RCE Messageboard's Regroupment
RCE Messageboard's Regroupment
PDA

View Full Version: RCE Messageboard's Regroupment

  • Reverse Software Engineering help & support
    • The Newbie Forum
    • Packing and Unpacking Forum
    • Advanced reversing and programming
    • Rce Cryptographics
    • Tools of our Trade (TOT) Messageboard
    • Mini Project Area
    • Off Topic
    • Linux RCE
vBulletin v3.0.7, Copyright ©2000-2005, Jelsoft Enterprises Ltd.


The Newbie Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum
PDA

View Full Version : The Newbie Forum

Pages : [1] 2 3
  1. Help a newbie please
  2. newbie prob with reversing an ipaq app
  3. help please!
  4. I`m going insane with Tabledit 2.60d
  5. BillPro & OllyDebug
  6. Question about 1mcrypt with cro for fle*lm v7+?
  7. Remove a VBox 4.3 protection
  8. delphi for newbie help
  9. ollydbg help
  10. Programs similar to TMG Ripper?
  11. Complete Newbie
  12. newbie Q: convert assembler 2 hex
  13. Delphi (SolSuite 2002, 12.0) too hard for me?
  14. VBOX v4.5 - Corel WordPerfect Office 2002 Trial
  15. Good newbie target...
  16. remote anywhere 3.8.26 troubles ???
  17. How to Unpack *.msi file?
  18. PE Explorer reversing
  19. can't resize or add new section
  20. installshield or msi ?
  21. TCL code in an EXE? Duh?
  22. CrackMe
  23. Question about Internet Download Manager v3.0.7
  24. newbie Q: far jump?
  25. annoying ads
  26. button enabling delay
  27. How to patch an encrypted dll after it's loaded?
  28. help on delphi
  29. Problem with "Dongle" prot. App...
  30. annotations
  31. Delphi counterpart to RegQueryValueExA?
  32. SmartCheck...no, not a TOT topic
  33. Newbie Roadblock, some help please
  34. DOS-Kernel Cracking Question
  35. Disabled Save Function / Hidden RegWindow
  36. G6 ftp tutorial
  37. Destruction of Listbox Hscroll?!
  38. Hardware ID based serial number
  39. a forever farewell to vb nag screens
  40. Problems when patching an executable
  41. Does there tools to spy Hardlock-Server exists?
  42. Help needed !!! [cep2reg.exe]
  43. is XOR mathematically distributive ??
  44. Reversing an UPX-packed program
  45. Newbie need help...
  46. VxD spy
  47. Convert memory to string
  48. Webextractor questions
  49. FlexLM 7.2g
  50. Question about KERNEL32!LockResource.
  51. looking for a VB3 compiler
  52. How can a COMPLET newbie start??
  53. Greetings from amateur reverser
  54. Vbox 4.6.2 on Coreldraw 11 - LAME
  55. bpx lc_init
  56. Strange crypkey target
  57. help with Cyberlink powerdirctor 2.0
  58. crypkey
  59. anybody try pop*3*hot yet?
  60. Reversing CD Phone Book
  61. complete nube - can't load symbols into SI
  62. Code Injection (plz help)
  63. easy but how ?????
  64. Greetings on the board,
  65. How To defeat EVER Lock Protection
  66. Assembly comparison??
  67. Serial Fishing .... but not trivial !
  68. Nice article
  69. Please Help w/ FoolFox Tutorial
  70. Need help before i go nuts!
  71. Help with DeviceIOControl function
  72. unpacked proggie
  73. Nag problem
  74. anyone have a IDS file(IDA Pro) for wince ARM mfcce300.dll?
  75. uk info & ckinfo ??
  76. Office patch
  77. TButton Property
  78. Reversing games
  79. Need help with debugging
  80. Test Eax,eax ???
  81. logging a SI trace to a file
  82. Need nfo about dongle
  83. Has anyone worked on AEA products?
  84. Sandman's Reverse Engineering site
  85. Is there a "Signature" for SentinelLM 7.2 protected programs?
  86. +puark's never written articles
  87. Interesting book
  88. Cyberheg SuperPro Shell Tuts help please
  89. Identify the target
  90. InstallAnywhere java install program
  91. flexlm (hard to explain)
  92. Reversing CD Phone Book PART II
  93. ISS Realsecure 6.5 iss.key protection
  94. Where is the Mark ??? (CrapKey)
  95. Import Address Table patching
  96. Changing page table entry flags
  97. WinXP Cracking problem
  98. #i need target program for reversing training
  99. Licence file
  100. hidden forms of program
  101. Searching Games
  102. Links
  103. FLEXlm - no imported functions
  104. Reverse Flash (MX) Code
  105. Interlok LM, someone experienced with it ?
  106. insufficient memory free error
  107. HASP v4.13 - Bysoft
  108. DVDXcopy 3.1 Removing "Features"
  109. IDA Delphi strings recognition
  110. How to create one section EXE from a multi section exe
  111. How to activate (unhide) options???
  112. MUST READ for noobee!
  113. Indentifying my FlexLM-Target !
  114. Anybody have experience on cracking dotNET applications
  115. Sentinel Super Pro
  116. Really my first steps ?
  117. cant find address range
  118. Need help
  119. EXEStealth - SPOILER - Unpacking!
  120. Armadillo tutorial link ?
  121. help a newbie...
  122. norton antivirus 2003
  123. file access
  124. Debugging a .NET application
  125. Help getting back on track..
  126. How to reverse a DLL without .exe (Matlab)
  127. KeyGenning Internet Download Manager v3.12
  128. diffrence between f11 and f12 in sice
  129. Problems with Softice detection
  130. compressed data in files?
  131. How to find referenced strings pre-loaded by DLL's
  132. GetModuleHandle return value
  133. safecast..autodata..
  134. Add a new function to a dll
  135. "call eax"; needle in the haystack
  136. flex8.1b
  137. Ok... COMPLETE n00b here
  138. How to know where I am
  139. St4rsh1ps Unl1m1ted 2_3c
  140. A strange question (bytes)
  141. Thoughts Required
  142. help with asm source
  143. ReadProcessMemory vs. WinXP
  144. Tracing into IIS
  145. In IDA Pro, how can I found the machine code of instruction?
  146. In IDA Pro, how can I modify a instruction?
  147. No CD
  148. Flex Lame Tuts
  149. Command line switch routine
  150. differents offset between hexworkshop and Softice
  151. Resource Editing
  152. Insert some functions
  153. Flexlm 8.1a another challenge!
  154. Is it possible to remove DMA from a program?
  155. Wise Installers
  156. *slap* n00bie
  157. reversing a 16-bits dll
  158. Crypkey??
  159. OllyDbg..
  160. Fileopen Pdf encryption
  161. How to set bpx on Save?
  162. Hardlock, fake or really implemented
  163. HELP : Sice in Windows .NET
  164. Need some HASP-Dongle targets...
  165. time trials
  166. function disbaled
  167. Did someone say...Dongle?
  168. Armadillo System Time Clock
  169. Request Suggestions
  170. MFC VC question
  171. Serial fishing with Softice
  172. where to get best tutotrial on serial/unpacking,etc?
  173. Hacking a keyboard driver...
  174. problem pl..... help
  175. Super Pro Lesson Learnt!
  176. haspms32.dll && Target, need help pleaz
  177. appforge 3.5 serial fishing
  178. disassembling a console app
  179. How to find Offset
  180. CDQ and IDIV Help
  181. Keygenerator,patching, etc
  182. Adobe Acrobat Not Working After SICE !!
  183. Sentinel Super Pro Need Help
  184. Opera naughty? ( -> Hybris virus)
  185. How to Trace Our Module
  186. api getwindowtextA
  187. Add .res to exe
  188. Total time used
  189. Api Spy & Api Mon Terminate Process
  190. How I see the crack file source
  191. Problem with win32dasm
  192. Win32dasm hasn't been updated in a while...
  193. replacing hiew
  194. EIP of the program
  195. SERIAL FISHING Problems!!
  196. Anti-Olly
  197. interesting target(s)?
  198. Win32 PE File - GUI
  199. SICE Detection on 'GETRIGHT'
  200. Question about RCE_CD
  201. Olly tuts
  202. Searching the windows “wrong serial” under softice
  203. to understand a break and a API
  204. Strange HASP check
  205. Audio plugin (VST)
  206. Hiew and a tutorial
  207. Softice nt setup questions
  208. cracking xp, 98............
  209. Copying keymaker ASM from Win32Dasm
  210. Key- GeneRaToR HELP!!!!
  211. Tut Rqst, Please Read b4 Flame
  212. how to....make a buffer
  213. What is it doing?
  214. dll unpacking
  215. Question on some code.
  216. Shockwave
  217. REQ: SLK symbplic link file format
  218. a stupid question !
  219. Java bytecode debugger?
  220. Tutes on HMEMCPY
  221. armadillo + aspro 1.2
  222. Hasp4 Flash utility
  223. PortTunnel v1.6.14.211 - Keyfile protection & Packer $ Unkeygenable ???
  224. this one is a tuff 1
  225. VB help file?
  226. VXD vagaries
  227. Sentinel emulation
  228. damned bloody SI modules....
  229. CD protection
  230. DilloDumper error?
  231. Dos fun
  232. softice
  233. Runtime patching...
  234. i wanna change this thing... please help !!
  235. DialCops Protection
  236. Winamp 5 - how hard is this?
  237. Loader how-to: a few questions
  238. Help me have a luck !
  239. HASP4 envelope problems
  240. help me about microdog (dongle)
  241. question about rebuilding IT of dumped program (finding/fixing unresolved)
  242. HowTo Enable Text/Field Box
  243. Cast Lighting Wysiwyg, sentinel protected
  244. Windows API
  245. Need help changing an email addy in a packed library
  246. Stuck with an App
  247. String refs for a VB prog in IDA?
  248. Hardlock Envelope Question...
  249. Linux FlexLM....starting from the past...
  250. Reversing an unknown image format?


Packing and Unpacking Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum
PDA

View Full Version : Packing and Unpacking Forum

Pages : [1] 2 3 4 5 6 7
  1. Is this our new home, +Sandman?
  2. Reversing Query - Please Help!!! (BTW first RCE query on the new Board) ???
  3. Greetings for all of you, infos on this place
  4. what happened with the eassy's search engines?
  5. REKML subscription
  6. +Sandman Re-painting
  7. To +Sandman
  8. Dongles?
  9. disassembly...
  10. WTF??
  11. Mini Project Area - Now Open..
  12. Job Opportunity for Reversers
  13. getting started
  14. some reversing questions
  15. Cooledit // wincommander...........
  16. aspack help
  17. Bit-Arts SoftLocx 5 Mutant Engine
  18. Breakpoint problem
  19. FileMon
  20. BPX on a button??
  21. resources section study
  22. How to retrieve values on the stack with SoftICE
  23. Help - I floating away
  24. Help with unknown packer
  25. vdat 2.000.2
  26. Screensaver password dialog
  27. Merak Mail - Warning, Warning Will Robinson!
  28. newbie Help!!!!
  29. Newbie, Help with Soft Ice!
  30. API Moniter -- Help ???
  31. Reversing high-level language sources
  32. how useful is dede?
  33. Why does imp_list say "error read MZ-header" ?
  34. The rocky AsPack/AsProtect road...
  35. tut search engines?
  36. a little help wit softice plz
  37. is api monitor better than filemon/regmon?
  38. <b>Question about ASM instruction?</b>
  39. comparisons
  40. CRC check reversing -- Please Help !!!
  41. help with softice pls!!!
  42. Inadvertent Filemon/Regmon Antidebugging Trick?
  43. Request for assistancemfc42.dll and license dll's!?
  44. off the subject
  45. Can anyone send me a copy of "win95rk.hlp" ? Thx!
  46. Very VERY new to the scene and would appreciate any and all pointers =)
  47. looking for orgpaks(complete,not only text)
  48. RCE CD
  49. newbie in town
  50. How can i catch lookups in ini files ???
  51. 'bout NE File Format
  52. Demo Shield reversing
  53. Help me with IDA
  54. Message for Clandestiny
  55. Help cracking PaintShop Pro 7
  56. Cracking of Dyno Datamite
  57. SoftICE and IDA
  58. How to let W32DASM show ref. string for VB program?
  59. how to tell which packer used on *.exe
  60. working on a packed file
  61. please answer my question below (offsets)
  62. Completely off topic...
  63. www.litespeed.org (formally website from CrackZ )
  64. Cracking a DLL Driver
  65. RCE Archive CD
  66. C
  67. Help with Backtrace in Soft Ice
  68. VB source patch
  69. How do you disable softice ?
  70. Is there a patcher to hide softice 4.05 ?
  71. Hello!
  72. Is there a way to break on a Register access?
  73. Need help with Delphi target
  74. UserList Component.
  75. SOFTICE is writing to my disk!!!!
  76. question to sandman (or any1 in uk with RCE-CD)?
  77. sorry for these dumn ass questions but i just dont know??? pls help
  78. Is there any documentation on the services of NDIS.VxD ?
  79. Anyone in China with RCE-CD?
  80. softice help please!
  81. Logical.exe
  82. A Win32 Asm Problem --> Need help !
  83. Logomanager 1.1.71
  84. Help with Ultra Edit ver 7.20a
  85. unbox 4.5
  86. Anyone know of any Tutorial Search Engines?
  87. RCE-CD Download
  88. softice and SiS530
  89. Dumping/Unpacking???
  90. what is a watermark??
  91. How would I do something like this?
  92. Site down for several hours ?
  93. Unpacking API Spy v2.5
  94. REPNE SCASB ?@$#!
  95. Juz to say hello ,Merry xmas and Happy New year
  96. Q about l0phtcrack crack
  97. Is there a new project about newbie-reversing like BakeHead?
  98. somthing weird with my softice or..
  99. Another newbie.
  100. encrypted .exe?
  101. People of the Planet Earth
  102. hacking for reverse engineering purposes
  103. Correction to messsage above!!!
  104. X AMIGA CRACKER/CODER needs a mentor
  105. Softice 4.05 and WinME
  106. Segments and offsets
  107. Hacking Sim Theme Park that has Safedisc protection
  108. Command Line Argument problem
  109. Help me with Ida!!
  110. new wannabe reverser got a Q. for anyone who can help me please
  111. Where down softice 4.05 Build 526?
  112. ms access database - registration code cracking
  113. InstallShield Package for the Web
  114. Stupid win (or maybe i am :)
  115. I get a red screen when softice jumps.
  116. Tool Question
  117. RVA ???
  118. newbie download
  119. Yay! found this again
  120. Portable executables
  121. Off Topic: Spam Problem
  122. Disabled Button on VB 6.0
  123. Where do I start???
  124. Icdump (tracex)
  125. Is it possible to insert code?
  126. Finding out which .DLL...
  127. OCX's
  128. PDA's?
  129. FrogsIce - How to Set It Up?
  130. SmatCheck Tutorial ...Where to find ?
  131. VB API's What the heck are these ?
  132. new newbie
  133. Installshield CABS - uncompressing/adding to/recompressing question.
  134. unpacking
  135. Reversing CD Is it OK to "burn"
  136. Adding code
  137. Some question about sice
  138. Flexlm 6.1
  139. Tracing into Dll's?
  140. .prf files? (maybe hehe)
  141. Font
  142. If you can provide the URL, why not?
  143. Wdasm won't disasemble
  144. hmemcpy
  145. Ripping CD's
  146. Cant Find software
  147. Unix Gurus - HELP!!!!!
  148. Registering an app with no register dialog
  149. Eternal Bliss tut 35!Need solution for ??
  150. Advice about win16 apps
  151. How to bypass old floppy protection?
  152. How to generate flexlm 6.1 license
  153. password sender?
  154. Where to find tut for manual unpacking Of Pecrypt 1.02 Or how do you do it!
  155. CAN SOMEBODY HELP ME--I WANNA TO CRACK TRIALS AND I NEED HeLP
  156. New Crack tuts added
  157. key
  158. softice no-cd tutorial
  159. Enabling "Save" function + linking to code
  160. How to get the oFFset in Ida!
  161. Sice: Source & Symbolic Level Debugging ???
  162. Bhrama server problem!????
  163. What type of VB6 protection is this?
  164. PC Games.....And how to find out what cd protection they use....
  165. Help-running out of paper- Can anyone help with a 16bit prog. my brain cant get round?
  166. Cracking with Softice
  167. Logomanger 1.1.8
  168. who can crack SR3.6
  169. Name/Password for VirtualGirl 1.54???
  170. Signlab 5.0 rev6.2
  171. Could use a hand with Registry Drill
  172. When tut's go amiss?
  173. Fatal errors
  174. ASm help!
  175. Does anyone know where to get unpacking(full) Miz+Sandman project!
  176. Ultraedit 8.00
  177. can't crack newer version using older version tuts.
  178. Timelimit...need suggestion
  179. Info about keyfiles
  180. Help with manual unpacking!!
  181. What Happened to #Cracking4Newbies ?
  182. Password encryption used by Windows/Outlook Express
  183. Softice problems
  184. aol
  185. Need more help on this TimeTrial
  186. softice-win me
  187. Please help with unpacking
  188. An old crack
  189. Immunity of SoftIce Breakpoints???
  190. Memory places??
  191. Little CrackMe
  192. A self-introduction ...
  193. BackTracing? Any Tuts or info?
  194. Unpacking tuts for Newbies
  195. ASm help!!
  196. I know, VERY basic, but ... How do you identify a VB app?
  197. Is it possible to detect SoftICE by IsDebuggerPresent( )?
  198. Anonymity challenge for a newbie
  199. My new SI essay...
  200. Somebody tried out the new CASPR yet?
  201. 2 Questions/1 kinda OT
  202. Elimanating the protection in MAD - Globalthermonuclear War
  203. Webpage-Passwords
  204. Ra2
  205. Something Strange with Asm!!Help Please!
  206. Game cracking
  207. ?????????
  208. Having problem with antidebugging tricks..
  209. some vbox-help needed
  210. Would like to download the RCE cd
  211. Cracking Delphi programs with DeDe
  212. Believe me or not :)
  213. Art of Assembly which chapter do i have to know?
  214. old games
  215. anybody looked at accware? (by icode)
  216. Stupid Newbie Question!
  217. sice
  218. Unpacking ???
  219. r2v by ablesoft 5.5.002 help please
  220. How can i see the source code of a webpage?
  221. Searching 4 ??
  222. something different
  223. Too Close To The Bone ???????????
  224. Unpacking without Soft Ice ??
  225. Sice problem (sorry about earlier post)
  226. offset
  227. Really newbies probs
  228. SoftIce problem... VxD error on Win98
  229. Boson test exams
  230. viewing the stack in SICE...
  231. Save function in MFC generated program
  232. InstallShield script cracking: SETUP.INX, not SETUP.INS
  233. 2nd gear
  234. sice prob... :/
  235. need helpwith x-plane
  236. SICE
  237. hmemcpy breakpoints
  238. BIG SICE Problem
  239. widecharstrings in w32dasm ?
  240. GetDiskFreeExa - is this the right syntax
  241. cd cracking
  242. I would like to start RE'ing, where do I begin?
  243. general unpacking question
  244. bpx problem
  245. Help Please with rtsoftware keygen protection
  246. InsideTheWeb Shutdown (for those who remember the old board)
  247. SICE problem with Win2k SP1 ?
  248. Disabled functions
  249. TRW2000
  250. Newbie question about Unpacking/OEP


Advanced reversing and programming
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming
PDA

View Full Version : Advanced reversing and programming

Pages : [1] 2 3 4 5
  1. Welcome to the new board ;-)
  2. Congratulations and Thanks...
  3. Very cute. My compliments
  4. moderator's name
  5. A lot of more to do...
  6. Nice new interface...
  7. The Newbies Forum Shut Down Again
  8. YAY!!!!
  9. Hi Revesers,Nice board,WOW
  10. May the Schwarz be with you
  11. FWIW - help is not functioning
  12. Ok , first rce topic : asprotect 1.1
  13. What happened to newbies forum relocating here?
  14. The sandman's newbie forum
  15. NVIDIA Detonator problem
  16. Thanks +Tsehp, problem solve Isp problem :)
  17. Any unpacking guru please help
  18. Question to +SandMan
  19. CommView 2.3 and Asprotect memory patching
  20. +fravia
  21. A small suggestion
  22. help me out plz
  23. Seems to be another ASprotect Version
  24. Code injection problem
  25. Request for comments---Do you like the colors ?
  26. Geforce -> Quadro modification in software?
  27. browsing list-a question to +Tsehp
  28. CGI reversing?
  29. Have S-ICE detection, Need Help. Am Confused.
  30. Legitimate lob opening for Code Reversers
  31. ASProtect and we, reverse engineers.
  32. Another question to +SandMan (i'm so proud ;p)
  33. Find vendor string in flexlm
  34. WAKE UP +SplAj.....KNOCK, KNOCK ........FOLLOW THE WHITE RABBIT......
  35. Corrupt CD-R
  36. Crypto
  37. REKML Links
  38. FlexLM reversing
  39. A simple question concerning an iat rebuilder
  40. magic with 0F9x (intel errata?)
  41. VBox v4.3 .DLL Help
  42. Another hacking contest fo0r money... (Not sure if I nshould post this...)
  43. floating point and si
  44. exemplar question?
  45. Aarg
  46. Hooking modem comunications
  47. Temporary topic for Disavowed
  48. +Tsehp -- Search Engine ???
  49. Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations
  50. Ou how nice.
  51. Help needed
  52. To whom wants to crack flexlm.. :)
  53. No Code, Help!!!
  54. still trouble. me stupid.
  55. Problems!...
  56. Need a newer version of AsProtect decompressor
  57. How to know what a ASM instruction is in HEX
  58. Use an assembler ;-)
  59. paint shop pro 7..
  60. If my proggie...
  61. Thanks 4 the help guys (Solomon, Notme (risc)
  62. DDB help .. please!
  63. Where can I find CD-Check CrackMes ?
  64. New ASProtect again ?
  65. Tutz about menu enabling?
  66. Thxs men !
  67. Adding some tracing features to a c++ program (iat rebuilder)
  68. Looking for "The Art Of Assembly"
  69. daemon tools against safedisc on win2k
  70. [b]Help with ASM Instruction Please![/b]
  71. Laz's vb5 dll patch?
  72. Check out the new Sudden Discharge
  73. Flexlm & REA*V*Z
  74. New essay on cryptography
  75. CD copying hardware protection?
  76. NT internals questions
  77. Vbox 4.5
  78. Help with breakpoint on RegQueryValueA
  79. Soft-Ice Mouse problem
  80. Looking for Orcpaks (complete,not only text)
  81. Coding a Trainer: Hotkey problem, please help :)
  82. OllyDbg, a new cool looking debugger!
  83. Why the silly "posturing" ?
  84. Big Brother is reading: cryptography in the digital world.
  85. Modem Hooking - In trouble again...
  86. Acroread plugin hacking
  87. owlbook.htm
  88. CopyCrypt
  89. SWmartCheck
  90. Help me with IDA
  91. Help cracking PaintShop Pro 7
  92. Rediscussing old targets (to macilaci and +Tsehp)
  93. Time limit disabled save and print
  94. just here
  95. Strong Anti-debugging, Anti-FrogsIce
  96. For Nolan Blender - Vox Quiet
  97. Softice Help from a pro Please
  98. Req: Realworld downloadable FlexLM Targets that make use of the new 7.x tricks
  99. heh, on the subject of anti debugging....
  100. MicroSentinelUX
  101. Big Problems @ my Australian fortress
  102. question about offsets?
  103. broken links in the essay by CyberHeg at +Tsehp mirror of fravia
  104. Winice Reversing
  105. working on asprotected file
  106. winice question about overclock
  107. Thanks to Arthaxerxes
  108. More on code injection
  109. +tsehp
  110. Code injection under DOS in WinME
  111. Is it asp-protected ??
  112. tracing exception handlers in NTIce
  113. VBcracking
  114. Sentinal LM ?
  115. Newbie in need of help
  116. Some really good news...and asking for help
  117. W32dasm disassembled: dead link?
  118. mb suggestion: Reverser statistics, bloody paranoia.
  119. Can someone kindly show me a tutor how to unpack packed dll(VBox)?
  120. Hmm.
  121. Help with achilles'shield 3.0.........
  122. Install Shield 6... + Dongle Protection
  123. Interesting Topic
  124. icedump re-assembling
  125. Getting ImageBase from inside the process
  126. Help with Backtrace in Soft Ice
  127. How do i create long flexlm license keys (with 20 chars) ?
  128. Advanced Call Center
  129. Breakpointing Winice
  130. flexlm vendor key question ...
  131. Anything new on heh, on the subject of anti debugging....
  132. Building lmcrypt with Borland C++
  133. PW hashes and Active Directory
  134. lmkeyfil.c ...
  135. How to manually unwrap/unpack Elicense-protected prog's.....
  136. Bitarts Fusion/CCrunch
  137. to +tsehp: Broken link to essay
  138. Aldec HDL cracking ... Flexlm ... need some pointers ....
  139. CASPR sac.home-page.org gone?
  140. Patch file but leave 'modified' flag same
  141. Question
  142. UPX Unpacking
  143. Praise for r!sc's Asprotect Deprotector v0.6 (rAD)
  144. Keygenning!
  145. native API on Windows NT4 (NtOpenThread)
  146. To laptoniC.... Thanks man !!!
  147. ftp client
  148. CrackZ reverse engineering site: Location of a tool?
  149. another kernel debugger?
  150. a SetThreadContext & ERROR_NOACCESS problem
  151. RSA keygenning
  152. Flexlm signature files or Flair Toolkit for IDA Pro
  153. Anyone have any experience with this, know of a tutorial on it?
  154. Lotus Notes "user.id" bruteforcing
  155. Help with Ultra Edit ver 7.20a
  156. mentor mgcld
  157. a public question to the owl, concerning a tracer
  158. Für deutsche Leser nur..
  159. W32Dasm and Win2k
  160. Flair toolkit ... how to make signature files from dll
  161. SoftlOCX v5
  162. My last question about RCE CD
  163. What is this target Packed/Encrypted with?
  164. UPX Unpacking .dll file
  165. Clipper 5.01 dongle cracking
  166. slm flirt sigs and ida dll problem
  167. need some targets to test the iat rebuilder
  168. java : PE & .class
  169. Site down for several hours ?
  170. Does someone knows how to emulate CreateRemoteThread on win9x ?
  171. WS Cad 4.0 + WIBU-Key
  172. slm question (yeap another)
  173. Christmas!
  174. Slashdot embarassment
  175. VB4 pcoded program how ?
  176. Help with API Spy 2.5 plz (process patching)
  177. Need mentor. Will work hard. Anybody bite?
  178. HVIEW vs UltraEdit vs HexWorkshop.
  179. Hex Workshop 3.11 Help
  180. VB troubles
  181. Italian dongle
  182. SENTINEL DRIVER --> WITH MONEY !!!!
  183. MFC reversing
  184. Manipulation of folder's content.
  185. Renaming files
  186. Java Reversing
  187. Happy New Year Everyone!!
  188. Analyze self extracting sfx exe
  189. Problem with packed EXE
  190. Incredible! SuddenDischarge.com trial has expired!
  191. IAT resolver beta test starts now
  192. Attn Quine
  193. some problems about latest version of winace
  194. BlueScreen coding
  195. Woww...1'st Post
  196. Retrieving VBox'ed DLL - Any ideas?
  197. Linear Address
  198. Multiple Crunched files.
  199. http://sac.yeah.net dead?
  200. New I6Comp released.
  201. Realbasic programs any experience here ???
  202. .msi
  203. A sidequestion
  204. I get a red scren when softice jumps
  205. CORE keygened CloneCD v2.842!
  206. another target...??
  207. FLEXLm 6.1 - question
  208. SHDN 4.12 Neolite compresion !
  209. C-Dilla LM
  210. Downloading from Sandman
  211. psx, psx2, and dc gamz
  212. Win32 Asm
  213. Silicon Graphics Unix Flexlm
  214. feslw30.dll crack
  215. a thread handle problem
  216. new Aspack/Asprotect keygened: RSA-1024 bit broken? Huh?
  217. :)
  218. Need help with HASP
  219. java reversing tutorial for beginners
  220. ASPROTECT v1.1+
  221. DEBUG using Softice: Softice look for abort.c atoi.c etc... (Win32 console program)
  222. Advanced RSA, ECC and crypto keygenning...
  223. Encryption Lite
  224. Thread and DEBUG context
  225. tutorial by sandman. winzip self extractor
  226. Everkey Protection
  227. Is there any reference or essay for hasp dongles under DOS?
  228. FLEXlm for NT
  229. tutorial on making serial numbers for programs
  230. microsoft's new anti-piracy scheme for whistler
  231. What's THUNKING guys?
  232. (urgent)Windows ME systemfile protection ?
  233. Flexlm Crypt Filter ??
  234. PM Question
  235. 2 Black Check
  236. MSloopback LAN ID
  237. keyboard hooks
  238. +Tsehp -- fravia search engine ???
  239. emulatore
  240. VB6 apis. Where do I get info on them ???
  241. ESSAIS of CRACKZ
  242. Flexlm 6.1
  243. Cracking Tutorials
  244. Reversing an old dos target
  245. RSA Elliptic Curve
  246. License.dat?
  247. Star Force Protection
  248. wdasm crashing
  249. IAT, safedisk, frogice
  250. Problem with exe files under win2k


Rce Cryptographics
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics
PDA

View Full Version : Rce Cryptographics

  1. Cryptography ( As posted by EtErNaL_L0ser)
  2. Crypto api test problems
  3. a newb ie question?
  4. Rsa > 512
  5. Basics of Cryptography
  6. xtr help :[
  7. ECC and Flexlm
  8. TMG keygenme #3
  9. Cryptography's Shining Ciphers
  10. How to know which algo is used ?
  11. Secrets & Lies
  12. E changed to 1 in RSA algo.
  13. A challenge ?
  14. MD5 works but RIPEMD-160 does not work
  15. help on a llittle crypto mission : -)
  16. Inside Windows Product Activation (WPA)
  17. Beginners question
  18. RNG and relative primes
  19. Dsa
  20. rsa
  21. SecureID program!?
  22. Rsa Challenge
  23. Alittle bit of Encryption/Decryption fun...
  24. tE!'s RSA Tool
  25. Cryptography challenge ;)
  26. bit commitment blues ;)
  27. Easy RSA
  28. RSA cracker machine
  29. fun proof
  30. decrypting an unknown file type
  31. Challenge to all you so brilliant people...with motivation ;)
  32. why not decrypt in exe ?
  33. Analysis of ASProtect Keygeneration scheme
  34. Tutorial: finding encryption code
  35. need ideas on how to attack an Authentication and Encryption model I thought of
  36. Grille Me
  37. stream cipher???
  38. WinZip cipher
  39. new winzip attack
  40. Cracking w97 files
  41. Finding RSA Constants for keygenning...
  42. RSA Tool 2 v1.2
  43. Random Number Analysis
  44. Subexponential attack on AES
  45. prime number properties
  46. Encrypted Magic Folders
  47. Blum-Blum-Shub questions
  48. super-tiny PRNG
  49. public-key based Delphi components protection: SLockPK
  50. Blowfish Init<>set_key
  51. SHA-1 combined with RSA?
  52. What kind of encryption is this?
  53. hypercomplex numbers and RSA
  54. 8 bit CPU cipher
  55. Blowfish and SHA-1 analysis on cacheX
  56. i search Rsa-tools
  57. Help determining cypher...
  58. Searching RSA Protected Programs
  59. SSleay BIGNUM FLIRT sigs
  60. Encryption used in CRT
  61. RSA-Tool2 v1.7 Request
  62. Cryptic Formula Help
  63. SHA-1 protected program
  64. Need help with foxpro please
  65. $$$ for crypto weakness in a cool simple algorithm
  66. Blowfish Bruteforce 48 bits
  67. New project: RSA-65 analysis on GetDataBack for NTFS
  68. Um few crypto newbie questions.
  69. Interesting site
  70. Hash algorithm identification
  71. Bob and Alice
  72. JBuilder 7 and DSA
  73. Primality testing *is* in P - Proof
  74. Zip Protection Question?
  75. Marx Cryptobox
  76. Inside a MD5 (?) protected Java prog
  77. Pencil and paper decryption ?
  78. Encryption modes
  79. Data structure for big Integer
  80. Typical code sequence for encryption?
  81. unknown algorithm
  82. Blowfish
  83. xor protection
  84. BigNum Calc
  85. Question about ECC points addition...
  86. Call for Mike's comments
  87. Recognizing ....
  88. Tea
  89. ElGamal Signature
  90. help me on reversing hash function
  91. Ecdsa
  92. ServU Ftp Password Decryption
  93. NeoProject
  94. knapsack
  95. RSA-576 - Factored
  96. new primality testing algorithm?
  97. NeoProject takes on MD5
  98. bug in FGInt lib? (RSA)
  99. A nice intro to Cryptography
  100. IShield Single Exe password recovery?
  101. Attacking DSA
  102. recover RSA primes p and q if we have n,d,e
  103. des modified algo
  104. WINZIP Archive decrypt
  105. elliptic distribution
  106. Crypto Library Help Please!
  107. DES 40bit
  108. Little simple doubt in Handbook of Applied Cryptography...
  109. Diffie Hellman Key Agreement - Cryptlib???
  110. Could I ask u how to fix the problem in the mentioned keygenRSA.asm?
  111. Writing RSA keys to keyset - permission errors
  112. ECC questions
  113. microsoft drm
  114. Cryptlib - setting IV's
  115. Mind Challenge...(or not?!)
  116. RSA 576 factored
  117. Interesting Docs
  118. MD5 + some bit math
  119. Adobe DRM (Digital Right Management)
  120. miracle sig files
  121. simple rsa
  122. problem with rsa
  123. New in crypto
  124. link problem using MS Visual c++6.0 when useing Cryptlib
  125. Tiny Encryption Algorythm
  126. Windows DRM and WMV
  127. Safer-K128
  128. Acoustic cryptanalysis
  129. Lets put those graphic processors to use
  130. Decoding TwoFish Encryption
  131. Project RainbowCrack
  132. Okay, ultimate challange i belive
  133. got P,Q,D, how to compute E?
  134. Is it illegal to solve an RSA code?
  135. LFSR-based cypher analysis
  136. Will RSA-640 be solved soon?
  137. Cryptanalysis questions
  138. Complexity of HASH algoritm
  139. new article about ECC
  140. Man in the middle
  141. MD4/MD5/SHA-0 Dead
  142. RSA - More than 2 primes
  143. hash algo help
  144. RSA implementation
  145. Collision vulnerabilities in MD5 Checksums
  146. A little help in understanding some crypto
  147. How to implement
  148. Steganos Encrypted File and forgotten Password
  149. Article about next-generation movie/DVD encryption
  150. PSDS_Crypto (panasonic crypto)
  151. Article: The Misuse of RC4 in Microsoft Word and Excel
  152. Is this real ?
  153. Literal Bitwise Calculations
  154. Q:Number analysis...
  155. DES question
  156. ec problem
  157. Breaking a challenge / response algo
  158. XOR property (MD4/5 related)
  159. XOR equations :)


Tools of our Trade (TOT) Messageboard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard
PDA

View Full Version : Tools of our Trade (TOT) Messageboard

Pages : [1] 2 3 4 5
  1. _they_ will never stop you :)
  2. problems with smartchck
  3. icedump 6.020
  4. Erratic mouse movement in SoftIce 4.05
  5. Problems with version 3 InstallShield script
  6. Question about VB3 and S-Ice
  7. Decompiler
  8. WinME
  9. Ooops...sorry about WinME
  10. icedump pre6.020 + MS loader
  11. msi decompiler
  12. Adding a dll to winice.dat
  13. Wisd can't even decompile it's own setup.ins ??!!
  14. ElanLM/SentinelLM SDK needed
  15. Softice & Win2K
  16. Banning tools
  17. hmemcpy
  18. SoftIce
  19. Need help with APISpy32
  20. hard copy of softice trace buffer
  21. W32Dasm
  22. Newbie, Help with Soft Ice!
  23. about NASM
  24. released icedump 6.020 and nticedump 1.10
  25. MSI - Installer
  26. A new essay from ShADe - Patching In A Patcher
  27. regmon question?
  28. Please help me with FloodGate
  29. TRW2000
  30. http://www.microsoft.com/ddk/debugging/
  31. quick icedump question...
  32. Win2000 SoftIce Nt 4.05 Problem
  33. can't load icedump
  34. fooled by icedump
  35. prob: sice 4.05 with ne2000 / remote debugging
  36. SI loader doesn't always break at program start ??
  37. Softice vs Win Me
  38. Winice Reversing
  39. icedump 6.021 & nticedump 1.10 are out
  40. TWR2000 vs SoftICE
  41. I d/l ed the new "free" version of Opera...
  42. help me with nticedump1.8
  43. contacting protools ?
  44. FLEXlm v6.x *VENDOR-KEYGEN* from PGC
  45. Sourcer v 8.0
  46. Memory Upgrade - SICE Problem
  47. Ho to use Tracex and hydra ?
  48. HMEMCPY and W2000
  49. softice peculiarity
  50. filemon
  51. 2Morlac, autor of i6comp
  52. isDcc version 2
  53. Solid Works
  54. File kernel32.dll can't be accepted as module 'KERNEL32'
  55. unpacker that works w/ shrinker
  56. Reveal
  57. Site down for several hours ?
  58. Guillemot problems on Softice4.05 win2000AS
  59. softice 'n stuff...
  60. Softice 4 wont popup in Win 2000 :(
  61. debugging when online
  62. How to patch subroutine calls ?
  63. SoftIce and Windows 2000
  64. W32dasm and Windows 2000
  65. wme ddk
  66. My new video board and SoftIce 4.05
  67. [INFO] new forum for OllyDbg users
  68. Help with IceDump 6.021
  69. Quick Q on Caspr
  70. SoftICE configuration
  71. Analyze self extracting sfx exe
  72. Wdasm
  73. Crypkey Crack Tutor???
  74. IAT resolver beta test starts now
  75. Crypkey crack Tutor for mortals??
  76. new i6comp released.
  77. Dos cracking with Softice 2.8 someone help with disassembler please
  78. Softice 4 winice.dat problem
  79. SI with WinME
  80. Smartcheck
  81. DLL image/icon extracting
  82. Alternative To SmartCheck
  83. HELP -> DLL
  84. NVidia <-> SoftIce and win2k... working
  85. SoftIce breakpoints on offsets/RVA´s?
  86. Icedump
  87. RE: SOFTICE FREEZING
  88. IDA 3.85B is freeware
  89. Where Can I find Winfrog or Windowsc
  90. for IDA users
  91. Searching Mouse Hook
  92. NEED -> RSE -> RSC Editor
  93. IDA Question...
  94. VIRUS Warning
  95. perl/ java script
  96. Win ME "friendly" list ?
  97. Working WinDisassembler Download?
  98. to all the MSIE haters out there and those who like it
  99. -
  100. FrogsIce - How to set up?
  101. For people with more knowledge about Buttons!!VB!!!
  102. WDASM page faults with large files?
  103. IceDump : Tracex Pb
  104. Still seeking the answers.....
  105. Help with setting softice for a hercules secondary display
  106. wdasm crashing
  107. Where to find the unpacker for Telock 0.51
  108. Snatch you'r wrong
  109. Reply!!
  110. I need wdasm32 v8.9........... NOT 8.93
  111. Procdump and win2k
  112. Softice Screen Dump
  113. IceDump
  114. W32DASM hanging when opening Access Diver.
  115. Lord Caligo's Fantastic World of Cracking
  116. Bhrama server problem!!Help please!!
  117. isDcc2.1 is out
  118. How to get functions argument types in IDA. (ida plugIns programing)
  119. Disassembling GEOS files!
  120. Universal decriptor
  121. IceDump lame question
  122. john the ripper configuration
  123. Change SICE's hotkey
  124. Wdasm patch for "out of memory error" ??
  125. icedump 6.022/nticedump 1.10 released
  126. IDA x-refs question
  127. workhelp.hlp
  128. Turbo Debugger (TD32) and Symbols
  129. Setting bpx __vba breakpoints
  130. ?? SoftIce video setting under Winnt4 sp5/sp6a
  131. Install SoftIce
  132. How to let IDA recognize UNICODE strings?
  133. FlexLM SDK 7.2
  134. iscab for Install Shield 5.5
  135. New SI essay by yours truly, for all those who are interested..
  136. IDA pro v 3.7 demo
  137. Help!About Hiew!
  138. driver the game
  139. cd checker
  140. Windows2000 + Detonator7.52 + Softice + 16bit colourdepth == ok?!?!
  141. Frogsice problem
  142. SoftIce clears my breakpoints!
  143. Looking for FlexLM SDK v5.12 (I have another versions)
  144. IDA404 vs IDAfree4.1
  145. IdaG
  146. Icedump install
  147. Erratic mouse movement in SIce 4.05
  148. IDA Pro 4.15...
  149. first step with icedump...
  150. how to download ExDec?
  151. /tracex command problems
  152. problems with softice
  153. ...
  154. a tool...
  155. Where to start
  156. install monitor
  157. argument name propogation in IDA 4.15
  158. PHONE HACKING (NEVER DO A THING LIKE THIS)
  159. WinZip password cracker
  160. BRW problems w/ Win2K
  161. icedump v6.0.2.2
  162. Generating .nms files for regular debugging with Sice
  163. sice 4.05 messes w/ win2k gui boot?
  164. ldasm problem
  165. pdemon v0.21 Beta rlsd
  166. FLEXlm 6.1f (libmgr_s.a)
  167. HOW to reverse the code that generates the VENDOR_INFO string from the license key?
  168. winice.dat settings/customization
  169. Help!! AMD pracessor and W32Dasm
  170. Special Character in Feature name of flexlm license
  171. regmon & aspack
  172. funk'd up commands
  173. My only hero Nblender..not the cd key...sentinel key number
  174. User crypt filters.
  175. smartcheck vs winme
  176. break point
  177. Reversing spedia
  178. Softice Keyboard Driver for Win2k Build 2195
  179. Please: How to convert *.MAP/*.LST file to *.NMS?
  180. PrivateICE
  181. Running sice on vmware win98 guest
  182. IDA 4.00 & NB09 debug info
  183. some questions about flexlm6.1 on Solaris
  184. lmrand2.obj(FlexLM 7.2a) & Ida Pro
  185. SoftICE 4.05 / Windows ME / hmemcpy
  186. IceDump and W2k??
  187. shockwave tools
  188. IceDump and W2k still ain't got it yet.. :(
  189. SoftIce and Windoze Millennium
  190. Smartcheck help
  191. icedump crashes on original win95 since 6021
  192. Feasability of re-assembling Ida code
  193. Problems using revirgin
  194. SENTINEL LM
  195. API Functions in Windows ME
  196. How to get microsoft mapsym?where?
  197. SoftICE 4.05 + W2K
  198. To Carphathia about palmdeMON
  199. How do you force a complete installation of DriverStudio?
  200. To Carphatia : IDA vs PalmdeMON ?
  201. where can i find Trainer Engine v1.0 (c) odin?
  202. Problems running IceDump
  203. Win2k with SoftIce and Symbol Loader....
  204. help with NTicedump/NTfrogice and BSOD... please!
  205. PROGRAMMING IN ASM .......
  206. AsProtect...
  207. Win9x/nt Platform SDK request
  208. Win2k SDK
  209. Windows 2000 compatible debugger?
  210. Kayaker,come in...
  211. UNP problems
  212. Help With SoftIce's Trace Back
  213. SoftICE doesn't work on Windows XP beta
  214. help need sentinel lm sdk
  215. Problem with SoftIce and Windows XP beta 2
  216. Backtrace Logging (Where the HELL is that???)
  217. Softice Install! Need Help
  218. getting started with IDA need info
  219. BoundsChecker
  220. Win2k Multiple Monitor Problem
  221. Breakpoints in Win2K
  222. Breakpoints in Win2K
  223. TRW2000
  224. I request to change my Ethernet Address in my network card.
  225. Breakpoint format in Softice
  226. Please help with proper Softice breakpoint format??
  227. softice w/ win98
  228. Here is a good tool for ActiveX cracking: TLBDBG
  229. Problems with Soft Ice
  230. SICE - configuration
  231. trw1.23
  232. Softice DriverStudio with Win2k And NVidia
  233. Sice / hmemcpy
  234. musthave littlelearningtool :P OllyDbg 103 step2 with code hit tracer
  235. Using Special characters in SI breakpoints
  236. cracking tool for 3d studio viz
  237. ida function arguments
  238. hardware lock
  239. IDA Pro SDK
  240. sigmake ??
  241. Autoexec.bat +WindowsME + Softice problem
  242. boundschecker 'BCHK' interface patch offsets
  243. Need a beta tester(W32Dasm v8.93 patch)
  244. Win2k SP2 + Softice == Bad News?
  245. Where can I get the newest vesion of generatekey!!!???
  246. DevPartner Studio
  247. Some problem with proxies may arise here...
  248. IDA problems (or problems with me)?
  249. SoftICE and PFE?
  250. softice not showing up?


Mini Project Area
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area
PDA

View Full Version : Mini Project Area

  1. How about we get started....
  2. A Couple of Questions ???
  3. Recommended Software for Reversers
  4. Movin Pix - How to "unregister"? and more
  5. Registered, but how?
  6. Making progress...need a little asm clarification ???
  7. Guided steps for newbies(And my findings, all in a thread)
  8. Yipppeee!
  9. Asm function: Hex to Decimal ?
  10. Project ideas -Feedback plz-
  11. Here is the keygen code for Moving Picture
  12. Win32ASM keygen!
  13. Little project for newbies
  14. Merak Mail-great project! (feedback from moderators please!)
  15. New project: Magic File Renamer
  16. Magic File Renamer Patching tips and solutions
  17. Magic File Renamer Keygenning tips and solutions
  18. Try this one........
  19. The next project, and beyond...Feedback please :)
  20. another newbie
  21. Magic File Renamer
  22. Project # 3
  23. Project # 3 TASKS 1 & 2
  24. Project # 3 TASKS 3 & 4
  25. Unusual UnPackMe
  26. Project #3 - Question to Kayaker
  27. Pls clarify
  28. Task 4 CRC hints
  29. TalkPCR Key File Project
  30. newbies responses to the projects
  31. TalkPCR is it dead?
  32. Lets start another project or something. Ideas welcome
  33. Menu Enabling Project
  34. Desperately needing help on a VB6 project
  35. Great Project
  36. Menu Reversing Project
  37. Great Board - Could it be better?
  38. Possible project here...Multiple tasks involved!
  39. Scally Returns with a poss. project
  40. Ideas For A New Project ???
  41. A New Project (Unpacking, Nag, Keyfile & More ;-)
  42. A little mini project
  43. Crackme using a different approach
  44. A New Project?
  45. Harlequins Task 3 Challenge
  46. It's Easy-Level... Everyone have a try...
  47. A new class... join now!
  48. Novice-Intermediate Dumping Challenge
  49. Lesson #2.... Lets Rock!
  50. Messin' with the Import table
  51. Keygen and Banner Removal - Newbie/Intermediate
  52. very mini project :-D
  53. Snood!!
  54. Lesson #3 kiddies
  55. GDI Reversing
  56. What do you want to see in this forum?
  57. VxD Keygen Rip
  58. Steganography
  59. challange ... ;]
  60. VB6 Crackme Practice
  61. An simple name/email/serial crackme
  62. Is it really that tough? ;)
  63. an simple crackme #2
  64. Crackme #3
  65. Decompiler Discussion
  66. Crackme #4
  67. A little project...
  68. Rather Very Easy VB Challenge...
  69. Newbie Crackme
  70. VB Decompilation...
  71. My New KeygenMe --- Give it a try ;-)
  72. Crackme #5
  73. My Challenge To You
  74. int 20 (hinte's crackme #6)
  75. Whoohoo... Anyone wants to get a go at a KeyGen?
  76. Crackme #6
  77. time for a new mini project?
  78. Selftest for Crackers
  79. CRypkey Studie for Newbies Peoples
  80. Honeynet Challenge (With Prizes)
  81. Newbies4Newbies Crackme Discussions
  82. Crackme based on algorithm I found
  83. Newbies4Newbies Crackme Targets
  84. Newbies4Newbies Crackme Solutions
  85. Crackme Newbie Classics 2-4
  86. Lamecrypt
  87. A Classic LaZaRuS / +Sandman Cracking-Challenge Forum
  88. Little VC/PE help ;P
  89. reversing "system tools" under w98
  90. try this crackme
  91. New Moderator
  92. adding functionality project...
  93. bsod
  94. Crackme 3 crashes under win2000
  95. new crackme challenge
  96. Flat button in Delphi
  97. Regshot (registry snapshotter) menu separators
  98. Netware 5.1
  99. How to customize menus ?
  100. floating point crackme challenge
  101. uic strainer...
  102. help with this crackme
  103. Krypton 2
  104. Krypton v0.4 unpacking contest :))
  105. suggestions and thoughts about a new project
  106. a crackme of sorts
  107. How to write program for tracing OEP?
  108. RSA Mini Project
  109. Good, fun, Cracking for newbies!?
  110. CoDe_InSiDe's "checkit" crackme
  111. just another simple keygen me
  112. IDC script project
  113. ddk *grr*
  114. Code Injection with Code Snippet Creator: W32Dasm + Mouse Wheel support
  115. Reversing our own tools
  116. 2 Easy proggies for Newbs
  117. Brute force exercise
  118. Reversing our own tool: HexWorkShop
  119. A little challenge (maybe?)
  120. To solve crackme without using debugger.
  121. crypto crackme thought experiment
  122. crypto thought crackme #2
  123. crypto thought crackme #3
  124. Project Idea : Modifying MSN messanger
  125. crypto thought crackme #4
  126. Crazy Idea Time (Kernel Level Debugger)
  127. crypto thought crackme #5
  128. Genetic Algorithms? Debugger Attack? - Brute force exercise part II
  129. few Ideas
  130. K-Protean v1.0: anti-bpm, anti-bpx, anti-traced, anti-frogsice...
  131. launch.com hacking experiment
  132. CyberHeg's sentinel crackme
  133. Terminal Dogma: "the whole crackme is ANTI trace!"
  134. Pseudo_code Exersize
  135. Who will help the commander of the ESS Stargoose?
  136. How to write a keygen ripping the original asm code
  137. Help me Unpack this Packer!!!
  138. Project idea with safedisc
  139. trickie Depli Keigelme
  140. CrossWord puzzle
  141. windev crackme
  142. Driver reversing and defeating (WDM, not VXD)
  143. Reversing our M$ game: Minesweeper
  144. adding functionality
  145. auto.search.msn.com/response.asp
  146. Patch...!? Debugger approach...
  147. Need help in this crackme (delphi project)
  148. Remove NagZo!
  149. Crypto crackme: MD5 + DES
  150. LoginBox
  151. VB Keygen-me
  152. Crypto crackme: Rijndael
  153. crypt crackme:blowfish
  154. 1 byte puzzle
  155. simple crypt crackme:twofish
  156. GetProcAddress
  157. decompile_me ;-)
  158. Unpackme
  159. simple crackme without validation button
  160. a crackme without comparing string
  161. How to unpack file packed with "EncryptPE v1.0 CnCrkGroup PE·"?
  162. Simple crackme, find solution without patching...
  163. Little BruteMe ex.: Genetic Algorithm
  164. Changing notepad's background color
  165. Unpacking project
  166. Adding Functionality to Printer Drivers
  167. Low Level Graphics Programming Project
  168. Armadillo unpacker
  169. Mini Research Project (Crackme) - 25/Sept - 11/Oct
  170. A new PE editor!
  171. C++ Object editor
  172. "brand-new-ways-crypted" crackme for new year!
  173. Evaluator's crackme#2
  174. advanced Crackme
  175. KeyGen-Me Crackme
  176. Newbie ReverseMe
  177. odd behavior in a keygen crackme
  178. No Oldie: How to hide Regmon?!
  179. Question about Nag's


Off Topic
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic
PDA

View Full Version : Off Topic

Pages : [1] 2
  1. Help needed with UPX protected program
  2. Efnet servers
  3. New interesting Kris Kaspersky books...
  4. Welcome Back........
  5. Networking project
  6. New contest on anticrack.De : CPU emulator.
  7. FAO Woodman: FAQ link borked...
  8. Interesting project? InstallShield Script Emulator
  9. Using drivers to patch and hook other code
  10. Who are the new "+" ?
  11. Code Patch Creators
  12. Why is the Fravia mirror redirect URL point to this board?
  13. arthaxerxes
  14. Linking the world
  15. exetools.com
  16. How to make a master-key. (for RL locks on doors etc)
  17. IDA 4.50 released, with integrated debugger!
  18. Test
  19. Thanks!
  20. security related ASM paper
  21. What is the data between the DOS-stub-code and the PE-header in MASM-linked files?
  22. Not a stealth..
  23. hmmm
  24. Disassembling Amiga roms with IDA, how?
  25. Documentation of earlier undocumented MS API:s...
  26. Do you suppose
  27. anti crack book
  28. Self-deleting exe:s, widespread technique won't work?!
  29. Getting hold of handles and/or ID:s for threads of running processes
  30. corporate espionage account?
  31. Hasp 4
  32. Home made DIY Dongles...
  33. 16 bit code inside W1nd0se XP Kernel
  34. Hacking games for spare time
  35. PAL/GAL chip breaking code?
  36. Breaking on an API programmatically
  37. Scent thoughts by a grumpy old man
  38. Correctly stated question gives the true answer...
  39. Sort Algo Challenge
  40. New contest : crackme
  41. Compile this Under Dos
  42. have you noticed tsehp.cjb redirect to krosoft ?
  43. reordering of forums?
  44. Another nice hacking/cracking challenge
  45. Unpacker for FSG wrote
  46. Computer Made from DNA Enzymes
  47. Lost thread?
  48. Search not working??
  49. Please confirm this rumour about Code-Lock
  50. Autodesk Visual Lisp Decompilation...
  51. WinHEX 10.8 - Specialist version - Here
  52. xxx.reversing.net?
  53. Would it be possible? (way to post/reply threads)
  54. essay
  55. Faq forum ...
  56. CrapKey 6.0
  57. Welcome back everyone!
  58. triky Qvaschion:) "unknown api"
  59. To Woodmann
  60. Toolbar bitmap explorer
  61. I'm bitching
  62. Hacking 16lvls, mostly reversing. :) fun!
  63. As a matter of question...
  64. To admins
  65. An act of God?
  66. Internet Popups accessing systems' Client Server Runtime Process?
  67. For all NEwbies Spècialy Spanish Crackers
  68. Shirt
  69. Race 2.9
  70. Other messageboards with similar subjects?
  71. Another riddle page
  72. Waheyy, it's back !
  73. Screensavers special
  74. Why the DMCA ...
  75. A Haiku
  76. Ok, what do you think about selling unpackers or other de-protection schemes?
  77. email tracking
  78. Invitation to participate in research survey
  79. Crossroads Call for Ethics Articles
  80. Keygen makes front page of The Register
  81. Ok, who changed the board?
  82. Splaj,.....
  83. cock sucking: pros&cons - 2
  84. CrackZ Archives ?
  85. Which linux do you prefer?
  86. Crack for $
  87. "SunnComm to sue 'Shift key' student for $10m"
  88. Be Back
  89. Ring -1 (Palladium/NGSCB/LaGrande)
  90. TMG Dead?
  91. Features, pros and cons of Palladium / NGSCB
  92. Cracking DES book online
  93. BoundsChecker Easter Egg
  94. return
  95. syncronizing problem with daylight-saving-time
  96. JMI, fire near you?
  97. Who knows Anonymous Remailers!
  98. Pm
  99. RegClean craps out on Win2K?
  100. This is Hard to Believe
  101. Lame email I often receive.
  102. Nice bug in Acrobat Reader 6.0
  103. Italian Tears
  104. "SETI Hacker" hypothesis: Keeping Watch for Interstellar Computer Viruses
  105. Who was Teshp?
  106. am back :D
  107. how to unpack the shell of svkp 1.3x
  108. another dongle (serial) question::
  109. heard of Glasswall
  110. Private Messages
  111. EICAR sample virus implementation
  112. Again Offtopic but related to this new board format.
  113. 64 bit CPU
  114. Thanks to you all !!
  115. About this board...
  116. Seasons greetings Alexy, Chad, ..
  117. Asprotect ;-)
  118. ok, huppy nuv birzdey, NotePads!
  119. What do you think
  120. Stopping Scumware?
  121. Cracker "She"
  122. LINK: Windows Forensics: Have I been Hacked?
  123. Uh, quite off-topic; it's about the stock market. I want you to compete with me!
  124. port stuff
  125. "Crackers Matrix" book
  126. Some respond to this one. Don't just view my ignorance
  127. newbies
  128. Windows File Protection Story with happy ending
  129. 5 minutes of fun
  130. iceext screendump
  131. Are your ears burning?
  132. How to get a DirectPlay bug fixed?
  133. Cracking Oxford Advanced Learner’s Dictionary
  134. Proofing a crackme-solve
  135. Problems with the board again
  136. LINK- ".. instead read this."
  137. About forum Archive
  138. FADE Protection
  139. Is it OK to link to this forum?
  140. Can any guru give me some hints on ClearCase?
  141. Imagine having this computer
  142. New FAQ! (+ complete forum archive for download!)
  143. IDA Debugger
  144. unknown cd protection
  145. English please?
  146. Reduce processor power?
  147. Admins ! plz pay attention !
  148. SSL forum
  149. Where Did +Tsehp Gone ?
  150. RCE Board Archives .chm file available
  151. MFC Documentation!
  152. Belgian police arrest female virus writer
  153. What did the old forum look like?
  154. Lights out - Crypto game
  155. MYDOOM Virus
  156. "New" protection. ya right...
  157. How to see invisible processes on your machine?
  158. link: "View Forum Leaders"
  159. wasm.ru is back
  160. Questions for Bill Gates
  161. crack request job offering
  162. Crapkey - Long time No Hear
  163. LINK: Windows Debuggers: Part 1: A Windbg Tutorial
  164. Imagine Octal Opcodes
  165. To Board Admins
  166. How to access CMOS ram
  167. tsehp.cjb.net
  168. 16 bit
  169. Support Royalty from Numega
  170. how i can forget: c0ngratz, m$!
  171. AsProtect 1.23 RC4 Registered and something else? (Thread split)
  172. Macrovision's "Hacker University" at E3...
  173. I found a Cplus ver B dongle
  174. Unofficial Driverstudio FAQ?
  175. wasm.ru on woodmann.net
  176. Crack sites - why so scummy?
  177. VB P-Code <SPLIT>
  178. Problem after install Borland C++Builder 5 into winxp
  179. "Systemwide Windows Hooks without external DLL"
  180. M.sc in security(RE,...)?
  181. Recent Fravia Sighting
  182. Sorcerers are bad cyber lovers
  183. Private Message Replies
  184. VMWare vs. Virtual PC
  185. Abbott and Costello in the 21st century
  186. Busted
  187. flexlm 8.0d using 8.0c sdk... works fine
  188. MASM and MSVBVM60 imports
  189. Microsoft Word's dictionary
  190. Acoustic cryptanalysis
  191. Forums...
  192. Canterwood's web site
  193. FORTRAN - Mathematics Library
  194. Where hackmate site has gone?
  195. Exetools Forum Viewable to Non-Registered
  196. Good Virus--Bad Virus
  197. Reverse engineering in the movies
  198. Crypto tool
  199. attachments...
  200. Softice and LCD Flatscreen
  201. How do you pronounce "IDA"?
  202. [RSA] Largest N you did factored ?
  203. icedump site?
  204. Piracy & Unconventional Wisdom
  205. A Request to all Posters on posting replies
  206. Do you use your reversing knowledge to cheat in games?
  207. tut question...
  208. Worst case worm
  209. Classic......404 file not found
  210. miracl problems
  211. Hello All
  212. Could someone help me?
  213. Palm Reversing
  214. Graduation project
  215. Where'd the board go?
  216. Babel's Library Reversing machine (Search "Jorge Luis Borges")
  217. Free Web Space
  218. Any Assembly Programming Certification?
  219. Interesting studies on web topology
  220. Offline board archive chm file updated Aug 3
  221. This is not a post
  222. !protect on....
  223. softice not popping
  224. win32asmcommunity is down
  225. More problems with XP SP2...
  226. Hasp Privilege Imprec Plugin by LaptoniC
  227. Encrypted execution engine
  228. Board probs ??
  229. Gmail
  230. Need Hacking Services Site
  231. How to porting this code with SDK
  232. Perhaps its Time
  233. ON THIS DAY 3 YEARS AGO 9/11/01
  234. So what does RCE stand for, anyway?
  235. Google tremble!!!???
  236. Spyware/adware on the board
  237. A public service announcement by JMI?
  238. Rendering, a nice distraction
  239. Some deeply disturbing issues...
  240. Archive chm file updated for the collectors...
  241. InvalidFS
  242. What links mice to motherboards?
  243. good customer support as an anti-crack measure
  244. Are you sharp sighted enough?
  245. Help reversing key validation algoritm
  246. As Above...
  247. HOLY CRAP ;)
  248. Why?
  249. Personal Experience
  250. What can edit a directory entry?


Linux RCE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE
PDA

View Full Version : Linux RCE

  1. welcome
  2. linux RCE starter
  3. new tutorial
  4. shiva
  5. new linux crackmes - let's crack them!
  6. linux anti anti debugging tut
  7. easy printf reversen
  8. linux dongles
  9. Perhaps be useful:Linux Kernel Debugger (Linice) v2.5 Released
  10. Dual Plataform RCE
  11. Knoppix anyone?
  12. Trying to Crack Linux program with maybe AntiDebugging?
  13. process dumper


Reverse Software Engineering help & support
RCE Messageboard's Regroupment > Reverse Software Engineering help & support
PDA

View Full Version : Reverse Software Engineering help & support

  • The Newbie Forum
  • Packing and Unpacking Forum
  • Advanced reversing and programming
  • Rce Cryptographics
  • Tools of our Trade (TOT) Messageboard
  • Mini Project Area
  • Off Topic
  • Linux RCE


Advanced reversing and programming
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming
PDA

View Full Version : Advanced reversing and programming

Pages : 1 [2] 3 4 5
  251. Java Encryption
  252. Finding a serial for File-Ex 2.12d
  253. Smartcheck: will it handle a former Neolite packed exe ?
  254. FlexLM 6.0f
  255. Asprotect unpacking
  256. Attention CrackZ what is your new email ?
  257. First safedisc 1 cracked with revirgin
  258. Reality Cracking : the supermarket enslaving as a science
  259. CommView 2.4 keygen ask you translator..
  260. OLD MSGBOARDS ZIPS. Who has them ?
  261. vb p-code patching
  262. Project Hasp4 memo1 replacementwith Microcontroller
  263. wondering if such a thing exist? can you help?
  264. some help
  265. +Tsehp - Cbuilder 4 essay question
  266. lest we forget -- M$ does
  267. FLEXLm 7
  268. Where to find tut or how to unpack manualy Pecrypt32 1.02!!
  269. For iCEman!!!!
  270. The Business Software Alliance
  271. Multiple safedisk checks ?
  272. Can patch a DLL... strange
  273. Cracking web authentication via dongle
  274. Strainer ????
  275. Question about memory mapping
  276. BitArts
  277. Vender Key Question
  278. Target use Flexlm 6.0
  279. Why winzip passwords can't be cracked...can i understand ?
  280. Lord Caligo's Fantastic World of Cracking
  281. How to get the Offsset in IdA!
  282. Reversing and the real world
  283. Known-plaintext attack on Encrypted Magic Folders
  284. Copylocx
  285. Final Challenge - Unboxed
  286. Hasp4 memo1 Service 60,Service 61
  287. New Software from the BSA!
  288. intel floating point instruction set
  289. Kernel level messaging on Windoze?
  290. Morlac
  291. Copy Control
  292. Fixing an vb app to run in windows2000
  293. Revirgin (iat rebuilder) final available.
  294. Suggestions...Thoughts...Maybe?
  295. Who know the name/password for VirtualGirl 1.54???
  296. C-dilla iat-call fixes
  297. java disassembling (not decompiling)
  298. quite strange app behaviour
  299. softice crashing my system
  300. Lost in Space
  301. How to locate Call Relocation Table in .Exe
  302. Help with safedisc?? Anyone??
  303. RSA/DSA problem calculating X^(-1)
  304. Hasp4-Service2: HaspCode() Info?
  305. Problems with board?
  306. dll swapping / re-asm
  307. (X)Intermediate (x)Advanced (x)Expert help appreciated
  308. Question (stupid or not that is the question)?
  309. Very interesting target: AdSubtract Pro
  310. New info on AdSubtract Pro
  311. Goatass please help
  312. Asm help needed: What type of CRC is this?
  313. Does anyone know where to get unpacking(full) Miz+Sandman project!
  314. ICQ2000b reversing
  315. cracking 16-bits very old CDILLA protection
  316. Ripe-MD any papers on this hashing algo ?
  317. Help on HASP service 3Dh (service 61)
  318. Revirgin error in w98se
  319. ESSAYS ABOUT JAVA CRACKING ?
  320. Help with manual unpacking!!
  321. ASM EXPERTS> Some C++ to ASM help? Please? :)
  322. Nolan: encryption seeds 3 and 4 in flexlm 7.2
  323. 30-day limit in asp-protected files..
  324. Asm help: Opcode JNB xxxxx help needed
  325. Stop the fancy designs.
  326. ASProtect 1.2 'Revirginated'
  327. A little crackme
  328. I must be retarted
  329. Help: Coding Filter Drivers on winnt/2k problem
  330. welcome to your new moderator : +splAj
  331. i need info
  332. VBOX 4.30 Lang modules
  333. Help: An interesting ActiveX Server protection used by SolarWinds 2000
  334. Again interesting target: 2findmp3....wrapped with a Asprotect-alike
  335. Help to start
  336. Jump if not below | another question to moderators
  337. Finding Armadillo Entry Point???
  338. Setting up a broadcast socket in a LAN as "license server"
  339. HIDING SOFTICE ?
  340. 2 +Tsehp about Revirgin
  341. Adding licences to an NT server
  342. Problem With Revirgin !
  343. Whatever
  344. Crackme challenge
  345. Alexeys *new* trick ?
  346. Help NAG & Timelimit
  347. To understand if a program is crackable
  348. ultraboard interruption, should be ok now
  349. I need to contact +Spath, privatley.
  350. Challenge for all good crackers
  351. SmartCheck cause System Error with some target...
  352. Recent information about CrypKey needed, tnx
  353. Armadillo 1.90 beta...
  354. MemTurbo II offset disparity
  355. Just another handle
  356. To +Tsehp: Since you did what you did to the MB, its being working quite faster! No delays in loadin
  357. Can someone help me with this proggie?
  358. for beginners at revirgin (iat rebuilder) important essay on what new section
  359. Good books on PE execution and file structure?
  360. How to strip the export tables of EXEs generated by C++ Builder?
  361. "Usage of ReVirgin" problems (reaction on TSehp/Killby)
  362. About message formatting on bd
  363. ok who asprotect(ed) the newbie forum?
  364. a request for comments : creation of a private asprotect forum
  365. Help with Folio LCF files
  366. Tutorials about cryptogrphy used in shareware programs
  367. Help trackin IO from a driver
  368. Unpacking question
  369. some information on parallel port access ??
  370. Hardest bite-board cube-pro ?
  371. Attempt to apply ReVirgin on Pc Guard protection on app Iris
  372. http://www.researchindex.com/
  373. WinZip attack
  374. Finding the entry-point......
  375. Reverse Engineering forum down?
  376. Attention -> Possible new asprotect 1.2 scheme to reach the oep
  377. asprotect and crypto
  378. My new website design! ;-)
  379. Question about te!'s RSA Tool
  380. Attn : MInoTHauR, please read (about RCE CD)
  381. Is there a "crack" for REALPLAYER to save movies (*.rm) on hd?
  382. ... diskcopy don't works... ???
  383. Cracking meeting
  384. New revirgin 1.01 minor update
  385. armadillo killer not working :-)
  386. Armadillo Killer v1.2 Nanomites Edition
  387. Revirgin attempt on AD PicView
  388. How to add attachments?
  389. Funny telephone listing
  390. Help needed
  391. Umm...how to get around IE hostility...not too hard
  392. debug versions of system dll's
  393. com-port hookup
  394. HELP NEEDED
  395. AS strikes back
  396. Tamosoft 'bloatware'
  397. ReVirgin won't trace this ASPR
  398. erm, btw
  399. A nasty one!?
  400. only a link
  401. Help for a software protection market research
  402. Infos about the .NET support
  403. Assembly help
  404. "Hacker"-Contest -> Cracker Contest
  405. Searching for CD-Cops protected app
  406. What happened to reversecourse.cjb.net?
  407. CTRL-ALT-DEL
  408. VBOX 4.5
  409. Running sice on vmware win98 guest
  410. New chameleon clock......
  411. GetDiskFreeExa - is this the right syntax ?
  412. here are some links to asprotected progs
  413. Lame protection cracking attempts, I need help.
  414. Dongle cracking (rainbow version)
  415. Companion disk to Barry Kauler's "Windows Assembly Language and Systems Programming"
  416. Reversing Microsoft Reader .lit format to text format, any ideas?
  417. wisp
  418. FlexLM 7.0b target with no DLL
  419. Vbox 4.3 questions
  420. Memories...
  421. .NET MSIL Decompiler
  422. Reversing the swap file
  423. cracking old CDILLA license manager
  424. Installshield Unpacking/Decompiling?
  425. Atria license manager
  426. Where to download Flexlm SDK of Solaris platform
  427. Is there anyway to identify the version of aspack used to pack a program?
  428. New safecast essay
  429. WebDetect
  430. Is The Sand Man Still alive??????
  431. softICE question
  432. How to generate Solaris's license with Flexlm6.1 SDK on Windows
  433. What to do when you receive ' Feature has expired' Flexlm Error
  434. PC Guard app
  435. IS there any body online here whom i can ask a question about flexlm right now?
  436. Working on FLEXlm licensed targets.
  437. Midtown madness 2 (safedisc) defeated by Revirgin, need beta testers
  438. help with revirgin
  439. CRC-Check
  440. Gearbox Connection Kit
  441. Signlab 5.0 rev 6.2 - Compleate reverse
  442. snpslmd on solaris...
  443. Safedisc 2 : how can i get a valid dump? (r!sc??)
  444. Agilent License Manager
  445. Palm Reversing
  446. SENTINEL LM
  447. Flexlm error
  448. adding a msgbox to show the serial !
  449. Vbox, PerlBuilder Tutorial by +Tsehp
  450. Patching neolite...??
  451. safedisc 2 need a complete game to finalize the revirgin's tests
  452. . THe ReVirgin PRoblem!
  453. Kinda off topic. I need a good book on C++
  454. Attacks against my site
  455. Fravia
  456. Looking to Hire someone to help create a patch for anti cheat
  457. Help!
  458. Get some e-books here
  459. New revirgin 1.10 major update
  460. Further info
  461. CAN YOU REVERSE THE MDE FILE FROM ACCESS 97 ) - :
  462. "British firm develops 'unbreakable' polymorphic encryption"
  463. Bit-Arts are boasting and lying have a look
  464. InstallShield script Decopiling v 6.xx
  465. How to import new API:s to a program?
  466. reverse of xor
  467. help fully unpack NeoLite plz... (newsbin pro)
  468. Recognizing valid code sequences in .text section
  469. softice 4.04 nt/20k + loader = proublem
  470. +Tsehp,some things about revirgin
  471. Sentinel Inquiry
  472. Peer review...
  473. Help patch SoftICE (nt version) please :)
  474. +Tsehp,Can you post a tutorial on Tag&Rename 1.9
  475. Still don't know what happened on the messageboard...
  476. Is this problem related to incomplete/corrupt imports?
  477. WW32packed program and Revirgin
  478. how to avoid Smartcheck detection ???
  479. Which protection use .lxk licence files
  480. Ho Kan I Use Int13h In Win32?
  481. This process can't be dumped!
  482. If board works again then...
  483. How do I use icedump?
  484. +SplAj - website location ???
  485. How is protect Solid Edge 9?
  486. How Can Read CD-Rom Sector's In Win32?
  487. Opcode length recognition
  488. FYI: Verance Watermark challenge
  489. injecting debug symbols back into images
  490. how to use asprotect?
  491. hey gang
  492. New versions of ASProtect, where?
  493. Vbox (4.4) come back?
  494. Imports Libraries
  495. hi,gang
  496. revirgin Q
  497. How PEX 0.99 Redirects API's
  498. eLicense, need help
  499. bilieve it or not
  500. how i crack it?


Advanced reversing and programming
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming
PDA

View Full Version : Advanced reversing and programming

Pages : 1 2 [3] 4 5
  501. Asprotect 'upgrading' question
  502. help needed with vbox 4.2-protected app
  503. 3D-FTP 4.0
  504. java reversing
  505. thx but...
  506. IDA Pro reversing
  507. NetObjects Fusion MX Vbox v4.5
  508. Linux
  509. Reversing
  510. DLGTEMPLATE
  511. Problem with VBox 4.3 tut by Fravia under Win 2000
  512. CommView 2.6....
  513. Armadillo protected soft
  514. VBox 4.3 expired
  515. Packer Source Codes
  516. only demo version?
  517. phone reversing
  518. Office 2000 help??
  519. Together v5.0 -- Java FlexLM license protection
  520. Register contents at exe startup......
  521. msgboard interruption
  522. 16 bit Dongle Program, need advices or help debugging
  523. Revergin:redirected api's
  524. Any kind of help on HardLock dongle reversing can help me
  525. 'bout napster 2.0.10
  526. Sentinel SuperPro
  527. Microsoft Activation Protection
  528. HCUnix strainer (repost)
  529. msgboard problem
  530. license.dat about Sun Workshop 5.0
  531. A strange thing about Flexlm 6.1
  532. Her's my strainer
  533. What is ZoneAlarm doing?
  534. microsoft's registration scheme
  535. Info about Softice urgently needed
  536. AFR + aspack + revirging
  537. Serious Sam - new safedisc ???
  538. PalmDemon
  539. ExeScope Question - making a form destroy itself
  540. Linux Flexlm SDK Kit
  541. MS Access
  542. Is there any way to make w32dasm disassembly editable ?
  543. Some problem with proxies may arise here...
  544. 'snpslmd' XOR and Permutation Tables
  545. eEye Iris 3.00
  546. disassemblers
  547. How do I calculate target in vbox?
  548. Not good: This forum can't keep the indent
  549. CopyLok AntiDebug
  550. crackz site
  551. A strainer, or perhaps just a challenge for the interested.
  552. softice not showing up?
  553. Bi-Tarts have a new Transvestite "chairperson"......
  554. Exception Handler Howto ???
  555. argh :)
  556. The widening gap
  557. Hasp4 envelope cracking...
  558. Harlequin's "Protecting against TerminateProcess" - impossible to work
  559. WinCE cracking..
  560. Safedisc
  561. unpacking nonexecutable files
  562. What is going on with this simple cmp ?
  563. On average, are softwares hard to crack?
  564. Awave studio 7.0
  565. How Can I Use Thunk For Reading Sectors From CD-ROM?
  566. winCE stuph
  567. RE : /me asks stupid mem allocation question
  568. vbox 4.5 tut some problem with iat fixing proc
  569. some proxies ip
  570. Nice Update
  571. Hasp
  572. CrypKEY
  573. Question about FlexLM license
  574. Where can find VB4+ p-code format ?
  575. Environment space in Windows Me
  576. Awave Studio 7.3 - AsProtect unpacking
  577. Armadillo Killer 1.3 (CopyMem Edition)
  578. XP
  579. HWND error message
  580. Install Shield 6 stuff?
  581. Chariot Ganymede VOIP 4.1 - FlexLM License Crack?
  582. Binary Interception of Win32 Functions
  583. Safecast
  584. Thief 2 but not target specific
  585. Adobe 5 READER (godammit, READER!!) is S-ICE hostile
  586. problem with "phantasm v1.5b3 DingBoy"
  587. tElock 0.81
  588. Hasp Envelope help please
  589. Iris v3.2
  590. Computer architecture book
  591. Isn't it suitable to raise this question here?
  592. aspack site down ? Need latest asprotect with latest revirgin dev
  593. Java protection w/ Crypted Class Loaders: Help, my brain is melting !!!
  594. windows XP hardware-sensing product activation
  595. To make a point on latest asprotect 1.2, applied to aoepr.exe
  596. help crack foxweb for suddendischarge
  597. Is this legal?
  598. help with dissasemble of dll
  599. Reverse .mde (compiled Access database)
  600. Quick Time 4
  601. Unix Program problem
  602. Securom *new* load process informations ?
  603. Clonecd......
  604. Anti Loader Mechanism
  605. Psst buddy... wanna work for the Union?
  606. ALLOY
  607. help! sentinel superpro
  608. About Reversing
  609. shell and reverse problem, HELP please!
  610. VB3 Pcode *grumble* *swear*)
  611. link: Windows Product Activation
  612. Flexlm use LM_A_VENDOR_ID_DECLARE , how to crack ?
  613. sspro
  614. lost on unpacking, need hints
  615. is this code tricking me ?
  616. remember NE-files? ... need HELP
  617. How to patch Registry Settings by Crack?
  618. Inline memory patching Asprotect
  619. Revirgin minor update -> Auto locate IAT start + length added !
  620. How to unpack EXE protected by Cexe v1.0a?
  621. digital rights management
  622. revirgin???
  623. Quick warning to all RCE Webmasters.
  624. Lingoware 3 Crack
  625. Asprotect V1.3?
  626. 2 questions about Asm Programming resources
  627. asprotect api what a chaos
  628. protection with vb and ocx
  629. About REVIRGIN
  630. Hardlock Key
  631. This Blows - Everyone should have a look at this
  632. Visual Basic Program, __vbavarsub, __vbavarmul
  633. flexlm + linux
  634. hey where can I find v-box 4.5 tut??
  635. SoftIce Backtrace Buffer Disassembler - A new tool
  636. Reverse engineering in WinNT/2000
  637. TrialMaster
  638. YUY2 video references
  639. Memory address ref.
  640. How to reuse a dongle - Hardlock
  641. Info req. about M$ACCESS MDE files reversing.
  642. FLEXlm 7.2f
  643. Tame a Tiger
  644. Telock 0.9 ......
  645. Windows CE hex editor
  646. The controversial findings of Prof. Felten who cracked the new SDMI digital music protection
  647. ProTools website?
  648. PC Guard 4 mauale unpacking
  649. SMARTCHECK
  650. Dongle Tutorials
  651. FlexLM 7.1 Target solution
  652. acudata sheriff protected software
  653. The new MS protection scheme
  654. Media Player totally locks up Win2k system
  655. Cloning a dongle (HASP)
  656. Here we go again...
  657. Retina v4.2 and Iris v3.5 (easy crack)
  658. adjusting UCL HASP emulator
  659. what's the version of FlexLM which uses lmgr327a.dll?
  660. Hi CrackZ can u help ???
  661. FLEXlm License
  662. vendorcode6 ?
  663. Asprotect + time trial
  664. In-memory patching question
  665. DElphi DFM ,adding controls
  666. SetWindowsHookEx problem
  667. Why unpacked files dont run on win2k
  668. Is there any software crack for HASP4
  669. Welcome To First Persian Crack Stroe
  670. How to find free space in the code section?
  671. Need help on HASP Envelope?
  672. Hasp and Hasp4 emulator
  673. Sorry for the big messageboard interruption.
  674. Sentinel LM help
  675. Either new aspr, better implementation or asshole author code ;)
  676. Killing rogue processes under Windows!
  677. Unknown Cipher
  678. Rewrite Spro developer id ???
  679. telock 0.90
  680. Revirgin 1.2 beta just released
  681. How to find HASP Envelope & reverse it?
  682. How to decrypt files with newer cd-cops 32 copy protection
  683. Reversing a algorithm: 4 bytes read - 8 bytes written
  684. some new tricks from bi-tarts
  685. Hasp4 dumped, next what ?
  686. How to find free space in the code section?
  687. Just wanna say hi!
  688. What's wrong with the Message Board
  689. Poll example...do you like this board ?
  690. Asprotect again
  691. MessageBoxA inside MFC
  692. Unpacking !!
  693. Revirgin stops responding on tELock(FlashFXP 1.4)
  694. ViaTech eLicense System
  695. Unpacking Asprotect
  696. Unpacking Asprotect
  697. Need help on HASP seeds & return codes
  698. Revirgin 1.2 Fails tracing Kernel32
  699. how can the register dialog be shown ?
  700. /tracex crashing
  701. Softice + foreign (non US ) keyboard
  702. Cant get tracer work in XP!
  703. Tracing problem with SoftICE
  704. SoftIce and tElock 0.92a
  705. flexlm in matlab 6.1 (UNIX)
  706. u talk about me :)
  707. Can anyone help me
  708. Nice Securom trick
  709. sentinel spro - no need for devID
  710. Revirgin vs VisualProtect
  711. armadillo
  712. how to see the DD library name under linux
  713. DriverStudio 2.5 RC1 Loader Problems!
  714. Little problem with a Sentinel dongle...
  715. Any CD-COPS 32 Sample ?
  716. Any one knows about "Avtype_info"?
  717. Dongle indentity
  718. telock >0.92 unpacking
  719. zip protected files
  720. Crackz Page
  721. ad-aware&reghance2.0
  722. Installshield script help!!!
  723. Need a list of Sentinel protected program
  724. finereader five try&buy
  725. Why?????
  726. Revirgin 1.2 beta 7 released.
  727. tsehp, please add "refresh process list" feature to Revirgin
  728. Packed / dumped apps and IDA
  729. Unpacking SafeCast [Help]
  730. Need some help for revirgin 1.2 feature
  731. Opnet Modeler 7.0 Licensing system
  732. Unpacking PELocknt v2.04 (modified by Xoanino)...?
  733. Hi everyone
  734. Need help for Revirgin 1.2
  735. about a dos program crack
  736. Sentinel Micro UX
  737. Info
  738. vramdir
  739. Any good SEH documents out there ?
  740. Microsoft Activation Protection
  741. Flexlm Stupid Uqestion !!
  742. revirgin 1.2 beta 9 released
  743. FlexLM Tools ?
  744. some ebooks
  745. trying to cheat games
  746. Sentinel SuperPro dongle protection
  747. Reversing Safecast - The Solution
  748. Iris 3.6
  749. Unloading SofticeNT
  750. good ebook site..


Advanced reversing and programming
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming
PDA

View Full Version : Advanced reversing and programming

Pages : 1 2 3 [4] 5
  751. www.hexalock.com
  752. w32dasm help
  753. How can I reverse the Java Class File into its orginal source code?
  754. hard1ock envelope without dong1e?
  755. api hooking
  756. Wise installation system and script decompilation
  757. InstallSjield compiler
  758. UPX unpacking
  759. UPX and NAV
  760. SPM license server
  761. CDILLA 2 reversing
  762. Tages
  763. Enabling menu item in delphi target ?
  764. Is it ME
  765. win xp keygen
  766. I need CD-Cops protected exe
  767. Proteq dongle emulation lib(src included)
  768. help, or is there a program?
  769. HASP Protection
  770. reversing savegame file
  771. Something different
  772. need 3d max help
  773. stuck with securom
  774. reversing the binary code of .exe and .dll
  775. Dead Tracing
  776. KMD in asm
  777. Loading Data in memory,
  778. Armadillo cracking tutorial
  779. Merry Cristmas and Happy New Year !
  780. Asprotect 1.4 !!!
  781. defeating frogsice help please
  782. "Magic Card"
  783. IDA unload\remove binary from database
  784. Happynewyear gift.
  785. SmartKey Unshell!
  786. Sentinel SuperPro v6.1 Unsheller!
  787. Windows XP product type
  788. Idea request please
  789. iris 3.7
  790. Text to Hex file with 00 padding
  791. REQ: info on OSOLIS / SIVL protection
  792. IDA signature for Activator / Unikey
  793. flexlm
  794. I'm looking for any stuff protected by Crypkey !
  795. Unpacking NE (packed) files...
  796. api hooking via vxd...
  797. MDE (Acess MDE file format) decompiler
  798. figuring out new eip
  799. flexlm: lc_set_attr(LM_A_CHECKOUTFILTER)
  800. I need some help
  801. mem or running app patching
  802. Feature Request: Downloading threads
  803. Any way to crack this?
  804. FlexLM: what's difference between 7.2a and 7.2f
  805. New Member and CoffeeCup Password Applet
  806. Hard f***** to unpack (Armadillo)
  807. flexlm: general question
  808. Microsoft conforming to their standards
  809. armadillo password protected targets...
  810. unknown crypter/packer
  811. how do you read superpro/cscribe key id?
  812. How can I make a valid PE ?
  813. Tinity xsi how to....
  814. SentinelLM
  815. help with XOR
  816. .net
  817. What does this code (ARM)
  818. Section Atributes
  819. OT: Porting VB ole automation to asm
  820. parameters passed to a call
  821. modules loaded into memory - dumps/disasm
  822. LoadLibrary Emulation
  823. files protected with pcguard 4.xx ?
  824. hooking a process's keyboard input
  825. windows hook help...
  826. Solaris executable identifier
  827. Removing ASProtect from a DLL file
  828. NT Doubts.
  829. Makin Revirgin Work in Win95
  830. Finding EXE Size in Memory WinHex Style
  831. MPR.DLL trouble
  832. parameters
  833. problems with revirgin 1.3
  834. Flexlm
  835. How to debug a Windows service program
  836. How to crack ansys6.0 for windowsNT/2000?
  837. xLoK Commercial Protection
  838. Patching dll at runtime
  839. IDA new processor module
  840. CD-Cops Generic Unpacker v1.1 Open source
  841. Protexis commercial protection (DivX5)
  842. Miracode
  843. windows xp debugger problems, rv's tracer on windows xp.
  844. Anti-trace/Anti-debug techniques
  845. tsehp : small "anti-trace" in asprotect..?
  846. API hooking - new article
  847. LaserLock 5 - Help !
  848. Could someone else have a look ?
  849. Date changing of computer files
  850. Sentinel (Appeal for target information)
  851. How does ms generate XP activation codes?
  852. nugget under Win98?
  853. grocker
  854. about LM_A_CRYPT_CASE_SENSITIVE ??
  855. Try This !!!
  856. M$ going cracker ??
  857. Together v6.0 -- FlexLM protection
  858. protectionist idea
  859. Need some hints for a wkcrypt target
  860. Sentinel Lm
  861. Protection
  862. need help with resource tuner 1.7(PLEASE)
  863. New Article: Detecting Windows NT/2K process execution
  864. New SEPP protector from aNti-Crucking...
  865. Some Information on NTDLL!NTContinue...
  866. F*L*E*X*L*M* SDK v8.0c (Help)
  867. How to rebuild import table?
  868. tutorial for ici crackme 1.0
  869. sentinel dongle cracking help
  870. I have found a mistake in CALCSEED for FLEXLM.
  871. Intel manuals
  872. For asprotect lovers
  873. SD2 - Why God ?
  874. Import table size.
  875. Hmmm, possible new toy ProCrypt
  876. Hard Keygennin Program
  877. Help on finding a "Creating a No-CD" tutorial?
  878. Best way to hook PrintScreen under Windows NT/2K
  879. Sheriff acudata
  880. Sas
  881. How to analyze the seeds3,4 of f*lm 7.x?
  882. Note about opcode short jmp translation in Hiew,OllyDbg and SI.
  883. Floppy Disk Format Specification
  884. SEH Internals - Info Requested
  885. E-License vtcpak33d.dll and Deep Paint 1.1b
  886. Packers: theory and coding???
  887. Unpacking Dlls with Relocations
  888. getting the AL of an int
  889. crypkey
  890. FLEXlm 8.0d
  891. C++ patch code
  892. Microsoft's Really Hidden Files!!
  893. Crapkey
  894. Ladies and gentlemen, I invite you.
  895. APIHooking and ConsoleMode applications
  896. armadillo 2.60
  897. unpacking windows 16bit dll
  898. Doing it without softice
  899. floating point
  900. Strange things with debug registers and SEHs?
  901. Hardlock Envelope: Hl-Crypt
  902. cxbx needs "xbox.dll" ;-)
  903. SentinelLM 7.1.1 - 7.2.0
  904. Help please about FLAIR.Enter please.
  905. aspr 'randomizer II' f*xed
  906. How is this really done?
  907. Just a small question.
  908. CSE HTML Validator
  909. help with a multi(?) packed .dll
  910. Armadillo protected target
  911. Windows XP driver internals...
  912. unpacking pklite 2.1 NE target???
  913. LiMan - Yet another "copy protection"
  914. Cloning Sentinel Dongle
  915. Yet another FLEXIm target ...
  916. anti-debug stuff?
  917. visual dbase reverse
  918. Looking into .obj files rather than the .exe
  919. a wrong disassembly?
  920. Need some help with app please
  921. Asprotect tutorials
  922. Reversing (Finding WndProc)
  923. hardlock maybe?
  924. [SentinelLM] WlscGen.exe: not enough tokens?
  925. Pushing button
  926. IrfanView v3.75 KeyGen source c0de
  927. non PE or NE but msdos exe reversing
  928. need some help
  929. the tale of the virus and the headers (help)
  930. Any info on the Softice SIWTR command?
  931. tcpip.sys?
  932. Reversing IDA protection (the real one)
  933. Question on coding a patcher...
  934. Find "EXE is damaged" by NetCaptor v7.01
  935. ATA programming
  936. IDA script
  937. MSIE reversing
  938. Intel Chip Blunder
  939. DakienDX --> Patching SHELL32.dll ???
  940. Preventing API hooking????
  941. FlexLM 6.1 an Vendor Defined HostID
  942. FLEXlm 8.1a
  943. Help on Sase module
  944. FLEXlm 8.1 once more...
  945. checking correctness of flexlm license
  946. Windows Command Keyfile
  947. FlexLM 8.1
  948. Hasp4 Double Trouble
  949. HyperLock PE envelope emulator
  950. symbian / armi
  951. Senselock dongle
  952. symbian 6 and 6.1 difference !
  953. GetProcAddress by ordinal problem
  954. installshield 6.0 scripting trouble
  955. pelock anti SI detection
  956. How to dis SPARC-excutable file by IDA?
  957. Need help with win32 asm
  958. reversing Delphi 6 code ...
  959. .NET assembly problems
  960. UniToBSCPath problem
  961. in PROTETORS help!?
  962. FLEXlm 7.2+: Fake daemon
  963. Serial Hardlock Power Requirements
  964. Symbian OS7 reversing
  965. NetCaptor 7.1.0 - new tricks
  966. Help with a real RCE problem
  967. KMD -- manual unloading???
  968. HASP services 32h and 6, and MD5?
  969. FLEXLM: How can i found Seed3 and Seed4?
  970. Crk Guardant Dongle
  971. where can i found thd flair tools to making the sig file for flexlm?
  972. Detach A Debugger
  973. I need help for a Flexlm 8.1a target
  974. Bashing ARC Render v9.0 - Strange HASP_Prot
  975. Machine Code.... Where do I find it.
  976. Stuck with C-dilla Safecast protection
  977. wibu
  978. flexlm on solaris
  979. reversing a dll
  980. System Driver Linking
  981. Loop to get key
  982. windows 9x/nt system call stop/restart (int 2E/int 30)
  983. Printing
  984. does someone know how the altera ip encryption core work?
  985. Backwards disassembling
  986. Hardlock question
  987. LINK: Three Ways to Inject Your Code into Another Process
  988. Official PE specification, download here
  989. Debugging RPCRT & OpenSC Manager
  990. Function as References
  991. [Question] About C-Dilla SafeCast. Help!
  992. problem with firmware on dsl route
  993. Fetch text from RichEdit control
  994. OpenSCManager Controller PseudoTool (+ KMD Programming Example Package)
  995. Undocumented NT Kernel Technique and Header files Collection
  996. heuristic scanning
  997. Log any DRX Access - srcs now available
  998. Windows NT IDA scripts
  999. Signature Scanning & Packers
  1000. Generating DBG files for COM DLL/OCX's.


Advanced reversing and programming
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming
PDA

View Full Version : Advanced reversing and programming

Pages : 1 2 3 4 [5]
  1. IDC Help
  2. problem extract resources from exe created by meta card?
  3. sproQuery emulation
  4. Question of BigInteger ...
  5. Bad address references in a dumped encrypted dll
  6. Some info about USB
  7. "Writing Your Own Packer"
  8. Art Of Disassembly
  9. Programs In Xp With Ntvdm.exe
  10. anyone have any information on User32InitializeImmEntryTable export from user32.dll ?
  11. RVA to file offset in C++??
  12. Delayed import table?
  13. ida plugins
  14. Rainbow Sentinel Protocol confusion?
  15. Adding new PE sections
  16. Unusual tests for DRx registers
  17. Change setting in application from external app.
  18. FlexLm Vendor Deamon Cracking
  19. SDK for C-dilla SafeCast.
  20. Hardware-based read-only memory
  21. Sentinel Super Pro (16-bit)
  22. Trap exceptions 0E in NTVDM.exe without being a debugger
  23. FlexLM7.2 -invalid pointer to the job structure
  24. Programming Journal Articles by Rheingold
  25. FlexLM 7.2a - wierd license format
  26. InstallShield inx files again
  27. Using SoftICE - Details of some useful commands
  28. FLEXlm 8.4
  29. Clipper 5.3 with Exospace V 2.11
  30. FlexLM 7.2i
  31. Nokia 6600 Symbian: help disassembling
  32. debug registers & SI
  33. Sentinel SuperPro Password Overwrite
  34. idioms
  35. ImpREC.dll problem
  36. Retrieving System, Process and Thread information using ZwQuerySystemInformation
  37. Bypassing Debug Registers Protection
  38. Tages defeated
  39. CBJ - Call for papers and participation
  40. LINK: Process-wide API spying-an ultimate hack
  41. Getting hardware infos about the local computer
  42. SoftIce - Breaking on phisical sector access
  43. SSP license check?
  44. MSI mystery...
  45. Hardlock cloning
  46. Interesting technical article about the Windows loader
  47. Advanced address context question!
  48. How to disassemble Startup code of Binary
  49. Trap, interrupt & all that stuff
  50. Seed Code for Hasp 4
  51. Process Environment Block
  52. CreateRemoteThread and VB apps!
  53. Discovery reversing the kernel memory
  54. LINK: Toby Opferman's Debug Tutorials
  55. WiseInstaller help?!
  56. Original application and hardlock (for the last time...)
  57. flex + hareware key???
  58. A stranger dongle. help me please
  59. Harddisk serial number & reversing
  60. Low-level Keyboard Hook
  61. question about debuggin an app and preventing registry access..
  62. java third party components debugging
  63. vwin32 and win32 service table
  64. Writing Windows NT Device Drivers
  65. Kernel reverse engineering tool
  66. Hasp 3 dos exe envelope
  67. Need Help with "access violation...."
  68. how to do this ?
  69. Preserving Undocumented Kernel Information - KeServiceDescriptorTableShadow
  70. IDA argument list - c++ program
  71. Need to track 99% resource usage by cracked prog... ring 0
  72. IsDebuggerPresent - how to bypass WITHOUT changing the mem
  73. hardlock emulation
  74. Win2003 Server Activation
  75. How to make a kernel debugger ?
  76. VxD and PageNotPresent
  77. What is the best EXE-protector?
  78. SoftIce Symbol Retriever - Getting PDB Files aka Symbols
  79. Problem to emulate SproQuery
  80. FlexLM v9 clarifications needed...
  81. Change control properties in VC++
  82. Reverse engineering poker protocols?
  83. Method to Detect Virtual PC
  84. Debugging Kernel Drivers
  85. Dongle Access Codes Problem
  86. Link: Kernel Services in User Space on Win2K
  87. Message Tracking
  88. flexlm 8.1a feature problem
  89. .NET RCE Info: Salamander obfuscator Anti-ILDASM
  90. Can't see WIN32K with SoftIce?
  91. Need programming tips to achieve this effect
  92. WinXP 10-Client Server Limit
  93. WIN32 Debug API
  94. Sentinel sproQuery Again :(
  95. WIN32 DEBUG API(AGAIN)
  96. code for call processing application
  97. Adding functionality to RASAPI32.DLL
  98. Back to INT2E, trash SYSCALL:)
  99. How to anti crash code in swf files
  100. PEB of another process?
  101. unknown TEB fields
  102. help linux shared linked library
  103. Nice site for driver development
  104. nice (and new) article about NT-Syscalls
  105. New memory protection in XP SP2, details and problems
  106. DR7.GD bit and DRX access exception problem
  107. I want to write a generic static disassemler
  108. i'm gone lost my mind ...(Kaspersky)
  109. Ring3 debugger detection stuph (was Please test a program)
  110. Kernel Filter Driver Example & Article
  111. NtQuerySystemInformation and open handles
  112. interrupt handler problem
  113. DeviceIOControl and mouse drivers
  114. Globetrotter Parallel Dongle Clone
  115. how to use adb to get the seed on unix?
  116. Can't set a working Hardware breakpoint
  117. Resources
  118. EXECryptor
  119. Marx CryptoBox infos
  120. syncrosoft dongle
  121. iButton
  122. article on classes restoration by example of Delphi
  123. FlexLM 7.2d, CRO, SEED, VENDOR n LICENSE
  124. What is the Flags field in the output of a SoftICE Query command?
  125. SoftIce Breakpoint Table Structure
  126. Virtual Drive
  127. Further observations in Flexlm...
  128. Articles: .NET (dotnet) cracking
  129. Changes in policy related to patching kernel for MS Windows Server 2003 SP1
  130. Physical to virtual address translation
  131. How to use the genlic32.exe(version 9.2) to generate license?
  132. Flexlm with CRO...need pointers (Crackz?)
  133. multithread application debugging
  134. how to build the lmgrypt.exe with the flexlm SDK v8.1?
  135. Setting up IDA for analysing Softice functions
  136. Specification of NE executables
  137. Windows undocumented native API, interesting article updated
  138. Different paths in different Computers
  139. Ring 0 -> Ring 3 : Upward calls and downward returns theoretically possible?
  140. Security Accounts Manager
  141. protection CD's
  142. finding documents about CPU cache locking ( for Intel P4)
  143. Hack-a-Bike
  144. Old DOS Stack handling by Win2k
  145. Reverse engineering a firmware
  146. VB reversing
  147. DRIVER_OBJECT structures list
  148. little state of art in decompilation
  149. XP using not only ring0/ring3?
  150. The Infamous "VB4 PCODE & sx32w.dll"
  151. NEW: Syser Kernel Debugger by wuyanfeng
  152. Multiple same hardware issue in programming
  153. Article: Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass
  154. Looking for some help with softice and installshield methods
  155. Please help...SentinelLM question
  156. An unusual driver based Time-trial protection
  157. HASP HL
  158. phys @ EE200000h..
  159. article on ring0 exploits
  160. Hardlock HL-CODE
  161. JavaCard internal structure (JCOP, CyberFlex, etc.)
  162. OSIX Articles: Avoiding Debuggers; Self Modifying Code - Defeating the Disassembler
  163. How to force data into a specific PE section?
  164. what the hell with windows installer
  165. BGL (babylon glossary) to GLS (babylon glossary source).


Tools of our Trade (TOT) Messageboard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard
PDA

View Full Version : Tools of our Trade (TOT) Messageboard

Pages : 1 [2] 3 4 5
  251. Looking for PEeditor 1.7
  252. ICEDUMP Problem
  253. S-ICE && full screen mode
  254. Softice's ? (evaluate) command problems...
  255. To Kayaker, Is this the right place? ;)
  256. error during translation...
  257. Attacking DELPHI 1.0 target
  258. SoftIce Backtrace buffer
  259. Search for 'IT Add by SV'
  260. SoftIce
  261. IDA / symbol loading Q..
  262. screendump function for icedump
  263. Smartcheck crash in WinME with this prog...?
  264. DriverStudio 2.0.1, Icedump 6.023 and Windows Millennium
  265. IDA sig file loading problem
  266. Win2k SP2 and W32dasm 9.83
  267. SoftIce NT, API breakpoints don't work
  268. nice collection of debuggers/editors/related tools
  269. Lord Caligo
  270. Icedump
  271. Cracking IRIX software
  272. OllyDbg 1.03b released - plugin support
  273. How 2 grab SoftICE's screen ?
  274. SEH exceptions
  275. WDasm 8.93 under w2k
  276. softice USB troubles
  277. Looking for Unsafedisc 2.10 or higher that works ok!
  278. Basic IDA question?
  279. i8042prt.sys
  280. Extracting asm from programs for use in keygen...
  281. SoftIce: symbol not defined
  282. Getting SI to start upon prog execution
  283. Symbol not defined
  284. softice and getwindowtexta
  285. Anyone remember who did that vb5 thingy
  286. need help
  287. Any W32dsm gurus listening...?
  288. SoftIce and Win2k problem... again... :(
  289. FlexLM FLIRT signatures
  290. Win2k + sp2 ==> crashes computer... plz try to help.
  291. problem with TRW2000
  292. 'T' - ing in SoftICE: But lets stick to the debugged process...
  293. Hiding SI NT2K :)
  294. loader32 deletes my .nms file after creating it?
  295. Help with install icedump
  296. Searching for SentinelLM 7.0 SDK
  297. How to patch Registry Settings by Crack?
  298. SoftIce with VMware (Win2k)
  299. Windows,its debug binaries and SoftIce
  300. FlexLM SDK 7.2f trouble.
  301. Halvar Flake
  302. SoftICE and Win ME
  303. FlexLM no HostID=ANY
  304. SP2, Win2K, SoftICE, and Problems
  305. Reversing a VB6 exe to see event procedures
  306. softice and win 98
  307. USB+SICE = Driver Studio 2.5(b)?
  308. SmartChech and WinME
  309. RE
  310. InstallWatch 2.5
  311. Can't get bpx GetDlgItemTextA to work???
  312. uh-oh... heya r!sc, any update for SafeDisc 2.40.10 planned?
  313. where I can download ImpREC
  314. How to instal Icedump ?
  315. can't run softice in high color mode
  316. SoftIce/Mouse compatibility
  317. Softice and Hex Works - Not working for some reason
  318. IceDump installation again
  319. Windows ME kernel not loading into SoftICE
  320. Siftice405 and WinMe
  321. Can anyone here help me with S-Ice for DOS??
  322. trouble installing icedump
  323. Missing SoftIce Commands!!
  324. New Tool: AirSnort
  325. Win2K API names
  326. Invalid Page Faults
  327. Ultra IdeAsm
  328. SoftICe Resolution
  329. vbox vs procdump
  330. How can i know softice's program interface?
  331. Softice breakpoint on a string??
  332. Sorry for the big messageboard interruption.
  333. Memory dumping 16bit code
  334. SI, VB and a 16bit DLL
  335. HELP: Error translating debug symbols...
  336. wdasm8.93 segfault?
  337. website capture tools
  338. Icedump for NT
  339. how to Find flexlm 6.1x Seed1&2
  340. Detect IceDump?
  341. binary uploads in virtual process space using ice
  342. PC-Lint 8.0 anyone?
  343. Driverstudio2.5 timelimit
  344. Protools?
  345. Softice and XP Pro
  346. ida scripts
  347. Softice and Windows ME. -------- HELP!!!
  348. Crypkey KeyGen
  349. Zipped up Site
  350. softice
  351. help
  352. IDA auto param recognition on OLDER versions with VALUES!!
  353. Revirgin problem
  354. SoftIce v4.05, VB6, and Win2kSP2
  355. Flair38
  356. softice 4.05 - load up problem HELP!
  357. IDAPro problem??
  358. SnetinelLM sdk 7.1
  359. Revirgin users !
  360. FTP mirror or other ressource for Num*ga files ?
  361. LMD Tools version 5.0 crack
  362. using softice with map file
  363. can soft-ice for dos be load in the lower memory
  364. Only IDA 4.17 can disassemble this dll...
  365. Softice and large memory configuration
  366. lost W32Dasm file
  367. IDA v4.15 leaked / stolen.
  368. Trail Sentinel LM Shell
  369. w32dasm 9.0
  370. TRW2k (Win95/98 v1.23) problem
  371. Problems with a slm 7.1 sdk installation
  372. particular tool
  373. Greetings..
  374. Debugger Tool
  375. How to download the Messageboard
  376. SI + w2k + mouse
  377. NE1 :: Got a local copy of CrackZ site b4 it went down????
  378. SoftIce Video Problem
  379. VB decompiling
  380. hmemcpy not in ME, please chastize here
  381. elcom apps
  382. Need help with IDA Plugin
  383. Help me hide SI (win2k sp1) please...
  384. Geforce / w2k & softICE
  385. Quick Win programming constants interpretation ?
  386. S-Ice - just freezes everything
  387. Driver Studio 2.5 and IceDump 6.024
  388. How to load Borland debug info into IDA (4.1.5 for example) ?
  389. Softice breakpoints sometimes leave nasty int 3 !?
  390. System freeze on BPR in SIce
  391. softice config
  392. Maybe off-topic, but...
  393. Smartcheck and Windows Me
  394. IDA v4.17 leaked / stolen.
  395. Driver Studio 2.6 released
  396. Breakice for DS 2.5
  397. Iczelion home page
  398. Crashing DeDe
  399. opcode generator
  400. SoftICE 4.2.5 keyboard mapping
  401. [not] initializing softice
  402. Basic Softice use
  403. softice - loading a .dll's export table
  404. Anti-disassembler tricks
  405. IceX by Mamaich for Softice
  406. Wild idea: BOCHS
  407. IDAW and Amante's plugins (Q was asked on REMB forum too )
  408. Altering protection flags on pages with SI
  409. I need help...
  410. Hiding SI in WINNT4/2K DS2.5
  411. Softice problem.
  412. Driverstudio 2.6
  413. Loading a dll
  414. ASPI call log
  415. .TIL files in IDA Pro 4.1.5 and above...
  416. Soft ice keyboard problem (qwerty to azerty)
  417. Sice + NUM-Key
  418. softice for a newbie
  419. DriverStudio 2.6 + XP problems again...
  420. REQ: NuMega SmartCheck 5.0
  421. SmartCheck - FROM MICROSOFT !!! (Well...not really.)
  422. Numega DevPartner Studio (Enterprise) 6.7
  423. Exe2Dpr v3.1
  424. Revirgin bug ?
  425. Ati Radeon7500/8500 and Softice?
  426. Newbie question SI
  427. Commenting - Softice 4.05 and above
  428. DS 2.6 produces grafical garbage
  429. Who have the flexlm6.1 flirt signatrues?
  430. IDA Pro Question
  431. TimeFix, softice time tool
  432. Bpx on win2k ?
  433. exdec crashes
  434. tools that logs a program address CS:EIP execution?
  435. Softice question
  436. Plugin for Ida 4.1.5.520
  437. Winice.dat file config
  438. idc scripting newbie question
  439. softice show nothing after Ctrl-D
  440. Soft Ice breakpoint
  441. win2k softice problem
  442. SentinelLM FLIRT SIG's
  443. alfpas2idc.pl
  444. WICE vers
  445. softice with windows xp
  446. DS 2.5 and XP probs
  447. Softice crashes Computer before os can start
  448. icedump question
  449. Softice Break Points
  450. Softice and IceDump Help Needed
  451. SMARTCHECK help is needed!
  452. W32DASM Max path length
  453. Stupid 9x/DOS question
  454. Softice 3.25 Under windows2000 professional
  455. DriverSuite2.6 with XP
  456. Softice not breaking
  457. SoftIce causes me the blue screen
  458. How can I bpx the WINSOCK apis (with SoftIce)?
  459. Is there any universal breakpoint like "hmemcpy" in win2k or xp?
  460. rv 1.3 bug
  461. My softice doesn't work in windowsXP!!!
  462. W32Dasm 8.94
  463. Writing an OpCode Generator
  464. Profiling ->PURE<- Binary without source!!
  465. best Exe identifier??
  466. possible bug in icedump
  467. IDA Pro 4.17 and Windows CE apps (for MIPS processor)
  468. Error running Revirgin
  469. Procdump scripting...
  470. Win2K problem
  471. PatchEngine 4.5 English
  472. Icedump
  473. softice
  474. Filemon/Regmon Programs
  475. LordPE goes freeware :>!!!!
  476. Diassembler-Sources ?
  477. SI 4.05 + W2k: 'p ret' troubles
  478. Win2K Pro and SoftIce (Not Repost)
  479. IID King problem
  480. Mow???
  481. Softice symbol help.. please help if u can
  482. Problems with revirgin?
  483. How to load *.TDS files into SoftICE?
  484. good InstallShield 6.x decompiler but how to use its debug info?
  485. SoftICE on XP
  486. Hackman
  487. Announcement: OEPFinder
  488. WKT Debugger and commandline arguments?
  489. Softice itstallation problems on W98
  490. SuperBPM on Win2K???
  491. need vb3 decompiler
  492. Debugging and tracer.
  493. Need program to read input
  494. icedump question
  495. SoftICE Boot Probs on Windows ME
  496. Announcement: OEPFinder v0.2 Hybrid Build
  497. New Tool: First_Thunk_Rebuilder 1.2
  498. CrypKey sig for Ida ?
  499. How to bypass Firewall?
  500. icedump building


Tools of our Trade (TOT) Messageboard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard
PDA

View Full Version : Tools of our Trade (TOT) Messageboard

Pages : 1 2 [3] 4 5
  501. Bdasmdll.dll ?
  502. SoftICE BackTrace Dissassembly Tool
  503. BigNum Calculator
  504. Armadillo 2.5
  505. Configuring Softice for the first time
  506. GetWindowText problem
  507. i need help on patching softice´s frame color
  508. SICE and XP...
  509. sice on 2k (again...)
  510. Numega...
  511. Revirgin 1.4
  512. Some Armadilloed Targets for testing....
  513. ReVirgin 1.31 problem with large IAT
  514. SI install problem
  515. Hall of Shame
  516. SoftIce question tracking
  517. need sentinel dongle cracking advice
  518. Litestep & SI
  519. SoftICE 4.05 & Win2K (problems)
  520. SoftICE HMEMCPY problem!!!
  521. SoftICE/Install/Windows ME
  522. Why my system crashed?
  523. export any functions from a DLL
  524. knlsoft.com down (forever)?
  525. WDasm32 & W2Server
  526. SoftIce Crashes abruptly!@!
  527. flexcv - convert hex or integer value into lm_attr define
  528. AIPH first public version!
  529. PEViewer V1.0
  530. SoftICE vs. Detonator 29.40
  531. SoftIce BPR crahes comp
  532. Will SoftIce be okay on my dual-boot computer?
  533. OllyDbg, usage hints
  534. ????? in softice data window
  535. New Matt Pietrek PE File Format Article
  536. new progyy
  537. Wdasm Crasher
  538. New tool of our trade: windbg
  539. CodeView
  540. n00b need help
  541. Announcement: OEPFinder v0.3 Tensor Build
  542. softice - breakpoint on export beginning with @
  543. Softice Help Plz
  544. Here is the usual idiot
  545. winice.dat
  546. Softice Crashing...
  547. problem while Unpacking under XP (using RV and SICE)
  548. Hmemcpy with SoftICE
  549. SIce and Windows XP (No, is not the same old question)
  550. Problems with SoftIce (symbol not defined) I did Dat stuff.
  551. problem with softice
  552. W32Dasm
  553. Win 9x --> WinNT
  554. String Ref
  555. vbox 4.5, trace X 6.025 & DreamWeaver 6
  556. CoXoC's API Hooker or haspfind.com needed
  557. C Source Code Generator
  558. Softice DS 2.6 ans WinXp Sp1 (beta)
  559. SI4.05 with winMe
  560. SI DS2.6 and Win98, the oddest thing ever
  561. Hiew...
  562. C source code for an assembler
  563. Announcement: ProView 0.5 Test Build
  564. SCREENDUMP feature in NTicedump needed
  565. Driver Studio 2.6 anti detect patches.
  566. Dede probs with directdraw graphical stuff
  567. icecump problems
  568. trw2000 plugins needed
  569. Ida
  570. PEiD v0.8
  571. trw2000 plugs
  572. icedump assembly
  573. Sice says "Symbol not defined"
  574. Sice problem! Can't bpx __vbastrcomp!?
  575. How to install icedump?
  576. Dede source code available now
  577. Stud_PE 1.5b preview
  578. Still wondering...
  579. Numega DriverStudio 2.7
  580. Win2k -> DS 2.6 BSOD (hal.dll) HELP!?!?
  581. TRW2000 internal
  582. Waiting for DeDe Comment, Ideas, Questions etc.
  583. Mouse problem with SoftIce 405
  584. First beta of new DeDe available
  585. Softice and screen refreshing
  586. Can I set a breakpoint on a key press?
  587. Newbie-Question: How to add code with WDASM or Code Snippet Creator?
  588. LordPE Deluxe
  589. Softice - how do I return to calling code?
  590. DS 2.6, icedump, win XP -> fail
  591. Does a tool like this exist?
  592. Stupid Newbie Revirgin Question
  593. Fsg 1.3
  594. Program's memory location in SoftIce (DriverSuite2.6)+ W2k
  595. softice with vmware
  596. Generating IDA .sig files from Delphi units?
  597. Setting a breakpoint in Softice
  598. Symbol Loader wont work???
  599. FSG 1.31 Update
  600. W32Dasm Problems....
  601. WinXP: SoftICE breakpoints dont work?
  602. "Patch program" functions removed in IDA Pro?!?
  603. debugs debugger's int handler
  604. W32Dsm Question
  605. RegMon & FileMon. COnflicts!! please Help!!
  606. xframe problem
  607. Help with Hiew
  608. IDA & argument propagation
  609. Driverstudio 2.6 and Windows XP SP1
  610. softice help
  611. XP SP1 and XP SP1 Symbols
  612. problems with W32dam....need some help!
  613. softice help
  614. Changing keymap in Softice
  615. Hiding SoftIce
  616. Toughts on code de-obfuscator(s)
  617. hiding softice under winxp
  618. Driverstudio 2.7 and Windows Me
  619. pagein error in si 4.2.7
  620. DriverStudio 2.7 is *out*
  621. Smartcheck version info
  622. DevPartner 7.0
  623. IDA disassembly relocation
  624. Tool
  625. Strange Things: Cxop, WinMe, Ds 2.7
  626. Avoiding INT1 detection of SoftICE under WinXP
  627. DriverStudio and DevPartner with VC++ Standard
  628. SoftICE 'bprw' vs. Athlon processor (lockup)???
  629. IceDump - load?
  630. annoying bug of SoftICE Symbol Loader :(
  631. Softice for NT
  632. Iceload not breaking on entry...?
  633. Here is the SuperBPM for WinNT
  634. SoftICE virgin
  635. icedump 6.026 final working
  636. Mechwarrior4 keeps detecting Softice
  637. Softice 4.2.7 loading
  638. SoftICE search function ?
  639. SI Breakpoints
  640. SOFT-ICE wince.dat Download
  641. just a bug in ds27 & W9X
  642. IDB 2 SIG for IDA Pro 4.3
  643. smartcheck easter egg
  644. Debugging java byecode
  645. how to show the module size
  646. w32dasm winxp problem
  647. Anti-Smartchk? ImageHlp.dll... int3? what?
  648. Patch for DriverStudio to fix problem of Symbol Loader not breaking at WinMain
  649. Run-Time Debugging Full-Screen Applications in Windows 2000
  650. A small tool...
  651. Making IDA work "like" w32dasm
  652. new free debugger?
  653. sice display
  654. Revirgin , tracing, etc.
  655. ida mdi?
  656. icepatch
  657. Driver Studio *2.7* anti detect patches.
  658. SICE (4.0.5 334) bug ???
  659. Probably a stupid question, but hey who knows...
  660. DS 2.7 Patch correction. Sorry.
  661. IceDump & VXDLDR_LoadDevice error ???
  662. softice help
  663. SoftIce Not breaking in XP? Try this.
  664. Softice doesn't break !!!
  665. tracex on NT...
  666. Writing to Process memory within SoftICE
  667. VFAT Error when loading softice
  668. TELock 0.99
  669. Softice: (hmemcpy problem)
  670. debugger for linux
  671. LordPE dumper vs. Icedump vs Procdump etc
  672. Advanced search in Softice?
  673. open source tools
  674. Armadillo IAT plug in
  675. Tiny tool for S-ICE\Win9x released
  676. Patcher Outputs ASM Source
  677. [OllyDbg] new users forum
  678. OLLYDBG Question
  679. New FSG, 197 bytes of loader code
  680. OllyDbg 1.08 released
  681. Debuggers/Disassemblers?
  682. New Tool: Regmon Log Duplicate Remover
  683. hooking a plugin export entry in ollydbg?
  684. Does SI4.05 support different keyboards?
  685. IDA Difference file patcher???
  686. Driverstudio 2.7 and video problem
  687. Why does IDA behave like this? (arbitrary halt of disassembly, and more...)
  688. Dogbert's Genuine Patching Engine
  689. RV Tracer (not for the apis...)
  690. Devpartner7 vs. web browser performance?
  691. tracedump?
  692. Hardlock Memory Dumper
  693. IDA 2 SICE plug-in failed
  694. Serious softice problem
  695. A short note to .vxd authors ...
  696. flexlm 8.0c sdk builds 8.0c makekey
  697. Best memory searcher?
  698. softice symbols ramblings
  699. mamaich BlindStudio?
  700. Olly Debugger
  701. looking for new dissasembler
  702. linux reverse engineering
  703. TRW2000 : keyboard / mouse ...
  704. IDC scripting question
  705. Bug in Hex Workshop, anyone knows if it's fixed?
  706. New Tool: RTA 1.00
  707. Palm Os Reversing
  708. ImpRec/RV questions
  709. softice disassembly problem
  710. IDA IDC/plugin writing
  711. debuggin technique? dumping eip
  712. Problems with RV tracer
  713. SoftIce Server - dynamic stopping & restarting
  714. Winsock spy programs
  715. Revirgin 1.5.1 Bug???
  716. problem with rta
  717. WKT VB Debugger
  718. ARMPA and AIPH2
  719. New Tool: TraceDump SoftIce Backtrace Disassembler v2.0
  720. Looking for Disk Analyser
  721. New "tool" - S.I. int 3 / int 1 patcher
  722. hwnd problem under XP
  723. copy and paste under Softice
  724. help making ntice break on exception.
  725. help needed : mouse drivers; WdM/ not...
  726. Code Snippet Creator question
  727. bpx problem in SoftIce
  728. String references in Olly ?
  729. dldr.exe - Sice is not loaded.
  730. new debugger(vvvvvvvvery good)
  731. unloading softice?
  732. Where ? DeDe 3.50.02 build 1619 - full (with new DSF and DOI v2.3)
  733. Resource editors
  734. RTA 1.10 Sneak Preview and wishlist thread :)
  735. Tool: RTA 1.10 - Released...
  736. SICE crashes with DX 9
  737. Preventing Decompilers / Disassemblers
  738. OOps i did it again
  739. Softice 4.05 NT
  740. Tool Update: RTA 1.20 released...
  741. Avoid INT1 detection of NTICE under 2k/XP
  742. NTICE Detection method in PESHIELD ????
  743. okay, all is fine now, BUT...kernel32!unhandledexceptionfilter
  744. weird output of JAD Java decompiler
  745. Can someone explain the unhandledexception mystery !!!!
  746. driverstuio 2.6 + sofice
  747. Live DLL Injector.
  748. A new generic multipurpose patcher tool
  749. Tutorial for Ollydbg
  750. Linux Lice Debugger - A request....


Tools of our Trade (TOT) Messageboard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard
PDA

View Full Version : Tools of our Trade (TOT) Messageboard

Pages : 1 2 3 [4] 5
  751. dll-in-the-middle
  752. Rename NTice service. SuperHidden! :P
  753. Dynamic Breakpoints?
  754. Combinations of Sice and Win98
  755. SOFTICE Problems..
  756. SoftICE battles DOS-Mode !?
  757. Strange problem...with softice!
  758. Softice under Windows XP
  759. New !Improved! UnHandledExceptionFilter sollution!
  760. conditional breakpoints
  761. Windoze XP updates and Sice
  762. How to get IDA sig files quickly for lots of Delphi units
  763. Asprotect Debugger v0.99b
  764. SoftICE on a Laptop
  765. Small New Tool
  766. Softice and the clock
  767. VB p-code IDA plugin
  768. Anticrash patch for WKTVBDE v1.3
  769. Need help with Soft-Ice
  770. Waiting for the translation
  771. softice DS2.7 Problem
  772. Softice SYMLOC function
  773. Exctracting Debug Mode Exe
  774. Pseudo-HMEMCPY in OllyDbg?
  775. revirgin probs
  776. Some IDA Sdk help...
  777. New Disassembler - Spasm
  778. hide softice on XP :( sorry
  779. Softice4.05/Install/Won't Run
  780. INQUISITION IDA Pro plugin is released!
  781. need help,use SoftIce under win 2003
  782. frogsice documentation
  783. RTA 1.20 source code release
  784. ResFixer v1.0 beta 1
  785. IceExt 0.30
  786. DriverStudio 3 b2
  787. Driver Studio 3.0beta2
  788. calculation under softice
  789. Need some help with DeDe plz
  790. starforce3 and ntice under 2k
  791. PEiD 0.9 available
  792. Some INQUISITION news
  793. RTA 2.00 Beta 2 Release
  794. PE Tools by NEOx
  795. Multiple data-windows in SoftICE/Video problem
  796. Visual SoftIce?
  797. A New Tool...
  798. retool v1.04 - first public release
  799. tELock plugin for imprec
  800. exe32pack unpacker/dumper with source
  801. softice windows 2000/sp3 boot mode problem
  802. Beginner's Visual SoftICE
  803. retool v1.06 released - sourcecode now availible too...
  804. anyone has tried LiveKD?
  805. DriverStudio 3.0 BreakPoints
  806. PVDasm 1.03b
  807. Problem with SoftICE 4.05 and Win2000 (Softice isn't breaking with F12 or F11)
  808. how i can save my trace in softice ???
  809. Just another problem with sice in XP
  810. SI and XP and no KB...
  811. stupid question about IDA
  812. problem with nt all (frogsice clone)
  813. PVDasm v1.04
  814. retool v1.06a - new version released
  815. IDE or editor for Intel C++???
  816. SoftICE Driver Suite 3.0.1 (StinkyD) problem
  817. Can't start softice in winxp sp1
  818. trace calls
  819. SoftICE Driver Suite
  820. PEiD v0.91
  821. retool v1.07
  822. Driver Suite 3.0.0 Problem?
  823. can't load softice
  824. Compuware SoftICE 4.3.0 Lite Edition
  825. N-Rec - armadillo nanomites recover tool
  826. Softice issues. Reboots PC
  827. Poker-Winner problem
  828. Hiew and XP SP1
  829. End of Unpacking/Decrypting Routine
  830. logging calls to a particular function in ollydbg or softice
  831. Tool to find caves into an app to add extra code???
  832. Anti-Smartcheck Code
  833. app similar to hiew
  834. edit a gfx ?
  835. SoftICE on win2000
  836. Trial Doctor
  837. Low-level (not necessarily process specific) memory editor for Windows XP?
  838. SoftIce + XP one big, or 3 small probs..
  839. Tool to edit imported functions???
  840. Display Driver Problem
  841. Help! Random reboot using SoftICE for WinXP!
  842. "Cleanest" way to add DLL functions? Looking for an imports editor.
  843. Its me again :) SoftIce prob
  844. help,Need all the asm references
  845. Better hiding of Softice
  846. Armadillo Goblin
  847. bpx bug in WKTVBDE 1.4 found+fixed+tutorial :)
  848. KANAL Sources
  849. IDC short-circuit evaluation
  850. Softice startup problem in XP SP1
  851. OllyDbg scripting plugin
  852. Softice 3.1 and Breakpoint Options
  853. Softice on notebook crashes
  854. New plugin for OllyDbg
  855. PUPE now in english
  856. visual softice Vs. Softice
  857. softice problem
  858. Possible to load NTICE manual ?
  859. Softice Breakpoints
  860. Russian Webhosters against IceExt...
  861. PEiD v0.92
  862. RE on server 2003?
  863. BigInt Calculator
  864. Aspr Stripper 2.07 final
  865. IceExt and DS 3.1
  866. A request but keep the screaming down :)
  867. Softice as JIT debugger
  868. SoftIce Just runs Once !
  869. FlexLM SDK v9.2 source code leaked
  870. new ollydbg feature
  871. Asdd
  872. Cuestion Concerning Imprec. 1.6
  873. Olly Problem
  874. Sice for DS4.3.1 (WinXP)
  875. Softice Will not display
  876. Revirgin and BSOD
  877. keyboard problem with SoftICE on NT systems
  878. Again... XP+SoftIce 4.27
  879. !dump in IceExt 0.62
  880. Another nice (Crypto)Tool from reteam.org...
  881. BPM doesnt stick?
  882. ds 3.0
  883. A Good Api monitor tool
  884. ds 3.1 win2000 not breaking
  885. [Release]I make this PE'tool for chaging a PE file
  886. BPM on multiple CPU system
  887. VMWare & Softice - Experiences, problems and solutions
  888. I need ollydbg help
  889. Driver_irql_not_less_or_equal
  890. DrCOM Monitor...
  891. WKT Debugger Problem
  892. what tools are best
  893. Symbol Loader not loading from CL
  894. getversion system crash
  895. REQ: binary calculator
  896. A Protected Mode Debugger
  897. ida misinterpreted data section as code
  898. Custom calling conventions in IDA
  899. Any way to add new vid drivers for SoftICE?
  900. Anyone have any good IDA tutorials (how to use)
  901. ntice 4.27 on win2k sp4, cannot load advapi32.dll
  902. NTice.sys Patch for DriverStudio v3.x,fix problem of Symbol Loader not breaking at Wi
  903. Softice, VMWare and INT3
  904. Softice & IDA symbols
  905. FSG v2.0 executable packer
  906. Old winice (vxd) & relocation
  907. Softice 4.05 breakpoints
  908. Olldbg and Symbol Files
  909. Sice loading problem
  910. "Relative" Debugging.
  911. IceExt & DirectX
  912. Another IDA Pro website
  913. Is there such a tool?
  914. Does IDA debugger show live memory?
  915. softice 4.05 and WINME, black screen on start-up....
  916. Softice (driverstudio 2.7)
  917. IceExt 0.64
  918. IDA MakeStruct
  919. ida pro plugin question
  920. SoftICE Console
  921. NanoFixer v1.0 [for Armadillo 3.6x - 3.7x]
  922. IceEXT problems again
  923. USB Mouse
  924. dUP 1.03
  925. Remove assembled code from image
  926. RegQueryValueExa Help (New)
  927. Format String Bug in OllyDbg 1.10
  928. PVDasm 1.5c
  929. Delphi 6 and 7 IDA Signature
  930. Tool to convert RVAs to physical addresses???
  931. new linux disassembler
  932. Can't disassemble
  933. IDA FLAIR
  934. Problems with IDA
  935. Function Start/End Addresses in IDA (IDC coding)
  936. adobe acrobat and sice
  937. Updated Support for Visual SoftICE 3.0/3.1 (XP SP2/ W2K3 AMD64)
  938. AZURE IDA Pro plugin
  939. IceExt troubles
  940. New kernel32.ids and D7RTL.sig for IDA
  941. SoftICE Woes on XP
  942. IDA_2_PVDasm (MAP)
  943. Down memory lane
  944. IID King 2.0
  945. have anybody analysed TRW2000 reversely
  946. ida sdk api
  947. Olly Prob
  948. Icedump substitute ?
  949. Full Delphi 6 and Delphi 7 Signature For IDA
  950. PV Dasm1.5d
  951. BPINT 3 Problem
  952. SI problem
  953. Problem with KD (Kernel debugger) from WinDBG pack.
  954. Plugin OllyDbg problem
  955. softicent427 ? ?
  956. Changing the key combination to invoke SI
  957. Not another bloody SoftICE problem.
  958. olly plugin scripts
  959. Any way not to load si405nt
  960. deARMPro v1.0
  961. iTunes + SICE. Will it ever be?
  962. PVDasm 1.5e
  963. Boomerang decompiler
  964. New i2s -> completely rewritten
  965. SoftIce 2.7 and HT ?
  966. Keyboard repeating in softice
  967. OllyDebug bpx question
  968. tool for searching strings
  969. winxp sice BSOD
  970. Window handles
  971. VB resource editor
  972. New i2s -> 4.03
  973. New i2s -> 4.04
  974. How to edit instruction in IDA pro
  975. Ollydebug access violation
  976. New i2s -> 4.05
  977. [BUG] NTICE DDRAW function
  978. Softice - updating code in memory ?
  979. Memory Hacking Software
  980. Unfinished Wise Script Decompiler
  981. Looking for compression Library jcalg
  982. DS31 softice in XP with XP2
  983. W32Dasm v8.9 Problems
  984. windbg final 6.4.7.2
  985. IDA Buffer Overflow Vulnerability
  986. PEiD Buffer Overflow Vulnerability
  987. RVA Of Events
  988. Guide How to play with processes memory, write loaders and Oraculums + full framework
  989. Re-Pair 0.2
  990. W32DASM Buffer Overflow
  991. Armadillo Tools v0.1
  992. winice / ds 3.1, SP2 & AMD64 processors
  993. c2u by Proferror Nimnull and MakeCrk by Doctor Stein's Lab
  994. Rootkit Revealer
  995. New I2S -> 4.06
  996. Distributed reverse engineering with IDA Pro seems to be now a reality
  997. Hiew
  998. Tools: Developer Playground & ComTrace
  999. Need dilloed apps
  1000. A debugger that can step backwards


Tools of our Trade (TOT) Messageboard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard
PDA

View Full Version : Tools of our Trade (TOT) Messageboard

Pages : 1 2 3 4 [5]
  1. iceext 0.67 prob
  2. Softice Breakpoints
  3. Is there such a tool?
  4. PVDasm 1.6c is Available
  5. New remote code execution vulnerability in IDA Pro...
  6. Two small plugins for OllyDbg...
  7. ProcessSpy
  8. Unicode strings in IDA
  9. Visual C++ Toolkit 2003
  10. Flexible Patcher?
  11. SoftICE Keyboard Support under Win2K
  12. Olly Invisible Plugin
  13. Just a loose idea for a tool.
  14. IDA auto function arguments
  15. IDA FLIRT Annoyances
  16. IDC to UDD converter?
  17. RE: Adding mouse functionality


Packing and Unpacking Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum
PDA

View Full Version : Packing and Unpacking Forum

Pages : 1 [2] 3 4 5 6 7
  251. SoftIce and 16 bit code.
  252. reversecourse.cjb.net ?
  253. ROR EAX,4 help
  254. VB Source for Crack
  255. Whic Breakpoint?
  256. Using Softice - display command
  257. Still BIG SICE Problem
  258. msn messenger ad
  259. Help with protection
  260. Reversing Regmon Tutorial
  261. MenuItem question
  262. hmemcpy in Windows2000
  263. Crack For Hip-hop eJay
  264. ASM help
  265. propellerhead reason
  266. SoftICE Symbol Loader Problem
  267. Windows 2K S Pack 1 HELP
  268. Probs With Win2k And Softice
  269. Sentinel CPlus Dongle - I'm half way there.
  270. W32dasm and Windows 2000
  271. ;STATUS_BREAKPOINT ?
  272. Softice and Win ME
  273. crack tornado (vxworks) install serial
  274. I need Help with Digi Guide
  275. Softice knowledge sharing and questions
  276. THe ReVirgin PRoblem!
  277. Help with a vb6 program
  278. Patcher Source for win32asm
  279. I am reverse engineering right or I am just reversing everything in sight?
  280. How do I recompile lmcrypt (FlexLM SDK source codes)?
  281. How to crack the MStudio
  282. Paint Shop Pro 7.02
  283. HELP! SIce&WinME prblm(I'm Goin Crazy!)PLZ SOMEONE!
  284. Runs under 98, but not NT2K
  285. getting past SD2 antidebugging
  286. Cracking a packed?????
  287. IAT
  288. can you help me in a IP problem
  289. Do you now a serious site for programs cracking?
  290. fucked up message
  291. softice font
  292. Windows Commander 4.5.2
  293. Installshield V5
  294. HELP!! I am a totaly newbie at this.. HELP!!
  295. help me
  296. armageddasya
  297. getting started with softice 4.05 nt/20000
  298. IMPORTANT !!!! JOIN teAm_Cracking (CRACKER, CODER, GFXer searched for)
  299. New Boson exams :How do I Add Command line functionality to TRW2000 ????
  300. RCE Archive CD?????
  301. Unpacking a .DLL
  302. Can Someone teach me or help me
  303. Win31 CDROM check
  304. Flash 4 , Fireworks 3 , Dreamveawer 3
  305. Code Guide from Omnisoft
  306. n e 1 willing to teach me RE please e-mail me!!
  307. Softice Install! Need Help
  308. cd-key
  309. a question by newbie.. please refer me to the right tutorial
  310. Unpacking without SI
  311. Crackme without the usual jumps
  312. I'm looking for a SUB7 documentation
  313. Reversing notepad.exe
  314. Is it possible to save a code window output in SICE while F10, F8?
  315. 30 day trial
  316. help 4 si 3.24 w/win98...............please
  317. How to crack the flash5's cd-kay????
  318. how do i use SICE to do what i want to do with programs written in VB
  319. bpx GetProcAdress
  320. MANUAL UNPACKING
  321. softice blues
  322. Is it possible to crack a DX plugin with SI?
  323. FlexLM
  324. Newbie: how does a prog detect it has been modified ?
  325. VB P-Code
  326. Masm32.exe
  327. unpacking & registering, please help
  328. trying to find the most up-to-date tutes
  329. keyboard simulation
  330. Could some one tell me more about Brute Force ~ I am totally New to This
  331. Can anyone crack Macromedia Director 8 for me???
  332. DLGTEMPLATE
  333. ultradev4
  334. HMEMCPY on WinNT
  335. KEyboard api!
  336. help running sice with win me
  337. Sentinel CPlus B
  338. Dongle Protection
  339. I'm a new beginner ... How to crack mirc.exe .. step by step .. !! And make it my own file
  340. Need help for my first crack, working 2 days w/out any effects
  341. newbiecracker
  342. Dump the Backtrace History buffer ????
  343. cracking dos prg
  344. Office 2k Cracking
  345. Office 2k Cracking
  346. The Mod Function
  347. Extreme Virgin Help
  348. new tutorials
  349. msgboard interruption
  350. Newbie needs help with first program...
  351. Ebooks sites
  352. Congrats On the New Job :)
  353. VBox 4.3 unwrapping problem
  354. synd.exe
  355. need some info bout cossacks
  356. Pooldemo.exe
  357. RCE CD
  358. Laughs For You All :p
  359. How to crack this task?
  360. CopsVerify
  361. Signlab 5.0
  362. assembler
  363. WinIce in & Windows ME
  364. how do unpack/dump a 16bit windows app?
  365. sice bpx on dll/function access
  366. Some problem with proxies may arise here...
  367. Int 13
  368. The isp was changed just today
  369. fiendish games key manager
  370. MFC32.ordinal.???
  371. Serching for tutors on ExDec or other pcode tools
  372. Subliminal "Embeds" in SoftIce.......
  373. softice not showing up?
  374. What to look for with a VB 6 app?
  375. Serching for tutors how to dump & convert dumps to exe
  376. TUT FOR USING IDA PRO
  377. some kind of CRC that i can't overcome
  378. what packer did I just unpack?
  379. Decompile .inx
  380. Si breakpoints for delphi stuff? please
  381. Which book for learning about Windows Internals?
  382. help with packed program
  383. RegMon Detection Protection
  384. Delphi IDE detection ? - for Help ...
  385. PDB--->NMS, How?
  386. sentinel superpro sheme : someone understand this ?
  387. this sentinel dongle kill me ! please need help
  388. Software sniffers for LPT and COM Ports
  389. Telock signature problem
  390. The small essay from newbie showing how to dump packed VB programs and find entry point in dump
  391. the rest of the setup process : dongle thing
  392. dongle bash
  393. So new it's embarrassing
  394. --> Need Help !!!
  395. Trouble cracking windows commander 4.51
  396. Thanx
  397. Is any non commercial protection a-la Soft Sentry known
  398. FS 98 atc
  399. How to hide SICE under Win2k when unwrap VBOX43??
  400. Harlequin
  401. "xxx is not a vaild Win32 application" errrrrrrg
  402. How to pass the installshield 6 anti-softice tricks?
  403. Hi
  404. Where to learn crack of safedisc 2?
  405. De -armadilling
  406. Installshield 6 -Need help
  407. who has already seen this protection ?
  408. teleport pro
  409. Error Message windows98
  410. How to attach Files ?
  411. unwrap vbox43 problems..
  412. where can d/l Win32 API Reference or help?
  413. HWND error message
  414. PassMark PerformanceTest V3.4
  415. What is the easiest thing to unpack?
  416. Good packing tutorials?
  417. Armadillo Killer 1.3 (CopyMem Edition)
  418. Failing miserably....
  419. FlexLM license generation
  420. FlexLM license generation
  421. Time keeper or Killer????????????
  422. I can't seem to get this serial
  423. Problems Inlinepatching AsPack v2.11c!
  424. Crippled target
  425. VBox 4.5 & revirgin... need some help
  426. Reverse engineering under UNIX/IRIX, looking for advise and help.
  427. seeking tutorials on reversing CRC
  428. Mentor vendor checkout filter
  429. problem with "phantasm v1.5b3 DingBoy"
  430. packed program ??
  431. disassembling 4 serial Codes????
  432. How to delete flexlm license manager date log?
  433. A question in general
  434. Frequently Sice Problem
  435. tools...?
  436. Heh, tell GetRight it wasn't pirated
  437. Softice and System crash when going into message loop
  438. This one is about Telnet? (Newbie)!
  439. Allright, Lets findout who is our grand pa!!
  440. Digging out serial codes
  441. i've cracked my first program
  442. How to get hWnd?
  443. Enabling a button help!
  444. +ORC toys
  445. softice and breakpoints
  446. Puzzled by FPU
  447. Puzzled over ra2wav password
  448. What does the '+' sign mean
  449. I'm really stuck
  450. SoftIce and star-up!
  451. What the heck is a key code??
  452. section .protect ,what it does?
  453. Softice
  454. where can i find gdi32.inc?
  455. Serial for Twinkle Bulbs 4.0
  456. Sense of tracing in unpacking
  457. Code Charge (Unpacking)
  458. Question about jumps/addresses
  459. disassembly of a DOS programme.
  460. Searching for breakpoint(s)
  461. I've found great ReVirgin - Tutorial
  462. What means "@" in Softice?
  463. ASProtect 1.2x
  464. winzip 8.0
  465. Two questions...
  466. How to reverse program under IDA ?
  467. Registration codes-How do I read them?
  468. Help with +ORC tutorial
  469. AX NF ZZ and *.EKB files protection help
  470. Dumping/Rebuilding exe's compressed with telock 0.80!
  471. tnt-enforcer
  472. Modify Adress in System Area under Win9x
  473. packed files
  474. Weird Serial Check
  475. Help with unpacking UPX
  476. Help finding +Orc Packs
  477. PDF Restriction
  478. how to add msvbvs6.0 to winice.dat? anyone can help? thanx
  479. finding the msg loop
  480. Excel Passwords
  481. Softice......
  482. New Site VB 6.0 Cracking
  483. Can a program modify itself of disk????
  484. Thanks
  485. fiendish games key manager update ?
  486. Crypt Cotelem latest version
  487. Pixar
  488. Intercepting messages in softice
  489. New C-Dilla?
  490. where to find a PKLite 2.01 Unpacker?
  491. Enable / Disable buttons?
  492. Delphi without Dede?
  493. Something U may want to try cracking
  494. Usefull link for beginners...
  495. Full set of lessons for novices????
  496. Help with unpacking
  497. using SI for serial# need help please!
  498. where can we find some papers about SmartCheck? (NULL)
  499. Link For the Snake's Page Please
  500. when should i use ? *eax or ? eax and others


Packing and Unpacking Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum
PDA

View Full Version : Packing and Unpacking Forum

Pages : 1 2 [3] 4 5 6 7
  501. help with first reverse engineering attempt
  502. cyclic redundancy code blows
  503. Linux revs.
  504. SoftICE and Win ME
  505. want to crack dongle sentinel superpro
  506. discompress.cjb.net
  507. Anybody know of other reversing forums???
  508. Searching SentinelLM sdk 7.1.0 anybody any idea
  509. Batronix Assembler
  510. Need some (simple?) Delphi crackers help...
  511. Tutorials collected by g-rom on procdump???
  512. I am in dire need of help PLEASE HELP ME !!
  513. help needed
  514. point the way
  515. Bazik reversing
  516. I'm stuck
  517. Looking for help to reverse Golden Tee Golf Program
  518. What is tcl/tk ?
  519. hmmm.... ShareLock
  520. Password Stealer
  521. vb funtion disable
  522. setup.ins problem
  523. Help!!!! nonworking Softice!!!!!
  524. Playing with M$N messenger
  525. SoftIce Backtrace Buffer Disassembler - A new tool
  526. IDA problem...
  527. Real Player and recording?
  528. Tut site update
  529. BPRW <Module> code:T...
  530. Hi,i am new here
  531. Trw2000 Tutorial
  532. Help with finding keyfile a program used by program
  533. Unpacking a dll packed with UPX
  534. Hardlock Doogle Key
  535. How to remove a banner in software?
  536. Little help needed (username+pw)
  537. The Impossible Mission: Reversing Sentinel Pro Protected Code?!
  538. Adding functionality: any pearls of wisdom?
  539. Help! : Win2K Pro SP2 and SIce 4.05
  540. A little help with SoftIce plz
  541. Need help with Hex Workshop plz
  542. Windows ME kernel not loading into SoftICE
  543. who in here....
  544. newbie
  545. P-code-Satbuster
  546. Nag Screen equivalent
  547. New kind of protection very used
  548. help me get set up for reverse project
  549. process patcher (r!isc)
  550. winsock API to bpx on ?
  551. Where do I start with this one, Help please?
  552. how can I make a breakpoint while program is running in directx
  553. Help with 16bit crippled prog please?
  554. C++ Programming Question
  555. Bryce 5 - vbox 4.5
  556. help
  557. HMEMCPY
  558. reg'd then unreg'd
  559. Programming Problems
  560. newbie prob: devoid of refz...
  561. Start Code
  562. Breakpoint problems
  563. javascript
  564. WinTack
  565. different EIP at different PC ?
  566. Kernel.dos3call Api?
  567. Asprotect and time trial
  568. Anyone else ran the "sims_nude(1).exe" trojan?
  569. KeyLib16/32
  570. Redundant Checking & malicious consequences
  571. vbox time keeper
  572. DreamWeaver 4.0
  573. Help! Task & Ldt & Hwnd?!
  574. bpx HMEMCPY Not working with win2k
  575. S E N T I N E L D O N G L E
  576. Debbuger detected message ???
  577. hehe~~
  578. Method 4 getting a handle
  579. Would appreciate some pointers, stuck in Delhpi program....
  580. Where to find "HASP/Sentinel Kill v0.01"
  581. Softice breakpoint on a string??
  582. Offset mismatch in IDA and HewWorkshop!?!?!
  583. games
  584. Absolute beginer
  585. Need help with a little, simple proggy PLZ
  586. Where am I goin wrong?
  587. Any recommendations for assembler book and/or tutorial please.
  588. Finding a button's code
  589. Sorry for the big messageboard interruption.
  590. Problem loading SoftIce in W2k server.
  591. what API calls for a program to close itself ?
  592. How Can you remove it's CRC?
  593. Woh Yeah!!!!!!! :d
  594. help dummies
  595. Soft Sentry tutorials
  596. Softice Help needed
  597. [OT] We are close to you friends
  598. How to convert RVA to RAW Offset in a program?
  599. How to add DLL funtions to SI
  600. SI, VB and function in DLL
  601. How to find free space in the code section?
  602. How to use UCL HASP Emulator?
  603. OT: #Cracking4Newbies on IRC ?!
  604. In Win2K how to defeat the anti-debug trick of ASProtect?
  605. Revirgin 1.2 beta just released
  606. serial of sharewares
  607. Getting a Process's Address map?
  608. 2 hours program limit, how to catch that?
  609. XP and SoftIce
  610. Hmmz. trouble logging in with old username/password
  611. Revirgin & CommView2.6
  612. Help with SI
  613. Copy Control Protection
  614. Tshep help mE!!!
  615. UK-INFO (PC F*Rmat Mag Sept 2001
  616. PCGuard 4.03 demo unprotecting
  617. HomeSite 4.5
  618. Commandos II: SafeDisc protection
  619. installshield 6
  620. Demo watermark in printout and object copy
  621. Softice Startup
  622. Viva, manual unprotecting!
  623. Tips pointers for cracking a crypted license file type protection
  624. Odds Wizard v1.33
  625. Help me, about unaspack OCX !!!
  626. Better then ASPR...
  627. Help on Hasp seeds & return codes
  628. Loader for ASPr?
  629. Missed magic moment with Icedump
  630. 3D Studio 4.2 and Safecast
  631. Vbox 4.6 ???
  632. Delphi serial check, any ideas on what to breakpoint?
  633. Borland C++ Builder 5.0 Enterprise Edition
  634. Can Someone Please Give Me Some Tips In Cracking Password Protection On .exe Files.
  635. Write to NTFS
  636. new method for softlocx
  637. Sentinel problems I think
  638. HELP: i cant trace (no F10 or F8)
  639. Help needed to unpack and dissasemble file
  640. Help on HASP4
  641. uk-info 6.5 info required...
  642. BPX according to ST0 value
  643. +HCU Cracking Guide
  644. Editing DOS encrypted files
  645. Date Specified Time Trail
  646. Missing address
  647. keygen help
  648. Help Me Plz!
  649. Suggestions for, relativly new, good learning targets?
  650. Who can remove the VB5's Nag? HELP!!
  651. Hope this helps newbies
  652. With what is this packed?
  653. What can I use on win2k instead of bpx hmemcpy?
  654. unpacked file won't run on win2k
  655. Problem with Winhex
  656. can anyone help me with cryp95e.dll
  657. how hide softice in win2000
  658. jump generator
  659. SPARC / Solaris Reversing tips please :).
  660. How to revers the statement 'AND'
  661. Unpacking Tag&Rename..
  662. Need a mentor
  663. splash screen
  664. FlexLM help please
  665. Rce Cd
  666. Problem patching packed ones
  667. need some help with rsagent
  668. need info on ROR and ROL
  669. vbox43
  670. Registry question + trw2000 questions
  671. need help!
  672. how to modify the Vpraster pro
  673. w32dasm
  674. Message left in process
  675. w32dasm for win 98se
  676. how do i edit the asm code in trw 2000
  677. How to trace/find files from WISE self-extracting installer?
  678. mouse-si
  679. unpacking inno-setup
  680. Under Protectors Attack
  681. how2patch "outlook express"
  682. dll/keyfile help requested
  683. Need help on HASP EMULATION
  684. VB start-up code
  685. recognize UNICODE strings
  686. After unpacking aspr it doesn't run ?!
  687. hi
  688. how to add a api call ?
  689. Cracking a kind of password...
  690. HASP Service 3C
  691. other debugger than softice?
  692. Cracking From Win ME ... help .. Please
  693. Prog a KeyGen
  694. hex, dec, ascii (Convertion)
  695. Serial Crack
  696. What means NOP???
  697. Break-point for p-code..
  698. Morfit V5 3D Engine License Protection System
  699. Iso image file format
  700. manually unpacking telock
  701. ocx?
  702. using sice under 2k
  703. How to patch a VB3 exe?
  704. Is it possible to write win32 appz in asm?
  705. Multi Screen ans SI
  706. passwords used in installshield
  707. Unpacking Tutorials
  708. Where to start ??
  709. How come ?
  710. cobol cracking
  711. trw2000 is a good crack tool !!!!
  712. Vbox 4.3
  713. Unpacking SafeCast [Help]
  714. Crypkey
  715. SI 4.05 and WinME
  716. c++ question
  717. Where to get rtm compatible with tlink?
  718. Good time to get into cracking?
  719. Disassembling Morpheus...
  720. IDA 4.4 doesnt disassemble VB5 &6 softs ?
  721. kids....
  722. A SoftIce Question.
  723. about a nag dos crack
  724. MSComm32/Read parameters
  725. Is there a tool like frogice on NT/2K?
  726. volatilities essay on unpacking
  727. SetClipboardData() in VC++
  728. Hello,I am a cracker of China.
  729. Armadillo 2.x
  730. Tag&Rename 2 whatever
  731. Crypkey SDK.
  732. help with unpacking webpics.
  733. I'd like to crack larger programs than crackmes
  734. Crykey MK II
  735. Fixing PE headers to run under XP?
  736. IDA Question
  737. SmartCheck detection
  738. A question...
  739. Can someone tell me how to crack ocx
  740. A tricky Proggy, Help me !!
  741. need Sentinelpro help
  742. Info Needed
  743. encrypt Elan LM Key
  744. Information requrired
  745. crypt strings
  746. Can't send keystroke ?
  747. Is there a decompiler for VB5 like there is one for VB3 (Dodi)?
  748. SI + w2000 = couilles ?
  749. Win 2000 Dial-Up Password
  750. What I can expect from InterLok?


Packing and Unpacking Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum
PDA

View Full Version : Packing and Unpacking Forum

Pages : 1 2 3 [4] 5 6 7
  751. Book:I want to be a real cracker
  752. Save function disabled
  753. REQ:Help with Dongle cracking....
  754. How to create a patcher and..
  755. Some pointers reagrding disabled features please...
  756. Delphi Breakpoints
  757. online-RegCode-check trick
  758. help with juno browser
  759. w32dsm can't disassemble c++ builder exe?
  760. An unusual CRC check, I guess
  761. ASCIIs in executeables [w95]
  762. ExitProcess and TerminateProcess
  763. WhereIsIt 3.21 (aspr 1.22-1.30 ?)
  764. Help on toshiba AAC ( mpeg 4 audio ) encoder / player
  765. Is there any unpacker for Asprotect 1.2 ??
  766. can anybody help me for reversing delphi
  767. help the moron
  768. Hello!Everyone!I am a cracker of China!
  769. help cracking PE
  770. Here is a stuff up
  771. about RV and duplicated exports
  772. IDA is a problem
  773. Help with mIRC stats
  774. +ORC's missing lessons....
  775. How to crack P-Code?
  776. Enabling menu item in delphi target ?
  777. Need help, asm
  778. how can i start cracking dos program
  779. Hi
  780. Try to unpacker this file!It from China Cracking Group!
  781. GetType 2000
  782. Some questions about HASP
  783. CrackZ's Reverse Engineering Page
  784. removing nag
  785. use INT 1 to detect SoftICE
  786. Crypkey
  787. inline patching TElock 0.85f
  788. Reprogramming a passcode generator
  789. windows ce rce tools
  790. Packed programs and Imprts Table
  791. Rebuilding Missing Imports.
  792. hmemcpy does not break!! in Win98!!!
  793. Using Olldbg
  794. VBoxM430
  795. Softice doesnt work? try this....
  796. Need Help - FlexLM
  797. AddVectoredExceptionHandler( )
  798. How to crack XLA sheets
  799. Need Help
  800. Gift: ICCAVRIDE.EXE rdata
  801. +Splaj Tuts
  802. Java programs cracking
  803. Help on Delphi>-<ASM Combo
  804. Does As-Protect use "Exception handling"?
  805. RE:Neolite..
  806. PACE Interlok
  807. Another protecton system bites the dust..
  808. RCE CD ? How to get it ?
  809. A good starting point?
  810. softice for winxp
  811. Odd softice behaviour
  812. remove debug printing of kernel32
  813. im afraid
  814. [Cracking Securom....]
  815. Help CommView 3.1 (build 156)
  816. softice bug?, durin a jmp
  817. VB Serial Protection
  818. which API?
  819. ahhh short delphi keygen question!!!
  820. a very hard nut ! ! !
  821. armadillo
  822. newbie questions
  823. asprotect
  824. Help Icedump
  825. macro prob..I need help
  826. Size of Delphi exes..
  827. Merry Xmas & Happy New Year
  828. crackme time-crippled
  829. Help on Windows MS Installer
  830. W32DASM shows n0thinq
  831. Packer identifyer
  832. IAT help please
  833. ShitXP & SoftICE
  834. awesome packed file
  835. UPX-Scrambler rc1
  836. so cold is SoftICE [introduce me too]
  837. Vintage NE
  838. problems with cracking a program: need a hint (most parts in German)
  839. Need help on Sentinel Dongle!
  840. How to make a BPX at POPAD
  841. anti disassembler tricks x86
  842. BitArts Titanium 3 softice detection.....
  843. TZ-Strip Poker 2 cracking
  844. Cracking VOB ProtectCD need Help ! Urgent
  845. delphi source code for a patcher
  846. vb5 cracking
  847. VTpack
  848. VB-Bytecodes
  849. ao2000pr IDATA + IATthunk_tricks KILLER method
  850. crackme for newbies
  851. Help a newbie plz :)
  852. IceDump and driver studio 2.5
  853. G6 FTP server
  854. Packed Apps
  855. Wanted Good API tutorial
  856. first real unpacking task
  857. morpheus anti-sice tricks
  858. Softice detection in general...(and hiding)
  859. REQ: howto debug VB proggy (ZoneLog Analyzer)
  860. ... a bit of asm
  861. Invalid PE?
  862. Help cracking with disabled button
  863. Decode an MD5 string - help pls
  864. Crackme / Keygen ASM source code
  865. how to crack a hardlock Envelope
  866. How to unpack an armadillo-ed program ?
  867. SafeSerial
  868. Remove Delphi Window Form
  869. MS Access
  870. FileRestore by Winternals
  871. Mp3 Wav Converter v2.52
  872. strings extractor
  873. strange program behaviour
  874. Need Help...
  875. timeLOCK ver 3 or higher info needed
  876. help!!
  877. Asprotect question
  878. Tut site update
  879. Help required. Hex workshop problem
  880. VBCrackMe
  881. big dumb newb question
  882. Windows SDK Mailslot !
  883. new type of clever protection?
  884. FileInfo 2.49 blues
  885. First Timer
  886. Tell me what all I can learn from this picture
  887. Circuit Shop
  888. MSN Messenger
  889. asprotect question
  890. unpack aspack
  891. File Pointer not showing up accurately
  892. how do you read sentin*l pro/superpro/c-scribe key id?
  893. Retain Connection
  894. winzip 8.1
  895. Relocations editor?
  896. idiv!!!
  897. Strange CD protection (for me) Help
  898. problem with revirgin
  899. Enabling save option with AsPack
  900. Finding OEP manually on win2k
  901. stuck on Cakewalk cracking TRial versions
  902. keyfile generation in RaidenFTPD v2.2 build 688?
  903. RV "little" bug
  904. VBOX 4.30 Probz
  905. Cool Edit Pro Demo?? or Cool Edit???
  906. WinSniffer 1.3 [ASPACK???]
  907. For newbies: Import-Deadlisting for current ASsPR version.
  908. PcGuard Unpacking
  909. Newbee question
  910. Password genaration
  911. Advanced Registry Tracer 1.5
  912. unpacking APDFPRP 1.61 (Elcomsoft) ASPROTECTED!
  913. eeyelic.dll
  914. unpacking a game tutorial
  915. Killing drivers... Deepfreeze
  916. Armadillo Tutorial ?
  917. +SPLAJ! New ASPR version comes for you!
  918. Just a nother querry abt AsProtect :>
  919. No String Reference
  920. Unusual setup program
  921. how to unpack Dll file for Aspack 2.12 ?
  922. VB4 Pcode
  923. The mistery of the self repairing program
  924. Hows it get there?
  925. What is this??
  926. VB cracking on W2000
  927. I'm stuck with flexlm 6.1
  928. Change Main Formular
  929. Major Revirgin Bug ? :-( Tsehp help!!!
  930. GetModuleHandleA???
  931. Winzip 8
  932. Stuck with MosASCII
  933. ins****.tmp softlocx protection?!
  934. How to manually locate IAT start?
  935. Patching APDFPR Pro 1.61 ?
  936. Offset ans Size of sections
  937. revirgin!!!!
  938. Pep?
  939. rv1.3
  940. help me Vbox 4.3
  941. newbie stuck with tabledit
  942. ASProtect API Emulator DLL (LapTonic Help!)
  943. Monitoring software ??
  944. RegOrganizer 1.3B4: Questions and More Questions (sv / +spl/\j guru!)
  945. Unpacking Kazaa - unvisiable for the boss :)
  946. Problem to use WriteProcessMemory
  947. Unpacked exe and dll
  948. new protector: PE-PROTECTOR
  949. AWAVE STUDIO 8.0 Almost done. Final question!!
  950. Which OS to learn on?
  951. Anti Sice causes rebooting.....
  952. BIG-dipper :)
  953. VB6 app de-asprotected
  954. Does anyone know the name of this protection ?
  955. THKX for the help with Awave 8.0!
  956. WinHack 1.1, missing finishing touch
  957. CommView 3.3 Unpacked but have question
  958. Bad news for RV from ARMADILLO 2.51
  959. Aargh! Can we PM some of these RV/Asprotect threads?
  960. How to calculate which jump I want to use...
  961. Cops Copylock II !
  962. any simple beginners projects?
  963. Accelerator Keys
  964. Packers Signatures! (Or another lame thought?)
  965. Who can tell me...?
  966. RepoInfo- I need help cracking !!!!!
  967. Is this not the right place to ask for help on this?
  968. more asprotect...
  969. Its been awhile
  970. How to dump a project under tElock 0.90's protection?
  971. Guidance Required
  972. How to remove the very good trick of ReGet Deluxe?
  973. memohasp 1
  974. Need help with HistoryKill
  975. how do i set a dongle breakpoint?
  976. How to detect double-dip of ASPR and locate them?
  977. reversing msn messenger
  978. Strange DRx
  979. Serial check
  980. PE and Imports and more questions....
  981. how to copy bad mared floppy?
  982. coupla questions
  983. Installshield Password Protected Self Extracting EXE
  984. Visual Protect i need Help :)
  985. What use is selfmodifying code
  986. Stuck on aspr
  987. some asm querries
  988. Where should I start?
  989. Menu resource ??
  990. SVK-Protector
  991. Help on HASP ID
  992. it's me again with more question :>
  993. Reenabling trial for CrypKey
  994. Referencing the stack in SI expressions
  995. I need to trace thru a prog
  996. Quick One
  997. Hooking serialport
  998. How to get section to load right?
  999. what bpx to set for wise install password ?
  1000. IVT format?


Packing and Unpacking Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum
PDA

View Full Version : Packing and Unpacking Forum

Pages : 1 2 3 4 [5] 6 7
  1. New Securom - sintf*.dll files
  2. One thing need to solved
  3. ASProtected?
  4. application packed with something called ficken
  5. Disabled Menus In Acrobat Reader
  6. Softice VB export question
  7. bpr in asprotect...
  8. ASPR API ? (ReGet Deluxe 3.0 beta 117
  9. CommView 3.3 :) Small issues..
  10. nightmare protection on cache explorer
  11. Hard to unpack ?!
  12. Who can help me about one unchanged crypkey protected programme??
  13. How to approach a 'dead' target
  14. Taskbar
  15. Process patching yet again
  16. Bug??
  17. Protected Flash Movie
  18. gcd problem
  19. Need help w/ FlexLM 8.0...
  20. Wise script
  21. how to remove cdilla completely?
  22. Visual Foxpro + NetHASP anyone?
  23. Wlscgen.exe
  24. onGuard protection
  25. help!!!
  26. How to unpack FlashFXP
  27. Need help---------mix-fx
  28. im stucked
  29. CKI32H.DLL and it's tricks...
  30. how i can define: can i unlock HASP protection or can't (without key)?
  31. anti-gravage
  32. Question about copy & paste
  33. AsProtect but it's not about unpacking it :>
  34. CrypKey
  35. Lilttle Help and Info!
  36. Loader Question
  37. CRC Checkup...Need some info!
  38. Loader
  39. Loader problem
  40. SoftIce Prob...
  41. Q on UPX packed files
  42. Hero IV
  43. pcode vb help
  44. Break point on memory not work?
  45. ASProtect again...
  46. "OutLine-Patch Studio" for ASSp.
  47. Problem in regged program
  48. Shrink34
  49. 'calcseed' fails making correct seeds on a FLEXlm 7.1c daemon
  50. Sentinel superpro dongle cracking help
  51. rebuilding iat
  52. Making a asm rip keygen???
  53. How to find entry point for SPARC ELF binary?
  54. HASP protected program(HELP !)
  55. Help on Hasp4
  56. A newbie ? re/serial fishing
  57. asprotect phase two!
  58. DOS cracking
  59. anti-crack tut from the developer
  60. I need some help
  61. Anyone can give insights on InterLok 3.0.7 ActiveX API?
  62. winice.dat
  63. Seeking Mamaich's Goodies?
  64. IT rebuilding
  65. installshield
  66. Some question about AsPr.
  67. vbov 6.4 (Flash mx)
  68. problem with ems mysql manager 1.75
  69. Paching UPX Exe
  70. Three questions...
  71. activx ocx
  72. Newbie's Q. about Winsock detail
  73. Different of int 2Eh int 2Fh between W2k and Nt 4
  74. Where is the application code in XP ?
  75. file system error 31
  76. help on HASP PCS
  77. I need you help ;-)
  78. AntiCrack.de Site - Search Here (link now posted below, bye bye sticky)
  79. Remove Anti-Disassembling-Tricks
  80. sentinel monitor :-)
  81. Great Links on ASM language!
  82. how to unpacking manual?
  83. unArmadilling
  84. Another newbie's struggle against ASProtect...
  85. Something about Flexlm
  86. How to rip out ...
  87. old encrypted cd
  88. sentinel lm sdk (lsdecode)
  89. call [eax+xx]
  90. Greetings,
  91. Symbol Loader doesn't breaks under Win2K
  92. Finding code in a VC6 dll ?
  93. OpenSSL Bignumber FLIRTs
  94. Stupid toys
  95. Quest for Information
  96. qeustion please read
  97. blendingclock fails oepfinder
  98. Typelibrary calculating function offset
  99. Swapz button ?
  100. KaZaA 1.71: packed with pex variant?
  101. crc's of executable
  102. aspack inline patching
  103. safedisc lt info request
  104. For CrackZ/HypnoticZ/TNT the hasp prot prog
  105. Who knows ??
  106. Greetings
  107. DOS cracking
  108. a little program protect with HASP m1 and sn,somebody help me
  109. hi all!
  110. Sentinel spro dongle protection
  111. aspack or asprotect
  112. EtherPeek 4.5.0
  113. Just another idiot
  114. FlexLM feature finding problem
  115. New/Latest ASProtect Strain
  116. DriverStudio 2.6 & IceDump
  117. keygen masm
  118. InstallShield / MSI Installer
  119. Problem with QuickSnooker
  120. Reversing win16 applications???
  121. How to map dead listing offsets to sice addresses???
  122. Solomon's trick
  123. Has anyone got Stone's many source code samples???
  124. issues with export symbols 016f 0167
  125. Code Injection
  126. unpacking protected cab files??
  127. Asprotect 1.2
  128. HaspServicesSpy Program Release !!! :)
  129. Problem at Linux crack development...
  130. Disassembling a .DLL
  131. Delphi obfuscation
  132. Help with Quick ASM Translation.
  133. CRC check
  134. Protector vagaries
  135. Private Keys and Seeds 3/4 in FlexLM
  136. destroying a Symbol table
  137. Announcement: New software protection
  138. Ring
  139. ASPR G-Lock Software
  140. Time trial & encryption woes
  141. KeyFile Cracking
  142. dictionary pattern searching project
  143. Help compiling lmcrypt with Borland
  144. Sentinel Shell encription
  145. yet another aspr (and delphi) lamer, part II
  146. ASPR wierd API
  147. CyberCafePro - Bitarts protection
  148. find somethimes source text in exe or dll
  149. FlexLM Help in Ansoft Ensemble v7.0
  150. plz help!!! Advanced MP3 Catalog Pro - asprotect
  151. 3com firewall VPN enabling
  152. p-code tut
  153. How would I deal with java/html imbedded?
  154. Lost in the code
  155. Latest aspr tricks
  156. Armadillo Killer 2.5 beta 1 (14-Jul-2002)
  157. SoftSentry
  158. Bios
  159. Shrinker
  160. Finding the OEP (ASProtect)
  161. vbox & dead lock jmps...
  162. Window positions in Asm
  163. Fusion v3 cracked, Titanium v3 defeated, Bit Arts fooled!
  164. Did I JMP far enough ?
  165. Getting the right serial......
  166. Basic unpacking/revirgin question
  167. Stream Cipher with Key to decrypt
  168. VirtualProtect blah blah......
  169. delete awave file
  170. how are adresses calucated ?
  171. what packer :(
  172. Curious question about reg storage addresses
  173. how use w32dsm to crack flexlm
  174. converting string to offset
  175. Revirgin & ImpREC fucked by this ASPR
  176. Zmud 6.32 Beta w/Elicense vtcpak33.dll
  177. Java questions
  178. Deskey api guide ????
  179. another asprotect newbie
  180. can't find out the key validation
  181. Photobrush
  182. how to cr@ck a pocket pc application?
  183. Unpacked Asprotect filed doesn't run on other machine..
  184. armadillo 2.60(a)?
  185. Tutorials search
  186. Error when unpacking .exe-file ( UPX )
  187. manual unpacking.. and i mean manual :)
  188. Why my dumped apps won't run??
  189. adding code
  190. arm tut
  191. "CloneCD" for floppies
  192. Asprotect trick?
  193. Breakpointing IO
  194. Need help with this very small app please
  195. CommView 3.4?
  196. Armadillo Killer 2.6 ready!
  197. a question to armkiller ?
  198. shrinker problem ...
  199. assembling my own prog to 'fix' import data sections
  200. Problems finding OEP
  201. Need some clarafication on this tut plz
  202. about the kazaa-encodiing PEX 0.99b
  203. Unpacking VBox 4.20 Experied
  204. SOFTICE : need a function for decrypt ...
  205. some thoughts/questions regarding asprotect
  206. MSR value reader for win2k/xp
  207. Aspack trouble
  208. Decompressing and saving UPX compressed section to a file
  209. IAT rebuilding for unknown packer ??
  210. a question to kayaker about OEP finding
  211. Armadillo protection
  212. Another ASPack problem
  213. How to find OEP
  214. ASPacked notepad: manually unpack problem
  215. how can i creat a packer?
  216. kill process
  217. ASProtect v1.2 on a dll (plugin)
  218. Ecomsoft products Asprotected
  219. armkiller on Dvd region-free
  220. For newbiez-ASsPROT-unpacker help
  221. problem after unpacking asprotect
  222. Sucessful (?) ASProtect unpack
  223. Flex Feature Problem
  224. wanna play a game ??
  225. A challenge (or the many faces of ASProtect)
  226. AsProtect ... still
  227. A problem about upx deccompress?
  228. My dll is now unpacked and cracked, but...
  229. SafeSerial (sase.ocx Aspack)
  230. Rebuilding Import Tables Manually
  231. deobfuscation java class
  232. EAccess Error in IDA when disassembling dump
  233. imprec question
  234. Some questions about ASProt dll
  235. ASProtect v1.23 drive me crazy :(
  236. unpacking as usual
  237. missing imported dll
  238. revirgin IAT tracer fail
  239. 16-bit packed file - How to identify packer?
  240. OEiP - How to .... ? (ASprotect v1.3)
  241. aspr license routine
  242. SafeDisc V2.60.52
  243. an oldy ASpack
  244. AsProt crash...
  245. newbie unpacking question
  246. Neolite 2
  247. Armadillo dumping
  248. Anti Dump
  249. RV tracer seems not work on...
  250. Armadillo unpacking: NetScanTools v4.30a


Packing and Unpacking Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum
PDA

View Full Version : Packing and Unpacking Forum

Pages : 1 2 3 4 5 [6] 7
  1. about g6 and asprotect again...
  2. Azpr's new check time algo !
  3. Hard to unpack :(
  4. fireworks problem(vbox4.6.2)
  5. PELock
  6. Armadillo and CopyMem II decryption
  7. Crypkey SKW.EXE unpacking
  8. Asprotect..
  9. Unpack tElock 0.99
  10. smell the RAT
  11. Asprotect 1.2X challange
  12. Heh, new armkiller is ready.
  13. Problems with Armadillo-ed application
  14. help with Redirected API calls in Armadillo 2.53x
  15. dump problem
  16. CoDe_InSiDe's tutorial about Pex
  17. Maybe new Azpr trick ?!
  18. Armadillo 2.61 =(
  19. Aspr - Aspack double pack? :)
  20. Generic ways to find OEP
  21. ASProtect - new OEP
  22. need help to resolve iat please
  23. help!
  24. Unpacking Elicense
  25. Chameleon Clock 3 b4
  26. ExeStealth 2.41 EXE Protector
  27. Hardlock dongle, locking up SoftIce (with windows hang)
  28. I need help with tELock
  29. Version of Armadillo
  30. AsProtect - new version?
  31. crUsAdEr - Armadillo 2.61 Tutorial
  32. Exceptions after unpack of Winace 2.11
  33. Softwrap - new ver. - man. unpacking?
  34. More armadillo fun
  35. Writing an EXE packer ?
  36. APDFPR Pro V2.1
  37. Armadillo 2.61 IAT Problem
  38. Sentinel Super Pro
  39. PHP Encrypter ?
  40. aspro layer check removal
  41. [q] Unpack of uncompressed exe.
  42. Damn i'm so near to unpack this one
  43. help on unpacking
  44. Mini-tute: Getting rid of Armadillo nag
  45. New ?
  46. take back on flexlm
  47. unpacking Official CFF Crackme 3.0
  48. This PE file is not in standerd windows format ???
  49. Need help with unpacking
  50. hmmmmmmmmmmm
  51. un unknown
  52. Dumping WindowsCE DLL's
  53. Crypkey 6.0 Stealth Unpacking
  54. Armadillo 2.6x ..I´m a lame =(
  55. Vbox
  56. anti-softice, armadillo
  57. Asprotect 1.2x [New Strain] ???
  58. Vbox 4? help
  59. ASPack 2.11 - random decryptor!?
  60. Unpacking Armadillo 2.xx + Aspack 2.xx
  61. Unpacking an unknow packer
  62. easiest-to-unpack packers
  63. Xcr 0.13
  64. Micro-tute: Original CD emulator
  65. Help with PE MSCAN with ARMADILLO
  66. PCGuard
  67. Need help with FLEXlm
  68. rebuilding last import
  69. Aspr IAT Cleaner
  70. Unknown packer/crypter
  71. Quick ASProtect question
  72. Strange problem after unpacking
  73. PE Rebuilding Topic
  74. File Analyzers (noob help)
  75. New Aspr
  76. Bi-Tarts
  77. Is it protected by SentinelLM?
  78. ASPR Hacking in user mode (ie. not ring 0!)
  79. Aspr IAT Cleaner
  80. AsPack
  81. Crusader - PELock
  82. any experiences with "Xtreme protector"
  83. A reverser busy day
  84. Xtreme-Protector
  85. Help me with armadilled app!!
  86. ASPR CALL EAX Loop
  87. CopyMem 2
  88. PESHIELD: NTICE Detection method
  89. Something Different.
  90. Un-packing UPX packed exes
  91. tElock 0.9x modified/private
  92. 2 ASPR old Tuts
  93. Armadillo Jump Fixer
  94. SafeDisc v2 softice detection under 2k/XP
  95. ExeProtector 1.37a
  96. ASPR 1.3x OllyDbg Tut
  97. question about crussader's tut on arma
  98. SintAX ;), some help plz with this sd2 sice detection under 2k/xp
  99. Armadillo License Management How To...
  100. .fuckMut section and OLESCMLOCKMUTEX - ???
  101. a new crptor/pakcer is out!!
  102. Help with unpacking, plz ?
  103. Loading a second exe from memory(not from disk)
  104. Can somebody remind me
  105. About Titanium and Fusion v3
  106. TryMedia
  107. dll Asprotected
  108. icedump help??
  109. Dillodump / ImpRec
  110. Dll Crunched...
  111. Dillodumper 2.3
  112. Unpacking ZoomPlayerPro (UPX) w/o SI
  113. aspr oep..
  114. Great piece of Software, Great Protection
  115. Hardlock packed exe (for CrackZ and others :p)
  116. Solid concept
  117. Quick ASPRed Q
  118. PECOMPACT packed dll(1.6 - 84)
  119. Armadillo + UPX = (any good ?)
  120. How
  121. New Mutant is OUT !!!!!!!!!!!!
  122. crucnher v4.0
  123. New unknown anti-debug packer out.
  124. upx1
  125. Armadillo for dummies (vol 1) english
  126. Armadillo for dummies (vol 2) english
  127. ARMADILLO & NANOMITES (part 1)ENGLISH
  128. Armadillo & nanomites (2º part) english
  129. New VBOX 4.6.2 tutorial..
  130. about dillodumper...2.5
  131. Armadillo expiration check
  132. 79-armadillo & Nanomites Annex
  133. new PCGuard Unpacker/Dumper
  134. qustion with Obsidium
  135. Removing useless code from dumped exe
  136. AsProtect 1.2x [New Strain]
  137. "INT 3" modify problem in safedisc 2.90.....
  138. IAT rebuilding (Asprotect)
  139. stripper v2.01 (public release)
  140. New ASPR Anti Si and IceDump
  141. securom new
  142. Aspacking an manually UnAspacked file
  143. FAO nikolatesla
  144. VBOX 4.6.2 tutorial, HTML format
  145. New ASPR Tool
  146. TryMedia Question
  147. is this new cryptor?
  148. this is true new protecter!
  149. OCX unpacking
  150. .rsrc
  151. Thinstall
  152. ASPR not full tut
  153. Asprotect mR Gandalf (.ar)
  154. Aspack unpacked dll relocations ignored
  155. Hi guys,
  156. Obsidium.exe doubts
  157. Armadillo 2.85 with Visual basic 6
  158. ASPR \ ASprotect 1.23 Tut !
  159. Is this packer New ??
  160. Another "trick"...(packer)
  161. Using original .idata instead of creating new section
  162. Armadillo Hardware ID
  163. About Stolen Bytes
  164. interlok protection
  165. IDA and HASP SIGNATURE FILES
  166. Unpacked prog. does not run on different OS.
  167. Neolite 2.0 Questions
  168. About ocx unpacking.
  169. An self-made packer - Part 1
  170. ASPR New Feature
  171. Newbie, how to remove Armadillo protection...
  172. How to avoid AVS-detection @ packer
  173. Optloader - who knows this Packer ??
  174. ASProtect 1.23 RC4 Demo
  175. Armadillo help
  176. CrapKey new version
  177. ASProtect 1.23
  178. telock 0.98 again :(
  179. Protectors for other Operating Systems.
  180. Imprec Plugin
  181. New apple software :)
  182. Aspr 1.23 (Stolen Bytes)
  183. Unidentified packer?!?
  184. TryMedia
  185. is there any tutor about unpack safedisc ?
  186. new arma tricks ?
  187. InstallShield ComponentValidate
  188. Sice detection/Unpacking
  189. A - maybe - new approach to Import Section Rebuilding
  190. help in unpacking asprotect(alomst completed but hanged in between)
  191. Unpacking ASPack, Neolite, Pe-Pack, Petite, andUPX tutorial
  192. Copycontrol Information
  193. armadillo "magic jump"
  194. Yet another trymedia thread
  195. New Exe Stealth
  196. Armadillo 3.x Unpack
  197. Newbie needs help
  198. E-license 4.0 unpacking
  199. Lost and confused in INT 30
  200. Armadillo !!!!
  201. Armadillo Nanomites - Help (Please)
  202. Defeating PCGuard v5.0
  203. armadillo 2.85
  204. Winxp & dumping
  205. Exestealth 2.73 problem
  206. Impossible to Dump??
  207. Memory Breakpoint In Execution Only?
  208. Powerstrip 3.47 Build 425 => ASProtect 1.23
  209. ASprotect 1.23 rc4 & crackme
  210. ultimate unwrap3d reversing :(
  211. Aspr "Super tut"
  212. Shockwave games
  213. Help: Writing your own dumper/fixer
  214. Armadillo - AntiDebug
  215. Stolen Bytes to the Extreme ? (Armadillo)
  216. tElock 0.98b1 -> tE! Unpack Problem
  217. new HASP envelope
  218. unknown packer
  219. SVKP for Developers USE ???
  220. Unpacking Skype...
  221. Elicense Software
  222. Softice: Hide and Seek
  223. Error´s unpacking Dillo 3.x
  224. Armadillo unpack problem ?
  225. Looks like something really NEW !!!!!
  226. upx unpack error
  227. More product activation
  228. Armadillo: something new!
  229. Alternative way of finding OEP for AsProtect?
  230. Safecast is driving me crazy Help needed
  231. Armadillo (i think.. )
  232. Execryptor
  233. Unpacking SVKP 1.3X
  234. Asprotect Debugger ...
  235. vbox 4.6.2
  236. dll packed with Armadillo
  237. Thinstall unpacking
  238. Unpack Files...
  239. HeLp Me :(
  240. How Packed files are Packed
  241. Armadillo Tut Req. !
  242. How to unpack a .sys file?(device driver)
  243. Dump wont work
  244. Aspr stolen byte stubs
  245. problem fixing imports
  246. Cant unpack ASPACK, even Aspack fails...
  247. Hmm interesting new protection....
  248. Armadillo enhanced softice detection
  249. Need help in unpacking
  250. UPX Trouble


Packing and Unpacking Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum
PDA

View Full Version : Packing and Unpacking Forum

Pages : 1 2 3 4 5 6 [7]
  1. What's the best unpackers for HASP?
  2. Armadillo 3.60 + COPYMEM II + ?? = No WriteProcessMemory!!
  3. asprotect closing door
  4. Awsome Asprotect Tut!!
  5. r!sc process patcher and aspr ??
  6. y0da's crypter 1.x/modified
  7. need Help (createProcess)
  8. ASPR : finding the anti loader protection scheme
  9. About PCGuard 5.0
  10. MSI :: The magically appearing dll file
  11. What to put in ImpRec?
  12. damaged stolen bytes ??
  13. Whats the best CAB editor/extractor/replacer for MSI cab files?
  14. ASPR - IAT on Xp and 2000
  15. ASProtect high memory address trick
  16. sentinel pro crack...
  17. Unpack PECompact 1.84 - Have anyone can help me?
  18. what can i do to crack dongle routine?
  19. ASPR Dumper is additon for ASPRDbgr!
  20. VBox 4.6.2
  21. Unable to unpack a file wrapped by Bit-arts
  22. Armadillo
  23. AsProtect 1.23 RC4 Registered and something else?
  24. Help, unpacking armadillo
  25. unpacking pebundled files
  26. flexlm 9.0 help!
  27. ASProtect 1.2x [New Strain] -> Alexey Solodovnikov
  28. API on Safedisc 2.60
  29. unpacking secuROM 5.00.3
  30. Armadillo Hang
  31. How to bypass Norton AV2004 emulator?
  32. ASPR v1.23 RC1 Removed, program doesn't stay running...
  33. Vbox Spanish Tut In English
  34. ActiveMARK Packaging Tools Released
  35. ASPR 1.23 loader SEH approach
  36. unpack me
  37. A Vobx 4.6 packed module
  38. Armadillo Unpacking Problem
  39. CRC,checksum??!
  40. Armadillo, Hardware FingerPrint, Keygens
  41. Vbox and Olly
  42. patching dll functions at runtime?
  43. Redirect IAT advice
  44. Where can I find...?
  45. cm2 + spliced code
  46. Unknown packer and how do generic OEP finders work???
  47. Armadillo 2.x/3 DLL stub unpacking
  48. tElock 0.98b1, 7 renamed sections, 2x CRC32 poly
  49. Splash - Loader
  50. ASProtect 1.23 RC4 - 1.3.08.24
  51. Thinstall???
  52. Armadillo Anti-SICE
  53. Asprotect 1.31 Build 04.27
  54. Armadillo 2.51 - 3.xx DLL unpacking - OEP?
  55. Old Novex
  56. More eLicense 4 issues
  57. Armadillo 3.6x
  58. Microsoft MSO.DLL (Product Activation)
  59. NeoLite 2.0 DLL Decrypting / Decrunching / Decompressing / Unpacking
  60. Help with a weird encrypter/packer
  61. Asprotect 1.23 RC4
  62. Dll relocation?
  63. Aspr 1.23 problem
  64. Request: Armadillo Tuturial
  65. Strange armadillo target
  66. Help ACprotect Unpack
  67. Armadillo FingerPrint...
  68. vbox 4.6.2 timelimit
  69. Unpacking a with Petite v2.2 packed DLL file
  70. About SF3
  71. Armadillo horror
  72. hi
  73. Manual unpacking Virogen Crypt v0.75 question
  74. FSG 2.0 oep finder
  75. dumping securom 4.8 via loader
  76. Java application packed with towerj
  77. Armadillo scripts
  78. Armadillo 3.00a - 3.61, Ollydbg endless loop?
  79. unpacking a dll
  80. Armadillo once again (wrong IAT after unpacking)
  81. Armadillo message before RUN
  82. Armadillo is down...
  83. Unpacking Neolite 2 (exe, dll)
  84. ocx unpack header?
  85. Protection plus
  86. Nasty Nag removal
  87. Import Table: Working with IAT, ImpRec
  88. PC-Guard 5.0's code XORing
  89. Delphi dumped apps
  90. MFVDasm, Softlockx, and Bitarts PHASE1 (could use some help :-)
  91. inline patching asprotect
  92. new aspr 1.31 un-dumpable?
  93. Microsoft C# and Basic .NET
  94. Safedisc (v1) and ollydbg
  95. question about armadillo packed dll & IAT
  96. Wibu dongle unpacking
  97. Nice trick to hide Olly to most controls..
  98. Aspr Exception Handler Emulation notes
  99. Seems like Arma detects virtual PCs..
  100. Coding ASPACK dumper
  101. CrypKey 6.0 for Newbie?
  102. Unpacking Execrytor
  103. Sentinel SuperPro Emulator
  104. Interlok v5 exploration...
  105. Windows NT System-Call Hooking
  106. Sentinel SuperPro: IDA sigs, function #'s, & shell
  107. problems with a program protected by aspack + aspr
  108. Installshield self extracting-exe ...possible?
  109. IAT Rebuilding of a safecasted dll
  110. "General extraction error", the hidden face of armadillo?
  111. Unpacking Vbox
  112. Unknown packer
  113. Aramadillo 3.0-3.6
  114. Is it possible!
  115. a SEH CONTEXT' Question
  116. how to get the point of the CONTEXT STRUCT
  117. QuickUnpack DLL release
  118. Is the code at wrong direction?
  119. Vbox 4.6.2[Im stuck] please help
  120. what fuction of this code be done
  121. PKLITE32 1.1's signature
  122. Why remove my thread?
  123. Sentinel Super Pro Shelled files problem
  124. I can't find the OEP
  125. Sticked in by the debugging loop
  126. Powerfull tool to successfully unpack
  127. Aspack 2.12? Maybe...
  128. another aspr question
  129. Why the program crashed
  130. Fool PEiD
  131. Vbox 4.6.2 confusion
  132. What is the sentence mean?
  133. A strip of code in the an UnpackFile
  134. SafeDisc 2/3 IAT Rebuilding
  135. More Armadillo Stuff
  136. Wrapper question
  137. How to repack a file
  138. Installshield 7 exe fun
  139. ActiveMa** unpacking
  140. Hard Objetive!!
  141. Star Force 3.3 Cracked!
  142. ASPACK problems with DLL (relocations?)
  143. ASPR IAT
  144. Indentifing Armadillo version & unpacking
  145. Honeynet RE challenge
  146. asprotect 2.0x working tut?
  147. NEOLITE 2.0 UNPACK
  148. Unpacking help - possible armadillo
  149. Ollybug
  150. the new packer
  151. unpack hasp enveloped file
  152. Automated Imports Reconstruction
  153. Trouble with Unpacking Crypkey 5.6
  154. +Splaj Awave tutorial revisited.
  155. How to unpack an ASProtected .dll?
  156. Need help figuring out code from unpacker.
  157. armadillo unpacking problem
  158. decrypt decompile precompiled resources
  159. ASProtect 1.3 Problem
  160. ARMADILLO 3.78 HELP NEEDED
  161. Suspending a riot process..how?
  162. Execryptor
  163. Anti Debugging ? ?
  164. SoftWrap 6.1.1 unpacking tuts
  165. armadillo nanomites
  166. unknown armadillo
  167. PE packer identification and Anti-Ollydbg
  168. Unpacking some packers VIII
  169. how to identify if a file is packed more than once?
  170. dillo fingerprints :( :( :( :( :(
  171. New Vbox Name HASP SL
  172. Identifying a packer, PEiD/TrID fail
  173. sentinel
  174. ACI 2005 (C) [Armadillo Code Injection]
  175. Armadill0 4.05 or 4.10
  176. starforce 3 question
  177. problem running unpacked file


Off Topic
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic
PDA

View Full Version : Off Topic

Pages : 1 [2]
  251. Electronic components
  252. Gedanken experiment - an uncrackable architecture
  253. Sentinel Envelope
  254. Oh, this is funny...
  255. Biting back on SPAM
  256. Nice paper, reverse engineering a virus
  257. Windows shut down notification API?
  258. Starforce protected games open up security hole in your computer
  259. Kind of interesting search engine
  260. Olly needs your help with OllyDBG 2
  261. Crystallized water...
  262. Cookie timeout (grumble)
  263. R.I.P. Win32ASM Forum?
  264. other board gone
  265. Win32asm and Anticrack board users, welcome here!
  266. Forum Archives CHM file updated - Special Hacking Week Edition
  267. Some interesting papers
  268. Script kiddies or woud be crackers ?
  269. what about linux
  270. Exetools
  271. Why you crack program?
  272. Torrent Spoof?
  273. Another reason to crack.
  274. Video recorder
  275. Domain & web hosting recommendation
  276. MASM Forum, check your email carefully
  277. more forum hacking?
  278. RAID 5 and RAID 50 reliability
  279. Merry Xmas All
  280. Cool book: "The Mezonic Agenda"
  281. Awesome Artistry / Not mine
  282. Experiences with AVP
  283. Interesting book on RCE
  284. Jobs
  285. Required Watching
  286. Just to count out how many chinese here.
  287. Any Germans looking for a cool job? ;-)
  288. Two funny links
  289. Need a Javascript/IE setup guru
  290. Archive CHM file updated Jan 28 (*NM*)
  291. The end of win 2k is programmed
  292. Aristocrats
  293. Reverse Engineering Conference 2005
  294. New but backwards compatible DVD copy protection
  295. Welcome Back
  296. Corrupted ZIP files
  297. Quick reply functional change
  298. [JOB OFFER] Reverse Engineer wanted!
  299. Are we back..?
  300. RSS feed??
  301. I love IDA
  302. Nasty harddisk problem, need some tips fast :(
  303. Attached Zip files are fixed fixed
  304. 802.11n detector
  305. Dead Links [SoftIce]
  306. GenuineCheck.exe
  307. A hell of a reverse engineering project
  308. Amazing new searching tool!
  309. Call for dELTA
  310. are these down ??
  311. WinMX Issues
  312. What kind of papers do you want to read today?
  313. Audio waves Reverse Engineering
  314. autorun question
  315. Programming Languages Used by Pest Authors ...
  316. Any crackers idea???
  317. Windows NT DDK Kit
  318. Opera Browser 7.54 For Free (As In Beer)


The Newbie Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum
PDA

View Full Version : The Newbie Forum

Pages : 1 [2] 3
  251. How does it control for multiple installation on different computers.?
  252. ATI macrovision
  253. Print without the symbol loader
  254. give some advice
  255. Icon in taskbar
  256. BUG-Win32Dasm-EXEscope-Str Table
  257. Very hard To crack eeeeeeeeeeee
  258. A few queries
  259. Handling PUSH DWORD PTR SS:[REG+CONST] in OllyDBG.
  260. Where to Start
  261. MFC42 problem
  262. Data file extractors?
  263. OllDbg: Memory Log
  264. Hasp4 ID
  265. remove HASP4 at customise app.
  266. Someone feed me
  267. Need help on P-Code.
  268. How to change far Jump in P-Code ??
  269. Dialcops
  270. New at this...Can someone help please ?
  271. Crackin.NET Applications
  272. Is mammon_ back?
  273. Mega Newbie needs help. Enabled Save button but cant save
  274. how to remove Alt+tab protection ?
  275. symbol not defined - Why?
  276. CheckRemoteDebuggerPresent
  277. zero knowledge
  278. cracking licence files
  279. Cracking a game
  280. FlexLM protection
  281. How to use really s 0 l ffffffff ?
  282. Mup Upx 1.24
  283. Emulate a fast-eye dongle
  284. WriteProcessMemory on XP services
  285. Newbie question: why aren't hardware breakpoints breaking???
  286. Need help reversing string-to-key routine
  287. Most reliable break points
  288. Newbie Dongle Problem
  289. How to fix nulls in dumped exe
  290. IncrediMail Upgrade Message
  291. OSX cracking
  292. laserlok
  293. VB hex values for jumps and thier functions please?
  294. Hard Lock
  295. question from a pre-n00b :)
  296. rtcMsgBox breakpoint doesn't work
  297. MUP bpx int3 - all done - - cant' find real OEP
  298. MUP Upx
  299. Try to Create a Patcher
  300. SoftIce stopped breaking at all
  301. The bios
  302. Dll protection with Digital Signature
  303. :( SoftICE
  304. problem with hasp4
  305. VOB ProtectCD V5
  306. Marx Cryptobox dongle
  307. PE Format HTML
  308. No Point Of Attack
  309. PE Files
  310. If you had to choose?
  311. cracking FlexLM based program
  312. Process Patching
  313. Need some helps(newbie)
  314. Software Memory Breakpoints ??
  315. modify the PIB? (Hey squidge)
  316. newibe problem
  317. old dos keydisk
  318. RVAToOffset
  319. Hi!
  320. Im Like The Little Train That Could But Ive Just Run Out Of Tracks.
  321. PC ROM debugger
  322. Very Newbie Question - How to translate addresses from IDA to SoftICE?
  323. GetWindowTexta and GetDLGItemTextA don't work!
  324. Dynamic memory allocation question
  325. SoftIce Does Not Pop Up....
  326. please help me
  327. I need to find compression type (Data files)
  328. How to find out, what the call does ?
  329. problem with bmsg
  330. Game data files cracking
  331. The Function in PE
  332. New lamer meats forum..
  333. Strings in ExeScope versus W32DSM
  334. getright5.1 beta2 detect debugger
  335. newbie here, trying to disable menuitem
  336. Fullscreen to windowed mode and change resolutions
  337. About CrypKeyGen
  338. unix/irix software cracking
  339. bug in a game
  340. List of all String comparing APIs?
  341. what is a thunk???
  342. Does asprotect have anti-tracing code???
  343. flexLM/'system clock setback detected' problem
  344. Questions in kernel32.dll of Win98
  345. Unpacking PC-Guard 4 Protected App
  346. Digging up some old memories (real newbies: read this!)
  347. breakpoint softice <-> specific file
  348. softice -- simple problem
  349. Need help with FlexLM v8.4a
  350. A Hidden Online Serial Key Check.
  351. newbie serial fishing
  352. removing "server check"
  353. A newbie question.
  354. CRC Check Trick
  355. First success(es)
  356. MAC Dongle Possible?
  357. what about XPSP2 "Execution Protection"
  358. MASM and dword ptr
  359. Any one with experience reversing a powerbuilder application?
  360. Quiestion about vb pcode
  361. How to trace a register back? (plz help)
  362. Need help
  363. Marathon CD Protection
  364. A Troublesome DLL file
  365. softice question
  366. how to write tutorials?
  367. Struck in keygenning
  368. How do I remove A programes Licence
  369. HASP Driver-How to Start?!
  370. ASM language....
  371. task bar
  372. i need some quick help
  373. win XP
  374. Got SERIAL..Still Can't Register?!!
  375. Patching .NET opcodes
  376. Minor rant
  377. Where to get the targets???
  378. Removing the Call Home "feature" in vBulletin 3.0?
  379. BreakPoints with SI
  380. Common ASM instructions explained (from MSJ Under The Hood)
  381. Can anyone help a beginner?
  382. Undocumented file format containg executable code ?
  383. F3 in hiew
  384. VB P-Code
  385. old DOS program
  386. interlok troubles
  387. Which C++ IDE do you use and why?
  388. I´ve cracked a program but i don`t know how...!!!!
  389. Asprotect patching exposed
  390. same codebytes, different meaning ?!
  391. Rainbow Superpro Sentinel Driver
  392. How does this program work?
  393. Crypkey (again)
  394. looking for NetSentinel Tutorial
  395. Help C++ compiling
  396. Need other SentinelLM Crackmes
  397. can i buy a good protection for my application ?
  398. Borland Builder Exceptions
  399. Which tool is better for packet sniffing/modifying?
  400. Packed and probably self-checking. Help needed
  401. A (beginner) beginner
  402. Teach yourself programming...
  403. Fishing Setup Key..how??
  404. HELP!! Cant find the correct ID button in GetDlgItem
  405. Starforce 3...Uncrackable?
  406. Advanced binary diff tools?
  407. crack this crackme
  408. softwarekey.com protection
  409. Hasp Hinstd.dll?
  410. cracking help
  411. DllMain breakpoint
  412. possible to get the string(file) from md5 hash
  413. Hasp emulator
  414. UD2 opcode
  415. Vectors
  416. Crypting or Packer plz ?
  417. No matter what there is always another way
  418. Normal Breakpoints Work!
  419. minute trial
  420. Help: Can see Api call in Hexeditor but not Dissassembler!
  421. CAD add-on dll and Olly
  422. Req: Patcher that can apply different patches based on file version
  423. Unpacker Detection
  424. Changing a Windows XP software to run under Windows NT
  425. pocket program need help
  426. Dll won't run
  427. A push in the right direction
  428. profile
  429. hiding public key in the app
  430. FlexCrypt
  431. ascend the code after a [ebp+08]
  432. How to "reverse" this algo???
  433. How to bpx on class method?
  434. Deleting a button (C++)
  435. Identifying Protection
  436. what registers do WINAPI-CALLs depends on?
  437. Finding call to files on source CD.
  438. [Help] Key-Lok II and MS Access target
  439. Help doing inline keygenning....
  440. n00b PDA reversing question...
  441. Direction on unpacking
  442. IAT rebuilding question
  443. Newsrover hiding files?
  444. How should I create INC for NICE 4.3.1
  445. DirectX interface names
  446. dll dump questions
  447. yet another softice bp question
  448. How to find static pointers in a process? (hlp)
  449. @ xollox
  450. Changing default menu selection.
  451. question about some stuff in exe header
  452. how to determine importtype?
  453. File time
  454. exe file
  455. Newbie, In need of direction
  456. EXCEL macro signature
  457. strange behavior of unpacked exe (upx)
  458. Interview...
  459. App better than ring-0?
  460. ImpRec Question
  461. VirtualAllocEx equivalent on win9x?
  462. Setting break point at the RET
  463. How do you bpx on a class method??
  464. Olly and SMC
  465. Registry file
  466. DLL in NASM
  467. GENTIUM dongle
  468. PE File Virtual Size > Size Of Raw Data
  469. Faster bruteforcing a SPro dongle?
  470. Help with RCData
  471. Disasm idea (Interactive flow-chart)
  472. Texas Instruments Interactive; can someone help me to crack it?
  473. with one valid NAME & KEY
  474. Prevent application from receiving messages
  475. Installshield 9 - S/N Protection
  476. Making a program run without the loader ?
  477. Crackme and Sources
  478. VXD Files
  479. Dont quite understand what this inst is doing
  480. Which API's are used for connecting to website?
  481. Need help in developing keygen for <deleted>
  482. Online Checker
  483. help with a cbuilder component
  484. Hasp4 dmp to reg converter HaspPro.Emul
  485. VTCPAK33 Target
  486. Using code caves for bruteforcing
  487. WinMain question
  488. dos cracking
  489. Basic cracking. Please help.
  490. Getting a feel for how a program works
  491. Flag Read/write of header section
  492. Looking for information on manual Import Reconstruction.
  493. aspacker - HELP
  494. how do I use an apps dll in my own apps
  495. Missing something in this code...
  496. how does ImpRec work?
  497. (x ^ y) mod z = w
  498. PE Problems after unpack hasp envelope...
  499. IDA and Dede dissassembly differences
  500. Dallas iButton problems


The Newbie Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum
PDA

View Full Version : The Newbie Forum

Pages : 1 2 [3]
  501. change hwfp
  502. Help with ASM code ?
  503. File checksum value problems
  504. product key/ time trial
  505. learning idc
  506. softice 4.0 trouble
  507. How can I get an information for a certain thread?
  508. Need some help with olly script
  509. universal brute force tool
  510. Softice 4.3 Breakpoints Not Working
  511. Ice License (delphi)
  512. c compiler/linker and snippet creator
  513. Deferences between Debug and Release in IDA
  514. Need bruteforcing tutorial?
  515. Windows message constants
  516. Finding windows Handle
  517. Hiding Si
  518. Vertical scroll
  519. A quick Thank You
  520. Hooking DLL functions
  521. Assembly Coding in Delphi Problem
  522. A Little Help Maybe!
  523. Problem Finding Import Table
  524. Recosntruction the code
  525. SafeDisc v3 - New protection?
  526. Have Hardlock (Dongle) will learn!
  527. Help Rebuilding IAT
  528. how to decrypt *.rar file ?
  529. Append text to an edit control text buffer?
  530. IDA: what a bomb!!
  531. Breakpoints in SICE
  532. Dll functions
  533. Configuring SoftIce.
  534. A Little Help With Ollyscript
  535. Where to start?
  536. How to find difference between two binary files.
  537. enabling missing option
  538. Ollydbg and C++ Applications (specifically RTTI)
  539. DOS programa with a disk Protection
  540. Fusion vs. Thinstall
  541. Archives
  542. How can i do?
  543. REPZ Instruction
  544. TLSGetValue
  545. Winzip registration routine
  546. Safedisc 2 questions
  547. Network access
  548. Stupid encryption Examples. (In protector help file). um, duh.
  549. How can I modify a win xp system dll?
  550. VB forms
  551. Identify Processor on Smart Card
  552. wysiwyg 1.09
  553. Krobars crackme2 tut
  554. Question about Softwrap
  555. I intuitive cracking of mine!
  556. Softice doesn't break on "int 21" in 16-bit code
  557. IPAQ - M$'s EVC++ won't debug
  558. Need advice...
  559. convert .MAP to .TDS?
  560. MD5 hash calculator
  561. Visual Basic 5.0/6.0 File reading
  562. When MessageBoxA is far away
  563. Explorer add-in patching...
  564. can't find hex code in exe file
  565. USB Fake port
  566. How to remove the NAG Window
  567. Shrinker 3.4
  568. A FILE HANDLE question
  569. code injection problem
  570. looking for Microguard PC info.
  571. File Handle
  572. Ollydbg and antidebugger protection
  573. Keygen approach for a Delphi app
  574. add ordinal to export table
  575. MP3 Dumping.
  576. INT3 and process
  577. a protection algorithm using INT3
  578. Converting an old InstallShield Package
  579. YAPEQ - "Yet Another PE Question"
  580. Os architectry
  581. File hiding
  582. MASM Syntax.
  583. problem with NTFS file encryption
  584. Looking for OpCodes!
  585. wise installer trouble
  586. Problem with an app and ASProtect
  587. Newbie password protection help
  588. PhotoLine5 (ida crash)
  589. begin of program in mem
  590. Nuthin' works (breakpoints)
  591. Ida signature and unpacked program
  592. a program that detects debugger attachment
  593. import table - add a dll -
  594. Change detection
  595. Harddisk serial lock
  596. WDasm32 closes when loading Exe
  597. Restoreing VB project files...
  598. lm_checkout() retn
  599. java class patching
  600. Learning to RE installshield, am i doing it right?
  601. protection i need help
  602. ok i'm new go easy...
  603. Debug registers and w2k3
  604. general unpacker for almost all win32 exe
  605. Very basic question bout SI
  606. distinguishing between imul and mul in C
  607. Sentinel sprofindfirstunit
  608. EPROM code patching
  609. Recommended Graphics Card for Driversuite 3.1 ?
  610. Need help for Masm32
  611. Clarification of breakpoint contexts
  612. Location of l_sg v6.1
  613. game training
  614. Trying to figure this program out.
  615. IceDump
  616. explorer parent process
  617. checking my ASM
  618. offsets are different in Softice and IDA
  619. Replacing Strings
  620. java BigInteger
  621. call stack -back tracing
  622. win32 edit control problem
  623. database reverse engineering
  624. cracking a flash game
  625. Visual Studio debugger better than SoftICE?
  626. Delphi RE for obtain decrypted data
  627. UPPERCASE CHECK
  628. beginner's series of crackmes
  629. Authorization from floppy disk
  630. dword ptr question
  631. about the book <<How Debuggers Work.. >>
  632. Altering a DLL file
  633. Remote debug & Visual SI
  634. create slockpk cert without priv. key?
  635. quick question about __allrem function
  636. ICE License
  637. GetDriveTypeA
  638. Hex
  639. HASP ENVELOPE AGAIN...
  640. Where to start
  641. Two different program with same package
  642. Targets with commercial protection
  643. Resources
  644. SoftIce strange behaviour
  645. Searching string literal in remote process
  646. Speaking of SoftIce problems, it ate my boot screen
  647. Need help with Sentinel SuperPro
  648. How-to log port IO protocol?
  649. Taking control of a prog
  650. Mophun
  651. tutorial on soleau type games
  652. DebugActiveProcess
  653. Some DRx Questions
  654. INT1 question
  655. new borland libraries format dumper?
  656. Editing Installshield CAB files.
  657. A few tips please
  658. SoftICE / bpx
  659. Installshield v6.31 problem
  660. Attaching a .res file to a process
  661. The RCE Staff
  662. Stuck with registry query
  663. Activating functions provided by add-in ?
  664. Import table doesn't really resolved
  665. DirectDraw editbox breakpoint
  666. Help with Delphi 7 app
  667. Assembler to C
  668. Additional process without name...
  669. Need help with crackme
  670. Using proxies and all that
  671. Open Sourcing
  672. How to write array-elements using a loop in MASM32?
  673. Key generating, computer ID, etc.
  674. Reversing Pocket PC Apps
  675. Desperetely looking for Sentinel LM SDK 7.1.0
  676. Internet based protection
  677. Problems Reversing a PE File
  678. question about HASP
  679. windev and api's
  680. softice 4.o5 winnt and XP
  681. DLL used by VB Application for Object Type
  682. patching pocketpc smartphone apps
  683. DConsoleapplication?
  684. Need some help for hardware protection
  685. Question about aspack
  686. Harlock eye help
  687. Question about breakpoint.
  688. Question about IDA
  689. dongel emulator and reg key
  690. Two small questions
  691. a place for REAL newbies??
  692. sick template-stuff aka compile-time programs
  693. I don't know anything about assembly instructions
  694. Some problem with my simple import protector
  695. HOW TO UNPACK FILES FROM MICROSOFT MSP ?
  696. Need Help with Strange JSR Call
  697. Serial fishing
  698. having trouble understanding
  699. Generic IDAPro/ASM questions...
  700. need hlp dongle emulation
  701. 16 Bit Sub-system
  702. HOW TO:Breaking flash movie protection
  703. disasseble for arm-processor...
  704. Anti Smartcheck
  705. Identifying a protection
  706. Tornado's crackers notes
  707. Win32dasm
  708. Why I have this access between processes?
  709. Making the change
  710. Breakpoint
  711. Turbo Pascal V7
  712. Sentinel, and now ?
  713. Why IDA crashs for MSVBVM60.dll?
  714. Need help with network debugging
  715. I want to look at source code
  716. Marx Cryptobox emulation/hacking
  717. IDA Pro FLAIR421 "issues"...
  718. Need help for Sentinel LM
  719. SoftIce 3.25 nt
  720. W32DASM USER MESSAGE
  721. DLL modification
  722. Looking for Sentinel SuperPro Emulator
  723. Dynamic Memory Allocation Question
  724. PAGE_GUARD protected memory
  725. PC Based Fortran
  726. [.AVF FILE]
  727. BinDiff in IDA Pro
  728. interesting time based debugger detection
  729. How to determine what Specific API calls do
  730. Strange Reaction In Program
  731. Cracking a trial - Time Up dialog text is not in stringdata
  732. Winrar SFX Archive Cracking
  733. Reversing few parts from a guitar program
  734. GODUP question
  735. about Visual Studio .NET 2003
  736. A quesion about PE
  737. VB P-code article
  738. Hardlock HL-Dump
  739. Unpacking Intall creator pro
  740. Trials, how do they work?
  741. Two PE detector,Why two detections?
  742. How I can inject code in windows CE DLLs or Hook them?
  743. Impossible Protection?
  744. New Anti-debug protection?
  745. Sentinel SuperPro USB
  746. Good tut / essay on CD protection
  747. Newbie
  748. Injecting code in Symbian??
  749. CRC Check
  750. A problem in Flexlm 6.1


How about we get started....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > How about we get started....
PDA

View Full Version : How about we get started....

goatass
10-31-2000, 04:15 PM
Why don't we get started on a new project. The project I tried to start before the old forum was shutdown was StageTools Moving Picture Standalone version.
This program requires a valid serial number to be registered, but this serial differs on every machine. This is really not as hard as you might think.
To get started all you need is to download the program from ht*p://www.stagetools.com and get SoftIce and maybe if you want get W32Dasm or IDA. After installing the program try to register it and see what happens what messages you are getting back.
some BPXs to try: MessageBoxA, GetWindowTextA, GetDlgItemTextA. I promise atleast one of these will work. Once inside the program trace around and see what you can find.

Post any questions, findings, whatever, but don't give out the answer so others can have a chance to try it for themselves.

p.s. +Sandman I e-mailed the madorator about this project but got no answer back. Feel free to remove this post if you think it's not a good project. I just wanted to get something started.

goatass
+Sandman
10-31-2000, 05:14 PM
Greetings Goatass...

Thanks for dropping by.. I won't remove your posting as it's start in the right direction.

I would 'suggest' however, that you make your objectectives both clearer and in easy (yes, even spoon fed) steps for those less experienced than ourselves.

Not all newbies are aware that most win programs create registry enteries when first executed, and that some go as far as to create hidden files in the Windows directory as well. But if we don't mention this then people won't know what, or where to look for the program's Registration settings etc. What utility might we use to make a 'snapshot' of our system registry file that will show up these changes?. Would RegMon & FileMon help us in our endevours in understanding more about this program?.

It's not easy I know, to try and always 'think' like a newbie in circumstances like this but it helps..)

Regards
+Sandman
goatass
10-31-2000, 07:08 PM
+Sandman thanks for your suggestion, I assumed certain things were known but that was my mistake, here is some clarefication.

After running this application a couple of times and seeing what kind of error messages pop up, how does the registration works do you need to restart the program for it to take affect ? It's always a good idea to run the program a couple of times and see how it works, then run FileMonitor and run the program again and check the listing for some out of the ordinary files such as license.key or something similar to that. After that run RegMonitor and run the program again and see what registry keys are being accessed and see wether the program found the key or not this should give you some idea of what to expect the program to be doing once you register it.

When dealing with serial protections there are some break points that are often used to try to follow the serial generation algorithm. These are GetWindowTextA and GetDlgItemTextA, in 90% of the time either one of these APIs would cause SoftIce to break and put you near the serial algorithm code.

Some hints about our target:
BPX GetVolumeInformationA - this will put you right at the biginning of the key generation algorithm. This algo is very simple only a couple lines of code.
After SoftIce breaks continue tracing (F10) until the RET and go past it once you return from that function start tracing (F10) slowly and look at memory addresses that are stored in the registers. do a: d eax to see what's in eax or: d *eax to see what eax points to.

I hope that give you a starting point, feel free to post any questions if you don't understand something or don't know where to start.

all tools are available at ht*p://protools.cjb.net

goatass
CrackDoode
11-02-2000, 04:30 PM
Greetings and salutations. Many thanks to goatass and +Sandman for the learning opportunity. As far as newbies go, I'm as green as you'll ever see but I'll try not to test your patience too much ;)

I've got Win32Dasm and Moving Picture stand alone but I'm having a little trouble with SoftIce. What's the difference between SoftIce 4.0 and SoftIce Suite ? Is the suite a plug-in ?

CrackDoode
goatass
11-02-2000, 04:54 PM
Hi CrackDoode,
I'm not very familiar with the SoftIce suite but I think that's SoftIce and driver studio and some other stuff...As long as it includes a full version of SoftIce it doesn't matter what you get.

goatass


A Couple of Questions ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A Couple of Questions ???
PDA

View Full Version : A Couple of Questions ???

Clandestiny
10-31-2000, 09:00 PM
Thx goatass for taking the initiative with the first project. I can already tell that this is going to be a great opportunity for newbies like me to learn :-)

I just downloaded the moving pix program, but before I dive too deeply into this project, I would really appreciate a little more insight on how to use filemon / regmon. I noticed that these tools were mentioned in one of the posts. I've mostly gotten by with Wdasm and SoftIce to this point but since I've now seen both filemon and regmon referenced several times, I decided I should check them out. I downloaded them and ran them, but am not quite sure what I am looking for or how to sort out the relevant information. I ran filemon once without the moving pix program being open (??to get some basline info??) and then again after opening and attempting to register moving pix. I saved both of these to a file and then opened them and attempted to compare them for any key differences. These files were *very* long and I'm not quite sure what I'm looking for or if this was the right approach ??? I know this must be a very *basic* question and I will really appreciate any pointers on the use of these tools...

Thanks in advance,
Clandestiny
ThRaX
10-31-2000, 09:13 PM
Awright here:
First off, set your filter in filemon/regmon such that only events from MovingPix (i believe process name is "Moving") are captured. Then open up the program, go the registration dealy, type in your stuff, press okay, then exit. Do this for filemon and regmon---THis procedure is common for any porgrams with a registration screen (I donno if MovingPix does, as I dont have it yet...if it doesnt, then open filemon/regmon, then open MovingPix, then colse movingpix)...Then view the file. It shouldnt be THAT long, but look for any registry entires or files with the word "register", "user", "Name", "serial", "code", or anything thatl ookds like it may have something todo with it---or in some rare cases, just anything that looks out of place. .

hope this helps
--ThRaX
Kayaker
11-01-2000, 01:31 AM
Hi Clandestiny and other Project keeners,

OK, I just got an error message from my post that
The "Message" field cannot contain more than 4098 characters.
So, I'll break this in 2

A couple of points re Filemon and Regmon. Rather than setting an Include filter to capture the process you think you want (Moving), you can set Exclude filters for all regular background stuff you don't want. For example, mine right now is
explorer;regmon(or filemon);???;kernel32;msgsrv32;tapisrv
for both programs. You may come up with others on your system that you're not interested in. The Include filter is "*".

This way, you're set up to go for any program, and you won't miss any situation where the main program might call another process (exe, dll) which itself tries to access a file or the registry. As an aside, I just noticed CloneCD does this, the name of the 2nd process is a nonsense name that is different each time it's run. I don't know what the REAL process is yet, but it's a neat trick ;)

Both programs have the nifty ability when you double click on an entry to open up the associated registry key (VERY useful for a quick check to see if this might be a "suspicious" entry) or the file directory (less useful).

One thing I often do when I first see a suspicious file or reg entry which might hold some install date info is to make a backup copy of it immediately. Then you can compare a few days or runs later and see if anything has changed.

It's also useful to use an install monitor, such as Inctrl4 (PC Mag freebie), when installing for the 1st time. Sometimes it'll show things you might not pick up immediately with Filemon or Regmon. Plus, you should use these 2 the VERY 1st time you run the program, as well as any subsequent times. Occasionally a program may write something somewhere on the initial run which it won't check until later (Perfect Companion is a good example where having original Install/Filemon/Regmon logs proved helpful in ferreting (!) out some 'hidden' orphan items left behind).

For Filemon, there's a cool util called Filemon Log Killer by Marton and R0ach which removes all the duplicate Filemon log entries. This is useful for making any suspicious entries stand out. Really saves the 'ol eyeballs on those big logs. You can get it at one of the Tools sites on the shelf next to Filemon.

On to Part II...
Kayaker
11-01-2000, 01:34 AM
Another indispensible part of the 'Reversers Toolset' IMHO is an API monitor. Here's one line from the APISpy32 output for Moving.exe using the Kernel32.fnl library:

0040C3F9:GetVolumeInformationA(LPSTR:012620ED:"C:\",LPSTR:00000000,
DWORD:00000000,LPDATA:006AF9D8,LPDATA:006AF9DC,
LPDATA:006AF9DC,LPSTR:00000000,DWORD:00000000)

This tells you for one thing that GetVolumeInformationA is actually used and might be important. Combine this with other Kernel32 calls plus results from User32, Advapi32 and any of the program's dll's functions (you can build your own .fnl library with APISpy32), and you can get a truckload of information on what the program is doing and the general code flow.

0040C3F9 is the address of the Call as seen in WDasm or Softice (this isn't *always* the case, but it often holds) which you can set a breakpoint on or scope out the disassembly code of

* Reference To: KERNEL32.GetVolumeInformationA, Ord:014Fh
|
:0040C3F9 FF15289B4300 Call dword ptr [00439B28]

The information in the brackets after the address and function are all 8 of the calls' stack parameters BEFORE the call, which is of course where the Win32 Programmer's Reference comes in.

The entry LPDATA:006AF9D8 is the 4th paramter of GetVolumeInformationA, or lpVolumeSerialNumber which "points to a variable that receives the volume serial number". Hmmm, might this be important? Would it be worth doing a 'dd 6AF9D8' in Softice before you F10 step over the call at 40C3F9?

Anyway, just a few ideas for now. Good Luck with the rest.

BTW, if anyone wants to bypass the email registration needed to d/l the program (why annoy the poor programmer with bogus email addresses?), here's the direct links (note the \Backslash argument):

h*tp://www.stagetools.com/downloads\Support.exe
h*tp://www.stagetools.com/downloads\MovingPix.exe
(both required)
h*tp://www.stagetools.com/downloads\OpenGL.exe
(required if you don't have OpenGL already installed (Win95, early Win98 perhaps)

Cheers,

Kayaker
Clandestiny
11-01-2000, 06:46 PM
Thx Kayaker and Thrax.

You were right. The filter function was the key. I acutally did not find too much that seemed relevant in regards to the Moving Pix program in either filemon or regmon, but it is good to know how to use these 2 new tools just the same. Just 1 other question though...I was wondering if there is any way to save the filter information in filemon...regmon asks me if I want to continue using my previous filters when I open the program...filemon just deletes them. Maybe I have an old version of filemon (it is v. 4.01) ?

Thx,
Clandestiny
?ferret
11-01-2000, 08:14 PM
hmm...get filemon to do something that it usually doesn't (that regmon does)....Do I hear someone calling your name Kayaker? heheh
Kayaker
11-01-2000, 08:49 PM
Dang, wish I could get this board to do something it doesn't want to do and keep me logged in long enough to post as a registered user. I have to type in my nick and pw each time to post even if I'm logged in just prior to clicking on "Reply".

I don't know why you're getting that behaviour with Filemon Clandestiny. I don't think there's a "Save" feature for the filters, just the "Reset" which acts as an unsave. 4.29 is the latest version (Sept/00)

Well let's see, by using Regmon on Filemon (with the "filemon" Exclude filter omitted) it seems that Filemon keeps its filter settings under

[HKEY_CURRENT_USER\Software\Systems Internals\Filemon]
"Settings"
"InFilters"
"ExFilters"
"HiFilters"

You can check there to see if the info still exists.
MR. Candyman
11-02-2000, 12:48 AM
I see that the last 2 or 3 posts hint at "aiding the program filemon along in it's progression through the versions" and another "fixing the message board for selfish, but useful needs"

the second would require hacking into the server though...not something I can do yet, but it would be fun...

but the first would be cool too...combining the programs is good research
?ferret
11-02-2000, 08:42 PM
Hi MR. Candyman,

Go to qferret.cjb.net and look for the essay by Kayaker. Download the zip file & enjoy the read ;-)


Recommended Software for Reversers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Recommended Software for Reversers
PDA

View Full Version : Recommended Software for Reversers

RalDnoR
11-01-2000, 06:08 AM
Hi all!

It pleases me to see there's already some real cool activity on this part of the forum.
This time I'd like to share with you my recommendations regarding reversing tools.

I'd like to select my tools depending on various aspects like: simplicity, size and the readability of the output.

For all newbies I'll try to explain what the purpose of the program is and where you can get it:

Disassembler
Name: W32Dasm
Location: ht*p://protools.cjb.net
Purpose: A disassembler takes an executable file (or library) and dissects it into assembly code. Good disassemblers also create string references which is usually a list of text-strings which are used from certain locations in the program. This is very handy to use when a string is displayed in the program like for example: 'Invalid serial-number'. When you know where the location is where the string is displayed it's easy to backtrace into the source-code where the validation is done.

Debugger
Name: TRW2000
Location: ht*p://www.protools.cjb.net
Purpose: I'm sure I will get some flames on this one ;). Most people will reference to SoftIce when it comes to a debugger, but as I've said before one of my criteria is size and TRW is VERY small and uses almost the same instruction set as SoftIce. The only drawback is that TRW runs only under Win9x. Another advantage of TRW is that it can be loaded and unloaded, so you can load it once the anti-debugger code has passed :).
Anyway, a debugger is used to take a look inside a running program. You can halt execution of a certain program on any point and take a look at what's inside certian memory locations. This way you can for example 'sniff' serials. In many programs there's a location where the given serial is compared to a generated one (based on for example a username). With a debugger you can step through the code untill you arive on the comparison of the serials and 'sniff' the right serial (pretty cool huh?).

Registry Monitor
Name: Regmon
Location: ht*tp://www.sysinternals.com
Purpose: Well, I assume that most people know what the registry is... The registry is a centralised location where programs put information about their functionality (program settings, window-settings, encrypted registration info etc.). The registry consists of two files located in the windows dir (user.dat and system.dat). RegMon provides a live view on registry activity. So when a program tries for example to read a registration key from the registry you'll see it on the moment it occurs in RegMon.

(Message continues in reply due to exceeding of message size)
RalDnoR
11-01-2000, 06:09 AM
(Continued message)

File Monitor
Name: FileMon
Location: ht*tp://www.sysinternals.com
Purpose: Besides getting registration information from the registy another trick from programs is to hide it in other files usually with strange filenames and located in system directories (like windows\system). YOu can also use this program to view dependancies. For example; when a program has a serial-validation routine but you can't find it in the disassembly of the main program it could be located in an external library (dll or vxd). With filemon you can check which files are 'connected' to the main program and from where they are used (off course you can also check the disassembly and locate the dependancies).

Api Monitor
Name: Api Monitor
Location: ht*tp://www.rohitab.com/apimonitor
Purpose: Windows programs are usually build with building blocks. Why should every programmer reinvent the wheel? This is why windows uses an API (Application Programming Interface). This means that dll's and vxd's (external 'programs' without startup-code) contain functions available to use for everyone. When a program needs to access the registry for example it can 'call' a function of the Windows-API which does all the dirty work without having the programmer to know the inner workings.
This API monitor displays when and which calls are made to the API. So it actually explains what a program is doing at a certian moment. Since API-calls usually have descriptive names you can learn a lot from this.
For example a function like StrCmpA (String Compare) might be a serial validation part.

Hex Editor
Name: UltraEdit
Location: ht*p://www.ultraedit.com (crack on ht*p://astalavista.box.sk)
Purpose: I will probably also get some flames on this one, because msot people will use a dedicated hex-editor (like hiew or IMHO better, Biew, both available on ht*p://protools.cjb.net) but I prefer this one (despite it's large size) since it integrates in windows (right click on a file and choose 'ultra-edit') and it supports all kinds of files. I use it for my programming exercises and for patching of files. Another nice thing is that it creates backups of edited files.

Scratch Pad
Name: Notepad
Location: Your windows directory
Purpose: Within no-time you'll find yourself making notes everywhere about certain locations, calculations and other stuff. Maybe even better than Notepad is to use just plain paper and a pencil.

Time Tool
Name: Watch
Location: Usually on your wrist
Purpose: Cracking sometimes takes a lot of time and dedication. Always keep in mind that tomorrow there's another day. You'll often find that after a night of sleep you'll suddenly get past the location where you were stuck the night before.

This is only a basic list which will be usable to reverse most programs. Once you're getting more experienced other tools might be usefull like ProcDump, IDA and other stuff. Though I suggest working with the above tools to learn the basics.

Play with these tools, take some simple programs and notice what's going on behind the scenes.

I wish you good luck and if there are any questions don't hesitate to contact me.

Cheers,

RalDnoR.
?ferret
11-01-2000, 08:11 PM
Hi Raldnor,

I tried to mail u, but the mail got returned....mail me at jcferret at yahoo dot com, so we can bounce a few ideas around OK?

As for the post.....good going. Some people may stumble across this place and want to give it a shot, but not know what to use or how to use it...good thinking.

As for the possibility of being flamed for suggestingTRW? Not going to flame, but simply point out that 50% or so of the people I know that have tried it can't get it to run at all.....Win 9x or not ( would be pretty frustrating for a "complete newbie" to try to install suggested software & find he/she can't use it ;-))
MR. Candyman
11-02-2000, 12:38 AM
Thank you for saying what the debugger does when disassebling programs. That is a handy tool then...it would greatly simplify the project I'm doing right now where I'm trying to crack a dongle (the dongle doesn't execute instructions, it's just there).
RalDnoR
11-02-2000, 03:59 AM
Hey ?ferret!

Thanx for the reply! The best email address to use to mail me is: raldnor(at)crosswinds.net. Is seems that the other account of mine had indeed some problems.
I'll mail you tonight (I'm working right now).

About TRW: it's quite simple... In the distribution (a zip-file if I'm correct) there are two files, an exe- and a vxd-file. The exe functions as a loader, the vxd is the actual debugger.
To load TRW simply start the executable and enter a program in the textbox (you can also browse for a program). The press ok and the program will be started. To pop the debugger up press ctrl-n. To quit the debugger simply close the loader (so when you are debugging always keep the loader minimized).

Hope this helps dude :)

Cheers,

RalDnoR.
ByTeSnIpEr
11-08-2000, 08:19 PM
I have used the first version of TRW2000 and it worked well, but was slightly unstable and buggy. Now isn't the version you are recommending shareware? It keeps popping up with a registration message during use, like the Nigel nag. Does it need a RE solution or are you recommending buying this app as a matter of course? Is their a later version that is not crippled?

Thanks
Bytesniper
?ferret
11-08-2000, 09:02 PM
That choice is ultimately up to you, but if you find it to be a good proggy and continue using it (and can afford to)....by all means buy it. Programmers deserve to make a living (they have families too ;-))


Movin Pix - How to "unregister"? and more
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Movin Pix - How to "unregister"? and more
PDA

View Full Version : Movin Pix - How to "unregister"? and more

InOverMyHead
11-02-2000, 08:10 AM
First of all I would like to say thanks for the direction the project area is taking. I like the supplying of hints, so we don't have to just jump in "cold".

One thing I would like explained further, is how are the bpx's chosen. I use Quick View Plus to view the exe file and then try to pick from the functions listed there - but is there another "sureshot" way. I am trying serial number targets, but have NO success due to being a very newbie.

Along this same line, I submitted a question in the tools section about adding a dll to winice.dat - but I can not get softice to accept a bpx on any function that I try to set that is listed in that dll.

Lastly, I have successfully registered Movin Pix. Is there a way to "unregister" the program in order to try some of the other approaches to learn more?

Thanks!!!
goatass
11-02-2000, 08:21 AM
Hi InOverMyHead, I'm glad you were able to register the program, it wasn't too hard right ?
As for how to unregister the app it's quite simple, run FileMon and run the program and look around for interesting files one to look at is c:\windows\moving.ini in there you will find the RegistrationKey so just delete it's value and you are no longer registered. Another thing to keep in mind is that many programs no adays store the registration in the registry so running RegMonitor on a program is a good idea too.

Since you managed to register the program see if you can isolate the registration algorithm and extract it, that should point you towards a keygen and better understanding on how this algo works.

goatass
MGJ
11-21-2000, 10:05 AM
please, could someone tell me the location of the Moving Pix? It looks like a good project for a newbie and I missed it's address...
?ferret
11-21-2000, 09:17 PM
ht*p://www.stagetools.com


Registered, but how?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Registered, but how?
PDA

View Full Version : Registered, but how?

JaneK
11-02-2000, 01:26 PM
Hi and thanks for this learning opportunity,

I think I managed to register the prog, but I'm not sure. Sounds strange, I know, but this is what happened:
1. Entering wrong code does not result in any message (like wrong registration number etc. - the program just continues unregistered)
2. Bpx at GetVolumeInformationA as suggested earlier.
3. F11 and I'm in the "moving" code, probably in the routine for calculating the correct serial (lot of math expresions).
4. Cmp and then setnz seems like verification routine to me. I checked what is in eax and it was a number in hex. Converted it to decimal and put as a registration number. Again no message (no "thank you" or anything), but next time I started the prog, "Register" option in Help menu was inactive, so I guess it's registered.

Pure luck, I guess. Waiting for posts explaining the registration process from someone who understands it - unfortunatly I don't.

JaneK
goatass
11-02-2000, 05:02 PM
Hi JaneK,
Congratulations you managed to register the program. Not showing a messagebox wether it's "Wrong serial" or "Thank you" is something that you will see alot now adays since those messages could be used as search strings and the key algorithm located in seconds.

The GetVolumeInformation API (when setting a BPX on it) will drop you at the beginning of the key generation algorithm. After more people get a chance to look at the program I will post a complete explanation and a keygen to study.

When you get to the CMP code you can see the numbers being compared (in HEX) and the SETNZ sets EAX to 01 if the two strings compared a Not Equal and sets EAX to 00 if they are equal. It's just a flag to tell the program wether you entered a good serial or not later on.

disassemble the program and look at the code below GetVolumeInformation, it's only about 5 lines long and try to understand it.

Keep learning

goatass
JaneK
11-03-2000, 05:50 PM
Hi goatass and others,
Being sort of encoureged by your reply I decided to have closer look at this routine. This is what I found:

:0040C3FF mov eax, dword ptr [ebp-08]
- serial No. of my volume is put in eax.
:0040C402 xor edx, edx
- edx=0
:0040C404 mov ecx, 05F5E100
- 100.000.000 decimal is put in ecx
:0040C409 div ecx
- divide volume’s serial no. by content of ecx, in my case (in decimal) 994.188.286 : 100.000.000=9,94188286. From this result 9 goes to eax and 94188286 goes to edx (in sice corresponding hex values can be seen inside the registers).
:0040C40B mov dword ptr [ebp-08], edx
- put edx to where volume’s serial no. was before.
:0040C40E mov eax, dword ptr [ebp-08]
- and move this value to eax.
:0040C411 cdq
- convert dword in eax to signed quadword in edx:eax. As a result this instruction assigns dividend for idiv instruction below (eax=94188286 d) and brings edx to zero (because eax is positive).
:0040C412 mov ecx, 00000003
- move 3 to ecx (assign divisor to ecx)
:0040C417 idiv ecx
- divide two signed values so divide eax by ecx (94188286:3=31396095,33)
From this result the quotient (31396095) goes to eax and the remainder to edx)
:0040C419 add eax, 00001E35
- add 31396095+7733 (that is 1E35 hex) = 31403828= GOOD SERIAL in eax
:0040C41E mov edx, dword ptr [ebp-0C]
:0040C421 xor ecx, ecx
- ecx=0
:0040C423 cmp dword ptr [edx+00000420], eax
- compare my serial with the good one.

Well, that’s what I managed to find out. I had to use asm book a lot to see what each instruction does but at the end everything started to make sense. Will be nice if you (or another reverser) can comment on this.

Thanks
JaneK
goatass
11-04-2000, 12:18 AM
JaneK, I'm glad that you found my comments encoureging and spent the time figuring out the algorithm and in the process you learned some assembly :)

One thing tho, in this case don't convert the values to decimal leave them in hex only the last and final value needs to be converted to decimal so you can type it into the registration box.

I have no other comments you did a great job, you found exactly what the algorithm does and you understand it.

great job
p.s. stay tuned for my post of a keygen.

goatass


Making progress...need a little asm clarification ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Making progress...need a little asm clarification ???
PDA

View Full Version : Making progress...need a little asm clarification ???

Clandestiny
11-02-2000, 08:33 PM
Hi guys,

I have sucessfully registered the moving pix application and I think I've *almost* decoded its registration checking algorithm, but one thing is puzzling me.

I examined the parameters being passed to the GetVolumeInformationA function (as per mentioned in an earlier hint, the address of the volume serial number appears to be the relevant piece of information here)and looked at the return values. Maybe I am misunderstanding the function, but according to my API reference, the GetVolumeInformation function returns either a true or false value depending on whether or not the information is retrieved. From this I thought it only returns a 0 or 1 and nothing else. The 1 is returned in eax and makes sense, but there also seem to be some other values being returned as I step over the function in SoftIce. The return values are...

eax = 1
ecx = FF
edx = 4006
ss = 006AF8FC --> 224912F3

I don't quite get why it returns these other values when the api reference says the function only returns a 0 or 1.

Nevertheless, the stack segment value returned in this function appears to be the important piece of information, for this address pointed to by the stack segment holds a value crucial to the key calculation.
Looking back at the parameters being passed into the function, this stack segment address corresponds to the address of the volume serial number. When I displayed the contents of this memory location before the function was called, there was no relevent info in this location, but after the funcion call it contains a key piece of information... I guess the function returns more than just a 0 or 1 ???

Also, maybe someone could provide a little more explanation on this function than my API reference has given me. I've cracked several serial # protections and have never come across this approach before. In fact, were it not for the hint about the GetVolumeInformation, I would have probably stumbled around in the code for quite a while before I figured it out. Is this a common scheme ? In other words, if you had not seen this approach before, what would alert you to this tactic. Is GetVolumeInformation a common api call for programs and what does a program use this information for (other than generating a serial)??? I think it would be important to understand its use in a general sense in order to be able to tell if such a call would be "suspicious".

As soon a someone clarifies the return values of this function a little more, I will try to code a key gen for it.

I don't wan't to give too much away about the algorithm so others may have a chance to play with it, but I will give a general piece of advice... It can never hurt to look at your inputs and other given information in both hex and decimal since most calculations are performed in hex in the computer. Translating your decimal values into hex can give some clues about the origin of certain values...once I realized this it clarified quite a lot.

Cheers,
Clandestiny
hz
11-02-2000, 10:11 PM
hi,
take another look at kayaker's post
. Re:A Couple of Questions ??? Part II
and you may see things a little clearer.
regards
hz
goatass
11-02-2000, 10:44 PM
Hi Clandestiny, you misunderstood the API reference...here is what it says:
The GetVolumeInformation function returns information about a file system and volume whose root directory is specified.

BOOL GetVolumeInformation(
LPCTSTR lpRootPathName, // address of root directory of the file system
LPTSTR lpVolumeNameBuffer, // address of name of the volume
DWORD nVolumeNameSize, // length of lpVolumeNameBuffer
LPDWORD lpVolumeSerialNumber, // address of volume serial number
LPDWORD lpMaximumComponentLength, // address of system's maximum filename length
LPDWORD lpFileSystemFlags, // address of file system flags
LPTSTR lpFileSystemNameBuffer, // address of name of file system
DWORD nFileSystemNameSize // length of lpFileSystemNameBuffer
);

The key algorithm uses the serial number of your hard drive lpVolumeSerialNumber
so you won't have a generic serial and it will differ from computer to computer.
You tried looking at the lpVolumeSerialNumber using the D command in SoftIce but if you look at the parameters above this variable is not a string so D won't give you much, it's declared as LPDWORD so what you want to do is use the ? command to look at it.
? eax will show you the Hex/Dec/Ascii values in that register. In this case the hard drive serial number returned from the API is in Hex and that's the value that the key algo uses.

Return Values
If all the requested information is retrieved, the return value is nonzero. This doesn't mean much in this case you just have to look at the variables that are pushed to the stack before the CALL and see what they get filled with after the CALL executes.

eax = 1
ecx = FF
edx = 4006
ss = 006AF8FC --> 224912F3
224912F3 is the serial number of your C:\ drive in Hex this is what's used to generate your serial number to register the program.
EAX=1 just means that all the information was retrieved successfuly.

hope that gave you some insight into what this API does.

goatass
Kayaker
11-02-2000, 11:03 PM
Hi Clandestiny,

I can see the light bulb above your head already beginning to brighten ;)

As you figured out, one of the parameter types passed to an API function before the call, besides constants, variables, etc. needed for the function, can simply be blank address locations which will be filled with some information on return.

The "Return Value" of zero or non-zero may simply be an error check of whether the call succeeded or not, as in this case. But for example, in the case of CreateFileA, which is used to create or open, among other things a file for reading, the Return Value will be a new open handle (Hwnd) to the file, if the call is successful.

As for how you would "know" that GetVolumeInformationA was used here, well, unless Goatass pulled that bit of info out of his...er, hat, then he either made a shrewd guess as to what generated that number that comes up in the reg box, or he used an API monitor to confirm it.

Hope this helps a bit.
goatass
11-03-2000, 10:45 AM
HI Kayaker,
I didn't pull anything out of my ... I simply traced the program and saw where the key was generated and I saw that GetVolumeInformation was used in the key generation algorithm, it's pretty simple and there is no need for an API monitor.
All you have to do is set a BPX GetDlgItemTextA, enter a serial and start tracing until you get to where GetVolumeInformation is called and see what it does.

When a program does calculations on a returned value from an API in a keygen algorithm you can be pretty sure it's gonna have something to do with the final serial number, there is no need to guess anything.

goatass
Kayaker
11-03-2000, 05:01 PM
Hiya goatass,

I was just kidding about you pulling ideas out of...wherever ;) My reply was more just to stress the usefulness of an API monitor in giving clues to a protection scheme, as well as to getting a feel for the overall program flow, without using SoftIce. Of course the tried and true method of tracing the s/n can work just as well in some situations.

I haven't actually traced the program yet, but I'm curious about the Kernel32 API logs. GetVolumeInformationA is actually called twice, once at 0040C3F9 and once at 004225A8. After the 1st calling there are many calls to QueryPerformanceCounter and after the 2nd calling many calls to GetTickCount. I'm wondering what's actually going on here. Are both GetVolumeInformationA calls being used in the protection scheme? If not, why is the 2nd one called? And what are QueryPerformanceCounter and GetTickCount doing? I've seen GetTickCount being used before to transfer a random value into a CMP routine in order to make it fail, if a previous check on s/n validity also failed. I think there's other ways to use GetTickCount in protections as well (would make a good random seed generator).

As for QueryPerformanceCounter, I've never seen it being used before. Perhaps this might make a good advanced Task. What ARE these weird calls doing, even if they're not part of the specific protection algorithm itself? This might give a bigger picture of how the program actually works.

Can anyone come up with some other good intermediate/advanced Tasks for this program? How about patching it so that it writes lpVolumeSerialNumber to the ini file rather than the s/n you input? From a quick look at the code it seems that your hex s/n is transferred from [EBP-80] into a register before WritePrivateProfileStringA is called and code could be changed to point to the address containing your VolumeSerialNumber instead.

Just some ideas.

Regards,

Kayaker
Clandestiny
11-03-2000, 09:46 PM
Thanks for the input guys :-)

I think I figured out where my thinking was going wrong...I was looking at the function prototype and seeing that it should only return one value while *completely* forgeting that half of my parameters being pushed on the stack are pass by reference values (ie addresses whose contents may be changed during the course of the function). It is just amazing how many times I confuse myself on these concepts when I try to apply them to assembly !

Thanks to all for your patient help :-)

Cheers,
Clandestiny
goatass
11-04-2000, 12:09 AM
Kayaker my friend you are making this waaaaaay too complicated, I have no clue what that second call to GetVolumeInformation does but it has NOTHING to do with the key algo and neither do the other APIs you mentioned. Check out the program and you will see it's sooo simple. This is a newbies project, I made sure there is nothing complicated in it.

goatass
Kayaker
11-04-2000, 03:46 AM
Sorry goatass, I'm only trying to encourage people to think 'outside of the box'. Yes, I know it's simple, I looked at it, and it's a fine introduction to a s/n trace/algorithm/keygen and you've done a great job kicking off this Project area.

Maybe I shouldn't be bringing these things up in a Newbie project, but I figured some may want to extend the challenge beyond the "Yahoo, it's registered" concept. I know the initial lessons are important and dealing with protection schemes are the easiest way to go, but I for one would like to see the attitude develop that this is only one part of Reverse Engineering. There's no reason why we can't go beyond what one of a thousand other tuts already teach. There's a multitude of other interesting things to be learned from the rest of a program's code and certainly other opportunities for reversing, limited only by imagination.

In no way does this mean excluding or leaving behind the Newbie of any level, far from it. That's the last thing we should be trying to do. I just don't want to see "the Crack" being the ultimate narrow goal. I don't have all the answers. I consider myself a Newbie learning by the seat of his pants as much as anyone. But I figure we have a great chance here for a "new beginning" if you will and I'm sure if we tried we could develop a true Reversing community we'd be proud to part of. I know that sounds really corny and I don't know if it's even truly feasible, but I think it would be a nice goal to strive for. I'm not criticizing please understand, just trying to get across my thoughts.

Signing off,

Kayaker


Guided steps for newbies(And my findings, all in a thread)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Guided steps for newbies(And my findings, all in a thread)
PDA

View Full Version : Guided steps for newbies(And my findings, all in a thread)

ThRaX
11-02-2000, 10:36 PM
Kay I believe most of you have registered the program, and many of you have found the algorythm, but anyway, here are some steps for a newbie to follow to eventually get down to the kill.

First, sniff out the program using regmon/filemon and your eyes. Find out what sort of protection it uses (serial, keyfiles, etc.) Key things to look for is where the program stores its information, and what speciffic entries are useful to us.

Next, before going into the code, use API Mon to find out what APIs are used when we hit "Register". Set a breakpoint on anything interesting you find here, and then see if you get any breaks in soft Ice

You should get a break on one of them. When you do, trace through it. Look for any jumps etc. You may be able to simply 'sniff' your serial out in this fashion, but go back for another look. If you dont see how any of this relates to an algorythm, do the following.

Convert your 'serial number' that you got with the program into HEX (calculator that came with windows). WRite this down. Then convert your phony reg code to HEX,and write it down. Now go through the code in SoftICE again, this time looking for those HEX values. Take careful note of any operations done tot hem. You should have no trouble finding the algorythm in this way...ANd remember, a dead listing helps.

hope this helps anyone whos stuck (though no one probably is anywya)

--ThRaX
goatass
11-02-2000, 10:57 PM
Hi ThRaX, those steps should help newbies I just wanted to add something to the last step. Instead of converting your serial to Hex and searching for it that way you can use the search command in SoftIce:
s 0 l ffffffff "12121212" <-- that's the made up serial you used
s = search, 0=starting point, l=length, ffffffff=length of ffffffff, "12121212"=you serial number or whatever you are looking for
now if the address that it finds it in is way out of the range that the program is loaded into then it wasn't found.
Example: program started at 401000, doing a search and it founded it in C89354 that is way out of our program's range so it's not what we are looking for. If it had found it in 432012 (or something like that) thent that would be what we are looking for and you could set a BPM 432012 (Break Point on Memory) so if the program reads or writes to this memory address you SoftIce will break.

goatass
?ferret
11-03-2000, 06:23 PM
Just a quick note....

Use single quotes for the search string ;-)

s 0 l ffffffff '12121212'

Sorry Goatass, most of us will know what you meant, but just in case hehe
?ferret
11-03-2000, 06:25 PM
hmm...what happened there? LOL
?ferret
11-03-2000, 06:26 PM
OK LMAO, the board doesn't like to print single quotes...but softice likes to use 'em
goatass
11-04-2000, 12:11 AM
?ferret not that it matters but the search function works just fine with either single quote(' ') and with double quotes (" ")

goatass
?ferret
11-04-2000, 10:41 PM
hmmmm....ok, I seem to remember having troubles with trying regular quotes at one time, but it may have just been the version of sice or something (maybe the user, who knows? hehe)


Yipppeee!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Yipppeee!
PDA

View Full Version : Yipppeee!

mersenne_
11-02-2000, 11:25 PM
Hi all,

Have checked out the program and determined what it does with the volume serial it retrieves (finally :) ). Also found out what happens to the serial we need to enter and just for kicks what the significance of the number posted by the program at the top of the register screen. Jeez, they make it easy for themselves, don't they ;)

Anyway, thanks for getting us started Goatass and if anyone needs some help just sing out and I'll happily share what I think is happening.

Cheers
mersenne
goatass
11-03-2000, 10:49 AM
Hi mersenne_,
I'm glad to see that you understand how the algorithm works :)
Here is another little challange for you if you want it. Write a keygen for this program, use any languge you want. If you need any help with just ask.

Keygen will prove to yourself that you truely understand what this algorithm does.

goatass


Asm function: Hex to Decimal ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Asm function: Hex to Decimal ?
PDA

View Full Version : Asm function: Hex to Decimal ?

Clandestiny
11-04-2000, 01:42 PM
Hi,

I am working on coding a key gen for Moving Pix now that I understand the algorithm. It is actually my *first* attempt at a Win32 asm program and I am outputting the key in a MessageBox. My keygen is actually working *beautifully* with one small problem...the output to my MessageBox is in hex and the output key needs to be in decimal. I have looked everywhere for some library function that would convert hex to decimal (with no success). I finally decided to write a function myself, but it is still outputting the results of all of my calculations in hex. The GetVolumeInformationA function returns the serial in hex and all I need to be able to do is convert it to decimal. Surely, this can't be very difficult. Are there any functions for this purpose ???

Thx,
Clandestiny
hz
11-04-2000, 02:27 PM
hi,
As I recall, wsprintf will do it.
regards
hz
goatass
11-04-2000, 03:13 PM
Here is what I use:

szKey db 13 dup(?)
eax = the hex value the program calculated

invoke dwtoa, eax, ADDR szKey

and then: invoke SetDlgItemText,hWnd,IDC_KEY,ADDR szKey
will put the decimal value into a text box.

goatass
ThRaX
11-04-2000, 06:05 PM
dwtoa? what does that do? If that makes an ascii string out of a hex value like i think it does, that would have saved me a LONG time on my keygen...lol
goatass
11-04-2000, 06:23 PM
dwtoa = DWord To Ascii (I think) :)

goatass
ThRaX
11-05-2000, 10:41 AM
Hmmm...goatass, say that the dword was the hex value 4C12A145, right? than wouldnt dwtoa (dword to ascii) simply make the string "4C12A145"? There would have to be some intermediate step to convert 4C12A145 to its dec. equivilant, 1276289349....then, the string "1276289349" would be created...Or does the dwtoa function already cover that? (hex to dec, to the ascii string of the dec value)?
hz
11-05-2000, 11:02 AM
hi,
yes dwtoa does handle the conversion as
does wsprintf which is more flexible, come on guys, you really should be testing these things out for yourself if you want to learn.

regards
hz


Project ideas -Feedback plz-
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Project ideas -Feedback plz-
PDA

View Full Version : Project ideas -Feedback plz-

raldnor
11-04-2000, 02:42 PM
Hey all!

It's great to see the activity on this forum!

I've got some ideas regaarding this board I'd like to share with you and receive some feedback...
IMHO creating keygens is for the intermediate/advanced since it involves some assembly experience.
I myself (still a newbie) started reversing by creating patches. This means first creating a dead listing from a program by using W32Dasm, search for some obvious strings and tracing the code until a good-guy/bad-guy jump is reached.

What I'd like to do is to create for each project three different threads:
1st thread - Project information like the goal, where to get it and tools.
2nd thread - Patching tips, hints and solutions
3rd thread - Keygenning/Serial sniffing tips jhints and solutions.

This way requirements of the targets are:
- It has to use a serial (for keygenning)
- It needs to be small (!)
- No compression
- No SMC (self-modifying code)
- Preferably a single file

Please let me know what ya all think of this :)

Cheers,

RalDnoR.

b.t.w thanks for all the positive feedback!
goatass
11-04-2000, 03:19 PM
raldnor, I think those are good ideas. I think that you should put out a project and give some basic information on what it does and how to get started. Then let people play around with it, if people come back and say "I'm lost what do I do" than we give out some more details on how to get to the protection code. Once a patch is made and people understand how it was done we should move to the next level and maybe show how to sniff out a serial number and then move to the last step keygenning the program. Newbies need to learn assembly sometimes why not make people learn it the fun why by coding in it instead of reading about it for days and then forgetting everything by the time you actually have to use it.

I'm gonna start looking for new programs that could be good for newbies.

Please let me know what you thought about the Moving Picture project, was it hard, about right, too easy ?

goatass
hz
11-04-2000, 03:35 PM
hi,

First thanks your efforts. In general it probably is better to know
assembler for keygens. My last (not difficult) keymaker for Netpal and
CookiePal are Qbasic, I could have done them in c, pascal or assembler but
the temptation is to just cut, "borrow" the procs from the target and paste
them into your "keymaker". Personally I would like to see something on keyfiles, those litle encrypted registration files some progs write out or maybe something thats writes a flag into an unexpected place in the registry. I don't like patching unless its absolutely necessary, it may
appear the patch is perfect and then ages later up pops some problem. I've also seen some essays on patching where a valid s/n could obtained more simply than the patch. Having said that I can suggest a couple of progs if all you are looking for is simple flag patching to eliminate nags.

regards
hz

PS
the first project was to easy, the code could easily be calculated on
a calculator.
ThRaX
11-04-2000, 06:07 PM
good idea, just one little tweak:

Have another thread for just program information ---not like tools and stuff, but rather information about the program's protection, i.e. key files, algorythms, registry entries, and how to find these things...
goatass
11-04-2000, 06:22 PM
Keyfiles are a good project but 99% of them are difficult for newbies you have to have a good knowledge in assembly in order to understand the encryption/decryption routines used on these keyfiles...I will keep my eyes open for a program that uses an easy implementation of a keyfile, if not I'll write one.

goatass
Clandestiny
11-04-2000, 06:30 PM
Hi Raldnor, goatass, other reversers...

I thought the Moving Pix target was a good choice. I definately learned something since I had never seen the GetVolumeInformationA call used in a serial calculation and the key was also quite easy to generate which IMHO made it a very good choice for a first keygen. I understand where Raldnor is coming from about keeping it simple, but there is also something to be said about keeping the level just a little high so we have to reach for it :-)

I am a newbie myself and would certainly hope that a chosen target would not rely on anti-sice tricks, packing, self-modifying code or other advanced topics which are yet beyond me, but I would like to see some more serial protections that use something unique (like the volume serial #) in their implementation. This enables us newbies to begin to think "outside the box" and gain experience which will lead us on to a more intermediate reversing level. I don't see simple asm (like this small key algorithm we just cracked) as being a problem. Coding a simple key gen like this really does help to put things in perspective. Book or classroom knowledge about the topic just does not cut it. IMO, eventually you just have to dive in! And besides, a certain level of basic asm will eventually be required for newbies wishing to tackle more intermediate reversing tasks.

Keep up the good work guys...

Cheers,
Clandestiny
InOverMyHead
11-04-2000, 07:27 PM
If this board is for Newbies, please let it be as such! Myself and perhaps others, don't know all of the functions to set a bpx on or better yet, how to locate the one that is really needed. All of the tut's I have read, including this project, give you the bpx to work with. I know it's not magic - at least I don't think it is. I would like to see ALL the steps, if possible, that you go thru to arrive at your starting point.

If I am asking for something too simple, something you are not willing to do, or something that was not your intent in starting this group, I will understand completely.

I believe RCE is kind of like the saying:
Give a man a fish and he will eat. Give a man a fishing pole and he will learn to fish.

Thanks!!!
?ferret
11-04-2000, 10:29 PM
Get an API reference and study it a bit.

Many of the API's also do as they sound...

i.e. GetDlgItemText = Get Dialog Item Text
that's the 16 bit version...32 bit is GetDlgItemTextA

Hence, when filling in an edit box, and you wish o break when it gets read, GetDlgItemTextA or GetWindowTextA are usually good choices.

Sometimes you stumble around in the dark for awhile, but experience more than explanation is the biggest help on this matter. Many times there are different API's that do similar things, different compiilers may use different ones for same task, but you can usually narrow it down to a few using logic and try them.

I repeat the 1st point....get an API reference (an API monitor may be of some help too, then you can see what functions the program uses)
goatass
11-04-2000, 11:15 PM
The way I see it is that many of the newbies these days don't bother to take the time to read and learn assembly and how to use our tools. All they want is to be able to crack from the second they download the tools. It doesn't work this way, we are dealing with a brand new language and therefore you must read everything you can find about it so you could understand what you are looking at.
When we say put a BPX on this API we assume that you read SoftIce manual and you know how to use it a little bit and know what a BPX is and what an API is. We can't teach you every single thing, you have to do some of the learning by yourself this way you will remember it better. If there is something you don't understand or can't find any good information about go ahead and ask but when you ask things that can be easily learned just by reading a small paper or manual we will not answer because you did not take the time to find and read the information yourself therefore we will not waste our time explaining it. We were newbies too and we know what's out there, we know what's easy and what's hard to find.

This is not directed to anyone in particular just a general newbie comment.

goatass
JaneK
11-05-2000, 08:24 AM
Hi,
Just few comments from my side (someone new to this stuff):

1. The project was easy but not too easy e.g. before the bpoint GetVolumeInformation was posted I had problems to locate the serial calculating routine.
2. I am not interested in finding which jumps to change to have the prog registered but rather to gain the basic knowledge that will let me understand how protections (and software in general) work (so no “quick cracking of recently downloaded apps”).
3. Who is a newbie? Obviouslly there are different levels of being a newbie and surely some knowledge is required. It’s up to moderators to decide what kind of project will suit biggest audience.
4. A question comes to my mind re. keygens (don’t forget I am new :). What is the point of writting keygens? What is has to do with reversing? Is it not more a programming exercise? I mean once protection routine has been located and understood, any programmer can make working app out of it.

These are only some very general thoughts of mine. I understand very well that my point of view is only mine and for others writing a keygen can be the most exciting part of it. Would be nice therefore if the new project will be broad enough to make every participant “happy”.

Thanks
JaneK
mersenne
11-05-2000, 05:23 PM
Hi,
I have some comments on a few of the posts.

I think JaneK hit the nail on the head. There are various classes of newbie and all will see the goals of the project differently, so it becomes a matter of trying to please most of the people most of the time. I don't think this is difficult though if an open-ended questioning approach is used. This is basically what raldnor suggested with his first post and I agree with that concept. There is nothing preventing anyone taking the project as far as they want or only going as far as they want. For example, for this last project I am going to try and take it a step further and modfiy the exisiting code to show the correct serial for you to enter. Why? No reason except to learn how the program functions and what I can do with it. Now it may take me weeks to do this, but I get something out of it.

I am one of those people that has to actually do it to learn. I read many essays before I attempted to make a keygen (this program will be my second) in assembly but I actually learnt more from diving in and doing it. And yes it does take time. Time thinking, time trying and time hoping something will work :)

I think that what has been suggested will work fine, it will be up to each individual to determine what and how much they get out of it.

Cheers
Mersenne
?ferret
11-05-2000, 07:30 PM
Mersenne,

Congrats on wanting to take the project a step further, that's the type of attitude I like to see on this forum! Never stop learning.

If you need a few tips on how to go about this, I did the very same thing to Winzip a while back. I have a tutorial on it at qferret.cjb.net. It probably won't be a step by step conversion, but it may give an idea or 3 on how to proceed ;-)

As for the point of keygens, you have to understand every line of the algo routine to get it to work properly, so it is definitely a reversing exercise. But yes it is ALSO a coding exercise. Reversing is far easier if you can program in at least one language, so you at least know a bit of how programs work. For me it's a circle (gain cracking knowledge-> learn a bit about programming, learn a bit about programming->gain a little insight into cracking ...etc.) ;-)


Here is the keygen code for Moving Picture
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Here is the keygen code for Moving Picture
PDA

View Full Version : Here is the keygen code for Moving Picture

goatass
11-04-2000, 03:28 PM
Hi everybody, it's been a couple weeks since we started this project and since then all of the people that participated managed to register the program. Here is the code for the keygen written in MASM.

.data
szDrive db "C:\",0
szBuffer dd 0
szCaption db "Moving Picture - KeyGen by Goatass"

.data?
szKey db 10 dup(?) ;an array of characters

.code
start:

;int 3 ;my personal break point for testing

invoke GetVolumeInformationA, addr szDrive, NULL, NULL, addr szBuffer, NULL, NULL, NULL, NULL
mov eax, dword ptr [szBuffer] ;saves the returned serial number of my C: drive
xor edx, edx ;all this code was taken out of the actual program
mov ecx, 5f5e100h
div ecx
mov eax, edx

cdq
mov ecx, 03h
idiv ecx
add eax, 1e35h

invoke dwtoa, eax, ADDR szKey ;converts the Hex value to decimal
invoke MessageBox,NULL,ADDR szKey, ADDR szCaption, MB_OK ;shows the serial number

This is it, very simple, I only showed the keygen code I didn't show any of the non-relevant code that goes along with an ASM program. If you want the full code e-mail me and I'll send it to you.

goatass
e-nigma
11-16-2000, 01:25 AM
Hi!
While compiling this asm file, the compiler returned an error message;

invoke dwtoa, eax, ADDR szKey ;converts the Hex value to decimal

it didn't understand "dwtoa" is and neither do I?
I think you miss typed the word?

thanks
e-nigma
?ferret
11-16-2000, 09:02 PM
dwtoa...DWord To Ascii (I believe)....Are you using MASM or TASM?
ThRaX
11-16-2000, 09:28 PM
You gotta include the m32.inc, and m32.lib files I believe...They c ome with MASM32
e-nigma
11-17-2000, 09:32 AM
after including masm32.inc and .lib file. It worked.
dwtoa is defined in the file.

thanks,
e-nigma

____________________
The One Who Ask Remains Fool For 5 Minutes,
The One Who Doesn't Ask Remain Fool Forever. - A Chinese Proverb


Win32ASM keygen!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Win32ASM keygen!
PDA

View Full Version : Win32ASM keygen!

ThRaX
11-04-2000, 06:02 PM
Hey, heres a win32asm keygen...its not very good, in that it if you type in letters/strange characters for your sn which it uses to generate your reg code, its not gonna stop you, and it gives the rec code in a msg box rather than an edit box...Oh well, here it is
goatass
11-04-2000, 06:19 PM
Sorry to tell you this but the key algorithm DOES NOT care about what serial number you entered....look at the code for my keygen that I posted and that should explain what the algo does.

goatass
ThRaX
11-05-2000, 10:33 AM
Nono, I'm talking about the serial number that you get with the program

LIke when you press 'register', in that dialog there is a greyed out box that sayts 'Serial'...

and "Serial" is NOT the same as "Reg Code" in this program...sorry if that wasn't clear
goatass
11-06-2000, 10:52 AM
Oh ok now I get what you are talking about. Well what that is is the serial number that the program generates once it calls the GetVolumeInformation. This number is unique for each computer. What my keygen does is instead of asking the user to enter that serial number and then genrate a key I use the GetVolumeInformation API and generate the serial number myself and then modify it to generate the real key that you would enter into the box.

I don't remeber exactly but if you look at the serial number that the program shows you I think it's the same as the one returned from the GetVolumeInformation API just converted to Decimal.

goatass


Little project for newbies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Little project for newbies
PDA

View Full Version : Little project for newbies

Timmy
11-06-2000, 05:35 PM
I have been cracking for a while but have only recently been using packed progs. I was having a problem with a prog and needed a dead listing to see if I could sort it out. The prog is Quicksilver from ht*p://quicksilver.skuz.net/. With no experience of packed progs it didn't take me long to unpack it and get a dead listing with WDASM32. There is no serial or anything (the prog is freeware) but I just thought it might help getting newbies started with a simple unpacking exercise.
goatass
11-06-2000, 05:43 PM
Hi Timmy, I don't think packed programs are suitable for newbies doesn't matter if it's hard or not. The purpose of these projects is to learn how basic protections work and how to use our tools to reverse them. With a packed program you either use a util to unpack it and than you didn't learn a damn thing, or if you unpack it manualy it involves too many new ideas that newbies should not be confused with just yet.

goatass
Timmy
11-06-2000, 06:21 PM
No probs, I totally understand where you are coming from. I just thought that there are "new" newbies and then there are slightly more experienced newbies etc. and there doesn't seem to be anything with thread specific help for the people that want to progress a little further.
Kayaker
11-06-2000, 09:05 PM
Hi Timmy,

Why don't you post your findings anyway on the Newbies Forum? I'm sure a lot of people would like to get their feet wet with unpacking. You could simply post a few hints or teasers to get them started and if there are any questions, I'm sure they could stay within the same thread so as not to mess up the Board too much.

While there may not be a "thread-specific" forum for more involved RE concepts there's no reason why we can't make the best of it and at least present the information. Then at least those who are interested could benefit from the examples and comments and your good idea won't be lost. The more contributions, feedback and discussions there are the better it is for everyone.

Every little bit helps. Go For It ;)

Cheers,

Kayaker


Merak Mail-great project! (feedback from moderators please!)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Merak Mail-great project! (feedback from moderators please!)
PDA

View Full Version : Merak Mail-great project! (feedback from moderators please!)

ThRaX
11-06-2000, 08:42 PM
Looking at the newbie forum, I read a post by Red_Ant about "Merak Mail"...ANd looking at it, it seems like it would make an EXCELLENT project---moderaters, if you think this would be good, then what are we waiting for lets get started...else we should start to look for something else. i think that the "MovingPix" project is more or less finished...THough we could write an essay of some sort about it...
esther
11-07-2000, 05:31 AM
Hi Thrax,
This prog is a hard one,crc checks,
sice anti-debug techniques,disabled Api monitors and serial lic.I have try to reverse
it but no avail :( .not easy for newbies,but you guys can try to help.

regards
esther
esther
11-07-2000, 07:53 AM
Sorry,one more thing limited functions,hehe
8PPP
regards
esther
latigo
11-07-2000, 01:41 PM
im on it!
I think that this one will be a good RE project :)
RalDnoR
11-07-2000, 03:48 PM
Hey ThRax!

Thanks for the suggestion, but I think it's too difficult for newbies. I think there are many essays dealing with programs like this.
I myself think it's better to use programs which have one way of protection and digging it out and explain the inner workings in very simple language.

Thanks for the suggestion though and keep up the good work!
Maybe it's an idea to create another forum for the intermediate and post programs like this in it?

Cheers,

RalDnoR.
ReD_AnT
11-08-2000, 01:04 AM
Hi Friends,

Thrax, u did what I was just thinking about. ie posting this target as a project on this project's board. Thanks. ;)

Hey Esther no reply to my post on the forum... what happened?

Latigo, any suggestions/hints etc. or should I expect a tutorial when u finish?

Raldnor, nice work man. Your site is very good too.
You said there are tuts for targets like this. Can u please point me to some....

Regards.

ReD_AnT
Kayaker
11-08-2000, 01:29 AM
Better check my recent post on the Newbies Forum before you get into this one... ;)
RalDnoR.
11-08-2000, 02:30 AM
Hi ReD_AnT!

Hmmzzz, It seems I made a mistake... I checked a couple of sites listed on neworder.box.sk and I can't find any tuts on more difficult targets with multiple protections...
I know they exist though, caus I've seen them on the RCE-cd. You can 'order' a copy of the RCE-cd via +Sandman. There are many, many tutorials on it...

Hope this helps!
goatass
11-08-2000, 07:48 AM
You guys are forgeting that this is not just a project forum, it's a Newbies project forum so that Merak Mail is not suitable to newbies.

goatass


New project: Magic File Renamer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > New project: Magic File Renamer
PDA

View Full Version : New project: Magic File Renamer

RalDnoR
11-07-2000, 03:59 PM
Hi all!

Let me introduce a new small program for your reversing pleasure :)
The target will be Magic File Renamer 4.0. It's a very usefull util to rename files in hundreds of different ways.
You can grab it here: ht*p://doodu.tripod.com/MFR400.zip.

First of all, the program is very small. It can be disassembled by W32Dasm without the need of unpacking it.

I'll give you a few hints:
- The registration is done from the 'File'-menu -> Register
- The validation is done while characters are typed in the boxes.
- The program is written in Delphi, so you can use DeDe (Delphi Decompiler from the Millenium Group) to discover more about the app (get it here: ftp://ftp.balbaro.com/dede/dede242.zip)

Let's first try to patch it in a way that it accepts any serial, then try to create a keygen for it.

Good luck and please use the appropiate topics for replies.

Once the project is finished I will create an essay about it.

Cheers,

RalDnoR.
Kayaker
11-07-2000, 04:22 PM
Nice choice RalDnoR. A classic Delphi protection ;)

Kayaker
hz
11-07-2000, 06:24 PM
hi,
sorry I disagree, its a 1 minute crack and
a two minute keygen. Why another keymaker?.
regards
hz
hz
11-07-2000, 06:34 PM
hi,
Just want to apologise for my earlier post,
it is easy, but that was a negative response to you hard work.
regards
hz
RalDnoR.
11-08-2000, 01:16 AM
Hi Hz!

Doesn't matter dude! Just regard this program as a target for the uninitiated :)
Anyway, I think this target might be hard for complete newbies. There will be other targets more complex but this is a nice example of one of many shareware apps with easy protections.

Cheers,

RalDnoR.
goatass
11-08-2000, 07:53 AM
Great choice for a project, I think it's a good idea to show newbies some programs written in other languages since they will see them sooner or later. Also I'm glad you decided to let people try to keygen this. I think by making newbies write keygens on their first cracks is important this way they don't just blind patch everything in sight until something works, they will actually understand how the protection works which will make them much better crackers.

Keygens are for the elite, we are helping start the next generation of elite crackers.

goatass
MGJ
11-16-2000, 01:10 PM
I think that it was a great idea. I am, for example, an absolute newbie and I think that the problems like this one are the best way how to learn....

thanx RalDnoR


Magic File Renamer Patching tips and solutions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Magic File Renamer Patching tips and solutions
PDA

View Full Version : Magic File Renamer Patching tips and solutions

RalDnoR
11-07-2000, 04:01 PM
Please post all you experiences on patching MFR into this area...

Thanks!
Raven58
11-08-2000, 03:02 PM
Looked to patch at 004a8170, 742b, JE, 004a819d, offset a7570. Changed to JNE 752b with no effect, than nopped with same result. Working above string ref. "Thank You for registering Magic". Ran filemon and regmon before opening , found nothing. also looked at a .ini file in the MFR folder. So now I will look again. As you can tell I am a real newbie and somewhat embarrased by this post. But then again I am here to learn.
hz
11-08-2000, 03:48 PM
hi,
don't really know if I should be saying this but you are off track with the .ini and registry.
regards
hz
Timmy
11-08-2000, 04:54 PM
The procedure you're looking for starts at cs:004a8378. Trace this with F10 (you don't really have to step into any of the calls in this subroutine until you are ready to work out how the code is generated) when there is a call instruction, look at the register values before the call and also what is being pushed onto the stack. - ie. if the value in eax is pushed before a call do a d eax and see what it points to. Also after the call see what values are returned (eg. d(bp+?) might point to something, if it doesn't the (bp+?) address might contain another address that contains relevant data).
ThRaX
11-08-2000, 08:37 PM
see my problem here is i can't seem to break to the code in any way at all...i've tried all the breakpoints I know of, but nothin works...I've gotten a dead listing and gotten *somewhere* using only string data references and back tracing from there...
any tips on how to go about getting a break on the code somehow?
?ferret
11-08-2000, 09:08 PM
well, one way, since you're having a bit of trouble finding the right API, would be to break on a suspicious address from your dead listing (bpx CS:Address)
Kayaker
11-08-2000, 09:33 PM
Thrax,

If you can't find any suspicious addresses, HMEMCPY always works (MEMCPY I think for NT, but I wouldn't know anything about that).

Just keep hitting F12 until you return to program code. Remember that this app does its reg check realtime, so to speak, as you are entering your s/n, so HMEMCPY, or whatever good BP you set, will keep breaking until the proper conditions are met.

?ferret has the better idea though, you should be able to use Dede to scope out a good address breakpoint at the start of the reg routine.

Go with his suggestion, ignore almost all of what I've just said unless you're desperate ;)

Kayaker
ThRaX
11-08-2000, 10:06 PM
heh...i guess i'll just have to take your word for it...I'm on NT, and hmemcpy doesnt work...(and contrary to popular belief, based on my own observations, memcpy is *rarely* a replacement for it)...oh well i believe that i found another way ... i used dede and viewed the "SetRegisetered" function and it pointd me to that address anyway, lol...

thanks anyway
Timmy
11-09-2000, 03:28 PM
Can't understand why hmemcpy doesn't work for you, it did on my machine. I just clicked on file then register (the registration box appears), ctrl d into sice then bpx hmemcpy, F5 then when I enter a character in any of the edit boxes sice breaks. The same route but slight ly easier is to get the registration box on the screen and enter a name, company and a dummy code (enter 4 or 5 digits for the code), enter sice, bpx hmemcpy, F5 then enter 1 more digit in the code edit box and sice breaks. This way gives you longer strings to do a search on. Make sure the appropriate entry in winice.dat hasn't got a ";" in front of it.
ThRaX
11-09-2000, 03:46 PM
Hmemcpy is not GOING to work for me in any way---I'm on windows NT as I said, and hmemcpy doesnt work on NT....doesnt have anything to do with how im trying to use it...(hmemcpy isnt a valid function, its coded into the 16 bit part of the win9x operating system, and winnt is totlaly 32bit, therefor no hmemcpy...or something like that, i'mnot really sure about the details)...

cya
Timmy
11-09-2000, 04:49 PM
Try this then ...
get the registration box up and enter name company and code, ctrl d then bpx callwindowproca, an F11 or 2 later you should be at c:00434e57 (this is where bpx hmemcpy returns you to in win98). I think this should work because the a at the end of callwindowproca means it is 32 bit.
Clandestiny
11-09-2000, 08:00 PM
Hi guys,

I have registered Magic File Renamer. I found both the valid # and the place to patch (which I have tested in SICE). I'll admit, I was a little perplexed on how to break into the code at first. Finally, I used ?ferrets suggestion of breaking on a suspicious address from my dead listing which landed me right smack in the middle of the protection.
It's the first time I have ever used Dede and the layout is really quite...I mean you really can't give the cracker any more hints than a nice procedure labled 'register' and references to 'name'and 'code'...hehe.

Cheers,
Clandestiny
mersenne
11-10-2000, 12:52 AM
Hi Clandestiny,

Did you make the patch with a hexeditor and then check you've got it right? I also have found the place where the valid serial is calculated and where the comparison between that and the entered serial is made. I too can make the program become registered using SIce at this point, HOWEVER, when I make the patch permanent it doesn't work.

I think I'm slowly zeroing in on it. So will keep at it.

Later
Mersenne
Raven58
11-10-2000, 09:37 AM
Wow, I must be out in left field here. Everyone using sice and me trying to patch with wdasm and hiew as I thought that was the first part of this project. Anyway, still playing above Strg ref. "Thank you for reistering" i wdasm. It appears that if 004a8170 is changed to JNE we get to 004a819d. There are than around 5 calls before we drop below and into the good boy routine. I thought I might nop these 5 calls, but haven't got to it as yet. Am I on the right track here using wdasm? Suggestions appreciated.
goatass
11-10-2000, 10:23 AM
Hi everybody, I'm happy to see people are enjoying this new project.
From what I've read on previous posts, people are setting BPX HMEMCPY when they are entering the serial to see what happens well that's good too but here something else to try.
First of all this is a delphi program so I used DeDe to decompile it, Clicking on the "Procedures" tab we see some names and the last one is Register...ummm interesting. We click it to see it's events, now look carefully, don't just to conclusions right away, do you see something interesting in there ? NO NO NO I'm not talking about SerRegistered, I'm talking about ebNameChange what this tells us is that something is gonna happen to our name as we enter characters in to the program. That is interesting so we double click on ebNameChange and we see the disassembly we start looking at 4A83A8.
The first call gets our name, the second moves it to another location and checks to see if there is anything in that location (was the move successful), the third call gets the length of our name and check that it's no longer than 60 characters.
Now comes the really fun part, see all those characters MOVed to EDX before the CALL at 4A83DA what do you suppose it's gonna do with that. Well it does something I didn't look at it yet, but after that call there is another one and when that one returns from whatever it does (you have to figure that one out, I won't tell u everything) you will see your real serial in EAX. Than in the CALL at 4A83FD is where your serial gets compared with the real one.

I'm gonna write a keygen in a few minutes so I'll have that posted when I'm done.

goatass
Timmy
11-10-2000, 11:32 AM
Well here is my 2 pence worth. A unit written in er.. Delphi. Enjoy.

unit Unit1;

interface

uses
Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
StdCtrls;

type
TForm1 = class(TForm)
Edit1: TEdit;
Edit2: TEdit;
Edit3: TEdit;
Label1: TLabel;
Label2: TLabel;
Label3: TLabel;
Label4: TLabel;
procedure Edit1Change(Sender: TObject);
procedure Edit2Change(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;

var
Form1: TForm1;
EncStr : string[$46] = 'lcjfvibb22vg45hdfk6456gff767hu56jjjjhjhu76574fgdjgfzhdfh67hjghfdh6667h';

implementation

{$R *.DFM}

procedure GenerateCode(Name,Company:string);
var
NandC : string;
PosNandC,
PosEncStr : byte;
Count,
Code : integer;
begin
NandC := Name + Company;
if (Name <> '') and (Company <> '') and (length(NandC) <= $46) then
begin
PosNandC := 1;
PosEncStr := 1;
Count := $46;
Code := 0;
While Count > 0 do
begin
Code := Code + ord(NandC[PosNandC]);
Code := Code xor (ord(EncStr[PosEncStr]) * $83);
Code := Code + PosEncStr;
Code := Code + PosNandC;
PosEncStr := PosEncStr + 1;
PosNandC := PosNandC + 1;
Count := Count - 1;
if PosNandC > length(NandC) then PosNandC := 1;
end;
Count := Code shl 4;
Code := Code + Count;
Form1.Edit3.text := inttostr(Code);
end;
end;

procedure TForm1.Edit1Change(Sender: TObject);
begin
GenerateCode(edit1.text,edit2.text);
end;

procedure TForm1.Edit2Change(Sender: TObject);
begin
GenerateCode(edit1.text,edit2.text);
end;

end.
stanks
11-10-2000, 01:08 PM
Hi!

This is our routine:

00491ABC 33D2 xor edx, edx
00491ABE 8AD3 mov dl, bl
00491AC0 0FB65417FF movzx edx, byte ptr [edi+edx-01] ; 1st char. of name+company
00491AC5 03F2 add esi, edx
00491AC7 33C0 xor eax, eax
00491AC9 8A442404 mov al, byte ptr [esp+04]
00491ACD 8B1424 mov edx, dword ptr [esp]
00491AD0 0FB65402FF movzx edx, byte ptr[edx+eax01] ;lcjfvibb22vg45hdfk6456gff767hu56jjjjhjhu76574fgdjgfzhdfh67hjghfdh6667h
00491AD5 69D283000000 imul edx, 00000083
00491ADB 33F2 xor esi, edx
00491ADD 03F0 add esi, eax
00491ADF 33C0 xor eax, eax
00491AE1 8AC3 mov al, bl
00491AE3 03F0 add esi, eax
00491AE5 43 inc ebx
00491AE6 8BC7 mov eax, edi
00491AE8 E8A324F7FF call 00403F90
00491AED 33D2 xor edx, edx
00491AEF 8AD3 mov dl, bl
00491AF1 3BC2 cmp eax, edx
00491AF3 7D02 jge 00491AF7
00491AF5 B301 mov bl, 01
00491AF7 FE442404 inc [esp+04]
00491AFB FE4C2405 dec [esp+05]
00491AFF 75BB jne 00491ABC

I will try to write this keygen in C.

greetz
pm
11-10-2000, 05:09 PM
Raven58 (11-09-2000 23:37):
Wow, I must be out in left field here. Everyone using sice and me trying to patch with wdasm and hiew as I thought that was the first part of this project. Anyway, still playing above Strg ref. "Thank you for reistering" i wdasm. It appears that if 004a8170 is changed to JNE we get to 004a819d. There are than around 5 calls before we drop below and into the good boy routine. I thought I might nop these 5 calls, but haven't got to it as yet. Am I on the right track here using wdasm? Suggestions appreciated.

Hi Raven58,

For the patching part is enough to use w32dasm, but is always better (at least for me is) to use Sice to understand whats going on, for example with the jumps. You can try to nop all that calls you mentioned, but it wont work. My tip is look a little further (backtrace)
and try to see the referenced call at 4a8406. Hope it helps.

pm
JaneK
11-10-2000, 05:24 PM
Hi,
How can I unregister the prog?

Thanks
JaneK
ThRaX
11-10-2000, 07:56 PM
Whoops, double post again lol...sorry
hz
11-10-2000, 07:57 PM
hi,
writes the registration to mfrdat.dat in the
system folder, just remove it.
regards
hz
hz
11-10-2000, 08:02 PM
hi,
writes the registration to mfrdat.dat in
the system folder, just remove it.
regards
hz
ThRaX
11-10-2000, 08:07 PM
Hey, stanks I seem to have found one small problem with the code segement you just gave...You're missing a small part that was on the end of the loop. (after it actualy)

I have posted what I believe to be the correct code snippet on the 'keygenning' thread, as I think we are getting a bit off the "patching" subject here, and this stuff is more keygen related...Please check it out I think the file i attached there is worht looking at for other newbies who need some help understanding the calc routine.

cya later
Timmy
11-10-2000, 08:19 PM
delete or rename the mfrdat.dat in windows\system
Timmy
11-10-2000, 08:32 PM
Forgive me if this gets posted twice (I have had a wet), just delete or rename MFRDAT.DAT in c:\widows\system\ and there you go.
hz
11-10-2000, 09:59 PM
hi,
remove the mfrdat.dat file from the system
folder.
regards
hz
goatass
11-10-2000, 11:29 PM
to unregister, just edit the mfr.INI file (it's the only INI file, don't remember the name) and find UserName= and delete your name from there leaving the UserName= in place also delete the Company value.

goatass
stanks
11-11-2000, 03:09 AM
Hi!

You only have to delete mfr.ini (it is in dir. where is exe file)

greetz
stanks
11-11-2000, 03:12 AM
Hi!

You only have to delete file called mfr.ini from directory where is our exe file.

Greetz
Lord Rhesus
11-11-2000, 05:52 AM
JaneK (11-10-2000 07:24):
Hi,
How can I unregister the prog?

Thanks
JaneK

Delete the file mfr.ini
JaneK
11-11-2000, 07:39 AM
Pls ignore above post

JaneK
JaneK
11-11-2000, 07:42 AM
Pls ignore above post

JaneK
goatass
11-11-2000, 09:08 AM
To unregister, edit the INI file in that same directory and delete your name and company from there.

goatass
RalDnoR
11-11-2000, 03:38 PM
Hi all!

It's great to see all the effort people are putting in this project so far!

The last question about the unregistering of the software is an important one, because it isn't mentioned by anyone...
There is a file in your <windows>-directory called 'MFR.DAT' which contains the registration info.
This is also where the difficulty in patching shows up... It is easy to patch the program in such a way that it says 'thank you for registering' (or something like that), but afterwards you'll notice that the serial check is done at many, many points in the program (check it in W32Dasm and see from which locations the serial-routine is called). The trick is to modify the code in such a way that when the MFR.DAT-file is empty it will ask for registration, and once it is full (by registering it with a fake serial) it will return the 'good guy' number (can't remember if it's 1 or 0, I don't have the disassembly at hand right now).

I really appreciate all the info given by people here, though sometimes I miss some more background. Maybe it's nice for newbies to show some more detail. I think in the patching issue this isn't really necessary, but with keygenning newbies also need to have some assembly experience. Maybe it's nice to show more comments in the source-code. It's difficult to make it easy to understand for everyone though I think with this many posts we're definately in the good direction.

I will compile the threads concerning this project in a file and post it on my website soon.

Keep up the good work!

B.t.w. I also want to say it's nice to meet such a lot of people with the same interests :)

Yours sincerely,

RalDnoR.
hz
11-11-2000, 04:24 PM
hi,
look up the page and you will see I posted the mfrdat mesage and on my computer its
in the windows/system folder. Not trying to be a smart ar*e just mentioning it.
regards
hz
hz
11-11-2000, 04:39 PM
hi,
forgot to mention, if you follow from where
it reads the mfrdat file you will very quickly
find where to patch so its regged at startup.
regards
hz
Timmy
11-11-2000, 07:46 PM
Doh ... Homer ...
hz
11-11-2000, 09:34 PM
that all you have to contibute apart from a half finished keygen?, yawn.
hz
RalDnoR
11-12-2000, 05:53 AM
Sorry, I only read the first page and posted a reply on it... :)
Timmy
11-12-2000, 08:00 AM
The Doh Homer was a reference to myself for posting a message twice, clicking the next page button illuded me for a while - obviously I was not alone in that. Anyway, back to more serious matters.
ThRaX
11-13-2000, 04:24 PM
Hey, looking at the website for MFR, and reading it I found that the guy who wrote this thing seems like hes a cool guy. After this is all done, I think we should contact the author and tell him all about this project, and point him to this site...(I'm assuming that after cracking this program you all unregistered it) He seems like the type of author who would even appreciate something like this in fact, and it would be cool if we contacted him...laterz
hz
11-13-2000, 07:54 PM
hi timmy,
fair enough mate, I jumped the gun, I apologise.
hz
11-13-2000, 08:05 PM
hi ThRaX,
I'm against that idea, for the same reasons as BlackB in his "ASProtect and we, reverse engineers" thread on the other forum and maybe he's not as "cool" as you think, we have been shut down too many times already. Just my opinion buddy, you are entitled to yours.
regards
hz
ThRaX
11-16-2000, 09:29 PM
Ehh, whats goin on now? It seems most of us are basically done with both of the tasks (or at least one)...And no one has posted in a while...Does this mean we're moving on?
paularis1
12-10-2000, 04:22 PM
Hi,
To unregister the prog just delete the file C:\windows\system\MFRDAT.DAT

Have a Nice Day !
Paularis1 [/quote]


Magic File Renamer Keygenning tips and solutions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Magic File Renamer Keygenning tips and solutions
PDA

View Full Version : Magic File Renamer Keygenning tips and solutions

RalDnoR
11-07-2000, 04:04 PM
Please post all you experiences on keygenning MFR here...

Thanks!
ThRaX
11-10-2000, 08:02 PM
Whoops, double post...just edited it out, sorry 'bout that.
ThRaX
11-10-2000, 08:03 PM
Kay as i said in the patching thread, we are getting into keygen territory so we should move over here...
kay so as i left of, stanks, you left out a few keylines in that code that takes place after the loop: and here it is, attached to this post (the actual code was too long with my comments so i had to attach it...)

Basically what you left out was that after the loop, the "serial" in ESI was really not the correct serial. Before the "real" serial is totally calculated, the resulting value that is in esi after the loop is copied over to eax. It is then shifted to the left 4 bits, then copied back to esi. THEN we have our real serial...I think the file i attached is worth viewing for newbies who are having trouble comprehending the calculation routine.

If I am mistaken in anyway, please feel free to correct me.
Thanks,
stanks
11-11-2000, 03:13 AM
Hi!

Thank you. I forget that part. Sorry!!
:(

Greetz
Lord Rhesus
11-11-2000, 06:10 AM
I have had a go at the program and have come up with a key generator for it written in Masm. Included with the keygen I have a hastily written tutorial describing the method I used. I hope this is of use to somebody. Please note that it is probably easier to follow the code that my actual tutorial.

Also as a suggestion, I was thinking that all of the solutions to each mini-project could be compiled together and made available for download and quick reference. This way new reversers will be able to look at all the different solutions and perhaps learn which methods produce the most effective results.

One more suggestion. Perhaps the next project could be about something different, such as removing ad banners from internet programs like GoZilla.

If you think this is spoiling the challenge then send me an e-mail. (To get attachment see a few posts down)
goatass
11-11-2000, 09:05 AM
Hi everybody, I also wrote a keygen in masm but I really liked Timmy's keygen that he posted in the Tips and Solutions thread. It's written in Delphi (just like our target) and it shows you almost exactly what the target is doing so you can get a much better feel to how this algorithm works. The keygen in assembly is easy to do because all you have to do is rip out that one CALL that does all the modifications to our name and convert the reutrn value in EAX to decimal and print it on the screen.

Great job Timmy.

p.s as for what Lord Rhesus said about compiling all these projects together, I think it's a good idea. I'll start doing that when I have some free time.

Lord Rhesus if you could please send me your tutorial for this project it would be great so I don't have to write this one too :)

goatass
ThRaX
11-11-2000, 10:51 AM
Hey all, one questino about writing an ASM keygen:

In the actual calculation loop of the program, there are multiple references to the byte located at ESP+4, and the byte located at ESP+5...I was just wondering if, in your keygen that you are writing when you rip out the code can you stick to these two values? or do you have to create your own variables/store your own values in registers in order to use them? Basically what I'm asking is do the lines of code that reference 'ESP+4' and 'ESP+5' need to be tweaked? If so, how?

Thanks

One more thing, I hear that "Unless you know what you are doing, you shouldn't mess with the ESP register"...is this an exception to that "rule"??
thanks again
goatass
11-11-2000, 08:10 PM
Well no you don't need to tweak those values. Here is how my main loop looks like, I didn't calculate a character at a time, I read everything at one time and looped through the characters (I'm lazy).

invoke GetDlgItemText,hWnd,IDC_NAME,ADDR szName, 03ch
lea edi, offset [szName]
or ecx, 0FFFFFFFFh
xor eax, eax
repne scasb
not ecx
dec ecx
mov szLength, ecx

@DOAGAIN:
mov dl, byte ptr [szName-4]
mov cl, byte ptr [szLength]
cmp dl, cl
jg @ALLDONE
mov edx, offset aLcjfvibb22vg45
mov eax, offset szName
call sub_491A98 <-- this is where the ripped code is
inc byte ptr [szName-4]
jmp @DOAGAIN

@ALLDONE:
invoke dwtoa, eax, ADDR szKey
invoke SetDlgItemText,hWnd,IDC_KEY,ADDR szKey

What you were relating to is this, when you rip code from a program you need to make sure you include the local variables declared by that function, looks like this:

sub_491A98 proc near ; CODE XREF: sub_4A8378+62p

var_8 = dword ptr -8
var_4 = byte ptr -4
var_3 = byte ptr -3

The code that you mentioned, ESP+4 and ESP+5 therefore will looke like this:

loc_491AF7: ; CODE XREF: sub_491A98+5Bj
inc [esp+8+var_4] <-- ESP+4
dec [esp+8+var_3] <-- ESP+5

I use IDA when riping code out, it's the best since it shows you everything you ever wanted.

When using the ESP it's not dangarous you just have to make sure to save it (PUSH ESP) before you use it and when you are all done restore it (POP ESP).

goatass
ThRaX
11-11-2000, 10:26 PM
Ahh, i see...Thanks for clearing that up, goatass
Lord Rhesus
11-12-2000, 08:37 AM
goatass (11-10-2000 23:05):

Lord Rhesus if you could please send me your tutorial for this project it would be great so I don't have to write this one too :)

goatass

Hey goatass! I can attach files now? So here is my tutorial and keygen. Note that you have to right click on the link and select save to disk other wise you get a window displaying garbage!
ThRaX
11-13-2000, 04:27 PM
Hey all I just finished up the Keygen in Win32ASM...the code is basically identical to Lord Rhesus's, so I dont really think I need to post it up here.

Anyway, this was a really nifty project...Taught a lot about other languages (namely, Delphi), and how to defeat *many* Delphi protections. As I said in the patching post, I read the authors website and he seems like a cool guy, the type who would appreciate something like this...I think we should contact him and point him to this forum...And maybe in the future he could make a better protection, possibly with help from the reverser community ;)

laterz
Timmy
11-13-2000, 06:23 PM
Just as a note, I know high level languages are overbloated but writing a keygen in delphi or whatever gives me a complete understanding of what is going on and is a hell of a lot easier to look at later on when you are looking back at your past projects for tips. Actually I should have added plenty of comments to my source code to clarify things but I was slightly drunk at the time of posting.
ThRaX
11-14-2000, 04:01 PM
Hey all, one question....
This project showed how useful DeDe the delphi decompiler (er...sorta decompiler.) Anyway, is there a conveniant way to know if a program is written in Delphi? (Any clear cut give aways, or even subtle hints)...It would be tedious to simply attempt to decompile every singel app you stumble across, just to find out if it was in Delphi.

Thanks
hz
11-14-2000, 04:46 PM
hi,
Gettype works for me, protools or h*tp://surf.to/phax
regards
hz


Try this one........
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Try this one........
PDA

View Full Version : Try this one........

Spekkel !
11-09-2000, 08:03 AM
try this one,took me 3-days, when you have succeed try to make a new acount. prog.: the BAt (halloween),email program.

http://ritlabs.taide.lt/ftp/pub/the_bat/the_bat.exe
Carpathia
11-09-2000, 08:00 PM
If I recall, wasnt The Bat Halloween edition, an RSA based protection ?

Regards

Carpathia
Spekkel !
11-10-2000, 05:31 AM
Yep,

Look at :http://users.belgacom.net/blackb/thebat.html

It's an older version but The bpx on "sendmessagea"
worked good !

SpeKKel.....


The next project, and beyond...Feedback please :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > The next project, and beyond...Feedback please :)
PDA

View Full Version : The next project, and beyond...Feedback please :)

ThRaX
11-16-2000, 09:35 PM
Hey all...Alright, I personally think that the MFR project was a great success, and I'd say that it:

Showed the value of a new tool that many of us were new to, DeDe.

Gave an introduction to us about Delphi, a language many of us are new to

Gave another opportunity to locate, and understand algorythms!

Alright, now on to the next project, and beyond...I personally think that, while many have stated that going beyond the "patch" and "keygen" topics is "too advanced" for a newbie,I rather disagree for the sole reason that the purpose of this project forum is to teach newbies like me, and have progression! Now, i'm not saying we shoudl move to unpacking/dongles etc. right *now*, but I am saying that, we should start moving on to more diverse things, I do think that MFR was a step up in difficulty from MovingPix, and similarly the next project we do should be a "step up" from MFR...And after that, and maybe 1 more, we should move on to more advanced topics such as unpacking, dongles, and other things. We will however need considerable guidance from more experienced reversers...But isnt that the whole purpose of these forums? :)

ANy feedback would be appreciated!
Raven58
11-17-2000, 06:24 PM
This newbie is a real newbie. I did not have any luck with MFR project. I couldn't patch it or figure the calculation scheme. The posts were of little help to me and I came away with the impression that the majority of the posts were from intermediate to advanced reversers. So I would like to see two projects run at the same time. Something for the true newbie and something for the more advanced. I think we have to give consideration to the real beginners here and the people who participate on the board could sure assist in "bringing us along"
ThRaX
11-17-2000, 08:40 PM
Hmm..Thats a pretty good idea. After all, it isn't necessary for you to actually *work* on both projects, and the more advanced newbies could give help to the less advanced newbies on the "real newbie" project.
And Raven, as for MFR, I'm sure you'll udnerstand one the essay gets posted.

Laterz
ThRaX
11-17-2000, 08:43 PM
Alright, additionally I thinnk i found a program that would make a good project, because I couldnt make heads or tails of it :)

www.execsoft.com

The DiskKeeper trial version...If the moderators, or more advanced reversers wanna take a look at it , that would be cool. (I posted this on the main forum a good while back, just reposting it here where I Think it belongs)
Kayaker
11-17-2000, 09:56 PM
Hi, Just a couple of thoughts

Well Thrax, I was willing to give Diskeeper 6 a look, but after going through all the user profile/survey BS required to get to the d/l area (Pleassse give direct links ;), I found out it was 9.42Mb for 95/98/Me and 11.7Mb to include NT/2000. Wow, nice try but I think this might deter some people from giving it a shot as a project. If anyone IS interested, the direct link is at

http://www.execsoft.com/trialware/diskeeper/download.asp

Raven58 - Not a problem. The purpose of this board is to make sure everyone learns something and progresses. Go with the questions if you have problems, the only stupid question is the one not asked. However, don't forget that this Project area is to supplement, not replace, basic lessons you can and should get elsewhere as well by reading, reading, reading and trying other tuts. The more you get under your belt from written tuts, simply in being more comfortable reading/tracing through code, the more you'll get out of these interactive projects I would think.

Just to make sure that you DO get something positive out of this last project, where did you run into problems? Not necessarily at what address, but perhaps conceptually or at what step in the process? Feel free to share your thoughts. Call it a post-game discussion ;)

Regards,

Kayaker
ThRaX
11-17-2000, 11:04 PM
Heh...Kayaker I suppose your right, somehow it totally evaded me that the file was so large ;) And sorry about the link too. And Raven: Just to give you some more insight as to the process i personally followed with this:

Right, *many* people suggested that I set a breakpoint on HMEMCPY in SoftICE, and hit F12 a lot and eventually find my way back to the code. Well two things, first off thats fairly inefficient, and I"ve never like hmemcpy,second of all im using Windows NT so it wouldnt have worked anyway ;D

Thankfully, there is a wonderful progrma out there called DeDe which "decompiles" Delphi programs! So I ran and downloaded that, and decompiled MFR...(I believe you can grab it at ht*p://protools.cjb.net) Anyway, I decompiled the program (fairly self explanatory on how to do this) and clicked on the "Procedures" tab inside Delphi. Looking in the left column, I selected the "Register" heading. Under that, in the other column were a list of procedures. Two of them caught my eye. "SetRegistered", which looked like a procedure which would be called in order to "Set" the program into its "Registered" mode after correct information was entered---but i wanted to go further back and find the true routine for calculating a serial. The other procedure that caught my eye was "ebNameChange", or something along those lines (can't remember the exact name). I looked in there, and it looked fairly suspicious so I set a breakpoint on the location given there in Soft-ICE. I traced through a lot of calculations, an enormous loop, and at the end, following the 'RET' instruction, wound up right after a call. I noticed a few lines down a call followed by a conditional jump....Hm...So I popped up W32DASM, and went to that jump. I used a hex editor then to reverse it, and it gave me the "Registered" message! Alright cool...But then upon restarting the program, again it was unregistered. Now in this sort of case it usually means there are serial checks called from various locations. To find out where all the locations it was getting called from were, I fired up w32dasm, loaded up the program, and went to the Calculation call, the address of which I got from DeDe (procedure ebNameChange). It said there that it was called from two locations---One of which I had made the patch shortly after. I then went to the *OTHER* location from which this function was called, and saw that the same sort of conditional jump was there as well! So I patched that one as well, and voila, I entered some bogus data, restarted the program, and it was Registered!!!

So now I wanted to find the calculation routine and actually understand it...
I restored the old backup of the un-patched program and unregged the problem by deleting the "Name" and "Company" entries from the mfr.ini file in the directory. I then once again set my breakpoint in Soft-ICE, and started tracing...I saw a really long table being pushed to the stack right before the call to the calc. routine was made, which looked interesting. inside the call, I saw a couple values being moved to various registers---Namely, '01' to BL, 46h to esp+5, and '01' to esp+4. After this, there was a Loop which performed *the* calculation routine which I won't describe here...If you read the posted keygen code in the other posts, you will understand it though I hope.

Alright, I hope this helps you if you have any more questions just ask :)
ThRaX
11-18-2000, 11:34 AM
Opera 4.05 seems rather good...Its one of those programs where you find the *area* that the *crack* is in, but you just cant pinpoint it....I started workin on it today, and if anyone is interested I think its a good project....
Lord Rhesus
11-19-2000, 07:49 AM
ThRaX (11-18-2000 01:34):
Opera 4.05 seems rather good...Its one of those programs where you find the *area* that the *crack* is in, but you just cant pinpoint it....I started workin on it today, and if anyone is interested I think its a good project....

No thanks. I've already got 4.01 }>
Kayaker
11-19-2000, 07:31 PM
Sorry, just a test. I keep getting CGI errors when trying to make a new post :(
Free
11-20-2000, 05:38 AM
Lord Rhesus (11-18-2000 21:49):
ThRaX (11-18-2000 01:34):
Opera 4.05 seems rather good...Its one of those programs where you find the *area* that the *crack* is in, but you just cant pinpoint it....I started workin on it today, and if anyone is interested I think its a good project....

No thanks. I've already got 4.01 }>
______________________________________
I"ve been trying to crack it for some days now. Can you give me some hints?

thanks
Free
11-20-2000, 05:38 AM
Lord Rhesus (11-18-2000 21:49):
ThRaX (11-18-2000 01:34):
Opera 4.05 seems rather good...Its one of those programs where you find the *area* that the *crack* is in, but you just cant pinpoint it....I started workin on it today, and if anyone is interested I think its a good project....

No thanks. I've already got 4.01 }>
______________________________________
I"ve been trying to crack it for some days now. Can you give me some hints?

thanks


another newbie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > another newbie
PDA

View Full Version : another newbie

MGJ
11-17-2000, 09:56 AM
please, does anybody know about some reference, manual, etc. on the web that explains all the things like getdlgitemtexta, IstrcmpA, and so on? like exactly what it does and when it's used.
thanx
ThRaX
11-17-2000, 04:14 PM
Theres a helpfile out there all about win32 api (getdlgitemtexta, lstrcmpA, etc.) I have it because it was part of my C compiler package...I'm sure you can download it somewhere...
Timmy
11-17-2000, 09:06 PM
I know its going to be a bitch, but download "Art of Assembley" and PRINT IT OUT (about 1500 pages), reading from paper is far better than from screen - and you need to understand the first half of it before you go on to anything difficult. Then after that mamoth task is to download (and PRINT each topic as you require it - {as you require each little bit for whatever you are trying to do/reverse}) the WIN32 Programmers Refernce. When the penny drops about any specific function and what parameters are pushed before each call (AND IN WHAT ORDER) you WILL gain a serious insight as to what is going on in any program you encounter - normal, packed or whatever. It will be a long and tedious job - but it will be well worth it in the end.
Clandestiny
11-20-2000, 08:58 AM
Hi MGJ,

Thrax is right. There is a win32 API helpfile and you can download it from ht*p://www.crackstore.com under the tools section. Hope this helps :-)

Regards,
Clandestiny
MGJ
11-20-2000, 10:03 AM
thanx everybody, i downloaded the Art of assembly(WOW, 1500 pages, looking forward to print it :) and the API reference, it looks pretty good, I just don't know when I'm gonna read it all :).
Oh, btw, I cracked my first program yesterday :)))
the snake
11-20-2000, 11:25 AM
Oh, btw, I cracked my first program yesterday :)))

Hi MGJ, There is nothing (almost :):) ) like first crack, keep up the good work
the snake


Magic File Renamer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Magic File Renamer
PDA

View Full Version : Magic File Renamer

MGJ
11-20-2000, 10:10 AM
hi

I wrote this under a new topic, because it's not about solving the problems that Raldnor posted

I tried to register this program in the easiest way I could think of: I used dede to decompile it, found the SetRegistered proc and where it starts. Then I changed the call that's made when you press an about item in the menu to call this procedure. This works, once you click to about, the title of the main frame changes to registered and the register choice from the menu disappears, but next time I start the program, it appears unregistered again. Does anybody know whatz wrong?

thankz

MGJ
Raven58
11-20-2000, 07:54 PM
Please look under the heading" RE: The next project and beyond.. Feedback Please. Under item # 6, ThRaX responded to this newbie with an excellent explanation which included the question you raised. My thanks to ThRax.


Project # 3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Project # 3
PDA

View Full Version : Project # 3

Kayaker
11-20-2000, 01:44 PM
Hi All,

Hmmm, it's pretty quiet around here lately ;) OK, I'll give it a go.

Target: Happy Icon 2.01 960Kb
http://www.logipole.com
Any of the half dozen progams at the site would do since they all use the same principle in protections.

The Tasks range from easy, though not mundane, to very hard. So everyone should be pleased/displeased ;)

TASK 1 - Set your system clock ahead to trigger an expiration nag.
a) Figure out how to change the install date info so the program still functions normally (at least for the next 30 days or so) WITHOUT patching the program.
b) Now patch the program so it will continue to operate (unregistered) indefinitely.

There are many API breakpoints that might, or might not, be successful with time checks. You could just try them all, or maybe use an API monitor to tell you which one(s) are being used. If not, you'll need another way to get to the relevant code. Filemon/Regmon should tell you where the install date info is kept, so you may need to use the corresponding breakpoints (i.e. CreateFileA / ReadFile for files and RegOpenKeyExA / RegQueryValueExA for the registry)

CompareFileTime
DosDateTimeToFileTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
LocalFileTimeToFileTime
SystemTimeToFileTime

TASK 2 -
a) Determine where/how the program keeps its registration info.

Trace through the registration routine and register the program by
b) patching a jump or
c) determining a valid serial.
The 1st two projects have given the general techniques sufficient to do this.

d) After you've done b) or c) above, what happens? Trace through the code (F10) and determine what API calls are used and what they are doing.

TASK 3 - Describe and/or keygen the registration algorithm. I'm not a big one on keygens, a verbal/codal description is better and probably more instructive for others. The algorithm is not *too* complicated ;)

TASK 4 - This one's for fun. Change the image that's on the large button from a yellow "Men Working" sign to the red "Stop" sign that's in the file Resources.

BONUS TASK - Pretend at this point you don't know the exact structure of the program's licensing information. Can you re-create from first principles what is needed for the program to be validly registered? i.e. you knew where the info was kept, but not exactly what that info was. This falls under the realm of generating a registry structure/inifile/keyfile.

Task 2d) should've told you that some clues are in the exe file. This task is made even more difficult because of the presence of a CRC check which takes into account your specific user information, so maybe a combination of license reconstruction and CRC patch in the program might work.

I'll split Task1/Task2 and Task3/Task4/Bonus into seperate threads which can be used for questions/answers.

Good Luck,

Kayaker
ThRaX
11-20-2000, 07:16 PM
alright, this is the way it should be :)
hz
11-21-2000, 01:14 AM
Hi Kayaker,
Don't know what happened to my last post, anyway what do you mean about crc check?. I've only had a quick look but it patched without problems. Keygen is simple, but creating a registry key is not something I've
done before (nice touch) so I will need some hints in that direction.
regards
hz
Kayaker
11-21-2000, 02:50 AM
Hi hz,

The CRC check isn't on the program itself. If you patched it at the critical compare where I'm thinking of, or if you entered a valid s/n, then it "created" something which holds your registration info. Take a look at that something and there's a reference to CRC and a number. Now try changing a byte in that something and see if you're still registered ;)

What I wanted now was for people to pretend that they didn't know what this "creation" was and could they reconstruct it from 1st principles. This would of course be the case where there is no option to enter reg info but the author sends you a little present via email after registering.

For example you see a reference in Regmon to "Name" and the result is 'Not Found'. So you create a new string reference (could be binary or dword though) called "Name", fill it in and rerun Regmon. Then that step passes and now it looks for say "Serial", so you create that one, etc. etc.

Now you've got something to break on (RegQueryValueExA) as the program starts its registration check on startup. With a file it'd be the same thing, you see it looking for a file, so create that file and enter some junk. Then you can break on CreateFileA and ReadFile and see what sort of structure it's looking for. Or sometimes the program might use GetPrivateProfileStringA if its a simple ini type file.

I'm sure you know what I mean and you've seen it before. It's sort of like registering through the back door even if you can enter a serial number through regular means. The problem is, sometimes you can't ;)

BTW, if the program seems to hang as you're doing this (say if you don't have any breakpoints set) it just means it's trying to digest your bogus information and can't make heads or tails of it. You can just CTRL-ALT-DEL close it. But SI will break OK normally.

The other option for this Task, and maybe a better one, is just to change something, a letter or maybe the CRC value itself, and trace until you find the CRC check in the program and see if you can patch it. Yeah, maybe that's a little better and we can get an intro to CRC checks in ;d

Hope this helps,

Cya,

Kayaker
hz
11-21-2000, 03:57 PM
Hi Kayaker,
Don't know what happened to my last post, anyway what do you mean about crc check?. I've only had a quick look but it patched without problems. Keygen is simple, but creating a registry key is not something I've
done before (nice touch) so I will need some hints in that direction.
regards
hz
ThRaX
11-21-2000, 08:36 PM
Hey, sorry this is probably a fairly trivial thing but what exactly is a CRC check?
?ferret
11-21-2000, 09:27 PM
Hi Thrax,

A CRC check is a check to make sure the program's "integrity" remains intact.

CRC (***** Redundancy Code) ***** is "Critical" I believe, but not 100% positive ;-)

At some point in the program it checks certain bytes at another part of the program to make sure they're what they are supposed to be (not patched). So if a programmer knows the weak points he can place a few CRC's in to check them and make us work a few more minutes hehe
ThRaX
11-21-2000, 10:35 PM
Heh, well I guess I just jumped right in with Sice, and did the crack...And while I guess I should have studied it a bit more before going in for the kill, one thing amazed me---I just typed 'r fl z' at what i believed was *the* jump, and i was registered! Not just till I closed the box, not just till I reopened the program, but I just did that and I was registered...forever! Whats more i found the correct serial, this program uses a "cmp correctvalue,wrongvalue" sort of routine, rather than a flag of any kind, and no encrypting the correct code before comparing either...
anyway, on to actually doing what i was supposed to do ;)

LoL!
Anyway, on to actually
ThRaX
12-02-2000, 08:04 PM
Hey, seems that this project isn't quite over (for me anyway, lol) but we'res tarting another one...I think it would be cool if all the threads for HappyIcon were compiled into an essay...I understood tasks 1-4 fairly well, and learned a lot from them, but I, and I think others are having trouble on the bonus task, specifically on the part involving regenerating a keyfile from scratch...An essay would be cool I think!
If anyone wants to do this taht would be great, and I would be willing to help in any way possible (er, more specifically I would be willing to write the solutions to tasks 2 and 3 ;))


Project # 3 TASKS 1 & 2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Project # 3 TASKS 1 & 2
PDA

View Full Version : Project # 3 TASKS 1 & 2

Kayaker
11-20-2000, 01:48 PM
TASK 1 - Set your system clock ahead to trigger an expiration nag.
a) Figure out how to change the install date info so the program still functions normally (at least for the next 30 days or so) WITHOUT patching the program.
b) Now patch the program so it will continue to operate (unregistered) indefinitely.

There are many API breakpoints that might, or might not, be successful with time checks. You could just try them all, or maybe use an API monitor to tell you which one(s) are being used. If not, you'll need another way to get to the relevant code. Filemon/Regmon should tell you where the install date info is kept, so you may need to use the corresponding breakpoints (i.e. CreateFileA / ReadFile for files and RegOpenKeyExA / RegQueryValueExA for the registry)

CompareFileTime
DosDateTimeToFileTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
GetLocalTime
GetSystemTime
GetSystemTimeAsFileTime
GetTimeZoneInformation
LocalFileTimeToFileTime
SystemTimeToFileTime

TASK 2 -
a) Determine where/how the program keeps its registration info.

Trace through the registration routine and register the program by
b) patching a jump or
c) determining a valid serial.
The 1st two projects have given the general techniques sufficient to do this.

d) After you've done b) or c) above, what happens? Trace through the code (F10) and determine what API calls are used and what they are doing.
mersenne
11-23-2000, 08:14 PM
Hi all,

I though I may as well get the ball rolling. here is some preliminary stuff and task 1.

Preliminary stuff
I installed the program with INCTRL 4 which monitors the installation and generates a report showing all files, registry keys and values added or changed during the installation. Useful for making sure you get rid of all of the program when you delete it and damn useful for this sort of work :) The following created in the registry is probably fishy considering we are looking at a time check:

HKEY_CURRENT_USER\Software\HappyIcon\startdate=01C0546F (29381503)

Note: the startdate value is created from your system clock when you install the program and will be different for each person. The value 29381503 is just the decimal conversion of 01C0546F.

SIDENOTE: If someone could show me how to convert this into a time and date eg 3rd Nov 2000 I would be grateful.

OK, I ran the program to find out what it did. Selecting "about" from the "Help" menu gives the following information:

Licence: Unregistered
Granted to: Unregistered

Selecting "register" from the same menu provides you with a dialog to enter:

Name:
Firstname:
Key:

If you set the system clock forward so that the expiration nag is displayed and then set the clock back to the correct time, you can use the program normally once again. This suggests that there is just a direct comparison with the date it was installed and the current date and nothing else is set.

Task 1
As was mentioned in the task list, set the system time so that the expiration nag appears. Time to look at the program.

Kayaker discussed a couple of the ways you could determine the right breakpoint to use. There is another simple method he did not mention. Get yourself a PE header browser (I use PEBrowse), open the program with it and check out the program's imports. There is only one API function that the program uses that will retrieve the system time; GetSytemTimeAsFileTime. If you set a breakpoint on that API function you will land here:

* Reference To: KERNEL32.GetSystemTimeAsFileTime, Ord:0176h
|
:00414C5A FF15E8004200 Call dword ptr [004200E8]
:00414C60 8B4C241C mov ecx, dword ptr [esp+1C] ;current filetime
:00414C64 8B542404 mov edx, dword ptr [esp+04] ;installed filetime
:00414C68 2BCA sub ecx, edx
:00414C6A 81F993170000 cmp ecx, 00001793
:00414C70 720A jb 00414C7C

If you note the values in ecx and edx after the MOV instructions you will see that one of them corresponds to the the startdate value we saw in the registry earlier, the other is the current system time/date. If you take the value in ecx and use this to replace the startdate value in the registry (Use regedit in the windoze directory, get to the key shown above, rightclick on the value and select modify, type in your new value) you can now use the program for the next 30 days or so.

To make the patch permanent so it will continue to run unregistered, it is a simple matter of changing

:00414C70 720A jb 00414C7C

to

:00414C70 EB0A jmp 00414C7C

which will cause the program to make the right jump regardless of what the result from the comparison is.

mersenne
Kayaker
11-24-2000, 03:02 PM
Nice work Mersenne and thanks for a detailed response.

I don't think you can convert GetSystemTimeAsFileTime results as a regular date and time. According to its definition it returns information as Coordinated Universal Time (UTC) format in a FILETIME structure. The FILETIME structure is a 64-bit value representing the number of 100-nanosecond intervals since January 1, 1601. Don't know where the hell they come up with that one ;)

If you trace into the Kernel32 call you can see system date info being PUSHed in certain registers (i.e. 7D0=2000, 0B=11=Nov), but they're only being used internally to calculate the UTC.

typedef struct _FILETIME { // ft
DWORD dwLowDateTime;
DWORD dwHighDateTime;
} FILETIME;

dwLowDateTime- Specifies the low-order 32 bits of the file time.
dwHighDateTime-Specifies the high-order 32 bits of the file time.

If you display the FILETIME structure address pointed to in the GetSystemTimeAsFileTime parameter you see the 2 DWORDS listed. It appears that the HighDateTime is the date and the LowDateTime is the time. The HighDateTime is the [esp+1C] value used in the CMP.

* Reference To: KERNEL32.GetSystemTimeAsFileTime, Ord:0176h
|
:00414C5A FF15E8004200 Call dword ptr [004200E8]
:00414C60 8B4C241C mov ecx, dword ptr [esp+1C]
:00414C64 8B542404 mov edx, dword ptr [esp+04]
:00414C68 2BCA sub ecx, edx
:00414C6A 81F993170000 cmp ecx, 00001793
:00414C70 720A jb 00414C7C

Just for fun here's a few other ways you could patch to force the cmp to be valid:

change
:00414C64 8B542404 mov edx, dword ptr [esp+04]
to
:00414C64 8B4C241C mov edx, dword ptr [esp+1C]

:00414C68 2BCA sub ecx, edx
to
:00414C68 2BC9 sub ecx, ecx

or
:00414C68 2BCA sub ecx, edx
to
:00414C68 33C9 xor ecx, ecx

Regards
ThRaX
11-25-2000, 11:08 PM
mhmm...Alright, just finished task 1, same general idea as what mersenne posted. As far as task 2 goes, however I did both B and C....Using a very simple breakpoint (GetDlgItemTextA), I was able to locate and patch *the* conditional jump, and i was registered (actually crazy as it is, I didnt even ahve to patch lol I Just did 'r fl z' in sice and i was registered for good, lol), as well as *fish* out a correct serial within just a few lines of this critical jump.
mersenne
11-26-2000, 11:42 PM
Please ignore all the ' marks, I had to try and stop those emoticons from being posted everywhere. Also if someone knows how to format the code stuff better, PLEASE let me know. The pre and fixed tags don't work so well.

Here we go with task 2 :)

Considering that everytime you try to register the program you have to re-enter all the details, suggests that the program is not keeping any information entered (at this stage). There is nothing written to the registry or file.

To patch a jump or determine a valid serial, we first need to break into the code to figure out what the program is doing. The program needs to get the information we enter into the registration dialog so lets begin there. There are a number of API functions which the program can use to do this. Looking at the list of imports again you will see that it is most likely GetDlgItemTextA. Set this breakpoint and then enter the information requested in the registration dialog. For the purposes of this project I entered the following:

Name: copy
First name: pirate
Key: 12344321

Hit the OK button and you will break at this function. The program actually calls this function three times in a row to get the name, followed by the first name and then the key so if you are using Softice you can press ctrl D after the first and second calls to get you to the third one. Press F11 and you will be in the program code. Alternatively you can trace through the code after you break the first time. After the final call you will end up here:

* Reference To: USER32.wsprintfA, Ord:02B3h
|
:00414079 8B1DF4024200 mov ebx, dword ptr [004202F4]
:0041407F 8D542414 lea edx, dword ptr [esp+14] ;address of name in edx
:00414083 52 push edx ;'push "copy"
:00414084 8D44246C lea eax, dword ptr [esp+6C] ;address of first name in eax

* Possible StringData Ref from Data Obj ->"HappyIcon"
|
:00414088 6878214200 push 00422178 ;'push "HappyIcon"
:0041408D 50 push eax ;'push "pirate"
:0041408E 8D8C24A0050000 lea ecx, dword ptr [esp+000005A0];'destination address

* Possible StringData Ref from Data Obj ->"%s%s%s"
|
:00414095 68B4484200 push 004248B4 ;format string
:0041409A 51 push ecx ;'push destination address
:0041409B FFD3 call ebx ;call wsprintfA

This bit of code takes our name, first name and the string "HappyIcon" and concatenates (links) them. The result is that at the destination address you will see "pirateHappyIconcopy" for this example. For imformation about the format string used check out the API reference.

:0041409D 8DBC24A8050000 lea edi, dword ptr [esp+000005A8];address of our new string
:004140A4 83C9FF or ecx, FFFFFFFF
:004140A7 33C0 xor eax, eax
:004140A9 83C414 add esp, 00000014
:004140AC F2 repnz
:004140AD AE scasb
:004140AE F7D1 not ecx ;length of string including 00
;termination byte now in ecx

The program now calculates the length of this string. During this time edi is incremented so that after the scasb instruction edi will point to the end of the string. The following corrects edi so that it points to the beginning of the string once more.

see part 2................
mersenne
11-26-2000, 11:46 PM
:004140B0 2BF9 sub edi, ecx

:004140B2 8D942490010000 lea edx, dword ptr [esp+00000190];new address for string
:004140B9 8BC1 mov eax, ecx
:004140BB 8BF7 mov esi, edi
:004140BD 8BFA mov edi, edx
:004140BF C1E902 shr ecx, 02 ;converts length to dwords
:004140C2 F3 repz
:004140C3 A5 movsd ;move the string
:004140C4 8BC8 mov ecx, eax ;string length back into ecx
:004140C6 8D842490010000 lea eax, dword ptr [esp+00000190] ;address of string
:004140CD 83E103 and ecx, 00000003
:004140D0 F3 repz
:004140D1 A4 movsb
:004140D2 8A8C2490010000 mov cl, byte ptr [esp+00000190] ;first character of our string
:004140D9 84C9 test cl, cl ;Is it zero?
:004140DB 741F je 004140FC ;if yes, jump

The string gets moved to a different address and now the fun begins :)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140FA(C)
|
:004140DD 80385F cmp byte ptr [eax], 5F
:004140E0 7503 jne 004140E5
:004140E2 C60020 mov byte ptr [eax], 20

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140E0(C)
|
:004140E5 0FBE08 movsx ecx, byte ptr [eax] ;move character into ecx
:004140E8 334C2410 xor ecx, dword ptr [esp+10] ;xor with value in [esp+10]
:004140EC 81F1CE9A5713 xor ecx, 13579ACE ;xor with 13579ACE
:004140F2 40 inc eax ;move pointer to next char
:004140F3 894C2410 mov dword ptr [esp+10], ecx ;'put new value in [esp+10]
:004140F7 803800 cmp byte ptr [eax], 00 ;is our next char=0?
:004140FA 75E1 jne 004140DD ;if no, jump up

This is the major loop of our serial calculating routine. It cycles through the string one character at a time, checks to see if the character is 5F ("_") and if yes, replaces it with 20h (space character). The charcter is then XORed with what is at address [ESP+10]. The starting value in [ESP+10] is FFFFFFFF. This value is then XORed by 13579ACE and stored back in [ESP+10]. The pointer to our string is moved to the next character which is checked to see if it is zero (the end of the string). If it is not zero the loop repeats.

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004140DB(C)
|
:004140FC 8D9424BC000000 lea edx, dword ptr [esp+000000BC] ;the key we entered
:00414103 52 push edx
:00414104 E873220000 call 0041637C ;the key converted to hex
:00414109 8B4C2414 mov ecx, dword ptr [esp+14] ;our calculated value
:0041410D 83C404 add esp, 00000004
:00414110 81F1F0BD6824 xor ecx, 2468BDF0 ;xor with 2468BDF0
:00414116 3BC1 cmp eax, ecx ;compare the values
:00414118 742E je 00414148 ;if the same, please continue
mersenne
11-26-2000, 11:47 PM
The key we entered is converted to hex. The value from the loop above is then XORed with 2468BDF0. Note that after this instruction, ecx contains our correct serial IN HEXIDECIMAL for the name we entered. For pirate copy it is C8C0D8A4. To get the correct key to enter in the registration screen all we need do is covert it back to decimal viz -926885724. The jmp directly after the compare is where the program decides who gets registered and who get the "Invalid registration" message. If we wish we could change

:00414118 742E je 00414148

to

:00414118 EB2E jmp 00414148

to permanently patch the program. There are also other ways to patch this, as Kayaker mentioned in a post above.

After the program is successfully registered, the file HappyIcon.lic is created in the same directory that Happy Icon is installed in. The unregistered string disappears from the main window title and the about menu item now has the registration information entered as does the register menu item but now all the edit boxes have been greyed.

mersenne
mersenne
11-26-2000, 11:49 PM
Groan.....

Remind me not to use code tags either, they take up too many characters! Found out a little too late.

Sorry about the split posts

mersenne
()whore
11-27-2000, 09:29 PM
Well I haven't seen anything here yet about the happyicon.lic file so I will mention it. After the prog decides the user typed in a valid reg number, it creates the .lic file with your registration info. Most programs will check the reg info every time on start up to make sure it is valid but not in this case. If you pass the original check you are reged for life it seams. There is a checksum number in the *.lic file. I haven't traced through the CRC routine but if I have time I will look at it.
Thanks for the interesting project. The target is damn easy to crack but untill now I never bothered to follow all the api calls and see what was going on in a program. Normaly I was just interested in getting it reged. This is a bit more interesting.


Project # 3 TASKS 3 & 4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Project # 3 TASKS 3 & 4
PDA

View Full Version : Project # 3 TASKS 3 & 4

Kayaker
11-20-2000, 01:50 PM
TASK 3 - Describe and/or keygen the registration algorithm. I'm not a big one on keygens, a verbal/codal description is better and probably more instructive for others. The algorithm is not *too* complicated ;)

TASK 4 - This one's for fun. Change the image that's on the large button from a yellow "Men Working" sign to the red "Stop" sign that's in the file Resources.

BONUS TASK - Pretend at this point you don't know the exact structure of the program's licensing information. Can you re-create from first principles what is needed for the program to be validly registered? i.e. you knew where the info was kept, but not exactly what that info was. This falls under the realm of generating a registry structure/inifile/keyfile.

Task 2d) should've told you that some clues are in the exe file. This task is made even more difficult because of the presence of a CRC check which takes into account your specific user information, so maybe a combination of license reconstruction and CRC patch in the program might work.
Kayaker
11-23-2000, 03:59 AM
Hi All,

Thought I'd say a few words about Task 4 in case anyone is wondering "Where the hell do I start?" ;)

You can find the image Resources that I want swapped with Exescope. The Resource ID's given are in decimal but any reference to them in Wdasm or SoftIce are in hex, so you need to convert. The APIs used to load image resources from a file are LoadIconA, LoadCursorA, LoadBitmapA and LoadImageA (which can be used for all 3 types). CopyImageA, FindResourceA, UpdateResourceA and some others should also be kept in mind for certain contexts. For Icon (and maybe Cursor) resources, there may be more than 1 listed under a Resource ID. Windows apparently chooses whichever pixel size is appropriate.

As an example if a program wants to load a cursor:

HCURSOR LoadCursor(

HINSTANCE hInstance, // handle of application instance
LPCTSTR lpCursorName // name string or cursor resource identifier

The 2nd stack parameter passes the Resource ID as seen in Exescope (but in hex). A few ways of attacking this might be to do a string search in W32dasm for LoadCursorA and set a breakpoint on that address(es). Or do a string search for "PUSH 0000xxxx" where xxxx is the Resource ID PUSHed as a DWORD. Or you could set a BPX LoadCursor do "dd esp+8" which will break and display the 2nd stack parameter, or Resource ID, in the Data window in SoftIce.

Once you find where the Resource ID representing the yellow image is PUSHed in the file, you simply need to replace it with the one of the red image.

Hope this helps,

Kayaker
Clandestiny
11-24-2000, 11:58 AM
Greetings Kayaker and fellow reversers...

I have not yet done tasks 1 & 2 because I jumped right in to task 3 after examining Happy Icon's code a little bit in SICE. I registered it first by forcing the jz after the eax,ecx comparison. Then I decided to key gen Happy Icon since the algorithm didn't look too bad :-)

I'll explain what I found out about the algorithm first and then I'll include the source to my key gen (written in C).

I found that this algorithm computes a value based upon the name the user enters and this value (converted to decimal) is the key. The entry form asks for both the full name and the first name of the user.

Name:
First Name:
Key:

These strings are then concatnated into a single new string consisting of:

"first_name""happyicon""full_name"

The ascii codes for each character in this new string are then fed sequentially into the algorithm in a loop that terminates with the end of the string.

The algorithm essentially consists of 2 XOR operations.

i=0
key = 0xFFFFFFFF

while (name[i] != NULL)
{
key = name[i] xor key;
key = key xor 0x13579ACE;
i++;
}

key = key xor 0x2468BDF0;

The final result of this algorithm stored in the variable key is your key when it is output in decimal.

******************************************

Key Generator Source Code in C:

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void main()
{
char first_name[30];
char last_name[30];
const char blank_space[] = " ";
const char string[] = "happyicon";
char string2[50];
int i=0;
int key = 0xFFFFFFFF;

//Get first and last names from user
printf("Enter first name: ");
scanf("%s",&first_name);
printf("Enter last name: ");
scanf("%s",&last_name);

//Put names in form "first""happyicon""first"" ""last"
strcpy (string2, first_name);
strcat (first_name,string);
strcat (first_name,string2);
strcat (first_name,blank_space);
strcat (first_name,last_name);

//Generate key
while (first_name[i] != NULL)
{
key = first_name[i] ^ key;
key = key ^ 0x13579ACE;
i++;
}

key = key ^ 0x2468BDF0;

//Output key
printf("
key = %d

",key);
}

Cheers :-)
Clandestiny
Clandestiny
11-24-2000, 06:46 PM
Hi again,

I think I need a little help with task 4...A couple of things are confusing me ???

1)There is no red "stop" sign in the resources I'm seeing in Exescope...I can see the "men working" sign...but no stop sign. I suppose I can always use one of the other images if necessary ?

2)I wrote down what I believed to be the resource name for the men working sign (275 decimal)...there also was an offset 2D3D8 and size 1160. Then I fired up my api moniter and had it to look for all calls like LoadIconA, LoadBitmapA, LoadCursorA. It logged several calls to LoadIconA, but none of the parameters passed in these calls matched my resource identifier! I know it must load these images so I must be doing something wrong :(

3)Also, my user32.fnl seems not to have the LoadImageA function ? Could this be a problem ?

Many Thanks :-)

Clandestiny
Kayaker
11-24-2000, 09:46 PM
Hey man,

Things aren't always as they seem ;)

The red stop sign IS there, it's just not a bitmap.

And you're right, LoadImageA isn't part of the user32.fnl library and yes could be a problem if you rely too heavily on a API monitor (even though I keep touting it ^_^ )

cya
Clandestiny
11-25-2000, 05:12 PM
Kayaker,

Wow! That was pretty cool...I've never done anything like this before...ExeScope is definately an interesting little toy that brings up many more interesting reversing possibilites...

You were absolutely right! It was not a bitmap... which goes to show I should *look* a little more closely before I *leap* into something new! ;)

And the function does not show up in my api moniter which is a little puzzling...I finally found it in Wdasm!

Cheers :)
Clandestiny
Kayaker
11-27-2000, 03:25 AM
Hi Clandestiny,

Fun huh? ;)

I figured LoadImageA was probably a useful one to have APISpy32 monitor so I decided to add it to the library. What I did was to open a (copy) of user32.fnl with the APISpy program Libedit.exe and Add a function. I entered the following in the edit box:

LoadImageA(HANDLE,LPSTR,DWORD,DWORD,DWORD,DWORD)

to correspond to the 6 parameters of the function:

HANDLE LoadImage(

HINSTANCE hinst, // handle of the instance that contains the image
LPCTSTR lpszName, // name or identifier of image
UINT uType, // type of image
int cxDesired, // desired width
int cyDesired, // desired height
UINT fuLoad // load flags

Then I ran APISpy on HappyIcon again and got a successful result:

0040A2D7:LoadImageA(HANDLE:00400000, LPSTR:00000113, DWORD:00000001, DWORD:00000030, DWORD:00000030, DWORD:00000000)
0040A2DD:LoadImageA = 35DF

You probably recognize the parameters being pushed as the correct ones...

Cheers,

Kayaker
ThRaX
11-29-2000, 10:43 PM
Heh, yay I got tasks 1 done and 2 done, learned a good deal from both, and now on to 3. After looking at the algorythm, I found the *loop*...The great thing about this program (er, the thing that makes it rather simple anyway) is that it has *all* the code a cracker could want for any patch, serial fishing, or keygenning in a compact block of code about 10 lines long...no calls, no jumping around, its all *right* there. Quite conveniant :)
Anyhow, essentially how this program calculates is it concatinates the Firstname string, with the string "HappyIcon", followed by the Lastname string. So the string will be "FirstnameHappyIconLastname"....Alright, so heres how it is in pseudocode

var a=pointer to "firstnameHappyIconlastname"
var b=FFFFFFFFh
var c=0
while (name string is not finished cycling through) {
c=current char of a
key=key xor c
key=key xor 13579ACEh
increment a to point to next char
}
key=key xor 2468BDF0h

Anyway, I've attached my keygen in .zip format to this post...written in win32asm :)
no ripped code either even though i called my calc function "Rip" :D ACtually I was planning on ripping code, but the damn prog wouldnt disassemble under IDA, so that plan was scratched...Just wrote it from the bottom up.
mersenne
11-30-2000, 04:42 PM
Also have completed Tasks 3 and 4. My keygen was in win32asm but I won't bother to post it since Thrax has already put an asm one up.

Task 4 was quite good fun :) The thinking took the biggest chunk of time, once I sorted out what was going on, the actual changes were very easy. I've had a brief look at the bonus task at the moment but am a little confused on the aim/outcome? Is the aim to come up with a way of contructing a keyfile so that it will register an unregistered copy of the program?

mersenne
Kayaker
11-30-2000, 05:27 PM
Hi Mersenne,

That was sort of the original idea, to simulate how to reconstruct a keyfile if there was no serial entry routine in a program. I later gave another option to simply change 1 byte in the existing keyfile, which will give a "corrupt keyfile" message, and see if you can trace and patch the CRC check causing it.

I made a few comments which might help (or likely confuse ;) in the 3 threads

Project #3 - Question to Kayaker
Project # 3
Task 4 CRC hints (all right, so I meant the Bonus task)

Let me know which of the 2 Bonus tasks you're attempting and I'll try to help. I didn't actually DO the 1st one BTW, just figured it COULD be done. Especially with knowing WHAT the keyfile was supposed to look like, I thought it would be a good exercise to pretend you didn't and go through the routine of trying to reconstruct it. Filemon would tell you that the program is looking for a file called happyicon.lic, so you create one and try to fill in the correct structure, as you normally would with a keyfile. Luckily in this program, there is hard-coded the skeleton of the structure in the exe file, so theoretically you should be able to create a valid keyfile. The CRC check just throws in a nasty little quirk to it all.

Kayaker
mersenne
11-30-2000, 09:02 PM
Hi Kayaker,

Thanks for the explanations, much clearer on how to proceed and I'll get back after I've:

a) Done some work
b) Confused myself totally
c) Decided I've got no idea what the heck is going on
d) All of the above

Cheers
mersenne
ThRaX
11-30-2000, 09:21 PM
I think I'm on to *something* here at last..
Looking up the API GetPrivateProfileString and WritePrivateProfile string seems to have given me *SOME* insight here on how to create a valid keyfile.

BOOL WritePrivateProfileString(

LPCTSTR lpszSection, // address of section name
LPCTSTR lpszKey, // address of key name
LPCTSTR lpszString, // address of string to add
LPCTSTR lpszFile // address of initialization filename
);

Anyhow, I searched for "WritePrivateProfileStringA" in the dead listing, and only found ONE. That means that it is only called once, obviously upon registration. Now, of course I searched a bit above the call for any paramaters being pushed, knowing that this would tell me exactly how to construct the keyfile...

:00413FA6 68C8E84500 push 0045E8C8
:00413FAB 50 push eax

* Possible StringData Ref from Data Obj ->"CRCKM"
|
:00413FAC 6888484200 push 00424888

* Possible StringData Ref from Data Obj ->"END"
|
:00413FB1 6884484200 push 00424884

* Reference To: KERNEL32.WritePrivateProfileStringA, Ord:031Bh
|
:00413FB6 FF15F0004200 Call dword ptr [004200F0]

now looking at this (in soft ice of course), I found the value at 0045E8C8 to be the file name, happyicon.lic as expected (consulting the trusty win32 api manual), the next paramater was in eax, and when I displayed the contents of EAX I found a VERY strange string, a sequence of numbers "287804711"....No clue what this is, all i know is previously in code i remember seeing something done with the value '04711', I don't remember where I saw it before though...After that the string 'CRCKM', and then the string 'END' were pushed, which is the section ([END]), and the key (CRCKM).

So looking at the keyfile it looks like this in happyicon.lic

[END]
CRCKM=287804711

any insight as to what this means would be appreciated

one more thing, why dont I find anything about writing the
[ENREGISTREMENT]
licence=********
first name=ThRaX
last name=CINARA

portion of the keyfile? I Found no reference to it whatsoever... Oh by the way I got the french version of this program, so thats why the headers are bit strange ; )

Cya later
--ThRaX
Kayaker
11-30-2000, 09:43 PM
Hiya Thrax,

Cool, sounds like you're getting somewhere. The CRCKM=287804711 is the calculated CRC value of the .lic file which the program stores into the .lic with WritePrivateProfileStringA as you found out.

As to how the rest of the stuff is written, try a string search in the .exe file with a hex editor, or a string search in Wdasm for '[ENREGISTREMENT]' and you'll find where the rest of the .lic structure comes from.
ThRaX
12-01-2000, 04:29 PM
Hey Kayaker...one thing, what exactly do you mean by the "CRC Calculated value of the licence file"?? Does this mean that the value represents the contents of the file in some encrypted manner?? (So a change of it can be detected)
Kayaker
12-01-2000, 05:05 PM
ThRaX (12-01-2000 06:29):
Hey Kayaker...one thing, what exactly do you mean by the "CRC Calculated value of the licence file"?? Does this mean that the value represents the contents of the file in some encrypted manner?? (So a change of it can be detected)

Yes.

Interestingly, it does a nifty trick in that the CRC value that is in the file INCLUDES the CRC value itself. i.e., if the algorithm was to sum all the bytes as hex in the file and write that value under [CRCKM], then that would include the number itself, but before it's actually written to the file. So it has to know what this value is before it finishes calculating the CRC!

Sorry, that probably just muddies up the idea, it doesn't really matter. If you change the CRC number or any string or add a space etc., the calculated CRC changes and you get an error message. At this point it doesn't matter what the CRC algorithm is (sum the bytes, divide by pi, whatever), the idea is to bypass it.

Kayaker
mersenne
12-03-2000, 04:24 PM
Kayaker (11-30-2000 07:27):

Let me know which of the 2 Bonus tasks you're attempting and I'll try to help. I didn't actually DO the 1st one BTW, just figured it COULD be done. Especially with knowing WHAT the keyfile was supposed to look like, I thought it would be a good exercise to pretend you didn't and go through the routine of trying to reconstruct it. Filemon would tell you that the program is looking for a file called happyicon.lic, so you create one and try to fill in the correct structure, as you normally would with a keyfile. Luckily in this program, there is hard-coded the skeleton of the structure in the exe file, so theoretically you should be able to create a valid keyfile. The CRC check just throws in a nasty little quirk to it all.

Kayaker

Hi Kayaker,

I am trying the 1st approach, trying to create the .lic file from scratch. I'm trying to do it logically like I really didn't know what the program is looking for. I must admit it is hard not to make assumptions once you already know the answer :)

OK, it is easy enough to figure out that the program is looking for a keyfile. I created one of 100h bytes and filled it with 01. The readfile operation sorta chokes at this point and the task needs to be killed (via procdump) to try again. This makes sense as the keyfile is wrong. I guess at this point I would try to disassemble the file and look for some clues relating to the .lic file or trace the code after the readfile instruction.

mersenne
Kayaker
12-03-2000, 11:48 PM
Hi Mersenne,

Yeah, it is hard to forget about preconceived notions of what the license file is supposed to look like. In fact, a valid .lic file can be just 2 lines long! Faking amnesia, here's one way to go about it.

Filemon or APISpy tells you that it's looking for a Happyicon.lic file. Create one and put a bit of junk in it. Now Filemon says it wants to read 4096 (1000h) bytes of this file, but the program gets locked up in a loop somewhere. CTRL-ALT-DEL kill the program and try creating a file of the correct size. Same problem.

Try a String Ref search in W32dasm and notice refs to suspicious entries like "DO NOT MODIFY", "[SOFTWARE]", "CRCKM=". Exescope doesn't show up any of these strings. Search for them in the exe file with a hex editor et viola,

00024728 5B45 4E44 5D0D 0A00 0A0D 0A0D 0A00 0000 [END]...........
00024738 7665 7273 696F 6E3D 0000 0000 6C6F 6769 version=....logi
00024748 6369 656C 3D00 0000 5B53 4F46 5457 4152 ciel=...[SOFTWAR
00024758 455D 0D0A 0000 0000 0D0A 0D0A 0000 0000 E]..............
00024768 6C61 7374 206E 616D 653D 0000 6669 7273 last name=..firs
00024778 7420 6E61 6D65 3D00 6C69 6365 6E63 653D t name=.licence=
00024788 0000 0000 5B45 4E52 4547 4953 5452 454D ....[ENREGISTREM
00024798 454E 545D 0D0A 0000 0D0A 0000 3B0D 0A00 ENT]........;...
000247A8 3B44 4F20 4E4F 5420 4544 4954 0D0A 0000 ;DO NOT EDIT....
000247B8 3B44 4F20 4E4F 5420 4D4F 4449 4659 0D0A ;DO NOT MODIFY..

Note that 0A stands for LineFeed LF and 0D for CarriageReturn CR. Try extracting this hex into a new file and save it. Hmmm, doesn't look quite right. Try removing all occurrences of "00". This gives a text file which looks like:

------------------------------------------------
[END]

version=logiciel=[SOFTWARE]

last name=first name=licence=[ENREGISTREMENT]

;
;DO NOT EDIT
;DO NOT MODIFY
-------------------------------------------------

Not bad, we can logically add CR's after the "=" signs and we KNOW that the key in square brackets in ini files are supposed to be first, so we can turn the whole thing upside down and get something pretty close to the correct structure. Program still hangs, so we need to get in there with SoftIce.

on to Part II...
Kayaker
12-03-2000, 11:49 PM
OK, that's one way to start, but let's say we couldn't even figure out that much about the .lic file. Create a file of 1000h bytes, fill it with some byte and break on ReadFile. Do a 'BPM address R' on the 2nd stack parameter after ReadFile returns (for me it was 01594240), SI breaks and you can trace to a loop at:

:004167A9 DEC DWORD PTR [ESI+04]
:004167AC JS 004167B8
:004167AE MOV ECX,[ESI]
:004167B0 MOVZX EAX,BYTE PTR [ECX]
:004167B3 INC ECX
:004167B4 MOV [ESI],ECX
:004167B6 JMP 004167BF
:004167B8 PUSH ESI
:004167B9 CALL 00419ED1
:004167BE POP ECX
:004167BF CMP EAX,-01
:004167C2 JZ 004167DA
:004167C4 MOV [EDI],AL
:004167C6 INC EDI
:004167C7 CMP AL,0A
:004167C9 JZ 004167D0
:004167CB DEC DWORD PTR [EBP+0C]
:004167CE JNZ 004167A9

The 1st thing you should notice is the :004167C7 CMP AL,0A line, always important to keep an eye out for when reconstructing keyfiles. Since 0A stands for CR it seems the structure of the .lic file should have some line breaks rather than being one complete byte sequence. I usually create a file like this

Line1
Line2
Line3
etc.

so you have some idea of which line is being worked on. Modify .lic and the above code continues to

:00410F30 CALL 0041678C
:00410F35 PUSH 06
:00410F37 PUSH 004242C8
:00410F3C PUSH 00460580
:00410F41 CALL 0041F520
:00410F46 ADD ESP,18
:00410F49 TEST EAX,EAX
:00410F4B JZ 00410FA9

Display 4242C8 and you see the string "CRCKM=". After the Call 41F520, EAX = 1. If you were to R FL Z the jz you'd get the "License file has been modified" MessageBox. NOW we're getting somewhere. So change "Line1" to "CRCKM=", enter a value for it (numbers or letters doesn't matter because you don't know this is a value for a CRC check at this point). Now EAX = 0 and the program continues to the next step.

If you've tried the CRC check task you'd recognize the next code by its calls to the FPU registers. At this point you don't really know this though so you trace on. There will be an obvious Jump which you'd probably do a R FL Z on at some point while trying different things and you'd find this brings you to a GetPrivateProfileStringA call where the key it's looking for is [END]. Either a leap of faith or a few other clues tell you that - "Aha, so 'CRCKM=' must be under an '[END]' key", so update the .lic file to show this.

Continuing, you find a comparison between your value of CRCKM and some other value. You enter this value instead and whaddya know, a valid license file!

So, being dumb as to what was really going on, we can come up with a valid .lic file, though it doesn't have any of our reg info in it as the About box shows. I suppose one could trace from selecting the About menu item and see where it gets the info from and perhaps relate that back to the .lic file. If one cared ;)

Hope this makes some sense,

Kayaker
mersenne
12-04-2000, 04:19 PM
Hi Kayaker,

Yes, it makes perfect sense. I have had a go and made it some way down the path you just described. In summary; I created a 100 byte file which of course doesn't read it properly. Set breakpoint on CreateFileA and the call to the lic file is the sixth one in. Breakpoint on ReadFile and then trace will show that the file contents are processed under it find the linefeed character 0A (yeah I found it too :) ) It then compares what it just found to the string CRCKM=. So add that to the start of the lic file and rerun. The file will now read in and we get the "modified lic file" message. We get to the GetPrivateProfileString call and find out that it is looking for the section name END in the lic file. Add it to the file in the manner you described and we get down to the checksum calculation, check the comparison and put that value as a checksum in the file.

This bit didn't work for me but I also didn't have the rest of the structures in the file the way you added them. I'll need to examine this a bit closer but I'm pretty happy that I got to where I did.

I noticed there is some another keyfile practice in session, so I'll have a go at that too.

Thanks Kayaker for your help and patience

mersenne
Clandestiny
12-11-2000, 01:15 PM
Hi,

Been really busy this past week, but I finally got a chance to start working on the keyfile part of Kayaker's project. I found much help / advice in the above posts, but I still seem to be having a few problems. I have created the happicon.lic file and filled it with 4096 bytes after examination in filemon. Also, as was per mentioned in an above post, the program hangs up and must be killed. Looking in Wdasm, I find the reference to WritePrivateProfileStringA...and proceed to try to examine it in SICE. Here is my puzzlement and problem...

1) Examination in API spy does not list a WritePrivateProfileStringA or a GetPrivateProfileStringA call. It actually lists 2 other calls...a)CreateFileA -->happyicon.lic which makes sense and b)WritePrivateProfileStringW --> what exactly is the difference between the W and A version of these calls? Anyway, it seems strange that the function would show in Wdasm but not in APIspy (unless it is because the program gets locked up?).
2) SoftIce will not break on either these functions or the addresses shown in Wdasm (also presumably because the program gets locked up?)

Is there no way to examine this part of the program in SoftIce or am I just overlooking something???

Thanks in advance,
Clandestiny
Kayaker
12-11-2000, 08:03 PM
Hi Clandestiny,

You're right in that APISpy doesn't see the GetPrivateProfileStringA call because the program gets locked up in some loop trying to read the .lic file if it's not in some kind of correct format yet. You need to trace solely with SI in this case and figure out how to modify the file so it continues to the next step. When you have a couple of critical entries in the file, THEN you reach GetPrivateProfileStringA.

If you use the "real" .lic file produced earlier you should see the proper API calls. As for the "W", I believe that refers to Unicode strings. Don't know what that could have been. What ini file did it refer to?

Kayaker


Unusual UnPackMe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Unusual UnPackMe
PDA

View Full Version : Unusual UnPackMe

NchantA
11-20-2000, 07:36 PM
lo all

this goes out to newbies and oldies alike ;)

http://www.crosswinds.net/~nchanta/trnr_cme.zip

please have a go, and dont be afraid to abuse me in a post.

NchantA
NchantA
11-20-2000, 07:56 PM
err. i personally wouldnt refer this unpackme to the true newbies, i would however like you advanced crackers that sometimes look in on the rest of us, to have a look at it ;)

and maybe even show me why i cant unpack my own damn unpackme eheehhehe *g*

have funnnnnnnn

NchantA
Kayaker
11-20-2000, 11:09 PM
Hi Nchanta,

So you're looking for abuse, eh? ;)

Well I haven't unpacked it yet, but I did find the process in memory it's looking for (or at least I found SOMETHING ;d

So, no nag, straight to the splash screen. I have a question though, I'm not familiar with trainers, is the 'Apply Memory Changes' supposed to do anything in your unpackme or is it just there for show as it seems? Does this button normally, well, apply memory changes in a real trainer?

Pretty cool. I'll work on the unpacking now, but I'm not holding my breath on figuring that one out... One more question. Couldn't you have loaded a few more system functions? I think you missed a couple of the Audio Compression Codecs ;)

Cheers,

Kayaker
NchantA
11-22-2000, 07:01 AM
ehehe arguements sharpen the mind ;)

ok well, the trainer was a novel idea (not entirely my own) one of the reasons i included it here. and i *was* going to submit this too the reversr forum but this is the mini project area, it says nothing about newbie project ;)

and it is a small project so it fits the forum quite well

it search's for a dummy process on start up, patching shouldnt be hard, but i did have trouble unpacking myself! ;)

its packed with neolite if that helps :D

im not sure what u want about the audio codecs??

and the apply changes in a real trainer *would* do something to the game yes, it could be fun to reverse hehe ;)

NchantA
NchantA
11-22-2000, 07:02 AM
i just realized i do this way to much ;)

hehehehehehe
SV
11-22-2000, 07:27 AM
Hi

I have a working unpacked exe except splash bitmap :-( and have found something too !!
I have really big prob with this splash bitmap.
How is it loaded in dialog ? Only in rsrc ?
I have saved a right bmp file (at least).

Thx SV
Kayaker
11-22-2000, 04:42 PM
Hi SV,

I seem to be having a problem with the Splash screen as well. I got what I thought would be a working dump (JMP EAX in .crypt section, EAX = OEP in .text section) and the program runs fine. The problem is that the file size is only 224K and all it does is display the Splash screen, and without any image...

In Exescope the Splash screen Dialog Resource (ID 102) is there. You can edit a few things with it (Titlebar etc.) and it responds. FindResourceA with lpName properly points to it (66h = 102) and is called a few times. But there just ain't no image associated with it!!

So this was packed with what? AsNeolite? ^_^

Nchanta, I was joking about adding a few more functions via the codecs because it seemed you had loaded just about every other system dll via LoadLibraryA and GetProcAddress just to make things nice and confusing ;)

Kayaker
Kayaker
11-22-2000, 07:09 PM
OK, I sort of figured out what's going on. The program maps itself into memory with MapViewofFile then starts unpacking itself. If you trace for a while after this break and display the Virtual Offsets of each section you see them being unpacked at address 451D70 (and within that call at 45220A) each in turn -
.text 400000 - 423000
.rdata 423000 - 42B000
.data 42B000 - 42D000

There's one more Call to 451D70 for the .rsrc section but it seems to be unpacked into scattered parts of memory there and later. i.e. 470000 - 480000 contains some of the good stuff, the memory around 4F4F90 contains a ref. to "Nchanta" and a few of the string resources, etc.

I think if we could get a good dump of the .rsrc section it could be appended to a dump of the 1st 3 sections and work OK. I just haven't figured out where to dump the good bits.

Kayaker
NchantA
11-22-2000, 08:23 PM
hehe

a very unusual problem yes?

a simple splashscreen can cause so much problems

ah yes, kayaker, i notice the aha joke now ;P i dont usually find 'needle in the haystack' approach is worth using, but in this such experiment it proved usefull

keep going ;)

NchantA
90h
11-24-2000, 08:16 PM
I have extract the splash screen from the crackme and find out which proccess the crackme wants to be loaded. The splash screen is at 47009Eh(Virtual Offset) size 84E76h(aka 531kb) and it has a BMP Header so i do not think it in the .rsrc sectionas. Far as i know all bmp in .rsrc have no header(that not 100% ture they can if you like).

PS.
What is a easy program to unpack? Then i will come back to this program. Kayaker thanks for the info will have to look in to.
NchantA
11-25-2000, 05:45 AM
http://csir.cjb.net is a good place to go for packing related stuff
http://zencrack2.cjb.net rox aswell

hi r!sc :)

NchantA
Kayaker
11-25-2000, 06:06 AM
Hi 90h,

Your info on the size/location of the bmp makes sense. I have a dump of size 85029 addressed at 470080 which I got during the Neolite unpacking phase. The 1st 1E bytes contains a header which includes what seems to be an encryption string, the next 84e76 as you've confirmed is the bmp itself, which can be dumped and viewed, and the last 195 bytes contain more encryption strings associated with the rest of the resources. This seems to account for the whole of the "lost resources".

These 'encryption strings', for lack of a better term, seem to be associated with each resource. i.e. *!mai!**!ScN!* seems to be associated with the Splash Screen bitmap, *!mai!**!MiS!* is associated with the 2 MessageBox strings, *!mai!**!but!* with the Apply Memory Changes' and 'Quit' buttons, etc.

I unpacked the program manually following a standard Neolite procedure, tracing until code similar to the following (may need to set a MapViewOfFile to break into the program initially)

MOV EAX,[ESP+04]
AND EAX,[xxxxxxxx]
CALL xxxxxxxx
INC BYTE PTR [xxxxxxxx]
JMP EAX ; eax is Original Entry Point of program = 40F2D3

set a jmp eip at the JMP EAX, F5 out of SI, full dump with Procdump, change Entry Point. Check out the tut by Eternal Bliss for an example with Notepad:
http://www.woodmann.net/fravia/text/eb_tut32.txt

I also dumped the unpacked memory image with TRW PEDUMP. In both cases the program ran OK but just shows a blank splashscreen then sits there. All resources except the icon, some default string resources, and some DialogBox templates are missing.

There's a call 0040EF00 statement which is used several times at different addresses which seems to make use of these encryption strings somewhere during the FindResource / LoadResource / CreateDialogIndirectParamA phase of the program. You can do a String Ref search in W32dasm for them or set a BPM on the strings in SI (i.e at memory address 470080 for the 1st one, 484E96 for the rest).

Why the encryption strings? Well, there's also a ref in the dumped exe file to Inflate 1.04 by Mark Adler. Turns out this is a GNU program used to 'inflate' compressed files. The public source code is now part of Info-ZIP software.

My thought was that Nchanta "borrowed" some of the source code and it is being used somehow to 'inflate' the corresponding 'deflated' resources. Though this doesn't really make sense in a way because the resources aren't actually compressed, just sort of separate from the regular exe structure. I looked briefly at the source code and there's no indication of these funny encryption strings, so I may be off-target here. ???

I've tried inserting the whole 85029 byte 'resource' structure into the dumped file in various ways and succeeded in getting the Apply Memory Changes and Quit buttons to show somewhat ghostly in the splashscreen, but that's all.

Assuming the code to deal with these encryption strings (if that's really what they are) is OK in the dumped file, then it *should* just be a matter of proper addressing of the bmp, messagebox and dialog box resources as a unit.

This is all fine in theory, but I still haven't put Humpty back together again. If Nchanta is being truthful in that he hasn't been able to unpack the file successfully himself, perhaps he may want to enter the discussions? ^_^

Regards,

Kayaker
90h
11-25-2000, 03:49 PM
thanks NchantA and Kayaker. Cool i was right about the JMP EAX is a jmp to the original code.
90h
11-26-2000, 01:44 AM
With bad/good luck i got it unpack with a splashscreen(but that's all). What i did was a standard Neolite dump. Then made a dump at 470080 size 85029(like Kayaker said). Add 85029 bytes with topo to my main dump then add the 470080 dump over my new bytes then run a test run(had a splashscreen). Yes it a bad dump but was makeing i for testing.

This what i was trying to do is use PEditor to add a new section with a VA of 470080(i do not think you can jump from 42D000 to 470080 now) then add 470080 dump to end of File. Did not work so i use topo to add the byte(/section) to it and was going to reedit with PEditor(but b4 i did that i run it).

Kayaker how did you get Apply Memory Changes and Quit buttons?
90h
11-26-2000, 05:07 AM
I did a new dump 470080 from 40D9E5(well a BPX 40D9E1 and i think the 2nd time) size 85F80h and add it to the end like i did b4 done it run find but it not 100% unpack i have a section .crypt! that i can not delete at this time.
Kayaker
11-26-2000, 07:08 PM
Hi 90h,

I tried padding my dumped (TRW PEDUMP) file up to 70080h with zeroes, then adding a new section of size 85029 which contained the bitmap and other resource info. That's how I got the Apply Memory Changes and About buttons to show, but it's crap, not a good solution and the file is over 900k in size.

The Splash screen is a separate class in itself (Afx:400000) which uses a SetTimer value of EA60 (60000 msec) to destroy itself if you don't click on it. It's created within a CreateDialogIndirectParamA call which also creates the rest of the controls. Beforehand it's control class is registered with GetClassInfoA and RegisterClassA.

This all falls apart in the dumped file, GetClassInfoA on the Splash screen class fails and of course it's never created. I'm trying to figure out where in memory the program is looking for certain information. I don't know if the answer lies just with adding and correcting the pointers to that 'resource' dump, or whether there's a problem in the .crypt section as well.

Cya,
90h
11-26-2000, 08:23 PM
My dump(size 760k) has a Splash screen(timer works too) and Apply Memory Changes and Quit buttons....(like it was win it was pack). But i have .crypt section.(and i can not delete/0 that section)

PS
size 85F80 was only a test my new one is 85029(and work find too)
90h
11-26-2000, 08:41 PM
2 more thing the Import Table may b bad(program may only run on the pc it was unpack on...) in IDA(v4.14) i have 2 _crypt_ section the 1st _crypt_ has a list of dll/api. In Procdump i have 1 .crypt section.


Project #3 - Question to Kayaker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Project #3 - Question to Kayaker
PDA

View Full Version : Project #3 - Question to Kayaker

JaneK
11-21-2000, 04:12 PM
Hi Kayaker,
First of all thanks for this learning opportunity. Now the question:
I started to look at HappyIcon using softice from the beginning. After setting a nice (I think) bpoint I traced through what I believe is a registration routine. Looking at the code I forced a jump where I thought the prog should do so. After few more calls I was kicked back to HappyIcon and it was registered all right! In the "About" menu I got the following:
License: (My code)
Granted to: (My name, name).
Ok, I said, I'm on the right track. I restarted the prog to work more on it but it was still registered! I restarted my computer and it is still registered!
I have to say I'm a bit lost now. Not only I don't know how to unregister it but also I don't understand why a small cheat with the zero flag became a permanent patch.
May be you or someone can give me a hint.

Thanks
JaneK
Kayaker
11-21-2000, 05:37 PM
Good work JaneK, you figured out the trick ;)

That's exactly what happens, the s/n is only checked once, if it passes (by R FL Zing that jump), then the reg info is written somewhere and as long as that info remains intact, you're still registered.

By using Filemon or looking in the program directory you should be able to find where the info is written. You can just delete/rename the file and you're no longer registered and you're back to square one.

What I wanted in Task 2d was for people to trace immediately after doing the R FL Z just to see the API calls used to write that info and how it's done.

The problem is if you change a byte in the file created. That's where the CRC check lies. When this file is read in on the next startup it goes through a CRC routine and if it doesn't match the value that was initially calculated after you did the R FL Z and written into the file, you get an error message.

The CRC calculation routine itself is quite complicated (lots of FPU register activity) but if you can ignore the forest for the trees, the actual final check is simply a small byte for byte CMP comparing the CRC value written in the file and the one just calculated.

While some CRC checks can be tough (CRC is used here interchangably with Checksum since it may not be a true CRC-type check), many still seem to boil down to a black box kind of thing where there's a simple compare no different from any other.

If you change the file structure TOO much however then it may crash out earlier than the CRC nag, but changing a byte or two will be OK to try to trace it.

Regards,


Pls clarify
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Pls clarify
PDA

View Full Version : Pls clarify

JaneK
11-26-2000, 04:24 PM
Hi Kayaker and others,

It was not too difficult to both patch the program and find correct serial for my name. I have however some problems to understand how the correct serial is generated.
After the new string "FirstnameHappyIconName" is created (at 0041409D I think) various string operations are performed (moving between memory locations, scan for blanks etc). then at 004140D9 I find first character of my "Firstname" in cl and a test cl, cl is performed. In my case the result is not equal, so I do not jump here thus entering a routine that is processing one by one each character of "FirstnameHappyIconName" string until end of string is found, so until at 004140FA I do not jump.
Then my serial appears in edx, correct one is found at 00414116 in ecx (in hex) and if equal I jump to registered.
My doubts are:
1. test cl, cl at 004140D9 - what is it actually doing and when the result will be equal? (so we jump and bypass the procedure between 004140DD and 004140FA).
2. what is really happening between 004140DD and 004140FA? What is the outcome of this loop?
3. what is the call at 00414104 doing? I tried to trace it but without success - I only found some kind of check for strange characters like "-", "+" etc.

Hope someone will find time to answer :)
Thanks
JaneK
Clandestiny
11-26-2000, 09:41 PM
Hi JaneK,

Maybe I can help :-)

My doubts are:
1. test cl, cl at 004140D9 - what is it actually doing and when the result will be equal? (so we jump and bypass the procedure between 004140DD and 004140FA).

You are right about there being many string manipulation operations prior to this instruction (stosd, movsb, scansb...ect) and the fact that the first character of the first name is loaded in cl at the test cl,cl instruction. This test cl,cl instruction is testing for a zero value in cl and since cl holds the first letter of our name we can probably assume it is testing for the NULL (0) end of string character. Possibly it is checking if the user has entered an actual name or if they left it blank. As long as you enter a name, this value in cl will never be 0 and you will never bypass the procedure between 004140DD and 004140FA.

2. what is really happening between 004140DD and 004140FA? What is the outcome of this loop?

Well, this loop is performing an algorithm on "FirstnameHappyIconName" and it is at the *heart* of the protection scheme. Try to figure out this little snippet of code, but if you get stuck take a look at my explanation and key gen under Project #3 TASKS 3&4.

3. what is the call at 00414104 doing? I tried to trace it but without success - I only found some kind of check for strange characters like "-", "+" etc.

This call is also at the heart of the protection only this time an algorithm is being performed on the serial you entered. Trace a little further past the "strange character" checks until you get to the code between 004163C8 and 004163F7. This is where the second part of the mystery of this key gen resides ;)

Hope this Helps...

Regards,
Clandestiny
mersenne
11-26-2000, 10:51 PM
Hi JaneK,

The call at 414104 converts the key you entered into hex, check eax after the call. The only reason I recognised this quickly is that I've run across this sort of thing before and because I generally use the same serial value for all my reversing, I know what it is in hex!

I have just posted a detailed description in the Task1&2 section with some commented code that may help. Then you can see how Clandestiny's key gen works.

mersenne
JaneK
11-30-2000, 12:44 PM
Many thanks to both of you.
All clear now.

Janek


Task 4 CRC hints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Task 4 CRC hints
PDA

View Full Version : Task 4 CRC hints

Kayaker
11-28-2000, 06:51 PM
Hi All,

Everyone seems to be doing great with this Project and there's some good learning and understanding going on. I'm really pleased. But I don't hear much CRC noise ;)

So...

By now everyone's figured out that the program creates a Happyicon.lic file in the program directory if it's successfully registered (by fair means or foul :) If you modify even one byte of the .lic file you get a nice "The lic file has been modified !! 1toX cannot run" message.

Don't worry about the 1toX business, that's actually another program by the author and he obviously didn't change the code to suit HappyIcon...

At its simplest, a CRC (Cyclic Redundancy Code) check, well really just the most basic Checksum I could think of, might be to add all the bytes in a file as hex and compare this value with the one it's *supposed* to be. If they don't match, the file has been altered.

In reality they are much more complicated than this and you could read A PAINLESS GUIDE TO CRC ERROR DETECTION ALGORITHMS by Ross N. Williams, somewhere on the Net, as a start.

Often, what will happen is that a program will Read its exe file in as a regular file (since the program is already mapped into memory it can do this), and pass it through some CRC algorithm routine. It might be on the whole file or just parts of it. If you've patched the program it will likely fail the test.

This program does the same thing except that it only reads in the .lic file. If you were to trace the code after the critical regged/not regged jump (this was Task 2d!), or use an API monitor on it now if you've patched the jump so it always produces a .lic file, you'd see that the program goes through 2 sequences to write the file.

First it uses CreateFileA, WriteFile and CloseHandle to write the basic information into the file. It gets the structure of the file from the .exe. If you do a search for say the 1st line, "DO NOT MODIFY" you'd find it hard-coded in the file.

Then it uses CreateFileA and ReadFile to read the file back in, calculates a Checksum, which actually includes the Checksum value itself, closes the file with CloseHandle since it can't be written to if it's previously open, and then writes the Checksum value with WritePrivateProfileStringA.

This should give some indication of how to monitor for the CRC check on program startup.

CreateFileA DO "dd esp->4" will display the name of the file which is to be read in (Happyicon.lic is the one of interest) in the Data window. "dd esp+4" would display the 1st stack parameter, or the pointer to name of the file, "dd esp->4" displays the contents of that address.

ReadFile DO "dd esp->8" will display what has been read into the buffer that receives the data once you've F11 returned.

GetPrivateProfileStringA is used to retrieve the CRC value which was written into the file. The destination buffer for the function is the 4th stack parameter, the sequence being esp + 4, 8, C, 10, 14, 18, 1C...

These 3 Calls should be enough to trace the CRC check to the simple jump which will bypass it and avoid the MessageBoxA (which is another breakpoint you can sometimes make use of).

Finish this part and the Fat Lady can sing... ^_^

Cheers,

Kayaker
()whore
11-29-2000, 01:30 AM
Well with all thoes hints not hard to find

00411084 call 0041f520
...
0041108c test eax,eax
0041108e jz

changeing the jz to a jmp will avoid a bad CRC check. So will noping the call. Or you could change some bytes in the call so it allways return 0;
I traced through the CRC calculation which started by adding all the bytes in happyicon.lic together then preformed alot of floating point math operations on it to arrive at the final number.

cheers
ThRaX
11-29-2000, 11:31 PM
Heh, disagree, I say those hints make it *POSSIBLE* to consider *ATTEMPTING* to do this task ;D Its still a challenge for me. (though I guess im more newbieish than most)

Doesn't make it *EASY*, though

I need to *STOP* putting all my *WORDS* in these damn *STARS*...
;)

--ThRaX


TalkPCR Key File Project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > TalkPCR Key File Project
PDA

View Full Version : TalkPCR Key File Project

Timmy
12-01-2000, 11:56 AM
This project is ideal to wet newbies heads with a program that uses an unknown binary file and not a serial number that you type in to register a program.

TalkPCR (V2.4) is a good radio scanner control program and it uses a key file for registration. Luckily (as far as I know) there are no cracks for this program on the net so it has to be tackled totally from scratch. It is a Delphi 3 program and as it requires a key file, there is no registration box. The task is to create a key file that would be placed in the programs directory and would make the program run in registered mode.

The key file is specific to the computer the program is run on (according to the author), but he has left a check for a master key file that he must have used when testing the program. The master key file (this will allow the program to run in registered mode on any computer) and the computer specific key file are almost identical, so creating a master key file is the object (slightly easier than the computer specific one, but this can be done once you fully understand what the format of the key file is and how it is manipulated within the program).

Tips to start with:

Run the program and use filemon to see what the key file name the program is looking for.

Create a file with this name and repeat the above step.

This will tell you the size the key file is supposed to be.

Modify the file you have created so that it is the correct size.

IDA is the best disassembler to use for this program (but is not absolutely necessary), disassemble the program and use the signatures B3VCL and B32VCL. This will make the task in hand a lot clearer. Once disassembled, you will be able to search for where the key file is loaded into memory and what happens next.

You need to set breakpoints in Softice where the key file is loaded and also where the manupulation routines do their work. Do not rush, take it one step at a time - one part leads nicely on to the next. The first manipulation routine is easy and the second is straight forward once the penny drops.

The easiest way to create the key file is to write a small program to do it for you. Once you know what is going on in the second manipulation routine this is fairly easy.

The key file should contain a user name (not necessarily the computers registered owner name for the master key file), a serial number (actually any text will do) and whatever other information the program requires - you will see what this is as you reverse the program. Also the key file should contain data that will tell the program that the registration date is the day on which you finally cracked the program (and not the default of 30/12/99).

Have fun, this is an interesting project and will teach you how to create, from scratch, an unseen binary registration file. The download URL is:

ht*p://www.mahy.demon.co.uk/TalkPCR/TalkPCR.htm
hz
12-01-2000, 12:57 PM
hi timmy,
Now this is getting interesting. I have only
managed two or three keyfiles and one of
those I had to patch. Btw, you have succeeded in creating the keyfile yourself, have'nt you?.
regards
hz
hz
12-01-2000, 03:36 PM
hi,
filemon or apispy show no sign of it trying
to open a keyfile. I disassembled it with
WDasm and saw a reference to a key, so
I tried with talkprc.key and talkpcr.reg but
still nothing. ?
regards
hz
Kayaker
12-01-2000, 08:16 PM
Hi Guys,

Dumb question for you Timmy. This program is supposed to do what? You plug a radio scanner into your COM port? The docs are kind of sketchy... I wanted to test out the EEPROM demo disabled function but it seems without a scanner that part is always in demo mode. Are there any other demo restrictions?

Hi hz, you've got the correct filename Talkpcr.key and it should show up in both Filemon and APISpy. APISpy will tell you the size it will be looking for. The way it checks in the program that the required file size is correct is using the difference in the value of the stack pointer ESP before and after the ReadFile. Kind of a neat trick actually. I thought GetFileSize would be used, especially since there's 4 refs to it in the disassembled code, but it's not.

I haven't generated a keyfile, but with the correct size of a fake one and a single jump patch, the program thinks it's registered (gives Pre-registered status in the About box, so this may not act as a Master key). That's why I wanted to test if it's truely out of demo mode.

Kayaker
hz
12-01-2000, 09:28 PM
hi Kayaker.
thanks for the reply, yeah I got a patch
too, there's a place you can patch that
appears to be full regged. Still no luck with
apispy. I only installed apispy yesterday so
maybe I need something in one of the lib files, then again it shows all the other files.
Getfilesize would show up would'nt it?, I mean if the prog checked the size and it was'nt right then don't even bother to read it. As for what its for, I was under the impression it worked thru your modem.
I never even looked at the docs though.
regards
hz
Timmy
12-01-2000, 10:38 PM
I'm on windows 98 BTW. Using filemon, the program looks for TalkPCR.key, if it finds it, it tries to read 768 (300h) bytes and then starts playing with what it loads. I have gone a long way with this app so any questions with references to specific bpx's and/or memory locations, I hopefully should be able to help.

If you haven'y got a scanner connected it will still come up with the box asking you if you want to run in "Demo" mode (or whatever) - but this is not the point. The object of the exercise is to create a key file so the program misses out the first nag screen (NOT WITH PATCHING) and when you click on help/about you see "Pre-registered to" - any name, "Serial No", whatever, and "Date Registered" (the date you cracked it) with the fields that you have entered in the key file.

hz ... Filemon on the first pass looks for TalkPCR.key, then (when you have made a file with this name) it then shows that the program reads 768 bytes from this file (this IS actually the total length of the file).

Kayaker ... As far as I know the only demo restrictions are the initaial nag screen and then periodically a reminder pops up telling you that the prog is unregistered (I could be wrong here).

Once you know where the key file is loaded it is then decrypted (or should I say - rearranged) to another memory loction (look slightly above in the softice data window - {edx and eax are marvellous pointers} ). The key file is then really decrypted (the interesting part - starts at CS:004ca611), and copied to yet another memory location. Later there are calls to a function (xx4xxc7c) - very interesting. A basic explanation of this function to follow if required.

REMEMBER - It is NOT a program patch that is required, only a valid key file that will allow the program to run in non demo mode (the help/about window will verify this).

hz ... I have a valid master key file and the source to create it (to be posted as and when), the next step after figuring out what is going on in the "second" decryption routine is to post a message explaining what is happening in this routine. I will then (hopefully) help with the next step.

If a key file specific to the computer that the program is running on is used instead of a master then the "Pre-registered" bit changes to just "Registered".

It might just be me but when you get deep into this one, the process of generating a key file becomes obsessive.

It's just my opinion, but the newer you are to reversing, the deeper you go for solutions. I have found that stepping into most calls is mostly a waste of time, that is why I suggested IDA for the disassembler and to use the two signatures - I know IDA is very difficult for newbies and experienced alike but if you are used to WDASM try to use IDA once you have cracked a target and eventually you will see IDA does an outstanding job.

Feedback ?
hz
12-01-2000, 11:29 PM
hi,
got it sorted now, probably should'nt say this but I left the 'r' off th end of the keyfile name (embarrased). Think I'm doing too much at once, bouncing betwen this
and two others. Btw Kayaker if you fancy
a challenge when your not busy, try advanced catalgouer h*ttp://acat.hypermart.net. its packed with upx, easily unpacked with procdump, I've been banging my head with this all night.
regards
hz
Timmy
12-04-2000, 08:09 PM
Since it's become quiet I guess I'll post my source for the TalkPCR.key generation in pascal. (I use pascal and/or Delphi as ,for me anyway, it is very easy to read and understand when I come back to it later).

var
OutFile : file;
FileBuffer,
Buffer : array [$01..$300] of byte;
X,
Y : integer;
RegisteredOwner,
SerialNumber,
RegType,
KeyType,
RegDate : String;

begin
for X := $01 to $300 do
Buffer[X] := $00; { just a filler byte }
RegisteredOwner := 'Timmy';
SerialNumber := ' Don''t need one';
RegType := 'TalkPCR registration key';
KeyType := '_Master___';
RegDate := '336';

for X := $01 to length(RegisteredOwner) do
Buffer[X + $294] := ord(RegisteredOwner[X]);
Buffer[X + $294] := $00;

for X := $01 to length(SerialNumber) do
Buffer[X + $83] := ord(SerialNumber[X]);
Buffer[X + $83] := $00;

for X := $01 to length(RegType) do
Buffer[X + $03] := ord(RegType[X]);
Buffer[X + $03] := $00;

for X := $01 to length(KeyType) do
Buffer[X + $1BB] := ord(KeyType[X]);
Buffer[X + $1BB] := $00;

for X := $01 to length(RegDate) do
Buffer[X + $13B] := ord(Regdate[X]);
Buffer[X + $13B] := $00;

FileBuffer := Buffer; { Twin bit rotation routine }
for X := $01 to $100 do
begin
if FileBuffer[X] and $02 = $00 then Buffer[X + $100] := Buffer[X + $100] and $F7
else Buffer[X + $100] := Buffer[X + $100] or $08;
if FileBuffer[X] and $40 = $00 then Buffer[X + $100] := Buffer[X + $100] and $7F
else Buffer[X + $100] := Buffer[X + $100] or $80;

if FileBuffer[X + $100] and $08 = $00 then Buffer[X + $200] := Buffer[X + $200] and $FE
else Buffer[X + $200] := Buffer[X + $200] or $01;
if FileBuffer[X + $100] and $80 = $00 then Buffer[X + $200] := Buffer[X + $200] and $DF
else Buffer[X + $200] := Buffer[X + $200] or $20;

if FileBuffer[X + $200] and $01 = $00 then Buffer[X] := Buffer[X] and $FD
else Buffer[X] := Buffer[X] or $02;
if FileBuffer[X + $200] and $20 = $00 then Buffer[X] := Buffer[X] and $BF
else Buffer[X] := Buffer[X] or $40;
end;

X := $01;
Y := $01;
while X <= $100 do
begin
FileBuffer[Y] := Buffer [X];
FileBuffer[Y + $01] := Buffer[X + $100];
FileBuffer[Y + $02] := Buffer[X + $200];
X := X + $01;
Y := Y + $03;
end;

AssignFile(OutFile,'TalkPCR.key');
ReWrite(OutFile,1);
BlockWrite(OutFile,FileBuffer,$300);
CloseFile(OutFile);
end;

end.
goatass
12-06-2000, 12:27 PM
Timmy, it was nice of you to post a new project but this one is way too complicated for newbies, notice only you and kayaker understand what's going on from the 3 total people that posted comments about it. There is a enc/dec envolved in this keyfile and it uses Delphi so there are alot of extra useless code that newbies have to fish through which makes learning that more difficult.

For now lets stick with simple serial protections and move on from there. We are trying to teach people not overload them with new stuff.

p.s. You should pass your project ideas by the modorator of this board first.

Don't take this the wrong way I have nothing against your project I just think it's way too difficult for newbies, Kayaker's project was on the border line it involved too many things but they were not too complicated to understand so it succeeded.

Goatass
Timmy
12-06-2000, 06:35 PM
I see what you mean. It maybe a good idea to delete my keyfile posting and save the project for a later date if it is required. I know not everyone agrees but I do think that writing a keygen or keyfile generation routine as part of a project is necessary though. This is because by definition a newbie is just learning the basics of reversing and I would hazard a guess that most are not experienced programmers and if they can write a keygen (in a high level language - as opposed to pinching bits of code from a target) it gives the reverser a total understanding of the protection of the target and helps them learn to program as well.
As for the part about stepping through unnecessary code, thats where IDA became very useful with TalkPCR. Maybe a project could be started that utilises a particular tool so that the project is not just about cracking a target but also teaches about using a tool as well. Like you say, it might be a bit soon for this but a consideration for the future?

If I come up with anything else how do I reach the moderator, just email the +Sandman ?
goatass
12-08-2000, 10:03 AM
Hi Timmy, I agree with your point of view as well, and yes I think we could use your program in a later project for sure.

You could e-mail me your project and we could coordinate with the others about what project should be done first.

Goatass


newbies responses to the projects
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > newbies responses to the projects
PDA

View Full Version : newbies responses to the projects

goatass
12-06-2000, 12:38 PM
Hi everyone,
I wanted to see what people think about the projects posted so far. We had a simple serial protection program that was easily figured out by all participants. The second one was by Kayaker which involved patching and a keyfile. This project was a bit more difficult and exposed people to new tools and techniques.

What I'm asking people on this board and people participating in the projects is to post comments on what they thought of the first two projects, were they too hard, too difficult, about right, etc.

Than post some comments on what kind of projects you would like to see in the future, keeping in mind this is a newbies project forum so dongles, flex-lm, encryption/decryptions and the such are out of the question at this point in time.

Thanks

Goatass
hz
12-06-2000, 01:40 PM
hi,
IMHO timmy's project was about right as the next step. It was'nt that difficult and if
the moderators are'nt setting a new project then wher'es the harm in somebody else doing it?. I was thinking about the next one myself. If you rule out
encryption, packed targets (which in most cases can be unpacked with a tool) then
whats left?. Don't misunderstand me this is not meant to be offensive.
regards
hz
goatass
12-06-2000, 02:23 PM
Hi Hz,
I'm not offended the reason for this thread is to hear people's opinions. I think that Timmy's project is not hard but it's not quite suitable for newbies especially as the 3rd project, a little later on sure but not just yet. We need to take things slow, just because you understand how to trace with SoftIce doesn't mean others do and when you have to trace through Delphi code you must learn to rule out certain pieces of code which are irrelavent to the protection.
Another thing that I go buy is the number of responses to the project. First of all Kayaker's project is not fully completed there are people working on it still so you can't start a new project until the previous is fully completed by everyone. Second the only people trying Timmy's project is Kayaker (an advanced cracker) and yourself (I don't know your level of skill). That is enough to show that either the timing or skill level of the project is wrong.

I didn't rule out packed program, I guess I wasn't clear. By enc/dec I meant programs that can not be decrypted/unpacked by generic tools or that involve multiple layers of encryption. We need to learn to understand enc/dec routines not be robots and just use tools because as you get to more advanced program those tools will be useless and you will have to understand the code and write your own tools, this is where these projects are suppose to take newbies.
Even packed program are not the best targets because when using Procdump for example the person has no idea what Procdump did therefore beating the purpose of teaching packing routines. This will leave the person with once again the simple serial protection (or whatever protection it may be).

p.s. feel free to comment on anything, I want to hear what you have to say.

Goatass
JaneK
12-06-2000, 03:05 PM
Hi goatass,

Since comments were requested, here are mine:

1. I think tasks were just right (I mean difficulty level). In my case the crack itself (a patch or finding valid serial) was much easier then fully understanding how the protection works. I got stuck few times, but with the help received from moderators and other participants I was able to proceed until all became understandable.
2. As regards new tasks I can hardly suggest anything - I still know too little. For example do all protections (at newbie level) use same pattern e.g. input from user or from hardware is converted through math/logical operations into valid serial and then compared with the entered one? Frankly speaking I don't believe it (too easy, isn't it?).
Maybe we could try some crackmes with "unusual" protection scheme?
I would like to move from easier to harder tasks but I also realize that I have to learn walking before I can start running. Do I walk already? I know I don't.
Of course I don't take private classes in reverse engineering here so I will really appreciate any initiative and work on it to the degree I'm able to follow.
3. Finally I want to thank to all of you that made this kind of activities possible. Let's hope you'll have time and patience for many future projects.

P.S. I have the feeling that I am the "newest" newbie on this forum. My opinion therefore may be irrelevant cos I see it as sort of "primary school" and not (yet) as HCU.

Regards
JaneK
mersenne
12-06-2000, 04:38 PM
Hi goatass,

I agree with your summations regarding the relative difficulties of the projects that have been posted. To that end, I think Kayaker's project was great because the task spanned the whole range. As I have mentioned before on this board, that allows the individual to take control of how far they want to go. Those that want to learn will push forward to figure out what is going on and help a few of the others on the way (as JaneK pointed out above), those that just want to figure out how a serial protection works will probably stop there, and so on.

There appears to be people reading the discussions but not a lot contributing to them. I have tried to provide detailed explainations of how I solved the individual tasks because
1) to explain it I need to know what is going on and
2) examples of how to use particular tools are useful

If someone wants to comment on whether this sort of detail is warranted (or needed for that matter) on this board, then the guidelines for future project discussion can be better defined.

cheers
Mersenne
goatass
12-06-2000, 05:29 PM
JaneK and mersenne,
Thanks for the response, JaneK just because you are a newbie your opinion matters more. To answer your question about serial protections. Well in 90% of the time there is some kind of user input which then gets calculated and a real serial is generated. Now many cases it's not so easy to crack because the math involved gets much more complicated and spans over a larger part of the program (you need to trace through alot of code). Encryptions and Hashing could be done to the real serial so you won't be able to read it from memory. There are other things that could be done to make this simple scheme much more difficult to reverse.

mersenne I'm glad you liked Kayaker's project it was a good one.

What about tools ? Where there any tools that you wanted to see being used ? were there tools that were used which were not clear to you how they work ?

keep the comments coming.

Goatass
Raven58
12-06-2000, 06:49 PM
Now janek is more advanced then this newbie. I for one am a true beginner. I have read the excellent Krobar tuts and many others. I am familiar with sice, dasm, hiew dede and others. I have patched, used patchers, and done some serial fishing. I have played with crackmes, a few programs and attempted to expand my limited knowledge. I know nothing about calculation schemes, keygens, dongles, encryption etc. I am a "hands on show me" kind of person. As you know,some tuts assume knowledge many of us don't have. Mersenne is an excellent teacher but is way above my level. Perhaps two projects are warranted one for the really new and one for the advanced on the board. Your thoughts, GoatAss?
?ferret
12-06-2000, 08:56 PM
Hi folks,

Goatass, I agree totally with your views on the forum thus far. I only wish I could be more help. I've started a new job, working 60-70 hours/week, and trying to make a good impression (read "kissing ass") hehe.

I still try to browse the board daily and help where I can, but actual reversing time has eluded me lately.

As for suggestions, I think if we keep it simple for another 2 or 3 projects, we could maybe find a simple VB proggy. Something with a simple protection, yet utilizing the runtime .dll will force "students" to think a bit more creatively about tracing code.

Of course this would entail a few preliminary threads on VB tools and how to use them ;-)

Well, that's my 2 cents worth, off to the newbies forum b4 I go crash for the evening.

Regards,
?ferret
()whore
12-06-2000, 09:33 PM
Hello everyone. Sence you asked for my 2cents I will give it. I have participated in kyakers project and while the protection scheam was very easy to crack (about 2 min worth) it was the other parts of the project that asked you to look deeper at the program that I found worth while. I consider my self an advanced beginner at cracking so something harder would be ok with me. I don't see why there couldn't be more than one project going at a time. With thoes interested participating in the one(s) they liked.
As an advanced beginner I find that a protection scheam that I have seen befor is easy to crack but there are a lot of holes in my knowlege. So different projects that cover varying scheams would be nice.
Peace,
()whore
InOverMyHead
12-06-2000, 10:32 PM
Quite honestly, I like the direction the projects have taken. I have read, printed, and gone through many tutorials and although I probably got more out of them than I first believed, I feel that you all have given me and perhaps others, more “ground” level information – which is what I for one had previously asked for and have gotten.

As far as for the level and the type of projects are concerned, I feel that they have been on a newbie level – the serial number generators are not very important to me personally at this time. I would like to see the serial number projects continued as they seen to abound everywhere. I currently have a teacher’s grade book written in Delphi that I am working on and have not made very much headway with, but I also have not given up on it. As time permits, the level of proficiency increases, and the moderators see fit, I would like to see some projects that deal with disabled functions such as print and save.

Again thanks for taking the time to furnish us with these projects and asking for our input!
Kayaker
12-07-2000, 12:19 AM
Hi Gang,

Great timing on the question Goatass, and I'm glad everyone's responding with positive suggestions.

Mersenne mentioned something about whether putting a lot of detail/effort into ones responses to a task is warranted. And also to how many people are actually reading and learning from the threads but not necessarily taking an active part in them. The 1st part is totally personal of course, and some days you may feel like writing something or nothing at all, but I find if you can succeed in making someone else understand a point it helps in your own understanding of it.

As for the 2nd part, that would be interesting to know. There's maybe 8 or 10 active participants it seems, if that. Are there any Lurking Newbies out there who are getting anything out of this? Don't be shy, knowing you are out there would help us both in designing projects and for the people who are replying to know that their responses may be helping someone else. If it seems to remain the same core group of 'regulars', then people may stop explaining certain "basics" that they know everyone else already knows, and any new people may quickly feel left in the dark. While we have started at a Newbie level, we don't want to create a clique of "Elite Newbies" that moves on while forgetting their roots.

That said, if there are 2 or 3 levels of skill, as there seems to be, then we should continue to make sure the tasks span the range if possible so no one loses heart, or interest. I don't see a problem with the odd difficult crackme or whatever thrown in occasionally, as long as the board doesn't get too cluttered up with too many projects at once. Unfortunately we don't have a separate board for more advanced projects, so it's either here or the Newbie Forum. I personally enjoyed Nchantas 'unusual' unpackme. Though I haven't successfully unpacked it yet *grin*, I did learn a lot in the trying.

I fully agree with Goatass that we shouldn't use Procdump etc. as a blind tool, but at some point (later) we should definitely cover manual unpacking of simple packers such as Neolite, UPX, etc. using Procdump, Icedump and maybe even TRW.

As for the next project, VB might be a good one (hurry up and impress your bosses ?ferret, we need ya back ;) , or maybe a Save/Print disabled target, there's a lot of those around. And let's not forget the venerable Nag Screen...

Again, any Lurking Newbies out there who are getting anything out of this forum? We need a show of hands.

Cheers,

Kayaker
Kugi
12-07-2000, 11:43 AM
Hi Kayaker,

There are many lurking newbies out here that check out this forum every day. So, here is my "show of hands".

The project tasks, for this newbie, seem to be about right. By the time I get stuck, another newbie has already posted a question or answer that gets me moving again. I'm real slow.

Thanks to all involved with these projects. You provide a valuable educational service.

Regards,
Kugi
goatass
12-07-2000, 09:11 PM
Hi everyone and thanks for the input.

All your comments really help myself, kayaker and anyone else that has a project in mind for us head in the right direction. Like Kayaker mentioned there are alot of newbies that are just reading the threads and not posting anything and this does cause a bit of a problem when explaining things. That is why we can't jump from a simple serial protection project to a packed target or a similar advanced project.

Another issue that was raised was working on projects with a broad range of tasks, this is good but we have to watch what kind of tasks and how many there are. We got to remember that if you already know how to do something that doesn't mean someone else that is reading the thread does.

Anyways, I already have some ideas of new projects, if someone else has any ideas of projects that they would like to see feel free to e-mail me.
But please don't just post your project otherwise there will be caos with everybody posting their projects. Lets go a project at a time.

Keep the comments coming....

Goatass
ThRaX
12-07-2000, 09:15 PM
Hey, yeah heres my 2 cents...

MovingPix was a good intro, nothing PARTICULARLY new, but as you can learn something from everything, I admit I learned about the GetVolumeInformation function, which is something I had never encountered before. They kegen was simple etc., but its all good.

MFR...EXCELLENT project. I learned a lot about delphi, and the tool DeDe which I had never used before. Keygen wasnt really simple, but I could follow it, and the whole 'crypt key' concept was cool too. A lot of things learned in one project.

HappyIcon("Kayakers Project")...Nice project. I liked this one because it went in something of the format that the old Sandman-moderated projects went long time back. Also, this really had clear cut tasks and everyone could take it just as far as they wanted, depending on their level of newbiness. I personally did the first 4 tasks, then on the 'Bonus task' i saw it first and said "okay, screw this"...But after reading some posts and asking some questions I finally understood (though Kayaker more or less told me the solution, lol) :D

Next project...I think that packing is a really good idea. I dont think it should be too complicated, and we should have it something in the format of 'Task 1: Unpack the prog', and 'Task 2: Crack the prog (keygens, patches etc.)', so it can be divided up by interest. I think that if we do htis , I am personally VERY new to unpacking, and a good deal of guidance would be cool....Almost a tutorial, only like "real time", rather than simpyl reading a doc. and following directinos...kinda make it "unfold"...If the moderators/advanced reversers could coordinate something like this it would be awesome!
goatass
12-08-2000, 10:12 AM
ThraX, very good comments.
As for the packed projects that you want to see that is a good direction although there is a bit of a problem there because pretty much all packers today are advanced packers meaning they are not for newbies. In order to unpack them you will need to know the PE header pretty good, section headers, import tables and IAT. It would be very hard to start explaining all of this for one project that's why I want to move slowly and not jump to packed files this way we could have a project that will introduce something to do with the section headers, then a project to do with some imports and so on until people are familiar enough with this information so we could move to packed targets. Otherwise the only way to do a packed target would be for the advanced crackers to basically say "ok do this, then this, then this....etc." and that's not teaching anyone anything.

I will keep my eye open for targets packed with simple packers that we could work on, if someone know one feel free to e-mail me.

Goatass
Clandestiny
12-09-2000, 09:57 PM
Greetings :-)

MANY thanks to all who are making this learning experience possible! And now my own few cents...

As a newbie to reversing, I feel that these projects have been at just about the right level and I've learned something new from all of them. From the first project, I learned about the GetVolumeInformation function which I did not even know existed (must less that it could be used in a serial calculation). From the second project, I gained exposure to Delphi and the Dede decompiler since I had had no prior experience with programs written in Delphi...And Kayakers project has been great too. I got kind of busy in the last week so I haven't finished the CRC or keyfile, but I'm still working on it. Once again it is a great learning experience since this is also my first exposure to a keyfile!

I have read many tutorials, but I feel I've learned *more* from the hands on discovery approach of the projects than from reading an already made solution in a tut.

I have to admit, serial / keygen protections are where my experience lies and I have little to no experience with packing, keyfiles, and other more advanced topics...but I am ready to test the waters a little so to speak...and though I've learned something useful from all of the projects, I have perhaps been the most intrigued with Kayaker's project because it has opened my mind to some new concepts...resource editing, CRC checks and keyfiles, on a *simple* level that it is possible to understand and build upon. I would love to see some upcoming projects tackle these angles a little more. Maybe another simple CRC or keyfile where we could apply what we have learned in the previous projects.

Anyway, just a few of my thoughts/comments
and a BIG thanks to the moderators and project initiators for your time and effort to help us newbies!

Cheers :-)
Clandestiny
mersenne
12-10-2000, 05:17 PM
Hi all,

This is all shaping up very well :) Just a few comments and responses. The number in parentheses is just the post above where the issue was raised, so you won't have to hunt it down.

Goatass: (6) WRT tools, I remember when I was wetter behind the ears than at present that I had difficulty when some things were not explained properly. For example, not ever having editted a registry key before using regedit I was a bit plerplexed by it all until I read a post from Jeff (the ice penguins still botherin you;) ) which explained it perfectly, no trouble since. I see some mutterings below about VB proggies so if we venture down that road, I think the *reasons* for the changes we need to make to our tools to cope will be important.

Kayaker: (11) I find that writing in detail is very helpful as I need to understand what I'm writing before I do so. If no-one finds it annoying or fun spoiling, then I will continue doing so. It's a bummer that code doesn't post too well on this board.

WRT the basics, I have an idea for a work around but it needs a little more thought and then I will float it for comment.

Kugi (12): Don't worry about being slow, I'm slow myself. Unfortunately life doesn't slow up and let me get on with more interesting things :) I'll reiterate the comments above; if you have a question, please ask. Odds are that someone else will be in your shoes. I have found the inhabitants of this board will often go out of their way to help and to quote the most famous electronic book are "mostly harmless" ;)

I agree with Clandestiny in that a bit of variation keeps the brain humming along. I need to attend to other matters for a few days so I'll get back when I can.

later
Mersenne
xOptiMus
12-26-2000, 02:38 PM
Hi reversers,

I think this newbie project area is a great idea, but i do think and agree with many others that it could be even better if there were maybe a few projects taking place simultaneously. I know at first this sounds like it might get a bit messy, but if there are only 2 or 3 and the threads are labled accurately, then I don't really see a problem.
For Instance, the projects could still be numberd project 1,2,3 etc, but a level indicator could be added e.g. (bas)ic, (int)ermediate, (adv)anced.
Another idea might be to have a theory section whereby the moderators/advanced reversers could teach us important fundamentals and then test our understanding with questions. I think this would be very valuable because it would be like a two way interactive tutorial. Tutorials par se are good, but I've often read one and thought: "how the hell did he arrive at that!", or "there you go again assuming your readers have that prior knowledge". Don't get me wrong tuts are great, and we all need them. But, what I am saying is this: how wonderful it would be to learn important fundamental concepts from a tut like teaching tool, and then be able to clarify any misunderstandings or grey areas by questioning!
Another advantage here would be that any moderator/advanced reverser running a "hands on project" could, from time to time, check the last few "theory projects", and then base their projects accordingly. In this way all active projects although possibly on different levels, could all be related if need be. I think that all this would introduce more flexibility and choice to the board which at the end of the day has to be a good thing!

Anyway these are just ideas, and it's my hope that even if none of them are taken up, maybe at least they can be a springboard to others.
I hope my views will be of some value - it's boxing day as I write and the drinks are flowing freely: hope I've made sense.

Merry xmas & happy new year all, and long live this board!

xOptiMus (well oiled)


TalkPCR is it dead?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > TalkPCR is it dead?
PDA

View Full Version : TalkPCR is it dead?

()whore
12-11-2000, 11:43 PM
Hello Timmy,
Sounds like your project for TalkPCR is dead at the moment. Even so I have looked at it and have some questions for you. I have traced through the keyfile rearangeing (breaks it up into 3 parts 0x100 each. Bits 1,4,7,ect in 1st part, bits 2,5,8,ect in second, bits 3,6,9,ect in 3rd part).
Then through the copying of these parts to a new location.
Then it decrypts the bytes by useing a part of 1 copied section as a mask for a different part of another.
Finaly it swaps a piece at the end of a section with a piece at the begining.
That done, it starts fishing for strings in these decrypted, rearanged sections (ie TalkPCR registration key, and _Master__) I also noticed it fishing around with my windows username adding underscores at front and back.
Finaly my problem. I have been trying to create a valid key file but can't seam to make any sence out of how to reverse the decryption part so I end up with a valid string in the end. What is the reverse of ORing something with 0x20 ect. I have experimented with some code in c but no luck. I looked over your code and could recreate it in c if I wanted but that wouldn't help me understand whats going on.
please send some help.
Timmy
12-12-2000, 09:53 PM
There are three main parts to the encryption.
1. You need to know the offsets in the unencrypted file where the data the program is looking for - this is failry easy as with a big enough data screen in sice you can see where the data should be.
2. The next part (most difficult) is basically very simple once you understand what is going on (it took me a while). Basically two bits from each byte are rotated through their corresponding counterpart in the other 100h byte blocks. ie. the original bits 1&6 of byte(n) go to bits 0&5 of byte(n+200h), while the original bits 0&5 of byte(n+200h) got to bits 3&7 of byte(n+100h), while the original bits 3&7 of byte(n+100h) go to bits 1&6 of byte(n).
3. The final part is just the interleaving of the three blocks of data back into one contigious file.

I hope this helps. ( I think I've got it right but it's 3:45 am here and I've had a wet )
()whore
12-13-2000, 11:26 PM
Hello Timmy,

Thanks for the pointers. I have looked back at the decryption code and while everything I wrote down about it was correct; all thoes:

if byte x of middle section ANDed with 8h = 0 // meaning bit 3 = 0
then byte x of first section is ANDed with FDh // meaning bit 2 1st section set to 0
else byte x of first section is ORed with 2 // meaning bit 2 1st section set to 1

, I don't think I was any where near figureing out what it was doing (shifting the bits 1 & 6 from a byte in the first section to bits 0 & 5 in the last section ect. ect.) Once you explained it like that, createing a valid master keyfile was no problem. I doubt I would have ever figured out this bit shifting by myself. This was a pretty advanced project and I can see whay goatass didn't want to inflict it on newbies.

I do have some remaining question though. While I have created a valid keyfile and the nag screen is no longer shown ( doing the samething was a 1 byte patch as kayaker mentioned ) I still can't find where the program is reading in the serialnumber, date, ect. I have the type of keyfile "TalkPCR registration key" which is checked at 004ca7bc and the key type "_Master__" which is checked at 004ca844 but that is all it seams to need to bypass the nag screen.

The offsets you posted in your code are familiar:
registered owner = offset 294h in keyfile, ends up = begging of section 3;
serial number = offset 83h in keyfile, ends up = begging of section 1;

and the code from 004ca6e4 to 004ca763 swaps the sections around according to these offsets. I also noticed the calls to 00403c7c. Passed in is an empty mem location and a pointer to different places in the decrypted file (where it is looking for strings like our _Master__). When this function returns the empty mem location now contains a pointer to a copy of a null terminated string pointed at by the other paramater. Along with the strings length and a flag which is set to 1. The offsets it searches are the begging of each section and 80h (middle) of each section.

From this I can figure out where it is looking for the data but not what data it is looking for or where in the program it is reading this (which would deffinatly help figure out what goes where). As I said befor it only seams to check the places for the type of registration and the key type.

Can you help me put this to rest? I have lost enought sleep as it is. Maybe using IDA as you suggested would help but IDA still confuses the hell out of me. While I could have patched this program to run reged in about 5 min. I wouldn't have learned very much doing it. The hours I spent trying to create this keyfile have tought me a lot. Thanks
peace
()whore
Timmy
12-14-2000, 09:38 AM
Its a while since I looked at this but from memory I think the call to 00403c7c looks at the decrypted key file for a null terminated string. If it finds one it copies a pointer to the string somewhere and then eventually the program uses the string (via the pointer) for whatever. You should look where in the key file the c7c call accesses and enter some dummy data (a string) at this point and see what the help/about box shows, this tells you which place in the key file holds the relavent info for serial number / date etc. If you look at my source code in the other thread you will see where in the key file the relavent data goes (ie Buffer[X + n] where n is the offset in the file). BTW the date is a string that is a number of days from the start date 30/12/99.
Also I think there was a final c7c call but I didn't figure out what it was for. Regardless of what dummy data I entered the prog didn't do anything different.
()whore
12-14-2000, 02:25 PM
Thanks again Timmy,

Mission accomplished. I now have a valid keyfile with proper name serial number and date. By placeing dummy strings in my keyfile at the known offsets I found what was being read into which field. For anyone else who has been keeping up with this. The offsets are:

begging section 1= serial number
begging section 2= keytype
begging section 3= registartion name
middle section 1= key file type
middle section 2= date
middle section 3= ???

as you said the date string was in number of days from a certain date. I tried putting in a dd/mm/yy date (trying to ignore what you said and find it out for myself) and found it was only reading the first number of this sequence. To get the date displayed right I needed to put the #349 in this spot.

good project. I hope to see another one soon. Things have been quit here lately, must be the comeing hollidays.
peace
()whore
Timmy
12-14-2000, 06:37 PM
Glad to be of help

BTW did you see the last c7c call ? I can't figure out what it is for ?

I entered string data and hex values but I did not see any change in the help/about box or anywhere else in the prog. I must admit I didn't trace what accesses the data pointed to by the last c7c call but I suppose it could be something left over from the progs developement stage. After all, the prog is only supposed to work on the comp it is installed on with a key derived from the comps registered owner name (I think - can't remember exactly) and the author did forget to remove his check for the master data in the key file.

Anyway, I'm glad to see that someone else got hooked with this one.


Lets start another project or something. Ideas welcome
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Lets start another project or something. Ideas welcome
PDA

View Full Version : Lets start another project or something. Ideas welcome

ThRaX
12-15-2000, 06:11 PM
HEy, seems a bit dead lately what do you say we start another project...Or since TalkPCR didnt seem to get anywhere, I think this may be because people are unsure how to proceed? Maybe some moderators/advanced crackers could give some detailed advice to newbies on how to proceed...I know this sounds like "ruining the puzzle", but lets just take this as an "introductory" sort of project into keyfile creating...(Decryption, etc.) Any thoughts would be cool

--ThRaX
()whore
12-15-2000, 11:12 PM
Hello thrax,

I second the thought on a new project. How about something from visual basic or an introduction to useing IDA? These would be my suggestions.

about TalkPCR read through the 2 threads there is enough info there to get going on. If you run into any specific problems post them. I will try and help. I am sure Timmy would too, he has been getting me up too speed.

peace
()whore
Timmy
12-16-2000, 05:19 AM
I have just seen the post from SiR in the Newbies Forum regarding Logomanager. I have had a quick look and it looks like it's worth having a go at. First of all you have to figure out how to get the name/password entry box up (use regmon) and then sort out how your name and email address are manipulated.

The URL is ht*p://www.logomanager.co.uk
Kayaker
12-16-2000, 01:59 PM
Hi Guys,

This one's packed with UPX. The project's not going to get too far without a down 'n dirty unpacking lesson ;-) We weren't supposed to do this, but for lack of a better project...

Get the latest version of Icedump and start it up (put your applicable version of icedump.exe in the SoftIce folder and double click it). SoftIce loader may not break at the start of the unpacking code if you don't.

Fire up LogoManager.exe in SI loader32.exe and you should break at the start of unpacking code at a PUSHAD. A few line below is a JMP. Trace through the JMP and you'll get into these loops you have to get over. You can just pay attention to where the farthest jump would be when you finally get out of the loop and set a breakpoint there, or just keep you finger on F10 and you'll eventually get out.

Easier though is to scroll down the code page a bit and notice a LOOP statement at 478164. The LOOP statement is characteristic with UPX. You can set a BP here to get past all the previous crap. Look further down the code and you notice a POPAD at 4781B7 and a JMP statement immediately after. Again this is characteristic of UPX.

The address pointed to by the JMP statement is the Original Entry Point or OEP of the program. At this point the unpacking is finished and the program is just about to start for real.

The classic Procdump method for dumping is as follows. Many of you already know how to do this, but in case not...

While you are ON the JMP statement, take note of the address and write it down. Type 'a eip' in Softice (Assemble at the address you're on) and enter 'jmp eip'. Now hit enter twice to exit the 'a' command.

You are now in a permanent loop jumping nowhere but to itself. Exit SoftIce at this point with F5. Your cursor will probably be a little sandtimer because of the infinite loop you just created. Open Procdump and in the main Task window right click on the Logomanager process and select Dump(full). Save the dump, then right click on the process again and Kill it.

Now all you need to do is fix the OEP. Open the file you just dumped with Procdumps PE Editor and change the Entry Point to the one in the JMP statement that you wrote down. Note that you must subtract the Image Base of 400000 from this, i.e. the Entry Point for 401234 would be 1234.

That's it. You should now be able to disassemble the file with Wdasm yadda, yadda, yadda.

Hope this helps,

Kayaker
meRlin
12-17-2000, 02:21 PM
Hi,
I have an easy method to unpack this application :)
-Run Procdump ->Select unpack button
-select UPX
-chose *exe
-let procdump wait
-push procdump OK button when Logomanager has been started
ready!
happy cracking

meRlin
Kayaker
12-17-2000, 11:57 PM
OK, this isn't a Newbie target ;)

It seems to use something called D-Square Cipher v2.5 (saw a ref. to it) to decrypt your name and s/n (concatenated as a string, no capitals) from the RegistrationKey registry value at location 20h. Minimum length of RegistrationKey is 30h. This is the value MOVed to cl. It then compares each character with your name/sn string as hex, XORed with 55 at 4205B0.

If this passes, then it compares it with your name/sn string as it has been encrypted in WindowData. This is a simple XOR AA encryption. NOTing it will recreate it as the XOR 55 value.

i.e. "k" in hex is 6B. 6B XOR AA = C1. This is stored in WindowData.

6B XOR 55 = 3E. NOT C1 = 3E

:004205A4 mov cl, byte ptr [eax] ; DEcrypted name/sn from RegistrationKey, still partially encrypted
:004205A6 mov dl, byte ptr [eax+edx-000024C8] ; your name/sn as hex. i.e. "k" = 6B
:004205AD xor dl, 55 ; 6B XOR 55 = 3E
:004205B0 cmp dl, cl ; are they equal?
:004205B2 jne 004205C4
:004205B4 test esi, esi ; counter
:004205B6 je 004205C4
:004205B8 mov dl, byte ptr [eax+FFFFDB38] ; name/sn from WindowData. i.e. "k" = C1
:004205BE not dl ; NOT C1 = 3E
:004205C0 cmp dl, cl
:004205C2 je 004205CE

This is repeated verbatim at 3 locations in the program. The easiest solution is to patch all the jumps.

Now there's a problem with this solution. As long as you have the details fairly correct in the Registry key "RegistrationKey" (this found from Regmon), i.e. 30h bytes or more, then you will always be registered as whatever you enter as name and s/n. BUT, the reg box comes up every time.

Maybe a couple of reasonable Tasks for this is to find the 3 comparison routines and patch them (1st one is above), and then try to get rid of the reg box that comes up each time. Maybe figure out how to show your registered name in the About box.

When you create this RegistrationKey value out of thin air, how do you know whether it's supposed to be a String, Binary or DWORD value? Sometimes you can just make a good guess, but if not, the 3rd parameter of RegQueryValueExA will tell you.

LONG RegQueryValueEx(

HKEY hKey, // handle of key to query
LPTSTR lpValueName, // address of name of value to query
LPDWORD lpReserved, // reserved
LPDWORD lpType, // address of buffer for value type
LPBYTE lpData, // address of data buffer
LPDWORD lpcbData // address of data buffer size

i.e.

Public Const REG_SZ = 1 ' Unicode nul terminated string
Public Const REG_EXPAND_SZ = 2 ' Unicode nul terminated string
Public Const REG_BINARY = 3 ' Free form binary
Public Const REG_DWORD_LITTLE_ENDIAN = 4 ' 32-bit number (same as REG_DWORD)

Anybody had any other luck with the encryption process?

Kayaker
()whore
12-18-2000, 02:53 PM
Hello,

I am working on this project but have some questions. First I tried to unpack this program manualy like kayaker was explaining. I have done this befor and had no problem stepping through the unpacking code and dumping the decoded file with procdump. I changed the peheader to reflect the new oep. Now this program runs fine but windsm and ida both barf trying to decode it ?!? I tried redoing this a couple of time with no luck. I finaly got a decent disasembly letting procdumb unpack it thought even with this the import table is screwed.

next and more importantly both kayaker and timmy mentioned the RegistrationKey that our program was looking for. I found this but where/how did you find that this key needed to be 30h? I finaly got the dialog box for name and serial number after makeing this key the proper size. Reading the posts it sounds like regmon was reporting this 30h size but I found nothing like that in mine.

finaly to actualy be of some help. The program checks the keycode at three places
004223f3
004225cf
00422758
or roughly there abouts.

As for which type of data to make the RegistrationKey (string,binary,dword) I tried string first and the program didn't like that. Next I tried binary and that made the gods very happy.
Timmy
12-18-2000, 08:41 PM
I haven't had a lot of time with this one yet but c:0041fefe is the call that reads your dummy registration key. Later there are three compares, cs:0041ff28, cs:0041ff35 and cs:0041ff3e, the last of which is cmp,ecx,30. I have seen the reference to Square Cipher v2.5 but it looks a bit base 64 ish (I could quite easily be wrong).
Look at 6af354 > 01 23 45 67 89 ab cd ef-fe dc ba 98 76 54 32 10 00 00 00 00(and what generates it)
and (I can't remeber where but) the area where 8954jkh89fdhjnh4 etc. are stored (and the next bit of string data). Look up Latin Cipher and Block Cipher then Base 64. THERE ARE URL'S THAT EXPLAIN THIS. I know this is VERY DEEP but usually the author of a program usually is a specialist in what he has written the program for - not cryptography so he is most likely to have used a pre-built cripto routine for his protection. (Unless we are VERY UNLUCKY).
This project definately needs a bit of lateral thinking - don't dive in too deep stepping through hundreds of lines of code at first. See what each register points to before a call and what happens to the data after a call. I have found with this sort of protection that you have to run it many (many, many, many) times before you begin to get a feel for it.
I agree with Kayaker that this is an advanced project but even if it takes a while to sort it (assuming that we do), from what I have seen so far this is going to be a very good learning exercise.
BTW cs:00422618 kills you, so we are interested in whats before this. Also, not every program is keygenable but all should be patchable. I have a feeling that at least this one is registerable with tha data we input as test data (as a keygen could be too involved). Maybe we need to work on the RegistratioKey data and backstep to string values for Username and Email address.
(BTW in the main decryption routine there is a cmp with 3f, is this the maximum RegistrationKey length? - It might not throw up an error in the programs execution but with the RegistrationKey and the references to 8954jkh89fdhjnh4 etc. and the next bit of string data it makes me wonder. I will have another look in my data on Base 64 and see if I can find again the URL to info that led me (blindly) to my conclusions).
Timmy
12-18-2000, 08:54 PM
Start URL = http://www.io.com/~ritter/GLOSSARY.HTM

This page has some interesting stuff. It is serious and heavy going I know but amongst the interesting lines there is :

"A public code for converting between 6-bit values 0..63 (or 00..3f hex) and text symbols accepted by most computers: "

Also look at the reference to Base64
Timmy
12-18-2000, 08:59 PM
Sorry - error at the bottom of my last post

It should read - take a look at Mixing Cipher.
()whore
12-19-2000, 01:07 AM
Kayaker (12-17-2000 13:57):
OK, this isn't a Newbie target ;)

This is repeated verbatim at 3 locations in the program. The easiest solution is to patch all the jumps.

Now there's a problem with this solution. As long as you have the details fairly correct in the Registry key "RegistrationKey" (this found from Regmon), i.e. 30h bytes or more, then you will always be registered as whatever you enter as name and s/n. BUT, the reg box comes up every time.

Maybe a couple of reasonable Tasks for this is to find the 3 comparison routines and patch them (1st one is above), and then try to get rid of the reg box that comes up each time. Maybe figure out how to show your registered name in the About box.

Kayaker

Hello Kayaker and Timmy,

I must have been smokeing crack befor. I missed some of the reg checks; and from the looks of it Kayaker did too. If you patch ALL the jumps the program runs like a dream. You get no nag, no repeated dialog box for name, and your name and data appear in the about box. the checks are located at:

00408dab
00408eab
004205ad
004223f3
004225c7
0042275f

remember there are 2 checks at each location. I found all of them by doing a string search in wdasm for "xor dl, 55". I was also thinking of patching [450000] as it seams to be a flag to the program weather it is reged or not.

Now if we want to get into decrypting this algo, I am up for it. But would we learn much in the process?

cheers,
()whore
Kayaker
12-19-2000, 04:02 AM
You're right ()whore, I guess I must've been smoking something missing the rest of those calls. Heh, heh. Yeah, that pretty much takes care of all the checks. You've probably also seen the 6 corresponding calls leading to the decryption key:

* Referenced by a CALL at Addresses:
|:00408D87 , :00408E86 , :00420533 , :00422384 , :0042255C
|:004226FA
|
:004221D0 81ECC0000000 sub esp, 000000C0
:004221D6 8D442478 lea eax, dword ptr [esp+78]
:004221DA 56 push esi
:004221DB 57 push edi
:004221DC 50 push eax
:004221DD E85E630000 call 00428540
:004221E2 6A34 push 00000034
:004221E4 8D8C2488000000 lea ecx, dword ptr [esp+00000088]

* Possible StringData Ref from Data Obj ->"8954jkh89fdhjnh43tkjdsg9lij32qr09ai;r'ar098at4"
->"takjg8"
|
:004221EB 68E0574300 push 004357E0
etc.

The ref in the file is "Square cipher v.2.5 (compiled on Dec 13 2000 23:41:31)..Using assembler core functions". I think I found the latest implementation of it (v 2.7) which uses this exact phrasing at
http://www.esat.kuleuven.ac.be/~rijmen/downloadable/square/Square27.zip

Can one of you C gurus compile this and see what it generates? There was a new Hashing scheme implemented between v2.5 and v2.7, but it would be interesting to see what it does.

Regards,

Kayaker
Timmy
12-19-2000, 08:57 PM
Good work there boys. I think my brain needs testing though - for some reason I've been trying to work out how the cipher works. The nibbles of the first 20h bytes are interlaced with the nibbles of the second 20h bytes (I think, it looks like the RegistrationKey length should be 3fh bytes long). It is standard block cipher (if you can call it standard). Then this is played with .......... I spent 4 hours figuring the first bit out and now I can't see anymore. There is info in the regkey as to the number of chars in username and password plus god knows what else.
()whore is bang on the mark - the only thing I can see that could be gained from totally reversing the decryption process is that patching is sometimes far better than keygenning (apart from the personal satisfaction).
I have a weak understanding of what is going on but to be honest, I've had enough of this one. It just shows you that you can have a brilliant encryption scheme but in the end a few appropriately placed jmp's can defeat it.
()whore
12-19-2000, 10:22 PM
Hello again guys,

Kayaker. I compiled that c program you linked above. Acctualy its 2 different .exe. One just runs some timeing tests on it encryptions techniques and the other out puts some crypto bable to a file. If you want them I will gladly send them on but nothing I would wan't to tangle with.

Lets get another project up. It has been fun working on these as a group. We can help each other out. But first. PLEASE someone tell me how or why you arrived at 30h for the size of the RegistrationKey. Were you getting that by BPXing on RegQuereyValueExa? I just don't see where it was comeing from.

If you want a sugestion for a new project, how about mp3 navigator from http://www.vertexlab.com/mp3nav/
but be warned this is packed (ASpack I believe) and it kills filemon and regmon when it starts up. Oh and it also has a crc check. I have poked around with this one with out getting very far.
peace
()whore
Timmy
12-20-2000, 11:19 AM
The check (checks - there are a couple) for the size of the regkey are just after cs:41fefe (this call reads the key) - I think it is at cs:41ff3e.
John
01-16-2001, 02:15 AM
how do you get logomanager to break, ive only been at this for a week, any help please
Kayaker
01-17-2001, 12:36 PM
John (01-15-2001 16:15):
how do you get logomanager to break, ive only been at this for a week, any help please

Hi John,

This may not be the best target to start with, but if I remember correctly you needed to fake a "RegistrationKey" value (minimum length 30h) in the Registry which would then automatically call up a registration box. Definitely an unusual trick. This is (sort of) discussed in the above posts ;)

Kayaker


Menu Enabling Project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Menu Enabling Project
PDA

View Full Version : Menu Enabling Project

Kayaker
12-20-2000, 05:25 PM
Menu Enabling Project

Hi All,

I thought I'd suggest this as a project to explore the process of enabling a disabled menu item and hopefully fully restoring its functionality.

Target: MixVibes PRO 2.23a 880Kb
h*ttp://www.mixvibes.com/mixvibes/download/mixvibespro223.zip
f*tp://ftp.axinet.com/pub/mixvibes/mixvibespro223.zip (may be corrupt)
Other d/l locations at h*ttp://www.mixvibes.com/

This is a 30 day registerable Save-disabled audio mixer. While it can be registered, the main tasks will be to:

1. Enable (ungray) the Save and SaveAs menu items.

2. Enable the Save functionality.

There are at least 2 required readings for this:

Theory and practice of menus reversing by +Spath.
http://www.woodmann.net/fravia/menusspa.htm

Enabling Menu Items - Techniques by Lord Soth
http://www.immortaldescendants.org/database/essays/lordsoth/menu-items.txt

I've used some of the techniques in a couple of tuts that might help as well

Enabling Print-Challenged PDF Files
http://www.searchlores.org/pdffing.htm

Implementing an Inline Patch from the Menu
http://www.woodmann.net/fravia/TracePlus_MenuPatch.html

An API monitor with all the 'menu' APIs enabled is indispensible here, as is the Win32 Programmers Reference. A couple of tips - the decision to enable or disable a menu item in a drop down list is usually made when the main menu item is clicked on. As for actually restoring the Save functionality, familiarize yourself with a couple of the Common Dialogs dll (Comdlg32.dll) functions used in this program, and study closely Lord Soth's tut.

Have fun.

Cheers,

Kayaker
?ferret
12-22-2000, 09:16 PM
've been kickin a few ideas around in my head for save disabled protections for awhile, but I haven't run across any for some time. Thanks Kayaker, this will give me a chance to test my theories ;-)
Kayaker
12-22-2000, 09:47 PM
?ferret (12-22-2000 11:16):
've been kickin a few ideas around in my head for save disabled protections for awhile, but I haven't run across any for some time. Thanks Kayaker, this will give me a chance to test my theories ;-)

Hi ?ferret,

Believe me, I had a hard time finding one. Had to wade through a huge search listing for "Save Disabled". They don't seem as common as I thought they'd be. Them shareware programmers are just gettin' too darn sophisticated ;)
meRlin
12-25-2000, 03:20 AM
Hello,
It was a nice target you have chosen Kayaker!
Should be no problem to enable all items.
If one want's to "cheet" it's really easy to enable all menus, I suppose you already know that. (Don't want to spoil the challange for other reverser:) )
About finding targets with disabled menuitems, all adobe trial, calgari (truespace) and Bryce (3x) has some function disabled, they're maybe to big for us who still use a modem but we can grab them from any "cover-cd".

cheers
meRlin
Clandestiny
12-25-2000, 08:58 PM
Hi Kayaker,

Good choice for a target! I've been wanting to try my hand at enabling disabled functions for a while :-)

After reading the suggested tuts I've managed to ungrey all of the menu items, but I'm a bit stuck now on how to activate them. I'll explain my approach and findings and then hopefully you will kindly help me back on the right track...

First thing I did was run the target to see exactly which functions were disabled. The disabled functions were new, open, save, save as, export file, recent file, and options. I was a little puzzled that the new and open functions should also be disabled since that pretty much renders the app useless? But anyway, I deadlisted it in Wdasm where I was able to determine that the menus are created using a template rather than at runtime. From here I was able to get the menu ID's (save=E103h && saveas=E104h).

At this point I checked the menu definition in Hex Workshop. The options were all 00, or active so I then figured it must be disabling itself during runtime.

After examining the assorted imported functions pertaining to menus, I saw EnableMenuItem which I set a breakpoint on IF the menu item flag == 01. SoftIce broke at the following code.

:0049A76A 8B4C240C mov ecx, dword ptr [esp+0C]
:0049A76E F7D9 neg ecx
:0049A770 1BC9 sbb ecx, ecx
:0049A772 83E1FD and ecx, FFFFFFFD
:0049A775 83C103 add ecx, 00000003
:0049A778 80CD04 or ch, 04
:0049A77B 51 push ecx
:0049A77C FF7608 push [esi+08]
:0049A77F FF7004 push [eax+04]

* Reference To: USER32.EnableMenuItem, Ord:00B0h
|
:0049A782 FF150C264C00 Call dword ptr [004C260C]
:0049A788 EB53 jmp 0049A7DD

Stepping through the code here a couple of times in SoftIce I could see that the flag was 403 for disabled and 400 for enabled menu items. Since the flag parameter was being passed in ecx, I figured it should always be 400 so all items would be enabled and I did a patch at:

:0049A778 mov cl,0
:0049A77A nop
:0049A77B push ecx

Now 400 would always be passed to the enable menu function enabling all of the selections. . Possibly this wasn't the most elegent patch, but it worked since all of the menu items are now ungreyed.

Unfortunately, my work is not done. Though the items are ungreyed, they still need to be activated. It is here that I am having some difficulties. BTW, I've read each of the suggested readings a good 3+ times trying to glimpse the vagaries of reversing windows message structures without a great deal of sucess (alas my win32 asm knowledge is *basic* and +Spath's discussion a bit *advanced*).

*** ran out of space: message continued in following post ***
Clandestiny
12-25-2000, 09:00 PM
*** message continued ***

I did follow what I read enough to realize that windows sits in a loop waiting for various messages, (wm_command among them) and that wm_command is the message sent when a menu item is clicked. So from this it makes sense that we would want to intercept this wm_command message to see exactly where the program branches in response to a particular menu item being clicked.

Now, taking your advice Kayaker, in the Trace32 tut, I found the class name for MixVibes to be Afx:400000:b:1466 using Windowse. Then I got the taskname and HWND of the menu bar. Now I set a bmsg Hwnd wm_command where the Hwnd is the menu handle I just found. SoftIce then broke when I attempted to select a menu item...so far so good...

...Now borrowing the bpxK32Thk1632Prolog trick (how this works I have no idea!) I was able to get back into the MixVibes code. And from what little I understand, I think the program has to do a comparison to determine what menu item was actually selected. I entered the code here:

:004969A3 817D0C60030000 cmp dword ptr [ebp+0C], 00000360
:004969AA 7505 jne 004969B1
:004969AC 6A01 push 00000001
:004969AE 58 pop eax
:004969AF EB1A jmp 004969CB

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004969AA(C)
|
:004969B1 FF7508 push [ebp+08]
:004969B4 E863FFFFFF call 0049691C
:004969B9 FF7514 push [ebp+14]
:004969BC FF7510 push [ebp+10]
:004969BF FF750C push [ebp+0C]
:004969C2 FF7508 push [ebp+08]
:004969C5 50 push eax
:004969C6 E8BDFCFFFF call 00496688

There is only one comparison here and I can't fathom the significance of 360. Beyond that, stepping down though the remaining instructions throws me out into a shit load of Kernel and User32 code and then back into the K32Thk1632Prolog / Epilog functions. I tried going through a few iterations, but I seemed to be running around in circles. I certainly don't see any place that is comparing my selected menu item ID with anything. Help me Kayaker !!!

BTW, Merry Christmas and a Happy New Year :)

Cheers,
Clandestiny
Kayaker
12-26-2000, 05:11 AM
Hi Clandestiny,

Hey, you really got into some good stuff there! While you took the hard route ;) it's probably much more instructive.

I thought having the New and Open items disabled were kind of useless too until I realized, if you can't save a mix, why should you be able to open one? heh, heh. So I guess we need to enable all of them. My first choice might be to try something like I did with the PDF files, do a TRACE and see if you can find a unique patch point somewhere close to the EnableMenuItem call that would both enable the menu items and restore their functionality.

This isn't always possible though. It could be a pure demo without the code to call the menu item functionality, but if you're lucky the code IS there and just needs to be activated. In this case it's a registered/not registered flag. If you can't backtrace from the EnableMenuItem call then you need to trace from the selection of the menu item.

I don't think there's any definitive method to doing this, but here's a few things I've noticed.

You followed the BPX K32Thk1632Prolog trick perfectly. One thing I've noticed is that as soon as you break on Bmsg Hwnd WM_COMMAND after selecting the menu item,

:BMSG 06d4 WM_COMMAND
Break due to BMSG 06D4 WM_COMMAND (ET=8.89 seconds)
hWnd=06D4 wParam=E103 lParam=00000000 msg=0111 WM_COMMAND

you land in KernelAlloc at

141F:05B8 6668A0694900 PUSH 004969A0

and the address PUSHed is the same one that you reach after going through K32Thk1632Prolog and the Call in Kernel32.dll at
BFF73637 65FF5608 CALL GS:[ESI+08] ; Call 4969A0

So if you restart the program and set a BPX 4969A0, you end up at the start of program code where you want to be without having to set the BPX K32Thk1632Prolog. I've seen this many times, and at least with certain languages, there's always a PUSH statement in KernelAlloc that has the return address. Either way, you end up at the code you listed.

continued...
Kayaker
12-26-2000, 05:14 AM
What I try to do is watch what params are being pushed in each call as I trace (usually the MenuID as wparam, Hwnd, lparam and Msg). And I usually F8 into Calls that are indirect, i.e. Call [EAX + 64] or that are just before a RET.

So if you step into the 2nd call after you return to program code after selecting a menu item

:004969C6 E8BDFCFFFF call 00496688

you reach the 1st indirect call

:004966EB FF5064 call [eax+64] ; 4978A5

F8 into this and you reach the next

:004978C1 FF90A4000000 call dword ptr [eax+000000A4] ; 4978E9

and the next

:00497912 FF9080000000 call dword ptr [eax+00000080] ; 4AC0E7

Now the next section doesn't have an indirect call, but if you step into the direct call just before the RETurn, you continue on the right path

:004AC153 E830BDFEFF call 00497E88

which leads to the next indirect call at

:00497EC1 FF5014 call [eax+14] ; 4ACAE4

a few more of these and you get to another indication of something important happening - lots of parameters pushed!

:0049A53B FF7514 push [ebp+14]
:0049A53E FF7010 push [eax+10]
:0049A541 FF7510 push [ebp+10]
:0049A544 FF7014 push [eax+14] ; 45AF20
:0049A547 FF750C push [ebp+0C]
:0049A54A FF7508 push [ebp+08]
:0049A54D 57 push edi
:0049A54E E80E000000 call 0049A561

and the stack:

dd esp
016F:0075FA58 0050F070 0000E103 FFFFFFFF 0045AF20
016F:0075FA68 0075FAC0 0000002C 00000000

Suddenly there's an address in the .text section being pushed! This may lead somewhere...

Step into this call and you reach

:0049A628 FF5514 call [ebp+14] ; 45AF20

This is where all the action happens. It's also where you'd end up by doing a backtrace from EnableMenuItem in the first place ^_^

The other thing that's interesting to explore here is when you find the compare with the registered/not registered flag, which controls all checks in the program, do a BMSG RW on the address of the flag and start the program again. You find all kinds of interesting addresses like when it's first mapped into memory in the .data section (can't set it there), when it's checked for the opening nag, and it leads right to the main registration routine.

There's more than one way to skin a cat ;)

Hope this helps,

Regards,

Kayaker
Kayaker
12-26-2000, 05:41 AM
Sorry, in that last paragraph that was supposed to be BPM address RW, not BMSG
Lord Rhesus
12-26-2000, 04:35 PM
I don't want to sound like I am pluging my site but I resently put up a site related to adding functionality (or code injection) where I have archived a few useful tutorials which are related to this topic. The address is http://www.codeinjection.cjb.net hope it can be of use!
Kayaker
12-26-2000, 09:16 PM
Nice! A site dedicated to adding functionality. Let's hope to see more of it in the future. Thanks Lord Rhesus.

Regards,

Kayaker
Clandestiny
12-26-2000, 10:23 PM
Thx Kayaker,

That helped a lot, but I have a couple of questions for ya...

I found the register / unregister flag and enabled all of the menu items. However, I'm doing my best to try to *understand* what is happening as much as possible and not follow *blindly*.

You gave me 2 pieces of advice:
1)trace into the indirect calls first
2)trace into direct calls that are before a return.

To my amazement, both of these tips worked like a charm and I'm wondering *why* you trace this type of code like that? Beyond your advice, I found there to be very few "landmarks" in this section of code. Indeed, without it I would have remained hopelessly lost in a maze. Is this approach a result of your experience? ...Intuition? ...Something having to do with the structure of the code surrounding menus? ...Possibly this wasn't the best approach toward enabling menu functions? That was an awful lot of calls. Is that pretty standard? I think I will try to reverse it again using your TRACE approach.

Now, my second question...I fear it is a bit mundane :-) I was going to put a bpm on the address of the reg / unreg flag so I could explore the possibility of removing the nag. Unfortunately, SoftIce won't break on my bpm. This has been a constant problem...90% of the time it won't break on any bpm I set and I've never been able to figure out why. Usually, I am breaking on API's so this has generally not been a problem...but I would really like to figure out whats going on. Likewise, I have a problem with setting a single bpx on an arbitrary line of code. For example, I tried to directly set a bpx directly on 004969a0, the location after the K32Thk1632 prolog trick, but SICE would not break!

Here is exactly what I did...
bpx 017f:004969a0
bpm 0187:0050f8a4 rw

I don't think there is anything wrong with my syntax and I have re-read the break point section in the manual. If this is a lame question I apologize.

Thx Kayaker,
Clandestiny
Clandestiny
12-26-2000, 10:41 PM
To Lord Rhesus,

Interesting site...and I love the disclaimer ;)

Cheers,
Clandestiny
Kayaker
12-27-2000, 12:20 AM
Clandestiny (12-26-2000 12:23):
To my amazement, both of these tips worked like a charm and I'm wondering *why* you trace this type of code like that? Is this approach a result of your experience? ...Intuition? ...Something having to do with the structure of the code surrounding menus?

Experience? Intuition? Zen? Snicker. ^_^

Nah, I've just cheated a few times and kind of noticed this before. Call it what you want. What I did here just to make sure this would work again was to set a BP on the critical JZ at 45AF28 and then started tracing from the return to program code after selecting the menu item. Every time I stepped OVER an indirect call or a call just before a return, the BP kicked in, ergo you step INTO them.

I haven't done this enough times to prove it statistically, but it *sort of* makes sense. There's usually dozens of menu items that need to be redirected from the same start point, so indirect calls (or jumps in some cases) which can change when necessary (different Msg, wparam, lparam) are logical, especially when you consider how many times K32Thk1632Prolog returns to the same code over and over again.

I like the TRACE approach in a lot of different circumstances when I'm trying to understand what's going on. Here it's simple to use, just set a trace between GetMenuItemID of a disabled menu item and the next EnableMenuItem. Then repeat with an enabled menu item and compare.

BPM's seem to give me a problem as well unless I delete and retype them each time. You could try SuperBPM from one of the tool sites, seems to work well with Asprotect anyway. I'm curious though why your register offset is so different between the two breakpoint types - 17F and 187? I know it changes on everyones system, but mine is always 167/16F. Maybe try it without the CS/DS offset?

You may have also noticed that when you first break into a program with Loader you need to F8 once to change the code window from all INVALID to code, before setting a direct address BPX.

Cheers,

Kayaker
meRlin
12-27-2000, 01:36 PM
Hi,

here is a nice place to enable all items, if you do it this way it's not registered and the nag is still left to remove :)

mov eax, dword ptr [ecx+00000834]..
test eax, eax..
jne 0045AF34..
mov ecx, dword ptr [esp+04]..
push 00000000..
mov eax, dword ptr [ecx]..
call dword ptr [eax]..

figure it out by yourself.

meRlin
JaneK
12-27-2000, 02:17 PM
Hi Kayaker,
Well, I decided to post few words so you know that more people are working on this
project :).
First of all I have to admit that I was beaten here - I did not manage to reverse the target fully, neither to follow the way I was planning to.
My approach was similar to what Clandestiny already mentioned:
1. I set bpx on EnableMenuItem and then clicking on "File" triggered the bpoint. In the Mixvibes code I noticed 3 pushes before EnableMenuItem was called. The first one (ecx) should keep menu items flags. From Spath's tutorial I know that 03h means MF_Grayed+MF_Disabled. I changed it to 00h (MF_Enabled) and got "Save" and "Save As" (among others) ungrayed. BTW all other menu items that were active before, now became grayed/not active.
2. Ungrayed does not mean enabled, so I decided to find the piece of code that corresponds to the "Save" function, so to bp when "Save" is clicked. After reading about wm_command (0111h) I searched for "cmp register, 00000111" in deadlisting and tried to bpoint on corresponding addresses. No success. Then I used hwnd mixvibes, but that gave a lot of handles. Finally handle for Afx:400000:8:148e worked and I landed at 0177:00495F11.
From there I tried to trace further on, but after some time I realized I am not sure what to look for! What I wanted to do was to have "Save" and "Save As" enabled while the prog remains unregistered! I could not do it.
3. I have the feeling that searching for a serial is easier - at least I'm sure what to look for. I'll do it now just to see both things enabled!

Finally I have to say that this challange was beyond my reach. I mostly regret I wasn't able to follow Spath's tut (I feel all the anwers are there) as much as I wanted. Although I did not manage to complete the crack, I've learnt quite a lot and that was my point. Maybe next time...

Thanks
JaneK

P.S. Just saw above post from meRlin. Something to study for me :)
()whore
12-27-2000, 03:28 PM
Hello everyone I have been following this one quietly,

Kayaker I have to say thanks for the project but DAMN this one was hard to follow. I have never done a menu disabled project befor and I am haveing alot of trouble understanding this one.

I can enable the menuitems fine by bpx on enablemenuitem and changing what value was being pushed in ecx. I even traced backward following all the returns to the getmenuitemid loop. This seamed promising for finding where the program was deciding they were disabled. However there was way to much code to look through and I realy didn't know what I was looking for.

I then tried following the WM_COMMAND from my enabled menu item to find the code for this function. But Lord Soth's tute talked about finding the CMP memory location, Const. I searched through alot of code looking for this but no luck (Is this because it is MFC?).

Finaly I got a few clues from +spath's tut. Specificly the second program he cracks. This is the MFC target and mixvibes is MFC also. HE described perfectly what I had seen in mixvibes:

:7FB21074 cmp ebx, 00000111 ; 111h = WM_COMMAND
:7FB2107A je 7FB2110C
:7FB21080 cmp ebx, 0000004E ; 4Eh = WM_NOTIFY
:7FB21083 je 7FB21138
:7FB21089 cmp ebx, 00000006 ; 06h = WM_ACTIVATE
:7FB2108C je 7FB21176

I also found the indirect calls that he talked about. He goes on to try and explain about lookup tables (which I didn't understand) and finaly trails off; like once you found this table everything else was a done deal. ?

Finaly I read your post about following the inderect calls then finding 45af20. I had acctualy traced through this call several times befor but nothing there stood out to me ( I was looking for the cmp mem,cont ). When traceing through this program what exactly were we looking for ??? I enabled all the functions by fixing this test jnz. But how we arrieved at this spot I still can't figure out.

Another note. +spath mentioned the stack command. I used it with a bpx on enablemenuitem. I found something very interesting with a dissabled menuitem, stacked looked like enablemenuitem,00099553,000abb40,00099920,000ac21a,ect But when an active item triggered this bpx the stack command went from enablemenuitem, to 000ac21a. This happened with every enabled and disabled item. I was unable to translate this into anything productive. Could this have lead anywhere?

I am going to try and do a backtrace with this one and see what happens.
peace,
()whore
Kayaker
12-29-2000, 02:16 AM
Hi All,

So you thought I was brutal posting the disabled menu project did ya? Just wait until you see the next one! Nah, just kidding ^_^

I suppose it wasn't all that easy because you can really get messed up trying to trace the code, but that's pretty well what you're up against with a function disabled situation. I think it was well worth it though to introduce a few new concepts to anyone unfamiliar with them.

I just wanted to mention another tut that's quite good and easy to understand which covers most of what we went over:

Re-enabling functions - Cool Edit 2000 by UmE
http://www.immortaldescendants.org/database/essays/ume/ce-2000.txt

I think it's worth reading just to see a slightly different route to the critical compare which restores the Save functionality. In this case there's a direct CMP with the MenuItemID and a jump to the good/bad flag.

I'm still kicking around some ideas for future projects. Somebody want to give the next one a go?

Regards,

Kayaker
JaneK
12-29-2000, 03:11 PM
Hi,
I thought I should be able to find E103h (Menu ID value for "Save") in the deadlisting, but it's not there!
Why? Where is it?

Thanks
Janek
Clandestiny
12-29-2000, 08:14 PM
JaneK (12-29-2000 05:11):
Hi,
I thought I should be able to find E103h (Menu ID value for "Save") in the deadlisting, but it's not there!
Why? Where is it?

Thanks
Janek

Hi JaneK,

When I first deadlisted MixVibesPro I too was a little puzzled about why I could not find the menu ID's in the listing. After researching / reading quite a few tutorials about menus and such, I don't think the program has these indentifiers hard wired into the code, but instead uses the GetMenuItemID API to obtain the menu item ID's during runtime when it needs to figure out which item was selected.

From the API Reference:

The GetMenuItemID function retrieves the menu item identifier of a menu item located at the specified position in a menu.

UINT GetMenuItemID(

HMENU hMenu, // handle of menu
int nPos // position of menu item
);

Parameters

hMenu

Identifies the menu that contains the item whose identifier is to be retrieved.

nPos

Specifies the zero-based relative position of the menu item whose identifier is to be retrieved.

BTW, this is also my first crack of a crippled menu target, so I could be wrong about this. Kayaker (or someone else who has more experience) is probably more qualified to answer your question :-)

Regards,
Clandestiny
Clandestiny
12-29-2000, 08:57 PM
Kayaker (12-28-2000 16:16):

I just wanted to mention another tut that's quite good and easy to understand which covers most of what we went over:

Re-enabling functions - Cool Edit 2000 by UmE
http://www.immortaldescendants.org/database/essays/ume/ce-2000.txt

Hi Kayaker,

Funny that you should mention Cool Edit 2000. Actually, I tried reversing it myself a while ago (and failed miserably I might add :( ). Hard as I tried, I couldn't get past the CRC check which would not let me patch so much as a *single* random byte in a string resource. I had a look at the essay you mentioned hoping that it could show me where I went wrong. Unfortunately,UmE didn't address the CRC in his essay. After comparing the addresses in Wdasm though, I think it might be a different version. Anyway, I thought I would throw out the possibility of removing the CRC on Cool Edit 2000 as an upcoming project. It can be downloaded from:

h*ttp://www.syntrillium.com/download/getfile.html?001

BTW, there is also the demo version of Cool Edit Pro (by the same authors) which I also unsuccesfully attempted to reverse since it seems to use the same type of CRC as Cool Edit 2000...another menu disabled project perhaps although I don't know if the functions on this one can be enabled...It might be a pure DEMO.

Well anyway, project or not, I'd surely be grateful if you could give me a few pointers on CRCs.

Cheers,
Clandestiny
Kayaker
12-29-2000, 09:03 PM
Hi Janek,

I think Clandestiny pretty much has it right, it just means the program never uses the MenuItemID directly, as in a direct CMP. Some disabled menu programs apparently do (CoolEditPro), some don't.

Like the majority of Windoze programs, this one uses the Comdlg32.dll functions GetOpenFileNameA and GetSaveFileNameA to open the appropriate Common Dialog box. Even where Mixvibes decides which one to use, it's only a flag compare:

:00493F18 JZ 00493F21
:00493F1A CALL comdlg32!GetOpenFileNameA
:00493F1F JMP 00493F26
:00493F21 CALL comdlg32!GetSaveFileNameA

I backtraced from here using BPM address X a bunch of times at the start of code sections and found the main branch point for all menu items. It starts with the program sitting in a loop checking all the MenuItemID's in turn and if any one was selected:

--------Start Loop
:0049A53B PUSH DWORD PTR [EBP+14]
:0049A53E PUSH DWORD PTR [EAX+10]
:0049A541 PUSH DWORD PTR [EBP+10]
:0049A544 PUSH DWORD PTR [EAX+14]
:0049A547 PUSH DWORD PTR [EBP+0C]
:0049A54A PUSH DWORD PTR [EBP+08] ; cycles through MenuItemID's
:0049A54D PUSH EDI
:0049A54E CALL 0049A561
.
.
:0049A583 CMP EAX,0C ; 2C if no menu item selected, 0C if there was user input
:0049A586 JA 0049A5A5
--------End this section of Loop

:0049A588 JZ 0049A59A
.
.
:0049A59A MOV ECX,[EBP+08]
:0049A59D CALL [EBP+14] ; main branch to menu routines

The stack display at this last Call shows the wparm (=MenuItemID =E103 for Save) and Msg (111) from WM_COMMAND:

dd esp
016F:0075FA08 004E3328 00000111 0075FA40 0049A553
016F:0075FA18 00D90078 0000E103

And the program branches to the appropriate routine for the menu item selected.

OK, so what good is all this? Well, it could be another route for finding the critical compare in menu disabled programs. It seems that this checking loop is pretty important because it's also run through on startup. Now if you put a BP on the loop at
:0049A54E CALL 0049A561
with say BPX 49A54E do "dd esp"
and start the unpatched program, again you see each of the MenuItemID's being checked. When it's one of the disabled ones, bypass the
:0049A583 CMP EAX,0C
by editing the EAX register to 0C, pretending that the menu item was selected. If you do that the address at
:0049A59D CALL [EBP+14]
happens to be **45AF20**, which if you remember was the address that led to the critical compare that we got to by other routes (manual tracing from selection of the patched enabled menu item, or doing a TRACE).

I hope everybody understands what I'm getting at here. It's sort of why I alluded to the Comdlg32.dll functions GetOpenFileNameA and GetSaveFileNameA in my original post - as being a potential avenue for tracing to figure out how to actually get them called and restoring full functionality once you've ungrayed the menu items.

Regards,

Kayaker
JaneK
12-30-2000, 05:39 AM
Thanks a lot.
I'm back to work now :)

JaneK
Ignatz
01-03-2001, 03:34 AM
interesting project here....

not being a cracker myself really (more of a ~coder who finds reversing interesting~) i havent paid much attention to this section before..... but i have been wanting to try menu-disabled programs for a while... gonna grab the proggie and the tuts and give it a whirl!

(and gonna try to do it without reading ppl's posts on here about it , fingers crossed)
Kayaker
01-03-2001, 11:12 PM
Ignatz (01-02-2001 17:34):
interesting project here....

not being a cracker myself really (more of a ~coder who finds reversing interesting~) i havent paid much attention to this section before..... but i have been wanting to try menu-disabled programs for a while... gonna grab the proggie and the tuts and give it a whirl!

Great! Please reply with any results you might want to post.

You speak the truth, it IS the Reversing that's interesting, not the Cracking 8)

Regards,

Kayaker
BlackB
01-04-2001, 08:33 AM
Well, great project kayaker ;)
When I first saw you on a messageboard (don't remember which one) about Guitar Pro about a year ago (or something), I knew you would become a good reverser ;) and now you are :)

Maybe an additional task for all people following this project: get the "Save" or "Save as..." function enabled in Guitar Pro v2.20 or v3.0. They are not grayed :) The challenge here is to change the program that way it saves any .GTP file no matter how many notes and bars.
Before you start this one I can tell you: This one is hard :) For the hardcore reversers, who get bored very quickly: crack the whole program ;).And please try not to cheat by reading my tutorial I wrote on it :P Use it as a "lender of last resort" when you're REAL stuck.

To end: greetz kayaker....remember the guitarpro dayz? :)

cya all

greetz

The Blackbird aka BlackB
Kayaker
01-04-2001, 10:32 PM
Hi BlackB,

Hey, how's it going? Thanks for the compliment man, but then I had plenty of good teachers including you and your great site ;-) Cracking 4 Newbies should be required reading for everyone! I especially found your unpacking tuts very useful and still use 'em as reference.

Ahh yes, the GuitarPro days... ^_^

Yeah!! Anybody wants a Full-Monty demo, mega-crippled example of real reversing, check this one out! I thought the guy was going to choke on it 'till he puked 8)

Hey, keep up the good work.

P.S. There's a good true reversing project coming soon from Clandestiny, stay tuned... (Sorry Clan, you're in for it now, heh heh ^_^

Cheers,

Kayaker
Lord Rhesus
01-05-2001, 10:34 AM
Looks like a really interesting project that you have going. If I didn't have so much work to do at the moment I would love to have a go at the project.

I had a go at something similar to this with HyperSnap-Dx v3.50 (which is a screen capture program) a year ago. I had a go at the serial number but couldn't get my head around it at the time, so I decided to take a different approach and try to make the program look like it's registered. It is a similar challenge like you have going here.

This program has been cracked/keygened black and blue by many different crackers so there isn't any damage that can be done to the makers. The program features anti-SoftICE routines (unfortunately it's plain old MeltICE :() and CRC checking. The problem with the shareware version of this program is that there is a big nag screen at the begining, and if you save your screen capture then there is a little message tagged to the top left hand side of the capture saying that the screen capture has been taken by a shareware version of the program. If your interested in the challenge then here are the tasks that I set myself last year:

1) Neutralise CRC code
2) Prevent tagging of screen captures
3) Kill nag screen at beginning
4) Disable all links to register and buy screens
5) Change about box so it looks registered

There is a newer version of the program out now (version 3.63 I think) which you can get from www.hyperionics.com if your interested. Also I started writing a tutorial for this a year ago but I lacked the will and I didn't finish it. If anyone really wants I'll rewrite the tutorial and update it to the newer version of HyperSnap, but only after the end of January when my workload vanishes. For interest, Douby also wrote an essay on reversing the CRC check for version 3.30. If your interested and you can't find Douby's essay then e-mail me at lordrhesus@yahoo.co.uk and I'll send you his tutorial.
Ignatz
01-16-2001, 06:13 PM
oooooooooops....

hehe had some system probs before i got very far along...

two reformatted and repartitioned hard drives,
one reinstalled windows98, one reinstalled linux mandrake 7.0, one reinstalled openbsd 2.8 and a bunch of dowloads (not to mention a new soundcard) later... here i am lol

gonna get back after it soon but right now am grabbing the october platform sdk (and thinking next time it might be better to order the "inexpensive cd")

anyways found the "required readings" interesting.. think ill play around with the toolhelp funcs a bit
x!
01-30-2001, 04:56 PM
Thanks to Kayaker and Clandestiny for pointing me to the mini projects page. Great thing to have going here. :)

I'll check the other posts out in 14 days.

in case someone wanted a different gray-challenge, I'll post the link:

http://www.woodmann.net/cgi-bin/Ultraboard/UltraBoard.cgi?action=Read&BID=8&TID=684&SID=

greets guys!
JaneK
02-20-2001, 04:49 PM
Hi,
I know ppl are busy with the new project, but maybe someone can help with MixVibesPro (still).
I tried to find the correct serial, but without success. I start to suspect that it's not appearing in memory as a string, but rather some checks of single characters (one by one) is performed.
Is it possible at all or am I looking in the wrong place?

Thanks
JaneK
Kayaker
02-21-2001, 09:56 PM
Hi Janek,

Heh, I had never looked at the s/n routine before. I traced what was happening to the s/n just enough to follow the code as it was being transferred from one memory address to another, ignoring the details, then I noticed a comparison starting at

:004censored :) lea esi, dword ptr [esp+08] ;some 4 char number
:004censored :) lea eax, dword ptr [esp+1A] ;your s/n

At first I couldn't really clue in on what was happening until I used the maximum length s/n for the edit box, then I realized there was a pattern it was expecting xxxxx-xxx-xxxx, because it breaks your s/n into these chunks. When I filled it this way it started to become clear what was happening in the routine. The 4 char number in esi is compared with the last 4 digits of your s/n. If you pass you continue to a routine which checks the middle 5 chars. This part's a little different, it's expecting a delimiter, but not the "-" (2D) that I had guessed at. 2 of the 5 chars can be "us" or "fr", though this doesn't seem to change any language setup. Finally, the 1st 5 chars are totally ignored because these are apparently the ones which determine what the final 4 chars should be. I don't know what their relationship is but if you find out let me know for interests sake.

If you can match up a working s/n (keep the 1st 5 chars the same and glean from the code what the rest should be), you find after all that trouble - it doesn't give a hoot what your name is!

If you need any uncensored help, just say so ;)

Cheers,
Kayaker
JaneK
03-04-2001, 05:10 PM
Hi Kayaker,

First of all thanks for your help. With your hints I managed to find the correct serial.
Here is what I have found so far:
Expected pattern is xxxxx/xxx/xxxx.
As you mentioned, 1st 5 characters are used for calculating the last part of the serial. Seems that hex notation is assumed, because I found them in eax exactly as they were entered in the dialog box.
In the middle part, 1st and 2nd char can be f and r and the 3rd one can be any number between 1 and 9.
Delimiter is "/".
Looks to me that entire serial never appears in memory as string (there are many correct serials).
I have to look a bit more in few places, but main job is done.

Thanks again
JaneK
Kiran
03-07-2001, 01:05 AM
Hello everyone,
I have been working on this project as well. However, I have a problem using the TRACE functionality. I am trying to learn this advanced option in SI, following Kayaker's comments on this subject in order to solve this lesson. Well, I am not having muck luck. I tried to put a bpr between GetMenuItemID and the end of EnableMenuItem. That did not give me any results. Actually it does not show much... only 20 or so indexes which do not differ between an enabled item and a disabled item. So I tried from different locations without much success.
The only thing that I could think of was to TRACE small parts at a time from when the GetMenuItem gets call up until the end of EnableMenuItem. But that doesn't look too smart as there is a lot of code and nested calls in between, therefore, defeating the purpose of using TRACE.

Sooooo.... Kayaker, can you explain me how should I put the bpr?!? It does not look like I am fully comprehending the TRACE option in SI.

Also, when use TRACE can you go inside a call?!?
Hopefully, I am confusing only myself and no one else.

Thanks,
Kiran
Kayaker
03-07-2001, 07:53 PM
Hi Kiran,

To get the Trace function to work OK for you, you should first make sure you've got enough memory allocated for the back trace buffer. The default is I think 8K, I normally use 16K which was enough for Mixvibes. You set it in winice.dat with the line TRA=16 or you can set it with the SoftIce loader. The buffer is linear in that once it's filled, that's it. So if it's too small, and you've got lots of traced instructions to index you may never see the final target breakpoint reached.

For this particular target set a BPX GetMenuItemID and click on the File menu. SI should immediately break. If you continue to press F5 you should see the 2nd stack parameter, or the zero-based position of the menu item, displayed in EAX. 0 for the 1st, 1 for the 2nd, etc. Save and SaveAs are 2 and 3.

Disable ALL other BP's other than GetMenuItemID and set your Trace. You can specify the memory range, but it's just as easy to set the whole program address range with 'BPR module T' where module is the name you see when you type TASK. Make sure you get the right module name, it's cut off after 8 letters in SI, but the BPR command will need the full name as listed by 'MOD' to work properly. (just make it easy and shorten the filename). Then set a BPX EnableMenuItem and press F5 again. The backtrace buffer should now be filled with all the instructions traced, including those within Calls, that are within the address range specified.

I usually hide the Code and Data windows with WC and WD then type 'SHOW 1' where 1 is the very last instruction traced, which *should* be EnableMenuItem if all went well. If you just type SHOW it will display the very first instructions traced, numbered somewhere in the 900's. You can use the PgUp/Dwn or arrow keys to move around. You can also check out the TRACE command as well, but I usually only use SHOW.

Unfortunately you can't easily save the backtrace as you see it displayed, though there is a way to dump the memory and convert at least the addresses, though not the opcodes, to a listing, though I've never bothered doing it. Usually I just look for interesting addresses to set BP's on or /screendump pages and compare them between enabled/disabled menu item tracings.

Make sure you disable the Trace BPR before you do anything else or it'll keep tracing when you exit SI, tying up the CPU and overwriting the buffer. Also be sure to use XRSET to clear the buffer when you want to start afresh.

Hope this works for you.

Cheers,
Kayaker
Kiran
03-07-2001, 11:54 PM
Thanks Kayaker. I will try your suggestion and not use the memory range approach I was using.

Thanks,
Kiran


Desperately needing help on a VB6 project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Desperately needing help on a VB6 project
PDA

View Full Version : Desperately needing help on a VB6 project

Vanilla Pie
01-02-2001, 02:04 PM
Hi everyone,

I am tyring to crack a futures trading system created by www.internationaltrading.com and finding a few difficulties in it, and also hoping that someone will be able to help me a little.

The system comprises 5 trading systems, each enabled by a password (created using a serial number generated by your machine and the system you have purchased).

I have managed to bypass the limit on how much data can be loaded in the unregistered version, and I have also managed to get the password verification to accept any password, but that doesn't work.

Please could someone help me, or if we could make it a project, that would be great.

Many thanks,

Vanilla Pie
Kayaker
01-02-2001, 03:49 PM
Hi,

How about a direct d/l link and a file size so people can consider it? I don't think many want to have to have a special password emailed to them by the company just to login to the d/l site.

If it seems reasonable, then perhaps you'd like to give some introductory lessons on how to approach protections in VB apps? The purpose behind this Project forum is as a teaching/learning outlet for Newbies and VB hasn't been covered yet. I think to validate the help you desperately request as a project, you should be willing to provide at least a little guidance for those to whom VB breakpoints are an unknown entity.

Regards,

Kayaker
Vanilla Pie
01-02-2001, 04:46 PM
Hi keyaker,

The setup EXE for the application is 7.8mb. Do you know of anywhere I could place the file as a d/l? Would people be willing to look at it with a size like that?

Although I don't have much experience in VB cracking, I can add the following reference to VB and softice tutorials site to get you started:

http://www.idca.com/~thesandman/students.html

In Identifying a VB 5/6 Application
-----------------------------------
First we have to know what we're dealing with Version 5 or 6. So we take a look into the .exe.
I use Hex Edit for that action simply right click the .exe and select Hex Edit. At Offset (+/-) 238(hex) or 250 (hex) you'll find the entry MSVBVM50.DLL or MSVBVM60.DLL.

Setting up Softice
------------------
OK we know which DLL is used. Now we have to setup up Softice

That's one of the most important things!!!

Open winice.dat in your softice directory and go to section:

; ***** Examples of export symbols that can be included *****
; Change the path to the appropriate drive and directory

exp=c:\windows\system\msvbvm60.dll
;exp=c:\windows\system\msvbvm50.dll

Enter these two lines. Depending on which .DLL is used you have to disable the other by using the ; (Semicolon).
In this case my program uses msvbvm60.dll and msvbvm50.dll is disabled
NEVER ENABLE BOTH DLL's!!

Give softice a little bit more memory SYM=4096

After you have saved the changes you will have to reboot!

Regards,

Vanilla Pie
()whore
01-02-2001, 10:41 PM
; ***** Examples of export symbols that can be included *****
; Change the path to the appropriate drive and directory

exp=c:\windows\system\msvbvm60.dll
;exp=c:\windows\system\msvbvm50.dll

Enter these two lines. Depending on which .DLL is used you have to disable the other by using the ; (Semicolon).
In this case my program uses msvbvm60.dll and msvbvm50.dll is disabled
NEVER ENABLE BOTH DLL's!!

why Never enable both? I have both enabled in my winice.dat and so far have not noticed any problems.
Kayaker
01-02-2001, 11:34 PM
Hi ()whore,

If you check out the export functions of the 2 VB dll versions, you'll see MANY of them have identical names, but different addresses. This confuses SoftIce if you say BPX _vbaStrComp or something. I'm not sure which one is chosen as priority, it *may* have something to do with the order you have them set up in your winice.dat file and which one gets loaded first. If you DO have both of them loaded at the same time, you'd have to set the BP as a direct address of the function in the particular version you want, to be sure you got the right one (unless you got lucky the 1st time ;-)

Kayaker
hz
01-03-2001, 12:07 AM
Hi,
I believe you just use msvbvm60!__vbastrcmp or msvbvm50!__vbastrcmp as
appropriate
regards
hz
?ferret
01-03-2001, 04:59 PM
yes that does work hz....but I'm essentially lazy and would rather type a semi-colon once and go mix a drink while I rebbot ;-)
hz
01-03-2001, 07:45 PM
Hi,
yeah I'm very lazy too, so I put the msvbm on an fkey so I only need to type it once.
cheers
hz
?ferret
01-03-2001, 08:57 PM
good thinkin!


Great Project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Great Project
PDA

View Full Version : Great Project

Mustapha
01-04-2001, 06:58 PM
Hi Kayaker,
I met the projet too late. I read some of the tuts and
I tried myself to see what happend. Well, ungray the
"Save as" was easy But meke it work it's another story.
When I read Lord Soth's tut "Now, trace through the code,
carefully look for that CMP, and you should see it after a while."
I thought I must prepeared for that *While*. I was looking for
E104 or 111 something that could gave force to my finger
because it was tired of pressing F8. In some part of the
code, EBX=111 and I entered into a Call, then EBX was xored
but three lines after that there was a CMP or I must say The Holy CMP.

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00497E48(C)
|
:00497E93 57................. push edi
:00497E94 0FB7F8..............movzx edi, ax
:00497E97 33DB................xor ebx, ebx ; EBX is xored
:00497E99 8BF1................mov esi, ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00497E50(C)
|
:00497E9B C1E810..................shr eax, 10
:00497E9E 395D0C..................cmp dword ptr [ebp+0C], ebx
:00497EA1 894508..................mov dword ptr [ebp+08], eax
:00497EA4 753A.<----- here ---->..jne 00497EE0 ; MUST BE JMP(EB)
:00497EA6 3BFB....................cmp edi, ebx
:00497EA8 7466....................je 00497F10
:00497EAA 8D4DD4..................lea ecx, dword ptr [ebp-2C]
:00497EAD E8A9FFFFFF..............call 00497E5B
:00497EB2 8B06....................mov eax, dword ptr [esi]
:00497EB4 8D4DD4..................lea ecx, dword ptr [ebp-2C]
:00497EB7 53......................push ebx
:00497EB8 51......................push ecx
:00497EB9 6AFF....................push FFFFFFFF
:00497EBB 57......................push edi
:00497EBC 8BCE....................mov ecx, esi
:00497EBE 897DD8..................mov dword ptr [ebp-28], edi
:00497EC1 FF5014..................call [eax+14]
:00497EC4 395DFC..................cmp dword ptr [ebp-04], ebx
:00497EC7 743E.<----- here ----->.je 00497F07 ; MUST BE NOP(90)
:00497EC9 895D08..................mov dword ptr [ebp+08], ebx

If I change one of the Cmp, the prog works well. I donot know
why the two Cmp are there. I write this because I'm very happy now,
and because is good to tell how the things happend or what was
in my(or someone) mind in that moment.
(Maybe the power of my little finger do the job, who knows?)
I must say that this Project was great because it makes you go deeper
in reversing.

Regards,
Mustapha
Mustapha
01-04-2001, 07:03 PM
SORRY!!!!!
I posted out of the project folder!!!
Kayaker
01-05-2001, 01:30 AM
Hi Mustapha,

I don't know if you've heard the famous Bugs Bunny phrase "I don't know howz ya done it, but I knowz ya done it!", but it applies here ;) (actually I think it was Yosemite Sam who said it first)

The code you found is in that complex path leading from the selection of a menu item (after you've ungrayed it) to what I was calling the "critical" compare at 45AF20. Trace by stepping into the indirect calls/last call before a RETurn as outlined before and you'll reach it:

:00497E9E 395D0C..................cmp dword ptr [ebp+0C], ebx
:00497EA1 894508..................mov dword ptr [ebp+08], eax ; MenuItemID
:00497EA4 753A.<----- here ---->..jne 00497EE0 ; MUST BE JMP(EB)

If you patch the jump as you mentioned, this restores the functionality of all the disabled menu items, even if the JZ at 45AF20 ISN'T patched!

I'm not sure what the significance of [ebp+0C] is (the address is 75FAF8 while the memory address used at 45AF20 was 50F8A4), but this could be interesting to explore if anyone wants to go into this further.

In any case it works and you can't argue with results. Good job!

Regards,

Kayaker


Menu Reversing Project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Menu Reversing Project
PDA

View Full Version : Menu Reversing Project

MaTRiX_2k
01-07-2001, 05:13 AM
Greetings Reversers,

I am having a sinking feeling of late, because of a problem, which
i am unable to understand.
It is regarding the Menu reversing project (Target: MixVibes PRO 2.23a).
I made a BPX on enablemenuitem and came to this code.

:0049A759 56 push esi
:0049A75A 8BF1 mov esi, ecx
:0049A75C 57 push edi
:0049A75D 8B460C mov eax, dword ptr [esi+0C]
:0049A760 85C0 test eax, eax
:0049A762 7426 je 0049A78A
:0049A764 837E1000 cmp dword ptr [esi+10],
:0049A768 757A jne 0049A7E4
:0049A76A 8B4C240C mov ecx, dword ptr [esp+0C]
:0049A76E F7D9 neg ecx
:0049A770 1BC9 sbb ecx, ecx
:0049A772 83E1FD and ecx, FFFFFFFD
:0049A775 83C103 add ecx, 00000003
:0049A778 80CD04 or ch, 04
:0049A77B 51 push ecx ->Flag
:0049A77C FF7608 push [esi+08] ->Menu Item
:0049A77F FF7004 push [eax+04] ->Handle To Menu

* Reference To: USER32.EnableMenuItem, Ord:00B0h
|
:0049A782 FF150C264C00 Call dword ptr [004C260C]
:0049A788 EB53 jmp 0049A7DD ;->Returned To The Caller came here

Then I Bpx'd the Pushes before the call as described by Lord Soth.

On the next pass, I watched the value of ECX, it's value (flag) was set
to 02.
But i had a problem when i began to read the 2nd & 3rd parameter's.
They did not correspond to any, ID's I had seen in Win32dasm.
Maybe I was reading it the wrong way.

Anyways here is what i saw in Softice:-

ECX -> 016f:00000403 02 00 00 00 00 78 03 - 00 00 00 13 02 23 c4 fe

MenutItem ->

016f:0075f3dc 01 00 00 00 90 53 EA - 00 00 00 00 00 00 00 00

Handle ->

016f:00EA5394 D4 03 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00

Then I said Enough of this, and tried to patch it.

I saw this:-

:0049A772 83E1FD and ecx, FFFFFFFD
:0049A775 83C103 add ecx, 00000003
:0049A778 80CD04 or ch, 04
:0049A77B 51 push ecx

00000003 was added to ecx. I guess that 3 was added to some number may be -1 to give 2. So why not change this to 1 ?#$#. (I may be stupid sometimes
so bear with me)

I opened up HEX Workshop, I must confess that this was the first time,
i was using it. I searched for 0049a77b and guess what i did'nt find it.

Then I guessed that I must search for the offset value (0009b75h) given by Win32Dasm (Staus Bar).
I got this junk, i did'nt know what to do.

:00099b70 1BC9 83E1 FD83 C103 80CD 0451 FF76 08FF

This was the last thing i wanted, which effectively stopped my cracking
session for the day.

Please help this newbie out.

Please suggest if, there is anything I should read to increase my knowledge. (Other than the one's suggested by Kayaker.)

Signing Out
MaTRiX

PS:-

Sorry I am getting a lot of I's in my english, this human being
shall try to improve his lang.
Clandestiny
01-09-2001, 09:04 AM
Hi,

Why don't you try Hacker's View instead? IMO, its much nicer because it allows you to edit directly in asm.

Regards,
Clandestiny
MaTRiX_2k
01-09-2001, 02:12 PM
Thanx Clan, I will give it a try.


Great Board - Could it be better?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Great Board - Could it be better?
PDA

View Full Version : Great Board - Could it be better?

xOptiMus
01-07-2001, 03:05 PM
Hi reversers,
I think this newbie project area is a great idea, but i do think and agree with many others that it could be even better if there were maybe a few projects taking place simultaneously. I know at first this sounds like it might get a bit messy, but if there are only 2 or 3 and the threads are labled accurately, then I don't really see a problem.
For Instance, the projects could still be numberd project 1,2,3 etc, but a level indicator could be added e.g. (bas)ic, (int)ermediate, (adv)anced.
Another idea might be to have a theory section whereby the moderators/advanced reversers could teach us important fundamentals and then test our understanding with questions. I think this would be very valuable because it would be like a two way interactive tutorial. Tutorials par se are good, but I've often read one and thought: "how the hell did he arrive at that!", or "there you go again assuming your readers have that prior knowledge". Don't get me wrong tuts are great, and we all need them. But, what I am saying is this: how wonderful it would be to learn important fundamental concepts from a tut like teaching tool, and then be able to clarify any misunderstandings or grey areas by questioning!
Another advantage here would be that any moderator/advanced reverser running a "hands on project" could, from time to time, check the last few "theory projects", and then base their projects accordingly. In this way all active projects although possibly on different levels, could all be related if need be. I think that all this would introduce more flexibility and choice to the board which at the end of the day has to be a good thing!

Anyway these are just ideas, and it's my hope that even if none of them are taken up, maybe at least they can be a springboard to others.

Best Regards
xOptiMus
MaTRiX_2k
01-07-2001, 10:12 PM
Hello all,

Great Idea mate, i can't agree more with you on this. I too experienced the same thing as you have. By the time i started ungraying the new/open/save/save as menu item's whoosh! the project was over. And iam still stuck at the same place. I really really, liked your ideas. IMHO if that was done, there would be no need for seperate projects.

BTW:- Having seperate projects, would cause

1.) a lot of confusion as you correctly thought out.

2.) There would be no communication between, exp'ced reverser's and newbie's like me/us can i say ? , if project's & board members were divided on basis of levels. You get my point don't you.

3.) the moderator would have a hell a lot of job to do.

4.) But most importantly there would be no fun.
What I mean is, there would be no competetion. IMHO, to increase our
level of knowledge we must compete & learn from those who are better than us. Even if we get beate'n badly.

But this will be good only when :-

-------------------------------------------------------------------------
*****
1.) Another idea might be to have a theory section whereby the moderators/advanced reversers could teach us important fundamentals and then test our understanding with questions. I think this would be very valuable because it would be like a two way interactive tutorial.
-------------------------------------------------------------------------
*****
2.) But, what I am saying is this: how wonderful it would be to learn important fundamental concepts from a tut like teaching tool, and then be able to clarify any misunderstandings or grey areas by questioning!
Another advantage here would be that any moderator/advanced reverser running a "hands on project" could, from time to time, check the last few "theory projects", and then base their projects accordingly.
--------------------------------------------------------------------------

(Copyright's to xOptiMus) are implemented. Then theory wize if not in experience we would be on the same level. So, then we would be able to reverse any damn protection under the sun.

Food for thought, that's all. But i really hope this get's implemeted.

With Regards
MaTRiX

PS:- Sorry for my post Named "Menu Reversing Project".
I guess i have wasted a lot of people's time reading my tale.
I did not intend to misguide you good people, it's only a query
not a new project.
You can't expect a new project from a newbie can you?
Well you know it now. If you get any posts named like this from me
(if any) you can comfortably shove them off.
Thankyou.
Kayaker
01-08-2001, 02:24 AM
Hi,

Thanks for posting this again xOptimus, it's always good to have discussions, especially in a fledgling operation such as this. I agree with everything that's been said. I love it when the board is active and rocking, but as I'm sure you can understand it's dependant on the time and willingness people have to give to the projects, on both sides.

More than 1 thread at a time - yeah, it'd probably work. It'd be nice to have some easy introductory projects going that the raw rookie could get into and get something out of. I still think there's a lot of people who would like to join in but feel perhaps a bit intimidated by it all, let alone not wanting to ask "lame" questions or posting their results.

This is really my main concern, that some newbies may be feeling left out. The thing is, we can't only post basic projects because many others will get bored, won't be challenged and won't learn anything. We also need intermediate/advanced challenges so all of us can learn and teach the new people coming into RCE.

I'm concerned too about MaTRiX_2k's comment about the projects seemingly being "over" while some people are just beginning. Well, they're never really over as long as someone keeps posting, but I understand the sentiment. I think part of the problem is the format of this board. With Sandman's old projects everyone had their own thread and they could go on for weeks. No one had to read the other threads or the "answers" if they didn't want to. With this format all being in one thread, if someone asks a question, you want to reply to it and give as much help/instruction as possible, but of course everyone else tends to read it as well, perhaps taking some of the fun out of the whole thing. I'm not sure what the solution to this is - less direct answers and let people work it out for themselves?

Question/answer sessions on RCE theory- nice idea but again, could be a lot of work. Someone's got to take the initiative and actually put the thought and effort into developing the 'lesson'.

There's been at least a few suggestions recently for potential projects. Have these gone by the wayside? Or should they be presented differently, as in "This is the next project OK? and these are the tasks, now sharpen your pencils!" ??

One thing I'd like to cover fairly soon is a basic project in writing an inline patch, where you jump to an empty section of the program, write your own code to do something, then jump back into the program. Many people already know how to do this, many probably don't, but this opens up a whole new world into the realm of Reversing and not simply patching/serial fishing. It also develops your ASM programming skills when you've suddenly got all kinds of empty space to write any code you want.

In any case, this board is going to be what we make it. We need people to develop projects, small and large, basic and advanced. And we need people to participate in them. One feeds the other and maybe we get the snowball rolling...

Just more fodder for discussion.

Regards,

Kayaker
xOptiMus
01-09-2001, 02:28 PM
Hello again

Thanks for the response and support MaTRiX_2k, and Kayaker. Yes, I agree with you both, Ideas are fine, but their implementation isn’t always so easy is it. I do realise this, I just wanted to convey (as a newbie) what I feel is often missing within the reverse engineering teaching/learning arena.
The reason I suggested a theory section was not because I think this is lacking - there are numerous tuts and technical essays out there - but because whenever interesting theory is encountered, it's more often than not on such a high/technical level, that it's not of much use to a newbie. I've often come across material like this and most often in so called newebie tuts. I think a lot of authors although extremely knowledgeable and experienced in RCE, are unable to communicate that knowledge in such a way that newbies can understand it. I say “unable to communicate”, though that’s probably not quite true. I think it’s more likely the authors get a little carried away with what they know, and are unconsciously trying to impress us. Please don’t misunderstand me here, I’ve seen nothing of this here on this board, I’m talking more on the line of tuts and essays.
The reason I thought that a theory section on this board would add to it’s value is simply this: that anything not understood in a topic being discussed could be questioned, clarified and elaborated on by anyone knowledgeable and experienced enough to do so. This questioning would hopefully also encourage the answerer to elaborate and explain things in a way that newbies would understand. For instance, if the answerer is a little too technical on a particular point then a subsequent question will force him/her to explain in a more simplified way.
Hope I haven’t waffled on to much about keeping things simple and non technical, but after all this is a newbies’ board isn’t it?

BTW kayaker I would love to see a project that introduces “inline patching” as you mentioned earlier – sounds great!

Regards
xOptiMus


Possible project here...Multiple tasks involved!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Possible project here...Multiple tasks involved!
PDA

View Full Version : Possible project here...Multiple tasks involved!

ThRaX
01-07-2001, 06:15 PM
Hey all, here is a semi-menu-enabling project for you all to work on. Also, it quits you out of the program after 30 minutes, and only has 16 uses available...

ht*p://www.software-technology.com/scripts/downform.pl

(ht*p://www.software-technology.com/scripts/downform.html if that doesnt work)

For me i downloaded the downform.pl file and renamed it to downform.exe, then ran it and it installed the program...a bit strange....

Anyway, anyone have any luck please post here..So far i've been totally stumped here...

Later

--ThRaX
Kayaker
01-08-2001, 04:33 PM
New Project - Vaz+ 1.7

Hi All,

Hmmm, this smells of a nice project. Small d/l size (970Kb), not packed, written in Delphi, disassembles with DeDe. Nice find Thrax.

OK, how about we make this the next project? Sharpen your pencils ^_^

I found I had to go to the main site at
ht*p://www.software-technology.com
to d/l it. You don't really need to enter your email address, but you do need to change the filename from downform.pl to downform.exe as Thrax says.

I haven't had too close a look at it yet, but it looks like it might be fun.

This demo is fully functional with the following exceptions:
1. You CAN save, but NOT load patches (except defaults)
2. It will time-out after 30 minutes
3. It can be used a maximum of 16 times

Well, that sounds like 3 nice tasks ready-made for us ;)

1. The Open button is enabled but you get a demo nag. Does the code for opening files actually exist and can you restore this functionality? This may be the hardest task. Review the last Menu Enabling project if this is your first shot at this.

2. Timeout after 30 minutes. What's used to monitor the time? A timer event? GetLocalTime? GetTickCount? TickTockExA?

Can you find a way to subvert the timer for unlimited use? How about changing it to limit your usage to 1 hour max? (gotta save some playtime for RCE ;)

3. Maximum uses of 16. Where is this info kept, a file, the registry? Can you modify the code so that after every use a *fixed* value is written back so that the maximum uses check always passes? i.e. don't patch a simple
CMP EAX, 10
JG
make it a little more ingenious.

Bonus Task? There's other potential here as well. Any other ideas? It has a nice splash/nag screen that you need to click on to continue. Sure would be nice to get rid of that...

I think at least 2 of these tasks should be reasonably easy so it would be nice to hear from anyone who hasn't posted much yet and has any questions or comments, or feels like sharing their results.

Good Luck once again,

Kayaker
MaTRiX_2k
01-09-2001, 02:05 PM
Hello All,

I think I am close to solving the 3rd task. There is a patch you can make
to run it more than 16 times. May be you'all might have already done it.
But hey give me a chance to be the first one to post a Solution for the
easiest part of the Project.

* Possible StringData Ref from Code Obj ->"VAZ+ Demo"
|
:004A6391 BAC46A4A00 mov edx, 004A6AC4
:004A6396 E8FD40FAFF call 0044A498 -----> Call For The Splash
Screen I Think
:004A639B E88C1CFCFF call 0046802C -----> Critical Call
May Be It Counts. Too Confusing!
:004A63A0 84C0 test al, al
:004A63A2 0F8598000000 jne 004A6440 ---->********** Patch It
to jmp and no 16 times limit.
:004A63A8 A1588A4B00 mov eax, dword ptr [004B8A58]
:004A63AD 8B00 mov eax, dword ptr [eax]
:004A63AF E86413FAFF call 00447718
:004A63B4 A1448C4B00 mov eax, dword ptr [004B8C44]
:004A63B9 8B00 mov eax, dword ptr [eax]
:004A63BB 33D2 xor edx, edx
:004A63BD E87A29FAFF call 00448D3C
:004A63C2 6A00 push 00000000
:004A63C4 8D4DEC lea ecx, dword ptr [ebp-14]

* Possible StringData Ref from Code Obj ->"The VAZ+ demo will only run 16 "
->"times. Would"
|
:004A63C7 BAD86A4A00 mov edx, 004A6AD8

* Possible StringData Ref from Code Obj ->"DemoRunCount1"
|
:004A63CC B80C6B4A00 mov eax, 004A6B0C
:004A63D1 E85AB3FAFF call 00451730
:004A63D6 FF75EC push [ebp-14]
:004A63D9 68246B4A00 push 004A6B24
:004A63DE 8D4DE8 lea ecx, dword ptr [ebp-18]

* Possible StringData Ref from Code Obj ->"you like to place a web order "
->"for VAZ+?"
|
:004A63E1 BA306B4A00 mov edx, 004A6B30

* Possible StringData Ref from Code Obj ->"DemoRunCount2"
|
:004A63E6 B8606B4A00 mov eax, 004A6B60
:004A63EB E840B3FAFF call 00451730
:004A63F0 FF75E8 push [ebp-18]
:004A63F3 8D45F0 lea eax, dword ptr [ebp-10]
:004A63F6 BA03000000 mov edx, 00000003
:004A63FB E83CDAF5FF call 00403E3C
:004A6400 8B45F0 mov eax, dword ptr [ebp-10]
:004A6403 668B0D706B4A00 mov cx, word ptr [004A6B70]
:004A640A B201 mov dl, 01
:004A640C E8F7A4FAFF call 00450908
:004A6411 83F806 cmp eax, 00000006
:004A6414 7517 jne 004A642D
:004A6416 6A00 push 00000000
:004A6418 6A00 push 00000000
:004A641A 6A00 push 00000000

Continued:-
MaTRiX_2k
01-09-2001, 02:08 PM
Hey and I also managed to remove the nag's for the open/capture/ etc..

But could not make them function.

I did not manage to find a single breakpoint in S-ice.
I made a bpx messageboxa, for the MsgBox we get for the open menu,but ..
Again made a bpx messageboxa, for the MsgBox we get after 16 uses but ..
Made a bpx for enablemenuitem but ...
Made a bpx for get & set menuiteminfoa but ... no result

Don't Know What to do?
Can anyone help me?

Here is the code related to the nag's:-

The Nag Code:-

* Referenced by a CALL at Addresses:
|:004A1E8D , :004A2685 , :004A26A1 , :004A2869
|
:00467ECC 55 push ebp
:00467ECD 8BEC mov ebp, esp
:00467ECF 33C9 xor ecx, ecx
:00467ED1 51 push ecx
:00467ED2 51 push ecx
:00467ED3 51 push ecx
:00467ED4 51 push ecx
:00467ED5 8945FC mov dword ptr [ebp-04], eax
:00467ED8 8B45FC mov eax, dword ptr [ebp-04]
:00467EDB E850C0F9FF call 00403F30
:00467EE0 33C0 xor eax, eax
:00467EE2 55 push ebp
:00467EE3 68547F4600 push 00467F54
:00467EE8 64FF30 push dword ptr fs:[eax]
:00467EEB 648920 mov dword ptr fs:[eax], esp
:00467EEE 6A00 push 00000000
:00467EF0 8D4DF4 lea ecx, dword ptr [ebp-0C]
:00467EF3 8B55FC mov edx, dword ptr [ebp-04]
:00467EF6 8B45FC mov eax, dword ptr [ebp-04]
:00467EF9 E83298FEFF call 00451730
:00467EFE FF75F4 push [ebp-0C]
:00467F01 68687F4600 push 00467F68
:00467F06 8D4DF0 lea ecx, dword ptr [ebp-10]

* Possible StringData Ref from Code Obj ->"is disabled in the demo."
|
:00467F09 BA747F4600 mov edx, 00467F74

Nag For Open Button:-

* Possible StringData Ref from Code Obj ->"Patch loading"

:004A1E88 B89C1E4A00 mov eax, 004A1E9C
:004A1E8D E83A60FCFF call 00467ECC -> call for nag Proc
:004A1E92 C3 ret

Nag For Capture Button:-

* Possible StringData Ref from Code Obj ->"Capture"

:004A2680 B894264A00 mov eax, 004A2694
:004A2685 E84258FCFF call 00467ECC ->call for nag Proc
:004A268A C3 ret

I Don't know for which button:-

* Possible StringData Ref from Code Obj ->"Patch memory loading"

:004A2864 B878284A00 mov eax, 004A2878
:004A2869 E85E56FCFF call 00467ECC -> call for nag
:004A286E C3 ret

Nag for I Don't Know , May be for Capture Sequence. But did not find in Str Ref.

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A2616(C)
|
:004A268C FFFFFFFF BYTE 4 DUP(0ffh)
:004A2690 07 pop es
:004A2691 000000 BYTE 3 DUP(0)

:004A2694 43 inc ebx
:004A2695 61 popad
:004A2696 7074 jo 004A270C
:004A2698 7572 jne 004A270C
:004A269A 6500B8B0264A00 add byte ptr gs:[eax+004A26B0], bh
:004A26A1 E82658FCFF call 00467ECC ->Call For Nag
:004A26A6 C3 ret

That's it for now. I know i missed a lot of details, but i will be back.

With Regards
MaTRiX

PS:-

Please help me on the breakpoint thing. I did not get a single entry point
for task 1.
How do i patch a prog permenantely?
Which tool should i use?
a [address] is only temp in S-ice.
Help wanted for this too!

Thanks Again
Mustafa
01-09-2001, 04:42 PM
I do not know whay i can bot download the file.
In this webpage i can see only to prog.
Am I right??
Kayaker
01-09-2001, 05:22 PM
Hi Mustafa,

It's a little weird, but you need to go to the main page at
h*ttp://www.software-technology.com
select your Country, then click on Vaz+1.7. It then kicks you to a page where near the bottom you can select d/l, where it THEN kicks you to the /downform.htm page, where you can THEN select the product again and press submit.

Kinda dumb. You *might* have problems if you don't have javascript enabled, or some other config problem.

Let me know if anyone else has real problems with this and I'll up it to this board.

Kayaker
mersenne
01-10-2001, 12:35 AM
Good to be back! Missed out on the last project but glad to see there is a new one afoot :)

MaTRiX, you didn't mention how you found your way to the code above. Would be interested to know.

I've had a brief look also at task 3 (figured that was going to be the most limiting factor) and here is some preliminary findings. Hope I haven't jumped the gun Kayaker, enthusiasm is hard to quench ;)

Monitoring the install didn't turn up anything unexpected except for some cryptic looking registry entries. After checking the program with filemon and regmon a couple of times. Some entries in regmon caught my eye.

OpenKey HKLM\Software\CLASSES\CLSID\{A0E64221-706C-11d3-98D8-D2E7EFBCEAA4}\Control SUCCESS hKey: 0xC2307780

QueryValueEx HKLM\Software\CLASSES\CLSID\{A0E64221-706C-11d3-98D8-D2E7EFBCEAA4}\Control\ID SUCCESS 0x4

SetValueEx HKLM\Software\CLASSES\CLSID\{A0E64221-706C-11d3-98D8-D2E7EFBCEAA4}\Control\ID SUCCESS 0x5

CloseKey HKLM\Software\CLASSES\CLSID\{A0E64221-706C-11d3-98D8-D2E7EFBCEAA4}\Control SUCCESS

Each time I ran the program the SetValueEx function had the number corresponding to the that on the splash screen. In this case "Preparing to run for the 5th time of 16..."

So the program opens the key (RegOpenKeyEx), checks its value (RegQueryValueEx), adds 1 and updates the registry key (RegSetValueEx). This was easily tested by double clicking on the "SetValueEx" line in the regmon display, which started regedit and opened the registry to the correct location. When the value is modified (right click on the ID key and select edit), the change is reflected in the splash screen when the program is started again.

A quick disassembly and check for the RegSetValueEx function indicates that there is only one call to the function. Lovely! So now I'm off to snoop a little further and aim to find where the value is incremented.

Regards
Mersenne
Mustafa
01-10-2001, 09:52 AM
Mmmm, When I dissasemble it, I have no strings like the other people??
mersenne
01-10-2001, 04:11 PM
Mustafa (01-09-2001 23:52):
Mmmm, When I dissasemble it, I have no strings like the other people??

Hi Mustafa,

What are you disassembling it with?

Regards
Mersenne
90h
01-10-2001, 06:16 PM
If you r useing W32dsm do not use the Visual Basic strings patch(or W32Dasm Fx v1.00 patch) or you will not get strings.

-------
I managed to remove
2. It will time-out after 30 minutes
3. It can be used a maximum of 16 times
Bonus. nag screen(click to continue)

MaTRiX_2k your solution dos not work 100% if you use the program 18time+(i think) it is very bug e(you get lots of error messages). This how i patch the 16times...

I look in call 0046802C and found
00468113 cmp edi, 10h ; edi = #er of times used
then look for edi and found
00468099 mov edi,eax ; patch to xor edi, edi
90h
01-10-2001, 07:11 PM
one more thing useing DeDe with Symbol vclx40.dsf and vcl40.dsf load will make call 0046802C a lot less Confusing.
mersenne
01-10-2001, 09:52 PM
Hi all,

This is my solution for task three which follows from my post above. In order to write a fixed value to the registry I figured I needed to find where the value was being incremented.

After disassembling the program in W32Dasm we can search the imported functions for the RegSetValueExA function (registry functions are found in advapi32.dll) we found using regmon. It is only called once in the entire program which makes our life easier :) If you check your trusty win32 API reference for this function you will find the address of the data written to the registry is pushed at 467B08 and is stored at ebp-04.

:00467AFF 8BF0 mov esi, eax
:00467B01 8B450C mov eax, dword ptr [ebp+0C]
:00467B04 50 push eax
:00467B05 8B45FC mov eax, dword ptr [ebp-04]
:00467B08 50 push eax
:00467B09 56 push esi
:00467B0A 6A00 push 00000000
:00467B0C 8BC7 mov eax, edi
:00467B0E E82DC4F9FF call 00403F40
:00467B13 50 push eax
:00467B14 8B4304 mov eax, dword ptr [ebx+04]
:00467B17 50 push eax

* Reference To: advapi32.RegSetValueExA, Ord:0000h
|
:00467B18 E8FFE8F9FF Call 0040641C

Time to start tracing back through the code looking for references to ebp-04. If you move up the disassembly a little way you will come to the following

:00467AE2 894DFC mov dword ptr [ebp-04], ecx

where the updated value gets moved from ecx to ebp-04. So now we need to look for references to ecx. Keep tracing up the code and you will see that this code is referenced by two calls

* Referenced by a CALL at Addresses:
|:00467A85 , :00467A9C

Let's look at the second one. Directly before the call is made the value we are interested in is moved into ecx from the stack at address esp+8. Three lines further up the value from ecx is moved to the stack adress esp (which incidently is the same as esp+8 further down due to the two pushes).

* Referenced by a CALL at Address:
|:004680BE
|
:00467A90 51 push ecx
:00467A91 890C24 mov dword ptr [esp], ecx
:00467A94 6A04 push 00000004
:00467A96 6A03 push 00000003
:00467A98 8D4C2408 lea ecx, dword ptr [esp+08]
:00467A9C E833000000 call 00467AD4

So we are still interested in ecx, lets keep tracing up to where this code is called from, namely 4680BE.

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004680A3(U)
|
:004680B1 8D7701 lea esi, dword ptr [edi+01]
:004680B4 8BCE mov ecx, esi
:004680B6 BAA4814600 mov edx, 004681A4
:004680BB 8B45FC mov eax, dword ptr [ebp-04]
:004680BE E8CDF9FFFF call 00467A90

At 4680B4 the value in esi is moved into ecx and directly before that we see that value in esi=edi + 1 which is exactly what we are looking for. It is good to confirm this "live" in a debugger, which I did. So how do we patch it? If we change

:004680B1 8D7701 lea esi, dword ptr [edi+01]

to

:004680B1 8D37 lea esi, dword ptr [edi]
:004680B3 90 nop

then whatever value we have in the registry will remain and never get incremented. Problem solved :) If you have any questions, just ask and help will be forthcoming.

Regards
Mersenne
MaTRiX
01-10-2001, 11:58 PM
Possible StringData Ref from Code Obj ->"VAZ+ Demo"
|
:004A6391 BAC46A4A00 mov edx, 004A6AC4
:004A6396 E8FD40FAFF call 0044A498 -----> Call For The Splash
Screen I Think
:004A639B E88C1CFCFF call 0046802C -----> Critical Call
May Be It Counts. Too Confusing! Code Is Given Below
:004A63A0 84C0 test al, al
:004A63A2 0F8598000000 jne 004A6440 ---->********** Patch It
to jmp and no 16 times limit. I May be wrong here. I think this patch
stops the compare func itself. I think the prog needs this call to compare.
-------------------------------------------------------------------------
* Referenced by a CALL at Address:
|:004A639B
|
:0046802C 55 push ebp
:0046802D 8BEC mov ebp, esp
:0046802F 83C4F8 add esp, FFFFFFF8
:00468032 53 push ebx
:00468033 56 push esi
:00468034 57 push edi
:00468035 33C0 xor eax, eax
:00468037 8945F8 mov dword ptr [ebp-08], eax
:0046803A 33C0 xor eax, eax
:0046803C 55 push ebp
:0046803D 683A814600 push 0046813A
:00468042 64FF30 push dword ptr fs:[eax]
:00468045 648920 mov dword ptr fs:[eax], esp
:00468048 B201 mov dl, 01
:0046804A A104774600 mov eax, dword ptr [00467704]
:0046804F E8F0F7FFFF call 00467844
:00468054 8945FC mov dword ptr [ebp-04], eax
:00468057 BA02000080 mov edx, 80000002
:0046805C 8B45FC mov eax, dword ptr [ebp-04]
:0046805F E878F8FFFF call 004678DC
:00468064 8D55F8 lea edx, dword ptr [ebp-08]
:00468067 B854814600 mov eax, 00468154
:0046806C E837FFFFFF call 00467FA8
:00468071 8B55F8 mov edx, dword ptr [ebp-08]
:00468074 B101 mov cl, 01
:00468076 8B45FC mov eax, dword ptr [ebp-04]
:00468079 E8C2F8FFFF call 00467940------>RegOpenKeyA
:0046807E 33C0 xor eax, eax
:00468080 55 push ebp
:00468081 68A5804600 push 004680A5
:00468086 64FF30 push dword ptr fs:[eax]
:00468089 648920 mov dword ptr fs:[eax], esp
:0046808C BAA4814600 mov edx, 004681A4
:00468091 8B45FC mov eax, dword ptr [ebp-04]
:00468094 E80BFAFFFF call 00467AA4------->Very Imp
MaTRiX
01-10-2001, 11:59 PM
continued

#################################################################
this in turn calls 0167:00467ab7 call 00467b78 ----->RegQueryValueExA
this in turn calls 0167:00467bf3 call 0046781c ----->Very Interesting
but don't know what i does;
#################################################################
:00468099 8BF8 mov edi, eax
:0046809B 33C0 xor eax, eax
:0046809D 5A pop edx
:0046809E 59 pop ecx
:0046809F 59 pop ecx
:004680A0 648910 mov dword ptr fs:[eax], edx
:004680A3 EB0C jmp 004680B1----->Very Interesting
###################################################################
Jumps to the code, to inc the value retrieved from registry.
And also for RegSetValueExa
The Code Is Given Below
###################################################################
:004680A5 E98AB2F9FF jmp 00403334
:004680AA 33FF xor edi, edi
:004680AC E833B5F9FF call 004035E4
-----------------------------------------------------------------------

Oh No time's up. Got to go. I will continue. I have lot more to ask
and share.

Bye Bye
MaTRiX

PS:-
Mersenne, I used str ref of Win32dasm to get
to the codes.
There Is another prob Iam getting logged
out every time i try to post.
Don't know why?
Kayaker
01-11-2001, 12:49 AM
Hi All,

There's an interesting little ASM tidbit brought up here with the 16 times usage check. People have found that the check occurs at

:004A639B E88C1CFCFF call 0046802C
:004A63A0 84C0 test al, al
:004A63A2 0F8598000000 jne 004A6440
.
.
* Possible StringData Ref from Code Obj ->"The VAZ+ demo will only run 16 "

and the value of al is set within the Call 0046802C (where there is a call to RegQueryValueExA of the reg entry Mersenne mentions)

:00468113 83FF10 cmp edi, 00000010 ; cmp #uses w/ 16
:00468116 0F92C3 setb bl ; set bl to 0 or 1 depending on Carry Flag
.
.
:00468141 8BC3 mov eax, ebx

It's interesting to note that SETB is used instead of an immediate JG or JL, which delays the jump until later. You can use 'r edi' in Softice to edit EDI and see the effect on the Carry flag.

SETB is one of a number of “Set on Condition” instructions that can be used to test a Register flag or the results of a comparison. You can check out the Art of Assembly reference for more on this.

"The set on condition (or setcc) instructions set a single byte operand (register or memory location) to zero or one depending on the values in the flags register. Setcc represents a mnemonic appearing in the following tables. These instructions store a zero into the corresponding operand if the condition is false, they store a one into the eight bit operand if the condition is true.

The cmp instruction works synergistically with the setcc instructions. Immediately
after a cmp operation the processor flags provide information concerning the relative values
of those operands. They allow you to see if one operand is less than, equal to, greater
than, or any combination of these."

i.e.
SETA Set if above (>) ; Carry=0, Zero=0
SETB Set if below (<) ; Carry = 1
SETZ Set if equal (=) ; Zero = 1
SETNZ Set if not equal (!=); Zero = 0

BTW, check out the possibilities of registering this puppy. There's a ref to 'Serial' and 'License' that the proggy seems to want to read from its ini file. I found that if you R FL Z a certain jump while it's using GetPrivateProfileStringA on the section
[VAZ]
Version=VAZ Plus 1.6
then it also looks for Serial and License. I'm not sure if this is a dead end or not, but it *might* be the check for registration. Still working on this myself ;-)

As for enabling the menu functions, you can find a lot of references to the events with DeDe, and it does look like the code for "Open" and the others are there, they're just not called but instead you get a TMessageForm nag (BTW, this is why you don't get the usual breakpoints on MessageBoxA etc, Matrix, this is Delphi, a real strange critter)

I've found where the indirect call that goes to each menu function is, and I can see the address table where the "wrong" address of 4A1E88 is set up, which calls the nag, but I can't see that there's any easy flag patch. Sooo...what I'm thinking now is to try to find that address hard-coded in the file and change it to where I think it SHOULD point to when the OnClickEvent occurs, the start of the real "Open" code, which I think exists.

There's a few recent Delphi tuts on Tsehps site which nicely discuss how Delphi is actually set up and how you CAN change pointers to address what you want (to a degree). Worth looking at. Well, back to it ;)

Cheers,

Kayaker
mersenne
01-14-2001, 04:59 PM
Hello everyone,

No-one seems to have posted about task 2, the 30 minute time-out yet. Here is what I found. While the program is running if you set your computer clock forward 45 minutes, the program does not time-out. This suggested to me that a timer was being used rather than relying on the system time. If that was the case then the time should be in milliseconds. For 30 minutes this is equal to 1800000d = 1B7740h If you check the imports, Settimer and Killtimer are there so I gave them a look. I didn't get much joy from this and after chasing my tail around for a bit, tried a different approach. I went back to DeDe and from the procedures tab selected "main" which is the Tsynthform. If you scroll down the events in the right pane you will come across IdleTimerTimer. Double click on that and the disassembly for that procedure will pop up. You will see a reference to Winmm.timeGetTime which I have not come across before but looks suspicious and a few lines down there is our magic time value.

* Reference To: winmm.timeGetTime, Ord:0000h
|
:004A1AAF E86CF1FAFF Call 00450C20
:004A1AB4 2B8358070000 sub eax, dword ptr [ebx+00000758]
:004A1ABA 3D40771B00 cmp eax, 001B7740
:004A1ABF 765A jbe 004A1B1B

While we are within our 30 minute time period, we always take the jump. Otherwise the call to the "Demo time limit has expired" nag at 4A1B0F is executed. So to change the limit to 1 hour it is a simple matter of changing 1B7740 to 36EE80. To check whether I could bypasss the timer though I needed to have a shorter time period. So I changed

:004A1ABA cmp eax, 001B7740

to

:004A1ABA cmp ax, 7530
:004A1ABE nop

which times me out after 30 seconds. Makes it much easier to test any changes this way. Although there are probably many ways to overcome this protection, simply changing

:004A1ABF 765A jbe 004A1B1B

to

:004A1ABF EB5A jmp 004A1B1B

forces the jump past the demo nag and appears to work. A better solution would be to kill the timer but I haven't investigated this as yet.

I have only begun looking at the menu stuff but after opening the program in a resource editor, I found the code for the Open patch dialog does exist in RCData and not surprisingly is called TOpenPatchDlg. It starts at offset FB10C for those that want to see it. Using DeDe, I found that all the other events of a similar nature like SavePatchDlg, SaveSeqDlg, OpenSeqDlg etc all have the same format as shown below

:0049DA5F 005351 add byte ptr [ebx+51], dl

In DeDe this disassembles to

53 push bx
51 push ecx?

:0049DA62 8BD8 mov ebx, eax
:0049DA64 8B83D8020000 mov eax, dword ptr [ebx+000002D8]
:0049DA6A E8B138FBFF call 00451320

The [ebx+000002D8] refers to both saves (patch and sequencer) as both dialogs are identical except for a few bits and pieces. I wonder if this might hold for open? Open patch is disabled but open sequence is ENABLED. There is a refernce to OpenWaveDlg which shares the same [ebx+000002E0] address. Sorry this last bit is so garbled, I need to examine it a bit further and try and make sense of what is happening. I just posted this bit in case it fits in with what someone else has found.

Regards

Mersenne
ThRaX
01-17-2001, 09:16 PM
Hey, looks like tasks 2 and 3 are under the belt. Those were pretty easy, but what about task 1? I haven't found ANYTHING for that one yet...
Kayaker
01-17-2001, 11:41 PM
Hi All,

I had a look at enabling that Open Patch menu item and like Mersenne, tried to key in on what DeDe could say about the Delphi structures, where they're called from, similarities in forms, etc.

As Mersenne mentions, there IS an OpenPatch Form that is at offset FB10C
TPF0.TOpenPatchDlg, which specifies opening VAZ Patches|*.vzp, which is what we would like to enable if possible. This Form isn't shown in DeDe under "Forms", but you can find its structure in the file.

There are also forms for
TPF0.TOpenSeqDlg, VAZ Sequences|*.vzs
TPF0.TSavePatchDlg
TPF0.TSaveSeqDlg

Each of these Forms is called via a corresponding standard Delphi "OnClick" event which you can find in DeDe under Procedures (in either Main or SeqUnit). Right now the OnClick event for TPF0.TOpenPatchDlg points to 004A1E88, which is just the Nag.

Anyway, I noticed that the 2 SaveAs events and the 1 working "Open" event had similar calls to 004439BC, i.e.

* Possible reference to class TOpenSeqDlg
|
0049AD73 A1107E4900 mov eax, dword ptr [$497E10]

* Reference to: Forms.TCustomForm.Create(Classes.TComponent)
| or: Forms.TDataModule.Create(Classes.TComponent)
|
0049AD78 E83F8CFAFF call 004439BC

So I did a string search in W32Dasm for "4439BC" and found it was called from 12 places:

* Referenced by a CALL at Addresses:
|:0049AD78 , :0049B20D , :0049BC5C , :0049BF5C , :0049C658
|:0049C992 , :004A20B9 , :004A2970 , :004A2A60 , :004A3C91
|:004A56A7 , :004A634D
|
:004439BC 55 push ebp

"Eureka!" I cried. All I gotta do is find which one of these don't match with an existing OnClick event that calls this Forms.TCustomForm.Create(Classes.TComponent) thingy and the one left over must be for that disabled OpenPatch function.

"Crap!" I cried, after finding out that they were all accounted for, opening things like PatternRandomItemClick and HelpAboutItemClick.

So, 1st strike against there existing the code to call the OpenPatch menu item.

...and so on...
Kayaker
01-17-2001, 11:43 PM
Then I thought I'd try to "persuade" the TOpenSeqDlg routine to mimic what I thought the TOpenPatchDlg might require to open VAZ Patches|*.vzp instead of VAZ Sequences|*.vzs. I found that the Common Dialog dll comdlg32.dll function GetOpenFileName was used. Cool, because I knew that you could modify the OPENFILENAME structure to change how the Open dialog box behaves.

-----------------------------------------------------
GetOpenFileName function creates an Open common dialog box that lets the user specify the drive, directory, and the name of a file or set of files to open.

BOOL GetOpenFileName(

LPOPENFILENAME lpofn // address of structure with initialization data

Parameters

lpofn

Pointer to an OPENFILENAME structure that contains information used to initialize the dialog box. When GetOpenFileName returns, this structure contains information about the user's file selection.
------------------------------------------------------

You can check out the Win32 Programmers Reference for details on the OPENFILENAME structure, but the 4th DWORD contains the file filter, which I changed in memory to *.*. So now when I selected OpenPatch (I had made it point to the OpenSeqDlg routine at 0049AD44), I could select a VAZ Patch|*.vzp instead of just a VAZ Sequence|*.vzs. Big Deal, I still got a slightly modified Demo Nag anyway.

Confused yet? Good. I hope you're not expecting a solution ^_^

Another indication that this is a Demo only is that the address in eax at

* Possible reference to class TOpenSeqDlg
|
0049AD73 A1107E4900 mov eax, dword ptr [$497E10]

is 497E5C and points to what looks like a template structure for TOpenSeqDlg which you can see at offset 9725C in the file. There doesn't seem to exist a similar one for TOpenPatchDlg.

So does all this mean we're screwed? Maybe :( Even the existing patches, which are resources you can see with Exescope, are different from saved patches. I thought maybe you could paste them as a resource into the file, but I guess not.

Any other ideas?

Cheers,

Kayaker
mersenne
01-18-2001, 12:42 AM
Hi kayaker,

I also tried those 12 calls you found and also to no avail. Did you follow the retrieval of the serial and license from the ini file any further?

Regards
mersenne
Kayaker
01-18-2001, 02:26 AM
Hi Mersenne,

I had checked the ini file but didn't get the feeling the code was doing anything important. If you delete the 'Version' entry in

[VAZ]
Version=VAZ Plus 1.6

There's a cmp at

:0048324A CALL 00403D58
:0048324F CMP BYTE PTR [EBP-0100],00

which if met (length of 'Version' entry = 0), goes on to look for

[License]
Serial=

Couldn't see that there was any valid serial checking going on really. Serial is only checked if Version isn't there, which is then rewritten anyway, so GetPrivateProfileStringA on Serial is not used as a normal reg check. I could be wrong that this leads to nothing, still might be worth a look.

Regards,

Kayaker
90h
01-19-2001, 02:33 AM
Hi All,

Looking for code to Open Patch and not get any where. I start look for some code to edit so i can load a Patch File.
We have...

TSynthForm FileNewPatchItemClick
by tracking we find
004A485A xor edx, edx
004A485C mov eax, [ebx+04F4h] ;b3Osc1Wave : TButtonOsc1Wave
004A4862 call 0047C220 ;SetTButton
...

and
TSynthForm PatchPatchItemClick
004A278C mov eax, [edi+0Ch] ;eax = Patch #er
004A278F mov edx, [4B8B54h]
004A2795 mov edx, [edx]
004A2797 mov edx, [edx+eax*4+0328h] ; edx= Patch data
004A279E mov eax, dword ptr [4B8B54h]
004A27A3 mov eax, [eax]
004A27A5 mov ecx, [eax]
004A27A7 call dword ptr [ecx+04h] ; 48BA10
...

so i pick the PatchPatchItemClick code. Useing Snippet Creator i add file VAZOPEN.asm to the exe

---File VAZOPEN.asm---
include windows.inc
include user32.inc
include kernel32.inc
includelib user32.lib
includelib kernel32.lib

;FileOpenPatchItemClick
;old code
;004A1E88 B89C1E4A00 mov eax,0004A1E9C
;004A1E8D E83A60FCFF call 000467ECC ;NAG
;004A1E92 C3 retn

;new code A1288h
;004A1E88 C6051B706D0001 mov byte ptr [IsOpenFile], 1 ; open mode
;004A1E8F E8CC080000 call 004A2760 ;TSynthForm PatchPatchItemClick
;004A1E94 C3 retn

jmp j1
hinst dd 0
DLLName db "VAZPatch.dll",0
FuncOpen db "Open",0
IsOpenFile db 0 ; easy to find this way
DLLError db "Error file VAZPatch.dll not found...",0
data db 198h dup(0)

j1:
.IF [IsOpenFile]==1
pushad ; save all registers
mov [IsOpenFile],0
invoke LoadLibrary , offset DLLName
.IF eax!=NULL
mov dword ptr [hinst], eax
invoke GetProcAddress , eax, offset FuncOpen
.IF eax!=NULL
push offset data
call eax ; call VAZPatch.dll!Open
.ELSE
invoke MessageBox , NULL, offset DLLError, NULL, MB_OK
.ENDIF
invoke FreeLibrary , [hinst]
.ELSE
invoke MessageBox , NULL, offset DLLError, NULL, MB_OK
.ENDIF
popad ; restore registers
mov edx, offset data
ret

.ELSE
OldCode:
mov edx, [edx]
mov edx, [edx+eax*4+328h]
ret

;old code
;004A278F mov edx, ds:off_4B8B54
;004A2795 mov edx, [edx]
;004A2797 mov edx, [edx+eax*4+328h]

;new code A1B95h
;004A2795 B900706D00 mov ecx,0006D7000
;004A279A FFD1 call ecx
;004A279C 90 nop
;004A279D 90 nop

.ENDIF

-----------------------
and edited in

004A2795 B900706D00 mov ecx,0006D7000
004A279A FFD1 call ecx ;call my code
004A279C 90 nop
004A279D 90 nop

;new FileOpenPatchItemClick code
004A1E88 C6051B706D0001 mov byte ptr ds:6D701Bh, 1 ; open mode
;004A1E8F E8CC080000 call 004A2760 ;TSynthForm PatchPatchItemClick
;004A1E94 C3 retn

Continued
90h
01-19-2001, 02:35 AM
now we need a test dll so here it is

---VAZPatch.asm----

.486p
.MODEL FLAT,STDcall

Open PROTO :DWORD

.DATA

.CODE

DllEntry proc hInstance:DWORD, reason:DWORD, reserved1:DWORD
mov eax,1
ret
DllEntry Endp

Open proc data:DWORD
mov edx,data

mov byte ptr [edx+58h],05h ;58h LFO-Rate
mov byte ptr [edx+59h],01h ;59h LFO-Waveform
mov byte ptr [edx+5Ah],55h ;5Ah LFO-WaveShape
mov byte ptr [edx+5Bh],00h ;5Bh LFO-Retrigger

mov byte ptr [edx+8Dh],00h ;8Dh Envelope1-Attack
mov byte ptr [edx+8Eh],55h ;8Eh Envelope1-Decay
mov byte ptr [edx+8Fh],0AAh ;8Fh Envelope1-Sustain
mov byte ptr [edx+90h],0FFh ;90h Envelope1-Release

mov byte ptr [edx+0ACh],0FFh ;ACh Envelope2-Attack
mov byte ptr [edx+0ADh],0AAh ;ADh Envelope2-Decay
mov byte ptr [edx+0AEh],55h ;AEh Envelope2-Sustain
mov byte ptr [edx+0AFh],00h ;AFh Envelope2-Release

ret
Open Endp

End DllEntry

---------------------

---VAZPatch.def----
LIBRARY VAZPatch

EXPORTS Open
---------------------

some notes(all up in the air)
---------------------
[VAZ]
Type=Patch
Version=VAZ Plus 1.5
Name=1
Description=
Author=

[LFO]
Rate=85 ;58h
Waveform=0 ;59h
WaveShape=205 ;5Ah
Retrigger=1 ;5Bh

[LFO 2]
Rate=0 ;74h
Retrigger=1 ;75h ;77h ?
Sample And Hold=1 ;76h ;75h ?
Manual Depth=0 ;77h ;76h ?
Delay=0 ;78h

[Envelope1]
Attack=0 ;8Dh
Decay=0 ;8Eh
Sustain=133 ;8Fh
Release=145 ;90h

[Envelope2]
Attack=72 ;ACh
Decay=75 ;ADh
Sustain=69 ;AEh
Release=0 ;AFh

[Oscillator1]
Tuning=-2400 ;DCh ;dword ?
Waveform=0 ;E8h
Sync Target=0 ;E9h
FM Source 1=0 ;EAh
FM Depth 1=0 ;EBh
PWM Source=0 ;ECh
PWM Depth=0 ;EDh
Portamento=0 ;EEh ; ??

[Oscillator2]
Tuning=-1700 ;???? ;0D0h, 104h ??
Waveform=0 ;110h
Modifier=0 ;111h
FM Source 1=0 ;112h
FM Depth 1=0 ;113h
FM Source 2=0 ;114h
FM Depth 2=0 ;115h
PWM Source=0 ;116h
PWM Depth=0 ;117h
One Shot=0 ;118h ;??
No Trigger=1 ;???? ;154h,155h,12Ch
Sample= ;NA ; will need to edit more code i think

[Filter]
Mix=64 ;161h
Source=0 ;162h ;160h ??
Mode=0 ;163h ; ?
Bandwidth=80 ;164h
Slew Limit=1 ;165h
Cutoff=255 ;166h
Resonance=0 ;167h
FM Source 1=4 ;168h
FM Depth 1=88 ;169h
FM Source 2=1 ;16Ah
FM Depth 2=78 ;16Bh
FM Source 3=0 ;16Ch
FM Depth 3=0 ;16Dh
RM Source=0 ;16Eh
RM Depth=0 ;16Fh

[Amplifier]
AM Source 1=3 ;184h
AM Depth 1=127 ;185h
AM Source 2=0 ;186h
AM Depth 2=0 ;187h
Overdrive=173 ;188h

PS.
So we can get Open Patch working this way but there is not much point in doing it. We will not have it all working File->Capture...


Scally Returns with a poss. project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Scally Returns with a poss. project
PDA

View Full Version : Scally Returns with a poss. project

Scally6
01-10-2001, 02:58 PM
Hi folks, Long story... but I'm back. No response on the newbies forum & I suspect this prog may be of interest. I 'cracked' its earlier (1.0) version but it uncracked itself after a couple of months;). Even though I'd stepped the clock forward 2 months, I missed whatever it did.
I guess the v2.00 will have similar stuff in it & the way it generates the unique system code is interesting. Its very easy to (apparently) crack using smartcheck but I suspect after time it'll revert to its eval way.
The prog itself isn't much use unless you're into research in a big way but its worth a look:
Text Analyst v.2.0 (2mb)The d/l address is:
http://w*w.megaputer.com/down/tm/ta/ta2eva.exe
but if this fails, you'll need to complete the registration form with rubbish & d/l via http://w*w.megaputer.com.
(ps the easy bit in smartcheck uses strcmpi) but i couldn't get my head round it in sice.
I'd be interested if anyone can explain how it deals with the win reg code in order to generate the unique machine serial & also if anyone can tell me how the prog seems still regged when you move the clock forward but eventually reverts to being an eval version. I just can't see it.
Scally
Clandestiny
01-10-2001, 10:00 PM
Hi Scally,

Your description sounded interesting so I downloaded the proggy to have a look. Unfortunately, I seem to be having a problem disassembling it in Wdasm. Everytime I try to load up ta.exe for disassembly, Wdasm hangs / won't start disassembling at all. Did you have any problems with this ??? Any ideas ???

Regards,
Clandestiny
Kayaker
01-11-2001, 12:05 PM
Welcome back Scally :)

The reason for the W32Dasm problems Clandestiny is that this is packed with PECompact. I tried Yoda's UnPECompact on it but it just kept giving me an "error allocating memory" problem and wouldn't unpack. I even got a Windows error message when I tried to run TextAnalyst with Softice loader.

You might want to try UnPECompact on your system, it might work better.

Regards,
Kayaker
Scally6
01-11-2001, 01:19 PM
Hi all, it really is good to be back. Ignore any posts from waggscally*hotmail.com. Someone hacked my old A/c.
Kayaker: How d'ye know it was pe compact? I tried 'gettype' & it said it was clean.
I've tried tno's & yoda's & both fail. Procdump fails on pecompact but has a go at it with unknown but the resulting exe produces a page fault, so its probably not right.(?)
Regards
Scally
Kayaker
01-11-2001, 02:04 PM
Scally6 (01-11-2001 03:19):
How d'ye know it was pe compact?

Besides the 2 sections labelled pec1 and pec2? FileInfo told me ;)

K.
SV
01-13-2001, 03:45 AM
Hi reversers
I have unpacked it.
If you are interested, i can send it.

Regards
SV
Scally6
01-13-2001, 05:23 AM
Hi SV,
Well done! Love to see it. What did you use? I've tried several unpackers with no luck.
If you did it manually, is there any chance of explaining - I've tried to follow a tut. on manual unpacking before but got lost in the code.
Scally


Ideas For A New Project ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Ideas For A New Project ???
PDA

View Full Version : Ideas For A New Project ???

Clandestiny
02-01-2001, 03:46 PM
Hi guys,

Its really quiet around here lately and I was wondering if anyone had some ideas for a new project?

I was thinking it might be interesting to have an introduction to the PE format and an example of basic unpacking. Of course, we would need the advice of an advanced reverser to guide the selection of the target.

Also, there is more room for work on function disabled targets, keyfiles, CRC checks, and like topics...All ideas are welcome though :)

Cheers,
Clandestiny
KoKaInE
02-01-2001, 04:42 PM
I think a keyfile protection is great. There arent many tuts on this subject. Im going to search for a target and post it here. any ideas?

KoKaInE
NeO'X'QuiCk
02-01-2001, 04:45 PM
Hey guys what about Unpacking project!!

NeO
meRlin
02-03-2001, 01:58 PM
Hello,
I think unpacking is usefull to have some knowledge about, to understand anything about it you have to grasp the PE structure first, I suggest reading the manually unpacking project (MiZ) at +Sandman's old forum will point you in right direction.

meRlin
NeO'X'QuiCk
02-03-2001, 03:30 PM
I was think what we wouldn't start on Upx but Pecrypt 1.02!Not so easy and fun!!

NeO
hz
02-03-2001, 04:02 PM
Hi NeO'X'QuiCk,
I think as its a newbie project, if it is going to be an unpacking project then it should
probably be fairly easy. As for PeCrypt 1.2, I have'nt yet found a target packed with it. Did you have a particular target in mind?.

regards
stealthFIGHTER
02-03-2001, 04:04 PM
And what about a project on some CrackMe?
NeO'X'QuiCk
02-03-2001, 04:13 PM
Where is it meRlin!

NeO
NeO'X'QuiCk
02-03-2001, 04:25 PM
hz there for we would make it more easy!I was thinking like this That we pack the notepad.exe everyone has it!SO we would have all the start advantage!And there is a little help with Latingo unpacking PeCrypt 1.02!
The problem was to get the program back to the orignal and explaon how you did it!Easy but not Easy!

What do you think??
hOrn_dOg
02-07-2001, 04:33 AM
Hi guys,

I don't know if you checked out www.discompress.com by my alter-ego Vince ;)

I attempted to create a simple tuts guide for most of the packers/protectors. Well I lost interest in September last year - time/wife problems :(

But the site is still there and I still have more tuts on
unpacking notepad.exe and other targets after packing it with several packers available to upload.

I also had a great idea of publishing the known 'signature' bytes of these packers so attempting to make it easier to find that elusive OEiP that causes so much hassle for beginners. If anyone thanks me enough I'll rev up the notebook and do a few more tuts to include rebuilding the IAT and IT (oops, Import Address Table and Import Table for the API's) with +Tsehps Revirgin ! and explain what the hell are RVA, RAW etc and what other tools to use............

hOrn_dOg
NeO
02-07-2001, 10:34 AM
It a good idea!There should be more like you because there are only a few but not complete site for learning to unpack!Etern Bliss(4),R!sc,yates...

I will write to you !!

Neo
Kugi
02-07-2001, 11:14 AM
Hi hOrn-dOg,

Checked your discompress. Good work. Keep going. Yes, I'll send you one thousand thank yous for more.

Regards, Kugi
hz
02-07-2001, 12:55 PM
Hi,
Yeah I will throw in a couple of thanks A
site specialising in unpacking, I like it, keep
it up.
regards
hOrn_dOg
02-08-2001, 04:03 AM
Hi Guys, thanks for the support.

I'll show the wife the messages and hopefully she will let me play with my PC at weekends again :)

BTW
I have requested that the site be hosted at safer
place as well. So those P off Mafia 'commercial protectors' programmers can't shut it down

Plus any suggestions re the discompress site are welcome :)

hOrny
NeO
02-08-2001, 09:51 AM
Horny do you have a email!!

NeO
NeO
02-08-2001, 02:36 PM
I meant hOrn_dOg!!Sorry!!

NeO


A New Project (Unpacking, Nag, Keyfile & More ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A New Project (Unpacking, Nag, Keyfile & More ;-)
PDA

View Full Version : A New Project (Unpacking, Nag, Keyfile & More ;-)

Clandestiny
02-07-2001, 10:19 PM
Hi All,

Hz recently brought to my attention a new target for our reversing pleasure. And man, this one has it all...

The name of the target is Globe Time and you can download it from:

h*tp://www.powerup.com.au/~marver/dl/globetime131.exe

Firstly, its packed (with PE-Crypt). Its not too difficult to unpack though (and thats coming from a complete unpacking newbie ;) I should mention, however, that Proc Dump has some trouble rebuilding the import table and for this reason, you'll probably need to use IceDump's Pedump feature. Though its not really necessary, if you're new to unpacking like me, you might be interested in reading up on some of the PE docs... Iczelion has a number of tuts at win32asm.cjb.net on the portable executable (PE) format. Likewise, you may wish to research PE-Crypt a little... and there is at least 1 tut on PE-Crypt at Krobar's site: http://zor.org/krobar/

Secondly, you won't play with this little proggy too long before you encounter its nag (with a timer no less). IMO, its one of the most annoying ones I've encountered in a while and I think you'll agree with me that its necessary to do a small patch before we can fully enjoy this reversing experience ;)

Lastly, and the heart of Globe Time's protection, is a keyfile.

...So basically there are 3 challenges here

1) Unpack it
2) Remove the nag and its accompanying timer
3) Generate a valid key file

Have Fun... ;-)

...and thanks Hz for the suggestion ;)

Cheers,
Clandestiny
Kayaker
02-09-2001, 10:11 PM
What, no screams, no cries of distress, no Eurekas?

SOMEBODY must've tried unpacking it by now, SMC got your tongues? Give it a shot if you haven't yet, this isn't beyond anyone's capabilities, but it IS a good learning opportunity. Where you at?

Kayaker ^_^
NeO
02-10-2001, 04:50 AM
I try it with dump but it isn't so easy!!
It's more difficult then Latingo's !his text isn't meant for newbie but so fare it's the only one!

NeO
hz
02-10-2001, 08:28 AM
Hi,
way to go man, the way to learn is give it
a try, I'm sure you will get it. Don't be shy
if you get stuck.

regards
Kayaker
02-10-2001, 05:02 PM
Hi,

Don't get *too* caught up in Latigo's tut. While it's an excellent tut, and everything he talks about should be learned, most of it deals with rebuilding the Import table. As Clandestiny mentioned, /PEDUMP does all that work for you here. The number one thing is just to find *where* to dump it, just before the jump to the Original Entry Point (OEP). This is only alluded to in Latigo's tut.

You've got 2 reasonable choices here I figure. If you try tracing from the start of unpacking code you'll drive yourself crazy, get lost in Self Modifying Code (SMC), and still get nowhere because you'll probably end up in Kernel32 code and not be able to get back into unpacking code. So you need to jump into the middle of all the mess, and that means the Import table decryption routine, since PECrypt mangles the Imports. This is a constant, there will be a routine dealing with the Imports and you can use this to your advantage to get deep into unpacking code. Also applies to i.e. Asprotect. Latigo's tut will help get you here, or you may have heard of another, or come up with your own, method of dropping into the maw. Then you've got to get yourself OUT of it, and continue your tracing to try to find the OEP.

If you start tracing while you're in the Import decryption routine you'll notice you're in a loop. Watch the registers, display some addresses, and you should get a rough idea of what's happening with the Import names. This loop will continue for as many Imports as you have. Now you need to start paying attention to the jumps that might get you OUT of that loop. Set a few advanced breakpoints and see if they work. You may have set them on SMC code, in which case you're screwed. You need to find a few "solid" BP's that will kick you out of the loop.

Once that's done you can single step until you find that for which you seek.

There is another less painful, but also less instructive method of finding the OEP using the capabilities of a very powerful tool which is probably sitting in your SoftIce directory right now.

'nuff said

Kayaker
Clandestiny
02-10-2001, 06:13 PM
Hi Neo,

I hope Kayaker won't mind, but I'm going to clarify a couple of things he said since I just learned some of this stuff myself and I know how confusing it can be (already read Icezelion's import table tut +5X ;)

Kayaker mentioned using breakpoints to break into the heart of the import table decryption part of the unpacking routine. For these bpx's you might want to try VirtualAlloc or GetProcAddress. VirtualAlloc does just what its name says...it allocates memory. It makes sense to bpx VirtualAlloc since you know the program must allocate memory to unpack itself into. GetProcAddress, on the other hand returns the address of a dll and would therefore presumably be found in the vicinity of the import decryption routine. Alas, I had some trouble getting Sice to accept these breakpoints (possibly the SMC though I'm not sure)...so I took the easy way out that Kayaker mentioned. Actually, I'm very curious if its *only* me that has trouble getting this proggy to break on VirtualAlloc and GetProcAddress. I tried several times but it just will not break so please let me know if you have any success with these.

RE: the easy way out -> get IceDump if you don't have it already and read about the tracex and pedump functions.

Good Luck,
Clandestiny
NeO
02-10-2001, 06:49 PM
Hello!

Why i said that latingo tut is no good!I will explain!I am new at unpacking so as normally i started with Upx!I manage that one quickly!So i read some tut of risc(nut there are not for newbie)and Eltern Bliss(good he expalin everthing)Recommen to anyone) he wrote that way that i could get did!The problem for me was that LAtingo tut for someone that already knows what we were talking about!And of course it's good it gives you teh basic idea how to unpack!!

SO i was look Oep like made i was trying (latingo exe)But even if i used F8 or F10 evertime is doesn't matere how fare did i came i always got the Close Error shut down of prog..And never i can to Oep
to dump !SO from my point of you i can be great if you get but i didn't!So i aks Sv how to get to Eop and dont need to trace!So he explain me the /tracex command!Thanks SV!!!SO i used it am the computer found it for me !No tracing !The i use /dump when i was in Eop!And that was it !

But the problem for me in This target is that I don't get MZ!so the peheader is fuck!I don't i read about my to use /pedump??I don't know!
SO the realy problem is how to know how many bites do you have to copy from packed file!!

The real problem abput unapcking is that there are not many great tuts!So fare i did fine how to use ita rebilder ,use more tehnicks on one pack...and so one!SO it a problem to learn quicklY!!

NeO
NeO
02-10-2001, 06:51 PM
What is the big difference betwen /dump /pedump!I read icedump txt but i don't get it!!

NeO
LaptoniC
02-11-2001, 03:24 PM
Hi everybody,
For the first task I have used TRW2k.
a)Open trrw2k and load the globtime.exe
b)Write Pnewsec and enter it means stop when it enters new section.
c)wait for 1-2 minute TRW2k will stop
d)Write Makepe and enter.
e)your exe will be in C:\windows\desktop,trw2k or program directory.It works and can be dissambe with Dede as you know it is writen in Delphi

I have found that program looks Globetime.key but it does not look on program directory instead it use FindFirstFile api.So if you debug with Trw like me it will look this file in trw2k directory it is not problem when you start from start menu but if you use loader maybe it can confuse me like me :)
Regards and happy reversing
NeO
02-11-2001, 04:44 PM
TRy it with Softice most people have it!!

NeO
Kayaker
02-11-2001, 10:30 PM
NeO (02-11-2001 06:44):
TRy it with Softice most people have it!!

NeO

Oh I don't know, I think it's good to get a new persepective. I know some people have problems with getting TRW to run on their systems, but for those who don't it's nice to know its features. I had never used the PNEWSEC command before and sure enough it works as well as /Tracex!

While we're on the subject, and I know this should be posted in the Tools Forum, but maybe Laptonic or someone else familiar with TRW can help, but I've never been able to get mouse support (Logitech cordless) with TRW. Fine, I can live with that, but I'd *like* to be able to scroll down in the Code window and see what lies ahead of me in the codewoods. I haven't been able to do this without using the U(nassemble) command and doing it page by page. It doesn't look like the Code window has a scroll bar anyway. IS there a way to get focus into the Code window so you can at least use the arrows keys, or is that window verboten anyway?

Neo, re /DUMP and /PEDUMP. Simply put, /DUMP [address] [length] [filename] allows you to dump any section of memory of whatever length you specify. It's a raw dump just as you see it. Handy for lots of things.

/PEDUMP [imagebase] [EIP] [filename] allows you to create a working PE file from the image in memory. [imagebase] is (usually) 400000. [EIP] is the Original Entry Point as a *relative* Virtual Address, i.e. if you find the OEP is 401000 then you use 1000 here.

You can convert a /DUMP [imagebase] [length of file] to a working PE as well afterwards using Procdump, PEditor or some other util. Assuming of course the packer hasn't pulled some other trick such as corrupting the Import table or the PE Header ;)

Regards,
Kayaker
hz
02-12-2001, 12:00 AM
Hi,

On the subject of annoying things about trw, no cut and paste, thats really annoying. Maybe we all send our "borrowed" registrations back to the author in protest.

regards

its a joke, its a joke
NeO
02-12-2001, 07:42 AM
Very good answer Kayaker !I mean very good!I know what i made wrong with /pedump !!I will try to dump it!

Thanks man really!

NeO
LaptoniC
02-12-2001, 11:06 AM
Oh I don't know, I think it's good to get a new persepective. I know some people have problems with getting TRW to run on their systems, but for those who don't it's nice to know its features. I had never used the PNEWSEC command before and sure enough it works as well as /Tracex!

Trw works fine on me I have PS2 mouse, when I was navigating code menu I use cursors with Alt,Shift and Ctrl combinations ie Shit+UP vs..
I know icedump tracex is good but you should give range for possible OEP and I couldnt managed to use it on upxed exe so, I dont try anymore lazy me.Trw2k's pnewsec is just pure command.Regards.
NeO
02-12-2001, 04:02 PM
Ok !I used /tracex and /pedump like you said and Pedump does all the work for you!SO it upacks our taget!

For Kayaker or evenone with ideas!

So i have one another Pecryp 1.02 the problem is not normal !If you opened it with Peedit you get .ficken in every section!In normal Pecrpy it's only in the last one!So i you use PeCrpy unapcker it opens it and at the he gets an eRROR!SO i have to unpack it manually!

[imagebase] 400000 ,OEP is 401000 , after /tracex command i used /pedump 400000 1000 D:\kl.exe!
And he says 400000 is not original Pehead!
Where should i find it???
If i use /dump 400000 1000 D:\kl.exe! it dumps it but the problem is that there is no Pehead so no MZ!!

You can convert a /DUMP [imagebase] [length of file] to a working PE as well afterwards using Procdump, PEditor or some other util. Assuming of course the packer hasn't pulled some other trick such as corrupting the Import table or the PE Header
Kayaker did you mean you the bhrama server!If i use bhrama server on Pecrpty 1.02 I get shut down off Loader!!

Thanks for helpinG!!

NeO
Kayaker
02-13-2001, 01:50 AM
What's the target Neo?

PECrypt 1.02 messes with the NumberOfSections in the File Header section of the PE Header. It changes the #sections to FFFF. Check in a hex editor if your PE Header section is actually in your dump, then check somewhere around bytes 80-100h or so (just after the text "PE") and see if there's an FFFF which shouldn't be there kicking around
NeO
02-13-2001, 05:39 AM
I Can send to you if you give me email!Because it the old crackme!Or if you like you can email to me!!You decide!!

NeO
mustapha
02-19-2001, 07:56 PM
Hi to All,
I do not try this packed prog because I have not the time yet. Yesterday I read some +Splaj tuts and the GetProcAddress api appears like you said. I always use the method explained in Volatility's tut(unaspack.txt). It is a great tut, all is detailed in it.
The bytes of the end of the unpacker-routine depends on the packer. Yesterday I found Discompress, there you can find the +spla tut and the secuence of bytes to look for the end of the unpacker-routine.
Well, now my time is over. Tomorrow I will ask some things about iat.
By
Mustapha
NeO
02-21-2001, 04:59 AM
Where did you get Volatility's tut(unaspack.txt). uRl!!

mustapha

NeO
mustapha
02-26-2001, 12:14 PM
Hi to all,
I checked Globe and I have problem(s). I used bpx FreeLibrary, some F12 until Clobe.rsrc, bpx here and 14 F5 and then some F10 until

00490E02 8B83CC1F0000 MOV EAX, [EBX+01FCC] ; EAX=400000
00490E08 038308200000 ADD EAX, [EBX+02008] ; EAX=463318
00490E0E FFE0 JMP EAX ; go to Globe.CODE

After the jump, I land in Globe.CODE, everything seems right, no jump to the middle of the code.
I made a script to procdump and when I try to use it, I have an error. So I dumped (with jmp eip....) the code and changed the entry point to 63318. After that I have some access-error and a runtime error if i try to use my globeunpakced?.exe.
Now I know that I am in the wrong direcctions.
Like always: Any suggestion?

Saludos
Mustapha
Lord Rhesus
02-28-2001, 06:12 PM
I haven't actually had a go at unpacking this program, but it seems to me that most people fail at this point. And I think that it puts them off, so I suggest that in order to keep people interested that someone posts the OEP. Any critics?
Kayaker
02-28-2001, 07:27 PM
Hi Mustapha,

This problem with Procdump not being able to rebuild the Import table that PECrypt corrupts is mentioned in the first post. You can either use (/PEDUMP 400000 63318 filename) and a new IT will be sitting in a new section at the end of the file, or you can try out Revirgin and rebuild it manually.

Procdump is still a great tool, but not being able to handle corrupted Import tables or PE Headers limits its use now. PEDUMP is the simplest way to go. However if the pointers to the IT are redirected, as in Asprotect, then you need something like Revirgin.

Even for "regular" packed dumps where the image of the file in memory looks just as the original unpacked file would, I prefer to raw dump the file and fixup the PE Header with PEditor over using Procdump. At the OEP you would use
/DUMP Imagebase SizeofImage filename
where Imagebase is (usually) 400000 and the Size you can get from PEditor as well.
Then you use the Dumpfixer feature to make the Virtual Size and Virtual Offset equal to the Raw Size and Raw Offset of all the sections, fix the OEP, change the code characteristics of the 1st section to E0000020 if necessary, check that the Imports are all OK, and viola, you've got a working PE file. If the Imports *aren't* OK, you can still use this raw dumped file as a base to add a rebuilt Import table on to the end of it.

Just caught Lord Rhesus' post as I was about to post this one. Actually, Mustapha just did show the OEP. A simple BPX 490E0E should get SoftIce to break there bypassing all the crap. /Tracex should also find the OEP, good chance here for people to try it out.

Hope this helps,

Kayaker
mustapha
03-02-2001, 07:10 PM
Hi to all,
Yes, with PEditor I can make the prog run, I used Rebuild Import Table option. I am gonna install it in another machine to see what happends.....
Mustapha
03-03-2001, 06:12 PM
Hi to all,
Well, I used PEditor to rebuilt the import table and Globe load fine in my computer but I try it in a Windows ME machine it does not works.
I used Icedump (the fisrt time i use it, it impressed me) and Globe works fine in both, Win98 & WinME.

Saludos
Mustapha
Mustapha
03-12-2001, 06:43 AM
well, a made a mistake, there wasn't a WinMe machine, Sorry :(

Mustapha.
+SplAj
03-13-2001, 03:32 AM
Hi guys,

may I input a little help for you who are STUCK re dumping/rebuilding the IAT/IT for this target ?....

If not CLOSE this message immediately !
and sorry for poking my nose into this thread. :'(

If so the first thing to do is a bpx LoadLibraryA and when SI pops then after F12 look at where EDI points to..... this is in the middle of the IAT/IT section at 4671AC - hint scroll up to the first thunk <Alt-PgUp> and see the first API memory is at 467118.
Now get to your OEiP at 463318, dump with PEditor1.7, (after E EIP EB FE) then kill the task. Edit the DUMPED.EXE with PEditor1.7 and change the Entry Point to 63318 and the Import table to 67118.
Then REBUILD with the following parameters selected :-
Rebuild Import Table + make PE Header WinNT compatible. NO realign etc.

Now you should see the IT address has changed to 67000 and if you click 'imports' ... I think it's fixed now......erm change the EB FE back to 55 8B at raw 63318 !

see, no icdeump to worry about or strange PE header section entries or redirected API's. Just plain vanilla dump and rebuild the traditional way.

Thats all , no help with the 3 timezones or closing timer nag ...
unless you want that to ? don't think so.

Have fun :D

SplAj


A little mini project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A little mini project
PDA

View Full Version : A little mini project

Raven59
03-19-2001, 05:04 PM
This little crackme coded by Lazarus, he describes as "uncrackable" and dares us to crack it. Now I have played with it for a while and have learned much , but not enough to crack it. Now I can tell you were I am with it but perhaps those of you wishing to assist me in cracking this might be better off without my input at this juncture. There is also the possibility that this is "over this newbies head" at this point in time, but it sure peaks my interest. It can be found at http://mesa-sys.com/mercution/hf/crackmes/lazarus/crackmes2.zip. Help appreciated.
Aleph
03-19-2001, 05:42 PM
Link don't work.
Wich one is it, crckmeg2, crckmes2 or crckmew2 ?? (use h**p://mesa-sys.com/mercution/hf/crackmes/lazarus/ to get it) ??

Or register on the board, and post it in your post (chck 'attach file' on the message window)

Regards,
Aleph
Kayaker
03-19-2001, 07:23 PM
Hi All,

Permit me to impose here. If I'm not mistaken I think Raven meant this Lazarus crackme:

http://mesa-sys.com/mercution/hf/crackmes/lazarus/crckmeg2.zip

I apologize Raven for not getting back to you on this, I have attempted it and was hoping to give you some good news ;-) It is tough, probably very tough, but as a unified project effort it just might be crackable. To start with it's packed with Aspack 1.081, so you need to at least start Icedump to get it running with SoftIce (it uses the MeltIce protection). The unpacking is easy, you can actually use Procdump on this older version of Aspack (just choose Unpack with a later version of Aspack selected), or you can manually unpack it with /PEDUMP.

However!, I seem to have problems with the unpacked version, the window is partially drawn and then it receives an exit message, so even unpacked there are difficulties.

As for the keyfile and s/n, I haven't given it too much attention yet since I'd *like* to at least be able to work with an unpacked file.

BTW, the solutions that are listed on the site for this crackme are actually for another crackme, bit of a mix up there I guess.

Good luck to all :)

Kayaker
Raven59
03-20-2001, 04:48 PM
Kayaker, you are right.It is the crckmeg2.zip file. It has anti-sice and indeed is packed with aspack 1.082. I used procdump on this and saved the unpacked file. When I tried to open the unpacked file, it blinked, again showed its anti-sice protection even with frogsice running. Its a delphia program and dede shows some interesting patch points; except I can't get to them.
qferret
03-20-2001, 08:34 PM
damn you guys ;-)

I had to reformat my HD again......haven't even reinstalled Sice yet & it's been a week and a half. But now you go and get my curiosity piqued right when I was starting to be a productive member of society hehe

Well, time to feed my HD some tools & see what I can see :-D
Kayaker
03-20-2001, 11:43 PM
qferret (03-20-2001 18:34):
damn you guys ;-)

...now you go and get my curiosity piqued right when I was starting to be a productive member of society hehe

LOL. Whew! Guess we saved you just in the nick of time. Who knows what trouble you would've gotten into out there in society ^_^

I'm still trying to figure out why the unpacked proggy doesn't run well. There is a MeltIce protection easily bypassed (for anyone unfamiliar with this, read code.txt that comes with FrogsIce) or you can simply start up Icedump.

But there's also a PeekMessageA call during creation of the main window that detects a WM_QUIT = &H12 message while the window is only partially drawn. The proggy shuts down of course. This is why you see it "blink", but this has nothing to do with SoftIce detection. It *might* be a deliberate trick which detects if it's been unpacked (and a damn good one if that's the case), or it just might be a weird glitch.

I tried rebuilding the Import table with Revirgin so I could paste it into a raw dump, rather than using Unaspack or Procdump, but Revirgin crashed on me (curious for just Aspack).

Anyway, that's all the useless information I have to contribute for now.

Cheers,
Kayaker
Kayaker
03-21-2001, 06:09 PM
Hi,

OK, I came up with a workable solution to the "blinking window" problem with the unpacked version of this file, if anyone else is having the same effect as me. I also unpacked it using the 'old-fashioned' method of dumping the Import .idata section BEFORE it's overwritten, which is the "trick" behind Aspack, and inserting it into a raw dump of the file. This produced a working file similar to using Unaspack or Procdump. I can go over this method if anyone's interested, but it doesn't really matter, it's not really necessary but I just wanted to make sure the problem didn't have to do with the unpacking method per se.

Anyway, the problem with the window being partially drawn, then exiting occurs here:

:0041E30D E8DEB9FFFF call 00419CF0 -draw template of window
:0041E312 8B45FC mov eax, dword ptr [ebp-04]
:0041E315 E8F2FDFFFF call 0041E10C -process messages which draw rest of window

In the 1st call, most of the main window is drawn except for the tab controls and the edit box text. You can see this by using F4 or typing 'RS' in SoftIce, which will RestoreScreen so you can see what's behind your SoftIce window.

In the 2nd call is a PeekMessageA, TranslateMessageA, DispatchMessageA series of API calls which process certain window messages to draw the rest of the window. For some reason during the 2nd time through this call, the WM_QUIT message (12h) is received and the progam shuts down. This happens here:

:0041E072 E8F9DB0200 call PeekMessageA
:0041E077 85C0 test eax, eax
:0041E079 0F8485000000 je 0041E104
:0041E07F B301 mov bl, 01
:0041E081 837C240512 cmp dword ptr [esp+05], 00000012 ;if WM_QUIT, then quit of course
:0041E086 7478 je 0041E100

This is the normal course of events IF you opted to close the program. Of course we don't want to. So I found what you can do is change the cmp statement to a cmp of the message WM_CLOSE (10h). This way you can still close the program with CTRL-ALT-DEL, but it won't abort to soon. So just change

:0041E081 837C240512 cmp dword ptr [esp+05], 00000012
to
:0041E081 837C240510 cmp dword ptr [esp+05], 00000010

and we can continue with trying to solve the keyfile/serial part of the crackme. I really don't think the above problem is deliberate, there's nothing in the code processing the message queue indicating that it should send a WM_QUIT message if it detects a bad-cracker attempt. Of course I wouldn't want to be quoted on this ;)

You don't really need to do this if you don't want to, you could still work on the packed file. I just wanted to mention this as an option.

Kayaker
Raven59
03-21-2001, 06:38 PM
Kayaker, here is this newbie's dumb question. The packed crackme blinks when sice is detected. With frogsice enabled, the packed file opens. Now, after the file is unpacked with procdump and frogsice is still running, the unpacked file "blinks" and will not open. Looking at the packed vs. unpacked PE headers, it would seem that changing the unpacked ep to that of the packed ep would lead to the same oep, and thus the unpacked file would open. Am I way off in my thinking on this?
Kayaker
03-21-2001, 11:57 PM
Hi Raven59,

I may be misinterpreting your question, but the Original Entry Point of the packed and unpacked files are going to be different. The OEP of the packed file is the start of Aspack unpacking code (actually it's a jump from the .text section into the .adata unpacking code, but it amounts to the same thing), and the OEP of the unpacked file is the entry point of the original program at 401000. Not sure if this answers your question.

I did find something else out that's *very* interesting. There IS a check as to whether the file has been unpacked by comparing the File Size with what it should be. If it's greater than that then it means it's been unpacked and PostQuitMessage is used to send a WM_QUIT message to the Windows messaging queue. This is the WM_QUIT message that is processed later on and shuts down the program. I don't remember this as a part of Aspack but I could be wrong, it's been a while. So it *could* be something Lazarus coded himself or it's part of a Delphi protection scheme he implemented. (You out there Laz? ;)

Here's what I see happening. There is anti-SoftIce protection built in as part of Aspack which uses CreateFileA to check for the presence of \.\\SICE or \.\\NTICE. This is the MeltIce protection I mentioned. It's easy to bypass by setting a BP on CreateFileA and changing the JZ which monitors for it after the call. FrogsIce and Icedump take care of this little anti-SI trick automagically anyway.

Beyond this there's the check on the File Size here:

:00404A79 E83ED90300 call 004423BC ;Call GetFileSize
:00404A7E 59 pop ecx
:00404A7F 3DE0930400 cmp eax, 000493E0 ;compare size with 300000 bytes
:00404A84 7E0D jle 00404A93
:00404A86 8B0D801F4500 mov ecx, dword ptr [00451F80]
:00404A8C 8B01 mov eax, dword ptr [ecx]
:00404A8E E8B5980100 call 0041E348 ;if >300000 bytes it's unpacked therefore call PostQuitMessage

So I've changed my strategy of dealing with the unpacked "blink" by changing the JLE line instead of modifying the WM_QUIT message test. Now you can run the unpacked proggy and close it normally.

Kayaker
SV
03-22-2001, 03:26 AM
Lo all (kayaker :)

I just have encounter this kind of check in a ftp server ASprotected ... funny !
BTW exe is rebuild (import ok ;)

Regards SV
qferret
03-22-2001, 02:49 PM
Wow, Laz DID go all out, didn't he? ;-)

I can't get my dumped file to run AT ALL, but I suck at unpacking.

I can however disassemble the unpacked version & it looks ok for the most part. Rather than fall too far behind you guys here, I'll just dig around in the unpacked one, & Sice in the packed version hehe....I'm gonna use DeDe to make a .map file for IDA & see if I can use it to find a few interesting things DeDe turned up for me. ( It would be easier if I could get the unpacked version running...can you say Symbol loader? [.map -> .nms]) ;-)

oh btw....I finally got TRW2000 to work on my system (new Video Card) ......& yes, Laz put in stuff to crash that too LOL
Raven59
03-22-2001, 08:42 PM
Kayaker, If I am following you, you are saying that the unpacked file "blinks" not because of anti-sice protection but because of a file size check with the packed one. You are then saying to eliminate the blink, @ 00404a84, 7eod, change the jle. Now would that be to a jnle and what would the 7e0d be changed to or are you saying to nop this. Still learning! And ferret playing in DEDE, I have some questions there on some possible patch points.
Raven59
Kayaker
03-22-2001, 10:57 PM
Raven,

Actually the window blinks for both those reasons. The *cause* of the blinking is the program receiving a standard Windows WM_QUIT notification message after the window is partially drawn. This "message" has been sitting on what is known as the message queue simply waiting to be processed. It is sent to the queue by the PostQuitMessage API which is called if you fail either the SoftIce or the File Size checks, and is processed later by the PeekMessageA et al calls.

In the meantime there's lots of other code called between the 2 checks and the time the program craps out on you. This is actually a good trick, by not closing the program immediately after the checks it makes it harder to figure out where they are actually coming from. You need to deal with both of these checks separately (unless you patch it as I first did, which I don't *really* recommend, it was kind of brute force). If you are using FrogsIce or Icedump to fool the SI check, then you only have to take care of the second one.

As for the 2nd part of your question I would encourage you to trace through that part of the code and figure out how you want to patch it. You could change the JLE statement but you could also change the number of bytes the true file size is compared to in the cmp statement above that. Or you might find some other patch point within the Call 4423BC above that. There are always other options, so you should explore the code thoroughly on your own, try to understand exactly what's happening and try to determine WHERE you want to code to jump to to bypass the PostQuitMessage being called. You might even want to LET the JLE part of the check go untouched and patch something later, just so you miss the call you don't want called. There is no "best" option, just the one that works for you.

That 7Exx JLE statement: 7E is the opcode for JLE, xx is the number of bytes to jump ahead. You could change it to a JGE but you might as well use an unconditional rather than a conditional jump. EB is the opcode for JMP. EBxx will jump xx bytes ahead, EB00 will jump to the next line only, same as if you nopped out the statement. Determine where you want the jump to go and use the appropriate EB statement. You can type in the code line you want as text with the SoftIce 'a' command.

Hope this helps,

Kayaker
Aleph
03-23-2001, 11:27 AM
qferret (03-22-2001 12:49):
oh btw....I finally got TRW2000 to work on my system (new Video Card) ......& yes, Laz put in stuff to crash that too LOL

There's no check for ollydbg ;p
Not my favorite stuff, but it can do a fuzzy analysis, telling you what API is called by the proggy, with wich parameters [CreateFileA with hell.key, for example...] and dump any section to a file. No bpx, but useful for a nearly-dead-listing approach (trace the 'You did it' to its point of origin, ...)

Regards,
Aleph
Acid_Cool_178
03-23-2001, 04:29 PM
Herm..

I haven't cracked the crackme (abit 2 hard for me atm)

But I was the crackme and it have been solved by others

Check it out at
www.HForge.cjb.net <-- Hellforge
and at
http://members.nbci.com/_XMCM/faxanadurox/crackmes.htm <-- LaZaRuS Crackmes page :)

Good luck and hope that this was helpfull..
Acid_Cool_178
Raven59
03-23-2001, 07:16 PM
Acid Cool 178, I may be mistaken,but I don't believe that this crackme we are working on has been solved ,at least not at the sites you mentioned.
stillnewbie
03-24-2001, 08:58 AM
Raven59 (03-23-2001 17:16):
Acid Cool 178, I may be mistaken,but I don't believe that this crackme we are working on has been solved ,at least not at the sites you mentioned.

Heya Raven59,
I'm not surprise that Tiamath solved the serial coz he is leet on unpacking.
serial does not a problem for him either.
regards
stillnewbie
Raven59
03-24-2001, 10:29 AM
Kayaker, following your thread, increased the file size and with frogsice running, the unpacked version now runs. Looking in DEDE under timer1timer is a string reference "You did it". Looking up I saw two possible patch points,407232 and 407244. I tried changing and noping but have had no luck as yet. I also used sice on the unpacked file breaking on hmemcpy and began to look for a hard coded serial again with no luck as yet. With WDASM, there are no string references in either the packed/unpacked file. In DEDE, under form key down there is a reference to "didn't shadow mention that disassemblers suck". Wonder if its possible to get string references in WDASM. This newbie continues to learn with your assistance. Perhaps Ferret has Found something of help in DEDE other than what I mentioned.

Raven59
Kayaker
03-24-2001, 10:22 PM
Yeah well don't count on me for guiding you through this one, this is as much challenge as I can handle. This is an excellent crackme. I don't know what we did to deserve such pure evil though ^_^. I've never seen so much labyrinthine, dead-end, confuse-a-cracker code before. Well worth trying this crackme just to study the implementations.

I'm still chuckling over the Timer1Timer event. If you go over the code carefully you see it's targetting W32Dasm and IDA, showing a very simple yet very effective way deter our beloved tools we count on so much. Just try to work with either disassembler while the crackme is running. As he's trying to tell us, disassemblers suck ;)

The FormKeyDown event is curious. It seems to be concerned with the keystrokes Ctrl-D (familiar somehow), but nothing seems to happen one way or another.

At this point I am simply suspicious of EVERYTHING! Either implied or otherwise. The "Input serial here" edit box may be bogus. There's a "hidden" small edit box next to it which may be as well. The only text I see being read is the "UNREGISTERED" label. The "Invalid Keyfile" message box when you create a keyfile is bogus, it will come up in any case. The real, or at least the *more* real reading of the keyfile occurs later, and only if you get the relationship between the ini file and the keyfile correct. You can use an API monitor and GetPrivateProfileStringA to determine this relationship.

The only thing I'm fairly certain of at this point is that what's apparent - isn't. Throw out your old ideas of the way a program should determine if it's registered. I don't think this one will be solved by finding a s/n or patching a few jumps. There is one thing I found which *might* provide an avenue to explore. I was *really* questioning exactly WHAT will tell us if the proper solution is found. There is a "You did it" string in the Timer event, but I have a suspicion this is a red herring. There doesn't seem to be any Dialog boxes which will come up and tell you congratulations. The edit box(es) *might* be used to display some message if you crack it. But I thought the most likely would be a regular MessageBox. So I broke on the "Invalid Keyfile" message box and found that several Message boxes are called from the same location.

* Referenced by a CALL at Addresses:
|:00404B74 , :00406B8E , :00406BE3 , :00406C98 , :00406D20
|:00406D98 , :00406E10
|
:0044AF74 E97334FDFF jmp 0041E3EC

The jump goes to a MessageBoxA call. I traced the 7 addresses that lead here and found the "Invalid keyfile" message came from the 1st one at 404B74 and the second one at 406B8E has a "You did it" message. The text of the message is NOT from the same memory location as that from the Timer event but from here

:00406B71 833D30C3440000 cmp dword ptr [0044C330], 00000000
:00406B78 7408 je 00406B82
:00406B7A 8B1530C34400 mov edx, dword ptr [0044C330]
:00406B80 EB05 jmp 00406B87

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406B78(C)
|
:00406B82 BAB5D34400 mov edx, 0044D3B5

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00406B80(U)
|
:00406B87 A1801F4500 mov eax, dword ptr [00451F80]
:00406B8C 8B00 mov eax, dword ptr [eax]
:00406B8E E8E1430400 call 0044AF74

The contents of [0044C330] contain "You did it". I was actually able to get a message box with this text to display after pressing the OK button. Of course I don't even know if this what the final indicator of success is supposed to be. As I said, I am very suspicious of Lazarus now ;)

PS, to those who wrote that this crackme had a solution already written, I really don't think so, this is CrackMeg2.

The hunt continues...

Kayaker
qferret
03-25-2001, 09:51 AM
* Possible StringData Ref from Data Obj ->"DIDN'T SHADOW MENTION THAT DISASSEMBLERS SUCK ???"

I got a kick out of this also. I am also running into alot of bogus crap.

I got my unpacked ver. to run now, but I said the heck w/ the .map route & just loaded the Delphi 4 FLIRT Sig into IDA while disassembling. I know this labels quite a few functions but I haven't had a chance to dig too far yet.

My PC overheats when I'm in Sice for more than 10 minutes or so, then I have to shut it down (after it crashes itself of course) and wait for it to cool b4 I can try again. Really annoying. Gonna have to check it out a bit further, suspect either Memory Module or Hard Drive. Both are fairly cheap, but if my HD goes out b4 I'm ready for it, I'll be pissed LOL.....anyway, that's my excuse for being so dang slow here ;-)
LaZaRuS
03-25-2001, 12:34 PM
Hi

just throwing my 2 cents into that project (after AC_178 told me you ppl would work on it) and solving at least a bit of confusion - without spoiling the fun, of course.

The crackme has not yet been cracked as far as I know, and the "disassemblers suck" string reference is a reference to a crackme made by former Hellforge member Shadow where he had a sdr like this in it.

Thats all I remember 100% - I coded this crackme about 2 years ago and dont have the sources anymore.

Generally I can say that you are pretty much on the right track and you probably will have a solution, soon.

LaZ
Raven59
03-26-2001, 06:54 PM
Kayaker, qferret, this newbie is in way over his head, but struggling to learn. I do read and study a lot but am not up to this challenge. Kayaker, you once said,"if you have a ?, just ask" So here it is. Throughout the thread, there is mention of numerous API calls to various API functions. I gather that when you start the crackme, you are also running an API spy program. Once you learn the eip of the various API calls, you then use sice to break on the location and trace through the calls. Is that correct? If so, a brief explanation is requested. I have not located any tutorials on the use of this tool in conjunction with sice and if you know of any kindly advise. Well at least we got Laz here.

Raven59
Kayaker
03-26-2001, 11:59 PM
Hi Raven59,

Yeah, I tend to consider an API monitor such as APISpy32 a mandatory reversing tool, a point which as some people know I've beaten to death before ;-) After a while you don't really "need" it to sniff out what's happening so much, but it's a great way to learn how Windows actually operates using API's and to get a sense of the general code flow of a program.

You can run APISpy32 on the program you're monitoring with any of the built-in .fnl libraries (Kernel32, User32, Advapi32) or choose just selected functions from any of them. You can also build your own personal library, or modify the existing ones (with Libedit.exe), to eliminate some of the calls that you're either not interested in or come up too often. You can also Pause API monitoring until you decide to start it, i.e. just before you press a registration OK button.

For example, running the API monitor with the Kernel32 library on the crackme scoped out this:

004381A3:FindFirstFileA(LPSTR:00DD6308:"Hell.key",LPDATA:0069FC58 )
004381A8:FindFirstFileA = FFFFFFFF (CRACKME.EXE)

The output is always in pairs when there's a return value and the parameters within the brackets are read in the same order as you see them in the Win32 Programmers Reference, i.e.

HANDLE FindFirstFile(

LPCTSTR lpFileName, // pointer to name of file to search for
LPWIN32_FIND_DATA lpFindFileData // pointer to returned information

While Filemon would also tell you that the program is looking for a file called "Hell.key", it doesn't tell you what API is being used or what address it's at. Try running APISpy on the crackme with the above API, as well as CreateFileA and GetPrivateProfileStringA as a start, and you'll find a wealth of info. When you've "created" what you think the program is looking for, rerun the API monitor and see if there's any new info. This should help you to reconstruct what the keyfile *should* look like.

An API monitor isn't a panacea of course, monitor too many API's at once and you just can't sort out what's important from the output. I didn't use it to find the GetFileSize/PostQuitMessage subversion for example, that was just from poking around in the code, but now that I know what to look for, the API monitor output makes it oh so crystal clear!

Try using an API monitor routinely and you'll probably find it helps a lot.

Regards,
Kayaker
Raven58
04-07-2001, 10:16 AM
Kayaker, I hope I understand this. In DEDE, under timer1timer you mentioned that the code there is targetting WDASM & IDA.Would you be willing to explain were and how that takes place? Isn't there a way to bypass (patch) a location so that we are able to use these tools? A bit of confusion on my part is this; since the formkeydown lead to the "disassemblers s**k" message and the time1timer lead to the "good boy message", I had thought any anti-disassembler code would be under the formkeydown and not the other way round as you suggest. Would you clarify this? Now I had used debug under WDASM on the unpacked crackme but while stepping through the code nothing moved in the disassembler window. Was that what you meant when you said "try using a disassembler"?

Thanks, Raven
Kayaker
04-08-2001, 12:04 AM
Hi Raven,

I'll try to explain what I saw, but I haven't touched the crackme since my last post so this is just from memory/guesswork. Someone else may have a better interpretation of what's going on.

Under the Timer1Timer event are calls to GetForegroundWindow, which returns the handle of the foreground window (the window with which the user is currently working) and GetWindowTextA which gets the text of the specified window's title bar. After that you notice a bunch of compares:

00407198 cmp eax, +$57 ;W
004071B0 cmp eax, +$33 ;3
004071C8 cmp eax, +$32 ;2

004071EC cmp edx, +$49 ;I
00407204 cmp eax, +$44 ; D
0040721C cmp eax, +$41 ;A

and then a PostQuitMessage call within:

* Reference to: forms.TApplication.Terminate(TApplication);
|
00407229 E81A710100 call 0041E348

So you can use W32Dasm in debug mode, but if you actually allow the crackme to run free so the Timer event kicks in, then move the focus to the window who's title bar contains the text "W32", then the crackme closes itself. Same with IDA. You can *use* both of the disassemblers on the crackme, but not really while it's running. I'm sure you could patch any one of the compares to get around this annoyance, or even change the title bar text of the disassemblers so they don't contain the "bad words".

As for the 'You did it' message, well I could be wrong, but after forcing this part of the code to be executed and tracing it a couple of times, I never figured it to be anything more than a red herring, an enticing string reference to bite on. Also it just didn't make sense to me how or why the valid "good boy" check would be **within a Timer event**. How within 1000 msec or so you could go from not registered to registered, because I didn't see any checking of an ini or key file within the Timer event code, or the Registry, or of a section of code that might be checking if you've since inputted a valid s/n.

If you trace into the code just before what looks like it might trigger the "good boy" jump

0040723D E8CA100300 call 0043830C
00407242 3BC3 cmp eax, ebx
00407244 0F873CFFFFFF jnbe 00407186
0040724A 66C745E42000 mov word ptr [ebp-$1C], $0020

* Possible String Reference to: 'You did it'

all that seems to be happening in the call 43830C is a SCASB on the Title bar of the crackme which returns its length in eax (2F). This is compared with ebx which only seems to be a counter. When the counter reaches 2F then apparently "You've done it". Big Deal! The calls after that don't seem to do anything important like call a message box, change any text or do any further checking for a valid registration. Again, I could be wrong and there *is* something further going on here, I just thought it looked like confuse-a-cracker code to me and I focussed my attentions elsewhere rather than beat this area to death. Call it a hunch ;)

As I mentioned, there is another "You did it" message in another address location that I thought had more potential of being the real one. And as it turned out at least this one *is* used in a MessageBox call.

Continued...
Kayaker
04-08-2001, 12:07 AM
As for the FormKeyDown event, I'm still a little uncertain as to what it's trying to accomplish. The "Disassemblers Suck" message and the www site address again seem to be dangling carrot string references. I couldn't get them to display as messages at all. Another part of the code seems to be targetting the key combination "Ctrl-D"

004070D2 test byte ptr [ebp+$08], $04 ;Ctrl key pressed?
004070D6 setnz dl
004070D9 and edx, +$01
004070DC test dl, dl
004070DE jz 004070FC
004070E0 mov ax, word ptr [ebx]
004070E3 cmp ax, +$64 ;"d" pressed?
004070E7 jz 004070EF
004070E9 cmp ax, +$44 ;"D" pressed?

The hex value comparisons for d and D are obvious, but where the hell does that test with 04h, specifying the Ctrl key come from? Well, if you set a BMSG Hwnd WM_KEYDOWN for example on the Hwnd of the main window (this is the TPageControl window of the tab sheet, not the TForm1 title bar window) and get back into program code (I discuss how to get back into program code from "WM_" message breaks in my latest tut), and then fiddle around tracing the code for a while, you reach the following code:

0041851E push $10 ;virtual keycode for "Shift"

* Reference to: GetKeyState()
|
00418520 call 0044BB68
00418525 test ax, ax
00418528 jnl 0041852D
0041852A or bl, $01 ;identifier for state of Shift key

0041852D push $11 ;virtual keycode for "Ctrl"

* Reference to: GetKeyState()
|
0041852F call 0044BB68
00418534 test ax, ax
00418537 jnl 0041853C
00418539 or bl, $04 ;identifier for state of Ctrl key

So, what's happening here is GetKeyState is used to detect if you've pushed the Ctrl or Shift keys. If so, it flags that fact with the OR statements. This happens continually as part of Windows monitoring and is not part of the protection routine. You can see 04h is used for the Ctrl key. This is where the value comes from in the statement which IS part of the protection Lazarus designed:

004070D2 test byte ptr [ebp+$08], $04 ;Ctrl key pressed?

Now this routine *looks* really cool, but as I say I don't really know what it's supposed to accomplish. I tried changing my SoftIce key combination with the ALTKEY command to something other than Ctrl-D and didn't really find any difference. Nothing seems to happen one way or another. I didn't really spend ages going over this anyway because I found farting around with the WM_KEYDOWN message seemed to lock up my system (couldn't access my desktop icons etc.) I don't *think* this was due to the code, just my unstable system, happens at other times as well.

I could be totally wrong that this code doesn't do something nasty, it just didn't seem to for me. BTW, if you start playing around with this and monitor the contents of [ebp+08], you'll see that for Ctrl it's =4, Shift=1, and Alt=2, but if you use more than 1 they summate, so suddenly it may contain 5,6 or 7. Just a weird thing I've noticed before as well when working with keystroke stuff. You just need to restart the proggy and then [ebp+08] will be cleared.

Well, that just turned into a bloody mini tut. I hope some of it is understandable ;-)

Continued again #$&^!!
Kayaker
04-08-2001, 12:09 AM
Maybe just one last thing. You said

"A bit of confusion on my part is this; since the formkeydown lead to the "disassemblers s**k" message and the time1timer lead to the "good boy message", I had thought any anti-disassembler code would be under the formkeydown and not the other way round as you suggest."

Just a thought on this. Please don't take it wrong or as criticism or anything but I think this illustrates a perfect point that we should always be wary of. The statement is pure assumption. It's guessing what the code *should* be doing logically perhaps, not what's it's really doing. There's absolutely nothing in the world says the programmer should set up the protection a certain way. Remember especially Lazarus is trying to trick us, to make this difficult, probably even more so than a shareware programmer might. So even in a "real" protection there may be curves, dead-ends, obfuscation and so on. Probably a much more effective protection than all the packers, CRC checks and encryption algorithms combined ;p

Cheers,
Kayaker
Raven58
04-18-2001, 06:01 PM
Kayaker, I wanted to take a moment and thank you for all your help and guidance with this crackme. Although it was not solved, I certainly learned a lot from you. I must say, that I was somewhat surprised that we could not motivate some of our other advanced reversers to assist on this. So qferret, goatass, janek, hz, mersenne, thrax, carpathia, raldnor where were you when we needed you? Thanks also to Lazarus who's crackmeg2 remains unsolved for now, " a splinter in my mind", that I hope to try again as I learn more.

Raven58
janek
04-20-2001, 03:33 PM
Hi Raven58,

I like to be listed among people like Kayaker, Goatass, Carpathia etc but unfortunatly I don´t belong there - I am a raw newbie for whom finding a serial or eliminating a nag is still a challenge (and fun).
Lazarus crackme was beyond my reach and that was the reason I did not participate.
I look forward for new projects (maybe bit easier). Hope there will be some :)

JaneK
hz
04-20-2001, 03:56 PM
hiya,
Yes you are right. All I can offer in defence is "I really hate" crackme's but its not a good enough reason. I have been bemoaning that the board doesn't appear to be thriving as it once was and then leaving it to people like Kayaker and Clandestiny to put the effort in. Apologies,
(most noteicable by his absence hz).
+SplAj
04-22-2001, 07:44 AM
MINI PROJECT AREA
"A classroom run by newbies for newbies. Gain valuable reversing experience & skills as we explain the in's and out's of RCE"

mmm, big conundrum, who is what ? Like all more advanced;experienced;newbie;RCE I always feel a little guilty about poking my nose where it's not wanted. I don't want to get flamed , well not too much anyways ;)

BIG Q :-

So is this 'mini projects' run by newbies for newbies literal or not ?

As hz says, "I HATE CRAKMES" Most are stupid entrance exams to some la..erm ..nice cracking groupies who want to rival UCF ! So the challenge for me was to pass the test and then refuse to join }>
Never joined a 'klan', never will. I do this stuff for me, myself and I.

With this one from Laz it all seems to be a big joke. Just full of dead ends & red herrings and nice coding tricks. As he said he lost the source ;)

Kayaker , once again the hero, has performed serious scalpel injury
to this crackme and found some nice tricks for us all without actually killing it. It's entrails are all over the floor.... and I bet Laz is too, rollin around p*ssing himself laughing his f*ckin head off ......}>

Greetz

+SplAj
LaZ
04-27-2001, 11:16 AM
+SplAj (04-21-2001 21:44):
MINI PROJECT AREA
"A classroom run by newbies for newbies. Gain valuable reversing experience & skills as we explain the in's and out's of RCE"

mmm, big conundrum, who is what ? Like all more advanced;experienced;newbie;RCE I always feel a little guilty about poking my nose where it's not wanted. I don't want to get flamed , well not too much anyways ;)

BIG Q :-

So is this 'mini projects' run by newbies for newbies literal or not ?

As hz says, "I HATE CRAKMES" Most are stupid entrance exams to some la..erm ..nice cracking groupies who want to rival UCF ! So the challenge for me was to pass the test and then refuse to join }>
Never joined a 'klan', never will. I do this stuff for me, myself and I.

With this one from Laz it all seems to be a big joke. Just full of dead ends & red herrings and nice coding tricks. As he said he lost the source ;)

Kayaker , once again the hero, has performed serious scalpel injury
to this crackme and found some nice tricks for us all without actually killing it. It's entrails are all over the floor.... and I bet Laz is too, rollin around p*ssing himself laughing his f*ckin head off ......}>

Greetz

+SplAj

Hey, +SplAj

yeah, alright - I lied when I said that I lost my source, in fact I deleted all of my old sources when I closed my site and started full-time idling ;)

Furthermore I dont roll around on my floor just because the project seems to have failed in the case of this crackme. Actually I am rather surprised about that fact and if I find some time in the next weeks I will try to crack it myself (I hope my memories about this crackme equalize the amount of skills I lost during the last 10 months being out of the bussiness ;) )

So long and keep up the red-herring fishing ;)

LaZ
Kayaker
04-27-2001, 11:51 AM
LaZ (04-27-2001 01:16):

So long and keep up the red-herring fishing ;)

LaZ

Goldangit, now you're making me want to start poking around in the fish guts again. Cut that out! ^_^

Guess it's time for another fishing trip?

Kayaker
+SplAj
04-29-2001, 08:16 AM
Greets to Laz & Kayaker

LOL...and this (uncracked }> grrr) crackme is now so old the rotting fishy smell is rather overpowering us all ..... Laz should offer a gas mask to the worthy fisherman who stays the length.......and it won't be me , prefer to shoot the bastards with a kalashnikov !

Kippers for breakfast anyone ?

SplAj
LaZ
04-29-2001, 08:51 AM
Guess what, I found my source again. It was still on my "ancient" P2-300 =)

It's about 4 pages in a really bad coding style on 800x600 screen resolution (9 KB), and if you wish to have it I can upload it somewhere ;)

But I think you wish to crack it before, anyways ;)

Regards
LaZ
+SplAj
04-30-2001, 05:07 AM
Well found LaZ

.... lets keep the suspense up for a little longer ! if there is a solution then we (Kayaker ;) ) should carry on the hunt :-)

Maybe I will get my Kalash out again ......

SplAj


Crackme using a different approach
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crackme using a different approach
PDA

View Full Version : Crackme using a different approach

The Diver
04-22-2001, 06:54 AM
Get the crackme in www.arrakis.es/~ajr

The Crackme is written in Visual Basic 6.0 and so should be easy to crack but unfortunatly isn't so easy for Newbies like myself. (And I wrote the crackme so I have an advantage).

If, after trying for some time you still cannot crack it send me an e-mail and I'll give you the correct password. Armed with this information it may be easier to see how it works. Please do not ask for the source code until you have really tried to crack it and failed since I wrote the program to learn more myself and hopefully help other laern too.

Good luck!


A New Project?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A New Project?
PDA

View Full Version : A New Project?

CoDe_InSiDe
05-04-2001, 12:55 AM
Hi Everyone,

Maybe you've seen the little conversation with me and Kayaker in "The Newbies Forum" about a new Project :)
We need to get things going in here ;)
And so, i was thinking for a new Project about my latest CrackMe (A PatchMe named: Re-Move).
Maybe you want to take a look at it and solve it :)
It has some weird things, as ussual with my CrackMe's ;)
You can get the CrackMe here:

http://codeinside.freeservers.com/Crackmes/CoDeCrk18.zip

Have Fun.

Cya...

CoDe_InSiDe
CoDe_InSiDe
05-04-2001, 12:59 AM
Hi Everyone,

Hmm.. that link didn't work, strange :)
Try to get it from here:

http://codeinside.cjb.net

And look in the "CrackMe's and ReverseMe's" Section.
CrackMe 18 is the one we need ;)

Cya...

CoDe_InSiDe
Clandestiny
05-04-2001, 09:01 AM
Hiya CoDe_InSiDe & Kayaker,

Thanks guys for getting another project rolling. It sure is good to see something happening in the project forum again :-)

I'll d/l the target and let you know my findings soon...

Cheers,
Clandestiny
JimmyClif
05-04-2001, 09:10 AM
It's the funniest PE Header I've seen so far ;D
Kayaker
05-04-2001, 12:37 PM
WTF ??? ^_^
CoDe_InSiDe
05-04-2001, 12:49 PM
Hi Guys,

HAHAHA :D

I don't know if it's for Newbies, but that doesn't matter as long as you have fun with it ;)
As i told you before it's a bit weird CrackMe (Err PatchMe) :)

Cya...

CoDe_InSiDe
Clandestiny
05-04-2001, 03:45 PM
Hi CoDe_InSiDe,

LOL, I think I kinda cracked your crackme by default :-D ...Though after going back and looking closely at the code I think I understand how it works. Its definately an interesting crackme...but IMO you need to patch it so as to protect it against people like me who inadvertently remove the protection before even loading it up into SICE :-)

Now I'm sure you're curious how this happened so here goes...

Generally my first appoach when cracking or reversing any target is to get a dead listing. Following this, I attempted to load your crackme up into WDASM. Of course it did not disassemble and this was a dead give away that the proggy was packed or encrypted in some way. Realizing this, I opened it up in PE editor hoping to get a clue about what it was packed with. Now, as Jimmy Clif mentioned, the header looked a little strange. First, there were no section names ! Also, I noticed that all three sections had the characteristics E0000040. This had to be corrected right away for the SICE loader to break correctly. Using PE Editor, I changed the characteristics for the first section to E0000020 (Executable, Read, Write). Now, I loaded it up into SICE and it broke at the entry point as expected. At this point I traced the target once through just to get a feel for the flow of the code...and Lo and Behold it was cracked !!! WTF, I was wondering... I haven't even really patched anything and its already telling me Contratulations I did it !!!

So now, I figure I'm going to have to go back and find out how I cracked it :-D

Running another copy of the exe whose section characteristics had not been modified let me know that patching the characteristics of the section was the key. Needless to say, I'd just stumbled on the solution due to the standard investigations I make before unpacking a proggy ;).

With these thoughts in mind, tracing the code in SICE began to make some sense.

...continued
Clandestiny
05-04-2001, 03:48 PM
...continued

PE INFO:
entry point: F0090
size of image: 7F1000
image base: 0040000

017F:004F0090 BE00114000 MOV ESI,00401100 017F:004F0095 8BFE MOV EDI,ESI
017F:004F0097 33C0 XOR EAX,EAX
017F:004F0099 B930030000 MOV ECX,00000330 // raw size of first section
017F:004F009E 33DB XOR EBX,EBX //clear ebx
017F:004F00A0 33D2 XOR EDX,EDX //clear edx
017F:004F00A2 AC LODSB //load byte starting at address 00401100
017F:004F00A3 01C3 ADD EBX,EAX //decrypt routine
017F:004F00A5 2C1F SUB AL,1F
017F:004F00A7 01C2 ADD EDX,EAX
017F:004F00A9 AA STOSB
017F:004F00AA E2F6 LOOP 004F00A2
017F:004F00AC 2BDA SUB EBX,EDX
017F:004F00AE 93 XCHG EAX,EBX
017F:004F00AF 3DD01B0000 CMP EAX,00001BD0
017F:004F00B4 7506 JNZ 004F00BC //if != 0, jmp good guy; else bad guy
017F:004F00B6 6800114000 PUSH 00401100
017F:004F00BB C3 RET
017F:004F00BC BF00004000 MOV EDI,00400000
017F:004F00C1 BED2004F00 MOV ESI,004F00D2
017F:004F00C6 33C9 XOR ECX,ECX
017F:004F00C8 B12E MOV CL,2E
017F:004F00CA F3A4 REPZ MOVSB
017F:004F00CC 6800004000 PUSH 00400000
017F:004F00D1 C3 RET

...So from the above code it seems that the first section of the .exe is encrypted. The decryption begins at address 00401100 and proceeds byte by byte until the end of the first section of the PE file is reached. This will occur when ecx = 0 since ecx was initially loaded with the raw size of the section before decryption began. The result of the decryption is finally found in eax and must be dependent on the characteristic flags of the first section.

017F:004F00AC 2BDA SUB EBX,EDX
017F:004F00AE 93 XCHG EAX,EBX
017F:004F00AF 3DD01B0000 CMP EAX,00001BD0

If eax = 1BD0, the PE header has not been edited and the proggy executes the "bad guy" MessageBox. If, however, section characteristics were changed, then eax will not = 1BD0 and the comparison will fail and consequently execute the "Congratulations" message box.

Well, thats about as far as I investigated. I'm sure someone else will have something constructive to add to the above explanation :-)

Cheers,
Clandestiny
JimmyClif
05-04-2001, 04:35 PM
Ouch Clandestini :)

I wonder, I've been tracing thru this code for exactly 2h 59 mins... See above... I edited my
message after I finally made it *hehehe* to know the time difference *g*

But I had to deal with SoftIce checks, the int 68 in the code (EC87) [one is copyied into
00401500 after awhile]

How come you could correct the PE using a PE Editor? My PE was all grabbled up and I had
to use a hex editor for it... And then there was that bloody cmp byte ptr [XßX],CC check
which searched for a breakpoint, and then this bloody code copying itself over and over
again before spitting out the congrats message...

And don't tell me... I traced this all (/me slaps myself)

Oh well, reading your solution, I might have choosen the hard path... but it worked too ;)

-J-
Clandestiny
05-04-2001, 05:30 PM
Hey Jimmy Clif,

Wow !!! SoftIce checks ? Breakpoint scanning code ? You started making me wonder if I d/l the wrong crackme ;-) But nope... crackme # 18 called ReMove... unless we got different versions or something ???

No anti SICE checks at all. Well I didn't encounter any anyway. And as for breakpoint scanning code, I suspected the possibility when SICE refused to break on MessageBoxA...but had no need to persue it further since my little proggy essentially cracked itself when I changed the section characteristics. I know it seems too good to be true...but I swear it worked ;) !!!! Just ran my little .exe again and its still cracked. Unbelievable, huh?

Hey, I'm interested in the details of your solution since you clearly put out a lot more effort than I.

Cheers :)
Clandestiny
JimmyClif
05-04-2001, 06:04 PM
Heya Clandestini,

Yeah... I wondered too if you had a wrong CrackMe.. but nope.. it must be the same... after all it's called the same (this is brutal reverser logic *jk*)

I remember bit and pieces.. and I don't really want to open this one again (jeeesuss - no way) ;D

So, when I got it I opened it into my PEDitor (by Yoda) - (Procdump failed, but I guess that's another story) and all I've seen was this:

Section Names : Nothing
VS : Nothing
VO : At two of them E000040
RS & RO : Nothing
Caracteristics : 300 (first) 200 (2nd) and 000 (3rd)

I opened my Hexeditor and searched for E0 (three instances) and changed the 40 into a 20.
SI breaked at startup where it encrypts +/- 350 (i don't remeber that well) bytes into 00401100.

then the
push 00401100
ret

I quickly found out that this jumptable in the first call was more or less unimportant.. oh well, I haven't even had much looking at it *hehehe* I didn't want to confuse myself too much for the beginning.

So, I enetered this call and F12'd until I came up to a push 00400000 and a ret... Here's where my action started... After a two more of these push - rets .. I came to a place copying always just 1 byte into 00401500... So after a few of these loops I bmp'd on that adress a little further... Althogether it copies 12 bytes there... which it calls right after this:
(I still have noted these values down)
33 C0 B4 44 CD 68 66 3D 30 13 C3 (the 13 may be a 12.. erm my handwriting)
And this translates to this after the call:
xor ax,ax
mov ah,44h
int 68
cmp ax,4300
ret

Froggy told me this :)
=> Re-move
** SOFTICE DETECTION ** code 07, at 018F:004011A2
Interrupt:68h >eax=00004300h ebx=00000000h ecx=00000000h
edx=00000000h esi=00401430h edi=00401430h ebp=00E2FF78h

[but that's not the only one - I don't tell all *g*]
[and I don't know if this is only some cracker confusion code... If I see an Int - I patch it black and blue - this is habit not thinking]

Later on, I passed this cmp byte ptr [xßx],CC thing which checked quite a big bunch of bytes for "int3" - I passed this one by reseting ecx which was used as a counter...

Here my memory gets vague... I don't think much happened, but suddenly I was in a loop copying always the same bytes it was in a few bytes below itself and then executing itself again until esi was a specific number... Somehow I didn't dare to fiddle with this one as I was sick being on the push "Hmmm..." so I bravely executed it using F10 and F8.

After the conditions were met, (I guess I could have saved me all this work, but I didn't trust him... I bet he would have been so mean, going to a "One little problem" if I changed his esi to early *g* ) I was already at the push "Congratulations" message.

I tried you method now.. but I still have no clue how in this world you could have used a PE-Editor making this...

My Re-Move me has just 5 bytes patched inside... :) for the other ones I would need to get back inside SI *g*

Woopy,
Jimmy
Clandestiny
05-04-2001, 10:23 PM
Hi Again Jimmy,

Thought you might be interested in comparing notes...

This is bizarre. After unzipping the CoDeCrk18.zip, I opened it up in the PE Editor of ProcDump. The version I'm using is 1.6.2 , btw and there were no problems opening it. Here's what I got...and dare I say its quite a bit better than what you reported for your PE ;)

Before Any Corrections:

Section Names
none

Virtual Size
2000
400
400

Virtual Offset
1000
F000
0

Raw Size
2000
1000
1000

Raw Offset
300
200
0

Characteristics
E0000040
E0000040
E0000040

After changing the characteristics of the first section to E0000020 (executable code, read, write) and applying the changes to the entire PE file I have:

Section Names:
none

Virtual Size
2000
400
400

Virtual Offset
7000
F000
0

Relative Size
330
400
400

Relative Offset
1000
2000
3000

Characteristics
E0000020
E0000040
E0000040

Amazingly, it was cracked after this !!!

From there I loaded it up in the SICE loader, traced it through a couple of times and determined that the first section (335 bytes) was being decrypted in that LOOP. From there I could see that the results of the decryption determined which MessageBox would be shown and then realized that the final sum contained in eax must be dependent on the section characteristics flag. Didn't exactly do a whole lot as you can see ;-)

As for anti-sice, I had IceDump protection loaded so possibly that could account for my lack of anti-debugger problems ???

It'll be interesting to see what CodeInside has to say about our header problems - or lack thereof - ;)

I think I'll trace a little further tomorrow and see if I can locate a few of the scenic landmarks like that int 68 I missed out on today ;). For now though I'm off to the sleepy Land of Nod :)

Hey did you ever consider the possiblity that the header might have got corrupted in the download ?

Cheers,
Clandestiny
CoDe_InSiDe
05-05-2001, 01:07 AM
Hi Clandestiny & JimmyCliff,

HAHAHAHA :D

Now that's some awesome Solution ;)
Did it really work???
Hmm... so it's a little bit too easy, eh? ;)
I don't know what to say about this, but it's damn funny :D

Btw, have you seen some other protections then those "int xx" ??? ;)

Cya...

CoDe_InSiDe
JimmyClif
05-05-2001, 05:20 AM
Clandestiny:
I just thought I upload a pic of my PE-Header *g* Repairing the PE as you have it there just seems to crash Re-Move at my machine.

Code-Inside:
Quote : have you seen some other protections then those "int xx"

You mean inside Re-Move? Nope, that all I've seen and then I got the Congrats message.
I was wondering nonetheless about that cmp,4300 because the "Z"-Flag got set but then the return?

Besides the cmp byte ptr [iueoa],CC which never got me out of this loop without showing the "Bad Boy" MessageBox (even when no breakpoint was set) there was nothing :(

-----
So.. I'd really want to do it the "Clandestine-way"... how come our PE headers differ that much???
-----
CoDe_InSiDe
05-05-2001, 10:40 AM
Hi Clandestiny,

Hmm.. i tried it a little bit about what you said with the PE header, but no luck :)
Please send the working .exe to my Email :)
Thx.

Cya...

CoDe_InSiDe
beierno
05-05-2001, 11:14 AM
hmmm activating frogsice, run the crackme twice and the success msgbox appears. That is going to be a very short tutorial :)
At least it indicates what have to be patched.

I like stepping though the code and see how much effort code_inside has put into making stepping a nightmare, especially the JMP section. OK after a while it gets boring. It took me some time to make a working deadlisting and to break on program entry.
CoDe_InSiDe
05-05-2001, 01:27 PM
Hi Guys,

"hmmm activating frogsice, run the crackme twice and the success msgbox appears."

Hmm.. some weird kind of solutions do you all have ;)
If i try that with FrogsICE it doesn't work, the Bad Message Box pops up and a beep follows :)

Cya...

CoDe_InSiDe

P.S. nice isn't it, that JMP Section ;)
Clandestiny
05-05-2001, 01:49 PM
CoDe_InSiDe (05-04-2001 15:07):
HAHAHAHA :D

Now that's some awesome Solution ;)
Did it really work???
Hmm... so it's a little bit too easy, eh? ;)
I don't know what to say about this, but it's damn funny :D
CoDe_InSiDe

Hehe... I'm glad you're getting a laugh out of my solution ;-) Too easy ? Heh, yeah thats what I thought...BUT I swear it works. I'll tell ya, it was downright unbelievable to me too... Trust me, I tried it on 3 different copies of the unzipped file before posting the solution !!! Tried it on another one this morning and it still works :D I don't know what to say either except to assure you for what its worth that I would not post something that I 'd not tested first.

1) Patched a working .exe 4 times now
2) Anti Sice tricks are certainly present since I did find the INT 68 Jimmy mentioned when I did a back trace. Also, going back to the unfixed copy, I realized that SICE loader will not break at the entry point unless ICE DUMP's protection is loaded so there is definately anit-sice code. Works fine once ICE DUMP is loaded though and there are absolutely no other ill effects for my fixed .exe since the fixed .exe works perfectly regardless of the anti-sice code. As they say "if it ain't broke, don't fix it"...LOL
3) I redownloaded the file from CodeInside's site and unzipped it again with the exact same results - this makes the 5th working .exe
4) As a *very* wild guess I theorized that my PE was somehow getting fixed in the extraction process since I'm using WinRar and it has some file repair capabilites (in spite of the fact I was just performing a plain unzip). Well, to be thorough and test out all possiblies I d/l a simple little unzip program from a shareware site and extracted it using that. The PE header was unchanged. A long shot I know ;)

So I guess my question is : Is the PE header supposed to look like what Jimmy got ? Mine simply doesn't, plain and simple...

I suppose the best I can do to prove it is to send a before / after picture from the PE header like Jimmy did and then send the working .exe. I suppose the joke will really be on me if this only works on my machine ;)

So check your mail CoDe_InSiDe and Jimmy. You'll find 3 attachments...

1) Before picture of the PE header (jpg)
2) After picture of the PE header (jpg)
3) The working .exe

BTW, Code_Inside I stepped through the code some more and I want to congratulate you on a job well done for the obsfucation. Those useless jmp loops make tracing terrible :-)

Regards,
Clandestiny
JimmyClif
05-05-2001, 02:58 PM
Useless jump loops *gulps* No, just kidding... I had a quick look but never done them... I
F12'd just thru *g*

But I got a question too now:

- What's the point? (Not that I'm getting pissed off)

but what's the point, telling me after a hard trace - Congratulations when the real answer is
supposed to be something different ? I received Clandestiny's version... and it says what I
guess to be the real answer for it !

So, I'm kinda confused... two possible solutions ? Or did I just do sthg never expected ?
I'd love to know :D

I think I go download Procdump again... maybe that's the key to the mistery here...

Anyway... it's the strangest CrackMe I've seen so far :) ...

Regards,
JClif

PS: And I've tried this FrogIce thing - doesn't work.. maybe I should just reformat again...
(My Windows folder is dated 17.07.00) *g*
CoDe_InSiDe
05-05-2001, 03:44 PM
Hi Clandestiny & JimmyCliff,

Hmm... now i've tried to change the PE Header exactly as it was shown on the picture (from ProcDump) and now i got a Message Box :)
It shows:

Title: You did it...
Caption: it...

That's not completely correct ;)
But it shows an Message Box, hehe pretty weird.
I traced it and in the beginning it just Encrypts stuff, but the Checksum fails and then it's supposed to show the incorrect Message Box, but because the Sections are now different mapped in space, it shows part of the Good Message Box :) hehe...
(If i didn't put that Checksum in there then you were not yet finished ;-) )

"but what's the point, telling me after a hard trace - Congratulations when the real answer is
supposed to be something different ?"

Hmm... I'm sorry JimmyCliff but i don't get your question :)
What do you exactly mean with "something different" ?
The goal of this CrackMe is to get to the Congratulations Message Box :)
And that Message Box is supposed to show:

Title: Congratulations !!!
Caption: You made it :) now write a Tutorial on how you did it...

Cya...

CoDe_InSiDe

P.S. Clandestiny, i haven't recieved any Email from you :)
JimmyClif
05-05-2001, 03:57 PM
Erm.,..

Oops... I strated thinking Clandestiny's answer "You did it" was the good one ;) and I'd just been on an rather long and brutal cracker joke tracing this ;)

/me blushes
stillnewbie
05-05-2001, 09:02 PM
CoDe_InSiDe (05-05-2001 05:44):
Hi Clandestiny & JimmyCliff,

Hmm... now i've tried to change the PE Header exactly as it was shown on the picture (from ProcDump) and now i got a Message Box :)
It shows:

Title: You did it...
Caption: it...

That's not completely correct ;)
But it shows an Message Box, hehe pretty weird.
I traced it and in the beginning it just Encrypts stuff, but the Checksum fails and then it's supposed to show the incorrect Message Box, but because the Sections are now different mapped in space, it shows part of the Good Message Box :) hehe...
(If i didn't put that Checksum in there then you were not yet finished ;-) )

"but what's the point, telling me after a hard trace - Congratulations when the real answer is
supposed to be something different ?"

Hmm... I'm sorry JimmyCliff but i don't get your question :)
What do you exactly mean with "something different" ?
The goal of this CrackMe is to get to the Congratulations Message Box :)
And that Message Box is supposed to show:

Title: Congratulations !!!
Caption: You made it :) now write a Tutorial on how you did it...

Cya...

CoDe_InSiDe

P.S. Clandestiny, i haven't recieved any Email from you :)

Hi CoDe_InSiDe,JimmyClif,Clandestiny,

Btw Clandestiny,whats your OS anyway ?
regards
stillnewbie
stillnewbie
05-05-2001, 09:11 PM
[quote]CoDe_InSiDe (05-05-2001 05:44):
Hi CoDe,JimmyCliff,Clandestiny

Btw Clandestiny,
what Os are you using?

regards
stillnewbie
stillnewbie
05-05-2001, 09:21 PM
[quote]CoDe_InSiDe (05-05-2001 05:44):
Hi Clandestiny,

what OS are you using ?
Btw hi CoDe :)
regards
stillnewbie
Clandestiny
05-05-2001, 09:50 PM
Hi CodeInside & Jimmy,

Somehow I had this feeling my little solution was too good to be true ;) Now that you tell us what the MessageBox *should* say, I can see your point. Heh, its actually pretty funny that it almost worked... Fails the CRC and then goes on to execute part of the "good guy" message due to the way the section mapping has been changed... I'd be laughing if I wasn't contemplating tracing through that code again ;) ...I'm sorely tempted adjust the string pointers a bit and call it quits, but I suppose that would be cheating, eh ? ;-)

Hey Jimmy... Good Job :) Looks like that hard trace paid off after all... screwy header and all!

Cheers,
Clandestiny
Clandestiny
05-05-2001, 09:57 PM
To Still Newbie:

I'm running Win 98 Second Edition since you're curious :-)

Cheers,
Clandestiny
JimmyClif
05-06-2001, 05:52 AM
Hey Clandestiny,

I'm sorry ;P ... but I really believed at some point that your answer was the correct one...
and I just made a fool out of myself tracing all this...

Imagine the real answer would have ben yours and the trace in itself would have been just
unimportant code... *hehehe*

Ah.. before I forget, the answer is Procdump... Procdump is the only PE-Editor I have
showing me the PE Headers as they should be... Why do they other fail tho ?

I'm running Win98SE too... (WinME crashes too often *g*)
Cheers -J-
stillnewbie
05-06-2001, 07:01 AM
Hi Clandestiny ,
what is your OS anyway :)

stillnewbie
stillnewbie
05-06-2001, 08:40 AM
Hi Clandestiny,

Btw what is the version of your OS?

regards
stillnewbie
NeO'X'QuiCk
05-06-2001, 05:57 PM
Hello!I also downloaded code crackme!And i tryied doing the same as Clandestiny did but it fucked up exe!I got ErroR shut down!

I dont know if code fix the last one!But that what i got the Peheader is the same as in Clandestiny case i also did find any anti!

Bye NeO
NeO'X'QuiCk
05-06-2001, 06:34 PM
Hello i tryied the Clandestiny solution of fixing the peheader but it did give me any solution!SO what i di i used Rebiuld Pe in procdump!That did the job only problem is that you dont see the whole congra.. message!!heh And also made the file much much bigger then it was before but it changed the box!!Like it shoulD!

But that shouldnt be the solution as i know Code he change evething in pe so the result is make pe working!

NeO'X'QuiCk
stillnewbie
05-07-2001, 03:40 AM
Sorry about the several post above :/
Hi Clandestiny,
I was curious about the Os cuz I'm using
win98 but not SE.it has anti-debugging
as JimmyClif as stated.I'm not doubt about
your unpacking skills btw :).NeoXquick has also mention about Pe builder but he's right
too.
AnyWay cheers :))))
cya
stillnewbie
Kayaker
05-07-2001, 04:34 AM
Hi,

Hmmm, I've got little comment on this (yet) except that the good-boy MessageBox params are pushed here

:004012D6 6886124000 PUSH 00401286 ;Congratulations
:004012DB 689A124000 PUSH 0040129A ;You made it blah blah...
:004012E0 E9D7FEFFFF JMP 004011BC

and the jmp is back into the main bad-boy MessageBox call

:004011BC 6A00 PUSH 00
:004011BE FF1544004F00 CALL [USER32!MessageBoxA]

Even in the repeating SMC code at 4011A0, where you can set a bpm and check out 20 or so different code snippets, I can't see where you can remove any checks which will reach the above code.

That is the rules right, no patching allowed? I interpret this as either no traditional direct patching allowed, i.e. don't change a jmp to jump to 4012D6. Or, some type of patching is allowed of code which might change the result of a check or produce altered SMC. For example, I could probably alter the code so one of the SMC snippets produced at 4011A0 caused a jump to the good message, but this would still be "cheating", right? Or finally, I can only interpret the rules as to mean NO patching of any kind, but altering the file in some other way, such as changing the PE header IS allowed.

I'm just trying to clarify things towards a valid solution. I'm a little confused by the seemingly erratic behaviour of this crackme on different systems, for example why Clandestiny can get one result by changing the code characteristics, but no one else can.

...continued...
Kayaker
05-07-2001, 04:35 AM
In any case, I was more interested in why PEditor doesn't generate valid section information while Procdump does. My guess was that Procdump was simply a bit more sophisticated and used other clues as to the PE Header structure, while PEditor was "expecting" a certain format, which this crackme certainly doesn't have ;)

I found this out. The first odd thing about the file format is that it's missing the DOS Stub, which is that little section just before the PE header that usually says something like "This program cannot be run in DOS mode". Not a problem, it's sort of like your appendix, a PE file can live without it. Normally a PE file uses the final field in the DOS MZ Header, e_lfanew, which is an offset into the file where the PE File header is located. This offset is at byte 3C and points to 48h. This is where part of the problem with PEditor recognizing this crackme lies.

File Header

00000048 5045 0000 4C01 0300 0000 0000 0000 0000 PE..L...........
00000058 0000 0000 F000 0F01 ........

Notice the value at 5C, 00F0. This is the SizeOfOptionalHeader. A normal Optional header is supposed to be 224 or E0h bytes, not F0h bytes. Aha, something's afoot! Immediately following the Optional header is the Section header, which is where the Name, Virtual/Raw Offset and Size, Code Characteristics, and a couple of other bits of info are kept for each section. This is what's screwed up in PEditor.

If you select a block of E0 bytes (the proper size of an Optional header) starting immediately after the File header at byte 5C, you see there's 10 extra bytes of 0's which shouldn't be there. This is where PEditor thinks it should start processing the Section header, so it reads it wrong. Procdump must be smart (dumb?) enough to use the (wrong) SizeOfOptionalHeader field value of F0 as an offset and by dumb luck reads the Section header correctly.

So you can delete these 10 bytes, change the SizeOfOptionalHeader to the correct value of E0, and replace the 10 bytes *after* the Section header, but before the 1st section starts at byte 200. PEditor will now read the file correctly. You probably don't want to actually use PEditor to make any changes to the file anyway because it has this annoying habit of inserting 60 bytes of "advertising" which will overwrite the start of the 1st section in this crackme. So this is a good opportunity to learn a bit about manually editing the PE header. Also a good opportunity to reverse Yoda's truly wonderful PEditor tool so it doesn't insert its logo/web address in a file. (Hey, could this be catagorized as Adware? :)

There's lots of little things you can play with with this crackme. The Image size of 7F1000 can be changed to the correct size of 0F1000 with no ill effect. The OEP can be changed to 401090 since the opening code is duplicated here anyway after the decryption process.

What was the point of this crackme again? ^_^

Kayaker
JimmyClif
05-07-2001, 05:09 AM
*hehehe* Kayaker :D ,

I assume the point we took out of it is to learn a little bit more of a PE-Header than before...

I see the rules as patching is allowed.. but the simple way of jumping immediately to the good-boy push is forbidden... I just see it as a search and destroy obstacle chase...

Like an "huh, I need that ecx to be 1 and not 330 so that it gets out of the loop faster... and in case the loop turned out wrong I need the jnz to be always true so that I can go on for the next obstacle"

Only thing wich really kills my nerves is the adding 1F to every opcode... before patching.. My hp-calculator is in lack of batteries and using calc.exe 'erm' s*cks.

So, I was thinking on ripping out his crypted code, writing a little utility to sub 1F from every byte and saving it... This way it will be readable in hiew... (Maybe even print out ? +/- 350 bytes isn't that much... )

Well, thanks for the PE~Crash course ;)

JimmyClif
CoDe_InSiDe
05-07-2001, 08:12 AM
Hi guys,

HAHAHA Kayaker ;)

Well it's indeed what JimmyCliff said:

Patching is allowed (This CrackMe is meant to be Patched ;)) but not a direct Patch (I mean a Jump straight to the Good Message Box).
Just play with it as long as you want hehe ;) (And solve it)...

Cya...

CoDe_InSiDe

P.S. i allready got a Solution to this CrackMe in my mail ;)
JimmyClif
05-07-2001, 01:32 PM
Code Inside... here's you solution... somehow my mail box doesn't work...

I know the tut has been brutally nasty written but it's enough to follow...

Hey guys... this is not for anyone else then CodeInside - please don't cheat!

JimmyC
CoDe_InSiDe
05-07-2001, 03:21 PM
Hi JimmyCliff,

Whoah what kind of language is that? ;)
Uhm i can't read it now, dunno what language it is, but thx anyway ;)

Cya...

CoDe_InSiDe
JimmyClif
05-07-2001, 03:24 PM
LOL :D
CoDe_InSiDe
05-07-2001, 03:24 PM
Hi JimmyCliff,

Sorry i'm dumb now i see ;D Thx...

Cya...

CoDe_InSiDe
CoDe_InSiDe
05-07-2001, 03:25 PM
Hi JimmyCliff,

Sorry i'm dumb now i see ;D Thx...

Cya...

CoDe_InSiDe
Kayaker
05-11-2001, 12:37 AM
LOL, that's funny Jimmy Cliff!

Hey, I say this projects not dead yet. JC had to tell me about it, but he encrypted his last post attachment. Howzabout patching Code_Insides crackme to decrypt and write a copy of Jimmy Cliffs attachment?

This would be a good opportunity to work on an inline patch. I figure you can use the MessageBox itself as the trigger to call your patch code. There's plenty of empty bytes in the file to place a patch. You can just redirect the jump after the MessageBox to your patch before it calls ExitProcess, decrypt and write the file, then jump back to program code. You can either Read the file or Map it and make the changes.

For Reading a file you'll need to study up on the usage of CreateFileA and ReadFile. To Map it you'll need CreateFileA, CreateFileMapping, MapViewOfFile, then call your patch, then UnmapViewOfFile and CloseHandle to close the mapping.

Just a thought for anyone wanting a bit of a new challenge. That, plus the wisdom of a quote after you've succeeded ;)

('course you can just make a stand-alone proggy to decrypt it as well which, lame-ass that I am, is what I did :)

Regards,
Kayaker
CoDe_InSiDe
05-11-2001, 01:26 AM
Hi Kayaker,

Hehe you Lame-Ass ;)

But maybe it's a nice thing yes, we'll see if anyone will do it ;)

Cya...

CoDe_InSiDe
JimmyClif
05-12-2001, 04:56 PM
Well, I'd give it a go... even tho that I know coding one would be faster... actually I even
started but I stopped when I realized that his exe wasn't his exe anymore... at the point
where I landed ;) I even had my handles and Flags section already *grin*

I'm, willing to start anew... but only if CodeInside is willing to teach :P

So, CodeInside... it's up to you.. let's assume you finished your CrackMe called Re-Move and
suddenly you realize that you forgot to insert a call to CreateFile...

(well, I'm prepared for some mindbreaking PE juggling)
JimmyClif *bg*
Clandestiny
05-12-2001, 06:53 PM
Hi CodeInside, Jimmy, Kayaker

hehehe :D that was really funny Jimmy ...

Kayaker (05-10-2001 14:37):
('course you can just make a stand-alone proggy to decrypt it as well which, lame-ass that I am, is what I did :)

And you Kayaker... shame on you for laziness ;)

As for me, I'm willing to give Kayaker's suggestion a try, but I'm going to need some help w/ the PE juggling since I am only a beginner to unpacking :-)

Writing the actual patch should be pretty easy, but unpacking this thing to get a working decrypted, disassemblable .exe that I can insert my patch into seems like its going to be quite a challenge. Perhaps one of the unpacking gurus around here will be so kind as to put me on the right track. I'll tell you what I've tried so far... I think I'm loosing sight of the forest for the trees since I've never tried to completely manually unpack and .exe section by section and then "glue" them all together again.

First off is the decryption routine which appears to be decrypting the first section of the PE:

017F:004F0090 BE00114000 MOV ESI,00401100 //program entry point
017F:004F0095 8BFE MOV EDI,ESI
017F:004F0097 33C0 XOR EAX,EAX
017F:004F0099 B930030000 MOV ECX,00000330
017F:004F009E 33DB XOR EBX,EBX //clear ebx
017F:004F00A0 33D2 XOR EDX,EDX //clear edx
017F:004F00A2 AC LODSB
017F:004F00A3 01C3 ADD EBX,EAX
017F:004F00A5 2C1F SUB AL,1F
017F:004F00A7 01C2 ADD EDX,EAX
017F:004F00A9 AA STOSB
017F:004F00AA E2F6 LOOP 004F00A2 //decryption loop
017F:004F00AC 2BDA SUB EBX,EDX
017F:004F00AE 93 XCHG EAX,EBX
017F:004F00AF 3DD01B0000 CMP EAX,00001BD0
017F:004F00B4 7506 JNZ 004F00BC
017F:004F00B6 6800114000 PUSH 00401100
017F:004F00BB C3 RET

Now after decryption is complete, I put the proggy in an infinite loop and go to Proc Dump where it is my intention to dump it. Alas the full dump doesn't work so I opt to dump it section by section and then "glue" it all back together.

...continued
Clandestiny
05-12-2001, 06:54 PM
...continued

In order to dump it I began each dump at the Image Base + Virtual Offset for each section and dumped a number of bytes corresponding to the Virtual Size.

Now I have 3 dumped sections sitting on my HD . Going to paste them together, I pasted in my 3rd dumped section which appears to be the PE header (with some problems). Following the header, I paste in the other 2 sections.

At this point, I realize that I need to fix entry point as well as the Raw Size and Raw Offset and of these sections... so I go try to load it up in Proc Dump again (crossing my fingers and toes) that it will recoginize my butchery of this PE file. Well, no such luck...

Looking at my dumped PE header... I can see it looks rather strange... ie. there is no DOS MZ header at all. Strangely, the original crypted file had an MZ header when opened up in a hex editor. So as a long shot I transplant the MZ header from the original file into my new glued together PE.

Now ProcDump actually opens it and I proceed to adjust Raw Sizes and Raw Offsets in my new .exe.

Finishing the task, I crossed my fingers and toes again, hoping (but not really thinking) it'd run for me. Well needless to say I wasn't much surprised when it didn't. In fact it greeted me with a nice friendly Invalid Page Fault :(

And here I am, not too sure at all about wtf I'm doing ??? as its the very first time I'm trying to piece together a PE all the way from scratch. Hopefully, at least a part of my above ramblings will make enough sense for someone to tell me if I'm on the right track (or not as the case may be).

Regards :-)
Clandestiny
JimmyClif
05-12-2001, 08:06 PM
Clandestiny,

To be honest... I'm lazy... The easiest method of getting this executable into something that
would be readable... or get close to an diassembled listing is:

To break at startup. F12 to the pushad. And dump 330 bytes of it.
Then you grab your hex editor and copy those bytes over the last 330 bytes.
So.. running it will fail as it tries to decrypt the already decrypted ones.. so to run it just nop
out his sub eax,1F and his jne... Alright, this is enough for Hiew...

Now to get this into Wdasm (IDA seems to be a little bit more sensitive here) is to take a
valid PE Header from an executable and paste all his code (starting from Offset 290) into the
code section of the valid PE-Header overwriting the old one ;)

This disassembles but won't make it run... because all adresses are relative to the copy process he does.. and rewriting those .. Pfuhh... I won't go there ;)

I just went half way and did the /dump copy-paste thing to be able to work my way around in Hiew...

Regards,
Jimmy
Kayaker
05-13-2001, 03:20 AM
Hiyas,

Dump individual sections? Crazy Glue them together? White-Out code? Man, I MUST be a lazy-ass. I just raw dumped it after returning from the decryption process at 401100. You don't need to dump the whole 7F1000 size of the image as listed, 0F1000 works just as well. You could also get away with less since the code at the OEP of 4F0090 is repeated at 401090, but this just complicates fixing up the PE header.

With packed files I usually do a raw /DUMP with Icedump. Since this is an image dump of the file in memory, the Raw Size and Offset now need to be changed to the values of the Virtual Size and Offset. You can use the Dumpfixer option of PEditor 1.7 to do this. As I mentioned before, PEditor kind of overwrites a bit of what *used* to be code at offset 200h in the file, but after the raw dump and fix up, the real code now starts at 1000h and this earlier stuff is never used anyway.

I like doing raw dumps rather than using Procdump or Icedump's /pedump because WYSIWYG. An address in SoftIce or W32Dasm is the same as in a hexeditor. Really helps to find sections or the IAT or whatever.

So I dumped the file at 401100 with
/DUMP F1000 C:\filename.exe

This gave a working exe, but unrecognizable with WDasm. Then I fixed up the Optional header as I mentioned before, which screwed up PEditor (and WDasm) from interpreting the Section header properly. There's 10 bytes too many in the Optional header. Remove 10 bytes from 130h and insert them at 1E0h, then change the SizeOfOptionalHeader at 5Ch from F0 to E0.

That should give a file which can be disassembled. You get some screwy MessageBox text though because the 330 bytes are decrypted twice now, which includes the MessageBox strings at 4011C6 and 4011CD. So you can change the OEP to completely bypass the decryption routine and point it to elsewhere in the code, like 401100.

This should be OK for patching purposes. There's still some trimming which could be done of the F1000 file size, there's actually 3 Import tables, so you could point to the 1st one and delete some bytes. But that's just messing around.

...continued...
Kayaker
05-13-2001, 03:22 AM
Here's my PE header (and we'll see if PRE formatting works):

<PRE>
00000040 B44C CD21 0000 0000 5045 0000 4C01 0300 .L.!....PE..L...
00000050 0000 0000 0000 0000 0000 0000 E000 0F01 ................
00000060 0B01 050C 0010 0000 0010 0000 0000 0000 ................
00000070 0011 0000 0010 0000 0010 0000 0000 4000 ..............@.
00000080 0010 0000 0010 0000 0400 0000 0000 0000 ................
00000090 0400 0000 0000 0000 0010 0F00 0004 0000 ................
000000A0 0000 0000 0200 0000 0000 1000 0010 0000 ................
000000B0 0000 1000 0010 0000 0000 0000 1000 0000 ................
000000C0 0000 0000 0000 0000 0000 0F00 3400 0000 ............4...
000000D0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000E0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000000F0 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000100 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000110 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000120 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000130 0000 0000 0000 0000 0000 0000 0000 0000 ................
00000140 2E74 6578 7400 0000 0020 0000 0010 0000 .text.... ......
00000150 0020 0000 0010 0000 0000 0000 0000 0000 . ..............
00000160 0000 0000 4000 00E0 2E69 6461 7461 0000 ....@....idata..
00000170 0004 0000 0000 0F00 0004 0000 0000 0F00 ................
00000180 0000 0000 0000 0000 0000 0000 4000 00C0 ............@...
00000190 2E77 7466 0000 0000 0004 0000 0000 0000 .wtf............
000001A0 0004 0000 0000 0000 0000 0000 0000 0000 ................
000001B0 0000 0000 4000 00C0 ....@...
</PRE>

SizeOfImage = F1000
OEP = 401100
.text VS = RS = 2000; VO = RO = 1000; Char=E0000040
.idata VS = RS = 400; VO = RO = F0000; Char=C0000040
.wtf VS = RS = 400; VO = RO = 0; Char=C0000040

I find the BEST util for learning about PE headers is PEBrowse Pro (h**p://www.smidgeonsoft.com/). Also comes in an interactive debug version, both freeware. Just start scoping out notepad and you'll quickly learn where everything is.

There's also a good summary by FatBoyJoe listing what each of the fields in the PE Header are as offsets within each section at
http://www.immortaldescendants.org./database/essays/fboyjoe/exe_hdr.html

Hope this helps confuse things a bit ;)

Kayaker
Clandestiny
05-14-2001, 01:41 PM
Thanks Jimmy and Kayaker for your help :)

Jimmy: I really liked your practical mindset about just pasting in the decrypted code... ;)

Kayaker: A very educational explanation (and works much better than my butchered attempt at gluing sections). Thanks. We couldn't pay you enough for all of your kind help ;-)

Regards,
Clandestiny
Clandestiny
05-14-2001, 09:23 PM
Yup, its me again ;)

What a PE nightmare this has been... And its just got worse ! Of course on the bright side, this means I'm learning lot ;)

Man, I thought I was home free after getting a working dump of this proggy. After all, there's plenty of room to insert my inline patch...

BUT, I sorta took the ability to add new API's to the import table for granted. Firing up IDD King to insert my new functions led me to a most unwelcome surprise. Apparently, there is not any room to insert new imports and I checked all 3 of the tables that Kayaker mentioned.

I suppose this means adding some empty space at the end of the current import table. Before I try this though, I just want to confirm that its necessary and that I'm not overlooking the obvious...

Clandestiny
Kayaker
05-20-2001, 09:06 PM
OK, now I'm flummoxed. I finally rebuilt a logical PE file out of this s***, and suddenly I get the Congratulations message (but only if I don't set certain breakpoints, some are OK, some aren't). My hat's off to you Code_Inside, you turned this PE file inside out, chewed it up, and spat out... something.

I started by trying to answer Clandestiny's question about IIDKing. The *reason* it can't insert another section in the PE Header is because there's not enough empty bytes after the Section header, either because of the original code, or because of the advert crap PEditor 1.7 puts in there if you used it. If you made a raw image dump, then the real code begins at 1000h, so you can fill that whole section from the end of the Section header around 1B8h to 1000h with 0's. IIDKing will now be able to insert a new section.

I found a problem with this anyway because the image file extends to 4F1000, and IIDKing wipes out most of it because I guess it doesn't really recognize the still screwed up PE header. Well, I could see that all of the code was between 1000h and 1430h, and I was getting fed up with this F1000h file size (964KB), so I decided to create a "proper" PE file.

I deleted everything from 2000h onwards, this left me with just a .text section from 1000h to 2000h. Then I rebuilt my own .idata section of the 3 API's at 2000h. I used the existing one as a template, and just changed the IMAGE_IMPORT_DESCRIPTOR pointers and the IAT pointers. While messing with getting the file to run, I finally realized what that 3rd section, the one I called .wtf, really is! This is the one in the original file that has a Raw and Virtual Offset of 0000000. Very peculiar this. Turns out this is actually the PE header, beginning at the ImageBase Virtual Address of 400000. This section seems necessary to map the PE header into memory so part of it can be overwritten at:

:00401107 BE20114000 mov esi, 00401120
:0040110C BF00004000 mov edi, 00400000
:00401111 F3 repz
:00401112 A4 movsb

and elsewhere. If the 400000 address is not mapped properly, the repz/movsb code crashes. Anyway, that was interesting, I kept wondering why I couldn't delete that .wtf section. (Which is why I called it .wtf ;)

To continue, I realized that the original Import Table, at F0000, is **required** to be mapped there, because the SMC code at 4011A0 at one point calls GetTickCount, and it's looking for it in this memory range. But, I didn't want a raw file this big, so I discarded my rebuilt IT and copied the original Import table, including the IAT, (i.e. from F0000h to F0090h in the dumped file, or 200h to 290h in the original file) and inserted it in a new .idata section at 2000h. Then I set the Virtual Offset to be F0000 so it would be mapped where it was expected to be.

So my final Section header looks like:

.text VSize=2000, VOff=1000, RSize=1000, ROff=1000, Char=E0000020
.idata VSize=1000, VOff=F0000, RSize=1000, ROff=2000, Char=C0000040
.wtf VSize=400, VOff=0000, RSize=400, ROff=0000, Char=C0000040

SizeOfImage=F1000
OEP=401100

*note- raw size of .text can be 1000h (minimum 430h), but virtual size *must* be 2000 (or somewhere in there) because this memory, even though it only contains 0's, is read/written to at some point and must be mapped to prevent a crash.

Not sure where the checks are, but this rebuilt file seems to call the Goodboy message box. IIDKing also seems to be able to insert API's properly now. I inserted 10 new API's:

CreateFileA, ReadFile, WriteFile if I wanted to read JimmyClif's encrypted file into memory to decrypt it.

CreateFileA, CreateFileMapping, MapViewOfFile, UnmapViewOfFile, CloseHandle if I wanted to map it into memory.

LoadLibraryA, GetProcAddress, FreeLibraryA if I wanted to call my own dll to do the dirty work.

Kayaker


Harlequins Task 3 Challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Harlequins Task 3 Challenge
PDA

View Full Version : Harlequins Task 3 Challenge

Kayaker
05-21-2001, 12:11 AM
Hi All,

Mitrix posted a question on one of the tasks in Harlequin's course. After looking at it I thought it was so good that I thought it'd make a great Project. Since it's actually the final task of a section and I think the course should be started from the beginning without giving away the answers to the previous task, I deleted the original link Mitrix had posted and will just post the download link for Task 2/3:

http://htasks.cjb.net/fx23ht.zip

In case of difficulties (I couldn't d/l it with Opera), I'll attach it here (11KB zip)

Here is what Harlequin says about this task:

"I should warn you here though, this is the last Task in this section and as such is therefore the most difficult. Some may struggle with this one a little. I can only assure you that in the CodeWoods things are not always as they seem, there is (despite everything you may think) a solution to this task and, if you have made it this far you have more than the skills required to complete it successfully."

The rest is self-explanatory, find the correct serial number. I've posted Mitrix's original post and my reply.

I encourage you to try the complete course, which begins at:

http://www.angelcities.com/members/harlequin/

Good Luck,
Kayaker
Kayaker
05-21-2001, 12:12 AM
ORIGINAL POST (slightly modified):

In the program the DD [0040209F] is 00401124 and the [00401124] is E8. I think it should be EB.

:00401124 E8B5000000 Call 004011DE
:00401129 83F80A cmp eax, 0000000A
:0040112C 757B jne 004011A9
:0040112E BAA7204000 mov edx, 004020A7
:00401133 33DB xor ebx, ebx \
:00401135 8A1A mov bl, byte ptr [edx] |
:00401137 42 inc edx |
:00401138 33C0 xor eax, eax \the first serials must 4
:0040113A 8B0D9F204000 mov ecx, dword ptr [0040209F] /
:00401140 8A01 mov al, byte ptr [ecx] |
:00401142 80F3DC xor bl, DC |
:00401145 3AD8 cmp bl, al /
:00401147 7560 jne 004011A9
:00401149 8A02 mov al, byte ptr [edx]
:0040114B 42 inc edx
:0040114C 3430 xor al, 30
:0040114E C1E008 shl eax, 08
:00401151 8A02 mov al, byte ptr [edx]
:00401153 42 inc edx
:00401154 3430 xor al, 30
:00401156 C0E004 shl al, 04
:00401159 66C1E804 shr ax, 04
:0040115D 8A1A mov bl, byte ptr [edx]
:0040115F 42 inc edx
:00401160 2AC3 sub al, bl
:00401162 3C3C cmp al, 3C
:00401164 7543 jne 004011A9
:00401166 B104 mov cl, 04
* Referenced by a (U)nconditional or ©onditional Jump at Address:
|:00401178©
|
:00401168 8A02 mov al, byte ptr [edx]
:0040116A 42 inc edx
:0040116B 3433 xor al, 33
:0040116D 2C03 sub al, 03
:0040116F 3AC1 cmp al, cl
:00401171 7536 jne 004011A9
:00401173 FEC9 dec cl
:00401175 80F900 cmp cl, 00
:00401178 75EE jne 00401168
:0040117A 668B02 mov ax, word ptr [edx]
:0040117D 663D3033 cmp ax, 3330
:00401181 7526 jne 004011A9
:00401183 A0A7204000 mov al, byte ptr [004020A7]
:00401188 3C37 cmp al, 37 ; the first serials must 7
:0040118A 751D jne 004011A9
:0040118C 6A00 push 00000000
Kayaker
05-21-2001, 12:14 AM
Hi Mitrix,

Looks that way doesn't it? As you mention, the 1st part of the algorithm

:00401124 E8B5000000 Call 004011DE ;GetDlgItemTextA
:00401129 83F80A cmp eax, 0000000A ;length must be 10
:0040112C 757B jne 004011A9
:0040112E BAA7204000 mov edx, 004020A7 ;your entered s/n
:00401133 33DB xor ebx, ebx
:00401135 8A1A mov bl, byte ptr [edx] ;1st char of s/n
:00401137 42 inc edx
:00401138 33C0 xor eax, eax
:0040113A 8B0D9F204000 mov ecx, dword ptr [0040209F] ;address 401124
:00401140 8A01 mov al, byte ptr [ecx] ;1st byte of opcode (E8 )
:00401142 80F3DC xor bl, DC ;xor 1st char s/n w/ DC
:00401145 3AD8 cmp bl, al ;must be = E8
:00401147 7560 jne 004011A9

If 1st char XOR DC = E8
then
DC XOR E8 = 1st char = 34h = 4

The 1st char MUST be 4 then. However, the last part of the algorithm indicates it MUST be 7:

:00401183 A0A7204000 mov al, byte ptr [004020A7]
:00401188 3C37 cmp al, 37
:0040118A 751D jne 004011A9

Can't be both. Harlequin must've goofed. Nope. (I love this guy's work :)

You followed the algorithm perfectly and came to the conclusion Harlequin wanted you to come to. As a matter of fact, I like this one so much I hope you'll forgive me if I move it to the Mini Project Forum, I think it'll make a great project and there's some interesting instruction to come out of it.

Regards,
Kayaker
CoDe_InSiDe
05-21-2001, 07:19 AM
Hi Kayaker,

I've taken a look at this and i know this guy's work it's always quite funny ;)
But anyway, i don't know if you have a valid Serial but i have a valid "bugged" Serial ;D
I'm not going to tell more, i think ;)
Just tell me if you got that too....?

Cya...

CoDe_InSiDe
Clandestiny
05-22-2001, 08:17 AM
Hi Kayaker,

Not quite the garden variety serial fishing / key gen exercise, but you wouldn't know it until that little caveat at the end ;)

So far I've generated a serial that passes all checks but the last... But I have made a couple of observations about both the first and last checks (ie. the significance of E8 vs. EB). Interestingly, I noticed that in the following lines ecx actually holds the pointer to an address within the proggy's code section.

:0040113A 8B0D9F204000 mov ecx, dword ptr [0040209F]
:00401140 8A01 mov al, byte ptr [ecx]

This address corresponds to
:00401124 E8B5000000 Call 004011DE

And hence you get your E8 from the hex opcode for "call" in the function call to GetDlgItemTextA. Now in the last check, we'd rather this E8 be EB because this would allow the first check to pass with a 7 (ie 37h) rather than a 4 (34h). Making this realization, I looked up what EB is in my asm hex opcode reference and its apparently a jmp command. So the only thing I can come up with as of yet to make a valid serial is to change the instruction at address 00401124 from a call to a jump. BUT I'm not quite sure that you can jump directly to an API like GetDlgItemTextA because you would ultimately need to jump back to the correct position in the code from where you made the original jump in order to continue execution since a jump doesn't return like a call does. I haven't actually tried this yet, but I guess you could maybe write a patch that simulates the process that occurs when a call is executed (ie. saves the instruction pointer on the stack and then jumps to the address where GetDlgItemTextA begins in memory. According to my asm reference, the RET instruction just pops the previous instruction pointer off the stack right back into eip so execution can resume where it left off. Anyway, I'm just speculating here.

And assuming, you could make it work by changing the instruction I'm not even sure if this observation is on the correct path to a valid serial because it would be necessary patch the .exe to do it.

So, here are my 2 questions (and I don't want the solution yet... just a little guidance / reaffirmation)....
1) Is any kind of patching allowed ??
2) Am I looking in the right direction or do I need to completly revise my strategy ??

If no patching is allowed at all, I'm gonna be really stumped ;)

Regards,
Clandestiny

PS: Kayaker, that last post of yours in Code_Inside's crackme was a really impressive explanation on how to rebuild a PE file ! Just wanted you to know that it was very helpful and that I haven't given up on it yet. Gotta hit the PE docs again. ....Just got a little distracted in the last couple of days ;)
Clandestiny
05-22-2001, 10:02 AM
Me again,

...After a little more investigation.

I think I may have answered my own question from above. I don't think I'll be able to patch in the way I was thinking simply because I just realized something about the EB opcode. Not only is EB an opcode for jmp, but moreover it is the opcode for a SHORT jump. Alas, a short jump won't get me to the empty space at the end of the code section to insert my patch. Guess I'll have to keep thinking ;)

Clandestiny
Kayaker
05-22-2001, 10:20 AM
Clandestiny (05-22-2001 06:17):

1) Is any kind of patching allowed ??
2) Am I looking in the right direction or do I need to completly revise my strategy ??

1) No
2a) No
2b) Yes

;D
Clandestiny
05-22-2001, 12:52 PM
Hiya Kayaker,

hehehe :D

I got the serial! And man do I feel stupid now :-o

Oops, I swallowed Harlequin's bait (and then some) !

I'd post my solution, but I don't want to ruin the fun for anyone else who might be trying it. Besides, there's really not that much to write about once you get the point of it ;-) As some wise man said, "to assume makes an ass out of you and me (although its only me in this case)" ...A very good lesson.

Cheers,
Clandestiny
NeO'X'QuiCk
05-22-2001, 07:19 PM
Kayaker the idea is good!I think its not so hard for newbies but they will loose some time with this like Clavidestina did for nothing !heh

This task is very common for apps and crackmes!If they think good they will see the solution alredy posted by you.They only need to read harder and they will put two and two together.

It was nice working on it !heh but i found serial soon so better luck next time !

I think i will join the course to see !Is it hard Kayaker ??

NeO'X'QuiCk
Kayaker
05-23-2001, 12:09 AM
Hi,

You're right Neo, the real answer isn't particularly hard to find if you have a suspicious mind and look beyond the obvious. Once the obvious becomes suspicious that is ;)

But what I found interesting wasn't the "trick" per se, but, because this is such a simple program, you can easily follow how the trick *works*, how it is implemented from a programming point of view. This is the kind of program one could truly "reverse engineer" and create workable source code from.

For example, the code at the program entry point is:

:00401000 PUSH 00
:00401002 CALL KERNEL32!GetModuleHandleA
:00401007 TEST EAX,EAX
:00401009 JZ 00401026
:0040100B MOV [0040209B],EAX
:00401010 PUSH 00
:00401012 PUSH 0040102D ;entry point of DlgProc
:00401017 PUSH 00
:00401019 PUSH 64 ; DialogID_0064 seen in W32Dasm
:0040101B PUSH DWORD PTR [0040209B]
:00401021 CALL USER32!DialogBoxParamA
:00401026 PUSH 00
:00401028 CALL KERNEL32!ExitProcess

If you've done a bit of ASM programming you'd recognize this as the skeleton of a modal dialog box:

.code
start:
invoke GetModuleHandle, NULL
mov hInstance,eax
invoke DialogBoxParam, hInstance, ADDR DlgName, NULL, ADDR DlgProc, NULL
invoke ExitProcess,eax

...continued...
Kayaker
05-23-2001, 12:11 AM
The next section is the DlgProc itself and you can see the Windows messages being processed:

:0040102D ENTER 0000,00
:00401031 PUSH EBX
:00401032 PUSH EDI
:00401033 PUSH ESI
:00401034 CMP DWORD PTR [EBP+0C],02 ;constant for WM_DESTROY
:00401038 JZ 00401040
:0040103A CMP DWORD PTR [EBP+0C],10 ;WM_CLOSE
:0040103E JNZ 00401044
:00401040 JMP 00401068
:00401042 JMP 0040105F
:00401044 CMP DWORD PTR [EBP+0C],00000111 ;WM_COMMAND
:0040104B JNZ 00401051
:0040104D JMP 0040108E
:0040104F JMP 0040105F
:00401051 CMP DWORD PTR [EBP+0C],00000110 ;WM_INITDIALOG
:00401058 JNZ 0040105F
:0040105A JMP 004010DD
:0040105F XOR EAX,EAX
:00401061 POP ESI
:00401062 POP EDI
:00401063 POP EBX
:00401064 LEAVE
:00401065 RET 0010
:00401068 PUSH 00
:0040106A PUSH DWORD PTR [EBP+08]
:0040106D CALL USER32!EndDialog
:00401072 PUSH 00
:00401074 CALL KERNEL32!ExitProcess

And it looks like the source could be represented with something like:

DlgProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM

.IF uMsg==WM_DESTROY || WM_CLOSE
invoke EndDialog, hWnd,NULL
invoke ExitProcess,NULL

.ELSEIF uMsg==WM_COMMAND
JMP 0040108E ;this is where it gets interesting

.ELSEIF uMsg==WM_INITDIALOG
JMP 004010DD ;whatever initialization code is used

...continued...
Kayaker
05-23-2001, 12:13 AM
The jump to 40108E when the WM_COMMAND (111) message is received is where it gets interesting because this is Self Modifying Code (SMC).

:0040108B ADD [EAX],AL
:0040108D ADD [ESI-7D],AH
:00401090 JGE 004010A2
:00401092 INSB
:00401093 JNZ 0040109D

becomes

:0040108E CMP WORD PTR [EBP+10],6C ;button pushed?
:00401093 JNZ 0040109D
:00401095 PUSH DWORD PTR [EBP+08]
:00401098 CALL 0040110F
:0040109D CMP WORD PTR [EBP+10],6B ;edit box received input?
:004010A2 JNZ 004010D6
:004010A4 MOV EAX,USER32!GetWindowTextA
:004010A9 PUSH 00000080
:004010AE PUSH 00402127
:004010B3 PUSH DWORD PTR [004021AB]
:004010B9 CALL EAX ;GetWindowText of edit box
:004010BB CMP DWORD PTR [00402127],73704F4F

Rather than just blindly flailing away at a crackme until you get the right answer, here is where you can use your knowledge of how Windoze operates to *understand* how the crackme works, and use other clues to assist you.

After the uMsg parameter of a Windows message is processed, in this case 111 for WM_COMMAND, the other parameters may be processed.

WM_COMMAND
wNotifyCode = HIWORD(wParam); // notification code
wID = LOWORD(wParam); // item, control, or accelerator identifier
hwndCtl = (HWND) lParam; // handle of control

In the code above, the ControlID's in wParam are being examined. W32Dasm itself tells you that 6C and 6B are the ControlID's for the button and for the edit box:

002 - ControlID:006C, Control Class:"BUTTON" Control Text:"Try It!"
004 - ControlID:006B, Control Class:"EDIT" Control Text:"Your Serial"

If you set a 'BMSG hwnd WM_COMMAND' breakpoint in SoftIce on the hwnd of the main window, you'll break when either control receives input. For example,

:BMSG 0690 WM_COMMAND
Break due to BMSG 0690 WM_COMMAND (ET=1.83 seconds)
hWnd=0690 wParam=006B lParam=01000694 msg=0111 WM_COMMAND

From this break you can trace back into program code and follow the action...

By being able to understand what ALL the code in a program is doing, even the boring looking stuff, you've got a better chance of finding where the real protection lies. Here, does something happen only when you push the button, or is there a hidden check when you type something in the edit box? This seems to be a popular deception with Delphi programs where the programmer can use an OnChange Event as you're typing your s/n into the registration edit box. There's another nifty bit of SMC that opens the final door if you successfully pass the real protection check above.

So the point is not to just come up with the quick answer, but like Clandestiny (sp?) ^_^ "waste" the time, examine all angles, including fancy patching, and try to *understand* the code, learning all the while.

Cheers,
Kayaker
Clandestiny
05-23-2001, 08:21 AM
Hi Kayaker,

Heh, I guess I lacked "zen" in my approach to this one but I actually found the real solution while reading my whole 8 page disassembled listing. After you told me patching was not an option, there was NO logical solution to that serial check routine and I knew I had to look elsewhere... Of course, after comprehending the protection I realized I'd REALLY missed the obvious in the list of imports ;)

And you're right, the program is actually quite small and easy to follow and therefore would not be impossible to re-engineer / recode. So here's my suggestion... Why don't we extend the scope of this project a bit ??

Part 1 could include reverse engineering and rewriting the complete source code of Harlequins crackme from the dead listing (only 8 pages) in a language of your choice...

And Part 2 could include inventing a clever way to modify Harlequin's crackme / improve the protection.

Well there's my 2 cents for now ;-)

Regards,
Clandestiny
NeO'X'QuiCk
05-23-2001, 04:25 PM
heh True Kayaker what can i say !But i think that if newbies would like to learn they should join the course !Because i think they can must to learn from simple step to hard one.

Because so fare i didnt find i really good course and that would teach you from step to step but only course when you show you knowledge if you have it.If not the learn and come back.SO this kind of courses are ment for good coders and crackers and their main good is to put more ppl to quite it!

But this one i like because i give you all tuts and tools to do it!You must just use some brains !!heh

NeO
Kayaker
05-24-2001, 11:31 PM
Hi,

Sounds like an interesting challenge Clandestiny. I'm going to give it a shot as soon as I get a chance. I've got a little "trick" in mind that I'd like to see if it works just for fun.

If anyone tries the rest of Harlequin's course and has any questions, maybe we can start a project thread on it too.

Kayaker
Clandestiny
05-25-2001, 07:36 PM
Hi Kayaker,

My reversed and recoded version of Harlequin's crackme is coming along quite well, but there is one silly little bug that is driving me crazy. ...And that's the Bitmap resource.

Now, I could easily load the bitmap using LoadBitmap() and then paint it into the client area by getting a device context and using BitBlt() in response to the WM_PAINT message... BUT I'm trying to keep this as "authentic" as possible and thats clearly not what Harlequin did to load his Bitmap (as evidenced by the imports in WDASM).
Indeed, there appear not to be any GDI functions of any kind. So I'm presuming that there is some way to load the bitmap direct via the resource file ??? I've examined the resource file from Harlequin's crackme in detail and I just can't quite seem to figure it out... I don't even see any mention of the Bitmap's resource identifier in my dead listing. Admittedly my Win32 asm programming skills are limited, but I'm unsure how load this thing w/o any GDI APIs. Likely, there is some insanely simple way to do this and I'm going to shoot myself in the foot for asking about it when I find out... but a little insight will be appreciated anyway ;-)

Thanks :-)
Clandestiny
Kayaker
05-26-2001, 12:26 AM
Hi Clandestiny,

I had a bit of a problem with that one too. Working with .rc files is still a bit of a black art ;)

I extracted the .bmp and .ico with ResHacker and produced an .rc file from the original exe with BRW. After the usual messing around to get MASM to recognize it, I had the same problem with no bmp in the static edit control. Finally got it right:

======================================
#include "resource.h"

#define BITMAP_1 104
#define IDC_EDIT_REG 107
#define IDC_BUTTON 108

BITMAP_1 BITMAP "Harl.bmp"

ICON_1 ICON "Harl.ico"

100 DIALOG 0, 0, 128, 105
EXSTYLE 0x200L
STYLE DS_ABSALIGN | 0xA04L | WS_OVERLAPPED | WS_VISIBLE | WS_CAPTION | WS_SYSMENU
CAPTION " "
FONT 8, "Times New Roman"
BEGIN
CONTROL "", 102, "STATIC", SS_BLACKRECT | WS_CHILD | WS_VISIBLE, 0, 0, 131, 137
CONTROL "Try It!", 108, "BUTTON", BS_DEFPUSHBUTTON | WS_CHILD | WS_VISIBLE | WS_TABSTOP, 1, 90, 124, 12, 0x200L
CONTROL "", 101, "EDIT", ES_CENTER | ES_MULTILINE | ES_READONLY | WS_CHILD | WS_VISIBLE | WS_BORDER, 1, 35, 124, 38, WS_EX_NOPARENTNOTIFY
CONTROL "Your Serial", 107, "EDIT", ES_CENTER | ES_AUTOHSCROLL | WS_CHILD | WS_VISIBLE | WS_BORDER | WS_TABSTOP, 1, 75, 124, 10
CONTROL 104, 106, "STATIC", SS_BITMAP | SS_CENTERIMAGE | SS_REALSIZEIMAGE | WS_CHILD | WS_VISIBLE, 1, 3, 124, 28
END
=====================================

Then I used a standard modal dialog template from Iczelion's ASM tut #10-2, and filled in a few of the apparent calls in Harlequin's app within this framework:

====================================
.386
.model flat,stdcall
option casemap:none
DlgProc PROTO : DWORD,: DWORD,: DWORD,: DWORD
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

.data?
hInstance HINSTANCE ?

.const
MYDIALOG equ 100

.code
start:
invoke GetModuleHandle, NULL
mov hInstance,eax
invoke DialogBoxParam, hInstance, MYDIALOG, NULL, ADDR DlgProc, NULL
invoke ExitProcess,eax

DlgProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM

.IF uMsg==WM_DESTROY || uMsg==WM_CLOSE
invoke EndDialog, hWnd, 0
invoke ExitProcess,0

.ELSEIF uMsg==WM_COMMAND

.ELSEIF uMsg==WM_INITDIALOG

.ENDIF

xor eax,eax
ret
DlgProc endp

end start
====================================

The above code produces a dialog virtually identical to the original, just needs the details filled in now :)

Kayaker
Clandestiny
05-28-2001, 03:57 PM
Hi Kayaker,

Thanks for the pointer. I had no idea you could load a bitmap in the resource file like that. Sure is handy though... and to think I've been writing all that extra code to paint bitmaps into a window's client area for nothing... Likewise, I'm glad I decided to write this in asm since I found out that Borland's Resource Workshop beats VC++'s by a long shot ;)

Right now I've got the reconstructed program and its working great minus SMC. I don't suppose you know anything about writing SMC, Kayaker ?? ;-)

Cheers,
Clandestiny
Kayaker
05-28-2001, 10:04 PM
Hi Clandestiny,

Just been thinking about posting an update myself. I'm at the same stage. I'm leaving the final SMC details until I finish, er, "enhancing" the proggy with a new protection ;)

There's 2 tricky sections I see, one SMC, the other I guess you could call obfuscation. BTW, I actually goofed in my earlier post thinking the line
:0040108E 66837D106C cmp word ptr [ebp+10], 006C
was part of SMC code. The obfuscated section is just above it and I had done a screendump in SoftIce of this section and SI didn't parse the code correctly. WDasm does show it properly however.

Anyway, the obfuscated (that word really doesn't roll of the tongue easily ;) code is at:

:00401079 6880000000 push 00000080
:0040107E 6835674000 push 00406735
:00401083 FF35AB214000 push dword ptr [004021AB]
:00401089 0000000000 BYTE 5 DUP(0)

This code is never called. If you look down a little further you see the PUSHes repeated with an indirect call to GetWindowTextA:

:004010A4 B8E4114000 mov eax, 004011E4
:004010A9 6880000000 push 00000080
:004010AE 6827214000 push 00402127
:004010B3 FF35AB214000 push dword ptr [004021AB]
:004010B9 FFD0 call eax ;GetWindowTextA

And 4011E4 is the address of the jump table entry for this API:

* Reference To: USER32.GetWindowTextA, Ord:0000h
|
:004011E4 FF2584304000 Jmp dword ptr [00403084]

So what I've got right now is a direct Invoke of GetWindowTextA at 401089 so the API will be included in the import table. Then I guess the trick is to hex edit it out later and include the code which will call it indirectly.

...continued...
Kayaker
05-28-2001, 10:05 PM
The SMC is of course right below the obf. section:

:004010BB 813D272140004F4F7073 cmp dword ptr [00402127], 73704F4F
:004010C5 B8D0104000 mov eax, 004010D0
:004010CA C7000F84B600 mov dword ptr [eax], 00B6840F
:004010D0 C7000F840000 mov dword ptr [eax], 0000840F

which converts to the proper code of:

:004010BB 813D272140004F4F7073CMP DWORD PTR [00402127],73704F4F
:004010C5 B8D0104000 MOV EAX,004010D0
:004010CA C7000F84B600 MOV DWORD PTR [EAX],00B6840F
:004010D0 0F84B6000000 JZ 0040118C ;good boy MessageBox

Sooo, I guess 4010D0 is the line to change, the next line has the bytes to move there, and the original 4010D0 is just bogus, but holds a place for 6 bytes. The tricky part seems to be planning and thinking ahead and knowing what bytes will create the code line you want. I guess the 'a' command in SI is handy for this.

I don't know, I've never created SMC before. Maybe someone who's played with this can give us a few pointers. Hell, this'd be a great topic in itself.

Unless you change the code characteristics in the compiled file later, you need to include this in your linker line:
/SECTION:.text,EWR
This will create a .text section with the characteristics E0000020, which will allow the SMC to write to memory without crashing.

BTW, how did you deal with the wm_command loop? In the original file, the loop continues, somewhat ungracefully, after the good message box, which is why you see it flickering. The reason for this I think is that there are *2* wm_command messages processed for every letter you input in the edit box. I've got a little proggy (ISpy) that monitors windows messages and tells me this. In my version the loop finishes with a crash :( I added a flag which tests if the good messagebox has been called, in which case stop processing messages from that edit box. This works great, but isn't how the original code ran.

So where the heck is everybody else? They're missing all the good, clean fun ^_^

Cheers,
Kayaker
Clandestiny
05-29-2001, 10:25 PM
Hiya Kayaker,

I think I figured out SMC and its not half as bad as the horrors I'd conjured up in my imagination prior to trying it. In fact, its really cool (and amazing) to me that you can actually do something like this with asm.

Here's the little piece of SMC I've managed to write so far...

Test1:
mov edi,offset smc1 ; define the beginning address of the code you want to replace
mov [edi],byte ptr 080h ;replace code w/ hex opcodes for new instructions
inc edi
mov [edi],byte ptr 0F3h ;replace code
inc edi
mov [edi],byte ptr 0D2h ;replace code
smc1: xor bl,0DCh

/*********************************
xor bl,0DCh is a 3 byte instruction and we replaced it with a 3 byte instruction
xor bl,02Ch
**********************************/

mov edi,offset smc2 ;address of code we want to replace
mov [edi],dword ptr 04E8C166h ;replace code
smc2: cmp ax,03330h
xor ebx,ebx
mov esi, offset serial
.
.
.
/*********************************
Here we replace a 4 byte instruction cmp ax,03330h with another 4 byte instruction shr al,04
*********************************/

So from this I've deduced a general procedure...

1) Define a label where you want your SMC to start and load the address of that location in a register
2) Determine the number of instructions you want to replace and calculate the total number of bytes used by those executable instructions
3) Load in the new instructions starting at the address you defined to be the beginning of the SMC code until you've reached the total number of bytes of the instructions you've designated for replacement
4) Change the section characteristics to E0000020h (like you mentioned previously)

Well, thats all I've discovered so far, but I think it will be servicable for the task at hand ;)

Oh, and in case you're interested I'll post the urls to the 2 documents I managed to dig up to help me figure this out (though IMO they're a bit skimpy on the explanation).

http://blacksun.box.sk/smc.txt
http://www.geocities.com/SiliconValley/2151/selfmod.html

Just don't get too excited and go overboard with the SMC in your "enhanced" protection, Kayaker ;-)

Cheers,
Clandestiny
Kayaker
05-31-2001, 02:48 AM
Hi Clandestiny,

I liked your idea of using the OFFSET of the label of the line which is to be SMC'ed in ASM code. Saves having to input it or hexedit it in later once all the coding is finalized.

In the 2nd step however you still have to manually calculate the opcode and displacement bytes and MOV them as a hex value. I wanted to see if this could also be done entirely as ASM coding and came up with this.

If you know the conditional jump you want is going to be a Short jump (less than 128 (80h) bytes, then the opcode is one byte long (74h for a JZ). If >80h bytes then it's a 2 byte Near jump opcode (0F84h for JZ). So, that's at least one step that can be hard coded.

The other bit is the displacement value of the jump. For a Short jump it's 1 byte long, i.e. 00 to 7F. For a Near jump it can be up to 4 bytes long. If you set a label where you want to jump to, i.e a MessageBox, then you can use OFFSET again to calculate the displacement of the jump.

I wrote a little proggy with source that I'll attach that shows this for both Short and Near jumps.

The idea is sort of:

-------------------------------------------------------------------

mov eax, offset SMC line
mov ebx, offset Line to jump to

;#bytes between start of SMC line and where to jump to
sub ebx,eax

;mov 74h Short jump opcode to first byte of SMC line
mov byte ptr[eax],74h

;compensate 2 bytes for a short jump since jump actually takes place at the END of the line
sub ebx,2

;set pointer to where displacement byte goes
inc eax

;mov displacement bytes into position
mov [eax],ebx

;SMC JZ line now fully produced

------------------------------------------------------------------

And no, I wasn't planning on using this in the "enhanced" version ;)

Cheers,
Kayaker
Clandestiny
06-01-2001, 07:51 PM
Kayaker (05-31-2001 00:48):
In the 2nd step however you still have to manually calculate the opcode and displacement bytes and MOV them as a hex value. I wanted to see if this could also be done entirely as ASM coding and came up with this.

Hi Kayaker,

That was a very clever idea with the JMP and thanks for going to the trouble to write me up an example :) In your example you were writing into an empty section of code and it worked perfectly, but when overwriting some existing code I think there could still be some problems. I think you'd still have to manually calculate opcode lengths for both the inserted instructions and the overwritten instructions to make sure they both fall on the same instruction boundary. Else the remainder of the code will likely be transformed into garbage (as I've had the pleasure to witness quite a few times now ;) Likewise, I've seen my valuable data in one of the registers modified more than once by garbage instructions. It seems one has to be VERY careful about which registers are modified, keeping the meaningful values in the calcuation separate from the bogus ones in the routine. Inserting an SMC instruction or 2 seems not to be too hard, but have you tried a whole block of em? And IMO, you need a whole block of interlaced SMC / real instructions for some meaningful obsfucation ;) Man, I'll tell you right now its a painful coding job and I haven't met with much success... err, I mean it crashes every time I try to run it with more than just a few SMCed lines... I guess I just don't fully grasp the technique yet... And its shattering my delusions of grandeur for pages and pages of SMC obsfucating my "enhanced" protection ;-) I'll be lucky to get a decent obsfucation of 5 lines the way its going...LOL

Cya,
Clandestiny
Kayaker
06-02-2001, 06:36 PM
Hi Clandestiny,

Quiet in here isn't it? Just the sound of our own voices echoing off the walls...

You're right, that was *very* optimized and basic SMC. I had used 6 nops as the 'reserved' bytes where the new SMC generated jump was to be created just for clarity. If I had used real code totalling 6 bytes, then in the case of a Short jump, which is only 2 bytes long, there would be 4 bytes left over which as you say, could translate into bogus code which would screw up the rest of the code below. It didn't really matter anyway because the Short jump jumped over any bad code directly to the proper address in any case.

I know what you mean by generating a block of SMC is more challenging. And confusing. I was thinking you could always pad extra bytes with nops or some other innocuous series of bytes to make it easier. Say you wanted to create an 8 byte code sequence. You could have a bogus 5 byte Call statement, say to GetTickCount or some other API which doesn't push anything onto the stack, or maybe to a fake call somewhere in your code. Then pretend to mov the return value to some garbage variable, producing another 5 bytes to play with

E82C5AB7BF CALL KERNEL32!GetTickCount
A334124000 MOV [00401234],EAX

This now looks like valid confuse-a-cracker code ;) Then your SMC generating code can mov 2 DWORDS worth of bytes giving you the new 8 byte code sequence, and a WORD mov of 9090 will fix up the extra 2 bytes so it doesn't crash. Or you could use inc eax, dec eax or something like that.

Again though, even this is very simplistic. You probably don't want all these extra nops kicking around but would prefer the SMC and original code to "mesh".

I suppose you could even have "layers" of SMC - a mov dword statement *creating* another mov dword statement which produces the real SMC code you want. Yikes, the brain reels at the House of Mirrors concept.

Hey Clandestiny, I know you're a talented graphic artist, I've seen some of your work. I know you like to take a word or idea and conceptualize it into an image. Think you could do that with the programming concept of SMC? Y'know, the Board *could* use a fancy graphic to jazz it up a bit... ^_^

...seed planted...

...water...

...feed...

...weed...

...Blossom!

Cheers,
Kayaker
smokin'
06-13-2001, 04:53 PM
I can't get the link to harlequin home page to work. Does anyone know if he moved or what?

Sorry all, couldn't get it to work for 2days but it's working again to night!
Cold Coder
06-14-2001, 04:50 AM
Hi all

http://www.angelcities.com/members/harlequin/
http://www.Harlequin00.cjb.net
http://htasks.cjb.net/fx23ht.zip

all work for me
--------------
This how i did the SMC for fx23ht.exe
; at about 004010CA and WellDone at NA(not telling hehehe)
mov eax, Modif
mov dword ptr [eax], 0Fh*1h + 84h*100h + (WellDone-Modif-6)*10000h
Modif EQU $
;C7h, 00h_________, 0Fh, 84h, 00h, 00h
mov dword ptr [eax], 0000840Fh ; give us 6 bytes(for jz xxxx0000)

2 other things
here some thing cool
:00401142 80F3DC xor bl, DC ; aka 'Ü' aka ALT 666(you bad Harlequins)

and fx23ht.exe has a cool bug at about WellDone by sending hInstance and not hWnd to MessageBox get it into a loop(well for me it dos)

Cheers,
Cold Coder
Cold Coder
06-14-2001, 06:11 AM
Hi smokin,
one more thing harlequin is away right now(i think he will b back soon) so if it go down 100% then it down for now.

cya,
Cold Coder
Kayaker
06-15-2001, 12:30 AM
Hi Cold Coder,

Glad to see someone else working on this. You're right, hInstance is pushed as the 1st param in the MessageBox calls rather that hWnd, which is what it's supposed to be (or NULL) according to the API reference, even though it doesn't seem to make a great deal of difference. I hadn't noticed this error, just recognized 400000 in Harl's original file as an Instance handle returned from the GetModuleHandleA call, and used hInstance in my code. Unfortunately this doesn't get rid of the infernal message loop when you get the correct 'serial', at least for me.

If I use hInstance or NULL as the 1st param of the MessageBox call, I get multiple message boxes and a flickering of the dialog window. If I use hWnd, I get multiple message boxes, but the flickering stops and it seems to exit from the loop a bit more gracefully.

It still seems to have to do with wm_command being processed too many times. If you set a bp on the code line .ELSEIF uMsg==WM_COMMAND (401044 in the original file), and step over the good MessageBox when it's called, you immediately break at that wm_command line again, even before the MessageBox call finishes and displays its message. So of course the GetWindowTextA / cmp dword ptr [variable], 73704F4Fh / MessageBox routine gets called *again*, which is totally redundant.

wm_command is also sent when a control sends a notification message to its parent window. I used Winsight to monitor the windows messages in both the main dialog and the edit control when something is typed into the edit box. After the 1st wm_command is processed, it seems there are still some messages from the edit box sitting in the message queue , one (or more) of them which cause further wm_command messages to be sent to the main window, causing the bug.

I haven't tracked down the exact source of the multiple wm_command messages. I think this is just a one-off problem with using wm_command as a tricky way to monitor when there's a change in the edit box. Maybe using a less generic wm_ message such as WM_GETTEXT or WM_GETDLGCODE (both of which are also sent by the edit box) might work better.

Cheers,
Kayaker
Cold Coder
06-15-2001, 02:50 AM
Hi Kayaker,

> Glad to see someone else working on this.
I have bin here/working(i think some other ppl have too "read 435 times") from the start project.(i just think my post sucks so i do not post much)

This what i did i used the edit box hWnd as it save any way(bing the way code work i have to save the main one). So this may have stop all message from the Edit box.

Cheers,
Cold Coder
Kayaker
06-16-2001, 10:30 PM
Hi All,

I came up with a solution to the errant message loop problem in Harlequin's original file that caused that flickering/mulitiple message boxes. The wm_command processing loop needed another test to isolate when a single change was occuring in the edit box before continuing on to the GetWindowTextA call.

If you use Winsight (or Ispy) to monitor the wm_command windows messages being sent to the dialog box when you type a character into the edit box, you also get the values of wParam and lParam. For each keystroke entered there are 2 wm_command (111h) messages sent from the child window (the edit box) to the parent window (the dialog box):

"Harlequin 7" WM_0x111 Sent wp=0400006B lp=00000524
"Harlequin 7" WM_0x111 Sent wp=0300006B lp=00000524

lParam just gives the hWnd of the child window
The low-order word of wParam is the Control ID = 006B = the edit box ID
The high-order word of wParam is the Notification Code

The Notification Code is the interesting one. There are 2 of them, 0400 and 0300. Doing a search for them I found they corresponded to EN_UPDATE and EN_CHANGE.

The EN_UPDATE notification message is sent when an edit control is about to display altered text. This notification message is sent after the control has formatted the text, but before it displays the text. This makes it possible to resize the edit control window, if necessary. The parent window of the edit control receives this notification message through the WM_COMMAND message.

The EN_CHANGE notification message is sent when the user has taken an action that may have altered text in an edit control. Unlike the EN_UPDATE notification message, this notification message is sent after Windows updates the screen. The parent window of the edit control receives this notification message through the WM_COMMAND message.

So now either one of these messages can be used to make sure the GetWindowTextA routine is called only once for each keystroke:
------------------------------------------
.ELSEIF uMsg==WM_COMMAND
jmp wmcommand
.
.

wmcommand:
mov eax,wParam ; check low-order word of wParam
.IF ax==IDC_BUTTON ; button pushed?
invoke FakeCheck,hWnd

.ELSEIF ax==IDC_EDIT ; something entered into edit box (ID=6B)?
shr eax,16 ; shr to check high-order word of wParam
.if ax==EN_CHANGE ; equal to 0300?

invoke GetWindowTextA, hEditReg, ADDR strReg, 20h
cmp dword ptr [strReg], 73704F4Fh
.
.
------------------------------------------------

I also set a BMSG hwnd WM_COMMAND breakpoint in SoftIce to monitor things and found something unusual. SI lists the Notification Code in lParam instead of wParam. This must just be an internal syntax because according to all API documentation, Numega's got it wrong!

Break due to BMSG 0B34 WM_COMMAND
hWnd=0B34 wParam=006B lParam=03000B3C msg=0111 WM_COMMAND

Just thought this might be interesting. At least now I can sleep better ;)

Kayaker


It's Easy-Level... Everyone have a try...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > It's Easy-Level... Everyone have a try...
PDA

View Full Version : It's Easy-Level... Everyone have a try...

JimmyClif
05-26-2001, 07:53 PM
Hello people :)

I had a little chit chat with Kayaker lately... and well this made me come up with a little
project... To start off: I'm sorry that it is a 5MB download... But I'm hanging at a 56K
line too and I just received it by mail - had my fun and decided to upload it to angelfire for a
project... As you can see I just dl'ed it and uploaded it (together 10 MB) just for you ;D

To raise your interest:

* The program itself is called "WinVCR" which is a recorder for movies on your TV card.
(I don't have a TV card either - and w/o a TV card some options are greyed out, but that's
not the point here ;) )
* Unfortunately the exe itself is only 260kb
(I uploaded it too if you want to try it without the proggy)
* You can read the file like a book :D
* No unpacking
* Funny patching

Your expected goals are:

--- Get rid of the 30 days time limit.
--- Get rid of the splash / or / reduce the counter which keeps the nag alive to minimum
--- Get rid of the Buy or Continue Dialog

Possible Goals:

If you don't have a TV card:
--- Try to find the 10 minutes minimum recording time && explain why you think it's probably at that/these place(s).
If you have a TV card..
--- Kill the 10 minutes minimum recording time. (haven't tried that - my record button is greyed out)

SideNotes:
I've choosen version 2.0 because I thought we wouldn't hurt the programmer team from
WinVCR too much this way...

The links is: (angelfire doesn't like links being accessed from outside)
http://www.angelfire.com/rpg/screendudes/index.html
and click on :
Angelfire - Free Home Pages* -> For the 5MB File which is the whole Program
Free Web Building Help*orig* -> For the exe itself ;) (will be harder tho)

And I hope you don't feel underestimated
JaneK
05-31-2001, 01:18 PM
Hi JimmyClif,

Thanks for this project.
I managed to patch the program so it never expires by changing one jump (jl => jmp).
I don't know if I should post how I found the right place to patch - I am sure other newbies are working on it.

Cya
janek
JimmyClif
06-01-2001, 02:46 AM
Hi Janek...

No need to post the answer yet... I guess where you're at ;)

But before the congrats, let's do a little bit of backchecking ;D

Try to answer these questions for task n° 1:

* Did you find out where it saves your expiration details? (registry, file etc..)
* Can you receive another 30 days w/o patching the target?
* What API did you try breaking on first?
* Is there something which could get dangerous later, regarding the timelimit?
(pretty close to where you're at) Have a look at the flow.. any other
conditional jumps leading to the bad boy routine?
* What were the tools you used?

Until later...
JimmyC
JaneK
06-04-2001, 06:57 AM
Hi JimmyC

Well, I did not have too much luck with the additional questions. Maybe you can guide me in the right direction:

1. I am not sure where it saves expiration details - after reinstaling the proggie ( and cleaning the registry from all winvcr entries I could find) it still displays the same number of days left as before, so I guess it is probably stored somewhere in windows directory. I couldn´t find the exact place though.

2. Maybe manually editing the place where it stores reg. data would do?

3. I tried to brake on GetLocalTime and GetSystemTimeAsFileTime first, but sice kept on poping and I could not get to the winvcr code. Then I noticed CompareFileTime in w32dasm, checked it out in my API ref. and it looked ok so I tried this one and it worked.

4. Something dangerous - hm, patched program works ok, the only thing is when I passed 30 days it starts to show trial days as negative numbers in the initial nag, but even if I set the time 1 year ahead it still works, just saying "you are on day -366 of your trial period" or sth like this.
There is also a check if the system time (clock)has been tampered with, but it is activated only when you set the time back, not ahead. It can be disabled I guess, and then one may get additional days by setting the system date e.g. 30 days backwards (I have not tried this yet).

5. My tools were: w32dasm, s-ice, hiew. I also tried regmon and filemon, but without too much success.

If you have time I would appreciate if you can post few words about locating the place where reg. info, number of days etc. are stored.

Thanks
JaneK
JimmyClif
06-04-2001, 08:04 AM
Hi Janek.

I'll do my best getting you on track ;)

1. The expiration details:

You should always take your time looking at every String Reference you got (big hint)
The more you should have another try with reg and filemon. Start RegMon and immediately
start WinVCR. Once the nag displays the days, you know it had to read them somewhere,
you can stop RegMon capturing data. Now you have a nice "hopefully" not to long list to
browse thru... Anything looking TopSecret there ?

2. When you found the data... imagine this ;D
IF Key==Present
...Call LocalTime
...Compare Time with Time in Registry
......IF LocalTime>=RegistryTime+30
........display "DOH"
......ELSE
........go on as usual
......ENDIF
ELSE ;(Key!=Present)
...Assume it is the first time he started
ENDIF

3. Yup... it's always good to check out the Imported Addresses :)

4. Yes, you found the place I spotted as "dangerous"; well.. the "normal" User probably never gets to this jump, but I kinda lived already weeks in 2002 as sometimes I forget to set my sytem time back again *g* Imagine you just installed it... and then you realize that your time is wrong.. you set it correctly and "doh" you can't ever use that prog again...
(And besides that: Patching is fun, so why not close every possible door?)

5. Good choice in tools... I went for the 'double whopper' IDA & Wdasm analizis, If you downloaded IDA already somewhere take a look at the same part of code where you patched the time check. This will get you a pleasant surprise... ( talking about a book ;D )

Once you got yourself familiar with reg and filemon... and a little bit of IDA... we can go on to the splash screen...

JimmyC
JimmyClif
06-04-2001, 05:20 PM
BTW: I just went to Angelfire and saw that there were 31 visitors...
Let's take away me 3 times... Twice for checking if the links worked and once now.

Who else did download WinVCR? Any lurkers around?
JaneK
06-06-2001, 12:04 PM
Hi JimmyC,

I had another look at the registry with regmon and this time I found the topsecret place :)

I also looked at both nags and I think I found the calls creating each of them, updating the first one with version number and numbers of days left etc.

Is it possible just to nop them? (it is crashing the prog as I do it).

JaneK
JimmyClif
06-06-2001, 05:05 PM
Hi Janek...

Great you found the two spots for them... I assume the call you mean is at 0041A324.
This is actually only the call to display it... but if you see the code afterwards... there
is still a lot happening with it... Nop-ing this one out results in a crash :(

Ergo,

I don't see no easy solution for the first nag... at least not without opening the
"JimmyClif's Infamous WinAPI Surprise Box". (I'll surpise you later ;) )

That's why I primarly decided only to reduce the minimum time shown... and then we get "rid"
of it :D ... To make this easier we divide the Splash-Nag and the DialogBox into Task 1 and
Task 2..

Task 1:
Try to find the place where it keeps the nag alive using a counter.

One solution to get there is:
UpdateWindow and ShowWindow are some of the more known breakpoints and then you
would start tracing. (Some counters are created using GetTickCount too)
Another one (my favorite) is:
You wait until the nag is displayed but before the Dialog shows and hit CTRL-D.
Then you need to find your way back to the code and find the suspicious place where
it keeps counting.

Task 2:
Try to find the call which has entirely to do with the dialog. ( i guess you found this one)

Alright, once you got them write their Offsets (maybe a code snippet too) here...
so that I'll see where you're at =) and then we go for the action.

Happy F8'ing ;D
JimmyClif
JimmyClif
06-18-2001, 06:53 PM
Heya Janek...

I haven't heard anything from you in quite awhile, so I guess you might be stuck || bored with WinVCR.. who knows ? :D
Anyway... Here's the solution for the remaining tasks:

The Splash Nag:

First I started WinVCR and before the Purchase Dialog poped up but while it was displaying the Splash I hit CTRL-D. A few F12's were leading me back into it's code and I got to this point:

0041A4D1 call esi ; timeGetTime ; Get system time, in milliseconds
0041A4D3 sub eax, ebx
0041A4D5 cmp eax, 0BB8h
0041A4DA jb short loc_41A4D1

Pretty self-explanatory what to do at this point... We nop out the jump and the Splash pops up and we see immediately the Purchase Box...

So.. but how to get rid of the Splash for good?

I then had another go with it and put a breakpoint at "UpdateWindow"...
Which brought me upon this point:

0041A30F push 92h
0041A314 push 0D4h
0041A319 mov ecx, edi
0041A31B call sub_401540
0041A320 push 1 ; <- 1 == Visible // 0 == Invisible
0041A322 mov ecx, edi
0041A324 call j_?ShowWindow@CWnd@@QAEHH@Z ; CWnd::ShowWindow(int)
0041A329 mov ecx, [edi+20h]
0041A32C push ecx
0041A32D call ds:UpdateWindow
0041A333 mov edx, [edi+20h] <-I landed here

Being in SoftIce I set a breakpoint a few calls above to find out where the nag got generated... Here it's clear to see that it will be the call @ 0041324 (ShowWindow)

This made me get out my Win32API reference to have a look at ShowWindow:

BOOL ShowWindow(
HWND hWnd, // handle of window
int nCmdShow // show state of window
);

So, well.. no hwnd push? MFC's way are strange...So I assumed the push 1 would be the push for the Show State of the Splash.. I replaced this with a push 0 then. And voila.. God bless the API Guide... The Splash is gone.. (Basically it's still there but at least we won't see it anymore..)

-----------------------------------------------------------------------------------------
Getting rid of the Purchase Dialog:

We know that immediately after the Splash the Dialog pops up.. so we can just continue tracing using F10 until that Dialog pops up.. And this will happen at this call:

0041A519 mov ecx, esi
0041A51B mov [esp+7DCh+var_5C], 2
0041A523 call dword ptr [edx+0C0h] <-- HERE
0041A529 cmp eax, 1
0041A52C jnz short loc_41A57E

Lucky we are.. We stepped over the call using F10.. SoftIce made a little rest to let us push the Continue button and we land exactly a line after the call on cmp eax,1

Checking our registers tells us that only eax got changed after this call. (Well eip too, but that's another story ;) )

Eax has as value 2 now... Instead of nop-ing out the call (which is not always the way top go because of the pushes which may preceede a call (every push needs a pop) - but here there are no pushes before.. that's good) So.. instead of nop-ing out the call we can replace the whole call with a mov eax,2 (which is the correct value upon return and it will jump to the right place... You'll see the bytes fit exactly in :)

So.. that's been it.. You found already the Time Check... no more need to tell this..
Finally I can delete this useless tool from my HD... (or should I go and buy a TV card?)

;) JimmyClif

& How do these bloody <pre> tags work?
JaneK
06-19-2001, 12:05 PM
Hi JimmyC,

I am still interested and still have plans to look more into this prog. I am so loaded with work I just did not have any time to sit down in peace and investigate further on. When I'm done, I'll post something here (or shall I mail you?) and hope to have your comments, so don't delete winvcr yet!!!

JaneK
JaneK
06-20-2001, 04:51 PM
Hi JimmyC,

All clear now!
I also, same as you, tried to get rid of the 1st nag by modifying the pushes before the call at 41a324, however I have wrongly assumed it's CreateWindowExA (I used w32dasm so I could not see it is ShowWindow). CreateWindowExA also seemed to be a nicely working bpx so I was also mislead by this.

The "purchase" nag (at 41a523) - this one I just noped and it works fine. Changing "call xxxxxxxx" to "nop" would crash the prog, but substituting call's hex notation by 909090909090 solves the problem.

For me it was an interesting project - thanks for your time.

Cya
JaneK

P.S. Now you can delete this crap from your disk :)
JimmyClif
06-20-2001, 05:33 PM
Heya JaneK,

Sorry for pushing you a bit with the Project.. I'm just traveling pretty soon and I was in fear of not being able to finish it and to help you with any questions, while I'm sunbathing at +/- 90 °F *hehehe*

I hope you saw the difference between IDA and Wdasm... It's simply incredible what IDA can do... Even tho that I prefer the way Wdasm handles the String References. That's why I always go for the double whopper ;)

For the Call xxxxxx to a single nop ? Oh Lord, You learned that you need to replace all the bytes (as you nicely said "substituing the hex notation" ) If you use Hiew you could have tried replacing the call xxxxxx with mov eax,2 and you would have seen how it fit in there.

Oh well... T'was a pleasure... Take care and don't give up on it...

JimmyClif

PS :So.. you think it's a crappy prog too? *hehehe* I love to hear this :D


A new class... join now!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A new class... join now!
PDA

View Full Version : A new class... join now!

Rage9
06-04-2001, 09:29 PM
I would like to run a small amount of newbie Reverse Engineering classes if its ok with all of you, first lesson, the easy jne patch and a newbie reverser problem.... it should not be too hard do it and have fun, another one will be comming soon...

Rage9's Crackme #1

http://www16.brinkster.com/realcool23/download/rcrackme1.zip

-brad
Kayaker
06-04-2001, 11:36 PM
Hi Rage9,

Sounds good. I modified your link slightly because it wasn't working as written.

Regards,
Kayaker
CoDe_InSiDe
06-05-2001, 12:08 AM
Hi Rage9,

Ah good thing ;)
I also had that kind of idea some time back, i had the idea to make some CrackMe's from very easy to a little bit harder (Offcourse not Impossible ;) )
So i think it's a nice thing for people to learn let's say "Some Basic Techniques" :)

Cya...

CoDe_InSiDe
CoDe_InSiDe
06-05-2001, 12:35 AM
Hi everyone,

Well, i just want to say that i resolved the 2 things that could be accomplished ;) (Patching and reversing).
I'm not going to tell the solution (yet ;) ) because i want that other people have a look at it ;)

Cya...

CoDe_InSiDe
Aleph
06-05-2001, 09:04 AM
Hiya all.

Rage9, i'm maybe (*probably*) missing a thing, but isn't there a kind of "gap" between the two tasks ?
I mean, patching the exe was done in 20 seconds, but I'm damn unable to complete the "reverse" part (actually, i wrote the code, but I don't know how to place some strings in the proggy to call 'em for the mbox) :(
Anyway, I think i'll have a play with BRW on this ;) ...

Regards,
Aleph
Rage9
06-05-2001, 02:04 PM
Dont worry too much about the reversing part, if you cant do it you cant, its acutally quite complicated at first. It requires a good knowledge of writing pure assembly code and knowing what it does, im sure if i dont write the essay someone else will....

-Rage9
netjunki
06-07-2001, 12:06 PM
[quote]Rage9 (06-04-2001 19:29):
I would like to run a small amount of newbie Reverse Engineering classes if its ok with all of you, first lesson, the easy jne patch and a newbie reverser problem.... it should not be too hard do it and have fun, another one will be comming soon..
well im the ultimate newbie cause i need help i went in with not pad and started changing the way it was writen like say two things were the same even when the wern't well all this did is make the program not run it had a problem with not enough conventional memory what am i doing wrong do i need to start my schooling at an even lower level than this please help cause im not computer illiterate
NeO'X'QuiCk
06-07-2001, 04:34 PM
Hello all !The idea is very good Rage9 ! I think that you couldnt do it more simple then already iS!To put Msg box inside isnt hard !SO Aleph if you have problems with it you should read more that will help!ANd Rage) about cracking i think you should do it more hard because i saw here more difficult project the this NAg !SO i think even if ppl should learn it better to make it a little harder not to hard because if it harder to do it harder to forget!

NeO'X'QuiCk
Rage9
06-07-2001, 06:25 PM
boop keep this a blank next message contains everything....
Rage9
06-07-2001, 06:41 PM
NeO'X'QuiCk: I understand your point but as you can see our freinds netjunki and Aleph can not do one part or all of that, hell everyone starts off like that, what did u just become a half decent reverse engineer over night? no at least not for me, it took long hours of reading through books on assembly language and mounts of reverse engineering tutorials to get this far and i think its important to help others who dont know how, beleive me it will get LOTS harder as the class goes on but you cant do the other advance stuff without know the basics, how many of us can say we learned to ride a bike without riding w/ training wheels? I dont know anyone who can say that.

netjunki : goto http://protools.cjb.net and click on 'Decompilers' and download 'W32DASM'

then click on 'Utilities' scroll down to 'Binary file editors' and download 'Hiew'

then go over to http://exagone.cjb.net/ and read everything in his 'Win32Asm Tutor' and read everything from the ' Introduction' down.

head over to http://webster.cs.ucr.edu/ and click on 'DOS Assembly' and scroll down to the text 'The Art of Assembly Language Programming' and click 'HTML Version' and read what you can it will keep you bussy for a while.

make a stop back here or head over to http://crackmes.cjb.net/ and read all the level 1 essays you can, you should then have a kinda hazy idea how to reverse engineer somthing simple... its alota work.

-brad
Aleph
06-08-2001, 07:47 AM
Dont worry too much about the reversing part, if you cant do it you cant, its acutally quite complicated at first. It requires a good knowledge of writing pure assembly code and knowing what it does

Woops, maybe i wasn't clear. I wrote the call in the proggy, and it's working fine. What I don't know yet is how to place my own title and text (for the messagebox) into the proggy :)...

Regards,
Aleph
NeO'X'QuicK
06-09-2001, 05:16 AM
Rage9 I meant the cracking part the revesing part is ok!!And above all you should putted up the reversmes uRl not cracking ones beucase ppl would learn more from REvermes the crackmes and there are a lot of the On Immortaldescendnats!!

NeO'X'QuiCk
JimmyClif
06-09-2001, 07:04 AM
Aleph,

Just dump the strings somewhere in the exe... where enough free space is available.
Probably somewhere at the end of a section ;D

Regards,
JimmyClif
Clandestiny
06-10-2001, 12:05 AM
Aleph (06-08-2001 05:47):
Woops, maybe i wasn't clear. I wrote the call in the proggy, and it's working fine. What I don't know yet is how to place my own title and text (for the messagebox) into the proggy :)...

Hiya Aleph,

I haven't done this particular crackme / reverseme so I can't offer any specifics, but maybe I can give you a few general pointers...

The first thing you need (if you don't have it already) is a copy of the win32 API reference. Looking up MessageBoxA in the reference reveals that it takes 4 parameters.

int MessageBox(

HWND hWnd, // handle of owner window
LPCTSTR lpText, // address of text in message box
LPCTSTR lpCaption, // address of title of message box
UINT uType // style of message box
);

All 4 of these parameters will be pushed on the stack prior to the call .

First off, the style of the MessageBox defines the appearence of the box...

MB_ABORTRETRYIGNORE The message box contains three push buttons: Abort, Retry, and Ignore.
MB_OK The message box contains one push button: OK. This is the default.
MB_OKCANCEL The message box contains two push buttons: OK and Cancel.
MB_RETRYCANCEL The message box contains two push buttons: Retry and Cancel.

These styles, MB_OK, MB_OKCANCEL, ect are actually defined constants and if memory serves me correct you should be able to find out their values by doing a search within the header file winuser.h (or from looking at the MessageBoxes referenced in a dead listing)... Anyway, you'll need to push the numerical value for the style of the messagebox you want.

Next, you have pointers to the text and title strings. In order to insert this text, you'll need to find some empty space in the file. Often there is some empty space at the end of the code section in the proggy. Here you'll write your desired title and text in a hex editor using the ASCII codes for the letters. The addresses where you place them are going to be the second and third parameters you push prior to the MessageBox call. Note, you'll also likely need to change the section characteristics from C0000020 to E0000020. This will allow the section to contain both data and executable code without crashing.

Lastly, is the handle to the window that owns the MessageBox. In the simplest case this parameter can simply be NULL.

Anyway, I hope the above is of some assistance to you. Feel free to ask additional questions if any part of it is not clear :)

To Neo :
While it may be true that there is more to be learned from the 'reversing' task than the 'cracking' task, it is necessary for most to begin at the beginning in their persuit of knowledge. Man, I didn't even know what an API was when I first began... but I sure have learned a whole hell of a lot since I inverted that first jump on a reg routine. And as such, simple tasks like changing a jump or noping a call are necessary stepping stones on path to gaining the knowledge and skills necessary to tackle more advanced issues. IMHO, a purely 'reversing' challenge is beyond the complete newbie and in most cases would lead to more discouragement than productive learning... We all crawl before we walk. Anyway, this is just my humble opinion based on my own personal experience.

Good Luck Guys :)

Regards,
Clandestiny
Clandestiny
06-10-2001, 01:30 PM
What happened to my post anyway ? The forum says I was the last person to post... but my post is gone ??? Well apparently not gone... let me rephrase the problem ;)

It seems that the last poster's message disappears until there has been another post, after which the message appears and the new poster's message becomes invisible....

Any ideas why this is happening ?

Clandestiny
Rage9
06-10-2001, 09:59 PM
anyone ready to post a small essay?

mine if someone doest post one in... ohhhhhh.... a day or so i will....

ok? any objections?? peace out...

-Rage9
Kayaker
06-11-2001, 06:27 PM
I've noticed this delay in posts that Clandestiny mentions before, in other boards as well. The latest post is by Hz, but it doesn't show - yet. I'm posting this just to see if I can "force" the previous one to show, to try to see why we're always one post behind.

'course if this works you won't see THIS one until later as well ;)

Kayaker
Rage9
06-12-2001, 12:45 PM
The essay is done, the essay is in the zip and the finnished exe, if your still working on it dont read it but if your done go ahead.... peace out.

-Rage9
Kayaker
06-12-2001, 09:38 PM
Hi Rage9,

Hey, nice project, and *very* nice essay about it. Well explained, step-by-step and informative, giving extra information about using hiew and the details of basic code injection. Very instructive and newbie-friendly ;)

This is exactly the kind of projects we need in here to help develop peoples interest in and understanding of reversing. Thanks for your efforts, and those helping with suggestions, they are much appreciated. I hope you've got a Lesson 2 for us to enjoy :)

Regards,
Kayaker
Rage9
06-13-2001, 04:06 PM
Thanx Kayaker and yes there is a lesson 2 comming, I will continue doing these until there is no intrest hopfully! The lesson 2 crackme will be done in a day or two, check you all later.

-Rage9
Kugi
06-14-2001, 03:01 PM
Hi Rage9,

Way to go! Great project. And, there are many of us interested in your next project.

Links to appropriate study pages and the attachment are very helpful. (No I didn't peek)

Thanks, Kugi
CoDe_InSiDe
06-14-2001, 04:07 PM
Hi everyone,

Kayaker, what's wrong with the messages again?
Kugi has posted an Message now, but first instead of his message was a message from "Rage9" with the text "bump" ? :)
Weird.

Cya...

CoDe_InSiDe
Kayaker
06-14-2001, 09:36 PM
Dunno CoDe_InSiDe. It only seems to be happening with this thread. I'm just bumping whoever posted last so their post is shown, which is what Rage9 did.

I've been deleting the 'bump' messages as they come up (I know I've got a couple outstanding ;)

To be assured your post shows, FOR THIS THREAD ONLY, just make a second post with whatever you want, and your 1st post will show up.

As I wrote in a now deleted bump post, I think it's some kind of temporal shift or something :)

"bump" was coined by Hz btw ;P

Kayaker
CoDe_InSiDe
06-15-2001, 02:18 AM
Hi Kayaker,

Ok, i get it now still pretty weird ;)

Cya...

CoDe_InSiDe
Joda
06-24-2001, 02:32 AM
Hey.

I'm in, too - a bit late but better late then never, isnt it.
I'm goin to try to do the msgbox job, too and then get over to the 2nd lesson.

cya later

Joda
Kayaker
06-24-2001, 06:03 PM
Cool Joda, feel free to post questions or results, these projects never really end y'know.
jim
06-28-2001, 05:07 PM
Hi,

I feel so sorry that I am going on holiday in two days' time. Can I join your class when I come back ? (May be several weeks from now). I am definitely interested in learning about r.e.

Jim
Rage9
06-29-2001, 05:01 PM
By all means join whenever you can, remember to real all the other eassays and the such.

-brad
zeeman
07-03-2001, 12:21 PM
Well, people, here I am, back again. I swear, if it's the last thing I ever learn whilst on this planet, it's how to crack an app!!!

I gotta say, though, the membership is HUGE!! With all these people, perhaps I'll make it this time. Anyway, I have a little time today, so I'll putz around for a bit, but I need to mow the lawn, and get my dog to the kennels - we're going away for several days, and these chores need to be done, otherwise my name is MUD!

TTYL
Zee.

p.s. From now on, ALWAYS thumbs up ... <g>
ThRaX
07-26-2001, 09:46 PM
Excellent! This helped me, a definite newbie, an amazing amount with code injection...code injection had always been scary, but this project was a really easy approach to it, very newbie friendly...sparked my interest in this sorta thing, that was cool =)
ThRaX
07-28-2001, 02:44 PM
Hey rage9/everyone else...this topics been kinda dead for the last few days

I say we get the next project goin...Perhaps since the last one was patching a conditional jump/code injection, maybe the next one should be serial fishing/calculation routine determining and possibly an extra credit keygen? ; )

--ThRaX
Rage9
07-29-2001, 04:52 PM
Wow guys, I love the suport. Yes I am working on the next lesson, serial fishing, oh hell yeah, the scheem with be a little harder and with a cool twist. right now im working full time and doing art on the side for a small german game developer, and trying to get this sneeked inbetween, ill put some time into it and hopfuly come out with somthing soon! ok? l8er all.

-Rage9
Rage9
07-29-2001, 04:55 PM
bumping my last message up, god this thread is screwed up


Novice-Intermediate Dumping Challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Novice-Intermediate Dumping Challenge
PDA

View Full Version : Novice-Intermediate Dumping Challenge

Kayaker
06-11-2001, 11:25 PM
Hi All,

I've got this little app called Ispy_001 which allows you to view the Windows messages being sent to a window you choose. It was written by Glynn Farrow in '99, but I really don't remember where I downloaded it from. I actually use it fairly often and find it quite useful.

I'd like to offer it up to the group for anyone who doesn't have such a utility, but I'm kinda mean and nasty and don't just want to 'give' it away. Soooo, what I did was to bundle it with PEBundle v1.02. PEBundle is "a tool that allows for DLLs or other files to be 'bundled' with an executable, therefore removing the requirement to distribute the bundled files separately from the application". It was written by Jeremy Collake and can be d/l from:
h**p://www.collakesoftware.com

Now Ispy is composed of 3 main files:

iSpy .exe main program
moushook.dll reqd library
msghook .dll reqd library

So I bundled Ispy with its 2 required dlls with the option NOT to extract the dlls to disk. Your task, if you choose to accept it, is to extract the 3 files from memory so they work as originally designed. The app works on Win95/98, not sure about Me/NT.

Of course I couldn't just give away the working bundled version, now could I? Else there'd be nothing to shoot for. Instead I bundled each dll *separately* with the exe file. So what you've now got is 2 files:

iSpy.exe + moushook.dll
and
iSpy.exe + msghook.dll

NOW you're getting the picture ;)

Neither file works by itself, but you can trace into it with SoftIce. There are no other hidden tricks or packing going on. If you can successfully dump the exe (from either bundled file), and the 2 dlls, you've got yourself a new reversing utility, newfound knowledge, and the satisfaction of doing it yourself. No other prizes will be awarded, subject to local laws ^_^

While not really necessary, you might want to d/l PEBundle and try it out yourself on a file with a required non-system dll. This way you can compare the original exe and dll(s) with your dumped versions and figure out how it does its thing, and how to get working dumps. Once you've figured out the trick you can easily apply it to iSpy. PEBundle comes with a GUI, but I used the command line version pebundle.exe. You may find the version at the site already expired, but I'm sure you can figure out how to get it to work ;)

Required (or acquired) knowledge: Basic PE file format, dumping with Icedump or other, rebuilding techniques, perhaps understanding of Import tables. There is more than 1 way to come up with working dumps.

I'll up a zip file containing the 2 bundled files, as well as the original help and readme files. The 2 bundled files are:
Ispy_bundled_with_Moushook.exe
Ispy_bundled_with_Msghook.exe
You can rename them as desired, but the dumped dlls must have their original names of course for the exe to recognize them. I'll also add the command line version of pebundle.exe I used. Just run in a DOS box without any parameters for usage instructions.

While you could probably figure it out without, I'll give this information to make dumping/rebuilding easier:

iSpy.exe:
Size of Image 11000, Entry Point 11CB
moushook.dll:
Size of Image 9000, Entry Point 1148
msghook.dll:
Size of Image 8000, Entry Point 1148

Oh yeah, I guess there should be some kind of "proof" that you've accomplished the task. In the Messages and Notifications List, what is the first Windows message listed? If the first has already been posted by somebody, what is the next, etc? Of course an instructive description of how you did it would be nice too.

That's about all I can think of for now.

Have fun!

Cheers,
Kayaker

EDIT: The project file has been reuploaded along with the original intact program files. Note that Ispy works on Win2K, but crashes with an invalid page fault on exit only. (Dec '03)
qferret
06-12-2001, 12:14 AM
count me in.....as I've pointed out in the past, I suck at unpacking LOL (in other words, I could really use the practice)

downloading as I type...then it's bedtime.....maybe try tomorrow (or maybe go fishing?) ;-)
Eternal Bliss
06-12-2001, 08:25 AM
Coincidence? Fate? Who knows? 8P

I was trying to unpack PECompact just yesterday after getting really bored with my revision... heh... noticed that he used PEBundle to bundle aplib.dll with it. heh

Have not found out how he did it yet...

How long will the project be on? I will be busy for the next 2 weeks I think... 8(

Seeya
EB
Clandestiny
06-12-2001, 10:38 AM
Hi All,

And thanks Kayaker for the new project :) It's good to see another PE file challenge. Like ?ferret, I'm not too hot at unpacking myself and so could definately use the practice / guidance.

Cheers,
Clandestiny
JimmyClif
06-12-2001, 11:32 AM
Hellau ;)

Woop.. it's sounds like fun... I already dumped msghook.dll and afterwards the prog is
working. Well.. I suppose... The first message anyways is (see below :) )
But I wonder? My dumps from the moushook.dll are all not working... I assume I just did
something wrong... I'll wait a bit until some more hints are available.

Cheers,
JimmyClif

PS: I love this PE fiddling stuff ;D ... as long as it is not AZPR it's all good *g*
Kayaker
06-12-2001, 05:27 PM
LOL JimmyClif, I never thought of that - one of the bundled exe's works when the missing dll is dumped from the other one. Dang, I knew I should have made it trickier.

You're on your honor then to dump 3 separate files to be considered successful ;)

Kayaker
JimmyClif
06-12-2001, 06:24 PM
Ah that was the problem... :D

I first dumped msghook.dll and then I tried running the iSpy+Mouse... it ran fine...
So then I dumped moushook.dll ran the iSpy+Msg to see if the dll was dumped fine and it crashed...

I thought this was some kind of trick behind the second dump... *lol*
It never came me into mind I've landed on the Anti-Cheating Gateway *g*

Now I can resume the work ;D

The bss section of the moushook.dll pointing to Raw Offset 0 ? Just a coiincidence ?
Why is it good for? Anyone know?

JimmyClif
seir
06-13-2001, 07:38 AM
Hi all,

after playing with PEBundle I noticed that the dll is simply appended
to the executable. It is not encrypted in any way, so it should be no
problem to extract the dll from the exe.
OK, after extracting the msghook.dll I tried to start Ispy_bundled_with_Moushook.exe,
but it didn't work. Hmm ... strange. With my example program all went
fine ...
Load msghook.dll in a PE editor and look at the directories. Do you
notice something strange ?
As I don't want to give the solution away right now, I will give only
a little hint: It seems like Kayaker exchanged two sections.
After fixing this the prog runs fine. Try to think what a dll is
supposed to do and you have the answer before your eyes ;)

- seir
JimmyClif
06-13-2001, 10:48 PM
Hola Kayaker, Hola Seir...

Thanks seir for the valuable tip ;)

I wonder why I needed a six pack of beer to figure this out *hehehe*

It's now 5:36am... birds are singing outside already.. and I feel pretty good.

Cheers,
JimmyClif

(t'was pretty mean tho)
Kayaker
06-13-2001, 11:07 PM
Sorry, I didn't do no exchanging of sections or nuttin'. I did say there were no hidden tricks. Though next time I think I will just so the grumbling is deserved ^_^

What appeared to be "funny"?

Kayaker
JimmyClif
06-13-2001, 11:15 PM
Kayaker,

You don't know? Now that's funny :D

Welcome in the club... you have to reverse your own project *g*

Nonono.... well.. I won't tell... I've been scratching my head for hours... and seirs clues are more than enough... even tho that he put me on the wrong track at first...

I guess it's only fair if you join the crew *lol*

JimmyClif
qferret
06-14-2001, 12:25 AM
Hey guys,

Looks like you got some interest on this one Kayaker.....good deal.

However, I haven't even looked at the files yet...I will in the morning I promise LOL

I went fishing for the past 3 days & took my A+ OS Tech exam today (I am now A+ certified, woohoo, next cert please) ....4 more days of vacation & thunderstorms predicted for all 4 of 'em.....rainin now actually :P.....So, I guess that gives me reversing time LOL

Enough off topic rambling, I'm off to bed. Looks like I got some catching up to do in the morning ;-)
Eternal Bliss
06-14-2001, 03:39 AM
Ok,
I neglected my revision and tried it. Can't bear the pulling power of the program sitting on my HD. Shouldn't have downloaded it. 8P

Ok.
I think I got it. 8P But I didn't copy down the messages. heh...

There is no tricks to the dll or the exe. They are all appended with a main loader that will run the program.

I traced by loading with symbol loader.

After a few blue screen of death (I seem to be getting them quite often nowadays), I found out what happened. 8P

Get the tips given, try and find out how to get the correct image size. Use a pe editor and look at the section names.

Can't exactly recall what I did but I dump the dlls immediately after I break with symbol loader. Then change all the physical section's size to the virtual ones.

As for the dumped exe, make sure the import table is correct. 8P

Hope I am not giving out too much. Delete it if it is too much. 8P

btw, PECompact uses a more "advanced" pebundle I think. Solved it too using the same principle. Dump the stuff before they get initialised.

Regards
EB
seir
06-14-2001, 06:17 AM
Hi again,

as I described above the programs seem to work fine, but if you
take a closer look ...
When starting Ispy_bundled_with_Moushook.exe the program starts,
but the "choose window" button doesn't work.

When starting Ispy_bundled_with_Msghook.exe the program starts
and the "choose window" button works fine. But then it is not
able to capture the windows you move over with the mouse.
So something doesn't work as it should ...

I tried to extract the original ispy.exe, but it didn't work so
far.
I don't understand why it doesn't work, because PEBundle leaves
our exe and dll untouched. It only changes the PE header and adds
its sections. The loader is located in the pebundle section.
So to Eternal bliss: There is no need to dump our files, you can
easily copy them from our PEBundled EXE. They are neither packed
nor encrypted ! (HINT: Look for the MZ header to get to
beginning of our dll, it is in fact the start of the .pe section :)
This means to get the original EXE you can delete all the sections
added by PEBundle, change the Entrypoint, change the image size
and the import table to its original values. But trying this the
program crashes when trying to call _GetMainArgs ...
Anyone successfully extracted the ispy.exe ?

- seir
Eternal Bliss
06-14-2001, 06:32 AM
seir (06-14-2001 04:17):
I tried to extract the original ispy.exe, but it didn't work so far.
I don't understand why it doesn't work, because PEBundle leaves our exe and dll untouched. It only changes the PE header and adds its sections. The loader is located in the pebundle section.
So to Eternal bliss: There is no need to dump our files, you can easily copy them from our PEBundled EXE. They are neither packed
nor encrypted ! (HINT: Look for the MZ header to get to beginning of our dll, it is in fact the start of the .pe section :)
This means to get the original EXE you can delete all the sections added by PEBundle, change the Entrypoint, change the image size
and the import table to its original values. But trying this the program crashes when trying to call _GetMainArgs ...
Anyone successfully extracted the ispy.exe ?
- seir

Hiya,
that's why I extracted dump the exe and the dlls when it is loaded in memory. I tried what you said before. I just copy and paste the various sections (correct ones) to make up the exe and the dlls. I got my blue screen of death and had to reboot my computer a few times. 8)

However, if I dump them from memory, it is ok with the few alterations I mentioned above.

Regards
EB
seir
06-14-2001, 07:26 AM
Yeah ! Got it to work. It is pretty easy in fact. To make life easier for
you, I will give some hints:

1) You don't need any silly dumping. All what you need is in the
PEBundled exe. It's not encrypted or packed.

2) To get the original exe file, look at my post above.

3) The extracted dlls need a little change. As I already said there
is something wrong with the sections. They are not exchanged as
I thought first, but 2 sections are displaced.

That was a nice challenge, although it was not really unpacking.
Hope to see more from these soon.

The second entry in the messages and notifications window is:
0x0000 0 STN_CLICKED

Have phun,

- seir
CoDe_InSiDe
06-14-2001, 09:07 AM
Hi everyone,

Ok, this was pretty simple actually ;D
I'm just here to say i solved it ;)

Cya...

CoDe_InSiDe
JimmyClif
06-14-2001, 09:24 AM
I wonder if that was a bug inside Pe-Bundle, as Kayaker said there were no extra tricks...
But when I bundled my own exe to some dll it went fine... there was no strange Section shifting going on...

I've extracted them nicely too and *woop* this is a real helpful tool...

...but I have another question here:

Once I f*cked up an exe and I get told that I couldn't delete it as it is in use..etc..
Is there any way to delete it besides having a reboot?

JimmyClif
CoDe_InSiDe
06-14-2001, 10:03 AM
Hi everyone,

JimmyClif: i don't know if it can be done (It probably can) but you can't do it with ProcDump for example ;)

And about my own stuff that i did it, i think i should explain a little? :)

Should I?

I never want to spoil the fun for others so that's why i'm asking if i need to explain how i did it? ;D

Cya...

CoDe_InSiDe

P.S. actually it's exactly what Seir says :)
Kayaker
06-14-2001, 11:31 AM
Ah man, you guys are too good ;) It wasn't meant to be really hard, just to have a look at something a little different. I'll definitely have to make the next one harder.

I was hoping it would be approached as EB did, by dumping from memory. It was strictly a dumping exercise. I did raw dumps and rebuilt them with PEditor. I did /pedumps and found I couldn't use the default options on the dlls. I thought this was interesting and thought someone might pick up on it, having to use the /option P command in Icedump.

JimmyClif, I use something called bust-it which calls TerminateProcess unconditionally on any app running, visible or not. You should be able to use Procdump's Killtask which works the same way.

Cheers,
Kayaker
JimmyClif
06-14-2001, 11:48 AM
Oh...

I did memory dumps... checking my trashcan counts approx. 10 dll's of each and 6 iSpy.exe's *hehehe*

The "Delete"-thing I have sometimes is that the exe crashes and it isn't listed in procdump or in the Ctrl-Alt-Del thing. I just wondered if I was the only one screwing up exe's sometimes that way ;)
CoDe_InSiDe
06-14-2001, 12:51 PM
Hi JimmyClif,

Nope, your not the only one ;)
It's often when the Import Table RVA isn't linked correctly, or any of the links that belong to that ;)

And btw if i recall correctly TerminateProcess can't kill it ;)
I haven't searched deep for this, but i do know that ProcDump can't handle it ;D

Btw, Eternal Bliss: thx for the Tutorial, i'm not angry ;D
I'm glad someone made a Tutorial for it ;)

Cya...

CoDe_InSiDe
Clandestiny
06-14-2001, 11:21 PM
Hi All,

I'm glad you guys all found this particularly "easy" ... but I for one am having some problems. On the bright side though I guess this means I'll have the whole lot of you PE gurus to help me out ;)

...I'll explain my resoning throughout the process, what I've attempted and why. You'll have to forgive me if I restate the obvious, but I'm a *complete* beginner to PE manipulations. I've only manually unpacked a couple of proggies prior to this point and they were the very simple packers...

Lets see, I started out on this project by rereading the PE docs (again). This lead me to the understanding that a .dll must also follow the PE format like an .exe. Having no prior experience w/ dumping or unpacking dll's, I found this to be an interesting piece of info which lead me to the realization that my PE Bundled file should have 2 PE headers, 1 for the .exe and 1 for the .dll (provided it was not packed or encrypted). After examining the file I concluded that it did indeed have 2 headers, the second one being in the disguise of the .pe section.

Next, I figured I should PE Bundle a file and its .dll for reference / comparison. My target turned out to be none other than Regmon and Kayaker's RegmPlus.dll. Examining the before and after versions of these I was able to confirm that the .dll was indeed appended to the .exe as was previously mentioned. Moreover all of the sections of the .exe and the .dll remained intact with only 2 noticable differences: 1) The PE header of the .dll was placed under the guise of the .pe section 2) There was an extraneous .pebundle section at the end of the file.

Someone mentioned this earlier, but being as the file was not packed the thought also crossed my mind that it might be able to be extracted w/o dumping by using only the disk image. I disregarded exploring this possiblity for the simple reason that I knew it would be easier having all of the physical and virtual offsets the same. ...So I dumped the entire image in memory to disk (some 32000 bytes) using IceDump's /dump feature.

Then I fired it up in Ultra Edit's hex editor and separated my 32000 byte image into 2 separate files using the second MZ header to define the point of separation. The first of these was the executable at 11000 bytes and the second the moushook.dll at 900 bytes. I also deleted the .pebundle section on the end of the moushook.dll.

Now, I *tried* to fixup the headers on both of these files.

For the .dll I only fixed a couple of things. The entry point was unmodified and so was the image size (with the .pebundle section trimmed off). Likewise the pointer to the import table looked ok as far as I could tell and I confirmed that it had the correct number of sections (8). The only thing I really changed was all of the physical offsets / sizes to the virtual offset /size values.

Now, the .exe was a little harder. Here I had to fix both the entry point (11CBh) and the image size (11000h). I also had to change all of the physical offsets and sizes to virtual ones and change the number of sections to the correct number of 6. Likewise the import table had to be fixed as it had previously pointed to a location in the .pebundle section. This part I was a little shaky on. In fact, it took me some time to figure out how to locate what I *think* to be the import table since I've never done this before. Basically, I did an ascii text search for the KERNEL32.dll found out what address the name was located at and did another hex search for where that address was refereced. Presumably, this would be in my array of Import Directories which contains pointers to the .dll names. Following my trusty PE offset guide I backtraced till I found what appeared to be the very first Import Directory located at F000. I'm assuming this is the new value for the Import Table pointer. From tracing this array of Import Dirctories I also think the size of the table should be 70h.

After extracting msghook.dll the same way as the mousehook.dll, I crossed my fingers and went to run my new proggy. The good news: It doesn't crash !!! Indeed, the main window comes up and I can select the option to choose a window off the menu... BUT thats where the good news ends. The bad news is that it doesn't seem to be logging any messages. Though I can select the window for message logging, it thereafter hangs and I have to kill the process.

Oh, and I should mention that I successfully managed to extract all three files from my PE Bundled Regmon using the technique I outlined above.

No doubt I've done something wrong along the way. I'll really appreciate all the help / criticism I can get :-)

Thanks,
Clandestiny

PS: I'm attaching my attempted extraction of the three files.
Kayaker
06-15-2001, 12:57 AM
Hi Clandestiny,

Just a quick note, your 3 dumped files seem to work fine on my system, I had no problems logging windows messages. Right click on a window, select OK, highlight that window again and it's log-ho! The only thing I've noticed with this app is that if you close the window you're monitoring without stopping logging, it will hang. Beyond that, it looks like you did great. If you still have problems I'll send you the original to see if it behaves the same way.

Primed for a harder challenge now? ;)

Cheers,
Kayaker
Clandestiny
06-15-2001, 11:19 AM
Kayaker (06-14-2001 22:57):
Just a quick note, your 3 dumped files seem to work fine on my system, I had no problems logging windows messages. Right click on a window, select OK, highlight that window again and it's log-ho!

hehe, thanks Kayaker... apparently I rebuilt it correctly, but just couldn't figure out how to use the proggy ;) I got as far as right clicking on a window and selecting OK, but I didn't realize you had to highlight the window again for it to log messages. How about that ispy.hlp file, Kayaker ? Why don't you u/l it to the board for us ? ;D

The only thing I've noticed with this app is that if you close the window you're monitoring without stopping logging, it will hang.

Yup, that was the bug I noticed. I closed the windows thinking it wasn't working.

Primed for a harder challenge now? ;)
Already got another one ready ? Sure, I'll give it a go :) Good project, btw.

Cheers,
Clandestiny
qferret
06-15-2001, 01:18 PM
Well, I'm reading up on some PE docs to try to figure it out yet LOL. I'm pretty much screwed as far as dumping anything from Softice w/ IceDump. /screendump, /dump, and /pedump ALL generate GPF's on my box now. Last week /dump worked fine. Oh well, I'll reinstall SOftIce & see if that helps at all.

At least dumping isn't necessary this time around hehe.

Regards,

?ferret
qferret
06-15-2001, 02:58 PM
OK....I'm friggin lost ;-)

ANY tips, relevant docs appreciated.

Peering Inside the PE A Tour of the Win32 Portable Executable File Format by Matt Pietrik, although somewhat informative, does little more than describe what each section in the section table is for.

I've tried everything I could think of that I thought *might* work, causing everything from absolutely nothin to happen, to program hang (w/ no way to get rid of it w/o rebooting hehe), to complete system hang. This is my first time attempting anything with PE files other than changing characteristics, so go easy on me guys ;-)

btw....the dumpfixer option in PEEditor didn't help either ;-)
JimmyClif
06-15-2001, 03:28 PM
?ferret,
I found Luevelsmeyer's doc very informative...

and a doc at this url:
http://www.immortaldescendants.org./database/essays/fboyjoe/exe_hdr.html

Later ;D
JimmyC
Clandestiny
06-16-2001, 01:06 PM
Hi All,

After getting my dumped files to run and having a semi-understanding about the PE header, I thought I'd try to extract them again without dumping.

I dumped the first time for the simple reason that I don't have too clear a picture of the relationship between virtual / physical offsets and sizes. By dumping, everything lines up prettily in the hex editor ;) ...but I think this is something I should learn and not evade so I'm trying it again using only the disk image.

I don't think this should be too hard, BUT I'm getting really confused. Previously, I only needed to look at the hex addresses to fix up the Image Size, Pointer to Imports and the like. Now, I know some kinda conversion has to be made and I d/l Lazarus's RVA converter, but I'm not sure how this should be done or if this is even the tool I need to use.

Some docs / examples of this sort of thing would be great :)

To ?ferret:
Why don't you u/l what you've got so far so one of us can take a look at it and see if we can help you get unstuck. Also, check my post above. I think I explained my thought process pretty thouroughly and it might give you some ideas. If some part of it isn't clear, just ask. I'm new to unpacking too... took me over an hour just to figure out how to find the import table so I could change the pointer ;-)

Cheers to all,
Clandestiny
JimmyClif
06-16-2001, 09:22 PM
Heya everybody ;)

I hooked out the phone today to be left alone and then I started getting bored nontheless :(

So I played around with iSpy a bit and it kind of irritated me that all those messages were floating that fast thru this little window when all options were selected. To make the story short I added a Logging file to it.

This inline patch is far from being perfect but it works!

Known bugs:
* I forgot to call CloseHandle at the end.. (And now I don't have the place to add it anymore)
* When it overwrites the Logger.txt file the highlighting of the window's disappear when moving your mouse while choosing a window.
* It may crash after +/- 65000 letters written. ;D (not tested tho.. but I'm pretty certain due to "Out of Memory" *g*)

If anyone wants to pick up the task, feel welcome... I just wanted to test Iczelions SnippetCreator ;)

J
qferret
06-16-2001, 11:19 PM
Got it....thank God for ICQ & JimmyCliff.

I now have a basic understanding of PE's.....thx for the project & the util Kayaker.

.......NEXT!
seir
06-17-2001, 04:48 PM
Hey JimmyClif,

nice idea with the logging function. Actually I had the same
idea. First I wanted to add a scrollbar, but this is a bit
difficult, because the messages are not in a regular edit box.
So I had a look at your work ... some criticism:

1) As you already mentioned you forgot CloseHandle
2) The file is created, when you click the ChooseWindow item,
but what is when you cancel ;)
3) Ispy crashes when the file size is greater 65535
4) You don't log wparam and lparam

OK. Enough reasons for writing an own logging function.
Actually it was a good pratice for stage 3 of the Reversing Course.
There I also have to implement a logging function ;)
It should work fine. If you find any bugs tell me.

- seir
JimmyClif
06-17-2001, 05:36 PM
Heya Seir,

I know all this.. but I've just done it pretty quick... ;P and really didn't felt like doing more...

4) I logged the w & lparam at first but it crashed due to some unknown reason.. I guess it was because the messageflood from iSpy was a little bit too quick and my loops were too slow and the MessageLoop couldn't handle it.. Basically I don't know :P

2) You shouldn't press Cancel ;) as it opens a file but never uses it *g* I thought about disabling that Cancel button for a minute *hehehe*

3) Well.. yes.. as I allocated only enough Mem for FFFF bytes ( /me shrugs ) Should be enough tho...

1) heh... No one is perfect...

Oh well... I guess I could have coded it cleaner... Rewritten it again leaving out the nops.. etc..

I know.. this was a constructive critic ;) Maybe I shouldn't release pre-pre-alpha's in future...

Best Regards,
-J-
seir
06-18-2001, 06:04 AM
Hi all,

OK. I found one little bug that I forgot to fix. When you want
to spy on ispy itself it crashes instead of giving the error message.
That is because you can't do something like this with masm:
(I used Iczelion Code Snippet Creator to add my code)

> cmp dword ptr[00405030h], edi

This is not allowed because of the immediate value. So I replaced
00405030h simply with one of my data variables. After compiling
I had to correct this everytime and change it back to 405030h.
This was the thing I forgot and so the prog crashes ...

A little workaround for this would be:

> mov eax, 00405030h
> cmp dword ptr[eax], edi

So it is not an immediate value anymore and masm accepts it. That means
you don't have to correct this after compiling.
I attached the fixed ispy. Now it should really be bugless ;)

Greetz,

- seir
dreamweavermx
11-29-2003, 04:53 AM
Could all you please write a tutor ?
dELTA
11-29-2003, 07:15 AM
Considering the date of that thread, the majority of people participating in it are most likely dead and buried by now.... or have at least forgotten any and all details about that little project anyway. ;)
esther
11-29-2003, 10:30 AM
And the target file is lost.

There's no way to "play" with it :(
Kayaker
11-29-2003, 01:18 PM
>...majority of people participating in it are most likely dead and buried by now....

Hellooo, not everyone got eaten by polar bears ;)

>And the target file is lost

Our old venerable leader 'cleaned' up the database at one point and a lot of attachments were lost, I may still have it on my old unplugged computer, if I can find it I'll reupload it.

Wouldn't help this poster much anyway, different version plus he's looking for a different kind of answer. I know, "Please I need it urgently" , other forum's answers didn't help right? A few general points, I happened to unpebundle something the other day which made an interesting use of bundling/executing a sys driver, and I was interested in the technique.

What you need is general unpacking experience and patience, not a blind tutorial. It's really not much harder than UPX or anything, use Softice, observe where the import decryption loop is, find where the break out of that loop is (a basic point of understanding when dealing with any loops), and soon after you'll find the push OEP, ret. (not every push address/ret is the OEP one)

Be half aware of what the decryption loops are doing and after a few times tracing you'll find you can set advanced breakpoints on bits of code such as 'pushad' commands, use the data window to see when these particular addresses are fully decrypted. You can probably find 2 or 3 reliable bp's after several times tracing that will hop/skip to the OEP each time.

I did see a peculiar effect with this app/protector, with the Win2K debug symbols loaded for the main system dlls, everytime I hit the IAT decryption loop(s) the SI command window would spit out some defining text as to the imports that had been decrypted. Very strange yet very interesting effect I haven't confirmed with any other app. Anyone ever experience something like that?

Other than that I can't help with your urgent need for a tutorial to crack some pebundled app.

Kayaker
dreamweavermx
11-29-2003, 11:38 PM
Thanks so much for your advise , Kayaker.
Kayaker
12-01-2003, 01:38 AM
For what it's worth, I reuploaded the project file to the first post, this time along with the original Ispy program files. Surprisingly, it actually works on Win2K, though crashes on exit (gracefully however), might still be of some use then.

K.


Lesson #2.... Lets Rock!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Lesson #2.... Lets Rock!
PDA

View Full Version : Lesson #2.... Lets Rock!

Rage9
06-15-2001, 10:03 AM
You guys asked for it Lesson 2 is ready, this one is a bit harder then the last, freel free to work togeather and/or form teams or somthing... if your not real familiar with windows api you better download the help file http://www.win32asm.com/files/win32api.zip .Three things to do this crackme so if you need a hint or having lots of trouble post or e-mail me, ok? Rock on and remember to have fun!

http://www16.brinkster.com/realcool23/download/rage2.zip

-Brad
realcool23@yahoo.com
CoDe_InSiDe
06-15-2001, 12:45 PM
Hi Rage9,

Hmm... Keygen ?? ;D (Hint)

Let the Reversing begin ;)
I'll be back...

Cya...

CoDe_InSiDe
CoDe_InSiDe
06-15-2001, 01:02 PM
Hi Rage9,

Ok, done :)
Let's wait for the other people first since i'm the only one posting yet ;D

Cya...

CoDe_InSiDe
sludge
06-15-2001, 04:29 PM
ooo, ill give it a shot, i could use the practice.
C_DKnight
06-16-2001, 09:52 AM
ok i'm bored so i'm in. mebbe c ya later

-cdk
Muad'Dib
06-17-2001, 01:31 AM
I, too, have finished this one. Lets hope there are harder challenges to come =) A question: was the keygen part a mistake in coding or a trick? (hint :) Keep 'em coming.
AirW0lf
06-17-2001, 01:32 AM
Yo all! rage9, nice crackme =] Ive destroyed the nag and added the messagebox when entering a wrong serial. But it looks to me the crackme has a bug, or 'feature'. I always get the same serial, no matter what is the name or the machine. Is it right? Its very late here, I might be wrong...

AirW0lf
---
THeHeRmiT
06-17-2001, 07:49 AM
hey people! im glad you confirmed that there was only one serial, as i thought there might have been some little trick, seeing as the name went through a little process before hand.
i did the messagebox part as well, BUT i am ashamed to say that the nag screen has got me! ive been trying but keep failing
please someone give me some clue...
C_DKnight
06-17-2001, 11:00 AM
yea ok. i've worked all the parts and as muad said was a bit too easy but am not complaining: was the first time over a month+ that got me to touch softice again ;-) and yeah it seems like it's hard-coded serial, maybe a bit "lame" but probably because it was easier (?) to have the msgbox to show it ;)

and as a hint to thehermit, i've no idea what way did muad and airwolf go but i messed around with dialogboxparam call(s) ;) hopefully hinting to bp on settimer/killtimer doesn't ruin anyone's attempts too much, but is a way i used anyway.

any questions? my email is included..

-cdk
AirW0lf
06-17-2001, 12:26 PM
First of all, thanks Muad for all your help, that live tutorial rox =] Im adding some code to the crackme to fix the bug... Ill show to you guys as soon as I finish it.

Second, C_DKnight, its not a hard-coded serial... check it out ;) This is how Ive cracked the splash,

00401000 public start
00401000 start proc near
00401000 push 0
00401002 call j_GetModuleHandleA
00401007 mov dword_403074, eax
0040100C push 0
**40100E push offset sub_401165 Thats the DlgProc (Kayaker explains it in this same forum, another thread ;)
00401013 push 0
00401015 push offset aSplash ; "SPLASH"

then

00401165 push ebp
00401166 mov ebp, esp
00401168 cmp [ebp+arg_4], 110h
0040116F jnz short loc_401197 ; We dont want to go here, we want to jump this code to 40119D
00401171 push 0
00401173 push 3E8h
00401178 push 3F3h
0040117D push [ebp+arg_0]
00401180 call j_SetTimer

---
00401197 cmp [ebp+arg_4], 10h
0040119B jnz short loc_4011C2
0040119D push 0

Why 40119D and not 401197? Because 401197 is handleing the WM_CLOSE event, and as [ebp+arg_4] is NOT 10h, its 110h, it would jump out of the code we want. So I changed two bytes at 00401171 push 00 (6A00) to jmp 40119D (EB2A)
and it works =]
btw, check the EB2A, Im almost sure thats the opcode

AirW0lf
---
Muad'Dib
06-17-2001, 01:52 PM
Now that a few people have solved this crackme, I'll explain WHY it is always the same serial. Rather than spoiling it for everyone who wants to solve it themselves, you can see the attached file (it also explains an effective way to patch the nag).
Rage9
06-17-2001, 05:25 PM
Good job guys! Yeah it was actually intended to see how many people i could fool with a fake serial routine! It just kinda happened and then i decided to pass it to you guys and not fix it.... but Muad'Dib didn't really explain why it was like that... he just said.."Aha! Rather than returning the serial that was generated, it rather returns the POINTER to the serial that was generated." actually..... NO! after sifting through the code i found that it was all in the call to the api SetDlgItemInt! with the one you guys have the original asembly line looked like:

invoke SetDlgItemInt,hWnd,IDC_PASS, addr checker,FALSE

but apon changing it to

invoke SetDlgItemInt,hWnd,IDC_PASS, checker,FALSE

the proc indeed returns a value that can be used! see i was passing the address of the address of the variable checker! thats why otherwise she seems to work darn good!

but i do agree with Muad'Dib's way to solving the nag screen, it is the easiest way i see! im still going to write the essay cuz i have been e-mailed requesting it... peace out!

-Brad
Muad'Dib
06-17-2001, 08:29 PM
Exactly what I was saying, it returns the pointer to (the address) of the variable rather than the contents of the variable.
Rage9
06-17-2001, 10:20 PM
sorry my bad, you put it right after the serial generation code, so i assumed that you where saying the generation code returned the pointer, sorry!

-brad
Rage9
06-20-2001, 11:18 PM
For those who want to read an essay......

-Brad
ThRaX
07-28-2001, 02:50 PM
Woah! looks like i totally missed this message, as there had been no replies in the last 30 days and i've been gone...well im workin' on it now ; )
Sphinx
07-28-2001, 03:12 PM
you got you're self a new student iám going to give it a try
ThRaX
07-29-2001, 10:18 AM
Lesson 3? ; )
Sphinx
07-29-2001, 11:59 AM
well i found the routine easy but when i was tracing it i saw a number that could be the serial i wrote it down and tried it guess what it is the serial. I think oke now try another serial to see how the routine works, thoughed i missed a peice where the serial was made the first time but i found the same serial over and over
oke lets try other name with that serial that worked. Oke just on right serial , but what do i have to keygen then just read name and return the serial i didn`t do that i`m looking @ those other things know little more difficult for me.
Sphinx
07-30-2001, 10:25 AM
well i did it well more or less just read the text file and look @ the patched exe pls do and let me know what you think it's the first time i wrote something down for others to read


Messin' with the Import table
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Messin' with the Import table
PDA

View Full Version : Messin' with the Import table

Kayaker
06-20-2001, 11:36 PM
'Lo All,

How about a little challenge this time to manually rebuild an Import table? There's an interesting reversing task as well once the first step is done.

Again I offer up a unique reversing tool as a target, called KeyCode, which is "An auxiliary utility for developers. It gets information generated by Windows under pressed/depressed keys. Such information may be messages sent by Windows, virtual key code, OEM scan code, etc. The utility hides its own window after switching on another application, besides the program activation may be carried out by pressing the hotkey (Ctrl-F12) from any application. The program is freeware and freely distributable". (7K attached file)

PART 1:

What I did was first to dump the program from memory so the Virtual and Raw Offsets would be equal. This makes rebuilding so much easier while working in a hex editor, which is where you're going to be spending most of your time btw, heheh. There and in PEditor.

This was the end of me being Mr. Nice Guy though. I then made 3 distinct types of changes to the Import table. Your job is obvious. The problems aren't extremely difficult, but I think that by the end of it anyone unfamiliar with exactly how the Import section is constructed will have a much better handle on it. I tried to leave enough clues as to the structure of the section that even if you're confused by the documentation, it can still be figured out strictly as a logic exercise. (sort of like a Myst puzzle :)

A few recommended refs:

Iczelion's PE Format Tutorials (Tutorial 6: Import Table)
http://win32asm.cjb.net/

[yAtEs] Understanding Import Tables
http://66.98.132.48/yates/Import_tables.txt

TiTi - PE Files Import Table Rebuilding
http://66.98.132.48/yates/rebuild.txt

PART 2:

The app has the annoying habit of hiding itself as soon as it loses mouse focus. You call it up again with Ctrl-F12. This is by design, so be careful when you're testing during the 1st part, you may have been successful but miss seeing the small window.

The second challenge is to stop the window from hiding itself. Quite do-able in several ways.

Lemme know if there's any questions.

Cheers and Good Luck,
Kayaker

EDIT: Project file reuploaded, this time along with the original KeyInfo program files, Links updated. Dec '03
ThrawN
06-20-2001, 11:55 PM
interesting timezone you must be in to write a post at this time. U from down south in australia or something? :)
CoDe_InSiDe
06-21-2001, 12:28 AM
Hi Kayaker,

Hmm.. you made a little mistake in the Import Table ;D
Because the "Base Address" doesn't exists in my System ;)
It was in your "Memory" but not here, now i can never retrieve the correct API, but i'll find it in some way ;D

Cya...

CoDe_InSiDe
CoDe_InSiDe
06-21-2001, 12:37 AM
Btw nice "holes" ;D

Cya...

CoDe_InSiDe
CoDe_InSiDe
06-21-2001, 12:52 AM
Hi Kayaker,

I think i found the correct API now ;D
The prog runs, on to part 2 ;)

Cya...

CoDe_InSiDe
CoDe_InSiDe
06-21-2001, 12:57 AM
Hi Kayaker,

Ok, part 2 doine ;D
Err... am i too fast? ;)

(Show The Fricking Window) Hint :)

Cya...

CoDe_InSiDe
Kayaker
06-21-2001, 01:04 AM
Heh heh, you're just too damned fast CoDe_InSiDe. I was just going to up my Win98 copy of the dll in question, when you found the 'lost' API.

Duh, I never even thought of that. I gotta start working on more platforms to be aware of this ;) Do you think I should still up the dll or do you think others could find it as you did, and this could just be part of the challenge for some?

LOL ThrawN. No, I'm in a far Northern time zone, eh? I just keep strange hours, as proven by this even later post ^_^

Kayaker
Kayaker
06-21-2001, 01:12 AM
CoDe_InSiDe (06-20-2001 22:57):
Hi Kayaker,

Ok, part 2 doine ;D
Err... am i too fast? ;)

(Show The Fricking Window) Hint :)

Cya...

CoDe_InSiDe

OK, that's it. Next time you get a special CoDe_InSiDe-only, mega-crippled, self-destruct version of the challenge. Sheesh, I can't even keep ahead of your posts! ;D

Regards
CoDe_InSiDe
06-21-2001, 01:35 AM
Hi Kayaker,

haha LOL ;D
A Mega-Crippled, Self-Destruct Version sounds good ;)

But anyway, well you can leave it as an Challenge option, for "The Lost API" :)
I found it by first checking what was pushed for the API, and then thinking a bit and running down Win32.hlp, and tried some ofcourse ;)

So to anyone that has problems finding "The Lost API", try to look for what it pushes and then think a bit about what it is related to? :)

Then if someone still has problems you can put the DLL ;)

And about Part 2, the solution is quite obvious :)
The program "Hides" itself, so what do you need to "Unhide" it? ;)

Cya...

CoDe_InSiDe
seir
06-21-2001, 07:43 AM
Hi all,

again nice challenge Kayaker and again an other tool to play with.
As part2 of the challenge says you have to stop the window from
hiding itself. Yep, that is an easy task. So for the reverser out
there a little extra challenge:

- Make the window to stay always on top.

It is in fact pretty easy to achieve, you only need one function
(which you have to add to the imports first).
I won't post the solution yet, but if someone has troubles I will
give some hints ;)

- seir
qferret
06-22-2001, 08:10 PM
Call me a glutton for punishment...but I'll try it ;-)
Kayaker
06-22-2001, 10:09 PM
Hi All,

Just want to make sure that anyone spinning their wheels on this one isn't left at the starting gate. I'm wondering if this is the type of project people want to see. Too hard? Too easy? Too boring? Not pertinent?

In response to the last one, I'd say becoming familiar with manually modifying the Import table is *very* pertinent to our sport. Many packers alter the IT, and even Revirgin won't do it all automatically or is even able to handle certain packers. As for Seir's excellent suggestion on adding an Import so you can call that API to handle some function, this is where it becomes pure reversing fun.

The 2 refs I gave should cover it all, but it's probably all pretty confusing on 1st (and 2nd, and 3rd...) reading. I'm not an Import guru by any means, but I'll try to cover what might be important in all that crapola just so those unclear on the concept have some framework to work with. (Hope I don't screw up ;)

I guess the first thing is wheredahell is the Import table? If the name hasn't been changed purposely, then it's usually at the raw offset of the default named .idata section. If this section has been renamed, there's always an RVA (relative virtual address, i.e. "in memory") pointer to it at byte 80h of the PE header. So look for the word 'PE' in a hex editor near the start of the file and add 80 bytes. Subtract from this dword pointer address any difference between the Relative and Raw offsets of the section and you've found it.

I'm not going to repeat the excellent descriptions in the refs I gave, just give a hint as to where to start. I think of the Import table proper as having 4 sections, the IMAGE_IMPORT_DESCRIPTOR (IID), the OriginalFirstThunk, the FirstThunk, and the ASCII names (IMAGE_IMPORT_BY_NAME) section.

The 1st section you'll see is the IID, which consists of a set of 5 dwords giving info about 1 dll. There's one IID for each dll, one after another, and the section is terminated with a set of 5 empty dwords, i.e. all '0000 0000'. This is where you should start examining the changes I made to the file.

The 1st dword in each IID is a pointer to the OriginalFirstThunk. The OriginalFirstThunk doesn't always exist, so sometimes you'll see this dword empty. If it does, the dword will be an RVA pointer to the start of an array, or table, that contains *other* RVA pointers to the ASCII name of each API in the dll. Each OriginalFirstThunk array is terminated by a single empty dword, so this is how you can recognize the *next* OFT section for the next dll.

The 5th dword in each IID is a pointer to the FirstThunk, which is essentially a duplicate of the OriginalFirstThunk. The difference between the two can be seen if you dump the file from memory, or look at the Import table while in SoftIce. The FirstThunk now contains the actual memory addresses of each API, instead of just RVA pointers to the ASCII name. This is done when the PE file loads in memory, the FirstThunk is initialized. Actually, if you look at your copy of notepad, you may see that the FirstThunk already contains the real addresses for each API.

The 4th dword of the IID is just a pointer to the name of the dll.

I think this should be enough info to start trying to rebuild the Import table I f***** up. Hope this helps.

BTW, I thought of another possibility to extend this project, after trying Seir's task of course. It strikes me we have the beginnings of a keyboard logger here. The program is already processing keystrokes, you'd just need to dump the characters to a buffer perhaps, and write the buffer to a file after so many keystrokes. Any takers? ;D

Kayaker
qferret
06-22-2001, 11:25 PM
I volunteer CoDe_InSiDe for the keylogger LOL
CoDe_InSiDe
06-23-2001, 12:32 AM
Hehe qferret ;)
Maybe i'll take a look at it, dunno yet ;)
I'm currently busy with Unpacking stuff ;D

Cya...

CoDe_InSiDe

P.S. does any of you guys outthere, have the Encrypter "NoodleCrypt v1" or know any URL to it??? :)
I'm searching desperately for it ;D
TIA
Clandestiny
06-23-2001, 01:55 PM
Hi All,

Well, I think I've got it pretty much fixed, except for that darn missing API... As soon as I find it I'll post some of my results. Anyway, just wanted to poke my head in and say I'm working on it :)

And also, for anyone who's as new to this as I am, I found an EXCELLENT tut on rebuilding the import table. After I read it through a couple of times things started to make so much more sense. I'm gonna u/l it to this message as an attachment in case any of you need another good reference.

Regards,
Clandestiny
seir
06-23-2001, 02:31 PM
Hi Kayaker, Clandestiny,

cool idea turning the tool into a keylogger. But I think it is pretty
difficult to do. The problem is that it only shows the keycodes
if the keycode window is active (has the focus). The WM_KEY*, WM_SYSKEY*
messages are only sent to the window, which has the keyboard focus.
This means to turn it into a keyboard logger, we would have to make
a dll/vxd which hooks the keyboard and forwards the messages to our keycode
program.
It is possible, but that would be more a programming challenge than a reversing
challenge. I don't think there is another solution, but who knows ...

Clandestiny: Finding the missing API is the more difficult part of the challenge
(if you are already familiar with the import table ;) ) Hint: Look as Code_Inside
already said at the parameters pushed to the API and also look at the API
following our missing one *big hint*.

- seir
Clandestiny
06-23-2001, 02:40 PM
Yipee!!! The first time I've ever rebuilt an import table and it actually works ;D . As it ends up, that missing API was not so hard to find...we have the same memory address for that API, Kayaker ;) ...And I can tell either you (or I) have been playing Myst far too long... hehe, it really was like a Myst puzzle... all the missing pieces in the right places :p

Regards,
Clandestiny
Kayaker
06-23-2001, 05:44 PM
Good point seir, by the time you install the hook procedure you'd have most of the keyboard logger written anyway. And then to have to pass that to the existing program just to process the keystroke, and then write more code to dump to a file is just plain dumb. Guess I didn't think that one through. I suppose you *could* reverse it to generate a log file just so you've got an output of scan and key codes for your keyboard, but I guess that's not really all that useful ;)

Heh, I guess those Squee Chirps from Myst3 finally got to me Clandestiny ;p I had totally forgotten about that ImportReb essay, which I know I've got *somewhere*. It's a good one.

OK, that was a gentle introduction to Import rebuilding. I have a feeling it may come up again :)

Cheers,
Kayaker
Rage9
06-23-2001, 06:38 PM
Wow, this is the first time I have ever tryed this, well there's a first time for everything :) but im having a little bit of trouble.... i was wondering if im going in the right direction, would you have to add an IMAGE_IMPORT_DESCRIPTOR structure for the USER32.DLL??? Right inbetween the other 2 dll's? just wondering if i was on the right track, l8er...

-Brad
Kayaker
06-23-2001, 07:11 PM
Hi Rage9,

Yup, you got it ;)

regards
qferret
06-23-2001, 11:31 PM
I'm almost there guys...& I haven't even had to bug JimmyClif (mainly cuz he hasn't looked at it yet LOL)

Hey CoDe_InSiDe,

noodlespa.cjb.net->My Fantastic Programs ;-)
qferret
06-24-2001, 12:09 AM
Well, since it looks like most participating in this are done, or close to it, I'll share what I have so far....

I have 2 of the 3 IT probs fixed (I think).
But I'm having a tough time figuring out what the 3rd is, much less fix it.

The missing IID & API were easy to spot, although I did have to do some reading and studying of the rest of the IT to figure out how to fix it ;-)

Anyway...

I added the IID for User32.DLL, double & triple, etc. etc. checked the addresses that the OFT and FT pointed to (btw, are they right b4 and right after the ASCII names in all proggies?)

Then I hit cntrl d and typed "d cs:The_Address_Of_The_Missing_API"...whattaya know? now I know the missing API name. I then replaced the address in the FT array with the offset for that spot from the OFT array, and put the name in the ASCII name list.

Anyone want to gimme a clue as to what the 3rd prob is?
CoDe_InSiDe
06-24-2001, 02:31 AM
Hi qferret,

"Hey CoDe_InSiDe,

noodlespa.cjb.net->My Fantastic Programs ;-) "

Nope, that's only NoodleCrypt v2 ;)
v1 is nowhere to find ;D

Cya...

CoDe_InSiDe

P.S. Kayaker throw in another Import Table challenge, it's easy :P
qferret
06-24-2001, 09:16 AM
aw nuts....well I tried for ya CoDe_InSiDe *G*
Clandestiny
06-24-2001, 03:09 PM
Hiya ?ferret,

Sounds like you fixed up everything for the User32 imports, but there are other problems w/ both the Kernel32 and User32 portions of the table... They're just not as obvious ;)

Hint for Kernel32: The Image Import Descriptor may look ok... but take a closer look at the unbound IAT array section. Could there be a few missing pieces ?

Hint for Gdi32: Recheck the First Thunk pointer to IAT and the IAT entry itself.

Regards,
Clandestiny
qferret
06-24-2001, 03:42 PM
I did fill in the missing offsets for Kernel32....but I didn't catch anything wrong in the IID for GDI32.....will check it out, thanks :-)
Muad'Dib
06-24-2001, 04:10 PM
I finally finished this project. I worked on it for a few hours over a span of 2 or 3 days and, though it was difficult (I knew nothing of the IT and hardly anything about PE before I started) I can now say that I learned quite a bit about how the IT works. Thanks, Kayaker, for the great project, now on to part 2...
Muad'Dib
06-24-2001, 04:29 PM
qferret (06-24-2001 13:42):
I did fill in the missing offsets for Kernel32....but I didn't catch anything wrong in the IID for GDI32.....will check it out, thanks :-)

I don't think that there is anything wrong with the IID for GDI32...everything works fine and I didn't have to alter that one at all.
Rage9
06-24-2001, 05:26 PM
I must admit that finding the missing api has bit me like some kinda screwy bug! :p CoDe_InSiDe did you find it without softice? Any hints? If it gives it away send me an e-mail...

And one more quick question, can you still run the program without the missing api? Or do you absolutly need to find it?

-Brad
Kayaker
06-24-2001, 05:54 PM
Hi All,

Hey that's great Muad'Dib, that's *exactly* what I was hoping for! IT corruption is such an important part of some protections, and it's just an interesting place to play around with anyway, that I thought it might make a fun project.

Packers and such tend to use more of a redirection of the pointers in the Thunk array, rather than the deliberate mangling I did, but it's good to understand the section so you know what's supposed to point to what under normal conditions. Instead of being initialized directly with the addresses of the Imports they may call some routine which gets you there indirectly, such as a jump to the API after some SMC, or maybe decrypting a previously encrypted Import name, then calling GetProcAddress to get its address.

As well, I know there's some utilities around like IIDKing by SantMat which allow you to add Imports, but I like to have the knowledge how to do this manually just for a lark.

BTW ?ferret, I think Clandestiny is trying to throw you off track with that GDI32 stuff. At least I don't remember mucking with gdi :)

Rage9, if you're running Win98 you could use Exescope on the system dll in question to find the address. If not, then it would be a different address than mine (mea culpa on that one), in which case educated guesswork is in order I suppose. And if you've fixed everything *else* up, I *hope* it doesn't run without that missing API, it's not supposed to ;)

Regards all,
Kayaker
?ferret
06-24-2001, 06:34 PM
Hi all,

Well, after chattin with Clandestiny and figuring out what I missed, it ran on his system....but not mine.

I started over with a fresh copy, redid all (i hope) the changes, & it still won't run.

I'm attaching my copy of the proggy. Could someone test it to see if it's just a problem w/ running it on my box? I'm gonna look again to see if I missed anything, but I think I got it all ;-)

Thanks,

?ferret
?ferret
06-24-2001, 06:36 PM
uh Kayaker? .....if the proggy works.....feel free to delete it LOL.....oops
Clandestiny
06-24-2001, 07:42 PM
Hiya Kayaker, ?ferret

Kayaker (06-24-2001 15:54):
BTW ?ferret, I think Clandestiny is trying to throw you off track with that GDI32 stuff. At least I don't remember mucking with gdi :)

Nah Kayaker, I wouldn't be mean like that ;-) Here's what I really meant to say... There's no problem with the Image Import Descriptor Struct for the GDI32 dll.

0x00001000 50 10 00 00 72 C2 3E 35 00 00 F2 BF C4 13 00 00 P...r.>5........
0x00001010 E8 13 00 00

...But there is a problem w/ the IAT for the Gdi32 dll. At the RVA to IAT (offset 13E8h) the pointer points to the memory address rather than the ascii string name.

0x000013E0 32 2E 44 4C 4C 00 00 00 13 49 F2 BF 00 00 00 00 2.DLL....I......

Where you've got BFF24913h you should have offset 10F8 which points to our GDI API name GetStockObject. Thats what I meant when I hinted to ?ferret to have another look at the GDI stuff. Sorry about the confusion.

To ?ferret: I ran that copy of your .exe again that we fixed earlier just to make sure I wasn't having delusions / ran the wrong file / did something really stupid...ect... ;-) And it still works. But I d/l the file you just u/l to the board and it crashes. I don't think I changed anything other than those 2 little things we talked about...so you got me puzzled. I'll have a look at the u/l file and see if I see any problems.

Regards,
Clandestiny
qferret
06-24-2001, 08:18 PM
It works It works!!! LOL

Thanks Clandestiny (can't believe I 4got to reverse the byte order on that offset) ^_^

And thanks to Kayaker for these projects.....learning ALOT of new and interesting (not to mention useful) stuff.
qferret
06-24-2001, 09:25 PM
part 2 was the easy part....just changed a ShowWindow param ;-)
CoDe_InSiDe
06-25-2001, 12:26 AM
Hi Rage9,

"CoDe_InSiDe did you find it without softice? Any hints?"

Yes i did it without SoftICE ;)
Like i said before in some post, try to search for what it pushes before the call to the API :) (Try to make a Dead Listing, that'll help ;) )

Cya...

CoDe_InSiDe

Efbe!Mjtujoh!.?!Tuso!Sfg!.?!XN`DIBS
Eternal Bliss
06-25-2001, 08:11 AM
Hiya,
I rebuilt the IT, but somehow, it ran a bit then crash with a kernel32 thingy. Tracing into the proggy, I realise that the crash is always at postmessage or getmessage (can't remember which one). Can someone check my IT for me? 8P

Regards
EB
Kayaker
06-25-2001, 11:18 AM
Hi Eternal Bliss,

I see what's happening. The original 'missing' Import had an initialized address in the First Thunk of 1D17 F5BF, but its API name was missing.

You replaced the First Thunk pointer correctly to where the name should be, but didn't get the API name right. Instead you got the name corresponding to the address BFF51118 instead of BFF5171D. From what you did replace the name with I'm thinking you're running Win98 as well, but just in case I'll up my version of User32.dll (28K zip) so non-98 users can find the address easier.

Cheers,
Kayaker
Rage9
06-25-2001, 12:27 PM
weeeee!! i solved it! haha! turns out i did it all right, even found the right api! but I hade one byte offset switched around on accident.... onto part two...

-Brad
Rage9
06-25-2001, 12:37 PM
damn part 2 was easy....

-Brad
CoDe_InSiDe
06-25-2001, 12:45 PM
Hi Rage9,

Way to go !!! ;D

Cya...

CoDe_InSiDe
NeO'X'QuiCk
06-25-2001, 04:29 PM
Kayaker the project is good i like it like i liked the one before this!But i didnt manage to solve it yet !!but ...

NeO'X'QuiCk
qferret
06-26-2001, 10:48 PM
Hola,

Me again ;-)

I'm trying to add the import SetWindowPos to try to add code to keep it on top.

I added the ASCII name, added the offset to the IAT; fixed all the IAT offsets, IID offsets, etc. in my hexeditor; adjusted the image size and the IT sizewith PEEditor, and it crashes....no error messages, just the hourglass for a second & then nothing. It doesn't hang in mem, because I can edit it again w/o rebooting hehe (1 good sign).

What else do I have to update/change to add imports?

I even tried IID King to see how it did its work, but it says there's not enough room, so that didn't work to show me either :-(

The good news is, I did manage the first 2 tasks & I'm still playin around with it LOL.
Kayaker
06-26-2001, 11:48 PM
Hi ?ferret,

That error message with IIDKing is sort of a bug between it and PEditor. PEditor inserts its 'advertising' right at the end of the section table in the PE header. Along comes IIDKing and it's looking for a bunch of 00's as a delimiter for the section table so it can add a new section to place your sneaky new imports and a new IID, but doesn't find it.

Just replace the "Modified with PEditor..." text with 00's and IIDKing should work.

I know, I know, I should buy the new LordPE util. Hey Hz, can I bum $13 from ya? Maybe we can get a group rate?

btw, I checked out the LordPE demo the other night and, well yeah, it's a crippled demo all right ;)

Kayaker
Lord_SplAj
06-27-2001, 07:53 AM
LOL........LordPE /notrademark ;) .............ooohh I my paid for version also adds imports easier than IIDK ;)

money well spent, thanks y0da :-)

anon_splaj
qferret
06-27-2001, 11:11 PM
Thanks for the tip Kayaker, it worked beautifully. But is there a tool that will add an import w/o adding a section? or is this not possible/too hard?

I just had a brief look at it so far, but I think I should be able to figure out how it was done. I would just rather have it look "original" ;-)
Eternal Bliss
06-28-2001, 06:02 AM
Kayaker (06-25-2001 09:18):
Hi Eternal Bliss,

I see what's happening. The original 'missing' Import had an initialized address in the First Thunk of 1D17 F5BF, but its API name was missing.

You replaced the First Thunk pointer correctly to where the name should be, but didn't get the API name right. Instead you got the name corresponding to the address BFF51118 instead of BFF5171D. From what you did replace the name with I'm thinking you're running Win98 as well, but just in case I'll up my version of User32.dll (28K zip) so non-98 users can find the address easier.

Cheers,
Kayaker

Thanks. 8) Did it. 8)

the second part:
1) I used resource editor to make the form always on top.
2) I look for showwindow and see which one has a PUSH 00000000 which is SW_HIDE and changed it.

Regards.
EB
Kayaker
11-29-2001, 07:02 PM
For anyone following the API Hooking thread on the main forum, here's a reupload of the original project program, which is OK to remain here.

Kayaker
Kayaker
12-01-2003, 01:59 AM
Hmm, I forgot I had reuploaded this lost project file. I just reupped it again to the original post, this time along with the original KeyInfo program file, so should make it easy to compare a correct import table with the 'corrupted' one for those just getting their feet wet. Links updated as well.
(yes I know I originally called the program KeyCode, but that was a ruse so nobody tried downloading the *real* KeyInfo program to cheat ;-)

Kayaker
nofurs
12-01-2003, 10:04 AM
Well maybe someone did who knows (ouch! an accusation again? LOL


Keygen and Banner Removal - Newbie/Intermediate
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Keygen and Banner Removal - Newbie/Intermediate
PDA

View Full Version : Keygen and Banner Removal - Newbie/Intermediate

Muad'Dib
06-26-2001, 01:05 AM
Though I agree that keygenning is not the highest eschelon of reverse engineering, I feel that it is important nonetheless. This project incorporates both a simple keygen (only a few [20-30] lines, I've done it and I'm a poor keygenner) and patching.

The Target:
HTML Encryptor v1.21
http://www.share2.com/htmlencr/download.htm

Upon running the program you will notice that there is a "GoldStone Software Group" banner at the top of the window. Adware, how annoying. Once a correct serial is found/generated and entered, and the program is restarted, the ad is still there. Either the author forgot to put removal code or he is greedy (I am thinking the latter...). The second challenge is to remove this banner and resize the window properly. I'm sure there are a few ways to do this, be creative.

In review, here are the challenges:

1. Create a working keygen for this program. (Don't worry, it's simple)

2. Remove the ad

3. If you want to do something extra, remove the "registration" tab upon complete registration.

I hope you enjoy this project, and maybe learn something from it. It shouldn't be too hard...
Kayaker
06-27-2001, 05:18 AM
Hiyas,

Well I've been spending a bit of quality time with this one. The s/n routine is a classic Delphi serial sniff. I usually break into these with hmemcpy, F12 a few times and your name has been read in, then comes the s/n. Check out the contents of the registers (or the contents of the contents) before the calls and you can usually find your name and s/n being pushed without having to do bpm or bpr traces on them. After your name undergoes the keygen routine there's the classic Delphi EDI/ESI compare of good vs bad s/n.

As for the ad window, I dredged through the bloated code in and around the CreateWindowExA calls, used APISpy32 to get a listing, and WinShow to match the components names up with their hWnds. I found memory addresses holding the height and width of the ad window, traced them all over the place, and even did a couple of backtraces. In all my tracing did I find anything that looked like there was an option built in to eliminate the ad window with a simple jump patch. So you're likely right Muad'Dib that the guy never coded this into his proggy.

Most of the components use the same window creation calls (GetClassInfoA, RegisterClassA, CreateWindowExA, SetWindowPos...), and I couldn't find a unique patch point for just the ad window. Then I thought about creating an inline patch which checked when the TPanel component which holds the ad window came up, and bypass its CreateWindowExA call.

But I did find an easier way to get rid of the ad window. To start with, it helps to know how Delphi programs are set up and how they look in a hex editor. There's several tuts at the main site that give some general insight if you haven't messed with Delphi too much. Start with

Delphi Reverse Engineering: Adding functionality to a Delphi program by +DaFixer
http://www.woodmann.net/fravia/dafix_t1.htm

and the refs he gives.

Exescope will recognize the unpacked file enough that you can look at the TMainForm RCData info and perhaps figure out a way to eliminate the ad window.

One annoyance is that DeDe doesn't disassemble the unpacked program (/dump, /pedump or Procdump -ed). I think that there's a Delphi Section format that it's expecting in order to recognize it properly. If you look in the dumped file in a hexeditor closely you'll see the original PE header with the original sections (code, data, bss, idata, tls, rdata, reloc, rsrc) from before it was packed.

ResHacker might be a great tool for this as well because it allows you to modify Delphi component parameters and then recompile the script. Unfortunately it doesn't recognize the unpacked file either. I want to try replacing the Section header with the original and see if I can't get both DeDe and ResHacker recognizing the file. The problem with Delphi is that a lot of things are set runtime, so even if you modify say a Visible=True to Visible=False setting for a component, it defaults back to True at runtime.

Getting rid of the Registration tab is a stickler. I tried manually inserting a Visible or TabVisible qualifier into the resource but haven't had any luck. In Delphi it seems that specifying a 'Visible' entry in the component declarations makes it =False, NOT specifying it makes it default to =True. Mess around with some other Delphi apps and you may see what I mean. In any case, that's why I want to get ResHacker working, to see if it will help. If not, then I guess some convoluted inline patch is in order.

Let me know if anyone comes up with a method for getting rid of that &*^%#$! Registration tab.

Kayaker
Muad'Dib
06-27-2001, 11:25 PM
I have been successful in removing the banner from the top of the window - as a hint, the TMainForm starts at 62A50 (raw offset). It only requires some simple editing, cut and pasting, and patching of 2 calls (to remove errors, you'll see what I mean...). In removing the tab after registration...hmm...this will be more difficult. I think that I can create a runtime patch to Check_If_Registered and then find and remove the tab. I'll post a message when I'm done with this part...If anyone needs help, feel free to ask...
Kayaker
06-28-2001, 09:07 PM
Well, I got ResHacker to recognize the dumped file, and this really is a wonderful tool. Ad window and Registration tab gone like (snap of the fingers). The real challenge was convincing Reshacker to work and to rebuild the Import table afterwards so the proggy would run.

I d/l the latest ResHacker (3.28 ) which gives a message box that the resources in the file are corrupt when you select RCData/TMainForm. Exescope has no problems with this, but it doesn't do what Reshacker can. So I ran APISpy32 on Reshacker and paused it until I selected to view TMainForm. I found one API I could use to break into Reshacker- FindFirstFileA. (You can't use MessageBoxA with Delphi message boxes).

So I set a bp on FindFirstFileA (which is used to open a copy of the selected file from c:\windows\temp) and F12ed back and found this code:

:0049F056 837B0C00 CMP DWORD PTR [EBX+0C],00 ;starting address resource section
:0049F05A 751F JNZ 0049F07B ;should jump if section found

What is *supposed* to be in [EBX+0C] is the starting address of where Reshacker has stored in memory the resource section of the file you've opened. For some reason the dumped UPX file screws it up and it has 00 here instead of an address. It *is* in memory somewhere though, so you have to search for it and insert it into [EBX+0C].

The section it's looking for, which is consistent in all Delphi apps, starts with "TPF0". So I did a search in SoftIce with

s 30:0 L ffffffff "TPF0"

and found the section here:

0030:00CA9B50 30465054 614D5409 6F466E69 4D086D72 TPF0.TMainForm.M
0030:00CA9B60 466E6961 046D726F 7466654C 03011103 ainForm.Left....
0030:00CA9B70 03706F54 420B0087 6564726F 6F634972 Top....BorderIco

Then I just inserted the address 'CA9B50' in EBX+0C and Reshacker ran fine the rest of the way.

After this I changed the width and height of Panel2 (the Ad window) to be 0, added a TabVisible = False qualifier to the Registration tab, then recompiled the resource script and saved the file.

object Panel2: TPanel
Left = 0
Top = 0
Width = 417
Height = 60

object Registration: TTabSheet
Caption = 'Registration'
ImageIndex = 2
TabVisible = False

Now 1 problem remained, the program wouldn't run! This has to do with the way Reshacker saves the dumped file, not because of the changes I made. The Import table is moved around and the pointers are no longer valid. Sooo, the next step was to rebuild a valid Import table with Revirgin using the original dumped file and paste it on the end of the ResHacker modified file.

Note this use of Revirgin. It's not just for esoteric use in tracing redirected API's in selected protection schemes like Asprotect. I used it simply to build a complete new Import table from a working app that I could paste at a specific location in a new section, and changed the pointer in the PE header (@ PE+80h) to point to this new IT. Try it with regular notepad sometime.

This worked really well, if somewhat convoluted to accomplish it, but it's not really an attack on the Delphi window creation code, it's just modifying the resources instead with a program designed to do that. (works for me though ;)

Kayaker
LaptoniC
06-28-2001, 11:16 PM
First of all I appreciate for preparing this type of exercises for us.I have downloaded program and keygenned it.Here is what I did and how I made it.

Removing Banner
---------------
Open exe with exescope and go to RCDATA/TMAINFORM. We are looking for our banner.I have found with spy that its height is 60 and width is 417.So look for this values. object Panel2: TPanel is what we are looking for.Etiher change width and height to 1 or choose it till object OpenDG: TOpenDialog and cut them.You will see that banner will go.You can also change object Main: TPageControl Top behaviour and change height of main form.Removing Register tab should be done with same method but I havent tried

Keygen
------
Making keygen is easy too.Unpack program with upx -d parameter or use Procdump.Dissamble with dede and look for suspisous code which has some * Reference to: controls.TControl.GetText(TControl):System.String; which is the function of delphi to get text from forms.TransperantButton8CLick is our reg button on the form.Click on it and try to understand what is going on.However it is hard to understand delphi code because it so bloated.It is better to use SoftICE to point memory locations.Look for error messages There is a call just before error message and after this call there is compare.So this call must be our keygen rutine.You will also notice that it copies 3rd char of name and store and use this as constant for keygen.Some times it adds 3rd and 4th char and store this as constant.Everything is clear now.Just copy paste this rutines to ASM template and your keygen is ready to go.I made keygen but I dont want to put my source and break your fun.I will put it after everbody solved problem or any one of the moderators want me to do so.

Best Regards,
LaptoniC

Ps:If you dont have any experince with Win32ASM and keygenning I suggest you to download and read Shade's superb tutorial on http://snakepage.cjb.net
Kayaker
06-28-2001, 11:55 PM
Sheeeittt!! Well the joke's on me ;p I never thought about using the upx -d command and whaddya know, it unpacks the file perfectly. Both Reshacker and DeDe recognize the unpacked file no problem! Makes sense I guess. The original structure of the file, including the PE header, Import table and even the file date, are restored. Guess I'm blinded by always dumping. Thanks for the lesson.

Regards,
Kayaker
Muad'Dib
06-29-2001, 01:24 AM
Kayaker (06-28-2001 21:55):
Sheeeittt!! Well the joke's on me ;p I never thought about using the upx -d command

I was going to say "I used upx -d and it worked fine..." but I guess I don't have to now, do I? :)

I removed the resources manually. It was a bit of a pain, but I got it - and I learned about Delphi form structure in the mean time. Maybe this knowledge will come in handy sometime.
qferret
06-29-2001, 10:58 PM
hehe....I'm used to the older versions of UPX that don't support unpacking
NeO'X'QuiCk
06-30-2001, 04:07 AM
Done !!The window name can be deleted after unpacking BY exescore Like i did or rescource hacker!
!YOu can also see it in DEde:

00454B9F E8B0EFFAFF call 00403B54
00454BA4 83F804 cmp eax, +$04
00454BA7 7D09 jnl 00454BB2
00454BA9 C6059978450001 mov byte ptr [$457899], $01
00454BB0 EB55 jmp 00454C07
00454BB2 8B55F8 mov edx, [ebp-$08]
00454BB5 8B45FC mov eax, [ebp-$04]
|
00454BB8 E8BBECFFFF call 00453878
00454BBD A299784500 mov byte ptr [$457899], al
00454BC2 803D9978450000 cmp byte ptr [$457899], $00
00454BC9 7411 jz 00454BDC

* Possible String Reference to: 'HTMLEncryptor 1.21 -- UNREGISTER'
|
00454BCB BAC84C4500 mov edx, $00454CC8

* Possible reference to MainForm
|
00454BD0 A194784500 mov eax, dword ptr [$457894]

* Reference to: Controls.TControl.SetText(System.AnsiString)
|
00454BD5 E8DE2EFDFF call 00427AB8
00454BDA EB2B jmp 00454C07

* Possible String Reference to: 'HTMLEncryptor 1.21'
|
00454BDC BAF44C4500 mov edx, $00454CF4

For Keygen you just use softice and little tracing will do!Write the algo done an code it!

Best aproach is mix Dede and SOftice to get the resoult done!

NeO'X'QuiCk
NeO'X'QuiCk
06-30-2001, 04:24 AM
And about the banner you have solution writen alread here SO FInd it and read it !

I would like to says that good job For Mund ,Kayaker,Rage and other for putting thing into project so the keep us buys!!

Keep a good work so we will have fun while doing it.

NeO
Rage9
06-30-2001, 09:54 AM
hmmm, softice isnt giving me anything i want. haha. i break on hmemcpy as usual but it seems i only break on 3 program addresses, 421686, 428c78, and 42b473..... my guess (from just looking through W32Dasm and finding where the error message comes from and then going up and looking for some kinda call that returns somthing for the compare) is that the serial routine starts at 453878, i guess i could be wrong. Any help anyone?

-Brad
NeO'X'QuiCk
07-02-2001, 05:57 AM
Rage9 it difficult to help if you have writen the solution already in the board!!REad from the top to bottom use the same tools as guys infront of you and you will do it!

The solution for solving in writen up from mine post...just read it..

NeO
Clandestiny
07-03-2001, 10:51 PM
NeO'X'QuiCk (07-02-2001 03:57):
Rage9 it difficult to help if you have writen the solution already in the board!!REad from the top to bottom use the same tools as guys infront of you and you will do it!

The solution for solving in writen up from mine post...just read it..
NeO

Hi Neo,

At the risk of sounding harsh... But why post a response to a query for help if you can't give constructive *help* ?

Instructing Rage9 to "REad from the top to bottom use the same tools as guys infront of you " is a statement of the obvious. I have little doubt that Rage9 had already read the above posts before asking for help. We are all in the process of learning and what is clear to one individual may be ambiguous to another. IMHO, wagging the finger and preaching RTFM on a project that may well have more than one solution is non-constructive and possibly discouraging.

Regards,
Clandestiny
Kayaker
07-04-2001, 12:47 AM
Hi Rage9,

Maybe this will help. The funny thing about most Delphi apps with a reg box like this is that they all behave in pretty much the same manner. You can enter your information, set a bpx hmemcpy, and F12 out of the break until you reach program code.

You did this, but those addresses you reached 421686, 428c78, 42b473 are only the beginnings of getting back to the main call which retrieved the edit box text. The thing about Delphi is that it's terribly overbloated, so you need to step through a lot of useless code to find the good stuff. There are several of these short POP, POP, RET sequences that you need to continue F12ing back through. When you do reach the right area you'll recognize it immediately because there'll usually be a long sequence of regular code unbroken by RETs.

On returning from getting the text in the edit boxes you should see the length of the text in EAX. This doesn't really matter, but it's good to be able to recognize the register values being kicked around. It's handy to keep your name and s/n of different lengths for this reason.

Again with Delphi, the calls in the main thread handling a protection routine often seem to be spaced shortly apart, with only a few other code lines in between them. This makes it easy to check the contents of the registers being MOVed before the calls, so you can usually find your name and s/n being manipulated in there somewhere. Note that often your user info will be in the *contents* of the address in the registers, not pointed to directly, so use 'd *eax' or whatever. You can also set "watches" in Softice by setting something like INIT="ww 5; watch *eax; watch *edx;" in winice.dat. "ww 5" opens up the Watch window 5 lines long. This way you can often spot your name and s/n being moved around easily.

The more elegant way of attacking this than 'bruteforcing' with hmemcpy is to use a combination of Exescope and DeDe. You can often find a likely address to set a break on using DeDe and looking for string references. W32dasm is usually worthless for this because it doesn't pick up the majority of good string refs with Delphi. Under "Procedures" in DeDe you'll find all the Unit names and their Events. This is where you'll find the good stuff. To narrow down the search, use Exescope and peruse the listing under RCData/TMainForm. Search for "Registration" (the Tab title) and you'll find

object Registration: TTabSheet
Caption = 'Registration'

object TransparentButton8: TTransparentButton
Left = 222
Top = 189
Width = 86
Height = 27
Caption = 'OK'
FrameStyle = fsLight
OnClick = TransparentButton8Click
end

This tells you right off the bat that when you click the OK button the TransparentButton8Click procedure is carried out. Double click on the entry in DeDe and you've got your listing and any breakpoint address you want. The rest should be straightforward.

Hope this helps,

Kayaker
NeO
07-05-2001, 01:27 AM
TO Clandestiny :

I didnt want to be harsh.. but sometimes before posting the msg would help to read all posts again..I am not some good expert at cracking but the solution writen about and KAy.. explanation is more then enought that will you get into the right direction and to start the way... Because i cracking is very important where you start and how you can be looking for hours and hours but if you are looking not on the right place all for nothing...

But as i read there are some find what to look for in DEDE so i will put all the solution here from the board not useing the last post ok::Sorry Rage it wasnt meat like that but it made me mad...Because most of ppl dont even read the whole thing just post..

From the board the solution copyied:::

Kayaker
6. Re:Keygen and Banner Removal - Newbie/Intermediate

Sheeeittt!! Well the joke's on me I never thought about using the upx -d command and whaddya know, it unpacks the file perfectly. Both Reshacker and DeDe recognize the unpacked file no problem! Makes sense I guess. The original structure of the file, including the PE header, Import table and even the file date, are restored. Guess I'm blinded by always dumping. Thanks for the lesson.

Kayaker (07-03-2001 22:47):
Hi Rage9,

Maybe this will help. The funny thing about most Delphi apps with a reg box like this is that they all behave in pretty much the same manner. You can enter your information, set a bpx hmemcpy, and F12 out of the break until you reach program code.

You did this, but those addresses you reached 421686, 428c78, 42b473 are only the beginnings of getting back to the main call which retrieved the edit box text. The thing about Delphi is that it's terribly overbloated, so you need to step through a lot of useless code to find the good stuff. There are several of these short POP, POP, RET sequences that you need to continue F12ing back through. When you do reach the right area you'll recognize it immediately because there'll usually be a long sequence of regular code unbroken by RETs.

On returning from getting the text in the edit boxes you should see the length of the text in EAX. This doesn't really matter, but it's good to be able to recognize the register values being kicked around. It's handy to keep your name and s/n of different lengths for this reason.

Again with Delphi, the calls in the main thread handling a protection routine often seem to be spaced shortly apart, with only a few other code lines in between them. This makes it easy to check the contents of the registers being MOVed before the calls, so you can usually find your name and s/n being manipulated in there somewhere. Note that often your user info will be in the *contents* of the address in the registers, not pointed to directly, so use 'd *eax' or whatever. You can also set "watches" in Softice by setting something like INIT="ww 5; watch *eax; watch *edx;" in winice.dat. "ww 5" opens up the Watch window 5 lines long. This way you can often spot your name and s/n being moved around easily.

The more elegant way of attacking this than 'bruteforcing' with hmemcpy is to use a combination of Exescope and DeDe. You can often find a likely address to set a break on using DeDe and looking for string references. W32dasm is usually worthless for this because it doesn't pick up the majority of good string refs with Delphi. Under "Procedures" in DeDe you'll find all the Unit names and their Events. This is where you'll find the good stuff. To narrow down the search, use Exescope and peruse the listing under RCData/TMainForm. Search for "Registration" (the Tab title) and you'll find

object Registration: TTabSheet
Caption = 'Registration'

object TransparentButton8: TTransparentButton
Left = 222
Top = 189
Width = 86
Height = 27
Caption = 'OK'
FrameStyle = fsLight
OnClick = TransparentButton8Click
end

This tells you right off the bat that when you click the OK button the TransparentButton8Click procedure is carried out. Double click on the entry in DeDe and you've got your listing and any breakpoint address you want. The rest should be straightforward.

Hope this helps,

Kayaker
NeO
07-05-2001, 01:31 AM
Sorry i copy the wrong part but lets continue:

Next upacking done:
Banner:
I have been successful in removing the banner from the top of the window - as a hint, the TMainForm starts at 62A50 (raw offset). It only requires some simple editing, cut and pasting, and patching of 2 calls (to remove errors, you'll see what I mean...). In removing the tab after registration...hmm...this will be more difficult. I think that I can create a runtime patch to Check_If_Registered and then find and remove the tab. I'll post a message when I'm done with this part...If anyone needs help, feel free to ask...
--------------------------------------------------------------------------------
-Muad'Dib
muaddib(at)immortaldescendants(dot)org
KAy...
I d/l the latest ResHacker (3.28 ) which gives a message box that the resources in the file are corrupt when you select RCData/TMainForm. Exescope has no problems with this, but it doesn't do what Reshacker can. So I ran APISpy32 on Reshacker and paused it until I selected to view TMainForm. I found one API I could use to break into Reshacker- FindFirstFileA. (You can't use MessageBoxA with Delphi message boxes).

After this I changed the width and height of Panel2 (the Ad window) to be 0, added a TabVisible = False qualifier to the Registration tab, then recompiled the resource script and saved the file.

object Panel2: TPanel
Left = 0
Top = 0
Width = 417
Height = 60

object Registration: TTabSheet
Caption = 'Registration'
ImageIndex = 2
TabVisible = False

LAptonic:

Removing Banner
---------------
Open exe with exescope and go to RCDATA/TMAINFORM. We are looking for our banner.I have found with spy that its height is 60 and width is 417.So look for this values. object Panel2: TPanel is what we are looking for.Etiher change width and height to 1 or choose it till object OpenDG: TOpenDialog and cut them.You will see that banner will go.You can also change object Main: TPageControl Top behaviour and change height of main form.Removing Register tab should be done with same method but I havent tried
NeO
07-05-2001, 01:34 AM
And so and so .... i hope that you see mine reason...for because it really it is all posted except the algo for the keygen but i think that some thing you must do all if you like to teach ....

I apologize to Rage9

NeO
Kayaker
07-05-2001, 02:08 AM
Hi Neo,

I'm not trying to turn this into a war of words, but there's 2 different issues here. Rage9's original question was re the *serial* routine, nothing more. You responded as if he had asked about removing the *banner*. He didn't. I know you're trying to help, and it is appreciated, but all your copy/pasting and suggestion to "REad from the top to bottom use the same tools as guys infront of you", didn't address his question at all, because no one had covered the s/n routine yet.

As you yourself just said, "...sometimes before posting the msg would help to read all posts again" ... "Because most of ppl dont even read the whole thing just post..." :)

I'm sure no one is taking offense to any of this, we're all just trying to learn and have a bit of fun together.

Regards,
Kayaker
LaptoniC
07-19-2001, 03:48 PM
Almost 1 month passed.Should I post my source code of kg ?
Muad'Dib
07-20-2001, 11:30 AM
Go right ahead :)
LaptoniC
07-20-2001, 02:02 PM
I have tried to comment all code however I am newbie :) If you find any errors in the source please letme know.Thanks.
Sphinx
07-31-2001, 05:38 AM
hello all i just started this project

i found the routine and a working serial i`m going to keygen it no problem there but for the other challenges i`m going to try it changing code for layout of progam and so is new for me but i think i can do it with the help thats allready here
Sphinx
07-31-2001, 05:42 AM
hello all i just started this project

i found the routine and a working serial i`m going to keygen it no problem there but for the other challenges i`m going to try it changing code for layout of progam and so is new for me but i think i can do it with the help thats allready here


very mini project :-D
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > very mini project :-D
PDA

View Full Version : very mini project :-D

the analyst / ucf
07-11-2001, 08:58 AM
hello all,

i think i got something for you to work on.
i coded a rather easy crackme.
the goal is to enter a serial and to get the good boy message..
however , it is not as easy as it seems ;)
i never seen such a crackme, and i wonder how would you guys
use your reversing skill to complete that one ;)
NO PATCH allowed :-P
use your brain and have fun ;-)
every one can try it and it is not that hard :)
i will give some hints if needed ;o)

file : http://www.abfiles.cjb.net/weird.zip

regards,

the analyst / ucf

ps: as strange as it may look, this crackme introduces you guys at something that many reverse engineers do nowadays ;)
good hunt
S4v4G3
07-11-2001, 11:26 AM
Hello All...

Oki... Lets give it a try...
But This iz wierd =)
the analyst / ucf
07-11-2001, 11:42 AM
S4v4G3 (07-11-2001 09:26):
Hello All...

Oki... Lets give it a try...
But This iz wierd =)

indeed :)
i just wonder how you guys are going to face that app :)
i once thought about writing such a protection.
but there are many things to test to make a good protection out of this .
you will see what i mean once you try it ;)
it is not obvious to see my point anyway.
hope this is not too boring for everyone, but try it to see ;)

regards,

the analyst
CoDe_InSiDe
07-11-2001, 01:31 PM
Hi Analyst,

Damnit, why did you use that Borland crap ? ;D

Hmm..... first is fake..... Second lot's o checks heh ;)
err... ?

Cya...

CoDe_InSiDe
Kythen
07-11-2001, 01:59 PM
Very clever scheme analyst!

I think I had a bit of an unfair advantage in solving this one though as I read a book on the subject recently ;)

Interesting to finally be able to get a feel for how one of these things actually works.

Thanks!

PS: a rather cryptic hint - The weakness of the code is it's strength ;)
the analyst / ucf
07-11-2001, 06:03 PM
CoDe_InSiDe (07-11-2001 11:31):
Hi Analyst,

Damnit, why did you use that Borland crap ? ;D

Hmm..... first is fake..... Second lot's o checks heh ;)
err... ?

Cya...

CoDe_InSiDe

how far are you mate ? ;)
heh u gotta love those checks ;)
later,

the analyst
the analyst / ucf
07-11-2001, 06:04 PM
Kythen (07-11-2001 11:59):
Very clever scheme analyst!

I think I had a bit of an unfair advantage in solving this one though as I read a book on the subject recently ;)

Interesting to finally be able to get a feel for how one of these things actually works.

Thanks!

PS: a rather cryptic hint - The weakness of the code is it's strength ;)

hehehe ;)
the code is quite small isn't it ? :)
hmm mail me ur solution , i wonder how you did it ;)
i may have a different way to crack it :)
regards,

the analyst
LaptoniC
07-11-2001, 09:38 PM
I have solved too :) It was really fun.There is more serial than you can imagine :D
the analyst / ucf
07-12-2001, 04:56 AM
LaptoniC (07-11-2001 19:38):
I have solved too :) It was really fun.There is more serial than you can imagine :D

i know :)
heh, this is my all days work btw ;)
for those who succeed, write me a mail , and show me how you did it ;)
it is nice to see that reversers use their knowledge to face not so common problems ;)

regards,

the analyst

hint : "c'est la goute qui a fait deborder le vase"
go figure it out ;-)
the analyst / ucf
07-12-2001, 01:58 PM
hey guys

i got only 2 answers..
2 guys succeed.. no questions ...
is my project not interesting ?
it introduces to one of the most used form of RE in the application side btw ;)
get your hand on it..
if yu got some questions , i can answer..

best regards,

the analyst
Raven58
07-12-2001, 08:51 PM
Downloaded your project. I first used get file type on this and learned it was a dos executable and not packed. I then ran the program using inctrl5 and learned nothing of interest there. Using wdasm,I noticed delphia and attempted to use dede, had trouble opening it, proceeded anyway and noticed a run time package(?). Nothing under any of the headings using dede was found.Under wdasm is a good boy string message with some possible patch points noted but this was not the intended way to go. Also used apispy on this. Broke in sice on hmencpy but could not f12 into the program or code. Will attempt to use sice and break on api's noted in the apispy program. Used procdump, looked at sections and nothing rang a bell. So you see that two reversers solved this but this newbie had no luck. Perhaps some hints are in order or perhaps I am way off base. Thanks for your time and effort in bringing the project to us. This beginner is always learning something new, although I am lost here.

Raven58
tony b.
07-12-2001, 09:38 PM
Interesting one... thanks analyst. I also have been reading about the subject so it hit me pretty quickly.

Maybe a hint: if you load this into IDA there seems to be no way to get to the congrats message... so how can you make a way without a patch? :)

regards,

tony
the analyst / ucf
07-13-2001, 04:56 AM
Raven58 (07-12-2001 18:51):
Downloaded your project. I first used get file type on this and learned it was a dos executable and not packed. I then ran the program using inctrl5 and learned nothing of interest there. Using wdasm,I noticed delphia and attempted to use dede, had trouble opening it, proceeded anyway and noticed a run time package(?). Nothing under any of the headings using dede was found.Under wdasm is a good boy string message with some possible patch points noted but this was not the intended way to go. Also used apispy on this. Broke in sice on hmencpy but could not f12 into the program or code. Will attempt to use sice and break on api's noted in the apispy program. Used procdump, looked at sections and nothing rang a bell. So you see that two reversers solved this but this newbie had no luck. Perhaps some hints are in order or perhaps I am way off base. Thanks for your time and effort in bringing the project to us. This beginner is always learning something new, although I am lost here.

Raven58

ok mate,

this doesn't use delphi.
but borland C++
you saw a good boy string , but if you look around, you see that there aren't any references to it .
so what ?
let me give some helpful hints :

look the size of the max name length.
play with name length.

i will publish a solution later i guess.
do i need to publish it already ? or you prefer me to do it on monday?

best regards,

the analyst
the analyst / ucf
07-13-2001, 05:01 AM
tony b. (07-12-2001 19:38):
Interesting one... thanks analyst. I also have been reading about the subject so it hit me pretty quickly.

Maybe a hint: if you load this into IDA there seems to be no way to get to the congrats message... so how can you make a way without a patch? :)

regards,

tony

ehe ;)
you got it too im sure ;)
i wish more ppl would have looked this one.
it is either too weird, or maybe not interesting :)
the best hint ever is :
"c'est la goute qui fait deborder le vase"

it is way enuf to get it ;)

regards,
the analyst
neo
07-13-2001, 12:11 PM
Its interesting but its also hard to find the right one ...because the the analyst made a good job by doing it... and like we all know he is good at a lot of thing ... i think that most of ppl are quite because they are trying like me ..

Lenght you say... i will see about that ...

NeO'X'QuiCk
the analyst / ucf
07-14-2001, 05:46 AM
neo (07-13-2001 10:11):
Its interesting but its also hard to find the right one ...because the the analyst made a good job by doing it... and like we all know he is good at a lot of thing ... i think that most of ppl are quite because they are trying like me ..

Lenght you say... i will see about that ...

NeO'X'QuiCk

hey,

lenght indeed :)
i will post my solution on monday, and also the ones from others ;)
till that day, keep trying and work well
regards,

the analyst
the analyst / ucf
07-16-2001, 10:59 AM
hello reversers ;-)

im actually writing a little text for this project, and i will publish it here in a few hours.
im trying to explain every step, not to loose newbies along the road :)
i coulda done something smaller tho, but it is not the goal of the board.
for now, regards and have fun

the analyst
Kayaker
07-16-2001, 11:57 AM
the analyst / ucf (07-16-2001 08:59):
hello reversers ;-)

im actually writing a little text for this project, and i will publish it here in a few hours.
im trying to explain every step, not to loose newbies along the road :)
i coulda done something smaller tho, but it is not the goal of the board.
for now, regards and have fun

the analyst

Hi the analyst,

Hey, appreciate the project, and the tut. But you know what? I'm still kind of intrigued by the project and don't really want to know the answer quite yet.

I know, I know, I don't have to read it, but...you know :)

Your project's only been up for a few days and I only got the chance to have a good look at it last night. It's up to you, but I'd just like to see another teaser hint. I'm sure there's several people given up on it, eagerly awaiting your explanation. To hell with them I say ^_^, make 'em wait or make 'em work.

I think the project is different enough from the norm that it deserves to be an open-ended challenge. At least for now ;)

"Shut up Kayaker", I hear several people yelling, "I want the friggin' answer!"

OK, whatever, I'm just having fun. Post it if you want, I'm sure the answer will be intriguing.

I think I've figured out the "c'est la goute qui fait deborder le vase" analogy, but on my system le vase tomber avec un grand fracas chaque fois il debordement :(

Bifurcation of variables? Might this be the principle behind it?

Cheers,
Kayaker
the analyst / ucf
07-16-2001, 01:41 PM
Kayaker (07-16-2001 09:57):
the analyst / ucf (07-16-2001 08:59):
hello reversers ;-)

im actually writing a little text for this project, and i will publish it here in a few hours.
im trying to explain every step, not to loose newbies along the road :)
i coulda done something smaller tho, but it is not the goal of the board.
for now, regards and have fun

the analyst

Hi the analyst,

Hey, appreciate the project, and the tut. But you know what? I'm still kind of intrigued by the project and don't really want to know the answer quite yet.

I know, I know, I don't have to read it, but...you know :)

Your project's only been up for a few days and I only got the chance to have a good look at it last night. It's up to you, but I'd just like to see another teaser hint. I'm sure there's several people given up on it, eagerly awaiting your explanation. To hell with them I say ^_^, make 'em wait or make 'em work.

I think the project is different enough from the norm that it deserves to be an open-ended challenge. At least for now ;)

"Shut up Kayaker", I hear several people yelling, "I want the friggin' answer!"

OK, whatever, I'm just having fun. Post it if you want, I'm sure the answer will be intriguing.

I think I've figured out the "c'est la goute qui fait deborder le vase" analogy, but on my system le vase tomber avec un grand fracas chaque fois il debordement :(

Bifurcation of variables? Might this be the principle behind it?

Cheers,
Kayaker

hehe :)
heya kayaker !
actually , the vase doesn't break here ;-)
i'd like to publish the solution, in order to make them learn something from it, but you are also right, that they should better try from their own :)
i might wait till tomorow evening ?
the tutorial will be quite detailed and i hope it will help ppls to finish that one.
i only got 3 valid answers yet, not that big imho.
hey guys? where are you atm ? ;))
don't hide under your desktop and give it a try ;)
shake ur brain ;) it is not only used to unpack asprotect ,is it ?
ok for a hint :

"c'est la goute qui fait deborder le vase"
"mais ne perdons pas l'eau qui deborde ;-)"
"recuperons la plutot et utilisons la "

i can't say much, it is so easy reading those sentenced :)

work well, and don't only focus on common cracking technics coz they are helpless ;)))

regards,

the analyst
woodmann
07-16-2001, 02:29 PM
work well, and don't only focus on common cracking technics coz they are helpless ))

I concede to the Analyst :D

I cant find an online translator worth a shit

I got all pissed off trying to figure it out so I decided to be lazy and try to patch it.

Needless to say I got it to do some funky things before I nuked it.
I will d/l it again and wait for an answer.
The best part is my interest is coming back to me as far as protection schemes :)
Thanks to you Analyst.

Peace, Woodmann
Kythen
07-16-2001, 05:53 PM
Needless to say I got it to do some funky things before I nuked it.

The fact that you got it to do some funky things is a better hint than almost anything else we could give you :)

cryptic hint #2: It's a long road to the point of no return, so you had better change your destination.
the analyst / ucf
07-17-2001, 04:56 AM
Kythen (07-16-2001 15:53):
Needless to say I got it to do some funky things before I nuked it.

The fact that you got it to do some funky things is a better hint than almost anything else we could give you :)

cryptic hint #2: It's a long road to the point of no return, so you had better change your destination.

hey :)
hint 2 is way too clear ;-)
i have almost finished the solution, and i think that i will post it this evening :)
or tomorow morning, depends of my lazyness ;-)

"it's the drop that made the vase overflow ;)"
fucking hell, no more help now :-)

regards,

the analyst
the analyst / ucf
07-17-2001, 03:03 PM
(First part )
Hello all, here comes my solution for my little crackme.
I didn't receive much answers, but i hope you will try it with this solution.
i think that it is not needed to wait anymore , coz you are all prolly too damn lazy and just waiting ;) one or two days more won't change it :)
so here it goes, have fun:

tools used :

- IDA mostly
- Soft ice
- hexeditor (optional)

1) study of the crackme

ok, i first ran it to see what appened:

-- The analyst's weird crackme --
---------------------------------
enter your serial please:

ok, alright, i enter a serial such as : IOWNU
once you press Enter, nothing happens.If we press again, it closes for good.
ok let's use IDA and disassemble our weird.exe.It takes a lil while and then we
see that :

CODE:00401108 push ebp
CODE:00401109 mov ebp, esp
CODE:0040110B add esp, 0FFFFFFB4h ; char
CODE:0040110E push offset aTheAnalystSWei ; __va_args
CODE:00401113 call _printf ; print some text.
CODE:00401118 pop ecx
CODE:00401119 push offset asc_40C097 ; __va_args
CODE:0040111E call _printf ; same
CODE:00401123 pop ecx
CODE:00401124 push offset aEnterYourSeria ; __va_args
CODE:00401129 call _printf ; same again
CODE:0040112E pop ecx
CODE:0040112F lea eax, [ebp+s] ; buffer
CODE:00401132 push eax ; s
CODE:00401133 call _gets ; get entered serial
CODE:00401138 pop ecx
CODE:00401139 nop
CODE:0040113A lea edx, [ebp+s]
CODE:0040113D push edx ; s
CODE:0040113E call _strlen ; get his length
CODE:00401143 pop ecx
CODE:00401144 mov edx, eax
CODE:00401146 cmp edx, 19h ; is it less than 25?
CODE:00401149 jl short loc_401182 ; yeah
CODE:0040114B cmp edx, 78h ; is it more than 120?
CODE:0040114E jg short loc_401182 ; yeah
CODE:00401150 mov eax, 1 ; eax = 1 , initialise loop
CODE:00401155 cmp edx, eax ; did all chars?
CODE:00401157 jl short loc_40115E ; no let's jump
CODE:00401159
CODE:00401159 loc_401159: ; CODE XREF: _main+54j
CODE:00401159 inc eax ; eax = eax + 1
CODE:0040115A cmp edx, eax ; did all chars?
CODE:0040115C jge short loc_401159 ; no let's loop
CODE:0040115E
CODE:0040115E loc_40115E: ; CODE XREF: _main+4Fj
CODE:0040115E mov eax, 7A69h ; eax = 31337
CODE:00401163 test eax, eax
CODE:00401165 jnz short loc_401182 ; jump quit
CODE:00401167 cmp eax, 1388h
CODE:0040116C jl short loc_401182 ; jump quit
CODE:0040116E cmp eax, 3A98h
CODE:00401173 jg short loc_401182 ; jump quit
CODE:00401175 jmp short loc_401182 ; jump quit
CODE:00401177 ; ---------------------------------------------------------------------------
CODE:00401177 push offset aWooCongrats ; __va_args ; good boy message
CODE:0040117C call _printf
CODE:00401181 pop ecx
CODE:00401182
CODE:00401182 loc_401182: ; CODE XREF: _main+41j
CODE:00401182 ; _main+46j ...
CODE:00401182 call _getch ; wait till a key is pressed
CODE:00401187 xor eax, eax
CODE:00401189 mov esp, ebp
CODE:0040118B pop ebp
CODE:0040118C retn

A quick look show us that there is NO x-ref to our good boy message, but rather some jumps that go directly to the
end of the crackme.
Quite weird, isn't it ? oh isn't it the name of my crackme? :)
Let's have a look at the goal of that crackme to see what we have to do.
lemme past my 1st post on the message board:

"the goal is to enter a serial and to get the good boy message..
however , it is not as easy as it seems
i never seen such a crackme, and i wonder how would you guys
use your reversing skill to complete that one
NO PATCH allowed "

ok goal is to get the good boy message, without patching it:)
just enter a serial. interesting, but how can we do it, without patching when there is no jump to the good
boy message?

i see no way except a nice buffer overflow ;-)
wtf? this is pretty new, isn't it ? in crackme at least.
ok, first, what is a buffer overflow ?

A buffer overflow happens when the string that we enter is bigger than our buffer.
so it overflows. the values that are over the buffer might get executed.
If we put some random values, the program crashes, but if we put good ones then the code is executed!
Once you have read that tutorial, i advise you to get your hand on some nice tutorials, such as 'smashing the stack',
and other nice ones in phrack magazine.
Phrack 55 has a nice tutorial about Win32 buffer overflow, that i advise you to read.
ok let's continue now.

2)overflowing the beast

ok, First of all, we have to check if there is a buffer and its size.

CODE:0040112E pop ecx
CODE:0040112F lea eax, [ebp+s] ; buffer
CODE:00401132 push eax ; s
CODE:00401133 call _gets ; get entered serial
CODE:00401138 pop ecx
CODE:00401139 nop
CODE:0040113A lea edx, [ebp+s]
CODE:0040113D push edx ; s

ok, this is obvious.eax is pushed on the stack, just before a call to the 'gets' function.
lemme put some C code to demonstrate it :)

--------------------------------------------------------------------------------

#include <stdio.h>
#include <string.h>
#include <conio.h>
#include <iostream.h>

int main(){

unsigned char name[50];

gets(name);

--------------------------------------------------------------------------------

As we can see, there is a buffer called 'name' which is 50 bytes long.
then, we use 'gets'. our input goes into 'name'.
We defined it as 50 chars long. but what happen if we type 100 chars in ? a nice overflow ;)
I hope you are folloing me.

let's continue.
We have to check how big is our buffer.According to IDA it is 75 chars long.

First, we look our stack parameters:

CODE:00401108 s = byte ptr -4Ch
CODE:00401108 argc = dword ptr 8
CODE:00401108 argv = dword ptr 0Ch
CODE:00401108 envp = dword ptr 10h
CODE:00401108 arg_11 = dword ptr 19h

see 's' ?
run softice and do :
? ~-4C
it gives us 75 :o)

For me it looks pretty much that the max size of the buffer is 75 chars.
Let's test and enter something like 80 chars :

-- The analyst's weird crackme --
---------------------------------
enter your serial please:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

our program crashes nicely , no wonder ;-)
we entered a string of 80 chars, which is 4 chars more than the max size of the buffer.
Having a look at the registers, i can see that EBP=41414141.
Interesting isn't it ? where are those 41h coming from ?
41h is the hexadecimal ascii value of "A" ;))
so we just overwrote EBP.. ok nice, but the best thing would be to overwrite EIP ;))
Once EIP is overwritten, we can execute any code we want!
ok, lets enter 84 chars to see what happens now :

**** read the next part ****
the analyst / ucf
07-17-2001, 03:04 PM
(2nd part)

-- The analyst's weird crackme --
---------------------------------
enter your serial please:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

ok now our app still crash, but we get :
instruction at the address 41414141h uses the memory address at 41414141h. memory cannot be read.
it in fact , tries to execute code at VA : 41414141h.
ok now i *HOPE* you know what to do !

what about replacing our return address with something different than 41414141h ?
say, something like the good boy message location ?

CODE:00401177 push offset aWooCongrats ; __va_args ; good boy
CODE:0040117C call _printf

hmm, ok we have to put '401177' as our return address and it will obvisously print it on our screen :)
ok, just before to do that, let's try to enter a different serial such as :

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1234

why ? just to see what is the return address now.we might have to reverse the byte's order.

here we go, it crashes at address "34333231h". so we have to inverse our return address.
now we have : 771140. this is "w@" in ascii

let's try to enter it :

C:\attente>weird
-- The analyst's weird crackme --
---------------------------------
enter your serial please:
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAw^Q@

wOO! congrats ;)

WOO! it worked!
note: there is still the pause that wait till we press a key, but when we press that key, EIP
get executed and we land at the good boy message!

here we go. :)
as i said, it was not that difficult, but rather new for a crackme ;)
i hope you learnt something from it, and i advise you to read some essays from phrack magazine.
Such as "Smashing the stack", and the one on win32 buffer overflow (phrack 55).

3) source of my lame weird crackme ;) (coded in 15 secondes)

#include <stdio.h>
#include <string.h>
#include <conio.h>
#include <iostream.h>

int main(){
int i,len,temp;

unsigned char name[75];

unsigned long check=0;

printf("-- The analyst's weird crackme --
");
printf("---------------------------------
");
printf("enter your serial please:
");

gets(name);
asm{ nop};

len=strlen(name);

//cout << len;
if (len < 25) goto theend;
if (len > 120 ) goto theend;
for (i=1; i <= len ; i++)
{
temp += name[i] ;
}

if (temp = 31337) goto theend;
if (temp < 5000) goto theend;
if (temp > 15000) goto theend;

goto theend;

printf("wOO! congrats ;)
");

theend:

getch();
return 0;
}

greetings go to :

duelist,dimedrol,ivanopulo,nu,CrackZ,G-Rom,iceman,spath,frog's print,Warezpup,corn,tin,
llama,quantico,carpathia,pain, yoshi.
i just can't be arsed to type every goddamn nicks, so greetings to my pals in #cracking4newbies, #ol,#u**.

copyright pissed away, all right reversed

tHE ANALYST [UCF/HERT]
woodmann
07-17-2001, 03:58 PM
Excellent !!!!!
the analyst / ucf
07-17-2001, 05:59 PM
woodmann (07-17-2001 13:58):
Excellent !!!!!

thx mate :)
it was not hard, was it ;-)
Kayaker
07-17-2001, 11:57 PM
Excellent indeed. No, no, that's not the phrase I want. F***ing A. Yeah, that's it ;)

I could see EBP being overwritten by the buffer overflow and figured that was the end of that line of questioning. So I started concentrating on the ReadConsoleInputA call following that in the 2nd input line (the 1st uses ReadFile to read in the characters), thinking there was some way to enter more than 1 character. But to do this I had to change the INPUT_RECORD structure of the call, but to do this I had to change the WINDOW_BUFFER_SIZE_RECORD structure, but to do this I had to...

Off on a tangent ;p

Weird. But interesting. Probably implementable in a commercial scheme if the programmer knew what he was doing. Say instead of jumping to the wOOhoo message you jumped to a routine (just the fact that you're here means the right s/n was entered, read in from a lic file, or whatever) which enabled some demo function by repairing some code, then fixed up the stack which was just corrupted, and then control was returned to the calling thread. Sure makes tracing for a good s/n difficult if the app keeps crashing on wrong entries.

Phrack mag you say? Sounds like some interesting bedtime reading. Congrats on an interesting challenge.

Regards,
Kayaker
the analyst / ucf
07-18-2001, 05:11 AM
Kayaker (07-17-2001 21:57):
Excellent indeed. No, no, that's not the phrase I want. F***ing A. Yeah, that's it ;)

I could see EBP being overwritten by the buffer overflow and figured that was the end of that line of questioning. So I started concentrating on the ReadConsoleInputA call following that in the 2nd input line (the 1st uses ReadFile to read in the characters), thinking there was some way to enter more than 1 character. But to do this I had to change the INPUT_RECORD structure of the call, but to do this I had to change the WINDOW_BUFFER_SIZE_RECORD structure, but to do this I had to...

Off on a tangent ;p

Weird. But interesting. Probably implementable in a commercial scheme if the programmer knew what he was doing. Say instead of jumping to the wOOhoo message you jumped to a routine (just the fact that you're here means the right s/n was entered, read in from a lic file, or whatever) which enabled some demo function by repairing some code, then fixed up the stack which was just corrupted, and then control was returned to the calling thread. Sure makes tracing for a good s/n difficult if the app keeps crashing on wrong entries.

Phrack mag you say? Sounds like some interesting bedtime reading. Congrats on an interesting challenge.

Regards,
Kayaker

hehe ;))
yeah, phrack is a good resource for knowledge indeed.
i didn't learn it from there tho.

http://packetstormsecurity.org/mag/phrack/phrack55/P55-15
win32 buffer overflows

and a general one :
http://www.shmoo.com/phrack/Phrack49/p49-14

buffer overflows are a part of my work actually ;-)
this said, a protection could use it someway yeah.
i will check that later ;-)
nice thing you did btw ;) but a bit complicated he? :)
ok, now i hope that i will get some feedbacks, and i want to know if ppl tried to make it work :)
another challenge coming somedays ;)
ie : writing a real exploits for some FTPd ;-)
which is more challenging that my easy weird crackme :)

best regards,

the analyst
DEATH
07-19-2001, 07:10 PM
Hello analyst

Actually I saw a solution that includes overflowing the crackme in another crackme, but that solution just overwritten the checksum code compared to a hash generated on few characters of the password...
r2r2
07-20-2001, 05:40 PM
hmmm is java vulnerable to buffer overflows?

personal msg to analyst: was that somehow linked to your recent paper covering the 'caramail' webchat protocol? =)

-r2
r2r2
07-20-2001, 05:45 PM
duh, a quick google search reported me that:

'For example, buffer overflow attacks are impossible in a Java program, because Java automatically checks that an array index is within the proper bounds. Unfortunately, full-blown range checking in C is impossible, because of the dichotomy between arrays and pointers'

www.mcs.csuhayward.edu/~simon/security/boflo.html

(nice links there)

again, nice crackme analyst
the analyst / ucf
07-23-2001, 09:38 AM
r2r2 (07-20-2001 15:45):
duh, a quick google search reported me that:

'For example, buffer overflow attacks are impossible in a Java program, because Java automatically checks that an array index is within the proper bounds. Unfortunately, full-blown range checking in C is impossible, because of the dichotomy between arrays and pointers'

www.mcs.csuhayward.edu/~simon/security/boflo.html

(nice links there)

again, nice crackme analyst

hello all :)

im back now ;)
i have been away for sometimes, coz i was getting engaged ;)
had a nice party and drank a lot ;]]
wish me good luck heh :)

anyway, im gonna read that page, thx for the link r2 :)
what do u mean with my paper on the web chat protocol ?
i did not overflow anything there ;))
tell me more :)

to death :

ah, in fact i got that crackme done for something like 1 year and a half on my had ;)
i wrote it for some tests at work, when i was doing (and i still do) vulnerability research..
i did modify it a bit to add some fake checks tho ;)
just to piss some boys off
feel free to mail me in case of need :)

regards all

the analyst (now engaged *doh* )
Kythen
07-23-2001, 02:31 PM
Hey Analyst

First of all, congrats on the engagement :) hehe, better get all your RE studying in now while you still can! ;)

Second, what kind of vulnerability research have you done? More on buffer overflows like this, or other areas as well? Plz mail me if you can, as your crackme has gotten me curious about these types of things :)
r2r2
07-24-2001, 06:05 AM
nothing, i was just wondering if your bof research was to discover new holes in caranewchat.jad =) (for those who didnt read analysts tut: its the webchat client)

but i found my answer when i saw java had his own bounds checking (bah that makes me hate java even more than before =), jk).


Snood!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Snood!!
PDA

View Full Version : Snood!!

ThRaX
07-15-2001, 09:32 PM
www.snood.com

I think this one will be fun, for newbies. (Very newbieish) but its not just a simple patch...It refines basic skills a lot though

If you get it please post your methods.
rmlobox
07-16-2001, 10:41 PM
Done...very newbie-ish indeed. Simple matter of patching a return... (hint)
ThRaX
07-18-2001, 07:52 PM
Oh yeah and try to get the correct serial as well.
noptical
07-19-2001, 12:59 AM
Bust-a-Move was my all time favorite game... and now i can play it with elite looking peices, how cool.. the game's an easy crack, but try training it... heh heh heh... oh well, i have some other projects in mind that should get me to the top of that high score list in no time
Muad'Dib
07-19-2001, 02:20 PM
This project could be a lot more interesting - and therefore I will attempt to add something to it. There are a few more things that could be done to make this game more "fun" - cheating maybe - and fixing a bug. First off, sometimes after a completed round, the program page faults. Task number one is to fix this. When you attempt to use the aimer or mulligan, it tells you that you won't be able to record your high score and you will have a piece of cheese next to your name. Make it so that you can use these features without that problem. Recap:

1. Fix bug
2. Allow aimer use without "cheese"
3. Allow mulligan use without "cheese"

Enjoy :)
ThRaX
07-21-2001, 11:30 AM
Ooh, this looks like fun!

So far all I've tried is removing the "cheese" next to your score...I got rid of the warning, but it still puts the "cheese" in...any ideas on this?
JaneK
07-21-2001, 05:03 PM
Hi,
I have registered snood, but I had to patch it (I thought I found the serial but it just does not work - don´t know yet what is wrong).
Anyway, I have fully functional prog now, saying "Registered to: %$.98nmlkjihgfec".
Will try the "cheese task".

janek
Muad'Dib
07-21-2001, 09:41 PM
I have completed all of the tasks I suggested as well as allowing use of the aimer and still allowing submission to the "world high score" charts. I did not bother to remove the messages as you did, though. If anyone is ready for me to post my essay, I will attach it to the next post.
Brill0
07-22-2001, 07:14 PM
post it, i have been playing snood for a while and it is a pretty good game, what is you high score, (without the aimer;))
Hoof
07-23-2001, 03:03 AM
Well, I was not going to have an in depth look at this Snood bull but when I installed it, it installed an application called GATOR. This sh!t makes me mad. Who the hell do they think they are installing apps without my knowledge? And it is Ad ware!!!

Damn lamers do not deserve to make any money from there applications.

He even has the balls to ask us to stop cracking his app. Well, up yours buddy. I will break it open and keygen its ass.

Hoof
FatHead_Slim
07-24-2001, 12:01 AM
Lol am i ever a newbie.... i cant even get the f ' n patch!..... i need hints... what a baby

ive found about 3 operations that use the data entered for the registration... and have determined the purpose of 2 of them but my eyes glaze over and i keep tracing into infinate darkness on the third and final...

plz give me a couple of hints

thanx for the project
ThRaX
07-26-2001, 08:53 PM
yes post the essay by all means, im totally stuck on your tasks ; )
Sphinx
08-07-2001, 10:21 AM
hi all

i`m stuck too
can`t find working serial i think i know where it`s done more or less but can`t follow it so no working serial found yet and about patching tried some places got it to say its reged but not all function are working then program checks if you are regged but that`s not the case i found location where the check is preformed on an address but don`t know how to change it to my benifit patch all ? that`s about 23 jne/je changes :(

pls post solutions thx
[NtSC]
08-11-2001, 03:10 AM
Cracking + Training: Snood V2.4.3
URL: www.snood.com
---------------------------------
W32Dasm-Ripped-Part:
---------------------
:0040143D E8AE280000 call 00403CF0

* Possible StringData Ref from Data Obj ->"Checked Registration"
|
:00401442 68F0214200 push 004221F0
:00401447 A291D54200 mov byte ptr [0042D591], al <-- al = 1 if registered User,so
;---------------------------------------------------------------------------------------
We change that Call... It just checks the Registration there,so nothing important at all
:0040143D E8AE280000 call 00403CF0
Size of Call = 5 Bytes..
;---------------------------------------------------------------------------------------
Edit to:
:0040143d b001 mov al,01
90 nop
90 nop
90 nop
;---------------------------------------------------------------------------------------
Hexadezimal-Offset: 143d / insert: b0 01 90 90 90
;---------------------------------------------------------------------------------------

Training The Game .....

Adress 4098f8 + 4098f9 offer 2 Inc´s.
Nop both of them out,and thats it...No Counter / Display Decrease anymore!

That means: 4098f8 = 90
4098f9 = 90

And your Game is trained..

Thats it....Have fun..
[NtSC]
Muad'Dib
08-11-2001, 10:29 PM
If anyone hasn't seen it yet, there is an essay that I wrote at http://www.immortaldescendants.org
anon
08-11-2001, 10:44 PM
[NtSC] (08-11-2001 01:10):
Cracking + Training: Snood V2.4.3
URL: www.snood.com
---------------------------------
W32Dasm-Ripped-Part:
---------------------
:0040143D E8AE280000 call 00403CF0

* Possible StringData Ref from Data Obj ->"Checked Registration"
|
:00401442 68F0214200 push 004221F0
:00401447 A291D54200 mov byte ptr [0042D591], al <-- al = 1 if registered User,so
;---------------------------------------------------------------------------------------
We change that Call... It just checks the Registration there,so nothing important at all
:0040143D E8AE280000 call 00403CF0
Size of Call = 5 Bytes..
;---------------------------------------------------------------------------------------
Edit to:
:0040143d b001 mov al,01
90 nop
90 nop
90 nop
;------------------------------------------------ [NtSC]

I was wondering about the KeyGen routine...

the return can also be patch at bad cracker located @ 004044ea either by nop'n it or by editing it to B001 -- mov al,1:

but I haven't been succesful in determining the keygen routine... was wondering if anyone had any insight
begginning should be located here.

:0040159C E84F270000 call 00403CF0
.
.
.
:004041F2 E899030000 call 00404590
.
.
.
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00405311(C)
|
:004052B0 33C0 xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052C3(C)
|
:004052B2 8A1406 mov dl, byte ptr [esi+eax]
:004052B5 80C9FF or cl, FF
:004052B8 2AC8 sub cl, al
:004052BA 02D1 add dl, cl
:004052BC 881406 mov byte ptr [esi+eax], dl
:004052BF 40 inc eax
:004052C0 83F814 cmp eax, 00000014
:004052C3 7CED jl 004052B2
:004052C5 8BAC24F8010000 mov ebp, dword ptr [esp+000001F8]
:004052CC 8BC6 mov eax, esi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052ED(C)
|
:004052CE 8A5500 mov dl, byte ptr [ebp+00]
:004052D1 8ACA mov cl, dl
:004052D3 3A10 cmp dl, byte ptr [eax]
:004052D5 751C jne 004052F3
:004052D7 3ACB cmp cl, bl
:004052D9 7414 je 004052EF
:004052DB 8A5501 mov dl, byte ptr [ebp+01]
:004052DE 8ACA mov cl, dl
:004052E0 3A5001 cmp dl, byte ptr [eax+01]
:004052E3 750E jne 004052F3
:004052E5 83C502 add ebp, 00000002
:004052E8 83C002 add eax, 00000002
:004052EB 3ACB cmp cl, bl
:004052ED 75DF jne 004052CE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052D9(C)
|
:004052EF 33C0 xor eax, eax
:004052F1 EB05 jmp 004052F8

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004052D5(C), :004052E3(C)
|
:004052F3 1BC0 sbb eax, eax
:004052F5 83D8FF sbb eax, FFFFFFFF

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004052F1(U)
|
:004052F8 3BC3 cmp eax, ebx
:004052FA 7424 je 00405320
:004052FC 680CF54200 push 0042F50C
:00405301 56 push esi
:00405302 E8B0180100 call 00416BB7
:00405307 83C408 add esp, 00000008
:0040530A 47 inc edi
:0040530B 83C615 add esi, 00000015
:0040530E 83FF17 cmp edi, 00000017
:00405311 7C9D jl 004052B0
:00405313 5F pop edi
:00405314 5E pop esi
:00405315 5D pop ebp
:00405316 32C0 xor al, al
:00405318 5B pop ebx
:00405319 81C4E4010000 add esp, 000001E4
:0040531F C3 ret
.
.
.

and here are all the jumps to the bad cracker... which will also patch the registration which is one possible exit to first call listed

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004041FC(C), :004042ED(C), :00404350(C), :004043CB(C), :004043D9(C)
|:00404423(C), :00404459(C)
|
:004044E8 5F pop edi
:004044E9 5E pop esi
:004044EA B001 mov al, 01
:004044EC 5B pop ebx
:004044ED 81C408010000 add esp, 00000108
:004044F3 C3 ret


Lesson #3 kiddies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Lesson #3 kiddies
PDA

View Full Version : Lesson #3 kiddies

Rage9
08-02-2001, 01:54 PM
well i finaly got done with this kiddies, this one should be lots harder, well i just hope it takes Code_Inside more then 5 min to finnish, haha.

http://www16.brinkster.com/realcool23/download/RIII.zip

Objectives: Are in readme file in the zip file, so have fun!

if you really need a hit, e-mail me or somthing, l8er guys.

-Rage9
CoDe_InSiDe
08-03-2001, 12:06 AM
Hi Rage9,

Haha ;)
i've taken a look at it and fixed the Import Table.
Now i need to load the library and produce a Keygen (and maybe more ;) ) so i'll be back :)

Cya...

CoDe_InSiDe
ThRaX
08-03-2001, 12:26 AM
Er...Well i'm quite stuck ;)

I'm afraid I've never dealt with fixing import tables so...someone wanna point me in the right direction? (or downright hold my newbie hand through this? ;)
CoDe_InSiDe
08-03-2001, 12:32 AM
Hi ThRaX,

Look in this Mini project section somewhere for some thread :)
I don't know exactly which anymore but it was about Import Table rebuilding ;)

Cya...

CoDe_InSiDe
CoDe_InSiDe
08-03-2001, 12:34 AM
http://usa3.hostrack.net/woodmann/Ultraboard/Public/HTML/B9/733-1.topic.html

This is the correct link ;)

Cya...

CoDe_InSiDe
CoDe_InSiDe
08-03-2001, 01:10 AM
Hi Rage9,

Ok, i solved it now completely but i don't know if i solved it according to your ideas ;D
About Loading the .dll was easy (Simple Renaming ;) ).
But to show the "other" window was a little bit harder.
I tried several things and it just simple didn't want to show that F*ck*ng window (pardon my french ;D ).
So i decided to copy the entire Resource Section from the .dll into the .exe, fixed the PE Header, inserted a jump to my code (somewhere at the end of the first Section ;) ) changed a few things and let it jump back :)
Now it showed me the window hehe ;)
To keygen this is easy, but about the window "procedure" from me is this the correct way to do it? ;D

Cya...

CoDe_InSiDe
Kayaker
08-03-2001, 04:04 AM
Hi All,

Entertaining as usual Rage9 ;D Here's my keygen.

There is an easier way to show the right Dialog box CoDe_InSiDe, you just need the correct pointers to the one in the dll ;)

Cheers,
Kayaker
CoDe_InSiDe
08-03-2001, 04:48 AM
Hi Rage9,

Ok, here's my Keygen heh ;)

Kayaker: really, oh i tought i already checked all the pointers heh, well gonna check it again ;)

Cya...

CoDe_InSiDe
Rage9
08-03-2001, 09:18 AM
Well i Knew the import wouldnt be too hard.... with only 2 dll's haha, Code_Inside, I think you did it the extreemly hard way, there are 2 api's you can use, they both have `resouce` in there name.
well time to go back to work.... l8er.

-Rage9
cerb^^
08-03-2001, 11:32 AM
Hi,

can anyone write a short Tut about manuall repair Import table for this example here. I have problems with that and an example would be nice.

Thx
Sphinx
08-04-2001, 07:06 AM
well i joined too, but it will take a while reading a lot about pe file format right now i think i will solve it someday

CoDe_InSiDe thx for the linkz very usefull

l8er
cerb^^
08-05-2001, 05:52 AM
Help!!

can anyone help me i cant repair the import table.

please help

Thx
cerb^^
LaptoniC
08-05-2001, 05:21 PM
Rage9 (08-03-2001 07:18):
Code_Inside, I think you did it the extreemly hard way, there are 2 api's you can use, they both have `resouce` in there name.
well time to go back to work.... l8er.

-Rage9
Am I blind? I havent seen any resource api in the exe.However I loaded dialog box(instead of pushing hinstance push the result of loadlibrary) and keygenned it.I have done like Kayaker said changing pointers.
Rage9
08-05-2001, 10:07 PM
cerb^^: here u go, just read the attachment....

LaptoniC: sorry my bad, that way is much easier, the other way you would have to add the api's to the import table, sorry!

-Rage9
Hoof Arted
08-06-2001, 02:13 PM
I have managed to correct the import table but now I am stumped with the rest of the tasks. I have tried to follow up the "clues" provided in the messages above but this is not getting me anywhere. Please provide me with an idea of where I am supposed to be looking.

Thanks

Hoof
Kayaker
08-06-2001, 06:24 PM
Rage9 (08-05-2001 20:08):
LaptoniC: sorry my bad, that way is much easier, the other way you would have to add the api's to the import table, sorry!
-Rage9

Actually, I found it interesting that you *could* load a dialog resource from a dll without using FindResource and LoadResource. You just need to modify the params of WinMain and CreateDialogParamA.

I've been playing with this to see how you could load the resource using FindResource and LoadResource. I made up a skeleton app using Iczelion's tut 10-1 example. Adding a LoadLibrary call for the dll and changing WinMain and CreateDialogParamA as above I was able to duplicate the results of patching the crackme, the correct dialog box was called.

However, I got some strange results when I added the following code:

invoke FindResource, hInstance_of_Dll, ADDR DllResource, RT_DIALOG
invoke LoadResource, hInstance_of_Dll, eax
;returns a global memory pointer of the resource that can be used in subsequent API's
invoke CreateDialogIndirectParam, hInstance, eax, 0, wc.lpfnWndProc, 0

I get the dll resource displayed, but it's corrupted. The bitmap, icon and buttons don't show, but the edit boxes, static text and main window does. Even more strange is that there seems to be a morphing with the original dialog resource that's in the exe (I used Icz's example resource). The dll dialog box now has menu items as well!

LOL, what's the term, Transmogrification? It seems that some of the exe dialog resource is in memory where only the dll dialog resource should be, after the LoadResource call.

Anyway, I'm just trying to figure out the proper procedure to call a dialog resource from a dll using FindResource and LoadResource. CreateDialogIndirectParam is supposed to create a modeless dialog box from a dialog box template in MEMORY, so I think this is the right API to use, and it does work - to a degree ;)

Anybody got any insights?

Kayaker
cerb^^
08-07-2001, 09:12 AM
Hello,

i have little problem with this lesson here. I have a short knowledge about PE Header and Import Table and short knowledge about programming assembler.

Can anyone please where made this lesson successfully explain the steps to get the right dialogbox. So that a newbie can following the steps.

Sorry for my bad english, but i would like learn Reversing.

Thanks

cerb^^
Hoof Arted
08-07-2001, 03:17 PM
I have had a look at this section of code :

004010C7 |. 6A 00 PUSH 0 ; /lParam = 0
004010C9 |. 6A 00 PUSH 0 ; |pDlgProc = NULL
004010CB |. 6A 00 PUSH 0 ; |hOwner = NULL
004010CD |. 68 09304000 PUSH Rage9III.00403009 ; |pTemplate = "FIRST"
004010D2 |. FF35 D0304000 PUSH DWORD PTR DS:[4030D0] ; |hInst = 00400000
004010D8 |. E8 FD010000 CALL <JMP.&USER32.CreateDialogParamA> ; \CreateDialogParamA
004010DD |. 8945 B0 MOV DWORD PTR SS:[EBP-50],EAX

The problem is that I am not exactly sure what are the correct pointers to push. I have tried many different memory locations but nothing seams to work. The closest I have got is to PUSH 40300F at 004010CD and PUSH DWORD PTR DS:[4032E0] at 004010D2. It is quite clear that this is not working. Can anyone tell me what I should be looking at ?

Hoof
Kayaker
08-07-2001, 04:12 PM
Hi Hoof,

I think you've got that part perfect. You need to do the same with WinMain as well, hInstance needs to be of the dll not the exe. WinMain is the procedural call right after LoadLibrary and just before the ExitProcess call.

Kayaker
Hoof Arted
08-07-2001, 04:23 PM
THANK YOU..... worked first time. I was looking for with winmain call but could not see it.

Keygen to follow shortly.

Hoof
Hoof Arted
08-08-2001, 05:45 AM
Learned a lot from this lesson. Thanks. A little on the tough side for newbies like me. Here is my keygen. Sorry it is written in VB.

Hoof
cerb^^
08-11-2001, 03:57 PM
Hi,

I have get the right Dialogbox. But one I didnt understand.

00401048 |. FF35 D0304000 PUSH DWORD PTR DS:[4030D0]

How come you to the Address 4032E0?

That is the hinstance?
Kayaker
08-12-2001, 09:40 PM
cerb^^ (08-11-2001 13:57):
I have get the right Dialogbox. But one I didnt understand.

00401048 |. FF35 D0304000 PUSH DWORD PTR DS:[4030D0]

How come you to the Address 4032E0?

That is the hinstance?

That's right cerb.

The reason you use [004032E0] in the WinMain and CreateDialogParamA calls is that this is the memory address which holds the hInstance of the dll which contains the resource you're trying to load. The return value (in eax) of the LoadLibraryA call is a handle to the module, its "Instance".

* Possible StringData Ref from Data Obj ->"dialogdll.dll"
|
:00401016 6827304000 push 00403027

* Reference To: KERNEL32.LoadLibraryA, Ord:01A9h
|
:0040101B E838030000 Call 00401358
:00401020 0BC0 or eax, eax ; test if eax is zero
:00401022 7515 jne 00401039
.
.
.

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401022(C)
|
:00401039 A3E0324000 mov dword ptr [004032E0], eax ; store hInstance of dll

I've got example source of the crackme including calling the dll dialog resource with FindResource and the bitmap with LoadBitmap. In this case you don't need to change the hInstance of WinMain to that of the dll. I'll post it in a day or two if anyone is interested.

Kayaker
cerb^^
08-13-2001, 02:08 AM
Hi,

can you please post it. Im interessted.
Rage9
08-13-2001, 10:45 AM
me too, post away!

-Rage9
Kayaker
08-13-2001, 08:47 PM
Hi All,

OK, here's my source code for Rage9's Crackme #3, written from disassembly, with keygen added in.

It demonstrates calling dialog and bitmap resources from a dll by using CreateDialogParamA and changing the Instance handle of WinMain to the context of the dll, or by using CreateDialogIndirectParamA and loading the resources independantly with FindResourceA and LoadBitmapA.

As a keygen, the Serial edit box is used to display the serial generated from the Username.

Let me know if there's any questions.

Kayaker
Hoof Arted
08-16-2001, 01:58 AM
I have learned so much from this lesson.... great! I would like to make sone suggestions for the next, if there is going to be a "next". How about we try something with file access and maybe some "easy" encryption, if there is such a thing? I would like to also see more involving repairing damaged files/ PE as this has been the area where I have learned the most from in this lesson.

Looking forward to Lesson #4

Hoof
UrgeOverKill
10-27-2001, 08:33 AM
Well I've enjoyed following the threads on the previous lessons.

Anybody up for a fourth ??
Sphinx
11-06-2001, 07:36 AM
hi all

i joined this lesson quite awhile ago but still didn`t complete it cuz the pe file format was totaly new for me so i took Code_inside`s advice and read a lot of the old threads. Just to get a better handle on this subject more or less related to packers of the .exe I wrote my own pe file analyser, this way i learned alot off usefull things for the future.

i also read the solutions for this lesson @ that time and looked what the did but now i know where i can find these things in the Import table. And i think i can do it now on my own :)

Sphinx


GDI Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > GDI Reversing
PDA

View Full Version : GDI Reversing

Kayaker
08-21-2001, 11:44 PM
Hi All,

And now for something completely different...

Here's a little program I've played with to explore the GDI functions. It's possible to change the way a program looks as well as the way it behaves.

h**p://www.simtel.net/pub/simtelnet/win95/desktop/we2001e.zip
h**p://www.wineye.net/download/wineye2001e.exe
(585Kb)

This is a silly desktop utility which displays a pair of eyes that follow your mouse around. It uses a resource dll for all its window and control creation, but the eyes themselves are created runtime with GDI functions.

To figure out what APIs are used and when, you need to use an API monitor such as APISpy32. Once you've determined where and how the eyes are created you can change any of the parameters to control their drawing. The program itself allows you to change many of the parameters yourself, but the idea is to modify them through code instead.

The project is more just to explore the routines on your own, but a few suggested tasks are to:

1. Get rid of the nag screen, since everybody loves nag screens ;p

2. Stop the eyes from disappearing when the mouse hovers directly over them.

3. Make the left eye 50% smaller.

4. Make the right eye 50% larger, but don't allow the region to be "clipped".

5. Change the color of the pupil to some other color than the default.

6. Have the eyes positioned elsewhere on the screen, say the upper right or center, as they are created.

7. An advanced task might be to add a menu item to allow moving the eyes to the upper right corner of the screen. This would require adding a new menu resource and breaking into code when the item is selected. From there new code would have to be added which emulated or accessed the existing code which draws and positions the eyes.

If anybody gets this last task, a little tutorial would be beneficial to everyone ;)

A little different from the norm, but the principles are exactly the same as when working with other APIs and when performing other reversing tasks. When looking at the GDI output in APISpy32 you can pull out patterns in the calls, as well as the addresses and parameters of the API calls that are used in creating each separate eye, pupil and iris. If you can sort out what functions control which graphic, you can then go about modifying them. I might suggest monitoring with APISpy32 *before* getting rid of the nag screen, since it creates a nice break in the output.

You can modify the parameters runtime in SoftIce and see their effect, but if you can patch the file permanently all the better. Don't ignore the Kernel and User APIs which control window and rectangle creation. You'll need to modify your winice.dat file to include EXP=c:\WINDOWS\SYSTEM\GDI32.DLL.

Good luck and have fun.

Cheers,
Kayaker
CoDe_InSiDe
08-22-2001, 01:42 AM
Hi Kayaker,

Hmm, different kind of project ;)
I want to say 2 things now:

1. A little bug in the program, when the Nag Screen comes up try pressing with your right mouse button on the Eye Icon in the taskbar, the program will crash ;)

2. About your fifth task (Changing the pupil) you can do that in the program itself ;D

Ok, that's all hehe :)
Further examination will follow (i think) ;)

Cya...

CoDe_InSiDe
Fake51
08-23-2001, 07:40 AM
Interesting to see the move to something almost not about cracking, but solely on rce (only the nag left). Guess this is a good turn.

Bluajn cxielojn
Fake
[yAtEs]
08-24-2001, 08:17 AM
This sounds like some evil plan to make the perfect set of eyes for Kayaker, i would strongly advise against this task ;)

regards, yates.
Kayaker
08-24-2001, 09:38 AM
LOL [yAtEs], Nah, if I had wanted to coerce people to do my evil bidding I would have used a sexy graphic of a gorgeous girl and asked "Make the left one 50% bigger, make the right one 50% bigger..." :D

Regards
[yAtEs]
08-25-2001, 10:55 AM
_heh_ ;)
Clandestiny
08-25-2001, 12:25 PM
:D Kayaker, you're incorrigible ;)


Is this our new home, +Sandman?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is this our new home, +Sandman?
PDA

View Full Version : Is this our new home, +Sandman?

JimmyClif
10-28-2000, 09:23 AM
I see newbiesforum.cjb.net directed me here 8-)
ThRaX
10-28-2000, 09:27 AM
I guess it is? Time to start again, i guess...

--thrax
+Sandman
10-28-2000, 10:22 AM
Good question.. While this mb is pretty much safe and secure from outside interference (no names mentioned but you can guess who I mean) it does mean however, that it must share with two other mb's, thereby losing some of it's independance. A small price we must pay for it's continual security.

It's going to take me a few days to fully configure this mb but when I've done I'll start work setting up the "mini-project" area, since this offers hands-on experience for those with little rce experience.

In the meantime, treat this place as home, grab a few (cold) beers and settle down to some serious rce work..)

Regards
+Sandman


Reversing Query - Please Help!!! (BTW first RCE query on the new Board) ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reversing Query - Please Help!!! (BTW first RCE query on the new Board) ???
PDA

View Full Version : Reversing Query - Please Help!!! (BTW first RCE query on the new Board) ???

ReD_AnT
10-28-2000, 11:08 AM
Hi Friends,

First of all I am thankful to +Sandman, +tsehp for maintaining this wonderful place in spite of all odds. I hope that now we don't have to move again for a long time...

I am a newbie reverser and in need of some help.
I am trying to crack MerakMail for windows 9x version : 2.10.340 (not the pro version)
(URL : www.icewarp.com or www.merakmail.com).

I have found that the main protection is located in the files config.exe and control.exe.
I disassembled config.exe,looked for the relevant strings, found quite a few, was trying to look the conditional jumps just before the error messages........
Now I am facing a peculiar problem.....Some of the jumps point to the middle of an instruction... (i hope I am making myself clear!).
Given below is the relevant piece of code :-

---------------The Jumps------------------
:004A2591 7373 jnb 004A2606 ---> while 5 byte instruction begins at 04A2605
:004A2593 66756C jne 004A2602
:004A2596 2E004572 add byte ptr cs:[ebp+72], al
:004A259A 726F jb 004A260B
:004A259C 7200 jb 004A259E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A259C(C)
|
:004A259E 0000 add byte ptr [eax], al
:004A25A0 52 push edx
:004A25A1 65 BYTE 065h

-------The locations pointed to by jumps---------

:004A25FE 8B00 mov eax, dword ptr [eax]
:004A2600 E847D9FAFF call 0044FF4C
:004A2605 6830200000 push 00002030

* Possible StringData Ref from Code Obj ->"Warning"
|
:004A260A 681C264A00 push 004A261C

* Possible StringData Ref from Code Obj ->"Your trial version has expired."
|
:004A260F 6824264A00 push 004A2624
:004A2614 6A00 push 00000000

WinDasm gives an error while trying to execute these jumps..... Call/Jumps unsuccessful.

There r many such jumps....

I couldn't understand this at all... what is happening?
Is the code there just to fool the crackers ?
or some runtime patching is happening ?
or some anti-disassembler is there ?

I tried to see what happens at these jumps at runtime. So I loaded Softice and ran the program.
The program runs fine but when I click the register button (which remains enabled) nothing happens....... When softice is NOT loaded, then on clicking the register button a box with a filled up reference key and 2 blank text boxes comes-up (which r meant to input the licence no.)

So there is some debugger detection inside the program....
How to find which type of detection is there? How to get to it ? and how to disable it ?

Please guide me! I am a newbie and please don't flame me for asking such silly questions...
(Maybe i have picked up a real tough proggie... But I think it is great opportunity to learn...)

Thanks a lot in advance and sorry for such a long post...

ReD_AnT ???
esther
10-28-2000, 12:59 PM
Sorry Read above post on RE:

esther

ReD_AnT (10-28-2000 01:08 a.m.):
Hi Friends,

First of all I am thankful to +Sandman, +tsehp for maintaining this wonderful place in spite of all odds. I hope that now we don't have to move again for a long time...

I am a newbie reverser and in need of some help.
I am trying to crack MerakMail for windows 9x version : 2.10.340 (not the pro version)
(URL : www.icewarp.com or www.merakmail.com).

I have found that the main protection is located in the files config.exe and control.exe.
I disassembled config.exe,looked for the relevant strings, found quite a few, was trying to look the conditional jumps just before the error messages........
Now I am facing a peculiar problem.....Some of the jumps point to the middle of an instruction... (i hope I am making myself clear!).
Given below is the relevant piece of code :-

---------------The Jumps------------------
:004A2591 7373 jnb 004A2606 ---> while 5 byte instruction begins at 04A2605
:004A2593 66756C jne 004A2602
:004A2596 2E004572 add byte ptr cs:[ebp+72], al
:004A259A 726F jb 004A260B
:004A259C 7200 jb 004A259E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004A259C(C)
|
:004A259E 0000 add byte ptr [eax], al
:004A25A0 52 push edx
:004A25A1 65 BYTE 065h

-------The locations pointed to by jumps---------

:004A25FE 8B00 mov eax, dword ptr [eax]
:004A2600 E847D9FAFF call 0044FF4C
:004A2605 6830200000 push 00002030

* Possible StringData Ref from Code Obj ->"Warning"
|
:004A260A 681C264A00 push 004A261C

* Possible StringData Ref from Code Obj ->"Your trial version has expired."
|
:004A260F 6824264A00 push 004A2624
:004A2614 6A00 push 00000000

WinDasm gives an error while trying to execute these jumps..... Call/Jumps unsuccessful.

There r many such jumps....

I couldn't understand this at all... what is happening?
Is the code there just to fool the crackers ?
or some runtime patching is happening ?
or some anti-disassembler is there ?

I tried to see what happens at these jumps at runtime. So I loaded Softice and ran the program.
The program runs fine but when I click the register button (which remains enabled) nothing happens....... When softice is NOT loaded, then on clicking the register button a box with a filled up reference key and 2 blank text boxes comes-up (which r meant to input the licence no.)

So there is some debugger detection inside the program....
How to find which type of detection is there? How to get to it ? and how to disable it ?

Please guide me! I am a newbie and please don't flame me for asking such silly questions...
(Maybe i have picked up a real tough proggie... But I think it is great opportunity to learn...)

Thanks a lot in advance and sorry for such a long post...

ReD_AnT ???
gAnZ
10-29-2000, 01:55 AM
I'll try to help you.
ReD_AnT
10-30-2000, 12:54 PM
Hi Friends,

To Esther :
Thanks a lot for the help...
I used +FP's frogsice and found out that indeed it was doing the debugger check.
The check was meltice... using the CreateFileA technique...
But still the app. is far from being cracked...

To gAnZ :
Thanks a lot for offering ur help...
I am looking forward to it... :)

I am grateful to both of u guys..
------------------------------------

What i have done ?

To stop the debugger detection I patched the cmp eax,-1 part at both the checks (check for SICE at : cs:0049382F and check for NTICE at cs:0049386B)

But the App. is perhaps having some kind of CRC check : when I ran the patched config.exe i got this nice message :
" a protection error occured..blah blah .. the app cannot be run .. program might be infected with a virus or CRACKED."

(Frankly speaking, (though this sounds like a lamer) this app. is the first one, with anti-debug protection and crc checks etc, that I am doing...)

So again I am in a fix... :-(
Any suggestions/advice?

ReD_AnT ???
esther
10-31-2000, 07:26 AM
Hi Red_Ant,
I'm fixed too ??? hehhe this is a delphi prog.I am not experience enough to reverse this prog.
others might able to help ,Sorry :(
post again with a BIG Help you would probaly get one.btw I'm still trying,hope can find some answers.did you notice the reference key
strange is'nt it....it seems that its a empty shell...

cya
regards
esther
goatass
10-31-2000, 08:11 AM
You said that this is a delphi program ? Have you tried using DeDe to decompile it ? just a suggestion.

goatass
esther
10-31-2000, 10:30 AM
Hi Goatass,
Thanks for the input,I simply forgot that,
Thanks again

regards
esther
ReD_AnT
10-31-2000, 04:21 PM
Hi Esther,

So now I have a fellow reverser who is working on this app. too... Thanx a lot brother.

Yep, I too had found out that it was written in Delphi (some string refs also point that out).
And I too forgot DeDe... thanx Goatass for pointing that out :-)
Esther u r right, maybe I should post again with a BIG help...to get some answers...

Btw don't u think that this target is worthy enough of being selected as a target for one of the projects here...(it will certainly give newbies like me a chance to learn some advnaced techniques)
What do u say?

Btw I couldn't understand what u were saying about the reference key, shell etc? Sorry!!! Could u please elaborate a little bit?

Thanks a lot once again...

Regards.

ReD_AnT ???
(still confused)

Hey gAnZ where r u? U promised that u'll help!!!
C_DKnight
11-01-2000, 11:36 AM
hey guys I saw this thread last nite and downloaded the app which (unfortunately?) was the PRO version.. well anyways I just took the ordinary version and saw its code didnt differ that much from the analysis what I came up with the PRO version..

I traced a _lot_ and found practically nothing useful.. just some arithmetic stuff done here and there but no solid part that'd clearly create the valid serial :( some FPU code in few parts which I'd say checks the remaining days (toggle FPU registers in SoftICE with "wf") or at least does something with it .. not sure though

Overmore it really requires a lot tracing to finally find the place where the messagebox pops up .. and its rather funnily created (small excerpt from somewhere :)):

:00450350 53 push ebx ; Save process ID?
:00450351 83C4E4 add esp, FFFFFFE4
:00450354 8BD8 mov ebx, eax
:00450356 8BD4 mov edx, esp
:00450358 8BC3 mov eax, ebx ; Load it to eax
:0045035A E841FFFFFF call 004502A0 ; Trace

---------------------------------------------------------

Behind the call dwells PeekMessageA which I belive checks which Process ID is being processed and sets flags according to that

Finally follows TranslateMessage & DispatchMessageA of which the latter is the one to 'create' the messagebox.

Since the code location is called all the time it's of no use to do any patching here...

Well thats all the 'useful' information I could so far gather.. more to follow if/when I figure out something. I know I might understood things wrongly as I'm only in a newbie level so please dont hesitate to correct this text if possible. Please also post your progress (if any) on this msgboard :) Thx

-C_DKnight
C_DKnight
11-02-2000, 08:16 AM
woo finally made some sort of useful progress... again was working with the PRO version but I hope the main code structure matches with the normal version...

Did a string search as I was a bit frustrated already and my eyes caught these two strings: <Demo Version> and <Full Version>

Selected either.. scrolled up some code to find interesting bits.. and I did!
after scrolling up a few conditional jump spots there was a call to somewhat
a lengthy routine.. the keycheck routine I bet. The downside is that it's _quite_ lengthy one and has several checks and some 'encryption' (xor, rol) instructions which then compare with your serial and the encrypted one (sortof).. but I'm still working on this to find a way to the final compare (cmp eax,ebx if I recall) without having to set dozens of "r fl z" :)

Hopefully I can fully reverse the algorithm but even if I didnt, so far this 'project' has proved to be a valuable experience, thx to Red_Ant ;)

-C_DKnight
ReD_AnT
11-05-2000, 04:11 PM
Hi C_DKnight,

Thanks for your help ;-)
I was really stuck up... nothing seemed to work out...
You are probably right the protection scheme is perhaps the same in both the versions.
I searched for <Demo> in WinDasm and I found it in the non-pro version too.
And then I moved around a bit in that piece of code and yes interesting stuff...
Few comparisons and conditional jumps.
Btw u must have noticed that other than <Demo> and <Full Version> there is another type ie the <Unlimited>...what would that mean??? some sort-of time-unlimited demo version.
Tracing,tracing and more tracing and still no luck...
But even if the proper jumps are found, the patching won't work, because of CRC checks etc so at least serial-fishing and then maybe a keygen must be done. Is there any way of killing the CRC-checks?
This target has really gone out of hand :(
Again one old question : what happens to those jumps which jump to the middle of an instruction.

Could u please post ur observations and hints etc. And if u happen to reverse the algo. could u please write a tutorial, explaining the general methodologies and techniques that should be used for such a target for the benefit of newbies like me.

Thanx a lot once again... :)

Regards.

ReD_AnT ???
C_DKnight
11-06-2000, 12:14 PM
well.. about the unlimited version.. i dunno either. I'd bet on the unlimited time-trial though.. and what comes to the serial algorithm, its very irritating and has got lots of checks and i'm lost there too. It does something with your serial first (messes up with it, takes an encrypted version or something) and then compares some chars with 'good' part of the real serial

repnz
scasb

or something similar i'd remember.. the first check I pass as I got a match with the 'string' in EAX and ES:EDI (Scasb instruction) .. the matching part is "-" (2Dh) .. but from then on i'm stuck too and cant get anywhere without setting additional "r fl z" .. d'oh ;( ... if anyone's able to help please post here.. thx :)

-C_DKnight
esther
11-08-2000, 04:15 AM
Hey Red_Ant,
I didn't find any solutions to it :-(
that's why I did'nt post.
Read Kayaker's post,see a experience reverser
talk about this prog...
Anyway,thanks for the "project" hard one hehhe and C_Dknight too.

regards
esther


Greetings for all of you, infos on this place
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Greetings for all of you, infos on this place
PDA

View Full Version : Greetings for all of you, infos on this place

tsehp
10-28-2000, 01:58 PM
hi,
I'm very glad to see this forum back to life, you can be sure that all of us : carpathia, Amante4, Sandman and me will do anything to keep
it clean and working well.

All the threads and posts are backed up, it takes me *very* little time
to restore the place just in case something goes wrong. The host is
private and nicely given to us by woodmann, the fravia mirror was kept here since months and never had to interrupt.

Actually, you upload some small files (500k) if you are registered, I'm
not asking for valid emails, but you can be reported immediatly for responses on a topic you start.

This place just started actually, we wanted to make a test phase without starting as fast as this, but everything was destroyed too fast
so I had no choice.

I'm currently working to improve this place, adding a reliable local search engine indexing the most essays I could host here, this will appear normally in the next few days.

I badly need some suggestions and critics on this work, just to make it
the way you want, so post what you think, even if you don't like, we need all the points of view.

Best regards,

tsehp
Scally
10-30-2000, 01:58 PM
Great work, guys. I'm back after a little absence & missed the ugly stuff. Thanks for keepin it going.
Greets & thanks to Kayaker.
Scally
goatass
10-30-2000, 03:46 PM
Hi everyone, wanted to say Great Job to +sandman, +tsehp and the rest of the people that helped bring these great forums back.

One thing I'd like to see come back is the newbies project forum. We got it started a couple weeks ago but it went down. It would be great to see it come back. I don't mind helping out if any help is needed.

greets
goatass
RalDnoR
10-30-2000, 04:03 PM
Hi Tsehp!

Great to see the effort you put in this board! I hope it will soon become a large knowledge area. If there's anything I can help you with plz. let me know.

Cheers,


what happened with the eassy's search engines?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > what happened with the eassy's search engines?
PDA

View Full Version : what happened with the eassy's search engines?

Ferry
10-29-2000, 03:21 AM
what happened with the eassy's search engines?
Kwazy Webbit
10-30-2000, 06:23 AM
Ferry (10-28-2000 06:21 p.m.):
what happened with the eassy's search engines?

I assume you mean essay search engines. Im not sure, I think crktutse.cjb.net is still up.. Although I cannot get onto the server at the moment. If that is gone, I guess it is time for someone to start a new project ;)

-KW-
tsehp
10-30-2000, 06:40 AM
I'm actually on this, this will be a local one. I'm actually searching a
reliable script and soon adding much more essays on this site.

tsehp


REKML subscription
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > REKML subscription
PDA

View Full Version : REKML subscription

jimbeam
10-29-2000, 09:40 AM
Hi,

does anyone have an idea, how long it takes to get the REKML membership approved after subscription (membeship is needed for accessing the file area - I'm looking for a crypkey essay which must be there) ?

Is there any chance to become a member ?

And of course - is it worth to request the membership (are the monthly newsletters OK?) ?

Thanx

PS: I like the new MB - keep on your good work!
stillnewbie
10-29-2000, 09:50 AM
Hi there,
you will receive an email after you subscribe
about 15 minutes or 1/2 an hour maybe they will tell you how to activate it.

>I'm looking for a crypkey essay which must be there) ?

not sure,you have to check it out yourself

regards
stillnewbie
Carpathia
10-29-2000, 10:35 AM
Hi JimBeam,

AFAIK the confirmation email should be sent shortly after you request to subscribe. The list does not require my approval for membership, so if you still havent recieved it, try again.

If you still struggle, please let me know, and ill add you manually, and look into it.

The crypkey essay is still in the files area. Int he meantime you can also find it on my site at carpathia.cjb.net/CrypKey.zip.

I encourage everyone to at least try to read it, as its a very good piece of work by Maverick. Its fairly advanced tho, so be warned ;-)

> And of course - is it worth to request the
> membership (are the monthly newsletters OK?) ?

Sure, the newsletters are fantas... erm no actually, theyre ok I suppose ;-) Contributions are few and far between, but occasionally theres a few very good essays you wouldnt find from the usual haunts.

The claim of being a monthly newsletter should be taken with a pinch of salt. It gets sent out when I have time to compile it, and when theres a reasonable amount of content. There should be a new newsletter sent out tonight, hopefully.

Regards

Carpathia
jimbeam
10-31-2000, 07:19 PM
Hi,

Thanx for your comments.
I got the email and I followed the instructions - but I still have no access to the old monthly letters and the files area.

In the Membership section I just see the following text:

"The moderators have
not yet approved your
membership to this
group. You may still
update your
membership options or
unsubscribe."

Carpathia: Thank you for the link to the crypkey essay. It seems to be very useful - it will take me some time to read it. Anyway, I would like to become a member of REKML.

Thanx again,
jimbeam


+Sandman Re-painting
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > +Sandman Re-painting
PDA

View Full Version : +Sandman Re-painting

Petty Question
10-29-2000, 11:58 AM
I know this sounds petty and that we a lucky to have a board, but, can the colors be changed?

The dark gray and blue and dark tan and black are hard for an, let's say not a spring chicken, to read.

Thanks

Old Country Gentleman
+Sandman
10-29-2000, 04:02 PM
Greetings...

There are just two skins available with this mb, this one, the default for UltraBoard 2000 and the darker one, which is perhaps a little hard to read sometimes. I will try out both and see which one is best for this forum.

Regards
+Sandman
Critter
10-29-2000, 04:50 PM
this silver/gray seems a bit easier to read.....
hz
10-29-2000, 06:32 PM
hi,
yes the new colours are better.
regards
hz
Old Country Gentleman
10-31-2000, 12:22 PM
Yes, the silver/black is much better, can even read withiout the bi-focals.

Thanks


To +Sandman
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > To +Sandman
PDA

View Full Version : To +Sandman

RalDnoR
10-29-2000, 05:01 PM
Hey dude!

Nice to see that you've found another location so quickly. It seems that this board is much faster than the Ex-Board garbage.
What's the status with the projects-forum? Can you divide this category into more forums?
I'd still like to moderate if that's possible. Unfortunately I haven't got any copies of the messages posted in the Ez-Board forum, because there were a lot of interesting ideas and comments.

Cheers,
+Sandman
10-29-2000, 06:30 PM
Greetings RalDnoR...

As soon as everyone is settled in here we will indeed fire up the mini-project area and continue on with our original plans..

The sudden loss of our Ezboard forum took me by surprise and was not able to implement any form of backup on the postings.. This is not the case here, everything is backed up daily by +tsehp, including the settings for this and +fravia's mb's.

Regards
+Sandman
ThRaX
10-29-2000, 07:48 PM
What was that people were talking about earlier like "Someone" got the Ez-board shut down?


Dongles?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dongles?
PDA

View Full Version : Dongles?

ThRaX
10-29-2000, 07:46 PM
Hey cool new colors!

Okay in my relatively short reversing days, I've been hearing the word "dongle" a lot...What exactly is this? I've heard they are a difficult protection scheme of some sort...Could anyone give me more details, or an example of one?

Also, what exactly does an unpacker do?? I've been hearing about these also

thnx,and lets keep the newbie forum going strong!
--ThRaX
?ferret
10-29-2000, 09:01 PM
Hola,

First off, dongles are a piece of hardware that you plug into one of the ports on your computer. Some software manufacturers ship these with their products to make sure that the software stays on only one computer. Depending on how the programmer implements the protection, you may be able to patch a few jumps, but more often you'll have to emulate the dongle. Some programs are even actually driven by the dongle itself. See zencrack2.cjb.net for more info. CrackZ is pretty slick when it comes to dongles (he's revamping his site ATM, so I don't know if it's back up yet)

As for unpackers, they "unpack" a program (obviously) ;-)

What this means is that a program has been packed, and is unpacked at runtime. Disassembly of the packed .exe is pretty much useless, so you unpack it and save the unpacked copy of the .exe. You can then usually proceed as normal. A simplistic (and somewhat inaccurate) analogy is that packed proggies are somewhat like .zip files.

Hope that helps ya a little
Nickname
11-17-2000, 01:11 PM
Try litespeed.org i think that is Crackz new home,i came across it the other night
esther
11-18-2000, 10:31 AM
Hi Thrax,
Not sure about dongles :(
theres a url might help u understand
unpackers
http://users.supernet.com/dharp/files/UnpackFAQ.html
cheers

esther


disassembly...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > disassembly...
PDA

View Full Version : disassembly...

MR. Candyman
10-30-2000, 01:01 AM
Ok...now I have about 3 programs on my computer for disassembly, 2 of which were referred to me when I asked on the Tools Of The Trade board which ones disassemble into C++ code. NONE of the programs do, or if they do the functions to make them go into C++ are hidden.

The code they (includes IDA) come up with is uncomprehensable to me. What language is it? Any extrememly abreviated way to make me understand or at least begin to?

PS: The board's a good idea, glad it's up...and sorry so sounding so be-garkled, but hey, i gotta start somewhere
JimmyClif
10-30-2000, 01:57 AM
I bet the disassemblers you got are called IDA and Wdasm, hehehe (I can read minds). Well, for a start... I better tell you that the garbage these progs produce when disassembling a program is called "Assembly", which is actually a language...

I'm sorry to disappoint you but there won't be C++ code coming out of a disassembly, never. (Guess, that will be too easy) :D

Better learn Assembly first before doing the "hands on" part. There are lots of tutorials about it, some of the best ones are :

- The Art of Assembly (It's supposed to be great, personally I never came around reading it)
- Adam's tutorial on _mammon's page. (Funny, I really liked it - 98 printed pages if I remember)

Unfortunately I'm not at my machine so I can't furnish the links for these tuts. (search :) )

Regards,
JimmyClif
Kayaker
10-30-2000, 02:14 AM
Hi,

Don't think there is such a thing as a C++ Decompiler. IDA and such are Disassemblers which give output in Assembly language or ASM.

The closest I've seen is REC - " a portable reverse engineering compiler, or decompiler.
It reads an executable file, and attempts to produce a C-like representation of the code and data used to build the executable file."

http://www.backerstreet.com/rec/rec.htm

If this question is in the context of "How do you reverse engineer?", forget the idea of "Decompiling" programs into their source code. You need to learn, live and breath Assembly ;)

Hope this helps.


WTF??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > WTF??
PDA

View Full Version : WTF??

TexNAss
10-30-2000, 05:24 AM
Shesh, a bloke turns his back for a couple of months, and message boards are being opened and shut quicker than i can open emails..

Anyway it's good to see the 'light' is still shinning and attracting new 'moths' to the brightness of information and enlightenment..

Hey +Sandman, When does Tsehp get a medal of honour for above and beyond the call of duty in the face of constant oppression??

In the background (as always),
TexNAss
tsehp
10-30-2000, 06:46 AM
Thanks,
I didn't do everything, we must also thank woodmann that provided us
this paid account.

regards,
?ferret
10-30-2000, 10:21 PM
Agreed...THANK YOU WOODMANN!!! (&Tsehp too) ;-)


Mini Project Area - Now Open..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Mini Project Area - Now Open..
PDA

View Full Version : Mini Project Area - Now Open..

+Sandman
10-30-2000, 04:31 PM
Greetings...

Back by popular demand, your own mini-project area.. Feel free to wander around the code woods, contributions to the forest of knowledge is always welcomed & appreciated.

RalDnoR & qferret were volunteer moderators of the last forum so I see no reason why they can't continue on from where they left off. Thanks guys..

For those who are new to this type of learning experience allow me to briefly explain how it works..

The moderators will select a particular target for you to examine and hopfully, test out your skills on. They will then set out a number of tasks on this program for which you are to try and solve. They will guide you through these tasks as and when required, for it's not a race but a learning experience. There are no losers, only students.

It is reccomended that you equip yourself with the nessasary tools of our trade (Links will be provided to them by the Moderators) and that you have a basic understanding of their uses.

Once you have made a thread, stay within your own thread there-after, don't start a new thread. This will help us to 'watch' over you while your working.

Above all, relax and have some fun!

Regards
+Sandman
Kayaker
10-30-2000, 06:14 PM
Mr(?) Moderators:

Lemme know if you need a hand wit' sumpin'...
MR. Candyman
10-30-2000, 06:38 PM
I was wondering when you guys were gonna start that back up. I cought the last one about 5 minutes before it was closed and liked the idea.

You can mos def bet I'll be doin a few of those projects (not at the same time though, hehe)
Kayaker
10-30-2000, 08:19 PM
Mr(?) Moderators:

Lemme know if you need a hand wit' sumpin'...


Job Opportunity for Reversers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Job Opportunity for Reversers
PDA

View Full Version : Job Opportunity for Reversers

zitterbe
11-01-2000, 06:32 AM
There was an add in "USA Today" this Monday looking to hire a software reverser. They wanted C/C++ experience and familiarity in reversing techniques using SoftIce. They're also looking for someone that has or can get Top Secret clearance. It's a govt job in McClain Virginia. Isn't that where the CIA headquarters is localted?

Sounded kinda interesting.....
The Owl
11-01-2000, 11:35 AM
There was an add in "USA Today" this Monday looking to hire a software reverser.

is it available online or could you quote it here?

They wanted C/C++ experience and familiarity in reversing techniques using SoftIce.

oh my.... does not sound like a serious offer.

They're also looking for someone that has or can get Top Secret clearance. It's a govt job in McClain Virginia. Isn't that where the CIA headquarters is localted?

this smells.... since when does the state security world look for applicants who would potentially be granted TS clearance in the public media?
+Sandman
11-01-2000, 05:21 PM
This job offer may in fact, be genuine, as strange as this sounds..

Not all that long ago, the British Secret Service were recruiting applicants that could 'reverse' (not hack) their web page in order to gather the 'secret' words/phrases they had hidden within it.

The job offer in the USA sounds like they are looking for someone who is self-educated in Reversing, rather than someone who was taught in a class room. There's a big difference between being self-taught where you develop your own reversing methods and being shown what to do & think in a class room environment.

As for having Top Secret clearance.. If someone had worked for 'them' previously as an outside/independant contractor they would already have the nessasary security clearance for this particular job.

Regards
+Sandman
zitterbe
11-01-2000, 09:56 PM
Not CIA like I thought. Probably a subcontractor???
The add was titled: "Can you work in Reverse?"
"Software-Reengineering"

It is "reverse-engineering Network Traffic for vulnerability analysis".

Pre-reqs: Interactive Disassembler (IDA??? - Kewl!), Numega SoftIce (kewler!), C++ or Java, blah blah....

The company is called NCI Information Systems, Inc
See http://www.nciinc.com

Resume to: dmcrae@nciinc.com
FAX: (703) 903-9750

Addy:
NCI Information Systems,Inc
Attn: RE/DM
8260 Greensboro Drive, Suite 400
McClean, VA 22102
cronos
11-02-2000, 01:25 PM
The British one was more codebreaking, and the pay was truly awful. I hope this one pays better ;) now... top secret clearance, nope.


getting started
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > getting started
PDA

View Full Version : getting started

dr.chaos
11-01-2000, 06:42 PM
i want to learn how to crack and hack but i dont know where to get started....i looked at jack the ripper and warez.com but i dont know what the hell they're talking about...help me please!! i wanna live up to my nickname!!! (dr.chaos)
JimmyClif
11-01-2000, 07:08 PM
First you have to get an account at AOL, then repost your question.
carpathia
11-01-2000, 07:21 PM
I think you want to learn to crack and hack for all the wrong reasons. Crackers and hackers arent gods, they are just everyday people doing something they enjoy; learning and applying. And its not common to find a very talented hacker who is also an equally good cracker/reverser. While they may share many skills, they are essentially different disciplines.

If you seriously want to learn to crack, try

www.cracking4newbies.com
tsehp.cjb.net
crfb.cjb.net

These sites, and those linked from them, will get you up and running. But theres no magic wand to wave. Dont want hard study ? Just give up and go do somethig less demanding.

It seems you want to crack to be 'elite' or to live up to your nickname, as you put it ? My advice is to either knuckle down and study these sites (in my experience, people like you will often give up on the first lap), or more feasible, change your nick. Might I suggest Dr.DoLittle instead ? ;-)
evc_viper
11-01-2000, 09:10 PM
Base on my experience, the first thing and the most fundamental skill to be a reverser is: Can you sit in front of monitor keep thinking, tracing, taking note, repeat repeat repeat the whole process again and again and again?

Your answer will be the answer to getting start.


some reversing questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > some reversing questions
PDA

View Full Version : some reversing questions

radaremt
11-02-2000, 11:01 AM
Hi all,

ok i am working on trying to crack Abacus Pub's Flight sim design studio
i have tried to reverse with softice,IDA and w32dasm, i believe this program is in delphi but dede will not decompile it...

i have found the core of the serial check - a friend who is more advanced at cracking than me tried it - finally got it to install but only in demo mode..... e-mail me at swflatrunking@hotmail.com and i can provide the source code i have

Exported fn(): SerialCheck - Ord:0001h
:0040C450 55 push ebp
:0040C451 8BEC mov ebp, esp
:0040C453 8B4514 mov eax, dword ptr [ebp+14]
:0040C456 50 push eax
:0040C457 E850000000 call 0040C4AC
:0040C45C 84C0 test al, al
:0040C45E 7404 je 0040C464
:0040C460 B064 mov al, 64
:0040C462 EB15 jmp 0040C479

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040C45E(C)
|
:0040C464 6A30 push 00000030

* Possible StringData Ref from Code Obj ->"SERIAL NUMBER ERROR"
|
:0040C466 6880C44000 push 0040C480

* Possible StringData Ref from Code Obj ->"Invalid Serial Number"
|
:0040C46B 6894C44000 push 0040C494
:0040C470 6A00 push 00000000

* Reference To: user32.MessageBoxA, Ord:0000h

if anyone can assist me in this - would be appreciated - and you can take the credit for the crack when it is complete ..

also i can provide dumps from softice, w32dasm, and IDA if needed

Thanks

Jason
goatass
11-02-2000, 01:24 PM
Hey there, going by the only thing you provided it looks like
:0040C453 8B4514 mov eax, dword ptr [ebp+14] <--moving your serial to EAX
:0040C456 50 push eax
:0040C457 E850000000 call 0040C4AC <--the actual CALL that checks serial
:0040C45C 84C0 test al, al <-- AL must be 1 if it's 0 it will jump to the error box
:0040C45E 7404 je 0040C464
:0040C460 B064 mov al, 64 <--some flag maybe
:0040C462 EB15 jmp 0040C479 <-- jump passed the error box maybe good place

the 0040C457 E850000000 call 0040C4AC is the one place you should focus on, it could be that it's generating a real serial in there or maybe just checking the length of the serial. If you could provide some code from with in that CALL it would be easier to see what it does.
Just make sure that the je 0040C464 never executes this way you won't get the error message box, I don't know what the program does after that since you didn't include the code but that flag (MOV al, 64) looks like it has something to do with it.

Another thing, try using IDA to disassemble the program, it provides much more informtaion about functions that could be of great help.

hope that helped.
goatass
radaremt
11-02-2000, 01:46 PM
Ok here is the code for that call - see next reply for something i did

* Referenced by a CALL at Address:
|:0040C457
|
:0040C4AC 55 push ebp
:0040C4AD 8BEC mov ebp, esp
:0040C4AF 33C9 xor ecx, ecx
:0040C4B1 51 push ecx
:0040C4B2 51 push ecx
:0040C4B3 51 push ecx
:0040C4B4 51 push ecx
:0040C4B5 53 push ebx
:0040C4B6 33C0 xor eax, eax
:0040C4B8 55 push ebp
:0040C4B9 68BCC54000 push 0040C5BC
:0040C4BE 64FF30 push dword ptr fs:[eax]
:0040C4C1 648920 mov dword ptr fs:[eax], esp
:0040C4C4 8D45F0 lea eax, dword ptr [ebp-10]
:0040C4C7 8B5508 mov edx, dword ptr [ebp+08]
:0040C4CA E8ED6EFFFF call 004033BC
:0040C4CF 8B45F0 mov eax, dword ptr [ebp-10]
:0040C4D2 8D55F4 lea edx, dword ptr [ebp-0C]
:0040C4D5 E84A9DFFFF call 00406224
:0040C4DA 8B45F4 mov eax, dword ptr [ebp-0C]
:0040C4DD 8D55F8 lea edx, dword ptr [ebp-08]
:0040C4E0 E8079EFFFF call 004062EC
:0040C4E5 8B45F8 mov eax, dword ptr [ebp-08]
:0040C4E8 50 push eax
:0040C4E9 E8FA000000 call 0040C5E8
:0040C4EE 84C0 test al, al
:0040C4F0 7516 jne 0040C508
:0040C4F2 8B45F8 mov eax, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"DEMO"
|
:0040C4F5 BAD4C54000 mov edx, 0040C5D4
:0040C4FA E87170FFFF call 00403570
:0040C4FF 7407 je 0040C508
:0040C501 33DB xor ebx, ebx
:0040C503 E999000000 jmp 0040C5A1

i have the entire source code as a text file
radaremt
11-02-2000, 01:52 PM
ok i did some changing to the code but got it to install only in demo mode so i have to figure out how to bypass that call

Exported fn(): SerialCheck - Ord:0001h
:0040C450 55 push ebp
:0040C451 8BEC mov ebp, esp
:0040C453 8B4514 mov eax, dword ptr [ebp+14]
:0040C456 50 push eax
:0040C457 E850000000 call 0040C4AC
:0040C45C 84C0 test al, al
:0040C45E 7404 je 0040C464

**** Changed to je 0040c479*******

:0040C460 B064 mov al, 64
:0040C462 EB15 jmp 0040C479

and this is the Jump

:0040C47D 000000 BYTE 3 DUP(0)

:0040C480 53 push ebx
:0040C481 45 inc ebp
:0040C482 52 push edx
:0040C483 49 dec ecx
:0040C484 41 inc ecx
:0040C485 4C dec esp
:0040C486 204E55 and byte ptr [esi+55], cl
:0040C489 4D dec ebp
:0040C48A 42 inc edx
:0040C48B 45 inc ebp
:0040C48C 52 push edx
:0040C48D 204552 and byte ptr [ebp+52], al
:0040C490 52 push edx
:0040C491 4F dec edi
:0040C492 52 push edx
:0040C493 00496E add byte ptr [ecx+6E], cl
:0040C496 7661 jbe 0040C4F9
:0040C498 6C insb
:0040C499 6964205365726961 imul esp, dword ptr [eax+53], 61697265
:0040C4A1 6C insb
:0040C4A2 204E75 and byte ptr [esi+75], cl
:0040C4A5 6D insd
:0040C4A6 626572 bound esp, dword ptr [ebp+72]
:0040C4A9 000000 BYTE 3 DUP(0)
radaremt
11-02-2000, 02:08 PM
here is the code for IDA

040C450 ; Exported entry 1. SerialCheck
0040C450
0040C450 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
0040C450
0040C450 ; Attributes: bp-based frame
0040C450
0040C450 public SerialCheck
0040C450 SerialCheck proc near
0040C450
0040C450 arg_C = dword ptr 14h
0040C450
0040C450 push ebp
0040C451 mov ebp, esp
0040C453 mov eax, [ebp+arg_C]
0040C456 push eax
0040C457 call sub_40C4AC
0040C45C test al, al
0040C45E jz short loc_40C464
0040C460 mov al, 64h
0040C462 jmp short loc_40C479
0040C464 ; ---------------------------------------------------------------------------
0040C464
0040C464 loc_40C464: ; CODE XREF: SerialCheck+Ej
0040C464 push 30h
0040C466 push offset dword_40C480
0040C46B push offset dword_40C494
0040C470 push 0
0040C472 call j_MessageBoxA_0
0040C477 xor eax, eax
0040C479
0040C479 loc_40C479: ; CODE XREF: SerialCheck+12j
0040C479 pop ebp
0040C47A retn 14h
0040C47A SerialCheck endp ; sp = -14h
0040C47A
0040C47A ; ---------------------------------------------------------------------------
0040C47D align 4
0040C480 dword_40C480 dd 49524553h, 4E204C41h, 45424D55h, 52452052h, 524F52h
0040C480 ; DATA XREF: SerialCheck+16o
0040C494 dword_40C494 dd 61766E49h, 2064696Ch, 69726553h, 4E206C61h, 65626D75h
0040C494 ; DATA XREF: SerialCheck+1Bo
0040C494 dd 72h
0040C4AC
0040C4AC ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
0040C4AC
0040C4AC ; Attributes: bp-based frame
0040C4AC
0040C4AC sub_40C4AC proc near ; CODE XREF: SerialCheck+7p
0040C4AC
0040C4AC var_10 = dword ptr -10h
0040C4AC var_C = dword ptr -0Ch
0040C4AC var_8 = dword ptr -8
0040C4AC var_4 = dword ptr -4
0040C4AC arg_0 = dword ptr 8
0040C4AC
0040C4AC push ebp
0040C4AD mov ebp, esp
0040C4AF xor ecx, ecx
0040C4B1 push ecx
0040C4B2 push ecx
0040C4B3 push ecx
0040C4B4 push ecx
0040C4B5 push ebx
0040C4B6 xor eax, eax
0040C4B8 push ebp
0040C4B9 push offset loc_40C5BC
0040C4BE push dword ptr fs:[eax]
0040C4C1 mov fs:[eax], esp
0040C4C4 lea eax, [ebp+var_10]
0040C4C7 mov edx, [ebp+arg_0]
0040C4CA call unknown_libname_25
0040C4CF mov eax, [ebp+var_10]
0040C4D2 lea edx, [ebp+var_C]
0040C4D5 call sub_406224
0040C4DA mov eax, [ebp+var_C]
0040C4DD lea edx, [ebp+var_8]
0040C4E0 call sub_4062EC
0040C4E5 mov eax, [ebp+var_8]
0040C4E8 push eax
0040C4E9 call sub_40C5E8
0040C4EE test al, al
0040C4F0 jnz short loc_40C508
0040C4F2 mov eax, [ebp+var_8]
0040C4F5 mov edx, offset _str_DEMO.Text
0040C4FA call @System@@LStrCmp$qqrv ; System __linkproc__ LStrCmp(void)
0040C4FF jz short loc_40C508
0040C501 xor ebx, ebx
0040C503 jmp loc_40C5A1
goatass
11-02-2000, 05:18 PM
ok that's a alof code :)

The change you made is wrong because you skipped the MOV EAX,64 which is like I said some kind of flag so this is how to fix that problem:

:0040C457 E850000000 call 0040C4AC
:0040C45C 84C0 test al, al
:0040C45E 90 nop
:0040C45F 90 nop
:0040C460 B064 mov al, 64
:0040C462 EB15 jmp 0040C479

Here is another place to look at, as you can see from looking in IDA that this call is a compare - call @System@@LStrCmp$qqrv ; System __linkproc__ LStrCmp

0040C4E8 push eax
0040C4E9 call sub_40C5E8 <--don't know but if return 1 it's good
0040C4EE test al, al
0040C4F0 jnz short loc_40C508 <--bad jump (maybe)
0040C4F2 mov eax, [ebp+var_8] <-- your serial maybe ?
0040C4F5 mov edx, offset _str_DEMO.Text <--checks if you entered DEMO ?
0040C4FA call @System@@LStrCmp$qqrv ; System __linkproc__ LStrCmp(void)
0040C4FF jz short loc_40C508 <--did you enter DEMO as serial ? bad jump
0040C501 xor ebx, ebx
0040C503 jmp loc_40C5A1 <-- probably a good jump

check out what all the CALLs above this code do and check out all the stuff being pushed to these CALLs. Do a: d eax or d *eax to see what registers hold everytime they go into and come out of a CALL.

If you want a JZ or JNZ to NOT execute just NOP (90) it out so the program will proceed normally.

goatass
?ferret
11-02-2000, 08:59 PM
:0040C4E8 50 push eax
:0040C4E9 E8FA000000 call 0040C5E8 //This one could be interesting
:0040C4EE 84C0 test al, al
:0040C4F0 7516 jne 0040C508 //Jumps past the string ref for "DEMO"....possibly to registered version?
:0040C4F2 8B45F8 mov eax, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"DEMO"
|
:0040C4F5 BAD4C54000 mov edx, 0040C5D4
zitterbe
11-03-2000, 05:12 AM
Why not let it go ahead in make the call and fuck with the code in that proc that affects the return value? Or better, analyze and fuck with the code, in the
"call :0040C457 E850000000 call 0040C4AC <--the actual CALL that checks serial"???

Code in that call (or maybe deeper level calls) supposely detertmines immediate results of the serial check - so maybe global variables (that may get tested later) get set that may need that that call to be made and get set some variables set right?

z
radaremt
11-03-2000, 09:32 AM
also i now know there are three types of licenses for this program - standard, pro, and Commercial..... i have found the .dll in the install directory that affects these as well
radaremt
11-03-2000, 10:21 AM
ok i dissasembled asreg02.dll in the program once it installed - the upgrade registration menu was disabled but i found some very very interesting code - i cannot post all the code here but if someone wants to take a look at it with me i can send it to you as a text file it is very very interesting indeed
e-mail swflatrunking@hotmail.com or ICQ 8074034

Thanks for the help so far


Cooledit // wincommander...........
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cooledit // wincommander...........
PDA

View Full Version : Cooledit // wincommander...........

SpEkkEl
11-02-2000, 02:28 PM
anyone knows how to handle the software protection
these programms use ?? When trying to set a breakpoint or patch the program, they come with some message " file-integrity error ....." and the program kills it self.
I tried to trace the calls to the messagebox but this
didn't work.
hz
11-04-2000, 02:32 PM
hi,
h*tp://users.belgacom.net/blackb/wincmd.html. Hope it helps.
regards
hz
SpeKKel
11-06-2000, 07:55 AM
hz (11-04-2000 04:32):
hi,
h*tp://users.belgacom.net/blackb/wincmd.html. Hope it helps.
regards
hz

THAnks alot hz.


aspack help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > aspack help
PDA

View Full Version : aspack help

Timmy
11-02-2000, 04:49 PM
i have a prog that i am having trouble with. its totally free but it doesn't work correctly on my comp so i want to do a bit of digging to see if i can figure out what is going wrong. the prog is packed with aspack 1.07b and is written in CBuilder C++. i have unpacked it using procdump but when i run wdasm on the resulting file nothing (very little) comes up - do i have to import a relocation table or something. ashamed to say it but i have been cracking for a while but its the first time i've had to deal with a packer. any good tuts on anything similar ?
stillnewbie
11-02-2000, 06:38 PM
Hi Timmy,
theres a tut in ht*tp://krobars.cjb.net
written by Pagefly

ht*p://csir.cjb.net
hopes this helps
Timmy
11-05-2000, 05:05 PM
cheers, couldn't find the tut (could'nt find the page with that url - but I have a url for krobar that works) but did find relevant info on aspack and I have now a working unpacked exe to work with. thanx again


Bit-Arts SoftLocx 5 Mutant Engine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Bit-Arts SoftLocx 5 Mutant Engine
PDA

View Full Version : Bit-Arts SoftLocx 5 Mutant Engine

hOrn_dOg
11-03-2000, 04:02 AM
Hi all,

As you may have seen at deja.com, Basher and romeo_uno have dared 'disrespect' +SplAj.

So he published his SL5KeyGen. This prompted Bit-Arts to pull the DL page and re-hash their softs, put the new DL page up in just 24 hrs.

So, here is the Dead Mutant version of SL5.exe for you all to study, look for //./NTICE
//.//SICE FROGSICE etc etc.

The moral of this is that once you are not a newbie. DONT friggin help anyone 'cause their ego's are toooooo BIG. Just crack for pleasure and for yourself. DONT 'dis' another
reverser EVER.

get the zipped-up exe from:-

ht*p//www.acmecity.com/thematrix/dejavu/438/deadmutant.htm

hOrn_dOG
zitterbe
11-03-2000, 05:38 AM
You got it wrong!

1. "Once you're not a newbie"??? What the hell is that?????? A good code reverser is ALWAYS a Newbie. When you lose that Newbie mind Ure fucked. "Zen mind is beginners mind" as the wise master once said.

2. Helping others that are struggling to learn the craft (art) and have questions is a moral responsibility. Gaining knowlege, and helping others to do the same, is a major (or should be) reason for reversing. What? U reverse just get free software and some respect and worship in the minds of others????? Be a teacher - if U have something worthy of imparting!

3. When U help others learn U may get burned. It goes with the territory. Who cares? A chemistry teacher may get blown up by some asshole student that used the teaching in a self-motivated (foolish) way. BFD! But!!!! - the rest of the class profitted by the teacher's wisdom and knowlege.

Sorry for the lecture grasshopper. But U need to get U're priorities in sync with the real goals of doing RCE (and everything else, for that matter). Stealing ridiculous software and gaining prestige among peers ain't even close.
Romeo.One
11-04-2000, 03:50 PM
I seen this Splaj or newly named Horn_Dog post some ini keys on the forum some time back.. I thought this is strange why does this guy not explain his work , I left it be and then noticed his reply to a posting I'd done to some dude in a forum. Things don't make sense ?

1. He's in no crew.
2. I've never seen a crack of his posted.
3. He's doesn't teach his findings. (I agree zitterbe)
4. He seems to have a personal vendetta on bitarts (who??).
5. He emails a magazine reviewer about his crack !!!
6. He creates his own page about the product.
7. No-one on the scene has heard of him.
8. He codes a keygen in Visual Basic ?!

My conclusion is that this idiot is using the scene for the benefit of a competior of Bitarts. The guy is crazy, well paid or both and doesn't even understand that forums like these are for teaching not for some personal corporate battle ! I only replied to this idiot because he uses the "+" , no I wasn't in HCU... but I do know he never was! Now this fool changes his alias because many R/C smell a corporate rat ! The kind of leech that infects our forums with his crazy chantings.. I notice he also posts a message in reversing site trying to stir problem there..

This guy is the horn_duck -> he flies into the cracking scene flaps around , makes lots of noise, shits everywhere and then flies out with his pay and leaves us to clean up the mess !

Splaj , horn_dog or whatever name you call youself.. The purpose of these forums is not to crack the !!! lame !!! warez of bitarts and play corporate battles but to teach new coders the art of R/C. Why not tell the corporate hand that feeds you to make their protection better ? .. I also find the info about bitarts being disbanded hcu members a touch insane... even if they were who cares we all have bills to pay (unless ur 13). How many ex-HCU members do you think may now be working for commercial companies ? The protection they do is good but no way uncrackable and this is a great oppertutinty for us to study and learn the techniques in use.. An example - AsProtect use(s/d) 'good' routines to prevent dumping such that novices cannot dump the file easily, are these guys in HCU ? Or are they not so damaging to the corporate trough you feed from HORN_PIG !

I seriously cannot understand why UR so "uptight" with a protection solution that I've never seen in one single commercial product. You complain that someone dared 'disrespect' the mighty +SplAj if you continue to annoy everyone what do you expect ? You said you were doing a generic unpacker 4 shitlocx... where is it ? .. Oh I see U have to get dudes here to do ur dirty work because you can't access the PE so well in VB :p Oh well you're still getting paid for it ;)

I now understand why you use the "+" it's the most used button on ur calculator when u count that big fat pile of cash !

Oh sorry I'm going to have to dare 'disrespect' the mighty +SplAj - FUCKU asshole and tell the same to UR corporate friend ! Go home pull your pants down and give it a good slap , it used to calm me down when I was 12 :p

Romeo_One -> @lias changed + retired with kids ;)
IronMan
11-06-2000, 11:25 AM
You know, umm..., err, Romeo... One is it? I see that your original reply to Basher offered no help to him? As of this date you have no posts to help Basher with Softlocx, yet +Splaj had at least posed the keys to help?

Then your replys themself show your maturity with your lovely profane language? Are you sure it's he who is 13? Hmm... ?

Funny that Basher trashes +Splaj not realizing that he is using a V4 tutorial on V5. So for his help for whomever needed it for BitArts-ware, he gets two trash talkers?

Oh, then your going to release something for CrypKey? Why?

Oh, and by the way. He does not work for a competitor (Vbox, CryKey, etc.). So you can drop that idea.

IronMan
esther
11-11-2000, 11:02 AM
>Funny that Basher trashes +Splaj not >realizing that he is using a V4 tutorial on >V5. So for his help for whomever needed it >for BitArts-ware, he gets two trash talkers?
>Oh, then your going to release something for >CrypKey? Why?
One's doesn't knoe that releasing crypt keys
are for lamers.Trash talkers? you two are the ones
8DD

Doesn't fit to be grasshopper.listen to Zitterbe's. its a word of wisdom ;)


Breakpoint problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Breakpoint problem
PDA

View Full Version : Breakpoint problem

delit
11-03-2000, 06:30 AM
Hello people!

I have a little problem, maybe u could help me.

I have this proggie with a dongle protection, quite a simple program, only one .exe file. When i want to do a specific function, it sas 'No dongle!'.
I disassembled it with w32dasm, but i can not find the part of the program that is calling this message - w32dasm cant find that part of the program. Looks ike this :

xxxxx ret

xxxx1 mov blahblah (here it moves the no dongle msg)
xxxx2 call ... (the popup window)

So i assume the message is called with something like : call [ebx + xxxxx]
so w32dasm cant find that call (or jump), beacouse it dos not know the values of registers. Could IDA be of any help, i havent got it??

And another question: since the msg is shown shortly after pushing a button, i could trace manually through the program with softice, if i could stop the execution after the button has been pushed.

So could someone tell me how to make i breakpoint on the button?

TIA
NchantA
11-06-2000, 10:41 AM
hehe

i find this topic a *little* advanced for the classic newbie. dongles are a hard nut to crack but if you are persistant even the most impossible tasks can be accomplished.

http://zencrack2.cjb.net

CrackZ site should have plenty of information on dongles.
goatass
11-06-2000, 10:59 AM
Hey there, well you mentioned that you know where the call to the messagebox is so just look in the disdassembly and see from where that is called. If you don't know where it is you can set a BPX on the button like this: bmsg HWND WM_LBUTTONUP
HWND is the window handler for that button, get it by typing HWND in SoftIce and looking for the name of your application and to the right of that it should say "button".

Other BPXs for dongles would be:
bpio -h 378 --> breaks when accessing the parallel port
bpx CreateFileA --> breaks if a dongle opens a DLL or VXD

It really depends on what dongle the program uses, HASP, sspro, DESKey whatever.

checkout CrackZ site he has tons of great info.
zencrack2.cjb.net

goatass
Aimless
11-13-2000, 04:03 AM
Do this:

W32DASM, IDA or any such cannot find the caller if it has been called by something like call [esi+43] and such code. So what do you do in this case. I'm afraid that you have no choice but to use SOFT-ICE.

In this case BPX on the call. Do a "BPX @ESP". Run the proggie. It will break at the next instruction from where your call was.

Eg:

call [esi+90] << this is what makes your call
test eax, eax << upon breaking, you'll be here!!
:::etc, etc....

Hope that helps.
aMEXICAN
11-13-2000, 10:14 AM
Try the following breakpoints
bpio -h 378 rw (I/O port Access)
bpio -h 278 R
DeviceIOControl
FreeEnviornmentStringA
Hope that this helps....cracking dongles is definitely not for newbies.......and no problem with trying......just that cracking is like lifting weights.....you start out lite.....then move up.....
C ya


FileMon
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FileMon
PDA

View Full Version : FileMon

MR. Candyman
11-04-2000, 01:14 AM
Call me a pot head or whatever, but I can't figure out how to open the log file that Filemon saved. I would like to look through what happened when I opened a program with a dongle (dongle does nothing, just there for security of the program).
Kayaker
11-04-2000, 04:03 AM
The .log file is a text file, having it default to Notepad is the easiest solution.


BPX on a button??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > BPX on a button??
PDA

View Full Version : BPX on a button??

pupp
11-04-2000, 01:55 AM
Hi all
I can't remember how to break on a button in sice when in hwnd i see the button i want to break on (03AC) .
Was it just normal bpx 03ac ??
can ne1 help me

thanks

pupp
Petroff
11-04-2000, 03:12 AM
To refresh your memory:

bmsg 03ac wm_lbuttonup
pupp
11-04-2000, 04:03 AM
Thanks

pupp
NchantA
11-06-2000, 10:30 AM
bmsg HWND WM_COMMAND

is also a usefull command when dealing with buttons...

NchantA
goatass
11-06-2000, 10:54 AM
another good one is:

bmsg HWND WM_GETTEXT

goatass
NikDH
11-06-2000, 06:09 PM
[quote]NchantA (11-06-2000 00:30):
>bmsg HWND WM_COMMAND

>is also a usefull command when dealing with >buttons...

Hwnd refers to the windows in which the button stays: its parent window :)
In fact this window recevies the WM_COMMAND msg when we push the button :)))


resources section study
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > resources section study
PDA

View Full Version : resources section study

SV
11-04-2000, 03:34 AM
Hi reversers

If you want to do something different, let's have a look at Amante4 first ReverseMe.
New goal : "Welcome to my first reverseme challange. The goal here will be to learn something about the format of the resources section (.rsrc) of a windows PE file....."

Interesting one (it change of IAT one ;))

Anyone have resource section description ?

URL : http://www.immortaldescendants.org/database/amante/am4_reme1.zip

SV
carpathia
11-04-2000, 11:45 AM
For an overview of the .rsrc section, read the PE format docs at

http://carpathia.cjb.net/pe_format.zip

For the binary format of individual resources, read

http://msdn.microsoft.com/library/psdk/winui/resource_8f3n.htm

Regards

Carpathia
Kayaker
11-04-2000, 04:51 PM
Hi All,

Hey this sounds like reversing fun, good choice SV. I'll go over how far I've gotten to start things off. Here is the challenge:

(Grumble, gotta break this post up into 2 parts since it contains more than 4098 chars.)

***************************
* The Challenge

Attached in the zip file you will find 3 .dump files. These files are the actual
hex/binary data for 2 dialogs and an icon. This is the raw data for 3 seperate
resources. Your goal is to add a new section called .rsrc and insert these resources
into the exe file. This will involve building a valid rsrc structure in the new section,
and adding the provided data as the actual data pointed to by the leaf nodes.
Then change the program to pop up the dialog1.dump dialog first, followed by the
dialog2.dump dialog next. For each dialog, make the title bar display the added
icon in the .rsrc section.
Currently the program just exits immediately.

Here are the rules:

1) You MUST!!!! do all the work in the .rsrc by hand. No using resource editors to do this.
Remember you're supposed to learn about the structure of this section.
2) You can use any other tools you wish, except a resource editor, to perform the adding of the
section or adding code. etc...
***************************

...Part II
Kayaker
11-04-2000, 04:53 PM
Disassembly of the main exe file shows:

Number of Objects = 0004 (dec), Imagebase = 00400000h

Object01: CODE RVA: 00001000 Offset: 00000600 Size: 00000200 Flags: 60000020
Object02: DATA RVA: 00002000 Offset: 00000800 Size: 00000000 Flags: C0000040
Object03: .idata RVA: 00003000 Offset: 00000800 Size: 00000200 Flags: C0000040
Object04: .reloc RVA: 00004000 Offset: 00000A00 Size: 00000200 Flags: 50000040

I am going to start the insertion of the .rsrc section at C00 (A00 end of .reloc raw offset + 200 raw size = C00). Before doing this the Number of Sections in the PE File Header needs to be changed. I've filled in the values in the Header template with results from PEBrowsePro.

PE File Header
WORD Machine Type; 0x014C
WORD Number of Sections; 0x0004 ; change to 05
DWORD Time/Date Stamp; 0x8D8D2953
DWORD Pointer To Symbol Table; 0x00000000
DWORD Number Of Symbols; 0x00000000
WORD Size Of Optional Header; 0x00E0
WORD Characteristics; 0x818E

In a hex editor the section looks like this:

00000100 5045 0000 4C01 0400 5329 8D8D 0000 0000 PE..L...S)......
00000110 0000 0000 ....

So I just changed offset 106 from 04 to 05.

After the File Header comes the Optional Header, which I think we can ignore, then the Section Headers for each of the 4 (soon to become 5) sections.

Using the .reloc section as an example you can use it as a template to fill in values for the .rsrc section

00000270 2E72 656C 6F63 0000 0010 0000 0040 0000 .reloc.......@..
00000280 0002 0000 000A 0000 0000 0000 0000 0000 ................
00000290 0000 0000 4000 0050 ....@..P

Section Header
BYTE Name[IMAGE_SIZEOF_SHORT_NAME]; = ".reloc "
DWORD PhysicalAddress; = unused
DWORD VirtualSize; = 0x00001000
DWORD VirtualAddress; = 0x00004000
DWORD SizeOfRawData; = 0x00000200
DWORD PointerToRawData; = 0x00000A00
DWORD PointerToRelocations; = 0x00000000
DWORD PointerToLinenumbers; = 0x00000000
WORD NumberOfRelocations; = 0x0000
WORD NumberOfLinenumbers; = 0x0000
DWORD Characteristics; = 0x50000040

So at the end of the .reloc section I inserted TEMPORARY values to create a .rsrc Section Header (some of these may be changed):

00000298 2E72 7372 6300 0000 0030 0000 0050 0000 .rsrc....0...P..
000002A8 1617 0000 00C0 0000 0000 0000 0000 0000 ................
000002B8 0000 0000 4000 0040 ....@..@

Which now gives PEBrowse results of:

Name = ".rsrc "
Misc = 0x00003000 ;Virtual Size - I guessed at 3000 for now
VirtualAddress = 0x00005000 ;starting at the end of V.Off for .reloc
SizeOfRawData = 0x00001716 ;size of 3 dumped bin sections (doesn't include Resource Directory Headers!!)
PointerToRawData = 0x0000C000 ;will begin inserting Resource Headers here
PointerToRelocations = 0x00000000
PointerToLinenumbers = 0x00000000
NumberOfRelocations = 0x0000
NumberOfLinenumbers = 0x0000
Characteristics = 0x40000040 ;standard, might change it

The next step will be to *try* to build up the Resource Directory tree for each of the 3 resources and then actually insert the raw resources. Adding code to pop up the Dialog boxes is going to be a whole other matter altogether...;)

Kayaker
Amante4
11-04-2000, 05:37 PM
Hi guys,

I'm glad to see some interest in my
reverseme.

Good luck, and hope you learn some things :)

regards,
amante4
goatass
11-04-2000, 11:22 PM
ThRaX my friend let's stick with newbies projects for now, lets not swim to the deep side of the pool just yet. You have to learn the PE header and section structures before you can even attempt this project, eventhough the resource section is not so complicated it's still not for newbies.

Amante4 very nice crackme, an original idea I like it :)

goatass
SV
11-05-2000, 03:35 AM
Hi amante4

Actually there is no code in exe and only ExitProcess in IAT.
I think it will be a little difficult for newbies to add
somes others API like DialogBoxParam in actual IAT.
Why not include code to open dialog and then if you
can rebuild the rsrc section, it will works ?

SV
Amante4
11-05-2000, 09:12 AM
Hi SV,

There being no code or imports for
other functions needed was intentional.
I certainly didn't intend this challange
for complete newbies. The only requirement
I set is that you do the editing in the
.rsrc section by hand. Although I'd suggest
to everyone to also learn how to import
other API functions by hand, there are tools
to do this for you. Maybe you can check
out the tool by Santmat here:
http://www.immortaldescendants.org/database/santmat/iidking.zip

regards,
amante
SV
11-06-2000, 05:03 AM
Hi reversers

Ouf ... it works.
I had difficulties to show icon in title bar !!!
Now, need time to writte something understandable :-)

Regards SV
SV
11-08-2000, 02:50 AM
My tut.
http://www.multimania.com/svtc/Progs/Amante4_reverse_tut.zip
Hope it will be useful.
Kayaker
11-08-2000, 09:18 PM
Nice job SV. I'm still working on it, but you answered a question I had re the Icon size.

The icon.dump file provided is 4DC bytes in size. However this doesn't correspond to any standard icon size. Now the hex in the 1st line of an icon raw resource seems to uniquely define the icon. I think this is part of the
[DIB Header]
[Color DIBits of icon XOR mask]
[Monochrome DIBits of AND mask]
structure supposedly explained in the Windows SDK Reference.

The usual ones are:

2800 0000 1000 0000 2000 0000 0100 0100 16*16*2 ; Size B0
2800 0000 1000 0000 2000 0000 0100 0400 16*16*16 ; Size 128
2800 0000 1000 0000 2000 0000 0100 0800 16*16*256 ; Size 568

2800 0000 2000 0000 4000 0000 0100 0100 32*32*2 ; Size 130
2800 0000 2000 0000 4000 0000 0100 0400 32*32*16 ; Size 2E8
2800 0000 2000 0000 4000 0000 0100 0800 32*32*256 ; Size 8A8

2800 0000 3000 0000 6000 0000 0100 0400 48*48*16 ; Size 668
2800 0000 3000 0000 6000 0000 0100 0800 48*48*256 ; Size EA8
etc.

The closest I could come up with in size is
2800 0000 4000 0000 8000 0000 0100 0100 64*64*2 ; Size 430

but the given icon is
2800 0000 0D00 0000 1200 0000 0100 0800 ?*?*256 ; Size 4DC

I'd like to ask Amante4 what the original size of the icon was and does 4DC correspond to a standard size?

In looking at your example SV, the size of the icon you specified in LEVEL 3 IMAGE_RESOURCE_DATA_ENTRY

.004050D0: -20 51 00 00-A8 08 00 00
.004050E0: 00 00 00 00-00 00 00 00-
Icon (DATA at offset 5120 size 8A8 BASE OFFSET!!)

and the type and size of icon specified in the Group Icon header correspond to a 32*32*256 icon. This is fine, but if you look at the binary output of the icon in Exescope you see that the resource also includes both Dialogs. Windows is looking for a 8A8 size icon but there's only 4DC bytes of icon bitmap!

This is why the icon looks a bit funny, it actually includes a pixel representation of the words (in Unicode) "Dumb Dialog" and "Dumber Dialog" ;) Not that it really matters obviously, I just wanted to clarify that.

I'm looking forward to taking a closer look at how you came up with code to open the Dialogs.

...on to Part II
Kayaker
11-08-2000, 09:20 PM
Continuing with the "Everything you didn't want to know about Icons" thread, I just want to clarify something that I noticed in the Win32 Binary Resource Formats document by Floyd Rogers (resfmt.txt). This a great one-of-a-kind document, but it is written for Win32S, not Win95+ and I've noticed a discrepancy with true 32-bit applications.

At one time I had done some work repairing the resource directory after doing a manual dump of a Shrinker 3.4 packed target. It seems that some RVA's pointing to the Icon, Group Icon and sometimes Version Info Resource structures are not recalculated. They remain as the "shrinked" addresses, so there is no main icon in the unpacked file and it crashes on execution.

Anyway, I noticed the discrepancy before and ignored it, but this project seems to have reconfirmed my suspicions.

The GroupIcon Header structure is defined in that document by:

struct IconHeader {
WORD wReserved; // Currently zero
WORD wType; // 1 for icons
WORD wCount; // Number of components
WORD padding; // filler for DWORD alignment

The next portion is repeated for each component resource:

struct ResourceDirectory {
BYTE bWidth;
BYTE bHeight;
BYTE bColorCount;
BYTE bReserved;
WORD wPlanes; // Number of color planes in the icon
WORD wBitCount; // Number of bits per pixel in the icon
DWORD lBytesInRes; // Specifies the size of the resource, in bytes
WORD wNameOrdinal; // Component ID
WORD padding; // Filler for DWORD alignment
};

Following is this section for 4 Icon resources of (DWORD) sizes 128, 568, 2E8 and 8A8.

0000 0100 0400 1010 struct IconHeader {
1000 0100 0400 2801 0000 0100 2020 struct ResourceDirectory { Icon 1
0020 0100 0800 6805 0000 0200 2020 struct ResourceDirectory { Icon 2
1000 0100 0400 E802 0000 0300 2020 struct ResourceDirectory { Icon 3
0000 0100 0800 A808 0000 0400 struct ResourceDirectory { Icon 4

Counting bytes, it seems that either 2 BYTES or 1 WORD is missing from struct ResourceDirectory {. You can confirm this by just creating a blank icon resource in BRW or other resource editor and looking at the GroupIcon section. 32-bit icons do not conform with what the document specifies for struct ResourceDirectory. But as the disclaimer says "Microsoft is NOT committing to stay with these formats by releasing this document".

So there it is, a minor niggling point in case anyone was confused by reading the document (or maybe is now ;)

Cheers,

Kayaker
LaZ
11-09-2000, 03:31 AM
Hi

bear with me when I could not understand Kayakers last reply correctly, I have the flu and some headache but worst of all I sit on SunSolaris which is not very cool for an average Windows user ;)

Anyway, if the problem was that you miss 2 bytes from Icons in the rsrc section in the file, the reason is that in standard Icon resources (*.ico) there is a DWORD in the header which tells you on which offset in the file the Icon begins. This is not needed in EXE files, because there you identify the icons by ID and the starting offset is saved elsewhere. Instead of the DWORD, you have a WORD there which specifies the ID of the Icon. Here 2 bytes are saved.

See www.wotsit.org for details. It has a good document about Icons in EXE files.

Regards
SV
11-09-2000, 03:47 AM
Hi Kayaker

thx :)
In my first version, size was 4DC and between structures
there were zero byte space.
This version has worked fine on 9x but not on NT :( !!!
Then i have changed some code, removed zero bytes , changed size.
Now it works on NT.
I admit that i have not really found (code, size ...) why first version doesn't work !
Very interesting description for the GroupIcon structure.
Mine was ripped from another exe and differ, like you said.

SV
Kayaker
11-09-2000, 08:36 PM
Thanks LaZ,

That really helps clear things up. In the resfmt.txt document I mentioned, they speak of an extra WORD in the "struct IconHeader {" portion of the GroupIcon resource which is used as padding for DWORD alignment.

In that excellent doc Icons in Win32 by John Hornick you recommended, it's omitted and I think I can interpret the hex values correctly now.

His description of the GroupIcon Header structure is:

The RT_GROUP_ICON resource is simply a GRPICONDIR structure:

typedef struct
{
WORD idReserved; // Reserved (must be 0)
WORD idType; // Resource type (1 for icons)
WORD idCount; // How many images?
GRPICONDIRENTRY idEntries[1]; // The entries for each image
} GRPICONDIR, *LPGRPICONDIR;

The idCount member indicates how many images are present in the icon resource. The size of the idEntries array is determined by idCount. There exists one GRPICONDIRENTRY for each icon image in the resource, providing details about its size and color depth. The GRPICONDIRENTRY structure is defined as:

typedef struct
{
BYTE bWidth; // Width, in pixels, of the image
BYTE bHeight; // Height, in pixels, of the image
BYTE bColorCount; // Number of colors in image (0 if >=8bpp)
BYTE bReserved; // Reserved
WORD wPlanes; // Color Planes
WORD wBitCount; // Bits per pixel
DWORD dwBytesInRes; // how many bytes in this resource?
WORD nID; // the ID
} GRPICONDIRENTRY, *LPGRPICONDIRENTRY;

The dwBytesInRes member indicates the total size of the RT_ICON resource referenced by the nID member. nID is the RT_ICON identifier that can be passed to FindResource(), LoadResource() and LockResource() to obtain a pointer to the ICONIMAGE structure (defined above) for this image.

Now if I look at the GroupIcon structure of Notepad.exe using PEBrowsePro:

Reserved: 0x0000
ResourceType: 0x0001
ResourceCount: 0x0002
ResourceEntry[0]
.. Width 0x10
.. Height 0x10
.. ColorCount 0x10
.. Reserved 0x00
.. Planes 0x0001
.. BitCount 0x0004
.. BytesInRes 0x00000128
.. ResID 0x0001
ResourceEntry[1]
.. Width 0x20
.. Height 0x20
.. ColorCount 0x10
.. Reserved 0x00
.. Planes 0x0001
.. BitCount 0x0004
.. BytesInRes 0x000002E8
.. ResID 0x0002

The hex dump starts to make sense:

0000 0100 0200 ; GRPICONDIR
1010 1000 0100 0400 2801 0000 0100 ; GRPICONDIRENTRY (Icon1 - 16*16*16 Size 128)
2020 1000 0100 0400 E802 0000 0200 ; GRPICONDIRENTRY (Icon2 - 32*32*16 Size 2E8)
0000 ; padding for DWORD alignment ??
2800 0000 2000 0000 4000 0000 0100 0400 ; start of raw icon resource

Well that pretty much satisfies me... ;)

Thanks again,

Kayaker


How to retrieve values on the stack with SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to retrieve values on the stack with SoftICE
PDA

View Full Version : How to retrieve values on the stack with SoftICE

chopin
11-04-2000, 07:36 AM
I have a program that uses the Windows-function GetWindowText (exported by user32.exe)
The declaration is like this (stdcall calling convention):

int GetWindowText(
HWND hWnd, // handle to window or control with text
LPTSTR lpString, // address of buffer for text
int nMaxCount // maximum number of characters to copy
);

In SoftICE 4.05 I set "BPX GetWindowText" and wait.

On Breakpoint execution I would like to see
- the value of hWnd
- the value of lpString and the contents of the buffer
- the value of nMaxCount

After execution of the function I would like to see the above values again, plus the return value.

How to do that?
Amante4
11-04-2000, 09:03 AM
Hi,

I ususally do this to see stuff on the stack:

d esp->0
d esp->4
d esp->8
d esp->c

etc.....

Hope this helps,

amante4
?ferret
11-05-2000, 07:36 PM
Another possiblity is to scroll up in the code window just a bit when you break. Check out the values pushed (they will be in reverse order from the API ref (i.e. last pushed is 1st retrieved))

after the function.....the registers change colors when they change in sice...simply check the ones that changed
chopin
11-06-2000, 09:45 AM
Ok, I managed to retrieve the values.
the first DWORD is on DD ESP+4
the seconde on DD ESP+8 and so on.

Anybody knows what I can find at DD ESP+0?
And where is the return value stored after the RET.
(Or is the value besides the RET, like RET 0004 the return value?)

chopin
NchantA
11-06-2000, 10:11 AM
chopin: a usefull thing to do is to break just above the getwindowtext function. an easy way to do this is bpx getwindowtexta, then when it breaks F11 to p ret to caller. then double click or manually set a bpx above it. that way you can easily check each paramater pushed onto the stack as it happens.

im pretty sure GetWindowTexta puts its return value in eax, so after you press F11 to get back to program check eax's, value.

from memory I have a feeling this is the size of the buffer read.

if however you are wanting to pursue the operations of the stack try using 'stack' in softice, and if i remember correctly there is a stack window?? 'ws'? im afraid sice isnt loaded on this box atm ;)

NchantA
DinDon
11-07-2000, 02:24 AM
Anybody knows what I can find at DD ESP+0?
The return address: the address of the instruction following the CALL. You will go there at the end of the subroutine, immediately after the RET instruction. The return address is automatically pushed on stack by the CALL itself.

And where is the return value stored after the RET?
The return value is in the register EAX if it is 4 bytes long (as normally it is) or in AX if 2-bytes long, or in AL if 1-byte long. It will be stored there before the RET.

Or is the value besides the RET, like RET 0004 the return value?
The value besides the RET is the number of bytes that were pushed before the CALL as arguments to the subroutine.
If, for example, an API subroutine has one argument, you will find a single PUSH before the CALL in order to put that argument on the stack. But who will clean the stack with the corresponding POP? That job will be done automatically by the RET 0004!

Hope it helps...


Help - I floating away
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help - I floating away
PDA

View Full Version : Help - I floating away

zitterbe
11-05-2000, 11:21 AM
Well - just cause I got involved in a drug-alch scenario.... very massive!

But I can see bits quite well now. Just need some help in doing 32bit op codes. Mmmmmm....
That will be here soon.

Maybe here now. Stand by for further instructions.....................................................

Bye
zitterbe
11-05-2000, 11:25 AM
Hi me.

Obviously U are fucked up! Maybe you should take a nap!

me


Help with unknown packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with unknown packer
PDA

View Full Version : Help with unknown packer

Timmy
11-05-2000, 05:19 PM
I decided to have a play with CloneCd. When I try to deadlist it WDASM crashes, looking at it with PE editor (under sections) there are blanks where you would expect to see .text etc. File analysier tells me that it is processed with "unknown" and then a list of 16 bytes. New(ish) to packed progs so anyone got any pointers where to start?
Thanks

BTW I inadvertantly posted this to the mini project area, could +Sandman please delete it, thanx.
notme
11-05-2000, 07:37 PM
asprotect .. probably asprotect v1.1 or greater depending on what version of clonecd u have.. (if its dated late august/september/october 00)

type in 'asprotect' into the search engine bit @ http://www.woodmann.net/

:o)
Timmy
11-06-2000, 05:20 PM
Don't know if this is relavent to anyone reading this but my machine is (has been) spot on, I regularly take care of the registry manually and I know for a fact that up untill today everything has been fine. After a cracking session, unpacking (not totally but most of the way) CloneCD I am now getting error messages at startup (usual bullshit - windows has found an error and will repair the registry, and they don't seem to want to go away). Wonder if this latest? version of asprotect has altered something or has a bug. Whatever it is it must be related to me having a look at CloneCD. So if anyone has a crack at any new progs with asprotect I would make sure you're machine is ok first and back up the registry before you start.
esther
11-07-2000, 05:44 AM
Hi Timmy,
what I often do is backup my windows.
After reversing,I'll copy it to another drive
restore my backup win and copy it back to it
this will save yu from reinstall everything again.Use ghost to backup, a good one

:-)

esther


vdat 2.000.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vdat 2.000.2
PDA

View Full Version : vdat 2.000.2

Nameless
11-06-2000, 05:05 AM
Hello all,
I downloaded vdat 2.000.2 and was amazed to see that it is limited!
This information should be available to anyone.
Any way Cicatrix done a good job protecting it,
the only thing I found out is that the key file is a dll called openit.dll
I have no idea what it does, I haven't messed with reversing for a long time,
so I'll be greatfull if anyone could give me a direction.

p.s
I don't identify myself because cicatrix is blacklisting names...
I suggest to response anonymously.
Anon_Crax0r
11-06-2000, 12:19 PM
Duh the protection is very very lame
go ahead and break it while watching tv :)
Nameless
11-06-2000, 03:29 PM
Anon_Crax0r (11-06-2000 02:19):
Duh the protection is very very lame
go ahead and break it while watching tv :)

I haven't find it lame, can you give me a general direction?
On what can I break?
Anon_Crax0r
11-07-2000, 12:17 PM
I cracked it at home and left everything there..but if you gimme a link to it, ill reverse it + disassm and give you some hints.
;)
Nameless
11-07-2000, 01:33 PM
You can download it at:

http://base.oc.to/VX-zine/vdt20002.zip
Anon_Crax0r
11-07-2000, 01:37 PM
great,im getting it.
i'll let you know when i finish it.
Bye
Anon_Crax0r
11-07-2000, 03:50 PM
ok here we go..
you obviously break with loadlibrary..and see that this program requires openit.dll as you correctly said.

Basically if the dll is not found the program shows that nasty message telling you how lammo you are..that's all..

Its just a jz/jnz kinda thing..

Sorry to spoil it all but there is basically no protection here!
Of course the program tries to GetProcAddress some function and blah blah but there is no need to reverse this since the check is completely wiped out with a simple byte exchange.
here is the disasm:

les di,[bp][00006]
push es
push di <- "openit.dll"
call 002:02DC8 <- LoadLibrary
mov [bp][0FCEF],al <- keep result
cmp b,[bp][0FCEF],000 <- result = 0?
jne .000023293 <- no! go to good boy
les di,[bp][0FEF0] <- yes! bad boy!

Open vdat with hiew, search for 80 BE EF FC 00 75 4B C4 BE F0 FE
and replace the 75 with 'EB'
as _mammon would say:

'...movie at eleven...'

:)

Bye !


Screensaver password dialog
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Screensaver password dialog
PDA

View Full Version : Screensaver password dialog

NoRToN
11-07-2000, 06:13 PM
Hi!
I want to modify the screensaver password dialog
with an resource editor. But where is that dialog?
Is it in a dll-file, like many of windows other dialogs are in?
pupp
11-07-2000, 09:53 PM
Hi
Did you try Exescope thats what i use when tryinf to find a dialog.
hope this helps

Regards
pupp


Merak Mail - Warning, Warning Will Robinson!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Merak Mail - Warning, Warning Will Robinson!
PDA

View Full Version : Merak Mail - Warning, Warning Will Robinson!

Kayaker
11-08-2000, 12:29 AM
I hope everyone gets the old reference ;)

OK, I put my foot into it. Big Time. Everyone seemed to be having so much fun with Merak Mail I decided to get into the fray. And I got frayed.

SICE detection - simple MeltIce protection

CRC check - break on CreateFileA/ReadFile. Seems to read in config.exe in 2 parts. A few calls after the 2nd Read is a CMP. Change it and you're (apparently) free to go. Interestingly there's a check if the file NAME is changed and you get the same CRC error message. This is understandable because config.exe is called by a Control Panel extension anyway and it needs to find it.

Somewhere in there I tried accessing my registry to take a look at HKLM\Software\Microsoft\Windows\CurrentVersion
(the program uses this value in it's reg check), and lo and behold I get a message saying that "Registry Editing has been disabled by your Administrator"

Oh, Oh. Now I'M the Administrator and I'd never do that to myself. So I had my suspicions and checked wininit.ini before rebooting to make sure the program wasn't going to start deleting things on startup and it looked OK.

What the heck, maybe it's a glitch I thought, I mean, this IS Windows. Reboot and I get a very polite Message Box saying "Warning you have tried a cracked program on this computer. The software people have been notified by this..."

Well, that's bull, BUT, suddenly Ping.exe appeared in my C:\ directory. Now the message won't go away and I still can't access my registry with regedit. Other files (regclean, etc.) CAN access my registry however, but TweakUI is also disabled.

Why don't you restore your registry you say? I'd love to, but my default backups seemed to have disappeared... And unfortunately I cleaned house recently of OTHER backups before defragging and never got around to making new backups.

I don't know WHERE this nasty message box may be coming from. Startup Manager (which checks Run/RunOnce/RunServices etc) doesn't show anything. StartMenu/Startup doesn't show anything. SoftIce however (oh beloved SI) shows that the Message Box (which appears just before the Icons on your Desktop appear) is created by Mprexe.exe, a standard Win98 task that always seems to be running. So I assume some little registry snippet is calling mprexe.exe and giving it that string, or maybe the string is stored elsewhere in a file. A fresh bootlog.txt doesn't show anything untowards that I can see. Bootup in SafeMode is OK - no message.

I'm just about to d/l one of those programs that allows you to change Administrator settings in Windows and hope it reverses the registry editing disabling. If it does, then I need to wipe out what's calling that Message Box.

Anyway, this is a warning to anyone who wants to "just have a little fun" with this program. I'm not complaining, I deserve it (beat me, whip me, I love it ;p and if worse comes to worse it's about time for a complete housecleaning anyway.

But if anyone has any suggestions...

BTW, I did get the program to say "Thanks for Registering", but this was only the Message Box call.

Kayaker >(
Kayaker
11-08-2000, 01:19 AM
Whew! Back in business. I d/l a great little freeware program called Key 2000 which allows you to disable all system restrictions. Just happens to be by a guy called Goh Kayak (gotta love it ;)

As it turns out the Message Box was being generated from:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon]
"DontDisplayLastUserName"="0"
"LegalNoticeCaption"="Illegal software installed on this computer."
"LegalNoticeText"="Warning! You have tried a cracked program on this computer... The software people have been notified by this..."

And the restriction on Regedit from:

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000
"NoDispCPL"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispAppearancePage"=dword:00000000
"NoDispSettingsPage"=dword:00000000
"NoSecCPL"=dword:00000000
"NoPwdPage"=dword:00000000
"NoAdminPage"=dword:00000000
"NoProfilePage"=dword:00000000
"NoDevMgrPage"=dword:00000000
"NoConfigPage"=dword:00000000
"NoFileSysPage"=dword:00000000
"NoVirtMemPage"=dword:00000000

Well, that was a nice little lesson in Policy settings and a new location for things starting up on logon. Kudos to Merak Mail.

If I was smart I'd leave well enough alone now...

Yah, Right. Heheh

Kayaker
goatass
11-08-2000, 08:03 AM
Kayaker my friend that was pretty cool :)
Merak Mail people were actually thinking when they wrote this program, well I'm glad you got evertyhing to work now. I'm hoping this little setback will make you want to rape this program even more :)

good luck
goatass
cronos
11-08-2000, 11:34 AM
Regedit is easily fooled. Hexedit the program and you'll find that policy key it checks.. disableregistrytools or whatever it is. Just change the name of the key it checks ;) In fact, anywhere that you don't have the admin rights.......
hz
11-08-2000, 12:49 PM
Hi Kayaker,
Sounds like key 2000 might be useful, appreciate a url for it.
regards
hz
Kayaker
11-08-2000, 05:03 PM
goatass - You can be assured Sir, that this personal affront, this violation, shall not be forgotten. The gauntlet has been dropped. Ze Duel, she begin at Dawn...

hz et al - You can get Key 2000 at www.softseek.com under Utilities/System (2nd page I think)

cronos - Oh the String/Registry references are definitely there in a hex editor. The 1st thing I want to do is see if the "problem" was caused by the initial CRC check, or if there's a 2nd "quiet" one around that caused the problem.

I figure I'll do a Trace between 004753F1 AFTER doing a fresh patch to bypass the CRC check so it's not triggered even once, and a BPX RegOpenKeyExA. If a Key is opened and is either of
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Winlogon]
or
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableRegistryTools"=dword:00000000

and something nasty is being written into them, I'll assume there's a 2nd check somewhere in that Trace.

There's also an interesting Flag set at 00475404 if the check is bad that I'd like to know what its function is. I'd take a guess and say that if the Flag was set to 00, the registry entries might not be written even if the CRC check failed (could be wrong though).

Here's the relevant code:

SoftIce Check ('MeltIce' protection documented in FrogsIce):
:0049758C FF92B4000000 call dword ptr [edx+000000B4] ; \\.\SICE check
:00497592 84C0 test al, al ; I changed this to 32C0 xor al,al
:00497594 740F je 004975A5
\\.\NTICE check follows

CRC Check (break on CreateFileA/ReadFile):
:004753D4 E8EBFDFFFF call 004751C4 ; looks like it could be the checksum for config.exe (lots of ROL ROR SHL SHR in a big loop)
:004753D9 8BF0 mov ESI, eax ; need to confirm ESI contains the value used in the later CMP
:004753DB 8D55F8 lea edx, dword ptr [ebp-08]
:004753DE 33C0 xor eax, eax
:004753E0 E8F7D5F8FF call 004029DC ; call to GetModuleFileNameA (!)
:004753E5 8B55F8 mov edx, dword ptr [ebp-08]
:004753E8 8BC3 mov eax, ebx
:004753EA E815FDFFFF call 00475104 ; calculate correct checksum

EAX=4F355C1E (correct checksum) ESI=4C3F1C50 (SICE-patch checksum)

:004753EF 3BF0 CMP ESI, EAX
:004753F1 7415 je 00475408 ; change to EB15 jmp 475408
:004753F3 66837B2A00 cmp word ptr [ebx+2A], 0000 ; ?
:004753F8 740A je 00475404
:004753FA 33C9 xor ecx, ecx
:004753FC 8BD3 mov edx, ebx
:004753FE 8B432C mov eax, dword ptr [ebx+2C]
:00475401 FF5328 call [ebx+28] ; CRC Nag

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004753F8(C)
|
:00475404 C6434401 mov [ebx+44], 01 ; Flag used for??

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004753F1(C)
|
:00475408 33C0 xor eax, eax ; passed CRC check
:0047540A 5A pop edx
:0047540B 59 pop ecx
:0047540C 59 pop ecx
:0047540D 648910 mov dword ptr fs:[eax], edx
:00475410 682A544700 push 0047542A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00475428(U)
|
:00475415 8D45F8 lea eax, dword ptr [ebp-08]
:00475418 BA02000000 mov edx, 00000002
:0047541D E8F6E8F8FF call 00403D18
:00475422 C3 ret

The fun continues... ;)

Kayaker
esther
11-10-2000, 10:07 AM
Hi Kayaker,
EAX=4F355C1E (correct checksum) ESI=4C3F1C50 (SICE-patch checksum)

How to calculate this checksum ,I'm stupid
hehe.
I just found that after deleting settings.cfg
it returns to 30 days.the reference key is
your windows registered key with just a
C-Pro !
Kayaker
11-11-2000, 02:48 AM
Y'know, this 4098 character limit for posts is real annoying, especially with all the code we tend to generate...

Hi Esther,

I played around with it a bit tonight and found a few things out about the checksum routine. Here's the start of the routine I mentioned in my last post:

:004753D4 CALL 004751C4 ; calculate checksum of config.exe
:004753D9 MOV ESI,EAX ; checksum returned
:004753DB LEA EDX,[EBP-08]
:004753DE XOR EAX,EAX
:004753E0 CALL 004029DC ; GetModuleFileNameA (config.exe)
:004753E5 MOV EDX,[EBP-08]
:004753E8 MOV EAX,EBX
:004753EA CALL 00475104 ; retrieve hard-coded checksum
:004753EF CMP ESI,EAX ; cmp the two
:004753F1 JZ 00475408 ; Oh, Oh, you're a bad boy!

If you set a BP at 004753D4 and then set a
BPX CreateFileA do "dd esp->4"
as you F10 over it, SI will break and display the path of the file 'config.exe' in the data window.
Then if you set and break on
BPX ReadFile and display the stack with "dd SS:ESP"
(it's actually ESP before the call but ESP+4 if you've already broken into the call, and the "SS:" isn't really needed)

:0076FA9C 00000020 014D0004 0012CA00 0076FAB0
:0076FAAC 00000000

you see the 5 DWORDS corresponding to the ReadFile parameters being PUSHed

BOOL ReadFile(

HANDLE hFile, // handle of file to read
LPVOID lpBuffer, // address of buffer that receives data
DWORD nNumberOfBytesToRead, // number of bytes to read
LPDWORD lpNumberOfBytesRead, // address of number of bytes read
LPOVERLAPPED lpOverlapped // address of structure for data
);

If you display 014D0004 (address of buffer that receives data) in the Data window, you'll see the file being read in. 0012CA00 (number of bytes to read ) is the size of the full exe file, and after returning from the Call, 0076FAB0 will show that 0012CA00 bytes were indeed read in.

Now, if you trace a bit after returning from ReadFile, you reach the heart of the checksum routine. I've shown the registers before and after the loop. As this is an untouched file, the final checksum shown in ESI is the "true" checksum.

EAX=00000000 EBX=00000000 ECX=00000000 EDX=0004B280 ESI=0012CA00
EDI=0012CA04 EBP=0076FC40 ESP=0076FAC8 EIP=004752A7

:004752A7 MOV EAX,ECX
:004752A9 SHL EAX,02
:004752AC ADD EAX,[EBP-10] ; [ebp-10] = 014D0004
:004752AF MOV EAX,[EAX]
:004752B1 CMP EBX,00000158 ; skips over 4 bytes at 158h in the file - why? - this is the hard coded checksum
:004752B7 JZ 004752DA
:004752B9 MOV [EBP-04],EAX
:004752BC ROR DWORD PTR [EBP-04],0A
:004752C0 SHR DWORD PTR [EBP-04],03
:004752C4 ROL DWORD PTR [EBP-04],07
:004752C8 XOR [EBP-04],EAX
:004752CB MOV ESI,[EBP-0C]
:004752CE XOR ESI,[EBP-04]
:004752D1 ADD ESI,[EBP-14]
:004752D4 MOV [EBP-0C],ESI
:004752D7 MOV [EBP-14],EAX
:004752DA ADD EBX,04
:004752DD INC ECX ; final value is 4B280
:004752DE DEC EDX ; initial value is 4B280
:004752DF JNZ 004752A7

EAX=014D0004 EBX=0012CA00 ECX=0004B280 EDX=00000000 ESI=4F355C1E
EDI=0012CA04 EBP=0076FC40 ESP=0076FAC8 EIP=004752E4

...and on to Part deux...
Kayaker
11-11-2000, 02:49 AM
So what's happening here is that every 4 bytes in the entire file undergoes the ROR SHR ROL etc. routine and the cumulative checksum is stored in ESI. 4 bytes at 158h in the file is skipped because this contains the hard-coded checksum value (1E5C354F). 4B280 times through the loop at 4 bytes apiece = 12CA00 = size of file.

You can monitor the reading of the hard-coded checksum value at 004753EA by setting breakpoints on SetFilePointer and then ReadFile. The ReadFile function reads data from a file, starting at the position indicated by the file pointer.

Display the SetFilePointer stack with "dd SS:ESP"

:0076FACC 00000020 00000158 00000000 00000000

and you see stack param. 2 specifies the number of bytes to move the file pointer (158) and
stack param. 4, which is the starting point for the file pointer move, is set to the beginning of the file.

DWORD SetFilePointer(

HANDLE hFile, // handle of file
LONG lDistanceToMove, // number of bytes to move file pointer
PLONG lpDistanceToMoveHigh, // address of high-order word of distance to move
DWORD dwMoveMethod // how to move
);

Doing the same at the ReadFile break shows that 4 bytes are to be read in beginning at 158h, which lo and behold is 1E5C354F.

Now I don't know what checksum algorithm this routine corresponds to. I generated checksums on the file (sans those 4 bytes) using Hex Workshop and the value doesn't match any of the standard ones built into HW.

So all this brings up an interesting twist on a keygen. You could code a keygen which would read the file after you've made all your patches and generate a new checksum using the program's routine, which you could then insert at 158h.

There's a file at h*tp://www.createwindow.com called CRCtext.exe which generates a (0's compliment I think) CRC32 checksum of a file and source code is available. It might be a fun little project.

Cheers,

Kayaker
esther
11-12-2000, 05:44 AM
Hi Kayaker,

Thanks for the input,I er hm slow learner hehhe
must put more time understand this CRC checks...
Please don't use force,she'll screamm d:P

cheers
with respect
esther
esther
11-14-2000, 09:08 AM
Hi Kayaker,
>There's lots of info on CRC/checksum stuff, >but here's a nice, gentle doc called
>A PAINLESS GUIDE TO CRC ERROR DETECTION >ALGORITHMS guaranteed not to make you scream
>http://www.repairfaq.org/filipg/LINK/F_crc_v>3.html

Hey not me her :D I did'nt even rip her clothes off,you did ;)
thanks for the url REEEEl GOOODDD

>Anarchriz did a tut on CRC and how to >Reverse it if you're feeling masochistic, I >haven't even TRIED to digest it! I think >I've also seen an ASM representation of a >true CRC-32 check by some reversing guru >somewhere or another.

Hard to understand hehe,I have read it.
should read the doc you recommmend.
I found the CRC-32.txt in ftp site
the url is in Anarchriz's tut
Great thanks again
Busy like hell in real life hehhe
maybe laterzzzzz
best regards
esther


newbie Help!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbie Help!!!!
PDA

View Full Version : newbie Help!!!!

nebbursis
11-08-2000, 12:07 PM
Hi!
I know what Im about to ask maybe do not belong in here, but I really need help with this sence there are not really many tutorials in this matter, sure there is a lot of tutorials on noping a value......but were do I go from there? I hope some of u know what Im talking about here.
Here it goes ..... I´m trying to hack starcraft v.1.0. Lets say I want to make a trainer that when I push a button it will add 1000 to the minerals. I search the game with gamehack and I come up with an adress. In my case it was 004EFE0C. So I did an bpmd 004EFE0C w on it and here`s where softice poped up.
0042205B 8A464C MOV AL, [ESI+4C]
----------------------------------------
0042205E 8A8ECF000000 MOV CL,[ESI+000000CF]
----------------------------------------
00422064 6A00 PUSH 00
-----------------------------------------
00422066 8B148508FE4E00 MOV EDX,[EAX*4+004EFE08]
-------------------------------------
0042206D 03D1 ADD EDX,ECX
------------------------------------
0042206F 89148508FE4E00 MOV [EAX*4+004EFE08], EDX
---------------------------------------
00422076 33C0 XOR EAX,EAX:THIS LINE IS WHERE SOFTICE POPSUP
------------------------------------------
00422078 8A464C MOV AL,[ESI+4C]
------------------------------------------
0042207B 33D2 XOR EDX,EDX
-----------------------------------------
0042207D 8A96CF000000 MOV DL,[ESI+000000CF]
-----------------------------------------
00422083 8B0C8598FE4E00 MOV ECX,[EAX*4+004EFE98]
----------------------------------------
0042208A 03CA ADD ECX,EDX
----------------------------------------
0042208C 33D2 XOR EDX,EDX
-----------------------------------------
00422095 8A96CF000000 MOV DL,[ESI +000000CF]
-----------------------------------------

Now, where do I go from here, I have a basic ide, but I`m a little confused. So if anyone could help me with this I would really be thankful, sence Im stuck at this point. And I feel if I get help with this I will get a hang of it all.
Thanks in advance
Fake51
11-09-2000, 06:32 AM
nebbursis (11-08-2000 02:07):

0042205B 8A464C MOV AL, [ESI+4C]
----------------------------------------
0042205E 8A8ECF000000 MOV CL,[ESI+000000CF]
----------------------------------------
00422064 6A00 PUSH 00
-----------------------------------------
00422066 8B148508FE4E00 MOV EDX,[EAX*4+004EFE08]
-------------------------------------
0042206D 03D1 ADD EDX,ECX
------------------------------------
0042206F 89148508FE4E00 MOV [EAX*4+004EFE08], EDX
---------------------------------------
00422076 33C0 XOR EAX,EAX:THIS LINE IS WHERE SOFTICE POPSUP
------------------------------------------
00422078 8A464C MOV AL,[ESI+4C]
------------------------------------------
0042207B 33D2 XOR EDX,EDX
-----------------------------------------
0042207D 8A96CF000000 MOV DL,[ESI+000000CF]
-----------------------------------------
00422083 8B0C8598FE4E00 MOV ECX,[EAX*4+004EFE98]
----------------------------------------
0042208A 03CA ADD ECX,EDX
----------------------------------------
0042208C 33D2 XOR EDX,EDX
-----------------------------------------
00422095 8A96CF000000 MOV DL,[ESI +000000CF]
-----------------------------------------

Well, first of all, you might wanna check that you have the right value. Alter it a bit and see what happens. Then, if it turns out to be the right one, what you might wanna do is create a runtime patcher, that at any given time can add a value to the specific mem location (that is, if you want to be able to add to the value. You could also opt for a patch that would stop the value decreasing. In that case you could just nop out 42206dh). This can be done simple or complex according to needs and wants. Go find some tutors on doing run-time patchers.

Fake
NikDH
11-09-2000, 06:43 AM
I dont think the line u have posted refers to changing a mem value :)))
For example: da ya think that
0042208C 33D2 XOR EDX,EDX
has something in common with the bp u have put?
U have to remeber that when u put a bp on memory sice pops AFTER the instruction that modifies the memory :)
So set your bp and record the line before the line in which sice pops :)
I hope these r the rigth ones :)
NchantA
11-12-2000, 11:07 PM
-----------------------------------------
00422066 8B148508FE4E00 MOV EDX,[EAX*4+004EFE08]
-------------------------------------
0042206D 03D1 ADD EDX,ECX
------------------------------------
0042206F 89148508FE4E00 MOV [EAX*4+004EFE08], EDX
---------------------------------------
00422076 33C0 XOR EAX,EAX:THIS LINE IS WHERE SOFTICE POPSUP
------------------------------------------
00422078 8A464C MOV AL,[ESI+4C]

ok just with a quick look it looks like the add edx,ecx is the instruction ur looking for, for a superb tutorial on training check tsehp+'s page

direct link:
http://www.woodmann.net/fravia/trainer.htm

otherwise theck whats new tsehp.cjb.net


Newbie, Help with Soft Ice!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Newbie, Help with Soft Ice!
PDA

View Full Version : Newbie, Help with Soft Ice!

Hexon
11-09-2000, 10:42 AM
Hi all

I have a little problem with Soft Ice. I have just started one of the Sandman’s tutorials on how to reverse a util called “StartClean”. In the tut it says set a BPX breakpoint on “getdlgitemtexta”. However when I set it by typing: bpx getdlgitemtexta, I get the error message: symbol not defined (GETDLGITEMTEXTA).

Why does this keep on happening whenever I try to set the breakpoint? Is it something to do with the Symbol Loader that comes with Soft Ice, or the config file. I cannot understand this, according to Sandman’s tut I should be able to set this breakpoint!

Any help here will be greatly appreciated – I want some hair left!

Regards

Hexon
esther
11-09-2000, 11:04 AM
Hiya,
check winice.dat

; Example: PHYSMB=32
; *************************************************************************
EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll

there should be no ; after the kernel32 or user32.dll

Hope that will save your hair from dropping

;)
regards
esther
Hexon
11-09-2000, 01:24 PM
Hi Esther

Thanks the lot for the info, it workred fine after I altered winice.dat file. I still have my hair!!

Thanks again
Hexon


API Moniter -- Help ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > API Moniter -- Help ???
PDA

View Full Version : API Moniter -- Help ???

Clandestiny
11-09-2000, 03:38 PM
Hi,

I recenly downloaded API Spy api moniter and was wondering which functions I should include ??? At first I just included all of the standard function libraries (gdi, kernel32, user32 ...ect), but this does not seem to be a good choice for a couple of reasons.

1) it slows my system terribly when trying to moniter an app

2)There are hundreds api functions and many of these functions are useless in context of examining an app's protection and it becomes very difficult to sort through the log.

On the other hand, I don't want to exclude api functions which might be useful (which my newbie knowledge might exclude in not realizing their benefit).

Thanks in advance,
Clandestiny
Kayaker
11-09-2000, 04:49 PM
Hi Clandestiny,

I usually start by doing Kernel32.fnl seperately to get an overview of what's going on. After a few times doing this on several programs, you'll find several API's that you don't usually want included (EnterCriticalSection, LeaveCriticalSection, AddAtomA and other crap like that that comes up all the time but are kinda useless). Then you can modify the fnl file with LibEdit.exe and delete them, saving your own personal version which you can develop over time.

Same with User32.fnl and Advapi32.fnl. You can also make your own fnl's with combinations of several calls, for example CreateFileA/ReadFile from Kernel32 and RegOpenKeyExA/RegQueryValueExA from Advapi32. This can be really useful because you get a sense of WHEN certain calls are being made relative to each other, as well as WHAT.

You can also add just the Imports from the file you're monitoring from the Imports button, but most of them are VOID, which I *think* means there is no parameter information, so you'd have to add that in the .fnl format.

Generally I find setting up a Kernel and/or User fnl library slightly modified and running them seperately so as not to hog CPU works fine, and then the stock Advapi version.

Hope this helps,

Kayaker
NikDH
11-09-2000, 07:40 PM
I think that if u r intereseted only in app protection scheme its better 4 u to include only a few very important group of api:
For protections dealing with registry import some useful function by ADVAPI32.DLL like:
RegCreateKey, RegOpenKey,... and their corresponding Extended :)
For protections dealing with files import some functions like CreateFile, ReadFile, WriteFile,...
I think that functions like GetWindowText,... r always welcome :)
pepperman
11-16-2000, 12:27 PM
is this program better than regmon/filemon?


Reversing high-level language sources
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reversing high-level language sources
PDA

View Full Version : Reversing high-level language sources

Lord_Soth
11-09-2000, 05:57 PM
Hola folks,

I gotta say, reversing code of a real app,
written in a HLL without much commenting
is not trivial.
I'm quite happy because I'm doing it faily
good so far :)
I'm reversing 1 of the sendmail source files
hehehe

Awesome, you guys gotta try it!

LS
the snake
11-13-2000, 10:17 AM
Hi Budy
First i'm happy to see someone that i know here, it's been a while since i was here last time...

Second, i'm glad to hear that you're happy with what you do... :)

Man, i don't have the time for all of this as i use to have, and i realy realy miss it.

take care (you can phone me if you like)
the snake

GreetZ to all my "old" friends and the new newbis as well...

the snake
ThRaX
11-13-2000, 04:33 PM
hey snake wutz up! i remember you from way back in '99....my name was 'craftie' back then, dunno if you remember me or not ...

later
the snake
11-14-2000, 12:04 AM
Hi there craftie
Sure i remember you, i still host the tutorial about "How to crack Cruehead's Crackme v1.0" at my guest section. I'll post here the url for all those newbies that don't know my site :
http://snakepage.cjb.net

Hey, are you still in business ? do you have the same interest and time spending as before ?

C ya
the snake
ThRaX
11-14-2000, 04:44 PM
Heh, actually I sorta took a good long break from all cracking/reversing/coding things since the end of 1999..."real life" had me busy. I'm slowly remembering/relearning all the things I used to know. Thats cool that you still have that tut...I remember writing that a long time ago...I just reread, and realized there's actually a couple of mistakes in there. Oh well...I dont have the patience to fix it now ;)

cya later


how useful is dede?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how useful is dede?
PDA

View Full Version : how useful is dede?

hz
11-09-2000, 09:14 PM
hi,
anobody had more than a little success with dede?. I've never got much from it and now I'm looking at references to TfmEnterRegCode that does'nt appear to
exist. Any help advice appreciated.
regards
hz
DinDon
11-10-2000, 02:40 AM
I find it a wonderful RE work, and very useful too, especially if you are oriented towards a dead-listing approach. In that case you can find immediately the entry points of the routines you are interested at, and you can go on reversing and understanding your target, eventually dumping them with a good disassembler like IDA (but DeDe itself is a very good disassembler...).
Obviusly you cannot pretend to find the symbol TfmEnterRegCode in SoftIce: it's related to a form structure, but the code entry point is well shown by DeDe, so if you want you can break at the address DeDe will suggest you.

All these words are just on a theretical ground, because I do not know what is the application you are referring to.

Best regards
hz
11-11-2000, 04:16 PM
hi,
yes what I should have said is a registration box/form whatever that I can
find no way to activate. Maybe you would
be willing to help?
regards
hz
Kayaker
11-11-2000, 04:20 PM
So what's the program?
hz
11-11-2000, 07:26 PM
hi,
Its SIGaurdian. h*tp://palick.mastak.com.
Its asproteted but rad unpacks it.
regards
hz
hz
11-11-2000, 07:33 PM
hi,
please ignore my post about SiGaurdian. I'm
either going blind or stupid, the registration box was there all the time. sorry.
regards
hz


Why does imp_list say "error read MZ-header" ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Why does imp_list say "error read MZ-header" ?
PDA

View Full Version : Why does imp_list say "error read MZ-header" ?

Solomon
11-10-2000, 02:27 AM
I want to rebuild the import table of a asprotected prog with imp_list,
but it says "error read MZ-header" .
Anyone know why this happens? Thx in advance.
SV
11-11-2000, 03:31 AM
Where is the asprotected prog ?
Solomon
11-11-2000, 10:30 AM
thx for your attention.
This is a nice prog named GoldenSection Organizer, Version 1.20 (Build 99).
http://www.tgslabs.com/download/GSOrg.zip


The rocky AsPack/AsProtect road...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > The rocky AsPack/AsProtect road...
PDA

View Full Version : The rocky AsPack/AsProtect road...

JimmyClif
11-11-2000, 06:46 PM
I'm trying to walk the way... *g* Does anyone know what version came after :
AsPack/AsProtect v1.084 ? And what would be really helpful... does anyone know a prog with that specific packed version?

Thanks in advance.
JimmyClif
esther
11-12-2000, 03:54 AM
Hi JimmyClif,
this is in the help file of aspack

Version 2.11 (04-Oct-2000)

Version 2.1 (30-Mar-2000)

Version 2.000 (27-Dec-1999)<--- you can get it in R!sc site

Version 2.000 beta (06-Dec-1999)<--- I can't find this version in the web

Version 1.08.04 (14-Oct-1999)

Well ,its rocky,need time and patience
8)

esther
JimmyClif
11-12-2000, 05:19 AM
Thanks esther,

JimmyClif blushes *g* he should have thought at that...


tut search engines?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > tut search engines?
PDA

View Full Version : tut search engines?

pepperman
11-13-2000, 01:31 PM
is there a "working" tutorial search engine , im particularly interested in techno ejay (PXD software), i got a time limited version and now the times run out, the program starts in a small 6kb 16bit program that loads a 32bit windows program, ive tried filemon/regmon to see whats going on but theres so many dll's, it writes a temp file to c:\windows\temp, a different file every time. Does anything sound "familiar" here, can someone give us a tip please, just some guidance for a newbie...thxz
the snake
11-13-2000, 11:53 PM
Hi
All Tornado's search engines urls doesn't work, but here is Jeff's search engines, hope this will help.

http://www.jps.net/jas/

the snake
zouzouni
11-14-2000, 05:46 PM
I'm just updating my search engine check it out http://reversersearch.da.ru


a little help wit softice plz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > a little help wit softice plz
PDA

View Full Version : a little help wit softice plz

pupp
11-14-2000, 11:46 PM
Hi all
i can't remember in softice how too copy and paste, its been a while sence i did it last. Can someone plz give me a little info on this.

TIA

pupp
NoRToN
11-15-2000, 10:50 AM
If u have the mouse activated in SIce then its just to
right-click and select copy or paste.


is api monitor better than filemon/regmon?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > is api monitor better than filemon/regmon?
PDA

View Full Version : is api monitor better than filemon/regmon?

pepperman
11-16-2000, 12:33 PM
same as above
?ferret
11-16-2000, 08:51 PM
AFAIK an API monitor just tells you what API's each module is using (hence the name ;-) )

Filemon/Regmon are completely different tools....actually if Sysinternals made an API monitor, it would probably be called Apimon :-)
ThRaX
11-16-2000, 09:37 PM
You can't really say its "better"...They are totally different, and serve different purposes

Regmon: Lists what parts of the registry the program modifies/accesses

Filemon: Lists what files the program accesses/modifies

APIMonitor: Lists what APIs the program makes calls to.

hope that clears it up


<b>Question about ASM instruction?</b>
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > <b>Question about ASM instruction?</b>
PDA

View Full Version : <b>Question about ASM instruction?</b>

xOptiMus
11-17-2000, 10:51 AM
Hi there,

Can anyone explain what "MOVZX" actually does?

I know what MOV does. So what is the difference between MOV and MOVZX?

Hope someone can help

TIA
xOptiMus
cronos
11-17-2000, 12:10 PM
I replied to this on the other board.


comparisons
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > comparisons
PDA

View Full Version : comparisons

MR. Candyman
11-19-2000, 04:49 PM
I was wondering if there's a program that can compare either text files or .alf files.

Normally I would print everything out but each file I wanna compare's over 3000 pages long.

thanks
pupp
11-19-2000, 10:24 PM
If i remember right Ultra Edit will do it

pupp


CRC check reversing -- Please Help !!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CRC check reversing -- Please Help !!!
PDA

View Full Version : CRC check reversing -- Please Help !!!

Clandestiny
11-20-2000, 08:52 AM
Hi guys,

I've recently been trying to crack Cool Edit Pro. Upon attempting patch the program, I get a "file integrity compromised" message. This let me know that there is probably a CRC check. I've done some research / read some tutorials about CRC protections, but the info was somewhat sketchy. I'll tell you what I've tried though and *hopefully* someone will be able to point me in the right direction.

1)The MessageBoxA containing the "file integrity compromised message" was the first and most obvious place to start. This I both examined in Wdasm and traced in SoftIce. There are a couple of jumps which bypass this mbox, but the program becomes frozen upon trying to change them so I concluded that the check must be earlier during the initialization.

2)I examined the program in an API moniter looking for all functions like CreateFileA and _lopen since I know the program will need to open itself to perform the CRC check. There were 2 promising files being opened with the _lopen API. These were coolpro.exe and cool.ini. I was *hoping* that the program was opening itself to perform the check. There was also an interesting reference to a checksum = 832952384 in the .ini file. Once I found this I did a search for it in memory and put bpm on all of the locations from the search. SoftIce broke a couple of times, but the contents of my memory loctions had somehow changed and no longer had the check sum value in them. I can't find any isolated function that looks like a CRC check,
though there is some code that operates on the coolpro.exe file after the_lopen and _hread APIs. This code does not look simple at all to reverse and I'm not even sure it is what I'm looking for !

3) Also, the program behaves somewhat inconsistantly...For example, after tampering with the file I first get a "file integrity compromised message box". A little later the program simply closes without displaying the message box. This continues to occur somewhat randomly and a couple of times the program even ran normally without displaying the message box or closing itself. Could this be indicative of some "self modifying code" ???

I'm a little lost on what to try next and will really appreciate some advice...

It seems like this protection is a little more challenging than newbie level, but I think there is much to learn and I don't want to give up on it ;-)

Thanks in advance...
Clandestiny
IcyDee
11-22-2000, 05:33 PM
CRC calculations are not usually performed on the file contents, instead they are usually performed on the memory contents. To find the code that does a CRC put a breakpoint on a particular byte of code being read. This will probably help you to find out where the CRC code is.

IcyDee
Lord Soth
11-25-2000, 06:09 PM
Also true, but you might wanna try to see
if the app uses any kind of memory mapped files.
The obvious reason to use memory mapped files is to transfer info between applications, but i've seen protections that use memory mapped files to check their own integrity.
functions like MapViewOfFile (i think, not sure, been awhile..) and related might be used.
A good tip is to patch the CRC check but in a way that will fool the program. Don't just patch a conditional, try to patch the "correct" checksum transforming it to the checksum that gets calculated after you patched.

LS
Clandestiny
11-27-2000, 10:11 PM
Thx guys for the input...

Unfortuntely, this is my *first* attempt at reversing a CRC check and my problem right now is not "how to patch" but "how to find" the CRC check. I looked into Lord Soth's suggestion about the MapViewOfFile function. A really good suggestion I might add (and one which I will keep in mind for future CRC protections), but alas Cool Edit does not seem to use this particular function. I have read several tuts on CRC, most of which suggest the CreateFileA function to be a key indicator of a CRC. CreateFileA is called in this program and I've tried to examine the surrounding code with limited success...if there is a CRC here it does not look to be a simple cmp --> jmp. I'm actually a little lost on what else I should try and I would really appreciate it if a few of the more advanced reversers on the forum could offer me a few more detaitled pointers or possibilites which I might investigate.

Thx in advance,
Clandestiny
hackscode
11-27-2000, 10:36 PM
hi clandestiny,
i myself don't have that much of experience with crc-secured files, but
maybe a good first step for you to take, could be this:
find out, if it is just a simple crc or a more complicated one. e.g. change
a byte (preferably in a string somewhere in the file), let's say from
'a' to 'b'. run the file, check if it will abort. if so, change another byte
from 'd' to 'c' or whatever. you've got the idea?
if it is just a simple routine, you might success this way..
but it's just a workaround, i know.
if the programmer did a very good job, he didn't set a crc-check across
the whole file, but instead of that just a part of the code, that is important.
i have once come across a prog of that type and so the method
mentioned above didn't lead any further.

maybe i could give you some ideas to think about

be careful
Lord Soth
11-28-2000, 05:23 PM
Did you take the few means to check if this
is a memory CRC ?
The first thing to check for is if the program is actually performing the CRC on
the contents of memory.
Place a BPM on the patched bytes for read
access (I'd suggest a byte BP, nothing bigger).
If this is the case, you won't have much
work to do to reach the conditional.

LS
Lord Rhesus
11-28-2000, 06:24 PM
Hello Clandestiny. Instead of boring you with the facts I will let someone else do it ;-). I downloaded most of the DREAD website before the group closed it down and I have two useful essays which were on the site regarding CRC. One is about how the CRC check is calculated and how it can be reversed and the other is an example of how to find and reverse the CRC check on a particular program. All credit to DREAD. I'm sure this will be of use to you! For some reason I can't upload attachments so just e-mail me at lordrhesus@yahoo.co.uk and I will send you the essays.
Clandestiny
11-29-2000, 09:50 AM
To Hackscode: You were right about changing a random byte of some string unrelated to the protection. Apparantly (thankfully), this is an *easy* CRC since it must perform the check across the whole file rather than just on the important part of the protection scheme.

To Lord Soth: I think I now understand about what you and IcyDee were saying about the CRC being on the memory contents rather than the file contents and I feel almost *silly* to ask this next question, because I think it must be a painfully obvious one...but I really want to learn and here goes anyway...

To my limited understanding (and please correct me if I'm wrong) the program will use CreateFileA or _lopen API to load the file in memory and return a pointer to the beginning of the file. Then it will have to read either some or all of the file in order to perform the CRC. I changed a single byte in the file as was suggested and I'm now wondering how exactly to locate the address of this specific byte in memory once the file has been loaded so I can bpm on its address? Now I know that Wdasm gives me the offset of each line in the file. Could I just add the address of the file pointer returned by _lopen + the offset in Wdasm to get the memory address to bpm on. Am I on the right track here or completely off target ???

Thanks A Lot,
Clandestiny
Unregistered
10-14-2001, 06:01 AM
Hi Clandestiny

I am trying to make CoolEdit 2000 v1.1 work properly and I found this discussin very interesting. I would like to know how far are you. I am almost sure you are finished now. How about a tutorial?

Met


help with softice pls!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help with softice pls!!!
PDA

View Full Version : help with softice pls!!!

pepperman
11-20-2000, 12:54 PM
how do i break on any of these functions? +++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++

Import Module 001: kernel32.DLL

Addr:BFF9D545 hint(0000) Name: SystemTimeToFileTime

Import Module 003: MSVBVM50.DLL

Addr:0F0E9FC8 hint(02B2) Name: rtcSaveSetting
Addr:0F102FFC hint(0000) Name: MethCallEngine
Addr:0F0E0A2C hint(026E) Name: rtcStrConvVar
Addr:0F03C89B hint(0204) Name: rtcAnsiValueBstr
Addr:0F03AB67 hint(0271) Name: rtcCreateObject
Addr:0F03A479 hint(0206) Name: rtcLowerCaseVar
Addr:0F0D67E1 hint(0229) Name: rtcGetYear
Addr:0F0DC025 hint(0294) Name: rtcVarFromFormatVar
Addr:0F012135 hint(029D) Name: rtcCommandBstr
Addr:0F05E479 hint(012C) Name: GetMem2
Addr:0F0E89D6 hint(012D) Name: GetMem4
Addr:0F0D405A hint(0253) Name: rtcMsgBox
Addr:0F0261B4 hint(0256) Name: rtcDoEvents
Addr:0F03BF96 hint(0132) Name: PutMem2
Addr:0F0DF23C hint(0208) Name: rtcTrimVar
Addr:0F0E8AFF hint(0133) Name: PutMem4
Addr:0F0DF2B5 hint(0209) Name: rtcLeftTrimBstr
Addr:0F0DF4BC hint(020B) Name: rtcRightTrimBstr
Addr:0F00BCB0 hint(0277) Name: rtcMidCharBstr
Addr:0F0DF81E hint(020D) Name: rtcSpaceBstr
Addr:0F04306E hint(0278) Name: rtcMidCharVar
Addr:0F0DF860 hint(020E) Name: rtcSpaceVar
Addr:0F02299D hint(0000) Name: EVENT_SINK_AddRef
Addr:0F0DF88E hint(020F) Name: rtcUpperCaseBstr
Addr:0F0DF8B3 hint(0210) Name: rtcUpperCaseVar
Addr:0F01272A hint(0211) Name: rtcKillFiles
Addr:0F04F3E0 hint(0000) Name: DllFunctionCall
Addr:0F01218E hint(029E) Name: rtcCommandVar
Addr:0F0DE054 hint(0238) Name: rtcFileSeek
Addr:0F037FD1 hint(0000) Name: EVENT_SINK_Release
Addr:0F0D0A69 hint(0258) Name: rtcShell
Addr:0F03634A hint(0000) Name: EVENT_SINK_QueryInterface
Addr:0F022B59 hint(0000) Name: __vbaExceptHandler
Addr:0F0E8A73 hint(013A) Name: GetMemNewObj
Addr:0F0E8D19 hint(013B) Name: PutMemNewObj
Addr:0F04EBF6 hint(025F) Name: rtcStringVar
Addr:0F0E8E3E hint(013C) Name: SetMemNewObj
Addr:0F0D5C7F hint(0212) Name: rtcChangeDir
Addr:0F01BD44 hint(0260) Name: rtcVarBstrFromAnsi
Addr:0F0D5CA2 hint(0213) Name: rtcMakeDir
Addr:0F0D5CB3 hint(0214) Name: rtcRemoveDir
Addr:0F0D6033 hint(0215) Name: rtcChangeDrive
Addr:0F100284 hint(0000) Name: ProcCallEngine
Addr:0F050519 hint(0218) Name: rtcStrFromVar
Addr:0F01BCE6 hint(0219) Name: rtcBstrFromAnsi
Addr:0F0D6626 hint(021A) Name: rtcPackDate
Addr:0F040CDA hint(0285) Name: rtcDir
Addr:0F0D5A29 hint(0287) Name: rtcCurrentDir
Addr:0F0DE230 hint(023A) Name: rtcFileLength
Addr:0F00369C hint(0288) Name: rtcFreeFile
Addr:0F0D7E39 hint(023B) Name: rtcEndOfFile
Addr:0F01B43E hint(02A9) Name: rtcImmediateIf
Addr:0F054278 hint(0240) Name: rtcFileCopy
Addr:0F0D5D5F hint(0241) Name: rtcFileDateTime
Addr:0F00D607 hint(02AD) Name: rtcErrObj
Addr:0F036192 hint(0242) Name: rtcFileLen
Addr:0F00A1BF hint(0064) Name: ThunRTMain
Addr:0F0E9DFB hint(02B1) Name: rtcGetSetting
Addr:0F01B62E hint(0262) Name: rtcGetDateVar
Addr:0F058DD8 hint(0265) Name: rtcVarStrFromVar
Addr:0F012378 hint(0268) Name: rtcLeftCharBstr
Addr:0F00B8C4 hint(0269) Name: rtcLeftCharVar
Addr:0F0DED66 hint(026A) Name: rtcRightCharBstr
Addr:0F01238B hint(026B) Name: rtcRightCharVar
Addr:0F0D686F hint(021E) Name: rtcGetDayOfMonth
Addr:0F0D6828 hint(0221) Name: rtcGetMonthOfYear
Addr:0F0D5E62 hint(0244) Name: rtcSetFileAttr
Addr:0F0DD1FE hint(0245) Name: rtcR8ValFromBstr

ive tried bpx and bpm "CS:0F0D686F" rw, without the exclamation marks ? pls help me some1...BTW ive loaded every DLL that i can see that this program uses but alas im only a very young reverser (old person...39...but young reverser!! :)...)the program is a 30 day time trial of Techno ejay...(PXD software)..any help here would be truly appreciated
?ferret
11-20-2000, 09:30 PM
hmm...if you have the VB5 runtime dll loaded in softice, you should be able to break on all of those listed under it....if it's a small d/l I'll check it out
pepperman
11-21-2000, 12:53 PM
?ferret (11-20-2000 11:30):
hmm...if you have the VB5 runtime dll loaded in softice, you should be able to break on all of those listed under it....if it's a small d/l I'll check it out..the msvbm50.dll is 1316KB

this is part of my winice dat...is the fact that i hace "two" msvbvm50.dll,s loaded the reason i cant braek on the ejay one?

; WINICE.DAT
; (SIW95\WINICE.DAT)
; for use with SoftICE Versions greater than 3.0 (Windows 95)
;

; *************************************************************************
; If your have MORE than 32MB of physical memory installed, change
; the PHYSMB line to the correct # of Megabytes.
; If you have LESS than 32MB you can save a bit of memory by
; specifying the correct # of Megabytes
; Example: PHYSMB=32
; *************************************************************************
; ***** Examples of sym files that can be included if you have the SDK *****
; Change the path to the appropriate drive and directory
;LOAD=c:\windows\system\user.exe
;LOAD=c:\windows\system\gdi.exe
;LOAD=c:\windows\system\krnl386.exe
;LOAD=c:\windows\system\mmsystem.dll
;LOAD=c:\windows\system\win386.exe
; ***** Examples of export symbols that can be included *****
; Change the path to the appropriate drive and directory
;EXP=c:\windows\system\vga.drv
;EXP=c:\windows\system\vga.3gr
;EXP=c:\windows\system\sound.drv
EXP=c:\windows\system\mouse.drv
;EXP=c:\windows\system
etware.drv
EXP=c:\windows\system\system.drv
EXP=c:\windows\system\keyboard.drv
;EXP=c:\windows\system\toolhelp.dll
;EXP=c:\windows\system\shell.dll
;EXP=c:\windows\system\commdlg.dll
;EXP=c:\windows\system\olesvr.dll
;EXP=c:\windows\system\olecli.dll
;EXP=c:\windows\system\mmsystem.dll
;EXP=c:\windows\system\winoldap.mod
;EXP=c:\windows\progman.exe

;***ejay files
EXP=C:\Program Files\Techno2\ejay\ejay\Asycfilt.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Comcat.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Ctl3d32.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Dsetup.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Dsetup6e.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Dsetup6j.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Msvbvm50.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Msvcrt.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Msvcrt20.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Oleaut32.dll
EXP=C:\Program Files\Techno2\ejay\ejay\Olepro32.dll
EXP=C:\Program Files\Techno2\ejay\ejay\pxd32cl1.dll
EXP=C:\Program Files\Techno2\ejay\ejay\pxd32r4.dll
EXP=C:\Program Files\Techno2\ejay\ejay\pxd98db.dll
;********End of ejay files

; ***** Examples of export symbols that can be included for Windows 95 *****
; Change the path to the appropriate drive and directory
EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\msvbm50.dll
EXP=c:\windows\system\msvcrt.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
EXP=c:\windows\system\advapi32.dll
EXP=c:\windows\system\shell232.dll
EXP=c:\windows\system\comctl32.dll
EXP=c:\windows\system\crtdll.dll
EXP=c:\windows\system\version.dll
EXP=c:\windows\system
etlib32.dll
EXP=c:\windows\system\msshrui.dll
EXP=c:\windows\system\msnet32.dll
EXP=c:\windows\system\mspwl32.dll
EXP=c:\windows\system\mpr.dll
Aleph
11-21-2000, 01:16 PM
Hello.

1st, you should make a little check : replace the ejay version of the DLL with the normal windows one. If the proggy don't run, then you know why you can't break into it :-)

2nd, try commenting the msvbm50.dll that is in your "normal" windows exports symbols, and reboot. This way, SIce won't have to handle 2 *(maybe) different DLLs* with the same name.

3rd: is your proggy is in VB, you should consider using Smartcheck, an amazingly powerful and easy-to-use tool...

Hope that helps.

Aleph
?ferret
11-21-2000, 08:41 PM
Yup, you figured it out....softice is confused. I'd say the proggy uses the one in the system directory, you just included ALL .dlls used by the proggy in the part you added right? delete or jsut put a semi-colon in front of one to comment it out. reboot & try again. ;-)

As for Smartcheck....good suggestion...if it's not a pcoded app (smartcheck will tell you if it is). If so, might I suggest trying ExDec by JosephCo. It's a beutiful little tool for disassembling p-coded apps in VB5 & 6. Takes a little study to get the hang of it, but once you learn a few excodes, the disassembly tells you just about anything you want to know about the proggy ;-)

I don't have a URL handy for it, but I'm sure you could finesse one from somebody (JoCo?)

I know you can get it at #cracking4newbies on EFnet.

Good Luck
?ferret
11-21-2000, 08:42 PM
btw, LOL I meant if the proggy was a small d/l....11.5 MB....YIKES! hehe


Inadvertent Filemon/Regmon Antidebugging Trick?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Inadvertent Filemon/Regmon Antidebugging Trick?
PDA

View Full Version : Inadvertent Filemon/Regmon Antidebugging Trick?

Kayaker
11-20-2000, 01:38 PM
Hi All,

I was playing with a program that *appeared* to be resistant to Filemon/Regmon hooking. Cool, I thought. So I check for the presence of 'FilemonClass' and 'RegmonClass' in the file, apparently the usual method of detection, though I've never been lucky enough to find a proggy that did this. No dice.

No problem with other file/registry/API monitors, no anti-SoftIce, a few odd API calls at the start but I couldn't understand what effect they might be having on this. Then I happened to run the proggy under a different filename - Bingo.

The original filename began with a number. Filemon and Regmon apparently do not recognize filenames beginning with a number or a character other than a letter. You can duplicate the effect with Notepad. I checked the source code of Filemon/Regmon but couldn't figure out why this would be.

Anyway, just something to be aware of if you ever have a filename that doesn't start with a letter, or maybe if you want to throw a twist into a Reversme ;)

Kayaker
hz
11-20-2000, 06:52 PM
hi Kayaker,
thanks for that snippet, I came across a prog
just recently that behaved in the same way and did'nt figure it out.
regards
hz


Request for assistancemfc42.dll and license dll's!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Request for assistancemfc42.dll and license dll's!?
PDA

View Full Version : Request for assistancemfc42.dll and license dll's!?

SuperCali
11-20-2000, 01:45 PM
Hello,
I am looking at a program (smartstor) and it seems to use a seperate dll to generate / check valid licenses. Is it possible to use this dll to create valid licenses? Also what is the mfc42.dll used for? The damn program keeps dropping me into it every time I breakpoint either GetWindowText MessageBoxExA etc. It seems like it somehow does the work for the calling program (like string compares) using variables passed to it...or I am completely off track!? Anyone know were (except here) I can get info about it? I have managed to disable the auto prog shutdown when expired, and the service shutdown annoyance but I haven't really understood the protection ,which is the whole point of the excercise, hence the request for assistance. Notable is that the nags are still there because I keep on getting dropped in the mfc42.dll and don't really know were to go from there... Any help would as usual be greatly appreciated.
// SuperCali
?ferret
11-20-2000, 09:27 PM
MFC42.DLL is the runtime DLL for Visual C++. It behaves somewhat like the runtime DLL's for VB, that's why you keep geting dropped in there.


off the subject
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > off the subject
PDA

View Full Version : off the subject

newbern
11-20-2000, 04:52 PM
can any 1 help me with motorola ASP cards?they are used to track peoples movements. id like to know if reprogramming etc is possible
?ferret
11-20-2000, 09:24 PM
Sittin in front of the puter on Home Arrest are we? LOL
newbern
11-24-2000, 12:47 AM
not quite ferret . they use them at my work to track our whereabouts. but some cards have more access power than others.ie: open more doors .btw around here they use HOME ESCORT brand home arrest monitors


Can anyone send me a copy of "win95rk.hlp" ? Thx!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Can anyone send me a copy of "win95rk.hlp" ? Thx!
PDA

View Full Version : Can anyone send me a copy of "win95rk.hlp" ? Thx!

solomon
11-20-2000, 11:28 PM
This file is in Windows95 Resource Kit, can be found in Windows95 CD:
\admin\reskit\helpfile\win95rk.hlp

I have searched Microsoft site & other search engines, but no luck :(
The latest MSDN (2000/10/11) contains no such file?
Your help will be greatly appreciated.

solomon@yes100.com
the snake
11-22-2000, 02:43 AM
Hi Solomon
The file size of win95rk.hlp (Windows 95 Resource Kit help file) is about 2.9 MB. I've zipped it to 2.25 MB and sent it to you a few min ago.
If, from any reason you can't get it thru e-mail, write to me and i'll uploade it someware so you can download it from there..
the snake
solomon
11-22-2000, 03:46 AM
Thank you Snake.
I'm glad you'd like to help. pls check your mailbox.
Sorry for the inconvenience.
the snake
11-22-2000, 04:16 AM
Hi Solomon
Check your mail..
Let me know.
the snake
Solomon
11-22-2000, 05:29 AM
I got it.
Thanks!!!
The world can't live without such kind man like you :)


Very VERY new to the scene and would appreciate any and all pointers =)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Very VERY new to the scene and would appreciate any and all pointers =)
PDA

View Full Version : Very VERY new to the scene and would appreciate any and all pointers =)

crazed crack monkey
11-21-2000, 09:11 PM
Hello to you all =) I have been working over the last couple days doing various tasks with ./htpasswd files and the lot ... but all under GoldenEye / AccessDiver... I know some of you may shiver in fear and say ohhhhhhhh a script kiddie, run away, but it is the opposite of that... I crack to learn , hence my reason for askin the followin questions... I have read through several of the newbies tutorials for using softice/ other programs on azreals page and am completly lost ... all of the hex numbers just confuse the hell out of me and I don't know whats what... is there any list that explains what hex numbers do what, etc? also ... api calls.... breakpoints? Lol ... y'all got to take it slow on a fragile minded fellow such as myself... I really would appreciate any information on what these words mean and all since I am starting my long long LONG journery into the realms of RE .... thank you in advance and have a great night
Solomon
11-22-2000, 06:02 AM
read http://blackb.tsx.org
odin420pgp
11-22-2000, 09:22 AM
thank you for all of your help =) I appreciate it greatly


looking for orgpaks(complete,not only text)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > looking for orgpaks(complete,not only text)
PDA

View Full Version : looking for orgpaks(complete,not only text)

proxymo
11-22-2000, 06:02 AM
Hi everybody!

Can anyone help me, in finding orgpaks?
I did try the links at:
www.freenet.tlh.fl.us/~gthorne/orcpaks.htm, but they where down.

Thanks
Clandestiny
11-22-2000, 07:53 AM
Hi proxymo,

I know the +orc packs are on the RCE cd. If they are not available on the web and if you email me, maybe I could send you a copy :-)

Regards,
Clandestiny


RCE CD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RCE CD
PDA

View Full Version : RCE CD

motion
11-22-2000, 12:19 PM
I've been trying to download a copy of the RCE CD from the FTP site provided in one of +Sandman's messages on listbot.com, however, the login info doesn't work. Does anyone know where to donwload this? Thanks in advance,

motion
?ferret
11-23-2000, 09:34 AM
The ftp site is gone....too many problems with people uploading virii, etc. The only way to get a copy is to contact someone on the distribution list at:

www.idca.com/~thesandman/RCE/requests.html
stillnewbie
11-23-2000, 10:11 AM
Hi,
its
www.idca.com/~thesandman/RCE/Requests.html


newbie in town
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbie in town
PDA

View Full Version : newbie in town

dicdoctor
11-22-2000, 09:55 PM
hey guys,
yet another newbie for u. i joined up today.. and guess what i didnt understsnd slmost anything that hav been posted by others.. would like help . And i am really interested in the field. thanx in advance
the snake
11-23-2000, 12:07 AM
Hi
First, let me welcome you to this world, i *think* you're going to like it :)

You can start your way here, just for some general answers about How, why and so on..
url : http://crk4n.cjb.net

When you're ready, start read +Sandmans site tutorials, about tools tutorials, SoftIce manuals etc. url : http://www.idca.com/~thesandman/Main.html

But just a second before you start, bear in mind that you won't become a cracker in a day or a week. You need to READ and READ and READ... it pays after all...

And last but not least, we are here to help and to answer when you're stuck someware in the codes..

Good Luck
the snake
Shamunda
12-03-2000, 10:43 AM
Thanks Snake! I'm new as well and and the places you pointed out was exactly what I was looking for.


How can i catch lookups in ini files ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How can i catch lookups in ini files ???
PDA

View Full Version : How can i catch lookups in ini files ???

hugok
11-24-2000, 04:30 AM
Hi @all,

i wanted to know, how can i catch lookups in ini-files for some settings information by the programm. Is it possible to catch such lookups with soft-ice?

thanx hugok

sorry for my bad english.
Solomon
11-24-2000, 06:04 AM
In SoftICE, type "bpx GetPrivateProfileStringA" to set a breakpoint.
Then u can analyze its parameters in the stack.
There are several GetXxxx( ) and WriteXxxx( ) API functions used to deal with INI files.
Better use an API spy to do this.
hugok
11-24-2000, 06:33 AM
thanx for answer i will do this.

ciu


'bout NE File Format
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 'bout NE File Format
PDA

View Full Version : 'bout NE File Format

^[G]oLe[E]^
11-24-2000, 10:16 AM
hi, i'd like to know if someone can give me some info ábout NE file format, i'm trying to crack a Hasp Protected program, and it's in the NE Format, so, if someone can help me, it'd be great
Solomon
11-25-2000, 04:16 AM
http://www.wotsit.org

hope this helps :)


Demo Shield reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Demo Shield reversing
PDA

View Full Version : Demo Shield reversing

myAvatar
11-27-2000, 01:04 AM
hey,
I havent found any info on this yet... so I was hoping some of you might have some ideas.

I am checking out a program that uses DemoShield. From what I gather DemoShield is something similiar to SafeDisc... It wraps an actual executable program which is launched by the protection program.

So... I am wondering if anyone has had any experience with dumping this program and rebuilding the original exe?

thanks for any ideas,
myAvatar
DakienDX
11-27-2000, 10:20 AM
Hello myAvatar !

As far as I know (since I'm using it), DemoShield is no protector or copy-protection, but a programm by "InstallShield Software" which is used for creating CD-Browsers and presentations.

It has usually has a file DEMO32.EXE and in older Versions (< 6.70) a file called DS32.DLL.

Try http://www.demoshield.com for more information.

I hope I could help you.
myAvatar
11-27-2000, 11:53 AM
I knew it was something of the nature of InstallShield, but what made me liken it to SafeDisc was references to a DBD (I believe this was the extenssion, not at home to verify right now) file. One string reference said something like "Sorry, Demo Shield was not able to load your DBD file."

This DBD file seems to vary by each setup (which made me think it was like a compressed setup.exe or something), but I tried to view the resources with Resource Hacker & PE Analyser & neither recognized it as a WinEXE.

I am going to open it in hex & see what I can find....

Any additional ideas/comments/suggestions?

Thanks for the reply too!
myAvatar

PS: Here is another tool to checkout, h*tp://pexplorer.nm.ru/index.htm
DakienDX
11-28-2000, 07:34 AM
Hello myAvatar !

I don't know if I understood you correct, but DemoShield is no Copy-Protection. It is just something like "Macromedia Director" which helps you in creating CD-Browsers.
The .DBD file contains information about the demo and no serial check or something that is crackable. It gives the viewer only a nice looking presentation of the CD-context. (i.e. "Install", "Start", "Uninstall", "Readme", "Visit homepage", ...)
The buttons are linked to applications that exist on the CD.

If you want to see the "source" of a .DBD file, download a free try-it version of DemoShield from InstallShield (http://www.installshield.com/product/default.asp?prod=demoshield). (~25 MB)

You can enter any Information, but insert your real email address because you will recive a password to extract the files from the EXE. (you can also enter something like a@a.a, but you've to look for the password manually - so enter your real email address)

So you can view the demo, change it, extract images, videos, ...
myA
11-28-2000, 10:38 PM
.


Help me with IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help me with IDA
PDA

View Full Version : Help me with IDA

proxymo
11-27-2000, 07:26 AM
Can somebody please, send me the IDAPA404.r12 file, part of skh2000n.zip of IDA 4?
nobody
11-27-2000, 07:43 AM
Search the web-Don't insult our intelligence by asking for Cracks or Serials,Warez!


Message for Clandestiny
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Message for Clandestiny
PDA

View Full Version : Message for Clandestiny

proxymo
11-27-2000, 07:30 AM
[b]Thank you Clandestiny

I couldn't figure out your e-mail!
Please let me know![b]
Clandestiny
11-27-2000, 09:35 PM
Hi Proxymo,

>I couldn't figure out your e-mail!
>Please let me know!

Well, that would be because I didn't post it...Sorry about that ;)

You can reach me at: clandestiny(at)ziplip(point)com

Regards,
Clandestiny


Help cracking PaintShop Pro 7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help cracking PaintShop Pro 7
PDA

View Full Version : Help cracking PaintShop Pro 7

xOptiMus
11-27-2000, 01:23 PM
Hi all

I need a little help with cracking PaintShop Pro ver 7 (trial). I am a newbie but have cracked quite a few progs with s/n protection. PaintShop pro is very different for me as it uses a completely different protection - it's a 30 day trial, with no s/n to enter.

This is probably an easy protection to crack, but not having attempted any kind of time limit protections, it's giving me a little trouble!
I've been setting a bpx on GetSystemTime, hoping that maybe the prog checks the date just after the call. GetSystemTime appears to be called from a file called "MCF.RTL" or something similar. When I hit F12 and return to the main prog I can find no sign of any data related to today's date anywhere.

Am I going in the right direction here? will I find the protection code by using such a breakpoint or should I be breaking on something else?

Can someone (especially someone who has already cracked the prog) please point me in the right direction. I'm not looking for an answer outlining the exact place (offset) where I should patch the prog, as I want to discover that myself. However I do need some kind of guidence because I'm just thrashing around in the dark at the moment!

Any help will be greatly appreciated

Thanks in advance
xOptiMus
Clandestiny
11-27-2000, 09:53 PM
Hi xOptiMus,

I've not cracked PaintShop Pro myself, but I was wondering if you've tried an api moniter to moniter all time related calls...there are several...GetLocalTime, GetFileTime, GetSystemTime...ect...I've been learning the usefulness of an api moniter myself recently ;) and it might be worth a try since it will tell you in what order the apis are called, their addresses, and the parameters being pushed on the stack.

Good Luck,
Clandestiny
Mr Smith
11-28-2000, 08:27 AM
Do you get a MessageBox saying that the demo
period has expired ? If yes, set a bpx MessageBoxA and with some luck you land right where the routine is called. Now look a bit upstream in the code if there is some conditional jump instruction which might jump over MessageBox call. (Of course there are several possibilities why this might not work :-()

Good luck
C_DKnight
11-28-2000, 05:23 PM
i'd suggest http://www.cracking4newbies.org as i figure BlackB has written a tutorial on PSP 6.0x ... maybe it gives you some help.. it covers both taking out the nag and removing 30 day trial

-C_DKnight
hobgoblin
11-28-2000, 11:40 PM
See my message in the other forum (previously +fravia's).
Regards,
hobgoblin
11-29-2000, 10:04 AM
Forget my previous post. I remembered it wrong somehow. It’s been a few weeks since I cracked it.
I just cracked it once more today, and here is a couple of hints for you.
Enter Paintshop in the Sice loader. When you’re at the beginning of the code, you may try a bpx postquitmessage. ( To get the full potential of this approach, your copy of Paintshop must be expired). When Sice breaks, just hit F12 until you reach psp.exe code for the second time. You should by then be right after a call to Updatewindow. You are now in the middle of a call that runs/builds/loads the nag screen. If you just get out of the call, and then re-enter the call, I’m sure you will see a way to get rid of the nag screen. Now, if you do this correctly, you will also get rid of the time limitation at the same time.
If you only want to get rid of the time limitation, but keep the nag, just run the program until the expired nag shows. Enter a bpx destroywindow in Sice and then hit the quit button. When Sice breaks, get rid of the breakpoint, and start tracing backwards. Quite soon you will get to a point in the code where you will see some jle-instructions. This is where you can manipulate the program to never expire.
Hope this helps…
Regards,
Hobgoblin


Cracking of Dyno Datamite
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cracking of Dyno Datamite
PDA

View Full Version : Cracking of Dyno Datamite

JohnnyBoy
11-28-2000, 10:47 AM
With alot of help I think that the algorithm for the serial is inside a DLL (KeyLib16.dll)
The functions inside KeyLib is
pp_copyadd(p1 as any, ByVal p2, ByVal p3)
pp_setvarchar(p1 as any,ByVal p2,ByVal p3)
pp_tcode(ByVal p1,Byval P2,ByVal P3,ByValP4)

I tried to set a BPX on the pp_xxx function, but SI did not take it. It says "Symbol not defined (PP_XXX)

OK I think. I press alot of F8 to get to the KeyLib16 and then the function must be available. After alot of F8 I did not receive KeyLib16. I got User,Kernel,VBrun300 but not KeyLIB16. why?
How do I set a BP on the pp_xx function?

Is KeyLib16 a protoction DLL to add on for VBprograms?
Coa_chez
11-28-2000, 01:07 PM
Add the keylib16.dll (the complete path to the file) in your winice.dat file (imports paragraph) and after rebooting you should be able to break on it's functions

Hope you can get it to work
JohnnyBoy
12-03-2000, 08:40 AM
Coa_chez (11-28-2000 03:07):
Add the keylib16.dll (the complete path to the file) in your winice.dat file (imports paragraph) and after rebooting you should be able to break on it's functions

Hope you can get it to work

Added c:\windows\system\keylib16.dll but I cant get inside that DLL.
Is this a general advice or have you tested it?
The software can be found at
http://www.performancetrends.com/DyDM-w95.exe


SoftICE and IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftICE and IDA
PDA

View Full Version : SoftICE and IDA

pilz
11-28-2000, 05:22 PM
Has anyone else had trouble loading .nms files from IDA in SoftICE? I created a file from a dissassembled app in IDA then converted it to a .nms file as the instructions directed. When I try to load the file using the SoftICE Loader, I get a message - Error: Out of symbol memory. The .nms file is over 5meg, but I would still think that the software could handle this. If anyone can suggest a solution I would be grateful.

pilz
Nolan Blender
11-28-2000, 06:10 PM
Increase the size of the symbol buffer size
in the softice initialization settings in the
symbol loader - I cranked mine up to 10240
but you may need more, depending on what
you're working on.
The Owl
11-29-2000, 04:19 AM
filtering out some stuff from the .map file before conversion might help reduce the final .nms size as well ;-). after all, the IDA autogenerated names don't tell you much, do they?
pilz
11-30-2000, 04:11 PM
The Owl (11-28-2000 18:19):
[snipped] ... after all, the IDA autogenerated names don't tell you much, do they?

I guess I don't know - I'm still trying to figure this tool out. I tried to open the .nms file in a couple of editors (UltraEdit, Hiew, wordpad) and it doesn't look very intuitive. Is there another utility that is used to edit the entries?
pilz
11-30-2000, 06:42 PM
uh, forget that last message. I think I figured it out. I even found a nice perl scriipt on Greythorne's site that will aid in removing the 'noise'. Thanks for the help,

pilz
pilz
12-01-2000, 04:49 PM
Although I was able to load the symbols from IDA in SoftICE, I don't seem to have access to the information. Perhaps I have missed something, but I can find the _WinMain@16 procedure in the IDA listing, and resulting .map file. When I load the derived .nms file and then the application and load/translate symbols, it complains about no debug info, which I would expect. Unfortunately, it doesn't seem to get the labels associated with the procedures while debugging. In other words, I can't find any procedures with WinMain in the titles in SoftICE. I can find the procedure instructions at the appropriate memory location, but there is no refernece to the proc name, or the AfxWinMain... proc that it calls. Is this expected behavior? or should I assume that this process will align proc names from IDA with the proc's in S'ICE? If not, is there a way to annotate labels like proc names and parameter names, etc in S'ICE?

pilz


How to let W32DASM show ref. string for VB program?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to let W32DASM show ref. string for VB program?
PDA

View Full Version : How to let W32DASM show ref. string for VB program?

evc_viper
11-29-2000, 01:32 AM
Greeting, reverser:

I remember that there is way to do it, but I totally forgot how. Could any kind soul give me some suggestion? Thanks.
vgb
11-29-2000, 10:54 AM
Look for w893sdr.zip or wd893sdr.exe. Should find it on some of the tool sites. Sorry, don't have the URL handy.

vgb
4oh4
11-29-2000, 06:40 PM
The patch info is as follows if you'd like to make the 2 byte changes yourself:

offset original byte patched byte
00016B6C 98 28
00016B6D F4 F6

--4oh4

(damned tabs turned into spaces somehow)
?ferret
11-29-2000, 10:15 PM
Make a copy of W32Dasm and patch it for sole use w/ VB proggies.

The patch seems to make W32Dasm react a bit strangely w/ some "normal" programs for some reason.
Hodensack
11-30-2000, 10:33 AM
That's not true fret... it works flawlessly even yith the patch
evc_viper
11-30-2000, 06:52 PM
Thanx, buddies. I found it and successfully patched it. working like a charm. Thanx for the help again.
4oh4
12-01-2000, 10:11 AM
I forget who, but someone published a tut on a asm loader so you could of course choose the in-memory patch only when working with vb apps. I personally have not had problems with non-vb apps using a patched w32dasm but have heard others complain. This is an easy work around for that issue.

--4oh4


how to tell which packer used on *.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to tell which packer used on *.exe
PDA

View Full Version : how to tell which packer used on *.exe

()whore
11-29-2000, 02:39 PM
Well the title says it all. I have stumbled onto a target MP3 Navigator that is proving difficult. It is obviously packed but I haven't been able to figure out what program it is packed with. GetType didn't recognize it.
If anyone wants to look at MP3 Navigator it seams quite well protected. Not only is it packed but it shuts down reg mon and file mon when it is run. And it does some kind of CRC checking. When I tried to change things in the PEheader it gave me "this program has been tampered with" message.
I think if I could get it unpacked I could gut this bastard but need some help getting that done.
thanks
meRlin
11-29-2000, 03:11 PM
Hi,
Well the first and the most easy way you can find out wich packer that have been used, open target file in your hexeditor and take a look at the header or use quickview or ..... the list is long.
As those packers delete some section names you can only tell wich one thats been used at a specific target if you unpack them as they appear or as you did, ask someone who should know.
If this link is leading to your target (updated today) http://www.vertexlab.com I should guess it's packed with some ASPack/ASProtect.

sorry for my bad english

regards
meRlin
hz
11-29-2000, 04:35 PM
hi,
language2000 at protools is a good util, recognises most (not all), upto the new asprotect. If it is asprotect get Casper while your there.

Hi MeRlin, how's it going.


working on a packed file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > working on a packed file
PDA

View Full Version : working on a packed file

NikDH
11-30-2000, 12:49 PM
hi to all :)
I'm working on a file procetced by asprotect
When I disasm it with ida it shows me only a little piece of the the decryption routine
Some of that is encrypted by xoring it with a number :)
I'd like to know if it's possibile to write an idc file that acts on the idb file for xoring that bytes so i can look at them :)
I know its possible to dump them from mem when they r decrypted but doing so they r not in the idb file
I hope u can help me :)
Tnx
See ya
tsehp
12-03-2000, 11:01 AM
hi,
bad and long way to succeed.
You have to dump your target and before that locate the prog's original entry point.
The main problem with asprotect is that this protection scheme modifies a lot the target's IAT, you have to find a way to fix.
This was already done by several crackers, do a local search here on asprotect and you will find the essays.
I will release in the future my tool to unprotect this very easily, but you have to master the pe-file structure and unpacking skills before using it.
regards,

tsehp
NikDH
12-03-2000, 05:37 PM
Well at the moment
I only want to study the prog dumping it and disasming it and even if the iat is destroyed i've no problem for studying the file


please answer my question below (offsets)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > please answer my question below (offsets)
PDA

View Full Version : please answer my question below (offsets)

pepperman!
12-01-2000, 03:47 PM
some1 must know..or is this a silly question??? the question was...are offsets in exdec the same as softice/w32dasm ??
evc_viper
12-02-2000, 04:01 AM
I'll say that when you say offset, it is really an offset with respect to some starting position. If code base is 40000000, and code offset is 1234, then, it should mean 40001234. In W32DASM, you can use offset it shows to look for place to patch the exe file. Hope this help.
?ferret
12-02-2000, 08:13 PM
They are relevant in both, but if it's a pcoded VB app (y else would u use ExDec hehe) W32Dasm is pretty much worthless.....if you try to break on the addy in Sice & it doesn't seem to want to break, try a BPM instead of BPX


Completely off topic...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Completely off topic...
PDA

View Full Version : Completely off topic...

hobgoblin
12-03-2000, 12:07 PM
Greetings on the board,
I have a question to someone who knows the Windows ME system quite good.
I'm trying to locate where the ME keeps the startup logo. In win 98, you could find the startup logo in a file named logos.sys (or logow.sys) - can't remember exactly which one. But a search in ME does not reveal the logo I'm looking for. And I can't open the file io.sys in Paint either (if I remember correctly, io.sys contains a backup of the startup logo).
If anyone could please explain where I can find the file containing the logo, I would be grateful. Or if anyone could point me in the right direction and give me some hints on where on the net I can get some constructive information.
TIA,
Regards from hobgoblin
?ferret
12-03-2000, 10:21 PM
not sure on ME, but for 95/98 logos.sys is the "You may now shut off..." screen. logosw.sys is the "Please wait ...." screen, and I don't know where it "originally" gets the startup screen from, but here's how to change it.

make a bitmap image 320 x 400 (it will take a little guesswork to get the proportions right, since it gets stretched across the width of the screen). There may be a color limitation too, but I can't remember (256 maybe?). Anyway, rename the file to logo.sys and place it in your root (C:) directory. Windows will then use it as the startup screen.

Like I said, that's 95/98....try it w/ ME & see if it works (logo.sys doesn't exist on 95/98 either, unless you put one in to change the screen)

Hope it works 4 ya ;-)
stillnewbie
12-04-2000, 05:01 AM
Hi Hobgoblin,
you can use hexeditor to open winme like win.com that executes winme
search for *.sys ot bmps.maybe you can find it.juz a thought.
Hopes this helps
best regards
stillnewbie

hobgoblin (12-03-2000 02:07):
Greetings on the board,
I have a question to someone who knows the Windows ME system quite good.
I'm trying to locate where the ME keeps the startup logo. In win 98, you could find the startup logo in a file named logos.sys (or logow.sys) - can't remember exactly which one. But a search in ME does not reveal the logo I'm looking for. And I can't open the file io.sys in Paint either (if I remember correctly, io.sys contains a backup of the startup logo).
If anyone could please explain where I can find the file containing the logo, I would be grateful. Or if anyone could point me in the right direction and give me some hints on where on the net I can get some constructive information.
TIA,
Regards from hobgoblin


www.litespeed.org (formally website from CrackZ )
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > www.litespeed.org (formally website from CrackZ )
PDA

View Full Version : www.litespeed.org (formally website from CrackZ )

ton
12-03-2000, 04:34 PM
Who knows the new URL from this crack guru ?
Please mail me.
a Nobody
12-03-2000, 04:47 PM
Here's his new domain

zencrack2(dot)cjb(dot)net

I don't know what happened to his "litespeed.org"
?ferret
12-03-2000, 10:25 PM
He keeps running into traffic problems & getting spanked (at least that was the previous problems, I'm guessing it's the situation again)....litespeed is just supposed to be a mirror in case the main site zencrack2.cjb.net goes down for awhile.


Cracking a DLL Driver
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cracking a DLL Driver
PDA

View Full Version : Cracking a DLL Driver

Dark7622
12-05-2000, 12:52 PM
Ok heres my problem, I got a driver its a ODBC driver and it has the securtiy built into it and not a external program. So my problem is to deassemble the driver DLL and have it jump code so that it doesn't go thought the windows verison check or the serial check and just does its thing and gets the info from the unix database box, into windows. Now I have looked at the code and I think I got it figured out but How to I assemble the darn thing back to a dll???? Everything I have found is to assemble it to a EXE or COM. I just can't find anything to make it a DLL again. I'm using IDA 4.04. Please if anyone has any idea's on how I can get the ASM file back into a DLL file I would be so happy.
THanks
Dark
DinDon
12-06-2000, 03:54 AM
If you are using MASM32 (or Microsoft assembler) look at the BLDDLL.BAT file which comes with the examples of the distro.

You must first create an OBJ file with the command "ml /c /coff xxx.asm", and then link it with the command
"link /SUBSYSTEM:WINDOWS /DLL /DEF:xxx.def xxx.obj"
The .DEF file is required to add to the header of the target all the exported entries. It will have "EXPORTS" in its first row, followed by a list of all the exported functions.
You must also add a .RES file containing the possible resources used by your target (dialogs, strings, icons), if required.

But be aware: the process of reassembly some disassembled target is never automatic and it can be accomplished with a lot of reverse engineering.
Better to make a patch inside the executable file: that is the common way of operating...
Dark7622
12-06-2000, 09:15 AM
My problem is the security isn't in the EXE its in the darn DLL I guess they made it like that so it can be used to check if you have valid access to use the driver from any program that uses the ODBC connection. Would it be helpful to just attach the dll to a another reply?
It sounds like a lot of stuff to do just to just have it not do any checking. Now I have hex work shop and I have been able to change the reg info to where to look but It isn't working because it uses that darn kernel32.dll to get the windows version, thats where it all goes down hill I believe I could do it if I could change it to just avoid looking for the windows version. I haven't seen any programing logic, by just looking at the hex output. How would you go about patching this kind of problem?
Any help would be so thankful and thanks for responding so far.
Dark
goatass
12-06-2000, 12:45 PM
How about you open that file in W32dasm or IDA and see if you can find any of the checks. Does the DLL gives a messagebox saying "you are not licensed" or something like that when you are trying to access the DB using it ? if so try to find those strings and go from there.
Maybe use SoftIce to trace it during it's work. Try to access something using the DLL and BPX on CreateFilea (assuming it's using a license file) or something along these lines.
Check with RegMon to see if it's looking for something in the registry to tell it if it's registered or not.

hope that helped a bit.

Goatass
Dark7622
12-06-2000, 01:23 PM
It uses the registry and it calls out to another DLL to decode a Serial that it got from the registry and I can View it all just fine in IDA but I need to Patch it, And I am not as aware as some as to how to go about patching a DLL. I have gotten some great advice on assembling a DLL from a ASM file but where do I get this RES file and def file. And is there some nice program that will just re assemble the ASM without so much trouble? Now I just got Softice but when I go to use it I have to use some other program to access the driver and all it shows up in the log is what Dlls it accessed but nothing on the instructions of that dll. So I'm stuck Also I do not know SOftice well enough to hit the road running. It's amazing how much they want you to pay for it too LOL.
Now I have the serial but its the darn windows version thats the problem it doesn't reconize W2k so thats where it gives me the error but it works with w2k if I don't give it any serial it starts in the 30 day trial mode and it works fine. Now it gets its version info from another dll called kernel32.dll which is a windows DLL file. Now I have found how to jump but its just a pain in the butt to get back into a DLL file from a ASM.
ANy help is greatly welcomed
Dark
goatass
12-06-2000, 02:31 PM
Hi, you mentioned that you don't have the knowledge to use SottIce well then I think you took on something bigger than you can handle. What people said about re-assembling the DLL is great and all but useless. When you open the DLL in IDA find where you think the checks are being done then open the file in a hex editor look up the offset and set a int3 (cc) breakpoint in the file. Or just find APIs close to where you want to break and set a BPX on them. For example to check for version it might be using GetVersion API so set a BPX GetVersion in softice and it should bring you to where you want (hopefully).
I suggest you read some tuts on how to use SoftIce and other tools.

goatass
DinDon
12-07-2000, 03:11 AM
I am not as aware as some as to how to go about patching a DLL.

Patching a DLL is a very different task from reassembling it! It means to locate the code you want to alter, and overwrite it with new code bytes. To do it you need:
- some assembly knowledge
- some assembler tools, which will convert your new assembly code into hexadecimal code bytes. SoftIce will do it well enough. Other tools at e.g. protools.cjb.net

I have gotten some great advice on assembling a DLL from a ASM file but where do I get this RES file and def file.

RES file: you can create it starting from your DLL and using Microsoft or Borland compilers and related tool
DEF file: since it is a simple text file, you can build it by hand

And is there some nice program that will just re assemble the ASM without so much trouble?

As I tried to tell you before, the reassembling of a DLL/EXE file is not a trivial task, and it cannot be done in an automated manner. I am suggesting you again to try another approach: patching it.

Before patching it you can set breakpoints and change the code on the fly using some debugger (e.g. SoftIce). The important thing is to get a quite good knowledge of the debugger you will use!

Now I just got Softice but when I go to use it I have to use some other program to access the driver and all it shows up in the log is what Dlls it accessed but nothing on the instructions of that dll. So I'm stuck

Dark, you must use the right breakpoints...
And I cannot tell you what without looking at the DLL (and unfortunately I have no time to look at it...)

Also I do not know SOftice well enough to hit the road running.

A lot of time and a lot of patience will be required if you want to make some progress on your target.

It's amazing how much they want you to pay for it too LOL.

Then use some freeware debugger! The Microsoft one (one of the best IMHO) is free! Grab it at http://www.microsoft.com/ddk/debugging/
But then the problem is again the same: you must learn it very well!

Now it gets its version info from another dll called kernel32.dll which is a windows DLL file.

The Windows version is probably used to generate the true serial, which then will be compared with the serial you have entered...

Hope it may help you.


RCE Archive CD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RCE Archive CD
PDA

View Full Version : RCE Archive CD

pm
12-06-2000, 05:28 AM
Finally I have my copy of the CD (thanks again ?ferret) and I can burn a few CDs if someone is interested. Just mail me.

pm
pm
12-06-2000, 05:32 AM
hehe, forgot the mail:

pjgdm(at)another(dot)com
+Sandman
12-10-2000, 09:23 AM
Thanks for offering to burn a few copies of the RCE CD.. Just one thing tho, what country are you in?. This will then help those who are -near- to you when they request a cd from you. No point in sending CD's to the other side of the planet when someone else is much closer.

Regards
+Sandman
pepperman
12-10-2000, 09:35 AM
+Sandman (12-09-2000 23:23):
Thanks for offering to burn a few copies of the RCE CD.. Just one thing tho, what country are you in?. This will then help those who are -near- to you when they request a cd from you. No point in sending CD's to the other side of the planet when someone else is much closer.

Regards
+Sandman
i would be intersted in a cd please, im in the uk? if your not in uk, never mind...thxz anyway
?ferret
12-10-2000, 09:35 AM
Hola +Sandman,

pm is in Portugal.
(not sure how often he checks the board, so I'll just answer) hehe
pm
12-10-2000, 04:11 PM
Thanks for answering ?ferret :)
Yes, that's right, I'm in Portugal, but if you still want it pepperman just mail me.

pm
pepperman
12-11-2000, 07:49 AM
pm (12-10-2000 06:11):
Thanks for answering ?ferret :)
Yes, that's right, I'm in Portugal, but if you still want it pepperman just mail me.

pm

thxz but i think 40H4 is going to send me a copy...its nice to have such helpfull people here..
L8rz (luigi)


C
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > C
PDA

View Full Version : C

NoRToN
12-06-2000, 08:38 AM
How do I clear the screen in C?

In Borland it is clrscr() or something.
But i have Micro$oft's C compliator, how
do I clear the screen with that?
MagTians
12-06-2000, 08:58 AM
Clearing the screen is not a matter of language but a matter of operating system and library :
But maybe you don't want to think about that and can have a look at http://support.microsoft.com/support/kb/articles/Q99/2/61.ASP


Help with Backtrace in Soft Ice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with Backtrace in Soft Ice
PDA

View Full Version : Help with Backtrace in Soft Ice

xOptiMus
12-06-2000, 12:41 PM
hello all,
Can anyone help me using "Backtrace" in Soft Ice? I have 2 questions:

1) Am I right in thinking that bactrace is used to record all the instructions that you step through, so that you can reviw them again later?

2) How do I use or turn backtrace on? I have increased the backtrace buffer size to 128 in winice.dat, but still don't seem able to use it. If I type: TRACE and enter in the command window, I get the message "Trace simulation is off". I have also tried typing the example from "help trace": TRACE 50, but I get the message: "Backtrace buffer is empty".
I just can't seem to get anywhere with it!

Any help greatly appreciated

xOptiMus
Kayaker
12-06-2000, 03:53 PM
Hi xOptimus,

For a rundown on the command, check out
http://www.idca.com/~thesandman/si-ug-chapter09.txt

What I try to do is minimize the amount of code which will be traced, i.e. if you wanted to check how a MessageBox is called, trace as far along as you can manually, disable all BP's, then set a BPX MessageBoxA. Then you set the trace. I generally use 'BPRW taskname T', where taskname is the name of the Windows module. This will cover the whole of the module address range (usually 400000 onwards). Hit F5 and SI should break at MessageBox and the trace buffer will be filled with all the program code addresses encountered.

Then you can use the SHOW and TRACE commands. If your trace never gets to the MessageBoxA call, increase the buffer size, because the buffer is filled from the 1st instruction onwards and stops when filled, so it may have fell short. (Been a while since I've used it, but I think I got the command right)

Hope this helps,

Kayaker


VB source patch
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB source patch
PDA

View Full Version : VB source patch

current
12-06-2000, 05:01 PM
I need some help. Does anyone have a VB source on how to code a patch (or any tut)? I mean, just like the ones we see in a lot of tuts in ASM, C and pascal (a small program that checks the offsets and change the bytes of the target). I know VB is a lame language but even so I would appreciate any help.

Thanks

current
4oh4
12-08-2000, 08:01 AM
I wouldn't exactly say that vb is lame, but it definitely limits you as a programmer. That said, the relevant patch functions are as follows (digging deep in my poor memory):

1) open the file in question with (gasp) "open filename as filenumber"
*note: of course you'll want to verify the file version/size and all of that jazz

2) use "get filenum, offset" (correct me if I'm wrong cause it's been a long time) to check a single byte
*note: vb always seemed to be a lot different to me, like if I'm not mistaken the offset starts with 0 instead of 1 so you'll have to subtract one from all your patch offsets to change the intended bytes. Also, I think that all the offsets/bytes need to be in dec format. Again, I could be wrong.

3) use the "put filenum, offset, byte" (again, I might be wrong) to actually change the byte.
*note: read the note from #2

4) finally close the file with "close filenum", where filenum is the file number that you opened it with.

That's really about it I think. Of course that's vb6 functions, vb5 had "seek" instead of "get" I think.

Anyways, hope this helped.

--4oh4
current
12-08-2000, 01:41 PM
Hello 4oh4,

I whish I had your memory :)
The tips you gave me were very helpful and it was enough to get what I needed. Thanks for the help.
BTW the offsets in vb start with 1 so its need to add 1 (not subtract)

current
4oh4
12-09-2000, 08:49 PM
Glad that info helped!

Sorry about my mistake though. Alcohol consumption has a direct affect on mathematical coherency I think.

--4oh4
?ferret
12-10-2000, 09:45 AM
Amount of Sleep*Amount of Alcohol
______________________________
Number of Living Brain Cells Left

=Amount of Mathematical Coherency?

(My equation could be a bit off.....same problem) LOL
4oh4
12-10-2000, 11:34 AM
That sounds about right. 8n)

Something's always puzzled me though...
If most forms of alcohol are about 90% water, then how come it dehydrates you so badly?
I even tried mixing vodka and gatorade, thinking that they would balance each other out and rehydrate me at the same rate at which I was dehydrating. To me, that sounds like reasonable logic. Needless to say it didn't work out as I had intended though.


How do you disable softice ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How do you disable softice ?
PDA

View Full Version : How do you disable softice ?

Expired
12-06-2000, 10:19 PM
Hi
i am very new to softice and want to knwo how i didasble it on startup as some of the programs i have make softice popup on generlf fault protection which is getting a little annoying as my pc crashes after this so if anyone could help i would like hear from you asp please .
thanks for you help great site
JimmyClif
12-07-2000, 12:41 AM
Hi Expired,

Did you rtfm, yet? Anyway, typing 'faults off' will help you with the GPF.
Check out the SoftIce Newbie Guide from +Sandman's page..

Here's the link: http://www.idca.com/~thesandman/SoftPage.html

Soon it's weekend :)
JimmyClif
Expired
12-07-2000, 06:01 AM
Thanks jimmy for your much needed help and your quick reply i think i will be back quite soon to this forum to pick every brain cell you have left working till i get the hang of this

thanxs again


Is there a patcher to hide softice 4.05 ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is there a patcher to hide softice 4.05 ?
PDA

View Full Version : Is there a patcher to hide softice 4.05 ?

Expired
12-06-2000, 10:22 PM
I have come across my first program that detects softice and want to know if there is a patch to hide softice 4.05 from this program and others ?
JimmyClif
12-07-2000, 02:00 AM
Hi again Expired,

Yes there is ;) ... Check out protools.cjb.net and have a look under the Debugger Section and you'll discover the SoftIce Addon Rescource Center...

ForgsIce is the best hider tho...

"Making Sharewares work" erxcept from FrogsIce :D
JimmyClif
Expired
12-07-2000, 05:38 AM
Thanks for answering so quickly but i have tried to download the newer version from there and and it is gone just get some russian startup page i have the old version but either it doesn't work with 4.05 of softice or its just for version 4.0 as my version of frogice says frogice vxd error (code 2) any other help would be great
Expired
12-07-2000, 06:46 AM
Thanks worked it out doesn't look for the vxd driver in its folder
you have to put in in with the ftploader.exe


Hello!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hello!
PDA

View Full Version : Hello!

toye
12-07-2000, 08:51 AM
;-)
ThRaX
12-07-2000, 09:15 PM
;)
mcny@work
12-08-2000, 12:38 PM
;)
McNy@Work
12-08-2000, 01:38 PM
}>


Is there a way to break on a Register access?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is there a way to break on a Register access?
PDA

View Full Version : Is there a way to break on a Register access?

Kayaker
12-08-2000, 04:59 PM
Hi All,

I'm trying to get SoftIce to break when EBX is changed, not the address pointed to by it but the register itself. I've been R-ing TFM, but can't find a syntax that might be able to do this. I suspect it can't be done but thought I'd ask ;) I could probably set up a TRACE and check for a MOV/LEA/ADD/SUB EBX, statement but thought there *might* be another way.

TIA, Kayaker
hz
12-09-2000, 02:46 AM
Hi,
It would be nice if there's a simple way to
do what you ask. The only way I've got near it is:
bpr xxx yyy RW if ebx!=specific value do "
u eip" where x and y cover the whole
code range, sometimes it can get you round about where you are looking for.
regards
hz


Need help with Delphi target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help with Delphi target
PDA

View Full Version : Need help with Delphi target

InOverMyHead
12-09-2000, 04:07 AM
I am working on a teachers grade book that is a Delphi program and gives you 30 days or uses. It requires a user name and an activation code. After the time limits the nag screens are still there and all save and print functions are disabled. It is available here:
http://www.jacksoncorp.com/demoformcgi/Download.html version 5 for Windows

I used hmemcpy to break on the activation code pressed F12 7 times, then F10 26 times to end up here:

004C955F mov edx, [ebp+var_308] ; d edx=fake activation code
004C9565 lea eax, [ebp+var_100]
004C956B mov ecx, 0FFh
004C9570 call @System@@LStrToString$qqrv ; System __linkproc__ LStrToString(void)
004C9575 mov [ebp+var_200], 0
004C957C cmp [ebp+var_100], 0
004C9583 jz short loc_4C95A1
004C9585 lea eax, [ebp+var_200]
004C958B push eax
004C958C mov ecx, 1
004C9591 mov edx, 1
004C9596 lea eax, [ebp+var_100]; d eax=space + fake activation code
004C959C call @System@@Copy$qqrv ; System __linkproc__ Copy(void)
004C95A1
004C95A1 loc_4C95A1: ; CODE XREF: sub_4C9320+263 j
004C95A1 mov eax, ds:off_5B26E0
004C95A6 mov eax, [eax]
004C95A8 cmp dword ptr [eax+150h], 1
004C95AF jz short loc_4C95C2
004C95B1 mov eax, ds:off_5B26E0
004C95B6 mov eax, [eax]
004C95B8 call @System@TObject@Free$qqrv ; System::TObject::Free(void)
004C95BD jmp loc_4C97F1
004C95C2 ; ---------------------------------------------------------------------------
004C95C2
004C95C2 loc_4C95C2: ; CODE XREF: sub_4C9320+28F j
004C95C2 lea eax, [ebp+var_100]
004C95C8 mov edx, offset aExtension ; "EXTENSION"; d edx=space + EXTENSION
004C95CD xor ecx, ecx
004C95CF mov cl, [eax]
004C95D1 inc ecx

004C95D2 call @System@@AStrCmp$qqrv ; System __linkproc__ AStrCmp(void); I stepped into this call and saw my fake and the above EXTENSION being compared beginning at 00403db6 the 1st 3 characters in reverse – if you change the Z flags that follow you will see the rest of the comparison being made. Using EXTENSION as an activation code will give you an additional 30 days or uses. I stepped into other calls, but I could not see any cmps being made such as in this area that yielded what I thought was useable info.

004C95D2 call @System@@AStrCmp$qqrv ; System __linkproc__ AStrCmp(void)

004C95D7 jnz short loc_4C95F5; if you change this Z flag - at 004c95df it tells you t hat you are registered, but you are not

004C95D9 lea eax, [ebp+var_100]
004C95DF call sub_4C8F54; Congratulations message

Could someone please point me in the right direction.

Thanks
NicoDE
12-11-2000, 09:00 PM
there is no needing to target the buttons, some hints,,,

(1) TDemoMsg2_Form.FormCreate @0x004C8A5C
(2) TSoldRegForm.FormCreate @0x004C8DD0
(3) Think about the invalid DosDateTime of the file "q.gq"

the rest is your's...

Nico_
Timmy
12-11-2000, 09:38 PM
Interesting one this. I have had a quick look and the registration code entered looks like it is made up of two parts. The first three characters are seperated and the rest are digits. The digits are converted into hexadecimal and are compared with a hexadecimal number generated from your registered name (and I think the first three characters have something to do with it on restarting the prog). The hex of the last digits is generated at CS:0041EDFC and the compare hex number is generated at CS:004C9307. Both numbers are returned in EAX. If you enter a dummy code (1st char must be a letter - possibly 1st 3, havent checked yet) and then break at the second address above, take a note of the value in EAX. Convert this to decimal and then restart the prog. Now enter the code as before but with digits 4 onwards as the decimal digits you have just converted. The prog is then registered - only until you restart, then it falls down here. I used "Timmy" and "Tim30094"

I have had an hour on it now but its 3:25 am in the UK and I need some sleep. If I get time tommorrow I will find out why it won't stay registered.
InOverMyHead
12-12-2000, 07:17 PM
Thanks NicoDE and Timmy - I now have two very different avenues to explore regarding the protection used in this target.
Timmy
12-12-2000, 09:27 PM
This one is doing my head in !
When you first register it with a dummy serial it checks to see if the first character is in [A..Z] - fair enough. The next thing is that the first three characters of the serial are combined with the username to produce what the digits after the first three characters should be - BPX CS:4C9307, F10 this call and the hex of the digits is returned in EAX. This then registers the prog until it is restarted.
There are three interesting BPX's that you should use when the prog fires up, these are :
CS:510BE8 - checks if the first char is in [B,C,F,G,J,K,N,O]
CS:510C53 - checks if the second char is in [B,C,D]
CS:510CB1 - checks if the third char is [B]

Now you can register the program using a first char of [B,C,F,G,J,K,N,O] and ANYTHING ELSE - you just need to BPX on CS:4C9307 to get the last digits. I have tried many combinations of registration codes and they all work perfectly regardless of what date I set my system clock to. At the moment I am playing it safe with a code of "JCB******" but my question is - what are the checks on the second and third character for if they do not hinder the prog in any (apparent) way. Or am I just being a bit picky ?


UserList Component.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > UserList Component.
PDA

View Full Version : UserList Component.

Bratsch
12-09-2000, 11:40 AM
Hello:

I need some guidance in a reversing project.
The Demo of the software in question is crippled. The disabled functions are "grayed out". There are no nag screens or any way to make Sice break when the item is clicked. I thought "easy", and tryed to use the BPX ActivateMenuItem., I learned, the hard way, that the grayed out functions are not in a menu component. Rather, they are presented in a UserList component. Does anybody know some API function used to manipulate UserList? When I asked this question in C4n in the IRC, somebody asked what a UserList was. It is a component of Windows in which options are presented as lines. when you click a line it gets highlighted. If you double click it, someting happends. The Channel list of mIRC is a good example of a UserList.
Any knowledge out there?
If I can catch the program constructing the userList, I hopefully can find the function that decides if a list item should be grayed out or not and take it from there.
Thankyou

Bratsch
Kayaker
12-09-2000, 03:49 PM
Hi,

Sounds like a List Box. Check out the Win32 Programmer's Reference under List Box functions.

DlgDirList
DlgDirSelectEx
LB_ADDSTRING message, etc.
Bratsch
12-10-2000, 01:19 AM
Thanks, It Helped a lot. I got the name UserList from the class name I was seing in Sice when I used Hwnd to see the components of the aplication. The menu I am trying to crack IS a list box.


SOFTICE is writing to my disk!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SOFTICE is writing to my disk!!!!
PDA

View Full Version : SOFTICE is writing to my disk!!!!

Bratsch
12-10-2000, 01:33 AM
Hello again.

I have been seing something in SoftIce that is driving me wild. I have RTFM and found no particular reference to the Issue. Here it goes:

sometimes I patch the code in memory, using the A(ssemble) command of Sice, to see if it would work there before I modify the file with HIEW. ie I change a JZ to a JMP and so on in memory. Now when I go to change the file with HIEW, THE DAMN THING IS ALREADY CHANGED. Is softice writing the changes I perform in memory to the file? I even saw the op code for INT 3, CC, in the places I had placed a BPX!. WTF is going on? Is softIce suppossed to do this? I have never seen that documented in any tutorial. Or may be the program I am working on copies itself from the memory to the disk when it closes?

I recently installed Sice 4.05, so I do not know if this is a relatively new feature or It is me going crazy.
Kayaker
12-10-2000, 03:59 AM
Hi again Bratsch,

This is something that came to light some months back with MS Visual C++ v5.0 and v6.0. It happens fairly frequently it seems, but not with all programs, and you're not going crazy ;)

You must disable all BP's before exiting the program or CC's may be written as you noticed, and changes you make with 'a' will be hardwritten to the file. (I did mention it in my TracePlus tut actually). There were a few explanations put forth on the Board at one time, some weird paging fault error sounded plausible.

Just make sure you've got a backup of the original file. BTW, what program were you working on with the disabled ListBox items? Sounds interesting...

Regards,

Kayaker
Bratsch
12-10-2000, 11:05 AM
Hi Kayaker, Thanks for being helpful, and afable. I am not sure if I should tell you the program I am working on In this public forum. It is not an internet available shareware, but rather a specialized software present in a CD, with a sort of reduced marker, so if that info gets in the wrong hands, The software company might trace it to me. Am I being overcautious? perhaps.
However It does not mean I do not want to discuss about it with you. E-mail me to My avatar at picapiedra01@yahoo.com if you want and I can talk to you in a more private environment.


question to sandman (or any1 in uk with RCE-CD)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > question to sandman (or any1 in uk with RCE-CD)?
PDA

View Full Version : question to sandman (or any1 in uk with RCE-CD)?

pepperman
12-10-2000, 09:42 AM
i would be very interested in getting a copy of the RCE CD, im in the uk. Please contact me at the above address. Thxz
the snake
12-11-2000, 12:58 PM
Hi pepperman

You can e-mail me the address you want to get this CD to, and i'll send you a copy.
I'm from Israel, but this is not a problem...

the snake
pepperman
12-11-2000, 01:28 PM
thxz
+Sandman
12-11-2000, 02:40 PM
As it happens, The Artful Dodger is from the UK and is willing to help burn a few copies of the RCE CD for anyone in the UK.

Visit: http://www.idca.com/~thesandman/RCE/Requests.html

Regards
+Sandman
pepperman
12-12-2000, 12:17 PM
thxz i will keep it in mind


sorry for these dumn ass questions but i just dont know??? pls help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sorry for these dumn ass questions but i just dont know??? pls help
PDA

View Full Version : sorry for these dumn ass questions but i just dont know??? pls help

pepperman
12-10-2000, 03:02 PM
how do i bpx on an address in exdec EG:
439FBC: 0a ImpAdCallFPR4: _rtcFileDateTime (BPX ...???)
439FC1: f5 LitI4: 0x1 1 (....)
439FC6: f5 LitI4: 0x1 1 (....)
439FCB: 3a LitVarStr: ( local_00C8 ) yyyymmDd
439FD0: 4e FStVarCopyObj local_00D8
439FD3: 04 FLdRfVar local_00D8
439FD6: 04 FLdRfVar local_00B0
439FD9: 04 FLdRfVar local_00E8

so to break on 439FBC ?? what do i bpx in si coz it dont work for cs or ds???
4oh4
12-10-2000, 06:35 PM
Well you could breakpoint on either the function itself or the memory address. You'll probably be better off just bpx'ing on the call to the function itself though.

For example, "bpx msvbvm60!__rtcFileDateTime".

--4oh4

(By the way, pm is going to send me a copy of the rce disc. Since I owe you a disc anyways, I'll send you a copy alright.)
pepperman
12-11-2000, 07:45 AM
i think i just need to read/try etc and learn about RVA (which i believe is Relative virtual address) and the other address types. THxz for the RCE cd, will communicate withn you on icq/email....l8rz
4oh4
12-11-2000, 12:57 PM
You should also read the softice .pdf's as well. Especially the chapters on bpx and bpm.


Is there any documentation on the services of NDIS.VxD ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is there any documentation on the services of NDIS.VxD ?
PDA

View Full Version : Is there any documentation on the services of NDIS.VxD ?

Solomon
12-11-2000, 01:29 AM
I want to hook some services of NDIS.VxD in Win98 to do some packet filtering. But can't find any info about the services of this VxD in DDK & MSDN(Only how to use the NDISxxxx functions there). So I use IDA to get a deadlist of this vxd and extract its service table. Is the following correct? There seems to be big difference between the NDIS in Win9x and that in Win2K(NDIS 5.0). Just wonder how the author of IDA knows the service names of this VxD? What services shall I hook? I heard that the network architecture of Windows ME is quite different from that of Win98, is it true?
Thx for your hint.

(sorry for flooding this board)

Service_Table_0 dd offset NdisGetVersion
dd offset NdisAllocateSpinLock
dd offset NdisFreeSpinLock
dd offset NdisAcquireSpinLock
dd offset NdisReleaseSpinLock
...............
dd offset unkserv_99
dd offset unkserv_9a
dd offset unkserv_9b
dd offset unkserv_9c
dd offset unkserv_9d
dd offset unkserv_9e
dd offset unkserv_9f
dd offset unkserv_a0
Frog's Print
12-12-2000, 04:18 PM
Reading the inc32 files *.inc & *.h will teach you much more than only reading the manual : => Ndis.h
Frog's Print
12-12-2000, 04:26 PM
Forgot to mention that SoftICE command 'vxd NDIS' will give you the names and numbers of services (161 for NDIS)... ;-)
Solomon
12-13-2000, 03:21 AM
Thank u!
Ignatz
01-01-2001, 01:37 PM
Hi ppl!

Solomon, i'm interested in learning about packet filtering, too

was wondering if you could point me to some info on generally ~how~ packet filtering works...

i have the paper about bpf somewhere... and have linux and getting ready to install one of the bsd's so i can look in the networking/firewalling code... but just an overview of the theory behind it would help more than anything...
Solomon
01-02-2001, 12:53 AM
hi Ignatz,

There are some skeleton source codes & docs for packet filtering in ftp://ftp.pcausa.com/devonly/(The "ndispim9x" there needs an installation key which I don't know, but maybe sb. else can figure it out). Also there are FAQs in PCAUSA's web page.
source code for packet sniffer(not filter) can be found in http://netgroup-serv.polito.it/windump/.

Hope this helps.
Ignatz
01-02-2001, 01:17 AM
Thank you :o)

Checking it out now...


Anyone in China with RCE-CD?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anyone in China with RCE-CD?
PDA

View Full Version : Anyone in China with RCE-CD?

Sun Bird
12-12-2000, 05:22 PM
I also would be very interested in getting a copy of the RCE CD.
I'm in China. If u would like to give me a copy of it, please contact me.
Thx.
noname
12-13-2000, 08:51 AM
Hi,
get it here :)))))
http://www.idca.com/~thesandman/RCE/Requests.html


softice help please!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice help please!
PDA

View Full Version : softice help please!

spacegoat
12-13-2000, 09:28 AM
This is probaly as newbie as it gets but i am having a problem trying to find out how to write to code using SI, you know JNZ to JZ... I read Sandmans excellent tut but i didnt see anything refering to that.

Also on the web the other day i downloaded a already cracked version of Win32dasm8.9, my copy is at home and i want it at work to, does anyone know where this possibly came from.

thanx
goat
pupp
12-13-2000, 11:27 AM
Let me see if i understood your ??
First do a d eip on the line that you want to change and look at the top you will see the same line Example your at 00123456789 and at the top you will see 00123456789 0F 75 34 54 65 77 and try and change the first or second numbers like 75 to 74 and press return you will see the change but this will change it only in memory to permently change it use your Hex editor.

i hope this helped you..

pupp
Bratsch
12-14-2000, 11:30 PM
Another posibility is to use the Sice command A(ssemble):
If you want to change the current instruction just type A
Otherwise type A cs:xxxxxxxx where xxxxxx is the address of the instruction you want to change.
Then write the FULL opcode you want in that position ie: JMP 0045232A or XOR eax,eax
-then click enter. SI will translate the opcode to Hex and give you the option to assemble the next instruction(s) (perhaps to add the nops to compensate for a change in the instruction lenght). Caviat emptor: look at the Hex translation of whatever you typed (in the field to the left of the instructions). If your new instruction translation is longer than the original instruction, you may overwrite the following instruction bytes and obtain unpedictable results. Also, I have seen Sice make mistakes when the jump you are changing is a Far jump.
When you are done assembling click escape and you are back to Sice in regular mode.

Bratsch
SI Help
12-17-2000, 04:45 AM
Hi, If you are a real newbie then maybe you did not RTFM
and so cannot see the hex code refered to above. You should alter the [CTRL+F1] macro (init string ?) in 'winice.dat' - with registered UltraEdit 7.20 :) like this :-

CF1="altscr off; lines 60; wc 30; wd 10;code on; set font 2;;"

the 'code on' command shows the hex/opcode equivalents.

Hope this helps.


Logical.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Logical.exe
PDA

View Full Version : Logical.exe

pepperman
12-13-2000, 01:20 PM
just a thought, im reading ArtOfAsm (arghhhhhh) and wondered if any1 has the programs Logical.exe and Convert.exe that comes with it?
Timmy
12-13-2000, 05:25 PM
I could be wrong here but I think I saw all the files that come with AOA on the site where I downloaded it ages ago. If memory serves it was the University of Paris website. Can't remember the URL but search for the site and then search for Art of Assembly.


A Win32 Asm Problem --> Need help !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A Win32 Asm Problem --> Need help !
PDA

View Full Version : A Win32 Asm Problem --> Need help !

Clandestiny
12-13-2000, 04:00 PM
Hi guys,

I have been trying to learn win32 asm programming from Iczelions site...and I am having a couple of problems with something I'm trying to write.

Basically, I've made it to about the 9th tut which involves using child window controls (buttons and edit boxes and such). I am using an edit box to get a numerical string from the user which I am want to convert into a floating point number using the StrToFloat function. Then after some calculations are performed on the floating point number, the press of a button will output it again as a string in a message box. Here is my problem...

The floating point number output by the StrToFloat function is an 8 byte QWORD and I can't figure out how to add / subtract / multiply / divide with this size of value. I have looked at an assembly reference book and can find no instructions for dealing with this size (it is an old book so possibly it doesn't contain all of the instructions). Any help will be appreciated.

Thanks in advance...

Regards :-)
Clandestiny
Solomon
12-13-2000, 09:05 PM
hi, you can use floating-point instructions like FADD, FMUL etc. All these instructions begin with a 'F'. Details of these instructions & the architecture of 80x87 can be found in the manuals of Intel processor or "the Art of Assembly Language".(try here: http://personales.com/eeuu/arizona/Aesculapius/files.html). Finally the result can be converted into a string with wsprintf( ) & displayed in the text box.
Clandestiny
12-14-2000, 11:23 AM
Thanks a lot :-)

Regards,
Clandestiny


Logomanager 1.1.71
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Logomanager 1.1.71
PDA

View Full Version : Logomanager 1.1.71

SiR
12-14-2000, 08:30 AM
HI!

I tryed with glditemtexta and that bpm on name and password,
but can't figure out the reg. number or how it is calculated.

Please if anybody have an idea please help.

Thanx
InOverMyHead
12-16-2000, 08:52 AM
Look in the mini project area under "Lets start something ..." - looks like your target is next up!
Timmy
12-18-2000, 09:26 PM
Are you the author of Crackme11 ????? - Nice.


Help with Ultra Edit ver 7.20a
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with Ultra Edit ver 7.20a
PDA

View Full Version : Help with Ultra Edit ver 7.20a

xOptiMus
12-14-2000, 01:45 PM
Hi all

I've just managed to patch the latest version of Ultra Edit ver 7.20a. However it was'nt my intention to patch it, I started out fishing for the serial, but after a few days of no luck decided to make do with patching it.

I'm usualy quite good at tracing serials, but this prog has so far beaten me! I just can't seem to even get near to it. I know the damn prog must check the serial that I enter with the real one somewhere - but where, I just do not know!

Can anyone give me a hint as to where I should be looking for this serial check? Is there some method I can use to track it down? I've tried breaking on hmemcpy, GetWindowTextA, GetDlgItemTextA etc, but they don't work. After entering a username and serial the prog informs you that it must shut down to check the serial, so I guess that it must do it's check when you restart it.

Please can someone help, I'm clean out of ideas.

xOptiMus
ytc_
12-14-2000, 05:43 PM
I did not personally try out Ultra Edit v7.20a, but I tried older versions before. What Ultra Edit did was to read a .reg file. When you're asked to restart the program, UltraEdit will read the .reg file for the serial and verify it. Your strategy here in your case would be bpxing on CreateFileA and get the handle of the .reg file, then bpx ReadFile when the handle is used. UltraEdit will then decode the Name/Serial combo and starts messing around it like what a normal serial check would do. Hope this helps :)


unbox 4.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unbox 4.5
PDA

View Full Version : unbox 4.5

mag64
12-15-2000, 05:02 PM
need help for new unboxed software 4.5

thx.
tsehp
12-23-2000, 01:28 PM
wait for a while, this should be fixed by the iat rebuilder I'll soon publish on this mb.
send the target's link to my email


Anyone know of any Tutorial Search Engines?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anyone know of any Tutorial Search Engines?
PDA

View Full Version : Anyone know of any Tutorial Search Engines?

xOptiMus
12-16-2000, 03:44 PM
Hello reversers,

Is there such a thing as a tutorial search engine?
If so, does anyone know where I can find one?

Any help greatly appreciated!

Thanks
xOptiMus
Nick
12-17-2000, 07:07 AM
Ohhh yes there is. Good ole Jeff have been puting alot of work in to this site, you might find other interesting links too !

Nick
Nick
12-17-2000, 07:14 AM
Ehh sorry maybe you'll need the link also, I was a little too fast there. Here you go : http://www.jps.net/jas/


RCE-CD Download
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RCE-CD Download
PDA

View Full Version : RCE-CD Download

bolts
12-18-2000, 10:16 AM
I have tried to access the FTP site to download RCE but it says I have the wrong password. I am using WS-FTP Pro. Anybody have the correct details??
?ferret
12-18-2000, 08:27 PM
There are no correct details....ftp's been down for months.....too many people uploading virii etc.

Only way to get a copy is to email a volunteer to burn 1 for you.


softice and SiS530
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice and SiS530
PDA

View Full Version : softice and SiS530

k3k
12-18-2000, 10:52 AM
when i install sice theres no support for my video borad what should i do ? all that i tried failed im with sice4.0

tnx
k3k
?ferret
12-18-2000, 08:28 PM
have you tried the universal vga driver....with the use universal vga driver checkbox checked?
?ferret
12-18-2000, 08:29 PM
btw...this is a TOT board question


Dumping/Unpacking???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dumping/Unpacking???
PDA

View Full Version : Dumping/Unpacking???

pupp
12-18-2000, 10:45 PM
Hi
Can some tell me what the difference is between dumping and unpacking??
if i unpack a program with Shrinker1.6 i can open the program but when i push the register button the computer crashes, when i dump it with prodump and press on the program Softice pops up and the computer lockes up :-(

TIA

pupp
CrackZ
12-19-2000, 01:17 PM
Hiya,

This is my somewhat subjective view so don't take it as the only one ;-). I've always distinguished unpacking and dumping by the level of involvement (and to a certain extent) knowledge required by the user.

As far as I'm concerned virtually anyone can 'dump' a program from memory using tools such as ProcDump, IceDump or TRW2000's /PEDUMP etc (and very good these tools are too). Yet as the authors of these tools will probably tell you this is no substitute for doing your PE homework ;-).

'Unpacking' I always interpreted as 'manual' (keyword) unpacking of a packed file, i.e. you trace the unpacker code, you dump the various sections, fix the import table etc, etc, the definition isn't the best since running any unpacker is by default 'unpacking', yet I think this is the majority view.

Dare I also say that learning to unpack by hand by yourself is much more useful than blindly using tools ;-), the authors of these things just can't (sadly) keep up with the neverending latest versions of these packers, and NT compatibility also seems to be a serious problem too, although you can with some work make your tools work for you ;-).

My 2c and some.

Regards

CrackZ.
pupp
12-19-2000, 09:14 PM
Thanks CrackZ
The Owl
12-24-2000, 05:43 AM
my 2 centimes ;-)

i think history starts some 15 or so years ago with MS-DOS and the first .com encryptors (packers came later on the scene, although for our purposes they're almost the same). back then recreating a working executable (.com) amounted to tracing to the original entry point (which as we know is always at cs:100) and then dumping (writing out) the memory content of CS to disk (plus trimming its size to the original if one was able to determine it). at this point dumping and unpacking pretty much meant the same, even when the 'scene' moved to the MZ type .exe encryptors/compressors, besides dumping one had to fix relocations only and got a working executable.

with the advent of windows and its NE and PE type executables the picture became more complex. it was no longer enough to simply dump memory content to disk, one had to reconstruct the internal structures of these files as well (since they have a complex one, unlike .com or the simple MZ .exe). i think it is at this point when people (skilled in the 'art' ;-) started to make the distinction between a 'simple' memory dump and 'full' unpacking (reconstruction).

i'd also say that the tools one uses (or not) for either purpose do not make the difference between the two. speaking for myself, i'm more than happy that i no longer have to manually trace wrappers in order to find the original entry point, yet i still consider the whole process more as unpacking than dumping (well, it also depends on what i do at the OEP, /dump or /pedump ;-). in other words, without having learned it to do the hard way as well, one will always be a mere user (and at times even victim ;-) of said tools, regardless what they were meant to do.


what is a watermark??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > what is a watermark??
PDA

View Full Version : what is a watermark??

()whore
12-19-2000, 01:13 AM
Hello all,

I have just read a tute about removing watermarks from IDA. I have also heard about the recent contest to remove the watermarks from the new music encryption scheem dreamed up by the evil music industry. Can anyone explain exactly what a watermark is? Is is a form of encryption? How does it work?

Thaks
()whore
Volatility
12-19-2000, 09:50 AM
Greetings,

Watermarks can come in many different forms... I'll explain a few different ways that can give you a general idea:

* Say you have an document creation program... any document you create/print with it, unregistered, displays a message "Unregistered version, blah blah"

* In the case of IDA, the actual program contains information about who owns it. If you were to distribute as warez, your personal information would still be in it.

* Say you have some type of unregistered "patching program"... unbeknownst to you, any patchers you create from it, and send out, could include your information, wether "branded" into the patcher, or just displayed when applying the patch...

Those, besides the IDA watermark, are just hypothetical, but should give you a general idea :)


How would I do something like this?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How would I do something like this?
PDA

View Full Version : How would I do something like this?

Newler
12-21-2000, 12:00 AM
Eg.. I know that the word

secian = qi.9xV/RSUOJ2

What would something like

oyHS2doxz9skE be equal to?

Is there a program that does this or how would I go upon doing this?

Thank you
Solomon
12-21-2000, 06:40 AM
if it's one-way hashing, have to brute-force it :)


Site down for several hours ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Site down for several hours ?
PDA

View Full Version : Site down for several hours ?

tsehp
12-22-2000, 07:25 PM
Just read :

>Dina mis-stated the problem. The fax I got from Microsoft, through
>Globalcenter (the people we get our internet connection from) said:
>
>"Microsoft has received information that the domain listed above, which
>appears to be on servers under your control, is offering unlicensed copies
>oris engaged in other unauthorized activites relating to copyrighted
>computer programs published by Microsoft.
>
>1. Identification of copyrighted works:
>
>Computer Programs
>Windows 98
>Frontpage 98
>Publisher
>Age of Empires
>
>Copyright owners
>Microsoft
>
>2. Infringing material or activity found at the following locations:
>http://66.36.228.12 http://www.woodmann.net/fravia/project9.htm
>http://www.woodmann.net/fravia/twd_aeo.htm
>
>The above location is offering 'Cracks' or 'Serial Numbers', inteded to
>circumvent protection applied to prevent the unauthorized copying and use of
>copyrighted computer programs, for distribution by technical means."
>
>And then there's more that's irrelevant.
>
>That's why we took your site offline.
>
>
>Thanks,
>
**********

Ok, the essays were removed from the mirror. Now, don't even think to publish an essay concerning adding functionnality to msdos 2.0 :)

Sorry for the inconvenience, one good news, woodmann (our great sponsor) took a two year domain account for this place to stay alive.

We're still here to last for a very long time, merry christmas.

+Tsehp
JimmyClif
12-23-2000, 04:58 AM
I guess Golem is still kicking ;)
tsehp
12-23-2000, 01:26 PM
but without serious results this time


Unpacking API Spy v2.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking API Spy v2.5
PDA

View Full Version : Unpacking API Spy v2.5

stanks
12-23-2000, 03:03 AM
Hi!

I have problems with API Spy v2.5. I check apis32.exe with GetTyp (last version) and it says that it is packed with Petite v1.2. This is output from GetTyp:

- --- # GetTyp 2.60 # ----------------- # Copyright (c) 1997-99 by PHaX # ---
- --- # phax@writeme.com # ---------------------- # http://surf.to/phax # ---
- ------------------------------------------------------ # free edition # ---

- [C:\PROGRAM FILES\APIS32\apis32.exe] -----
DOS executable file - 71180 bytes

Portable executable (starting at 232 for 70948 bytes)
Packer: Petite 1.2
Calculated entrypoint: 65536 / 00010000h (RVA: 00018000h)
Required CPU type: 80386
Requires Win 95 or NT 4
Flags:
Relocation info stripped from file
File is executable
Line numbers stripped from file
Local symbols stripped from file
32 bit word machine
Linker version: 6.0
Objects (object align = 00001000h):
Name Virt size RVA Phys size Phys Ofs
.text 00008000h 00001000h 00005000h 00001000h
.rdata 00001000h 00009000h 00001000h 00006000h
.data 00005000h 0000A000h 00000000h 00000000h
.rsrc 00009000h 0000F000h 00009000h 00007000h
.madmat 0000D258h 00018000h 0000160Ch 00010000h

This section .madmat we can see from W32Dasm too (and IDA). I tried with ProcDump (final version) to unpack apis32 (with Petite<1.3) but it doesn't work. ProcDump tells me this:

An error occured at script line 0x8
- Script evaluation failed
or
- Script syntax error

I tried to unpack it manually. This is a piece from W32Dasm (the place i where we jump to real entry point ... i think :)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00418110(C)
|
:004195BD 8B642414 mov esp, dword ptr [esp+14]
:004195C1 5E pop esi
:004195C2 8BFE mov edi, esi
:004195C4 81C6D7150000 add esi, 000015D7
:004195CA 6A05 push 00000005
:004195CC 59 pop ecx
:004195CD F3 repz
:004195CE A4 movsb
:004195CF 61 popad
:004195D0 669D popf
:004195D2 E989CDFEFF jmp 00406360
:004195D7 E95BE3FEFF jmp 00407937
:004195DC F2 repnz
:004195DD 0B00 or eax, dword ptr [eax]

I think that at 4195d2 is our real entry point. I run ProcDump, choose PE Editor, our target and change entry point from 00018000 to 00006360. But when i click on OK ProcDump is going down to hell. This program has performed al illegal bla bla bla classic shit. What to do? I am confused. Nothing is work (at least i can't find something that is work on this target). Does anybody have an idea? Thanks.

P.S. Sorry for this very long post. Next time it will be much shorter.

Greetz
JimmyClif
12-23-2000, 04:54 AM
Hi stanks,

The Snake wrote a tut about how to unpack API-Spy 2.4 which is packed the same. Go visit his page at snakepage.cjb.net

It's a funny target,
JimmyClif :)
stanks
12-23-2000, 07:04 AM
Thank you JimmyClif.

Greetz


REPNE SCASB ?@$#!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > REPNE SCASB ?@$#!
PDA

View Full Version : REPNE SCASB ?@$#!

MaTRiX_2k
12-23-2000, 12:07 PM
Hello there,

i am a newbee, having the experience of cracking some hardwired (serial,reg) crackme tut's and also some xor one's.
It was this chess program (chess partner 4.3) i was trying to crack.
i traced and bpm'd the dummy name (pwd,serial.no) and then i came to this
section of the program:-

ret 0008
push ebp
mov ebp,esp
push ecx
push edi
mov edi,[ebp+08]
or ecx,-01
xor eax,eax
cld
016f:bbf7117e repnez scasb -> bpm'd and got kicked here
or eax,-02 sub eax,ecx
pop edi
pop ecx
leave
ret 0004
phew!

i am unable to trace my dummy name, after the renez scasb loop;
please help me out.

signing out
MaTRiX_2k
Bratsch
12-23-2000, 09:03 PM
repnez scasb scans each byte in the string pointed by the pair ES:EDI with the byte contained in al. it automatically increments EDI, to point the next byte, and ECX, to keep the count. It looks like a convoluted way to find the end of the string (a zero ended string and find its length. look at the comnents:

ret 0008 ;Previous call returns
push ebp ; Standard begining of a call
mov ebp,esp ; save the ebp and move esp in
;its place to access the local
;variables in the stack

push ecx ; Preserve the value of ecx
push edi ; Preserve the value of edi
mov edi,[ebp+08] ; edi has the adress of your
;string. Type in Sice
; d ES:EDI and you will
;see your serial or whatever in the data area
or ecx,-01 ;ECX now contains FFFFFFFF (-1)
xor eax,eax ;EAX is equal to 0. that is
;the null terminator of a string

cld ;make the direction flag zero so the scan proceeds
;forward, if it is set to one, the scan would be ;bacwards
repnez scasb ;repeat until the byte in al(now zero) and the byte
;pointed by ES:EDI are equal
;scan for the end of the string in other words
; ECX increases after eachcompare. it contains the
;length of the string. as we started from -1 it does not ;count the null character at the end
or eax,-02 ;eax should be FFFFFFFE
sub eax,ecx ;and we substract the length of the string in ecx.
;eax now contains the negative of the length of the string ; minus 1
pop edi ; restore the saved EDI
pop ecx ; restore the saved ecx
leave ; restores esp and ebp to their original values
ret 0004 ; return discarding 4 bytes in the stack
phew! ; Not that hard. Look up the opcodes in ;webster.cs.ucr.edu/Page_asm/Doc386/
or any ASM reference page.
The encoded length of the string is returned in EAX. String in question was in the stack at ebp-08. you need to trace more, this call only checked the size of the key.

Hope this helps.

Bratsch
Lord Soth
12-23-2000, 09:15 PM
Here's the code, commented :

push ebp ; store ebp
mov ebp,esp ; take stack pointer
push ecx ; store ecx
push edi ; store edit
mov edi,[ebp+08] ; get stack variable
or ecx,-01 ; ecx = 0ffffffffh
xor eax,eax ; eax = 0
cld ; clear direction flag
016f:bbf7117e repnez scasb -> bpm'd and got kicked here
or eax,-02 sub eax,ecx
pop edi
pop ecx
leave
ret 0004

Well my friend, you stumbled accross the simplest of string length algorithms.
Or so it SEEMS :)
EDI is loaded IMO with the address of the string, the direction flag is cleared, eax is set to 0, ecx is set to max (4g), and then it scans for a null terminator (00h byte).
The value in AL is the value the scasb is scanning for. Each time scasb is used, it will compare the byte pointed to by edi with AL. if they are equal, the loop will exit.
In any case, edi is always incremented by 1 (because this is scan-string-byte) if the direction flag is cleared (or decremented if set).
Then comes a weird part. OR with -2 (FFFFFFFEh) will cause all bits in EAX except the least significant bit to be set.
Then they substract ECX from EAX.
This is an equivalent way of having to NOT ECX and then add 1 (i'm almost certain hehe..)

You shouldn't be concerned with this particular code because it doesn't move your string data anywhere and it doesn't calculate any special things from it.

LS


Juz to say hello ,Merry xmas and Happy New year
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Juz to say hello ,Merry xmas and Happy New year
PDA

View Full Version : Juz to say hello ,Merry xmas and Happy New year

esther
12-24-2000, 10:04 AM
Hi everyone on board,
Its a long time I have not been here :)
Juz to say hello ,Merry xmas and Happy New year

regards to all
esther
Bratsch
12-24-2000, 12:09 PM
Same to everybody, keep the flame of RE burning fur the next millenium.
Kayaker
12-24-2000, 12:13 PM
Merry Xmas to you esther,

Try to come by more than once a year, OK? :-D
?ferret
12-24-2000, 09:40 PM
Happy Holidays to all my reversing friends! :D


Q about l0phtcrack crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Q about l0phtcrack crack
PDA

View Full Version : Q about l0phtcrack crack

daemon
12-25-2000, 08:59 PM
I've got a question and forgive me if it's rather stupid but here goes. I've read thru Goatass's tutorial on cracking l0phtcrack 2.5.2

<snippet of tut>
Run
the
program and you should see a nag screen showing you how many days you have
left (15 days total) and there is also a "Register" button. Click the
"Register" button and you should see a dialog box with a grayed out box
with
the pre-assigned serial number and below it there will be a box for your
unlock code. The unlock code is alphnumeric but that doesn't matter right
now. Go ahead and put any number you like, I used 12345678.

Now go into SoftICE (Ctrl+D) and set a breakpoint on GetWindowTextA (BPX
GetWindowTextA). The approach here is to break right after the program
reads
your unlock code and then uses it along with the pre-assigned serial
number
to generate and compare the good unlock code. Now get out of SoftICE (X)
and
click the OK button. SoftICE breaks, press F11 to return to the calling
function, that reads in the pre-assigned serial number. Now press F5 to
read
your unlock code, SoftICE breaks a second time, press F11 again and now
you
are in the program's code. Trace through the code until you get to this
part:

:00406345 MOV EAX, [EBX] <-- if you type D EAX you will see the code you
entered.
:00406347 LEA ECX, [ESP+1C] <-- here is the 1st unlock code, D ECX to view
it.
</snippet of tut>

How did he know to go to 00406345 ?? I've followed thru w/this using SoftICE on my machine and I don't see any hints that referance this.

If anyone's interested I performed roughly the same crack w/W32dsm...
EVC_ViPeR
12-26-2000, 04:29 AM
I am not sure how he knows, but I sort of understand that kind of line always make a newbie wondering.....how do you know it is here??? Based on my experience (or if you read most of my articles, it is full of those stuff), when we trace the code, we always dump what is inside the register and see if it is related to our name, fake code or something helpful until we got what we are looking for. After that, when we write the tutorial, we are sort of (or at least I am) point out where to look into.

The reason we know is part of experience on the road of reversing. instinct also paly a role in it. Just my 2cents opinion.
daemon
12-26-2000, 09:14 AM
Thanks for the reply. When I hit F11 the second time it dumps me to 00456ECA mov ECX,[EBP+10] which is a hell of a long ways away from 00406345. I understand what you're saying but that seems like alot of "easter egging" (I use that term referring to me as I can't find any referance to it ;) )to trace back that far just dumping registers along the way. I need to get busy on some more SoftICE tutorials as I'm obviously missing something ;) I've put up how I did the same crack w/W32dsm on my site (www.ill0gik.org) under the /*Misc*/ section if anyones interested.

thanks,
daemon
?ferret
12-27-2000, 08:29 PM
one way that usually works to cut some of the useless registers is to do a search for the serial you entered (S 0 L FFFFFFFF 'yourserial') and then put a bpm/bpr on the address/range given by the search (BPM 0167:49A178 RW) [the RW is for read OR write]

When softice breaks, dig around a bit, if the fake serial gets transferred to a different memory address, BPM it. If it gets compared to something, find out what.

Hope that clears it up a bit for ya ;-)
daemon
12-29-2000, 07:38 PM
Thanks to both of you for the replies. I've got some massive reading and learning to do but I think I can start looking in the right direction now ;)

-d


Is there a new project about newbie-reversing like BakeHead?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is there a new project about newbie-reversing like BakeHead?
PDA

View Full Version : Is there a new project about newbie-reversing like BakeHead?

Mustafa
12-26-2000, 05:51 PM
Is there a new project about newbie-reversing like BakeHead?
Thanks.
noname
12-26-2000, 09:58 PM
Hi,
go to mini project area
http://www.woodmann.net/cgi-bin/Ultraboard/UltraBoard.cgi?action=Headlines&BID=9&SID=

best regards


somthing weird with my softice or..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > somthing weird with my softice or..
PDA

View Full Version : somthing weird with my softice or..

Scream_18m
12-26-2000, 06:54 PM
softice used to work perfectly well on my 486 but now I have changed to 900mhz thunderbird amd, a7v motherboard and csb platinum and asus v7700. anyway this combination seems not to work for softice...since every time I try to start softice it pops up before windows98 even starts and gets stuck there ....it says something like fault 00 or someting...I have tried to change my configuration but nothing seems to work maybe it does not like my optical mouse...I don't know ....plz help me with this....has anyone had the same problem...if so what did you do...

Dark Angel
noname
12-26-2000, 07:51 PM
Hi,
whats your version of sice?
Muad'Dib
12-27-2000, 01:34 PM
First try putting FAULTS OFF in your INIT= line. If that doesn't work, try re-installing SoftICE.
?ferret
12-27-2000, 08:37 PM
I can say for certain it's not your mouse....i've been using an intellieye for over a year w/ no probs


Another newbie.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Another newbie.
PDA

View Full Version : Another newbie.

OeDiFuZz
12-27-2000, 02:38 PM
Hi guys,

I'm just another newbie interested i cracking. I have already downloaded +thesandman's tuts as well as the +orc's tuts and several other tuts from other crackers. And I still hunger for more knowledge thats why i joined this forum.

I hope i can learn a lot from you guys. I already did some cracking of my own with the aid of the tuts. Currently I'm trying to crack Hex Workshop v3.1 and... man it's really tough for a newbie like me. Anyway, thanks for letting me into your world of reverse engineering. Is Reverse Engineering and cracking the same?
?ferret
12-27-2000, 08:35 PM
Welcome to the hobby :-)

...Are Reverse Engineering an Cracking the same?

......for the most part

This may just be my view, but I think we use reversing as a term to somewhat distinguish ourselves from "scene" crackers (many of whom don't test their cracks to see if they "really" work, just put out as many cracks as possible to get hits on their banner supported sites)

[There are many good scene crackers out there also, but the majority don't seem to take pride in their work]
JimmyClif
12-28-2000, 02:21 AM
Dear ?ferret,

I am sorry but I have to say : "Objection" :) I think they do differ a lot.

Cracking merely consists of breaking software protections. I do see that we 'reverse' a protection scheme but cracking is only a little step in reversing.

Reversing is done when you analize a program to see how it is working, implementing additional functions, cleaning bugs, and such...

OeDiFuZz,
Have a look at a few reversing essais at +fravia's site to see the difference:
- Reversing W32Dasm by Harlequin
- Reversing Notepad by Neural Noise ( <-- excellent)
- Reversing FileMon by reverser
(& Last not least) @ http://qferret.cjb.net
- Kayakers FileMon essai....

Of course this is only my point of view.

Best regards,
JimmyC
OeDiFuZz
12-28-2000, 07:04 AM
Thanks guys.

I'll check out the essays at +fravia's site.

Happy New Year to all of you!!!
?ferret
12-28-2000, 09:26 PM
hehe.....got me there ;-)


encrypted .exe?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > encrypted .exe?
PDA

View Full Version : encrypted .exe?

spamal
12-27-2000, 03:26 PM
http://e-ditorial.com/editor201.exe

A popular e-book creator and html compiler. It appears to be written in Delphi 3 or 4. When I tried to disassemble it in W32Dasm 8.9 it just gave me 2 pages of garbage. I don't think it is packed. Please help a newbie understand how to disasseble this bad boy. (I can't install SICE where I am).

TIA,
Spamal
LuTiN NoIR
12-27-2000, 06:27 PM
Hello,

Your program is packed with aspack 2.11. Use an unpacker to obtain an unpacked version ;) .

regards,
LuTiN NoIR
spamal
12-28-2000, 01:25 AM
Thanks, I unpacked it like a charm. The unpacked .exe runs fine. However, here is a strange thing... When I try to disassemble it, W32DASM v8.93 always hangs when processing the jumps. Could this be another layer of anti-disassembly protection?

Thanks a lot,
Spamal

PS I am running the disassembler on Win2k
splaj
12-28-2000, 06:41 AM
When you find a Delphi target ALWAYS use DEDE by DaFixer on it. Latest version does D2 -> D5

With this tool I reversed ColorPilot 3.xx, Lockdown Pro , ASProtect, Softlocx5 (unpacked 1st)
etc etc etc.

from :-
www.balbaro.com ?

Try It :)
You don't need WDasm89 for Delphi

+SplAj
'Patch+Play'

Hey thanks for the 'tools' guys. What a year of advancement for the RCE.
spamal
12-28-2000, 09:12 PM
Well I tried patching the two jumps, but one didn't work, and the other gave me an external exception error when the two strings were compared. Any final ideas? I would like to reverse this without using SICE.

Here is the code, split into 2 posts:

* Reference to: System..LStrCmp()
|
0048FD24 E85341F7FF call 00403E7C
0048FD29 0F85CC000000 jnz 0048FDFB
0048FD2F 8D55F0 lea edx, [ebp-$10]

* Reference to control TFormWelcome.eUser : TEdit
|
0048FD32 8B8310030000 mov eax, [ebx+$0310]

* Reference to: Controls.TControl.GetText()
|
0048FD38 E8AB18FAFF call 004315E8
0048FD3D 8B55F0 mov edx, [ebp-$10]
0048FD40 A1588B4900 mov eax, dword ptr [$498B58]

* Reference to: System..LStrAsg()
|
0048FD45 E8FA3DF7FF call 00403B44
0048FD4A 8D55F0 lea edx, [ebp-$10]

* Reference to control TFormWelcome.eSerial : TEdit
|
0048FD4D 8B8314030000 mov eax, [ebx+$0314]

* Reference to: Controls.TControl.GetText()
|
0048FD53 E89018FAFF call 004315E8
0048FD58 8B55F0 mov edx, [ebp-$10]
0048FD5B A174884900 mov eax, dword ptr [$498874]

* Reference to: System..LStrAsg()
|
0048FD60 E8DF3DF7FF call 00403B44
0048FD65 A1588B4900 mov eax, dword ptr [$498B58]
0048FD6A 8B00 mov eax, [eax]
0048FD6C 50 push eax

* Possible String Reference to: 'User'
|
0048FD6D B994FE4800 mov ecx, $0048FE94

* Possible String Reference to: 'Software\Microdream\E-ditor 2\'
|
0048FD72 BAA4FE4800 mov edx, $0048FEA4
0048FD77 B802000080 mov eax, $80000002
|
0048FD7C E8D7A6FEFF call 0047A458
0048FD81 A174884900 mov eax, dword ptr [$498874]
0048FD86 8B00 mov eax, [eax]
0048FD88 50 push eax

* Possible String Reference to: 'Software\Microdream\E-ditor 2\'
|
0048FD89 BAA4FE4800 mov edx, $0048FEA4

* Possible String Reference to: 'Serial'
|
0048FD8E B9CCFE4800 mov ecx, $0048FECC
0048FD93 B802000080 mov eax, $80000002
|
0048FD98 E8BBA6FEFF call 0047A458
0048FD9D A1008A4900 mov eax, dword ptr [$498A00]
0048FDA2 C60001 mov byte ptr [eax], $01
0048FDA5 6A00 push $00
0048FDA7 668B0DD4FE4800 mov cx, word ptr [$48FED4]
0048FDAE B202 mov dl, $02

* Possible String Reference to: 'E-ditor Pro 2 has been registered.T
| hank you!'
|
spamal
12-28-2000, 09:13 PM
0048FDB0 B8E0FE4800 mov eax, $0048FEE0

* Reference to: Dialogs.MessageDlg(System.AnsiString; Dialogs.TMsgDlgType; System.[Dialogs.TMsgDlgBtn]; Integer)
|
0048FDB5 E8CE47FCFF call 00454588
0048FDBA 8B15008A4900 mov edx, [$498A00]
0048FDC0 8A12 mov dl, byte ptr [edx]
0048FDC2 80F201 xor dl, $01

* Reference to control TFormWelcome.ib7 : TImgBtn
|
0048FDC5 8B8328030000 mov eax, [ebx+$0328]

* Reference to: Controls.TControl.SetVisible(bool)
|
0048FDCB E83017FAFF call 00431500
0048FDD0 8B15008A4900 mov edx, [$498A00]
0048FDD6 8A12 mov dl, byte ptr [edx]
0048FDD8 80F201 xor dl, $01

* Reference to control TFormWelcome.ib8 : TImgBtn
|
0048FDDB 8B832C030000 mov eax, [ebx+$032C]

* Reference to: Controls.TControl.SetVisible(bool)
|
0048FDE1 E81A17FAFF call 00431500
0048FDE6 8B15588B4900 mov edx, [$498B58]
0048FDEC 8B12 mov edx, [edx]

* Reference to control TFormWelcome.LRegistered : TLabel
|
0048FDEE 8B8324030000 mov eax, [ebx+$0324]

* Reference to: Controls.TControl.SetText(System.AnsiString)
|
0048FDF4 E81F18FAFF call 00431618
0048FDF9 EB15 jmp 0048FE10
0048FDFB 6A00 push $00
0048FDFD 668B0DD4FE4800 mov cx, word ptr [$48FED4]
0048FE04 B201 mov dl, $01

* Possible String Reference to: 'Invalid Serial or User Name'
|
0048FE06 B81CFF4800 mov eax, $0048FF1C
spamal
12-28-2000, 09:33 PM
Actually, killing the jump at
0048FD29

Makes it accept any password as "registered", but it doesn't unlock all of the features. When you use the program it still brands an ugly "unregistered version" on you compiled .exes
+SplAj
01-03-2001, 04:49 AM
Did you get it yet ?

Here is my solution:-

Change the bytes at 48FE06 from B81CFF4800
to 8B45F89090 and this make a KEYGEN for you !

Just enter your name and dummy serial. The messagebox wil now give you the valid serial
instead of 'incorrect serial or user name'

SPAMAL
4FF2020..... bla bla
spamal
01-04-2001, 02:48 PM
Hehe, pretty elegant! I finally got ugly and reversed it the old-fashioned way, but yours is much better


People of the Planet Earth
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > People of the Planet Earth
PDA

View Full Version : People of the Planet Earth

zitterbe
12-28-2000, 01:11 PM
Your planet will be destroyed in .03655 of your solar orbital patterns. We of the Hydra system have studied your silcon based x86 systems and found them lacking. Termination of all life forms wil comence as noted above.

zitterbe [under hydra guidence]

[they made me do it! - those snakey bastards!]
zitterbe
12-28-2000, 01:23 PM
Those crude beings have fed me drugs and elixirs that should never be mentioned among civilized folks. They forced me, at Stroneh-point, to post that previous ultimatum - under extreme durress. They threatened my sister with the Whampol! I said - that's enough!!! Cruel extra-terrestials!!!!! Their mercy is not to be found - and their aborhance of silicon knows no bounds. But I'll fight em, I will. With sheer guts and glory, uh huh.

[They're monitoring my keystrokes, even now] But I will not become a slacker! It's death to the finish now. No turning to the slacker state for ole Z. It's for God and Silicon! Amen...
?ferret
12-28-2000, 09:23 PM
Somebody's sure feeding you drugs & elixors ;-)

...got any xtra?


hacking for reverse engineering purposes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hacking for reverse engineering purposes
PDA

View Full Version : hacking for reverse engineering purposes

l00n
12-28-2000, 03:57 PM
Hi everyone
+Greythorne has collected all files needed in +ORC 's tutes in an ftp site. I tried to d/l then and I was surprised when I found out that I need a username and password. I don't have any hacking experience at all. Is there anyone who can help me. +ORC 's packs are priceless. I wonder why there is a restricted access. I also read that it took +Greythorne a year to collect them all, it would take an eternity with me....
If anyone know a valid username and password and willing to share I'll be greatfull I can keep it secret if that's required (although I think that king of info should be public). or if anyone has some documents that teaches a sure methode of hacking this site I'm also interrested in that.

I hope there is someone who can help me.
(the ftp site is ftp://ftp.sol.no/public/users/r/reopsahl/
there is another one at sandman's :
http://www.cyberspy.com/~thesandman/orcpacks.html
Thank you.
JimmyClif
12-28-2000, 05:08 PM
Sorry man... I don't know - but talking about it:

Anyone got +Greythorne's HP link ?
2nEw
12-29-2000, 09:12 AM
I think this is what you're looking for. I found the link to this page by doing a mouseover on the image of a key on +greythornes site.
http://home.online.no/~reopsahl/files/orcpaks.htm
this page has a few links to Orc Packs. The ftp with the pword login you found may have been the ftp for his actual site. I hope this helps. 2nEw
+Sandman
12-30-2000, 04:18 PM
Greetings...

If my memory serves me right, the RCE CD contains all the +ORC packs and it's still FREE!. Why are people still searching the web for them when they freely available for the asking!.

Happy New Year!

+Sandman
ArchMage
01-26-2001, 03:35 AM
Hi all,
I tried to ftp to 4.3.179.196 on port 1999, but it seems code / code is not the way to get in.... Anybody know more ? (BTW: I can copy a few rce archive CD's and distribute them to Belgian users... should I ever be able to login to the site...)
Aleph
01-26-2001, 03:00 PM
Hi all.

I have the ORC packs from +Greythorne on my HD. Mail me if you want 'em, I'll send it to you (or upload it somewhere).

By the way, I also have the RCE CD, with the ORC packs and lot more. See h**p://www.idca.com/~thesandman/RCE/Requests.html and mail me if you want a copy.

Regards,
Aleph


Correction to messsage above!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Correction to messsage above!!!
PDA

View Full Version : Correction to messsage above!!!

SEL
12-30-2000, 08:15 PM
I need to know how works Ishield serial#
mechanizm,and want to know how to reverse it!
Clandestiny
12-31-2000, 05:10 PM
SEL (12-30-2000 10:15):
I need to know how works Ishield serial#
mechanizm,and want to know how to reverse it!

Hi Sel,

Why don't you try the following link for starters...
http://www.woodmann.net/fravia/snatch_2.htm

You also might want to do a search for "installshield" on the +fravia search engine. I did a search on this same topic a while ago and there are a number of good essays :-)

Regards,
Clandestiny


X AMIGA CRACKER/CODER needs a mentor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > X AMIGA CRACKER/CODER needs a mentor
PDA

View Full Version : X AMIGA CRACKER/CODER needs a mentor

Lazzer
12-31-2000, 01:12 PM
I am an x amiga coder/cracker whos got a PC at last and i need some help with what tools i need to code/crack pc stuff what coding language is best to use on a PC also a list of the different typs of PC PROTECTION. just ask any old sckool amiga dudez about me to verify my history.
SELcorp
12-31-2000, 01:39 PM
hehe,find somewhere SoftIce 4.05 or later.
And read all tuts which teachs cracking(stupid word) reversing progs,about protections:
So many:but interesting are not so many:
UPX(rebilding tables),ASpack,ASProtect(very good prot,but not so for somebody :)
Need chat just call :)


Softice 4.05 and WinME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice 4.05 and WinME
PDA

View Full Version : Softice 4.05 and WinME

Gab
12-31-2000, 02:00 PM
I am trying to install SI 4.05 on WinME 4.9 3000 using the loader and every time I boot I see that SI loads but breaks with an error code (Break due to invalid op code fault (06h)) in address 0028:0000000B LOCK SUB EAX, [ESI*2].

I also tried to load Softice with MS/NUMEGA solution of WinME DDK and this one seize the computer every time.

I have tried various INIT config such as "faults off" and more but it always break with the same error code 06h.

I tried for days now and I need your help. How can I make it work?
l00n
01-01-2001, 03:10 AM
Hello there
I had problems with softice when I installed it on winme. I didn't seem to load. I didn't investigate the problem very long. I just uninstalled the new windows and went back to win98.
I thought that I need to upgrade softice to a newer version....
Is there any other way to solve this?
thanx
The Owl
01-01-2001, 01:22 PM
I am trying to install SI 4.05 on WinME 4.9 3000 using the loader

1. which build of SI?

2. what kind of loader do you need to *install* SI? if you meant *loading* it during boot and this loader happens to be wmldr, did you properly follow the installation instructions?

3. speaking of installation, are the SI files at their proper place? i recall winice.dat is not automatically copied to %windir% during install for example.
Gab
01-02-2001, 03:41 PM
I found the problem...it turns out I had the wrong video driver installed under SI. It works fine now and I thank you all for your support.


Segments and offsets
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Segments and offsets
PDA

View Full Version : Segments and offsets

NoRToN
12-31-2000, 06:56 PM
How do I get the segment and offset of a variable in C?
The address of operator (&), does only give one value.
zyn\ker
01-06-2001, 04:50 AM
A high-level language like C isn't designed to provide you with low-level information about the underlying architecture. There are architectures out there who don't have something like a segment but only an offset, so what should the language do in such a case?
C is designed so the programmer doesn't have to bother with such architectural-specific quirks.
What the address &-operator returns is for example
-in Win32 programs the virtual address of the variable; a program in a Win32 environment is in "flat memory" space, which means there is no segment to bother with (you are in protected mode; there is of course a segment, but you must not bother with it, it's a task of the OS to handle this).
-in DOS programs which use Real Mode the offset in the Data-Segment (DS specified in the EXE-header or sometimes even at runtime). Also nothing a C-programmer should bother with, it's the task of the compiler to handle this.
In short: You can't even be sure the platform your C-Code is running on HAS a segment, so the language doesn't have any facility to retrieve it. Everything the &-operator returns should not be evaluated by value. It may even be something completely different than the address, it just has to ACT as an address.
Use Assembler if you want to do low-level stuff.
?ferret
01-08-2001, 06:59 PM
...also note that most compilers allow you to use inline assembly to accomplish lower level tasks...

e.g. you start in C, add a routine in assembly in the middle of your proggy, go back to C (there will be a keyword to tell the compiler you're switching to assembly)


Hacking Sim Theme Park that has Safedisc protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hacking Sim Theme Park that has Safedisc protection
PDA

View Full Version : Hacking Sim Theme Park that has Safedisc protection

Zenon
01-02-2001, 12:19 AM
Okay, i don't hack at all. but i've been trying to crack Sim Theme Park. It has SafeDisc as the cd protection and i don't have the original Cd at this moment in time. My backup cd however wasn't created from a Cd image btu rather was simply made from copying just the files from the original to a blank. And i crazy to even try to get it working. I've tryed patches and just keep getting insert CD. I know i'm going to get some harsh responses for asking something this stupid. But it would be nice if i could get some help.

-Z
tazmanianBRC
01-04-2001, 04:11 PM
You can use the UnSafeDisk program, by r!sc...


Command Line Argument problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Command Line Argument problem
PDA

View Full Version : Command Line Argument problem

the_lover
01-02-2001, 07:43 AM
I am reversing a silly program,in order to get some valuable experience from that. While disassembling (using IDA) I fell through the command line args identification routine.

In this proc I encountered some misleading istructions:

WhileBody: ; CODE XREF: _WinMain@16+89j
mov edx, [ebp+ArgumentStringPointer]
movsx eax, byte ptr [edx]
test eax, eax
jz short locazione3
mov ecx, [ebp+ArgumentStringPointer]
movsx edx, byte ptr [ecx]
cmp edx, '"'
jz short locazione3
mov eax, [ebp+ArgumentStringPointer]
add eax, 1
mov [ebp+ArgumentStringPointer], eax
jmp short WhileBody

What is the meaning of the sequence
mov edx, [ebp+ArgumentStringPointer]
movsx eax, byte ptr [edx]
test eax, eax
jz short locazione3

I thought it was a check of the string's end,but this seems not to be the right interpretation. Does anybody have any idea?
MagTians
01-02-2001, 07:54 AM
What is the meaning of the sequence
mov edx, [ebp+ArgumentStringPointer]
movsx eax, byte ptr [edx]
test eax, eax
jz short locazione3

Looks like
if(ArgumentStringPointer[0] != '\0') ...
to test if the length of ArgumentStringPointer is not zero. I think that your interpretation is right.


Help me with Ida!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help me with Ida!!
PDA

View Full Version : Help me with Ida!!

NeO'X'QuiCk
01-04-2001, 04:48 PM
I would like to know where to find some good txt,doc.. about ida!!Basic for first time and than maybe advance!!I found one but it's in Deutch i don' understand it So Please be in English!!

Thanks to anyone that will help me!!
JimmyClif
01-05-2001, 12:48 AM
Hola,

Did you really search all over the net? :)

Well, anyways afaik....

BlackB ( http://beam.to/blackb ) wrote one

_mammom did too ( http://revengeforum.cjb.net - click on link at the bottom of the page)

PS: Next time you got one of these Deutch texts in hand use one of these online translators... (these come in handy if the only tut you find about a prog is for example in Dötsch :D )


new wannabe reverser got a Q. for anyone who can help me please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new wannabe reverser got a Q. for anyone who can help me please
PDA

View Full Version : new wannabe reverser got a Q. for anyone who can help me please

santa2000
01-05-2001, 06:51 PM
i`m still new in this field (very green)???
i just wanted to know what that means....
like...

call 00414428
mov ecx,[ebx+000001CC]<------that
mov edx,[ebp-08]<------and that
eax eax,[ebp-04]<--------and that

the numbers in [@@@-0@]
what does it do exacly
thank in advance
Clandestiny
01-05-2001, 09:40 PM
santa2000 (01-05-2001 08:51):
i`m still new in this field (very green)???
i just wanted to know what that means....
like...

call 00414428
mov ecx,[ebx+000001CC]<------that
mov edx,[ebp-08]<------and that
eax eax,[ebp-04]<--------and that

the numbers in [@@@-0@]
what does it do exacly
thank in advance

Hi santa2000,

The instructions you marked are move instructions -- in this case they're moving the contents of a memory location [ebp+1CC] into the 32 bit register ecx...IMO, you have a long road ahead of you. You should start by reading some basic tuts on assembly language programming. Once you learn the basic instructions and syntax you'll be able understand some basic cracking /reversing approaches. Read, read, read, and read some more. Also, the newbies forum is an excellent place to begin learning. Good Luck :-)

Regards,
Clandestiny
santa2000
01-05-2001, 10:34 PM
thanks Clandestiny

i have read a lot of tuts and even bought a book
about asm language
i think i`m 10% there
i`m just learning how to read the softice debugger
i have cracked only a couple crackmes[serial fishing]on my own
anyways thank for ya help


Where down softice 4.05 Build 526?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where down softice 4.05 Build 526?
PDA

View Full Version : Where down softice 4.05 Build 526?

1212
01-05-2001, 11:37 PM
Thanxs!;->
Sickman
01-07-2001, 05:41 PM
If it's 526 i don't know
but it is built at
ma. 14 feb 2000 19:46:54

And yoy can find it at a site of mine on

http://www.sickman.to/html/Sickman's Tools.htm
Sickman
01-07-2001, 05:43 PM
[quote]Sickman (01-07-2001 07:41):
If it's 526 i don't know
but it is built at
ma. 14 feb 2000 19:46:54

And you can find it at a site of mine on

http://www.sickman.to

an go to the link sickman's tools
1212
01-08-2001, 04:59 PM
Thanks!
But It is bilide 334.


ms access database - registration code cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ms access database - registration code cracking
PDA

View Full Version : ms access database - registration code cracking

MotorHead
01-06-2001, 03:37 PM
hi,

i'm trying to crack the registration code in MusicManager 3.0 by Customware. its a ms access database.

i've tried al the usual bpx's (hmemcpy, getdlgitemtext,int etc), at the registration details entry box, but none of them work. can anyone help me with this as i'm really stuck!

i should point out that its not a password protected database, it just needs 'registering' like a shareware program.
LaptoniC
01-08-2001, 08:41 AM
Generally it is not so hard to crack this apps.Read my access database cracking tutorial at Fravia http://www.woodmann.net/fravia/msaccess.htm

Regards
MotorHead
01-12-2001, 12:54 PM
thanks for the reply, I'll checkout your tutorial and see what i can learn...

cheers
MotorHead
01-12-2001, 02:32 PM
hello again,

i read your tutorial (and peppers) and did the following. downloaded getaccess '98 and registered it. loaded the 'new' database (with restrictions reset) into access but only see Tables, there are no Modules listed. is this more protection? if so, is there a way round it?

thanks for any help you can give me.

ps - i know nothing about access so please excuse me if i'm being stupid...


InstallShield Package for the Web
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > InstallShield Package for the Web
PDA

View Full Version : InstallShield Package for the Web

golk75
01-06-2001, 10:30 PM
Hi all

Is the a way to unpack a app packaged with this tool, besides just clicking it.

The reason of this is that i downloaded a app from the web ( Like 20 times) & every time i try to unpack it it says not enough space please free 4003mb & try again. The funny part is that this app is only 4mb

Also whats the best way to crack 16bit apps i have an entire program that runs on a hanheld computer, & i want to crack it

thanks ...
SEL
01-07-2001, 05:30 PM
Run Program that packed with IPW,and while it's running go to windows\temp dir,there u find unpacked program files.
Regards,
SEL
golk75
01-09-2001, 07:31 PM
Thats what i do

I run the packeged program, it tries to unpack , then it stalls sayng that it needs 4009mb, while the whole program is only 4mb, & i do have free space like 10gb?

Any suggestions...


Stupid win (or maybe i am :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Stupid win (or maybe i am :)
PDA

View Full Version : Stupid win (or maybe i am :)

stanks
01-07-2001, 12:00 PM
Hi!

I have one "big" problem. The proggy that i compiled with masm (hutch) under Win2000, doesn't work under Win95 (???). I even try to compile it under Win95 and i did it, but when i try to run it win says "This program has performed an illegal...bla bla". What to do?

Thx in advance

Greetz
Muad'Dib
01-07-2001, 01:47 PM
Maybe someone can help if you include the actual error message and maybe some of the code. If you cant figure out what code to put, disassemble the prog and go to the address in the error text...
stanks
01-07-2001, 01:50 PM
Hi Muad'Dib

If you think about error on compiling there is no error and no warning. In windows classic error This program has performed ..."

Greetz
carpathia
01-07-2001, 05:17 PM
Youve tried using a debugging over it on w95 ?
stanks
01-08-2001, 12:00 AM
Hi Carpathia!

I didn't use debugger yet. I will. BTW the source is the same (no change)

Greetz
stanks
01-08-2001, 10:45 AM
This is happening in debugger:

xxxx:xxxxxxxx Call SetWindowTextA
xxxx:xxxxxxxx JMP yyyyyyyy
...
...
yyyy:yyyyyyyy xor eax,eax
yyyy:yyyyyyyy leave
yyyy:yyyyyyyy ret 10

After this ret 10 we are here:

Kernel32!_FreqAsm+xxxx
xxxx:xxxxxxxx mov esp,edi
xxxx:xxxxxxxx xor ecx,ecx
xxxx:xxxxxxxx mov gs,ecx
xxxx:xxxxxxxx pop edi --> when i step over this instruction (SIce), Win is tell me that this program has performed illegal bla bla...
stanks
01-08-2001, 02:02 PM
BTW when i nop this pops (2) in kernel... everything works fine
stanks
01-09-2001, 11:04 AM
Hi

Me again. I solve the problem. I only have to add before push edi, and after, pop edi.

greetz


I get a red screen when softice jumps.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I get a red screen when softice jumps.
PDA

View Full Version : I get a red screen when softice jumps.

edge
01-07-2001, 06:50 PM
I'm trying to reverse a msdos based program and i'm trying to debug it with softice for dos.

I set a breackpoint, i start this program but when it arrives to this point the screen becomes completelly red and i can't see anything, the debuger works, but i see nothing. Is there any tool to make a snapshot of the state or output it to a file(or to the printer) so that i can see what's going on?
NeO'X'QuiCk
01-12-2001, 09:20 PM
Try to use normal Softice 4.02 just work in the doS¨¨!!
Lord Rhesus
01-13-2001, 06:39 PM
Alternatively download the latest version of TRW2000 from protools (or where ever) as it allows you to set breakpoints at the start of DOS programs. However the last version I tried didn't didn't let you set breakpoints on interrupts, but hopefully the new version does. Try it and see!!!


Tool Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tool Question
PDA

View Full Version : Tool Question

Bratsch
01-07-2001, 08:29 PM
If you feel like calling me lame for this request, please go ahead, enjoy.
But I think I am asking for a tool, not warez.
does anybody either have or know where the Sentinel LM SDK is to be found?
The manufacturer took it from its site and all the mirrors.
With my apologies,

Bratsch
?ferret
01-08-2001, 07:02 PM
Check zencrack2.cjb.net ...if it's not there, contact CrackZ ...I'm sure he'll point you in the right direction


RVA ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RVA ???
PDA

View Full Version : RVA ???

Dreadnought
01-08-2001, 07:02 AM
Hi there,

does anybody know what an RVA is Exactly. I think it´s something like an offset, but I´m not sure. I hope someone of you corrects me if I´m wrong.
?ferret
01-08-2001, 07:05 PM
*Someone feel free to shoot me if I'm wrong, it wouldn't be the first time *

I think :-) it's "Relative Virtual Address"

RVA=Base Address + Offset

Base address in win32 is usually 400000 (but not always)
Dreadnought
01-09-2001, 12:49 AM
ReHi,

ThanX....

I don´t think you´re wrong, coz´ I´ve never heard a "more possible" answer till yet.


newbie download
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbie download
PDA

View Full Version : newbie download

Marmora
01-08-2001, 12:49 PM
if you go to reverse software engineering help and support i have left a message about
downloading the viewer and essays. i cant open the viewer. in the file location box of the open dialogue box of my mswindows98 i type "viewer" and get an error message saying incorrect name or path. when i have typed unzipped/viewer which seems correct. i also get a file extension htz which i dont understand so i cant open. Q1
Q2 when i do get it open how do i use it to view the tutorials. i tried to open 1 tutorial but couldnt read it because another error message said it didnt exist. can you please help me to get started.
thanks marmora
stillnewbie
01-09-2001, 10:18 AM
Hi,

this is the viewer
http://www.idca.com/~thesandman/Files/viewer.zip
this are the tuts
http://www.idca.com/~thesandman/Files/orc_tuts.zip
http://www.idca.com/~thesandman/Files/sand_tuts.zip

unzip it and read using the viewer

regards
OeDiFuZz
01-09-2001, 01:27 PM
Marmora (01-08-2001 02:49):

Q2 when i do get it open how do i use it to view the tutorials. i tried to open 1 tutorial but couldnt read it because another error message said it didnt exist. can you please help me to get started.
thanks marmora

Hi Marmora,

Once you've fire up the A1viewer choose the *.HTZ file to load and once you have loaded. Click on the logo (you will know that you're on top of the logo when the mouse cursor changes to a pointing hand). And you'll be able to read the tutorials.


Yay! found this again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Yay! found this again
PDA

View Full Version : Yay! found this again

Argoth
01-09-2001, 05:37 AM
I used to post on the board on Insidetheweb.com, but ur forum got removed.

(Tnx Sel)
Argoth
01-09-2001, 05:45 AM
Uhm, kinda wrong symbol...

:)
JimmyClif
01-09-2001, 06:50 AM
lol... wb... Argoth
stillnewbie
01-09-2001, 10:24 AM
Hi Argoth,

welcome back :D


Portable executables
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Portable executables
PDA

View Full Version : Portable executables

Dreadnought
01-09-2001, 10:27 AM
Hi,

can some one tell me what the difference between portable executables and "normal executables" is?
carpathia
01-10-2001, 02:22 AM
The Portable Exe (PE) is just a term given to all exe's which adhere to the PE format. Just about all the exe's youll deal with will be PE's. Its called portable because all versions of NT use this format, regardless of the machine architecture theyre running on. There's not really such a thing as a 'normal executable', other formats that exist are the old DOS MZ format, LE (16bit Windows and VXD) and NE. Youre unlikely to ever need to know the format of LE/NE.

PE guides can be found at http://carpathia.cjb.net/pe_format.zip

Regards

Carpathia


Off Topic: Spam Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Off Topic: Spam Problem
PDA

View Full Version : Off Topic: Spam Problem

JimmyClif
01-09-2001, 12:06 PM
Greetings everybody,

I do know that this is way off topic but I believe that in this forum there must be a few who know the solution to my problem.

I get spammed recently (well, for two weeks now) by a whole bunch of fscked up internet pron spammers, mailing lists and more. I tried (until now in vain) to get the IP adress of the one who keeps adding me. [I know this sounds funny]

As I haven't given that specific email out for months, I'm clueless who it could be.

Does anyone know how to get close on these spammers?
Or what I see coming:
Does someone know about a email program which has a nice kill list? (Preferably one which kills mails already on the server) (Shareware is o.k. ;D )

Thanks for contributing,
JimmyClif
Argoth
01-09-2001, 05:03 PM
I had the same problem with my hotmail. It didn't exist for even 1 week and I already got spam. Sometimes the spammers just try some adresses, I got mails to a whole list pf ppl like: Argot, Argoth, Agoth and so on. So I made a new account with an underscore at the end. Problem solved. I got Argoth_@hotmail.com and I never had spam in 1 year!

And there are spam killers, just dunno which ones they are. :)

gl
carpathia
01-09-2001, 05:39 PM
The mere fact that youve just included your unmodified email in your post is enough to allow spammers to grab it into their database. Spammers generally run robots which scour the net looking for quoted email addresses, they stop at nothing ;-)
Always try to screw their robots by modifying your email address in such a way that it takes human attention to correct it, before they mail you.

Most decent mail clients will allow you to set up rules based on the header, and just delete the mail from the server. I cant say Ive found a win32 mail client I like a lot, but I use Eudora at the moment. Its not too bad and supports the sort of rules you want

Finally, if you have a domain based email address, where anything before the @ will arrive to you, always use the username to help you track where youre email address was snatched from. IE, if for example you sign up for a newsletter at www.programmersheaven.com, subscribe as progheaven@yourpersonaldomain.com etc... If you suddenly get spammed on that address, you know who to blame.

Carpathia

(btw, im not suggesting programmersheaven are spammers. it was just an example ;-)
JimmyClif
01-10-2001, 02:26 AM
Carpathia & Argoth,

Thanks for trying to help, but I was talking about my POP3 private email account... I never put in on the net at all, and I use it only for business and for a few friends... Nonetheless, I have to say that I possibly gave it to no more than 15 people in 3 years...

Talking about my hotmail address, I have to admit that I don't really care how much it gets spammed... well, it's only a hotmail account and I don't have to download anything if I don't want to read it... not like my other one... (PS: I have up to 25 spams on hotmail on a busy day :) )

Back to topic... I'll definitively try out Eudora... even tho that I've been kinda happy with "TheBat" for a long time, only disadvantage it has, is that the filter rules apply just after downloading...

A question to finish off:

- Hypothetically: If someone grabbed your email address right now and used it to register on various pron lists and such, would it be possible to track that person down somehow?

That's what I suppose what is happening... but reply's to my abuse letters to various places are all unanswered :(

JimmyClif

PS: I hope not that programmersheaven are spammers :D
Argoth
01-11-2001, 05:24 AM
Heh, I can assure u they aren't spammers. Most POP3 accounts also have Telnet support, so u can delete them with Telnet. It has worked for me once when some friend mailed me an MPeg file of 10 Megs. (I have a 28K modem) :)
Eternal Bliss
01-12-2001, 11:35 AM
http://spamcop.net
Muad'Dib
01-12-2001, 10:16 PM
Another problem might be the fact you're using hotmail. Did you add yourself to the directory? That could be the problem...also I wouldn't be surprised if M$ was selling addresses...anything to make a few more $ for gate$.
JAS
01-14-2001, 06:25 PM
Greetzs.
If you setup an email account with Lycos,
they make all of the headers visible.
Not magic by any means, but easier to track down
where it came from. I friend of mine used these headers
to bust sites that sent out unsolicited porn crap.
Many of the return emails weren't real anyways.
After a long email to the involved isps,
he did succeed in getting a couple of them shut down.
For what it's worth anyways.
Take Care.
JAS


Disabled Button on VB 6.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Disabled Button on VB 6.0
PDA

View Full Version : Disabled Button on VB 6.0

golk75
01-09-2001, 05:21 PM
Could somebody tell me how to enable a button in Visual Basic 6.0,

or point me in the right direction of where to find info abot it.

Thanks ...
josephCo
01-10-2001, 10:39 AM
A little more information may be required. Is it native? pcode? URL of program? I'm sure someone will be willing to help if given more specific information.

joe
golk75
01-10-2001, 04:49 PM
I don't know if is native pcode
i know is written in VB6 with no protections at all

the program is not in the web, if you'll like see it i would have to send it to u(100kb)

I have used the customiser to enable the button, but i cant make it permanently
Eternal Bliss
01-11-2001, 05:07 AM
http://ebliss.cjb.net
There are a few tuts on disabled stuff on VB.

Good luck.
NeO'X'QuiCk
01-12-2001, 09:25 PM
REad txt 30, 34 from Elter Bliss site!!!!
golk75
01-12-2001, 10:34 PM
I have tried VB5 crackMe succesfully , is the VB6 that i'm having problems with.

When i load VB6 crackMe into Smartcheck , & check "Show all events" , then click on the + sign next to ( _Load ), it expands, however it does not show any reference to disabled buttons? sometimes no references at all?

When i try the VB5 crackMe it loads ok & it shows all events in Smartcheck. Easy crack.

Any help welcome ...

I am a newbie so please no flaming ...
?ferret
01-13-2001, 01:16 PM
Well....this won't be of "much" use, but if you're using SmartCheck, and it doesn't pop up a MessageBox telling you that it's a p-coded app.....it's native code. Like I said, not much help, but you at least know you need to find info relating to apps compiled to native code for sure.


Where do I start???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where do I start???
PDA

View Full Version : Where do I start???

customx
01-09-2001, 11:49 PM
Where should I start??? What stuff should I download??? What stuff should I read etc??????
Solomon
01-10-2001, 12:11 AM
start from here:
http://blackb.tsx.org
Argoth
01-11-2001, 05:49 AM
http://protools.cjb.net

Find W32Dasm and SoftICe here. Most tutorials work with these programs. Try to disassemble some program to see what it looks like

And read *alot* :)


Icdump (tracex)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Icdump (tracex)
PDA

View Full Version : Icdump (tracex)

hz
01-11-2001, 01:13 PM
Hi,
reading through the docs, tracex appears simple, however using /tracex addr1 addr2
has does nothing so I am obviously doing something wrong. Appreciate any help.

regards
hz
The Owl
01-12-2001, 12:00 PM
reading through the docs, tracex appears simple, however using /tracex addr1 addr2
has does nothing so I am obviously doing something wrong. Appreciate any help.

if you had given more info like when/how you tried to use it, what versions were involved, etc... we could have spared the first round of posts ;P.
hz
01-12-2001, 12:48 PM
Hi Owl,
version is 6.0.1.6. I was trying to trace/find the oep in a pe-crypt(ed) file
and just entered /tracex section_start section_end, had everything enable with the option t switch.
regards
hz
The Owl
01-12-2001, 02:58 PM
version is 6.0.1.6. I was trying to trace/find the oep in a pe-crypt(ed) file
and just entered /tracex section_start section_end, had everything enable with
the option t switch.

1. try 6.021 or 6.022pre, anything before 6.019 had ugly bugs in the tracer.
2. section_start and section_end should have been VAs, not RVAs. did you make
sure you used VAs?
3. enabling all options does not always get you what you want, generally you
should use the default settings and change options as you discover you need
them for a successful trace.
hz
01-12-2001, 04:57 PM
Hi Owl,

I d\l v6.021. Now when I start Icedump I get a black screen, ctrl-d and I have a nice back and white pattern in SI, another ctrl-d and its a really nice red pattern, a couple more ctrl-ds and everything looks fine, got the Icedump loaded message, then I try and load my target and SI has that nice black and white pattern again just before it reboots my machine. Oh I did
get an "Invalid page fault" once so I tried it with faults off. I'm using v3.25 of SI on win95c.

regards
hz
The Owl
01-16-2001, 06:37 AM
I'm using v3.25 of SI on win95c.

ok, this win9x is known to have problems with the export renormalization icedump performs on load, i hope i will have time to put up a new 6.022 pre release at the weekend that will fix this. in the meantime, you can try 6.020, it's still on the site, although not linked (hint: dir listing ;-)).
hz
01-16-2001, 04:57 PM
Hi Owl,
6.020 works for me. Thaks for your help.
regards
hz


Is it possible to insert code?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is it possible to insert code?
PDA

View Full Version : Is it possible to insert code?

Argoth
01-12-2001, 05:21 AM
I want to insert code in an EXE file. Ofcourse it gives an error when I just insert some bytes. Is it possible to do this without some sort of tool, if not, with what tool can I do this?

Greetz
latigo
01-12-2001, 07:02 AM
Howdy! yes , it is very possible to append code to an existing .exe file whose source you don't posses.
heck my tutorial at:
http://gam3room.virtualave.net/Decoding/Win32/Tutorials/CrackedPad.zip

Bye!
Hope that helps!

Latigo
Muad'Dib
01-12-2001, 10:23 PM
Try reading some of the tutorials at http://www.immortaldescendants.org/ and for practice go to http://reversecourse.cjb.net
Argoth
01-13-2001, 01:50 PM
Ok, thanks
Muad'Dib
01-13-2001, 03:48 PM
hehe i forgot...also you can go to my good friend SantMat's site at http://reversemes.cjb.net/ for more practice and tutorials
Lord Rhesus
01-13-2001, 06:29 PM
You could try the site I put up dedicated to this sort of reversing at http://www.codeinjection.cjb.net At the moment it is a library for this sort of thing and currently contains many essays which I have gathered relating to inserting code. Hope it can be of some use.


Finding out which .DLL...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Finding out which .DLL...
PDA

View Full Version : Finding out which .DLL...

Argoth
01-13-2001, 08:09 PM
I am busy editing Quake2, so that when I play a network game, Quake2 will not use the .DLL from the server, but always my own. But...how do I find out where it gets the .DLL? The name of the .DLL is Gamex86.dll.
carpathia
01-13-2001, 10:56 PM
Maybe I dont fully understand your question, but the dll is searched for first in the same directory as the exe, then \windows, \windows\system and system32 dir.

if you still struggle, just use 'MOD gamex86' command in softice while your app is running.

Regards

Carpathia
Argoth
01-15-2001, 03:55 PM
Tnx, but it wasn't really what I meant. (It is my fault though, coz my question wasn't very clear). What I meant was: How do I find out where (at what location in the program) the program loads the .DLL.
And how does a program check if it has a network/I-net connection?

Greetz

Argoth
aimless
01-16-2001, 01:00 AM
Try using Filemon.

It should give you a detailed information whether its opening the GAMExxx.dll from your local machine, or from the server.

:)
latigo
01-16-2001, 10:56 AM
Try bpx LoadLibraryA in softice.
also bpx getprocaddress.

The first one is used to load the dll and the other one is used to get the address of the exported functions.
Good Luck.

Latigo


OCX's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > OCX's
PDA

View Full Version : OCX's

pupp
01-13-2001, 11:34 PM
Greetz all
I am looking for a Tutural on Patching a OCX i did a search but did'ent come up with anything, theres one from Merlinz but its in german, can NE1 help me ?

TIA

pupp
Solomon
01-14-2001, 12:36 AM
Patching OCX is the same as patching EXE. Nothing special.
pupp
01-15-2001, 12:00 PM
Solomon (01-13-2001 14:36):
Patching OCX is the same as patching EXE. Nothing special.
nippon45
01-19-2001, 02:32 AM
Hi

The Sandman has written a little essay on this

http://www.idca.com/~thesandman/sandman.html

its essay number 74.

Try it!
pupp
01-20-2001, 09:31 AM
Thanks Nippon45
i over looked that on +Sandmans page.


PDA's?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PDA's?
PDA

View Full Version : PDA's?

Critter
01-15-2001, 06:50 AM
I have a couple questions, but wanted to find out if anyone here had experience with reversing PalmOS apps?
latigo
01-15-2001, 09:39 AM
Howdy!
Check www.latigo.cjb.net
I wrote two tutes for PDA reversing using different approaches.
Also wrote a tool for .prc reversing.
Hope you like them :)
Bye!

Latigo
Critter
01-15-2001, 01:05 PM
cheers mate.
I'll have a look
Critter
01-15-2001, 01:41 PM
I've actually already been there, but hadn't seen PrcView before, so I grabbed that. perhaps you could assist a bit with this or at least point me in the correct direction:
The program I've been mucking with is called Tank

Talt0834.bin =  Tank Thankyou for registering. OK

0000260e 200a MOVE.L A2,D0
00002610 4fef000a LEA 10(A7),A7
00002614 672e BEQ L213
00002616 2f0a MOVE.L A2,-(A7)
00002618 486df414 PEA -3052(A5)
0000261c 4eba28f2 JSR L437
00002620 486df414 PEA -3052(A5)
00002624 4eba2958 JSR L439
00002628 4a00 TST.B D0
0000262a 4fef000c LEA 12(A7),A7
0000262e 6714 BEQ L213
00002630 3f3c0834 MOVE.W #2100!$834,-(A7)
00002634 4e4fa192 sysTrapFrmAlert
00002638 3f3c03e8 MOVE.W #1000!$3e8,-(A7)
0000263c 4e4fa19b sysTrapFrmGotoForm
00002640 584f ADDQ.W #4,A7
00002642 6016 BRA L215
00002644 3f3c04b0 L213 MOVE.W #1200!$4b0,-(A7)
00002648 4e4fa19b sysTrapFrmGotoForm
0000264c 544f ADDQ.W #2,A7
0000264e 600a BRA L215
00002650 3f3c03e8 L214 MOVE.W #1000!$3e8,-(A7)
00002654 4e4fa19b sysTrapFrmGotoForm
00002658 544f ADDQ.W #2,A7
0000265a 1003 L215 MOVE.B D3,D0
0000265c 4cdf0c08 MOVEM.L (A7)+,D3/A2/A3
00002660 4e5e UNLK A6
00002662 4e75 RTS

I thought that branching above 2630 would bring my desired results, but no luck.
latigo
01-16-2001, 10:53 AM
Hi there. To tell you where and/or how to patch i'd need the whole disasm. But again, i'm very short of time so i'm sorry but i won't be able to help you. :(
Anyway, if you want tell me the url for Tank and i'll see what i can do.
Bye

Latigo
carpathia
01-16-2001, 03:56 PM
You'll also find a compilation of palm cracking tools, from various corners of the net, at

http://carpathia.cjb.net/PilotTools.zip

Regards

Carpathia
Critter
01-17-2001, 10:26 PM
latigo (01-16-2001 00:53):
Hi there. To tell you where and/or how to patch i'd need the whole disasm. But again, i'm very short of time so i'm sorry but i won't be able to help you. :(
Anyway, if you want tell me the url for Tank and i'll see what i can do.
Bye

Latigo

No worries mate. I'm gonna give it some more mucking with before I give in. Thanks though, I'll bug you when I'm really stuck :)

Carpathia: Thanks for the tools


FrogsIce - How to Set It Up?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FrogsIce - How to Set It Up?
PDA

View Full Version : FrogsIce - How to Set It Up?

pusspuss
01-15-2001, 08:40 PM
This is a repeat post from the TOT forum.

Would someone please explain WHICH system driver is to be copied to FrogsIce loader or wherever else in order to allow FrogsIce to run.

>( >( >(

Thanks.
aimless
01-16-2001, 12:58 AM
It all boils down to 2 things. What is UR OS?

If it is Win95, then there is a vxd in the Win95 folder

If it is Win98 then there is a vxd in the Win98 folder.

Copy the appropriate vxd (from 95 directory for Win95 machs. and from 98 directory for the Win98 ones), to the main directory where frogsice.exe is located.

That's all.

NB: FICE Does not work for NT. If you have NT, I'd suggest you get NTICE from protools.cjb.net

:)
pusspuss
01-16-2001, 06:05 AM
:) Thanks for your post aimless.
I was looking in the c:\windows\system area for the vxd file instead of within FrogsIce itself.

The instructions that come with FI were not clear to me! ??? ;p


SmatCheck Tutorial ...Where to find ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SmatCheck Tutorial ...Where to find ?
PDA

View Full Version : SmatCheck Tutorial ...Where to find ?

golk75
01-15-2001, 08:54 PM
Does any body know where to find tutorials on Smartcheck , good ones specially for dealing with Visual Basic 6.0 programs .

Thanks alot ...
the snake
01-15-2001, 11:57 PM
Hi golk75

A nice collection of VB tutorials can be found on Eternal bliss's site :

http://users1.50megs.com/oreland2043b/
You'll find there a lot of VB related stuff..

I'm sure there are some other sites..

the snake
golk75
01-16-2001, 05:27 PM
Hi,Snake

The problem is that i dont get the same result in smartcheck for VB6 as i do for VB5 programs

I have done all the settings as Eternal Bliss appointed, but no change

I'm having this problem with Eternal Bliss VB6 crackMe's only, all other VB5 crackMe's work just fine

Do you think that i could be the version that i'm using(6.03)?

Thanks ...
the snake
01-17-2001, 01:38 PM
Hi Golk75
SM Ver 6.03 is a VERY fine version, have no idea what makes it not to show what you expect from it.
Hope someone more experience with VB6 will read this and can help.
Maybe, try to contact with EB, if he have the time, he will help... (EB, don't kill me, you're the VB expert)
the snake
golk75
01-17-2001, 05:13 PM
Thanks ,

I tried contacting EB but his Page says ,

That he has no internet connection 'till the end of 2001...

Thats a long way to wait lol ...
Eternal Bliss
01-24-2001, 05:45 AM
Hiya,
not sure why. But I rechecked my settings of Smartcheck according to what is written on my website and then retried my crackme and everything is shown as before.
Did you choose "Show All Events" after clicking on the "Load" line?

Regards
the snake
01-24-2001, 09:17 AM
Hi EB
Nice to see you around, most of the "old" friends are gone... i think..

Hope evrything in your real life is ok..

Regards
the snake
golk75
01-31-2001, 10:52 PM
Hi, EB

i did all the settings like the ones on your Web site , no luck, i did choose show all events , no luck ,

Whats weard though is that the VB5 crack me works just as mentioned in the tut?

Oh well , i'll keep on trying ...

i'm running win 2000, could that afect the output?

maybe i need some runtime files ?

Thanks for your time and replay ...
Lord Soth
02-01-2001, 07:26 PM
Is the program Pcoded ??

LS
iNFiNiTY
02-03-2001, 03:37 PM
Tutorials in SmartCheck (VB5, VB6, P-Code, crackmes) here:

http://infinity2001.cjb.net
golk75
02-05-2001, 11:06 PM
Thanks man ...


VB API's What the heck are these ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB API's What the heck are these ?
PDA

View Full Version : VB API's What the heck are these ?

MaTRiX_2k
01-16-2001, 01:30 PM
Hello All,

I have been trying to solve this crackme, called VB Crackme v 2.0 by
Eternal_Bliss (from http://crackmes.cjb.net). I am able to see my fake
serial being tossed around, but Iam unable to comprehend what is being
done with it. As a result Iam not able to solve the crackme.

These are some of the interesting API's I found out.
Please help me with them.I don't know what they do.
I know this is a very long list. If not an explanation of each of these
API's, please tell me the source from where I can learn about them, or
please explain only the important one's.

Any help will be greatly appreciated by this SuperDumb Newbie.

1.) __vbaVarMove
2.) __vbaFreeStrList
3.) __vbaI4Var
4.) __vbaVarCopy
5.) __vbaVarForNext
6.) __vbaFreeStr
7.) __vbaFreeObj
8.) rtcR8ValFromBstr
9.) rtcMidCharVar
10.) __vbaStrCmp
11.) __vbaVarTstEq
12.) __vbaVarCat
13.) __vbaFreeVar
14.) __vbaLenBstr
15.) __vbaFreeVarList
16.) __vbaEnd
17.) rtcAnsiValueBstr
18.) __vbaHresultCheckObj
19.) __vbaVarForInit
20.) __vbaObjSet

also WideCharToMultiByte & MultiByteToWideChar (I think these are very
interesting API's in the context of this crackme)

Sorry for the trouble. Hope I can share this knowledge you give me, with my fellow newbies.

Thankyou Once Again.

With Regards
MaTRiX
?ferret
01-16-2001, 08:37 PM
Hola,

That's quite the list, so instead of going line by line, I'll just give you a nudge to help yourself a bit ;-)

Most API's are fairly self explanatory with a little thought...

var = variant (more or less...variable)
str=string
cmp=compare
free=release from memory(more or less)
alloc=allocate to memory
i4=4 byte integer (i think)
cpy=copy

etc.....

multibyte to widechar take a string from regular text(multibyte) to unicode(widechar format)

hope that helps you out a little
Eternal Bliss
01-17-2001, 04:55 AM
http://ebliss.cjb.net


new newbie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new newbie
PDA

View Full Version : new newbie

ironlung
01-16-2001, 04:40 PM
so I got softice and tried version 3.2 and 4.05, but all it does is freeze windows (98). How do I stop this from happening?? Should I get version 2 and apply the icepatch, or something else?? I appreciate any help. Maybe I just need some of them drugs :).
Argoth
01-18-2001, 05:22 AM
Heh, thats what SoftICE does. It freezes windows so u can see whats going on. Try to press F10 a few times :)
Maybe u should read some tutorials about SoftICE
Clandestiny
01-18-2001, 12:57 PM
ironlung (01-16-2001 06:40):
so I got softice and tried version 3.2 and 4.05, but all it does is freeze windows (98). How do I stop this from happening?? Should I get version 2 and apply the icepatch, or something else?? I appreciate any help. Maybe I just need some of them drugs :).

By freezing Windoze do you mean that this is occuring before or during bootup (ie. a protection or page fault causing the freeze?). If this is so, you could try turning off the faults option in the winice.dat.

Regards,
Clandestiny


Installshield CABS - uncompressing/adding to/recompressing question.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Installshield CABS - uncompressing/adding to/recompressing question.
PDA

View Full Version : Installshield CABS - uncompressing/adding to/recompressing question.

Cheryl M Paine
01-16-2001, 05:14 PM
I wanted to snoop around the CAB files that Norton AntiVirus uses - but found that they were not Microsoft CAB format (CAB Viewer wouldn't open them).

I saw a installshield decompressor here, but it didn't work.

Is there any way to open those CAB files to add, replace, or remove files?

Sorry for a dumb question, but I just want to see inside the cabs and can't.
Morlac
01-18-2001, 01:17 PM
Cheryl M Paine (01-16-2001 07:14):
I wanted to snoop around the CAB files that Norton AntiVirus uses - but found that they were not Microsoft CAB format (CAB Viewer wouldn't open them).

I saw a installshield decompressor here, but it didn't work.

Is there any way to open those CAB files to add, replace, or remove files?

Sorry for a dumb question, but I just want to see inside the cabs and can't.

a new version of the installshield comp utility has been released.
It should work. You cabn get it from protools.cjb.net
Its version 0.20
Hope that will help.

Regards,
Morlac
Morlac
01-18-2001, 01:18 PM
Sorry, the prog. is called I6Comp ver0.20


unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking
PDA

View Full Version : unpacking

Scally6
01-16-2001, 06:49 PM
where can I find a tut(s) on unpacking progs such as early 32bit pecomp & v2 of softsentry, please? Whilst its easy enough to get round these from a pure cracking pov, I'd really like to understand what they're doing. All I've found so far is derision frompeople saying what naff protections they are - well maybe they are but I'd like to understand them for myself - & I've spent hours playing in an uneducated way to no avail.
With Softsentry, 20/20 seem to be out of business & I could only find a V3 demo with dogpile.
I have a couple of progs I'd like to examine - one of each - can anyone point me in the right direction, please?
(Ps I've done numerous tuts on other prot systems which are fine but I can't seem to transfer the learning to the above progs.
tia
Scal
Kayaker
01-16-2001, 08:02 PM
Hi Scally,

There's a tut by LSD on SoftSentry 2.7 at Krobar's:

http://whateverhosting.com/krobar/other/other26.htm

I think there's a few things he doesn't mention about SS2 though. I'll try to dig up my notes, but SS uses 3 registry entries as reg/time checks - SSRandom, some cryptic entry in the main HKCR (something like [r%#y7h&*..), and one other one that eludes me right now. Sorry for being vague but I just wanted you to watch out for them.

Also, and be careful with this one, it modifies your Winhlp32.exe file, or if it can't find it, your Winhelp.exe file (adds 30 bytes or so to the end). So back 'em up or get fresh ones from your sysbackup dir.

Don't know about pecomp, Krobar's got a good selection there.

Regards,
Kayaker
Scally6
01-17-2001, 12:44 PM
Hi Kayaker, Thanks. It seems to use three reg entries:
ss_random, a system specific one in hkcr which starts { & ends in } and another in hkcr\SystemAppIDs. It also adds access.ctl & a dll with the app's name in windows system. (Deleting the keys & the ctl file gives another 30 days.)
I wasn't aware of the winhlp32.exe alteration, so thanks I'll check it & also the tut.
The exe/dll/ctl file & reg entries don't specify the sentry version & although I could find the jump to allow any key to tempy reg it (until restart), it seems to use several seeds to generate the checks & the final compare is to an integer, so there's no place where the real s/r appears.
Regards
Scally
Scally6
01-17-2001, 12:50 PM
Hi Kayaker,
I've seen the Krobar tut - unfortunately the prog I have isn't 2.07 (or 3.00) & its coded differently. The 'unique' sequence of hex isn't in the exe or dll associated.
I've tried several different file info progs & looked at both exe & dll in hexworks but theres no ref to the version number.
PS did SV send you the TA dump? I can't see how he did it.
Kayaker
01-17-2001, 03:25 PM
Hi Scally,

Yeah, SystemAppIDs, that was the name of the other Reg entry. OK, if this one uses access.ctl then it's probably not V2.x-ish, which uses ss.drv as a bogus check file instead. In which case, forget the alteration of winhlp32, because I think it only does that in the earlier versions (I remember because I got burned with it ;)

No, I haven't seen anything from TA, I'll try to have a look at it. What's this SS file you're looking at?

Kayaker
Scally6
01-17-2001, 04:42 PM
Hi Kayaker, yeah, the reason I didn't mention the file was I don't think its about on the net (not really looked, even at the site below) but it was from a mag. cover (www.computershopper.co.uk) issue 155,Jan 2001. Prog. is Autostreet 2000, a mapping program with gps interface.
You're right about winhlp32.exe - no change there.
I've also heard from SV with the rebuilt file but not had time to play with it yet.
Keep you posted
Thanks for your help
Scally


Reversing CD Is it OK to "burn"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reversing CD Is it OK to "burn"
PDA

View Full Version : Reversing CD Is it OK to "burn"

plaster
01-17-2001, 12:18 AM
On the previous board, I noted the site for RE CD download. I downloaded all files, but noted that one of the posts suggested that there were virii included on the site. I have lost the instructions for creating the CD from the downloaded files, but would like to make sure that I don't inadvertently include virii. Does a virus checker find these before they are processed? I'd like to assist with distribution if that is still required, but don't want to mess people up with stupid virus inclusions
Clandestiny
01-17-2001, 09:42 PM
plaster (01-16-2001 14:18):
On the previous board, I noted the site for RE CD download. I downloaded all files, but noted that one of the posts suggested that there were virii included on the site. I have lost the instructions for creating the CD from the downloaded files, but would like to make sure that I don't inadvertently include virii. Does a virus checker find these before they are processed? I'd like to assist with distribution if that is still required, but don't want to mess people up with stupid virus inclusions

Hi plaster,

At one point there were some virus problems with the RCE cd. I actually got a copy after it had been "cleaned" and my cd has a file with a record of the original virus scan and reported hits. I'll be happy to send the file for your reference if you email me.

Regards,
Clandestiny


Adding code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Adding code
PDA

View Full Version : Adding code

KoKaInE
01-17-2001, 10:56 AM
Im reversing a delphi crackme and decided to make it a keygen by adding some code. I was looking at the APIs and found SetWindowTextA
was already used. I need to push the serial and the hwnd of the editbox. I know where the valid serial is, but I dont know what to push for the hwnd. Any ideas how to find it?

Thanks for all the help.
JimmyClif
01-17-2001, 12:07 PM
Go back to your disassembled code and have go to the SetWindowTextA function... the last push before the call is the hwnd. If this last push is for example "push eax" try to find out where eax got the hwnd from...

JimmyClif
JimmyClif
01-17-2001, 12:11 PM
Oops sorry I was talking nonsense...

You have to find out the hwnd of the edit window (your want to post to) itself... so better use our beloved SoftIce and break on it posting messages to it or getting messages from it... then you have the correct hwnd...

Here is the API explained:

BOOL SetWindowText(

HWND hWnd, // handle of window or control
LPCTSTR lpString // address of string
);

Or getting text API:

int GetWindowText(

HWND hWnd, // handle of window or control with text
LPTSTR lpString, // address of buffer for text
int nMaxCount // maximum number of characters to copy
);

Otherwise you may get the hwnd from an completly different window/control,

Sorry if this was a little bit confusing.
JC
Kayaker
01-17-2001, 12:17 PM
Hi,

Maybe you could use GetDlgItem

-------------------------------
The GetDlgItem function retrieves the handle of a control in the specified dialog box.

HWND GetDlgItem(

HWND hDlg, // handle of dialog box
int nIDDlgItem // identifier of control
----------------------------------

The Hwnd of the dialog box you should be able to get from its CreateWindowExA return value.

The ID of the edit box control you might be able to get with GetNextDlgGroupItem or GetNextDlgTabItem

-----------------------------------
The GetNextDlgGroupItem function retrieves the handle of the first control in a group of controls that precedes (or follows) the specified control in a dialog box.

HWND GetNextDlgGroupItem(

HWND hDlg, // handle of dialog box
HWND hCtl, // handle of control
BOOL bPrevious // direction flag

--------------------------------------------

The GetNextDlgTabItem function retrieves the handle of the first control that has the WS_TABSTOP style that precedes (or follows) the specified control.

HWND GetNextDlgTabItem(

HWND hDlg, // handle of dialog box
HWND hCtl, // handle of known control
BOOL bPrevious // direction flag

Hope this helps,

Kayaker
JimmyClif
01-17-2001, 12:20 PM
Hi Kayaker,

Nice to see you around ;D
Kayaker
01-17-2001, 12:40 PM
You too JClif ^_^

Kayaker
Kayaker
01-17-2001, 05:07 PM
er, I guess I should have said GetDlgCtrlID to get the ID of a control, but between them all you should be able to make it work ;)

The GetDlgCtrlID function returns the identifier of the specified control.

int GetDlgCtrlID(

HWND hwndCtl // handle of control


Some question about sice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Some question about sice
PDA

View Full Version : Some question about sice

Juergen
01-18-2001, 12:56 AM
Hi,
i have some Question about Sice and others.

So, who does sice set a breakpoint into a target ?
Must Sice really set a code into the target adress or happens it on other a way?
How looks it by tracing ?
Is there sice setting breakpoint after breakpoint ( surely by refeshing the old code after left the instuction before )?

Or can a target be traced step by step without insert any code from the debugger ?

Greetings from germany

Juergen
Argoth
01-18-2001, 05:48 AM
Hi, SI just sets a breakpoint on the target or on API calls. I don't know how SI sets a breakpoint, but I don't think it adds code to the program.
When tracing the program, it is highlighted (at least in version 3.2).
U can trace the target while its running. When you press F10 while you are in the code, you will be able to follow it step by step.
Clandestiny
01-18-2001, 01:25 PM
Juergen (01-17-2001 14:56):
So, who does sice set a breakpoint into a target ?
Must Sice really set a code into the target adress or happens it on other a way?
Juergen

Hi,
Technically speaking, Sice does insert a code. For execution type (bpx) breakpoints, an int 3 command is set at the target address. This interrupt command signals that a breakpoint has occured, halts program execution, and pops up Sice at the target location.

Or can a target be traced step by step without insert any code from the debugger ?

To my knowledge, the int 3 is an internal interrupt and is essential for halting the program execution via breakpoints. I don't think it would be possible to trace a target without it. Fortunately, the operating system handles these messy details and we don't need to worry about them when reversing a target.

Hope this answers your question.

Regards,
Clandestiny
Bratsch
01-18-2001, 10:40 PM
Juergen (01-17-2001 14:56):
Hi,
i have some Question about Sice and others.

So, who does sice set a breakpoint into a target ?
Must Sice really set a code into the target adress or happens it on other a way?

It does. At the BPX address a Hex CC (int3) byte is written. When the interrupt is called and trapped by SoftIce it takes control and its screen pops up. The first thing Sice does is to replace the CC in the screen with the original byte from the code of the app so you don't see it.However, in memory mapped programs, like the ones generated by Delphi, the temporary CC code gets actually written in the DISK of the code producing surprising results if you don't dissable the BPXs before quiting the application.

How looks it by tracing ?
Is there sice setting breakpoint after breakpoint ( surely by refeshing the old code after left the instuction before )?

I might be wrong about this but there is a CPU flag called T(rap) which is clear (0) most of the time. Debuggers change that flag to 1, what tells the CPU: "execute the next instruction, the return the control to me". So debuggers don't need to constantly modify the code ahead of them, the hardware has a service that handles it for them. (this was truth for the debugger used by MSDOS, when I was young. I do not know if the more advanced , multitasking, CPU have a different approach. I doubt it, because when Sice is active, not even the system Clock ticks: notice how your system time gets behind when you use Sice).

Or can a target be traced step by step without insert any code from the debugger ?

Greetings from germany

Juergen

More expert explanations welcome.

Bratsch
Bratsch
01-18-2001, 10:42 PM
Juergen (01-17-2001 14:56):
Hi,
i have some Question about Sice and others.

So, who does sice set a breakpoint into a target ?
Must Sice really set a code into the target adress or happens it on other a way?

It does. At the BPX address a Hex CC (int3) byte is written. When the interrupt is called and trapped by SoftIce it takes control and its screen pops up. The first thing Sice does is to replace the CC in the screen with the original byte from the code of the app so you don't see it.However, in memory mapped programs, like the ones generated by Delphi, the temporary CC code gets actually written in the DISK of the code producing surprising results if you don't dissable the BPXs before quiting the application.

How looks it by tracing ?
Is there sice setting breakpoint after breakpoint ( surely by refeshing the old code after left the instuction before )?

I might be wrong about this but there is a CPU flag called T(rap) which is clear (0) most of the time. Debuggers change that flag to 1, what tells the CPU: "execute the next instruction, the return the control to me". So debuggers don't need to constantly modify the code ahead of them, the hardware has a service that handles it for them. (this was truth for the debugger used by MSDOS, when I was young. I do not know if the more advanced , multitasking, CPU have a different approach. I doubt it, because when Sice is active, not even the system Clock ticks: notice how your system time gets behind when you use Sice).

Or can a target be traced step by step without insert any code from the debugger ?

Greetings from germany

Juergen

More expert explanations welcome.

Bratsch


Flexlm 6.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Flexlm 6.1
PDA

View Full Version : Flexlm 6.1

shymu
01-18-2001, 08:48 AM
I have been working on a program that requires a license.dat I used KeyGen 2000 to find my 5 keys and 2 seeds. The license
generated didn't work,.... yeh I know a lame way to try. So after reading some essays I found the keys in my target, to verify
them. Now to my question. I'm trying to generate a key for Flelm 6.1 and after reading essays on this I'm stuck. CrackZ site has
keys but they install Flexlm in a demo mode. By following an essay I found a key and changed the last 2 numbers (00-99) and
still no luck. Is there a program to gen the keys so I can try again. I just can't bear the thought of entering them by hand again.
I read the tut on making bat files and a macro to do this but I'm lost!
shymu
01-18-2001, 08:08 PM
Hey !! I got it !! Generated at license and it worked. What a rush to do it on my own,... well with help from tut's
Perry
01-23-2001, 05:04 PM
Where I can to find KeyGen 2000?

shymu (01-17-2001 22:48):
I have been working on a program that requires a license.dat I used KeyGen 2000 to find my 5 keys and 2 seeds. The license
generated didn't work,.... yeh I know a lame way to try. So after reading some essays I found the keys in my target, to verify
them. Now to my question. I'm trying to generate a key for Flelm 6.1 and after reading essays on this I'm stuck. CrackZ site has
keys but they install Flexlm in a demo mode. By following an essay I found a key and changed the last 2 numbers (00-99) and
still no luck. Is there a program to gen the keys so I can try again. I just can't bear the thought of entering them by hand again.
I read the tut on making bat files and a macro to do this but I'm lost!
shymu
01-24-2001, 11:49 AM
http://zencrack2.cjb.net/

On the Flexlm page


Tracing into Dll's?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tracing into Dll's?
PDA

View Full Version : Tracing into Dll's?

Argoth
01-18-2001, 03:31 PM
Hello all, I need your help again :)

Is it possible to trace into a .DLL? Like in ICQ, I want to trace in to the ICQInfo.dll. If yes, how do I do this?

Greetz

Argoth
Muad'Dib
01-18-2001, 05:25 PM
You will see a CALL instruction to an address. Just press F8 to trace into a call, instead of over it.
latigo
01-18-2001, 09:37 PM
It all depends on what you want to do and how.
If you want to break when icq LOADS that specific dll then you could try this:
Before launching icq set a breakpoint on 'LoadlibraryA'. This API is used for dll loading. Of course softice will pop up many times. But after you f12 from that breakpoint ,check the parameters pushed looking for the name of the dll you are interested in.

Another thing to do is to disasm the dll, search for some interesting exported functions and then breakpoint them with softice. To do this, launch icq and when in softice do a 'mod icq'. This will show all loaded modules in memory and their respective base addresses. Take note of the base address of the desired dll, add the offset belonging to the piece of code you want to breakpoint and put a bpx there.
Thats two of the many options you got.
Hope i did not get it wrong :)
Cya mate.

Latigo
Bratsch
01-18-2001, 10:55 PM
Argoth (01-18-2001 05:31):
Hello all, I need your help again :)

Is it possible to trace into a .DLL? Like in ICQ, I want to trace in to the ICQInfo.dll. If yes, how do I do this?

Greetz

Argoth

You can also Hexedit the .dll you want to trace into (saving a good copy of course) and place a hex CC (int 3) byte into the exact site you want Sice to break. when Sice breaks you need to manually change the CC byte to its original value using the Sice memory edition services, otherwise the program will surely crash, then go your merry way tracing and/or setting other BPX inside the dll code.

Hope this helps,

Bratsch
Argoth
01-22-2001, 03:35 PM
Hmm, must be me, but when I do mod ICQ, the Base of ICQcore.exe is something like 22000000. I want it to break at 24101210 (just an example), so I type: bpx 21880000:24101210. It tells me its an Invalid Sector. What am I doing wrong?

Argoth


.prf files? (maybe hehe)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > .prf files? (maybe hehe)
PDA

View Full Version : .prf files? (maybe hehe)

?ferret
01-18-2001, 08:15 PM
HI all,

I'm working on a proggy called VirtuaGirl....yup, it's what it sounds like LOL....

Anyway, the critical compare took about 1.1 seconds to find, but as the code is used for online downloads, a patch here is worthless.

A number generated by some math on my serial (I haven't found all of this yet, just see the results), this result is then compared with the value at an address. When I bpm this addy, it breaks on WriteFile several times. The file being accessed is vg.prf.

The number generated from my serial is multiplied by 15D70h and then compared to the number at the address, which ends up being 28h......this is an impossible test isn't it? (meaning a certain serial pattern may change the number at the address too?)

I'm not done digging through this yet, but if someone has any pointers/ideas, I'd be grateful.

It can be found at www.virtuagirl.com
Kayaker
01-19-2001, 01:58 AM
Hi ?ferret,

Heh heh, it's good to see there's still some quality xxhareware programs around. I like your tastes ^_^

I'm wondering if the s/n is not used for the actual online downloads, but rather it just allows you to view the d/l's with the proggy once you've got them, or maybe it just gets rid of the nag. If you go to the site you still have to access the members section with a valid name and p/w, the usual dealy which would require site hacking (which I know diddly about).

Re the program, the value derived from your s/n that is multiplied by 15D70 is your s/n in hex (why I always use 998899 - converts to an easily recognizable 0F3DF3)

0040AAC6 call ds:GetDlgItemTextA ;get s/n (name not used)
0040AACC push esi
0040AACD call sub_40D484 ;convert to hex
0040AAD2 pop ecx
0040AAD3 mov esi, eax
0040AAD5 call sub_403008 ;something to do with WriteFile vg.prf
0040AADA imul esi, 15D70h
0040AAE0 mov eax, dword_41EAC8
0040AAE5 push ebx
0040AAE6 cmp esi, [eax+14h]
0040AAEE push esi
0040AAEF jnz short loc_40AAF5 ;good/bad cracker message

For me, the value in [eax+14h] varied: 50h, 64h, 3Ch. The address itself also varied, but seemed to be a reference in the file anim.prf. If I changed the value in memory so it matched what ESI was (s/n in hex * 15D70), then it was written into anim.prf, but later got overwritten.

It's all kind of weird, these .prf files are being continually updated and are PICS Rules files for the Content Advisor feature of IE. Do you think a s/n would be stored in one of these?

My suggestion is hack the site and get some full d/l's ;)

Cheers,

Kayaker
?ferret
01-19-2001, 03:25 PM
I get different addresses for [eax+14] also, but it's always the same place in the file ;-)

hmm....for me, the value there is ALWAYS 28h....but even with the values you're getting it's an impossible compare to satisfy, right? ???

btw....what's up w/ the disassembly (I haven't tried w/ IDA) ....no code at all & if it's packed, I can't figure out what with....
Kayaker
01-19-2001, 06:54 PM
Re the disassembly, this seems to be the problem again with W32Dasm getting confused with proggys that have Resources that are Named instead of being identified with an ID, in this case the bitmaps. If you delete the .rsrc section completely, or otherwise render it unrecognizable by editing its header section, W32Dasm has no problems disassembling the .text section.

It might be an interesting reversing exercise to find out WHY W32Dasm seems limited this way. (Are you listening Harlequin? ^_^) I don't remember the name of the other program this happened with a few months ago.

You're right, that 0040AAE6 cmp esi, [eax+14h] makes no sense when its only 1 byte being compared. And yet I don't see how it could be anything else when that address is from a file that's constantly being overwritten anyway.


Font
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Font
PDA

View Full Version : Font

xxx
01-19-2001, 01:16 PM
Hi

I am using dialog box as main window. I am trying to change font, but it doesn't work. I can't change it (i don't see the difference, font is always the same). The question is: Can i change this font, and if i can, how?

Thanks
?ferret
01-19-2001, 03:41 PM
you didn't specify a language...but here's a bit of C++ documentation...

"CFont::CreateFont
BOOL CreateFont( int nHeight, int nWidth, int nEscapement, int nOrientation, int nWeight, BYTE bItalic, BYTE bUnderline, BYTE cStrikeOut, BYTE nCharSet, BYTE nOutPrecision, BYTE nClipPrecision, BYTE nQuality, BYTE nPitchAndFamily, LPCTSTR lpszFacename );

Return Value

Nonzero if successful; otherwise 0.

Parameters

nHeight

Specifies the desired height (in logical units) of the font. The font height can be specified in the following ways:

Greater than 0, in which case the height is transformed into device units and matched against the cell height of the available fonts.

Equal to 0, in which case a reasonable default size is used.

Less than 0, in which case the height is transformed into device units and the absolute value is matched against the character height of the available fonts.
The absolute value of nHeight must not exceed 16,384 device units after it is converted. For all height comparisons, the font mapper looks for the largest font that does not exceed the requested size or the smallest font if all the fonts exceed the requested size.

nWidth

Specifies the average width (in logical units) of characters in the font. If nWidth is 0, the aspect ratio of the device will be matched against the digitization aspect ratio of the available fonts to find the closest match, which is determined by the absolute value of the difference.

nEscapement

Specifies the angle (in 0.1-degree units) between the escapement vector and the x-axis of the display surface. The escapement vector is the line through the origins of the first and last characters on a line. The angle is measured counterclockwise from the x-axis.

nOrientation

Specifies the angle (in 0.1-degree units) between the baseline of a character and the x-axis. The angle is measured counterclockwise from the x-axis for coordinate systems in which the y-direction is down and clockwise from the x-axis for coordinate systems in which the y-direction is up.

nWeight

Specifies the font weight (in inked pixels per 1000). Although nWeight can be any integer value from 0 to 1000, the common constants and values are as follows:

Constant Value
FW_DONTCARE 0
FW_THIN 100
FW_EXTRALIGHT 200
FW_ULTRALIGHT 200
FW_LIGHT 300
FW_NORMAL 400
FW_REGULAR 400
FW_MEDIUM 500
FW_SEMIBOLD 600
FW_DEMIBOLD 600
FW_BOLD 700
FW_EXTRABOLD 800
FW_ULTRABOLD 800
FW_BLACK 900
FW_HEAVY 900

These values are approximate; the actual appearance depends on the typeface. Some fonts have only FW_NORMAL, FW_REGULAR, and FW_BOLD weights. If FW_DONTCARE is specified, a default weight is used.

bItalic

Specifies whether the font is italic.

bUnderline

Specifies whether the font is underlined.

cStrikeOut

Specifies whether characters in the font are struck out. Specifies a strikeout font if set to a nonzero value.

nCharSet

Specifies the font’s character set. The following constants and values are predefined:

Constant Value
ANSI_CHARSET 0
DEFAULT_CHARSET 1
SYMBOL_CHARSET 2
SHIFTJIS_CHARSET 128
OEM_CHARSET 255

The OEM character set is system-dependent.

Fonts with other character sets may exist in the system. An application that uses a font with an unknown character set must not attempt to translate or interpret strings that are to be rendered with that font. Instead, the strings should be passed directly to the output device driver.

The font mapper does not use the DEFAULT_CHARSET value. An application can use this value to allow the name and size of a font to fully describe the logical font. If a font with the specified name does not exist, a font from any character set can be substituted for the specified font. To avoid unexpected results, applications should use the DEFAULT_CHARSET value sparingly.

continued....
?ferret
01-19-2001, 03:42 PM
nOutPrecision

Specifies the desired output precision. The output precision defines how closely the output must match the requested font’s height, width, character orientation, escapement, and pitch. It can be any one of the following values:

OUT_CHARACTER_PRECIS OUT_STRING_PRECIS
OUT_DEFAULT_PRECIS OUT_STROKE_PRECIS
OUT_DEVICE_PRECIS OUT_TT_PRECIS
OUT_RASTER_PRECIS

Applications can use the OUT_DEVICE_PRECIS, OUT_RASTER_PRECIS, and OUT_TT_PRECIS values to control how the font mapper chooses a font when the system contains more than one font with a given name. For example, if a system contains a font named Symbol in raster and TrueType form, specifying OUT_TT_PRECIS forces the font mapper to choose the TrueType version. (Specifying OUT_TT_PRECIS forces the font mapper to choose a TrueType font whenever the specified font name matches a device or raster font, even when there is no TrueType font of the same name.)

nClipPrecision

Specifies the desired clipping precision. The clipping precision defines how to clip characters that are partially outside the clipping region. It can be any one of the following values:

CLIP_CHARACTER_PRECIS CLIP_MASK
CLIP_DEFAULT_PRECIS CLIP_STROKE_PRECIS
CLIP_ENCAPSULATE CLIP_TT_ALWAYS
CLIP_LH_ANGLES

To use an embedded read-only font, an application must specify CLIP_ENCAPSULATE.

To achieve consistent rotation of device, TrueType, and vector fonts, an application can use the OR operator to combine the CLIP_LH_ANGLES value with any of the other nClipPrecision values. If the CLIP_LH_ANGLES bit is set, the rotation for all fonts depends on whether the orientation of the coordinate system is left-handed or right-handed. (For more information about the orientation of coordinate systems, see the description of the nOrientation parameter.) If CLIP_LH_ANGLES is not set, device fonts always rotate counterclockwise, but the rotation of other fonts is dependent on the orientation of the coordinate system.

nQuality

Specifies the font’s output quality, which defines how carefully the GDI must attempt to match the logical-font attributes to those of an actual physical font. It can be one of the following values:

DEFAULT_QUALITY Appearance of the font does not matter.

DRAFT_QUALITY Appearance of the font is less important than when PROOF_QUALITY is used. For GDI raster fonts, scaling is enabled. Bold, italic, underline, and strikeout fonts are synthesized if necessary.

PROOF_QUALITY Character quality of the font is more important than exact matching of the logical-font attributes. For GDI raster fonts, scaling is disabled and the font closest in size is chosen. Bold, italic, underline, and strikeout fonts are synthesized if necessary.

continued...
?ferret
01-19-2001, 03:43 PM
nPitchAndFamily

Specifies the pitch and family of the font. The two low-order bits specify the pitch of the font and can be any one of the following values:

DEFAULT_PITCH VARIABLE_PITCH FIXED_PITCH

Applications can add TMPF_TRUETYPE to the nPitchAndFamily parameter to choose a TrueType font. The four high-order bits of the parameter specify the font family and can be any one of the following values:

FF_DECORATIVE Novelty fonts: Old English, for example.

FF_DONTCARE Don’t care or don’t know.

FF_MODERN Fonts with constant stroke width (fixed-pitch), with or without serifs. Fixed-pitch fonts are usually modern faces. Pica, Elite, and Courier New are examples.

FF_ROMAN Fonts with variable stroke width (proportionally spaced) and with serifs. Times New Roman and Century Schoolbook are examples.

FF_SCRIPT Fonts designed to look like handwriting. Script and Cursive are examples.

FF_SWISS Fonts with variable stroke width (proportionally spaced) and without serifs. MS Sans Serif is an example.
An application can specify a value for nPitchAndFamily by using the Boolean OR operator to join a pitch constant with a family constant.

Font families describe the look of a font in a general way. They are intended for specifying fonts when the exact typeface desired is not available.

lpszFacename

A CString or pointer to a null-terminated string that specifies the typeface name of the font. The length of this string must not exceed 30 characters. The Windows EnumFontFamilies function can be used to enumerate all currently available fonts. If lpszFacename is NULL, the GDI uses a device-independent typeface.

Remarks

Initializes a CFont object with the specified characteristics. The font can subsequently be selected as the font for any device context.

The CreateFont function does not create a new Windows GDI font. It merely selects the closest match from the fonts available in the GDI’s pool of physical fonts.

Applications can use the default settings for most of these parameters when creating a logical font. The parameters that should always be given specific values are nHeight and lpszFacename. If nHeight and lpszFacename are not set by the application, the logical font that is created is device-dependent.

When you finish with the CFont object created by the CreateFont function, first select the font out of the device context, then delete the CFont object."

To use the font you've created, use
SetFont(&FontVarName)
xxx
01-19-2001, 04:57 PM
Thank you for your reply. I am doing this in asm (api included)

Thanks
Clandestiny
01-19-2001, 06:18 PM
You might also want to chceck out Iczelion's win32 asm site. He has a tut specifically devoted to creating a font in asm.

The address is win32asm.cjb.net

Regards,
Clandestiny
xxx
01-20-2001, 02:10 AM
Thanks Clandestiny

Greetz


If you can provide the URL, why not?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > If you can provide the URL, why not?
PDA

View Full Version : If you can provide the URL, why not?

Solomon
01-21-2001, 04:35 AM
If we newbies want to get efficient help, better provide the URL of our targets. Focusing our questions on specific target is a good practice, or the masters maybe don't know how to help us out, coz what they can do without specific target/URL is giving "universal" suggestions. But Newbies need step-by-step guidance.
hz
01-21-2001, 07:20 PM
Hi,
I agree. I did a quick search for mozfet's
dll, could'nt locate it but you would be amazed how many naked tina pics there are so guess it was'nt a complete wate of time.
regards
hz


Wdasm won't disasemble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Wdasm won't disasemble
PDA

View Full Version : Wdasm won't disasemble

Critter
01-21-2001, 06:45 AM
I'm pretty sure I have read something of this nature before, but cannot for the life of me remember what to do.

I have a prog, that is not packed, that just kind of sits there in wdasm.....isn't it something to do with changing a couple of bytes of the prog??
NeO'X'QuiCk
01-21-2001, 05:37 PM
Try ida it's a great tool!

bye
hz
01-21-2001, 07:26 PM
Hi.
IDA may be great if you have it. Imhotep 1.6.0.5 at protools may help.
regards
hz
Argoth
01-22-2001, 03:40 PM
Ya, IDA is alittle big to download with a 28K modem :)
I had the same problem too, it was with Xara 4D. I wasn't able to dasm the file, but I believe
?Ferret solved the problem last time. (It was just a bug the programmers left in to lock up disassemblers). Sorry I can't help u myself.

Argoth
Critter
01-22-2001, 06:58 PM
hz (01-21-2001 09:26):
Hi.
IDA may be great if you have it. Imhotep 1.6.0.5 at protools may help.
regards
hz

Don't really know what it did, but after running this on the exe, I was then able to Dasm it......so Thanks!!


hmemcpy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hmemcpy
PDA

View Full Version : hmemcpy

dipsy
01-22-2001, 06:35 AM
Hi
does anybody know how can I set a bpx to hmemcpy? I use Softice 4.05 on WinNT4; set the dll files into winice.dat but in softice command line: bpx hmemcpy --> I get a message symbol undefined. I read a few essay where they use this bpx but how did they set? I also checked all dll's which are in winice.dat file but noone has this function inside?I will be very appreciate anybody who can help me.
Dipsy
Bratscher
01-22-2001, 01:26 PM
dipsy (01-21-2001 20:45):
Hi
does anybody know how can I set a bpx to hmemcpy? I use Softice 4.05 on WinNT4; set the dll files into winice.dat but in softice command line: bpx hmemcpy --> I get a message symbol undefined. I read a few essay where they use this bpx but how did they set? I also checked all dll's which are in winice.dat file but noone has this function inside?I will be very appreciate anybody who can help me.
Dipsy

For Windows NT and Windows 2000 try memcpy instead.
Look back in this forum and at the Reverse Forum. This topic has been discussed in depth before.

Regards,

Bratsch
dipsy
01-23-2001, 08:04 AM
Bratscher (01-22-2001 03:26):
dipsy (01-21-2001 20:45):
Hi
does anybody know how can I set a bpx to hmemcpy? I use Softice 4.05 on WinNT4; set the dll files into winice.dat but in softice command line: bpx hmemcpy --> I get a message symbol undefined. I read a few essay where they use this bpx but how did they set? I also checked all dll's which are in winice.dat file but noone has this function inside?I will be very appreciate anybody who can help me.
Dipsy

For Windows NT and Windows 2000 try memcpy instead.
Look back in this forum and at the Reverse Forum. This topic has been discussed in depth before.

Regards,

Bratsch

Thanks to answer me. So this is the function from a particular dll and if I set bpx to this function ( or maybe some one else ) and softice don't pop up, it means that program doesn't use it. Am I correct? Which functions use the program I can check by disasembler also?
Denis
bratcher
01-23-2001, 09:01 PM
dipsy (01-22-2001 22:04):
Bratscher (01-22-2001 03:26):
dipsy (01-21-2001 20:45):
Hi
does anybody know how can I set a bpx to hmemcpy? I use Softice 4.05 on WinNT4; set the dll files into winice.dat but in softice command line: bpx hmemcpy --> I get a message symbol undefined. I read a few essay where they use this bpx but how did they set? I also checked all dll's which are in winice.dat file but noone has this function inside?I will be very appreciate anybody who can help me.
Dipsy

For Windows NT and Windows 2000 try memcpy instead.
Look back in this forum and at the Reverse Forum. This topic has been discussed in depth before.

Regards,

Bratsch

Thanks to answer me. So this is the function from a particular dll and if I set bpx to this function ( or maybe some one else ) and softice don't pop up, it means that program doesn't use it. Am I correct? Which functions use the program I can check by disasembler also?
Denis

hmemcpy and memcpy are found in the kernel of windows and windows NT respectively, they do not belong to a particular .dll in a software package.
hmemcpy is extensively used by Windows API functions to copy a string from one place to another. For example: you write a serial number in a dialog provided by your application. when you click "OK" or "register" or whatever button the dialog has, it may activate one of several API functions: GetWindowTextA or GetDlgTextItemA, GetDlgStringA, GetDlgItemInt etc. This functions in turn will use hmemcpy to perform the simple process of moving your input from place A (the buffer where windows stored temporarily, to place B, the memory buffer that your app set aside to store the user input.
The advantage of hmemcpy or memcpy is that you do not have to guess what API function the programmer used to read your input, it is at a lower level and is independent of the calling API function. Once you determined the destination of your input serial (or name or whatever), you may set up a BPR or BPM to at the relevant asddress and catch the App. evaluating/manipulating it. for more details consult a copy of the CracKnotes http://crknotez.cjb.net/, a handy HTML compilation where the use of hmemcpy is explained in detail.

You are correct, if Sice does not break, the function you set a BPX on has not been called. The program may still use it later, it depends on the which path in the flow of the program you are.

With a dissasembler you can check the list of imported API functions, which may be very large. Knowing which functions are imported and used by the program may or may not help you in reversing it. The trick is knowing WHICH function is called at the relevant moment. The same function may be called multiple times to perform other services that may not be relevant for your reversing purposes.

Hope this helps.
ksm
02-06-2001, 01:53 AM
Bratscher (01-22-2001 03:26):
dipsy (01-21-2001 20:45):
Hi
does anybody know how can I set a bpx to hmemcpy? I use Softice 4.05 on WinNT4; set the dll files into winice.dat but in softice command line: bpx hmemcpy --> I get a message symbol undefined. I read a few essay where they use this bpx but how did they set? I also checked all dll's which are in winice.dat file but noone has this function inside?I will be very appreciate anybody who can help me.
Dipsy

For Windows NT and Windows 2000 try memcpy instead.
Look back in this forum and at the Reverse Forum. This topic has been discussed in depth before.

Regards,

Bratsch
Lord Soth
02-06-2001, 07:55 PM
That function is actually inside the MS C runtime library. It's implemented this way on all C supportive platforms (just about all of'em :) )

Check out the MSVCRT*.DLL at windows\system.

LS

-------------------------------------
hmemcpy and memcpy are found in the kernel of windows and windows NT respectively, they do not belong to a particular .dll in a software package.
?ferret
02-07-2001, 11:26 PM
just out of curiousity....I know hmemcpy doesn't work on NT....but does BozosLiveHere?
(Probably not useful info for as often as that API gets called, but as I said...I'm curious)
Anonymous
02-08-2001, 01:10 PM
?ferret (02-07-2001 13:26):
just out of curiousity....I know hmemcpy doesn't work on NT....but does BozosLiveHere?
(Probably not useful info for as often as that API gets called, but as I said...I'm curious)

hmemcpy, Bozoslivehere are 16 bit routines; you can't find them in any NT version.
Memcpy is the 32bit version of hmemcpy, but it doesn't perform the same function as hmemcpy in Win 9x (inside the Operating System, I mean); you cannot use "bpx memcpy" in NT and obtain same effects as "bpx hmemcpy"
Bratscher
02-08-2001, 09:09 PM
hmemcpy is a 32 bit function Alright, check it in Sice:
it uses extended registers.
This is a code snipet from inside hmemcpy taken directly from the cracknotes:

PUSH ECX
SHR ECX,2 ; number of words to copy
REPZ MOVSD ; copies from DS:ESI (32-Bit) to ES:EDI (32-Bit)
POP ECX
AND ECX,3
REPZ MOVSB ; same as REPZ MOVSD, but only 1 Byte
XOR DX
XOR AX

16 bit code cannot use ESI, ECX or EDI.

The function as stated by Sice is part of the KERNEL!HMEMCPY code. Check the code upper margin of the code window in Sice.
Anonymous
02-09-2001, 10:16 AM
Bratscher (02-08-2001 11:09):
hmemcpy is a 32 bit function Alright, check it in Sice:
it uses extended registers.
This is a code snipet from inside hmemcpy taken directly from the cracknotes:
...

I don't know anything about the cracknotes, and don't figure why ppl feel the need to speak about arguments that don't know at all.
HMEMCPY was implemented first in Windows 3.0 (16 bit) and was, and still is, exported by KRNL386.EXE, a 16 bit (obviously) module; its name corresponds to ordinal 348, at least in Windows 3.1, Windows 95, Windows 98, Windows NT 4 and Windows 2000. This is part of the disassembly listing of the function from the KRNL386 module part of Windows 2000 Build 2128 (a pre-release version); the implementation in Windows NT, 9x and 3.1 is almost identical.

cseg01:8976 ; Attributes: bp-based frame
cseg01:8976
cseg01:8976 public HMEMCPY
cseg01:8976 HMEMCPY proc far ; CODE XREF: sub_0_9AFC+5Ep
cseg01:8976
cseg01:8976 var_2 = word ptr -2
cseg01:8976 arg_0 = word ptr 6
cseg01:8976 arg_2 = word ptr 8
cseg01:8976 arg_4 = dword ptr 0Ah
cseg01:8976 arg_8 = dword ptr 0Eh
cseg01:8976
cseg01:8976 enter 2, 0 ; KERNEL_348
cseg01:897A push ds
cseg01:897B push si
cseg01:897C push di
cseg01:897D mov ds, cs:word_0_30
cseg01:8982 mov bx, word_128B_464
cseg01:8986 mov [bp+var_2], bx
cseg01:8989 mov dx, [bp+arg_2]
cseg01:898C mov ax, [bp+arg_0]
cseg01:898F xor cx, cx
cseg01:8991 lds si, [bp+arg_4]
cseg01:8994 les di, [bp+arg_8]
cseg01:8997 cld
cseg01:8998
cseg01:8998 loc_0_8998: ; CODE XREF: HMEMCPY+7Fj
cseg01:8998 mov cx, 8000h
cseg01:899B cmp cx, si
cseg01:899D jnb loc_0_89A1
cseg01:899F mov cx, si
cseg01:89A1
cseg01:89A1 loc_0_89A1: ; CODE XREF: HMEMCPY+27j
cseg01:89A1 cmp cx, di
cseg01:89A3 jnb loc_0_89A7
cseg01:89A5 mov cx, di
cseg01:89A7
cseg01:89A7 loc_0_89A7: ; CODE XREF: HMEMCPY+2Dj
cseg01:89A7 neg cx
cseg01:89A9 or dx, dx
cseg01:89AB jnz loc_0_89B3
cseg01:89AD cmp cx, ax
cseg01:89AF jbe loc_0_89B3
cseg01:89B1 mov cx, ax
cseg01:89B3
cseg01:89B3 loc_0_89B3: ; CODE XREF: HMEMCPY+35j
cseg01:89B3 ; HMEMCPY+39j
cseg01:89B3 sub ax, cx
cseg01:89B5 sbb dx, 0
cseg01:89B8 test [bp+var_2], 2Ch
cseg01:89BD jnz loc_0_89CA
cseg01:89BF shr cx, 1
cseg01:89C1 repe movsw
cseg01:89C3 adc cx, 0
cseg01:89C6 repe movsb
cseg01:89C8 jmp short loc_0_89D7
...
...
; CODE XREF: HMEMCPY+65j
cseg01:89FF pop di
cseg01:8A00 pop si
cseg01:8A01 pop ds
cseg01:8A02 assume ds:dseg04
cseg01:8A02 leave
cseg01:8A03 retf 0Ch
cseg01:8A03 HMEMCPY endp

This means that if you add "EXP %SystemRoot%\system32\krnl386.exe " to the export list in SoftICE, on any NT system, SoftICE will accept the "bpx hmemcpy" command; however, SoftICE will never break on it because HMEMCPY is a 16 bit function and neither the Win32 subsystem, nor the NT DOS Virtual Machine will never call it. HMEMCPY is still implemented for backward compatibility, just in case some program called it directly, but I've never seen a program that referenced it. In Windows 9x, as many OS function are implemented by thunking on 16bit modules, HMEMCPY is widely used in order to perform memory chunks copying;therefore, the related EXP line is present in default .DAT file. Not so on NT system; beside MEMCPY DO NOT perform same functions as HMEMCPY in 9x system, so setting a such breakpoint is useless for cracking purposes.
Regards
Bratsch
02-09-2001, 11:50 AM
Sorry anonymous, I talked to fast.
And I had extra beers when I answered your post. (Take this as an apology).
Hmemcpy is 16 code.
I did the homework now.
Lord Soth
02-09-2001, 09:39 PM
yup, anonymous here is right again. In fact, it appears that the 16 bit code of many windows functions are actually mixed 16 and 32 bit routines. That means they've got both 16 bit code and 32 bit code. Even more, MS designed a compiler specifically for this purpose, which is to compile to this kind of hybrid thunked down code. It's an interesting approach, but not too great heh

Anyways, it's still a good thing to sometimes use a low level function such as this to copy chunks of memory, but usually
a win32 program doesn't need to do that.

LS


Ripping CD's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Ripping CD's
PDA

View Full Version : Ripping CD's

golk75
01-22-2001, 07:52 PM
ok , sorry ...
ThRaX
01-22-2001, 10:19 PM
Sorry, but I think this is the wrong place to ask that sort of question. This board is for the discussion of reverse engineering software. If you need such a program, I reccomend an FTP search, or try taking your postings elsewhere.

Thanks.


Cant Find software
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cant Find software
PDA

View Full Version : Cant Find software

Lunatik
01-22-2001, 09:17 PM
i need to find some...........basic software w32dasm & Hexworkshop does anyone know where i an find it?
EVC_ViPeR
01-22-2001, 09:58 PM
This should get you going...

http://protools.cjb.net/

EVC_ViPeR


Unix Gurus - HELP!!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unix Gurus - HELP!!!!!
PDA

View Full Version : Unix Gurus - HELP!!!!!

zitterbe
01-24-2001, 12:45 PM
I gotta a bad problem where I work. I suspect a f'd up HD but not sure. It's a CNC machine from Germany running Unix. So....

Is there a Unix utility that can check the intergrity of a hard drive - like, doing variously patterned write/read/restores - and reports on bad areas? Maybe even maps em out as bad, etc? Without reformatting.....

Thanx,
zitterbe [not into Unix]
mammon_
01-25-2001, 10:19 PM
you mean like fsck? Anything more in-depth really depends on the platform [and the partition type, e.g. NFS/ext2/reiser/hpfs].

_m

[hinthint hit the hcunix board ;) ]


Registering an app with no register dialog
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Registering an app with no register dialog
PDA

View Full Version : Registering an app with no register dialog

SirLeechaLot
01-24-2001, 12:46 PM
hy :)

how could I crack an app with no boxes to register? (It says Unregistered in the title bar)

As far as I know it could be:

1) a keyfile
2) registry entries

It would help me if you could tell me more possibilities and give me some links to essays about that. I´m also looking for tuts about registry access and the whole protection scheme round it.

many thanx in advance

siRl
zitterbe
01-24-2001, 12:49 PM
How would you register is U wanted to?
SirLeechaLot
01-24-2001, 03:35 PM
zitterbe (01-24-2001 02:49):
How would you register is U wanted to?

what do you mean by that?
pupp
01-24-2001, 08:24 PM
make a Deadlisting and see whats inside or use exscope see what dialogs it has, alot of things you can use, and do! to get an Idea on how to get it Registered.

Search here to start with h**p://reversersearch.da.ru/

hope this helped a bit
pupp
?ferret
01-25-2001, 03:09 PM
to check to see if it's using a keyfile/reg entry...use Filemon & Regmon from sysinternals.com. They come in handy quite often


Eternal Bliss tut 35!Need solution for ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Eternal Bliss tut 35!Need solution for ??
PDA

View Full Version : Eternal Bliss tut 35!Need solution for ??

NeO'X'QuiCk
01-24-2001, 01:19 PM
Every one that read this tut wolud know that he teaches us to get serial number for our name in the Wrong message box!He show us how!But the problem is he doesn't show use how to do this permanently!IT only work for you serial and in Softice!How to every serial in wrong message box!

I think that the autor of tis tut would probably know it best but the shame is that he doesn't reply to any email!!!

NeO'X'QuiCk
NeO'X'QuiCk
01-24-2001, 01:23 PM
It the tut for CrackMe 1 by DaNiEl-RJ!Make a patch with Hexworkshop so it works for evey password!

Thanks to anyone that will help!!

NeO'X'QuiCk


Advice about win16 apps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Advice about win16 apps
PDA

View Full Version : Advice about win16 apps

allan
01-25-2001, 07:42 AM
I am lokking for tutorials about win 16 apps let me know,if you know where i can find
some.And i need all advice i can get about cracking win 16 program.
If there is anything special about cracking win16 program.
I am a beginner and i try to get serial for electronic workbench,this one is from
cd-rom. Maybe ewb is to tough for a beginner?.
?ferret
01-25-2001, 03:14 PM
there are *some* differences between 32 and 16 bit apps as far as cracking them, but they're pretty similar.

One tip is that for many of the API's you see with an "A" at the end (GetDlgItemTextA)....they're 32 bit API's. For the 16 bit version, simply drop the A off (GetDlgItemText).


How to bypass old floppy protection?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to bypass old floppy protection?
PDA

View Full Version : How to bypass old floppy protection?

Carn
01-25-2001, 08:18 AM
I've got a program that is distributed in 1.44 floppy. The floppy act as a master key disk which holds 3 license and able to transfer it into a hardrive and take it back into the floppy.
Is there a way to duplicate the floppy?
I have tried to clone(ghost) the hardrive to another, the license is not valid ( possible hardisk serial checking)?

Any other method?
pm
01-25-2001, 11:51 AM
Try to duplicate the diskette with FDA 6.1 (floppy disk analyser). It was the only program that managed to duplicate all my everlock protected diskettes. The only problem is that FDA run in pure DOS and not in all computers (I tried several PCs and only an 386 and a 486 did the work correctly)

Hope it helps

pm
Bratsch
01-25-2001, 12:25 PM
Carn (01-24-2001 22:18):
I've got a program that is distributed in 1.44 floppy. The floppy act as a master key disk which holds 3 license and able to transfer it into a hardrive and take it back into the floppy.
Is there a way to duplicate the floppy?
I have tried to clone(ghost) the hardrive to another, the license is not valid ( possible hardisk serial checking)?

Any other method?

Most old DOS floppy protection schemes were based on disk sectors of unconventional sizes, which could not be copied with fidelity by the usual file copying services of DOS and windows. If you try to do a surface scandisk on the key floppy, it will detect anomalies in the way the disk is formatted. There used to be utilities that copied floppies with their original format. DISKIMAGE comes to mind from prehistoric times(BI), before the internet.
An alternative approach, or lateral thinking solution, is to try to catch the routine(s) that validate the disk type and the BIOS utilities reading the floppy, then emulate the results your program wants. BIOS interrupt 7 and DOS interrupt 21 come to mind from the foggy past. This is extremely LOW level programming, so get braced.
Carn
01-26-2001, 11:46 AM
I have used FDA (Floppy Disk Analyzer) as suggested by pm. The duplicated disk works flawlessly.
I've tried to check for any anomality on the disks and found out that both diskettes on last sector is purposely marked as bad. I copy the content of the original disk to a fresh disk using normal file copying and mark the exact bad sector. The program refuse to accept the copied floppy.
I guess there're other protections that i may have overlooked.
Any help on deciphering the FDA copy utility compared to normal copying?

Onto bypassing the checkup routine, the program is executed using Asymetrix runtime and I could not catch the dialog box stating the license is not valid? bpxGetDialogTextItem(sp?) doesn't work here?

Any idea?
Thanks...
Bratsch
01-26-2001, 05:29 PM
Several suggestions:

Search in the Fravia mirror for +ORC tutorials on floppy protections. They were written around the time this was fashionable, so you may get some ideas out of them.

Based on what you are describing, the protected program probably READS information out of the "bad" sector, and uses it to validate the floppy as autentic. The license counter is probably stored there. Any DOS or windows API call would fail miserably in attempting this endeavor. But this gives you a point of attack: Disassemble the program and its dlls, if any, and look for a Int 13 instruction. Rarely will you see such beast in modern Windows programs, because they all use API functions to encapsulate disk access, but your protected program must be accessing the disk in an unconventional fashion, by using Int 13 directly to read the "bad" sector from your floppy, bypassing windows and DOS services. Your protection should be around this operation(s).

In regard to suggestion 2 of previous post, Does the program give you an "invalid disk" or such when it does not find the key disk?
can you use the nag screen to trace back? check the Cracknotes (there is a copy inCrackZ site): "nag screens"
In short:

Ispy utility will tell you the name of the owner of the nag screen and its Handle number( a short int).
Also Hwnd instruction in Sice will list all the process handles along with the owners of such processes. locate the Handle of your Nag screen and set up a BPMSG /your nag Handle/ wm_destroy. when the nag is clicked Sice pups up. F12 Trace back from inside the windows API until you get to your program. you will be in the place where your nag is destroyed, which probably resides in the same call where the nag is generated. then you have a general idea where the protection check(s) are happening.

If you don't mind, ZIP the contents of the floppy and e-mail it to me. You got me curious now.


How to generate flexlm 6.1 license
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to generate flexlm 6.1 license
PDA

View Full Version : How to generate flexlm 6.1 license

3M
01-25-2001, 09:40 AM
Hi,
I have worked for a target and found the seeds/keys. I used genlic32 to generate license, but the license don't work. The format of my generated license is
FEATURE XXX_XX XXXX 2020.110 18-jan-2050 uncounted \
277CA139DEF7 \
VENDOR_STRING=XXXX,XXXX,XXXX \
HOSTID=SKEY=935BBF69 ck=137.

I also have a workable license from one cracker's site, its format is
FEATURE XXXX XXXX 2020.110 18-jan-2020 uncounted \
8C19952526A76ED24A4C \
VENDOR_STRING=XXXX,XXXX \
HOSTID=SKEY=1234 NOTICE=abcd@yahoo.com ck=21.

Does anyone help me generate a workable license with genlic32.
nblender
01-26-2001, 04:56 PM
I think you have to use lmcrypt for this one.
it has to be recompiled, and a vendor
defined hostid put in for SKEY.


password sender?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > password sender?
PDA

View Full Version : password sender?

nyah
01-25-2001, 02:57 PM
some utility like barok but i want better then that
where can i find that!!!
ThRaX
01-25-2001, 07:19 PM
Could you please be a little more specific? I'm not quite clear on what it is that you are looking for.
nyah
01-28-2001, 05:14 AM
barok iz some software which send all the password to u means when ever some astrik place
come it take it as password so i want that batter
utility
mike
01-29-2001, 02:38 PM
I.e. a keylogger that only grabs password fields but also mails them to you. Do a search on "keylogger" or "keyboard logger" or "keyboard sniffer"


Where to find tut for manual unpacking Of Pecrypt 1.02 Or how do you do it!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where to find tut for manual unpacking Of Pecrypt 1.02 Or how do you do it!
PDA

View Full Version : Where to find tut for manual unpacking Of Pecrypt 1.02 Or how do you do it!

NeO'X'QuiCk
01-26-2001, 03:49 PM
Please help me that!!The subject says it all!!

NeO
hz
01-27-2001, 03:18 PM
Hi,
I would like to take a look at this prog, will
you provide a url?

regards
NeO'X'QuiCk
01-27-2001, 09:14 PM
http://kickme.to/tnt/

Goto school /Tnt official crackmes/ number 49

NeO


CAN SOMEBODY HELP ME--I WANNA TO CRACK TRIALS AND I NEED HeLP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CAN SOMEBODY HELP ME--I WANNA TO CRACK TRIALS AND I NEED HeLP
PDA

View Full Version : CAN SOMEBODY HELP ME--I WANNA TO CRACK TRIALS AND I NEED HeLP

solata
01-27-2001, 11:01 AM
You have all in title
I wanna to crack trials and need help.
Please mail me a lot of tutorials on specific programs and no on specific programs
JimmyClif
01-27-2001, 11:36 AM
Hi solata,

Did you know that writing in CAPITALS means SHOUTING?
Anyway:

Here are a few links:

http://www.idca.com/~thesandman/
http://beam.to/blackb
http://snakepage.cjb.net
http://qferret.cjb.net


New Crack tuts added
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New Crack tuts added
PDA

View Full Version : New Crack tuts added

krobar
01-27-2001, 09:53 PM
Hi all :)

I added a nother couple of hundred tuts to my site: Krobars Crack Tut Collection h**p://zor.org/krobar if anyone besides me is interested.

krobar
hobgoblin
01-28-2001, 01:40 PM
Hi there,
the links to the tuts don't work properly.
regards,
NeO'X'QuiCk
01-28-2001, 03:41 PM
Krobar keep a good work!But it's true that some of the links do work!But you have a lot of work with updating the website!

NeO
krobar
01-28-2001, 08:50 PM
Thanks for mentioning the dud links. I found that one of the folders been deleted off the server...over 500 tuts I got to reupload...so hopefully they be back soon...(although no ftp upload so it slow :(

Well it the next day now. Last night I reuploaded the missing folder (took hours...10 at a time) and this morning folder gone again. So dunno...they all be there sometime soon!! Find somewhere to store them for now..

So if you trying for the tuts on the other tuts section, they be there soon.

P.S. I always seem to have trouble with files disappearing...anyone had similar experiences

krobar
krobar
02-06-2001, 02:15 AM
All the links should be working now!!


key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > key
PDA

View Full Version : key

bt
01-28-2001, 04:36 AM
can anyone help i need a key for quickbooks 2001
?ferret
01-31-2001, 04:45 PM
OK....her's what you need to do......

Are you ready for this?...Got your pen and paper ready to take notes?....

OK...here we go.....

Go to your software vendor of choice, find the software, go to the cash register and pay the person working behind it. Then go home and open the package. The key should be printed in/on the manual, or on the jewel case for the CD...

Hope that helps ;-)

LOL...I love messin' with lamers


softice no-cd tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice no-cd tutorial
PDA

View Full Version : softice no-cd tutorial

Fred Garvin
01-28-2001, 12:44 PM
does anyone know of a good tutorial on using softice for making no-cd cracks.I am just looking for no-cd tutorial (softice).
Kilby
01-29-2001, 03:56 AM
Almost any of the ones involving WDisasm32 or IDA can be carried out on the program while it's running.

The quickest and dirtiest way is to simply BPX GetDriveTypeA.

A good place to look is either old Fravias Site or http://cdchecks.cjb.net

I ofcourse recomend my tutorial on Thief <grin>

Goog luck,

Kilby...


Enabling "Save" function + linking to code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Enabling "Save" function + linking to code
PDA

View Full Version : Enabling "Save" function + linking to code

x!
01-28-2001, 06:16 PM
I worked on this 6 months ago, and gave up, but actually need it now and cannot shell out the $475,-.Tried again, but got halted @ the same place. :(
This thing has 3 limitations:
- cannot load more than 1000 frames.

fixed this.

- Open more than 3 windows simultaneous

fixed this.

- Cannot save.

This is the problem. I read some essays on how to ungray buttons and enable menu options, which is also ok, but then I don't seem to manage to link that function to the save functions, which are in there:

":0046D09D"

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0046D0E9(C), :0046D0F8(U), :0046D109(C)
|
:0046D12D A190F44A00 mov eax, dword ptr [004AF490]
:0046D132 8945EC mov dword ptr [ebp-14], eax
:0046D135 FF75F0 push [ebp-10]

* Possible Reference to String Resource ID=61699: "Save changes to %1?"

I spent too damn much time on this one and would appreciate some pointers or a tut about this specific one. - thanks!

Target: Mayah editpro 3.0 DEMO http://www.mayah.com/content/products/editpro/editpro.html
---
MS002 MAYAH® EditPro MPEG Audio Editor

Editor for MPEG Layer II and III files which have been created by using Mayah® SendIt, Flashman® or compatible codecs. Cut, copy and paste functions, handles different windows, cue in, cue out, fast 32 bit version, long names are allowed.

$475,-
Clandestiny
01-29-2001, 09:13 PM
Hi x!,

Man, dare I say thats quite a hefty price on that little app ;-)

Well, I downloaded it and had a quick look at it so I'll offer up my few cents (though quite possibly you will have already exhausted the options I'm going to mention).

1st...Does the code exist? I'm inclined to think that it does. Both the string reference you mentioned as well as the presence of the GetSaveFileNameA API in the imports makes it likely that the code exists.

2nd...How to attack it...
Well, Ungreying the items is pretty straight forward as you mentioned via the EnableMenuItem API. Unfortunately, linking the code is the hard part and here is my suggestion if you haven't tried it already.
Have you tried a back trace range? You can pull out all of the relevant menu imports from Wdasm...plop them in an API moniter...and find 2 suitable "traps" for a back trace. I was going to try this and let you know if it helped, but unfortunately SICE won't recognize the module name (EDIT PRO 32 DEMO) so I can't set the bprw "module name" T. I'm not sure why...Maybe too many letters?
Well, I thought I'd throw out the option anyway. If you haven't investigated it yet, it might be worthwhile.

Your other option will be via the WM_COMMAND message route. +Spath has a very good menus reversing essay on this approach. IMO, its a little advanced (if you're like me you'll have probably have to read it 4-5 times ;), but its a good essay nontheless and very informative on all aspects of menus creation / reversing. If you don't have it already, you can easily find it here on the local fravia search engine. Also, Kayaker has a good tut on menu reversing for Trace32 which you might want to look for as well.

And I wrote up a tut myself covering some basic menus reversing techniques in response to the menus reversing project we had here in the mini projects section of the newbies forum. I tried to keep it simple and explain some of the basic concepts as I went along. I'll be happy to send it over to you if you're interested.

Hope something of the above helps :-)

Regards,
Clandestiny
Clandestiny
01-29-2001, 09:13 PM
Hi x!,

Man, dare I say thats quite a hefty price on that little app ;-)

Well, I downloaded it and had a quick look at it so I'll offer up my few cents (though quite possibly you will have already exhausted the options I'm going to mention).

1st...Does the code exist? I'm inclined to think that it does. Both the string reference you mentioned as well as the presence of the GetSaveFileNameA API in the imports makes it likely that the code exists.

2nd...How to attack it...
Well, Ungreying the items is pretty straight forward as you mentioned via the EnableMenuItem API. Unfortunately, linking the code is the hard part and here is my suggestion if you haven't tried it already.
Have you tried a back trace range? You can pull out all of the relevant menu imports from Wdasm...plop them in an API moniter...and find 2 suitable "traps" for a back trace. I was going to try this and let you know if it helped, but unfortunately SICE won't recognize the module name (EDIT PRO 32 DEMO) so I can't set the bprw "module name" T. I'm not sure why...Maybe too many letters?
Well, I thought I'd throw out the option anyway. If you haven't investigated it yet, it might be worthwhile.

Your other option will be via the WM_COMMAND message route. +Spath has a very good menus reversing essay on this approach. IMO, its a little advanced (if you're like me you'll have probably have to read it 4-5 times ;), but its a good essay nontheless and very informative on all aspects of menus creation / reversing. If you don't have it already, you can easily find it here on the local fravia search engine. Also, Kayaker has a good tut on menu reversing for Trace32 which you might want to look for as well.

And I wrote up a tut myself covering some basic menus reversing techniques in response to the menus reversing project we had here in the mini projects section of the newbies forum. I tried to keep it simple and explain some of the basic concepts as I went along. I'll be happy to send it over to you if you're interested.

Hope something of the above helps :-)

Regards,
Clandestiny
Clandestiny
01-29-2001, 09:15 PM
...Sorry guys,I hit post twice by accident.

--Clandestiny
Kayaker
01-29-2001, 10:44 PM
Hi Guys,

I've been having a look at this one too. I tried a Trace between the GetMenuItemID call for the Save menu item and its EnableMenuItem call. Set a BPX GetMenuItemID, select the File menu item and watch the value in EAX, which shows the 2nd stack parameter of the call (position of menu item). When it reaches 3 (for the 4th item in the drop-down list which is Save), F11 return from the call and set the trace with BPRW [module-name] T. Then set a BPX EnableMenuItem and press F5. When it breaks again you've got a trace of all the code hit between the two. Compare this with a similar trace for an enabled menu item, such as Open, and you can find the difference lies here:

:00467622 CALL [EBP+14]

When the item is to be Enabled, [EBP+14] is 40CFA0, if Disabled it's 4106D0. Now there doesn't seem to be a simple flag determining this, but you could check further in the backtrace history and see what determines the address called. If you're *very* lucky there's a single memory flag somewhere that might also control enabling the Save functionality.

BTW Clandestiny, it seems Softice sometimes has problems with certain commands (BPRW, MAP32) using long or spaced MODule names such as this, so you can usually just rename the file to something short that shows completely when you type Task. Works for me anyway.

Anyway, I didn't get anywhere with this, did a bush patch so ALL menu items were enabled and tried manually tracing from selecting Save. You have seen the Mini Project forum thread right? ;-) Well, there's lots of places where the MenuID's of E103 (Save) or E104 (SaveAs) are pushed before indirect calls, but I got bored with the code. Er, I mean, lost in the code ;)

So then I keyed in on GetSaveFileNameA and found 1 interesting thing out. The code you mention
* Possible Reference to String Resource ID=61699: "Save changes to %1?"
IS actually called when you modify an MP3 and then select Exit! It asks you if you want to save and if you say Yes, a SaveDialog box pops up! Whaddya know. The only problem is is that DeleteFileA is called and the file is never saved. If you fake it and force it to be saved, it's of zero size. Anyway, this is maybe another area you could check out. You do want to connect that GetSaveFileNameA routine (sans DeleteFileA) with selecting the Save menu item.

'bout all the help I can give right now.

Regards,
Kayaker
x!
01-30-2001, 01:34 PM
Clandestiny, Kayaker,

thanks both for the input! I think I see a light at the end of the tunnel now :).

I am in the middle of some exams now, so I'll look into this again in 14 days or so...

Clandestiny, can you put that tut on a page or something? thanks! I can use ungray reading because IIRC the menu ungaying was no problem but the button ungray I couldn't get to work. (been a while, and I'm not really advanced, or "intermediate" :))

thanks a lot guys! maybe I get to edit mp3's this year :)

greets, and I'll drop a line in 14 days or so..
UnWANTED one
02-07-2001, 09:45 PM
The attual code that enables the save and save as button is simple:

:00467827 FF7608 push [esi+08]
:0046782A FF7004 push [eax+04]

* Reference To: USER32.EnableMenuItem, Ord:00B5h
|
:0046782D FF15D8644800 Call dword ptr [004864D8]
:00467833 EB55 jmp 0046788A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467833(U)
|
:0046788A C7461801000000 mov [esi+18], 00000001 <-- here

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00467813(C)
|
:00467891 5E pop esi
:00467892 C20400 ret 0004

Very simple 1 = disabled | 0 = enabled. So do the apropiate changes and the menu items will be enabled.

If you check closer the developers havnt included the save function at all. Its disabled/raped. Missing critical code.
Kayaker's method of forcing it to be save is not going to work and looking at that code will make it quite clear why not. The program is a demo and its not full with code disabled. It doesnt have the needed code at all..
x!
02-08-2001, 09:41 AM
well, I can confirm what is said here. The save code is gone :(.

I knew I cracked an old '99 version once and after a bit of searching I found it.
It's called "Real Edit MP3 3.0", and more the little brother of this one. (only can cut
mp3 frames. no fading etc)

please download pack.rar from:
http://briefcase.yahoo.com/bc/melvin887vjy814?c&.flabel=fld3&.src=bc&start=1

the rar password is "rce.project"

the OLD little brother calls:
:0043CBD0 FF5078 call [eax+78]

which points to:

:00408A6D B83E294500 mov eax, 0045293E
:00408A72 E841870100 call 004211B8
:00408A77 81EC28010000 sub esp, 00000128
...
:00408A93 33DB xor ebx, ebx

* Possible StringData Ref from Data Obj ->".TMP"
|
:00408A95 684CCE4600 push 0046CE4C
....

:00408B73 C645FC02 mov [ebp-04], 02
:00408B77 E891040300 call 0043900D

* Possible StringData Ref from Data Obj ->"If you save in plain MPEG, they "
->"will be lost!"
|
:00408B7C 6808CE4600 push 0046CE08

which is the SAVE routine...

the target we were working on:

:0046D017 FF5078 call [eax+78]

calls:

:0040E280 33C0 xor eax, eax
:0040E282 C20400 ret 0004

which doesn't do much of course :( ... Also no other locs found with save routine so I'm assuming it's not in there.

Is it do-able to graft the Code from little brother in the big one? (like that notepad essay?)

It's a bit above my capabilities, but it would be great if a "intermediate" or "expert" would have a go at this. (please)

I'd love to learn how, if feasible of course.
?ferret
02-09-2001, 02:15 PM
here's an idea, that I was planning on toying with a bit sometime, but I won't have time for awhile, so if you like, go for it....

If you have any programming knowledge, write a .dll that pops up a save window.....make the program load the .dll and the link a call to it when the save item is clicked......

you'll have to ad serialization code, play with the imports, PE etc, but it is an option ;-)
x!
02-09-2001, 11:05 PM
well, I actually started transplanting the code.

am about 70% though the 967 byte snippet for changing all the call locations (about 60 calls).

stumbled upon 3 calls which are slightly different, so potential problem here

stumbled upon the _real_ save function, also missing, which is about 400-500 bytes, but luckily mostly simple calls like "call ds:SetFilePointer" which are surely in the new exe already so good chances here.

found one small call + subcall (!!00408ACB call sub_4010BB) which is also missing in the new exe, but I'll get it in the new one also.

the datastrings (or how do you call those: "push offset a_tmp ; ".TMP"" I'll add last after all code is in.

all in all another 4-5 hours of work. I hope I can pull it off because this is totally new for me...

Can't code win32, nor know anything usefull of win32asm so I'm left to do this the brute-force way. :(

would be cool if someone else could look up the exact patches to get

- that save/save-as button and menuitems linked to the code?
- the 3 file limit, seems I lost the patch...

btw: 401C98 -> 1000 frames limit

ne-way I'm going to sleep. 6am and a lot of reversing tomorrow.

btw: would this make a good tut?
Kayaker
02-10-2001, 03:45 AM
Hi

I had a closer look at this one too. That was an interesting observation x!. The code around the call [eax+78]in both versions is essentially identical, and the
:0040E280 33C0 xor eax, eax
:0040E282 C20400 ret 0004
that's pointed to in the Demo version is just plastered in the middle of a bunch of nops. Makes it pretty enticing to think you *could* graft the code from one to the other doesn't it? ;)

As you've found out I see, unfortunately there's other areas that are just a "bunch of nops" too and a lot of Calls that need to be readdressed. Not only the WriteFile procedure but whatever processing happens to convert the memory image to an mp3 file, plus the graphics of the lame progress bar, plus Windoze code, plus...

I looked at this and then I thought that if it proved to be too difficult to "mesh" the new and old code bits together, might be to extract the entire extent of all code called from the Call [eax+78] in the good version, insert it in a new section at the end of the demo version and rereference the addresses. I tried a TRACE in SI to see how far this network would go, and by the time I had finished vacuuming the cat, went out and bought some iodine, and returned, it was still processing.

After rebooting both the cat and the computer I started thinkin' like ?ferret, except in a more inelegant way, about having the demo memory map the *entire* good version when [eax+78] is called, and access the working Save functionality from there, returning to the demo. Kind of clumsy, but I think it would work in theory.

One last thing you've probably noticed anyway. The call [eax+78] in the demo *is* called when you Exit with a changed file and elect to save it. The funny thing is, it doesn't actually exit after this. You might be able to use this to get the SaveDialog to open. As soon as you give it a name and say OK, *then* [eax+78] is reached to process the file, and all the code after the RET seems to be OK.

BTW, your question about whether this would make a good tut? It sure would! Get some sleep, finish it up and start writing ^_^

Regards,

Kayaker
x!
02-10-2001, 07:30 PM
BTW, your question about whether this would make a good tut? It sure would! Get some sleep, finish it up and start writing

hehe. lol.

after a day of reversing I'm stuck with

>5000 lines assembly sourcecode
>43 sub-calls
>11kB patched code
& added USER.DLL:GetCursor to import table

all nicely organized.

damn. why am I afraid to commit this patch? :-)

If I pull this off, I just got nominated for the 2001 Nobel prize, category "hardcore reversing". Slim chance though ...

my head hurts, I need to take a walk I think. :-)
?ferret
02-12-2001, 08:52 PM
I don't know that my way is elegant LOL....jus portable.....if you run across another save disabled scheme, the .dll is already wrote ;-)
Lord Soth
02-13-2001, 01:16 PM
Alrighty, then when can we see the whole thing ??
I haven't been following the message threads and it sure seems like an interesting project.

And ?ferret you little birdie, you smartass :)

LS

?ferret (02-12-2001 10:52):
I don't know that my way is elegant LOL....jus portable.....if you run across another save disabled scheme, the .dll is already wrote ;-)
?ferret
02-13-2001, 08:37 PM
:D
x!
02-13-2001, 10:21 PM
The code is in, but still need to adjust the calls. Everything went ok, but I 'topo' ( http://free.hosting.and.email.at.ebox.ru/~protools.fbi.ru/files/utilities/topo.zip ) to add a code section where I put most functions, and now I have problems calling these.

If I don't find a way, I'll need to start over and fill 11k of caves... (and more might follow).

example: in hiew

I get to my function-2-be-called by pressing F5 (goto) and then offset
1022bb gets me to .005492BB

however, when I call this address:
000851CB: E8EBD00700 call 0001022BB

it calls .0005022BB (???) (hey, I'm a newbie...) :(

first thought it was a hiew bug because biew shows ok, but now when I disassemble the exe, wdasm also gets the wrong address.

I don't have much time the next few days, but I'll see what I can do.

anyone can explain to me why hiew JUMPS ok with F5 but fails to get the right call?

thanks
?ferret
02-14-2001, 07:15 PM
I can't offer much insight into the prob, but when injecting code, I tend to use JMP's to get to the new function and back. Not as neat, but it seems easier to implement ;-)


How to get the oFFset in Ida!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to get the oFFset in Ida!
PDA

View Full Version : How to get the oFFset in Ida!

NeO'X'QuiCk
01-29-2001, 08:05 PM
I would like to know how to get a offset in Ida if you have 0042234
for example!

Thanks in front for helping

NeO
Frost
01-30-2001, 02:54 PM
Have tried using the offset command/submenu?
NeO'X'QuiCk
01-30-2001, 06:22 PM
I saw that buti don't know which one of four and how??

NeO
carpathia
01-30-2001, 07:59 PM
If you mean Edit->operand->offset, this is used purely to modify the representation of the disassembly. The disk offset, as tsehp pointed out, is on the status bar.

Also, its generally best to prevent crossposting. I think its fair to say most people read at least this and the main forum.

Regards

Carpii
NeO'X'QuiCk
01-31-2001, 02:52 AM
Thanks guy !!I fully got it!Was i stupid!By some how i always looked up!The problem for me was that In toolbar near Offset you have a stroke!And if you press it you get 5 diffrent lines !I don't know how to use it so i thought that there was one it that lines !But it easy like int Win32d!

Thanks again NeO!
breZel
01-31-2001, 05:39 AM
I've found a great Tutorial about IDA at The Newbiez Project. It's really basic with all Funktions explained by a included Crackme. I guess it's the best I've ever found.
regards
breZel
breZel
01-31-2001, 05:50 AM
hmm...i've forget the url...sorry
http://www13.brinkster.com/newbiez/index1.html
It's in the Basic-Section.

Have phun
NeO'X'QuiCk
01-31-2001, 03:08 PM
Thanks !man!!

NeO


Sice: Source & Symbolic Level Debugging ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sice: Source & Symbolic Level Debugging ???
PDA

View Full Version : Sice: Source & Symbolic Level Debugging ???

Clandestiny
01-29-2001, 10:07 PM
Hi All,

I am writing a program in C++ and I was wondering about the possibilites of source and symbolic debugging in Sice. I have looked over some documentation on +Sandman's SoftICE Resource Centre, but I'm a still a little puzzled on how to apply it. The tut I read mentions "linking the program w/ switches to create a .map file" and then using Sice's msym.exe to create the symbol file. I am using Visual C++ and cannot figure out how to get this .map file. I checked all of the files created from compiling including the debug directory and did not see anything. I also did a search through the VC++ msdn help files, but did not find anything relevant. Possibly I have overlooked something? And I would be appreciative to anyone who could clarify this for me / point to some more docs discussing source debugging w/ SICE.

Thanks,
Clandestiny
DinDon
01-30-2001, 03:05 AM
Simply link your project with the debug info from VC++.
Next run NuMega SoftICE/Symbol Loader and open your executable module. Click the Load command on the menu, then Load subcommand.

This will have two effects: a Translate command (which will create a file with extension .NMS from your executable, containing all the symbols and optionally the source files - click on the Book icon on the toolbar to include them) and the loading and execution of all required files in memory, performing a breakpoint on the first source line.

Have fun

(by the way, I do not like very much this way of debugging my programs, because the computer is blocked during the debug, and you cannot run any other app; but it may come useful when debugging the programs on a machine without M$ Studio installed: you just need SICE, your exe and the .NMS file, built on the machine with the sources. Note that the .NMS format is not dependent on the operating system, so you could develop a program under WinNT and test it an Win2k, for example)
Lord Soth
01-30-2001, 05:10 PM
Hiya dude,

All you need to do is compile your project for debug and not release.
If I remember correctly, this is the default behaviour of VC++ so it shouldn't be a problem.
In the project configuration dialog you can set debug or release compilation.
Once you have it, just load up your new exe with the symbol loader and it should do everything for you.
I suggest using the locals window (command: wl, which shows a function's local vars), and
possibly wf if you have floating point calculations there..
Notice you can use F3 (by default unless you've changed it) to switch to source, mixed and asm modes of debugging.
setting a BP is very easy too, just BPX .1234, will put a BPX on line 1234 for example.
I really suggest you read the SI manual on source level debugging. VC++'s debugger is a joke in comparison, trust me :)

LS
Clandestiny
01-30-2001, 10:19 PM
Lord Soth & DinDon,

Thanks both of you for your help :-)

I fixed the problem. After reading your feedback and having a closer look at the SICE manual, I realized that VC++ creates the .NMS file all by itself whenever a project is compiled. It was just a matter of telling SICE to load it inside the initialization settings.

I must say, its pretty cool to see my source code sitting right there in SoftICE! And even with just a cursory glance, IMO it already appears to run much smoother than the M$ VC++ debugger.

Guess I'll finally attempt to use SICE for what it was intended for in the first place ;)...LOL

Cheers,
Clandestiny
Lord Soth
02-01-2001, 07:19 PM
IMO the best way to debug things you really don't understand is using mixed source mode.
What this gives you is not only seeing the
source code that is running. Look also at the registers themselves, which gives a great insight :)

Have fun dude

PS. get the damn SI manual! it's priceless!! :)
If you can't find it, mail me.

LS
?ferret
02-02-2001, 10:15 PM
I agree w/ LS that the VC++ debugger is crap. I DO use it sometimes if I just need to check a simple value, but if I don't have a pretty good idea of what's wrong before I start it, it's worthless.... ;-)

(Off topic, but I had to put my 2 cents worth in)
Clandestiny
02-02-2001, 10:54 PM
Lord Soth,

Thanks man for the advice! ...Yeah, mixed mode is great and I've already caught a couple of bugs with it.

As for the SI manual, I already have it but thanks for the kind offer...I just don't read it as often as I should ;)

Cheers,
Clandestiny


Bhrama server problem!????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Bhrama server problem!????
PDA

View Full Version : Bhrama server problem!????

NeO'X'QuiCk
01-31-2001, 02:32 AM
I have problems with Brahma server!First i load icedump secessfully!The i open Procdump start bharma server started waiting !The i use simblo loader exapmle load packed upx!Find OEP!The i write /option p
That Ok!Then i write /bhrama procdump32 !!And he write Failed to find bhrama window!!

What's wrong !

Thanks to anyone that help!!

NeO
Corbio
02-03-2001, 05:38 PM
u wrote(wrong ;-):
/bhrama procdump32

correct:
/bhrama procdump32 - dumper server
NeO'X'QuiCk
02-04-2001, 04:24 PM
Thanks master!!What are you doing !I thought "- dumper server "Was the explanation!

Mail me !!

NeO


What type of VB6 protection is this?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What type of VB6 protection is this?
PDA

View Full Version : What type of VB6 protection is this?

Cruise
01-31-2001, 04:13 PM
Hi,
I'm a newbie but i'm trying really hard to learn. I've been trying to crack this program, following all the tuts but i can't seem to find the product id using softice 3.24 and smartcheck 6.x.
It works by giving each install a unique key and then (u're supposed to email the company with the key and they give a product ID). Could some one please take a look and see what u make of it. Any help would be really helpful.

Thanks again.
Cruise.
hz
01-31-2001, 05:23 PM
Hi Cruise,
its usually quite helpful when making a request for someone to "take a look" if you
give at least a hint as to what program it
is.
Cruise
01-31-2001, 06:32 PM
Sorry Hz,

The program is called Radar Contact V2.1 - it's an addon for microsofts flight sim 2000. You can view at www.flightsimmers.net/radarcontact/

Hope thats a bit more helpful.

Thanks again,
Cruise.


PC Games.....And how to find out what cd protection they use....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PC Games.....And how to find out what cd protection they use....
PDA

View Full Version : PC Games.....And how to find out what cd protection they use....

Syphon
02-02-2001, 12:17 AM
I am new to cracking, and I am trying to learn.. I could use some guidance from you l33t crackers out there :P I have some issues i need cleared up, and maybe even more as time goes by. But my ? is simple... How to find what cd protection a PC game uses for there cd? I am a gamer at heart, and I am wondering what i need to figure this out. The game basicly refers back to the cd.... for what i dont know.. Please help

Syphon...
Muad'Dib
02-02-2001, 04:00 PM
Try reading some stuff at http://cdchecks.cjb.net ...


Help-running out of paper- Can anyone help with a 16bit prog. my brain cant get round?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help-running out of paper- Can anyone help with a 16bit prog. my brain cant get round?
PDA

View Full Version : Help-running out of paper- Can anyone help with a 16bit prog. my brain cant get round?

Scally6
02-02-2001, 01:07 PM
Hi all,
I've been playing with a 16bit prog:

ht*p://homepages.force9.net/vastro/astrop.zip

for experience for over a week and am getting nowhere. (Its an old astrology prog which isn't any use to me but its got me beat) I'd really appreciate some guidance.
The prog uses an ini file in /windows & several dll's in windows/system. It writes a temp file out to /windows/temp as it loads & this varies depending on whether the thing is within or outside the 30 days trial. None of the files in /astrop (or the ini) seemed to change when I put the clock forward but as I can't seem to get it back to within the time trial state, I'm poking in the dark. There is an entry in the reg. but I don't think its responsible.
I can't understand how to find out from where the temp file is initially read & dead listing in Wdasm didn't help me.
I guess I may have missed something but would appreciate some help.
Anyone got any ideas?
TIA
Scally
Kayaker
02-02-2001, 05:53 PM
Hi Scally,

Check out win.ini

[Settings]
s1=3501
s2=2502
s3=3502

Cheers,
Kayaker
JimmyClif
02-02-2001, 05:55 PM
Hi Scally,

I had a quick look into it and must say that I have never seen a proggy have sooooo many String refs inside it and somehow I wonder on what day someone has to be born to be ... perverse and neurotic... :)

Anyway... I went the drunk/bad patcher way and it prints happily showing no nags... now!

First the printing:

The MenuItem is disabled after 30 days! In the whole program there's only 1 call made to EnableMenuItem (guess which one) Here is the definition of that API :

BOOL EnableMenuItem(

HMENU hMenu, // handle to menu
UINT uIDEnableItem, // menu item to enable, disable, or gray
UINT uEnable // menu item flags
);

flags:
MF_ENABLED equ 0h
MF_GRAYED equ 1h
MF_DISABLED equ 2h

All I did was patching the 3rd last push (the flag) into push 00 (enable always) and noping out the remaining bytes to clean up.

The nags:
For the nags I went an rather unusual way - I deleted them all using a resource editor, thinking about the "no handle - no dialog" way... and yep... it went good.

---------------------------------------------------------------------------------
But don't take my solution as the example! It is possible to register it somewhere
as there is a registered dialog inside the proggy... I'm just unable to find it right
now...

Best Regards,
JimmyClif
(who should stop drinking white russians)
JimmyClif
02-02-2001, 05:58 PM
LOL Kayaker... goes the good way *g*
Kayaker
02-02-2001, 06:04 PM
I like your way better JimmyClif. More creative ^_^
Scally6
02-03-2001, 03:27 AM
Doh! Should have seen the win.ini a mile off! What I stupidly did was rely on a config manager which tells me when system files have changed... Unless of course I reboot into a different config after the changes... so I missed the change to win.ini & even though I looked at the file later, (once I'd reached the lost & brainless stage) I didn't see the changes that were there - probably because I didn't expect to see them.
I couldn't get sice to bpx on enablemenuitem or graystring & was intrigued by the dialog refs you mentioned, Jimmy Clif, - also the fact that there are dialog refs to several different evaluation versions.
I'm gonna play with it some more to see how they're called but thanks guys - the rain forrests are a safer place.

a less perverse & less neurotic Scally

Thanks guys


Cracking with Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cracking with Softice
PDA

View Full Version : Cracking with Softice

steve38
02-02-2001, 03:15 PM
I'm new to this and trying to crack two diffarent programs with softice,with the first I can by-pass the serial check but can't find the true serial..although i keep on finding ..x.e.p.e.p.t... when I dump various registers,the prog is Windows Enforcer 6,I gave up looking and moved on to another totally un related prog and found the same string in that too....is it a problem i have with something or is it a very,very strange coincidence
Cheers
Muad'Dib
02-02-2001, 03:57 PM
Maybe you should try reading some tutorials. There are plenty of newbie tutorials at both http://zencrack2.cjb.net and http://crackmes.cjb.net
steve38
02-02-2001, 04:34 PM
I was following a tutorial for Enforcer V4 but didnt seem to be able to find that version.It was a simple question do i have a problem with Softice or not...Yes or No would have been fine...I know as much now as I did when I posted the first message.If I'm missing the obvious fair enough I'll look again,and again.But ive been at it for a week,learnt a lot about ASM as i knew nothing two weeks ago,but not enough I see,just wanted to check I hadnt got a fault and that the answer was there even if I cant see it.
hz
02-02-2001, 08:26 PM
Hi,
Hmm yes or no would be fine, ok yes then again no it could be your attitude thats the problem.
regards
Lord Soth
02-02-2001, 10:17 PM
Just lemme say this:

The likelyhood of such a bug in SI is so small, I doubt it's even infinitisimal :)
Now really. The chances are way too slim that this is a SI problem.
It could be that the two protections rely on something in your system, or something else that is common and thus you see the same kind of string.
Don't worry dude, keep at it, but keep refreshing your mind with tutorials all the time so you don't get lost in the code.
Once you get the hang of it, it'll look much easier later on.

LS
?ferret
02-02-2001, 10:24 PM
steve38 (02-02-2001 05:15):
....is it a problem i have with something or is it a very,very strange coincidence
Cheers
Yes, it's a problem you have with something ;-)

Your "real" serial may never get loaded into memory as a string....the entered serial, may just get compared to certain mathematical procedures and if it passes them all, it's good, if not, it's a bad serial.

Don't give up easily, but you need to start with the basics and work your way up. These programs may be a bit advanced for you at this point. Try a few tutorials, and when you learn a bit, go back and try them again ;-)

I suggest qferret.cjb.net (plug plug), or www.idca.com/~thesandman/index2.html.

For a first proggy, I would suggest Winzip, as it's extremely easy, and the serial IS held in memory, so you'll kinda find out what to look for.
?ferret
02-02-2001, 10:28 PM
LOL, hey LS, next time you pop sice, check out the data window. There's e's x's p's and various other chars everywhere (mostly 1st 3 though)......coincidental ascii representation of the hex notation.
Clandestiny
02-02-2001, 10:39 PM
Hi,

I downloaded the Windows Enforcer proggy and had a quick look at it.

Bypassing the checks is pretty easy...there are three of them. The first simply checks if the user entered string is the correct length of 24 characters (a pretty long string for a serial). The second and third checks are jz / jnz flags.

...Finding the real serial on the other hand may not be so easy. Without extensively analyzing the algorithm, it appears to be using a couple of look-up tables. One appears to be generated from your serial and the other appears to be constant. The elements in these arrays are compared. Unfortunately, generating the table from your 24 digit serial is no simple case of "serial fishing" in memory as there seem to be some extensive mathematical operations occuring / possibly some form of encryption. IMO, reversing this algorithm might be more trouble than its worth...though it could be interesting if you have the time to play with it ;-)

Might I add that Maud Dib's advice of reading some tuts is good advice. CrackZ has a number of key gen tutorials if that is your area of interest. It takes time and *much* effort to get over the initial learning curve in learning to crack / reverse. IMO, 2 weeks is nothing in the scheme of things. By first getting a good foundation in asm, reading tuts, and learning to use your tools effectively, you'll save yourself much agony and frustration. I speak from personal experience! :-)

Regards,
Clandestiny
steve38
02-03-2001, 05:02 AM
Thankyou all...It seems that this one is a little out of my depth (most seem to be) but I am having a lot of fun...at least i know it wasnt staring me in the face...
Thanks again,
Steve.
Me
02-03-2001, 07:53 AM
I apologize in advance for this post, if I piss off anybody. Steve posted a question in a NEWBIE forum, i.e. he is far from being an expert, and got a flurry of condescending answers, sending him to read the Tuts, or criticizing him for his attitude.
I have to say this because I have been in his place. If you don't ask your Newbie questions in here, the NEWBIES forum, then where?
Clandestiny went well out of his way to post a sensible answer, probably because he has been in Steve's place before, as I have been.
The people that know Soooo much about reverse engineering should answer a post if they are willing to help, not to bash a newbie or to demonstrate their contempt. We all know you have been through the boot camp, please don't kick us.
I think Steve's question was fair, though misguided. The answers could be more sympathetic.
.
hz
02-03-2001, 08:14 AM
Hi,
I don't wan't this to turn into a long slagging off thing so my last words on this subject. I actually was trying to help, his
curt reply to being directed to tutorials was
out of order, if you are polite then others will be the same, if not..

regards
steve38
02-03-2001, 03:30 PM
I would like to say that my comments were in no way intended to sound disrespectfull of Tutorials or their Author's,I have the greatest respect for people who take the time out to write them for the benefit of people like myself,who really do seem to be staring into the Abyss when starting from scratch.
Sorry if my words were misrepresentative of my true opinions.
Steve.
Lord Soth
02-03-2001, 05:51 PM
Hey guys, I doubt any of the posters in this forum intended to insult or hurt. As for directing a newbie to tutorials, well, it might seem a bit harsh to hear: you're not good enough, go read some tuts and then try again.
But bare in mind folks, nobody actually said that. And refering a newbie to tutorials is sometimes the only advice we can give.
This doesn't come to badmouth or demoralize the newbie or any1 else posting here, it's just that the point we're trying to make is to grasp a GOOD understanding of the basics, and then try again and again untill you get it right.
It's maybe unfortunate that the only learning tools available comes down to the tutorials, but that's the way it goes now.
For the people who struggle with programs, don't give up, time will make it's magic, and suddenly you'll discover you've learned a whole lot of useful things.
Keep at it and keep learning. :)

LS
?ferret
02-04-2001, 11:29 PM
?ferret (02-02-2001 12:24):
Yes, it's a problem you have with something ;-)

I didn't mean it to look *very* harsh ;-)

As anyone who's seen any number of my postings can verify, I'm a complete smarta$$ at heart :-D
the snake
02-05-2001, 12:51 AM
Hi
If you want to try to follow tutorials with the original progs, try my tuts section.
If you can't get the original version that the tut is about, e-mail me, i kept ALL the originals, so just drop me a note what do you need, and I'll send it to you or tell you where to download it from.
It is realy helpfull to follow same version as in the tutorial..
http://snakepage.cjb.net
Good luck
the snake


Logomanger 1.1.8
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Logomanger 1.1.8
PDA

View Full Version : Logomanger 1.1.8

Cesium
02-03-2001, 07:46 AM
Hi
It was a while ago since I did some cracking. But I wanted to start again, my target is Logomanger for Nokia phones.
Has anyone tried this? Is it to hard for someone who hasn't to much experience and has forget some things?

h**p://www.logomanager.co.uk
meRlin
02-03-2001, 01:50 PM
Hi,
You should read all threads in "our" small Mini Project Area to get some answer.
Cesium
02-04-2001, 10:59 AM
Oops missed that, did a search but just in the newbies forum.
But I think it looks quite hard anyway, think I refresh my mind and return to that one later


who can crack SR3.6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > who can crack SR3.6
PDA

View Full Version : who can crack SR3.6

netbee
02-03-2001, 08:16 AM
Search & Replace 3.6 Is very useful Tool
http://www.searchandreplace.com/ftp/setupsr.exe
SV
02-03-2001, 08:28 AM
It have taste of crack request ;)


Name/Password for VirtualGirl 1.54???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Name/Password for VirtualGirl 1.54???
PDA

View Full Version : Name/Password for VirtualGirl 1.54???

BadGuy
02-05-2001, 01:18 AM
Who have a name/password for VG 1.54(You can get it from www.virtuagirl.com)?
JimmyClif
02-05-2001, 01:52 AM
I'm pretty sure that ?ferret does have one ;)
stillnewbie
02-05-2001, 09:28 AM
nah JimmyClif,
www.virtuagirl.com has it :D
stanks
02-05-2001, 10:58 AM
i have one

name: FuckYou
pass: UglyAndBloodyLamer

c ya
?ferret
02-05-2001, 08:28 PM
;-)

:-D
hz
02-05-2001, 09:02 PM
Hi ?ferret,
I don't believe you have a password for
VGirl, send it to me and prove it :-)

regards
Nolan Blender
02-05-2001, 11:17 PM
IIRC, part of the protection was that you had to run
the program with the data files which you got once
the program was registered. If Ferret has the
password, and probably the relevant data files, I'm
sure there's some zero knowledge way of proving
it to you without revealing the relevant keys.

Previous versions were fairly straightforward, but I
haven't had a look at the latest version.
hz
02-06-2001, 04:48 PM
hi,
I know ?ferret has a sense of humour and thats exactly what the post was. I am quite capable of reversing it myself if I so desired.
?ferret
02-07-2001, 04:17 PM
hehe...hola hz ;-)

yes, NB it's pretty starightforward......it compares [your serial (in hex) * a fairlay large hex #) to a byte in a .prf file....since it compares this equation to only 1 byte, you have to make the serial large enough to get the register to wrap around (FFFFFFFFh+29h=28h)
It doesn't check the name at all.

The website login, however may or may not be a different story :-)~
hz
02-07-2001, 05:54 PM
Hi ?ferret,
Thanks but I never d/l VGirl (much prefer the real thing), it was just a bit of fun that
seems to have gone down like a brick.

regards
hz
ThrawN
02-07-2001, 10:07 PM
Another method of registering vg is rename any .BK1 file to .BK3 and load
?ferret
02-07-2001, 11:08 PM
ThrawN (02-07-2001 12:07):
Another method of registering vg is rename any .BK1 file to .BK3 and load

Ya, but where's the fun in that? ;-)
(I actually haven't seen any limitations in unregistered version, other than if you're not registered, you can't download the full set of files)

hz...I did catch your l'il joke. I was just confirming to NB that the protection is still straightforward and contained in about 8 lines of ASM ;-)
nblender
02-08-2001, 11:22 PM
Thanks for the confirmation about the keygen
routines. I haven't looked at this one in
a bit. Actually at the time I looked at it
for the cheap cost of it, I was going to
give them money to grab the files, but their
credit card verification system wasn't working
at the time.
?ferret
02-09-2001, 02:29 PM
ya....$3 is pretty cheap ;-)

I doubt if the same name/serial combo would work for the site anyway, as the name isn't checked in the proggie's calcs (I'm sure they add user priveleges of some sort to registered users for d/l'ing)

I haven't actually tried at the site, but like I said, quite doubtful that it would work


Signlab 5.0 rev6.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Signlab 5.0 rev6.2
PDA

View Full Version : Signlab 5.0 rev6.2

signsolutions
02-05-2001, 02:37 PM
I've patched all the dongle checks but when I plot, the screen zooms out and the 'tile' box jumps to the left. I'm stumped. Any ideas?
Bratscher
02-05-2001, 09:28 PM
I have not taken a close look to your target. However, what you are describing sounds like the protector used results from the dongle as input for the normal flow of the program. That is what the dongle manufacturers recomend, every blue moon, some protectionist use it. This info might be useful to pinpoint the place where the protection is f**king your program.
Cast
02-07-2001, 04:10 PM
Try to locate the main hasp call in the program, trace back callers and see what services they represent, with that info you can goto zencrack2.cjb.net and get info on emulateing them. If your program does rely on the returncodes, this is the best thing you can do.

BTW - Signlab last time i cracked it was very poor, during install setup.ins contains a large list of valid serials (last chars is some kind of checksum for dongle or smth) :)

I emulated the hasp routine very quickly, but im not an expert with this genre of software, could u tell me how u triggered the protection, and if u found more checks like it?

Regards,
Cast
signsolutions
02-08-2001, 02:32 PM
Hi, thanks for the pointers. I'm new to this so please excuse any simple mistakes. I used Wdasm to locate each jump which led to an error message,1 possible error with password,1 Internal error......I found 5 jumps relating to Error locating security device......I've patched all of them successfully but the first seems to control the plot function, it zooms away from the selected object and the set tiles pop up box appears only half on screen, I can drag it back and continue normally, the plot function works perfect.
dusterx
02-08-2001, 10:25 PM
I tried this target several months ago and almost figured it all out...then Real Life rudely intervened, and I haven't had time
to even think about it again until now. The method described by Jas does work...but I thought it would be cleaner to have
a hasp emulation (and more of a challenge, since I had never reversed a dongle). But to the point....Signlab 5, all revs probably,
calls two hasp api's, IsHasp and HaspId (1 and 6). There are also calls to HaspCode (2), but they seem fake, and I don't think the program would ever call them if patched properly.Bratscher is right. The problem is when the returns of HaspId get checked against the password, I couldn't figure it out.CrackZ said the same thing about the ID being checked to the password. (thanx CrackZ for your pointers in the right direction!) If you would like, I can post or email some code
snippets of where I was at when I had to quit. BTW, check out CrackZ's site for all you need to know about Hasps. Also maybe some of the old +HCU stuff like Frog's Print and
Zafer's essays, and whatever you can download at alladin's site.

regards,
dust
signsolutions
02-18-2001, 12:51 PM
Cast,
I have a list of valid serials. How do I trace the entire list in setup.ins? I'm going down a different track now any trying to emulate the dongle (thanks Bratscher!), I'm think I'm heading in the right direction now but I'm new to this so any pointers would be greatly appreciated.

Thanks

PS has anyone else worked on Signlab
goatass
12-05-2002, 03:24 PM
I'm sorry to tell you, but patching the jumps to get around the error messages will not work. You will need to emulate the dongle in order to have the application function correctly. I don't think what you are seeing is related to the dongle checks but emulating here is key. I cracked a bunch of versions of SignLab including this one and they all been easy.

goatass
CrackZ
12-06-2002, 06:57 AM
Hiya,

I recall SignLab 5, R something or other from a long time back.

I'm probably just repeating everything already stated here but as
I remember the installer had a long list of valid passwords. It
started something like the ones I've given below (there are shed
loads more), note to Woodmann, censor these if you need too.

LX2G91,FTZ79N,FP9BFL,KDS2BJ,86MHTF
XYXT4T,X9D6FY,WJ7L58,5JJGRQ,C92YJJ
0HSZTH,L7413K,C6K8DB,PTK5TB,4F0KYR
WTFP6H,7PV96J,9Q3PPN,1XPC0T,CL01YB
20PH1H,77R6P5,GTJS3C,TZ9TD4,4C0282
DCXHSF,0YWM4C,4MTRRH,XDQ2B0,F47ZNY
2F6G47,J7D603,45MWV3,G0XTFX,3ZW5RY
.....

The main program calls HASP services 1/2 and 6, I don't know
how to use the program personally, but the service 2 checks
didn't appear fake to me, they check out against good
return codes, but again I wouldn't swear to this. The HASP ID
is checked against a response derived from the password.

If you know enough about HASP's you can use my HASP emulator
plus a registry key (create it yourself) and emulate the dongle (see HASP 4 thread in other forum), the guy who posted re: UCL's emu probably is out of luck here, the source code to that emu is on the net and the time expiry stuff is all in there, you
could even compile it out if you can't figure it out.

I also know that goatass has a lot of info. about revisions of SignLab.

Regards

CrackZ.


Could use a hand with Registry Drill
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Could use a hand with Registry Drill
PDA

View Full Version : Could use a hand with Registry Drill

halifax
02-06-2001, 12:32 AM
Has anyone tried cracking Registry Drill V1.2.03. It can be had at:

http://www.easydesksoftware.com

Unfortunately, it is about 3.5MB. It is a 10 day trial. I loaded it onto my hard about a month ago, but have not been able to look at it till now. It is a VB5 program that is p-coded, so there is not much useful information from SmartCheck (that I could find anyway). The interesting registry key that I found with Regmon is:

\HKEY_USERS\.Default\Software\VB and VBA Program Settings\Registry Drill\Content\Registration

The key value is blank when the program is installed. If you load a string value into it, it responds right after reading that key (and followed with a BAD_KEY) with:

"It appears that you are a registered user. With this update the unlock code has change. Please contact IDRequest for another unlock code....."

I put a bp on RegQueryValueEx if *((esp->8)== 'Regi' do "d esp->14", let it pop three times and followed the code. I put some bpr on the fake unlock code, but could not find where it was being compared or what manipulation was being used. It just changed it to Wide Char and then back (unless I missed something in between) and was not looked at again. Just seems to be a lot of p-code woods.

Any suggestions?
josephCo
02-11-2001, 12:28 AM
I'm not 100% positive about the app (I think it's this target), but if it's the same one I'm thinking of registry drill HAS to be patched. Its been quite some time, but as I remember it goes something like this:

1) read registry value
2) store value in variable
3) overwrite variable

There seems to be a missing call to the algo (if the algo is even there). THEN a certain value is stored in a hidden object on one of the forms. That value is checked throughout the program. If the program had a registration function, then it'd do everything for you! As it is, you'll have to rewrite a few little sections of code and it should be fully reg'd.

Good luck :)

joe
halifax
02-18-2001, 05:41 PM
The program did have a registration function, but when the time trial expired it took the registration function with it. I believe you are right that if you do not register with that function it does not do any good to insert a correct SN in the registry key (which I have done). The irony here is that I was able to get the registration screen to come up early on (after the trial expired), but I was trying to create/find a good SN so did not really pay attention to what I had done to get it. Thanks for your info josephCo.

halifax


When tut's go amiss?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > When tut's go amiss?
PDA

View Full Version : When tut's go amiss?

D++Cracker
02-06-2001, 05:56 PM
I am new to the scene here and have completed only a few tut's using W32Dasm and more recently SI. One thing I have found about the SI tut's is that sometimes when the author includes snipets of the programs code it is totally different than what I ended up with. It doesn't happen all the time but it is a little disconcerning to be working a program out and then all of a sudden I'm totally lost because my screen shows something completely different than that of the author. Has anyone else come across this problem? I'm sure it's something I'm doing but I don't have a clue as to what it is. Any ideas?

Thx

D++
Bratsch
02-06-2001, 08:56 PM
When working with Sice the program is "alive", i.e. the flow of the program may change based on the contents of some variables in memory. If your variables are for some reason different from the Tut's author, your program might have branched to some uncharted territory. Also you have to be very careful: the author may have stepped into a call (F8/) whilst you stepped over it (F10) and the picture you see is completely different.
Also sometimes the version of the program you downloaded may be different than the version the tut's author was using.
Moreover, tutorials are not professionally produced and edited to be 100% correct. The authors do their best to explain their steps but they may not remember the exact route they took in their cracking endeavors so you sometimes have to do some exploring on your on. Not to say, there are plenty of excellent tutorials that will take you by the hand into understanding the code and the reverse engineering universe. The trick is getting the best each one has to offer and not getting discouraged if a few do not seem to work as expected.


Fatal errors
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Fatal errors
PDA

View Full Version : Fatal errors

KARL
02-07-2001, 01:59 AM
I read your article about how to get red of the neg on the Image.exe demo program with Win32Dasm used as a debugger. I must say that it is indeed interesting.

However, I have a question for anyone. I really appreciate it if anyone could offer advise, please. Is it possible to get red of Fatal Errors(Exception Errors) of a problem program that I have?

The program is in C++. I ran Win32Dasm debugger on it, and the Fatal Errors would occure at some instruction like cmp eax, 000000C0 in a .dll file of the program. There are a few errors on other dll file also like in system.dll and kernel32.dll and also on some test ecx,eax statement. Could I reverse the errors with Win32Dasm v 8.9 and Hexworks?

How do I go about reversing the AI of the program? Could you offer some suggestions on this please.

Sincerely,

Karl
newcomer
02-09-2001, 09:57 AM
There are a few errors in system.dll and kernel32.dll.

LOL !!! 8)
KARL
02-22-2001, 02:40 AM
newcomer (02-08-2001 23:57):

There are a few errors in system.dll and kernel32.dll.

LOL !!! 8)

How to fix it?

Karl


ASm help!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASm help!
PDA

View Full Version : ASm help!

NeO
02-10-2001, 04:40 AM
I need little asm help!

:00448055 8945B0 mov dword ptr [ebp-50], eax /**In eax
123**/
:00448058 DB45B0 fild dword ptr [ebp-50] +++++
:0044805B DB2DC88A4400 fld tbyte ptr [00448AC8]++++++
:00448061 DEC9 fmulp st(1), st(0)+++++
:00448063 DB7DA4 fstp tbyte ptr [ebp-5C]++++++

I just want to know what those lines marked with ++++ do with eax!

Thanks for helping!

NeO
JimmyClif
02-10-2001, 08:15 AM
Here I'll copy paste a few lines from AoA:

The FLD instruction:
The fld instruction loads a 32 bit, 64 bit, or 80 bit floating point value onto the stack. This instruction converts 32 and 64 bit operand to an 80 bit extended precision value before pushing the value onto the floating point stack.

The fld instruction first decrements the tos pointer (bits 11-13 of the status register) and then stores the 80 bit value in the physical register specified by the new tos pointer. If the source operand of the fld instruction is a floating point data register, ST(i), then the actual register the 80x87 uses for the load operation is the register number before decrementing the tos pointer. Therefore, fld st or fld st(0) duplicates the value on the top of the stack.

The FILD Instruction
The fild (integer load) instruction converts a 16, 32, or 64 bit two's complement integer to the 80 bit extended precision format and pushes the result onto the stack. This instruction always expects a single operand. This operand must be the address of a word, double word, or quad word integer variable. Although the instruction format for fild uses the familiar mod/rm fields, the operand must be a memory variable, even for 16 and 32 bit integers. You cannot specify one of the 80386's 16 or 32 bit general purpose registers. If you want to push an 80x86 general purpose register onto the FPU stack, you must first store it into a memory variable and then use fild to push that value of that memory variable.

The FMUL and FMULP Instructions
The fmul and fmulp instructions multiply two floating point values.
With no operands, fmul and fmulp both do the same thing - they pop st(0) and st(1), multiply these values, and push their product back onto the stack. The fmul instructions with two register operands compute destination := destination * source. One of the registers (source or destination) must be st(0).

The FSTP Instruction
The fst and fstp instructions copy the value on the top of the floating point register stack to another floating point register or to a 32, 64, or 80 bit memory variable. When copying data to a 32 or 64 bit memory variable, the 80 bit extended precision value on the top of stack is rounded to the smaller format as specified by the rounding control bits in the FPU control register.

The fstp instruction pops the value off the top of stack when moving it to the destination location. It does this by incrementing the top of stack pointer in the status register after accessing the data in st(0). If the destination operand is a floating point register, the FPU stores the value at the specified register number before popping the data off the top of the stack.

-------
Hope this helps...
JClif
hz
02-10-2001, 08:24 AM
Hiya JC,
well thats that all cleared up then, think I
will stick with wf and dl [ebp-50] and see
if I can't figure it out from there, still its
worth bearing in mind :-)
regards
NeO
02-10-2001, 09:21 AM
Thanks JimmyClif !

Here I'll copy paste a few lines from AoA!

what that were did you get it!!

NeO
NeO
02-10-2001, 09:40 AM
Can you tell me what's the value do i get out!

Thanks!!

NeO
Bratsch
02-10-2001, 11:23 AM
:00448055 8945B0 mov dword ptr [ebp-50], eax ; the eax, hex dword value is moved to ebp-50

:00448058 DB45B0 fild dword ptr [ebp-50] ;the value in ebp-50 is pushed to the top of the float stack and transformed from hex to float format in the process

:0044805B DB2DC88A4400 fld tbyte ptr [00448AC8];now the contents of a global variable, stored in 00448ac8, is pushed to the float stack and transformed to float format in the process

:00448061 DEC9 fmulp st(1), st(0) ;the two previous pushed values are multiplied with each other, the result is stored, in float format, in the top of the float stack, st(0).

:00448063 DB7DA4 fstp tbyte ptr [ebp-5C] ;the result is transferred (poped) from the float stack to ebp-5c.

In other words the contents of eax is multiplied, using float arithmetics, with the number stored at :00448AC8. The result is placed in ebp-5C.
Bratsch
02-10-2001, 11:27 AM
the result in esp-5c will be, I think, in float format, so change the mode of the data window to ercognize its value
JimmyClif
02-10-2001, 12:33 PM
AoA = Art of Assembly

get it here: http://webster.cs.ucr.edu/Page_asm/ArtofAssembly/ArtofAsm.html

---
hz : I tried to help tho... I don't understand this floating point stuff myself good enough to give better advice :'(

JimmyClif
NeO
02-10-2001, 01:00 PM
Thanks to everyone !Very good answers!A lot of help!

For -Bratsch :esp-5c will be, I think, in float format, so change the mode of the data window to ercognize its value!!

How ???

NeO
JimmyClif
02-10-2001, 03:53 PM
To hz (again)

Did you know that the more often I read your little answer the more I think it got funny?
;)

"Sarcasmically",
JimmyClif
hz
02-10-2001, 04:18 PM
Hiya JimmyClif,

honestly man, it was'nt meant to upset
anyone. Of course you tried to help, If I offended you then I apologise. Second time
this week I've unintentionally upset someone.

best regards
hz
JimmyClif
02-10-2001, 06:13 PM
To hz:

No man,

No worries :) I know how you meant it! I didn't get upset.. actually I started laughing as you caught me right in the act :D

Bestest,
JimmyClif

PS: (besides the FSTP I was able to get the AoA text, and I thought it might help)
Bratsch
02-10-2001, 06:20 PM
NeO (02-10-2001 03:00):
Thanks to everyone !Very good answers!A lot of help!

For -Bratsch :esp-5c will be, I think, in float format, so change the mode of the data window to ercognize its value!!

How ???

NeO

In softIce, click repeatedly the upper margin of the data window where it says "byte" (usually) it will cycle to word dword short real, long real, 10 byte real. The format command has the same effect.Also type the softIce command: wf f (window, float stack float format) it will activate a window with the contents of the float stack, in float format.
NeO
02-11-2001, 08:57 AM
Thanks man !!for helping!That really help and i crack it and wrote a keygen!

NeO


Does anyone know where to get unpacking(full) Miz+Sandman project!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Does anyone know where to get unpacking(full) Miz+Sandman project!
PDA

View Full Version : Does anyone know where to get unpacking(full) Miz+Sandman project!

NeO
02-10-2001, 01:10 PM
I found one at unpacking goods sit and at krobar's but they dont have everything!I was looking at sandman's page and i can't find it!

Thanks to everyone that help!

NeO
the snake
02-19-2001, 10:54 AM
Hi NeO
First, as far as i remember, this project didn't took place, we lost a great chance to learn from this guy, Miz, he did great work with unpacking.
I've found the file on my machine, it called Latest.zip.
the file have some sub-folders to use with the up coming project, and still empty, but the good news are that it have in it some good txt files written by Miz, and some FAQ that can clear out some basics about unpacking manualy.
If you want me to e-mail you the file, e-mail me at :
th_snake@hotmail.com

regards
the snake


Ultraedit 8.00
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Ultraedit 8.00
PDA

View Full Version : Ultraedit 8.00

cerb^^
02-11-2001, 11:40 AM
Hi,

have anyone a Tut for Ultraedit 8.00 how can find the right serial.

Thx

cerb_@gmx.de

cerb^^
aimless
02-12-2001, 02:17 AM
Better fo leeching the PC/TNT patch mate.


can't crack newer version using older version tuts.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > can't crack newer version using older version tuts.
PDA

View Full Version : can't crack newer version using older version tuts.

bas
02-11-2001, 11:53 PM
I tried to get the serial of winzip 8 using the tutorial to get serial no of winzip 7 and i couldnot do any good. help....
Me
02-12-2001, 03:47 PM
The new version proctection scheme may have changed, from slightly to substantially. I have not checked it myself. Try searching for the short pieces of code depicted in the tutorial. It may happen that the coding is the same, but it just got relocated to a different area in the compilation /linking of the new version. OR, the authors of WinZip became tired of giving away their app, as they have been doing, and implemented a more elaborate protection. In that case, the literal use of the tutor will not be of much use, and you may have to explore the new protection. Keep in mind that, as a rule of thumb, programmers tend to change the DETAILS of protections, but the philosophy of it tends to remain constant (Protectionist Personality Trait? or Efficient re-use of Code?).
Hope this helps.
?ferret
02-12-2001, 08:40 PM
Winzip 8 has the EXACT same protection as ALL of the previous versions. Only the addresses have changed. The same breakpoints etc. all still work.

(ask any of the regulars here....I know my winzip hehe ;-))

Want to see a few different ways to attack it? check out qferret.cjb.net


Timelimit...need suggestion
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Timelimit...need suggestion
PDA

View Full Version : Timelimit...need suggestion

CantCrack
02-12-2001, 09:52 PM
I'm attempting to crack a 30-day time limited program with no nags. The program works fully featured until the final day in which a box will come up indicated that the trial expired.

What are the known methods used (especially on more expensive software packages) to store this information? If anyone has some experience with this, please feel free to share your advice with a newbie so I don't go re-inventing the wheel. Since i'm very unexperienced, I'm looking for some suggestions as to how they are monitoring the date. What can I breakpoint on to see whats going on?

Thanks for any input!!
NF
Solomon
02-12-2001, 10:22 PM
Try "bpx GetLocalTime". For VB progs, "bpx rtcGetPresentDate" also works, perhaps this function is implemented with GetLocalTime.
pupp
02-12-2001, 10:53 PM
Try bpx gettickcount
CantCrack
02-13-2001, 07:59 AM
Also another important note:

If you change the date forward and then start the program, It reflects the increase by decreasing the number of trial days left. If you change the system clock back, you will now get the "trial expired" message box and no program.

Also, for example if I had 30 days left in the trial and I uninstalled and then reinstalled OR just reinstalled, I would get the "trial expired" box.

Isn't it true that this information MUST be stored in a file or registry for it to remember even if it's program directory has been deleted.

If this information adds anything new that could help me limit down what I should be looking for, please let me know!!

Thanks
NF
Lord Soth
02-13-2001, 01:20 PM
In this case you really out to check out the registry and local file system.
Use RegMon and FileMon and see what this program stores and where. Once you find out where it's storing the info, you can experiment all you want :)

LS
?ferret
02-13-2001, 08:43 PM
Another way (easy way out in some cases).....

BPX MessageBoxA....set your clock ahead....when expired message pops sice...F11 back to proggie code

above the call for the MessageBox you'll probably see a Call (or if you're lucky the compare itself)....trace through & find the DaysLeftInTrial compare and patch it ;-)
CantCrack
02-13-2001, 10:10 PM
You guys are good!! I succeded at patching one of the six applications included in the "suite". The one I started with was the smallest and probably the easiest.

I initially started out using Reg and Filemon, but saw nothing that looked anything like either writing or reading date information. zI then tried the various Time APIs, but they were called too frequently and it was difficult to figure out which one was a good place to break in. I then used MessageBoxA and traced back. Found the byte and nop'd it. Works so far.

I started to do the next one, but so far no luck. It must be deeper than I think...I'll keep looking though. I guess It is pretty normal for the actual call to be embedded much further in the code than a couple of page ups right?

Thanks for your help!! This is the first program I ever attempted to crack.

Thanks!!
CC
Bratsch
02-14-2001, 11:16 PM
Some General Suggestions.
I an not an expert as other people that have answered your post before, but I have been in similar woods as you are now.

When you set bpx on time-related API functions, is not unusual that softIce breaks a bunch of times. Many of the calls are not coming from your target application! Make sure to deactivate as many apps as possible from the system tray and from the system in general. Real Player, for instance calls a GetsytemTime like every second. GetRight does it too. Trim down windows to the Bare bones. Then the Time API call breaks may be more relevant.
2- Some times the Protection obtains the current time by creating or modifying a file and then quering the file time stamp. BPX on the Usual windows time API calls will not catch this. CreateFileA may do the trick.
3- Do all Applications on the suite time out simultaneously when you advance your computer clock? or each one seems to keep its own 'time of instalation' record. You may get away with cracking the time keeping files or dll devices instead of cracking each App individually.
CantCrack
02-15-2001, 07:52 AM
I did find the section of code by bpxing the GetLocalTime API finally. I do know that it creates two temporary files and deletes them within the startup, don't know if that helps me at all.

I'm currently wading through the code prior to the call to MessageBox. It's difficult to find the place where the comparison is made on the remaining 5 programs. The one that I did crack seems to be completely different than the other 5. The 5 all have the same "format" and once I find one of them, I should be able to fix all 5 using the same method. Haven't had much time to mess with it, but I'll play with it on the weekend.

Yes, all 6 of the applications time out on the same date. Unfortunatly, I can't find where it's getting the time info in either the Registry or a file. I setup filemon and regmon on another computer and installed the software there. I saved the logs. I keep seeing that it's accessing a few keys that have the words "cryptography" and "seed". Is this some area that is hidden? Is this where the date information could be?

Thanks!
CC


Info about keyfiles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Info about keyfiles
PDA

View Full Version : Info about keyfiles

SirLeechaLot
02-13-2001, 05:36 AM
hy all :)

I´m just trying to get into keyfiling so I would love to have some suggestions for sites, which contain good tutorials about this topic.
It would also be great to know some apps which use this kind of protection and are easy to crack for a newbie. I tried abook and ISDN 2000 but I couldnt really crack it cause there are some routines I can´t interpret. :(

Any help would be very nice. Thanks in advance

siRl
Clandestiny
02-13-2001, 08:09 AM
Hi SirLeachaLot,

Have you tried the local fravia search engine. I did a search on keyfiles a while back and if I remember correct, it came up with several tuts. Also, there was a mini project a while ago which involved constructing a very simple type of keyfile. You might want to have a look at it if you haven't already. Also, the current project on GlobeTime has a keyfile protection so you might be interested in that one as well.

Regards,
Clandestiny


Help with manual unpacking!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with manual unpacking!!
PDA

View Full Version : Help with manual unpacking!!

NeO
02-13-2001, 12:49 PM
For Kayaker or evenone with ideas!
So i have one another Pecryp 1.02 the problem is not normal !If you opened it with Peedit you get .ficken in every section!In normal Pecrpy it's only in the last one!So i you use PeCrpy unapcker it opens it and at the he gets an eRROR!SO i have to unpack it manually!

[imagebase] 400000 ,OEP is 401000 , after /tracex command i used /pedump 400000 1000 D:\kl.exe!
And he says 400000 is not original Pehead!
Where should i find it???
If i use /dump 400000 1000 D:\kl.exe! it dumps it but the problem is that there is no Pehead so no MZ!!

You can convert a /DUMP [imagebase] [length of file] to a working PE as well afterwards using Procdump, PEditor or some other util. Assuming of course the packer hasn't pulled some other trick such as corrupting the Import table or the PE Header
Kayaker did you mean you the bhrama server!If i use bhrama server on Pecrpty 1.02 I get shut down off Loader!!

Thanks for helpinG!!
Kayaker
02-13-2001, 01:36 PM
No need to crosspost so much Neo. You haven't said yet if the suggestions you've already received on 2 of the other boards were of any use.

Do you or do you not see a PE Header in memory before dumping, or in the dumped file itself? If not, consider the possibility that you don't have the right dump address.

Regards,
Kayaker
NeO
02-13-2001, 02:32 PM
Sorry for that but i would like to reach you by email if posible!!

NeO


What Happened to #Cracking4Newbies ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What Happened to #Cracking4Newbies ?
PDA

View Full Version : What Happened to #Cracking4Newbies ?

Bratsch
02-13-2001, 10:51 PM
Question Might be of Topic, but:

What happened to the #Cracking4Newbies IRC channel? It certainly was an institution of the
"Scene" (I was not a regular), but over the last 4 weeks the contents of the channel, and the
Crowd, has changed substantially. It is now BORING. Before, there was an aristocratic scheme
of newbie bashing, that I , despite being on the receiving end, rather enjoyed.
Could anybody in the forum comment what is going on?
If the question is off base, may the moderator take out this posting?
rg_
02-14-2001, 06:02 AM
Bratsch (02-13-2001 12:51):
Question Might be of Topic, but:

What happened to the #Cracking4Newbies IRC channel? It certainly was an institution of the
"Scene" (I was not a regular), but over the last 4 weeks the contents of the channel, and the
Crowd, has changed substantially. It is now BORING. Before, there was an aristocratic scheme
of newbie bashing, that I , despite being on the receiving end, rather enjoyed.
Could anybody in the forum comment what is going on?
If the question is off base, may the moderator take out this posting?

Hi

I don't think it became "boring". But that's not what the chan is for anyway. It's more to support newbies and not bash at them and the Chan-Ops (like Carp, who is probably commenting here later ;) ) are trying to reduce newbie bashing and increase the motivation of the ops to support newbies currently, too.

If you have the desire to be bashed you can still msg me ;)

Regards
rg_
Bratsch
02-15-2001, 12:39 AM
rg_ (02-13-2001 20:02):
Bratsch (02-13-2001 12:51):
Question Might be of Topic, but:

What happened to the #Cracking4Newbies IRC channel? It certainly was an institution of the
"Scene" (I was not a regular), but over the last 4 weeks the contents of the channel, and the
Crowd, has changed substantially. It is now BORING. Before, there was an aristocratic scheme
of newbie bashing, that I , despite being on the receiving end, rather enjoyed.
Could anybody in the forum comment what is going on?
If the question is off base, may the moderator take out this posting?

Hi

I don't think it became "boring". But that's not what the chan is for anyway. It's more to support newbies and not bash at them and the Chan-Ops (like Carp, who is probably commenting here later ;) ) are trying to reduce newbie bashing and increase the motivation of the ops to support newbies currently, too.

If you have the desire to be bashed you can still msg me ;)

Regards
rg_

Have Had enough bashing for now thank you. :() anyway. BORING was a poor choice of words. The activity inside the channel apppears to me is lower than before. The bashing was not pleasurable by any stretch of imagination. However the 'aristocracy' as I called them before were the main bashers and the most helpful and kowledgeable people once you catch them in the right mood.
?ferret
02-15-2001, 07:33 PM
Many have seemed to become bored with answering the same questions all the time, although this is unfortunate since the chan is to help newbies, it is understandable to some extent.

In my experience, if it is a different and/or interesting question/problem, someone or several someones will try to help.

If it's covered in the faq or can be found doing a simple search in 5 minutes, prepare to be flamed hehe
Carpathia
02-16-2001, 02:07 AM
To answer Bratch's comments, I think its understandable that a channel this size will be full of mindless and rather dull chat. You cant sit quiet in the channel and expect to learn a great deal, just by reading other peoples dross.

C4N is very reactive, if there's someone asking questions, some people will generally help out. Also, a lot of conversations talke place in private messages. If theres something you want to know but arent keen on asking in the channel, feel free to message me or one of the other ops.

Regards

Carpathia
disavowed
02-19-2001, 07:17 PM
i think it's been boring because i haven't been around much lately (seeing as how all discussions in the channel revolve around me) :P

btw, speaking of which.. carpie: how the hell do i get re-added to these new bots?


Password encryption used by Windows/Outlook Express
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Password encryption used by Windows/Outlook Express
PDA

View Full Version : Password encryption used by Windows/Outlook Express

JRF99
02-14-2001, 06:50 AM
I use Outlook Express with several identities. I've forgotten my password to one identity which logs on to Hotmail and I know that the password is encrypted somewhere on my machine. I've found in the register all the info I need together with the HTTPMail Password2= 01, 02, 03 and so on.

I'd really appreciate some help on how to decrypt this binary or info on where to look to get this password. I'm a newbie and aplogize if I offend someones intelligence... Hope for help anyway though...
Bratsch
02-14-2001, 02:13 PM
JRF99 (02-13-2001 20:50):
I use Outlook Express with several identities. I've forgotten my password to one identity which logs on to Hotmail and I know that the password is encrypted somewhere on my machine. I've found in the register all the info I need together with the HTTPMail Password2= 01, 02, 03 and so on.

I'd really appreciate some help on how to decrypt this binary or info on where to look to get this password. I'm a newbie and aplogize if I offend someones intelligence... Hope for help anyway though...

Try a tool called "CAIN 1.51".h$$p://www.confine.com/downloads.shtml
It may help you decript your password. I have not used with Outlook Express specifically, but it has done a decent job when I have had the need.
mike
02-17-2001, 04:12 PM
Outlook stores the CRC of the password in the .pst file. Any password with the same CRC is accepted.

What kind of encryption did you use? If it's "none" or "compressible," you can search for a signature in the file.

none: ff670300 next 4 bytes are CRC

compressible encryption replaces each byte x with firsttable[x]

unsigned char firsttable[256]=
{
0x41, 0x36, 0x13, 0x62, 0xA8, 0x21, 0x6E, 0xBB,
0xF4, 0x16, 0xCC, 0x04, 0x7F, 0x64, 0xE8, 0x5D,
0x1E, 0xF2, 0xCB, 0x2A, 0x74, 0xC5, 0x5E, 0x35,
0xD2, 0x95, 0x47, 0x9E, 0x96, 0x2D, 0x9A, 0x88,
0x4C, 0x7D, 0x84, 0x3F, 0xDB, 0xAC, 0x31, 0xB6,
0x48, 0x5F, 0xF6, 0xC4, 0xD8, 0x39, 0x8B, 0xE7,
0x23, 0x3B, 0x38, 0x8E, 0xC8, 0xC1, 0xDF, 0x25,
0xB1, 0x20, 0xA5, 0x46, 0x60, 0x4E, 0x9C, 0xFB,
0xAA, 0xD3, 0x56, 0x51, 0x45, 0x7C, 0x55, 0x00,
0x07, 0xC9, 0x2B, 0x9D, 0x85, 0x9B, 0x09, 0xA0,
0x8F, 0xAD, 0xB3, 0x0F, 0x63, 0xAB, 0x89, 0x4B,
0xD7, 0xA7, 0x15, 0x5A, 0x71, 0x66, 0x42, 0xBF,
0x26, 0x4A, 0x6B, 0x98, 0xFA, 0xEA, 0x77, 0x53,
0xB2, 0x70, 0x05, 0x2C, 0xFD, 0x59, 0x3A, 0x86,
0x7E, 0xCE, 0x06, 0xEB, 0x82, 0x78, 0x57, 0xC7,
0x8D, 0x43, 0xAF, 0xB4, 0x1C, 0xD4, 0x5B, 0xCD,
0xE2, 0xE9, 0x27, 0x4F, 0xC3, 0x08, 0x72, 0x80,
0xCF, 0xB0, 0xEF, 0xF5, 0x28, 0x6D, 0xBE, 0x30,
0x4D, 0x34, 0x92, 0xD5, 0x0E, 0x3C, 0x22, 0x32,
0xE5, 0xE4, 0xF9, 0x9F, 0xC2, 0xD1, 0x0A, 0x81,
0x12, 0xE1, 0xEE, 0x91, 0x83, 0x76, 0xE3, 0x97,
0xE6, 0x61, 0x8A, 0x17, 0x79, 0xA4, 0xB7, 0xDC,
0x90, 0x7A, 0x5C, 0x8C, 0x02, 0xA6, 0xCA, 0x69,
0xDE, 0x50, 0x1A, 0x11, 0x93, 0xB9, 0x52, 0x87,
0x58, 0xFC, 0xED, 0x1D, 0x37, 0x49, 0x1B, 0x6A,
0xE0, 0x29, 0x33, 0x99, 0xBD, 0x6C, 0xD9, 0x94,
0xF3, 0x40, 0x54, 0x6F, 0xF0, 0xC6, 0x73, 0xB8,
0xD6, 0x3E, 0x65, 0x18, 0x44, 0x1F, 0xDD, 0x67,
0x10, 0xF1, 0x0C, 0x19, 0xEC, 0xAE, 0x03, 0xA1,
0x14, 0x7B, 0xA9, 0x0B, 0xFF, 0xF8, 0xA3, 0xC0,
0xA2, 0x01, 0xF7, 0x2E, 0xBC, 0x24, 0x68, 0x75,
0x0D, 0xFE, 0xBA, 0x2F, 0xB5, 0xD0, 0xDA, 0x3D
};

so you would need to look for firsttable[ff 67 03 00] = [3d 53 62 41] and
the next 4 bytes are the encrypted CRC. Invert the table above to
figure out the actual bytes

CRC is linear and invertable, so you shouldn't have much trouble in finding
a password that's all printable characters. Write me if you need help.

If you used "best" encryption, there's no signature to search for. Download one of the shareware programs that does outlook password recovery and hack it or pay for it.


Softice problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice problems
PDA

View Full Version : Softice problems

skiabox
02-14-2001, 04:39 PM
I recently installed softice 4.05 for win 2K.It is the latest version.The shortcut that it creates on the desktop points to a bat file.This bat file contains the following command : net start ntice.When it runs it produces the following error : 'net' is not recognized as an internal or external command,operable program or batch file.Any ideas?
hOrn_dOg
02-15-2001, 04:03 AM
Hi

Change the startup to be at 'boot' time (you can press 'ESC'
if you don't want to load SI)

START/Programs/numega softice/startup mode selection

If SI don't load then you have a problem.
Re-install.


aol
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > aol
PDA

View Full Version : aol

?ferret
02-15-2001, 07:47 PM
hmmm. An RCE CD request from an aol.com email addy........what to do, what to do?
:D :D :D :D :D :D :D :D
Kayaker
02-15-2001, 11:19 PM
Are you saying you don't think serious Reverser's use AOL? :o
stillnewbie
02-16-2001, 10:34 AM
Kayaker (02-15-2001 13:19):
Are you saying you don't think serious Reverser's use AOL? :o

Hi Kayaker,
?ferret doesn't mean that,I think coz of irc is banning aol isp servers,he juz likes to
joke about it :-)
Robtam
02-16-2001, 05:48 PM
Had a request from a lawyer in califorinia...
wasn't quite sure about that either but for
legal reasons.......anyone have any opinions about how legal sandman's disclaimer is in this country.....???
Lord Soth
02-16-2001, 10:16 PM
What do you mean exactly ?

LS
?ferret
02-18-2001, 12:26 AM
Everything on there is printed with authors permission. The software is freeware or shareware with limitations intact.

Hardcopies of information also seems to have different standards than online. If I wrote a book about how to make a homemade nuclear warhead, it would get catalogued in the Library of Congress...the worst that would happen is some bad press.....but if I post it on the web, the space provider would most likely delete it it / and or there would be the threats/reality of lawsuits by various orginizations.

I think the absolute worst that would happen is some overpaid legal eagle would order us to cease & desist (hehe like that would happen)
?ferret
02-18-2001, 12:29 AM
stillnewbie (02-16-2001 00:34):
Kayaker (02-15-2001 13:19):
Are you saying you don't think serious Reverser's use AOL? :o

Hi Kayaker,
?ferret doesn't mean that,I think coz of irc is banning aol isp servers,he juz likes to
joke about it :-)

I do just like to joke about it....but I don't think many serious computer users use AOL, much lss serious reversers LOL


Need more help on this TimeTrial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need more help on this TimeTrial
PDA

View Full Version : Need more help on this TimeTrial

CantCrack
02-15-2001, 10:11 PM
I'm still having all kinds o' problems getting a simple time trial cracked. I cracked 1 of the 6 programs that came with it. The other 5 are pretty close to the same code (very similar at least).

I'm hoping someone out there could assist me in one of these 5 programs contained in the "suite". I'm not asking for you to do the work, but I really do need some advice. Since this is the first attempt for me to crack, I need to know if I'm even on the right track.

This is a pretty large app (~39MB), but I have it on my FTP and you should be able to download it pretty quick. The program is called P-CAD 2001 and is probably the most popular software used to design printed circuit boards. A single license costs around $10,000. From what I can tell, there is nothing difficult about the protection. I'm just overlooking something extreamly simple. Anybody that can offer some assistance, please help me look into one of the apps. The app that I will continue to try is "pcb.exe".

ftp://64.14.40.88:21/Revlon/graphics/pcad2001.zip (You don't need an FTP client to dl)

Anyway, I'm going to keep looking in pcb.exe and if someone could please assist and see if i've overlooked something simple!

Thanks a lot!!
CantCrack
Kayaker
02-15-2001, 11:15 PM
Hi,

Maybe we can still help without having to d/l the whole suite. In your earlier threads you mentioned using Filemon and Regmon and found a few suspicious entries. Have you tried deleting them (actually a simple rename is safer) from the Registry and see if it renews your time trial? The "cryptography" and "seed" entries sound like they're more likely involved with the reg routine. When looking at Regmon output, it's easy to miss a suspicious CLSID entry or some other "hidden" in what seems like a normal Windows registry key name. Install date info is often kept in these odd keys. Looking for a cryptic string in the "Other" column of Regmon might indicate something. You can double-click on any entries you want to check out closer which will open up Regedit.

If you find the critical Registry key (assuming that's what it is), deleting it doesn't guarantee renewing the time trial, this in itself may expire the program, or it may store this info elsewhere as well. It sounds like this program is professional enough to protect itself from easy cracking (heh, heh, THAT'S no guarantee either).

You also mentioned if you set the system clock ahead, and then back it expires itself. This seems to indicate something is being written to the Registry each time it's used i.e. it's a counter of days/uses as opposed to simply comparing with the install date. In this case you could use an API monitor or set a break on RegSetValueExA (or perhaps WritePrivateProfileStringA or WriteFile) and when you close the program you may find what Registry keys are being written to. It may even call GetLocalTime again before writing.

The other thing while tracing in the code after a GetLocalTime call is to monitor the registers for the day/month/year as hex. This may help you figure out where critical comparisons may be taking place i.e. 2001 is 7D1 in hex.

Lastly, if you still can't figure out if the Regmon/Filemon output is telling you much, why not upload just the logs as a zip, either to your ftp or just attach them to your post. Maybe someone will twig on what the suspicious log entry might be.

Anyway, just a few thoughts.

Cheers,
Kayaker
Bratsch
02-16-2001, 12:25 AM
Hi,
I downloaded from your FTP to my computer at work. (T3 connection, 15 min) First time around, the file did not unzip. Second time around it Unziped but gave me a "iKernel" mistake when I tried to install. Either my or your connection is allowing some rotten bytes through, or the rip that you packed is not sufficient to install a working version of your program. Also, Is it Windows NT specific?
I have win98 in the computer the file is now. I cannot do much more exploring from here, at home, because I cannot remote control computer at work and SICE in it simultaneously.
I did a sincere try to help.
CantCrack
02-16-2001, 08:26 AM
I downloaded it myself just to double check. For some strange reason winrar cut the names of the files. Rename the files:

up.inx -> setup.inx
up.ini -> setup.ini
up.exe -> setup.exe
rnal.ex_ -> ikernal.ex_
out.bin -> layout.bin
a2.cab -> data2.cab
a1.cab -> data1.cab
a1.hdr -> data1.hdr

After that, it will install just fine. I will fix the pack and reup later in case anyone else wants to take a look at it. Also, thank you very much for any assistance you can provide. And thanks to kayaker for your help as well, i'm currently trying what you suggested. Anybody willing to take a look at the software, please post anything that you find that may help me on my journey!

New link to new archive:
ftp://64.14.40.88:21/Revlon/graphics/pcad2001.rar

Thanks in advance!
CC
Bratsch
02-17-2001, 12:47 PM
Hola, Cant:

I took a look at your Suite.

I recognized some code I have seen before in SentinelLM protected packages. It is not completely equal to the already well (tutorial) documented schemes of the Borland Delphi, Borland C Builder, but it has several similarities. Some of the files share the same names, LICENSE.INI for example. Take a look at the tutorials at
http://www.woodmann.net/fravia/Delmaci.htm
http://www.woodmann.net/fravia/tse_cbuilder.htm
Even more, when I messed around with the Jumps in one of your files, the Sentinel Loader was activated!. So your suite invoked sentinel dll somewhere along the lines.

2 Your Apps invoke a getlocalTime, GetSystemtime containing routine no less than 30 times at loading and then esentially every time they do something thenafter. A call to the time protection routine is probably invoked as part of a heavily used routine, probably to obfuscate Sice based crackers.

Try dead listing several of your programs ind searching for the code of the routine (is the same in all of them. This does not tell you how to crack it but it surely tell you where it is.

3 There is a nag screen: "Trial has expired".
At least one of the evaluations takes place before this window is called. try backtracing this dialog.

The protection does not appear trivial to me.
but I hope I gave you some directions to explore.
CantCrack
02-17-2001, 03:07 PM
Thanks for your assistance!!

I know that this package in previous versions was NOT available in a timed demo and could only be purchased with the infamous Sentinial dongle. This is no longer the case. I believe if I were to purchase the software, I would be given a dongle that would unlock the programs perminantly. I'm sure someone could crack the dongle and enable it that way, but for a noobie like myself, I think I would concentrate more on the 30-day trial portion.

The getlocaltime approach looks a little too deep, but probably doable. The messagebox "Trial Expired" and backtracking is the approach I have been using. I've looked pretty deep and I have found several places where I think that the jump is taking place. I then patch the spot and re-run it and it will only do something like change the size of the messagebox....pretty depressing. From what I can tell, I completly patched the entire call that contains the messagebox function and somehow it still breaks in on the messagebox. From the coding standpoint, I don't see how it could ever be called after what I did to it.

Being that this is THE only program I have ever attempted to crack, I really can't compare or relate the difficulty to any other protection or program. Keeping things simple, I would say that defeating the trial has expired crap is as easy as any other timetrial...but maybe not. Also, I was able to crack SR.exe by patching a few lines back from MessageBoxA...pretty easy.

Anyway thanks and if you or anyone learns or finds anything, let me know.

CC
Clandestiny
02-17-2001, 07:11 PM
CantCrack (02-17-2001 05:07):
I know that this package in previous versions was
The getlocaltime approach looks a little too deep, but probably doable. The messagebox "Trial Expired" and backtracking is the approach I have been using...

Being that this is THE only program I have ever attempted to crack, I really can't compare or relate the difficulty to any other protection or program.

Hi CantCrack,

I hope I'm not stating the obvious here, but since you said this is the first protection you're trying to crack, I thought I would make a mention about the back-trace Bratsch suggested in an earlier post. I have not had a personal look at the proggy in question so this is only some general related information. There is backtracing in a general sense where you look at the code preceeding a particular event like a nag screen and then attempt to determine what triggered it via single stepping through the code in an empirical way...however the drawback here is the fact that its difficult to trace too too far back if there are a lot of preceeding jumps because you simply don't know exactly where the program came from (ie. as in the case of an unconditional jump from somewhere else in the code)...And this is where the technical back-trace range feature of SICE comes in. The backtrace feature of SICE can be used to trap all of the code between 2 breakpoints and then display it in a linear fashion. This allows you to see all of the instructions in the exact order they were executed in and may also allow you to easier make comparisons between the program flow if all of your programs are using a similar routine in the protection. For the backtrace, the aim is basically to "trap" the code you're interested in by carefully set breakpoints. An API monitor alongside an API reference can be particularly useful for this. Hypothetically, speaking if your monitor shows 2 relevant calls in close proximity (GetLocalTime followed by MessageBoxA) for instance, it would make sense to choose an API just prior to these APIs as your first trap API so that the back-trace would catch all of the code leading up to and in between them. Once you've chosen your traps all you have to do is set breakpoints on them and wait for SICE to break. After SICE has broken on the first one you'll want to set a BPRW "module name" T. The module name can be determined by using the "task" and "mod" commands in SICE and the "T" stands for trace. Then you exit SICE and wait for the proggy to break again on your second "trap" API. After this occurs, you can easily show the results of the trace using the "show" command. If you have IceDump you can even do a nice screen dump of the results.

Anyway, if you haven't used this technique before its well worth investigating. +Sandman also has some more detailed information on the back-trace on his SoftICE resource centre if you're interested. I don't remember the url off the top of my head, but it shouldn't be too hard to find. If you have any troubles feel free to mail me and I'll try to dig it up for you :-)

Hope this helps a little...

Regards,
Clandestiny
Kayaker
02-18-2001, 12:32 AM
[b]Clandestiny (02-17-2001 09:11): There is backtracing in a general sense where you look at the code preceeding a particular event like a nag screen and then attempt to determine what triggered it via single stepping through the code in an empirical way...however the drawback here is the fact that its difficult to trace too too far back if there are a lot of preceeding jumps because you simply don't know exactly where the program came from (ie. as in the case of an unconditional jump from somewhere else in the code)...
Clandestiny

Hiya,

Actually you can use BPM to your advantage here to 'backtrace' as far as you want. Say you see an address at the start of a code section but you don't know how the program got there. If it was called from an [indirect] addressed jump or call, W32Dasm won't help.

If you set a BPM address X on it, the next time you break there you'll see a FromIP and a ToIP listed in the Command window. You can now set a BPX (or BPM) on this FromIP. You can continue tracing backwards through several code sections this way until you get bored or otherwise. The only caveat is that you can only set 4 BPM breakpoints in SoftIce, so you'll need to delete the unneeded ones as you go along.

Cheers,
Kayaker
pupp
03-10-2001, 11:22 AM
I tried the links below but just error came e-mail me a good URL so i could d/l it and help out .
Thanks
pupp6969@yahoo.com
pupp


softice-win me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice-win me
PDA

View Full Version : softice-win me

Robtam
02-16-2001, 06:04 PM
anyone know if softice is supported in windows ME.......bought a new computer and am trying to get an idea of all the things I'm going to have to do to configure it...M$ doesn't give you a choice of these operating systems...don't know much about ME.....thanks for any input........
JimmyClif
02-16-2001, 06:10 PM
Quote from Robtam:
anyone know if softice is supported in windows ME.......

Is the pope catholic?
Lord Soth
02-16-2001, 10:45 PM
OMG, I think the real question is WHY WinME ?? hehe
;)

I would say Win98 is better, even if older. And if you're looking for a GOOD OS, or GOOD ENOUGH of an OS,
then you'd have to install either NT or Win2k (mind you, they've got some compatibility issues, both with hardware
and with software).

LS

Robtam (02-16-2001 08:04):
anyone know if softice is supported in windows ME.......bought a new computer and am trying to get an idea of all the things I'm going to have to do to configure it...M$ doesn't give you a choice of these operating systems...don't know much about ME.....thanks for any input........
Robtam
02-17-2001, 10:37 AM
Lord Soth (02-16-2001 12:45):
OMG, I think the real question is WHY WinME ?? hehe
;)

I would say Win98 is better, even if older. And if you're looking for a GOOD OS, or GOOD ENOUGH of an OS,
then you'd have to install either NT or Win2k (mind you, they've got some compatibility issues, both with hardware
and with software).

LS

Robtam (02-16-2001 08:04):
anyone know if softice is supported in windows ME.......bought a new computer and am trying to get an idea of all the things I'm going to have to do to configure it...M$ doesn't give you a choice of these operating systems...don't know much about ME.....thanks for any input........

LS
The only reason for ME is it comes installed along with some other M$ stuff I really don't want. Like I said I really don't know anything about ME or antbody that uses it for that matter.....I guess I should probably partition 2 primary hard drives and put my Win95 on the 2nd one and make it default so I can use things as they are untill I see if I want ME or not......I take it ME would not be the OS of choice....
Thanks
Robtam
2nEw
02-17-2001, 11:17 PM
Good luck! I bought a new box to get a faster processor. It also had win me on it. After three weeks of using me i dumped it. I had numerous lockups and saw the "blue screen of death" more times than 5 years of win 95 and 98 put together. The next OS from M$ is probably called Whistler because of the wind rushing through all the holes : )
?ferret
02-18-2001, 05:54 PM
If memory serves me correctly (I don't use ME), you have to get a patch for the OS to use autoexec & config files to load softice at boot time (been awhile, so there may be a different workaround by now) ;-)
dooral
03-01-2001, 12:58 AM
http://www.numega.com/drivercentral/tech_tips/windows-me_6_30_00.shtml

install it, make copy of the debugger.exe, and put in ur windir. also copy winice.exe,siwvid.386,winice.dat from sice also put in windir
should work
Robtam
03-01-2001, 02:25 PM
dooral (02-28-2001 14:58):
http://www.numega.com/drivercentral/tech_tips/windows-me_6_30_00.shtml

install it, make copy of the debugger.exe, and put in ur windir. also copy winice.exe,siwvid.386,winice.dat from sice also put in windir
should work

Thanks dooral ............first official notes I've seen on the subject.......Now comes the decision......So far the comments and opinions of the others about ME in general seem to be proving true.......not the greatest OS.....trying to give it a fair shake, but so much junk integrated into it........don't know if I'll keep it or not.....probably easier to partition two OS's , one ME, one Win95 and run softice from there, but I really appreciate your finding this........
robtam
Robtam
03-01-2001, 02:33 PM
dooral (02-28-2001 14:58):
http://www.numega.com/drivercentral/tech_tips/windows-me_6_30_00.shtml

install it, make copy of the debugger.exe, and put in ur windir. also copy winice.exe,siwvid.386,winice.dat from sice also put in windir
should work

Thanks dooral ............first official notes I've seen on the subject.......Now comes the decision......So far the comments and opinions of the others about ME in general seem to be proving true.......not the greatest OS.....trying to give it a fair shake, but so much junk integrated into it........don't know if I'll keep it or not.....probably easier to partition two OS's , one ME, one Win95 and run softice from there, but I really appreciate your finding this........
robtam
JimmyClif
03-01-2001, 04:05 PM
I know not for sure... (memory leak - duh, Jimmy is getting old) but wasn't there an SoftIceLoader or an Patch included in IceDump solving this?

Gee... these are memories from the old insidetheweb board... I guess it's time to clear my 'cache' *g*
The Owl
03-03-2001, 12:43 PM
it's called wmldr, at icedump.tsx.org.


Please help with unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Please help with unpacking
PDA

View Full Version : Please help with unpacking

WlAda
02-17-2001, 02:05 PM
Hi, i have problem with unpacking Apdfpr prog
(www.elcomsoft.com/apdfpr.html)
I think that OEP is at cb1044 but i can't
make function dump with IA. Thank's for any help.
Cheers,
wlada
hz
02-17-2001, 03:02 PM
Hi WlAda,

This is probably not what you want to hear
but if you are an absolute beginner then
(imho) this target will be too difficult for
you. It would be difficult to unpack it manually so you would need to think about using an unpacker. That's not the end of the story, Elcomsoft products are not the easiest to crack anyway. Why not tuck this away until you have a bit more experience. You could look in on the current unpacking project in the mini project. If you are not a total novice then
I should have kept my mouth shut and
if you are determined to go ahead anyway
then I suggest you take a look at ReVirgin.

regards
hOrn_dOg
02-18-2001, 04:08 AM
Hi

If you think that the OEiP is up there at CB........ then you need a bit of help ;) Try www.discompress.com and a few tuts and explanations there for the beginners to moderates.

There are a lot more tuts from excellent reversers around but I want to gather this info in one place......

I am revamping the site as I believe the art of unpacking MUST be learned. Otherwise you might as well be a lamer and get a serial directly..... So I am attempting to introduce
the newbie into the 'approach' and use of tools to succesfully unpack a target, any target regardless of packing/wrapping sytem used. Once this is practised a few times then unpacking becomes easier :)

I am looking for ideas from newbies on what they expect....

SplAj


An old crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > An old crack
PDA

View Full Version : An old crack

Kronic
02-17-2001, 04:23 PM
could someone help me here... i'm looking for a crack for Varren realms elite v988.... i know it's old but i think it's out there somewhere.
Lord Soth
02-17-2001, 05:43 PM
Don't insult our intelligence by asking for Cracks or Serials!

Have you read that part of the page at all ??

I suggest you go elsewhere and apologize too, before they start flaming you hehehe
;)

LS

Kronic (02-17-2001 06:23):
could someone help me here... i'm looking for a crack for Varren realms elite v988.... i know it's old but i think it's out there somewhere.


Immunity of SoftIce Breakpoints???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Immunity of SoftIce Breakpoints???
PDA

View Full Version : Immunity of SoftIce Breakpoints???

Bubbleman
02-17-2001, 06:29 PM
Hi,

is it possible, that a program is resistent against Breakpoints, set in Softice??? I try to crack a program that does this. I can only break for Api Calls Like hmemcpy, but when I step into the program code by pressing the F12 key a couple of times and put a breakpoint at this position, this breakpoint does not break. Although it is absulutely sure, that the software reaches this address again, it does not break. In the Debugger, that is included in Win32Dasm, the breakpoints break. But I need a Softice breakpoint, that breaks.

Thanks
Clandestiny
02-17-2001, 07:33 PM
Hi Bubbleman,

Its interesting that you should bring this topic up ;) ...I've had a couple of questions along those lines myself recently. After some research, I do believe that its possible to hide breakpoints (but don't take my word as gospel on this ;). Actually, I recently found an interesting little article entitled "BPX detection and tricking" by duelist which discusses scanning for INT3 in the import table to detect breakpoints that have been set as well as the use of IAT hooking for breakpoint detection. There is also some example source code with the file as well. Both of these examples show resulting General Protection Faults when the bpx is detected rather than just "hiding" the breakpoint and preventing it from breaking. This is currently all the info I've found on the topic, but I too am interested to learn more.

If you're interested, the url for the page with the tuts is: http://neudump.cjb.net

Regards :)
Clandestiny
?ferret
02-18-2001, 05:40 PM
if you can detect the int 3 you can change it...the trick would be for the program to know what bytes were supposed to be in a given location...maybe wrapped the int 3 check in with a CRC.

Simply crashing a program upon finding an int 3 is easy, changing it back to the original byte would be a bit harder to accomplish (but still theoretically possible).
?ferret
02-18-2001, 05:41 PM
oh & btw.....have you tried BPM instead of BPX?
Lord Soth
02-18-2001, 07:11 PM
Also, don't forget that SI has backdoors. Some programs use them to detect SI while others can even go on and execute some commands.
Among these they can of course manipulate BPs. a bc* would solve the program's problems altogether heh

LS

Bubbleman (02-17-2001 08:29):
Hi,

is it possible, that a program is resistent against Breakpoints, set in Softice??? I try to crack a program that does this. I can only break for Api Calls Like hmemcpy, but when I step into the program code by pressing the F12 key a couple of times and put a breakpoint at this position, this breakpoint does not break. Although it is absulutely sure, that the software reaches this address again, it does not break. In the Debugger, that is included in Win32Dasm, the breakpoints break. But I need a Softice breakpoint, that breaks.

Thanks
Brtascher
02-19-2001, 03:11 PM
Is the program we are talking about available on the Net?
I would like to take a look.


Memory places??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Memory places??
PDA

View Full Version : Memory places??

Bubbleman
02-17-2001, 06:37 PM
Hi,

I´ve got a question, about the places in Memory, where informations about registration are stored. In many shareware programs, there is place in the memory, that is used, to check, if the program is registred or not.

For example: cmp [00494858],01
je 04483834

Just like that. Thats easy to crack, because all I would have to do here is searching all places in the code, where the memory 00494858 is changed to 0 and make all this places put a 01 into the memory place.

But in many programs it is like that:

cmp [esi+4808],01
je 08768878

This is more difficult because I don´t know the value of esi.
My question is: Are all [esi+4808] variables for the same place in memory or could it be, that the variable is set in a line like [esi+5875] just with an other value for esi???

Thanks
Clandestiny
02-17-2001, 07:53 PM
Bubbleman (02-17-2001 08:37):
This is more difficult because I don´t know the value of esi.
My question is: Are all [esi+4808] variables for the same place in memory or could it be, that the variable is set in a line like [esi+5875] just with an other value for esi???

In my experience, if there is a flag comparison cmp [esi+4808],0 the reg flag will remain in this same place in memory throughout the duration of the program though it may be checked multiple times. Because of this you can search and bpm it the same way as the direct memory location. I don't think you would normally see another [esi+5875] pointing to the same memory location with just a different esi value. The esi is most likely a base memory location for where some of the variables the program uses are stored and the 4808 is an offset from that base location. IMHO, it seems unlikely that the base location for the variable would arbitrarily change like that...most likely it is determined during run-time by the computer and would have nothing to do with deliberate programmer obsfucation.

Regards :-)
Clandestiny


Little CrackMe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Little CrackMe
PDA

View Full Version : Little CrackMe

stealthFIGHTER
02-17-2001, 07:51 PM
Little CrackMe (Delphi) for improving skills here:

http://nitrous.hop.to
Acid_Cool_178
02-19-2001, 02:21 AM
stealthFIGHTER (02-17-2001 09:51):
Little CrackMe (Delphi) for improving skills here:

http://nitrous.hop.to

Well, yeah but it are already cracked...

Tools:
Language
UPX
DeDe

and the serial was "iamnotalooser" on every name :)

My solution are at http://www.acidcool.cbjb.net

Acid
stealthFIGHTER
02-24-2001, 05:24 PM
Congratulations! Wait for next CrackMe!!! It'll be harder :)
[Or if you want, I'll send it to you via email.]

sF

http://nitrous.hop.to -or- http://stealthfighter.cjb.net


A self-introduction ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A self-introduction ...
PDA

View Full Version : A self-introduction ...

zeeman
02-18-2001, 02:47 PM
Hi, all. I could have sworn I did this a couple of days ago, but who knows? Maybe I pushed the "cancel" button instead of the "post" button - retaining ideas and thoughts becomes a challenge, once you reach my age <g>.

Well, here I am, back at the learn-to-crack stage, for the fourth time. Maybe this time I'll get it. I happened by this group about a week ago, and after having read a few requests for help, and their responses, I think that I'll be getting some civil answers as well - at least, I hope I will. Oh, and I've just picked up some new essays that appear to cover the information I have been missing.

Brief bio: 53 yr old male - sole proprietor CADD services - central MA - no training in programming. Should I forget it? Naah, I'm persistent - almost understood what was going on at the last go-round, but because no-one was answering my questions, I left it alone for a while.

Regards,
Zee.
Bratsch
02-18-2001, 04:55 PM
You have the basic qualities to become a cracker. You have a pulse, you have a computer, and you have the will.
Please feel free to post your questions, be patient, wait for answers and someone will help you or direct you.
This is the internet, there is no editorial board or costumer service manager, so some answers may be unclear, some useless and some, perhaps, unpolite. It is you who has to filter what suits you. For the most part, people in here come to learn and to help.

Bratsch the Bratscher
Clandestiny
02-18-2001, 05:25 PM
Hiya zeeman,

Welcome to the board :)

I think you'll find this to be a very newbie friendly board (I have anyway). Feel free to post your questions and we'll do our best to answer them. You might also want to check out some of the past projects in the mini project area...they could provide some ideas and they're never really "dead"...you can always continue posting your questions within the thread.

Cheers ;-)
Clandestiny


BackTracing? Any Tuts or info?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > BackTracing? Any Tuts or info?
PDA

View Full Version : BackTracing? Any Tuts or info?

CantCrack
02-18-2001, 06:58 PM
I'm searching for any info or tuts on the "backtrace" feature of softice.

Thanks,
CC
Lord Soth
02-18-2001, 07:14 PM
Hi dude,

As it happens, I've just about to write an essay on some advanced SI commands, which will also include an explanation of the backtrace buffer.
Do you think you can wait a day or two ?
If not, mail me, I'll be as helpful as I can
:)

ciao

CantCrack (02-18-2001 08:58):
I'm searching for any info or tuts on the "backtrace" feature of softice.

Thanks,
CC
OeDiFuZz
02-19-2001, 01:37 PM
[quote]Lord Soth (02-18-2001 09:14):
Hi dude,

As it happens, I've just about to write an essay on some advanced SI commands, which will also include an explanation of the backtrace buffer.
Do you think you can wait a day or two ?
If not, mail me, I'll be as helpful as I can
:)

ciao

Hi Lord Soth,
May i know where you will be posting your essay? I'm also interesed in learning some advance SI commands.

regards,
OeDiFuZz
Clandestiny
02-19-2001, 06:09 PM
Cant Crack:

In the interim until Lord Soth finishes his tut, here is the url to +Sandman's SoftICE resource centre. Chapter 9 has some info on the back trace range. And you can't go wrong checking out what the officail manual has to say (though IMO its a bit vague on the details ;) )

http://www.idca.com/~thesandman/SoftPage.html

Lord Soth: BTW I'm interested in your tut too...maybe you could upload it to the board when you're finished...

Regards,
Clandestiny
NeO
02-21-2001, 04:44 AM
I would like to read the tut too!!

NeO
Lord Soth
02-21-2001, 07:53 PM
hiya all, the new essat is finished.
It should be posted at the ID site soon enough, so don't hold your breath :-)
hehe

http://www.immortaldescendants.org/

LS


Unpacking tuts for Newbies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking tuts for Newbies
PDA

View Full Version : Unpacking tuts for Newbies

+SplAj
02-19-2001, 06:59 AM
Hello fellow reversers.

As promised I have uploaded discompress.com and today concluded a tut on tElock 0.71 unpacking.

This is under the advanced section as it involves debugger detection, IAT redirection and some PE header f*cking by the packer

Can some one please check-it-out and give some feedback
cos it takes around 4 hours of my time to 'create' such masterpieces ;)

basically I intend to do the following :-

1) Introduce packers and what they do
2) Introduce the PE header format
3) Introduce the Imports (API's)
4) The Original Entry Point (OEiP)
5) The tools to use, including the usual large G&T
6) Frame of mind, approach.

hopefully discompress.com will become a focus for unpacking, oriented towards the Newbie reverser. I know there are tuts etc around but I think this is a specialist topic and a bit phearful for the beginner so the tuts will be full of my mistakes :) so you can make them too and learn.
I won't just say "do this" then "do that" "voila" - done. As the Newbies will have questions. especially about the IAT !!

I will try and pack/unpack with you ALL the major packers/protectors and intend to do 1 per week. I promise - NOT :)

Any special requests will get priority

+SplAj

www.discompress.com
CoDe_InSiDe
02-19-2001, 12:56 PM
Hi +SplAj

I just want to say that i like that about "Unpacking".
I'm also planning to write some Tutorials about it, So i want to ask can i send them to discompress.com when i'm done ;)
Thanks.

Cya...

CoDe_InSiDe
Kilby!
02-19-2001, 01:32 PM
Feel welcome to use the essay I did on Crunch2

It's not much but it's an easy packer to work on.

It's on http://tsehp.cjb.net/

Kilby...
NeO
02-19-2001, 05:35 PM
Good job!!+SplAj!!

NeO
Clandestiny
02-19-2001, 07:42 PM
Hi +SplAj,

I'm excited about the possiblity of having the guidance of an experienced reverser in the unpacking arena :-).

I checked out your tut on tElock. It looks very infomative, but alas still a little advanced for me as I'm a *complete* newbie to unpacking... I'm currently wading through those beloved PE docs (for the 4th or 5th time)...I get a *little* more out of them each time and I'm hoping they'll really sink in one of these days ;).

You mentioned covering a packer per week... And I was thinking that if you have the time, it would be great if you could post the target in the mini projects forum for open discussion. Perhaps we could start out slow with some very simple packers w/o import redirection and such and then work up to more advanced ones.

--Clandestiny
stillnewbie
02-20-2001, 06:31 PM
[quote]+SplAj (02-18-2001 20:59):
Hello fellow reversers.

As promised I have uploaded discompress.com and today concluded a tut on tElock 0.71 unpacking.

Hi +SplAj,

I did not find any tuts in the np-te!.zip.
it only has a notepad.exe packed with te-lock ??? I can't find it in discompress.com

regards
stillnewbie
CoDe_InSiDe
02-21-2001, 12:27 AM
Hi stillnewbie
Check the site again at:

www.discompress.com ---> Tutorials ---> Advanced

There you'll see the tutorial of tElock V0.71, you need to click on "ready" next to it.
Otherwise go here:

http://www.woodmann.net/discompress/tutorials/te!-unpack/te071.htm

Cya...

CoDe_InSiDe
NeO
02-21-2001, 04:38 AM
i had the same problem!Once i found a tut the next time it wasnt' there!!

NeO
stillnewbie
02-21-2001, 04:41 AM
CoDe_InSiDe (02-20-2001 14:27):
Hi stillnewbie
Check the site again at:

www.discompress.com ---> Tutorials ---> Advanced

There you'll see the tutorial of tElock V0.71, you need to click on "ready" next to it.
Otherwise go here:

http://www.woodmann.net/discompress/tutorials/te!-unpack/te071.htm

Cya...

CoDe_InSiDe

Damn I must be sleeping :(((((
Thanks Cide_Inside 1001001001 :-D

stillnewbie
stillnewbie
02-21-2001, 04:41 AM
CoDe_InSiDe (02-20-2001 14:27):
Hi stillnewbie
Check the site again at:

www.discompress.com ---> Tutorials ---> Advanced

There you'll see the tutorial of tElock V0.71, you need to click on "ready" next to it.
Otherwise go here:

http://www.woodmann.net/discompress/tutorials/te!-unpack/te071.htm

Cya...

CoDe_InSiDe

Damn I must be sleeping :(((((
Thanks Code_InSide 1001001001 :-D

stillnewbie


ASm help!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASm help!!
PDA

View Full Version : ASm help!!

NeO
02-20-2001, 06:38 AM
In eax = abc
004478A2 A32CA94400 MOV [0044A92C],EAX
0167:004478A7 C1152CA9440005 RCL DWORD PTR [0044A92C],05
0167:004478AE C1252CA9440009 SHL DWORD PTR [0044A92C],09
004478B5 C12D2CA9440003 SHR DWORD PTr[0044A92C],03
0167:004478BC C11D2CA944005C RCR DWORD PTR [0044A92C],5C
0167:004478C3 C1152CA944000C RCL DWORD PTR [0044A92C],0C
0167:004478CA C1252CA9440003 SHL DWORD PTR [0044A92C],03
0167:004478D1 C12D2CA9440005 SHR DWORD PTR [0044A92C],05
0167:004478D8 C1152CA9440036 RCL DWORD PTR [0044A92C],36
0167:004478DF C1252CA9440002 SHL DWORD PTR [0044A92C],02
004478E6 0FB63514A94400 MOVZX ESI,BYTE PTR[0044A914]

What do you get out

Thanks for helping NeO!
Bratsch
02-20-2001, 10:30 PM
In eax = abc
04478A2 A32CA94400 MOV [0044A92C],EAX ; 0044a92c = 00000ABC
0167:004478A7 C1152CA9440005 RCL DWORD PTR [0044A92C],05 ; 0044a92c = 00015780
0167:004478AE C1252CA9440009 SHL DWORD PTR [0044A92C],09 ; 0044a92c = 02AF0000
004478B5 C12D2CA9440003 SHR DWORD PTr[0044A92C],03 ; 0044a92c = 0055E000
0167:004478BC C11D2CA944005C RCR DWORD PTR [0044A92C],5C ; 0044a92c = 0ABC0000
0167:004478C3 C1152CA944000C RCL DWORD PTR [0044A92C],0C ; 0044a92c = C0000055
0167:004478CA C1252CA9440003 SHL DWORD PTR [0044A92C],03 ; 0044a92c = 000002A8
0167:004478D1 C12D2CA9440005 SHR DWORD PTR [0044A92C],05 ; 0044a92c = 00000015
0167:004478D8 C1152CA9440036 RCL DWORD PTR [0044A92C],36 ; 0044a92c = 05400000
0167:004478DF C1252CA9440002 SHL DWORD PTR [0044A92C],02 ; 0044a92c = 15000000
004478E6 0FB63514A94400 MOVZX ESI,BYTE PTR[0044A914] ; IRRELEVANT TO PREVIOUS CALC

With softIce write d ds:0044a92c. then change the mode of the data window to dword by repeatedly clicking in the upper right margin so you see the numbers in a more human readable format.
Keep an eye on ds:0044a92c as you trace through the code. As I did not have your original code I just reassemble your snippet it in a small asmfile.com using the HIEW assembler capabilities. I started the code with a Int 3 instruction so Sice would break at the begining of the program, then traced it and copied the results for you to see. If you are interested in the little snippet, write me back. The hell if I know how to attach files to postings. Is only 41 bytes:

Ìf¸¼
fÁÐfÁà fÁèfÁØ\fÁÐ fÁàfÁèfÁÐ6fÁàÍ
NeO
02-21-2001, 04:54 AM
I wroted you email today !i hope you will answer!Because last to email you didnt'!

NeO


I know, VERY basic, but ... How do you identify a VB app?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I know, VERY basic, but ... How do you identify a VB app?
PDA

View Full Version : I know, VERY basic, but ... How do you identify a VB app?

zeeman
02-20-2001, 08:16 AM
Hi, all!
I used to have a 1 1/2" 3-ring binder chock-full of tutorials and essays, but the durned thing's gone missing, so I gotta ask. (I'm sure if you had a lamer section, this would be moved there <g>.) This much I remember: view the .exe with Quick View, but I can't for the life of me recall what the identifying text is.

Regards,
Zee.

ps I've looked, but it just escapes me.
Brtascher
02-20-2001, 02:56 PM
I don't know the text that Quick View would show if the exe file you are examining was written with Visual Basic. I know other methods instead:

If you dissasemble the main exe file and look in the import section you will see one of the VB dlls: msvbvm50.dll or msvbvm60.dll, for versions 5 and six respectively, and the load of VB functions all named with a double underscore at the begining like __vbaStrComp.

If you are tracing the file in question with SoftIce, sooner rather than later you will get into one of the MSVB dlls. You can tell such information, the file containing the code you are tracing, by reading the lower margin of the code window in Sice.
The left upper margin of the code window contains the name of the exported function you are currently tracing.
zeeman
02-20-2001, 04:16 PM
Thank you for sharing, Brtascher. I could have sworn you could identify VB apps the way I mentioned, down and dirty, prior to disassembly ... I believe it was in an article written by Eternal Bliss ... you think I could lay my hands on it??? Nooooo. Sheesh, I'm drowning in paper. What a state to be in, in this, the computer age.<g>

Regards,
Zee.
hz
02-20-2001, 05:29 PM
Hi,
Language 2000 (protools), identifies more executables than any other I have tried.

regards
Bratsch
02-20-2001, 09:28 PM
zeeman (02-20-2001 06:16):
Thank you for sharing, Brtascher. I could have sworn you could identify VB apps the way I mentioned, down and dirty, prior to disassembly ... I believe it was in an article written by Eternal Bliss ... you think I could lay my hands on it??? Nooooo. Sheesh, I'm drowning in paper. What a state to be in, in this, the computer age.<g>

Regards,
Zee.
I checked a VB app with Quick View Plus.
It does give you a list of the import libraries and functions, so what I told you about dissasmbling applies to Quick View, it is only faster.
Regards,
zeeman
02-21-2001, 10:38 AM
Hello, hz.
Language 2000 is a very nice tool indeed! I especially like the drag&drop feature. Thank you very much for pointing this one out to me.

Regards,
Zee.

hz (02-20-2001 07:29):
Hi,
Language 2000 (protools), identifies more executables than any other I have tried.

regards
Eternal Bliss
03-01-2001, 02:36 PM
hz (02-20-2001 07:29):
Hi,
Language 2000 (protools), identifies more executables than any other I have tried.

regards

http://ebliss.cjb.net
I think if you open it with a hex editor, you will see msvbvmXX.dll around the front part of the exe where XX is 50 or 60

Regards
EB
8)


Is it possible to detect SoftICE by IsDebuggerPresent( )?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is it possible to detect SoftICE by IsDebuggerPresent( )?
PDA

View Full Version : Is it possible to detect SoftICE by IsDebuggerPresent( )?

Solomon
02-21-2001, 03:43 AM
According to MSDN, this API is used to detect debugger.
In my opinion it's used to detect Win32 application level debugger such as W32Dasm/VC++/TurboDebugger etc, not system debugger such as SoftICE.

Am I right? Thx
+SplAj
02-22-2001, 12:46 AM
Hi

I came across this in the last CommView 2.4. Usually, in previous versions, there was several checks by both ASprotect and CV.exe to find a debugger by the old Int and \\.\NTICE etc tricks.

When 2.4 was unpacked there was just this single call to 'IsDebuggerPresent'. I LOL cos the unpacked 2.4 ran ok, no SI / debugger message !...and I got on my merry way to try and fix the half packets of the evaluation etc etc.

Then I pressed the 'start capture' button......BOOM they got me PSOD. This was on Windows 2K

So in short this call can be used to find SI as well.

SplAj
Solomon
02-22-2001, 03:45 AM
Thank you for your experience.
I wrote a little prog to test this API, it always tells me "SoftICE not found". The environment is Win2000 Server + SoftICE 4.05. Both kernel32.dll and SoftICE are not patched.

#include <windows.h>
#include <stdio.h>

WINBASEAPI BOOL WINAPI IsDebuggerPresent(VOID);

void main(void)
{
if (IsDebuggerPresent( ))
{
printf("SoftICE detected.
");
}
else
{
printf("SoftICE not found.
");
}
}
Acid_Cool_178
02-22-2001, 04:17 AM
for some more API's that might help so are some of them in here:
http://msdn.microsoft.com/library/psdk/winbase/debug_6qcz.htm

else http://msdn.microsoft.com/default.asp is a good place to get some good information on API's ;)

Acid_Cool_178
Solomon
02-24-2001, 12:56 AM
Thx Acid_Cool_178.

Actually I have the MSDN CD. Just wonder why this API can't return TRUE when SoftICE resides in the memory.
Solomon
02-24-2001, 01:01 AM
I have read some anti-tracing tuts saying that SoftICE can be detected in this way. But it can't detect SoftICE in my machine. That's why I asked such a question.
Lord Rhesus
02-24-2001, 07:56 AM
I'm sure this only checks if someone is trying to debug the program using the debug API's that come with windows! Have a look at Iczelion's tuts on using the debug API www.win32asm.cjb.net
IcyDee
03-04-2001, 05:42 AM
I think that the IsDebuggerPresent() API only checks that the application has been loaded using the Debug API. In other words using the SoftIce Loader.

If you run the program normally, with SoftIce in the background I don't think it tells you.


Anonymity challenge for a newbie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anonymity challenge for a newbie
PDA

View Full Version : Anonymity challenge for a newbie

spamal
02-21-2001, 05:57 PM
Here is a tough one for me. I was trying to connect anonymously to Hacker Radio's IRC channel via a web page java form (not through an MIRC client) here:
http://www.hack3r.com/irc/index.html

I used an http:// proxy program. Testing it at anonymizer.com, cyberarmy and shieldsup all showed that I was masked and anonymized. So far so good.

However, when I connected to the hacker radio IRC channel via the web form, it says that I am using a spoofed IP and it stamps my domain name for everyone to see! :(

When I connect it says it found my hostname (domain name) "cached" on my system. However, I have turned off cache in Netscape, and disabled cookies.txt and cleared it. Where on my system could it be caching my domain name?

I then wrote a c++ program to search every file on my hard drive, including binary, to search for a text or hex string, to see if I could find where my domain name is being cached. A few places came up on Win2K pro:

drwtsn32.log
Adobereg.db
Scrap.shs
Memory.DMP (obviously)
AppEvent.evt
NSMad6M.tmp
CIM.Rep
NetSetup.log

Which did not point me in the right direction. If anyone can help me figure out how to get through this java applet anonymously I would be grateful! I know I can use http2socks with the real MIRC client, but I would rather figure out how to get through this java door anonymously!

Thanks in advance,
spamal

Again the URL is:
http://www.hack3r.com/irc/index.html
+SplAj
02-22-2001, 04:17 AM
Hey nice challenge ...

My approach :-

I usually wait for the Java to load it's own cab file on yer PC then switch to SI and HBOOT. This makes sure they don't clear the files when you exit the site.

On reboot you can usually find this file zipped/tarred etc in the IE cache as well as the htm source page.

(in this case jirc_mss.tgz)

Then I would analyse the .class files within with the give-away java tools ???

maybe this helps maybe not............

SplAj
spamal
02-23-2001, 06:02 PM
Thanks! Its worth a try!

BTW is anyone else able to connect to
http://www.hack3r.com/irc/index.html

through a http:// proxy and remain anonymous?


My new SI essay...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > My new SI essay...
PDA

View Full Version : My new SI essay...

Lord Soth
02-21-2001, 08:02 PM
I'm testing to see if I can UL to the board.

Damn, donno how.. nm

LS
MP
03-10-2001, 12:52 PM
Please send me by email.
Thanks in advance.


Somebody tried out the new CASPR yet?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Somebody tried out the new CASPR yet?
PDA

View Full Version : Somebody tried out the new CASPR yet?

hobgoblin
02-24-2001, 11:21 AM
Greetings on the board,
I have just downloded the new version of CASPR from Programming Tools. It requires a new syntax to be used when you want to unpack an Asp-protected program. Have someone had the time to look at it yet?
To be frank, I'm a little bit confused on how to use it. (Or maybe I'm rusty. It has been a while since I did some "serious" reversing...)
But take a look at how to use it (read the readme.txt), and check out the caspr.ini file. Is it correct that we have to set the flags in the sections in the .ini file ourselves? It may seems that we have to do it ourself. Tried to unpack Tag&Rename without success. It unpacks the program, but it will not run properly. You get the same error message you sometime see when you haven't rebuild the import table properly.'
If someone have some experience on this, please, could you post some input on this?
Maybe someone could post an example on how a correct .ini file should look like with the flags set correctly.
All kinds of input will be appreciated...

Regards from a long time absentée...
Hobgoblin
esther
02-25-2001, 02:51 AM
hobgoblin (02-24-2001 01:21):
Greetings on the board,
I have just downloded the new version of CASPR from Programming Tools. It requires a new syntax to be used when you want to unpack an Asp-protected program. Have someone had the time to look at it yet?
To be frank, I'm a little bit confused on how to use it. (Or maybe I'm rusty. It has been a while since I did some "serious" reversing...)
But take a look at how to use it (read the readme.txt), and check out the caspr.ini file. Is it correct that we have to set the flags in the sections in the .ini file ourselves? It may seems that we have to do it ourself. Tried to unpack Tag&Rename without success. It unpacks the program, but it will not run properly. You get the same error message you sometime see when you haven't rebuild the import table properly.'
If someone have some experience on this, please, could you post some input on this?
Maybe someone could post an example on how a correct .ini file should look like with the flags set correctly.
All kinds of input will be appreciated...

Regards from a long time absentée...
Hobgoblin

Hiya Hobgoblin,
ltns :)read this post from SV if you want more details.
http://www.woodmann.net/Ultraboard/Public/HTML/B5/340-1.topic.shtml
are you kidding rusty :)

esther


2 Questions/1 kinda OT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 2 Questions/1 kinda OT
PDA

View Full Version : 2 Questions/1 kinda OT

Critter
02-25-2001, 06:20 AM
What is the difference (in SICE) between "?eax" and "d eax"
how to know when to use which one??

What was used to create the menu system of RCE?

Thanks, Critter
JimmyClif
02-25-2001, 08:28 AM
Hello again,

?eax shows you the value of eax at the bottom of the screen in SI in Hexadecimal, Decimal and Ascii.
ex if eax contains 6652
?eax
00006652 00000026194 "fR"
Hex...........Dec...............Ascii

d eax dumps what's behind an adress in your data window.
ex:
d eax (eax contains maybe 00403012)
After executing this command you will see that SI goes to that specific adress and shows you the content of that adress in your data window.

How to difference these two? You need to know the difference between a value and an address first!

As carnival is in town,
Cheers JimmyClif
Critter
02-26-2001, 04:41 AM
cheers for the info mate.

Critter


Elimanating the protection in MAD - Globalthermonuclear War
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Elimanating the protection in MAD - Globalthermonuclear War
PDA

View Full Version : Elimanating the protection in MAD - Globalthermonuclear War

Stumped
02-25-2001, 08:33 AM
This program has me stumped. You can only destroy 2 countries or play 10 minutes and then the program tells you to get lost. I have loked at the functions that it calls and I am unable to the call where it counts up, or down when my time is up. Also, I am unable to pinpoint the spot in the registary where it stores that data. The keys, all of them have no values inside them. Can you give me advice on how to overcome this time-limit and or a method of tracking down the serial in memory. It looks to me like they use some dummy roitines. It plays around with the name and serial code, about 6 times with each. Can you help me ?
LatexX
02-25-2001, 09:02 PM
Maybe if you provided some url for download my friend! :)


Webpage-Passwords
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Webpage-Passwords
PDA

View Full Version : Webpage-Passwords

MAS
02-26-2001, 06:30 AM
Hi! I'm a german guy, so my english is BAAAAD and I hope I'm at the right adress.Sorry if not.

Is there a possibility to enter a webpage, which is locked by a password (so you have to be a member to enter) ?

Thanx!
me
02-26-2001, 09:47 AM
MAS (02-25-2001 20:30):
Hi! I'm a german guy, so my english is BAAAAD and I hope I'm at the right adress.Sorry if not.

Is there a possibility to enter a webpage, which is locked by a password (so you have to be a member to enter) ?
Thanx!

It is possible, but not necessarily easy.
If the password is validated by the page in a javascript, it could be a rather simple "looking at the code, reversing" excercise.
If the password is validated at the server, it would entail a hacking excercise: gaining control of the server's script processor, not trivial.
?ferret
02-27-2001, 10:09 PM
try a proggie called Wwwhack


Ra2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Ra2
PDA

View Full Version : Ra2

NoRToN
02-26-2001, 03:07 PM
Where can I find a tutorial to crack Red Alert 2?
Lord Soth
02-26-2001, 04:34 PM
You sound like you're asking for a recipe to
crack RA2.

LS

NoRToN (02-26-2001 05:07):
Where can I find a tutorial to crack Red Alert 2?


Something Strange with Asm!!Help Please!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Something Strange with Asm!!Help Please!
PDA

View Full Version : Something Strange with Asm!!Help Please!

MeTERMan
02-26-2001, 05:37 PM
Hello!

I dump it!

EAX=9805EB64 EBX=9805EB64 ECX=0000CCFD EDX=00000000 ESI=00BF2E6A
EDI=00000000 EBP=006CF3EC ESP=006CF1FC EIP=00456B5E o d I s Z a P c
CS=0167 DS=016F SS=016F ES=016F FS=3DB7 GS=0000
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
0167:00456B07 8D8520FEFFFF LEA EAX,[EBP-01E0]
0167:00456B0D E80AECFAFF CALL 0040571C 
0167:00456B12 E885BCFAFF CALL 0040279C
0167:00456B17 31DB XOR EBX,EBX
0167:00456B19 31C0 XOR EAX,EAX
0167:00456B1B 31D2 XOR EDX,EDX
0167:00456B1D 8B75F4 MOV ESI,[EBP-0C]
0167:00456B20 803E00 CMP BYTE PTR [ESI],00
0167:00456B23 740D JZ 00456B32
0167:00456B25 AC LODSB
0167:00456B26 80E830 SUB AL,30
0167:00456B29 01C3 ADD EBX,EAX
0167:00456B2B 6BDB0A IMUL EBX,EBX,0A
0167:00456B2E 31C0 XOR EAX,EAX
0167:00456B30 EBEE JMP 00456B20
0167:00456B32 B90A000000 MOV ECX,0000000A
0167:00456B37 89D8 MOV EAX,EBX
0167:00456B39 F7F9 IDIV ECX
0167:00456B3B 8945F0 MOV [EBP-10],EAX
0167:00456B3E 89C3 MOV EBX,EAX
0167:00456B40 B908020000 MOV ECX,00000208
0167:00456B45 8B45F0 MOV EAX,[EBP-10]
0167:00456B48 0FAFD8 IMUL EBX,EAX
0167:00456B4B 3B1D10834500 CMP EBX,[00458310]
0167:00456B51 7210 JB 00456B63
0167:00456B53 31D2 XOR EDX,EDX
0167:00456B55 51 PUSH ECX
0167:00456B56 89D8 MOV EAX,EBX
0167:00456B58 8B0D10834500 MOV ECX,[00458310] I am here! Cursor!
0167:00456B5E F7F9 IDIV ECX This give me cripps!
0167:00456B60 59 POP ECX
0167:00456B61 89D3 MOV EBX,EDX
0167:00456B63 E2E0 LOOP 00456B45
0167:00456B65 81FBF7310000 CMP EBX,000031F7
0167:00456B6B 7504 JNZ 00456B71
0167:00456B6D C645EF01 MOV BYTE PTR [EBP-11],01
0167:00456B71 8D8520FEFFFF LEA EAX,[EBP-01E0]
0167:00456B77 E858EAFAFF CALL 004055D4
0167:00456B7C E81BBCFAFF CALL 0040279C
0167:00456B81 807DEF01 CMP BYTE PTR [EBP-11],01 
0167:00456B85 7512 JNZ 00456B99

there is :Eax= as you can see above
EAX=9805EB64 EBX=9805EB64 ECX=0000CCFD EDX=00000000!
So the fucktion does moves ccfd to ECx!And idiv Ecx ;The same as Eax=eax/ecx!
Right!So you get right nothing new!!

But this is the strange thing! Look down::
MeTERMan
02-26-2001, 05:40 PM
But this is the strange thing!

EAX=0000BDDA EBX=9805EB64 ECX=0000CCFD EDX=000092F2 ESI=00BF2E6A
EDI=00000000 EBP=006CF3EC ESP=006CF1FC EIP=00456B60 o d I s Z a P c
CS=0167 DS=016F SS=016F ES=016F FS=3DB7 GS=0000

0167:00456B53 31D2 XOR EDX,EDX
0167:00456B55 51 PUSH ECX
0167:00456B56 89D8 MOV EAX,EBX
0167:00456B58 8B0D10834500 MOV ECX,[00458310]
0167:00456B5E F7F9 IDIV ECX
0167:00456B60 59 POP ECX ***Curson here!!CRipss!
0167:00456B61 89D3 MOV EBX,EDX
0167:00456B63 E2E0 LOOP 00456B45
0167:00456B65 81FBF7310000 CMP EBX,000031F7
0167:00456B6B 7504 JNZ 00456B71

So logicaly the eax and ecx would change right!
But looked at edx it changes too !!Edx =00 before now EDX=000092F2
How do you get the edx!Or how to see it where does it change!It's crackem so i did send you one!
can you please advice me!!How to calculate edx!!

Thanks for helping!
MeTERMan
02-26-2001, 05:40 PM
But this is the strange thing!

EAX=0000BDDA EBX=9805EB64 ECX=0000CCFD EDX=000092F2 ESI=00BF2E6A
EDI=00000000 EBP=006CF3EC ESP=006CF1FC EIP=00456B60 o d I s Z a P c
CS=0167 DS=016F SS=016F ES=016F FS=3DB7 GS=0000

0167:00456B53 31D2 XOR EDX,EDX
0167:00456B55 51 PUSH ECX
0167:00456B56 89D8 MOV EAX,EBX
0167:00456B58 8B0D10834500 MOV ECX,[00458310]
0167:00456B5E F7F9 IDIV ECX
0167:00456B60 59 POP ECX ***Curson here!!CRipss!
0167:00456B61 89D3 MOV EBX,EDX
0167:00456B63 E2E0 LOOP 00456B45
0167:00456B65 81FBF7310000 CMP EBX,000031F7
0167:00456B6B 7504 JNZ 00456B71

So logicaly the eax and ecx would change right!
But looked at edx it changes too !!Edx =00 before now EDX=000092F2
How do you get the edx!Or how to see it where does it change!It's crackem so i did send you one!
can you please advice me!!How to calculate edx!!

Thanks for helping!

MeTERMan
Bratcher
02-26-2001, 09:31 PM
IDIV, signed integer division, may operate with dword numbers that are bigger than 32 bits.
I such case the Dividend is contained in EDX:EAX. the divisor, in your example, was in ECX. After the operation executes, the quotient is contained in EAX and the remainder is placed in EDX. That is why EDX, despite not being explicitly involved in the operation, changes from 0 to something.
Bratcher
02-26-2001, 09:34 PM
EDX is the remainder of EDX (0 n this case):EAX integer divided by ECX.
(I pulsed the post button before I was done.
MeTERMan
02-27-2001, 04:38 AM
Thanks Bratcher!!I get answer quicker if i put it on board then if i email you !!heh

Thanks again!

MeTERMan
MeTERMan
02-27-2001, 04:39 AM
Thanks Bratcher!!I get answer quicker if i put it on board then if i email you !!heh

Thanks again!

MeTERMan


Game cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Game cracking
PDA

View Full Version : Game cracking

NoRToN
02-27-2001, 03:46 PM
I'm trying to crack a game so it runs without CD.

The game checks for files on the CD, which I have
moved to my harddisk.
I Can get the game to run if I move the files to the root
dir on my harddisk, because the files is on the root of the
Cd. I just have to change the drive letter.

But I want the files to be in the game directory.
But how do I get the directory that the game is in?
mustapha
02-28-2001, 05:45 AM
http://cdchecks.cjb.net/
risc
02-28-2001, 11:17 AM
you need to alter the drive letter it gets from the cd check from "x:\" to ".\"

.\ is current dir ..

it might use %c:\%s to format the drive letter and filename it wants .. if this is the case u can shift it to the left by one byte, and change it to "%c\%s",0

and make the cd check return 2eh / "."

then it would load file x as ".\x" .. instead of ".:\x" or "x:\x" ..

check out the cdchecks.cjb.net like the other guy said, see if anything there can help you ..

if this 'game' u want to crack is red-alert 2, your in for a little more trouble than this ..
Lord Soth
02-28-2001, 02:01 PM
Hi risc,

What's so special about RA2 ?

LS
risc
03-01-2001, 09:05 AM
lord soth -

im not too sure u know, ive never cracked it, but i expect it to be the same as tiberian sun, having to fake the cd swap code when the cd check looks for disc 1 / disc 2 / disc x, as it loads the required files from 'mapsd.mix' etc .. creating the file name from the cd # .

and ra2, it has some sort of crc or hidden check too .. if u dont crack it right, either tanya blows up after a few seconds, or your whole base does..

i thought the latter was to do with the key missing from the registry, but i 'heard' it was a hidden check or crc..

so, 'whatever his name is', should be in for a little more trouble than a simple cd check / reroute
NoRToN
03-01-2001, 05:47 PM
I have checked it,

and the whole base will blow up if don't have a register key, think its the serial key.
There is no CRC check.


?????????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ?????????
PDA

View Full Version : ?????????

BE-NINE
02-27-2001, 05:21 PM
May I ask....we all make such a big deal of the fact that THEY believe only THEY have the right to the knowledge...How do we justify doing the same thing to newbies ????
Think about it,the quotes of the "Knowledge Being Free" to learn,that we dont give freely,,,,,,THEY TRY to keep it from us...do WE not do the same ???????
Look Back....Do we not do exactly what WE accuse THEM of doing ??????
BE-NINE
02-27-2001, 05:27 PM
Sorry Didn't sat.....ANSWERS ON A POSTCARD TO slave_1@you know where..
BE-NINE
02-27-2001, 05:27 PM
Sorry Didn't sat.....ANSWERS ON A POSTCARD TO slave_1@you know where..
Kayaker
02-27-2001, 06:37 PM
Well ya got the subject title right anyway ???
?ferret
02-27-2001, 10:17 PM
LMAO....I'm w/ u Kayaker :D
me
02-27-2001, 10:50 PM
I think YOU know what you wanted to say,
and I think I glimpse the reasons for your frustration,
BUT you are not communicating very effectively.
WHO are THEY, and WHO are US?.
WHAT got you so UPSET?
CONTRARY to other posters, IT is not my intent to laugh at you BE-NINE, I just think you have something important to say, but you have not put it togheter yet.


Having problem with antidebugging tricks..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Having problem with antidebugging tricks..
PDA

View Full Version : Having problem with antidebugging tricks..

Glaurung
02-28-2001, 01:22 PM
Greetings fellow Reversers !!!
First of all...dont go flaming me for my english...im trying as good as i can : )
The problem is:
Most tutorials that deal with packed targets are written for the win98/ME OS.I prefer using NT when reversing coz its a bit more stable then 98/ME. When i follow the tutorials they offten assume that you have some kind of anti antisofticeprotection. I know there is one for NT aswell. The one for NT have not implemented IDT check protection yet so im a bit stuck. What is bothering me is that i preferably want to crack everything manuelly. So my main question is...how can i find these antidebugging protections in the code im debugging. I know how to take care of the meltice and the int68 and so on...but the IDT and how it checks the debugging registers i dont know. Plz....Im verry gratefull for any information in this matter.
My target im trying to crack is a tElock packed version of notepad.
You can find it in www.discompress.com
I know there is a turorial for it ive read it. Its really excellent but it dosn't serve my needs.
plz help me out..
NeO
02-28-2001, 04:42 PM
REad more tuts!IT's says it for advance!!

NeO
Glaurung
03-01-2001, 01:57 AM
NeO (02-28-2001 06:42):
REad more tuts!IT's says it for advance!!

NeO

Greetings NeO!!
Well...ive read allot of tutorials...ive been in the RCE sceen for about 3 years now so packed targets are not unknown for me. What i want to know is how the more advance antidebbuging protections work. But what i say is that the tutorials don't explain in detail how to avoid the more heavy protection without using frogsice or the newer icedump programs to cloak your debugger.
As fas as i see it the more advance checks..the ones that check the IDT and DR registers?(maybe mixing the DR up with motorola : ) ) for bpx and bpm's have to be in ring0. The program in itself usally only dont have right to run in a lower ring. So what they do is to take control of an exception and generate an exception fault. eg div by 0 or something.
hmm..maybe its possibly to get softice to break when a exception occurs.? Maybe Reset the hooked interrupt 3?
Most people that have done packed targets knows the problem when softice refuses to break inside a program..And its hell to step through the code one instruction at time..I dunno...sigh...
Maybe im forced to use an external program that hides my debugger.....

Cheers and Gnite : )


some vbox-help needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > some vbox-help needed
PDA

View Full Version : some vbox-help needed

Silent
02-28-2001, 05:17 PM
i tried to unwrap this application:

http://www.sybase.com/detail/1,3693,1010602,00.html

(sybase's PowerDesigner 7.5 trial. warning, it's 42mb!) but i didn't get mentionable results. procdumps internal vbox-dumpers for vbox <4.2 don't work, the external (via bhrama) dumps the file, but the result doesn't look very good (maybe because some of the used dll's might be packed, too, maybe because my knowledge concerning pe's isn't the best). and for v4.3 i could only find one unwrapper wich works only on win2k :(. the tutorials for v4.3 seem to be very easy, but the program i try to unwrap looks completely different (not the normal mv/cmp/jmp after the getprocaddress). so i think it may be packed with version 4.5 (http://208.240.131.116/products/vbox/download.html). anyone got:

1) a way to identify the used version of vbox?

2) a tutorial/unwrapper for version 4.5
Silent
02-28-2001, 05:40 PM
ok, now i'm one step further, i used the rebuild function for the import-table to let procdump fix the file(with vbox 4.2 plugin). now i have a working executable, BUT the program seems to miss most of the functions. some menu-entries are missing, the whole workspace-window has gone and i get a 'can not open file' message if i try to open a project-file. any ideas? do i need to unwrap some dll's or something like that? or did the dumper/rebuilder forget to include the dll's (but why does it start anyway?).
evc_viper
02-28-2001, 11:18 PM
It is packed by VBOX4.2.
Silent
03-01-2001, 05:26 PM
any idea why it wont load the dll's after it has been unwrapped?
Silent
03-01-2001, 07:41 PM
ok, i got it. one of the dll's imports functions from the exe. i think it's pretty strange that a.exe imports b.dll wich imports a.exe, but maybe thats normal. so the only problem was that the filename was wrong since the dll didn't try to include my new dump.exe for some unknown reason ;-)


Would like to download the RCE cd
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Would like to download the RCE cd
PDA

View Full Version : Would like to download the RCE cd

Lint
02-28-2001, 08:07 PM
Could someone please give me the ftp address and file name so I can download this cd.
Thanks
Solomon
03-01-2001, 03:15 AM
Such question has been answered many times.
The answer is: No download for this.
the snake
03-01-2001, 10:51 AM
Hi Lint
Well, there is no ftp site, but try the Volunteer page, try to look for someone living by you...
That's why they are in this page :)

http://www.idca.com/~thesandman/RCE/Requests.html

Good luck
the snake
Solomon
03-01-2001, 09:04 PM
I have a suggestion:
use offline browser such as Teleport Pro, Offline Explorer etc to grab the sites listed in Sandman's page. Don't open too many simultaneous connections in case of traffic jam.


Cracking Delphi programs with DeDe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cracking Delphi programs with DeDe
PDA

View Full Version : Cracking Delphi programs with DeDe

Acid_Cool_178
03-01-2001, 01:47 AM
As ususal i'm are using DeDe alot these days....

I have some problems on these API's

* Reference to: Sysutils.StrLen()
* Reference to: System..LStrToPChar()
* Reference to: Sysutils.IntToHex(Int64; Integer)

I can't get them to calculate in my brain yet, so any ideas on what they mean ??

-Acid_Cool_178
goatass
03-02-2001, 04:10 PM
they are pretty simple, they do what they say:

StrLen() returns the length of a given string
LStrToPChar() converts a string to an array of characters and returns a pointer to that array.
IntToHex() converts an integer to its Hex representation.

goatass


Believe me or not :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Believe me or not :)
PDA

View Full Version : Believe me or not :)

JimmyClif
03-02-2001, 04:49 PM
I've just been on an AOL Warez site, where I was the 25th visitor on the site *hehehe*

Amazing stuff... Winzip, WinAce, CuteFTP & DreamWeaver to be downloadable as FULL version... (lmao)

Gee... how did I get there??... erm... I'm drunk and started searching for:
"aol" & "warez" on various search engines...

(this got added) They even had the AOL Logo on their MainPage ;)
esther
03-03-2001, 08:16 AM
JimmyClif (03-02-2001 07:01):
I've just been on an AOL Warez site, where I was the 25th visitor on the site *hehehe*

Amazing stuff... Winzip, WinAce, CuteFTP & DreamWeaver to be downloadable as FULL version... (lmao)

Gee... how did I get there??... erm... I'm drunk and started searching for:
"aol" & "warez" on various search engines...

(this got added) They even had the AOL Logo on their MainPage ;)

Heya JimmyClif,
You must be drunk :-D
Don't drink when you are searching and posting in this board its dangerous :-D
JimmyClif
03-03-2001, 09:44 AM
Ur right.

Last night I found it hilarious, now, being erm..."slowed down" it doesn't sound that funny anymore... duh...

esther: Don't you like living dangerous too? Until now I haven't even tied my lacings together despite the risk falling ;P


Art of Assembly which chapter do i have to know?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Art of Assembly which chapter do i have to know?
PDA

View Full Version : Art of Assembly which chapter do i have to know?

Ulku
03-02-2001, 09:57 PM
I dont want become an assembly programmer and i just want learn how to debug and crack and i just want to which chapter do you have to know crack a program.
LatexX
03-02-2001, 11:19 PM
Ulku (03-02-2001 11:57):
I dont want become an assembly programmer and i just want learn how to debug and crack and i just want to which chapter do you have to know crack a program.

Do read them all my friend.
Not only that one, but get many books about assembler.
Read, code and learn.
There is no short path. :)

LatexX
mustapha
03-03-2001, 07:41 AM
i am sending you 2 htmls.
This will help you.
mustapha
03-03-2001, 07:41 AM
i am sending you 2 htmls.
This will help you.


old games
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > old games
PDA

View Full Version : old games

KIS
03-03-2001, 09:19 AM
I am starting with reverse engineering,
and was looking for the games used in the +ORC tutorials...
sadly enough I only can find them fully working..
and that's no use for learning this stuff..
so,
if someone know where I can get them,
please tell me..

Thanks
Aleph
03-03-2001, 01:49 PM
They're on the RCE CD. Read h**p://www.idca.com/~thesandman/RCE/Requests.html

to know all about it.

regards,
Aleph
Argoth
03-04-2001, 03:57 PM
try:

http://www.trojansoft.com

Here u will find cracked games, but also ppl who want to play good guys and bring out uncracked games on their site. Gl

Grtz

Argoth


anybody looked at accware? (by icode)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > anybody looked at accware? (by icode)
PDA

View Full Version : anybody looked at accware? (by icode)

BeAR
03-04-2001, 11:19 PM
anyone taken a swing at accware? I'm not begging for free reg codes, I just want to know if someone is familiar with how it's protected and how to defeat it. So far my attempts don't seem to be like any of the tutorials I've walked through before.
-B
BeAR
03-09-2001, 12:12 PM
OK, here's what I've got so far...

Near as I can tell, the registration has different "levels." I suppose this is for different user licenses (5-user, 10-user, whatever). You enter a serial # and an auth code. With SI, I did a bpx hmemcpy and it broke on the auth code. I set a bpr on where it was being copied to (something like bpr 30:xxx segment) and this is where I start to get confused. I'm trying to avoid tracing calls all day. Twice I get a bpr where I can look at the ds:si and see my auth code. Other times it'll bpr and I can't seem to see my auth code in any of the regular registers (si,di,ax,bx...and so on). Could someone help me along, please?
Bratscher
03-09-2001, 03:22 PM
Nose diving into tracing and chasing a serial into the memory woods, may work sometimes, but it is easy to miss the forest by paying too much attention to the trees.
Consider alternative approaches:

Dissasemble the code.
Look for the nag screens or the texts that tell you, "unregistered" or "registered under such and such limitations". and so on. The processing and checking of the serial already took place, but by studying the code around those texts you may be able to find the critical decision jumps that take you to the code that produces the nag screen, and also the identfy the calls that do the checking that decide the call.
Brtacher
03-09-2001, 04:06 PM
I mean the Jump.
BeAR
03-12-2001, 03:33 AM
Brtacher (03-09-2001 14:06):
I mean the Jump.

OK. I disassembled it with w32dasm. I know that the rejection message is "unauthorize registration..." Couldn't find it with a text search in the disassembly. hmm...looked for it in the exe with just a hex editor: bingo! found the offset (0x002B454E), and just a few bytes before it is "Company successfuly registered" This looks promising. What I don't get is why the text didn't show up in the disassembly search. Guess I shouldn't fret over that too much. The next question for me is: how can I exploit this? Is there a way to watch if the text at that offset in the file are read? I'm not sure how to do that in SI, but I figure it'll get me closer to the test and jmp routines I'm trying to find. Or would this be another wild goose chase?
-B
A?????
03-12-2001, 09:07 AM
Now that you know the offset of the message search where the program PUSHs it. Im not sure about it, but as the offset is 2B454E, I think it will be 6B4E452B , 6B is push. 6A is push also. Play with this. Im sure you will find it =] Try also without reversing the order of the bytes.
Peace.
Bratscher
03-12-2001, 12:18 PM
BeAR (03-12-2001 01:33):
Brtacher (03-09-2001 14:06):
I mean the Jump.

OK. I disassembled it with w32dasm. I know that the rejection message is "unauthorize registration..." Couldn't find it with a text search in the disassembly. hmm...looked for it in the exe with just a hex editor: bingo! found the offset (0x002B454E), and just a few bytes before it is "Company successfuly registered" This looks promising.

I agree.

What I don't get is why the text didn't show up in the disassembly search.
Guess I shouldn't fret over that too much.

I don't know either, it is irrelevant.

The next question for me is: how can I exploit this? Is there a way to watch if the text at that offset in the file are read?

Sure there are several ways.
1. Try to break in the software early in its execution perhaps with BPX GetVersion.
When you are inside the app code, the CS and the DS will be pointing to the program code and data respectively. now search for the Strings "unauthorized registration..." and "Company successfuly registered". put BPR into the memory locations in which Sice found the strings. clear the BPX GetVersion and let the program run. Try to register and softice will break whenever the "unauthorized registration..." is read. Write down the instruction offset it breaks on, BPX on it, trace a little around it, try to figure out who or from where is this code called from. use both the deadlisting and SoftIce. That way you may zero-in the protection.

I'm not sure how to do that in SI, but I figure it'll get me closer to the test and jmp routines I'm trying to find. Or would this be another wild goose chase?

It certainly can be another wild goose chase, but is fun.
-B

Good luck
BeaR
03-14-2001, 04:44 PM
Well....
I did a BPR on the "unauthorized" text and worked backwards through the jump. I did a bpx hmemcpy at the point of entering the guessed auth code and worked forward. When I met in the middle, I was happy because I figured I was REALLY close. After that things got confusing. Near as I can tell there are 3 CMP/TEST points before it starts the routine that pulls up the "unauthorized" stuff. First one tests if a register equals 0008h and then jumps over a call. So does the second one, but tests for 8000h. Then it does a bunch of move operations (about 10) and does another test. This test jumps over a call and then heads on to the "you're a bad person" routine (at least I think it does). I decided to change the JNZ to a JZ at the first test so I could trace into that call. That's when things got confusing. Could I email or post the code to have someone look at it? I'm obviously not seeing something here and I hope someone could help me along. I sure wish I could just have an experience person over my shoulder sometimes.
-B
bratcher
03-15-2001, 04:17 PM
Bear,

Your E-mail does not work
BeAR
03-15-2001, 05:04 PM
Sorry, I goofed on my login. Try blanstengern@hotmail.com. That should work. BTW, thanks.
-B
BeAR
03-21-2001, 05:46 PM
OK, here's the approach I've taken. Let me know if there's a better way or if I'm missing something. By now it should be obvious I'm a total newbie. Anyways...

I'll start up the target program and get to the registration screen. I fill in some info and then position my mouse over the "OK" button. At this point I CTRL-D into softice and set a bpx on hmemcpy. I flip back to the prog and click OK. When it breaks, I'll F10 a few times until I see something like:
REPZ MOVSD
POP ECX
AND ECX,3
REPZ MOVSB

At the REPZ MOVSB I'll type 'd ds:si' to see the validation code I typed. Same with 'd es:di'. I'll see that the di is at seg:offset, so I'll type 'page seg:offset'. (Whatever set and offset showed up from es:di)
I'll take the value reported at 'Linear' (usually in the 80xxxxxx area of memory) and bpr on it. Something like 'bpr 30:80234A38 30:80234A38+12'. I'll clear the breakpoint on hmemcpy and go on with the bpr. When it breaks, I'm in USER! code, so I'll F12 back until I'm in accware code. I'll see something like this:

2B77:E342 CALL USER!CALLWINDOWPROC
2B77:E347 POP DI <---WHERE I LAND IN THE ACCWARE CODE
2B77:E348 POP SI
2B77:E349 LEA SP,[BP-02]
2B77:E34C POP DS
2B77:E34D POP BP
2B77:E34E DEC BP
2B77:E34F RETF 000A ---> Goes to USER!BEAR498+016F

(I F12 a couple of times to come back to accware code)

2B77:ACF3 CALL USER!SETWINDOWTEXT
2B77:ACF8 POP DI <---WHERE I LAND AFTER USER!BEAR498
2B77:ACF9 POP SI
2B77:ACFA LEAVE
2B77:ACFB RETF --->This bounces to another location still in accware code

2B5F:0975 MOV DI,[4088] <---Where I land from the previous RETF
2B5F:0979 MOV DI,[4092]
2B5F:097D TEST WORD PTR[DI],8000
2B5F:0981 JZ 0988
2B5F:0983 CALL 2B1F:1744
2B5F:0988 TEST WORD PTR[40A2],0008
2B5F:098E JZ 0995
2B5F:0990 CALL 2B1F:09E6
2B5F:0995 MOV BX,[DI+02]
2B5F:0998 MOV [4092],BX
2B5F:099C MOV AX,[BX+12]
2B5F:099F MOV [409E],AX
2B5F:09A2 MOV AX,[BX+10]
2B5F:09A5 MOV [40A2],AX
2B5F:09A8 SUB AX,AX
2B5F:09AA MOV AL,[BX+04]
2B5F:09AD MOV [4098],AX
2B5F:09B0 MOV AL,[BX+05]
2B5F:09B3 MOV [409A],AX
2B5F:09B6 MOV AX,[BX+18]
2B5F:09B9 MOV [4096],AX
2B5F:09BC MOV AX,[BX+1A]
2B5F:09BF MOV [4094],AX
2B5F:09C2 SUB DI,0E
2B5F:09C5 TEST WORD PTR[4034],FFFF
2B5F:09CB JZ 09D2
2B5F:09CD CALL 2B27:2F62
2B5F:09D2 POP ES
2B5F:09D3 MOV AX,[4264]
2B5F:09D6 MOV CX,0000
2B5F:09D9 CALL 0685
2B5F:09DC RET <---RETURNS TO 2B5F:03EB

2B5F:03EB XOR AX,AX <---I've been able to backtrack to this point*

* using the other method listed in this thread, where I bpx getversion and look for the "unauthorize" text, then bpr on the location of the text and try to trace back. I've tried to look at the code above this line and bpx in there, but I seem to be having trouble with Softice. when I try to set another breakpoint and CTRL-D out to test it, everything locks up or moves really slow.

I could be wrong, but I suspect that the rest of the code carries out the "bad registration" routine. This makes me believe that the above code is the area to focus on. I'm a newbie, so I may have missed something important. One of my fears is that I'm totally off the mark.
Anyways, that's what I have so far.


Stupid Newbie Question!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Stupid Newbie Question!
PDA

View Full Version : Stupid Newbie Question!

Bob Dobbs Jr.
03-06-2001, 12:16 AM
Yeah, this probably is a dumb question. Today was my first day ever researching about cracking, and i'm pretty tired, and i've had to restart my computer many times in the past hour, so i'm kinda cranky and burnt out ;)
One of the sites I visited was Cracking 4 Newbie (http://users.belgacom.net/blackb/). At the Newbie Cracking School there under Basic Lessons there was a thing on cracking Winzip that seemed fairly do-able. My winzip is already registered, but I have a program that seemed to be kinda similar.
This program (tapetracker) has a regular serial # protection thing, and it also has a 30 day timer, which isn't expired. I was hoping to be able to emulate the winzip crack. I downloaded softICE and edited winice.dat as suggested (although the last things i removed the ";" from said for win95, and i have 98... i just realized that...) So then I opened my program and went to the register screen and put in a random string of #'s. I opened softice and typed 'bpx getdlgitemtexta', then went back to my program and hit okay. It said the serial was wrong, but softice didn't do anything. In the winzip tutorial it is supposed to pop open...
So my question is, what went wrong? Does that just not work for my program? Is something wrong with softICE? Am I just being dumb and not realizing something obvious? ;)

Like I said before, I'm really tired (and a real newbie), so I'm probably just missing something obvious.

thanks in advance...
CoDe_InSiDe
03-06-2001, 12:30 AM
Hi Bob Dobbs Jr.

Well you tried to use a Tutorial that was ment for Winzip on a different program.
If a program looks almost the same as another program it doesn't have to be the same protection.
Like my quote works here:

"Don't trust the Outside, trust the InSiDe !!!" ;)

Maybe you can try to make Winzip unregistered again and then try to crack it yourself with or without the Tutorial.
To make Winzip unregistered find the following key in your registry:

"HKLM\Software\Nico Mak Computing\"

Or something similiar but i think it's the same.
Be sure to backup the Name/Serial number in case you don't succeed, you'll never know ;)
Then try to crack Winzip yourself.
Hope this helps...

Cya...

CoDe_InSiDe
batankyu
03-06-2001, 01:49 AM
maybe you'll find some info at this site.
good place,if you're interested in cracking with softice.
http://www.idca.com/~thesandman/index2.html
cu
Clandestiny
03-06-2001, 03:08 PM
Hi Bobb,

First, don't get discouraged...most all of us were in your shoes at one point or another. As for why Sice does not break on GetDlgItemTextA, there are other text input API's than GetDlgItemTextA. It is quite possible that your program is using one of the other text retrieval functions. For starts you can try GetWindowText, GetWindowTextA, GetDlgItemText (w/o the 'A'), and hmemcpy. You should also disassemble the proggy with Wdasm and have a look at the imported functions. That will surely give you some clues to set breakpoints on ;-)

Good Luck,
Clandestiny
Eternal Bliss
03-07-2001, 03:09 PM
hiya newbie,
try ebliss.cjb.net
It might help.
Regards


sice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sice
PDA

View Full Version : sice

dooral
03-06-2001, 03:34 PM
i know that this has probly been asked b4, and i know that ive seen it somewhere b4, but i cant find the answer anywhere, so here goes:
where can i go, or how do you get your mouse to work while in sice?
any help would be greatly app
thanx

dooral
Scally6
03-06-2001, 05:26 PM
Hi Dooral,
If you've got Sice 4-0 or +, go to the start/progs/ menu item (whereever you installed it) & click on the mouse setup. If you're using a three button mouse, its likely that you'll need to select the ms intellimouse option as well as ps2. Then reboot.
This has thrown me a couple of times when I've changed systems - i've played with the settings but not rebooted & wondered why it didn't work!
Scally
dooral
03-06-2001, 08:54 PM
thanx scally6
i cant f*ckin believe i asked that

thanx a lot tho, glad i got that sr8
much obliged :D

dooral


Unpacking ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking ???
PDA

View Full Version : Unpacking ???

KocloX
03-07-2001, 06:12 AM
Hello... another newbie question here...
I've worked out some cracks ( serial fishing, patch, kind of easy ones). But I'm having trouble with 'Packing/Unpacking'. I can't seem to find a good REAL NEWBIE essay on this subject. I've search trough several newbie site at reveserlinks.cjb.net, but I still can't find the tutorial I need. Note that what I need is a TOTALLY NEWBIE introduction of the subject, something like what is Packing/Unpacking, what it effects on the prog, etc. Even in cracking4newbie.org, the most 'newbie-suited' site I've seen, the only tutorial about Unpacking says "I assume you are familiar with unpacking..."
So anyone can point me out here, or even better, sending me a good introduction of the subject ???
I'd appreciate it guys. Thanx
CoDe_InSiDe
03-07-2001, 06:57 AM
Hi KocloX,

Maybe you'll like my Tutorial about Unpacking... ;)
It can be found here:

www.TrickSoft.net

Then look in the directory cracking/tutorials
I've got some more tutorials but they are not yet showed there :(
If you want them contact me... :)
Hope this helps...

Cya...

CoDe_InSiDe
Eternal Bliss
03-07-2001, 03:03 PM
Try ebliss.cjb.net
Maybe it might help.

KocloX (03-07-2001 04:12):
Hello... another newbie question here...
I've worked out some cracks ( serial fishing, patch, kind of easy ones). But I'm having trouble with 'Packing/Unpacking'. I can't seem to find a good REAL NEWBIE essay on this subject. I've search trough several newbie site at reveserlinks.cjb.net, but I still can't find the tutorial I need. Note that what I need is a TOTALLY NEWBIE introduction of the subject, something like what is Packing/Unpacking, what it effects on the prog, etc. Even in cracking4newbie.org, the most 'newbie-suited' site I've seen, the only tutorial about Unpacking says "I assume you are familiar with unpacking..."
So anyone can point me out here, or even better, sending me a good introduction of the subject ???
I'd appreciate it guys. Thanx
KocloX
03-08-2001, 04:39 AM
Thanx guys... good tutes, with example target. I'm getting the idea now. Thanx again.


r2v by ablesoft 5.5.002 help please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > r2v by ablesoft 5.5.002 help please
PDA

View Full Version : r2v by ablesoft 5.5.002 help please

Johannes
03-08-2001, 02:58 AM
Hello,
I do not do much of this so please forgive my skill set. I am working on a target called R2V (raster to vector). It is written by ablesoft.
It is available here:
http://www.ablesw.com/r2v/r2vsetup.exe
The password upon installation is r2v567

The program is designed to run with a dongle.
When I disasm the main exe file with w32dasm, I find the main dongle check at the below location. (sorry if the formatting gets messed up.)
....So, I go to
:00461574 751E jne 00461594 and I just change that to 741E je 00461594 and I get past the dongle check just fine. But then I get some errors when I try to export a file as a vector format.......basically the program thinks it is in demo mode. I suspect that my patch only created more work. Please advise me any way you can. Thanks for the help as always.
Johannes

:00461549 55 push ebp
:0046154A 8BEC mov ebp, esp
:0046154C 6AFF push FFFFFFFF
:0046154E 68DA455200 push 005245DA

:00461553 64A100000000 mov eax, dword ptr fs:[00000000]
:00461559 50 push eax
:0046155A 64892500000000 mov dword ptr fs:[00000000], esp

:00461561 81EC480A0000 sub esp, 00000A48
:00461567 898DB4F5FFFF mov dword ptr [ebp+FFFFF5B4], ecx
:0046156D E874DCFFFF call 0045F1E6
:00461572 85C0 test eax, eax

:00461574 751E jne 00461594
:00461576 8B85B4F5FFFF mov eax, dword ptr [ebp+FFFFF5B4]
:0046157C C7804405000001000000 mov dword ptr [ebx+00000544], 00000001
:00461586 6A00 push 00000000

:00461588 6A00 push 00000000

* Possible StringData Ref from Data Obj - >" Hardware key missing ,export is "
- >" limited to small images."
|
:0046158A 6810E05400 push 0054E010
:0046158F E82FC60A00 call 0050DBC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461574(C)
|

:00461594 8B8DB4F5FFFF mov ecx, dword ptr [ebp+FFFFF5B4]
:0046159A E85B380A00 call 00504DFA
:0046159F 8B4D08 mov ecx, dword ptr [ebp+08]

:004615A2 51 push ecx
nobody
03-08-2001, 09:52 PM
Hi.

You already realize that the jump reversing was not enough, and the program checks the dongle in AT LEAST another location. From what you posted you reversed the code that generates the message:" Hardware key missing ,export is " . . . but not all the dongle check.
For starters, I would
1. Trace into :0046156D E874DCFFFF call 0045F1E6, which seems to check for the existance of the dongle and return the answer in EAX. Perhaps reversing the subroutine to AWAYS return something different from 0.
2. In a dissasemble, look where else the subroutine 0045F1E6 is called.

This is just a starting point, it may, or more than likely may not solve your problem.

Regards

Johannes (03-08-2001 00:58):
Hello,
I do not do much of this so please forgive my skill set. I am working on a target called R2V (raster to vector). It is written by ablesoft.
It is available here:
http://www.ablesw.com/r2v/r2vsetup.exe
The password upon installation is r2v567

The program is designed to run with a dongle.
When I disasm the main exe file with w32dasm, I find the main dongle check at the below location. (sorry if the formatting gets messed up.)
....So, I go to
:00461574 751E jne 00461594 and I just change that to 741E je 00461594 and I get past the dongle check just fine. But then I get some errors when I try to export a file as a vector format.......basically the program thinks it is in demo mode. I suspect that my patch only created more work. Please advise me any way you can. Thanks for the help as always.
Johannes

:00461549 55 push ebp
:0046154A 8BEC mov ebp, esp
:0046154C 6AFF push FFFFFFFF
:0046154E 68DA455200 push 005245DA

:00461553 64A100000000 mov eax, dword ptr fs:[00000000]
:00461559 50 push eax
:0046155A 64892500000000 mov dword ptr fs:[00000000], esp

:00461561 81EC480A0000 sub esp, 00000A48
:00461567 898DB4F5FFFF mov dword ptr [ebp+FFFFF5B4], ecx
:0046156D E874DCFFFF call 0045F1E6
:00461572 85C0 test eax, eax

:00461574 751E jne 00461594
:00461576 8B85B4F5FFFF mov eax, dword ptr [ebp+FFFFF5B4]
:0046157C C7804405000001000000 mov dword ptr [ebx+00000544], 00000001
:00461586 6A00 push 00000000

:00461588 6A00 push 00000000

* Possible StringData Ref from Data Obj - >" Hardware key missing ,export is "
- >" limited to small images."
|
:0046158A 6810E05400 push 0054E010
:0046158F E82FC60A00 call 0050DBC3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00461574(C)
|

:00461594 8B8DB4F5FFFF mov ecx, dword ptr [ebp+FFFFF5B4]
:0046159A E85B380A00 call 00504DFA
:0046159F 8B4D08 mov ecx, dword ptr [ebp+08]

:004615A2 51 push ecx
goatass
03-08-2001, 10:07 PM
Hi Johannes,
Try to figure out what dongle the program is using which would help alot. Look at the imported functions they might sometimes have the names of the dongle APIs, do a string search for HASP or Sentinel (RNBO) in a Hex dump of the executable and in the disassembly that sometimes will tell you which dongle you are dealing with.

Your best bet is to trace into 0046156D E874DCFFFF call 0045F1E6 like nobody said and set a BPX in there that way you can see if it gets called from somewhere else. Also don't forget the usual dongle breakpoints.

BPIO -h 378
BPX FreeEnvironmentStringsA (used in HASP)
BPX DeviceIOControl (used in HASP and SSPro)
BPX CreateFileA (useful to see if a dongle driver is being opened)

read some other dongle papers to get some more ideas on how to identify which dongle is being used.

goatass
bAZiK
03-11-2001, 11:12 AM
Johannes,

:0046156D E874DCFFFF call 0045F1E6 ; call a Function at 0045F1E6
:00461572 85C0 test eax, eax ; test the return value
:00461574 751E jne 00461594 ; if value = 1 then jump

What you need to do, is to go at the Function at 0045F1E6. You can see, that this function is called several Times:

* Referenced by a CALL at Addresses:
|:00448F31 , :00449199 , :0044941B , :00450323 , :004600E5
|:00460669 , :00460863 , :004608E3 , :0046156D , :00461AB8
|:00461DF6
|
:0045F1E6 55 push ebp
:0045F1E7 8BEC mov ebp, esp
:0045F1E9 83EC1C sub esp, 0000001C
:0045F1EC 66C745F4CF18 mov [ebp-0C], 18CF

You can now go to every call and make a JMP, JE out of the following jump or (easier) just modifiy the Function, that it returns always 1:

:0045F1E6 B801000000 mov eax, 00000001
:0045F1F1 C3 ret

And your problems are solved ;-)
12399
03-15-2001, 01:26 AM
Thanks for responding and for helping. I really appreciate you taking the time to try and explain the code. I guess that I do not understand how to read the assembler instructions fully. I have finished the task and the program works beautifully, but I would like to do it a few more ways. What is the point if I am not learning. I like the "global" patch that just returns the right data. I also would like to modify the TEST lines in each location where the sub is called. I just do not know all the syntax......any thoughts?

bAZiK (03-11-2001 09:12):
Johannes,

You can now go to every call and make a JMP, JE out of the following jump or (easier) just modifiy the Function, that it returns always 1:

:0045F1E6 B801000000 mov eax, 00000001
:0045F1F1 C3 ret

And your problems are solved ;-)


How can i see the source code of a webpage?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How can i see the source code of a webpage?
PDA

View Full Version : How can i see the source code of a webpage?

KiSCiX
03-08-2001, 10:10 AM
i know that you can see the source code by right-clicking on the webpage , then click on source code...

but im looking for a way to see the source code of a target webpage:
exemple: sourcecode://www.yahoo.com

wating for replies... thanks
IcyDee
03-13-2001, 02:26 AM
I assume that you mean you want to 'look' at the source code from a program.

One way would be to write a socket program which connects to the URL and retrieves the page.

Do some searches for 'socket' and 'perl' if this is what you want to do.


Searching 4 ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Searching 4 ??
PDA

View Full Version : Searching 4 ??

Critter
03-08-2001, 11:31 AM
There are several tutorials in TKC's releases that make reference of the search function in Sice, but the amount of f's seem to differ each time, and there is no explanation of what is actually being searched for. Can someone shed a little bit of light on this function?

what it does, what parameters it takes.....etc

Thanks
Crit
me
03-08-2001, 02:25 PM
The file SoftICE command reference.pdf is either within your numega folder or available from the numega site.
There you can obtain a detailed explanation about your question. The number of F vary from tutorial to tutorial probably because nobody count them when they type them.
The "default" would be EIGHT F, so you will be searching your string in all the available space of virtual memory.
Critter
03-12-2001, 08:47 AM
Thanks for your reply.


something different
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > something different
PDA

View Full Version : something different

MP
03-10-2001, 12:45 PM
i have one application. I think it is VB3. Because when debugged with win32dasm, in the beginning it shown vb300.dll. Then in the string data it shows as per the following.
" Combst"
" Demle"
" nes lees 8 iegCe "
"(5I>"
"(5Iz"
"@!-j"
"\pred_eng.mdb"
"25I42"
"2a5I"
"5I48"
"5Iz8ffffff"
"7m716"
"8!-@*P"
"AB8G"
"ASHWIN"
"ee Je<e& o"
"en ueive peerJeve kes"
"ENGLISH [ENG]"
"er leeje "
"g77!!-"
"g77!"
"H=5I"
"hD!-"
"I!-,"
"I48pX"
"Lagna (Body,Health)"
"MARATHI"
"rKI>"
"Simha"
"Times New Roman"
"vNp3"
"XI!-n.P"
"XI=8"
"Zdp3YB"

Further the software requires key diskett to run it. I want to break disk checking. I am a newbie hence guide me in the matter.
disker
03-10-2001, 10:31 PM
If a program asks for a key diskette, the diskette is probably formatted in an unusual way that the operating system copy functions would no understand and copy. The protection will have to read the disk in an "unconventional" way.

Look for the instruction INT13 in the code of the program or the dlls. INT13 is the BIOS interrupt that access the disk devices at low level. It is unusual to find this instruction inside the regular code of an application . There is a chance that the protection is around the call(s) to this interrupt.
MP
03-12-2001, 08:59 AM
I checked the vbrundll.300. It was in the same programme folder. Hence i disassembled it but unable to find the reference for int 13. Can u guide me further?
disker
03-12-2001, 09:12 AM
MP (03-12-2001 06:59):
I checked the vbrundll.300. It was in the same programme folder. Hence i disassembled it but unable to find the reference for int 13. Can u guide me further?
Sorry if I missguided you before. What I meant you should dissassemble are the code and the dll specific to the program. not the visual basic library. VB probably access the disks in a conventional way: using the Windows API functions. But, inside of the program or libraries, the programmers should have a piece of code that reads the disk in a non-standard fashion ie, without using regular windows API, or VB ready-made routines, for that matter. Int13 is the BIOS service that is able to perform such task.
MP
03-13-2001, 09:53 AM
I read cracking tutorial about int13 by Specular vision. He has mentioned to use PC-Watch to get the reference. It can be set to look for any type of BIOS call. I am not able to get PC-Watch and hence cannot porceed further. Can u help me to move further.
Sorry for trouble.
MP
bAZiK
03-13-2001, 02:12 PM
If you want it as easy, as possible, goto google and search for "DoDi". He's written a decompiler for VB3 ;-)
MP
03-14-2001, 01:02 PM
I downloaded the vb decopiler from dodi. the txt file is in german. after installation the programme is asking for registration.
Solomon
03-15-2001, 12:50 AM
Hi,

You can get the VB3 decompiler from CrackZ's site: zencrack2.cjb.net.

Seems that this decompiler needs VB to be installed. So install VB5/VB6 first.


Too Close To The Bone ???????????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Too Close To The Bone ???????????
PDA

View Full Version : Too Close To The Bone ???????????

slave
03-10-2001, 07:08 PM
Is it really possible ????????
Could it be true?????????
Do we reallY???????????
lol.....
We restrict knowledge just the same as anyone else does............are you really any different??????
you do the same thing as BILL GATES(sic)
you restrict freedom of information...
PLSE Dont Scrub This One...IT IS KNOWN AS CENSORSHIP
esther
03-11-2001, 02:10 AM
slave (03-10-2001 17:08):
Is it really possible ????????
Could it be true?????????
Do we reallY???????????
lol.....
We restrict knowledge just the same as anyone else does............are you really any different??????
you do the same thing as BILL GATES(sic)
you restrict freedom of information...
PLSE Dont Scrub This One...IT IS KNOWN AS CENSORSHIP

Hi Slave,
Your post is not constructive,you are wasting bandwith others posting this."we" is you not us :)
esther


Unpacking without Soft Ice ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking without Soft Ice ??
PDA

View Full Version : Unpacking without Soft Ice ??

Acid_Cool_178
03-11-2001, 12:57 PM
Is there any tutorials on manually unpacking without softice ??

-Acid_Cool_178
mrlove
03-23-2001, 07:32 PM
hmm yea there is one thou i dont remember the name of it but, its not very stable the method , i never managed to be able to run the prog using this method thou hehe.

but the great part is you can see the ASM n stuff and you unpack it to an extent.

ok here goes use proc dump ,,, use unpack aspack 2000 or something else nowbefore pressing ok there should be a new funny named created file hgfh$$.tmp something in the proc dump dir or the program dir, this is the unpacked file just copy it and rename:)


Sice problem (sorry about earlier post)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sice problem (sorry about earlier post)
PDA

View Full Version : Sice problem (sorry about earlier post)

Bombast
03-11-2001, 05:05 PM
Sorry about the earlier posts.
The message given when computer fails to load is as follows:-

VCACHE DEVICE INITIALIZATION FAILED
There is not enough memory to initialize the system cache manager. The system is halted.

system halted.

This problem continues to occur whenever sice is set to load in autoexec.bat.
I have tried to remove double buffer and ifshlp when doing a step by step load but this then bring up the message VFAT failed to load.

anyone out there able to help in this matter
Aleph
03-11-2001, 11:04 PM
Hello Bombast.

Perhaps you should read this topic : h**p://www.woodmann.net/Ultraboard/Public/HTML/B6/151-1.topic.html

I hope it might be useful for you.

Regards,
Aleph


offset
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > offset
PDA

View Full Version : offset

kip
03-12-2001, 01:05 PM
okay, I am a "very beginner"...
I found a tutorial for psp, but a different version that I have..
okay, I played around a bit with softice,
trying out things, until I found something.
then I wanted to disassemble it with wdasm, but it crashes when trying (only with psp).
I tried ida pro, but I am not to good with it..
my question is : where can I find the offset
addess with ida pro?
I know where to find it with wdasm, but not with this prog.
help please..
thanks.
ThrillSeeker
03-12-2001, 06:43 PM
If my memory serves me right, psp is aspacked and no dissasembler will get your offset you so desparately seek. Try manual unpacking or get an unpacker at protools.
kip
03-13-2001, 07:35 AM
okay, thanks, I will try that.


Really newbies probs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Really newbies probs
PDA

View Full Version : Really newbies probs

cherry
03-12-2001, 01:37 PM
softice window will not pops up
I have installed Siw but when i press ctrl+d
SIW appears only 1 sec and that´s all.
i have win98. i tried to install differ. ver. but the thing is the same.
pls plshelp
Maggot
03-14-2001, 08:53 PM
Maybe u can try to change your video driver
in softice


SoftIce problem... VxD error on Win98
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftIce problem... VxD error on Win98
PDA

View Full Version : SoftIce problem... VxD error on Win98

Mercutio
03-12-2001, 03:25 PM
"Invalid VxD dynamic link call to device number 17, service 8."

This is the message i get upon trying to boot my computer. I have just installed SoftIce, and the computer refuses to boot past this error. The winice program loads ok with no errors, and sets the memory allocations ok.

After many days of researching, and searching, and crying, and failed suicide attempts, I ended up here.

Remedies I have tried:

1. Setting INIT="FAULTS ON;X" in the winice.dat file, to try and catch the error.

2. Adjusting the Memory size in the winice.dat to reflect my true memory size.

3. Hitting the computer with a large cricket bat.

Ok, so i didnt try the last one, but I'm getting close to it...

My system stats are: 486DX4/75 w/ 12MB ram running Win98. SoftIce 4.05.

I know the spec is a bit small, but Ive seen sice run on lower spec than that before.

Cheers if you can help,

Mercutio (acm2@ukc.ac.uk)
NeO'X'QuiCk
03-13-2001, 09:50 AM
Try to use older version of Softice !Maybe that will take care off the problem!!

NeO
Mercutio
03-14-2001, 07:51 AM
Forgot to mention the other thing i tried...

All previous versions i could get my hands on gave the same problem...
stillnewbie
03-14-2001, 10:40 AM
Hi,
Your ram must at least 32mb to run softice
thats a very old version of softice.
regards
stillnewbie
Mercutio
03-14-2001, 04:52 PM
A) The minimum is 16MB.

B) Ive seen it run on lower spec machines than mine.

C) 4.05 isn't an old version

Merc
MERCUTIO*N*
03-15-2001, 01:00 AM
OK, first of all, i would like to confirm that

MERCUTION != mercutio

now that ive confirmed, maybe you came here to look for a suggestion. well..

it seems like a VXD conflict, i would advise your to bootlog on bootup, and check for which vxd if fuqing up, and remove it from the registry.

else re-install winblowz, and put si on it fresh, and it should be ok.

try running that display driver program too, cud be a display driver conflict. god knows, ive never used si for the past 2 years now.

good luck

mercutio. consider changing your nick, coz a lot of people think ur me. (if possible)

thnx.
Mercution
Mercutio
03-16-2001, 01:15 AM
I'll consider it ;P

Merc.
Brewman
03-16-2001, 06:51 PM
Ok, do this and you will be fine... Temporarily load the vanilla VGA drivers, then load softice again, it should work now. Now Re-load your true video drivers.

If that does not work, tell me, so I can pull the trigger on what is left of my brains.
Brewman
03-16-2001, 07:03 PM
oh, btw, Softice HATES directX 8... absolutely hates it... which should make you wonder why.... look into it someone who isn't as lazy as me... heh.... bet it's all the "security" check coding or the ring 0 "debugging" stuff... wonder what they can "check" with that stuff.... heh...
Mercutio
03-17-2001, 05:24 AM
I have only been using the vanilla display drivers.

Sorry!

Merc
qferret
03-19-2001, 04:21 PM
SoftIce 3.24 + DX8 = No Probs 4 me brewman ;-)
Brewman
03-19-2001, 09:51 PM
***BLAM!***

well, there goes my last few cells...

sorry, it didn't help.
Stone-D
06-25-2004, 02:07 PM
Appologies for coughing up an ultra-old thread, but I also had this problem. If I use the LargeFP version of softice, everything's hunky dory. If I use the VXD variant, the first time, after a cold boot, is fine. Some corruption occurs if I use it for any length of time. The second time I boot after a soft reset, get that error message and windows freaks.

Unfortunately, using this method means NOT using a number of sice tools like icedump.
Kayaker
06-25-2004, 10:03 PM
Hi

What may I ask is the "LargeFP" version of softice? I don't think I've ever heard that term.

All I can offer is a likely definition of the cryptic error message "Invalid VxD dynamic link call to device number 17, service 8." (I'm assuming the numbers are decimal equivalents)

From vmm.h in the Win98DDK (or i.e. Ralf Brown's interrupt list), device number 17 defines the VMCPD (Virtual Math Coprocessor Device) vxd driver - VMCPD_DEVICE_ID equ 0x00011. And from vmcpd.h is Service number 8: VMCPD_Set_Thread_Precision. (Or possibly _VMCPD_Get_FP_Instruction_Size, depending on how the Service_Table entries are indexed)

This probably doesn't do much to solve your problem though, which sort of sounds like a memory leak? stack corruption? crappy math coprocessor? Maybe there's an updated vmcpd.vxd available? However, while the error may occur there, it doesn't mean it begins there...

I wonder if the original poster ever recovered from the self-inflicted gunshot wounds?

Kayaker
Stone-D
06-26-2004, 11:00 AM
I believe it means "Large Foot Print". The LargeFP version is tucked away in subfolder of the softice installation. Instead of a small WINICE.EXE and a large WINICE.VXD, you get a single large WINICE.EXE.

Using this I get no problems whatsoever. Except, of course, for the fact that icedump doesn't want to know. :P


Boson test exams
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Boson test exams
PDA

View Full Version : Boson test exams

Jason
03-12-2001, 10:22 PM
Has anyone worked with these programs w*w.boson.com, i am interested in going at these. But its vb6 and compressed with neolite, if anyone has done these can you give me some feedback.

Thanks.
Ar!s$
03-23-2001, 04:02 PM
hi jason
it's very esay but it's hard to make keyG
or to save u crack

bpx hmemcpy
& f12 -----> message error
than u are in the program "croute"

3 or 4 page up
u founde a clear call #"not call for vb or call esi
ex:call49056"
u make brkpiont & u press f8
3 f10 & dd eax u see u'r code"it's cracked"
f12-----> f10 u found jz (no jmp) "2nd" solution"

but the file is compress ---->unzip.dll
i can't save the jmp in hex
u help about it

ex:equizare for tood lammle boson 8061 ccna exam

bpx hmemcpy
f12------>till vb6
s 0 lfffffffff 0f,84,ad,01,00,00,00
u make a brckpiont in thr result
167:4a4636
15f:4a4636
r fl z------>jz for no jmp

best regards
obbc@hotmail.com


viewing the stack in SICE...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > viewing the stack in SICE...
PDA

View Full Version : viewing the stack in SICE...

nullvolt
03-14-2001, 03:19 AM
yo,
how can i see what´s on the stack in SICE (4.05/NT)?
i know about :ws to open the stack window but can´t get very much out of it... i don´t see anything in there i pushed...
any help?
thx in advance,
so long,
nullvolt
MackT
03-14-2001, 10:56 AM
If you want to see directly what you have pushed in the stack, the best way is to look at the display window:
type "d esp"
You will see what you pushed.
(The "ws" command is not done for viewing directly all stack values but for functions which are called of a process if i remember good...)

Bye,
MT.
nullvolt
03-14-2001, 02:40 PM
exactly what i needed...
thx man!

so long,
nullvolt


Save function in MFC generated program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Save function in MFC generated program
PDA

View Full Version : Save function in MFC generated program

WinDos2K
03-14-2001, 01:47 PM
A MFC generated program with the save function hardcoded to save something useless,the original save routine still exist in this program,a jump from the menu to this routine make no result ! anyone know what else to do to make it function again ?
Clandestiny
03-14-2001, 08:15 PM
Hi WinDos,

The name of the target in question would be useful for us to be able to help you. Also, possibly a url for d/l.

Regards ;)

Clandestiny
WinDos2K
03-14-2001, 10:16 PM
Hi Clandestiny
This is a very old VxD disassembler from http://www.chez.com/jls/vxdasm.html
Limited program but very good to RE !
May be add another section for save function is the only way .

Regards
WinDos2K


InstallShield script cracking: SETUP.INX, not SETUP.INS
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > InstallShield script cracking: SETUP.INX, not SETUP.INS
PDA

View Full Version : InstallShield script cracking: SETUP.INX, not SETUP.INS

Solomon
03-15-2001, 12:45 AM
The target is JAWS PDF Creator v2.0(http://www.jawssystems.com/products/products_fs.html)

The setup program of this package uses SETUP.INX, not SETUP.INS.
Both isDCC v2.1 and WISDec v1.0 can't recognize this file as a valid InstallShield script file. I don't know the difference between *.INX and *.INS, but I can find the "INVALID_SERIAL_NUMBER" macro in the INX file and "value.shl" file.

Any suggestions? TIA
Solomon
03-15-2001, 08:09 PM
Anyone has such experience?
I'm not asking for serials, just want to know how to reverse SETUP.INX
buj
04-02-2001, 03:13 AM
just bpm on the serial and see what the script does with it...
Bratsher
04-02-2001, 06:52 AM
Hi Solomon.
In an already cracked target, Delphi 5 demo,
I have been able to crack the setup.ins scripts, by pure and simple "hmemcpy on the serial, backtrace from the nag" methods, before I knew about the convenience of wisdec. The size of the code and the strength of the protection was not unsurmontable, and that might have worked to my favor.
The point is that even without "dissasembly" of the scripts, they are (were) still suceptible to trace cracking.
Scooby
04-02-2001, 07:39 AM
SETUP.INX is InstallShield 6 isn't it? There's a isdcc6 that can decompile these kind of files and give you back the script.
Solomon
04-02-2001, 09:52 PM
yes, a debugger is the ultimate way to crack a serial protection. Actually I ever cracked some InstallShield serials with SoftICE before. But without enough patience one will probably get lost in the InstallShield script interpreter DLLs. The same will happen when cracking VB/Java progs only with a debugger, coz VB/Java/FoxPro are interpreted languages(Am I right?), most of the time we are tracing in the interpreters.

I just get a decompiler for setup.inx written by Nekosuki. It works well. (h**p://nekosuki.virtualave.net)

well, thank you all for the help.Happy reversing
Solomon
04-02-2001, 09:53 PM
yes, a debugger is the ultimate way to crack a serial protection. Actually I ever cracked some InstallShield serials with SoftICE before. But without enough patience one will probably get lost in the InstallShield script interpreter DLLs. The same will happen when cracking VB/Java progs only with a debugger, coz VB/Java/FoxPro are interpreted languages(Am I right?), most of the time we are tracing in the interpreters.

I just get a decompiler for setup.inx written by Nekosuki. It works well. (h**p://nekosuki.virtualave.net)

well, thank you all for the help.Happy reversing


2nd gear
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 2nd gear
PDA

View Full Version : 2nd gear

MP
03-15-2001, 09:41 AM
I am a newbie trying to crack a programme
( 606kb zip) whose author and webside is untraceble. further the programme is useless without registration file or serial by which the programme is operational for 2 weeks. Hence I disassembled it with win32dasm. The first error message is "no registration file". Hence i got the details of the string. unable to understand details in win32dasm i need help from experienced and expert people to start with. I have put down string details at below as starting point. Kindly guide me to proceed further so that i can use the programme. preferably how to write the registration file or diable the checking of registration file. help will be highly appreciated.

* Possible StringData Ref from Data Obj ->"No registration file"
|
:00409079 BAC5B14600 mov edx, 0046B1C5
:0040907E A1A8AC4800 mov eax, dword ptr [0048ACA8]
:00409083 E804F70400 call 0045878C
:00409088 E9F6020000 jmp 00409383

* Referenced by a CALL at Addresses:
|:00404AE8 , :00408F4A , :00409083 , :00413582 , :00413681
|
:0045878C E97FFDFDFF jmp 00438510
:00458791 90 nop
:00458792 90 nop
:00458793 90 nop
:00458794 E94FCFFDFF jmp 004356E8
:00458799 90 nop
:0045879A 90 nop
:0045879B 90 nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0045878C(U)
|
:00438510 55 push ebp
:00438511 8BEC mov ebp, esp
:00438513 83C4F4 add esp, FFFFFFF4
:00438516 53 push ebx
:00438517 56 push esi
:00438518 57 push edi
:00438519 8BF9 mov edi, ecx
:0043851B 8BF2 mov esi, edx
:0043851D 8BD8 mov ebx, eax

for jmp call

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00408F4F(U), :00409088(U), :004090A2(C), :004090C7(C)
|
:00409383 8B4DCC mov ecx, dword ptr [ebp-34]
:00409386 64890D00000000 mov dword ptr fs:[00000000], ecx
:0040938D 8B45FC mov eax, dword ptr [ebp-04]
:00409390 807DCB00 cmp byte ptr [ebp-35], 00
:00409394 7405 je 0040939B
:00409396 E8AE2C0100 call 0041C049

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409394(C)
|
:0040939B 5F pop edi
:0040939C 5E pop esi
:0040939D 5B pop ebx
:0040939E 8BE5 mov esp, ebp
:004093A0 5D pop ebp
:004093A1 C3 ret

:0041C049 50 push eax
:0041C04A 8B10 mov edx, dword ptr [eax]
:0041C04C FF52E4 call [edx-1C]
:0041C04F 58 pop eax
:0041C050 C3 ret
qferret
03-15-2001, 08:03 PM
Most likely, by the time you reach this part of the code, it's too late....scroll up a bit to see how you get the "No Registration File...." MessageBox.

Try utilities such as RegMon & FileMon to see what the proggie is checking for...

Just a few hints to point you in the right direction....dig around a bit & if you get hung up again, ask another question ;-)
MP
03-16-2001, 10:28 AM
Thank u very much. As suggested by u, scrolled up a bit & found that there is a reference string about rfcalc.dll This file is not in the program folder & also not on my computer anywhere. I think this must be the .reg file. Now look at the followings & please guide further in the matter.

* Reference To: KERNEL32.GetVolumeInformationA, Ord:0000h
|
:00408FAD E834020600 Call 004691E6
:00408FB2 8B8D60FFFFFF mov ecx, dword ptr [ebp+FFFFFF60]
:00408FB8 8D8554FEFFFF lea eax, dword ptr [ebp+FFFFFE54]
:00408FBE 51 push ecx

* Possible StringData Ref from Data Obj ->"%ld"
|
:00408FBF 68B3B14600 push 0046B1B3
:00408FC4 50 push eax
:00408FC5 E8765F0500 call 0045EF40
:00408FCA 83C40C add esp, 0000000C
:00408FCD E822D00400 call 00455FF4
:00408FD2 DD9D50FFFFFF fstp qword ptr [ebp+FFFFFF50]
:00408FD8 DD8550FFFFFF fld qword ptr [ebp+FFFFFF50]
:00408FDE DD5DA4 fstp qword ptr [ebp-5C]

* Possible StringData Ref from Data Obj ->"r+"
|
:00408FE1 68C2B14600 push 0046B1C2

* Possible StringData Ref from Data Obj ->"rfcalc.dll"
|
:00408FE6 68B7B14600 push 0046B1B7
:00408FEB E8684E0500 call 0045DE58
:00408FF0 83C408 add esp, 00000008
:00408FF3 894590 mov dword ptr [ebp-70], eax
:00408FF6 837D9000 cmp dword ptr [ebp-70], 00000000
:00408FFA 7476 je 00409072 This jump is just above the old string below
:00408FFC 8D558C lea edx, dword ptr [ebp-74]
:00408FFF 52 push edx
:00409000 8B4D90 mov ecx, dword ptr [ebp-70]
:00409003 51 push ecx
:00409004 E8CF4A0500 call 0045DAD8
:00409009 83C408 add esp, 00000008
:0040900C 8B4590 mov eax, dword ptr [ebp-70]
:0040900F 50 push eax
:00409010 6A31 push 00000031
:00409012 8D9588FEFFFF lea edx, dword ptr [ebp+FFFFFE88]
:00409018 52 push edx
:00409019 E8DA4A0500 call 0045DAF8
:0040901E 83C40C add esp, 0000000C
:00409021 8B4D90 mov ecx, dword ptr [ebp-70]
:00409024 51 push ecx
:00409025 6A31 push 00000031
:00409027 8D85ECFDFFFF lea eax, dword ptr [ebp+FFFFFDEC]
:0040902D 50 push eax
:0040902E E8C54A0500 call 0045DAF8
:00409033 83C40C add esp, 0000000C
:00409036 8B5590 mov edx, dword ptr [ebp-70]
:00409039 52 push edx
:0040903A 6A31 push 00000031
:0040903C 8D8DECFDFFFF lea ecx, dword ptr [ebp+FFFFFDEC]
:00409042 51 push ecx
:00409043 E8B04A0500 call 0045DAF8
:00409048 83C40C add esp, 0000000C
:0040904B 8B4590 mov eax, dword ptr [ebp-70]
:0040904E 50 push eax
:0040904F 6A31 push 00000031
:00409051 8D95B8FDFFFF lea edx, dword ptr [ebp+FFFFFDB8]
:00409057 52 push edx
:00409058 E89B4A0500 call 0045DAF8
:0040905D 83C40C add esp, 0000000C
:00409060 8D8DB8FDFFFF lea ecx, dword ptr [ebp+FFFFFDB8]
:00409066 51 push ecx
:00409067 E820C40500 call 0046548C
:0040906C 59 pop ecx
:0040906D DD5D9C fstp qword ptr [ebp-64]
:00409070 EB1B jmp 0040908D

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00408FFA(C)
|
:00409072 6A00 push 00000000

* Possible StringData Ref from Data Obj ->" "
|
:00409074 B9DAB14600 mov ecx, 0046B1DA

* Possible StringData Ref from Data Obj ->"No registration file"
Eternal Bliss
03-16-2001, 10:48 AM
Hiya,
No offence meant. But you should learn to read more tutorials and know more asm. Then use a little bit of thinking and analyse what the piece of code you pasted mean. There is no point in getting people to tell you what to do when in the end, you still have no clue what is happening. The piece of code you pasted is very simple to understand.

Regards
Bliss


sice prob... :/
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sice prob... :/
PDA

View Full Version : sice prob... :/

dooral
03-15-2001, 08:39 PM
hmemcpy comm doesnt work in sice for me, do i need to do somethin in my winice, its not a specal comm, and ive got the vb stuff, but i dunno what else it could b
its not vb, but ive already got everything else i tink....

thanx for all suggestions

dooral
Scally6
03-16-2001, 12:51 PM
Hi Dooral,
What's the target ?
Scally6
03-16-2001, 12:53 PM
Hi Dooral,
What's the target ?
hmemcpy
03-17-2001, 07:14 AM
dooral (03-15-2001 18:39):
hmemcpy comm doesnt work in sice for me, do i need to do somethin in my winice, its not a specal comm, and ive got the vb stuff, but i dunno what else it could b
its not vb, but ive already got everything else i tink....

thanx for all suggestions
dooral

If you are using Windows NT or Win 2000 hmemcpy won't break.


need helpwith x-plane
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > need helpwith x-plane
PDA

View Full Version : need helpwith x-plane

deominac7744
03-16-2001, 12:26 AM
hey everybody

i need help i got this crack tut for x-plane but it 5.60 and i have 552 so all the codes are diff

i want to remove the time limit
and the nag screens
i have w32dasm ,ultraedit , soft ice , gametrainer2.01

the crack tut was in megagames.com

if someone could please help me with this i would greatly appreciate it :)
bytesss
03-21-2001, 11:23 PM
well, i can tell you what you need to do or you can get the latest patches i put together, i have them for v5.52 (the fake release by "Sphinks") v5.61 v5.62 and 5.62-B, as you can tell i'm a big X-Plane fan

http://briefcase.yahoo.com/bytesss
splaj
03-22-2001, 09:26 AM
This wanker is the same person as 'recallurbrain / domein/ panthergirl (nice handle :-p ) who is banned from th main RCE MB

DO NOT REPLY ANY FURTHER ABOUT X-PLANE Q's

SplAj


SICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SICE
PDA

View Full Version : SICE

P:G:
03-16-2001, 04:40 AM
A newbie question..
How can I view in SICE 4.x complex data like "DRAWITEMSTRUCT" or "MEASUREITEMSTRUCT" and so on?
At now I can only inspect simply data like "int" or "BOOL" and the only manner I can view complex data is copying single fields in simple data.
Is there a manner to inspect them directly?
Kayaker
03-16-2001, 11:37 AM
Hi,

Both of the data types you mentioned are structures which are used with system defined window messages. One of the parameters of the message is an address pointer to the structure. The structure itself can contain many fields so as far as I know the most direct way to view it in SoftIce is to set a BMSG break on the windows message that uses it.

The DRAWITEMSTRUCT you mentioned for example is defined as:

==================================
The DRAWITEMSTRUCT structure provides information the owner window must have to determine how to paint an owner-drawn control or menu item. The owner window of the owner-drawn control or menu item receives a pointer to this structure as the lParam parameter of the WM_DRAWITEM message.

typedef struct tagDRAWITEMSTRUCT { // dis
UINT CtlType;
UINT CtlID;
UINT itemID;
UINT itemAction;
UINT itemState;
HWND hwndItem;
HDC hDC;
RECT rcItem;
DWORD itemData;
} DRAWITEMSTRUCT;
==================================

and the windows message that uses it is:

==================================
The WM_DRAWITEM message is sent to the owner window of an owner-drawn button, combo box, list box, or menu when a visual aspect of the button, combo box, list box, or menu has changed.

WM_DRAWITEM
idCtl = (UINT) wParam; // control identifier
lpdis = (LPDRAWITEMSTRUCT) lParam; // item-drawing information

Parameters

idCtl
Value of wParam. Specifies the identifier of the control that sent the WM_DRAWITEM message. If the message was sent by a menu, this parameter is zero.

lpdis
Value of lParam. Points to a DRAWITEMSTRUCT structure containing information about the item to be drawn and the type of drawing required.
==================================

So you'd need to retrieve the hWnd of the control that uses the WM_DRAWITEM message (with 'HWND' in SI or with a utility such as Winshow/Winfrog) and set a 'BMSG hWnd WM_DRAWITEM' in SI. When the control receives the message SI should break and you can view the address of the DRAWITEMSTRUCT (pointed to by lParam in the above example).

Many API's also use structures directly as one of their parameters (i.e. GetOpenFileName), in which case you can use a bpx rather than a bmsg breakpoint.

Anyway, hope this helps

Kayaker


hmemcpy breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hmemcpy breakpoints
PDA

View Full Version : hmemcpy breakpoints

Plaster1
03-16-2001, 09:43 AM
setting bpx hmemcpy in softice for serial number, breaks each time a character is entered into the box. I have tried to do a search in the register following each break. I can locate the information I type in , but can't see what the program is comparing it to. So I can see the fake serial, but none of the registers seem to hold the real serial. Could the real serial be held in a dll text xtension file? There are a lot of calls to mfc42.dll and text elements in that library.
Bratscher
03-17-2001, 07:39 AM
setting bpx hmemcpy in softice for serial number, breaks each time a character is entered into the box.

That is more the rule than the exception. you should either :
1. Set or activate the BPX hmemcpy AFTER you have entered all the serial digits but BEFORE you click OK.

2. I f you suspect the program is evaluating the serial "on the flight" as you enter it, break with hmemcpy after each character as you have been doing, but once you have written five or 6 digits, enough to form a unique pattern of bytes, try searching for it in the memory when Sice breaks and put a BPR on the area in memory the serial is being stored.

I have tried to do a search in the register following each break. I can locate the information I type in , but can't see what the program is comparing it to. So I can see the fake serial, but none of the registers seem to hold the real serial.

The Real serial may well not be in the registers. they may hold, in a convoluted way, the address for the real serial or the encoded serial.

It is also naive to think the serial most be somewhere in memory and the program is going to compare your fake with the real. There are more secure ways to validate a serial.
The program may encrypt your fake serial and compare it with an "encrypt" form of the real serial, or may perform some arithmetic transformations on the fake serial and then test for conditions that only a valid serial would pass etc, ect, etc.

Could the real serial be held in a dll text xtension file?

Yes, but the real serial may not be held anywhere...

There are a lot of calls to mfc42.dll and text elements in that library.

mfc42.dll is an operating system library, does not belong to your App. Should not contain any information specific to your target program, less a serial or protection info.
Plaster1
03-18-2001, 06:35 AM
Thanks Bratcher, it was naive to believe that there would be a memory echo of the real serial. I guessed that I would get lucky as the prog also has a reg code and a license code which were echoed in memory. I suppose it just means I should learn a bit more before tackling this program again. As you have suggested, it may be that the real serial is not contained anywhere. Thanks for your time.


BIG SICE Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > BIG SICE Problem
PDA

View Full Version : BIG SICE Problem

SORD
03-16-2001, 07:57 PM
I installed SICE 4.05 on my Win98 SE computer. But whenever it turns on SICE comes up during the Win98 pic say Page Fault and wants me to debug it. I restared and changed the INIT string to add "FAULTS OFF" but now SICE just keeps restarting after the fault accurs (Boot, Win98 pic, restart, so on). I then uninstalled it and tried it with SICE 4.0 but the same thing happened. I've tried it with the boot menu and same again. My comp is a pentium III, 550 Mhz, 128 RAM. I tried my WINICE.DAT's area for RAM as both 128 and 32(default). Please help!
Maggot
03-19-2001, 04:07 AM
I dont have a clue but here is my init.
INIT="lines 80; width 100; wc 40; wd 14; code on; faults off; X;"
aimless
03-19-2001, 09:36 AM
Try this:

I think you will have to modify your config.sys file. I think you must be having a manual entry for HIMEM.SYS.

REM that particular entry. A better idea is to copy config.sys to config.bak and delete ALL contents in the config.sys file. Yes, correct. An EMPTY config.sys file.

This WILL work. Later on, once ice is loaded, try reloading it by adding each statement that was originally present in the now renamed config.bak file one-by-one.

THis will definitely solve your problems.

Have fun.

Luv
SORD
03-19-2001, 02:10 PM
My config.sys already has nothing in it. So I can't fix it that way. It still restarts after finding a page fault on boot. My INIT string is
INIT="wl;code on; lines 50; wc 36; wd 4; wr; faults off;X;"
PLEASE HELP!


widecharstrings in w32dasm ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > widecharstrings in w32dasm ?
PDA

View Full Version : widecharstrings in w32dasm ?

nullvolt
03-17-2001, 09:52 AM
howdy,

i read that there´s a patch to enable widecharstrings in w32dasm e.g. build stringrefs from vb-progs...
anyone know of such a patch? i can´t seem to find one :(

so long,
nullvolt.
Snacker
03-17-2001, 05:05 PM
check protools.cjb.net !

[]'z
Snacker


GetDiskFreeExa - is this the right syntax
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > GetDiskFreeExa - is this the right syntax
PDA

View Full Version : GetDiskFreeExa - is this the right syntax

the snake
03-18-2001, 04:56 AM
Hi to whom can help.
I'm at work right now, and don't have any tools here.
I have a program that crashed on start-up with this messagew :
"FILE APPMANAGER.DLL IS LINKED TO A MISSING EXPORT GetDiskFreeExa-KERNEL32.DLL"
Can someone please check for me if this is the right syntax for this API, or the programer had a mistake ?
Thanks in advance for a quick reply...
the snake
Plaster1
03-18-2001, 06:58 AM
dont know if this is useful or not, snake, but looked up the reference on api's and it has an entry for GetDiskFreeSpace do you want other details of the api arguments
the snake
03-19-2001, 08:29 AM
Hi
Thanks for replying.
As i've wrote, i was at work and had no tools or other goodies, so i couldn't read
the API manual, but i've got a reply on the other board, from SV...
Thanks anyway
the snake


cd cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > cd cracking
PDA

View Full Version : cd cracking

Name
03-18-2001, 11:00 PM
8) :( :) ;) :* >( :'( :o :P :p ;P :-D 8-) :-(
:-) ;-) :-o ^_^ }> ??? :D ;D

can anyone send me a tutorial or a link to a tutorial that teaches how to crack programs so they dont need the cd's??

8) :( :) ;) :* >( :'( :o :P :p ;P :-D 8-) :-(
:-) ;-) :-o ^_^ }> ??? :D ;D
CoDe_InSiDe
03-19-2001, 12:23 AM
Hi Name,

Take a look here:

http://www.yates2k.co.uk

Cya...

CoDe_InSiDe


I would like to start RE'ing, where do I begin?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I would like to start RE'ing, where do I begin?
PDA

View Full Version : I would like to start RE'ing, where do I begin?

Sven
03-19-2001, 03:02 PM
I am at the momment working on defeating a dongle (using tools to enable me to build a hardware solution) as my purely hardware approach, a micropressor based add-on board that seached for data from the PC; memorized the response from the dongle then replicated it was not up to the task, but having seen how my hardware design approach is not suitable in all cases I now want to branch out into software cracking.
From my job I know Intel assembler and HEX (For RISC processors) like the back of my hand, I've dabbled in VB and C++ but I doubt if I could "hello world" anymore though, I have a good understanding of how programs and processes interact but not at the code level.
And that is it, with this pitiful ammount of knowledge how and where do I start?
Latigo
03-19-2001, 03:19 PM
www.cracking4newbies.org
#cracking4newbies
This board :)

Bye and have a nice trip.

Latigo.
Acid_Cool_178
03-19-2001, 03:19 PM
Begin with grabbing so many asm tutorials as you can and tutorials on how to crack.. that's how i begain cracking..

http://www.krobar.cjb.net for everything
http://www.hellforge.org for tutorials on cracking and some crackmes
http://www.immortaldescendants.org/ for great tutorials on coding and cracking

-Acid
Eternal Bliss
03-20-2001, 08:43 AM
Hiya,
there is also ebliss.cjb.net
On the site, there is a zip folder called resource.zip which is quite helpful too.

Regards
EB
aimless
03-21-2001, 08:28 AM
You could also try reading the (defunct?) +ORC tuts.

Best in the business there is.

Try breaking psedit.exe

(heh!)

Luv
RaSdeC
03-22-2001, 06:42 AM
You can find all you need at these urls:

+Sandman
http://www.idca.com/~thesandman/

ImmortalDescendants
www.immortaldescendants.org

TRES2000
www.tres2000.cjb.net

CrackZ
http://zencrack2.cjb.net/

----RaSdeC
stealthFIGHTER
03-23-2001, 06:43 PM
This is not so kickass page, but it can also help you with rev.

http://stealthfighter.cjb.net -or- http://nitrous.hop.to

Regards

sF


general unpacking question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > general unpacking question
PDA

View Full Version : general unpacking question

nullvolt
03-19-2001, 03:23 PM
hi there,
i know there are several tuts around which explain unpacking for different packers. my question is: how to find out which packer was used? do they all leave their own sign i should recognize?

thx,
so long,
nullvolt.
CoDe_InSiDe
03-20-2001, 04:43 AM
Hi nullvolt,

Most of the time you can see that by just examining the Sections.
For example UPX, then you'll see Section names with UPX :)
Hope this helps.

Cya...

CoDe_InSiDe
Eternal Bliss
03-20-2001, 08:29 AM
Hiya,
there are programs that will sometimes tell you what packers are used. And after a while, you might just be able to recognise what packer is used simply by the code.
protools.cjb.net

Regards
EB
nullvolt
03-21-2001, 03:50 AM
Eternal Bliss (03-20-2001 06:29):
Hiya,
there are programs that will sometimes tell you what packers are used. And after a while, you might just be able to recognise what packer is used simply by the code.
protools.cjb.net

Regards
EB

thx for ya help ebliss but i cant seem to find such a program on protools. u know it´s name by chance?

so long,
nullvolt.
splaj
03-21-2001, 05:03 AM
yo nullvolt,..... watt ya want amp le help :)

try :-

www.exetools.com

nice section called 'file analysers'

SplAj
SirLeechaLot
03-21-2001, 05:27 AM
Hi,

I tried Language 2000 but most of the time it doesnt recognize the format with which the exe is packed and especially it doesnt show anymore info which is needed for asprotect.
So which fileanalyzer shows an exact format?
Any experiences?

thanx for repyling

siRl
splaj
03-21-2001, 06:21 AM
Yes this is a good point for newbies, experience is the key.

Overcome the phear and feel the code. Once you are delving in deep you can usually tell the type of code from experience.

Asprotect is one of those that lets you CHOOSE the section name, also you can manually change the section names with PEditor !
So such 'tools' that attempt to recognise the packer for you are useless. The brain beats them all up. Just practise and practise. I could make you an ASpacked file LOOK like UPX !!! After 1 year you get the 'feel'.

I made a tut on unpacking and also inline patching Lockdown 2000
last year, my opening statment was ' I don't know what the f*uck has been used to pack this target..... just for fun lets do some fishing'. In an attempt to show an approach and get the feel of how most packers unpack in memory and hand over to the real exe. Most use the aPlib routines anyway ! This is taken out from unpacked CrunchV2.exe from BiTarts :-

"aPLib v0.22b - the smaller the better :)..Copyright (c) 1998-99 by Joergen Ibsen / Jibz, All Rights Reserved....This copy of aPLib is free for non-profitable use.....For more information: http://apack.cjb.net/ "

Well a few who tried the tut did e-mail me and correctly identify ASpack.

Well done.

Keep fishing.

SplAj
The Archivist
03-21-2001, 03:30 PM
Well I guess I should put in a plug for the Information|Identification section of suddendischarge.com, especially FileInfo and GetTyp


bpx problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > bpx problem
PDA

View Full Version : bpx problem

Slicer
03-19-2001, 04:11 PM
In most tutorials about cracking programs with softice, are saying that you have to type in the command bpx getdlgitemtexta. But when I type that, softice will say that getdlgitemtexta is not difined. Could someone please tell me how to use the command bpx getdlgitemtexta?
thnx
bratscher
03-19-2001, 09:36 PM
Slicer (03-19-2001 14:11):
In most tutorials about cracking programs with softice, are saying that you have to type in the command bpx getdlgitemtexta. But when I type that, softice will say that getdlgitemtexta is not difined. Could someone please tell me how to use the command bpx getdlgitemtexta?
thnx
The code for that API function is lives in USER32.DLL. Make sure that in winice.dat you uncommented that library (and all the windows API libraries for that matter) so WinIce recognizes the symbol 'getdlgitemtexta' as a function.


InsideTheWeb Shutdown (for those who remember the old board)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > InsideTheWeb Shutdown (for those who remember the old board)
PDA

View Full Version : InsideTheWeb Shutdown (for those who remember the old board)

Kayaker
03-20-2001, 12:20 AM
Guess it was a good thing we left. Or were we kicked out? I forget ;)

InsideTheWeb Shutdown Notice

Since January 1997, InsideTheWeb has provided free message boards to online
communities. Our goal has always been to offer an easy-to-use and
technically superior format for threaded discussions. Though we have hit a
few bumps along the way, we feel we have succeeded in that ideal.

As some of you may know, internet advertising revenues have fallen to
extremely low levels over the past several months. Supporting a community
service such as InsideTheWeb is impossible without a secure source of
funding and we are being forced to close our doors. While there are certainly
other means of generating income, we do not have the ability to
address them without sustaining significant losses in the foreseeable
future. Therefore, as of March 9th, we are shutting down all InsideTheWeb
message boards and ceasing site operations altogether.

We would like to thank you for visiting us! We sincerely appreciate each and
every one of you for your patronage and support! We have thoroughly enjoyed
talking with many of you over the years and wish you the very best. It is
people like you that made InsideTheWeb the best message board community on
the internet!

Sign up for a free Beseen Bulletin Board
here!

Thank you!
InsideTheWeb Staff
JimmyClif
04-04-2001, 05:04 PM
Hey Kayaker,

The only thing I miss from the old itw board is how the threads were looking:

Big Softice Problem by newb4454
What about pressing CTRL-D? (n/t) by dude
Great that worked! (n/t) by newb4454
Why does my computer freeze when pressing CTRL-D? (n/t) by newb4454

*hehehe* I just loved the general look you got there


SICE problem with Win2k SP1 ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SICE problem with Win2k SP1 ?
PDA

View Full Version : SICE problem with Win2k SP1 ?

nullvolt
03-20-2001, 02:27 AM
howdy partners,
i used to run SICE 4.05 under win2000. everything went fine till i installed service pack 1 yesterday. now whenever i press ctrl-d to pup up softice it does pop up, but without showing anything to me. i cant see the softice window- the screen freezes untill i press ctrl-d again. i´m sure it runs correctly (cause x; also works to return desktop control) but it just doesn´t show up... strange, anyone else have this problem ? i didn´t try to uninstall sp1 yet, cause i´d like to find another way around it...

share your thoughts with me ;)

so long,
nullvolt.
+SplAj
03-20-2001, 04:12 AM
Here is my winice.dat for you to look at, hint check out the altscreens bit ! also read the
Numega pdf hel
+SplAj
03-20-2001, 04:17 AM
Sorry, premature ejaculation occured...
here is the winice.dat. and I can't attach ???
so here is the text

Winice.dat in Winnt 2k system folder :-

PENTIUM=ON
NMI=ON
ECHOKEYS=OFF
NOLEDS=OFF
NOPAGE=OFF
SIWVIDRANGE=ON
THREADP=ON
LOWERCASE=OFF

SYM=512
HST=256
MACROS=32
DRAWSIZE=2048

INIT="X;"

F1="h;"
F2="^wr;"
F3="^src;"
F4="^rs;"
F5="^x;"
F6="^ec;"
F7="^here;"
F8="^t;"
F9="^bpx;"
F10="^p;"
F11="^G @SS:ESP;"
F12="^p ret;"
SF3="^format;"
AF1="^wr;"
AF2="^wd;"
AF3="^wc;"
AF4="^ww;"
AF5="CLS;"
AF11="^dd dataaddr->0;"
AF12="^dd dataaddr->4;"
CF1="altscr off; lines 51; wc 32; wd 8;set font 2; code on; color 9 a0 1 4 5;;"
CF2="^wr;^wd;^wc;"

; WINICE.DAT
; (SystemRoot\System32\Drivers\WINICE.DAT)
; for use with SoftICE for Windows NT (versions 3.0 and greater)
;
; ***** Examples of export symbols that can be included *****
; Change the path to the appropriate drive and directory
; EXP=\SystemRoot\System32\hal.dll
; EXP=\SystemRoot\System32
toskrnl.exe
; EXP=\SystemRoot\System32
tdll.dll
EXP=\SystemRoot\System32\kernel32.dll
EXP=\SystemRoot\System32\user32.dll
EXP=\SystemRoot\System32\csrsrv.dll
EXP=\SystemRoot\System32\user32.dll
; EXP=\SystemRoot\System32\winsrv.dll

MACRO UINT="U #8:(WORD(*#10:((#30:38).0+%1*8+6))*10000+WORD(*#10:((#30:38).0+%1*8)));"
MACRO UINT0="EB (#10:((#30:38).0+%1*8+5)) 8E;"
MACRO PBCHK="UINT 3;EB (CODEADDR+A)+@(CODEADDR+6)+1C \"J\";.;"
MACRO PFG="UINT 3;EB (CODEADDR+A)+@(CODEADDR+6)+29 \"F\";.;"
MACRO PJM="UINT 3;EB (CODEADDR+A)+@(CODEADDR+6)+30 \"L\";.;"
MACRO PBPLIM="UINT 3;EB (CODEADDR+A)+@(CODEADDR+6)+10208 EB;.;"
MACRO PSRLIM="UINT 3;EB (CODEADDR+A)+@(CODEADDR+6)+B672 EB;.;"
MACRO PUHF="UINT 3;EB (CODEADDR+A)+@(CODEADDR+6)+29466 EB;ED @(DATAADDR-5) 0;.;"
MACRO PNTICE="S#10:E1000000 L4800000 4F,62,4E,6D,4E,0,54,0,69,0,63,0,65,0,0,0;EB DATAADDR+4;"
MACRO PSIWST="S#10:E1000000 L4800000 4F,62,4E,6D,53,0,69,0,77,0,76,0,69,0,64,0,53,0,54,0,41,0,52,0,54,0,0,0;EB DATAADDR+4;"
MACRO LDRON="DB NtGlobalFlag;EB DATAADDR BYTE(*DATAADDR)|2;"
MACRO LDROFF="DB NtGlobalFlag;EB DATAADDR BYTE(*DATAADDR)&~2;"
nullvolt
03-20-2001, 04:21 AM
solved it - woohoo :D

i tried to reinstall sp1 which didn´t work. then i tried installing sp1-network version (the 100mb thing from microsoft). it behaved like no service pack was installed yet and after installation SICE runs smoothly again ;)

tho i didnt need it: very thx for your winice.dat man.

so long,
nullvolt.
LordSoth
03-20-2001, 11:45 AM
hiya +Splaj,

Wanna explain why your macros look so funny ? :)

LS
splaj
03-21-2001, 03:58 AM
Yeh, this is a strange one . The macros don't look like this in a text editor ;) ................

But those 'cool smokin dudes' sure look after any attempts at debugger detection in WinNT4/5 very well ;D

I worship thee o'master Elicz

Your humble follower SplAj


Disabled functions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Disabled functions
PDA

View Full Version : Disabled functions

Bazil
03-20-2001, 01:14 PM
I have some software in which the save function has been disabled in the file menu and the button itself.

Has anyone got any tutorials of ideas on how to go about removing this, as I am sure the save code is there - just disabled.
Squidge
03-20-2001, 05:24 PM
In which way are they disabled?

Are the buttons greyed out?
Does it say "Not available in demo mode" ?

etc?


TRW2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > TRW2000
PDA

View Full Version : TRW2000

garvic
03-21-2001, 01:08 PM
How do I change the language and keyboard in Trw2000?
Thanks.
blackos
03-30-2001, 04:58 PM
I'm really sorry man, but I think it's simply not possible...
:(
I'm french, and use AZERTY keyboard instead QWERTY... and it's a pity that mapped keyboard is not supported. If I'm wrong, just tell me, it will make me happy !

I asked Liutaotao and co. about this point for a long time now and I never get any answer.

bye.

blackos.
RuFeng
04-01-2001, 09:15 AM
Hello!Liutaotao is a chinese.in china,We use the english keyboard,and very hardn't to find the other language keyboard.so I think He can't develop the other language keyboard for trw2000.
qferret
04-01-2001, 07:06 PM
could still remap it.....

IBM's 5250 AS/400 emulator is a great example of this in practice. You can tell the program that the <enter> key is actually the <tab> key etc. All within a GUI. Simply click on the graphic of the key you wish to change, then change the keystroke value in the scroll box. You can also set up different commands for "shift +" "ctrl +" & "alt +"
jnc
04-03-2001, 06:30 PM
'IBM's 5250 AS/400 emulator is a great example of this in practice.'

What would this AS/400 emu run on ??
A pc or 5250????
Basicaly I'm looking for some AS/400 experience, If I can use AS/400 I can get paid more but they won't let me use the AS/400 untill I have experience :-(. So I need a source to get it.
qferret
04-04-2001, 12:58 PM
it probably won't help you much for that...it's actually a program that allows you to issue commands, queries, etc. to an AS/400 from within windows, as opposed to say, a dump terminal.

sorry.

There are alot of references around though, even a command reference would be helpful to you. (most are easy enough to figure out what they are, (IBM standard 3 letter truncations)
Stony
04-08-2001, 09:03 AM
you may try to change corresponding part in its inifile, or do something to its sys.dll (just guess).


Newbie question about Unpacking/OEP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Newbie question about Unpacking/OEP
PDA

View Full Version : Newbie question about Unpacking/OEP

emulder
03-23-2001, 10:01 AM
Hi!

I'm quite new to unpacking and this stuff.
I've got a question about unpacking an ASProtected programm,
esp. finding the right Entry Point (OEP).
So let me tell you what I did so far:

1) set a bpx getprocaddress and started the program
2) when SI pops and the program's code appears, I did bc*
3) I watched at the sections with the map32-command and guessed
that the section with the biggest Virtual size must be the code
section, where the OEP sits. So I used icedumps /tracex command
with low eip=start of code section and high eip=end of code section.
4) I let the program run and when it breaks the second time, I traced
a bit down until there's a jump with leads to this code:

0167:004B56C8 55 PUSH EBP
0167:004B56C9 8BEC MOV EBP,ESP
0167:004B56CB 83C4F4 ADD ESP,-0C
0167:004B56CE 53 PUSH EBX
0167:004B56CF 56 PUSH ESI
0167:004B56D0 57 PUSH EDI
0167:004B56D1 8B7508 MOV ESI,[EBP+08]
0167:004B56D4 8B4610 MOV EAX,[ESI+10]
0167:004B56D7 83E001 AND EAX,01
0167:004B56DA A3E4114C00 MOV [004C11E4],EAX
0167:004B56DF E8ACD1FFFF CALL 004B2890
0167:004B56E4 8B5620 MOV EDX,[ESI+20] <crash
0167:004B56E7 52 PUSH EDX
0167:004B56E8 8B4E1C MOV ECX,[ESI+1C]
....

5) Now I thought that 4b56c8 must be the OEP; I used the "jmp eip",
switched to Procdump and dumped the process to disk.
6) I used Revirgin to get the IT.bin and pasted it into the dump.exe using
SV's tool, corrected the values for Entry Point and IT RVA and length.
7) But now when I start the dump.exe the program crashes at the marked
line (esi==0).

Well, my question is how can I find the OEP?
And am I on the right way, how i described it?
And one more stoopid question: What's the difference between IT and IAT?

I hope there's someone out, who feels like to help me and answer me
newbie questions...

regards
e.
stillnewbie
03-23-2001, 10:30 AM
emulder (03-23-2001 08:01):
Hi!

I'm quite new to unpacking and this stuff.
I've got a question about unpacking an ASProtected programm,
esp. finding the right Entry Point (OEP).
So let me tell you what I did so far:

1) set a bpx getprocaddress and started the program
2) when SI pops and the program's code appears, I did bc*
3) I watched at the sections with the map32-command and guessed
that the section with the biggest Virtual size must be the code
section, where the OEP sits. So I used icedumps /tracex command
with low eip=start of code section and high eip=end of code section.
4) I let the program run and when it breaks the second time, I traced
a bit down until there's a jump with leads to this code:

0167:004B56C8 55 PUSH EBP
0167:004B56C9 8BEC MOV EBP,ESP
0167:004B56CB 83C4F4 ADD ESP,-0C
0167:004B56CE 53 PUSH EBX
0167:004B56CF 56 PUSH ESI
0167:004B56D0 57 PUSH EDI
0167:004B56D1 8B7508 MOV ESI,[EBP+08]
0167:004B56D4 8B4610 MOV EAX,[ESI+10]
0167:004B56D7 83E001 AND EAX,01
0167:004B56DA A3E4114C00 MOV [004C11E4],EAX
0167:004B56DF E8ACD1FFFF CALL 004B2890
0167:004B56E4 8B5620 MOV EDX,[ESI+20] <crash
0167:004B56E7 52 PUSH EDX
0167:004B56E8 8B4E1C MOV ECX,[ESI+1C]
....

5) Now I thought that 4b56c8 must be the OEP; I used the "jmp eip",
switched to Procdump and dumped the process to disk.
6) I used Revirgin to get the IT.bin and pasted it into the dump.exe using
SV's tool, corrected the values for Entry Point and IT RVA and length.
7) But now when I start the dump.exe the program crashes at the marked
line (esi==0).

Well, my question is how can I find the OEP?
And am I on the right way, how i described it?
And one more stoopid question: What's the difference between IT and IAT?

I hope there's someone out, who feels like to help me and answer me
newbie questions...

regards
e.

Hi,
before you put a 'jmp eip' look at the register window and write down this with a pen and paper.
eax=003003
after you dump it.open up the dump file.
change the entry point to 0030003
above is just a example

2) iat and it
please guide me if I'm wrong
iat is the import jump table
IT is part of iat like idatas sections ....

regards
stillnewbie
emulder
03-23-2001, 11:33 AM
stillnewbie (03-23-2001 08:30):
before you put a 'jmp eip' look at the register window and write down this with a pen and paper.
eax=003003
after you dump it.open up the dump file.
change the entry point to 0030003
above is just a example

Hi robin, thx for your reply!
But unfortunately that doesn't get me any further...
I know that I have to insert the OEP into the dumped file, but I don't know how to
locate the right EP in an ASPRotected app...

2) iat and it
please guide me if I'm wrong
iat is the import jump table
IT is part of iat like idatas sections ....
regards
stillnewbie
Yes, I see :-)

regards
e.
bAZiK
03-24-2001, 04:57 AM
Hi, emulder (aka nitehawk *g*),

"5) Now I thought that 4b56c8 must be the OEP; I used the "jmp eip","

Do a JMP EIP before (!!) the OEP. Then switch to ProcDump. Click on "Options".
Under "Structure" select all, under "Imports", select "Rebuild new Import Table". Click OK and dump (full) the Process. After dumping, kill the Process and click on "PE Editor". Select your dumped.exe, correct the Entry Point and Click OK.
Try your dumped.exe . It should run now! ;-)

And, if not, why don't you use CASPR? *gg*

regards,
bAZiK [AmoK]
emulder
03-24-2001, 05:42 AM
Do a JMP EIP before (!!) the OEP. Then switch to ProcDump. Click on "Options".
Under "Structure" select all, under "Imports", select "Rebuild new Import Table". Click OK and dump (full) the Process. After dumping, kill the Process and click on "PE Editor". Select your dumped.exe, correct the Entry Point and Click OK.
Try your dumped.exe . It should run now!

Hey bazik :-)
Yes, thats exactly what I did! The problem is that this point is not the OEP!
BTW: When checking the "Rebuild new IT" Procdump crashes, the same with IceDump...but i think there's no need to check this at
all, 'cause Revirgin will do this job, not?

regards
stillnewbie
03-24-2001, 08:32 AM
emulder (03-24-2001 03:42):

Do a JMP EIP before (!!) the OEP. Then switch to ProcDump. Click on "Options".
Under "Structure" select all, under "Imports", select "Rebuild new Import Table". Click OK and dump (full) the Process. After dumping, kill the Process and click on "PE Editor". Select your dumped.exe, correct the Entry Point and Click OK.
Try your dumped.exe . It should run now!

Hey bazik :-)
Yes, thats exactly what I did! The problem is that this point is not the OEP!
BTW: When checking the "Rebuild new IT" Procdump crashes, the same with IceDump...but i think there's no need to check this at
all, 'cause Revirgin will do this job, not?

regards

Heya Edward,
whats the prog anyway?url...

can you write more no how you find the oep,
using Revergin ...
post more about your findings and more ppl
might help :)

stillnewbie
emulder
03-26-2001, 07:13 PM
Hi,
I finally unpacked the program successfully :) maybe my postings was
a bit to fast...

Anyways, Thanks for your kind reply! :)
regards
e


SoftIce and 16 bit code.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftIce and 16 bit code.
PDA

View Full Version : SoftIce and 16 bit code.

Bratsher
03-24-2001, 10:09 PM
Hello.

I am trying to reverse the protection of a 16 bit program written for windows 3.x.
I have had quite a bit of problems tracing it with SoftIce: Unpredictable behavior, The computer frequently lockup, A BPX on a place in the code I am 100% sure is going to be executed never breaks etc. etc etc.
My questions are:

Is softice as good as a debugger with 16 bit code?
Perhaps the program itself is messing softIce? I dug another old windows 3.1 program and tried to trace it with Sice and found less problems but still some.
Or there is a set up option I missed?
I searched the FM and found no specific mention of 16 bit code debugging settings.

Thanks in advance
Kayaker
03-24-2001, 10:41 PM
Hi Bratsher,

I've had that problem sometimes too with 16-bit. SI just refuses to break, even if you're within the same code segment. That of course is the other problem working with 16 bit, you need to specify the code segment selector to set a bp in another segment from the one you're in. You probably know this already, but you can use the HEAP command to get a listing of all the Segments as you see displayed in W32Dasm (01,02...) and the corresponding Selector (which changes each time the program is run) that has so far loaded into memory. If the current CS:EIP belongs to one of the heap entries, that entry displays with the bold video attribute. You may have to step into a few calls for Windows to load the other code segments of the program as they are needed, but by watching the command window you should eventually find the selector for the segment you are interested in creating a break in. Once that selector has been allocated for that segment, you can use it until the next time you run the program.

Beyond that I have no idea if there's a way to optimize SI for 16-bit. You could try SuperBPM from one of the toolz sites, it *might* help make the bp's stick.

Regards,
Kayaker
Bratscher
03-26-2001, 11:08 AM
Thank you Kayaker. You as usual came up with helpful suggestions.
The erratic behavoir I have been talking about happens even if the BPXs are set up within the same code segment.
BPX placed inside 16 bit windows functions, like the ones in USER.DLL, work dandy. only BPXs inside the program code seem to give trouble, and the trouble is computer freeze, not even blue screen of death.
I tried to stay away from *all* BPX and manually placed BPM instead into the program code, with very limited success. The computer does not freeze, but Sice does not break.
Any suggestions about a pure 16 bit debugger that is able to perform decently in a windows 32 bit environment?

TIA


Help Please with rtsoftware keygen protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help Please with rtsoftware keygen protection
PDA

View Full Version : Help Please with rtsoftware keygen protection

Bill Stickers
03-19-2001, 05:14 PM
I am a newbie and have followed with some success a few tuts.
However I am now stumped on trying to crack my first app. It is APrintDirect by bpsoftware.com, but it features a seemingly complicated keygen protection by rtsoftware.com.
Has anyone come across this b4 and maybe give me a pointer or two.

TIA

Bill
+SplAj
03-20-2001, 03:43 AM
hey I can help you }>
click on the 'go to:' bar below and select
'The Newbies Forum'
and finally press 'Go'

5p14j
Bill Stickers
03-20-2001, 09:01 AM
SpIAj
Your reply was most unwelcome, I was asking for help not sarcasm.
goatass
03-20-2001, 11:31 PM
Hey Bill, I'm sure +SplAj didn't mean to be a dick, he just wanted to point out that as you said you are a newbie and there is a newbies forum that newbie questions (such as this one) should be posted in, just trying to keep the posts in their correct forum.

As for your program, how far did you get in figuring out the protection ? can you post some code that you think might be generating or verifying the serial number or whatever so we could look at and try to help.

goatass
Bill Stickers
03-21-2001, 04:36 PM
Thanks for some courteousy goatass.
I haven't the time just now to put down the approaches that I made and where I got to but I will in the next coupla days.
Thanks again

Bill
quiller
03-24-2001, 08:12 PM
I took a look at the program APrintDir and it actually has pretty good protection considering it is kind of a simpleton program. I was able to crack it in about 20 mins by changing one byte (74->EB), but the user key/reg key seems to use TripleDES encryption. It uses a base key of 43HG4R and product key of APRINTDIR99 and from there on I got lost. I would love to have someone do a tut on the serial gen for this program, but for now it is over my capabilities. I believe it has both the encryption and decryption algorythms in the program so I have not given up yet, but it will be tough going.
splaj
03-25-2001, 05:01 AM
Bill times up , show us your work......... if you can :'(

Quiller, DONT give this NEWBIE ? (more like a crack request to me) any more clues until he posts some relevant dis.

SplAj
tsehp
03-25-2001, 06:38 AM
Bill Stickers (03-21-2001 14:36):
Thanks for some courteousy goatass.
I haven't the time just now to put down the approaches that I made and where I got to but I will in the next coupla days.
Thanks again

Bill

Ok bill let's start from beginning, and forget all the messages before...
As goatass said, you have first to do some personnal work and locate the code where you think the key is calculated, paste the code here and we'll see if we can help you.

regards,

+Tsehp
Bill Stickers
03-25-2001, 03:38 PM
Well ok fellas
I have managed to find a bit of time now to put down some of the things I had tried, others which I had scribbled on a piece of paper don't make a lot of sense now !

My first approach was in w32dsm to search for any recognisable strings such as "register", but there were none.
I then looked for "getwindowtexta" and found references to it but when I ran the app in debug this api appeared after the nagbox and register screen came up.

I traced through from the program entry point and found the following code which I thought might have been the test,

|
:00450C3F E8AC66FBFF Call 004072F0
:00450C44 85C0 test eax, eax
:00450C46 7475 je 00450CBD
:00450C48 B301 mov bl, 01
:00450C4A 837F0412 cmp dword ptr [edi+04], 00000012
:00450C4E 7466 je 00450CB6
:00450C50 C6042400 mov byte ptr [esp], 00
:00450C54 6683BEC200000000 cmp word ptr [esi+000000C2], 0000
:00450C5C 7410 je 00450C6E
:00450C5E 8BCC mov ecx, esp
:00450C60 8BD7 mov edx, edi
:00450C62 8B86C4000000 mov eax, dword ptr [esi+000000C4]
:00450C68 FF96C0000000 call dword ptr [esi+000000C0]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00450C5C(C)
|
:00450C6E 8BD7 mov edx, edi
:00450C70 8BC6 mov eax, esi
:00450C72 E819FFFFFF call 00450B90
:00450C77 84C0 test al, al
:00450C79 7542 jne 00450CBD
:00450C7B 803C2400 cmp byte ptr [esp], 00
:00450C7F 753C jne 00450CBD
:00450C81 8BD7 mov edx, edi
:00450C83 8BC6 mov eax, esi
:00450C85 E8FEFDFFFF call 00450A88
:00450C8A 84C0 test al, al
:00450C8C 752F jne 00450CBD
:00450C8E 8BD7 mov edx, edi
:00450C90 8BC6 mov eax, esi
:00450C92 E841FEFFFF call 00450AD8
:00450C97 84C0 test al, al
:00450C99 7522 jne 00450CBD
:00450C9B 8BD7 mov edx, edi
:00450C9D 8BC6 mov eax, esi
:00450C9F E8C0FDFFFF call 00450A64
:00450CA4 84C0 test al, al
:00450CA6 7515 jne 00450CBD
:00450CA8 57 push edi

I noted the offsets, and in hexworkshop, I changed the jumps but then the prog just crashed.

I then tried a few things with softice, but without much luck.

To give you an idea of the things I tried with softice. I set bpx to "getwindowtexta" and tried to trace the calls, but I got lost.
I then thought I was getting somewhere using hwnd aprintdir, and bmsg on wm_buttonup and button but it got so that I couldn't see the wood for the trees.

I am not trying to leech a crack as the verbose splAj might think, but I am beginning to wonder if I am getting too old for these challenges, and maybe just stick to Fortran and HPRMB (really showing my age).

If after this anyone feels inclined to help then I would be grateful, but as quiller pointed out it is a pretty tame program anyway and no huge loss. It would have been useful, but it was the challenge and I would really like to refine my approach.

TIA

Bill
quiller
03-25-2001, 10:22 PM
Bill,
It looks like you will need to read a few more tutorials because there are quite a few references in W32Dsm that you missed such as:

"This is an UNREGISTERED version."
"The evaluation period has expired."
"Thank you for registering!" (one of our favorites)
"Wrong registration key" (another favorite)
"The evaluation period expires"

If you double click on "Thank you for registering!" (in W32Dasm) it will take you to the following lines:
===================================================

:0048E884 E8AB46FFFF call 00482F34<- You might want to check
:0048E889 84C0 test al, al this function.
:0048E88B 743B je 0048E8C8 <-jmp if bad boy cracker
:0048E88D 8BC6 mov eax, esi <-Otherwise, welcome
:0048E88F E8E846FFFF call 00482F7C to the promised land
:0048E894 84C0 test al, al
:0048E896 7407 je 0048E89F
:0048E898 8BC6 mov eax, esi
:0048E89A E80547FFFF call 00482FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048E896(C)
|
:0048E89F 8BC6 mov eax, esi
:0048E8A1 E80A47FFFF call 00482FB0
:0048E8A6 84C0 test al, al
:0048E8A8 7407 je 0048E8B1
:0048E8AA 8BC6 mov eax, esi
:0048E8AC E82747FFFF call 00482FD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048E8A8(C)
|
:0048E8B1 6A00 push 00000000
:0048E8B3 668B0D14E94800 mov cx, word ptr [0048E914]
:0048E8BA B202 mov dl, 02

* Possible StringData Ref from Code Obj ->"Thank You for registering!"
|
:0048E8BC B820E94800 mov eax, 0048E920 <-You land here
:0048E8C1 E8BE9CFCFF call 00458584
:0048E8C6 EB1A jmp 0048E8E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048E88B(C)
|
:0048E8C8 6A00 push 00000000
:0048E8CA 668B0D14E94800 mov cx, word ptr [0048E914]
:0048E8D1 33D2 xor edx, edx

* Possible StringData Ref from Code Obj ->"Wrong registration key!"
|
:0048E8D3 B844E94800 mov eax, 0048E944

=======================================

This is an example of the classic scenerio.

Call Bad_Ass_Protection_Function
Return Result (Good or Bad)
Jmp if BAD

If you want to get a thrill, you can NOP (90) the je (at 0048E88B) or in SI do a "r fl z" and view the "Thank you ..." You will NOT really be registered though. This program is deceptive and I would not recommend to a newbie. However, this information should get you started and if you are persistent, who knows. Good luck.
SplAj
03-26-2001, 03:15 AM
Hey Bill,

Well done, nice try. As quiller says this is a tuffy. Look around and see that ONLY cracks are available NOT serials for this version. So if you make it you are one hell of a reverser...WELCOME to the RCE

Try to reverse the Winzip algo. This is a nice trainer and then move on to making keygens............... There are a few 'templates' available from r!sc and rudeboy.

Also DL the 'ripper-studio ' from TMG . This util helps you 'cut+paste' the algo from dis. to ASM >}

SplAj

PS Tsehp, thanks for moving this thread to it's rightful home.
Bill_S
03-27-2001, 07:08 AM
[quote]quiller (03-25-2001 20:22):
Bill,
It looks like you will need to read a few more tutorials because there are quite a few references in W32Dsm that you missed such as:

"This is an UNREGISTERED version."
"The evaluation period has expired."
"Thank you for registering!" (one of our favorites)
"Wrong registration key" (another favorite)
"The evaluation period expires"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Quiller,
Thanks for the lead .

But I would like you to know that I really aint that much of a dummy (at least I hope not). I think I would have picked up the references to
"This is an UNREGISTERED version.", etc if they had appeared with w32dsam, but they did not show up at all. In fact neither did the
* Possible StringData Ref - pointers as I show in the code below, taken from the same section you posted.

===================================================================

:0048E884 E8AB46FFFF call 00482F34
:0048E889 84C0 test al, al
:0048E88B 743B je 0048E8C8
:0048E88D 8BC6 mov eax, esi
:0048E88F E8E846FFFF call 00482F7C
:0048E894 84C0 test al, al
:0048E896 7407 je 0048E89F
:0048E898 8BC6 mov eax, esi
:0048E89A E80547FFFF call 00482FA4

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048E896(C)
|
:0048E89F 8BC6 mov eax, esi
:0048E8A1 E80A47FFFF call 00482FB0
:0048E8A6 84C0 test al, al
:0048E8A8 7407 je 0048E8B1
:0048E8AA 8BC6 mov eax, esi
:0048E8AC E82747FFFF call 00482FD8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048E8A8(C)
|
:0048E8B1 6A00 push 00000000
:0048E8B3 668B0D14E94800 mov cx, word ptr [0048E914]
:0048E8BA B202 mov dl, 02
:0048E8BC B820E94800 mov eax, 0048E920
:0048E8C1 E8BE9CFCFF call 00458584
:0048E8C6 EB1A jmp 0048E8E2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0048E88B(C)
|
:0048E8C8 6A00 push 00000000
:0048E8CA 668B0D14E94800 mov cx, word ptr [0048E914]
:0048E8D1 33D2 xor edx, edx
:0048E8D3 B844E94800 mov eax, 0048E944
====================================================================

W32Dasm gave only the following list of String Data

==================================================================
String Resource ID=42500: "The %s file does not exist"
String Resource ID=42501: "The %s directory does not exist"
String Resource ID=65519: "Invalid variant type conversion"
String Resource ID=65535: "Range check error"
" "
"%.*d0x@"
"("
"(y@"
"0"
"91)!"
"Error"
"H:H"
"l"
"Runtime error at 00000000"
"x"
"Y"
==================================================================
So am I missing something along the way ? becoz I dont got the same dissasembler output as you.

BTW I'm using W32Dasm v8.93

Thanks & Regards

Bill
Kayaker
03-27-2001, 03:52 PM
Hi Bill,

I checked out the lack of string refs in WDasm and found that too, but only when using the ORIGINAL version of WDasm 8.93. I normally use one that's patched to allow VB string refs to be seen. Apparently it has an effect with this Delphi app as well.

The VB patch is available at the tools sites, and I'm not sure exactly what it does, I've never bothered looking, but I compared my 2 versions and the difference is here:

Original WDasm:

:0041756A 8D8598F4FFFF lea eax, dword ptr [ebp+FFFFF498]

VB String ref patched WDasm:

:0041756A 8D8528F6FFFF lea eax, dword ptr [ebp+FFFFF628]

So try changing bytes 16B6C and 16B6D in a hex editor from
98F4
to
28F6

and see if this brings up the string refs. BTW, you'll probably want to try using the Delphi disassembler DeDe with this app as well.

Regards,
Kayaker
quiller
03-27-2001, 07:54 PM
Bill_S,
I was not implying that you were a dummy, only that you appeared inexperienced by missing some obvious things. I used W32Dasm v8.9 to disassemble the proggie (w/o the VB patch that Kayaker was talking about).

quiller


reversecourse.cjb.net ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > reversecourse.cjb.net ?
PDA

View Full Version : reversecourse.cjb.net ?

new_reverser
03-26-2001, 07:35 AM
whats up with this project ?
will it be updated in the (near) future or is it dead ???
please answer a newbie ...
amante4
03-27-2001, 08:04 PM
Yep, I'll continue to live.
Santmat has kindly taken the web site
over and will be adding a new level 6 soon.

regards,
amante


ROR EAX,4 help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ROR EAX,4 help
PDA

View Full Version : ROR EAX,4 help

Acid_Cool_178
03-27-2001, 05:42 AM
I'm trying to understand this code

MOV EAX,12345678h
ROR EAX,4

and what will the value of EAX be now ??

Acid_Cool_178
Scooby
03-27-2001, 06:31 AM
ROR (Rotate Right) by 4 (Bits)

12345678 -> 01234567

Acid_Cool_178 (03-27-2001 03:42):
I'm trying to understand this code

MOV EAX,12345678h
ROR EAX,4

and what will the value of EAX be now ??

Acid_Cool_178
SV
03-27-2001, 06:36 AM
ROR - Rotate Right
Usage: ROR dest,count
Modifies flags: CF OF
.---------------. .-.
.->|7 ----------> 0|--.->|C|
| '---------------' | '-'
'---------------------'
Rotates the bits in the destination to the right "count" times with
all data pushed out the right side re-entering on the left. The
Carry Flag will contain the value of the last bit rotated out.

Clocks Size
Operands 808x 286 386 486 Bytes
reg,1 2 2 3 3 2
mem,1 15+EA 7 7 4 2-4 (W88=23+EA)
reg,CL 8+4n 5+n 3 3 2

mem,CL 20+EA+4n 8+n 7 4 2-4 (W88=28+EA+4n)
reg,immed8 - 5+n 3 2 3
mem,immed8 - 8+n 7 4 3-5

D0 /1 ROR r/m8,1 Rotate 8 bits r/m8 right once
D2 /1 ROR r/m8,CL Rotate 8 bits r/m8 right CL times

C0 /1 ib ROR r/m8,imm8 Rotate 8 bits r/m16 right imm8 times
D1 /1 ROR r/m16,1 Rotate 16 bits r/m16 right once
D3 /1 ROR r/m16,CL Rotate 16 bits r/m16 right CL times
C1 /1 ib ROR r/m16,imm8 Rotate 16 bits r/m16 right imm8 times
D1 /1 ROR r/m32,1 Rotate 32 bits r/m32 right once

D3 /1 ROR r/m32,CL Rotate 32 bits r/m32 right CL times
C1 /1 ib ROR r/m32,imm8 Rotate 32 bits r/m32 right imm8 times

eax : 12345678 and after ror eax,4 eax : 81234567

Regards


VB Source for Crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB Source for Crack
PDA

View Full Version : VB Source for Crack

Critter
03-27-2001, 09:12 AM
Could someone point me in the direction to locate a source code for writing a patch in VB?

Thanks
Crit
emulder
03-27-2001, 05:43 PM
Hi,
open the target with the "open"-command(open "test.exe" for binary as #1), write the new bytes with the "put"-command and close the file with "close #1". For reading bytes from a file use the "get"-command.
Check VB command reference for details... :)
hope this helps
cu
Critter
04-02-2001, 07:53 AM
cheers, I'll give it a shot.


Whic Breakpoint?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Whic Breakpoint?
PDA

View Full Version : Whic Breakpoint?

distr0n
03-28-2001, 12:09 AM
This may seem an overly elementary question, but hey, I figure why not ask. I have been doing a lot of tutorials and crackmes (Immortal Descendants are good) and I understand how to crack each one of these. However, why use the breakpoints that they did? How do you figure out whether you want to use bpx on hmemcpy, MessageBoxExA, GetDlgItemTextA, etc, etc. How do you make the choice of which one to use? Thanks,

P.S. -> Is there an alternative to using hmemcpy because they took it out of kernel32.dll for Win ME and I can't use it or memcpy.. any ideas? (I know.. wrong board but I figured I would ask while i was thinking about it)
qferret
03-28-2001, 12:31 PM
This gets asked every few weeks or so, maybe we should post an faq here somewhere (yes, I may be volunteering if I find the time)

Anyway, as for your question...

Much of it is experience and the ability to read an API guide ;-)

Most programmers use functions provided by the compilers so they don't have to reinvent the wheel every time they write a program... this is good for us ;-)

What this means is that there is a limited number of API's they use for each function. API's such as GetDlgItemTextA or GetWindowTextA will get text from an edit box. MessageBoxA or ShowWindow will pop up a MessageBox. etc.,etc.

The A at the end of some API's means that they are for 32 bit code. For 16 bit apps, drop the A. i.e. GetWindowTextA is 32 bit while GetWindowText is 16 bit.

As for the tutorials, the author probably set breakpoints on 2 or 3 API's, but didn't feel the need to tell you which ones didn't work.
qferret
03-28-2001, 12:33 PM
This gets asked every few weeks or so, maybe we should post an faq here somewhere (yes, I may be volunteering if I find the time)

Anyway, as for your question...

Much of it is experience and the ability to read an API guide ;-)

Most programmers use functions provided by the compilers so they don't have to reinvent the wheel every time they write a program... this is good for us ;-)

What this means is that there is a limited number of API's they use for each function. API's such as GetDlgItemTextA or GetWindowTextA will get text from an edit box. MessageBoxA or ShowWindow will pop up a MessageBox. etc.,etc.

The A at the end of some API's means that they are for 32 bit code. For 16 bit apps, drop the A. i.e. GetWindowTextA is 32 bit while GetWindowText is 16 bit.

As for the tutorials, the author probably set breakpoints on 2 or 3 API's, but didn't feel the need to tell you which ones didn't work.
Bratscher
03-28-2001, 12:38 PM
distr0n (03-27-2001 22:09):
This may seem an overly elementary question, but hey, I figure why not ask. I have been doing a lot of tutorials and crackmes (Immortal Descendants are good) and I understand how to crack each one of these. However, why use the breakpoints that they did? How do you figure out whether you want to use bpx on hmemcpy, MessageBoxExA, GetDlgItemTextA, etc, etc. How do you make the choice of which one to use? Thanks,

It is, for the most part, trial and error.
You may guide your choice by disassembling the program and looking at the imported function list, if it is small enough to be practical. For instance if the program does not list GetDlgItemTextA as an import, it is unlikely that a BPX on this function will be useful.
hmemcpy is sort of an 'universal' breakpoint, which is in turn invoked by most of the other
functions that capture input from the user.

P.S. -> Is there an alternative to using hmemcpy because they took it out of kernel32.dll for Win ME and I can't use it or memcpy. any ideas? (I know. wrong board but I figured I would ask while I was thinking about it)

I have not seen working alternatives, and I have been chastised for talking about it.
A possible solution would be to do your cracking in a Win98 machine in which hmemcpy does work.
qferret
03-28-2001, 12:38 PM
damn back button ;-)
distr0n
03-30-2001, 01:26 PM
Thanks, that helped! So I can tell which breakpoint to use by looking at 1) whether Im trying to find the contents of a textbox info or how a message box pops up? or 2) By looking at the program's imports through windasm or IDA?

Thanks!


Using Softice - display command
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Using Softice - display command
PDA

View Full Version : Using Softice - display command

Ralder
03-28-2001, 01:10 PM
Hello,

After reading and studying all the fantastic tutorials on reversing and cracking for many months now, I thought I would try to get hands-on experience with solving a few CrackMe's first, and learn how to use the tools before I apply the knowledge and techniques I've learned. I've amassed quite a good collection of tuts, and just this week I finally installed the tools, and I'm ready to apply the knowledge and develop the skills.

I d/l'd several CrackMe's, and have started practicing. I thought I'd jump straight into the solutions first and follow the solutions to the letter, just to learn how to become proficient with the tools and commands. Unfortunately, I'm having mixed success, despite following the solutions and following the lead. The problem is trying to get Sice to display certain registers. I've run the CrackMe and Sice and the solution countless times trying to figure the error. I know I'm totally overlooking the obvious, but just can't figure it out despite all my efforts.

Here's the situation, briefly:

CrackMe_1 has a solution which bpx-ed on hmemcpy. I followed, and Sice popped as it should, and I followed the author as he traced through the code. The author then bpx-ed on a particular CALL function, and then performed a display on 'edx' which contained the correct serial. 'eax' on the other hand, should contain the wrong serial, entered by me at the start of the CrackMe_1.

Here's the simple code: (borrowed from w32dasm), my notes arrowed:

------------------------Code Start------------------------
:0042D556 8D55F8 lea edx, dword ptr [ebp-08]
:0042D559 8B86E0010000 mov eax, dword ptr [esi+000001E0]
:0042D55F E8FCC8FEFF call 00419E60
:0042D564 8B45F8 mov eax, dword ptr [ebp-08] <-- wrong serial
:0042D567 8B55FC mov edx, dword ptr [ebp-04] <-- correct serial
:0042D56A E86163FDFF call 004038D0 <-- compare eax, edx,
:0042D56F 750C jne 0042D57D

* Possible StringData Ref from Code Obj ->"Congratz cracker! hehehe"
|
:0042D571 B8ECD54200 mov eax, 0042D5EC
:0042D576 E87DFBFFFF call 0042D0F8
:0042D57B EB0A jmp 0042D587

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D56F(C)
|
* Possible StringData Ref from Code Obj ->"No no no! :( Try again!"

---------end--------------------

Here's my question: when I try to display 'edx' as the author did, I just don't see the serial in the data window; however, I wanted to take a look at the contents of 'eax' and was able to display 'eax', which is the incorrect data I entered into the CrackMe. I can't understand why I'm unable to get 'edx' to display as the author is able to do? I'm entering the same command for both: "d edx" and "d eax".

Similarly, the second solution to this same CrackMe1 was written by a different author. He also bpx-ed on hmemcpy. I traced along with him, to the same CALL above.
The author writes:

" Indeed... eax after 0042D564 is my serial of 1234567 and edx after 0042D567 is the correct serial...". I completely understand, but I just can't get 'edx' to display here either.

This author actually took the solution even further, and then offered yet another angle to solving the CrackMe, and displayed the address of edx [ebp-04]. In his words, he stated:

" [ebp-04] contains the address that stores the correct serial. To find what is [ebp-04], type "d (ebp-04)" and in the data window. you will see D0 1D B9 00 ........" ,
and then he did a conversion routine, but the point being is that he was able to display 'edx'. I couldn't get it to display either. I believe I'm using the display command correctly, but can't get 'edx' to show the contents.

I hate getting stuck on such a trivial issue. I know it's difficult trying to troubleshoot something like this without having the CrackMe in progress, but if anyone can see what the problem could be and can help with this slight snag I'm having, I'd be very grateful.

Thanks for any input and advice.

~Ralder
Bratscher
03-28-2001, 02:55 PM
Ralder (03-28-2001 11:10):
Hello,

After reading and studying all the fantastic tutorials on reversing and cracking for many months now, I thought I would try to get hands-on experience with solving a few CrackMe's first, and learn how to use the tools before I apply the knowledge and techniques I've learned. I've amassed quite a good collection of tuts, and just this week I finally installed the tools, and I'm ready to apply the knowledge and develop the skills.

I d/l'd several CrackMe's, and have started practicing. I thought I'd jump straight into the solutions first and follow the solutions to the letter, just to learn how to become proficient with the tools and commands. Unfortunately, I'm having mixed success, despite following the solutions and following the lead. The problem is trying to get Sice to display certain registers. I've run the CrackMe and Sice and the solution countless times trying to figure the error. I know I'm totally overlooking the obvious, but just can't figure it out despite all my efforts.

Here's the situation, briefly:

CrackMe_1 has a solution which bpx-ed on hmemcpy. I followed, and Sice popped as it should, and I followed the author as he traced through the code. The author then bpx-ed on a particular CALL function, and then performed a display on 'edx' which contained the correct serial. 'eax' on the other hand, should contain the wrong serial, entered by me at the start of the CrackMe_1.

Here's the simple code: (borrowed from w32dasm), my notes arrowed:

------------------------Code Start------------------------
:0042D556 8D55F8 lea edx, dword ptr [ebp-08]
:0042D559 8B86E0010000 mov eax, dword ptr [esi+000001E0]
:0042D55F E8FCC8FEFF call 00419E60
:0042D564 8B45F8 mov eax, dword ptr [ebp-08] <-- wrong serial
:0042D567 8B55FC mov edx, dword ptr [ebp-04] <-- correct serial
:0042D56A E86163FDFF call 004038D0 <-- compare eax, edx,
:0042D56F 750C jne 0042D57D

* Possible StringData Ref from Code Obj ->"Congratz cracker! hehehe"
|
:0042D571 B8ECD54200 mov eax, 0042D5EC
:0042D576 E87DFBFFFF call 0042D0F8
:0042D57B EB0A jmp 0042D587

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042D56F(C)
|
* Possible StringData Ref from Code Obj ->"No no no! :( Try again!"

---------end--------------------

Here's my question: when I try to display 'edx' as the author did, I just don't see the serial in the data window; however, I wanted to take a look at the contents of 'eax' and was able to display 'eax', which is the incorrect data I entered into the CrackMe. I can't understand why I'm unable to get 'edx' to display as the author is able to do? I'm entering the same command for both: "d edx" and "d eax".

To examine the contents of eax and edx simply look at them in the register window (or activate the registers window by typing 'wr' in softice).
The command 'd eax' shows, in the data window, the contents of the ADDRESS pointed by DS:EAX, not the actual number contained in EAX.
Same with 'd edx'

Similarly, the second solution to this same CrackMe1 was written by a different author. He also bpx-ed on hmemcpy. I traced along with him, to the same CALL above.
The author writes:

" Indeed... eax after 0042D564 is my serial of 1234567 and edx after 0042D567 is the correct serial...". I completely understand, but I just can't get 'edx' to display here either.

This author actually took the solution even further, and then offered yet another angle to solving the CrackMe, and displayed the address of edx [ebp-04]. In his words, he stated:

" [ebp-04] contains the address that stores the correct serial. To find what is [ebp-04], type "d (ebp-04)" and in the data window. you will see D0 1D B9 00 ........" ,
and then he did a conversion routine, but the point being is that he was able to display 'edx'. I couldn't get it to display either. I believe I'm using the display command correctly, but can't get 'edx' to show the contents.

I think the author of the tut assumes you have opened the data window (type 'wd' in Sice).

I hate getting stuck on such a trivial issue. I know it's difficult trying to troubleshoot something like this without having the CrackMe in progress, but if anyone can see what the problem could be and can help with this slight snag I'm having, I'd be very grateful.

Thanks for any input and advice.

Also keep in mind that the data in memory is organized in the 'Little endian format' ie: the least significant byte is in the lowest memory position, to the left, and the most significant byte is in the highest memory position, to the right. This is also known as reverse notation.
a for instance:
after the instruction
:0042D564 8B45F8 mov eax, dword ptr [ebp-08]

eax will contain '12345678'
but if you examine the contents of ebp-08 with the instruction 'd (ebp-08 )'
you will see in the data window

1256:90456789 78 56 34 12 ........"
Some address actual data

this notation is somewhat counterintuitive and may be confusing. you may be looking at the correct number but you would not recognize it

Hope I understood your question and helped you.
Ralder
03-28-2001, 10:44 PM
Hi Bratscher,

Thanks for replying. Oh yes, that was the problem. It was a complete oversight on my part. I'm really embarrassed now, haa. I'm still learning the interface of Sice, which seems a bit complex and a little daunting at first go. I'm sure it'll take a bit of practice for me, but I'm ready.

Hey, thanks *very* much! I also keep good notes, and I really appreciate your information about the way in which data is organized. I will certainly study that in more detail.

Your help is appreciated, and my sincere thanks again for clearing things up for me.

Onward,

Ralder


Still BIG SICE Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Still BIG SICE Problem
PDA

View Full Version : Still BIG SICE Problem

SORD
03-28-2001, 01:54 PM
My config.sys already has nothing in it. So I can't fix it that way. It still restarts after finding a page fault on boot. My INIT string is
INIT="wl;code on; lines 50; wc 36; wd 4; wr; faults off;X;"
PLEASE HELP! To see what other people have said before go to http://www.woodmann.net/Ultraboard/Public/HTML/B8/1094-1.topic.html
Maggot
03-29-2001, 08:50 PM
Try to disable the ACPI in Bios..
I had that problem at first. But i didnt get a page fault,
but the system restarted all the time.
Scally6
03-30-2001, 04:02 PM
Longshot but I had similar prob on my last PC & couldn't solve it with logic, so moved to poke n' hope. I had an ATI video card & an ATI cable/TV tuner which was at the root of the problem. I could have sice or the tuner but not both.
Never figured out why 'cos the tuner was bundled with the PC & I didn't really want it.
If it aint that, try to disable everything that starts up thru 'run's in registry or via boots in win.ini/system.ini. & see if it'll go on a clean boot.
Scally


msn messenger ad
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > msn messenger ad
PDA

View Full Version : msn messenger ad

zouzouni
03-28-2001, 05:19 PM
I would like to know if there is a way (it should be ) to get rid of the advert in the msn messenger .I try to find the size of the advert in hex search in wdasm and finnaly change it in a smaller value ,but it didn't work .Any help or ideas ?
Mr_T
03-29-2001, 01:20 PM
Hi mate

I tried the same thing with the same method a little while ago and got the same result :(

Good Luck.
zouzouni
04-02-2001, 02:10 PM
I found a way but it still leaves an emty space (without the add)

--------------------------------------------------------------
OFFSET - Original File Bytes Patched File Bytes
--------------------------------------------------------------
00029EF8 - 75 2B 8D 45 D0 C7 45 E0 --- 74 2B 8D 45 D0 C7 45 E0


Help with protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with protection
PDA

View Full Version : Help with protection

Timmy
03-29-2001, 05:37 PM
Does anyone know if Codedesigner+ from h*tp://csmicrosystems.com has any anti softice protection built in. It screws my comp up when sice is loaded and freezes totally when frogsice is loaded. I have been having bother with my comp and would be gratefull if someone could tell me if its my comp or if its the program.

Thanks in advance.
Timmy
03-29-2001, 08:07 PM
I must be on a mission - BitArts springs to mind. Don't ask.

Are there any tuts for BitArts chaps ? - Its ages since I've done any reversing so I'm a bit behind the times.


Reversing Regmon Tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reversing Regmon Tutorial
PDA

View Full Version : Reversing Regmon Tutorial

Kayaker
03-29-2001, 05:40 PM
Hi All,

I've submitted a new tut that gives an example of using a dll to add functionality to a program. I'm hoping that it also reminds us that the true spirit of Reverse Code Engineering is not limited to the apparent goal of always defeating protection schemes. Reversing for non-nefarious purposes? What a concept :o ^_^

Thas' all.

Kayaker

Jazzing up Regmon - Adding a DLL to reopen logs with Drag and Drop support

http://www.woodmann.net/fravia/kayaker_RegmonPlus.htm
qferret
03-29-2001, 05:58 PM
Mind if I post it along w/ your Filemon essay at my site?
Kayaker
03-29-2001, 09:56 PM
qferret (03-29-2001 15:58):
Mind if I post it along w/ your Filemon essay at my site?

I'd be honored of course :)
Scally6
03-30-2001, 03:52 PM
Greets Kayaker,
Most impressed with the tut. Keep up the good work. Wish I could keep up with you!
Best
Scally


MenuItem question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MenuItem question
PDA

View Full Version : MenuItem question

newbie
03-30-2001, 10:50 AM
hi all
I want to change the state of some menuitems in a program which has no EnableMenuItemA or any likewise Apis in the importtable... :(
Now i don't know what to do, do i have to do it in runtime (i don't know how, maybe simple a flag in memory to check if its enabled/disabled ?),
or patch the importtable or write a dll to import the api ?

please give me a hint or a url where this prob was discussed in an essay or so....
(i didn't found anything in lord soths essays
about this... )

greetings to all newbies and people who help them raising to a new level...
bye
newbie
04-01-2001, 11:14 AM
Hi
Please delete this topic cause it was a dumb question , now i have everything i need...
a little research and there it was ;-)
so delete it and forget it
bye


hmemcpy in Windows2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hmemcpy in Windows2000
PDA

View Full Version : hmemcpy in Windows2000

Real Novice
03-30-2001, 06:48 PM
Hi!!!

Break point hmemcpy is not available in windows 2000.
Is there any same break point in windows 2000 version Softice?

Thanks!!!
Solomon
03-31-2001, 01:59 AM
No such universal breakpoint in Win2K.
Some one recommends memcpy( ), but this is not so frequently used as hmemcpy in Win9x.
Just try other BPs.


Crack For Hip-hop eJay
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crack For Hip-hop eJay
PDA

View Full Version : Crack For Hip-hop eJay

Mike
03-30-2001, 09:32 PM
Anyone know where I can get a crack for Hip-hop eJay? The one from cracks.am doesn't work. I was just wondering if anyone had a crack that works. Thanks.
Kayaker
03-31-2001, 12:34 AM
Let's see, you must have read this at least twice before posting. As the banners plainly state:

Don't insult our intelligence by asking for Cracks or Serials!

Use this forum to ask questions relating to RCE matters.

Any more questions?
qferret
04-01-2001, 07:13 PM
I have one, but with your reading ability, you wouldn't understand how to apply it ;P


ASM help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASM help
PDA

View Full Version : ASM help

stealthFIGHTER
03-31-2001, 05:32 PM
Hi, I have problems with this piece of code:
-----------------------------------------
:
:
MOV ECX, 3 ; EAX=E
CDQ ; ECX=3
IDIV ECX ; EDX=0
IMUL ... ; EAX=4, EDX=2
:
:
-----------------------------------------
I don't know what does the 2nd function (CDQ) do.

Regards

sF
Bratsher
03-31-2001, 10:41 PM
stealthFIGHTER (03-31-2001 15:32):
Hi, I have problems with this piece of code:
-----------------------------------------
:
:
MOV ECX, 3 ; EAX=E
CDQ ; ECX=3
IDIV ECX ; EDX=0
IMUL ... ; EAX=4, EDX=2
:
:
-----------------------------------------
I don't know what does the 2nd function (CDQ) do.

Regards

sF

CDQ Convert doubleword (in EAX) to quadword (contained in EDX:EAX) always acts on the EDX:EAX registers, so it does not take an operand. The Quad mantains the sign of the integer contained in EAX.
Fpc
03-31-2001, 11:29 PM
About CDQ:
If EAX>0x7FFFFFFF, then EDX=0XFFFFFFFF;
If EAX<=0X7FFFFFFF,then EDX=0X0.
That's all.


propellerhead reason
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > propellerhead reason
PDA

View Full Version : propellerhead reason

state
03-31-2001, 10:07 PM
hey, guys
im new into the subject, and there is this new piece of software i wanna crack by myself:it is a new multi-module synthesis/seguencing/effects workstation from Propellerhead (the same guys that made the analog synth simulator Rebirth.)
obviously the soft to crack is a demo, which has the save and exports commands disable and worst of all the program quits every 20 minutes.
Any idea how could i make this happend?
Is it posible for a newbie to do it at all?
and what programs do i need to crack it?
i hope you guys clear me out and thank you in advance for your support.
Aquatron
04-01-2001, 11:46 AM
I agree that this program needs to be cracked, and I would love to start on it myself, being a total newbie.

However, it seems to me that the problem has two branches, one of which you have identified and the other which may or may not be eaiser to beat.

The full version of the .exe asks for the factory soundbank which is a 500 meg file that prevents many folks from downloading this app.

No cracking group has bothered to remove this requirement because they all assume that everyone has a fast connection like they do, and that the soundbank is easy to download.

This soundbank is very effective in limiting the spread of unlicenced Reason.

so....

1. Save disable/Time limit crack ( I have seen a time limit crack but not Save disable)

2. Soundbank requirement crack for full .exe

Hoping for some knowledgeable replies.

What tools would be required for this??

Softice?

Ok what do we look for?

This IS the place to ask surely!

Aquatron
qferret
04-01-2001, 06:57 PM
yep, this is the place to ask.....after you try a bit yourself....

20 minute time limit.....should be easy

Things to try

1. 20 min x 60 seconds = 1200 seconds = 4B0h ......search disassembly for a compare to this

2. BPX on one of the API's that has to do with time

Save Disabled...could be tougher

is the code even there to save? or has it been completely omitted? (check the newbies mini project forum....had covered this a while back)

now for what you don't want to hear.....we aren't going to crack it for you, but we will most assuredly help where we can when you get stuck. BUT do some work yourself first, then you can tell us where you're stuck & we can point you in the right direction. I can name 25 or so search engines off the top of my head. How many of them do you suppose would turn up results on a search for "cracking + tutorial + time + limit" or "cracking + tutorial + save + disabled"?
Don't know yet do you? ;-)

OK, I'm gonna climb down from my soap box now ;-)
Aquatron
04-02-2001, 07:40 AM
hello

I expect that there is no code for save fuinction at all and , for my part, I am only interested in the removal of the soundbank requirement in the install .exe

Someone already did a time limit crack and it was pretty irrelevant since the main prog shipped and appeared in the newsgroups etc a week or two later.

I will get a copy of softice then. See you in a while!

Aquatron
landmass
04-08-2001, 05:15 PM
If it should be cracked we should ignore the demo for a while and concentrate on the Full versions protection:

1: You need a 500 meg soundbank.
2. Sometimes it asks you to insert the soundbank CD. It doesn't happens everytime. This one also needs to be cracked.

Then we maybe could use one of the patchers to compare the demo with the cracked full version and then make the crack? Or else we need a install shield disasembler or similar.

This is just my opinion, and maybe it sucks. I'm a newbie just as you guys, so don't be to harsh =)
bytesss
04-09-2001, 03:04 PM
State, the 20 minute shutdown is pretty easy, take a look at 00544d44 (00144D44 hex) and you'll see a conditional jump that'll trigger the shutdown ( a little EB may help here huh), as for the save function, i was working on the demo until i found the full version, kinda gave up on it now, i found in the demo alot of code that was noped out, i confirmed this after i compared it with the full version exe, so i doubt if that function can be restored, anything's posible though, I've tried some crazy things like,using the Demo Sound bank and renaming it then loading it on a Virtual Cd and installing the program. the program installed fine but failed when reading the sound bank (of cousre) but i had to try, i think the Demo Sound Bank would work though, the demo doesn't seem to have any mixing limitations, when you install Reason if you choose to install the sound bank on the hard-drive then it doesn't do the CD check, so i'm thinking if you use the full version exe and hack it, you may be able to get a fully functional version of Reason, BTW, the full version exe is 173kb larger than the demo exe.


SoftICE Symbol Loader Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftICE Symbol Loader Problem
PDA

View Full Version : SoftICE Symbol Loader Problem

Lou Cypher
04-01-2001, 09:31 AM
Hi, I am new to this reverse Engineering thing. I am using SoftICE ver 4.05 in Windows 98 and I am having lots of problems with the SoftICE Symbol Loader. Every time I open a program from the Symbol Loader and try to load it from the Symbol Loader I get the error message "An error occurred during symbol translation/load. Load executable anyway?" and it gives me a YES and a NO button. If I press yes the debugger runs but when I exit to see what is in the Symbol Loader I get a "Error: No debug information found". At first I thought that the problem must be with the program I am loading but I found out that it gives the same error with all programs including the calc.exe file in the Windows directory. The only modifications I have made to SoftICE is changing the INIT line in the winice.dat file to INIT="wl;code on; altscr off; lines 57; wc 32; wd 8; wr; faults off; x;". Can some one please help me out!
SplAj
04-01-2001, 09:45 AM
Welcome to RCE

This is a regular error. Don't worry. Just carry on and debug. You are debugging a 3rd party soft with no debug symbols ie no source to play with !!!!

There used to be a patch many years ago for this annoyance on ver 3.xx, can't remember who made it, but it was around 1998 ;)

I guess we all get used to it - it's sign that SI is OK (for me). You could actually patch it yourself. do a 'BPX MessageBoxa' and trace back after SI pops ;)

SplAj
Lou Cypher
04-01-2001, 10:26 AM
Thanks SplAj that was a very fast response I am amazed. I don't think that even Microsoft with all its money and power ever gave me an answer as fast as you did. I posted my question in several newsgroups hoping to get an answer soon but I have learned my lesson. The only place I need to go when I have a problem with reverse engineering is here.

Thanks again,

Lou Cypher
Raven58
04-01-2001, 10:50 AM
Splaj, I have a similar problem except when I get the error message and press "yes", sice breaks but then locks up on me and I have to reboot. Is something missing or should something be unchecked or added to the winice dat file?
Thanks, Raven58
Kayaker
04-01-2001, 03:58 PM
Raven58 (04-01-2001 08:50):
Splaj, I have a similar problem except when I get the error message and press "yes", sice breaks but then locks up on me and I have to reboot. Is something missing or should something be unchecked or added to the winice dat file?
Thanks, Raven58

Do you have "faults off" in winice.dat set? It might be a response to that. What exactly happens? Does SI break at WinMain, the start of your program? Can you F8 single step at all or is it totally locked up? Does this only happen when you use the Loader or also when you just press Ctrl-D? Bummer if you can't use SoftIce :(
Raven58
04-02-2001, 08:16 AM
Hi Kayaker, Faults are off in my winice dat file. What happened was that I was following a manual unpacking tut. When I packed a exe with upx, I went to loader 32 & the exe opened sucessfully but would not load. I then changed the characteristics in upxo using procdump. Went back to loader, opened exe successfully, went to load, were I then received the error message and proceeded any way. Sice broke were I wanted to be (according to the tut) but locked up requiring a reboot. After my post, I noticed it locked up on everything I tried to use sice on. In desperation, I removed sice and reloaded it. It seems to work fine now, but then I haven't tried using the loader again on the exe mentioned above. BTW, looks like our mini project is dead. Downloaded apspy and following your thread. If you don't mind I have some ?'s on this. Still learning. I appreciate all your help.
Raven
SplAj
04-02-2001, 10:32 AM
It's time for me to go home now and stop watching you 'reversers' asking Q's..... however I did a little search
and read the original Fravia stuff again from ~1997, when we used to have to PATCH SI 3.01 and Wdasm demo etc etc
I wanted to find the original info on patching the loader error message , I thought it could be +mammon ? but anyway
I found the following site for a laugh :-

http://members.nbci.com/Carpie99/lamerlogs/morons.html

see <ALpha66> Q re SI loader :-p

Thank G I never made it here :-)

CYA tomorrow

SplAj }>


Windows 2K S Pack 1 HELP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Windows 2K S Pack 1 HELP
PDA

View Full Version : Windows 2K S Pack 1 HELP

DarkSky
04-01-2001, 10:22 AM
hey i cannot run softice in windows 2k srevice pack 1 because it doesnt pop-up. I've been told that using Windows Service Pack 1 Newtwork version solves this. Where do i find it?
SplAj
04-02-2001, 06:30 AM
yo DarkSky,

I suggest you take those ultra-cool blackout shades off and take a look at http://www.microsoft.com they have a nice section on Windows 2000, with lots of goodies to DL including
the 'monster' ~80meg SP1 :D

SplAj

hey guys was I gentle enough ???? I did think of 300 sarccy replies, but hey April 1st was yesterday so maybe I fell for it ???


Probs With Win2k And Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Probs With Win2k And Softice
PDA

View Full Version : Probs With Win2k And Softice

DarkSky
04-01-2001, 11:44 AM
Hey i have a nvidia graphics card and win2kand when i turn on softice nothing shows up. I know it is on because it freezes when i press ctrl+d and i can unfreeze it when i unpress it. I did not have this prob with win98. Please help me, i have tried a lot of things
buj
04-02-2001, 03:30 AM
ctrl+alt+c to center window
ctrl+alt+arrow keys to move the window around ..sometimes it starts up somewhere outside the monitor...usually below it so ctrl+alt+up might give you something

..all this after you hit ctrl+d of course
rocko
04-03-2001, 04:18 PM
i had the same prob with w2k sp1 and TNT2.
after installing the softice version from Driver Studio 2 it finally works now.

i think in an earlier thread ArthaXerXes solved his problems by using nvidia driver version 5...if i remember correctly.
DGR
04-05-2001, 04:11 AM
Yup, this is a well-known problem...

I've had it myself for quite a while aswell (using a geforce2 mx, windows2000sp1, sice and detonator drivers) and finally it all works with the latest version of softice. Indeed the driverstudio2 pack seems to fix it for atleast some ppl, together with the later detonator drivers. For me it already worked with the 7,52 ones but the 11.01 seem to work fine also.

So try to get and install Driverstudio 2.0 with the latest detonators and yer chances will improve a lot.

Take care


Sentinel CPlus Dongle - I'm half way there.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel CPlus Dongle - I'm half way there.
PDA

View Full Version : Sentinel CPlus Dongle - I'm half way there.

Spiv
04-02-2001, 12:18 AM
Without the dongle, this application functions in a Demo mode. I quickly discovered the place where it calls SC16W.DLL, which reads the dongle data. Moving into AX the proper bytes after the call enabled me to print data (This seemed to change the way menus in the program appear). When I try to open a file or save a file, I can't. The application only checks for the dongle when the program is initialized, so my guess is that if the proper dongle is found, it writes something to memory which it checks later on when you want to open a file. Any help regarding writing and reading from memory, or any other suggestions would be appreciated.
Once I can beat this dongle on the applicatioin side, I hope to learn how to re-write the dll that calls the dongle, but I need to learn a little more assembler. Playing with a 32 bit version of a cracked calling dll and inserting the data from my dongle and renaming the procedures didn't work.
meRlin
04-03-2001, 10:38 AM
Does this target has an URL??

meRlin
Spiv
04-03-2001, 08:57 PM
Unfortunately the target is not available from a URL. It is a specialized CAD program.
NOBODY
04-03-2001, 09:53 PM
Spiv (04-01-2001 22:18):
Without the dongle, this application functions in a Demo mode. I quickly discovered the place where it calls SC16W.DLL, which reads the dongle data.

What functions are exported from SC16W.DLL?
If the number is small enough try to identify the one that provides the bytes for EAX.

Moving into AX the

(How do you know the proper bytes?, can you trace where they came from?)

proper bytes after the call enabled me to print data (This seemed to change the way menus in the program appear). When I try to open a file or save a file, I can't.

The application only checks for the dongle when the program is initialized

(Are you sure, did you BPIO -h 278 R,BPIO -h 378 R )

so my guess is that if the proper dongle is found, it writes something to memory which it checks later on when you want to open a file. Any help regarding writing and reading from memory, or any other suggestions would be appreciated.

IF your hypothesis is correct the flag that says "dongle present" should be in a global variable in the main .exe program or in a static variable within the SC16W.DLL. Both global and static variables are read like this:

mov EAX,[00456328]

of course EAX and the address are illustrations, but constructions like this, containing the characters ,[ are usual in accessing global variables. Of course the flag may be addressed indirectly, which would create code which is more difficult to spot, like

mov EAX, dword ptr [EBP-14]

but it is worth trying.

Once I can beat this dongle on the applicatioin side, I hope to learn how to re-write the dll that calls the dongle, but I need to learn a little more assembler. Playing with a 32 bit version of a cracked calling dll and inserting the data from my dongle and renaming the procedures didn't work.[/quote]
Spiv
04-09-2001, 07:39 PM
First let me thank you NOBODY for your input.

SC16W exports the functions SCREAD and SCINIT. Other exported functions are either not called, or called after the dongle's presence is confirmed. I have tried step by step tracing after these calls, but there is so much code to wade through and nothing jumped out at me like "here is the write to memory to indicate that the dongle is present."

The proper bytes were determined both by a simple or ax,ax jne and a cmp ax, 2239 jne. I also have the dongle in my posession, so I can break at these points and compare the results with and without the dongle. I suppose having the dongle in my posession should make this exercise a lot easier, but . . .

A BPIO -h 278 R, yielded no breaks, and a BPIO -h 378 R broke in SC16W.

The program is filled with indirect addressing so it is difficult to find the key spot.

A Few New Questions regarding Softice:

Is it possible to run a section of the program with and without the dongle, where Softice saves the tracing of the code into a file, and then comparing the two files? I am trying to find a tutorial on the back trace history buffer, but have yet to find the right one.

Is it possible to have the program executing with Softice in another window tracing through the code, or are the T, P and F12 commands the only way?

How does one begin to trace after choosing a menu item with the mouse. Now I try and hit the mouse and CTRL-D a fraction of a second later, but I am sure there has to be a better way.
NOBODY
04-09-2001, 10:22 PM
Spiv (04-09-2001 17:39):
First let me thank you NOBODY for your input.

SC16W exports the functions SCREAD and SCINIT. Other exported functions are either not called, or called after the dongle's presence is confirmed. I have tried step by step tracing after these calls, but there is so much code to wade through and nothing jumped out at me like "here is the write to memory to indicate that the dongle is present."

The proper bytes were determined both by a simple or ax,ax jne and a cmp ax, 2239 jne. I also have the dongle in my posession, so I can break at these points and compare the results with and without the dongle. I suppose having the dongle in my posession should make this exercise a lot easier, but . . .

A BPIO -h 278 R, yielded no breaks, and a BPIO -h 378 R broke in SC16W.

The program is filled with indirect addressing so it is difficult to find the key spot.

A Few New Questions regarding Softice:

Is it possible to run a section of the program with and without the dongle, where Softice saves the tracing of the code into a file, and then comparing the two files? I am trying to find a tutorial on the back trace history buffer, but have yet to find the right one.

I DO NOT REMEMBER THE NAME OF THE TUTORIAL BUT I THINK THE AUTHOR WAS MAMMON. TRY WRITING TO LORD SOTH, HE RECENTLY WROTE A TUT ON SICE, HE MAY REMEMBER. YOU STAND A GOOD SHOT WITH THAT APPROACH.

Is it possible to have the program executing with Softice in another window tracing through the code, or are the T, P and F12 commands the only way?

THERE IS A POSSIBILITY OF RUNNING SICE IN A SEPARATE SECOND SCREEN, IF YOU HAVE TWO MONITORS AND TWO VIDEO CARDS. SOUNDS EXPENSIVE.

How does one begin to trace after choosing a menu item with the mouse. Now I try and hit the mouse and CTRL-D a fraction of a second

NOBODY IS THAT QUICK.

BUT, IF YOU FIND OUT THE HANDLE OF THE WINDOW THAT CONTAINS THE MENU WITH HWND, YOU MAY TRY: (Lets say the handle is 0456)

bpmsg 0456 WM_LBUTTONUP

wm_lbuttonup MESSAGE IS GENERATED WHEN YOU LET GO THE LEFT MOUSE BUTTON AFTER YOU CLICK INSIDE A WINDOW. SICE WILL BREAK FOR YOU DEEP INSIDE SOME API, BUT YOU MAY F12 YOUR WAY OUT TO YOUR APP.

later, but I am sure there has to be a better way.

excuse the uppercase, it is diffcult to intercalate comentaries in this board
NOBODY
04-09-2001, 10:36 PM
NOBODY (04-09-2001 20:22):
Spiv (04-09-2001 17:39):
First let me thank you NOBODY for your input.

SC16W exports the functions SCREAD and SCINIT. Other exported functions are either not called, or called after the dongle's presence is confirmed. I have tried step by step tracing after these calls, but there is so much code to wade through and nothing jumped out at me like "here is the write to memory to indicate that the dongle is present."

The proper bytes were determined both by a simple or ax,ax jne and a cmp ax, 2239 jne.

BASED ON THIS EXAMPLE YOU MAY TRY BRAKING WHEN AX BECOMES EQUAL TO 2239. WITHIN THE ROUTINE THAT SETS UP THE "RIGHT" BYTES ON AX AND ZERO IN THE AREA WHERE THE READING FROM THE MEMORY OR TO THE MEORY FLAG IS TAKING PLACE. IT WOULD BE

BPR CS:00400000 CS:7FFFFFFF rw IF (AX == 2239)

THE RANGE FROM 00400000 TO 7FFFFFFF COVERS ALL THE MEMORY SPACE OF YOUR APP AND EVERY TIME A ISTRUCTION IS EXECUTED OR DATA IS READ/WRITTEN THAT RANGE IS ACCESSED AND SOFT ICE WILL CHECK IF AX HAS TURN INTO 2239.

IT WILL SLOW YOUR COMPUTER LIKE HELL, BUT YOU MAY HIT GOLD.

I also have the dongle in my posession, so I can break at these points and compare the results with and without the dongle. I suppose having the dongle in my posession should make this exercise a lot easier, but . . .

A BPIO -h 278 R, yielded no breaks, and a BPIO -h 378 R broke in SC16W.

The program is filled with indirect addressing so it is difficult to find the key spot.

A Few New Questions regarding Softice:

Is it possible to run a section of the program with and without the dongle, where Softice saves the tracing of the code into a file, and then comparing the two files? I am trying to find a tutorial on the back trace history buffer, but have yet to find the right one.

I DO NOT REMEMBER THE NAME OF THE TUTORIAL BUT I THINK THE AUTHOR WAS MAMMON. TRY WRITING TO LORD SOTH, HE RECENTLY WROTE A TUT ON SICE, HE MAY REMEMBER. YOU STAND A GOOD SHOT WITH THAT APPROACH.

Is it possible to have the program executing with Softice in another window tracing through the code, or are the T, P and F12 commands the only way?

THERE IS A POSSIBILITY OF RUNNING SICE IN A SEPARATE SECOND SCREEN, IF YOU HAVE TWO MONITORS AND TWO VIDEO CARDS. SOUNDS EXPENSIVE.

How does one begin to trace after choosing a menu item with the mouse. Now I try and hit the mouse and CTRL-D a fraction of a second

NOBODY IS THAT QUICK.

BUT, IF YOU FIND OUT THE HANDLE OF THE WINDOW THAT CONTAINS THE MENU WITH HWND, YOU MAY TRY: (Lets say the handle is 0456)

bpmsg 0456 WM_LBUTTONUP

wm_lbuttonup MESSAGE IS GENERATED WHEN YOU LET GO THE LEFT MOUSE BUTTON AFTER YOU CLICK INSIDE A WINDOW. SICE WILL BREAK FOR YOU DEEP INSIDE SOME API, BUT YOU MAY F12 YOUR WAY OUT TO YOUR APP.

later, but I am sure there has to be a better way.

excuse the uppercase, it is diffcult to intercalate comentaries in this board
brtascher
04-10-2001, 09:09 AM
Look also:

http://www.idca.com/~thesandman/si-ug-chapter09.txt
Spiv
04-14-2001, 09:20 PM
I just received the new version of my application. This is completely re-written for Windows and bears little resemblance to what I have been working on. As much as I would like to continue, I may as well work on the new version.

The dongle calls are in a new dll (criter.dll) so it is back to the drawing board for me. I do not believe that this is Rainbow’s, but written by the software vendor. A cursory glance at it shows tests for CPLUS, PRO and SPRO so it should be interesting to work on and learn on.

It is puzzling that I do not get a break from bpio –h 378 r, nor from 278 nor from 3BC. Are there any other parallel port interrupts to break on?

I’ve learned much thanks to the input from this board, and still being a newbie expect I will be back for some more tips. Thanks again.
Antipodean
04-18-2001, 06:39 AM
Hi

>It is puzzling that I do not get a break from bpio –h 378 r, nor from 278 nor
>from 3BC. Are there any other parallel port interrupts to break on?

Do remember that each printer port is 3 consecutive addresses. The base address is the data port (I think, it is a while since I dealt with them). You may well find that the dongle is actually being accessed through the handshake lines, using software generated serial.

Another possibility is that anti-softice code detects you are trying to BPX on a port, and so branches the code out (in the DLL) so it always takes the demo route as though the dongle is not there.
Spiv
04-19-2001, 09:09 PM
Thanks to a tutorial by ACiD BuRN I learned that you can break on DeviceIOControl which worked in this new application. My application uses the SENTNEL.VXD virtual device driver.

I have found a result code for the dongle not being found which can be bypassed (JNE to JMP)(even though there are about 30 places where this is set in the dll and 30 places where it is compared in the application, but I'll trace which ones are called)but this causes a General Protection Error later on when the program tries to reference memory using EAX and ECX. So I guess I'll find the values these have to be and try to find where they are set.


W32dasm and Windows 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > W32dasm and Windows 2000
PDA

View Full Version : W32dasm and Windows 2000

Hoof Arted
04-02-2001, 02:02 PM
Please help me with this problem I am having. I am using win2k build 2195 with Services pack 1 and I am having a serious problem with w32dasm. Everytime I set a breakpoint or try view API call info, the system closes the app and w32dasm. This was not the case in win2k release candidate 2 so I am sure that anyone using it will also have the same problems.

If you have any Idea about where to start looking for the resolution, I would be pleased if you could let me know.

Have fun.

Hoof
Scooby
04-03-2001, 12:00 PM
The only solution I found with this is to reboot into Windows98.
Critter
04-03-2001, 12:05 PM
I've had this problem with Wdasm on all NT based systems
Hoof Arted
04-06-2001, 04:15 AM
Thanks for the info. The problem I have is that duel boot will work but there are apps that do not run on anything else but win2K. I have looked at every registry key, every debug setting available and nothing. There is something that is not working the way it should. I never had a problem with NT systems.

I think that M$ has placed some sort of anti-debug things in their win2k code as the W32dasm only closes when you try seeing info from system API calls. If the info is from the applications function calls, then there is no problem. Also, if you try reading the info in the registers, it closes.

Very strange. If any of the realy experienced people are reading this, your help would be great.

Thanks

Hoof


;STATUS_BREAKPOINT ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ;STATUS_BREAKPOINT ?
PDA

View Full Version : ;STATUS_BREAKPOINT ?

m0sk
04-02-2001, 07:48 PM
hi,

I have two questions regarding the following snippet:

:0040BFB0 mov edx, ecx
:0040BFB2 and edx, 80000003h ;STATUS_BREAKPOINT
:0040BFB8 jns 40BFBF
:0040BFBA dec edx
:0040BFBB or edx, 0FFFFFFFCh
:0040BFBE inc edx
>:0040BFBF inc edx

* What does SoftIce mean with that ``STATUS_BREAKPOINT'' comment? I searched through the Sice docs, but couldn't find anything about it. It can't be some leftover debug info, as there is none... It doesn't seem too important though, but I'm curious to find out (btw: I am on NTIce now, and didn't see this comment in win98---at least as far as I can remember ;-))

* Regarding the code itself: what could be the meaning of lines 40BFBA..40BFBE? I know they're only executed when the result of the AND sets the sign flag, but what's the use? Note: edx contains the reamainder of an IDIV (in this case always a positive integer, jns is always taken). Obviously, the compiler put these instructions there to deal with negative results of the signed division...but what exactly do they mean ???

Any insight appreciated ;-)

Regards,

m0sk
tom
04-02-2001, 09:05 PM
status breakpoint == 80000003h, its an exception code .. int 3 causes this exception .. dont think it has any meaning with the code u have though . just ignore NTice's auto comments :-)

dec edx / inc edx == decrease edx, increase edx

edx = edx - 1

edx = edx + 1

!

r.e.
Note: edx contains the reamainder of an IDIV (in this case always a positive integer, jns is always taken).

nope, edx contains ecx .. look at the damn code !

:0040BFB0 mov edx, ecx
:0040BFB2 and edx, 80000003h ;STATUS_BREAKPOINT

goodnight
m0sk
04-02-2001, 09:34 PM
tom,

thanks for your answer on STATUS_BREAKPOINT

tom (04-02-2001 19:05):
nope, edx contains ecx .. look at the damn code !

:0040BFB0 mov edx, ecx
:0040BFB2 and edx, 80000003h ;STATUS_BREAKPOINT

lol, hehe, you're right of course (stupid me)

However, my question still remains: why did the compiler put in these extra lines (and what do they do)... ecx is a counter going from 0x0..0x14 --> these instructions will never be executed

???

m0sk
DinDon
04-03-2001, 04:24 AM
Hi m0sk,

the purpose of the snippet you provided is simply that of remapping a signed integer, stored in EDX (the remainder of an IDIV as you said), into a restricted range of signed values surrounding the zero.

In the case of positive values for EDX the result is rather obvious: it spawns in the range 1 - 4, as we can see from the following table

input -> EDX and 80000003 -> result
-----------------------------------
input 0 -> 00000000 -> 1
input 1 -> 00000001 -> 2
input 2 -> 00000002 -> 3
input 3 -> 00000003 -> 4
input 4 -> 00000000 -> 1
input 5 -> 00000001 -> 2
input 6 -> 00000002 -> 3
input 7 -> 00000003 -> 4
and so on...

In the case of negative values, the code you are asking about simply brings the results near the 0. But there is a further trick to overlap some results to the results obtained from the positive cases (I don't know why, since I don't know the target of this stuff).

I explain myself better with some examples. First comment out the instructions
"0040BFBA dec edx" and "0040BFBE inc edx" before and after the "0040BFBB or edx, 0FFFFFFFCh". In that case the mapping between input and result is linear, without overlappings, as you can see by the following table:

input -> after AND -> after OR -> result
----------------------------------------
input -1 -> 80000003 -> ffffffff -> 0
input -2 -> 80000002 -> fffffffe -> -1
input -3 -> 80000001 -> fffffffd -> -2
input -4 -> 80000000 -> fffffffc -> -3
input -5 -> 80000003 -> ffffffff -> 0
input -6 -> 80000002 -> fffffffe -> -1
input -7 -> 80000001 -> fffffffd -> -2
input -8 -> 80000000 -> fffffffc -> -3
and so on...

But after inserting again the two instructions we commented out, the overlapping is manifest from this new table:

input -> after AND -> after DEC+OR+INC -> result
----------------------------------------
input -1 -> 80000003 -> ffffffff -> 0
input -2 -> 80000002 -> fffffffe -> -1
input -3 -> 80000001 -> fffffffd -> -2
input -4 -> 80000000 -> 00000000 -> 1
input -5 -> 80000003 -> ffffffff -> 0
input -6 -> 80000002 -> fffffffe -> -1
input -7 -> 80000001 -> fffffffd -> -2
input -8 -> 80000000 -> 00000000 -> 1
and so on...

As we can see, the result -3 is no more present, and it is replaced by +1. Why this?
We must look at the overall target of the code to understand this...

Regards.
m0sk
04-03-2001, 11:37 AM
Thanks a lot DinDon! I've figured it out thanks to your help 8)

The lines do simply the following (both for pos. and neg. values):

edx := (edx MODULO 4) + 1

Simple huh? ;D
Thanks again & happy reversing!

Regards,
m0sk
DinDon
04-04-2001, 02:45 AM
Good! I missed your last inference!

The beauty of reversing is to find the light from the darkness of chaos!

Bye...


Softice and Win ME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice and Win ME
PDA

View Full Version : Softice and Win ME

Aquatron
04-03-2001, 02:44 PM
Hello

I have installed Softice 4.05 in Win Me and there is nothing in the autoexec.bat as I was advised that there should be. Can I input a line there and, if yes, what should it be?

Control and D does nothing at all andif I go to the install directory and start it from the loader exe it will open an exe but the load button is greyed out.

Does the app work in Win Me at all?

My Win98 computer is really for audio and has Cubase on board. I remember reading once that Steinberg inserted code into Cubase that stops it from running if Softice is present. I can do without any troubles on that system and prefer to stay on my small set up if possible. I would rather not use win98 on that because the net is faster for me using Millennium.

Also - if I have to go to my primary system - I use 98 lite and wonder of thats ok with Softice?

Thanks.

Aqua
winME
04-03-2001, 05:29 PM
I have winME and softice running. You need to go to Numegas site and follow their detailed instructions on getting the two running together, which involves installing one of the sdk's from MS. Can't remember all of the details, but I know it was hard to find the page at Numega when I was looking for it :) Simply changing the autoexec.bat just doesnt work. On the subject of winME, anyone know how to get smartcheck working
Aquatron
04-04-2001, 05:18 AM
Thanks!

Aquatron


crack tornado (vxworks) install serial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > crack tornado (vxworks) install serial
PDA

View Full Version : crack tornado (vxworks) install serial

wowo
04-04-2001, 07:01 AM
tornado dev tools(www.windriver.com) is a powerful
develop kit for vxworks rtos.
it install content is determined the serial,i hope anyone crack it.
the install is run by the TCL/TK language.
you can download a vxsim version from windriverby login tornado prototype!
anyone crack it pls tell me the crack method,Ialso have my tornado develop packages to crack.
Scooby
04-04-2001, 07:36 AM
Well, the first thing to do is have a look at the code in something like UltraEdit and see if it's packed, and if so, unpack it. Then disassemble it.

From what you say about TCL/TK - Is this a Unix or Linux program we are talking about?
wowo
04-04-2001, 08:21 PM
the installation is excute by a script language writed in tcl/tk
Scooby
04-05-2001, 07:50 AM
In that case, look through the script file and see what you can find.


I need Help with Digi Guide
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I need Help with Digi Guide
PDA

View Full Version : I need Help with Digi Guide

Tak Tics
04-04-2001, 09:27 AM
Iv been looking evry where and i still carnt find the reg code for it. all the people i no carnt find it either.

Tak Tics Hacks & Cracks Forum
http://wwwboard.net/bbs1/Tak_Tics/wwwboard.sht
qferret
04-04-2001, 01:16 PM
I answered at the board you linked to....but you won't like it... }>
Tak Tics
04-04-2001, 01:40 PM
im sorry about that every 1 i dident c it untill i posted the message
sorry
?ferret
04-04-2001, 01:46 PM
color me impressed ;-) .....politeness after the flame

if you wanna learn, you're welcome to join in the fun....start off with some tutorials, & find some of the basic tools....a debugger, a disassembler and a hexeditor


Softice knowledge sharing and questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice knowledge sharing and questions
PDA

View Full Version : Softice knowledge sharing and questions

Lou Cypher
04-04-2001, 03:24 PM
After going over countless of tutorials on reverse engineering I finally figured out how to use softice. The problem with most tutorials is that they assume that you have some kind of knowledge on the subject matter and while some people might have knowledge in assembly language it doesn't mean that they automatically have knowledge on softice. I know a little bit of assembly but I am new to this reverse engineering thing so I would like to share my troubles with anyone who is willing to listen so that if you don't know much about reverse engineering you can learn from my mistakes and try not to make them.

The most important thing I have learned is the use of breakpoints from a tutorial I found in http://azrael.mine.nu/underground/softicetuts/bps.htm but still I am not very comfortable with the softice dos screen. Is there a way to print out or make a text file of the info uncovered by the breakpoints? I am using sofice 4.05 under windoze 98 and I would prefer if I could use the softice log file as a reference for searching for the breakpoints in a hex editor like Hex Workshop in which I can print out or do some cutting and pasting. Can this be done? Is the softice log file good for anything or is it there just for amusement? This is the information I get on my softice log file:

WINICE: Load32 Obj=0002 Add=016F:BFF5D000 Len=00001000 Mod=USER32

I guess my question really is if the Add= is the location of the operation being executed in the Mod= file in this case user32.dll?

Thanks for listening,

Lou Cypher
JimmyClif
04-04-2001, 04:49 PM
Hola,

If I got you right, you want to search the breakpoints in an HexEditor? *g*

That's pretty hardcore... as only pro's can see that E8 D4 20 00 00 is a call to the CreateValidSerialInMemory-API *hehehe*

/me gets serious again

----

I really would start reading the SoftIce manual first, then I would get me a disassembler (www.datarescue.com (freeware) or get Wdasm32) and you will see that there's no need for printing out the SoftIce-Dos-Screen as you would have the code clear & lisible in front of your eyes.... and there are the breakpoints all listed in a row!

Then I would start reading & understanding countless tuts and not just going over them :) That helps a lot too!

JimmyClif
"There's really no magik behind :

3BF7
7642
CC

CC? What the f**k?"
Lou Cypher
04-06-2001, 02:50 PM
Como estás:

Thanks for answering my question. Sorry I took so long in replying back. I have tried for about a week now to reverse engineer anything but I haven't had much success mainly because the tutorials I get use sample files that are not available any more that is why I can only go over them I can't really study them. To add insult to injury the SoftICE manual and the command reference are written in Chinese, well at least that is what it looks to me because I can't understand half of what they are saying. I couldn't find a place either in the manual or in the command reference with a complete keyboard mapping of all he short cuts available in SoftICE. I had to make the keyboard mapping after going over what must have been at least a hundred of commands in the command reference. I really hate adobe acrobat documents because it is very difficult to scroll through them and you can't cut or paste. My printer just died so I hate Acrobat even more. I had to go through every single command in the command reference to find out which ones where mapped in the keyboard. I give anything for a good book or manual. Unfortunately this is a forbidden subject and good books and manuals are hard to come by. Anyway was really glad that you could straighten me out. I will keep trying more and I will try to post my discoveries so I can help people out.

Thanks,

Lou Cypher
JimmyClif
04-06-2001, 03:02 PM
Check your mail :)
JimmyClif
04-06-2001, 03:08 PM
ERROR: The address "vpanepinto@hotmail.com" does not exist. This mail has not been sent.

:( what's that?
Lou Cypher
04-07-2001, 03:31 AM
Sorry about my hotmail email, the account was closed for 2 months but a reactivated it. It apparently didn't work because I get the same message I got a week ago. I will try again to get it reactivated but in the mean time here is my local email vinny@coqui.net. Thanks for your time and patience.

Lou Cypher
tan ah lek
04-07-2001, 01:05 PM
Hi,
you don't understand the language in the manual doesn't mean its written in chinese.
pls don't insult us.remember that!!!
JimmyClif
04-07-2001, 01:51 PM
Yeah... we better take care...

After all: They do have atomic bombs...

JimmyClif
Eternal Bliss
04-14-2001, 10:29 AM
It takes quite a bit of intelligence to read and write Chinese too. 8) Not that easy. 8)
Maybe you should grab a copy of the manual written in english or your native language?

Regards.
EB
LordSoth
04-14-2001, 05:55 PM
Lou Cypher (04-06-2001 12:50):
Como estás:

I couldn't find a place either in the manual or in the command reference with a complete keyboard mapping of all he short cuts available in SoftICE. I had to make the keyboard mapping after going over what must have been at least a hundred of commands in the command reference. I really hate adobe acrobat documents because it is very difficult to scroll through them and you can't cut or paste. My printer just died so I hate Acrobat even more.

Lou Cypher

Umm, not true at all.
Hi, just for the record, acrobat reader DOES
have the ability to copy text, just use
the text select tool :)
I think you're trying to overdo it from the
start. Don't try mapping shortcuts to each
and every command in SI, that's pointless,
since more than half of them aren't used
regularly (that is, only on specific cases).
The SI manual is divided into chapters, and
you can browse easily through them using
the bookmark pane. In the windows menu there's an option to enable bookmark view,
which makes it a lot easier to navigate.
Finally, give it time. With some training,
you'll get a good grip of the commands you
need to use regularly, so you needn't be
worried about it right now.

LS


THe ReVirgin PRoblem!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > THe ReVirgin PRoblem!
PDA

View Full Version : THe ReVirgin PRoblem!

NeO'X'QuiCk
04-04-2001, 04:11 PM
I have bin reading the The Blackbird tut about unpacking Iris!

I got to problem i cant find the ReVirgin!

How they can be found:

1. Run the program with a breakpoint on UpdateWindow (or another one), when SoftICE breaks, press F12 until you are back in Iris maincode. Then trace into every call you come across until you turn out to be in the jump table. A jump table looks like this:

Start partial code

015F:004469D8 JMP [004BAF4C]015F:004469DE JMP [004BAF50]015F:004469E4 JMP [004BAF54]015F:004469EA JMP [004BAF58]015F:004469F0 JMP [004BAF5C]015F:004469F6 JMP [004BAF60]015F:004469FC JMP [004BAF64]015F:00446A02 JMP [004BAF68]015F:00446A08 JMP [004BAF6C]015F:00446A0E JMP [004BAF70]015F:00446A14 JMP [004BAF74]015F:00446A1A JMP [004BAF78]015F:00446A20 JMP [004BAF7C]015F:00446A26 JMP [004BAF80]
End partial code

Now, scroll through the jump table and try to find the lowest jump offset (i.e. find the JMP xxxxxxxx where xxxxxxxx is the lowest value in the whole jumptable). Note that this jump table can be divided by a lot of other instructions, so you'll have to scroll to make sure you saw the whole jumptable.
Another method to find the lowest offset, is to take a random offset in the jumptable (like 4BAF80), type d 4BAF80 and scroll up in the datawindow until there's no more data, but only zeros.
In Iris, the beginning of the IAT is @ offset 4BA48C. Fill in BA48C in ReVirgin.

Could you help me where to fing it!

Thanks in advance!
NeO'X'QuiCk
IcyDee
04-08-2001, 03:14 PM
You can find it at h**p://tsehp.cjb.net/


Help with a vb6 program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with a vb6 program
PDA

View Full Version : Help with a vb6 program

Jason
04-05-2001, 12:59 PM
If anyone can help me with this it will be a tremendous relief. The program is Test Pro Developer 2000 at www.atrixware.com. I did the bpx__vbastrcat and when i landed on the pop (10 F10's) i sat there. Then i set a bpx on the address with the pop. Then i started monitoring eax, i saw so many numbers appear in there that i dont know which is the correct one. I tried quite a few and none of them worked, so i really need some help.

I have my F5 key mapped in sice as F5="^x;^dd eax;"

Can someone help me with this and show me exactly how you found the correct one. There are so many that appears that the right one may not have been in there, i really don't know.

Thanks......

Jason
Jason
04-05-2001, 01:05 PM
Everytime i posted the message it give me an error and i see no message. Then i try again and the same thing happens. Then eventually there are three messages. Whats up with that...

Can someone delete the other two messages....


Patcher Source for win32asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Patcher Source for win32asm
PDA

View Full Version : Patcher Source for win32asm

SS2001
04-05-2001, 08:38 PM
Hey I need help with writeing a win32asm patcher could you help me (I only coded the Hello World Thing, But I can Crack!)
Kayaker
04-05-2001, 11:19 PM
Hi,

Check out Cogen II at www.suddendischarge.com, it will generate complete TASM source for a patcher which you can study. It Reads the file into memory to patch it.

If you want, you could also take a look at the patcher I wrote for my Regmon project, which is on the main tutorial site for this board. It Maps the file into memory instead and is written in MASM. It's just a simple DialogBox which when the button is pressed Maps the file and patches the required bytes. I could send you the source if you *really* want, but I think you'd learn a lot more by studying the disassembly of it and implementing your own version. The actual patch routine is about 12 lines long total. It's packed with UPX just to keep the file size down, so if you have a problem with unpacking it I could send you the unpacked version if you are interested in studying it further. As for the DialogBox itself, take a look at tutorials 10 and 11 in the unquestionably excellent Iczelion ASM tut series.

There's plenty of patchers at the Tools sites, some of them may have source or you could study their compiled output as well. Let me know if you need any more help.

Regards,
Kayaker
Latigo
04-06-2001, 11:09 AM
Hi there. i got some sources in www.latigo.cjb.net
Check them! :)
Bye!

Latigo


I am reverse engineering right or I am just reversing everything in sight?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I am reverse engineering right or I am just reversing everything in sight?
PDA

View Full Version : I am reverse engineering right or I am just reversing everything in sight?

Lou Cypher
04-06-2001, 03:01 PM
Hi everyone:

I have been trying to learn how to reverse engineer but I haven't had much success because almost all of the tutorials I have read use sample files that are not available anymore. So I decided to try to reverse engineer an old Windows 95 program I had because it had 1 .exe and 6 .dll making it more complicated than a file with just 1 .exe but not extremely complicated like some programs I have seen with 20+ .dll. I thought that reverse engineering this program would be easy because the protection it has is that it looks for piece of hardware and if it can't locate the hardware it sends a message box with a warning that it could not locate the hardware and then it quits. I thought that the easiest way to reverse engineer would be to search for the source of the message box and eliminate it. I thought that SoftICE would be perfect for a job like that. I tried using the MessageBoxA, MessageBoxExA, MessageBoxW, MessageBoxExW breakpoints but all I get is garbage or at least that is what I looks to me. Maybe it is not garbage and it is just me that I am so tiered from reading everything on reverse engineering only to fail at every attempt. Am I doing this right? What I usually do is set a breakpoint and once I get the break I use the T command to back trace the code. Maybe you guys can point me in the right direction if I tell you what I see in my code window. I am not asking you to reverse engineer the program for me I just want to know what I am doing wrong and what would be the correct way to attack this kind of problem. This is what I get in my screen:

USER32!MessageBoxA
167:BFF5412E--> 55 --> PUSH --> EBP
167:BFF5412F--> 8BEC --> MOV --> EBP, ECP
167:BFF54131-->6A00 --> PUSH --> 00
167:BFF54133-->FF7514 --> Dword PTR [EBP + 14]
167:BFF54136--> FF7510 --> Dword PTR [EBP + 10]
167:BFF54139--> FF750C --> Dword PTR [EBP + 0C]
167:BFF5413C--> FF7508 --> Dword PTR [EBP + 08]
167:BFF5413F--> CALL --> USER32!MessageBoxExA
167:BFF54144-->POP --> EBP
167:BFF54145--> RET --> 0010

Maybe it has to do with the PE file because when I quickview the file I get the following messages:

1) Relocation info stripped from file
2) Line numbers stripped from file
3) Local symbols stripped from file

Maybe the program I have chosen is more than I can handle at the moment but I get the same info when I quickview winzip so I thought that if winzip could be fixed so could this program but what do I know. I am just a confused newbie trying to learn something new but if I ever figure it out I am more than willing to help others out. Maybe my problem is that I just can't see what I have right in front of me.

Lou Cypher
JimmyClif
04-06-2001, 04:26 PM
When you break... your not in your programs code, as you break on API functions (API's are the MessageBoxA stuff).. ergo your deep in Windows code!

When you're breaking.. have a look around in SoftIce.. example:

EAX=00000218 EBX=0063FC94 ECX=00760744 EDX=7B68408E ESI=00008CB8
EDI=0063FC48 EBP=0063FC34 ESP=0063FC34 EIP=004013CF o d I s Z a P c
CS=018F DS=0197 SS=0197 ES=0197 FS=12F7 GS=130E
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄbyteÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
0197:00412CF0 2C 00 41 00 00 00 00 00-00 00 00 00 00 00 00 00 ,.A.............
0197:00412D00 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0197:00412D10 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ÄÄÄÄÄ_ShEr+0023ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
018F:00401380 C3 RET
018F:00401381 55 PUSH EBP
018F:00401382 8BEC MOV EBP,ESP
018F:00401384 68363E4000 PUSH 00403E36 
018F:00401389 687F660440 PUSH 4004667F  
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄSPAM!.text+0380ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
d eax

do you see the line in bold (here it is an example - you won't see SPAM!.text+380 when you break)?

Hit F12 until you see your programs name at that spot!

And of course you can't find
Relocation info, Line numbers, Local symbols - because you're debugging a file w/o source and DebugInfo.

How easy would our Life be if programmer would distribute their shareware with DebugInfo, and we could read everything like this :?
lea eax, [RealSerial]
lea ecx, [UserSerial]
push eax
push ecx
call _CompareSerial
cmp al,1
jz @GoodBoy
call _ShowBloodyErrorMessage


How do I recompile lmcrypt (FlexLM SDK source codes)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How do I recompile lmcrypt (FlexLM SDK source codes)?
PDA

View Full Version : How do I recompile lmcrypt (FlexLM SDK source codes)?

idnauoy
04-07-2001, 01:22 AM
I can't compile lmcrypt & makekey in FlexLM SDK 6.1f.

And I got SEEDs & VENDER_KEYs from FlexGen2000.3,
but Genlic32.exe made an error. ('the vendor codes are not valid')

How can I recompile or compile FlexLM programs
and generate my licenses?

Were the information in FlexGen2000.3 wrong?

I want to use BC++ 5.5 Free Compiler.
( I don't like using VC++ because it is so big and difficult. )

Please eplain the compiling method easily.

Thanks in advance.
TonTon
04-18-2001, 07:36 PM
I installed the SDK FlexLM, installed VC++ (don't care the order) and ran a batch that is it a SDK subdirectory now i no remember. I don't have problem with they.

Regards.
TonTon

idnauoy (04-06-2001 23:22):
I can't compile lmcrypt & makekey in FlexLM SDK 6.1f.

And I got SEEDs & VENDER_KEYs from FlexGen2000.3,
but Genlic32.exe made an error. ('the vendor codes are not valid')

How can I recompile or compile FlexLM programs
and generate my licenses?

Were the information in FlexGen2000.3 wrong?

I want to use BC++ 5.5 Free Compiler.
( I don't like using VC++ because it is so big and difficult. )

Please eplain the compiling method easily.

Thanks in advance.


How to crack the MStudio
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to crack the MStudio
PDA

View Full Version : How to crack the MStudio

Stony
04-08-2001, 09:19 AM
Hi,

I got a Demo version MStudio for plotting, but it cann't save. Now i find a 'Call ..' which causes error information, unfortunately, this 'Call ...' has been carried out many times, i wonder how to reach its last turn. To be honest, I lose confidence in cracking it. So i am looking forward your kind help.

P.S. the download address:
http://www.quantsims.com/Software/index_mstudio.htm
Squidge
04-10-2001, 02:26 PM
3 ways jump to mind: Either BPX the message box using SoftIce which will give you the caller, and trace back the stack from there. Do a BPX on DestroyWindow and trace back from there, use W32Dasm, load it into the debugger part and set a break and then trace back the stack in that.

Alternatively, look for a JNE or JE near the PUSH or MOVE for the error message text.

NB: If the program can't be registered from itself, and the programers who did the protection arn't stupid, then the chances are there will be no save code so you'll have to create your own :)


Paint Shop Pro 7.02
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Paint Shop Pro 7.02
PDA

View Full Version : Paint Shop Pro 7.02

GetinMyTummy
04-08-2001, 12:52 PM
I'm realitively knew to cracking, hence the posting within this forum. But I'm requesting help to teach me how, do it with me, or just give some hints as to how to crack Paint Shop Pro 7.02....it would be my first semi-big crack i guess.....thanks
NOBODY
04-09-2001, 04:45 AM
GetinMyTummy (04-08-2001 10:52):
I'm realitively knew to cracking, hence the posting within this forum. But I'm requesting help to teach me how, do it with me, or just give some hints as to how to crack Paint Shop Pro 7.02....it would be my first semi-big crack i guess.....thanks

You stand a better chance of getting help if you show what you have attempted so far: What kind of protection(s) you have identified, and what methods you have tried to figure them out.
While there is a chance somebody else in the MB has looked at that app, most ppl are going to let you do your homework and will become interested only when you ask specific questions instead of you plainly saying, as you aparently did, "I don't know where to start".
Squidge
04-10-2001, 02:30 PM
Well, my advice would be to look for an essay on an older version of PSP and then read up on the essays for the later versions. Read the PSP5 essay, and then the PSP6 essay. Then you'll have an understanding of the type of protection you'll be dealing with.

You'll most likely find that PSP 7.02 will use the same protection, but slightly altered.

Once you've read the essays, and then looked at the latest version of the program, feel free to ask questions here, but don't expect us to do the work for you.
Instructor
04-10-2001, 11:58 PM
Here is a good tutorial:
http://users.belgacom.net/blackb/

The method works also in 7.02.

cu


HELP! SIce&WinME prblm(I'm Goin Crazy!)PLZ SOMEONE!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HELP! SIce&WinME prblm(I'm Goin Crazy!)PLZ SOMEONE!
PDA

View Full Version : HELP! SIce&WinME prblm(I'm Goin Crazy!)PLZ SOMEONE!

wutever0
04-08-2001, 09:10 PM
poor lil me is just soo clueless.I have tried everything.I can't get sice4.05 to load on WinME.

1)Without any loaders:-
a) i get the msg "Enhanced Windows 386 is already running" whenever i dbl click winice.exe.
b)when i press Ctr-D nothing happens.
c)whenever i add "g:\softice\winice.exe" to autoexec.bat and i run autoexec.bat the same msg as 1a) appears.
d)when i save the altered autoexec.bat and restart and then press CTR-D nothing happens.When i recheck autoexec.bat the added line is not there???
e)when i uninstall and let softice's setup add the line by itself and restart and press CTR-D nothing happens and there is no line in autoexec.bat???

2)I tried the microsoft/numega solution:-
a)when i use the standard debugger installation windows doesnt load(period!).
b)when i use the system.ini debugger installation funny stuff happens(everything same as in 1 except this time when i restart or shutdown the computer doesnt restart or shutdown it just gives me a black screen with a blinking white ' _ ' on the top left of the screen???

3)I havent tried the protools loader cause it sounds complicated...

WHAT I'M SURE OF:-
i have a S3 Trio 3D-2X video adapter so i tried all S3 adapters as well as the SuperVGA during setup and none worked(only when i use the "Universal" thingy they work).....Whatever i do the autoexec.bat file doesnt have the winice.exe line after restarting.

WHAT I'D REALLY LIKE TO KNOW:-
1)Has anyone experianced the exact same problems?
2)What does "Enhanced windows 386 is already loaded" mean?
3)What can i do to load winice.exe???
PLEASE I BEG U GUYS
(ANY small comment is GREATLY appreciated)..sorry for the long msg:'(
winME
04-09-2001, 05:39 PM
2)I tried the microsoft/numega solution:-
a)when i use the standard debugger installation windows doesnt load(period!).

that happened to me too :) then I finished the numega solution...... by replacing the windows debugger with softice. (Yeah, I had to single step through the config and not allow the debugger to load to get windows to boot, but then I shouldnt have rebooted at that point anyway..... when windows says 'reboot now' don't!!!!!!!
wutever0
04-09-2001, 07:04 PM
finally i did it!!!
after long tedious hours of praying and breath-holding "TRial n Error" i finally HAVE SOFTICE LOADED!!!!
it seems i had to download some file from
http://www.numega.com/drivercentral/utilfiles/debugger3_13_01.exe ,rename it to debugger.exe and replace the existing "c:\windows\debugger.exe" with it. i also did what was told in this page:- http://www.numega.com/drivercentral/tech_tips/windows-me_6_30_00.shtml .Then another problem appeared ... Whenever i restart or shutdown the screen just turns black with a white blinking _. I knew this was because of the microsoft/numega standard debugger installation cause whenever i uninstalled it the computer would restart or shutdown normally so i tried the loader.exe thingy and no problems there. If someone has the same problems and still doesnt understand what i said feel free to email me..no need to go through all that useless trouble again.
NOW THAT IVE FINALLY LOADED SOFTICE AND I FEEL LIKE A GOD, CAN ANYONE SUGGEST A BEGINNERS PROGRAM TO TRY TO CRACK (TO RECHECK MY EGO).
oh i almost forgot...the above info i got from an earlier post in the TOT Forum posted by someone called DESTRYER97 to someone called GOAT..id like to thank them as well as thank my parents who without their absence i could never have succeeded. I would also like to thank my friends and colleuges who helped me through the last few difficult days..to all i say THANK YOU FROM THE HEART OF MY BOTTOM..THANX GUYS


Runs under 98, but not NT2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Runs under 98, but not NT2K
PDA

View Full Version : Runs under 98, but not NT2K

rich
04-11-2001, 10:23 AM
Hello all,

I'm learning about vbox 4.3 protection, and have managed to un'vbox an app under windows 98 by walking through the +Tsehp tut. But, when I run the app under NT2K, it generates an error (application failed to initialize properly at 0xC0000005) and fails.

Using PEditor, I've made sure that file checksums are correct, and the PE header is NT2K compatible. But, the app still fails.

Any ideas are what to look into next, or pointers to tuts that might give me some clues?

thanks,

rich
Cps530
04-13-2001, 09:07 AM
I have exactly the same problem. I think you need to rebuild the header of the dumped file (using peditor 1.7). I tried to do that but no success. Maybe somebody has some tips. Thanks.
rich
04-13-2001, 02:20 PM
Yeah, did that to no avail.

One thing that I have identified, though, is that it's definitely the import table getting screwed up.

I was able to successfully crack my vbox 4.3 application using TRW2000. When I attempted to same with ProcDump/PEditor, the application dumped doesn't run.

So, now I need to do some poking around to compare the two files and figure out what's happening.

rich


getting past SD2 antidebugging
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > getting past SD2 antidebugging
PDA

View Full Version : getting past SD2 antidebugging

-newbie
04-11-2001, 03:04 PM
is it possible to bypass safedisk 2 antidebugging on 9x or nt? sometimes it says to unload debugger even if i dont have one loaded, thats how "strong" it is! (tho i believe its because some softs i write for learning change dr7)

thank you.

-
clarkee
04-13-2001, 07:46 AM
icedump.tsx.org, 6.022 / 6.023pre appear to handle his anti debugging quite nice on win9x .
-newbie
04-13-2001, 03:42 PM
thanks. yes, icedump does it. great tool... that must have taken quite some winice and win9x reversing.

-


Cracking a packed?????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cracking a packed?????
PDA

View Full Version : Cracking a packed?????

Tex
04-11-2001, 07:09 PM
If i was to patch Electronic Workbench ver. 5.1, and i was getting an error message saying the file was either packed or the wrong version, what would i need to do (or what would i be doing wrong?)
?
Muad'Dib
04-13-2001, 12:09 AM
You could try unpacking it...there are plenty of essays on unpacking around, just search a bit. There are also some good tools on http://protools.cjb.net


IAT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IAT
PDA

View Full Version : IAT

wet behind the ears
04-13-2001, 05:10 PM
Where in the PE header this import data supposed to be stored (.idata?)

All by chance, I found the correct IAT Start RVA and length and Revirgin gave me all the modules, IT_ADD added IT.bin. Now I have two .idata in my unpacked .exe. It works well but, I wonder isn't it possible to disassemble the .exe? May be I should use stg other than w32dasm?
Carpathia
04-13-2001, 06:41 PM
http://carpathia.cjb.net/pe_format.zip

contains some of the more popular PE references.
[yAtEs]
04-25-2001, 07:00 AM
wet behind the ears (04-13-2001 07:10):
Where in the PE header this import data supposed to be stored (.idata?)

http://www.yates2k.co.uk/Import_tables.txt

The IAT is pointed to in each iids which is located at PE+80 PE=dword at 0x3Ch


can you help me in a IP problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > can you help me in a IP problem
PDA

View Full Version : can you help me in a IP problem

marfaru
04-13-2001, 06:09 PM
I have a dial-up connection and I want to hide my real IP and generate another. Do you now a program who can do this thing for me? Exist any program my fake IP?
Thank YOU!!!
qferret
04-13-2001, 10:55 PM
just use a proxy server
marfaru
04-14-2001, 05:20 PM
qferret (04-13-2001 20:55):
just use a proxy server

Thank you, my friend!
By the way, can I hide my real identity
if I use a proxy server (computer name, hard IP, etc) ?
Squidge
04-14-2001, 05:43 PM
yes, unless you use irc, etc then no. proxy servers only hide your ip from www and ftp sites.


Do you now a serious site for programs cracking?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Do you now a serious site for programs cracking?
PDA

View Full Version : Do you now a serious site for programs cracking?

marfaru
04-14-2001, 05:33 PM
I want to find a real programing cracking site, with real crackers, etc
Do you now a serious site for programs cracking?
Thank you!
Squidge
04-14-2001, 05:46 PM
you've just found one!

are you newbie or experienced?


fucked up message
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > fucked up message
PDA

View Full Version : fucked up message

dooral
04-15-2001, 12:49 AM
i usually leave my comp on, but my shit locked up today and when i rebooted when sice usually loads i got the message that my version (4.05) was no longer a valid version, more specifically it said my winice.exe was no longer valid. even worse i couldnt get past that in reboot. :( im f0rkin confuzed, i tried everything i could possibly think of. but no luck it just gave me the message and said to visit numegas site. i finally gave up and reformatted :( really pissed me off, but i was wondering if anyone else had the problem. but i really cant understand how it happend. im stumped. l8rz

doorall
JimmyClif
04-15-2001, 05:10 AM
I don't know what your problem consist of; but did you know?

* That you could have pressed SHIFT-F5 to bypass the auoexec.bat, config.sys at StartUp?

* That you could have used a Boot disc to access your computer?

Reformatting a computer because of a line in your autoexec.bat really wasn't the way to go ;P
dooral
04-15-2001, 02:27 PM
do ya honestly think i didnt try a boot disc?
JimmyClif
04-15-2001, 04:11 PM
Sorry man,

I didn't want to p*ss you off... In other words I meant:

SoftIce is not standard into Windows! It has to load somewhere, and that can be disabled upon startup! (remember? there's a way..etc)

I had such funny progs too before, and I know.. If something wants to block my boot process I need to check following files:

* Autoexec.bat
* Config.sys
* System.ini -> under [boot]
* Win.ini -> under [Windows] (especially load instructions)

and disable any uncommon stuff....

Did you try renaming winice.exe under DOS? That gives you usually another (more specific) error message at next boot...

I excuse myself again.. if I hurt your feelings, personally I think you were too fast using format! I can't use format... I have to find a way in case my machine is stuck! Too much data would be lost! And... I always found a way!

best Regards,
JimmyC

PS: What did Numega's Site tell about this message? (Curious as I am ;) )


softice font
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice font
PDA

View Full Version : softice font

b.
04-15-2001, 04:48 PM
Hi
Can someone advise how to set the font size
of this software?
The option is available through 'winice.exe
properties' but it doesn't change even after
restart.
Can someone reccomend a good instruction set
of the 80x86 on the web?
Thanks.
Solomon
04-15-2001, 09:01 PM
Modify Edit->SoftICE Initialize settings->General->Initialization string:
"set font 2; x"
or you can edit the following line of winice.dat :
INIT = "set font 2; x"

80x86 Instruction manual:
h**p://personales.com/eeuu/arizona/Aesculapius/files.html
miscreant
04-16-2001, 11:44 AM
if only i'd known about this command before.. so much easier on my eyes :P
b.
04-16-2001, 01:58 PM
Solomon (04-15-2001 19:01):
Modify Edit->SoftICE Initialize settings->General->Initialization string:
"set font 2; x"
or you can edit the following line of winice.dat :
INIT = "set font 2; x"

80x86 Instruction manual:
h**p://personales.com/eeuu/arizona/Aesculapius/files.html

Thank you.


Windows Commander 4.5.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Windows Commander 4.5.2
PDA

View Full Version : Windows Commander 4.5.2

DaWsOn3k
04-16-2001, 03:14 AM
i am trying to crack windows commander 4.5.2 any tutorial that u can suggest for that ??? don't forget i am newbie :)))
JimmyClif
04-16-2001, 06:07 AM
If I remember right, BlackB wrote a tut about it some time ago. Have a look at ht*p://beam.to/BlackB

If my memory serves me right it used to be packed with AsProtect... if this hasn't changed - you might need to read the new ReVirgin essais too.
DaWsOn
04-16-2001, 02:47 PM
JimmyClif (04-16-2001 04:07):
If I remember right, BlackB wrote a tut about it some time ago. Have a look at ht*p://beam.to/BlackB

If my memory serves me right it used to be packed with AsProtect... if this hasn't changed - you might need to read the new ReVirgin essais too.
thnx for the source :)))))
Scooby
04-17-2001, 07:38 AM
Don't forget that Windows Command 4.5.2 has a load of CRC checks built into the code that are time and feature triggered. It'll make you think you've cracked the program and then a minute or so later it'll something along the lines of "The windows commander executable is damaged - possible Virus!" and exit. It can be a real bitch to find and eliminate all the checks.

The perfect way to register it would be to create a proper, working keygen that created the wincmd.key file, but no one seems to have managed this as yet.
DaWsOn
04-17-2001, 02:07 PM
You are right mate it has fucking CRCs and weirdly i cant unpack 4.5.2 as BLackB unpacks 4.5.1.....But Predator from Phrozen Crew managed to crack 4.5.2 too we may need him here to tell us :))))
Squidge
04-17-2001, 03:53 PM
Yup, strange thing is, the cracked version that you just run the keygen on seems like it's still packed, but with the additional text at the end, maybe they unpacked it and hacked it with softice, and then patched onto the end of the loader, hence the text at the end of the exe once cracked?
DaWsOn
04-18-2001, 03:10 AM
i finally gave up cracking it i got this
005ae4f3 61 popad
and set a breakpoint on it with bpm 5ae4f3 but softice didnt break when i re-run commander...so i used predator's crack..it works fine..
JimmyClif
04-18-2001, 03:15 AM
Dude! Go sit in the corner Bad Boy!

Alright, when using the crack, try at least finding out what he patches!

Save the wincommander.exe under a different name.. run the crack.. and do a byte compare on the original & patched one.. This gives you the offset! Disassemble the original search for the offset and [try] at least finding out what he did!
Fpc
04-18-2001, 09:02 AM
DaWsOn3k (04-16-2001 01:14):
i am trying to crack windows commander 4.5.2 any tutorial that u can suggest for that ??? don't forget i am newbie :)))

The tutor is right in you EmailBox.
i've just Crked it under a direction of a Tutor(Not in English.)
DaWsOn
04-18-2001, 02:31 PM
JimmyClif (04-18-2001 01:15):
Dude! Go sit in the corner Bad Boy!

Alright, when using the crack, try at least finding out what he patches!

Save the wincommander.exe under a different name.. run the crack.. and do a byte compare on the original & patched one.. This gives you the offset! Disassemble the original search for the offset and [try] at least finding out what he did!its so lame copying other's works like that ....
JimmyClif
04-18-2001, 03:05 PM
its so lame copying other's works like that ....

Excuse me???

what do you think what following a tut is? Don't you copy step by step what someone did before you?

It is not lame at all using your brain finding out what a cracker did by running his patch, imo! I even say that chances are higher to learn something as he has to find out how the code flows by himself.
DaWsOn
04-18-2001, 03:09 PM
JimmyClif (04-18-2001 13:05):
its so lame copying other's works like that ....

Excuse me???

what do you think what following a tut is? Don't you copy step by step what someone did before you?

It is not lame at all using your brain finding out what a cracker did by running his patch, imo! I even say that chances are higher to learn something as he has to find out how the code flows by himself.
no i disagree wtih you..as soon as all you and me know crackers use SoftIce i mean live approach technique to crack..they scroll down the code to find the protection routine..that time u learn everything not by see differences in the patched file...
JimmyClif
04-18-2001, 03:19 PM
Argh... ok... I give up.

use SoftIce i mean live approach technique to crack

that's not true.. you can use TRW or the Wdasm Debugger... hehehe..
without kidding: A disassembled listing && knowledge of the API Guide is usually enough...

they scroll down the code to find the protection routine

Where do you think he patched it? Wild guess: Maybe in the protection routine?
DaWsOn
04-19-2001, 02:20 AM
JimmyClif (04-18-2001 13:19):
Argh... ok... I give up.

use SoftIce i mean live approach technique to crack

that's not true.. you can use TRW or the Wdasm Debugger... hehehe..
without kidding: A disassembled listing && knowledge of the API Guide is usually enough...

they scroll down the code to find the protection routine

Where do you think he patched it? Wild guess: Maybe in the protection routine?
lame or not i check differences..guess what i see..more than 182 differences...i think that contains wincmd.key routine (proggie looks for that ) , protection routine , CRC routine and some routines to chande the title...lets mail predator to write a tutorial about it...what u say dudes?
Kilby
04-19-2001, 10:00 AM
Gentlemen,

It is not lame to learn from other peoples examples.

Wether it is a tut or looking at what somebody elses patch does.

What you need to do is learn why something was done.

If you use a tut it is explained for you.
If you look at what a patch does, you have fo figure it out for yourself.

The latter teaches you more, if you want to learn for real.

The only real way of learning techniques is to see them in action.

From there you can then look for a better way of carrying out the task in hand.

e.g.

I looked at r!scs technique for settlers 3 and used a similar technique for copylok loaders.

Is that lame ? You tell me !
But compiler & API attacks are valid techniques.

Right now I am going back to learning about ASProtect (yet again), due to recent changes.

I will use whatever valid info is out there, I may find a better way of doing things or possibly not.

But life is too short to trace every single line of byte of code, unless I have to.

The whole point is to;

Look for a weakness and exploit it, only if that fails, is it time to use brute force.
DaWsOn
04-19-2001, 12:16 PM
yeah seeing them in action is really good to be a real cracker..but as i mentioned in my msg there are too many differences in patched version..so i need to read more about ASpack as u....
Kilby
04-20-2001, 04:13 AM
Not aspack in my case but the tweaked version of asprotect (seems to be for the Russian market).

Theres some extra screwing about with the IAT :(
DaWsOn
04-20-2001, 01:31 PM
Kilby (04-20-2001 02:13):
Not aspack in my case but the tweaked version of asprotect (seems to be for the Russian market).

Theres some extra screwing about with the IAT :(man check h**p://rotaderp.cjb.net/
asprotect tutorial really worth a look..hope that can help :)
JimmyClif
04-20-2001, 01:42 PM
Hi all :D

I thought there was some IAT screwing going on too first, as my dumps didn't work... but somehow there's no need for idata saving...

load icedump
dd 551000 (where idata is located - currently there are 00 or ??)
bpx GetProcAddress
F12 until you see the idata filled up
bc *
F12 (probably a xor eax,eax)
[(here i dumped idata)]
F12 (wait! it parses for the next p ret - next break is at start of prog)
SoftIce breaks at push ebp
[idata changed? I dumped again to find out differences and maybe patch it together]
dump wincommander
use PEEditor with the dumpfix option
change caracteristics for code section to E0000020

done. Working dump. Until the CRC check pops in ;)

Kilby: [i]Not aspack in my case but the tweaked version of asprotect
>Are there different versions of WinCommander around?

Oh.. well... sorry for keeping this short... hope this helps someone :)
Fpc
04-22-2001, 08:36 AM
Well, maybe i am a lamer though i get my own ideas, next time i'll work out the KeyFile check.
ThrillSeeker
04-22-2001, 08:18 PM
DaWsOn (04-17-2001 17:10):
i finally gave up cracking it i got this
005ae4f3 61 popad
and set a breakpoint on it with bpm 5ae4f3 but softice didnt break when i re-run commander...so i used predator's crack..it works fine..

If you gain back, try using BPM 005ae4f3 X
instead. I read that in a another tutorial about aspack
JMI
04-24-2001, 12:48 AM
For those of you actually interested in reversing this program, I recommend that you review "Windows Comannder 3.02" by iNCuBus++ of 6 August 1997 on Fravia's site. It contains a discussion of the protection scheme which, with different addresses, is consistent with that discussed in BlackB's essay on v4.51.
Of even more technical interest, because it discusses a timebomb CRC check which was not addressed by BlackB, is the article "A Study in Methology" by +Indian_Trail. It can be found at h**p://www.cyberspy.com/~thesandman/Windowscommander.htm. It is a review of v4.01 using only Win32Dasm 8.9 and FileMon. He also discusses the decription code for the nag and help screens, which is partially discussed by iNCuBus++ as well. A search for wc32v401.zip (or change the last 3 digits and find other versions) will find +Indian_Trail's copy of the program to study and compare with v4.52.
The attempt to reverse v4.52 is my first project on the PC and I have begun by unpacking several of the packed versions and finding whether the code routines in the later versions are the same, although at different addresses, for those protection routines discussed in the essays. These locations can be found by searching in a dissambler for the op codes and/or hex values of the op codes and much can be learned, including how software authors, as opposed to protection writers, are not quick to make significient changes over time in their code for the basic protections. There appears to be little significient change in these routines between version 3.02 and 4.52.

Paraphrasing the addage: Give someone a crack and they have a program. Teach them to crack and they have "food" for a lifetime. If you start with an essay, search for others on other versions of the software. It is more likely that the packer/protection will change than the basic author's protection system.
Kilby
04-24-2001, 07:03 AM
Predators asprotect tut helps for 1.1 files.

But 1.2 has changed the game again

I know what needs to be done but it's finding a way, WITHOUT tracing the whole damn thing by hand.
JMI
04-24-2001, 03:45 PM
Maybe I'm missing something here, but by my observation Win Commander is packed with ASPack, and not ASProtect, and doesn't have the difficulties which I have read discussed with the ASProtect. For example, when the exe is unpacked and dumped, the IAT is not a problem and Revirgin was not required to make the program run from the dumped exe without changes. This was noted in the BlackB essay.

The "only" problems: Bypass the call to the key file, which BlackB and the others describe; Defeat the nag, which they all describe; Get your own name, etc. into the title of the main window, which +Indian_Trail and iNCuBuS++ describe; Defeat the two CRC checks, one immediate and one random, BlackB and iNCuBuS++ describe the first and +Indian_Trail the second; and, finally, find if there is still anything "new" keeping v4.52 from working like the "official" version.

+Indian_Trail's essay is particularly helpful because rather than giving the answers it provides a framework for understanding the protections and what code to look for which might be supporting them. For example if you are investigating a CRC issue you know that the code must be "read" by the routine that is processing the check and if it is to detect changes in the file, the "expected" result has to be in the file somewhere, anthough it could be encrypted. Studying the process by which +Indian_Trail located the code where this reading and checking had to occur led to his discovery of the routine which gave the final result for the first CRC check and the second and his discovery of the location of the "expected" result.

A wouldbe cracker, like me, can learn a great deal from these lessons, without spending hours tracing code of reading the disassembly from start to finish.
DaWsOn
04-25-2001, 02:44 AM
thnx for all your attention and answers on this topic..it helps me a lot..


Installshield V5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Installshield V5
PDA

View Full Version : Installshield V5

TR
04-16-2001, 09:44 AM
Hi !
How do I replace a file in the "_inst32i.ex_" file ? this file is extracted when I run setup.exe.
Scooby
04-17-2001, 07:40 AM
If you want to patch an installshield installation program, then you shouldn't try and modify any of the exe's or dll's. Instead look at the INS file and decompile that (with the various installshield decompilers around)
British
04-24-2001, 03:29 AM
Don't mess with that file. What you will always be after are the files
with *.z *.cab *.hdr *.ins.


HELP!! I am a totaly newbie at this.. HELP!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HELP!! I am a totaly newbie at this.. HELP!!
PDA

View Full Version : HELP!! I am a totaly newbie at this.. HELP!!

Maniak
04-17-2001, 03:56 AM
Hi,

I am totaly new at this..
I have aquired softice (win2k).
Can anybody tell me what the basics are to crack/hack a program..
I have made a simple program to test on.
Any info/sites about this would be helpfull..

Greetzzz

Maniak
DaWsOn
04-18-2001, 03:15 AM
firstly win2k may not be the right platform to crack..Win98 Se is the best i think..and h**p://zencrack2.cjb.net h**p://beam.to/BlackB h**p://kickme.to/sirdream would be a good start for ya...
Maniak
04-18-2001, 04:15 AM
Thanx... But why not Win2k?? What's the difference??
I have softice for win2k and for win9x..
And I have some software programming background..
But thanx for the warning ;)

Greetzzz

Maniak
DaWsOn
04-18-2001, 02:34 PM
in win2k you cant use " bpx hmemcpy" as you will see that breakpoint so much in tutorials so Win2k is not for newbie crackers in my opinion...
TonTon
04-18-2001, 09:22 PM
That's right.
Maniak
04-19-2001, 05:02 AM
Thanx.. I will switch to Win98se (I have winme!!)
The assembler part is easy (i have some programming background)..
But does anyone know where I can find a list of usefull breakpoints to use when cracking programs..
I have written down all breakpoints I found in the tuts but I think there are lots more where that came from ;)
I have checked for Windows API list on the Microshot site but I found nothing it is if microsoft want the list to be a secret ;)

Thanx for all the help and replies..

Greetzzz

Maniak
Zedr0n
04-19-2001, 09:18 AM
What concernes API reference, try http://win32asm.cjb.net; Downloads section. If you need the address, here it is: ftp://ftp.borland.com/pub/delphi/techpubs/delphi2/win32.zip

But I myself use MSDN, because it has information on all the functions, including API. :-)

MoreOver, this site containes the tutorials on win32asm. Maybe it will be useful to you.
Maniak
04-19-2001, 02:58 PM
I need the windows API's to find good breakpoints to use in softice..
Clandestiny
04-19-2001, 10:45 PM
Maniak (04-19-2001 12:58):
I need the windows API's to find good breakpoints to use in softice..

The ftp site ZedrOn gave you IS the direct download for the win32 API reference. D/l it and check it out :)

Regards,
Clandestiny


help me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help me
PDA

View Full Version : help me

ppbear
04-17-2001, 06:19 AM
Hi,I am a newbie in china.I know some knowledge about Assembler and c .I can write program with 'c' or 'assembel' too.I want to learn more about cracking. Please give some advice ! And tell me the url about SSG.

Thank you!
CaptRE
04-19-2001, 07:10 AM
Try to start at members.dencity.com\CaptRE....

Regadrs,
CaptRE


armageddasya
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > armageddasya
PDA

View Full Version : armageddasya

lex
04-17-2001, 12:44 PM
can anyone help me crack armageddasya (http://www.wegroup.org/cgi-local/load.cgi?downloads/armageddasya.zip)

prog has time lock and reg code.
None of the normal (getdlditemtexta) api function's seem to work on the serial insert box.
Can't make a dead listing of the program cause W32Dasm will crash. Can't use any file or reg monitor cause they are closed when you open the prog.

A weird thing too:
i found out that at one point (#0167:00410265), that if you actually fill some stuff in for the serial, EAX is compared with AC(hex) and if it's greater or equal you'll get the msg that serial was correct. The EAX value is there the length of the string that you entered.
So if you put in a LONG string (172 chars)(or change that JGE jump) it will say it's registered. Then it says it has to restart, but when you do, you get the same screen that says you have to fill in your serial.

someone have any clues?
Squidge
04-17-2001, 03:48 PM
Armageddasya is a compressed file with a mangled IAT.
It looks for any window with known monitoring programs such as "filemon", "regmon" and various others, and will kill any programs it finds that match. To proove this, type "notepad filemon.ppp" and say "Yes, create new file" and then launch Armageddasya, you'll find it shuts down notepad :-)

I've tried changing the name of Filemon's window to Snort, but it didn't work, so it obviously is scanning the process list as well or something like that. I'm not interested in the program so have no urge to crack it until I get bored.

You'll need to decompress it and find the original entry point.
lex
04-18-2001, 06:13 AM
do i have to do this manually or can i use a program for it, cause procdump gave an acces violation or something
Squidge
04-18-2001, 06:13 PM
do it with softice and then use a program to dump the result and fix the iat.
lex
04-18-2001, 06:21 PM
kay thanks :)


getting started with softice 4.05 nt/20000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > getting started with softice 4.05 nt/20000
PDA

View Full Version : getting started with softice 4.05 nt/20000

larry h
04-17-2001, 05:38 PM
Please I need help. I installed softice with no proublems so far, on win 2000. I also added the fix "ntice.sys" I have no video proublems with my ati 16 meg card. I have 256 meg of ram.
I just can't get pass the loader and the nms files that they talk about. IN THE LOADER I open the file
then try to translate. that's when I have the proublems.Want all do I need to get a exe file opened and translated to get the symbol loaded into softice.
Any help ,from anyone PLEASE!!!!!!!!
larry h
p:g:
05-03-2001, 07:33 AM
Your problem sound like a non corret making of .exe file.
Maybe you try to load an .exe file without the source file, I mean that you try to load an .exe file not made by you, in an workspace like Visual C++ or similar.


IMPORTANT !!!! JOIN teAm_Cracking (CRACKER, CODER, GFXer searched for)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IMPORTANT !!!! JOIN teAm_Cracking (CRACKER, CODER, GFXer searched for)
PDA

View Full Version : IMPORTANT !!!! JOIN teAm_Cracking (CRACKER, CODER, GFXer searched for)

PiTcH_SiLoW
04-17-2001, 07:10 PM
Wanna join teAm_Cracking !!?
Ok.

Just send me a Mail to:

PiTcH_SiLoW@gmx.de

Everyone is wanted !!!!
hz
04-17-2001, 08:49 PM
Oh yeah, me please, can I please, can I?
Kayaker
04-18-2001, 12:09 AM
Awww, Hz, I'm hurt. I thought you and me were going to create the bestest, coolest cracking group around!! ^_^

Yup, just what we need around here, more cracking, less reversing. (Sorry, acid tongue firmly implanted in cheek got loose)


New Boson exams :How do I Add Command line functionality to TRW2000 ????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New Boson exams :How do I Add Command line functionality to TRW2000 ????
PDA

View Full Version : New Boson exams :How do I Add Command line functionality to TRW2000 ????

Star Buck
04-18-2001, 10:00 AM
I'm trying to "Fix" the new Boson exams .
I've unpacked it manually with TRW2000 and it runs.
I've unpacked it with procdump and it runs.

One problem thought. When I look at the idata it it missing alot of msvbvm60 functions.. it looks as if it is incomplete. On previous versions that I've unpacked, everything looked fully unpacked and I could merrily search for the correct bytes to "FIX" . I suspect (from looking at the dlls that come with it that it probably is still zipped (unzip.dll) after unpacking and needs an argument after exe (hence the need for start menu shortcuts) to continue on .. unziping and then running.
Now IDApro4.15 chokes on the unpacked file (which does still run by it'self) and in Hiew only a small part looks unpacked.
I'm tyring to use TRW2000 to load the program so Ican follow it as it unpacks but as the exe needs an argument for it to run I can't get it working. After Neolite unpacks (JMP EAX) the exam terminates ("please use Shortcuts" blah blah blah)

How can I Load exe with it's argument using TRW2000??? I need to add command line funtionality ??

Can anyone offer any solutions or point me in a suitable direction ??

I'm very new to this but I learn quickly

Cheers

Star Buck
hz
04-18-2001, 09:59 PM
hiya,
there is one guy around here that could help you with this, he's K**** and I know he's been itching to take trw apart and add all sort of missing features. Cmon K give the guy a helping hand. Oh btw would you add cut and paste while your at it :-D
Kayaker
04-18-2001, 11:38 PM
hz (04-18-2001 19:59):
hiya,
there is one guy around here that could help you with this, he's K**** and I know he's been itching to take trw apart and add all sort of missing features. Cmon K give the guy a helping hand. Oh btw would you add cut and paste while your at it :-D

Heh, heh, funny guy ^_^ I still don't know why you want copy and paste functionality in TRW. Think I can't come up with impossible projects on my own? LOL

Anyway, since the gauntlet was dropped I thought I'd at least have a look at it. I tried loading a program I have which uses a command line argument with TRW. No go. Loading the file as a shortcut with the argument specified only brought up the main program. Specifically typing in the argument in that little edit box caused an error on loading. So I guess TRW doesn't support this directly.

However, is there any reason you can't set a breakpoint in TRW on some early call and just start the program from its shortcut with the command line argument intact? Since you're dealing with VB, I made up a little junk exe in VB5 and traced it in SoftIce. The very 1st Kernel call is GetStartupInfoA within the VB dll. Then I started TRW, entered it with Ctrl-N and set a BPX GetStartupInfoA. When I started my program again, TRW broke. From here you should be able to get back into program code. Actually, I guess you'll be dealing with Neolite code, in which case you just need to find an early call in it that you can set a BP on, GetVersion or GetModuleHandleA or something. Maybe even GetProcAddress, dunno, I'd have to check out how Neolite starts up. You won't be missing much of the unpacking code this way.

SoftIce however can support command line arguments which you can specify under Module/Settings, so you may want to try this with SoftIce instead. Sounds easier to me, I don't really do TRW much.

Sorry, that's all the help I can muster. No Ctrl-C, Ctrl-V today ;)

Regards,
K******
Star Buck
04-19-2001, 09:16 AM
Hi K******,

Thanks for the suggestions. I didn't realize SI supported command lines as I have had alot of problems in the past with softice crashing my PC . I've tried playing around with alot of things on my PC but invariably, it crashes, so I haven't used SI in quite awhile. I kinda like the fact that I can load /unload TRW on the fly. I guess it's time to revisit SI .

Once again, Thanks for responding

Cheers

star Buck


RCE Archive CD?????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RCE Archive CD?????
PDA

View Full Version : RCE Archive CD?????

Tex
04-18-2001, 02:38 PM
Does anyone know where i can get a copy of the RCE Archive CD? I've tried the U.S. contacts, but they either no longer burn the c.d.'s or don't respond.
qferret
04-18-2001, 03:29 PM
....sorry

/me grins sheepishly
JimmyClif
04-18-2001, 03:31 PM
?ferret:

ltns... I knew you were around :D


Unpacking a .DLL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking a .DLL
PDA

View Full Version : Unpacking a .DLL

KoKaINe
04-18-2001, 05:53 PM
Ive read some tuts about unpacking a .exe and have also unpacked a couple by my own. But now I have a packed .dll Ive coded a little asm program(below) that calls LoadLibraryA but I think it doesnt gets me to the entrypoint. The dll is attached to this msg. Any ideas? Can I use the symbol loader?

Thanks,
KoKaINe
---
.data
MsgCaption db "KoKaINe.br",0
MsgBoxText db "DLL Loaded!",0
DllName db "Common.dll"

.code
start:
invoke LoadLibraryA, addr DllName
invoke MessageBox, NULL,addr MsgBoxText, addr MsgCaption, MB_OK
invoke ExitProcess,NULL
end start
hz
04-18-2001, 09:50 PM
hiya,
good question, unfortunately NOone around here can unpack a .dll }>
Zedr0n
04-19-2001, 09:24 AM
You know, I myself, when I reversed CruddMe 3.0(look at http://crudd.cjb.net) done this way:

a) I dumped the dll using ProcDump;
b)Then reversed it with IDA, got the idea...
c)Then made a runtime patch(using the offset got from IDA).
d)Everything worked :))
Zedr0n
04-19-2001, 09:30 AM
And, by the way, if you want to use the symbol loader to debug the dll, you'd better take iceLoad for this from the IceDump Team page(http://http://ghiribizzo.virtualave.net/icedump/icedump.html). It allows you to load dll's. That's all.


Can Someone teach me or help me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Can Someone teach me or help me
PDA

View Full Version : Can Someone teach me or help me

Tak Tics
04-18-2001, 06:30 PM
Can Someone teach me or help me to hack and crack programs i really want to learn.
thanks alot
Tak Tics
04-18-2001, 07:22 PM
P.S. i new to this think i dont no not 1 bit of hacking but i really do want to learn and i haerd about softice is a good programe to use but i dont no where to download it, i have windows 95 so if u could help me get a download and show me how to use it i would be very greatful cheers c u later
DaWsOn
04-19-2001, 02:24 AM
Tak Tics (04-18-2001 17:22):
P.S. i new to this think i dont no not 1 bit of hacking but i really do want to learn and i haerd about softice is a good programe to use but i dont no where to download it, i have windows 95 so if u could help me get a download and show me how to use it i would be very greatful cheers c u later
go and download SoftIce from h**p://softice.tsx.org and read about how to use it at h**p://cracking4newbies.com and h**p://www.zor.org/krobar and h**p://beam.to/BlackB have phun


Win31 CDROM check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Win31 CDROM check
PDA

View Full Version : Win31 CDROM check

Win31 cracker
04-18-2001, 10:00 PM
Can anybody tell me how a CDROM check (label check, and so on) is made in the Win31 apps (DOS ints or APIs?)
[yAtEs]
04-25-2001, 06:54 AM
Win31 cracker (04-18-2001 12:00):
Can anybody tell me how a CDROM check (label check, and so on) is made in the Win31 apps (DOS ints or APIs?)

getvolumeinformation
getdrivetype
int 2fh


Flash 4 , Fireworks 3 , Dreamveawer 3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Flash 4 , Fireworks 3 , Dreamveawer 3
PDA

View Full Version : Flash 4 , Fireworks 3 , Dreamveawer 3

DaWsOn
04-19-2001, 03:50 AM
i cracked third of all by finding unlocking code w/ SoftIce it was too easy but now i need to un-register it so that i can work on a keygen for unlocking code...anyone knows how can i amke the proggie think that not-unlocked...and my second questions does anyone know a tutorial about macromedia keygenning ??...all answers are greatly appreciated...what a shame for macromedia....
DaWsOn
04-20-2001, 01:36 PM
yeah i found the solution go and delete HKEY_CLASSES_ROOT/ultextfile and proggie will think that u r not registered and re-start your evaluation ..but i still need tutorial for macromedia keygenning if u can help mail me at dawson3k@hotmail.com :)
LaptoniC
04-22-2001, 04:55 PM
If you are talking about the keygenin of Rsagent part, I made a generic keygen for Rsagent.You can download from http://zencrack2.cjb.net keygen section.Hope it helps.

LaptoniC
DaWsOn
04-23-2001, 06:47 AM
i can reach CrackZ's website can you send a copy of your tutorial to dawson3k@hotmail.com is it possible?..thnx in advance
DaWsOn
04-23-2001, 06:49 AM
i cant reach Crackz__'s website can u post a copy of it to dawson3k@hotmail.com..thnx in advance
Peacemaker
04-26-2001, 05:56 AM
I also would be interested in a copy of your tutorial.
Peacemaker_@gmx.net


Code Guide from Omnisoft
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Code Guide from Omnisoft
PDA

View Full Version : Code Guide from Omnisoft

mikey
04-19-2001, 05:30 PM
I have been using CodeGuide from OmniSoft, which is an excellent, but expensive ($300) Java editor and IDE. I have been looking all over for a crack or serial number and have so far failed to find one, so I thought I'd have a go at cracking it myself.

Please can someone have a look at it and point me in the right direction?

Thanks,

Mike
scoob
04-21-2001, 05:41 PM
Your not even going to do a slight amount of research on your own first? If it's a 30 day trial, try setting you clock forward about 35 days and saying exactly what it says - is it a demo ver? Full ver with day limit? Need a license key (flexlm? etc) flexlocked? etc, etc

need more info :)


n e 1 willing to teach me RE please e-mail me!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > n e 1 willing to teach me RE please e-mail me!!
PDA

View Full Version : n e 1 willing to teach me RE please e-mail me!!

ShadowhacK
04-22-2001, 10:20 AM
n e 1 willing to teach me RE please e-mail me!!
CoDe_InSiDe
04-22-2001, 11:37 AM
Hi ShadowhacK,

I don't think that anyone is going to mail you ;)
Try to learn from the Resources spread over the Internet :)

Cya...

CoDe_InSiDe
CoDe_InSiDe
04-22-2001, 11:38 AM
Hi ShadowhacK,

I don't think that anyone is going to mail you ;)
Try to learn from the Resources spread over the Internet :)

Cya...

CoDe_InSiDe


Softice Install! Need Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice Install! Need Help
PDA

View Full Version : Softice Install! Need Help

F1DT
04-22-2001, 03:56 PM
Hi I am very new to all this and wish to install softICE
but have no Ideai how to do it or want i need.
I have downloaded it but don't know how to Install it.
I downloaded it with Gozilla, which give me 4 zip files which i unzipped. There is now 1 file in each folder which i can not open, and i have no setup.EXE files.The files i have opened are devotion, file_id, firesite, MFD, ULS, all in notepad but the file which i can not open is mfdsi45.r01 which must have the setup.EXE file in it, this is the same in all 4 folders.
sinn0r
04-22-2001, 04:03 PM
maybe you need SoftICE? :)

and no, i'm not telling you where to download it, find it yourself. }>
Scoob
04-22-2001, 05:04 PM
Running the provided "Setup.exe" normally does quite a good job of installing the program for you :)
hz
04-22-2001, 06:05 PM
Hiya F1DT,
you don't make it clear, have you got softice and need help installing/setting up or are you asking where you can find it?. If you are asking where you can find it, I'm afraid I can't tell you because I don't know. If its help setting up then can you be more specific about the problem.

regards
hz
F1DT
04-22-2001, 06:13 PM
I downloaded it with Gozilla, which give me 4 zip files which i unzipped. There is now 1 file in each folder which i can not open, and i have no setup.EXE files. The files i have opened are devotion, file_id, firesite, MFD, ULS, all in notepad but the file which i can not open is mfdsi45.r01 which must have the setup.EXE file in it, this is the same in all 4 folders.
ThrillSeeker
04-22-2001, 08:14 PM
Read how in Tools of Trade.
Clandestiny
04-22-2001, 11:03 PM
F1DT (04-22-2001 08:28):
Hi I am very new to all this and wish to install softICE
but have no Ideai how to do it or want i need.
I have downloaded it but don't know how to Install it.
I downloaded it with Gozilla, which give me 4 zip files which i unzipped. There is now 1 file in each folder which i can not open, and i have no setup.EXE files.The files i have opened are devotion, file_id, firesite, MFD, ULS, all in notepad but the file which i can not open is mfdsi45.r01 which must have the setup.EXE file in it, this is the same in all 4 folders.

Hi F1DT,

Well you're about halfway there ;) Extracting the 4 .zip files is certainly the first step.
These 4 .zips should be

1)mfdsi45a.zip
2)mgfdi45b.zip
3)mgfdi45c.zip
4)mgfdi45d.zip

Looking inside you're newly unzipped folders you should now see some files with extensions like .rar, .r00, .r01, ect. You mention the mfdsi45.r01, but there should be more; 4 to be exact and they should be numbered sequentially.

1) mfdsi45.rar
2) mfdsi45.r00
3) mfdsi45.r01
4) mfdsi45.r02

These files, known as rar files, are actually compressed archives like .zip files but different in the sense that all of the small files (volumes) are extracted into one large file using an unpacker like WinRar. You will wish to begin the extraction process with the .rar file (I shouldn't have to mention this but for the sake of thouroughness make sure all of the rar files are in the same directory). Once begun, it will then continue sequentially unpacking each volume in the rar archive until you reach the last volume (in this case .r02). Upon complete extraction you should have the SI405w9x.exe file. This is your setup file for the SICE installation and you can follow the instructions from there.

Might I also add that it would be a very good idea for you to download some tuts on SICE's configuration as you'll need to modify both your config.sys and autoexec.bat files (and possibly tweak your winice.dat). There are a number of tuts that explain these things in detail and you should begin your search right here with the local +fravia search engine followed by a visit to +Sandman's SoftICE Resource Center.

You've got a LONG journey ahead of you mate ;)

Good Luck :-)

-Clandestiny


cd-key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > cd-key
PDA

View Full Version : cd-key

newBorn
04-23-2001, 03:29 AM
Does any one know how to crack a cd-key for a game. Are there a tutor or something for this.
TonTon
04-23-2001, 07:40 PM
newBorn (04-22-2001 17:29):
Does any one know how to crack a cd-key for a game. Are there a tutor or something for this.

Stupid!!! read.


a question by newbie.. please refer me to the right tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > a question by newbie.. please refer me to the right tutorial
PDA

View Full Version : a question by newbie.. please refer me to the right tutorial

spathi
04-23-2001, 06:14 AM
Hi

I was wondering if there's any way to *edit* some progy. Let me explain ;

This progy sends a *string* to some website, and i was wondering if i could change that string into somethin else. I've successfuly done that with hex editin, but the problem is that the string i want to replace the original with is longer than the original. Is there anythin i could do about it ?

I guess this task involves some advanced crackin or am i wrong ?

Can anyone be kind and refer me to the right tutorial ?

thanx in advance

/spathi
NOBODY
04-23-2001, 09:51 PM
spathi (04-22-2001 20:14):
Hi

I was wondering if there's any way to *edit* some progy. Let me explain ;

This progy sends a *string* to some website, and i was wondering if i could change that string into somethin else. I've successfuly done that with hex editin, but the problem is that the string i want to replace the original with is longer than the original. Is there anythin i could do about it ?

I guess this task involves some advanced crackin or am i wrong ?

Can anyone be kind and refer me to the right tutorial ?

thanx in advance

/spathi

With Hexedit find a some space where your "new" string will fit either an Island of zeros or some irrelevant string, write it there, zero terminated.
Then figure out the place where your program passes the address of the old string into the sendout subroutine, and shamelessly change that address to point to your new string, cross your fingers and run.
spathi
04-24-2001, 12:24 AM
Thank you, but do u know any tutorials which i could use to practice this ? i'l very new to all that.

thanx again ;>
[yAtEs]
04-25-2001, 07:07 AM
spathi (04-23-2001 14:24):
Thank you, but do u know any tutorials which i could use to practice this ? i'l very new to all that.

thanx again ;>

add the winsock dll to ur softice, BPX SEND then in ur exe edit the offset which is pushed to the string to send.

yates.


Unpacking without SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking without SI
PDA

View Full Version : Unpacking without SI

Hoof Arted
04-23-2001, 07:10 AM
Does anyone know of a tutorial that shows how to unpack files without softice?
beierno
04-23-2001, 12:01 PM
Hmm your question is a little bit tricky.
I guess you mean unpacking with only a deadlisting at hand.

If thats correct you will have problems. You see, the program needs to be unpacked so that you can dump the unpacked program. You dont get much out of looking at the packed program in a disassembler.

Hope that helped. I'm far from an expert so dont rely to much on this one.
anTiHerO
04-23-2001, 01:33 PM
It is possible to unpack without softice, using unpacking utilities such as ProcDump, but I would advise against it, cos you are denying yourself the chance to learn how the protection code works!


Crackme without the usual jumps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crackme without the usual jumps
PDA

View Full Version : Crackme without the usual jumps

The Diver
04-23-2001, 04:31 PM
I have written a little Crackme which should test your ingenuity pretty well. It is written with Microsoft turn-your-computer-into-a-toaster V6.0 (Visual Basic). You need to supply a password but it does not work the way you probably expect and could turn out to be much harder to crack than expected!

Get the crackme from:
http://www.arrakis.es/~ajr

Good luck!

PS. If noboby manages to crack this within a month I'll supply the source code so that you can see how the hell the thing works. (Assuming enough people have actually tried to crack it).
vReal
04-23-2001, 11:19 PM
Hi.

Very nice crackme.
I've got the correct password but did not crack the algorithm.
I used a somewhat brute force attack. I will continue pondering
the algo but look forward to the source.
The Diver
04-24-2001, 12:06 AM
I have just read your reply and seen that you did in fact use a brute force attack. I could quite easily increase the size of the password. It is rather short to protect the program but the algorithm is, as you say interesting.

As you liked it I will, willingly publish the source once enough people have though about what I did. We are here to learn after all. The method is pretty subtle.
vReal
04-24-2001, 02:22 PM
Hi.

I said I used a "somewhat" brute force attack because with even a short password, a standard brute force approach would take way too long. Your current password has 1.400288544882e+73 possibilities. I have created a corresponding lookup table for all keys so even if you increase the password length to 50 chars, it will still take less than one hour to achieve.

However, I still believe the real challenge is to decipher your clever algorithm :)

I'm still working on that. Later.
The Diver
04-24-2001, 04:20 PM
I have put a new version on the web page which stops brute force attacks without first patching the code. The algorithm is in fact a little less complex and better.

Try cracking it again.
vReal
04-25-2001, 02:25 PM
Hello.

I've dl'ed and began work on 2nd crackme.
I have decrypted a 15 char password but it does not seem to work the same as the last 6 char pass worked in crackme 1. You have successfully added a new twist to the program that has me stumped for the moment :) I did not patch the brute force check you've added (I'm just living with it).

Good job & I hope others are enjoying it as well.

vReal
The Diver
04-25-2001, 02:51 PM
Remember what I said about not the usual jumps well you have just got to it. In the first crackme there was a fundamental error which made it easy to crack - the usual jump - oops - I compiled a preliminary version by accident. In this one after the password is XORed have a look at the nearest following proceedure call to a Windows API. Check the registers for the parameters held there and then think a little more. It is a very special API.

I think that other crackres would like to know how you have managed to do what you have done so far and which tools you have used.

Stump the brute force protection by NOPing the call to ExitWindowEX.
vReal
04-25-2001, 11:21 PM
Hello.

I have the correct password now. From the clues that you gave me, I was able to determine that the 15th char of the password needed to be changed from 0 to 6. I must admit that this was a challenging crackme and I'm not sure if I could have completed it with out the hints. Thanks for your time. Again, at the end, please post the source code.

vReal
The Diver
04-26-2001, 05:08 PM
SOURCE CODE - If you send a little tutorial about how you cracked this it could help a lot of people.

Private Sub CheckPassword_Click()
Dim X&, Y&, Z&, J&, I&, P&
Dim Stri$, Char$, iHwnd$
Static Rt As Byte
'Password for x = "#128-*AGF987150"
'Real Password for text box = "#128-*AAF987150" NOTE THAT IT IS DIFFERENT AFTER THE XOR YOU WILL GET A DIFFERENCE OF 6
'Encrypted password = ¹¨ª¯»¿ÕÔÔ¨¨¸¿¸¼
Y = Len(Text1.Text)
'Encrypt the password This is what you followed in memory. You failed at first as this is the "-6" password
For X = 1 To Len(Text1.Text)
Char$ = Mid$(Text1.Text, X, 1)
P& = Asc(Char$) Xor 155 - X
Stri = Stri + Chr$(P&)
Next X
'The password must be fifteen characters long Y = 15
'Pad out the password
If Y > 15 Then iHwnd = "¹¨ª¯»¿ÕÔÔ¨¨¸¿¸¼" + Space$(Y - 15)
If Y <= 15 Then iHwnd = "¹¨ª¯»¿ÕÔÔ¨¨¸¿¸¼"
'IF it is OK make Z = 6 This is used as a parameter for SendMessage
For X = 1 To Y
I = Asc(Mid$(iHwnd, X, 1)) Xor Asc(Mid$(Stri, X, 1))
Z = Z + I
Next X
'You could add a comparison of the two strings to cause another false trail here.
'NOW REPEAT THE SAME AND MAKE P=1
P = Z - 5 'Make P = 1
R = Z 'Globally remember the value of Z ie 6.
'If you directly call the API showwindow on the second handle the window will display and then disappear if R <> 6
X = SendMessage(Form2.hwnd, Z, P, Form2.hwnd)
'If Z = 6 and P = 1 we have sent a Activate window message.
'This message is generally sent after OpenWindow. In this case it is the Activate procedure in VB which
'displays the window using SetWindowPos rather than ShowWindow or the VB command Show.
'The password was not OK
'X = 0 is the API fails
If X = 0 Then X = MsgBox("Try again!", vbExclamation + vbOKOnly, "BETTER LUCK NEXT TIME!")
'show the message
Rt = Rt + 1
'Too many tries so Reebot the system
If Rt > 3 Then X = ExitWindowsEx(4 Or 0 Or 2 Or 1, 0) 'FAILED THREE TIMES SO SHUT DOWN WINDOWS
Text1.SetFocus
Text1.SelStart = 0
Text1.SelLength = Len(Text1.Text)
End Sub

Private Sub Quit_Click()
End
End Sub

Private Sub Form_Load()
Text1.SelStart = 0
Text1.SelLength = 9
Label4.Caption = "Handle of This Window: " + Hex$(Me.hwnd) + "h" + Chr(10) + "Handle of Second Window: " + Hex$(Form2.hwnd)
End Sub

'***************************** SECOND FORM *************************
Private Sub Form_Activate()
'This was called via the SendMessage API and not by Visaul Basic
Dim str$, X&
'Show the window using SetWindowPos rather than ShowWindow or the VB Show command.
X = SetWindowPos(Me.hwnd, HWND_TOP, 150, 150, 0, 0, SWP_NOSIZE Or SWP_SHOWWINDOW)
'Well done friend encrypted
For X = 1 To 20
Char$ = Mid$("Ìþ÷÷»ÿôõþ»öâ»ýéòþõÿº", X, 1)
P& = Asc(Char$) Xor 155
str = str + Chr$(P&)
Next X

Label1 = str
Form1.Command1.Enabled = False
'This window was not called by our API so close it
If R <> 6 Then Me.Hide
End Sub

'********************* THE BAS FILE *****************
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Public Declare Function SetWindowPos Lib "user32" (ByVal hwnd As Long, ByVal hWndInsertAfter As Long, ByVal X As Long, ByVal Y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long) As Long
Public Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long

Public Const HWND_TOP = 0
Public Const SWP_NOMOVE = &H2
Public Const SWP_NOSIZE = &H1
Public Const SWP_SHOWWINDOW = &H40

Global R&


I'm looking for a SUB7 documentation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I'm looking for a SUB7 documentation
PDA

View Full Version : I'm looking for a SUB7 documentation

meserie
04-23-2001, 05:53 PM
I'm looking for a SUB7 documentation. I want to corespondate with peoples interest by this program. My e-mail is ssuubb7@yahoo.com

Thank you!
DaWsOn
04-27-2001, 02:02 AM
this is not a hack forum...this is a reverse-engineering forum..go and visit h**p://www.blackcode.com


Reversing notepad.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reversing notepad.exe
PDA

View Full Version : Reversing notepad.exe

Gimmee
04-24-2001, 12:03 AM
Hi all

Just going through the tut by neuralnoise (tuts at work) i think it was on reveersing and adding menus etc to notepad.exe.

He says about adding code to the reloc section. When i look at this section under winice it just shows invalid. If i try and assemble the code there nothing happens. Softice shows i am in the correct section but no go.

I am doing the notepad.exe on win98 but i think the one in the tut is for win95, does this make a difference?

Haven't really done much reversing before, just stuck to cracking so any help or hints u can give me on adding code at the end of sections will be mostly appreciated.

thanks

gimmee (new zealand)
stillnewbie
04-24-2001, 05:34 AM
Gimmee (04-23-2001 14:03):
Hi all

Just going through the tut by neuralnoise (tuts at work) i think it was on reveersing and adding menus etc to notepad.exe.

He says about adding code to the reloc section. When i look at this section under winice it just shows invalid. If i try and assemble the code there nothing happens. Softice shows i am in the correct section but no go.

I am doing the notepad.exe on win98 but i think the one in the tut is for win95, does this make a difference?

Haven't really done much reversing before, just stuck to cracking so any help or hints u can give me on adding code at the end of sections will be mostly appreciated.

thanks

gimmee (new zealand)

Hi gimmee,
yes,there are difference in win98 and 95
if you want 95notepad mail me.I'll send it ro you ;)
stillnewbie_b@hotmail.com
regards
stillnewbie


Is it possible to save a code window output in SICE while F10, F8?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is it possible to save a code window output in SICE while F10, F8?
PDA

View Full Version : Is it possible to save a code window output in SICE while F10, F8?

neviens
04-25-2001, 01:41 PM
Unfortunately one application what I deal with:
1. crashes WDASM,
2. checking routine doesn't appear in DeDe (it's a Delphi app),
3. I can step through this routine in SICE, but it's complicated
with alot of calls and variables (serial and username retrieving
from register, some math etc.).

So here becomes subj. And yes, I know about a paper and pen :),
but seems it's not a case.
Neviens.
Clandestiny
04-25-2001, 03:53 PM
neviens (04-25-2001 03:41):
Unfortunately one application what I deal with:
1. crashes WDASM,
2. checking routine doesn't appear in DeDe (it's a Delphi app),
3. I can step through this routine in SICE, but it's complicated
with alot of calls and variables (serial and username retrieving
from register, some math etc.).

So here becomes subj. And yes, I know about a paper and pen :),
but seems it's not a case.
Neviens.

Hi Neviens,

First, is the proggy packed ? That could be one possiblity for your disassembly probs.

Second, I'm not sure I understand your question. Is it possible to save a code window output in SICE ? Well, if you're asking what I think you're asking then it is possible. You can use icdump's /screendump command to save the the current window in SICE to a text file.

BTW, whats the target ?

Regards :-)
Clandestiny
neviens
04-26-2001, 04:09 AM
Hi Clandestiny,

I'm working on unpacked copy (UPX) of Delphi database application
(BDE, .dbf files, etc., etc.) but, seems, there is a bug in code
(not related to checking) that chrashes dizassemblers.
Thanks for tip about icedump - it works as I wanted!

Neviens.


30 day trial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 30 day trial
PDA

View Full Version : 30 day trial

erty
04-25-2001, 04:05 PM
can anyone explain how
30 day trail protection work?
CoDe_InSiDe
04-26-2001, 12:32 AM
Hi erty,

In most Programs it's checked with the current System Time and Date :)
Try to break on

GetLocalTime
GetSystemTime

Hope this helps...

Cya...

CoDe_InSiDe


help 4 si 3.24 w/win98...............please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help 4 si 3.24 w/win98...............please
PDA

View Full Version : help 4 si 3.24 w/win98...............please

tinman
04-25-2001, 08:41 PM
when i hit ctrl-d si pops up but then i lose control of my mouse & none of the command keys work any longer. i cannot exit back to windows, i'm locked into the si window w/reboot being my only known option out. i've tried every thing i could find in the tutorial dept. and nothing has worked so far. i'm a newbie but i know there has to be a way to resolve this. any help would be greatly appreciated
Kayaker
04-25-2001, 11:58 PM
Hi,

This is a problem with all versions of SI it seems. You have to be really careful not to move your mouse just as you enter SI, either via a break or Ctrl-D.

You probably see that little copy/paste window pop up. Usually if you deliberately click your mouse several times and hit Ctrl-M it *sometimes* restores itself. I also find hitting enter or Ctrl-C, to try to force focus back to the command window helps as well.

Try keeping your hand off the mouse and see if that helps.

Kayaker


How to crack the flash5's cd-kay????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to crack the flash5's cd-kay????
PDA

View Full Version : How to crack the flash5's cd-kay????

jekay
04-26-2001, 11:48 AM
I want knowe the answer.
Reply me,OK?
DaWsOn
04-27-2001, 01:58 AM
there is no need to crack Flash5's cd-key. i have made a crack for trial version which doesnt need any serial.even Flash gives you a valid serial :))))


how do i use SICE to do what i want to do with programs written in VB
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how do i use SICE to do what i want to do with programs written in VB
PDA

View Full Version : how do i use SICE to do what i want to do with programs written in VB

yobo
04-26-2001, 01:50 PM
would someone please point me in the right direction? I'm newer than a newbie. I have figured out how to use SICE in order to find what I'm looking for in some programs, but I haven't been able to unlock the secrets when it comes to programs written in VB. None of the usual bpx work with VB. I just need some good advice. I'm also looking for some up-to-date tutes. I would be forever grateful if someone could point me in the right direction. Thanks to those of you who wish to help me. Once I know enough to help I will also help others.
vReal
04-26-2001, 02:37 PM
Hi.

A good place to start is here: http://vipatcher.cjb.net/ Go to the tutorial section and read the ones that use softice and smartcheck.

Good luck,
vReal


bpx GetProcAdress
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > bpx GetProcAdress
PDA

View Full Version : bpx GetProcAdress

DaWsOn
04-27-2001, 10:15 AM
topic : Aspack :)

Question :when I try to breal on GetProcAdress with "bpx GetProcAdress" it says "symbol not defined" should i add an extra line to winice.dat to use that bpx?
any suggestion ?
p.s: i am using SoftIce 3.24 on Win98 SE
and SoftIce 4.05 on Win2k both have the same problem....
noname
04-27-2001, 10:42 AM
DaWsOn (04-27-2001 00:15):
topic : Aspack :)

Question :when I try to breal on GetProcAdress with "bpx GetProcAdress" it says "symbol not defined" should i add an extra line to winice.dat to use that bpx?
any suggestion ?
p.s: i am using SoftIce 3.24 on Win98 SE
and SoftIce 4.05 on Win2k both have the same problem....

Hiya,
check your winice.dat compare the difference

EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
EXP=c:\windows\system\shell232.dll
EXP=C:\windows\system\advapi32.dll
EXP=C:\windows\system\vb40032.dll
EXP=C:\windows\system\msvbvm50.dll
EXP=C:\windows\system\msvbvm60.dll
EXP=C:\WINDOWS\SYSTEM\KERNEL32.DLL

More about how to config softice
http://www.idca.com/~thesandman/SoftPage.html
check this out :)
JimmyC
04-27-2001, 10:59 AM
Maybe it's a typo.

bpy GetProcAddress

(2 d & 2s )

I believe you well commented out the kernel32 line.
noname
04-27-2001, 11:08 AM
JimmyC (04-27-2001 00:59):
Maybe it's a typo.

bpy GetProcAddress

(2 d & 2s )

I believe you well commented out the kernel32 line.

Hi JimmyC,
Could be I didn't notice it :P
*G*
noname
DaWsOn
04-27-2001, 01:04 PM
none of them worked..any other idea ????
*DaWsOn*
04-27-2001, 02:45 PM
JimmyC you are right....

Right syntax is bpx GetProcAddress with double d...Thnx again :)


MANUAL UNPACKING
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MANUAL UNPACKING
PDA

View Full Version : MANUAL UNPACKING

Ceno_2k
04-27-2001, 11:54 AM
NEED HELP WITH MANUALLY UNPACKING ASPACK protected programs.

Can dump the program ,using the JMP EIP tip ,but need help in rebuilding the import tables.

I done a tut by TORN@DO explaining that you have to EIP+ over a call ,so that windows can ,create the import table ,and not the packer.

Can anyone give me and explanation on how to do this?

Thanks guys
tsehp
04-27-2001, 02:37 PM
I moved your request to the newbie forum.
btw, you should read other tutorials, search for iat words.
good luck
anTiHerO
05-13-2001, 04:32 PM
i've mailed you a couple of essays i have written

hope they help!

if for some reason you dont get them, they can be found at;

http://clix.to/antiher0


softice blues
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice blues
PDA

View Full Version : softice blues

tinman
04-27-2001, 04:56 PM
have uninstalled si 3.24 and installed 4.01 and am still having lock up trouble. when si window opens, lose mouse control and command keys. only known exit is reboot. can someone please help me?
thank you
Kayaker
04-27-2001, 11:47 PM
Hi,

I replied to your earlier post on this. I take it it didn't help?

Kayaker
tinman
04-28-2001, 11:50 AM
yes, i tried your suggestions from my last post but it did not help. that's when i decided to uninstall 3.24 and install 4.01 in an attempt to see if it was just the ver. of si i was tryint to use, ver. 4.01 installed easily and started fine with ctrl-d then f5 to drop back to win but when i open a program to use si with, then hit ctrl-d si opens but mouse and command keys are history. i have searched the web for hours and have consulted hundreds tutorials and faqs. i have tried every suggestion, including yours that i could find and nothing works. do you think this could be a software issue with my type of pc (hewlett packard pre-loaded w/windows 9x)? thanks
tinman
04-28-2001, 11:51 AM
sorry........posted same message twice
Clandestiny
04-28-2001, 07:10 PM
Hi tinman,

Sorry to hear about the problems. It is unlikely that they are due to a software issue with your OS. Nevertheless, you could try to reformat and install SI on a clean hd (though I know its probably a less than desirable course of action). Also, have you considered possible hardware incompatiblity problems with SI for your keyboard and mouse ? If you have easy access to another keyboard / mouse of a generic variety I'd try plugging them in and see what happens...
Admittedly a no brainer solution ;) but you never know.

Regards,
Clandestiny


Is it possible to crack a DX plugin with SI?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is it possible to crack a DX plugin with SI?
PDA

View Full Version : Is it possible to crack a DX plugin with SI?

Benwaw
04-28-2001, 08:23 PM
Is it possible to crack a DX plugin with SoftIce? I'm just a humble newbie and am just starting out and am trying to crack some DX plugins made for Cakewalk. The fact that the plugins run UNDER Cake makes me wonder if SI is gonna work....I have W32Dasm as well and am diligently learning but most of the tutorials I've seen are vague to say the least. Like they're written in French and then translated to English later or something. One thing's for certain: I've never seen a tutorial that didn't get me lost. Thanx for any help!
DaWsOn
04-29-2001, 02:14 AM
try tutorials at h**p://www.hackersclub.com ..they are really easy for a newbie...
Benwaw
04-29-2001, 11:29 AM
Ahhh HAAAAAAA!!!!! I just cracked my 1st program!!!! It was one of those DX Plugins I was talking about. Actually, it's the newest one of the company's that I cracked. I used W32Dasm and got it just fine. Now I'm trying their other plugs. Their Mastering Compressor, Mastering EQ and CompressorX give me a crash when trying to disassemble the .ax file. Crashguard gives me the details (CompressorX) as such:
Windows 98 Version 4.10.1998
W32DSM89.EXE caused fault #c0000005 in W32DSM89.EXE at address 0177:004a5a73

Registers:
EAX=05214fc6 CS=0177 EIP=004a5a73 EFLGS=00010203
EBX=0078c58c SS=017f ESP=0078bce8 EBP=0078bcf0
ECX=00000007 DS=017f ESI=00dccfef FS=5da7
EDX=00000056 ES=017f EDI=05214ffe GS=0000

Bytes at CS:EIP:
f3 a5 8b ca 83 e1 03 f3 a4 5f 5e 5d c3 55 8b ec

Stack dump:
00000000 00000056 0078bd14 0045ecd9 05214fc6 00dccfb7 00000056 00000001 0000de7a 0078c58c 0078bed8 0078bfa8 004587c8 0078c58c 00dccfb7 00000030

Anyone know why W32Dasm fails on these files? If not, does anyone know how in hell's half acre to use SoftIce on these?
DaWsOn
04-29-2001, 11:39 AM
it may be packed..learn about unpacking.. http://www.discompress.com is good start
Benwaw
04-29-2001, 02:59 PM
Thanx 4 the info, mahn....
Benwaw
04-29-2001, 03:06 PM
Those .ax files that crash open fine in HIEW and look normal. It's just WinDasm that's freakin'....
DaWsOn
04-30-2001, 12:09 AM
thats a usual packed proggie..u cant disassemble it before u unpack it...have phun


FlexLM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FlexLM
PDA

View Full Version : FlexLM

Basil
04-29-2001, 07:13 PM
At me is CD-Roms ,licenses
I offer exchange

Altera Quartus 2000
Cadence IC, Orcad 9.2 Full, Specctraquest,Specctra,Allegro
Avant!Hspice 99 , 2000 Win and Sun KeyFlexLM
Accel PCAD Master Designer v8.7
ACTIVE HDLv4.1 v4.2.876 4.2 906
Ansoft PCB/MCM, Serenade, Essemble
Translogic HDL
AutoELECTRIC v2000
Cadsoft Egle v4.0
Denali Memory Modeler v.27 v2.8
E PLUS MAX v10.0
SynopsysMemPro
ModelSim Mentor KeyLegalFlexLM( not host ethernet)
Renoir Mentor
FPGA Advantage 4
Cadstar 4.5
HDS Designer Mentor
FPGA Compiler II Altera Edition
FPGA Compiler II Express Edition
FPGA Compiler II
HFSS v5.6
Synapticad Allproducts v7.1c
Veribest and etc.

Regards
next
05-04-2001, 04:02 AM
hi:
have you synplify6.2's crack?


Newbie: how does a prog detect it has been modified ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Newbie: how does a prog detect it has been modified ?
PDA

View Full Version : Newbie: how does a prog detect it has been modified ?

xfission
04-30-2001, 08:28 AM
Hello

I am currently trying to crack a program of which the demo is protected by an expiration date. Using IDA i think i have the point where the conditional jump is done. The problem is that the prog is detecting a modification (NOPing out the jump) to itself and aborting startup with the sound of a Win critical error.
Correcting the PE checksum with PESUM results in a runtime error when starting up the prog.
(It seems to have been written in Delphi 1.0 according to IDA.)

Any suggenstions ?

Anyone aware of a tut on the topic ?
Should i look for the place where the sound is played ? (which API ?)
Is this a standard protection for which a standard <g> workaround exists ?

Many thanks in advance !
Xfission
+SplAj
04-30-2001, 09:46 AM
Hi.... in such cases the best way is to set (in SI) a BPM 'memory_I_replaced' r in the ORIGINAL file to see what happens. Like the new ASprotected targets there is a HUGE checksum algo loop that if you change one byte some code does not get decrypted. So you have to trace to the end of the routine and find out what SHOULD happen to the crc result
and emulate it ;)

.....for example... I know the bytes to patch are around VA 187:00542110 (~ raw 142110) . Then I would set a bpm 187:542110 R and press F5 . Then hopefully I am in the middle of the checking routine ! So trace it and emulate it.

side note:-
the CS register is a clue what OS you are running ;) 167:=Win98, 187:=Win ME, 1B:=WinNT/2K

Hope that helps

SplAj


VB P-Code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB P-Code
PDA

View Full Version : VB P-Code

Acid_Cool_178
04-30-2001, 09:39 AM
http://www.AcidCool.cjb.net

Enter the P-Code section

And how is it possible to enable one button, I have made some crackers for VB P-Code....

Acid_Cool_178
pupp
05-01-2001, 05:11 AM
Greetings,Acid_Cool_178

I just stoped by your site Great looking but there are a few Dead links ,like to download all tuts and some Serial fishing, maybe you might want to check it out.

Have a Great Day!!

pupp


Masm32.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Masm32.exe
PDA

View Full Version : Masm32.exe

pupp
05-01-2001, 04:00 AM
Greetings
I am looking for the Masm32.exe a while back i Beta tested it but i seem to have lost it somewhere :-( If any one could help me would be great
TIA
CoDe_InSiDe
05-01-2001, 04:07 AM
Hi pupp,

Try this:

win32asm.cjb.net

Cya...

CoDe_InSiDe
pupp
05-01-2001, 04:47 AM
Bingo thats what i was looking for

Thanks

pupp


unpacking & registering, please help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking & registering, please help
PDA

View Full Version : unpacking & registering, please help

WlAda
05-01-2001, 12:57 PM
Hi,

target:AED Tools
h**p://www.superdownloads.com.br/download.cfm?stats=7601

program is packed and protected by
ASProtect (? maybe that's why one section name is .aspr)
Program was unpacked and IT was rebuilt
(thank's go to revirgin [+Thesp])
OEip=4633e6 IAT begin at RVA 66000

Now it seems to me that the program is only demo version which can't be registered. The test on address 41c569
gives always the same result because the local variable (ebp-10h) is set to the constant value regardless of any check
(reg./not reg) => dialog with unregistered
message is always displayed. The original unpacked version look into win registers for item named Key. It's here possibility
that the code of unpacker can unpack 2 different versions (reg./not reg) of program ?

subroutine of unpacked program:

0041C4F0 push ebp
0041C4F1 mov ebp, esp
0041C4F3 push 0FFFFFFFFh
0041C4F5 push offset aXig ; "+xdG"
0041C4FA mov eax, large fs:0
0041C500 push eax
0041C501 mov large fs:0, esp
0041C508 sub esp, 88h
0041C50E push ebx
0041C50F push esi
0041C510 push edi
0041C511 mov [ebp-88h], ecx
0041C517 mov dword ptr [ebp-10h], 6 (!)
0041C51E mov eax, [ebp-88h]
0041C524 cmp dword ptr [eax+800h], 1
0041C52B jnz short loc_41C542
0041C52D mov ecx, [ebp-88h]
0041C533 mov dword ptr [ecx+804h], 1
0041C53D jmp loc_41C85D
0041C542 ; ---------------------------------------------------------------------------
0041C542
0041C542 loc_41C542: ; CODE XREF: seg000:0041C52Bj
0041C542 mov edx, [ebp-88h]
0041C548 cmp dword ptr [edx+800h], 1
0041C54F jnz short loc_41C556
0041C551 jmp loc_41C85D
0041C556 ; ---------------------------------------------------------------------------
0041C556
0041C556 loc_41C556: ; CODE XREF: seg000:0041C54Fj
0041C556 jmp loc_41C569
0041C556 ; ---------------------------------------------------------------------------
0041C55B db 4Ch ; L
0041C55C db 5Dh ; ]
0041C55D db 12h ;
0041C55E db 1Ch ;
0041C55F db 51h ; Q
0041C560 db 0C0h ; +
0041C561 db 0C8h ; +
0041C562 db 32h ; 2
0041C563 db 3Dh ; =
0041C564 db 0A7h ; º
0041C565 db 0A2h ; ó
0041C566 db 0EAh ; O
0041C567 db 4Ah ; J
0041C568 db 0A5h ; Ñ
0041C569 ; ---------------------------------------------------------------------------
0041C569
0041C569 loc_41C569: ; CODE XREF: seg000:0041C556j
0041C569 cmp dword ptr [ebp-10h], 6
0041C56D jnz short WithoutDialog
0041C56F push 0
0041C571 lea ecx, [ebp-74h]
0041C574 call sub_417EA0
0041C579 mov dword ptr [ebp-4], 0
0041C580 lea ecx, [ebp-74h]
0041C583 call j_MFC42_2514
0041C588 mov dword ptr [ebp-4], 0FFFFFFFFh
0041C58F lea ecx, [ebp-74h]
0041C592 call sub_40B0F0
0041C597
0041C597 WithoutDialog: ; CODE XREF: seg000:0041C56Dj

thank for ANY help, vlada


trying to find the most up-to-date tutes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > trying to find the most up-to-date tutes
PDA

View Full Version : trying to find the most up-to-date tutes

yobo
05-01-2001, 02:26 PM
i'm looking for the most up to date tutes. seems like there are a lot of older tutes which are good, but i'm really looking for some that are pretty new. thank you in advance for helping this newbie!
CoDe_InSiDe
05-01-2001, 03:29 PM
Hi yobo,

Maybe you can take a look at my page :)

http://codeinside.cjb.net

Cya...

CoDe_InSiDe
Kayaker
05-02-2001, 12:24 AM
Hi,

I would guess the most up-to-date reversing tuts, and I don't mean the crack site tuts on how to crack program x, would be

here at
http://tsehp.cjb.net/

CrackZ's Reverse Engineering Page
http://zencrack2.cjb.net/

Immortal Descendants
http://www.immortaldescendants.org./

Probably the largest selection of all kinds of tuts is at Krobar's
http://zor.org/krobar/

Lord Rhesus has a nice site on code injection
http://oberon.spaceports.com/~codeinj/

and BlackB has a premiere Newbies site at
http://beam.to/cracking

There are certainly other quality sites around as well, sorry if I've missed any.

And sure enough, Code Inside, you've got quite a nice selection of crackme tuts there! Hey, you think any of those would make a good Mini Project for the forum? It'd be nice if we got that forum going again with maybe some easy projects. I'd like to see a 'back to basics' project going there again, I just can't find the time to do the background research on what might make a good project. Maybe you'd have a suggestion if you're familiar with most of the crackmes you have there? Just a thought anyway if you're willing. I'm sure many people would chip in with help once it got going ;)

Regards,
Kayaker
CoDe_InSiDe
05-02-2001, 01:28 AM
Hi Kayaker,

You mean a little mini Project about one of my CrackMe's ???
Or do you mean a little mini Project about one of the CrackMe's where i've written a Tutorial for ??? ;)

Cya...

CoDe_InSiDe
Kayaker
05-02-2001, 01:45 AM
CoDe_InSiDe (05-01-2001 15:28):
Hi Kayaker,

You mean a little mini Project about one of my CrackMe's ???
Or do you mean a little mini Project about one of the CrackMe's where i've written a Tutorial for ??? ;)

Cya...

CoDe_InSiDe

Either or. I guess if it was on one you haven't written a tutorial about yet it would prevent "peeking" :)

Kayaker
CoDe_InSiDe
05-02-2001, 01:52 AM
Hi Kayaker,

Well, it would be nice if you guys did a little mini Project about one of my CrackMe's ;)

And about the Tutorials, maybe the one from Fr1c (CrackMe 7) is a nice CrackMe to begin a Project with :)
It's a little bit Unpacking, Button Enabling, Cracking ... :)

Cya...

CoDe_InSiDe
Kayaker
05-03-2001, 09:03 PM
Hi Code_Inside,

Well, as far as I know there is no "you guys". This isn't like a consortium or anything ;) If you think it might make a good project why not just post it with a short explanation and see what happens. I'm sure lots of people will be willing to help with newbie questions.

Cheers,
Kayaker
CoDe_InSiDe
05-04-2001, 12:49 AM
Hi Kayaker,

Good point about that "you guys" ;)
Hmm... i'll post something about my latest CrackMe (A PatchMe) in the "Mini Project Area" :)
Maybe that's a nice little target.

Cya...

CoDe_InSiDe
zampt
05-04-2001, 09:29 AM
Hi

I think that ID, tres2000 and hellforge is mostly
updated.

ID -once or twice a mon.

tres2000 -five or six times a mon.

hellforge -hmm, not sure.

krobar is also a good site but was last updated in
January.

bye
Zampt


keyboard simulation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > keyboard simulation
PDA

View Full Version : keyboard simulation

claumarius
05-01-2001, 06:24 PM
I am looking for an interface between 2 computers, the first for generate sequences of characters (simulates a keyboard) those are input to the second by keyboard connector and acting like a real keyboard. So, i need the ideea for the interface and the software. Thnx you in advance !!!
+SplAj
05-02-2001, 06:01 AM
pheeeeewww...... i'm glad this question is for 'newbies' ;)
mo k
05-02-2001, 01:04 PM
Do your KBcontroller research,

for software, look at "expect", it is a TCL
extension, and is perfect for simulating an
"operator".

If you know C/TCL you can modify expect to
do just about what you want.

for an example; my previous employer had
a custom database running on an ultrix box.
the database had a primitive query interface.
We wrote some custom "expect" code to supply,
the query dispatcher with the appropriate commands,
writen a modern GUI to interact with the
"expect" layer, and piped them to the DBhost
over a socket.

If this is what you want, then "expect" is the
way to go.
Scally6
05-03-2001, 06:03 PM
Depends what you're tryin to do. If you want to effectively use a remote keyboard, you need to photo-couple to the keyboard using opto-isolators or cmos. It's easy with opto-isolators soldered across the keys on the pcb and the capacitance problems then disappear allowing a longish link between the real keyboard & dummy.
You can then use software like John Hnidec's CCM to generate any combination of keystrokes from a single keypress. Try searching flight sim sites for 'Control Command Module' if this is what you want to do.
As this is a little OT, contact me off list if you want any more on this.
Scally


Could some one tell me more about Brute Force ~ I am totally New to This
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Could some one tell me more about Brute Force ~ I am totally New to This
PDA

View Full Version : Could some one tell me more about Brute Force ~ I am totally New to This

Abhi
05-02-2001, 03:34 AM
Hi

Of the little I have been able to find about E-mail Hacking, I have come across the mention of Brute Force.

Could someone tell me more about Brute Force and how can I go about it and how reliable is it.

THANX A TON
no_one
05-02-2001, 07:38 AM
Let's say you need a password, or perhaps a serial number.
A brute force attack means you start "guessing" all posibilities until you hit the right one. Doing it by hand can be, well, boring. There are programs that do the combination and typing for you. CAIN comes to mind.
If the password or serial you are attacking is long enough, it may take a few million years to find the right combination, in such cases brute force is not desirable.
Also, most programs limit the number of trials to 3 or so and then lock up to discourage such practices. Moreover, if you try a brute force attack over the net You will be detected almost for sure.


Can anyone crack Macromedia Director 8 for me???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Can anyone crack Macromedia Director 8 for me???
PDA

View Full Version : Can anyone crack Macromedia Director 8 for me???

Burbs
05-02-2001, 04:04 AM
Hey y'all, I was just wondering if anyone fancies having a go at cracking Director 8 for me, as I can't do it myself, nor can I find any cracks around the net...if u can or already have, please email me the crack on danielburton@hotmail.com
Hoof Arted
05-02-2001, 09:26 AM
no
qferret
05-07-2001, 10:49 PM
Why bother....if you can't even READ a FRICKIN MESSAGE BOARD HEADER, you'll never figure out how to even run Director......much less do anything useful with it }>


DLGTEMPLATE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > DLGTEMPLATE
PDA

View Full Version : DLGTEMPLATE

p:g:
05-02-2001, 05:15 AM
Did anyone try to load a resource like a dialog box into memory? If so, can help me?


ultradev4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ultradev4
PDA

View Full Version : ultradev4

viper
05-02-2001, 08:25 PM
need an unlocking code for dwud4. got a s/n.
can anybody help?
Hoof Arted
05-03-2001, 05:49 AM
no


HMEMCPY on WinNT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HMEMCPY on WinNT
PDA

View Full Version : HMEMCPY on WinNT

TheWizard
05-03-2001, 10:13 AM
Hi, I'm trying to do a BPX HMEMPCY in SoftIce/WinNT and it shows "Symbol not defined".
Do I need a special EXP= line in winice.dat or it's just that HMEMCPY is not supported in WinNT ?

Thanxs
stealthFIGHTER
05-04-2001, 09:55 PM
hi,
hmemcpy don't work on NT/2000. Try to use bpx memcpy.

Regards
KaKTuZ / TMG
05-06-2001, 11:02 AM
Yes, hmemcpy is a Win9x only API. On a NT/2k system, you should use breakpoint on WM_GETTEXT message with a handle to your edit control. You can get the handle to the control, with the help of numerous "Spy"-like utilities (e.g. Spy++). You then set a breakpoint on window message in SIce like this:
"bmsg handle_here WM_GETTEXT" (without quotes, of course ;)).

HTH


KEyboard api!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > KEyboard api!
PDA

View Full Version : KEyboard api!

NeO'X'QuiCk
05-03-2001, 06:05 PM
I have a problem i found a crackme that it check for keyboard pressing what should be normal !!But please dont forget that crackme is in VB!!

Thanks infront!!

NeO'X'QuiCk


help running sice with win me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help running sice with win me
PDA

View Full Version : help running sice with win me

bazzzzz
05-04-2001, 09:23 AM
help please i canot sus out the way to get sice to work in windows me can anyone help i can install but autoexec.bat wont keep the changes aftwer install this is doing my nut in as i can only run sice in win 98 on an old 486 yuk
stanks
05-04-2001, 10:28 AM
Hi

Go to protools.cjb.net and d/l loader for SoftIce for WinME, and run it. That's it.

Bye


Sentinel CPlus B
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel CPlus B
PDA

View Full Version : Sentinel CPlus B

TR
05-04-2001, 10:38 AM
Does anyone have info about this dongle? document, manual, software? I can't find anything on internet.
thanks for any help.


Dongle Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dongle Protection
PDA

View Full Version : Dongle Protection

JaBorges
05-04-2001, 01:42 PM
Does anyone know where I can get a good tutorial about cracking a program protected with a dongle, or at least what the name or size of the driver used by dongle is?

The dongle in question is a Rainbow sentinel superpro.


I'm a new beginner ... How to crack mirc.exe .. step by step .. !! And make it my own file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I'm a new beginner ... How to crack mirc.exe .. step by step .. !! And make it my own file
PDA

View Full Version : I'm a new beginner ... How to crack mirc.exe .. step by step .. !! And make it my own file

xperts
05-05-2001, 09:08 AM
Hello .. i'm a new beginner in cracking software .. first software that i have crack is mirc.exe .... but when i crack this exe file ... about for author was disable .. how can i enable it against ??
sinn0r
05-05-2001, 11:21 AM
hmm, please explain it further :)
ThrawN
05-06-2001, 10:19 PM
Yes i remember some years ago reversing a version of mirc and the about box disapeared. I cant remember exactly what happened but i know that it was because I didnt do a good aproach. Try something difirent.. I believe you can patch the Bad boy message but shortly above it theres a call to the algo. Its the call that i altered to get it to stay registered.

Sorry I cant help you more, its been some long time since i looked at mirc.
Storm
05-08-2001, 09:44 PM
I don`t have much time so this will be brief.

Don`t know what wersion of mirc you have (I have v5.8) but this may be helpfull to you...

Click Register and in Sice put "bpx messageboxa".
Enter any Name/Serial then click Register.
When Sice pops F12 to enter mirc32 code.
Look up until you see TEST EAX, EAX
JZ 0049855A (my vers. o mIRC)
Clear all breakpoints and put a breakpoint on the call before
TEST EAX, EAX then press F5.

Enter again Name/Serial and then press register.
SIce will break at the call.
Step into the call (F8) and then F10 until next call.
Step into that call too and then F10 until you find CMP EAX,05
Then in Sice type "a" then press Enter.
Type in "MOV EAX ,01" so that the call returns 01 in EAX (what we want)
Then nop the next two bits (e.g. type NOP two times) to nop the XOR EAX, EAX ( this instruction will make EAX = 0 (we don`t want that to happen).
Then F5 and you`ll see reg successfull message and then the program writes Name/Serial to registry.
The thing is that when you restart the program it will check at startup to see if registration is valid but if you patch the code as showed above than you don`t have to worry about that anymore.

Now patch the executable with HView (or similar).

If any questions email me.

Storm.
xperts
05-09-2001, 01:01 AM
Hello .. how to use cracker Jack .. i've download it but i can use it .. b'coz it saids DPMI Not supported .. so .. what can i do ?

xperts


Need help for my first crack, working 2 days w/out any effects
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help for my first crack, working 2 days w/out any effects
PDA

View Full Version : Need help for my first crack, working 2 days w/out any effects

SoftKnight
05-05-2001, 07:39 PM
Hi experts out there...

cracking is an absolute new thing for me. Im using wm32dsm, got procdump32, softice, a hexeditor AND a prog to crack (WinZinsen 6.00b).

So, I started to search in the zinsen32.exe for StringDataRefs which may be discribe the ErrorMessage after I tried to enter a serial. I did also a lot of other things like searching the right address with Sice. Nothing.

Please give me some help via e-mail or icq. Oh, I just read thousends of tutorials but no one discribes a similar problem.

Thx
Cu
SoftKnight
aimless
05-06-2001, 12:24 PM
Hullo,

I think you are trying your hand at something that you may not quite understand. You would NOT find these strings as:

* The .exe may contain U.N.I.C.O.D.E. strings. And your string search util could be searching ONLY ASCII.
* The .exe could be compressed
* The .exe could be crypted
* The .exe is normal. But the strings are generated on-the-fly. Dynamically!
* The strings may NOT be there at all.

The first thing to do, is NOT TO CRACK a program that are any of the above. Try cracking a simple program. An older version of Winzip (typically 6+ to 7) should do. And you will need JUST softice. Leave Procdump/IDA et al to the big 'uns.

And searching for strings using some dump utils is NOT ADVISABLE. Instead, try BPXing on the messagebox using SOFTICE only. And then carry on thence.

And most important. Learn how to use the BACKTRACE buffer in Softice. You'll see the entire damn code out there!!

If you are REALLY intent on searching for strings, I'd suggest strings.exe from www.systeminternal(s).com (check spelling however...)

This little babe searches for all files in a directory. Both ASCII and UNICODE.

Then carry on. And yes..if your strings are NOT in the program files (or its directory). Do not give up. Get FILEMON.exe from the same site. Check the files being accessed. If there is still nothing, then it IS one of the above reasons.

And oh yes, do not OVERESTIMATE the commercial programs. They "CAN" be broken. And even you C*A*N do it.

Above all, have fun...

Regards,
qferret
05-06-2001, 08:55 PM
...justfelt the need to point out that it doesn't matter what version of WinZip you try....the protection routine is the EXACT SAME in ALL versions of it ;-)

but.....I do agree that WinZip is a GREAT 1st proggy for the absolute newbie
SoftKnight
05-07-2001, 02:46 PM
But at first: It is NOT WinZip, it's WinZinsen ;-)
In english it means WinInterest (banking language)

OK, the prog is not compressed or crypted like with UPX. I used the dump prog to get the StringDataRefs and now i can see them. But the text doesn't make any sense.

I will try the progs and I never give up. I'm just a little stressed because I got an big thing next week.

Once I have done my first crack the next will follow soon ... but step by step :-)

CU
SoftKnight


newbiecracker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbiecracker
PDA

View Full Version : newbiecracker

^-^NovanO^_^
05-06-2001, 10:12 AM
hi everyone
i just wana ask that what r the things that a newbie cracker should learn before start cracking
SoftKnight
05-06-2001, 10:52 AM
The meaning of the different jumps: jne, je, jmp, ja, js, jg, jl, jle, jge
qferret
05-06-2001, 08:59 PM
at least a rudimentary understanding of ASM and Windows API's

How to use the basic tools of the trade is also good knowledge (RTFM's)
chewhost
06-03-2001, 12:42 PM
SoftKnight (05-06-2001 08:52):
The meaning of the different jumps: jne, je, jmp, ja, js, jg, jl, jle, jge

I aint a daft bloke (take my word for it) and very recently i've developed an interest in "cracking" namely Paint Shop Pro's evaluation has run out and i still wanna play with it!....Ok i've cracked the ansa myself...simply change your date on your comp to co-inside with the evaluation download date....and hey presto IT WORKS!!
Am i a genius?.....well i thought i was until i looked at this site..

upon further investigation and having downloaded the free IDA thinngy (as advised) i set to work on paintshop 7 (just for a giggle) ida set off at a rate of knots (doing sommit) and eventually stopped.... i waited for something else to happen but nothing did. just then i realised that i hadn't got a clue how to use the programme...wot it did...and how it done it. With my never say die attitude i set off to learn...but this stuff aint easy to pick up.....I equate this to something like me explaining how to do the lead guitar bit in Queen's "bohemian rhapsody" to someone who has recently started strumming.

So wot have i learned? I've learned that i'm a beginner at cracks and i need help to find out wot i need to know to progress. I wont even bother asking for instructions regarding PSP7.......cos it seems like everybody takes offence at that!

anyway steam let off......any advice?
qferret
06-03-2001, 09:42 PM
well, you have the right attitude, you dug around a bit, got stumped......then asked ;-)

the question is still somewhat vague though ;-)

Ideally, you would know ASM programming, how to use a debugger(SoftIce is by far the debugger of choice), a hexeditor (HexWorkshop is user friendly, HIEW is a lot better IMHO, but the user interface can be intimidating for a newbie who's used to Win32 apps), and a disassembler (IDA is the king, but again kinda intimidating for newbies....W32Dasm is quite user friendly)

These are the bare essentials for your toolkit, learn them well, RTFM's, ask questions on TOT MB if you get stuck.

There will doubtless be other tools you will use (or create), but these are almost mandatory.

Get an API reference and an Intel OpCode reference...study them too ;-)

Learn how to use the search engines, they will be your very good friends, or you biggest apin in the a$$ ;-) ....you can find any info or program you desire if you know where to look and how to ask.

I hope that is enough info to get you started (and I hope it was at least partially relevant LOL)

If you get stuck along your journey....feel free to ask questions....as long as you try yourself first :-D


Dump the Backtrace History buffer ????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dump the Backtrace History buffer ????
PDA

View Full Version : Dump the Backtrace History buffer ????

Clandestiny
05-06-2001, 05:36 PM
Hi guys,

I am interested in dumping sice's backtrace history buffer, but am not quite sure how to proceed. First, where exactly does this backtrace buffer reside in memory ? Having consulted some documentation on the bactrace range at +Sandman's SoftICE Resource Centre, I'm lead to believe that this data will need some conversions in order to get the instruction information into a displayable text format ? Is there any available info on this matter... Or better yet, does a tool exist to automate this process ?

Thanks,
Clandestiny
Kayaker
05-06-2001, 09:11 PM
Hi Clandestiny,

http://www.woodmann.net/Ultraboard/Public/HTML/B6/748-1.topic.html

After you've read this and realized you can only dump the addresses not the ASM code, I've got a Perl source which will convert the binary address dump to an ASCII file. Email me if you're interested in it.

Kayaker


cracking dos prg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > cracking dos prg
PDA

View Full Version : cracking dos prg

rags
05-06-2001, 11:29 PM
I am an absolute newbie trying to crack a dos program that registers a user for "Seabattle". I have cracked Winzip 8.0. That alone's my experience.

In the Dos program that runs in Win98 hexeditor shows up strings such as "Enter serial no.", "You are registered", "Invalid Serial No" etc. But disassembly (thro' HIEW 6.0 or W32Dasm) does not show them. Why ?

How to break into the prg using Softice while running it under Win98 ?
emulder
05-07-2001, 02:20 AM
Hi,
I suggest, that you use IDA for disassambly. This works much better
on DOS-programs than HIEW (not talking about W32DSM ;-).

If you are running Win9xNT and Winice, you might use the Dos-Loader,
which is in the subdir SoftICE/Util16. Just type dldr.exe <filename.exe>
and SoftICE is ready to trace you program...
hope this helps
cu


Office 2k Cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Office 2k Cracking
PDA

View Full Version : Office 2k Cracking

Sniper_J
05-07-2001, 11:46 AM
I need help cracking and installing Office 2k on my computer


Office 2k Cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Office 2k Cracking
PDA

View Full Version : Office 2k Cracking

Sniper_J
05-07-2001, 11:47 AM
I need help cracking and installing Office 2k on my computer


The Mod Function
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > The Mod Function
PDA

View Full Version : The Mod Function

Acid_Cool_178
05-07-2001, 01:53 PM
In encryption so is the mod function used alo, like in RSA.. I have heavily problems to understand that functin, someone that could help me ?

Acid_Cool_178
poiu
05-07-2001, 02:06 PM
If you mean the modulo function, well that would be quite easy. It gives the remainder of an integer division.

Examples: 10 MOD 3 = 1
15 MOD 5 = 0
13 MOD 10 = 3
etc...

Don't know if this answers your question... :p otherwise, try to be more specific... ;-)
Acid_Cool_178
05-07-2001, 02:10 PM
but WHY is 10 MOD 3 = 1
How is the mod function built up ?

Acid_Cool_178
poiu
05-07-2001, 02:21 PM
Acid_Cool_178 (05-07-2001 04:10):
but WHY is 10 MOD 3 = 1
How is the mod function built up ?

Acid_Cool_178

because 10 = 3 * 3 + 1

other example 13 MOD 10 = 3 because 13 = 10 * 1 + 3
(1 is the quotient, 3 is the remainder of ``13 divided by 10''... the mod function simply returns the remainder of an integer division...)
Acid_Cool_178
05-07-2001, 02:23 PM
Wooha, thanxx alot poiu.. Finally i'm understanding :)

Acid_Cool_178


Extreme Virgin Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Extreme Virgin Help
PDA

View Full Version : Extreme Virgin Help

nekulturny
05-08-2001, 09:53 PM
Please don't laugh everyone has to start somewhere.

Problem

As you will see I am obviously new to reverse engineering and am starting to build a toolkit. I have downloaded 2 zip folders from seperate sources of Softice 4? for win98. Both Folders contain 4 zip files a, b, c and d.

The problem is that i can't get them to make a program. I have tried everything, spanning - dumping into one file etc but to no avail.

What can i do?

I wil not give up as 2 years of looking up porn has led to a very booring person, i need a challenge for this computer and I and not just filing porno from the net.

nekulturny
Clandestiny
05-09-2001, 09:50 AM
Hi,

I responded to a similar question in another post. You can have a look here:

http://www.woodmann.net/Ultraboard/Public/HTML/B8/1420-1.topic.html

Hopefully, it should answer most of your install questions :)

Regards,
Clandestiny


new tutorials
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new tutorials
PDA

View Full Version : new tutorials

cluesurf
05-09-2001, 11:49 AM
Hi Reversers,
My name is cluesurf.I have wrote a tutorial
on unpacking aspack.This tut is for
newbies want to learn the basics of unpacking.Btw Code_Inside has put up
solutions about his crackme18 too :)
http://code.freeservers.com/crackmes.html
Please give comments,critics,flammings
are welcome :)
http://code.freeservers.com/tutorials.html
I have no decent email at the moment

best regards to all
cluesurf


msgboard interruption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > msgboard interruption
PDA

View Full Version : msgboard interruption

tsehp
05-10-2001, 04:27 PM
sorry for this little interrupt.
The isp disabled cgi-bin because of too much cpu time consumed by this script. I'm actually fixing this by changing the database system.
To clean up a little the database, all the unanswered topics from newbie's forum older than 2 weeks will be deleted.

regards,

+Tsehp


Newbie needs help with first program...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Newbie needs help with first program...
PDA

View Full Version : Newbie needs help with first program...

madhax
05-10-2001, 07:56 PM
Heya guys,

Well, I am trying to crack Codewright 6.5b, using softice and some old codewright tutorials (5.1 and earlier), but, I have yet been able to figure it out.
If anyone could help me out with an updated tutorial, and a tutorial for newbies to Softice, and/or ASM, I would be most appreciative...

Thanks a MIL
[MaDHaX]
JimmyClif
05-11-2001, 02:51 PM
SoftIce for Beginners : http://www.idca.com/~thesandman/index2.html
Art Of Assembly : http://webster.cs.ucr.edu/Page_asm/ArtOfAsm.html

MyRamblings proc uses HumbleOpinion
If you really intend to learn reversing.. don't start with a $299 and 15MB application...
especially not when you need SoftIce and ASM tuts.

This looks like one of those:
"Oh.. I couldn't find a crack at astalamistas because I got version 6.5b and their latest one is
6.5a, but I found a tut and I just need some naive guy helping me to fiddle my way around
to get my full version."
MYRamblings endp
hz
05-11-2001, 04:01 PM
hi,
jc caused an invalid page fault at eip ???????? ;)

regards


Ebooks sites
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Ebooks sites
PDA

View Full Version : Ebooks sites

e-nigma
05-11-2001, 11:12 AM
Hi!
I need some ebooks [esp=>Teach yourself vb6 in 21 days] I think Votality had this book on his FTP since he has left ID I can't comm. with me. Anyone got this book.

thanks,
e-nigma
Kayaker
05-11-2001, 04:03 PM
Hi,

There's a goodly selection at

h**p://www.psyon.org/archive/e-books/index.shtml

Kayaker
e-nigma
05-11-2001, 10:45 PM
I know this one and it has got quite impressive selection but d/l speed is at 0.36KB/S and most of the time due to slow d/l file will be corrupted.

BTW, do you have any good book on vb.
thanks
JimmyClif
05-12-2001, 08:35 AM
Hi e-nigma...

How's the Mosaic tutorial going ? ;D

Anyway... if downloads are slow... get yourself a slave grabbing the files and sending them to your mailbox... Try: http://www.downloadslave.com/html/en/default.htm.

Here are a few more links to e-books... (some may be dead tho)
http://rahmat.zikri.com/books.html
http://www.itknowledge.com/reference/dir.archive2.html
http://get.to/FreeKnowledge
http://proxy.bashnet.ru:8100/pub/Books/
http://www.freeweb.org/NewEntry/YanOrel/books.htm
http://cires.colorado.edu/people/peckham.scott/tutors.html
e-nigma
05-12-2001, 10:22 AM
Mosaic game tut is going fine and thanks for the links.


Congrats On the New Job :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Congrats On the New Job :)
PDA

View Full Version : Congrats On the New Job :)

Clandestiny
05-11-2001, 04:16 PM
Hiya Kayaker,

Just noticed you're listed as our new moderator and thought I'd offer up a traditional congratulations and a welcome to the new job message :)

Cheers,
Clandestiny
JimmyClif
05-11-2001, 04:26 PM
And thee Kayaker, shall do your best and make it your duty and maintain the spirit of this place.

~JClif~
(*big grin*)
hz
05-11-2001, 04:55 PM
hiya,
ah well, no more reversing for you then, guess you'll be too busy, erm "moderatin". wtf does a
moderator do anyway?.
greetz
oh yeah congratz
Kayaker
05-11-2001, 10:10 PM
OMG, what have I done?

Let's just say I didn't go searching for the job, but I'm willing to help out. I don't know what the heck a moderator is supposed to do either. Nuke lame posts with a giddy sense of power I guess. I'm open to suggestions as to what constitutes a violation of Board protocol. I wouldn't want to be accused of censorship, but I'll gladly squash blatant crack requests like a bug ;)

In any case, thanks for the support, and I'm sure we can continue this board as an open forum on Reversing issues for Newbie and advanced Reversers alike.

Cheers,
Kayaker
+SplAj
05-13-2001, 06:36 AM
.." OMG, what have I done?
Let's just say I didn't go searching for the job, but I'm willing to help out...."

Watch out there is a Tsehp about ;)

... "I don't know what the heck a moderator is supposed to do either...."

Watch out there is a Tsehp about :*

.." I wouldn't want to be accused of censorship, but I'll gladly squash blatant crack requests like a bug.."

Watch out there is a Tsehp about }>

...." Nuke lame posts with a giddy sense of power I guess. I'm open to suggestions as to what constitutes a violation of Board protocol...."

LOL lame idiots quoting "Watch out there is a Tsehp about" :-p

+SplAj

PS did you finish RTFM 'ultrabored' yet ?
Kayaker
05-13-2001, 11:17 AM
+SplAj (05-12-2001 20:36):

+SplAj

PS did you finish RTFM 'ultrabored' yet ?

Oh No, don't tell me there's a strainer exam for this gig? ^_^
Scally (restored msg)
05-20-2001, 09:42 AM
Hey Kayaker,
Got a crack for Atlasti? .....
Congrats mate - If you help others as much as you've helped me in the past you'll do a damn fine job- or should I say a moderately fine job?
Scally
Kayaker
05-20-2001, 09:03 PM
Oh well, we lost some posts. Still missing the originals from Esther, Kugi and Raven58, but here's my reply anyway. The only important part was asking for anybodys ideas on improving, or general comments on this forum.

Oh Man, now I feel pressured to actually try and do a good job even! ^_^

Heh, heh Scally. Gee I don't know, if I give you a crack for Atlasti it might be considered a conflict of interest. Then I'd have to delete my own post or something like that. I don't even remember what that program was, some ugly demo I think but it was kind of interesting because there were so many files involved. Actually, I just checked, thinking it might make a good project, but it's now 7.5Mb in size. Forget it.

Hi Esther, I wish I *could* get rid of that danged post size limitation, it annoys me to no end. I'd like to see PRE formatting work as well, or maybe something like on Iczelion's ASM board where you can post formatted CODE. Maybe I should RTFM on Ultraboard as +Splaj suggests and see if anything can be done (I assume not though :(

Thanks Kugi. Thanks Raven58. But you know, I've never felt anything I've said is any more or less than what the majority of people who post trying to help others offer. And I ALWAYS learn something myself in doing so. That's the beauty of it. You learn by helping. Other than that I'd be sitting on my ass trying to think of some other project to tackle ;) I remember the old Sandman's forum, not from WAY back when, but from a year or two ago. I learned SO much by the posts on that board. There always seemed to be an interesting thread that you could pick something up from. Crack requests were almost non-existant, and most threads were long with a lot of input by many people. I'd like to see that again. We can all make this a great board with input, output and throughput. Doesn't mean it'll always be right, but at least there'll be some productive discussions.

One thing I want to start working on is a little link page that can be accessed from the main Newbie Forum page. I'd like to post selected links on several Reversing topics that people can use as a reference to try to answer some basic questions before posting, or use as a getting-started guide. Things like links to good ASM docs, PE file structure, SoftIce basics, info on API's, unpacking, code insertion, yadda, yadda. I've got a few particular links in mind, but I'd appreciate any and all that anybody thinks might be a good reference. I know that most of us already know where to look to find whatever it is we need, but for someone just coming into the field, there's a lot of chaff to go through to find the good stuff.

I'd like to hear any other ideas that people may have on what could improve this board.

Oh, and Raven58? Will ya quit trying to sucker me back into Lazarus' crackme, heh, heh.

Cheers,
Kayaker


VBox 4.3 unwrapping problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VBox 4.3 unwrapping problem
PDA

View Full Version : VBox 4.3 unwrapping problem

Xybyre
05-11-2001, 05:16 PM
I installed MicroEdge's Visual SlickEdit 6.0a. It's protected with VBox 4.3 (I think). I followed +Tsehp's VBox 4.3 tutorial, but the execution path doesn't follow the same path!

The tutorial shows execution going to here:
015F:011604E0 MOV EDX,[EBP-08]
015F:011604E3 MOV EAX,[EDX+14] <-- get app entry point
015F:011604E6 MOV [EBP-10],EAX
015F:011604E9 MOV EBX,[EBP-10] <-- app entry point to EBX
015F:011604EC JMP EBX <-- jump to real entry point

But this target doesn't go there. The function with the above code is entered, but there is a jump before it gets to the 'JMP EBX' that goes to the end of the function.

Everything else in the tutorial matched what I saw, up to that point. Did I do something wrong, or is this target special? I put a 'bpm x' on the 'JMP EBX' line, but that line never gets executed.

I've gotten the same results with win2k and winme. I used Soft-ICE on win2k and TRW2000 on winme.
Xybyre
05-14-2001, 10:04 AM
I downloaded PerlBuilder, which also uses VBox 4.3. With PerlBuilder, everything goes exactly as explained in the tutorial. So the VBox protection is somehow different with SlickEdit...
JohnBlbec
12-20-2001, 04:41 AM
* sorry for my poor English *

...but I thought MicroEdge using FlexLM v6.1a. BTW I'm trying to crack Visual SlickEdit 6.0c and for the present I'm unsuccesful ;o( Installation key for v6.0 not working with v6.0c...
Solomon
12-20-2001, 04:46 AM
hello Xybyre,

Visual SlickEdit v6.0c is protected by VBOX 4.5.
vsapi.dll is packed. I have not succeed yet. Can't find the OEP of this dll.

I wonder what I shall pay special attention to when unpacking a DLL. Import table? Export table? or Relocation table?


synd.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > synd.exe
PDA

View Full Version : synd.exe

next (restored msg)
05-20-2001, 09:44 AM
hi Gang:
who have the tutorials about crack flexlm?
splaj (restored)
05-20-2001, 09:45 AM
Hello 'next' from China
Perhaps it's your problem with the English language
, but the words 'DON'T INSULT' means DONT ASK for cracks or serials. This is not a crack site

You probably saw that your synd.exe 'crack request' was locked out of the main forum and banished to the sin bin..... as will happen to all such 'red-card' violations.

This current request for flexm info is a little better but.......
We kindly ask you do some 'research' first before posting a request here as you will probably find what YOU wish for from cracks.am or astalavista.box.sk or google.com directly.

SplAj


need some info bout cossacks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > need some info bout cossacks
PDA

View Full Version : need some info bout cossacks

elgura (restored)
05-20-2001, 09:51 AM
i'm tryin to crack cossacks but it is a bit to difficult for me but i wanna do it anyway.. well i put a bpx at getdrivetypea and it stops four times?? and the second problem i got is why does it check every drive that i got a: c: d: e:
can someone tell me or just point out a direction for me it would be great..
Kilby
05-23-2001, 08:25 AM
Why is it checking all your drices, well it's stepping through your drives tring to find which one is the cdrom and getting their assigned letters.

This is pretty normal for a cd based protection.

Cossacs depending on what country you 'bought' it in may be a copylok file.

If so, I suggest looking at something else first if you have had no experiance of dumping and IT rebuilding, then get some practice with packers.

www.discompress.com is a good place to start.

If it's not copylok then you probaby look for the usual GetDriveTypeA call.

Kilby...


Pooldemo.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Pooldemo.exe
PDA

View Full Version : Pooldemo.exe

shockwave
05-20-2001, 03:06 PM
Hi, Im new in cracking and I read the +ORC first lesson and I try to crack pooldemo.exe but when I switch to softicedos 2.0, the characters are bad, the screen show only garbage, and I dont undertand anything. I post there because in the tool forum nobody response me. thanks
ice
05-20-2001, 08:29 PM
Hi :))

I used softice 4.01? for windows and just
bprw the module, dos or not...
But the deadlisting helps too...
use PROC to find the module..
or MOD if you have patience...
:)
Plus the loader seems to take anything these days ... there was a few loaders in the package I think.... or from the net.

Even w/o loader just hunt it down, even search for some code at start of pooldemo if need be....
ps I've never gotten 2.62 or 2.8 dos softice to work on this machine.. if you do let me know any tips :)
The newer has more commands too....


RCE CD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RCE CD
PDA

View Full Version : RCE CD

Aleph
05-20-2001, 05:30 PM
Hi all.

Sorry to post it here, Kayaker, but /me think it's the best place to do it.

As one of the volunteer for the RCE CD distribution, I'd like to tell some requesters : things would be a lot easier for me if you could provide a return-adress on your emails >(
Especially ~X~ from Greece, and a few others from France, UK, Denmark and Honk-Kong... You know now what you have to do ;)

Wow ! Haven't posted here for a while... Damn real-life work :(

Regards all,
Aleph
Kayaker
05-21-2001, 12:30 AM
Hi Aleph,

Certainly not a problem posting that here! You're obviously doing something very nice for people, I hope you can find some time to do some reversing for yourself.

Where the heck did they think you were supposed to send the CD if they didn't include a return address anyway??

Regards,
Kayaker


Laughs For You All :p
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Laughs For You All :p
PDA

View Full Version : Laughs For You All :p

Clandestiny
05-20-2001, 08:12 PM
Hi All,

Maybe its just a wee bit off topic, but everyone needs a good laugh once and a while ;) and I just couldn't resist sharing these links I found :D

Here's the art of "How to Write Unmaintainable Code". This'll be a riot of laughs for the programmers among you.

http://mindprod.com/unmain.html

A small excerpt:

"To foil the maintenance programmer, you have to understand how he thinks. He has your giant program. He has no time to read it all, much less understand it. He wants to rapidly find the place to make his change, make it and get out and have no unexpected side effects from the change.

He views your code through a tube taken from the centre of a roll of toilet paper. He can only see a tiny piece of your program at a time. You want to make sure he can never get at the big picture from doing that. You want to make it as hard as possible for him to find the code he is looking for. But even more important, you want to make it as awkward as possible for him to safely ignore anything. "

And here's Unix Humor w/ a whole gauntlet of essays guaranteed to make you laugh.

http://www.geocities.com/SiliconValley/Vista/8009/index1.html

Hope you guys enjoy some of these as much as I did :)

Cheers,
Clandestiny


How to crack this task?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to crack this task?
PDA

View Full Version : How to crack this task?

mitrix
05-20-2001, 08:34 PM
im a newbie cracker,im learning Harlenquin's
course in his homepage
http://htasks.cjb.net/fx23ht.zip
and download Task2/3.
In the programer the DD [0040209F] is 00401124
and the [00401124] is E8 .i think it shoud EB.

:00401124 E8B5000000 Call 004011DE
:00401129 83F80A cmp eax, 0000000A
:0040112C 757B jne 004011A9
:0040112E BAA7204000 mov edx, 004020A7
:00401133 33DB xor ebx, ebx \
:00401135 8A1A mov bl, byte ptr [edx] |
:00401137 42 inc edx |
:00401138 33C0 xor eax, eax \the first serials must 4
:0040113A 8B0D9F204000 mov ecx, dword ptr [0040209F] /
:00401140 8A01 mov al, byte ptr [ecx] |
:00401142 80F3DC xor bl, DC |
:00401145 3AD8 cmp bl, al /
:00401147 7560 jne 004011A9
:00401149 8A02 mov al, byte ptr [edx]
:0040114B 42 inc edx
:0040114C 3430 xor al, 30
:0040114E C1E008 shl eax, 08
:00401151 8A02 mov al, byte ptr [edx]
:00401153 42 inc edx
:00401154 3430 xor al, 30
:00401156 C0E004 shl al, 04
:00401159 66C1E804 shr ax, 04
:0040115D 8A1A mov bl, byte ptr [edx]
:0040115F 42 inc edx
:00401160 2AC3 sub al, bl
:00401162 3C3C cmp al, 3C
:00401164 7543 jne 004011A9
:00401166 B104 mov cl, 04

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00401178(C)
|
:00401168 8A02 mov al, byte ptr [edx]
:0040116A 42 inc edx
:0040116B 3433 xor al, 33
:0040116D 2C03 sub al, 03
:0040116F 3AC1 cmp al, cl
:00401171 7536 jne 004011A9
:00401173 FEC9 dec cl
:00401175 80F900 cmp cl, 00
:00401178 75EE jne 00401168
:0040117A 668B02 mov ax, word ptr [edx]
:0040117D 663D3033 cmp ax, 3330
:00401181 7526 jne 004011A9
:00401183 A0A7204000 mov al, byte ptr [004020A7]
:00401188 3C37 cmp al, 37 ; the first serials must 7
:0040118A 751D jne 004011A9
:0040118C 6A00 push 00000000

if what i think is wrong,please tell me some ideal about crack it.
thinks!
Kayaker
05-21-2001, 12:01 AM
Hi Mitrix,

I took a look at this and, as a matter of fact, liked it so much I hope you'll forgive me if I move it to the Mini Project Forum. I think it'll make a great project and there's some interesting instruction to come out of it.

I've locked this thread in the Newbies Forum, please post all replies to the Mini Project Forum.

Regards,
Kayaker


CopsVerify
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CopsVerify
PDA

View Full Version : CopsVerify

refra
05-21-2001, 03:12 AM
I'm trying in cops copy lock An old key floppy protected program
Any one could help


Signlab 5.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Signlab 5.0
PDA

View Full Version : Signlab 5.0

Signsolutions
05-21-2001, 04:49 PM
I've managed to emulate Hasp calls 1,2 and 6 for Signlab 5.0.
This works for all versions except 7 and 11 (instant replay). The error I get relates to a password that does not correspond to the dongle emulation. I need to trace all valid passwords.
I belive this can be done during setup but I don't know where to start.
Can anyone point me in the correct direction?

Thanks

Signsolutions


assembler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > assembler
PDA

View Full Version : assembler

ant
05-22-2001, 12:26 PM
Hello,

I'm trying to turn a program into a keygen (to show the right code in the message box) and I have the right code in edx+1. The problem is that when I do mov eax, edx+00000001 (before I did this eax hold the bad message after this instruction) I don't get the code in the message box, but in Sice if I do d edx+1 I have the code there. Since I'm a newbie in assembler language I don´t know what I'm doing wrong. Can anyone help me? Thanks in advanced.
JClif
05-22-2001, 12:46 PM
Hello ;)

As I understood your problem you want to display the right code in a funky messagebox.

And I guess your inserted code looks like this:
mov eax,edx+1
push 00 ;ok button
push eax ;caption
push eax ;text
push 00 ;handle
call dword ptr [x??x??x??x] ;the call to MessageBoxA

Well, you have to use the Address/Offset to the real number to display it inside the box.
So use a push 004X2345 where the serial is in memory or replace your mov with a lea.

That should work.
Jim
ant
05-22-2001, 02:36 PM
Thanks for the fast answer, but it's not exactly this. I pasted the original code here (with my comments). The correct code is at edx+1

:0045E891 B201 mov dl, 01 --> call the icon in the messagebox

* Possible StringData Ref from Code Obj ->"The Registration Key is incorrect."
|
:0045E893 B888E94500 mov eax, 0045E988 --> 0045E988 is the bad message
:0045E898 E84F6CFDFF call 004354EC --> call the messagebox

If at 45E898 I do 'd eax' I can see the bad message. So in Sice I decided to change the code at 45E893 to 'mov eax, edx+1' but the result is the same as doing 'mov eax, edx' (why?), which not holds the correct code. If I do mov eax,[edx+01] I will get in eax the 4 first digits (in inverse order) in hexadecimal of the correct serial. This is very confusing to me !!! Can you see what am I doing wrong?
mo k
05-22-2001, 04:15 PM
>If at 45E898 I do 'd eax' I can see the bad
> message. So in Sice I decided to change the
> code at 45E893 to 'mov eax, edx+1' but the
> result is the same as doing 'mov eax, edx'
> (why?)
They are not the same =P
what is in edx is a pointer to a string. display
it, and you will see the entire string. now when
you increment it, you are forwading the pointer
and you will see the exact string, missing the first
letter.
if you don't see any difference, then the first letter
was not an alphabet letter, it must have been an
space, and caused your "visual" confussion.

> If I do mov eax,[edx+01] I will get in eax the
> 4 first digits (in inverse order) in hexadecimal
> of the correct serial. This is very confusing
> to me !!! Can you see what am I doing
> wrong?
first note this
edx+1 increments a pointer
[edx+1] increments a value

The fact that values are stored in hex or in reverse
doesn't do much, any algorithm can do comparison
however its author likes it.

But the fact that the "value" of the serial is also
the "pointer" to the error message raises a suspicion.

first: the author is an asm coder, who did indeed
manually patch his application and/or tweak
his linker/library.
this is bad!

second: the author is a dumbass, since he cann't
place the error message, wherever the generated
serial hashes to.

I think the serial is hardcoded, derive your own
conclussions!

Please name the app, or post the comparsion
algo, i think someone hit jack pot ;P


WinIce in & Windows ME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > WinIce in & Windows ME
PDA

View Full Version : WinIce in & Windows ME

Mr.Dumb
05-23-2001, 12:17 AM
I am a real newbie and I cannot make the Full DLL to load by that meanig nthat if I isssue a Exp command I see that Kernel32 is loaded but i cannot bpx on getlocaltime (Im running windows ME & winice 4.05)


how do unpack/dump a 16bit windows app?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how do unpack/dump a 16bit windows app?
PDA

View Full Version : how do unpack/dump a 16bit windows app?

n0de
05-23-2001, 02:37 PM
ok- this is my problem:
i have an old win 3.11 program exe-packed with something called Shrinker (at least this is the only proper ascii string if you dump it)- but is not recognized by un-pack or file analyser as a packed executable.Procdump and other generic unpackers don't work since it's not 32bit, unp or tron etc. dont work since it's not dos.
so what can i do- how to find the entry point the program length a working dumper and do i have to fix the dump after all this?
Kayaker
05-27-2001, 07:21 PM
Hi,

You could try checking out the 4 Shrinker tuts at Krobars, under unpacking:

http://zor.org/krobar/

Maybe you can inline patch it like Risc explains so you don't have to try to rebuild a 16 bit dumped app (what a horrible thought ;)

Kayaker


sice bpx on dll/function access
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sice bpx on dll/function access
PDA

View Full Version : sice bpx on dll/function access

n0de
05-23-2001, 02:43 PM
how can i set a breakpoint in sice which breaks not only if the program accesses a file but accesses a certain function in a e.g. a .dll ?
Clandestiny
05-23-2001, 09:26 PM
n0de (05-23-2001 12:43):
how can i set a breakpoint in sice which breaks not only if the program accesses a file but accesses a certain function in a e.g. a .dll ?

Hi Node,

Can you be a little more specific with your question ? Setting a standard bpx on a Windows API used by the proggy in question will cause SI to break when that function is called. And those API's are functions within windows dlls...ie User32.dll, Kernel32.dll....ect. Perhaps I misunderstand your question, but I fail to see the problem. If you can clarify then perhaps I can help.

Regards,
Clandestiny
Ceno_2k
05-24-2001, 10:51 AM
Clandestiny (05-23-2001 19:26):
n0de (05-23-2001 12:43):
how can i set a breakpoint in sice which breaks not only if the program accesses a file but accesses a certain function in a e.g. a .dll ?

Hi Node,

Can you be a little more specific with your question ? Setting a standard bpx on a Windows API used by the proggy in question will cause SI to break when that function is called. And those API's are functions within windows dlls...ie User32.dll, Kernel32.dll....ect. Perhaps I misunderstand your question, but I fail to see the problem. If you can clarify then perhaps I can help.

Regards,
Clandestiny

Please correct me if i am wrong ;) ,but you want softice to break on non-standard DLL API functions ,stuff like timelock dlls and the like?

If so i think ICELOAD makes softICE break on DLL access..
n0de
05-29-2001, 01:44 PM
ok-let's see...
suppose i have a program which has it's serial caculations done in a seperate .dll.
Now, since i know the functions name (e.g. calc_serial) i want to get a bpx which only snaps if THIS function is called.


Some problem with proxies may arise here...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Some problem with proxies may arise here...
PDA

View Full Version : Some problem with proxies may arise here...

tsehp
05-23-2001, 07:26 PM
Hi,
I'm forced to ban more and more proxies to impeach a really-not-wanted-here guy (golem) to come here and flood us with his knowledge. He actually could have exhausted all his direct ip's, and now is using some anonymous proxies.
I'm forced to ban also those anonymous proxies he's using, so this could impeach yourself to connect on the messageboard.
If this happens, the only fast and working solution is to make a direct connection, sorry for this. I don't want to set a messageboard with messages to moderate before publishing or registering people before publishing messages, this is not needed actually.

Sorry for the problems,

+Tsehp


Int 13
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Int 13
PDA

View Full Version : Int 13

refra
05-24-2001, 06:31 AM
Hello all
While traping int 13
bpint 13 ah=4 verify ;softice pops up but the computer freezes;what can i do.

Can someone told what the int13 verifys here
is it the buffer in Bx Exists on FD or what
Thanks


The isp was changed just today
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > The isp was changed just today
PDA

View Full Version : The isp was changed just today

tsehp
05-26-2001, 05:17 PM
Considering the past problem we have with the unacceptable messageboard dos of the last weeks, all the problems was due to the isp that disabled our messageboard without warning anyone, just because it took too much cpu time.
So I changed the database system to mySql and woodmann accepted to find us another host, with much greater capacities :
-more bandwidth, space
-perl and c++ cgi's
So I hope that now everything will be much more stable, we are still under our test phase, so please report me or woodmann pretty fast if there is just a small problem on this messageboard.
Thanks again to all the people that helped me to build this place,
and don't hesitate to share with us your suggestions.
regards,

+Tsehp

ps: btw,as an experiment I've introduced some more details into headers + the rating option, for example I self reated mine 5 stars at first, but I can remove this one the newbie section if I am asked to do.


fiendish games key manager
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > fiendish games key manager
PDA

View Full Version : fiendish games key manager

Alyta
05-26-2001, 08:35 PM
How to deal with "fiendish games key manager" ?
How to make work a such protected game ?
qferret
05-29-2001, 09:13 PM
there is a byte patch out that allows you to use any serial (as long as it's in format x-xxxx-xxxx-xxx), I haven't looked at it, but if you try google, you may find it (probably an outdated version, but you could check the patch & find the ver they used & see how they did it)
ThrawN
05-30-2001, 09:23 PM
Yes when i was starting the art of cracking I was asked by my cousin to crack some rabit shooting game, that used this key mmanager. I came pretty close but it was slightly more advanced back then than i could handle. Could you include the keymanager system on the board please so i can have a look again?
Kayaker
05-30-2001, 10:20 PM
Heh, heh. Why does this sound so familiar to me?

I went over this quite a while back at BlackB's forum with someone - DaKrazySniper I think - (change your name Thrawn? ;) Could've been someone else)

The s/n routine was pretty much standard serial sniffing, lot's of passing to other memory locations.

The only reason I bother dredging this up again (I was sort of ignoring the post ;) is that the keymanager file *was* a little bit different. My memory's hazy, but if you run Regmon on it you'll see it's looking to create a couple of reg entries. If you create those entries it will do something - unpack the keymanager correctly, kick up the reg box, or something like that.

Read the command line help that's given and there's some switches to set as well. Scope out what filemon and regmon tell you and post the results, maybe my memory will come back :)

Or check out BlackB's discussion forum at
http://beam.to/cracking
the original thread may still be there near the bottom.

Kayaker
artisa
06-01-2001, 06:18 AM
i was too lazy to reverse the whole keychecker, so i write a simple patch. check http://ucol.home.lt/cgi-bin/ucol.pl?l_cracks
JimmyClif
06-01-2001, 07:19 AM
wtf ?
ThrawN
06-02-2001, 09:43 PM
Change my name? hardly, i very rarly post. I enjoy reading, learning and shutting up more. If you attualy read you dont need to ask ;)
Kayaker
06-02-2001, 10:16 PM
Sorry Thrawn,

I had had a bad experience with this, spending ages publicly and privately trying to help someone learn, when I think all they really wanted from me was the crack.

My mistake.

Regards,
Kayaker
ThrawN
06-02-2001, 10:37 PM
Come to think of it, the nick DaKrazySniper sounds familuar. Maybe he's asked me for cracks in the past sometimes or anoyed us in gcw channel :\


MFC32.ordinal.???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MFC32.ordinal.???
PDA

View Full Version : MFC32.ordinal.???

generalhackbar
05-27-2001, 12:43 PM
Hello,
I would like to know how to get the API 's name represented by MFC32.ordinal.??? while disassembling with Windasm.
Thanks.
Kayaker
05-27-2001, 07:02 PM
Hi gh,

Your first post, which I replied to, got lost in the ISP shuffle I guess.

I haven't got mfc32 on my system, but if it's like the rest of the mfc dlls, most of the API's are referenced by ordinal, not by name. If you check out the dll in Exescope you'll see this.

MFC42.dll has only 6 named functions. Not sure if Wdasm recognizes these or not, the rest you'll never see anyway 'cause I don't think there's anything *to* see.

Kayaker
generalhackbar
05-30-2001, 02:32 AM
thanks Kayaker,
i have found out that the names exist but the only way to translate the ordinal into the real name is to look into the MCF32.def.
Kayaker
05-30-2001, 04:45 AM
Hi generalhackbar,

Just curious, are there really (semi)descriptive names in the .def file, or are they just generic default names?

For example in mfc42 the "names" of an exported function seem either to be descriptive, or just "Ordinal x"

Addr:5F479A16 Ord: 1 (0001h) Name: DllGetClassObject
Addr:5F46E19E Ord: 256 (0100h) Name: Ordinal:0100

Before linking, would the .def file contain something a bit more useful than "Ordinal 100", and would this info be transferred into the compiled dll?

Kayaker
nud
05-30-2001, 06:03 PM
I wrote a lousy little prog that inserts function names from mfc.def into wdasm .alf files. It should be attached to this post, with source, in a zip file.

I don't know how mfc32.def is set up, so I have no idea if it'll work. Mfc42.def is set up like this (for ordinal 5880 [decimal]):

?SetBorderStyle@COleControl@@QAEXF@Z @ 5880 NONAME

Let me know if it works.


Serching for tutors on ExDec or other pcode tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Serching for tutors on ExDec or other pcode tools
PDA

View Full Version : Serching for tutors on ExDec or other pcode tools

bubaka
05-28-2001, 02:17 AM
Serching for tutors on ExDec or other pcode tools

thx.
Acid_Cool_178
05-28-2001, 04:32 PM
Try http://www.AcidCool.cjb.net
bubaka
05-29-2001, 07:30 PM
Thanx


Subliminal "Embeds" in SoftIce.......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Subliminal "Embeds" in SoftIce.......
PDA

View Full Version : Subliminal "Embeds" in SoftIce.......

+SplAj
05-29-2001, 08:29 AM
Here is a warning.

Did you know that due to the popular choice of using SoftIce to crack software instead of debugging system drivers as originally intended, the US Gov't and MS were lobbyed heavily by The Shareware Writers Guild and others to react to this uncivilised conduct. So along with the 'owners' of SI, Numega, they all made a decision to 'embed' a subliminal message in that soothing black screen.... so the longer you used SI, the more 'programmed' you became.............

The big question, *WHAT* is that hidden message ?

Before I answer that Q, think a little.

1) Did you ever wonder why such an expensive software is ALWAYS available on the WWW !
2) Why the updates to SI driver only happen when there is an improvement in screen technology / VGA cards and faster screen updates (like 100mhz) are used by the cracker
3) Why there are loads of *functioning* sites giving free tutorials on the use of SI to crack !

Ok, are you ready ?

The answer is to program the cracker into delusions of grandeur
and leetness. He is told to give up using SI and start programming instead. He also should 'dis' every user of Win32 and SI and should choose *nix to replace Win32 on his PC's
and waste several years back in 'command-line' mode and preach the ways of the 'penguin' to every god damn passer-by !

Thats how to get rid of Win32 crackers phorever !
The Shareware Writers Guild are happy now. The truth is out there.....

BUT WAIT. I have a solution. I made some special polarised glasses that filter this message. I can custom make them for you at $999 each.

Ok I know that's expensive. As a special offer I will give them to you at a cheaper price if you post some worthwile reversing questions on the MB over the next 3 months.

Take care !

+SplAj }>
2nEw
05-29-2001, 09:05 AM
hmmm.. Don't forget about Smartcheck, which can cause some users to break things and rant incoherently about cleaning up "our internet".
qferret
05-29-2001, 09:05 PM
ROFLMAO 2nEw!!! :D


softice not showing up?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice not showing up?
PDA

View Full Version : softice not showing up?

some dude
05-29-2001, 05:44 PM
on win2k, tnt card. when i start softice, then hit ctrl + d... it seems it comes up, but i cannot see the black dialog?! what?!!! how can i fix this m8's? :)


What to look for with a VB 6 app?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What to look for with a VB 6 app?
PDA

View Full Version : What to look for with a VB 6 app?

BeAR
05-29-2001, 05:58 PM
Hi All. I'm going to take a swing at an app that was made with VB6. Does anyone have any useful hints for me to get started?
-butchie
m0sk
05-30-2001, 09:27 PM
Be sure to get Numega's Smartcheck (version 6.03 is what you'll need, it's out there somewhere on the web :-)

Then go have a look at Eternal Bliss' tutorials (ebliss.cjb.net). Look for ``Visual Basic Part 1: Compare Methods and Breakpoints'' and ``Visual Basic Part 2: SmartCheck Usage''.

That should get you started

Have fun,
m0sk
BeAR
05-31-2001, 02:35 PM
Sweet! Thanks.


Serching for tutors how to dump & convert dumps to exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Serching for tutors how to dump & convert dumps to exe
PDA

View Full Version : Serching for tutors how to dump & convert dumps to exe

bubaka
05-29-2001, 07:32 PM
Serching for tutors how to dump & convert dumps to exe

thx
+SplAj
05-30-2001, 07:45 AM
You have ~FEW~ days or so to get the files from old www.discompress.com :-

http://59327516776/discompress/

Learn the PE file. Especially the header. Get latest PEditor1.7 from protoools (greetz y0da . Where is my 'registered' LordPE ???)
and have a play with your Notepad.exe . Get the full SP on basic Notepad then pack it with all those trial packers/protectors from exetools and protools et al.

There are other nice tuts aound as well (greetz ev!L_r!sc)

Then unpack/rebuild ......till you understand the concept.

Then come and ask some questions :-)
cos I bet you would just love to unpack ASprotect1.2, wouldn't you !

+SplAj }>
Kilby
05-30-2001, 08:33 AM
Unpacking asprotect 1.2 leaves an empty feeling and the inability to work on anything other than unpacking.

Please dont' do it :)

Seriously, Naughty-R!scs essay on Settlers 3 was the info that really helped

Regards,

Kilby...
hz
05-30-2001, 10:07 AM
Hiya +SplAj,

Bad news, Yoda's computer blew up and he lost the source for LordPe. Guess your $13 (and mine nearly :-)) goes toward a new computer. Straight up, check his home page.

regards
Kayaker
05-30-2001, 10:32 AM
hz (05-30-2001 08:07):

Bad news, Yoda's computer blew up and he lost the source for LordPe. Guess your $13 (and mine nearly :-)) goes toward a new computer. Straight up, check his home page.

Heh, heh. I know this borders on sacrilege, but have you found any, um, 'tempting' limitations in the demo version which might be reversable? }>

Kayaker
+SplAj
05-31-2001, 05:17 AM
F*cks I sent $15......had no change :-(

SplAj


TUT FOR USING IDA PRO
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > TUT FOR USING IDA PRO
PDA

View Full Version : TUT FOR USING IDA PRO

Ceno_2k
05-30-2001, 09:30 AM
Does anybody know where i can get good tuts for cracking ,using IDA pro ,personally i use winDASM ,but i have heard this program is really quite good.

Ta
Ceno
JimmyClif
05-30-2001, 12:28 PM
rtfm

Hope this helps,
JimmyClif
Kayaker
05-30-2001, 10:28 PM
And after you've done that check out

IDA Pro Advanced 4.x by BlackB

http://users.belgacom.net/blackb/ida.html

Kayaker


some kind of CRC that i can't overcome
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > some kind of CRC that i can't overcome
PDA

View Full Version : some kind of CRC that i can't overcome

Dante
05-30-2001, 04:55 PM
i started to play with nice shareware Atropos-SB.
It allows voice triggered recording of voice notes to MP3 etc.I detected that it's packed with UPX.After unpacking obvious stuff with ida.I found also (bad guy /good guy)switch but after patching it still crashes at the same point
in app (delphi3/4 Code).Later i found that it crashes even when i only switch two characters enywhere in text.Please does somebody know if there is some special approach to crack those Delphi apps? (Delphi form CRC ??) or it's just another CRC by author?.Im just wondering
,becouse the place where it still crashes dosn't seem like CRC check (GetCursor etc.).
Any advice apreciated.


what packer did I just unpack?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > what packer did I just unpack?
PDA

View Full Version : what packer did I just unpack?

()whore
05-30-2001, 11:16 PM
Hello everyone. I recently read a tut by Predator on inline patching an Asprotected app (Awave Studio v7.0). Unfortunately the link to download the file didn't work. I found a copy of Awave 7.0 elsewhere but found the tut didn't work with this version.

I am in process of learning to unpack programs and went ahead and with much work unpacked and cracked the app. However I am unsure what packer it was packed with. In other Asprotected targets I have looked at there is an .aspr section in PE header. This on has a section labled .Y38d5x

Anyone seen this befor and can tell me which packer this was. Are there other things I can check to tell which packer?

thanks
()whore
Ceno_2k
05-31-2001, 09:45 AM
Try using GETTYPE http://www.egroups.com/list/gettyp

Or UNPACK20

www.unpackinggods.de.vu www.unpacking.org
ug2000.tsx.org

And try to indentify the type of packer that way.
StOrM
05-31-2001, 08:01 PM
Goto www.exetools.com and look for a
proggy called Language2000. This one can detect most used packers (not Vbox).
sludge
06-13-2001, 04:35 PM
If i can recall correctly, asprotect lets you change the name of the section that it stores the code in. Either they used a different packer or they just decided to change the name.


Decompile .inx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Decompile .inx
PDA

View Full Version : Decompile .inx

Critter
05-31-2001, 05:33 AM
I thought I remembered a post about this previously, but I am unable to find it. Can someone shed a little light on how to decompile one of these files (setup.inx)

Thanks.

Critter


Si breakpoints for delphi stuff? please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Si breakpoints for delphi stuff? please
PDA

View Full Version : Si breakpoints for delphi stuff? please

Boristhebad
06-01-2001, 12:40 PM
Trying to get a prog to break after entering my unlock code then pressing the "OK" button to unlock. Hmemcpy creates numerous breaks before getting the mouse anywhere near the button, no nag screens are present so bp's on messagebox dont work. ..........so how can I get it to break after the button push?
I am hoping to then trace the code to extract the correct serial (you get 4 attempts at the unlock code before the regscreen (form with radio buttons to select which part of the prog you require) dissappears.
Dante
06-01-2001, 01:50 PM
Get any shareware which captures windows messages (WM_?? for ex.).I have c++ builder which contains such utility winsight32.exe
.So run it and just watch and learn which messages are generated in which situations.And after that just set bpm on that message in softice.Or for now try WM_GETTEXT. most appz are using it read text (serial?) from edit box just after you clicked on that button.


Which book for learning about Windows Internals?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Which book for learning about Windows Internals?
PDA

View Full Version : Which book for learning about Windows Internals?

edward
06-01-2001, 04:11 PM
Hi,
I would like to learn "more" about the Windows Internals.
Which book would you recommend to read on this topic?
Is there an up-to-date book at all?

thanks in advance for your help
regards
e.
mo k
06-01-2001, 08:11 PM
start with charles petzold's programming
windows. 5th edition is the latest i beleive.
This is not an internals book though, but it
is a good presentation of the "outernals" ;P

If you already now how to code at the api
level, and know your way around system
dlls, then get Matt Pietrek's "Windows 95
system programming secrets", probably
the only useful book from IDG publishing ;)

Both books are online everywhere in e-editions,
incase you are short of $ or cann't find them
around you ;)

I own both of them, and petzold's has the e-edition
in the CD. Pietrek's was scaned i think, and you will
need to hunt around in the scene.
I saw them last at gAnz's site.
ht7p://jump.to/ganz

Some people will suggest Keuler's win32 assembly
book, but not me.
If you want to study the IBM PC then get
Bary Brey's 80x86-Pentium pro book.
It is the best.

For win32 asm Iczelions tuts are simply the best
out there.
Look for a package called win32asm at his
site, writen by some pioneers in the field, don't
remember their name though :-(
it includes a well writen .doc file and a bunch
of demos.

Good luck
Carpathia
06-01-2001, 09:02 PM
nu, our tasty looking comrade, has pietreks book on her hompage ;-)

http://neudump.cjb.net
edward
06-03-2001, 09:28 AM
Thank you both for your replies :)

>If you already now how to code at the api
>level, and know your way around system
>dlls, then get Matt Pietrek's "Windows 95
>system programming secrets", probably
>the only useful book from IDG publishing ;)
Unfortunately this book isn't available any longer as
a "real" book, but I found the e-book, thats fine too. ;)

>For win32 asm Iczelions tuts are simply the best
>out there.
>Look for a package called win32asm at his
s>ite, writen by some pioneers in the field, don't
>remember their name though :-(
>it includes a well writen .doc file and a bunch
>of demos.
Yes, that is a great ressource for learning win32asm,
thx for the tipps...

regards
e.
topdeck
06-07-2001, 10:45 PM
There is another book similar to pietreks, done by the guys from sysinternals.
Inside Microsoft Windows 2000
I think this is also available in e-edition, but haven't seen it available anywhere.


help with packed program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help with packed program
PDA

View Full Version : help with packed program

()whore
06-02-2001, 07:49 AM
Help,
I posted earlier about a program (Awave studio 7.0), I thought I unpacked and cracked but I have been fooled. While the program would work ok dumped and patched I did more testing and found it would crash when saveing files.
The heart of the problem is a redirected api call (GetProcAddress). In the packed .exe this call was directed to a section in the packing code

005ce1e8 push ebp
... mov ebp,esp
... mov edx,[ebp+0c]
... mov eax,[ebp+08]
... cmp eax,[005db348] ; mem=ffffffff
... jnz 005d3a0e
... mov eax,[edx*4+005db348] ; gets pointer to decryption code
... jmp 005d3a1e
005d3a0e push edx
... push eax
... call kernel32!GetProcAddress
005da1e pop ebp
... ret 0008

This code checked if -1 was pushed if so then return a pointer to some decrpytion code (005cb4bc) in eax else just go ahead with the api.
I have a working IAT thanks to revirgin but that call it wouldn't resolve. I manualy pointed this call to GetProcAddress and that seamed to work. However at one place the program needs the pointer returned from the original (unpacked program) function to decrypt the save file code. I had it patched to skip this check and it didn't seams to be needed untill I tried the save functions.
I could work around this by patching the address to the save file decryption at the right place but in the dumped version there is NOTHING in memory where the decryption routine should be. While in the packed .exe there is code.
I am guessing that somewhere in the packed .exe the code is writen to that location and that my dumped version never runs the unpakcing code so no code gets placed there.
How can I get around this? It seams devlish that even though the program is unpacked and dumped fine it is still useing code from the unpacker. Please help give me some pointers if you can. I am several days on this and running out of steam.
Thanks.
()whore


RegMon Detection Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RegMon Detection Protection
PDA

View Full Version : RegMon Detection Protection

Joda
06-03-2001, 05:21 AM
Hey guys - totally new here i got my first question right with me.
I have a two programs here, seeming to use exactly the same protection, some kind of packing or encryption and a serial check, which does something in the registry.
But the prog shuts down my RegMon when i start it. I searched the web but wasnt able to find any infos on RegMon protections - this Anti_Anti-Regmon-Patch doesnt work with me.

Any ideas how to defeat that?

Thx in advance,

Joda
GodsJiva
06-03-2001, 08:16 AM
Hi there, welcome.

I had the same problem, I got round it by hexediting regmon.exe (and filemon.exe) and replacing all occurrences of regmon with something else, (I used, erm, segmon :P). Then rename the file itself and the folder its in (not sure thats actually necessary, but hey).

Have fun
CrackZ
06-03-2001, 01:02 PM
Hiya,

One other possibility I ran into a few nights ago in ASProtect.

He calls GetClassNameA to find the name of all the classes, then uppercases and compares them too a few known bad guys REGMONCLASS / FILEMONEX and a few others, if he finds them, FindWindowExA & SendMessageA combine to close regmon/filemon.

Take a search in your hex editor for 'regmonclass' and change it slightly and this detection bites the dust. The check is looped several times so this is probably the best solution. Early tools simply change the regmon window caption, for when only FindWindowExA was used.

Regards

CrackZ.
GodsJiva
06-03-2001, 01:46 PM
Crackz - thats probably what my search for just regmon changed without me knowing ;-)
mo k
06-03-2001, 05:41 PM
why hexedit? regmon cometh with full source
code.
qferret
06-03-2001, 09:47 PM
takes longer to compile than to search & replace hehe ;-)
CrackZ
06-04-2001, 12:42 AM
My oh my :-).

To GodsJiva : I intentionally posted the method of detection since in my mind the method is far more important than blindly hex editing strings, you can disagree with me on the learning value of that if you want ;-).

To mo k : Aren't these newbies supposed to work a little and figure out solutions, progression so to speak, thought process "I know he detects the class name, I have the source code, lets see, what if.....".

Regards and please no flames, I'm not criticising anyone here ;-).

CrackZ.
GodsJiva
06-04-2001, 01:25 AM
CrackZ, I agree with you. I did actually find what I thought was the reason... After I had done the search & replace, I left the hex editor open, which had the filename filemon.exe in the title bar. When I ran the prog that was killing filemon, it left the modified filemon alone, but closed the hex editor :-P
Joda
06-04-2001, 01:52 AM
Heya.

Thanks for the ideas, goin to try them out after breakfast ;D - another guy told me that it seemed, the programmers of that program renamed some sections of the PE header, so the unpackers cant check, that its ASPack - maybe i can get it cracked with the new infos i got :)

cya

Joda


Delphi IDE detection ? - for Help ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Delphi IDE detection ? - for Help ...
PDA

View Full Version : Delphi IDE detection ? - for Help ...

LC
06-03-2001, 05:59 PM
Hi All.
I try to learn how can we crack delphi app (bpl, dcl, app ...) but that will ONLY work while Delphi-IDE is RUNNING

- Does anyone have any useful hints for me to get started ?

Thanks in advance
Solomon
06-03-2001, 11:07 PM
try "BPX FindWindow" etc.
LC
06-04-2001, 02:29 AM
Solomon (06-03-2001 21:07):
try "BPX FindWindow" etc.

Hi,
Thanks for your reply ...
I try to explain (I'm a newbie) : I try to find how a Delphi program can detect the Delphi-ide for running and so, how can I start for cracking it: is-it OK "bpx FindWindow" ?
how can I do for break in delphi Package (BPL ...) ?

thanks in advance
Regards


PDB--->NMS, How?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PDB--->NMS, How?
PDA

View Full Version : PDB--->NMS, How?

Solomon
06-03-2001, 09:49 PM
I write a DLL in Visual C++, and build it with debug info, then I get a PDB file. How to extract the debug info(line number, symbol, source code) and save it to a NMS file?

There is no corresponding DBG file :(
or how to get a DBG file when compiling it?
Thx
Solomon
06-03-2001, 11:31 PM
well, after some searching, I found the way.

Just put the DLL/EXE and the PDB file in the same directory, load the DLL/EXE with symbol loader, and click "Module-->translate", a NMS file will be generated. Sure you need to setup "Module-->Settings" first.

That's it.


sentinel superpro sheme : someone understand this ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sentinel superpro sheme : someone understand this ?
PDA

View Full Version : sentinel superpro sheme : someone understand this ?

samy la guigne
06-04-2001, 04:57 AM
i'l try to understand the call of sentinel.dll to jump it
then the setup's program 'll be fully optional but noway to do this

next the second request is
that the geoport check everytime if the dongle is here
some's got an idea ?
bobik
06-04-2001, 10:21 AM
I don't know if that helps . I have undongled one one programm protected with
sentinel shell. So how sentinel shell works i think :

It decrypt itself using some data stored in the dongle , so see if your's dll
is not encrypted.

In any case you can see what exported functions setup call from dll, an write
own dll ( for ex. in Delphi ) with the same function names but returnig allways
correct value expecting by setup shield

Sorry for corrupted language and best wishes.

P.S. whar u are undongling ?

samy la guigne (06-04-2001 02:57):
i'l try to understand the call of sentinel.dll to jump it
then the setup's program 'll be fully optional but noway to do this

next the second request is
that the geoport check everytime if the dongle is here
some's got an idea ?
bobik
06-04-2001, 10:33 AM
Attached Setup.exe is not enought, it looks for setup.Lst and fails

samy la guigne (06-04-2001 02:57):
i'l try to understand the call of sentinel.dll to jump it
then the setup's program 'll be fully optional but noway to do this

next the second request is
that the geoport check everytime if the dongle is here
some's got an idea ?
samy la guigne
06-04-2001, 12:25 PM
here there is the rest of the setup prog
thank for all


Software sniffers for LPT and COM Ports
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Software sniffers for LPT and COM Ports
PDA

View Full Version : Software sniffers for LPT and COM Ports

bobik
06-04-2001, 10:12 AM
Cause now the era of "homemade" dongles begins, i search for some programs
that can trace data on LPT & COM Ports. (If a simple hardware can be made
myself it will be OK )

Also please let me know if there is any "PIC programming for dummies"
site, to start.

Big Thx for reading and help


Telock signature problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Telock signature problem
PDA

View Full Version : Telock signature problem

bobik
06-04-2001, 10:30 AM
Gentelmen,

I have following problem : the succseffuly dumped aplication can't be
compresed again ( it was telock 0.80 paked ) evey packer i try fails
(producing non working application ) . and telocks says "already compresed"

That means the header is somewhere signed ?
How telock signature looks like ?

Thx
CoDe_InSiDe
06-04-2001, 11:58 PM
Hi bobik,

Most Packers/Encrypters leave a Signature at a certain place in the PE Header.
Look at the place:

"Offset PE Header + F0"

This place isn't used by the PE Header Structure (Or to say it even better by the Optional Header ;) )
I've tried tElock v0.80 myself with some test file and this place contained the value:

0000000000002000

It's probably the same with your File :)
Hope this helps.

Cya...

CoDe_InSiDe
Kilby
06-05-2001, 03:16 AM
You can use upx -f to force the packer to get on with it's work.

Whough I would prefer to have Telock to have a force option.

Kilby...
madmax
06-05-2001, 11:38 AM
I've noticed this prob on some unpacked apps with ASPR as well...I tried upx -f and my own packer and both lead to faults...I've not yet explored why, but it likely involves something with the rebuilt IAT from RV/importrec...Unfortunately some packers modify stuff as to not allow layering, and I find it to be kinda crappy...Check what changes in the peheader as well..I know telock changes # of sections (PE+8) to FFFF..Fix that first.

madmax
ThrawN
06-05-2001, 08:52 PM
Try somethign on the simple side.
Some packers simply simply check the files sections (UPX) and if they are packed with a packer, or at least unpacked without the sections renamed etc.., they wont pack.
Kilby
06-06-2001, 07:55 AM
Un-Asprtoected progs, seem to pack happily with upx -f.

TeLock, identifys the file as being packed with an as product.

Section renaming dosn't help.

Kilby...


The small essay from newbie showing how to dump packed VB programs and find entry point in dump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > The small essay from newbie showing how to dump packed VB programs and find entry point in dump
PDA

View Full Version : The small essay from newbie showing how to dump packed VB programs and find entry point in dump

bobik
06-04-2001, 11:31 AM
The small essay from newbie showing how to dump packed VB programs and find entry point in dump

get it here http://yuan.terrashare.com/dump.html


the rest of the setup process : dongle thing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > the rest of the setup process : dongle thing
PDA

View Full Version : the rest of the setup process : dongle thing

samy la guigne
06-04-2001, 12:32 PM
for courageous and brillant men here is the rest of the installation process
i didn't put the data coz 3 meg ....
but it works withou i've tried

thank by advance
sam
bobik
06-04-2001, 01:20 PM
I don't understand french

samy la guigne (06-04-2001 10:32):
for courageous and brillant men here is the rest of the installation process
i didn't put the data coz 3 meg ....
but it works withou i've tried

thank by advance
sam
samy la guigne
06-05-2001, 05:12 AM
speak french is no necessary
the problem in fact is :
the program stop in a menu to select option to install
but if dongle is not here you can't select them
as : "taxation" "hotel" they don't stay selected
can you reverse this please

a desesperate man
sam
best regards


dongle bash
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > dongle bash
PDA

View Full Version : dongle bash

samy la guigne
06-04-2001, 01:05 PM
i've posted another dongle problem but is ther someone who can take a look to the attached pieces in my first below message ??
the geoport.EXE check the 378 port for a sentinel dongle how to nop it ??
cast
06-06-2001, 04:36 PM
in softice bpio 378 -rw
now f12 til your back in the executable. Now f12 until EAX=03
Your now at FindFirstUnit. Trace from there, and ye'll see.
samy la guigne
06-07-2001, 02:24 AM
But as a newbies like me
I missed one or two thing
first
in softice bpio 378 –rw <<<ok
now f12 til your back in the executable.<< where am i supposed to land ?

Now f12 until EAX=03 <<< eax,13 ???

You r now at FindFirstUnit.<<< how do you know that is this fonction called

Trace from there, <<< sorry to ask that : how to trace ??

and ye'll see.<<<< i really wait to see ;;;

In case really thank you for what you’ve done

Sam
Best regards


So new it's embarrassing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > So new it's embarrassing
PDA

View Full Version : So new it's embarrassing

Tryta
06-04-2001, 08:03 PM
I've been staring at Softice for two days now...I've had one programming class (got a "C" in Pascal), have downloaded and read as many manuals and tutorials as I can find...
What's the best way for someone with virtually no experience to learn programming and reverse programming?
Kayaker
06-04-2001, 10:28 PM
Welcome Tyrta!

Well, you've definitely come to the right place. We're in the process of creating a FAQ for just this type of question. It's still under construction, but the references should give you a good start in learning the basics and beyond. Plenty of reading material in there.

At the heart of it all is probably understanding ASM, since that's what you'll be staring at in SoftIce all the time. Next might be learning about Windows API's which will give you an understanding of how Win32 operates. Of course learning to use the tools such as SoftIce, W32Dasm, Filemon, Regmon, etc. is part of it all.

Start by working through some basic tutorials to get the hang of it, but don't hesitate to explore (and get lost in) the code on your own. It's a slow, but rewarding process. There's lots to learn. Lurk, ask questions, and peruse earlier posts on the board to see the scope of the field.

Good Luck. The (in progress) FAQ is located at
http://208.50.16.104/Ultraboard/Public/Uploads/Post-11-375-rce_faq.html
but check out the thread in the General Considerations board for the most updated version

Regards,
Kayaker
qferret
06-04-2001, 10:32 PM
read, read, read ....& oh yeah, did I mention read? ;-)

find yourself some good programming books & a compiler or 2 (I'm partial to C/C++ myself)

for the reversing end of things.....a good grasp of ASM & the internals of Windows itself is highly recommended. Get the basic tools (you already have Softice, got a disassembler and a hexeditor?), and learn to use them (RTFM's)....there are also a few tutorials around on the basics of softice (check +Sandman's site)

An API reference and Intel OpCode reference come in handy too ;-)
qferret
06-04-2001, 10:34 PM
Hi Kayaker, I see we posted at the same time here....got ICQ? ;-P
JimmyClif
06-04-2001, 10:36 PM
?ferret - C/C++ ? What happened to VB? Too slow? *lol*
qferret
06-04-2001, 11:44 PM
hehe...I just crack VB.....never have liked programming in it }:>
madmax
06-05-2001, 11:33 AM
I believe one of the best ways to learn is to code things...Little projects are the best (say a PE packer,trainer) to learn structure as well as familiarizing yourself with the common APIs...And reversing is not exactly necessary for cracking, so dont get too overwhelmed =)

madmax


--> Need Help !!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > --> Need Help !!!
PDA

View Full Version : --> Need Help !!!

-->kNKi<--
06-05-2001, 08:35 PM
(Win2K)
Hi,
I'm a Newbie :for some help please :)
- 2 questions -

1/ - I try to learn how I can crack a delphi prog which use IDE detection for running; exe demo has been compiled with BPL, DCU TRIAL and stop after a popup window with "only run with delphi IDE ..."
- no "bpx MessageBoxA, GetDlgItemTextA" works
- "bpx FindWindow" doesn't work with "symbol not defined" but kernel32, user32 and so on ... are configured in winice.dat
How ca I do ???

2/The second essay I try is also new for me :
- I run an exe package INSTALLATION prog and when it starts there are:
- a popup with "wise installation started ..." (??)
- a pop dialog box with "userID and Key" for continue with a "next" button
- a temp file xxxx.tmp (dll type) used by the installation prog
- but -
- no "bpx MessageBoxA, GetDlgItemTextA" works again >(
- only one "bpx GetDlgItem" works but very ??? for me

I appreciate for your help
Thanks in advance
--kNKi
Ceno_2k
06-06-2001, 07:56 AM
The reason why softice does not break when running a DELPHI program is because it does not use standard WINDOW's API functions

Find some tuts on cracking DELPHI programs there are loads out there ;)

Ceno_2k
Go here and enjoy

http://zor.org/krobar/


Trouble cracking windows commander 4.51
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Trouble cracking windows commander 4.51
PDA

View Full Version : Trouble cracking windows commander 4.51

termose
06-06-2001, 10:25 AM
Man... I am really tired trying to crack this program. I try using bpx readfile and bpx readfilea and somehow find the part that read the keyfile. But I still can't find out what next. Could someone please help me crack this program ?
JMI
06-06-2001, 05:45 PM
No disrespect intended, but one of the reasons that you often see suggestions that you do a search "before" you ask for help is that there is often "help" in the form of articles or previous threads available "if you look."

As to your specific question, a review of the Newbie Board over just the last 45 days would have led you to a long thread on 4-25-2001 which contains substantial hints and directions to helpful articles on "reversing" various versions of Win Commander and where the difficulties may be found.

Give that a try and come back after you've tried some of the things you find there.

Good Luck JMI


Thanx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Thanx
PDA

View Full Version : Thanx

Tryta
06-06-2001, 05:00 PM
Thanx for your support and encouragement regarding my extreme newness in learning programming and reversing. I appreciate the courtesy and have already begun following your tips and suggestions.

thanx

Tryta


Is any non commercial protection a-la Soft Sentry known
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is any non commercial protection a-la Soft Sentry known
PDA

View Full Version : Is any non commercial protection a-la Soft Sentry known

bobik
06-07-2001, 04:02 AM
Is any non commercial protection a-la Soft Sentry known
Wrapper to createc trials without dll and stupid license files
Must be not uncrackable

Thx
noname
06-07-2001, 05:45 AM
bobik (06-07-2001 02:02):
Is any non commercial protection a-la Soft Sentry known
Wrapper to createc trials without dll and stupid license files
Must be not uncrackable

Thx

Code your self :P


FS 98 atc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FS 98 atc
PDA

View Full Version : FS 98 atc

Elric
06-07-2001, 04:12 AM
Hi !

I'm new in this forum (and in cracking too :).

I tried to crack FS 98 atc 1.0 but when I try to disassemble it (via IDA, very good tool) I obtain only a call to VB6 ThunRTMain and after, lots of "db". I tried to use SoftIce but it never shows the name of FS 98 atc 1.0 but 'USER(0), ...' and when I try to search an instruction shown by SoftIce, I can't find it in the file.

Please, Help ! Could you give me the technic I could use for this ? Is it crypted or packed (I don't think so, but I'am perhaps wrong)

Thanks
Eternal Bliss
06-07-2001, 04:32 AM
Elric (06-07-2001 02:12):
Hi !

I'm new in this forum (and in cracking too :).

I tried to crack FS 98 atc 1.0 but when I try to disassemble it (via IDA, very good tool) I obtain only a call to VB6 ThunRTMain and after, lots of "db". I tried to use SoftIce but it never shows the name of FS 98 atc 1.0 but 'USER(0), ...' and when I try to search an instruction shown by SoftIce, I can't find it in the file.

Please, Help ! Could you give me the technic I could use for this ? Is it crypted or packed (I don't think so, but I'am perhaps wrong)

Thanks

It looks like the program is written in visual basic. And most likely to be compiled in pcode which is similar to a script that is read by msvbvm60.dll (visual basic runtime file). Using a disassembler will not help much. Softice will help to a certain extent. But you will not be in FS's code most of the time but msvbvm60. The most useful tool in my opinion is josephco's visual basic diassembler called Exdec. Look for it at http://www.mesa-sys.com/~codomain/

You might want to read some tutorials based on that tool. Look for it at ebliss.cjb.net

Happy learning
EB


How to hide SICE under Win2k when unwrap VBOX43??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to hide SICE under Win2k when unwrap VBOX43??
PDA

View Full Version : How to hide SICE under Win2k when unwrap VBOX43??

tigeros
06-07-2001, 02:13 PM
Hello all!
I am a newbie to hack. I used the way
decribed by dEZZY. Under Win98 I used TRW2000
2.33 to load and use BPX 70049D9 to get
around that debuger check. But the
resulted exe not runnable.

Under Win2k I used SICE 4.05. But the symbole loader never stopped at the entry point. And I used ProcessPatch to patch the code at 70049D9 to 0xCC and set I3Here=On. Ok,
it stopped and I repatch the code and set EAX
to zero. I get the Nag screen. But after I
clicked "Try" and it comes again to 70049D9,
ok I set EAX again to zero and F5 run. But
it won't run and telling debugger was found.
Ok, I check after that process after second
70049D9 run, it goes to 70063DF. It seems
that there will be checked if the in memory
image's CRC is correct or not. Ok, I fuck
up that code and F5 run, it crashes becauses
of "Access Violation" sometimes later.
I have no idea now. What should be done to
hide SICE???

I used NTALL to hide SICE under Win2k, But
dunno why it nevers works now, always said,
that failed to init KMD or something.

Any help would be grateful!!!

P.S.: The APP is F-Secure SSH Client 4.3
tigeros
06-07-2001, 04:29 PM
Now it can run, but it never calls
GetProcAddress(I used bpx GetProcAddress)
Ok, I know the entry point and set a bpm xxx
there. But I'll look forward why this is
diffrent under win2k than win9x


this sentinel dongle kill me ! please need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > this sentinel dongle kill me ! please need help
PDA

View Full Version : this sentinel dongle kill me ! please need help

samy la guigne
06-04-2001, 05:07 AM
i'm just newbie it's a matter of fact
but i try to trace the superpro's call in order to nop it
but noway
someone 'd got an idea ??

please
CrackZ
06-04-2001, 01:06 PM
Hiya.

1. Your upload is missing a whole load of dll's, namely :

GEOUTI32.dll, GEOHOC32.dll, FNCTVX32.dll, PIPE32.dll, GEOCOM32.dll, PORTUTIL.dll.

2. The .exe you have uploaded contains the Sentinel 5.31 object. I recommend you load this target into IDA, download Killer_3k's Sentinel SuperPro signature and apply that (from my site).

I also suggest you familiarise yourself with the Sentinel SuperPro API, www.rainbow.com may still have the pdf's, else several of the essays on my and +Tsehp's site can help you more.

3. Initial analysis confirms the main file is protected, there appear only to be calls to sproFindFirstUnit(sub_4288c0) and 2 xrefs to sproRead(sub_428ae0), the read appears to be in a loop so multiple words are being retrieved from the dongle. This is probably about as basic as a Sentinel protection comes ;-).

Anyhow, if you want more help with this, drop me an e-mail (only if your prepared to provide those missing files ;-) else theres enough here and on the web for you to get through).

Regards

CrackZ.
samy la guigne
06-04-2001, 04:06 PM
here are the files missing to you crackz Z

can you explain to a newby like me,
how to patch this target with ida and your signature thing
in detail please if you couls because
it's appear that many of the other executable with this one are protected in the same way so
in order to not boring you anymore
if you could help me
CrackZ
06-04-2001, 06:22 PM
Hiya.

Thanks for the files. It seems it as above.

Program calls sproFindFirstUnit(developer ID 4142h). Easy patch to AX=0. Program then loops sproRead() twice, reading words 0x8-0x26 in one loop and 0x1A-0x3F in another, the destination buffer is the same in both cases i.e. 0x1A-0x26 are duplicate reads.

Bypassing these I could find only 2 instances of where the dongles memory was used, I don't know what this program does so it may be used later on or in other programs in the suite.

Word 9 - version information.
Word 0x30 - high byte test'd with 1 toggles the edition, 'GeoPort' or 'MD-90 port'.

Regards

CrackZ.

NB - None of the dll's you gave me seem to be protected, although the inclusion of superpro.dll in the package makes me think something somewhere must call in via there ;-).
samy la guigne
06-05-2001, 03:23 AM
so sorry to be a newbies but i don't wherer to start
i've got every tool softice hexedit ida w32dasm

i've read your answer
open my target with ida, download your signature by "load flirt signature file"
with and WHAT ???????????????
what do i suppose to be :
Create output file in exe
but i can't coz he reply me that he can do this only for msdos prog :(
what i am suppose to do ?
i've got 4 similar prog to undongle
i'm really ambarrasssed can you teach me again
tsehp
06-07-2001, 02:23 PM
hi samy,
I had to move this thread up to the newbies section where it belongs.
You first have to master the tools, learn about the api's, crackz is really nice to help you in such a way, but he will not give directly the solution to patch your apps.

regards,

+Tsehp


Harlequin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Harlequin
PDA

View Full Version : Harlequin

TheBossman
06-08-2001, 08:00 AM
Having been away from the scene for quite a while I thought I would try and refresh my knowledge by starting at harlequin's site. It would appear that the tasks are unavailable, due to site being under construction. Does anybody know where I can obtain the first task from?

Regards

TheBossman
CoDe_InSiDe
06-08-2001, 08:13 AM
Hi TheBossman,

I think you've been to http://harlequin00.cjb.net right?
If so i could download the first task there no problem :)
Otherwise try here:

http://jove.prohosting.com/~thsnake/harl1.zip

Cya...

CoDe_InSiDe


"xxx is not a vaild Win32 application" errrrrrrg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > "xxx is not a vaild Win32 application" errrrrrrg
PDA

View Full Version : "xxx is not a vaild Win32 application" errrrrrrg

tigeros
06-08-2001, 12:25 PM
I tested some from Procdump some unwrapped exe under win2000, I always get that message.
Those apps runs well under win98. I tried
to use PE Editor's rebuild function, but
not work.

I tried to unwrap under win2k, the result
is the same.

Can anyone tell me, what is wrong? How should
I repair such procdumpped exe???

thanx
tigeros
06-08-2001, 06:24 PM
ok, it seems that no one has interest
on my stupid questions.

But does not matter, I played around
with that PE Editor, and successed
making all unwrapped exe run under win2k!
But there is no standard solution of them!
Sometimes need to realign(rebuild) the exe,
sometimes change the characteristic of
a section in PE, sometimes must be ripped
under Win2k at first...
qferret
06-08-2001, 08:56 PM
protools.cjb.net -> utils

________________________________________
PE Validator by LaZaRuS. 02.V.2000.
PE Validator 1.0 (7K).

PE Validator is a small tool that adjusts PE headers of EXE files that don't run under Win2K (this file is not a valid Win32 Executable) so that they run under Win2K.
_________________________________________
tigeros
06-09-2001, 04:27 AM
hey, thanx man. I checked it, but I used it
to compare two exes, unwrapped from same
vbox, one is only runnable under win98,
the other is runnable for both win2k and 9x,
but the result from pevalid didn't show the point, that need to change(Or I stupid
don't know what it means ;))

I'd rather change it myself now!
Acid_Cool_178
06-09-2001, 08:19 AM
qferret (06-08-2001 18:56):
protools.cjb.net -> utils

________________________________________
PE Validator by LaZaRuS. 02.V.2000.
PE Validator 1.0 (7K).

PE Validator is a small tool that adjusts PE headers of EXE files that don't run under Win2K (this file is not a valid Win32 Executable) so that they run under Win2K.
_________________________________________

I have used that utility at CoDe_InSiDe's crackmes wich don't work under win2k. And with that tool the crackmes still don't work.... any ideas ??
LaZ
06-09-2001, 10:40 AM
Hi

check the SizeOfImage value, its often the reason for such a error message and my tool has a bug for certain files when calculating the SizeOfImage value.

Regards
LaZ
Acid_Cool_178
06-09-2001, 01:58 PM
Hi Laz

I have checked the SizeOfImage and it was WRONG so i dubble clicked on it so fix it.
I did the same thing with SiseOfHeaders and it still don't work...

Do you have any good ideas on what can bwe wrong, none else sections are wrong and i'm testing at CoDe InSiDe's crackme 1.. ( http://codeinside.cjb.net/ )

I'll take all ideas on how to make it work on a Win2K box..

Acid_Cool_178
tigeros
06-10-2001, 04:40 AM
OS: Win2k
freeze the app and use procdump to make a
full dump, but be sure select "Don't rebuild
import" in "Option" before dump!
And use a tool names Import REConstructor
v1.2 to fix the dumped.exe by make a
IAT to it. It can also fix EIP to OEP if
you have it(u must have it already).

I tried this cause by some dumping
Procdump crashes when I select rebuild
import table.

The tool is to find at protool
Eifful
06-10-2001, 07:45 AM
for 2k dumps *ALWAYS* fix the checksum ;)

remember......Guinness is good for you...yes it's me ! }>


How to pass the installshield 6 anti-softice tricks?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to pass the installshield 6 anti-softice tricks?
PDA

View Full Version : How to pass the installshield 6 anti-softice tricks?

draX
06-09-2001, 03:55 AM
i'm trying to get pass the anti-softice routines of a program that is installed using installshield 6(fileversion 6, 02, 100, 1247). when i have softice loaded it just says it cant load setup for any reason. when i try to hide softice with frogsice, my pc reboots or hangs. i found the call where the message is dispalayed that setup cant continue, but i cant figure out where the installer checks for the presence of softice. does anyone know how to fix this?

thx draX
bobik
06-10-2001, 03:58 PM
Try icedump

1) load it
2) enable protection ( protect on )
2a) start proggy
3) if soft ice pops sayind " bla bla tryind ... " disable protect , trace a few steps
manually (F8)
4) enable protection again
5) and so on

I think it is classical way to defeat such things

WBR bobik

draX (06-09-2001 01:55):
i'm trying to get pass the anti-softice routines of a program that is installed using installshield 6(fileversion 6, 02, 100, 1247). when i have softice loaded it just says it cant load setup for any reason. when i try to hide softice with frogsice, my pc reboots or hangs. i found the call where the message is dispalayed that setup cant continue, but i cant figure out where the installer checks for the presence of softice. does anyone know how to fix this?

thx draX


Hi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hi
PDA

View Full Version : Hi

Wampyre
06-09-2001, 04:11 AM
Hi peoples. I have found my way here in the search for learning reverse engineering. I have no background in programming and only 12mths in warez. but I am beggining to learn VB and will start on C++ soon too. Am I in the right place to learn here? or is this not an apropriate place for someone with zero experience such as Myself?
Eternal Bliss
06-09-2001, 06:06 AM
Wampyre (06-09-2001 02:11):
Hi peoples. I have found my way here in the search for learning reverse engineering. I have no background in programming and only 12mths in warez. but I am beggining to learn VB and will start on C++ soon too. Am I in the right place to learn here? or is this not an apropriate place for someone with zero experience such as Myself?

It is the right place. But you must start with the right attitude or you will develop into a lamer. 8P

Listen to my advice:
1) Learn to search for tutorials, tools etc (if you are from the warez scene, that shouldn't be difficult)
2) Learn to read and think.
3) Learn to understand what you are reading and why.
4) Learn to use the tools with the help of tutorials.
5) Learn to crack simple things first before trying difficult things.
6) Learn the sad fact of life: God help those that help themselves.

Enjoy!

Regards
EB
qferret
06-09-2001, 01:29 PM
.....and after all that (or during all that, as the case may be), if you have questions, this is the place ;-)


Where to learn crack of safedisc 2?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where to learn crack of safedisc 2?
PDA

View Full Version : Where to learn crack of safedisc 2?

tigeros
06-09-2001, 09:03 AM
I searched this forum and main web site,
found only some advanced infos, but never
got a tut. for newbie like me. Is there
any useful link or infos about the
protection of Safedisc2?

Thanx!


De -armadilling
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > De -armadilling
PDA

View Full Version : De -armadilling

bobik
06-09-2001, 11:15 PM
Are any methods known ( for ex. Brute force ) to defeat armadillo protection
for programs that do not have trial mode ? It wants password before unpacking application.
mo k
06-10-2001, 12:01 AM
i think it was risc who did it last. Not really
interested in the protection at the moment,
but i have had a weird incident with it last time
i had it.

The moment the download was over, the entire
PC slowed down. I couldn't do anything, not
even run it OR other apps.

I checked the web for info, and i found an assembly
snippet that does just this, it was called "turtle".
It was in one of those FidoNet packages from
simtel.

Just wondering if anyone else has come across
other protschemes that do this.
mo k
06-10-2001, 12:08 AM
sorry i wasn't of help above

Look for a tool called unarmadillo at protools.
there was also another one called de-armadillo.
bobik
06-10-2001, 01:58 PM
this not help cause proggy has no trial mode as mentioned above
mo k
06-10-2001, 05:12 PM
my my my my,

armadillo was done black and blue.

search for the following files:
armd184.zip (the commercial packer)
armdep.zip (unpacker)
armkiller.zip "
armkiller.zip11 "
armkiller12.zip "
unarm.zip "


Installshield 6 -Need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Installshield 6 -Need help
PDA

View Full Version : Installshield 6 -Need help

draX
06-10-2001, 07:53 AM
does anyone know where i can find information about how to handle an installshield 6 package? i need information about how to work on the product-serial protection. if someone did installshield before, or know where to find information about it, please help me, thx.
draX
06-10-2001, 07:55 AM
i forgot to mention, i passed the anti-sice tricks, so i only need help on the serial now.

thanks
Kythen
06-18-2001, 01:47 PM
The first thing you need to do is to determine if the serial protection is in the InstallShield script or if it is in some dll called by the installer. Run the installer and while it is running look for a newly created directory in your %TEMP% directory (C:\windows\temp for 9x or C:\Documents and Settings\<username>\Local Settings\Temp\ for NT/2k). See if there are any non-InstallShield dlls in the directory and look through them for anything suspicious (you can find IS dll's by looking at version info in properties) Find something interesting and you probably can just look at that dll rather than messing around with InstallShield itself.
If you don't find anything however, don't worry. It just means that the serial is probably in the script file. The script file will be setup.ins or setup.inx Use isd from h**p://nekosuki.virtualave.net/isd.zip Then use the search in your favorite text editor to find the error message you get (if any) and look through the dead listing to reverse your serial protection.

If you have any other questions/problems, just let us know :)

Regards,
Kythen
Critter
06-19-2001, 09:15 PM
I don't suppose there are any tutorials around for the reversing of an inx file?
Kythen
06-19-2001, 10:33 PM
Natzgul's InstallShield script cracking tutorial would be the closest that I can think of. If you mean the reverse engineering of the .inx files in the decompiling sense, i'd say look at the source code of isdcc (old IS decompiler). If you mean reverse engineering the dead listing made by the isd decompiler, that is no different than reverse engineering a messy C source file :)
Critter
06-27-2001, 08:06 AM
Unfortunately, I can understand his tut, (can't get wisedec working on win2k, though) but the setup.inx file I have just confuses the hell out of me....I do not know where to start.. or even how to recompile it.
Kythen
06-27-2001, 08:30 AM
Ok, np. First thing is that wisdec can't handle .inx files... only older .ins files from InstallShield v5.x or earlier (afaik). Second, after decompiling the .inx file with ISD, open the resulting text file in your favorite editor and look for an error message or some other message that you can work from. After that, look through and see what leads to that good boy or bad boy message and try to reverse engineer the serial algorithm. You don't actually recompile the script at all. This is probably easier to do than patch the .inx file imo, as there isn't much documentation on inx files, opcodes, etc. If you can't find any message, try looking in your temp directory for any suspicious dll's that the InstallShield script may call. If the serial protection is in a dll, just crack it like you would any other program.
Solomon
06-27-2001, 08:36 AM
Just search in this forum section.
I asked such questions long time ago. A Japanese guy wrtites a decompiler for *.INX file. I have tried it and it really works.
Critter
06-29-2001, 08:05 AM
cheers. thanks for the replies.....I shall delve back into it


who has already seen this protection ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > who has already seen this protection ?
PDA

View Full Version : who has already seen this protection ?

bobik
06-10-2001, 02:01 PM
What delphi component put such kind of protection inside main form ?

object Ss: TSs
EncrypKey = 'x3r100'
RegistryKey = 'SOFTWARE\PSW\x3r100'
RegName = 'UNREGISTERED'
TrialDays = 0
UseHDSerial = True
LogAutoClrate = False
Left = 16
Top = 96
end
end

Thx.
CoDe_InSiDe
06-10-2001, 02:53 PM
Hi bobik,

You seem kinda active the last days in this forum,
And you jump from one Protection to the other ;)
Try to stick to one Protection till you get the hang of it ;)

I don't want to be rude or something, I just noticed it ;)
Or maybe your a damn hard Learner/Worker/Cracker/Reverser or however you call it ;)

Oh and btw i don't know which Delphi Component does that ;)

Cya...

CoDe_InSiDe
bobik
06-10-2001, 03:47 PM
Proud to be "Cracking newbie" since 1988( Lotus Manuscript it was) , and don't pretending to be God, and learning every day.

FileFucktory Group in 1997 was my project, more then 100 audio applications
and photoshop plugins.

Now for fun only

Why jumping ? cause i make it in "task switching"
bobik
06-10-2001, 04:02 PM
Sorry for that : But i don't want to invent weels, if it is already invented ,
thats why questiions.
CoDe_InSiDe
06-11-2001, 12:05 AM
Hi bobik,

Hey, don't worry it's no problem, like i said i just noticed it ;)
Keep on going...

Cya...

CoDe_InSiDe
bobik
06-11-2001, 11:40 PM
It was
"TSoftShare 1.1 Copyright © 1998 by David Martinz "

So see in DeDe encryption key, and write keygen in mins.

Can be be also pathed with 2 NOP


teleport pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > teleport pro
PDA

View Full Version : teleport pro

digyoubetterdead
06-11-2001, 09:25 AM
I cracked a program by forcing a serial number on it, but when I close and open the same program again, I get a message stating that a possible virus was detected and that the program will not run. What is causing this and how can i disable it?
Clandestiny
06-11-2001, 10:12 AM
Hiya,

Likely there is a CRC check within the proggy which detects if any bytes have been altered by patching. You'll need to locate this routine and disable it.

Realizing this, a good approach would be to...

Run an API monitor to log the file operation API's. CreateFileA, ReadFile, OpenFile, _lopen, _hread, _lcreat, MapViewOfFile... those are the main ones.
There is a good chance that one or more of these API's will be used to open the file / map it into memory so it can be read and the CRC calcuation can be performed. Once you've found the when and where from the monitor, set a bpx on the suspicious function. SICE should *hopefully* break close to the CRC routine.

If not, a backtrace between CreateFile (or whatever API it uses) and the error MessageBox could be another useful tatic.

Likewise, I'd suggest doing a search right here on the local Fravia mirror for CRC checks. There are at least a handful of essays on the topic which could prove insightful.

Hope this helps :)

Regards,
Clandestiny
digyoubetterdead
06-11-2001, 08:30 PM
thanx:)


Error Message windows98
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Error Message windows98
PDA

View Full Version : Error Message windows98

PeeWee
06-11-2001, 03:14 PM
I get error message when tried to install VB6 run time files or Blaze Media.

Says "Thunk Connect 32 Failure'
Title of Message Box is "W95INF32.DLL"

I don"t expect an easy solution so If anyone can suggest where I can find help I would be forever grateful.

Thanks in advance.

PeeWee
woodmann
06-11-2001, 04:53 PM
Try renaming w95inf32.dll and re-installing the prog.after it re-installs change the .dll name back to its original name.

Peace, Woodmann
PeeWee
06-12-2001, 12:13 PM
Thankx for the reply

Now I get 3 error messages

#2 Error Loading W95INF32.DLL

#3 This Program Has Performed An Illegal Op and
will be Shut Down

It only appears to be a problem installing VB6 progs and they seem to run OK afterwards so WTF.

Thanx Have a Great Life


How to attach Files ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to attach Files ?
PDA

View Full Version : How to attach Files ?

bobik
06-11-2001, 11:57 PM
How to attach Files ?
Kayaker
06-12-2001, 12:41 AM
Hi bobik,

You need to log in first, then you'll get a preview post/attach file option. You may need to enable cookies, not too sure - I usually disable my firewall to up a file because I haven't had any luck with it enabled.

Kayaker
bobik
06-12-2001, 12:03 PM
Thanx, so it was firewall


unwrap vbox43 problems..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unwrap vbox43 problems..
PDA

View Full Version : unwrap vbox43 problems..

bbodd
06-12-2001, 08:26 AM
i follow dezzy's essay to unvbox43 successfully under win98..
but can't working on win2k or other windows..plese give details or related essay how to do??
and the "bpm edi x" don't break in sice. only work in trw2k..why?
Thanks!


where can d/l Win32 API Reference or help?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > where can d/l Win32 API Reference or help?
PDA

View Full Version : where can d/l Win32 API Reference or help?

darkrain
06-12-2001, 08:23 PM
Hi All,
who can tell me
where can d/l Win32 API Reference or help?

thanx.
Kayaker
06-12-2001, 09:27 PM
Hi darkrain,

Lots of places, you can try Iczelion's ASM site:

http://spiff.tripnet.se/~iczelion/files/win32api.zip

or look under the Education/Reference section at Sudden Discharge:

http://www.suddendischarge.com

Kayaker
..
06-13-2001, 12:02 AM
now, put that in the FAQ, it is getting on my
last nerve >:-(
stillnewbie
06-19-2001, 11:19 AM
.. (06-12-2001 22:02):
now, put that in the FAQ, it is getting on my
last nerve >:-(

well its in the FAQ you don't see it oh you shud see a doctor :D


HWND error message
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HWND error message
PDA

View Full Version : HWND error message

Wizard
06-13-2001, 07:23 AM
When I use Softice HWND command under WinNT, I got the following error :
"Unable to find a desktop window"

Does someone know why ?


PassMark PerformanceTest V3.4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PassMark PerformanceTest V3.4
PDA

View Full Version : PassMark PerformanceTest V3.4

Ceno_2k
06-13-2001, 07:42 AM
This program had a 30-day trial and the inability to use updated benchmarks downloaded off the net.

The crack was easy ,CALL NOP ,and a RED FLAG.

But the problem is this ,
When doing a benchmark ,the program gives back a false benchmark...hehe my P3/550 ,out paces a 1.3gig Athlon ;)

Has anybody else cracked this program and had the same problem?


What is the easiest thing to unpack?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What is the easiest thing to unpack?
PDA

View Full Version : What is the easiest thing to unpack?

sludge
06-13-2001, 04:36 PM
Guys, I have never been good at unpacking, so I am wondering, what is the easiest packer to unpack. Currently im trying to unpack an aspacked notepad.exe. Is there anything easier out there?
JimmyClif
06-13-2001, 04:50 PM
Sure AsPack is good to start with.. smc is barely confusing if you're new with unpacking.

(just kidding)

I don't know.. I'm having a hard time unpacking Alexey's toys lately... and I'm not talking about getting them running now :( (which is a completely other story again)

Oh.. well.. UPX is a good starter I think.. It's pretty straight forward... Then you could try yourself on PE-Compact which isn't too hard either...

Good luck ;D
JimmyClif
qferret
06-14-2001, 12:20 AM
I agree....UPX is very straightforward

Pushad ->Popad->Dump (a "bit" simplistic, but u get the idea) ;-)
Clandestiny
06-14-2001, 07:42 AM
Hi,

I'd definately have to agree with ?ferret and Jimmy Clif. Upx would be the easiest. It was the very first packer I manually unpacked and I had no problems at all. No SMC, no funny screwing w/ sections, no IAT rebuilding - it's about as straightforward as it comes :)

Regards,
Clandestiny


Good packing tutorials?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Good packing tutorials?
PDA

View Full Version : Good packing tutorials?

sludge
06-13-2001, 06:45 PM
Guys, what are some good packing tutorials for the newbie? Everything I can find nowadays either is pretty poor, or is mainly for the more advanced cracker. Any help is appreciated :)
sludge
06-13-2001, 07:50 PM
Err, I meant unpacking ;P
JimmyClif
06-13-2001, 07:50 PM
Sludge,

You know... you could have kept this in the thread you started ;)

Oh well.. the only site I know offering some basic tuts is:
http://www.woodmann.net/discompress/

Then there is an Upx tutorial on the net @
http://www.mesa-sys.com/mercution/hf/tutorials/misc/upx.htm
but even this is considered "Intermediate"

Read Pe-docs (see the FAQ - references section) and well start F8'ing...
A lot is just single stepping... so F8 will become a good friend :D

regards,
JimmyClif

Appendix:
Old but good:
http://users.supernet.com/dharp/files/UnpackFAQ.html
sludge
06-13-2001, 10:18 PM
Thanks. I am also proud to announce that I was able to unpack UPX without any tutorial help today :)
Kayaker
06-13-2001, 10:55 PM
Hi,

Congrats on unpacking UPX, you've obviously got the right idea about unpacking. You can also try the mixed bag of notepad unpacking tuts by Eternal Bliss at

http://www.woodmann.net/fravia/what_new.htm

Kayaker
JimmyClif
06-13-2001, 10:56 PM
So.. tomorrow you'll go for PE-Compact then ;)

JimmyClif
Eternal Bliss
06-14-2001, 03:50 AM
I will be rewriting or appending a few of those tutorials since I have progressed a bit more. 8P

Might include building a valid import table and stuff. Out maybe end of June, early July.

Regards
EB

http://ebliss.cjb.net
sludge
06-14-2001, 12:51 PM
I was able to unpack PECompact today with a tutorial as well :D. Now if only i could crack this bastard, Petite. Anyone have any advice about it?


Armadillo Killer 1.3 (CopyMem Edition)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Killer 1.3 (CopyMem Edition)
PDA

View Full Version : Armadillo Killer 1.3 (CopyMem Edition)

ArmKiller
06-14-2001, 02:41 AM
Hi all!
Here is the latest version of my Armadillo Killer (with CopyMem support) for Armadillo v1.7-2.0 and keygen for it.

By.
Solomon
06-16-2001, 07:57 AM
great! I like it


Failing miserably....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Failing miserably....
PDA

View Full Version : Failing miserably....

Tryta
06-14-2001, 02:20 PM
Hoplelessly lost in code and softice.....can't successfully use a tutorial
to save my life...have more tuts than programs....books on assembly, visual 6.0, c++....win32 API....I WANT TO LEARN! WHAT AM I DOING WRONG? HELP!

(please no flames, I'm really a newbies newbie)
sludge
06-14-2001, 03:49 PM
Read the art of assembly and the like... or maybe cracking/reversing isn't for you.
Maggot
06-14-2001, 03:50 PM
Just study your target. Dont give up..
Begin with something easy, like a easy ranked crackme.

And the most important, Never Panic. :)
hz
06-14-2001, 06:32 PM
hiya,
what is it, you are trying to do?. Can you be a bit more specific than saying learn to crack/reverse. What have you tried and failed miserably at and at what point did you decide you couldn't achieve what you are aiming for?.
Hey, sounds like I'm training to be a shrink, wasn't meant to come out like that.
regards
qferret
06-15-2001, 01:31 PM
There are many around here that are against target specific tutorials......but I've suggested this one b4 & I'm sure I will many time to come.

Winzip (any version) is a great first program to try.

I have tutorials on 4 ways to crack it @ qferret.cjb.net.

Start with the easy methods & work your way up. It's a pretty simple protection and if you can negotiate your way through all 4 methods you will have a pretty good understanding of how it works, and how things should look in Softice.

Any questions, just ask.....the more specific your question is the more helpful my answers can be ;-)
Argoth
06-17-2001, 04:18 PM
Hello

May I suggest some very easy programs. These were programs I cracked the first time I looked at it. (Btw, this isn't to show off, coz I am a newbie too, but to indicate how easy they were).

Font Creator Program 3.0 - http://www.high-logic.com - Very easy serial fish.

MovGear 2.63 - http://www.gamani.com - very easy patch (use W32Dasm). My tutorial about its serial is here: http://worx.tmfweb.nl/GmgTutorial.txt

Tru View v.1.82 - http://members.home.com/beyeler/truview.html - Very easy serial fish (I believe it used lstrcmp)

WinHacker 95 v2.0 - http://www.winhacker.com - Very easy serial fish

ClipCache Plus v2.9 - http://www.xrayz.co.uk - very easy serial fish

Most of them (all of them except Gif Movie Gear :) are easy to find a serial for. So u have to use SoftIce.

Grtz

Argoth
Joda
06-23-2001, 02:10 PM
Oh hi :).

lol u seem to have the same prob like me. Perhaps your problem lies grounded therein that ure trying to learn TOO much at one time - thats at least my problem, i want to learn everything - c, asm, cracking, hacking, reversing and how to live my life... :> - finally i mostly end up doing NOTHING cauz i cannot learn all at the time. I guess its really a good idea to start with some CrackMes that are easy. When u just go and down some software and want to kill all its protections, you'll see that most of the time its not as easy as its described in most tutorials. I'll try it this way from now on. Perhaps it'll help you, too :).

cya

Joda
Zedr0n
06-23-2001, 04:05 PM
I think you'd better start with fravia. I've began with this one. It helped me a lot. It wasn't that long ago, and now I'm fully in reversing, I mean reversemes and such like this. I haven't tried to learn asm at the same moment. I've first began to explore the most newbie tuts and then more and more advanced. Good luck to you!
disease_2000
06-24-2001, 06:01 PM
Hoplelessly lost in code and softice.....can't successfully use a tutorial
to save my life...have more tuts than programs....books on assembly, visual 6.0, c++....win32 API....I WANT TO LEARN! WHAT AM I DOING WRONG? HELP!

Tryta, there's nothing wrong with your brain. Really. You probably trying to learn too much at
once that you lack sleep. Thus, changes your mood and thinking. When i first started reverse
engineer, i have no knowledge whatsoever! but i succeed nontheless. still to these day, i have
no book on cracking, except online materials. i don't have books the way you have them. what
you need is a relaxing mind. Take things step-by-step and jump when the condition is right.

my predictioin: you've come across too many hacking site, toooo many cracking site and many
people tell you different things that you have a hard time deciding. or, are you competiting with
someone?
oldhacker
06-26-2001, 06:05 PM
Just remember the tree. The Exe. calls the Dll/api the api calls the driver/asm , get a book on the microprocessor that your using for the calls to it, and look at that hex code.. and check to see if the program is packed, you may have to unpack it to get started.


FlexLM license generation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FlexLM license generation
PDA

View Full Version : FlexLM license generation

Killer_l00p
06-15-2001, 05:30 AM
I know that this subject has already been beaten to death, but being a reasonably clueless newbie, I have to bring it up once more...

My problem is this: most of essays about FlexLM concentrate on dynamically linked vendor daemons, and while I basicly know what to look for, the fact that my target is staticly linked, leaves me a bit confused... what would be a good way to approach this ? ???
(the daemon is built with 6.1b SDK)

BTW, if some kind soul could point the (apparently) blind ol' me to FlexLM FLIRT signatures, I'd be most grateful.


FlexLM license generation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FlexLM license generation
PDA

View Full Version : FlexLM license generation

Killer_l00p
06-15-2001, 05:33 AM
I know that this subject has already been beaten to death, but being a reasonably clueless newbie, I have to bring it up once more...

My problem is this: most of essays about FlexLM concentrate on dynamically linked vendor daemons, and while I basicly know what to look for, the fact that my target is staticly linked, leaves me a bit confused... what would be a good way to approach this ? ???
(the daemon is built with 6.1b SDK)

BTW, if some kind soul could point the (apparently) blind ol' me to FlexLM FLIRT signatures, I'd be most grateful.
Perry
06-15-2001, 12:03 PM
what would be a good way to approach this ? ???

Maybe the Dan´s essay is a good way http://208.50.16.104/crackz/Tutorials/Danflex.htm

to be patient and understand this excelent essay,
i´m sure that help you but too there are other fast way.

Regards.
Perry.
Kythen
06-18-2001, 01:14 PM
The FLIRT signatures are nice, but they don't always work. Often times, functions will not be identified due to very minor changes between versions that alter the function's signature. I have found that it is better to use "landmarks" to identify functions in statically linked code. For example, you can always find lc_init by searching for a reference to "flex%i.log". lc_checkout can be found by searching for another particular string and looking a few functions up. The best way to get a feel for this is too disassemble the dll for your version of flexlm, locate the functions you want/need to identify, look for these landmark strings or win32 api calls, and then use what you find to identify functions in your target. After a while you get familiar enough with the functions that finding them becomes a snap! :)

Hope that helps!
Kythen


Time keeper or Killer????????????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Time keeper or Killer????????????
PDA

View Full Version : Time keeper or Killer????????????

Tug
06-16-2001, 05:42 PM
Hi all!

I'm a total newbie at this so please excuse my pathetic low life post, I've got a programme I want to crack but before I go any further into disassembling it I want to find out what registry key, file it is leaving in my system to get system time, why? cos it's doing my head in, the software uses a Dongle to kill the nag and serial codes to increase the evaluation time, I spent over 3 days trying to find this hidden file on my system and the protection is mind F*cking me!!!!

Anyone please help cos I'm going out of my mind.

Any help very very much appreciated Regards Tug
qferret
06-16-2001, 09:08 PM
www.sysinternals.com

regmon and filemon

these 2 proggies r great for checking out which reg keys/files programs are accessing
Tug
06-22-2001, 12:01 PM
Sorry I've took so long to get back to this! well thank you for the reply and yes with these tools I cracked it!! nice one!!


I can't seem to get this serial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I can't seem to get this serial
PDA

View Full Version : I can't seem to get this serial

Argoth
06-17-2001, 04:35 PM
I am working on a program called Screen Saver Studio, which has some weird serial protection. Well, for me that is. The serial is supposed to be 26 characters, but then I get stuck. I don't know what the fuck is going on in the end. It checks if SI = 1 or SI = 2
I don't know how they create the SI value, but I always end up at some weird number.
I did some exploring and I think it is weird. When u set a bpx on 00405532, u will get into a serial calculation point (at least with this name: Argoth and serial: Z00085F5CC0N670655082200FE). Now set a BPX on 405493 and 40541E. This compares EAX and ECX, notice that ECX is a piece of our typed in serial and EAX gets calculated in the part of my first BPX. Well, everything ok...NOT! I thought I passed all the checks, but there seem to be some more. *hmmmz*

URL: http://www.worx.tmfweb.nl/apps/SSBuilder.exe

Grtz

Argoth
stillnewbie
06-19-2001, 11:26 AM
Argoth (06-17-2001 14:35):
I am working on a program called Screen Saver Studio, which has some weird serial protection. Well, for me that is. The serial is supposed to be 26 characters, but then I get stuck. I don't know what the fuck is going on in the end. It checks if SI = 1 or SI = 2
I don't know how they create the SI value, but I always end up at some weird number.
I did some exploring and I think it is weird. When u set a bpx on 00405532, u will get into a serial calculation point (at least with this name: Argoth and serial: Z00085F5CC0N670655082200FE). Now set a BPX on 405493 and 40541E. This compares EAX and ECX, notice that ECX is a piece of our typed in serial and EAX gets calculated in the part of my first BPX. Well, everything ok...NOT! I thought I passed all the checks, but there seem to be some more. *hmmmz*

URL: http://www.worx.tmfweb.nl/apps/SSBuilder.exe

Grtz

Argoth

Heya,
You shud not post the serial number here though it doesn't works.Please read the FAQ.
cya...
Argoth
06-19-2001, 04:29 PM
No, I know it doesn't work, but it's a serial which matches certain checkpoints. This serial number is only to get you to some parts of the code. This is easier for anyone who wants to have a quick look at it. Now he doesn't have to figure out his own parts of serial.

And who said this serial worked? :)

Grtz

Argoth
hz
06-27-2001, 10:48 AM
hiya Argoth,
You had best part of it worked out already. 1st two characters of fake code converted to hex byte (should be >0x5A and <0x5E), determine type of license and used to calculate valid code, last 8 characters converted to two hex words used as checksum/s, finally, ADD EAX,-5A where eax contains the byte from 1st two characters.
regards

This essay will now be placed in Tsehp's hall of F/Sh(ame).
Argoth
06-27-2001, 05:01 PM
Thanks! I am sure I will be able to find my own serial now :)

And what is this hall of F/Sh(ame)?

Grtz
hz
06-27-2001, 05:57 PM
hiya,
shame,flame,lame take your pick. Nothing about you, just that I read my post afterwards, didn't understand a word of it.^_^.

Off topic, why the hell do we have a 'kiss' emoticon on this board?
Argoth
06-27-2001, 07:24 PM
Heh, could be me, but where is this kiss emoticon? I don't see it.

And about your little solution...what do u mean with "ADD EAX, -5A, where EAX contains the byte from first two characters". When I use this serial: [[1085F5CC0N67065508A20BAA, EAX is something like 264 (sorry, my PC is telling me I haven't got enough memory to run any appliations). Where does it get this value then?
hz
06-27-2001, 07:56 PM
hiya.
remember I said the 1st two characters of serial had to be either 5B or 5C, the 1st two characters
of serial are converted to 1 hex byte, ascii 5C converts to hex byte 5C.
eax=5c
ADD EAX,-5A ; now eax = 2
thats where the si value comes into it.
or
eax=5b
ADD EAX,-5A ; now eax = 1
you dont want it to be 1 coz its the shitty non pro license

check here
004051B3 663D5A00 CMP AX,005A
regards

PS. Safer if nobody knows where the 'kiss' emoticon is I think
hz
06-27-2001, 08:02 PM
hiya again,
use something like (exactly)
5CABCDEFABCDEFABCD12345678 as your serial
and you will get a cleare picture of what is going on.
5CABCDEFABCDEFABCD12345678
^^^^^^
checksums
hz
06-27-2001, 08:15 PM
Arrgh,
I can't edit my posts. 12345678 part of the serial
is the checksum part not as diplayed above.
qferret
06-27-2001, 10:35 PM
Hi Hz :* LOL
hz
06-28-2001, 05:45 AM
Oh qferret, I would never have got married if I'd know you felt that way.:-D
Argoth
06-29-2001, 05:56 PM
Thanks alot man!
hz
06-29-2001, 06:21 PM
hiya,
you got it then?. you come across a lot of these
daft serial routines that seem complicated at first flance, then you realise how easy it is.
regards
Argoth
06-29-2001, 06:33 PM
Yes, I studied the lines and the serials you gave me, and u were right. It became clear immediately.

[you come across a lot of these daft serial routines that seem complicated at first flance, then you realise how easy it is.]

I wonder if this is the case with ACDSee, coz I couldn't find a serial a few months ago, but maybe now I can. I'll give it a try now.

And maybe this gets a bit boring but eh...thanks again :)

Grtz


Problems Inlinepatching AsPack v2.11c!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problems Inlinepatching AsPack v2.11c!
PDA

View Full Version : Problems Inlinepatching AsPack v2.11c!

Lotus
06-17-2001, 05:44 PM
Hi!

I have some problems inlinepatching AsPack v2.11c.
Earlier versions is no problem.
But it seems like the prog is kinda packed 2 times or so?
Now i don't mean I want to patch the program AsPack v2.11c, I mean programs packed with that version.

Anyway, unpacking programs packed with AsPack v2.11c is no problems. but then when I search for the PUSH 000000 <- OEP in HEX it can't be found.

So does anyone know of any tutorials about AsPack v2.11c or maybe can give me some help.

Thanks!

Lotus


Crippled target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crippled target
PDA

View Full Version : Crippled target

Tezza
06-17-2001, 10:55 PM
I have a crippled target that I have managed to enable the menu's. The problem I have now is that when Save is clicked, I get an error message such as "Save not allowed in demo". The message comes from a separate file consisting of messages only. Question is, how is the best way to find the call to the external file and how does the prog determine what message in the external file to display?

I have tried string searching such as Save but I find it about 20 times in the code and none of the code is similar except maybe a push 00000068 which I assume is the address of the variable containing the error message????

Help much appreciated.
Tezza


Reverse engineering under UNIX/IRIX, looking for advise and help.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reverse engineering under UNIX/IRIX, looking for advise and help.
PDA

View Full Version : Reverse engineering under UNIX/IRIX, looking for advise and help.

Franc
06-18-2001, 09:30 AM
Greetings,

I would like to Reverse engineer some UNIX (Mainly IRIX FlexLM'ed) programs and looking for some hints from the people who are expierenced in that.

My expierence in Reverse engineering is fairly small (I did cracked some small programs on PC 2-3 years ago and used to know the x86 assembly basics), in addition to that I cannot use most of the tutorials or education tools simply because I have no Windows / x86 machine at my disposal anymore, I could certanly buy one, but not sure if this will help me much for working under IRIX. My UNIX knowhow is good.

So, I would like to know what tools are available under UNIX ?

Is there anything like SoftIce available for IRIX ?

Can I somehow disassemble an executable (In IDAPro Advanced or native platform disassembler) and use the listing to set breakpoints & co in IRIX's dbx, cvd or ddd ?

Are there any tutorials which are directed on UNIX platforms ?

Looking forward for any helpful information

Franc.


seeking tutorials on reversing CRC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > seeking tutorials on reversing CRC
PDA

View Full Version : seeking tutorials on reversing CRC

digyoubetterdead
06-18-2001, 09:11 PM
I'm looking for a good site that will school me on dealing with CRCs while cracking softwares. Any suggestions would be greatly appreciated.
hz
06-18-2001, 09:34 PM
hiya,
there is more than one way of dealing with crc but you said reverse it so there is an essay at
hxxp://zor.org/krobar/
If you manage it let me know. Hell, if you even understand it let me know, better still, teach me.
good luck.


Mentor vendor checkout filter
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Mentor vendor checkout filter
PDA

View Full Version : Mentor vendor checkout filter

scot z
06-19-2001, 12:44 AM
Hi,
I am trying to generate the correct vendor string for a L-Cable/DA 8.6NT flex license. I have compiled a working lmcrypt. I have read Amantes two flex essays and I have been trying to find the lc_set_attr call in my target exe/dll but without success. I have disassembled the lc.exe, da.exe, lmgr's, pcls, etc. without seeing where the encryption routine is. Any help on how to hunt it? I am new to wdasm and sice, so please be simple. Thanks.
The exes/dlls are at 211.50.11.3/<1sp>/LC86/2.zip
scot z
06-19-2001, 12:48 AM
password is licensefile


problem with "phantasm v1.5b3 DingBoy"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > problem with "phantasm v1.5b3 DingBoy"
PDA

View Full Version : problem with "phantasm v1.5b3 DingBoy"

synphony
06-20-2001, 12:43 AM
Hi
I am trying to unpack an executable program crypted by "phantasm v1.53 DingBoy" (my fi245 says). one of my friends tells me to do unpacking by using Undbpe v1.50. I've tried, but failed. The small message box reads "dbpe not found". I want to know what "phantasm v1.53 DingBoy" is and what tool can be used to deal with it. What is more important is what should I do?

Many thanks!
Ceno/2k
06-22-2001, 11:46 AM
PHANTASM ,is a type of EXE compressor like PECOMPACT ,or PETITE ,The version i have is in Japanese so ,INFO on the program is not very good :(

Scout around ,somebody somewhere might know how to defeat it.

I know this is not much help ,but atleast you know what your ENEMY looks like ! ;)


packed program ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > packed program ??
PDA

View Full Version : packed program ??

yats
06-20-2001, 04:10 AM
hi to all

i'm a complete newbie so please bear with me. i'm tring to crack " window waher v4.0" http://www.webroot.com/washer.htm, you can also download it from tucows. my question is this.

I have been able to find the memory location to patch thru softice, but i don't have a clue as how to unpack the the program so that all of my offsets compare. it's basically a time trial protection scheme. thanks for any help in advance.

**sandman your tuts rule i had a great time following them **
Ceno/2k
06-22-2001, 11:40 AM
This program is packed by SHRINKER ,There are lots of programs that can unpack this kind of compressor.

GO HERE

http://stanford.esuccess.com/protools/

Maybe they can help you

Ceno/2k
Neoasm
06-22-2001, 10:08 PM
Instead of getting Unpacker from Protools, you can choose ProcessPatcher from the site as your choise.
Lord_Soth
06-22-2001, 10:41 PM
and how about learning to unpack ?
qferret
06-22-2001, 11:15 PM
Hey LS...Long time no see ;-)


disassembling 4 serial Codes????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > disassembling 4 serial Codes????
PDA

View Full Version : disassembling 4 serial Codes????

Tug
06-22-2001, 12:31 PM
Hi all!

I've disassembled some evalution/rental software which uses a dongle to turn it into a full version and serial codes to continously extend it's rental/trial life,

these codes change intermittently when trying to run it when it has timed out! the idea is you contact the vendor give them the codes you are presented with at the nag and they give you a fresh set of codes which corresponde with the codes at the nag to extend the rental/trial period,

depending on what codes you are given depends on how much longer you are given to evaluate/rent the software.

I've used W32dsm to disassemble this software and my question is where are these serial codes hiding and do I need any additional tools to extact this codes?

Any help much appreciated!!

Regards Tug
JimmyClif
06-22-2001, 06:07 PM
Congrats my friend :)

You just discovered the working method of shareware. The reason behind all this is to let
you try before you buy... That's why they expire after a certain period of time. The nag
you saw for entering the serial is commonly used by honest buyers to register their programs.

The different codes which may give different versions depend probably about the type of
licence people want to buy. You have to understand that a single User shouldn't pay as much
as probably an enterprise with +100 workers. Good reason for inserting different methods of
payement and "codes".

In your disassembled listing have a look at .00425F9 ... Does something look suspicious?

Hope this helps *g*
JimmyC
hz
06-22-2001, 09:41 PM
hiya,
Cmon JC give it up, how the hell did you know 00425F9 ? he doesn't even mention what the prog is. Never even seen a dongle myself, well not the kind he means anyway.
qferret
06-22-2001, 10:23 PM
He's really Karnak the Magnificent....but Karnak may be confused w/ Kayaker, so he uses JimmyClif }:>
hz
06-23-2001, 11:25 AM
hiya qferret,
glad you cleared that up, thought for a moment he *really* was JC, nah we all know +Splaj is the real JC (hey only kidding). +Spaj have you reversed LordPE yet, if not can you lend me $13.00, I'm outa here.
Tug
06-24-2001, 06:33 AM
Thanx for the tips Jimmy, as for the rest of you I think you obviously haven't got a clue so why even to bother to post a thread?

I had already cracked the proggie to use Illegally but thats not what I'm trying to accomplish, trying to understand how the programme works is what I'm tring to do! after all that is what this is all about!
hz
06-24-2001, 09:40 AM
Hey Tug,
lighten up man, some of us don't have the powers of JC to be able to just pull an address out of the air from "I've disassembled some
evalution/rental software....". For me, part of what made the original Sandman's site so enjoyable was people didn't take themselves so seriously, for f*ck sake its just a hobby not a vocation.
regards
qferret
06-24-2001, 03:48 PM
1. I'm with hz on the lightening up...at least it wasn't a flamewar ;-)
2. We may have been able to help more if you'd given us a download URL, or at least told us what program you were looking at. Without knowing what program, which version or even what dongle you need help w/, it was impossible to help. If the address JC gave was helpful, it was pure coincidence LOL
JimmyClif
06-24-2001, 11:10 PM
LMAO :-D

Hz, I bet you too can earn these mental powers *hehehe* It' all a matter of energy...
You have to get the insight... You have to take the coincidences seriously and be aware of
the awareness as something real. Then when you define the physical universe as one of pure
energy you will be able to remediate your shortage of energy while connecting to the higher
source. In my case I had a mystical experience that allowed me to briefly see the magnitude
of energy one can aquire.. and this addy just popped right up.

Reading tip: "The Celestine Prophecy"

Seriously now...

>>For me, part of what made the original Sandman's site so enjoyable was people didn't take
>>themselves so seriously...

It's all for fun ;) Agreed!
Kayaker
06-24-2001, 11:28 PM
JimmyClif, that is PURE ZEN. You got the power my man! Go with it. Nail the hardest protections, buy lottery tickets, make out like crazy. Ride the wave. Man, I gotta get me some of that stuff :)
Tug
06-25-2001, 06:14 AM
CAPTAINS LOG STAR DATE : 104.44.5

I think the enterprise and the Post has now entered a Parallel universe in another dimension, since the enterprise was hit by the unexplained entity I am besides myself and the rest of the crew have lost logical thoughts! captain quirk insists I am a lonely space cadet floating amongst many worlds so I'm I now going back in time to beam up Mulder to find out the truth!!
hz
06-25-2001, 06:22 AM
hiya jc,
ok I am a newbie but honestly I have read all the tutorial on 'Celestine Prophecy' and I keep getting lost in the code, no matter what I try I keep getting a different address, only thing I can think of is its a different version of 'Celestine Prophecy' to yours and the author has changed the protection.
To anyone new around here, no one is laughing/taking the p*ss, (this reply to JC is really laughing at myself). Try and look at it that if the poster doesn't answer your question then perhaps he doesn't know, but at least showed an interest.

Message from the mb police.
Its been brought to our attention, you reversere/crackers are having too much fun and it must stop.
+SplAj
06-25-2001, 06:43 AM
Can't see what all the fuss is about.... actually the clue was the dongle.... that gives the target away immediately.

+Splaj


How to delete flexlm license manager date log?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to delete flexlm license manager date log?
PDA

View Full Version : How to delete flexlm license manager date log?

winworm
06-23-2001, 01:38 AM
As the title!Now I can't change date back when run some software which use flexlm.What can i do?Maybe reinstall OS can resolve this probelm.
Perry
06-23-2001, 04:32 PM
_____________________________________
Maybe reinstall OS can resolve this probelm.
_____________________________________

Yes, but isn't a elegant solution.

Flexlm will check various properties of many files in your system. Maybe other way is change all properties's date of all your files but again isn't a elegant solution.

Perry.
winworm
06-24-2001, 09:15 PM
Thanks Perry! But a good solution? Every one,Plz!


A question in general
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A question in general
PDA

View Full Version : A question in general

slide
06-23-2001, 05:05 AM
Well this is my main pondering, are there any tuts out there that are more descriptive in the ways of cracking a prog? What I mean is that lately I've been reading cracking tuts here and there and most are too straight forward. (ex. open reg window, type in fake name, bpx <blah>, press F11 10 times and look at this then edit and done). Are there any tuts out there that describe the various code that you look at more in depth or describing exactly what certain lines of code do? I know I should probably be readin about asm and all that stuff, but when I read those asm tuts, I hardly read how this applies to cracking, at least not at my current mental threshold, maybe someone could explain more to me?
Eternal Bliss
06-23-2001, 06:29 AM
Hiya,
you can go to ebliss.cjb.net and download a zip file called resource.zip which contains quite a lot of useful information I used when I started cracking. Also, I believe my tuts might be useful too.

Regards
EB


Frequently Sice Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Frequently Sice Problem
PDA

View Full Version : Frequently Sice Problem

Joda
06-23-2001, 06:31 AM
Hi all.

I hope this question wasnt posted b4, if it was plz give me the url and close the topic, so i dont waste space here with things already been discussed.

My problem is the following:

Most programs i try to crack (ye crack, i wouldnt call it reverse engeneering cauz i just have some fundamental ideas of programming, but cannot code in any language yet :( ) are not disassembleable (?) in WinDasm (at least 70-80%), so i have to use S-ICE on them.
But the problem with Sice is, that i always lose myself in the code. I set a breakpoint on let's say hmemcpy or createwindowexa or sth and then trace trace trace - check registers and memory and trace... And then its over, a nag appears and - ewps did i miss something?
So i try it a 2nd time and so on - until i give up - most of the time resulting in crippled programs, doing funny errors :).

Is there anything in general, that could help me to get a more structured, effective way in using Sice on programs?
This tracing doesnt get me anywhere - and just breakpointing on memory ranges that look interesting or APi functions doesnt help me too most of the time - perhaps its just because i'm so new to the cracking stuff, but maybe there are some ideas that could help me, i would appreciate it.

cya

Joda
CoDe_InSiDe
06-23-2001, 11:48 AM
Hi Joda,

Yes, i've got one big suggestion for you ;)

"Learn ASM"

i think that'll help ;)
(Atleast with the Tracing and understanding of the Codes :) )

Cya...

CoDe_InSiDe
Joda
06-23-2001, 01:19 PM
Hey.

What do u mean by "Learn ASM" - learning to code in (win32) asm or just learning to "read" the asm dump?

cya

Joda
CoDe_InSiDe
06-23-2001, 01:34 PM
Hi Joda,

Well, both actually :)
But i think the second is better, unless you want to Code in it too ;)
But the main thing would be to try to understand the meaning of the ASM instruction.
Not all instructions at once ofcourse ;D
But some basic instructions like ADD, MOV, SUB etc... :)
And the Jumps...
Hope this helps.

Cya...

CoDe_InSiDe
Joda
06-23-2001, 01:48 PM
hehe

Well i have some basic understanding of asm and a good and thick reference to its instructions - but u know if i land inside the dark code woods (wink), ret p myself outta the api instructions, i find myself writing down tons of notes - my bin is filled to the top and still i get nowhere - hm perhaps im not just physical visually handicapped but also mentally? :D

Last weekend for example i was sitting 2 days in front of a dumb Visual Basic program, with a stupid Serial/Name protection scheme, at the end just finding out that i missed, that it also compares a "-" to the serial number and just its last 5 numerical parts. Checking where a routine begins and where another ends in SoftIce sometimes gets me a real headache :).

Joda
CoDe_InSiDe
06-24-2001, 02:22 AM
Hi Joda,

Hehe ;)
I've got another suggestion:

"Don't try to use SoftICE for VB Programs"

No wonder you were lost in the woods ;)
For VB programs you can better use SmartCheck :)

Have you tried simple, small CrackMe's for example ??
That should be good to learn Tracing and understanding i think ;)

Cya...

CoDe_InSiDe
Joda
06-24-2001, 07:07 AM
Hi ho.

I will now. For i seem to have the problem always to download software thats packed or protected in ways i dont understand the CrackMe way will be the most intelligent I think.
And SmartCheck - hmmm - later maybe :).

Thx for your suggestions man,

Joda


tools...?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > tools...?
PDA

View Full Version : tools...?

disease_2000
06-23-2001, 12:08 PM
greeting to all (this is my first time to this board and reverse engineer).

where can i get IDA, IceDump???
Kayaker
06-23-2001, 12:42 PM
Hi D2k,

You can get Icedump at
http://icedump.tsx.org/

IDA demo at their homepage.

Now that you've found us, I encourage you to read the (in progress) FAQ ;)

Kayaker
hz
06-23-2001, 01:44 PM
yeah, welcome to the board, catch yer later, wait a minute Disease_2000?, well maybe not.
ale-cxa-12
06-24-2001, 12:42 AM
d2k,

try www.programmerstools.com
Solomon
06-24-2001, 01:30 AM
w*w.exetools.com
disease_2000
06-24-2001, 05:15 PM
a thousand thanx for all the reply. this is the most wonderful forum on RE i've encounter. you
people are very friendly (it makes me feel very welcome).

and hey! you even know a short name for my handle. :) nice to see smart people helping each
other out.
Kayaker
06-24-2001, 05:59 PM
disease_2000 (06-24-2001 15:15):

and hey! you even know a short name for my handle. :) nice to see smart people helping each
other out.

Hi D2k,

Heh, I cheated actually and took the liberty of using your short nick from that *other* board you frequent ;) Just trying to make you feel at home, hope you don't mind.

Cheers,
Kayaker


Heh, tell GetRight it wasn't pirated
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Heh, tell GetRight it wasn't pirated
PDA

View Full Version : Heh, tell GetRight it wasn't pirated

Argoth
06-23-2001, 05:58 PM
Well, I have a very strange question I think. How does GetRight know there has been a crack attempt? I fished a serial, which I tried. The program told me: F*ck off with ur lousy cracking skills and that the code was pirated and that it would be disabled. The I restart the prog and I what do I see? I can't fill out any regnumber anymore. Durn. So can anyone tell me how to disable this, so I can get on with my serial fish?

:)

Thanks & Grtz

Argoth
Solomon
06-24-2001, 01:27 AM
blacklisted serials
Zebulon
06-26-2001, 09:19 AM
Solution:
Uses a blacklist for pirate serials. Might try to bring up a 'gotcha' page.
If it starts playing up...
Goto HKEY_CLASSES_ROOT\CLSID\{F853B2C7-386A-11D3-A860-006097897A00}
and delete 'ID'
Goto HKEY_CURRENT_USER\Software\HeadLight\GetRight\Config\
and delete 'Window00' and 'RegistrationCode'
or delete the number itself. Then try using another serial#.

Don't even think about thanking me, thank +Tsehp and ArthaXerXes.
Argoth
06-26-2001, 08:16 PM
Okies!

Thanks +Tsehp and ArthaXerXes. This was exactly the info I was looking for.

Grtz
hz
06-26-2001, 09:03 PM
hiya Argoth,
tut, tut, your serial shouldn't be in the blacklisted serials, yor not using someome elses crack are you?. Btw for want of something to do, I did your screensaver thingy the other night, if you didn't sort it let me know and I will drop you a hint.
regards
Argoth
06-27-2001, 05:41 AM
Hell no! Shame on me if I was using anyone else's crack! No, I just saw a list of serials in my EAX and I was only trying it out to see what would happen when I used one of these.

And about the 'screensaver thingy', I didn't figure it out yet, so please drop me a hint :)

Thanks

Argoth


Softice and System crash when going into message loop
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice and System crash when going into message loop
PDA

View Full Version : Softice and System crash when going into message loop

Joe Doe
06-24-2001, 09:33 PM
I am getting started debugging with Ice. However whenever I break into the the program at the beginning, and trace it into the message loop the system will hang. The hole system. SI, windows everything.
So somewhere in here:

while( GetMessage( &lpMsg, NULL, 0, 0 ) ) /* begin the message loop */
{
TranslateMessage( &lpMsg );
DispatchMessage( &lpMsg );
}
The system is hanging. Has anyone else experienced this problem, or know why it is happening to me?

Thanks a lot
Kayaker
06-24-2001, 11:34 PM
Hi,

You may have a bad RET sitting in ESP and your calls return to some non-code address. I've had SI hang a few times on me this way. It may also hang if you're performing some operation on an invalid memory address. Like mov [500000], eax where [500000] contains 'FFFFFFFF', meaning that address isn't mapped into memory yet. Chances are you'd just get an error message with the above example, but who knows, it might just decide to hang instead on your system, it's the kind of thing to watch out for anyway.

If you're tracing with SI you should be able to single step (F8 ) and find the exact location where it hangs, and watch the registers to see what's being passed, or where you end up. You can look at your TranslateMessage Msg structure, its address being pushed in eax just before the call, and see if it's all OK. If you can F10 step over the TranslateMessage call without hanging, then maybe it's the DispatchMessage call giving trouble.

In any case, that's the beauty of SoftIce, you should be able to single step to the exact trouble spot, even if that means tracing completely through the API calls. If you do find it, you can use the 'a', 'e' or 'r' commands in SI to change the code, memory contents, or register values to try to circumvent the hanging until you can fix your code (even a crash is better than a hang).

Hope this helps,

Kayaker


VBox 4.5 & revirgin... need some help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VBox 4.5 & revirgin... need some help
PDA

View Full Version : VBox 4.5 & revirgin... need some help

garph0
06-18-2001, 04:47 AM
hi all :)
i'm toying myself with premiere 6.0, but i've got some problems in unpacking:
i can't find the oep, iat rva and iat size (or, better, i'm sure it's possible, but actually i get lost somewhere in the code).
i tryed bpx-ing GetProcAddress and then p ret-ing back, but i land in a code full of jumps in the middle of other instructions, and there i can't find the way back home.
i also tryed bpx GetVersion, but i still get lost :(
some clues on a way to get oep?

10x
r3
07-14-2001, 06:39 PM
a code full of jump? thats your way back home.
you should encounter it just after your second 'bpm x' of the call edi.
just trace with f8 until you land to a clean code, the first byte of clean code will be your oep


This one is about Telnet? (Newbie)!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > This one is about Telnet? (Newbie)!
PDA

View Full Version : This one is about Telnet? (Newbie)!

Dreamer77
06-25-2001, 03:14 AM
I don't know if this is the right place to ask this but I'm going to try it out any how. I have Windows 98 and Videotron which is a cable host i got. How come I can't connect to telnet? I give it the host name and it say can't connect, why? I thought maybe i could crack into my own system. Is my 98 telnet difforent to Windows 95 Telnet version? Is there a programe like Netcat for windows 98? Sorry had alot on my mined. Hope you guys help me out.


Allright, Lets findout who is our grand pa!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Allright, Lets findout who is our grand pa!!
PDA

View Full Version : Allright, Lets findout who is our grand pa!!

nEOasM
06-25-2001, 09:57 AM
Enough for technical info. Let's check a historycal one. My (unsolve) question is 'WHO IS THE FIRST CRACKER ON EARTH?', anyone know that?
disease_2000
06-25-2001, 01:23 PM
i don't think there will be an accurate to such question.
nEOasM
06-25-2001, 08:50 PM
I mean of both system/software cracker. Who is the first well known one or the savant.
disease_2000
06-26-2001, 10:32 AM
nEOasM, i got your point (sorry for my bad misunderstood) :)

and for your question, i dare not answer. cause i have no clue who was the first. but let's put
it aside and just say that the first is the air we breath.

history are bad, i don't like it. it's full of truth and lie. i can't really tell if the dollar i'm using is fake
or real...
nEOasM
06-26-2001, 09:45 PM
aaaammmmeeeennnn


Digging out serial codes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Digging out serial codes
PDA

View Full Version : Digging out serial codes

Tug
06-25-2001, 01:49 PM
Hi all,

I’ve got some commercial software which is a evaluation/rental copy, I want to dig out the serial codes which revalidate it for the various time periods, I’ve disassembled it but does anyone know how I go about digging these serials codes out, are the codes encrypted code in the executable cos I can't see any thing even resembling the codes?

Any help on this will be much appreciated

Regards Tug
hz
06-25-2001, 04:25 PM
Oh man, time to get your celestial balls out again jimmy. You got a spare one outa that six pack?


i've cracked my first program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > i've cracked my first program
PDA

View Full Version : i've cracked my first program

Rupert
06-25-2001, 10:56 PM
i've got it right here:
http://axha1100.8m.com/
(swp.zip)
as you can see, it's sorta cracked. just click OK and you have all the registered functions. i'm really new to this stuff and am trying to learn. i found a newbie tutorial on how to crack this specific program, but it's for a different version. i got the basics though. look for the string "thanks for registering" and try to understand all the asm stuff before it.

i don't know what all the codes do yet. if anyone knows of a site that has something like the example below, let me know.

NOP: does nothing (no operation)
MOV: similar to LET command in QBASIC

that would really help me out. in the folder at my so called site, there is another zip. it's called tank. that's my current project. can someone take a look at it? preferably one of you grandmasters. all i want to know is if it's possible to crack. don't tell me how. if it's crackable, i'll find a way.

i'm not sure if i can crack it becuse there are no string references for "registerd" or "thanks for registering".

well, thanks for reading this.
nEOasM
06-26-2001, 03:02 AM
Keep trying mann!
disease_2000
06-26-2001, 10:27 AM
advice: it's ok if you don't understand asm, soon or later, you will. when i first started cracking (that
was way back) i have no clue how computer works, how it execute instruction.
what i know is ASCII (just pure ascii) and i crack program using PSEDIT (my first hex editor i've
ever used, now, hiew becomes my favorite). For simple program, you can actually destroy nag
screen with no knowledge, but for big program, it requires more understanding of how computer
go around with those instruction and with asm knowledge, it helps alot. but don't jump when
the condition is wrong.

what i mean by ASCII cracking is this: let's say that the nagscreen contains "Please Register"
you fire up any hexeditor and search for that string and then you play around with that string.
soon or later, that box will get destroyed. (this is a method that requires no asm knowledge, just
patience and it's time consuming. this is my method when i first began reverse engineer, and nailed
down 3 program in a day. 1: music program 2: screen saver 3:don't remember and that was
my first day)

so, have faith in yourself and continue with this wonderful endeavour.

one thing i forgot to add: CURIOUSITY when comes to reverse engineer, nothing is stronger than
a mind with full of curiousity. Have them, and try to destroy them with the answer you're seeking
for.
Rupert
06-26-2001, 12:56 PM
i've downloaded a lot of stuff to help me learn ASM. i've made a few simple programs in debug. i got the jmp mov and am starting to learn about int.

if it possible to crack that tank game i will do it.

tell me one thing. when you open a program in dasm or whatever, do you look at the first line in there and just follow what it does or do you try to jump to where the protection acually is?
Rupert
06-26-2001, 03:43 PM
this is hard to explain, cause it comes from experience. there are program that i can crack easily,
and there are program that take days and days (i don't do much cracking nowaday, i'm here just
to see what people post so i can get a better understanding of how each and every individual go
about debugging others app. that way, i will have an insight and view of debugging my own app). debugging your own app is easy, cause you're the one that actually created it and you
know what's going on in there. but debugging someone else code with no source is a task beyond
your imagination. and yet, it's possible (tools is the boundary).

whenever i decided to reverse a certain program, what i always look for first is
#1: what type of exe is it (is it 16bit or 32bit?)

that's the first thing i always look for. and do i really sit and follow instruction by instruction?

no. I will save my time by using Resources Hacker or Workshop and try to open it. See if there's
anything useful it give me. If that failed (which mean it couldn't open the exe or the exe was
unpacked by some other program.), i go for w32dasm or IDA to gain more info about my target.
(this is my first time using IDA, and i must say that it's the best! :) )

once i get all the info. i fire up softice and begin my work based on the research i got with dasm
and ida.

what if the program was packed by some other software? well... i'm not into that area yet. thus
this tells you that my reverse skill is not far from 50% yet. I actually stopped half way (a year
after my first day of crackign) just to learn assembly, and now, i finally understood how/what
it's all about - that's why i'm here now. and when i'm here, i feel safe. because i have a basic
understanding of asm.

i can see that you're heading the same direction i was back then. keep it up. :)
disease_2000
06-26-2001, 03:48 PM
i think there's a bug with the login in script on this forum. the msg above is MINE. for some odd
reason, after i click the post button. It posted with "Rupert" id instead of mine. i try to exit IE
and reload my browser just to see if the problem fix, but it didn't. on the top it still say:

"logout (Ruper)" so i try to fix the problem by loging out and now, i'm back in....

and this is my msg also. :)

- disease_2000 <------ hope there's no misunderstood.
qferret
06-26-2001, 10:35 PM
hmmmm.....How can we expoit this bug ^_^ ....just kidding }>
Argoth
06-27-2001, 05:10 PM
Gratz!

I will download this tank game now and I'll have a look at it. I am also still newbie so I can't promise anything good. And my first 'crack' was that I removed a NAG from a program. I was pretty proud of that. In the beginning it didn't matter how lousy my cracks were, I just wanted to remove the irritating stuff. As soon as you have made a start, it gets more and more fun, so keep up the good work.

Grtz

Argoth
Argoth
06-27-2001, 05:19 PM
And about the basic asm tut u asked for, its very basic, but will make some things clear:

http://www.worx.tmfweb.nl/ASM.txt
Rupert
06-27-2001, 06:07 PM
thanks:)

i got a lot of info on ASM and read it. i have pretty much everything i need to understand the code. i have all the tools, and an ever expanding knowledge in ASM.

last night i traced through Winzip's entire code generator. traced it through line by line (the key gen) with softice and wrote my findings on paper.

what did i find?

Softice of Winzip32.exe: (v7.0)

408061: test eax, eax
408063: jz 004080B2

004080B2 a text ref to "sorry, wrong code". the interesting thing here is that line 408063 is different in WS32DASM

408061: test eax, eax
408063: je 004080B2

who's right? dasm or softice?

wrong password makes eax = 1. that doesn't make the JZ work. err, i need to do some more work. bye.
Rupert
06-27-2001, 06:21 PM
[disease_2000 speaking here]

testing... hmmm, the bugs still exist...

Rupert, how do you know that wrong password make eax=1???

by the way, TEST changes ZF flag... according to the result.

JE Jump short if equal (ZF=1)
JZ Jump short if 0 (ZF=1)

thus, they're both right.

NOTE: MODS, please remove my account (disease_2000)
i will register with a new handle. i can see that this one is causing problem....
i don't know how i got into rupert account. i just press the reply button and i'm him.. strange.
Argoth
06-29-2001, 05:52 PM
Okies, I've had a look at your Tank game. I figured some things out, but it is very hard for me. There are a lot of calculations and a lot of checks. All 'bad code' jumps seem to head for 506F:C64A. First thing: our serial should be 20 characters. The Serial is supposed to be made of the following characters: ADCEFGHJKMNPQRTWXY()3467L9$!%#@+. I don't know if you know how to use SoftICE, but I think it is necesary if you want to crack this one. Further in the code it does some calculations (which I don't understand :( ) and these are followed by alot of compares. it seems to work with some kind of checksum, coz when I modify my serial a little bit, the values it compares change. Maybe the skilled ppl around here could have a look at this one, coz I am a little stuck.

Grtz

Argoth
hz
06-29-2001, 06:40 PM
hiya Rupert(d2k) whoever and Argoth,
if I missed anybody out (sorry). Think you will find answer to serial lengths if you check params pushed just before getdlgitem and if you check when you get to compare, note there are some obvious missing characters from the compare string. I did have a quick look then got engrossed in playing the game and forgot all about the serial :-D
regards

PS don't forget to keep an eye on that number converted to hi,lo word


How to get hWnd?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to get hWnd?
PDA

View Full Version : How to get hWnd?

4oh4
06-26-2001, 11:52 AM
I'm trying to insert some additional code into a program, but need to pass the hWnd to one of my api calls. The problem is that the app is written in vc++ and is so overbloated.

What's the quickest way to get the hWnd so I can finish inserting my code?
Kayaker
06-26-2001, 01:08 PM
How about GetActiveWindow?
The GetActiveWindow function retrieves the window handle to the active window associated with the thread that calls the function.

Or tap into the main CreateWindow call, which returns the hWnd, and store it for later use.

If it's a particular hWnd you need maybe you can retrieve it with some other API such as GetTopWindow or GetNextWindow once you've got the parent hWnd.

Kayaker
4oh4
06-26-2001, 03:59 PM
Great!

That worked like a charm on the small test program I wrote. Now I'll just cross my fingers and hope it's that easy on the real app.

Thanks Kayaker
4oh4
06-28-2001, 12:43 PM
Well this is irritating...

The app starts out by programmatically disabling several menu items and enabling them at specific times. For example the "copy" and "paste" menu items are enabled only when the clipboard has text on it. So before I can even add my functionality code, I've got to programmatically enable my added menu items.

This code (for one menu item) is as follows:

jmp 00502830 ;jmps around my added code
pushad ;for some reason my popad at the end seems to cause a gpf so I'm just pop'ing edi,esi,ebp, and ebx at the end
call GetActiveWindow
push eax ;hWnd of active window
call GetMenu
push 0 ;MF_ENABLE
push 00000FC9 ;resource id
push eax ;hMenu
call EnableMenuItem
pop edi
pop esi
pop ebp
pop ebx
jmp 0041262a ;back to the original code

The return values from each of the calls are currect and the return from EnableMenuItem is 03 which is the previous state of the menu item (MF_GRAYED | MF_DISABLED). The api help states that if the return value is 0xffffffff that the menu item didn't exist so I know that I've got it right. As a side note, the api help also states that MF_GRAYED disables AND grays the menu so I don't know why someone would pass both flags.

Anyways, generically speaking.... Can anyone think of why my menu item isn't enabled after this apparently successful code is run? This code technique is working perfectly in my test programs.
Kayaker
06-28-2001, 08:50 PM
Hi 4oh4

Is it possible there's a call to some other menu function after your code is called which updates the menu to its default, such as LoadMenu, SetMenu or possibly several others? You might still be placing your patch too early in the programs execution. Try running APISpy32 on it with all of the 'menu' API's selected, then click on your menus, copy something to clipboard, whatever else affects the menus, and see if there are any other API calls that you have to deal with first.

Kayaker
4oh4
06-28-2001, 10:26 PM
I'm pretty sure not, as I inserted my code well into the app. ....after the app is good 'n loaded my stuff runs. A quick check shows that SetMenu (which I didn't even know about...sheesh!) is called 4 times. That's could be my problem. I'll check it, as I don't know what else to try. At least that makes sense though.

Damn I hate vc++. The code looks like garbled crap even. You know what I saw? An "xor eax, eax" followed a few lines(which didn't alter eax at all) with a "push eax". Wouldn't a "push 0" be better?

God, if you're up there, I promise if I make it through this rce project alright I'll go to church every sunday and quit smoking and drinking....and all the prostitutes......and the crack too......


Enabling a button help!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Enabling a button help!
PDA

View Full Version : Enabling a button help!

Xpert
06-26-2001, 02:26 PM
Hi,

I've a window message with 3 input text, when the 3 text are entered in the correct form a button is Enabled to continue the process.

I use softice to bpr the string and the P RET instruction the get the procedure, but it loop into the USER!BOZOLIVEHERE function.

Any ideas how to get into the main function of the event "on text change" of the field text?

Thanks
Kayaker
06-29-2001, 02:53 AM
Hi,

This sounds like a Delphi app. Try disassembling it with DeDe and search for the OnTextChange Event you're looking for. You should find an address associated with this event. Then you can set a bp in Softice on this address and it should break when you type something into the edit box. F12 a few times and you should be back in Delphi code.

Kayaker


+ORC toys
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > +ORC toys
PDA

View Full Version : +ORC toys

you2
06-27-2001, 10:01 AM
there's a wonderful tutorial on cracking by +ORC, but where are the toy?? suchas POOLDEMO.EXE

it seemed to me that they're all GONE!???????? where can i get it?
aimless
06-28-2001, 03:56 AM
Google.

1. Search for "ORCPAK", "ORCPACKS" and "ORC PACKS", in this order.

2. If too much junk comes up, search for:

+"ORCPACKS" +sandman
+"ORCPAKS" +sandman

In (1) do not use the quotes, and use each word in seperate searches
In (2) use the combination and quotes both. Do not forget to include the "+" sign...

Regards.
noname
06-28-2001, 11:24 AM
you2 (06-27-2001 08:01):
there's a wonderful tutorial on cracking by +ORC, but where are the toy?? suchas POOLDEMO.EXE

it seemed to me that they're all GONE!???????? where can i get it?

search the web,crying like a baby :D
google
download pooldemo

ps: You wanna to play "toys".search for gaytoys :D
you2
06-28-2001, 03:11 PM
thanx alot aimless!

noname <---- go to hell
noname
06-28-2001, 08:00 PM
google
rce cd sandman

you2 <---- go to hell ;p ;)

:D


softice and breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice and breakpoints
PDA

View Full Version : softice and breakpoints

jose
06-27-2001, 01:20 PM
I use windows me and softice 405.I have
problems when i set breakpoints (like getwindowstexta or getlocaltime).When i want to get out from softice appear a message like: " break due to bpxuser32!Get
WindowTextA", and i have to disable or
clear the breakpoint to get out.It doesnt occurs with others breakpoints(like getwindowtextw).What is happening?
disease_2000
06-27-2001, 02:29 PM
is there such thing as GetWindowTextW? I've never heard of GetWindowTextW, but GetWindowTextA
is a very common api specially for textbox and things like that. I think sice brings you in due to
bpx user32!GetWindowTextA. It could be that your target is processing that api as soon as you
get off sice (and the your target has control).

anyway, that's just my guess. (i don't have sice installed...)
Rupert
06-27-2001, 06:15 PM
softice is kinda difficult to use. i can't get it to work with bpx getdlgitemtexta at all. i use bpx and a line number (real newbie) to break exe.

remember:

BL: list you breakpoints
BC: clear your breakpoint

you want a step by step guide? ok.

start the sice's symbol loader. open your program. in module settings > debugging make sure "stop at winmain" is selected. go into ws32dasm and find the line # that you want to break. click on the load button in symbol loader. (3 gears). now, type BPX (linenumber)

done and done.


Puzzled by FPU
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Puzzled by FPU
PDA

View Full Version : Puzzled by FPU

Paddy
06-28-2001, 06:04 PM
I am a newbie trying to deepen my understanding of assembly by delving more deeply into a protection scheme I have already cracked using some NOPs.
Immediately before the crucial jump in the programme I have found the following code

FCOMP REAL8 PTR [EBP-00C0]
FSTSW AX
TEST AH,40
The programme jumps to the 'good guy' code when 4000h is in the AX register. According to the Intel web site FCOMP compares the value in the first register of the FPU with the memory location [ebp-00C0] and if the two values are identical 4000h is placed in AX.
What puzzles me is that just before I F10 the FCOMP line the bottom right hand side of the register window shows the contents of EBP-00C0 to be 00000000 while the contents of ST0 is shown as 8 but FCOMP still (ultimately) places 4000h in the AX register.
What is going on here?

Paddy.
eazylife
06-28-2001, 07:12 PM
your looking at the fpu registers, as floating point numbers.. and your looking at ebp-c0, in your data window, as a dword ?????

try 'dl ebp-c0' or 'dt ebp-c0' ..

RTFM :D
hz
06-28-2001, 07:35 PM
hiya eazylife,
Why don't we just try and keep it nice and easy round here, the guy just asked a question. Would have saved you some typing and been nicer without the rtfm remark.
What is it round here?, everyone's a master cracker except me and Paddy.
regards
eazylife
06-29-2001, 04:41 AM
hmmmm? did i answer his question? did i help? did i add the rtfm to be sarcastic, with a big smiley by the side of it??

sarcastically saying rtfm, see, if i was being evil or cruel or elitest, the only word in my post would have been RTFM

well i can see im not wanted, so i shall fuckoff and not bother trying ..
hz
06-29-2001, 08:01 AM
hiya eazylife,
If I have taken your reply as sarcastic when it wasn't meant to be, then I apologise. Who said your not wanted?, of course your wanted here, eveyone is, are you going to get upeset evey time some one misinterprets or disagrees with you?.
regards
hz
06-29-2001, 03:26 PM
cmon eazylife,
I was man enough to apologise, are you man enough to accept it?.
Paddy
06-30-2001, 06:13 AM
Thanks fellas for the replys.
I was afraid I had started a war there for a while.

When I use dl instead of d as suggested by eazylife there is indeed an 8 in ebp-00c0.

Reading some of your replies on the forum I am wondering, if you guys are newbies, what word is used to describe someone who knows as little as I do.


Puzzled over ra2wav password
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Puzzled over ra2wav password
PDA

View Full Version : Puzzled over ra2wav password

sdse71
06-28-2001, 11:55 PM
I am totally lost in trying to find the correct password for this program. I've been
trying for 2 weeks now, and only resorted to posting as a last resort because I wanted to try to figure this one out on my own. Anyway, I found the string "incorrect unlock code", but the only reference I found was several lines above it. I have seen nothing that looks anything like the tutorials I have read or programs I have successfully cracked thusfar. Also, maybe this will help, I have come across the password(or code) I entered but no luck on the good password. Any help will be greatly appreciated!! If any of you want to give this one a shot, here is the link to the program: http://www.remixer.com/ra2wav.exe
I think some of you will find cracking this program interesting. Finally, I am using both Softice and W32dasm. Thanks for your help!!!!
hz
06-29-2001, 03:22 PM
hiya sdse71,
If you show you have done a bit more than search for "incorrect unlock code" in WDAsm, I will point you in the direction. I mean no offence (seem to be able to do that without trying) but a lot of requests for help are thinly disguised
crack requests, again, I am not saying this is the case but you must have got a little further with this.
regards
qferret
06-29-2001, 11:06 PM
hz is right that this is a little vague...so I will give a vague answer ;-)

Set a BPR onthe bytes that you find your phony serial in.....when your program accesses that mem range (presumably either to copy it elswhere, or to compare it to a correct serial or conditions to make one) SoftIce will break.....take it from there & ask again if you get stuck...maybe a bit more specific w/ the question 8)
sdse71
07-07-2001, 07:56 PM
I really appreciate your help. Sorry about being so vague. I don't post alot so I felt like I didn't want to get too lengthy in my description. Please excuse my ignorance, but how do I set a bpr on the bytes. Could you give me a explanation on this. I see the display window for bytes on the screen in softice, and I 'm almost sure your not talking about the memory address (ex. 0043ff12). I've read about bpr but nothing really explained it clearly about setting the bytes to bpr, at least as far as showing any decent examples. Again, sorry for my ignorance, I am a little confused. I've never used bpr before.
qferret
07-07-2001, 08:43 PM
BPM CS:0043ff12 will set a breakpoint on that byte in memory

BPM CS:0043ff12 r will set a breakpoint on that byte in memory if it is read from

BPM CS:0043ff12 w will set a breakpoint on that byte in memory if it is written to

BPM CS:0043ff12 rw will set a breakpoint on that byte in memory if it is read from OR written to

now for setting breakpoints on more than one byte @ a time it's not practical to BPM each byte ;-) ...This is wgere BPR's come in.

Say your serial is 10 bytes long. search for it in memory (s 0 l ffffffff 'myserial')....then set a bpr on the range. Say you find your serial at CS:0043ff12 .....you would set this breakpoint:

BPR CS:0043ff12 CS:0043ff22
OR
BPR CS:0043ff12 CS:0043ff12+10 (softice will evaluate the expression for you)

Now if it reads the 4th char in your serial, you'll still break since you don't just have a BP on the first byte ;-)

Oh yeah......you can us the r & w flags on BPR's too.

Hope that clears things up a bit.

?ferret


What does the '+' sign mean
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What does the '+' sign mean
PDA

View Full Version : What does the '+' sign mean

nEOasM
06-29-2001, 04:33 AM
Anyone know what does the '+' sign (first char of the cracker nickname like +ORC or +HCU) mean?
4oh4
06-29-2001, 07:10 AM
I could be wrong, but it has something to do with them being fraavia's students.
latigo
06-29-2001, 11:59 AM
nEOasM (06-29-2001 02:33):
Anyone know what does the '+' sign (first char of the cracker nickname like +ORC or +HCU) mean?

Sometime ago (couple of years to be more accurate) an 'institution' existed which held the name of 'High Cracking University' a.k.a HCU. The students who belonged to the HCU had an optional '+' attached to their nickname either as sufix or prefix. To enter the HCU the potential HCUker had to pass an exam called 'the strainer'.
Those were my two nostalgic cents :)
Bye

Latigo
nEOasM
06-30-2001, 01:53 AM
Thanks, Guy! Now I'm Clear.
nEOasM
06-30-2001, 01:55 AM
So, who is the +HCU owner? Is Fravia?
Dimoni
07-03-2001, 10:29 AM
nEOasM (06-29-2001 23:55):
So, who is the +HCU owner? Is Fravia?

Dear,
Dimoni
07-03-2001, 10:30 AM
nEOasM (06-29-2001 23:55):
So, who is the +HCU owner? Is Fravia?

Dear,

the HCU owner was a hacker whose nick name was +ORC. He dissapered from scenes years ago.

.D.
Fake51
07-03-2001, 12:07 PM
The HCU didn't have an owner, tho it had a founder. To some degree it had teachers, but onely to some degree. The term was rather loosely used, more than it covered an actual teaching institution.

Blue skies
Fake


I'm really stuck
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I'm really stuck
PDA

View Full Version : I'm really stuck

scream
06-29-2001, 04:52 AM
Hi even though i have read the faq and unchecked the necessary lines...i still get the "symbol not defined" prompt...i need advice..
ytc_
06-29-2001, 05:41 AM
Which API are u trying to break on? And which OS? Bear in mind that WinNT/2k systems do not have hmemcpy. :)


SoftIce and star-up!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftIce and star-up!
PDA

View Full Version : SoftIce and star-up!

HerbieK28
06-29-2001, 05:16 PM
I did installed SoftIci401 on my windows 98 2nd Edition. It's work ok, but it also show up when I'm in windows explorer 5.5 reading web pages. I also find the program at shut-down. Contr+D won't shut down SI. My question: How do I prevent SoftIce from loading at start-up in windos 98 program. I just would like to start it myself when I need the program Not having it run in the background all the times. Need some advice, Thanks for now. Herb
hz
06-29-2001, 06:29 PM
hiya,
do you mean just click on si from explorer and it load?, can't be done that way. You don't need to have it start from autoexec.bat though, you can boot to a dos prompt then just go to si folder and type winice.
regards

call me "mr. state the bleeding obvious"
Kayaker
06-29-2001, 08:29 PM
You can edit autoexec.bat to give you the option of starting up Softice on bootup.

Example courtesy of Eternal Bliss:

--------------------------
@echo off
cls
set Winice1=Yes
set Winice2=No
echo Please Specify Whether You Want To Load SoftIce
echo.
echo Press 1 for %Winice1%
echo.
echo Press 2 for %Winice2%
echo.
echo SoftIce will not be loaded if nothing is pressed within 3 seconds
echo.
choice /c:12 /T:2,3 Choose an option
if errorlevel 2 goto NoLo
if errorlevel 1 goto Lo
:Lo
c:\PROGRA~1\NUMEGA\SOFTIC~1\WINICE.EXE
goto end
:NoLo
echo.
echo SoftIce Will Not Be Loaded
:end
------------------------

Kayaker
HerbieK28
06-30-2001, 06:45 PM
Thanks to all, I will use Kayakers advise also get icedump to hide SI....Herb
Rupert
07-01-2001, 02:18 AM
wow, in my 6 years on the net, you're the first person i've seen who can make a nice msdos batch file. only if asm were that easy.


What the heck is a key code??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What the heck is a key code??
PDA

View Full Version : What the heck is a key code??

Pam
06-29-2001, 11:42 PM
I'm trying to use a PC "backup" of "The Sims" but someone said I needed to get the key codes....What the heck is that and where do I find it? Any help would be greatly appreciated!!
qferret
06-30-2001, 06:37 PM
1.) a code that allows the full version of a program to be installed

2.) elsewhere


section .protect ,what it does?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > section .protect ,what it does?
PDA

View Full Version : section .protect ,what it does?

box
06-30-2001, 09:08 AM
help!
CoDe_InSiDe
06-30-2001, 11:29 AM
Hi box,

Well, it's probably Packed/Encrypted with some kind of Packer/Encrypter :)
You can try to Manually Unpack it or find out what the Packer/Encrypter is.
Look on Protools.cjb.net for i think the name was Language2000 and/or GetType.
Then search for some Unpacker for it, but i prefer Manually Unpacking ;)
Hope this helps.

Cya...

CoDe_InSiDe
LaptoniC
06-30-2001, 04:20 PM
It can be Hasp Envelope also.Maybe :)


Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice
PDA

View Full Version : Softice

newbie
06-30-2001, 12:39 PM
Well this may be some real stupid easy questions but i was kinda hoping you could clear up some doubts i had..
In softice when i press F10 and F8 they both seem to have the same function to allow me to scroll down the screen..however when i trace to a call function and press F8, it seems to trace into the call...why is this?? what is the primary differnce with F8 and F10??
Another thing..F10 is the trace down function right?
is there a 'trace-up' function key so to speak??
JimmyClif
06-30-2001, 01:56 PM
Alright, and Hello...

let's start with a good old -> RTFM

Open up the SoftIce command reference and read the pages:

P and T

This will tell you the difference between F8 (single stepping),F10 (stepping over) and F12 (step until return).
stillnewbie
07-01-2001, 10:37 AM
JimmyClif (06-30-2001 11:56):
Alright, and Hello...

let's start with a good old -> RTFM

Open up the SoftIce command reference and read the pages:

P and T

This will tell you the difference between F8 (single stepping),F10 (stepping over) and F12 (step until return).

Hi JC,
You have told him the answer ;)

ps: PLEASE RTFM before you post :D
JimmyClif
07-01-2001, 10:58 AM
I know.. I have a Heart of Gold ;)
Argoth
07-02-2001, 05:38 PM
"I think u prolly figured out what the difference is between F8 and F10, but just to clear things up: With F10 u trace over CALLs and with F8 u trace into CALLs."

DOH! I really should learn to read all of it and not just the question. It seems u were totally right

Grtz

Argoth


where can i find gdi32.inc?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > where can i find gdi32.inc?
PDA

View Full Version : where can i find gdi32.inc?

jing
07-01-2001, 09:30 AM
when assembling asm
error:can not find gdi32.inc

but i can find it on my disk

what's wrong?
should i down a new one ?where can i find?
stanks
07-01-2001, 10:38 AM
Hi

Check path again. Maybe there is a problem.

greetings
tezza
07-02-2001, 06:42 PM
Check your path in the asm code and ensure the file exists in the path specified.

Example:

include \masm32\include\gdi32.inc


Serial for Twinkle Bulbs 4.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Serial for Twinkle Bulbs 4.0
PDA

View Full Version : Serial for Twinkle Bulbs 4.0

Argoth
07-01-2001, 05:21 PM
I tried to find the serial for Twinkle Bulbs. It uses the softwrap system for registering. (I've encountered some more apps which worked with this softwrap loader and stuff. It also always has a SoftICE protection which is helpless against FrogsIce.) First the basic stuff: Check for right serial length (40BF87) it should be 41 characters. Then there is some calculation (they add the hex of every number you entered and an AND 0F in the end (414F6A) The outcome should be zero, because of the check at 40BFBB. I used 32045678901234567860123456789012345678900 and this got me into the second part of the protection, which is where I get lost. I know it does something with some key you get when using telephone purchase (Which is given by the program). Maybe anyone could point me in the right direction? The app can be found on http://www.twinklebulbs.com.

Grtz

Argoth


Sense of tracing in unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sense of tracing in unpacking
PDA

View Full Version : Sense of tracing in unpacking

Joda
07-03-2001, 12:43 PM
Hi all.

As always im goin to prove with the following question that i am a newbie :D.
It's the following:

When i read about manual unpacking, i see that i have to trace or bp myself to the original program entry point. Well that makes sense for me but - then i dump from 00400000 to 004***** - uhm?
I dont understand why i have to trace to the OEP, breakpoint on it and then dump - i miss the connecting line between those two acts.
If i just dump a program in memory that is already unpacked there, why do i need to find the entry point first - i could then just bp on any api inside the prog and dump from there. Hmm.

Help and tutorial tips are welcome ;) - guess im just not able to see the wood because of the trees :).

cya

Joda
CoDe_InSiDe
07-03-2001, 01:28 PM
Hi Joda,

well first thing is to find the OEP so that when you dumped the file you can fix the PE Header to make it run, but i think you already understand this ;)
And about just breaking on any API in the Program, ofcourse you can do that but then you don't have a "clean" dump because the program has changed a lot of values and stuff around (probably) :)
So the main thing is to first find the OEP (Because then you know where the original file "really" begins) and when your at the OEP dump the file, then fix the file ;)
So there won't be any values changed and you have a "clean" dump heh.
I hope you understand me ;)

Cya...

CoDe_InSiDe
Joda
07-03-2001, 02:58 PM
Hi Code_Inside.

Uhm well - i guess that was too logical :D.

Thx for answering,

Joda


Code Charge (Unpacking)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Code Charge (Unpacking)
PDA

View Full Version : Code Charge (Unpacking)

sharon
07-03-2001, 01:28 PM
hello everyone

target: www.codecharge.com
written in VB6
anti-Softice tricks + Packing

1- anti-softice can be bypassed using frogs ice or any other method

2- following most of the unpacking tutorials instructs to change the .text section from c0000040 to E0000020
the problem is that there is no .text section indicated
nevertheless, i assumeds that the first section (no name) is the text and changed it and it worked..

3- how do i find the OEP.. all the techniques i found in tutorials are for common packers.
what really can give me a clue for the OEP?

thanks for all your efforts
qferret
07-03-2001, 08:13 PM
how did you unpack it?

If you unpacked manually, the EIP when you dumped should be the OEP.

If you used ProcDump or another tool, it should have been taken care of automagically ;-)
sharon
07-04-2001, 05:14 AM
i appreciate ur answer but i geuss my question was not very clear..
my question is how do u find the right spot to unpack?

thanx again
bobik
07-04-2001, 08:22 AM
find my "small essay from newbie" about VB dumping in this forum
date : beginning of june

sharon (07-04-2001 03:14):
i appreciate ur answer but i geuss my question was not very clear..
my question is how do u find the right spot to unpack?

thanx again
noname
07-06-2001, 10:34 AM
sharon (07-04-2001 03:14):
i appreciate ur answer but i geuss my question was not very clear..
my question is how do u find the right spot to unpack?

thanx again

Hi Sharon,
its difficult to tell you which one is correct coz different packers has different
ways to find the oep.
the best way is to find a packer and packed
a notepad or vb progs and upacked it explore the unpacking rountines.
Hopes this helps :)

noname
qferret
07-06-2001, 06:37 PM
I actually suck at unpacking, but I believe most (I know of at least a few hehe) packers use a pushad opcode to store the info in the registers for later use.....then a popad right before the popad ends to restore the registers to their formar state. So if your unpacking routine is sitting at cs:470000+(purely a hypothetical #), and you find a jmp eax (again hypothetical) to say cs:412ef0 (you guessed it), with a popad a line or 3 before it....the address jumped to is probably the OEP.

Hope that helps.....& if it's way off base someone feel free to slap me with a large trout ;-)
Kayaker
07-06-2001, 09:52 PM
Hi Sharon,

Why don't you try Icedump's /Tracex command? I've never used it on a VB app, but it works great on packers in general.

/TRACEX <low EIP> [<high EIP>]

So if your .text section is from 401000 to 480000 you would set

/TRACEX 401000 480000

in Softice wherever you want to start tracing, press F5, go get a drink because it may take awhile, and SI should break in program code. In the command window will be a log with a cs:eip value, the last instruction address executed in packing code. You can then use the 'u' unassemble command on the address to see what the code looks like. If it looks like it was the jump to OEP you can dump it right there.

/Tracex will break anytime there's a jump/call to the code range you specified, but this may not necessarily be the OEP, some packers (like Asprotect) jump into program code a few times before the actual jump to the OEP. If it looks like the code returns quickly to packing code, you can trace back there and set another /Tracex command the same as the first, and it will break on the next jump to program code.

TRW has a built in feature that I think might be able to be used in a similar fashion, PNEWSEC (go until run into a new section in PE image).

Hope this helps,

Kayaker


Question about jumps/addresses
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Question about jumps/addresses
PDA

View Full Version : Question about jumps/addresses

nofun
07-03-2001, 02:33 PM
Hiya, I got my foot in the door in the world of cracking today and patched GRC's ASPIME, removing the exe modification check and time limit.

My question is about patching a file to make a jump to a certain address. I'm using W32DASM, and I see the bytes "EB 02", where the EB is for JMP and 02 (i guess) is for 00401497.

What I don't get is how can 02 stand for 00401497? Is there some kind of conversion I have to do so I can change it to "EB XX" and make it jump to a different address of my choice?
CoDe_InSiDe
07-03-2001, 02:59 PM
Hi nofun,

Calculating a Jump is very simple :)
Ok, so you have "EB02".
Then EB = Jmp
And 02 = how far it'll Jump (in Hex)
So let's take this example:

0 1 2 3 4 5 6 7 8 9
EB 02 33 C0 6A 00 58 0C 01 50 9D C3
|______^

Here "EB02" will jump to the Opcode 6A.
If you would change here EB02 -> EB09 it would jump to the "C3" (ret) :)
If you want to calculate a Jump then take the Offset of the instruction you want it to jump to and then SUB the Offset behind the actual Jump ;)
With "near" (like EB, 74, 75 etc...) and "far" (like E8, E9, 0F84 etc...) Jumps there's also one other thing.
A Jump/call can jump Forwards but it can ofcourse also jump backwards ;)
To calculate a backwards Jump take the Offset after the actual Jump and SUB the Offset where the instruction is located you want to Jump to :)
Here's a little table for backwards Jumping because it's a little different then Forwards ;)

0 1 2 3 4 5 6 7 8 9 A B C D E F
F E D C B A 9 8 7 6 5 4 3 2 1 0

So a little example:

5 4 3 2 1 0
33 C0 EB 05 EB FA 33 C9
^_____________|

So you could translate "EBFA" (With the above Table) into:

FA
||
05

And so it Jumps to the Opcode "33" :)
And you asked:

"What I don't get is how can 02 stand for 00401497?"

that's very logical check the next example:

00401493 EB02 ----
00401495 33C0 |
00401497 6A00 <--
00401499 58
etc...

See those Offsets? ;)
Ok, i'm gonna quit now and i hope you understand it ;D

Cya...

CoDe_InSiDe
nofun
07-03-2001, 03:55 PM
See those Offsets? ;)
Hey, I see em!

Thanks for the indepth detail CoDe_InSiDe!

It all makes sense now
aimless
07-04-2001, 10:38 AM
You might also want to try out the jump generator from protools.cjb.net in the "utils" section....
nofun
07-04-2001, 05:44 PM
Thanx for the tip. BTW, it was in the compilers -> misc tools sec.


disassembly of a DOS programme.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > disassembly of a DOS programme.
PDA

View Full Version : disassembly of a DOS programme.

Paddy
07-04-2001, 02:34 AM
Will wdasm disassemble a DOS programme. If not what will.

Paddy.
CoDe_InSiDe
07-04-2001, 02:42 AM
Hi Paddy,

Yes W32Dasm can disassemble DOS Programs ;)

Cya...

CoDe_InSiDe
aimless
07-04-2001, 10:40 AM
...But better, try Sourcer7.

Again, at protoos.cb.net or exetools.com
Paddy
07-05-2001, 02:47 AM
Thanks for the replies.

I have downloaded Sourcer7 as suggested but cannot find a manual. When I try to get the app. working it complains there's not enough conventional memory. I suspect I may not have installed it properly -I just clicked an MS-DOS install icon, entered reg. no. when asked and almost instantly a DOS box appeared.

Paddy.
ThinHorse
07-05-2001, 09:42 AM
Try Ida Ver 4.15. URL:http://www.doroom.com/aaron/ida415_X.zip(x=1 to 8)


Searching for breakpoint(s)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Searching for breakpoint(s)
PDA

View Full Version : Searching for breakpoint(s)

bobik
07-04-2001, 08:08 AM
How a serial communication (throught com port) can be controlled
in dos (Exept int14h and direct port I/0) ?

10xThx
Muad'Dib
07-05-2001, 01:27 AM
Try "bpio -h 378 rw" - this will break on a read or write from port 0x378, which is the serial port.


I've found great ReVirgin - Tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I've found great ReVirgin - Tutorial
PDA

View Full Version : I've found great ReVirgin - Tutorial

Incognito
07-04-2001, 05:43 PM
Hi everyone! :)

I've found a great ReVirgin-Tutorial with many Images and ASprotected Files. It's a Step by Step Tut from a man called "Instructor". But it is only in german available.
h**p://tnp.6x.to
This Tut is much easier than Predator's...;)

cu
incognito
hz
07-04-2001, 06:26 PM
hiya,
are you going to translate it for all us non german speaking/reading then?
regards
Joda
07-05-2001, 11:08 AM
Hi.

Well even that i dont think, that predators tut was very hard to understand, im always thankful for new links - I'm German tho, so its not a problem for me :x.
But as long as the site doesnt seem to work with Netscape at all, its of no use for me - doesnt really speak for the guys that they make jokes about Microsofts "Monopol" Browser and then don't even support netscape.

cya

Joda
exa
07-05-2001, 11:59 AM
Hi there...
It's a known bug on our page - the design is pretty new, so some kind of "beta-stage".
We are going to fix it within the next 14 days, promised.

:)

Bye,

exa.

---

The Newbiez Project - tnp.6x.6to
#newbiez @ efnet
incognito
07-05-2001, 03:59 PM
hmm..this link works with Netscape. I think it's the "old" TNP-Page...;)
http://www.websamba.com/newbiez/index2.html

Have phun
incognito
Battlestar
07-06-2001, 09:28 AM
Thx Incognito,
this Tut brings me up with ReVirgin. :)

But is anyone out there who translate it? I'll understand most of them, while the pictures are there, but my german isn't the best...;)

Again,
thx Incognito

Btw.: @ exa :The second link is the better way. The old Page looks much better than the new one. Why you are changed the style?

cu
Battlestar
WoPi
07-06-2001, 06:01 PM
Thx for that link! :)
exa
07-07-2001, 04:29 AM
Battlestar (07-06-2001 07:28):
Btw.: @ exa :The second link is the better way. The old Page looks much better than the new one. Why you are changed the style?

Might be too long to explain here. But i guess that we are going to switch back to the old one - we'll see.

But personally, I clearly prefer the old version - ist much more browserfriendly...

But anyways, I am really glad to see how much you enjoy the work of our team.. Most of us donate really a lot of work to this project, so some kind of a thank you is always a very pleasant thing... :)

exa.

exa.
Joda
07-07-2001, 10:58 AM
Hi again.

I checked the "old" page and well its a nice one (wont discuss the matter of is-the-old-one-better-or-the-new-one tho :P ) - good for all guys from Germany a pity that there's no english version for our english mates - perhaps you'll find some guys that have the time to create translations of the pages.
I'm just going thru some stuff atm and it brings up a clear written and easy to understand style. An interesting idea to fill the tutorials with pictures, is it the beginning of PowerPoint-Cracking-Tutorial-Presentation era? ;))))

Hm that posting kinda sounds like a review now :X.

For i dont know how to end this posting now, i'll just do it.

theEnd,

Joda
Hoof
07-11-2001, 04:38 AM
Why not translate it using a web based translator like Altavista or something ?

I did it and the translation is quite good. Well.... good enough to read.
Janus
07-11-2001, 08:06 AM
rofl!!
I've tried it with Altavista. And now?
The Tutorial is a very funny thing. :-)
I used my old german book and translate for my own purpose. That's it.

greatz to all from sweden
Janus


What means "@" in Softice?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What means "@" in Softice?
PDA

View Full Version : What means "@" in Softice?

mitrix
07-04-2001, 06:52 PM
Hi All

What means "@" in SI,such as:

bpx xxxxxxxx if (@esi+8==111)

Thanx!
Kayaker
07-04-2001, 09:45 PM
Hi,

Same as *

What means "*"?

Better not ask without doing a bit of research first ;)

Kayaker
mitrix
07-05-2001, 02:23 AM
Hi Kayaker

at first,thanx for your advice
after have a test,i think @ and * means get
something from the address,same as the [] in ASM.doesnt it?

if my thinking is right,the sentence above should be wrong when i want to make a bp as
[ESI+8]==111.it should be
bpx xxxxx if @(edi+8)==111

mitrix
Kayaker
07-05-2001, 10:38 AM
Hi Mitrix,

Yes you're right, you need the brackets with the @ or * indirection operator. While the brackets make it easier to understand, you can also use the "." or "->" operators, making it quicker to type.

The following commands are equivalent:

*(edi+8) (gets Dword pointed to by ebp+8)
@(edi+8)
edi->8
edi.8

Kayaker


ASProtect 1.2x
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect 1.2x
PDA

View Full Version : ASProtect 1.2x

tigeros
07-04-2001, 07:58 PM
I try to patch a ASProtected prog in
memory using RiscPP. But whenever I
luch the loader, it says protection
error etc. I then find a call to
VirtualProtect and modified the DWORD
flNewProtect to PAGE_EXECUTE_READWRITE=0x40.
But the problem is the same. Can anyone
give me some hint how to work around this?

Thanx!


winzip 8.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > winzip 8.0
PDA

View Full Version : winzip 8.0

I.D.X
07-04-2001, 09:23 PM
how to crack winzip 8.0 (patch , serial ) ?
qferret
07-04-2001, 10:00 PM
I.D.X (07-04-2001 19:23):
how to crack winzip 8.0 (patch , serial ) ?

(yes, yes) }>

easy serial fish, easy keygen, easy to make the proggy cough up the serial in a messagebox...etc, etc....

bpx getwindowtexta or getdlgitemtexta & go from there
NeO
07-05-2001, 01:17 AM
REad some find it on web ..There are exact tuts for winzip 8.0

NeO
qferret
07-05-2001, 05:07 PM
The only thing that differs between versions is the memory addresses.....the protection has remained unchanged (line for line) since the birth of the program ;-)


Two questions...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Two questions...
PDA

View Full Version : Two questions...

doc
07-05-2001, 04:17 PM
All right my first question is about cracking using Win32dasm and a hex editor (Hex Workshop). I'm trying to crack WinZip 8.0 (I'm just learning) and I've gotten to the point where when I run WinZip I can type in Name and Registration Number and it will bring up dialog about the license agreement and supposedly I am registered. But the program still says I'm unregistered and the popup screen still shows up in the beginning telling me to register. All I changed was three 'je's to NOPs... they all called the 'Incorrect information...' string. What else do I need to look for to register it? I've tried looking in the Windows registry, and I found where they put my Name and Reg #, but for some reason it's not seeing me as registered. Any help would be appreciated...

Also, I haven't used SoftIce yet and I'm looking to download it... I'm running WinME. I can't seem to find the SoftIce site and when I looked at protools.cjb.net I found a version for that should work for Win98. WinME supposedly runs all Win98 programs.. is that what I should get?

Thanks.
Muad'Dib
07-05-2001, 04:39 PM
The reason that it is not saving the registration data is because even though you changed the compare to be unconditionally correct, it still stores the key you entered into the registry. You could either patch the calls at the beginning of the program or change which address it writes to the registry.

Also, Windows ME + SoftICE is a bad combination IMO. WinME is bad period IMO :) I would recommend either down(up)grading to Win98 or going to http://icedump.tsx.org for more information on how to run SoftICE under WinME.
doc
07-05-2001, 05:02 PM
Why is it a bad thing for the false registration info I provided to be in the registry? Does the program check if that info is incorrect when it loads too? If so, I have no clue how to fix that. Are there tutorials? If so, can someone give me a URL for one? I was trying to do it without a tutorial, but I've worked on two programs and I'm having the same problem with both.

Also, about SoftICE... is there a need to use it? I mean, are there programs that would be impossible to crack without SoftICE, or can I just use Win32dasm and a hex editor? Just wondering...
qferret
07-05-2001, 05:05 PM
hehe.....so.....u want tuts for winzip eh?

I believe qferret.cjb.net will help you out in that respect *plug plug* ;-)
doc
07-05-2001, 06:37 PM
All of your tutorials, except for the cheat using just the hex editor :), require the use of SoftICE. Isn't there a way to crack WinZip without SoftICE? I wanted to avoid using SoftICE until I understood Win32dasm and hex editing well enough.
Kythen
07-05-2001, 06:51 PM
Actually, i think it would be a better idea to get SoftICE working and start learning it. It can be very difficult to crack programs using only a dead listing from Win32dasm or IDA. Many times it's hard to tell specific details of what is happening in a piece of code, and you may miss things like the contents of certain memory locations and registers. Generally, you only start cracking with only a dead-listing once you have enough practice and experience to know what is going on in the asm code. Even then, it can still be a challenge and sometimes impossible! I'd suggest playing around with SoftICE and if you have any questions about using it, just ask away here and we'd be happy to help you! :)
doc
07-05-2001, 07:32 PM
What do I need to download from that icedump page to use SoftICE with WinME? And is there another debugger I can use? Will any of the other ones work better with WinME? Thanks..
qferret
07-05-2001, 08:57 PM
search, search, search ;-)

ht*p://www.numega.com/support/knowledgebase/docs/1078.stm
qferret
07-05-2001, 09:04 PM
...and I think learning to use SoftIce is definitely a good idea as, you get to actually see what's happening in the program line by line....a deadlisting is great IF you know assembly ;-)
doc
07-05-2001, 10:02 PM
Ok.. I want to get SoftICE. But I have a few REALLY stupid questions. First, where do I get it... I couldn't find it on www.numega.com, but it may be because I didn't look for very long. For some reason, that site will not load on my computer, but will on other computers. If anyone know why that is, tell me, because I can't figure it out... Every link I've seen so far to get the program has come up dead, so I can't figure out if it's my computer or the pages that are screwing up. I don't know... please help.
aimless
07-06-2001, 05:44 AM
Hullo jforjunk,

Here's something that you should do.

* Get SoftICE. (of course.) But try to search from Google where the free downloads are. Protools is not good as it links to HAMBO which is out for as long as I know it (about 2.5 years now, I think!)

* Get w32dsm but use it for UNDERSTANDING and not CRACKING. Its good for cracking easy progs. It is a very BAD MISTAKE to try cracking the "correct" serialz apps using this disassembler. Simply because, disassembly was meant to show you which calls to patch and which jmps to nop. Its not, and CANNOT show you the correct serial in the memory like ICE does.

* You can also try Oledbg.exe (search in google) or TRW2000 1.23. First is legal and free and second is free (almost)

* Secondly, if you HAVE to use W32dsm for WinZip, I'd suggest you stop using it to find out the serial, but start using it to determine which procedures are actually validating the serial, both at start, middle and end.

You can also, of course, post here, as ever.

Regards.


How to reverse program under IDA ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to reverse program under IDA ?
PDA

View Full Version : How to reverse program under IDA ?

mitrix
07-06-2001, 01:33 AM
Hi all:

i heard IDA is a good tool to analyse program code.I find it's fine after have a test today,but who can tell me how to patch or modify some code under IDA if I want to reverse some program.

thanks.

mitrix


Registration codes-How do I read them?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Registration codes-How do I read them?
PDA

View Full Version : Registration codes-How do I read them?

Tommy Mc
07-06-2001, 10:26 AM
I'm new to cracking, but I've been reading every tut I can get my paws on. I am humbled by how much there is to learn. I have performed my first reversal, just got past the trial time limit on DePopper 2.04 (recording noise filter) It was, I think an easy one to do, and if anybody is interested, I have written up the instructions in very easy language.
Elated by my first reversal, I've moved on to Polderbits 1.6. Even the time reversal isn't so easy, but my preference would be to crack the registration. There is a 'program code' that is already there (tied to something in my registry?) and then an access key that I must supply. Using Softice, I break on Getwindowtexta, but then I'm getting lost.
I think I'm unclear on how to 'read' what is in the registers. Somewhere shouldn't I see the text I have entered, and what it is being compared to?
I know to use 'deax' etc. to display the contents of the registers, but how do I decipher it? Any nudges in the right direction would be appreciated.

I am using Softice, W32dasm, Hexworkshop, and Regmon.
Kythen
07-06-2001, 01:33 PM
One of the parameters to GetWindowText is a buffer that holds the text after the call. Scroll up after you F12 from the break and look at the parameters that get pushed onto the stack before the call. In one of them (I think it's the second one, but I don't remember offhand and I don't have my API reference handy) will be your text. You can do a bpm/w/d on your text and follow it along. Generally what will happen is your serial will be compared to the output of some function on that 'program code'. You can watch and see what the output is of that function and find your good serial (serial fishing) or if you feel up to it, you can try and reverse engineer that function and make yourself a keygen for the target.
If you have any more questions, feel free to ask :)
hz
07-06-2001, 05:10 PM
hiya,
If I'm not mistaken this prog uses getdlgitemtexta, try bpx getdlgitemtexta do "d *(esp+c) ; pret". Could be wrong though ;)
regards
Tommymc
07-08-2001, 10:53 AM
First off, I appreciate your help. I'm having a hard time because there are gaps in my knowledge. (Actually, more gaps than knowledge.) Reading all the tuts has been hit or miss. From each one, I gain some insight, but I'm missing the overview of what I am doing. So for instance, Kythen, you say "Scroll up after you F12 from the break and look at the parameters that get pushed onto the stack before the call. In one of them (I think it's the second one, but I don't remember offhand and I don't have my API reference handy) will be your text. You can do a bpm/w/d on your text and follow it along.
" Problem is, (my fault, not yours) that I understand in theory what you said, but am lost in the details of how to perform it.
Ok, so "one of the parameters will be pushed into the stack" (push-I get that). "In one of them will be your text." (where, or how do I see it? is it in code, or visible as I typed it?) "Do a bpm/w/d on your text and follow it along. " (bpm=breakpoint on memory. w=word, d=dword? or display? Exactly how do I execute this command?) (and how do I follow it along...F8?)
As you can see, one of the big problems I am running into is 'assumed knowledge'. Even the most basic tuts do this to some extent. I don't know if I should be asking for specific clarification to your suggestions, or direction to fill in my missing knowledge. (or both)
hz: I tried getdlgitemtexta, it breaks at the popup asking for the access code. I entered your command, don't know what I'm looking for tho.....
Kythen
07-08-2001, 01:05 PM
Yes, you do bring up a good point. Many of us do make assumptions on the knowledge of ppl reading our instructions. I'll try and answer your questions in order..
1. How to see the pushed parameters?
in the command prompt at the bottom of the SI window, enter d and then the register or address that was pushed as the parameter. This will show the contents of that memory address in the data window (if you don't see the data window, enter wd in the command prompt). I can't tell you exactly what to enter, as parameters and how they are pushed will vary. Read the SoftICE manual for details on all the different ways to enter the registers and memory addresses (they are similiar to C/C++)
2. BPM/W/D
You are correct in that bpm = breakpoint on byte access, bpmw = breakpoint on word access, and bpmd = breakpoint on doubleword access. You set one of these breakpoints on a memory address and SoftICE will break when that memory address is accessed (you can set it to break on read, write, read/write, or execute of the address)
Once the program breaks, you know it is doing something with your entered text. It can be making it uppercase, finding its length, or comparing it to something else, or any number of other things. Follow the code along in that area and try to make out what the program is doing to your text.

The biggest suggestion i can give you is to read over the SoftICE manual and become familiar with the basic instructions like breakpoints, windows, and evaluation (the "?" command). It will explain how to do things much better than I can (like how F12 returns from the current function, F8 single steps through instructions, etc.)

Hope this helps!

Kythen
Tommymc
07-08-2001, 01:44 PM
Thanks, I'll chew on this a bit..........


Help with +ORC tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with +ORC tutorial
PDA

View Full Version : Help with +ORC tutorial

SMurf
07-06-2001, 07:25 PM
I've been looking at the How To Crack C.1/2/3 for a while now, attempting to figure out the Instant Access protection scheme. Unfortunately, the third section doesn't have a full breakdown of the cracking method as +ORC had done in his other tutorials.

I can see how the registration code is changed into the "magic" code, but I don't see how the access code is generated from it (the product code also appears to be randomly generated, which doesn't help).

Any clues? I'll admit this is quite an old target, but it's quite hard to beat. ???


AX NF ZZ and *.EKB files protection help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AX NF ZZ and *.EKB files protection help
PDA

View Full Version : AX NF ZZ and *.EKB files protection help

l0ke
07-07-2001, 02:44 AM
Could need some help with this!

The protection:
A protective directory is stored with the authorization. It contains authorization files with the "system" and "hidden" attributes. The attributes must not be changed. The files must not be modified or deleted, otherwise the authorization will be irretrievably lost.
The protective directory "AX NF ZZ" is stored once per drive and contains all the installed local authorizations on the drive. It is stored with the installation of the first authorization and deleted again when the last authorization is removed. The protective directory stores one or two files per authorization, both with the same name. These files have the authorization name as the file name, but different name extensions.

And:
The authorization causes a cluster to appear on the target drive which is identified as "defective". Do not attempt to restore this cluster.
URL to get the AuthorsW application (wich can control and manage diffrent licenses): http://www.ad.siemens.de/Simatic-cs

--Note! the file extensions is *.EKB and *.HRD
(I'm not sure about the *.HRD) there is also a file check to see if the SWITCH.F9L exists in your %windir%.

The application I'm trying to crack is an upgrade for "Switchsim" at www.routersim.com.
To run you need a already registered copy of an earlier version (nlwdll32.dll is required), and also the "Assymetrix toolbook runtime" files.

Dump taken from "SCPW32.DLL"
If one change :00404980-004049881 to FF FF and then continue to run it
(watch them as an error code will moved there, bpmb the 00404981 byte to se any changes)
If the bytes gets changed do change them back to FF FF.

The application will start running (as normal I think) but closes itself right away!?
This is where I need the help to find out how things work.

EAX=0000FF00 EBX=00F56729 ECX=8171675C EDX=8061FEC7 ESI=00F5CBEC
EDI=00404980 EBP=00F5C03C ESP=8061FFDC EIP=00F57E85 o d I S z A P C
CS=0167 DS=016F SS=016F ES=016F FS=4187 GS=0000
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄbyteÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
016F:00404980 03 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
016F:00404990 03 00 53 57 49 54 43 48-00 00 00 00 00 00 00 00 ..SWITCH........
016F:004049A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
016F:004049B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
016F:004049C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
016F:004049D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
016F:004049E0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
016F:004049F0 06 53 57 49 54 43 48 00-00 00 00 00 00 00 00 00 .SWITCH.........
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
0167:00F57E67 58 POP EAX
0167:00F57E68 807D3A01 CMP BYTE PTR [EBP+3A],01
0167:00F57E6C 7511 JNZ 00F57E7F
0167:00F57E6E 80BD6E15000001 CMP BYTE PTR [EBP+0000156E],01
0167:00F57E75 7508 JNZ 00F57E7F
0167:00F57E77 3CFF CMP AL,FF
0167:00F57E79 7504 JNZ 00F57E7F
0167:00F57E7B B0EA MOV AL,EA
0167:00F57E7D EB00 JMP 00F57E7F
0167:00F57E7F 8BBD94060000 MOV EDI,[EBP+00000694] <<=00404980
0167:00F57E85 83C701 ADD EDI,01
0167:00F57E88 8807 MOV [EDI],AL
0167:00F57E8A 8BBD94060000 MOV EDI,[EBP+00000694] << same location
0167:00F57E90 8A07 MOV AL,[EDI]
0167:00F57E92 3C00 CMP AL,00
0167:00F57E94 7505 JNZ 00F57E9B
0167:00F57E96 E803D3FFFF CALL 00F5519E
0167:00F57E9B E8EACEFFFF CALL 00F54D8A
0167:00F57EA0 8A854A880000 MOV AL,[EBP+0000884A]
0167:00F57EA6 3C00 CMP AL,00
0167:00F57EA8 7414 JZ 00F57EBE
0167:00F57EAA 8BBD94060000 MOV EDI,[EBP+00000694] << same location
0167:00F57EB0 83C701 ADD EDI,01
0167:00F57EB3 8A07 MOV AL,[EDI]
0167:00F57EB5 3CD3 CMP AL,D3
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄSCPW32!.text+6E67ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
l0ke
07-07-2001, 02:58 AM
Sorry!
wrong url.

Here is the one: http://www.sinetic.ru/support/soft/repair.shtml
bar
07-08-2001, 12:00 AM
[quote]l0ke (07-07-2001 00:58):
this protection is one of the oldeast
in the world. 80....
his name is stopcopy

uncrackable !


Dumping/Rebuilding exe's compressed with telock 0.80!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dumping/Rebuilding exe's compressed with telock 0.80!
PDA

View Full Version : Dumping/Rebuilding exe's compressed with telock 0.80!

Dr Apocalypse
07-07-2001, 06:57 AM
Simply(!), I would like to 'unpack' a telock file, Gilbert Goodmate Patch, the exe is telocked with 0.80!

Have dumped with Procdump, looked at revirgin, but completely lost!

Can anyone help or suggest how to unpack this file!
Clandestiny
07-07-2001, 07:33 PM
Hiya,

+Splaj has a good essay on tElock unpacking for version .71. Perhaps it can show you how to approach the target. It would seem +Splaj's site www.discompress.com is down, so I'll u/l the tut to the board for ya. The original html file was very printer unfriendly, so I'm attaching a .txt version of it.

Regards,
Clandestiny
Dr Apocalypse
07-07-2001, 10:10 PM
Thanks for the tut!

Small problem, Softice won't work with my video card, Matrox G200!! Nothing happens when I use CTRL-D, the system freezes until I press CTRL-D again! Looks like softice is activating but not displaying a window!

Is there a fix for this or do I need to use an alternative debugger?

Thx
Kayaker
07-07-2001, 10:10 PM
Clandestiny (07-07-2001 17:33):

It would seem +Splaj's site www.discompress.com is down,
Clandestiny

Ahh, but it still does exist under the guise of evil_+Splaj... }>

http://59327516776/discompress/

not_so_evil_Kayaker
cuddly_SplAj
07-08-2001, 04:58 AM
Hi

Yes tE!lock.8 is very nice, and FREE (greetz egoiste)

My approach ( I don't normally use Icedump cos I reverse in Win2K) is to find the 'signature' bytes then you are near the OEiP and ready to dump/rebuild. You also have to stop the IAT being destroyed after it has been mapped and redirected. Also use LordPE to dump cos it fixes the PEheader from disk so no section count FFFF probs ;)

You have to hide the SI as well ;)

For a starter, the signature bytes :-

"B9,09,01,00,00,8D,BD,09,99,40,00,8B,F7"

do some research and you get more help }>

+SplAj
Dr Apocalypse
07-08-2001, 05:22 AM
Well it looks like i'm stuffed b4 I start! Sice 4.01 won't work under ME! In fact ME strips out the sice commands in the autoexec.bat when it boots :/ so it never loaded at all!!

I assumed CTRL-D had froze my machine as nothing had happened (I had the same under Win98, but sice HAD loaded and that did freeze with CTRL-D!)

Which sice version runs under ME?

If you think I'm wasting your time, kill the thread and I'll forget it, will just have to wait for a 'telock' unwrapper!
Dr Apocalypse
07-08-2001, 06:13 AM
Sorted!

Softice 4.05 + info & debugger.exe from Numega + MS Debugging Kit for ME = working sice! No video problems :)

A bit of 'research' helped there ;)

Now to work through the tut!

Sh*t! Now Icedump won't load...grrrrr! ICEDAT.DLL ver 4.05.334, so ran icedump for 4.05.334, just get 'VXDLDR failed to load icedump'!! Should I give up!
+SplAj
07-08-2001, 08:36 AM
DONT EVER GIVE UP !

That's what makes a good reverser, took me 2 weeks to figure out SI with WinME on my new notebook cos I am too proud to ask such lame q's :)

Actually I believe Iceman made a nice utlity to load SI without the
M$ baloney bloat degugger stuff....

Any way you are nearly there, this prob should be in the faq cos Icedump has to have kernel & user dlls loaded by SI. So change your ';exp=' in winice.dat to point to the real dll's like EXP=c:\windoze\kernel32.dll etc etc

reboot, icedump will now load :)

later

+SplAj
splaj
07-22-2001, 05:58 AM
latest news regarding tE! lock (now up to v 0.90)

With ALL versions of tE!lock I have it takes 10 secs to get to the OEiP......- but Kilby will take an hour with his Frankie Fingers ;)

BPX VirtualProtectEx
f12
s cs:eip l eip+200 61
bpx the memory location of 61 [popad]
there U R , at the hand over :-)

+Spl/\j }>
NeO'X'QuiCk
07-23-2001, 09:06 PM
Hello i try to unpack telock .90 but i think that the problem is not that much the OEP but more rebuilding ITA..

NEO'X'QuiCk


tnt-enforcer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > tnt-enforcer
PDA

View Full Version : tnt-enforcer

mambox
07-07-2001, 09:45 AM
hi,

anyone got this and checked whats worth?
unable to find it again,all links on TNT are down.
any working links welcome

thanks
Joda
07-07-2001, 11:28 AM
Hi.

Hmmm sounds good, if it does what is says, but that download signup shit on their page is lame.

(and isn't it more challenging to activate buttons and stuff with your knowledge than the one of others anyways? ;) )

Joda
nofun
07-07-2001, 02:41 PM
I didn't find it too fascinating. Here's a link to v1.0.
knowledge.ye.hu/toolz/otherz/enforcer10.zip

BTW, does anyone know of a good tool for adding space to a specific offset of an existing section instead of creating a new section in a PE file?
Clandestiny
07-07-2001, 07:19 PM
nofun (07-07-2001 12:41):
BTW, does anyone know of a good tool for adding space to a specific offset of an existing section instead of creating a new section in a PE file?

Hiya,

Most, if not all, PE utilites add an extra section or append space to the last section rather than allowing you to add to an existing section. Till I found the following essay by c0v3rt+ I too wondered why this is so.

As it ends up, adding to an existing section is a formidable (if not impossible) task without relinking the file.

Here's a small excerpt in explanation from c0v3rt+ 's essay:

**************************************

If there is not sufficient space at the end of the text section you will need to extend it. This poses a number of problems.

1. If the section is followed by other sections then you will need to move the following sections up to make room

2. There are various references within the file headers that will need to be adjusted if you change the file size.

3. References between various sections (such as references to data values from the code section) will all need to be adjusted. This is practically impossible to do without re-compiling and re-linking the original file.

Most of these problems can be avoided by appending to the last section in the exe file. This however poses a number of further problems, none of which are insurmountable.

**************************************

For additional info, check out entire essay at the following link:

http://208.50.16.104/fravia/covert1.htm

Does creating a new section pose a problem for you with the app you're working on ?

Regards,
Clandestiny
qferret
07-07-2001, 08:48 PM
so that's y they add sections to add imports ;-)
mambox
07-08-2001, 06:05 AM
thanks for the url..
i should admit...bad web search from me!

trying now to get from a 0.2 k/b site hungarian far

x
nofun
07-08-2001, 03:36 PM
>Does creating a new section pose a problem for you with the app you're working on ?

Nah, I was just wondering if there was an easier way. All I did was replace some instructions and made it jump to the newly created section, then have it return when all the code has been executed.

Thanks for the link


Modify Adress in System Area under Win9x
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Modify Adress in System Area under Win9x
PDA

View Full Version : Modify Adress in System Area under Win9x

tigeros
07-10-2001, 05:30 PM
I made a programm to use that undocumented
Vxd Call to reserv some shared memory
and hooked the VxD call. But when my
VxDCAll is called, I still can't modify
the adress in System Area, such as
Kernel32!GetLocalTime etc. How do I modify
such adress??? I thought under Ring0 you
can do everything to all the memory.
Fake51
07-11-2001, 10:50 AM
You CAN do what you want when in Ring0, provided that the page you are writing to is present.
So, it would seem that the problem lies somewhere in your VxD or in the communication between the program and the VxD.
You could upload both program and VxD, see if somewhere has the time to take a look, if you haven't found the prob yet yourself.

Blue skies
Fake
tigeros
07-12-2001, 06:14 PM
I found out how to do that in Ring3
mode, Ring0 is not neccessary to do
such simple work ;)

Use the VxDCall PageModifyPermission
to do anything you want


packed files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > packed files
PDA

View Full Version : packed files

Brill0
07-11-2001, 12:28 PM
is there a way to tell what a program has been packed with, and then unpack it, or do you have to look at it with softice?
another thing if you have some free time, how can a program detect if it has been modified. i change a jz to like a jmp or nop it out and it picks it up somehow ???.
CoDe_InSiDe
07-11-2001, 01:28 PM
Hi Brill0,

"Is there a way to tell what a program has been packed with, and then unpack it, or do you have to look at it with softice?"

SoftICE is not especially needed to know what kind of Packer/Encrypter has been used ;)
You can simply check the Section Names for some suspicious names, for example with UPXed files a Section Name looks like "UPX0" :)
To be more Version specific, that's tougher ;D
And to Unpack it, you can try to Manually Unpack it or otherwise find an Unpacker for this Packer/Encrypter :)

"how can a program detect if it has been modified. i change a jz to like a jmp or nop it out and it picks it up somehow?"

Then there's probably a CRC check ;)
A CRC check makes an unique Checksum out of the file and Compares that created Checksum with another (Original) Checksum.
If they're not equal, the CRC fails and you get probably an Error box :)
Otherwise it continues the Program ;)
So you need to find that "weak" spot where it Compares or replace the (Original) Checksum with the newly created Checksum ;)
Hope this helps.

Cya...

CoDe_InSiDe
Clandestiny
07-11-2001, 01:36 PM
Hiya,

I replied to a question along these very same lines a few weeks ago. Check out the following post for a few clues on how to locate the CRC.

http://usa3.hostrack.net/woodmann/Ultraboard/Public/HTML/B8/1777-1.topic.html

Regards,
Clandestiny
Brill0
07-12-2001, 09:43 PM
thanks for the info,
:)


Weird Serial Check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Weird Serial Check
PDA

View Full Version : Weird Serial Check

Joda
07-12-2001, 01:08 AM
Heya.

Well I have a shareware program here that uses a sonewhat easy serial protection sheme, but I can't find the right serial.
That wouldnt be so interesting, but the facts are this:
(i can't post code, cauz I'm at work, hope it's clear nevertheless)

1. Name and Serial are read in with GetWindowText
2. An algo calculatesa serial from the name
3. MySerial and AlgoSerial are compared

If they are the same:

"The serial was right, but it doesnt work with this version of the program"

If they are not equal:

"Sorry wrong serial."

Weird.
Well i traced a bit thru the code after the JNE and found that some memory is tested, if the word saved there is between 1 and 6 it says "Right Serial".
The problem is that long before FF is written over that memory area and it seems that this is done everytime - which can't be true, cauz then it wouldnt be possible at all to enter a valid serial.
I checked it with IDA and wdasm but it i wasn't able to figure out, from where it was called or jumped to.

So I have two questions in one :)

1. Anyone seen this before and has any tips for me?
2. Is there a function in SoftICE to check, from where a specific code location was called? (the bpr <xxx> T cmd doesnt work for me.

thx'n'cya

Joda
Kayaker
07-12-2001, 01:40 AM
Joda (07-11-2001 23:08):

1. Anyone seen this before and has any tips for me?
2. Is there a function in SoftICE to check, from where a specific code location was called? (the bpr <xxx> T cmd doesnt work for me.

Joda

Hi Joda,

1. Nope
2. If I understand correctly, and you want to essentially trace backwards from code section to code section to find out how a particular address was reached, 'bpm address x' should do the trick.

If you set the bpm break at the start of the code section you're interested in (i.e. at the push ebp that starts the call), then when it breaks there will be a FromIP in the command window, which will be where it was called from.

You can then set a regular bpx on this FromIP address or check things out in Wdasm and continue on like that. This will allow you to step backwards as far as you want to go.

G'luck

Kayaker
Bratscher
07-12-2001, 04:28 PM
Heya.

Well I have a shareware program here that uses a sonewhat easy serial protection sheme, but I can't find the right serial.
That wouldnt be so interesting, but the facts are this:
(i can't post code, cauz I'm at work, hope it's clear nevertheless)

1. Name and Serial are read in with GetWindowText
2. An algo calculatesa serial from the name
3. MySerial and AlgoSerial are compared

If they are the same:

"The serial was right, but it doesnt work with this version of the program"

If they are not equal:

"Sorry wrong serial."

Hi Joda:
I think that this program is validating your serial in at least another segment of the code. such function is the one that sets up the value from 1 to 6 in the memory position you identified. That evaluation probably occurs before the piece of code you reversed. By the time you get to the snippet you described, it may have decided "bad boy" already and written FF in the flag you located, because the "correct" serial you entered passes the sencond test, but not the first one.
The serial comparison you saw may be a residual from a previous version of the shareware, or a decoy for bad boys like you (and me). I would follow kayaker's suggestion trying to catch Who writes that number from 1 to 6 in the memory position you isolated, and that may give you a clue to the rest of the protection.

Regards

Bratscher

Weird.
Well i traced a bit thru the code after the JNE and found that some memory is tested, if the word saved there is between 1 and 6 it says "Right Serial".
The problem is that long before FF is written over that memory area and it seems that this is done everytime - which can't be true, cauz then it wouldnt be possible at all to enter a valid serial.
I checked it with IDA and wdasm but it i wasn't able to figure out, from where it was called or jumped to.

So I have two questions in one <http://www.woodmann.net/Ultraboard/Public/Images/Default/E1.gif>

1. Anyone seen this before and has any tips for me?
2. Is there a function in SoftICE to check, from where a specific code location was called? (the bpr <xxx> T cmd doesnt work for me.

thx'n'cya

Joda
Joda
07-13-2001, 06:02 AM
Hi guys.

Yes Bratscher that was, what I thought also. Yesterday i found out that it seems to go through that FF writing routine everytime, i enter a new letter or number of serial number and / or name.
But i pushed the program on my stack - working on another thing now ;-). Resolving that calls is a bit boring and I'm loosing the survey - guess I need another or better form of writing down notes on the asm code of the program.

Thx for the tip Kayaker, works fine for me :-).

Well after work and aspirin-power i guess I'll give that new prog another try, analysing the serial routine, perhaps coding a keygen for it and then get back to that FF prog.

cyAll

Joda


Help with unpacking UPX
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with unpacking UPX
PDA

View Full Version : Help with unpacking UPX

Scally
07-12-2001, 12:02 PM
Hi folks, I’ve never had much luck with unpacking in the past & following some of the threads on these groups, I’ve tried to unpack various progs(usu notepad) and follow through several tuts. One of these threads suggested that UPX was an easy one to learn from & so I was pleased to come across a file (GENViewer Legacy Edition - (1.9MB) -
http://www.legacyfamilytree.com/_downld/Addons/GenViewerLegacyEdition.exe) packed with UPX 1.07 – according to fileinfo.
I’ve tried using sice/procdump as per various tut’s but I suspect that there’s a problem with the import table as looking in sice (after the dump & changing the ep) the prog crashes when it should be redirected by a call to [Kernel32!Getmodulehandlea]

Can anyone tell me where I’m going wrong? What I did is below:

1. Changed Characteristics of upx0 to 20, so sice could break
2. Opened in symbol loader at pushad
3. Scrolled down to popad, breakpointed
4. F5, so sice broke on popad
5. F10 to step onto the JMP (@ 686D54 JMP 5979AC)
6. F10 to get to the jump
7. Bc to clear bpoints
8. Typed A (enter) JMP EIP (enter) (esc)
9. F5 to exit sice
10. Start procdump, rt click on gvleg.exe
11. Choose full dump & save file as dump.exe
12. Choose kill task
13. Edit pe header – image base=10000, so new eip= 5979ac-10000 = 5879ac
Result prog crashes before it opens in sym loader.
Changing the image base to 400000 enabled me to start the prog but where it should be calling Kernel, it goes to other code
Any constructive help welcom
TIA
Scally
cluesurf
07-12-2001, 12:22 PM
Scally (07-12-2001 10:02):
Hi folks, I’ve never had much luck with unpacking in the past & following some of the threads on these groups, I’ve tried to unpack various progs(usu notepad) and follow through several tuts. One of these threads suggested that UPX was an easy one to learn from & so I was pleased to come across a file (GENViewer Legacy Edition - (1.9MB) -
http://www.legacyfamilytree.com/_downld/Addons/GenViewerLegacyEdition.exe) packed with UPX 1.07 – according to fileinfo.
I’ve tried using sice/procdump as per various tut’s but I suspect that there’s a problem with the import table as looking in sice (after the dump & changing the ep) the prog crashes when it should be redirected by a call to [Kernel32!Getmodulehandlea]

Can anyone tell me where I’m going wrong? What I did is below:

1. Changed Characteristics of upx0 to 20, so sice could break
2. Opened in symbol loader at pushad
3. Scrolled down to popad, breakpointed
4. F5, so sice broke on popad
5. F10 to step onto the JMP (@ 686D54 JMP 5979AC)
6. F10 to get to the jump
7. Bc to clear bpoints
8. Typed A (enter) JMP EIP (enter) (esc)
9. F5 to exit sice
10. Start procdump, rt click on gvleg.exe
11. Choose full dump & save file as dump.exe
12. Choose kill task
13. Edit pe header – image base=10000, so new eip= 5979ac-10000 = 5879ac
Result prog crashes before it opens in sym loader.
Changing the image base to 400000 enabled me to start the prog but where it should be calling Kernel, it goes to other code
Any constructive help welcom
TIA
Scally

Hi Scally, dump it with Pe editor from Yoda
imagebase should be 400000 in most pe files
oep=5979ac-400000=1979ac
just my 2 cents :)
cluesurf
qferret
07-12-2001, 09:51 PM
Well, I tried downloading it to take a peek, but the entire site seems to be down :-(

Anyway....it looks like you pretty much have the method for UPX down.....only thing I can think of from your post is ...are you sure it's the right popad? (There are a few in the unpacking routine)

The loader usually gets loaded at a fairly high mem address & writes the proggy to the preferred image base. (usually 400000). So if your tracing through code @ say 550000+ (solely an example), and come across a popad closely followed by a JMP to say 410EB0.....that's probably the one you want.

Dunno if that's the prob, but since I couldn't d/l it, that's the best I could come up with ;-)

Hope it helps

?ferret
qferret
07-12-2001, 09:55 PM
as far as it crashing.....UPX doesn't mangle imports, so it's gotta be the dump....sounds like you're dumping before Kernel32 imports are resolved
Scally
07-13-2001, 05:40 PM
Yeah,
Cluesurf: Tnx, I tried shifting the ep to 400000 - thats how I got it to run at all in
sice but the first dll call it made wasto a mem address that had 00 in it & it should have been to the sig of a kernel32 mod.

qferret: Tnx, I'll try stepping from after the point I saw the popad. What you said does make sense but the packed version is openable with wdasm & there's no popad with an unconditional jump after (higher than) the one at 296d54 (686d54 in sice) to jmp 1a79ac. I know it may jump back & I'll check this out. Btw, I couldn't d/l from the url anymore myself. Looks like you gotta go thru the page at:
h*tp://www.legacyfamilytree.com/GENViewerDownload.asp
Even that didn't work every time but the main site url seems to:
http://www.legacyfamilytree.com then downloads, then genviewer.
I agree it sounds like mis op on my part. Is there a definitive way of finding a packed progs ep?
Scally
Kayaker
07-14-2001, 01:44 AM
Hi Scally,

Interesting app. I was able to d/l it from the 1st link you gave, the site itself is in ether but the exe d/l OK directly.

The 10,000 ImageBase may be a little trick thrown in to fool auto-dumpers like Procdump and bad-boy crackers. Whether it was intentional or not I'm not sure, or just that it had something to do with UPX being run on NT. If you look at the packed file in PEditor (in the Directory Table Viewer) you see there is an entry for BaseRelocations. Interesting. If you unpack it with the UPX -d switch you see that while there is a .reloc section, the BaseRelocations entry is empty. Plus, except for the ImageBase of 10000, all the sections indicate a base address of 400000. More interesting.

If you change the ImageBase to 400000 in the -d unpacked file it crashes because the pointers to the Import table are screwed up as you mentioned. They are off by 400000 - 10000 = 3F000. So I guess the original program was designed to load at 400000, after being packed it's set to load at 10000, but it can't so UPX uses the base relocations to fix up a few addresses.

I've been doing some reading on base relocations, since it's not something we're normally concerned about, and there's some good explanations of it in "Peering Inside the PE: A Tour of the Win32 Portable Executable File Format" by Matt Pietrek as well as the Luevelsmeyer doc, if you're interested in exploring it further. To quote:

"When the linker creates an executable, it assumes that the file will be memory-mapped to a specific location in memory. That address is stored in this field, assuming a load address allows linker optimizations to take place. If the file really is memory-mapped to that address by the loader, the code doesn't need any patching before it can be run. In executables produced for Windows NT, the default image base is 0x10000. For DLLs, the default is 0x400000. In Chicago, the address 0x10000 can't be used to load 32-bit EXEs because it lies within a linear address region shared by all processes. Because of this, Microsoft has changed the default base address for Win32 executables to 0x400000. Older programs that were linked assuming a base address of 0x10000 will take longer to load under Chicago because the loader needs to apply the base relocations.

When the linker creates an EXE file, it makes an assumption about where the file will be mapped into memory. Based on this, the linker puts the real addresses of code and data items into the executable file. If for whatever reason the executable ends up being loaded somewhere else in the virtual address space, the addresses the linker plugged into the image are wrong. The information stored in the .reloc section allows the PE loader to fix these addresses in the loaded image so that they're correct again. On the other hand, if the loader was able to load the file at the base address assumed by the linker, the .reloc section data isn't needed and is ignored. The entries in the .reloc section are called base relocations since their use depends on the base address of the loaded image."

In any case, it would be interesting if someone with NT could pack a file with UPX and see if the base address changes, or whether this was done by hand. There are only 4 addresses fixed up in the BaseRelocations section in the packed file (starts at raw offset B1D5C). Or maybe someone has an explanation for this.

In any case, it's easy to manually dump it if you use 400000 as the base address at dumping time. UPX is simple to trace because you can set a bpx on the diagnostic LOOP statement which you can find a few screens down in Softice. Just double click on it to set the bp and press F5. From there it's a short trace to the POPAD just before the jmp to OEP. Here you can dump it as a raw /dump or a /pedump with Icedump, or setting the 'jmp eip' and doing a full dump with Procdump or PEditor might work as well.

The trick is getting the ImageBase right. Since little can hide from Softice, use "map32" to get a true memory map of the file that Procdump or PEditor doesn't give you:

:map32 gvleg
Owner Obj Name Obj# Address Size Type
GVLEG UPX0 0001 016F:00401000 001D8000 UDATA RW
GVLEG UPX1 0002 016F:005D9000 000AE000 IDATA RW
GVLEG .rsrc 0003 016F:00687000 00004000 IDATA RW

Since this is obviously a regular PE file with ImageBase 400000, you just need to use this when specifying the dump parameters. I had no problems getting a working dump with

/pedump 400000 1979ac filename

Ciao,
Kayaker
Scally
07-14-2001, 06:47 AM
Hi Kayaker,
You done it again! I think the programmer was being cute. Having got it dumped, it looks like the Delphi resources have been compressed. There's a reference to 'Victor Kasend* reSource Compres*ion' that I found with exescope but can't get onto the site that Dogpile finds (ht*p://torry.spang.org/listk.htm). Dede processes the file but shows no info.
Scally
Scally
07-16-2001, 12:12 PM
Well, I spent almost all day tryin to follow this one - with no luck - As none of the delphi decomp's seem to work except exe2dpr trial version, I'm kinda stuck.
I've stepped thru it from getwindowtexta at the reg box, from the beginning to try to find the days left in a register (or address in a register) in hex & dec & still can't see it. I tried going back from the invalid code message with wm_lbuttonup but just got lost in the code.
Would really appreciate the guidance of someone familiar with delphi.
Scally


Help finding +Orc Packs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help finding +Orc Packs
PDA

View Full Version : Help finding +Orc Packs

Seri_
07-12-2001, 01:32 PM
I tried looking on all searchengines and scrolls and could only find dead links. Anyone know where I can find these orcpacks?
Kl[e]
07-12-2001, 07:05 PM
Hi!

Try at http://www.tres2000.cjb.net (essaybase)
I found mine here...

Kl[e]
Seri_
07-12-2001, 08:04 PM
Thanks, but those are just the tuts... I was looking for the orc packs - ex location here: ftp://ftp.sol.no/public/users/r/reopsahl/

If anyone knows how to get into that server also...
aimless
07-13-2001, 12:37 AM
Go to google.

type in "ORCPAKS" minus the quotes. Search. else...

type in "orcpacks" minus the quotes. Search. else...

http://www.idca.com/~thesandman/Orcpacks.html

Enjoy!!
noname
07-13-2001, 05:56 AM
aimless (07-12-2001 22:37):
Go to google.

type in "ORCPAKS" minus the quotes. Search. else...

type in "orcpacks" minus the quotes. Search. else...

http://www.idca.com/~thesandman/Orcpacks.html

Enjoy!!

Hi aimless,
You can't get the paks there its already no
more in the ftp.
search for google rce cd sandman
you will find it :D
btw someone posted that :(
latigo
07-13-2001, 08:52 AM
try here:
http://www.hackpalace.com/cracking/tutorials/
Bye

Latigo
NoName020202
07-24-2001, 08:48 PM
Go to +Sandmans homepage and there you will find alot of PACKS including The +ORC packs.....they are outdated :)
Bengaly
08-12-2001, 03:14 AM
hehe..
In +sANDMANS's page indeed u will find the +ORC pack, but the pack has lack of tuts though.
why not enter +HCU's +ORC database??
http://tsehp.cjb.net/

Have fun ;D


PDF Restriction
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PDF Restriction
PDA

View Full Version : PDF Restriction

ADC
07-12-2001, 09:41 PM
How do I print an unprintable pdf? What tool should I use?
Clandestiny
07-12-2001, 11:01 PM
ADC (07-12-2001 19:41):
How do I print an unprintable pdf? What tool should I use?

Well, I remembered reading an essay Kayaker wrote on the matter a while back and a quick search at google revealed the location to be:

http://www.searchlores.org/pdffing.htm

Hopefully, it will provide some insight into the matter :-)

Regards,
Clandestiny


how to add msvbvs6.0 to winice.dat? anyone can help? thanx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to add msvbvs6.0 to winice.dat? anyone can help? thanx
PDA

View Full Version : how to add msvbvs6.0 to winice.dat? anyone can help? thanx

GDR
07-13-2001, 12:29 PM
how to add msvbvs6.0 to winice.dat? anyone can help? thanx!
latigo
07-13-2001, 02:35 PM
Hey..just add the path to the VB runtime dll to the list of exported symbols.

ie:

EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\advapi32.dll
EXP=c:\path\to\huge\vb\dll.dll

Bye

Latigo
The Diver
07-15-2001, 07:33 AM
GDR (07-13-2001 10:29):
how to add msvbvs6.0 to winice.dat? anyone can help? thanx!

Read my mail about the new VB Cracking Site. It answers your questiona nd a lot more besides.
splaj
07-15-2001, 08:31 AM
...and of course because you only need to crack yer VBshit in one session you can always load the dll with SI Loader...

FILE menu / Load Exports ;)

....you don't need to waste time re-booting (again !)

SplAj


finding the msg loop
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > finding the msg loop
PDA

View Full Version : finding the msg loop

4oh4
07-13-2001, 04:20 PM
I could use some generic help finding the message loop on a msvc/mfc app. I've tried bmsg [hwnd] wm_command, but sice breaks on "mov edx, 00000111". Tracing downwards, the "jz xxxxxxxx" is never taken for some reason. How can I break on wm_command and f10'ing through sice will take me to the wm_initdialog section?

I've even gone through a deadlisting, searching for ever occurance of "00000111". I've breaked on every "cmp" and every "mov reg, 111" followed by a "cmp".

This is starting to get annoying.

Any ideas?
4oh4
07-14-2001, 01:57 PM
First off, the last sentence in the previous post should read "I've tried to break on every...." I found one location which breaks every time I click on one menu only. I'm guessing that that specific menu is subclassed, which seems strange. But I did manage to break on another code location every time I accessed a menu (except for the one I added in for some reason).

I'm stuck with how do I compare wParam with the resource id of the menu item that I added? When I break in softice on 'bmsg [hwnd] wm_command', when I click on one of my added menu items, sice shows what the wparam is but when I check all the registers.....none of them contain the wparam (my menu item's resource id). This is really annoying.

Does anyone have any suggestions at all?

I was thinking that if I could find a basic generic vc++ w/ mfc app (and source), it could help me learn to debug vc++ apps. Maybe throw in a int3 right after the '.if wParam == wm_command' (or however that would look in vc++).
4oh4
07-14-2001, 03:19 PM
nm

I found a couple of interesting looking essays on this type of thing. Hopefully, they'll answer my questions.
Kayaker
07-14-2001, 05:11 PM
Hi 4oh4,

It sounds like you're not breaking early enough in the proc that handles messages. Rather than searching for a likely bp in the disassembly, why not trace there directly from the bmsg <hwnd> wm_command break so you don't miss anything.

There's a couple of ways you can do this quickly. I'll just paste a quick example from choosing File/Open from notepad. Say you have this:

Break due to BMSG 0904 WM_COMMAND (ET=2.51 seconds)
hWnd=0904 wParam=000A lParam=00000000 msg=0111 WM_COMMAND

In most cases you'll break in KernelAlloc at

141F:0AE0 6668741C4000 PUSH 00401C74
141F:0AE6 666800000300 PUSH 00030000
KERNEL.Alloc

Notice the first push statement. This is the address of the start of WndProc, or wherever the message loop is. You can set a bp directly on this with:

:bpx 167:401c74

(167 is my cs: register in regular program code, change it to whatever yours is)

Press F5 and you should be there and can start tracing, watching for msg=111 and wParam. Remember that the ControlID wParam is in hex, but some resource editors like Exescope will show them in decimal. WDasm shows them properly in hex.

The other option is as soon as you break on bmsg <hwnd> wm_command is set a:

:bpx k32thk1632prolog

F11 and you'll be here

0167:BFF943FD E8E3D3FDFF CALL KERNEL32!K32Thk1632Prolog
0167:BFF94402 E8F6F1FDFF CALL BFF735FD
0167:BFF94407 E8FED3FDFF CALL KERNEL32!K32Thk1632Epilog

This is the Windows routine for setting up the stack frame. Step *into* the middle call CALL BFF735FD and you'll be here

0167:BFF735FD 55 PUSH EBP
0167:BFF735FE 8BEC MOV EBP,ESP
.
.
0167:BFF7361F 65D16E04 SHR DWORD PTR GS:[ESI+04],1
0167:BFF73623 7222 JB BFF73647
0167:BFF73625 65FF32 PUSH DWORD PTR GS:[EDX]
0167:BFF73628 8D5204 LEA EDX,[EDX+04]
0167:BFF7362B E2F2 LOOP BFF7361F
0167:BFF7362D 8BFC MOV EDI,ESP
0167:BFF7362F 33C0 XOR EAX,EAX
0167:BFF73631 65394608 CMP GS:[ESI+08],EAX
0167:BFF73635 7404 JZ BFF7363B
0167:BFF73637 65FF5608 CALL GS:[ESI+08] ; 401C74
0167:BFF7363B 8BE7 MOV ESP,EDI

Step *into* the last call CALL GS:[ESI+08] and it will again be the start of the messaging loop in program code at address 401C74. You'll see the wm_command params being processed in the LOOP.

If you display the stack as soon as you get into program code with 'dd esp' at

0167:00401C74 55 PUSH EBP
0167:00401C75 8BEC MOV EBP,ESP

you'll see the return address from the call, hWnd, uMsg, wParam and lParam

016F:0063FC70 BFF7363B 00000904 00000111 0000000A
016F:0063FC80 00000000

Your ControlID may be being referenced to the frame pointer EBP, so this is why you don't see it in a disassembly. For notepad the local variables are referenced at

[EBP+4] = Return address of Call = BFF7363B
[EBP+8] = hWnd = 904
[EBP+C] = Msg = 111
[EBP+10] = wParam = 0A
[EBP+14] = lParam = 0

Hope this helps

Kayaker
4oh4
07-22-2001, 08:52 PM
Thanks again kayaker. :)

After you sent that I stumbled upon your essay that covered this same topic (rce cd maybe?). It just goes to show that 'zen cracking' thing about the more you try to find something your search fails. Then when your mind is blank and you're just looking around you find exactly what you've been looking for.

Anyways, this is where I am right now. Softice isn't loaded (mostly because of a huge hangover), but I've been thinking about this project. I've added a jump to my cave in the wm_command part of the msgloop, where I've added a messagebox. This messagebox gets triggered correctly. Then I added a "cmp d,[ebp+10],menuid" in hiew which gets translated to "cmp [ebp][10], menuid" (I can't remember the menuid at the moment). That didn't work at all. It's obviously not the correct hiew asm syntax. I basically left off with that and didn't try anything else, and am too bothered with this hangover to work on this tonight. Please forgive my laziness, but what is the correct 'hiew syntax' for typing that cmp instruction?
Kayaker
07-23-2001, 11:33 AM
Hi 4oh4,

I think you've got the syntax right, in hiew you'd enter

cmp dword ptr [ebp+10], BB9

where BB9 is the Control ID (3001 in decimal), as:

cmp d,[ebp+10],0BB9

Notice the 0 required before *any* value or address in hiew that doesn't begin with a number. i.e. the address A00000 needs to be entered as 0A00000.

Hiew is great, but not intuitive in its usage. Dunno if this was the cause of your problem, or just your hangover ;)

Kayaker
4oh4
07-23-2001, 01:54 PM
Actually, I just looked at it again this morning. I didn't have much time, but the hiew syntax was correct as you said. Believe it or not I had followed the cmp instruction with a jmp instead of a jne/jnz. I quickly changed that jmp into a conditional jmp and my little test messagebox didn't get triggered. I'm not sure exactly why yet, but I'll tackle it again after work. Hopefully it's just a silly mistake on my part that I'll be able to easily spot.

Thanks for the advice Kayaker.


Excel Passwords
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Excel Passwords
PDA

View Full Version : Excel Passwords

Mick
07-13-2001, 09:30 PM
Has any-one out there read anything about serial fishing for passwords in Excel? Any info would be appreciated.


Softice......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice......
PDA

View Full Version : Softice......

KR
07-14-2001, 03:08 AM
I've seen this program mention everywhere all over this website but I couldn't actually find it anywhere... what's going on here
can somebody tell me where I can get it

if u could email me that'd be really great

kr7@hotmail.com
Solomon
07-14-2001, 05:03 AM
softice.tsx.org
exetools.com
.....

SoftiCE is also included in DriverStudio.
noname
07-14-2001, 07:37 AM
Solomon (07-14-2001 03:03):
softice.tsx.org
exetools.com
.....

SoftiCE is also included in DriverStudio.

A kind reminder Solomon don't post toolz
on this board this is not a warez board
regards
noname


New Site VB 6.0 Cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New Site VB 6.0 Cracking
PDA

View Full Version : New Site VB 6.0 Cracking

The Diver
07-15-2001, 07:27 AM
Hi, I am producing a new site - still under construction - on Visual Basic 6.0 cracking. So far there is an overview of the Winice.dat file for VB, information on cracking string compares, long compares, enabling and disabling controls etc.
There is also a downloadable crackme which is pretty hard to do unless you think about what you are doing. You will also find the complete VB 6.0 API and OLEAUT32 API is downloadable form with a description about how to create breakpoints with SoftIce.

I would appreciate any feedback and contributions in the form of technical papers or links. I shall continue to develop the site ONLY if it gets enough visits.

If you have any clues or need any hints about the crackme you should send them to this message board. If you get the password then send it to me directly and don't spoil the fun for others. If you manage the crack I'll invite you to write a tutorial and send you the Visual Basic source code as well.

Enjoy the site.
hz
07-15-2001, 07:42 AM
hiya The Diver,
sounds interesting, shall certainly visit if/when you decide to let us know where it is ^_^

regards
hz
The Diver
07-15-2001, 07:44 AM
The address is WWW.infonegocio.com/VBCrack. The page requires java.
Mitch
07-15-2001, 02:37 PM
I'd take out that moving link javascript ... and add section on SmartCheck :)
The Diver
07-15-2001, 02:51 PM
Mitch (07-15-2001 12:37):
I'd take out that moving link javascript ... and add section on SmartCheck :)

I may remove the moving Javascrip link even though it is quite pretty in order to make the site easier to access. SmartCheck is a pretty good tool for initial analysis and cracking weak programs but it is not as flexible as softIce. You will notice that cracking the CrackMe should first be tried using SmartCheck. Nonetheless, the program uses Windows API's and smartCheck is not the best tool for these.

Thankl you for your comments.
The Diver
07-16-2001, 03:45 AM
Has anyone tried the Crackme from the site? If you have your feedback may well be apreciated by others. Letting people know what you have tried and what has not worked is a great way to learn and for me to improve on the basic algorithm.

Let's get some feedback here. This is a forum not just a book.
The Diver
07-17-2001, 08:22 AM
I have just added a new section to the site with some advice on making your Visual Basic applications more difficult to crack.

Most of the techniques discussed are actually used in the downloadable CrackMe so I'd recommend downloading it and having a go at cracking it.

Remember that if anyone manages the crackme I'll publish the commented Visual Basic Source Code.

If you get stuck you should ask for help by posting a message after this message.
Eternal Bliss
07-18-2001, 05:46 AM
Nice stuff. More than what I originally write in some places. 8)
If you get your info from elsewhere, don't you think a credit to the author is required?

Regards
EB
The Diver
07-18-2001, 07:14 AM
I got everything myself the hard way. Write a very small VB app and then breakpoint on everything in sight. The lists of breakpoints came from using W32Dasm to decompile - the rest common sense. I would appreciate help from others however where credit will of couse be given.

There is a general void in literature for cracking Visual Basic which I hope my site will help to remediate. the original idea for the site was to get others interested and form a reference point for everyone. It is great to say give credit to others but for me to say this others have to do something first.

I will nonetheless give credit to vReal whom was the only person to crack my last CrackMe and with our conversations has allowed me to improve the basic algorithm - which was in its day posted in Visual Basic code on this board.

You will note that if you use a program to search the net and check for copied material it will bring up negative results.

I hope you have tried the CrackMe. It will test your knowledge properly.
The Diver
07-19-2001, 08:45 AM
I have added another new section today called Rolling Your Own. It describes in detail how to go about researching Visual Basic Calls and as an example gives detailed instructions on the information which lead to the section on Long Compares.

The section tells you which tools to use and with which patches and then what you should do.

The idea of the section is to get others to continue researching and produce some papers or articles for publishing on the site. So far absolutely no one has sent any material. I find it hard to believe that nobody else has the slightest clue about cracking Visual Basic.

If you find the site useful and would like it to grow I expect to get some help from others. If I do not get any help then I won't bother publishing at all and will use my notes for my own personal use only.
Eternal Bliss
07-20-2001, 05:01 AM
The Diver (07-18-2001 05:14):
I got everything myself the hard way. Write a very small VB app and then breakpoint on everything in sight. The lists of breakpoints came from using W32Dasm to decompile - the rest common sense. I would appreciate help from others however where credit will of couse be given.

There is a general void in literature for cracking Visual Basic which I hope my site will help to remediate. the original idea for the site was to get others interested and form a reference point for everyone. It is great to say give credit to others but for me to say this others have to do something first.

I will nonetheless give credit to vReal whom was the only person to crack my last CrackMe and with our conversations has allowed me to improve the basic algorithm - which was in its day posted in Visual Basic code on this board.

You will note that if you use a program to search the net and check for copied material it will bring up negative results.

I hope you have tried the CrackMe. It will test your knowledge properly.

Interesting... 8)
My essay dated 23rd Jan 1999, has a lot of similarities with your VB API overview... especially the
1) Data type conversions
2) Moving Data
3) Mathematical
4) Miscellaneous

Even to the point that I didn't capitalised the various APIs (You have the same thing too)... hmmm... Of course there are a few more that you most probably leeched from somewhere else...

For your interest, you might already have the URL, the essay I am refering to this
http://www.mesa-sys.com/~eternal/eb/eb_vbpart1.zip

Hmm... maybe you have gotten the stuff from Crackers notes by tornado who added them with my permission...
Hoof
07-20-2001, 05:46 AM
OUCH..... Checked it out and what a bitch-slap that was. EB I agree with you.
The Diver
07-20-2001, 06:00 AM
I will be checking your reference today. If you have come to the same conclusions then I will give you credit for it for doing it first. I can assure you that so far I have not seen your essay but I hope that it will provide some more valuable information.

Rather than criticising wouldn't it be better to get together and jointly write the site? It seems pretty obvious that we are going to reach the same conclusions on many things. Particualrly the main useful API's which have been common knowlegde for quite some time.

I look forward to hearing from you soon.
The Diver
07-20-2001, 07:53 AM
I have checked the Eternal Bliss link. I see what you mean. The original table was given to me in a slightly less complete form in an e-mail a couple of years ago. Now I know where it actually comes from I have ammended the Overview and added a credit to Eternal Bliss.

I am truly sorry for having a copied table on my site on the API overview page and I unreservedly ask for EB's forgiveness for not having given him credit. The original site of Eternal Bliss has even more types of comparison explained and is well worth a visit.

I have also added "rtcTrimBstr" to the original Eternal Bliss table as this is called before most conversion routines.

I would also like to take the opportunity to ask EB if he would like to get together and produce a combined site.

The Diver


Can a program modify itself of disk????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Can a program modify itself of disk????
PDA

View Full Version : Can a program modify itself of disk????

bob
07-15-2001, 04:25 PM
Hello,
I have been told that a program may write into itself on disk ... while I always thought that while running a program may not be modified. Can anyone shed some light on this?
Thanks.

bob
Clandestiny
07-15-2001, 10:16 PM
bob (07-15-2001 14:25):
Hello,
I have been told that a program may write into itself on disk ... while I always thought that while running a program may not be modified. Can anyone shed some light on this?
Thanks.
bob

Hiya Bob,

I believe you're referring to Self Modifying Code (SMC). With SMC, its quite possilble to modify a program's code in memory during runtime. Packers and encrypters typically use this technique (as do polymorphic viruses).

And while it sounds really difficult and scary, coding *simple* SMC is not that difficult if you have a little asm knowledge. Here's a small example:

mov edi, offset smc ;address to begin loading smc I's
mov [edi], byte ptr 90h ;move the opcode for the nop instruction into location

smc:
inc edx
xor ebx,ebx
.
.
.

Well, thats a *very* simplistic example, but it shows the idea. The above snippet just replaces the inc edx (a 1 byte instruction) with a nop (another 1 byte instruction). And as you can see, this occurs "on the fly" while the program is executing. If you're in a debugger you'd see the inc edx change to a nop right before your eyes. If not, you'd never know the prog just modified itself.

For a more elegant example of this technique, I'd suggest tracing through some unpacking code in SICE. I know tElock has a bunch. Now some of that SMC is amazing, but I don't think it can be generated by hand... Trust me, I've *tried* (and failed ;) ). I never managed to get past a small handful of SMC instructions before confusing myself utterly.

We had a thread on writing basic SMC a while back in the mini project forum. For a little more information, I'd suggest you have a look at the thread entitled "Harlequin's Task 3 Challenge" posted by Kayaker.

Hope this gives a little insight :-).

Cheers,
Clandestiny
nofun
07-15-2001, 10:19 PM
A running program can not write to itself, but you can have another executable stub that would write to the application while it is not running.

It wouldn't be SMC, but you can use a loader (process patcher).
bob
07-16-2001, 02:53 PM
Hello friends,
my question was on programs able to modify themselves ON DISK clandestiny. nofun are you talking of programs on disk or in memory? By the way, I'd appreciate if someone could tell me what is a loader? It's a lot of time that one in a while this term pops up in things I read but I have never understood what loaders are and do.

Regards,
Bob
Clandestiny
07-16-2001, 08:21 PM
Oops, I guess I misunderstood the question. I though you were referring to progs modifying themselves *off* disk (in memory).

Clandestiny
qferret
07-17-2001, 10:02 PM
technically...they *shouldn't* be able to. adding a registry entry from the program, to change the program at reboot would seem to work. (I'm sure there are other ways too)

However...I said *shouldn't*....nobody that I know of has really figured out why, but with VC++ programs, if you change code in memory or close the program with BP's still set, they write to disk *shrug*
BobTheRock
07-18-2001, 08:00 AM
Hello,
are there registry entries to have a program modified at reboot? By the way, more than modified I should say subtituted or overwritten.
I thought that there was some INI file for this type of operations .... I believe that also service parks use it .....

Regards,
BobTheRock
45xc
07-18-2001, 09:14 AM
autoexec.bat :p

wininit.ini :D (though i thought was only for deleting files, not renaming / replacing, but you know what thought did)

you can create / delete / rename / read / write to file on disk, from the process created by the file .. not sure how though .. but i had a program that once u ran it, it renamed itself :p

and like the other guy said, some apps (maybe vc related), if you set bpx's or modify the code in them, and the app exits cleanly (no gpf / crash), they can store the modifications onto disk ..

i patched the cd check in tiberian sun in memory, and he patched himself on disk for me, quite handy :-)
BobTheRock
07-18-2001, 01:44 PM
Gee, this is interesting indeed.
Has anyone a clear idea of how this can be done?

Regards,
BobTheRock
nofun
07-18-2001, 08:22 PM
ok don't quote me on this stuff cause i'm still learning (arn't we all?)...

>nofun are you talking of programs on disk or in memory?
I was talking about a program on disk for the application stub. For the loader, thats modifing the memory which is kinda what Clandestiny was talking about.

> I'd appreciate if someone could tell me what is a loader?
You can think of a loader as a stub basically. And it does what it is named. It will load or start another application.

I think TNT made a nice program that allowed you to create a loader and basically bind it with the exe (makes it look like injection kinda).

And r!sc has a great process patcher as well. Their great tools to mess around with (especially for a beginner like myself).
declspec
07-23-2001, 09:22 PM
I may be a genius!!! look my first day on a newbie board and i already got one! HA : )

I believe you could use an old windows trick. (or is it winblows here? I can never keep my boards straight. Anyway call the api and change the directory name under the executable. for example if you loaded out of
C:\foo\foo.exe change that to C:\_foo\foo.exe then windows write protection will fail and now you can write to your hearts content. Finally before your program exits change the directory back to C:\foo.
This also works to get at files other programs are trying to protect.

Ok thats a straight hack in every bad sense of the word but what are your options? That was the big fat way... but i figure you werent into the assembly way so have at it.
BobTheRock
07-24-2001, 05:35 AM
Very nice hack .... if it works. I'll verify it on my win2000.

BobTheRock
Fake51
07-24-2001, 06:08 AM
Altho I'm guessing this wouldn't work on windows 2000, I suspect it might work on win95/98. The idea is inspired from a crackme done a couple of years ago by someone I can't remember the name of.

The idea of the crackme was put together a .lic file that the crackme would load, and then use to modify it's own code in mem. The beauty of the scheme was the way the memory was modified (it was code read-only). The file was read into memory and then copied onto the code in mem, with a hmemcopy or something. Before allowing this, windows checks the desired destination, to see if everything is okay. But these checks could easily be bypassed, allowing you to write to whereever in memory you wanted (as well as I remember), without a glitch.
My guess is, windows checks the file to be written to against processes in memory, and if it finds a match, no write. Bypass the checks, and you're home free.
Or, if bypassing the checks proves to be somewhat difficult, find out what is compared in memory (ie what info of the running processes is compared to the info about the file). Then modify the info in memory about the process, and restore it just before you quit.

Just a thought

Blue skies
Fake


Thanks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Thanks
PDA

View Full Version : Thanks

4oh4
07-15-2001, 05:32 PM
Thanks, that looks great Kayaker. The next time I reboot I'll try both of those techniques. :)
4oh4
07-15-2001, 05:35 PM
I'm an idiot.

I guess I hit "new topic" instead of "reply".

This was meant to be a reply in the "finding the msg loop" thread.


fiendish games key manager update ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > fiendish games key manager update ?
PDA

View Full Version : fiendish games key manager update ?

Alyta
07-15-2001, 09:05 PM
I noticed that Fiendish Entertainment has changed his name to Small Rockets and the key manager too, so I posted the two files, does anyone knows how to reverse one of them.
I would like to have a step-by-step explination on the process, not a patch or a crack, but the algorithm, this way I could reverse it by myself !


Crypt Cotelem latest version
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crypt Cotelem latest version
PDA

View Full Version : Crypt Cotelem latest version

Alyta
07-15-2001, 09:44 PM
Does anyone knows the algorithm involved in this encryption process ?
Can you explain it to me ?


Pixar
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Pixar
PDA

View Full Version : Pixar

Dracster
07-16-2001, 09:21 AM
Does anyone know how too generate a Licence file for pixar Artist Tools 4.5 or is it around somewhere


Intercepting messages in softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Intercepting messages in softice
PDA

View Full Version : Intercepting messages in softice

BobTheRock
07-16-2001, 04:43 PM
Hello,
I was wondering what type of debugging capabilities softice provides for intercepting UI messages. Does one have to for example go to a window procedure and place conditional brakepoints there looking for the wanted messages or does it provide easier methods of trapping such messages? Thanks.

Regards,
BobTheRock
4oh4
07-17-2001, 07:23 AM
Kayaker gave a good answer to this in another thread here (http://usa3.hostrack.net/woodmann/Ultraboard/Public/HTML/B8/2115-1.topic.html).
4oh4
07-17-2001, 07:23 AM
Kayaker gave a good answer to this in another thread here (http://usa3.hostrack.net/woodmann/Ultraboard/Public/HTML/B8/2115-1.topic.html).
bob
07-17-2001, 08:02 AM
Hello,
what does bmsg <hwnd> wm_command mean? You simply type it in without having to get to the address of the window procedure???? I'm asking because I'm trying to decide if to adopt softice (I never used it) as my standard debugger understanding what it provides compared to the others.

Regards,
BobTheRock
latigo
07-17-2001, 10:01 AM
The command pretty much speaks for itself :)
bmsg hwnd WM_MESSAGE means that Sice will break whenever the window represented by hwnd processes the WM_MESSAGE.
And do adopt Softice as your 'standard' debugger for its the best :)
Bye

Latigo
BobTheRock
07-17-2001, 01:46 PM
Hello,
what I was curious about is if you can just type in the said command (and softice does the rest, finding the window procedure associated to the specified window) or you have to go to the window procedure to set such a breakpoint.

Regards,
Bob Rock
4oh4
07-17-2001, 06:01 PM
Heya latigo

Bob, type "hwnd stuff" (where stuff is stuff.exe, the application you're debugging) at the sice prompt. Then look through all the handles for the main handle (check the class name). Then use that handle that you've found with "bmsg 0D0 wm_command" (assuming that "0d0" is your handle).
Clandestiny
07-17-2001, 07:30 PM
Or alternately use a spying utility like Windowse to obtain the handle of the window in question.

Regards,
Clandestiny


New C-Dilla?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New C-Dilla?
PDA

View Full Version : New C-Dilla?

Sphinx
07-17-2001, 06:57 AM
i have a target protected by c-dilla but i think it`s a newer version then explained in the tuts i have. I would like to know if there are tuts about the newest version of c-dilla safedisk protection and where can i find them

thx
45xc
07-18-2001, 09:17 AM
whatever, it is 95% the same as the 'old cdilla safedisc' . so why not just give it a try and then post if your having trouble ..

also, try 'revirgin' if you dont want to attempt to rebuild imports by hand

oh, and newest icedump handles all the anti softice ..
Sphinx
07-23-2001, 03:56 PM
yes i gave it a try but i haven`t been able to find that c-dilla code that loads the function of the kernel.dll and user.dll and with out it i can`t rebuild the .rdata

yes i tried a progie to do it automatic but if i start the target it is asking for cd 2 :( so it not a 100%
Sphinx
07-23-2001, 03:57 PM
yes i gave it a try but i haven`t been able to find that c-dilla code that loads the function of the kernel.dll and user.dll and with out it i can`t rebuild the .rdata

yes i tried a progie to do it automatic but if i start the target it is asking for cd 2 :( so it not a 100%
Sphinx / TRES2000
07-23-2001, 07:47 PM
ingat ka!?
GodsJiva
07-24-2001, 03:02 PM
are you using unsafedisc? is that the automagic tool of which u speak?

if it is, and it has unwrapped the exe successfully, you have let r!sc do (more than) half yr battle.

all you need to do now is bypass the internal cd detection. chances are that it will now work with a backup cd, but not w/o a cd.

try looking at some tutes...
Sphinx
07-28-2001, 02:57 PM
sorry ?

ingat ka???
Sphinx
07-28-2001, 03:01 PM
oke thx that's usefull

i wanted to do it my self not with a tool like unsafedisk
but i allready talked to r!sc. he helped me a little futher :)


where to find a PKLite 2.01 Unpacker?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > where to find a PKLite 2.01 Unpacker?
PDA

View Full Version : where to find a PKLite 2.01 Unpacker?

tudou
07-17-2001, 11:33 AM
Hi, guys,

Anybody know where to find a PKLite2.01 unpacker? The -x option of PKLite can not extract a compressed Windows exe.

Thanks.

tudou


Enable / Disable buttons?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Enable / Disable buttons?
PDA

View Full Version : Enable / Disable buttons?

tudou
07-17-2001, 12:08 PM
Hi,

It's me again.
Sometimes a button can be enabled or disabled by the program according to the current conditions. For example, if you click the save file button, the button will be disabled after your file is saved until you modify you file again.

My question is which API controls the enable and disable operations? cause I don't know how to set the break point in SoftIce.

Thanks!
The Diver
07-17-2001, 01:30 PM
This depends on the language that the program was written in. If it is Visual Basic you will find a description of how to do this on the New Visual Basic 6.0 web site anounced a few days ago. You will also find a lot more information.
BobTheRock
07-17-2001, 01:58 PM
Hello tudou,
it can be done in at least to way:
1) EnableWindow
2) sending a WM_ENABLE with SendMessage to the control

Regards,
BobTheRock
neo
07-17-2001, 05:35 PM
If you like enable for buttons and menus for VB read E_bliss tuts on his site very good stuff..if you like delphi or vc++ read on immortal DEscendants web(by lord) .. you will find all that you need ..

NeO'X'QuiCK
BobTheRock
07-18-2001, 08:26 AM
Can anyone post the urls to such site? Thx.

Regards,
BobTheRock
Bengaly
08-11-2001, 04:20 AM
whoo whoo CripleWare ;DD

if it's VC++/WIN32ASM than it sets a flag [01/00]
on the API that controls the "Enable/Disable" function.

01=Enable
00=Disable

Normaly there would be a MOV instruction ;
Mov EAX,0000001 or semilar instruction to control the di/en function...
find that and kick it! ;D
guest (WoZX)
08-29-2001, 03:31 AM
try Yoda Window Manager,
i forgot where's his homepage is.
CoDe_InSiDe
08-29-2001, 03:45 AM
y0da.cjb.net ;)

Cya...

CoDe_InSiDe
pompeii
09-01-2001, 11:14 AM
If this was the c++ code:

GetDlgItem(IDC_BUTTON_EXIT)->EnableWindow(FALSE);

you could set a bpx on enablewindow and find something like this:

0040164F push 0 <-- Modify this
00401651 push 3E8h
00401656 mov ecx, [ebp-4]
00401659 call j_?GetDlgItem@CWnd@@QBEPAV1@H@Z ; CWnd::GetDlgItem(int)
0040165E mov ecx, eax
00401660 call j_?EnableWindow@CWnd@@QAEHH@Z ; CWnd::EnableWindow(int)

All you have to do is change the 0 at 0040164F to a 1. The code above was disassembled in IDA, so it won't look like that in SoftIce.


Delphi without Dede?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Delphi without Dede?
PDA

View Full Version : Delphi without Dede?

Scally
07-17-2001, 07:18 PM
Can anyone recommend tutorial(S) on working with Delphi, where Dede/revendre etc cannot show the detail of the code?
The file in question was discussed in an earlier thread where Kayaker came up with a way of unpacking the UPX host which did not unpack correctly with UPX -d. (use icedeump \pedump 400000 file)
Having done this, with no clues from the usual tools, I just get hopelessly lost in the code. Registers (& the pointed to addresses) don't seem to show anything related to the days left or entered string.
The forms don't seem to have the usual names (e.g. no tmainform) & there are refs in the prog to bits being compressed which is why, I guess, Dede can't show the detail.
h*tp://www.legacyfamilytree.com/GENViewerDownload.asp
I'm pretty sure the process I need is 'butapplyclick' which is at o/s 1660166 (0x00195506) or 02131610 (0x0020869a) in the unpacked version of the file. Is there a way of using this location to find the proc in sice?
Alternatively a good tut would help.
TIA
Scally
Kayaker
07-18-2001, 12:05 AM
Hi Scally,

DeDe is handy, but what it's most useful for is giving an RVA to break on for OnClick events. You see this under Procedures/Events - an RVA dword and a Hint word. All you need to do is figure out where DeDe gets this info from and get it yourself from the file. To do this you need to know how Delphi stores this info.

If you look at the pedump of that Genviewer proggy in Exescope you find under the TdlgEnterLicense form the OnClick event you're looking for:

object butApply: TBitBtn
Caption = 'Apply'
OnClick = butApplyClick

Even better than searching the resources with Exescope, get a copy of D-Peeper h*tp://batry.hypermart.net/D_Peeper.htm
which allows you to click directly on Delphi components (like the 'Apply' button in the reg box) and get their Event names.

If I use D_Peeper on that button I get:
OnClick = dlgEnterLicense.butApplyClick // TdlgEnterLicense

OK, now do a hex search for dlgEnterLicense or butApplyClick and you find:

001954FF 1400 6C61 5900 0D62 7574 4170 706C 7943 ..laY..butApplyC
0019550F 6C69 636B 1054 646C 6745 6E74 6572 4C69 lick.TdlgEnterLi
0019551F 6365 6E73 65 cense

The 7 bytes before the ascii are what's important.
The 1st WORD is the 'Hint' you would see in DeDe (0014)
The next DWORD is the RVA of that event (0059616C)
The next BYTE is the length of the text that follows (0D)

Now just set a bpx 59616C, enter some s/n and press Apply. And whaddya know, it breaks :)

And to think I almost deleted the thing ;)

Kayaker
Kythen
07-18-2001, 11:49 AM
Kayaker, you forgot to mention that D-Peeper is a good exercise in playing with Asprotect ;)

I usually avoid unpacking stuff like the plague (crypto/LMs/dongles my preference), but it was a fun little diversion!

Thanks for finding this new tool and a good way for me to waste half the morning! <g>
Kayaker
07-18-2001, 12:15 PM
Kythen (07-18-2001 09:49):
Kayaker, you forgot to mention that D-Peeper is a good exercise in playing with Asprotect ;)

Oh, didn't I mention that little detail? ;D
Scally
07-18-2001, 07:38 PM
Hi Kayaker,
Thanks, I've learned a lot from this & can now clear a lot of clutter of the HD.
I looked at a couple of tuts before that I found on the net & what was screwing me up was the hint, the tuts said look before the proc which I did - I saw 6159 000D & translated to 0D005961 (Ie nonsense)- when what I needed was to ignore the 000D & go back one. The protection was fairly easy after that, 5961ad/596243 & the initial compare on opening at 5979e9.
Thanks, I'll not be so feared of delphi again.... or maybe....
Scally


Something U may want to try cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Something U may want to try cracking
PDA

View Full Version : Something U may want to try cracking

zitterbe
07-18-2001, 05:34 AM
A-book v2.2.1

DL at http://www.dualitysoft.com/abook/index.html

Requires a kew file called abook.key

It's is real nice "full-featured contact manager with intuitive interface. You can keep all your friends, family and business contacts' information in one organized and clear environment".

I just started on it. Made some progress by just creating a bogus abook.key with some easily tracable characters in the file. Now tracing thru in Sice where they read the file and all that. If anyone tries it let me know if ya make any progress in actually reversing a good key file or just get around the check.
quiller
07-20-2001, 12:46 AM
Hi zitterbe,
I took a quick look at the proggie. It can be patched in one location by moving a 1 into the memory flag that is used. In that case, the proggie is registered and it does not even look at the file abook.key. Not sure yet how it all relates together.

You can make it pretty by typing in the user name and regcode in the registry at:

HKEY_USERS\.Default\Software\PIM+\A-book\Settings\UserName
HKEY_USERS\.Default\Software\PIM+\A-book\Settings\RegCode

The RegCode appears to be in the format:
WIN-xxxxxxxxxxx-xxxxxxxxxxxxxx with x's being letters (small and capital) and numbers.
zitterbe
07-21-2001, 04:53 AM
Thanx. I did a quick look in the Registry but didn't mess with trying to trap reads and writes. Anyway, I found the algorithm that interprets the key file. Been playing with reversing that. I'll go find the Registry test after I fail at reversing the key file :-)

Thanx for helping.

zitterbe


Usefull link for beginners...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Usefull link for beginners...
PDA

View Full Version : Usefull link for beginners...

Incognito
07-18-2001, 12:18 PM
A little site that contains tool-packs. You find the most needed tools in download packages.
I think it's usefull.
h++p://newbieztools.6x.to
DudyStuff
07-28-2001, 01:39 PM
I tried that link and it didn't work did you mispell it? (i replaced ++ with tt so it wasn't that)
Incognito
08-05-2001, 03:11 PM
THe 6x.to Redirector is often down..:(

Try this h++t://newbieztools.8m.com
h++p://www.8ung.at/nbt

This Links are working...:)

Cya
incognito


Full set of lessons for novices????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Full set of lessons for novices????
PDA

View Full Version : Full set of lessons for novices????

BobTheRock
07-18-2001, 01:52 PM
Hello,
I've seen around a huge amount of tuts (a lot of them kind of repetitive and of little use ...) and was wondering if there is any good set of organized lessons specifically written to that take you from a level of "total idiot" to a level of "I still got a lot to learn but have a good idea of what is involved in reversing".
Thx.

Regards,
BobTheRock


Help with unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with unpacking
PDA

View Full Version : Help with unpacking

stealthFIGHTER
07-18-2001, 03:39 PM
Hi,

I have a program to unpack and I need help with it. The data sections are:
CODE
DATA
BSS
.idata
.tls
.rdata
.reloc
.rsrc
.aspack! <<<

I thought it was packed with Aspack but at the end of the file there was a text:
Packed with PE-Pack v1.0 etc.

When I manually unpack it [At JMP EAX was EAX=00441D8C].
I changed the entry point from 1F68F to 41D8C [441D8C-400000 - is this right?].
When I run the program I get some error - but - I can disassembly this program now (I can see all Import tables and SDRs).

I tried to unpack it with ProcDump >>> GPF and no IT and SDRs).

I appreciate any help.

Bye

sF
Clandestiny
07-18-2001, 06:11 PM
What is the name of the target ? I'm not advanced at unpacking myself, but I'll give it a shot if you supply the name and a d/l location.

Regards,
Clandestiny


using SI for serial# need help please!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > using SI for serial# need help please!
PDA

View Full Version : using SI for serial# need help please!

HerbieK28
07-18-2001, 05:23 PM
I'm in a tutorial and using SoftIce to find a serial#. I did download the program for the tut from the web. I think, I do have a newer version, but I do follow the steps I'm told. In the register window I did put as a name: Herbie and Serial#: 666111666. It show up later nicely. The registration gives a error message: Please check the following: 1. This is the 32-bit version. Be sure you are entering a 32-bit serial number. 2. Make sure you entered your registered name EXACTLY as we sent it to you........Now I know it have to be 32 bit serial#. The serials I'm finding won't work. there must be another comparsion going on what I won't see as a newbie. (lol) I need a little help with this one: Here the moves;
Call
Move EAX ,[EBP-14] (On this line I do stop)
LEA EDX, [EBP-04
CALL 0043A268
MOV EAX, [EBP-04]
CALL 00403568
TEST EAX, EAX
JZ 0043CC47
LEA EDX, [EBP-08]
MOV EAX, [EBP-0C
MOV EAX, [EAX+000001B0]
CALL 00414688
MOV EAX, [EBP-0C]
MOV ECX, [EAX=000001D0]
MOV EDX, [EBP-08]
MOV EAX, [EBP-04]
CALL 0043B898
TEST AL, AL
JZ 0043B898
That what i do see in SI. I'm told to highligt the line: MOV EAX, [EBP-04] (4th from bottom) and do a :d EDX go down 2lines to: TEST AL, AL and do a :d EDX There I do see my # and Serials numbers. Did I miss something some where? Thanks for now Herb.
Herbiek28
07-18-2001, 10:48 PM
Gentlemen!
I did solved the problem after super, did more F8th I entered the serial I found and it was accept. :) Thanks to all for reading. No help on this one now :) Herb
CoDe_InSiDe
07-19-2001, 12:13 AM
Hi HerbieK28,

Hehe, good job ;)

Cya...

CoDe_InSiDe
Bengaly
08-11-2001, 03:27 AM
hahaa Indeed Good job.

Hey Code..I found ya ;P


where can we find some papers about SmartCheck? (NULL)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > where can we find some papers about SmartCheck? (NULL)
PDA

View Full Version : where can we find some papers about SmartCheck? (NULL)

tudou
07-18-2001, 11:35 PM
where can we find some papers about SmartCheck? (NULL)


Link For the Snake's Page Please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Link For the Snake's Page Please
PDA

View Full Version : Link For the Snake's Page Please

MaTRiX_2k
07-19-2001, 02:13 AM
Hello All,

Can anyone give me the link to the Snakes Page, please.
It contains some very interesting files, on how to crack Softice

Thanks in advance

Bye
Wizard
07-19-2001, 02:28 AM
http://snakepage.cjb.net/ (!!!)

Wizard
MaTRiX_2k
07-19-2001, 04:01 AM
Hello Friends,

Thanks for the link, Wizard :))

Bye
the snake
08-15-2001, 07:08 AM
Hi, a small correction...
The tutorial is not about how to crack SI,
It's about the way Numega is checking the valid serial number for *all* products, Or better say, how to build a valid serial number based on the product number.
In the "key-gens" section, you can follow the source code for a key-gen regarding this tutorial,
step by step.
Regards
the snake


when should i use ? *eax or ? eax and others
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > when should i use ? *eax or ? eax and others
PDA

View Full Version : when should i use ? *eax or ? eax and others

Newbyte
07-19-2001, 07:49 AM
Hello

cmp edx, eax
in this case should i use ? eax and ? edx or ? *eax and ? *edx or to see whats being compared ?

? and d are the same right ?

cmp eax, [edx]
in this case should i use ? eax and ? edx or ? *eax and ? *edx to see whats being compared ?

cmp eax, dword ptr [edx]
in this case should i use ? eax and ? edx or ? *eax and ? *edx to see whats being compared ?

when i refer using the ? i assume ? == d

im confused with these things :(
tnx all
Fake51
07-20-2001, 08:16 AM
First of all, d != ?. They're not the same. D is used for the data window, ? is for evaluating an expression.

So, for cmp eax.edx you would use ? eax and ? edx
For cmp eax,[edx] you would use ? eax and d edx
And since cmp eax,dword ptr [edx] equals cmp eax,[edx], procedure is the same

Normally, you wouldn't bother using ? eax or ? edx, since it's much easier to have the register window open (issue a wr to open it).

Read Mammon's essay about soft-ice and how to use it, it should be easy to find.

Blue skies
Fake
zitterbe
07-20-2001, 07:46 PM
One more thing. As was mentioned above, with the processor registers window open [WR toggles the window] you can also see what eax and edx contain directly. Maybe they contain actual values like 8010FFFF, etc. Or maybe they contain the addresses where the actual data value exists, e.g. 004CBD76, etc. You'll get the hang of telling the difference pretty quickly. If eax contains a data value you'll see it. If it contains the address of where the data value is stored then you could do a D eax and see the value that is located at the address in eax in the data window [WD toggles the data window].

In general, D address (like 004CBD76) displays the value at that address. If it is another address, D that address will reveal the value at that address. D register (like eax, esp, etc) displays the value at the address in that register assuming the register actually contains a valid address. If that value is yet another address, D *register will show what lies there. This is used a lot in checking what is being pushed onto the stack (passed into the Call) just before some Call is executed. For some useful info on that see:

http://users.supernet.com/dharp/files/Rhayader.txt

BTW - it's usually easier to do a DD the first time. DD will display the memory location in 32 bit (double) format in the data window which is usually more convenient for making sense out of the results. After that just do a D and it will retain the same format. DD - Display in Double format, DW - Display in Word format, DB - Display in Byte format.

Cheers,
zitterbe


help with first reverse engineering attempt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help with first reverse engineering attempt
PDA

View Full Version : help with first reverse engineering attempt

Merkinball
07-19-2001, 04:28 PM
i found this little puzzle game called aargon deluxe but the demo only lets you play a few of the levels, all of the other levels are there they are just blocked. so i decided to try to crack it myself. not having any real experience with programming i just kind of fumbled around a bit. i've dissassembled it and found a few spots were it says that an action is disabled in the demo and found a few jumps and calls that are common. i have tried to change the code to not do what i think is checking if it is the demo but nothing changes or the program just doesn't work. i also just found a reference to a fuction in a dll thats is called version info. i tried changing this but every thing i did made the program not work. i know i probably sound stubid but i have never done anything more than some programming in basic on my calculator. if someone could give me a little direction it would be very helpfull, i don't want to just give up.
Fake51
07-20-2001, 07:59 AM
Go to Tsehp's site, and learn what you can from the essays, then try again. Also check out Sandman's page for good newbie essays. Read, learn, do.

Blue skies
Fake
Merkinball
07-20-2001, 10:32 AM
i have been around and read a bunch of essays. here is a little more about what i have found.
this is the imported fuction that is all over the place when there is something about it being a demo:
1000107B 55 PUSH EBP
1000107C 8BEC MOV EBP,ESP
1000107E A120300010 MOV EAX,[10003020]
10001083 5D POP EBP
10001084 C3 RET

after it returns it tests eax and then jumps to variouse places. here is what i understand about this section.
i don't know what push does, it moves what is in ebp into esp. it moves eax to somthing, somewhere? i don't know. i'm not sure what pop does and then it returns. if someone could give me a better idea about what this means i may be able to figure out if this is the right piece and what to change.
Merkinball
07-20-2001, 04:08 PM
I DID IT!!!!
there was probably a better way than what i did but it still worked. after each of the calls to the VersionInfo fuction there was a test and then either a je or jne, if it was a je i changed it to a jne and visa-versa. and it worked!!
just thought i'd let you know, if any of you cared.
Kythen
07-20-2001, 05:51 PM
Congrats!

Just thought I'd try and clear up a few things for you.
First of all, push XXX pushes the value of/in the XXX part onto the top of the stack. In your case it's the value in the EBP register.
MOV instructions work the other way around from what you said. MOV EBP, ESP copies the value of the ESP register into the EBP register.
MOV EAX,[10003020] copies the value stored in memory address 10003020 into the EAX register. If you wanted to approach your crack from a different perspective, you could have used a disassembler to try and see where that value in 10003020 comes from, then make sure the correct value is always put into that location.
POP EBP removes the top value from the stack and places it into the EBP register
RET just returns to the calling function.

If you want to learn more about how these intstructions and other instructions work, read up on assembly language. There are plenty of good books out there. I personally recommend "The Art of Assembly". You can find links to it around the web with a bit of searching.

Hope this helps!

Kythen


cyclic redundancy code blows
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > cyclic redundancy code blows
PDA

View Full Version : cyclic redundancy code blows

Brill0
07-20-2001, 08:47 PM
okay, i have asked about crc before and found some tuts on it. but i still can not really know what the assembler code for this really looks like. i have been tring to crack a screen saver, but it detects it has been cracked. the ss which is pretty cool, at least i think is called firemagic (http://www.fpsoftlab.com/firemagic.exe) if someone could look at this could give me a little help.
LaptoniC
07-21-2001, 07:26 AM
I dont think that it use classic crc algo.However this programs crc check is easy I guess.Only one reference to error messsage.

:00409647 E8747D0000 call 004113C0 ;Check file integrity
:0040964C 85C0 test eax, eax
:0040964E 7511 jne 00409661 ;good boy
:00409650 50 push eax
:00409651 50 push eax

* Possible StringData Ref from Data Obj ->"Executable file is damaged (or "
->"ckracked)!"
|
:00409652 68E8DA4300 push 0043DAE8

I didnt check reg check.I have just changed one byte and changed above jump.It worked.Be carefull that this crc call is called two times.I guess you can patch your self this one also if needed.
FatHead_Slim
07-25-2001, 09:29 AM
I dont know how much u know about crc ing but pretty much all it does is XOR a sectionbyte by byte or word by word....(etc.) to ensure that it does not change

normally in the following fashion of somesort

/************************************
* This C code snippet Wont show u what an *
* asm code will look like but will let understand *
* the theory behind it... I hope *
***********************************/

int i=0;
char *SectionToBeChecked;
char GoodCheck = WhateverIsValueOfGoodCheck;
char XORValue = 0;

/************************************
* iterate through the section Byte by Byte
* XOR'ing the value of each byte with the
* current XORValue variable and storing it there
* so any one different byte should change the
* final value of the variable
***********************************/
while(i<LengthOfSection)
{
XORValue^=SectionToBeChecked[i++];
}

/* test the variable agianst the good */

if(XORValue == GoodCheck) // passed the CRC
else /* DOH!!!!!!!! But Ma-arge! */

anyway... find a tiny loop that is just XOR-ing a String and you should have found a CRC procedure
then u got all sorts of ways to fix your problem

:) gl hope i helped
LaptoniC
07-26-2001, 03:19 AM
Off course in this call there is a xor and shift operations.I mean classic CRC32 or CRC16 standard. like this for example

CRC32 proc lpbuffer:DWORD, lsize:DWORD
uses ebx, esi, edi
mov esi, lpbuffer
mov ebx, lsize
xor ecx, ecx
lea eax, [ecx-1]
mov edi, 0EDB88320h
@@m1: xor edx, edx
mov dl, [esi]
xor dl, al
@@m2: shr edx, 1
jnc @@m3
xor edx, edi
@@m3: inc ecx
and cl, 7
jnz @@m2
shr eax, 8
xor eax, edx
inc esi
dec ebx
jg @@m1
not eax
RET
CRC32 endp
Brill0
07-26-2001, 09:54 AM
thanks,
i finally know what it is.
brill0


Linux revs.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Linux revs.
PDA

View Full Version : Linux revs.

YC
07-21-2001, 11:45 AM
HI, it seems that most stuff out there is dedicated for Win32 methods and tools. I was wondering if there are any places dedicated for reversing under linux?

Thanks
YC
Kayaker
07-21-2001, 01:07 PM
Hi,

You can try the HCU*nix Messageboard

http://mb.hcunix.org/

Read their FASQ very carefully before posting though so no seals get hurt ;)

Also, Raldnor has some tuts and interest in the subject at his site

http://azrael.mine.nu/underground/

Kayaker


SoftICE and Win ME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftICE and Win ME
PDA

View Full Version : SoftICE and Win ME

zitterbe
07-22-2001, 06:00 AM
My old PC died and this new one came with Windows ME. Is it possible to load SoftICE 3.23 somehow even though ME doesn't process autoexec.bat or config.sys?

zitterbe
Brill0
07-23-2001, 11:27 AM
get softice 4.x ;)


want to crack dongle sentinel superpro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > want to crack dongle sentinel superpro
PDA

View Full Version : want to crack dongle sentinel superpro

steel detail
07-22-2001, 07:41 AM
now i try to carck dongle (sentinel superpro) but i can not do it.please tell me what can i do? or have the program to kill dongle out.
Muad'Dib
07-22-2001, 09:16 PM
There are plenty of tutorials about Sentinel on http://zencrack2.cjb.net - you should be able to find all you need there


discompress.cjb.net
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > discompress.cjb.net
PDA

View Full Version : discompress.cjb.net

disco_Spl/\j
07-22-2001, 08:38 AM
I am on my own for the next 3 weeks and this is my annual
crack fest and tut writing period :-)

If any newbie wants a specific UNPACKING tut on a certain protector/packer he is having trouble with then i'll try and oblige.... if it's of suitable universal educational use ;)

I will update my site tomorrow, cos I got the day off - Egyptian Revolution Day , on HD and bring it up to this years blurb ...........
then Tuesday i'll see what is requested , is there anybody there ? .......... oh and hopefully upload my modernised site !!!!

http://discompress.cjb.net

Salam to all you Revolutionaries ;)

+Spl/\j }>
Victraulic
07-22-2001, 10:29 AM
With my new winME I can't use my old ver. of
RegRepair. Crackers seem to shy away from these Easydesk Util Progs. A tut on any one of their fleet is long overdue.

Thanks Victraulic
att@kk
07-24-2001, 04:46 PM
Any tuts on CodeLok2 (also known as CopyLok2). Kilby's tut on the first version was excellent but since when Panlok have done the honourable thing and updated it.

Unpacking is no problem, but ReVirgin struggles with the IT & IAT. I managed to trace manually about 3/4 of the unresolved imports (for there are many) but I'll be buggered if I can work out the rest.

Any help muchos appreciated.


Anybody know of other reversing forums???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anybody know of other reversing forums???
PDA

View Full Version : Anybody know of other reversing forums???

Jipsy
07-22-2001, 05:30 PM
Hello,
does anybody know of other popular forums on reversing?
thx.

Jipsy
Hoof
07-23-2001, 02:58 AM
Do you walk into a restaurant and ask the chef where else you can get something to eat?
Jipsy
07-23-2001, 03:25 AM
I'm putting up a site and just wanted to put togheter a few links for my visitors. I did not realize that even here people is only supporting the local team.

Jipsy
Hoof Arted
07-24-2001, 02:17 AM
http://www.ollydbg.f2s.com/
Bob
07-24-2001, 02:34 AM
;-)

Bob


Searching SentinelLM sdk 7.1.0 anybody any idea
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Searching SentinelLM sdk 7.1.0 anybody any idea
PDA

View Full Version : Searching SentinelLM sdk 7.1.0 anybody any idea

Sope
07-23-2001, 09:41 AM
Hi,

Just wanted to ask where can i find SentinelLM Sdk 7.1.0
I have a program which is protected by it.
If anybody knows any url it would be a great help.

hopeing for a reply.
sope
Kayaker
07-23-2001, 11:16 AM
Hi Sope,

You've posted this exact same question at least 3 times on this MB in the past 10 days, twice here within 4 days, and once in the TOT forum.

I've also seen your posts on the ID RevengeForum and uhmm, er, my email. Sounds like you're not having any luck ;)

I give you credit for persistence and making use of all your options, but please don't duplicate post on this forum, at least within such a short period of time. You're either going to get your answer or you're not.

In any case, what's wrong with the sdk versions other than 7.1.0 available at CrackZ site?

Kayaker
Sope
07-24-2001, 11:50 PM
Hi Kayaker
Thanks for your pt. I won't duplicate the things next time
... sorry for inconvenience to all.

Regards
sope
Kayaker
07-25-2001, 02:21 AM
Not a problem Sope, just trying to maintain order and keep things reasonably clean ;)

I noticed the links to the sdk's at CrackZ site seem to be working OK. I'm not real familiar with the SentinelLM stuff, is there a big difference between the versions and is a specific version of the sdk needed to work on SentinelLM?

Regards,
Kayaker
Sope
07-25-2001, 05:13 AM
Hi Kayaker

> I noticed the links to the sdk's at CrackZ site

A bit of lame question on my part but i
don't see the link which you are mentioning.
I could get the SentinelLM Programmers Guide
which i am currently reading.

Can i get the exact url of it ?

I searched CrackZ site but i did not find
SentinelLM sdk link anywhere.
Must have overlooked on the site.

Regards
Sope
Kayaker
07-25-2001, 10:25 AM
Reverse the What's New section
Sope
07-26-2001, 07:30 AM
Thanks for the Hint
Regards
Sope
tom324
07-27-2001, 05:17 AM
Hi,

I have found only FlexLM no SentinelLM.
Did I miss something?

Tom
Sope
07-27-2001, 07:14 AM
Hi

Same problem here. Did not see any link yet. Almost searched
the whole site. Hint also doesn't seems to give enough clue.
I guess its not there.

I also search www.rainbow.com full site not available :(
Also read the FAQ & the last question says you need to
contact rainbow for sdk. I guess they know
about CyberHeg Tuts...

Regards
Sope!
Kayaker
07-27-2001, 10:06 AM
Oh Crap

FlexLM != SentinelLM

Shows you how much I know about that stuff ;)

I guess I wasn't paying enough attention to what I was seeing, I thought the FlexLM sdk's were what you needed. Back to square one. Sorry about misleading you guys.

Kayaker
CrackZ
07-27-2001, 01:23 PM
Hiya,

Since I've conversed with everyone on this thread at some point and even related to SentinelLM I'll post here instead of digging out e-mail addresses (no doubt long lost).

I had intended to upload the SentinelLM SDK to my site a week or so back (curse me guys if it was longer than that). A combination of passwords changing and crap u/l speeds has convinced me I just can't suffer the u/l and I'm not sure +Tsehp will appreciate 80Mb d/l's at a time, I looked at 'ripping' the SDK somewhat but even a basic rip of the programs and so on comes in at a hefty 25Mb's+.

Any suggestions/solutions appreciated, until then I guess its going to have to be sourced elsewhere, unless +Tsehp takes the server hits and I suffer the agony of watching my modem choke for an evening or 2 ;-).

Regards

CrackZ.
Bratscher
07-28-2001, 02:53 PM
Hi CrackZ, and others in the thread.

I am one of the people that pestered you (and Cyberheg, and NolanBlender)about the mysterious Sentinel LM SDK. t'was 6 months ago or so, so I am learning to survive without it ;).

I am for sure not an Authority in klebbing the web, but I have tried to find th SDK package quite unsuccessfully.

CyberHeg told me that it is just not available, because it is not a free sample.

If CrackZ could hint us on how he got his copy, would be helpful.
I see few alternatives to a long u/l and d/ls, what would be somewhat abusive to CrackZ and his host. What about a Snail-mail chain of burned CDs and/or Zip disks?


Batronix Assembler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Batronix Assembler
PDA

View Full Version : Batronix Assembler

Bios
07-23-2001, 11:49 AM
Also ich hab da dieses Programm (Prog - Studio V5.03 von Batronix --> Download: http://www.batronix.com/exe/prog-studio-pack.exe). Da es sich dabei allerdings um ein VB - Programm handelt, hab ich nicht viel Ahnung, wie man die Seriennummer fischen kann.
Wie fange ich da am besten an? Mit welchem Programm (SoftICE? SmartCheck?)?
Sollte mal jemand Zeit haben, wäre ich sehr dankbar, wenn er sich das Programm mal ansehen und vielleicht den einen oder anderen Tip hier posten könnte.

Schon mal Danke
Bios
Bios
07-23-2001, 11:59 AM
Also das wissen wir bereits:

Programm greift auf file Reg.rtf zu, wo name, strasse,... gespeichert werden vermutlich aber nicht die sn. (Reg.rtf kann selbst erstellt werden...einfach Textfile erstellen und die Daten wie name,... jeweils in eine eigene Zeile schreiben)
Die Routine zur erstellung der Sn kann in Smartcheck nachvollzogen werden, die daraus gewonnene Seriennummer aber nur zum entsperren der version 4.23 verwendet werden, nicht aber für die aktuelle version.
Achtung: Programm startet in SmartCheck nicht vollständig, sondern beginnt Integerzahlen hochzuzählen

Das Programm verwirrt mich ein wenig, also hoffe ich, das hier jemand Zeit findet, sich das mal anzusehen. Das Proggi ist auch recht nützlich und könnte sicher meherern Leuten zusagen!

Mfg
Bios
Bob
07-23-2001, 02:23 PM
In what direction did you say is the pub?

Regards,
Bob
Bios
07-23-2001, 02:57 PM
Sorry for the language! so if there is anybody who speaks german, pleas look at the entry. else forget it.


Need some (simple?) Delphi crackers help...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need some (simple?) Delphi crackers help...
PDA

View Full Version : Need some (simple?) Delphi crackers help...

Xces
07-23-2001, 12:45 PM
Hi guys,

I am trying to crack a delphi component called TOxygenSMS 2.1.1
http://www.oxygensoftware.com/download/tsms21.zip

Somebody removed for me 2 of the 4 cracks, but there are still 2 simple messageboxxes in the dcu file which i can't find / remove.

-----------------------------------------
This is the info to remove the first 2 nags:
-----------------------------------------
TOxygenSMS Version 2.1
Object files : SMSComp.dcu

[REMOVE WELCOME NAG]
Find string 6a00668b ... 33D2
replace with E92A000000 33D2 33D2 33D2
## Jumps over nag window and shell call opening exploder. ##

[REMOVE TEXT ADDED TO OUTGOING SMS]
Find hex string 1700 0000 7777 772e replacing 1700 with 0000.
## Changes string length ('www.Oxygensofware.com ', 17h) to 0 ##

Rebuild the componet to update OxygenSMS.bpl
-----------------------------------------

But there are 2 more simple nags:
A messagebox with
a) "TOxygenSMS: Message arrived."
b) "TOxygenSMS: Report arrived."

I can't remove them. If you can help me...

DO SO PLEASE !!!
And email if you are ready :)
Thanx
Xces
07-23-2001, 12:51 PM
Please note that this is not a request to completely crack it for me, i just need some help finding all stuff and so forth.

I did remove the 2 nags with a "90" over a jmp in the compiled exe, but i can't find the location of the nags in the DCU (delphi compiled unit) file.

Anywayz, it would be gr8 if somone could help this new-newbie :!

I included the DCU/ASM version kinda dump of the file as an attachment... Maybe someone can help


Tutorials collected by g-rom on procdump???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tutorials collected by g-rom on procdump???
PDA

View Full Version : Tutorials collected by g-rom on procdump???

BobTheRock
07-23-2001, 03:42 PM
Hello,
has anyone got the 28 tuts on procdump that where available on g-rom's site? The link is broken. Could someone please post a link to them if available. Thanks.

Regards,
BobTheRock
-=elgura=-
07-29-2001, 05:09 AM
i would like to have them too :-)
Mr_Helpful
08-13-2001, 11:11 PM
You can still get the tutorials at:

http://hem.passagen.se/pr0d1gy/Tools/Procdump/

Mr_Helpful


I am in dire need of help PLEASE HELP ME !!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I am in dire need of help PLEASE HELP ME !!
PDA

View Full Version : I am in dire need of help PLEASE HELP ME !!

DudyStuff
07-23-2001, 05:13 PM
Hi, I am writing this in the hope that i won't get flamed and that some very nice person might take pity on this almost newbie to cracking. By almost newbie, i mean that i can identify and remove a few nag screens (ie. MessageBoxA) but thats about it and I'm having trouble advancing to anything further
I can find specific cracking tuts such as "Crack Winzip 7.0" and even followed them through in the hope I might learn something but that didn't work although a did get a valid serial for Winzip. Please take pity on me and help someone that may be able to help you. (I do proffesional webdesign (ASP))
hz
07-23-2001, 05:30 PM
Hiya,
Ok we feel sorry for you, we really do ^_^ , what is it you are asking beside we take pity on you? ???.
DudyStuff
07-23-2001, 06:01 PM
Anyway what I need is someone that is willing to actually be a mentor or just guide me along the path to getting to the point where i can learn more be myself. I can use search engines and sometimes they yeild results but I'm after general lesons on the technique of cracking, finding the protection. Ideally i need a mentor, a teacher but then again noone normally gives up any time for me so why should a complete stranger? Just consider it write back soon with suggestions!!PLEASE!
4oh4
07-23-2001, 06:40 PM
That's what these forums are for....to offer assistance to people as they need it. ;)

You just walked into the middle of a LOT of talented reversers who ARE willing to offer their time to give you pointers.

....but first you have to have a reversing question. ;)
DudyStuff
07-25-2001, 02:26 PM
I need a lot of advice about how to fish for serials. Please, nothing specific, i really hate specific tutorials. Its pointless. Anyone can follow a tutorial! I'm not interesting in keygenning (yet) I just want to know the best way to go about this common protection scheme (name/serial generated OR hardcoded)
I'd appreiciate a fairly prompt response
woodmann
07-25-2001, 06:27 PM
Did someone call the messageboard police?

Read the FAQ.

Peace, Woodmann
aimless
07-25-2001, 11:54 PM
You ought to be more understanding of the nature of serial fishing. Gone are the times when you laid an ear to the working of the program and it would echo back the serial to you.

Nowadays, apps are using sophicticated algorithms to match serials and use lots of self modifiying codes. It is nearly impossible to get a serial number in the SICE data windows as was with Win 3.11 proggies.

Of course, I speak for good programs. You can find a lot of bad programs on the net that STILL do the actual serial comparision. Winzip, for example, is one such.

Instead, I'd advise you to go to google and search for "DrMe1.htm" and "DrMe2.htm". Explains almost all concepts and without taking into account a single program! It should be good to you.

Have fun
DudyStuff
07-28-2001, 06:32 AM
Thanx, now does anyone know any easy targets for a newbie like me
DudyStuff
07-28-2001, 01:56 PM
Guess wot? I just cracked the cd check on Sonic 3 & Knuckles!!!
Woohoo!
Well, kinda
I inversed a 'je' to a 'jne' rather than making an unconditional jump
This was because i didn't know all the hex op codes
I though there was only one hex equivalent for each instruction, but i found that
je starts with either 74 (what i'm used to) OR 0F84
jne starts with either 75 (what i'm used to) OR 0F85
Why is this? Although i've sorted it, its not very satisfactory bcoz it only works with the cd out. So, can anyone help me with my problem?
hubbabub89
07-28-2001, 04:27 PM
when u got 75 = JNZ and 74 = JZ and EB = JMP
these jumps are called shortjumps and the other ones.... 0F85, 0F84, E9 are the code for long jumps= jumps out of the routine u are in..

well í'm a newbe too so i can be wrong but this is what i think anyway.

i'm like you learned cracking without a mentor... i've got about 500 tutorials on my HD.. anyway i've been doin this with the proggiez i'm cracking.
first find the serial-calculation and the right serial.
and find the messageboxa that says wrong code.
change the wrongcode message with the right serial... make it show u the right serial = the program keygens it self... thats how i spend my time now
ok have fun
DudyStuff
08-18-2001, 08:30 AM
----------------------------------------------------------------
first find the serial-calculation and the right serial.
and find the messageboxa that says wrong code.
change the wrongcode message with the right serial... make it show u the right serial = the program keygens it self... thats how i spend my time now
----------------------------------------------------------------
Sounds fun but, how?
HOW?
I can easily locate the "wrong code" message box but what do i do from there?
gaffa
08-19-2001, 05:22 AM
hi
ref probs with sonic
you need to know why it jumps in the first place
1 does it jump if cd found
or
2 does it jump if cd not found

then you change the jump to match

all that you have done so far is changed the check around

hope this helps

gaffa

ps
winzip 7 should be easy have cracked winzip 6 and made my 1 and only keygen .As far as i know same keys still work
DudyStuff
08-19-2001, 05:34 AM
gaffa (08-19-2001 03:22):
hi
ref probs with sonic
you need to know why it jumps in the first place
1 does it jump if cd found
or
2 does it jump if cd not found

then you change the jump to match

all that you have done so far is changed the check around

hope this helps

gaffa

ps
winzip 7 should be easy have cracked winzip 6 and made my 1 and only keygen .As far as i know same keys still work

Don't worry about it. I sorted it out myself.
Before, i just inverted the jump so it worked without cd but not with. Then when hubbabub89 told me about 'e9' op code i sorted it to work with and without the cd!

Anyway can anyone help me with hubbabub89's method about cracking, sounds simple but then again, i'm stupid!
m0sk
08-19-2001, 09:50 AM
DudyStuff (08-19-2001 03:34):
Anyway can anyone help me with hubbabub89's method about cracking, sounds simple but then again, i'm stupid!

The method is explained in an essay by Kwazy Webbit (look for the `DREAD way' at the end of the essay).

h**p://its.mine.nu/html/re/essays/kwazy.html

have fun
m0sk
08-19-2001, 10:41 AM
Also, you might want to check out 2 columns written by Matt Pietrek (obviously these columns don't deal with cracking :))

The columns explain how basic hll constructs are converted by the compiler to asm. Since you seem a newbie a bit lost in the codewoods, I suggest you study these columns well. They will give you more insight in understanding compiler generated code, so check 'em out.

part 1:
h**p://www.microsoft.com/msj/0298/hood0298.htm

part 2:
h**p://www.microsoft.com/MSJ/0698/hood0698.htm

From there on: read (esp. the essays by DrMe), practice, read, ... (you get the point)

have fun and good luck,
m0sk
DudyStuff
08-19-2001, 11:23 AM
thanx BTW why star out the t's in web addresses
m0sk
08-19-2001, 04:00 PM
DudyStuff (08-19-2001 09:23):
thanx BTW why star out the t's in web addresses
hehe, otherwise this board would convert it to a hyperlink (you can click on it). Problem is that every time you click on a hyperlink, your browser sends the address of the page that contains the link to the target server (in this case m$). This way, the admin of the m$ server can see where traffic is coming from, and they might not like this place ;-)

If you copy and paste the url in your address bar (as I force you to do by starring out the tt), no `refferer information' is given away...

In other words: /me was being paranoid :p

Btw: you can disable referrer logging in Opera ;-)
DudyStuff
08-19-2001, 05:12 PM
The Dread way is amazing! One prob, i don't know enough assembler anyone know any decent tus for win32asm?


help needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help needed
PDA

View Full Version : help needed

Brill0
07-23-2001, 10:54 PM
i am trying to crack a program (BORX if interested) which limites options if it is not registered. the options are shown, they are just not able to be used ie. checkboxes. is there a api call for this? i have been trying to crack the reg function, i can get it to say registered ok but the options are still inactive.
i am also woundering why it wouldn't load in IDA right,it doesn't load the string references i got in wdasm. i tried 404 and 415 and it is still the same.
you can download the file from here if you like. it is a fun game... ;) 3D tetris
h*tp://www.bluemoon.net/~sdh/home3/BORX.exe
thanks
hz
07-25-2001, 06:44 PM
Hi,
it disassembles perfecty with wdasm. why are you posting the same request in different threads?.
Brill0
07-25-2001, 07:09 PM
no one responded to the other one, thought mabey if i had a more catchy subject i could get some people to read it. do you know what those api calls are or why it won't dissassemble in IDA


point the way
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > point the way
PDA

View Full Version : point the way

budda
07-23-2001, 11:54 PM
hello
I've learned some but still had some questions.
1 when I opened a exe file in the ultra edit it comes out is hex and and the code.. is the code supposed to be readable???
I'm looking at cracking a freeware game B-17 flying fortress. the game has been released for freeware and the copy protection is a simple look up the password in the manual but the D/L doesn't include the manual. not looking for a crack but more a clue. there are two files one is copypro.?? and then the exe file. I can open the copypro file but I cant read it . Since this is a freeware game is there anyone that would be willing to use this as a tutorial ???? enclosing the file
hope you have time to help
budda
Tezza
07-24-2001, 12:13 AM
Try dissasembling it with IDA or W32Dasm. You will then see the asm code.

If you are lucky you might also see the code in the string references!

Tezza


Bazik reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Bazik reversing
PDA

View Full Version : Bazik reversing

NikDH
07-24-2001, 12:08 PM
Hi to all,
was trying to reverse that program
Bazik 4 the chinese oroscope
U can find it on www.download.com

I cant find where the prog anylize my code to check if its correct

I tried to bpm on it but the only thing i can find is the routine that calculates (in a very complicated way) the lenght of my regcode

What i found is that:
-the regcode has to be not over 20 char
-every time i put in a new char the prog reads it and i think checks the code
-when i press the check button it only checks in memory if the last time the program checked the regcode (when i put in my last regcode char) was a correct code

Hope u can help me :)

See ya
NikDH
NikDH
07-26-2001, 12:05 PM
I'd like to know where that prog checks
if its updated
U know it has a max num of execution and i dont know where it writes down and where it reads if its updated

Tried with regmon and filemon but i didnt catch well anything interesting

Hope u can help me

See ya
Byez
NikDH
07-27-2001, 05:56 AM
From furtherer study it seems to be
an interpreted language like P-Code in VB
Do any of u know anything about a lang called WD?
It seems to have french origin and think its used to do this app
It should be very kool to find someone that will help me in defeating this prog
Think u should enjoy with it :)))

See ya
NikDH
NikDH
07-27-2001, 08:12 AM
Latest news about Bazik:
its written using Windev 5.55 i think :)
If someone knows anything more about it it would be great :)
See ya
NikDH


I'm stuck
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I'm stuck
PDA

View Full Version : I'm stuck

zitterbe
07-24-2001, 05:32 PM
If anyone's got some time I need some help with this program.

Program - A-book v.2.2.1
Company - Duality Software
Download site - h*tp://www.dualitysoft.com/abook/index.html
Install File - abk221.exe
Size - 1.1 Mb

It's pretty basic cracking but I need somebody else to help get me out of my mental block. The program takes a Name and Reg Code. It also requires a key file called abook.key which they send along with a valid Reg Code. It places the Name and RegCode in the registry at:

HKEY_USERS\.Default\Software\PIM+\A-book\Settings\UserName
HKEY_USERS\.Default\Software\PIM+\A-book\Settings\RegCode

Quiller said "The RegCode appears to be in the format:
WIN-xxxxxxxxxx-xxxxxxxxxxxxxxx with x's being letters (small and capital) and numbers."

I believe this is true. In fact for some strange reason there are 7 UserNames and RegCodes in the exe - see CS:0046A1F8. Don't know what that's all about but I used one of them.

Quiller went on to say "It can be patched in one location by moving a 1 into the memory flag that is used. In that case, the proggie is registered and it does not even look at the file abook.key..."

I just can't find any way that this is so. I can't find any flag test that bypasses checking the key file - especially when you first start the program.

Here's what I did:
[#1]I made a bogus abook.key with the numbers 6666111155552222 and saved it to the same folder as abook.exe.
[#2]I ran the proggie and chose to register it.
[#3]I used a Name and RegCode from the disassembly:
Name: Mark Riddle
RegCode: WIN-e805dR7dhA-t7jFfydjf5j3guS

That got me past the "incorrect user name" and "incorrect code" message boxes. Then I started tracing by loading it with symbol loader and trapping the registry queries. To make a long story short, the code starting at 401355 thru 40143B gets the UserName and RegCode registry info when first starting the program. That gets passed into a call at 40143D (Call 401CC0). The first Call in that function (Call 469DCO) reads abook.key into memory. If there was any error in reading the file or the UserName and RegCode were wrong it returns an error code and the calling function posts the particular message in a message box. Otherwise it gets to 469F05 which calls 4AE8A0. This is the function that tests the key file data that was previously read into memory. The actual algorithm is the code between 4AE8AE and 4AE910. I started to reverse this but I keep thinking about what Quiller said about there being a memory flag check that could bypass all this. Anyway, it appears that this Test Key function should return a valid address - maybe the memory location of the key. It definitely should NOT return 0.

Well - that's as far as I got. If anyone could give me some insights on this I'd appreciate it. I'm probably making an easy crack into a nightmare :-)

zitterb
quiller
07-25-2001, 12:42 AM
I guess that I should have a been a little clearer, "the proggie is registered and it does not even look at the file abook.key..." The program does look at the abook.key file, it just does not care what the result is (when patched).

You are in the ball park, you found the important call at 401CDA (CALL 469DC0). If you look a few lines below that you can see eax moved into a memory location. If eax (which is the return value from the above fuction)is 1, the program says that you are a good boy. You will need to go through typing in a username and regcode, but it will now accept anything and store it in the registry.

I'm not sure keyfile is the correct term for abook.key. I believe that file gets written automatically if a good username and regcode is provided, but I haven't checked. You might look into that. The reason I think that is that CALL 469DC0 is called from 2 locations. Anyway keep rolling, you're making headway.

quiller
zitterbe
07-25-2001, 05:16 AM
quiller (07-24-2001 22:42):
You are in the ball park, you found the important call at 401CDA (CALL 469DC0). If you look a few lines below that you can see eax moved into a memory location. If eax (which is the return value from the above fuction)is 1, the program says that you are a good boy. You will need to go through typing in a username and regcode, but it will now accept anything and store it in the registry.

What a dummy I am!!! In Sice I BP'd at 401CF0 and calculated that EAX should be 1 in order for ECX to be 1 for the required jump to "Registration Completed". I changed EAX to 1 and got the right message box but completly overlooked 401CE7 stuffing that Good Guy 1 to memory. So I changed EAX after a Bad value was put in memory, then got sidetracked on making the Call 469DC0 return 1. Jeeze!

:00401CDA E8E1800600 call 00469DC0
:00401CDF 83C410 add esp, 00000010

* Possible Reference to Menu: MenuID_0080
|
:00401CE2 3D80000000 cmp eax, 00000080
:00401CE7 A3ECA15200 mov dword ptr [0052A1EC], eax
:00401CEC 7761 ja 00401D4F
:00401CEE 33C9 xor ecx, ecx
:00401CF0 8A887C1D4000 mov cl, byte ptr [eax+00401D7C]
:00401CF6 FF248D581D4000 jmp dword ptr [4*ecx+00401D58]
I can't believe I missed that obvious mov at 401CE7 :-O

quiller:I'm not sure keyfile is the correct term for abook.key. I believe that file gets written automatically if a good username and regcode is provided, but I haven't checked. You might look into that. The reason I think that is that CALL 469DC0 is called from 2 locations. Anyway keep rolling, you're making headway
As for the getting called from two locations, I assumed one was when the program was run each time, the other was at initial registration. Not sure now. Maybe today I'll have time to play a bit more while at "work" :-)

The key file is puzzling. It's contents aren't really checked (in the Call 4AE8A0) against the UserName or RegCode. It's merely checked for self consistancy via the algorithm from 4AE8E1 thru 4AE910. Plus, it is called from 25 different locations??? That's an interesting little manipulation in that Call. Want to drive yourself crazy try reversing it.

One more thing. Why do you suppose there are those 7 UserNames and RegCodes in the exe itself? Seems weird they'd put those strings in there.

Thanx for your help!

zitterbe
+SplAj
07-25-2001, 05:53 AM
probably if you used astalavista and searched for cracks/serials for this target i'll bet you'll find some familiar names ;)

could be a list of 'bad boy's who released their serials ? If you played with CommView anytime you can see a similar thing... a list of bad boys ;)

+SplAj
bNaza
07-28-2001, 12:48 AM
zitterbe,
U can use:

Patch 1:
U need RegCode and UserName in registry, but don't need .key file.
at 4013FA u have jz 401499
Change to: mov dword ptr [0052A1EC],1 ; it is a good boy flag
jmp 40161D ; start the normal proggi
This1 skips a lot of stuff and the proggi will start faster....

or Patch 2:
U need RegCode and UserName in registry, and .key file.
at 46A0FF u have mov eax, 20
change to: mov eax,1
then u can register with any UserName and RegCode
This1 don't skips the checks and proggi is slower..

bNaza
zitterbe
07-31-2001, 11:40 AM
I already patched it but thanx.

I changed the CMP to a MOV EAX,1 and NOP'd the JA.

Cya,
zitterbe


Looking for help to reverse Golden Tee Golf Program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Looking for help to reverse Golden Tee Golf Program
PDA

View Full Version : Looking for help to reverse Golden Tee Golf Program

benz450sl
07-24-2001, 10:53 PM
Hi,
My name is peter, there are around 800 of us that play a game called Golden Tee Golf. The maker of the game Incredible Technologies (IT)
has abandoned the PC version of the game to concentrate on their arcade version. What we are looking for is someone to help us be able to create new courses for the game. There might be a small financial reward for any help on this project.

Thanks
Benz
Kayaker
07-24-2001, 11:41 PM
Hi,

I sure can't help you per se, but this reminds me of a project I saw at Sourceforge

http://sourceforge.net/projects/tsshp/

where a group of people are working on:

"A project to reverse-engineer and recode (from scratch, but using the original datafiles) the 3D role-playing / shooter games from Looking Glass (System Shock and the Ultima Underworlds)"

With 800 people you might want to think about starting up a similar project that might generate some discussion about what you want. Worth a looksee anyway.

Kayaker


What is tcl/tk ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What is tcl/tk ?
PDA

View Full Version : What is tcl/tk ?

el gato
07-25-2001, 04:53 AM
hi, I have been working on a program called Shelly lib that is written in tcl/tk whatever that is ,it has a nag screen on start up and a disabling of save as function i worked out it was using a key file named Xdefault but have not got further .As I am a newbee I would appreciate any help on where to start ,how to go about it ,any advice really ,oh well it is only a 759kfile at http://www.shelly.de/ if any one can spare a bit of time ,i realise every body is busy any help greatly appreciated
Wizard
07-25-2001, 09:40 AM
http://hegel.ittc.ukans.edu/topics/tcltk/
el gato
07-25-2001, 01:18 PM
Thanks Wizard for the link i am checking it out now ,very informative .i will try and understand ,get back to you soon when i finnish ploughing through the mountain of info there
thanks again


hmmm.... ShareLock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hmmm.... ShareLock
PDA

View Full Version : hmmm.... ShareLock

Hoof Arted
07-25-2001, 10:02 AM
Hi,

My target is using ShareLock and I can feel that I am 90% there. The problem is that the target is written in VB and ShareLock does something that hides the process of comparing the serial. I have extracted the last 5 of a 20 chr password correctly and the app then does something strange.

It "concats" the name I entered with the Location, "and some other stuff" and then compares the first chr with second chr and second with third and so on, untill it is finish. It then pops up with "GET your own serial". What the hell is going on? I have checked it with W32dasm, SmartCh3ck and Olly and cannot find any clues.

Any help or tutorials on ShareLock would be great.

Hoof
Xavax
07-25-2001, 10:41 AM
What version of sharelock?
I did a short story on sharelock 2.? some time back which was in the old Fravia's essay database (the app was Webzip). It involved more obfuscation than technology.


Password Stealer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Password Stealer
PDA

View Full Version : Password Stealer

Digyoubetterdead
07-25-2001, 08:54 PM
I've just discovered that there's a password stealing program in my system. I was able to find a script that was used in this program that seems to be mostly in hex. Is there a way to get this thing out of my system without having to wipe the Harddrive clean?
el gato
07-26-2001, 01:30 AM
hi Digyoubetterdead,
i dont think my answer is very reverser like but a program called The Cleaner always works for me ,it has some cool features and looks nice too,you can find it here http://www.moosoft.com/.good luck
Solomon
07-26-2001, 08:53 PM
How did you find that prog?

If you know its program files, just delete them. Maybe you need to boot into safe mode to do this.
dig
07-28-2001, 07:37 PM
When I realize the the prog didn't do anything I became suspicious and when it made an attempt to email my password to a closed yahoo account, I knew right then and there there was something in my PC that shouldn't be there. I deleted all the associated files and folders, but every now and then I stumble on a script or something.....is there a way to make absolutely sure this trojan is deleted?

PS........

thanx Gato for the tip on Moosoft


vb funtion disable
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vb funtion disable
PDA

View Full Version : vb funtion disable

RockmanX4
07-27-2001, 05:17 AM
the time limit & nag screen is easy to wrap off with wktvdebugger.
But about vb function disable cracking i have no idea. If any one have idea on how to cracking vb5/6 appz for function disable plz post your method. I am a newbie so i hope u all can help me.
Thanks
NikDH
07-27-2001, 08:08 AM
RockmanX4 (07-27-2001 03:17):
But about vb function disable cracking i have no idea. If any one have idea on how to cracking vb5/6 appz for function disable plz post your method. I am a newbie so i hope u all can help me.
Thanks

Remember that sometimes happens that
functions r totally erased from the prog
so none can restore them
U've to assure if its just a demo with function totally erased (if its so u can see lots of nop inside it) otherwise there should be other checks :)

See ya
NikDH


setup.ins problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > setup.ins problem
PDA

View Full Version : setup.ins problem

neurall
07-28-2001, 09:20 AM
Hi i lost my nfo file (microstation for Java 7.1 RISCISO)so i must findout passes for installer myself.

I decompiled install script and iam here

AskText ("Please enter the password: ","",passwText)
StrToNum (NumPassw,passwText)
A = NumPassw - 1234567890
RealPassword = A ^ 1234567890
IF (ComponentValidate MEDIA,"",RealPassword )< 00000000) THEN
BAD GUY DETECTED

How could i FIND password?

Brute Force ?
Best Regards.

NeuRaLL
javelin
07-29-2001, 10:20 PM
if ^ means the same thing in the script as it does in perl then

Perl snippet

$a = int( 1 ^ 1); # $a Will = 0
$b = int( 2 ^ 1); # $b Will = 3
$c = int( 6 ^ 6); # $c Will = 0

get the point?


Help!!!! nonworking Softice!!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help!!!! nonworking Softice!!!!!
PDA

View Full Version : Help!!!! nonworking Softice!!!!!

f_v_man
07-29-2001, 04:37 AM
I have got i great problem. I installed softice and loaded it correctly but can't make it work properly. whenever i set bpx it does not break of execution. Can anyone help me please?
-=elgura=-
07-29-2001, 04:59 AM
have u removed the " ; " from the dll's in the winice.dat??

or it may not break if you set bp's on address'es instead of api's,(if it is wrong file in the left bottom corner) so set an api breakpoint. when it stops in the right file, set it on the address..
zitterbe
07-31-2001, 11:51 AM
Make sure you are in the proggie's address context (do you know that means???). With the program running do a ctrl-d into Sice and type TASK and check out what the name of your program's task is. Do you see that name in top of the command window? If not - I'll show you how to get into your proggie's context so your BPXs use the right code segment. You can't just BPX 0040107FC in any context - like in Kernal32 or someplace. You gotta be in your program's address context so the 004010FC is referenced from the current task's (your program's) code segment. Ya know what I mean?

zitterbe
Argoth
08-16-2001, 05:39 PM
Hehe, very clearly zitterbe! :)
Try this f_v_man, use the SoftICE launcher. If u execute this regfile ( http://www.worx.tmfweb.nl/LoadInSI.reg ), all you have to do is right-click on an app and click Load in SoftICE. Then click the 'Load' button and set your breakpoints the first time SoftICE pops up.

Hope this helps a little

Grtz

Argoth


Playing with M$N messenger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Playing with M$N messenger
PDA

View Full Version : Playing with M$N messenger

Hoof Arted
08-01-2001, 03:00 PM
For a while now I have been bugged by the fact that my messenger notifies me that there are messages in my "other" folders. This is usually junk and I could not be asked to be notified every time I log on. So, I had a little look at this.

I have managed to stop all notifications by changing the JE instruction to a JMP instruction at 41C839 but as I said, it stops all notification. I would rather have this than be notified of the crap I have in the Junk folders.

What else can you guys find that can be done with messenger? I would be interested to know. Lets rip it a new one.

Hoof
Critter
08-12-2001, 07:04 PM
www.patchou.com/msgplus/


SoftIce Backtrace Buffer Disassembler - A new tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftIce Backtrace Buffer Disassembler - A new tool
PDA

View Full Version : SoftIce Backtrace Buffer Disassembler - A new tool

Kayaker
08-04-2001, 03:13 AM
Hi All,

I wrote a new Win9x reversing tool, TraceDis, that I hope might prove useful. It's made to work in conjunction with SoftICE to allow convenient viewing and saving of Backtrace logs. It combines a raw dump from memory of the addresses contained in the Backtrace buffer with a disassembler.

The Backtrace feature of SoftIce, which allows you to log all instructions executed within a specified address range, is a very powerful option that I think isn't used to its full potential because of the difficulty of working with the disassembled trace. Only the *addresses* of the lines logged are stored in the Backtrace buffer, the disassembled output you see with the SHOW or TRACE commands is generated internally by SoftIce.

You can do multiple screendumps of the trace with IceDump, but this isn't a good option for large traces. What TraceDis does is parse the addresses contained in a dump of the Backtrace buffer and disassemble those addresses in the target program while the program is loaded in memory. The results are a readable disassembled output much as you would see in SoftIce.

It works with Self Modifying Code (SMC) as well as packed programs using high memory addresses during unpacking. You can also use it to help manually trace redirected API calls. All dependant on the quality of your Backtrace in the first place of course.

It has a feature which allows you break into SoftIce, either specifically at the Program Entry Point of the target program, or at any time you wish after it is loaded, to access the address space of the program. This is simply an obsolete, never-used API invoked at a couple of places in TraceDis that you can set a breakpoint on.

I think it will be a handy utility to take full advantage of SoftIce's tracing abilities, simply because you can now view and save the traces outside of SoftIce. There's a complete help file giving examples of its usage.

I owe a large vote of thanks to +Tsehp for the major contribution he made by kindly providing a C source dll which converted the opcode instructions to readable assembly instructions. Not only did this save an immense amount of time (I'd still be decoding opcode mnemonics), it ensured the accuracy of the results.

I hope you find it useful once you've figured out wtf it's all about ;) and I'd appreciate any comments or bug reports to help improve it.

Cheers,
Kayaker
CoDe_InSiDe
08-04-2001, 04:50 PM
Hi Kayaker,

I checked the Tool a little bit and i found a bug ;)
I opened the Program and choosed Notepad.
Then Notepad and the Program runned.
Then in the TraceDis Program i clicked on "Open Buffer" and i selected the file from the Example zip "Trace.bin" and TraceDis crashed ;)
Well actually it was "tracdis.dll" that crashed hehe :)
I don't know if i were supposed to open that file or something but it obviously doesn't handle it correctly ;)
Well that's it for now :)

Cya...

CoDe_InSiDe
Clandestiny
08-04-2001, 05:54 PM
Hiya Code_Inside,

If I'm understanding your problem the Trace.bin is the buffer address dump for Example.exe, not Notepad. As such TracDis can't parse the addresses to meaningful code. Hence the crash. If you want to try TraceDis out on Notepad you'll need to do a manual raw dump of Sice's backtrace buffer with Notepad loaded into memory. This dump is the file that you need to open, not Trace.bin. If you load Example.exe, however, you can open Trace.bin which provides a demo of the prog's functionality.

Cheers,
Clandestiny
Kayaker
08-04-2001, 09:15 PM
Hi CoDe_InSidE,

Clandestiny is right, the trace.bin file is a raw dump of a backtrace that only goes with the example program. You need to make your own dumps for any other program. But I'm glad you brought it up because it showed a flaw in my code. A program should always exit gracefully if possible on an error and not crash!

I found the error and fixed it so if the user chooses the wrong file it won't crash. I see another potential area that could use some error handling as well, so I'll work on that. Thanks for the report ;)

BTW, sorry for the cross post on the 2 forums, but I've always had problems attaching files in the main RCE forum, so I had to post it here instead. This after I realized my first post on the other forum contains a dead link to the file.

Kayaker
CoDe_InSiDe
08-05-2001, 07:35 AM
Hi everyone,

Yeah, Trace.bin belongs to the example program quite logical ;)
BUT it shouldn't crash, but you fixed that now, good ;D

Cya...

CoDe_InSiDe
Bengaly
08-11-2001, 04:48 AM
Also note "BPRW NOTEPAD T" is not working
even if notepad is loded in Symbol Loader! ;D
if there is another suggestion plz let me know :/

Have Fun ;D


IDA problem...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IDA problem...
PDA

View Full Version : IDA problem...

the_lover
08-04-2001, 01:31 PM
I am disassembling an old dos executable with IDA Pro 4.04 Shocked Release.

I am in a situation like this:

sub_444:

...
mov dword ptr aHelpFileNot+2,eax
...
sub_444 endp

The instruction is a nonsense:I have manually defined the string aHelpFileNotFound,and it cannot be anything else.

I have a lot of this kind of situations,so I cannot proceed in my analisys.Note that IDA doesnt let me change the first op to anything.

>) Any idea??


Real Player and recording?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Real Player and recording?
PDA

View Full Version : Real Player and recording?

Hugo
08-10-2001, 08:27 PM
I've read Woodmans excellent reverse ingeneering instruction how to enable recording of "non recordable" streams. But now there is Real Player 8 plus out there. Is there a shortcut to do it all again or is it a new task? I don't know much about Intel assembler prorgramming, allthough I'm a fairly skilled programmer. Isen't there a way of pretending to be RealPlayer and just implement the rstp protocol and download it all?
So to now to the point. If you think Woodmans method is still the way to go, please tell me so. If there is a easier way around please tell me that as well.
woodmann
08-10-2001, 09:35 PM
Do your research, You will find that Real player is painfully lame.

Peace, Woodmann
Hugo
08-16-2001, 06:41 PM
Thank's woodmann but that do not help me a lot. I've opend the .rm files and noticed the property value. It's a pain setting my computer to act as sever and getting the warez versions of realplayer studio. I'm lame as well as RealPlayer but a further hint would do no damage.
Hugo
08-16-2001, 06:45 PM
Forgot to say peace to you as well. Anything is appriciatded. /Hugo
woodmann
08-16-2001, 06:52 PM
Hi Hugo,
I am not quite sure what you want to do but if you are trying to record a live stream via the internet, the last app I used was Total Recorder. It comes as a trial/share version.
The rest is up to you.
Peace, Woodmann
Hugo
08-16-2001, 07:06 PM
What I want to do, is just to record/or download protected (non recordable) streams. I will try to search for "Total Recorder". Maybe "total recorder" will generate many hits so a more specific name? Gonna look for it after this post!
/peace
Hugo
08-16-2001, 07:17 PM
Sorry for the evolution of the subject. But what I want to do, is saving "non recordable" realstreams to my computer. I read the "total recorder" forum and I dident't find what is was looking for. Please help me overturn the "non-saving" option in realplayer. And if it was to be found in the trotal recorder forum please tell me where.
woodmann
08-16-2001, 07:30 PM
Email me so that we can continue this discussion.
woodmann@woodmann.com
Peace, Woodmann
bob
08-17-2001, 04:30 AM
This may help: the StreamBox VCR Underground.
http://zor.org/svcrunderground/


Tut site update
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tut site update
PDA

View Full Version : Tut site update

krobar
08-10-2001, 09:03 PM
Hi all

If anyone interested...I updated my crack tut collection...added about another 200 tuts...as usual it at http://zor.org/krobar/

krobar
Bengaly
08-11-2001, 03:37 AM
Still no tuts there? ;(

;=)
Tezza
08-11-2001, 09:44 PM
Thanks man...excellent collection
qferret
08-12-2001, 08:58 PM
Bengaly....once you go to the url, and click a link to get into one of the main sites.....click on the Krobar logo at the top
Kugi
08-13-2001, 10:14 AM
Hi Krobar,

Great update. Thanks for your continued good work.

Regards, Kugi
Bengaly
08-13-2001, 03:47 PM
qferret:

I think u didn't understand what i ment..
when i said "what no tuts their?"
I ment that why MY TUTS are not on krobar's Page..cuz i asked him to add them!

Have Fun
krobar
08-18-2001, 03:55 PM
Bengaly

Heh, I forgot where you said your tuts were, but I got them now.

I lost a couple of my accounts (seems to happen whenever I update) but I moving at the moment...so add your collection to my collection then

krobar
danii
08-31-2001, 05:25 AM
yeah thanks krobar :)


BPRW <Module> code:T...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > BPRW <Module> code:T...
PDA

View Full Version : BPRW <Module> code:T...

Bengaly
08-11-2001, 04:08 AM
OK that's wierd..it seems SoftICE won't break on
any BPR i tell it to..
Even if the module is loaded in Symbol loaded...
nothing it just says:
"module not found" <== and the module is already loaded in sumbol loader...
weird..anyone has suggestion??

[bpx works fine ;P]
noname
08-11-2001, 09:34 AM
Bengaly (08-11-2001 02:08):
OK that's wierd..it seems SoftICE won't break on
any BPR i tell it to..
Even if the module is loaded in Symbol loaded...
nothing it just says:
"module not found" <== and the module is already loaded in sumbol loader...
weird..anyone has suggestion??

[bpx works fine ;P]

Heya,
First of all you post this on the wrong forum
you should post it in Tools of the Trade forum you can see it below
in the list box.
Ok to the point.how do you breakpoint?
Please read the faq before posting anything.

example:
bpr low eip high eip r w

bpr 403000 405000 r w
noname
Bengaly
08-11-2001, 10:43 AM
That's not what i have Ment Nomane.
BPR works fine, i know how to sue bpr.

It's just BPRM <Module Name> T
is not Breaking..
Or u mean i need to add the Low/High EIP as well?
But i don't think i need to.
i wanna use BPRM in order to do BACKTRACE using loaded APP in SYmbol Loader.
if u have another suggestions plz let me know.
Kayaker
08-11-2001, 11:34 AM
Bengaly (08-11-2001 08:43):

It's just BPRM <Module Name> T
is not Breaking..

Hi,

I'm sure you realize it's bprW for one ;)

Make sure the module is actually loaded and that's the context you're setting up the backtrace in. Type TASK in SoftIce, the task with the asterik beside it is the one running and this is the actual module-name you need to use.

'BPRW Notepad T' should work for Notepad. If it doesn't, then are you running NT?, I hear BPR commands don't work in NT.

Also, if your module name has a long filename (> 8 chars?) SI may not recognize it, so it's best to rename it first before using BPRW.

Hope this helps,
Kayaker
Bengaly
08-12-2001, 01:13 AM
Yes i realize it's BPRW now..
but still there is no effect of the breakPoint,
I am running on win98.
And it seems either: BPR/BPM/BPRW are not working.
like i load the program into SYMBOL LOADED.
while in Sice i press "SHOW" and i see the module name running, but 'BPRW <Module> T'
Telling me "Module not found"..
I use Sice 4.0.5 Built 334.
Hope to get more Answers.

Have Fun ;D


Hi,i am new here
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hi,i am new here
PDA

View Full Version : Hi,i am new here

Hor
08-11-2001, 10:44 PM
Hello~~~~~~!
woodmann
08-12-2001, 04:47 PM
Hi, Do you know what your name means in the USA ?

Peace, Woodmann
qferret
08-12-2001, 08:50 PM
....ummmm....Woodmann?.....I think u may wish to consider turning off your computer for a night and getting yourself laid LOL......aside from the different spelling, it does look like it would be pronounced whore though doesn't it? ;-)


Trw2000 Tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Trw2000 Tutorial
PDA

View Full Version : Trw2000 Tutorial

SantaC2
08-11-2001, 11:50 PM
Does ne1 have a good tutorial on using trw2000??

TIA

Santa


Help with finding keyfile a program used by program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with finding keyfile a program used by program
PDA

View Full Version : Help with finding keyfile a program used by program

Polt
08-12-2001, 11:07 PM
Hello,

I'm a relative newbie at cracking Win 95/NT etc. based software. The program I am looking at is called Websnatcher, I've been messing around with it for several days, but no go.. Having read the key-file related tutorials, I tried all the mentioned breakpoints (.lopen, createfilea, readfile, and a couple of others), but have had no luck locating the spot where the program looks for or tries to access the keyfile. Complicating matters is the fact that a .DLL file that websnatcher uses (it places two .DLL files in your system dir) is encrypted with ASProtect. Needless to say I've been unable to remove. Does anyone know of anything else I can try to find the area of the program that looks for the presence, or tries to open the keyfile? Note that despite the Asprotect, I can debug the program (breakpoints for other windows calls work, including a messagebox breakpoint when the nag screen pops up). I appreciate any help someone can provide with this.
Thanks!
test
08-13-2001, 12:17 AM
test
aimless
08-13-2001, 06:58 AM
Hullo Polt,

I think that you need to (as you have mentioned you are) crack easier programs (the serial num kind) rather than the keyfile ones, as you are relatively new to this. This is not to dissuade you, but to simply put things in perspective. However, if you DO want to go ahead, maybe you can follow the pointers, which, if not really crack the application for you, can atleast point you to the right direction.

Firstly, its protected with Asprotect, which by iteself has got a few ICE detection tricks up its sleeves. And worse, it does not tell you its detected the same (it simply does something that its supposed to do - nasty of course). Trying to run around unpack that manually is going to be a long long exercise (unless you are one of the experts on unpacking). So I would suggest that you get a file analyzer. And run your program and its dlls through that. This will tell you approximately (no file analyzer is 100% correct) , as to what version of Asprotect it was compressed with. Un Asprotect it with apps lying around the web for the same.

Secondly, if it is indeed protected with Asprotect, I might suggest cracking it using a disassembler, rather than ICE. After you have unpacked the dlls, of course :)

NOW! we come to the actual approach. You have ONLY 2 approaches in this case.

Approach 1: Regenerate the keyfile as it was meant to be (crazy, if the developer was smart and has ensured that it requires several KBs of key file !! or alter the keyfile if ICE was detected (though I doubt very much the latter option, as developers are generally sloppy)

Approach 2: Crack the dlls an/or exe via disassembly and find out the locations (please note the plural! and not the singular) where it reads for the key file. You can then reverse/invert/nop do whatever you want to your heart's content. A note here to remember is that it is not necessary to check for the keyfile in only one location or two or even three for that matter (as most tuts assume they would). It could be even in tens and twentys (the locations, I mean!) So be patient and trace EVERY access to the key file, modify the files and carry on. However...

After modifications, your app may not run. Developer may have a checksum or CRC on each file, which may be interlinked and may have a check on whether its protected and STILL compressed with Asprotect (size compare) and so on...you get the idea.

So a better idea would be to patch the file in memory using a loader. And of course, he could also check for the checksum of the memory...but I doubt that. :)

So best of luck on your new attempts. Having fun while doing this is the success. Be serious and think that there is a mandate to cracking the file will not get you anywhere. Enjoying and having the time of your life while doing it will.

Have phun.
Polt
08-13-2001, 11:33 AM
aimless,

Thanks for the info. I ran the .EXE and the dll files through a couple of file analyzers and they come up with Asprotect 1.3 (damn) on the websnatcher.exe file. So I was wrong about the protection being on the .DLL. The only unpackers I found were for up thru v1.2. So I'm trying a different approach -- got an earlier version of websnatcher (v2.0) and figuring it might have an earlier version of Asprotect - but it had none!! So now I can concentrate on the keyfile and forget about Asprotect :) And then hope it works with 2.4, if I can make a fake keyfile in the first place :O
Bengaly
08-13-2001, 03:41 PM
hehe KeyFiles are easy to find!
Especially what is the KeyFile the program File search for!

Here are the steps in Order to find the KeyFile name:

1. load Softice
2.Set a BPX CreateFileA
3.unload sICE
4.run the program u want to find the keyfile for
5.SoftICE will Break at the instruction:

EAX=0047799C EBX=00477954 ECX=00000003 EDX=00000000 ESI=0000002C
EDI=0047799C EBP=006DFC48 ESP=006DFBF0 EIP=BFF77AF6 o d I s Z a P c
CS=0177 DS=017F SS=017F ES=017F FS=62EF GS=0000
----KERNEL32!GetFullPathNameA+0046-----
KERNEL32!CreateFileA--------------------
0177:BFF77ADA JMP BFF7CAD0
0177:BFF77ADF PUSH EDI
0177:BFF77AE0 PUSH 00000127
0177:BFF77AE5 SUB EDX,EDX
0177:BFF77AE7 PUSH BFFA19C3
0177:BFF77AEC PUSH DWORD PTR FS:[EDX]
0177:BFF77AEF MOV FS:[EDX],ESP
0177:BFF77AF2 MOV EDI,[ESP+14]
0177:BFF77AF6 SUB EAX,EAX <=here
---------------------------------------
On Adress 0177:BFF77AF2 Type: D EDI
full path+name of the KeyFile will be presented to u by SoftICE!!

Have Fun
bengaly
Polt
08-14-2001, 03:41 PM
Thanks for the general info on finding keyfile accesses. I've been plugging away at this and found out that the keyfile feature of websnatcher is actually part of asprotect itself!!

I found an excellent tool called 'Caspr' which blew away the ASprotect v1.2 on websnatcher 2.3. Totally cracked!! Now the problem is Asprotect 1.3 on Websnatcher 2.4 :)


Unpacking a dll packed with UPX
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking a dll packed with UPX
PDA

View Full Version : Unpacking a dll packed with UPX

the snake
08-13-2001, 02:02 AM
Hi all
Nice to be back after a long long time, even if i had to re-register :)
Nice to see some old familiar names, too.

The target is FlipAlbum (~7MB):
http://www.flipalbum.com/cgi/web_sup/free_dl.php?dlpage=www.flipalbum.com/flipalbumcd/fasuite40_dl.php
It's a 30 day limit trial, with nag.
I've unpacked the main program, found where to patch, but then, i've notice that the days remainin and the nag screen is done in the FACOMMON.dll that is packed as well with UPX.
I've forgot most of things i knew, and some other i didn't know at all :)
Can someone point me how to unpack this dll ?
i did my best, with procdump and without.. nothing helped..
Thanks
the snake
LaptoniC
08-13-2001, 04:54 AM
have you tried to unpack with upx itself ? upx -d filename.dll will do the job.Also if you want to unpack it manually,Put CC on the entrypoint of dll.In softice type i3here.Then trace as usual.Hope it helps
the snake
08-13-2001, 06:12 AM
Hi LaptoniC
Thanks for the reply.
I didn't know that UPX lets unpack, this will do for the easy way.

Now, for the interesting way, i need some more words, if you can..

"..Put CC on the entrypoint of dll.."
what is "CC" and how do deal with it?

"..In softice type i3here.."
Just not sure what to type in SI, please be more speciphic..
I feel i become a newbie again :)
Thanks in advance
the snake
Eternal Bliss
08-13-2001, 06:42 AM
Hiya my dear friend,
hope you have been well. I haven't heard from you for a long long time. 8)

"CC" means to put a int 3 at the entrypoint and setting sice to break when it comes to an interrupt 3.

This is exactly like unpacking a normal exe file where you break into it at the entrypoint. For the dll, I suppose the imagebase will not be 400000 but higher.

Unfortunately, I have yet fully setup my computer after the recent repartition and reformatting, thus I am not able to help you specifically.

Good luck.
EB
the snake
08-13-2001, 08:36 AM
Hi EB,
How are you ? Happy to hear from ya again.. Are you back home now ? Last time we talked, you had your final exams..
I'm ok, had a very busy year in real life and at work, and I have now a "webmaster" certificate..

"CC" = int3 , damn me, forgot all.
Do i need to set it in the dll with an dexeditor before running, right ?

Sorry, Sounds like i'm getting old, passed the 40's..
Going home to try it now.
Thanks
the snake
qferret
08-13-2001, 07:43 PM
wb snake, & congrats on the cert.....
I actually unpacked an ocx packed with UPX awhile back.

EB is right once you get Sice to break on the dll it's business as usual for UPX unpacking/dumping.

The newer versions of UPX support unpacking...the older ones don't, so it depends on what version the author used as to whether or not you can take the easy way out ;-)
Eternal Bliss
08-14-2001, 12:01 AM
Hi snake,
yes, I have finished my exams and is now waiting for september when I will start working. Hopefully, I will still have time to hang around here. 8P

Hi qferret,
you mentioned an ocx packed with upx. Was that the ocx that is supposed to be difficult to crack? I was reading the postings then but didn't get to try it myself due to my exams. How was it? Were you able to crack it? I don't recall reading any postings on it after my exams when I started visiting the board again.

Regards
EB


Hardlock Doogle Key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hardlock Doogle Key
PDA

View Full Version : Hardlock Doogle Key

BirdMan
08-13-2001, 02:40 AM
Can anyone get me started.
I have a hardlock Key. I do not know which software and instructions
to use to TRY to reverse this doogle, which I do have and own.
Please someone point me in the RIGHT direction.
Squidge
08-19-2001, 06:47 PM
I'd say the first thing to do is to see if it's got a hardlock hasp envelope. You can do this with a hex editor, if the programs in an envelope, I wouldn't attack it as your first dongle project.


How to remove a banner in software?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to remove a banner in software?
PDA

View Full Version : How to remove a banner in software?

peterchen
08-14-2001, 02:02 AM
HI,eveybody!
I from China,my english is poor!
How can you remove banner in software?
Give an example: icq?Acutftp?AReGet Junior?AThatBat...
Have you some tutorial or know where donwloand it?
Where have someone know chinese?
Have you a icq?
Js
08-16-2001, 04:50 PM
Greetz peterchen,
I'm from England so my english is poor too. Can't remember any tutorials specifically dealing with adware except from our very own legend in his
own lunchtime (kidding buddy :))
hxxp://usa3.hostrack.net/woodmann/fravia/kayaker_adware.htm
hope it helps.
the snake
08-17-2001, 10:36 AM
Hi Kayaker
I was about to follow the tut about Frazzle, but the new ver, 1.1,
is different, no ads, and the "about" button went down to the bottom
of the window.
I'm trying to do something with Kazaa, www.kazaa.com

But first i need some basic help,
How can i know what child-window or main window is the one
i'm looking for, the one shows the ads.. Is there any logic that
i miss here ?

If someone is about to try it, edit the pe-header, using procdump,
and change the last 2 sections characterictics to E000000020,
so it can be disassemble with w32dsm..

thanks
the snake
Kayaker
08-21-2001, 01:42 PM
Hiyas,

Hey Snake, welcome back :) Glad to see you're still at it. This stuff is just way too much fun to give up for long isn't it?

I think the easiest way to find out what control or window is holding the Ad is to use the direct approach with a Windows monitor like WinShow/Winfrog or Windowse. Point it to the Ad window and this will give the Class and Hwnd.

Then type 'Task' in Softice to get the modulename and 'Hwnd <modulename>' to get a listing of the controls making up the active window(s). All this really does is give you a handle (so to speak) on the hwnds of the program. Kind of useless unless you combine it with other information like APISpy output monitoring creation of the Ad window. Just match up the hwnd of the Ad window with whatever API calls use it and see if you can short circuit its creation.

If you want to try the techniques I used in Frazzle to get rid of the Ad banner, and move and resize other controls by altering the params pushed to CreateWindowEx, ShowWindow, SetWindowPos, give it a shot with the Opera 5 Adware. It will work exactly the same way, heh, heh ;)

I took a quick look at Kazaa. What an obnoxious adware program, wanting to install all these extra demo programs! I'm not too sure about getting rid of the ads in this one because they all seem to be within the main window, an Internet Explorer_SE Class. Essentially they're ads within a web page, so I don't know if you have any control over them in the same way.

Hope this helps,

Cheers,
Kayaker
peterchen
08-21-2001, 06:47 PM
Thank you very much!
But I Can't remove ReGet Software banner!
Do you try remove it?
And wirtting for some tutorial about it ok?
It's two banner in the software.
a banner in main windows,an other in skin windows!
I hope you wirte a new tutorial about it!
How do you user some tools to crack it?
Please witre clarity process for it!
Thanks again!
Download:www.reget.com


Little help needed (username+pw)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Little help needed (username+pw)
PDA

View Full Version : Little help needed (username+pw)

Ransid
08-16-2001, 06:27 PM
Hi guyz

The program I am trying to crack is, GaugeDump 2.0 (shareware/243k):

http://www.bruceh.com/download/GD20.EXE

I have found that if I change the:

0040E311 0F85A1000000 jne 0040E3B8

to

0040E311 0F85A1000000 je 0040E3B8

Then the program accepts any username, password and reports that registration was successful. But it asks for you to restart the program to give full functionality... but I can't find out how to stop it reverting back to unregistered/shareware version?

P.S I did change the (je) at :004012B9 to (jne) and that made the front end say the program was registered but really it wasn't(atleast it didn't function as if it was registered)

Please, I hope someone can help me :)

Thanks in advance
Clandestiny
08-16-2001, 10:01 PM
Hiya Ransid,

Chances are that your target has multiple registration checks and that it performs at least one of them during initialization everytime the prog is run. You'll need to find and disable these as well. In the simplest case it will be another reg / unreg flag which you will be able to handle as you did the original check. It is also possible, however, that the target reads its registration status from another file or from the registry. In these cases, Regmon, Filemon, and an API monitor will be your tools of choice.

Regards,
Clandestiny
ransid
08-17-2001, 05:07 AM
Hi Clandestiny,

I looked at the registery and found that the program saves my username+false password in the registery but then must look at it again when the program starts again(which then says, "ahem, this password is wrong for this username")

Like I said I have already made it say it is registered at program start but then runs in unregistered mode. Maybe it does some more checks somewhere else?

Thanks for the advice & thanks in advance

:)

Ransid
Fake51
08-17-2001, 08:39 AM
Most programs tend to check the name gainst the serial at startup, few rely on a simple flag in the registry to tell them they're regged.
This typically doesn't make it a whole lot harder tho, as most programmers are stupid enuff to use the same algocheck-subroutine, when trying to figure out if the serial is straight. That just means that you have to go one level deeper, find the algo-sub, and make sure it always gives the right answer.

Thus, you may have several places in the program, that all call the same sub to see if the serial is correct. Patch the sub to see the light.

Blue skies
Fake


The Impossible Mission: Reversing Sentinel Pro Protected Code?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > The Impossible Mission: Reversing Sentinel Pro Protected Code?!
PDA

View Full Version : The Impossible Mission: Reversing Sentinel Pro Protected Code?!

Mans
08-16-2001, 09:30 PM
I really tried my best to reverse the attached program which is
protected with Sentinel Pro dongle, but couldn't succeed! The program is 16-bit
code, so I searched for 16-bit Sentinel API function calls but non of them exist
inside the program!

I tried to trace the program's execution in a debugger - TRW2000 1.23
and SoftIce 4.05 used - BUT it crashes after trying to execute some code in an
unknown module! The program lands at that unknown module after RETF
instruction, before that, the program calls some Win API functions
including: AllocDStoCSAlias (Allocate Data segment to Code segment) and
AllocCStoDSAlias.

Also, I tried to break at BPIO -h 378 but the program dose not break there
at all!

I read all papers on CrackZ and downloaded all Sentinel related files. I'm
stuck PLEASE HELP.

NOTE: The program contains two versions: Complete and Demo. The Complete
one requires dongle. The demo one dose not require dongle but dosen't
work after 12/30/2000! I already patched this :)

http://us.f1.yahoofs.com/users/683af739/bc/Work/amnsetup.exe?bcaLIf7A3Kj2yMpn
Squidge
08-18-2001, 07:27 AM
Hi,

Do you know what the program is written in? (Which Compiler?)
gaffa
08-18-2001, 12:46 PM
hi will try to help you but can d/l file

gaffa
gaffa
08-18-2001, 01:38 PM
hi again

ment to type can't d/l not can

gaffa
Mans
08-18-2001, 05:35 PM
Thank you for replies.

The program was written in Borland C++ 1991 version

Sorry for the incorrect download link. To download the program, go to http://briefcase.yahoo.com/nss6 and choose Work folder then click on amnsetup.exe. When you install the program, choose the English interface and Complete version!

BTW, I think the program is protected using the Automatic Sentinel protection mode, i.e. SPro Shell. That is because Sentinel Shell text is found in the file when viewed in HEX Viewer and there is no SPro API calls in the code (refer to the Sentinel manual for more information)

Thanks again,
Mans.
gaffa
08-19-2001, 04:30 AM
hi
i d/l the files ok
the bad news you are right about sentinel shell , all the progs that unpack this need the dongle this makes it to hard for me as i think that the unpacking code is in the dongle .
if you have the dongle then we can unpack the exe and then try to crack it but if not then you will have to find someone better than me
sorry i could not be of more help
gaffa
Squidge
08-19-2001, 06:43 PM
Ah! 16-bit programs protected with the shell are a complete bitch to hack/patch without the original dongle. (The original code is encrypted using the dongle)
Mans
08-20-2001, 04:39 AM
Gaffa and Squidge, thank you very much for your contribution in this! I know it is hard. Unfortunately, I don't have the original dongle. But wait!! When I disassemble the program using WDasm or WCB, the disassembling program recognizes the original program and shows the API calls it makes to DLL. To better understand what I mean, try to disassemble WSTOCK.EXE using WDasm and have a look at import calls. You'll see lots of them that deals with accounting and alike (know this from their names). Now, if the original code is encrypted, then how would the disassembler recognize these calls?!

Thanks again,
Mans
Morlac.
08-20-2001, 04:46 AM
Hi all,

I think Ive seen an automatic Sentinel Unsheller zencrack2.cjb.net
I dont know if it works with 16-bit code but no harm would come from trying.

Morlac
gaffa
08-20-2001, 02:46 PM
not all the exe has to be packed just enough of it to stop it from working

also in wdsm try load process under the debug menu

gaffa
Mans
08-21-2001, 06:33 AM
Morlac., I think that Unsheller works with 32-bit code only.

Gaffa, so part of the code can be packed! This is the first time I know this. Thanks :)
About WDasm, the debugger works only with 32-bit code :(

BTW, can SoftIce automatically trace the code's execution then dump that into a file?! Another question, how can the program know that the dongle isn't present while not stopping at BPIO 328 breakpoint?! Using SoftIce, I can make the program to break before displaying the messageBox that tells the dongle is not present. Can this be of any use?!

Thanks,
Mans
qferret
08-21-2001, 10:22 PM
for your Softice q....

Set up a backtrace buffer and check earlier posts in this forum for Kayaker's new tool to dump it to a file ;-)
goatass
08-22-2001, 08:38 AM
did you guys read the Sentinel shell breaking courtesy of CyberHeg from CrackZ's site ? It's a 32bit shell but it's not all that different from the 16bit one. They both use the sproQuery for most of the important decryptions. I think this project is a bit over your head Mans. But give it a shot. The other pain is that it's written in Borland which makes the code much more bloated and harder to trace through. Lastly, get the sspro signatures for IDA and use them and it will find all the API calls to the dongle which will help a little when trying to figure out the sproQuery calculations.

good luck
goatass
Mans
08-23-2001, 03:35 AM
Thanks Goatass for help. Actually, I've already read CyberHeg's tut. It is based on sproQuery function which I cannot find in my program! I've used IDA and WDasm to disassemble the program but no traces for such function (nor any other 16-bit function mentioned in Sentinel manual, strange!)

I've to agree with you that Borland makes the code harder to trace and even crash!

For Sentinel IDA signatures, they are for 32-bit programs (16-bit and 32-bit Sentinel functions are different). Anyhow, I downloaded them and applied them but they could not identify any function.
goatass
08-23-2001, 07:55 AM
Another technique I use alot if BPX CreateFile to see when the program loads the sspro driver for communication with the dongle. This will usually land you near the main protection and you can see from the calls that you trace over, if they return 3 in AX check the variables pushed onto the stack before these calls and you can figure out what function is what.

goatass


Adding functionality: any pearls of wisdom?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Adding functionality: any pearls of wisdom?
PDA

View Full Version : Adding functionality: any pearls of wisdom?

myAvatar
08-17-2001, 11:58 AM
Greetings Board,
I am going to find as many essay's of this nature
that I can... but I thought it might also be wise
to see if any of you had some pearls of wisdom
to share that I might not find in a tutorial or
something...

I have a program that doesnt process command
line arguments, so I have to go in and hit a button
each time, or press F9, or choose the appropriate
option from the main menu. I know I could use
one of those window's macro programs would send
the keys to it... but thought it would be nice to
possibly write something so that I could use AT
commands in NT to schedule it.

What are your thoughts?

Regards,
myAvatar
the snake
08-18-2001, 12:24 PM
Hi
here is a link to :
"A series of essays on adding functionality to W32Dasm.
Added functions are: Commandline parameters..."
Written by Harlequin.
Can be found at http://harlequin00.cjb.net at the
essay section, the first one..
the snake
myAvatar
08-18-2001, 07:40 PM
thnkx! looks execellent... now I just
need to spend time understanding it
so I can apply it to my target...

appreciatively,
myAvatar


Help! : Win2K Pro SP2 and SIce 4.05
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help! : Win2K Pro SP2 and SIce 4.05
PDA

View Full Version : Help! : Win2K Pro SP2 and SIce 4.05

isotope
08-17-2001, 12:21 PM
Everything seems broke!
(P4-1.4GHz, Voodoo 5500)

I can find my program using PROC and then use HWND *name* to determine the handle of the nag message, but when I try to use a breakpoint (BPM hwnd command) on the closing of the message box, SICE just never breaks.

I'm new to using SICE with Win2K, so any help here would be appreciated! (Is the list of wm_* commands correct?)

(All my *.dll files have been uncommented in the .DAT file. There aren't many for Win2K.)


A little help with SoftIce plz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A little help with SoftIce plz
PDA

View Full Version : A little help with SoftIce plz

Torque
08-17-2001, 12:28 PM
Hello,
I just got SoftIce and I have a few questions:
1)To follow the tutorial that they provide I have to make GDIDEMO using the provided makefile. They say use nmake but im on a win98 machine. Is there any way i can still make the application?
2)I was trying to follow a tut i found on the web and it said to set a breakpoint, bpx getdlgitemtexta, however when i try, softice says symbol undefined. What am i doing wrong?
3)What does the winice.dat file do? What should i do with it?
4)This maybe someone would know. I cant seem to get my mouse working eith softice. I have a microsoft intellipoint mouse but it just doesnt work with softice? I tried to use the mouse setup util but nothing worked. Anyone experience this as well?

Anyway, these are my questions. As u can see am am clearly a beginner. Hopefully u guys can help me out.

Thanx

Torque
CoDe_InSiDe
08-17-2001, 12:52 PM
Hi Torque,

Take a look at this link :)

http://c4nfaq.cjb.net

Cya...

CoDe_InSiDe
Bengaly
08-25-2001, 03:20 PM
hahahah In this case i agree with CoDe_ ;DD
matt
08-25-2001, 09:54 PM
winice.dat stores usefull softice initialization stuff.. you will probably need to edit it a bit if you are using anything but the windows2000 version of softice.

what i think the problem you're having is one described in the faq. type 'addr' in softice. and then 'addr program_to_be_hacked'.. then the breakpoints will have proper context or something ;) might work anyways
matt
08-25-2001, 09:55 PM
ok i read your post wrong.. just edit winice.dat and uncomment the proper lines. learn about it in the faq..

the other stuff i said though WILL probably become usefull if you have problems about 'breakpoints not working'


Need help with Hex Workshop plz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help with Hex Workshop plz
PDA

View Full Version : Need help with Hex Workshop plz

Torque
08-17-2001, 05:06 PM
Hello,
I was reading a tut on how to crack hex workshop. I have hex workshop 3.11 (from their website) and thought that it wouldnt be too difficult to follow the tut using a different version.
I tried to register, put in some phony reg number, and wrote down the message that hexworkshop gave me: Please check your key and try again. If this problem persists, please contact service@bpsoft.com.

I opened the program in wdasm and searched it for that text. However, to my surprise, I cant find it anywhere.

Please help me. I know Im probably doing something stupid but I am new at this and would appreciate any help you can give me.

Thank you

Torque
the snake
08-18-2001, 12:47 PM
Hi
Some or more of the protection is done in the "BPSREGWD.DLL".. If you're going to patch the program/dll, there is a checksome someware..
Good luck
the snake


Windows ME kernel not loading into SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Windows ME kernel not loading into SoftICE
PDA

View Full Version : Windows ME kernel not loading into SoftICE

Goat
08-17-2001, 05:07 PM
I'm not exactly sure how SoftICE detects Win API calls, but I can't set a BPX on anything on Windows Millennium. It has to be that OS because I've had the same problem with SoftICE v4.05 on two different systems with WinME. For instance:

:bpx GetDlgItemTextA
Symbol not defined (GETDLGITEMTEXTA)

Is the normal scenario for a breakpoint on any API. Also for those of you who had the problem, why can't I get SoftICE v4.25 to work on windows ME? After installing I reboot and my display is messed and I'm in Safe Mode. I know I'm doing the WinDDK stuff right because if I wasn't, how would SICE 4.05 work? :P

Anyway I've had this problem with SICE for quite some time and as you can see, that's a bit of a problem. :-/

Thanks.
Goat
08-17-2001, 05:14 PM
I should also say that I'm loading the programs in Symbol loader first so that's not the problem. :P
Goat
08-17-2001, 05:33 PM
OK LAST TIME!!
All the EXP= lines in my winice.dat (in the /windows directory of course) point to the right DLL's and are uncommented so it isn't that either. :/
xiaoxiaoc
08-18-2001, 01:51 AM
The file enable softice in the winme
Goat
08-18-2001, 02:27 PM
:) That did it. Thanks. Let me ask this, does Loader.exe also fix my problem with SoftICE 4.25?


who in here....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > who in here....
PDA

View Full Version : who in here....

DontKn0wMuch
08-17-2001, 07:19 PM
has used winhex 9.92 ? or has cracked it
Hz
08-17-2001, 07:30 PM
me :)
DontKn0wMuch
08-17-2001, 07:37 PM
i dont want to be a flaming newbie but...is there anyway that you could hook me up with the key or if you have created a keygen could you please post it? i am desperate for this program and i need it a.s.a.p. to get back the info on my "corrupted" hard drive. i know i sound retarded asking this but i need your help. thank you.

p.s. even if you dont want to give it to me i still find this board very interesting and will be reading it often
woodmann
08-17-2001, 08:11 PM
I am impressed.

Peace, Woodmann
DontKn0wMuch
08-17-2001, 08:27 PM
may i ask why ?
Hz
08-17-2001, 09:05 PM
Hiya,
Okay DontKn0wMuch my reply was a bit sarcastic and maybe unnecessary but hell, there is a big enough notice when you enter this board, "Don't insult our intelligence by asking for Cracks or Serials!". I do sympathise with your HD problem but handing out cr*acks/sn is not what its about here. The thing is all over the net, if you really need it and can't afford to pay
for it then the best advice I can give you is, search for it.
regards
DontKn0wMuch
08-17-2001, 09:35 PM
man, i have searched my balls off for the sn..cant find it anywhere. i can only find the older versions. so i try to find the older version of the program to go with the key and i cant. ive looked on irc (irc.dal.net) in all the crack/serial/warez chans. ive looked at every crack.ru page. ive even look on AOL (dont laugh). im looking as we speak. cant find it anywhere. if you have any other ideas im open for suggestions. i know that we are not supposed to ask for cracks...im not insulting anyones intelligence. hell, if i was so damn smart i would crack the thing myself but im not. thats why i ask you guys. i found this place in my search for the crack. i REALLY need this and i dont see paying $40 to use it once. can you guys help ?
Squidge
08-18-2001, 07:22 AM
Hi m8,

Download w32ds893, load the program into that. It's not compressed or encrypted, so just load it into the debugger and you'll soon the serial key, it took me about 5 minutes. (Type in two bogus codes into the register box, watch it compare them, and then type the real ones in).

If you have any problems, just ask in here.

DontKn0wMuch (08-17-2001 19:35):
man, i have searched my balls off for the sn..cant find it anywhere. i can only find the older versions. so i try to find the older version of the program to go with the key and i cant. ive looked on irc (irc.dal.net) in all the crack/serial/warez chans. ive looked at every crack.ru page. ive even look on AOL (dont laugh). im looking as we speak. cant find it anywhere. if you have any other ideas im open for suggestions. i know that we are not supposed to ask for cracks...im not insulting anyones intelligence. hell, if i was so damn smart i would crack the thing myself but im not. thats why i ask you guys. i found this place in my search for the crack. i REALLY need this and i dont see paying $40 to use it once. can you guys help ?
GodsJiva
08-18-2001, 09:24 AM
just pasting this from CORE's nfo on the rls... done by eGis, who I think we can trust ;)

***
WinHEX has limits if it is not registered:

(1) It can not edit files larger than 250KB. This could be patched wthout a working keyfile as I did before.

(2) It can not edit RAM.

(3) It can not edit disk sectors.

The limits of (2) and (3) can not be patched if you don't have a working keyfile. WinHEX will use your key to dynamically modify its code segment to decrypt some of code for editing RAM and disk sectors.

WinHEX also uses a random number generator designed by its author to decrypt the key. No direct compasion to validate if the key is correct. If your key is real, WinHEX is able to write disk and RAM, otherwise a GPF will greet you.

***

mebbe not so simple, squidge? ;-) bet ya didnt test yr serial :-D
DontKn0wMuch
08-18-2001, 03:03 PM
thank you gentlement for all your help. someone from here has e-mailed me the key gen, if you read this is would like to thank you, i greatly appreciate it. once i get my system up and running again i am going to start looking into all these reverse engineering programs and tutorials.

once again, thank you
Kayaker
08-19-2001, 10:56 PM
Man, I go on holiday for 3 days and I come back to this...

I've locked this thread but it will stay up for a while so the message gets across.

To all Newbies on this Forum:

There is a policy on this board that outright crack/serial/keygen/warez/hacking requests are not desired, make for extremely boring threads, and are insulting to those who are trying to contribute to create a quality board. It's a place meant for people to share knowledge and ideas about program reversing issues. Discussion of keygen creation is OK, but an outright request for a keygen is not.

You're welcome to learn and contribute here as long as the posts aren't target specific crack requests. Requests like this one are rated "L" for lame and will be deleted. Simple policy, simple to remove the post.

Regards,
Kayaker


newbie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbie
PDA

View Full Version : newbie

never give up
08-18-2001, 11:42 AM
Hi just joined got softice hex w\ shop downloaded some essays and going to try to get to grips with this


P-code-Satbuster
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > P-code-Satbuster
PDA

View Full Version : P-code-Satbuster

kassar
08-18-2001, 04:47 PM
i can't see strings in Wdasm (VBPatched,of course) for SATBUSTER (http://web.tiscali.it/satbuster/program/satbuster15demo_ita.zip).Is it due to p-code or section characteristics?.Help me I'm not a lamer: see my work on kassarfiles.da.ru


Nag Screen equivalent
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Nag Screen equivalent
PDA

View Full Version : Nag Screen equivalent

bratscher
08-18-2001, 05:08 PM
Hi.

I am dealing with a software that uses an alternative way to display a nag screen. Instead of making a "sorry no" nag window itself, the program uses the default web browser to display a *.html file saying "No, you cannot use me". I'm trying to find the place in the code where this program opens the "bugger off" htm file, but there are no explicit references to it in the dead listing of the program. I think finding the code where the program opens the nag-screen equivalent *.htm file is key to finding where the program decides good boy, bad boy.
May anybody suggest a way to catch a program opening a .html file?

thanks
the snake
08-18-2001, 11:31 PM
Hi
Try to break with "ShellExecuteA"...

The ShellExecute function opens or prints a specified file. The file can be an executable file or a document file. See ShellExecuteEx also.

HINSTANCE ShellExecute(

HWND hwnd, // handle to parent window
LPCTSTR lpOperation, // pointer to string that specifies operation to perform
LPCTSTR lpFile, // pointer to filename string
LPTSTR lpParameters, // pointer to string that specifies executable-file parameters
LPCTSTR lpDirectory, // pointer to string that specifies default directory
INT nShowCmd // whether file is shown when opened
);

I'm using it in my key-gens to sent the user to my homepage.
the snake


New kind of protection very used
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New kind of protection very used
PDA

View Full Version : New kind of protection very used

NikDH
08-19-2001, 06:32 AM
Hi guys,
lately i've noticed many progs when u click
on the about menu show something like this:
bla bla bla
licensed to:
----------------------------
Thats a fucking trial
Go register it
----------------------------

The ---- represent a panel and when it registers
it only changes the text inside it

So what have i to bpx to intercept what is it writing inside the panel ?
Whats the api responsable 4 the text writing inside panels?
DrawTextA() ?

Tnx a lot :)

See ya
NikDH
Kayaker
08-22-2001, 11:02 PM
Hi NikDH,

If it's an About box you're dealing with there's a good chance its a DialogBox. In which case the panel is likely a disabled edit control or a static text label.

The text of either control can be changed with SetDlgItemText. Or the application might send a message to the control with SendMessage or SendDlgItemMessage and a WM_SETTEXT message.

With this in mind you can look around the code for these calls. They may point to where the text can be rewritten.

DrawText or SetWindowText I think are more likely to be used if the about box was a regular Window rather than a DialogBox.

Hope this helps,

Kayaker


help me get set up for reverse project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help me get set up for reverse project
PDA

View Full Version : help me get set up for reverse project

meBigGuy
08-21-2001, 01:37 AM
I'll describe what I want to do:

I have a windows NT application installation package, but no NT to run it under. I can install it on NT (at work), but I then need to copy the files to my win95 junkpile to work on them.

Somewhere in the .dll's (I assume) there is a function I want to reverse.

So, the question is: what set of tools or what tool should I acquire to do this job.

(last time I did cracks it was 486/borland debugger days, and I've never tried to reverse a dll )

Any help will be appreciated.
Fake51
08-21-2001, 07:31 AM
The good old w32dasm and ida 4.xx should come in handy. Both should be easy to find. Look for w32dasm 8.9, and ida 4.04 which is free for download (unless you wanna spend some on 4.15).
meBigGuy
08-21-2001, 09:30 PM
thanks.... I'm on my way.


process patcher (r!isc)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > process patcher (r!isc)
PDA

View Full Version : process patcher (r!isc)

WoZX
08-22-2001, 01:50 AM
i have a packed program and have successfully cracked it manually using TRW2000 by patching the unpacked program in memory.

I decided to use r!sc process patcher to patch it everytime it runs, but it displays an error, 'process error: 15'.

any idea ?

thx.
thenite
08-22-2001, 07:25 AM
Hiya,
Correct me if I'm wrong, but I think that is not an error
of the process-patcher.
Your program is packed with ASProtect, which
CRCs the unpacked memory. Your loader patches the code
as soon as it is unpacked, so aspr detects it and
displays the nice "error no.15".
Try this trick:
The prog will store its modulehandle in some memory
of the data-section and this happens after the crc check.
Now you just have to make the loader to wait until
the modulehandle is written and then apply the mempatch.

The code could look like this:
push 0
call GetModuleHandleA
mov [00500000], eax

script for rpp:
p=500000/00,00,40,00/00,00,40,00: ;waits until handle is
;written and then goes to 'real' patch
p=crackaddr/origbytes/patchbytes:

hope this helps
cu
WoZX
08-22-2001, 09:31 PM
thx, but i think the program is packed using EXE Protector 1.37a, which currently does not have any unpacker available.

After searching and testing several process patcher, I found Process Patches 3.93 found in protools.cjb.net adequate, unfortunately it does not create .exe file, but it doesn't matter as long as it works :)


winsock API to bpx on ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > winsock API to bpx on ?
PDA

View Full Version : winsock API to bpx on ?

WoZX
08-22-2001, 02:56 AM
as above, as more and more proggie are "calling home".

any reference,links will be appreciated.

thx.
latigo
08-22-2001, 12:29 PM
bpx recv
bpx send

whatever.

Latigo


Where do I start with this one, Help please?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where do I start with this one, Help please?
PDA

View Full Version : Where do I start with this one, Help please?

forge-X
08-22-2001, 07:51 AM
HI Im newbie, Id like to learn how to create program patches, and cracks? Not for passwords or games but real, usefull programs.

Id really appreciate some starter points and or information on how to get started and what Ill need.
goatass
08-22-2001, 08:52 AM
learn assembly, good place to start is http://www.win32asm.com
it's the most important part, without knowing assembly forget about reversing, let alone writing patches for programs. Next read some tutorials about reversing, read everything you can find, even the old ones they still have good ideas in them. Some sites are: tsehp.cjb.net and zencrack2.cjb.net
Once you read and learned get some tools from http://www.programmerstools.com and start working on small shareware programs. Come back to this board with any questions you have. Once you think you are pretty comfortable with reversing and the tools you can start working on the bigger and harder applications.

good luck
goatass
forgex
08-22-2001, 09:38 AM
Thanks goatass!! This site is great, and to get a reply so quick....I'll be hanging around here a bit !!!!

Its good to see that you guys are so helpfull about all this, thanks!!!
goatass
08-22-2001, 10:39 AM
as long as you are willing to learn and show that you do your own work before asking we are willing to help. The more reversers the better, the more we all learn.

good luck
goatass
forge-X
08-22-2001, 11:50 PM
Well Iv read a fair bit and am still reading, Iv also got hold of a few of the programs that I'll be needing.

I wanted to get Softice running so i could throw a few things through it, to see what happens and help me understand some of the stuff im reading.

But I cant seam to get it working, how do I set it up. I'v found a few pieces of text on it but nothing that covers setup and operation?

I know its still down the road from where I am, but I find the hands on learning fits me best. Can you help?


how can I make a breakpoint while program is running in directx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how can I make a breakpoint while program is running in directx
PDA

View Full Version : how can I make a breakpoint while program is running in directx

lancelot
08-22-2001, 09:23 AM
something like mouse click ect.
Aimless
08-22-2001, 11:07 AM
Need answers ?

You need to be more specific. Your question is too vauge.

However...

If you are asking that ~ during ~ a directX game, you would like to capture the mouse clicks, then you need to first download the directX SDK from MSN (Documents and examples, will do. Not necessary to download the apps).

Understand how the mouse is programmed over there. Rest is easy. ICE can take care of the rest. Just one point though..

Make sure that if you want the breakpoint to occur, and ICE to be visible, you have the "FORCEPALATTE" option in the ICE settings as ON.

Have Phun
lancelot
08-22-2001, 11:20 PM
Thank you for replies.

yes it's a directx game, the game needs rigister code , and
can not use keyboard to type the code, just mouse can be
use, so I want to catch the mouse click.

sorry I'm poor in English,because English is not my mother
language.

Thanks again
matt
08-24-2001, 10:51 PM
couldnt you set a breakpoint on WM_LBUTTONDOWN?
The windows message for 'left mouse button is pressed down'..


Help with 16bit crippled prog please?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with 16bit crippled prog please?
PDA

View Full Version : Help with 16bit crippled prog please?

Scally
08-22-2001, 12:58 PM
Hi folks,
Could really use some guidance to point me in the right direction.
h*tp://mvsoft.com/pub/eqs/eqs57dem.zip
It's a 16bit app, which says its a demo but at least some of the code for the full version seems to be present. It creates an Ini file in c:\windows on installation but this never gets read on loading the demo (it is read in several functions such as 'about' and there is an annoying space for the serial)
There are numerous dll's but only two are read on loading xwmba423.dll & xwmte423.dll.
Save,print,cut & copy are menu disabled and there are limitations on the size of models the demo can produce.
At first I tried to get back to the protection via the 'can't print...' nag but just keep getting lost in the code - the first couple of conditional jumps don't seem to make a difference. I also tried bpxing on enablemenuitem & enable window but no luck.

Modifymenu is called on load from xwmba423.dll but again I kept getting lost in the code.
I tried stepping thru from the ep for the best part of a day :) but them thar codewoods..

Any help would be welcome
Scally
Scally
08-23-2001, 12:07 PM
Still no further with this one but I did manage to get back to the print menu select from the 'can't print' dialogbox breaking initially on 'dialogboxparam'.
The sequence of segments/files from the calls in the first part is:

Dmas.exe Seg 1:1301
Dmas.exe Seg 1:34c4
Dmas.exe Seg 15:4baa
Xwmba423 Seg 94:818
Xwmba423 Seg 13:22e
Xwmba423 Seg 94:830
Dmas.exe Seg 15:4bca
Xwmba423 Seg 87:07ac
Xwmba423 Seg 11:0000
Xwmba423 Seg 13:4b6
Xwmba423 Seg 11:0011
Xwmba423 Seg 87:07c9
Dmas.exe Seg 15:4c1b
Xwmba423 Seg 94:8e6
Xwmba423 Seg 13:22e
Xwmba423 Seg 94:8fe
Dmas.exe Seg 15:4c29
Dmas.exe Seg 1:34f1 etc.
I've tried to compare the sequence with the disabled controls like this one with a couple of good ones but can't see it.
Scally


C++ Programming Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > C++ Programming Question
PDA

View Full Version : C++ Programming Question

BGI 5x
08-22-2001, 04:21 PM
Hi, im coding in c++ but i found a problem i cant get a thing to work

i need to get the len of the serial if its less than 10 i add a "9" to the start of it, this was what i could do

length1=strlen(heh);
while (length1 != 10)
{
heh[length1]+=0x39;
length1++;
}

but this only add one "9" at the end of the string, the rest is filled with shit, if anyone can help. :(

tnx
BGI 5x
Clandestiny
08-22-2001, 06:01 PM
Hiya BGI 5X,

From your description, I'm not entirely sure what the serial algo is but I can explain why your code isn't working.

First your while statement...
If you're dealing with a condition where the serial length really must be "less than" 10, using the "not equals" operator is ambiguous and fails to correctly describe the situation. Whether the length is 1 or 100 it still remains != 10.

while(length1 != 10)
should be
while(length1 < 10)

Next, look at heh[length1] += 0x39;
length1++;

This explains your problem of 1 '9' at the end of the string and shit in the rest of it.

Length1, being the length of the string, will start to index the heh array at the last element of the string (which explains the '9'at the end of the string). Then, presumably because the array size of heh is longer than the actual string length, length1++ proceeds to index past the last element in the string into the remainder of the array. If you did not initialize the contents of the array when you delcared it, you will now be adding 0x39 to whatever crap is already in those memory locations beyond your string resulting in the shit of which you speak. I should also mention that if your serial length were to be greater than 10, the length1 variable would never == 10 and terminate the while loop... Infinite Loop == crash ;)

From your description, I'm not entirely sure of the serial algo. Are you adding the ascii value for 9 (0x39) to the existing ascii values of each element in the string or are you simply adding 9 (0x09)to the existing ascii values for the string elements. For the sake of example I'm going to assume you're adding 0x39. Also for this situation I would suggest a 'for' loop rather than a 'while' loop.

Example: If the serial length is less than 10 add 0x39 to each element in the string starting with the first element.

length1=strlen(heh);
if(length1 < 10)
{
for(int i=0; i<length1; i++)
heh[i]+=0x39;
}

Anyway, I hope this clears up a few of the bugs :) If you post more details of the algorithm you're trying to code, I'm sure either myself or someone else around here can help you with your C.

Regards,
Clandestiny
m0sk
08-22-2001, 06:16 PM
hmmm :-)

I don't know sh*t about C++, but my guess is you confuse C++ strings with C-style strings (character arrays actually)... If you declared heh as a char* or char[] (which seems to be the case, since you're using strlen()), then AFAIK, the snippet you gave is C, not C++. So the += operator is the plus assignment, not the concat operator ;-) That's why you see these strange things, explained by Clandestiny :p

Use concat() with c-style strings, and += with the C++ datatype string, but don't mix them...
m0sk
08-22-2001, 08:09 PM
hmmm :-)

I don't know sh*t about C++, but my guess is you confuse C++ strings with C-style strings (character arrays actually)... If you declared heh as a char* or char[] (which seems to be the case, since you're using strlen()), then AFAIK, the snippet you gave is C, not C++. So the += operator is the plus assignment, not the concat operator ;-) That's why you see these strange things, explained by Clandestiny :p

Use concat() with c-style strings, and += with the C++ datatype string, but don't mix them...
BGI 5x
08-22-2001, 09:35 PM
Hello All

here is a resume

the program makes a checksum with name this checksum is X chars
suppose X = 6 chars (ABCDEF)
then the program will add a 0x39 at the start of ABCDEF until it gets 10
so in this case it'll be 9999ABCDEF

Clandestiny, I tried using your code and it didnt work, then i debugged it and say that it was adding 0x39 to the already made checksum :/

maybe this is coz what m0sk said about heh[i]+

btw Im using visual c++ 6.0.

if you didnt understand the algo i can explain again.

thanks
BGI 5x
Wizard
08-23-2001, 03:12 AM
non-optimised 'C' program :

#include <stdio.h>
#include <string.h>

int main(void)
{
char szSerial[50];
char szBuffer[50];

printf("Serial : ");
gets(szSerial);

while (strlen(szSerial)<10)
{
strcpy(szBuffer,"9");
strcat(szBuffer,szSerial);
strcpy(szSerial,szBuffer);
}

printf("New serial = %s",szSerial);
getchar();

return 0;
}

Wizard
BGI 5x
08-23-2001, 03:50 AM
yes, thats it Wizard, thanks a lot.
tnx all that helped
anon
08-28-2001, 12:14 AM
Two Lines:

for(int i=0; i<(10-OldSerialLength);NewSerial[i++]);
for(int j=0; NewSerial[i++]=OldSerial[j++];);
anon
08-28-2001, 12:16 AM
anon (08-27-2001 22:14):
Two Lines:

for(int i=0; i<(10-OldSerialLength);NewSerial[i++]);
for(int j=0; NewSerial[i++]=OldSerial[j++];);

oops last statement in first for loop needs to be

" NewSerial[i++]='9' "
Wizard
08-28-2001, 02:48 AM
for(int i=0; i<(10-OldSerialLength);NewSerial[i++]='9');
for(int j=0; j<OldSerialLength+1;NewSerial[i++]=OldSerial[j++]);

... would be better ;)

Wizard
FatHead_Slim
08-30-2001, 03:00 PM
Were did my "i" go?

need to declare i outside of first loop cause its referanced in second

int i=0;
while( i<(10-OldSerialLength);NewSerial[i++]='9');
for(int j=0; j<OldSerialLength+1;NewSerial[i++]=OldSerial[j++]);
qferret
08-30-2001, 08:18 PM
...same routine...loop 2 is within loop 1 ....i is considered local for both loops (nested for loops)
Wizard
08-31-2001, 02:20 AM
"need to declare i outside of first loop cause its referanced in second"

Wrong, you don't *need* to : it depends on your compiler settings.

Anon (corrected) code perfectly works with VC++ default settings.

Wizard


Bryce 5 - vbox 4.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Bryce 5 - vbox 4.5
PDA

View Full Version : Bryce 5 - vbox 4.5

MH2K
08-23-2001, 04:50 AM
Hi there,
i'm quite new to reversing and up till now have only made cracks using wdasm. Now I would like to move on and try softice. My target is bryce 5 trial which is vbox protected. I've read +tsehp's tut on it and I it might be a bit too much for me, but a try never hurts ;)
When I try running vbox together with sice 4.05 or trw2000 I get a pirating message and it won't run. Also newest procdump gives an error when dumping.
Do I need some additions to sice to keep it from being detected?
Any comments are welcome

Tnx, MH2K
MH2K
08-23-2001, 05:00 AM
btw the packed executable is 5Mb alone, so a vbox removed exe will probably not show up as a crack.
Doing it yourself is much more rewarding anyway :)

to +Tsehp: Amok has released a great utility to remove the vbox (also version 4.5) related files and reg-entries, so 30-day trial is reset. Downside is you have to reinstall :(
vbox cleaner 1.0 util can be downloaded from their website

CU, MH2K
Fake51
08-23-2001, 07:35 AM
Use Icedump, frog's ice or conutless others to hide s-ice. Or do it manually and learn: either download frogs ice and check the doc that comes with it, or find some info on anti-softice trix. The last option is ofcourse recommended.

Fake


help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help
PDA

View Full Version : help

Samurai Joe
08-23-2001, 05:32 AM
how do i comment on files? it would probably help me a LOT. i am having a lot of trouble cracking anything because i get lost in the code. im using trw 1.23, w32dasm 8.7/ida 4.15 and hiew if it helps at all.
Tech19
08-23-2001, 08:37 AM
In Ida you can press Shift+; or alternatively select Edit|Comments|Enter Comments. I'm not sure about W32Dasm, I think you could probably edit the *.Alf file in a text editor if you save your project. I don't have trw 1.23 either.
Hoof Arted
08-23-2001, 08:55 AM
In OllyDbg, you press ; and enter comment. Comments are retained between sessions.
Samurai Joe
08-24-2001, 02:08 AM
Thanks guys. it helped a lot. i actually cracked something. *woohoo*


HMEMCPY
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HMEMCPY
PDA

View Full Version : HMEMCPY

Tech19
08-23-2001, 11:04 AM
When I try to set a breakpoint on HMEMCPY softice says Symbol not Defined. Some tutorials I am trying to complete use this breakpoint so I was wondering if anyone could help me out.
Scally
08-23-2001, 12:17 PM
Have you removed the semi-colon from in front of the exp statements in winice.dat?
It should look something like:
EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=C:\windows\system\vb40032.dll
EXP=C:\windows\system\msvbvm60.dll
EXP=c:\windows\system\advapi32.dll
EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
Scally
Solomon
08-24-2001, 03:35 AM
HMEMCPY is only for Win9x/ME. It can't be found in WinNT/2K/XP.
Tech 19
08-24-2001, 05:52 AM
Ok thanks, I have win2k so thats why it wasn't working. I got memcpy working so that must probably be the win2k version
HiTecCrkn
08-28-2001, 04:44 AM
Is MEMCPY working fine as a replacement to HMEMCPY
jeppe
12-10-2001, 11:31 AM
NO!
npcracker
12-10-2001, 10:30 PM
hi buddy

can someone tell me the equivalent of hmemcpy in Win NT/2K/XP.
i will be glad to know that
Solomon
12-10-2001, 11:05 PM
unfortunately there is no such equivalent:D due to the difference of kernel code.

Actually ANY appropriate API can be used as a breakpoint.

I know some guys relies heavily on this hmemcpy in Win9x, but they have to forget it in WinNT/2k/XP. There may be some pain when they move from Win9x to WinNT.

The best way is to learn Win32 API programming first, then they will know what are the appropriate breakpoints.:)

To learn Win32 API programming is to learn how your target works.:D

Am I right?;)
jeppe
12-11-2001, 09:53 AM
I wanted to crack a vb4 prog in w2k, but all the tutorials use hmemcpy. I tried memcpy and lots of other things. Nothing worked.

I solved everything by exporting vb40032.dll in winice.dat
Used softsnoop to check which API's to breakpoint
Then I bp'd all those rtc-functions.

Hey! At least it worked!
npcracker
12-11-2001, 11:44 PM
thanx Solomon
u r right ;) ;)
JMI
12-12-2001, 01:40 AM
I'm just kind of wondering why some of you are using ArthaXerXes
avatar? It's kind of like using someone's nick. We also have someone using +Splaj's old avatar, but at least it's not his current one. Imitation is the highest form of flattery, but this goes against the grain some how. Just my 2 cents.
+SplAj
12-12-2001, 05:41 AM
Avatar sharing is no prob for me. The fee is $10 per message :D

Hehehe , no one wants to use my new 'heads-up' avatar :p

BTW 1) whats hmemcpy ?

BTW 2) I am beginning to wonder wtf is going to happen to you guys without icedump vxd on XP ? no /tracex .....no hiding //./NTICE.... better start learning to patch the ntice.sys !

Spl/\j
jeppe
12-13-2001, 05:07 AM
Sorry?
I'm kind of new here, I just picked the first avatar offered...
Didn't know they were personal. Now I do. Didn't even know what it meant, besides "avenger" that is. I guess It's the little picture to the left. I'll remove it when I learn how to do that:cool:

So I'll have to make a picture I guess.
+SplAj
12-13-2001, 06:44 AM
If you want to see how some 'avatars' really ah-erm 'enhance' a MB :-

h**p://board.iexbeta.com/

especially the flame section :rolleyes:


reg'd then unreg'd
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > reg'd then unreg'd
PDA

View Full Version : reg'd then unreg'd

devOnair
08-23-2001, 01:21 PM
Okay - say (hypothetickally speaking, of course) one has cracked some prog so that any ol' garbage typed in the name and serial gets the glorious "Thank You for Registering" screen and access to all features. Kewl. However when one closes then reopens the prog, it's unregistered again :-( Sure it's easy to register every time, but that's a nuisance, dig... Can anyone point me to a tute or offer advice on keeping the thing reg'd? I'd appreciate it.
Thanx.
D.
pretender[zERo]
08-23-2001, 02:20 PM
what programm?
it no use if you only change JZ to JMP(or other),
the best way is get the right register code
Hoof Arted
08-24-2001, 02:55 AM
Most apps like that do a check for the stored name and serial which is usually located in the registry. You can use something like Regmon to see which reg keys are being accessed.

When you enter your code, it writes that code to the reg. When the app starts up again, it reads this code again and re-calculates that the serial is wrong, thus, unregistering itself. You need to find the second serial check and disable that one too..

Hoof
[yAtEs]
08-24-2001, 08:23 AM
change the jump back then patch the code in the call above to make it return so that the jump is successful,... if there is a call of course. more than likey this call will be used again at the start of the program for further validation

regards, yates.


Programming Problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Programming Problems
PDA

View Full Version : Programming Problems

BGI 5x
08-24-2001, 05:56 AM
Hello all,

I've a big problem, i get the program and get its algo i can even make a serial manually, but i can't code the algo in a programming language, the only i know a little are c++ using winapi and asm, can anyone point me to something that'll help me..like a book..hints, etc

(i think i dont understand the loop things right, like the "for" that is very used)
I dont know too what variable should i declare for a specific case :/

Thanks,
BGI 5x
Clandestiny
08-24-2001, 06:51 PM
Hiya,

Well, I have the e-text version of Thinking in C++ by Bruce Eckel. I can send it to you if you're interested.

If you want to buy a really good *basic* C programming book, I'd *highly* reccommend "C By Dissection" by Kelly and Ira Pohl. That was the book I used when I started learning C programming and it goes over basic concepts like loop structures and pointers in great, easy to understand detail. Also, I'd suggest learning C before trying to dig too deeply into the "object oriented" intricacies of C++. Once you learn C, the gap between programming win32 in C and programming win32 in ASM is surprisingly easy to bridge.

For asm, I'd highly reccommend Art of Assembly, also available in e-text form. Oh, and there is Sam's Teach Yourself C++ In 21 Days. Both of these are available at the protools site (protools.cjb.net).

Iczelion's win32 asm tuts are excellent as well, but more from a win API perspective than general programming logic and constructs. You can check those out at win32asm.cjb.net.

IMO, C is a great language but if you're learning to program solely for RCE purposes, you should probably learn ASM first since programming it will reinforce what you're seeing in SoftICE. Often its even possible to rip out part of the key generation code from your target and insert it into your own key-generator with a few modifications (the lazy man's way ;)

Regards,
Clandestiny
BGI 5x
08-25-2001, 06:37 AM
i've wrote lots of things but when i tried to send i got an error :( now my message is lost and im leaving for work, can you please mail the book to bgicrk@usa.net ?

tnx in advance
BGI 5x
Clandestiny
08-25-2001, 09:28 AM
Hiya,

I attempted to send the book to the address you indicated, but it bounced back with the following error message...

Unable to Deliver to the following recipient(s).
<bgicrk@usa.net>:
mxpool01.netaddress.usa.net:550 <bgicrk@usa.net>... User has cancelled

The file is 1.65 megs zipped. Possibly this is too big for your email account ? What is the maximum size attachment you're able to recieve ?

Regards,
Clandestiny
BGI 5x
08-25-2001, 09:58 AM
Increased space (32MB total!)

bgicrk@hushmail.com

im sure this will work :-/ sorry for the problem at usa.net i just subscribed some days ago.

btw, i can understand asm but i feel i need to code sometime in c++, not just rip the asm and compile, as im doing these days.

Thanks Clandestiny


Start Code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Start Code
PDA

View Full Version : Start Code

Tech19
08-24-2001, 02:30 PM
How can I get softice to go to the first line of code for a program?
Argoth
08-24-2001, 04:53 PM
If u use your softICE launcher, it will get you to the first line of code. You can also disassemble the .EXE and see what's the first line of code and bpx that line.

Grtz

Argoth
Clandestiny
08-24-2001, 06:58 PM
It's also possible that you might need to change the section characteristics of the code section to E0000020 in a PE editor to get SoftICE to properly break at program entry.

If the prog will not break at entry when you load it up in the SI Loader, this would be the next logical thing to check.

Regards,
Clandestiny


Breakpoint problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Breakpoint problems
PDA

View Full Version : Breakpoint problems

matt
08-24-2001, 11:00 PM
I am having a problem with Softice where the breakpoints aren't working! This is the NT version of softice btw.. I have had this problem for a while, so I got the example program that comes with Masm32, called MessageBox ;).. set a breakpoint on MessageBoxA, which I for sure know that it calls... and run the program - however softice does nothing! I didn't get a symbol not defined error.. so what could be wrong?

I was running halflife though and i set a breakpoint on WM_LBUTTONDOWN and it worked fine, so at least it works a little bit..

Perhaps breakpoints are process specific??

Thanks, in advance. Matt.
qferret
08-25-2001, 04:35 PM
[quote]matt (08-24-2001 21:00):
so I got the example program that comes with Masm32, called MessageBox ;).. set a breakpoint on MessageBoxA, which I for sure know that it calls... quote]

For SURE? ....I didn't check, but r u sure it doesn't just call MessageBox and not MessageBoxA? (1 is 16 bit....the one with the "a" at the end is 32 bit)
matt
08-25-2001, 09:20 PM
Well, I checked the source code, and it called MessageBox.. however, when I ran it using softsnoop, softsnoop said that it called messageboxa.. And when I try and set a breakpoint for messagebox in softice it says symbol not defined.

I dont think windows2000 would export a 16bit function.

But if i still need to set a breakpoint for MessageBox, how do I 'define the symbol'?
matt
08-25-2001, 09:51 PM
Ok i dissassembled it and it IS calling MessageBoxA, and after I read the #c4n faq i learnt that I might need to set something up for the breakpoints to work.. so i am going to set a breakpoint for program entry - use 'addr msgbox' (the name of the program), then set bpx messageboxa.. that might work
matt
08-25-2001, 11:25 PM
but it didn't.. anybody have any ideas?

maybe a reinstall of ice
matt
08-25-2001, 11:26 PM
but it didn't.. anybody have any ideas?

maybe a reinstall of ice
frustrated
08-25-2001, 11:53 PM
Just out of curiosity, did you see any messagebox produced by the program you want to run in softice? When you say the breakpoint doesn't work, has there been at any point of time when you set the breakpoint, the breakpoint doesn't break and you see a real messagebox?
matt
08-26-2001, 03:32 AM
I've been testing Softice on two programs. So far the breakpoints havent worked. I dissassembled both and found out that they both called MessageBoxA, - one ONLY called it, it was an example win32 programming project, and the other called it when you entered an invalid registration.

The breakpoint is always set, and I always see the messagebox, and softice doesnt catch it.
matt
08-26-2001, 03:34 AM
Curiously the symbol loader doesnt load the symbols, and doesnt break at winmain like it should.

I could be something to do with my system configuration. But I don't know what.
frustrated
08-26-2001, 04:35 AM
in this case, try this.
after you disassemble one of that program you want, and you know where the messagebox is at, set a breakpoint near it. Don't set it on a API. Just one of the addresses close to the messagebox. To do that however, you might have to gain entry into the program's thread 1st. That is up to you to figure.

Then trace to the messagebox and see what is shown in softice and trace into that call and see what causes the messagebox. Is it user32.dll like other gates' OS or some other weird dlls? I don't use win2k so that's all I can think of to help.
matt
08-26-2001, 09:38 PM
maybe the fact that typing 'sym' in softice returns 'No symbol table' means something?
isotope
08-27-2001, 05:18 AM
You are not alone!

I've been working with SIce for years, but recently switched to Win2K SP2. SIce sorta works for me too. Especially in the message box area. I can't get it to do anything. A second problem here is that the API names appear to be different than any other version of windows. I downloaded the 180MB symbol tables from M$ and installed, but SIce can't seem to translate the information without producing an error every other line in the file.

I'm assuming that others have over come this problem or just went back to Win98. Me? I guess I'll just have to start waiting for someone else to fix the programs. It was just a hobby anyway.

Good luck.
matthew
08-28-2001, 01:02 AM
Well I got the symbols to load properly, except for user32 and shell32 (yes they are main ones!). But it didnt matter because nothing worked anyways - and they should have worked because of the exports loading (?).. oh well.

I'm burning a cd that will have win98SE. masm32, tasm5, virus zines, windows ebooks, sandman and orc cracking tutorials, directx and some other driver updates, plus some apps like winrar etc.

Win98 is only taking up 400 megabytes for some reason so I can still cram a lot of stuff onto that 700 meg cd-rom.

After the cd is set up it should only take 1 hour to have the computer fully setup.

I'll miss things about windows 2000 though ;( I could disable and install networking protocols without rebooting.. lots of little enhancments .. but compatibility was a big issue. Win98 will be ok.

BTW the main problem with win2k would be the build of your version. mine was unsupported mostly which sucks ;(


newbie prob: devoid of refz...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbie prob: devoid of refz...
PDA

View Full Version : newbie prob: devoid of refz...

devOnair
08-24-2001, 02:01 PM
Thanx to all who helped me with my last little sticky wicket. Useful adVICE, all. Here's another conundrum I have faced too many times to count: I open up a proggie, type in name and ser #, write down the error message, like a good lil cracker, then fire up 32dasm, disassemble said proggie, and -dragimundo- no string refs a 'tall... Any tutes or advice for dealing with these suckers? Again, I'd appreciate it.
D.
Clandestiny
08-24-2001, 07:07 PM
Hiya,

Your target is probably packed. That would account for the lack of string references.

PS. This thread is probably more suited to the newbie's forum.

Regards,
Clandestiny
devOnair
08-24-2001, 07:23 PM
Clandestiny,

Apopolologiez.. Meant to post that in the newbies forum. Shows what little I know. Thanx for the help though.

D.


javascript
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > javascript
PDA

View Full Version : javascript

SwootH
08-26-2001, 07:10 AM
Hey,

Not quit sure that this is the right forum to ask this question ;D

But I'll give it a try

I am really a newbie, i am the newbie of the newbies, and this is my question

I am working on a site about the soccer team of my friends, caus i allways have problems with the resolution of the users, i decided to use frames, only there is one problem.
I am using a menu, cool menu(=that's the name :D), everything worked fine till i wanted to change the urls. This is the code of my menu:

<table bgcolor="black" border="1" bordercolor="#124581" cellpadding="2" cellspacing="0">

<tr>
<td width="165" height="30"class="menu" bordercolor="black" id="choice1" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice1,'Back Home')" onmouseout="moveout(choice1)" onclick="location.href='http://www.javafile.com'" target="head">
<center>Home</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice2" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice2,'De Stand')" onmouseout="moveout(choice2)" onclick="location.href='http://www.10mbfree.com/lange/home.html'">
<center>Competitie</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice3" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice3,'Laatste wedstijd')" onmouseout="moveout(choice3)" onclick="location.href='http://www.bravenet.com'"><center>Verslag</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice4" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice4,'Fixtures')" onmouseout="moveout(choice4)" onclick="location.href='http://www.bravenet.com'"><center>Schema</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice5" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice5,'Fotos+Stats')" onmouseout="moveout(choice5)" onclick="location.href='http://www.linkcounter.com/ea.exe?ref&claeld&1'"><center>De Spelers</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice6" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice6,'De Trots')" onmouseout="moveout(choice6)" onclick="location.href='http://www.linkcounter.com/ea.exe?ref&claeld&1'"><center>Het Stadion</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice7" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice7,'Poll vd week')" onmouseout="moveout(choice7)" onclick="location.href='http://www.linkcounter.com/ea.exe?ref&claeld&1'"><center>De Mini Poll</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice8" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice8,'Commentaar?')" onmouseout="moveout(choice8)" onclick="location.href='http://www.linkcounter.com/ea.exe?ref&claeld&1'"><center>Het Forum</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice9" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice9,'Defend het Doel!')" onmouseout="moveout(choice9)" onclick="location.href='http://www.linkcounter.com/ea.exe?ref&claeld&1'"><center>Voetbal Spel</center></td></tr>

<td class="menu" height="30" bordercolor="black" id="choice10" style="background-color:#ffffff; cursor:hand" onmouseover="movein(choice10,'Op/Aanmerkingen')" onmouseout="moveout(choice10)" onclick="location.href='http://www.linkcounter.com/ea.exe?ref&claeld&1'"><center>Contact</center></td></tr>

<tr>
<td bordercolor="black" bgcolor="#124581" height="28"><center><font id="description" face="Verdana" size="5" color="white"></font></td></tr>
</table>

This doesn't look to difficult does it?

The menu is in the left frame and there is also a right frame, where i want to display the content. So i have to use targets.
I tried this:
"location.href='http://www.javafile.com'" target="head">
But with this the page i want to open doesn't open in the head frame but in the nav frame, the frame of my menu.

Does anyone no what i have to change or correct?

Thanks in advance,

EbboRazor
Wizard
08-27-2001, 02:34 AM
May I suggest :

http://rummelplatz.uni-mannheim.de/~skoch/js/part3/part3.htm#js

Wizard


WinTack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > WinTack
PDA

View Full Version : WinTack

Squidge
08-26-2001, 08:59 AM
Does anyone have any experience with WinTack? It seems to be a packed file with a checksum, but I'm not sure which protector (or packer) was used as I can't find any signature that matches the popular packers.

There's hardly any text available in the exe which makes me think it's compressed, and changing one byte gives a messagebox with the message "File Corrupted!". Anyone know which packer this string comes from?

You can get WinTack from ht*p://www.tucows.com
CoDe_InSiDe
08-26-2001, 09:07 AM
Hi Squidge,

You can try on programmerstool.com to get some identifying program like GetType or something :)
Or just Manually Unpack it the program ;)

Cya...

CoDe_InSiDe


different EIP at different PC ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > different EIP at different PC ?
PDA

View Full Version : different EIP at different PC ?

WoZX
08-26-2001, 09:43 AM
i use TRW2000 to debug a packed program, i got the CS:EIP address to patch, so the bpx always work, but it only worked on that PC, when i use TRW2000 in another PC debugging the same program, my bpx doesn't work ?

anyone can help ??? and tell me why?
WoZX
08-26-2001, 09:47 AM
btw, i got the hex code, since i do not know the exact new EIP, how do i 'bpx' in trw2000 ?

i have seen a tute like this but have forgot where it was, like this:

bpx cs:eip IF *(EIP) == ????????

can't really remember the syntax, help please !!!


Kernel.dos3call Api?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Kernel.dos3call Api?
PDA

View Full Version : Kernel.dos3call Api?

Scally
08-26-2001, 12:00 PM
Can anyone tell me what this does, please. I's tied up with a condx jmp to int21.
TIA
Scally


Asprotect and time trial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect and time trial
PDA

View Full Version : Asprotect and time trial

NikDH
08-26-2001, 04:19 PM
One of the most common used lately is the asprotect + time trial of 30 days

I spent a lot of time in studying it but i shouldnt find a standard way to crack all of them

I'd like to listen to ur experience with this kinda protection and perhaps write a great tute about it

If u wanna explain ur experience about this kinda protection write it here and i'll discuss it with u
I can give my little experience about it

See ya
NikDH


Anyone else ran the "sims_nude(1).exe" trojan?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anyone else ran the "sims_nude(1).exe" trojan?
PDA

View Full Version : Anyone else ran the "sims_nude(1).exe" trojan?

myAvatar
08-26-2001, 06:36 PM
Hey,
I've search the web, and the virus sites, but havent found any info on this yet.

The file didnt "seem" to do anything when I ran it (it has a generic EXE icon). But right after my firewall software popped up saying that "regedit" was trying to contact a website on the SMTP port.

Now every time my PC boots, the regedit process is running (two processes actually, under the main program). Neither of which are visible in any taskbar/ALT+TAB'ing.

I disected the file... and it appears to be in VB5 :) It keeps creating a file in C:\windows called "99334.exe". I deleted it 5 times, and it immediately reappeared. I tried to disassemble it, and it says its not recognized as a valid file format. So I opened it in HIEW, and I saw the text "[m52 aol password logger]" (and that's all).

Any ideas? Anyone want it to look at it? Any places I should've searched for info on it but didnt? (I searched via google, and on the NAI website).

Regards,
myAvatar
myA
08-26-2001, 06:52 PM
Hopefully someone will kill the second thread I started.

So, the correct filename (as I downloaded it) is "nude_sims(1).exe".

Some more info I've found. It (or actually regedit.exe) is continuously enabling an autodial key in the registry, then checking the list of service providers (DUN connectoids?) that i have (but it never tries to dial, that I've noticed... the lights on my hardware modem havent changed since its installed).

myA
myA
08-26-2001, 07:01 PM
Some more info, in the same dir that I downloaded the nude sims file to are two other files, both ending in .dat. They both start as "kazadownload" then a seemingly random string of numbers. The file was downloaded via morpheus (file shareing program).

One of these .dat files ("kazaadownload998869459180662.dat") has the same text at the beginning of it, "[m52 aol password logger]"... it is then followed by what appears to be Javascript...

-=CODE START=-
var agent_isIE = 0;

var agent_Major = '5';
var L_H_APP='MSN Search';
var H_URL_BASE='http://help.msn.com/EN_US';
var H_CONFIG='searchv3.ini';
var bSearch=true;
var H_BRAND='';
var H_FILTER='';
var H_TOPIC='';
var bScreen=false;
var L_H_TEXT='MSN Search';
if( ( navigator.userAgent.indexOf("Nav") > 0 ) || ( navigator.userAgent.indexOf("Mozilla/4.5") > -1 ) ){
var agent_isNS = 1;
} else {
var agent_isNS = 0
}
if(navigator.userAgent.indexOf("Mac") > 0){
var agent_isMac = 1;
} else {
var agent_isMac = 0;
}
var agent_isAOL = 0;
H_KEY = 'srch_rslts';
if( navigator.appVersion.indexOf("4.")>=0) bScreen=true;
// Wrapper function to allow me to modify the variables in the Help call and not have to set global variables to do so
//
// fWrapHelp( IN v_bSearch, IN v_H_KEY, IN v_L_H_TEXT )
// WHERE
// v_bSearch = boolean value identifying whether this is a search in help or a topic
// v_H_KEY = if v_bSearch is false, then this is a topic, else it is a secret keyword
// v_L_H_TEXT = if v_bSearch is false, then it's ignored, else it is a localized string displayed in UI
function fWrapHelp( v_bSearch, v_H_KEY, v_L_H_TEXT )
{
//Set each var and then call DoHelp()
//If a Search in enabled, then we need a KEY and TEXT values, otherwise it's a topic and we just need TOPIC
if( v_bSearch )
{
bSearch = v_bSearch;
H_KEY = v_H_KEY;
L_H_TEXT = v_L_H_TEXT;
} else {
H_TOPIC = v_H_KEY;
bSearch = v_bSearch;
}
DoHelp();
bSearch = true;
}
function newUrl()
{
var strID = document.all.item("q").value;
if (strID == "")
{
window.alert("Please type the word or words you wish to search for in the Search box.");
SetFocus();
}else{
if (strID.indexOf("://") < 1)
{
strID = "http://" + strID;
}
self.location = strID;
}
}
function SetFocus(objMT)
{
document.all.item("q").focus();
}
function tooltip()
{
document.all.item("tips").style.display = "";
}
-=CODE END=-
myA
08-26-2001, 07:05 PM
The file mentioned above (with the JS code) seems to be partial HTML from searches I have done (or partial HTML from IE windows that have been opened, because one references the Morpheus main page, and Morpheus itself uses IE).


KeyLib16/32
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > KeyLib16/32
PDA

View Full Version : KeyLib16/32

JohnnyBoy
08-27-2001, 02:15 AM
Anyone who has hints about how to crack a program protected by keylib16.
In my case the program is written in VB3.
I have used Dodi VB decompiler and found som ineresting functions and what values they should return.
How can I set breakpoints on functions inside KeyLib16.dll? (=pp_tcode)
(I use TRW200 and/or SI)
The DLLs are from the company h**p://www.softwarekey.com/
Eeth
08-31-2001, 02:29 PM
Sorry for replying that late, but was too busy. The keylib type of protection is quite easy to defeat. i reversed it a few months ago. first of all i advise you to get the protection api documentation from their web/ftp-site. they have well documentated how to call their functions and what they. there are several weaknesses how to get around the protection. first of all you can just patch the dll. but more elegantly: code a proxy dll which handles all the calls and always replies that the app is registered. only the calls to vital functions like the checksums will be routed through to the original dll. but, as i guess it's not really an answer to your question.
JohnnyBoy
09-11-2001, 05:01 AM
I got all the documentation about keylib32. Hope its the same for the 16 bit version.
How do I get breakpoints on the functions inside the DLL. SI & TRW do not accept my tries. (pp_tcode for example)
If you have done this. Is it possible that you can guide me thru in small steps. I do NOT want the hole solution. I want to learn something aswell.
JohnnyBoy
09-12-2001, 06:35 AM
Added Keylib16.dll to winice.dat
Still not possible to set a breakpoint at pp_tcode.
Tried w32dasm on keylib16.dll to se if I spelled something wrong. The function is there.
If I look at the VB3 program with w32dasm I cant see thet it is using keylib16 :confused: Is this because it runs thru VBRUN300.dll:confused:
Other functions used is pp_compno, pp_copyadd
Solomon
09-13-2001, 04:19 AM
Can 32-bit SoftICE symbol loader deal with the 16-bit dll symbols?

I just wonder.


Redundant Checking & malicious consequences
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Redundant Checking & malicious consequences
PDA

View Full Version : Redundant Checking & malicious consequences

dzzie
08-27-2001, 02:42 AM
hiya,

thought i draw on the experience of others here for somthing...namely

how common is it to have a programmer code in a redundant check which when fails results in either a malicious function (like drive filling of deleting) or some attempt at author notification (like fireing up your browser to a special cgi script with whatever personal info he could scavange from you) ?

or am i just paranoid to unplug from the lan when goofing around? :)

would be intrested in hearing of any progs know to do this and how common a practice it is.
aimless
08-27-2001, 05:51 AM
Hullo,

Not really. Since the past Win 9X programs, no one does the above mentioned. However, with more and more hackers/crackers/phreakers getting jobs like 'Security Consultant', 'Firewall Admin', or even absorbed into Anti-Virus S/w companies, you can assume that this will be on the rise.

However, malacious code will be to the extent of internet, not the "delete-the-friggin'-hdd' kind. For the simple reason that the companies indulging in the latter kind of tend to get very clumsy when explaining to the law, or even the local Consumer complaint forum as to why they fried the HDD of a particular person. It is bad publicity. Though the company may then spend millions convincing people, normals will not buy the program and corporates will shy away as a result of the "of-course-its-legal-but-it-COULD-happen-to-me-too" syndrome. Hence, the company will try its utmost to do the malacious code to sending messages on the internet. My idea of breaking is to do it on a machine that's not connected to LAN/Internet, or if you MUST, then atleast disable them by removing the goddam plugs !!

However, be very careful of the hacker tools, or tools that are really really specialist. The makers of these tools have guaranteed market and would give a rat's ass to complaints from the law and Consumers, if they DID indeed fried your HDD.

But commerical companies ? Nope. Remove the NET and the LAN, and you're pretty much on good grounds.

Have Phun
Tech19
08-27-2001, 04:25 PM
I've got a program that simply restarts the computer if a check fails. It's kinda annoying >(
Tech19
08-27-2001, 10:12 PM
Id recommend tiny personal firewall (websearch it).

At the click of a button you can save yourself much hassle and prohibit any network traffic from going beyond localhost :-)

regards

Carp
Carpathia
08-27-2001, 10:15 PM
It seems this board has a nasty cookie problem. I just noticed after making that post that I was logged in as Tech19.

After I manually log out it then reverted to my usual nick.


vbox time keeper
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vbox time keeper
PDA

View Full Version : vbox time keeper

Peronospora
08-27-2001, 12:07 PM
I'm looking at Corel's Knockout 30 day trial protected by vbox 4.3. In particular, at this point, I'm trying to find where vbox hides it's time counter. I've tracked with Regmon and Filemon to no avail. I used Amok's vbox cleaner 1.0 to scan and remove vbox files but when prog reinstalled the day countdown remained the same.
As an aside, why can't I disassemble prog. with w32asm - just hangs. I've heard this description by others with challenged by vbox.

Any clues?

P
Peronospora
08-28-2001, 01:16 AM
Nevermind. Found it!

Thanks anyway,

P
Hemo
08-28-2001, 03:38 AM
I've faced the same problem. Since you found the solution, could
you please tell it to me also.

Thanks in advance,
Hemo
jomamameister
08-29-2001, 08:23 PM
vbox places license files in the c:\windows\vbox usually and are hashed dates.
jomamameister
Peronospora
08-30-2001, 10:37 AM
Deleting the licence files doesn't reset the time counter. As far as I can see, there are two vbox entries that need to be deleted (deleting just one or the other doesn't do it). One is a *.bin file in the root directory (C:\) (for Knockout it's os683439.bin - though this likely varies, and the other is a registry entry HCR/CLSID/615557C3.....
-again this probably varies from prog to prog.

P
+SplAj
09-10-2001, 03:11 AM
Hi

There are a lot of tuts around re Vbox4.2/3/5.... esp. +Tsehp ;)

I have the older VboxBuilder 4.2 and 4.3 (4.5 is/was not public)
and I also have a prv file ;) so it is possible to play with making
a protected notepad (duh !) and then register it, unpack it, learn the time trial tricks etc blah blah whatever..........

I did a web search for these files but failed to find any real link to anyother site than Previewsoft :-( ...... maybe someone found it ?

If anyone is REALLY interested in doing this then I will find a ftp
to place the original files for you. I'm sure Li Wei Bin Bam whatever won't mind ;) Maybe exetools will host them ???

+SplAj
tsehp
09-10-2001, 03:39 AM
I've tested new rv on latest vbox I could find and it still works, even if the last essay talked about mangled iat scheme, I didn't saw this on lastest version.

It's easy to locate the reg entries that you have to delete, just check your regmon and look for bizarre entries inside key regs like :
kjshfksjhfdsdf65s4df6sqdfsdf¤$$^^%%% for example :D

gosh I just love those new smileys :p
SpeKKeL
09-10-2001, 09:11 AM
Today downloaded

www.ontrack.com/freesoftware/icl2eval.exe Pfff 15MB for a
prog of nothing (cleans cookies etc..) but Yes V-boxed with 5.0 ! (so that's nice)
Dumped and rebuilded with rev., about 12 api's didn,t resolve
So easily found them and fixed them manually.

Just for the info, Grrrreeetz.......SpeKKeL......

BTW I shall not ask tseph about the new RV maybe i litlle tired
after all the Mb-work........
tsehp
09-10-2001, 11:19 AM
Originally posted by SpeKKeL

BTW I shall not ask tseph about the new RV maybe i litlle tired
after all the Mb-work........ [/B]

it's fully working now, with a new feature against the new aspr
api emulation.

I only have to debug the section realigner + add some code to dump targets and it's there. Tracer is much more stable then before (less unstable is better said ;) )

soon here


DreamWeaver 4.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > DreamWeaver 4.0
PDA

View Full Version : DreamWeaver 4.0

Argoth
08-27-2001, 04:43 PM
I am now struggling with DreamWeaver 4.0. I want to remove the first Nag; the Dialog which tells u if it's expired or not and that we should buy DreamWeaver for 'only' $299,-. When u remove this nag correctly, everything will be fine. I know this because I did it. Now, what is my problem? When I patch the .EXE file at location 004072DF (This jump should always jump). My harddisk starts to make lots of noize but I see nothing on my monitor. But, when I just reverse the jump in SoftICE, no nag will be shown and DreamWeaver starts without any problems. Could this be some kind of checksum? I find this very hard to believe, because when I set a BPX with SoftICE, one byte of the file is changed into CC and DreamWeaver will run normally.

Does anyone know anything about this?

Thanks in advance and Grtz,

Argoth
Wizard
08-28-2001, 02:38 AM
I don't know if there is a checksum in Dreamweaver, but anyway you are wrong when you say that "when I set a BPX with SoftICE, one byte of the file is changed into CC". In fact, when of the byte of the program loaded IN MEMORY is changed, but the file stays the same. Of course, when you make a patch, the file is modified.

Wizard
Argoth
08-28-2001, 04:47 PM
Thanx for replying, but I'd like to disagree with you there. Maybe its my sICE version (v3.0), but when I set a specific breakpoint in an EXE and I compare it to a backed up EXE with HexWorkShop, the files are different; there's a CC on the places where I just set my breakpoints.

Grtz

Argoth

(This doesn't really solve my problem, but what the hell :) )
m0sk
08-28-2001, 06:31 PM
hi,

I think you're both kinda right :-) That is, Wizard is rigth in theory... debuggers only change the code of the program in memory. What Argoth is seeing is some very weird softice-specific thing, which mostly seems to happen when debugging programs made with MSVC (not sure if it was VC or VB though)... There was a discussion on this a long time ago on the board, and as far as I can remember, nobody could give an explanation for this behaviour. I think it was Kayaker or Jimmy Cliff who started that thread (not quite sure though -- it's a long time ago).

Anyway, concerning your original question: have you looked at memory patching tools or process loaders and the like? That's all I can think of, just trying to help until one of the local gurus arrives :p
jomamameister
08-29-2001, 08:20 PM
i have a question or two. is this the old rsagnt32.dll? if so i have already done tutorials on that but will help you nevertheless. it matters not, i have reversed all of the newer versions and would be glad to lend assist. please email me.
jomamameister
+SplAj
08-30-2001, 05:44 AM
the CC is an int3 opcode instruction for the debugger to break on. So DONT set a bpx. Try setting a bpm 4072df rw or bpr 4072df 4072df+4 rw and see if you get to the crc code that way.

I remember the old rsagent - simple to 'pop' those real exe's ;) but this DW4 is a with later version but you can still make it self register with the correct string in the registry. no hacking required.

+Spl/\j }>
...topped up with Guinness again :-)
+SplAj
09-10-2001, 03:48 AM
Hello Coderz ;)

Today I am in shitty mode due to trouble at work ......

So I am going to take my vengence out on RSAGNT ANY VERSION............ as the LAMEST commercial 'protection' scheme in the history of .... commercial protection.

So I read this thread and posted a teaser as a reply. Nobody took me up on the offer of explaining (probably cos the MB was down !) what I meant about 'pop'ing the exe !!!
I also checked out some other tuts that take you deep into the codewoods........ well forget em.....here is my *tutorial* for ANY RSAGNT 1,2,3 protected app...esp. Macromedia Dreamweaver, UltraDEV, AuthorWare, Flash 5 etc etc etc

1) Install the app.
2) look in the program folder for a ???pop.exe or ???pop.tty and always make it a ???pop.exe.
3) Set a BPX MessageBox in SI
4) run the 'pop' exe
5) proggy says 'preparing blah blah'
6) SI pops cos your not supposed to be doing this !
7) Press F12 and see a couple of lines down CMP ESI,1.
8) make ESI register 1
9) BC*
10) Press F5

Finished. The program self registers and unprotects itself like a good little boy.

Lame or what......... Norton / Symantec used to use RSAGNT. I once saw a fantastic tut on bypassing the protector thread in WinFax Pro 9 trial.... well pop me they moved to 'superior' VBOX soon after !!!!!!! duh.

+Sp/\j

:Devil :)
Js
09-11-2001, 10:22 AM
Hiya,
Lucky for Macromedia etc you were'nt in a *really* bad mood ;)
Its that orrible black stuff you've been drinking that puts
you in the evil mood ;).
greetz
+NeWbiE
09-16-2001, 12:57 PM
Ok here is a little info on Macromedia Appz:

All Macromedia Appz can be cracked easily....What to do is simple..Just install Flash4 Trial and unlock it with your softice..And register it with a serial...Now the trick is coming

Go Start-->Run-->Regedit

Open Hkey_Classes_Root\ultxfile key and export it as a reg file.....

Ok...After this install another Macromedia Appz like Dreamweaver 4 and just check Hkey_Classes_Root\ultxfile.You must see another sub-key with a new number just write down the number and open your imported reg file and change the number to the new number you just got.Save the file and double click it.

And now open Dreamweaver What You See!

"Your software is being prepared" Heheheheh You got it!

This works for all Macromedia Appz including Flash 3-4-5 ;Fireworks 3-4 ;Dreamweaver 3-4 and Authorware :)

Just newbie's gift to all newbies outta there!
tsehp
09-16-2001, 05:47 PM
and the easiest trick :
go to astalavista.box.sk and download the crack he he.

I'm using dreamweaver 4 on the main site and did it that way, this time

Sorry but somebody had to make the stupid post of the thread, I felt comfortable with this:)


Help! Task & Ldt & Hwnd?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help! Task & Ldt & Hwnd?!
PDA

View Full Version : Help! Task & Ldt & Hwnd?!

dzhiguo
08-27-2001, 10:42 PM
When I do a "Task" or "Ldt" command in si4.05+win2k+sp1, it report "No Ldt"
and "Hwnd" command report "Unable to find a desktop window", why?
Bengaly
08-28-2001, 05:15 AM
Because you are using WIN2K hahahah ;D
Switch back to win98 and there will be no problem ;)

Bengaly


bpx HMEMCPY Not working with win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > bpx HMEMCPY Not working with win2k
PDA

View Full Version : bpx HMEMCPY Not working with win2k

HiTecCrkn
08-28-2001, 05:42 AM
I Need the replacement of bpx HMEMCPY in win 2k.
MEMCPY not working...
Tech19
08-28-2001, 07:04 AM
Yea I had the same problem :( Not to state the obvious but sometimes the program breaks on other api's. Try GetWindowTexta, GetDlgItemTexta, MessageBoxA, etc... Sorry that I can't be of more help, if you find the alternative let me know cuz I want it too :)
matthew
08-28-2001, 09:01 PM
check the readme that comes with softice (i believe it is an html file) and compare your build of windows 2000 with the ones they've listed as compatible.

If yours wasn't listed, like mine, then you might be out of luck. I was unable to get breakpoints on APIs working at all. However i could get breakpoints on messages working, which wasn't good enough to crack with ;)

Use a program like Soft Snoop or W98dsm and see what functions are imported that look like memcpy. With softsnoop you can just run the program and see what apis are being called with is handy for that sort of thing.
jomamameister
08-29-2001, 08:09 PM
from what i've heard, hmemcpy is not supported in the win2k kernel. :-(


S E N T I N E L D O N G L E
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > S E N T I N E L D O N G L E
PDA

View Full Version : S E N T I N E L D O N G L E

TrixMan
08-28-2001, 05:30 PM
Hi !
My skils in dongle reversing is not so good but
i'm lerning.
This marin navigation prog (15Mbyte) have almost make me quit computing and start with some other hobby (Girls, beer etc.)
This is protected by sentinel dongle.
://www.transas.de/dowload/tsunamis.zip
Plz! Plz! bring back my power.with some advice how to do it.

Thank's Billy,
JohnnyBoy
08-29-2001, 04:32 AM
Have the software and the dongle on my desk. Have not start working with the dongle.
Since I have the dongle I have start looking at how to get all the maps thru a keygenerator.
I have not done any dongle crack (yet).
Mail me!


Debbuger detected message ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Debbuger detected message ???
PDA

View Full Version : Debbuger detected message ???

Solo
08-29-2001, 11:33 PM
I think I find a piece of protection scheme that looks new for me...
I'm relatively "new in the business" so I would
apreciate any hints or sugestions from an experienced
cracker.

Well, I tried to crack a russian soft, serial based
registrations but not this is the problem.

I tried first with Softice, but a message box tell me
something like "Debugger detected, program aborted",
then everything crashes, including Softice, general
protection fault.I switch the Faults off but no use,
"illegal operation" message windows show up on the screen.

Then I tried Wdasm, despite the fact there is no
readable string in program files but this one
failed too , ridiculous...

As the authors said , the program is written in C++
and I suspect it uses some of the debug() functions
of the windows API but my knowledges about that
ends here.

What can I do ? From where shoud I start ?
Thank you.
Wizard
08-30-2001, 02:35 AM
If you're using win 9x, you should start by using Frogsice (get it at http://www.programmerstools.com/) which can bypass every kind of softice detection.

Then, you should read articles about debugger detection ('Meltice' is the easier to understand and is used by Softice itself ;).

Wizard


hehe~~
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hehe~~
PDA

View Full Version : hehe~~

DickieX[BCG]
08-30-2001, 04:24 AM
try bpx memcpy
it's better cracking in win98


Method 4 getting a handle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Method 4 getting a handle
PDA

View Full Version : Method 4 getting a handle

NikDH
08-30-2001, 06:13 AM
Hi to all
i was looking 4 a method to get the handle of the editbox which last recived text from the keyboard

With GetForegroundWindow() i can only get the parent window with focus but i wanna which of the windows inside this one was recciving text from keyboard

Tnx in advance

See ya
NikDH
Kayaker
08-31-2001, 01:01 AM
Hi,

How about GetFocus? - retrieves the handle of the window that has the keyboard focus, if the window is associated with the calling thread's message queue.

Kayaker


Would appreciate some pointers, stuck in Delhpi program....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Would appreciate some pointers, stuck in Delhpi program....
PDA

View Full Version : Would appreciate some pointers, stuck in Delhpi program....

SuperCali
08-30-2001, 12:08 PM
Hello,
I am trying to crack Muzicman 3.5 Build 808 and am having serious problems. I have cracked the previous versions after quite alot of hard work but this one has changed alot and I can't find part of the code I need. I am aiming for first a nasty byte patch then I will see if I can keygen it. I've looked at it with IDA, TRW2000 and dede 2.5. I can get the unregistered text part of the splash to disappear [whoopi :( ] and also the nag on start-up but this is merely cosmetic. Some how I lose myself in the code after tracing it for a while... well to make a long story short I am stuck. I suspect there is some checksum involved as changing certain bytes result in really strange errors (but then again maybe I just patched the wrong place).
B.t.w the UPX isn't a problem as I unpacked it first. So if someone could have a look and give me some suggestions on how to proceed I would appreciate it greatly.

// SuperCali

Just though I'd clarify the protection a bit. It's a serial number stored (I guess for now because I haven't verified it yet) in a file. There is a registration input dialog under settings menu, but it never displays a message if your code is wrong (not sure, but I don't think it displays a message even if the right code is entered). The protection itself is a 400 file limit on the amount of files in your mp3 collection.


Where to find "HASP/Sentinel Kill v0.01"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where to find "HASP/Sentinel Kill v0.01"
PDA

View Full Version : Where to find "HASP/Sentinel Kill v0.01"

Sam
08-30-2001, 03:50 PM
Where to find "HASP/Sentinel Kill v0.01"
woodmann
08-30-2001, 07:22 PM
Did you try searching for it?
I'm not trying to be an asshole here but it took me all of 5 seconds.

http://208.50.16.104/crackz/Coding.htm

Peace, Woodmann
jonny
08-31-2001, 02:20 AM
On that page there is no link to the program!
woodmann
08-31-2001, 05:24 PM
Yes there is no link because it isnt finished yet.

Peace, Woodmann


Softice breakpoint on a string??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice breakpoint on a string??
PDA

View Full Version : Softice breakpoint on a string??

jerrydav
08-30-2001, 07:48 PM
Hello!
I'm quite new in reversing and I have some problems trying to crack a dos program. I disassembled the program and I want Softice to break to a specific line or command saw in the disassembled program. For example, I want to break on : "cmp eax, 00000002". Is there a way to do that?? Of if I want to break when a specific string is written in memory like : 'test', how can I do that??

Jerry
qferret
08-30-2001, 08:10 PM
Well....I've never played w/ SoftIce for DOS, but here are some pointers for Win32 proggies....some info may cross over ;-)

jerrydav (08-30-2001 17:48):
Hello!
I'm quite new in reversing and I have some problems trying to crack a dos program. I disassembled the program and I want Softice to break to a specific line or command saw in the disassembled program. For example, I want to break on : "cmp eax, 00000002". Is there a way to do that??

nope....break on the address shown in the disassembly (make sure you have the selector right though)

Of if I want to break when a specific string is written in memory like : 'test', how can I do that??

First time through, search memory for the string using s 0 l ffffffff 'test' .....when you find where it's being stored, you can restart the program and set a BPM or BPX on the address to break when that address is read from or written to


Offset mismatch in IDA and HewWorkshop!?!?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Offset mismatch in IDA and HewWorkshop!?!?!
PDA

View Full Version : Offset mismatch in IDA and HewWorkshop!?!?!

SuperCali
08-30-2001, 08:44 PM
Hello,
I had a realy strange problem with the Muzicman program I am cracking. After figuring out how to bypass the splashh screen by nopping it out I decided to do it a little neater by using c3 (RET) so the function just returned. Well two of the calls went ok , but the third one was strange. After going to the address in IDA and checking the offset I was about to patch it in HexWorkshop when I noticed that instead of the bytes I wanted to patch being on offset 36xxx (xxx being the same on both) as shown in IDA they were on 35xxx in hexworkshop!? How or why does this occur!? Is it common?

// SuperCali


games
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > games
PDA

View Full Version : games

nishant_sr
08-31-2001, 04:38 AM
i am reallly new to this iwas trying to run carmageddon 1 with out the cd but no success
i cracked all the popups about the Cd not being in the drive but dont have clue abt the message that splashes across the screen saying 'Please Insert the Carmageddon Cd' i couldnt find this mssg in dsm strng ref.
Plz help
fido_sr:)
CoDe_InSiDe
08-31-2001, 04:46 AM
Hi nishant_sr,

Maybe it's because your bad at english? or maybe it's because i'm dumb? ;D
But your saying that you cracked all the popups about the CD not being in the drive but you have no clue how to remove the Message "'Please Insert the Carmageddon CD" ? uhm... ;D

I don't get it ;)
Try to look at the Resources for that message ;)
(I hope i was helpfull in some way ;D )

Cya...

CoDe_InSiDe
fido_sr
08-31-2001, 04:52 AM
CoDe_InSiDe (08-31-2001 02:46):
Hi nishant_sr,

Maybe it's because your bad at english? or maybe it's because i'm dumb? ;D
But your saying that you cracked all the popups about the CD not being in the drive but you have no clue how to remove the Message "'Please Insert the Carmageddon CD" ? uhm... ;D

I don't get it ;)
Try to look at the Resources for that message ;)
(I hope i was helpfull in some way ;D )

Cya...

CoDe_InSiDe

but dear this messg i'm talking abt is not a popup window but splashes across the screen and there's no strng reference to it in DSM
CoDe_InSiDe
08-31-2001, 05:11 AM
Hi fido_sr,

Ah ok :)
Well try to look into other files like *.DLL or something, it doesn't have to be in the .EXE :)
Especially when your saying "splashes", that makes me think about *.DLL ;)

Cya...

CoDe_InSiDe


Absolute beginer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Absolute beginer
PDA

View Full Version : Absolute beginer

Tyagi
08-31-2001, 08:59 AM
Hi guys
I am an absolute beginer in this field .All i have cracked so far are proggy from the years 1998 to 1999 where you can allways find key stored in some memory location, or it was calculated jaust one call deep using simple hex additions and xoring the result to get the key.But when ever the calculation routine is nested in deep call or when there are 20-30 calls I am at total loss.I don't know much of asm.I came to this site looking for fundamentls but all these PE header files import tables go over my head.The tutorials collected by me so far are not of much help any longer as they are of kind which i can allready handle i.e. very easy type .Can any one out there point me to somewhere i can systematicly develop my knowledge along with strong funda's
thenite
09-01-2001, 11:54 AM
Hi,

here are some links. Hope it helps.
http://users.belgacom.net/blackb/ (very good page by blackb)
http://tsehp.cjb.net (I guess you know that :-)
Reading the older "Fravia-tuts" would be good as well.
http://home.online.no/~reopsahl/files/assem.htm (about asm)
http://zor.org/krobar/

cu


Where am I goin wrong?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where am I goin wrong?
PDA

View Full Version : Where am I goin wrong?

Scally
08-31-2001, 12:14 PM
Could really use some help with this one. It seems to have code related to registering the app & references to the non-demo version of the ini file but I can't see any way to get the prog to call the relevant code, so it may be a genuine demo.
I've never seen (or noticed:) ) any app that according to filemon managed to not read its ini file if its loaded via symbol loader but it does read it if you break on the ep in sice without using the loader. Even when I'd figured this out, I couldn't seem to get close to the point where the dll attempts to read the ini file.
The app is at ht*p://www.mvsoft.com/pub/eqs/eqs57dem.zip
So, I decided to have a go at reconnecting the print dialog & save code to the appropriate menus instead. (Print dialog is at offset 7071Eh & 7079Ch/Save dialog is at offset 7064Ch and the print menu select is at offset 5301h jumping to the code I changed at offset 4DB5h:
0DB5 push 0000
0DB7 push 0000
0DB9 push 0099
0DBC Call .....
I nop'd the pushes and changed the call to go to what I think is the print dialog code.

I maybe doing somethin basic wrong but if I try to hex edit the main app to redirect the calls, the prog crashes. (this occurs even though the files are same size & the only changes visible in hexwkshop/tools/compare are the redirected call & the nop'd pushes). I tried modifying a couple of jumps here and there and redirected the print to printsetup dialog & the thing worked, so it's not just a file date check that's causing the problem. The crash occurs before the symbol loader kicks in, so I can't trace it that way.
Please can anyone give me some guidance on this.
Scally
Scally6
09-09-2001, 09:05 AM
:) Cracked it!
Hi folks,
Kind of answering my own query. Cos the board's been down I decided to play around with this some more. After playing with sice history dumps W32dasm and exescope, I managed to restore the print & save functions in the text/analysis sections. The two jumps in the first segment are 'hard-wired' into the app and I can't see any way of registering it, despite the existence of a suspicious potential register box seen in exescope that doesn't seem to be dialog referenced in W32Dasm. Looks like the dlls aren't concerned with the protection.
Anyhow, the print jump needs to go to Jmp dc7 and it prints! There is a way to get it to give options on printing before it prints but I'm still working on that. Not sure where the 'save' should go to but 'save as' is at F6B, so it serves the purpose. This also needs a cmp & Jne noping around fea but it works. The copy/cut stuff is similar coding, you gotta avoid 1.34c4 and the rest fall into place pretty easy. (The 34c4 call is for errors & the nag is 0099, so only change code above 34c4 calls where 99 is pushed.) This also goes for options that call the print function indirectly, just avoid going to 34c4. From the deadlist, it looks like there might also be a time expiry kicking around .........but this one's gonna go down sooner or later!
Scally


Need help with a little, simple proggy PLZ
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help with a little, simple proggy PLZ
PDA

View Full Version : Need help with a little, simple proggy PLZ

Torque
08-31-2001, 11:11 AM
Hey guys,
I have a little program that is supposed
to pick up items in Diablo2.
However, there is a random delay from 0
to 4 seconds before it picks up the item.
My question is how can i remove the delay?
All i can see is some calls to MSVCRT.dll.
It calls srand, rand, and time.
Im sure it is very easy to remove the delay, but im still learning.
If any1 here can help me that would be so great. I would really appreciate it (and it shouldnt be too hard if u know what ure doing).
Please email me if u can help me.

Thanx :)

Torque


Any recommendations for assembler book and/or tutorial please.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Any recommendations for assembler book and/or tutorial please.
PDA

View Full Version : Any recommendations for assembler book and/or tutorial please.

SuperCali
08-31-2001, 07:47 PM
Hello,
I want to learn assembler properly and was wondering if anyone here could recommend some good books about the subject (or tutorials). I have a book called "Mastering Turbo Assembler 2nd ED." but it is rather dated and I would like another book but don't know which one's are good. I am pretty much a complete newbie, so I would prefer a book that starts from A-Z, or maybe one good beginners book and one more advanced. Thanks for any suggestions.

// SuperCali
CoDe_InSiDe
09-01-2001, 12:37 AM
Hi SuperCali,

About the books i can't help you with that :)
But about the Tutorials maybe you can check out this URL it can be handy ;)

win32asm.cjb.net

Cya...

CoDe_InSiDe


Finding a button's code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Finding a button's code
PDA

View Full Version : Finding a button's code

pompeii
09-01-2001, 10:04 AM
Can anyone tell me how to find the code attached to a button in SoftIce or a disassembler? I've messed around with it some in SoftIce. The best thing I can think of is to but a BMSG on WM_COMMAND. I'm still having a hard time finding the button's code. Any ideas? Thanks.
Fake51
09-09-2001, 09:23 AM
What exactly are you looking for? the hwnd of the button, or the control code, that takes action according to messages received?
The hwnd can be found easily, by doing your basic hwnd <app name here> and then skimming thru the different hwnds till you find the right one (this would ofcourse be done in softice). The other is harder, since it would depend on how the button was created. You might wanna do a "bpx createwindowexa" and then check whether or not it's a button that's created. Then you can find the routine that handles the messages (usually the parent window), and then act accordingly.

Bluajn cxielojn
Fake
lololol
09-09-2001, 10:08 AM
h


Sorry for the big messageboard interruption.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sorry for the big messageboard interruption.
PDA

View Full Version : Sorry for the big messageboard interruption.

tsehp
09-08-2001, 03:21 PM
Coming back from vacations, your isp just tells you after 1.5 year :
Just be gone in 10 days, and then shut down your account after 2, leaving your poor chances of verifying your backups and downloads.

And that was the problem + big Ultraboard based failures, we had lost all the rce general board messages, so I had to reconstruct the whole big archive and it took a long time, I just hope that this interruption didn't discouraged you to come here and trade your knowledge.

They can shut down the site, they can't kill the knowledge and archives, so we're back and more motivated as ever.

Now all the files have been transfered to this new php script, much faster and reliable, I hope you'll like it.
We'll try to change the colors in the future as long as there are suggestions.

regards,

Tsehp
Dr Apocalypse
09-09-2001, 07:53 AM
WTF? What's to be sorry about? Sh*t happens and none of it's your fault, right?

I think you've done a f*cking A+ job on the board getting up so soon! I'd rather a board be down for days/weeks and bring it online *working* than try to rush it and bring it up half finished!

You deserve another vacation for sorting all this sh*t out!!

Give yourself (and anyone else who helped you) a F*UCKING BIG pat on the back and give a BIG FINGER to those who try to destroy the knowledge!

I like VBulletin better anyway ;)

DrA.
+SplAj
09-09-2001, 08:34 AM
YIPPEE 'we're back' !!!

Well done +tsehp and $woodmann. ;) tremendous............

I Just wasted the last week D/L mp3 trance music ;) - mixed by some geezer called dj_irish, duh .... :cool: Pulsar Rulez
.....gave me some new inspiration for some lame answers as well as finding LockResource in ASProtect .....duh

+SplAj

Shamus O'Feck........where is my Devil icon gone now ????
:mad:
Scally6
09-09-2001, 09:11 AM
Thanks for all your hard work guys.
Scally
Kayaker
09-09-2001, 11:51 AM
Fantastic! We're Baaaaaack..... :)

Great job guys at getting all of us a shiny new board, and more importantly continuing to protect the knowledge contained within these walls from misguided destruction. The efforts and positive contributions people have made over the past several years should not be lost from public record.

Thanks to +tsehp and $woodmann for all the time and money they have invested in resurrecting the RCE Phoenix from the ashes.

Besides having the forum as a fun place to shoot the shit, this place is needed. Reversing isn't the only thing learnt here, there's a whole generation (or at least those who take something out of it) who learn assembly programming and Windows system operation, let alone the logic behind it all.

There's a database here, available either direct or linked to, to a vast amount of information concerning computer function which has a direct application to low level programming. Whether it's applied in the form of the most ethical and legal of reverse engineering, or whether it's applied to crack is up to the user. The fact is it exists and provides a source of teaching available nowhere else.

If shareware organizations are concerned about this site maybe they should consider its deeper implications and instead target the true get-rich-quick crack sites and warez distribution servers.

There's a few quotes from some lecture notes of a course given by the Massachusetts Institute of Technology entitled "Reverse Engineering in Computer Applications" given in Boston this year I found interesting. It is targetted towards high school students attending the course. It's a good document I think would make a perfect addition to the FAQ:

http://www.geocities.com/hackmansite/fotis/books/re.pdf

----------------------------------
"Reverse Engineering (RE) is the decompilation of any application, regardless
of the programming language that was used to create it, so that one can acquire its
source code or any part of it.
The reverse engineer can re-use this code in his own programs or modify an
existing (already compiled) program to perform in other ways. He can use the
knowledge gained from RE to correct application programs, also known as bugs. But the
most important is that one can get extremely useful ideas by observing how other
programmers work and think, thus improve his skills and knowledge!

Here are just a few reasons that RE exists nowadays and its usage is increasing
each year:
•Personal education
•Understand and work around (or fix) limitations and defects in tools
•Understand and work around (or fix) defects in third-party products.
•Make a product compatible with (able to work with) another product.
•Make a product compatible with (able to share data with) another product.
•To learn the principles that guided a competitor's design.
•Determine whether another company stole and reused some of source code.
•Determine whether a product is capable of living up to its advertised claims.
Not all actions performed can be considered “legal”. Hence, extreme caution
must be taken, not to violate any copyright laws or other treaties. Usually each product
comes with a copyright law or license agreement."

...continued

1.3 Typical Examples
What comes in our minds when we hear RE, is cracking. Cracking is as old as
the programs themselves. To crack a program, means to trace and use a serial number
or any other sort of registration information, required for the proper operation of a
program. Therefore, if a shareware program (freely distributed, but with some
inconveniences, like crippled functions, nag screens or limited capabilities) requires a
valid registration information, a reverse engineer can provide that information by
decompiling a particular part of the program.
Many times in the past, several software corporations have accused others for
performing RE in their products and stealing technology and knowledge. RE is not
limited to computer applications, the same happens with car, weapons, hi-fi components
etc.

All major software developers do have knowledge of RE and they try to find
programmers that are familiar with the concepts that will be taught during this class. RE
are well paid, sometimes their salaries are double or even more, depending on the skills
they have."

...continued

1.3.2 HIDING INFORMATION FROM PUBLIC
Companies are hiding a lot of things: their mistakes, security vulnerabilities,
privacy violations and trade secrets. Usually, if someone finds out how a product works
by reverse engineering, the product will be less valuable. Companies think they have
everything to lose with reverse engineering. This may be true, but the rest of the world
has much to gain.

Many of the privacy risks we face today such as the unique computer
identification numbers in Microsoft Office documents, the sneaky collection of data by
Real Jukebox, or the use of Web bugs and cookies to track users were only discovered by
opening up the hood and seeing how things really work. Companies do not publish
this kind of information publicly.
Sometimes they even disavow that they meant to design and build their products
to work way it ends up working.

PEOPLE ENGAGED IN REVERSE ENGINEERING ARE A CHECK ON
the ability of companies to invade our privacy without our knowledge. By going public
with the information they uncover they are able to force companies to change what they
are doing lest they face a consumer backlash.

Uncovering security vulnerabilities is another domain where reverse engineers
are sorely needed. Whether by poor design, bad implementation, or inadequate testing,
products ship with vulnerabilities that need to be corrected. No one wants bad security,
except maybe criminals, but many companies are not willing to put in the time and
energy required to ship products without even well known classes of problems. They use
weak cryptography, they don't check for buffer overflows, and they use things like
cookies insecurely. Reverse engineers, who publicly release information about flaws,
force companies to fix them, and alert their customers in a timely manner.
The only way the public finds out about most privacy or security problems is
from the free public disclosures of individuals and organizations. There are privacy
watchdog groups and security information clearinghouses but without the reverse
engineers who actually do the research we would never know where the problems are.

There are some trends in the computer industry now that could eliminate the
benefits reverse engineering has to offer. The Digital Millennium Copyright Act (DMCA)
was used by the Motion Pictures Association of America (MPAA) to successfully stop
2600 Magazine from publishing information about the flawed DVD content protection
scheme. The information about the scheme, which a programmer uncovered by reverse
engineering, was now contraband. It was illegal under the DMCA.

Think about that. There are now black boxes, whether in hardware or software,
that are illegal to peek inside. You can pay for it and use it, but you are not allowed to
open up the hood. You cannot look to see if the box violates your privacy or has a
security vulnerability that puts you at risk.

Companies that make hardware and software products love this property and are
going to build their products so that they fall under the protection of the DMCA. CueCat
did this when they built their product. They added a trivial encoding scheme, which they
call encryption, so that their bar code scanner was protected against reverse
engineering by the DMCA. We can expect to see many more companies do this.
----------------------------------

Just a little food for thought while we all gear up for another forum ;)

Regards,
Kayaker
Tech
09-09-2001, 12:25 PM
Yay, brilliant forums. Good job :D
CoDe_InSiDe
09-09-2001, 12:50 PM
Hi Everyone,

Whoho new board new layout ;D
I need to get a little familiar with it tho, but very nice, good work :)

Cya...

CoDe_InSiDe
JimmyClif
09-09-2001, 06:31 PM
WASSUP ?

It's nice to see that the board is back up again...

Haven't got much time to write so I wish you guys all my best
&& Keep up the good work...

JimmyClif
Clandestiny
09-09-2001, 06:42 PM
Hiya,

Thought I'd pop my head in and give another hat's off to +Tsehp and Woodman :) . A BIG thanks to you guys who keep this place alive. I've been following the MB for about a year now, and have learned a heap, knowledge which would have been difficult (if not impossible) to aquire elsewhere. They don't teach you *any* of this stuff in school, legit RCE or otherwise.

To Kayaker:
A very insightful commentary... But that was a LOT of food for thought... Nice to know there aren't any post size limits on this new forum for the wannabe novelists among us ;)

To JimmyClif:
Long time no see :) ...Back from retirement ? ;)

Cheers,
Clandestiny
tsehp
09-10-2001, 03:18 AM
Originally posted by +SplAj
YIPPEE 'we're back' !!!

Well done +tsehp and $woodmann. ;) tremendous............

I Just wasted the last week D/L mp3 trance music ;) - mixed by some geezer called dj_irish, duh .... :cool: Pulsar Rulez
.....gave me some new inspiration for some lame answers as well as finding LockResource in ASProtect .....duh

+SplAj

Shamus O'Feck........where is my Devil icon gone now ????
:mad:

he he, you have to build it yourself this time and ftp it to /images/avatars, then add the avatar on cp panel, and finally edit your profile to add the image, just like the one I've put for myself.

Sorry for all the non admins, but you can't use the upload feature for you to have your own avatars, php here runs on restrict_mode and doesn't allow this.

But you can ask me to add your image, mail me directly
tsehp
09-10-2001, 03:25 AM
The past board (Ultraboard) was written in perl, not made to exploit mysql database mode so had some big speed + reliability problems, it was also a pain to reinstall in case the site shut down our account.

Woodmann will eventually comment why we had to move to this server...

This new board have much more features if you are registered, there also are some private messages, more complete profiles, and a lot of stuff I didn't even know so I'll leave it to you.

Important : the backup procedure takes 1 mn, installation takes 5 minutes, it also takes now 10 minutes to open another php temp account on a free server, so nothing again will ever be lost in case some pathetic dmca-like jokers wants to try again to shut up our mouth :p

hey I just have to click :cool: at the left to bring those simleys :) :( :o :D ;)

Isn't that great ?

splaj, you'll have to upload some more icons if you want back your beloved devil :)
kugi
09-10-2001, 11:01 AM
Hi All,

Thought that we had lost the message boards last week. Searched all over the place. Finally made contact this morning. Like finding an old friend.

Many thanks Tsehp and Woodmann. Your efforts to keep these boards going is a great service to seekers of knowledge.

Regards,
Kugi
the snake
09-13-2001, 02:45 PM
Hello to all.
Thanks to tsehp and all others involved in rebuilt the new board.

One of the reasons i was not able to find it before, (and i got a mail about it), it's because i used to use the old "newbiesforum.cjb.net".
Maybe it will be helpfull to redirect it again for those who are looking for the new board..

regards
the snake
?ferret
09-13-2001, 09:25 PM
WOOHOO!!!!

I'm ?ferret again!!! LOL

Now I just need an avatar ;)

(Some time to participate would also be nice, but probably won't happen for some time)

Great to see the board up and runnin' AND to have my true name back though....

I shall return ......:D
Timmy
09-18-2001, 08:04 PM
I have been out in the wilderness for ages and I thought it was about time I got back into RCE (brain was stagnating). I clicked on my usual link (I've been away for a bit) and no furums. I was in turmoil there for a while. Never underestimate the power if beer. 12 bottles and a bit of looking and I've found my favourite board again.


_they_ will never stop you :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > _they_ will never stop you :)
PDA

View Full Version : _they_ will never stop you :)

0x400
10-27-2000, 09:59 AM
Error:
You forgot to fill in the "Message" field.

i know i forgot :P


problems with smartchck
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > problems with smartchck
PDA

View Full Version : problems with smartchck

ThRaX
10-28-2000, 03:56 PM
Following a tutorial for a crackme written in VB, the tut said to fire up smartcheck and open up the program. While opening it up it says 'Warning, program written in p-code' but the tut accounts for this saying thats fine. Then the tut says to run the program. However, when doing this i get the following 'error' in the code-window-dealy:
EXCEPTION(2nd Chance) Exception: Access Violation
code: C0000005 addr:77F89181
ntdll.dll-00029181 (77F60000)
invalid write to 8015ED84
EAX:00000000 EBX:0012FF0C ECX:0012FE64
EDX:FFFFFFFF ESI:00000001 EDI:77F9D0E8
ESP:0012FE64 EBP:0012FEB4 EIP:77F89181
EFLAGS:00000246
CS:001B DS:0023 ES:0023
SS:0023 FS:003B GS:0000
Stack dump
C0000005:00000001:00000000:77F89181
Call stack
ntdll.dll!00029181
ntdll.dll!000012B4
Exception: Access Violation
EXIT_PROCESS

then it simply quits out saying 'an error occured'

anyone know whats going on here?
thanks
--ThRaX
LaptoniC
10-28-2000, 04:56 PM
I got this problem when I switched WinMe.I dont know if you have WinMe too.Anyway I remeoved winme and loaded win98 se again
mariop
10-29-2000, 09:01 AM
I have the same problem with WInMe. But it works fine under Win2k. The saved tracing works ok under WinME. So you can trace under W2K and study it under WinMe. No need to uninstall WinMe.
ThRaX
10-29-2000, 09:43 AM
Hmm...alright, thanks for the help. But see I'm not on Win9x, im using NT for this....And pardon my newbiness, but what exactly is WinMe??

thanks
--ThRaX
stanks
10-29-2000, 03:41 PM
WinME - Would be Minor Erection
ThRaX
10-29-2000, 07:41 PM
LoL...But WinMe aside, Does anyone know why this wouldnt work under NT?
stanks
10-30-2000, 03:18 PM
on my language WinMe means 'ja prozor'
:)
ThRaX
11-09-2000, 03:39 PM
just bringin' this to the top so i can get a little help...once again, im on nt 4.0

thanks
Jack
11-11-2000, 03:43 PM
Maybe the program is anti SmartCheck and is making an illegal call to end the process. Does the program work when not loading it in SC?
ThRaX
11-13-2000, 05:55 PM
hmm no i dont think thats it...yea it works not in smartcheck
but see, it doesnt run *ANY* vb programs....even crackmes that are (for newbies) intended for use with smartcheck..in fact, i was reading a tutorial that said that smartcheck was meant ot be used, and it said no problems should be encountered.
just wondering, cuz from what i hear smartcheck is very useful in understaning vb protections
the snake
11-16-2000, 01:13 AM
Hi
I'm not sure that Eternal Bliss is still active as before, but, IMHO, he is a VB guru.
Go visit his site, see if you can e-mail him or if he have a message board

Also you will find there VB crackme's and tutorials.. (I think i saw there pcoded, too..)

http://www.eternal-bliss.net
http://vipatcher.cjb.net
http://users1.50megs.com/oreland2043b/

Regards
the snake
Jack
11-18-2000, 03:55 PM
What version of SC are you using and what Service Pack of NT?
Do you have VB installed?
I would try updating or reinstalling the SP on NT, use the vb6 dll from SP3 or SP4 of the VB SP, you can get those files from eternal-bliss or winfiles (required runtime files).
Numega readme files says VB SP3 is required if VB is installed.

Jack
ThRaX
11-18-2000, 07:20 PM
Hm? I have the VB6/VB5 runtime libraries installed....Is that what you meant?

As for SP and NT versions, I am running SP 4, and NT4...

Thanks, I'll try what you suggested..
Jack
11-21-2000, 02:10 PM
http://support.microsoft.com/support/vbasic/runtime.asp

Here is where you can get the current vb run library file service packs.


icedump 6.020
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump 6.020
PDA

View Full Version : icedump 6.020

movzx
10-28-2000, 06:34 PM
When will icedump 6.020 come out?
The pre6020 doesn't work with the softice from driver studio.
tsehp
10-28-2000, 07:43 PM
you should ask the owl , he registered here and manages this.

tsehp
The Owl
10-29-2000, 04:10 AM
i suppose by driverstudio you mean the latest final release of 2.0. support for this is coming, unfortunately numega is lacking a decent release engineer and their version numbering now fucks up my code ;-), so i have to rework the build process in addition to generating the necessary include files. also there is some
new code to add/test (CLIP: 2-way clipboard communication, courtesy of ignoramus), all this means if i can't do it today, then only next weekend ;-(.

btw, tsehp, i don't know if you also wanted to host icedump, but in case you do, then i'd need a larger quota than the current 500k ;-).
The Owl
10-29-2000, 01:40 PM
ok, i did it. at least /tetris worked ;-). the /clip command is not documented yet but you can try to use it.


Erratic mouse movement in SoftIce 4.05
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Erratic mouse movement in SoftIce 4.05
PDA

View Full Version : Erratic mouse movement in SoftIce 4.05

Mr Smith
10-29-2000, 07:13 AM
Hi,
when I use my PS/2 mouse under win98 with
SoftIce 4.0.5 I get some strange mouse behaviour when I break into SI. It seems to be stuck at the top and it constantly opens some popup windows.
I read in the manual that I should press ctrl-M or type set mouse off, set mouse on, but it doesn´t help :-(
Any idea what I can do ?

Btw., when I use a serial mouse everything is fine (I just want to use the PS/2 mouse because I need my serial port for other things).

Many thanks,

Mr. Smith
esther
10-29-2000, 10:10 AM
Hi there,
I have problems with serial mouse too ,I have solve it but changing the cmos settings
look for Internal peripheral(correct spelling? :)) look for usb controllers on it
.reconfig your mouse settings see if it works

regards

esther
ThRaX
10-29-2000, 10:43 AM
Hmm I have this problem with Sice 4.05 for NT too, but not ALL the time. Its an occasioinal thing for me which I fix by just clicking and right clicking a lot till the popup menu goes away, closing down soft-ice, and firing it up again....

I dunno you've probably tried that already, but that works for me

cya later
--ThRaX
nu
10-29-2000, 07:24 PM
when softice handles the interrupt queue for the mouse, there are times when hardware packets cant be managed to be flushed - that's when ctrl+m comes to use, afaik it's supposed to 'manually' flush the queue. i find this useful, but when i had the same problem as you i couldnt get anywhere with plain ctrl+m or mouse off/on command pairs...i did actually fix the problem by setting the intellimouse option on. try it out, if you haven't already.
tantox
10-30-2000, 07:46 AM
I know how annoying this can be - happened to me too, especially when used M$ wheelmouse, but also with other PS/2 mice. A plain old serial mouse always helped it, though.

Another solution was to run SoftIce setup again and unselect the mouse PS/2 driver - that's, use no driver. Give it a try.

tantox
Mr. Smith
10-31-2000, 08:42 AM
Hi,

nu (10-29-2000 09:24 a.m.):
.i did actually fix the problem by setting the intellimouse option on. try it out, if you haven't already.

Yeah, thanks that worked fine.

Mr. Smith
boggy
10-31-2000, 08:27 PM
i used to have this problem too, it happened when the mouse was
in motion when softice broke - i just kept my mouse really still
which was a hassle but seemed to work fine.

i recently bought one of those ps/2 converters thingies which also helped
()whore
11-26-2000, 11:15 PM
Sorry for the lame question but where is the intellimouse option set at?
newbie
12-19-2000, 05:17 PM
It´s in the Mouse setup menu


Problems with version 3 InstallShield script
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems with version 3 InstallShield script
PDA

View Full Version : Problems with version 3 InstallShield script

Mr Smith
10-29-2000, 07:18 AM
Hi,
I have here an older (version 3) InstallShield script and I tried to decompile it with isDcc and wisd. However, both complained that it is not a valid InstallShield script (wrong magic number). But it is a valid script, since I can start it okay.

Any idea what´s going on, or what I could do next ?

Mr. Smith


Question about VB3 and S-Ice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Question about VB3 and S-Ice
PDA

View Full Version : Question about VB3 and S-Ice

mariop
10-29-2000, 08:51 AM
I'm dealing with a VB3 app (they're still around!). I used Dodi's ProDiscompiler. Although it choked, I got enough source to identify the variables in question. My problem is how to relate these in S-Ice. Even though the Discompiler has a variable window, I cannot interpret the information. Eg: Offset: 0510
Value : 0000
Name: gv0510


Decompiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Decompiler
PDA

View Full Version : Decompiler

MR. Candyman
10-29-2000, 03:13 PM
Yo, I'm just getting started with decompiling programs. I do have some C and C++ knowledge but have yet to find any decompiler that decompiles exe and dll's into either C or C++, the only ones I've found decode into delphi.

Could anybody direct me as to where I can get some good programs? I don't need the security one's yet.

Thanks, MR. Candyman
mariop
10-29-2000, 05:21 PM
I know you said decompiler, but if you mean disassemblers then;

Hambo' site has IDA404
http://www.cracks.tabcrawler.com/~hambo/

Others are here:
http://playtools.cjb.net/

and here:
http://www.suddendischarge.com/
Aleph
11-05-2000, 01:16 AM
The only decompiler to C I know of is a beta version, quite bugged by the way. Have a look here : http://www.cs.uq.edu.au/groups/csm/dcc.html

Hope that helps.
Ignatz
11-08-2000, 02:45 AM
hmmm theres one called rec... the reverse engeneering compiler or something like that... not sure how good the code it comes up with is but it does support multiple file formats pe,elf,...
and different types of processors i think (dont remember about that for sure)
anyways from what i remember about it i dont think you would be able to recompile the code it produces but ya might be able to learn from it

you might look for the papers written by cristina cifuentes... they talk about the theory behind compilers and code analysis
Carpathia
11-08-2000, 02:59 PM
Christina's excellent papers can be found at

http://tempura.cs.uq.edu.au/personal/cristina/pubs.html


WinME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WinME
PDA

View Full Version : WinME

stanks
10-29-2000, 03:32 PM
Windows Millenium Edition
noname
10-30-2000, 07:02 AM
wrong forum pal :)


Ooops...sorry about WinME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Ooops...sorry about WinME
PDA

View Full Version : Ooops...sorry about WinME

stanks
10-29-2000, 03:35 PM
:)


icedump pre6.020 + MS loader
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump pre6.020 + MS loader
PDA

View Full Version : icedump pre6.020 + MS loader

movzx
10-30-2000, 03:44 PM
Is there a problem using the microsoft loader
and icedump pre6.020 with WinMe?

I'm using softice 4.05 build 526, and get the
failed to load icedump message.

I didn't see any posts about this.

movzx
The Owl
10-31-2000, 01:59 PM
I'm using softice 4.05 build 526, and get the
failed to load icedump message.

hmm, i don't think the loader has anything to do w/ icedump ;-). on w98se icedump works fine (for 4.05.526 that is), so it must be a wme issue. did you see any messages in the winice window? in any case, i will try to take care of wme tomorrow, hopefully won't take more than a day ;P.
The Owl
11-01-2000, 04:24 PM
ok, i fixed both wmldr (0.3 is out), and icedump (works under wme, id6020pre.zip, not linked on the site yet). as for the not loading: did you make sure that winice.dat in %windir% has the proper exp= lines uncommented? loader32's editor changes the wrong winice.dat, so don't rely on that.


msi decompiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > msi decompiler
PDA

View Full Version : msi decompiler

pm
10-30-2000, 06:21 PM
Hello there,

I would like to decompile an installshield package file (extension .msi). Is this possible? Is there any program to do this ?

Thanks for the help

pm
tsehp
10-30-2000, 08:36 PM
I never searched for this, but it's more easy to trace with softice
than installshield. Those msi's looks like small libraries of code as far
as I remember, installshield is interpreted.

tsehp


Adding a dll to winice.dat
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Adding a dll to winice.dat
PDA

View Full Version : Adding a dll to winice.dat

InOverMyHead
10-31-2000, 12:24 AM
Can a dll such as cavort20.dll be add to winice.dat? I have entered the file path and checked to see if it exists and it does. I have rebooted and I can not set a bpx on any of the functions listed in the dll that I have printed out using Quick View Plus.
nu
10-31-2000, 02:46 AM
in winice.dat, just add a line similar to the one where you export kernel32.dll, user32.dll etc. symbols:

in other words, add a line that reads

EXP=C:\path\dllname.dll

and then reboot. careful not to comment it out (semicolon in front of the exp statement).

laters,
n.


Wisd can't even decompile it's own setup.ins ??!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Wisd can't even decompile it's own setup.ins ??!!
PDA

View Full Version : Wisd can't even decompile it's own setup.ins ??!!

Mr. Smith
10-31-2000, 04:36 AM
Anyone here who knows about InstallShield decompilation ?
I'm trying to decompile a version 3.00.101.0 setup.ins and it doesn't work with wisd or with isdcc. Wisd itself comes with an InstallShield script and just for fun I tried to use it to decompile its own setup.ins (3.00.111.0) and surprise, surprise it doesn't work !! How can that be ?
A version is does work with is 3.00.104.0, so I don't see any system here.
Btw., it's clear why it doesn't work. isdcc and probably also wisd look at the first 8 byte to determine if it's a legal InstallShield version and the setup.ins which don't work have unrecognized values.

Is there anybody who experienced similar problems ? I can't believe I'm the only one who wants to tackle InstallShield scripts.

Mr. Smith


ElanLM/SentinelLM SDK needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ElanLM/SentinelLM SDK needed
PDA

View Full Version : ElanLM/SentinelLM SDK needed

Nagual
10-31-2000, 10:22 AM
Help!!!
Where can I get ElanLM/SentinelLM SDK or API guide?
decx
11-01-2000, 03:59 PM
if anyone need it please E-Mail me and we can probably work out a transfer of it.

If you dont need the complete SDK i can send you the SLM V7.1 Manuals/developers guide.

- Decx


Softice & Win2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice & Win2K
PDA

View Full Version : Softice & Win2K

King Zeus
11-01-2000, 08:14 PM
I've been reversing about 1 year and have been felling pretty good about my progress. Then I put Win2k on all 4 of my home computers (necessary for work) and have been having a heck of a time with softice. BPX HMEMCPY is my favorite breaking method and doesn't work in Win2k. In fact, I may have gotten over dependent on that command, since it always seems to work for me.
I could put a second operating system on, but I'd prefer not to.
1) Is there a command that works like BPX HMEMCPY
2) Is there a command list available that shows commands which do and don't work under certain operating systems?

Thanks


Banning tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Banning tools
PDA

View Full Version : Banning tools

cronos
11-02-2000, 02:24 PM
The Council of Europe's latest cybercrime treaty, with the hope of stopping computer criminals, will ban most of the tools that are used to find the security problems in networks, operating systems and Internet applications. This is because the same tools that can be used for good can be used for evil.

http://www.zdnet.com/zdnn/stories/news/0,4586,2647940,00.html
cronos
11-02-2000, 03:21 PM
Here is some further background info:

http://conventions.coe.int/treaty/en/projets/cybercrime.htm

with some specific quotes:

Section 1 - Substantive criminal law

Title 1 - Offences against the confidentiality, integrity and availability of computer data and systems

Article 4 - Data Interference

Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law when committed intentionally the damaging, deletion, deterioration, alteration (8)or suppression (9) of computer data without right (10).

Article 6 – Illegal Devices

Each Party shall adopt such legislative and other measures as may be necessary to establish as criminal offences under its domestic law when committed intentionally and without right:

the production, sale, procurement for use, import, distribution or otherwise making available of:
a device, including a computer program, designed or adapted [specifically] [primarily] [particularly] for the purpose of committing any of the offences established in accordance with Article 2 – 5;
vgb
11-03-2000, 04:59 PM
Now *that* is the dumbest thing ( and scariest ) I've ever heard. carry it to the extreme - if you own a computer you have a tool that could be used to violate security.......etc.

Sometimes I think the people who try to make these laws don't have a clue.
mr_R_hund
11-06-2000, 10:35 AM
That really cracks me up.
Since telnet.exe can be used for illegal purposes, I suppose it will be banned :D

And furthermore... A good compiler can be used to produce lots of illegal programs.

Hell, a computer is a tool that can be used for illegal purposes. Ban it.

WHAT AN ABSURD LAW
2nEw
11-11-2000, 03:18 PM
Gotta ban those evil virus spreading e-mail programs too! LOL
apathic
11-26-2000, 07:20 AM
I think they should also ban plastic bags.
They are very bad, because you can use them to suffocate someone.
The screwdriver is also extremely dangerous, not to mention chainsaws and knives,
and you can kill a man with a fork or even with a spoon.
They are all bad, everything should be banned.

In the end, the user is the one who decides what the tool is used for - BAN HIM!


hmemcpy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > hmemcpy
PDA

View Full Version : hmemcpy

nu
11-02-2000, 05:49 PM
hmemcpy is a krnl386 function, that is, a function that resides in the 16 bit portion of the windows (9x) kernel. you don't have it under nt or 2k since the underlying system architecture is made up of pure 32 bit code in such OS's. as for what function does the same, i've heard alot of rambling about memcpy (or was it memcopy?) having a roughly similar role, but i couldnt tell. i havent been cracking for ages, and i've done even less cracking under nt, so i'm not really the one who'll answer this question. the functons that will not work are simply the ones exported by 16 bit modules (kernel, user, gdi, etc) in the 9x core. the 'common' winapi functions will be alright to break on. a good chance if you approach cracking under nt/2k is given by taken into account ntoskrnl and every other module peculiar to those systems. as a rule of thumb, what's not pointed out as being "obsolete" in your win32 api reference, is likely to be a possible breakpoint, independently from the platform.

hope that helps a bit,
neuro.
nu
11-02-2000, 05:51 PM
whoops, sorry, still trying to get used to the system used in this MB :)
my post was meant as a reply to the softice and w2k question below.


SoftIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce
PDA

View Full Version : SoftIce

MR. Candyman
11-04-2000, 01:23 AM
Ok...I've tried downloading SoftIce from all 3 of Hambo's sites...2 of them I was able to download the files, but they were all the same and weren't the full program...the other one I couldn't get to at all.

Are there any other sites that have SoftIce for download?
stanks
11-04-2000, 01:38 AM
Hi!

Try here:

Aaron's homepage -> http://mud.sz.jsinfo.net/per/aaron/

and here:

http://www.crackstore.com/

Greetings
MR. Candyman
11-04-2000, 02:16 AM
Thanks, I just d/led it again...hmmm...a serial number...oh well...I'll either get a serial for it or crack it given enough time.

Thanks
Hexon
11-08-2000, 12:27 PM
Hi candyman

Try downloading SoftIce from here: it comes with the serial: http://www.lockless.com/

I downloaded it from this site only a few days ago, no problem!

Good luck
Hexon


Need help with APISpy32
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Need help with APISpy32
PDA

View Full Version : Need help with APISpy32

InOverMyHead
11-04-2000, 01:50 AM
I have downloaded and upzipped the program file. I have read the help file on their web site, but I don't understand how to install it or use it.

I have ran it from the directory where I unzipped it, but I don't see anything being captured when I run a program.

Any help would be appreciated.

Thanks
Lord Rhesus
11-04-2000, 01:44 PM
Hope I'm not patronising you but have you selected any API calls to monitor for?
Are you using Windows 95/98, ME, NT or 2000?
The problem is probably cause by one of the above. If not then flame me!


hard copy of softice trace buffer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > hard copy of softice trace buffer
PDA

View Full Version : hard copy of softice trace buffer

Dadrksde
11-04-2000, 07:05 AM
I've searched the documentations extensively. Seems there is no way to save to file (I have a HP windows only printer so printscrn key won't work) a trace sequence recorded by a BPRW mod-name T???
I've tried closing the code window and modify the bp to read "BPRW mod-name R DO 'x' ". This would then place the breaking instructions in the command window so it can be saved through loader's save command history feature.
This quickly overflowed my command history (set at 356k)
I don't enable this breakpoint until my "bmsg hwnd wm_Lbuttonup" triggers and then disable when "bpx messageboxA" (failed) or "bpx mcisendcommanda" (passed) triggers. Don't know how much further I could isolate the suspected code.
Since I have a valid serial for one of the cars in this program,my thinking is a simple file comparison of a trace that passed with one that failed would show the decision points that need to be modified to get an "always pass" situation.
I'm not too keen on the idea of hand copying 5000 lines of trace buffer code
The Owl
11-04-2000, 09:01 AM
you may want to give icedump and its tracer engine a try as well. when you enable logging, you will have the option to log every traced instruction or only those that can change the execution flow. it won't log disassembly, only cs:eip/ss:esp, but that should be enough information.


W32Dasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32Dasm
PDA

View Full Version : W32Dasm

stanks
11-08-2000, 12:52 PM
Hi!

Anybody know for W32Dasm for Win3.1

thx in advance
mr_R_hund
11-08-2000, 01:21 PM
I'm not sure what you're talking about...
W32dasm doesn't exist in 16-bit versione, however, you can with it disassemble 16 bit programs if you like.

My point: use regular w32dasm for Windows 3.1 programs, or get another disassembler that works in windows 3.1.
esther
11-09-2000, 05:47 AM
mr_R_hund
> I'm not sure what you're talking about...
>W32dasm doesn't exist in 16-bit versione, >however, you can with it disassemble 16 bit >programs if you like.

You are dead wrong mr_R_hund.There's a windows disassmebler for win3.1
Stanks search wdasm15 in ftp site ,you will find it
Happy reversing
regards
esther
mr_R_hund
11-09-2000, 07:09 AM
Yes, but there's a reason it's called w32dasm, you know.

The windows disassembler you mentioned can not disassemble 32-bit programs, (i think?)

Anyways, sorry for the misunderstanding ;)
esther
11-09-2000, 08:06 AM
Hey,
Sorry,maybe I'm too harshed,he wants a win3.1 disassembler.Stanks don't knoe that
w32dasm is for 32bits or 16bits. I apologise
No hard feelings hehhe
cya around
esther
stanks
11-10-2000, 11:00 AM
Hi!

Thank you esther for info about WDasm15.
For your information mr_R_hund and esther, W32Dasm WORKS FINE under win 3.1x (if you don't believe try it). Check in W32Dasm help and you will see this:
"...dialog formats are not completely supported by NT 3.5 and some dialog controls will not display properly.

It will also load on Windows 3.11 with W32s but the debugger operation will be unpredictable."

BTW who cares for debugger. We use Soft Ice. Don't we?

Greetz
esther
11-10-2000, 11:22 AM
Hey Stanks,
Its important to use the "right" tools for
the right os.Sometimes using w32dasm
to debug is much better than sice.Reverse
more progs,you will see...
Anyways,Happy reversing

cya


Newbie, Help with Soft Ice!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Newbie, Help with Soft Ice!
PDA

View Full Version : Newbie, Help with Soft Ice!

Hexon
11-09-2000, 10:44 AM
Hi all

I have a little problem with Soft Ice. I have just started one of the Sandman’s tutorials on how to reverse a util called “StartClean”. In the tut it says set a BPX breakpoint on “getdlgitemtexta”. However when I set it by typing: bpx getdlgitemtexta, I get the error message: symbol not defined (GETDLGITEMTEXTA).

Why does this keep on happening whenever I try to set the breakpoint? Is it something to do with the Symbol Loader that comes with Soft Ice, or the config file. I cannot understand this, according to Sandman’s tut I should be able to set this breakpoint!

Any help here will be greatly appreciated – I want some hair left!

Regards

Hexon
mr_R_hund
11-09-2000, 03:33 PM
You can either load User32.dll from the symbol loader (use the load exports button), or look in your winice.dat, and uncomment user32.dll, and thus enabling it to load everytime SoftIce loads
Razor
11-14-2000, 01:16 AM
try to write bpx GetDlgItemTextA
the snake
11-16-2000, 01:05 PM
Hi
Go to the +Sandman's page, url below.
http://www.idca.com/~thesandman/Softice.html

There is some basic settings you need to do in this file before you start using break points and some other things like references to VB run time files.. (if you want reverse VB programs)

If you have problem to set it up, try to ask some one to e-mail you the file...

the snake


about NASM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > about NASM
PDA

View Full Version : about NASM

0x400
11-11-2000, 03:44 AM
hi all,

my question is:
is there any options in NASM allowing to define start address when compiling raw 32 bit code (no segments)?

i use NASM as a code generator for snippets for win32 executables (and dlls) and everything goes on perfect, BUT in order to make JMPs and CALLs with correct addresses i must use TIMES directive e. g. [TIMES 0040xxxx 0x00] which makes NASM to generate huge (about 4 Mb) output file, from which i use only couple hundert bytes - it takes some time to do this.
maybe i should reverse NASM add this feature? :P

thnx :)
The Owl
11-11-2000, 06:03 AM
if i understood your question properly, then ORG is your friend. and the manual as usual ;-).
0x400
11-11-2000, 07:15 AM
i have tried it - ORG is not a friend ov mine, coz it works only with 2 byte values (at least i could not get it working w 4 byte values) :)
The Owl
11-11-2000, 11:24 AM
i have tried it - ORG is not a friend ov mine, coz it works only with 2 byte values (at least i could not get it working w 4 byte values) :)

well, meet BITS too ;-).
0x400
11-12-2000, 02:33 AM
me lame - i put that ORG before [BITS 32], but i should put after :)

thnx


released icedump 6.020 and nticedump 1.10
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > released icedump 6.020 and nticedump 1.10
PDA

View Full Version : released icedump 6.020 and nticedump 1.10

The Owl
11-11-2000, 02:54 PM
at icedump.tsx.org, not much news, sort of maintenance release. a new command (CLIP) and a new Hydra plugin (for VBOX 4.30), plus support for Windows ME and SoftICE 4.05 build 526 (the one in DriverStudio 2.0 final).


MSI - Installer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > MSI - Installer
PDA

View Full Version : MSI - Installer

Aimless
11-16-2000, 07:22 AM
Hi, this is a post to some MSI issues below.

MSI is noT INSTALLSHIELD product. Its actually an acronym. It stands for (are you ready...?):

Microsoft - Software - Installer

(Yup, this is the NEW installation format in which ALL further microsoft products shall be distributed).

I guess they found out that Installshield was making better money than them in this installer market.

Hmmm...You can get it free if you install Office 2000. Actually, it'll probably be free on the MS site.

Luv Ya All,


A new essay from ShADe - Patching In A Patcher
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A new essay from ShADe - Patching In A Patcher
PDA

View Full Version : A new essay from ShADe - Patching In A Patcher

the snake
11-20-2000, 01:28 AM
Hi all
After a few months that ShADe have left the reversing community, i was very surprised to get by e-mail a new essay that he wrote.
Seem like this guy can't seat quiet, and this is just great for us, reversers and newbies. Hope we can see him back soon.
The essey can be found in ShADe's site (backed up by me) : http://shadeshome.cjb.net at the "myessays" section.

the snake


regmon question?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > regmon question?
PDA

View Full Version : regmon question?

pepperman
11-22-2000, 03:05 PM
why does regmon always return ??? for the first three processes? the 1st one is : ??? QueryValueEx 0xC18A5EC0\MSVBM50 NOTFOUND
??? QueryValueEx 0xC18A5EC0\OLE32 SUCCESS "OLE32.DLL"
??? QueryValueEx 0xC18A5EC0\OLEAUT32 SUCCESS "OLEAUT32.DLL"...(EXCUSE THE MESS but the lines dont fit) ..what about the numbers on the end ..IE: success hkey: 0xC1887E60 ?? is there a tutorial that covers this?

thxz in advance


Please help me with FloodGate
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Please help me with FloodGate
PDA

View Full Version : Please help me with FloodGate

TDHNightmare
11-23-2000, 07:15 PM
I tried to find about floodgate but i can't found anything about it , please help me how it to do while gen a key

TDH@
Solomon
11-24-2000, 01:55 AM
try various search engines

http://search.excite.com/search.gw?search="floodgate"


TRW2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > TRW2000
PDA

View Full Version : TRW2000

DeathLord
11-24-2000, 05:10 AM
Hi guys :-)
I have a newbie question about TRW2000:
How can I translate in it a F11 SoftIce, I mean I want to make a G @ss:esp, I tried G ss:esp but it didn't work :-( .
Thanks in advance for your help and sorry for my poor english


http://www.microsoft.com/ddk/debugging/
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > http://www.microsoft.com/ddk/debugging/
PDA

View Full Version : http://www.microsoft.com/ddk/debugging/

The Owl
11-24-2000, 09:41 AM
updated tools, quite some stuff to check and/or reverse engineer ;-)


quick icedump question...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > quick icedump question...
PDA

View Full Version : quick icedump question...

Sab
11-24-2000, 08:26 PM
I have been useing procdump and trw2k to dump most my files. However , in this case procdump crashes and trw2k isnt winnt compatible so i cant run the program i dumped in winnt. Anyways heres my question.. when i type /Dump
AddressofOEPHERE(0183EBA2) 172128 C:\my.dll
it comes out to be 200 or so megs? when it is only 172kb... heres some info about what im dumping.. its packed file size is 172kb , its a dll and im dumping it from win9x useing Sice 4.05 and id6016(icedump) Thanks for reading .
Kayaker
11-24-2000, 09:51 PM
Hi,

I've had that happen a few times too (like yesterday!), but after repeating the dump it was fine. Just one of those glitches I guess...

Kayaker
The Owl
11-25-2000, 05:25 AM
hummm, now that's interesting ;-). the size for /dump comes from the internal winice expression evaluator, i have no control over it. in your case it means it was evaluated as a hexadecimal number, i.e some 1.5 Megs, but that still doesn't quite explain the 200 Megs... in any case, i'd try it with the latest 6.020 or 6.021pre just in case i managed to fix it. also, you'd be better off with /pedump (and its numerous options) if your target is a PE image.

kayaker: what versions did you use and could you reproduce the behaviour? if so, let me know how and i will take a look at it.
Kayaker
11-25-2000, 10:11 PM
Hi Owl,

I've had this happen a few times before with earlier versions of Icedump, the latest was when dumping the unpacking project currently being worked on in the Projects Forum using Icedump 6.018. Since I'd seen this before I just ignored the glitch, deleted it, tried it again and it worked OK. I seem to remember the sizes of the faulty dumps being in the 200Mb range as well though.

I tried reproducing it a few times with no luck. If I happen to notice this again, I'll take specifics and dig up the History log to see exactly what was entered.

Regards,

Kayaker
latigo
11-26-2000, 08:40 PM
Howdy!
I had this exact problem tonite..
icedump dumped files about 200 megs big!
Coincidentally i had this problem while dumping from erroneous addresses in memory.
When i say erroneous, i mean not the ones i had to dump from.
For example:
I had to dump from RVA 10200 but as i was kinda tired i forgot to add the image base to that number..and the two dumps from address 10200 in memory were too big.
When i corrected the address, i got a normal dump.
I don't know if this was a coincidence or what, but just posted it cos it might be helpfull.
Bye!
Mr Smith
11-28-2000, 04:01 AM
I had similar problems with /dump in icedump 6.020. In my case the problem seemed to be that I didn't specify a selector in front of the address. Once I did that (167:41c023) everything worked fine.

Mr Smith
Sab
11-30-2000, 05:31 PM
thanks for the help guys i just got back and read the replies im going to go ahead and try the suggestions from all of you and all replies were helpful btw it seems as though i did a little of everything wrong ( :
The Owl
12-02-2000, 11:33 AM
problem found and fixed, wait for 6.021 or its next prerelease. the bug manifests only when you have some non committed pages in the dump area, something that normally does/should not happen.
Sab
12-04-2000, 12:00 AM
Cool ( : btw I tried useing pedump and I dont know if its from my lack of knowledge in useing icedump but heres what happened. When i Dump the app useing trw1.22 with MakePE option (MakePE Filename IMTE) it dumps fine and runs under win9x without any protection. However, on winNT i get a tlsfreeinternal error something about a entrypoint. When I dump in trw1.22 it dumps the export/import table and strings basically the whole package ( : however useing pedump in the following form /PEDUMP <imagebaseinmemoryy> <EIPofentrypointandwhereimatindebugger> <C:\some.dll> it dumps fine however when i dissamble it i notice there is no import table.. hrm... anything u notice right off the bat im doing wrong? thanks! (btw glad to hear that that /dump bug will be fixed soon)
The Owl
12-04-2000, 04:39 PM
However, on winNT i get a tlsfreeinternal error something about a entrypoint.

probably incorrect TLS object or incorrect kernel32 imports. on former i can't comment but latter is taken care of by icedump 6.021.

however useing pedump in the following form /PEDUMP <imagebaseinmemoryy> <EIPofentrypointandwhereimatindebugger> <C:\some.dll> it dumps fine however when i dissamble it i notice there is no import table.. hrm... anything u notice right off the bat im doing wrong?

the entry point parameter must be a RVA, and not a VA (ie, VA-imagebase). but it has nothing to do with imports reconstruction. did you set any special options for PEDUMP (/option p ...)? or perhaps use a /hydra plugin?
Sab
12-04-2000, 05:36 PM
ahh i did not calculate rv-imagebase, ill try that and download the new icedump today (just transfered everything to a brand new drive i bought a nice 30 gigor)
Sab
12-04-2000, 05:42 PM
va-imagebase rather. also i did not use any special options and i am not useing the hyrda plugin, unless it is set to default but i did nothing to implement anything special just used the the pedump command as it was i will try this all tonight see if it works out. Thanks for all your quick responses owl/others who helped out.
Sab
12-06-2000, 12:50 AM
weeeeeeeeeeeeeeeeee ( :
Welp heres what happened i bought a new harddrive(nice 7200 30 gigs they got all over for sale) and reindid my intire machine. I installed softice 4.05 and downloaded a brand new copy of icedump 6021. The dump command no longer does those mean 200 meg files, and the pedump function got me to dump a completly rebuild .exe from the protected one i had been working on. So its safe to say.. the new icedump is great ( : Owl thanks for the help and for a awesome tool for reversers to have. Im gonna try useing icedump instead of procdump just because of the convience of not having to switch screens ( : . Once again thank u kindly


Win2000 SoftIce Nt 4.05 Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2000 SoftIce Nt 4.05 Problem
PDA

View Full Version : Win2000 SoftIce Nt 4.05 Problem

I_need_help
11-26-2000, 11:09 PM
I had softice running on my computer just fine. Then I had a large problem and had to delete some programs (SI405NT was one of them) from my disk I also removed all the registry settings that I could find. Now I go to reinstall it and it appears to install properly the video test works, but it will not start, no matter what setting I use for startup. Using "net start ntice" from the cmd line gives me a "system error 1058" it says the service is disabled. I can't find where that service is disabled at. I did a bootlog and it say it loaded ntice.sys just fine. I hope someone can help me THX.

Screwed up
Iceman
12-15-2000, 03:34 AM
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

Here are the registry keys enumerating sercices. Reenable NTICe driver
I_need_help
12-15-2000, 08:08 AM
I have turned on /sos in my boot file so that I can see if the device NTice.sys loads at during the boot and it does. I just cannot activate it with ctrl d. Here is my reg entry
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice]

"ExcludedDisplayDrivers"="VGA;MNMDD;"
"DoInt2DPatch"=dword:00000001
"InstalledDisplayDrivers"="w2kv106p2"
"Type"=dword:00000001
"Group"="NTICE"
"ErrorControl"=dword:00000001
"Tag"=dword:00000020
"Start"=dword:00000000
"KDStackSize"=dword:00008000
"KDHeapSize"=dword:00001fa0
"Mono"=dword:00000000
"Ddraw"=dword:00000001
"Uniprocessor"=dword:00000002
"Build"=dword:00000893
"Check"=dword:00000000
"Version"=dword:00000500

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice\Enum]

"0"="Root\\LEGACY_NTICE\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

I have installed it on another (no mine) win2000 machine and it worked no problem, I double checked the registry settings with mine and they are identical accept for the video driver. I am using an appian jeronimo pro dual monitor card, I can boot into the 98 partition on my machine and it works fine. I just can't make it activate under win2000 since my crash and reinstall

Below is my console output:
f:\>net start ntice
System error 1058 has occurred.

The service cannot be started, either because it is disabled or because it has
no enabled devices associated with it.

Any help is appreciated

TIA
newbie
12-19-2000, 05:11 PM
Hi.
It looks almost the same as mine except the display drivers and Start. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice]

"ExcludedDisplayDrivers"="VGA;MNMDD;"
"InstalledDisplayDrivers"="NV4_DISP"
"Type"=dword:00000001
"Group"="NTICE"
"ErrorControl"=dword:00000001
"Tag"=dword:00000020
"Start"=dword:00000003
"KDStackSize"=dword:00008000
"KDHeapSize"=dword:00001fa0
"Mono"=dword:00000000
"Ddraw"=dword:00000001
"Uniprocessor"=dword:00000002
"Build"=dword:00000893
"Check"=dword:00000000
"Version"=dword:00000500

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice\Enum]

"0"="Root\\LEGACY_NTICE\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Did you install this W2k patch for softice??
I hope it will work. :-)))


can't load icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > can't load icedump
PDA

View Full Version : can't load icedump

mike
11-26-2000, 11:17 PM
im running win98 using softice 4.05 build 334 and when i try to run icedump.exe it says:

icedump v6.0.2.0 for winice v4.05 build 334 loader
icedump was not loaded yet
VXDLDR failed to load icedump

any help will be greatly appreciated.
thanks.
The Owl
11-27-2000, 06:24 AM
did you load exports for kernel32 (in winice.dat)?
mike
11-27-2000, 12:16 PM
that was it... i just downloaded a new version and i didn't fix up winice.dat. thanks.


fooled by icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > fooled by icedump
PDA

View Full Version : fooled by icedump

latigo
11-27-2000, 01:56 PM
I was fooled when i tried the /tetris command . just that. hehe. :)
Btw are you guys going to release some docs about icedump? i know that the sources are available, but some of them are not very clear to us non-leetos :).
Thanks.
The Owl
11-27-2000, 03:47 PM
I was fooled when i tried the /tetris command . just that. hehe. :)

uhm, fooled? honestly, what did you expect? pacman? ;-)

Btw are you guys going to release some docs about icedump? i know that the sources are available, but some of them are not very clear to us non-leetos :).

well, good question. i've always had the intention to document all the knowledge that manifested in icedump, but unfortunately life/time/mood/etc (or lack thereof) has proved to be stronger than me... thing is, it is simply too much stuff, especially if i wanted to explain to people with little or no background in reverse engineering (win9x/nt/softice), IA-32 protected mode programming, OS design/implementation, etc. as you can see, covering all these topics would easily amount to writing an entire book. so, until life provides me with better circumstances, i will try my best to answer specific questions, or at least give out a few pointers, but i'm afraid the long promised 'technical docs' on icedump will have to wait.


prob: sice 4.05 with ne2000 / remote debugging
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > prob: sice 4.05 with ne2000 / remote debugging
PDA

View Full Version : prob: sice 4.05 with ne2000 / remote debugging

hackscode
11-27-2000, 10:19 PM
hi all!

I need some help with sice 4.05 running on a w95b
machine with a pci-bus ne2000 compatible network
card (realtek chipset)

For setting up sice for remote-debugging via
tcp/ip network, numega provided a driver named
nmne2k.sys for ne2000 compatible cards. I have
tried that driver on a pc with an isa-bus ne2000
and it works fine.
Now the problem: The pci-bus ne2000 does as default
use an i/o range og 6000-601f on my machine. The
driver provided by numega allows an adress range
iirc from 0x200 .. 0x320. Simply changing the
original driver with that supplied by numega (and
renaming that to rtl8029.sys) makes the card
deactivated ('wrong driver'). After restoring the
original driver I tried that again, this time first
manually setting the adress range of the card to
0x320-0x33f, and then changing and renaming the
driver. But no success...

Maybe someone has a solution. Obviously I can't
call the numega support for assistance ...
Anticode
11-28-2000, 09:17 AM
This is what you need to do:
In device manager, select your network card, click properties.
In the 'dirver' property sheet, press on 'update driver'.
Select 'display a list of known drivers'.
Select 'have disk' and point to softice's ne2000 directory.
There should be a list of manufactures and drivers, go to realtek and select 'Realtek RTL8019 LAN adapter or compatable for SoftICE'.
(i know its not 8029 but it works.)


SI loader doesn't always break at program start ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI loader doesn't always break at program start ??
PDA

View Full Version : SI loader doesn't always break at program start ??

Mr. Smith
11-29-2000, 08:48 AM
Hi,
I'm using SI 4.0.5 under NT4 for some time now, but recently I noticed a very strange behaviour. The SI loader doesn't always break at the program start !
This has nothing to do with manipulated section attributes because this also happens with some of my own programs !!
Some break at the start, others run through, and this behaviour only started recently.

Any idea what's going on ?

Many thanks,
the snake
12-04-2000, 10:44 AM
Hi
I'm not sure about NT and specialy about "your" programs, all this happend usually when program is packed...
Do you packed your programs is any way while compile them, maybe ?

good luck
the snake
IcyDee
12-05-2000, 04:08 PM
I think that this happens if you make extensive use of bpm type breakpoints. It seem that the loader uses one breakpoint of this type. If you have specified four bpm breakpoints then this leaves none for the loader and it does not break!


Softice vs Win Me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice vs Win Me
PDA

View Full Version : Softice vs Win Me

Vasquez
11-30-2000, 01:01 PM
Hello!
Plz can any1 tell me how to run Softice on Windows Millenium Edition?
Thnx
The Owl
12-01-2000, 03:50 AM
there are 3 ways i know of.

1. numega/ms ('official'): go to the MS DDK download page and get the WME DDK which has the debug version of io.sys plus read the numega site for details.

2. use wmldr (at icedump.tsx.org), comes with install doc.

3. use MFD's patch to boot into command.com and run winice from command line (or maybe autoexec.bat works too, i never tried this myself).


Winice Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Winice Reversing
PDA

View Full Version : Winice Reversing

latigo
11-30-2000, 03:16 PM
Hi there!
I don't know why but i happen to have some interests in the inner workings of Winice.
I've been searching in Fravia's old fortress and found that most docs about winice reversing deal with cracking the 'commercial' protection. But none (or very little) about how it works.
Needless to say any pointer is very much appreciated!!
ThRaX
11-30-2000, 05:22 PM
Alright, cool I'm actually pretty interested in that too, and just started looking into it...Fravia's site has a project about 'Cracking' it, but I sorta wanna go deeper than that. I guess that theres not many docs about it, maybe we could be the ones to create 'em...Ya know, all docs have to be originally created by *someone* ;)

If you find anything interesting just email me, thrax@mindspring.com

cya later

--ThRaX
mamaich
12-03-2000, 05:23 AM
ThRaX (11-30-2000 07:22):
Alright, cool I'm actually pretty interested in that too, and just started looking into it...Fravia's site has a project about 'Cracking' it, but I sorta wanna go deeper than that. I guess that theres not many docs about it, maybe we could be the ones to create 'em...Ya know, all docs have to be originally created by *someone* ;)

If you find anything interesting just email me, thrax@mindspring.com

cya later

--ThRaX

By the way, if you know Russian, you can read my small essay at www.reversing.net. Or you can read an electronic-translated version at www.mamaich.f2s.com (very bad translation ;)
Though that essay is not complete and deals only with writing SoftIce extensions for NT/2K...


icedump 6.021 & nticedump 1.10 are out
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump 6.021 & nticedump 1.10 are out
PDA

View Full Version : icedump 6.021 & nticedump 1.10 are out

The Owl
12-04-2000, 04:30 PM
at icedump.tsx.org, as usual.

news:

- fixed DUMP/LOAD
- HASPCODE
- PEDUMPed files have proper kernel32 imports (meaning that they will work under NT/2000 as well)


TWR2000 vs SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > TWR2000 vs SoftICE
PDA

View Full Version : TWR2000 vs SoftICE

·TeKiN [²K]
12-06-2000, 02:54 PM
Hi,

It's a simple question, maybe some of you will find it stupid but I'd like to know which is the best debugger.
I like TRW because you haven't to launch it before windows starts and you can unload it when you want but sometimes I wonder about which is the best. I use both but where are the differences? I would like experienced reversers answer me ;)
Kayaker
12-06-2000, 04:01 PM
Hi,

Once major difference that springs to mind, and there may be another way to do this but I haven't found it, is that there is no BPR command in TRW, so it's difficult to break on a range of memory accesses.

I've found the odd API that TRW doesn't recognize and I can't seem to enable mouse support either. The PEDUMP feature is nice though.

Kayaker
Anticode
12-07-2000, 05:34 AM
Sometimes an advantage is also a disadvantage: with trw2k you cant debug windows boot proccess (drivers initialization code etc..)
Lord Soth
12-16-2000, 12:15 AM
I personally don't like the fact that TRW can't change the horizontal width of the debugger screen. The lack of BPR is really annoying too.
Altho it has some good advantages (namely being loadable at will). The problem is SI is more complete, if you will.
A problem with SI tho is that it's very very easy to detect and crash in numerous ways..
I still prefer SI, but I like the GUI of TRW better hehehe
With SI I feel at home :)

LS
Lord Soth
12-16-2000, 12:17 AM
Did I forget to mention that I didn't find any macro capabilities in TRW ?
Maybe I'm not aware of them existing but they are important, and TRW should have them.

LS
Anticode
12-16-2000, 03:57 PM
PS: I think TRW2000 have been discontinued.
m!
12-19-2000, 08:43 AM
I love TRW2K 1.22 registered, but it always crashes when I try a bmsg (or bpmsg) :(. really annoying.


I d/l ed the new "free" version of Opera...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > I d/l ed the new "free" version of Opera...
PDA

View Full Version : I d/l ed the new "free" version of Opera...

mr_R_hund
12-08-2000, 12:12 PM
... and I'm no longer the happy man I used to be. It's hardly an upgrade. More like a downgrade :(
Jueteng Lord
12-08-2000, 05:18 PM
One thing I hate about Opera, is that it now has more and more useless features like the messaging crap and such. If they concentrate on the browser itself, it would excell far better.

The way its been going, we might see another Netscape with all those integration of mail, news, etc (which bloats the program imo)
Magus
12-29-2000, 11:45 PM
I have to agree. I've written them several times trying to get them to fix their JavaScript engine to no avail. It still doesn't handle the Java/JavaScript interface properly. Now as to the features added, Mail, News &c. this is good from the useage point of view but may bloat the code somewhat.

I am having a hard time waiting for them to fix this type of problem, so much so that I now run Mizilla 0.6 in preference to Opera.

Regards,
Magus.
ThrillSeeker
01-13-2001, 09:03 AM
Your right. I use to be happy with 4.xx but now i'm mad. It crashes sometimes. The 4.xx use to be perfect and never crashes. Now I have to try to find another browser that would suit my needs.
OeDiFuZz
01-13-2001, 01:53 PM
before, i was using M$ Internet Exploder. i was happy when i got opera 5.01 cause it's really fast even. but now i'm experiencing the same thing with me when i use opera 5.01. it really makes me angry when opera crashes especially when i hav to restart all over again.


help me with nticedump1.8
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > help me with nticedump1.8
PDA

View Full Version : help me with nticedump1.8

chn-boy
12-09-2000, 08:22 PM
Could someone please,tell me how to use nticedump 1.8 in SoftICE4.05?
The Owl
12-10-2000, 03:19 AM
1. which build of 4.05? 1.8 supports 334 only, use 1.10+ for newer versions.

2. what is the problem? the little info you provided (pretty much nothing) doesn't exactly help anyone to remotely guess your problem.... if it's about installing the thing at all, then here's a quick guide: copy the appropriate 'icedump' file and ntid.exe into your %systemroot%\system32\drivers\ directory (ie. where normally ntice.sys is itself). then simply run ntid.exe and your ntice should be patched, finally reboot (or if you haven't loaded ntice yet, simply start it manually).


contacting protools ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > contacting protools ?
PDA

View Full Version : contacting protools ?

Mr. Smith
12-11-2000, 05:13 AM
Hi,
I tried to contact the maintainer of protools (Kaparo) at protools@w3.to but the email bounced :-(
Does anyone know a working email ?

Mr. Smith
Kaparo
01-01-2001, 09:56 AM
please!!


FLEXlm v6.x *VENDOR-KEYGEN* from PGC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FLEXlm v6.x *VENDOR-KEYGEN* from PGC
PDA

View Full Version : FLEXlm v6.x *VENDOR-KEYGEN* from PGC

Scatje
12-12-2000, 04:01 AM
hello,

i found these info file:

Pirates Gone Crazy [PGC]
proudly Presen
FLEXlm SDK v6.x *KEYGEN* (c) Globetrotter Software
Release Date: 02.27.2000

"This is lmkg6, a vendor key generator for the version 6 FLEXlm software development
kit. This code generates a set of VAILD vendor keys for a given vendor name. Keys
generated with this software are valid on all known platforms."

It´s sound nice , does anyoine know a download url or something like that for this software ?

thanks
Nolan Blender
12-12-2000, 10:45 AM
In the flexlm section on zencrack2.cjb.net,
you'll find flextool.zip, which contains all
sorts of really helpful goodies, most notably
lmrecode, which also generates valid vendor
keys for FLEXlm. Source is included for
lmrecode, which is helpful if you want to
make your own fancy license generator.

The PGC key generator is specific to version
6 of FLEXlm, and is really a derivative work
of lmrecode.

I hope this is helpful, and clarifies things
a bit.


Sourcer v 8.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Sourcer v 8.0
PDA

View Full Version : Sourcer v 8.0

yoritomo
12-12-2000, 09:12 AM
anyone have any experience with this new dissassembler by V-Com yet?
comments?
thanks

URL hxxp://www.v-com.com/product/devsopr.html

-yoritomo
Malkocoglu
12-20-2000, 10:08 AM
Where is it ?
Finally a new version is out...
What are the new features and the URL please ?
funfstern00
01-05-2001, 02:56 PM
Yeah,

what is the url, i have heard so much about this program but it is version 7.0, is the new version 8.0 for win32 programs as well and please tell us where we can download this baby... thanks..

ff
DGR
01-05-2001, 06:33 PM
There is no place to download it yet... unless u wanna spend some bucks for the real program. It hasn't been warezed newayz...

So have patience, once it shows up u'll notice it...


Memory Upgrade - SICE Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Memory Upgrade - SICE Problem
PDA

View Full Version : Memory Upgrade - SICE Problem

Timmy
12-13-2000, 10:06 AM
Today I have upgraded my system memory from 256Mb to 512Mb SDRAM (PIII 600EB / PC133) on a Gigabyte 6CXC motherboard. In the softice initialization settings I have changed Total RAM from 256 to 512 as you would expect. The problem is that when the comp is booted I now get a BSOD saying "VCACHE Device Initialization Failed", then something about not enough memory. (if windoze is loaded without SICE there isn't a problem). Any ideas anyone ?
The Owl
12-13-2000, 10:50 AM
it's not entirely a SoftICE problem, but that of windows as well. both SoftICE and vcache try to reserve as much memory in the system arena (roughly the upper 1 GB of the linear address space) as much physical ram you have. this adds up to 1 GB in your case - obviously they would leave no room for other VxDs should they succeed. since SoftICE reserves its memory first, vcache's attempt will fail.

to solve the problem, set minfilecache/maxfilecache to values less than your physical ram size. ie, in system.ini add something like this this:

[vcache]
minfilecache=8192
maxfilecache=65536

numbers are in kbytes and for guidance only, feel free to experiment to see what brings you the biggest performance advantage.
Timmy
12-13-2000, 01:02 PM
Thanks for the help. I have done a bit of digging and came up with the same sort of remedy myself. I have read that it is more of a windoze problem (suprise suprise), and the remedy is to set vcache to between 60% and 70% of your total amount of ram with win98se but never exceed 512Mb regardless. With a bit of experimenting I now have a stable system with both MinFileCache and MaxFileCache set to 346112 (338Mb). The reason I have them both the same is because I have read (using a search on deja.com) that this is the way to go. Any ideas why this has been said, myself I would have thought that MinFileCache should have been in the order of what you suggested. Obviously when SICE is loaded the speed of the machine is not the main consideration, stability is, but I would just like to know what difference lowering MinFileCache would make. Anyway, so far, the machine seems to OK for now - time will tell. Thanks again.
Lord Soth
12-16-2000, 12:22 AM
This might seem like a stupid question, but WHY would you need 512 MB of RAM on your personal computer ?

LS
Timmy
12-16-2000, 05:06 AM
Because it was very cheap and I thought why not. Actually, it has made a slight speed improvement also.


Ho to use Tracex and hydra ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Ho to use Tracex and hydra ?
PDA

View Full Version : Ho to use Tracex and hydra ?

LaptoniC
12-16-2000, 05:47 PM
I am trying to figure out how this features work.For example I have tried tracex on upxed exe file and after 2-3 minutes program run but softice didnt popup.However when I try with trw2k pnewsec it stopped after unpacking.I have problems with hydra too.Could someone document how yo use this features(tracex and hydra -unbox.dll ) with I am so dumb to understand without example
Thanks
The Owl
12-17-2000, 06:33 AM
I am trying to figure out how this features work.For example I have tried tracex
on upxed exe file and after 2-3 minutes program run but softice didnt popup.However when I try with trw2k pnewsec it stopped after unpacking.I have problems with hydra too.Could someone document how yo use this features(tracex and hydra -unbox.dll ) with I am so dumb to understand without example

it would have helped if you had told us at least what you exactly tried to do - i'm
trying to guess for now.

1. tracex/upx (or anything else):

1. loader32/iceload your target
2. when winice pops up, you're ready to start tracing with

/tracex <low> <high>

where <low> and <high> define the area you think the OEP will be. if your app
starts up without winice popping up at all then it means that either the tracer
was somehow defeated or you made the wrong guess regarding that range. for
upx it will be the latter ;-). a good guess is (usually) the first section (map32 or
a PE editor can tell you where it is), eg. the command will be something
like /tracex 401000 456000. i suggest you try to experiment with it on simple apps
like notepad, then go look up all the other features/options of the tracer engine
(although the default settings rarely need to be changed).

2. hydra

to tell /pedump to use a specific hydra plugin during imports rebuilding you simply use

/hydra unvbox.dll

before you invoke /pedump. note that you need to use /hydra only once, not
each time you /pedump as the .dll will stay in memory until you explicitly unload it
or load another one. for /hydra to work you have to copy all the hydra .dll files
into %windir%\system\hydra\ (this means kernel.dll and at least unvbox.dll in your case).
LaptoniC
12-21-2000, 10:42 AM
Sorry for repling late but I was away for a while here is my problems and detailde info you want

Problem 1:
I am trying to unpack Adobe LiveMotion with the help of hydra.I can unpack without hydra and with trw2k easily.As far as i understand this hydra deals with import rebuilding.Therefore I didnt bypassed the "encyrpt function call" in vbox dll.I have bpx on getprocadress.

0167:0700BCF5 FF15C8310407 CALL [KERNEL32!GetProcAddress]
0167:0700BCFB 8BF8 MOV EDI,EAX
0167:0700BCFD 3BFB CMP EDI,EBX
0167:0700BCFF 0F849D010000 JZ 0700BEA2
0167:0700BD05 8B7616 MOV ESI,[ESI+16]
0167:0700BD08 037508 ADD ESI,[EBP+08]
0167:0700BD0B 395DDC CMP [EBP-24],EBX <-- encyrpt function call
0167:0700BD0E 7435 JZ 0700BD45 <-- jump if not
0167:0700BD10 8D85ECFEFFFF LEA EAX,[EBP-0114]
0167:0700BD16 50 PUSH EAX
0167:0700BD17 FF75E0 PUSH DWORD PTR [EBP-20]
0167:0700BD1A 57 PUSH EDI
0167:0700BD1B E8FD030000 CALL 0700C11D
0167:0700BD20 83C40C ADD ESP,0C
0167:0700BD23 85C0 TEST EAX,EAX
0167:0700BD25 741E JZ 0700BD45
0167:0700BD27 FF7528 PUSH DWORD PTR [EBP+28]
0167:0700BD2A 57 PUSH EDI
0167:0700BD2B FF7524 PUSH DWORD PTR [EBP+24]
0167:0700BD2E FF7520 PUSH DWORD PTR [EBP+20]
0167:0700BD31 E884020000 CALL 0700BFBA
0167:0700BD36 83C410 ADD ESP,10
0167:0700BD39 3BC3 CMP EAX,EBX
0167:0700BD3B 0F8451020000 JZ 0700BF92
0167:0700BD41 8906 MOV [ESI],EAX <-- eax=encrypted
0167:0700BD43 EB02 JMP 0700BD47
0167:0700BD45 893E MOV [ESI],EDI <-- eax=not encrypted
0167:0700BD47 FF45D8 INC DWORD PTR [EBP-28]
0167:0700BD4A 8B45D8 MOV EAX,[EBP-28]
0167:0700BD4D 3B45B4 CMP EAX,[EBP-4C]
0167:0700BD50 0F8C49FEFFFF JL 0700BB9F

I have F5 and F11 couple of times and finally I came to here
015F:011604E0 MOV EDX,[EBP-08]
015F:011604E3 MOV EAX,[EDX+14] <-- get app entry point
015F:011604E6 MOV [EBP-10],EAX
015F:011604E9 MOV EBX,[EBP-10] <-- app entry point to EBX
015F:011604EC JMP EBX <-- jump to real entry point

at this point ebx was 8A1D68 so OEP is 8A1D68-400000=4A1D68
I typed
/hydra unvbox.dll
/pedump 400000 4a1d68 C:\dumped.exe

Windows98 SE (4.10.2222 A) gives fatal exception and it doesnt dump exe.
However if I bypass "encyrpt function call" with jmp 0700BD45 in vbox dll I can dump with pedump or any other dumpers and it works.I have writen /OPTION P in sice but it says import rebuilding meyhod is 3 which i guess should be 4 because I have run hydra and unvbox.dll stub.exe and kernel.dll in my C:\windows\system\hydra directory.
What is wrong here ? I couldnt manage to understand
LaptoniC
12-21-2000, 10:46 AM
Problem 2:
Here is my second question I am trying to understand how this trace engine works.I have packed notepad exe as Owl said and tried to trace it with tracex function.I have loaded my packed notepad.exe and when sice pops I have writen
/tracex 400000 402000
After 2 sec Softice poped again.Yes it found OEP

0167:004010CC 55 PUSH EBP
0167:004010CD 8BEC MOV EBP,ESP
0167:004010CF 83EC44 SUB ESP,44
0167:004010D2 56 PUSH ESI
0167:004010D3 FF15E0634000 CALL [KERNEL32!GetCommandLineA]
0167:004010D9 8BF0 MOV ESI,EAX
0167:004010DB 8A00 MOV AL,[EAX]
Then in order to dump it i have writen
/pedump 400000 4010cc C:\dumped.exe
ICEDUMP: Phoenix engine v2.13 (C) G-RoM 1998/2000

ICEDUMP: Phoenix : Exception handlers installed
ICEDUMP: Phoenix : PEInfos Collected [1]
ICEDUMP: Phoenix : PE Buffer allocated
ICEDUMP: Phoenix : PE Image replicated
ICEDUMP: Phoenix : PEInfos Collected [2]
ICEDUMP: Phoenix : Current TaskDB: 00004086
ICEDUMP: Phoenix : DLL List allocated
ICEDUMP: Phoenix : Failed to rebuild Import table ;Error
ICEDUMP: Phoenix : DLL list deallocated
ICEDUMP: Phoenix : PE buffer deallocated
ICEDUMP: Phoenix : Exception Handlers uninstalled
import table rebuild method was default mode.What is wrong ?
Thanks for any response and sorry for my bad language and knowledge.
G-RoM
12-21-2000, 01:46 PM
Unvbox plugin was designed for a specific APIWrapper of VBOX 4.3. I do not attest it works on any VBOX 4.3 (even if it worked on all VBOX 4.3 we had), they can have change it slightly in order to make plugin fails. IE if version was upgraded u can be sure it won't work anymore.

This is actually the only reason I can find why it fails. If u could paste the APIWrapper code it could give me some hints.

Cheers,
The Owl
12-21-2000, 03:27 PM
Then in order to dump it i have writen
/pedump 400000 4010cc C:\dumped.exe
ICEDUMP: Phoenix engine v2.13 (C) G-RoM 1998/2000

ICEDUMP: Phoenix : Exception handlers installed
ICEDUMP: Phoenix : PEInfos Collected [1]
ICEDUMP: Phoenix : PE Buffer allocated
ICEDUMP: Phoenix : PE Image replicated
ICEDUMP: Phoenix : PEInfos Collected [2]
ICEDUMP: Phoenix : Current TaskDB: 00004086
ICEDUMP: Phoenix : DLL List allocated
ICEDUMP: Phoenix : Failed to rebuild Import table ;Error
ICEDUMP: Phoenix : DLL list deallocated
ICEDUMP: Phoenix : PE buffer deallocated
ICEDUMP: Phoenix : Exception Handlers uninstalled
import table rebuild method was default mode.What is wrong ?

first of all, the OEP in the /PEDUMP command line is an RVA, although you can always fix that later.

import rebuilding is a kinda complex process, unfortunately we'll probably never have the time to document every bit of it (actually G-RoM should since he wrote that part ;-), but i'll try to give some generic guidelines (some of which is already in the manual btw). as you already know, the default import rebuilder mode is 3 which tries to detect IAT thunks and resolve them to DLL exports. the first step is to find said thunks in the process's address space, and the 2nd one is to resolve them.

the former is fully automated, however it does rely on 2 fields in the PE header that should be valid: code base and size (this was a design decision, one may debate it in fact, maybe it will be replaced with some other logic in a future version). not all wrappers restore them properly, so better take a look at them before dumping. as a sidenote, it is normally worth changing some fields in the PE header in order to reduce the dumped image size (this often means that one makes a dump without any special tweaks in the PE header and then examines the dump, figures out what should have been set to what and then makes a 2nd dump).

the 2nd step is semi-automated, for resolving a given IAT slot it can make use of an external helper DLL, the hydra plugin (reminds me, did you make sure that you did not have anything loaded when you dumped notepad? unless it was aspack for which there is some simple support in unwrap.dll). this step cannot really fail (unless there is a bug in a hydra plugin that causes page faults and the like), but nor is it guaranteed to produce a meaningful result, ie. once you manage to 'successfully' dump a PE file with 'rebuilt' imports, it's more than wise to check them. of course for known/simple schemes you can trust the result, but for unknown ones you have to double check it (you'll notice bad imports anyway when you first try to run such an exe ;-).

in short, no matter how hard one tries, import rebuilding will always be an 'art', ie. something that cannot really be fully automated, it's (yet) another endless cat/mouse game. icedump/hydra gives you just a tool and framework to 'fight' your side of the battle, how you make use of it is always up to you.
G-RoM
12-21-2000, 03:38 PM
For ur second pb... i'd suggest u check PE header codebase, codelen fields as Phoenix relies on them. UPX got the bad habit to kill those (manually fix this in mem). This is specified in the documentation somewhere.

Cheers,
LaptoniC
12-23-2000, 07:12 AM
G-RoM (12-21-2000 03:46):
Unvbox plugin was designed for a specific APIWrapper of VBOX 4.3. I do not attest it works on any VBOX 4.3 (even if it worked on all VBOX 4.3 we had), they can have change it slightly in order to make plugin fails. IE if version was upgraded u can be sure it won't work anymore.

This is actually the only reason I can find why it fails. If u could paste the APIWrapper code it could give me some hints.

Cheers,

But when I type /OPTION P why it says import rebuilding method is 3 according to I understand from document it should be 4 ?
G-RoM
12-23-2000, 09:23 AM
Sigh...

Mode 4 is for full plugin mode, it means u provide an IAT detector (ProcessIAT or whatever is the name). UnwrapThunk plugin is able to act in mode 1,2,3,4. U haven't read the documentation correctly or more precisely u didn't read SDK doc :). However... if u select mode 4 and that there is no ProcessIAT function in plugin, it behaves like in mode 3. So set mode 4 if u wish to.

Regards,


HMEMCPY and W2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > HMEMCPY and W2000
PDA

View Full Version : HMEMCPY and W2000

cps530
12-16-2000, 08:10 PM
It seems to me hmemcpy doesn't appears in Windows 2000 (or NT). However I think there's some similar function. Am I right? If so, what's the name of the function? Thanks.
Iceman
12-18-2000, 04:49 AM
hmemcpy stands for Hughe memory copy. Since NT - 2K (unlike w9x family ) are true 32 bit OSs ,
such a function is not needed. Closest "equivalents" are RtlXxxxMemory (where Xxxx can be Move , Compare , Zero ....)are API exported by ntdll.dll and kernel32.dll and the old good classic memcpy()
Csp530
12-19-2000, 04:34 AM
Thanks!
Alucart
01-07-2001, 06:19 AM
Does this also apply to Windows ME? I can't use HMEMCPY either. It tells me that the symbol is not defined.


softice peculiarity
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice peculiarity
PDA

View Full Version : softice peculiarity

ES
12-18-2000, 05:58 AM
Hello. I am witness to some very strange and frustrating Softice installation behavior. Every time that I try to install Softice, my computer completely freezes up once I press "Next" on the the screen where you choose the installed components. This behavior is true for versions 325, 400, 401, and 405! It is also true for Win98 and ME. Before my HD died, I had 405 installed, so the only thing that has changed is my HD.
Ok, I have spent many hours searching the net for even a mention of this oddity. Nothing. I installed TRW2000 to attempt to find out what is going on before the big freeze. The Installshied prog seems to be caught in a loop waiting for a callback. I am not very good at reversing yet, and I have not been able to find a way to exit this loop in a manner that the program seems to want.
Any ideas would be most appreciated.

Thanks,
Eric


filemon
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > filemon
PDA

View Full Version : filemon

kaya23
12-18-2000, 02:03 PM
newbie to the fullest but very willing need some help on how and when to use this prog during the process of cracking.Any help much appreiciated.
mike
12-21-2000, 12:32 PM
Use it to see what files the app uses & what parts get accessed. I.e., is the use counter stored in a file somewhere?

Another useful app for pw cracking is a CRC generator. When there are a bunch of data files & you don't know where the PW is stored, calculate the crc's of each file before and after you change the password. Then compare them to see which file changed.


2Morlac, autor of i6comp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > 2Morlac, autor of i6comp
PDA

View Full Version : 2Morlac, autor of i6comp

Nagual
12-19-2000, 09:08 AM
Do you comtinue developing of i6comp? I've found some bugz in 1.03beta. if it's interesting for you - email me.
Regardz.


isDcc version 2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > isDcc version 2
PDA

View Full Version : isDcc version 2

Mr. Smith
12-20-2000, 03:12 AM
Hi,
I recently worked on an install shield script and I wasn't quite happy with the available tools. So I modified slightly Andrew de Quinceys installshield decompiler isDcc.
I wanted to put it on protools but couldn't contact them (email didn't work), so if you are interested contact me at MrSmith_@hotmail.com and I'll send you the package (I couldn't figure out how to attach a file to this message board :-( ). Here is a short description what's it all about.

What´s the problem ?
If you currently have a problem with an Installshield script file you can use either use
NaTzGULs and SiraXs wisdec, which is easy to use but has problems with many install shield scripts,
or use isDcc which can handle most scripts but that one gives you "only" the source of the script
which can´t be used immediately. Only with the install shield compiler itself can those scripts be
compiled again. Often you need the right compiler version for your script version and even then it can
be tricky to compile it.

What is the solution ?
Version 2 of isDcc prints by default some additional information for each source line which can be
helpful. Like wisdec is prints the offset and opcode for each source line. If you figured out which line
you would like to change you open the script in a hexeditor and go to the offset of that line. The things
you can change are comparisons. "if" statements like "if (lNumber1 = 0) then" have in their binary
representation somewhere a

91 for an <
92 for an >
93 for an <=
94 for an >=
95 for an =
96 for an !=

The other thing which can be changed are lines like "lNumber1 = lNumber0 = 12". Here you find at the
binary level.

01 for an <
02 for an >
03 for an <=
04 for an >=
05 for an =
06 for an !=

After you made the necessary changes you have to correct the CRC which is best be done with mkcrc
by Sebastian Apel which I have included.

Oh yes, if you need the old behaviour you can always start isdcc2 with
isdcc2 -classic bla.ins

Mr. Smith
hfade
01-07-2001, 07:30 PM
How about the installshield6?
Mr Smith
01-08-2001, 09:15 AM
If the old isDcc couldn't do it, this one can't do it !

Mr. SMith


Solid Works
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Solid Works
PDA

View Full Version : Solid Works

MR_Candyman
12-21-2000, 02:18 AM
Ok...this has nothign to do with cracking, but I was wondering if any of you knew where I could get a cracked copy of solid works.

Thanks
noname
12-21-2000, 08:22 AM
wrong forum!
stanks
12-21-2000, 10:50 AM
Did you try the net.
:)


File kernel32.dll can't be accepted as module 'KERNEL32'
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > File kernel32.dll can't be accepted as module 'KERNEL32'
PDA

View Full Version : File kernel32.dll can't be accepted as module 'KERNEL32'

mike
12-21-2000, 12:23 PM
Why not?
Erovin
12-23-2000, 08:30 PM
It's an IDA bug acknowledged in their support forum. They've fixed it but you have to be a real customer. So that's either good news or bad news depending on how you acquired IDA.


unpacker that works w/ shrinker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > unpacker that works w/ shrinker
PDA

View Full Version : unpacker that works w/ shrinker

mike
12-21-2000, 12:41 PM
Anyone know an unpacker that'll work w/ shrinker?
pupp
12-22-2000, 08:31 PM
i allways used (Deshrink1.6) nerer had any problum wit it

pupp
mike
12-27-2000, 11:35 AM
thx


Reveal
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Reveal
PDA

View Full Version : Reveal

meRlin
12-21-2000, 03:09 PM
Hi,
Anyone tested "Reveal", a kind of windows debugger application, there is no evaluation copy availible to test this program but it seems to be a good tool.
Nice if someone know anything about it.

regards
meRlin


Site down for several hours ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Site down for several hours ?
PDA

View Full Version : Site down for several hours ?

tsehp
12-22-2000, 07:24 PM
Just read :

>Dina mis-stated the problem. The fax I got from Microsoft, through
>Globalcenter (the people we get our internet connection from) said:
>
>"Microsoft has received information that the domain listed above, which
>appears to be on servers under your control, is offering unlicensed copies
>oris engaged in other unauthorized activites relating to copyrighted
>computer programs published by Microsoft.
>
>1. Identification of copyrighted works:
>
>Computer Programs
>Windows 98
>Frontpage 98
>Publisher
>Age of Empires
>
>Copyright owners
>Microsoft
>
>2. Infringing material or activity found at the following locations:
>http://66.36.228.12 http://www.woodmann.net/fravia/project9.htm
>http://www.woodmann.net/fravia/twd_aeo.htm
>
>The above location is offering 'Cracks' or 'Serial Numbers', inteded to
>circumvent protection applied to prevent the unauthorized copying and use of
>copyrighted computer programs, for distribution by technical means."
>
>And then there's more that's irrelevant.
>
>That's why we took your site offline.
>
>
>Thanks,
>
**********

Ok, the essays were removed from the mirror. Now, don't even think to publish an essay concerning adding functionnality to msdos 2.0 :)

Sorry for the inconvenience, one good news, woodmann (our great sponsor) took a two year domain account for this place to stay alive.

We're still here to last for a very long time, merry christmas.

+Tsehp


Guillemot problems on Softice4.05 win2000AS
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Guillemot problems on Softice4.05 win2000AS
PDA

View Full Version : Guillemot problems on Softice4.05 win2000AS

Carpathia
12-23-2000, 02:38 AM
Hi,

Im running w2000 Advanced Server with SoftICE 4.05, with a Guillemot GEForce 256 gfx card.

Using nvidea reference drivers, with Universal mode in s'ice, the softice console window will not paint at all.

Numega's knowledge base turns out nothing useful for this. Has anyone else had/solved this problem ?

Thanks.

Carpathia
The Owl
12-23-2000, 09:39 AM
Numega's knowledge base turns out nothing useful for this.

hmm, kinda not surprised ;P. no i haven't solved the issue (yet), but it appears that ntice/siwvid somehow lose track of the linear frame buffer address and they write to the wrong place. you can test this theory by entering ntice via the hotkey, then issue some (not too destructive) commands and exit it. then dump the command history to a file and you should see all those commands. i'm only guessing at this moment that NT may have the habit to remap the frame buffer in linear address space (for whatever reason) and ntice fails to catch this. if anyone has more experience with ddraw and video display drivers, could you please look into this and report the results?


softice 'n stuff...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice 'n stuff...
PDA

View Full Version : softice 'n stuff...

no-brainer
12-23-2000, 03:12 PM
please forgive me my stupidity.

i was reading a tutorial for some crackme, and there was this line of code dumped from softice

UPX1:0042E4B0 call near ptr CheckCode

i got into the exact same line of code in the crackme, and there was no 'CheckCode' on that line... just an address.

so is my copy of softice (4.05, build 334) somehow damaged or am i just plain stupid being unable to see the reason for this?

and what is a tool named "BP v7.0" ???

thank you for taking the time to read my post...
0x400
12-26-2000, 04:24 AM
this may sound strange but -
BP 7.0 == Borland Pascal 7.0
imo :]


Softice 4 wont popup in Win 2000 :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice 4 wont popup in Win 2000 :(
PDA

View Full Version : Softice 4 wont popup in Win 2000 :(

Rayden
12-24-2000, 10:21 AM
Hi,

i have a little problem: I just installed SI4 on my German Win2k. Then i placed my winice.dat into its folder. SI is supposed to popup when i press STRG+D...but nothing....the machine hnags i cant move the mouse anymore and cant hit any more keys...if i press again STRG+D everything is back to nromal...so i think STRg+D works well but SI just wont show its Window.

I already chekced this /NOGIUBOOT option in the boot.ini and switched to standard vga driver und enable UVD...no success at all.

Any1 has some ideas left ?

Tia & Merry christmas from Germany

Rayden ;)
Carpathia
12-24-2000, 10:42 AM
Sounds like youre experiencing similar problems to me. (see thread about Guillemot).

Can I ask what gfx card youre using ?

Carpathia
Rayden
12-24-2000, 02:42 PM
I Have a Elsa Eraotr III Pro with TNT 2 Chipset. I also treid to use the TNT Setting in Softice' Graphic-Setup but it dont help either :(

Rayden
DGR
12-24-2000, 04:59 PM
Same problem here... in both win2k and Whistler. My card is a GeForce2 MX, appearantly it's a specific NVidia problem :/
The Owl
12-25-2000, 06:00 AM
actually, 2 ;-)

1. in which startup mode(s) did you (try to) load ntice?

2. when ntice starts up, it executes the commands from the INIT line in winice.dat. at this point you should see the ntice screen appear/disappear for split moments. can you actually observe this happen? (if different startup methods result in different behaviour, then please specify)
zyn\ker
12-30-2000, 06:22 AM
The NVidia drivers have stopped working with SoftIce some months ago. The last version I know to work with it is 5.32 which you can get at http://www.reactorcritical.com/download.shtml
I didn't try the new 7.xx drivers though, perhaps you can try them and tell me if they work, I don't dare to :)
DGR
12-30-2000, 04:02 PM
Oops, I haven't read this in a while... but here the answers to your questions.

1. What startup modes: Manual. I allways used manual and serves well... I prefer this mode above all others and have never even bothered to try another.

2. Yes, I've seen a window pop up shortly... But I couldn't see what window and the contents.

Actually, I'll install Windows2000 again tomorrow perhaps (soon anywayz) and will let you know more about it...

Take care
Iceman
12-30-2000, 04:51 PM
Try this:

get ntoskrnl.dbg for your win2k build. translate it to nms and make NTICE use .nms for symbol lookup by adding to winice.dat this statement

NTSYMBOLS=ON

if this does not work , please post a msg here with your NTICE build , video card brand you have
and version of video drivers you have + whatever you use UVD or targeted display mode in ntice.. You would help us a lot with this to track down the problem with this information.
DGR
01-02-2001, 07:29 PM
I tried your advice with regards to the ntoskrnl.dbg and it seemed to work fine at first... I got the softice screen and work with it. But then after a few minutes it was gone, the softice screen wasn't shown nemore (it was still there since ctrl^d would freeze the system and another ctrl^d would 'enable' it. Also when typing "bpx getlocaltime" in freeze-mode the system would freeze few times after ctrl^d, indicating that the bp's triggered).

So I don't know, maybe I don't have the correct .dbg file. Can anyone send me/mail me/tell me where I can get the ntoskrnl.dbg file for windows2000 Professional Final Edition. Also, where do I have to put the .nms file... in winnt/system32 or the softice dir itself?

I used the driverstudio2.0 release from softice, with detonator v6.49 drivers, using the Universal display driver. My card is a geforce2 mx from Asus ( v7100).
WHat IS the newest softice version? The one I'm using now... or should I go for the 4.05 version...

I would really LOVE to solve this issue as well...

DGR
The Owl
01-03-2001, 03:39 AM
So I don't know, maybe I don't have the correct .dbg file. Can anyone send me/mail me/tell me where I can get the ntoskrnl.dbg file for windows2000 Professional Final Edition. Also, where do I have to put the .nms file... in winnt/system32 or the softice dir itself?

customer support center:

http://www.microsoft.com/WINDOWS2000/downloads

follow the Other Downloads/Customer Support Diagnostics link.

.nms has to be where the file it refers to is, but i think loader32's translation mechanism will put it into the right directory for you.

btw, where did you get your .dbg files from?

WHat IS the newest softice version? The one I'm using now... or should I go for the 4.05 version...

4.05.526 from DS 2.0 (maybe there are newer beta builds since then).

as for my previous questions: does ntice pop up briefly when it executes the INIT line? or not even then?
DGR
01-03-2001, 04:16 AM
Ah tnx, downloading it now....

I found the file by doing an ftp search and with the help of a helpful friend :) I also only got the ntoskrnl.dbg file, no others...

As for your question, yes... softice does pop up while executing the ini line. It even seems to work (a bit) now, meaning I DO see the softice window for a while, it pops up on ctrl^d as it's supposed to do and also at breakpoints. Now I don't know if it is because of the ntoskrnl.dbg and .nms file or maybe the newest version (Driversuite 2.0) or even the drivers (Det3 6.49). I'll have to look at that. But where before I never saw the softice screen it now acts normal for a while...

After a few minutes of use however it 'snaps back' to the original problem this topic is all about but as I said, it could be that the .dbg file I have is not the right one.

I'll give you some more info asap once I finished this download.

Take care,

DGR
DGR
01-03-2001, 05:01 AM
And ehm... DS2.0, is that DriverStudio 2.0 or DriverSuite2.0
DGR
01-03-2001, 08:14 AM
Still no luck,

Reinstalled everything, used softice from Driverstudio 2.0. I got the ntoskrnl.dbg file (from the location pointed out by The Owl) and translated it to a .nms file. Added it to the Softice Initialization Settings using the symbol loader and started praying. However, no luck...

Again it seems to work for a very short while, window pops up and u can use it normally... however suddenly the window stops popping up and the problem is back. I also tried it without the symbol file (that is, without the procedure above) and with the exact same result. It works for a very short while and then... problem.

The fact that before I never even could use softice my guess is that the 6.49 drivers (or the softice version from the Driver Suite 2.0) fixed some things.I'll try installing some older Detonator drivers to see if I can verify this.

If u need ne more info feel free to mail me...

Take care,

DGR
DGR
01-05-2001, 07:52 AM
Well, I just keep on trying...

Appearantly switching the colour depth can help with this problem... (desktop/display->properties) I used 32-bit, got probs with the si-screen not popping up, switched to 16-bit and suddenly it appeared. Also, probs in 16-bit were solved by changing to 32-bit.

It's not as if it's default working on a certain depth, but changing it while running softice (so without rebootign the puter to let it take affect) works atleast temporarily.

I'll just keep fewling around to see if there's a way to fix it or work around, and I'll just keep posting it here even tho noone reads it ;)
miscreant
01-23-2001, 03:35 PM
If you revert back to the old detonator 5.32 drivers it will work fine.

Only problem is that they suck for DirectDraw and Direct3D Performance, even MS Powerpoint presentations start to run slow!


debugging when online
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > debugging when online
PDA

View Full Version : debugging when online

noname
12-25-2000, 07:28 AM
Hi guys,
Need some help when debugging online.
It always disconnect when I'm debugging
any prog when I'm online.Any help appreciate

TIA
Merry Christmas
best regards

nonmae
Muad'Dib
12-27-2000, 01:25 PM
I'm afraid as of now you can't debug while online without being disconnected. Maybe if a patch were to be built that were to disrupt SICE every few seconds to handle all the packets coming in, there could be a possibility. Its worth a try...maybe someone can make it and Owl can incorporate it into Icedump?
noname
12-28-2000, 06:19 AM
Hi Muad'Dib,
Thankyou fer yer responese .
Greatly appreciate :)

best regards

noname
The Owl
12-28-2000, 08:39 AM
I'm afraid as of now you can't debug while online without being disconnected. Maybe if a patch were to be built that were to disrupt SICE every few seconds to handle all the packets coming in, there could be a possibility. Its worth a try...maybe someone can make it and Owl can incorporate it into Icedump?

this issue was raised already by other people as well, and every time i thought about it, i just couldn't figure out if it was worth the hassle/effort in the end or not (not talking about the experience one would gain by getting it to work, but the whole purpose of this).

as i see it, to prevent modem disconnections, network timeouts, etc, one would have to do this:

1. initialize/handle timer in softice
2. after some interval resume OS (exit softice)
3. after some interval enter softice (at the same 'context' where we left it)
4. go to 2.

this scheme would allow then the OS to process pending IRQs, process packets, etc. this sounds nice and simple enough so far, but when you get to implement it, you'll face a few questions.

1. softice by default does not handle the timer IRQ, ie. it doesn't hook its handler let alone enable/process it (this is not that hard to solve though).

2. how much should 'some interval' be? obviously resuming the OS too often would ruin the user experience, doing it too late would defeat the purpose of the whole project.

3. same question, how much time to wait before returning to softice? when can one be sure that all the relevant packets have been processed, winsock (tcp/ip stack) updated all the internal connection states, etc? and of course waiting here too much (your brain would observe anything over say 20 msec i think which is not much time) will ruin the user experience as well.

to summarize, i see no real benefit in implementing this, people would be better off by not using a kernel debugger for application debugging, or at least not while online ;-).
noname
12-29-2000, 08:24 AM
Hi The Owl,

Thanks for the input.Greatly appreciate.

:)

best regards and Happy New Year

noname


How to patch subroutine calls ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to patch subroutine calls ?
PDA

View Full Version : How to patch subroutine calls ?

Mr. Smith
12-25-2000, 04:54 PM
Hi everybody,

I have a target where I have to NOP an internal subroutine call (i.e. call 401522). But how can I patch this call within the file on disk ? I mean the bytes on disk are different from the bytes in memory (because the actual bytes are calculated during load time), so putting nops in the file doesn´t work. Furthermore this routine takes no parameters on the stack, so I have no spare space to insert a jmp before the call and I cannot manipulate the subroutine itself because it is called and needed from other parts of the program.

Any ideas ?

Mr. Smith
Anticode
12-25-2000, 05:42 PM
one solution is not to patch the subroutine call but patch the subroutine itself and put a ret instruction at 401522. you get the same effect.
IcyDee
01-07-2001, 05:12 PM
When you don't have enough room, replace some of the code before the call to jump to another address where there is room to insert some code. At the new address put in the code that was lost by the jump, then jump back to the address after the call. Voila.


SoftIce and Windows 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce and Windows 2000
PDA

View Full Version : SoftIce and Windows 2000

Cps530
12-25-2000, 06:58 PM
I'm loading SI ('Driver Studio') after W2k (from 'start SI'). I can't unload SI anymore. Just rebooting. But when I try to reboot, during the issuing of the message 'Saving your settings' my computer freezes and I need to turn it off and on again. Any idea to overcome that? Thanks in advance.


W32dasm and Windows 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32dasm and Windows 2000
PDA

View Full Version : W32dasm and Windows 2000

Hoof Arted
12-26-2000, 06:43 AM
Has anyone tried to run W32Dasm on Windows 2000 and managed to get it working 100% ?

I have tried to get info on this from everywhere on the net without joy.

When you load up the Dasm software and launch the app for debugging, windows 2000 kills both the W32Dasm process and the app process when you try see the api call info (especially when you try add a breakpoint to user32.dll and kernel32.dll). Is there a way around this ?

I have noticed that amount of issues that some are having with SoftIce and I cannot help feeling that we are all being affected by the same problem. Does your SoftIce service / process get killed or just ignored ?

What I can say is that W32Dasm runs perfectly on Win2K Pro RC2 and below so something has been done to the release version to stop us from debugging.

Any info would be appreciated.


wme ddk
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > wme ddk
PDA

View Full Version : wme ddk

rocknhome
12-26-2000, 06:29 PM
where can i find the wme ddk for softice to run on milleniam i'm new at this and want to learn as much as i can i think its fun and would like any help i can get thanks so much for your time
Muad'Dib
12-27-2000, 01:20 PM
There is a patch for Window$ ME available at http://www.geocities.com/mfd4life_2000 . Just so you know, Window$ ME sucks, stick with 98 SE :)
Drak0
12-27-2000, 03:25 PM
Muad'Dib (12-27-2000 03:20):
There is a patch for Window$ ME available at http://www.geocities.com/mfd4life_2000 . Just so you know, Window$ ME sucks, stick with 98 SE :)

Why does winME suck compaired to win98SE? (just curious...)

I'm using winME right now....

-Drak0
rocknhome
12-27-2000, 05:04 PM
Muad'Dib (12-27-2000 03:20):
There is a patch for Window$ ME available at http://www.geocities.com/mfd4life_2000 . Just so you know, Window$ ME sucks, stick with 98 SE :)

thank you very much and i'm learning that it does suck but this is a replacement because best buy blew up my other system for me thanks again


My new video board and SoftIce 4.05
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > My new video board and SoftIce 4.05
PDA

View Full Version : My new video board and SoftIce 4.05

Snacker
12-28-2000, 01:59 PM
Hi i changed my video bord these days and now SoftIce won't work anymore :(
even standard don't work

here are some info that might be usefull for someone to help me

Adaptor : SiS 530

Manufacturer : SiS
Processor Type : 530 Rev A3
DAC type : Internal
memory : 8mb
Resources : DirectDraw 1.00
software version: 4.0
Bios : Ami

Tnx
noname
12-29-2000, 09:28 AM
Hi Snacker,
memory ram must at least 16mb

best regards

noname
Snacker
12-30-2000, 11:47 AM
Hi noname but its not ram it's video..ram i have 64
noname
12-31-2000, 04:26 AM
Hi Snacker,
configure your universal display adaptor

hopes this helps

regards


[INFO] new forum for OllyDbg users
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > [INFO] new forum for OllyDbg users
PDA

View Full Version : [INFO] new forum for OllyDbg users

TBD
12-28-2000, 05:33 PM
hi ppl!

a new forum dedicated to OllyDbg is opened at
http://pub44.ezboard.com/follydbgfrm1

any of you that use OllyDbg please give it a try
and post your opinions, ideeas, ...

but before that, download 1.01 version and
check it first at:
http://home.t-online.de/home/ollydbg/odbg101.zip

thanks guys and keep up the good work
TBD

ps. Happy New Year :)


Help with IceDump 6.021
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help with IceDump 6.021
PDA

View Full Version : Help with IceDump 6.021

death_terror
12-30-2000, 03:58 AM
I am unable to get IceDump load properly. I am using SoftIce v4.05,which runs right. When I try to run IceDump I get the foollowing message:

icedump v6.0.2.1 for winice v4.05 build 526 loader
icedump was not loaded yet
VXDLDR failed to load icedump
G-RoM
12-30-2000, 06:18 AM
I would suggest u read carefully the documentation about requirements. However here is a quick advice : Check if u have loaded exports of kernel32.dll, if not do it (exp=<ur windows system path>\kernel32.dll inside winice.dat). This is madatory.

In the case it still wouldn't work we would appreciate more infos such as :

OS build
Softice build
etc....

Cheers,
death_terror
12-30-2000, 12:20 PM
I checked my winice.dat and the exports from kernel32.dll were loaded correctly.

I am using Windows 98 build 4.10.2222 A
My Soft-Ice version is 4.05 build 334

If you need more info please tell.However I would like to know where to get some docs on IceDump,as I have found none.
G-RoM
12-30-2000, 01:40 PM
According to ur first post u used icedump for SoftICE 4.05 build 526 and now u tell me u have SoftICE 4.05 Build 334. I'd suggest u try to load the correct one (w9x\4.05.334\icedump.exe).

About the documentation check (W9x\Doc\icedump6.txt) for example :).

Cheers,


Quick Q on Caspr
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Quick Q on Caspr
PDA

View Full Version : Quick Q on Caspr

NchantA
12-30-2000, 07:08 AM
ive used caspr to say bye to asprotecet on two version of the program i am working on (cool desk - new ver at www.newapps.com)...both times it has decompiled perfectly, but the newer version just runs when i type caspr cdesk.exe instead of unpacking...

prolly silly mistake, but what am i doing wrong?

NchantA
SpeKKel!
01-01-2001, 07:23 AM
No mistake i think, i got the same on a new proggy..
Newer version of asprotect ?

......SpekkeL!.....
Kayaker
01-02-2001, 03:04 AM
I got this with an Asprotect (earlier version, pre Jan/00) + AsPack v2.0 protected proggy. Caspr hooked it OK, but it just ran and didn't dump anything.

Caspr docs didn't mention anything, but I'm assuming it won't work with the additional AsPack protection??

Kayaker
SV
01-02-2001, 12:18 PM
Hi all

Seems to be a new version ?
Seems to use a custom GetProcAddress function :)

However if you want an unASprotected version of this new CoolDesk, mail me ;)

SV
SV
01-03-2001, 05:20 AM
Hi

"No mistake i think, i got the same on a new proggy..
Newer version of asprotect ?"

Please, could you post this proggy url ?

Thx

SV


SoftICE configuration
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE configuration
PDA

View Full Version : SoftICE configuration

Eric
12-31-2000, 04:35 AM
Hi. I have a need to set up SoftICE's video adapter setting manually. Could anyone point me in the right direction?

I had posted [Softice peculiarities] earlier, and have narrowed down my problem some. It is the display adapter setup screen that sends my computer into an endless loop. I installed Softice on another computer, then manualy copied the files and reg setting over to get it installed on my computer. But when I try to open the Display Adapter Setup prog, ....loop. I have used SoftICE with this adapter [Chips & Technologies 65554 PCI] before though, the only thing that has really changed since then, is a new hard drive. For some reason though, this has disabled PCI IRQ steering. This might be the problem...

Anyway, that's why I need to try to configure the adapter manualy, and I cannot seem to find an docs on this subject.

Thanks,

Eric
carpathia
12-31-2000, 11:08 AM
Softice stores its video config in the system.ini, at least for win 9x.

[Siwvid]
VideoManufacturer=Standard VGA
VideoBoard=Standard Display Adapter (VGA)
MouseType=0
VidType=0
Mono=0
Ddraw=1

DDraw is the universal driver flag, the rest is self explanatory.
Check $SOFTICE/setup/VSetup.ini for a list of valid identifiers for VidType. I imagine the textual descriptions are for cosmetic purposes only.

Hope this helps.

Carpathia
Eric
01-03-2001, 11:37 AM
Thanks, that is just what I was looking for!

Eric


Analyze self extracting sfx exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Analyze self extracting sfx exe
PDA

View Full Version : Analyze self extracting sfx exe

CccT
01-01-2001, 07:19 AM
I recently saw a downloadable tool (or toolz?)
that allows to view the contents of self extracting sfx and exe and to extract only the files you need.
Does anybody know from which site it is available.
Thanks


Wdasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Wdasm
PDA

View Full Version : Wdasm

Raven58
01-02-2001, 03:10 PM
Using wdasm on a crackme and came up with the following error message,"this pe file not in standard windows format,all data references will be terminated". Being a newbie, not sure what this means other than no string references. Tried to unpack the file, but that didn't work. An explanation would be appreciated.
Thanks!
Kayaker
01-02-2001, 06:41 PM
Hi Raven58,

What does a file identifier such as FileInfo or GetTyp say it's packed/compiled with? What did you try to unpack it AS?? Got a link?

Regards,

Kayaker
Raven58
01-03-2001, 09:07 AM
Kayaker, this is a Lazarus crackme from the hellforge site that he describes "as the hardest he coded" It had anti sice and I thought some type of anti-debugger. I used proc dump and selected unknown, proceded and then came up with the message" terminated,not packed or trace failed". I also tried to rebuild the PE header with proc dump to no avail.Using Hiew, I noticed something about Virtual protect. I can break on hmemcpy and get into the crackme but had no luck finding or calculating the routine. To new at this I guess, but learning. The name of the crackme is crackmeg2.zip and I would be glad to e-mail it to you. Thanks for your response to this post.


Crypkey Crack Tutor???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Crypkey Crack Tutor???
PDA

View Full Version : Crypkey Crack Tutor???

MazCrack
01-02-2001, 11:08 PM
I need help with this shit!!!
carpathia
01-03-2001, 08:32 AM
Maverick wrote a very good essay on reversing crypkey.
Its available in the files area of the REKML

http://rekml.cjb.net

Regards

Carpathia


IAT resolver beta test starts now
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IAT resolver beta test starts now
PDA

View Full Version : IAT resolver beta test starts now

tsehp
01-03-2001, 05:22 AM
hi,
the first beta is finished, this programs actually allows you to fix the
IAT's of all asprotected and vboxed targets.
It works on win2000 and win98, I need some beta testers that already
knows how to unpack targets and have some knowledge on pe-section
to test this app on other packers or protection systems.
You can write a word to tsehp@yahoo.com, you need to register on
this messageboard (fraviamb.cjb.net) for me to send you the program.
later,

+Tsehp


Crypkey crack Tutor for mortals??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Crypkey crack Tutor for mortals??
PDA

View Full Version : Crypkey crack Tutor for mortals??

MazCrack
01-04-2001, 03:32 AM
The Mavericks Tutor is for Advanced People, someone helpme to traduce this to easy learn tutor??
........


new i6comp released.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > new i6comp released.
PDA

View Full Version : new i6comp released.

Morlac
01-04-2001, 09:16 PM
I just emailed protools the new version of i6comp
This new version is a collaboration between fOSSil and me.
fOSSil was kind enough to share his knowledge with me.
Thanks fOSSil. :-)
The results are very nice.
Enjoy.

Wait for Protools.cjb.net to update.

Morlac


Dos cracking with Softice 2.8 someone help with disassembler please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Dos cracking with Softice 2.8 someone help with disassembler please
PDA

View Full Version : Dos cracking with Softice 2.8 someone help with disassembler please

funfstern00
01-05-2001, 02:50 PM
Hello

I am just learning how to crack with Softice 2.8 Dos, i just need to know which is best way to analyze the disassembly and which disassembler should i use, i tried IDA but it produces words not address's for the assembly. I want to produce same type of code that appears as in Softice 2.8 Dos with the same Hex Bytes so i can atleast search in hex editor to find the address's in. I tried this with w32Dasm and it is totally different output diassembly, the hex bytes are different. Can anyone please help with this? I want to understand Dos cracking to improve my skills and know what the heck is going on down there also in dos level cracking.

FF


Softice 4 winice.dat problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice 4 winice.dat problem
PDA

View Full Version : Softice 4 winice.dat problem

Kugi
01-06-2001, 06:25 PM
Hi All,

I have been using SI 3x for some time now. Works like a charm.

Decided to move up to 4x and my problems began. SI loads at boot and pops up (clt-D) with a small DOS screen. I have modified autoexec.bat and config.sys (thanks to Carpathia's tips) and winice.dat (thanks to The Sandman's tips) Winice.dat is in the same directory as winice.exe.

At boot a full screen of softice flashes, then the regular boot routine continues. I seems as though some delault winice.dat loads the DOS screen rather than the modified winice.dat.

Can anyone point me in the right direction?

Regards, Kugi
SilverWar
01-08-2001, 09:18 PM
That doesn't make any sense, you said you got help with some particular subjects as Carpathia and Sandman etc.. But then you say you have a DOS screen on your system, what dos this DOS screen say on it, we need more details before you can get some type of feedback.

FF
Kugi
01-09-2001, 12:40 PM
Hi SilverWar,

Carpathia's thread of 6Jan00 on the Newbies Forum recommended config.sys and autoexec.bat entries that would allow the user to load SI or not load SI. e.g. menuitem=ICE,softice menuitem=NOICE,no softice (for config.sys) and C:\path\winice.exe (for autoexec.bat). These entries seem to work.

The Sandman's Softice for Beginners tut recommended modification of the winice.dat file to make SI easier for the reverser to use. The main modification was to the INIT line. e.g. INIT="wl; code on; altscr off; lines 57; wc 32; wd 8; wr; faults off; x;"

I should have said that a "DOS like" window appeared after ctl-d. The window covers about two thirds of the screen. It has a black background with white lettering.
There is a green bar across the top of the window. Below that are about six blank lines. Then a green bar labled Prot32 with ten lines of code below it. Then a green bar labled VMM01+2b5a and about twenty lines of lettering below it. The last line of lettering is the ":" command line. Typing "wr" on this line causes the registers to show at the top of the window. But typing "lines 60 or wc 32" does nothing.

Thank you for your interest.

Regards, Kugi
Aleph
01-09-2001, 10:01 PM
Hi Kuri.

What you describe here is the exact screen I have (Sice 4.05) and always had (Sice 3.x), with nearly the same modifications from +Sandman and Carpathia.
And it works fine ;-)

'wc 32' does nothing, 'cause it's already in your INIT line. Type 'wc 10' or 'help' and enjoy...

BTW, do you see a funny little square in the upper right corner of this "DOS-like window", wich hop and move whenever you try to use your mouse ? If so, just check your mouse setup. Had been stucked on it for days (unrecognized mouse)...
While you're there, change your colors: white lettering on black background is not the best choice, IMHO. 'color f a 4f 1f e;' in your INIT line, maybe :-)

Regards, Aleph
Kugi
01-11-2001, 12:06 PM
Hi Aleph,

Added your color string to the INIT line and it sure does make life easier. Nice color combo.

Still have to manually add wr after ctl-d. Wr is in the same INIT line that the new color string is in...funny.

Mouse doesn't work at all. Tried every combo available in the mouse setup section of SI. When SI pops I get a dead mouse. "Set mouse on" - still get a dead mouse.

If I get tired of adding wr and no mouse I can always go back to good old SI 3x.

Thanks for your help.

Regards, Kugi
SilverWar
01-11-2001, 02:03 PM
I don't think am able to help you with the Mouse problems you experiencing in SI4.05 but i can tell you one thing about the INIT, the INIT i think was programmed for retrieving a minimum of init settings on one line. I found this out by setting the init on multiple lines. Try setting your inits seperately in your winice.dat as follows:
example:

INIT = "WD 12;"
INIT = "WR;"
INIT = "FAULTS OFF;"
INIT = "X;"

setting your inits on seperate lines is more user friendly and behave much with the last INIT line to have Init = "X;" so it will know to bring you back to your desktop in your windows.
Kugi
01-11-2001, 05:15 PM
Hi SilverWar,

Bingo, joy, happy days. The INIT trick works.

Thanks all.

Regards, Kugi


SI with WinME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI with WinME
PDA

View Full Version : SI with WinME

Crudd
01-06-2001, 07:27 PM
I recently got anew computer and it came with WinME. After a few hours of screw with Si i finally got it to work using the icedump teams winice loader. Now all of the sudden it doesnt load anymore. It just hangs at the screen where it displays the memory stats that SI uses. Any idea whut happened or how to fix it?
Thanks in advance,
Crudd
SilverWar
01-11-2001, 02:10 PM
I would go back to windows 98 SE and run Softice there, it hangs all the time. Or atleast it did when i ran Windows Millenium, it is so darn buggy and nice features in Win Me that i sorta didn't care to see the bugs which it encountered. You probably went to Numega.com and selected [Knowledgbase] in the menu option on the left, and type in the search engine [Softice 4.05] and noticed the line "loading Softice 4.05 in windows millenium"

sw


Smartcheck
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Smartcheck
PDA

View Full Version : Smartcheck

golk75
01-07-2001, 02:00 AM
Where can i get this besides numegas web site?

Thanks ...
MaTRiX_2k
01-07-2001, 05:20 AM
Go to Excite and type ftp search.

It is the first search engine in the list i suppose.

Ok i got the link it is ftp.tokyoweb.or.jp

sc620.exe

There is another one go to excite as i said.

BTW:- You should be able to search it for
yourself, that improves your thinking.

Sorry for my remarks if it hurts you.
MaTRiX_2k
01-07-2001, 05:21 AM
Go to Excite and type ftp search.

It is the first search engine in the list i suppose.

Ok i got the link it is ftp.tokyoweb.or.jp

sc620.exe

There is another one go to excite as i said.

And also go to crackstore.com

BTW:- You should be able to search it for
yourself, that improves your thinking.

Sorry for my remarks if it hurts you.
golk75
01-07-2001, 12:20 PM
Is not ur remark that hurt me , is the fact that you posted it twice.

===========

Just kidding , thanks for your help, the reason i didin't really look around for it very hard is that @ Numegas web site they want like $600 usd for it , so i didin't think i would be so easy to fond a free version of it.
golk75
01-07-2001, 05:19 PM
Ok i got it.

Now how do i ,make it display caracters corectly?

I cant read anything seems to be written in japanes?
MaTRiX_2k
01-07-2001, 08:27 PM
Sorry mate no answer for this, bcos i
haven't downloaded it myself (in the process). The damn link is very slow.

Try crackstore.com for an eng ver, if your
problem isn't solved. I hope it is.

Bye
MaTRiX_2k
01-07-2001, 10:37 PM
Man Since I got you into this trouble, i will
get you out. I had downloaded the original version of smc, but it was asking for the serial.
Hopelessly i entered the serial
for S-ice 4.5.( which i found on one of the
ftp sites) and presto iam through.
I can't understand of all the programmers
how can the Numega one's can be so lazy.

Now i have a original tra la la la smartcheck
version.

And the serial is err.. can't tell you here.
The rule's says no cracks or serials remeber. So give me your mail ID.
I may mail you, if iam in a mood too.
Just kidding. I will mail you ok.

Gosh i forgot the link

www.CrackPLTools.prv.pl

I downloaded it from here.

Bye For Now
Enjoy
the snake
01-08-2001, 01:25 PM
Hi to all of you out there...
Since there are "some" new newbies around, maybe some of you don't know me and my site. I don't like to publish my site this way, but i think you can get some answers for Numega products at the "essays and tuts" section at my site.... look for the word "Numega".
A very detailed tutorial how the serial is being calculated, and at the key-gen section, a full source for coding it in assmebler..
Regards
the snake
golk75
01-09-2001, 04:34 PM
Hey, thanks

Can you email it to

golk75@hotmail.com


DLL image/icon extracting
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DLL image/icon extracting
PDA

View Full Version : DLL image/icon extracting

Xrain
01-07-2001, 02:07 AM
Can anyone tell me what is the name of the utilities that extract images and icons from a DLL file?
DEATH
01-17-2001, 07:21 AM
Any resource manager, you can find resource managers in protools.cjb.net .
the snake
01-17-2001, 01:34 PM
Hi
I recommend ExeScope, a realy great utility..
Try it and you'll understand why, great abilities.
the snake
Xrain
01-19-2001, 01:26 AM
DEATH (01-16-2001 21:21):
Any resource manager, you can find resource managers in protools.cjb.net .

Thanks DEATH...
Xrain
01-19-2001, 01:27 AM
the snake (01-17-2001 03:34):
Hi
I recommend ExeScope, a realy great utility..
Try it and you'll understand why, great abilities.
the snake

Thanks snake... I'll sure to try that one...
Vitriolx
02-11-2001, 07:34 PM
To extract icon I use a tool called Avalon Icon Library Viewer. You can get it at http://www.geocities.com/SiliconValley/Station/8542/Icl_View.htm . But you can also use borland resources workshop.


Alternative To SmartCheck
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Alternative To SmartCheck
PDA

View Full Version : Alternative To SmartCheck

MaTRiX_2k
01-07-2001, 05:27 AM
Hello Reversers,

Is there any alternative to Numega's
Smartcheck ?

Bco's the links i got are very slow.
It will be my next life when i finish downloading and start using smartcheck.

Thankyou
MaTRiX
Muad'Dib
01-07-2001, 01:56 PM
There are no alternatives as far as I know but there are a few decompilers. DoDi has one for VB3 and I believe VB4, JosephCo made one for VB6 PCode...All are available at http://protools.cjb.net/
MaTRiX_2k
01-07-2001, 08:16 PM
Muad'Dib (01-07-2001 03:56):
There are no alternatives as far as I know but there are a few decompilers. DoDi has one for VB3 and I believe VB4, JosephCo made one for VB6 PCode...All are available at http://protools.cjb.net/
-----------------------------------------

Thanks For The Update.
And sorry for the one liner, got to renew
my net connection.

Bye


HELP -> DLL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > HELP -> DLL
PDA

View Full Version : HELP -> DLL

Xrain
01-07-2001, 01:08 PM
Please anyone can you tell me the name of the tool that view DLL file and extract the images and icons from it?
Muad'Dib
01-07-2001, 01:54 PM
A resource editor (Borland, Symantec, M$) will do it...
Xrain
01-07-2001, 03:03 PM
Muad'Dib (01-07-2001 03:54):
A resource editor (Borland, Symantec, M$) will do it...

Reply: Thanks a bunch...


NVidia <-> SoftIce and win2k... working
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > NVidia <-> SoftIce and win2k... working
PDA

View Full Version : NVidia <-> SoftIce and win2k... working

DGR
01-07-2001, 03:39 PM
Well, it seems there is a way to make it work... atleast for now. Here is how I did it:

1. Install the newest version of SoftIce (I used the one from DriverStudio 2.0)
2. Get the windows2000 ntoskrnl.dbg file and translate it to a .nms file using the loader
from softice
3. In loader go to Edit -> SoftIce Initialization Settings. Go to the 'symbols' tab and add the
ntoskrnl.nms file u created
4. Run regedit and check the following keys, if one doesn't exist create it yourself
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice\
Set the value for "Ddraw" to 1
Set the value for "DoInt2DPatch" to 1
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Siwvid\
Set the value for "Start" to 0
5. Set softice startup mode to "BOOT"
6. Naturally a nogui boot

Reboot and pray. The first time I got a bsod concerning NTice.sys but after that it seemed working. Try it out and let me know if it works. I'll fool around some more and check if it keeps working.

It didn't seem to be working when I set the softice startup mode to manual... but I'll try again newayz.

Btw, this is for Windows2000 Professional with SP1, a geforce2 MX with the 6.67 nvidia reference drivers. I'll put the .dbg file up somewhere if it's needed, just drop me a mail if u want it somewhere.

Take care,

DGR
DGR
01-07-2001, 04:07 PM
Crap, and the answer is a nono...

It works exactly the same as the manual mode without loading the debug symbols. That is, a bit. Again, when softice doesn't pop up switching the colour depth from 16-bit to 32-bit and vice versa helps (for me anywayz). So I guess that this is the way to go for now...

I'm signing off, l8r ppz


SoftIce breakpoints on offsets/RVA´s?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce breakpoints on offsets/RVA´s?
PDA

View Full Version : SoftIce breakpoints on offsets/RVA´s?

Dreadnought
01-09-2001, 10:35 AM
Greetz,

does anybody know how I can set a breakpoint in SoftIce (v. 4.05 or something) on offsets or RVA´s. I think it´s "bpx (offset/RVA)".

Or have I to set a bp at memory access and if yes, how?
aimless
01-11-2001, 12:52 AM
Read the manual please.

You must BPX xxxx:yyyyyyyy for offsets/RVA's

BPX also breaks on loaded symbols like:

eg: bpx kernel32!getprocessaddress

Note here that the x, in bpx can be replaced by other types:

eg: bpm or bpint etc.

Once again, read the manual. it explains all.

Cheers
Dreadnought
01-11-2001, 06:50 AM
ThanX,

I´m sorry, but I didn´t had the manual right here. Now I´ve got it.


Icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Icedump
PDA

View Full Version : Icedump

Kilby
01-10-2001, 07:29 AM
Hi,

Iv'e a question regarding Icedump & ProcDump32.

Has the bharama side of things been replaced with pdump.

Iv'e never previously needed to dump to disc.

Previously file patching, serial fishing, and process patching has done the job,
but I'm playing with copyloc at the moment, so between my ineptidude and lack of info on the later versions of the afore mentioned progs, I have ground to a halt.

Regards,

Kilby...
The Owl
01-10-2001, 11:43 AM
Has the bharama side of things been replaced with pdump.

short answer: yes.

longer story:

depending on your dumping needs, you either want to use /dump which does a raw memory dump or if you need something more formatted (ie. a PE file) then you'd either use /bhrama or /pedump. since the /bhrama reconstruction code uses procdump, you can think of it as being obsolete because G-RoM has enhanced his engines a lot since the last PD was released (this means both new features and bugfixes of course).
Kilby
01-11-2001, 04:33 AM
Many thanks,

Ive never needed to dump a decrypted prog before (under windoze that is), so I want to use the right methods then I can only blame myself :)

Kilby...


RE: SOFTICE FREEZING
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RE: SOFTICE FREEZING
PDA

View Full Version : RE: SOFTICE FREEZING

SilverWar
01-10-2001, 07:33 AM
you can check out Numega.com and read some info on your problem FAQs. Or you can read the Help PDF files came with you Softice? I would recemmend you open your winice.dat file and edit everything you think might be necessary. For ex: size of memory. Monitor type in mine says 0. You can try for you experiment and change it to 1 etc.. or go to the pro FAQs at Numega.

sw


IDA 3.85B is freeware
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA 3.85B is freeware
PDA

View Full Version : IDA 3.85B is freeware

stinkf
01-10-2001, 08:55 AM
This was bit of a surprise and I am just downloading it, you can get it:
ftp://ftp.datarescue.be/pub/ida/

and it's called idafree.zip.
If they also release flair and other stuff with it it's actually quite sufficient for all your reversing needs.


Where Can I find Winfrog or Windowsc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Where Can I find Winfrog or Windowsc
PDA

View Full Version : Where Can I find Winfrog or Windowsc

moma
01-10-2001, 11:59 AM
Hello all,

Where can i find winfrog or windowsc?

Needed for the project in the mini project area

Thank You
Kayaker
01-10-2001, 12:38 PM
Hi,

Winfrog is actually FrogPrint's version of Winshow. Very handy. You can get it at
www.suddendischarge.com

Program Details:
display the characteristics of windows underneath the cursor including window handle, text caption, class, client width and height, window width, height and position
modded by Frog's Print so all values are hex to make it easier to use with the SoftICE BMSG command: No more 'Task', 'Hwnd xxxx' commands needed. Just pick up the Windows handle and 'BMSG Windows_Handle [IF expression}'

Windowse is purely commercial and you can get it at Softseek.

Kayaker
Moma
01-11-2001, 10:07 AM
Hello all,

Kayaker, I searched for Winfrog, at
suddendischarge.com, but could not find it.

Is there someother place from where i can get it?
Kayaker
01-11-2001, 10:42 AM
Sorry, I should have specified it's packaged with the original Winshow there. You need to search for Winshow not Winfrog.

Here's the direct link

http://www.suddendischarge.com/download.query?id=0x3B5E2CF3

Regards,
Kayaker
Moma
01-11-2001, 11:07 AM
Thank You Kayaker. I got it.

With Regards
Moma


for IDA users
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > for IDA users
PDA

View Full Version : for IDA users

+Spath.
01-10-2001, 03:15 PM
For people using IDA 4.04 or older, I have
made a script to add parameters recognition
for win32 functions, you can get it at
frogsprint.cjb.net.

Regards,
Spath.
SilverWar
01-11-2001, 01:44 PM
Isn't that site frogsprint not compatible with Internet Explorer? I logged on there a couple of times and it shows internet explorer logo being crossed out?

please could you give an alternate url with your IDA script tool?

thanks
Spath.
01-11-2001, 01:53 PM
You can get it also at spath.cjb.net/w32param.zip

Spath.
Zukkos
01-11-2001, 01:59 PM
[quote]SilverWar (01-11-2001 03:44):
Isn't that site frogsprint not compatible with Internet Explorer? I logged on there a couple of times and it shows internet explorer logo being crossed out?
please could you give an alternate url with your IDA script tool?

O-lala!
Are you really so stupid you cannot figure how to load and use opera or netscape instead of your crappy M$IE crap? I mean, even if you'r really in a corporate environment where they would like to compel you to use overbloated M$IE... even then, there are MANY ways out of that crap and into a decent browser!

I don't think you should be allowed to download anything at all, I think +Frog's print is right in screwing boobos like you, uncapable to change browser if needs be - and needs be a lot... as you would know and understand if you had enough brain.

Zukkos the idiotsstrafer
DGR
01-12-2001, 02:50 AM
Errr... excuse me but pointing Netscape out as a substitute for IE just doesn't work for me. A long time ago, well... relatively long, I also preferred Nutscrape but I found it to be that Nutscrape just gets worse every version. Where IE hasn't crashed on me in quite a while.

Also Opera is a nice little browser, but I just don't like it all that much... still has some probs with some sites and other things. So, despite the fact that IE is a MS product and prolly bloated yeah it still IS one of the best browsers imo.

I just get annoyed by the fact that something can't be good just coz of the fact it's made by MS. Then also don't use windows2000/ME/Whistler...

There, just had to say this... nothing personal hehe ;)
CrackZ
01-12-2001, 08:22 PM
Hiya,

Instead of debating the vagaries of the various browsers ;-), perhaps you should all instead thank +Spath for this great script, which implements one of the main enhancements in the latest versions of IDA (at least those after v4.04 which most people have).

I have v4.1.5 myself so I can fully appreciate just how useful this really is.

Regards

CrackZ.
iONiZER [AmoK]
01-13-2001, 05:04 PM
At first I want to thank Spath for this great tool!

Second, I want to gratulate frogsprint for the great MS IE-protection, but if you are experienced enough you can try a workaround with the proxomitron. You can ban all MS-IE specific code and have got a IE with no extra functions...

I think MS-IE is for some things not as bad as all do say...

And IHMO MS has got the better concept in DHTML.

The all-Object model is easier to use and has more functionality the the Netscape-layer-model, cause the netscape-model must have fixed coordinates ....

cu

iONiZER

PS: Again, many thanks to Spath !!!!


Searching Mouse Hook
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Searching Mouse Hook
PDA

View Full Version : Searching Mouse Hook

GlutrotesLicht
01-11-2001, 11:14 AM
when scrolling with the mouse over a window, this tool displays the window handle

can´t find it... plz help
Muad'Dib
01-12-2001, 10:08 PM
Try tutorial #24 at http://win32asm.cjb.net
GlutrotesLicht
01-13-2001, 05:01 AM
Ay... Thanks very much !!!


NEED -> RSE -> RSC Editor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > NEED -> RSE -> RSC Editor
PDA

View Full Version : NEED -> RSE -> RSC Editor

Xrain
01-11-2001, 12:15 PM
Does anyone know where I can get a simple and small package of resource editor? I want to extract some images from a DLL file. To be specific, I need a reverse engineering tool that would do that without having to install Borland or other stuff from M$...

Thanks for the help
SilverWar
01-11-2001, 01:51 PM
http://www.crackpltools.prv.pl/
http://crackstore.com/
http://www.protools.cjb.net/

you might want to try out Borland Resource Workshop, if it fails, then use EXEScope 6.XX, also a good one is to: Resource Hacker. It sometimes does a good job for you. If you cant open your DLL's or EXE files then you know it is possible that they are either encrypted or packed files, hopefully you know how to handle these such pests.

SW


IDA Question...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA Question...
PDA

View Full Version : IDA Question...

Newbie
01-11-2001, 07:36 PM
I am not very good with this tool so here is my question. I was disassembling a program and IDA reported "Can't disassemble" and started adding some junk in the code section. When this happens the code tends to look like this:

cmp blah.. blah
jump blah.. blah
;---------------------
dd some stuff (this part doesn't seem to be able to disassemble)
dd some other stuff (same here)
:---------------------
inc eax

Can anyone enlight me about what commands do I have to execute in IDA to help it out a little bit or am I running against anti-disassembly techniques and can't do much about it?!?

Thanks for the help,
Newbie
Muad'Dib
01-12-2001, 10:05 PM
If you press "u" in IDA, it will disassemble the selected line and the following ones. BlackB has a good tutorial on IDA at http://blackb.cjb.net or http://www.cracking4newbies.com


VIRUS Warning
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > VIRUS Warning
PDA

View Full Version : VIRUS Warning

pm
01-12-2001, 01:35 PM
Hi there,

Just to tell you all that the Predator's Extreme Loader Generator 0.3 at Protools is infected with the Navidad virus. I already sent a mail to Kaparo.

pm
McNy@Work
01-15-2001, 01:06 PM
Let me guess....Should be Norton Antivrus 200x
and with the virus definitoins before 2000.01.06

If i were right, that just a small mistake of NAV.
this definitions bugs was repair after 2000.01.06
You should use the latest virus deinitions updated
8-)
pm
01-16-2001, 03:46 AM
hehe. You are completely right :)
No virus after all. Thanks.

pm


perl/ java script
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > perl/ java script
PDA

View Full Version : perl/ java script

tanya
01-13-2001, 04:58 AM
Actually, I seek a freeware script for my website that will delete Cookies/History/Temp/Temporary Internet Files/Reg keys, that are put by my site on visitor's system.
Or at least clean the History folder of visitors.
So that my site will leave no traces on visitors' system.
Send any ideas to dchenka@yahoo.com
the snake
01-16-2001, 12:17 AM
Hi tanya

I'll try to keep on order by your post...
Freeware scripts are available all over the web :
http://www.javascript.com/
http://javascript.internet.com/
http://www.webdeveloper.com/
http://www.wdvl.com/
http://webreference.com/

And so on... just search, and you will find much more.

Cookies - don't create them with your pages, so you won't have to delete them.

Internet Files - you can use "meta tag" that will prevent the pages
from being stored in the temp/internet folders. IE :
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
This should come within the <HEAD> and the </HEAD> tags..

Reg keys - I can't think of a good reason to create any... Not sure
how it's posiable, may be with Perl or VBscript MAybe PHP, but what for ???

regards
the snake


Win ME "friendly" list ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win ME "friendly" list ?
PDA

View Full Version : Win ME "friendly" list ?

2nEw
01-14-2001, 01:09 AM
How about a list somewhere of Win ME "friendly" Rev E tools. I just started using ME and would be glad to add my input. Maybe catagories like "works well", "works but buggy" or "DON'T EVEN TRY IT!" Just a thought 2nEw
Lord Rhesus
01-14-2001, 05:07 AM
Better advice will be to uninstall Windows ME. This version practically takes over your system, it doesn't let you access any partitions you make on your harddisk in an attempt to prevent you using other operating systems like Linux or BeOS. Apparently according to microsoft this is an 'Anti-Piracy' move but I don't see how. It just left one of my friends 4 GBs or hard disk space short as it refused to let him unpartition his hard disk! For your own sake remove it now!!!


Working WinDisassembler Download?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Working WinDisassembler Download?
PDA

View Full Version : Working WinDisassembler Download?

Ocarina Maker
01-14-2001, 02:57 PM
Hello!
I have been unable to find a WORKING download link for WinDisassembler.
Can someone point me in the right direction, please? I am eager to learn. Thanks, Ocarina
pusspuss
01-16-2001, 07:37 PM
Try http://www.crackstore.com/

If necessary follow the links from this site.

:)


to all the MSIE haters out there and those who like it
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > to all the MSIE haters out there and those who like it
PDA

View Full Version : to all the MSIE haters out there and those who like it

Snatch
01-15-2001, 01:33 AM
ok first off these guys just put down ie because they think its "l33t" and "c00l" to do so. get a life. for those who like ie or dont think its as bad as the other lamers and arent going to conform to the typical cracker code of unl33tness let me give you a little cracking project. the way a lame site like frogs works is by checking the user-agent http header field. yup thats right modify that and frog can um cry. im not going to tell you how to do it but its not that hard if you set the right breakpoints and use your head

Snatch
Lord Rhesus
01-15-2001, 04:36 AM
Alternatively use proxomitron (http://www.proxomitron.cjb.net) like I do which allows you to easily fake browser type, OS and filter out adverts. As for using IE, speaking truthfully, I use Opera 4.02 and this is a hell of a lot quicker than IE, it gives you a hell of a lot more options for privacy and it doesn't allow sites to view cookies from others (http://www.peacefire.org). In my opinion as someone who has tried many different browsers IE sucks (but not as much as the latest versions of Netscape 'Communicator')
Muad'Dib
01-15-2001, 12:58 PM
I honestly think that M$IE sucks. It is slow, buggy, and unweildy. If you like it, good for you, but you dont have to insult someone like +Frog's Print for having anti M$IE stuff on their site. If he doesn't like M$IE and wants to have anti-browser code on his page, he certainly has the right to.
miscreant
01-27-2001, 12:35 PM
Internet Explorer is MUCH faster then opera and has a far better rendering engine. Only problem I have with IE is that its not integrated into a MDI form like opera (not a major problem) and that it wont render a table until the complete table is downloaded and it reaches a </table> tag, but then again, neither will opera.
Lord Rhesus
01-27-2001, 01:47 PM
miscreant (01-27-2001 02:35):
Internet Explorer is MUCH faster then opera and has a far better rendering engine.

Much faster? Just try and browse a website offline with IE and then compare it with Opera. Opera will load a page instantly where as IE will take a few seconds! The browsers have little if any affect on the internet connection and recieve data at the same speed. Just try and compare the two as I said off-line and when it comes down to raw processing power of the webpage, you'll see that Opera is far quicker!
Muad'Dib
01-27-2001, 02:17 PM
Yup, Opera is definately faster. Try running it on a slow computer like mine. On my computer Opera loads in a second or two and IE takes up to thirty. Also, for big multimedia intensive web pages, Opera doesn't steal all of my processing power and lag my computer until I close it like IE does. Once again, Opera wins my vote :)
igitt
01-27-2001, 04:28 PM
Moreover, as I said below: all IE-defenders among us may find A+heist's new essay at searchlores.org an instructive reading... M$IE 'smears' your data...

Besides Opera is not ONLY quicker. That's a nice feature, of course, but Opera has ALSO a (well known) no-images option a (lesser known) no-popup option and another (lesser known) no animated-gif option.

Now all those among you that do indeed prefer not only to smear their data around like there were no future, but also to slurp heavy images, swallow advertisements, ingest popups and gulp down gif-animations please step on one side and enjoy your M$IE... prima illa et maxima peccantium est poena, peccasse... eheheheh
miscreant
01-28-2001, 03:10 PM
ok... so we all gotta save our webpages to disk now to get a speed advantage.

In a real situation.. eg loading a website from a remote host, Internet Explorer is far faster.

Takes a few seconds??? Loads instantly on mine (any page from disk, even the complete source code listing from www.planet-source-code.com which is a huge table).
Muad'Dib
01-28-2001, 03:53 PM
As lord Rhesus said, the actual browser makes little or no difference on transfer speed. That really depends on your connection. Saving files to disk was an EXAMPLE of how to do a pseudo-benchmark on speed.


-
PDA

View Full Version : -

Frog's Print
01-15-2001, 04:47 AM
>the way a lame site like frogs works is by checking the user-agent http header field.

Wrong, totally wrong... Don't give wrong advices to anyone as long as you don't even understand what's going on and what you are talking about...

>its not that hard if you set the right breakpoints and use your head

...the very first step would be to ensure there's a brain inside.
diway
01-15-2001, 12:05 PM
LOL :)


FrogsIce - How to set up?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FrogsIce - How to set up?
PDA

View Full Version : FrogsIce - How to set up?

pusspuss
01-15-2001, 06:28 PM
I am new to .. (cough cough) .. reverse code engineering.

Could someone please explain which "system driver" has to be copied to FrogsIce loader or whatever in order to make FrogsIce work!

>( >( >(

Thanks.
Muad'Dib
01-16-2001, 04:35 PM
If you are using Windows 95, the one in the \Win95 dir, if \Win98, the one in the 98 dir, if me, the one in the \WinME dir. Pretty tough, isn't it? I'll bet you didn't even read the readme.
pusspuss
01-16-2001, 07:13 PM
Thanks for your response.

From a response on another forum I know what to do now.

I did read the readme.txt thank you! That was the first thing I did!

The readme file was not clear (to me). I assumed that it was referring to a driver in the windows\system directory. I missed the sub-directories in FrogsIce where the drivers are located.

;) :-) ;D


For people with more knowledge about Buttons!!VB!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > For people with more knowledge about Buttons!!VB!!!
PDA

View Full Version : For people with more knowledge about Buttons!!VB!!!

NeO'X'QuiCk
01-17-2001, 04:44 PM
Program goes like this you have to push the button in order to get to next nag!You also have timer that after 5 seconds enables you button!I how to enable it and get ridd of the nag and button but i don't know where to get ridd of so you dont' have to push the button!!

For help thank infront!


WDASM page faults with large files?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WDASM page faults with large files?
PDA

View Full Version : WDASM page faults with large files?

nud
01-17-2001, 05:33 PM
WDASM page faults every time I try to disassemble systat.exe. The program is just over 3MB, and I'm wondering if WDASM has a problem with large files. IDA disassembles the program with no problem. Has anyone else had trouble disassembling large files with WDASM?

systat.exe (version 10) is available at:
http://www.spssscience.com/registration/

You have to register (free) to download the prog.

Any help would be appreciated.
Nud
the snake
01-21-2001, 11:58 PM
Hi
I have a patch for W32Dasm, not sure it's the same problem you have. The .nfo says :
"..This patch will fix that annoying bug which occur when you close w32dsm and you've loaded a big file. EXE-files over >1mb.."

If you think it can help in any way, e-mail me.
the snake


IceDump : Tracex Pb
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceDump : Tracex Pb
PDA

View Full Version : IceDump : Tracex Pb

SV
01-18-2001, 07:06 AM
Hi owl

I have a little problem with tracex command on a proggy textdropper (lo Hz).

Page : h**p://www.powerup.com.au/~marver/home2000/22/textdropper.htm
Download : h**p://www.powerup.com.au/~marver/dl/textdrop103.exe

It's packed/protected, and i have used tracex to find EOP.
(How nice is this command !)
Then /tracex 401000 463000 (first section)
Softice break on 401aa0 : seems not to be EOP :(

EAX=00490078 EBX=00000020 ECX=81634E98 EDX=00490000 ESI=006BF9D4
EDI=00000017 EBP=006BF994 ESP=006BF988 EIP=00401AA0 o d I s z a p c
CS=015F DS=0167 SS=0167 ES=0167 FS=44DF GS=3ECE DS:00465488=00000000
--------------------------------------------------byte--------------PROT---(0)--
015F:00401A9B E8DCF8FFFF CALL KERNEL32!GlobalAlloc
015F:00401AA0 A388544600 MOV [00465488],EAX <---------- Here
015F:00401AA5 833D8854460000 CMP DWORD PTR [00465488],00
------------------------------------TEXTDROPPER!CODE+0A9B-----------------------
ICEDUMP: LOG: CS:EIP: 015F:BFF7B4CE, SS:ESP: 0167:006BF97C, R0TCB: CA5091C0
ICEDUMP: LOG: instruction count: 00000000:01C2CB2A, R0TCB: CA5091C0

Then i have tracing manually and found EOP with old method :)
right EOP : 462bdc.
To verify i have put 2 bpms on execute (401aa0 & 462bdc).
Ice break on 462bdc first.
versions are:
icedump v6.0.2.1 for winice v4.05 build 334 on Win98.
I have same problem on 2 differents systems.

I would like to know your sentiment.

Regards
SV
G-RoM
01-18-2001, 07:43 AM
I'd not call this a problem... u know with some layers u have to execute TRACEX several times (IE VBOX). I am about to check but well...

Anyway 6.0.22 will come soon (Poor Owl...so much stuff to do :).

Cheers,
G-RoM
SV
01-18-2001, 09:41 AM
Hi G-Rom

I have already experimented layers with ASprotect and i know this kind of problem.
But here, when i put only 2 bpms on execute, it break first on real EOP and after on 'tracex location' !

Regards

SV
Kayaker
01-18-2001, 02:19 PM
Hi SV,

I used Icedump 6.020 on Win95 and didn't have any problems. I traced the 'old-fashioned' way and confirmed there was a JMP EAX at 482096. Then I used /tracex 401000 463000 and after a time got:

ICEDUMP: LOG: CS:EIP: 0137:00482096, SS:ESP: 013F:006BFE3C, R0TCB: C4620E24
ICEDUMP: LOG: instruction count: 00000000:01E20F34, R0TCB: C4620E24

EAX=00462BDC EBX=0048211B ECX=00000000 EDX=0046820E ESI=815E1D40
EDI=815DF4BC EBP=006BFF78 ESP=006BFE3C EIP=00462BDC

Maybe v6.020 instead of 6.021 might work better?

http://ghiribizzo.virtualave.net/icedump/id6020.zip

Regards,

Kayaker
Kayaker
01-18-2001, 09:48 PM
Hmmm, seems this might be a Win98 issue, at least with this PECrypt32 proggy. I repeated the /Tracex 401000 463000 on Win98 with
icedump v6.0.2.0 and v6.0.2.1 for winice v4.05 build 334
and got the same results as SV, Tracex breaking at 401AA0

:00401A9B E8DCF8FFFF CALL KERNEL32!GlobalAlloc
:00401AA0 A388544600 MOV [00465488],EAX

EAX=00490078 EBX=00000020 ECX=81706D84 EDX=00490000 ESI=006BF9D4
EDI=00000017 EBP=006BF994 ESP=006BF988 EIP=00401AA0

instead of

//******************** Program Entry Point ********
:00462BDC 55 push ebp

which /Tracex correctly broke on with icedump v6.0.2.0 for winice v4.05 build 334 loader on Win95.

Regards,
Kayaker


Still seeking the answers.....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Still seeking the answers.....
PDA

View Full Version : Still seeking the answers.....

Hoof Arted
01-18-2001, 11:31 AM
It has been a little while now that I have been trying to find out if and how anyone has got w32dasm to work on windows 2000 and I still have no joy.

W32dasm and the debugged process gets killed when it tries to show api info for system dlls like user32.dll and kernel32.dll. It works fine on windows 2000 Release Candidate 2 but does not work on final release build 2195 or 2195 with service pack 1.

This problem does not have anything to do with the readonlymemory key in the registry, I have already tried many different settings.

This is starting to kill me. Dont know enough to fix it myself.

Any help will do.

Hoof


Help with setting softice for a hercules secondary display
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help with setting softice for a hercules secondary display
PDA

View Full Version : Help with setting softice for a hercules secondary display

Iuda
01-19-2001, 07:50 AM
Hi all,

I'm using a softice 4x on NT. A few days ago I've got a new video card, a TNT2M64 which seems to work with sice only with universal video driver, so now I'm trying to use a hercules card for debugging, but I cannot setup sice to use this card. If u have any idea about how should I config sice or where I could find some useful information please help me as I'm realy stuck and I don't like at all debugging in a window..

TIA, Iuda


wdasm crashing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > wdasm crashing
PDA

View Full Version : wdasm crashing

loner
01-20-2001, 04:04 PM
has anyone ever got this message while trying to open a file in wdasm

"cannot find .alf File
Be sure that .alf File exists and is in the same Directory as the .wpj file"

i am suspecting that this file has some kind of anti-debugging trick

anyone seen somethin like it in wdasm??

sharon


Where to find the unpacker for Telock 0.51
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Where to find the unpacker for Telock 0.51
PDA

View Full Version : Where to find the unpacker for Telock 0.51

NeO'X'QuiCk
01-20-2001, 05:11 PM
The title says it alL!!

Thanks to all that will help me!!
SV
01-21-2001, 05:08 AM
Hi
Sorry, i haven't but want to unpack it manually.
Could you post proggy's url?
Is it a Crackme ? ;)
Thx
SV
NeO'X'QuiCk
01-21-2001, 05:29 PM
http://kickme.to/tnt/

Go to school /crackme/ it is number 29!

Bye and good luck!!
SV
01-22-2001, 04:11 AM
Thx.
Now it's unpacked and unprotected :).
Have a valid serial too ;)

sv-the-cracker
5228-00-2767

SV
NeO'X'QuiCk
01-24-2001, 01:11 PM
It a easy crackme isn't it!So can see my serial on TNT site !I was the first to crack it!But the task was not to crack it but unpack iT!!

NeO'X'QuiCk


Snatch you'r wrong
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Snatch you'r wrong
PDA

View Full Version : Snatch you'r wrong

lurkerone
01-21-2001, 05:53 AM
Snatch, it seems evident you don't know what you'r talking about. Anti-IE trick used by +Frog has nutting to do with http headers.
You should first study and only later speak, once and if you have understood. And in your case, where you believe that people here are anti-IE "for the trend"... and not because IE is inerently shitty and overbloated as it actually happens to be, you should study a lot more... and avoid speaking for a while.

Try Opera 3.6 for yourself and see if you are really able to go back to crap-ie afterwards, sucker.
Igitt
01-23-2001, 01:32 AM
Moreover all IE-defenders among us may find A+heist's new essay at fravia's searchlores.org an instructive reading...


Reply!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Reply!!
PDA

View Full Version : Reply!!

NeO'X'QuiCk
01-21-2001, 05:25 PM
http://kickme.to/tnt/

Go to school/crackmes/ it is number 29!!

NeO'X'QuiCk


I need wdasm32 v8.9........... NOT 8.93
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > I need wdasm32 v8.9........... NOT 8.93
PDA

View Full Version : I need wdasm32 v8.9........... NOT 8.93

loner
01-22-2001, 12:10 PM
can anyone tell me where i can get this earlier version

cheers
pusspuss
01-22-2001, 04:31 PM
What wrong with V8.93?

For V8.9 try - http://www.exetools.com/

:)


Procdump and win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Procdump and win2k
PDA

View Full Version : Procdump and win2k

hawk_dk
01-25-2001, 12:19 PM
Pls help

when i dump files in procdump i've get and c000005 initialisation error when i start the dumped file
in win 98 the filez works fine ????
yoda
02-07-2001, 04:49 PM
Hi !

Well this can be almost everything =)...but try to set all TimeDateStamp and ForwarderChain members of the ImageImportDescriptors to 0.


Softice Screen Dump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Screen Dump
PDA

View Full Version : Softice Screen Dump

steve38
01-26-2001, 07:13 PM
I'm new to Softice......and cant find a way to screen dump..the key doesnt work...any ideas ?
90h
01-26-2001, 08:27 PM
goto h*tp://icedump.tsx.org/ and get IceDump with it you can Dump Screen to a file.(and lot of other suff you can do with it)


IceDump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceDump
PDA

View Full Version : IceDump

90h
01-26-2001, 08:25 PM
goto h*tp://icedump.tsx.org/ and get IceDump with it you can Dump Screen to a file.(and lot of other suff you can do with it)
90h
01-26-2001, 08:28 PM
sorry i hit post and not replay
steve38
01-27-2001, 03:58 AM
Thanks...I also get "cannot find C:\windows\system\user.NMS" at startup

Sorry to be a pain.
Steve
steve38
01-27-2001, 05:34 AM
Dowenloaded Icedump loaded it ok but still no luck....
Muad'Dib
01-27-2001, 02:19 PM
Did you try reading the help file? It will tell you how to do a screen dump...
steve38
01-27-2001, 10:03 PM
I was under the impression this m/b was for Newbies...I was looking for a little advice, not a smart ass reply......
The Owl
01-28-2001, 03:59 AM
I was under the impression this m/b was for Newbies...I was looking for a little advice, not a smart ass reply......

pardon me for asking, but how much information do you think the following has:

Dowenloaded Icedump loaded it ok but still no luck....

could it be as much as that 'smartass' answer... ? i suggest that you try to state your problem properly in the first place and then get to complain about the lack of content in answers.
carpathia
01-28-2001, 04:55 AM
As for user32.nms, youve obviously uncommented more than you should have done, in your winice.dat. Try it again, this time only uncommenting symbols for the set of dll symbols you want automatically imported.


W32DASM hanging when opening Access Diver.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32DASM hanging when opening Access Diver.
PDA

View Full Version : W32DASM hanging when opening Access Diver.

Dumbass
01-27-2001, 10:41 PM
I have a passwordchecking program that I want to disassemble for tracking down the ad-routines, but there must be some kind of protection in it. W32dasm always hangs when it starts to disassemble it... :(

Any clue ?

BTW. If you call me Dumbass, I allready knew that ;D
carpathia
01-28-2001, 04:58 AM
I expect youd have more success disassembling it with IDA. See the datarescue ftp site for the free 3.85b release.

Regards

Carpathia
carpathia
01-28-2001, 05:00 AM
oops, I should point out that IDA will only probably fare better if its just an anti-disasm trick.

Alternatively, the target may be packed, in which case no disassembler is gonna make much sense of it until you unpack it.
Frost
01-30-2001, 03:06 PM
carpathia (01-27-2001 18:58):
I expect youd have more success disassembling it with IDA. See the datarescue ftp site for the free 3.85b release.

Regards

Carpathia

Can you please specify the exact location of the free 3.85b release? I wandered the ftp but cannot find it!
90h
01-30-2001, 07:30 PM
h*tp://www.idapro.com/freefiles/idafree.zip
or f*p://ftp.datarescue.be/pub/ida/idafree.zip
Frost
01-31-2001, 02:31 PM
Thank you!! I was stuck into the wrong ftp...


Lord Caligo's Fantastic World of Cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Lord Caligo's Fantastic World of Cracking
PDA

View Full Version : Lord Caligo's Fantastic World of Cracking

mike
01-29-2001, 12:04 PM
Can anyone point me to a mirror of this site? (All the links I've found are dead.) Thx.
miscreant
01-31-2001, 04:04 PM
trying to cheat on the disavowed.net tests are we?


Bhrama server problem!!Help please!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Bhrama server problem!!Help please!!
PDA

View Full Version : Bhrama server problem!!Help please!!

NeO'X'QuiCk
01-31-2001, 02:28 AM
I have problems with Brahma server!First i load icedump secessfully!The i open Procdump start bharma server started waiting !The i use simblo loader exapmle load packed upx!Find OEP!The i write /option p
That Ok!Then i write /bhrama procdump32 !!And he write Failed to find bhrama window!!

What's wrong !

Thanks to anyone that help!!

NeO
The Owl
01-31-2001, 03:15 AM
The i write /option p

'p' stands for 'pedump', as opposed to 'b' which stands for 'bhrama'. and the two
option sets have nothing to do with each other... try to pick the right one next time ;-).

Then i write /bhrama procdump32 !!And he write Failed to find bhrama window!!

What's wrong !

well, the error message told you what was wrong. and the manual tells you as well
what the /bhrama parameter is - the procdump bhrama server window name.
i think the example given in the doc is actually what you could use directly unless
you specified a different name in script.ini ( which is otherwise highly suggested
to avoid detection).
NeO'X'QuiCk
01-31-2001, 03:05 PM
I am new at unpacking!

Thanks man!

NeO!


isDcc2.1 is out
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > isDcc2.1 is out
PDA

View Full Version : isDcc2.1 is out

Mr. Smith
01-31-2001, 05:36 AM
Hi,

in December I modified Andrew de Quinceys installshiled decompiler, so that it would print some additional information.
After releasing it I got several emails pointing out that there are some bugs in the original
version of isDcc. I had a look at the code and here is version 2.1 with the bug fixes:

1) I hope I fixed the problem of isDcc messing up labels !
2) Fixed the bug which printed "string" instead of the modulo sign "%".

While I was looking at the code I thought it would be nice if there would be cross references
for the labels, so that one can see from were a specific label is referenced. So I implemented that as well.

Currently it is available from protools, but I also submitted it to suddendischarge. Unfortunately the file description at protools didn't point out the bug fixes in the new version, but now you know.

The labels now seem to be correct for version 3 and 5 install shield scripts, but of course I couldn't test all existing versions. If you find one where the labels are wrong (referencing of labels across functions) let me know.

Mr. Smith


How to get functions argument types in IDA. (ida plugIns programing)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to get functions argument types in IDA. (ida plugIns programing)
PDA

View Full Version : How to get functions argument types in IDA. (ida plugIns programing)

Mostek
02-01-2001, 08:17 AM
Hi

Well the tittle says it all I need argument types for import/export (global) functions.

I checked all those .h,.hpp -s and I'm really confused right now. I only can get the size of all "push"-s .

Any help will be aworded (how? I'll finish ida2softice plugin faster.)
Last news: currently 1/3 of the plugIn is done

Well that's that, I hope somebody can help.

Peace
Mostek
Spath.
02-01-2001, 02:12 PM
I have made an IDC script which adds
parameters recognition based on a .h file, you
can get it at frogsprint.cjb.net (prototypes
parsing is very basic though, you should be
able to do much better in C).

Spath.
Mostek
02-02-2001, 05:28 AM
Thanks

I'll check if it helps.

Thanks
Peace
Mostek


Disassembling GEOS files!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Disassembling GEOS files!
PDA

View Full Version : Disassembling GEOS files!

n03l
02-03-2001, 02:53 AM
I'm after a disassembler that will dump/disassemble GEOS program files. Till now I have been using GeoDump 0.5, but this version is not really doing the job well.

Anyone here who knows about a better disassembler?

n03l


Universal decriptor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Universal decriptor
PDA

View Full Version : Universal decriptor

Frost
02-03-2001, 03:40 PM
I've just switched to Windows NT and I have recognized that my MS-DOS executable decriptor CUP386 does not work properly (It's something like ProcDump32 for old msdos files).

Does anybody know where to get an alternative program for unpacking old exes?


IceDump lame question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceDump lame question
PDA

View Full Version : IceDump lame question

Czajnick
02-04-2001, 05:46 AM
My problem with icedump 6.0.2.1 is that I can't even load it ;) Sorry for that lame question, but...
What is the loading procedure for icedump ?

I always get: "VXDLDR failed to load icedump"
I've tried it on every version of SoftICE i have - 3.23, 3.25, 4.01, 4.05... Nope...
The Owl
02-04-2001, 10:16 AM
1. do you load kernel32 exports in winice.dat?
2. do you see any messages in the winice window?
Czajnick
02-04-2001, 11:12 AM
The Owl (02-04-2001 00:16):
1. do you load kernel32 exports in winice.dat?

This was the problem.
I've found a note about it in docs, but I simply missed it.
I think it should also be added to the "Usage" section...

Well, thanx, now everything is clear ;)
+SplAj
02-06-2001, 03:46 AM
Hi OWL

I did not forget your Q re icedump and the Softlocx bug :)

Unfortunately I had installed that MS Virus WinME and it has taken me until today to fully clear it from my PC.

I had the same problem as Czajnick (VXDldr failed...) fixed that and now I am discovering what you asked .........

Please see the following text from an exception after /protect on with id 6021 was set and Fusionv2 then loaded :-

EAX=816FFA24 EBX=C0000027 ECX=E25EED00 EDX=00000020 ESI=0000000D
EDI=C17931B0 EBP=E25EEF70 ESP=E25EEE50 EIP=C02A217C o d I S z a P c
CS=0028 DS=0030 SS=0030 ES=0030 FS=0000 GS=0000 DS:C000002B=FFFFFFFF
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄbyteÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
0030:00000000 9E 0F C9 98 65 04 70 00-16 00 8B 09 65 04 70 00 ....e.p.....e.p.
0030:00000010 65 04 70 00 54 FF 00 F0-77 A5 00 F0 53 FF 00 F0 e.p.T...w...S...
ÄÄÄÄÄ_VWIN32_Npx_Exception+021EÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
0028:C02A211A 8BC8 MOV ECX,EAX
0028:C02A211C 66874D2C XCHG CX,[EBP+2C]
0028:C02A2120 33C8 XOR ECX,EAX
0028:C02A2122 F6C502 TEST CH,02
0028:C02A2125 7411 JZ C02A2138
0028:C02A2127 F6C402 TEST AH,02
0028:C02A212A 740C JZ C02A2138
0028:C02A212C 6681652CFFFD AND WORD PTR [EBP+2C],FDFF
0028:C02A2132 CD20 INT 20 VXDCall Enable_VM_Ints
0028:C02A2138 668345300E ADD WORD PTR [EBP+30],0E
0028:C02A213D 83CEFF OR ESI,-01
0028:C02A2140 F7C701000000 TEST EDI,00000001
0028:C02A2146 7518 JNZ C02A2160
0028:C02A2148 BE2C000000 MOV ESI,0000002C
0028:C02A214D 66A1F8C832C0 MOV AX,[C032C8F8]
0028:C02A2153 663B4528 CMP AX,[EBP+28]
0028:C02A2157 0F8513FEFFFF JNZ C02A1F70
0028:C02A215D C1EE02 SHR ESI,02
0028:C02A2160 56 PUSH ESI
0028:C02A2161 55 PUSH EBP
0028:C02A2162 CD20 INT 20 VXDCall _VWIN32_FaultPopup
0028:C02A2168 83C408 ADD ESP,08
0028:C02A216B C3 RET
0028:C02A216C A15CBB13C0 MOV EAX,[C013BB5C]
0028:C02A2171 0BC0 OR EAX,EAX
0028:C02A2173 7411 JZ C02A2186
0028:C02A2175 8B5878 MOV EBX,[EAX+78]
0028:C02A2178 0BDB OR EBX,EBX
0028:C02A217A 740A JZ C02A2186
0028:C02A217C 855304 TEST [EBX+04],EDX
0028:C02A217F 7504 JNZ C02A2185
0028:C02A2181 8B1B MOV EBX,[EBX]
0028:C02A2183 EBF3 JMP C02A2178
0028:C02A2185 F9 STC
0028:C02A2186 C3 RET
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄVWIN32(05)+0C42ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
MSR LastExceptionToIp=C02A2178

Please e-mail me and maybe I can help you. It's a bit embarrassing discussing it here P)

+SplAj
The Owl
02-06-2001, 05:11 AM
thanks for your offer, but i have already solved the problem with softlocx (many
thanks to SV). all is fine now, you can check it in the latest 6.022 pre release.

what's left is a /tracex issue with some old version of pecrypt (1.0 or so it seems),
for some unknown reason the tracer loses control at some point (before reaching
OEP) and gains it back, but somewhat after the OEP (a few function calls deep).
if you want to figure this out and need a target, try

h**p://www.powerup.com.au/~marver/dl/textdrop103.exe

(the app is not really interesting, but i know that it was wrapped by a version of
pecrypt on which the tracer fails).
The Owl
02-06-2001, 04:10 PM
well, i've nailed down the problem to this: when an app does a loadlibrary() for mmsystem.dll, by the time the loadlib call returns, eflags.tf is turned off. presumably mmsystem's dllmain performs some operation that leads to this side effect. anyone care to figure out where/why it happens?


john the ripper configuration
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > john the ripper configuration
PDA

View Full Version : john the ripper configuration

mike
02-06-2001, 10:15 AM
I'm trying to get john to try all passwords of length 6 that are just alpha. When I try

john -i:alpha -stdout

it's obviously not doing that. Maybe it's filtering it somehow? I also tried using the lanman generation, but I guess I don't understand it because it says it wants plaintext. Can anyone help? Thx
Spath.
02-06-2001, 05:38 PM
The order john gives out its words is indeed
quite weird, yet it seems to work (at least it
does for n=3). Use this command line with
Minlen=6 and Maxlen=6 and you should get
your 1.8 GB file.
Bytez
02-07-2001, 04:54 AM
You might want to read a tutorial about JTR, this is a good one:

http://blacksun.box.sk/john.txt


Change SICE's hotkey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Change SICE's hotkey
PDA

View Full Version : Change SICE's hotkey

Bytez
02-08-2001, 03:58 AM
The key to bring up is CTRL-D, but Photoshop uses this combination to Deselect. Does anyone know how to change the SICE hotkey?

Thanx in advance.
risc
02-08-2001, 11:22 AM
type in 'altkey <keycombo>' in sice window, or winice.dat init string

keycombo ctrl-? or alt-? ... see bottom of sice window
Bytez
02-08-2001, 12:31 PM
Thank you very much!


Wdasm patch for "out of memory error" ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Wdasm patch for "out of memory error" ??
PDA

View Full Version : Wdasm patch for "out of memory error" ??

Mr Smith
02-08-2001, 04:27 AM
Hi,

I tried to disassemble a 500kb target with Wdasm 8.93 and got an error message saying that Wdasm couldn't allocate enough memory for all code lines.

Now, this is hard to believe since I have 192MB RAM and I have already disassembled progs with several MB. So, this seems to be a bug ? I therefore wonder if there is a patch or workaround for this ?

Many thanks,

Mr. Smith

P.S. I know I should use IDA, but I just can't get used to it :-(
stanks
02-08-2001, 10:41 AM
buy 192MB more
;D
CoDe_InSiDe
02-08-2001, 11:30 AM
Hi Mr Smith,

I've also seen that problem sometimes it's probably the resource section.
It's simply too big try to decrease it's value.
You can use some program to look for that value, i don't know a program right now but i think that Procdump has it.
Good luck with it...

Cya...

CoDe_InSiDe
ThrillSeeker
02-08-2001, 04:59 PM
If you have a large hard drive try to increase the swap file's size. (Don't worry about the warning when you try). Mine's 700 MB.


icedump 6.022/nticedump 1.10 released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump 6.022/nticedump 1.10 released
PDA

View Full Version : icedump 6.022/nticedump 1.10 released

The Owl
02-11-2001, 03:52 PM
at icedump.tsx.org as usual.

there are many fixes in the tracer and PE dumper engines, plus other
goodies (check the doc/code for details). since some of the changes
are rather experimental, i can very well imagine there will be some
stability issues. feel free to report them back to me (with as many
details as possible!) and for this reason i'd also advise archive
maintainers to hold off on putting icedump up on their pages for the
next week or a few days at least, after that i will announce it here
whether a new release is in the works or this one is declared good
enough for now.
The Owl
02-15-2001, 04:21 AM
based on the (lack of ;-)) feedback i conclude that either noone cares or is
having any particular problems, so feel free to spread the word (and icedump).
Anonymous
02-16-2001, 02:20 PM
The fact remains the whole crackers/reversers community greatly appreciates either your work or your dedication. Thank you very much.
90h
02-17-2001, 12:48 PM
I like to say thanks to all the ppl that have worked on IceDump. And that it will be a sad day win IceDump is not update any more.
Thigo
02-19-2001, 05:35 AM
Yeah,
u guys did a really good job with this one... I don't know how I would do my keygens without it :) The best think is that it hides softIce perfectly... And the dump functions are quite usefull too...
Continue this damn good tool...


IDA x-refs question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA x-refs question
PDA

View Full Version : IDA x-refs question

the_lover
02-13-2001, 01:47 PM
I am removing the protection from a little program (really old disassembler). I located what procedure is responsible of the protection (nag screen + disabled menu item).

The problem is that I get only one x-ref to an offset,which is never x-referred.

How to find where this offset is used??


workhelp.hlp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > workhelp.hlp
PDA

View Full Version : workhelp.hlp

stanks
02-13-2001, 01:57 PM
This is for BRW. Anybody have it?

thx
stanks


Turbo Debugger (TD32) and Symbols
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Turbo Debugger (TD32) and Symbols
PDA

View Full Version : Turbo Debugger (TD32) and Symbols

cq25
02-14-2001, 02:43 AM
Hi Guys,

I'm just starting to work with Turbo-Debugger (TD32 V5.0). All works fine, but one thing looks very difficult ... how do i load an external symbol-map into this tool (not coming up with the exe-file!)?

I think (so far i understand this tool), i should have a *.TDS-File, but the only thing i can give is a *.MAP-File (coming from IDA).

So my question is:

Do i need a converting-tool (like msym for softice) to make a TDS-file or is there another way to load external symbols. And ... if i need a converting tool, does anybody know where to get.

awaiting a lot of ideas
/cq25
Maldoror
02-15-2001, 05:34 AM
>Hi Guys,

Hi
Here is my opinion regarding your question:

I'm just starting to work with Turbo-Debugger (TD32 V5.0). All works fine, but one thing looks very difficult ... how do i load an external symbol-map into this tool (not coming up with the exe-file!)?

AFAIK you can't load external map files in TDW32.

I think (so far i understand this tool), i should have a *.TDS-File, but the only thing i can give is a *.MAP-File (coming from IDA).

If you use BC++5.02(for example) you can tell the compiler(and linker) to generate debug information. If you check the "Detach debug Information from OBJs" option a .tds file is created. Otherwise the debug info is embedded in obj files. (You can strip the debug info later using the tdstrip.exe utility in order to get a .tds file)
Note that the debug info format is Borland specific(IMHO). This is the reason you can't debug a BC++ exe(or dll) with many other debuggers(except these provided by Borland).
On the other hand you can tell the BC++ compiler to generate a map file that can be used to generate SICE symbols. In this case you can debug with SICE (at source level) a program compiled with the BC++ compiler.

So my question is:
Do i need a converting-tool (like msym for softice) to make a TDS-file or is there another way to load external symbols. And ... if i need a converting tool, does >anybody know where to get.

Yes, you need a conversion tool.
I don't know where to get it ;-)

Greetings!
Maldoror
mmaldoror@hotmail.com


Setting bpx __vba breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Setting bpx __vba breakpoints
PDA

View Full Version : Setting bpx __vba breakpoints

InOverMyHead
02-14-2001, 08:20 AM
I have checked that the following lines are enabled as needed in Softice (I don't enabled both at the same time):
EXP=c:\windows\system\msvbvm50.dll
EXP=c:\windows\system\msvbvm60.dll

As an example when I try to set bpx __vbastrcmp I get:
Symbol not defined (__VBASTRCMP)

I can not set a bpx on any of the VB functions. I have checked in:
c:\windows\system\ and I have both dll's present.

I have no problems setting any other bpx's - only those associated with msvbvm50.dll or msvbvm60.dll when I have them enabled in winice.dat.

I feel that I am doing something very elementary wrong, but don't know where to look.

Thanks in advance
Brtascher
02-15-2001, 02:22 PM
Are you paying attention to the double underscore?

Are the msvbvm60.dll in windows/system the correct full version? Some time ago an idiotic shareware overwrote my msvb....dll file. Decompile the dlls and make sure that they export the __vba function(s) you are BPXing on.
Try loading the .dll manually using the Numega symbol loader.
InOverMyHead
02-15-2001, 11:27 PM
I manually loaded the exports as suggested and the bpx's now work fine.

Question: Is this the "standard" way of getting these dll's to work or do I have something set wrong?

Thanks for the tips!!!
Bratsch
02-16-2001, 12:01 AM
InOverMyHead (02-15-2001 13:27):
I manually loaded the exports as suggested and the bpx's now work fine.

Question: Is this the "standard" way of getting these dll's to work or do I have something set wrong?

Thanks for the tips!!!
I have been where you are, just so many months ago that I could only vaguely remembered the solution I employed.
Now it has come back to my old and alcohol embeded neurons ;P.
Goes like this:
Sice does not complain if the libraries you typed in winice.dat do not exist. It simply skip them from loading. a MINIMAL typing error, even an extra space in the path to the libraries is sufficient for softIce to miss them. When you do it using the symbol loader, is a "modern day" point and click process, so Windows takes care of our sloppyness. If you carefully review the spelling, path, etc in winice.dat, you will eventually get it right and the VB libraries will be loaded at boot time to softIce. DO YOU REALLY NEED IT SO?
that is the question


?? SoftIce video setting under Winnt4 sp5/sp6a
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ?? SoftIce video setting under Winnt4 sp5/sp6a
PDA

View Full Version : ?? SoftIce video setting under Winnt4 sp5/sp6a

kofude
02-15-2001, 03:06 AM
Hi all,

Where can I find FAQ about problems with SoftIce video under :
WinNT4 (standard encryption) sp5 Matrox MGA-G200 - 8Mb
WinNT4 (high encryptiuon) sp6a ATI Rage Fury - 16Mb

I can't see the softIce window using CTRL-D and I can switch back using F5.

TIA for any clue.
kFd


Install SoftIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Install SoftIce
PDA

View Full Version : Install SoftIce

Gibban
02-15-2001, 10:33 AM
Help!!
Is it possible to get information how to install these 5 files that are supose to be SoftIce when installed.

Help !!!

Gibban
ThrillSeeker
02-15-2001, 03:03 PM
You would need a unzip and then unrar those files.use Winzip to unzip to a separate directory. Move the .rar, .r00, .r01,.r02,.r03.,.04 files to a separate new directory. Once done double click on .rar and it will open with your program to unrar. unrar yet to another directory and double click on the exe file.(the install prog).

tell me if you have trouble.


How to let IDA recognize UNICODE strings?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to let IDA recognize UNICODE strings?
PDA

View Full Version : How to let IDA recognize UNICODE strings?

Solomon
02-16-2001, 01:04 AM
I use IDA to disassemble a VB6 prog, but there are many unicode strings and IDA displays them as DWORD integers. Tired of pressing 'a' keys, is there any plug-in to recognize the unicode strings? Thx.

BTW: my version is 4.04.
Anonymous
02-16-2001, 12:34 PM
Options->ASCII string styles...
Solomon
02-17-2001, 01:15 AM
So simple? Thanks


FlexLM SDK 7.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FlexLM SDK 7.2
PDA

View Full Version : FlexLM SDK 7.2

PadsPCB
02-16-2001, 04:02 AM
Hi Everybody !

Now we have a lot to do, RSA is also included.
But generally its difficult to get the SDK since
Globetrotter has taken it from their FTP.
Some tools may be found at __CrackZ place:
h**p://zencrack2.cjb.net/
He has already updated to 7.2, Let the games begin ;) .
I have made a public MySpace Folder just for sharing
all FlexLM stuff. You may find the 7.2 SDK there, also
FlexGen 2003 with source code (VB).
Please have a look:
h**p://www.myspace.com/Folders/1773963/
Password: freecad
You can also upload, if you think its worth.
Best Regards

PadsPCB
Nolan Blender
02-20-2001, 11:55 AM
/* Version 7 keys */
#define VENDOR_KEY1 0xaa3b525b
#define VENDOR_KEY2 0x1d751d8a
#define VENDOR_KEY3 0x868b0015
#define VENDOR_KEY4 0x0ee5a4d2
#define VENDOR_KEY5 0x7041ae99
#define CRO_KEY1 0xae1b5053
#define CRO_KEY2 0x5b577f0c

#define VENDOR_NAME "blenderd"

Have fun.
xx
02-21-2001, 06:47 AM
Thank you Nolan!

Are you ready to share some new insights ;->

x
nblender
02-21-2001, 10:00 AM
I have done some minor research on the latest version of FLEXlm,
but not as much as is required to really figure it out, as I have
real life events which preclude my spending time on this project.

As far as I can tell, if you use the "standard" version of FLEXlm
only encryption seeds 1 and 2 are used to generate the licenses -
changing the values of encryption seeds 3 and 4 do not appear to
affect the standard key values. Encryption seeds 3 and 4 appear to
be used to generate the public and private keys which are passed into
the Security Builder routines which the new FLEXlm is linked against.

I have only examined one target using the "new" flexlm, but it used
the default security mode rather than the counterfeit resistant option
mode. It appears as though CRO must be purchased seperately.
Globetrotter has improved the seed hiding, so it is no longer possible
to get the seeds out simply by passing a null pointer to the job
structure into the lm_new routines. This is an improvement over the
previous version which should never had that security hole coded
into it in the first place.

The CRO appears to be enabled on a per platform basis by individual
bits turned on in the decoded CRO_KEY1 and CRO_KEY2.
PadsPCB
02-21-2001, 11:52 AM
Hi Everybody !
Thanx for your interest Nolan !
First: You're right! Seeds 1 & 2 are used in the old ways, to generate the encrypted code. As this is still a version 7, it uses the old glseed = 0x788f71d2. SIGN= is encripted altogether as an ISSUER or other sring. Checksums work the same.
Second:Seeds 3 & 4 are used to scramble the SIGN, and probably scramble also the feature and the version number.
In a sample dump from lmcrypt we have:
: on entry eax, some value. Normaly enters with 0 (old seed)
: so calculations result in 0x788F71D2 ...
:00428253 neg eax ;glseed=0x00000000, CFLAG=1
:00428255 sbb eax, eax ;glseed=0xFFFFFFFF
:00428257 and eax, D0E83B58 ; glseed=0xD0E83B58
:0042825C add eax, 788F71D2 ; glseed=0x4977ad2a
So it may use this new seed to make SIGN !

I've seen in Tranlogic's HDL Entry, that the software passes along with the feature request, the value of the Prime(Q) and the Module(N), so it is easy to get the Private Exp(D). See the dump
0x00DC4F30 d8 94 a7 00 00 00 97 00 cc 7d e0 00 10 9f a7 00 .........}......
0x00DC4F40 c4 94 a7 00 a7 5f 5e 00 28 fe a7 00 00 00 00 00 ....._^.(.......
0x00DC4F50 30 32 43 56 00 00 00 00 00 00 00 00 00 00 00 00 02CV............
0x00DC5010 dc 05 ca 00 0c 60 dc 00 42 32 46 36 31 45 42 38 .....`..B2F61EB8
0x00DC5020 37 45 30 45 00 00 00 00 20 00 00 00 21 00 00 00 7E0E.... ...!...
0x00DC5030 39 43 35 41 41 33 38 33 45 45 38 45 38 43 45 41 9C5AA383EE8E8CEA
0x00DC5040 43 39 37 36 00 00 00 00 00 00 00 00 00 00 00 00 C976............
So, using RSA tool from TMG we have:
Prime(P) B2F61EB87E0E
Modulus(N): 9C5AA383EE8E8CEAC976
Private Exp(D): 447F09756FD7C51D191EEC828BDB678F

After getting Seeds 3 & 4 it should be easy to make lmcrypt using this key.
Lets find how SIGN is encrypted.

Ah.! And hope we can get a new LmRecode, with GUI now ? :D

Best Regards

Pads
Nolan Blender
02-21-2001, 06:45 PM
Well, seeds 3 and 4 shouldn't be available in a correct public
key implementation. I haven't examined it that closely, but
I have a hard time believing that Globetrotter would be so
stupid as to do that.

Examination of lmrand2.obj has revealed some interesting things.

I might do GUI based versions of the FLEX tools, but they are
used so seldom that the DOS versions seem good enough.
nblender
06-21-2002, 03:35 AM
Yes, it's possible that the seeds 3 and 4 may be derived from
the daemon in version 7.2 flexlm. lmrecode and lmvkey are no
longer publicly supported, although I'm sure it would be not much
work to make them work for later versions.
tom_324
06-21-2002, 09:04 AM
Originally posted by nblender
lmrecode and lmvkey are no
longer publicly supported, although I'm sure it would be not much
work to make them work for later versions.

Two new constants for vendor keys generation and different ctlarr[0] and [1] in nbl_crogen routine for v8.1. That is all.

Tom
FoxB
06-21-2002, 11:24 AM
Deleted
tom_324
06-21-2002, 11:39 AM
Originally posted by FoxB
This constant var1 = **** and var2 = *****

Whoever can't find those values by himself will not make any progress in cracking Flex*LM. I suggest deleting them ...

Tom
CPCP
06-23-2002, 07:50 PM
.
tom_324
06-24-2002, 09:12 AM
SeanC,

I do not think you question was stupid. I just want to prevent GT from learning too much from this MB.

roil, CPCP and others : let's switch to e-mail messages.

Tom
FoxB
06-24-2002, 09:17 AM
Deleted
yorkiny
08-28-2002, 10:48 AM
is anyone forward to me ? thanks yorkiny@163.net
whyIII
08-09-2003, 08:20 AM
how about me? whyIII@hotmail.com
dELTA
08-10-2003, 02:31 PM
How about... checking the date on post before replying to them? :D

dELTA
squidge
08-10-2003, 06:43 PM
LOL, I suppose a year late is better than never at all tho' ;)

Still, if anyone wants the SDK, head over to crackz....


iscab for Install Shield 5.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > iscab for Install Shield 5.5
PDA

View Full Version : iscab for Install Shield 5.5

IcyDee
02-21-2001, 04:27 AM
I am writing a general purpose tool to extract/replace exe files in all versions of Install Shield cab files. I will be providing support for IS V5.0 V5.5 V6.2

To do this I have purchased the latest Install Shield version. I also have V5.0. I don't have V5.5

I believe I need a file that comes with Install Shield 5.5 called ISCAB.EXE but although I have searched many of the search engines I can't find a copy of this file.

Since I have a legal copy of IS 6.2 then I *should* be able to use an earlier version, if I can locate it.

I understand some earlier versions of IS came on cover mount discs, effectively it was given away.

Does anyone know where I can get a copy of ISCAB.EXE for V5.5 IS?


New SI essay by yours truly, for all those who are interested..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New SI essay by yours truly, for all those who are interested..
PDA

View Full Version : New SI essay by yours truly, for all those who are interested..

Lord Soth
02-21-2001, 07:59 PM
Hiya folks,

I've finished writing a new essay about our beloved debugger (SI heh), that gives some insight on some of the useful commands it has (some advanced, some not).
If any1 is interested in checking it out, it should be posted at the ID site pretty soon.

http://www.immortaldescendants.org/

Cyas!

LS
Bratcher
02-21-2001, 11:01 PM
Thank You m'lord,
Generosity with knowledge is a path to Nirvana.
May life be Kind with your Honor.
zeeman
02-26-2001, 12:24 PM
I look forward to all new essays! Thank you.

Regards,
Zee.
Kugi
03-01-2001, 11:16 AM
Went there, got that. Good stuff. Thank you kindly.

Regards, Kugi
Jack
03-02-2001, 08:03 AM
i cant connect to the site :(

also it was previously on tsehp's page, but now it's removed?
Lord Soth
03-02-2001, 10:00 PM
hmm,

Weird, I don't know why it has been removed. Go figure..

LS

Jack (03-01-2001 22:03):
i cant connect to the site :(

also it was previously on tsehp's page, but now it's removed?
Kayaker
03-03-2001, 12:59 AM
Lord Soth (03-02-2001 12:00):
hmm,

Weird, I don't know why it has been removed. Go figure..

LS

Too non-threatening, too non-target-specific, too generic maybe? No animals or shareware authors were harmed in its making, heh.

Nice tut BTW, I especially liked the heads up on the DEX command, that removes one of my major aggravations. I know it's in TFM, but I never thought to use it!

I just read a quote tonight that I think applies to a lot of what goes on in here:

Employ your time in improving yourself by other men's writings so that you shall come easily by what others have labored hard for.

--Socrates

Ciao,
Kayaker
Jack
03-04-2001, 07:31 AM
I wonder if anyone has problems with the SICE macro's.
if i define them in my Winice.dat and restart my puter the macro doesnt get loaded and sice doesnt recognize the macros i defined..
The Owl
03-04-2001, 02:42 PM
1. since the original site/url seems to be down, try this:

http://mirror1.immortaldescendants.org/

2. on 'watch'

You might be wondering why would I want to use a watch when a memory BP can do the same.

this is not correct, a BP (on memory access i assume) lets you catch code that
attempts to access (read/write) memory, whereas a watch does not. on the
other hand, a watch makes it easy to keep an eye on expressions (which can
be memory content) whenever softice is active (visible) and it updates the watch
window. in other words, they're different animals, used for different purposes.

issue is that the total number of BPs is only 16

this is not true, the total number of BPs is 256 (hardcoded limit in softice).

3. on 'addr'

Remember though that the address space for a process is kept and enforced by the CPU while in protected mode, so in effect, there "should" be no trespassing. We have come to learn though, that in Windows9x, this is far from the truth.

the CPU has no knowledge of 'processes' and their 'address spaces', rather it's
the OS that creates these abstractions using the features of the CPU. on IA-32
CPUs it means making use of the paging logic (for which protected mode must be
enabled).

i'm not sure what you meant by 'there "should" be no trespassing', if you mean
that separate address spaces have been conceived in order to protect user
applications from trashing each others' memory, then it's correct, but then i don't
understand your saying 'We have come to learn though, that in Windows9x, this is
far from the truth'. do you mean that user processes are able to access each
other's address space in a controlled manner (ie. with OS kernel assistance, in
win32 OSs that would be read/writeprocessmemory)? but then you can state the
same for many other OSs as well, NT, Linux, BSDs, etc.

An interesting thing to note is when a context change occurs, windows copies the information from the PGTPTR array into its page directory (pointed to by the CR3 register, according to the manual). This will affect the addressing of the lower 2 GB of the virtual memory space. That is, all addresses ranging from 0 to 7FFFFFFFh are remapped according to the new context, and data of that process is now viewable to you.

some clarification here. in win9x the 'context' of a win32 process covers the linear
address range of 0x00400000-0x7FFFFFFF, as you pointed that out earlier in your
essay. however when a context switch occurs, VMM!_ContextSwitch updates the
Page Directory Entry for the range 0-0x003FFFFF as well. this specific PDE
happens to be common for all contexts because contexts are created for win32
processes only which in turn get created in the System VM (ie. when the current
VM is the System VM).
LordSoth
03-05-2001, 06:00 PM
damn, it didn't post the first reply, so here it is, simplified:

Hi btw :-)

About the watch issue, I never meant for it
to sound as if it was a memory access BP.
I know it well not to be a BP, but something
else. I'll need to rephrase my essay.

As for the 16 BP limit, I remember I've read
it in a SI guide sometime, altho I can't
remember. I'll check it out and update that
too.

As for the trespassing. What I meant was that
it is only too easy for a process to access
another process' address space by accident,
and otherwise. This has several reasons,
which I'm sure you are aware of. Whether it's
the global memory sharing above 2Gb, and the
16 bit code areas (mainly the kernel, user
and gdi modules), which have to also be
global to all due to them being 16 bit (yup,
relates to the win16mutex problem), and of
course lets not forget security, which is
totally ignored in win9x. So a process can
read any other process memory with a function.
In NT it's different. Many functions use a
security attributed structure and security
is enforced so it's harder to poke in other's
memory.

thank you for your comments, i'll go update :)

LS

PS. the board says my nick is taken (probly because I've registered using it), but
shouldn't it let me login ??
HalVarFlake
03-06-2001, 03:39 PM
I have a few questions concerning this;
(For those that know more than me don't laugh
at my sillyness ;)
Your post seems to be a bit mixed up, can you
please clarify:

1. What do you mean by the Win16Mutex Problem ? Mutex
(Mutual Exclusion) is something that is AFAIK used for sync issues.

2. I don't think a Win9x process can write to another process'
address space erroneously via a bad ptr or something similar.
As you guys mentioned before, all of what normally be user-mode
memory is being remapped, so the only thing a process could do
is corrupt stuff that would be in protected kernel memory under
any "real" OS.

LordSoth, can you please clarify ?
LordSoth
03-06-2001, 05:46 PM
Hello,

Well, I can try and clarify. Yet The Owl knows more than me on this issues, so
I'll bet he'll have something to add as well.
The best way to learn about the win16mutex is in matt pietriek's windows
programming secrets. That book is highly recommended, the guy did an awesome
job reversing many internal mechanism in windows.
In short, when MS set out to design win95, they wanted to make an OS that
will be new, and yet will be able to be backwards compatible with win3.11 16bit
programs. One other important design consideration was that they (apparently)
didn't want to rewrite all the windows internals code. For obvious reasons, that
code was much more stable than a newly coded system from the ground up.
So what they decided to do is to somehow build upon the win3.11 16bit libraries
with some more 32bit libraries. In fact, most of the real work of the OS is done
in those old 16bit libraries, which are also apparently, are not entirely 16bit, but
rather a hybrid. In any case, for the reasons mentioned earlier, 16bit memory
cannot be protected like 32bit code using hardware, and maybe some of those
libraries use functions that are non-reentrant (which sounds all too acceptable,
but I'm not certain on this point). In that case there would be a synchronization
problem in the OS when multiple threads execute the same lines of code in the
16bit libraries. It's basically like you can't use a function that uses a static
variable of any kind, if you expect multiple threads to run through it's code at
the same time (which can happen, since a thread has among other things it's
own register set, stack pointer, stack, etc..). MS decided to solve this sync
problem using a mutex. They called that object the Win16Mutex. Each thread
that would have to enter 16bit code will have to acquire control of the mutex
before continuing, and if a different thread is currently executing in 16bit code,
it has the win16mutex acquired so the other thread is put to sleep.That way MS
solved the sync problem with the 16bit libraries, which of course hampered
win95's multithreading. Apparently, as pietriek noted, it is possible to do some
weird things while you obtain the mutex, and in general, since 16bit code has
to be global to all processes, and many important things like window handles
and gdi object handles are stored in those libraries data segments, a process
can do great harm to the system.
I hope that clarified that a little.
You mentioned a process can't access memory outside of it's space with a
weird pointer. Well, that is true in general, but is not a 100% sure thing.
Since the 32bit libraries are also mapped globally, a badly pointed pointer (sorta
speak hehe) can do harm to the system. In fact, it's all too easy to cause
harm to the system or other processes if you try. On top of that there are
the XXXXprocessmemory functions (read and write), which give you a great
deal of power in your hands, since all processes in win9x are created equal,
and there are no security limitations :(

If you survived this long typing endeavor, i salute you my friend ;-)

ciao,
LS
HalVarFlake
03-07-2001, 06:15 AM
LordSoth (03-06-2001 15:46):
libraries use functions that are non-reentrant (which sounds all too acceptable,

In a truly multithreaded OS non-reentrant functions are not acceptable or at least not ideal for obvious reasons.

Thanks for explaining me what a mutex something.
Thanks for explaining me that a thread has its own register set.
I didn't ask for that either, but its good to tell the newbies on this
board about it.

The clarification I asked for is the relationship between the
Win16Mutex and your statement that the 16-bit code is mapped gobally
and can thus be corrupted by an errant pointer.

LordSoth (03-06-2001 15:46):
harm to the system or other processes if you try. On top of that there are
the XXXXprocessmemory functions (read and write), which give you a great
deal of power in your hands, since all processes in win9x are created equal,
and there arno security limitations :(

It has been a while since I saw an errant pointer constructing
all arguments to a certain API call on the stack and then overwriting
some pointer to get execution into the *ProcessMemory functions.
And even when I saw this, this was hardly by accident.

While the security subset of the Win32 API is not supported or
enforced in win9x AFAIK (correct me if I am wrong, I know nothing
about 9x internals)

Anyways, in case *ProcessMemory functions succeed, there obviously
*should* be "trespassing" as these are features (not bugs) supplied
by the OS.

Without wanting to restart the flamewar that apparently lead to
banning of people on this board, I would kindly suggest that you try
to limit the amount of information you're posting with each sentence.
You're trying to cram a lot of what is called "dangerous half-truths"
into your essays; Please try to be more to the point.
Something I usually do when I write something is to write it, then to
let it rest for a week, and then to slowly re-read it; That way you get
a distance to your work that enables you to see how unclearly and
unready the first vresion was. Correct everything then, and repeat
until you feel your stuff is concise, to the point, true, and under-
standable.

Cheers,
Halvar
[yAtEs]
03-07-2001, 06:51 AM
/me pokes lord_soth (;
LordSoth
03-07-2001, 05:07 PM
[yAtEs] (03-07-2001 04:51):
/me pokes lord_soth (;

hehe ;)

PS.
HalVar, thank you for your comments. I think I just might do what you suggested, it sure sounds like a good idea.

LS


IDA pro v 3.7 demo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA pro v 3.7 demo
PDA

View Full Version : IDA pro v 3.7 demo

KARL
02-22-2001, 02:36 AM
Can someone please email me the demo of IDA pro version 3.7 . I shall be very greatful to you.

I can't find it on the web. As the new version is 4.15 with limited options.

Thank you.

KARL


Help!About Hiew!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help!About Hiew!
PDA

View Full Version : Help!About Hiew!

ama
02-23-2001, 10:34 PM
Hiew is a power tools,but there are some functions which I don't know how to use.In "Text view " (of cause in "hex view" and "Code view" too),there is "CtrlF9 - FilArg - filelist from **argv",but what is "**argv" and in"hex edit",there is "CtrlF7 - SetCry - initialize crypto",can you tell me how to use it,or
it's directions in details.
Thinks a lot!!


driver the game
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > driver the game
PDA

View Full Version : driver the game

hoekeirs
02-24-2001, 04:33 PM
how can I change the environment of the city and
how to find out of it are sprites or direct rendered
scenes ?


cd checker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > cd checker
PDA

View Full Version : cd checker

sandstorm
02-24-2001, 11:01 PM
any help on tools to discover the cd check function in the code?

any documentation on how to see the cd check funtion.?
Kilby!
02-26-2001, 04:41 AM
Theres pleanty of tutorials out there I suggest starting with a tut on the Eidos CD Lock system

Kilby...


Windows2000 + Detonator7.52 + Softice + 16bit colourdepth == ok?!?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Windows2000 + Detonator7.52 + Softice + 16bit colourdepth == ok?!?!
PDA

View Full Version : Windows2000 + Detonator7.52 + Softice + 16bit colourdepth == ok?!?!

DGR
02-25-2001, 08:01 AM
Might be something to try for u ppz with nvidia cards and win2k... Until now I had major problems using softice with this combo. However with the new detonator7.52 drivers everything seems to be working.

At first when using a colourdepth of 32 bit the normal problems arose, softice wouldn't pop up (atleast, it would pop up but u couldn't see it). However when I changed the colourdepth to 16 bit it DID work as normal. With the previous detonator drivers switching between colourdepths also solved the problem temporarily but now I'm running at 16-bit for 2 to 3 days and all this time softice is working just fine. (Btw, I'm using DriverStudio 2.0).

So perhaps the problems are finally (on their way to be) solved? I sure hope so... Anywayz, if anyone else wants to try it and give their results here, coz I wonder if it's pure luck/coincidence/temporary or really finally working.

Take care and greetz,

DGR
umm
02-25-2001, 11:11 AM
would you be kind enough to post an address where these drivers can be downloaded from ???
miscreant
02-25-2001, 11:48 AM
No luck on my PC :(

Where can I get driverstudio 2 (im using sice 4.05, which is a slightly older revision than that with driverstudio 2)

Changing colour depth on other detonators didn't help me either, only solution is 5.32 or earlier for me, which sucks.

Maybe the new 10.50 drivers (with geforce 3 support) will help when the win2k version is released.

Those wanting to try (please post your results) all drivers can be found at http://www.the-ctrl-alt-del.com/Drivers.htm
DGR
02-25-2001, 02:26 PM
Sorry to hear that ppz, switching to Driverstudio2.0 might help... the softice version is 4.05 (Build 526). Also, I'm using windows2000 Servicepack1, don't think that's of any influence tho.

Maybe it also depends on the card you have (Geforce2 MX here), dunno... I do know that I'll pray every night that it keeps working.

Take care,

DGR
Xybyre
02-27-2001, 10:03 AM
I've tried the 7.52 drivers with no luck as well. I'm running Win2k+SP1, and running in 16-bit color didn't work for me, either.

I've been using SoftICE 4.05 with the 5.32 drivers. I run into the nv4_disp loop problem, too, so I end up having to hboot a lot. :(

I didn't know that the 5.22 drivers worked well! I'm going to use those now. :)
DGR
02-27-2001, 10:18 AM
Damn, this really freaks me out... why does it seem to work for me but not for anyone else?

Could it be the Driverstudio version of softice, else... no clue.
roocoon
02-28-2001, 04:45 AM
I've DriverStudio 2.0 installed and the Softice problem comes and goes.
The driver version (at least the newer ones) don't make much of a difference.
Reinstalling Softice after updating the drivers, helps initially until I run some graphics intensive program (usually protected ones in case they cause the problem (?)).
One thing you might try instead of switching drivers just to run Softice: go the driver's Properties and bring down the hardware acceleration level until Softice works, usually at level 1 or 2.
miscreant
03-31-2001, 01:07 PM
Could someone with Numega Driverstudio 2 please upload their NTICE.SYS file somewhere (probably in System32 dir, do a search) and give us a link, it may help those of us without driverstudio 2 if we overwrite our current one.
miscreant
04-01-2001, 11:15 AM
Hi all,
Well someone was kind enough to send me DriverStudio 2, and its fixed my softice problem.

Win2k + Nvdia Geforce 2 64mb GTS on 11.01 detonator + Sice Driverstudio 2.0.0 build 526

All works fine.

Miscreant.
roocoon
04-19-2001, 02:04 PM
As of now it works fine.
TNT2 Ultra, Detonators 12.0, Win2K-SP1, DriverStudio 2.0.1 (1280x1024x32).
The previous DriverStudio 2.0 would work randomly with any drivers up to 12.00.
The 2.0.1 beta wouldn't install all components.
So, I removed the previous NVidia driver and manually cleaned up the settings from the registry, booted up in VGA and installed the new drivers.
I tried to install 2.0.1 final, but it also wouldn't install all components.
I manually cleaned up the DriverStudio 2.0 (files and registry) and rebooted.
This time 2.0.1 installed properly and as of now it works fine.
The SIWVID start-up message started showing up after the aborted DriverStudio 2.0.1 partial installations.
That was because of the incomplete installation.
The SIWVID in question was still in a Temp directory under \Documents and Settings.
I got rid of it when I cleaned up the old DriverStudio and after reinstalling, it ended up where it was supposed to be.
As for problems with the drivers (12.00) I started getting some occasional waving of the screen soon as I installed them (but not with 11.01). It lasts about 10 seconds and goes away for hours. Looks like there's a frequency stability problem somewhere. I run them at 85Hz. The monitor could go higher but the drivers don't, without patching.


Frogsice problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Frogsice problem
PDA

View Full Version : Frogsice problem

LaptoniC
02-25-2001, 10:34 AM
I am trying to crack Asprotected program.Whenever I choose Aspack/Asprotect option in Frogsice windows crashes and gives this error
A fatal exception 05 has occured at 0028:DB9C64C3 in VXD BTPCIAUD(01) + 000043C3.The current application will be terminated

BTPCIAUD.VXD is comes from my Tv card which has Bt878 chipset.However Icedump patches "Code 07" trick without any error.
Any help will be appreciated.


SoftIce clears my breakpoints!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce clears my breakpoints!
PDA

View Full Version : SoftIce clears my breakpoints!

me (very original, isn't it?
02-25-2001, 11:28 AM
Ok, first I ran the program i was reverse engineering. SoftIce didn't break into the WinMain procedure, so I put a bpx CreateWindowExA just to get in somewhere. Then, I made a few breakpoints inside the code, disabled the CreateWindowExA breakpoint, and closed the app.

When I started the program again, it didn't break anywhere. So I typed bl into softice, just to see that all my breakpoints (except the CreateWindowExA) were gone. I did the same thing with another program, and the breakpoints didn't disappear. So judging from that, I would say there's something going on in the program I'm working with.

Could this be some kind of anti-sice code, or is it happening just because of my stupidity?
The app is WebFerret from www.ferretsoft.com, and I'm trying to remove the advertisements thing from it...
Cast
02-25-2001, 12:37 PM
Maybe you did a bc * to remove breakpoints? in that case you removed all breakpoints, i dont think a program can gain control of sice and disable breakpoints, nor did it occur to me while looking at webferret.

Regards,
Cast
Bratcher
02-25-2001, 02:02 PM
me (very original, isn't it?) (02-25-2001 01:28):
Ok, first I ran the program i was reverse engineering. SoftIce didn't break into the WinMain procedure, so I put a bpx CreateWindowExA just to get in somewhere. Then, I made a few breakpoints inside the code, disabled the CreateWindowExA breakpoint, and closed the app.

When I started the program again, it didn't break anywhere. So I typed bl into softice, just to see that all my breakpoints (except the CreateWindowExA) were gone. I did the same thing with another program, and the breakpoints didn't disappear. So judging from that, I would say there's something going on in the program I'm working with.

Could this be some kind of anti-sice code, or is it happening just because of my stupidity?
The app is WebFerret from www.ferretsoft.com, and I'm trying to remove the advertisements thing from it...

Hi Me.
First of all the nickname you are using is MINE. Me (Copyright).
The behavior you are seeing in your program does not come from antiSice code. About half of the programs I have Siced (traced with SoftIce), the Break points disapear when the program closes. Some other programs (the lucky ones, for us) the Breakpoints remain active and work, at least temporarily, when you re-run the program. the explanation lies in the way the operating system maps the memory for the program, I think. What I have done with this problem is:
1 avoid closing the program
2 set a BP in getversion an then using the history feature of Sice re-set all the breakpoints I need
G-RoM
02-25-2001, 04:55 PM
Bratcher : before posting bullshit, please consider knowing what u are talking about. BPs are only removed when u BC them... otherwise they may not work coz they are segment related, hence if ur app start with new segments, ur bp won't apply. Magic disappearance on program death, luck ? Why not trying to explain it with a virus of a special kind ? :)

So check BP list and see if segment match, if not, u know what's the problem.

As a more general note, would u mind people start to think before posting ? What's the purpose to post "fake" informations or half fucking guessed one ? This is pathetic and u help nobody. Even worse, u can risk to be laughed at.

Cheers,
Bratcher
02-25-2001, 11:26 PM
G-RoM (02-25-2001 06:55):
Bratcher : before posting bullshit, please consider knowing what u are talking about. BPs are only removed when u BC them... otherwise they may not work coz they are segment related, hence if ur app start with new segments, ur bp won't apply. Magic disappearance on program death, luck ? Why not trying to explain it with a virus of a special kind ? :)

So check BP list and see if segment match, if not, u know what's the problem.

As a more general note, would u mind people start to think before posting ? What's the purpose to post "fake" informations or half fucking guessed one ? This is pathetic and u help nobody. Even worse, u can risk to be laughed at.

Cheers,

Your unpolite posting was quite uncalled for.
I did not claimed to know all the answers, as you seem to know, I was plainly sharing what I have experienced. Please read above. I have observed that the BP disapear with some apps and remain in others. And I guessed, and clearly stated so, it had something to do with memory handling by the OS. I stated that it was unlikely to be due to antiSice code because way too many apps have such behavior.
I am certainly glad that there are experts, with more in depth knowledge, like you, that would provide a more complete explanation. Please do not take it on me. I was sharing my experience, not giving court sworn expert dictamination. If I bothered you or the original poster, I apologize.
G-RoM
02-26-2001, 06:16 AM
I don't think my post was unpolite, but harsh and sarcastic most probably (i am a very sarcastic person). Unfortunatly for you, I got fed up to see posts that claims stuff which aren't exact at all (and sometimes by people who call themselves "expert" !!). I don't call myself an expert and don't want to be called like this. However I really think that posting guess, half understood things aren't a good thing (lack of knowledge is better than knowing a false thing). Indeed last part of ur answer is quite exact for a guess BUT first part of ur answer tend to bring a false idea (BP disappears after app terminated), hence my reply to ur post. Well at least u seems to be a reasonable person, don't take it too bad :).

Clearly a BP can be rendered inapplicable for a couple of reasons, but in no way can disappear from SICE list by itself.

Speaking about antisice... only way to remove a BP from list would be to issue BC command using SICE backdoors command (via int 3) but it is unlikely to happen here.

Cheers,
Solomon
03-01-2001, 03:22 AM
I have encountered such problems many times.
The breakpoints disappeared when the program exited though I didn't typing any "BC" command in SoftICE.

regards
G-RoM
03-01-2001, 08:12 AM
Mr Arthaxerxes :

I spoke about SOFTICE internal list of BP... not about currently system applied bp which u can disable, or fuckup using a bunch of methods (r3, r0). Another way would be that u code a kmd/vxd (or using a r0 hack) to issue the remove BP command directly to SICE code (needs some RE :).

There is a difference between breakpoints list known by SICE (BL result) and breakpoints lists really effective on system (hwbp and softbp).

I resend u ur remarks since u are everything except precise. Speaking of oil on fire... I think urs started to burn :)... coz i remember ur statement about hwbp from ntuser mode... which were false :).

Cheers,
Xybyre
03-01-2001, 10:07 AM
It seems to me that SoftICE is removing your breakpoints because it does not think you are placing them within a code section. This is probably because the PE header is telling SoftICE that the section is C0000040, which means it is initialized data. You can use a PE editor and change it to E0000020 which indicates executable code.

This is common with packed programs. It would also explain why the loader wouldn't break at the first line of code.
Bratcher
03-01-2001, 04:50 PM
I am going to re-state my previous posting. in a way that G-ROM may find less objectionable. MY intent was and still is share what I have experienced and give some solution to the problem me (original isn't it) was having. from all the postings around this, I think I did the most sincere effort to fulfill the original intent of the board: Help Others.

Hi Me.
First of all the nickname you are using is MINE. Me (Copyright).
The behavior you are seeing in your program does not come from antiSice code. (I THINK IS UNLIKELY)
About half of the programs (OBSERVED FACT) I have Siced (traced with SoftIce), the Break points
disapear (DISAPEAR IN THE SENSE "STOP BEING EFFECTIVE". THE BRAKPOINTS REMAIN IN THE SICE LIST, BUT THE SELECTOR CHANGES TO 0001:. . . SO THEY DO NOT POINT TO THE ADDRESS IN THE ORIGINAL CODE, AND DO NOT BREAK. THIS APPLY ONLY TO BP SET TO THE CODE, THE DATA OR THE DLLS SPECIFIC TO THE PROGRAM IN THE LOWER 2 GB OF MEMORY SPACE. THE BP SET TO THE EXECUTIVE FILES OF THE OPERATING SYSTEM REMAIN ACTIVE DESPITE CLOSING THE APPLICATIONS) when the program closes.

Some other programs (the lucky ones, for
us) the Breakpoints remain active and work, at least temporarily, when you
re-run the program . the explanation lies in the way the operating system maps
the memory for the program (WHEN THE CODE AND DATA OF THE PROGRAM RESIDES IN MEMORY MAPPED FILES SICE WILL UPDATE THE SELECTOR OF THE BP AND THEY WILL WORK AGAIN IF THE APP IS RELOADED) , I think. What I have done with this problem is( i PROVIDED SOME SOLUTIONS THAT HAVE WORKED FOR ME):
1 avoid closing the program
2 set a BP in getversion ( BECAUSE IT ALMOST ALWAYS BREAKS AT THE BEGINING OF AN APPLICATION) an then, using the history feature of Sice re-set all the
breakpoints I need (BECAUSE THEN THE CS AND THE DS WILL BE POINTING TO THE CORRECT SELECTORS NEEDED FOR THE BREAKPOINTS TO START WORKING AGAIN)

The upper case was used to highlight the new added comments, not in the form of screaming.
Iceman
03-02-2001, 11:34 AM
Well , this wasnt a bad post after all , it was much better than your first one. With a single point , flat images are always memory mapped under "Win32" , so it's not a question of how the image is mapped or loaded in memory.
And for the sake of this thread , lemme know guys, are we speaking here about NTICE , Winice or both? It might be important to get a clue on it.
Also , can you give an example of a program which do work and one if which does not ?
Bratscher
03-02-2001, 01:41 PM
First, I would like to say that I have nothing personal against you. As you expressed in another thread, I do not know you. I can only go by your nickname and your postings when they happened to coincide, and I may debate some of your opinions. I have full respect for your kowledge, and I have derived quite a lot of benefit from your postings. I thing we agree on a lot of things, except the fundamental.
Regarding the specifics of this thread, My comments pertain only to winIce. I have not had a lot of experience with NTice, so I do not know if what I said pertains to the NT /WIN2000 environment.
The examples you requested may be the following:
1:
NotePad. if you place BP inside Notepad, and then quit the program, the selectors go to 0001: xxxxxxx. If you reload notepad, the selctors update and the BP will work again.

2: SigmaPlot2000: Happened to be a file I was tracing when I read your posting.
If you quit the program, and then reload, the BPs stop working.


Looking for FlexLM SDK v5.12 (I have another versions)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Looking for FlexLM SDK v5.12 (I have another versions)
PDA

View Full Version : Looking for FlexLM SDK v5.12 (I have another versions)

skew
02-25-2001, 08:46 PM
I'm looking for FlexLM SDK v5.12

I have v5.12b, but I need another version of v5.12 SDK.

I have a lot of SDK.
If you want, I'll give you.

thanks.

here is SDK list I have.
v5.12b, v6.1c, v6.1g, v7.0c, v7.0e, v7.0g, v6.1f, v6.0k
v7.0a, v7.0d, v7.0f, v7.2a


IDA404 vs IDAfree4.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA404 vs IDAfree4.1
PDA

View Full Version : IDA404 vs IDAfree4.1

mariop
02-25-2001, 09:43 PM
Are there any significant differences? I have 404 and am wondering if I should grab the other from datarescue's site.
carpathia
02-25-2001, 10:23 PM
http://www.datarescue.com/idabase/idanew.htm

Please try to do even just a *little* research on your own ;-)

Regards

Carpathia
mariop
02-25-2001, 10:51 PM
Hmmm! Seems you don't want to answer my question but are inclined to offer unsolicited advise. The page you refer me to has no info on IDAFree 4.1. So, my question still stands: What is the difference between IDAfree 4.1 (not the Demo), (not the Commercial version) and IDAPro404?
The Owl
02-26-2001, 04:38 AM
Hmmm! Seems you don't want to answer my question but are inclined to offer
unsolicited advise. The page you refer me to has no info on IDAFree 4.1. So, my
question still stands: What is the difference between IDAfree 4.1 (not the
Demo), (not the Commercial version) and IDAPro404?

i think you are being agressive (unsolicited too ;P), carpathia told you exactly
what the differences were but left some details to work out for you. namely, to
THINK a bit and make some logical conclusions.

quote from the datarescue home page:

"We have released a freeware version of IDA Pro 3.85B"

and since this was the last version before the 4.x series, the page he referred you
to has what you asked for.
Kilby!
02-26-2001, 04:40 AM
I think the suggestion is that if you download it, and try it you will find out.

The messageboard is here to help when you get stuck or require inspiration, not to do the job for you.

Kilby...


IdaG
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IdaG
PDA

View Full Version : IdaG

StarShock
02-26-2001, 02:31 PM
Maybe this has already been answered, but why doesn't Ida seem to be able to search for binary strings... If I open up the EXE in a hex editor, it works fine, but I've only been able to make Ida find TEXT strings, not binary strings (written in hex).
The Owl
02-27-2001, 04:09 AM
doh, why can i not post w/o a message? ;P


Icedump install
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Icedump install
PDA

View Full Version : Icedump install

__DuDu__
02-27-2001, 03:05 PM
im using the right icedump.exe why this happen ? how to install ? why this happen ?

icedump v6.0.2.2 for winice v4.05 build 334 loader
icedump was not loaded yet
VXDLDR failed to load icedump
__DuDu__
02-27-2001, 05:53 PM
sorry for my stupdness, i just restarted my pc and it worked
The Owl
02-28-2001, 03:25 AM
sorry for my stupdness, i just restarted my pc and it worked

humm, then it should have worked for the first time as well... next time you
experience it, you could break into winice and see if icedump printed some
extra messages there. also you could tell me what is your OS version, maybe
it's already known to have probs (like old win95 versions including OSR2 do).


Erratic mouse movement in SIce 4.05
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Erratic mouse movement in SIce 4.05
PDA

View Full Version : Erratic mouse movement in SIce 4.05

cabby
02-28-2001, 03:52 AM
Cannot read posts originated by Mr. Smith.
I keep getting "posts could not be found".
I am having a similar problem with Win98 SE, SoftIce 4.05 and an AOpen PS/2 mouse.
Sure would like to be able to read them.
cabby
02-28-2001, 04:21 AM
ArthaXerXes (02-27-2001 18:12):
I fixed the problem in disabling mouse support. :-)

Have you tried to reset the mouse several time (I believe it is CTRL-M) ?

Yes, I've tried CTRL-M numerous times and have re-installed mouse drivers but to no avail. I'm just about to disable mouse myself.
oskip
03-01-2001, 09:00 AM
I have the Aopen model MOSXX mouse and had the same problem.
In the Mouse Setup menu, I had to select
PS/2 compatible and Microsoft Intellimouse,
and now it works fine.

Regards
oskip


IDA Pro 4.15...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA Pro 4.15...
PDA

View Full Version : IDA Pro 4.15...

Snatch
03-01-2001, 08:23 PM
Where? What? When? How? Why?

Heh I think its obvious what I'm very um subtly asking ;). Questions are in order of priority. Thanks.

Snatch
Solomon
03-01-2001, 08:49 PM
I know there is cracked demo of v4.15.
This demo can only disassemble PE files. But it's really good.

------------------------------------------------------------------
IDA Pro v4.15 Cracked READ NFO
(c) Data Rescue
Supplier.:[ Team DiSTiNCT ][ 02/25/2001 ]:.Date
Cracker..:[ Team DiSTiNCT ][ Utility ]:.Type
Tester...:[ Team DiSTiNCT ] [ 05 x 2.88 mb ]:.Size
Packager.:[ Team DiSTiNCT ] [ WinAll ]:...OS

*NOTE*
This crack will chnage the demo into a FULLY working version.

Some of the things our crack restablish...

-Time limit
-Not possible to save/load projects
-Not possible to produce asm/lst
-Mot possible to upgrade projects from older versions
stinkf
03-02-2001, 02:33 AM
I haven't tested that one yet but I noticed that DiSTiNCT released a fix for it yesterday.

IDA.Pro.v4.15.FIX.Crack.Only.WinAll-DiSTiNCT
Carpathia
03-02-2001, 04:56 AM
Firstly, this is nothing more than a common warez request. Why is this tolerated when a request for, lets say, a full copy of some cd burning software is flamed?

Secondly, after already speaking to you Snatch, its clear you *really* do not need 4.15. You werent even aware that scripts and plugins were a feature of IDA ;-)
I'm sick of this 'must upgrade for no real reason ' mentality.

Do us a favour and get what I told you on IRC. Get the free version of IDA from datarescue, get spaths autoparam naming script. Its really that simple.

Carpathia
Snatch
03-02-2001, 09:25 PM
Well if you would like to claim I was not aware of the scripts and plugins then go right ahead because it is not true. You should read the logs of how you guys act in there sometimes. It is not clear that people in #c4n understand their own behavior. Anyway you always try to treat me like a newbie so I will act like one. People try to fit their respective "roles" as you probably already know. Anyway you are right in one respect, my "upgradeitis" is not necessary. I really would like to have automatic parameter identification though as you said there is a script to do this, I trust more the real IDA. I will inevitably buy IDA when I save enough money but for now I must resort to this. And why should IDA be discussed? It is a Tool of our Trade is it not? It is not like asking for a CD burning program that is not a Tool of our Trade. Our Trade IS cracking. Just a few thoughts.

Snatch
aaa
03-03-2001, 05:48 AM
where can this autoparam naming script be found?
The Owl
03-03-2001, 07:02 AM
it used to be on frog's print's site which seems to be defunct at the moment, let's hope i managed to upload it with this post. if spath has a newer version than this, i'm sure he'll let you know.
aaa
03-03-2001, 08:02 AM
many thanks for taking the time to help me out.
i really appreciate it.
_Snatch
03-04-2001, 04:07 PM
The Owl (03-02-2001 21:06):
it used to be on frog's print's site which seems to be defunct at the moment, let's hope i managed to upload it with this post. if spath has a newer version than this, i'm sure he'll let you know.

Thanks a lot. Even if this is not 4.15 its definetly good enough for my purposes :).
b00m
03-04-2001, 04:58 PM
Carpathia. Gawd. You think you know everything. You think you are cool. You think you can treat everyone like shit (excluding the 'elite' crackers). Well guess what. Maybe he wanted to upgrade because it was more stable. Maybe it is faster. Like you would know. You sit on your ass and think you are cool. Ideling on irc.. saying you did this.. your going to do this... when half the stuff you don't even know what the fuck you are talking about. You think you know ida like the back of your hand, because you read some tutorials or you like it cause everyone else likes it. You lie to yourself saying to buy ida when you know you have a warez'ed copy. You act like you bought it. You say that warez is bad, because some loser started saying that you should buy ida. Well guess what, Carpathia, in my world. You are not considered elite. You are not considered a cracker, nor a reverser, and especially not a coder. I actually belive you stole some of that code for your disassembler. I think you are just a slob that sits on your computer with a girlly name and laffs with friends in irc and you are called elite. Some of you guys are like WOW, you are talking to Carpathia like this?? Hell yes I am. You guys should pay attention to these assholes that call themself elite these days. Wow! Carpathia, your a op in c4n! Wow! Your cool!

Gawd Gawd Gawd.
carpathia
03-04-2001, 07:49 PM
Hi B00m.

> Firstly, Carpathia. Gawd. You think you know everything. You think you are cool.
> You think you can treat everyone like shit (excluding the 'elite' crackers).

Oh, who do I treat like shit? My reply to Snatch is the first abusive (and I doubt you can even call it that) post I can recall making in a long time. And I dont have a problem with snatch personally, I attacked his actions if you care to read my post with a little more care.

On another note, FYI, I dont have a problem with warez. I can quite happily admitting to using them. I dont feel good about using them, but I use them all the same.

My problem with Snatch's post was not that he was using warez. He can have the whole of cores releases on his HD and I couldnt care less. Its the fact he's making, on a tools board, a time wasting post which could easily have been avoided. He knows how to use the web, and just about every remotely related cracking site links to protools now. I can only assume he made the post because he just couldnt be arsed searching. Well sue me, but I dont much feel like helping people like that.

> Well guess what. Maybe he wanted to upgrade because it was more stable. Maybe
> it is faster. Like you would know.

Actually, I would know because I spoke to Snatch on IRC before he made the post. Like I said, it was clear he didnt know why he wanted the latest version, other than because it was more recent. The main attraction to him was the auto param naming, which Spaths script will supply, with the free version. Wheres the problem in that ?

> You think you know ida like the back of your hand, because you read some tutorials or you like it cause
> everyone else likes it.

As it happens, I know IDA pretty well, and I like it, yes. I like it because it makes my life a lot easier.
But, you accuse me of liking it because everyone else does. Forgive me if I dont see *ANY* logic in your accusation whatsoever. Have you ever considered it might be liked by a lot of people because its a very powerful tool ? Does *everyone* like it just cos everyone else does, or am I the only one ?

> You lie to yourself saying to buy ida when you know you have a warez'ed copy.

Wrong again. I dont claim to be intending to buy IDA Pro. Nor have I ever claimed to be a legally registered user.

> You say that warez is bad, because some loser started saying that you should buy IDA.

Again, you're basing your post on a bunch of stuff you really plucked out your head in a fit of anger, with no real factual basis. If you'd like to post any occasion where Ive categorically stated warez are bad, I'd be much appreciated. Theres a time and place for warez, and yes, Ive already pointed out I use them where necessary. They're also very easily locatable on the web, for anyone who spends a mere 5 minutes of their own time looking, instead of wasting 100+ readers times by requesting it somewhere else. Its this that annoyed me.

(sadly, this is continued ...)
carpathia
03-04-2001, 07:50 PM
> Carpathia, in my world. You are not considered elite.

No. I dont consider myself 'elite' either. I'm capable of asking (and often do ask) stupid questions just like anyone else does. I do however, pay them the common respect to spend time attempting to solve a problem myself, before I waste peoples time asking something that I could have found out myself, with a little time researching.

> You are not considered a cracker, nor a reverser, and especially not a coder.

Fair enough. You're entitled to your own opinion. I cant, nor am I even interested in making a statement about you. I clearly do not know you, but nor do I believe you really know me in any way, shape, or form.

> I actually believe you stole some of that code for your disassembler.

Now this would be actually amusing if you didnt sound so serious. Tell me, where is the basis for this accusation ? Or was it, god forbid, merely another statement intended to antagonise me? The answer is No. None of the code is stolen, copied, theived etc ect. It's 100% written by myself, and myself alone. There are still bugs which exist in the pda tool I released, thats why its a "BETA". If I was even to stoop so low as to use someone elses code without crediting them, would I really choose to thieve someone elses buggy code ? ;-)

The disassembler is based on the 68k chip definition file which you can find anywhere on the net, and this is a mere text file which openly sits in the same directory as the exe. Is that plagiarism ? jesus, do me a favour.

> I think you are just a slob that sits on your computer with a girlly name and laffs with friends
> in irc and you are called elite.

You notice how its at this point where your post kinda falls apart. You start becoming abusive because youre running out of mindless dross to say. Can you compose yourself, and grow up a little?

> Some of you guys are like WOW, you are talking to Carpathia like this?? Hell yes I am.

So you're flaming me, big deal! I dont have a problem with that. Theres no reason why I shouldnt be flamed if you feel you need to. However, this seems more like a troll to me. Youve been firing off a whole load of accusations with no real basis.

Additionally, you're speaking to me as if I have this huge insatiable ego, and that I'll be horrified to see someone who is clearly not a fan shouting out on a forum about how bad and lousy and lame I am. (oh yeah, and how Im a fat lazy slob). This is more likely to make me chuckle, than waste my time worrying about how Im percieved in your 'world' as you put it.

All I can say is, ask anyone who actually knows me, and you'll find you really couldnt be wider off the mark.
At the end of the day, just like everyone else. I wake up and go to work. I sometimes miss the bus. I sometimes burn my toast. Im just a guy behind a keyboard, passing my time as a hobby, and participating in a community (a community, incidentally, which is being degraded and falling apart lately, thanks to people who jump into it, dont bother following common courtesy, and think that the forum ettiquette apples to everyone but themselves). If you think that by me taking part in this, equates to me claiming Im elite, well, Id say you have a few fundamental problems in understanding the basic laws of society.

Why not try to follow an old motto, of looking before you shoot ?

Carpathia
FCU \ tsylana eht
03-05-2001, 08:17 AM
b00m (03-04-2001 14:58):
Carpathia. Gawd. You think you know everything. You think you are cool. You think you can treat everyone like shit (excluding the 'elite' crackers). Well guess what. Maybe he wanted to upgrade because it was more stable. Maybe it is faster. Like you would know. You sit on your ass and think you are cool. Ideling on irc.. saying you did this.. your going to do this... when half the stuff you don't even know what the fuck you are talking about. You think you know ida like the back of your hand, because you read some tutorials or you like it cause everyone else likes it. You lie to yourself saying to buy ida when you know you have a warez'ed copy. You act like you bought it. You say that warez is bad, because some loser started saying that you should buy ida. Well guess what, Carpathia, in my world. You are not considered elite. You are not considered a cracker, nor a reverser, and especially not a coder. I actually belive you stole some of that code for your disassembler. I think you are just a slob that sits on your computer with a girlly name and laffs with friends in irc and you are called elite. Some of you guys are like WOW, you are talking to Carpathia like this?? Hell yes I am. You guys should pay attention to these assholes that call themself elite these days. Wow! Carpathia, your a op in c4n! Wow! Your cool!

Gawd Gawd Gawd.

hello,

well, i just saw that message, and i got something to say...
knowing Carpathia quite good, i would say, that he is nothing, but an alcoholic.
heh j/k carp..
Seriously, i used to talk with carpathia, bugging him coz i had some problems, in coding generally..
OR even some OS related Questions..
Carpathia took HIS OWN time to help me, and i think that was very nice.
ok, this said, i wonder why the fuck, b00m talk bollocks like this...
actually, judging someone without even knowning him, is jut a stupid kiddies act ..
free flame.. wtf is wrong with that kid..
i NEVER seen carpathia bragging, i never seen him calling himself an elite..
i only saw him helping newbies, helping friends whenever u need help..
he helped me as i said above, even at 3am..
coding some shits..
so b00m , u mofo, u better stfu and stop those kind of FREE , yet LAME acusation..
who the fuck are you to threat him like a stealer, who the fuck are you to say what he knows, what he doesn't..
IMHO, you seem a bit jealous..
are you jealous coz he is op in c4n ?
are you jealous coz he is cooler than you ?
are you jealous coz he code a very nice disasm ?
again, who the fuck are you to know what he thinks ?
u used to say : 'u think that, u think ... blabla what ever'

lemme give yu a lil advice, instead of trying to break some person, in public, just think before..
ur post make you nothing but stupid, looking like a 13 years old jealous mofo..

what about doing homeworks instead of loosing time ?

FCU \ tsylana eht

- drunk, and angry

ps: aren't u the b00m who iddle the whole days on irc ?...

to the readers, take care.
booyah
03-05-2001, 03:50 PM
hahahaha!!

very well said FCU \ tsylana eht. I totally agree with you, I am not in #c4n under this name, but under another. I too, see Carp helping friends/newbies, ect. Carp does not act like he is elite, he defently is not a slob that sits around on his computer.. ahahah.. making me laugh, b00m.

by the way. are you the b00m from DiSTiNCT ??
CrackZ
03-06-2001, 05:42 PM
Greetings to the posters on this thread;

When the insults fly, you tend to find out who your real friends really are.

On that note, I'll add my support to Carpathia here, since I know him personally and know that the allegations levelled at him are either complete fantasy or grossly inaccurate. I really wish this personal flaming and trolling would stop on all these messageboards, is it really necessary?.

On the subject of the original flame to Snatch, well I've just reviewed the actual IRC log and without posting the details, I think Carpathia's mild irritation (I think it fair to call it that) is probably justified.

Theres a great lesson here, and Iceman for all his posts probably said it too, "don't post on subjects you know nothing about", it doesn't further the thread or the good of the community (which is after all what this is supposed to be).

Regards

CrackZ.


first step with icedump...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > first step with icedump...
PDA

View Full Version : first step with icedump...

mustapha
03-02-2001, 07:37 PM
Hi to all,
I prefer to say, how to install/use Icedump?
Thanks

Saludos
Mustapha
The Owl
03-03-2001, 05:29 AM
1. installation: quote from w9x/doc/icedump6.txt

------
usage.
------

first of all, you have to run icedump.exe from the directory corresponding
to your winice version to load the dynamic VxD (it's a self-loading VxD
before you start to look for a separate *.vxd file ;-). if the VxD cannot
find winice or recognize its version, it will simply not load, no harm
will be done.

2. (real) usage: quote from file_id.diz:

- Implemented as internal Winice/NTice
commands:

ie. you issue the icedump commands at the winice prompt, just like any regular
winice command.
mustapha
03-03-2001, 07:22 AM
Yes,
"icedump v6.0.2.2 for winice v4.05 build 526 loader
icedump was not loaded yet VXDLDR failed to load icedump"

I am using: "SoftICE 4.05 (Windows 95 / Windows 98.)
(C) Copyright 1999 Compuware Corp. All rights reserved.
"
The Owl
03-03-2001, 09:37 AM
"icedump v6.0.2.2 for winice v4.05 build 526 loader
icedump was not loaded yet VXDLDR failed to load icedump"

I am using: "SoftICE 4.05 (Windows 95 / Windows 98.)
(C) Copyright 1999 Compuware Corp. All rights reserved.
"

which build of 4.05? numega stopped increasing the version number for
some time now, only the build number makes the difference. the 'ver'
command should tell you what you have, then choose the appropriate
iceload.exe. if you still get the same issue, then make sure you load
kernel32 exports via winice.dat. and if this didn't help, we'll have to
do some debugging.
Mustapha
03-03-2001, 06:10 PM
All right, The problem was the build number.
Icedump impressed me. Goog program

Saludos
Muastapha


how to download ExDec?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > how to download ExDec?
PDA

View Full Version : how to download ExDec?

trap
03-02-2001, 08:09 PM
how to download ExDec? (Visual basic p-code decompiler)
carpathia
03-03-2001, 03:14 PM
The latest public release is always available at

http://members.xoom.com/c4n4ever/.space/c4nexdec.zip

Regards

Carpathia
Solomon
03-04-2001, 02:02 AM
Is there any documentation available for the pseudo instructions produced by ExDec? Can't understand these though some of them can be guessed.
breakfast
03-18-2001, 08:37 AM
Man... you woun't get far with ExDec. I don't mean JosephCo's isn't good (it's really good). But for cracking purposes... Well anyway. There should be like a tutorial for cracking WarezPup's CrackMe 3 with it and it explains it a little.
Eternal Bliss
03-20-2001, 08:22 AM
Hiya,
think there are a few tutorials written using ExDec. JoesphCo is great and so is his program. 8)
Check out ebliss.cjb.net and see if you know what I mean.

Regards
EB
?ferret
03-21-2001, 06:38 PM
breakfast (03-18-2001 06:37):
Man... you woun't get far with ExDec. I don't mean JosephCo's isn't good (it's really good). But for cracking purposes....

ExDec rocks for P-Code. After you get a feel for it and play with it awhile, you may get new ideas on better ways to find what you need and break on it in Sice.....

Note: the symbol files (.nms) for the VB runtime libs make transferring your discoveries from ExDec to SoftIce a lot easier ;-)


/tracex command problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > /tracex command problems
PDA

View Full Version : /tracex command problems

esther
03-03-2001, 07:13 AM
Hi there :),

Its about this command /tracex <low eip>
erm I'm stupid, :-D, whats does <low
eip> refers to?
Could any one explain it more precise how to use this?

thanks
Best Regards
esther
The Owl
03-03-2001, 11:24 AM
1. did you check w9x/doc/icedump6.txt?

2. simple experiment: load a win32 app into winice, choose an instruction down
from the entry point, then issue /tracex your_chosen_instruction_address.
this will exit winice and soon pop it up again as the tracer has reached your
selected target EIP. the name <low EIP> is a bit of a misnomer (my idea was
to keep it in synch with the other invocation format, if you look at the actual
implementation, you will see why), just think of it as an address where you want
the tracer to pop up winice (provided that address is ever reached of course).
this form of invocation should normally be used when you want to land at a very
specific address that you know will be reached (e.g. you already know the OEP
but for some reason you cannot use other BPs to break there).
Kayaker
03-03-2001, 01:05 PM
Hi Esther,

Low/High EIP refers to the Virtual Address range you want /Tracex to monitor. Normally you're interested in the .CODE section, so if a PE Editor shows that the first section is from 401000 to 409000, then the syntax would be
/Tracex 401000 409000

One of the message entries in the command window after /Tracex breaks will be (I think) CS:EIP. This tells you where you broke into this thread FROM. Handy for example if you break into program code from unpacking code because this will often tell you where the OEP is reached in unpacking code and where to dump it.

Hope this helps.

Regards,
Kayaker
esther
03-04-2001, 09:26 AM
Kayaker (03-03-2001 03:05):
Hi Esther,

Low/High EIP refers to the Virtual Address range you want /Tracex to monitor. Normally you're interested in the .CODE section, so if a PE Editor shows that the first section is from 401000 to 409000, then the syntax would be
/Tracex 401000 409000

One of the message entries in the command window after /Tracex breaks will be (I think) CS:EIP. This tells you where you broke into this thread FROM. Handy for example if you break into program code from unpacking code because this will often tell you where the OEP is reached in unpacking code and where to dump it.

Hope this helps.

Regards,
Kayaker

Hi The Owl,Kayaker,

it doesn't work for me when using the latest
version of icedump.Probably not the os problem I have test in win95 and 98.it crashes :-( .

Thanks for all the help.
Kind Regards
esther
The Owl
03-04-2001, 09:37 AM
it crashes :-( .

can you be a bit more descriptive, like what you did exactly that ended in a crash?
esther
03-04-2001, 10:15 AM
The Owl (03-04-2001 07:37):

it crashes :-( .

can you be a bit more descriptive, like what you did exactly that ended in a crash?

Hi The Owl,
its not problem of icedump either,could be sice problem.I'll install sice 4 .the prob seems that latest version of icedump is not compatiable with sice version 3.23.R0TCB error not fast enough blah blah... hangs
my win95 or 98 :'(
Could be my systems too
pentium 233mmmx
ram=32mb

laterz
regards
esther
esther
03-04-2001, 10:15 AM
The Owl (03-04-2001 07:37):

it crashes :-( .

can you be a bit more descriptive, like what you did exactly that ended in a crash?

Hi The Owl,
its not problem of icedump either,could be sice problem.I'll install sice 4 .the prob seems that latest version of icedump is not compatiable with sice version 3.23.R0TCB error not fast enough blah blah... hangs
my win95 or 98 :'(
Could be my systems too
pentium 233mmmx
ram=32mb

laterz
regards
esther
The Owl
03-04-2001, 10:32 AM
the prob seems that latest version of icedump is not compatiable with sice version 3.23.R0TCB error not fast enough blah blah... hangs
my win95 or 98 :'(

uhm, don't rush with that installation ;-). icedump should work will at those
version that it exists for, that specific message you quoted is not an error,
merely a warning that happens on older win95 versions, but it should not crash.
so my question is: when does icedump crash (and where, if you can determine
it)?
esther
03-05-2001, 08:58 AM
The Owl (03-04-2001 08:32):

the prob seems that latest version of icedump is not compatiable with sice version 3.23.R0TCB error not fast enough blah blah... hangs
my win95 or 98 :'(

uhm, don't rush with that installation ;-). icedump should work will at those
version that it exists for, that specific message you quoted is not an error,
merely a warning that happens on older win95 versions, but it should not crash.
so my question is: when does icedump crash (and where, if you can determine
it)?

Hi The Owl,
I have tested on my two harddisk with 95 and 98
the first thing I do is load in autoexec.bat.
winice loaded in the memory it shows

"Softice 3.23 win95 /98 beta 1-2"

I choose the dumper from 3.23 ,copy to the winice directory
and execute.
and it shows as follows windows "blue screen of death"
exception vxd error...
the dumper which I copied is dumper.exe.
I have copied the versions from 3.22 to 3.25 and tested
each. it gives me the error "vxdldr fail to load"???
Same it happen in win98.I don't understand
why it doesn't work even in win98 :(
I have a previous version of icedump which works well
version 6.0.1.8 for winice 3.23
Thanks for looking in

best regards
esther
The Owl
03-06-2001, 05:48 AM
I choose the dumper from 3.23 ,copy to the winice directory
and execute.

you can execute the proper icedump.exe from any directory, no need to copy it
where winice is (winice detection does not rely on winice.exe being present in the
current directory).

and it shows as follows windows "blue screen of death"
exception vxd error...

ok, this seems to be a known issue that the web page refers to as well as:

icedump: older win95 versions don't seem to like export renormalization

unfortunately i don't have access to win95 versions and can't debug the problem for now.

I have copied the versions from 3.22 to 3.25 and tested
each. it gives me the error "vxdldr fail to load"???

other versions will simply fail to load as they recognize that the current winice
you are running is not the one they were created for (plus the issue with renaming, see below).

Same it happen in win98.I don't understand
why it doesn't work even in win98 :(

this is because you renamed icedump.exe and the self-defense mechanism did not
let it carry out all the initialization it needed to do.
esther
03-06-2001, 09:39 AM
Same it happen in win98.I don't understand
why it doesn't work even in win98 :(

this is because you renamed icedump.exe and the self-defense mechanism did not
let it carry out all the initialization it needed to do.[/quote]

Hi The Owl,
Thanks for the trouble again :)
I didn't renamed the file to dump.exe .it
comes from the zip.Doh even I renamed it
to icedump it still doesn't work :(
I got no choice I installed sice 4.05 in
win98 and finally works.
win95 doesn't work even I installed version sice 4.05.

Icedump Team ,thanks for the hard work :)

Best Regards
esther
The Owl
03-06-2001, 01:21 PM
I didn't renamed the file to dump.exe .it
comes from the zip.

uhm, now what is it that you got in your icedump archive? dumper.exe or
dump.exe or icedump.exe? if it's not the latter, i'd certainly like to know where
you downloaded icedump from.

Doh even I renamed it to icedump it still doesn't work :(
I got no choice I installed sice 4.05 in win98 and finally works.
win95 doesn't work even I installed version sice 4.05.

i see. actually i can check out winice 3.2x and win98 myself, if i can reproduce
the problem here, i will fix it, but the win95 support will have to wait.
esther
03-07-2001, 10:47 AM
The Owl (03-06-2001 11:21):

I didn't renamed the file to dump.exe .it
comes from the zip.

uhm, now what is it that you got in your icedump archive? dumper.exe or
dump.exe or icedump.exe? if it's not the latter, i'd certainly like to know where
you downloaded icedump from.

Doh even I renamed it to icedump it still doesn't work :(
I got no choice I installed sice 4.05 in win98 and finally works.
win95 doesn't work even I installed version sice 4.05.

i see. actually i can check out winice 3.2x and win98 myself, if i can reproduce
the problem here, i will fix it, but the win95 support will have to wait.

Hi The Owl,
Sorry,I must apologise about renaming the file.I
did renamed a file but not sure which one
at that time.I have checked the zips,its icedump.exe.
Maybe I'm just too tired :(

Thanks again.

respects
esther


problems with softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > problems with softice
PDA

View Full Version : problems with softice

The Krystal
03-05-2001, 01:57 PM
lol i a real novice and i was tryin a crack me and softice tells me Symbol not defined (GetDlgItemTextA)

What can i do to fix it?

thx
Amante4
03-05-2001, 07:04 PM
Looks like you need to fix up your winice.dat file to
include the correct exports.

make sure these couple of lines are uncommented:
EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll

by uncommented, I mean no ; in front of them.
then save and reboot. That should help you out.

amante4

The Krystal (03-05-2001 11:57):
lol i a real novice and i was tryin a crack me and softice tells me Symbol not defined (GetDlgItemTextA)

What can i do to fix it?

thx
The Krystal
03-05-2001, 08:12 PM
thx so much i am such an idiot well thx again :)


...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ...
PDA

View Full Version : ...

_Snatch
03-05-2001, 06:16 PM
Well I actually agree with the previous 2 posts. Carp although the founder of Lamer Logs which insult newbies has done a lot of good as well. I can always manage to get some kind of response out of him. Oh well. He's just a human like me and everyone else, so I am sure he has made his fair share of mistakes. So we might as well leave him alone ;)

Snatch


a tool...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > a tool...
PDA

View Full Version : a tool...

Mustapha
03-05-2001, 07:16 PM
Hi to all,
I want to know if someone could give me the name of a tool that let know how many & names of files are installed when I install a program.
A kind of 'install_monitor', if it coukd remove all from my HD, would bo grate.

Thanks
Mustapha
hz
03-05-2001, 07:29 PM
hiya,

EasyClean was my favourite but I think its discontinued or changed to Ashampoo. Careful
if you "borrow" Ashampoo for a while, believe
its spyware.

regards


Where to start
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Where to start
PDA

View Full Version : Where to start

The Krystal
03-05-2001, 08:17 PM
So i have yet to find a good Tutorial/Crackme that really helps me out. If ne one can lead me in the direction of what they think is an excelent tutorial to start cracking please post a link.
Amante4
03-06-2001, 09:20 AM
You might consider starting at www.cracking4newbies.com.
It has some good text and FAQ's to read and
also provides links to places like +Sandmans
site where you can learn alot.

Regards,
Amante

The Krystal (03-05-2001 18:17):
So i have yet to find a good Tutorial/Crackme that really helps me out. If ne one can lead me in the direction of what they think is an excelent tutorial to start cracking please post a link.
Raven58
03-06-2001, 04:23 PM
Hi, I would try Krobars site. He has some excellent beginner tutorials that he authored himself. They are easy to follow and learn from.


install monitor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > install monitor
PDA

View Full Version : install monitor

Robtam
03-05-2001, 10:42 PM
don't know if this link will work or not ...anyway PcMagazine(free) search InCtrl5
Monitors everything that happens during install...Reg keys,files,etc...... won't
delete it,but atleast you know what to delete.....hope it helps....Robtam

http://chkpt.zdnet.com/chkpt/xlinkdownloads/http://hotfiles.zdnet.com/cgi-bin/texis/swlib/hotfiles/info.html?fcode=001CV2


argument name propogation in IDA 4.15
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > argument name propogation in IDA 4.15
PDA

View Full Version : argument name propogation in IDA 4.15

mike
03-06-2001, 02:49 PM
My company bought IDA & we recently upgraded to 4.15. Somewhere I go the impression that you can do something like automatically retain a variable name in a subfunction that you named in a parent.

Like this

function a (arg1, arg2)
{ b (arg1); }

If I give arg1 a different name in a, it propogates to b.

Does anyone know how to do this? Or have a script for it?
carpathia
03-06-2001, 07:36 PM
In Kernel Options 2 subscreen, there is an option to propogate "stack argument information". However, I cant say Ive ever managed to get much use out of this, even after a code reanalysis.

Note that the argument info would have to propogate upwards, not downwards, Ie you define the stack var in func b, and it propogates upwards to func A. This prevents problems where func B is called by func A but also by func C.

Also, I work on the assumption that the function (func B) must actually be declared as a function in IDA, not just a labelled code block, and that the function must have its own ebp based stack frame.

It might be worth posting this to the IDA forum. I too, would be interested to see its usage.

Regards

Carpathia
The Owl
03-07-2001, 03:34 AM
as carpathia said already, argument propagation works upwards (it's logical if you
think about it - the lower level function provides (defines) the interface that is
used to call it in the first place). to let IDA know that a given function has a C
prototype, you not only have to make it a function (default hotkey: p) but also
declare the prototype (default hotkey: y) or have IDA parse an .h file that has it.


PHONE HACKING (NEVER DO A THING LIKE THIS)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PHONE HACKING (NEVER DO A THING LIKE THIS)
PDA

View Full Version : PHONE HACKING (NEVER DO A THING LIKE THIS)

CHALKIE
03-07-2001, 03:37 PM
I HAVE A 402 I DONT WANT I WAS WONDERING CAN I HACK IN TO IT? I WOULD LOVE TO HERE FROM PEOPLE IF THEY HAVE ANY HELPFULL ADVISE


WinZip password cracker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WinZip password cracker
PDA

View Full Version : WinZip password cracker

mike
03-07-2001, 06:15 PM
www.cs.oberlin.edu/students/mstay/PRTKHome.exe

This is AccessData's Password Recovery Toolkit with the WinZip Divide & Conquer attack, PKZip dictionary and PGP secret keyring dictionary attacks activated.

It'll open any WinZip with 5 or more files in about 2 hrs regardless of password length. Enjoy!

WARNING: 7.5 Megabytes!


BRW problems w/ Win2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > BRW problems w/ Win2K
PDA

View Full Version : BRW problems w/ Win2K

kamisade
03-07-2001, 10:23 PM
Hi,

I'm trying to go through the nnhnpad tutorial by Neural_Noise, but I am running into a problem. BRW 4.5 does not seem to be able to write files back to disk in the "proper" format. It can read notepad.exe fine, and I can see all the menus & menu items; however after saving, the modified notepad.exe exec does not run.

Is there a BRW equivalent for NT4/5 platforms? Or am I just doing something wrong when saving my modified file?

Thanks.
kamisade
03-07-2001, 10:48 PM
Ack sorry for replying to my own post, but for those who might have the same problem, instead of using BRW, you could try either Exescope or Restorator.


icedump v6.0.2.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump v6.0.2.2
PDA

View Full Version : icedump v6.0.2.2

OeDiFuZz
03-08-2001, 02:03 PM
Hello guys,

i have a problem with icedump but before i proceed here's my "system
specs": Win98 2nd Edition 4.10.2222 A, SoftIce v4.05 build 334.

here's my problem: i extracted the icedump zipfile into the directory
of my version of softice and executed the icedump.exe (with softice loaded in memory, of course). on the console it said:
"icedump v6.0.2.2 for winice v4.05 build 334 loader
icedump was not loaded yet
icedump now loaded"

then pressed CTRL-D to enter softice and type the "/screendump" (just typing the "/" displays the "invalid command in softice's status line) to test if the thing worked. softice's reaction is: invalid command. :-(

can somebody help me out. i may have missed out on something.
thanks in advance guys.

OeDiFuZz
esther
03-08-2001, 07:18 PM
OeDiFuZz (03-08-2001 12:03):
Hello guys,

i have a problem with icedump but before i proceed here's my "system
specs": Win98 2nd Edition 4.10.2222 A, SoftIce v4.05 build 334.

here's my problem: i extracted the icedump zipfile into the directory
of my version of softice and executed the icedump.exe (with softice loaded in memory, of course). on the console it said:
"icedump v6.0.2.2 for winice v4.05 build 334 loader
icedump was not loaded yet
icedump now loaded"

then pressed CTRL-D to enter softice and type the "/screendump" (just typing the "/" displays the "invalid command in softice's status line) to test if the thing worked. softice's reaction is: invalid command. :-(

can somebody help me out. i may have missed out on something.
thanks in advance guys.

OeDiFuZz

Hi there,

type in softice
/screendump pathname:\filename

esther
OeDiFuZz
03-09-2001, 11:36 AM
esther (03-08-2001 17:18):
type in softice
/screendump pathname:\filename

esther

i finally got it working. how dumb of me ;D
thanks esther


Generating .nms files for regular debugging with Sice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Generating .nms files for regular debugging with Sice
PDA

View Full Version : Generating .nms files for regular debugging with Sice

ThrillSeeker
03-09-2001, 10:13 PM
Can any one help me with this problem i'm experiencing? I'm using Sice 4.05 build 334 and masm 6.15. I have windows 98. I built the app with the debug information and it even generates the .nsm (according to filemon) file but then it immediately deletes it! Did i do anything wrong or is it some hidden serial number check?
JimmyClif
03-10-2001, 05:52 PM
Who knows what happened? I can garantie tho that there is no serial check in masm :)

Did you link using these parameters?:
link /DEBUGTYPE:COFF /DEBUG:MAPPED,FULL /MAP /MACHINE:i386 /SUBSYSTEM:WINDOWS /LIBPATH:c:\masm32\lib yourfile.obj


sice 4.05 messes w/ win2k gui boot?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > sice 4.05 messes w/ win2k gui boot?
PDA

View Full Version : sice 4.05 messes w/ win2k gui boot?

me
03-10-2001, 08:45 PM
hi,

I've just installed sice 4.05 on my win2k SP-1 machine. When booting, I get the usual black screen with the grey progress bar. After that, just a black screen and my monitor goes in standby mode. After a minute or so I get the the login msgbox. My question is: where is the screen with the blue progress bar and the bitmap? I notice that there is a /noguiboot in my boot.ini file, is this causing causing it? I have no idea if that swith was in there before, so was just wondering if sice setup put it there...???
Carpathia
03-10-2001, 10:47 PM
Read the release notes that came with SoftICE. It mentions how the GUI must be disabled, in order to load SoftICE.

Regards

Carpathia
mamaich
03-15-2001, 01:50 AM
I've made a replacement of bootvid.dll in Win2K which does not cause problems with the SoftIce loading. Specifying the /noguiboot in boot.ini is not longer necessary. It can be found at www.mamaich.f2s.com with its sources. In this weekend I'll upload there a newer version of .dll which has the improved support for screen output during hibernate and blue screens.


ldasm problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ldasm problem
PDA

View Full Version : ldasm problem

stanks
03-11-2001, 11:12 AM
Hi

I installed ldasm, but when i run it, it says that can't find Tk.pm. I have perl and tk installed. I was trying to find Tk.pm but didn't find it on my disk. What to do?

Thank you
bAZiK
03-12-2001, 01:17 PM
Hi,
Have you tried to reinstall the "Development" Components from the Installation CD's?
stanks
03-13-2001, 11:12 AM
bAZiK (03-12-2001 11:17):
Hi,
Have you tried to reinstall the "Development" Components from the Installation CD's?

Will try.

Thank you


pdemon v0.21 Beta rlsd
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > pdemon v0.21 Beta rlsd
PDA

View Full Version : pdemon v0.21 Beta rlsd

Carpathia
03-11-2001, 11:25 AM
http://carpathia.cjb.net

v0.21b - 10/03/2001
Preferences are now saved between sessions.
Fixed minor bug which caused notes only to be saved if PRC was closed before exiting app.
Added support for displaying the actual PRC header
Added customisable fonts and more color options for disassembly
Added command line support
Added very primitve support for viewing data segment. Note that the data segment is compressed,
and palmdeMON will not decompress it (this feature is added in the next version).


FLEXlm 6.1f (libmgr_s.a)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FLEXlm 6.1f (libmgr_s.a)
PDA

View Full Version : FLEXlm 6.1f (libmgr_s.a)

FESTRIE
03-11-2001, 07:03 PM
Hi everybody,

I bought a CD which contains a crack of ArcINFO 8.02 but unfortunatelly it is not working :)... I need a license key number to make it work or a new Vendor daemon file which will make the license key number inactive... I have all the other license information exept licensekey number. I am not a developper, if there is some one to help me, I will really appreciate the help.

Thanks
nblender
03-12-2001, 01:22 PM
FESTRIE (03-11-2001 17:03):
Hi everybody,

I bought a CD which contains a crack of ArcINFO 8.02 but unfortunatelly it is not working :)... I need a license key number to make it work or a new Vendor daemon file which will make the license key number inactive... I have all the other license information exept licensekey number. I am not a developper, if there is some one to help me, I will really appreciate the help.

Thanks

Well, what you need to do is reverse the code that generates the VENDOR_INFO string from
the license key. Or you could go back to the
person you bought your stolen software disk
from and complain about getting ripped off :)


HOW to reverse the code that generates the VENDOR_INFO string from the license key?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > HOW to reverse the code that generates the VENDOR_INFO string from the license key?
PDA

View Full Version : HOW to reverse the code that generates the VENDOR_INFO string from the license key?

FESTRIE
03-13-2001, 05:43 AM
Hi everybody,

Is there anybody who knows how to reverse the code that generates the VENDOR_INFO string from the license key? I have 14 Features and their license information with the Vendor_Info string but I need a CD key number, and I wonder if there is a tool to find the CD KEY number using those features' VENDOR_INFO string?
I will apreciate the help,
Thanks
nblender
03-14-2001, 09:01 AM
I don't remember the CD-key check - you may
have to reverse the installation and see if
you can dig the CD check out of that.

I'll check the archives and see how it was done.

--nb.


winice.dat settings/customization
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > winice.dat settings/customization
PDA

View Full Version : winice.dat settings/customization

cabby
03-13-2001, 11:27 AM
I recently read either a post or a page that had colour, window placement, size, etc, settings for my SIce 4.05. I used the colour settings and it looks great but I didn't keep track of the rest of the info. Can someone refer me on to that post/page, or let me know what setting is for Ctrl-Alt-Home.
aimless
03-19-2001, 09:50 AM
The awesome colors that you refer for the softice windows come from ETERNALBLISS.

You can check out his site. Or simple enter eternalbliss in google.

Have Fun
PS: His colors R-E-A-L-L-Y rock !!
:)
Eternal Bliss
03-20-2001, 08:16 AM
Hiya,
like to clarify that the color selection is not my creation. I got it somewhere when I first started. But the startup option when you boot your computer is something I wrote.

Regards
EB


Help!! AMD pracessor and W32Dasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help!! AMD pracessor and W32Dasm
PDA

View Full Version : Help!! AMD pracessor and W32Dasm

casey
03-13-2001, 07:59 PM
I am new to this stuff, sorry, if this is a dumb question. But I am hearing and reading conflicting things, concerning AMD processors. I have one one my laptop. I want to run W32Dasm, softice, regmon, and also turbo pascal. will any or all of these give correct results, on a AMD processor? If not, do you know of any programs that will work? Thank you very much
Casey
hz
03-13-2001, 08:22 PM
hiya,

I'm using an athlon and before that a k6, never
had any problems with any of the apps you
mention.

regards
hz
casey
03-13-2001, 10:19 PM
Thanks hz
I'll give it a shot. I have a k6 in my laptop, but I had been told by some local guys that the AMD used a different code, and wouldn't give correct results. It's good to know that it worked for you. As i said, I am new at this, but will read some more tutorials and give it a try. Thanks again for your help
Casey
?ferret
03-21-2001, 06:21 PM
the only problems I've ever faced with my K6 II is that some heavy duty 3D graphics choke. It either ignores them or garbles the output badly (& even that seems to depend on the programmer more than complexity)....but from a reversing standpoint, it's all good ;-)
qferret
03-21-2001, 07:05 PM
one thing....I've never been able to get TRW200 to work on my system, I don't know if that's an AMD issue or something else, but SoftIce works so I never really bothered to look into it ;-)
qferret
03-22-2001, 02:40 PM
..quick update....I got the newest trw2000 to work on my system. I have a different video card, so I don't know if it's something they solved with trw, or if it just didn't like my ATI Rage Pro II...works w/ my Voodoo5...oh well, at least it works now ;-)


Special Character in Feature name of flexlm license
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Special Character in Feature name of flexlm license
PDA

View Full Version : Special Character in Feature name of flexlm license

roZes
03-13-2001, 11:13 PM
Hi All

I got a demo license for one of the softwares protected by flexlm 6.1, I saw something unusual in the feature names, this particular software used special charaters like $, /, \ in the feature name, as shown below

FEATURE my$feature ..........
FEATURE my/feature ..........

I was able to extract the vendor seeds and generate license for features which did not contain the special charaters, but when I tried for my$feature, I got error message saying that special charaters are not allowed in feature name.

Can anyone let me know, how to generate license with special characters in feature name.

thanks
roZes
nblender
03-14-2001, 08:22 AM
I think that it may still generate correct
keys even though it gives you a warning - try
-verfmt 4 to lmcrypt maybe. I can't remember
if that does it or not, but some Sun stuff
does this.

--nb.
roZes
03-16-2001, 04:08 AM
Hi nblender

Thanks for your reply, I was able to generate license after making the lmcrypt.c not to report warnings when there is feature name related errors.

thanks
roZes


regmon & aspack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > regmon & aspack
PDA

View Full Version : regmon & aspack

Mustapha
03-14-2001, 07:44 PM
Hi to all,

I want to know if this happend to someone:
I open regmon and then I start aspack 2.11.
Regmon dissapears and its folder cannot be closed:o.

Mustapha
Kayaker
03-14-2001, 08:36 PM
Hi,

That's an anti-monitor trick used by some packers which uses I think it was GetClassInfoExA or GetClassInfo to detect if Regmon and Filemon is open. I think it also uses EnumWindows. Try setting a BP on these and see if you can find the class string name the packer is searching for ;) The solution then is just to change the name of these classes in both Regmon and Filemon with a hex editor and use these modified monitors whenever you have this problem (a 1 letter change will be enough)

Good Luck,
Kayaker
Kayaker
03-14-2001, 09:27 PM
Hi Mustapha,

Sorry, I steered you wrong there, it was GetClassNameA. I didn't have a chance to double-check when I first posted.

Try starting Regmon/Filemon then set the BP to display the 2nd stack parameter:

bpx GetClassNameA do "dd esp->8"

Then start your proggy and keep pressing F5 until you see the Regmon/Filemon Class name come up in the data window. This should give you the clue what to look for and change in the monitors themselves.

Kayaker
Snacker
03-15-2001, 10:39 AM
Hi !

well try at protools my anti-filemon & regmon detection patches, if you still can't get it mail me !

[]'z
Snacker


funk'd up commands
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > funk'd up commands
PDA

View Full Version : funk'd up commands

dooral
03-15-2001, 12:18 AM
some of my vb commands come up sym not def, in sice.
i heard put 2_'s but still no luck.
also hmemcpy dont work. all my other bps work fine

:/ wtf?

as always any help is greatly apper.
thanx
dooral


My only hero Nblender..not the cd key...sentinel key number
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > My only hero Nblender..not the cd key...sentinel key number
PDA

View Full Version : My only hero Nblender..not the cd key...sentinel key number

festrie
03-15-2001, 04:49 PM
I made a great mistake in my last message ...

I wrote the word wrong...I do not need the 'CD key number' I need the 'Sentinel Key Number' which is starting with 371*****, it is my poor English combined with my poor knowledge...I am terribly sorry..
I could send you the license file wich puts me in trouble..maybe you could understand my problem better..becouse i thing i can not manage to explain it exactly...

In any case I appreciate all your help..

Best wishes..

That was my old message...
Hi everybody,
Is there anybody who knows how to reverse the code that generates the VENDOR_INFO string from the license key? I have 14 Features and their license information with the Vendor_Info string but I need a CD key number, and I wonder if there is a tool to find the CD KEY number using those features' VENDOR_INFO string?
I will apreciate the help,
Thanks
nblender
03-16-2001, 09:02 AM
Hmm - "sentinel key number"???
There are a couple of things that could be wrong.

It's possible that ESRI changed the protection between
8.01 and 8.02. Also, perhaps the license
daemon needs to be started.

If the people that provided your disk sent
a license file, post the first few lines
of it, and I may be able to point you in
the right direction.
festrie
03-16-2001, 01:24 PM
I have sent the license file and the error messages I got ...to your mail adress, you would see them if you check your inbox...

best wishes..
Festrie
nblender
03-16-2001, 03:42 PM
The license file you supplied is for use with a modified version of the esri daemon - the
person that you got the filez from should have supplied a crack.zip that contains the
required file to replace the daemon (esri.exe) with. A replacement daemon that had its
own vendor defined hostid was built, so you should follow the instructions that came
with your crack exactly otherwise it won't work. It's also a floating license, so the
FLEXlm daemon must be running in order to use the licenses.

It's more appropriate to discuss the methods used to crack in this forum, rather than
actually providing cracks themselves. I would suggest going back to the person you
purchased the CD from, or at least carefully examining how you installed the software.
The group that cracked this program no longer exists, so it might be difficult to track
the original crack down.

I would check to make sure the license server runs first though.


User crypt filters.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > User crypt filters.
PDA

View Full Version : User crypt filters.

nblender
03-16-2001, 09:50 AM
User crypt filters.

I was asked through email how to deal with this.

Solving this issue is very dependent on the version of FLEXlm that is used
to generate the crypt filters. Later version (7.1, 7.2) are much more secure,
but they can still be cracked, however a true inverse algorithm of the
one encountered in the user crypt filter in the daemon must be created.

A more automated approach to cracking may be required here - perhaps
rip the filter algorithm with IDA, recompile with TASM and brute force
out the permutation/xor tables.

Knowing what the target is might be helpful.
roZes
03-20-2001, 05:50 AM
HI Nolan

I have few more doubts regarding the daemon stuff

1) If my seeds are wrong then why is it that, some versions of the tools are able to check out license ?

2) Does seeds play any role when it come to checking out the license ?

thanks
roZes
nblender
03-20-2001, 07:33 AM
Hmm - it's possible I've made an error somewhere.

When I get to the machine I used to crack that daemon
I'll check it out more thoroughly.

--nb.
roZes
03-21-2001, 10:16 AM
Nolan

Please let me know your finding, once you get there.

thanks
roZes


smartcheck vs winme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > smartcheck vs winme
PDA

View Full Version : smartcheck vs winme

ama
03-16-2001, 11:10 PM
Please tell me how can I let smartcheck work normally in winme!
When I load VB programs,there is only 2 small windows in it.And I could not see the program.


break point
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > break point
PDA

View Full Version : break point

pdz
03-17-2001, 01:29 PM
Please Could, some one, explain me how put a BPX on feature like LC_INIT with software like flexlm
Thank you
Crackware2000
04-07-2001, 09:11 PM
Sorry i don't know the prog you 're talking about.

If you want to set an "bpx" on an area that is packed, crypt, or selfchecked use
BPM 1234 X.
That's an Breakpoint on Memory eXecution and doesn't change any data.
well the bad thing is that you have to renew it when you restart the program (i use bc *[enter}bh {insert+enter} )


Reversing spedia
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Reversing spedia
PDA

View Full Version : Reversing spedia

gogeta
03-18-2001, 04:36 PM
(Educational purposes)

Could you reverse a program like spedia and alter the way that it counts your points. Also is there any tuts out there on this subject.

thanks
miscreant
03-20-2001, 03:28 PM
I cracked a version of the AllAdvantage viewbar a long time ago, didn't manage to change the way it counts points however I did make a few modifications:

From the .nfo file from the release:
"This patch stops the viewbar from being on top of other windows when undocked, it keeps paying even if the
mouse stays still, it keeps paying if you don't change website, and it keeps paying no matter what program
you are using! And you don't have to change the titlebar text of your other programs! Also this allows you to open
more than one copy of alladvantage viewbar! I don't know if this pays more, try it and let me know!
"

Worked pretty well, got £15 from running it whilst I was playing counterstrike, couldn't even see the viewbar :)

Miscreant.
vman_
03-23-2001, 10:41 PM
Dear gogeta,

I've spent a little time reversing spedia. Its website recognition algo is very good last time I tested it. I was able to make it undock itself and hide itself but when I made it feed itself fake browser window text it would go into 'Yellow' mode after 60 seconds. Unfortunatly I didn't have enough time to get past that part.


Softice Keyboard Driver for Win2k Build 2195
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Keyboard Driver for Win2k Build 2195
PDA

View Full Version : Softice Keyboard Driver for Win2k Build 2195

Inbread
03-18-2001, 08:33 PM
I can't find the driver i8042prt.sys for Build 2195 of Win2k for Softice 4.05. I searhed their FTP site and no luck. Also checked all subjects in this forum. Any help would be appreciated.
Thanks,
Inbread
mamaich
03-19-2001, 07:22 PM
Driver which comes with 2K works fine. But in some very rare cases you may have problem with it. gAnZ found that adding this to registry may help:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice]
"KbdMethod"=dword:67416E5A

This will probably fix some problems like hanging or locking/loosing keypresses after starting SoftIce.
You may try to change the value of KbdMetod to 0 or 1.


Please: How to convert *.MAP/*.LST file to *.NMS?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Please: How to convert *.MAP/*.LST file to *.NMS?
PDA

View Full Version : Please: How to convert *.MAP/*.LST file to *.NMS?

Solomon
03-20-2001, 05:56 AM
How to load the symbolic info produced by IDA into SoftICE?

I get *.MAP files using IDA, but don't know how to convert it to */NMS :(

Thank you for your help.
aimless
03-20-2001, 08:45 AM
Go to google.

Search for "idasym"

Download the zip file (very small, less than 30 kb)

Go to IDA

Disassemble the proggy

Produce the .map file

Run the program you just downloaded on the .map file.

The resultant file, is the one that can be directly loaded into SoftICE loader.

Have Fun.
nblender
03-20-2001, 11:20 AM
"c:\program files
umega\softicent\util16\msym" %1.map
"c:\program files
umega\softicent
msym" %1.sym
Solomon
03-20-2001, 07:45 PM
WOW! It works!
Thanks you two!


PrivateICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PrivateICE
PDA

View Full Version : PrivateICE

[KSC]
03-20-2001, 06:45 PM
Is there anyone using PrivateICE in linux? I've downloaded one, since my kernel is 2.2.16-22, and the binary it comes with is for 2.2.17, so I have to recompile it. And at the first file it compiles, the compiler reports error immediately, saying that kernel header should not be include(it is the module.h), so I remove that line and do it again, I succeed. However, when I try to run it, it says some external symbols are not found. Those symbols are system call's functions and data, the thing is that I can't find each function in all the system modules, can anyone tell me how to compile it?
Thanx in advance
LordSoth
03-21-2001, 07:06 PM
If you've got more than one kernel compiled on your system, you might have
to include the specific headers for the kernel you wish to compile for, and
stuff like that.
In any case, as far as I know, everything that is related to the kernel (something developed for it, such as PrivateICE), has to include the kernel
headers..

LS
[KSC]
03-22-2001, 12:16 AM
I tried not to do any modifications to the source file, directly run makefile, but it will report error(some thing like "kernel module should not be include, but it is from an appropriate source"), it forces me to change the code, but many unresolved system call symbol are found, it's very bother me, it's been more than a week since I want to try this program, any additional help? Thanx again.


Running sice on vmware win98 guest
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Running sice on vmware win98 guest
PDA

View Full Version : Running sice on vmware win98 guest

tt
03-22-2001, 10:22 AM
Has anyone tried running Sice on vmware? I installed a Win98 guest OS on vmware and tried running SICE on it. I am running win2000 on the PC. The reason I want to use Win 98 is because reverse eng is easier on it than on Win2000.
I ran into a whole bunch of problems:
- vmware uses its own graphics adapter driver which gets messed up with Sice. The Directdraw capabilites are limited in the vmware driver and the OS is not able to boot with Sice running.
- trying to run sice remotely. unfortunately sice only supports ne2000 compatile/3com 3cxxx cards for remote debugging. I have a 3com card, but vmware installs its own AMD PCnet ethernet adapter and doesn't recognize any other network adapter. So I was stuck there as well.
- serial debugging. I thought of using a null modem cable to connect com1 (for sice output) and com2 (for listening on). Unfortunately my PC has only one serial port, so I am stuck there as well.
I could install another card and try this route, but was hoping if someone else has figured out a more elegant way to do this.
Thanks
Goat
04-01-2001, 10:51 PM
I have vmware running on Linux Mandrake 7.2 and I just use TRW 2000 instead of Softice. :/


IDA 4.00 & NB09 debug info
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA 4.00 & NB09 debug info
PDA

View Full Version : IDA 4.00 & NB09 debug info

Elf
03-23-2001, 07:18 AM
Hi all!
Can anybody say me, how I can use CodeView NB09 debug info (which present in the exe file) with IDA?
I have exe file with debug info. Can IDA handle this information for function names and operand types?
Solomon
03-23-2001, 10:08 PM
SoftICE symbol loader can extract debug info from PE files.


some questions about flexlm6.1 on Solaris
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > some questions about flexlm6.1 on Solaris
PDA

View Full Version : some questions about flexlm6.1 on Solaris

HappyWolf
03-23-2001, 08:12 AM
Inspired by thes articles on Zencrack2.cjb.net, I want to crack
Flexlm 6.1 on Solaris. But after two weeks' hard work, I gained
nothing but the two encrypted seeds and the five vendor keys.
My target is SUN C++ Workshop 5.0 whose license is administrated
by Flexlm 6.1. I haven't Flexlm 6.1 SDK on Solaris, but I have it
on Windows. I want to get the license for Sun Workshop 5.0 with
Flexlm SDK 6.1 on Windows. My step as following:

1) I found two files which located in /etc/opt/licenses and whose
names are "lmgrd.ste" and "sunwlicd" respectively. From the
license.dat, I think the sunwlicd is the vendor daemon and the lmgrd
is the the license daemon. I debuged the sunwlicd with adb debugger.
As a result, I can't find the lc_init and lc_checkout symbols which
were used to get the Vendor String, the two encrypted seeds and the
four vendor keys on Windows in the past. At last, I had to debug
lmgrd.ste with adb. I found the above two symbols. With the help of Pilgrim's
essay, I found the vendor string called "lmgrd". I were confused that
why the two symbols appear in the licenses daemon. What's more, I think
the vendor string should be "sunwlicd", but I found there wasn't "sunwlicd"
but "lmgrd" in the lc_init's argument list.

2) From Vyacheslav's essay, I tried to find the snippset as following

ld [%fp - 60], %o0
sethi %hi(0x9e000), %o1
or %o1, 0x244, %o1 ! vendorkeys
call
nop
st %o0, [%fp - 52]
ld [%fp - 48], %i2
ld [%i2 + 4], %i3
ld [%fp - 52], %i4
xor %i3, %i4, %i5
st %i5, [%fp - 40]
ld [%fp - 48], %o0
ld [%o0 + 8], %o1
ld [%fp - 52], %o2
xor %o1, %o2, %o3
st %o3, [%fp - 36]

But I failed. So I tried another way to get the two unencrypted seeds and key5.
Firstly according to Dan's essay, I think the calling sequence in lc_new_job() is
lc_new_job {
call lm_new.unpackage(vname,&vc) (unpackage vendorcode,vendor name)
call lm_new.unpackage(0,0)
call lc_init {
...
call l_sg (alt seed flag not set - return old style vc.d^vk5)
compare seeds to default 12345678 and 87654321
...
}
set alt seed flag
}
and the calling sequence in lc_checkout() is
lc_checkout {
...
good_lic_key {
...
l_sg {
alt seed flag set so,
lm_new.decrypt(job,name,vc) (decrypt and RANDOMIZE!!)
}
extract_date
l_ckout_crypt / -8 test
...
}
...
}
So I set breakpoints on lc_init(), l_sg(), lc_checkout() in lmgrd.ste file. I was very
suprised that the program couldn't stop at lc_checkout and exited directly after l_sg().
If the lc_checkout wasn't executed, where to identify whether the license is right or not?
Of course I hadn't got the two unencrypted seeds and key5 using Dan's methods. Could you
indicate where to find them? Thanks in advance.
3) At last, I used the flextool called lmrecode.exe and the two encrypted seeds and the four
vendor keys which I found in lc_init breakpoint to get the two uncrypted seeds and key5. Then
I modified the lm_code.h on windows and compiled to get the lmcrypt.exe. I used lmcrypt.exe and
the demo license to get license.dat. The result isn't right. I can't explain the case. Could you
give me some advice.

Regards,

Tony
nblender
03-23-2001, 10:36 AM
1) Make sure that the format of your license file is correct, otherwise it won't even try and check out a license.

2) sunwlicd is the right daemon, but it uses crypt filters.
kittykat
03-23-2001, 06:36 PM
Where could I get this Vyacheslav's essay ??
Would like to read it...
HappyWolf
03-23-2001, 08:06 PM
kittykat (03-23-2001 16:36):
Where could I get this Vyacheslav's essay ??
Would like to read it...

This article was written in Russia. The website is
http://www.compulog.ru/mac/hackzone/03-98/index.html

At present I didn't understand where lc_init in the sunwlicd file.
Which articles could crack the crypt filter?
nblender
03-24-2001, 08:01 AM
Well, I wrote an article on crypt filters for
Intel NT - they were published at tsehp.cjb.net.

Of course, things are very different on the SPARC
machines, but the whole thing can be sussed out with
a bit of time. The basic approach is still the same to crack this program.
roZes
03-25-2001, 07:55 AM
If you find it difficult to generate flexlm license on solaris, there is a easier way to make it work, but then it is not reversing, it is patching.

There is a call in daemon(ONLY ONE CALL) which need to be returned 1, when the license data in the license file is valid. You need to find it and patch it to return it 1 always. I have tried this on solaris, linux and Intel platform.

Hint : search for flexlmd.

roZes
HappyWolf
03-25-2001, 07:46 PM
roZes (03-25-2001 05:55):
If you find it difficult to generate flexlm license on solaris, there is a easier way to make it work, but then it is not reversing, it is patching.

There is a call in daemon(ONLY ONE CALL) which need to be returned 1, when the license data in the license file is valid. You need to find it and patch it to return it 1 always. I have tried this on solaris, linux and Intel platform.

Hint : search for flexlmd.

roZes

As an example, I used your method to crack Sun Workhsop 5.0. I tried your method with adb debugger.
Firstly I want to find the "flexlmd" procedure in
sunwlicd which is the vendor daemon and I can't
get it in sunwlicd file. But I got ls_flexlmd symbol
and the instructs which I can't understand.
ls_flexlmd: unimp 0x0
ls_flexlmd+4: unimp 0x0
ls_flexlmd+8: unimp 0x0
ls_flexlmd+0xc: unimp 0x0
ls_flexlmd+0x10: unimp 0x0
ls_flexlmd+0x14: unimp 0x0
ls_flexlmd+0x18: unimp 0x0
ls_flexlmd+0x1c: unimp 0x0
ls_flexlmd+0x20: unimp 0x0
ls_flexlmd+0x24: unimp 0x0
timer_expired: unimp 0x0
ls_cpu_usage_delta: unimp 0x0
ls_cpu_usage_interval: unimp 0x0
ls_cpu_usage_last_logged: unimp 0x0
ls_cpu_usage_last_logged+4: unimp 0x0
ls_cpu_usage_last_logged+8: unimp 0x0

Then I search the "flexlmd" symbol in lmgrd.ste which is
the license daemon and I got it. But the instructs as
following which I can't understand.
flexlmd: ???
flexlmd+4: unimp 0x7c008
flexlmd+8: unimp 0x0
flexlmd+0xc: unimp 0x0
flexlmd+0x10: unimp 0x0
flexlmd+0x14: unimp 0x0
flexlmd+0x18: unimp 0x0
flexlmd+0x1c: unimp 0x0
flexlmd+0x20: unimp 0x0
flexlmd+0x24: unimp 0x0
flexlmd+0x28: unimp 0x0
flexlmd+0x2c: unimp 0x0
flexlmd+0x30: unimp 0x0
flexlmd+0x34: unimp 0x0
flexlmd+0x38: unimp 0x0
flexlmd+0x3c: unimp 0x0

Could you give me some advice to find the location
of the call in daemon(ONLY ONE CALL) which need to be returned 1.

Thanks in advance.
roZes
03-26-2001, 10:29 PM
Use IDA to disassemble the target daemon, then search for string flexlmd..., rest will be clear.
roZes
03-28-2001, 08:01 AM
u have to disassemble sunwlicd file
HappyWolf
03-28-2001, 06:44 PM
roZes (03-28-2001 06:01):
u have to disassemble sunwlicd file

I think your method is the easiest but the most effective. I
adopted your method cracking the Flexlm6.1. Firstly I didn't crack
the software on Windows which is licensed by Flexlm6.1. My purpose
is obvious. Through it, I could find the "flexlmd" string and have
found three location which reference the string. Three pieces of snippet
as following:
1) The first location
00421F78 loc_421F78: ; CODE XREF: sub_421B2E+3FEj
00421F78 add edi, 70h
00421F7B push offset aFlexlmd ; "flexlmd"
00421F80 push edi
00421F81 call _strcmp
00421F86 pop ecx
00421F87 test eax, eax
00421F89 pop ecx
00421F8A jnz short loc_421F93
00421F8C or dword ptr [ebx+18Ch], 8
00421F93
00421F93 loc_421F93: ; CODE XREF: sub_421B2E+C1j
00421F93 ; sub_421B2E+24Ej ...
00421F93 push ebx
00421F94 call nullsub_3
00421F99 mov eax, [ebp+var_4]
00421F9C pop ecx
00421F9D pop edi
00421F9E pop esi
00421F9F pop ebx
00421FA0 leave
00421FA1 retn
00421FA1 sub_421B2E endp

2)The second location
0042F98A push 0Fh
0042F98C push dword_461928
0042F992 call sub_40A999
0042F997 pop ecx
0042F998 cmp eax, 0FEEFh
0042F99D pop ecx
0042F99E jz short loc_42F9F7
0042F9A0 lea eax, [ebp+var_20]
0042F9A3 push offset aFlexlmd ; "flexlmd"
0042F9A8 push eax
0042F9A9 call _strcmp
0042F9AE pop ecx
0042F9AF test eax, eax
0042F9B1 pop ecx
0042F9B2 jz short loc_42F9F7
0042F9B4 push ebx
0042F9B5 push esi
0042F9B6 call sub_43E438
0042F9BB pop ecx
0042F9BC pop ecx
0042F9BD push offset aTheVendorKeysD ; "The vendor keys don't support vendor da"...
0042F9C2 call sub_43E55C
0042F9C7 pop ecx
0042F9C8 push ebx
0042F9C9 push esi
0042F9CA call sub_43E438
0042F9CF mov eax, dword_44E160
0042F9D4 pop ecx
0042F9D5 pop ecx
0042F9D6 push dword ptr [eax+18h]
0042F9D9 push dword ptr [eax+14h]
0042F9DC push dword ptr [eax+10h]
0042F9DF push dword ptr [eax+0Ch]
0042F9E2 push offset aVendorKeysAre0 ; "Vendor keys are:
0x%x
0x%x
0x%x
0x%x
"

3)The third location
00434CCB mov ebp, esp
00434CCD sub esp, 38h
00434CD0 mov eax, dword_45B088
00434CD5 push ebx
00434CD6 xor ebx, ebx
00434CD8 push esi
00434CD9 cmp eax, ebx
00434CDB push edi
00434CDC mov [ebp+var_C], ebx
00434CDF mov [ebp+var_4], offset unk_459878
00434CE6 jz short loc_434CF1
00434CE8 mov [ebp+var_10], offset aFlexlmd ; "flexlmd"
00434CEF jmp short loc_434D00
00434CF1 ;**********************************************************************************
00434CF1
00434CF1 loc_434CF1: ; CODE XREF: sub_434CCA+1Cj
00434CF1 mov ecx, dword_461928
00434CF7 add ecx, 9Ch
00434CFD mov [ebp+var_10], ecx
00434D00
00434D00 loc_434D00: ; CODE XREF: sub_434CCA+25j
00434D00 mov esi, [ebp+arg_4]
00434D03 cmp esi, ebx
00434D05 jnz short loc_434D0E
00434D07 xor eax, eax
00434D09 jmp loc_434E78

As your essey says, there is a call near "flexlmd" string which needs to be returned 1.
I think it may be the mode of "test eax,eax; jump somewhere",so I break at 00421F81 in
the first snippet and at 0042F9A9 in the second one with winice. The program stopped at
00421F81 but not at 0042F9A9. No matter the license file is right or wrong, the return
eax is always FFFFFFFF.
Could you give more detail information to find the location of returning 1. Thanks in
advance.
HappyWolf
03-29-2001, 05:54 PM
roZes (03-28-2001 06:01):
u have to disassemble sunwlicd file

Dear roZes,

Thank you very much.

Best regards,

Tony


lmrand2.obj(FlexLM 7.2a) & Ida Pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > lmrand2.obj(FlexLM 7.2a) & Ida Pro
PDA

View Full Version : lmrand2.obj(FlexLM 7.2a) & Ida Pro

tom_324
03-26-2001, 05:36 AM
Hi,

I have been trying to disassemble & recompile lmrand2.obj from FLEXlm 7.2a SDK using Ida Pro. Assembler (masm) reports:

I:\masm32\rn2.asm(4928) : error A2006: undefined symbol : loc_0_202B
I:\masm32\rn2.asm(5033) : error A2006: undefined symbol : loc_0_2037

Does anyone know a workaround this problem? Fragment of the source code is below.

Regards,
Tom

<snip>

_data segment para public 'DATA' use32
assume cs:_data

<snip>

$SG22783 db '=',0 ; DATA XREF: _random_garbage+2A6o

$SG22785 dd offset loc_0_202B + 1; DATA XREF: _random_garbage+2E5o
$SG22787 dd offset $SG22644 + 48h; DATA XREF: _random_garbage+325o
$SG22789 db 9,'};',0Ah,0 ; DATA XREF: _random_garbage+367o
db 0 ;

<snip>

public _main
_main proc near

<snip>

loc_0_202B: ; DATA XREF: .data:00000F1Eo
add esp, 8
test eax, eax
jz short loc_0_2046
push offset $SG22654 ; "Overridding...
"

<snip>


SoftICE 4.05 / Windows ME / hmemcpy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE 4.05 / Windows ME / hmemcpy
PDA

View Full Version : SoftICE 4.05 / Windows ME / hmemcpy

Destroyer_97
03-26-2001, 12:07 PM
I've noticed that the hmemcpy function has been removed from the kernel32.dll file in Windows ME. Does anyone know a replacement function that I can BPX on?

Thanks!
Destroyer_97
03-26-2001, 12:10 PM
P.S. RtlMoveMemory does not work enough.
Cps530
03-27-2001, 05:32 AM
I think you can try 'bpx memcpy'.
S\ashZer0
04-05-2001, 05:45 PM
Hum like i see hmemcpy still works :)

Many ppl telled me its not implemented but i tried my self
and it works


IceDump and W2k??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceDump and W2k??
PDA

View Full Version : IceDump and W2k??

John Q 6Pack
03-26-2001, 05:23 PM
I am trying to get IceDump to run for me and I have "issues". I am using w2k and SoftIce 3.24 for NT. I have unzipped all files that come w/icedump. I then copied icedump.exe to the folder that SoftIce is installed to (this is more or less what I get from the included readme). I then start SoftIce and then run icedump.exe then I see...... *icedump v6.0.2.2 for winice v3.22 loader now VXDLDR services*. I have no clue as to what to do now.... Thanks in advance....


shockwave tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > shockwave tools
PDA

View Full Version : shockwave tools

Subaru
03-27-2001, 09:35 AM
Does anyone know of any tools for reversing shockwave applets ?

thanks
Latigo
03-27-2001, 03:27 PM
Hi, what a coincidence. Today i had the same needs ;)
Check www.openswf.org and/or www.suddendischarge.com
Very nice tools and very nice references.
Bye!

Latigo


IceDump and W2k still ain't got it yet.. :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceDump and W2k still ain't got it yet.. :(
PDA

View Full Version : IceDump and W2k still ain't got it yet.. :(

John Q 6Pack
03-27-2001, 10:45 PM
I am still having problems with IceDump. I traced some of my orignal problems to the way that I extraced the files to the softice dir. I now have the files extracted to the folders w9x, wnt, etc. At any rate this is the deal. In the w9x folders for the diff versions, I have icedump.exe in each folder. Now in the version folders under wnt, I have "icedump" With no file extension. Of course the w9x versions will not fly on my w2k pc. I have no clue as to why I don't get .exe's in the wnt folders like I do in the w9x folders after extraction. I have tried to "recompile" from the included source, sadly I suk at trying to compile someone elses code and I am not really sure that I have all the needed code, and that my borland compiler is compatible. I am using the 2195 build w/service pack1 on w2k running softice 3.24 for NT if that is important to someone that has any ideas what to do. I have d/led the icedump file twice and extracted twice to make sure it was not something stupid. At this point I can't even try to run the program as it seems that I have no program to run. Any help I would be most greatful for.

(oh ya just for the shits of it I dropped .exe on the "icedump" file LOL it crashed but... I expected that)
Anticode
03-29-2001, 07:01 AM
John Q 6Pack (03-27-2001 20:45):
I am still having problems with IceDump. I traced some of my orignal problems to the way that I extraced the files to the softice dir. I now have the files extracted to the folders w9x, wnt, etc. At any rate this is the deal. In the w9x folders for the diff versions, I have icedump.exe in each folder. Now in the version folders under wnt, I have "icedump" With no file extension. Of course the w9x versions will not fly on my w2k pc. I have no clue as to why I don't get .exe's in the wnt folders like I do in the w9x folders after extraction. I have tried to "recompile" from the included source, sadly I suk at trying to compile someone elses code and I am not really sure that I have all the needed code, and that my borland compiler is compatible. I am using the 2195 build w/service pack1 on w2k running softice 3.24 for NT if that is important to someone that has any ideas what to do. I have d/led the icedump file twice and extracted twice to make sure it was not something stupid. At this point I can't even try to run the program as it seems that I have no program to run. Any help I would be most greatful for.

(oh ya just for the shits of it I dropped .exe on the "icedump" file LOL it crashed but... I expected that)

On Win2K/NT icedump is installed by patching the NTICE.SYS file.
What you need to do is:
1) copy ntid.exe and the correct icedump file to the %SystemRoot%\system32\drivers directory and run ntid.exe from there.
2) restart ntice by rebooting windows
John Q 6Pack
03-29-2001, 01:24 PM
WaHOOO!!

Thank YOU!

That did it now if I could deal w/ the rest of the "issues" I would be all set.


SoftIce and Windoze Millennium
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce and Windoze Millennium
PDA

View Full Version : SoftIce and Windoze Millennium

Goat
03-28-2001, 08:43 PM
I'm having a problem gettin Softice 4.15 to work on Windows Millenium. I've downloaded the Windows ME debugkit from Microsoft.com, but when I put IO.SYS in the root directory, my machine freezes on bootup. I think this would have somethin to do with my running GRUB on bootup, its a menu that lets me choose between Windows ME and Linux Mandrake 7.2, both on different partitions in different hard drives. Anyone had this problem? And if so, how did you fix it?
Destroyer_97
03-29-2001, 12:01 AM
You also need to download the up-to-date version of debug and stick it in your Windows Directory.
http://www.numega.com/drivercentral/utilfiles/debugger3_13_01.exe

and here's a step-by-step how to do it if that doesn't work.
http://www.numega.com/drivercentral/tech_tips/windows-me_6_30_00.shtml
Destroyer_97
03-29-2001, 12:02 AM
Also forgot to mention that you need to rename that file to debug.exe once it's in your Win dir.
Goat
03-30-2001, 08:55 PM
That did it. :) THanks a million.


Smartcheck help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Smartcheck help
PDA

View Full Version : Smartcheck help

hodgePod
03-28-2001, 09:49 PM
Smartcheck V6.03 build 1103.
Trying to learn a new tool

When I "F5" I get all kinds of errors.
Invalid argument: AddAdamW
API failure AddAdamW
API failure: BegineUpdateResourceA
etc.

If I uncheck in settings
error settings API and OLE function call errors

I get past the above errors poping up but it doesn't show much info when I run the target program. What can I do? What am I doing wrong? I haven't found much info on smartcheck anywhere.


icedump crashes on original win95 since 6021
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump crashes on original win95 since 6021
PDA

View Full Version : icedump crashes on original win95 since 6021

nincompoop
03-29-2001, 02:18 AM
Not having used IceDump for a while I decided to upgrade from 6.0.20 to 6.0.22, only to find that it craches in VMM (c0231810 on my computer), leaving you in SoftIce with no other option than to do a hboot. I checked 6.0.21 and it too crashes, so the problem were introduced with the 6.0.2.1 version.

On the way down it displays:
Failed to find TDBX.R0TCB - will use slower.....
USER32 exports are not renormalised
ADVAPI32 exports are not renormalised

Can something be done??

Regards,
nincompoop


Feasability of re-assembling Ida code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Feasability of re-assembling Ida code
PDA

View Full Version : Feasability of re-assembling Ida code

onejump
03-29-2001, 02:52 AM
I am reasonably happy with using IdaPro 4.0 and Sice 4.05 under Win2k.
I have a very large OCX (~3mb) that has a lot of unwanted code that has no relevance to what I want in my program. My question is how feasable is it to strip out this code and re-assemble into a smaller ocx?
Has anybody done this or is it far too hard?


Problems using revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems using revirgin
PDA

View Full Version : Problems using revirgin

Anticode
03-30-2001, 06:19 PM
When i start revirgin i keep getting the message "can't use the tracer on this win 9x version".
this happens only on WinME (non english version) (i tried it on win98 with no problems).
I've found that revirgin is searching for some bytes in the kernel and some VxD.
The third search fails and the search bytes are not found within the range.
My question is what the third search is looking for? (i can only guess it is some function in vmm32)
if I would know that, i could have found the correct bytes for my windows version..


SENTINEL LM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SENTINEL LM
PDA

View Full Version : SENTINEL LM

vlsi
03-31-2001, 07:38 AM
please help me.... where can i find SENTINEL LM SDK or at least wlscgen.exe? i'm praticing with tuts from cyberheg and nolan blender but i cannot find all the tools i need...
if someone can help me.
my email is xmitsurugi@hotmail.com
thank u all


API Functions in Windows ME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > API Functions in Windows ME
PDA

View Full Version : API Functions in Windows ME

Goat
04-01-2001, 03:47 AM
I'm having a problem with setting breakpoints on certain important API functions such as Getdlgitemtext, hmemcpy, etc on a count of Symbol Not Defined. Anyone had this problem? It's being a real pain in the ass. An alternate function would do well too...I dunno why Windows couldn't leave that alone. >(
Crackware2000
04-07-2001, 08:56 PM
Well before you could bpx xyz you must load the export of the dll that exports the APi "xyz".

Here are two possiblies:

1.start the Symbol Loader (loader32.exe)
Files/load Export and chose a dll (for ex user32.dll)
now pop-up SICE an type to check if exports were loaded
exp message*
and you should see

2.You should put important exports in your winice.dat. (I will not discribe this - you will sure manage it)


How to get microsoft mapsym?where?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to get microsoft mapsym?where?
PDA

View Full Version : How to get microsoft mapsym?where?

Tomliao
04-03-2001, 06:25 AM
Thank you.
Scooby
04-04-2001, 07:37 AM
You could start by doing a search on the web...


SoftICE 4.05 + W2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE 4.05 + W2K
PDA

View Full Version : SoftICE 4.05 + W2K

baudy
04-03-2001, 08:20 AM
Hi all !

I have SoftIce new installation under W2K on Compaq Armada M700
with ATI RAGE Mobilty AGP Video and it doesn't work with this video adapter. :( I tried all SoftIce drivers (even Standard VGA) but it also said that the test failed.
Can anybody help ?

--== Baudy. ==--
Solomon
04-05-2001, 02:06 AM
run its video adapter setup prog, check the checkbox "universal video driver", then "test". After doing this softice will popup later as a small window. Add the following to winice.dat:
INIT = "set font 2; lines 40;faults off;x"
baudy
04-05-2001, 04:22 AM
Solomon (04-05-2001 00:06):
run its video adapter setup prog, check the checkbox "universal video driver", then "test". After doing this softice will popup later as a small window. Add the following to winice.dat:
INIT = "set font 2; lines 40;faults off;x"
Thanx alot ! It work now !!!

--== Baudy. ==--


To Carphathia about palmdeMON
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > To Carphathia about palmdeMON
PDA

View Full Version : To Carphathia about palmdeMON

the_lover
04-03-2001, 04:17 PM
Hello Carphathia,

I downloaded your program and I found it really fast/powerful...

How I can save my work?
Example: I set some comments and exit palmdeMON. All of it gets lost?
Carpathia
04-04-2001, 02:38 AM
Hi there.

Currently you can only save the disassembly to an asm listing. Im still modifying the internals of the disassembly quite a lot, so I decided not to write the 'save database' code until this was finalised.

Eventually you will be able to save your comments etc, but it wont for a few more versions yet :-(

Regards

Carpathia


How do you force a complete installation of DriverStudio?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How do you force a complete installation of DriverStudio?
PDA

View Full Version : How do you force a complete installation of DriverStudio?

roocoon
04-07-2001, 11:27 AM
Hi.
I picked up today a copy of DriverStudio 2.0.1 beta and it's giving me a hard time to install.
It only gives the option of installing VToolsD and EmbeddedNT.
Any idea why the other options don't appear? (Softice, Driverworks, etc.)
I doubt the only changes are in these two.
According to the Readme, Softice seems to have some updates:
****
Enhancements
Whistler Build 2296 support for SoftICE.
Pentium 4 (Willamette) support for SoftICE.
Add new Windows 2000 (Win2K) bugcheck strings and new driver verifier bugchecks.
With Driver Studio 2.0, your debugging ability ended at about the time the screen left high res mode. Now, you can debug to shutdown time on Win2K computers.
Added additional logging information to aid support:
Registration
Operating System
Version Number
Copyright data
Modified WX command to handle new formats for Pentium 4 processors.
***
Bug Fixes
Support for ID's > 0x400. (Specifically thread, process, object, etc.)
Fixed Packet Command.
Packet command would always fail after being given an invalid packet address.
Fixed the bug causing crashes when gina.dll's were used.
Local contexts would exceed what was expected.
SoftICE would occasionally remain partially visible after returning back to the OS.
KD Extensions were incorrectly handling context changes.
When changing contexts, we were actually setting instead of getting.
KD Extensions now accept commands with parameters.
Fixed a BSOD crashing bug when running with poolmon on
*************
I don't remember these things being in 2.0.
While on the subject, how on earth do you get the older version to uninstall?
Thanks in advance.
DGR
04-08-2001, 11:39 AM
afaik the final of Driverstudio 2.0.1 is out but anyways...

U might need to uninstall a previous version of driverstudio/other numega products. I installed ds2.0.1 without ne probs after uninstalling ds2.0, before that it was based on my previous installation and I couldn't, for example, select to install softice (simply wasn't in the list).

Take care
roocoon
04-08-2001, 03:09 PM
Thanks for the response.
That's whay happens to me too. But how did you manage to uninstall DriverStudio?
Since version 1.0, I always had to install on top of the previous versions since none of them could uninstall itself.
I could disable its services and try and remove all the registry entries and directories but it's too messy.
Did you find an easy way to do it?
DGR
04-09-2001, 09:16 AM
Ever thought of checking the "Control Panel -> Add/Remove software"? Does wonders...
roocoon
04-09-2001, 10:32 AM
Wish it was that easy.
It refuses to process the uninstall script. After all, even DriverStudio can't uninstall itself.
Oh well. I guess I'll have to do the hard way.
Thanks for the responses.
DGR
04-11-2001, 05:29 AM
Hmmm, weird...

As far as I can tell I had no probs with it, believe the new installation even uninstalled the old version itself...

Take care and gewd luck ; )
SplAj
04-14-2001, 08:16 AM
Shit I hate asking but,

I am debugging in W2K SP1 SI405 build334 Nvidia GeForce at 1154 res and of course this version does not support high resolutions with the new detonator3 driver .....so my , duh, question ?????..........

Could some kind fellow RCE e-mail me a clue as to the NAME of the DL re DriverStudio2 so I can filter my search better......
and serious replies only }>

TIA

SplAj
roocoon
04-14-2001, 12:07 PM
I'm seeing two copies of the same 2.01 beta at the moment. Both mispelled as in "DriveStudio".
There's also a copy of the final 2.01 (spelled properly) in some MP3 FTP but it's members only (and I'm not one).
In all cases just look for "numega".
SplAj
04-15-2001, 08:35 AM
duh I want a refund, Copernic 2001 Pro (!) still don't f*ckin find anythin ????

SplAj
roocoon
04-15-2001, 03:17 PM
No wonder you don't find anything.
If you look at the specs of Copernic you'll see that it mostly searches web sites with a couple of searches on files and software.
That would most likely be shareware.
What you're looking for, you won't find there.
Check the reliz engine.


To Carphatia : IDA vs PalmdeMON ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > To Carphatia : IDA vs PalmdeMON ?
PDA

View Full Version : To Carphatia : IDA vs PalmdeMON ?

the_lover
04-11-2001, 08:20 AM
I used your great program to successfully disassemble my target.The protection was easily killed in some minutes (simple jumps modifications).

Then I load IDA to write my modifications (and to test them!!) , but I first receive an error message (A5 register is not pointing to the start of the data segment) an then I receive a disassembly that presents no correspondencies with palmdeMON listing.

Why IDA presents me a disassembly so "dirt"? Am I missing something of PRC file format?
Carpathia
04-12-2001, 01:21 PM
Hi,

IDA takes the PRC, and shows all of it within its display, resources etc will be displayed as data in the disassembly. You need to jump to the start of the code segment, which wont be at the top of the display like in palmdemon.

Ive studied the A5 issue a little, AFAIK, IDA is merely warning you that the CODE0 resource could not be parsed sufficiently to provide data segment xrefs. Unless Ive misunderstood, Its shouldnt fundamentally affect the disassembly itself, only the annotations.

Could you send the PRC to me at carpathia_uk@mail.com please, and I can verify what Ive told you.

Thanks

Carpathia
the_lover
04-13-2001, 05:29 AM
The PRC is on the way,with more detailed infos!!


where can i find Trainer Engine v1.0 (c) odin?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > where can i find Trainer Engine v1.0 (c) odin?
PDA

View Full Version : where can i find Trainer Engine v1.0 (c) odin?

madsman
04-11-2001, 10:42 AM
I know this topic is not realy for this but spend some time to play those day instead cracks and cant find the Trainer Engine v1.0 rev 6 public release coded by odin and used in usual CLS release.
anyone can help,i lose the odin's page url!

xx


Problems running IceDump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems running IceDump
PDA

View Full Version : Problems running IceDump

Zedr0n
04-13-2001, 08:26 AM
I have the Windows ver. 4.10.2222 A with the SoftIce 4.05 Build 334 on it. And when I try to load it I get:

icedump v6.0.2.2 for winice v4.05 build 334 loader
icedump was not loaded yet
VXDLDR failed to load icedump

Does anybody know what the problem is?
And with the reVirgin I get that tracer doesn't run on my version. Must it be so?
SplAj
04-14-2001, 08:23 AM
Hi I think you should RTFM for icedump as this is a COMMON Q re this tool ?

.....check your winice.dat and EXP (load) some dll's especially kernel32 !!!

i.e :-
EXP=c:\windows\system\kernel32.dll

restart windoze and try icedump again.

SplAj


Win2k with SoftIce and Symbol Loader....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2k with SoftIce and Symbol Loader....
PDA

View Full Version : Win2k with SoftIce and Symbol Loader....

n03l
04-13-2001, 03:32 PM
Hmmm I've got a program here that will only run on Win2k.
To crack it I've had to install Win2k and SoftIce 4.05 NT version.
I guess I've not set it up right as I get an error "Unable to find a desktop window" when I use the command HWND. I've also got a problem using the HMEMCPY aldo I do not think this will work on a Win2K system.

An other problem here is that when I load a program with "Symbol Loader" and then do a "Load" SoftIce will not break (SoftIce is loaded). Is this again something Win2K will not allow?

Any suggestions are welcome.

n03l.


help with NTicedump/NTfrogice and BSOD... please!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > help with NTicedump/NTfrogice and BSOD... please!
PDA

View Full Version : help with NTicedump/NTfrogice and BSOD... please!

drak0
04-14-2001, 02:35 PM
Hi,

I have tried to install nticedump two times now and every time I fire up SI, I get the good ol' BSOD...

I have the ntice.sys from driverstudio 2.0.1 (product version 4.2.1 (build 53))

what am I doing wrong? I copy the ntid.exe and the 4.05.526 patch and it doesn't work....

hrmm... now that I see it... those builds don't look like they match... is this the problem? i'll post anyway...

also, is they why NT version of Frogice doesn't work? when I start up frogice (nt version), i get a BSOD (as soon as I enable meltice protection for example)

Is this version of SI from driverstudio too new?

Thanks in advance :)

-Drak0
drak0
04-14-2001, 02:37 PM
O yea... i'm using win2000 (2195) w/ SP1...

Thanks
drak0
04-15-2001, 01:17 PM
nticedump was just updated to support this version....


PROGRAMMING IN ASM .......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PROGRAMMING IN ASM .......
PDA

View Full Version : PROGRAMMING IN ASM .......

SpeKKeL !
04-15-2001, 02:29 PM
Hi you all,

After studing a book about assembler I want to start some (little) programming in asm.The writer talks about an editor(any type),TASM,and Tlink .(book's date is '96)
Should i use these programs or are there better prog's or easier ways to begin programming in asm. ??
Also i need a tutorial about the api's.

Thanks for any input......SpeKKeL....
Squidge
04-16-2001, 08:11 AM
If your writing dos apps, then TASM is fine. If your going to try and write windows apps, then use C, not asm, otherwise you'll be talking a few hundred lines just to open a window, never mind do anything useful with it.
+SplAj
04-16-2001, 08:36 AM
".........never mind do anything useful with it."

mmmmm that could lead to an interesting discussion }>

ever heard of icedump ???

hehehe greetz all

SplAj
+SplAj
04-16-2001, 08:45 AM
SpeKKeL

You have made several posts to RCE but no e-mail, please contact me and I will send you my asm templates to 1) patch files, 2) patch registry 3) keygening 4) resources 5) icons and how to link it all in :) to compile a nice exe of 4k size.

We can work together to bring you up to speed ;)

+SplAj
SpeKKeL !
04-17-2001, 02:34 AM
Would be great!

Sended you my address...
m0sk
04-17-2001, 01:20 PM
Squidge (04-16-2001 06:11):
If your going to try and write windows apps, then use C, not asm, otherwise you'll be talking a few hundred lines just to open a window, never mind do anything useful with it.

Hehe, with hutch's masm32 package it's not hard to do api stuff, it's essentially the same as you would do it in C ... Check out Iczelion's tutorials at h**p://win32asm.cjb.net ;P

have fun,
m0sk
SpeKKeL !
04-22-2001, 05:14 PM
Hi all,

trying to find to WIN32.HLP (api-programmers reference)-files...but couldn't
find it on the web......
Anyone knows ????????
Thanks (,a lot off links are death) SpeKKeL
hz
04-22-2001, 06:15 PM
hiya,
http://snakepage.cjb.net. on the tools page, not sure how up to date it is, think I got it from there quite a while back. I must have a read through it one of these days, may be something interesting in it.

regards
hz

PS it is a working link, I just tried it.
SpeKKeL !
04-23-2001, 02:19 PM
YEp,

Just what i needed thanks hz

Spekkel
ThrillSeeker
04-25-2001, 06:40 PM
In your opinion, which would be the best C compiler out there ?


AsProtect...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > AsProtect...
PDA

View Full Version : AsProtect...

0ldMan
04-15-2001, 08:41 PM
Hi all!
Just a question...
With the new AsProtect, is a new control build in(initialization error), generated from the memory patchers (generated from "WriteProcessMemory" Api).
Is there a different Api to write bytes in memory, or a new memory patcher around, that allows to do it?
TIA

0ldMan
Kayaker
04-15-2001, 11:16 PM
Hi,

Could you clarify this a bit? I've never used a memory patcher on Asprotect, just aimed for a clean dump with Revirgin. What memory patcher are you using, and why do you think there is a difference with the new Asprotect? Do you actually get an "Initialization error" message with a certain app?

Kayaker


Win9x/nt Platform SDK request
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win9x/nt Platform SDK request
PDA

View Full Version : Win9x/nt Platform SDK request

latigo
04-16-2001, 09:16 AM
Hi there fellas..
I've been trying to get the sdk from M$'s site for days and i just can't get a full download.
I don't know why the SDK is not availble as a single file as the DDK and other packages are.. But mainly this is the reason why i just can't get the whole download. My inet connection goes up and down.
If you happen to have the SDK and can make it available for me, i'll be very happy :)
Thanks in advance.

Latigo
Carpathia
04-16-2001, 03:33 PM
Hi Latigo,

if you have a *fast* ftp, I can probably help you.

Regards

Carpathia
Latigo
04-17-2001, 10:53 AM
Hey Carpie mate! :)
Thanks for your help..
My ftp is kinda fast..at least we could give it a try.
I'm mailing you right now.
Thanks!

Lati
Carpathia
04-19-2001, 11:30 PM
Hi Latigo, sorry about the delay.

You have mail :-)
Carpathia
04-23-2001, 02:33 PM
Latigo, can you confirm you got my mail plz. Also, If you still need it, I need to know which bits of the SDK you want (if not all).

Regards

Carpii
Latigo
04-24-2001, 12:36 PM
'lo mate!
Excuse my delay. These days are awfull ones at the office.
I'm still arguing with the admin about firewall/ftp/ports issues..and as i don't want it to get worse, i'll just drop it.
So i really appreciate your help but i think that i'll have to get it via cd.
Thanks again and sorry me for the delay :)

Bye!

Latigo
Carpathia
04-24-2001, 07:10 PM
Ok no worries. I always have it handy, so If you get the firewall sorted, feel free to ask again.

Regards

Carpathia


Win2k SDK
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2k SDK
PDA

View Full Version : Win2k SDK

miscreant
04-16-2001, 11:45 AM
I'd like the windows 2000 SDK too.. looks like im gunna have to order a cd from ms.
latigo
04-16-2001, 12:13 PM
If you order, let me know :)

Latigo
miscreant
04-16-2001, 01:56 PM
this was supposed to be a reply on your msg... obviously clicked the wrong button


Windows 2000 compatible debugger?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Windows 2000 compatible debugger?
PDA

View Full Version : Windows 2000 compatible debugger?

Squidge
04-16-2001, 02:24 PM
Does anyone know of a windows 2000 compatible debugger? W32dasm's debugger works fine under 98, but exits randomly under 2k.

I can't get Softice to work on my new ati radeon, so is there anything else that can set breakpoints reliably under this os?
Bert
04-17-2001, 04:58 PM
Whats the Problem ???
Does it install, but doesn't pop up ???
Please more info !
Hoof Arted
04-18-2001, 01:43 AM
The problem you are having is the same thing that I was having. I have contacted the developers and they have told me that there is nothing being done at the moment.

I am now using a debugger called OLLYDBG. Get it from www.suddendischange.com.

Hoof
n03l
04-18-2001, 02:15 PM
Squidge I have "kind of" the same problem with SoftIce and my Win2k system.

The crazy thing was that SoftIce didn't pop-up when I loaded the program with the Symbol loader.

The way I manage to "break" on the "dongle protected" program (that would only work on a Win2k system) was by adding a CC in the part of the program that I knew it would run.

Set in SoftIce a BPINT 3 and start the program that you like to break on. When SoftIce pop's up, MAKE SURE you change the CC back to what it was BEFORE you pas the CC, and set the new break points.

I know it's a strange way of doing it, but for me it was the only way to break on it.

Re: W32dasm. I've got the same problem here on my Win2k OS.

n03l.

PS. The program is now running fine without the Rainbow dongle.
Squidge
04-21-2001, 05:55 PM
Bert (04-17-2001 06:58):
Whats the Problem ???
Does it install, but doesn't pop up ???
Please more info !

Installs fine, CTRL-D works, but doesn't popup. Can't use any of the normal shortcut keys to bring window into view. (CTRL-D does kinda lockup the system, so I assume Softice is running somewhere, and you can use the commands to get back to 2k, so it's just missing a window). It's setup to use a window on the desktop.
Inbread
04-25-2001, 10:26 PM
I have a similar problem with Win2k and softice 4.05 for Nt/2k. Similarly CTRL-D freezes the program, but the window doesn't pop up because if I hit G (return to windows) the mouse comes back. I installed a May 2000 Softice build and had the exact problem you refer to. I'm using win2k build 2195. Previously I had a 4.05 version built in Oct 2000 but the keyboard response after loading softice was very, very slow. I tried all of the .sys keyboard files on the softice support FTP site but nothing worked properly. None the less, the Oct version froze the program and gave me the debug window, but had to reboot to get keyboard back.

Have lost the Oct 4.05 build and can't find an updated version.
Any help or suggestions would be appreciated.

Regards,
Inbread
DGR
04-26-2001, 04:30 AM
Try using the softice from Driverstudio 2.01 with Win2k and nvidia vid-cards... It's working great for me I must say, finally the problems I used to have (the same u are describing now) are gone...

I'm using the detonator 7.52 drivers myself... but newer ones should work just fine as well (Win2k SP1).

Take care,

D.


Kayaker,come in...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Kayaker,come in...
PDA

View Full Version : Kayaker,come in...

adddddd
04-17-2001, 01:30 PM
Hi Kayaker:
Can you give me some tips on how to get a clean dump before rebuild IT??? I always nop those asprotect hooks in proggy, but it seems to be useless, what's the reason?
Best Regards!
Kayaker
04-17-2001, 07:36 PM
Hi,

It's kinda hard to give any definitive answer to your problem, partly because from your post I'm not sure exactly *what* your problem is ;) The 1st step of course is dumping at the right OEP and making sure you've got the correct IAT start and length. There's been plenty of posts/tuts on this. Seems that every app uses a different weekly version of Asprotect as well, heh, so there's no tried and true method of finding the OEP dump location either.

I'm not giving anything away here by saying that there are usually some unresolved entries in the IAT after running Revirgin. Used to be there was only 1 or 2 and these were actually redirected GetProcAddress calls and you could just edit these entries yourself before generating the IT. Even then the program was likely to crash because of some other redirected non-API call that tried to access a value in Asprotect memory. Sometimes these could simply be replaced with GetVersion (nothing pushed, essentially acted as a RET), or nopped out, but sometimes you needed to be a bit more creative and actually return some address or other.

I've seen a few apps though that some unresolved entries were something other than GetProcAddress, or there's just some other reason for it crashing that Revirgin has no chance at solving. For these you need to trace each problem area yourself in the packed app and figure out what the code is *supposed* to be looking for/doing and determine how to fix this in the unpacked app. I've seen a couple where if you nop out the call to the registration nag it runs fine.

So really, assuming you've dumped at the right location and Revirgin behaved reasonably well, most of the problems can only be gleaned by getting your hands dirty in the packed file and carefully tracing the problem areas. Not sure what other advice I can give, hope this helps.

Regards,
Kayaker
adddddd
04-17-2001, 09:52 PM
Hi Kayaker
For most situation, I can find the right eop, and get a correct IAT,but the dumped file was still crashed, I think maybe I can Get a clean dump before Asprotect set it's flags or let Asprotect set flags first then run our dumped proggy(modify eop), so the key problem is to find the right eip of asprotect begin setting its flags. Have you some advice?
regards!
Kayaker
04-18-2001, 01:10 AM
Hi,

I'm not sure that in most cases modifying the way Asprotect unpacks will result in a better dump, if this is what you mean. Sometimes you see it jump back into program code and move a flag or address into a location, or modify a bit of code, maybe just inserting a C3 RET. I've tried a few times to R FL Z a jump in Asprotect to avoid going back into program code, but all that happened was when the code was finally executed, instead of finding, say an Asprotect address in a certain memory location (which would cause a crash), it found instead FFFFFFFF, which caused a crash anyway.

One notable exception to this I've seen was discussed in the Chameleon Clock thread a while back, where there was quite a bit of stuff happening in a jump back into program code (code modified + registry calls). The solution there *was* to bypass this jump during Asprotect unpacking and redirect the OEP to call the initialization code later. I'm not sure if this was a deliberate implementation of Asprotect or just the way the program was set up and how it came out in the unpacking.

If Asprotect sets any flags or addresses that are within the Asprotect memory range, any program code accessing these memory addresses in the unpacked file is going to fail anyway. So modifying this kind of flag call during unpacking won't really make a difference. Damned if you do, damned if you don't kind of situation.

I haven't really touched Asprotect for a while, so I don't know if it's gotten any trickier. Maybe someone else has some better insights into this problem.

Kayaker


UNP problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > UNP problems
PDA

View Full Version : UNP problems

mike
04-17-2001, 06:31 PM
Tried to unpack PKZipw.exe (latest windows version from pkware) using UNP but all it does is this:

>unp e pkzipw.exe pk2.exe

processing file : PKZIPW.EXE
DOS file size : 1748992
file-structure : New Executable ("PE")
EXE part sizes : header 512 bytes, image 195 bytes, overlay 1748285 bytes

>_

Any ideas? Or pointers to other unpackers that handle PKlite?
CoDe_InSiDe
04-18-2001, 12:21 AM
Hi mike,

Why not just do it Manually :)

Cya...

CoDe_InSiDe
everybody
04-18-2001, 05:09 AM
UNP is a DOS unpacker !

Use ProcDump to unpack PKLite for Win32 !
mike
04-18-2001, 11:27 AM
UNP is a DOS unpacker

Well, that would be a problem, wouldn't it? ;)

Thanks!


Help With SoftIce's Trace Back
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help With SoftIce's Trace Back
PDA

View Full Version : Help With SoftIce's Trace Back

???
04-18-2001, 11:12 AM
Hi,reversers
I am trying to learn to use SoftIce's Track back function.I think my step was right, but I still get a information that 'the trace buffer is empty', what's wrong???
I do as follow:
0. use loader
1. bpr xxxx xxxx t
2. xrset
3. bpx some_api
4. when break, do show b
5. get the 'trace buffer is empty' message.
Is there something wrong?
Regards!


SoftICE doesn't work on Windows XP beta
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE doesn't work on Windows XP beta
PDA

View Full Version : SoftICE doesn't work on Windows XP beta

Solomon
04-18-2001, 09:46 PM
My SoftICE is from DriverStudio v2.01.
I installed it on XP beta, the breakpoint doesn't work.
I heard that M$ has changed the system call instruction(the original is INT 2Eh) in XP, is it true?
D-G-R
04-20-2001, 02:58 AM
Hmmm, u mean u can install it and ctrl^d into it but the breakpoints just don't trigger...? If so, I'll give it a shot and find out. To check if what u think is true try hexeditng the value of the breakpoint (0x2e as u think) into an app and see if softice triggers... Else, try the same for the old breakpoint value.

Anywayz, I think I'll give it a shot as well... as soon as I get confirmed that u can normally install it.

Take care,

D.
Solomon
04-22-2001, 09:14 PM
sorry my previous post was not detailed.
SoftICE from DriverStudio v2.01 Final can be installed in WinXP beta 2462a, and no problem when setting a breakpoint with API name. It pops up as usual when CTRL-D hit. But it can't break when the API is called.

This code snippet is from ntoskrnl.exe of Win2K build 2195:

Exported fn(): ZwCreateFile - Ord:0416h
:004009C6 B820000000 mov eax, 00000020
:004009CB 8D542404 lea edx, dword ptr [esp+04]
:004009CF CD2E int 2E
:004009D1 C22C00 ret 002C

while the following is from ntoskrnl.exe of WinXP beta 2:

Exported fn(): ZwCreateFile - Ord:04D3h
:0043B211 B825000000 mov eax, 00000025
:0043B216 8D542404 lea edx, dword ptr [esp+04]
:0043B21A 9C pushfd
:0043B21B 6A08 push 00000008
:0043B21D E8EF89FEFF call 00423C11
:0043B222 C22C00 ret 002C

The "call 00423C11" seems to be "call KiSystemService", coz I have compared the above code at CS:00423C11 with the code of KiSystemService( ) from Win2K.
INT 2EH disappeared in WinXP?
DGR
04-24-2001, 07:15 AM
Hey, I just saw on the numega page that there's an update ntice.sys for softice in order to get it to work on windowsxp beta2 (2462)... u can find it here:

http://www.numega.com/drivercentral/icecentral.asp

Gonna install XP again in a few and try it out : )

Take care
DGR
04-24-2001, 10:01 AM
Woop : )

Just installed XP (and Softice) and with the special ntice.sys for WindowsXP it actually seems to work. Atleast it worked with a "bpx destroywindow" hehe.

So I'd say try it out... and now I can finally run XP as my sole OS ;)

Take care
Solomon
04-25-2001, 12:32 AM
hehe, thx DGR. I will try the new driver too.
DGR
04-25-2001, 06:51 AM
Blah, nevermind...

It does seem to work, somewhat but imo it's not really of any use yet. Breakpoints do work, sometimes... hard to say when they will and when they won't (most often they won't in my case). Meaning... when u do a "bpx Messageboxa" it sometimes snaps... but for the exact same app/situation the next time it won't.

Also when it does snap doing a "p ret" doesn't have the desirable result. Meaning, it won't go back to softice... the app just continues and u lost control again.

All in all, it's good to see that softice doesn't lock things up but it's too bad that it isn't worthy of using yet on this OS (which I really do like, heh).

Take care,

D.
matthew
12-10-2001, 07:32 PM
does anybody know where i can get the update for softice 4.05 to make it work in windows xp? the previously posted link doesnt work.. and i havent been able to find anything in their site.
Solomon
12-10-2001, 08:21 PM
Get DriverStudio 2.5 somewhere or wait for DS v2.6
That's the best choice:D

Originally posted by matthew
does anybody know where i can get the update for softice 4.05 to make it work in windows xp? the previously posted link doesnt work.. and i havent been able to find anything in their site.
matthew
12-11-2001, 11:29 PM
Does driver studio have a newer version of Softice then?
Looks like it from what I can see at the numega site.


help need sentinel lm sdk
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > help need sentinel lm sdk
PDA

View Full Version : help need sentinel lm sdk

chncrk
04-20-2001, 06:11 AM
need sentinel lm sdk tools!
pls help me.
PadsPCB
05-03-2001, 07:41 AM
Try at CrackZ
h**p://zencrack2.cjb.net/


Problem with SoftIce and Windows XP beta 2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problem with SoftIce and Windows XP beta 2
PDA

View Full Version : Problem with SoftIce and Windows XP beta 2

Seeker
04-22-2001, 08:49 AM
Hello reversers,

I cannot get Softice (the build coming with DriverStudio 2.01) to work with Windows XP
professional beta 2. No matter what I try, Softice won't break on any API call at all.

SoftIce installed and loads ok, CTRL-D works and "bpx <api function>" is accepted, but
to no avail. Any suggestions? Is is just an incompatible Softice version or am I missing
something here?

Thanks
Seeker
04-22-2001, 08:55 AM
Sorry, just noticed that there is already a related post on the board.
Mea maxima culpa .. :/


Backtrace Logging (Where the HELL is that???)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Backtrace Logging (Where the HELL is that???)
PDA

View Full Version : Backtrace Logging (Where the HELL is that???)

aimless
04-22-2001, 11:45 AM
Sofice logs is history buffer.

But cannot log the trace buffer. Many times, my correct codes are in the back trace. But inability to log really makes me tear out my hair!!!

Any ICE gods listening ??

Request assistance, please.

As ever
Kayaker
04-22-2001, 08:03 PM
Hiya,

I take it the problem isn't running or viewing the backtrace with SHOW or TRACE, but you'd like to be able to save the trace as you see it so you can peruse it at leisure and compare it with other traces. Yup, would be nice ;) Don't think it can be done though.

The backtrace buffer seems to only contain the addresses of each line executed within the backtrace range specified, not the actual opcodes. I guess this is done internally by SoftIce somehow when you select SHOW. You can find the actual buffer by doing a hex search in SI for one of your traced addresses.

I had asked this sort of question way back when, and Mr Smith, to give credit where due, scoped out that SI uses 7 Bytes per recorded EIP, 4 for the offset, 2 for the selector and 1 for the ring. So the asm line: "0167: 00401234" is recorded as:
34 12 40 00 67 01 03
immediately followed by the next.

So you could dump the entire buffer and write a proggy to convert the binary into an ASCII representation, but you'd still end up with only an address listing. Better than nothing for comparing purposes I guess.

The other option of course is to do screendumps of the SHOW display, a pain but at least you get the opcodes.

Hope this helps,

Kayaker


Softice Install! Need Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Install! Need Help
PDA

View Full Version : Softice Install! Need Help

F1DT
04-22-2001, 03:43 PM
Hi I am very new to all this and wish to install softICE
but have no Ideai how to do it or want i need.
I have downloaded it but don't know how to install it.
I downloaded it with Gozilla, which give me 4 zip files which i unzipped. There is now 1 file in each folder which i can not open, and i have no setup.EXE files. The files i have opened are devotion, file_id, firesite, MFD, ULS, all in notepad but the file which i can not open is mfdsi45.r01 which must have the setup.EXE file in it, this is the same in all 4 folders.
ThrillSeeker
04-22-2001, 08:06 PM
First Move the mfdsi45.rar, mfdsi45.r01, mfdsi45.r02, mfdsi45.r03 to a separate/same directory. They must be together. Then use WinAce/WinRar to open it. WinZip does not work. Once you installed WinRAR/WinAce then open the mfdsi45.rar file. extract, install, configure, and reverse :)

Any trouble tell me.


getting started with IDA need info
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > getting started with IDA need info
PDA

View Full Version : getting started with IDA need info

()whore
04-22-2001, 10:27 PM
I recently downloaded IDA and the learning curve is pretty hard with this program. Can anyone point me to good primers on IDA. I have read BlackB's IDA intro and mammon's ida primer essay. Any other good sources for learning how to use IDA?
Thanks
mo k
04-23-2001, 03:43 AM
there isn't much to it. once you learn the
basic configuration, and preference tweaking,
you will need to move to the advanced stuff:

1) scripting; it has a cool C-like language to
automate most of the disassembly. you
will need _m's paper for this, and keep the
official api reference printed out and handy.

2) writing plugins; this allows you to extend its
functionality. Amante4 has writen a paper on
this.

That is all there is to it. You don't have master
all the supported platforms, just master the
subset you need.
Muad'Dib
04-24-2001, 11:45 AM
I would recommend just playing with IDA a bit. Find a good protection and take a good look at it using all of the features of IDA. Just press different buttons and experiment with them as most of the buttons on the keyboard do something. The best way to learn (at least it was for me) is just to use it and fiddle around with all of the different functions and configurations until you learn something and find a configuration you like.


BoundsChecker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > BoundsChecker
PDA

View Full Version : BoundsChecker

p:g:
04-23-2001, 09:08 AM
Where can I get BoundsChecker 6.0x?
Thanks!


Win2k Multiple Monitor Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2k Multiple Monitor Problem
PDA

View Full Version : Win2k Multiple Monitor Problem

Timmy
04-23-2001, 11:46 AM
I have a P4 1.4 gig in a Dell Dimension 8100 running Win2k. It has a Matrox G400 max video card and the problem is that I can't get the sice window to appear on the second monitor. I have put the extra entries in the registry and obviously added MONITOR=1 in winice.dat. When initially using "set monitor" it says that monitor 1 is being used but the display is actually on monitor 0. At this point it does not show two available monitors. If I then do set monitor 0 and then set monitor to check, I have two available monitors. Regardless of which I select there are no errors but the sice window stays on monitor 0.

I have the exact same setup on another machine with win98se on it and there are no problems.

Any ideas chaps?


Breakpoints in Win2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Breakpoints in Win2K
PDA

View Full Version : Breakpoints in Win2K

Florin
04-24-2001, 12:31 PM
Does anybody know some good breakpoints in Win 2K? Hmemcpy doesn't exist, RtlMoveMemory has no effect; i know that the NT apis end in W, not in A, but the old breakpoints (GetWindowTextW, GetDlgItemTextW) do not seem to be working so well.


Breakpoints in Win2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Breakpoints in Win2K
PDA

View Full Version : Breakpoints in Win2K

Florin
04-24-2001, 12:32 PM
Does anybody know some good breakpoints in Win 2K? Hmemcpy doesn't exist, RtlMoveMemory has no effect; i know that the NT apis end in W, not in A, but the old breakpoints (GetWindowTextW, GetDlgItemTextW) do not seem to be working so well.
Solomon
04-25-2001, 12:47 AM
try ShowWindow, SoftModalMessageBox

If a prog uses Borland's VCL(it seems that VCL never call GetWindowTextA), why don't try the great tool called DeDe?


TRW2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > TRW2000
PDA

View Full Version : TRW2000

Andrei00
04-24-2001, 04:01 PM
Please if you know a crack for TRW2000 ver. 1.23 or a web page with the full version. I searched on the web but I couldn't find this.
Pleasea mail at andrei00@go.ro
Thanks

Andrei(andrei00@go.ro)
...
04-25-2001, 03:40 AM
"no Crack or Serial requests as it offends our intelligence."

"CRACK AND SERIAL REQUESTS WILL BE REMOVED."
ThrillSeeker
04-25-2001, 06:35 PM
F?????'s S?????????? has it.
I gave too much already.
n0de
05-23-2001, 02:49 PM
try lockless HQ


I request to change my Ethernet Address in my network card.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > I request to change my Ethernet Address in my network card.
PDA

View Full Version : I request to change my Ethernet Address in my network card.

Fernando4209
04-24-2001, 05:45 PM
Hello:

I request change my ethernet address in my network card (00-50-ba-46-69-20 for sample). I am working in Windows NT 4.0 and Windows Millenium. If you know how make it, please contact me. I worked with different tools, but i have not good results.

fernando4209@hotmail.com
mo k
04-24-2001, 08:04 PM
hate to brust your bubble, but, the number
is hardcoded into the card. what you can
do is spoof it at the OS level -- harder
in proprietry OSes.

the higher networking protocols query the driver
, so, imho, the best way to do it, is to make
the driver return the wrong address.

but be warned, MACs are as unique as IPs, so
if you spoof them, you might not receive the
incoming packets destined to the "fake" MAC.
i don't know much about this level of networking,
but if you wanna do this in a LAN, then the spoofing
might work perfectly.

Good luck
f0dder
04-25-2001, 05:11 AM
Isn't the MAC address added to the ethernet packet by the NIC?
That's the impression I've got after reading various documents -
I might be wrong, though. If it is, I can't see how you can be able to
fake the MAC address - unless you have a leet card that can be flashed :).
+SplAj
04-25-2001, 05:53 AM
Linux as a nice easy mac command line ! but I hate linux so..

I have a 3COM card in my Win2K Sp1 machine and can put in a valid mac address in the 'advanced' section driver manager setup of the NIC next to media type and flow control bla blah.

This is a nice new feature of Win2K (like Linux )

Also I have a notebook with PCMCIA card with win 98SE and this too has an option to set a mac address to the NIC. This is part of the PCMCIA driver and is not set by Win98SE.

I DL the commview 2.5 and this has a nice database of valid mac addresses to choose from ;)

I change my mac's regularly but I think my IP address gets me f*cked anyway ! , unless I play with the server ;)

SplAj


Breakpoint format in Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Breakpoint format in Softice
PDA

View Full Version : Breakpoint format in Softice

JMI
04-25-2001, 01:35 PM
I' running Softice 4.05 on Win98 and am attempting to get the program to break when a specific value is placed at a particular memmory address and only at that time. The value I'm seeking is the expected CRC value of the "unaltered" program. I know what the value is and where it is written into memory, which I believe is part of the stack. I'm trying to find the part of the code that fetches the value because it's encrypted in the file and I'm trying to understand where it's hidden and how its decrypted, even though I could just use what I've found to reverse the CRC check.

The problem is that this particular address is written to by hundreds of procedures, including most system calls. So bpm "address" w results in constant breaking. I've gotten close, but not found it yet. I started with rtfm, but it isn't very clear on how to break when a specific address contains a specific value.

I also tried bpm address==value, but that froze my machine a couple of times. I also tried an "if" statement but am not doing it correctly. Any help would be appreciated.


Please help with proper Softice breakpoint format??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Please help with proper Softice breakpoint format??
PDA

View Full Version : Please help with proper Softice breakpoint format??

JMI
04-27-2001, 02:12 PM
I'm using Softice 4.05 on Win98. I'm reversing a program and need to determine where the program is getting a data value which it puts at a particular address. The data is the "expected" CRC which resides somewhere in the file encrypted.

Because I've located the routine that uses this data to process for the CRC check to see if the code has been altered, I already know "what" it is and "where" it's stored. What I want is to find out how it got at that address and the routine to decrypt it. I don't really "need" to do this other than it will permit me to look at subsequent versions of the software and have some idea where this information is hidden. Learning for learning's sake.

I started with rtfm and then downloaded several articles on Softice breakpoints, but nothing works that I've tried.

I found one article that suggested using the "==" sign. so I tried bpm Address==data. The machine froze. I then tried an "if" statement using the "w" command. "bpm address w if (address==data)" This didn't work either. Part of the problem is that this specific address is written to by most of the system calls and I've already tried stepping through several hundred without reaching the goal.

Anyone who can point me to the correct format would be much appreciated. If it helps the data is a double word checksum of the unaltered file, so I also tried "bpmd" with several combinations. It's probably something simple I'm missing. That's part of what being a "newbie" is all about.

It seems that it should be rather trivial to get the d**n thing to stop when a specific value is written to a specific location. Thanx in advance.
All advise greatfully received.


softice w/ win98
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice w/ win98
PDA

View Full Version : softice w/ win98

desperate
04-27-2001, 09:35 PM
i'm running win98 and have tried using si 3.24 to no avail, when ctrl-d opens si my mouse locks up and my command keys won't work, thus the only exit is reboot i've tried every suggestion that i can find and nothing worked. so i've uninstalled 3.24 and installed 4.01 but the same problems still occur. there has to be some solution so i can run this program, if anyone knows it or can put me in touch w/someone or somewhere that can help me w/ this i would greatly appreciate it thank you


Here is a good tool for ActiveX cracking: TLBDBG
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Here is a good tool for ActiveX cracking: TLBDBG
PDA

View Full Version : Here is a good tool for ActiveX cracking: TLBDBG

Solomon
04-28-2001, 12:11 AM
It's written by our beloved Matt Pietrek, published in MSJ March 1999.
h**p://w*w.microsoft.com/msj/0399/comtype/comtype.htm

This tool uses 2 COM interfaces named ITypeLib & ITypeInfo(detailed in MSDN now) to extract symbolic info from an In-Process COM Server and generates corresponding *.MAP/*.DBG file. This will be a great help when you try to crack OCXs.

I don't know whether IDA itself or its plug-ins can do this.
Kilby!
04-30-2001, 07:39 PM
I have only worked on 2 ocxs.

I didn't found any difficultys with either.

Cept if you count finding a copy of delphi to test it with, and the buggy demo code supplied.

Kilby...
Ryan
05-01-2001, 11:37 AM
You can always try it on my ocx. I have been waiting for people to feedback to me but no one answered my call. My app is called RTSPS (forget about RT, SPS means software protection system)

http://rtsoft.cjb.net

Thanks!
Ryan
I need feedback. :)
br00t_4_c
05-28-2004, 03:43 PM
Solomon, thank you for that link. Who would have thought that this information would come in handy in 2004? :yay:


Problems with Soft Ice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems with Soft Ice
PDA

View Full Version : Problems with Soft Ice

stanks
04-29-2001, 02:05 AM
When i want to put a bp (any) for Delphi target Soft Ice is going down (i have blue screen). When i use Frog's Ice it is the same. What to do?

Thank you


SICE - configuration
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SICE - configuration
PDA

View Full Version : SICE - configuration

SolidSoul
04-29-2001, 09:21 AM
Hello, i need help !! in load of sice(winice.exe), ask for a file (C:\WINDOWS\SYSTEM\USER.MNS), i don't have this file ! what do i wrong? somebody can help me ??

sorry for my bad english :)


trw1.23
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > trw1.23
PDA

View Full Version : trw1.23

newbieforever
04-29-2001, 02:09 PM
hello
can anyone tell me where could i find a patch or how can i do to use trw1.23 with an azerty keyboard,reversing will be more easy for me with it.
thanks


Softice DriverStudio with Win2k And NVidia
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice DriverStudio with Win2k And NVidia
PDA

View Full Version : Softice DriverStudio with Win2k And NVidia

DarkSky
04-29-2001, 03:42 PM
hey i have windows 2k and nvidia and ive heard driverstudio is the only one that works with it. I just started cracking and have managed to patch a few small proggies and some easy marcomedia things. But then the sad gloomy day came when i got Windows 2k. I just need to find Driverstudio but my Bots and Peeps i know cant find them. Can someone tell me where to get it...or maybe email me with a link =) THX plenty


Sice / hmemcpy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Sice / hmemcpy
PDA

View Full Version : Sice / hmemcpy

Goat
04-29-2001, 09:05 PM
I've still not been able to set a breakpoint on hmemcpy in Softice on Windows Millenium. Hmemcpy isn't even included in the new kernel32.dll, which chaps my ass because its hard for a beginner reverser to thumb through tutorials that all use examples setting breakpoints on hmemcpy. When its possible, I'll bpx GetDlgItemTextA, GetWindowTextA, etc. but these don't always work. Has anyone found an alternative to hmemcpy(other than memcpy).


musthave littlelearningtool :P OllyDbg 103 step2 with code hit tracer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > musthave littlelearningtool :P OllyDbg 103 step2 with code hit tracer
PDA

View Full Version : musthave littlelearningtool :P OllyDbg 103 step2 with code hit tracer

_nn
05-01-2001, 04:06 AM
main page
http://home.t-online.de/home/Ollydbg/

Intermediate version 1.03
http://home.t-online.de/home/Ollydbg/odbg103.zip

messageboard
http://www.ollydbg.f2s.com/

thnx


Using Special characters in SI breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Using Special characters in SI breakpoints
PDA

View Full Version : Using Special characters in SI breakpoints

HP4000N
05-03-2001, 10:30 AM
Hi,

I'm having troubles putting SI breakpoints on functions with special names. Sometimes a function has a name like ?OnCreate@Cdlg and
bpx ?OnCreate@Cdlg doesnt work in this case, due to the question mark. Is there a method to use special characters with SI breakpoints ?

THanX


cracking tool for 3d studio viz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > cracking tool for 3d studio viz
PDA

View Full Version : cracking tool for 3d studio viz

malecave
05-05-2001, 05:29 AM
needs help cracking hardware lock of 3d studio viz


ida function arguments
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ida function arguments
PDA

View Full Version : ida function arguments

noone
05-05-2001, 06:15 PM
I'm working in a function with bp based frame and a typical instruction might be: mov ecx, [bp+arg_4].

The IDC function GetOpnd(ea,1) returns the string: [bp+arg_4], and GetFlags will tell me that [bp+arg_4] is a stack variable.

But which function will get me the Member Offset within the frame of arg_4 directly from the operand [bp+arg_4].

I can parse the [bp+arg_4] string and use GetMemberOffset(id,arg_4), but sometimes I have re-named the arguments or the operand looks like [bp+38h+arg_4], etc. There must be a built-in function I'm missing.

Thanks in advance.


hardware lock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > hardware lock
PDA

View Full Version : hardware lock

leca
05-05-2001, 06:31 PM
I'm trying to use w32dsm to disassemble 3d studio viz 3i, viz.exe, and core.dll. but it keeps on running the program and looking fo rthe hardware lock. Am I using the right tool? I'm new and got interested in cracking this program. Do you have a step by step procedure in cracking the dongle?
Muad'Dib
05-07-2001, 12:03 PM
It is generally better (IMO) to use IDA to crack/reverse dongle protected programs. IDA is a lot better at recognizing patterns and there are signature files that recognize the important functions of many types of dongles. I'd recommend you get IDA and then visit Zen's site (http://zencrack2.cjb.net) for more dongle information.


IDA Pro SDK
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA Pro SDK
PDA

View Full Version : IDA Pro SDK

tester
05-08-2001, 08:31 AM
I'm tired of writing IDC scripts - can anyone point me to the SDK?

Thx
mo k
05-11-2001, 10:51 PM
Poor coders/reversers, they will never
understand business.

Quick: how do you make more money, if you
release a top of the line category killer piece
of app?
Answer: you update it as frequently as possible.

With thousands of copies warazed, DR could
never make another piece of bread, without
forcing users to upgrade.

The domain of their application is extremely limited.
How many processors can you support? how
many file formats?
Simply there will come a point were they will
just freeze it, or head to another direction:
decompilation/automatic binary analysis/emulation etc.

And they know this, so they will do everything
in their hand to delay this day, and would
thinkup many little tidbits to add to each
release and boost the version.
Just look at microsoft, how many years is it
milking windows?

DR is in an even deeper shit, their target
customers "live" in/with piracy --although
secretly, and usually choose the cheaper
alternative.

Ilfak if you are reading this, don't waste your
time maintaining the same shit you wrote ten
years ago, there is plenty of room for innovation.
Just hand it over to another coder, and comeup
with something else, less appealing to crackerdom.

I would recommend processor bench-marking
software for one, or optimizing compilers.

Look into clustering technology: a single
thread safe math library can take you of the
belgique getho.

Nuff crap, go ahead folks, shoot me.


sigmake ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > sigmake ??
PDA

View Full Version : sigmake ??

wzj
05-08-2001, 11:12 AM
Where can I get sigmake ?

Thanks!


Autoexec.bat +WindowsME + Softice problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Autoexec.bat +WindowsME + Softice problem
PDA

View Full Version : Autoexec.bat +WindowsME + Softice problem

RogerBacon
05-10-2001, 04:16 PM
My fellow reverse-engineerers,

I have an interesting problem. I’m trying to install Softice, but every time I try to add a line to my Autoexec.bat file the changes I make get over-written upon re-boot. I am running Windows Me. Do you know what is causing this? I have Norton Anti virus, but I disabled that and that didn’t help any. ANY changes I make to Autoexec.bat are over-written, even if its just a REM statement. Any insight you can offer would be appreciated.

Thanks,

Roger Bacon
RogerBacon
05-10-2001, 04:32 PM
OK, I found Stank's post over in the other forum. I downloaded the file and will give it a go tonight. Thanks for the help Stank. I guess I should have read some more before asking for help.
For any others who might be having the same problem, I'll re-post his solution below.

Roger Bacon

"Go to protools.cjb.net and d/l loader for SoftIce for WinME, and run it. That's it.
Bye"


boundschecker 'BCHK' interface patch offsets
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > boundschecker 'BCHK' interface patch offsets
PDA

View Full Version : boundschecker 'BCHK' interface patch offsets

ice
05-13-2001, 09:23 PM
Does anyone know the offsets to change the magic numbers in boundschecker ?
Using v6.01 c++ version...... :)

Softice patcher works great but I still like boundschecker events!

Softice is using new numbers already.. the best anti-detection method yet :))
Post or mail any ideas or offsets :))
Thanks!


Need a beta tester(W32Dasm v8.93 patch)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Need a beta tester(W32Dasm v8.93 patch)
PDA

View Full Version : Need a beta tester(W32Dasm v8.93 patch)

Cold Coder(aka 90h , nop90h)
05-21-2001, 07:56 PM
This what i need some one that uses w2k and W32Dasm v8.93. So i can see if Harlequin CommandLine patch(as i use a edit ver in my patch) work now/or not in w2k. If you went to test this post your e-mail.

Thanks,
Cold Coder
zeroone
05-22-2001, 05:28 PM
can i become a beta tester?
email:zeroone1975@yahoo.com
Cold Coder
05-22-2001, 06:29 PM
> can i become a beta tester?
Well if you use win2k and W32Dasm v8.93 then you can.

PS.
I e-mail you the patch.

Cold Coder,
Thanks


Win2k SP2 + Softice == Bad News?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2k SP2 + Softice == Bad News?
PDA

View Full Version : Win2k SP2 + Softice == Bad News?

DGR
05-22-2001, 02:50 AM
Lo all...

What I was wondering, when I installed SP2 on Windows2000 softice suddenly started acting all weird. (The same as it acts with WindowsXP). That is, breakpoints don't always snap, doing a 'p ret' hardly ever snaps (ie, u don't go back into sice and the program just runs as if nothing is wrong).Things like that...

All in all it makes softice almost useless imo. I tried it with softice's ranging from the Dirverstudio 1.5, 2.0, 2.01 and even the newest beta. All with the same result. Anyone else who has noticed this? Or is it just me...

Take care,

D.
roocoon
05-22-2001, 06:09 AM
Similar things here. Interrupts on API calls didn't work on the single app I tried after SP2.
Window messages also. The wrong ones activated the breakpoint.
The problem might be the wrong symbols though (I still have the SP1 ones).
I'm getting the SP2 symbols now and check it again later.
They are here if you want to get them:
http://www.microsoft.com/windows2000/downloads/servicepacks/sp2/debug/default.asp
DGR
05-22-2001, 05:47 PM
Hmmm, actually I never use(d) those symbols and never had problems before... what's the use of those things exactly?

Cheers,

D.
DGR
05-23-2001, 04:52 AM
ah, I see...

Would I have to load just the symbols from the dll's I export (like kernel32.dll, user32.dll) or only the ntoskrnl.exe one.

About the driver remark, only problem I used to have with bad drivers (having a geforce2 mx with detonators myself) was the display of softice. Or total lockups... Now softice comes up just fine, it's just doesn't 'take control' so to say. Also, with SP1 and the latter softices I had no probs at all, it is something new with SP2.

Cheers and take care,

D.
Anticode
05-30-2001, 07:07 AM
There is an update for sp2:
h**p://www.numega.com/drivercentral/utilfiles/ntice.sys
Hopes it helps.

Cheers.
DGR
05-31-2001, 01:38 PM
Hmmm, it seems to be a newer build of ntice.sys then the one for xp beta2 (which didn't work either) so I think I'll give it a try... Also coz of the fact my puter is goin unstable as hell so I might need to reinstall newayz ;)

I'll keep y'all posted...
DGR
06-01-2001, 05:46 PM
Welps, installed Win2k sp2 and after using the file mentioned above everything works fine... Just so ya know ;)

Take care,

D.
harry
06-15-2001, 09:24 AM
yes it's works fine , but only with english keyboard layout in sice :(

cu harry
winworm
06-22-2001, 10:39 AM
But icedump can't work again after renew ntice.sys!!!!!!!
Joe Doe
06-24-2001, 02:35 PM
Thank you Thank you!! I've had this problem too. I found a section in the Readme.htm that came w SI saying that the kernal symbols may not load properly for Win 2k builds after 2031. I guess this is the problem. In my case however when I tried doing some of the things it said in the readme, it locked up my mouse. So I tried to dl the Microsoft symbols pack as in the above post. 74 megabytes latter, the install program that came with the sybols program locked up. It also disabled my mouse(i'm using a laptop w some funky mouse drivers). So I just kinda gave in and removed SP2. This freed up 200+ megs from my harddrive. My system is also responding much faster. I think next week I will remove all of Windows. I can't wait to see how fast my system runs them!!!
Lord Cheese
07-01-2001, 08:20 AM
i keep getting a clicking sound every time there is hard disk access when i have softice loaded and connected to the internet. I run Win2k SP2, but is the problem something non-sp2 releated? btw, im a newbie to this cracking stuff :)
drak0
07-08-2001, 03:13 PM
Hi, are all you guys using the newest beta version of driverstudio? I'm using 2.0.1 and SI freezes w/ sp2 :(

-drak0

ArthaXerXes (06-05-2001 07:41):
Just to report it works fine for me too.
DGR
07-11-2001, 04:15 AM
Get the updated ntice.sys for SP2 from numega.com


Where can I get the newest vesion of generatekey!!!???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Where can I get the newest vesion of generatekey!!!???
PDA

View Full Version : Where can I get the newest vesion of generatekey!!!???

yxwindy
05-23-2001, 05:29 AM
Somebody can tell me where I can get this software,thanks!!!!!
please tell me the address or directly e_mail to yxwindy@sohu.com
stillnewbie
05-23-2001, 06:11 AM
Search the web


DevPartner Studio
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DevPartner Studio
PDA

View Full Version : DevPartner Studio

lpvoid
05-23-2001, 03:46 PM
Has anyone fixed the Compuware DevPartner Studio license bug (it requires one) yet? Has anyone even attempted it yet?

lpvoid


Some problem with proxies may arise here...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Some problem with proxies may arise here...
PDA

View Full Version : Some problem with proxies may arise here...

tsehp
05-23-2001, 07:28 PM
Hi,
I'm forced to ban more and more proxies to impeach a really-not-wanted-here guy (golem) to come here and flood us with his knowledge. He actually could have exhausted all his direct ip's, and now is using some anonymous proxies.
I'm forced to ban also those anonymous proxies he's using, so this could impeach yourself to connect on the messageboard.
If this happens, the only fast and working solution is to make a direct connection, sorry for this. I don't want to set a messageboard with messages to moderate before publishing or registering people before publishing messages, this is not needed actually.

Sorry for the problems,

+Tsehp


IDA problems (or problems with me)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA problems (or problems with me)?
PDA

View Full Version : IDA problems (or problems with me)?

stanks
05-26-2001, 04:43 PM
Hi

I have a problems with IDA.
When i select module that IDA want it, it always says:
"File xxx can't be accepted as module 'xxx'"
I try to unpack it, but the result is same (help don't work)
I am doing something wrong...what?

Thank you
Zebulon
05-26-2001, 06:33 PM
Looks like your using the pirated 4.04 version of IDA. I think it's a bug but I never really investingated. I have the same problem so that's why I stopped using it. There are two options: 1.buy it 2.Get the freeware and the Automatic parameters recognition script for IDA v.4.04+ by +Spath.
[NtSC]
06-02-2001, 06:36 AM
The v4.04 Shock Version also seems
to have that cannot accept Problem
aimless
06-04-2001, 07:48 AM
IDA.

WHACKED OFF SHOCK FTP SITE

NO PROBLEMS.

WORKS OK FOR ME.

WHAT FILE GIVEZ YOU THIS ERROR WHILST OPENING...?

CHEERS.
stanks
06-04-2001, 10:49 AM
Hi!

What do you mean "What file"? When i am disassembling exe file, and IDA want dll, then IDA says that it can't accept this file (dll) as this dll....bla...bla...bla.

greetz
Shadz
06-04-2001, 08:06 PM
ArthaXerXes (05-30-2001 07:24):
3.get the 4.15 crack ;-)

I have a strange one with 4.04 pirated, the status bar disapeared ! No way to get it back.

There is a registry key that sets the dimentions of the status window. Find it and your problem will be fixed.
the_lover
06-06-2001, 11:55 AM
If I really have understanded what your problem is, there is nothing wrong in your IDA v4.04.

When IDA tells you "Please select module for xxxx.DLL" it is asking you the .IDS module for that DLL. This module contains the necessary informations about your required DLL and more.

You can then generate your own module for the DLL using the provided tools.

Regards ;)


SoftICE and PFE?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE and PFE?
PDA

View Full Version : SoftICE and PFE?

stan
05-27-2001, 11:56 PM
I use PFE2000 to find out the address is : 015D5960
so that I use SoftIce to set the break point :
bmp 0028:015D5960 W
G==>ENTER
When the data is changging, the softICE has not any response for breaking.
Why?
I use Uedit, but could not find out the 015D5960.

How can I find out it and modify it?

Thanks .


softice not showing up?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice not showing up?
PDA

View Full Version : softice not showing up?

some dude
05-29-2001, 08:35 PM
on win2k, tnt card. when i start softice, then hit ctrl + d... it seems it comes up, but i cannot see the black dialog?! what?!!! how can i fix this m8's? :)
An Eyewitness
06-06-2001, 07:24 AM
I have a similar system and the same problem. I'll tell you if I manage to make it work.
An Eyewitness
06-16-2001, 08:36 AM
I managed to make it work by removing my tnt2 drivers, but that 640x400, 16 color vga mode isn't really great. :(
morlac.
06-17-2001, 07:08 PM
Hi All,

Im using a Radeon card and i had the same problem.
It was solved by changing the color depth when sIce refuses to show up. Try it, might work. Nothing specific. Just change from anything to anything. In my case, i changed from 32-bit to 16-bit and it was solved.

Morlac
yoda
06-18-2001, 12:51 PM
Hi !

I've the same prob. Also w2k.
video card: Else Gladiac 511
:(
+SplAj
06-19-2001, 03:51 AM
I found it to be the refresh rate not color depth that hides the ice for my PC.

I have an Hercules 3D prophet with Win2K and a 19" thingy and regardless of which DS 'ntice.sys' version I try (currently 2.01 build 57) the only solution for me is to switch to 75hz then back up to 85hz. ............SI reappears :)

I tried all versions of Nvidia reference drivers and Hercules drivers, same shit :(

After the screensaver kicks in I have to re-do the above !

Hope it helps,.......... I thought ArthaXerxes was looking after this topic ;)
+SplAj
06-19-2001, 06:05 AM
mmmm ....had 5 mins lunch and searched numega. Found no refs to nvidia or geforce but got one similar problem for 'crap (j/k)' vga card :-

DoInt2DPatch ?

http://www.numega.com/support/knowledgebase/docs/707.stm

BUT still I remember that numega posted something about the vga frequency being a problem ....over 85hz ?

ArthaXerXes can add this to the faq if it's relevant ?
slide
06-20-2001, 03:21 PM
would it be a sin to ask for the ntice.sys from Driver Studio 2 to help fix some of our problems?
+SplAj
06-21-2001, 03:56 AM
thanks to Anticode ;)

h**p://www.numega.com/drivercentral/utilfiles/ntice.sys

ArthaXerXes :- DVD or VHS ?
qferret
06-22-2001, 08:15 PM
ArthaXerXes (06-22-2001 02:04):

+s : What is VHS ? :-)

...Kinda like Beta only it still exists on most planes of reality 8)
Kruemel K
06-26-2001, 04:54 PM
Get the asus Detonators,
install, in games press STRG+ALT+D
if the osd is enabled, sofice always pop's up !!!


Looking for PEeditor 1.7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Looking for PEeditor 1.7
PDA

View Full Version : Looking for PEeditor 1.7

bobik
06-01-2001, 11:32 AM
Looking for PEeditor 1.7

THX
DakienDX
06-01-2001, 11:40 AM
Hello bobik !

What about here (http://www.suddendischarge.com/file.search?site=sd&archives=off&details=on&size=on&type=on&date=on&author=on&name=on&homepage=on&rpp=10&o=desc&s=date&ud=1&lr=0&searchstring=PEditor) ?
bobik
06-01-2001, 11:43 AM
Thank U,
I have post because last night SD site was offline
aimless
06-04-2001, 07:50 AM
ALTO SITE...

PROTOOLS.CJB.NET

CHEERS


ICEDUMP Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ICEDUMP Problem
PDA

View Full Version : ICEDUMP Problem

bobik
06-01-2001, 11:36 AM
ICEDUMP Problem

any time i try to dump

I get message inside Softice window
"INT0d soft ice fault"
and system hangs, only hboot helps

What is wrong with me ? Int0d is used for LPT2 I dont have any ?

SoftIce 4.05.334 & Correct version if icedump


S-ICE && full screen mode
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > S-ICE && full screen mode
PDA

View Full Version : S-ICE && full screen mode

YaTaGaN
06-04-2001, 06:41 AM
I have the latest verzion of Soft-Ice, and I can't get it working in full screen. When I type "lines" and "width" over some numba, it's kraping something about wrapping, and refuses to strech. Because now I can see parts of windoze in the corners, it looks like windoze'z more powerfull than da SICE... :) How 2 fix that?

TIA,
YaTaGaN
aimless
06-04-2001, 07:47 AM
GIVE COMMAND IN WINICE.DAT...

SET MAXIMIZE ON

THAT SHOULD DO FOR WHATEVER RESOLUTION YOU ARE IN.
YaTaGaN
06-15-2001, 09:37 AM
aimless (06-04-2001 05:47):
GIVE COMMAND IN WINICE.DAT...

SET MAXIMIZE ON

THAT SHOULD DO FOR WHATEVER RESOLUTION YOU ARE IN.

Sorry, but that doesn't work for me... ;(
I still can't get it working in full screen!

Is there some patch 2 fix this or something... ?


Softice's ? (evaluate) command problems...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice's ? (evaluate) command problems...
PDA

View Full Version : Softice's ? (evaluate) command problems...

DGR
06-04-2001, 10:33 AM
Lo all,

I'm now running sice on win2ksp2 (using the updated ntice.sys from numega) but now I have this problem... when doing an evaluate of a value I only get the hex-values, not decimal. For example, doing a "? 0x1A" resutls is the following:

unsigned long = ox1A, "\x1A"

But I also want to see the hex-values... is there some setting which needs to be changed? Or some other command which can be used?

Thanx in advance.

Take care,

D.
DGR
06-04-2001, 10:35 AM
Crap, I meant to say that I also want to see the decimal values (not just the hex-values).

D.
qferret
06-06-2001, 09:32 PM
try this

? # <expression>
qferret
06-06-2001, 09:34 PM
....I should add the fact that while debugging with symbols (.nms) loaded, I get the same output as you....it works if I use the method I suggested though (but I debug in Win98)
DGR
06-08-2001, 04:13 AM
Hmmm, haven't tried that one... tnx.

But I already got rid of sp2... seemed like there was some memory leak (win2k using 150 megs of ram after a while without me running any programs) but I'll keep it in mind for the next time ;)

Cheers and take care,

D.


To Kayaker, Is this the right place? ;)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > To Kayaker, Is this the right place? ;)
PDA

View Full Version : To Kayaker, Is this the right place? ;)

CoDe_InSiDe
06-05-2001, 04:15 AM
Hi Kayaker,

Can you be a little bit more detailed about SoftICE-Is-Overheating-My-CPU-While-Debugging-Or-Playing-A-Game? ;)

Cya...

CoDe_InSiDe
Kayaker
06-05-2001, 07:35 PM
Hi Code_Inside,

This place should do better for the topic I guess just so we don't mess up what looks like a beta-protection testing thread ;)

The original question was (I think) why does your computer crap out after being in SoftIce for a short period of time, or playing games. Does your computer actually shut down while you're in SI?

I had noticed when playing Quake at a nutso rate with full graphics and weapons blaring that my computer would suddenly shut off. I raised the CPU shutoff temp in BIOS by 5 or 10 degrees to 90'C and it was OK after that. That's all, probably nothing surprising there, just tells me I should install another fan.

I've never had SI shut down on me in that way though, so I'm not sure what might be causing that with you and ?ferret. I'm not real fluent with Windows operating system privileges, but I gather regular Win programs run in Ring 3, SoftIce has a greater control over the system at Ring 0, and I would assume BIOS has a greater privilege yet. So I'm guessing that the BIOS CPU temp monitor would continue to give accurate readings while you're in SoftIce, so shouldn't shut the system down in error.

Maybe you have a non-BIOS temp monitor, or scheduler or timer or something that somehow shuts down the system if it's not receiving feedback while SoftIce is being used? Just guessing here, but that would seem to indicate that at least part of it is running at the same privelege level as SoftIce, else like most Ring 3 programs it should be "blind" to the fact that it's not actually running.

So what exactly is the abnormal SoftIce behaviour you see?

Kayaker
qferret
06-05-2001, 08:27 PM
for me it's usually the moment I finally exit SoftIce.....hardboot right when I hit cntrl-d (although occasionally I get an error within Softice and the softice screen freezes and I have to hit the power button to get out (-: )

I don't think I have a monitor, but I do run a bit warm (K6 II processor and a Maxtor HD [Bad combo for heat buildup hehe])
CoDe_InSiDe
06-06-2001, 12:28 AM
Hi Kayaker, Qferret,

Well let me explain what it does exactly ;)

Let's say if i'm in Win for a couple of hours (say 6,7 hours) there's totally no problem, it runs fine :)
But when i'm in SoftICE for about 30 minutes (It's not always the same time limit, it differs, sometimes it's already after 5 minutes ;) ) my Computer starts beeping like crazy.
And when i press Ctrl+D (Or whatever shortcut to quit SoftICE ;) ) the beeping stops (sometimes).
If it doesn't stop i need to shutdown/restart my Computer (i think Shutdown is better because of some cooling down ? ).
If i'm playing a game (It always happens in Halflife, Multiplayer) then i can play for a period of time and my Computer starts beeping again :)
Then i quit to the Main Menu of Halflife and the beeping stops (always).

And another thing, i got sometimes (i think just 1 or 2 times) an Error message when i started up my Computer (in the screen where you can enter the BIOS) it don't remember exactly what it says but it's something like "blah, blah, check your Power Management Setup".
And if i check there i see some temperature thing by the Internal Monitor that gives an Error, something like "60c / 145c [Err]" :)

Don't blame me if i say something wrong here, because i've got like 15% knowledge about Hardware stuff ;D

Cya...

CoDe_InSiDe

P.S. maybe this sounds stupid but i also think it has something to do with the weather ;)
When it's cold i can most of the time debug or play a game longer then when it's hot :)
Oh and one other thing (Maybe i should quit with that :( ) i think i smoke to much on my room ;D
heh...
esther
06-07-2001, 10:41 AM
CoDe_InSiDe (06-05-2001 22:28):
Hi Kayaker, Qferret,

Well let me explain what it does exactly ;)

Let's say if i'm in Win for a couple of hours (say 6,7 hours) there's totally no problem, it runs fine :)
But when i'm in SoftICE for about 30 minutes (It's not always the same time limit, it differs, sometimes it's already after 5 minutes ;) ) my Computer starts beeping like crazy.
And when i press Ctrl+D (Or whatever shortcut to quit SoftICE ;) ) the beeping stops (sometimes).
If it doesn't stop i need to shutdown/restart my Computer (i think Shutdown is better because of some cooling down ? ).
If i'm playing a game (It always happens in Halflife, Multiplayer) then i can play for a period of time and my Computer starts beeping again :)
Then i quit to the Main Menu of Halflife and the beeping stops (always).

And another thing, i got sometimes (i think just 1 or 2 times) an Error message when i started up my Computer (in the screen where you can enter the BIOS) it don't remember exactly what it says but it's something like "blah, blah, check your Power Management Setup".
And if i check there i see some temperature thing by the Internal Monitor that gives an Error, something like "60c / 145c [Err]" :)

Don't blame me if i say something wrong here, because i've got like 15% knowledge about Hardware stuff ;D

Cya...

CoDe_InSiDe

P.S. maybe this sounds stupid but i also think it has something to do with the weather ;)
When it's cold i can most of the time debug or play a game longer then when it's hot :)
Oh and one other thing (Maybe i should quit with that :( ) i think i smoke to much on my room ;D
heh...

Heya Code_Inside,
>(i think just 1 or 2 times) an Error message >when i started up my Computer (in the screen >where you can enter the BIOS) it don't >remember exactly what it says but it's >something like "blah, blah, check your Power >Management Setup".

Just an idea,this might solve your problem,disabled Power Management in cmos
it might help :).I'm not a good troubleshooter but the errors tells you that something configuration about power management.Hope this helps
>maybe this sounds stupid but i also think it >has something to do with the weather ;) sure it is :P

regards
esther
CoDe_InSiDe
06-07-2001, 12:30 PM
Hi esther,

Thx for the reply :)
I'm gonna try that ;)

Cya...

CoDe_InSiDe
CoDe_InSiDe
06-08-2001, 03:50 PM
Hi esther,

Ok, i tried to Disable (ignore) the Temperature monitor or something :)
And i think it works ;)
But...

First i got the "beeping" because something was overheating, but now i don't get the "beeping" anymore but now i also don't know if it's overheating or not? :)
So then i won't be "alarmed" and maybe all of a sudden the whole building goes in flames ;)
Am i right or wrong? :)

Cya...

CoDe_InSiDe
esther
06-10-2001, 04:46 AM
CoDe_InSiDe (06-08-2001 13:50):
Hi esther,

Ok, i tried to Disable (ignore) the Temperature monitor or something :)
And i think it works ;)
But...

First i got the "beeping" because something was overheating, but now i don't get the "beeping" anymore but now i also don't know if it's overheating or not? :)
So then i won't be "alarmed" and maybe all of a sudden the whole building goes in flames ;)
Am i right or wrong? :)

Cya...

CoDe_InSiDe

hi Code_Inside,

Sorry for the late reply.
My monitor differs from yours I don't have a
thermometer with tells me how hot it is.I didn't use
my pc for such long hrs :P

After you disabled this does your debugger or playing
games hangs on win?

The cmos setting in power management that you have
disabled does it have any other options like user define?
If you choose user define you can set it 1 hr on
Doze mode and leave other options untouched.
Below is my erm Main board user guide options
it might be different from yours :P.

Power Mannagement:user define,max saving,min saving

Doze:1min-1hr

The other thing is in the control panel
theres also a option on power management you can turn on
or off the monitor automatically 1min-5hrs but it will
affect the debugging the best option is 5hrs because you
are using it long hrs. I never turn off the harddisk
option though coz it will affect debugging too...

Hope this helps :P
ps:>First i got the "beeping" because >something was overheating, but now i don't >get the "beeping" anymore but now i also >don't know if it's overheating or not? :)
>So then i won't be "alarmed" and maybe all >of a sudden the whole building goes in >flames ;)
>Am i right or wrong? :)
Well don't worry ,it won't flame the whole building your monitor will just blown off :D
CoDe_InSiDe
06-10-2001, 01:03 PM
Hi esther,

"After you disabled this does your debugger or playing
games hangs on win?"

No they don't :)
I haven't got any weird reactions or something, while i'm Debugging or playing a Game :)

"The cmos setting in power management that you have
disabled does it have any other options like user define?"

Hmm, i haven't seen some option where i can set the time :)
And the thing in Control Panel, i know those options, but my brother said that i needed to put all those options off, that was better :)

"Well don't worry ,it won't flame the whole building your monitor will just blown off"

HAHAHA ;D ......................... Damn ;)
Thanks anyway for helping :) , because i CAN Debug and play a game now no matter how long ;D

Cya...

CoDe_InSiDe

P.S. Damn i love this face " ;D " ;)


error during translation...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > error during translation...
PDA

View Full Version : error during translation...

NorXor
06-06-2001, 10:30 AM
Hello,
I have SIce4.05 on w2k.When i translate the module in
Symbol Loader always pops up message:An error ocurred
during symbol translation/load.I click OK on next prompt:
Load executable anyway,SIce pops up and i see the program
,ok so far so good......the problem is when the module starts running
and when second time SIce pops up the module is gone and
back come some system modules(ntoskrnl!)
SIce also gives message Break due to symbol loader.....
Why do modules disappear,what s the problem in translation?
As i read, symbol loader should extract debug information
by itself from modules and make certain .nms file,but
there aren`t such files.....
Is something wrong or I just dont understand the
funcionality of this??


Attacking DELPHI 1.0 target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Attacking DELPHI 1.0 target
PDA

View Full Version : Attacking DELPHI 1.0 target

the_lover
06-06-2001, 12:01 PM
I am cracking an application written in DELPHI 1.0. The first thing I thought was of using Dede. But this fails,as the program contains a DEBUGGER check.

I turned then to the good old IDA Pro,but I have got no DELPHI 1.0 signatures.

Anyone does know where to get them,or where to get a delphi decompiler that does not crash? I tried Dede and Revendepro.

Thanks in advice >(


SoftIce Backtrace buffer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce Backtrace buffer
PDA

View Full Version : SoftIce Backtrace buffer

qferret
06-06-2001, 09:39 PM
HI all,

If you've been reading some of the other threads, you may have seen that I have kind of a strange crash problem when in sice too long (but only when the SoftIce window is active)

Anyway, is there any way to dump the backtrace buffer to a file to peruse through later?

If there's no documented way, I wonder if using /dump command in IceDump on the mem range where the buffer is stored would work?
Kayaker
06-07-2001, 09:48 AM
Hi ?ferret,

LOL, you just earned an addition to the FAQ ^_^ This one seems to come up a lot:

http://www.woodmann.net/Ultraboard/Public/HTML/B8/1550-1.topic.html

http://www.woodmann.net/Ultraboard/Public/HTML/B6/748-1.topic.html

I'll write something up for the FAQ.

Kayaker
qferret
06-07-2001, 06:28 PM
/me blushes & grins sheepishly

Thx Kayaker....the addresses is all I really need for my purposes (tracing a few possible execution routes) Once I find the critical branches I can look in a dissassembly listing ;-)

S'pose I should check that there new fangled search thingy sometimes huh? :D
qferret
06-07-2001, 09:29 PM
hmmm......fault int 0d ....or something closely resembling that wording (0D is for sure though)...when I try to dump the mem range:
(/dump 0030:C24A3A24 70 C:\Windows\Desktop\badserial.bin)

Is this memory area somehow restricted from dumping (Don't see how) or is this possibly related to my other SoftIce problem?

...or maybe just needed to reboot, will try again, but I doubt if it will work :*(
qferret
06-07-2001, 09:32 PM
LMAO...damn emoticons...the one I put in was a crying sad face (no graphic available LOL)

:+*+( != :*( ...or does it? hmmm ???


Search for 'IT Add by SV'
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Search for 'IT Add by SV'
PDA

View Full Version : Search for 'IT Add by SV'

Instructor
06-07-2001, 12:57 AM
Hi, I search for the tool: 'IT Add by SV',
who can help me?
thx a lot
stillnewbie
06-07-2001, 05:24 AM
Instructor (06-06-2001 22:57):
Hi, I search for the tool: 'IT Add by SV',
who can help me?
thx a lot

You are helpless :p
Url?=woodmann+Tsehp=IT ADD by SV

:D


SoftIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce
PDA

View Full Version : SoftIce

Taipanman
06-07-2001, 04:08 AM
I am wondering if anyone can tell me where I can get a copy of this program, as I am just learning the art of Cracking.

Thanx
NorXor
06-07-2001, 04:30 AM
Try www.crackstore.com
Eternal Bliss
06-07-2001, 04:39 AM
Taipanman (06-07-2001 02:08):
I am wondering if anyone can tell me where I can get a copy of this program, as I am just learning the art of Cracking.

Thanx

The art of cracking involves learning how to search. Try this http://www.programmerstools.com/
from there, if you can't find what you want, go to its links and so on.

Learning to search will be helpful for you when you really start cracking and searching for serials, code segments and so on.

Good luck
EB


IDA / symbol loading Q..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA / symbol loading Q..
PDA

View Full Version : IDA / symbol loading Q..

Znah
06-08-2001, 11:21 PM
Heya people.

Err, forgive me if this is a lame-o question and/or I've posted it to the wrong board, but I figure ya gotta start somewhere..

Anyway, I'm working on reversing a WDM driver that was obviously built with NTDEBUG *not* set to "retail" ;-), so I have all of the internal symbols on hand, which is cool, but..

Although I can load the symbol table to SoftIce, and have used the SoftIce history to save the symbol names to a text file for bedtime reading, I'd like to know how to load the same symbols with IDA.

Is there a cfg file setting, or an IDC script, or some other way of getting IDA to load the symbols so that I can see the names in the disassembly listing?

Of course, I have no header, nor DBG, nor MAP files.

I realise that typically we'd be using IDA to produce the MAP for SoftIce, but I seem to want to do the inverse (err.. reverse? :-P).

Well, any help appreciated (and apologies if this is somehow covered in Idaprimer or Idaprimer2..).

Regards,

Znah
Znah
06-10-2001, 11:03 PM
Err.. nevermind, looks like IDA 4.15 can now handle WDM files (I was still on 4.04 - doh!).

Thanks anyway. :-)

Znah


screendump function for icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > screendump function for icedump
PDA

View Full Version : screendump function for icedump

Eternal Bliss
06-09-2001, 06:01 AM
Hi,
recently I tried meddling with /screendump and had crashes everytime I do it.
Computer: PII 350MHz, 128MB
Softice: 4.05.334
Icedump: 6.0.22 and 6.0.23

Anyway, I managed to find out why. Think it is a bug in icedump. But a resolvable one. 8)

Basically, I have this nasty habit of not setting bp, just Ctrl D and tried dumping screen. I get blue screen of death. When I set faults on (CrackZ's advice), I see the error in IFSMSG or something. 8P

Anyway, this BOD does not occur if I break into Sice with a breakpoint. It dumps wonderfully.

Question is, is it a bug in icedump or is it required that I break into sice first with bps and not Ctrl D to dump?

Regards
EB
qferret
06-09-2001, 01:23 PM
I have the same problem....with /screendump AND /dump (in certain mem areas hehe) ....thx for the tip, I'll try it using a bp & see if I can get it to work for me ;-)


Smartcheck crash in WinME with this prog...?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Smartcheck crash in WinME with this prog...?
PDA

View Full Version : Smartcheck crash in WinME with this prog...?

ring0
06-09-2001, 03:09 PM
Hi!
I tried using smartcheck for serial fishing this VB6 prog Internet timer2 v 2.2.195 (20 day trial ?reg code)
url = http://hathwaymirror.tucows.com/files5/internettimer.exe
But smartcheck keeps on crashing "error in SCNFC.dll" and "error in MFC42.dll" etc, i used the standard settings as said in most tuts for SC. What is the problem and how can this be overcome? (BTW this prog is compressed with neolite which can be easily manually unpacked with OEP= 004062FC), thanks bye! ring0.
NeO'X'QuiCk
06-09-2001, 06:50 PM
Maybe the problem is in the App not the Smartcheck settings!!

NeO'X'QuiCk
ring0
06-10-2001, 03:52 PM
Do u know of any Tuts for progs with anti smartcheck code? How do i identify the code?
Thanks, ring0.
JMI
06-10-2001, 06:45 PM
The intent of this reply is (again) to simply encourage people to "search" on their own before they ask for help. I am a newbie at "reversing" but upon reading your post I simply went to the bottom of the TOT Messageboard and in the "search" box typed "smartcheck + detect". Try it.

The third item that appeared was a reference to a thread on the Messageboard itself that describes two methods of detecting the presence of Smartcheck. There were others that may also provide assistance.

Good luck,
JMI
JMI
06-10-2001, 06:58 PM
Just a quick update:

The second time I did the search it came up with more entries and moved the thread I referred to to #16. Just so there is no confusion check specifically URL: http://208.50.16.104/Ultraboard/Public/HTML/B5/2604.print.html - size 5kb - 07 Jun 2001

JMI


DriverStudio 2.0.1, Icedump 6.023 and Windows Millennium
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DriverStudio 2.0.1, Icedump 6.023 and Windows Millennium
PDA

View Full Version : DriverStudio 2.0.1, Icedump 6.023 and Windows Millennium

no-brainer
06-10-2001, 06:12 AM
My SoftICE is version 4.21, build 53, and I'm
using the corresponding version of icedump,
(from the folder w9x\4.21.53).

This combination works perfectly under Windows 2000,
but when I try to load icedump in Windows Millennium,
it tells me "VXDLDR failed to load icedump." :(

Is there any way to fix this, or should I just wait
for the next version of icedump?
Vollkorn
06-29-2001, 06:06 AM
I have the same Problem with W98SE, Softice 4.05 (443) and Icedump 6.023 (and 6.021).

Have a nice day
am4nte
06-29-2001, 07:27 AM
Do you have at least the kernel32.dll exports
uncommented in winice.dat???

I had a similar problem on 9x when I forgot
to uncomment at least the
EXP=c:\windows\system\kernel32.dll
line.

amante
Vollkorn
06-29-2001, 07:53 PM
Oh, sometimes I am so stupid!
I have uncommented the kernel32.dll, but not the user32.dll.

thanx :-)


IDA sig file loading problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA sig file loading problem
PDA

View Full Version : IDA sig file loading problem

Thigo
06-10-2001, 06:28 AM
Hi,
I just created a SIG file for last version of Crypto++ (http://www.eskimo.com/~weidai/cryptlib.html). I hate this lib but many sharewares use it in their crypto algos so it would be very nice to have it :) SO.. the sig file I created (with FLAIR 3.8) seems to be OK but when IDA wants to load it, I get an error :
'Signature file format error'.
I have no clue about this error... I someone could help me to get a working SIG that would be very nice...
Thigo // TMG

PS : I use 4.04 (SHOCK release)
KobaSurf
06-27-2001, 02:39 AM
Delete at pat-file all string, where "_Tree" in position > 1000.
Thigo
07-01-2001, 06:32 AM
hmmmm sorry... I didn't understand what you said :X


Win2k SP2 and W32dasm 9.83
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2k SP2 and W32dasm 9.83
PDA

View Full Version : Win2k SP2 and W32dasm 9.83

Hoof Arted
06-10-2001, 12:04 PM
Hi All,

Just to let everyone who is using Win2k know, w32dasm 9.83 works well with Win2k and Service pack 2.

My 2c

Hoof
Cold Coder
06-11-2001, 03:27 AM
What about with W32Dasm++ patch(you can get it at http://w3.to/protools thanks to Kaparo:))
Hoof Arted
06-13-2001, 07:17 AM
Had a look and it all seems to be working fine.

Thanks for the patch.

Hoof


SoftIce NT, API breakpoints don't work
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce NT, API breakpoints don't work
PDA

View Full Version : SoftIce NT, API breakpoints don't work

StarShock
06-11-2001, 10:48 AM
I'm using softice for NT with my Windows 2000 and for some reason bpx MessageBoxA (or W), bpx CreateFileA/W, bpx WriteFile, etc... . . . (you get the picture), don't work.

I also have SoftIce for w9x on my win98 and all these breakpoints work fine.

I tried changing EXP=\SystemRoot\...\kernel32.dll, ...user32..., etc. to EXP=D:\WINNT\...\kernel32.dll and so forth, but that didn't change anything. All the functions show up with the EXP command either way...

I used to have SoftIce loaded on here before I reformatted my h/d and it was working, but I don't know what I did different this time.

Phillip

P.S. One more hint. I noticed that after doing bpx .... and then bl I get something like:
00) #00FE:000275d5
and I know (at least at some point) what it should show is:
00) USER32!MessageBoxA
or something like that instead of just the numbers.
DGR
06-12-2001, 03:30 AM
Hey there,

What sp are u using? If sp2 you'll need to get the (free) updated ntice.sys from numega.com. Else try loading the symbol files (debug symbols are freely available through ms.com) but be sure to use the right versions. That is, sp2 symbols if u use sp2 etc...

Good luck
StarShock
06-14-2001, 11:29 AM
OK, thanks. I will definitely try it. I'm just having trouble finding the right ntice.sys. I found one but it was like for version 3.25 of softice and I have 4.0.5...


nice collection of debuggers/editors/related tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > nice collection of debuggers/editors/related tools
PDA

View Full Version : nice collection of debuggers/editors/related tools

defilwhore
06-13-2001, 10:44 AM
http://esca.atomki.hu/paradise/sac/utilprog.html


Lord Caligo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Lord Caligo
PDA

View Full Version : Lord Caligo

KiLLa
06-15-2001, 11:14 PM
Does anyone know if there is still a copy of Lord Caligo's Fantastic World of Cracking floating around on the web?
Sope
06-16-2001, 04:41 AM
Hi,
Don't expect atleast this answer from here :-)
I too in pipeline of searching....

Good Luck
Sope!
morlac
06-17-2001, 07:00 PM
Hi guys,

Yes, I think the main page is still up somewhere. I came by it a month ago but didnt bookmark it. I think its dead. Most links are dead as well.
morlac.
06-17-2001, 07:02 PM
Hi guys,

Yes, the main site is still up but all links where dead when i came by it. Was a month a go and i dont know what i was looking for and LordCAligos page came into the search result.
I cant remember how to get there but once i do, ill let ya know.

Morlac.
Kayaker
06-18-2001, 02:14 PM
morlac. (06-17-2001 17:02):
Hi guys,

Yes, the main site is still up but all links where dead when i came by it. Was a month a go and i dont know what i was looking for and LordCAligos page came into the search result.
I cant remember how to get there but once i do, ill let ya know.

Morlac.

Hi Morlac,

Just a thought. Don't make the same mistake I did a while back by giving the link to Lord Caligo's thinking you're just being helpful. This is part of Disavowed's Challenge at
http://www.disavowed.net/

These guys are (likely) doing the Research part of the challenge. It's your call, but if you post a link you might ruin the fun for everyone else.

I posted an old working bookmark I had of the site. Luckily I soon realized my mistake and the link was deleted within a short period. As I said, it's your call, but I know I felt like a piece of shit at the time ;)

Regards,
Kayaker
Sope
06-26-2001, 11:02 AM
Atlast i found it. ^_^
1 more unix-www to go !
[sope]


Icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Icedump
PDA

View Full Version : Icedump

qferret
06-16-2001, 03:28 PM
I am using Softice 4.05.334 and Icedump 6023.

The /dump command worked for me a few weeks ago, but then it quit working, causing GPF's. /screendump also causes GPF's for me, but I never have had that function work (any luck EB?).
I reinstalled Softice, and the GPF's stopped for the /dump command, but it only creates a file of 0 bytes. It never actually makes the dump, just creates the file.

Any ideas?
stillnewbie_b
06-17-2001, 10:20 AM
qferret (06-16-2001 13:28):
I am using Softice 4.05.334 and Icedump 6023.

The /dump command worked for me a few weeks ago, but then it quit working, causing GPF's. /screendump also causes GPF's for me, but I never have had that function work (any luck EB?).
I reinstalled Softice, and the GPF's stopped for the /dump command, but it only creates a file of 0 bytes. It never actually makes the dump, just creates the file.

Any ideas?

Hi ?ferret,
you must in your oep,then you can use the command /dump or /pedump

my 2 cents :=)

stillnewbie
Eternal Bliss
06-18-2001, 07:38 AM
qferret (06-16-2001 13:28):
I am using Softice 4.05.334 and Icedump 6023.

The /dump command worked for me a few weeks ago, but then it quit working, causing GPF's. /screendump also causes GPF's for me, but I never have had that function work (any luck EB?).
I reinstalled Softice, and the GPF's stopped for the /dump command, but it only creates a file of 0 bytes. It never actually makes the dump, just creates the file.

Any ideas?

Hiya,
I am not sure why you have that error. I solved my /screendump BOD by only screendumping if I break into Sice with a breakpoint. If I were to Ctrl D and then dump it, I will be asking for trouble.
/dump for me is ok. For example, if I were to dump at 00400000 for a length of 1000h bytes, I do /dump 400000 1000 c:\dump.bin
I don't get any errors at all. And I usually dump stuff not immediately after I Ctrl D into Sice but after a breakpoint and some tracing. Did you do anything to the icedump configuration? Maybe you can reinstall icedump again?

Regards
EB


Cracking IRIX software
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Cracking IRIX software
PDA

View Full Version : Cracking IRIX software

Franc
06-16-2001, 07:06 PM
Hi,

I am just wondering if anyone of you ever did some cracking / debugging under SGI IRIX ?

What tools did you use and is there anything like SoftIce avaiable for that OS ?

Thanks
guest
07-24-2001, 10:48 PM
Hi
only IRIX debug tool dbx


OllyDbg 1.03b released - plugin support
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > OllyDbg 1.03b released - plugin support
PDA

View Full Version : OllyDbg 1.03b released - plugin support

TBD
06-17-2001, 02:14 PM
OllyDBG 1.03b
http://home.t-online.de/home/Ollydbg/odbg103b.zip

new features
- *plugin support* (over 110 functions to play with)
- set memory and hardware breakpoints in Dump windows
- search for all referenced text strings
- display PE header in dump window
- show jmp path (with arrows)
- bookmark system implemented in a plugin (with source)

if you write an OllyDBG plugin please post the
address to

OllyDBG users page
http://www.ollydbg.f2s.com

TBD


How 2 grab SoftICE's screen ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How 2 grab SoftICE's screen ?
PDA

View Full Version : How 2 grab SoftICE's screen ?

YaTaGaN
06-18-2001, 09:50 AM
Is there a S-ICE extension that can grab S-ICE screen and save it as bmp file (or any other pic format) ? I know for ScreenDump (~part of IceDump) but it can only save snap to text file (with SDC converter even in HTML)... What about BMP ?! Is it possible at all ? If not, how to GENERATE (exactly the same! - just like S-ICE's screen) bmp from that text dump ?

What font S-ICE uses (what size, in different modes), what colors, dimensions...

BTW, where can I find tutorial about writing S-ICE extensions ? (how to access SoftICE's internal variables etc.)

TIA,
YaTaGaN
sex
06-21-2001, 08:54 PM
heh
heh
06-21-2001, 10:19 PM
sex
ThrawN
06-21-2001, 11:03 PM
Yes pls! :)
Kayaker
06-22-2001, 04:50 AM
Heh, heh. I think what they're trying to say is check out the Softice EXtension (SEX) project by defiler and ultraschall. (search for 'sex' at www.suddendischarge.com)

Also read SOFTICE INTERNALS by +Spath
http://208.50.16.104/crackz/Tutorials/Siceints.txt
for the hows and whys of the SoftIce 'dot' commands and why SEX works.

If you can write an ASM routine to dump a screen to a bitmap, it might be possible to incorporate it into the SEX project and have it dump the SI screen.

If you look at the beginning of the Using SoftIce.pdf file, you see a nice screen dump. I wonder if they just took a picture of it or whether it's a true screen dump?

Kayaker
defo
06-22-2001, 07:32 AM
Yeh, help us developing sex :-p
anyway, if you're just interested in dumping sice screen, a vm with win and sice installed will do just fine ;-)
qferret
06-22-2001, 08:19 PM
I'm all for developing sex!!!

/me wonders if he should turn off the 'puter when the wife is getting ready for bed for a change ^_^


SEH exceptions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SEH exceptions
PDA

View Full Version : SEH exceptions

YaTaGaN
06-18-2001, 09:52 AM
How does SoftICE handle exceptions ?

What I mean is why can't I STEP OVER some invalid instruction when I have setup SEH frame ? If I set breakpoint on my SEH routine and exit S-ICE (ctrl-D) before that invalid instruction (it doesn't matter what that is: page fault, invalid instr. or...), SoftICE pops-up, but if I trace it (t), S-ICE crashes and never switches control to my routine...

Is there a text about hiding "sticky" breakpoints (BPX) - 0xCC bytes in trace (t) mode ? Similarly, when I (try to:) read debug (DRx) register (yea, @ring0 level!), SoftIce's returning ZERO !!!

I need some text about this S-ICE's behaviour...

One more stupid question: How to debug S-ICE ? :))
(I want to patch that stupid "wrap-up" message and some other stuff too...) :)

TNX in advance.

YaTaGaN


WDasm 8.93 under w2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WDasm 8.93 under w2k
PDA

View Full Version : WDasm 8.93 under w2k

cadrox
06-19-2001, 10:40 AM
Something nasty. It doesn't work - can't load project files
Hoof Arted
06-20-2001, 03:28 AM
Try applying Service Pack 2 to your Win2k. It has solved many of my problems.

Hoof
cadrox
06-24-2001, 07:24 AM
Already applied but it doesn't help - WDasm trying to open executable from the directory where .wpj file located...


softice USB troubles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice USB troubles
PDA

View Full Version : softice USB troubles

wzrd
06-19-2001, 04:09 PM
Dear Guys,
I have a USB kbrd and am unable to use sice.
Any suggestions?

twzrd
Maggot
06-20-2001, 01:23 AM
look 4 a usb to ps/2 converter in your computer-store
wzrd
06-20-2001, 02:05 PM
Thanx! Thats really very kind of u pointout
wzrd
06-20-2001, 02:20 PM
Thanx! Thats really very kind of u 2 pointout


Looking for Unsafedisc 2.10 or higher that works ok!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Looking for Unsafedisc 2.10 or higher that works ok!
PDA

View Full Version : Looking for Unsafedisc 2.10 or higher that works ok!

Dweeb
06-20-2001, 08:12 PM
Downloaded Us 2.30 from Coders domain - didn't work on my computer!

Anyone know how to get in contact with r!sc?
+SplAj
06-21-2001, 04:02 AM
BBC Radio 1 in UK , telephone number 00 44 1????????
or
http://www.bbc.co.uk/radio1/chat/index.shtml

}>
evil-risc
06-21-2001, 02:28 PM
'erm, use this software at your own risk, it could crash your pc, it could contain a virus or a trojan, who knows.. the user is to blame if anything goes wrong'

something went wrong, its YOUR fault .. those programs come with no warranty, no support.

chill, but dont take too many pill's ..

r!sc
Dweeb
06-28-2001, 04:39 PM
R!sc I know about the "Its my fault" But it seems that the program don't work! Tried it on several computers and it didn't work!

Dweeb
eazylife (evil-risc)
06-28-2001, 06:57 PM
could you be a *little* more specfic ?

it crashed? you got a error message? it locked up your pc? you have what version of windows? you have what software running in the background? you have what processor? you have problems with any other software? the same problems you have with MY software? you tested on what other pc's (windoze versions?)? did the exact same fault occur as on your own pc? this being a like, cracking type forum, are you a cracker type person, capable of debugging it to see why it crashed?? int 01 points to what address on your computer? int 01 points to what address(s) on the other computers you tested it on?

anyway, its your own fault .. it works on my pc's fine, with and without a debugger present . win95b, win98se, winME, win2k .. p200mmx, k6-333, k6-450, celeron 700 ..

r!sc

/\
Dweeb
06-30-2001, 07:37 AM
I use Win98 second edition. My friends use the same. I got a Pentium II 400.

When I use the Dumper on 2.30.31 I get: Program has done a forbidden action error. When I use the Rebuilder I get a Blue screen. Also on 2.10.xx but the Dumper works.

Im sorry but Im a real lame newbie. Im study most the Tuts on the net and will catch on soon.

Dweeb
eazylife
06-30-2001, 08:44 AM
right, again, could you be a *little* more specfic ?

the program has caused an exception blah .. what does it say in the box when you click 'details' ?

e.g.

TM20 caused an invalid page fault in
module <unknown> at 0141:0070046d.
Registers:
EAX=00407407 CS=0167 EIP=0070046d EFLGS=00000256
EBX=00530000 SS=016f ESP=0063fe40 EBP=0063ff78
ECX=07744000 DS=016f ESI=81743ecc FS=372f
EDX=81743f2c ES=016f EDI=bff8b560 GS=0000
Bytes at CS:EIP:

Stack dump:
00000008 81743ecc 00530000 30326d54 45584500 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000

'When I use the Rebuilder I get a Blue screen. '

what does it say on the blue screen??

and, do you ever use irc?
Dweeb
06-30-2001, 01:51 PM
caused an invalid page fault in
module <unknown> at adress 0000:0064e0d9.
Registers:
EAX=e48f9e07 CS=0177 EIP=0064e0d9 EFLGS=00010282
EBX=0064fe14 SS=017f ESP=006532bd EBP=4243484b
ECX=ffffffff DS=017f ESI=8174f300 FS=5027
EDX=bff76859 ES=017f EDI=0066036f GS=0000
Byte på CS:EIP:
00 00 00 00 00 00 00 6f 03 66 00 02 00 00 00 00
Stackdump:

And the bluescreen says:

Execption at 06 on 0000:00000017

and I don't use IRC
Dweeb
Dweeb
06-30-2001, 02:08 PM
And I use the Swedish ver. of Win98
eazylife
07-01-2001, 01:59 PM
ok impossible to tell whats wrong without physical access to your pc ..

but it looks like my excpetion handler is causing a exception (causes exception, calls exception handler again, calls decrypt proc on seh when its already decrypted, thus encrypting it, then executes the encrypted 'decrypted' handler code, causing another exception, until fault occurs)

must be something to do with my int01 inside my code .. but what i do not know, since it causes no problems on every pc i have physical access to ..

05_30 util doesnt use int 1, and works fine, the 1030 util 'may' use int 1, and 3031 util deffinatly does.. but i dont see how this can cause problems on a few pc's and not others

sorry, cant help you
Dweeb
07-01-2001, 03:06 PM
Thanx R!sc You have been a great help just by putting up with me.

You rule! And i hope i didn't Bug you out!

Dweeb
eazylife
07-02-2001, 09:12 AM
haha, i havent been any help at all .. it still doesnt work does it ..

haha :d

c u around, dweeb


Basic IDA question?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Basic IDA question?
PDA

View Full Version : Basic IDA question?

()whore
06-20-2001, 08:49 PM
Howdy,
I have been working with IDA lately and like it a lot; However one thing keeps bothering me. When I dissasemble a file quite a lot of the code is shown as data. I know I can change the data to code via the 'c' key but there is a problem with this. It works out ok for specific places in the file I want to look at but searches for API calls and other things are missed because much of the file is being represented as data not code.
I hope I am just missing something obvious and easy to get all, or at least large portions, of the file changed to code quickly for these searches.
Peace,
And thanks to everyone on the message board. I don't post much but I have been learning lots. Thanks.


i8042prt.sys
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > i8042prt.sys
PDA

View Full Version : i8042prt.sys

Chead
06-22-2001, 12:04 PM
I have problems getting Softice working.
I have Softice from developerstudio 2.01 installed. Startup mode is Manual.
When I start softice, softice pops up and I get this error:

NTICE: MiCopyOnWrite found at 8044BE21
NTICE: RtlAssert end found at 80457321
NTTerminateProcess found at index 00E0
NTRaiseHardError found at index 00A0 Delte=00000242
NTICE: KDExtension are disabled KDHeapSize=00000000 and KDStackSize=00000000
NTICE: Patching Keyboard using method 0
NTICE: Keyboard driver found at - i8042prt.sys
NTICE: Keyboard successfully patched using RPUC hook

I've tried with the ntice.sys from:
http://www.numega.com/drivercentral/utilfiles/ntice.sys

But that gives me the same problem.

Running Windows 2000 pro without service pack.
I have been running this before but I can't get it working now for some reason

Anyone have any ideas?
Chead
06-22-2001, 01:22 PM
I got this fixed!

I did two things, so I'm not 100% what did it but I think it was adding this to the registry:

REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice]
"KbdMethod"=dword:67416E5A

I also set "Do not patch keyboard Driver"

But then I removed that "Do not patch keyboard Driver" and softice is still working

So I guess it's the registry 'hack' that did it.


Extracting asm from programs for use in keygen...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Extracting asm from programs for use in keygen...
PDA

View Full Version : Extracting asm from programs for use in keygen...

DGR
06-24-2001, 09:06 AM
G'day all...

I was wondering if there's a tool with which u can extract assembler from programs to use it in a keygen. I can't program in assembler but I do most of my stuff in c++. It has the possibility to use inline asm but when I disassemble an asm file in w32dasm or ida the format is not correct. So I have to copy-paste it, then alter it to make it valid (ie, put a 0x in front of the hex-values and stuff like that.) This is not always a problem but when the code is 100's of line of asm it gets VERY annoying.

So, is there a tool which can extract a certain amount of code (given a start and ending address for example) which can immediately used for something like a keygen.

Cheers and take care,

D.
hz
06-24-2001, 03:00 PM
hiya,
Haven't used it so don't shoot me if I'm wrong. Sounds like TMG Ripper may be what you are looking for. Available at protools and all good pirating goods stores.
regards
DGR
06-26-2001, 04:11 AM
Hiya,

When I read the description it seems to be EXACTLY what I was looking for, immediately gonna try it when I get home : )

Tnx a mill and take care,

D.


Getting SI to start upon prog execution
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Getting SI to start upon prog execution
PDA

View Full Version : Getting SI to start upon prog execution

Joe Doe
06-24-2001, 04:40 PM
I am trying to use SI as a debugger with acomanying source code. I have compilled my program with debugging on, and Have checked the option of the symbol loader to break on WinMain. However, when I load the exe, the exe just runs and does not break. Could someone that maybe has experience useing SI in this manner tell me what I am doing wrong. Here are some details.

-I am compiling under lcc.
-FILE does not show my file name however SYM seems to work, and when I set box _WinMain, the program breaks on executions...

Could someone please tell me what I might be doing wrong
-Thanks
Kayaker
06-24-2001, 10:11 PM
Hi,

Not sure why SI might not be breaking, but trying loading Icedump first, there's a good chance it will force SI to break.

http://icedump.tsx.org/

Kayaker
CoDe_InSiDe
06-25-2001, 12:31 AM
Hi Joe Doe,

I think (But i don't know sure) that SoftICE won't break because of the Section Characteristics of the "Code" Section :)
You can try to change that to "400000E0" or (like i always break at the OEP, because i don't trust Symbol Loader ;D ) put a "Int 03" (CC) at the OEP ;)
Hope this helps in some way ;)

Cya...

CoDe_InSiDe
Russ
06-25-2001, 11:06 PM
Hi Joe Doe.

Symbol loader has some wierd requirements it seems. Like CoDe_InSiDe says, your .text section needs to have certain characteristics. I downloaded lcc and compiled a small program. My .text section had 60000020 for characteristics which is fine for symbol loader to break (just need "contains executable code").

However, symbol loader didn't break if my program name was over 8 characters long no matter what executable I was working with!!!

Is your program name over 8???????
r_e_a_l_f
07-08-2001, 06:22 AM
i too get the same problem i just reinstalled it works fine (for time being) but the problem gets again.

i am also newbi


Symbol not defined
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Symbol not defined
PDA

View Full Version : Symbol not defined

mixxu
06-25-2001, 01:33 AM
When I type:
bpx getdlgitemtxta
SoftIce says:
Symbol not defined (getdlgitemtxta)
Please tell me what to do. I am really a newbie in cracking.
Carpathia
06-25-2001, 01:46 AM
Its lucky youre not on the hcunix board. A few thousand seals mighta been clubbed.

See the bit which says 'Read the FAQ' in the top left ? You know what to do.
+SplAj
06-25-2001, 04:59 AM
so we should club some penguins .....


softice and getwindowtexta
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice and getwindowtexta
PDA

View Full Version : softice and getwindowtexta

jose
06-26-2001, 07:54 PM
I use sotice 405.I have downloaded de latest debugger(winice.exe) from numega.It works.(I use windows me)
But when i set breakpoint getwindowtexta,then i can't get out from
softice(using ctrl+d,x or f5) appearing a
message like this: "break due to bpx user32!getwindowtexta".It only occurs
with getwindowtexta,not the others(like getwindowtextw).
what is happen?
qferret
06-26-2001, 10:56 PM
uh...my guess would be that GetWindowTextA is executed. ;-)

Hit F11 & note the name of the process you land in....if it's not a system .dll, or the program you are debugging, close that program & try again (I have this problem with hmemcpy & running ANYTHING besides the app I'm working on.) :-)


Anyone remember who did that vb5 thingy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Anyone remember who did that vb5 thingy
PDA

View Full Version : Anyone remember who did that vb5 thingy

Hz
06-26-2001, 07:59 PM
hiya,
it displayed strings being compared in __vbastcomp, cant for the life of me... Anyway
I was hoping to scrounge the source from him.
hz
06-26-2001, 08:57 PM
Sorry,
Thought I had posted that in the T.O.T, couldn't edit/delete it.
4oh4
06-27-2001, 09:43 AM
It was called "lazvb" or something similar, and of course Lazarus is the author. :)

It's not linked to from his website the last time I checked, but if you want I can email it to you. I doubt he would mind.
LaZ
06-27-2001, 02:18 PM
He wouldnt mind ;)
hz
06-27-2001, 03:23 PM
hiya 4oh4,
Appreciate if you would.

LaZ,
Did you ever upgrade it for VB6, do you still have the source or am I going to have to do some work?.

Thanks both of you.
4oh4
06-28-2001, 02:01 PM
;) @ Lazarus

Hz I'll mail it when I get home.

....of course I'll have to find it first.
LaZ
06-28-2001, 02:57 PM
Did not update, dont have it anymore. You are on your own ;)
4oh4
06-30-2001, 01:53 AM
Does anyone have a copy of msvbvm50.dll (05.00.4319 (SP2))? I'm not promising much, but I'd like to have a look to see the added code.
zeeman
07-10-2001, 10:10 PM
4oh4 (06-29-2001 23:53):
Does anyone have a copy of msvbvm50.dll (05.00.4319 (SP2))? I'm not promising much, but I'd like to have a look to see the added code.

I can help with this file. Send me a message: zee@man.vg and I'll send it by return email (I don't see the "attach" command here).

Regards,
Zee.


need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > need help
PDA

View Full Version : need help

sunboy
06-30-2001, 04:14 AM
Akton software licensing has changed. Akton now employs an encryption unlocking mechanism to manage its software licenses. We have incorporated a product from Kenonic Controls called Crypkey. There are some minor additional tasks to perform when installing this software. There are also significant benefits to Akton and our users. Our software can now be distributed easily over the internet, there by eliminating shipping costs. There is concurrent network sharing and license management for education and corporate environments. We have a more flexible licensing mechanism that allows us to create a larger number of licensing options.

All the code we distribute is the same, by default it installs as an Unlicensed copy and operates at level 0. Code can be distributed via diskette, CD, intranet, internet. Licenses are enabled by entering a "site key" which "unlocks the program." The key is based upon a "site code" that is generated when the software package is installed. The customer supplies the "site code", we supply the "site key." Once the program is "un-locked" it will function at the applied license level, and with the enabled license options
qferret
06-30-2001, 06:43 PM
uh...is this a quote from promotional material for a protection you're looking at? ....or are you the author, looking for some free consulting? *G*

either way....what exactly do you need help with? You never did say.....
+SplAj
07-01-2001, 05:49 AM
it's ok, I got it, watch out I have recovered from rubbing cologne on my balls and spending 2 days in hospital screaming in pain with no pants on and a fan blowing cool air on my testis, NOW I am zuper-uber-l33333t , better than woodmann ! You to can be l333t if you can take so much pain (remember David Carradine in Kung Fu)

The target link I got from :-

http://www.akton.com

and I cracked it in 5 seconds for sunboy (hey i must learn some chinese greetings), just rub some antiseptic-germolene on yer bum
and some vaseline. Thats as much protection you'll ever need for this target.

+SplAj }>

PS did that help or is there another akton ?


Any W32dsm gurus listening...?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Any W32dsm gurus listening...?
PDA

View Full Version : Any W32dsm gurus listening...?

aimless
07-01-2001, 11:52 PM
Hullo,

For w32dsm internals only!

You can disassemble an app in w32dsm (albiet not as perfectly as IDA) and can then run the process in its debugger. Good.

As the debugger runs, the addresses of the executed path is actually converted from black to red. Very good.

I wish to read the .alf/.wpj files for all lines that have their addresses as red and put them in another file (selecting shift+mouse click and copy of all red addresses) is getting tiresome.

Any suggestions?

Regards.
ColdCode
07-03-2001, 02:00 AM
>Any W32dsm gurus listening...?
that not me oh well(but you did not said only)

If i was you(i hell i was think about doing this) i'd add code w32dsm over makeing a program to get info from the alf/.wpj

some info on wpj file format
--------WPJ-----------

*.wpj
offset-size---------info
0------4-----------dll/0 for dll...
4------4-----------size of path
8-----pathsize-----path
next 4 ?
..
..

table b4 this end with 0101010101010101010101010000(in hex most of time i think)
Color table.... table look to b one or 2 tables from end of file
offset--size---info
0------4------line
4------1------color 1=red
5------1------start of text to color
6------1------end of text to color
.
.
.
.

in memory at 00452617 [ebx+?]
0001F69Dh ; line offset(size dword)
0001F6A1h ; size of line(size bytes)
0001F6A5h ; Color table i thank(size 4+1+1+1)

0043D3C6 ; most of *.wpj loading code

PS.
If you pull this off email me it and i will add it to the next W32Dasm++. And if neec any help email or post....

good luck,
Cold Coder


SoftIce and Win2k problem... again... :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce and Win2k problem... again... :(
PDA

View Full Version : SoftIce and Win2k problem... again... :(

wineos
07-02-2001, 12:39 PM
I have a problem when use CTRL+D. I can't see the softice window. I use a Geforce2 MX and the universal driver should run with it, It's DirectDraw compatible.
I found a lot of ntice.sys at Numega's ftp in /anonymous/tech/ but not for NT 5 (win2k build 2195 with SP1) and i8042prt.sys in /anonymous/tech/nt5beta/.
Well... the problem now is that I can't upgrade to DriverStudio 2.0.x becuase I can't find it... BUF!

I would be grateful if somebody can help me. I can't switch to win9x now and I already take a lot of time attempting find a solution.
I just need to know WHY I can't see softice window.
THX


FlexLM FLIRT signatures
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FlexLM FLIRT signatures
PDA

View Full Version : FlexLM FLIRT signatures

hayk
07-02-2001, 01:02 PM
Please help!
Where I can get FlexLM FLIRT signatures?
VoxQuietis
07-23-2001, 02:13 AM
By all means, make them by yourself. Its simple, and You learn using Your tools.
To make it brief: get the flirt toolset flirt28.zip.
And then use lmgr.lib to generate a pattern file and convert this one to the signature file. There are a few collisions with the pattern file, but these affect only minor functions. So ignore them. You find all the required information inside the flirt package.

regards
--Vox.


Win2k + sp2 ==> crashes computer... plz try to help.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2k + sp2 ==> crashes computer... plz try to help.
PDA

View Full Version : Win2k + sp2 ==> crashes computer... plz try to help.

drak0
07-03-2001, 02:20 PM
Hi

I am using the driver studio 2.0.1 release with win2k+sp2 with the updated ntice.sys from numega When ever I try to start SI... my computer hangs... SI shows and displays this:

NTICE: MiCopyOnWrite found at 8044EAD5
NTICE: RtlAssert end found at 80459ED9
NTTerminateProcess found at index 00E0
NTRaiseHardError found at index 00A0 Delta=00000242
NTICE: KDExtension are disabled KDHeapSize=00000000 and KDStackSize=00000000
NTICE: Patching Keyboard using method 0
NTICE: Keyboard driver found at - i8042prt.sys
NTICE: Keyboard successfully patched using RPUC hook

Chead already posted something very similar to this and he said he did two this to fix:

"REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice]
"KbdMethod"=dword:67416E5A

I also set "Do not patch keyboard Driver" "

Where is the "Do not patch keyboard Driver" setting? I tried to reg fix... but it still didn't work...

Anyone help????

Thanks,
drak0


problem with TRW2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > problem with TRW2000
PDA

View Full Version : problem with TRW2000

synphony
07-03-2001, 11:46 PM
i am a newbie intrested in cracking. one of my headeaches is that i don't know how to use trw2000 properly. every time i first browse and then load the exe. program ,a blue screen will open on which a lot of numbers are shown, and at the same time my computer crashes.if trw2000 can not be run under windows, i also tried it under windows MSDOS mode, but the result is just the same. i honestly need your help!

regards


'T' - ing in SoftICE: But lets stick to the debugged process...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > 'T' - ing in SoftICE: But lets stick to the debugged process...
PDA

View Full Version : 'T' - ing in SoftICE: But lets stick to the debugged process...

aimless
07-04-2001, 11:44 PM
Hullo All,

Win2K,
Softice 4.05 for NT
(no SPs in NT, so ICE works excellent...)

Now,

* Go to loader and starting notepad.exe (yup!)
* giving command

T =cs:eip 300

Now, this traces the next 300 instructions as they occur.. (sorta like a executable run time listing...I always wanted that).

But...

This command also traces over system code (ntdll, ntoskrnl, kernel32..yiddayidda).

Is there any way (none that I could find in the manual or net) that can instruct softice to trace only instructions in the current process (that is context of notepad ONLY) and auto do a P RET if it encounters system code...?

CSIP not ... does not work as it requires BPs to be set.

*Sigh*, wish there was a P =cs:eip 300 command acceptable in ICE!!

Any leads anyone?

Regards,


Hiding SI NT2K :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hiding SI NT2K :)
PDA

View Full Version : Hiding SI NT2K :)

+SplAj
07-08-2001, 08:23 AM
Hi fellows

I saw a few posts re the topic of anti-debugger cloaking for our beloved tool SI. We all know about Icedump team excellent work
and Frogs+ as well....but I saw a few Q about Win2K. I always point ppl in the way of Nticedump and Pntice from EliCZ who coded a nice patcher for us with an *.ini file for us to update.
This covered 3.24 very well. I made one for 4.01 but not 4.05 as I patched directly myself as well as the latest ntice.sys.

Well I failed miserably at the w/e to make pntice.ini for the latest 4.2.1 Build 57 (or 58) of NTice.sys for everyone. So i attach my patched files for you to play with. I think you know this is for Win2K only ;)

Rename your original files before copying mine to the relevant system / Si directory's. Don't blame me for any PSOD !

happy reversing in peace.

+SplAj }>
drak0
07-08-2001, 12:54 PM
Hey Splaj...

I tried your files... and SI wouldn't even start. But I'm not sure if that means anything because with the version of ntice from numega, SI would lock up my system before... With your version, it just says that ntice.sys can't be loaded (0xc0000221)

I have SP2 btw... do you have that? I wish I could revert back to SP1 :( cuz i can't get SI to work w/ sp2...

-drak0
DGR
07-11-2001, 04:20 AM
There is a quite old tool called NTall which does a pretty good job. However, it didn't work with the latest driverstudio 2.5 beta2. Then again, the symbol loader couldn't be used either coz it thought sice wasn't active (symbol loader from ds2.5b2 that is) so it's more a beta-related thing I'd think...

But give ntall a shot... it's quite fine. Altho once u activated all the protections/detections u can't disable them nemore (causes things to lock up heh). Can be annoying, but still... it's a nice tool.


loader32 deletes my .nms file after creating it?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > loader32 deletes my .nms file after creating it?
PDA

View Full Version : loader32 deletes my .nms file after creating it?

latigo
07-10-2001, 07:00 PM
Hi there!
I'm trying to build my asm project with symbolic debug under WinME but i seem to have problems..
Aparently the debug info is inserted in the exe because the executable ends bigger after linking. But when i try to load it using either nmsym or the loader32, my .NMS file is deleted by the afore mentioned tools.

Currently, i'm assembling with:

\masm32\bin\ml /Cp /coff /Zi /c %1.asm

Linking with:
\masm32\bin\Link /SUBSYSTEM:WINDOWS /DEBUG /DEBUGTYPE:CV /LIBPATH:c:\masm32\lib %1.obj %1.res

and trying to load my exe into softice with:

D:\WinApps\NuMega\Winnie4.5
msym /translate:source,package,always /source: MyProject.ASM /load:execute,break MyProject.exe

I'm kinda desoriented :/

Any ptr is appreciated as per usual.
TIA.

Latigo
rKo
07-12-2001, 08:41 AM
Hi,
You seem to be using Softice 4.5. Sadly that doesn't work with MASM. Last known working version was 3.25. But is does work with TASM.
latigo
07-13-2001, 08:42 AM
duh..i'll go back to older versions of sice then..
Thanks mate.

Latigo
f_v_man
08-02-2001, 07:01 AM
hey where can I get sice 4.5
latigo
08-03-2001, 05:16 PM
www.numega.com


Help with install icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help with install icedump
PDA

View Full Version : Help with install icedump

boxx
07-13-2001, 01:50 AM
in win2000, i copy the icedump and ntid.exe to softice directory, and then run ntid,got the message:
reading dump info :ok
checking NTICE: error

what can i do then?
CoDe_InSiDe
07-13-2001, 02:37 AM
Hi boxx,

Have you also put the correct .DLL into SoftICE directory ? :)

Cya...

CoDe_InSiDe
boxx
07-13-2001, 02:48 AM
I'm really a newbie.
Is the following process correct:

copy the image file "icedump" ,which is in the directory of 4.05.334 ,to the sice's directory;
then execute the ntid.exe
then ren icedump to icedump.exe
then run icedump.exe

or i've download a wrong package?

thanks a lot
CoDe_InSiDe
07-13-2001, 03:10 AM
Hi boxx,

Well, one thing that'll help is Read The Manual ;D
And i think that process is as good as correct ;)

Cya...

CoDe_InSiDe
boxx
07-13-2001, 10:46 AM
forgive me asking next stupid question:

where is the detailed manual, i can't find it in id6022.zip
CoDe_InSiDe
07-13-2001, 01:58 PM
Hi boxx,

You can't find the Manual? :)
Look in the Icedump directory:

w9x/doc/

or

wnt/doc/

Now you should find it, if you don't then search carefully must be somewhere in there ;)

Cya...

CoDe_InSiDe


Searching for SentinelLM 7.0 SDK
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Searching for SentinelLM 7.0 SDK
PDA

View Full Version : Searching for SentinelLM 7.0 SDK

Sope
07-13-2001, 01:22 PM
Hi to Everybody !

Where can i find SentinelLM sdk 7.0 ?
I downloaded Service Pack 2 for SLM 7.0 from Rainbow's site
but it is an update to sdk 7.0 which i don have.

Any body any Hint or URL ?

Sope


How to patch Registry Settings by Crack?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to patch Registry Settings by Crack?
PDA

View Full Version : How to patch Registry Settings by Crack?

TheDutchJewel
07-14-2001, 04:37 AM
I want to make cracks which not only patch EXE-files but also change registry settings. Is this possible? With what prog?
Thanks in advance.
TheDutchJewel


SoftIce with VMware (Win2k)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce with VMware (Win2k)
PDA

View Full Version : SoftIce with VMware (Win2k)

El Barto
07-15-2001, 11:34 AM
I tried to run Softice from within a VMware running W2k on W2k. I used the latest Driver Studio 2.5beta1, but upon video driver selection it said sth like "Test failed! Video driver not DirectDraw compatible". I also tried not to use the universal video driver, but same results: I hit Ctrl+D and nothing shows up, I type "X"+return w2k continues.

Any clues? I read in a post below as a suggestion to run SI in VMware, so I suppose anybody must already have succeeded in running one.
drak0
07-16-2001, 01:34 PM
Hey..

My experience is that softice will only work in VMWare if you DON'T install their video drivers disk... cuz they hacked video drivers cause problems w/ si.

-drak0
El Barto
07-18-2001, 03:02 PM
so you're saying your're running your VMware with 640x480 16 colors only? and that works?
drak0
07-22-2001, 11:42 PM
No, I'm saying you can't install their video drivers... so SI will work in full screen only... @ 640x480x256 I believe... and I was unable to get /tracex to work for some reason... I wish it would work perfect... but it doesn't :(

-drak0

El Barto (07-18-2001 13:02):
so you're saying your're running your VMware with 640x480 16 colors only? and that works?


Windows,its debug binaries and SoftIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Windows,its debug binaries and SoftIce
PDA

View Full Version : Windows,its debug binaries and SoftIce

latig0
07-16-2001, 06:30 PM
Howdy!
I happen to have the debug version of some of Windoze's vxds and dlls.
The problem is i don't know what i have to do.
Hehe.
Gots the debug .dll and its '.sym' file. What is it that i have to do so as to see the symbols in softice?
Any ptr is appreciated as per usual.
Thanks!
Solomon
07-17-2001, 03:18 AM
SoftICE only deals with *.NMS files. So you have to translate SYM/PDB/DBG into NMS. You can use SoftICE Symbol Loader to do this, or use the command-line utility NMSYM.EXE, which resides in the same directory of symbol loader.

good luck
latigo
07-17-2001, 09:58 AM
Thanks Solomon :)
latigo
07-19-2001, 12:14 PM
Hey solomon i got another q now :)
I did translate the kernel32.sym to kernel32.nms and put both the dll and its .nms file inside my %WinRoot%\system dir.
But after some reboot, kernel32 crashed.
Did i miss something here?
Does this means that i have some wrong .dll versions?
Thanks again for your time.

Latigo
Solomon
07-19-2001, 10:53 PM
hi
The version of SYM and DLL must be the same. The corresponding symbol files can be obtained from the installation CD of Windows. For win2k release version, just click X:\SYMBOLS\I386\RETAIL\SYMBOLSX.EXE to install the symbol files. I have tried this and it worked.

some reference:
http://www.windowsitlibrary.com/Content/356/05/1.html
http://www.numega.com/drivercentral/icecentral.asp

regards
latigo
07-23-2001, 02:29 PM
Solomon, thanks once again :)
I've been able to load symbols and now i can see them in Sice.
Still got problems with the debug version of kernel32 though.
Eventually i'll come up with the solution.
Thanks again.

Latigo


FlexLM SDK 7.2f trouble.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FlexLM SDK 7.2f trouble.
PDA

View Full Version : FlexLM SDK 7.2f trouble.

Bill Fox
07-16-2001, 09:35 PM
Hi ALL!

Crack__Z have FlexLM SDK 7.2f on passwords.
Send me please password for open Disk15.zip, if available.

Regards
Bill


Halvar Flake
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Halvar Flake
PDA

View Full Version : Halvar Flake

Tuesday
07-17-2001, 12:43 PM
At DefCon this year, although not attending, I read the presentation by Halvar Flake (http://www.blackhat.com/html/bh-europe-00/bh-europe-00-speakers.html) in which he uses a couple IDA scripts. Does anyone have any good script exmaples that I could use as a base?

Thx.

Tuesday
latigo
07-17-2001, 04:21 PM
Tuesday (07-17-2001 10:43):
At DefCon this year, although not attending, I read the presentation by Halvar Flake (http://www.blackhat.com/html/bh-europe-00/bh-europe-00-speakers.html) in which he uses a couple IDA scripts. Does anyone have any good script exmaples that I could use as a base?

Thx.

Tuesday

Check here!

http://www.eccentrica.org/Mammon/sprawl/filebase.html#idc

Bye!

Latigo


FlexLM no HostID=ANY
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FlexLM no HostID=ANY
PDA

View Full Version : FlexLM no HostID=ANY

cq25
07-24-2001, 03:08 AM
Hi guys,

I've noted a funny thing with FlexLM and perhaps some of you knows the solution.

I buildt a keygen for my Target using FlexLM SDK 6.1f. I've the right seeds and the right keys. The HostID is the ethernet address of my NT-System. All went well, the keygen worked until I want to use the HostID=ANY. Now LMcrypt returns with an error saying that I want to do unallowed things.

Question:
Is there a flag in the SDK which doesn't allow the HostID=ANY or are there keys which have this specific flag?

would be nice to hear from you
greetings cq25
cq25
07-24-2001, 07:31 AM
sorry guys,

the solution for my problem is a very simple and stupid writing error in my license template. All are running now how I expect.

/cq25


SP2, Win2K, SoftICE, and Problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SP2, Win2K, SoftICE, and Problems
PDA

View Full Version : SP2, Win2K, SoftICE, and Problems

EvilJordan
07-24-2001, 11:51 PM
Right, so I got the newest ntice.sys file, and everytime I ctrl+D to softICE, it goes full screen, and then nothing happens...i can quit with F5, but I can't get anything to come up...any ideas?
isotope
08-17-2001, 10:44 PM
I went through the same stuff. The NTICE.SYS update is for Windows XP, not Win2K and gives you a weird screen that works great if you had infrared vision.

Go back to the original NTICE.SYS and update your (NTKRN.dll)? file. (It's on the Numega update page. I don't remember the exact name.) In your Winice.DAT file insert a line that says: NTSYMBOLS = ON.

Now, if I could just get it to recognize the SP2 API names.

Best of luck!
Braindead
09-09-2001, 08:31 AM
The update is for Softice Driver Studio 2.01.
Download driver studio 2.01. Works fine with SP2 if you apply the patch. Just look for DS201.exe
Inbread
10-10-2001, 11:01 PM
Any suggestions for search engines to help find DS201.exe? Have tried the basics, but no luck. Am I too late?
Thanks,
Inbread


Reversing a VB6 exe to see event procedures
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Reversing a VB6 exe to see event procedures
PDA

View Full Version : Reversing a VB6 exe to see event procedures

Stu
07-25-2001, 08:46 AM
i want to see how some programmers are using vb6 to write IT cetification test software, i.e. transcenders, etc. i really want to see how they do certain things surrounding event procedures and database access stuff. does anyone know of a tool that will allow this. also is a tool available to look inside a .dll so i can see that information as well. i would like to see the information in "plain text", i know that may be asking alot, but i though i would ask.

thanks

mcse_instructor@yahoo.net
aimless
07-26-2001, 12:01 AM
Try obtaining the VB6 debugger. Standalone.

Search for it on google.

And for god's sake change the name of you email id. With a thing like that I don't think anyone will reply to you. MS indeed!!


SoftIce: symbol not defined
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce: symbol not defined
PDA

View Full Version : SoftIce: symbol not defined

mixxu
06-24-2001, 10:55 AM
When I type:
bpx getdlgitemtxta
SoftIce says:
Symbol not defined (getdlgitemtxta)

Please tell me what to do. I am really a newbie in cracking but I know some hacking stuff.

Check http://www.programmerstools.com/
for best tools.
stillnewbie_b
06-24-2001, 11:05 AM
mixxu (06-24-2001 08:55):
When I type:
bpx getdlgitemtxta
SoftIce says:
Symbol not defined (getdlgitemtxta)

Please tell me what to do. I am really a newbie in cracking but I know some hacking stuff.

Check http://www.programmerstools.com/
for best tools.

Hiya,
Please read the FAQ before you post anything here.
vampirefo
06-24-2001, 04:34 PM
mixxu (06-24-2001 08:55):
When I type:
bpx getdlgitemtxta
SoftIce says:
Symbol not defined (getdlgitemtxta)

Please tell me what to do. I am really a newbie in cracking but I know some hacking stuff.

Try getdlgitemtexta, you left out an e

Check http://www.programmerstools.com/
for best tools.
Uly
06-30-2001, 08:09 AM
ok go to your softice dir..open winice.dat in notepad or ultraedit whateever u use..scroll down to exports and remove the ;'s before the exp's on each one..not the loads aite? gl ..

ps. reboot afta..
DudyStuff
07-25-2001, 02:51 PM
Um, yeah. Another thing. Open whatever .exe your cracking into quikview (It should tell you what dll's it uses) Then (if your running S-ice 3.25 +) run Loader32 (somthing like that) and then from one of the menu's there is a config of s-ice startup. Under one of the tabs you can select which dll's to load on startup. Then you can use symbols associated with them Common dll's are User32, Kernel32 Commdlg(i think i spelt it right) etc.

Hope that helps
Write back


SoftICE and Win ME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE and Win ME
PDA

View Full Version : SoftICE and Win ME

zitterbe
07-22-2001, 06:02 AM
My old PC died and this new one came with Windows ME. Is it possible to load SoftICE 3.23 somehow even though ME doesn't process autoexec.bat or config.sys?

zitterbe
rotaderP
07-22-2001, 07:07 AM
1: programmerstools.com
2: softice winME loader
3: download/install

:-)
zit
07-24-2001, 08:47 AM
Is Winice 4.05 compatable with WinME? I DL'd the ME loader but I only hace Sice 3.23.

zitterbe


softice and win 98
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice and win 98
PDA

View Full Version : softice and win 98

fizzik
07-27-2001, 04:03 AM
howdy i was wondering if someone could give me a little help. ive installed softice on my windows 98 comp it loads up fine but when i shut the comp down softice poops up, so i press ctrl+d to get out of it then the comp hangs. i would be greatful of any help.

cheers
CoDe_InSiDe
07-27-2001, 04:31 AM
Hi fizzik,

Here's a link read it carefully ;)

http://c4nfaq.cjb.net

Cya...

CoDe_InSiDe
epsilon
07-28-2001, 06:19 PM
Hello,

I just installed SoftIce myself and was having the same problem. I think the bpx commands are still loaded in memory and must be cleared out.

Ctrl+D and type hboot to restart the entire system. Of course Win98 does'nt like that and you will get Scandisk. I also typed bc * or bd * to clear the break points.
fizzik
08-01-2001, 11:58 PM
I'm still having problems with softice, it doesnt pop up when i shutdown windows anymore but it still bluescreens. the bluescreen message is " A fatal exception OE has occured at 0028:C000051EF in VXD VMM(01)+ 000041EF. The current application will be terminated". It is really pissing me off and i would really appreciate any help.

thanks


RE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RE
PDA

View Full Version : RE

1212
07-28-2001, 02:15 PM
You can try other version trw2000 ,eg trw 1.03 etc.


InstallWatch 2.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > InstallWatch 2.5
PDA

View Full Version : InstallWatch 2.5

vgb
07-28-2001, 02:42 PM
Has anyone used installWatch 2.5? I notice it's now a free download - didn't notice any spyware or adware. Is it worth using?

Thanx,

vgb


Can't get bpx GetDlgItemTextA to work???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Can't get bpx GetDlgItemTextA to work???
PDA

View Full Version : Can't get bpx GetDlgItemTextA to work???

epsilon
07-28-2001, 06:28 PM
I just installed SoftIce and I am learning how to use it. However, when I type bpx GetDlgItemTextA I get a "Symbol Not defined" error. I already removed the semi-colons from winice.dat and rebooted my system, but no luck.

Any suggestions why I am having this problem and how I can fix it?

OK... I find out what the problem was after reading the same message another person had posted. The solution worked.
Mostek
08-10-2001, 06:46 PM
:)

It's nice to see that there are young ones out there.

Check winice.dat in SoftIce dir. Uncoment all 'EXP=....' commands.

Peace
Mostek


uh-oh... heya r!sc, any update for SafeDisc 2.40.10 planned?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > uh-oh... heya r!sc, any update for SafeDisc 2.40.10 planned?
PDA

View Full Version : uh-oh... heya r!sc, any update for SafeDisc 2.40.10 planned?

machgun
07-30-2001, 06:35 AM
Just ran into it - Max Payne patch to 1.01 is featuring SafeDisc 2.40.10. As you are so far the man with the most expertise in SD, can we hope to see 2.40.10 unwrapper update in near future? 2.30.31 throws random error :-) on this target, so there were actually some changes there I guess... Also, I would really like to read your thoughts on this update, from expert's view. :)

regards,
/mg


where I can download ImpREC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > where I can download ImpREC
PDA

View Full Version : where I can download ImpREC

Rainor
08-08-2001, 01:02 PM
look like revirgin
I want to give a try

R
CoDe_InSiDe
08-11-2001, 12:14 AM
Hi Rainor,

Try here :)

MackT.cjb.net

Cya...

CoDe_InSiDe


How to instal Icedump ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to instal Icedump ?
PDA

View Full Version : How to instal Icedump ?

jth
08-11-2001, 10:13 AM
In win98, i copy the icedump.exe to softice directory, and then run icedump.exe,
got the message:

icedump v6.0.2.2 for winice v4.05 builder 334 loader
icedump was not loaded yet
VXDLDR failed to load icedump

what can i do then?

i am a newbies,plz help me!
Bengaly
08-11-2001, 10:54 AM
hehe don't Be a shame that u are a newbie.

First of all :

Download IceDump.
Extract it with winZip or something in some dir u will create for.
now after extraction u will see some dirs.
If u use win98 than enter the dir called "WIN9X"
if u are on NT enter the dir "WNT"
now u said u in win98 so enter that dir.
now there are alot of Dirs..
Every dir contain a special VxD to each Version of SoftICE (Dos/win).
it's start with the first Version of Softice:
3.22 Untill u will reach the latest built: 4.05.526
Now inorder to know which SoftICE version u have, Load up SoftICE (ctrl+d) and type "VER"
than u will see the SoftICE version + Built.
Now that u know what built u got, enter the proper DIR and load up the VxD (icedump.exe).

Example:
My SoftICE ver = SoftICE 4.0.5 (Built 334)
than i enter the dir called: \4.05.334\
LOAD iceDump.exe
and violla u have IceDump VxD running and ready to use.

Have Fun ;D
jth
08-11-2001, 12:22 PM
To Bengaly:

LOAD icedump.exe means adding a line
LOAD=icedump.exe in winice.dat ?

thank you for answering.
stillnewbie
08-12-2001, 08:33 AM
jth (08-11-2001 08:13):
In win98, i copy the icedump.exe to softice directory, and then run icedump.exe,
got the message:

icedump v6.0.2.2 for winice v4.05 builder 334 loader
icedump was not loaded yet
VXDLDR failed to load icedump

what can i do then?

i am a newbies,plz help me!

Heya,
double click it the version of icedump.exe is the same version of softice and

you will see a windows prompt what Bongaly has said to you.

don't add it in winice.dat :)
stillnewbie
Bengaly
08-12-2001, 02:45 PM
No Need to add anything to Winice.dat
Just extract the icedump6.zip and choose the folder of Sice version and double click thr EXE

Have Fun
NSDWarrior
08-26-2001, 11:49 PM
IM no newbie.
BUt i face that problem too.THe VXD just wont load, even though i have the correct version of ICEDUMP loaded
Must trace it to some other problem.Dunno what though


can't run softice in high color mode
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > can't run softice in high color mode
PDA

View Full Version : can't run softice in high color mode

jth
08-11-2001, 10:33 PM
It is normal in 16 color mode.
But when it can't run in high color mode.
why?what should i do?
Bengaly
08-12-2001, 02:50 PM
SoftIce has bult in Standart colors (Black,white,red)..
So it's ok if u see it in 16 color mode ;P
qferret
08-12-2001, 09:03 PM
you mean Softice won't work when WINDOWS is in 16 or 32 bit color? Could be that your vid card is only partially supported...are you using the standard VGA with the universal video driver?


SoftIce/Mouse compatibility
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce/Mouse compatibility
PDA

View Full Version : SoftIce/Mouse compatibility

flip
08-12-2001, 06:42 PM
I have SI working fine on a machine using a PS2 mouse, but am having a problem with another setup using a in-port mouse.
"Invalid VxD" fault.
Should I persevere trying to run with this setup or is it a lost cause


Softice and Hex Works - Not working for some reason
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice and Hex Works - Not working for some reason
PDA

View Full Version : Softice and Hex Works - Not working for some reason

CowNaetion
08-13-2001, 07:15 PM
Hello, I just downloaded softice and hex works yesterday, and having trouble. I'm using Windows 98 second edition, and the version of softice i downloaded was 3.24. I installed it with the universal driver and with the standard vga card. My settings for color is 16 bit. Everytime I load up my computer, it never gets to windows, it just sits at a blank screen. I ran it in dos and it pops up with a few variables saying what amount of memory usage it uses and then sits there frozen. No clue at all.

Hexworks works fine for patching dos applications, but when i goto patch any windows program, for example winzip, it won't work. I even put back the same values that i changed and it still doesn't work. Anyone know what this problem is about? The version I have is from their website.

Any help would be appreciated, I just got done learning low-level assembly programming and would just like to experiment before i continued on, but without the tools working, i might have to stick with dos applications. Thanks!


SmartChech and WinME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SmartChech and WinME
PDA

View Full Version : SmartChech and WinME

Billz G@tez
07-28-2001, 01:09 PM
How can I use SmartCheck 6.03 on Windows ME. When I launch a program, with SC, it tell me api errors and don't launch the program.

I need help !!!


USB+SICE = Driver Studio 2.5(b)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > USB+SICE = Driver Studio 2.5(b)?
PDA

View Full Version : USB+SICE = Driver Studio 2.5(b)?

Ptk
07-27-2001, 05:50 AM
Softice (DriverStudio 2.0.1) doesnt work with USB mouse. I heard that is in DS2.5b it's fixed.
//Where to get DS2.5?//


IceDump installation again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceDump installation again
PDA

View Full Version : IceDump installation again

Cps530
08-14-2001, 02:21 PM
I read: 'Just extract the icedump6.zip and choose the folder of Sice version and double click thr EXE'. Sorry, but I'm feeling like an idiot trying to install IceDump this way. I'm using W2k and DriverStudio 2.0. First of all I can't find my SoftIce version (command 'ver' shows: DriverStudio 2.0.0 (build 526)). Secondly, there's no executable file in the directory 'wnt' inside unzipped icedump 6.0.23. Could anyone help me? Thank so much.


Windows ME kernel not loading into SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Windows ME kernel not loading into SoftICE
PDA

View Full Version : Windows ME kernel not loading into SoftICE

Goat
08-17-2001, 05:04 PM
I'm not exactly sure how SoftICE detects Win API calls, but I can't set a BPX on anything on Windows Millennium. It has to be that OS because I've had the same problem with SoftICE v4.05 on two different systems with WinME. For instance:

:bpx GetDlgItemTextA
Symbol not defined (GETDLGITEMTEXTA)

Is the normal scenario for a breakpoint on any API. Also for those of you who had the problem, why can't I get SoftICE v4.25 to work on windows ME? After installing I reboot and my display is messed and I'm in Safe Mode. I know I'm doing the WinDDK stuff right because if I wasn't, how would SICE 4.05 work? :P

Anyway I've had this problem with SICE for quite some time and as you can see, that hinders things a bit. :-/

Thanks.
Goat
08-17-2001, 05:15 PM
I should also say that I'm loading the programs in Symbol Loader and it still doesn't work so that's not the problem. :P
Goat
08-17-2001, 05:31 PM
Bleh I fixed it. :p
HiTecCrkn
08-28-2001, 04:25 AM
I am getting the same problem with win2k but not with all bpx
When I say
bpx hmemcpy then I am getting
symbol not defined (HMEMCPY)
I have Uncommented WinIce.dat for Exp Statements.
Can you help
Goat
08-28-2001, 01:37 PM
Yeah I finally fixed it by downloading a file called wmldr.zip and then unzipping loader.exe into /windows/system/vmm32


Siftice405 and WinMe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Siftice405 and WinMe
PDA

View Full Version : Siftice405 and WinMe

shubh
08-19-2001, 10:30 AM
My OS is WinMe(4.90Build3000). I installed Softice4.05 but it is not getting loaded at all. I read on the net that the problem is with IO.SYS.
So i downloaded WinMeDBUG.exe from Micrsoft. I followed the directions but my PC refused to boot! I had to reinstall WinMe. Please tell me how can I make Softice work on my OS? Or please suggest me some other debugger which works like softice on WinMe?
Goat
08-20-2001, 12:12 AM
Before you install wme_ddk you should copy your old IO.SYS from the root to another directory. In the future you can replace the new one in case you want to reboot without softice or vice-versa.
Also if you have a problem booting, you can press F8 for the boot menu, choose the last one, and type NO when it asks you to load debugger.exe.

Then install the wme_ddk and put this debugger.exe (attatched to this message) in your windows directory, also rename it to debug.exe and put that one in the windows directory, too. It's a special exe that loads softice instead of the windows debugger.

After you install SoftICE make sure you have copied your winice.dat, winice.exe, and siwvid.386 from the softice directory to your windows directory.

Last of all, search google for wmldr.zip and copy loader.exe to C:\WINDOWS\SYSTEM\VMM32\ because some of the API's won't load into softice.

Then reboot and have fun.


Missing SoftIce Commands!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Missing SoftIce Commands!!
PDA

View Full Version : Missing SoftIce Commands!!

Mans
08-20-2001, 04:47 AM
Hello,

I have SoftIce 4.05 for Win9x and WinNT/2K. Both versions of the program cannot recognize BPR, BPRW, TRACE, nor SHOW commands! Can anyone please teach me how to activate theses commands?

Thanks in advance.
Mans
08-20-2001, 06:10 AM
Still waiting for hepl!! HELP PLEASE.


trouble installing icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > trouble installing icedump
PDA

View Full Version : trouble installing icedump

rowdy
08-20-2001, 02:46 AM
I am trying to install icedump in softice. When I run the patch file (icedump.exe) I get the message:-
icedump was not loaded yet
VXDLDR failed to load icedump
I am using icedump v6.0.2.3 and winice v4.05 build 334. Can anybody help?
CoDe_InSiDe
08-20-2001, 03:07 AM
Hi rowdy,

First of all i think this post should be on the Tools Board ;)
And second try this link:

http://usa3.hostrack.net/woodmann/Ultraboard/Public/HTML/B6/1060-1.topic.html

Cya...

CoDe_InSiDe
ianaston
10-15-2001, 09:57 PM
I have tried everything but VXD will not load.
Int 2f gives VXDLDR entry point but when I call this,
it returns with carry set (error) and ax = 8. (error code ?)
What is error code 8?
Do I need to have winice loaded before running icedump.exe ?

Any suggestions?

Thanks
DGR
10-16-2001, 05:11 AM
Heyhey,

Maybe an unnecesary question but... did you put the corresponding icedump file into either the system32/drivers or softice dir (or whereever it should be put).

Seems to me that the icedump is not in the dir where the patcher expects it to be.
EtErNaL_L0ser
10-16-2001, 05:21 AM
That solves my problem too thnx DGR :D
Thinner
10-16-2001, 04:53 PM
Hi,

where do you put the icedump.exe ?

I tried SI dir and system32/drivers, but it doesn't work...

THX
Fake51
10-16-2001, 06:41 PM
Typical problem in getting Icedump to work is that one has forgotten to edit the winice.dat file, to make it load exports from kernel32.dll. Icedump tries to locate the addresses of kernel32 api's by searching in softice's symbol base, and if it can't find these, it won't load.

Fake
rowdy
10-19-2001, 02:06 AM
SUCCESS!!

It seems that icedump will not load with norton crashguard installed. I uninstalled crashguard and voila!....it loaded.
Bengaly
10-19-2001, 05:52 AM
Installing IceDUMP:
-------------------
Extract the ZIP file (32bit with dirs.).
It is not important where to Extract IceDUMP.
Once extracted, should see Dirs:
TOOLS / W9X / WNT
| | +--------------------> WinNT VxD versions of SoftICE
| +-------------------+
MASM include files |
|
SoftICE win9X versions (Dos as well)
In this dir you should see allot of Dirs
Every dir represents SoftICE version,
Starting from DOS->Windows SoftICE versions.
Also there are some other Dirs for small
Utile (mp3 player..)

The first thing you do before running the IceDUMP exe file (VxD)
Is to ensure your SoftICE version, you can do that by loading SoftICE
And press VER
You will be given The SoftICE information.
For example, my SoftICE version is:

SoftICE 4.0.5 (Build 334)
Copyright (c) 2000 Compuware Corporation. All rights reserved

This means I have SoftICE 4.05 Build 334)
So I Run SoftICE for Windows98, so in IceDUMP Dirs for w9x
I need to enter the sub dir called: 4.05.334
And load the specific VxD for my SoftICE version.
*You don't need to put IceDUMP files in SoftICE directory.
My IceDUMP is installed at: D:\Dont Tuch\My Ducoments\Cracking\Ice Dump\w9x
Where SoftIce is installed at: C:\Program Files\NuMega\SoftIce95
You see, there is no need to move any files, when running the right IceDUMP VxD
Version for your SoftICE it will automatically ready to use.
And you can use more options IceDUMP have :-)
Have Fun.


Can anyone here help me with S-Ice for DOS??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Can anyone here help me with S-Ice for DOS??
PDA

View Full Version : Can anyone here help me with S-Ice for DOS??

Torque
08-19-2001, 11:18 AM
Hey,
I'm trying to setup s-ice for dos on my comp. However, whenever I start it up, I get a general protection fault and have to reboot my comp.
Does ne1 here have s-ice for dos and can help me? Maybe you can show me how to setup my config.sys or any other suggestions.

Thanx

Torque
Anticode
08-22-2001, 08:02 PM
Which version of dos is it?
for some reason s-ice for dos don't work on win9x command prompt (at least for me).

_Anticode
Anybody
08-24-2001, 08:03 AM
Hello

Normally an example of including S-ICE in CONFIG.SYS is included in the package (even in the pirated).
You must load it before any other drivers or TSR's and of course you cannot use HIMEM.SYS, EMM386.EXE, QEMM or anything like that, since S-ICE provides your computer with all their services. You might need to enable a memory hole at 16MB, but after that you have only 15MB of memory!
I think it's needless to say that you cannot run Windows when S-ICE is active.
noname
08-24-2001, 09:53 AM
Anticode (08-22-2001 18:02):
Which version of dos is it?
for some reason s-ice for dos don't work on win9x command prompt (at least for me).

_Anticode

Heya all,
it only works in dos6.22.it will never works in dos 7.1
so you have to downgrade your os to dos.622
regards
noname


New Tool: AirSnort
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New Tool: AirSnort
PDA

View Full Version : New Tool: AirSnort

31337
08-20-2001, 01:27 PM
AirSnort is a wireless LAN (WLAN) tool which recovers encryption keys. AirSnort operates by passively monitoring transmissions, computing the encryption key when enough packets have been gathered.

802.11b, using the Wired Equivalent Protocol (WEP), is crippled with numerous security flaws. Most damning of these is the weakness described in "Weaknesses in the Key Scheduling Algorithm of RC4 " by Scott Fluhrer, Itsik Mantin and Adi Shamir. Adam Stubblefield was the first to implement this attack, but he has not made his software public. To the best of the authors' knowledge, AirSnort is the first publicly available implementation of this attack.

AirSnort requires approximately 100M-1GB of data to be gathered. Once enough packets have been gathered, AirSnort can guess the encryption password in under a second.

http://airsnort.sourceforge.net


Win2K API names
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2K API names
PDA

View Full Version : Win2K API names

isotope
08-21-2001, 04:59 AM
Where might I download NTOSKRNL.DBG to translate Win2K API names?
Solomon
08-21-2001, 11:58 PM
Try the web site of M$.

The debug symbol files are in the Win2K installation CD, too
isotope
08-22-2001, 06:35 PM
Found the files on M$. All 180 MB (Win2K and SP2). Downloaded, (at work) and extracted the NTOSKRNL and NTDLL DBG and PDB files.

Looks like I might have to install the whole thing so that everything overlays properly, then translate, then delete all the excess. Is this about right?


Invalid Page Faults
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Invalid Page Faults
PDA

View Full Version : Invalid Page Faults

Ren
08-21-2001, 09:40 AM
Anyone know why Softice Breaks on Invalid Page Faults & how I can disable it from doing so?
Kayaker
08-21-2001, 10:27 AM
Hi,

Simple solution. Add 'faults off' to the INIT= line in your Winice.dat file.

Kayaker


Ultra IdeAsm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Ultra IdeAsm
PDA

View Full Version : Ultra IdeAsm

vgb
08-23-2001, 11:20 AM
Anyone know how to reach ShADe & Code FUmbler? Can't get their IdeAsm to work and their support link gets bounced as undeliverable to closed account.
INstalls fine and runs fine first time but get illegal ops on any further runs.

Thanx,

vgb


SoftICe Resolution
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICe Resolution
PDA

View Full Version : SoftICe Resolution

Goat
08-26-2001, 12:59 PM
Hey I have my screen resolution at 1600x1200 and I my softice is at about 400x600--one fourth the size of my screen which is way to small. Anyone know how to up the softice resolution without downsizing my screen?
Carpathia
08-26-2001, 02:33 PM
LINES XX and COLS XX (or COL perhaps, i dont recall).
Either way, you could have found this out by reading the manual, or using the help command.
stanks
08-28-2001, 01:15 PM
Carpathia (08-26-2001 12:33):
LINES XX and COLS XX (or COL perhaps, i dont recall).
Either way, you could have found this out by reading the manual, or using the help command.

COLS XX==WIDTH XX

greetz
Mostek
08-28-2001, 05:08 PM
here is my macro.
MACRO resize="set font 3;lines 37;width 100; wd 6; wc18;"

Peace
Mostek


vbox vs procdump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > vbox vs procdump
PDA

View Full Version : vbox vs procdump

zare
08-28-2001, 11:05 AM
last time i cracked derive 5 which is protected with vbox 4.3. Then i wanted to crack f-secure antivirus 4.09 which is also protected with vbox 4.3.
I located the oep and made an infinite loop. then i started procdump and configured it as it says in dezzy's tut (about vbox-config worked with derive). i tried to dump the bastard but all i got was a msgbox saying that this process cant be dumped. does anyone know how to fix this problem?
thanx
jomamameister
08-28-2001, 01:08 PM
Actually, if you use guw32 by unpacking gods at
http://www.absolutelock.de/construction/frame.html you can defeat vbox on win98. i know this is a lame response to your question, but if you really want the prog, this may help. i have used this on several vobx protected progs and it has worked well.
jomamameister
nud
08-29-2001, 10:44 AM
I had the same problem with f-sec av version 4.09 also. There was a message on this board a while ago suggesting that using procdump's "dump (partial)" might work, but it didn't work for me. Trw2000's makepe didn't work either. I tried using Icedump to just dump the memory range with the program in it, but I wasn't able to get it to work.


How can i know softice's program interface?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How can i know softice's program interface?
PDA

View Full Version : How can i know softice's program interface?

strangename
08-30-2001, 08:06 AM
Hi, all
I want to write a plugin for softice, but i do not know the functions that softice provides,
and i did not find any document about it, does anyone know that?
Please help me!
Thx.
aimless
08-31-2001, 12:49 AM
Hullo,

You need to go to:

www.programmertools.com

You need to go to the subsection: debuggers

Search for .SEX (Softice extensions for Win NT)

Provided with source code, how to insert your plugins...

Have Phun
Kayaker
08-31-2001, 12:56 AM
Hi,

You'll want to check this out as well - SoftICE Internals by Spath

http://208.50.16.104/crackz/Tutorials/Siceints.txt

Kayaker
strangename
09-01-2001, 04:19 AM
Thank aimless and kayaker!
I get the sex.zip and the icedump both, but i find they use different way to extend softice.In sex.zip, it use microsoft's deubgger interface, in icedump it use numega's softice
interface. As to the later, it just has a inc file and no any details.
Is there any document about the inc file?


Softice breakpoint on a string??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice breakpoint on a string??
PDA

View Full Version : Softice breakpoint on a string??

jerrydav
08-30-2001, 07:46 PM
Hello!

I'm quite new in reversing and I have some problems trying to crack a dos program. I disassembled the program and I want Softice to break to a specific line or command saw in the disassembled program. For example, I want to break on : "cmp eax, 00000002". Is there a way to do that?? Of if I want to break when a specific string is written in memory like : 'test', how can I do that??

Jerry
aimless
08-31-2001, 12:45 AM
Hullo,

First things first...

a. If you are cracking a DOS proggy, then I'd suggest you crack using Win95/98. During startup, select the F8 key, select DOS only and crack from there.

b. To crack DOS proggys, use Softice for DOS and not the one for win9x.

Now that they are out of the way...

The instruction will have an address in the disassembly. For example:

xxxx:yyyyyyyy cmp eax 00000002

You need to breakpoint on the address and not the instruction. For example in softice:

bpx xxxx:yyyyyyyy

This will break whenever this address is accessed. If this instruction is in a loop, it will break on EVERY iteration/round of the loop.

For searching strings...

do a search first. Example:

s 0:0 l ffffffff 'test'

(please note the single quote on the string)

For EVERY instance of test that you find, breakpoint on memory access read/write for that string ADDRESS. Example:

bpmb xxxx:yyyyyyyy rw

where xxxx:yyyyyyyy are EACH addresses that you find duing the search command above. So, if you find 4 such address, you have to apply the bpmb to ALL the 4 addresses.

Thereafter, ANY access (Read or Write) to that string will breakpoint. And may I suggest that you keep the Ralf's Interrupt List with you at ALL times...

Have Phun.


Sorry for the big messageboard interruption.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Sorry for the big messageboard interruption.
PDA

View Full Version : Sorry for the big messageboard interruption.

tsehp
09-08-2001, 03:21 PM
Coming back from vacations, your isp just tells you after 1.5 year :
Just be gone in 10 days, and then shut down your account after 2, leaving your poor chances of verifying your backups and downloads.

And that was the problem + big Ultraboard based failures, we had lost all the rce general board messages, so I had to reconstruct the whole big archive and it took a long time, I just hope that this interruption didn't discouraged you to come here and trade your knowledge.

They can shut down the site, they can't kill the knowledge and archives, so we're back and more motivated as ever.

Now all the files have been transfered to this new php script, much faster and reliable, I hope you'll like it.
We'll try to change the colors in the future as long as there are suggestions.

regards,

Tsehp


Welcome to the new board ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Welcome to the new board ;-)
PDA

View Full Version : Welcome to the new board ;-)

tsehp
10-25-2000, 07:26 PM
I just hope this new look will be ok for everyone, this application is
still in testing phase. You'll soon have the option to upload files and share them.

You can register yourself as a member and write a profile, so nobody
can impersonate you, the mail and avatar duplicates are checked
by the host.

Thanks to report and comment this new place.

best regards,

tsehp
woodmann
10-26-2000, 05:40 PM
Very nice job T.
Peace, Woodmann


Congratulations and Thanks...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Congratulations and Thanks...
PDA

View Full Version : Congratulations and Thanks...

H+R
10-25-2000, 09:09 PM
... To all of you who have kept the message
boards alive.

Perhaps, by closing the old message boards,
someone has actualy done us all a great
favor! The improvements tsehp and others have
added to the new message board will surely
be of help to us all!

You've all done a great job... Thank you!

Hackmore Readrite


Very cute. My compliments
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Very cute. My compliments
PDA

View Full Version : Very cute. My compliments

Epic
10-26-2000, 01:33 AM
:o
Epic
10-26-2000, 01:42 AM
A minor problem ;)

And a question: are you logging ip numbers?

Best wishes

Epic
tsehp
10-26-2000, 02:16 AM
I would like to keep the settings like they actually are : no logging !
But, three msgboards were destroyed by golem, he will try to get
inside and the ip could be logged until he leaves us definitly.
Then, the normal anonymous settings will stay without any logging.
regards,

tsehp
stillnewbie
10-26-2000, 06:54 AM
Hi +Tsehp,
Take a look at +Sandmn's forum,
someones change the moderators name

regards
stillnewbie
tsehp
10-26-2000, 07:06 AM
Thanks ! If you see something more to add, feel free.
The upload files feature will be ready in the next hours.
Where were you contributing ? We didn't saw you for a while.
regards,

tsehp
vgb
10-26-2000, 11:55 AM
I like the new board. Took me a bit to get used to but conigrats on a great job. Hopefully our prior troubles will not continue, it is a lose-lose situation.

Thanx for the efforts,

vgb
+Sandman
10-26-2000, 01:29 PM
Greetings...

The changes at my forum (re: Moderator Change) was carried out by me, and me only. I expect many more changes to the new mb until I'm satisfied it can self/regulate itself without much further assistance from me..)

Keep up the *valuable* work forum Admin's, your doing just fine!

Correction.. The Newbies Forum was just shut down.. Hum, I wonder why..

Regards
+Sandman


moderator's name
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > moderator's name
PDA

View Full Version : moderator's name

tsehp
10-26-2000, 07:02 AM
already hacked ? Don't think so, maybe sandman's is changing his
settings.

tsehp


A lot of more to do...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A lot of more to do...
PDA

View Full Version : A lot of more to do...

tsehp
10-26-2000, 01:35 PM
Thanks sandman,
What I'm planning to do is to make all the information available in one
click, a good search engine will be included, it will index the most essays possible. So I need help, I'll write you personnaly to tell what.

You can make some suggestions to improve this place, you're always
welcome.

regards,

tsehp


Nice new interface...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Nice new interface...
PDA

View Full Version : Nice new interface...

Petroff
10-26-2000, 02:04 PM
I hope I'll get used to it. Nice to have both boards very close to each other. Bad to have to enter e-mail adress (whatever). Congrats and keep moving - forget ITW and remember the rest ;)
Now question:
What happened to zencrack2.cjb.net? My little dongle asks for refreshing memory and it looks like the best place for that is gone. Litespeed.org the second best is under some construction as far as I could figure out. So where to go?
tsehp
10-26-2000, 02:33 PM
Hi petroff,
thanks for your support. I'm still working a lot on this place, I have to
add some news essays and a good search engine to retrieve the
last updated essays.

For zencrack, goto http://sr7.xoom.com/zenrce/
you should find a working host.

best regards,

tsehp
Petroff
10-26-2000, 04:37 PM
Thx tsehp.Unfortunately there was no use of the link. It leads to where I've been before. However I'll have to try to rewrite that sspro routines without a reference book :).

Regards
Amante4
10-26-2000, 06:09 PM
Hi,

Crackz is still working his way through
redoing his website last time I spoke with him. So it'll be down for another week or so I presume. Wait a week
or so and check back.
Petroff
10-27-2000, 03:15 AM
Hi, Amante4.

I liked very much your IDA plugs ;)
Yeah CrakZ at work. However thx.

Greets.

Petroff


The Newbies Forum Shut Down Again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > The Newbies Forum Shut Down Again
PDA

View Full Version : The Newbies Forum Shut Down Again

Clandestiny
10-26-2000, 05:30 PM
Greetings,

+tsehp it appears that you were right about the newbies forum on on ezboard being short term. Apparently it has been "locked down in accordance with ezboard's terms of use".

Regards,
Clandestiny
tsehp
10-26-2000, 05:44 PM
I offered him to open a newbie's board on this place, I hope he will
be ok, then problems will be finished.
I just can't believe that.

tsehp


YAY!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > YAY!!!!
PDA

View Full Version : YAY!!!!

?ferret
10-26-2000, 10:12 PM
I can use my "?" here! LOL

(ezboard wouldn't let me)


Hi Revesers,Nice board,WOW
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hi Revesers,Nice board,WOW
PDA

View Full Version : Hi Revesers,Nice board,WOW

esther
10-27-2000, 05:33 AM
Hi Revesers Nice board,WOW
tsehp
10-27-2000, 01:28 PM
Hi !
Thanks for your congrats, we're just actually on testing phase, some
new features will be added, like a good search engine indexing a local
essay's repository.
We are awaiting your suggestions to make this place great and enjoyable for the rce community, at this time you can start to use it and start your topics or ask rce oriented questions I'll be pleased to help in any way.
regards,

tsehp


May the Schwarz be with you
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > May the Schwarz be with you
PDA

View Full Version : May the Schwarz be with you

Fake51
10-27-2000, 09:45 AM
Let's hope this one lasts ...

Fake
tsehp
10-27-2000, 01:41 PM
Hi,
sandman's idea was to keep the knowledge safe and they built the rce cd. All the info is there, safe and available, updates are coming with new cds.
All the topics starting here are stored as backups and stored on local computers.
The host closes the account ? No problem, the msg is installed somewhere else and the topics appears back in minutes, nothing is lost this time.
later,
tsehp


FWIW - help is not functioning
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FWIW - help is not functioning
PDA

View Full Version : FWIW - help is not functioning

vgb
10-27-2000, 11:11 AM
FYI, clicked on a few of the help topics and - nada.

Otherwise, all is well.

vgb
tsehp
10-27-2000, 02:05 PM
Hi,
just used it and everything was fine.
What browser do you have, is it the last java version ?

tsehp
vgb
10-27-2000, 08:03 PM
Using IE5.0 with java enabled. tried from home also - same problem but I'm sure it's something in my config. I use ZoneAlarm and AdsOff but I disabled them both with no change. I'll check for later java stuff and see what happens.

vgb
tsehp
10-27-2000, 08:14 PM
Watch out with addsoff, there's a bad written device that :
1-impeaches windows update
2-causes some problems to some progs using winsock2, I now use adfilter and have less but still problems, I never managed to find a
good anti ad program.

Does the window appears ? Did you tried to sniff the packets to see
where it goes wrong ?

tsehp


Ok , first rce topic : asprotect 1.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Ok , first rce topic : asprotect 1.1
PDA

View Full Version : Ok , first rce topic : asprotect 1.1

tsehp
10-27-2000, 08:21 PM
Did someone managed to reverse it or rebuild the import table ?
I made my first attempt on the last commview's version (2.3) and finally used a process patcher coded by r!sc.
It works fine, you just have to kill the anti softice routines and locate
the bytes to patch. The only problem is that your crack is win9x dependent, between nt and 9x , asprotect loads at different addresses. If someone is interested, I can give more details.

tsehp
Alexey Solodovnikov
10-28-2000, 06:23 AM
> Did someone managed to reverse it or rebuild the import table ?

Yep, I did.

> If someone is interested, I can give more details

Great! Could you send details to asprotect@aspack.com? I need for
this info for the next version.
JimmyClif
10-28-2000, 06:40 AM
LOL...

I bet you did Alexey, hehehe
tsehp
10-28-2000, 07:12 AM
Thanks for your reply, I've sent my method to the address you provided me, and also an updated asprotect version to impeach what I found to work. Can you try to reverse it ? I plan to submit a job carrier at asprotect's team :P

regards,

tsehp
tsehp
10-28-2000, 08:38 AM
Hi again,
understand that's a reverser's board and I just can
be such a traitor for this community ;)
But I have to admit that I really took some great pleasure to reverse the 1.1, it was much harder
than the 1.05 version, for which I published an essay.
So, congratulations, to me asprotect seems to be
one of the most difficult to beat, but +orc said :
If it runs it can be defeated !
Bogus
10-28-2000, 10:53 AM
Import List Rebuilder:
http://www.reversing.net/TOOLS/016/readme.htm
http://www.reversing.net/TOOLS/016/Imp_list.zip
if it can decrypt import - it generate import0.bin - valid import section, just insert it to dump, bla-bla-bla...
freddyk
10-29-2000, 04:37 AM
OK a q on aspr 1.1 - it kills regmon when it runs, so you cant watch its registry stuff (same as in the new aspack 2.11... and he says its just updated for bugfixes - yeah right alex) - any idea how to bypass without editing aspr

Also for 2.11 he sets up a reg key for the 30 days stuff - what variable does he use to decide this (the reg location (CLSID) changes on diff PCs)

FK
Dr.Golova
10-29-2000, 06:19 PM
for bupassing closing RegMon just change in regmon.exe their window class ("RegmonClass") and window title ("Registry Monitor - Sysinternals: www.sysinternals.com").
Solomon
10-31-2000, 03:53 AM
If u are using Win9X, there is another way to bypass the RegMon check:
try "Win-eXpose Registry" from http://www.shetef.com.


What happened to newbies forum relocating here?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What happened to newbies forum relocating here?
PDA

View Full Version : What happened to newbies forum relocating here?

?ferret
10-27-2000, 09:23 PM
Earlier Tsehp announced that +Sandman was going to bring the newbies forum here....and had a board all ready & waiting...the board is gone now and so is the announcement & replies...what happened?
tsehp
10-28-2000, 01:53 AM
I don't have any news from him since his last posting. He could maybe have changed his mind, so I prefer not to impersonate him and finally
let him create it by himself on this server if he wants to do.
Were you on the last deleted newbie's forum ?

tsehp


The sandman's newbie forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > The sandman's newbie forum
PDA

View Full Version : The sandman's newbie forum

tsehp
10-28-2000, 02:53 AM
Hi,
the link from his site is still not working. I'm awaiting his final decision.
Just in case the newbie's forum is installed elsewhere, thanks to report
here, so I'll update my links page.
regards,

tsehp
+Sandman
10-28-2000, 08:49 AM
Greetings +tsehp...

The Newbies Forum is once again up and running and it's "business as usual".

Thanks for your assistance, IOU 1..)

Respects
+Sandman


NVIDIA Detonator problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > NVIDIA Detonator problem
PDA

View Full Version : NVIDIA Detonator problem

Diway
10-28-2000, 04:07 AM
I juste want to know if someone has found a solution to the SoftIce not popping/Detonator 3 problem.

Cya
tsehp
10-28-2000, 07:25 AM
I have to get back to this story, can you give more details ???

You mean when you bpx something in detonator, sice doesn't popup ?

tsehp
Diway
10-28-2000, 08:21 AM
>You mean when you bpx something in detonator, sice doesn't popup ?

hum, not really. When I load NTICE under Win2K and when I press Ctrl+D, nothing appears, but SoftIce is running and I have to press F5 to go back to windows.

I think xOANINO (and others) already spoke about this problem but without finding a solution :(
dELTA
10-30-2000, 05:40 AM
No, I think he actually found a solution. He posted it on the old board. If noone has it I think I saved it at home, and I can post it in a day or two...
xOANINO [UCF]
10-30-2000, 06:04 AM
Hi dude,
i've posted already about that. The issue is the incompatibility of SICE 4.05 with Detonator drivers from 6.18 til the newest.
The solution is
A) get the new SICE from Driverstudio v2.0
B) install drivers oldest than 6.18 (or the original drivers which comes in the Win2000 package)
L8Rs

xOANINO
roocoon
10-30-2000, 01:44 PM
Solution (A) doesn't work xOANINO, I'm sorry to say.
I'm using DriverStudio 2.0 with Detonators 6.34. Same problem. Even with 6.34 WHQL drivers there are no changes.
Sice screen came up when I booted the system (with Sice in Manual mode). It even came up when I went into 3DMax. I didn't break on anything. I came out of Max and Sice became invisible from then on.
It just doesn't handle its video buffer too well with NVidias, I'd guess.
Booting up in other than Manual mode doesn't make a difference. It could behave the same way or it could be that it never shows its screen.
Nevertheless, on two driver releases back (6.31 I think) it used to work fine until one day it just stopped. If I remember right, I got it to work by just reinstalling DriverStudio. (I didn't try this now. I got fed up with it and I'm just using my NT box).
If I'm right, it would imply that the graphics driver detection and test works fine only on initial installation. After that (say, when you upgrade the graphics driver) detection doesn't work properly. Maybe they implement a subset of it?
Talk about groping in the dark...


Thanks +Tsehp, problem solve Isp problem :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Thanks +Tsehp, problem solve Isp problem :)
PDA

View Full Version : Thanks +Tsehp, problem solve Isp problem :)

esther
10-28-2000, 05:21 AM
Thanks +Tsehp, problem solve Isp problem :)
tsehp
10-28-2000, 07:29 AM
Yep, it doesn't mean that the account could not close, but everything
can appear back somewhere else in hours, with all the posts restored
this time ;)

tsehp


Any unpacking guru please help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Any unpacking guru please help
PDA

View Full Version : Any unpacking guru please help

LaptoniC
10-28-2000, 06:10 AM
I am trying to unpack Deep Paint it is packed with vtcyberpack.It is very similar to vbox usual trial,buy stuff.I run the program when dialog appears bpx with getprocaddress in trw run the program.It stopped and I am in some temp file after some tracing I cam back to vpack24.dll.

0167:02483503 CALL `KERNEL32!FreeLibrary`
0167:02483509 LEA ECX,[EBP+FFFFF418]
0167:0248350F PUSH ECX
0167:02483510 CALL `MSVCRT!_unlink`
0167:02483515 ADD ESP,BYTE +04
0167:02483518 CMP DWORD [EBP+FFFFF2D4],BYTE +00
0167:0248351F JNZ 02483526
0167:02483521 JMP 0248364D
0167:02483526 CMP DWORD [02491744],BYTE +01
0167:0248352D JNZ 0248354C
0167:0248352F MOV EAX,[02491738]
0167:024834F0 CALL `KERNEL32!LoadLibraryA`
0167:024834F6 MOV [EBP+FFFFF2D4],EAX
0167:024834FC MOV EAX,[EBP+FFFFF2D4]
0167:02483502 PUSH EAX
0167:02483503 CALL `KERNEL32!FreeLibrary`
0167:02483509 LEA ECX,[EBP+FFFFF418]
0167:0248350F PUSH ECX
0167:02483510 CALL `MSVCRT!_unlink`
0167:02483515 ADD ESP,BYTE +04
0167:02483518 CMP DWORD [EBP+FFFFF2D4],BYTE +00
0167:0248351F JNZ 02483526
0167:02483521 JMP 0248364D
0167:02483526 CMP DWORD [02491744],BYTE +01
0167:0248352D JNZ 0248354C
0167:0248352F MOV EAX,[02491738]
0167:02483534 PUSH EAX
0167:02483535 MOV EAX,[02491720]
0167:0248353A PUSH EAX
0167:0248353B MOV EAX,[02491768]
0167:02483540 PUSH EAX
0167:02483541 MOV EAX,[02491770]
0167:02483546 CALL EAX
0167:02483548 TEST EAX,EAX
0167:0248354A JZ 02483558
0167:0248354C POP ESI
0167:0248354D POP EBP
0167:0248354E POP EBX
0167:0248354F MOV ESP,EBP
0167:02483551 POP EBP
0167:02483552 JMP NEAR [02491754] ;here is OEP I guess

I run this jump JMP NEAR [02491754] I am in again real exe.Makepe in trw made unpacked exe with string.When I run it runs but it gives error that it cant find fileio.dll whcih is located program directory.Any help or suggestion wiil be greatly appreciated
Thanks
program is located at htt*//www.righthemisphere.com/
tsehp
10-28-2000, 07:21 AM
just before I check the prog,
did you checked the dll's imports into your dumped app ? The dll's import should appear normally in the iat is well rebuilt.
If yes, did you use filemon to see where it searches the dll ?
if yes, in what dir ?

tsehp
LaptoniC
10-28-2000, 11:44 AM
I guess every import is here.It loads but file operations doesnt work open save etc.It looks this dll in programs own directory which is already there.Maybe loading dll is done with vtpack24.dll and when I unpacked it it doesnt work I dont know
Sab
10-28-2000, 10:48 PM
Im no unpacking guru.. but ive ran into vtccyberpack and as i recall.. it didnt really encrypt anything in the exe. If you go to program entrypoint ull notice a call smack right there. That call from what i remember calls the vboxish looking screen. Also about 20 lines of code down from that ull see several mov eax, valuehere and followed by a jmp to location . Find the one that is either equivalent to buying and set it to jump there so it thinks its still good trial and and nop the vboxish looking screen in the program entry p oint. Also there are like 2 checks it makes really easy to patch ull get a message box just backtrace and change the bytes to jump over it and keep running. That should work.. maybe heh unless theyve changed the protection .
LaptoniC
10-29-2000, 05:51 AM
I found that my unpacking is working but you should change filename to original name (deeppaint.exe) otherwise it crashes.It is very easy to unpack no import rebuild no sice check like in old days


Question to +SandMan
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Question to +SandMan
PDA

View Full Version : Question to +SandMan

Dya-Blo
10-28-2000, 12:09 PM
Hello +SandMan,

i just would like to know if you are continuing your site (the ZEN section) ?
when will there be a 4 challenge ?

Thanks for all, Later.
+Sandman
10-28-2000, 12:49 PM
Greetings...

This I know is long over-due, the idea I originally had for this is still inside my head, I just need to spend some serious time on getting it written down on paper. Need to do some research on it first tho.

I will email you directly when/if I finish Part IV.

Regards
+Sandman
ThRaX
10-29-2000, 10:46 AM
awesome, the ZEN part of your site is REALLY nifty, you can learn more from that than you can using any tutorials on just *cracking*

cya
--thrax


CommView 2.3 and Asprotect memory patching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CommView 2.3 and Asprotect memory patching
PDA

View Full Version : CommView 2.3 and Asprotect memory patching

TOTEU
10-28-2000, 12:59 PM
T=9000: ; HOW MANY ATTEMPTS BEFORE QUITTING
F=cv.exe: ; PROCESS TO PATCH CommView 2.3 build 67
O=callcv2.exe: ; LOADER TO CREATE
P=11DBF94/53,56,57,8B,FA,8B,F0,B2,01,B8,F8,44,1D,01,E8,41,69,FF,FF,8B/81,FA,8D,04,07,00,75,06,B8,B2,1D,71,09,C3,B8,F1,F6,C3,77,C3: ; bypass 2 MD4derived checks
P=4ECDD7/80,38,00,75/C6,00,01,EB:; no more demo(below this one, code to set various versions Professional,MultiOS etc not tested)
P=4AC58F/83,38/EB,07: ;NOT REALLY NEEDED
P=4AC5C4/8B,00/90,90: ;NOT REALLY NEEDED BUT SEE About Box after
P=48E15B/DF,E0,9E/66,33,C0: ;this is to bypass another check for expired
P=4664BA/74,08/EB,08: ;bypass NTICE and SICE check from cv.exe
P=4EB7FD/C6,00,00/C6,00,01: bypass "unlicence"

$

this is a method for memory patching Asprotect with csir.cjb.net Risc loader

first MD4 derived checksum is 09711DB2
second MD4 derived checksum is 77C3F6F1
find MD4hash by bpx MapViewOfFile immediatly after found MD4hash routine

this is quick hack:
more interesting is to set these variables:

4F6D0C dword pointer to regusername
4F6D10 dword pointer to 1 or 2 string ascii set Professional or MultiOS
4F6D14 dword pointer regusername+8AEh
4F6D18 dword UPGRADETIME
4F6D1C byte 1 licenced/0-eval
4F6D1D byte 0 good/ 1 expired
4F6D1E byte 0 idem
4F6D1F byte 0=Personal / 1 Personal or Prof or MultiOS
last value is used in combination with byte @4F6D1C

immediatelly after verifylicencecwl @0048DA28
other useful resources:
-------------
push pointer buffer to store unencrypted string
push key for decrypt
push pointer encrypted string
:0048D9C0 decryptstring procedure
----------------

if expired in registry RLS\ExtFilter2 == 1
there are other two checks randomized ( one in win.ini ADAPTER and one in LOGS):
checkexpired procedure @0048E0ED
randomize procedure @00402CE0
tsehp
10-28-2000, 07:40 PM
Well done,
here's mine, uncommented (had to create it back from scratch),
but working on a win nt 2000, the asprotects addresses are not the
same :
T=10000000:
F=cv.exe:
O=cv_loader.exe:
P=d2f506/74/eb:
P=d2f564/01,04,24,c3,c3,8d,40,00/c7,04,24,6c,f5,d2,00,c3:
P=d305b5/31,04,24,e8,01,00,00,00/c7,04,24,a4,fb,d2,00,c3:
; I only remember that the two lines above are to disable the mem
;checksum of asprotect
P=d2f855/50,c3,5b,6a,10/e9,c2,34,7c,ff:
P=4ecdda/75/eb:
P=4ee64c/76/eb:
P=4eedf9/74/eb:
P=4ecd94/74/eb:
P=48e2d4/76/eb:
P=48e2e7/80,7d,ff,01,75,07/b8,20,02,12,00,90:
P=4f2d61/74/eb:
P=4eb5f1/0f,84,90,00,00,00/90,90,90,90,90,90:
P=4664ba/74/eb:
P=48e3b3/75/eb:
$

I didn't attempted to recreate the iat, did you ?

tsehp
TOTEU
10-28-2000, 08:23 PM
Of course not...I'm _lazy_ after all...And, remember my post on the old board, in version 1.05 I applied the same tehnique
but the checksums were CRC32hashes..

Regards,
TOTEU

PS:
Did you notice the check for Numega Softice Loader by FindWindow in Essential Nettools..an old version...2.2 build 51.I'll check the latest to see if they changed the code..
The Owl
10-29-2000, 04:16 AM
and what about iceload?
tsehp
10-29-2000, 05:15 PM
And alex did some changes in asprotect 1.1, an int2e calls (in winnt)
a win32 function (can't remember the name) that voids dr0-dr3 about
120 times before the entry point. Nice work. Didn't tried iceload,
but if asprotect voids the debug registers and tests dr7 for >400, then
iceload is useless to me.
Sice seems to loose easily control about the debug registers, you have
to wait for certain calls to occur (mem copy fox example)while tracing the prog to watch softice update those registers. I'll ask numega to fix
this ;)
The Owl
10-30-2000, 07:14 AM
And alex did some changes in asprotect 1.1, an int2e calls (in winnt)
a win32 function (can't remember the name)

when you do, please post it here ;-)

Didn't tried iceload, but if asprotect voids the debug registers and tests dr7 for >400, then iceload is useless to me.

actually, i suggested iceload for avoiding that FindWindow trick mentioned before, of course iceload has nothing to do w/ DRx. reminds me, under win9x icedump enforces 0x400 (instead of 0x700) in DR7 (whenever no DRx type BPs are set of course). this and the tracer should be able to do it, however i did not have time to test this myself.
tsehp
10-30-2000, 11:43 AM
Here it is,
lots of time, asprotect 1.1 calls an int 2e to 804668b0+a8c with param=2
you trace a little and you land here :
00462BB9 jz near ptr byte_462C84+1
00462BBF
00462BBF loc_462BBF: ; CODE XREF: .text:00462BB0j
00462BBF mov ebx, dr0
00462BC2 mov ecx, dr1
00462BC5 mov edi, dr2
00462BC8 mov [ebp+18h], ebx
00462BCB mov [ebp+1Ch], ecx
00462BCE mov [ebp+20h], edi
00462BD1 mov ebx, dr3
00462BD4 mov ecx, dr6
00462BD7 mov edi, dr7
00462BDA mov [ebp+24h], ebx
00462BDD mov [ebp+28h], ecx
00462BE0 mov ebx, 0
00462BE5 mov [ebp+2Ch], edi
00462BE8 mov dr7, ebx
00462BEB mov edi, large fs:20h
00462BF2 mov ebx, [edi+2F8h]
00462BF8 mov ecx, [edi+2FCh]
00462BFE mov dr0, ebx
00462C01 mov dr1, ecx
00462C04 mov ebx, [edi+300h]
00462C0A mov ecx, [edi+304h]
00462C10 mov dr2, ebx
00462C13 mov dr3, ecx
00462C16 mov ebx, [edi+308h]
00462C1C mov ecx, [edi+30Ch]
00462C22 mov dr6, ebx
00462C25 mov dr7, ecx
00462C28 jmp short near ptr byte_462C84+1

Don't pay attention to the fake addresses, in himem it corresponds to
0x804668b0+a8c , its the exReleaseResourceForThread API from ntoskrnl.exe on winnt.
This surely voids your debug registers and impeach a bpmb.
The quick crack, force to jump at 462bb9 (listing address).
The same routine is repeated about 8 times in ntoskrnl, you have to patch them all, then you can put some bpmb's again.
Regards,

tsehp
risc
10-30-2000, 01:40 PM
he clears dr0..3 in his many exception handlers..

add dword ptr [eax+0B8h], 2 ; increase eip in context struct to point past dodgy opcode
push ecx
xor ecx, ecx
mov [eax+4], ecx ; clear dr0 in context struct
mov [eax+8], ecx ; dr1..
mov [eax+0Ch], ecx ; dr2..
mov [eax+10h], ecx ; dr3..
mov dword ptr [eax+18h], 155h ; dr7 -> 101010101h ..
pop ecx
loc_40ED89:
xor eax, eax ; we handled exception.. blah
retn ; return contol to system..

which will in turn call _vwin32_set_thread_context on win9x, or int 2eh on NT/2k :/

_vwin32_set_thread_context is a lot simpler to patch than the NT equivlent.

wouldnt it be terrible if he stored decrypt keys or such in the debug registers, instead of 00000000 ..
alias
10-30-2000, 05:36 PM
Can you please post the code that calls int 2eh
(i.e., what is put into eax and edx)?

This seems to do what SetThreadContext() can't on NT/2000.
tsehp
10-30-2000, 08:29 PM
Sure,
here's the code on a winnt 2k service pack 1
inside asprotect 1.1, to get there first do a bpx getmodulehandlea
do "stack" until you see that it was called from asprotect.
do 3 p rets, disable bpx
bpx regclosekey, then F5
trace a little, you land here, the disassembly shows bogus code, it
does small jumps so the code is not what you see. real addresses.
seg0000:d304f2 call near ptr 4D80h
seg000:D304F7 add al, 0EBh
seg000:D304F9 add ax, bp
seg000:D304FB mov [bx+si+8], cx
seg000:D304FE jmp short near ptr 501h
seg000:D30500 ; ---------------------------------------------------------------------------
seg000:D30500 call near ptr 4D8Ch
seg000:D30503 or al, 0EBh
seg000:D30505 add ax, bp
seg000:D30507 mov [bx+si+10h], cx
seg000:D3050A jmp short near ptr 50Eh
seg000:D3050C ; ---------------------------------------------------------------------------
seg000:D3050C int 20h ; DOS - PROGRAM TERMINATION
seg000:D3050C ; returns to DOS--identical to INT 21/AH=00h
seg000:D3050E ; ---------------------------------------------------------------------------
seg000:D3050E mov word ptr [bx+si+18h], 55h
seg000:D3050E ; ---------------------------------------------------------------------------
seg000:D30513 db 0 ;
seg000:D30514 db 0 ;
seg000:D30515 ; ---------------------------------------------------------------------------
seg000:D30515 jmp short near ptr 518h
seg000:D30517 ; ---------------------------------------------------------------------------
seg000:D30517 call near ptr 0F073h
seg000:D3051A add ax, bp
seg000:D3051C xor ax, ax
seg000:D3051E retn -> this one leads to
77f8e064, then one ret and finally get into the call to 77f820f3, heres
the int 2e :

seg000:77F820F3 mov ax, 1Ch
seg000:77F820F3 ; ---------------------------------------------------------------------------
seg000:77F820F6 db 0 ; <- bad translation
seg000:77F820F7 db 0 ;
seg000:77F820F8 db 8Dh ; ì
seg000:77F820F9 ; ---------------------------------------------------------------------------
seg000:77F820F9 push sp
seg000:77F820FA and al, 4
seg000:77F820FC int 2Eh <-there you are seg000:77F820FC ; DS:SI -> counted CR-terminated command string
seg000:77F820FE jmp near ptr 892Ah
seg000:77F820FE ; ---------------------------------------------------------------------------
Are you thinking about hooking the int 2e ? I didn't manage to guess
the return point before this call.

tsehp
alias
10-30-2000, 11:37 PM
I am thinking of hooking the system service dispatch table (SSDT).
The value of eax just before int 2eh gives the service number. Once you know this,
you can hook that service using the method given in
"Undocumented Windows NT" by Dabak et al. (a short driver
that calls ntoskrnl!KeServiceDescriptorTable() to get the
address of the SSDT, and patches the SSDT entry indexed by
the service number)
alias
10-30-2000, 11:42 PM
I am thinking of hooking the system service dispatch table (SSDT).
The value of eax just before int 2eh gives the service number. Once you know this,
you can hook that service using the method given in
"Undocumented Windows NT" by Dabak et al. (a short driver
that calls ntoskrnl!KeServiceDescriptorTable() to get the
address of the SSDT, and patches the SSDT entry indexed by
the service number)
alias
10-30-2000, 11:50 PM
I am seeing double...


+fravia
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > +fravia
PDA

View Full Version : +fravia

ThRaX
10-29-2000, 10:45 AM
What exactly happened to +fravia? I remember that a year ago or so fravia.org got blown to hell, and after that +fravia seemed to stop working on his site, and eventually gave over to someone else? That's my understanding of it, but I'm curious as to what exactly went on, and where is +fravia now?

thanks
--ThRaX
+Sandman
10-29-2000, 11:38 AM
+Fravia is still around(?) although he has taken a different direction to 'our' Software based Reversing.

A link to his Lores site (http://www.searchlores.org/) can be found at the bottom of every forum here..)

Regards
+Sandman


A small suggestion
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A small suggestion
PDA

View Full Version : A small suggestion

?ferret
10-29-2000, 09:19 PM
Hola Tsehp,

Not sure if this would be possible here (or wanted hehe) but maybe an optional cookie for those of us that are too lazy to login?
tsehp
10-30-2000, 06:33 AM
Normally you have one. When you login, you have the option : remember your password, just check it and then your pass will be remembered, it's encrypted into your registry.
If you talked about an auto login, this is implemented also, just check
if your cookies are enabled, go to a test site and watch if the cookies
goes in and out.

tsehp
?ferret
10-30-2000, 10:27 PM
hehe...thx. I just noticed that when you log in, the login link changes to logout(username).....but even if I don't officially "login" every time, my info automagically pops up in the proper fields so i guess it's working ;-)

Just not as observant as I should be sometimes I guess LOL.....great new boards btw
?ferret
10-30-2000, 11:11 PM
hmmm...doesn't seem to use the user profile if i don't login each time though....look at the 3 posts by me in this thread....2nd one i hadn't gone through the login link (no Profile or icq icons). 1st and this post I was logged in.....
?ferret
10-30-2000, 11:15 PM
hmmm...doesn't seem to use the user profile if i don't login each time though....look at the 3 posts by me in this thread....2nd one i hadn't gone through the login link (no Profile or icq icons). 1st and this post I was logged in.....
Kayaker
10-31-2000, 02:19 AM
?ferret (10-30-2000 01:21 p.m.):
LOL...I also just found out that if you accidentally hit the back button after the post preview page, it reposts the same message again automagically hehehe

Hehe, glad I'm not the only one wiffing on a double post. I'm still trying to post as a real registered user. I can log in OK, but at the post page I seem to be logged out. Oh well, maybe I'll figure it out someday ???

This is great to finally be on a secure server anyway (sound of wood knocking), and a great round of appreciation to all involved. But I have to admit, I sort of miss the subject message banter that the old boards lent themselves to. While there was a lot of crap because of it, it could make for entertaining reading and it was easy to follow the progress of a thread sometimes without reading each post.

Hopefully this new style will keep down the crack requests anyway ;D


help me out plz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help me out plz
PDA

View Full Version : help me out plz

Qwake
10-30-2000, 09:20 AM
i'm having trouble with Vb in school. I need a program that can show me the codes of the teachers finishes programs. Please help me out dude.
Thanks man.
goatass-
10-30-2000, 10:25 AM
man you are pathetic, I'm sure if you pay a little more attention in class you will have no problem understanding. VB is very easy.

goatass
Sab
10-30-2000, 02:26 PM
try buying a book..
stanks
10-30-2000, 03:11 PM
or find a good site on the net with books for VB (in pdf)

greetz


Seems to be another ASprotect Version
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Seems to be another ASprotect Version
PDA

View Full Version : Seems to be another ASprotect Version

SV
10-31-2000, 05:22 AM
Hi reversers

Famous AZPR is now 3.51.
It seems that there is a newer (?) ASprotect version.
Not really a problem but needs somes adjustments.

h**p://www.elcomsoft.com/azpr.html

Regards
LuTiN NoIR
11-01-2000, 02:47 AM
Hello SV,

I don't look at code of asprotect for this prog just iat and don't see something special (but i don't look at the rest of the code so ...).
I currently coded an import rebuilder and i know you use one too so .. if you look at advanced quicken recovery or office recovery you will look something different on iat ..
But this don't come of asprotect but of compilator. The different part of iat are not separate whith a dword of 0 but whith more dword ... i will added support of this multi part of iat to my rebuilder whith a strange method (give all different iat address) and i want to know if you got a better idea than mine to doing that ?

Regards,
LuTiN NoIR
SV
11-02-2000, 02:47 AM
Hi LuTiN NoIR

I have found these stranges thunks too.
As you said, it's compiler's tricks and i always found enough space to paste uncrypts names.
The paste process with my rebuilder is not automatic, then i can choose where to copy it.
Perhaps the best method will be to add a new section ?

Regards

SV


Code injection problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Code injection problem
PDA

View Full Version : Code injection problem

garph0
10-31-2000, 01:42 PM
hello, i'm coding a little code injector wich works also under win9x, so i can't use VirtualAllocEx() and CreateRemoteThread().
i used a tecnique like the one iceman was talking about in iceman1.htm on fravia's site (it was 1998 i think):
1) save the original page and thread context
2) copy your code on that page
3) change context's eip to run your code
4) put everithing back like original code

i've done it rather sucessfully, but i've got a problem:
when i inject my code i a thread that is stopped when it's lost somewhere in the kernel, my code it's executed ok, but i get an access violation resuming the original thread, while if i can stop it while it is into the program code all goes well.
i noticed that the proble arises also when i modify a program that loads some DLL after my intervention... i cannot understand why this happens... can somebody
1) tell me hoe to prevent this
or
2) suggest me a method to detect when a process has done its initial work with dll and so on?

excuse me for my poor english and thank you :)

garph0
The Owl
10-31-2000, 02:06 PM
did you take care of the remote thread's stack (as in 'memory', not 'ESP') as well? ie, make sure you don't modify anything that's at/above the current ESP (of the remote thread).
garph0
11-01-2000, 06:20 AM
The Owl (10-31-2000 04:06 a.m.):
did you take care of the remote thread's stack (as in 'memory', not 'ESP') as well? ie, make sure you don't modify anything that's at/above the current ESP (of the remote thread).
garph0
11-01-2000, 06:30 AM
Sorry about the previous message... i hit enter before starting my reply ;)

Actually what i insert in the target process is just an INT 1 to make SoftIce popup and verify the code gets executed, later i think i will inject a loadlibrary and do the heavy work comfortably from a DLL :)
Anyhow thank you for the stack suggestion; a little question: if a imake some room for my local variables under the ESP i shouldn't have problems, am i right ?

thank you.

garph0
The Owl
11-02-2000, 02:54 PM
yes, below the ESP it should be safe (although you'll leave your traces there, some smart sw might decide to detect such attempts one day ;-).
garph0
11-03-2000, 01:40 PM
it seems i found the problem!
gheee! i want to play with debug API and i'm not able to use a simple printf!
so the problem was in my code, particularly in the 'trace' infos i gave.
shame on me ;( now that i fixed that ugly printf it seems to work quit well.
anyhow thanks for help :) i hadn't realized that problem with ESP.
well now i have two more problems:
1) can i detach from a process i have created as debugged without killing it?
2) how can i detect input idle or something like that for console apps?

thank you and, btw, i was a fravia's reader time ago, but life stealed my playing time... . now that i'm back on reversing, it has been really nice to find you again :)
garph0
The Owl
11-04-2000, 09:07 AM
1) can i detach from a process i have created as debugged without killing it?
2) how can i detect input idle or something like that for console apps?

welcome back then ;-).

1. as far as i know, you cannot (ie, MS APIs won't let you), but that doesnt mean there couldn't be a workaround. without some reverse engineering it's hard to tell, perhaps someone else will know. also try to ask EliCZ at http://elicz.cjb.net or .tsx.org (he has his own msgboard).

2. no clues. does waitforinputidle() not work?
garph0
11-12-2000, 11:16 AM
ok people, it seems i've found the right way...
kill3xx suggested me a way to emulate the CreateRemoteThread() under win9x without getting stuck with debug apis :)
so now i'm working in that direction.
than you all for your help

garph0


Request for comments---Do you like the colors ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Request for comments---Do you like the colors ?
PDA

View Full Version : Request for comments---Do you like the colors ?

tsehp
10-31-2000, 01:53 PM
You can actually compare between sandman's and this place, I can
easily set a new set of colors if the majority says so.
Please, tell me the colors you would like to have changed , you have
the document's background, text color, and tables titles background colors. Thanks to provide precise ones, use your html editor and tell
me in #xxxxxx format.
Best regards,

tsehp
ReD_AnT
10-31-2000, 03:20 PM
Hi +Tsehp,

First of all my heart felt thanks goes to you for for bringing the msg-boards back to life.

The colors on this MB are quite OK.
But the colors on the Newbies Forum r better...
Moreover they r convenient to the GrandPa reversers that visit this place...
(btw if anybody belongs to that generation and happen to read this message plz don't mind... remember what +alistair said about u :-D )

And my suggestion would be to have a consistent color scheme across the three boards... that'll give a much better feel... but that's what me thinks, can't say about the others...

Regards.

ReD_AnT ;-)

u can find what +alistair said on this page :
http://www.woodmann.net/io13.htm
BTW +Tsehp, i found this link using the search tool on this page...thanks a lot for providing it....
goatass
10-31-2000, 04:27 PM
Hey Tsehp, great job man. I think you should make the entire forum the same color scheme as the newbies forum it's much easier to read. Also it would be a better ideas (in my opnion) to move the links that you have on the buttom of the Fravia forum to the buttom of the main forum index so they will be seen by everyone no matter what forum they go into.

just a suggetion.

goatass
garph0
11-01-2000, 06:35 AM
Yes :) i think colors are ok, and maybe better than ones on newbies forum (more eye-relaxing)

greets

garph0
Lord Rhesus
11-01-2000, 09:59 AM
I use Opera 4.01 and the only colour I get is white on this forum compared with grey on the others. This just seems like a compatability problem though.
Lord Rhesus
11-01-2000, 10:09 AM
I use Opera 4.01 and the background of the general message board appears white as opposed to grey for the other boards. This is just a compatability issue though.
RoboRat
11-01-2000, 10:39 AM
I like this color very much. Very soothing to the eyes... (except dont use blue or other bright colors)
tsehp
11-01-2000, 06:55 PM
Thanks for your comments, That makes 2 for newbie scheme and 2 for mine. Teh newbie scheme is actually the one provided by default,
sandman has the full control for his two forums and I leave to him
the responsibility two choose whatever colors he wants.
I can't put my links on the front page, because they add to the one
I personnaly provide on the general rce board. But I'll divide my links
into personnal/general ones and the general will be added to the main
page. Soon to be done.
regards,

tsehp


Geforce -> Quadro modification in software?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Geforce -> Quadro modification in software?
PDA

View Full Version : Geforce -> Quadro modification in software?

sebbe_sabb
10-31-2000, 02:32 PM
Hello all.
If you did not know, it is possible to modify the GeForce cards to Quadro versions by moving two 10kohm resistors. (http://members.sidegadgets.com/tnaw_xtennis/board.html)
As my Asus v7700 Deluxe has an video-in function, that very same function will not work if I resolder the resistors.
I really want to have both video-in and Quadro-functions on my graphics card.
I have disassembled the Asus Live software (video-in program) and see several references to:

* Possible Reference to String Resource ID=00001: "No ASUS Card is found...."
|
:004011F6 B801000000 mov eax, 00000001
:004011FB E979060000 jmp 00401879

Could someone who understands disassembler more than I, please help me out?

/Sebbe_sabb
goatass
10-31-2000, 04:21 PM
Hey, the code snippet you pasted is VERY limited it, but what it could be is that the: mov eax, 01 is a flag and then when you jump on the next instruction that flag in eax will be checked and an action will be taken accordinlly. Try to find a JZ or JNZ that will lead you to this place in the code and then see what happens if the program jumps or doesn't jump.

goatass
sebbe_sabb
11-01-2000, 11:55 AM
Thanks for the reply.
I actually let the program continue to "do its stuff", and later it loaded a dll-file called i2c.dll.
Inside this dll I got the following:

Program Entry Point = 10002039 (I2C.DLL File Offset:00007039)

* Reference To: KERNEL32.GetVersion, Ord:0174h
|
:10001000 FF1508500010 Call dword ptr [10005008]
:10001006 8B4C2408 mov ecx, dword ptr [esp+08]
:1000100A 3D00000080 cmp eax, 80000000
:1000100F 1BC0 sbb eax, eax
:10001011 F7D8 neg eax
:10001013 83E900 sub ecx, 00000000
:10001016 A340660010 mov dword ptr [10006640], eax
:1000101B 7478 je 10001095
:1000101D 49 dec ecx
:1000101E 0F8585000000 jne 100010A9
:10001024 85C0 test eax, eax
:10001026 7444 je 1000106C
:10001028 6A00 push 00000000
:1000102A 6880000000 push 00000080
:1000102F 6A03 push 00000003
:10001031 6A00 push 00000000
:10001033 6A03 push 00000003
:10001035 68000000C0 push C0000000

* Possible StringData Ref from Data Obj ->"\\.\ai2cnt"
|
:1000103A 68F0600010 push 100060F0

* Reference To: KERNEL32.CreateFileA, Ord:0034h
|
:1000103F FF1504500010 Call dword ptr [10005004]
:10001045 85C0 test eax, eax
:10001047 A330600010 mov dword ptr [10006030], eax
:1000104C 7405 je 10001053
:1000104E 83F8FF cmp eax, FFFFFFFF
:10001051 7556 jne 100010A9

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000104C(C)
|
:10001053 6A30 push 00000030

* Possible StringData Ref from Data Obj ->"Waring"
|
:10001055 68E8600010 push 100060E8

* Possible StringData Ref from Data Obj ->"Your display card is not ASUS "
->"series display card"
|
:1000105A 687C600010 push 1000607C
:1000105F 6A00 push 00000000

* Reference To: USER32.MessageBoxA, Ord:01BEh
|
:10001061 FF15C0500010 Call dword ptr [100050C0]
:10001067 33C0 xor eax, eax
:10001069 C20C00 ret 000C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001026(C)
|
:1000106C E8BF0A0000 call 10001B30
:10001071 85C0 test eax, eax
:10001073 7513 jne 10001088
:10001075 6A30 push 00000030

* Possible StringData Ref from Data Obj ->"Waring"
|
:10001077 68E8600010 push 100060E8

* Possible StringData Ref from Data Obj ->"Your display card is not ASUS "
->"series display card"
|
:1000107C 6834600010 push 10006034
:10001081 50 push eax

I put a breakpoint on some jne statements, and it seems that just before the application starts, the process halts at this statement. Could you help me interpret the assembly listing?
Lets assume I want to change jne to something else, how do I edit the i2c.dll?

/sebbe_sabb
ground
11-01-2000, 01:56 PM
goatass (10-31-2000 06:21 a.m.):
Hey, the code snippet you pasted is VERY limited it, but what it could be is that the: mov eax, 01 is a flag and then when you jump on the next instruction that flag in eax will be checked and an action will be taken accordinlly. Try to find a JZ or JNZ that will lead you to this place in the code and then see what happens if the program jumps or doesn't jump.

goatass
sebbe_sabb
11-04-2000, 03:57 AM
10001000 model flat
10001000
10001000 ; ---------------------------------------------------------------------------
10001000
10001000 ; Segment type: Pure code
10001000 _text segment para public 'CODE' use32
10001000 assume cs:_text
10001000 ;org 10001000h
10001000 assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
10001000
10001000 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
10001000
10001000
10001000 _DllMain@12 proc near ; CODE XREF: start+4Bp
10001000
10001000 arg_4 = dword ptr 8
10001000
10001000 call ds:GetVersion ; Get current version number of Windows
10001000 ; and information about the operating system platform
10001006 mov ecx, [esp+arg_4]
1000100A cmp eax, 80000000h
1000100F sbb eax, eax
10001011 neg eax
10001013 sub ecx, 0
10001016 mov dword_10006640, eax
1000101B jz short loc_10001095
1000101D dec ecx
1000101E jnz loc_100010A9
10001024 test eax, eax
10001026 jz short loc_1000106C
10001028 push 0
1000102A push 80h
1000102F push 3
10001031 push 0
10001033 push 3
10001035 push 0C0000000h
1000103A push offset a_Ai2cnt ; "\\\\.\\ai2cnt"
1000103F call ds:CreateFileA
10001045 test eax, eax
10001047 mov dword_10006030, eax
1000104C jz short loc_10001053
1000104E cmp eax, 0FFFFFFFFh
10001051 jz short loc_100010A9
10001053
10001053 loc_10001053: ; CODE XREF: _DllMain@12+4Cj
10001053 push 30h
10001055 push offset aWaring ; "Waring"
1000105A push offset aYourDisplayCar ; "Your display card is not ASUS series di"...
1000105F push 0
10001061 call ds:MessageBoxA
10001067 xor eax, eax
10001069 retn 0Ch
1000106C ; ---------------------------------------------------------------------------
1000106C
1000106C loc_1000106C: ; CODE XREF: _DllMain@12+26j
1000106C call sub_10001B30
10001071 test eax, eax
10001073 jnz short loc_10001088
10001075 push 30h
10001077 push offset aWaring ; "Waring"
1000107C push offset aYourDisplayC_0 ; "Your display card is not ASUS series di"...
10001081 push eax
10001082 call ds:MessageBoxA
10001088
10001088 loc_10001088: ; CODE XREF: _DllMain@12+73j
10001088 call sub_10001F30
1000108D mov eax, 1
10001092 retn 0Ch
10001095 ; ---------------------------------------------------------------------------
10001095
10001095 loc_10001095: ; CODE XREF: _DllMain@12+1Bj
10001095 test eax, eax
10001097 jz short loc_100010A9
10001099 mov eax, dword_10006030
1000109E test eax, eax
100010A0 jz short loc_100010A9
100010A2 push eax
100010A3 call ds:CloseHandle
100010A9
100010A9 loc_100010A9: ; CODE XREF: _DllMain@12+1Ej
100010A9 ; _DllMain@12+51j ...
100010A9 mov eax, 1
100010AE retn 0Ch
100010AE _DllMain@12 endp


browsing list-a question to +Tsehp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > browsing list-a question to +Tsehp
PDA

View Full Version : browsing list-a question to +Tsehp

esther
11-01-2000, 08:46 AM
Hi +Tsehp,
Why are you capturing who is online when browsing the msg list? It makes me feel uneasy about that...Hope you could clarified(correct spelling?) :))

regards
esther
JimmyClif
11-01-2000, 11:50 AM
Uhm, dito :)
tsehp
11-01-2000, 06:45 PM
Sorry, I must have made a misconfiguration error. It's already removed.

tsehp


CGI reversing?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CGI reversing?
PDA

View Full Version : CGI reversing?

MalcolmXXX
11-01-2000, 04:28 PM
Need to get the info's from a cgi file, but haven't got a clue how to retrieve the file.
I am reversing a script in a website to reveal zip passwords, but need the cgi stuff to use on local drive rather than the net.
Ideas appreciated,
tia,
Malc.
carpathia
11-01-2000, 04:45 PM
You need to examine all various usage aspects of the CGI, and try to get some insight into what it might be doing on the server. Could it reading from a back end database, or perhaps just from a file ? (ie, flat files generally dont offer options to edit records using the CGI. Databases generally do). If its reading from a file, it may be possible to get the CGI to return itself as output.

Also, do some research into what web server the CGI is running on. IIS has many exploits, such as the test scripts which get installed by default, allowing you to retrieve known-location text files using the MSADC codeview sample ASP. Search the usual security sites for possible exploits for that web server.

Anyway, your first port of call should be Fravia's site busting lab. http://tsehp.cjb.net

Regards

Carpathia
MalcolmXXX
11-16-2000, 02:03 PM
Thanks for your input, however found a different way around problem.
The project was as follows:
A web site contained several thousand pass-protected zip files. Three files were available to download for free, but the others had to be paid for.
Each link to the 3 files gave zip file download link plus password.
(A small amount of lateral thinkin goes on here whilst having a coctail ;))....view source of page...save to local drive....change file name in script....save/reload....hey presto.......any pass to any given file
disavowed
11-16-2000, 06:23 PM
sounds like you have what it takes to try out for www.disavowed.net

btw, what's the site? :)
the snake
11-17-2000, 01:06 AM
Hi disavowed

I realy like the idea of your site, not sure i can pass all the tests right now, but on the programing section, i can't get the file to be calculated. Is it a problem i have or the link in wrong ?
Thanks
the snake
disavowed
12-17-2003, 02:09 AM
Been trying to brutforce anything i can get my hands on for like a year and a half now. To no avail. But i just can't and won't give up. Probably just my wordlist. But now i've been looking at the whole cgi exploits and they seem fun, just can't get any cgi-bin files to show themselvs.

be gentle with me. :Dhahahahaha... don't tell me you've had jtr running for 3 years straight and not a single password?!? are you sure you're not using 3des when you should be using md5 or something like that? :p


Have S-ICE detection, Need Help. Am Confused.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Have S-ICE detection, Need Help. Am Confused.
PDA

View Full Version : Have S-ICE detection, Need Help. Am Confused.

Aimless
11-01-2000, 11:16 PM
Hullo,

As you know, I am a complete newbie, and am slowly trying to crawl my way up to the 'higher' levels. However, in my quest for 'higher' cracking proggies, I encountered a small proggie (about 19KB), which I am trying.

This is, obviously, having a time check ("Your trial period expired"). My findings are:

1. It has got Anti-Disasm code. IDA does not disasm properly (IDA 4.04, BTW). W32dsm simply falls apart (havn't tried with Sourcer: yet.)
2. It has got anti-debugging code (IDT int 01, 03, 05) detection codes
3. It has got anti-Sice code (Interrupt Detection for int 03).
4. It also has an additional section (.yado) which is obviously, user made, and the entry-point goes there.
5. Its packed and/or encrypted.

Whew!

Now, the issue is I am trying to tackle things one-by-one. My aim here is to first prise the anti debugging/software code. Note that here, TRW2000 and SICE 4.05 (w9x), just hang! I have to re-boot to get it working.

However, a very good s-ice and anti-debugger hooks was revealed to me by FrogsICE (god bless him!) in FrogICE's return codes 05 and codes 00.

Therefore, after all these explanations, my questions:

(1): Frog's print has accurately shown me the op-code and the cs:eip where this occurs. The problem is nopping/bypassing the instruction does not help at all. Therefore, what is the next logical step to follow ?
(2): I have not yet tried dumping the active process. But would that be helpful ? COnsidering these extra protections, I am sure there would be an anti-dumping thingy too.

Any reponses shall be gratefully appreciated.

As ever
Aimless
11-01-2000, 11:19 PM
Thx
Int19
11-02-2000, 07:54 AM
If it's the yado's kripton2 crackme It took me about 10 days to crack it. I've mantained a log of all "malicious" locations.
There are many check anti-si on int1 int3 and debug registers, 2 checksum check and the file is crypted with the checksum value. And it crashes your machine if something goes wrong.
I'll send you my logs if you want.
tsehp
11-02-2000, 01:31 PM
Can you post it here ? That could be interesting for people that wants
to try their skills on this crackme.
TIA

tsehp
Int19
11-02-2000, 02:34 PM
Here's the Yado's Krypton2 crackme, inside the zip file there's also the version patched by me.
kr
11-02-2000, 06:30 PM
i annoyed the creator of this crackme.. i kinda lost touch with reality and blamed him for crashing my pc 100 times whilst i was debuggin it.. even though after the first time it locked up my pc, the other 99 times i ran it knowing this would happen..

he 'forgot' to put in the readme that it DIDNT run on win95, and WOULD crash your computer..

it got cracked, ida & tasm helped me code a decryptor for it.. eventually it was win95 compatable..

anyway, win95 users, beware of this dodgy product..
Aimless
11-03-2000, 02:04 AM
Dear Int19.

THank you very much for the encouraging responses. Yes, it is indeed krypton2, from lockless.com by Yado.

I totally agree with you that your logs would be excellent. However, what I need, is the "strategy" to break it.

I mean, where is the starting point. WHere does the beginning begin ?

Thanks in advance.
xOANINO [UCF]
11-03-2000, 05:02 AM
Eheheh .... lame krypton 2 .....
here in Italy everybody said it was a hell to crack ....
I looked at it with IDA while chatting on IRC, and personally i think its nothing more than a collection of lame wellknown antidebugging tricks, without nothing particular......
All i can remember is that it uses INT 5 to switch ring0, and the next layer decrypter is executed there.
So to succesfully decrypt it (should be 2-3 layers) trace into the INT 5 handler. There's also lame crc checks around ,to prevent you patched the code.
All this was done months ago, so maybe the info are not completely correct.... but it remember clearly that INT 5 thing.

xOANINO
[UCF]
Int19
11-03-2000, 01:48 PM
First make sure that you're clean (INT 1 and INT 3 MUSTN'T point to K2)
If you have already executed K2 with Softice loaded in memory, probably they point to K2 code
and you will be soon on "the middle of nowhere". I'm a newbie like you and only solution that I could
found is reboot my pc :-P

Question: Can anyone tell me how to restore IDT after that K2 has changed it?

Start to stepping INSIDE every call that you encounter, after some time you'll be familiar
with those istructions because are repeated very often and in the same order, are only junk istructions and the only usefull istruction is after the jnz of every "junk circle".
These are the initial istructions:
SIDT [4073d3]
mov ebx, [3073d5]
add ebx, 8
...

As said by xoa all the crackme is a collection of "lame Anti-SI tricks", but from "newbie side" I suggest this crackme to every other newbie like me because It has been very usefull to improve my skills on Anti-SI and Exceptions.

Sorry but I'm now a very well English writer, bye.

Int19
kill3xx
11-03-2000, 03:31 PM
xOANINO [UCF] (11-02-2000 07:02 p.m.):
XOANINO
^^^^^
[UCF]

my leim detector has raised an unhandled leim post exeception on this

muwahahahaah :D

cu on irc.
ur favorite leim,

kill3xx
Yado
11-06-2000, 12:01 PM
Hi :)
well well ... , i'm here only to say a think.
krypton2 was born from an idea a my idea to help newbies on some nice tricks (maybe old) anti sice and antidebug code.
I've done it on win98 and i've wrong i known this , i have not tested it under win95 ... it's a my fault sorry.
But i'm happy becouse a lot of people found it usefull.
Xoa.. well you are right , but this crackme is not made for a target of people like you , but for newbies , so please dont waste me.While for all the others that want to ask somethink , about krypton2 , feel free to contat me , if i can i'll answer.
P.s.:if you dont like it , simple do somethink else , there a lot of crackme that are coded better.Excuse me for my english.
Byez .... Yado of Lockless


Legitimate lob opening for Code Reversers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Legitimate lob opening for Code Reversers
PDA

View Full Version : Legitimate lob opening for Code Reversers

zitterbe
11-02-2000, 04:23 AM
I posted the details at Newbies Forum:
http://www.woodmann.net/cgi-bin/Ultraboard/UltraBoard.cgi?action=Read&BID=8&TID=54&SID=5334

This company is looking to hire a person [or more... not sure how many] proficient in C++ and/or Java, familiar with using IDA, SoftIce, and presumably other reversing tools, to make "vulnerability evaluations and recommendations" for government and commercial clients. The ad appeared in either USA Today or Washington Post the other day. Not sure which - a friend cut it out and gave it to. [I'm not interested - can't relocate to McClean, VA and too far to commute]. Maybe one of U ppl interested. Looks to me like a top notch job and "right down our alley". Seriously!!!

See the post at Newbies for details.


ASProtect and we, reverse engineers.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ASProtect and we, reverse engineers.
PDA

View Full Version : ASProtect and we, reverse engineers.

BlackB
11-02-2000, 12:39 PM
Wow, another message on ASProtect. Maybe we 'd start to call this msgboard the "ASProtect discussion forum".
Anywayz, I wanted to give a short comment on all this "ASProtect" stuff: I'm starting to see myself and all other reverse engineers as "we-work-and-give-advice-for-nothing"-employees of Alex S.
ASProtect is very interesting, studied it a lot too, but I refuse to write anything more about it. There has been written enough, and everybody with a little bit of common sense and some work can find out how it works, and can remove it.
But now, what happens? Everytime the author changes even the slightest thing, new tutorials are written and new discussions are started. So what does the author do? Read all the stuff and improving the protection. He brings out a new version, and we, who seem to LOVE to work for free for other people, start to reverse engineer (nothing wrong until now), and publish how to remove the protection. Author reads those papers to and improves again....you see, i'm starting to believe that we have put hundreds of more time into his product then he, himself has put in it. But don't forget people, that we don't earn a penny with it, and he does.

Now, don't misunderstand what i'm saying here. I 'm the first to give information for free. You see, my site about reverse engineering is 100% commerial-dirt free, and I never want to earn money with it. Nor with my site, nor with cracks I write, nor with tutorials I write.

I suggest you start discussing ASProtect via email, and write tutes about it for personal use, or just to give to a limited amount of people, and certainly not to publish it, or to mail the author how you removed it.

And you know, I hate ASProtect. Not because it's hard to crack, but because an application wrapped with it just sux to use:
1. app becomes pretty much slower (just compare the asprotected and non-asprotected versions of TheBat!)
2. if you only want to try an app, or if you bought it legally, it really sux that you have to disable your softice
3. personally, some asprotected apps crashed when using borland c++ v5.02. (due to the internal debugger it has? or was it just my system? dunno, but i think asprotect is suspect nr. one.)

Comments on this non-prepared maybe lame comment are welcome. ;) but i mean every word of it

greetz

BlackB

ps: Alex, if you wanna know how I remove your protection, it 'll cost you about 500$ :P
goatass
11-02-2000, 01:38 PM
BlackB I'm with you on this 100%. I think it's fine the first few times that we discuss it and write tutorials about a protection and it's fine that the author reads them and improves on his protection, but when it becomes almost an everyday job we have to draw the line. I have no problems helping developers imporove their protections but when I waste all my time everytime a new version comes out and the other just takes my work and improves his protection with no recognition of my (and other people's) work it's not right.

If he wants to improve his protection hire a cracker and they will crack it everytime a new version comes out.

Anyways he only makes small modifications here and there the overall algorithm is the same throughout, just another layer of encryption it's nothing worth wasting your time on.

Once the basic idea on how to do something is known it's just reapplying that idea again and again and maybe improving on it a bit but that's why we are all inteligent people here.

p.s BlackB I agree with you on the $500 to tell him how you cracked it.

Time and knowledge it money.

That's my opinion
goatass
tsehp
11-02-2000, 01:40 PM
hi,
when I made my first program, I was like everyone a newbie, fravia's
site was a kind of open public discussion about protections, how to
remove them and either how to build them.
If we start to discuss such topics with emails, you will confine the knowledge to advanced reversers and not give a chance to new comers on this community.
Sure, they read what we say, even mailing us some fake crack request
to have more confidence with their new version, but don't forget, they
just LEECH, it's very rare to see their point of view.
It's a major part of the game, we improve, they improve and still getting better. It's already a lost battle for them if we keep talking about what we found; and if we start talking privatly, we just kill the
main essence of this place, public, open to everyone, closed to lamers
and crack requesters.
Alex wants to add new features to his product ? What a fun ! I just can't wait for that ! Remember it takes him 2 months to build something new, and only 1 day to reverse it, where's the danger ?
Sincerely yours,

tsehp
nu
11-03-2000, 10:36 AM
i do agree with tsehp here. BB, don't get me wrong, your point is good since what you do is like underpaid (unpaid rather;) work, but consider this: asprotect author (dont recall his name) would be glad to see that info about reversing his protection has ceased flooding the net. he could relax, and in the end, he would anyway win this "battle" (what a violent, inapprorpiate term). the good point in the current situation is that he keeps on working, you keep on reversing, you both keep up the challenge and learn from each other. he deserves to learn just as well as you do, and i want to believe that you're in the biz not only for the cheap and quick crack (ie having one, definite, simple to crack asprotect version and therefore all the appz instanctly pirated), but for the true reversing fun.

nu
tsehp
11-04-2000, 07:19 AM
Just to finish :
There are much more "crackers" than protectionnists, if we just try
and get used to regroup and share the info into some general places,
the protectionnists can update their work as much as they can, there will always be a guy that will get rid of it, then we read his work and
learn. new essay archived into the database, what's the next target ?
That's one of the reasons I putted this msgboard and essay's archive here.
regards,

tsehp
BlackB
11-08-2000, 07:01 AM
Okay, thx for all your reply
i see you have a point. i'm not saying i totally agree, but you have a point :)

greetz

BlackB

ps: hi newral ;)
ps: nice msgboard tsehp
tsehp
11-08-2000, 04:44 PM
not to have the last word...
But protectionnist leaching here will only get the tip of the iceberg,
just as an example, famous assembly reversers/programmers like
g-rom , stone, owl, and much others will never give their sources, that
would be a fatal mistake that would ease too much their work.
They are paid for that, with some companies behind, and we're just
an underground community without serious financial resources, sure
we hide our work, but partially.
take care,

tsehp
ThRaX
11-13-2000, 10:30 PM
No offense man (not that youd take offense from a lame newbie like me anyway ;D) but I disagree with you... The reason I and many others reverse is for the sport of it. ANd if the author wants to read the publications and improve, GOOD! More fun things to crack, more interesting clever protections to work with...While, newbie that i am, do not know much about ASProtect per say, but in general, I agree witht he idea of authors improving from our work....Good for them, they get more money and dont have as many lamers cracking their stuff, and good for us, more fun things to crack...

Laterz


Another question to +SandMan (i'm so proud ;p)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Another question to +SandMan (i'm so proud ;p)
PDA

View Full Version : Another question to +SandMan (i'm so proud ;p)

Dya-Blo
11-04-2000, 04:04 AM
Hi,

Just would like to know if i'm really the only one who managed to completed the ZEN section 3 ? or you just not have the time to update it (i think it's more probably that) ?

Later. Dya-Blo
+Sandman
11-05-2000, 08:00 AM
Greetings...

It's true! Your the only one who has sent me the answer to the Zen(3) challenge. It must have been harder than I had originally planned for it?, hehe.

Since you like these little challenges, what can you make from the following statement...

"Today is Sunday and tommorow is Monday, Friday is before Saturday and Monday follows on from Sunday. So if I can crack this program today, I can go for a long walk on Sunday."

The grammer and spellings are correct, the 'facts' are also correct. So what's so unusual about this statement.

Regards
+Sandman
?ferret
11-05-2000, 08:18 PM
Hola,

Just a quick readthrough, but unless I missed something....

"Today is Sunday and tommorow is Monday, Friday is before Saturday and Monday follows on from Sunday. So if I can crack this program today, I can go for a long walk on Sunday."

Translation:

If I manage to crack this app today, I'm gonna take a long walk right after I'm done.

Is that right?
?ferret
11-05-2000, 08:19 PM
Hola,

Just a quick readthrough, but unless I missed something....

"Today is Sunday and tommorow is Monday, Friday is before Saturday and Monday follows on from Sunday. So if I can crack this program today, I can go for a long walk on Sunday."

Translation:

If I manage to crack this app today, I'm gonna take a long walk right after I'm done.

Is that right?
Dya-Blo
11-06-2000, 03:37 PM
hey,

strange sentence, i will think of tomorrow ;p

And do u know what's wrong with Disavowed Hacker's School (these challenges are sooo nice).

Later.
cronos
11-08-2000, 01:41 AM
If theres something unusual about the statement then it must be raining.
esther
11-08-2000, 08:12 AM
Hi +Sandman and guys,
"Today is Sunday and tommorow is Monday, Friday is before Saturday and Monday follows on from Sunday. So if I can crack this program today, I can go for a long walk on Sunday."

The grammer and spellings are correct, the 'facts' are also correct what's so unusual about this statement.

>So if I can crack this program today, I can >go for a long walk on Sunday."

The usual about the statment is that "today" is Saturday you are cracking this prog in Saturday ,so
you can go for a long walk on Sunday

:D

esther
+Sandman
11-08-2000, 05:00 PM
he actual sentence itself is *unimportant*, it's been made to *look* like it's saying something when in fact it's just a piece of mindless garbage which I made up on the spur of the moment. As so often the case, we tend to 'look' and fill-in the *assumed* gaps ourselves, thinking all the time there's some logic *behined* it. But what's in front and plain to see? what's missing from it?.

Regards
+Sandman
cronos
11-08-2000, 06:00 PM
I think I see the answer, but I am not really in the position to fully know the answer.

> "Today is Sunday and tommorow is Monday, Friday is before Saturday and Monday follows on from Sunday. So if I can crack this program today, I can go for a long walk on Sunday."

So the zen answer, understanding that logic is irrelevant and intuitive understanding prevails, is that we must take the situation into account. Thought transcends time. So the meaning is simply that you are asking whether Dya-Blo has learnt from completing Zen Section 3, not just that he has completed it.
?ferret
11-08-2000, 09:34 PM
hehe so mytranslation was accurate
Fake51
11-09-2000, 06:53 AM
+Sandman (11-04-2000 22:00):

"Today is Sunday and tommorow is Monday, Friday is before Saturday and Monday follows on from Sunday. So if I can crack this program today, I can go for a long walk on Sunday."

The grammer and spellings are correct, the 'facts' are also correct.

Spellings correct. Lmao. Might wanna do a spelling check before you write something like that next time.

Fake

Ps. Sorry, couldn't help it.


Find vendor string in flexlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Find vendor string in flexlm
PDA

View Full Version : Find vendor string in flexlm

jenshi
11-04-2000, 07:59 AM
Is there anyone who can provide some methods to find out
the vendor string checked in targets using flexlm? It seems
that the target should pass the vendor string check before
set the attribute (4A) to user crypt filter.
Amante4
11-04-2000, 08:59 AM
Hi,

You should read my essay on this subject
here:
http://mirror1.immortaldescendants.org/database/essays/amante/flexlm2.htm

Hope this helps. If you still have trouble
send me some mail.

regards,
amante4


WAKE UP +SplAj.....KNOCK, KNOCK ........FOLLOW THE WHITE RABBIT......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WAKE UP +SplAj.....KNOCK, KNOCK ........FOLLOW THE WHITE RABBIT......
PDA

View Full Version : WAKE UP +SplAj.....KNOCK, KNOCK ........FOLLOW THE WHITE RABBIT......

hOrn_dOg
11-04-2000, 12:43 PM
WAKE UP +SplAj.....KNOCK, KNOCK ........FOLLOW THE WHITE RABBIT......

So I did ..... ,

I met with +IronMan who asked me what I knew about 'Bi-Arts'. I told him nothing
special except they make commercial software protection systems........

He asked if I wanted to see how deep the wormhole really goes ?

I took the RED pill and....

When I awoke I met the real man. He showed me what had happened. The truth,
that the +HCU was used to select the cream of the worlds crackers (by the
'world' he meant USA ) to see how they could slaughter the very
best software protections. They spent a year doing this. Then a group wanted
to split, form their own MegaCorp (sorry wrong movie !) , Bit-Arts
Corporation .... created to program the worlds toughest protection. +Fravia
was annoyed with his protege's so moved on to other web based security issues
and left the +HCU as an empty shell for would be crackers to dream of the
halicon days.

Bit-Arts created Softlocx. Using techniques the crackers found to fool the best.
They marketed their product to the world. However the 'other' commercial
protections were still a threat to them, getting market share is the only way to
survive.....

How to get market share ?

1) Price your product at an aggressive level - say $400 when the rest range from
$500 - $10,000;
2) Market your products outstanding quality. Get reviews in PC mags etc etc;
3) Kill the opposition, destroy their products and the reputation of their
company with your own black-art 'crack' team ;

GOOD LUCK to you Romeo_One and the rest.

But the thing that will really cook your goose is the fact that they use another
marketing tool:-

4) NO cracks appear for Bit-Arts products. Every one concentrates on ASProtect
and VBox etc etc.The new reverser forums give/swap info and crack every
commercial system around...except SoftLocx. Duelist made a keymaker for specific
early versions of SoftLocx v4. But soon stops. I asked him if it was ok to rip
out a section of his key making code to produce a 'generic' keymaker for all
SoftLocx v4 protected softs. He said no because he is releasing a generic
keymaker 'soon' (mmmm ? that was in April 2000...)

So the whole cracking scene today is just existing to help those lucky few who
formed Bit-Arts and now derive their income from it. No unpackers from the
pro's. No generic keymakers, no tutorials, silence.....except a few snippets from
+SplAj.

However 'hOrn_dOg' is born and his mission statement :

"FUCK BIT-ARTS ASS, TODAY, TOMORROW, AND THE NEXT, FOREVER"

There is no spoon................

+SplAj
'patch+play'
14:36 04/11/00
tsehp
11-04-2000, 12:53 PM
Hi,
it's maybe a tough one, but I've never met well know programs infected
with this protection. Maybe you could give some recent urls so I (or we)
could take a look at this.
I could also crack it and send some private msgs on how to do it, sharing
this knowledge with elite members, or maybe I could install a pay on line
system for protectionnists that wants a free test for their products ?
Interesting challenge anyway, send some urls please.

tsehp
The Owl
11-04-2000, 04:20 PM
hmmm... i think i checked softlocx first around this time last year (for unrelated purposes), what they did then should be a shame for any mid-level cracker, or even beginner. next i think i tested it when i was writing my tracer (released in icedump), i don't recall any particularly earth-shattering techniques, except what you can fetch from the web after some searching. did they invent something new since then? or more interestingly to me, does the icedump tracer fail on it? if not, why bother... just tracex it, write a module to fix imports (if needed at all), then pedump.
Romeo.One
11-04-2000, 09:30 PM
Splaj -> knock , knock UR head and stop snorting the white rabbit cause it makes UR head spin !

1. I was never in HCU but I was in the IR@ , Canada's a bit far .. shame ;)
2. I DON'T work for bitart - but I'd love a job with crypkey any going ?
3. I DO code for a living in ASP shame it doesn't work in Sice.
4. I DO know you're game ! (read newbie forum , reply about SL)

Here in England there's a story teller who's made millions writing books about a kid called Harry Potter , belive me with UR imgaination if you don't make it as a coder put pen to paper ! It's funny Splaj how I played a game on you and you suddenly reply , RANT & RAVE when I mention a generic decrypter for CrypKey... as if I would ... I can't change nappies in jail ;) A simple lesson , set the grass on fire, stand back and see what rats come running out... Many people live in Seattle but do they have 2 work for M$. I don't hide my IP , cause I don't have anything to hide. The problem is UR IP was straight out of a network provider owned by Keonic Controls who also own crypkey, and then latter it suddenly came from Libya ... shit is Gadaffi now the crypkey MEast VP of sales :) or can you now crack "Anonimity 4 Proxy" and get the full DB.

Anyway to a more sensible post -> I agree Owl I studied SL last year and it was a pile of crap ! Not a great deal has changed. I've seen more comercial warez protected with this shit than Splaj has pubes , a big zero ! I cannot belive , splaj that you can say that bitarts are ex members of hcu when they've coded fucking lame s/w like "webwatch", "digicrap" and some shit activex control !

BTW : Splaj , Horn_Duck , Sandra , Katie , Jim ;) or whatever name you keep hiding behind .. don't make out UR some big dude cause I've seen more muscles on a bowl of rice and U can tell ur boss @ crypkey 2 kiss my ass ! Next time Duelist (hi) charge this fuck'n idiot when he asks you 2 code a generic keygen cause he's getting well paid by Keonic ! I also have a contact who's very much active and respected on the scene that you have chatted 2 -> 4 a request to crack shitlocx he sussed you out and did a generic crack and tut on crypkey instead ! The morale of the story splaj is don't fucking make up stories cause ppl get pissed off.... You will keep getting dissed by abusing the R/C community with ur corporate games !

Romeo.One - !! Retired with Kids !! (!!HONEST SPLAJ!!)
HypnoticZ/TNT
10-06-2001, 12:57 PM
i cracked the fusion 1 proggy you know now from bit-arts but i dont think to be publish i dont want to have any problems :)

regardz

hypnoticz
Woodmann
10-06-2001, 02:48 PM
Lovely are the children who know not.
To sling upon one from whom you have come.
Do not fear the one who maybe.
Look at yourself, can you see your reflection?

Do you ever feel like you have been cheated?

Peace, Woodmann
nchanta
10-08-2001, 12:11 AM
horn_dog, i can answer a few of your questions

as u might or might not know. i have cracked just about all softlocx programs ive come across, as im in pGC i have come across very few (maybe about 5/6 in the past year)...

does that answer your question about it being not cracked?

softlocx is very pathetic protection.. simple to keygen and/or dump virgin executables..

nC
HypnoticZ/TNT
10-08-2001, 04:32 AM
thx you very much nchanta

cu :)
hOrny_SplAj
10-10-2001, 06:22 AM
hehehe this thread is from a +YEAR ago already before anybody cared about bi-tarts protection and I had a bit of phun with some ppl who were actively pushing Softlocx as a 'real' protection solution on some user groups.

well we all move on........ but my lame story-telling attribute continues regardless.

and my IP address is as flavoured as usual :-)


Corrupt CD-R
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Corrupt CD-R
PDA

View Full Version : Corrupt CD-R

sscotts
11-04-2000, 08:08 PM
Hi all!
I am desperate about rescuing my corrupt cd-r which contain precious data. Any suggestion on how to go about on this one. Thanks.

sscotts
cronos
11-05-2000, 04:21 AM
You really dont give enough details on whats happened:

Did the CD appear to write and then you can't access it ? (In which case it could be completely gone)

Did it just mess up when you were adding another session to it ?

Can you see anything on it ? Directories, etc ?

Have you tried it in other drives ?

Does the drive appear to read anything ? Or does it get spit out by the drive as soon as you put it in ?

What have you tried to read it ? Tried reading it from dos ?
sscotts
11-05-2000, 11:12 AM
Thanks for replying to this.

The problem start when I accidently format the disc using DirectCD. Well, It was just starting to format when I intervened.

Now, Windows Explorer shows that there is some space "used" but did show any icons like .doc or .jif or .txt

If I use another cd-rom drive, It will say "Drive is not ready" "abort or Retry"
Thanks again.
cronos
11-05-2000, 04:50 PM
>The problem start when I accidently format the disc using DirectCD. Well, It was just starting to format when I intervened.

Hmm, so this is a CDRW then ? Partially reformatted...... oh dear.

> Now, Windows Explorer shows that there is some space "used" but did show any icons like .doc or .jif or .txt

OK, so at least the drive isnt just spitting it straight out.

> If I use another cd-rom drive, It will say "Drive is not ready" "abort or Retry"
Thanks again.

Well, most CD drives won't accept Direct CD's packet discs anyway.

Now, recovery isnt going to be easy. Let me say that at the start. To recover stuff from this disc you are going to have to put in a lot of time and a lot of effort. Its the same with any kind of disc recovery operation - hd or cd. You have to weigh up the cost of doing it against the cost of the data that you would get back.

My first approach, which is prior to bringing in the heavy duty stuff (which starts with some good programming exercises) would be to try some real disc reading software. The blind-read kind of software that tends to be available on sites like http://www.gamecopyworld.com/ Basically you want to try and create an image file on disc of what you have on that cd. The reformat (depending on which option you chose - full format or quick format ?) if it was quick format would have been a toc wipe, and so you will still have most of the data there, you just need to reconstuct the toc (easier said than done, but a cd toc is normally consecutive rather than randomised like a hd toc, unless its been read/written to a lot). If its a full format you might have lost some files but some of the toc might be ok. Anyway, get yourself a blind reader and sit back and read the disc (presuming you cd writer will do it, if not then its going to be harder).

OK, now you should have a cd image with any luck, a blind read of the cd contents. Given this you should now be in a position to start file recovery. You can get programs which will read the image file directly, but I suspect most will choke on a screwed image, so its going to be a manual data-extraction exercise from here.

I need to know several things at this point - 1/ did you manage a blind read, do you have an image file of some kind ? 2/ whats it looking like, how did the operation go ? 3/ just how good are you at being able to write the odd program to peer into this file ? 4/ what kind of data is in there ? text/compressed ? 5/ Just how valuable is your data and how far are you prepared to go ?
cronos
11-05-2000, 05:36 PM
Following my earlier post I would add that it helps to read up on these things, and so here a few links:

http://www.emediapro.net/MayEM/mcmurdie5.html
http://www.adaptec.com/products/faqs/udfreaders.html
http://www.octave.com/0/en/library/daotao.html

And quotes:

* If you have a CD-RW disc originally formatted with DirectCD 1.0x, DirectCD 2.0x will continue to write to that disc in variable-length packets, so you cannot randomly erase and recover space on it. In order to prepare the disc for random erase, you need to erase it completely and reformat it with DirectCD 2.0.

So I presume that you will have use Fixed-length packets (random erase) which will hopefully be in our favour ;)

Each time data is added incrementally to a CD, the laser must power up and power down, and as a result, useless blocks of data may be recorded to disk. Link Blocks are simply the blocks before and after user data that may contain this useless data. A single instance of written user data along with its associated Link Blocks is called a packet. Additionally, a special set of blocks called Run-in and Run-out blocks are written. These blocks allow the CD recorder's clock to get in sync with the recording at hand, and for interleaved data to play out.

There are some problems with packet writing, mostly due to the inability of older CDROM drives to deal with the gaps between packets. CDROM drives can become confused if they read into the gap, a problem complicated by read-ahead optimizations on some models.

Now, for the final link, which may be a get out of jail link for you if this software works (I haven't tried it personally):
http://www.cdrom-prod.com/software.html
allows you to test, examine and recover data from CD, CD-R and CD-RW discs. This includes support for discs written using Adaptec DirectCD and CeQuadrat PacketCD as well as other packet-writing programs. It bypasses Windows and other CD software installed on your computer to allow complete freedom to examine nearly any CD, including Macintosh and audio discs.
sscotts
11-06-2000, 06:26 PM
Cronos,
I would sincerely like to thank you for all this help. This would be my "big" project and yes, it is something valuable. My late pet's pic is among them. Again, thank you.

sscotts


Crypto
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Crypto
PDA

View Full Version : Crypto

JJ
11-05-2000, 10:14 AM
Hi
I would like to ask howcome no one is writing any documents about cryptography based schemes. That be it RSA, Blowfish, Elgammal - howto identify what encryption is used, and howto aproach them and in the end maybe write a keygen? - But it seems most people just keep their knowledge to themselves about that topic - so if someone could please write any documents about this very interesting subject i think many people would be thankfull :-)

- Crypthography in general would be interesting reading, more and more schemes use crypthography in someways.
carpathia
11-05-2000, 10:34 AM
Hi,

You know, you dont *need* to rely on anyone else to write tutorials for it. Why not set out to read up on crypto and progress on your own.

On the REKML files download area (rekml.cjb.net), is a great crypto book by Bruce Schneir (Sorry Bruce, I can never spell your surname correctly ;)

Also of interest:

The RSA FAQ (zipped PDF)
ftp://ftp.rsasecurity.com/pub/labsfaq/rsalabs_faq41.zip

FTP site of Crypto tools, papers and code
ftp://ftp.compapp.dcu.ie/pub/crypto/

Some crypto algorithms; many broken links :(
http://www.cs.auckland.ac.nz/~pgut001/cryptlib/algorithm.html

Hope this gets you started.

Regards

Carpathia
Epic
11-06-2000, 01:06 AM
It is not easy (if not too difficult) to pinpoint the crypto algo used to produce a given ciphertext.

However, sometimes it is possible to findout the algo very quickly from the proggy.

Different crypto and hash algos use different numeric constants. Thse search for those numeric constants (and possibly their arithmetic relations) will yield some results.

See carp's links.

Search for the "mcrypt" and "mhash" libraries. They include the necessary information.

Kind regards.

Epic
JJ
11-08-2000, 08:47 AM
Thanks for your kind replies. But i predicted the reply with bruce's book. And sure its good, but i would like if someone could write a tuturial about cryptography in protection schemes, as a start offset. Because so far i have seen no one share their knowledge on this subject.

- JJ


REKML Links
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > REKML Links
PDA

View Full Version : REKML Links

stanks
11-05-2000, 04:00 PM
Hi

Especially links at messageboards section are dead (not all of course).

Greetz
nu
11-06-2000, 01:36 PM
http://rekml.cjb.net


FlexLM reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM reversing
PDA

View Full Version : FlexLM reversing

David
11-05-2000, 04:37 PM
The last weeks I have been working with some serious reversing.
The target is a program called Advanced Design System 1.3 from
Agilent Technologies. It is an simulator for DSP and Microwave
designs. The target uses FlexLM 6.1 for license management and
I'm running it under Windows 98. I have a demo license file
for this target.

I started running lmgrd in the bin directory. This program
executes the vendor daemon 'hpeesofd'. Using a bpx on
'GetCommandLineA' I found the command line to execute
the vendor daemon directly.
The command line was 'hpeesofd -T myhost 6.1 -1 -lmgrd_port 6978'
Running this vendor daemon with a breakpoint on 'GetCommandLineA'
I can bpx the functions that I'm interrested in.
I have found some functions by comparing the vendor daemon with
lmgr326b.dll. The code in this dll and the code in the vendor
daemon are not identical, but it is still possible to recognize
some functions.

I first started to do the standard approach by breaking at
lc_init and write down the values stored in the vendorcode
structure. Then I used a generator for vendorkey 5 and created
a new license file. This didn't work.

Then I read the essay from Dan some more and tracing around
using w32dasm. After a lot of tracing I put a breakpoint on
the decrypt function in l_sg. The daemon is very similar to the
target described in Dan's essay about lc_new_job(). Passing
0 as the first argument to this function disabled the alternative
seed encryption. This will cause the seed encryption part of the
job structure to remain zero.
Watching the vendorcode structure after the call to decrypt
gave me another set of seeds which I tried without success.

I must say that I'm not really sure about what's happening after
the seed decryption. I think that somewhere the vendorcode
structure and the job structure would be used to generate
a license key which then would be compared to the key in the
license file.

Any idea on what I should try?

Thanks in advance,
David
Kythen
11-06-2000, 04:52 PM
I'm assuming that this app makes use of lc_new_job as the seeds from l_sg did not work. What you need to do is trace through the l_n36_buff function that is pointed to at the beginning of l_sg (See the check to see if a flag is set by test var, 80.. if yes go to function pointed to by another var.) Inside there is a point after the random time based data is acquired where the real seeds are built (or at least can be found through an xor). Read Nolan Blender's excellent essay for more specific information on how to do this and which bytes from the random data to use.

HTH
jenshi
11-06-2000, 05:57 PM
Why does everybody always want to find the vendor code hidden in the target? However, even you don't know the vendor code, you still can generate license key from the target itself (just let one comparison be correct, then the license will come out).
OrionYOung
11-07-2000, 10:13 AM
hmm..

why don't you use "BPX Createfilea" ?
When daemon reading License file, You can find lc_init & lc_checkout!!

first.. you have to check some symbolic bytes in those routine.
when finding it!! if you so genius , can find Vendor 5 & decrypted seed1 &2..

V5 , Seed 1 & 2 have some symbolic routine like "PUSH XXXXXXX" , "CMP reg , XXXXXXX" & "MOV reg, XXXXXXX"

farewell. =)
David
11-08-2000, 05:03 PM
Hi everybody,

Finally I got the license generation working.
Thanks alot for your great help.

Regards,
David


A simple question concerning an iat rebuilder
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A simple question concerning an iat rebuilder
PDA

View Full Version : A simple question concerning an iat rebuilder

tsehp
11-05-2000, 05:18 PM
hi,
I'm actually writing a (lame) iat rebuilder in c++. The purpose is to use the IT addresse's put them in a table, take all the modules in mem that target uses , extract their import names, and then compare
by a getprocaddress the result with the entries inside the IT. If the
adresses are equal, write the module and procaddress inside a table, when finished, finally used to generate IAT, IAD and IT.
My question is : is there a more direct way, when you have the import's mem adress to know it's name and module ?
regards.
G-RoM
11-05-2000, 05:37 PM
Answer is easy :

There is no other way... BTW ur method has some flaws from the beginning : Some API have no name :)

Cheers,
G-RoM
notme
11-05-2000, 07:28 PM
also, some asciiz's share the same address as others .. like, 2-3 asciiz's in kernel32.dll will return the same api address.. dupes.. which cause the program to have a 99% rebuilded IAT im some cases

dont know any off the top of my head, but they do exist..
kill3xx
11-05-2000, 08:05 PM
mem that target uses , extract their import names, and then compare by a getprocaddress the result with the entries inside the IT. If the adresses are equal, write the module and procaddress inside a table, when finished, finally used to generate IAT, IAD and IT.
My question is : is there a more direct way, when you have the import's mem adress to know it's name and module ?
regards.[/quote]

G-Rom has already answered to ur question..

so the following is just to satisfy my own ego ;)

umm AFAIK the only shortcut in (UM) is to let windows find the module name (and imagebase) usign VirtualQuery .. this method is well documented in Ritcher "Advanced Window Programming" if i racall correctly [ eheh it's a long time that i'm out of business :) ]

best regards,

kill3xx
tsehp
11-06-2000, 01:23 AM
First I thank you all for your answers.
g-rom : it's an honor to see you here :) If I double check with the ordinals, am I sure to have an unique entry ? I would love to see the
source of your *fantastic* phoenix plug-in, but you maybe want to
keep it private and I'll understand why.

notme : So those dupes are some kind of overloaded member functions ? Do you remember if they only differ by the parameters ?

kill3x : very interesting function, I'll just check for that and publish what I found about this virtualquery.

best regards,

tsehp
tsehp
11-06-2000, 11:22 AM
Sorry killer3x but I don't get it.
Virtualquery and virtualqueryex just gives into a structure some general infos about the mem protection state (commited/decommited,
protected or not) it gives also the base mem address, pages etc...
But nothing in direct relation with dll's exports names/ordinals.
Maybe I've missed something, but I'm actually taking the option I spoke before :'(
regards,

tsehp
kill3xx
11-06-2000, 07:02 PM
+Tsehp (11-06-2000 01:22):
Sorry killer3x but I don't get it.
Virtualquery and virtualqueryex just gives into a structure some general infos about the mem protection state (commited/decommited,
protected or not) it gives also the base mem address, pages etc...
But nothing in direct relation with dll's exports names/ordinals.
tsehp

yup.. not directly related with exports.. it's just a shortcut to find the baseaddress and module name given a valid address in the process address space.. let me explain better (umm.. with my crappy english it's hard ;)

when u pass to virtualquery an address that is within a module image.. virtualquery return as mbi.baseaddress = allocationBase the module base addr...

so if u've some this condition:
1) mbi.state != mem_free
2) mbi.state != mem_reserve
3) mbi.baseaddress = mbi.allocationBase

u can assume it's a module image and try GetModuleFileName to find the module name and then use the address to lookup ET.. at this point u've both the ordinal or the asciiz api name...

umm.. i know it sounds crappy.. but it works .. at least it has worked for me sometime ago when i've coded a lame iat dumper..

But again.. this solution is not the bulletproof or the best one.. so simply forget it..
as i've said in my previus post it was only for my own ego ;)

best regards,

kill3xx

p.s. sorry again for my english
G-RoM
11-06-2000, 07:33 PM
Seeing source code of Phoenix : Dream about it.

As point out Kill33r, it is true that under 9x, some API point to same address, IE Kernel32.Ord1-Ord9. There is no easy way to get back REAL one. I think I know a method but it involves special code and specific to 9x.

Now let's Speak of NT : u will have to deal with forwarded API... These are nice stuff as well :).

What Kill33r gives u with virtualquery is to get ride of ToolHelp32/PSAPI system to list attached DLLs... Advantage is it works uniformally under nt and 9x. Pb is when deal with wrapped API even if u can probably find a workaround.

Btw: this board got a little lack of feature... can't see posts of which I am replying, this is a bit annoying... IE here I have pb to remember exact nickname of Kill33r (sorry buddy if i am wrong).

Regards,
G-RoM
tsehp
11-07-2000, 02:04 AM
Thanks again kill3x and g-rom.
To see the post wich you are replying, simply click on reply w/quote.,
this will get back the msg on your reply.
I've read the "under the hood" contributions about another use of virtualquery and imagehelp.dll, using a map file it gets directly the function name, but it's useless in our case, we dont have debug info.
So I'll do it the hard way, I've already created the process and module
browser, I'll do a getprocaddress on all the exports present in the modules related to the process :'(
Just to ease my work, do you know about the existence of pre-defined
c++ classes concerning the pe-format ? Not the ones inside windows.h
off course, but more newbie-oriented ones ?
TIA,

tsehp
el.caracol
11-08-2000, 05:04 PM
Hi +Tsehp,

first of all: excuse-me for my very bad english !
(I'm French and I have used an electronic translator to write this message..)

Well, I also worked on Asprotect and I followed with much interest your essays on the call fixer and import table rebuilder.

For my part I had already put in practice the idea consisting in finding the function name and the DLL name starting from its address mem. It is a very simple idea, which has certainly weaknesses, but I can ensure you that it goes! (works fine).
Two months ago, I developed a (lame) tool prototype (with Delphi 5) based on the (nearly) same idea, which makes it possible to examine the IAT of a dumped prog, to visually detect "abnormal" IAT, to facilitate the validity of an IAT call fixer, and especially to rebuild a new import table.

(I recently worked on a program Asprotected v1.1: "AZPR351" (elcomsoft), and I dumped it, call-fixed and rebuilded Import Table without any problem :-)

Well, i will not explain in detail how works the prototype, but here is the essential points :
- from files containing the names of the export functions for each DLL (ie: 'kernel32.txt'), it builds a directory of these functions with the addresses corresponding to your system (with getprocaddress).
- It use these directories to solve the IAT adresses contained in the executable target and create a file called 'addr-FunctResolved.TXT'
- finally it use this text file to rebuild an Import Table (of Borland type) directly in the executable dumped, according to the parameters specified by the user.

some details :
It is preferable to work on programs dumped with Raw Offset and Virtual Offset aligned.

The design of the prototype enables you to solve the IAT on a dumped program (even incomplete) and rebuild an import table on another dump of this same program (dump complete).
(look at the example on Notepad Asprotected on "Caracol-Readme.doc").

The rebuilding of the IAT only starting from the txt file 'addr-FunctResolved.txt', it is possible for you to make corrections directly on the txt file.
That can be useful in the case of a " call fixer " doesn't fix all the IAT addresses on once and once only .
It is possible to back up the partially solved file, then modify the call fixer to correct only the bad addresses, then paste the corrected addresses.

(Voluntarily) the prototype does not write the offset values of the Import Table and size in the PE Header of the target file. But if you miss that, you can to add this on the source code.

In short, to treat a program asprotected here is the stages which I used with the prototype:
1- launching prog, then dump full
2- examination of the IAT with the prototype to determine the limits of the iAT and to see which are the "abnormal" addresses
3- writing a simply call fixer after the launching of the contamined program, then dump it
4- examination of the result and solve the IAT addresses with the prototype
5- rebuild an import table in the prog dumped on the entry point with the prototype.

If you give me an available e-mail address, y will send to you "caracol.zip" wich contains the following files :
(sorry but the majority of the documents are in French and I'm too lazy and too weak to try to translate them. But I am sure that you will understand the main point by reading only the listings and the logs..)

- Caracol-Readme.doc (well.. a readme on how works the prototype + some tuts on how to use it)
- AZPR321-Asprotected.doc ((asprotected 1.05) a tut on how to make a simply call fixer and use the prototype)
- Caracol-eng.exe (the prototype)
- Delphi-Caracol-Project-Eng (the code source with a little translation.. the first release..there was no modification since.)
- Address-DLL-TXT (contains some txt files with functions names)
- Work (a directory with some little examples (Win 98))

Well, that's all..

best regards,

el.caracol@caramail.com
tsehp
11-09-2000, 01:04 PM
hi caracol,
I have to thank you very much for your complete reply.
Just one thing : I'm French too, so you don't have to translate the docs ;)
What you already did is exactly what I'm currently working on, so the
more people working on this actual problem will surely give some reliable solutions.
Several programs like those are emerging, icedump 6 with hydra plugin
from g-rom, it_build by boris, the dedicated apps written by lutin noir.
Sure it would be better if a general, updated app could solve the most
different cases, I decided to code my own, so their most recent tricks
can be updated in no time, but I'm very far from this point.
Your sources will save me a lot of time, I'm actually thinking far beyond and finish this app with a tracer to fix their later encrypting
progresses.
I sent you a copy on your mail box, thanks again.
regards,

tsehp


magic with 0F9x (intel errata?)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > magic with 0F9x (intel errata?)
PDA

View Full Version : magic with 0F9x (intel errata?)

MO K
11-06-2000, 02:00 AM
Does any one know how does the SETxx family of opcodes select their memory operands?
They are the only ones that take single operand, and a ModRegRm. The operand is m8 or r8. The register operand is retreived by looking up the value of the Reg field, in the array of one byte registers.

I have assembled a long list of varying SETxx instructions, both with register and memory operands. And I noticed that all the opcodes that take a byte of memory as an operand, are followed by a 6 (00000110).

The Mod is 00, meaning, no displacement, and the Reg is 000 meaning ESP in 32-bit. Now that is not what i coded.

If the R/M field was a 100, i would expect one more byte for SIB, but R/M is 110 !

I expect the offset of the operand to be encoded in the instruction, and indeed, I see the offset in the instruction. But when automating the disassembly, how do I differentiate between the two distinct operands. Should I stick to the 0x6 i have discovered, so when ever i parse a 6, i flag it as a memory operand, or is there a `traditional' way?

So far, i am confident about this magical 6. I have greped 30mbs worth of disassembly listings, and got the six with every memory operand for a SETxx (e.g. 0F 94 06 00 30). Where the operand is a register, only a single ModRegRm byte is given (e.g. 0F 94 0C), in the later case, only the Reg part is decoded, Mod and R/M remain intact!

Anyone has an idea?
cronos
11-06-2000, 12:21 PM
Hi Mo,

well, I would like to know which disassembler you are using for this analysis. Certainly in a 32-bit segment you are not getting the disassembly right.

0f94c1 = sete cl
for example
now
0f9406 = sete byte ptr [esi]
and it is 05 which is the straight disp32, and 04 which indicates a sib
so
0f940542414000 = sete byte ptr [404142]

I checked this in Borg, and rechecked it in ida, setting the segment to 32-bit in a bin file.
MO K
11-07-2000, 01:59 AM
Look who is here, I knew i would fetch a legend out :-)

What i posted was crap, i said SETxx where the only single operanded opcodes that take a ModRegR/M byte, not so, look at group 4/5/6 ;)

Well, I am playing with a prototype disassembler at the moment, to be writen from scratch. And I thought the 0F9x where special, and such, wanted to code their own ModRm decoder, and dedicate the big ModRm decoder for the opcodes with two or more operands.

Its quite irritating in the case of the single operanded instructions. I am deciding the src/dest combination by testing the second bit of the opcode bit-1. Where the opcode takes two operands, this is Ok. Three operands? still ok, the third operand is (mostly?) either 1 or CL, and i can pretty much ignore it. I cann't base my decision of the src/dest by the misleading comma in the opcode table, it was meant as a reading aid, not disassembly.

When an opcode takes a single operand, there is no need to find src or dest. I think i should handle this seperatly, either by flagging them as such in the opcode tables, and testing for this in every invocation of the ModRm decoder. Or, by writing a mini ModRm decoder for them, which is well tailored for The SETxx and groups 4/5/6, and handle them there.

Well, if you are wondering why this awkwardness, well, i want the disassembled instruction to be output to a structure which is then passed to the printing module. I want to extract more information from a disassembled instructions (i.e. cross-referencing, predicting disassembly, etc.) and such, would like further inspection. Syntax independance is also a requirement of mine. Off-course, this goals could be adjusted, depending on mood and time ;-)

As you can see, I am still working on the blue print, so, I have nothing -yet- to bring out to public.

Well, that is all, Just stick around for tech support :P
cronos
11-07-2000, 11:39 AM
hehe!

Presumably you are realising and using the fact that the 'modr/m' byte often determines the actual instruction too (like SAL/SAR).


VBox v4.3 .DLL Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VBox v4.3 .DLL Help
PDA

View Full Version : VBox v4.3 .DLL Help

NchantA
11-06-2000, 05:45 AM
I have read deZZY's tutorial on vbox cracking and tested it on a program, it worked perfectly so i thank him and tsehp+ both for their hard work.

however i have run up against a program with a vboxed .dll instead of the .exe being packed...i follow the tutorial but it jumps right over the crucial 'jmp ebx'. i tried a few different methods of finding eop and dumping the .dll but i just cant do it. if i have overlooked something and am being stupid feel free to say so ;)

any help on this subject would be appreciated.

NchantA
tsehp
11-06-2000, 11:19 AM
More precisions :
bump on jmp ebx ? Means that your debugger is going nowhere after
this instruction. What if your dll base address ? Did you came just
before the jmp ebx while into an interrupt handler ?
Anyway, you can use the latest icedump 9 with the pedump option,
don't forget to protect it with the protection option, it's a real vbox killer, even if the IAT is well destroyed.
regards,

tsehp
The Owl
11-06-2000, 02:32 PM
wow, icedump 9, that must be a real killer, not even i have it ;-)

seriously, what you probably want to try is 6.020 pre-release, it is
on the site (icedump.tsx.org) but not yet linked, just do a dir
listing and you'll see. pls DO rtfm, especially the plugin system stuff
as this latest version has one specific plugin for vbox 4.30.

as for /protect, i don't think it's needed for vbox, it is useful for
new protections when one wants to quickly find 'suspicious' code,
ie. where the code attempts to enter ring-0 illegally.
tsehp
11-06-2000, 06:56 PM
Excuse me for the number, my monitor was put upside down ;)
The vboxed app I last reversed was videowave 3, but if you don't
dwelve inside vbox4.3 to stop redirectors/decrypters to install in the
thunks, then the auto rebuild feature miss a lot of imports.
I never used the trace feature, maybe it could manage to do such a
thing without the vbox plugin. The actual problem is that the 4.3
holds at least three different versions considering my attempts, how
can the plugin recognise them ?
v1:it not encrypted
v2:it encrypted, iat pointers still valid.
v3 (actual):it encrypted, iat messed up after the nag.
regards,

tsehp
G-RoM
11-06-2000, 07:22 PM
VBOX 4.3 Hydra plugin works efficiently on what I tried. Before asking or saying how could it works blabla... TRY IT and RTFM.

VBOX protection is really a joke imho.

Cheers,
G-RoM
tsehp
11-07-2000, 02:18 AM
G-RoM (11-06-2000 09:22):
VBOX 4.3 Hydra plugin works efficiently on what I tried. Before asking or saying how could it works blabla... TRY IT and RTFM.

VBOX protection is really a joke imho.

Cheers,
G-RoM

No doubt, even without using the hydra plugin it works if you disable
the jz inside vbox to redirect the jumps inside vbox, I'll never try to
put any critic on what you've done, g-rom.
I would like to follow your tracks, but coding in c++, I almost have to
start from the beginning, I just don't want to include your work by
linking my app to your pe.lib, the purpose is to understand how this works, al this level, there is no docs, no clear c++ to get, just your
several years of experience on this topic.
Lets put a direct question : Where can I find the most relevant help
to save me some time, avoiding me to reinvent the wheel ?
TIA
NchantA
11-07-2000, 04:39 AM
i am ecstatic that three of the most profound influences on cracking and indeed my cracking experience have answered my small post! :D

im sorry if i was unclear before, when i go offline i will try and save some code of what happens, but in general this is it:

i follow dezzy's tut all the way upto the jmp eax (eax==&GetProcAddress) after which i step into the important call that when debugging vbox usually jmps to the new unpacked code, i step through for a while and down below you see a jmp ebx with 2/3 push's above it, but unfortunately it never reach's this instruction, it jumps over it at some point, and i have no idea when/where the OEP of the .dll lies or at what time i should dump it.

im sorry g-rom, i dont know what Hydra is ;)

Thanks Guys

NchantA
NchantA
11-07-2000, 04:53 AM
apologies to you all, i see now Hydra is a plugin for icedump ;p

ill do my best with this, but i am kinda unsure of *when* to dump the file. usually this is when the packed has finished the unpacking and is about to jump to the new code. i am sorry to say i have no friggin idea the protocol it uses with .dll's. hehe

thanx again for your time

NchantA
The Owl
11-07-2000, 08:08 AM
sigh... lots of it ;-)

so, let me make another effort of repeating myself re: OEP & DLL & you name it.

1.
people/me produce/release tools because they/me think that they serve some
purpose other than their/my own. however this does not put them/me into the
same group as the users. in particular, i have stated it several times already that
i am *not* a cracker, but i *do* share certain interest and knowledge with them.
this should not come as a surprise as i consider myself a reverse engineer and
such knowledge is a prerequisitive for learning and evading software protection
schemes as well.

2.
i tend to make little or no effort to try to 'sell' our stuff (so your and others'
ignorance is a more or less forgivable 'sin' ;-), but that doesn't mean that once
you make it on the icedump site, you should ignore what *else* you find there,
nor does it mean that your are not required to RTFM and understand it and make
conclusions which we didn't explicitly stated anywhere (ie. *think* ;-). see, i'm
not a document/tutorial writer, i expect the reader/user do his/her homework as
well (but i welcome others' contributions in this area).

3.
so, as for your particular requests:

finding OEP: icedump has a tracer engine designed just for this. the commands
you want to check out are /TRACE and /TRACEX, the latter being probably the
more applicable. the generic use is something like this:

1. load the target into softice so that softice pops on the first instruction (see
next point regarding DLLs).

2. start the tracer like this: /TRACEX 401000 450000, where the two params
should cover the area in which you expect the OEP to be (typically the first
section of a PE file).

3. sit back and wait. after a while softice should pop up at the OEP (or at
least when EIP reaches the specified range for the first time, at this point
it takes some thinking to decide whether to continue tracing or not) or the
app will start up (meaning the range was wrong, try again with another one)
or the tracer crashes (in which case let me know about it). in most cases
you'll get softice pop up, just be patient (i recall VBOX took some 20 minutes
on a P5-200, with a few hundred million instructions traced). of course this
was just the bare minimum you need to know to use the tracer, there are
several options that have to be properly set for a successful trace (eg. for
VBOX child process tracing is not required, whereas for peshield you want
to trace threads in the same process, as nice as i am ;-), the default settings
reflect this already, but that's not always good enough - one more reason
to RTFM and think).

DLL issue: loader32 is incapable of loading a DLL and getting softice break on its
entry point. it is an artificial limitation, which our iceload removes (imho it is
good enough to replace loader32 for most users). so, get it, RTFM again and
think ;-). a little hint for your case: since VBOX uses several interoperating DLLs
plus the protected app, iceload should be used to notify softice only and not to
load the target DLL directly (into its own address space). this means, that once
iceload notified softice, you have to start the target app, which will eventually
make the OS load the target DLL on which then softice will break. then you can
start to trace.
tsehp
11-07-2000, 05:55 PM
NchantA (11-06-2000 18:53):
apologies to you all, i see now Hydra is a plugin for icedump ;p

ill do my best with this, but i am kinda unsure of *when* to dump the file. usually this is when the packed has finished the unpacking and is about to jump to the new code. i am sorry to say i have no friggin idea the protocol it uses with .dll's. hehe

thanx again for your time

NchantA

As owl said, I will forward you to master the icedump tool.
But at first, I would like to help you more, so could you post a snip
of the code you're in (about 20 lines before/after the eip) , just before
the jmp ebx you talked about.
It's better to learn do to it manually at first, then you can automate the repetitive tasks with icedump and its wonderful new features.
When I look at what they did, I feel like a monkey trying to read Einstein's theory of relativity :)
regards,

tsehp
NchantA
11-10-2000, 05:14 AM
Whole Routine

015F:008E04AD AND EAX,04
015F:008E04B0 TEST EAX,EAX
015F:008E04B2 JNZ 008E04BB
015F:008E04B4 MOV EAX,003B37FF
015F:008E04B9 JMP 008E051E
015F:008E04BB MOV ECX,[EBP-08]
015F:008E04BE CMP DWORD PTR [ECX+0C],000000C7
015F:008E04C5 JNZ 008E04FD
015F:008E04C7 MOV EDX,[EBP+0C]
015F:008E04CA MOV EAX,[EBP-08]
015F:008E04CD MOV ECX,[EAX+18]
015F:008E04D0 MOV [EDX],ECX
015F:008E04D2 MOV EDX,[EBP-08]
015F:008E04D5 CMP DWORD PTR [EDX+1C],00
015F:008E04D9 JZ 008E04FB
015F:008E04DB MOV EAX,[EBP+08]
015F:008E04DE CMP DWORD PTR [EAX+50],00
015F:008E04E2 JNZ 008E04FB
015F:008E04E4 MOV ECX,[EBP-04]
015F:008E04E7 MOV EDX,[ECX+64]
015F:008E04EA PUSH EDX
015F:008E04EB MOV EAX,[EBP+08]
015F:008E04EE CALL [EAX+6C]
015F:008E04F1 MOV ECX,[EBP-04]
015F:008E04F4 MOV DWORD PTR [ECX+64],00000000
015F:008E04FB JMP 008E0519
015F:008E04FD MOV EDX,[EBP-08]
015F:008E0500 MOV EAX,[EDX+14]
015F:008E0503 MOV [EBP-10],EAX
015F:008E0506 MOV EBX,[EBP-10]
015F:008E0509 JMP EBX // ehere u usually jump (ebx==eop)
015F:008E050B MOV ECX,[EBP-08]
015F:008E050E MOV EDX,[ECX+14]
015F:008E0511 MOV [EBP-0C],EDX
015F:008E0514 MOV EAX,[EBP-0C]
015F:008E0517 CALL [EAX]
015F:008E0519 MOV EAX,00533700
015F:008E051E POP EDI
015F:008E051F POP ESI
015F:008E0520 POP EBX
015F:008E0521 MOV ESP,EBP
015F:008E0523 POP EBP
015F:008E0524 RET

The Routine as is traced...

015F:008E0470 MOV EBP,ESP
015F:008E0472 SUB ESP,10
015F:008E0475 PUSH EBX
015F:008E0476 PUSH ESI
015F:008E0477 PUSH EDI
015F:008E0478 MOV EAX,[EBP+08]
015F:008E047B MOV ECX,[EAX+0000011C]
015F:008E0481 MOV [EBP-08],ECX
015F:008E0484 MOV EDX,[EBP+08]
015F:008E0487 MOV EAX,[EDX+00000120]
015F:008E048D MOV [EBP-04],EAX
015F:008E0490 MOV ECX,[EBP-04]
015F:008E0493 MOV EDX,[ECX]
015F:008E0495 AND EDX,01
015F:008E0498 TEST EDX,EDX
015F:008E049A JZ 008E04B4 (NO JUMP)
015F:008E049C MOV EAX,[EBP-04]
015F:008E049F MOV ECX,[EAX]
015F:008E04A1 AND ECX,02
015F:008E04A4 TEST ECX,ECX
015F:008E04A6 JZ 008E04B4 (NO JUMP)
015F:008E04A8 MOV EDX,[EBP-04]
015F:008E04AB MOV EAX,[EDX]
015F:008E04AD AND EAX,04
015F:008E04B0 TEST EAX,EAX
015F:008E04B2 JNZ 008E04BB (JUMP )
015F:008E04BB MOV ECX,[EBP-08]
015F:008E04BE CMP DWORD PTR [ECX+0C],000000C7
015F:008E04C5 JNZ 008E04FD (NO JUMP)
015F:008E04C7 MOV EDX,[EBP+0C]
015F:008E04CA MOV EAX,[EBP-08]
015F:008E04CD MOV ECX,[EAX+18]
015F:008E04D0 MOV [EDX],ECX
015F:008E04D2 MOV EDX,[EBP-08]
015F:008E04D5 CMP DWORD PTR [EDX+1C],00
015F:008E04D9 JZ 008E04FB (JUMP )
015F:008E04FB JMP 008E0519 (JUMP )
015F:008E0519 MOV EAX,00533700
015F:008E051E POP EDI
015F:008E051F POP ESI
015F:008E0520 POP EBX
015F:008E0521 MOV ESP,EBP
015F:008E0523 POP EBP
015F:008E0524 RET


Another hacking contest fo0r money... (Not sure if I nshould post this...)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Another hacking contest fo0r money... (Not sure if I nshould post this...)
PDA

View Full Version : Another hacking contest fo0r money... (Not sure if I nshould post this...)

gs
11-06-2000, 08:11 AM
Starting today (11/06/00). Security will be relaxed a bit every day until friday (i.e. today you only have IP, tomorrow they're gonna publish another detail ...)

http://www.argus-systems.com/events/hacker/
tsehp
11-06-2000, 11:14 AM
Sure, you shouldn't.
Why ? Not for off topic reasons, but the guys that organize the contest
are making big savings while treating the hackers like childs :
Come on, try to come in if you can. And then they will learn of all the
attempts, and maybe without giving anything back. They could also use
the ip logs to put them into a database. That's why it's not very interesting.
regards,

tsehp
gs
11-06-2000, 04:39 PM
I understand your arguments and in general I deem them valid. I wouldn't have posted it if I didn't think different in this case:

a) I am pretty sure they're not up to fill databases with IPs, because they presented that contest on an IT fair today and lots of visitors are going to try.
b) It is a relatively small company - I am pretty sure that they are not really willing to afford the 100.000 deutschmarks.
c) IMO they can't be interested in anyone breaking into their system because that would counter their marketing strategy. They modified a Sun 5.7 (if I remember correct) in order to make it 'uncrackable', even when hooked to the net and without the necessity to use a firewall.

What fascinated me was the fact that now a company doesn't blow the horn of hysteria. Instead of telling some 'inexperienced' managers how dangerous the internet is and how good their firewall/intrusion detection/gateway-software/you-name-it would protect them, they 'simply' take a system that's widely spread already and try to secure it.

But still...they may use the experience they gain to further improve the system. And they won't pay back, no way !

Regards,
gregor samsa
nu
11-07-2000, 10:02 AM
morality aside, i truly prefer this over fraudulent advertising of incompetent and/or bastard developers who concentrate their efforts on investigating what the customer is likely to trust as 'worth' the money and not on trying to shape their product's quality based on his/her real needs. they can put out a darn neat product description, make you almost fear how excellent the program is gonna be, but the underlying crap remains.

does lockdown2000 ring a bell?

ay carramba,
nu


floating point and si
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > floating point and si
PDA

View Full Version : floating point and si

figugegl
11-06-2000, 05:45 PM
i have the following line in a vb-crackme:

cmp dword ptr[ebp-28], 41047ae1

where [ebp-28] is shown in register st0. how can i make the value "41047ae1" visible? it's a packed floating point const and "? 4104..." doesn't work.

any ideas?

figugegl
goatass
11-06-2000, 05:56 PM
It's kinda hard to make out what you are asking here, but what is a "packed floating point const" ? and what's a st0 register ?

first of all if you do ? 41047ae1 there is no reason for it to fail since all it does is converts that hex value to a decimal and ascii value. Second, to see what's in the [ebp-28] you do: ? *(ebp-28)
or just do a: e (ebp-28) and that will put you in the data window right where the bytes are and you can read them and write them down, so you could use a calculator to convert them to whatever you want.

goatass
cronos
11-07-2000, 12:29 PM
Presuming this to be a single real (32 bits), it has an exponent of 8 bits and a 24 bit precision.

The representation you have is 41047ae1.
Now the first bit is the sign, in this case 1=positive.
then the next 8 bits are the exponent, plus a biasing constant. In this case (41)*2+0 - 7f = 3 , indicating that the number is -x * 2^(3) where x is given by the bits of 047ae1 converted into decimal, but there is an implied 1 at the front. So in other words, in binary the number is 1.000 0100 0111 1010 1110 0001
so it is 847ae1 divided by 2^23
hence our number is 8682209 * 2^-20 or 8.28

this presumes the standard ieee fp format of course ;)
cronos
11-07-2000, 12:30 PM
1=positive...........whoops. should be 0 = positive.
Timmy
11-08-2000, 11:01 AM
Floating point registers are not strictly speaking registers (although they can be considered as such). The floating point unit has an internal stack consisting of a number of 80 bit "data registers". These can obviously be manipulated by floating point instructions and you have to specify which register(s) your instructions will access. The registers are identified as follows :- st(0) is the register on top of the stack, st(1) is the next one, st(2) the next ... and so on.
Spath.
11-08-2000, 03:13 PM
> Floating point registers are not strictly
> speaking registers (although they can be
> considered as such).

Strictly speaking, they are exactly registers,
i.e. visible D flipflops.

Spath.
Timmy
11-08-2000, 05:03 PM
What I meant was that normally a register is static ie eax is always eax but the st(0) is described as a register but is in fact a pointer to a register (well, a value on a stack).
risc
11-09-2000, 11:20 AM
wf to toggle floating point registers display...

wf b|w|d|f|p|* are ure different options..

dl <address>
ds <address>
dt <address>

to display different floats in your data window..
figugegl
11-10-2000, 01:46 PM
thanks for your help :)


exemplar question?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > exemplar question?
PDA

View Full Version : exemplar question?

devilsword
11-07-2000, 01:13 AM
LeonardoSpectrum 2000.1b use flexlm 6.1
manage license.I have found seed1 and seed2 and key 1-5.But it is reported error
when the license I generated is used.Why?
Amante4
11-07-2000, 10:47 AM
Hi,

I've looked at the previous version which
used version 6.0 and all was normal.
Maybe in 6.1 they've used the lc_new_job
function to hide the seeds. These methods
are described in detail on tsehp.cjb.net.
There's also a possiility that they've started
using vendor defined checkout filters or
strings. I'd suggest to check out the calls
to lc_set_attr and see what the target is
setting.

regards,
amante4
devilsword
11-07-2000, 09:37 PM
I got the Vendor_id from the program,
It is "exemplard".
But I found the Vendor_id is "modeltech"
from the evaluation license.
Why?
devilsword
11-07-2000, 09:37 PM
I got the Vendor_id from the program,
It is "exemplard".
But I found the Vendor_id is "modeltech"
from the evaluation license.
Why?
lmflexcrk
11-07-2000, 10:32 PM
Exemplar spectrum 2000.b1 also accept modeltech's license. That's why your license file use modeltechd.


Aarg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Aarg
PDA

View Full Version : Aarg

MO K
11-07-2000, 01:55 AM
Look who is here, I knew i would fetch a legend out :-)

What i posted was crap, i said SETxx where the only single operanded opcodes that take a ModRegR/M byte, not so, look at group 4/5/6 ;)

Well, I am playing with a prototype disassembler at the moment, to be writen from scratch. And I thought the 0F9x where special, and such, wanted to code their own ModRm decoder, and dedicate the big ModRm decoder for the opcodes with two or more operands.

Its quite irritating in the case of the single operanded instructions. I am deciding the src/dest combination by testing the second bit of the opcode bit-1. Where the opcode takes two operands, this is Ok. Three operands? still ok, the third operand is (mostly?) either 1 or CL, and i can pretty much ignore it. I cann't base my decision of the src/dest by the misleading comma in the opcode table, it was meant as a reading aid, not disassembly.

When an opcode takes a single operand, there is no need to find src or dest. I think i should handle this seperatly, either by flagging them as such in the opcode tables, and testing for this in every invocation of the ModRm decoder. Or, by writing a mini ModRm decoder for them, which is well tailored for The SETxx and groups 4/5/6, and handle them there.

Well, if you are wondering why this awkwardness, well, i want the disassembled instruction to be output to a structure which is then passed to the printing module. I want to extract more information from a disassembled instructions (i.e. cross-referencing, predicting disassembly, etc.) and such, would like further inspection. Syntax independance is also a requirement of mine. Off-course, this goals could be adjusted, depending on mood and time ;-)

As you can see, I am still working on the blue print, so, I have nothing -yet- to bring out to public.

Well, that is all, Just stick around for tech support :P
MO K
11-07-2000, 02:08 AM
Should we put together a MBing mini HOWTO?


Hooking modem comunications
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hooking modem comunications
PDA

View Full Version : Hooking modem comunications

aCaB
11-07-2000, 12:42 PM
I've just got an external 56k modem manufated by atlantis and sold (at a really low price) by a free italian isp.
The problem is it's locked as you are not supposed to use it without the isp unlocking software it come with.
The unlocking procedure only consists in sending an 8 byte string to the modem.
If you give the wrong code more than 3 times the modem hangs untill switched off/on.
I've "guessed" the unlocking string in no time but now there's another problem:
the unlocking code needs to be send to the modem each time an application opens a handle to the modem (or to the com) port.
The question: how can i hook the modem, under win9x, so that i can unlock it before comunications? And under Linux?

Thanks,
aCaB
Fatboy Joe
11-07-2000, 03:40 PM
I think the RasDial function may be what you are looking for. I've never used any of the RAS functions thus far but from examining the net detect agent with ICQ these seem to be the relevant functions to do with connections on windows.
TOTEU
11-07-2000, 08:56 PM
Help references are:

Attacking Windows 9x with Loadable Kernel Modules
by Solar Eclipse

and:
http://www.sysinternals.com

Regards,
TOTEU
aCaB
11-08-2000, 07:44 AM
Thanks a lot for your help, I was already aware of this solution 'cause I used portmon to "guess" the unlocking code, but at the moment I know too little about vxd's to write one myself.
What I'm trying is a similar approach: api hooking using a little piece of code made available to all processes through a memory mapped file.
But now the further question is: how can applications open the modem?
The only two ways I know, under win9x, are "CreateFile" and "opencomm". Are there other api's I need to hook?
The other problem is that this attack is useless if the modem is driven by a dos program through in and out instructions, but that's not too important.

aCaB
Spath.
11-08-2000, 03:08 PM
> I've "guessed" the unlocking string in no time but now
> there's another problem : the unlocking code needs to be
> send to the modem each time an application opens a handle
> to the modem (or to the com) port.

The modem has no clue which application your request is coming
from, which would mean that another AT sequence is sent to lock
the modem each time a new application is started. Disassemble
your driver and/or use PortMon, and look for suspicious AT strings.

> What I'm trying is a similar approach: api hooking using a little
> piece of code made available to all processes through a
> memory mapped file.

That may work, but it is not a good idea because the driver's code
will always be called after yours ; you would have better chances
by running your code at driver's level or below.

Btw, I find the board ugly but the contents are
so far much more interesting than before.

Spath.
aCaB
11-08-2000, 05:47 PM
Thanks a lot Spath,
here's little explanation.

"The modem has no clue which application your request is coming
from, which would mean that another AT sequence is sent to lock
the modem each time a new application is started. Disassemble
your driver and/or use PortMon, and look for suspicious AT strings."

Well... nothing at all.
The modem driver is just the standard "unimodem.vxd" taken from win9x cdrom.
The lock is simplier: when any application open the modem (i.e. "Call CreateFile,'COM2',..." or "opencom, 'COM2',...") the modem waits for the unlocking code.
If the code is good it is ready to receive commands (AT...).
But, when the handle to the modem is closed (i.e. "Call CloseHandle, [modem_handle]" or closecomm,[modem_handle]) il locks again.
It would be nice to open and unlock it just once, but serial-device handles, as long as i know, are not shareable between processes under windows.

So, the approach i've choosed (i'm almost finished with it) is to hook CreateFile and opencomm.
The hook proc:
- verifies if the device to open is actually the locked modem
- calls CreateFile (or opencomm) to get the handle
- sets up the com port (speeds and timeouts)
- sends the unlocking string (via WriteFile or writecomm)
- receives the confirmation message
- restores default speeds and timeouts (not really important)
- returns to calling process

Any hints for a workaround under Linux?

aCaB
Spath.
11-09-2000, 04:37 PM
> The lock is simplier: when any application open the modem
> (i.e. "Call CreateFile,'COM2',..." or "opencom, 'COM2',...")
> the modem waits for the unlocking code.

No, because the modem cannot know if the traffic is coming
from a new or an already existing program, it is just receiving
raw commands and raw datas from a COM port. This means that
this lock must come from some specific piece of code installed
on your system ; check your installation logs for a new driver,
a DLL replacement, etc. Then if you can find where and how this
locking is done, and remove it. Please drop me a mail if you make
progress, this is interesting.

Regards,

Spath.
aCaB
11-11-2000, 03:36 AM
Sorry Spath, but this is the situation.
No specific drivers, no hidden unlockers.
To be sure i've made a little experiment on a clean machine with nothing on it but a fresh windows installation.
I've opened Hyper Terminal, made a connection directly to com3 (port to which the modem is connected).

Sent: AT
Received: Password error !!

Sent: ******** (the unlocking code)
Recv: Password check ok......

Sent: AT
Recv: OK

Sent: ATZ
Recv: OK

At this time i've clicked on the 'Disconnect' button and then on the 'Connect' button.
Sent: AT
Received: Password error !!

Sent: ******** (the unlocking code again)
Recv: Password check ok......

Sent: AT
Recv: OK

I think that this is the proof that the modem unlocks itself after receiving the rigth password and locks by itself.

aCaB
The Owl
11-11-2000, 06:21 AM
you may want to check out the .inf files that came with your modem, or the modem related registry keys where some of the info in .inf ends up. i forget the precise path in the registry, but you can do a search for 'init' or 'modem' and you'll see what windows will send to your modem on init (this also explains why no extra driver trickery is needed).
Spath.
11-11-2000, 08:57 AM
> To be sure i've made a little experiment on a clean machine

Very good test, thanks. I assume you just plugged the modem on
a machine where it has never been installed before ; if not then
you should also check Owl's suggestion (even if I seriously doubt
that an INIT string can cause the modem to lock itself back
from times to times).

> I think that this is the proof that the modem unlocks itself
> after receiving the rigth password and

Yes, I never discussed this.

> locks by itself.

Well, not really. When you click on "disconnect", this call
CloseComm() down to _VCOMM_CloseComm, which performs a 10 bytes
handshake with the modem (especially with MCR/LCR registers).
Now all this handshake is not strictly required from the
modem's point of view if another application is still using
the line ; however, it seems the modem use it to decide when
to lock itself back. Basically I think these guys did not
need to add their own locking command because MS gave them
already a nice sequence to detect (home made tools would
not make it lock itself back).

So from here, the best choice is in my opinion the one you
took, that is replacing OpenComm() by OpenComm()+WriteComm(unlockcode).

Regards,
Spath.
aCaB
11-11-2000, 07:09 PM
To The Owl: this was the first attack I tried after discovering the onlocking code, but i've found out that the init string is ignored by almost any application and by windows itself.

To Spath: "Basically I think these guys did not
need to add their own locking command because MS gave them already a nice sequence to detect..."
Sorry, i think there was a little misunderstanding: i agree that this must be the key.

In my solution i hooked CreateFileA ('cause opencomm isn't used by dialup nor by the fax application i'm using).

Thanks everybody,
acab

I'm also interesed in a linux and a hardware (i'm thinking about using a pic 12cxxx) workaround. Any suggestion?


Temporary topic for Disavowed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Temporary topic for Disavowed
PDA

View Full Version : Temporary topic for Disavowed

tsehp
11-08-2000, 02:14 AM
hi,
your actual email is not working anymore.
later,

tsehp
Epic
11-08-2000, 06:35 AM
regards.
_mac
11-08-2000, 11:21 AM
Hi Tsehp - confine seems to be fucked up.
No disa since days...
beginning to be worried.

greetz _mac
disavowed
11-08-2000, 12:08 PM
yeah, use disavowed@disavowed.net... forget the disavowed@confine.com address, as i doubt it'll ever work again. if for some reason disavowed@disavowed.net doesn't work (i just tested it, and it worked fine), then use disavowednet@hotmail.com as a last resort. keep in mind, i won't check the hotmail one too often.

for everyone interested, disavowed.net will reopen very soon. watch http://www.disavowed.net for updates
disavowed
11-08-2000, 04:20 PM
ok, http://www.disavowed.net now points to the new site

i think you'll all smile when you see who decided to host it :)


+Tsehp -- Search Engine ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > +Tsehp -- Search Engine ???
PDA

View Full Version : +Tsehp -- Search Engine ???

Clandestiny
11-08-2000, 01:56 PM
Hi +Tsehp,

I was recenly attempting to do a search using the local search engine indexing +fravia's and immortal decendents sites. My search was for protection schemes of apps written in Delphi and I seem to be getting many 404 not found errors. I got several interesting hits
including one of your essays...

Cracking using DeDe - first essay Published by Tsehp April 2000 Prologue: First of all I must thanks +DaFixer for magnificent tool which he made....URL: http://www.woodmann.net/CrkUDeDe.htm - size 10kb - 27 Apr 2000

Perhaps you are already aware of this problem, but I thought I would mention it anyway. Also, perhaps you could send me a copy of your essay ? The description sounded exactly like what I was looking for :-)

Thanks in advance...
&
Regards,
Clandestiny
tsehp
11-08-2000, 04:00 PM
Gosh ! I share now my account with a really nice guy : disavowed
that installed his personnal site. www.disavowed.net.
I had to move the mirror down a level and forgot to update the search
indexes :(
Start again you request, it will work now, if you still have problems,
mail me directly and I will send you the essay.
regards,

tsehp


Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations
PDA

View Full Version : Soft Tempest: Hidden Data Transmission Using Electromagnetic Emanations

cronos
11-08-2000, 03:53 PM
http://www.cl.cam.ac.uk/~mgk25/ih98-tempest.pdf

The future of protection schemes, and detection schemes starts here.
Epic
11-10-2000, 05:13 AM
.


Ou how nice.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Ou how nice.
PDA

View Full Version : Ou how nice.

Mostek
11-08-2000, 04:14 PM
It was long a go I stoped reading +F's board because useless taks. (Hm this one is probably the same, but I coudn't stand it.)

Well so when Tsehp invited me to the new one, I though AH. One or two weeks will pass and everything will be useless again. BUT man I was wrong.

It's quite nice 'here' again. No 'What are you doing here, ?$%$#%#$' and so on.

I must say Tsehp, your THE man of the year.

Well, nothing intersting, yes. You can delete it. If you want.

I just wanted to say, that I missed knowledge and peace in the board.

By

Peace
Mostek

P.S. Tsehp only one and a half sections to go. :)
tsehp
11-08-2000, 04:27 PM
Thanks mostek,
don't forget, I'm not alone on this. I was greatly helped by :
1-Carpathia that saved very fast the messageboard when itw closed the account.
2-Amante4 and sandman , they accepted to join this with me and
help me moderate this regroupment.
3-Woodmann for giving me this account since months, very fast without even knowing me, he's paying this account and really deserve
our gratitude
4-a guy that almost everybody wants to forget, responsible for reporting our activities, made the itw mb removed, and that finally motivated us to bring this result :D
5-all of you, great reversers and promising newbies that naturally
brings a *very* good ambiance in this place.

I was surprised to see how fast you get an answer to any related question you could ask here, I'm sure now that the good spirit is back,
and for a long time.

Best regards,

tsehp


Help needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help needed
PDA

View Full Version : Help needed

kingkaz
11-08-2000, 11:50 PM
I need some help on reversing the Algo on the backdoor thing on Fortres101. I found out where everything was and I tried to ripp the code and use it using inline assembler in C++ but it keeps crashing. If its possible can someone please download it and make a tutorial for making a keymaker for the backdoor thing with a guide explaining the routines I would be very greatful.

Thanks


To whom wants to crack flexlm.. :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > To whom wants to crack flexlm.. :)
PDA

View Full Version : To whom wants to crack flexlm.. :)

lmflexcrk
11-09-2000, 07:49 AM
Recently, I tried to find the license of the programs using flexlm. Every toos I own (5.x, 6.x, ...) are all done. So I am curious that whether I can solve all the programs (NT-platform) using flexlm?

I am very glad to help someone who wants the license of his program. However, I don't want my license to be distributed to others. So, if you want me to crack the license for you, you should

1. give me the physical address of your LAN card. (the license will lock on this hostid).
2. let me download your program (just for trying the license)
esther
11-09-2000, 09:29 AM
Hey you will definetely annoyed others this post bye
tsehp
11-09-2000, 12:29 PM
Sorry but your message is off topic here :
Crack requests are not accepted, but crack offers are useless on this
board. It's main purpose is to learn / teach rce.
I know you'll understand this point, just stop sending such messages here.
regards,

tsehp


No Code, Help!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > No Code, Help!!!
PDA

View Full Version : No Code, Help!!!

Hexon
11-09-2000, 02:04 PM
Hi all

I am trying to reverse a prog called AZPR ver 3.51 (Advanced ZIP Passwrd Recovery). The problem is evrytime I load the prog into W32Dasm or any hex editor, the code and data dissapear! All I get in W32Dasm is a few lines describing the code and data entry points, the trouble is when I jump there, there's no code listing shown at all - just a blank grey background.
Where the hell is the prog, there has to be one because it runs OK. Bye the way, Soft Ice sees the code, but I can't patch using Soft Ice.

Anyone know what's going on here?

Any help here will be greatly appreciated.

Thanks
Hexon
JimmyClif
11-09-2000, 02:30 PM
Hola,

Don't get me wrong or pick it up badly, but I just read your post on +Sandman's board and believe me 'no one' knows how to reverse AZPR only one hour after SoftIce has been installed for the very first time. ;)

AZPR is 'afaik' packed with AsPack or was it AsProtect (or am I in the woods?)? Which means you have to unpack it first before you can disassemble it with W32dasm.

Do a few more tuts first... soon you'll be ready :)

No hard feelings,
JimmyClif
tsehp
11-10-2000, 01:55 AM
to continue : you have to unpack it, by the way find the OEP, dump it
using icedump or procdump, then the IAT will be pointing to redirectors
or decryptors inside asprotect, so you can't disassemble this code correctly if you don't rebuild the IAT.
To learn how to do that, read some essays about asprotect, there is some on this site and interesting others at cristal's site :http://assembly.citeweb.net/

good luck,

tsehp
Hexon
11-10-2000, 04:21 AM
Thanks very much for the help +Tsehp, but I'm still a little confused. Firstly being a newbie i don't know what the OEP and IAT is?.
Also I've tried unpacking bit with AsProtect, but it does'nt seem to work! Maybe I have the wrong version.

A little more light on the subject would help. Hope I'm not becoming a nuisance, but I'm thirsty for knowledge.

Thanks
Hexon


still trouble. me stupid.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > still trouble. me stupid.
PDA

View Full Version : still trouble. me stupid.

NchantA
11-10-2000, 05:52 AM
hello again owl and tsehp+ (and g-rom :D)

ive RTFM on icedump, and have figured out the /tracex command, tsehp i have posted the routine above for reading, if u would like the target url, feel free to email me.

this is what i have tried:
use sice loader to load the normal.exe, after which the vbox screen pops up,
- set bpx on getprocaddress
I reasoned that since the .dll wouldnt be unpacked until after you press 'try', i would trace from there:
- set a /tracex imagebase imagebase+size
- a jmp eip
- f5, and dump file with peeditor(procdump seems to crash when dumping dll's attatched to active threads on my sytem ;))

needless to say this didnt work...any idea why? im going to try and figure out how to call/use hydra soon ;P

NchantA

thanx all
The Owl
11-10-2000, 03:35 PM
this is what i have tried:
use sice loader to load the normal.exe, after which the vbox screen pops up,
- set bpx on getprocaddress
I reasoned that since the .dll wouldnt be unpacked until after you press 'try', i would trace from there:
- set a /tracex imagebase imagebase+size
- a jmp eip
- f5, and dump file with peeditor(procdump seems to crash when dumping dll's attatched to active threads on my sytem ;))

oh-oh, now that would have surprised me if this had worked indeed ;-).

from my recollection on vbox 4.30, the nag/dialog is done from another process other than the target one, so tracing that would not make much sense (i think i told on the other thread that for vbox child process tracing was not needed, now you know why).

also, starting the tracer on a 'jmp eip' won't get you too far either ;-), unless you meant to patch in that 'jmp eip' after the tracer had winice pop up (fyi, it is not needed for /pedump, for external dumpers it is).

next, to have winice break in the correct thread (ie. the one that runs in your target process) you would want to use iceload as loader32 doesn't handle DLLs. also (based on my memory again) vbox plays with the section flags and makes softice unable to break on the (exe or dll) entry point but that should have been taken care of when you have icedump loaded.

so what you do is 'iceload -n target.dll' (to 'n'otify winice about the dll) and then start up your app, click the vbox nag, and next winice should pop up as the target.dll's DllMain gets called the first time. you then use /tracex, etc...
NchantA
11-12-2000, 05:35 AM
the_owl u are a genious. so are ur leet tools, i got that vboxed dll unpacked and it works perfectly, thanx alot u guys...

btw if u want a small tutor for tsehp.cjb.net or something so u dont have to keep telling idiots like me how to unpack a .dll file just say so ;)

NchantA
hz
11-12-2000, 05:48 AM
hi,
I think this would be a useful/interesting tutorial.
regards
hz


Problems!...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Problems!...
PDA

View Full Version : Problems!...

stanks
11-10-2000, 11:04 AM
Hi!

I have one problem in Win 3.1x. When i load a DOS proggy and when i try :task, Soft Ice tells me 'Error wlking task list'. And when i try :hwnd
it says 'Error wlking window list'. This is all happening with DOS programs. Why? How to correct this?

Greetz
esther
11-10-2000, 11:37 AM
Hi,
Task and hwnd are for windows progs not for dos proggies.
if you are using sice v2x,you have to load the prog in dos mode not windows
ldr proggie
regards
stanks
11-10-2000, 12:56 PM
thank you

greetz


Need a newer version of AsProtect decompressor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need a newer version of AsProtect decompressor
PDA

View Full Version : Need a newer version of AsProtect decompressor

Hexon
11-10-2000, 02:52 PM
Hi all

Does anyone know where I can get the latest version of a AsProtect decompressor/deprotector?

When I try to decompress my target (AZPR) I get the error message, unrecognised version!

I am currently using rAD v0.6 - (r!sc's Asprotect v1.1 Deprotector)

Any help greatly appreciated, thanks

Hexon
notme (risc)
11-11-2000, 10:20 AM
get caspr :o) SAC released it a few (or maybe one) day(s) ago..

dunno if it works with latest, but i should think it does, as sac released cracked ver of new azpr & clonecd recently aswell..

suddendischarge.com / protools.cjb.net might have it
Solomon
11-11-2000, 10:36 AM
SAC rocks!
notme (risc)
11-11-2000, 11:27 AM
http://sac.home-page.org/

:o)


How to know what a ASM instruction is in HEX
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to know what a ASM instruction is in HEX
PDA

View Full Version : How to know what a ASM instruction is in HEX

-[Z]-
11-10-2000, 04:52 PM
I know my english is poor:)

How to know what a assambler instruction is in hexadecimal?
If I want to know what INC EAX is in hexadecimal for instance. Whats the easiest way?

Where can I find a table with all instructions and what they are in hexadecimal?

Where can I find tutorials about programming directly i hexadecimal with a hexeditor? Like how you had new code to a program.
SV
11-11-2000, 03:42 AM
Try http://www.multimania.com/svtc/Progs/PentiumOpcode.exe

sv
The Owl
11-11-2000, 06:06 AM
damn, why do i need to fill in the message field? ;-)
Olga
11-16-2000, 03:40 PM
Try this too:
http://pasqualegalasso.interfree.it/Tools/phogptch.zip

String items are in Italian, but, anyway, it is not so hard to use, I guess.

Regards

Olga


Use an assembler ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Use an assembler ;-)
PDA

View Full Version : Use an assembler ;-)

Carpathia
11-11-2000, 01:12 AM
You can use softice to assemble your instructions into a *safe* area of memory. Assuming you have CODE ON, it will show you the assembled opcode alongside each instruction.

Beware of location dependant instructions like relative jumps; you should really temporarily assemble your new code into the location where you finally intend to patch them, unless you absolutely understand what youre doing.

If softICE isnt an option, you can use an editor like hiew, (possibly hex workshop too).

Assembling instructions by hand is a task usually reserved for bored and twisted old schoolers ;-) Let the tools do the mundane work.

Check out hutchs opcode viewer (also comes with MASM32): http://carpathia.cjb.net/opcodes.exe

Regards

Carpathia
carpathia
11-11-2000, 08:39 AM
incase anyone's wondering, this was supposed to be a reply to -Z-'s post about asm->hex. :-)
vgb
11-15-2000, 11:49 AM
I'm very rusty with assembler - was looking at some source code and saw
"invoke OpenClipboard,hinst". Have been unable to find INVOKE in any of the opcode references, can you shed any light? Is it essentially a CALL or am I misunderstanding something?

Thanx,

VGB
carpathia
11-15-2000, 12:36 PM
vgb (11-15-2000 01:49):
I'm very rusty with assembler - was looking at some source code and saw
"invoke OpenClipboard,hinst". Have been unable to find INVOKE in any of the opcode references, can you shed any light? Is it essentially a CALL or am I misunderstanding something?

Thanx,

VGB

Invoke is a MASM macro, which pushes the given parameters onto the stack and calls the function specified as the first parameter. It is exactly the same as making the call manually, with no extra overhead.

Regards

Carpathia
vgb
11-15-2000, 01:22 PM
Got it -

Thanx,

vgb


paint shop pro 7..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > paint shop pro 7..
PDA

View Full Version : paint shop pro 7..

Spekkel !
11-11-2000, 07:23 AM
w32dasm craches at the moment it will make the disassemble listing, so it does the pre-disassembling,the jumps and calls and then it craches !! what could here be the problem ?????

( yes i know about ida...)

Thanks, SpeKKeL
?ferret
11-12-2000, 12:11 AM
There are several ways to do this...

Here's the one I've run into quite a bit.

Does it crash WHILE processing the jumps?

if so, look for say...

401000 JMP 402000
402000 JMP 401000

or the like....w32dasm hates infinite loops, it will keep processing those 2 jumps til it runs out of resources and crashes.
?ferret
11-12-2000, 12:15 AM
One more note:

That's why IDA works on most proggies that crash w32dasm....

W32Dasm starts at the beginning of the file and processes from there.

IDA starts at the program's entry point.

Since the jumps never actually get executed when the program runs...IDA doesn't worry about them
hobgoblin
11-13-2000, 04:47 PM
There is a simple way to get W32Dasm to disassemble Paint Shop Pro 7. Run the “psp.exe” in W32dasm. After a while you will get an error message ( I think you have seen it..) saying something like “.......an error occured in modul w32dsm89.exe at 0177:004164D3”.
Now, when you open up and disassemble W32dasm itself and go to the address pointed to in the error message, you will see this:

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004165B9(C)

:004164C4 8D04BF ea eax, dword ptr [edi+4*edi]
:004164C7 8D04C0 lea eax, dword ptr [eax+8*eax]
:004164CA 69D668040000 imul edx, esi, 00000468
:004164D0 8D0CD3 lea ecx, dword ptr [ebx+8*edx]
:004164D3 0FB784010A126400 movzx eax, word ptr [ecx+eax+0064120A]

If you go to the adress where this code was referenced from, you will see this this:

:004165B7 3BFA cmp edi, edx
:004165B9 0F8205FFFFFF jb 004164C4
:004165BF 46 inc esi

Take notis of the conditional jump at 004165B9. Open up the Softice loader and run W32dasm. Put a bpmb 004165B9 x at the Softice commandline and exit. Now try to disassemble the file “psp.exe” in W32dasm. When Softice finally breaks, just nop out the instructions at 004165B9, and then exit Softice. W32dasm will then disassemble the file as normal. But you will have a quite large file to work with, the size will be about 93 megs big if I remember it correctly......:-)
the snake
11-16-2000, 12:15 AM
Hi Hob
Nice to see some "old" friends around..
How is life ? is evrything ok with ya ?
still reversing as before ?

take care
he snake
hobgoblin
11-17-2000, 10:47 AM
Hi Snake::-)
How are you doing? It's been quite awhile, that's for sure. I've been really busy IRL for quite a while (work, new girlfriend, responsibilites....).but I'm checking in every now and then to see what's going on. Haven't been too busy reversing lately (got pretty tired of the Asprotect discusssion too, actually). But you know how it is: Just have to do something.LOL.
So what's up in your part of the world? Still interested in keygen making? Or have you changed your prefernced field of interest?


If my proggie...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > If my proggie...
PDA

View Full Version : If my proggie...

Petroff
11-11-2000, 12:59 PM
...doesn't break on getdlgitemtexta, getwindowtexta (nor their 16 bit equivalents), hmemcpy, wm_gettext and manages to send me a nice messagebox (which isn't created using standard API) that says it was wrong serial I entered what can I do? When I bpx on wm_lbuttonup from msgbox I land in msg loop without useful jz/jnz instructions above. Register nag is created using Dialogboxindirectparama and it is possible to disable it but unfortunately without benefits (there are registered user flags for sure). So besides theese metods mentioned above which is the other way an author can copy entered serial in memory ? Of course there are no useful stringrefs. Any ideas from you guys?
carpathia
11-11-2000, 03:14 PM
The message dialog must be created using API somewhere along the line. Have you tried the CreateWindow series of API ? If you get desperate I'm sure you'd break on ShowWindow. Trace back from where the message dialog is shown or created.

If this still doesnt work, perhaps you could try placing a bpm on the API's youve tried to bpx on. If the first instruction or block of instructions were to be copied from the body of the API, to the application memory, executed, and then a jump made into the centre of the API call, it could be possible to execute the API without it ever hitting the address of the API entry point. This is unlikely, but something to bear in mind.

Also, if youre still stuck, by all means, post the url to the app.

Regards

Carpathia
rg_
11-11-2000, 03:23 PM
[b]Register nag is created using Dialogboxindirectparama and it is possible to disable it but unfortunately without benefits (there are registered user flags for sure).

Hi
one of the parameters of DialogBoxIndirectParamA is the offset of the DialogProc the dialog uses. Get it and you can start searching there.

Regards
tola
11-12-2000, 11:37 AM
Petroff (11-11-2000 02:59):
...doesn't break on getdlgitemtexta, getwindowtexta (nor their 16 bit equivalents), hmemcpy, wm_gettext and manages to send me a nice messagebox (which isn't created using standard API) that says it was wrong serial I entered what can I do?
you may also try this: enter your fake serial, search for it in memory (you'll find it somewhere above 80000000h) and set a breakpoint on that memory location.


Thanks 4 the help guys (Solomon, Notme (risc)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Thanks 4 the help guys (Solomon, Notme (risc)
PDA

View Full Version : Thanks 4 the help guys (Solomon, Notme (risc)

Hexon
11-11-2000, 06:04 PM
Thanks very much for recommending caspr from Sac, I'm about to download it and give it try.

Thanks again
Hexon


DDB help .. please!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DDB help .. please!
PDA

View Full Version : DDB help .. please!

SV
11-12-2000, 06:47 AM
Hi reversers

I have found this part of code.

mov eax, 2Ah
VMMcall Get_DDB
mov ecx, [ecx+38h]
add ecx, 0B0h

Please, i need some more description of DDB structure.
Thx SV

Get_DDB
include vmm.inc

mov eax, Device_ID
mov edi, Device_Name
VMMCall Get_DDB
mov [DDB], ecx

Determines whether or not a VxD is installed for the specified device and returns a DDB for that device if it
is installed. Uses ECX, flags.
Returns a DDB for the specified device if the function succeeds; otherwise, returns zero.
Device_ID
The device identifier. This parameter can be zero for name-based devices.
Device_Name
An eight-character device name that is padded with blank characters. This parameter is only required if
Device_ID is zero. The device name is case-sensitive.
The Owl
11-12-2000, 09:07 AM
mov eax, 2Ah
VMMcall Get_DDB
mov ecx, [ecx+38h]
add ecx, 0B0h

Please, i need some more description of DDB structure.

vmm.inc from the DDK has the full definition, IDA recognizes it too, or vxdn.inc from icedump. at offset 38h you have the win32 services table pointer, the table is a structure, first dword contains number of elements that follow thereafter. each element has two dwords, one is a function offset, the other is the number of parameters used. win32 services exported by a VxD can be called from user mode by using kernel32.vxdcall (documented by pietrek for example).
garph0
11-12-2000, 11:22 AM
In case you'll need...

i think Kernel32.vxdcall has no exported name, but it's exported as function #1 from kernel. If you want an example i think tha BO2k uses it when it hides the process under win9x.
you can get bo2k at sourceforge.net


Where can I find CD-Check CrackMes ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Where can I find CD-Check CrackMes ?
PDA

View Full Version : Where can I find CD-Check CrackMes ?

-[Z]-
11-12-2000, 06:52 AM
Where can I find CD-Check CrackMes?
NchantA
11-12-2000, 10:26 PM
im pretty sure r!sc had/has a couple of crackme's like that on his site:
http://csir.cjb.net

also try crackmes.cjb.net or crackme.cjb.net

cant remember if they up or not ;)

NchantA


New ASProtect again ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New ASProtect again ?
PDA

View Full Version : New ASProtect again ?

gAnZ
11-12-2000, 07:17 AM
Here is the target
http://www.softpointer.com/tr.htm
gAnZ
11-12-2000, 11:30 AM
Pandesal (11-12-2000 01:15):
CASPR worked fine with this baby ;-)

What version you have used ?
0.930 seems not to produce working EXE ...
gAnZ
11-12-2000, 11:34 AM
Pandesal (11-12-2000 01:15):
CASPR worked fine with this baby ;-)

What version you have used ?
0.930 seems not to produce working EXE ...
SV
11-13-2000, 04:39 AM
Hi

Why it doesn't work.
Look at entrypoint code.
At 0053D6F4 there is a indirect call. As you can see
with asprotected exe, in this call you land at 0125c540
and at this location the real call is done (53ce54).
Some generic unasprotecter doesn't save in exe offset 54341c
because it's a bss section (offset 142000 virtual size 2000
raw size is 0).
Solution is to patch this location before entering EOP or
to build an exe with this section and replace 40c52501 with 54ce5300.

regards SV

EAX=00000000 EBX=006F0000 ECX=00000000 EDX=00000000 ESI=816443B0
EDI=00000000 EBP=007FFE38 ESP=007FFE2C EIP=0053D6F4 o d I s Z a P c
CS=015F DS=0167 SS=0167 ES=0167 FS=33C7 GS=33CE DS:0054341C=0125C540
-----TAGRENAME_ORG!+141C--------------------------byte--------------PROT---(0)--
0030:0054341C 40 C5 25 01 00 00 00 00-00 00 00 00 00 00 00 00 @.%.............
0030:0054342C 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0054343C 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
-------------------------------------------------------------------------PROT32-
015F:0053D6CD 8BEC MOV EBP,ESP
015F:0053D6CF 83C4F4 ADD ESP,-0C 
015F:0053D6D2 B88CD15300 MOV EAX,0053D18C
015F:0053D6D7 E80897ECFF CALL 00406DE4
015F:0053D6DC A17C185400 MOV EAX,[0054187C]
015F:0053D6E1 8B00 MOV EAX,[EAX]
015F:0053D6E3 E838F3EFFF CALL 0043CA20
015F:0053D6E8 A1981A5400 MOV EAX,[00541A98]
015F:0053D6ED 8B00 MOV EAX,[EAX]
015F:0053D6EF E8E0FDF2FF CALL 0046D4D4
015F:0053D6F4 FF151C345400 CALL [0054341C] <----This indirect call
015F:0053D6FA A17C185400 MOV EAX,[0054187C]
015F:0053D6FF 8B00 MOV EAX,[EAX]
015F:0053D701 BA24D75300 MOV EDX,0053D724
015F:0053D706 E819EFEFFF CALL 0043C624
015F:0053D70B A17C185400 MOV EAX,[0054187C]
015F:0053D710 8B00 MOV EAX,[EAX]
015F:0053D712 E8A1F3EFFF CALL 0043CAB8
015F:0053D717 E8F863ECFF CALL 00403B14

EAX=00000000 EBX=006F0000 ECX=00000000 EDX=00000000 ESI=816443B0
EDI=00000000 EBP=007FFE38 ESP=007FFE28 EIP=0125C540 o d I s Z a P c
CS=015F DS=0167 SS=0167 ES=0167 FS=33C7 GS=33CE DS:012625C0=0053CE54
--------------------------------------------------byte--------------PROT---(0)--
0030:012625C0 54 CE 53 00 00 00 00 00-00 00 00 00 00 00 00 00 T.S.............
0030:012625D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
-------------------------------------------------------------------------PROT32-
015F:0125C53F 90 NOP
015F:0125C540 833DC025260100 CMP DWORD PTR [012625C0],00 
015F:0125C547 7406 JZ 0125C54F
015F:0125C549 FF15C0252601 CALL [012625C0]
015F:0125C54F C3 RET
gAnZ
11-20-2000, 10:00 AM
Hey!
Thanks for your reply, but it was clear to me.
My question actually was about VERSION of ASProtecct.
rAD sayed that it is unknown.
(but it could actually unhook this hook :)
CASPR is newest deprotector, so I've decided that it must understand such tricks and fix'em.
But I was mistaken.

So,so.....
Some work with loaded BRAIN.SYS(.VXD) never can be superfluous after any automatic engine :)

Good Luck !


Tutz about menu enabling?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Tutz about menu enabling?
PDA

View Full Version : Tutz about menu enabling?

Inst
11-12-2000, 04:00 PM
Where can I find:
tuts about menu item enabling?
I take 'Notepad.exe' and disable with
'Exescope' the 'Save' and 'Save under' menu item.
How can I patch this, to re enable the items?

Thanx
carpathia
11-12-2000, 05:10 PM
Well of course there would be nothing stopping you reopening ExeScope and enabling the menu items.
Most exe's wouldnt rely on the resource template to disable the menu items though. A more common way is to disable the menu item at run time, using the EnableMenuItem API.

Also, read Spath's comprehensive essay at

http://www.woodmann.net/fravia/menusspa.htm

Theres still so much knowledge at Fravia's, its a shame people still dont bother checking it as a course of routine.

Regards

Carpathia


Thxs men !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Thxs men !
PDA

View Full Version : Thxs men !

SV
11-13-2000, 11:28 AM
Sorry, this post was for DDB thread !
Thanks to The Owl and garph0.

SV


Adding some tracing features to a c++ program (iat rebuilder)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Adding some tracing features to a c++ program (iat rebuilder)
PDA

View Full Version : Adding some tracing features to a c++ program (iat rebuilder)

tsehp
11-14-2000, 07:00 AM
Hi,
I would be happy if g-rom, owl or people that already did such a program could help me a little.
I would like to add to my current iat rebuilder some tracing features,
I call a function, giving it the address to start the trace and a mem
address start and end to stop it, the goal is to intercept the exact
address where the traced process lands, but I can't force the process itself to be traced, my program must trace the code by itself...
Do I have to code a device driver on ring 0 ? Is there already made sources available ? TIA

tsehp
The Owl
11-14-2000, 01:21 PM
I would like to add to my current iat rebuilder some tracing features,

did you consider other options as well? eg, initially you may get away with decoding instruction lengths only, recognizing specific instructions, all without actually executing anything. of course i don't know your goals and why you chose the tracer idea, but you may want to give this a try as well. z0mbie.cjb.net has a nice package called LDE for this purpose (e.g. one of the example Hydra plugins in icedump uses it, enough for peshield and some asprotect API obfuscation).

but I can't force the process itself to be traced, my program must trace the code by itself... Do I have to code a device driver on ring 0 ? Is there already made sources available ?

by 'process'/'program' i assume you referred to 'thread' which is the executable 'entity' in win32. now, further interpreting the above (feel free to clarify it yourself btw), what you meant probably is that you don't want to start up the target app but instead want to execute its code somehow in your own process, eg. by loading it somewhere in your process' address space and starting a new thread (under the tracer's control). this is indeed possible and would actually result in what i could best describe as the user mode equivalent of icedump's tracer engine.

what you will have to do is roughly this:

1. implement a state machine like icedump's tracer and have it gain control on each single step exception that will occur in the traced thread. you can achieve this by ensuring that the engine's main entry point is always the first Structured Exception Handler in the traced thread. this means of course additional emulation for code that installs its own SEHs (something i didn't have to bother with in icedump).

2. to use the tracer, you'd create a new thread in suspended state, change its context so that single step exceptions would be enabled in it and by grabbing its FS, you have to install your engine's main entry point as the thread's first SEH (the emulation i mentioned will later ensure that it always remains the first handler thereafter). then you resume the thread and let the tracer carry out its job.

3. terminating the tracer will be easy once you got all the above to work, eg, you can do a simple range check for EIP in your engine's main function (which gets called on each single step exception), much like icedump's tracer does it.

now, having said all this, let me address a few points. first of all, this is a very interesting project with lots of potential, i beleive you didn't fully realize it when you asked your question ;-). one advantage of it would be that it would work under both win9x and NT as it would be pure user mode code. the drawback of it will be of course its speed, you can expect it to be between 10-100 times slower than icedump's tracer. this is not a tragedy per se, as long as you don't want to trace hundred million instructions ;-). so, my suggestion is that you study and understand how icedump's tracer works (at least the state machine part, how it interfaces to the win9x kernel or softice is less important for now), then implement it in c++. i will be available for help but don't expect me to do it for you, simply no time for this undertaking (you can expect to spend a 'man-week' or two to get all this to work).
tsehp
11-14-2000, 01:40 PM
thanks owl for your reply, I have previously seen the icedump's sources, sound a little complicated for me at first glance, but tha'ts ok.
My purpose is to fix the modified IT's by asprotect (and other's) scheme.
I first look at all the good api's addresses and remove them from test.
Then the bad adresses are traced, and I just look where they land into
all the addresses belonging to all the modules loaded by the app, then
we rebuild the iat. I'll check the site you told me and report of my progress.
Thanks a lot !

Tsehp
tsehp
11-16-2000, 04:11 PM
hi artha,
thanks also for your reply, I think your way will be much more easy to handle for me. Icedump's powerful tracing features are good when you go live debugging, but my app just wants to trace the asprotected application. I have anyway two big problems :
1-I can't use the app's thread context and trace it, I could find it's
first encrypted/redirected thunk, but it will crash just after.
2-If I use nasm disass to scan every thunk, I could find redirected jumps but If I encounter a decrypting scheme, that's gonna be more than difficult.

I have to finish pretty soon the easy iat rebuilding part of my app, then I'll start the tracing part, I'll tell you about my progress.
best regards,

tsehp
G-RoM
11-17-2000, 06:43 AM
In his reply to ur question, Owl suggested at first u use a LDE (Length Decoder Engine) for opcodes. Tracing wrapper and so on is a nice idea/concept BUT if u don't have a powerfull emulator/tracer you will get detected/fucked at some stage. Trust me I know of what I am talking about :).

WIN32 API system is easy to use, however highly detectable and fucking SLOW. So would be a step by step with a SEH... now up to you to know how reliable and fast u wanna be... and if it is worth the job :).

Cheers,
G-RoM
tsehp
11-17-2000, 02:08 PM
ok, considering all the answers I had for my project, no doubt, I have to work at the deepest level possible. I don't want to code something to scan for special opcodes like redirecting jumps and anything depending of the protection scheme, this could be easily defeated in the future ;)
So , I load and start the target into my tracer's mem context, setting
the seh to it's main entry point (owl's option), but I don't want to use
it's entry point, only the iat's redirected/encrypted adress points I have to trace. I put on the single step mode, and check if the eip belongs to every possible addresses I have to fix (dependant module's
exports), and when this occurs, they are logged and fixed inside the target's iat. Teh target's thread will crash after going into the api export, what can I use to fix this ? A general exception handler to get back into my tracer and fix the next iat entry ?
TIA,

tsehp
Spath.
11-20-2000, 01:10 PM
> In this example my code only retrieves
> few handles (the dll's handle) so that I can
> use WriteProcessMemory() on it.
> Why not using GetModuleHandle() you
> could say ? Because GetModuleHandle()
> only works for the current Process.

You can retrieve module handles without
injecting code with ToolHelp functions, see
PSDK's GetProcessModule() code.

S.
G-RoM
11-20-2000, 04:37 PM
I may add u can use too PSAPI (NT), and may be VirtualQueryEx :). And this is only to get a modulehandle from a foreign context.

There are several way to do in memory context patching without r0... some are however OS dependant (9x have bunch of shit non swappable).

I will never need a tutorial on how to do a thing linked with memory context patching and especially in C++... And frankly I never used and trusted tutorials : I try, debug, and so on which is lots more educationnal. Spreading knowledge with tutors is not always alright imho.

Cheers,
G-RoM
G-RoM
11-21-2000, 04:42 AM
I mean several things :

- Some "tutors" are full of bullshit.
- Some people use them as a tv guide... they don't think they just apply.
- Some tutors are inacurrate and can introduce bad habits.

Hence some tutors shouldn't exist as they are not helping at all or even confusing people... And some people shouldn't have access to them since after they think they know something and create more tutors that are full of bullshit.

I tend to go to the method which give advices/hints/informations but NEVER a fully detailed solution coz this is too easy and people forget to use their brains. Discovered knowledge will always remains... especially if it was hard to get :).

This is my opinion, may be some people thinks like me, some will say I am an "elitist" or even someone who don't want to share knowledge. In fact, I just want to have people with brains because I tend to think more people and more people forget what it is.

Cheers,
G-RoM
tsehp
11-22-2000, 04:20 PM
ArthaXerXes (11-19-2000 18:59):
I though this experience could give you some idea. Also I am not quite certain about what you mean by tracing IAT or "not being able to follow a jump". That is damn easy really, it took me only two hours to adapt NASM disasm to Imhotep, and believe me, there was serious incompatibility between my well organized C++ code and the messy C NASM code.

Create a class that encapsulates NASM rather than directly adding the code into yours. If I recall well, I have a class "instruction" which has got some methods and fields to get the size, operands, etc. of an instruction and another class that is a set of instructions, i.e. the code to desobfuscate. I also have another class that does the desobfuscation.

mmm... What a long post, I should go back to work now, I am having a nice fight with DirectX8... :-/

Hi artha (and others) I've been very busy finishing the first part of my iat rebuilder, it's almost finish now and I will soon add it the tracing features. Artha, you're talking about using nasm to disassemble the target, to see where it goes, starting from it's iat. I'm just afraid of one thing : encryption and very long routines if some protecting wrappers redirects the addresses into itself, I didn't had the time to
see how imhotep works but understood that you use disassembling.
My purpose is to be able to trace the program, just like you do in softice : you force the target to jump at the iat address and put a bpr
on himem, just to see where it goes, then you have the api entry, and deduce it's name and module. I don't know if you can solve this problem with encapsulating nasm and using it but g-rom's solution seems much complicated to implement but surely closer to the result I have to get, maybe you have another solution to what he used inside
icedump.
I'll be back soon when I'll get into this coding part, best regards,

Tsehp
tsehp
11-29-2000, 03:49 PM
Ok the beta is finished, now the real work begins, it's gonna take some time and I want to be sure to choose the right option.

1-Using a lde, disassembling every iat address not resolved could solve
easily some simple code, like redirect jumps, but when you meet a decryptor that leads you to the api export, it's very hard to program and too much dependent of asprotect coding

2-Using a tracer, I force the protected app to visit every iat not resolved, it finally lands into the api export and could crash before/after this point, do I have to implement another SEH to go back
and trace the other unresolved iat's ? I have to try the icedump's tracer to see if it solve this in another way...

3-last idea : log every api export call while it's coming from the target,
I can redirect every api export from every module depending from the target, test the caller and relink the iat while looking at the caller's origin, the drawback is that you have to use the program while it's logged, hoping that all the imports will be called and logged.

I just don't know at this point if someone have an original idea about this, just asking.

regards,

Tsehp


Looking for "The Art Of Assembly"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Looking for "The Art Of Assembly"
PDA

View Full Version : Looking for "The Art Of Assembly"

xOptiMus
11-17-2000, 02:26 AM
Hi all

Does anyone know where I can download "The Art OF Assembly", I saw it somewhere once but think where now!

Hope someone can help

Thanks
xOptiMus
Carpathia
11-17-2000, 03:08 AM
http://webster.cs.ucr.edu/Page_asm/ArtofAssembly/zips/

or browsable html at:

http://kanaima.ciens.ucv.ve/ArtofAsm/artofasm.html

enjoy :)

Carpathia
xOptiMus
11-17-2000, 04:08 AM
Thanks very much Carpathia, I knew I'd seen the damn thing somewhere!

Happy reversing
xOptiMus


daemon tools against safedisc on win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > daemon tools against safedisc on win2k
PDA

View Full Version : daemon tools against safedisc on win2k

gluni
11-17-2000, 03:17 AM
i tried them on win 2k against safedisc from birth of the fed and it didnt work, neither did unsafedisc or pedro.

any suggestions available.

thx
risc
11-17-2000, 11:29 PM
a: learn to crack
b: learn to code & crack
c: play with your original cd
d: get a life and sell your pc (a life? i could live for 2 days with the cash from my pc :)
e: there is no 'e' (i took it! (yum yum))
f: download 100 cracks for botf from various sites and test them all on your pc. maybe u will get lucky..
g: get win9x for playing games, it isnt as fussy about badly cracked / unwrapped exe's ...

you want anymore suggestions, just ask, ok :d


[b]Help with ASM Instruction Please![/b]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > [b]Help with ASM Instruction Please![/b]
PDA

View Full Version : [b]Help with ASM Instruction Please![/b]

xOptiMus
11-17-2000, 11:33 AM
Hi there,
Can anyone explain what "MOVZX" actually does?

I know what MOV does. So what is the difference between MOV and MOVZX?

Hope someone can help

TIA
xOptiMus

PS Can't get the hang of them Code tags for bold, underline etc!
cronos
11-17-2000, 12:05 PM
movzx is move with zero extend. it moves a reg or memory operand into another reg with more bits, extending the result with zero bits. So:
movzx eax,ax
where ax=0ffh means eax=0ffh after the instruction, or to make this a bit clearer, if eax=12345678h before the instruction then eax=5678h afterwards.

movzx eax,[400000]
means eax= the byte from [400000] but eax is 32bits, so the other bits become zero

You also have
movzx ax,al
movzx eax,al
etc, where 8 bits are moved into 16/32 and the rest become zero.

or in a 16-bit segment
movzx ax,ds:[0100]
etc

finally, contrast this with movsx which sign extends the item rather than zero extending it.

So
movsx eax,ax where ax=1 gives eax=1
movsx eax,ax where ax=0ffh gives eax=0ffffffffh (ie where ax=-1 gives eax=-1)
xOptiMus
11-17-2000, 01:43 PM
Hi Cronos

Thanks for explaining the MOVZX instruction, I understand now.
However, I don't see the difference between MOVSX and MOV: surely

movsx eax,ax where ax=1 gives eax=1

is the same as

mov eax, ax isn't it? or am I wrong?

xOptiMus
cronos
11-17-2000, 07:27 PM
in that case yes, but in other cases:
movsx eax,ax where ax=0f123h gives eax=0fffff123h

and
movzx eax,ax where ax=0f123h gives eax=0f123h


Laz's vb5 dll patch?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Laz's vb5 dll patch?
PDA

View Full Version : Laz's vb5 dll patch?

4oh4
11-17-2000, 03:41 PM
Anyone know where I can dl Laz's msvbvm50.dll patch?

--4oh4
4oh4
11-18-2000, 11:42 AM
The tool I am referring to is a patch that Lazarus made which allowed you to "configure" msvbvm50.dll. Once patched, vb5 compare functions would invoke a messagebox prompting the values for the compare and ask which value to pass back.
I just moved and my computers are being shipped and won't arrive for another couple of weeks. All I brought with me is my laptop, and this patch would come in pretty handy for an app I'm reversing. Laz's page seems to be down, along with HellForge's. Anyone know of another location?

--4oh4
2nEw
11-18-2000, 12:43 PM
I have Lazvb (great tool)if you have an e-mail addy I could mail it to. 2nEw
4oh4
11-18-2000, 05:34 PM
That'd be swell of ya 2nEw.

4oh4@excite.com

--4oh4


Check out the new Sudden Discharge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Check out the new Sudden Discharge
PDA

View Full Version : Check out the new Sudden Discharge

The Archivist
11-17-2000, 10:19 PM
http://www.suddendischarge.com
now with:
complete archives
descriptions (coming slowly)
new categories
alternative platforms (linux, os/2, etc.)
forum
search
and more

Stop by and let us know what you think

Bug reports, new version, old versions, suggestions, praises and criticisms welcome
tsehp
11-19-2000, 05:55 AM
Congratulations ! Great front page and good site organisation.
Just one thing, I didn't saw a *useful links* section. If you make one,
thanks to put a link back for this messageboard :) you already have a link pointing to your site below :)
Epic
11-19-2000, 02:48 PM
My compliments.

Epic
The Archivist
11-19-2000, 07:10 PM
if we put up a link page, I'll be sure to include this message board ;)
the snake
11-20-2000, 10:54 AM
Hi people,
Nice to see the new "drees" of the new site..
The pages load faster then in the old site, but i like them both :)

Regards
the snake
the snake
11-20-2000, 10:59 AM
Sorry, 'dress', not 'drees'


Flexlm & REA*V*Z
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm & REA*V*Z
PDA

View Full Version : Flexlm & REA*V*Z

bubba1
11-17-2000, 11:46 PM
Anyone know what type of encryption they are using, checkout, vendor defined?
Nolan Blender
11-20-2000, 11:30 PM
bubba1 (11-17-2000 13:46):
Anyone know what type of encryption they are using, checkout, vendor defined?

user defined crypt filters. Watch lc_set_attr
and you'll see what I mean.

I'm working on an essay for this.
Erovin
12-06-2000, 05:56 PM
NB, I look forward to your essay. I've been working on a target that has a 30-day trial limit imposed on it with FlexLM. I found out that even IF I am able to generate a new license.dat file it is still crippled to some degree, but the actual target itself is no longer my primary goal. Instead I have this need to just figure out how to do it (gen a new license file).

I read your essays as well as those by Pilgrim and VoxQ(?) and Dan(?) - everything I could find at Fravia basically. The target I'm working on uses FlexLM version 7.0 and Globetrotter has no developer downloads available for v7. Is there a repository somewhere to get older versions of their libraries, source examples, DLLs, etc.? I see how the different versions of FlexLM are evolutionary and how many techniques from one version are still applicable in newer versions. I found lc_init and lc_sg statically linked inside my target (thanks to the essays) but I have no idea what other routines like lc_checkout look like when disassembled. Also looking for genkey or genkey32 utilities. Not sure if these are Globetrotter utils or if they are developed by the community.

Thanks for all the good work.
Nolan Blender
12-07-2000, 11:23 AM
Erovin (12-06-2000 07:56):
NB, I look forward to your essay. I've been working on a target that has a 30-day trial limit imposed on it with FlexLM. I found out that even IF I am able to generate a new license.dat file it is still crippled to some degree, but the actual target itself is no longer my primary goal. Instead I have this need to just figure out how to do it (gen a new license file).

Certain targets (most notably the MAPLE trial) are disabled in some way, and the
relevant routines are missing, and the DLL's
are a special version for the trial, so getting
a full working version from the trial is not
possible.

I read your essays as well as those by Pilgrim and VoxQ(?) and Dan(?) - everything I could find at Fravia basically. The target I'm working on uses FlexLM version 7.0 and Globetrotter has no developer downloads available for v7. Is there a repository somewhere to get older versions of their libraries, source examples, DLLs, etc.?

If you look at zencrack2.cjb.net, I believe
that Crackz' has much of the relevant kits/tools
available.

I see how the different versions of FlexLM are evolutionary and how many techniques from one version are still applicable in newer versions. I found lc_init and lc_sg statically linked inside my target (thanks to the essays) but I have no idea what other routines like lc_checkout look like when disassembled. Also looking for genkey or genkey32 utilities. Not sure if these are Globetrotter utils or if they are developed by the community.

Thanks for all the good work.

Hmm - I think genlic is supplied by Globetrotter, but really lmcrypt is the
tool of choice for generating licenses.

--nb.
Erovin
12-08-2000, 05:15 PM
Maple. LOL! You must be a mindreader!

Thanks for the response. I happened upon CrackZ's page a couple of hours ago. I had bookmarked it weeks ago but whenever I need to find out something I seem to automatically go to the search engines without reviewing my bookmarks. Gotta stop doing that. Thanks again for the response. That site is definitely one of, if not THE best FlexLM site for reversers.


New essay on cryptography
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New essay on cryptography
PDA

View Full Version : New essay on cryptography

BlackB
11-18-2000, 08:04 AM
Hi there. I wrote a new essay on cryptography. It's a personal interpretation of an article i've read on cryptography in the scientific magazine EOS. You can read it on my site: http://blackb.tsx.org, in the security section in the right column.
Later on, my essay will be available on this site ;)
Plz send me your opinions, so i can improve the essay, or publish additional notes other people send me.

Greetz

BlackB
The owl
11-18-2000, 02:04 PM
you may want to check this out too (for RSA basics, good introduction to newbies).
BlackB
11-19-2000, 04:56 AM
The owl (11-18-2000 04:04):
you may want to check this out too (for RSA basics, good introduction to newbies).

that doc. 's really good. i think i'll publish it on my site.
thx ;)

greets

BlackB
tsehp
11-19-2000, 05:46 AM
The owl (11-18-2000 04:04):
you may want to check this out too (for RSA basics, good introduction to newbies).
Considering the pressure I have here, I had to publish it on the mirror too :D
It's really a good one,maybe someone could send a related one if he managed to reverse this kind of annoying protection :

In asprotect (again I know...) you can encrypt part of app by putting
some delimiters inside your source, compile it and asprotect will encrypt your code between those delimiters. Then the key to decrypt
is feeded by a reg entry or text file that is provided when you buy the license.

IMHO, nobody managed to reverse this, I know it's elliptic curve encryption scheme, I don't even think about bruteforcing this, I'll die
before my poor amd 600 will ever manage to decrypt a single instruction of code. This seems again an impossible task to do, except buy buying the license and dumping the decrypted code inside the unprotected target.
The+Q
11-20-2000, 09:19 AM
Have a look here:
http://members.aol.com/jpeschel/algoritak.htm
and grab ""Block Ciphers and Cryptanalysis",
by Fauzan Mirza, its a very interesting and well
written paper about block ciphers.

Have fun ;)


CD copying hardware protection?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CD copying hardware protection?
PDA

View Full Version : CD copying hardware protection?

dELTA
11-20-2000, 05:25 AM
A while ago I read that "they" were going to start putting hardware copy protection support into CD-writers, and if I recall it right it was about to happen pretty soon.

Anybody know if they already do it, and in that case which brands have it and which haven't this far?


NT internals questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > NT internals questions
PDA

View Full Version : NT internals questions

exit
11-20-2000, 07:07 AM
I post this message to forum some days ago, but forum still write 20 messages but there are 21. Maybe it is interesting.

What are the methods to access the debug registers under NT ? How
reliable is GetThreadContext() (for dr) ?
See http://elicz.com/infos/SEHall.zip

How do you "switch" to kernel mode (ring-0), more or less manually,
without using a driver (sys) ?
See http://elicz.com/export/DumpXDT.zip

Or if you interesting about debug breakpoints you can read:
See http://www.anticracking.sk/Articles/How_working_with_debug_breakpoints.txt

Exit


Vbox 4.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Vbox 4.5
PDA

View Full Version : Vbox 4.5

lucita
11-20-2000, 07:35 AM
Today, i've found my cracking limit: vb0x 4.5.
Anyone ever tryed it?.
its very hard to crack, bcoz it uses some strange protection. If u make a loadlibrary of any vbox dll, those damn vbox screen appears, so all dll's are wrapped.
GM
11-21-2000, 01:36 AM
What app did you find that was vbox 4.5 wrapped ?
solomon
11-21-2000, 08:18 AM
Maybe it checks the debugger in DllMain( ) ?
There is a prog named Visual SlickEdit v5.0(www.slickedit.com), which is packed with VBOX 4.3. It will say "xxxx.dll can't be initialized" if SoftICE or W32Dasm detected. eGIS/CORE has made a keygen for it.
NchantA
11-22-2000, 08:47 PM
this is the exact program i had a post on earlier about the vbox help...at the time i managed to unpack the dll and it worked well, but i think it was a fluke because i cant do it again doh ;/

im still experimenting with icedump on it...i think unpacking the .dll will be nicer, as it wouls speed up loading ect...

NchantA
lucita
11-22-2000, 11:43 PM
The program is Visio2000. And there is no unwrapper for Vbox 4.5.
tsehp
12-04-2000, 04:00 AM
I'd like to give it a try with the tool I'm finishing, the app can only be ordered via a trial cd, is it possible for your to upload the app here if it's not to big ? Email me directly if you want to.
lucita
12-04-2000, 04:44 AM
All the proggy its too big for my connection (28.8), but i can send u a couple of dll's wrapped with vbox 4.5
tsehp
12-04-2000, 09:59 AM
sorry it's useless for my unwrapping technique.
I use to remove those dll's and I can't test the protection if I don't have the launcher.


Help with breakpoint on RegQueryValueA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with breakpoint on RegQueryValueA
PDA

View Full Version : Help with breakpoint on RegQueryValueA

xOptiMus
11-21-2000, 11:10 AM
hello all

I need to set a breakpoint on RegQueryValueA in Soft Ice. The program I'm trying to crack checks the registry very early on for a username and serial number.
The problem I have is this: after seting up the breakpoint and and leaving the Sice window with control D, I am then unable to run my prog due to Sice breaking every few seconds on RegQueryValueA!
I rialise that this is the OS querying the registry, but it's getting in the way!!

Does anyone know if there is some kind of conditional break that I could use that would ignore the OS's reg queries, but just break on the ones in my program? Surely there must be something like this.

Any help will be greatly appreciated.

Thanks in advace
xOptiMus
JimmyClif
11-21-2000, 11:53 AM
Greetings xOptiMus :)

I asked the same question once too and got told to visit rhayader.htm on fravia's page... Since that time I got a helpful shortcut pointing straight at that specific page...

Next to some really helpful tricks he shows you this:

BPX RegQueryValueExA IF *(ESP->8) == 'Regi' DO "D ESP->14;"

And SoftIce will only break when the registry read the ones that start with "Regi".

Grabb that page...

;) JimmyC
xOptiMus
11-21-2000, 12:08 PM
Thanks very much Jimmy.

I still don't quite understand. When you say Sice will only break on anything starting "Regi", then what is"Regi", i.e. is it the key that you might be searching for in the registry, or some function call or what?

Can u elaborate a little more please?

Thanks
Spath.
11-21-2000, 02:40 PM
As always, reading the docs can help... 87

For this you can use process id and/or thread
id in your breakpoint condition to limit
breakpoint triggering on a single program
(PID/TID in NT, UPID/UTID in Win9x).

ex: bpx blabla if (upid==1234)

Regards,

Spath.
solomon
11-22-2000, 04:01 AM
It seems that there are bugs in the conditional breakpoints of SoftICE.
When I use
bpx RegQueryValueExA if *(esp+8)=='Key'
as the breakpoint, SoftICE doesn't pop up. But I'm sure that the prog does read a registry key named "Key"?C coz I use
bpx RegQueryValueExA do "d *(esp+8)"
and find the string "Key".
Spath.
11-22-2000, 05:09 AM
> It seems that there are bugs in the conditional
> breakpoints of SoftICE.
>
> When I use
> bpx RegQueryValueExA if *(esp+8)=='Key'

Your condition is not correct, you must either use
a 4 bytes string or add operand size information.
Solomon
11-22-2000, 05:51 AM
yeah, you are right. It's my bug, not SoftICE's :)
bpx .... if BYTE(*esp)== 74
bpx .... if WORD(*esp)== 7474
bpx .... if DWORD(*esp)== 74747474
xOptiMus
11-22-2000, 12:45 PM
Hi Spath,

Thanks for the info about using a thread or process id to keep all breakpoints to a single program, it sounds like just what I need.

The problem is I havn't been cracking long and don't know how to get the process or thread id of my program. Could you explain how I can get this....?

Thanks in advance
xOptiMus
Spath.
11-22-2000, 01:42 PM
> The problem is I havn't been cracking long
> and don't know how to get the process or
> thread id of my program. Could you explain > how I can get this....?

Use 'proc' and 'thread' for that, and get the
SoftIce manuals, that could be useful :)
http://www.idca.com/~thesandman/SoftPage.html


Soft-Ice Mouse problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Soft-Ice Mouse problem
PDA

View Full Version : Soft-Ice Mouse problem

FreaCon
11-21-2000, 04:35 PM
'Eh there people

I got a problem with Soft-Ice and my mouse. I am currently trying to understand the Zen and assembly stuff plus looking into programs, but it sure is hard when i try it and i can't do much before Soft-Ice crashes. It crashes sometimes when i type something wrong, but primarily when i roll my mouse when the Soft-Ice window is open (Ctrl+D), and then my computer freezes. Nothing to do that Resetting =(

I got my mouse connected to my USP port (It's a Razer Boomslang 2000 for the people interested in the intruments being used) and i really don't have a clue what to do about this. It sure is getting annoying...

Please help me
/FreaCon
stillnewbie
11-21-2000, 06:31 PM
Hi,
read msg in TOT board
Erratic mouse movement-Mr Smith
might solve your prob


Looking for Orcpaks (complete,not only text)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Looking for Orcpaks (complete,not only text)
PDA

View Full Version : Looking for Orcpaks (complete,not only text)

proxymo
11-22-2000, 04:38 AM
Hi everybody!
Does anyone know where I can download "The Orcpaks", I did try every links at www.freenet.tlh.fl.us/~gthorne/orcpaks.htm, but they where down

Hope someone can help

Thanks
Aleph
11-22-2000, 06:43 PM
Hello.

I know they're on the web (but quite well hidden :-). They're also on the RCE CD you can order (see www.idca.com/~thesandman/RCE/Requests.html).

Anyway, if you can't find 'em, just ask: I've downloaded all the packs more than a year ago, and I think they haven't changed a lot since then:-)
NchantA
11-22-2000, 08:43 PM
if i remember correctly the sandman had the complete set on his page when i last visited (albeit a long time ago)

they are interesting

NchantA


Coding a Trainer: Hotkey problem, please help :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Coding a Trainer: Hotkey problem, please help :)
PDA

View Full Version : Coding a Trainer: Hotkey problem, please help :)

Predator [PC/pGC]
11-22-2000, 08:39 AM
Well this is my first post, hope it won't be a bad one - first thing I should say is that this board is -great- and I should've checked it out earlier.

Here go's. I'm trying to code a trainer for Tony Hawk 2. I found the memory locations for the score and money. Thing is, that you can't use alt-tab in the game while those keys are disabled - so alt-tab and then pressing a button on my trainer window won't do. When I re-enabled those keycombinations by inserting a call to SystemParametersInfoA, setting the screensaver to 'disabled', I found that pressing alt-tab in the game simply closes the game.

So, use hotkeys then we can use from within the game (better anyway) for example pressing F12 would update the score with 10000. I've tried putting GetAsyncKeyState on a timer (what defiler did in his tut about trainers): no luck. Then SavaGe notified me about the RegisterHotKey API which looks great but: also doesn't work. As soon as you are -in- the game, the keys won't be noticed by my trainer anymore.

BPX SetWindowsHookEx, trying to see if the game hooks WH_KEYBOARD and indeed that was it - I jumped over the call and found that my trainer can 'see' the hotkeys now ... but, the game doesn't, anymore ;-)

I'm stuck. What do I do next? How can I make the trainer work?
An easy way out would possibly be to set a timer in my trainer, and after 5 minutes let it update the score/money (when the game is allready launched) but that kind of sux.

I'm calling for help here ;-) Thanks in advance.

Greetings,
Predator [PC/pGC]
Solomon
11-22-2000, 09:02 AM
Maybe the trainer can also set a keyboard hook, just like what the game does. All the keyboard hooks form a chain. One hook will use CallNextHookEx( ) to activate next one in the chain.
not proved yet :)
xOANINO [UCF]
11-22-2000, 09:51 AM
That dude, is right ... u just simply have to set your hook on top of the chain and CallNextHook in the end of your routine. In this way, your hook will be executed before the game's one. It's like old dos INT chaining :)

xOANINO
[UCF]
Predator [PC/pGC]
11-22-2000, 10:44 AM
Wow, thanks for the good and very fast reply guys - is this great or what? ;-)

I'm not sure if it's "normal" for a trainer to use a dll though (required for using SetWindowsHookEx right?) but, hey.. who cares ;) if it works it works.

Tnx again.. Greetz,

Predator [PC/pGC]
Predator [PC/pGC]
11-22-2000, 01:30 PM
xOANINO [UCF] (11-21-2000 23:51):
u just simply have to set your hook on top of the chain and CallNextHook in the end of your routine. In this way, your hook will be executed before the game's one.

Hello again ;-) I finished coding the hook thing, with a little help of Iczelion's tut#24 it wasn't hard, but it doesn't seem to work anymore as soon as I fire up the game. Before I run the game, the hook works good and pressing F12 pops up a messagebox (just as a test).
I guess this could be 2 things, please correct me if I'm wrong
1. The game doesn't call "CallNextHookEx" api when it should
2. My hook isn't on top of the chain

I hope it's option #2.. hehe.. if it is, how can I make my hook the top one on the chain? Perhaps setting it -after- the game has launched/set it's hook? I'm just guessing ...

Tnx again :)

Later,
Predator [PC/pGC]
Solomon
11-22-2000, 10:10 PM
Quoted from MSDN:

"The SetWindowsHookEx function always installs a hook procedure at the beginning of a hook chain. "

"When an event occurs that is monitored by a particular type of hook, the system calls the procedure at the beginning of the hook chain associated with the hook. Each hook procedure in the chain determines whether to pass the event to the next procedure. A hook procedure passes an event to the next procedure by calling the CallNextHookEx function. "

So the game should set the hook first, then the trainer ;)
Predator [PC/pGC]
11-23-2000, 01:57 AM
Hmm that's odd, I tried doing so by launching the game and having the trainer to sleep for 60 secs and -then- do the hooking .. but it still didn't work - quite weird because if it really is on top of the chain it doesn't matter if the game itself calls CallNextHookEx or not..

Is it possible that the game (or directX) fucks up the keyboard so badly that I can't hook it anymore? :-)

msdn says: "For a specified hook type, thread hooks are called first, then global hooks."

I have a theory ;) The game uses a thread hook, so wether I set my hook before or after the game sets it's hook, the hook set by the game will be processed first. And the game doesn't call CallNextHookEx so my global hook doesn't get processed at all.

I hope I'm not right, because I'm running out of options..

Greetings,
Predator [PC/pGC]
Predator [PC/pGC]
11-23-2000, 02:23 PM
Well my theory was correct.. So I was freaking out. Untill NU told me on irc that defiler coded an example of hooking services. Ring-0 keyboard hook. Can't be defeated ;-)
And indeed it works... but I see I gotta improve my VXD coding because I'm struggling a bit with it. Anyway, problem solved ;-)

Thanks very much to all of you who replied to my topic! Very much appreciated.
Erovin
12-08-2000, 05:05 PM
Any chance you'd like to share your VXD code or a template? I've been trying to decipher Ring-0 VXDs on and off for a few months now with no luck. I have MSDN Library so I have access to all documentation. My interest is in detecting :CueCat swipes under the covers so that I don't have to run special :CueCat software all the time. I want to detect swipes and then launch a program to deal with them rather than launch a program that subsequently detects the swipes.
Predator [PC/pGC]
12-10-2000, 06:20 AM
Ofcourse, no problem. Here's the url:

http://themen01.exit.de/windows/member/relifed/files/servicehook.zip

Greetings,
Predator [PC/pGC]
Anticode
12-11-2000, 02:31 AM
another example of keyboard service hooking: http://www.sysinternals.com/c2cap95.htm


OllyDbg, a new cool looking debugger!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > OllyDbg, a new cool looking debugger!
PDA

View Full Version : OllyDbg, a new cool looking debugger!

Jueteng Lord
11-23-2000, 12:17 AM
http://home.t-online.de/home/Ollydbg

OllyDbg is a 32-bit code level debugger for Microsoft®
Windows®. Emphasis on binary code analysis makes
it particularly useful in cases where source is unavailable. OllyDbg is
a shareware, but you can download and use it
for
free. Special highlights are:

Code analysis - recognizes procedures, API calls,
switches, tables, constants and strings
Object file scanning - locates routines from object
files and libraries
You can add your own labels and comments
You can send your patches directly to executable
file
No installation - no thrash in registry and system
directories
With OllyDbg you can also:

Debug multithread applications
Attach to running programs
Display code either in MASM or IDEAL format
Decode and assemble MMX and 3DNow! instructions, including Athlon extensions
Dynamically recognize ASCII and UNICODE strings
Recognize weird code constructs, like call to jump to procedure
Decode calls to more than 1000 standard API functions, add custom functions
Show fixups
Dynamically trace stack frames
Search for imprecise commands and masked binary sequences
Search in the whole allocated memory
Find references to constant or address range
Set conditional, logging, memory and hardware breakpoints
Examine and modify memory, set breakpoints and pause program on-the-fly
Assemble commands into the shortest binary form
Automatically correct fixups when copying patches to executable file
Start OllyDbg from the floppy disk
and much, much more!
xOptiMus
11-24-2000, 09:13 AM
Hello reversers

Hey, why is no one commenting on this new debugger. I'm a newbie, and would be very interested to hear the oppinions of some of the more experienced reversers here regarding this debugger - it looks very good, but then I'm no expert on debuggers.

Come on people, what do you think eh?

xOptiMus
NchantA
11-25-2000, 06:17 AM
hello all

hrmm, it has nice syntax colouring ;D hehe and pretty kewl dissembling ect. it could be usefull tool but i dont know how to set a breakpoint without specifying an address ;(

if anyone knows how to do this plz post!

NchantA
tsehp
11-25-2000, 07:21 AM
I didn't spoke about it :
no way to put a bpx on showwindow without guessing the api address.
try it on a app with a lea eax, eax , this debugger stops and can't trace the program. Too much easy to defeat with anti debug/disass measures.
So, this product seems promising, but not ready yet for serious rce.
But it's free :)

Tsehp


Why the silly "posturing" ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Why the silly "posturing" ?
PDA

View Full Version : Why the silly "posturing" ?

Aimless
11-23-2000, 03:34 AM
Recently read a document about BlackB meeting with Fravia, and the rest.

Also read how REALLY all anti-microsoft "neo-hackers", spitting on M$, really are using IE5x or NEtscape, and shitting on Opera.

Why the bloody posturing on the mbs that M$ is crap and all that bull? Peer pressure ? Or do they think that only by mouthing profanities against M$ can they be viewed as real hackers ?

I proudly say (since very long, on the old mb) that I use M$ products, and they are far better than many others.

I also understand REAL unix fans hating it. I have no issues with that. I also understand "old" hands trashing it. But all I want to do is:

Is it not time to stop talking about M$ and concentrate on how you are using IE and M$ stuff away from the prying eyes of the peers ? Like you used ta read "Hustler" hiding it from you mother, and preaching platitudes outside on the sins of the flesh ?

I am open for discussion. Sorry if it feels like a "flame", but I have no intentions of this posting being so.

Tsehp, you may delete this if you feel that this is indeed the case.

Sorry for the deviations. Only technical questions henceforth.

As ever
Epic
11-23-2000, 04:34 AM
Well, actually I'm pro *nix (see http://hcunix.org).

At work, all my servers are *nix based, due to the need of high availability. NT, unfortunately, failed to fulfill the standards.

However, in order to cope with the incoming documents, almost all workstations are 98 boxes (approx 30, except mine). MsOffice seems to be a market standard.

My box (both at home and work) is a dual boot one. I'm using mostly *nix. For excell files, using gnumeric and for word files antiword. In case of Powerpoint files, I switch to 98.

I'll be using VmWare, though.

For word processing, I'm using RTF and HTML. For spreadsheets, gnumeric and siag.

Database applcations are server based, mysql, with win odbc support. Sql text files.

Programming GNU, both on win and *nix.

Filemanagement mc and xwincommander (explorer alike, more panels)

Both OS's appears similar on my desktop, including e-mail clients (becky and xfmail). I can ssh manage my *nix servers from both my Os's.

So, who cares what OS you're running? The important thing is using the standards. If you code on VB, you cant port it. If you write *.doc, you can't port it, if you use telnet, someone will port it... etc. etc.

Lastwords, no MS products are not bad, but never use Outlook as you mail transfer agent.

Kind regards.
Bweebee
11-23-2000, 08:17 AM
I can throw in my two cents, here.

A few years ago I worked at Dell in part of a factory install group. This was shortly before Dell got into the Linux business, about the same time that Compaq swallowed Digital, and before the M$ lawsuit (to put things in perspective). One of the major barriers to entry that Dell had, which prohibited them from offering Linux sooner, was an agreement with the evil empire to sell and distribute the M$ OSes exclusively, with a discount of about $15 per license. Without the discount Dell couldn't compete; with the discount Dell couldn't offer Linux, OS/2, et. al, factory loaded. IMHO, this was an unfair agreement with implications of illegal price-fixing. IIRC, this was brought to the attention of Judge Jackson (that was his name, right?), but he didn't rebuke this agreement as he did with other M$ business practices.

Notwithstanding the Judge's opinion in that matter, you don't have to look far for other examples of unethical or illegal business practices on M$'s part. Their attempts to illegally divide the browser market with Netscape are notorious and well documented. The introduction of changes to their APIs that just-so-happen to break competing products like DR. Dos or OS/2 provide an example that shows how M$ used it's market dominance to deliberately hurt their competition. Their fairly consistent subterfuge of useful standards and protocols are a constant annoyance to developers that strive for cross-platform compatibility. And so on.

Some of these acts seem illegal, some seem unethical. All are good enough reasons to bash the evil Borg.
tsehp
11-23-2000, 01:30 PM
Aimless (11-22-2000 17:34):
Recently read a document about BlackB meeting with Fravia, and the rest.

Also read how REALLY all anti-microsoft "neo-hackers", spitting on M$, really are using IE5x or NEtscape, and shitting on Opera.

Why the bloody posturing on the mbs that M$ is crap and all that bull? Peer pressure ? Or do they think that only by mouthing profanities against M$ can they be viewed as real hackers ?

I proudly say (since very long, on the old mb) that I use M$ products, and they are far better than many others.

I also understand REAL unix fans hating it. I have no issues with that. I also understand "old" hands trashing it. But all I want to do is:

Is it not time to stop talking about M$ and concentrate on how you are using IE and M$ stuff away from the prying eyes of the peers ? Like you used ta read "Hustler" hiding it from you mother, and preaching platitudes outside on the sins of the flesh ?

I am open for discussion. Sorry if it feels like a "flame", but I have no intentions of this posting being so.

Tsehp, you may delete this if you feel that this is indeed the case.

Sorry for the deviations. Only technical questions henceforth.

As ever

Surely not, I'll never delete such postings, only crack requests and useless stuff even when I'll never be the only judge for this.

I completly agree with you aimless, a lot of us are using m$ products, considering the server logs, we have about 97%, it seems normal to hear more critics about m$ than the rest.
If m$ were as bad as they say, would be so much people using their products, buying the OS ?
Celebrity comes with critics, my only hope is that nobody uses the
*organised* fight unix/m$ to divide this community.

Best regards,

tsehp
vgb
11-26-2000, 04:17 PM
Bweebee (11-22-2000 22:17):
I can throw in my two cents, here.

A few years ago I worked at Dell in part of a factory install group. This was shortly before Dell got into the Linux business, about the same time that Compaq swallowed Digital, and before the M$ lawsuit (to put things in perspective). One of the major barriers to entry that Dell had, which prohibited them from offering Linux sooner, was an agreement with the evil empire to sell and distribute the M$ OSes exclusively, with a discount of about $15 per license. Without the discount Dell couldn't compete; with the discount Dell couldn't offer Linux, OS/2, et. al, factory loaded. IMHO, this was an unfair agreement with implications of illegal price-fixing. IIRC, this was brought to the attention of Judge Jackson (that was his name, right?), but he didn't rebuke this agreement as he did with other M$ business practices.

So? Have you never heard of quantity discounts and the like? This practice has been going on forever since the first smart businessman tried to outdo his competition. I have no love OR hate for MS but all i see is a strong marketing effort that is totally consistent with the corporate way of doing business. $15/unit discount??? - hell, I've seen $50- 100/unit discounts in other industries. Is it "fair" to the competition - hell NO! The operative word here is competition - this is an adversary. I guarrantee that if netscape could have done to MS what MS did to them - they would have.

The introduction of changes to their APIs that just-so-happen to break competing products like DR. Dos or OS/2 provide an example that shows how M$ used it's market dominance to deliberately hurt their competition. Their fairly consistent subterfuge of useful standards and protocols are a constant annoyance to developers that strive for cross-platform compatibility. And so on.

Some of these acts seem illegal, some seem unethical. All are good enough reasons to bash the evil Borg.

And I guess that we should all bash Apple, 'cause MAC software isn't compatible with PC's? If I wrote software that I only wanted to run on XYZOS and put code in it that would crash any other OS - am I crooked? It's MY software and I want to control who uses it. Two things will happen - if my software is good enough, people will buy XYZOS to run it. If it's NOT good enough, people won't buy my software.

Before we start bashing the evil borg empire we might want to consider bashing EVRYONE in business, cause if they're successful, they are doing one or more of the things you describe. Seem to recall that quite a long time ago there was a landmark case about Schwinn Bicycles trying to do the same thing that MS is doing by controlling distribution.

I say, cut MS some slack - like it or not, the computer industry woulod NOT be as big today if it weren't for them. They've forced manufacturer's to produce faster and cheaper product. As a consumer, I benefit.
fravia+
11-27-2000, 04:08 PM
--------------
[quote]Aimless (11-22-2000 17:34):
Recently read a document about BlackB meeting with Fravia, and the rest.

Also read how REALLY all anti-microsoft "neo-hackers", spitting on M$, really are using IE5x or NEtscape, and shitting on Opera.

Why the bloody posturing on the mbs that M$ is crap and all that bull? Peer pressure ? Or do they think that only by mouthing profanities against M$ can they be viewed as real hackers ?
---------------

Dear Aimless,
One year is a long time on the web. Indeed when we met in Brussel with BlackB, a long time ago, we 'confessed' each other to use MSIE Explorer MUCH more than we would like to admit... in those times, with a rudimentary Opera at hand. We were telling ourselves some thruths, which is what we always should do, and I intend to continue doing so: my own 'truth' (as far as I can feel it) today (yours can differ, of course) is that in the meantime things have evolved quite a lot AGAINST MSIE explorer: I am now NOT using MSIE anymore, not even at work, because of the sheer 'betterness' (is that the word? :-) of Opera. Especially its version 4.02 (even if it urgent needs our 'ameliorations', see recent essays on my site, so I'm not saying Opera is great and MSIE is crap, I'm saying Opera is better for my needs today, and I stick to it).

To be honest, very homnest, in this very moment I'm not using Opera: I'm using a modified version of netscape 4.75, for anonymity and testing purposes... Hi +Tsehp, is me... you like the referrals I bring arouns? :-) but I can assure you that nowadays my own personal choice when performing 'normal' browsing is and remains Opera 4.02. I'm ready to switch to MSIE if it will ever offer a better cutting of the mustard, though, but I think this hypothesis is getting more and more unlikely.

Try Opera 4.02 yourself -now- TOGETHER with whatever MSIE version you'r using and then let me know what you yourself think when you compare performances ('performances', not only 'hidden activities' take your time, at least a week experimenting before making up your mind).

Just my two cents, coz I think you got a false impression from some (true) considerations we made more than one year ago, which for many good reasons no longer apply.

Don't know if people are still 'mouthing profanities' against M$... personally I don't think it would be necessary any more: Microsoft has already lost, at least in my opinion (I don't even have any more an 'Antimicrosoft' section, you shouldn't flog dead horses, eh :-) Good riddance.

As a side consideration: the fact that people still (less and less) use a lot Microsoft products doesn't mean AT ALL that those same products are good, a very strange mass=good equation if you ask me... remember the VHS-Betamax battles? :-)

On a side note, everytime I see a book in the library with "more than 7.000.000 copies sold" advertised in big red letters onto it I, personally, know for sure that I should NOT buy it. So many zombies cannot be right.

F+
Bweeboe
11-28-2000, 01:32 AM
3 quick retorts for vgb:

1) Price fixing != quantity discount. One is illegal, the other isn't.

2) "Everybody does it" has never been an acceptable excuse to commit crimes. If other businesses are using anti-competitive tactics to maintain their stranglehold on an industry, then we should admonish them as we do M$.

3) Consumers (including you) do not benefit from companies that have monopoly control over an industry. Consumers benefit when they are able to choose the best quality product at the best price. Monopolies hurt consumers by denying them this choice.
xOANINO [UCF]
11-28-2000, 09:05 AM
Here we go.... finally one who thinks different in this era of "linux" trend :)

I thought this way for long time, and all i got was laughs from the huge amount of neo-hackers childs (who run linux just to smurf each others) and the graduated zombies hanging over in italians universities..... Well, what can i say ? i always said that the 2 OS (*nix and WIN) are different, and something is best done by WIN and something by *nix.

Simply, there's something u can't do performantly in *nix, and this is a fact. *nix will never be an all purpose OS like WIN, simply coz its architecture is too net-oriented. The server-client architecture of X can't be compared to the speed of the standalone GUI of WIN, and noone can deny it. Unless they get rid of the X architecture, they'll never have a gui comparable to WIN in terms of speed. It is true also the contrary, that this client-server architecture helps a lot on the net stuff side, which WIN lacks by now.

So you see, there can't be the perfect OS .... but people should be able to use the one which suits best their neads, and learn to rispect the others without spitting shit on what (often) they don't know at all.
Unfortunately, (at least here in Italy), the universities are the first to throw shit on M$ without even knowing their products... and this is because today everything is net oriented, and net=linux=work.... who says that ? You university teachers, ever noticed that there's not only net applications, but also games, gfx suites, audio suites ? You know that completely excluding WIN from italian university teachings 99% of your students gets graduated in computer science but DON'T KNOW A SHIT of what is the de-facto today standard in everything-but-net stuff ?!?!
Well, enough rants ......

I've always been proud to use MS products, and i don't see the bad in it. Its the standard, and today if you want to gain money (easy or not) you must agree to the standard. You can't code using WIN32 API or VisualC++/Basic/Delphi/Builder ? Too bad GNU guy, you work chances are very poor compared to mine.

Those things are overbloated ? Sure, infact almost every game is written used VisualC++ ..... seems this compiler is indeed good...

Windows is slow ? sure, Gnome/KDE are speed demons .... they swap as hell even with 128m ram....

In the end, no matter which OS you use .... but be sure that the OS is the best for the stuff you must do. If not, switch to another OS without wasting time...

And for *nix users ..... please open your eyes once for all, and try to see the bad and the good of Win as we WIN users try to do with your favourite OS :)

xOANINO
[UCF]
xOANINO [UCF]
11-28-2000, 09:13 AM
Ah sorry, i forgot the most important thing i wanted to say ..... too much ranting made me forgot it :)

To Linux users, you REALLY REALLY believe that if Linux Torvald would have been in Bill Gates position he wouldn't have acted as he's doing ? He's doing nothing bad at all, he's just a business man who runs his company, and he try everything he can to face the opponents. Wake up, this is BUSINESS!

And remember that (maybe) if there wasn't an "uncle Bill" probably we wouldn't be here chatting on this MsgBoard :)

enough for today, bye :)
xOANINO
[UCF]
fravia+
11-28-2000, 02:18 PM
Actually, IMO...
To be some sort of jolly, that's where you have chances... at least that's the kind of people anyone would love to hire... *nix-obsessed and windows-obsessed are pretty useless in a continuously a-changing world. Try your luck as windoze only or as nix only in a phase where there are so many going from Unix to NT as there are going from NT to Linux... and you'll soon realize that the (easy to guess) 'secret' is to have knowledge of BOTH fields (and to be able to see the limits and advantages of both).

This sais... we were not speaking about nix versus windoze, where we? We were speaking about Microsoft sad implementations in general (star office has given away on MAGAZINES the source code... you see what that -could-mean?) and, more specifically, we were discussing MSIE (WINDOWS) advantages and /ordisadvantages vis-a-vis Opera (WINDOWS).

There, specifically, I still miss your valued feedback...

Work well,
F+

Hey, Xoanino... I hoped to meet you in Milan in October :-)

PS:
+Tsehp... you like my referrals and User agents? :-)
xOANINO
11-28-2000, 03:40 PM
eh fravione, ero senza macchina ..... in attesa di prendere quella nuova, me l'hanno consegnata poco dopo lo smau :( Sarà per la prossima volta :)

xOA[UCF]
Rool&
11-29-2000, 05:25 AM
Browsers habits in an MS OS : why opera is not sufficient (IMHO)
I try :
If you're coding in MS langages ( VB(A) stuff ... ), the greatest source of info is MS site
, which is best surfed with ie5 (take msdn library for instance,and generally the tons of specific combos: awful without ie5 ).
I sometimes have to use ActiveX plugins ( for working purposes ), so I need ie5.
I don't want to switch to Opera, because it crashes more than Netscape (it may be computer-specific, so don't flame me for that please;) ), it's never compliant with all weird plugins (not the "multimedia" ones, the useful ones (sam spade,alexa ...)) .
Netscape has a great bookmark management, ( the "drag&drop to bookmarks button" is the fastest way to class bookmarks IMHO ).A "ctrl B ctrl F" and you can regexp in bookmark names,urls, titles...Great.
I think the personal toolbar is really useful (I import subtrees of my bookmarks into it, like search engine helps-in local of course to gain 2 seconds-)
I use Opera for better anonymity(INSIDE, with the black&white screen,no menun, no bars :ie a great notepad.exe, and OUTSIDE , with coookies/java/scriptlangages/referer management).

And you, what are your own browsers habits?
flameon
11-29-2000, 01:20 PM
Hi, Been visiting your "cracker" world and must say thanks....but there seems to be a small number of y'all that talk trash about M$ and thats
OK, Ford owners trash on Chevys, Chevy owners trash on Fords, they both trash on Mopar...nothing wrong with having a favorite ride. What is wrong, is sites like fu*kedprint
and others who take it too far and throw nails onto the information superhighway giving "flats" to surfers who drive explorers, and not Opera drivers, that is pure BS and makes them look like common low life thugs. Y'all claim that we should be free to surf for ANY info, then some of you select M$ surfers and tell others to "damage M$" ??????? Why not use
your time to make the highway a better road for everyone? I'm using Opera to surf "The Cracker World", so as not to get a "flat", but
EX5.5 is my browser of choice for all other surfing. I would never sink so low as to try to crash netscape or opera and you shouldn't do it either.
Woodmann
11-29-2000, 05:05 PM
Perhaps I am a little more paranoid then most people but, with Opera I am given such control over my anonimity. The same reason why I don't use bundled email programs, not even Operamail. It's hard enough to wander the internet and not be followed. I just wanted to make it a little more difficult for them. Bottom line for me is, I like Opera because it's easy to customize to *my* needs.
I also have to agree with you all that whatever fits your needs then use it.
I have a question though......Am I missing a "bash Microsoft" party somewhere?
Maybe there was renewed resistence and I missed the gathering?
Just wondering what started this thread.
Peace, Woodmann
flameon
11-30-2000, 12:25 PM
Hi Woodmann,

I don't think you missed a bash M$ party, but as a new comer, it
is quite obvious that people like *fravia are promoting a bash M$
attitude. Nothing personal *fravia, but telling people who visit
your site that they are fools for using M$, and that they should instead use Opera, sounds quite childish. The trouble is, there are new-be's who will take your advice and "damage M$". Do you have stock in Opera?? I think your students are trying to tell you
something, :time to do a little reality cracking yourself 'cause
you will end up making enemys. Frogsprint is another example, they
had anti M$ script blocking the front door, and offered free download script to fuck with Explorer surfers. (It caused them some trouble huh?) How many nails did
y'all throw onto the highway? If your server logs are true, and 97% of your members are using M$, seems to me a little help making
our rides a little more secure would be a better way to handle it.
All you reversers need to demand more respect from the teachers, bashing M$, makes you look like thugs. This internet, our computers and OS's ect. is a dynamic evolving awsome powerful tool
made by people as a whole, not a conspiracy by the 10's of thousands of real people who work at M$.


Big Brother is reading: cryptography in the digital world.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Big Brother is reading: cryptography in the digital world.
PDA

View Full Version : Big Brother is reading: cryptography in the digital world.

macilaci
11-24-2000, 12:57 AM
Essay perfectionism...
Bob calculates with his private number 6 the one-way function: 11^6(mod 11) = 4 = A
- a small error occured in this line 11^6(mod 11) = 0 not 4, but probably the right one is 7^6 (mod11) = 4 - it gives at least sense.
Take it easy nobody´s perfect, only the computers are so....
BlackB
11-27-2000, 10:54 AM
It's fixed, thx.

greets

BlackB


Modem Hooking - In trouble again...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Modem Hooking - In trouble again...
PDA

View Full Version : Modem Hooking - In trouble again...

acab
11-24-2000, 02:50 AM
Can someone explain how to send a string to the modem when its handle is opened through:
call CreateFileA,"\\.\ModemName",...

In other words, while the following piece of code works correctly:
call CreateFileA,"COM1",...
call SetCommTimeouts,...
call WriteFile,"ATZ",...

In this one writefile fails:
call CreateFileA,"\\.\ModemName",...
call SetCommTimeouts,...
call WriteFile,"ATZ",...

Thanks,
aCaB


Acroread plugin hacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Acroread plugin hacking
PDA

View Full Version : Acroread plugin hacking

Dizzy
11-24-2000, 07:53 AM
Anyone know how Acrobat Reader authenticates its plugins?

Plugins made with the SDK work nicely in Adobe Acrobat, but the reader requires the use of an additional "integration key" which costs $$$ and requires signing some general agreements (like not to save files etc).

The resource dir of Acroreader contains a field API_ADOBE_PUBLIC_KEY and the default plugins contain the fields API_DIGITAL_CERTIFICATE and API_CRYPTO_DIGEST (or some such). This suggest some procedure like:

1) Vendor key derived from adobe secret key used for certificate (API_DIGITAL_CERTIFICATE)
2) Hash of plugin code and data? (API_CRYPTO_DIGEST)
3) Some sort of signature scheme to verify the above.

I would expect the system to cryptographicly sound, but it would be interesting if there was some way around it without patching the executable.

Anyone know anything about this?

I started half-heartedly disassembling the reader, but it's really ugly and convoluted C++ code.

Dizzy
latigo
11-24-2000, 10:04 AM
any url for downloading the sdk and all the stuff?
Thanks :)
Dizzy
11-24-2000, 05:35 PM
That would be: http://partners.adobe.com/asn/developer/acrosdk/main.html for the SDK.

I just found out that Acrobat Reader does a md5 check on every plugin, but only on the PE header/optional header/data directories. So this means that it should be possible to cram any code you like into an old certified plugin as long as you retain the headers and the resource entries for the certificate. Haven't tried it yet, but at least some random patching seems to work.

Writing a handy version-independent plugin to remove printing restritctions etc is left as an excercise for the interested reader. :) Or why not a decryptor for some of the completely braindead pdf encryption systems around. The standard encryption does take some heavy brute forcing, though.

Dizzy
Kythen
11-25-2000, 02:16 PM
I believe Adobe may use an elliptic curve public-key cryptosystem made by Certicom. I remember seeing a statement on Certicom's website mentioning that Adobe was one of the companys licensing their products. If this is indeed the case, you aren't touching the crypto. Your best bet would to attack the implementation, but it'll still be a challenge. Good luck and be sure to let us know what you find out! :)

Regards,
Kythen
Dizzy
11-26-2000, 04:45 PM
Kythen (11-25-2000 04:16):
I believe Adobe may use an elliptic curve public-key cryptosystem made by Certicom. I remember seeing a statement on Certicom's website mentioning that Adobe was one of the companys licensing their products. If this is indeed the case, you aren't touching the crypto. Your best bet would to attack the implementation, but it'll still be a challenge.

It may be that the plugin authentication is done with elliptic curves. Anyway, as I already said, keeping the PE headers intact should allow us to get around that.

The standard security handler, btw, doesn't use any fancy crypto stuff, it's essentially a md5 hash of the password (and possibly some other stuff) used as a key to rc4. The specs are available on the web if you search a little. Also, there are brute force hackers against the 40 bit exportable version, although none of them are freely available AFAIK.

Dizzy


owlbook.htm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > owlbook.htm
PDA

View Full Version : owlbook.htm

latigo
11-24-2000, 10:26 AM
Howdy there fellas.
In my exhaustive search for walter oney's book i stumbled upon owlbook.htm at the old fortress..
Does anyone of you happen to have any of this .rar files mentioned in such html file??
As usual, thanks in advance :)
JimmyClif
11-24-2000, 10:43 AM
Greetings,

Some of these books can be found here:

http://ganz.newmail.ru/Dokz.html

Regards,
JimmyClif
The Owl
11-24-2000, 03:43 PM
.
latigo
11-24-2000, 04:31 PM
I would say i love you , but i still (unfortunately) i don't know you :).
Thanks VERY MUCHO MUCHO :) Owl!
Bye and thanks again.
latigo
11-24-2000, 04:32 PM
JimmyClif (11-24-2000 00:43):
Greetings,

Some of these books can be found here:

http://ganz.newmail.ru/Dokz.html

Regards,
JimmyClif

Thanks man!!! :)
JimmyClif
11-24-2000, 05:06 PM
uhm... Owl...

I love you too man ;)
Ignatz
11-26-2000, 05:18 AM
Hmmm.... interesting how you can wander aimlessly and find things you never knew you needed until you find it......

The info in some of these looks like i may find some use for it... so not only do i thank the one who provided the files... i also thank the one who requested the information....


CopyCrypt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CopyCrypt
PDA

View Full Version : CopyCrypt

Lost404
11-24-2000, 10:42 PM
Well copycrypt uses code 09 in FrogSice to protect itself from sice...and i just can't find the damn thing....

FrogSice says:

mov eax, Device_ID ; 202h for SICE or 7a5Fh for SIWVID VxD ID
mov edi, Device_Name ; only used if no VxD ID (useless in our case ;-)
VMMCall Get_DDB
mov [DDB], ecx

So after the code is executed i should land someplace after the mov ddb,ecx right?
Well the problem is i don't...i land in some funny code with lotta push [crap] and some calls to XXXstuph addresses.

So what the hell could be wrong?
Spath.
11-25-2000, 10:17 AM
You must realize that code snippets in
FrogsICE docs are just samples, you can
implement each method in many various
ways. Now you can look at FrogsICE report
or use the breakpoint proposed in the doc
to find where this method is used and how
eax,edi and ecx are handled.

Spath.
Spath.
11-25-2000, 10:26 AM
Hmm, it seems my messages are in some
strange way reposted when Opera reloads the
page from cache (without me reloading the
page). Sorry for this.
tsehp
11-26-2000, 11:20 AM
no problem I deleted the double msg, maybe they'll fix this on the 2.2 final version.

tsehp


SWmartCheck
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SWmartCheck
PDA

View Full Version : SWmartCheck

JohnnyBoy
11-26-2000, 12:03 PM
Where do I find the software. All I can find is the cracks and/or serial. If I find a linkt where I can download the file the zip-file is corrupted.

Please reply to johnny.nilsson@mandator.se


Help me with IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help me with IDA
PDA

View Full Version : Help me with IDA

proxymo
11-27-2000, 07:39 AM
Could someone please, send me the IDAPA404.r12 file part of shk2000n.zip of IDA 4?

Thanks


Help cracking PaintShop Pro 7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help cracking PaintShop Pro 7
PDA

View Full Version : Help cracking PaintShop Pro 7

xOptiMus
11-27-2000, 01:16 PM
Hi all

I need a little help with cracking PaintShop Pro ver 7 (trial). I am a newbie but have cracked quite a few progs with s/n protection. PaintShop pro is very different for me as it uses a completely different protection - it's a 30 day trial, with no s/n to enter.

This is probably an easy protection to crack, but not having attempted any kind of time limit protections, it's giving me a little trouble!
I've been setting a bpx on GetSystemTime, hoping that maybe the prog checks the date just after the call. GetSystemTime appears to be called from a file called "MCF.RTL" or something similar. When I hit F12 and return to the main prog I can find no sign of any data related to today's date anywhere.

Am I going in the right direction here? will I find the protection code by using such a breakpoint or should I be breaking on something else?

Can someone (especially someone who has already cracked the prog) please point me in the right direction. I'm not looking for an answer outlining the exact place (offset) where I should patch the prog, as I want to discover that myself. However I do need some kind of guidence because I'm just thrashing around in the dark at the moment!

Any help will be greatly appreciated

Thanks in advance
xOptiMus
hobgoblin
11-28-2000, 01:51 PM
Hi there,
I reversed the program a while ago. A hint: enter the program in the sice loader. When sice breaks at the beginning of the executed code, why not try a bpx loadimage? Paintshop uses this function (among others) to paint/load the opening nag screen. The nag screen reveals some text on yellow background. This text changes when the trial period is over. After Sice breaks on loadimage, why not try to trace back for a while and see where you end up?
The nag screen itself may also be removed in this version of Paintshop (without disableing some of the functions).
Good luck,
hobgoblin
11-29-2000, 10:06 AM
hobgoblin (11-28-2000 03:51):
Hi there,
I reversed the program a while ago. A hint: enter the program in the sice loader. When sice breaks at the beginning of the executed code, why not try a bpx loadimage? Paintshop uses this function (among others) to paint/load the opening nag screen. The nag screen reveals some text on yellow background. This text changes when the trial period is over. After Sice breaks on loadimage, why not try to trace back for a while and see where you end up?
The nag screen itself may also be removed in this version of Paintshop (without disableing some of the functions).
Good luck,

Or try this:
Enter Paintshop in the Sice loader. When you’re at the beginning of the code, you may try a bpx postquitmessage. ( To get the full potential of this approach, your copy of Paintshop must be expired). When Sice breaks, just hit F12 until you reach psp.exe code for the second time. You should by then be right after a call to Updatewindow. You are now in the middle of a call that runs/builds/loads the nag screen. If you just get out of the call, and then re-enter the call, I’m sure you will see a way to get rid of the nag screen. Now, if you do this correctly, you will also get rid of the time limitation at the same time.
If you only want to get rid of the time limitation, but keep the nag, just run the program until the expired nag shows. Enter a bpx destroywindow in Sice and then hit the quit button. When Sice breaks, get rid of the breakpoint, and start tracing backwards. Quite soon you will get to a point in the code where you will see some jle-instructions. This is where you can manipulate the program to never expire.
Hope this helps…
Regards,
Hobgoblin
xOptiMuss
11-29-2000, 03:16 PM
Hi there Hobgoblin,

Thanks very much for your help, i really do appreciate it! I'v been struggling for some time now. I've not heard of any of those breakpoints that you mentioned so I'll try all of them.

I would have been lost without those bpx's because that's just what I needed - bearings, a good reference point. I knew there must be somthing that Sice could break on, I just could'nt find it!

I think if there is a lack of knowledge in reversing tutorials, then it is the knowledge that would teach us how to isolate the lines of code that correspond to whatever object we whish to manipulate, ie a menu selection, an OK button, a window, or whatever. To be able to isolate the code that relates to these objects efficiently, is I think, just as important, if not more so, than the actual "cracking" of a program.

Thanks again Hobgoblin you've helped me enormously

xOptiMus


Rediscussing old targets (to macilaci and +Tsehp)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Rediscussing old targets (to macilaci and +Tsehp)
PDA

View Full Version : Rediscussing old targets (to macilaci and +Tsehp)

CyberHeg
11-27-2000, 03:19 PM
While browsing the site I digged up these two essays:
Borland's C++ builder v4 Emulating inputs on a timebomb protection by Tsehp

Rainbow trials Delphi five enterprise trial edition by macilaci ~Recommended

which I would like to take up again for a review. I found the Delphi program still availble for download however the C++ builder seems to be updated since then and I could not find a downloadable trial version. So is there any chance that you would still have this?
Else I will have to do with Delphi.

Besides I would like a confirmation especially of macilaci (since your is the "original" essay) that I am allowed to refer to your essay and recommenting some of the stuff you wrote.

Thanks in advance.

// CyberHeg
tsehp
11-27-2000, 05:24 PM
borland's c++ builder is actually v5 and still offers the same protection.
No need to update the essay, and you can order for a trial cd on inprise's site.

regards,

tsehp
CyberHeg
11-28-2000, 12:58 AM
It's not my intention to copy you guys essay's. Instead I want to show that you can bypass the protection by making real license keys instead of shaky patches and exploring some useful methods to targets like these.

// CyberHeg
tsehp
11-28-2000, 02:58 AM
Good idea, but the cd is about 140 megs; much too big for me to upload. You still can find the version 4 and apply your essay on it,
I could test on my 5 version before you release if you want.
CyberHeg
11-28-2000, 04:15 AM
I got a better idea. I actually dont need the program itself if you can just supply me with the info I need. Then you can test it out afterwards.
I'll write you a email later with the details.

Thanks in advance.
Regards
CyberHeg
macilaci
11-29-2000, 06:25 AM
You can try generating keys (hope you´ll find an effective method to get them), but better would be to unpack the whole app to speed it up a little and get some additional stability. I would like do this, but I´m short in time.
Good Luck

macilaci


Time limit disabled save and print
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Time limit disabled save and print
PDA

View Full Version : Time limit disabled save and print

Dawny
11-27-2000, 08:17 PM
Hi can anyone help me?.... I have this program that only give me 25 minutes and save and print is disabled. After 25 minutes it say this demo version has expired...etc...then you hit ok and program end. I found out where it give you 25 minutes I tried to change it to something like 2 hours, but when I do that and time reach 25 it says this program performed illigal operation. etc. can someone help... program is by Bytronic. thanks
macilaci
11-29-2000, 06:14 AM
What kind of illegal operation is that? When division by zero, look around, there could be a checking routine for that value. Or the proggy might use a CRC check....
Dawny
11-29-2000, 05:20 PM
Thanks for replying, macilaci. but I'm very new at this maybe u can check out the program, and see for yourself what I mean program is by bytronic program is a ladder logic, please reply if u can thank you.
tsehp
12-03-2000, 10:54 AM
I can't help you at this point, you have to go deeper and for example show us the listing where you suspect the protection to be located.
Otherwise this is like a direct crack request and its not the purpose of our work, if you're a newbie you can start of the fravia archive server, do here a local search concerning time trials.
regards,

tsehp


just here
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > just here
PDA

View Full Version : just here

bob
11-27-2000, 11:31 PM
one interesting thing i reverse that stupid old protection on flash 4 (rs agent) and got as far as the real program needing a passnumber and then done it all and made a crack(with codefusion crack engine(usefull way to save your work))but the i tranferred it all to another comp and the prog ran straight away!!!! and had a passnumber!!!!!note i didnt enter a passnumber anywhere


Strong Anti-debugging, Anti-FrogsIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Strong Anti-debugging, Anti-FrogsIce
PDA

View Full Version : Strong Anti-debugging, Anti-FrogsIce

Kayaker
11-28-2000, 12:35 AM
Hi All,

If anyone is looking for a nice, masochistic challenge...

EldoS AnyCalc multifunction calculator
http://www.eldos.org/elanycalc/elanycalc.html

The program is listed as a PE Windows GUI by FileInfo 2.3. It is protected by AsProtect, but FileInfo doesn't pick this up. The program maps a part of itself initially into memory in the 82Dxxxxx region with MapViewOfFile and then I believe runs through the gamut of GetProcAddress calls from there.

0167:00C6FB09 CALL KERNEL32!MapViewOfFile

Plenty of Self Modifying Code follows. All the unpacking and such occurs from this C6xxxx memory range. Lots of tracing later the program starts to unpack its sections from 401000 onwards. VirtualQueryEx or VirtualAlloc breakpoints seem to be as good a starting point as any to break into the unpacking routine.

Anti Filemon/Regmon - Partway through the unpacking process (stops at 4A4000, then I can't pick it up again) it uses GetClassNameA to check for the presence of 'FilemonClass' and 'RegmonClass'. If found, FindWindowExA and a series of SendMessageA calls send an ExitProcess message of some sort to shut down the SysInternal monitors. Must do something comparable with Prudens RegMonitor98 as it closes this one too. Luckily, modifying Filemon/Regmon by changing the strings 'FilemonClass' and 'RegmonClass' bypasses this protection.

Anti API Monitor - they don't pick up any useful API calls until after the program has started. Not sure if this is something specifically anti-API hook or just because of the memory location the program is running from.

Anti SoftIce - no nag, but Loader32.exe doesn't break on WinMain of course. Most direct calls seem to work OK though, surprisingly.

Anti FrogsIce - this is the one that gets me and the reason for my post. I'm using 1.08.8 with Bulletproof options, I1HERE is set to ON, Hook DRx selected, FrogsIce restarted as directed. I tried other combinations as well. SoftIce doesn't pop up, the program just ignores everything as if it wasn't there and goes on its merry way. Without the helpful hand of FrogsIce returned code I don't know what detection method might be being used. (CreateFileA / _lopen it ain't and there's no report of memory or IDT errors)

Now the FrogsIce domain is still a bit (!) of a Black Art to me, but I've used it successfully before. I just thought I'd mention this program to +Frog's Print & +Spath in case it's doing something new and unusual they might like to have a look at ;)

If FrogsIce works for others on this program then the fault must lay with my system or its user (I give it 50/50 ^_^ )

Beyond all this convoluted protection, it's still quite easy to use the 30 day trial program indefinitely by deleting a CLSID reg entry, and it doesn't seem to put a lot of crap on your system, so anyone could have a look at it without too much concern.

Regards,

Kayaker
SV
11-28-2000, 02:39 AM
Hi

I have unpacked it without problem.
It was Version 1.5 build 64.
What is your version ?
Spath.
11-28-2000, 04:12 PM
Hi Kayaker,

I have tried this app (1.53 build 73), and found
no anti-debugging, for me it works fine with or
without FrogsICE. What kind of problem do
you exactly see without FrogsICE loaded ?

Regards,

Spath.
Kayaker
11-28-2000, 04:13 PM
Y'know I think you're right, I was making this a lot harder than it needed to be. Amazing how different things look in the light of day ;)

I'm working on version 1.51 build 67 (1.52 build 69 is the latest I think). 3 breaks on MapViewOfFile and I'm where I want to be in Anycalc code. I kept getting caught up in the C6xxxx memory range, which seems to be mapped program code, but doesn't correspond to any specific module listed with MAP32 or MOD.

I haven't *quite* found the correct OEP but I've been able to make several dumps which have the main icon and apparently the full Import table intact (this would be a surprise for AsProtect?). FrogsIce still won't kick in on the packed file but I found that TRW loads the program OK.

I can work with this :)

Thanks,

Kayaker
Kayaker
11-28-2000, 04:24 PM
Spath. (11-28-2000 06:12):
Hi Kayaker,

I have tried this app (1.53 build 73), and found
no anti-debugging, for me it works fine with or
without FrogsICE. What kind of problem do
you exactly see without FrogsICE loaded ?

Regards,

Spath.

Hi Spath,

I caught your post just after I posted my reply to SV. Just the minor problem of SoftIce not breaking on WinMain, but I guess I got around that. I had seen a ref. to AsProtect in the programs code in the Data window and figured, especially with the Filemon/Regmon checks, that things would be a bit tougher to dump the file. Still working on that OEP though ;)

Thanks,

Kayaker
Kayaker
11-28-2000, 08:48 PM
Hi once again,

OK, I must apologize for my previous posts. My problem was that the SoftIce Loader wasn't breaking at the start of the unpacking code (which I erroneously called WinMain before but I guess that isn't technically correct). I had tried it several times and even after fresh reboots.

So I thought that perhaps because this was what FileInfo terms a PE Windows GUI type file, it behaved differently and that there might be SoftIce detection as well. Breakpoints on CreateFileA and _lopen didn't show any MeltICE type detection, so I turned to FrogsIce to see if it was using some Interrupt detection method. When FrogsIce didn't pop up SoftIce that's when I figured I had trouble on my hands ;)

I should have heeded the Occam's Razor principle that the simplest explanation is the best. For whatever reason, phase of the Moon, sunspot activity, bonehead user error, SoftIce is now breaking at the start of the unpacking code. Everything is well with the world again :)

I know SI gives glitches every once in while, it'll break one moment and then not the next, I guess that's what this was...

Just so this wasn't a totally wasted effort, I've often wondered exactly what a PE Windows GUI type file was, if anybody knows what I'm talking about. I've searched for the term but not found anything. It does seem to be a Delphi type language, using TForm like headings.

Thanks for your indulgence...

Kayaker
The Owl
11-29-2000, 04:12 AM
this is the same old winice feature/bug that's been biting people for some time now... and what i fixed in icedump earlier this year. check out icedump.asm, around line 1100 or so.
Kayaker
11-30-2000, 03:41 AM
The Owl (11-28-2000 18:12):
this is the same old winice feature/bug that's been biting people for some time now... and what i fixed in icedump earlier this year. check out icedump.asm, around line 1100 or so.

That is REALLY Cool Owl!

Line 1073 in Icedump.asm version 6.020c states that the code that follows will:

"; hook into a function which places a BP on the entry point of a module
; (used by loader32/wldr) and fix the problem with win32 modules not having
; their first section marked as executable (and thus winice not breaking at all)

So I start the problem program AnyCalc from a fresh boot with SoftIce Loader. Time and again SI does NOT break at the entry point.

I change the code characteristics of the 1st section from C0000040 to E0000020 and SI breaks, but there's a "File corrupted" CRC check message. Fair enough. Change it back and the program functions normally, but SI no longer breaks.

I thought I'd be a smartass and see if I could get SI to break by changing the Entry Point manually from 60 Pushad to CC Int3, and it did if I had a BPINT 3 set, but after restoring the code within SoftIce, the CRC check kicked in since the file itself still had the CC written into it of course!

Restore the program, run Icedump - SI breaks at entry point!! Unload Icedump with 'icedump u', hook is removed, SI no longer breaks. Amazing! It's like Magic happening there ^_^

Anyway, thanks for the explanation, I don't feel like I was going crazy now, I must've started Icedump out of habit at some point and that's when SI suddenly started breaking. Absolutely wonderful job you and the team have done on this, it goes beyond words. There's a LOT of work involved there which is much appreciated.

Regards,

Kayaker


For Nolan Blender - Vox Quiet
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > For Nolan Blender - Vox Quiet
PDA

View Full Version : For Nolan Blender - Vox Quiet

Crazy Genius
11-28-2000, 04:52 PM
I'm reversing my target with flexlm 6.1
As in essay I found out my real seeds ( by zeroing the random bits)
( It was the same seeds I got in lc_init proc 12345678 cmp )
But it's still not working.

Any ideas ?

I read in reverse group work essay , that VoxQuet had the same problem.
Nolan Blender
11-28-2000, 06:22 PM
For 6.1, you have to null out the **pointer**
to the job structure that's being passed to
the decoding routine - simply zeroing the
data in the job structure is insufficient, as the routine in lm_new will divide the key
between the job structure, and the returned
value in the vendorcode structure. If you
look at Dan's essay or mine you can see how
this is done.
tsehp.cjb.net is where to go for these essays.
Crazy Genius
11-29-2000, 02:35 PM
I didn't zero the data in the job structure , I zeroed the random bits. I tried to zero the pointer to the job structure and get same results . ( If I understood correctly the seeds then stored in the vendorcode structure in place of data[0] and data[1] ? ).

And I have some other progs in the same program package, that don't use static library and never take the "vector call" in l_sg(). So the seeds I found for those progs are same I found for main one. And they don't work too. :(

Any Ideas ????

P.S. Nolan , what's your e-mail ?
Nolan Blender
11-29-2000, 11:39 PM
Well, they could be doing some tricks like
user defined encryption or crypt filters.
If you null out the pointer, you should get
at least different results than without
nulling it out. What's the program? What
error does it give when it's not working?
Crazy Genius
11-30-2000, 04:54 PM
The target is Eagleware by GENESYS.
As for user-defined encryption and filters I checked it out and did not find any. And of course I get different seeds when I null the pointer.
But as I said this package includes different progs. And some of them are not using the new_job() function. The seeds I getting there ( by conventional ways) are same I found in main prog by zeroing out the pointer. in checkout() I got standart -8,-130 error - invalid seeds in all progs. Some of progs is about 400K in size. Want to look at it ?
Nolan Blender
11-30-2000, 11:06 PM
Are you generating long keys? Some programs
(notably older ones) won't work if you use
the current shorter keys. If you've compiled
lmcrypt, you can ask for longer keys with
lmcrypt -verfmt 5 -longkey license.dat

Since this one doesn't appear to be a public
(i.e, easily downloadable) program, I'm
assuming you have access to some valid keys -
try running lmcrypt against those keys to
see if your seeds are correct.

Also, some programs have a custom HOSTID that
they use - if it requires something like
HOSTID=BLAH_ID=11-23-53-23-53-23 then
it may require a custom host ID.

A very helpful exercise is to check what
lc_set_attr is being called with - you'll
be able to determine the behavior version and
any other weird settings that may be implemented.

I can sometimes be found on #cracking4newbies
on EFnet. There are other people there who
are experts at FLEXlm too, so ask in the
channel for assistance. I suspect that one
of the above tips will get you going though.

--nb.
Willebul
12-01-2000, 03:37 AM
Hi

Looked at this a while back ( Nice RF simulator ) , got hold of a real lic ( below )
You can extract the code but
look at the hostid , they do something funny
at that end .
Also the server line x=xxx seems funny
Got sidtracked and havent had the time to finish up.

SERVER Y=xxxx
VENDOR eagle
FEATURE genesys eagle 6.5 12-feb-2000 1 AF8EE0CC38C6 HOSTID="ANY P=EFEF"

Good hunting
W
GeN!uS
12-02-2000, 12:18 PM
; Are you generating long keys? Some programs

I tried all possible combinations.

;Since this one doesn't appear to be a public
;(i.e, easily downloadable) program, I'm
;assuming you have access to some valid keys -

No I don't have any.

Also, some programs have a custom HOSTID

But I failed in checkout() func. As for l_host it's returns 0 . a check for user defined HOSTID usually comes after checkout()

lc_set_attr is called with 3f,2b,38,3a,47,6,44 parameters - nothing unusual.

also I have seeds from older version of this prog ( 6.1 ) I tried to create license with this seeds and it's not worked too. Does it mean anything ?

P.S. I'm using Eagleware v.7 by GENESYS.
Perry
05-28-2001, 08:40 PM
Excuse me all, but do you have tried Skullcoder sniffind??

Perry.


Softice Help from a pro Please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Softice Help from a pro Please
PDA

View Full Version : Softice Help from a pro Please

down_n_out
11-29-2000, 12:07 AM
Anyinfo please

I had Softice running on my computer just fine. Then I had a large problem and had to delete some programs (SI405NT was one of them) from my disk I also removed all the registry settings that I could find. Now I go to reinstall it and it appears to install properly the video test works, but it will not start, no matter what setting I use for startup. Using "net start ntice" from the cmd line gives me a "system error 1058" it says the service is disabled. I can't find where that service is disabled at. I did a bootlog and it say it loaded ntice.sys just fine. I hope someone can help me

THX.

Screwed up


Req: Realworld downloadable FlexLM Targets that make use of the new 7.x tricks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Req: Realworld downloadable FlexLM Targets that make use of the new 7.x tricks
PDA

View Full Version : Req: Realworld downloadable FlexLM Targets that make use of the new 7.x tricks

nick
11-29-2000, 10:03 AM
working URLs welcome :-)
nick
12-07-2000, 02:31 PM
Come on guys!
Share your knowledge!
Direct me to those interesting targets.

;->


heh, on the subject of anti debugging....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > heh, on the subject of anti debugging....
PDA

View Full Version : heh, on the subject of anti debugging....

Lord Soth
11-29-2000, 05:58 PM
I've read the anti debugging thread that
kayaker started very thoroughly, and it was
interesting i might say.
Anyway, I've recently encountered a good CD
protection. What do I mean by good ?
Well, aside from the obvious digital signiature that is used to decrypt the file,
this protection makes use of SMC extensively
and when I say extensively I mean you can
hardly figure anything out untill it happens!
BTW, the protection is one of the latest
TTR DiscGuards. I've been fiddling with it
a bit (time constraints) but I wasn't able
to overcome the anti debugging stuff.
There are several simple anti debugging stuff going on,
like trying to load siwvid (i hope i spelled
that right hehe) and an int 68h and a meltice..
However, there is one other thing that also
affects TRW2K. The program will not complain
about a debugger present, but will just
rather crash itself. Now this doesn't happen
when you don't have a debugger running, so
I assume there is some anti-D check I'm not
aware, one that Frogsice might possibly missed (I dread the thought... heh).
Now, due to the nature of the SMC in the program,
it's very very hard to actually trace through
code, hence making the use of clever BPs
a necessity. I'll figure it out eventually,
hopefully, unless my brain overloads and fries first :)
OK, enough rambling, go back to doing whatever
you were doing heh

LS

PS.
How do you guys put those symbols in the body
of the post as well ? I know it's dumb, but
that's the way I am after all :-)
(don't nobody dare quote me on this one hehe)

Cyas
risc
11-29-2000, 11:15 PM
did you say discguard? tell us the name of the game please.

nothing follows which will be of any help to you. i apologise now for the crap i speak :\

i experianced discguard once on colin mcrae rally. never figured out the anti debugging code.. it would go into a almost continous loop checking the cd if debugger was present, then crash about 60 seconds later (after bypassing the 'regular' softice checks)

but all this crap was done in one call, which if i stepped over without executing it, would bypass the detection/crash and program would run fine.. (well, almost fine as it didnt like my 36x cd rom and always rekoned i had a pirate cd)
Kayaker
11-30-2000, 01:09 AM
And a good subject it is ;)

There's a Delphi Anti-debugging component called ADP Component I was wondering if anyone has come across, available at
http://Antidebug.ifrance.com

The author says it "defeat most debuggers & monitors as WDasm32, SoftIce, TRW 2000, Turbo Debugger, Sourcer, FileMon, ExeSpy, ResSpy, RegMon, Win-eXpose-Registry, Universal unpacker Procdump.

Improved Antidebugging Tricks & Anti SoftIce improved
- Added Anti-FrogsICE
- Added some Anti-Monitors (as FileMon, RegMon,ExeSpy,ResSpy,Windows Detective,...)
- Added some Anti-MemEditors (as Memory Doctor, Memory Editor, MemSpy, MemMonitor)
- Added Property Anti_Procdump (Protect your soft against Procdump Unpacker, for register users)
- Added Property Kill_Debuger (When ADP found debugger in memory, halt it)
- Added Property Stop_Execution (If a debugger or monitor is in memory, your program is stopped)
- Added Eventment If_DebugerFound (You can make false Keygen for wrong way for Cracker)
- Added Eventment If_Monitor_Found (Enter false informations in registry for example)

Now this guy's even saying his component is Anti-FrogsICE!!

Are we going to stand for this ? ^_^

Actually, if anyone HAS Delphi 3, 4 or 5 and can program a little Crack-me with it, even if it still includes the shareware registration nag, it might make a fun project...

(Shhh! He might be reading this right now)

Regards,

Kayaker
Spath.
11-30-2000, 03:11 AM
> There's a Delphi Anti-debugging component called ADP Component
> I was wondering if anyone has come across, available at

Yes, this component is just a collection of old tricks,
and the author has quite bad manners (he almost got banned
from some borland newsgroups for advertising spam).
Last time we checked, FrogsICE was able to handle it
without any problem.

Regards,

Spath.
Kayaker
11-30-2000, 03:49 AM
That's interesting Spath (and good to hear). By any chance do you know of any specific program which might use this protection? Purely out of academic interest of course you understand ;)
Spath.
11-30-2000, 05:52 PM
I have never seen it used in a real program,
some guy made a crackme for us. Try asking
FP if he still has it.

Spath.
Lord Soth
11-30-2000, 05:59 PM
Let me share something with ya.
I've cracked discguard once as well, but it
was fairly a lame crack. The game i cracked
back then is IAF (israeli air force).
It did check for the original CD, but you
could fool it somehow. It seeked all CD drives
in the machine and tried the verification on
each.
What I did was let it think that the HD is
in fact a CD (changing the getdrivetype return value from 5 to 3 hehe),
and it automatically returned an error saying
there was no CD (hence i skipped the big
delay..).
Then I was presented with a dialog with the
error code telling me to ask the company
what to do (and get an activation code..)
I decided to try my luck with the dialog,
and surely enough the code verification
routine was stupid. heh, I even managed to
remove the dialog completely making it think
I entered the right code.
Apparently as it seemed, the digital sig on
the CD was never required for the game to
run, but this is not the case with my new
project.
BTW, the anti-D trick that was used back then
was Meltice with CreateFileA, plain and simple.
Now I don't know if you'll recognize this
new game, but it's something called :
Play with the Teletubbies.
LOL
It's a BBC production, and the CD was made
in Israel too, as the prog is in hebrew.
(no, i'm not doing this for myself, I don't
know the 1st thing about those damn tubbies)
;-)
Now, what is happening in this one is the
whole DLL the code is executing in, is
totally encrypted and self modifying.
For example, if it wants to call an API,
doesn't matter which, it'll take some bytes
off someplace, do some calculations on them,
push it to the stack and ret. I found this
to be an API because the value pushed on the
stack looked suspicious. Programs don't usualy do a ret in order to jump to someplace
at bfffxxxx and above :)
It also features many many junk jumps so that you'll have to trace forever.
In any case, I've tried all Frogsice's AD
options to find out why it crashes when a
debugger is present (no matter which), and
not when a debugger is not present.
I'm basically clueless at this point, but
I might have an idea or two soon and I'll
probly go in and do some exploratory surgery :)

In the meantime, have fun all

Soth

PS.
risc, if you're really interested in this,
mail me.


MicroSentinelUX
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MicroSentinelUX
PDA

View Full Version : MicroSentinelUX

Microburst
11-30-2000, 10:06 AM
Does anyone have any information on this device? I'm been looking but to no avail.

Microburst


Big Problems @ my Australian fortress
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Big Problems @ my Australian fortress
PDA

View Full Version : Big Problems @ my Australian fortress

fravia+
11-30-2000, 11:06 AM
Dear friends,
my Australian fortress is going down once for all, since the ISP was sold (it's merry globalization time, isn't it? :-(

I'll redirect things during next week
In the meantime, should you want to visit, use the main mirrors, for instance

http://fravia.2113.ch/index.htm (Europe)

or

http://qu00l.net/s/www.searchlores.org/ (States)

spread & link on the board, if you believe it useful

The sad thing is that my new email system "@searchlores.org" is going down as well...

Fravia+

PS: +Tsehp, you still didn't told me if you like my new "anonymity" data & referrals...
tsehp
11-30-2000, 04:44 PM
hi f+,
Sorry for that, if you want me to help, I can give you an access to this site, the 6 gigs bandwidth is good enough to hold another mirror, you just have to tell, I'd be pleased. If you already have a searchlores
messageboard and if you are interested to maintain one here, I can add one too. I know you don't like a lot the American smiling figures
that are used here, but they can be disabled on local messageboards,
the perl script is quite well written and it's very easy to maintain.Every message is backup up and the board can be reconstructed in another place in half an hour.

Concerning the referals, all I can officially say here is that you're using
an ano proxy, located in chicago, ip 207.154.143.115, nothing more !
Let me ask disavowed about some few things...He could have some ideas who knows ?

Friendly yours,best regards f+
tsehp
12-02-2000, 02:17 PM
and I offer it to you if you ask, you can buy the license later if you think this script suits your needs.
NchantA
12-03-2000, 06:27 AM
australia rox ;)

i had to say that hehehe


question about offsets?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > question about offsets?
PDA

View Full Version : question about offsets?

pepperman
11-30-2000, 12:32 PM
are offsets all relative..ie, the address i see in Exdec, is it the same as w32dasm or Softice?? I cant seem to break on the address in exdec with si???


broken links in the essay by CyberHeg at +Tsehp mirror of fravia
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > broken links in the essay by CyberHeg at +Tsehp mirror of fravia
PDA

View Full Version : broken links in the essay by CyberHeg at +Tsehp mirror of fravia

Morlac
11-30-2000, 12:54 PM
After reading the essay "Removing need for dongle in Sentinel LM Wlscgen" by CyberHeg i tired to download the signature files linked in the essay to find the links broken.
Perhaps the problem can be rectified??
tsehp
11-30-2000, 04:32 PM
It's all fixed, sorry for this. I had to change from frontpage to dreamweaver and had some little linking problems at the beginning.
regards,

Tsehp


Winice Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Winice Reversing
PDA

View Full Version : Winice Reversing

latigo
11-30-2000, 03:15 PM
Hi there!
I don't know why but i happen to have some interests in the inner workings of Winice.
I've been searching in Fravia's old fortress and found that most docs about winice reversing deal with cracking the 'commercial' protection. But none (or very little) about how it works.
Needless to say any pointer is very much appreciated!!
Spath.
11-30-2000, 06:44 PM
Speaking for myself, I had started to write
such a document, explaining SoftICE
internals and undocumented commands,
breakpoints, FGJM/BCHK/INT 41 interfaces, etc.

But reading it back from the FrogsICE coder's
point of view, I realized that would give plenty
of free amnos to protectionnists. Not that I
care much about warez group crackers, I just
don't want mediocre coders to make money
by just copy-pasting what they find on the
Internet (like 99% of anti-debug code you will
find today).

Hmm, that's not very helpful I'm afraid, but that
could explain why you cannot find documents
about it (but you can still get IRC/message
board help).

Spath.
latigo
12-01-2000, 06:00 AM
Hey Spath! thanks for the reply.
I think your attitude was the right one and i agree with you; that info should not be given to copy-paste lammahs :).
But let me insist..all i need is some kind of pointer. Some starting point to begin unraveling. For example i would like to know how breakpoints are handled, where they are kept and so on.
If you could provide such starting point, i would appreciate it very much :). But again, i don't pretend your full doc, just some tip.
If you want/have the time to help me just mail the info to latigo_at_ciudad_dot_com_dot_ar.
If you cannot/don't want, thanks anyway :).

Bye and thanks Spath.
The Owl
12-01-2000, 12:43 PM
http://www.cdata.hu/~theowl/95ice322.zip

this will get you going, but you have a long road ahead... my time is simply too limited to help you (much) more, but feel free to ask specific questions, eventually i or someone else will answer.
latigo
12-01-2000, 02:00 PM
Thanks you maestro, i knew you were going to provide some pointers.
I know it's a long road..i'm ready to start walking! :)
Thanks very much again.
Spath.
12-01-2000, 08:37 PM
Speaking for myself, I had started to write
such a document, explaining SoftICE
internals and undocumented commands,
breakpoints, FGJM/BCHK/INT 41 interfaces, etc.

But reading it back from the FrogsICE coder's
point of view, I realized that would give plenty
of free amnos to protectionnists. Not that I
care much about warez group crackers, I just
don't want mediocre coders to make money
by just copy-pasting what they find on the
Internet (like 99% of anti-debug code you will
find today).

Hmm, that's not very helpful I'm afraid, but that
could explain why you cannot find documents
about it (but you can still get IRC/message
board help).

Spath.
Spath.
12-01-2000, 08:39 PM
grrrr, Opera again. Sorry :-(


working on asprotected file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > working on asprotected file
PDA

View Full Version : working on asprotected file

NikDH
11-30-2000, 05:41 PM
hi to all
I'm working on a file procetced by asprotect
When I disasm it with ida it shows me only a little piece of the the decryption routine
Some of that is encrypted by xoring it with a number
I'd like to know if it's possibile to write an idc file that acts on the idb file for xoring that bytes so i can look at them
I know its possible to dump them from mem when they r decrypted but doing so they r not in the idb file
I hope u can help me
Tnx
See ya
tsehp
11-30-2000, 07:01 PM
be patient, you will have pretty soon some very interesting news concerning asprotect. I can say no more at this time, just wait for 2-3 days...

+Tsehp


winice question about overclock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > winice question about overclock
PDA

View Full Version : winice question about overclock

NikDH
11-30-2000, 05:58 PM
Hi to all,
i've a little question about winice running the has been overclock
When the pc starts sice pops inside its own code (it says to be in winice) and if I make x all works ok but its quite strange sice pops isnt it?
Sorry but i dont remember other particulars about this thing
Does anyone know why?
Tnx
See ya


Thanks to Arthaxerxes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Thanks to Arthaxerxes
PDA

View Full Version : Thanks to Arthaxerxes

tsehp
11-30-2000, 07:08 PM
hi artha,
I finally followed your advices concerning the iat rebuilder, managed to
encapsulate and use the nasm library.
I'm very happy to advice that the tool now allows me to almost reconstruct the virgin target, and this time it's not depending on the asprotect version. I just managed to resolve 99 % of obfuscated/encrypted/redirected import,and spending 5 minutes on the others, your idea was just a really serious stab to such protection schemes :)
If you're interested (and everybody asking me), I'll be able to send you
the beta version.

Best regards,

+Tsehp
tsehp
12-01-2000, 06:43 PM
Yes you're right, integrating a good disassembler seems to be the future for certain things to be automated, like my app's task, resolving imports. The tool will be sent to you maybe sunday/monday.

To use nasm, I didn't encapsulated it inside c++ classes, I'm simply at the first level, working on c++ builder, I included disasm.h and disasm.c, I had to fix some bad references to the itable containing all the possible instructions, the set seems complete and it's easy to add some if there are missing ones. I'm sure you did much more work than me, but the disasm function is working well and actually just enough for what I did at this point. I'll send you my sources when I'll be finished, but they're not well documented.

The next very interesting step is to be able to avoid the tracer for serious encrypted functions, I surely have to take some heuristic search programming lessons to be able to do that, it's not an impossible limit anyway.

The method I used could be defeated later by more and more obfusctation techniques, I just hope that you'll provide a reusable dll to fix some annoying code parts, just like g-rom did with his several plugin's.

Thanks again, I'll send you (el caracol I don't forget you !) the first beta pretty soon.

take care,

+Tsehp
tsehp
12-04-2000, 09:56 AM
Yes, this could be very usefull in case we could have some obfuscation inside iat redirectors for example, making an auto disassembly harder for nasm.
Artha, did you check your mail at xerxes@altern.org have you tried
my beta already ?
Actually I managed to unprotect commview 2.3 and laster version of
azpr, the both in 15 minutes :)

later,

tsehp
tsehp
12-04-2000, 06:38 PM
yes,
if it's a problem I made a first version working with psapi.dll, but nt4
is going to disappear and toolhelp is implemented in win2000.
I could also synchronize the nt4 version but don't really think this will be asked by reverser's.
I'm actually starting the tracer, following owl's advices that are finally very usefull.
best regards,

tsehp


More on code injection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > More on code injection
PDA

View Full Version : More on code injection

garph0
11-30-2000, 07:44 PM
I managed to complete the API hooking project i was talking about some time ago :)
I use this tecnique:
1) prepare a memory mapped file with into the code i want to execute
2) run the target process suspended
3) copy the code at program entry point in the MMF
4) overwrite the code at program entry point with some code that maps MMF by name and jumps into it
5) resume the program

this works fine, and i widh to thanks killexx a lot :)
but for some programs i get "Application was not correctly initialized" as soon as i start this work...
Killexx told me that is a PE Loader problem, so i thought i could avoid this by injectiong the code at run-time.
this is pretty like the previous tecnique, but
1) i freeze the process main thread,
2) i save the CONTEXT
3) I do the operations as previously descripted
4) i fix the CONTEXT.EIP to program EP
5) i resume the thread

the code injected this time will not jump back to PEP after having put back original code, but will:
a) launch another thread and enter in a loop
b) this new thread will suspend the first one
c) will put back the original CONTEXT
d) will resume the original thread

ok. all this seems to work! the pain comes as soon as i want to close the second thread (the one generated just to fix the main thread):
- if i use a ret it will obviously fall back in nonsense crap somewhere in memory
- i cannot simply freeze it, 'cause it seems that windows doesn't like it too much (i have read that for correct message handling every thread needs to run for a little now and then), and anyway i'd prefer to close it
- a call to ExitThread() doesn't seem to work...

does anybody have an idea?

thank you very much

garph0

PS i know about CreateRemoteThread, but i want all this to work also under win9x :)
kill3xx
12-01-2000, 08:54 AM
hi,

garph0 (11-30-2000 09:46):
Killexx told me that is a PE Loader problem, so i thought i could avoid this by injectiong the code at run-time.

well.. problably my mail wasn't too clear (maybe too simplified) on this subject: strictly speaking it's not a prb of PELdr (win2k) itself:
AFAIK (from personal investigation on ntoskrnl , books , some threads in comp.xxx.nt../ms.plublic.xx/.kerne ng, REACTOS srcs snooping, etc..) the guilt for pbs with remote threads , CREATE_SUSPENDED, should be equally charged to CSRSS, SMSS, and the executive (NtCreateXX e Ldrxx) thread finalization code (mostly APC delivering & lpc ApiPort registration).
So i tend to summarize the pb as a PE loader pb since it actually fails to load/resolve correctly the modules.

for the u've with injected code/threads under win9x i continue to think that u've missed something in the register/stack restoration in ret OEP.. ehm no i've not tested ur code with xircon =) no time atm..

- a call to ExitThread() doesn't seem to work...

i cant see a reason why ExitThread does not work for this thread.. r u sure it's not till suspended ? NTStatus ?

Best Regards,

kill3xx
garph0
12-02-2000, 05:48 AM
Ok, so now i know the problem is somewhere in my code, and not in the way i've done all the stuff :)
Now i'm going to rewrite the whole thing, i hope i'll not run in toubles again :))
Thank you very much for the help :)

regards
garph0
garph0
12-02-2000, 05:48 AM
Ok, so now i know the problem is somewhere in my code, and not in the way i've done all the stuff :)
Now i'm going to rewrite the whole thing, i hope i'll not run in toubles again :))
Thank you very much for the help :)

regards
garph0
garph0
12-03-2000, 07:35 PM
excuse me for the double message above... it seems i need some more sleeping ;)

well people, the injector works (well, seems to)
i have rewritten the thing, and it seems that the problem was not with the PE loader, but with my code.

so now i'd like to thank you all for your help. hope i'll be able too, if you need :)

garph0
xOANINO [UCF]
12-04-2000, 07:46 AM
Well, for exiting your injected thread safely, i'd do in this "safe" way :

in the main thread, after creating the new thread to execute your stuff, issue a WaitForSingleObject on the new thread object. In this way, calling ExitThread in the new thread context will cause the event to be signaled and catched from the main, which then can resume normal execution, restoring context, etc.....

Hope i got ur problem, don't listen to kill3x coz he's leim (hi killo!!!!) :)))

xOANINO
[UCF]
garph0
12-04-2000, 01:23 PM
mmm well the idea is nice, but there is a problem:
the second thread has the task of restore the main thread to its original status before resuming it, so i cannot have a lock in the main thread waiting for the secondary to terminate, 'cause the secondary thread will overwrite my program memory & CONTEXT with the original ones :)

hope i've been clear, my english is not very good ;)

regards
garph0


+tsehp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > +tsehp
PDA

View Full Version : +tsehp

Dawny
11-30-2000, 09:55 PM
can u read my previous post maybe u can help me thanks


Code injection under DOS in WinME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Code injection under DOS in WinME
PDA

View Full Version : Code injection under DOS in WinME

JimmyClif
12-01-2000, 04:37 AM
We all know that it is possible to restore the DOS under WinME.
Now a friend of mine asked me if it was possible to recreate the functions and routines which were left out in command.com again.

Unfortunately I don't have WinME so I don't know which functions are left out besides those with the HardDisk access and the execution of the startup files like Config.sys and Autoexec.bat... And I never heard about code injection under DOS either...

I'd appreciate every glimpse of help (maybe it is possible to reconstruct a working Windows out of ME :) )

TIA JimmyClif


Is it asp-protected ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is it asp-protected ??
PDA

View Full Version : Is it asp-protected ??

spekkel !
12-01-2000, 05:21 AM
Working on a proggy ultra win-cleaner 2000 form www.blcorp.com. I think it is asp-protected but i am not sure..i have earlier seen this protection with cdclone.. but in both cases i failed to unpack cause i couldn,t find the real entry-point....I tried with several unpack progs (rad caspr etc.) and manually but all failed. So anyone who knows how to deal with this please help. Thanks in advance...... SpeKKeL!...
tsehp
12-01-2000, 06:46 PM
like the other thread on this topic : be patient, I'm finishing a tool that will fix (or only the hard part) this protection.
To learn more, use the searching engines on the mb and on the site, you'll learn a lot.

Tsehp
spekkel!
12-02-2000, 03:44 AM
thanks for your reply, I'll be patience.........( but hurry) (he,he just kidding)
tsehp
12-03-2000, 10:48 AM
The tool public release will be delayed... I actually managed to unprotect commview 2.3 with it, and very easily but it actually lacks a tracing feature to make it very hard to beat. Otherwise, if I spread it now it could be defeated too easily by our well known asprotect creator.

While waiting, you can read the precedent essays concerning asprotect, learn about the pe-file structure and attempt to rebuild a dumped file manually, write when you're at this point and I'll help further.

regards,

Tsehp
terces123
12-16-2000, 03:54 AM
HAve had a look at this - it is protected with ASProtect!


tracing exception handlers in NTIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > tracing exception handlers in NTIce
PDA

View Full Version : tracing exception handlers in NTIce

tony b.
12-01-2000, 09:00 PM
Consider
(1) int 0x0d
(2) xor eax, eax
mov eax, [eax]
Both of these cases produce a GPF (right?) But in SoftICE,
if you use F8 to step into the int 0x0d handler, you
wind up in _KiTrap0D in ntoskrnl, whereas if you hit F8 over the mov eax, [eax],
you wind up in ntdll.dll. Shouldn't both of these cause a
jump to the same handler given in the IDT? At least the Intel
dox seem to say so. What have I missed? Thanks.
The Owl
12-02-2000, 01:40 PM
Consider
(1) int 0x0d
(2) xor eax, eax
mov eax, [eax]
Both of these cases produce a GPF (right?)

it depends ;-).

1st one always causes a GPF in a user app if the IDT descriptor has DPL=0 which i think is the case in both 9x and nt.

however, the 2nd one can cause either a GPF or a page fault. in 9x you will get a GPF because the win32 data selector/descriptor specify an expand down segment whose lower limit is not 0 (some 4 digit value, don't recall it). this is the way 9x catches null pointer dereferences from win32 apps without interfering with the V86 part of the system virtual machine. in nt you will get a page fault as the win32 data segment is a true flat one and the paging logic is used to catch null pointer related problems.

But in SoftICE, if you use F8 to step into the int 0x0d handler, you
wind up in _KiTrap0D in ntoskrnl, whereas if you hit F8 over the mov eax, [eax],
you wind up in ntdll.dll. Shouldn't both of these cause a
jump to the same handler given in the IDT? At least the Intel
dox seem to say so. What have I missed? Thanks.

enter softice... and turn the world upside down ;-). the exception generated by the CPU on a faulting instruction has nothing to do with what (and when) you see in the debugger. it is entirely up to the designer of the debugger when he chooses to notify the user about it (if at all). softice hooks many exception handlers for various purposes and does its own processing before it decides to pass it down to the OS kernel or pop up the softice window or just let everything go as if nothing had happened. so the intel manuals are right, and you'd be better off with reverse engineering both the NT and NTICE exception handlers to get a better picture.
tony b.
12-03-2000, 08:43 PM
Yes, that explains it. The 'idt' command presents a fake IDT,
pretending SoftICE isn't loaded. The real interrupt offsets can
still be seen in memory. Thanks for your help.
tsehp
12-07-2000, 06:32 PM
no all handlers, just take a look at int 1 for example, it points directly
to ntice if you browse the idt gate, but if you just look at ide results,sice will show you the real win address, hiding the sice handler.


VBcracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VBcracking
PDA

View Full Version : VBcracking

Deimos
12-02-2000, 07:18 AM
Hi!
This board has changed both in design & location !
The new look is great, but the problem I got is quite funny...

I started cracking and all that stuff and always I've read that cracking VB was easy... but when i tried... i did fail... until I got a patch for W32Dasm so it could desasamble VB progg's, but It doesn`t work for VB6...

I tried looking for Doddy's decompiler... no luck that thing doesn't seem to work even for small proggs...

So I'm looking for some help...

can any one help me? my actual target is a huge and dedicated proggy and I don´t know where to start...
4oh4
12-02-2000, 05:29 PM
Well what program are you working on for starters?

That said, what kind of protection does the app have? (i.e. time trial, serial, limited/diabled functions, etc)

Now, is it normal code or pcode? (This'll help determine what sorts of tools you'll need for the job)

That's as much as I can help without knowing at least that much.

--4oh4
evc_viper
12-03-2000, 05:17 AM
mind telling us what is the program and where to download it?
NchantA
12-03-2000, 06:17 AM
VB Cracking, fun for all ;p

for normal vb stuff, try and use Numega SmartCheck (http://www.numega.com) else if its pcode, the only program i know of that can help (apart from softice of course) is my buddy jocos ExDec, (#cracking4newbies on efNET (type !exdec))
Deimos
12-05-2000, 04:14 PM
The target is a contability program, named BASEGES, it is spanish, and I don't think u can download it... too big... any way the URL is www.pi-sa.net or www.baselec.es

the proteccion scheme... well filemonitor said it was looking for a key disk, to get a code ¿? and then I had to get a licence number from them with both the aplication get's registered... (well, i guess is not too much, but I'm not but a newbie I think :( )
There is a CRC check too (the aplication says so...)

and there is something that disturbes me a lot... it sais it's illigal to decompile, disensamble or modify any file... ;)

Pcode ? don't know what it is... but dody's kind of check said it was not protected... so i guess it's not :)
Erovin
12-05-2000, 04:52 PM
I just saw this thread and had a similar question about a VB6 program. The program is called DataFit and it can be downloaded from http://www.oakdaleengr.com/download.htm

I have spent hours trying to track down where the license code gets verified but have had zero luck so far. It seems to use Unicode strings.

P.S. How do I turn on "HTML Tags"? When I post the indicator says they are "off".
Eternal Bliss
12-06-2000, 10:10 AM
http://ebliss.cjb.net
zouzouni
12-06-2000, 12:36 PM
http://www.immortaldescendants.org/database/tornado/notes092000/p06_10.html -general about VB cracking
Lord Soth
12-06-2000, 06:46 PM
i've wrote a simple essay describing how
to you SmartCheck to reverse VB5 and 6 non-pcoded apps.
It can show you the basics of how to approach a VB program, in case you don't know how to do it with SI.
Just thought it might help ya out..

BTW, VB uses widechar (or was it the other one? somethign with Ucode.. forgot..) by default.

Also, EB's site (look up for URL!) is a great resource for approaching VB progs, espeically with SI.

The URL for my essay is :

http://www.immortaldescendants.org/database/essays/lordsoth/vb-sc.txt

Good luck dude, and once you figure VB out, you'll see why it's a joke ;p

Soth
Erovin
12-08-2000, 05:23 PM
Very nice essay. Your command of English is appreciated. Many essays are very hard to read because the authors speak English as a second or third language. They are understandable, but even the best-written ones need to be read and re-read several times. When you add bad English into the mix it's a sure prescription for headaches. Good job!
McCodEMaN
12-25-2000, 01:05 PM
www.tres2000.cjb.net


Sentinal LM ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinal LM ?
PDA

View Full Version : Sentinal LM ?

Inbread
12-02-2000, 05:10 PM
Where can one get the SDK?
Looked at www.rainbow.com and no luck.
Also is this compatible to older Elan LM?

Inbread
OnLive
12-02-2000, 11:53 PM
They send it to you when you call them, It will upgrade elan but not work directly with them.
Inbread
12-03-2000, 12:10 AM
Mmmmhh.
So you just call Rainbow and say you want to reverse engineer their customer's software thereby rendering Rainbow's expensive product useless?

Has anyone posted it on a forum or freedrive or ftp site?

Thanks,
Inbread
OnLive
12-04-2000, 06:53 PM
Well if you put it that way then they probably won't sent it to you, but if you ask in a resonable manor like I did they are more than happy to send you a disk and give you a download page if you want it.

PS: Don't use the line "reverse you customers software", Oh BTW they also sent me the dongle kit software for Mac & PC

OnLive
Mark
12-07-2000, 01:36 AM
Can you share it to everybody ?
OnLive
12-15-2000, 08:18 AM
Where would I put it?
CrackZ
12-15-2000, 06:26 PM
Hiya,

RE: SentinelLM SDK 7.1 and where to get it.....

Having recently downloaded my full copy (83Mb's) from a very kind source, I can honestly say that apart from the manuals (API guides) and several lib's theres not that much thats really of interest ;-).

If anyone want's what I deem to be useful (about 8Mb's in all) then drop me an e-mail. If you can wait a little all this stuff will find its way onto my webpage on the 5th/2001 anyway....

Regards

CrackZ.
Nagual
12-19-2000, 09:17 AM
Mr. CrackZ, do you have a ElanLM v5 or v6 API guide or SDK?


Newbie in need of help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Newbie in need of help
PDA

View Full Version : Newbie in need of help

Dr_Kong
12-02-2000, 10:00 PM
Hi. I'm new to the cracking scene, and I'm not begging for help, I was just wondering if anyone can direct me to some good, *up to date* cracking tutorials and texts. If you can, it would be greatly appreciated.

Dr_Kong
evc_viper
12-03-2000, 05:25 AM
I am not sure which site has *up to date* cracking tutorials, but you sure will find a lot of tutorial at

http://krobar.cjb.net/

The protection schem is not really changed a lot for programs, I will say 50-50. (exception packed program so to speak.)

Hope this help.
tsehp
12-03-2000, 02:09 PM
Cracking is a very big world, in what section do you need some help ?
By section I mean time limited trial, dongles, packed targets, encrypted programs and so on...
You could also start on easy targets, my first one was registering winzip for example.

regards,


Some really good news...and asking for help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Some really good news...and asking for help
PDA

View Full Version : Some really good news...and asking for help

tsehp
12-03-2000, 05:31 AM
The new tool I'm building finally succeeded to remove an asprotect 1.05 on commview 2.3, the good new is that this was made without
touching anything concerning asprotect, meaning that now the program can virtually unprotect every past, actual and I hope for a long time future versions. The tool could also unprotect *every*
iat-protected scheme based targets.
Actually, it's on beta version with arthaxerxes and el Caracol, they're helping me to finalize the product.
But, I plan to publicly release it when it will be perfect and hard to defeat, for that to be done, I need a guy that is able to code in assembly some tracing functions.
Precisely : The function should work on ring 0, my c++ compiled app
feed the function with : -thread or proc id
-starting address to trace, this address is a thunkslot, the program must be forced to go here when the function is called
-low and high EIP to report, meaning that the tracer returns the address where it finally lands if its between those high and low addresses.
Then if possible, the program is restored to it's original state, to allow us to trace another address.

I know this is hard to implement, this feature is almost already constructed in icedump's latest version, my problem is that I would like to release the tool ASAP, so this could speed up a lot the final part of this project.

If someone is able & interested to code this, email me directly at
tsehp@yahoo.com

best regards,

Tsehp


W32dasm disassembled: dead link?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > W32dasm disassembled: dead link?
PDA

View Full Version : W32dasm disassembled: dead link?

MO K
12-03-2000, 04:05 PM
http://www.woodmann.net/fravia/harlequin_wdasm.htm

The two links given there don't work, looks like a relative path which works there on the server, but not in here in client land.

I don't have a problem with my firewall/proxy, So I guess it is a dead link.

The paper `looks' good otherwise ;-)
tsehp
12-03-2000, 04:15 PM
It's only a bad link problem, just fixed. I'll change my vodka brand in the future ;-)

tsehp


mb suggestion: Reverser statistics, bloody paranoia.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > mb suggestion: Reverser statistics, bloody paranoia.
PDA

View Full Version : mb suggestion: Reverser statistics, bloody paranoia.

MO K
12-03-2000, 04:39 PM
Hello Tsehp :-)

I have just noticed the logging of the number of times a given thread is read.

IMHO, A troller could use this info to sort out the interests of this community.

I could give examples on this, but I am sure you understand what i mean.

Nuke it if you can, if the majority agrees.
MO K
12-03-2000, 04:56 PM
___RCE Discussion Forum. (total 155 members)___

Whoah, now I know exactly how many of them are in the "know how" bussines, let's see if we can categorize them, Said Dr.EvilMon.

After reading several posts, with variying content (i.e. "anounce: new tool", "help, nag screen", "where can I get FlexLM sdk", "MSDN docs, where?", etc.)
Dr. EvilMon estimates the average of programmers/newbies/+reversers in this board, and uses this knowledge to create his own `skined' posts, to further fish more info.
tsehp
12-04-2000, 03:53 AM
I understand what you're meaning, the problem is that if I follow this,
I'm oblidged to also remove the members menu, disable the possibility for members to register also, he can use teleport to get all the messages an scan them to see some resulting from registered members.
Then the troll comes here and begin to mess with the messageboard,
then the four moderators here decide to ban the user,no more posts.
Or he tries, like golem to destroy the mb and reports our provider of criminal activities, like this happened 4-5 weeks ago, no results with this. Even if this happens, I can reconstruct ths place elsewhere in less than one hour, only the domain changes and everything stays the same.

Finally he tries to build a better mb than this one, I think people will move if they find a real interest to do that, meaning that they could learn better, have more docs or essays or something else.
Ok I'll learn then what is really missing here, I just can add the features required for people to stay here. My purpose was to rebuild a good place to stay, without trollers and useless and boring messages,
I choosed this script for this purpose and the result is here : I only had to delete 3 crack requests since this mb started, a question even from a newbie is answered in less than two days, people really collaborate here. I think they know that this time we wanted this place to be a reliable one, with all their typing work to stay, be backed up and never disappear.
Maybe something else could happen, but I'm not alone to support this place, you have Sandman, Carpathia, Disavowed, Amante4, Disavowed and Fravia, all of us are motivated to make this a place to stay.
Best regards,

+Tsehp


Can someone kindly show me a tutor how to unpack packed dll(VBox)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Can someone kindly show me a tutor how to unpack packed dll(VBox)?
PDA

View Full Version : Can someone kindly show me a tutor how to unpack packed dll(VBox)?

touchzen
12-03-2000, 10:49 PM
The target is slickedit 6.0. It used vbox 4.3. After 4 days hard try, still no result. Anyone know some good relative tutor please help.
evc__viper
12-03-2000, 11:10 PM
This should help.
http://www.woodmann.net/fravia/dezzy_vbx43tut.htm

Visit http://tsehp.cjb.net/ and I am sure you will find some other other there. good luck.

EVC_ViPeR
tsehp
12-04-2000, 03:56 AM
Yeah, this tut is a very good one and I use it a lot.
But recently, I had some IAT problems while trying to rebuild the dumped target's import allocation table, but if you correctly disable
the iat encrypting like it is said in this tutor, you can easily rebuild the import table with procdump, then fix the OEP and the app works fine.


Hmm.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hmm.
PDA

View Full Version : Hmm.

Nolan Blender
12-03-2000, 10:50 PM
Could be the vendor defined hostid - read your email.

--nb.


Help with achilles'shield 3.0.........
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with achilles'shield 3.0.........
PDA

View Full Version : Help with achilles'shield 3.0.........

SpeKKel
12-04-2000, 07:54 AM
Can,t trace what is happening, it makes a random temp-file and runs...How to start ?? disassembled
all exe's and dll's with no result. Url
:www.indefense.com Thanks Spekkel........
tsehp
12-04-2000, 06:40 PM
what's the kind of protection ? time trial, serial ? give more details please.
SpeKKel!
12-05-2000, 04:23 AM
It's a time protection, (15-day's) first a get a nag from soft-trade.com with the options:buy ,rent,try all comes from the temp file (with random name ) it uses vtcpak24.dll ( witch i disassembled but can,t find anything)........
LaptoniC
12-05-2000, 07:41 AM
I guess it is protected with Elicense (vtcpack24.dll(.It is easy to unpack.
* When try/bu dialog appears go to Trw2k or softice and put bpx on getprocaddress.
* Hit try button
* Trace the code until you see jmp ebx ,ebx is OEP
* with trw2k F8 to this code and type makepe you have exe file in trw2k or program directory without limitations.Btw dont forget to rename dumped exe to original name.
SpeKKel!
12-05-2000, 09:09 AM
okee thanks i hope to manage it soon, the only thing is that after the nag is appeared there is no call to getprocaddress, so nothing to break.......
I think i must break before the nag ?? I'll look further for elicense on the web........SpeKKel!.......
SpeKKel!
12-05-2000, 10:31 AM
maybe because it's expired...........?????or is it another protection ??? SpeKKeL!


Install Shield 6... + Dongle Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Install Shield 6... + Dongle Protection
PDA

View Full Version : Install Shield 6... + Dongle Protection

Georges Coolio
12-04-2000, 03:36 PM
Hi,
Here is the target : LightWave 6.5 Update ( http://www.newtek.com/lightwave/downloads/patches/intel/lw65_intel.html )

1. What is exactly "Severe" ( "No Dongle detected, ..." message box title )? Is is proprietary to InstallShield or is it the dongle protection's name?
2. Could someone help me to reverse this protection ( If a tutorial exists, please link it )
3. Can I find the answer to my question on the +fravia's REWebSite? If yes, which tutorial.
4. Do you know a good tutorial on Reversing installations made with the latest version of InstallShield (6.*)? I would like to know how to reverse the installation listing (like with isdcc for versions <5) if it is possible of course(Encrypted???)?
5. Afterwards there will be dongle protection in the program itself, so how to reverse it ?
6. I thanks all people who'd answer these questions ;)
tsehp
12-04-2000, 06:50 PM
Georges Coolio (12-04-2000 05:36):
Hi,
Here is the target : LightWave 6.5 Update ( http://www.newtek.com/lightwave/downloads/patches/intel/lw65_intel.html )

1. What is exactly "Severe" ( "No Dongle detected, ..." message box title )? Is is proprietary to InstallShield or is it the dongle protection's name?

Installshield can call the protection's dll, it is most probably the case here, did you try to trace back the messagebox ?

2. Could someone help me to reverse this protection ( If a tutorial exists, please link it )

If you're speaking about the dongle protection, you can start with a dongle search here, or consult the crackz site, it's all dongle oriented.

3. Can I find the answer to my question on the +fravia's REWebSite? If yes, which tutorial.

Again, you could have a good start trying to look where this messagebox comes from. Try those different bpx with softice :
-messageboxa
-createwindowexa
-showwindow
Locate the code that call this nag and the file where it comes from, surely the messagebox could come from installshield but the vendor's dll is certainly called before, you can also try to see all the modules currently loaded while the message is displayed.

4. Do you know a good tutorial on Reversing installations made with the latest version of InstallShield (6.*)? I would like to know how to reverse the installation listing (like with isdcc for versions <5) if it is possible of course(Encrypted???)?

Not to my knowledge, installshield 6 uses m$ msi installer now, they surely had to change a lot of things, you'll have to use softice a lot ;)

5. Afterwards there will be dongle protection in the program itself, so how to reverse it ?

Just consider the dongle to be a call in the program, it returns parameters, it's up to you to use the right breakpoints in sice, bpio for example freezes the program if some data goes thru the io ports.

6. I thanks all people who'd answer these questions ;)
Maldoror
12-05-2000, 06:26 AM
Georges Coolio (12-04-2000 05:36):
Hi,
Here is the target : LightWave 6.5 Update ( http://www.newtek.com/lightwave/downloads/patches/intel/lw65_intel.html )

1. What is exactly "Severe" ( "No Dongle detected, ..." message box title )? Is is proprietary to InstallShield or is it the dongle protection's name?

As you probably know when you write an IS installation you use the InstallScript language. You create a setup script(.rul file) which is then compiled to .inx file. This is something like exe which is executed by the IS engine during the setup process.
IS script language provides a MessageBox function(MessageBox(szMsg, nType);). The nType param can have the following predefinded values: INFORMATION, WARNING and SEVERE. So the "Severe" caption means that you see a message box called IN the compiled script. The message is : "No Dongle detected, ...". This means that a function in a custom dll is called(just before the MessageBox) in order to check the dongle presence.
Where is that dll?
In most cases when the setup engine initializes, it decompress the custom dlls in a temporary folder(i.e. d:\temp\{f51d162e-c20e-11d4-9228-004854519651}). So after you see the first setup screen such a folder should be created in your temp foledr. I suppose you will find there the suspect dll. You could copy the dll(s) in a different foler and reverse it. You could patch the check for dongle presence. But the most difficult part of the task begins here.
The question is "How to force IS engine to use the patched DLL?".
Unfotunately I don't know the answer of this question at the moment. A stupid idea is to trace the setup with a debugger and to copy the patched dll in the appropriate folder.(This should be perfomed when the protection dll first appears in the folder, but before the call to UseDLL - the IS version of LoadLibrary).

2. Could someone help me to reverse this protection ( If a tutorial exists, please link it )
Refer to +Tsehp's message
(I colud try it if I have time for it...)

3. Can I find the answer to my question on the +fravia's REWebSite? If yes, which tutorial.
4. Do you know a good tutorial on Reversing installations made with the latest version of InstallShield (6.*)? I would like to know how to reverse the installation listing (like with isdcc for versions <5) if it is possible of course(Encrypted???)?

Well, there are two products by InstallShield Corp.: "InstallShield for Windows Installer" and "InstallShield Professional" - the first uses the MSI and the second don't.
IS Proffesional v6.22 is very different from IS5.5.
So I don't think there are any reversing tools or tuts concerning this version.

5. Afterwards there will be dongle protection in the program itself, so how to reverse it ?

Refer to +Tsehp's message
Maldoror
12-06-2000, 11:03 AM
Hi again
I downloaded the setup and started the self-extracting exe.
The "No dongle ..." message appeared. In this moment I found the following new folders in my temp folder: "{f6ad52ed-b954-4bb6-8144-6648da3839ea}" and "pftAA~tmp\Disk1". The first one contains the dlls:_IsRes.dll, _IsUser.dll, isrt.dll(these are the IS dlls) and a dll named: tkey.dll(Nice name :-)). The folder "pftAA~tmp\Disk1" contains the decompressed setup. So I saved the setup files and the tkey.dll in different location and exit the setup. The tkey.dll contains two exported functions: TestHWLock ;-) and TimedKey. So I patched the function TestHWLock to return "appropriate" value. The next task was to force the setup to use my dll. Fortunatelly the IS Corp. provides two very usefull utilities: iscab.exe and iscabvu.exe which IMHO are very good reverse tool(thanx guys :-)).
Iscab.exe is a command line tool for exploring the IS .cab files(these are different from these of M$). It allows deleting, listing the contents, adding, and (NB) replacing of arbitrary files in the setup's cab files.
According to doccumentation: "The InstallShield Cabinet File Viewer (ISCabVu.exe) lets you select an InstallShield cabinet file and view its compressed files, file groups, components, and setup types and the properties of those items. It also lets you extract files from the cabinet file."(Note the last sentence!!!).
OK, using iscab.exe I replaced the original tkey.dll with the patched one.
Then I started the setup again. There was no "No dongle ..." message :-)
Everything was OK but when I had to select the dest location I got the message: "LightWave 6.0 or higer is not installed in this directory".
That's right - I don't have the version 6...:-)
Hope this helps!

Maldoror
(mmaldoror@hotmail.com)
Georges Coolio
12-06-2000, 02:09 PM
Thanks a lot ;)

I can get the *.cab files (u can unzip the .exe), I'm now trying to remove the dongle check but I haven't got your IS utils.

I've got i5comp & i6comp but they don't run so I don't tried to remove the dongle check in the dll's but by tracing the dongle protection (it's a little hard) and remove it in memory only. Now I know it's possible so I'll do this in that way but would you feel free to send your utils to me ;)

And again, thanks a lot ;)

[georges.coolio@usa.net]
goatass
12-06-2000, 02:36 PM
Hey guys,
Do you have any idea of what dongle it uses ?
HASP, Sentinel ? that will narrow down your points of attack by a great deal. Many times it's as easy as opening the file in a Hex editor and doing a text search for HASP or RNBO (sentinel). I suggest you patch the dongle dll that you found in the setup folder it will most likely be used by the program later on so you won't have to do the work twice.

goatass
Anticode
12-07-2000, 04:37 AM
there is a utility in installshield 6 that can extract the new .cab files, can't remember the name though.
Maldoror
12-07-2000, 06:31 AM
Hi,

Georges Coolio > "Now I know it's possible so I'll do this in that way but would you feel free to send your utils to me"

There is a way to find them for free here:
www.installshield.com

goatass > "Do you have any idea of what dongle it uses ? HASP, Sentinel ? that will narrow down your points of attack by a great deal. Many times it's as easy as opening the file in a Hex editor and doing a text search for HASP or RNBO (sentinel). I suggest you patch the dongle dll that you found in the setup folder it will most likely be used by the program later on so you won't have to do the work twice."

Well, I took a look at the dissasembly listing of tkey.dll(and my cup of vodka :-)) and I felt there was a statically linked spromeps.lib. This means that they use SentinelSuperPro(IMHO).
I don't believe they use the same dll(tkey.dll) for the setup protection and the protection of the final product.
I don't know...I don't have the product itself...

Greetings!
Maldoror
(mmaldoror@hotmail.com)
·TeKiN [²K]
12-07-2000, 03:46 PM
Hi,

Maldodor> How did you manage to get the "appropriate" value. I mean by that where does the TestHWLock return his value(s). When I disassembled tkey.dll (W32Dasm) I get this code for the TestHWLock Exported function :

Exported fn(): TestHWLock - Ord:0001h
:10001000 83EC04 sub esp, 00000004
:10001003 6804040000 push 00000404
:10001008 6890520110 push 10015290
:1000100D E89E010100 call 100111B0 ---> Test I ???
:10001012 6685C0 test ax, ax ---> Okay?
:10001015 7409 je 10001020
:10001017 B89BFFFFFF mov eax, FFFFFF9B # Retuned values if test failed ???
:1000101C 83C404 add esp, 00000004 #
:1000101F C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:10001015(C)
|
:10001020 6890520110 push 10015290
:10001025 E8E6010100 call 10011210 ---> Test II ???
:1000102A 6685C0 test ax, ax ---> Okay? So...
:1000102D 7409 je 10001038
:1000102F B89AFFFFFF mov eax, FFFFFF9A
:10001034 83C404 add esp, 00000004
:10001037 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000102D(C)
|
:10001038 6889C80000 push 0000C889
:1000103D 6890520110 push 10015290
:10001042 E819040100 call 10011460 ---> Test III ???
:10001047 6685C0 test ax, ax ---> Okay?
:1000104A 7409 je 10001055
:1000104C B899FFFFFF mov eax, FFFFFF99
:10001051 83C404 add esp, 00000004
:10001054 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:1000104A(C)
|
:10001055 8D442402 lea eax, dword ptr [esp+02]
:10001059 50 push eax
:1000105A 6A00 push 00000000
:1000105C 6890520110 push 10015290
:10001061 E81A060100 call 10011680 ---> Test IV ???
:10001066 6685C0 test ax, ax ---> Okay?
:10001069 7427 je 10001092
:1000106B 6A64 push 00000064

* Reference To: KERNEL32.Sleep, Ord:023Ah
|
:1000106D FF15EC710110 Call dword ptr [100171EC]
:10001073 8D442402 lea eax, dword ptr [esp+02]
:10001077 50 push eax
:10001078 6A00 push 00000000
:1000107A 6890520110 push 10015290
:1000107F E8FC050100 call 10011680
:10001084 6685C0 test ax, ax
:10001087 7409 je 10001092
:10001089 B898FFFFFF mov eax, FFFFFF98
:1000108E 83C404 add esp, 00000004
:10001091 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:10001069(C), :10001087(C)
|
:10001092 8B442402 mov eax, dword ptr [esp+02] # Returned values if tests passed ???
:10001096 83C404 add esp, 00000004 #
:10001099 25FFFF0000 and eax, 0000FFFF #
:1000109E C3 ret

So am I right??? If yes the only thing to done is to reverse the jumps (je > jne) to get the good returned values or have I to analyse it more?

Just a little help will be welcomed.

Oh, also, do you have another place to get the iscab & iscabvu files because ~100Mb to download to get these files takes me a lot of time (56k)? ;)
Maldoror
12-08-2000, 07:00 AM
·TeKiN [²K] > "So am I right??? If yes the only thing to done is to reverse the jumps (je > jne) to get the good returned values or have I to analyse it more?
Just a little help will be welcomed."

Yes you are right :-)

>Oh, also, do you have another place to get >the iscab & iscabvu files because ~100Mb to >download to get these files takes me a lot >of time (56k)?

You don't need to download these 100MB.
There are 2 options for downloading on the site, so you can choose to download only the utilities...
It doesn't matter.
I could send these utilities to someone who will upload them somewhere in order to be available to everyone who need them.
Any ideas?

Maldoror
·TeKiN [²K]
12-08-2000, 07:58 PM
Thanks Maldoror. Now I'm doing my website on RE, 3D Graphics, and a lot of my stuffs. It will be ready just after the new year I hope :)

I'd like to do something between protools for tools and the EXCELLENT +Tsehp mirror for the tut's but with a hard selection of them. I don't want to do the same, you see. So could you send me the files? I've not found them yet but when my website will be ready, there will be there ;)

Greetings
·TeKiN[²K]
klojo
12-09-2000, 04:56 AM
[1. What is exactly "Severe" ( "No Dongle detected, ..." message box title )? Is is proprietary to InstallShield or is it the dongle protection's name?

Installshield can call the protection's dll, it is most probably the case here, did you try to trace back the messagebox ?

you have to start your package from the web install and after that it runs the installshield.
when it does look in your windows temp dir.
there are the files and dll it uses during installation.
now there's one dll wich is called tkey.dll this contains an export function
testhwlock set a bpx in softice and the rest is up to you.

sure after you cracked the installshield, you have to crack the program itself.

If you have the version of 6.0 without the update cracked you can search with w32dsm for the differenties.

i am in the process of hacking it myself did the dongle crack and cracked the program it starts and then .... there is some other check else where the license.key file.

can anyone help me out here?
·TeKiN [²K]
12-11-2000, 05:00 PM
Well, I found the Utils and I "installed" it. Not with InstallShield Setup because I was not able to use my patched tkey.dll file (when I used iscab.exe, it told me that it couldn't decompress files compressed with older versions ??? ) but anyway you can use iscabvu.exe to extract them all and why it runs with this one, don't ask me ???

(Here is the link where I found them : http://playtools.cjb.net)

Well as Lightwave doesn't need a lot of files like 3DS Max, you are normally able to run the software just by extracting all program files from the update (with dll's, don't need plugins now).

So let's begin, if you disassemble modeler.exe you find a string reference to "Hardware Key Not Found" but when you try this with Lightwave.exe...nothing and the error is not the same. If we look in the program dir, we see *_err.enu files. I'm sure that these files contain ASCII Strings for the error messages but they are crypted or compressed?

1. Will dead listing help me to find the code to decrypt/unpack them ???

I know the code used to check if the hardware key was present from tkey.dll, if we suppose the soft use the same protection routine, we must find something.

2. I would like to compare the tkey.dll code and to try to find a part of it in both .exe's. Is it possible to do this with IDA ??? If not is it the same to do this with a hex editor? I thinks yes but is it that sure to find them correct code?

3. What are the API usally used for a dongle protection? They must deal with COM ports but, new since LW[6] I think, with USB ports too.

4. If you put a bpx on MessageBoxA, ...(See +TSehp Message) will it be easier to get the dongle routine or not?

5. This is the best site on the WEB ;) Enjoy it ;)

·TeKiN[²K] - tekin.2k@usa.net
molac
12-11-2000, 05:32 PM
Ok, Lw6 again.

I have cacked this programme since version 4.
Every time i search for
push 0404
in IDA, as you might know if you read Sentinel Dev docs, this is the packet size that gets sent to to sentinel driver.
Anyway, only two global routines to check the dongle are present in lightwave ( havent check v6.5 but 6.0b has only those two)
The first, initializes the donlge.
The second reads different cell fom the dongle.
There is another potection which relies on a license key.
If you locate the routine that does the cell reading in IDA, follow the coross references and you will find.
Another way:
Search for license.key in lightwave.exe and follow the cross refences and at the top just before calling the lic.kay check routine, the dongle read cell routine is directly above it.
also you can search fo "R/0" and "R/1" and similar ones. Those are cells to be read. If i remember, thos are referenced where lightwave is checking the dongle.

Hopefully this will fix your problem

Morlac
·TeKiN [²K]
12-12-2000, 04:05 PM
Hi, Morlac, it's the first time I deal with a dongle protection so I don't know much about it. Well I tried what you said, search push 0404 but without succes but the second way is OK, now some questions...

1. There are a lot of R/0, R/1, ... Have I to check them all to find the main call?

I found this code for R/0 :

loc_42964D: ; CODE XREF: sub_429070+4E2j
0042964D ; sub_429070+513j ...
0042964D cmp dword_4BA69C, ebx
00429653 jge short loc_4296C7
00429655 push offset aR0_0 ; "R/0"
0042965A call sub_496D40 - Call the following part
0042965F movsx eax, ax
00429662 push eax
00429663 call sub_497950 - Call Licence.key check
00429668 add esp, 8
0042966B cmp eax, ebx
0042966D mov dword_4BA69C, eax
00429672 jge short loc_42967E
00429674 mov dword_56D8C4, 1

And I think it's this code the real check (the calls in bold call some checks who look like familiar with tkey.dll code and they return eax, 0000FFFF both so ???) and this call is called twice.

00496D40 sub_496D40 proc near ; CODE XREF: sub_4102D0+8p
00496D40 ; sub_429070+5EAp ...
00496D40
00496D40 arg_0 = dword ptr 8
00496D40
00496D40 push ecx
00496D41 mov eax, [esp+arg_0]
00496D45 cmp byte ptr [eax], 52h
00496D48 jnz short loc_496DBA
00496D4A cmp byte ptr [eax+1], 2Fh
00496D4E jnz short loc_496DBA
00496D50 lea ecx, [esp+arg_0]
00496D54 add eax, 2
00496D57 push ecx
00496D58 push offset aHd_16 ; "%hd"
00496D5D push eax
00496D5E call _sscanf
00496D63 mov eax, [esp+0Ch+arg_0]
00496D67 add esp, 0Ch
00496D6A cmp ax, 4
00496D6E jnz short loc_496D79
00496D70 mov eax, 3Ch
00496D75 mov [esp+arg_0], eax
00496D79
00496D79 loc_496D79: ; CODE XREF: sub_496D40+2Ej
00496D79 lea edx, [esp+0]
00496D7D push edx
00496D7E push eax
00496D7F push offset dword_5388C0
00496D84 call sub_49E780
00496D89 test ax, ax
00496D8C jz short loc_496DAF
00496D8E push 64h
00496D90 call ds:Sleep
00496D96 mov ecx, [esp+arg_0]
00496D9A lea eax, [esp+0]
00496D9E push eax
00496D9F push ecx
00496DA0 push offset dword_5388C0
00496DA5 call sub_49E780
00496DAA test ax, ax
00496DAD jnz short loc_496DBA

2. If I'm right, have I to reverse some jnz, je or have I to nop the 00429655 call ???

Sincerely,

·TeKiN[²K]

PS: I've downloaded Sentinel Dev Docs, I'll read them and maybe all will bright in my head, I hope ...
·TeKiN [²K]
12-15-2000, 06:03 PM
I'm wondering about my docs, I'm not so far, but when I looked for "push", it was only referenced once, just saying me that it's better to use push instruction instead of call instruction to make reverser's life harder. I've donwloaded a .pdf file, about 6.5M long and called "SentinelSuperPro 6.0 Developer's Guide". Is it the good one? Or have I to order that docs (See Sentinel LM message)? I would prefer to download them so could anyone give me an address if I don't have the good docs?

>Morlac, could you give me your e-mail, I would like you to help me ( If you want of course ,)

Sincerely,

·TeKiN[²K] - tekin.2k@usa.net
Morlac
12-19-2000, 01:31 PM
Tekin.2k, check your email.
·TeKiN [²K]
12-24-2000, 02:51 PM
Hi you lot!
Especially Morlac & Maldoror ;) who helped me a lot. Thanks guys ;)

I've done it so if anyone need me ;)

Merry XMas to everyone ;)
x30n-
12-24-2000, 04:46 PM
hm... can't get this iscab.exe to work.. it says something about a ini file.. other than this.. i dont need any help :D

thanks,
x30n-
x30n-
12-24-2000, 04:48 PM
opps, main question though was, what are the commands to add and remove the file tkey.dll

?

thanks
x30n-
12-24-2000, 10:51 PM
doesnt anyone know? :P
x30n-
12-25-2000, 06:26 PM
just moving it to the top. hoping someone can help me with ISCAB.exe commands :(

i wanted make this subject into a essay and put it in a project i am going to release to the scene soon. but i cant put a incomplete essay out :(

/x30n-
·TeKiN [²K]
12-26-2000, 02:26 PM
Hi x30n-,
>opps, main question though was, what are the commands to add and remove the file tkey.dll ?

1. You must create a listing of all files in the data*.cab, so 'iscab cabfile options' becomes 'iscab data1.hdr -i"Listing.ini" -lx'. And in Listing.ini are all referenced files in the archive.

2. Locate the file(s) you want to patch in Listing.ini (Make a copy of it before). In our case : tkey.dll. Keep only this in WhatNameYouWant.ini :

[<Support>English Intel 32 Files]
File1="tkey.dll"

3. Replace the file in .cab archive with yours (put the patched tkey.dll in the same dir with .cab files): 'iscab data1.hdr -i"WhatNameYouWant.ini" -a'

4. Enjoy ;)

Sincerely,
x30n-
12-26-2000, 06:44 PM
Thannnnnnk Youuuuuu!
slidingpenguins
03-17-2003, 03:23 AM
Well, let me revive this thread.

I have been playing with L**htw*ve and IDA, but I have a dongle for it. I was thinking if there is a way to get a valid license.key for this combination. I am trying to know how does this serial is obtained. The license.key file contains a number like this: 1234-1234-1234-1234.

You can get the demo from www.newtek.com and install it by following the tkey.dll modification method. Since 7.5, they modified the program so that it will run without dongle, but will run in a demo mode.

I was thinking on tracing a ReadFile or searching for license.key, and then try to catch the routine where they compare this license with something I believe they calculate with the dongle and some other keys (like vendor or machine ones). Is this the right way to make it?


Interesting Topic
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Interesting Topic
PDA

View Full Version : Interesting Topic

Erik
12-05-2000, 02:28 AM
I am intrested in the posibility of my C Librarys being decripted
by hackers. What steps would a hacker need take to do this? Are there any workarounds?


icedump re-assembling
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > icedump re-assembling
PDA

View Full Version : icedump re-assembling

LarrydeClay
12-05-2000, 11:23 AM
Hello.
i have tried to re-assemble icedump but all i got was unsuccesfull attempts :(.
I have tried with nmake from microsoft but nothing. It did work for masm though.
Also tried with lcc's make but no luck.
I also passed the makefile to nasm.exe just to give it a try and no luck again.
Is there a 'make' for nasm?
Where can it be downloaded from?
Any other tip for remaking icedump?
Thanks very much.
The Owl
12-05-2000, 02:54 PM
I have tried with nmake from microsoft but nothing. It did work for masm though.
Also tried with lcc's make but no luck. I also passed the makefile to nasm.exe just to give it a try and no luck again. Is there a 'make' for nasm? Where can it be downloaded from?

hmm, looks like time for the developer page... ;-)

short answer:

1. you need the following *GNU* toos: make, echo, rm. i'm using the DJGPP port (at http://www.delorie.com/djgpp/ and the simtelnet mirrors), but MINGW would work just as well (http://www.mingw.org/). please make sure that you do *not* mix the tools from these packages, it just won't work (dos32 vs. win32 problem). this also means that user either the dos32 or the win32 version of nasm.

2. the linker you'll need is that of the MS DDK, v6.x will do it, maybe 5.x as well, i don't recall.

3. please post such stuff on the tools board, that's the place for it.
LarrydeClay
12-05-2000, 03:14 PM
man, thanks you very very much and excuse my mis-posting :)
Bye Mr.Owl.


Getting ImageBase from inside the process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Getting ImageBase from inside the process
PDA

View Full Version : Getting ImageBase from inside the process

Sorrow The Prince
12-06-2000, 05:33 AM
ola, i need to retrieve the imagebase of my running process: i don't want to read it from file, but from the memory of my process (the image of the file which generated the process is mapped beginning from ImageBase)... under NT there are PSAPI, but i want to port the application under Win9x... so i cannot use the PSAPI...
scanning the memory searching for PE is not a *fast* idea (^^), so could anybody tell me how to retrieve the process's imagebase (from the inside)?
10x
Malkocoglu
12-06-2000, 06:59 AM
ola, i need to retrieve the imagebase of my running process:
AFAIK it is fixed and 0x00400000...

under NT there are PSAPI, but i want to port the application under Win9x... so i cannot use the PSAPI...
I did not use PSAPI but here in my W95 Box,
W32dasm makes use of PSAPI DLL without error...
risc
12-06-2000, 12:48 PM
call getmodulehandlea, 0

returns your module handle aka process imagebase

no regrets
Spath.
12-06-2000, 01:29 PM
To get the base address of your program's
image (and not of your process), a third
solution in Win9x is to use the ToolHelp
functions (CreateToolhelp32Snapshot,
Module32First, ...). Default address is
0x400000, but another value can be chosen
at linking time.

Regards,

Spath.
Lord Soth
12-06-2000, 06:51 PM
umm, I always thought (correct me if I'm wrong ppl), that the hInstance parameter passed to winmain at program startup equals the ImageBase.
However, I'm not sure :)

Soth
Sorrow
12-07-2000, 10:06 AM
to Malkocoglu
well, you are right... but for now I'm so lazy and i don't want to test
the PSAPI's calls to ntdll.dll :)
(that because I want to be sure that all PSAPI are supported by Win9x's ntdll.dll)
note that the imagebase is not always 0x400000 (see M$ programs)

to risc && Lord Soth
you're right,
and here is it a better explanation from "god" Pietrek :)

- Peering Inside the PE: A Tour of the Win32 Portable Executable File Format
- Matt Pietrek, March 1994

>[...]
>For the sake of convenience, Windows NT and Chicago uses
>the base address of a module as the module's instance handle (HINSTANCE).
> In Win32, calling the base address
>of a module an HINSTANCE is somewhat confusing, because
>the term "instance handle" comes from 16-bit Windows.
>Each copy of an application in 16-bit Windows gets its own separate data segment (and an associated global

>handle)
>that distinguishes it from other copies of the application, hence the term instance handle.
>In Win32, applications don't need to be distinguished from one another because they don't share the same

>address space.
>Still, the term HINSTANCE persists to keep continuity between 16-bit Windows and Win32. What's important for
>Win32 is that you can call GetModuleHandle for any DLL that your process uses to get a pointer for accessing
>the module's components.

finally I will test and write the results of this approach
thanks to all


Help with Backtrace in Soft Ice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with Backtrace in Soft Ice
PDA

View Full Version : Help with Backtrace in Soft Ice

xOptiMus
12-06-2000, 07:17 AM
hello all,

Can anyone help me using "Backtrace" in Soft Ice? I have 2 questions:

1) Am I right in thinking that bactrace is used to record all the instructions that you step through, so that you can reviw them again later?

2) How do I use or turn backtrace on? I have increased the backtrace buffer size to 128 in winice.dat, but still don't seem able to use it. If I type: TRACE and enter in the command window, I get the message "Trace simulation is off". I have also tried typing the example from "help trace": TRACE 50, but I get the message: "Backtrace buffer is empty".
I just can't seem to get anywhere with it!

Any help greatly appreciated

xOptiMus
Spath.
12-06-2000, 01:49 PM
> 1) Am I right in thinking that bactrace is used to record
> all the instructions that you step through, so that you
> can reviw them again later?

Not exactly, only addresses are recorded.

> If I type: TRACE and enter in the command window, I get
> the message "Trace simulation is off".

Yes, as explained in the softice doc.... :/

> I have also tried typing the example from "help trace":
> TRACE 50, but I get the message: "Backtrace buffer is empty".
> I just can't seem to get anywhere with it!

1) load Notepad and look at the mapping
:map32 notepad
Owner Obj Name Obj# Address Size Type
NOTEPAD .text 0001 0137:00401000 00003953 CODE RO
NOTEPAD .bss 0002 013F:00405000 0000043A UDATA RW

2) define your watch range
:bpr cs:401000 cs:404000 t

3) define when to stop watching
:bpx cs:40133e

4) run Notepad, open a file an save it. Breakpoint 1
should trigger, then you enter trace mode :
:trace 1

5) use AltF8/CtrlF8 to move in the backtrace buffer.

6) exit trace mode.
:trace off


How do i create long flexlm license keys (with 20 chars) ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How do i create long flexlm license keys (with 20 chars) ?
PDA

View Full Version : How do i create long flexlm license keys (with 20 chars) ?

Ian
12-07-2000, 06:13 AM
hey ,

first of all i use the flexlm 6.1 sdk. i generated a license file with genlic32 but as you see in the topic i only get 12 chars keys...

i read some sites and mostly i found answers like that :
"try building lmcrypt, then use lmcrypt -verfmt 5 -longkey license.dat and see what happens."

but my problem is that i dont know how to build lmcrypt (if i take a look in i86_w3\build.bat
i see some lines like Microsoft C/C++ is required and sadly i have no C++ on my pc)

if i try to use i86_n3\lmcrypt ,i get no result with the command line above...the key is stil
12 chars long ... so i need your assistance .

- ian
Nolan Blender
12-07-2000, 11:32 AM
I don't think that genlic generates long
keys - I suppose you could patch it easily
enough to do that if you were so inclined,
but the right answer is to build lmcrypt.

--nb.
Nolan Blender
12-07-2000, 11:39 AM
I suppose I should have mentioned that lmcrypt will
only modify features for the daemon that it's built for, so
it won't do anything if the vendor names don't match.

I build lmcrypt and the custom keygens using
Microsoft Visual C++ 6.0.

--nb


Advanced Call Center
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Advanced Call Center
PDA

View Full Version : Advanced Call Center

Tonie
12-07-2000, 06:30 AM
Hi
a few days ago I tried to reverse Advanced Call Center v3 (www.voicecallcentral.com).
It is packed with Asprotect and I can't unpack it, but with SICE I found where to patch it and when i do it in SICE the program runs ok, but when I made a process patcher, a messagebox popups with message
"Error 15" and the program exits.
Any Suggestions?
10x.
Jueteng Lord
12-08-2000, 03:09 AM
Tonie (12-06-2000 20:30):
Hi
a few days ago I tried to reverse Advanced Call Center v3 (www.voicecallcentral.com).
It is packed with Asprotect and I can't unpack it, but with SICE I found where to patch it and when i do it in SICE the program runs ok, but when I made a process patcher, a messagebox popups with message
"Error 15" and the program exits.
Any Suggestions?
10x.

Try CASPR (h**p://sac.yeah.net), which is a asprotect unpacker. If the program uses crypted fragments, you need a valid key and and manually patch in the fixed code section.

BTW, if CASPR doesn't unpack it, email the author. He will update it.


Breakpointing Winice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Breakpointing Winice
PDA

View Full Version : Breakpointing Winice

latigo
12-07-2000, 07:31 AM
Howdy!
I started walking the dark path of (at least for me) 'Winnie' understanding and reversing.
The first obstacle i found was that Winice would not let me put bpx's on its own code.
This was rapidly 'fixed' with a byte patch.
But the problem kinda goes on, because now i can place breakpoints on Winice but they wont 'work'.
By 'won't work' i mean that Winice won't break on its own memory addresses.
Maybe the reason why is obvious for the 'congnoscenti' :P but not for me! :)
Let me give you an example:
By reading icedump's sources (thanks very much icedump team!) i found out that Winice's pPrintChar function (at least that's how its called in the sources) is at C0047043h in Winice version 4.0.5 Build 334. I do BPM C0047043 x and Winice accepts it due to the patch. But it will never break!
If i do 'u C0047043' i see that memory address line in blue.
As per usual, every tip is very much appreciated.
Thanks very much.

Latigo.
BoomBox
12-07-2000, 01:21 PM
Frog's Print has a tool called BreakIce to allow you do set BPXs inside WinIce. Get it here:

{ http://www.playtools.cjb.net | breakice.zip (http://156.17.4.4/~player/playtools/debuggers/softice/tools/breakice.zip) }
The Owl
12-07-2000, 01:34 PM
By reading icedump's sources (thanks very much icedump team!) i found out that Winice's pPrintChar function (at least that's how its called in the sources) is at C0047043h in Winice version 4.0.5 Build 334. I do BPM C0047043 x and Winice accepts it due to the patch. But it will never break!

hmm, icedump sources won't give the offset in memory, but rather an RVA inside the winice VxD image. where it will end up in memory depends on some factors, most notably the size of the VxDs that load before winice, eg. VMM (which changes in each windows version). so how did you arrive at that VA? i'd also try out a plain BPX, ie. not the DRx type, i don't recall right now if winice enforces some memory range limits for DRx or not.

If i do 'u C0047043' i see that memory address line in blue.

if you do a disassembly there, will winice display something like 'winice + xxxxx' where xxxxx is the RVA that you can find in the icedump include files?
latigo
12-07-2000, 02:40 PM
if you do a disassembly there, will winice display something like 'winice + xxxxx' where xxxxx is the RVA that you can find in the icedump include files?

Hi The Owl! and thanks for replying..
What i did was the following.
First i got Winice's base in memory by issuing a 'vxd winice' inside Winice.
Once i got the base address i added the RVA of the pPrintChar function found in the icedump's inc files for my Winice version.
pPrintChar's RVA is 0x0001879F. If i add this to COOOOOOO (base for a IDA disassembled winice) i get to the same place as in memory.
And yes when i disassemble memory at 0C0047043h i get a WINICE + 1879F which is the same RVA that w9xice4.05.334g.inc displays.
I also tried BPX 0C0047043h (actually i tried all the flavors of breakpoints) and no luck.
I also replaced the first instruction at 0C0047043h with a CC..but i won't do it again :).
Would it be possible to debug a winice (with winice) running on a vmware virtual machine on the same computer??
Like i don't know how im gonna learn how it works if i can't debug it :). (remote debugging??)
Again thanks for your help.

Latigo.
DinDon
12-12-2000, 03:03 AM
Would it be possible to debug a winice (with winice) running on a vmware virtual machine on the same computer??
Like i don't know how im gonna learn how it works if i can't debug it :). (remote debugging??)
Again thanks for your help.
Latigo.

Hi Latigo,

I tried that kind of masochistic approach
some time ago, but since that project took me a lot more than the expected time, I threw it in the big list of my waiting projects. It was anyway a big fun. Here is what I did and what I learned.

You cannot debug Winice with Winice itself. You must use another kernel debugger. The only kernel debugger I am aware of, besides Softice (never tried with TRW2000, because at that time my platform was WindowsNT) is Microsoft WINDBG (take it for free at http://www.microsoft.com/ddk/debugging/).
Tip: I think TRW2000 could be a good solution for Win9x platforms, but I am not sure of...

Unfortunately WINDBG cannot debug the kernel on the same machine where it runs but it requires a remote computer.
The target machine will run the kernel with the /DEBUG option. In this way the serial port (COM1 or COM2) will be used by the kernel to send and receive information for the remote debugger, with a simple protocol nearly undocumented by Microsoft.
It seems that Windows Whistler could be debugged by WINDBG on the same machine...
So you have two chances:
(a) buy another PC and connect it to the target one with a null-modem cable
(b) put your hands on VMWARE

I followed the second chance, and after some troubles installing Softice on the VMWARE virtual machine (you must set a standard VGA driver on it, selecting only 16 colours in order to have a not-garbled screen when softice pops-up), another problem arose: how can the virtual machine dialogate with WINDBG? You have again two chances:
(a) use a null-modem cable to connect COM1 with COM2. Configure the virtual machine kernel in order to use one of them, and instruct WINDBG to use the other one. I did not try this solution: on the paper it should work... who knows?
(b) thanks to VMWARE facility of redirecting all the COMx flow to a named pipe, another way to connect the two machines would be via pipes. But this requires an NT driver (VMWARE runs only on Windows NT) in order to redirect the COM to a pipe, since WINDBG can use only a COM port to connect to the target machine.

Well, I wrote a filter NT driver on the top of the standard serial one, which simply redirects all the WINDBG I/O to a named pipe and gets there the answers from the VMWARE redirected kernel I/O. I was in the stage of debugging this one when I realized that VMWARE was yet full of bugs: a lot of times it crashed. I lost my patience and I decided to stop the project and to spend my time with some more interesting, waiting for some new releases of VMWARE.

In the following weeks I found another way to manage the problem. You could use Bochs (the Intel emulator with full source code) with its debugger built-in, in order to step inside Winice. Could it work? I would have the time to try... Grab a Windows version of Bochs with the debugger enabled at
http://www.reactos.com/tools/bochsget.html

Ok, please let me know if you have the time and the skillness to make some progress...
I would be very interested at it.
My best regards.
latigo
12-12-2000, 10:01 AM
DinDon!!
Thanks very much!! :)
I really appreciate your info and i'll try all this stuff out as soon as i got some time.
Thanks again very very much :)

Bye now!

Latigo
The Owl
12-12-2000, 10:23 AM
i forgot to mention that TRW2000 can debug winice indeed (provided it works fine otherwise on your machine). on a more general note, you can understand (most of) the SoftICE code by looking at the disassembly only (and reading lots of docs, like Intel IA-32 manuals, DDK help + include files, books on VxDs/KMDs, etc). except for the symbol subsystem and some of the newer commands everything else was written in assembly, so it is less of a challenge to decipher; you'll find that you spend more time on reading docs then the actual code itself.


flexlm vendor key question ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flexlm vendor key question ...
PDA

View Full Version : flexlm vendor key question ...

VLD
12-07-2000, 10:12 AM
Hallo to all

I have 2 diffrent tragets from one vendor - first one runs on a PC - second one on IRIX ( first one uses 6.0, second 6.1 ). I'v got encryption seeds, vendor keys and vendor name from target 1, have built lmcrypt on a PC, and made license for IRIX target 2. It worked. Now i have flexlm SDK for IRIX and just for fun tried to build lmcrypt
with the same seeds and vendor keys. Builds fine, but when i run lmcrypt i get error message :

lc_init failed: FLEXlm platform not enabled
FLEXlm error: -48,52

As far as i understand from reading esseys and comments in flexlm SDK, this has something to do with vendor keys 2 & 3 - info about platfom. Also it is noted in lmrecode by Nolan Blender. My question is -
is it possible to change platform and if yes - how ?

Thanks in advance

VLD
Nolan Blender
12-07-2000, 10:54 AM
When you license FLEXlm from Globetrotter, you
are licensed for certain platforms, and your
vendor keys are only valid for those platforms.
The vendor keys have encoded in them a set of
bit fields which turn on various features/enable
specific platforms, and if the bit for the
platform you are trying to run on is not set,
then FLEXlm will refuse to run.
If you have the encryption seeds, and want to
run on any platform, use lmkg or it's equivalent to
generate new keys, and all will be well.

If you look on Crackz' site, you should be
able to find most anything which you need
to do this.

--nb
VLD
12-08-2000, 04:48 AM
Hi

Thank you Nolan for answer - now everything works just fine !
Actually that was my mistake ... pretty stupid one.

Have a nice day

VLD


Anything new on heh, on the subject of anti debugging....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Anything new on heh, on the subject of anti debugging....
PDA

View Full Version : Anything new on heh, on the subject of anti debugging....

MCooly
12-07-2000, 03:54 PM
I read a post "heh, on the subject of anti debugging...." by Lord Soth and I think a have found a game that uses similar protection. The game, sacrifice, uses Meltice and int68 for anti-debug checks however if you bypass them the program just crashes and is very self modifying.

Lord Soth (or anyone else for that matter), made any progress on bypassing the anti-D protection?
Jueteng Lord
12-08-2000, 02:57 AM
MCooly (12-07-2000 05:54):
the program just crashes and is very self modifying.

Is it real self modifying or just obfuscation code. IMO, there is a distincition between self-modifiying and obfuscation code (like jmp macros, garbage code, etc).
MCooly
12-08-2000, 05:12 AM
I think your right that it isn't self modifying (bare with me I'm very new to this stuff).

It looked self modifying because softice was loosing lines of code. You'd have a command and after it was executed its entire line would dissapear and be replaced by the line underneath or some other garbage code. When the code eventually jumps back to these specific locations where the code disapears, right before execution of that line, the code would return to normal.

Before I was just quickly running through the program so it looked like it was modifing the code, however I just looked closer and no opcodes are modified they just disapear or become garbage until the next time its executed.

I'm still very new to this and I have not seen softice do this before. Why does it do this?


Building lmcrypt with Borland C++
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Building lmcrypt with Borland C++
PDA

View Full Version : Building lmcrypt with Borland C++

Buz Killer
12-08-2000, 10:11 AM
Hi,

How can I create lmcrypt with non-microsoft
C, Borland for example ?

Buzkiller.
Nolan Blender
12-08-2000, 10:22 PM
Dunno if you can - I don't think the Borland linker
liked lmgr.lib. You should be able to call
the relevant routines in the DLL file from
Borland C++ though.
Buz Killer
12-09-2000, 12:27 PM
Hi Nolan,

When I try to build makekey I get this message :
"Error:Unresolved external '_lc_init' referenced from
module makekey.c"
There are 5 more messages like that.
How can I solve this problem ?

buzkiller
Nolan Blender
12-11-2000, 12:52 PM
The symbols are located in lmgr.lib - if you can get it to link
against that, you should be set.

I don't know if the Borland compilers like the lib file
though - I tried with C++ builder 4 and it choked.

I didn't try very hard though, since I use msvc anyway.


PW hashes and Active Directory
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > PW hashes and Active Directory
PDA

View Full Version : PW hashes and Active Directory

mike
12-08-2000, 01:24 PM
Anyone know in what *file* encrypted passwords / password hashes are stored on a win2k domain controller? They're supposed to be in the active directory, but the AD is broken up into a bunch of files, kind of like the registry is.
mike
12-08-2000, 04:35 PM
OK, it's in ntds.dit, which is a glorified jet database like Access or Exchange uses called "Extensible Storage Engine." Win2k resource kit will provide some more answers, I hope. Wotsit's site is down right now; anyone know where to get file format for ESE files?


lmkeyfil.c ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > lmkeyfil.c ...
PDA

View Full Version : lmkeyfil.c ...

kittykat
12-08-2000, 06:39 PM
Hello flexlm reversers,

I read Nolan Blender latest essay about flexlm - about user crypt filters.
I happen to know of an eda product which uses this crypt filter method. I followed Nolan's essay but came to a snag...I couldn't continue at the point of observing the crypt filter routines.

I already have valid encryption seeds for this product but requires lmkeyfil.c to generate the appopriate lmcrypt.

So, please can anyone (especially Nolan) provide me this lmkeyfil.c for this particular product.

Not to sound obvious : this product last uses vendor defined encryption but now uses crypt filters instead. I hope this is enough.

- kittykat
ps: I'm using gdb on Solaris and Linux. I've never reversed anything on the windows platform.
Nolan Blender
12-08-2000, 09:32 PM
kittykat (12-08-2000 08:39):
Hello flexlm reversers,

I read Nolan Blender latest essay about flexlm - about user crypt filters.
I happen to know of an eda product which uses this crypt filter method. I followed Nolan's essay but came to a snag...I couldn't continue at the point of observing the crypt filter routines.

I already have valid encryption seeds for this product but requires lmkeyfil.c to generate the appopriate lmcrypt.

To reverse engineer this routine, you have
to take a dead listing approach to it rather
than try and step trace through the function -
it's designed to be difficult.
It's a bit more difficult on the MIPS processor,
but still doable. One way is to
build your program with lmappfil.c and
reverse engineer that first - once you do
that you'll see what sort of code is generated
and how the variables map to the generated code.
The key to this protection is to understand
what the program is actually doing to the data.
The lmkeyfil you need will be similar to the
one provided in the essay - all you need to
do is reverse the program and extract the
tables from the target. You'll see that
the first part of the program holds the XOR
operations, and the second, larger part does
the permutations.
kittykat
12-08-2000, 10:25 PM
Thanks Nolan, I will try again...but I still feel if you can provide me the lmkeyfil.c for this product - I will be more than grateful :)

Thanks again

- kittykat
Erovin
12-09-2000, 11:55 AM
Sheesh. Some people want everything!
jenshi
12-09-2000, 09:47 PM
Hi,

Where can I find Nolan's newest essay?

Thanks!
kittykat
12-10-2000, 06:31 PM
Hello Nolan,

I've mananged to identify the user crypt routine and I believe I can extract num0-num19 and its corresponding x_0-x_19, however the permutation operation still puzzles me.

In your alternate lmkeyfil.c, how did you get the permute_t table ?? Put it in another way, how did you get values for idx 00 to idx 19 ? It's not so clear in your essay as the xor operation.

Also, I tried changing the values in your alternate lmkeyfil.c for example x_19 - from 0x1a to 0x2a, build lmcrypt and still the code generated by lmcrypt is same as the previous(with your original altered lmkeyfil.c). Why is this so ??

- kittykat
Nolan Blender
12-11-2000, 12:53 PM
> In your alternate lmkeyfil.c, how did you get the permute_t table ?? Put it in
> another way, how did you get values for idx 00 to idx 19 ? It's not so clear in
> your essay as the xor operation.

Well, the permutation operation isn't really all that clear without some careful
analysis.

04011C6 loc_4011C6: ; CODE XREF: sub_401000+1A4j
004011C6 cmp edi, myoffset_0d ; Is this index 0x0d?
004011CC jnz short loc_4011FD ; No, skip to next one
004011CE mov cl, byte ptr mybit_4 ; Move mask consisting of bit 4 (0x10) in place
004011D4 test byte ptr [ebp+arg_4+3], cl ; Is that bit set?
004011D7 jz short loc_4011E2
004011D9 mov cl, byte ptr mybit_6 ; Set bit 6 in cl , so bit 6 in cl
004011D9 ; corresponds to bit 4 in input
004011DF or [ebp+var_1], cl ; Turn bit 6 on if bit 4 on input was set
004011E2
004011E2 loc_4011E2: ; CODE XREF: sub_401000+1D7j
004011E2 mov dl, [ebp+var_1] ; Grab result so far
004011E5 mov ecx, mybit_6 ; Load ecx with bit 6 pattern (0x40)
004011EB mov bl, [ebp+arg_C] ; Grab the "expected char" fed into algorithm
004011EE and edx, ecx ; Mask off everything except bit 6
004011F0 and ebx, ecx
004011F2 cmp dl, bl ; Check to see if bit is the same
004011F4 jz short loc_4011FD ; Same - good continue on.
004011F6 xor al, 0DEh ; Otherwise, mix in garbage
004011F8 jmp loc_403217 ; And bail out

By looking at the above code fragment (this one is from realviz.exe), it shows that
bit 4 is mapped to bit 6 in the permutation. so 0x10 becomes 0x40 if passed through
the function.

I wrote the permute program, and it's operation isn't as clear as it could be. The
The position (from left to right) correspond to the bit position in the input word -
thus, the first value corresponds to bit0, second corresponds to bit1, and the last
corresponds to bit7. The value corresponds to the bit that the input bit maps to.

From realviz, we can take this example:

{ 2, 5, 1, 3, 6, 7, 0, 4}, /* idx 13 */

bit0 maps to bit2
bit1 maps to bit5
bit2 maps to bit1
bit3 maps to bit3
bit4 maps to bit6 **this is the mapping for the code fragment above **
bit5 maps to bit7
bit6 maps to bit0
bit7 maps to bit4

> Also, I tried changing the values in your alternate lmkeyfil.c for example x_19
> - from 0x1a to 0x2a, build lmcrypt and still the code generated by lmcrypt is
> same as the previous(with your original altered lmkeyfil.c). Why is this so ??

Well, the index is also used as the index into the key, so if the keylength is less
than 20, you won't see this algorithm being used. Try changing x_0 and see what
happens.
kittykat
12-12-2000, 06:54 PM
Thanks for all your help Nolan - everything's okay now - :)

- raif


How to manually unwrap/unpack Elicense-protected prog's.....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to manually unwrap/unpack Elicense-protected prog's.....
PDA

View Full Version : How to manually unwrap/unpack Elicense-protected prog's.....

SpeKKeL!
12-09-2000, 03:04 AM
I,am working on a target Achilles's Shield 3.0 witch is protected with elicense (try/buy/rent) it usses vtcpak24.dll; i can't find the compare for 15 day's or where it is stored. Tried with elicense unwrapper but it failed maybe because my prog is already expired..;it makes a temp-file from where it runs so any suggestions how i can unwrap or unpack it manualy.......Thanks....SpeKKeL!......
LaptoniC
12-10-2000, 10:00 PM
It is easy to unpack.I have found an easy method to unpack within 10 sec.
1.Run your program.When trial dialog appears goto your debugger and bpx on freelibrary
2.Trace untill you see jump[xxxxxxx].This is your OEP
3.If you are using softice,when you are at this location type
a eip
jmp eip
And dump with Procdump you are done.
4.If you are using Trw2k.When you are at this location F8 into it and type
makepe
You will have unpacked newpe.exe in program directory or trw2k directory.

I guess you have some problem with expiration.Deleting mmf.sys form x:\windows\system directory solves the problem.If you can't delete this file in windows, boot to dos and delete it or kick rundll32.exe process with Procdump and try to delete again.

Hope this information helps


Bitarts Fusion/CCrunch
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Bitarts Fusion/CCrunch
PDA

View Full Version : Bitarts Fusion/CCrunch

Instructor
12-09-2000, 06:40 AM
How can I manually or automatically unpack
a Bitarts protected file?

cu


to +tsehp: Broken link to essay
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > to +tsehp: Broken link to essay
PDA

View Full Version : to +tsehp: Broken link to essay

molac
12-09-2000, 12:32 PM
Getting the installation password by cracking the Installshield script ~Nolan Blender
NchantA
12-10-2000, 04:20 AM
hah

i *think* this is referring to the previous line, i.e Delphi 5 trial...read carefully ;)

hi nolan btw :DD

NchantA
tsehp
12-10-2000, 06:14 PM
yes,
I changed the line to make it more clear ;)


Aldec HDL cracking ... Flexlm ... need some pointers ....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Aldec HDL cracking ... Flexlm ... need some pointers ....
PDA

View Full Version : Aldec HDL cracking ... Flexlm ... need some pointers ....

sailor
12-11-2000, 12:36 AM
Hi,

I've been trying to crack Aldec HDL. It uses flexlm. I've read all the tutorials about flexlm cracking and whats different about Aldec HDL is that the flexlm routines are not used from the flexlm dll but rather are compiled into one of the target application dll's. I can identify 2 functions that seem similar to the function in the flexlm dll (ie. lc_init and lc_checkout) however they seem to have different arguments and I'm not sure if they work similarly.

I would ideally like to be able to extract the encryption keys so that I can make my own licenses but I've heard that globetrotter has made the encryption keys a little more difficult to extract in newer versions of flexlm. Incidentally, Aldec HDL 4.1 uses flexlm version 7.0d

I've been using wdasm 8.93 but its really not helpful in single stepping mode as it will just crashes after a little while. I would really like to use ida pro 4.14 but I cant seem to lay my hands on it. The flirt function recognition would really be handy.

I need pointers on how to proceed with this and anybody who has experience cracking flexlm would be invaluable. Please icq me 1979151.

Sailor
Nolan Blender
12-11-2000, 12:55 PM
Read the essays on Tsehp's site, most notably Dan's essay
to get the seeds out - this one checks the vendor string,
so if you want to get a full license out of it, you're in
for a fair amount of work.
sailor
12-12-2000, 12:17 AM
I read that essay and my problem is that my target does not call lc_init() or any of the other calls in lmgr3xx.dll. I may be grossy missing something but I'm at a dead end. The target has a dll that has a few similarly named function calls (most notably ahdl_init() and ahdl_checkout()) but I cant find too much similarity in between these functions and those in lmgr3xx.dll.

Any more pointers ?

Thanks in advance,

Sailor

Nolan Blender (12-11-2000 02:55):
Read the essays on Tsehp's site, most notably Dan's essay
to get the seeds out - this one checks the vendor string,
so if you want to get a full license out of it, you're in
for a fair amount of work.
Nolan Blender
12-12-2000, 08:23 AM
sailor (12-11-2000 14:17):
I read that essay and my problem is that my target does not call lc_init() or any of the other calls in lmgr3xx.dll. I may be grossy missing something but I'm at a dead end. The target has a dll that has a few similarly named function calls (most notably ahdl_init() and ahdl_checkout())

The code could be in one of the dll's too.
If you use lmutil:

lmutil lmver filename

It will tell you which library has flexlm
stuff in it.
CrackZ
12-12-2000, 05:15 PM
Hiya,

My first post on this godforsaken messageboard (damn inconvenient as it is to use), anyhow, this probably won't help you much but I've cracked a fair few versions of Aldec from v3.5 up to the neverending minor builds of 4.x.

I've personally tended to go after always the Sentinel protection, theres a diagnostic program included, and spront.dll is used as the basis (spro.. I'm sure you see it in the name ;-) ). Oh yes, theres also integrity checks on 7 of the files too ;p.

Regards (thanks for even reading this probably useless reply).

CrackZ.
sailor
12-12-2000, 05:19 PM
Nolan Blender (12-11-2000 22:23):
sailor (12-11-2000 14:17):
I read that essay and my problem is that my target does not call lc_init() or any of the other calls in lmgr3xx.dll. I may be grossy missing something but I'm at a dead end. The target has a dll that has a few similarly named function calls (most notably ahdl_init() and ahdl_checkout())

The code could be in one of the dll's too.
If you use lmutil:

lmutil lmver filename

It will tell you which library has flexlm
stuff in it.

The code is in a dll and I've identified the dll.
If you disassemble the dll, it still does not have the lc_init() or lc_checkout() functions as given in the flexlm manual.
If possible, I would like to email the dll for you to examine, i.e. depending on your schedule.

I sincerely appreciate your help.

Sailor
sailor
12-12-2000, 05:27 PM
CrackZ (12-12-2000 07:15):
Hiya,

My first post on this godforsaken messageboard (damn inconvenient as it is to use), anyhow, this probably won't help you much but I've cracked a fair few versions of Aldec from v3.5 up to the neverending minor builds of 4.x.

I've personally tended to go after always the Sentinel protection, theres a diagnostic program included, and spront.dll is used as the basis (spro.. I'm sure you see it in the name ;-) ). Oh yes, theres also integrity checks on 7 of the files too ;p.

Regards (thanks for even reading this probably useless reply).

CrackZ.

Hi CrackZ,

first of all, I would like to thank you as you've provided me with a wealth of information on your reverse engineering page. Infact, almost all the information i have on flexlm is from your page.

There is indeed a file called spront.dll and like you mentioned, it is indeed used in managing the sentinel keys.

Like I've mentioned in my previous posts, I've identified the dll in the target that is contains the routines for checking the license file. However, I cant seem to connect the functions mentioned in the flexlm manual with the functions that are present in the aldec dll.
Also, AldecHDL does not seem to follow any of the methods given in the flexlm manual (trivial or simple api).

Any help will be sincerely appreciated.

Sailor
Nolan Blender
12-12-2000, 09:10 PM
Look for lc_new_job(). Probably Crackz' approach is
better - I had always previously attacked the
FLEXlm part because I was more familiar with that, but
the Sentinel approach would probably be more straightforward now
that they've added some encryption crud to the
FLEXlm permanent licenses.

--nb.
goatass
12-13-2000, 08:24 AM
Hi guys, I cracked the latest version of Aldec HDL which was a download from the web. That version DID NOT use either FlexLM or sspro eventho it seem like it did. There was only a couple small checks for a license but it was a registry key if I remeber correct. Try using FileMon to see if the program tries to access the License.dat file or any file resembling a license file. My version didn't, if I created the License.dat file there was no change, usually with FlexLM you will get a diffrent error message if something in the license file is wrong as apposed to the entire file not being there.
It wasn't very hard to crack. I can't remeber any RVAs to point u to sorry.

goatass
sailor
12-13-2000, 11:05 PM
goatass (12-12-2000 22:24):
Hi guys, I cracked the latest version of Aldec HDL which was a download from the web. That version DID NOT use either FlexLM or sspro eventho it seem like it did. There was only a couple small checks for a license but it was a registry key if I remeber correct. Try using FileMon to see if the program tries to access the License.dat file or any file resembling a license file. My version didn't, if I created the License.dat file there was no change, usually with FlexLM you will get a diffrent error message if something in the license file is wrong as apposed to the entire file not being there.
It wasn't very hard to crack. I can't remeber any RVAs to point u to sorry.

goatass

Yeah, the web version does not really access the license file and you are probably right about a registry key.
But inorder to make it reconize a license, aldec sent me a little proggie. I can forward you that if you are interested.
If you requested the CD version, it checks for license files by default.

thanks for your help,

Sailor
sailor
12-13-2000, 11:07 PM
Nolan Blender (12-12-2000 11:10):
Look for lc_new_job(). Probably Crackz' approach is
better - I had always previously attacked the
FLEXlm part because I was more familiar with that, but
the Sentinel approach would probably be more straightforward now
that they've added some encryption crud to the
FLEXlm permanent licenses.

--nb.

I tried that approach but I really didnt pursue it as I wasnt all too familiar with the sentinel licensing system.
Anyway, I downloaded flair from the link you posted and I'm interested in seeing if I can indeed view any of the routines in the target dll.

Thanks again,

Sailor


CASPR sac.home-page.org gone?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CASPR sac.home-page.org gone?
PDA

View Full Version : CASPR sac.home-page.org gone?

m!
12-11-2000, 07:24 AM
anyone know where I can find a mirror of this page? it was always up-to-date

thanks!
Solomon
12-11-2000, 07:35 AM
http://sac.yeah.net
Tonie
12-13-2000, 04:48 AM
http://sac.yeah.net is also dead.
Any others mirror please?
McNy@Work
12-13-2000, 04:58 AM
http://sac.yeah.net is working fine to me.
and will be redirect to
http://ww1.realftp.com/sac/index.html

you had better try it again. 8)
Solomon
12-13-2000, 06:08 AM
http://www.unpacking.org/

This is not the mirror of SAC's page, but CASPR can be found here.


Patch file but leave 'modified' flag same
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Patch file but leave 'modified' flag same
PDA

View Full Version : Patch file but leave 'modified' flag same

ASMCoder
12-11-2000, 07:26 AM
I wrote an asm patcher to update a keymakers
data file and registry settings. However the keymaker detects that the datafile has been
modified and resets the file.

I noticed Hworks32 retains the settings but Ultraedit7 does not. So it must be easy :) ?

So how do I 'retain' the file settings after patching the file. ASM source example would
be nice.

ASM(wouldbe)coder
ASMcoder
12-12-2000, 05:20 AM
Thanks, yes the target does access this. But I want to make a third party 'stealth' patch. NOT to disturb the target.... for several reasons :)

I also have a need to 'unset' the archive flag in assembler any takers for an example ?

Also in the registry what value is REG_DWORD ? to poke in new value as part of the API input before RegSetValueExa , I only know REG_SZ = 1 the API guide does not elaborate on any of these two topics for 'dwType' or 'archive' flag on WriteFile :(

Nearly ASMcoder :)
NicoDE
12-12-2000, 10:37 AM
at first the constants you're looking for

REG_NONE = 0; No value type
REG_SZ = 1; Unicode nul terminated string
REG_EXPAND_SZ = 2; Unicode nul terminated string (with environment variable references)
REG_BINARY = 3; Free form binary
REG_DWORD = 4; 32-bit number
REG_DWORD_LITTLE_ENDIAN = 4; 32-bit number (same as REG_DWORD)
REG_DWORD_BIG_ENDIAN = 5; 32-bit number
REG_LINK = 6; Symbolic Link (unicode)
REG_MULTI_SZ = 7; Multiple Unicode strings
REG_RESOURCE_LIST = 8; Resource list in the resource map
REG_FULL_RESOURCE_DESCRIPTOR = 9; Resource list in the hardware description
REG_RESOURCE_REQUIREMENTS_LIST = 10;

as far as i had some minutes of sleep i'll post an asm example
wich assembler you are using ?

Nico_
ASMcoder
12-13-2000, 04:42 AM
Thanks,
I am (ab)using TASM5 !
I searched my home pc for 'inc' files and found a nice one in MASM6 (Iczelion updated) that gave the same info re
REG_DWORD etc etc. I use TASM5 because I can directly relate softice screen to coding :)
BUT I will try and switch to MASM6 as it looks to be more 'higher level' with those nice invoke macros etc. More learning !!!!

I now kill the file and create file with the data I wanted to replace. This leaves the archive flag unset. BUT it would be nice to have control via ASM of this feature without killing/creating :)

Thanks again .
ASMcoder
12-13-2000, 07:13 AM
Thanks,
I am (ab)using TASM5 !
I searched my home pc for 'inc' files and found a nice one in MASM6 (Iczelion updated) that gave the same info re
REG_DWORD etc etc. I use TASM5 because I can directly relate softice screen to coding :)
BUT I will try and switch to MASM6 as it looks to be more 'higher level' with those nice invoke macros etc. More learning !!!!

I now kill the file and create file with the data I wanted to replace. This leaves the archive flag unset. BUT it would be nice to have control via ASM of this feature without killing/creating :)

Thanks again .


Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Question
PDA

View Full Version : Question

Dya-Blo
12-11-2000, 01:42 PM
Hello all,

could someone tell me if there is a way to get the RCE CD ? an ftp maybe ?

I will spread it all around me (for free of course) but i dont want to give my real mail and send it to people i dont know, sorry.

See U.
Solomon
12-11-2000, 10:03 PM
me too ;)

solomon@yes100.com
noname
12-13-2000, 08:56 AM
Hi,
get it here :)
http://www.idca.com/~thesandman/RCE/Requests.html
Dya-Blo
12-13-2000, 02:16 PM
Well, thx but

i wanted to know where i can download it ? i don't want to give my real mail.

Thx, See U.
noname
12-14-2000, 11:06 AM
Hi,
not anymore,ftp site has been attack by hackers putting virus :(((((
if you want it you have to give the mail
to the volunteers .

cya
regards
noname
Lord Soth
12-16-2000, 12:31 AM
Why would any kiddies wanna attack that FTP ?
noname
12-17-2000, 02:13 AM
Hi LS,
the only reason I can think is their ass is ichy,those fucking bastards got nuffting to do :)))))

noname
?ferret
12-17-2000, 12:34 PM
If you dont want to give your real addy, you'll have to rent a PO Box, or a Mailboxes, etc. Box or something......but.......

It seems to be a fair trade.....us volunteers have to give people a place to mail it to also.....

I've mailed out 50+ CD's so far & remember the countries that most of the nicks were from, but hell I don't even know the cities (most send SASE, so I don't even have to write their addresses, just stick the CD in and throw it back in the mail).
Cx
12-17-2000, 03:11 PM
How about posting it to alt.binaries.images or alt.binaries.cd.image or alt.binaries.cd.image.highspeed ?


UPX Unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > UPX Unpacking
PDA

View Full Version : UPX Unpacking

Jack
12-11-2000, 03:50 PM
I having some problems unpacking UPX. I am trying a older version .84 Unpacking from cmd line is not yet enabled in this old version. I am using Win2K / SI 4.05 / Proc Dump as my tools. My target is a lame vb6 exe I wrote //please don't flame me on vb :)

I get to the final jump to real code.
:00407DB4 61 popad
:00407DB5 E96A94FFFF jmp 00401224

I am doing the a eip / jmp eip and dump with procdump.
I modify my entry point in PE header of my dump file to reflect the correct entry point.
Soon as if fires up, crash on can't read from memory location.
I've seen 1 or 2 other tuts on UPX but most of them were to make a patch in the packed file.
I believe my problem is in the PE Header, Import Table or the ProcDump options.
Could someone here that has unpacked a UPX file give me a clue on what I should focus on.

Thanks
Jack


Praise for r!sc's Asprotect Deprotector v0.6 (rAD)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Praise for r!sc's Asprotect Deprotector v0.6 (rAD)
PDA

View Full Version : Praise for r!sc's Asprotect Deprotector v0.6 (rAD)

Kayaker
12-12-2000, 01:00 AM
Hi All,

Just wanted to mention an experience I had with rAD so r!sc could get a little feedback ;)

I was checking out a nice little Tool of our Trade brought to my attention by Hz (thanks man) called D-Peeper, which is a Delphi application peeper to help you debug applications written with Delphi or CBuilder.
http://batry.hypermart.net/D_Peeper.htm

Turns out it uses the EXACT same protection as EIAnyCalc, which I had been griping about in an earlier Antidebugging thread on this board. It's also listed as a PE Windows GUI type file by FileInfo (most other file identifiers don't even recognize any compiler used), same FilemonClass/RegmonClass monitor protection, CRC check, Asprotect version unknown.

I was able to make a manual dump with full resources and partial Import Table, but most of the IAT is still missing. I'd like to ask SV or Spath for some pointers on how you dumped AnyCalc if you have a moment sometime. As I said, the unpacking routine for D-Peeper operates the same way. Getting to the REAL OEP still eludes me, though I can get a seemingly workable dump at a few locations. I just don't want to waste time trying to rebuild the IAT if I don't have a good dump. Thanks for any input.

On to rAD. This worked quite well with both programs, which must use Asprotect v1.1 since rAD only works with this version. rAD must completely strip all the Asprotect protections from the program - as well as being unpacked, the GetClassNameA monitor protections and CRC check was also gone.

Interestingly, one other protection common to both programs (and again must be part of Asprotect), is a check of an encrypted entry in HKCR/CLSID which contains the install date info. The only problem with this is that the unpacked program no longer reads this Registry value and the install date check part of the program now fails. This isn't really a problem as it can be easily patched, but it shows that part of what Asprotect does is still integrated into the programs basic code, i.e the program NEEDS a value retrieved by the Asprotect code it seems.

Tsehp, I was wondering if the universal anti-asprotect program you're working on takes this little oddity into account? This would be part of the Limited Trial option settings in AsProtect, but I assume there must be a similar mechanism at work for the Registration Key option as well. Just thought I'd bring this up as well.

Regards,

Kayaker
ww_paddler(at)hotmail.com
SV
12-12-2000, 02:59 AM
Hi Kayaker

I have downloaded your target and have a look inside ;)
EOP is 86DB4 and i have used my tools to rebuild it.
I have an unpacked one. It works but i have not used it
in deep :)
I send you my exe.

SV
risc
12-12-2000, 09:07 AM
heh, praise me :-) /me loves it ..

r.e. This isn't really a problem as it can be easily patched, but it shows that part of what Asprotect does is still integrated into the programs basic code, i.e the program NEEDS a value retrieved by the Asprotect code it seems.

uhm, im sure one of the asprotect api's was to get trial days left, and i hooked it so it returns a 'good' value .. (it did for aspack.exe .. never found anything else that used it) (see whatever section rad adds to files that used asprotect api, and data_dump.txt / dw 1F45h ; new_hook / trial days, and days left)

i cant give any advice as ive drank way too much beer since i coded rad & last debugged asprotect.

uhm, cheerio
Kayaker
12-12-2000, 05:20 PM
Heh heh, seems the more I learn about AsProtect the less I understand ;)

Thanks for the tool SV. The RVA's pointed out by it will give me some addresses to watch while AsProtect is doing its "thing".

Kayaker
tsehp
12-13-2000, 01:41 AM
Kayaker (12-11-2000 15:00):
Interestingly, one other protection common to both programs (and again must be part of Asprotect), is a check of an encrypted entry in HKCR/CLSID which contains the install date info. The only problem with this is that the unpacked program no longer reads this Registry value and the install date check part of the program now fails. This isn't really a problem as it can be easily patched, but it shows that part of what Asprotect does is still integrated into the programs basic code, i.e the program NEEDS a value retrieved by the Asprotect code it seems.

Tsehp, I was wondering if the universal anti-asprotect program you're working on takes this little oddity into account? This would be part of the Limited Trial option settings in AsProtect, but I assume there must be a similar mechanism at work for the Registration Key option as well. Just thought I'd bring this up as well.

Regards,

Kayaker
ww_paddler(at)hotmail.com

Hi kayaker,
The tool I'm working on is intended only to fix *damaged* iat's.
They can be encrypted, redirected, or valid, they are fixed in 98% in asprotect's all versions and will be pretty soon for every program.

The feature you're talking about is not os dependent, it's some data provided by asprotect and can be randomly put in target's data structures or resource or anything you can imagine, so my app cannot
fix globally this for all asprotect apps, otherwise I'm forced to put some heuristic searching skills to make an attempt.
Anyway, you can describe this mechanism precisely, who knows maybe I could do something ?

If you're interested to test my beta version, email me, I'll send it to you, but actually the most interesting tracer module is not included while it's still at dev stage.

regards,

tsehp


Keygenning!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Keygenning!
PDA

View Full Version : Keygenning!

Sphinx
12-12-2000, 02:24 AM
How would you keygen a program that would check the serial like this: from the serial you typed in, it calculates something twice
then somewhat decrypts the serial matching your name then tries to compare that "decrypted" code to your name! To be specific, i'm cracking here, APISpy32 2.4. I know there are a lot of serials (heh!)
and keygens out there but i want to do it myself. I know it sounds like the protection similar in Hiew! thanx!


native API on Windows NT4 (NtOpenThread)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > native API on Windows NT4 (NtOpenThread)
PDA

View Full Version : native API on Windows NT4 (NtOpenThread)

NicoDE
12-12-2000, 07:09 AM
I dumped and interpreted the API function OpenThread (in Win2ooo)
to get OpenThread running on Windows NT4, ok so far so good...

( view results: http://www.bendlins.de/nico/stuff/openthrd.htm )

...but whatever I try to use as parameter for SecurityQualityOfService
it does not work (as I expect it should ;-))

So if somebody can help me with an good link for more informations
or write some lines down as little explanation - every help is welcome

Nico_

postum scriptum: sorry for my german english ;)
tsehp
12-13-2000, 01:46 AM
is this parameter present in win nt4 headers ? check for winnt.h in m$ sdk.
does this function uses win2000 specific imports ? a lot of potential problems could rise on this case.
NicoDE
12-13-2000, 06:24 AM
Thanks for answering my questing (knowing it's not a 100% reversing problem)

The structures are really old and public through Windows NT4 DDK.
Thou can find NtOpenThread on every 32 Bit Windows NT; but it's not documented until these days (and never will).
Because Windows 2ooo published OpenThread it's possible to determine how NtOpenThread works by reversing the function.
In my project I have to use NtOpenThread to fine-tune the access on threads.
My "only" problem is; I don't know how to use SecurityQualityOfService.
Ok i can leave it blank, but my aim is to fully _understand_ the function and all of the possible options.

Nico_
DinDon
12-13-2000, 07:30 AM
(knowing it's not a 100% reversing problem)
IMHO reversing OSes (especially the closed sources ones) is far more fun than reversing protections...

I don't know how to use SecurityQualityOfService.

That structure is documented indeed by Microsoft. Have a look at
http://msdn.microsoft.com/library/psdk/winbase/accclsrv_4a5u.htm
[/quote]

I'm afraid you did not correctly reversed the first parameter required by NtOpenThread(). In fact I found that it must be the target Process ID (or 0), and not bInheritHandle!
In fact, if you put it to 1, the API fails on Windows NT.
The following C snippet works on Windows NT:

#include <windows.h>
#include <stdio.h>

typedef __declspec(dllimport) DWORD (WINAPI *PNATIVEFUNC)(
PHANDLE, ACCESS_MASK, PDWORD, PDWORD);

void
main(void)
{
PNATIVEFUNC pNtOpenThread;
HANDLE ThreadHandle;
DWORD status;
DWORD ObjAttr[] = { 0x18 /*length*/, 0, 0, 0, 0, 0 };
DWORD Params[2];

Params[0] = 0; // TargetPID;
Params[1] = 199; // TargetTID;

pNtOpenThread =(PNATIVEFUNC)GetProcAddress(
GetModuleHandle("ntdll"), "NtOpenThread");
printf("%x
", pNtOpenThread);

status = pNtOpenThread(&ThreadHandle, THREAD_ALL_ACCESS, ObjAttr, Params);
if (status) printf("%x
", status);
else {
printf("handle %x
", ThreadHandle);
while (1) Sleep(10000); // to see the handle with HandleEx
}

Regards.
NicoDE
12-13-2000, 12:49 PM
Many thanks for your help!

The last (first pushed reference) parameter is an CLIENT_ID, you are right.
How blind a man could be ;) Don't know why i did not found this in PSDK (less sleep ?).

Nico_


To laptoniC.... Thanks man !!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > To laptoniC.... Thanks man !!!
PDA

View Full Version : To laptoniC.... Thanks man !!!

SpeKKel!
12-12-2000, 02:18 PM
OK thanks for your reply on my elicense prog, i did it indeed in 10 sec (maybe 11) I used trw
(great programm) Removing the mmf.sys did remove the trial..( freelibrary must remember this bpx !!) ciaO........ SpeKKeL!.......


ftp client
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ftp client
PDA

View Full Version : ftp client

lipa-
12-12-2000, 06:11 PM
Hi there.
Hmm, want to write ftp client in win32asm, but dunno with what to start.
Any suugestions?


CrackZ reverse engineering site: Location of a tool?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CrackZ reverse engineering site: Location of a tool?
PDA

View Full Version : CrackZ reverse engineering site: Location of a tool?

morlac
12-12-2000, 07:22 PM
Hi everyone,
I was readin the news section at CackZ site when i noticed that FLEXGen and its source code mentioned and that its available.
Anyhow, there is no link to download it that i can locate in the site.

Did anybody or does anybody has the source for it?
If you do, can you email it to me?Ill appreciate it.

Morlac.
CrackZ
12-13-2000, 05:49 PM
Hiya morlac,

I have a feeling you may have e-mailed me about this before and I probably made a mental note to do something (then forgot ;-) ).

As FLEXlm has now moved on quite considerably I've re-published the FLEXGen link (now with the source code included, (lamers please don't abuse this ;-) ), its on http://zencrack2.cjb.net/Flexlm.htm by the time you read this.

Regards

CrackZ.
morlac
12-14-2000, 10:02 AM
Thankx man,
Although, it was not me who emailed you. But thanks alot anyway.

Regards,
Morlac


another kernel debugger?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > another kernel debugger?
PDA

View Full Version : another kernel debugger?

LostLascar
12-13-2000, 03:44 AM
New kernel debugger at fravia's: Ollydbg by Oleh Yuschuk and a link to this very thread i found there

http://fravia.2113.ch/tools.htm

looks kinda primitive, but it works
Solomon
12-13-2000, 06:00 AM
kernel debugger? don't think so ;)
bound
12-13-2000, 06:51 AM
Indeed, and it has already been discussed here 3 weeks ago ;)


a SetThreadContext & ERROR_NOACCESS problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > a SetThreadContext & ERROR_NOACCESS problem
PDA

View Full Version : a SetThreadContext & ERROR_NOACCESS problem

garph0
12-13-2000, 04:27 AM
Hi all :)
I'm here again with a question about my code injector tool:
the 'static' version (which Creates the process suspended and works on it befor letting it run) works (almost) well, so i decided to move on a dynamic version, which should attach to running processes.
The steps are almost the same, i'll repeat here so you'll haven't to read from previous posts:
1) Retrieve Thread and process handles (well, actually i obtain it from CreateProcess, but i don't use the CREATE_SUSPENDED)
2) SuspendThread()
3) Prepare a Shared Memory Mapped File with my new code, a page of the code found at entry point, some code to put back the original code back, and the code for a second thread (more on this later)
4) GetThreadContext and save it in the MMF, say MMFContext
5) Overwrite the target program entry point with the code to map the MMF and jump to the Injected code start
6) Create a duplicate of the target process main thread handle and save it in MMFhThread in the MMF
7) Modify the Eip in the context to the target program entry point
8) Resume the thread

when resumed the target program will map the MMF, execute the some code, execute the code in MMF to restore program's EP, then Create a new thread and enter in an endless loop.

the new thread will use the MMFhThread to
1) Suspend the main thread
2) restore it context <-------------- ERROR
3) resume the main thread

on step 2), SetThreadContext return FALSE, and GetLastError() tells ERROR_NOACCESS, which is the mapping of STATUS_ACCESSVIOLATION.
the documentation says:

Windows NT/ 2000: The handle must have the THREAD_SET_CONTEXT access right to the thread. For more information, see Thread Security and Access Rights.

I've not tested it under win98 (i will :) ), but when duplicating the handle i have requested THREAD_ALL_ACCESS and the operation completed successfully, so it shouldn't be a problem of privileges...

i'm pretty confused, do you ppl have any idea ?

thanks

garph0
NicoDE
12-13-2000, 07:36 AM
It's seems to be a problem with DuplicateHandle.
You should use DUPLICATE_SAME_ACCESS in dwOption and leave dwDesiredAccess blank - so you can be sure to copy the _same_ rights.
I believe THREAD_ALL_ACCESS alone is not enough and PROCESS_VM_OPERATION / PROCESS_VM_WRITE is needed (API intern) to set the context of an thread.
Last but not least, are you sure that the handle is copied to right process (handle table) ? ;)

Nico_
The Owl
12-13-2000, 07:44 AM
i'm not too familiar with the NT security system, but what i know from others is that having the privilege to do something does not mean that it is actually enabled. eg: the admin user normally has shutdown privilege but unless it is explicitly enabled by a thread running in the admin user's context, the thread won't be able to initiate a shutdown. this is the reason why uninstallers do something like this on NT:

GetCurrentProcess
OpenProcessToken
LookupPrivilegeValueA("SeShutdownPrivilege")
AdjustTokenPrivileges
ExitWindowsEx

of course, the scheme applies to all the other possible privileges as well.
garph0
12-13-2000, 05:52 PM
ok :) thanks ppl, i'll try if i'm missing something around here and i'll tell you :)

_but_ SuspendThread() works where SetThreadContext() fails, i'm not sure if it's an useful info

best regards

garph0
garph0
12-14-2000, 02:46 AM
ok, now SetThreadContext() is working 8-D
thanks to The Owl and NicoDE :)
it was a matter of Context structure alignment in memory, and i've been confused from this:

INFO: Mapping NT Status Error Codes to Win32 Error Codes

WINDOWS NT STATUS CODE WIN32 ERROR CODE
------------------------------------------------------------------
STATUS_DATATYPE_MISALIGNMENT ERROR_NOACCESS
STATUS_ACCESS_VIOLATION ERROR_NOACCESS

i thought of access violation while the structure was misaligned regardless of ALIGN DWORD directive ('cause it's buried in the code)

bien, now I've got a new problem, but still not a new question (i don't know what is going wrong): as soon as i resume the primary thread and terminate the secondary one i get this situation:

1) the secondary thread terminates
2) the primary thread runs for a little (it always seems to start from something like ntoskrn!ExUnexpectedInt (i'm not sure of the name, but it sounds like this) ), then it dies (cleanly)

bye all

garph0


RSA keygenning
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > RSA keygenning
PDA

View Full Version : RSA keygenning

DinDon
12-13-2000, 05:02 AM
Hi!

Just to avoid to reinvent the wheel...
Has anyone already managed to solve this problem?

Find a key k from this expression:

k^65537 mod M = N, where:
M and N are known huge integers (64 bytes long)
^ denotes the exponentiation operation
mod denotes the modulus operation (in C denoted as %, integer remainder between two integers)

In other words: the problem is to find the integer n-th root of an huge integer; the further modulus operation may make the things more difficult.
I digged through the net, but I could not find nothing interesting.
I suspect that some faster approach must exist, different from the classical RSA-breaking problem (which consist in finding two primes whose multiplication yields the modulus operand M).

My best regards to all.
Dizzy
12-13-2000, 06:05 AM
DinDon (12-12-2000 19:02):

Find a key k from this expression:

k^65537 mod M = N, where:
M and N are known huge integers (64 bytes long)

I suspect that some faster approach must exist, different from the classical RSA-breaking problem.

Good luck finding a method which is faster
than factorization... It's a really
hard mathematical problem.

FYI, 512 bit moduli have been factorized
using the GNFS (general number field sieve),
but no easy-to-use public implementation
is available. Also it would probably take
more resources than it's worth.

Take a look at http://www.codebook.org for
an interesting break of a 512 bit modulus
(stage 10).

Diz.
IcyDee
12-13-2000, 06:57 AM
If this were a 'normal' function such as

k^65537 = N

and you knew N then you could easily calculate k.

k = 65537th root of N

however the modulus M makes it significantly more difficult since effectively you are 'throwing away' information needed to reverse the calculation. The equation is inherently none-reversable (if that is the correct term). This only leaves a brute force approach which is what makes it infeasible for sufficiently large values on M and N.
Spath.
12-13-2000, 01:24 PM
> The equation is inherently none-reversable
> (if that is the correct term). This only leaves
> a brute force approach which is what makes
> it infeasible for sufficiently large values on M
> and N.

Uh ? There are efficient methods to solve such
equations, you should never use brute force for
that ; also efficiency of these methods does
not depend on how large N is, but how easily
you can factor it.
mike
12-13-2000, 04:19 PM
Are you designing the system or attacking it?

If you're attacking it, 64-bit numbers are the product of two 32-bit numbers, easily brute-forced over a weekend with a naive algorithm (loop through all odd numbers and check for divisibility).

If you're designing it, check out the protectionist's corner. From whom are you trying to protect the software? What functionality do you want to protect?
mike
12-13-2000, 04:24 PM
mike (12-13-2000 06:19):
64-bit numbers are the product of two 32-bit numbers, easily brute-forced over a weekend with a naive algorithm (loop through all odd numbers and check for divisibility).

Sorry, 64-byte numbers can't be brute-forced!

Why not replace M and N in the file you're attacking so that you can pick an arbitrary k?
DinDon
12-14-2000, 02:36 AM
Hi all!
Thanks to everybody for your answers...
Another project to be thrown to the trashcan...

dizzy:
Good luck finding a method which is faster
than factorization... It's a really
hard mathematical problem.
You are right. Thanks for the link (even if its content is not so technical). After reading that, I realized that even GNFS is not a feasible solution...

IcyDee:
the modulus M makes it significantly more difficult since effectively you are
'throwing away' information needed to reverse the calculation.
Correct! Furthermore, k^65537 mod M is different from k^65537 % M, as I thought before. It is not the same to apply the modulus operator just at the end of the exponentiation, but it must be applied after every multiplication performed to obtain the exponentiatiation!

Spath:
efficiency of these methods does
not depend on how large N is, but how easily
you can factor it.
Sorry, I do not understandand what are the methods you are talking of. Probably you are referring to factorization of the modulus operand M. But this is a practically impossible job, at least with just one PC...

mike:
Are you designing the system or attacking it?
Why not replace M and N in the file you're attacking so that you can pick an arbitrary k?
Nope, I am not a protectionist and I am not interested to protect my software...
Your solution (replacing M and N) is a good one, as would be to modify the code which compare the wrong encrypted key with the right encrypted one. But my initial target was just to build a keymaker in order to generate a valid usercode and an username without altering the executable (which is furthermore AsPacked or AsProtected) - ImageEye in my case.
As I have seen, thanks to your all help, this target is not possible.

My best regards.
Spath
12-14-2000, 11:00 AM
> It is not the same to apply the modulus operator
> just at the end of the exponentiation, but it must be applied after
> every multiplication performed to obtain the exponentiatiation!

No, they are the same (basic multiplication in Z/nZ), but
implementations with multiple intermediate modulos are much faster.

> Sorry, I do not understandand what are the methods you are talking of.
> Probably you are referring to factorization of the modulus operand M.
> But this is a practically impossible job, at least with just one PC...

Clearly solving equations in Z/nZ is generally speaking more complicated
than solving them in Z. My point was that one never use brute-force
to solve equations in Z/nZ, one can for instance use Euler totient
function for this, which depends on modulo factorization. Now this
does not help for your particular problem, i'm afraid.

Regards,

Spath.
The Owl
12-15-2000, 03:21 PM
this was written a while ago, hopefully everyone will find something useful in it.

1.1 RSA basics

RSA is a public key encryption system based on the arithmetics of
(large) integers. in this system a message is represented as a series of
large (but finite) integers, and the encrpytion/decryption process will
eventually transmit these numbers. since each of these integers goes
through the same process (think of it as a block cipher with larger than
usual blocks), let's discuss what happens with one such message block.

the basic insight of RSA is that Euler's theorem can be put to use in a
public key system. the theorem states the following:

(1.1) m^phi(n) = 1 mod n

where 'm' and 'n' are integers, 0 <= m < n, gcd(m,n) = 1 and phi(n) is
Euler's function (giving the number of integers relative prime to 'n',
i.e. for a prime 'p': phi(p) = p-1).

Fermat's little theorem is the special case of Euler's for n = p where
'p' is a prime:

(1.2) m^(p-1) = 1 mod p

from Euler's theorem we can derive the following:

(1.3) m^(phi(n)+1) = m mod n

as we can see, modulo exponentiation will be a no-op when a very
specific exponent is used (in other words, the exponent in mod n
arithmetics can be reduced mod phi(n)) and this is exactly what a full
cycle of RSA encryption and decryption does. namely, both of these
operations perform a modulo exponentiation (with encryption exponent 'e'
and decryption exponent 'd') as is shown below:

(1.4) m^e = c mod n

('c' is the ciphertext and is eventually transmitted to the receiver)

(1.5) c^d = m^(e*d) = m mod n

the condition to make this whole scheme to work is that

(1.6) e*d = 1 mod phi(n)

the rest of the RSA scheme is about the choice for 'n' so that 'e' and
'd' can be chosen/computed in an efficient way (by the sender of course)
and to allow all possible messages to be encrypted (remember, Euler's
theorem required gcd(m,n) = 1). as it turns out, if we choose 'n' to be
a product of two primes 'p' and 'q', and 'e' such that gcd(e,phi(n)) = 1
then all the above equations will work as expected. in this case:

(1.7) phi(n) = phi(p*q) = (p-1)*(q-1).

and either of 'd' or 'e' can be randomly chosen and the other computed
from (1.6). in practice, we place certain restrictions on them in order
to deter some attacks and make computations fast.
The Owl
12-15-2000, 03:22 PM
1.2 some observations regarding RSA and mod n arithmetics

the security of RSA is not known (no mathematical proof exists either
pro or contra), all we know is that our current knowledge is not
sufficient to determine

'm' from (1.4) (modulo n e'th root problem)
'm' from (1.5) without knowing 'd'
'd' from (1.6) without knowing phi(n)
phi(n) from (1.7) without knowing 'p' and 'q'
'p' and 'q' without factorizing 'n'

for a sufficiently large 'n' (recommended minimum is 1024 bits, 2048 and
up are desired). in summary, the security of RSA seems to be based on
the intracktability of the modulo n root and the integer factorization
problems.

it is interesting to see from a more practical point of view where RSA
(and mod n arithmetics in general) gets its security from. consider

(1.8) x^y = z mod n

which is equivalent to

(1.9) x^y = k*n + z

for some integer 'k'. in plain english it means that we LOSE information
(the value of 'k') when we perform the mod n reduction. the more this
information is (the higher the possible range for 'k' is) the harder it
will be to reconstruct 'k' (which is what we will eventually perform if
we manage to solve (1.8) for one of its variables).

for the mathematically challenged reader here is a more visual approach:
imagine the function f(x) = x^y in the x-y plane (for some fixed 'y').
the curve looks like a parabola. if we consider integer values for 'x'
only, we will get a series of dots along the curve, like a necklace. we
notice that the larger 'x' is the further the dots are from each other.
now, imagine what happens if reduce f(x) mod n: our necklace breaks down
into smaller parts and these parts will slip down to the 'x' axis along
the 'y' one. the 'length' of these parts decreases as 'x' increases, but
for 'small' values one can actually recognize the arcs of the original
curve (the larger 'n' is compared to 'y' the better the effect is).
however, as soon as f(x+1) - f(x) becomes larger than 'n' itself we
arrive at what best can be described as chaos and that is what makes
mod n arithmetics based algorithms intracktable (at least these days).
DinDon
12-18-2000, 04:01 AM
Thanks, TheOwl (and Spath), for your lucid explanations in a rather obscure matter.

I have spent some hours until now playing with BC.EXE, giant integer libraries and 64-digits numbers (and I forgot to poll the forum in the last days :-))

Aaargh! How can I disable that stupid yellow face??? The backslash in front of the ASCII characters of the emotion does not work!

Cheers.


Flexlm signature files or Flair Toolkit for IDA Pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm signature files or Flair Toolkit for IDA Pro
PDA

View Full Version : Flexlm signature files or Flair Toolkit for IDA Pro

Sophos
12-13-2000, 01:46 PM
Many of the newer programs using Flexlm are statically linking so there is no nice lmgr32xx.dll to watch. To easily find the Flexlm functions for these software packages the signature files for Flexlm .dll's are needed or the Flair Toolkit to generate the signature files are needed.

I have read every tutorial available about Flexlm and IDA Pro. All assume that you have the sig files or instruct you to download the Flair Toolkit from the IDA Pro web site. The Flair toolkit is unavailable without a password.

I have also extensively looked around the web and reversing web sites using methods described on Fravia's web site to find the sig files or Flair. I really have spent a lot of time searching to no avail.

Does anyone know a workaround, where Flexlm sig files or where the Flair toolkit can be obtained other than the IDA Pro web site?

BTW I have installed the plugin located on the immortal decedents web site for finding functions inside other files, but I can't seem to make it find functions on a target with statically linked known version of Flexlm.
tsehp
12-13-2000, 06:29 PM
sorry no answer for this, thanks not to post three duplicates of your topic here.
regards,

tsehp
Nolan Blender
12-13-2000, 09:07 PM
I have read every tutorial available about Flexlm and IDA Pro. All assume that you have the sig files or instruct you to download the Flair Toolkit from the IDA Pro web site. The Flair toolkit is unavailable without a password.

Hmm - maybe you should check some of the
standard tools sites like players tools -
I found a copy within about 30 seconds of
searching.

I have also extensively looked around the web and reversing web sites using methods described on Fravia's web site to find the sig files or Flair. I really have spent a lot of time searching to no avail.

I'll even provide you the link:
http://156.17.4.4/~player/playtools/disassemblers.html

Does anyone know a workaround, where Flexlm sig files or where the Flair toolkit can be obtained other than the IDA Pro web site?

see above.

BTW I have installed the plugin located on the immortal decedents web site for finding functions inside other files, but I can't seem to make it find functions on a target with statically linked known version of Flexlm.

Well, unless you have applied the signature,
IDA doesn't have a better idea of the name
of the function, so using Amante's plugins
aren't as helpful as when the sigs are
applied.
sailor
12-13-2000, 11:00 PM
Sophos (12-13-2000 03:46):
Many of the newer programs using Flexlm are statically linking so there is no nice lmgr32xx.dll to watch. To easily find the Flexlm functions for these software packages the signature files for Flexlm .dll's are needed or the Flair Toolkit to generate the signature files are needed.

I have read every tutorial available about Flexlm and IDA Pro. All assume that you have the sig files or instruct you to download the Flair Toolkit from the IDA Pro web site. The Flair toolkit is unavailable without a password.

I have also extensively looked around the web and reversing web sites using methods described on Fravia's web site to find the sig files or Flair. I really have spent a lot of time searching to no avail.

Does anyone know a workaround, where Flexlm sig files or where the Flair toolkit can be obtained other than the IDA Pro web site?

BTW I have installed the plugin located on the immortal decedents web site for finding functions inside other files, but I can't seem to make it find functions on a target with statically linked known version of Flexlm.

Sophos,

thats exactly the same conclusion I came to as well.
I've been trying to crack Aldec HDL and I've been asking Nolan similar questions.
Nolan, thanks for providing the link for flair as it will definitely be useful for me.

Sailor
Sophos
12-14-2000, 09:44 AM
[quote]+Tsehp (12-13-2000 08:29):
sorry no answer for this, thanks not to post three duplicates of your topic here.
regards,

Sorry about that. I was getting to the message board from CrackZ's website. For some reason evey time I returned to the message board the topic would post again automatically until I shut my browser down. It won't happen again.
Sophos
12-14-2000, 09:50 AM
[quote]Nolan Blender (12-13-2000 11:07):

Thank you for the link Nolan, and for all of your Flexlm essays. Your latest one came at a perfect time for me as I am working on a sofware suite that uses user defined crypt filters.


Anyone have any experience with this, know of a tutorial on it?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Anyone have any experience with this, know of a tutorial on it?
PDA

View Full Version : Anyone have any experience with this, know of a tutorial on it?

Mcooly
12-13-2000, 09:00 PM
There's a game that I'm working on with some protection that I can't quite figure out. I can't identify the protection nor can any program I've downloaded.

Anyway the exe is packed as I would expect and there's anti-softice code that catches SI even with frogice on bulletproof, boundscheck interface diabled and the backdoor commands diabled (not supprised as there seems to be many ways to detect it). It seems to detect all my other debuggers except for the trw2000 demo. This is really beside the point.

I did a standard dump of the uncommpressed program, rebuilt the working exe and it crashed. I debugged my exe and apparently the unpacker created a tmp file which is in fact an exe or dll (not sure which, it shows as a running program but the game makes calls to it like a dll).

So I assumed I needed to dump this. However, the tmp file has no imports or exports and neither the compressed exe or my dumped version has imports for it. They are apparent added to the uncompressed program durring some stage of the unpacking code.

Has anyone seen this? Maybe know what protection it is using? Or maybe a tutorial?
Mcooly
12-13-2000, 09:07 PM
Oops. Apparently I missed ArthaXerXes' reply on my other thread.

"Sacrifice uses Safedisc 2 (at least patch 1 does), so yes, that is obfuscation + ciphering."

So ArthaXerXes, how did you know it uses Safedisc 2? I'm very new to this and I still don't get how you all find this stuff out.

Also, know any good or any tutorials on Safedisc 2?

BTW: This is board really helps the learning process, thanks ArthaXerXes and everyone else.


Lotus Notes "user.id" bruteforcing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Lotus Notes "user.id" bruteforcing
PDA

View Full Version : Lotus Notes "user.id" bruteforcing

Nike
12-14-2000, 01:30 AM
Does anybody have ANY info about Lotus Notes/Domino "user.id" file structure? I wanna write simple bruteforcing tool, but walking through Lotus security DLL-s is too long...


Help with Ultra Edit ver 7.20a
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with Ultra Edit ver 7.20a
PDA

View Full Version : Help with Ultra Edit ver 7.20a

xOptiMus
12-14-2000, 01:43 PM
Hi all

I've just managed to patch the latest version of Ultra Edit ver 7.20a. However it was'nt my intention to patch it, I started out fishing for the serial, but after a few days of no luck decided to make do with patching it.

I'm usualy quite good at tracing serials, but this prog has so far beaten me! I just can't seem to even get near to it. I know the damn prog must check the serial that I enter with the real one somewhere - but where, I just do not know!

Can anyone give me a hint as to where I should be looking for this serial check? Is there some method I can use to track it down? I've tried breaking on hmemcpy, GetWindowTextA, GetDlgItemTextA etc, but they don't work. After entering a username and serial the prog informs you that it must shut down to check the serial, so I guess that it must do it's check when you restart it.

Please can someone help, I'm clean out of ideas.

xOptiMus
tsehp
12-14-2000, 07:41 PM
maybe yes, maybe not.
One method is to freeze the target just after entering the serial, you can do a bmsg on the button's handle, check for hwnd command in sice, good doc about it on cracker's notes.
Then you bpmb or bpr it, meaning that a read or write access to the serial you entered can lead you to the check routine.
win32 api's can copy it a lot into several mem locations before, so take a good trace of where it was copied.
witch
12-15-2000, 09:11 AM
Try to intercept WM_CHAR message.
Instructor
12-15-2000, 11:23 AM
Hi, I can send you an own tutorial about
cracking this, but sorry only in german.
I think, the String data ref will help you.

Please give me your email-adress, if you want it.


mentor mgcld
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > mentor mgcld
PDA

View Full Version : mentor mgcld

kittykat
12-14-2000, 06:21 PM
Mentor Graphics is using flexlm to protect their products. Are they using any special flexlm protection cause I can't seem to use their products just by getting the usual encryption seeds.

The daemon's name is mgcld.
Nolan Blender
12-15-2000, 11:01 AM
kittykat (12-14-2000 08:21):
Mentor Graphics is using flexlm to protect their products. Are they using any special flexlm protection cause I can't seem to use their products just by getting the usual encryption seeds.

The daemon's name is mgcld.

They check the vendor string using a proprietary checksum
algorithm. If you get the message "FATAL CS ERROR" it's because
you don't have the checksum correct.
kittykat
12-15-2000, 06:42 PM
So, is this a kind of vendor defined checkout filter implementation, that is if I follow Amante's essay on this particular topic - I should be able to reverse this product ??

Or, as you say - proprietary checksum algorithm which means following that essay is not sufficient to simply reverse the product ?

Which comes to the next question - how do I go about tackling this kind of protection scheme - any ideas ??
Nolan Blender
12-18-2000, 11:42 AM
Well, it's not all that tough a protection - basically certain
information such as the start date, number of licenses, expiry, and feature name are combined.
This is run through a checksum routine, and
the value compared against one one supplied
in the vendor_string.

So it's not too hard, and much easier than many shareware
protections.

--nb


a public question to the owl, concerning a tracer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > a public question to the owl, concerning a tracer
PDA

View Full Version : a public question to the owl, concerning a tracer

tsehp
12-14-2000, 07:51 PM
hi owl,
I just wonder if you got my e-mails :(
I'm actually looking for the best solution :
the tracer state's machine is on the dll I installed into the target's context, and the tracing thread too. At the opposite of icedump's, I have to send a much bigger structure to the state machine, the eip check is not one single interval, but a table of possible addresses that could contain up to 5000 entries. What's the best solution to communicate with my iat resolver ? IPC ? mapped file ? something else ?
TIA to give me some detail about the best solution, the reusability of the dll depends a lot on this.
Just to report you, I'm actually at the emulating seh install attempt stage, I've to say that at this point I could just implement all the icedump's tracer protections.

regards,

tsehp
The Owl
12-15-2000, 03:25 AM
yes, i got all your mails (the net is not *such* an unreliable medium after all ;-), but i've been just way too busy this week to even barely think about them - sorry, will do that at the weekend).
tsehp
12-15-2000, 01:46 PM
Take your time, I'm not struck at this point, I'm just reversing icedump's source to include the most possible features into my tracer,
the exchanges with my main app can be done later, but I really don't want to make an IPC interface too complicated, this dll must be easily reusable.
best regards,

+Tsehp
Lord Soth
12-16-2000, 12:28 AM
This question might seem dumb, but what are you coding tsehp ?

LS
tsehp
12-17-2000, 06:21 PM
a module, containing the state machine, is installed and attached into the target process, then a thread is created to trace some thunkslots,
when the trace is finished, I have to report my main app about the address it found, the main app is another process, so I'm looking for the better way to intercommunicate between the two processes.
If I have a lot of data to transmit, windows messages seems not very good, so I'm asking for the better solution.
regards,
DinDon
12-18-2000, 04:24 AM
Every time I want to exchange a lot of data between processes, I use a shared memory between them (that's the way Microsoft APIMON works...).
Obviously you have to protect (synchronize) the accesses to the common memory with a Mutex.

Furthermore, if your injected module is a DLL, it is very easy to build it with a shared section, so you have no need to dynamically allocate the shared memory with the MapViewOfFile API): it is a sort of static shared memory...

Please have a look at http://support.microsoft.com/support/kb/articles/Q125/6/77.asp

Regards.
tsehp
12-18-2000, 04:30 PM
thanks dindon,
just what I needed, I didn't know that it was such an easy task with a dll.
regards,


Für deutsche Leser nur..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Für deutsche Leser nur..
PDA

View Full Version : Für deutsche Leser nur..

aimless
12-15-2000, 07:42 AM
Schließlich habe ich gelernt wie zu Rede Deutsch, die "Schau-ab" über zu mögen, hier macht. Tatsächlich hat dies von einem online Übersetzung Dienst erhalten.

Hoffen Sie, daß dies den heck aus newbies beeindruckt, und denken sie macht, daß "Aimless" auch einer der Burschen ist. Yuk, yuk. Hübscher billiger Trick, was?
NicoDE
12-15-2000, 08:37 AM
Was will der (Wort)Kuenstler uns damit sagen ?
Da erbla/3t ja selbst Feuerbach ! ;) *lach*

Gru/3 NicoDe
tola
12-15-2000, 10:19 AM
retranslated using babelfish ;)
----
Finally I learned as to speech German to like " Schau off " over here make. This from a service kept on-line translation actual. Hope that this impresses the tail from newbies, and think it make that " Aimless " is also one Bur. Yuk, yuk. Pretty cheap trick, which?
----
*lol*


W32Dasm and Win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > W32Dasm and Win2k
PDA

View Full Version : W32Dasm and Win2k

Hoof Arted
12-17-2000, 04:21 AM
Has anyone tried to run W32Dasm on Windows 2000 and managed to get it working 100% ?

I have tried to get info on this from everywhere on the net, including IRC shite.

When you load up the Dasm software and launch the app for debugging, windows 2000 seams to kill both the W32Dasm process and the app process when you try see the api call info. Is there a way around this ?

What I can say is that W32Dasm runs perfectly on Win2K Pro RC2 and below.

Any info would be appreciated.
tessio
12-18-2000, 04:51 PM
Make sure you have the most up to date version. It works fine for me on Windows 2000 buil 2195 (final release build).
Hoof Arted
12-20-2000, 03:09 AM
I am not so sure that it is running 100% for you as I have installed it on Build 2195 and below and it does not work on 2195 correctly. Have you tried to work with it for a while or just open it? Just openning it is not the problem, intersepting the API calls is. I am using W32dasm 8.93 and Win2k build 2195 SP1. Service pack does not make a diff.

It is almost as though Windows 2000 has been made to kill the processes as soon as it detects that something is trying to inspect the memory.

Hoof
Jack
12-20-2000, 03:47 AM
Try this. Change the reg value
HKLM\System\CurrentControlSet\Control\Session Manager\Memory Managment\EnforceWriteProtection = 1; to = 0

Win2K write protects memory, putting a 0 there disables it. You have to reboot after changing the value. If you installed SI this should have been automatic during the install and has all ready been done.


Flair toolkit ... how to make signature files from dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flair toolkit ... how to make signature files from dll
PDA

View Full Version : Flair toolkit ... how to make signature files from dll

sailor
12-18-2000, 12:23 AM
Hi there,

I've been trying to make signature files for ida using the flair tool kit but without much success.

I've been trying to get the signature files for the flexlm lmgr327a.dll.

When I do plb lmgr327a.lib output
Everything looks like its fine but the pat file has the following

LMGR327A.dll 0000FF25..........................................................
.. 00 0000 0006 :0000 _lp_errstring ^0002 lp_errstring
LMGR327A.dll 0000 FF25..........................................................
.. 00 0000 0006 :0000 _lp_heartbeat ^0002 lp_heartbeat

Basically everything points to the dll file.

I tried doing a plb on lmgr327a.dll and I get an error saying its not a ar/coff file.

What switches should I be using for dll files ?
The Owl
12-18-2000, 04:25 AM
1. import libraries are just that, they won't have the real code you would want to feed into pcf. instead you need a library that is used for static linking (which therefore must have all the relevant code/data). since i don't know flexlm, you have to find it out yourself, probably there aren't too many candidates ;-).

2. you can't feed a .dll into pcf, although technically one should be able to write an app that can produce the .pat file from a .dll as well. your better option would be to load the .dll into IDA and export it to a .pat file using quine's IDC script.
Sophos
12-18-2000, 09:42 AM
The Flair toolkit is applied to *.lib and *.obj files. These files are contained inside of the Flexlm SDK for the version you are working on. You can download several versions from CrackZ's website. Install the SDK and then search it for *.lib and *.obj files. Feed these files into the PCF.exe and then feed the *.pat files into sigmake.exe. Check out the readme for how to handle errors.
sailor
12-19-2000, 01:54 AM
Sophos (12-17-2000 23:42):
The Flair toolkit is applied to *.lib and *.obj files. These files are contained inside of the Flexlm SDK for the version you are working on. You can download several versions from CrackZ's website. Install the SDK and then search it for *.lib and *.obj files. Feed these files into the PCF.exe and then feed the *.pat files into sigmake.exe. Check out the readme for how to handle errors.

The lmgr327a.dll I got was from Crackz's site SDK. I couldnt find any obj files but I'll keep on looking ...

thanks for the tips.

Sailor
sailor
12-19-2000, 02:16 AM
The Owl (12-17-2000 18:25):
1. import libraries are just that, they won't have the real code you would want to feed into pcf. instead you need a library that is used for static linking (which therefore must have all the relevant code/data). since i don't know flexlm, you have to find it out yourself, probably there aren't too many candidates ;-).

I tried using quine's idc script and plugin from a page I found on the web. It didnt seem to work with ida 4.04. Do you have an update url for quine's scripts ?

Thanks in advance

Sailor
2. you can't feed a .dll into pcf, although technically one should be able to write an app that can produce the .pat file from a .dll as well. your better option would be to load the .dll into IDA and export it to a .pat file using quine's IDC script.
sailor
12-19-2000, 02:21 AM
sailor (12-18-2000 16:16):
The Owl (12-17-2000 18:25):
1. import libraries are just that, they won't have the real code you would want to feed into pcf. instead you need a library that is used for static linking (which therefore must have all the relevant code/data). since i don't know flexlm, you have to find it out yourself, probably there aren't too many candidates ;-).

2. you can't feed a .dll into pcf, although technically one should be able to write an app that can produce the .pat file from a .dll as well. your better option would be to load the .dll into IDA and export it to a .pat file using quine's IDC script.

I tried using quine's idc script and plugin from a page I found on the web. It didnt seem to work with ida 4.04. Do you have an update url for quine's scripts or does anybody have the updated scripts ?

Thanks in advance

Sailor

Oops sorry for the double post but I forgot to list the url that I used.

http://skyscraper.fortunecity.com/epson/928/menu.htm
The Owl
12-19-2000, 05:46 AM
[/quote]
I tried using quine's idc script and plugin from a page I found on the web. It didnt seem to work with ida 4.04. Do you have an update url for quine's scripts or does anybody have the updated scripts ?
[/quote]

for 4.04+ find/change this line to this (AskFile() has changed a bit):

pat_name = AskFile(1,"*.pat", "Choose where to save the .pat file:");

as far as i know he never published any updated versions of neither the script nor the plugin.
sailor
12-19-2000, 11:15 PM
The Owl (12-18-2000 19:46):

I tried using quine's idc script and plugin from a page I found on the web. It didnt seem to work with ida 4.04. Do you have an update url for quine's scripts or does anybody have the updated scripts ?
[/quote]

for 4.04+ find/change this line to this (AskFile() has changed a bit):

pat_name = AskFile(1,"*.pat", "Choose where to save the .pat file:");

as far as i know he never published any updated versions of neither the script nor the plugin.[/quote]

You guys are wonderful. I finally have all the functions in target dll identified.

Thanks again.

Sailor


SoftlOCX v5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SoftlOCX v5
PDA

View Full Version : SoftlOCX v5

·TeKiN [²K]
12-18-2000, 02:38 PM
Hi,

I would like to know if a tut exists on this well-known protection.

First of all, it checks if SICE or TRW is loaded, of course.
(I installed SICE under NT2K Workstation, and TRW2K 1.22 under 98.)

I'm trying to reverse it with TRW2K and it just crash my PC when I launch any SoftlOCX protected programs. So let's the questions begin, 1, 2, 3, GO!

1. Will returned values be different on Win2K and 98 platforms if it finds SICE?

2. As TRW only runs under 98, how to bypass this check? Have I to install SICE under 98 too in order to compare the values if I doesn't find SICE or FrogICE/NTICE?

3. Which API to use? As LaZaRuS said in his essay, hmemcpy doesn't work nor GetWindowTextA but GetWindowTextLenght yes. Is it the same case or is it another API used to do this?

4. I've found the great util by Chafe[TMG]. Thanks him, he's a great reverser. He made an unwrapper of any SoftlOCX v5 protected progs and made reverser's lifes easier but anyway I want to fool this protection with my own hands. I've found a tut of LaZaRuS on Fusion v1 but I doesn't cover the same version of SoftlOCX so they had time to improve their protection till now.

5. Does anyone know how unpack this sort of protection? Like Chafe's util do but with a debugger? I'm very interested in ;)

Sincerely,


My last question about RCE CD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > My last question about RCE CD
PDA

View Full Version : My last question about RCE CD

Dya-Blo
12-18-2000, 04:03 PM
Hello,

will someone be nice enough to upload it to a ftp (i give the access) ?
Mail me plz : dya-blo@gmx.net

See U.
Cx
12-18-2000, 04:40 PM
Please can someone post an image file to one of the cd images newsgroups, and then we can all benefit :) Don't mind which format - iso or bin/cue
?ferret
12-18-2000, 08:39 PM
/me shakes his head in disbelief...

I guess you can't please everyone.......

Look guys....the title itself is self-explanatory.

It is an RCE *CD*...not RCE download file.....if you really want the headaches associated with the ftp site to return, send me a blank CD & return postage....when you get your copy you can upload it wherever you like. But, when people are giving you their time and knowledge for free....don't bitch about the format.

(sorry....had a VERY bad day) ;-)
garph0
01-10-2001, 10:33 AM
I had an idea some time ago reading about this topic, but then i forgot to post it ;)
i haven't checked the threads, so i hope thi is not a dupe... in case forgive me.
if somebody doesn't want to give his home address, i think it would be simple to use a P.O. Box :) for just a few money you can go to a post office and get one.
In advance if you don't want to leave any trace of where you live you can ask to a friend living in another town/state/galaxy to open the po box in his town and mail to you the packet.

hope this will help.

greets.

garph0


What is this target Packed/Encrypted with?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What is this target Packed/Encrypted with?
PDA

View Full Version : What is this target Packed/Encrypted with?

xOptiMus
12-20-2000, 12:51 PM
Hi all

Have just disassembled a target (ispeed.exe) in w32dasm and have noticed that it can only disassemble about a dozen or so lines. I realise that it must be packed/encrypted because there is no code. I have tested the file with several file analyzers including file sniffer, but have failed to identify the packer. As a last resort I have copied the first few lines from w32dasm and pasted them here in the hope that someone will be able to identify the packer by looking at the object data - there are some weird entries there, such as BSS and kdata.

Incidently, this target (beta version) was taken from January's issue cover disc of Dot Net mag. The latest version which can be downloaded from: http://www.hms.com/apps/issetup.exe gives a slightly different sections listing in W32Dasm, but it still cannot be disassembled! I've been told that it is a modified version of Asprotect ver 1.1.
+Teshp, I hope you and your eagerly awaited new iat rebuilder can solve this one!

Disassembly of File: iSpeed.EXE
Code Offset = 00000000, Code Size = 00000000
Data Offset = 00055000, Data Size = 00002C00

Number of Objects = 0010 (dec), Imagebase = 00400000h

Object01: CODE RVA: 00001000 Offset: 00000400 Size: 00054C00 Flags: C0000040
Object02: DATA RVA: 000E8000 Offset: 00055000 Size: 00002C00 Flags: C0000040
Object03: BSS RVA: 000ED000 Offset: 00057C00 Size: 00000000 Flags: C0000040
Object04: .idata RVA: 000EF000 Offset: 00057C00 Size: 00001000 Flags: C0000040
Object05: .tls RVA: 000F2000 Offset: 00058C00 Size: 00000000 Flags: C0000040
Object06: .rdata RVA: 000F3000 Offset: 00058C00 Size: 00000200 Flags: C0000040
Object07: .reloc RVA: 000F4000 Offset: 00058E00 Size: 00000000 Flags: C0000040
Object08: .rsrc RVA: 00104000 Offset: 00058E00 Size: 0001A600 Flags: C0000040
Object09: .kdata RVA: 00139000 Offset: 00073400 Size: 00002200 Flags: C0000040
Object10: .data RVA: 0013C000 Offset: 00075600 Size: 00000000 Flags: C0000040

Hope someone recognizes the packer from the above code.

Any help greatly appreciated

xOptiMus
CrackZ
12-20-2000, 02:24 PM
Hiya,

Well here goes with a spur of moment reply, I didn't look at your target but I'm guessing on 2 counts.

c0000040 section flags and extra 2 sections, one of which called .data, looks pretty much to me like ASPack. Others with more bandwidth can probably confirm that for you.

Looks like your in luck too, section names suggest a Borland compiler, as I recall, early versions of ASPack didn't trash Borland compiled .idata's.

Regards

CrackZ.


UPX Unpacking .dll file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > UPX Unpacking .dll file
PDA

View Full Version : UPX Unpacking .dll file

opx
12-20-2000, 10:17 PM
UPX Unpacking .exe OK.
UPX Unpacking .dll ?
ok
12-25-2000, 02:06 PM
ok !


Clipper 5.01 dongle cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Clipper 5.01 dongle cracking
PDA

View Full Version : Clipper 5.01 dongle cracking

Rainor
12-20-2000, 11:12 PM
does anyone had experience cracking CLIPPER 5.01 DOS app????, i'm dealing with a donggle protection , the target app is compile using BLINKER. There is any disasm avalible for CLIPPER 5.01 / BLINKER???

any help is welcome
gAnZ
12-23-2000, 05:19 AM
Mail me, and I'll try to help...


slm flirt sigs and ida dll problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > slm flirt sigs and ida dll problem
PDA

View Full Version : slm flirt sigs and ida dll problem

Sab
12-20-2000, 11:40 PM
um.. just a few questions wondering if anyone has the answer.
First one is when loading a sentinal lm protected application into ida.. it asks for a lsapiw32.dll; this is a dll used by the protection system. Problem is ida wont except lsapiw32 . says something along the lines of "lsapiw32.dll cannot be accepted as module LSAPIW32" (btw it will take any other dll i spit at it though).

Second question is the ida flirt signatures. When applying the flirt signatures to the protected app it doesnt have any results for sentinal lm.? sometimes it says 1 applied sometimes it says 0 applied. Can this be because of the dll deal ? who knows heh thanks for reading
Nagual
12-21-2000, 11:46 AM
I had same problem :(
The couse of the problem - dll export table.
It contain no Ordinals and Names of functions
How can we rebuild Export section? - i dont know :(
Nolan Blender
12-21-2000, 02:36 PM
I believe that there are libs associated with
the appropriate DLL's supplied with the SDK.

If no one is forthcoming with the full sigs,
I'll generate them when I get some time.

--nb.
CrackZ
12-22-2000, 09:38 PM
Hiya,

I think the answer here is a combination of the 2 previous posts ;-). The IDA problem you mention I've had with several other dll's (including lsapiw32.dll), no idea why since the export table of my lsapiw32.dll was absolutely fine, name and ordinal, how do I know this?, well I'm writing a replacement so had too know ;-). I did however find that by just saying cancel IDA did find all the names anyway ;-). msym and bpx time.

The key with FLIRT is applying a signature file generated from the .lib or at least the compiler interface you think the developer used, 90% of the time it seems to be VC++. If you want the various libs drop me an e-mail.

Regards

CrackZ.
Sab
12-22-2000, 11:55 PM
i thank u kindly for your replies, i did just end up useing the good ole cancel button however i did fix it by useing the lsapwhatever.dll by useing the one supplied in the sdk and not the one my app came with (also different sizes hrm..). Anyways i also got the flirts going thx all ( : (PS i was dieing to read the replies but mirror was down for 12 hours or so) C ya again -Sab


need some targets to test the iat rebuilder
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > need some targets to test the iat rebuilder
PDA

View Full Version : need some targets to test the iat rebuilder

tsehp
12-21-2000, 06:58 AM
hi,
it's actually almost finished, and able to reconstruct all iat entries, encrypted or not for :
-asprotect (all versions)
-vbox 4.3 (encrypted iat's)
So I need new targets, thanks to give me links for other packed apps
with iat's to rebuild, with other protection schemes than the above,
this will allow the tool to work on all the iat related protection schemes.
regards,

+Tsehp
DinDon
12-21-2000, 07:34 AM
Waiting for your masterpiece (sources would be great too...)

Regarding the links, have a look at xoptimus thread
(target at http://www.hms.com/apps/issetup.exe)
zeduser
12-21-2000, 08:08 AM
How about Advanced Direct Remailer 2.0 from Elconsoft? CASPR 0952 won't unpack it. CASPR worked on ADR 1.62 with no problem.

http://www.elcomsoft.com/ADR/adr.zip
noname
12-21-2000, 08:14 AM
Hi Tsehp,
Tag&rename
url http://www.softpointer.com

regards
noname
tsehp
12-21-2000, 02:41 PM
Thanks guys,
I will then finish testing my tool with those three targets, but before
releasing it, I want el-caracol and the owl to finish to test the beta 1,
then you can believe that I'll release this freely on the main server.
I will only give parts of the source to help people that wants to do the same, and actually working on such related schemes. The idea this time is to gather some people on this project, but the info will be available for everyone who asks.
Be patient, it's coming soon. Thanks again for all the great people that helped me on this messageboard, with special words to :
-The owl (unbelievable knowledge on this)
-El caracol, French cracker and funniest essays I've ever read.
-Arthaxerxes, idem and working on things that nobody did before.
and all of you, still giving this place such a good spirit of knowledge exchange.

Time to go back to work, just to finish before Christmas.

best regards,

+Tsehp
LaptoniC
12-23-2000, 07:20 AM
Adobe LiveMotion http://www.adobe.com vbox 4.3
NetObjectsFusion v5.0 http://www.netobjects.com vbox 4.3 but somehow different
tsehp
12-24-2000, 10:06 AM
thanks again !
I'm sorry but the beta of my app will be delayed again :(
Why ? because a badly needed api that I used on win nt is not implemented at all on win98, so I'm working hard to emulate it, have no choice. If someone knows its CreateRemoteThread .
later,

+Tsehp
tsehp
12-25-2000, 04:37 AM
zeduser (12-20-2000 22:08):
How about Advanced Direct Remailer 2.0 from Elconsoft? CASPR 0952 won't unpack it. CASPR worked on ADR 1.62 with no problem.

http://www.elcomsoft.com/ADR/adr.zip

It was resolved, see the attachment. I have to port it to win9x and
will release it pretty soon.
regards,

+Tsehp
tsehp
12-25-2000, 04:39 AM
LaptoniC (12-22-2000 21:20):
Adobe LiveMotion http://www.adobe.com vbox 4.3
NetObjectsFusion v5.0 http://www.netobjects.com vbox 4.3 but somehow different

Just tried netfusion, quite a big one but resolved also, see the attachment.
regards,

Tsehp
tsehp
12-25-2000, 04:39 AM
LaptoniC (12-22-2000 21:20):
Adobe LiveMotion http://www.adobe.com vbox 4.3
NetObjectsFusion v5.0 http://www.netobjects.com vbox 4.3 but somehow different

Just tried netfusion, quite a big one but resolved also, see the attachment.
regards,

Tsehp
K-BOY
01-10-2001, 08:07 PM
This piece is a little bit weird to me
http://www.addon-factory.com/download/cheet!_v1.12.zip
can it be tested ?
Thanks
LaptoniC
01-10-2001, 08:24 PM
Just tried netfusion, quite a big one but resolved also, see the attachment.
regards,
Tsehp
There is some question marks are they ok ?.Also netobjects fusion decryps imports when it needs then destroy again. I have tried to unapck it but when it starts it calls another dll import which is destroyed and crashes.How I can use your tool to rebuild import a little tutorial can help me so much.Thanks.
tsehp
01-12-2001, 01:44 PM
K-BOY (01-10-2001 10:07):
This piece is a little bit weird to me
http://www.addon-factory.com/download/cheet!_v1.12.zip
can it be tested ?
Thanks

write me to get the beta !
tsehp
01-12-2001, 01:47 PM
LaptoniC (01-10-2001 10:24):

Just tried netfusion, quite a big one but resolved also, see the attachment.
regards,
Tsehp
There is some question marks are they ok ?.Also netobjects fusion decryps imports when it needs then destroy again. I have tried to unapck it but when it starts it calls another dll import which is destroyed and crashes.How I can use your tool to rebuild import a little tutorial can help me so much.Thanks.
revirgin just impersonates the app itself when using iat entries, so they are decrypted and resolved by the tracer, you can only use the program itself while residing in mem, build the files and copy them into the dumped app. ask for the beta, everything is explained into the readme
St Thomas
01-26-2001, 02:05 PM
Hello,

The "Chameleon Clock v2.51" seems to be protected by AsProtect. If you want to try your program on this target, here is the URL :

www.softshape.com/cham

Thanks in advance for your work
St Thomas

PS:
Is it possible to download your program. If yes, where ? - thank you
zeduser
01-28-2001, 10:04 AM
Could I trouble you to email a copy of ReVirgin beta? I would like to unpack Advanced Direct Remailer 2.0.
TIA


java : PE & .class
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > java : PE & .class
PDA

View Full Version : java : PE & .class

keyser
12-21-2000, 08:54 AM
I know some program which transforms a .class into a PE executable. But is there a program which allow to recover the .class from the .exe ?
Thanks
disavowed
12-23-2000, 12:45 PM
you can try this: http://www.multimania.com/dolmen/productions/j++extract.zip

as http://www.multimania.com/dolmen/productions/index.shtml states:
J++Extract 1.0: J++Extract.zip ( 22k, 30/07/2000, English)
This command line tool for Windows extracts Java class files from a .exe created with Microsoft Visual J++.
License: GPL.


Site down for several hours ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Site down for several hours ?
PDA

View Full Version : Site down for several hours ?

tsehp
12-22-2000, 07:24 PM
Just read :

>Dina mis-stated the problem. The fax I got from Microsoft, through
>Globalcenter (the people we get our internet connection from) said:
>
>"Microsoft has received information that the domain listed above, which
>appears to be on servers under your control, is offering unlicensed copies
>oris engaged in other unauthorized activites relating to copyrighted
>computer programs published by Microsoft.
>
>1. Identification of copyrighted works:
>
>Computer Programs
>Windows 98
>Frontpage 98
>Publisher
>Age of Empires
>
>Copyright owners
>Microsoft
>
>2. Infringing material or activity found at the following locations:
>http://66.36.228.12 http://www.woodmann.net/fravia/project9.htm
>http://www.woodmann.net/fravia/twd_aeo.htm
>
>The above location is offering 'Cracks' or 'Serial Numbers', inteded to
>circumvent protection applied to prevent the unauthorized copying and use of
>copyrighted computer programs, for distribution by technical means."
>
>And then there's more that's irrelevant.
>
>That's why we took your site offline.
>
>
>Thanks,
>
**********

Ok, the essays were removed from the mirror. Now, don't even think to publish an essay concerning adding functionnality to msdos 2.0 :)

Sorry for the inconvenience, one good news, woodmann (our great sponsor) took a two year domain account for this place to stay alive.

We're still here to last for a very long time, merry christmas.

+Tsehp


Does someone knows how to emulate CreateRemoteThread on win9x ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Does someone knows how to emulate CreateRemoteThread on win9x ?
PDA

View Full Version : Does someone knows how to emulate CreateRemoteThread on win9x ?

tsehp
12-24-2000, 12:58 PM
hi,
I'm not talking about installing some code into an already existing thread for a win9x process, because the thread I have to create will be killed after I use it for the iat rebuilder tracer.
If someone have info about this, thanks to mail me or write it on the msgboard.
TIA
Alexey Solodovnikov
12-24-2000, 01:25 PM
Hi +Tsehp,
As I saw you work ever in Christmas time :) That's great!

Marry Christmas and Happy New Year, man. And good luck to
you and your IAT rebuilder ;)
Lord Soth
12-24-2000, 07:22 PM
Hiya +tsehp,

The way I see it, you basically only have
two options. The one is to somehow inject
code into the process space (temporarily),
that will call CreateThread itself, which will create a new thread for the process itself.
Then you really wouldn't care about the
changes you made to the code (or if you do
care, you can restore it..).
For all purposed intended, I think a new
thread would serve you right.
The other option would be to somehow use
internal kernel functions and structures
to allocate another thread block for the
process space. I'm not certain there is any
place you can find such information. I don't
remember seeing such a thing at pietriek's.
However, with some reversing, you might be
able to figure out how createprocess does
the magic, and try to perform it yourself.
I know it's a lot of work, but if you REALLY
need this, you might think about putting
the time for it.
This is a daunting project. Of course this
is not just allocation of memory and stuff.
You have to have a TCB, msg queue, stack
area, what not. You even have to somehow
notify vmm32 of your new thread.
Don't ask me how, that's as far as my knowledge goes ;)

cya buddy
good luck
Lord Soth
12-24-2000, 07:25 PM
> However, with some reversing, you might be
> able to figure out how createprocess does
> the magic, and try to perform it yourself.

That should've been CreateThread.
Oops :-)

LS
Morlac
12-24-2000, 08:04 PM
Hi all,

+Tsehp, i cant say that i understand why you want to emulate the function. I checked the msdn i have and it says that CreateRemoteThread() is available for Win98 or later.
Check this out( from the MSDN):
QuickInfo
Windows: Requires Windows 98 or later.
Windows CE: Unsupported.
Header: Declared in winbase.h.
Import Library: Use kernel32.lib.

Perhaps i dont understand.
Regards,
Morlac.
tsehp
12-25-2000, 04:23 AM
Alexey Solodovnikov (12-24-2000 03:25):
Hi +Tsehp,
As I saw you work ever in Christmas time :) That's great!

Marry Christmas and Happy New Year, man. And good luck to
you and your IAT rebuilder ;)

Hi alex, If I worked that christmas evening I would say that my app would be more than damaged, anyway I have a little text file for you,
generated from AZPR latest version , included for download.

Have a good work on next asprotect version :)

Merry christmas
tsehp
12-25-2000, 04:27 AM
Lord Soth (12-24-2000 09:25):
> However, with some reversing, you might be
> able to figure out how createprocess does
> the magic, and try to perform it yourself.

That should've been CreateThread.
Oops :-)

LS

Hi lord, thanks for your reply, I've found another way to do it, if you ask me by mail I'll tell you if the solution works, will be trying today.
merry christmas.
tsehp
12-25-2000, 04:33 AM
Morlac (12-24-2000 10:04):
Hi all,

+Tsehp, i cant say that i understand why you want to emulate the function. I checked the msdn i have and it says that CreateRemoteThread() is available for Win98 or later.
Check this out( from the MSDN):
QuickInfo
Windows: Requires Windows 98 or later.
Windows CE: Unsupported.
Header: Declared in winbase.h.
Import Library: Use kernel32.lib.

Perhaps i dont understand.
Regards,
Morlac.

I don't understand me too, because I've already found what you say, and I found also some other msdn links that say the opposite, just look at this, extracted from :http://msdn.microsoft.com/library/default.asp
at the end :
Requirements
Windows NT/2000: Requires Windows NT 3.1 or later.
Windows 95/98: Unsupported.
Header: Declared in Winbase.h; include Windows.h.
Library: Use Kernel32.lib.

A guy said that this api is used in office 2000, I'll check with softice,
otherwise I already have a kind of solution, when I'll be finished the app will be sent to beta testers.
best regards,
Predator [PC/pGC]
12-25-2000, 06:06 AM
Hey Alexey ;-)
Erovin
12-25-2000, 04:17 PM
My last 3 MSDN kits have stated clearly that CreateRemoteThread is UNSUPPORTED on Win95 and Win98. I needed the same thing for a trainer I made. I wanted my thread to run in the same process space as the game. I spent a lot of time and the only satisfactory thing I found was to use SetWindowsHookEx with WH_GETMESSAGE. With this I could send messages to the app and have my own code get access to the entire memory space of the process.

There are 2 drawbacks with this approach: (1) it requires some fancy DLL manipulations and (2) if the app is not a "real" Windoze app with a message loop and a window procedure then it won't work at all.
tsehp
12-25-2000, 04:46 PM
yes you're right.
I tried another way :
createprocess and get the primary hThread, freeze it and change it's context for my injected code with writeprocessmemory, sometimes it works sometimes not, if the threads eip is too low, I just crash it, no way to allocate more mem from another process to inject my code elsewhere and have plenty of space for my tracer dll. I'm waiting for a final answer from the Owl and then maybe give up the win9x port of my tool. It's plenty working on win2k, such a shame but I'm afraid that this iat rebuilder will be available only on this system with the tracing feature :( Maybe someone have another idea, who knows ?

+Tsehp
tsehp
12-25-2000, 04:52 PM
Lord Soth (12-24-2000 09:22):
Hiya +tsehp,

The way I see it, you basically only have
two options. The one is to somehow inject
code into the process space (temporarily),
that will call CreateThread itself, which will create a new thread for the process itself.

I'd like to, but I have to use the app's primary thread to do it, and if it doesn't have some free space, I just crush it's code and damage it.
Even if I manage to create another thread, I can't get back it's handle for my main app in another process to copy my dll... So I'm oblidged to use the main thread, if there's not enough mem allocated for it for my dll (about 5 mem pages) I'm just blocked on this. So much simple and stable on win2k / nt4 :)
too bad
kill3xx
12-25-2000, 06:45 PM
+Tsehp (12-25-2000 06:46):
yes you're right.
I tried another way :
createprocess and get the primary hThread, freeze it and change it's context for my injected code with writeprocessmemory, sometimes it
....
+Tsehp
without undocumented/exotics solution.. this one works fine for me..

1) put your createthread, etc, stuff in a MMF with bInheritHandle=true
+ some signiling/syncronization code (events,etc..)
+ restore EP code
2) setup a small stub that'll do :
a) MapViewOfFile (inheritable handle)
b) save registers, etc..
c) jmp into ur code

3) createprocess + CREATE_SUSPENDED + bInheritHandles=true
4) ReadProcessMemory to the original EP code into the MMF
5) WriteProcessMemory to overwrite the EP with your stub
6) ResumeThread
wait on hThread and syncronization objs to signaling u that all is ok.. a side bonus is that the MMF is also suitable for IPC (u can save ur listener thread/window handle, etc..)

merry xmas,

kill3xx
garph0
12-26-2000, 05:53 AM
I wrote a proggie just like kill3xx says... do you remember my injector threads ?
it works fine, if you want it drop me a line :)

regards

garph0
garph0
12-26-2000, 05:54 AM
uh, it works well also with a running target :)

garph0
The Owl
12-26-2000, 06:23 AM
createprocess and get the primary hThread, freeze it and change it's context for my injected code with writeprocessmemory, sometimes it works sometimes not, if the threads eip is too low, I just crash it

ok, if only this is a problem, then i suggest you take a look at not only the target thread's (E)IP but CS/SS/(E)SP as well ;-). then you'll find out what it really means that win9x still relies on 16 bit code at times. the solution for this will be to change all of these 4 registers to their proper values. CS/SS you can grab from your own process, however ESP will be less than trivial as you would have to find out the ESP value before the stack switch occured to the 16 bit stack... needs reverse engineering. or maybe you can make use of the current 16 bit SS:SP (just be careful with stack operations), or you can try to resume/suspend the target thread in a loop until you find it in win32 context.
tsehp
12-26-2000, 07:23 AM
garph0 (12-25-2000 19:53):
I wrote a proggie just like kill3xx says... do you remember my injector threads ?
it works fine, if you want it drop me a line :)

regards

garph0
hi,
that's very nice of you, it's tempting but if I want to have a chance to learn something on this case, I'm oblidged to continue my own way !
My actual method is at this point :
suspend the target thread, get a pointer to its stack, save it into my process, write about 600 bytes of code containing some tools :
a first loadlibrarya for my dll, then a new thread will be automatically created by win9x, but inside the target's context.
my actual problem is that I have to change the eip of target context to make it start my own code but it crashes, I'm trying to trace the win9x resumethread api but it's kind of long , maybe someone knows the last interrupt this function uses before the usual Iret that leads to the new eip into the target's thread resumed at this time.
But this technique works, I've succeded to load the dll just once, that was a lucky shot.
best regards ;)
tsehp
12-26-2000, 07:28 AM
kill3xx (12-25-2000 08:45):
+Tsehp (12-25-2000 06:46):
yes you're right.
I tried another way :
createprocess and get the primary hThread, freeze it and change it's context for my injected code with writeprocessmemory, sometimes it
....
+Tsehp
without undocumented/exotics solution.. this one works fine for me..

1) put your createthread, etc, stuff in a MMF with bInheritHandle=true
+ some signiling/syncronization code (events,etc..)
+ restore EP code
2) setup a small stub that'll do :
a) MapViewOfFile (inheritable handle)
b) save registers, etc..
c) jmp into ur code

3) createprocess + CREATE_SUSPENDED + bInheritHandles=true
4) ReadProcessMemory to the original EP code into the MMF
5) WriteProcessMemory to overwrite the EP with your stub
6) ResumeThread
wait on hThread and syncronization objs to signaling u that all is ok.. a side bonus is that the MMF is also suitable for IPC (u can save ur listener thread/window handle, etc..)

merry xmas,

kill3xx
I almost did the same, but didn't put the code to inject into a mmf, I directly use a function pointer to copy the compiled code into the target, like I did on win2k with the remote created thread, it's more simple, despite you must use function pointers inside this code and resolve first the function you want to call with a getprocaddress, but the mmf is avoided.
my actual problem is that I change the esp and eip of freezed thread into a context that is a copy of the original one, but when I resume it crashed, I'm working on this at this time, when this will be fixed that should work fine.

The iat rebuilder will be ported to win9x, I actually managed to resolve all the target's that was provided on this mb + all asprotect and vboxed apps !!!! the challenge is worth the work.
best regards,

+Tsehp
tsehp
12-26-2000, 06:10 PM
The Owl (12-25-2000 20:23):

createprocess and get the primary hThread, freeze it and change it's context for my injected code with writeprocessmemory, sometimes it works sometimes not, if the threads eip is too low, I just crash it

ok, if only this is a problem, then i suggest you take a look at not only the target thread's (E)IP but CS/SS/(E)SP as well ;-). then you'll find out what it really means that win9x still relies on 16 bit code at times. the solution for this will be to change all of these 4 registers to their proper values. CS/SS you can grab from your own process, however ESP will be less than trivial as you would have to find out the ESP value before the stack switch occured to the 16 bit stack... needs reverse engineering. or maybe you can make use of the current 16 bit SS:SP (just be careful with stack operations), or you can try to resume/suspend the target thread in a loop until you find it in win32 context.
as always I choosed the easiest solution ;)
But I don't start stop the thread, just watch for its context every 100ms and check for esp>0x400000, but on win9x, the app window must have focus for the thread to evolve so I will be forced to make it modal, and it's working, good old win 3.x and msdos days...
kill3xx
12-26-2000, 07:11 PM
Hi,
+Tsehp (12-25-2000 21:28):
target, like I did on win2k with the remote created thread, it's more simple, despite you must use function pointers inside this code and resolve first the function you want to call with a getprocaddress, but the mmf is avoided.

well.. u'r right from a HLL perspective (C,C++,etc..) i understand that using a dll is simpler since u've not to deal with relocation, delta-ofs, etc.. i use mmf it 'coz when i need this kind of "services" i prefer to code everything in asm and are more suitable for my IPC needs.. anyway u can simply replace 2a) MapViewOf.. with LoadLibrary 2c) with GetProcAddress + jmp/call and all works flowless (btw in the above list i've forgotten to list 7-PostThreadMessage to force wakeup) ..

my actual problem is that I change the esp and eip of freezed thread into a context that is a copy of the original one, but when I resume it crashed, I'm working on this at this time, when this will be fixed that should work fine.

as The Owl has pointed out there'r some things u've to deal with when u want to use the stack of a suspended remote thread (perphaps u can also use some TDB/TIB stack related fields and GetThreadSelectorEntry to infer if the thread is in a suitable state)
but i've to admit that i'm wondering why u want to absolutelely play with the stack ..maybe a WriteProcessMemory copy-on-write/page protection issue ?

Best regards,

kill3xx
tsehp
12-27-2000, 03:22 PM
at this time, I succeeded with the remote thread, I only have actually a few bug inside the state machine to fix but it's installed.
I tried to use the most simple way to emulate createremoteThread, here are the steps:
1-prepare an injector, should be less than 1024 bytes, gets byt parameters the name of dll to load and function pointer to getmodulehandle and getprocaddress, it also contains char* for loadlibrary, freelibrary and other needed api's to inject your code
2-wait for the target thread to reach an esp higher than 0x400000 then freeze it, you must have a valid handle to it, to get it, start yourself the app to tweak with createprocess and get the handle from systeminfo structure.
3-put your injector higher than the actual esp-4, then change the frozen thread's eip to it's oep and resume the thread.
4-the injector does a loadlibrary of your dll and then must wait for your work to finish to clean itself, you can use a flag that will be set by the dll you injected.
5-the dll is freed, your injector sets the flag and your main app freezes the thread again, cleans the injector and restore original eip and starts the thread again.

It's more simple that I thought, even if a simple implement of createremotethread would have done the job more easily, maybe done on windoze me 2005 who knows ? :)

I'm about to finish the win9x port for iat rebuilder now, got to fix some tracer bugs and that should work as good as on win2k, I'll write it here.

best regards,

+Tsehp


WS Cad 4.0 + WIBU-Key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WS Cad 4.0 + WIBU-Key
PDA

View Full Version : WS Cad 4.0 + WIBU-Key

faka
12-24-2000, 05:45 PM
greet! whether can {perhaps} me somebody to help in finding EFFICIENT methods" breaks" of programme WS CAD 4. 0?
And so acts {works} now without WIBU_KEY`A but after some time - during edition of document - at random chooses elements..

Ie. I choose element eg 15 - and programme puts in me eg 12!!

Please for help - from mountain very thank you

Arturchm@box43. gnet. pl


slm question (yeap another)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > slm question (yeap another)
PDA

View Full Version : slm question (yeap another)

Sab
12-24-2000, 06:06 PM
just a question.. regarding the license itself on execution. Ive created a few licenses and noticed i get "no license string is available for feature "Featurenamehere ver versionhere" on host no-net". That happens when I make it standalone license type long key encrypted, and no trial or fixed dates. Possibly i extracted or am puting in the vendor Id improperly or have placed incorrect info into the lic gen. If i set it to network i get "trial period exhausted blahblah". Anyways thanks for reading hope someone has any idea about that im pretty new to slm license creation i just used to patch the protection. Thanks for reading
Nolan Blender
12-24-2000, 08:18 PM
Sab (12-24-2000 08:06):
just a question.. regarding the license itself on execution. Ive created a few licenses and noticed i get "no license string is available for feature "Featurenamehere ver versionhere" on host no-net". That happens when I make it standalone license type long key encrypted, and no trial or fixed dates. Possibly i extracted or am puting in the vendor Id improperly or have placed incorrect info into the lic gen. If i set it to network i get "trial period exhausted blahblah". Anyways thanks for reading hope someone has any idea about that im pretty new to slm license creation i just used to patch the protection. Thanks for reading

If the vendor ID is incorrect the program will
choke. check the version, plus the flags which
are passed into LSRequest. Without knowing the target, I can't help much.
CyberHeg
12-25-2000, 07:50 AM
Like Nolan Blender wrote it sounds like a incorrect Vendor ID.

I used to get that message too in the past so I know all about it :)

What is your return code from LSrequest?
Sab
12-25-2000, 03:34 PM
o yeah..you guys hit it right on the dot!!. Turns out i had all the correct info from the LSRequest and from computevendorcode , however, when i was generating a license i had placed the info wrong into softice while modifiying memory. the return code was for say XYZ but when i put in softice i put it ZYX ( : thx blender/cyberheg. Hope others check out this message and dont make that same mistake ( : hehe thanks again.


Christmas!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Christmas!
PDA

View Full Version : Christmas!

ceas
12-24-2000, 08:22 PM
I wish to all the people in the cracking world a very Marry Christmas!
x30n-
12-25-2000, 01:25 AM
Same back at ya :)

x30n-


Slashdot embarassment
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Slashdot embarassment
PDA

View Full Version : Slashdot embarassment

Van Dijk
12-25-2000, 09:11 AM
Am I the only one slightly embarassed after reading about copy protected hard drives on slashdot?
On that supposedly competent forum nobody gave me an impression of knowing what the hell they are talking about.
Some say the protected files could be read but not the key on a special partition. Others say protected files cannot be read and copied at all without the key.
But almost everybody there intends to stock 'old standard' hard drives just in case.
So what is the real nature of this copy protection scheme?
Erovin
12-25-2000, 02:44 PM
You should be the only one embarrassed. The /. main articles had hyperlinks to information at The Register. From there, there were other links that spelled out what it is and how it works. If you spent a little time investigating you wouldn't be complaining here. You should be embarrassed.
Van Dijk
12-25-2000, 04:37 PM
Not really. The Register did not give any details.
The only technical link provided was to a pdf file that does not say whether encrypted file could be copied (without the key of course).
Some people at /. and kuro5hin said they *think* it could be copied. Others said they *think* it cannot be copied. Nobody was very sure.
In case encrypted file could be copied it would be useless without the key that remained on the original disk. Big deal, so you can't decipher it but at least it breaks backup ONLY in the sense copies of protected files are useless.
But in case encrypted file cannot be copied at all, it's a major blow for defragmentation and backup.
A lot of people at /. and kuro5hin can't really say which case is going to be implemented. That includes people that have read the pdf file I mentioned earlier.
You see, the reason I asked is that I hoped for an answer.
If you know the answer please share it with me. Consider me a clueless dimwit, but just give me the answer. And your reasons for thinking so.
Van Dijk
12-25-2000, 05:10 PM
Here are some quotes from kuro5hin, just to show that I am not the only one confused:

>I would be very hesitant to post something on this
>subject with no one but the Register to site as a source.

>I'm not saying that it doesn't work, just that I don't
>understand how.

>Maybe I don't understand the scheme, which is understand-
>able since the register article was a little vague. I
>wish there were a few more details.

>If I'm wrong, and instead the idea is that everything
>is encrypted, well, this is just unworkable. besides
>the issue of backups, how would you even optimize a
>drive? It just doesn't make sense...

>As far as The Register is concerned, I've seen a lot of
>overdramatic B.S. posted on there before, and I tend to
>not trust it very much anymore. At least not without
>other, more reliable sources, to back them up.

>I'm not sure that I totally understand this.

>This is hardware-level encoding. It apparently sets
>aside an area of the disk to store keys in, and keys
>need to know the physical disk location of the data
>(or something like that) to read that data. Like, the
>unlocking and decryption will be done before software
>gets a bit off the drive. It's entirely below the
>software level.
>Beyond that, I don't know anything either. Perhaps
>someone here has a better understanding of how this
>thing works.
Rosshole
12-25-2000, 07:37 PM
Erovin,
Watch your fucking mouth you fucking asshole. If you act elite, hopefully someone will take a bat to your fucking head bitch
Predator [PC/pGC]
12-26-2000, 01:47 AM
Hey, children, don't fight inhere. This is getting off-topic anyway. Saying fuck 5x in a row doesn't show how great you are; but neither does complaining about an article inhere. I'm not choosing sides, and I'm not looking for a fight.

Please behave ;)

-Pred
The Owl
12-26-2000, 07:20 AM
this is the document that you should read for technical details (note that this a draft, nothing final/approved). based on this (especially page 14) i think it's quite obvious, that the compliant ATA drive will *not* perform any encryption/decryption per se, it will only respond to challenges (so that a player/recorder can authenticate it) by using a hashing algo. this is detailed on page 13 which i think is the source of most of the confusion regarding what can be copied/moved/etc on a compliant drive. namely, the challenge (issued by the player/recorder device *or* software... hint hint ;-) is the result of a hash of two values. one is the dynamic media ID and the other one is some random bit sequence (denoted by c0...c4). the confusion comes from the representation of the latter as it is transmitted in the sector/cylinder/features fields of an ATA command. but it does *not* mean these values would actually be *real* s/c/f values (although they could be by chance or (bad) choice). after all, a challenge should be some random number by its nature (the diagram on page 14 clearly says so as well), there would be nothing challenging in responding to a well known (small) set of 'challenges'...

what this comes down to is that once you acquire some encrypted content which was specifically created to be stored on your compliant drive, you can move it around as you want, just make sure that when you want to play it, you will stream it from the drive it was created for (since the player will use that drive to come up with the decryption key). now if you suspect this whole scheme smells quite a bit and will be subject to the same attack as the CSS used for DVD, you're not far from the truth. again referring back to page 14, you see that the player ('portable device' in their terminology) uses nothing secret/hidden/etc to come up with the decryption key, every bit of the information is (will be) accessible through ATA commands. so as soon as the player manifests in software, you will have access to the decrypted content - probably nothing surprising for our kind ;-). so if the industry wants to avoid making the same mistake, they would have to ensure a fully encrypted path from the drive storing the content to the actual decoder/display device - obviously this excludes software only (player) solutions. whether and when they will figure it out remains to be seen.

end notes: i can very well imagine that all the above may not be quite correct, it was only my first impression/understanding of the issue. if anyone has any *constructive* observations, please feel free to share them with the rest of us.
Van Dijk
12-26-2000, 10:20 AM
Thank you Owl !

To Predator: I did not say f**k at all. To the contrary, I admitted that maybe I am a clueless dimwit :)

vir iracundus provocat rixas et qui ad indignandum facilis est erit ad peccata proclivior. superbum sequitur humilitas et humilem spiritu suscipiet gloria
tsehp
12-27-2000, 03:04 PM
Rosshole (12-25-2000 09:37):
Erovin,
Watch your fucking mouth you fucking asshole. If you act elite, hopefully someone will take a bat to your fucking head bitch

I hope this is the last msg of this kind you say, you cannot talk like this here, I warn you...
regards,

Tsehp
Antipodean
01-04-2001, 06:54 AM
Just caught up with things after the christmas holidays.

Not a follower of /. so am just going o what I have seen in this thread, but as I understand it someone is proposing encryting files using info peculiar to ID info on a disc drive.

I wonder what happens when the info is stored on a striped volume set such as you can do in NT, or with a scsi controller under any op system? might this foul up the encrytion or is all the key info got from data within formatted sector data like the disk ID microsoft uses. It would certainly be hard to use a drive serial number as part of the encryption, or perhaps they haven't thought of raid systems :)

Secondly does this mean the file cannot be stored on a network drive because you cannot get at the ID bytes?

Presumably the idea is some form of e-commerce file download system. I guess a standard encryption file is downloaded and decrypted/recrypted using local info by a special program. One then envisages someone coming up with a trojan program that will buy once/download and store standard encryption/do many saves to different disks for distribution to friends operation.


VB4 pcoded program how ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VB4 pcoded program how ?
PDA

View Full Version : VB4 pcoded program how ?

LaptoniC
12-25-2000, 02:41 PM
I am triyng to reverse p-coded vb program exdec doesnt work smartchek doesnt give any valuable information Dodi's dissambler gives error..
Could you give me some info or tool to reverse vb4 pcoded programs ?
Thanks


Help with API Spy 2.5 plz (process patching)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with API Spy 2.5 plz (process patching)
PDA

View Full Version : Help with API Spy 2.5 plz (process patching)

Drak0
12-26-2000, 12:14 AM
Hi,

I'm trying to pacth this program using a process patcher... and I have gotten it fully cracked... that is until it restarts itself!

After you use api spy on a program, it shuts down and restarts itself! Well, this is a problem because it's executing the wrong .exe!!!

Anyone who has used this program knows what i'm talking about... if anyone can help, I'd really REALLY appreciate it.

I don't really know what to break on... I've tried 'creatprocessa', 'creatthread', etc....

What I would like to do is find out where in memory the name of the program is stored... and change that to my patched loader (i'm using risc's loader, btw)...

Thanks,
Drak0
EVC_ViPeR
12-26-2000, 04:15 AM
Snake's page have a document about v2.4. Check it out, might be help.
Drak0
12-26-2000, 12:11 PM
EVC_ViPeR (12-25-2000 18:15):
Snake's page have a document about v2.4. Check it out, might be help.

I know I saw that... but he manually unpacked it and then just patched the .exe...

I'm am doing it a different way... with a process patcher...

but i'm thinking that his way is the better way :(

Any thoughts are still welcome :)

-Drak0
stanks
12-27-2000, 12:00 AM
Hi!

I tried to unpack it like snake but it doesn't work in 2.5 Don't know why. Maybe experienced reverser can help?

Greetz
SpeKKeL!
12-27-2000, 08:10 AM
proggy is compressed with petite1.2

Just manually unpackwith softice:
load apis32.exe (it breaks off its one)
Then trace and go in the first call (f8)
Trace till: popad
pop f
jmp 406360 ( goes to entry point) < here you
make a jmp eip instead and F5 >> go to procdump and
make a full dump exm Dumpapis32.exe.

After this you must make the right entry point by using
procdump > pe-editor > and change the entry-point from you new dumpapis32.exe to
6360 =( 406360-400000) Ok now it runs you can disass. and modify ...........

Good luck ......SpeKKeL!........
Drak0
12-27-2000, 03:41 PM
SpeKKeL! (12-26-2000 22:10):
Trace till: popad
pop f
jmp 406360 ( goes to entry point) < here

Hi,

I must be an idiot.... but I can't find that 'popad' thing.... everytime it get to a 'rep movsd' and then the program just runs after i press f10...

grr... what does 'rep movesd' mean?

why isn't it getting to that popad?

Thanks,
Drak0

P.S. Sorry if i'm an idiot...
SpeKKeL!
12-28-2000, 03:07 PM
WELL DON'T know why it's going to run after the rep mov instruction (( maybe someone else ??)) try putting a breakpoint after this instr. ?? (be sure before dumping to erase all bpx's)

rep mov = move ecx bytes(dwords) from DS:[(E)SI] to
ES:[(E)DI]

.................SpeKKeL!...........
Harlequin
12-30-2000, 04:41 AM
Seems to be a lot of un-required complications going on here:

1. Start APIS 2.5
2. Start Procdump
3. Select apis32 from the procdump task list
4. Right click and select dump full

You now have a fully working unpacked APIS 2.5

Have fun

Harlequin
stanks
12-30-2000, 06:04 AM
Hi Harlequin

Very nice, but it doesn't work so smooth as you think. Why? I don't know. It is unpacked but it crashes all the time. Yes i have to change entry point (probably), but when i try to change it with ProcDump, ProcDump crashes. So it doesn't work for me. I don't know for the others.
BTW it doesn't work too if you apply what snake wrote in his tutorial too (for me). So the next step will be what? Maybe guys with + sign in the nick can help. I think they can know that (i hope so).

Greetz
stanks
12-30-2000, 06:17 AM
Hi SpeKKeL!

This doesn't work too because ProcDump is crashing.

Greetz
SpeKKel!
12-30-2000, 07:10 AM
Well don.t know why it isn,t working for you but i did it all the way without any problems..(unpacked and disassembled)
Try before dumping (save all) erase all bpx's and shut down as much as possible at the back running progg.'s
Because it didn't crash here i don't know what further
could be the problem..
Lord Rhesus
12-30-2000, 08:09 AM
I wrote a process patcher in win32asm which I used to enable VB string references in WDASM. The code is easy to modify and adapt for any other program. If your interested you can download it from Iczelion's site here: http://members.nbci.com/_XMCM/winasm/files/VBLoader.zip
Harlequin
12-30-2000, 02:10 PM
Hi

Don't know why you are struggling?
I just downloaded the latest version from softseek and unpacked it as above without a problem.

Using procdump 1.6
win 98

Perhaps you would send me your copy (full install package)

Harlequin
Drak0
12-30-2000, 06:25 PM
SpeKKel! (12-29-2000 21:10):
Well don.t know why it isn,t working for you but i did it all the way without any problems..(unpacked and disassembled)
Try before dumping (save all) erase all bpx's and shut down as much as possible at the back running progg.'s
Because it didn't crash here i don't know what further
could be the problem..

Hi,

I too got it to work just like you said above... but traced it w/ OllyDBG and easly found the right entry point... and changed it w/ procdump and everything worked... then I was able to patch the program w/o any problems....

-Drak0
SpeKKel!
12-31-2000, 06:53 AM
Pffffff.....Just in time.. A Good Happy Cracking New Year........SpeKKeL!


Need mentor. Will work hard. Anybody bite?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need mentor. Will work hard. Anybody bite?
PDA

View Full Version : Need mentor. Will work hard. Anybody bite?

aimless
12-26-2000, 02:08 AM
Hello,

I have spent 3 years on this scene. And I'm (STILL) not even intermidiate cracker. I need mentorship from someone senior to get any further. Any senior willing to assist me? Communication would be ONLY through email.

Furthermore, I am not from an TECHNICAL background, so I may be a little hard nut to teach. However, I am willing to put in efforts that may be required to do this.

I have only my own managed to crack only 4programs so far:

Quake 2 - CD Check
Freespace 1 - CD Check + Cheat Progression check
Road Rash - Ability to load MODIFIED .rsh files
FL.exe - Synchronization (DOS) proggie.

My aim is more towards someone who can guide me on the programs that I may need to crack. In a progressive manner. What with complicated schemes coming up, I haven't a clue to what to crack. Crackmes and reversemes are well, not my cup of tea. I need hands on.

You may decide not to help, but thanks anyways for reading this mail. I AM getting help from this msgboard really, and I guess I should'nt complain, but I just had to try my luck.

Regards,
Carpathia
12-26-2000, 04:46 AM
Consider joining in the newbies forum, where various targets are attacked as a group effort. This seems to be quite popular for newbies.

I dont believe anyone needs a mentor to learn more about cracking, especially with such good web resources around. Even the more advanced aspects can be learnt by anyone willing to put in the time. You might wish to read the #c4n FAQ #12 (www.cracking4newbies.com).

Dont forget, a mentor via email goes against the grain of the community. Instead of everyone being able to learn/participate from a forum thread, it is restricted to merely two people.

Regards

Carpathia
latigo
12-26-2000, 07:27 AM
Hiya aimless and Merry Xmas.
Carp is right once again, the newbies forum/groups are a very good way of learning.There you share your experience with others and everybody learns. I did learn a lot while hanging at the newbie's forum and following the different targets.
I cannot offer you a 24-7 'mentorship' (not even via email) since my spare time is VERY VERY limited during the week ..(i haven't updated my site in months..not to talk about cracking/coding) and usually im playing with 200 things at the same time..coding,cracking,dongles,palm..so i get to play a little bit with each other just on weekends. Anyway, if you want to learn and be a good cracker i think i can give you some good pointers and could be a good mentor too.
Just mail me to latigo_at_ciudad_dot_com_dot_ar.
Again , if you are serious about RE do consider the group work.
Bye man!

Latigo
IceWaVe
12-27-2000, 02:32 AM
Heheh, I've been into cracking for about 3 months and I know as much as you :) Cracked Age of Empires, Rise of Rome, Age of Kings, Age of Conquerors, WinZip, NotePad, like a million crackme's, etc. :)
latigo
12-27-2000, 09:09 AM
IceWaVe (12-26-2000 16:32):
Heheh, I've been into cracking for about 3 months and I know as much as you :) Cracked Age of Empires, Rise of Rome, Age of Kings, Age of Conquerors, WinZip, NotePad, like a million crackme's, etc. :)

Wow you cracked Notepad :). Ph33r you l33t0 one!
Don't post if you are not going to help lame ass.
disavowed
12-27-2000, 11:33 AM
if i understand you right, you're just looking for actual programs to crack. try anything like www.download.com, and just download a dozen random programs and try cracking them. perfect real-world examples

aimless (12-25-2000 16:08):

My aim is more towards someone who can guide me on the programs that I may need to crack. In a progressive manner. What with complicated schemes coming up, I haven't a clue to what to crack. Crackmes and reversemes are well, not my cup of tea. I need hands on.
Nolan Blender
12-27-2000, 12:10 PM
The key is to get those l33t0 mind
enhancing drugs which make a master cracker.

Actually if you do the exercises on the board,
and go to sandman's page, you can learn much.

The key to cracking is **understanding**, not just
following the steps provided in tutorials.
BlackB
01-04-2001, 08:41 AM
Hi,

besides of all good advice above, I can give you one more advice: go visit my website ;)

http://www.cracking4newbies.org or
http://blackb.tsx.org or
http://crk4n.cjb.net

greetz

BlackB
tsehp
01-04-2001, 04:31 PM
Everybody putted his word on this, and to me this is one of the most important question someone can ask on this place.
Nolan blender is right about it : understand what you're doing.
How ? If you try to reverse something, you'll have a very good understanding if you already know of to code programs, personnaly I started to code since 1 year and half, about one year after my first
cracked app.
Just read the most essays as you can, start with serial based apps,
locate them in mem, follow them, trace the app, feel it and understand
what's happening, invert the tests, look if this is working, take some notes. I just had to follow from the beginning to the end about 10 essays on fravia's site to be on my own, this will be your private work.
Then ask your questions on this place, somebody will always answer positively, as you saw before.
good luck

+Tsehp
GM
01-05-2001, 05:59 AM
I've cracked EDLIN.EXE from DOS 3.3 to make it work with Windoze 95 and above :)
Need a copy ?


HVIEW vs UltraEdit vs HexWorkshop.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HVIEW vs UltraEdit vs HexWorkshop.
PDA

View Full Version : HVIEW vs UltraEdit vs HexWorkshop.

IceWaVe
12-27-2000, 02:43 AM
Which one is better? Why is HVIEW so popular? It's a sorry DOS program...

Anyway, what're the pro's and con's of all those HexEdits?
Muad'Dib
12-27-2000, 01:01 PM
HIEW is not a "sorry dos program". It has the most options of any hex editor (except maybe BIEW, which is free...but slower). It automatically converts addresses and it can disassemble. You can make scripts for it, etc. It is the best hex editor IMO, but I guess some people dont like it. Just use what you like but I'd recommend trying to learn some stuff about HIEW before saying it sucks :)
Toner
12-27-2000, 01:39 PM
IceWaVe (12-26-2000 16:43):
Which one is better? Why is HVIEW so popular? It's a sorry DOS program...

Anyway, what're the pro's and con's of all those HexEdits?

Why don't you use notepad? you cracked it :)
IceWaVe
12-27-2000, 03:52 PM
Um? Haha?
?ferret
12-27-2000, 08:57 PM
HIEW ROCKS! ;-)

Simply because of the fact that you can make changes in asm and set the base address, letting you find what you need in softice (which by the way also has a slightly less than "user friendly" gui [see a pattern here? ;-) ]), and make changes permanent in HIEW, using the same addresses/opcodes, etc.. No searching for byte sequences, or offsets.
disavowed
12-30-2000, 09:49 PM
No searching for byte sequences, or offsets.

that's half the fun of cracking :)
?ferret
01-01-2001, 08:12 PM
I prefer the other half ;-)


Hex Workshop 3.11 Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hex Workshop 3.11 Help
PDA

View Full Version : Hex Workshop 3.11 Help

treat
12-27-2000, 06:19 AM
Hello,
I have been trying to crack Hex Workshop 3.11. I haven't seen any essay on this app.
The app has a 30 day limit and after setting my clock forward and then restoring it, the app stays expired. I tried to disable the expiration message box, but couldn't find the right breakpoint routine. I am using WIndows 2000 with Sice 4.02. Task returns with No LDT message. Anything else is quite painful.
I am a relative newbie and am trying to figure out how to go about cracking this app. I have read a lot of essays and I am simply getting lost in the serial generation code. I could use a little Zen and if any of you can point me in the right direction, it shall be much appreciated.

Thanks
mike
12-27-2000, 11:32 AM
Have you tried installing it with RegMon and FileMon active? Often time-out keys are stored in the registry or a special file.


VB troubles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VB troubles
PDA

View Full Version : VB troubles

mike
12-27-2000, 06:14 PM
I'm working on a VB5 app (latest version of Encrypted Magic Folders). I'm trying to reverse-engineer the snake-oil they call encryption, but the VB is driving me nuts. I got SmartCheck, but the thing gets an access violation and quits right off. I figure it must be some kind of anti-debugger trick; the only one I found described well in a tute was one that timed ops to see if they ran slower because of smartcheck, so I turned off event viewing, but it still crashed. What other kinds of VB debugger shields have you all seen?
mike
12-27-2000, 06:43 PM
I also got the pcode disassembler from http://members.xoom.com/c4n4ever/.space/ but it failed right away, too.

I'm making progress with softice, but it's awful wading through all the crap that's in there.
Malkocoglu
12-30-2000, 04:58 PM
A small snippet
if there is a messagebox that says serial number is invalid
than that messagebox is most probably a MessageBoxIndirectA
msvbvm60.dll and the i think v5 of it uses the above function to display a messagebox
I dont know much about VB thingie but in the past i cracked 2 VB apps by setting a BP on MessageBoxIndirectA in SoftICE
Good Luck...
mike
01-02-2001, 11:13 AM
I'm not trying to register it, I'm trying to reverse-engineer it. I want to know how the encryption works. I'm attacking decrypt.exe, BTW.
tsehp
01-02-2001, 04:30 PM
do you have ida ? Normally it could show you usual vb functions that could help you understand what's happening in this app.
you can maybe have some docs on typiczl vb function at msdn site.


Italian dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Italian dongle
PDA

View Full Version : Italian dongle

TOTEU
12-27-2000, 08:03 PM
Looking for more info (API docs, etc) for an italian dongle
named EXSEKEY, if anybody heard about this one...

Regards,
TOTEU
maurik
01-15-2001, 02:52 PM
ok! www.des.co.uk

for deskey dk2

maurik
votan
09-15-2004, 11:22 AM
exsekey has 2 flavours: the old model and micro model.
I got a demo set from the company.
The envelope mechanism only checks whether the dongle is plugged. The decryption is dongle-independent.
There is a memory edit util of exsekey. To reach the memory you need a 10-char.s password. however, the implementation is weak and the password check is performed in PC memory, not in the dongle, thus i modified this edit util to display the correct password after a try with a dummy password.

more details about the key:
pic16c505 is the microcontroller
93c46b is the serial eeprom
also a nor and a nand logic gates
several transistor,resistors..

apis:(i dont remember the actual api names,but their functions)
readcell
readflag
writecell
writeflag
donglepresent
checkdate
checkprogramrunnumber
several communication functions

note to tgodd: tgodd,beside marx crypto, there are still commercial dongles which use microchip's products (exsekey,hyper-lock etc.). what a pity:)
dELTA
09-15-2004, 04:21 PM
Ok, that's almost a record I think... > 3,5 years. :rolleyes:
JMI
09-15-2004, 05:34 PM
Oh. Are we supposed to actually look at the date of the Post we are answering? Well, Duh. :idea:

Regards,
dELTA
09-15-2004, 05:44 PM
Oh well, at least it was a nice post with good content, so let's not bully him too much. :) Keep up the nice posts votan, there's nothing wrong with your post per se, just maybe check the dates of the posts you reply to the next time. :yay:
votan
09-16-2004, 02:09 AM
ha ha:)) well, I think my post about exsekey is the only one for 3.5 years:))
simple dongle however not known among the community.. actually, the sdk is not distributed on the producer website, this is probably the main reason..
i will check the sdk files, if there arent any clues about me for the producer, I will distribute both sdk and my works.
anyway, enjoy yourself:)
TOTEU
09-22-2004, 05:57 PM
Thanks, better late , than never...
Plz contact me on private for SDK stuff.

PS: HASP 4 is dead , welcome HASP HL...:D
votan
09-23-2004, 03:08 AM
I want to prepare a detailed tutorial about this toy. A small info about its eeprom:
93lc46b serial eeprom - 64 x 16 cell (that is each cell is 2 byte=1 word)
the data eeprom is 48x16 according to the sdk.
what about the rest of the eeprom?:)
lets see:

(for micro model of exsekey, all data in hex of course)

cell 1-2: product code
cell 3: personal code
cell 4-5: i think these are used to determine the behaviour of crypt algo
cell 6: time info for time limit
cell 7: run number counter for run number limit
cell 13: probably dongle version info (not sure)
cell 17-64: the data memory (i mean 48x16)

sincerely..
JMI
09-23-2004, 11:08 AM
We always welcome additional information which is actually useful. :idea:

Regards,


SENTINEL DRIVER --> WITH MONEY !!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SENTINEL DRIVER --> WITH MONEY !!!!
PDA

View Full Version : SENTINEL DRIVER --> WITH MONEY !!!!

Pierrot
12-27-2000, 09:53 PM
look at : http://bitwixen.gz.ee/

100 $ for unlimited license sentinel.vxd driver !!!!!
Alumni of Solitude
12-27-2000, 11:30 PM
Pierrot (12-27-2000 11:53):
look at : http://bitwixen.gz.ee/

100 $ for unlimited license sentinel.vxd driver !!!!!

What a scam.
Most of the stuff on your list has been
cracked by others, and many do not need a
"sentinel emulation". They can be fed
licenses locked to another unique ID such as
Ethernet ID. Others such as ARCinfo/ARCview
can easily be regged if you have a
keygen for the vendor string. It takes
a lot of nerve to advertise here, specially
since you are selling substandard cracks of
old software which has been updated long
ago. Also, who in their right mind would
send you money? What recourse do they have
if you rip them off? This is either a narq
or a con. Go away, and do not bother us
with your foolishness.

ALTERA.MAX.PLUS.II.V10.0-TiTAN
ANSOFT.SERENADE.DESIGN.ENVIRONMENT.V8.5-RiSE
ANSOFT.HIGH.FREQUENCY.STRUCTURE.SIMULATOR.V7.0.04-SCuM
ANSYS.V5.6.2-TiTAN
GRAPHISOFT_ARCHICAD_V6.5_INTERNATIONAL_RELEASE_2-LND
ArchiSITE.v5.6.Cracked-LND
ESRI.ARCINFO.V8.01.WORKSTATION.NT-SLT
Artlantis_v3.0.2-LND
MACPHERSONS.BARUDAN.PUNCHANT.V7.0-LND
Pierrot
12-28-2000, 07:13 PM
SORRY IT IS NOT MY LIST !!!!

ONLY INFO
CrackZ
12-29-2000, 04:17 PM
Hiya,

I ran into this site a few weeks ago (in fact I was asked to check it out by a friend), I have also had some e-mail conversations with the author.

As far as I can ascertain he is offering merely a Sentinel.vxd replacement which crudely fakes the presence of a dongle and reads from a registry key or internal buffer the desired dongles contents, i.e. this is purely a cracking solution and contains nothing new (like sproQuery() details which would be very useful :-) ).

Prior to this I had reverse engineered an example of one of these vxd's to check the above theory.

There is nothing new from a RCE perspective here, the person operating this site is merely selling cracks. His other dongle information has been *borrowed* from Fravia's old site.

Regards

CrackZ.
Predator [PC/pGC]
12-29-2000, 04:25 PM
Whatever Pierrot, just don't post that kind of crap inhere. *Yawn*.


MFC reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MFC reversing
PDA

View Full Version : MFC reversing

Subaru
12-28-2000, 10:20 AM
Hello I am trying to crack InstantID (www.instantid.com) but it is very confusing. It is written in MFC and when i break on an API I cannot seem to trace back into the apps code. Does there exists a tute for this MFC crap?

thankyou

subaru
tsehp
12-28-2000, 01:57 PM
you have an mfc section here, just try the search engine.
mfc's are pre-compiled c++ classes, encapsulating a lot of win32 api's,
you should use ida to decompile the target, then try to find some docs of the several functions that will be recognised by ida.
regards
NchantA
12-30-2000, 07:04 AM
As tsehp said ida is quite good for mfc, and if you get the plugins for ida, that display sdr (www.suddendischarge.com) its just like windasm :)

if u break on getwindowtexta, press f12 until u return to the programs calling code... it shouldnt take long.

NchantA
mario
01-01-2001, 01:32 PM
A strategy I found useful is to use the stack window in Softice. For example type in command line WS 6. Then keep pressing F12 and you will notice the changes in the stack window. Keep pressing and eventually you will see the return address of you call. Now you can double click on it and bring it up in disassembly window. Go there and set breakpoint. Re run program to break on it.


Manipulation of folder's content.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Manipulation of folder's content.
PDA

View Full Version : Manipulation of folder's content.

Bratsch
12-29-2000, 07:18 AM
Hi everybody.

This request for help does not have to do with reversing per se, but you are the crowd that knows most of the tricks, so there it goes:

I have 5560 files in a zip disk. They were transferred from an Mac machine to IBM format. As it is costummary, the name of the file gets a '!' symbol in front of it. ie: "num0001.seq" became "!num0001.seq". So far no problem. Now I have to put this files on a unix server. Unix does not like the files starting with '!'. I don't think I want to rename 5560 files manually, one by one!.
So here is my problem. I remembered good old Norton's Diskedit DOS version. I was planning to access the disk and change the attribute 'D'of the subdirectory that contains my files , open it with a text editor and replace all the '!' with something else, but the old diskedit version I have does not work with 32 bit FAT, and does not recognize ZIP drives. While coding a C utility to do the renaming may do the trick, I think there must be a simpler way. Questions to the public:

Does anybody know a utility to manipulate folders at low level?
Does anybody know a diskeditor like utility that works with FAT32 and or ZIP drives and can manipulate subdirectory entries (WINHEX can't)?
Does anybody know a simple way to rename 5K plus files without going crazy?

Thank you for your help.
carpathia
12-29-2000, 10:51 AM
Personally I'd abandon all plans of low level editing and other wonderful exercises. You could go for a cheap n dirty batch file solution..

output all your filenames to a file DIR /B > files.txt

open files.txt in ultraedit

construct an ultraedit macro to take each filename, remove the ! and build a move command from it

run the batch file

Alternatively, dont be so lazy and just write an app to do it :-)
Its so mundanely trivial you could have coded it in the time I've written this reply!

Carpathia
cronos
12-29-2000, 12:28 PM
Or you could just type
ren !*.* a*.*

:)
Bratsch
12-29-2000, 03:14 PM
Thankyou Carpathia for the advise and the Chastising :) I deserve it. I do not write code in a routine basis, so even a trivial program implies dusting my rusty skills.
The Ren !*.* A*.* worked! thanks. For some obscure reason it does not work in a ZIP drive (?). But once I moved every thing to a HD it went smoothly.


Renaming files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Renaming files
PDA

View Full Version : Renaming files

xOptiMus
12-29-2000, 02:35 PM
Hey

So simple it's brilliant cronos! We should never forget good old DOS.

xOptiMus


Java Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Java Reversing
PDA

View Full Version : Java Reversing

Bratsch
12-30-2000, 10:04 PM
Hello Again.

I am interested in learn a little Java for the heck of it.
I was trying to install Jbuilder 3.5 without importuning the software company to give me a serial and a key code.
A somewhat unusual looking window asked me for the data. After I entered the proverbial 1234554321 for serial and tried to break in the computer process with the usual Sice BPX I got nothing. Not even hmemcpy. The 'incorrect serial number' nag screen is not a typical windows process. When I disassembled the starter program (18k) I realized that all it does is load a JAVA machine and the validation routine and all the other processes are java themselves.
Question for the public:
Has anybody dealt with Java reversing?
Has anybody attacked this program before?
(I found very few references and tuts)
Am I way too off base and the Java reversing tools and techniques have not taken off jet
Solomon
12-31-2000, 07:45 AM
Good question. I also want to learn how to reverse Java *.EXEs.

For *.class files, we can use Java decompiler/disassembler to get a dead-list, then analyze the source code.
But for Java EXEs, how to reverse it? I often get lost in the Java VM. Is there any tool to extract *.class file from the EXEs?
In addition, if *.class is compressed, it will be hard to get a dead-list unless there is a decompressor.

BTW: Java uses wide char, so "BPX MultiByteToWideChar" may be a good breakpoint.
disavowed
12-31-2000, 11:58 AM
solomon: http://www.woodmann.net/cgi-bin/Ultraboard/UltraBoard.cgi?action=Read&BID=5&TID=826

bratsch: use a program like decafe or nmi (or even jad itself) to decompile .class's
Bratsch
01-01-2001, 01:28 AM
Thanks for your kindness Solomon and disavowed. This gives me some place to start. If anybody is interested in my adventures in this field, drop me a line and I will share what I have found.
Solomon
01-02-2001, 12:24 AM
Thx disavowed, that tool is just what I want :)


Happy New Year Everyone!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Happy New Year Everyone!!
PDA

View Full Version : Happy New Year Everyone!!

Leon [TRES2000]
12-31-2000, 02:23 PM
I wish a happy new year to you all!

And TRES2000 wishes all the best to all ppl in the r.c.e. community,

A very happy goes to:

* +Sandman
* Crackz
* Klefz
* Eternal Bliss
* Mammon
* All members in ReFleXZ
* Ytc
* Volatility and members of ID

I'm happy to tell you that Tres2000's webpage soon will be updated!

Best wishes:
Leon TRES2000


Analyze self extracting sfx exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Analyze self extracting sfx exe
PDA

View Full Version : Analyze self extracting sfx exe

CccT
01-01-2001, 07:17 AM
I recently saw a downloadable tool (or toolz?)
that allows to view the contents of self extracting sfx and exe and to extract only the files you need.
Does anybody know from which site it is available.
Thanks
tazmanianBRC
01-04-2001, 04:22 PM
If this self exe were a winzip-selfexe, you can open the exe in winzip :D


Problem with packed EXE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Problem with packed EXE
PDA

View Full Version : Problem with packed EXE

edward
01-01-2001, 02:49 PM
Hi,

I've got the following problem:
I have got a neolite packed file, which i want to patch.
So i traced to the end of the unpacking-routine (4E13B2h), redirected
the final jump to some free space (4E1385h) and inserted the patch
instruction. But unfortunately this does not work...the program
crashes with a "protection fault" at EIP=4E1385!
I can't see what i did wrong :-(
Maybe someone could help me ?

Thank you very much

edward

PS: Please excuse my posting in this forum instead of the newbies forum, but
the nf simply doesn't load at my PC...

<pre>
-------PRO!.text+A63C----------------------------byte-------------PROT---(0)---
0030:0040B63C 32 DB 8D 4D EC C6 45 FC-01 E8 77 9B 05 00 80 65 2..M..E...w....e
0030:0040B64C FC 00 8D 4D E8 E8 6B 9B-05 00 83 4D FC FF 8D 4D ...M..k....M...M
0030:0040B65C E4 E8 5F 9B 05 00 8B 4D-F4 5F 8A C3 5E 5B 64 89 .._....M._..^[d.
------------------------------------------------------------------------PROT32-
0167:004E1385 66C7053CB64000EB00 MOV WORD PTR [0040B63C],00EB
0167:004E138E FFE0 JMP EAX
0167:004E1390 52 PUSH EDX
0167:004E1391 657365 JAE 004E13F9
0167:004E1394 7276 JB 004E140C
0167:004E1396 65642E0D0A00018B OR EAX,8B01000A
0167:004E139E 44 INC ESP
0167:004E139F 2404 AND AL,04
0167:004E13A1 230503134E00 AND EAX,[004E1303]
0167:004E13A7 E871030000 CALL 004E171D
0167:004E13AC FE059C134E00 INC BYTE PTR [004E139C]
0167:004E13B2 EBD1 JMP 004E1385
0167:004E13B4 803D9C134E0000 CMP BYTE PTR [004E139C],00
0167:004E13BB 7513 JNZ 004E13D0
--------------------------------------PRO!.neolit+0385-------------------------
:map32 pro
Owner Obj Name Obj# Address Size Type
PRO .text 0001 0167:00401000 00086000 CODE RW
PRO .rdata 0002 016F:00487000 0001D000 UDATA RO
PRO .data 0003 016F:004A4000 0000F188 IDATA RW
PRO .rsrc 0004 016F:004B4000 0002C0B8 IDATA RO
PRO .neolit 0005 0167:004E1000 000062F2 CODE RW

</pre>
Predator [PC/pGC]
01-01-2001, 03:24 PM
Hello there..
the answer to your problem is quite simple..

NeoLite uses the VirtualProtectEx API to make the code it unpacks "read only". If you look up the api you'll see why a protection error occurs when you try to do your patching.

Solution 1: Use VirtualProtectEx yourself, right before you apply the actual patches, to make the memory writeable again.

Solution 2: BPX on VirtualProtectEx and you'll see some JZ or JNZ right in front of it. If I'm not mistaken, and you reverse that jump, it'll go over the call to VirtualProtectEx and you don't have to worry about it anymore.

Solution 3: Use my loader creator called PELG. v0.3 should be out today or tomorrow but even 0.1 can handle NeoLite.

Greets,
Predator [PC/pGC]
edward
01-02-2001, 05:35 AM
Thank you very much for your answer!
I found the jump you mentioned...patching now works :-)

Thanks again and Happy new year !


Incredible! SuddenDischarge.com trial has expired!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Incredible! SuddenDischarge.com trial has expired!
PDA

View Full Version : Incredible! SuddenDischarge.com trial has expired!

latigo
01-02-2001, 07:48 AM
Today i tried to access this popular site and all i got was:

'You are running an expired beta version of FoxWeb'

Whoa! Noone at THE site for RE tools cracked their web software..

As they say..'En casa de herreros, cuchillo de palo' :)
disavowed
01-02-2001, 04:07 PM
someone stopped by astalavista in the last few hours and got the crack for it.. the webserver's back up :)


IAT resolver beta test starts now
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IAT resolver beta test starts now
PDA

View Full Version : IAT resolver beta test starts now

tsehp
01-03-2001, 05:21 AM
hi,
the first beta is finished, this programs actually allows you to fix the
IAT's of all asprotected and vboxed targets.
It works on win2000 and win98, I need some beta testers that already
knows how to unpack targets and have some knowledge on pe-section
to test this app on other packers or protection systems.
You can write a word to tsehp@yahoo.com, you need to register on
this messageboard (fraviamb.cjb.net) for me to send you the program.
later,

+Tsehp
disavowed
01-03-2001, 05:14 PM
hurry up with it.. we're waiting for you on level 3 :)
tsehp
01-03-2001, 05:53 PM
sorry Alexey but you will have the release version when I'll be finished
to beta test, just give my tool a chance to last a while before release ;)

Thanks for beta testers to register here, it's more easy for me to follow the reports and send private messages on this messageboard, and this makes me some advertisements too for sure.
Please, don't spread actually this tool, it's far to be complete and I'd like the end users to have a correct version. Thanks again for all the replies I got today. Later
Kayaker
01-04-2001, 06:29 PM
Hi All,

Tsehp has requested a public discourse on the results of beta testing of his IAT Resolver, so here's my preliminary, albeit verbose, findings. The Good, the Bad and the Ugly.

The IAT Resolver, which sports the interesting filename of revirgin.exe, comes with several files, including an Asprotected 1.1 notepad, a raw Procdump dumped version with the sections realigned, 2 text files listing the imports detected after the 1st pass at resolving (i.e regular unencrypted addresses), and after the 2nd (attempt at resolving redirected addresses), and finally the Import Table and Import Allocation Table generated by the Resolver.

Part 1 - Win98SE

I first tried this on a Win98SE system. After loading the Asprotected notepad and using the IAT Start RVA and Length provided (IAT Start, 62e0; IAT Length, 238h) I did a first pass using the IAT Resolver. This very quickly showed the already resolved unencrypted imports for ADVAPI32.dll and GDI32.dll.

Then I chose 'Resolve Again' and within seconds the Imports for KERNEL32.dll and USER32.dll which had previously indicated 'redirected' were resolved. So far, so good ;-)

However, 2 dlls were never resolved, nor did they ever even indicate they were redirected, SHELL32.dll and COMDLG32.dll. If I tried to do a Trace, which is a further attempt to resolve unresolved imports as I understand it, on one of more of the problem imports, the blue progress bar would get to about 90% and then the program would lock up. I could CTRL-ALT-DEL and start again OK.

Doing a hex dump from the IAT in memory at 4062E0 showed that there was nothing "wrong" with the problem encrypted addresses, they just don't get resolved, aren't recognized as 'redirected', and can't be traced.

As an example, here is a portion of the resolved Import text file generated after the 2nd attempt at resolving showing the blank entries that *should* have been resolved for SHELL32.dll, as well as Tseph's results he included as one of the files:

My Results:

64 000063E8 BFF76DD7 01F1 KERNEL32.dll GlobalLock
65 000063F0 006A156C 0000 '?????? ??????' -dumb emoticons!
66 000063F4 006A1588 0000 '?????? ??????'
67 000063F8 006A15A4 0000 '?????? ??????'
68 000063FC 006A15C0 0000 '?????? ??????'
69 00006400 006A15DC 0000 '?????? ??????'
70 00006404 006A15F8 0000 '?????? ??????'
71 0000640C BFF55591 0285 USER32.dll wsprintfA

Tsehp's Results:

64 000063E8 BFF76DDB 01F1 KERNEL32.dll GlobalLock
65 000063F0 7FD47579 0142 SHELL32.dll ShellExecuteA
66 000063F4 7FD034A7 00CD SHELL32.dll DragAcceptFiles
67 000063F8 7FD124F4 0140 SHELL32.dll ShellAboutA
68 000063FC 7FCE6CA7 00AF SHELL32.dll
69 00006400 7FD012E6 00CF SHELL32.dll DragQueryFile
70 00006404 7FD44B5D 00CE SHELL32.dll DragFinish
71 0000640C BFF55585 0284 USER32.dll wsprintfA

So I Asprotected my own copy of Win98SE Notepad using Asprotect v1.01 (file date 10/14/00) and got the exact same results. I'm not 100% sure if that version is *actually* right, you know Alexey ;) it's just what the version properties said.

Then I tried it with Asprotect v1.0 (file date 6/13/00) and again got the same problems with SHELL32.dll and COMDLG32.dll, but also with ADVAPI32.dll (never indicated 'redirected', locked up on Tracing).

...continued...
Kayaker
01-04-2001, 06:36 PM
Part2 - Win95

I had an enjoyable lunchtime SoftIce session at work today on a Win95 system repeating the above procedure. To start with, the Asprotected Win98 notepad Tseph had provided wouldn't run on my system. It gave the error message "The procedure entry point SHGetSpecialFolderPathA could not be located in the dll shell32.dll" Huh? No idea what this means.

So then I Asprotected my own copy of notepad and found new values for the IAT Start RVA and Length. What I like to do to quickly reach the point where the IAT is unpacked is to display some section of the program memory in the Softice data window and break on VirtualAlloc until something shows (around 11x). Then I do 1 break on GetProcAddress and return into the IAT unpacking loop. At the POPAD the IAT start address will be in EDI and the table length is easily found . At least this is the way I read things, if I've goofed up please let me know.

:0068F43F AC LODSB
:0068F440 3A0584276900 CMP AL,[00692784]
:0068F446 74DD JZ 0068F425
:0068F448 4E DEC ESI
:0068F449 53 PUSH EBX
:0068F44A 56 PUSH ESI
:0068F44B 53 PUSH EBX
:0068F44C 8D5DF4 LEA EBX,[EBP-0C]
:0068F44F 53 PUSH EBX
:0068F450 3A0586276900 CMP AL,[00692786]
:0068F456 7407 JZ 0068F45F
:0068F458 0FB64E01 MOVZX ECX,BYTE PTR [ESI+01]
:0068F45C 41 INC ECX
:0068F45D EB05 JMP 0068F464
:0068F45F B904000000 MOV ECX,00000004
:0068F464 41 INC ECX
:0068F465 01CE ADD ESI,ECX
:0068F467 E8D4FBFFFF CALL 0068F040 ; Imports decrypted, GetProcAddress called
:0068F46C 5B POP EBX
:0068F46D EBD0 JMP 0068F43F
:0068F46F 61 POPAD ; IAT Start sits in EDI

...sigh, MB limitations, continued...
Kayaker
01-04-2001, 06:37 PM
But I digress ;) So anyway I got new values for Start RVA and Length for the Win95 notepad (7288 and 208h), plugged them into ReVirgin and got the same negative results on SHELL32.dll and COMDLG32.dll. There was also a second problem, though not as severe in that even after the 2nd attempt at resolving, none of the KERNEL32.dll imports were fully resolved, the addresses were but not the name of the dll or the import names, i.e.:

20 000072D8 BFF31C11 0199 GDI32.dll SetViewportExtEx
21 000072E0 BFF74904 0000 ?????? to_Resolve

I'm trying to remember now, but I don't think Tracer worked on the unresolved imports, BUT, I could use Exescope (on Kernel32.dll) to match up the addresses and the names and edit them in nicely. (Picky suggestion Tsehp - being able to use the Tab key to step along the edit boxes would be nice ;)

Anyway, that's the extent of what I've been able to do so far. I had a quicky look at a shareware Asproteced proggy and there were some unresolved imports, but I didn't spend enough time on it to give a useful report.

I have a couple of questions for Tsehp, which could wait until I try to rebuild a dumped file myself. One is exactly how you realigned the Procdump dump without losing the Icon? My Procdump (or Icedump) dump was 100K while yours was 120K. (OEP of E001 MOVed at 68F84C, dump at 68F87B, just before the Asprotect shareware MessageBox). My Raw Offset for the 1st section was 600, so realigning the PE Header value of it to 1000 would do no good without physically shifting everything 400 bytes and adding padding. I was going to try doing a raw binary dump of the file (which would give the proper RVA aligned image) and then rebuild it as a PE file later.

Tsehp wanted to take a look at my Win98SE kernel32.dll to try to "resolve" these problems, so I'll up it as a zip file. Oops, MB doesn't let me post while logged in therefore can't up files, I'll email it to you.

Interested in reports from other beta testers...

Regards,

Kayaker
tsehp
01-04-2001, 07:20 PM
first, thanks kayaker for this first report. I will drop at this time the win95 problems and focus on win98 se (that I don't have !)
The tracer is very dependent of the win version, but with the kernel32.dll you sent me, this should be fixed fast.
realigning ? I don't know, I just make a first dump with procdump, then
I check all the boxes, but not the one with optimize pe-section, then procdump realigns and keep the icon, meaning that the .rsc section is still correctly set inside the pe. I'll repeat on my win98 to see if I can replicate the problem you had, then report here.
Advice : try to continue the tests on win98 first version, that's where I made this prog and did all the preliminary tests, best regards.

+Tsehp

ps: alexey's protected app named ADR is cracked on win2k and win98 in 5 minutes with the beta :)
tsehp
01-04-2001, 07:43 PM
still about win98se problem,
I've attached the file you get just after you do a trace all, without doing a resolve again, the tracer works ok, but on win98 first version.
If I don't find nothing special inside the kernel32.dll, I'll have to download an old copy of win98se, maybe you have a link for this ;)
regards,

+Tsehp
tsehp
01-05-2001, 02:12 PM
hey ! did any of other beta testers had some good results on the
two platforms I used to build this tool ? win2k and win98 ?
I just don't want to be the only one that succeeds using it ;)
thanks to report, even if everything is ok.
Kayaker
01-05-2001, 03:30 PM
+Tsehp (01-05-2001 04:12):
hey ! did any of other beta testers had some good results on the
two platforms I used to build this tool ? win2k and win98 ?
I just don't want to be the only one that succeeds using it ;)
thanks to report, even if everything is ok.

And I just don't want to be the only one that DOESN'T succeed using it ;)
tsehp
01-05-2001, 05:23 PM
don't worry, I'm actualy downloading win98se, will re-compile on this platform pretty soon, how did work the version I sent you today ?
eL.CaRaCoL
01-05-2001, 07:18 PM
Hi +Tsehp !
Don't worry! we are testing your Super Tool in several mode.
It works! yes, it works fine...
tsehp
01-06-2001, 02:07 AM
thanks ! I'll sent you a personal reply to your e-mail el caracol with a detailed description of how it works.

Note to other beta testers :
seems like kayaker said, we have a small problem on win98se, I still can't find a link to download this platform :( , I'll ask kayaker if he can
do a very nice action to help a poor programmer like me to validate
this tool on this intermediate version of windows.

A new beta version is available as your request :
win me support
improved the manual edit iat's (can use tab)
auto select of app when you use load target on win 9x

Remember that the beta tests if provided also to improve the tool's ergonomy, the next version will take into consideration all what you said on you e-mail el-caracol.
regards.
+SplAj
01-07-2001, 05:21 AM
Hi Fellow Beta testers.

I was initally disappointed at my Revirgin not working with WinNT4.... and I also had problems with my notebook running 98 SE.
The Tracer crashed everytime :(

I had great fun unpacking all those notepad.exe's with ASpack21, UPX101, PElock,Pepack,Shrinker3.4,
Petite2.2,PEcompact1.33, Asprotect1.1, Softlocx5,Crunch etc etc.

It worked with them all (but same problem with the 'missing' api's sometimes ala Kayaker!) BUT NP is an easy target so I tested it on Ao97pr.exe (MS Office passwords 97) from Elcomsoft. Great!
Then with the latest Ao2000pr...... ???? what no API's :(

So Revirgin (or I) failed to get at Ao2000pr.exe
Any clues on this target ?

I also tried it with TMG KeyGens (Fusion2 keygen)
it failed. But I think the tracer might work with this
target.

Awaiting Beta RC 2 :)

+SplAj
'patch+play'
Yado
01-07-2001, 12:22 PM
Hi , i'm testing you rebuilder a lot , i've tryed it with some krypter
and it seem to work with a lot of them , i've found a new version of aspack that make it crash (maybe in my machine).i'll send you a report of all my tests soon !

byez. Yado.
tsehp
01-07-2001, 12:59 PM
+SplAj (01-06-2001 19:21):
So Revirgin (or I) failed to get at Ao2000pr.exe
Any clues on this target ?

I also tried it with TMG KeyGens (Fusion2 keygen)
it failed. But I think the tracer might work with this
target.

Awaiting Beta RC 2 :)

+SplAj
'patch+play'

no,no,no it works !
just launch it, try iat start : 198d38 length 3b4
then resolve and resolve again, all the api appears.
I didn't dumped it, to go to the working dumped file but it should normally work fine.
Maybe you didn't set a correct iat start, I mistake myself a lot, setting it to a jump table, but you have to set the iat start to the first pointer located inside the first line in the jump table.
you will find attached the text file of what was resolved.

Actually a problem will occur, but this will be fixed in the future :
you resolve on win9x, the target works on win9x, same for win 2k,
there are duplicate names inside win api exports that points to the same address, The Owl found actually a partial solution to this, I'll try to find mine, and the development is on this precise problem.
best regards,

+Tsehp

+Tsehp
tsehp
01-07-2001, 01:00 PM
Yado (01-07-2001 02:22):
Hi , i'm testing you rebuilder a lot , i've tryed it with some krypter
and it seem to work with a lot of them , i've found a new version of aspack that make it crash (maybe in my machine).i'll send you a report of all my tests soon !

byez. Yado.
thanks !
don't forget to report the error code, with your win version and link to the program in question,
regards,
tsehp
01-07-2001, 06:48 PM
now revirgin works on win98se 4.10 2222A,
two programs were tested : AZPR and asprotected notepad provided
on the pack.
regards
Kayaker
01-07-2001, 08:52 PM
Perfect! I haven't had a chance to rebuild anything yet, but I ran the new build of revirgin on 3 asprotected apps - notepad, asprotect 1.1 and Eldos AnyCalc and the Tracer worked flawlessly. After the 2nd pass any unresolved entries could be traced with 'Trace All', giving addresses and 'Resolve Again' filled in the Name and Ordinal.

There was 1 unresolved entry left with Asprotect 1.1 (C1C220) and 1 with AnyCalc (actually 2 duplicates of C6C220), but as Tsehp mentions these could be a bogus return and can be edited to a harmless GetVersion or something.

Nice work Tsehp, VERY impressive and thanks for getting it to work on Win98SE ;-)

Regards,

Kayaker
tsehp
01-08-2001, 01:48 AM
thank you very much kayaker, I'm half done with the version that will allow you to resolve dll's
the addresses you mention resolves to a single ret, so my tracer bounces on them, I actually don't know what to do with this, if someone have a suggestion or can eventually analyse the use with ida on several target's that would be nice and save me some work.
regards,

+Tsehp
+SplAj
01-08-2001, 04:21 AM
+Tsehp

Thanks for the e-mails. I DL the latest 0.99.....WOW!!! that tracer worked like a charm. Found the IT in StatMans keygens (Greetz 2U man, ace protection system) and Ao2000pr.exe
-starting at 10000 moving up 1000 bytes at a time until I hit an API :)

I traced everything, even those ' i'll come back to that later ' targets, like a kid playing on one of those 'magnadoodle' things :) .

Thanks Tsehp, CONGRATULATIONS !!!

Just one target left for my trials:- Softlocx5. The 1st beta found minimal stuff. So I waited for the functioning tracer version for 98SE. However The 0.99 new one CRASHES my PC while trying to resolve. I used the racer exetensively on other targets and it worked fine. I'll send you a SLcx5 protected NotePad (Bloc-Notes for you) target via e-mail. I'm sure it's just a bit of fine tuning required.

Ergonomics
=========
Some personal requests to make using Revirgin easier :)

1) Can you make the API box 'moveable', width-wise with the window so that I can see the API names in full.

2) Can you 'minimise' the target and return auto to Revirgin after loading target ?

3) Can you make the 'load target' file selector keep it's target directory ? it seems to be fixed on My Documents every time.

Again, congratulations, what a tool for 2001 :)

+SplAj
'patch+play'
+SplAj
01-08-2001, 04:54 AM
+Tsehp.

I did some more testing with Softlocx5 target NotePad....

I found the problem. It's not Revirgin but the 'mutant'
that is Softlocx5 protection. He didn't like being opened by
Revirgin and refused to be traced, crashing my W98 PC. Solution. Launch SLcx NP FIRST. Get the 'register' screen. Then launch Revirgin. Then continue with target launch - on Win2k OK. BUT W98SE cannot then TRACE the target as it did not LOAD it :(

So maybe Revirgin need some Int19 & Int20 etc stealth code in the future !

+SplAj
SpeKKeL!
01-08-2001, 06:50 AM
Sorry misposted my post:look at "another target....?" >general board. greetz SpeKKeL!......
tsehp
01-08-2001, 11:52 AM
+SplAj (01-07-2001 18:54):
+Tsehp.

I did some more testing with Softlocx5 target NotePad....

I found the problem. It's not Revirgin but the 'mutant'
that is Softlocx5 protection. He didn't like being opened by
Revirgin and refused to be traced, crashing my W98 PC. Solution. Launch SLcx NP FIRST. Get the 'register' screen. Then launch Revirgin. Then continue with target launch - on Win2k OK. BUT W98SE cannot then TRACE the target as it did not LOAD it :(

So maybe Revirgin need some Int19 & Int20 etc stealth code in the future !

+SplAj
yes, and that's a problem considering what I want to do with the tool in the future.
splaj, can you save me some time and email me this program, just to see if I can fix those int's problems. Do you mean that when I start myself the process, those int's are temporary handled by my tool and this is detected by the target ?
It it's the case, this should not be very complicated to fix, this sounds like a countermeasure against a process patcher no ?
regards,

+Tsehp
tsehp
01-08-2001, 11:56 AM
SpeKKeL! (01-07-2001 20:50):
Sorry misposted my post:look at "another target....?" >general board. greetz SpeKKeL!......

I'll finish this evening the dll resolve support for revirgin, then try a resolve on the other thread concerning vslick (vboxed dll)
then you target is next !
thanks for reporting this, I'll tell you just on this thread.
regards,

+Tsehp
tsehp
01-08-2001, 12:14 PM
hi,
just a small word for actual revirgin beta testers :
I have actually three targets to fix, if you have some others, thanks to wait until wednesday before sending them to me :)
I'll report here when I'm finished with all of them.
Thanks for your time & work,

btw I just updated the beta with support for dll's

regards,

+Tsehp
tsehp
01-09-2001, 05:00 AM
first see the vboxed dll topic on the mb.

Follow this steps to create your dumped dll :
load icedump
start vs.exe
at the nag, put a bpx getmodulehandleA ,then at popup do a p-ret (f12)
you're inside vbox code, then :
/tracex <high rva> <low rva>
you land in dll's OEP at 1013513A ,
then /PEDUMP 10000000 1013513a <file>

Don't use hydra if you want to test with revirgin (note to the owl, I tried latest hydra but it crashed my win98 first version :(

revirgin step :
load revirgin, then load target, select the vsapi.dll and enter :
iat start rva 1a17c8 length 6e4
first resolve, then you can either do a trace all or trace manually
after it's finished, do a resolve again, then put 1b6814 at it start , remember to paste the it.bin at this location inside vsapi.dll you dumped, paste also the iat.bin at 1a17c8 raw offset.
the target works and vbox is removed, this validates the dll resolve test. I included the revirgin list of imports resolved.
tsehp
01-09-2001, 06:07 AM
+SplAj (01-07-2001 18:54):
+Tsehp.

I did some more testing with Softlocx5 target NotePad....

I found the problem. It's not Revirgin but the 'mutant'
that is Softlocx5 protection. He didn't like being opened by
Revirgin and refused to be traced, crashing my W98 PC. Solution. Launch SLcx NP FIRST. Get the 'register' screen. Then launch Revirgin. Then continue with target launch - on Win2k OK. BUT W98SE cannot then TRACE the target as it did not LOAD it :(

So maybe Revirgin need some Int19 & Int20 etc stealth code in the future !

+SplAj
as I wrote you, this wasn't some anti debugger features but a process/modules actualisation problem inside revirgin, maybe I mistake but all iat entries were resolved without using the tracer, but I could mistake.

Finally, I almost finished with all targets with the problems that were reported, please send some more as soon as you find them, just avoid :
-asprotect
-vbox
-softlock
because revirgin seems to be ok for those schemes,wayward sent me a laserlocked one, if someone have a working target without the cd but with encrypted iat's , thanks to send them, it's maybe possible to half crack it, just to allow me to resolve the iat's.
regards,

+Tsehp
G-RoM
01-09-2001, 09:06 AM
Tsehp :

So far we tested successfully on vslick.. Please refer to the thread about unvboxed dll. U need to tweak some option AND after that fix relocation pointer manually.

Anyway... anything linked to Phoenix/hydra is my fault/ my problem... so leave my fellow Owl on this :). Please post what u did exactly (option etc...) and download really latest icedump (NOW).

Regards,
G-RoM
tsehp
01-09-2001, 04:20 PM
hi g-rom,
I've already posted the most infos I could to owl this morning, he already told that everything worked fine for icedump/hydra but I wanted him to have the most info possible, he will forward you.
I used the latest build I could find at http://ghiribizzo.virtualave.net/icedump/icedump.html
maybe I have a wrong address to have the pre 6.022 ?
regards,
+Tsehp
tsehp
01-12-2001, 01:54 PM
some news for revirgin development:
I'm actually working on safedisc v1, had some win98 problems , the load target could not work for this target because it creates another process and could trace into it on win98.
This is resolved and the win98 compatibility will be maintained, I'll upload a new version when my first safedisc app will be resolved by revirgin, be patient.
regards,

+Tsehp
tsehp
01-13-2001, 08:10 AM
hi, for beta testers, a new build has been uploaded :
-no need to load target anymore, useful for targets that creates some other processes to resolve.
-you can edit it length.
please re-test the tracer on your usual targets, next release will be normally able to resolve safedisc 1 :)
regards,

+Tsehp


Attn Quine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Attn Quine
PDA

View Full Version : Attn Quine

Iceman
01-03-2001, 05:12 PM
Quine , if your alive and see this , please contact me or any of our old common friends.

Ice

P.S

Tshep , sorry to use your board for a personal matter like this .
tsehp
01-03-2001, 05:58 PM
no pb, his last email I know is :q_u_i_n_e@yahoo.com
HalVar
01-07-2001, 04:25 PM
Iceman (01-03-2001 07:12):
Quine , if your alive and see this , please contact me or any of our old common friends.

Ice

P.S

Tshep , sorry to use your board for a personal matter like this .

Iceman, Quine is alive & more or less active on datarescues IDA board,
look at datarescue.com for link


some problems about latest version of winace
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > some problems about latest version of winace
PDA

View Full Version : some problems about latest version of winace

NikDH
01-03-2001, 06:10 PM
Hi to all
I'm under win2k and I'm working on latest version of winace
It gives me some problem coz i cant get the api it uses to get the name from serial edit
So I moved on win98 and made bpx hmemcpy and it seemd to work but when i bpm on that address i cant find where the prog processes the serial
There r a lot of functions which copies that serial in various zone of mem but it seems to never work on them
Quite strange
See ya
NikDH
tsehp
01-04-2001, 07:01 AM
hi,
you named the problem yourself :)
the serial is on an edit control ? do a hwnd on softice and locate this
edit, you'll get an handle to it, then do a bmsg <handle> wm_command,
this will trigger the wm_command sent to this window, then you have to trace the message loop to find where this edit is processed, this is long to do but will surely lead you to the api concerned.
a msg loop usually contains getmessage and then processes the message using the UINT msgId wparam and Lparam, look for m$ docs for this and search on this site for essays with words : hwnd , getmessage or sendmessage or postmessage.
regards
NikDH
01-04-2001, 08:10 AM
Already tried it
I tried with
bmsg hwnd_edit wm_gettext
but under win2k it never pops
Why?
R there any other msgs used by win to get the text from an edit box?


BlueScreen coding
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > BlueScreen coding
PDA

View Full Version : BlueScreen coding

blackcheck
01-04-2001, 01:19 PM
I'm using IDT modification to get to ring0.Then i get some mem with IFSMGR_HeapAlloc,
copy the following code and jump there.

.
.
.

int 20h
dd VMM_Get_Sys_VM_Handle ; get VM Handle in ebx

xor eax,eax ; MB_OK
lea ecx,[edx+BsodMsg]
lea edi,[edx+TitleMsg]
int 20h
dd SHELL_SYSMODAL_Message ; machine hangs here
iretd

BsodMsg db 'blablabla',0
.
.
.
.

This totally freezes my system. I know for sure that this snippet of code
works fine,if it's called by an IFSMGR Hook.So i assume the memory part
i got from HeapAlloc is somehow less privileged than the IFSHOOK.Could
someone please explain this?

tia,

blackcheck
disavowed
01-05-2001, 02:01 PM
check the source code for frogsice. he uses similar code (SHELL_SYSMODAL_Message), and it doesn't crash :)
Spath.
01-06-2001, 10:45 AM
> Then i get some mem with IFSMGR_HeapAlloc,

There's no such function in my IFSMgr and the
code you showed seems correct to me, but I
don't understand why you're using a IFSMgr
specific function for a general basic task. Try
a simple _HeapAllocate() instead, it always
worked fine for me.
blackcheck
01-06-2001, 12:23 PM
it works with frogsice ,cause it's a vxd.
spath: it does not matter what kind of alloc function i use
( i used IFSMGR cause i know it from memory) .As i said,it must
be some kind of privileg issue.if my proc gets called due to
an ifs hook it works just fine,regardless of the memory location.
The Owl
01-06-2001, 01:50 PM
I'm using IDT modification to get to ring0.Then i get some mem with IFSMGR_HeapAlloc,
copy the following code and jump there.

did you make sure that you setup the environment that the rest of the VxDs expects? most importantly, do you load DS/ES/FS with proper selectors? and i can imagine some other housekeeping is mandatory as well... take a look at what the VMM handlers do.
Spath.
01-06-2001, 06:43 PM
> spath: it does not matter what kind of alloc
> function i use. As i said,it must be some
> kind of privileg issue.if my proc gets called
> due to an ifs hook it works just fine,
> regardless of the memory location.

Yes, that's what you said and it is wrong.
Privilege has nothing to do there as long as
you call SHELL_SYSMODAL_Message from
a DPL0 selector (why do you think your call
to Get_Sys_VM_Handle is working ?).
This a functional problem in your code, not
a protection/privilege issue.
blackcheck
01-08-2001, 10:14 AM
> most importantly, do you load DS/ES/FS with proper selectors?

ok,this explains why it worked as an IfsHook,but why is that required ? SHELL_SYSMODAL_Message seems to be the only
function i use,that needs it.
sorry for my bad mode of expression: by privilege i meant
'proper environment'


Woww...1'st Post
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Woww...1'st Post
PDA

View Full Version : Woww...1'st Post

tazmanianBRC
01-04-2001, 04:04 PM
Hi people...
I'm tazmanianBRC. I'm from Brazil and
sorry about my english, but I'm new in this board. I'm a cracker (for sure :D) and i would like to say to you...i'll help you on everything that is cracking...and i 'll make my english better...

[]'s


Retrieving VBox'ed DLL - Any ideas?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Retrieving VBox'ed DLL - Any ideas?
PDA

View Full Version : Retrieving VBox'ed DLL - Any ideas?

zyn\ker
01-04-2001, 05:12 PM
Hi y'all
I'm currently trying to unpack/uncrypt a program which is being protected by VBox 4.3. The steps described in the tutorial on +Tsehp's page are working fine to the point where I'm supposed to find the OEP in the jump to EBX. I hoped to find the address of the DllEntryProc there, but it seems that for DLLs these instructions aren't executed at all as they're being jumped over. The DLL isn't even completely decrypted at that point; it still goes on and on.
Has anybody found a way to quickly find the final JMP?
The Owl
01-05-2001, 04:30 AM
for OEP: icedump/tracex
for dumping: icedump/hydra/unvbox.dll/pedump

a quick receipt just in case:

1. iceload -n vboxed.dll
2. run your exe, click 'Try' or whatever to pass by the nag
3. winice breaks as vboxed.dll!DllMain gets called for the first time
4. still in winice: /tracex <start VA of first section> <end VA of first section>
addresses can be fetched from map32 output
5. wait for first break, then you will have to issue another /tracex with a
slightly lower upper bound (no algo here, use zen to guess it, trying never
hurts)
6. 2nd break should normally be at the OEP, time to dump
7. /hydra unvbox.dll
8. /pedump <dll base VA> <RVA of DllMain> unvboxed.dll

if you want a cleaner dump, you'll have to edit the PE header in memory before
step 8. also, to have full relocs back, you have to spot it in the dump and adjust
the object directory entry appropriately.
zyn\ker
01-05-2001, 07:17 AM
Thanks a lot for the quick and detailed answer!
But I still got some problems:
When I start the EXE, SoftIce pops into the DLL _before_ the "Trial bla-bla" window appears. The situation is the following:
I have an EXE which seems to be completely unencrypted/unpacked which imports a DLL (besides a few others of course). Before the code in the EXE is even sniffed upon, the OS Loader kicks in and executes the DllMain of the DLL (in the 'WeiJunLi' segment). There this DLL somehow loads one of the VBox DLLs and (now comes a bit speculation) this DLL creates a new process with the 'Trial' window and waits for its return. Now I have a locked up process(the EXE waiting for the packed DLL to return waiting for VBox) and VBox. When I click on 'Quit', the first process is not being resumed, but killed together with VBox. I can't click on 'Try', but have to do some tricks with 'Relicense', but this shouldn't have an effect on the rest of the program.
Just wanted to make sure we talk about the same version of VBox and have the same info-base.
I can't \tracex the DLL when it pops up before the 'Trial', as the process locks up then.
Even if it worked, I don't quite understand step 5; when I \tracex again after step 4, I should break on the very next instruction, as I'm still in (almost) the same range as in step 4 or did I miss something?
Thanks again for your reply.
tsehp
01-05-2001, 01:41 PM
hi, send the program's url please, I'll check this out.
G-RoM
01-05-2001, 01:56 PM
Execute the steps Owl told ya except the one regarding the TRY button (well not exactly but)... DLLMain_VBOX code is invoked before...

However u must bypass VBOX crap so when u traceX it, the try dialog box will appear, just click on continue and at the end u will popup back in SICE when tracex will have done its job. Then follow the pedump steps.

Cheers,
zyn\ker
01-06-2001, 04:24 AM
Sorry for getting on your nerves, but it still doesn't work.
What I did is the following: I notified SoftIce about the DLL via IceLoad and started the program. SoftIce popped into WeiJunLi's DllMain where I executed a \tracex [lower bound of PREVIEW] [upper bound of PREVIEW]. After about 15 minutes it breaks somewhere at the upper levels of PREVIEW and everything looks not very DllMain-like, so I lower the upper bound of \tracex a bit. After a few more minutes the 'Trial'-box comes up and I do my thing to continue to the real program. After a while, SoftIce pops again, but I'm in the Export-Table and the function it jumps to doesn't look like the real DllMain at all. I ignored this and dumped the DLL with the UnVBox-Plugin, but the program crashes when I try the dumped dll.
The program I'm trying to unpack is Visual Slickedit (www.slickedit.com). Should anyone of you be so kind to take a look at it and show me my incompetence: The trial key is 2655693440-0600-WB0000-STD , so you don't need to enter a real e-mail address in the trial-form.
tsehp
01-06-2001, 07:03 AM
ok, while waiting for a good soul to point me a way to download win98se, I'll take a look at it, good oppurtunity to test also the iat
rebuilder on this target, all you say seems strange. Normally vbox must return to the main app for it to be executed, it could create a lot of good/fake threads to trace, but one must be, maybe trying to bpx ResumeThread api or another, I'll report of what I found.
regards,

+Tsehp
The Owl
01-07-2001, 04:47 PM
Sorry for getting on your nerves, but it still doesn't work.

no problem, i took a look at it now myself and figured we have an issue indeed. it seems that the scanner finds only kernel32 imports, but nothing else - obviously not good as the rest won't get resolved, no wonder the dumped DLL crashes.
tsehp
01-07-2001, 07:17 PM
at this point, I'll change my tool to resolve iat's from dll's, this was
designed from the start and should not be a problem. It allowed me
to rebuild every vbox dump I tested before and it should work also
for dll's, just check at the beta test topic, I'll notify when dll rebuild will be added.
Normally monday/tuesday evening (Owl, I promise you to work on what we said after ;)
regards
The Owl
01-08-2001, 05:20 AM
problem found&fixed. actually the other scanner (/option p a) does the job fine, it's just that the /option command was a bit screwed up - all works now, grab latest 6.022pre and test it.
tsehp
01-08-2001, 05:37 PM
G-RoM (01-05-2001 03:56):
Execute the steps Owl told ya except the one regarding the TRY button (well not exactly but)... DLLMain_VBOX code is invoked before...

However u must bypass VBOX crap so when u traceX it, the try dialog box will appear, just click on continue and at the end u will popup back in SICE when tracex will have done its job. Then follow the pedump steps.

Cheers,
Just after the nag, I putted a bpx getmodulehandleA, then a tracex
with low and hight vsapi rva, so normally the next popup is the OEP , because dllmain calls for vbox.

I did, landed at 0x1013513a after the try. Then dumped with icedump and procdump, just to be sure.

I resolved all imports with revirgin iat start : 1a17c8 length 6e4 with
the tracer,
putted the vsapi oep at 13513a, but when loading vs.exe, vsapi crashes at 100ad61b, doesn't seems to be because of a bad iat rebuild, but surely a bad guess of dll's OEP. any ideas ?
TIA
touchzen
01-09-2001, 12:37 AM
The eop of the crack is: 0013513A
IF anyone want the crack to studywith, please let me know
tsehp
01-09-2001, 03:36 AM
Ok it works finally with revirgin's latest version, see the beta test topic if you want to make a test with it.


Linear Address
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Linear Address
PDA

View Full Version : Linear Address

Newbie
01-04-2001, 09:24 PM
Hello everyone,
I have a simple question. How do you convert a 32-bit linear address in to a segment:offset address?!?

Thanks,
Newbie
Solomon
01-04-2001, 09:43 PM
There is a simple PDF manual: http://www.datarescue.com/idabase/idadown.htm
Solomon
01-04-2001, 09:46 PM
Ooops! I post in the wrong place. I mean IDA manual ;) sorry.
The Owl
01-05-2001, 04:43 AM
I have a simple question. How do you convert a 32-bit linear address in to a segment:offset address?!?

generally, you don't as segment:offset addressing is used in real and V86 mode only (and covers roughly the lower 1 MB of linear address space), in protected mode you have the selector:offset form (which i think is what you meant). so, there are 2 cases here:

1. you already have a selector and want to find out which offset to use to end up at the target linear address. you have to find out the corresponding descriptor (in the GDT or LDT) then extract the base address of the segment described by this descriptor, substract it from your target linear address and if the result is not above the segment's limit, you have just got your offset (otherwise the target linear address is not accessible through this selector/descriptor).

2. you don't have any specific selector. then you have to find one in the execution environment this linear address is used. for this you have to enumerate all the descriptors in the GDT and LDT and find one that has the right type code/data) and access rights (read/write and the DPL) and a base/limit for which the following holds:

base <= target linear address <= base+limit. once you find such a descriptor, go to the previous step to find the corresponding offset in it.
Newbie
01-05-2001, 09:56 PM
Thanks both of you for your explanations. What I am trying to do is to find the address of the IDT by reading the IDTR. As you most probably know the IDTR has a 32-bit linear address which points to the base of the IDT plus the the 16-bit Limit for the IDT. That's why the question. I want to extract that information from the IDTR and then do a memory dump using the 32-bit linear address.
Let's see if I can make this happen.

Thanks,
Newbie
Newbie
01-05-2001, 10:20 PM
By the way ArthaXerXes... if you have time to post that routine I will appreciate.

p.s. You can tell you people know quite a bit. Thanks for your time and knowledge. It is appreciate :)

Thanks,
Newbie[/quote]
The Owl
01-06-2001, 01:41 PM
Limit for the IDT. That's why the question. I want to extract that information from the IDTR and then do a memory dump using the 32-bit linear address.
Let's see if I can make this happen.

again assuming that you're under a win32 OS, you will face some problems:

1. win9x

every Virtual Machine has its own IDT, what's more, each one of them has two (one is used when the VM executes V86 mode code, this IDT is actually common for all VMs, and one for protected mode execution, it is created dynamically each time a VM switches to protected mode). if you write a win32 application to do all this IDT dumping, your SIDT will give you the protected mode IDT of the System VM which again is just one of the IDTs used in win9x. other than this, you can simply use the linear address as it is without the need for any further selector:offset transformation magic, win32 apps execute in a 'flat' environment, ie. all segments are 0 based and 4 GB limited (well, almost, for practical purposes it's true ;-)).

2. winnt

here you have a different issue, actually 2. first, you face a problem on SMP machines as each one of them has its own IDT, second the IDT is not accessible from user mode code (well, not entirely true ;-)) as it is in the system arena and the paging logic will prevent any access to it. so your only option would be to write a kernel mode driver that would then enumerate all the IDTs and dump them. i'm not sure how far you want to go to achieve this, so i'll stop here and let me know what you need.
Newbie
01-06-2001, 04:23 PM
The Owl (01-06-2001 03:41):
[quote]
1. win9x

every Virtual Machine has its own IDT, what's more, each one of them has two (one is used when the VM executes V86 mode code, this IDT is actually common for all VMs, and one for protected mode execution, it is created dynamically each time a VM switches to protected mode). if you write a win32 application to do all this IDT dumping, your SIDT will give you the protected mode IDT of the System VM which again is just one of the IDTs used in win9x. other than this, you can simply use the linear address as it is without the need for any further selector:offset transformation magic, win32 apps execute in a 'flat' environment, ie. all segments are 0 based and 4 GB limited (well, almost, for practical purposes it's true ;-)).

Ok. Let's start from a Win9x prospective. When you talk about the System VM's IDT, are you referring to the IDT that is common to all VMs?!? Otherwise, I can't explain how a program changing entries in the IDT can still stop SICE or any debugger for that matter. Or am I amissing something here.

Newbie

p.s. Don't want to sound corny... but talking to you people has really got me excited and a lot of light bulbs are turning on in my head. Thanks again for your time. Hope I am not frustrating anyone with my questions. Thanks! :)
The Owl
01-07-2001, 04:53 AM
Ok. Let's start from a Win9x prospective. When you talk about the System VM's IDT, are you referring to the IDT that is common to all VMs?!? Otherwise, I can't explain how a program changing entries in the IDT can still stop SICE or any debugger for that matter. Or am I amissing something here.

1. i did not talk about THE IDT of the System VM per se as there is no such thing. the Sys VM (by the time win32 apps get to run) has 2 IDTs. the V86 mode IDT (which will be common to all VMs when they start their life in V86 mode) is created when the Sys VM was born, later when krnl386 switches the Sys VM into protected mode (as part of the windows startup) a protected mode IDT will be created as well. since all win32 threads run in the Sys VM in protected mode, an SIDT executed by them will show the protected mode IDT of the Sys VM, ie. they will all see the SAME IDT, hence when any one of them modifies it (not exactly a prudent thing, but unfortunately the win9x design allows it), the rest of the win32 threads will experience the result as well (reason to many f*ckups you can see in protections written by not too well educated people... did i say c-dilla?).

2. the above also explains why changing the Sys VM protected mode IDT by one win32 thread will affect softice when you debug other win32 threads: they all rely on the same IDT (but other VMs are not affected).
Newbie
01-07-2001, 06:05 PM
The Owl (01-06-2001 18:53):
[quote]
1. i did not talk about THE IDT of the System VM per se as there is no such thing. the Sys VM (by the time win32 apps get to run) has 2 IDTs. the V86 mode IDT (which will be common to all VMs when they start their life in V86 mode) is created when the Sys VM was born, later when krnl386 switches the Sys VM into protected mode (as part of the windows startup) a protected mode IDT will be created as well. since all win32 threads run in the Sys VM in protected mode, an SIDT executed by them will show the protected mode IDT of the Sys VM, ie. they will all see the SAME IDT, hence when any one of them modifies it (not exactly a prudent thing, but unfortunately the win9x design allows it), the rest of the win32 threads will experience the result as well (reason to many f*ckups you can see in protections written by not too well educated people... did i say c-dilla?).

2. the above also explains why changing the Sys VM protected mode IDT by one win32 thread will affect softice when you debug other win32 threads: they all rely on the same IDT (but other VMs are not affected).

Thanks for the lesson. I understand things better now. Thanks for your time.

Newbie
Newbie
01-10-2001, 08:50 PM
ArthaXerXes (01-09-2001 20:22):

I am afraid it will not fit your needs though.

Thanks for the code. I did not know if you had given up on me :). However, I think there is so much for me to learn that I believe there is a need... if not now may be when I get smarter. I am just trying to learn some concepts and anything is useful when you are learning. Anyways... Thanks!

Newbie


Multiple Crunched files.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Multiple Crunched files.
PDA

View Full Version : Multiple Crunched files.

aimless
01-04-2001, 11:37 PM
Hello,

I was recently at unpacking site and I read the FAQ there. I have started exercises of unpacking the files, manually (using ProcD, SICE and some other such utils). I am facing with a number of problems, but am generally doing OK. However, I have a few doubts to which ALWAYS nag my mind, and I DO NOT FIND ANSWERS TO THEM ON ANY OF THE SITES:

1: It is (QUITE) obvious, when the file is packed. We can (USING any PE viewer, or by general chars) make out that the file is packed. However, HOW DO I MAKE OUT THAT THE FILE IS PACKED MORE THAN ONCE?

2: Packing garbles all the necessary data/code, etc. and then un-garbles them during runtime. However, how do I also make out if the file was ENCRYPTED and then PACKED?

Please note that I am not interested in knowing how to unpack multiple packed/encrypted files. I AM ONLY INTERESTED IN iDENTIFYING those files!!

Any pointers in that direction...?

Thx in advance.

As ever,


http://sac.yeah.net dead?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > http://sac.yeah.net dead?
PDA

View Full Version : http://sac.yeah.net dead?

source
01-05-2001, 07:36 AM
Is this site still alive? also the redirection ww1.realftp.com does not work.


New I6Comp released.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New I6Comp released.
PDA

View Full Version : New I6Comp released.

Morlac
01-05-2001, 08:42 PM
Hi All,

Just released the new version of the installshield comp util.
Its at protools.cjb.net
Hopefully no bugs but report them to me if you spot them.

Regards,
Morlac


Realbasic programs any experience here ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Realbasic programs any experience here ???
PDA

View Full Version : Realbasic programs any experience here ???

YuGung
01-06-2001, 04:04 AM
I'm working now on a target that i discover programmed with Realbasic for Mac/Win. The program seems to have enbedded the runtime dll that when run is saved in win/system dir as realbap1.dll. The difficult is that Ida and Wdasm don't disassemble correctly the code (some parts are simply vanished), Smartcheck is useless and debugging with Sice is long and diffucult as all the Vbasic programs.
There's no URL for this prog but maybe i can send you if you want to have a look at this.
Any help will be appreciate.
Thank u

YuGung


.msi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > .msi
PDA

View Full Version : .msi

vman_
01-06-2001, 11:51 PM
Does anyone have any experince with working with Microsoft Windows Installer files (.msi extension)? I couldn't find any sort of a SDK to learn from. Any information would be much appericated.

Thank you very much,
vman_
aimless
01-11-2001, 06:16 AM
The .msi files come with their OWN unpacker. What it means is, check out the M$ site and find out the MSI INSTALLER.

This is actually an extension to windows, that lets you decompile .msi files. Select FILEMON and REGMON while installing the INSTALLER itself, and it'll show you what files are inserted.

Try reversing THESE instead of the .msi files with protections.

Have fun,
aimless
01-11-2001, 06:18 AM
The .msi files come with their OWN unpacker. What it means is, check out the M$ site and find out the MSI INSTALLER.

This is actually an extension to windows, that lets you decompile .msi files. Select FILEMON and REGMON while installing the INSTALLER itself, and it'll show you what files are inserted.

Try reversing THESE instead of the .msi files with protections.

Have fun,


A sidequestion
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A sidequestion
PDA

View Full Version : A sidequestion

A+heist
01-07-2001, 11:20 AM
Dear +Tsehp happy new year, and happy new year to all other +friends that care or cared or will care.

I think I didn't post here since the board moved, but some of you will remember me and a couple of my old essays are on the mirror that +Tsep is updating.
I'm or better was an +HCU member.
And that's exactly the question I would like to rise in public: where's everybody?

+ORC disappeared?
+Greythorne retired?
+Alistair disappeared?
+fravia retired/changed approach?
+Quine disappeared?
+Aesculapius disappeared?
+Svd went elsewhere? Disappeared?
+RCD disappeared?

And not only HCu members:
Mammon doesn't care any more?
Stone went away?
The Owl went away?
Ghiribizzo went away?

Please understand that I'm not saying that the good younger crackers here are unworthy, I'm just wonering what actually really happened to the 'older ones'.
What's going on? Why? Is this a general trend that everybody here understands? I do not, and seek an explanation. Maybe I'm just stupid and you discussed this already.

A+
Muad'Dib
01-07-2001, 01:05 PM
Well, I've actually seen a few of them around. The Owl visits #cracking4newbies every once in a while, Greythorne used to visit it semi-frequently. Ghiri frequents #immortaldescendants and I've seen stone in #c4n once or twice...
carpathia
01-07-2001, 03:58 PM
Just about all these people are contactable via

http://mb.hcunix.org/

http://www.2113.ch/phplab/mbs.php3/mb001

or various hideouts on IRC.


I get a red scren when softice jumps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I get a red scren when softice jumps
PDA

View Full Version : I get a red scren when softice jumps

edge
01-07-2001, 06:47 PM
I'm trying to reverse a msdos based program and i'm trying to debug it with softice for dos.

I set a breackpoint, i start this program but when it arrives to this point the screen becomes completelly red and i can't see anything, the debuger works, but i see nothing. Is there any tool to make an snapshot of the state or output it to a file(or to the printer) so that i can see what's going on?
MO K`
01-08-2001, 02:36 AM
It is your video card that is not supported, or setup correctly.

But most likely is that SICE breaks in during high flicker and animation -are you cracking a dos game?- and when it takes control, it doesn't update the video memory, so you see the mish mash you see :P

Why don't you try winice? when the screen goes blank, you kill the dos box, and save the trace log to a file, you note where the break point occured and do it over, or take it to a disassembler and sniff right where is hurts ;)

I don't recommend using symdeb/debug in DOS, you will accidently trace an interrupt handler and hang the machine. If you are careful, try symdeb with p-rets, and not (t)races. Good luck!!
Igitt
01-09-2001, 02:14 AM
In my experience it is WAY better to reverse dos programs inside a REAL dos box (i.e. a 80386 or lower) with sice 2.6 (not 2.8) for dos.

You can most of the time find a good 80836 for free nowadays. Such a box is also very good for virus studies and reversing.

Amazing also how many good old and free dos games you can play there ;)

Igittigitt
aimless
01-09-2001, 04:00 AM
edge (01-07-2001 08:47):
I'm trying to reverse a msdos based program and i'm trying to debug it with softice for dos.

I set a breackpoint, i start this program but when it arrives to this point the screen becomes completelly red and i can't see anything, the debuger works, but i see nothing. Is there any tool to make an snapshot of the state or output it to a file(or to the printer) so that i can see what's going on?

Make sure that you set the force palatte option in .dat to ON. Check the manual for further instructions.


CORE keygened CloneCD v2.842!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CORE keygened CloneCD v2.842!
PDA

View Full Version : CORE keygened CloneCD v2.842!

Solomon
01-08-2001, 01:05 AM
check http://202.103.100.253/hambo/others3/cr-c2842.zip
AdamA
01-08-2001, 06:16 AM
Dimedrol/CORE wrote also a KeyGen for WinRAR 2.80B2, using Elliptic Curve Cryptography with 241 bits. Crypto Stuff becomes more and
more popular.
AdamA
01-08-2001, 06:17 AM
Dimedrol/CORE wrote also a KeyGen for WinRAR 2.80B2, using Elliptic Curve Cryptography with 241 bits. Crypto Stuff becomes more and
more popular.


another target...??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > another target...??
PDA

View Full Version : another target...??

SpekkeL!
01-08-2001, 05:13 AM
Yep a read all the good work of your Revirgin..
Dont know if it can handle this proggy....
It is protected By E-license (vtcpak24.dll, try buy etc) after pushing try it's unpacking..
http://www.soft-trade.com/?a=appdl&appid=234& (winoptimizer2000.exe)

Greetz ...SpeKKeL!.....
+SplAj
01-09-2001, 11:32 AM
Mmmmmmmm just DL it...

Load TRW 2.11
Load target exe
Set BPMB 499644 X
run encrypted exe
press TRY
TRW breaks at OEiP again...
voila, unencrypted exe !!!
Makepe new.exe
Runs fine, set date 2 years ahead, runs fine
DONE :)
5 mins.

so i tried it and it works thanks.

'patch+play'
SpeKKel!
01-09-2001, 12:03 PM
H'mmm Nice work, on what way did you find 499644.??

Thanks for reply..SpeKKeL!.......
SpeK
01-09-2001, 12:08 PM
Sorry,Sorry i was to fast Just the entry-point..

Greetz Spekkel!
SpeKKeL
01-09-2001, 02:24 PM
Ok i have done it in several way's (with trw, procdump etc) but the new.exe
keeps crashing on address 4997c6: call 44aa1c in this call i get:Access violation at address 0000001 read of address fffffffff ????
I did close all proggy's and closed all bp's while dumping so what could here be the problem ?
Btw: when i trace with trw/si all goes well...

Thanks.......SpeKKeL!..
+SplAj
01-10-2001, 06:13 AM
Hi SpeKKel.

Sorry for brief message but I was in one of those Cafe things using TRW from Floppy :)

Now I took the target home and retried with SI. Mmmm:( lock ups and crashing on NT4. So tried with TRW on my W98SE Notebook. It worked as long as i DONT 'LOAD' the target via TRW just load TRW, CTL-N set BPMB 499644 X. Then START the target,pop etc until after TRY button. TRW pops at unencrypted OEiP and so then MAKEPE Winopt_make..exe .
This new exe works on my Win98SE notebook OK.
Then transferred WEinopt_make.exe to my NT4 and got message 'no Cydoor' so fixed that flag at [49C90C] to 0 by changing code at 464EA3 - Mov byte ptr [49c90c],01 to 00.

It works fine now without e-licence manager :)

BUT could not DUMP and rebuild. Only 'make' with TRW worked . Strange. But this target is a cr*p piece of Sh*t
anyway so i just trashed the lot. Can't waste time with this.

You can have my 'make' exe if you want to study it further ?

+SplAj
'patch+play'
+SplAj
01-11-2001, 12:27 PM
Greetz SpeKKel...

Ive had a good learning experience today while beta bashing Revirgin. I tried my old friend Iris 101 from eEye.com (network scanner like CommView) Although I cracked it months ago I could never get a dumpster to work
It's packed with Pelock or whatever (AnAKIn) and then PCGuard32 applied.

I noticed on comparing my dumpster with the Revigined IAT that there was an extra link to the IRIS.exe that I asumed was the problem. So , how to get rid of it ? I used
PEeditor 1.7 (Greetz MoD & Yoda) and they have a 'right-click' selector in the Import Table section tht you can delete API links and it refixes your exe. I did it on my dumped iris.exe and....IT WORKED NOW.

So I applied the same to the Winopt dump as it had still Vkrypt.dll links in the IT whereas the MAKE version did not.So I deleted this API link and this new dump got the no cydoor message. I patched the byte referred to above and THIS Dumped exe WORKS !

Just sharing this revelation with you. Have fun

+SplAj
SpeKKeL
01-12-2001, 11:04 AM
Hajo great thanks for the info but,...i lost you on your way (imust studdy harder!)
i saw ,with pe-editor, in the section table viewer the section .vtc224 i think this is what i should delete(i did but after running it crashed) so what must i patch now or did i it wrong....

regards spekkel!
+SplAj
01-14-2001, 06:17 AM
Greetz SpeKKel

Sorry for confusing message. Here is the the reply. Freshly baked....

1) Launch Winoptimizer2000.exe
2) At the TRY/Rent/Buy screen start TRW2000
3) CTL-N set a BPMB 499644 x and F5
4) Presss TRY
5) TRW pops at unencrypted OEiP 499644
6) clear all BP's
7) PEDUMP new.exe
8) Close everything.
9) Start PEDITOR 1.7 (you have it ?)
10) Browse to new.exe and load
11) Press directory button
12) Press Imports button
13) See Vtcpack.dll as first dll (1st thunk 9D17C)
14) 'right-mouse-button' click on this line and choose
'delete ImageImportDescriptor', confirm and delete
15) Close peditor.
16) run new.exe :) - if 'No Cydoor' message. Edit raw
offset 64EA9 from 01 to 00

VOILA ! - it worked 3rd time just now ????

If this don't work for U then can't help any further other than this done is using Win98SE and TRW 1.22

+SplAj
SpeKKel
01-14-2001, 08:11 AM
HowdyHO + Splaj

All works fine by now.....

The only thing was that i could,t find the vtcpak24.dll
because in my dump (with trw2000) there wasn,t any....So i tried dumping with procdump (bpx getprocaddressss..and traced) and now I had also the vtc library copied,allthough i must delete it ??,But
yep it works !!!!!!

So verry thanks for this and maybe i clould use this info for other progg's as well

Ciao........SpeKKeL...........


FLEXLm 6.1 - question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXLm 6.1 - question
PDA

View Full Version : FLEXLm 6.1 - question

Czajnick
01-08-2001, 06:48 AM
My target is Synplify, which uses FLEXlm v6.1 linked staticaly.

After reading Dan's esssey I tried to find out the vendor codes /seeds his way, but in my target "vector call" never occures.
In _l_sg it always uses standard ^key5 method. It seems like my target call lc_init, not lc_new_job.

So I tried usuall ways to get the seeds, generated license file and... nope

My target contains vendor checkout proc, but bpx there never breaks - maybe some earlier test leads to -8 ?

My question is: does FLEXlm v.6.1 library obfuscates keys in any way if the client simply calls lc_init, not lc_new_job ?
Kythen
01-08-2001, 07:25 PM
I know exactly the problem you're having. I know this target is supposed to do something fishy, but I haven't found whatever it does either. Also, what version of the SDK are u using? I've run into the same problem with other targets that use v6.1g with behavior v5.1, so i'm wondering if it has something to do with the SDK version used. (I'm using v6.1f)
Nolan Blender
01-08-2001, 10:42 PM
Think this one needs a special vendor defined hostid - also there
was something that had to be in the vendor string IIRC.
I'll have to check the archives for this.

--nb.
Czajnick
01-09-2001, 05:41 AM
It's already solved, it actually was the problem with vendor-defined hostid :)))

I simply didn't know, that I need to include the vendor-defined hostid functions in my keygen !!!
I thought (how stupid i was), that it's needed only by client side. Nope !

I've included a function from examples modified to return label = 'SKEY' and type=1003. The actual value returned doesn't matter.

And voila ! My keygen works pretty !


SHDN 4.12 Neolite compresion !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SHDN 4.12 Neolite compresion !
PDA

View Full Version : SHDN 4.12 Neolite compresion !

DigitalBlade
01-08-2001, 09:19 AM
Hi!

I've a strange problem with Shut Down Now 4.12 packed with neolite, after decompressing it i can't use the exe coz is withouy IAT !!
i unpack the exe simply with a bpx getprocaddres then after some f8 i find a jmp eax that seems the correct jump to exe entrypoint. What is my error ??

P.s. sorry for my really poor english

Bye
SpeKKel!
01-08-2001, 05:23 PM
I did it this way:

-Unpack manually or with procdump.
-trace till 507ea8 and go in this call.
-Trace till 470564 ( jz 4705b3 ) and change the jz to a jump . ( some call's made here to kernel seterrormode)

After this it runs and you can disassemble.

Greetz.......SpeKKeL!..........


C-Dilla LM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > C-Dilla LM
PDA

View Full Version : C-Dilla LM

Cast
01-08-2001, 12:31 PM
Hello people,

Ive been working with this protection for a bit, and ive gotten my target to run when i apply some memory patches, however it would be nice to dump the decrypted cdilla protected executable, or patch in some sort of crack (IAT hooking i was thinking about on the date checks).. Has anyone worked on this? Is there a way to dump the executable somewhat easily or does it require some cracking inside the cdilla decryption drivers?

Anyone been looking at the Cdilla auth. code system? it seems not too advanced, maybe 100-120 lines of asm code. But i am not sure.

I'll be interested in any information i can get. Thanks
+SplAj
01-09-2001, 11:40 AM
I had Lotus Notes 5 30 day trial in 1999
and it's still running :)

Just keep tracing and you'll get to the decrypted
exe eventually. I'll try and find my reference notes and see what I did. Can't remember just now.
I don't think there are any tuts etc on this C-Dilla
LM system. Only game CD protection cdilla and R!sc has that one well covered.

+SplAj
Cast
01-11-2001, 05:54 PM
Would be nice if you could give some more info on how to spot the entry point of newly decrypted exe. And yes the Cdilla-LM (also known as SafeCast-LM should be looked more into :-).

Anyone else ?
templeofborg
01-13-2001, 08:24 AM
3dstudio max beta4 also now uses cdilla-lm,can anyone tell me if it writes any data to the mbr.
ive reformated,clean os install,and it still knows its been on before.

are you guys using sice with any anti detection?
does ti write tags anywhere else

any info ?
manny thnxs
Cast
01-13-2001, 08:38 PM
The trick is to kill it before it triggers the datecheck is over :)

- I tried too with fdisc /mbr and still it knows, donno how exactly though. But i beleave you can still reauthorize 3dsmax 4 beta even though its expired, i succeded to make a keygen for it, and it will still run if it has a valid cdilla keyfile, so i dont think it uses any encryption it must just be dumped before it expires. or in memory patched before the end check and dumped. problem is really fixing the crc, i struggled for a long time to do that, and i did not really succeed (the keyframe controls were still frozen etc)..

Good luck! (ps. check ereg.dll)
+SplAj
01-14-2001, 05:12 AM
Hi Cast

Good news and bad news.... Found the Lotus Notes 5 trial CD. 45 days not 30 day trial (generous Lotus).
C-Dilla LMS is version 3.18.000. I cracked (?) it in January 2000 with SI & ProcDump 1.6 (the last from G-Rom) .
Thats the good news. Bad news is I can't get it to work
to try again even after setting my clock back to early 2000, and re-installing. Could not figure out what it checks with RegMon/FileMon etc ... pretty embarrasing :(

The notes I have are that the REAL exe is the same name as the CD-LMS (Safecast) checking program ie NLNOTES.EXE = NLNOTES.CSX (the csx is the real un/encrypted exe) I got to it through BPX CreateProcess after the TRY button was clicked. ....I was in a cdillaXX.dll then cda01aa.dll . I think. Just kept tracing with F10/F8 and eventually got there. I must have just been lucky to land on the OEiP as I was a 'newbie' at unpacking a year ago.
............and still am as we all are :)

I'll carry on trying to figure out how it knows
that it's been on my HD before ...... This is really P me off.

+SplAj


Downloading from Sandman
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Downloading from Sandman
PDA

View Full Version : Downloading from Sandman

Marmora
01-08-2001, 12:33 PM
dear code reversers,
i am a beginner. i downloaded the tutorials and importantly the viewer, but i cant seem to open the viewer or open the tutorials on my mswindows 98. In the dialogue box, i type viewer and get an error message that the file is unknown, or incorrect path, when i think i have typed both in correctly. thats the first question.

the second is if i can get the viewer to work
i need to know how it works so that i can view the selected essays. sorry i am a clueless beginner but keen on computers and to know more.
Kugi
01-08-2001, 02:05 PM
Hi Marmora,

The files that you downloaded from Sandman are in zip format. Locate the file that you want to view, right click to activate WinZip and a dropdown window will appear. Select the folder that you want your unzipped files sent to and you will have your tuts in text format. Just double click the tut you want to view and win98 will find a viewer for it.

Keep on being keen on computers. They are fun.

Regards, Kugi
pusspuss
01-15-2001, 06:56 PM
I had trouble viewing the tutorials in the viewer as well.

To start looking at the tutorials in the viewer you click on the moving text near the top of the viewer. This will then bring you to the tutorial menu, where you can select the appropriate tutorial to view.

;)


psx, psx2, and dc gamz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > psx, psx2, and dc gamz
PDA

View Full Version : psx, psx2, and dc gamz

riceball
01-09-2001, 10:06 AM
Hey
does anyone know where there are any awesom FTP sites to get that have a shitz load of these gamez?????

please email me asap!
or post a reply!!!!!
?ferret
01-09-2001, 09:07 PM
...good luck.....they're figgin huge files that most people won't bother to download, meaning there's no market, no chance for $ from banners, no reason for warez sites to carry 'em...besides, if you can afford a mod chip, u can afford a cd burner

....btw.....This is the Reverse Software Engineering Help & Support Messageboard...

NOT the "Please find pirated games for my lame a$$" Messageboard


Win32 Asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Win32 Asm
PDA

View Full Version : Win32 Asm

OeDiFuZz
01-09-2001, 12:20 PM
I decided to try out programming in Win32 asm using TASM 5.0 a simple *Hello World* from Masta's tut in Win32 asm. I managed to covert it to its Win32 .OBJ file and link it to produce the executable. My problem is when i tried to execute the Hello.exe file no output was displayed. I followed the instructions in Masta's tut to the letter but i was not able to produce/displayed the output even though the file was compiled/linked with no errors. Can anyone point me the direction because i may have missed something.

Thanks alot,
OeDiFuZz
Muad'Dib
01-09-2001, 05:01 PM
Win32ASM is a lot easier if you use MASM32 by Hutch. It is available at http://masm32.cjb.net/ . It comes with loads of libraries, include files, and utilities that make Win32ASM much easier, especially for the beginner.
disavowed
01-10-2001, 02:29 AM
and i HIGHLY recommend using iczelions win32asm tutorials (http://win32asm.cjb.net) to learn win32asm. he writes very, very well, and explains every aspect of the code. he also goes along through the tuts at a perfect pace. starts of slowly with a nice hello-world, and continues to move through teaching you more and more
OeDiFuZz
01-10-2001, 01:20 PM
I've downloaded the file from http://masm32.cjb.net. Also i visit the Iczelion's site and downloaded his tuts. Thanks for pointing me to the right direction.

cya,
OeDiFuZz


Silicon Graphics Unix Flexlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Silicon Graphics Unix Flexlm
PDA

View Full Version : Silicon Graphics Unix Flexlm

unix
01-09-2001, 01:38 PM
Hi Guys
i tried looking around the net for any information about flexlm and SGI unix but unfortunatly every thing is windows related so if any body can help me either where to find info about the seed extraction and vendor key extraction or to tell me where to search.. puting in considaration that the SGI tools for hacking are very limted thank you all
MO`K
01-09-2001, 08:58 PM
IRIX binarries? you 13370 ;)

We have a page here http://hculinux.cjb.net, there are essays about flexlm, check it out.

Most -if not all- of the essays are about linux cracking, but the info given apply to most versions of unix.

Check your manpages about ptrace and /proc abusing, these areas are where posix gets blurry.

If you are totally new to this, post your questions in http://mb.hcunix.org and you will be answered. First checkout the links at the page. Mammon has some nice TuxTales, get the second one (IIRC) here http://www.eccentrica.com/mammon. Also dose had a nice little page but don't know where is it anymore.

Peace

MO K

P.S. which proggie is that? if there are linux/solaris/fbsd binarries for it, get me the url and i might jumb in the wagon ;)
Nolan Blender
01-10-2001, 07:49 AM
DBX can be used to crack applications on the SGI, but it's a lot
more work, as dbx is much less convenient that tools such as SoftICE.

I don't think DBX comes with the EOE though.
Nolan Blender
01-10-2001, 07:51 AM
unix (01-09-2001 03:38):
Hi Guys
i tried looking around the net for any information about flexlm and SGI unix but unfortunatly every thing is windows related so if any body can help me either where to find info about the seed extraction and vendor key extraction or to tell me where to search.. puting in considaration that the SGI tools for hacking are very limted thank you all

I suppose I should mention that the structure that holds the vendor
keys and encryption seeds can be fished out of v5 and earlier based
flexlm targets, so if it's one of those you can save yourself some work.
MO`K
01-10-2001, 09:13 AM
IRIX binarries? you 13370 ;)

We have a page here http://hculinux.cjb.net, there are essays about flexlm, check it out.

Most -if not all- of the essays are about linux cracking, but the info given apply to most versions of unix.

Check your manpages about ptrace and /proc abusing, these areas are where posix gets blurry.

If you are totally new to this, post your questions in http://mb.hcunix.org and you will be answered. First checkout the links at the page. Mammon has some nice TuxTales, get the second one (IIRC) here http://www.eccentrica.com/mammon. Also dose had a nice little page but don't know where is it anymore.

Peace

MO K

P.S. which proggie is that? if there are linux/solaris/fbsd binarries for it, get me the url and i might jumb in the wagon ;)
MO`K
01-10-2001, 09:14 AM
IRIX binarries? you 13370 ;)

We have a page here http://hculinux.cjb.net, there are essays about flexlm, check it out.

Most -if not all- of the essays are about linux cracking, but the info given apply to most versions of unix.

Check your manpages about ptrace and /proc abusing, these areas are where posix gets blurry.

If you are totally new to this, post your questions in http://mb.hcunix.org and you will be answered. First checkout the links at the page. Mammon has some nice TuxTales, get the second one (IIRC) here http://www.eccentrica.com/mammon. Also dose had a nice little page but don't know where is it anymore.

Peace

MO K

P.S. which proggie is that? if there are linux/solaris/fbsd binarries for it, get me the url and i might jumb in the wagon ;)
MO`K
01-10-2001, 09:15 AM
IRIX binarries? you 13370 ;)

We have a page here http://hculinux.cjb.net, there are essays about flexlm, check it out.

Most -if not all- of the essays are about linux cracking, but the info given apply to most versions of unix.

Check your manpages about ptrace and /proc abusing, these areas are where posix gets blurry.

If you are totally new to this, post your questions in http://mb.hcunix.org and you will be answered. First checkout the links at the page. Mammon has some nice TuxTales, get the second one (IIRC) here http://www.eccentrica.com/mammon. Also dose had a nice little page but don't know where is it anymore.

Peace

MO K

P.S. which proggie is that? if there are linux/solaris/fbsd binarries for it, get me the url and i might jumb in the wagon ;)
unix
01-10-2001, 09:17 AM
[quote]Nolan Blender (01-09-2001 21:51):
Hi Nolan
i read your essay about flexlm but i coudnt folow up since most of your assembly quotes are on PC .... if you have any other essay which is a little more clear i would realy areciate it.... an for dbx i have it nd also i have gdb and ddd ... the comand DIS which disasembles the binary but theres is no hex editor and my major problem is that the target program detects my flirting with the debuger and it doesnt start.... thank you
unix
01-10-2001, 09:25 AM
MO`K (01-09-2001 23:15):
IRIX binarries? you 13370 ;)

We have a page here http://hculinux.cjb.net, there are essays about flexlm, check it out.

Most -if not all- of the essays are about linux cracking, but the info given apply to most versions of unix.

Check your manpages about ptrace and /proc abusing, these areas are where posix gets blurry.

If you are totally new to this, post your questions in http://mb.hcunix.org and you will be answered. First checkout the links at the page. Mammon has some nice TuxTales, get the second one (IIRC) here http://www.eccentrica.com/mammon. Also dose had a nice little page but don't know where is it anymore.

Peace

MO K

P.S. which proggie is that? if there are linux/solaris/fbsd binarries for it, get me the url and i might jumb in the wagon ;)

hi MO K
th proggies are Alias Maya flint and some other compositing sw's .. i have a lot of work i guess .. i tried the first addres but its a bad link http://hculinux.cjb.net and the second link has nothing on flex and the third link in conection refused please advise...
MO`K
01-10-2001, 09:37 AM
First off, sorry about my four posts, i don't know what the heck went wrong ~:)

The link is working fine; or try the main page at hcunix.org.

There are essays about FlexLM, one of which is writen by -yes- Nolan Blender. Plus some others by Siul+Hacky
Go there and get them.

I will try to find your appie on the net, and give it a wack.

Peace MO K
Nolan Blender
01-10-2001, 12:22 PM
unix (01-09-2001 23:17):
[quote]Nolan Blender (01-09-2001 21:51):
Hi Nolan
i read your essay about flexlm but i coudnt folow up since most of your assembly quotes are on PC .... if you have any other essay which is a little more clear i would realy areciate it.... an for dbx i have it nd also i have gdb and ddd ... the comand DIS which disasembles the binary but theres is no hex editor and my major problem is that the target program detects my flirting with the debuger and it doesnt start.... thank you
You can disassemble IRIX binaries with the correct version
of IDA. Since the source code for the UNIX and NT versions
of FLEXlm are very similar, the actual operation of the programs
is the same. The Intel pentium processors are radically different
than the MIPS machines - I don't have any essays for the SGI,
but if you understand Intel and MIPS processors, figuring out what
is going on should be relatively straightforward.
If it has vendor defined encryption, or crypt filters, it will be
a considerable amout of work to figure out - it's possible to
do it, just more work.

What is the target that you're working on? Most targets use the
same seeds for the unix and NT variants, so it may be easier to
reverse engineer the target on the NT platform.

If you're trying only to get the seeds out of the target, one
thing that can help is to use syscall to trap calls to time - the
code in lm_new calls it a lot, and it might help you get to
the right spot in the code.
MO`K
01-10-2001, 09:51 PM
First off, sorry about my four posts, i don't know what the heck went wrong ~:)

The link is working fine; or try the main page at hcunix.org.

There are essays about FlexLM, one of which is writen by -yes- Nolan Blender. Plus some others by Siul+Hacky
Go there and get them.

I will try to find your appie on the net, and give it a wack.

Peace MO K
MO`K
01-11-2001, 02:20 PM
First off, sorry about my four posts, i don't know what the heck went wrong ~:)

The link is working fine; or try the main page at hcunix.org.

There are essays about FlexLM, one of which is writen by -yes- Nolan Blender. Plus some others by Siul+Hacky
Go there and get them.

I will try to find your appie on the net, and give it a wack.

Peace MO K
MO`K
01-12-2001, 05:16 AM
First off, sorry about my four posts, i don't know what the heck went wrong ~:)

The link is working fine; or try the main page at hcunix.org.

There are essays about FlexLM, one of which is writen by -yes- Nolan Blender. Plus some others by Siul+Hacky
Go there and get them.

I will try to find your appie on the net, and give it a wack.

Peace MO K
MO`K
01-12-2001, 03:49 PM
First off, sorry about my four posts, i don't know what the heck went wrong ~:)

The link is working fine; or try the main page at hcunix.org.

There are essays about FlexLM, one of which is writen by -yes- Nolan Blender. Plus some others by Siul+Hacky
Go there and get them.

I will try to find your appie on the net, and give it a wack.

Peace MO K


feslw30.dll crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > feslw30.dll crack
PDA

View Full Version : feslw30.dll crack

Mark
01-10-2001, 05:27 AM
Hi everybody :

I want to generator license for synopsys new version tools .
Its vendor name uses snpslmd. I have gotted Vendor Code.
But it uses vendor defind encryption routine. I can't find lc_set_attr
in fesle30.dll and get the corrct license key. Who can tell me
how to do now ?
Nolan Blender
01-10-2001, 07:54 AM
Check the essays on tsehp's site - you might find something
helpful there.
Mark
01-11-2001, 06:29 AM
I have find the lc_set_attr call in feslw30.dll and see the target

uses crypt filter. Alter see Nolan Blender 's eassy ( A Detailed

Look at Crypt Filters ) , I know what happen now.

Thank's Nolan Blender
Mark
01-11-2001, 06:29 AM
I have find the lc_set_attr call in feslw30.dll and see the target

uses crypt filter. Alter see Nolan Blender 's eassy ( A Detailed

Look at Crypt Filters ) , I know what happen now.

Thank's Nolan Blender


a thread handle problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > a thread handle problem
PDA

View Full Version : a thread handle problem

tsehp
01-10-2001, 07:15 AM
My problem : I have to inject some into a remote thread on win9x, to do that I need a thread handle, to freeze/restart the target thread where I inject my code, I can only retrieve thread id's with the createtoolhelp32 api, but don't know actually a method to retrieve the thread handle from thread id. The getcurrentThread api is useless, because working
already into the target's context, but I have to get this handle from my own process.
Does anybody how to solve this problem ? whatever the complexity, I'll take any solution.
TIA

+Tsehp
Iceman
01-10-2001, 09:19 AM
On NT you have NtOpenThread. On 95 , you can simulate this API trough varius means , a ready implemented one is to be found in Elicz ApiHokks source. Also check Icedump source code and thread related commands it conatins a lot of usefull info too.
disavowed
01-10-2001, 02:03 PM
http://www.insidetheweb.com/messageboard/mbs.cgi?acct=mb869669&MyNum=979155934
tsehp
01-10-2001, 03:05 PM
disavowed (01-10-2001 04:03):
http://www.insidetheweb.com/messageboard/mbs.cgi?acct=mb869669&MyNum=979155934
thanks disa :-)
but not on win98, this would have been too simple :
Windows NT/2000: Requires Windows 2000 or later.
Windows 95/98: Requires Windows Me.
Header: Declared in Winbase.h; include Windows.h.
Library: Use Kernel32.lib.
extracted from m$ docs.

Anyway if I can't emulate this fonction, I'll be forced to restrain to win me for revirgin :(
tsehp
01-10-2001, 03:08 PM
Iceman (01-09-2001 23:19):
On NT you have NtOpenThread. On 95 , you can simulate this API trough varius means , a ready implemented one is to be found in Elicz ApiHokks source. Also check Icedump source code and thread related commands it conatins a lot of usefull info too.

Thanks a lot iceman, I've checked the apihooks source and found nothing concerning emulating openthread on win95/98 but I'll check deeper.
+Tsehp


new Aspack/Asprotect keygened: RSA-1024 bit broken? Huh?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > new Aspack/Asprotect keygened: RSA-1024 bit broken? Huh?
PDA

View Full Version : new Aspack/Asprotect keygened: RSA-1024 bit broken? Huh?

CrYpTo
01-11-2001, 01:58 AM
How are they reversed?

Is there a fault in the RSA implementation?
Is the RSA-1024 bit key weak?

In general:
What is the Achilles heel of the protection?

Bye,
CrYpTo
AdamA
01-11-2001, 03:26 AM
Maybe they restored the private key by using
some valid serials. But Damn do not provide
any information about this, damn is a cracker
group no reversing group. Anyway, Alex uploaded a modified version of Aspack/AsProtect some days after the keygen was released, so the keygen dont work anymore.
CrackZ
01-11-2001, 02:39 PM
Hiya,

Alexey evidently now knows how the break was achieved since he healed the hole pretty quickly, take note too that he also has a LOT of 'scene' friends, thus what was supposed to be a closely kept secret leaked all around IRC probably in a matter of minutes, or at least it certainly seemed that way.

With this in mind, some general information on the break (someone else can post more if they feel its appropriate), the weakness was due to the random number generator inside ASProtect & ASPack (which uses the current time and process ID), with some thought the range of both of these 32-bit values can be narrowed considerably. To actually produce a key generator a cracker also requires a valid license file.

I won't post any more details than this since it is not my place to do so and I'm only repeating what most on IRC already knew anyway.

Regards

CrackZ.


:)
PDA

View Full Version : :)

GM
01-11-2001, 04:12 AM
Very Nice work +Tsehp.
I finally tried it on a few different apps.

keep up the good work.

GM

P.S. Can I get the src :) J/K
Glad the 98se thing was resolved.
tsehp
01-12-2001, 01:49 PM
thanks, see the beta topic


Need help with HASP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need help with HASP
PDA

View Full Version : Need help with HASP

meRlin
01-11-2001, 03:47 PM
Hello!
Recently I read Frog Print's fantastic essay about Dongle bashing.
I had have success with a couple of sentinel protected ones and now I'm working on a hasp protection.
Target is Icarus v2.42 3429307 bytes big (swedish software, they do have an english page too)www.keylogic.se/old/download/icarus/icarus242.exe
It will run in demo mode if no dongle is detected and you have to restart the "server services" after 3 hours time.

The dongle check is done 19 times starting with this one at:
00030941 mov eax, 5
00030946 call sub_1FEA8 <-main routine

inside that call you have another call and a check ->HASPUT16.DLL .
I do not uderstand what's going on in all 19 locations, an example that I do understand:

000309E3 mov edx, 665h
000309E8 mov eax, 2 <--hasp service 2
000309ED call sub_1FEA8 <-main
000309F2 test bl, bl <-test
000309F4 jz short loc_30A1A <-beggar off
000309F6 cmp [ebp+var_8], 0A0F1h <-retcode 1
000309FD jnz short loc_30A1A
000309FF cmp [ebp+var_C], 0D0ECh <- retcode 2
00030A06 jnz short loc_30A1A
00030A08 cmp [ebp+var_10], 63C6h <-retcode 3
00030A0F jnz short loc_30A1A
00030A11 cmp [ebp+var_4], 5D1Bh <- retcode 4
00030A18 jz short loc_30A1E <- good guy
00030A1A xor eax, eax <-beggar off
00030A1C jmp short loc_30A20
00030A1E mov al, 1
00030A20 mov ebx, eax

there is some similar checks that's pretty easy to understand but I need help to grep the other ones.

regards
merlin
Cast
01-11-2001, 06:00 PM
Goto the main hasp call, look at the addresses that calls it, and then go pack and take not the value pushed before the call, this will be the service number, 1 = IsHasp, must return 1 in eax. 2 = Haspcode,
like this:

push 0000XXX2 <- Pas2
push 0000XXX1 <- Pas1
mov edx, 00001234 <- Seedcode
push 00000002 <- service #
Call _Hasp

Then u got all u need to generate the returncodes useing the UCL haspcode generator. For other services, why not try to consult the manual? Its easy to figure out what is needed to be returned at given services. And 3rd option would be visiting zencrack2.cjb.net as it has some good tuturials explaining the hasp services. Good luck there
meRlin
01-14-2001, 03:56 PM
Hi Cast!
Sorry for my late reply.
I downloaded manuals.zip from hasp authors page, they give away some great information about their own protection :)
I think my target is doomed to die tonight, I had some problems at first finding IsHasp but a nice BPX CreateFileA did the job for me :)
I think the solution I have is not the best, but I'm happy with it because it's my first hasp dongle.

regards
meRlin
CrackZ
01-15-2001, 08:12 PM
Hiya,

I took a brief look at your target (about 5 minutes), and managed to get it working, so I'll bore you with some code snippets / meaningless information ;-).

CODE:0001FECB cmp bh, 32h
CODE:0001FECE jb short loc_1FED5
CODE:0001FED0 mov esi, [ebp+arg_0]
CODE:0001FED3 mov eax, [esi]
CODE:0001FED5
CODE:0001FED5 loc_1FED5: ; CODE XREF: sub_1FEA8+26j
CODE:0001FED5 mov esi, [ebp+arg_8]
CODE:0001FED8 mov esi, [esi]
CODE:0001FEDA push ebp
CODE:0001FEDB call sub_21DB0 <-- haspreg().
CODE:0001FEE0 pop ebp

Thats your haspreg() call. Eyes glimmer (emulator here maybe ;-) ).

Icarus calls service 5 first, I suggest you patch this as a MemoHASP-1, return, EAX=1, EBX=1, ECX=60. The next time haspreg() is called the passwords will be different (0x5185 & 0x4903).

Service 0x32 (50) is used to read a block of memory from the HASP (return buffer is -> EAX), all 38 words are read. At 40FAE5 a loop sums all the individual bytes of word 0 through word 1Ah inclusive (a table algorithm is used during this process), at the end this check word is compared too word 1Bh (from the dongle), match good guy.

Next up similar summing of words 1Ch through 1Eh, check word compared to word 1Fh. Final checks are trickier, word 6, word 7, word 9 are read individually with ReadWord (service 3), word 6 ^ 12h will find its way as a seed code parameter for HaspCode(), return code 1 of which must pass some AND checks. Word 9 also has AND checks.

Once your satisfied with what is an acceptable return code 1 from (word 6 ^ 12 as seed to HaspCode() call) then you can bruteforce correct word 6.

Anyhow, if you want any further help with this, e-mail me. Server32.exe is the only file with protection too ;-).

Regards

CrackZ.


java reversing tutorial for beginners
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > java reversing tutorial for beginners
PDA

View Full Version : java reversing tutorial for beginners

the analyst / UCF
01-12-2001, 04:43 AM
hello

i did a tut on reversing *.class files ages ago..
you can check it out at :

http://acidburn2k.cjb.net/java.txt

i hope it will help
cu

acid burn,

the analyst / ucf
the analyst / UCF
01-12-2001, 04:48 AM
looks like i'm even too tired to reply correctly to messages here..
again, excuse me ..
Solomon
01-12-2001, 05:47 AM
Thx.
How about Java *.EXE ? J++ Extract can only deal with M$ Visual J++ EXEs, but there are various Java compilers.
A good decompiler is enough for *.CLASS, coz we can take full control if we have the source.


ASPROTECT v1.1+
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ASPROTECT v1.1+
PDA

View Full Version : ASPROTECT v1.1+

Silent
01-12-2001, 06:32 AM
Hello,

Is there any release of ASPR (between v1.1 and v1.1c) available to download?

Regards,
AdamA
01-12-2001, 07:56 AM
Hi,

Try this:
ftp://ftp.nsysu.edu.tw/PC/SAC/security/asprot11.zip

Bye,
AdamA
tsehp
01-12-2001, 01:48 PM
or you can ask alexey itself, he visits this place very often ;)


DEBUG using Softice: Softice look for abort.c atoi.c etc... (Win32 console program)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DEBUG using Softice: Softice look for abort.c atoi.c etc... (Win32 console program)
PDA

View Full Version : DEBUG using Softice: Softice look for abort.c atoi.c etc... (Win32 console program)

lsteo2
01-12-2001, 08:32 AM
Hi:

I tried to debug Win32 Console program of mine using Softice 4.05 under NT 4SP6 with MS Visual C++ Install.

Where can I get those source?

Thanks a lot.

Regards,
lstE
DinDon
01-15-2001, 02:23 AM
You have to install also the CRT sources (C runtime), included in the VC6 CD: they are not copied to your hard disk in a standard installation.


Advanced RSA, ECC and crypto keygenning...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Advanced RSA, ECC and crypto keygenning...
PDA

View Full Version : Advanced RSA, ECC and crypto keygenning...

x30n-
01-12-2001, 05:29 PM
Why arn't there any tutorials for this stuff? Now days it seems like CORE, DAMN, and TMG are the only guys that know how to crack this stuff. Why don't they put out tutorials?? They chose not to share their knowledge?

Does anyone have any links on this kind of stuff? For new programs? I would love to learn about crypto keygenning... but I cannot find a place to start!!

Thanks guys.
x30n-
Sab
01-12-2001, 07:25 PM
think tE runs a crypto site with source etc.. also topic in #tmg's channel topic was 'Need ECC info/sources ? -> http://www.manning.com/Rosing/'

hrm.. thats about all i know off the top of my head theres more im sure...
Sab
01-12-2001, 07:33 PM
http://egoiste.cjb.net/ forgot the link heh..
Spath.
01-12-2001, 08:24 PM
Ok, you have to realize a few things :

1) These people are no crypto geniouses :
they did not invent new methods to break
the algorithms, they either use the methods
that are public, or sometimes they find
attacks against specific implementations of
these algorithms. Some of these latter attacks
are smart and elegant, but they don't question
the strengh of the algorithms themselves.

2) If you're interested in the algorithms, the
cryptanalysis methods are public and
described in the crypto litterature, and most
of them can be found for free on the internet.
Understanding some of these cryptanalysis
methods require very advanced math
background, but anybody can use the
implementations of these methods. For
instance, when many crackers explain they
'broke RSA', it actually means that they just
ran a QS program they understand nothing
about for a few dozen hours.

3) If you are looking for implementations
attacks, there are plenty of different ones ;
therefore, I would suggest you to first
understand how the existing ones are done
by studying the keygens and also going on
IRC to discuss with these guys (or others,
new keygen tricks are known quite fast on
IRC). As I said, there are plenty of different
ones, and talent and imagination will be
required to find new ones.

4) Why they don't make tutorials ? As a
non-technical and heavily subjective question,
I think only these people can answer properly
to it.

Spath.
agoutinz
01-17-2001, 11:44 PM
idaw.exe c:\keygen.exe
and get the private private key X Or P and Q
they are always in clair !
but diassamble first the target to get the
modulus N for rsa or p g y
/screendump c:\keyz
for example thematic chroma
x=6A60524225B9
get the egoiste source code
miracl lib and play avec ces pirates.
Kythen
01-18-2001, 01:14 PM
For some good info on ECC (Elliptic Curve Crypto) check out the tutorial and other info at http://www.certicom.com/research.html

Also, do check out the link to the Manning book above. It's a great resource for ECC info.

I can maybe find a spot an post a short paper I did for my number theory class on ECC as well if enough ppl want it.

HTH

Kythen
mike
01-19-2001, 11:49 AM
Public key keygen is going to work one of two ways, both of which have their weaknesses.

One way is to have encrypted code. You have to type in the key to decrypt it, which is impossible if you don't know the key. There might be a way to brute force it if they chose *really* small parameters, but usually they don't. However, once the code is decrypted, it can, of course, be dumped to disk, at which point you can make a version w/out encryption.

Another way is to use it as a hash function: decrypt the key using RSA and see if it matches a built-in string. This one is easy: generate your own keypair and replace the key in the app. Encrypt the string it's comparing against under your other key.

All crypto can do for you in an app is prevent someone from brute-forcing a valid key. It's not a magic wand or a silver bullet. If you want functionality that no one can reverse-engineer, it has to run on a processor over which the cracker has no control.


Encryption Lite
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Encryption Lite
PDA

View Full Version : Encryption Lite

hafer
01-13-2001, 01:53 AM
I decided to make a legitimate regkey for APISpy32 V2.4 (same regkey also works for V2.5) rather than unpack it, then patch it. That always seems so messy and I would rather not do that if I can avoid it. I was able to create a regkey for my regname halifax. However, I had to do it using brute force. It took about 20 minutes to test/record all 255 byte combinations (01 to FF) results for the encryption method used. Then you have to XOR the bytes that are needed for your name with 50+i (where i is the name char position). What I could use some help with is if somebody knows how to do the math so that brute force isn't needed. Below is an example of the encryption technique:

START WITH BYTE 1A TO ENCRYPT (OR DECRYPT DEPENDING ON HOW YOU LOOK AT IT)

1 1 x 1A= 1A (IF <=8899h CONTINUE)
2 1A x 1A= 2A4 (IF <=8899h CONTINUE)
3 2A4 x 1A= 44A8 (IF <=8899h CONTINUE)
4 44A8 x 1A= 6F910 (IF >8899h DIVIDE 6F910/8899= D REMAINDER 94B)
5 94B x 1A= F19E (IF >8899h DIVIDE F19E/8899= 1 REMAINDER 6905)
6 6905 x 1A= AAA82 (IF >8899h DIVIDE AAA82/8899=13 REMAINDER 8727)
7 8727 x 1A= DB9F6 (IF >8899h DIVIDE DB9F6/8899=19 REMAINDER 6305)

DIVIDE THE REMAINDER OF THE SEVEN ITERATIONS BY BB
6305/BB = 87 REMAINDER 68h (h)

h - first letter of my regname

Now if I want the remainder to be 61h (a-second letter of regname), how would I mathematically find what byte to start with? Turns out to be 3A, but how can that be determined mathmatically? Any math whizes out there or someone that can point me in the right direction?

(Sorry about the format of the example.)
Spath.
01-13-2001, 06:59 PM
Well, if I understood this algorithm correctly, it's a
very silly byte stream cipher, and your method to break
it is just fine. The complete algorithm is just useless,
since one can indeed build a lookup table that will be
used for any encryption/decryption ; therefore, this
cannot be called brute-force since you do it only once
and then you can reuse it to generate any key. To my
knowledge there's no analytical solution to this algorithm.

Regards,

Spath.
hafer
01-14-2001, 06:11 PM
Thanks for taking the time to look at the algorithm. I spent a few hours trying to reverse it mathmatically, after I had built the table, and didn't really get anywhere. Looked up stuff for modulo math, etc. Guess I will move on to something else.


Thread and DEBUG context
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Thread and DEBUG context
PDA

View Full Version : Thread and DEBUG context

SV
01-13-2001, 12:39 PM
Hi

I would like to start a thread in a debug context.
With process, it's like :
invoke CreateProcess, addr buffer, NULL, NULL, NULL, FALSE,
DEBUG_PROCESS+ DEBUG_ONLY_THIS_PROCESS, NULL, NULL, addr startinfo, addr pi
but CreateThread doesn't have this flag possibility.
How can i do ? (SetThreadContext ?)
tsehp
01-13-2001, 01:49 PM
SV (01-13-2001 02:39):
Hi

I would like to start a thread in a debug context.
With process, it's like :
invoke CreateProcess, addr buffer, NULL, NULL, NULL, FALSE,
DEBUG_PROCESS+ DEBUG_ONLY_THIS_PROCESS, NULL, NULL, addr startinfo, addr pi
but CreateThread doesn't have this flag possibility.
How can i do ? (SetThreadContext ?)
on what system ? nt or 9x ?
to have what ? debug events ? what kind of events to you want to be notified of ?
to tell you, revirgin contains a tracer and forces any thread to work
on single step mode, so you can examine anything you want.
Will give more details on your email if you want.
regards,

+Tsehp
SV
01-14-2001, 05:02 AM
I have send mail to you :)


tutorial by sandman. winzip self extractor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > tutorial by sandman. winzip self extractor
PDA

View Full Version : tutorial by sandman. winzip self extractor

allan
01-13-2001, 04:46 PM
I have read your tutorial about Winzip Self Extractor v2.1
And I can’t wiev the real serial No in the end of the tutorial.
When i come to the last line by pressing F10-key it said for me.
00408C(17) 6810C64200 push 0042C610 you have
00108C(77) 6810C64200 push 0042C610
that is not exactly same as you got if it matters i don’t know.
data window change, when I type d eax at that line in softice, but in my point of wiev it was not what i expected
to find. (a serial.)in vide format.what did I see, encrypt form of the serial. Or something else what?
What can I do to make softice show me the right serial. If softice display it in some code,
How can i decode it.
I have using softice v3,23 and have windows 95osr2 in my computer


Everkey Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Everkey Protection
PDA

View Full Version : Everkey Protection

Willy3
01-13-2001, 07:18 PM
I have searched the net and can not find any cracking info on Everkey dongles. Does anyone know if any are available? I am trying to crack a $2500 embroidery software program. Any help is appreciated.
Cast
01-13-2001, 08:40 PM
Where can we get this program from ? Is it avail of the developers site? - Does it use an encryption wrapper like HASP or sentinel Shell?

please let us know so we can help.


Is there any reference or essay for hasp dongles under DOS?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is there any reference or essay for hasp dongles under DOS?
PDA

View Full Version : Is there any reference or essay for hasp dongles under DOS?

edge
01-13-2001, 09:13 PM
is there any reference for hasp dongles under DOS? all the references i have found r for windows libraries...


FLEXlm for NT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXlm for NT
PDA

View Full Version : FLEXlm for NT

lvcita
01-14-2001, 03:41 AM
I need some help about generating licenses for FLEXlm (the target runs on NT only).
I was able to get all the keys (5) and the seeds (2), i have the vendor and the feature names, but when i make the licenses with the SDK v7.0d (the target uses FLEXlm v7.0a), the licenses dont works. I've used Genlic32.exe to generate the licenses.
Cast
01-14-2001, 04:18 AM
Flexlm 7 does not use the standard v6 keyhideing, so if you get the keyblock the seeds will not be correct. You must read the essay by dan and one of nolans to figure out the new system. This way you get the seeds only, you can use nolans flexlm vendorkey generators to get them. Good luck
lvcita
01-15-2001, 01:38 AM
Where is the dan essay?.
Maybe these target dont uses Crypt Filters, or all v 7.0 uses crypt filters?


tutorial on making serial numbers for programs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > tutorial on making serial numbers for programs
PDA

View Full Version : tutorial on making serial numbers for programs

video567
01-14-2001, 11:47 AM
hi all im looking for the best tutorial out there to make key generators for a program. can anyone direct me to the right place?
JimmyClif
01-14-2001, 12:50 PM
I don't think there is a *best* keygen tutorial on the web, but a nice tut collection for keygens can be found at :

http://snakepage.cjb.net/
video567
01-14-2001, 01:02 PM
wow fast reply thanks so much im looking at it now
disavowed
01-14-2001, 01:16 PM
hey jimmy.. ltns


microsoft's new anti-piracy scheme for whistler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > microsoft's new anti-piracy scheme for whistler
PDA

View Full Version : microsoft's new anti-piracy scheme for whistler

disavowed
01-14-2001, 09:22 PM
http://www.zdnet.com/zdnn/stories/news/0,4586,2674261,00.html

sounds like nothing new. just needs a keygen now instead of a serial
Predator [PC/pGC]
01-15-2001, 01:42 AM
Heh, well.. the "latest" kind of serial (5x XXXXX- as it is with win98/2k/me/office2k and so on) has never been keygenned while I heard (never even looked at it myself) it is impossible. So that might be a small problemo ;P
But when I hear that m$ is implementing protection in whistler I can only LOL.
Predator [PC/pGC]
01-16-2001, 03:47 PM
Heh, well with 'problem' I referred to making a keygen. A patch of somekind would be the other option, probably the only one.

It's true that not all whistler releases will have this protection; I'm not sure what why they are implementing it for that reason..
The release without protection will be all over the web, copied like all other m$ stuff..

Only thing this protection stops are the ppl who never heard of cracks and therefor can't copy their store version of whistler ;)
tsehp
01-18-2001, 07:52 AM
watch out here, don't give m$ all the tricks to defeat the whistler scheme ! or they will stop selling the cd and will oblidge us to buy the
preinstalled version on the computer, with an auto rebuild of windows in case of system failure with windows update; asking you to pay a fee of $100 for this ...
Predator [PC/pGC]
01-20-2001, 07:29 AM
hehe, oh well.. if they do the iso image is all over the net before it ships ..

don't worry ;P
disavowed
01-21-2001, 12:13 AM
if you've been following this thread at all, you'll definitely want to check out http://www.theregister.co.uk/content/4/16223.html


What's THUNKING guys?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What's THUNKING guys?
PDA

View Full Version : What's THUNKING guys?

aimless
01-15-2001, 01:58 AM
Sorry,

Pretty lame question, if big 'uns think so, but:

wtf are THUNKS? I keep reading them specially in any IAT rebuilder tuts. I also keep seeing them in some dumpers. And they don't explain that in any tuts or dump help files.

Checked my MSDN docs and found...ummmwell really nothing. A simple concise explanation, anyone?

As ever,
DinDon
01-15-2001, 02:40 AM
Thunking, in M$ literature, is the way to intermix 16-bit code with 32-bit code. The major focus is on calling 32-bit DLL functions from old-type 16-bit programs.

Checked my MSDN docs and found...ummmwell really nothing.

Really? Please try this...

http://search.microsoft.com/us/dev/default.asp?so=RECCNT&qu=thunking&boolean=ALL&chkM=on&chkM_0=on&chkM_1=on&chkM_2=on&chkM_3=on&chkM_4=on&chkM_5=on&chkM_6=on&chkM_7=on&chkM_8=on&chkM_9=on&chkM_10=on&chkM_11=on&chkM_12=on&chkM_13=on&chkM_14=on&chkM_15=on&chkM_16=on&chkM_17=on&chkM_18=on&chkM_19=on&chkS=on&chkS_0=on&chkS_1=on&chkS_2=on&chkS_3=on&chkS_4=on&chkS_5=on&chkS_6=on&chkS_7=on&chkS_8=on&chkS_9=on&chkS_10=on&chkS_11=on&chkS_12=on&chkS_13=on&chkS_14=on&chkS_15=on&chkA_0=on&chkA_1=on&chkA_2=on&chkA_3=on&chkA_4=on&chkA_5=on&chkA_6=on&chkP_0=on&chkP_1=on&chkP_2=on&chkP_3=on&chkP_4=on&chkP_5=on&chkP_6=on&chkP_7=on&chkP_8=on&chkP_9=on&chkP_10=on&chkP_11=on&chkP_12=on&chkP_13=on&chkP_14=on&chkP_15=on&chkP_16=on&chkK=on&p=1&nq=NEW

Regards.


(urgent)Windows ME systemfile protection ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > (urgent)Windows ME systemfile protection ?
PDA

View Full Version : (urgent)Windows ME systemfile protection ?

HeLL-PhReaK
01-15-2001, 04:44 PM
Hi there!
I'm writing a little program that needs to replace the Explorer.exe file with my own version of explorer.exe
This has always worked fine under Windows98; but WindowsME seems to have a built-in function that 'protects' all systemfiles, and when you restart, the original explorer.exe is restored.
Does anyone know how to bypass this protection, or know what criteria ME uses to identify the systemfile as being 'modified' (like size, date, ...)
It's really important that explorer.exe is replaced with my own version, so using the registry or win.ini to load the app is impossible !
Any help would be very appreciated!
90h
01-15-2001, 06:13 PM
You can get a program to load my editing "C:\WINDOWS\System.ini" SHELL=Explorer.exe to what ever you like and Explorer.exe will not load.

PS.
I have only done this on win95,win98 and win98se.
HeLLPhReaK
01-16-2001, 11:04 AM
Yes, I'm aware of this, but I really need to *replace*
the original explorer.exe with my own explorer.exe, which will in place (after entering the correct password) run the original explorer. For the original explorer to start as a shell, the system.ini setting called shell= has to be explorer.exe!
Also, because it's a kind of security program, it is important that no entries are written to the registry or any windows files are modified (because users will notice) and it has to load before explorer.exe.
But thanks anyway for the suggestion :)
4oh4
01-16-2001, 07:45 PM
Have you tried replacing the file via a batch file. I gather from your second post ("because users will notice") that you are writing this app for others to use. If that is the case you'll have to do all of this programatically.

Either put the copy command as the first entry in your autoexec.bat, or put it in a separate bat and call it from the first entry in your autoexec.bat. There's a parameter to keep dos from prompting the user if he/she wishes to overwrite an existing file as well.

Hope this helps,
4oh4
sludge
01-17-2001, 11:12 PM
If I am not mistaken, WindowsME repairs your system files... This is one of its few 'features'. I suspect that in order to get your program working, you will have to reinstall windows and make sure to disable this autorepair feature.
tsehp
01-18-2001, 07:55 AM
I didn't checked this but there must be a kind of dllcache dir into /windows, with a copy of explorer that could be replaced just in case, on win2000 you have to change the both files so the crc checks between the normal and cache dirs are ok.
miscreant
01-25-2001, 12:47 PM
There is a hidden directory called dllcache which holds the backups (at least in windows 2000, i assume it is the same). Rename this folder, ovewrite the original and the one in the dllcache and then rename it back.


Flexlm Crypt Filter ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm Crypt Filter ??
PDA

View Full Version : Flexlm Crypt Filter ??

Mark
01-15-2001, 07:56 PM
Hi every body!
I have a target uses crypt filter. I have knew its
Crypt filter function from daemon program. After see
Nolan Blender's essay , I also do't know how to used
Crypt Filter function's information to make the crypt
filter gen function for license generator program.
Who can tell me how reverse crypt filter gen from
crypt filter function ?

Thank's!


PM Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > PM Question
PDA

View Full Version : PM Question

Newbie
01-15-2001, 08:12 PM
Is it possible to have ring 0 code call ring 3 code?!? What about having ring 0 code call ring 3 code conditionally... can it be done? In other words is it possbile to create some kind of callback functionality in ring 3 that ring 0 code can call?!? If this is possible can someone show me an example??

Thanks,
Newbie
Solomon
01-16-2001, 01:21 AM
Here is some source code written in Delphi(Chinese characters):
http://www.driverdevelop.com/read.php?t=A&id=21
Newbie
01-16-2001, 09:04 PM
Solomon (01-15-2001 15:21):
Here is some source code written in Delphi(Chinese characters):
http://www.driverdevelop.com/read.php?t=A&id=21

Thanks for the tip. Do you know if there is any engine that will translate the web page to english?!? I can kinda make sense out of it, but I would like to learn the concept. It looks like GetProcAddress has something to do with it.
Well, thanks for the help. :)

Newbie
Spath.
01-17-2001, 02:52 AM
> Is it possible to have ring 0 code call ring 3
> code?!?

Yes, however this require some setup to go to
ring3 and come back to ring0. Therefore,
before you start messing with such tricks,
make sure that your OS does not provide
what you want (with for instance _SHELL_CallAtAppyTime). In case you want
the raw protected mode theory, you will first
need a good understanding of pmode and
ring transitions, or the explanations will not
make much sense to you.

> What about having ring 0 code call ring 3
> code conditionally...

conditionally like what ? You can go to ring3
and come back to ring0, so if your 'condition'
can be detected in ring0, then yes.

Regards,
Spath.
Solomon
01-17-2001, 06:58 AM
Here is the part of translation(not exact translation and without the permission of the original author, sorry):

The Virtual Shell Device of Win95/98 provides services for VxDs to call Win16 applications directly, while it doesn't provides services for VxDs to directly?@call Win32 applications. But Win95/98 still provides 2 ways for VxDs to call Win32 applications.

One is using the APC(Asynchronous Procedure Call) function of VWIN32.VxD. First the Win32 application dynamically loads the VxD, and passes the address of its callback procedure to VxD with DeviceIoControl( ), then it calls SleepEx/WaitForMultipleObjectsEx/WaitForSingleObjectEx to suspend itself. Thus the VxD can call the Win32 callback procedure with _VWIN32_QueueUserApc of VWIN32.VxD. There is a sample program named IFSMONITOR using this method which can be found in the companion CD of "Windows 95 System Programming 4" .

The other way is more flexible. It employs the multi-threading feature of Win32 and the event mechanism of inter-thread communication. The Win32 application creates 2 threads and defines an event. The main thread is responsible for dynamically loading/unloading the VxD and communicating with it using DeviceIoControl( ), while the secondary thread calls ResetEvent( ) and WaitForSingleObject/WaitForSingleObjectEx to suspend itself. The VxD calls _VWIN32_SetWin32Event of VWIN32.VxD to wake up the secondary thread, thus you get an indirect implementation of calling Win32 procedure from VxD. This method is very flexible because VWIN32.VxD provides lots of Win32 event services just corresponding to the Win32 event API. By defining 2 events you can even completely synchronize the VxD and Win32 application when calling the Win32 application from VxD.

I wrote a Win32 prog in Delphi 5 and a VxD in VToolsD v2.03 to illustrate the 2nd way. The VxD hooks the clock interrupt, just like the CHIME sample of VToolsD v2.03.

............. // source code omitted here

The Win32 prog calls the OpenVxDHandle( ) API of KERNEL32.DLL to convert the Win32 event handle to VxD event handle. The OpenVxDHandle( ) API is only documented in DDK. The VxD will wake up the secondary thread every 2000 clock interrupts. With little modification we can get a high precision timer.
Spath.
01-17-2001, 09:14 AM
> But Win95/98 still provides 2 ways for VxDs
> to call Win32 applications.
> ...

Unfortunately these two methods are not
doing that, because they both require part of
ring3 code to be executed before the vxd can
call it (and therefore you cannot use them from
static vxds or raw ring0). This is not calling
ring3 code or win32 applications from ring0,
this is a thread synchronization exercice.

Spath.
Solomon
01-17-2001, 09:29 PM
Spath. (01-16-2001 23:14):
Unfortunately these two methods are not
doing that, because they both require part of
ring3 code to be executed before the vxd can
call it (and therefore you cannot use them from
static vxds or raw ring0). This is not calling
ring3 code or win32 applications from ring0,
this is a thread synchronization exercice.

Spath.

OK, I will forward your opinion to the original author. Thx
Newbie
01-17-2001, 11:18 PM
WOW! Well I think I asked a question more complicated then I thought. I will need to study more about PM. I hope then when I do learn more, I can ask you people more directed questions. Thanks for your notes :)
I think I overdid myself with this question.

Newbie


2 Black Check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > 2 Black Check
PDA

View Full Version : 2 Black Check

SPYdERR
01-16-2001, 03:57 AM
Hey Black Check.
Your mailbox black_check@yahoo.de disappeared :/
Please write me, I have some questions on cdbrute.exe.
SPYdERR.

P.S.
Sorry for offtopic :/
blackcheck
01-16-2001, 05:34 PM
blackcheck@diplomats.com


MSloopback LAN ID
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MSloopback LAN ID
PDA

View Full Version : MSloopback LAN ID

+SplAj
01-16-2001, 05:06 AM
I have a nice target to play with: a well known German car manufaturers FULL workshop parts CD (15 CD's actually).

This expects a LAN ID and a serial key that
matches the LAN ID. I patched the program
in a suitable place to get around this. OK for
now. But the parts CD's are updated every 3 months and I actually know one real serial to a particular LAN ID.

So my question is HOW TO FIND and CHANGE the LAN ID of MSLoopback adapter ? If I can change it to a required ID then voila. This would FIX the problem for a while :)

I am starting this project now but if anyone has some info TIA.

+SplAj
Hoof Arted
02-16-2001, 02:13 AM
Let me know which OS you are using and I can see what you need to do. The M$ Loopback adapter is used differently on each OS.
Inbread
02-16-2001, 11:18 AM
Write a tutorial -please!

P.S. I'm using mostly Win2k and if possible help on Win98 would be appreciated but not necessary.
SplAj
02-16-2001, 11:56 AM
Hi, I had forgotten all about this problem
as I made the guy purchase a NIC with software changeable ID :-)

I had read that Linux could assign any number to a card but found no MS stuff on this topic.

I am still curious to know what is going on with this MS Loopback adapter for the record.

I use WinNT4 SP6

TIA

SplAj
Inbread
02-16-2001, 01:00 PM
Software changeable ID?-- Where did you buy.
hOrn_dOg
02-18-2001, 03:39 AM
Hi

I discovered a 3Com Etherlink XL 10/100 PCI that you have the option to change the address under properties/advanced...but maybe this is the O/S Win2K that allows a change ???

Anyway I would still like to see how the MS loopback adapter is assigned an ID... ??? cos the guy really has no need for an 'actual' adapter as it's a standalone machine ;)

SplAj
disavowed
02-18-2001, 10:54 AM
This won't necessarily work for all ethernet cards, but:

In Windows 95/98 and NT go to windows registry (use command regedit) and add a new stringvalue line "NetworkAddress=000011112222" to your Ethernet adapter parameters section (substitute 000011112222 by desired MAC address). In Windows95/98 the path to Ethernet adapter is something like:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Class\Net\0000].
In Windows NT the path is something like:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NE20001\Parameters].
The actual path will depend on the number and type of installed adapters. Reload the computer for the change to take effect. Use commands winipcfg (in Windows95/98) and ipconfig /all (in Windows NT) to check the current MAC address.
In UNIX use following commands to change MAC address of the Ethernet interface:
host# ifconfig eth0 down
host# ifconfig eth0 hw ether 00:00:11:11:22:22
Use command ifconfig eth0 to check the current MAC address.


keyboard hooks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > keyboard hooks
PDA

View Full Version : keyboard hooks

mike
01-16-2001, 12:00 PM
Is there a way to enumerate the hooks that have been installed on the system? I'd like to be able to detect a software keyboard sniffer.
carpathia
01-16-2001, 03:13 PM
As far as I know, theres no way to enumerate system hooks from application-level code.
However, what you could do is to install a system hook of your own, of type WH_DEBUG, which would be called before any other non-debug hook procedure is notified. You can then study the supplied debug structure, and optionally, return a non zero value from your debug hook proc to prevent the hook from being called.

Regards

Carpathia
Predator [PC/pGC]
01-17-2001, 04:56 AM
I'm backup up carps statement... afaik there's no way to check upon other ppl's hooks.. I'm also not 100% sure though.

If you look at the api ref you'll see how to set up your own WH_KEYBOARD hook and then you can choose not to pass on the hook (terminating the chain).. not that this is a direct answer to your question though ;)

If you want to make sure that you have a hook that is in front of all other hooks; check out the vxd that defiler has on his site (defiler.cjb.net) - it's an example of a ring0 keyboard hook which works fine.

Good luck.

Predator [PC/pGC]
mike
01-17-2001, 01:20 PM
I'm backup up carps statement... afaik there's no way to check upon other ppl's hooks.. I'm also not 100% sure though.

There has to be; Under Windows 98, at least, Start|Programs|Accessories|System Tools|System Information shows it under the Software Environment\System Hooks branch in the tree view.

<snip>

If you want to make sure that you have a hook that is in front of all other hooks; check out the vxd that defiler has on his site (defiler.cjb.net) - it's an example of a ring0 keyboard hook which works fine.

Good luck.

Predator

Thanks; I wonder if vxd hooks show up with this app...

Mike
Predator [PC/pGC]
01-18-2001, 05:56 AM
well, while i was browsing i found a possible solution for you..

check out elicz' site at http://www.anticracking.sk/EliCZ/

you'll see something like ShowGWH or something.. that just might be the thing you are looking for..

later,
pred.
mike
01-18-2001, 11:09 AM
Thanks! That's exactly what I needed.


+Tsehp -- fravia search engine ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > +Tsehp -- fravia search engine ???
PDA

View Full Version : +Tsehp -- fravia search engine ???

Clandestiny
01-16-2001, 04:13 PM
Hi +Tsehp,

It seems that the +fravia search engine at tsehp.cjb.net is down though the engine on the forums here is working great. Perhaps you're already aware of this, but I just thought I'd make a note.

Regards,
Clandestiny
Muad'Dib
01-16-2001, 04:23 PM
I recently asked him the same question. The search engine was removed because it was taking too much CPU time on +tsehp's host.
tsehp
01-18-2001, 07:50 AM
yes, it was a past version without an index file, I removed it and let this one, the site is here only for documentation purposes, the better
place to point now is here.

New and interesting essays can be added and indexed by the new search engine if someone wants to send.

regards,

+Tsehp


emulatore
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > emulatore
PDA

View Full Version : emulatore

maurik
01-16-2001, 07:10 PM
esistono emulatori per chiavi hardware del tipo
deskey dk2 ? dove posso trovarli?

maurik
Kythen
01-16-2001, 07:24 PM
Well... I'm afraid I don't speak your language, but I'm guessing you want help with a Deskey dongle. Check out CrackZ's great website for some essays on Deskey and dongle cracking in general. http://zencrack2.cjb.net
maurik
01-27-2001, 08:47 AM
sorry zencrack2 no!!!

another??

maurik
aCaB
02-04-2001, 09:19 PM
Prova a postare sul forum di RingZero (in italiano).
<a href="http://ringzer0.goldrake.com">http://ringzer0.goldrake.com/</a>
maurik
02-05-2001, 03:02 PM
putroppo l'ho gia fatto ma senza risultato sembra che
per questo tipo di chiave HW non ci sia nulla in giro
per tutte le altre (hasp-sentinel ecc.. ) di emulatori
ne esistono molti , ma per la deskey dk2 almeno
per quanto ne so io nessuno. non so piu dove sbattere
la testa.
ciao murik


VB6 apis. Where do I get info on them ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VB6 apis. Where do I get info on them ???
PDA

View Full Version : VB6 apis. Where do I get info on them ???

aimless
01-17-2001, 12:10 AM
I use win32.hlp for all my VC++/ASM needs. Fairly decent explanations of all exported APIs from kernel/user...etc.etc.

However is there a similar VB6.hlp file where I can get the details of the VB api's ??? And NO! I do not mean the MSDN docs.

Thx.
Solomon
01-17-2001, 01:52 AM
Did Micro$oft release any doc for the exported functions in MSVBVM50.DLL & MSVBVM60.DLL ? I think the answer is NO.


ESSAIS of CRACKZ
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ESSAIS of CRACKZ
PDA

View Full Version : ESSAIS of CRACKZ

CP
01-17-2001, 11:22 AM
after read essais of CrackZ ( Serenade 8.5 )

i have tried to generate rapidly license file with flexgen ( ISSUER=PERLA !! )

the keys and seed found on the essais are bad

have you a little infos

Pierre


Flexlm 6.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm 6.1
PDA

View Full Version : Flexlm 6.1

shymu
01-18-2001, 09:06 AM
I have been working on a program that requires a license.dat. I used KeyGen 2000 to find my 5 keys and 2 seeds. The license generated didn't work,.... yeh I know a lame way to try. So after reading some essays I found the keys in my target, to verify them. Now to my question. I'm trying to generate a key for Flelm 6.1 and after reading essays on this I'm stuck. CrackZ site has keys but they install Flexlm in a demo mode. By following an essay I found a key and changed the last 2 numbers (00-99) and still no luck. Is there a program to gen the keys so I can try again. I just can't bear the thought of entering them by hand again. I read the tut on making bat files and a macro to do this but I'm lost!
shymu
01-18-2001, 08:06 PM
Hey !! I got it !! Generated at license and it worked. What a rush to do it on my own,... well with help from tut's


Cracking Tutorials
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Cracking Tutorials
PDA

View Full Version : Cracking Tutorials

pusspuss
01-18-2001, 07:05 PM
???

I have downloaded and viewed many tutorials on cracking/reverse code engineering.

Unfortunately, I found that MOST of the tutorials were difficult to follow ??? because the authors did not provide DETAILS as to WHY they chose to do this or that!

An example of a common "mistake" by the authors is that they say you should set a 'breakpoint' (using SoftIce or similar debugger) using "whatever"; but how did they know which "whatever" to use as the breakpoint (there are MANY breakpoints to select from)!?
The authors should have explained WHY they chose "whatever" as their breakpoint.

Another common "mistake" is that the authors say you display the contents of a register at this location in the program to give you the serial number. How did they know WHERE in the program the serial number is??
Again the authors should have explained WHY and HOW they were able to determine the correct location in the program to get the serial number!

I would estimate at least 80% (yes, eighty percent) of tutorials make the above or similar "mistakes". These tutorials are then nothing more than brief notes on what the author did, and NO ONE can really learn from these so called "tutorials" except how NOT to write tutorials.

The point I am making is that tutorial writers should make the effort to explain clearly WHY they did things the way they did. THEN the 'notes' become a proper tutorial on cracking.

I pity the Newbies out there trying to learn from such tutorials, it would probably be a nightmare for them to understand what is going on. :(
Actually I believe it would also be difficult for experienced crackers to understand as well!!

Bottom line:-

PEOPLE WRITING TUTORIALS MAKE THE EFFORT TO EXPLAIN YOUR DECISIONS SO THAT ALL CAN UNDERSTAND WHAT IS GOING ON!!
?ferret
01-18-2001, 08:46 PM
Well, some ASM knowledge is essential to understand what's going on in the code. There are certain API's that are almost assuredly used for certain things. If there is something out of the "norm" going on, it usually gets explained.

For say example, serial protections.....GetWindowText, GetWindowTextA, GetDlgItemText, or GetDlgItemTextA will almost assuredly be used, unless the author codes his own routine (or uses VB,Delphi, etc.). This gives you only 2 options to choose from (with the "A" at the end for 32 bit apps, w/o the "A" for 16 bit). Why write this over and over in every tutorial ever written?

If there is a line like CMP ESI, EDI after a string reference to "Thank you for registering..." in the disassembly, of course you're gonna chyeck those registers when you step through.

You say you've gone through many tutorials....look for patterns, I'll bet if you think about it you'll find that you actually HAVE learned a few things by repetition....if the proggy does this, I could try this/with this style of scheme, I should try this approach, etc..

I guess one option would be to hire quality assurance staff and begin charging $15 per tutorial to offset the cost of their wages ;-)
Eternal Bliss
01-19-2001, 08:11 AM
hmm... what about ebliss.cjb.net
I try writing my tuts just enough to learn how to do it but complex enough to make you think at the same time. Also, there is a zip file there called resource.zip which contains the tuts and info that I needed when I first started.
Kugi
01-19-2001, 01:21 PM
Hi Pusspuss,

For the most part, tut authors do good work. Most of them are advanced reversers that take time to write tuts that help us newbies get a grip on reversing. Nice of them. Since they don't write tuts for a living and many are new to the English language, I am happy to gleen what I can from the tut and thank them for their efforts.

As for details...yes, there are many breakpoints to choose from in SoftIce. Only six or seven of them are used by reversers. How to know which one to set? I try every one that I know. Sometimes the magic works and sometimes not. Other reversers make educated guesses, even the big boys. In the tut they don't tell you all of the sets that didn't work. (And, some just know which set works?) Same with displaying contents of a register. Display forty of them until the secret number appears. Guessing what the programmer has done is not real efficient, but interesting. Efficient is... go to a warez page.

We are lucky here on the RCE message board. If you are realy having problems with a tut. Write to the board, in detail, what you have done to reverse the program and where you need help. You will always find someone to give you direction. Sometimes even the tut author will help you with direction and modify the tut to clear up unclear sections.

Anyway, hang in there and have fun with reversing.

Regards, Kugi
Malkocoglu
01-19-2001, 01:46 PM
Dont take it personally
But nowadays people want to crack even they dont know how to program... If you knew how to program (especially at the API level)
You would not say those things....

I have even seen people who DID crack some CD-checks but asking questions like "Heyy what the hell does this <rep movsd> instruction do ?"

1st step to be a good cracker/hacker:
learn how to write good programs

I have learned a lot of things from Fravia's site...
But that was after i have written a bunch of programs in assembly under DOS...
pusspuss
01-19-2001, 06:06 PM
Thanks to people who have responded so far! 8)

I am reluctant to say which are good and bad tutorials; however, since people have asked and to give people the idea of what are good and bad tutorials I list the following tuts -

Tutorials by The Sandman are generally quite good because details of WHY this was done are usually included.

The tKc compilation tutorials are a mixture of good and bad tutorials, with the majority of them being bad (because they don't explain why they chose to do this or why they chose not to do that).

ArthaXerXes , I had a quick look at your 'mastering the art' tutorials and found them to be quite good and reasonably clear and detailed; certainly better than most other tutorials!

Eternal Bliss , I had a quick look at a few of your tutorials (I hadn't downloaded them previously) and found them to be better than most tutorials; although in some tuts (#25 for example) the reason for selecting SI breakpoints wasn't explained.

?ferret . I disagree with your post. Tutorials are, or are supposed to be, written to teach! In order to teach, the tutorial has to supply sufficient information to the reader to enable that reader to understand what is going on. And to help the reader understand, the reasoning or logic behind the tutorial author's chosen cracking method should be clearly explained, regardless of whether the program/protection is standard or complex.
That means that the choice of breakpoints for debuggers should be explained for ALL programs (because you cannot use same breakpoint on all programs due to variations in program codes and protections). And an explanation as to WHY the author's think that a certain piece of code (or memory location) has the answer (serial number or code) to enable the program to be cracked; (a lot of tutorials do NOT explain HOW the author has determined a piece of code/memory location has the "crack"!!).
Holding back on some details such as the reasoning behind doing a certain cracking technique will, and does, make it difficult for others to understand what is going on.

It only takes about a minute or so for the tutorial author's to state something like - "I chose to use this breakpoint because ...blah blah blah.."; and - "the serial number is in register EAX here because ..blah blah blah..".

I am aware that you have to have a "feeling" when cracking programs, but you must also have a solid foundation in understanding the logic in making decisions on how to crack a particular program.

I do agree that people with programming experience, especially in ASM, will have considerable advantage over those who don't have such experience in cracking programs.

Malkocoglu . I disagree with your post also. I have some programming and ASM knowledge, but that still does NOT enable me to understand the process/logical thought the tutorial author's have followed in their cracking procedure and in their choice of breakpoints, memory locations etc.

That's it for now! ???
CrackZ
01-21-2001, 08:47 AM
Greetings to all.

It really saddens me when I read posts such as this, since it strikes at the heart of any of us who have ever attempted to write tutorials or pass on something in the hope someone will find it useful.

I wonder actually if the problem isn't just one of over supply, so many tutorials, so much information, so many sites to swim, so many forums, and then I examine my e-mails over the last 6 months and I wonder what proportion of people actually ever take in the basics or even come prepared to learn.....

Its a 2 way process, between tutorial user and author.....

and so, 5 years down the line and somewhat wiser, dare I say now that I believe most tutorials to be something of a redundant resource, there is enough on the web now for anyone new to learn and the only information that really stays is that which you acquire yourself.

There is little point in my opinion having web sites publishing trite repetitions on the core protection themes for which there are hundreds (if not thousands) of existing tutorials, I think many others before me have made this point. The only new resources should be target unspecific and discuss new protections, in my mind if you write a tutorial where the target has to be known, its probably not worth much ;-).

My 2c and some.

Regards to all tutorial authors and readers alike ;-).

CrackZ.
pusspuss
01-23-2001, 05:49 PM
The issue is about the QUALITY or CONTENT of tutorials, not the quantity.

I do appreciate and congratulate the tutorial author's that have made some effort to write the tutorials in the first place. Without tutorials it would be extremely difficult to learn cracking techniques.

However, many authors should have, perhaps, put themselves in the position of the people reading their tutorials. And then ask themselves, is the information within the tutorial sufficient to be understood?

Fortunately, some authors appear to have done just that, and consequently there are some QUALITY tutorials out there. Unfortunately, those tutorials are sometimes hard to find.

I have read on various forums that beginners/newbies were complaining that they couldn't understand some tutorials. Sure, it could be that the newbies are just unable to understand the tutorials because of just the way the readers are as a person. Then again, it could perhaps be due to poorly written tutorials (lack of, and/or incomprehensible information)?

I believe there is still a place for QUALITY tutorials.

That's my 3cents worth! ???
//Nike
01-24-2001, 01:50 AM
Feel the difference between "How to crack in common" and "How to crack this program/protection". If author writes tutor to cracking some hard protection like ASPack/ASProtect, don't ask him "Why you use bpm 12345 instead of bpx GetDlgItemText". Some of this "easy", but not understandable things are results of many-hours tracing in SIce, daily reading of disassembler listings and so forth.
But, IMHO, if you are to crack easy protection, there is no need to read CRACKING tuts, it's enough to read win32 api docs. If you wanna crack some really protected programms, you must be smart enough to write tutors WITHOUT reading any of them.
learn to think, not to crack.
WBR, //Nike
pusspuss
01-24-2001, 04:17 AM
Strongly disagree!

ALL tutorials should be written in some detail REGARDLESS of how simple or complex a programs protection is!

A tutorial is a tutorial!! It is meant to be a teaching tool!

The tutorial author could be the the smartest/cleverest cracker in the world; BUT, the author when writing the tutorial MUST allow for people who are not as smart as him/her reading the tutorials.
That means the author should make an effort to explain their choices/reasoning. All they have to do is add, perhaps, one sentence explaining their choices.
That is not asking much is it?

If authors deliberately leave out some detail or explanation of their cracking procedure, then that tutorial becomes unnecessarily difficult for (some) readers to understand.

It is all very well reading the Win32API doc's, but that does not explain how you CHOOSE and APPLY the appropriate cracking tools to the program being cracked!

This is where the tutorials can be of considerable help to people learning to use the cracking tools. With (detailed) tutorials, the time spent learning the cracking tools and cracking procedures will be short for most people.

:o :o :o
JimmyClif
01-24-2001, 05:35 AM
I dunno,

pusspuss... actually I'm not an tutorial writer but I read quite a lot... I just drop my 2cts in here because you seem to be angry that no one explains you the use of "our" cracking tools...
Would you really want to read over and over again how to use FileInfo on your packed exe? Wouldn't it be easier for every user to "rtfm" of every tool?

For the explications of the bpx's:
Would it be really necessary to explain why someone would bpx on GetDlgItemTextA? Isn't it normal to expect a little bit of common sense as it's really not that hard to read between the lines : GetDlgItemTextA -> maybe to get some text out of an Item in a Dialog?

Do not forget that these people are offering their wisdom for free!
& that Tutorial writing is actually damn hard...

JimmyClif
High Five To all Tut. Writers.
CoDe_InSiDe
01-24-2001, 07:51 AM
Hi pusspuss...

I'm reading this and i must say i agree a little bit with you.
I've seen also quite some tuts and most of them (but absolutely not all) are very short and quick explained.
Some of those tuts just go straight to the solution and you won't learn much from it but...

You must also realize that most authors of these tuts don't have much time or don't want to put too much time in it, because they want to do other stuff...

I'm also writing tuts and i try to explain it very detailed, if you want to read some contact me and tell me if they really are helpfull.

Now i don't think i have more to say except keep reading tutorials, you will learn a lot of them even if they are small and bad explained.
You'll learn something from them, its just they keep repeating the same kind of stuff and that stuff will get into your head without knowing it...

Anyway im off now so good luck with everything and keep on reading...

Cya...

CoDe_InSiDe
pusspuss
01-24-2001, 02:50 PM
JimmyClif .

rtfm = Read The F*****g Manual ?

Reading manuals or doc's are one of the first things I do pal!! Sure the manuals/doc's may explain the functions of the cracking tool in question, but is unlikely to explain HOW to APPLY those functions in practical cracking situations!

Breakpoint descriptions such as "GetDlgItemTextA" are reasonably obvious. The problem is that a SPECIFIC breakpoint (such as GetDlgItemTextA) may not work on a particular program, due to the programs coding. The breakpoint selection based on it's description may be obvious, but MAY NOT necessarily work!

The only thing I agree with your post is that tutorial writers are doing it for free, and that writing (good) tutorials is difficult.

What is clear to the tutorial authors may not be clear to readers!

OK pal!? :o

CoDe_InSiDe

Basically I agree with what you have said.

One will usually learn SOMETHING from all tutorials, even bad ones.

However, it would be nice if author's made just a bit more effort to clarify their thoughts and selections. This will make it easier and quicker for readers to understand their tutorials.

In some cases tutorials are NOT understandable when authors do not include sufficient detail! This is the issue!

Cheers.
JimmyClif
01-24-2001, 04:09 PM
Reading manuals or doc's are one of the first things I do pal!!

LOL... hehehe... I don't read every manual... I still have the original "How to use MS-DOS" book lying somewhere around here - unread... (I guess it's too late for that one anyways now ;) )

The problem is that a SPECIFIC breakpoint (such as GetDlgItemTextA) may not work on a particular program, due to the programs coding.

Yep, this happens! A good example I know of is an email client called 'TheBat' - I was getting nuts searching for a good breakpoint until someone pointed me to http://beam.to/blackb 's page where he found the backdoor called SendMessageA (If I remember right) ... Anyway, what I want to say is that if you check the imported functions you always find one to compensate another.

What is clear to the tutorial authors may not be clear to readers!

Well, a good tip I can give is to try cracking it yourself first, and peeking sometimes in the tut when you're really stuck... & that way things clear up way faster compared to any step by step followed essai.

ok ?!dude?! ;D

JimmyClif "the lean, mean patching machine"
Clandestiny
01-24-2001, 07:36 PM
Hi pusspuss,

I can't say I haven't felt the frustration you describe at one time or another ;-)

Though this may sound kinda funny, I've found that its sometimes necessary to "reverse" the reversing tut. Poorly written or no, there are always clues within which you may reverse and research to gain a deeper understanding... Not to get too philosophical here, but IMHO reversing occurs on more than one level...LOL

Likewise, cracking and reversing take a *lot* of effort and dedication especially if you aren't coming from a programming background. From personal experience, I've found that researching the *why* is at least as important as knowing *how* it was done. Though quite tedious at times, it will pay off exponentially in time saved in the future.

...A couple of things that have increased my understanding of cracking / reversing in general.

1) When I began reversing, I had a *little* dos asm experience, but no asm experience with windows. After a time I realized, how can I attack a window's program if I don't even know how a window is created? ...how can I enable a disabled menu function if I don't know how a menu is created? Sure, I could memorize a couple of common breakpoints and cross my fingers hoping they would work...but my reversing skills were basically at a stand still until I realized the necessity of learning at least the rudiments of win32asm programming. After working through
Clandestiny
01-24-2001, 07:44 PM
Hi pusspuss,

I can't say I haven't felt the frustration you describe at one time or another ;-)

Though this may sound kinda funny, I've found that its sometimes necessary to "reverse" the reversing tut. Poorly written or no, there are always clues within which you may reverse and research to gain a deeper understanding... Not to get too philosophical here, but IMHO reversing occurs on more than one level...LOL

Likewise, cracking and reversing take a *lot* of effort and dedication especially if you aren't coming from a programming background. From personal experience, I've found that researching the *why* is at least as important as knowing *how* it was done. Though quite tedious at times, it will pay off exponentially in time saved in the future.

...A couple of things that have increased my understanding of cracking / reversing in general.

1) When I began reversing, I had a *little* dos asm experience, but no asm experience with windows. After a time I realized, how can I attack a windows program if I don't even know how a window is created? ...how can I enable a disabled menu function if I don't know how a menu is created? Sure, I could memorize a couple of common breakpoints and cross my fingers hoping they would work...but my reversing skills were basically at a stand still until I realized the necessity of learning at least the rudiments of win32asm programming. After working through a good number of Iczelion's excellent tuts (win32asm.cjb.net) I found things starting to make a lot more sense. I'm still no guru at win32asm programming, but my research has at least enabled me to get a general idea of how windows API's work together in a program for windows creation / text input / menu definitions / mouse input....ect. IMO, this helped a *lot* in figuring out where to attack programs.

2) Like I think Jimmy Clif already mentioned, setting breakpoints is not a lucky shot in the dark. Once again there are clues ...and even a sort of procedure to it. First, check all of the imports in Wdasm. This will tell you which API's the program uses for a process like text retrieval (ie. you can clearly see whether it is going to be GetDlgItemTextA or GetWindowTextA ) before you ever fire up Sice. Secondly, consult an API monitor...(Kayaker sold me on this one a while ago) ;) This will not only show you which functions are called, but the order in which they are called (take the imported functions you're interested in from Wdasm and plop them right into the moniter). This helps to build up a picure of the code flow and can help you determine if for example a back trace range will be useful to you.

3) Of course, getting a win32 API reference is a *must*. If you're like me, you'll have to look up some of the imported functions to determine if they'll be useful.

Well, there's my 2 cents (and some more) ;)

Cheers,
Clandestiny
Clandestiny
01-24-2001, 07:48 PM
sorry about that...somehow I got trigger happy and hit post before I had finished...

--Clandestiny
pusspuss
01-24-2001, 08:16 PM
Clandestiny

Thanks for your comments; they are noted. :)

Just for your information -
I usually do check the API calls made, by using W32Dasm (program code permitting).

And I have the Win32API reference as well.

The use of an API monitor is a GOOD idea; I haven't got that yet!! I will chase that one up!

Cheers! :)
Luke
01-25-2001, 11:25 AM
When reading a tutorial are you really willing to work/learn something on your own or are you just a lazy bastard who only wants to 'consume' ready made information?
pusspuss
01-26-2001, 03:33 PM
Luke

Real constructive post LUKE !!!

WTF kind of a post is that, you p***k!

Of course I am willing to learn! And I can pick things up fairly quickly.

How the F**K can I learn something if the information is NOT there to begin with!!??

Maybe you can, but I can't read minds!!??
tsehp
01-26-2001, 04:56 PM
Please, the both of you, I just want this messageboard to be a place
of positive and constructive conversations around here.
So don't use such words, stay polite and everything will be ok.
People coming here are looking/giving knowledge, not personal opinions
or attacks at someone. So stay polite, please.

I'll just write a few words, my essays were not criticized here, but had a lot of critics during the past, especially for the most complicated ones.
Some essays can take a lot of time to write for the author, who is deeply involved with the target, making him sometimes hard to understand.

I have an easy way to correct this for future ones, you just start a
thread an upload you first essay, asking for people for critics,
then you correct it and upload again,etc...

When it's ready, you send it to be published, just like the beta versions.

regards,

+Tsehp
pusspuss
01-26-2001, 05:10 PM
+Tsehp

My apologies for my outburst, but that "Luke" guy should be careful about what he posts.

I agree that CONSTRUCTIVE posts (without swearing) should be the way to go!

In the future I will try to be more tolerant of similar "non-constructive" posts.

Cheers.
vgb
01-26-2001, 06:23 PM
OK - I have to get my licks in here also. I generally agree with pusspuss. I feel the problem is that a good RCE'r is not necessarily a good author. Writing *anything* is a talent. Writing a tutorial is even more difficult. Add that many of the tuts are written by people whose prime language is NOT english and you add to the difficulty. To answer the poster who asked if one would want to see an explanation on the use of filemon in ebery tut - if necessary, yes or at least a link to the relevant docs. If I'm familiar with the program, I can skip it but if I'm not and there's no help there, I'm stuck.
If I understand pusspuss' complpaint, it's not about simple "how to crack x program" tuts but more about learning generalized methods of attacking any target.
I DO wish to thank ANYBODY that takes the time to write a tut, good OR bad - at least you cared enough to share. If you see enough positive criticism, such as pusspuss, you will learn to express your knowledge in a manner easier for beginners to follow.

BTW, some tuts are clearly marked ()advanced. Those should be given a little slack. If a beginner reads an advanced tut and understand it either it isn't advanced or he IS.

Anyhow, that's my take on the issue.

vgb
pusspuss
01-26-2001, 07:32 PM
vgb

Excellent post!! :)

Basically you have stated what I have been trying to say all along!

I hope that tutorial writers take note of your post!

Cheers. :-)

pusspuss
tsehp
01-27-2001, 01:48 AM
pusspuss (01-26-2001 07:17):
+Tsehp

My apologies for my outburst, but that "Luke" guy should be careful about what he posts.

I agree that CONSTRUCTIVE posts (without swearing) should be the way to go!

In the future I will try to be more tolerant of similar "non-constructive" posts.

Cheers.
Yes, exactly, if this get to attack someone personnaly, just ignore it
and move to another topic. thanks to understand,
best regards pusspuss
NchantA
01-28-2001, 04:48 AM
hrmm...anyone else getting sick of the bold :P

pusspuss have you ever written a tutorial? i say this because if you havent then you dont know how hard it is to 'forget' everything you have learnt, and pretend you are a newbie again. cracking knowledge is usually hard-won, its a mixture of practise, reading(books tutorials), practise and time, therefore not many advanced crackers can easily put themselves in the readers shoes. it is a skill not all can master and frankly not many have time for.

you should be happy that at this point in time, there seems to be an enourmous ammount of information on crackign and reverse engineering related subjects all over the net, newsgroups and IRC.

i think your problem may be that you dont know how to search or 'sift' through the virtual data. i think that is one of the key hardship that crackers (young or old) find themselves with...

i started reading about cracking at approx 93/94 and since then i have acomplished much. i never had any qualms about any tutorials at that time (the quality has increased a hundred fold) and still dont.

read, study, and do *your* part as the reader in actually putting the knowledge learnt from tutorials in the real world. most of all practise.

each tutorial is a potential gem, but you wont see its worth until you read between the lines. understand dont just blindly follow like a coding sheep...

ehem, i seem to have said pretty all the money i have atm ;)

NchantA


Reversing an old dos target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing an old dos target
PDA

View Full Version : Reversing an old dos target

Scally6
01-19-2001, 12:57 PM
I have an old Dos exe, which was written in basic, packed withexepack & compiled with? 'MS run-time library 87, 88, 89'
I found unexepack on Sudden Duischarge's site & unpacked it but I don't have a clue where to go from there.
Is it possible to get back to the original basic listing?
TIA
Scally
mike
01-19-2001, 03:20 PM
is it possible to get back the original basic listing?
Possibly, depending on how the program was compiled and optimized, but you're not going to find any ready-made tools to do it. I'd say the next step would be to drop it onto IDA and let her have a go at it.
Anonymous
01-20-2001, 10:55 AM
I found the only thing that realy helped me to reverse an old dongle protected target was a debugger called TR. For some or other reason SoftIce was not giving me satisfactory results. You will find the next problem with dissassemblers is that you just get the bare assembler with them, no string references or what, what.. Not bad, encourage us to learn more assembler, but that is
Antipodean
01-22-2001, 07:51 AM
there used to be decompilers for the compiling version of GWBasic (I think it was called Mbasic or maybe that was the CP/M version, it might be Quickbasic). It used a tokenizing arrangement similar to the early VB compilers (which is not surprising as they were developed from it). Search the web for Quickbasic decompiler.
Scally6
01-22-2001, 01:02 PM
Hi folks,
I have searched - using dogpile & softseek mainly. There were some references to one in the newsgroup archives but no joy. Idid find a site offering to decompile for $700! (Think I'll pass on it)
Not too familiar with IDA, (have 3.84b), but that might be the only way to go.
Thanks for your help, anyhow
Scally


RSA Elliptic Curve
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > RSA Elliptic Curve
PDA

View Full Version : RSA Elliptic Curve

agoutinz
01-20-2001, 03:04 AM
crypto link
http://www.cs.uct.ac.za/courses/CS400W/NIS/
*A Comparison of RSA and Elliptic Curve Encryption
*Attacking the RSA Cryptographic System
*Elliptic Curve Cryptosystems
and more...
for newbiez:
http://www.filesearch.ru/cgi-bin/s?q=tasm5&t=f&w=a
tsehp
01-21-2001, 04:26 AM
not working from my isp...
agoutinz
01-22-2001, 06:40 AM
change your proxie..!
a+


License.dat?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > License.dat?
PDA

View Full Version : License.dat?

shymu
01-20-2001, 11:23 AM
The first target I generated a license for went without a problem,... learned alot about
Flexlm in the process. But while working on my second target I ran into a snag.
With both I generated the license's as permanent.
When I ran the license info program that came with my second target I noticed
this line " 13/permanem" for expire date. So I tried a date instead, but anything passed xx-dec-00 give me
" your vender keys are expired " in Flexlm. Going back to my first target and trying this gives me the
same result , "keys expired". How can this be? I have current demo licenses for both.
I'm using Flexlm 6.1,.. both targets ver 6,... lmgr326a.dl
This is the last lines of my second target license Can anyone tell me about it's format?

FEATURE EMW_MAGSTAT SRAC 2.000 12-jan-2001 0 6B6CB021A9CCE5D24260 "#64000#SRAC DEMO
01122001" DEMO
FEATURESET SRAC 30601D7CC0FA3914
00061 22000 04804 90470 49050 04705 00480 48049 09006 80690 77079
Nolan Blender
01-20-2001, 05:32 PM
shymu (01-20-2001 01:23):
" your vender keys are expired " in Flexlm. Going back to my first target and trying this gives me the
same result , "keys expired". How can this be? I have current demo licenses for both.
I'm using Flexlm 6.1,.. both targets ver 6,... lmgr326a.dl

Well, FLEXlm demo keys have an encoded expiry
date in them - your best bet is to use lmrecode
to generate new ones (found at Crackz' site)
and all will be well.

This is the last lines of my second target license Can anyone tell me about it's format?

FEATURE EMW_MAGSTAT SRAC 2.000 12-jan-2001 0 6B6CB021A9CCE5D24260 "#64000#SRAC DEMO
01122001" DEMO
FEATURESET SRAC 30601D7CC0FA3914
00061 22000 04804 90470 49050 04705 00480 48049 09006 80690 77079

The #64000 is the maximum number of nodes
that are supported. Encoded in that block
of numbers is a date and name - I leave
it as an exercise to you to figure out what
they are.

01/12/2001ZDEMO

Hint: SRAC provides a nice license test
utility which can be used to your advantage.
shymu
01-20-2001, 06:14 PM
Thank-you,... just enough info as not to spoil the challenge.

Again Thank you for a quick reply
shymu
01-20-2001, 07:45 PM
Hate to ask, but,.. I have lmrecode.c and .doc Am I missing lmrecode 1.2 program? Any
tuts on this?


Star Force Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Star Force Protection
PDA

View Full Version : Star Force Protection

Guest
01-20-2001, 02:54 PM
Hi, dear reverser's. I have big problem :(
I have CD game, protected with "star force protection" (http://star-force.com).
It uses big protect.dll, where implemented all protection functions. Entry Point of program is in ind of .text section and contains only one call of dll function.
As I know, after all test, dll must return to OEP of program, but I cant fint OEP: in dll function is very strange cycles - i can't find, where is it's end (?!?!). I try some another cnown methods (e.g. /tracex function) - but no result - just BSoD :(

Plz, if You know somethig about unwrapping these shit, give me answer.
tsehp
01-21-2001, 04:24 AM
/tracex is tracing your actual thread, if you're inside the protec.dll it will normally not find the main exe's OEP if there's is a context change.

look if there are several threads when the dll is working and look if it's the same thread that is calling the main exe OEP, if not you must /tracex the correct thread if you want it to trigger.
The Owl
01-21-2001, 08:44 AM
I have CD game, protected with "star force protection" (http://star-force.com).
It uses big protect.dll, where implemented all protection functions. Entry Point of program is in ind of .text section and contains only one call of dll function.
As I know, after all test, dll must return to OEP of program, but I cant fint OEP: in dll function is very strange cycles - i can't find, where is it's end (?!?!). I try some another cnown methods (e.g. /tracex function) - but no result - just BSoD :(

looks like another russian group trying to walk the other side of the road ;-). if you can make available all the files needed to successfully start (unwrap) your game, then i can look into the /tracex issue at least, although don't expect much, it's trivial to fool it in win9x. as a sidenote, did you notice if this scheme installs/uses any kernel mode component (vxd/sys)? if it does and you can isolate the file, i'd be especially interested in it/them.
Guest
01-21-2001, 05:48 PM
I'm upload main exe and dll to http://members.nbci.com/a0101010101/shit.zip
Certainly, it does not work correctly without the resources, but who knows :)
As I can see - game does not use CD in gameplay - just test (read some random(?) data from it). Main exe is emty and filled by decrypted/unpacked data from dll after dll inicialization. All my attempts to trace it manually were finished by failure - progz just lock, or I get BSoD :(
If I set some useful breackpoints (e.g GetModuleHandle, LoadLibrary) - program just lockup and not work at all.
May be it use some data from CD for decrypting/unpacking, but I can't upload 200mb of game, and I don't find any another target protected by this sheme. sorry.
Guest
01-21-2001, 05:49 PM
I'm upload main exe and dll to http://members.nbci.com/a0101010101/shit.zip
Certainly, it does not work correctly without the resources, but who knows :)
As I can see - game does not use CD in gameplay - just test (read some random(?) data from it). Main exe is emty and filled by decrypted/unpacked data from dll after dll inicialization. As I can see, it not use any vxd/sys drivers - only protect.dll. All my attempts to trace it manually were finished by failure - progz just lock, or I get BSoD :(
If I set some useful breackpoints (e.g GetModuleHandle, LoadLibrary) - program just lockup and not work at all.
May be it use some data from CD for decrypting/unpacking, but I can't upload 200mb of game, and I don't find any another target protected by this sheme. sorry.
The Owl
01-22-2001, 03:09 PM
is this supposed to run under w2k? all i get is an 'not a valid win32 app' message and i see some PE header editing by PEditor 1.7. is this really the original exe?
Guest
01-22-2001, 05:45 PM
Sorry, it is my mistake - I made some changes in header, but I run it on WinME and it works fine:
1) I decrease virtual size of .data section - this is only buffers for game sprites, but without chenging IDA use too much RAM, and sometimes lock my system.
2) I kill "debug information present" flag in header, because these data actually are absent in a file, and IDA crashed on the "reading outside a file".
3) I change in protect.dll names of SoftICE drivers (//./SICE, //./WINICE, ...) and name of IsDebuggerPresent function for fool stupid debugger detection routines.

Original section size:
.data VS: 18095C8h

Original Debug Info:
RVA: 165000h, Size: 1Ch

I'm upload original header from main exe to:
http://members.nbci.com/a0101010101/header.zip

I'm very sorry, that I have sent not original files, and I take away your precious time.


wdasm crashing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > wdasm crashing
PDA

View Full Version : wdasm crashing

loner
01-20-2001, 04:04 PM
has anyone ever got this message while trying to open a file in wdasm

"cannot find .alf File
Be sure that .alf File exists and is in the same Directory as the .wpj file"

i am suspecting that this file has some kind of anti-debugging trick

anyone seen somethin like it in wdasm??

sharon
Kayaker
01-20-2001, 05:56 PM
Hi,

The alf and wpj files are created once you've saved a WDasm disassembly. Ignore them and just re-disassemble the original file and you should be OK.
loner
01-21-2001, 03:38 AM
yes Kayaker.. i know what u are talking about..
but this error message is faulty cuz i dont try to open a previous project.. i try to dissassemble from new.. thats why i say its some kind of anti debugging trick

thanx again
Kayaker
01-21-2001, 04:14 AM
Hi,

I've never seen anything like this before...

What file are you trying to disassemble?

Regards,

Kayaker
loner
01-21-2001, 06:05 AM
tha name of the program is InTouch from wonderware..

the file is
intspt.dll
i am providing it at this location if anyone is interested in taking a look
http://www.cyberflat.net/intspt.zip

any inout is highly appreciated
thanx
Kayaker
01-21-2001, 12:58 PM
Hi,

Very bizarre. There's a couple of strange things with this dll that must be confusing the hell out of W32Dasm ;)

First, it's got over 60 non-standard sections after the .text section which have the code characteristics 60000020 (contains code, executable, readable). Even if W32Dasm was able to disassemble it, it might choke on the 7B000 bytes of executable code.

Second, it contains debug information, which essentially seems to encompass the whole of the file. You can actually use PEBrowsePro to disassemble each of the sections (right click on the entries under Debug Symbols and select Disassemble). Is there such a thing as a "debug dll"? Of what benefit, or purpose, would this be in a program?

IDA disassembles the file, but it asks for several dlls on "Reading Imports Directory". You can either provide them to IDA or just hit Cancel several times and make what sense you can out of things.

I thought that with changing the code characteristics of each of the (60+) sections to non-executable, W32Dasm would ignore them. So I replaced all occurrences of "60000020" in the Sections Header with "C000040" with Hexedit (then changed the single .text section back), but I still got the "Cannot find .alf file" error message. So maybe it's the debug info or something else screwing W32Dasm up.

Hope this helps,

Kayaker
SpeKKeL
01-21-2001, 01:53 PM
Hi to you all,

Just downloaded the dll and disassembled...!??
Nothing crashed and it gives all the stings etc.
I tried with the patched wdasm(vb) and unpatched but all two did fine using W98 (first edition) and w32dasm8.9
greetz............ SpeKKel.........
loner
01-22-2001, 12:07 PM
thank you all for ur input.. i appreciate it..
i hope u didnt loose ur patience yet cuz i have one more question for both of u..

Kayaker: looking at the pe section .. do u think this dll is encrypted??

SpeKKeL: can u tell me where i can get my hands on v8.9 of wdasm??

cheers everyone
SpeKKeL
01-23-2001, 04:39 AM
LOt's of places...>>www.lockless.com/dasm.html

...................................
Kayaker
01-23-2001, 11:53 AM
Good 'ol reliable W32Dasm ;-)

Version 8.93 doesn't know what to do with intspt.dll, just gives that bizarre error message on both Win95 and Win98.

Version 8.90 and even the old 8.7 have no problems with it.

From the looks of the String refs to "License", I guess that's the file you want ;)

Cheers,
Kayaker
Beyond2000!
01-29-2001, 04:51 PM
You wrote:
loner (01-20-2001 20:05):
tha name of the program is InTouch from wonderware..

the file is
intspt.dll
i am providing it at this location if anyone is interested in taking a look
http://www.cyberflat.net/intspt.zip

any inout is highly appreciated
thanx

Ok... I've got this error sometime ago. W32dasm doesn't load somekind of files, due to a bug (it's not only a antidebug trick). This bug is due to a lack of memory on the reading process.

I fixed sometime ago, and now, you can load any file without errors.

Otherthing, i changed w32dasm enabling breakpoints on forbiddens dlls, like kernell32, for example.

Now you can breakpoint directly on the dll loaded (any of them), and w32dasm will break, similar like softice do.

But, if you break on kernel32.dll, user.dll etc...w32dasm may crash due to this files are being used on windows. It does not crash every time.

It can be solved, but i still need much more memory to process the infos, and i am disassembling w32dasm in order to compile it under masm615.

If i could be able to completelly decode all data on w32dasm, the possibilities are endless, specially because i intend to put a resource editor under w32dasm and other features.

If you want the bug fix for w32dasm, let me know, and i'll send to you the patch or the tutorial on how to fix it.

Best regards,

Beyond2000!


IAT, safedisk, frogice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IAT, safedisk, frogice
PDA

View Full Version : IAT, safedisk, frogice

gimmee
01-20-2001, 06:57 PM
hi all

i bought a cd in america called realflight r/c simulator to teach me how to fly r/c helicopters before i wreck my own one. Cost me $500 new zealand cause our dollar is sooo low, so i must back it up aye. it is protected with safedisk. while cracking the the cd protection forgice said there where 7 changes to my iat. when i went to run the game again it said it couldn't find the *.icd file, bullshit. i tried to restore the iat.bak with fploader R but when it tried it return an error so no luck.

What is the IAT, how can i view it, and can you back it up manually or something when it gets damaged however. I uninstalled the game and reinstalled it and it works again so back to carcking the safedisk protection. Any replies or links on this muchly appreciated
tsehp
01-21-2001, 04:20 AM
iat stands for import allocation table, it's rva is on the pe-header, it's pointing to function/module import names, its resolved by windows to
give your exe some api addresses to be used by your program.

Iat's are very often used as a protection scheme, you just dump your program but iat is still pointing to protection's addresses but not loaded by your dumped program, so it crashes.
I'm actually working on a tool to resolve this problems, it's actually fixings the iat for a lot of protectionh schemes and it's actually being fixed for safedisc based protections, read the tutes on this sites and
write me when you're ready for a beta test.
risc
01-21-2001, 08:55 AM
"forgice said there where 7 changes to my iat"

tsehp - i think he means, frogsice detected 7 changes to his IDT ;-)

gimmee - erm anyway, never mind the idt changes, and goto cdchecks.cjb.net and get some reading material on Safedisc ..
Luke
01-25-2001, 06:03 AM
IAT = Import Address Table

The Import Address Table is an array of addresses of the imported
routines for each DLL.
Spath.
01-25-2001, 01:40 PM
> tsehp - i think he means, frogsice detected
> 7 changes to his IDT

Glad to see at least one person knows what
FrogsICE is about :)


Problem with exe files under win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Problem with exe files under win2k
PDA

View Full Version : Problem with exe files under win2k

hawk_dk
01-21-2001, 03:27 AM
I've got a problem plz help.
I've manually unpacked a program packed with aspack,
when i run it under win 98 it works fine but when i run it in win2k i'm getting this error "the applocation failed to initialize properly (0xc0000005).click on ok to terminate the application.

plz help
tsehp
01-21-2001, 04:14 AM
how did you unpacked in and on what system ?
you should also try to manually load it with sice symbol loader, just to
see if at loading all the exe's imports are resolved, some imports could only be valid on win 9x and not on win2k.

the pe header could also not be win2k compatible, use pe editor from yoda to correct it.

+Tsehp
McNy@Work
01-21-2001, 01:09 PM
+Tsehp (01-20-2001 18:14):
how did you unpacked in and on what system ?
you should also try to manually load it with sice symbol loader, just to
see if at loading all the exe's imports are resolved, some imports could only be valid on win 9x and not on win2k.
...
+Tsehp

Tsehp,
How did we know which of the exe's imports
are valid on win9x and not on win2k? can u give
an example ?
THanks aLOt 8-)
hawk_dk
01-21-2001, 02:08 PM
when i run the program packed it works fine ,but when it's unpacked it only works on win 98 not my win2k it's packed with aspack
exit
01-26-2001, 02:07 AM
You can use PE-Shield with parameter -r. I think it will repair your PE file.

Exit
The Owl
01-26-2001, 04:30 AM
I've manually unpacked a program packed with aspack,
when i run it under win 98 it works fine but when i run it in win2k i'm getting this error "the applocation failed to initialize properly (0xc0000005).click on ok to terminate the application.

the problem that plagues pretty much all imports rebuilders i've seen so far is that
certain system DLLs in both 9x and NT have exported APIs that have the same
RVA/VA. the problem with this is that *after* the IAT slots have been filled in by
the OS PE image loader (or PE wrapper, whoever happens to resolve the imports),
the one-to-one mapping between the imported API names (as found in the original
PE image) and the IAT slot contents is *gone* for good. any attempt to restore
API names from IAT slots will necessarily fail, what most schemes do is that they
simply resolve a given IAT slot value to the first API name (that resolves to the
given address) they find in a given DLL's export table - obviously it won't be the
correct guess all the time.

there are two ways to do this properly.

1. rebuild imports *before* this one-to-one mapping is destroyed, ie. before the
OS loader or the PE wrapper has performed the imports resolution. this requires
reverse engineering (of the various wrappers) and is not a generic method.

2. 'cure' the problem right at its root: make the colliding API addresses distinct by
changing the export tables of the DLLs in question and then use the existing tools
to reconstruct the imports from the IAT slots (this is the method icedump
implements since 6.021, although it does not work 100% yet - some win95
versions and also the tracer doesn't like it for some reason, the 6.022 release
will hopefully solve this problem).


Java Encryption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Java Encryption
PDA

View Full Version : Java Encryption

Killerkris
01-21-2001, 05:53 AM
Hi all i am wondering if anyone knows any tutorials on how this works as i dont have a clue really where to start. I am after both java applet and javascript encryption. Does anyone know any good parsing programs as well?

Thanks in advance

Killerkris


Finding a serial for File-Ex 2.12d
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Finding a serial for File-Ex 2.12d
PDA

View Full Version : Finding a serial for File-Ex 2.12d

siRl
01-21-2001, 04:32 PM
hi all :)
for a longer time know I´m trying to find a serial for File-Ex 2.12d which can be downloaded at www.file-ex.com (in case you need further information).
The Problem about this program is that it´s written in visual c++ 3.0 which means 16 bit code.
As i read in a tutorial of razzia I decided to look where the serial entered is taken to by bpr on es:di. It seems that the program generates a value from the serial by shifting the bits to the left. for example 112 = one hundred and twelve.
Than it does something to this value to encrypt it and compares it to another value. There is no echo in memory to be found. I think the only way to reverse it is to reverse the value with which it is compared, but i cant seem to find the routine where its encrypted and how.
It might be that I´m mistaken so please have a look at the program or give me some hints to crack it. Any good tutorials would also be fine.

many thanks in advance

siRl
hz
01-22-2001, 12:59 PM
Hi,
It's a long time since I did this so this is from memory. I don't remember there being any encryption, what I think you see
happening is your 32 bit sn being converted
to two hex words, then they are simple compared with the "real" ones, check it out by just entering '1234' and see if it end up with 4d2 in one of the regs.
regards

No Name in case I'm wrong :-)
sirleechalot
01-22-2001, 06:47 PM
hi :)

many thanks for the help, because I cracked it now and I will try to keygen it.
The hint you gave me was the last bit I needed to understand the whole protection.

siRl


Smartcheck: will it handle a former Neolite packed exe ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Smartcheck: will it handle a former Neolite packed exe ?
PDA

View Full Version : Smartcheck: will it handle a former Neolite packed exe ?

Aleph
01-21-2001, 08:16 PM
Hello all.

I know NOTHING about packed exe, and how to unpack it. So, sorry if it is a dumb question... : I have an app wrapped with Neolite (maximum compression), and
probably written in VB.

If I unpack it, will SC be able to handle it like any other VB app, or not ? (IDA is not really my cup of tea...)

Regards,
Aleph
tsehp
01-22-2001, 02:33 PM
If I remember well, vb compiler generates two kinds of apps :
-tokenized ones, you can smartcheck them.
-stand alone ones, you can't. and this is surely the case here.
+ there's a lot of ways to fool smartcheck, I'll encourage you to unpack it and put it inside Ida, it's not so hard, you have to search for
m$ docs for vb functions that ida will show you.
good luck

+Tsehp
Aleph
01-23-2001, 11:16 PM
OK, I presume I'll have to study IDA once again :-(
Anyway, thanks for the light, +Tsehp.

Regards,
Aleph


FlexLM 6.0f
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM 6.0f
PDA

View Full Version : FlexLM 6.0f

Perry
01-21-2001, 09:59 PM
My objetive use FlexLM 6.0f, where i can to find it?
I confuse with my objetive (is *******), i have the structure code (similar essay of Nolan), i thing that i have the vendor code (i checked 1 to 4), but don't know if the vendor code 5 is correct. I failed to get a valid licensed.dat using genlic32.exe (6.0k).
Perry
01-23-2001, 03:51 PM
Some help!?
Nolan Blender
01-23-2001, 06:07 PM
Perry (01-23-2001 05:51):
Some help!?

OK. tsehp.cjb.net has some good stuff
zencrack2.cjb.net does too.

You don't need the exact version of FLEXlm to generate licenses.

Common reasons for genlic32 failure are:
incorrect vendor keys
incorrect seeds.
Needs long keys.

There are others, but if you figure these out, that
will cover most problems.

You may need to rebuild lmcrypt and make the license that way.
Perry
01-24-2001, 11:56 AM
Thanks Nolan! I´ll come back.


Asprotect unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asprotect unpacking
PDA

View Full Version : Asprotect unpacking

SirLeechaLot
01-23-2001, 10:03 AM
hi all :)

I have unpacked several apps now with a program called DeAspr which were packed with Asprotect. I got the information from Language 2000 which showed my Aspack/Asprotect.
I was now trying to unpack Chameleon Clock and it only tries to start the program but doesnt unpack it.
Is there any possibility to get into it?

many thanks in advance

siRl
hz
01-23-2001, 12:25 PM
Hi,
You could try asking Tsehp if you can test
his ReVirgin.
regards
SV
01-24-2001, 03:08 AM
Hi reversers, lo Hz

This one must be modify after be unasprotected.
Some Alex tricks (one call before entering EOP).
I have one which work.

PS Hz have you rebuild this one ?

Regards SV
SirLeechaLot
01-24-2001, 10:07 AM
Hi :)

I didnt quite get what you meant but as far as I understood you got a working unpacker or you managed to unpack it.
If so please send me an E-Mail to SirLeechaLot@gmx.net

many thanx :)

siRl
babies
01-24-2001, 11:58 AM
SirLeechaLot (01-24-2001 00:07):
Hi :)

I didnt quite get what you meant but as far as I understood you got a working unpacker or you managed to unpack it.
If so please send me an E-Mail to SirLeechaLot@gmx.net

many thanx :)

siRl

You Should ask Tshep for it by yourself.
And u need to register in this forum for get it.
tsehp
01-24-2001, 04:21 PM
hi,
no need to register here, just email me and that will be ok.

I saw a new feature on commview 2.4 ,two iat's are pointing into cv code itself which are calling an encrypted one.
Did you fixed this SV ? If yes, thanks to answer me, I actually don't have the time to add this into the next version, working currently
on a win9x version independant revirgin and safedisc2.
TIA,


Attention CrackZ what is your new email ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Attention CrackZ what is your new email ?
PDA

View Full Version : Attention CrackZ what is your new email ?

LaptoniC
01-23-2001, 06:36 PM
I have tried to send email to you but hotmail says that

The address "crackz__@hotmail.com" does not exist. This mail has not been sent
CrackZ
01-24-2001, 05:04 PM
Hiya,

I just tried logging in and it seems to work fine (not that I read anything mind ;-) ).

crackz__@hotmail.com (2 underscores).

So I haven't a clue ;p.

Regards

CrackZ.


First safedisc 1 cracked with revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > First safedisc 1 cracked with revirgin
PDA

View Full Version : First safedisc 1 cracked with revirgin

tsehp
01-23-2001, 07:54 PM
hi,
just to report about the current state of the revirgin's (iat rebuilder)
beta.
I just did this :
-dumped the icd file with icedump
-generated the iat resolved files with revirgin, pasted them into the
dumped target and it works, spent 5 minutes on this.

Now, I've got to port it to safedisc 2 , which seems to use pretty much complicated iat based encryption, just like alexey (asprotect)
did into his latest asprotect version you can find on commview 2.4
(btw thanks alexey to keep me busy with your upgrades, if you just could put some info about your new versions on this board, I could react much more quickly ;)

So I need a working target protected with safedisc 2 and don't want
to buy a cd for this, so if someone manages to build a working one,
without the cd, and with iat untouched, that could ease a lot my work
on this case.

Thanks in advance, regards.

+Tsehp
IcyDee
01-24-2001, 07:19 AM
It might be helpful if you explained more exactly what you wanted. From what I understand revirgin is able to take the IAT of a working exe file (such as a SafeDisc 1 title running from and original CD) and re-generate it avoiding all the IAT re-direction etc.
When you say you want an exe file that runs without the CD I assume that you mean an exe that has been patched but otherwise has retained all of the IAT re-direction as in the original?
I assume that exe files with modified IAT tables are of no use to you.
I would like to discuss with you some-time how your revirgin works, some work I have been doing sounds like it might use a similar approach.
risc
01-24-2001, 09:27 AM
erm it creates a dumped file with idata intact (not dumped, doesnt dump idata from memory, is exactly the same as virgin exe's idata..), not very useful ..

also safedisc v2 (and the recent versions of v1) needed .code modifying to fully rebuild imports, call dword ptr [api_x] calls wrong api on 50% of imports.. safedisc v2 also has jmp _api_wrapper embedded into the .code section of wrapped exe.. more crap to rebuild! :p

theres this guy with a safedisc v2 'key injector patcher' type thing, which adds code to the exe to inject the key, kill cd check, and allow it to run with no cd.. i'll point him towards these post's!
tsehp
01-24-2001, 04:25 PM
IcyDee (01-23-2001 21:19):
It might be helpful if you explained more exactly what you wanted. From what I understand revirgin is able to take the IAT of a working exe file (such as a SafeDisc 1 title running from and original CD) and re-generate it avoiding all the IAT re-direction etc.
When you say you want an exe file that runs without the CD I assume that you mean an exe that has been patched but otherwise has retained all of the IAT re-direction as in the original?
I assume that exe files with modified IAT tables are of no use to you.
I would like to discuss with you some-time how your revirgin works, some work I have been doing sounds like it might use a similar approach.

Yes exactly, I just need an exe working in mem but without anything
modified considering the iat's.

considering revirgin's under the hood, just write to my email I will explain you, thanks in advance if you can provide me a working exe.
regards,

+Tsehp
tsehp
01-24-2001, 04:30 PM
to answer artha and risc at the same time :

Owl told me that the new safedisc 2, uses the esp to decode correctly
the encrypted iat, so several code locations could call the same iat
and give dirrent addresses :)

But I'll only have to create some kind of table to locate all the combinations and load my tracer with all the possible esp's, then a one-to-one it table will be built.
It's easy to say, much harder to code but if the protection sounds like
this I have to make some tests. Thanks if you have a ready made exe,
this will save me some time (such lazy I am those days ;)

best regards,

+Tsehp
The Owl
01-25-2001, 03:59 AM
Owl told me that the new safedisc 2, uses the esp to decode correctly
the encrypted iat, so several code locations could call the same iat
and give dirrent addresses :)

uhm, i didn't exactly (want to) say that ;-). what i was told is that kernel32/user32 API calls originating from the wrapped exe will/can end up at different APIs even if they seemingly go through the same IAT slot. this obviously means that 1. such APIs go through a wrapper, 2. the wrapper decodes the real intended API address based on the caller's address (which is on the stack). this was happenning for quite some time now, maybe not in the first releases of SD1 i looked at 2 years ago, but last year definitely. from what i see on the various forums this scheme hasn't changed that much for SD2, only that perhaps now other DLL APIs are wrapped the same way as well, and perhaps more kinds of API calling methods are detected and handled by the wrapper (i think originally they handled call/jmp [iat slot], maybe now it's more, i can't tell).
tsehp
01-25-2001, 06:49 PM
thanks Owl to make it more precise.
a reverser called tippex will send me what I asked for, I'll get on this
pretty soon, I think that the only solution is to look for every iat,
all the references and try to trace them, impersonating the different
esp on the stack, then a one to one (iat/api) could be generated
and the caller's offset corrected into the code itself. Not done in one day I think ;)
(modified 4/2/2001)
tippex/portia wasn't able to send a serious working app to reverse,
I still need a safedisc 2 app/game with iat still mangled just to test
revirgin on it, does someone have a working one ?
TIA,

+Tsehp


Reality Cracking : the supermarket enslaving as a science
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reality Cracking : the supermarket enslaving as a science
PDA

View Full Version : Reality Cracking : the supermarket enslaving as a science

Maldoror
01-24-2001, 04:15 AM
Hi guys,

Some of you probably remember the wonderfull essay by +Orc - "Supermarket enslavement techniques, March 1997".
Obviously since then the things have been moving on very quckly.

Look here:
http://www.fastcompany.com/online/29/sell.html
and here:
http://www.envirosell.com

Nice guys eh...

Greetings!
Maldoror
Muad'Dib
01-24-2001, 11:20 PM
A very interesting article indeed. Big business will do anything to make a few extra dollars. What the reality reverser needs to do is keep in mind all of the tricks used and try their best not to succumb. Don't buy something because it has pretty packaging, buy something because you need it. If the name brand is truly better than the generic brand (which is rarely the case), then by all means, buy it. Reality cracking/social engineering is a very interesting topic...maybe if we had a board dedicated to it we'd see more posts about it. (hint hint tsehp ;)


CommView 2.4 keygen ask you translator..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CommView 2.4 keygen ask you translator..
PDA

View Full Version : CommView 2.4 keygen ask you translator..

agoutinz
01-24-2001, 07:33 AM
http://www.reversing.net/cgi-bin/ceilidh.exe/ceilidh/?C33ee2500500A-4040-4318+1c.htm

.
agoutinz
01-24-2001, 07:39 AM
this one too
http://www.reversing.net/cgi-bin/ceilidh.exe/ceilidh/?C33e68ce4200A-4039-12220+1d.htm

enable cyrillic window-1251 in you browser.


OLD MSGBOARDS ZIPS. Who has them ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > OLD MSGBOARDS ZIPS. Who has them ?
PDA

View Full Version : OLD MSGBOARDS ZIPS. Who has them ?

aimless
01-24-2001, 07:45 AM
Fravia's older message boards. Someone had them. What's the site. It was zipped in some unusual format.

Can someone point me to that site ?
gs
01-25-2001, 08:27 AM
http://www.multimania.com/ephemeric/


vb p-code patching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > vb p-code patching
PDA

View Full Version : vb p-code patching

NikDH
01-24-2001, 08:46 AM
I'm working in a prog that has vb p-code inside
Its protection consists of disabling some voices of the menu and i wanna enable them :)
Coz its a vb prog cant read the resources using a resource viewer but i dont think thats a great mess coz i think the menu voices r disabled by some calls to EnableMenuItem()
The problem comes out when i find out the call to that api and i wanna patch it: its inside msvbvm60.dll which interpretates the pcode inside the prog but i dont have to patch dll but the pcode in the prog
How can i find out the location to patch the pcode?
See ya
NikDH
iorior
01-25-2001, 06:28 PM
You don't say if this is VB5 or VB6...

look at your prog with Hexworkshop (or Hview):
If you see something like that:

.......menu1mnu.....M
enu 1........

in hexa: 0002 0800 6D65 6E75 316D 6E75 0013 0306 004D
656E 7520 3100 0500 FF02 1F00

You can interpret like this:

02 0800 menu1mnu00 1303 0600 Menu 100 0500 FF021F00 0000

just change 0500 to 0400, and the menu is now enabled!!

If you don't have something like that with Hexworkshop, try to find in the dead listing the import fonction ".__vbaObjSet", with WDasm:

* Reference To: MSVBVM60.__vbaObjSet, Ord:0000h
|
:00404A2B E85CC8FFFF Call 0040128C
:00404A30 8945E4 mov dword ptr [ebp-1C], eax
:00404A33 6A00 push 00000000
:00404A35 8B45E4 mov eax, dword ptr [ebp-1C]
:00404A38 8B00 mov eax, dword ptr [eax]
:00404A3A FF75E4 push [ebp-1C]
:00404A3D FF5074 call [eax+74]

change the push 00000000 to push FFFFFFFF (used in the call [eax+74])
for enabled=true

PS: Send me your prog, or tell me where i can download it, i will try.
regards.
iorior


Project Hasp4 memo1 replacementwith Microcontroller
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Project Hasp4 memo1 replacementwith Microcontroller
PDA

View Full Version : Project Hasp4 memo1 replacementwith Microcontroller

John
01-24-2001, 05:39 PM
Hello ,
I have start a project on hasp4 memo1
Hasp4 is replace by a scenix microcontroller +
93C46 Eeprom .
I will try to do my best to explain structure of
communication between Lpt and dongle .
(my english is not to good)
this project is new and in development.

I'm not a master in programmation ,I'm still learning

if someone is interest please visit at :

http://john_scotti.tripod.com/index.htm
Antipodean
01-25-2001, 07:10 AM
The site has already been taken down.
john
01-25-2001, 02:09 PM
Hello ,
I have update files on the web site and had a little
Crash.
The site is now functionnal.

Sorry for the problem.

http://john_scotti.tripod.com/

john
CrackZ
01-25-2001, 04:23 PM
Hiya john btw ;-).

Just a quick greet in public ;-).

Regards

CrackZ.
Czajnick
01-25-2001, 05:47 PM
Is it all based on your own reversing work ?

I was reversing DLL <-> VxD communication some time ago (before I've found sources for some simulator), but It gave me headache ;)

Can U point me on some web resources about HASP reversing (not Zencrack nor Fravia's - I know them well ;) ) ?
John
01-26-2001, 05:45 PM
All my research on the web on hasp dongle has always
found the same web sites. Fravia web site and
4 or 5 sites with always the same pages.
there was 3 projects on this dongle and has stop after
in 1998.

I'm currently working on the dark side of the
hasp to find an easy solution to this virus that infect
a lot of softwares (the hasp4 dongle nightmare !)
I'm using a microcontroller that is easy to program
(cheap hardware programmer) so everybody can easily
make it's own !
no crack , no patch.
I will try to do my best to explain with digital capture
the communications with the dongle.
I will also put [*.LA] files for people that want to study more the captures files.

thanks !

John

Czajnick (01-25-2001 07:47):
Is it all based on your own reversing work ?

I was reversing DLL <-> VxD communication some time ago (before I've found sources for some simulator), but It gave me headache ;)

Can U point me on some web resources about HASP reversing (not Zencrack nor Fravia's - I know them well ;) ) ?
Czajnick
01-27-2001, 05:34 AM
Heh, using some CPLD (Xilinx ? Lattice ?) should be also nice idea, but probably more expensive.

Personaly I think emulating of VxD is better way, than emulating the hardware...
TonyLee
09-28-2001, 09:02 PM
Dear Jonn or any friend

how an mail the microcontroller to Emulator HASP4 for me

Thank You.
goatass
10-01-2001, 08:10 AM
Hey John, this is a good project and I will try to help as much as I can. I suggest also working on figuring out the new haspcode() used in the Encrypt/Decrypt functions.

btw, your web page still doesn't work.

goatass
SyNTaXer
04-14-2004, 05:44 PM
is there any new in this project ?

bye SyNTaXer
cah
06-29-2004, 01:07 PM
How to edit/change Hasp id of hasp4 lock for known pass1 & pass2?
we can edit its memory by haspedit.exe. Is any tool avail like haspgrab.exe for hasp4 dumper/writer?
Please help me in this regard
CaH
SyNTaXer
06-30-2004, 02:22 AM
hi cha !

i've a question to you, how it is possible to get the pass1 and pass2 of an hasp device ?
bye SyNTaXer
Xak
06-30-2004, 05:01 PM
Hasp4 code recovered year ago, we can produce HASP4 M1/M4 USB dongle with your own pwd1/pwd2, secret table, encryption key, ID. No problems to copy HASP4 dongles, cloned dongles 100% same as original. If anybody interested we ready to sale this project (hasp4 programmer, schematics, sources) - leave a PM.

is there any new in this project ?

bye SyNTaXer
SyNTaXer
07-01-2004, 01:14 AM
sorry xak, but black magic should be for free or done byself, never pay for it. bye SyNTaXer
cah
07-04-2004, 05:26 AM
Dear XaK

Is these hasp4 clones without external power supply?
Give me your email id
CaH
cahthere@hotmail.com
tgodd
07-05-2004, 06:42 AM
Hasp4 code recovered year ago, we can produce HASP4 M1/M4 USB dongle with your own pwd1/pwd2, secret table, encryption key, ID. No problems to copy HASP4 dongles, cloned dongles 100% same as original. If anybody interested we ready to sale this project (hasp4 programmer, schematics, sources) - leave a PM.

Recovered the code?!?

The hasp4 is not a processor, it is an asic.
How does one recover the "CODE" from an asic?!?

tgodd
neviens
07-09-2004, 12:39 PM
>...The hasp4 is not a processor, it is an asic.
>

Nope, those days are gone!
CY7C63001A (Cypress micro) + AT25020 (Atmel SPI serial eeprom) + 6MHz
resonator combination is in use in USB HASPs.
Neviens.
HarmEr
07-16-2004, 12:21 PM
Hasp4 code recovered year ago, we can produce HASP4 M1/M4 USB dongle with your own pwd1/pwd2, secret table, encryption key, ID. No problems to copy HASP4 dongles, cloned dongles 100% same as original. If anybody interested we ready to sale this project (hasp4 programmer, schematics, sources) - leave a PM.

2003 year, Jul.
before Glasha take result of our research....
I and Nikita reverse hardlock.sys and find next code:

VOID Transform( PULONG Data, PKEY_STRUCT Key )
{
ULONG i,index,bit;

InitDongle( 2, Key );

for( i = 1, index = 0; i <= 39; ++i )
{
bit = Transform2( ((PUCHAR)(*Data))[index], Key );

index = (( (*Data) & 0x01) << 1) | bit;

if( ( (*Data) & 0x01) == bit )
*Data = (*Data) >> 1;
else
*Data = ( (*Data) >> 1) ^ 0x80500062;
}
}

after it we make direct Hasp4 hardware access and build tables for analise.
3 days later i keep full Hasp4 encryption algo, and for reproducte it need only 37bit.

But atm i have one question.
Hardware contain algorith for convert pass->SecretTabel (for hasp v1.1) or pass->MagicWord (encryption key)?

Xak... do u answer on this question?


wondering if such a thing exist? can you help?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > wondering if such a thing exist? can you help?
PDA

View Full Version : wondering if such a thing exist? can you help?

Morlac
01-24-2001, 06:45 PM
Hi All,

Im looking for a tool/Ida script preferably that can rip a function to file so that i can compile it separatley. I know i can do it manually but im almost sure that i've seen something that does a similar job automatically.
Anybosy knows about it?

Best regards to all.

Morlac
Nolan Blender
01-24-2001, 11:19 PM
What do you mean "rip it automatically"? The code generated by
IDA can be cut and pasted into TASM assembly files. I suppose you
could write something that generates the required TASM headers
and digs out the references to the data segments and externals,
but this is usually fairly minimal work.
Morlac
01-24-2001, 11:24 PM
Hi Nolan,
By automatically i meant a script/plugin that given the function will exract it with its data references and if it can walk through xrefs then it would be nice.
Of course that script/plugins does not exist yet, but i think that i found something new to work on. :-)

Morlac,
disavowed
01-25-2001, 07:24 AM
"tmg ripper studio" is capable of this (as long as you tell it the beginning/ending offsets for the function)
Iceman
01-25-2001, 07:34 AM
I wrote one. Check e-mail later.
Morlac
01-25-2001, 06:08 PM
Thanks everyone.
And cheers Iceman.

Morlac
90h
01-25-2001, 08:14 PM
HI Iceman,
Can you send it to me too.
Nolan Blender
01-25-2001, 11:42 PM
Iceman (01-24-2001 21:34):
I wrote one. Check e-mail later.

Cool - glad to see that there are people writing
nice addons to IDA.
NeO'X'QuiCk
01-26-2001, 12:28 AM
Can you send it to me to Iceman?Or anyine that has it!!

Thanks to anyone that will send it to me !!Especially to Iceman that is writing stuff like that!

NeO'X'QuiCk
Iceman
01-27-2001, 04:44 AM
nop , neo , Ill send sorces next week , after midweek.
lvcita
01-27-2001, 10:43 AM
Hi iceman: I want it too!.
Greets and Thanks in adv.
NeO'X'QuiCK
01-27-2001, 12:23 PM
Iceman that article was posted before a your reply!!I will wait no problem!!

NeO


some help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > some help
PDA

View Full Version : some help

mustapha
01-24-2001, 07:39 PM
I ahve a program and it has 2 edit boxes to register it. One is for the name and the other for the pass. I put my name and a fake number. So a messageBox will appears telling me that it is wrong......

I added some code to the program to show me the real pass in that messageBox.
I found a pleca with 'ceros' to add this code but only one time it worked. Now it appears a Mssbox saying 'Acces violation at address 00484483 in module "ProgramName.exe". Write of address 004844C0'.
The first address is where i write this:
:00484483 mov [004844C0], EAX.
The second address is where i want eax value to be stored.
I do not know why it happends, i am working in a place where there's a lot of 'ceros'. And i changed the Characteristics with ProcDump of CODE from 60000020 to F0000020.
I am trying to pass from cracking to reversing.
If someone give me some hint, i would be grateful.
Thanks a lot.
Kayaker
01-24-2001, 09:09 PM
Hi Mustapha,

>And i changed the Characteristics with ProcDump of CODE from 60000020 to F0000020

I hope you mean E0000020 ;)

That part's right, it makes the characteristics of the section 'writeable' as well as executable. I've occasionaly had problems adding code to the CODE or .text section. It seems that sometimes not all parts of the .text section are loaded into memory yet when you want to use that memory for your own code, leading to an error. Not sure if this was the cause of your problem.

You could try adding it to the .idata section (again changing the code flags) right after the Import table, there's usually a big bunch of zeroes there. You have to be careful there too though. You can add a little bit of text to the start address of your patch in a hex editor, then do a search for it SoftIce just to find it and see if that area in memory remains untouched by the program during normal operation.

The other option of course is to add your own section. Various tools around to do this I guess. I use PEditor - add a section, change the Raw and Virtual size of the section, update the Size of Image and Characteristics, add a bunch of bytes with a hex editor. Gives you as much room as you want, no chance of conflicts, and besides it's fun to name a section after yourself ^_^

Cheers,

Kayaker
mustapha
01-24-2001, 10:53 PM
Nooooohhh,
You will not forgive me!!!!
Now i know why it works one time and then is does not work.
Because i was so tired, i confused 'F0000020' with '70000020'.
Well, i took this number from a SantMat tutorial.
With E0000020 it is OK too.
But now I want to learn more, about this number, section, .idata, ect.
Some recommendation will be great!!.
(PD: i also confused A->4, i need some rest.....)

Mustapha
hz
01-24-2001, 11:02 PM
Hi,
Topo (protools) is an excellent util for doing
what you want and probably simplest. One thing to check though is that the serial string is still at the address when the message box pops up, sometimes its overwritten or memory de-allocated. Unless of course you plan on copying the string.
regards
Kayaker
01-25-2001, 02:09 AM
mustapha (01-24-2001 12:53):
Nooooohhh,
You will not forgive me!!!!
Mustapha

Heh heh. Oh sure I will, if you forgive me for every gaff I've made while reversing (I think I only made 3 or 4 tonight) ^_^

PEBrowsePro is a good tool in helping to understand the structure of PE files. As for references, you can't go wrong with Iczelion's PE tuts.

Keep up the good work

Cheers,

Kayaker
Kayaker
01-25-2001, 02:46 AM
OK, make it 5 gaffs tonight ;) Just to set the record straight, the code characteristics

70000020 mean
shareable in memory, executable as code, readable, contains executeable code

and

F0000020
is as above plus writeable

E0000020
is as above without the shareable

So I guess F0000020 would be OK too. I'm curious now why the SantMat tutorial recommends using F0000020. Do you have a link for this tut?
mustapha
01-25-2001, 06:56 PM
this tut can be found at http://reversemes.immortaldescendants.org/reversemes.html
Reverseme#1 by Defiler
Solutions by: SantMat


+Tsehp - Cbuilder 4 essay question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > +Tsehp - Cbuilder 4 essay question
PDA

View Full Version : +Tsehp - Cbuilder 4 essay question

vgb
01-24-2001, 11:05 PM
+Tsehp - Been trying to follow your essay on CB4 and apply it to CB5. Getting confused by your references to Boundschecker. You mention using BC and then show a listing that looks like IDA. I can follow what's happening in your listing (sort of :-D) but I can't quite see how to locate it in BCB5. I guess I'm looking for a shortcut provided by Boundschecker - probably should step thru in sice until I see some code that's familiar?

Thanx,

vgb
tsehp
01-25-2001, 06:43 PM
hi,
can you paste here the part where you have the problem ?
I'll take a look after. mail me when you have done it please.

regards,

+Tsehp
Nolan Blender
01-25-2001, 11:44 PM
I think CyberHeg address some things with CBuilder 5 in one of his essays too.

--nb.
NeO'X'QuiCk
01-26-2001, 12:19 AM
Can you post Url of those tuts??vgb
vgb
01-26-2001, 01:07 AM
+Tsehp (01-25-2001 08:43):
hi,
can you paste here the part where you have the problem ?
I'll take a look after. mail me when you have done it please.

regards,

+Tsehp

This is the part that has me confused.

After I saw what's going on I decided to emulate inputs. The delete approach is effective but not elegant. Stop, I found timefix.exe.

***Where is timefix.exe???

Sweet - references to HKLM\SOFTWARE\Ntpad\HELPMENU\tin and some more... Try now run the trial with Boundschecker. Sysprst,.... GetLocalTime!! 0x00d217d =0x004d217d

**How to get this info from Boundschecker? When I run the trial and try to get info by clicking on an event, bc aborts. How does the sysprs7.dll ( bcb5 version) figure in this? I RTFM on Boundschecker but I don't see the answer.

Finally, the code below is found in what file? The bcb.exe, a dll,??

Let's see:

_0000010:004D6900 sub esp, 0CCh
_0000010:004D6906 lea eax, [esp+0CCh+var_BC]
_0000010:004D690A push esi
_0000010:004D690B push eax
_0000010:004D690C call ds:GetLocalTime

Thanx for the help,

vgb
vgb
01-26-2001, 01:09 AM
NeO'X'QuiCk (01-25-2001 14:19):
Can you post Url of those tuts??vgb

NeO'X'QuiCk -

They're all on +Tsehp's excellent Fravia Mirror. I believe the link is at the top of this MB.

vgb
tsehp
01-26-2001, 04:36 PM
vgb (01-25-2001 15:07):
[quote]+Tsehp (01-25-2001 08:43):

**How to get this info from Boundschecker? When I run the trial and try to get info by clicking on an event, bc aborts. How does the sysprs7.dll ( bcb5 version) figure in this? I RTFM on Boundschecker but I don't see the answer.

Finally, the code below is found in what file? The bcb.exe, a dll,??

Let's see:

_0000010:004D6900 sub esp, 0CCh
_0000010:004D6906 lea eax, [esp+0CCh+var_BC]
_0000010:004D690A push esi
_0000010:004D690B push eax
_0000010:004D690C call ds:GetLocalTime

Thanx for the help,

vgb

Ok I understand wher the problem is, you didn't saw the line on my essay : copied from macillaci's essay ;)
So you cannot find timefix because his essay was on another sentinel
target.

Lets get to it, it's very simple if you know that a time based protection
needs to have the number of days spent since the first install.
So you start the target with boundschecker, using the main exe,
then after it was loaded, look at the log file and you will locate all
the getlocaltime / getsystemtime used by the target before it decided
to load, the job is to locate the good one by tracing further in the
code.

On the listing you pasted, you must look after how the target uses
the values given by the getlocaltime function, then you emulate inputs
meaning you patch the code the force the registers to always contain
legal time values, calculated while you were into the trial period :
_0000010:004DBD76 mov esi, 38820632h
_0000010:004DBD7B mov edx, 0BC2C84B2h
_0000010:004DBD80 nop

those values comes from softice, still on the time trial period, so your target runs forever.
vgb
01-26-2001, 06:06 PM
OK - I see it now. I don't use Boundschecker much so I was a little lost. One thing I still don't follow - did you get the address of the getLocalTime function from Boundschecker or from a xrf in IDA or SICE? I can think of several ways to do it but hte essay implies that the ogffset is shown in boundschecker and I don't see that. I'll check the manual and listings to see if I'm missing something.

BTW, how do you get the emoticon graphics *inside* the message? tried cut/paste from the legend but didn't work.

Thanx agaion for the help,

vgb
tsehp
01-27-2001, 01:53 AM
hi,
first question :
when in boundschecker you select the right line, corresponding to the
api, if I remember well you've got the address of the caller at the
right top of your monitor , ex caller : bcb + $1524 , meaning bcb base
address + offset 1524.

second question, when you write your post, just click the link at your left, called emotions legend , you do the smiling face like this :) ,
: + ) without space or + sign.
vgb
01-27-2001, 08:37 PM
OK, I got it now.:) Finally solved my problem with the tut. Boy, am I embarrassed. I was using HIEW to assemble the code to insert in the various files. Wasn't paying attention - MOV edx,12345678 assembled as 66 ba 78 56 34 12 rather than ba 78 56 34 12. Of course after substituting, nothing worked!:-D -

Anyhow, I got the trial cracked but most important, got more familiar with IDA and boundschecker. Thank you very much for the help - I know you're busy with the revirgin project and it's tough to go back to something you did a year ago.

I included some smileys in the post - let's see if they show as graphics.

vgb
macilaci
02-01-2001, 02:31 AM
Hi vgb,
I know I'm a bit late, but still here... The time/date checking subroutine returns an encrpted or coded time structure inside eax (32bit). When you need emulate inputs (date is still the same), you need to replace the result of this subroutine by a constant. Of course the target one version higher and you need check many other things (improved protection! - don't forget that). Don't forget to delete the sysprt and other files and registry entries otherwise the target won't work. After patching it creates these entries. You can leisurely reinstall the patched target without deleting these newly created 'protection files and registy entries'.

regards
macilaci
vgb
02-01-2001, 10:36 AM
Hello Macilaci -

Thanx for the additional input. It took a while but I have the target patched and functioning. There were 10 files that needed the patch along with the registry entries and other files to be deleted. I found that the install magic number is constant for each machine, different, but constant.

Thanx,

vgb


lest we forget -- M$ does
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > lest we forget -- M$ does
PDA

View Full Version : lest we forget -- M$ does

Antipodean
01-25-2001, 06:21 AM
http://onenews.nzoom.com/news_detail/0,1052,26998,00.html
http://www.nzherald.co.nz/storydisplay.cfm?storyID=169715&thesection=news&thesubsection=general


FLEXLm 7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXLm 7
PDA

View Full Version : FLEXLm 7

Czajnick
01-26-2001, 09:00 AM
Hmm, I've got 2 targets protected with FLEXlm 7.0c and 7.2a (!).

They're already patched other ways (in one case patching lc_checkout to return 0 was enough. Fools...), but It made me think a little about new versions of FLEXlm...

Trying to use FLIRT signatures generated with FLEXlm 7.0a libs gave me nothing...

So, here are question for our FLEXlm experts:
- are there many significant changes(improvements) between v6.1 and v7.0 ?
- --"--- between v7.0 / v7.2 ?
- anyboody there got SDK v7.2 ?

Greetz
Perry
01-26-2001, 12:32 PM
I´ve flexlm 7.2a SDK. I´ll send you, to be patient.
Kythen
01-26-2001, 04:20 PM
FlexLM v7.1 and above use digital signatures made with elliptic curve cryptography. Globetrotter used the Certicom SDK, so unless they messed up the implementation... you're not touching it. However, if your target uses 7.1 or greater, but keeps the old style license, you can still make licenses for those programs.
I haven't run into any targets using 7.1 or 7.2, so I haven't had a chance to look if anything is different as far as finding seeds/keys goes. If you find anything new, please let us know :)
Czajnick
01-27-2001, 05:39 AM
They finally learned a bit about cryptography ? ;)

I wonder why they don't use well known private/public key crypto algorithms from the start...


Where to find tut or how to unpack manualy Pecrypt32 1.02!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Where to find tut or how to unpack manualy Pecrypt32 1.02!!
PDA

View Full Version : Where to find tut or how to unpack manualy Pecrypt32 1.02!!

NeO'X'QuiCk
01-26-2001, 03:58 PM
Sublect says it all

NeO


For iCEman!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > For iCEman!!!!
PDA

View Full Version : For iCEman!!!!

NeO'X'QuiCk
01-26-2001, 04:04 PM
Im looking for a tool/Ida script preferably that can rip a function to file so that i can compile it separatley. I know i can do it manually but im almost sure that i've seen something that does a similar job automatically.
Anybosy knows about it?

i would like if you could send it to me to!!

Thanks NeO
Iceman
01-27-2001, 04:40 AM
mail me pls next week (after midweek) to remember and Ill send you the sources after fixing some minor issues.
NeO'X'QuiCk
01-27-2001, 06:49 AM
Thanks man i will!!

NeO'X'QuiCk
NeO'X'QuiCk
02-01-2001, 12:36 PM
Where to get the email of Iceman!

NeO
90h
02-01-2001, 08:15 PM
i just e-mail iCEman with one off this post(white_ice*usa.net)
NeO'X'QuiCk
02-02-2001, 11:28 AM
Thanks!
NeO'X'QuiCk
02-02-2001, 11:34 AM
But the email does not work!!

NeO
90h
02-02-2001, 09:38 PM
Sorry well it look like i'm looking for his email to then

PS
you did make the * in to a @?
NeO'X'QuiCk
02-03-2001, 09:43 AM
Thanks that works i hope he will answer!

NeO'X'QuiCk


The Business Software Alliance
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > The Business Software Alliance
PDA

View Full Version : The Business Software Alliance

woodmann
01-26-2001, 05:55 PM
I recently recieved a letter from the Business Software Alliance stating that they have called a "truce" and that I may apply for license's for any unregisitered/unlicensed software.
http://www.bsa.org

Now here's where it gets a little vague, The second page goes on to explain how copyright laws are being infringed upon by making and distributing pirated copies of software. Blah Blah Blah you cant install on 100 computers and so on.
Yes that I understand.
What I dont understand is, what about the installed software that came with the computer and what if I bought software from a friend who had no need for it. I have a license, but the people who made it only got paid once. What about software I have downloaded and paid for but have no paper license?

I could not find any info on these 3 topics.
Oh and it goes on with a threat of a 150,000 dollar fine and/or jail time.
This smells rotten to me. Any thoughts?
Predator [PC/pGC]
01-28-2001, 05:27 AM
hello there...

first of all, the bsa talks a lot of pre-mature threats.. they are not the police they have no rights; they can only pass stuff on

saying they want a truce makes them vulnerable

passing on software asking others money for it, hmm i'm not sure about this.. the company gets paid for the license once, but if the 'seller' deletes the software and the 'buyer' installs it there's still only 1 person using the software - i'm not sure if it works like that though

you should ask some law dude really ;)

the 150g and jailtime is just another threatment..
i'm not saying you shouldn't take this serious at all; but bsa is about a lot of propaganda and less action..


Multiple safedisk checks ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Multiple safedisk checks ?
PDA

View Full Version : Multiple safedisk checks ?

gimmee
01-26-2001, 07:16 PM
Hi all

Been slowly cracking this cd i bought from amreica protected with safedisk. Anyway after dumping and rebuilding it heaps of times i still had the safedisk check. What i have found is my dumped and rebuilt icd works fine. Safedisk had actually been removed like most of the tuts on safedisk do. Trouble was when u run the program it then creates a temporary *.exe and *.icd file and does another safedisk check with these 2 temp files then deletes them after the check. I managed to wipe out this safedisk (i presume safedisk routine) by patching my newly dumped icd. No wonder the game took so long to load with 2 whole safedisk checks. Now it loads in a second or 2. The program does this whole process again at another time on the cd which i patched also. Everything works fine with the crack on the original, copy, and on other freinds puters.

Except, always an except. When u install the game for the first time the D:\setup.exe is another safedisk routine. So it goes through all this safedisk stuff again before handing over to the install shield routine. So now i need to crack the setup.exe and setup.icd as well. If i use the original cd till u get to the first install shield screen then swap to my copy cd evrything works fine.

Has anyone else seen safedisk used like this on a cd program. Seems like they are real parinoid someone is going to copy thier cd. Just looking for any thoughts or replies on cracking the setup.exe and setup.icd file on the cd. Think i will just try and dump the setup.icd file when it is decrypted, rebuild it and see if that works as a safedisk free setup.exe Will keep trying with this last safedisk check. 3 checks down 1 to go.

Might have to write a tut on this one aye

cya all

KiwiLand
gimmee
01-26-2001, 09:55 PM
Answered my own question.

Managed to remove safedisk from the setup.icd file and rebuild the import table. Copied cd works fine now with all 4 safedisk routine calls removed.

:):):)
risc
01-27-2001, 03:52 AM
you so lucky! 4 safedisc exe's for the price of one!

i got ra2 and was rewarded with 3 exe's for the proce of one.. but ive never seen 4 on one game before!

heh, u lucky bastard


Can patch a DLL... strange
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Can patch a DLL... strange
PDA

View Full Version : Can patch a DLL... strange

mozfet
01-27-2001, 07:36 AM
Hi there!

I'm working on TinaPro Student V5.5 eval

I can start the software with Softice.

The control is made in a external DLL called CKI3203.DLL. So by jum fix I can start the software.

Maybe when I would patch the DLL, all work in the DLL, maybe when the software come back in the principal exe (TINA.EXE) there is invalid section...

Any idea????

in the folder is a file called CRYP95xx for information

Thanks
Kythen
01-27-2001, 02:40 PM
It would appear you have a Crypkey protected app on your hands. Specifically Crypkey's packer (I think it's called Casper or something like that). There are a few good tutorials on TSehp's site that should point you in the right direction for fixing your problem :)


Cracking web authentication via dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Cracking web authentication via dongle
PDA

View Full Version : Cracking web authentication via dongle

AY
01-27-2001, 10:04 AM
Is there any way to crack web authentication, where the authentication routine is performed on a server rather than the PC at home ?
I'm talknig about a secure site system that looks for a dongle on the client side and let him login only if a dongle is present (a dongle that connects directly to a USB port on the client side).
other examples of web authentication, is for example the Q3Areana check for correct serial. it won't let you join the game unless you have a good non-blacklisted serial. The check is on the authentication server.


Strainer ????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Strainer ????
PDA

View Full Version : Strainer ????

Agent G
01-27-2001, 09:08 PM
when the new strainer will be published ?
A+heist
01-31-2001, 01:58 AM
If you'r referring to the +HCU strainer I doubt that there will be any this year. The +HCU is scattered, and most of its members are not working on windows anymore, see our messageboard at http://mb.hcunix.org/

A+heist


Question about memory mapping
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Question about memory mapping
PDA

View Full Version : Question about memory mapping

Kayaker
01-28-2001, 02:40 AM
Hi All,

I've developed a curiosity as to the exact process that occurs when a program first starts up, specifically what determines what sections are mapped into memory at the Program Entry Point.

It's sort of like exploring the precise moment of the Big Bang - what exactly happens when you load a file in SoftIce Loader and press that first F8?

Take Notepad as an example. Here are the sections and their Virtual Sizes:

.text :00401000 00003E9C
.data :00405000 0000084C
.idata :00406000 00000DE8
.rsrc :00407000 00004FB8
.reloc :0040C000 00000A9C

At the Program Entry Point of 4010CC, the only sections that are committed to memory are the 1st 1000 bytes of the .text section, the full .idata section, and the 1st 1000 bytes of the .rsrc section. As you step through the program you can find where the other bits and pieces are memory mapped by monitoring the Data Window.

Now I can live with the .text, or code, section being mapped piecemeal 1000 bytes at a time, but I'd like to know what determines which sections and how much of each is mapped into memory in that very first instance at the Program Entry Point. I've been burning up various PE documentations for clues, but nothing seems to jump out at me. Are all sections treated equally? Could you force a program to load the WHOLE of its .text section upon startup, irrespective of any later code which might be involved in doing this?

For Notepad the Program Entry Point and register values are below. What information is here concerning what's to be mapped into memory as soon as you F8 over that first magic PUSH EBP? Are the values in ECX, EDX and ESI significant?

EAX=004010CC EBX=00000000 ECX=8171B660 EDX=8171B6A0 ESI=8171B640
EDI=00000000 EBP=0063FF78 ESP=0063FE38 EIP=004010CD

0167:004010CA 0000 ADD [EAX],AL
0167:004010CC 55 PUSH EBP
0167:004010CD 8BEC MOV EBP,ESP
0167:004010CF 83EC44 SUB ESP,44
0167:004010D2 56 PUSH ESI
0167:004010D3 FF15E0634000 CALL [KERNEL32!GetCommandLineA]

You may rightly wonder why I ask such strange questions. Specifically, I have a packed program which, during the unpacking process every section is mapped into memory in the regular program address space, and then it jumps to the OEP and the program runs fine. Unpack the program and partway through the code there's a Runtime error because part of the .text section is not mapped into memory yet! Hence my interest in committing the entire .text section to memory on program startup, but this is as a general interest question as well.

Any light shed on this mystery of Windows is appreciated ;-)

Regards,

Kayaker
carpathia
01-28-2001, 04:51 AM
This question is more to do with paging, than the loader itself.
If you take another look, you'll notice that the committed blocks are not 1000 bytes in size, but actually 4096.

When a request is made to read a certain virtual address of the image, the kernel consults the paging directory to see if the page contained by that address is in physical RAM. When it finds that it cant be found in ram, a page fault occurs.

VMM32 handles this page fault, loads the 4k page from disk into memory, and then re-executes the instruction which caused the page fault. Second time round of course, the page is present, and no page fault occurs. All this is totally transparent to the process itself.
Kayaker
01-28-2001, 01:48 PM
According to The Portable Executable File Format from Top to Bottom by Randy Kath, the heap and stack sizes are controlled by

"SizeOfStackReserve, SizeOfStackCommit, SizeOfHeapReserve, SizeOfHeapCommit. These fields control the amount of address space to reserve and commit for the stack and default heap. Both the stack and heap have default values of 1 page committed and 16 pages reserved. These values are set with the linker switches -STACKSIZE: and -HEAPSIZE:."

I tried changing the sizes of SizeOfStackCommit and SizeOfHeapCommit in the Optional Header from the default of 1 page (4096 = 1000h bytes), but it had no effect on how much of each section was actually loaded on startup.

Luevelsmeyer seems to indicate that the stack will grow in pages no matter what these PE settings are. So as you mention, it may be VMM32 controlling this.

"The 'reserved' amounts are address space (not real RAM) that is reserved
for the specific purpose; at program startup, the 'committed' amount is
actually allocated in RAM. The 'committed' value is also the amount by
which the committed stack or heap grows if necessary. (Other sources
claim that the stack will grow in pages, regardless of the
'SizeOfStackCommit' value. I didn't check this.)
So, as an example, if a program has a reserved heap of 1 MB and a
committed heap of 64 KB, the heap will start out at 64 KB and is
guaranteed to be enlargeable up to 1 MB. The heap will grow in
64-KB-chunks."
Iceman
01-28-2001, 03:18 PM
It seems that you confuse some things ....
In the first place what "comitted" memory means.
When the PE loader maps a PE image into memory
(the process is not quite simple so I wont describe it here in detail) it will commit the entire address range occupied for image . Whatever
the memory will be actualy present or paged out ,
thats another issue. (Softice will dispaly ?? ?? ?? ?? for paged out memory too , not only for reserved memory ).
Second , that heap and stack size has nothing to do with how the image is mapped in memory .
They control exactly what their name suggest:
stack and heap .
If you are really interest in what happens in detail , I can explain it for you providing you have a basic knowledge of protected mode and paging.
And read a good article about virtual memory management on NT to clean up what "commited" ,
"reserved" , paged-out memory means.
Kayaker
01-28-2001, 05:16 PM
Thanks Iceman and Carpathia. I am no doubt confused by this aspect of program operation ^_^

I am interested in understanding this, so I'll do a little research and get back to clarify things with a more informed background.

Cheers,
Kayaker


BitArts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > BitArts
PDA

View Full Version : BitArts

NchantA
01-28-2001, 04:21 AM
i was wondering if anyone had any material, urls or something to say on softlocx protections.

NchantA
Kilby
01-28-2001, 02:55 PM
I havn't looked at softlocx but I have spent a few hours with Cruncher 2.

If Cruncher 2 is an example of their idea of security then their other products should be pretty easy.

Kilby...
NchantA
01-29-2001, 10:49 AM
hey guys, im particularly looking for info on softlocx

i am not 100% sure that the program im having trouble with is softlocx but thats what im guessing...

kirb can u send me your tut plz? any help is appreciated

NchantA
Kilby
01-29-2001, 12:31 PM
Hi NchantA,

I have attempted to send the doc (& test file) to Tsehp, but his mailbox is down.

So from the previous message here ArthaXerXes is posting it on his new system The Nexus.

I ain't got the URL on me at the moment, so either ArthaXerXes can post the URL, or Tsehp can pass on another mail address, so he can post the tut on the RCE site.

If nothing happens in the next 24 hours I will make alternate arrangements.

Kilby...
LaptoniC
01-30-2001, 05:28 PM
Your essay good however softlocx needs patching after unpack.There is levels for license you should patch .I couldnt managed to find it but you can try Pic2html http://home4.inet.tele.dk/palsbo/download2.html I have found one softlocx unpacker by Chafe but it didnt worked on this.
Regards
Kilby
01-31-2001, 04:02 AM
Oops posted the reply in a new threas, called copylocx.

Kilby...
Kilby
01-31-2001, 04:54 AM
Hmmm, just had a look at that prog,

The exe is packed with a (I assume) older vesion of cruncher, so atleast my weekend wasn't totally wasted.
+SplAj
01-31-2001, 06:58 AM
Gentlemen,

This exe is packed with crunch, BUT the protection is by .......................

Softguard6.ocx from Russell Anderson
(1997 home made protection)

This parasite is installed in your Windows directory ;)

Nothing to do with Softlocx 4 or 5

+SplAj
Kilby
01-31-2001, 08:20 AM
I'm in work at the momentand the only thing I have with any form of dissassembler is hiew.

In reality I'm trying to get a bit of experiance of dumping wrapped files, and as I had a very easy success with Cruncher, so I thought I would build on that victory.

Kilby...
NchantA
01-31-2001, 08:21 AM
"I have found one softlocx unpacker by Chafe but it didnt worked on this."

could send me (nchanta@nchanta.com) or give a url where i could get this softlocx unpacker plz?

its worth a try ;) (hi r!sc) ;D

NchantA

btw thanks for clearing that up splaj+
+SplAj
01-31-2001, 08:57 AM
www.exetools.com

unlocx5 in unpacker section ?

I managed to manually unpack all BA softs
- take care the IT is dESTROYEd when you dump. So catch the IT while its mapped then
dump that section. Rebuild after
The Owl
01-31-2001, 04:27 PM
now that several more knowledgable people on softlocx have shown up here, i'd
like to pose a problem which i can't solve as i don't have the time for it. for some
reason, the latest 6.022pre version is detected by the softlocx wrapper which i
think is more like an accident (my bug ;-)) than any conscious effort on their part
(6.021 is ok). i'd really appreciate if someone took the time and told me what
check fails (or rather succeeds) so that i could fix it. note that the issue is about
detecting winice, it has nothing to do with the icedump tracer which is fooled by
another thing i didn't yet emulate (int 1a/02, the last pre release actually has code
for emulation, so you could test it too once the real detection issues is solved).
thanks for your help in advance.
NchantA
01-31-2001, 11:50 PM
yo +splaj, but i couldnt find the unlocx on exetools under unpackers...

aswell as being so stupid i cant dump this thing, i also accidentaly played with my system clock, and now its bloody expired...

any ideas hehe ;)

NchantA
NchantA
01-31-2001, 11:57 PM
um nm about unlocx i found (good ol google) but its still bloody expired ;D
Solomon
02-01-2001, 03:07 AM
Here is a cracking tutorial for BitArts Fusion v1.0 by lazarus:
http://www.qwikpages.com/backstreets/krobar/serial/ser88.txt
+SplAj
02-01-2001, 03:34 AM
To re-enable B-A trial

1) find 'netdet.ini' in your Win folder
delete any section that says :-

[Routing.extent{CRITICAL ENTRY}]
NetDatKCR for the targets name and delete this. See a load of binary. Thats it.

After doing BOTH of the above. Restart the app and the trial begins.......

Hint.
Use TRW2000 AFTER the registration window has loaded and set a BPX TerminateProcess. Then
tarce in to the real exe from the 'insXX.tmp' (mutant) and search for the real IT being built

Big clue there is more than just kernel32.dll ;)
andd the destroyed IT has the FIRST letter of
the API name remaining only (eg RegQuery.. become R..........)

Dump this section when built in memory. Then dump at OEiP . Replace crap section with good dump and thets it. You still have to patch the unregistered flags though :)

Use DEDE by DaFixer as it's Delphi NOT ASM as they claim.

Should have kept my mouth shut as i'm fed up with this old stuff.....

BTW.1 the unpacker needs bug fixing if you use WinNT or 2K. The PE header is only ok for Win98.

BTW.2 NchantA, was that your serial for ColorPilot4.04 ??? tell me how you got the reg window to appear. I had to use DEDE to get the TFORMS and switch the about window for the Reg window, plus my reg key is 1 char different to yours :)

SplAj


Vender Key Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Vender Key Question
PDA

View Full Version : Vender Key Question

shymu
01-28-2001, 08:07 AM
I generated a permanent license with flexlm which works perfectly,
however if I try to generate one with a date to expire I get a
message " vender keys are expired". Will my permanent license
expire at some point or do the keys only expire within Flexlm
and not the target. Nolan had mentioned something about demo
programs having vender keys that expire and to use lmrecode to
generate new keys but I'm not clear on this. I have lmrecode.c
but I don't know what to do with this C file. Just when I thought
I learned something I'm lost again. I looked for essays on this.
Any help would be greatly appreciated.


Target use Flexlm 6.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Target use Flexlm 6.0
PDA

View Full Version : Target use Flexlm 6.0

Perry
01-28-2001, 05:14 PM
I just find this on my target
...............
using lmvkey5 1.0, I check and verify the vendor codes, although i've the real seed (verify) at the point:
...............
They are the same up, but genlic32 no give me a valid license, I intented to use lmcrypt but i get error on the link.

I don't know if my target use Crypt Filter. My target has all protection code inside and no make anything call outside.
Someone have a idea.
Czajnick
01-29-2001, 04:22 PM
find lc_set_attr , bpx on it (or trace it calls using Ida) - then you'll see what attrs it set - maybe custom hostid, or crypt filter ?
PadsPCB
02-16-2001, 04:38 AM
Hi
I had lots of troubles with that also.
You must try using the last "working" licensing scheme.
Get LmRecode, from Nolan Bender, at __CrackZ site
Get FlexLM SDK 7.0d (d not greater)

As you have the seeds, generate new version 7 keys
Make LmCrypt
Try now, if they dont use any other scrambling it should work.
LmCrypt license.dat -verfmt 6

If you don't know where to find the files, look at my post under TOT

Best

PadsPCB


Why winzip passwords can't be cracked...can i understand ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Why winzip passwords can't be cracked...can i understand ?
PDA

View Full Version : Why winzip passwords can't be cracked...can i understand ?

__DuDu__
01-29-2001, 10:24 AM
i'll say what i know someone plz correct me if im wrong

well if i set for example XXX as password the password ins't saved in the zip file a CRC is made with the password then when the user enter the password it is compared to the CRC and if equal the file is extracted else gives a error msg..is it right ?

ok i know how brute forcers work but how AZPR do xxxx password per second ? how do they work ? like it can sound dumb but shouldnt winzip password dialog get opened and with something like 'sendkeys' send the passwords to winzip password window..oh i don't understand..someone plz xplain me !

[]'s

DuDu
mike
01-29-2001, 11:21 AM
The CRC of the file is stored in the header. When you type in the password, the program initializes the stream cipher. It then decrypts the first twelve bytes of the encrypted file. The last byte should match the high byte of the CRC of the file that was stored in the header.

One out of 256 passwords are going to pass this test on any given file, so the rudimentary zip attack programs require you to have around four files archived in the zip file. This way, there's only a 1/(256^4) or one in four billion chance of a false positive.

Sometimes they say that with WinZip you can get by with fewer files or run faster. This is because there are two check bytes in WinZip files. The bytes are compared against the high word of the file CRC, thus squaring the effectiveness of each file.

The good pw crackers use knowledge of the compression method to filter bad passwords. They reconstruct the huffman trees and some other tables and check that everything is valid. This allows them to use a single file.

All of these methods rely on guessing the password and then checking against known plaintext. With a really long password, even if it's only alpha characters, it just takes too long.

The *really* good WinZip cracker (the one I wrote, see www.accessdata.com) eliminates 2^58 possible keys at a time, enabling one to brute-force the 90-bit keyspace in about two hours, no matter what the size of the password. It does require five files in the archive. I've submitted a paper for publication, and should find out next month if it has been accepted. Once the details public, I'll post a link to the paper on this site.
mike
01-29-2001, 11:24 AM
90-bit keyspace

sorry, meant 96-bit space (three dwords)
__DuDu__
01-29-2001, 02:56 PM
Man, thanks now things are clear for me. i'd like to know about the encryption that softwares like word, excel, winrar & others use, waiting to see your paper ;)

[]'s
DuDu
mike
01-30-2001, 11:10 AM
Word & excel store three 16-byte values in the file. Look for 01 00 01 00 at a 16-byte boundary and they follow immediately afterwards. I'll call these three first, second, and third.

To check a password, you do the following:

RC4Init(LM(LM((LM(pw) + first) x 10h) + 00 00 00 00))

where LM(a) is the first 40 bits of MD5 hash of a, + is concatenation, x N is repeated concatenation N times.

Decrypt second and third.

If MD5(second) == third, then the password is correct.

The source to RAR encryption is available at RARsoft's site. The file is CRCCRYPT.C


Lord Caligo's Fantastic World of Cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Lord Caligo's Fantastic World of Cracking
PDA

View Full Version : Lord Caligo's Fantastic World of Cracking

mike
01-29-2001, 12:05 PM
Can anyone point me to a mirror of this site? (All the links I've found are dead.)
disavowed
01-29-2001, 03:40 PM
:P
NchantA
01-30-2001, 05:22 AM
lol disa ;)
mike
01-30-2001, 10:02 AM
Hey, if asking other folks that are in the know isn't research, dunno what is ;D
Kayaker
01-30-2001, 05:15 PM
Not sure what all the knowing smiley-faces are all about, but here's a link to what's probably a bunch of long-dead links:

http://members.tripod.com/**__censored_by_request__**

^_^
Kayaker
01-30-2001, 05:42 PM
Well whaddya know, I did Disavowed's Easy Research Challenge without even knowing about it ;P

Guess I better try some of the others now...
Kayaker
01-30-2001, 05:52 PM
Sorry about that BTW, I plead ignorance :(
mike
01-30-2001, 06:02 PM
Thanks, although the actual address ought to be stricken from the message board if it's going to remain a challenge. How did you find it, so I can learn the skill instead of being a "cheater"? ;D

I checked every search engine I could think of.
Kayaker
01-30-2001, 06:16 PM
Hi,

I just sent an email to +Tsehp and Disavowed asking that my post be deleted. Feel like a shit now }>

It was just an old bookmark I had, nothing tricky about it. I knew nothing about the challenge when I replied.

Regards,
Kayaker
gs
01-31-2001, 09:51 AM
According to my logs I found it using a very large SE :)
And I did not find it on the direct way.

Is that help enough ? No ?
Well, changing your search terms is sometimes more successfull than changing the SE *grin*


How to get the Offsset in IdA!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to get the Offsset in IdA!
PDA

View Full Version : How to get the Offsset in IdA!

NeO'X'QuiCk
01-29-2001, 07:58 PM
I wolud like to know how can you get the offset if oyu have 0044324:
It an example!!

NeO'X'Quick
tsehp
01-30-2001, 12:33 AM
the raw files offsets corresponding to mem address are on the bottom
of the screen since the gui version.
NeO'X'QuiCk
01-30-2001, 02:59 PM
Can you please be more specific!!

I have ida 4.04 and i dont' see anything!

NeO'X'QuiCk
carpathia
01-30-2001, 07:26 PM
Look on the status bar, just after where it displays the free disk space.
NeO'X'QuiCk
01-31-2001, 02:50 AM
Thanks guy !!I fully got it!Was i stupid!By some how i always looked up!The problem for me was that In toolbar near Offset you have a stroke!And if you press it you get 5 diffrent lines !I don't know how to use it so i thought that there was one it that lines !But it easy like int Win32d!

Thanks again NeO!


Reversing and the real world
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing and the real world
PDA

View Full Version : Reversing and the real world

Janus
01-29-2001, 11:07 PM
I've noticed many crackers share Fravia's views on reversing reality, i.e. the supermarket 'scam'. My local supermarket actually employs 2 people who rea-arrange the shelves every week. We see them every Saturaday, wandering around, deciding what to move. The result? No-one knows where anything is.

I have spent my life 'reversing reality'. After a break of several years, I have recently revived my passion for computers. One of my reasons for doing so was to improve my grasp of abstract logic, in order to better understand the world around me.

A few years ago, I would have readily shared much of Fravia's view of the world. However, i have been privelleged to enjoy an extremely diverse life - amongst my dearest friends and relatives I number an astrophysist, several gangsters, an eminent doctor and a multitude of musicians, bums, junkies and philosphers. The truth of the matter is that assembly language is a piece of piss to comprehend compared to reality. Computers are black and white - they're just 0's and 1's at the end of the day.

Reality, on the other hand, is weirder than anyone could imagine. The number of variables involved; the way the rules constantly change; indeed the sheer complexity of the subroutines governing human behaviour is frighteningly complex. If the world were black and white, then quantum mechanics wouldn't favour probability over cause and effect.

Ultimately, people will believe whatever they want to, regardless of any brain washing tricks others try to use against them. If you don't agree, then why haven't those tricks worked on you?

Blah blah blah - just my two farthings worth.......(I mean no offence BTW)
woodmann
01-30-2001, 03:27 PM
Howdy,

"Ultimately, people will believe whatever they want to, regardless of any brain washing tricks others try to use against them. If you don't agree, then why haven't those tricks worked on you?"

Just what I needed, a post to stir my passion :)

At the risk of wandering down the deadly road of philosophy, I will comment briefly.
The trick's work on everyone, it is my opinion that many don't realize it. Some like the comfort it gives them in that, they don't have to think. It is easy to do what "they" suggest.
One example: I know of a person who firmly believes that in the USA , We are going to have a "cashless" society. This is some conspiracy that is being propagated upon the masses.
This is also the same person who gladly use's checks, debit cards, credit cards and the ATM machine. He does not yet realize that he is being tricked. Why? because it's easy.
Have I pointed this out to him? NO. Why? Because if he cant understand the hypocrisy in his statements then how could I possibly convey the idea to him. He has, for some reason, decided not to think.

I believe there are people who can see it and others who can't and then some who cant see but have the ability. Why or how does this happen? I have no answer. Probably the funniest thing is that most of those being tricked think they are the smart ones. They refuse to believe the reality that they could be misled.

I once tried to explain to someone how to "reverse" the reality of the supermarket. Even though he agreed with me he would not confirm that these things happen. Perhaps he didn't like my thoughts about it and thought I was just full of shit. I find these reality's very entertaining and delight in reversing them for what they are. Friends wonder at times why I stare at certain things for a few minutes while my brain delves into what they mean.

This happened today, I was asked about who offers free Internet. The last time I checked no one did.
I told him this and he could not grasp the concept. It says free just to get you to sign up. After that they are betting you will be to lazy to cancel it. You know what I got for a response? Yes but it says 700 hours free. I said yes that is true after that you have to pay. No response. He was completely perplexed by it. I said I gotta go and just left him standing there. How can they not see through things this easy?

Peace, Woodmann
Predator [PC/pGC]
01-31-2001, 02:00 AM
1 Word: Kickass =)
A+heist
01-31-2001, 02:25 AM
While Janus has surely a point when stating that reality is MUCH more complex than software ( even if we all know how heavily and uselessly complex some overbloated software can be when we have to reverse it :) I still find quite important every single crumb of our 'looking behind the mask' activities ... in our software world on the web or AND irl
Ok: reality is VERY complex, but if you have some good tools and some good examples you can try to tackle it from many sides , and you'll often enough find "scams" with similar patterns , since the main purpose is always the same : screw the poor little idiots .

I have a personal example : only recently I was trying to understand which gsm option and provider would be the best for me. You think you can compare them ? Go ahead and try it : YOU CANNOT . "They" offer an incredible variety of UNCOMPARABLE options for gsm use . You think this is not made on purpose ?
Don't you see that's the same aim as always ? Always the same objective : screw the poor slaves . This regards astrophisicists and gangsters alike .

In fact believe me where I live consumers would need as I did to write a complex C++ program only to understand which f**ing gsm-provider offers the most useful and / or cheap options !

I think and believe that even such banal observations can shed some light on the real hidden workings of our reality . Of course you would need to work further , check what happens elsewhere and finally even write something about it , that I wont do because I don't have the time . Just crumbs of "reality cracking" if you want to call this that way , and not very important for sure but useful nevertheless methinks .

Work well,
A+heist
Janus
01-31-2001, 09:57 PM
People are 'tricked'. 'But', people choose to be tricked. They choose to be ignorant, to see only that which justifies the consensus view of the peer group they inhabit. I'm going to have to mention three philisophers quickly.

John Stuart Mill - 'On Liberty'

Three points

a) He talks about the 'tyranny of the majority'. This, he argues, is a greater threat to 'mankind's advancement' than any legislative restriction of freedom. Basically the idea that the social forces of conformism hinder peoples freedom of choice.

b) He say that any statement can be either true, false or partially true. Most statements are partially true. Only through peaceful, intecellectual debates can the partial truths play off against each other to illuminate whole truths.

c) He believed the only time society had the right to restrict an individuals freedom, was to prevent them from causing 'direct' harm to others. (Not really relevant....lol)

Wittgenstein

'Tracitus'

Basically points out that all we spend our lives doing is playing games. In whatever we do, there are rules, goals, and penalties.

Satre

'Existentialism and humanism'

(Personally, i believe that the Budhists demonstrated these ideas first.....) Taking responsibility for shaping the person who are and will be, accepting full responsibility for your choices, i.e. not blaming God, or other people for the decisons you make.

What I'm getting at is this. The majority of people choose to be part of a flock. They willingly choose to surrender some of their own freedom, in return for the imagined security and other benefits that such as choice brings. They play the same games throughout their lives, secure in the knowledge that they won't have to face unfamiliar situations and games they don't understand.

Mill prophecised societies current predicament. People don't like wandering too far from natural pastures, because they fear the wrath that truly taking responsibility for their own thoughts and actions entails.

To be truly open minded and free comes at a cost.

Woodmann - "Friends wonder at times why I stare at certain things for a few minutes while my brain delves into what they mean."

You choose to do so at a cost. You act in a non-typical manner, and people think you're weird. Even if they don't, you can end up thinking they think you're weird, simply because you know you're breaking the rules. The reward is insight. Now they too could choose to stare at certain things and think about them, but they choose not to. People choose to conform because they want to fit it. I think that is why 'tricks' work. Not because the 'tricks' remove a persons ability to think properly. Its because that person chooses to lets others be the guardian of their thoughts.

People have to choose freedom. They enslave themselves.
?ferret
02-02-2001, 09:50 PM
Oddly enough, I agree with everything that has been said on this thread....if you really think about it, both sides of this discussion are actually the same side.

The Flock Mentality or conformity or whatever you want to call it....

People choose to be tricked...TRUE, but I would like to extend that to:

MOST or ALL People choose to be tricked.

I believe everyone has their buttons. The old adage "If it seems to good to be true, it probably is." almost always holds true, but if it's something that we REALLY want, we're more likely to get blindsided.

When reversing situations that are even the least bit commercially oriented, EVERYTHING is aimed at the flock. There's a multi-million dollar business that solely deals in studying videotape of people shopping. Why? To establish what the shopping habits of the majority are.

'Tracitus'

Basically points out that all we spend our lives doing is playing games. In whatever we do, there are rules, goals, and penalties.

There you have the core of the debate...
reality is complex, but there ARE rules, goals and penalties.

Make someone have the PERCEPTION that if they do this, they'll achieve their goal, if not, there will be a penalty....and they'll bite. This is the essence of advertising ;-)

As for rules....this goes back to the flock thing...
Next time you get on an elevator, stand facing the back and watch the reactions of the other passengers. Simply because you're facing a different direction while waiting to rise or descend to a different floor....you're wierd LOL ( This is especially effective if standing face to face with someone) :-D

Well, I've rambled and digressed enough for one day hehe


Known-plaintext attack on Encrypted Magic Folders
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Known-plaintext attack on Encrypted Magic Folders
PDA

View Full Version : Known-plaintext attack on Encrypted Magic Folders

mike
01-30-2001, 03:59 PM
Encrypted Magic Folders is a very popular shareware title from PC-Magic. Magic Folders, its predecessor, was designed to intercept file IO requests in Windows and return "File Not Found" if the file was in a marked folder. It does this reasonably well, although booting into DOS exposes all the files. To solve this problem, PC-Magic chose to roll their own encryption. Reading the documentation about EMF's encryption is frightening: as one cypherpunk put it, "Smells like snake oil, looks like snake oil, it even has bits of snake scales in it." Here we show that EMF is susceptible to a known-plaintext attack that needs as few as 768 bytes.

http://www.accessdata.com/emf_cryptanalysis.html


Copylocx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Copylocx
PDA

View Full Version : Copylocx

Kilby
01-31-2001, 03:56 AM
I have had a look at the liscence agreements that BitArts, have, and guess what I appear to have taken a dislike to the company :(

Although I have no intention of cracking Cruncher as such, I am going to have a look at the wrapper around it, and also at Softlocx itself, and if I can provide some usful nformation then I will pass it on.

I will have to wait until the weekend as I have a Win 2000 machine in work, and am experiancing great difficulty in hiding softice from all those nasty meltice style tricks :(

Regards,

Kilby...
+SplAj
01-31-2001, 04:19 AM
Hi guys,
please don't get too exited at Bit-Arts old shits. Softlocx 4 and 5 were defeated last year...................

With SL4 just get the keycode at offset 452244 in the insXX.tmp file. With SL5 use Chafe's rebuilder or use my or TMG's keygens.

The mutant is dead.

Thats why they pulled SL5 from the site in November 2000 :) too embarrassing for them.

Actually I am blocked from accessing Bit-Arts
WWW shite as well.

We are awaiting TITY or whatever to come out
so we can play with this new mutant. An evaluation Cd has been ordered, but I hope they don't deliver it to Libya or Canada by mistake now :(

Se if we can make a better attack than Zd labs

CYA

+SplAj
Kilby
01-31-2001, 04:50 AM
Heheh,

I cant find Chafes unwrapper, and their licensing agreement offended me (it is pretty one sided).

I am just looking for some rebuilding practice, so I can have another go at Copylok (from panlock).

Cruncher 2 was the target I chose almost at random, as it was the newest packer listed on Sudden Discharge, basicaly it was so crap I took a dislike to the company.

Additionally theres no tuts on the subject as far as I can see, and in a way a tut is the final insult to such companys.

Kilby...
NchantA
01-31-2001, 08:47 AM
Hey +SplaJ and Kirby, thanks for your posts...

i also am interested in the information (or lack of) regarding softlocx, i know ive been told that its not special, but despite this i still am having trouble...

how can i see what version of softlocx it is? if you would like my target.exe plz email nchanta@nchanta.com

thanks guys

NchantA
+SplAj
02-01-2001, 03:55 AM
Have't seen Cruncher2 yet......

You know last year I had my site pulled because I had
posted a keygen for all their products and rebuild Softlocx 5 without it's mutant protection.

Nobody came to my rescue after I asked about why nobody in the RCE seemed concerned about BA protection. I posted a story along the lines of Matrix
saying that all the old HCU members formed BA ......
quite untrue but there are a couple of ex-crackers working for BA.

Now I found TMG made keygens in November 2000 as well and after this extra pressure B-A pulled the DL section . B-A announced that TITTY would be available in late Dec2000. But now I don't know when.
Maybe soon by CD order only.
They had ZD labs attack it MMMMM :) but will not release it for public DL . How good is it then ?

If you want a good B-A Anti_SI / Frogs Ice tut then DzaKraker made a good report on this. To be honest use TRW if Win98 or ElicZ patches if WinNT/2K and youll never hit the mutant.

+Tsehp has made a great tool. Still in private Beta . But soon you will be able to rebuild stuff like this in seconds :)

It's game over for the redirected IT :)

BUT I think there is one other thing you should know about Softlocx5. I remember that it actually changes code. E.g. say you want the menu selection to work.
In MS compilers it's made in a standard way and SL REDIRECTS this code simililar to the API tricks. Or I least I think it did/does.

I'll check out Cuncher2....

SplAj
Yado
02-01-2001, 04:14 AM
hi' i've checked crunch2 and fusion2 , they have a really easy
protections , dumping and rebuilding them take me about 10 mins.
I thinks that there are a lot of better protections around...

see yaa...

Yado of Lockless.
NchantA
02-01-2001, 05:14 AM
i cant wait for tsehp to release his little tool, itll make my life so much easier...

i officially hate IAT...*g*

NchantA
Kilby
02-01-2001, 06:56 AM
>Ive't seen Cruncher2 yet......

Personally I don't like it, SURPRISE !

It looks like they wrote a packer for their other products, and then decided to release the packer on it's own at a later date.

> There are a couple of ex-crackers working for BA.

Hehehe, obviously they didn't work on the Cruncher 2 side of things :)

>B-A announced that TITTY would be available in late Dec2000. But now I don't know when.

TITTY ?

I assume thats their new product !

>They had ZD labs attack it MMMMM :) but will not release it for public DL . How good is it then ?

Hmmm, but how good atre ZD labs, I remember MemMaker got a good review by some ZD publications, until Dr Dobbs totaled the product,, which eventually ended up in a complete dissassembly and critique of MemMaker.

>If you want a good B-A Anti_SI / Frogs Ice tut then DzaKraker made a good report on this. To be honest use TRW if Win98 or ElicZ patches if WinNT/2K and youll never hit the mutant.

I will look into this as Cruncher only features the old ../NTICE business, hence my comment that their tame crackers havn't worked on the project.

>+Tsehp has made a great tool. Still in private Beta . But soon you will be able to rebuild stuff like this in seconds :)

I'm sorry to say that for cruncher packed files, I havnt' had to rebuild anything :(

Everything appears to be unpacked before the tables are unpacked, all I have to do is dump BEFORE the table is screwed with and set the entrypoint, this may change before long ;)

> It's game over for the redirected IT :)

OOPS or are you referring to my copylok woes ?

>BUT I think there is one other thing you should know about Softlocx5. I remember that it actually changes code. E.g. say you want the menu selection to work.

Well thats a change from the usual wrappers anyway

> I'll check out Cuncher2....

It also seems that BA or as I prefer to call them Bi Tarts as I am a complete sexist pig ;), really like Delphi.

The wrapper around cruncher appears to start off as a variation of the actual cruncher decompress, and there is no heavy duty anti sice code in there either, even icedump copes with it V Happily.

I'm bored with my everyday life lets have a jihad :)

Kilby...
+SplAj
02-01-2001, 08:09 AM
Greetz Kilby

Was Salam Alaikum. Glad to have you on-board.

Where the hell were you last year when those bastards made me lose my cool and my web site
>)

A JIHAD it is

hOrn_dOg is hot and ready to butt-f*ck the cross-dressed mutant from Bi-Tarts :*

.....but we are too late, Yoda beat us all .......

Greetz man, ace tool that Peditor .

SplAj
+SplAj
02-01-2001, 08:12 AM
:-D LOL can't friggin read English...:-D

it was Yado not Yoda ........

Greetz all the same.

SplAj
Kilby
02-01-2001, 11:48 AM
Possibly so,

but he ain't told everybody else how to :)

It's like red alert 2 cut off their money supply, hahaha (evil laugh) !

English is supposed to be my native language and I regularly fail to read it properly.

Kilby...
+SplAj
02-01-2001, 12:12 PM
Got home and had my dinner then settled down for battle. Fusion2 first :-

..... surprise the install password was the same 'noemail' but the protection is the new hairy scary TiTTY (Titanium)

But 10 minutes later I was at BPMB 69F7F8 X watching the IAT & IT at 649000 being built and then destroyed. So dump here while it's still alive :)

Then traced to OEiP at 401000. Dump here

Paste section raw offset 249000 to 24bfff from good IT dump to final dump and run the dumped exe like a charm. 15 MINUTES in total to butt f*ck the TiTTY.

Crunch 2 is similar . Different offsets but same procedure. Set a BPMB TerminateThread and get into the insXX.tmp process at it's hand over to the final unpack routine in Crunchv2........
Find the APIs (eg s 600000 l 800000 'USER32')

Now I can enjoy my weekend laughing my sick f*ckin arse off. Sweet dreams Bi-Tarts :*

SplAj
BTW here is the IT, zipped for you as proof..
hOrn_dOg
02-01-2001, 12:19 PM
forgot the zip :(
?ferret
02-02-2001, 09:28 PM
OEP @ 401000? Boy, that's original huh?
+SplAj
02-04-2001, 09:23 AM
Hey, Bi-Tarts thanks for subscribing me to over 600 internet.com bulletins from internet.com. I'll enjoy reading them. 8)

I have plenty of time cos it only takes 10 mins to Butt F*Ck your products :P

SplAj
tsehp
02-04-2001, 05:08 PM
NchantA (01-31-2001 19:14):
i cant wait for tsehp to release his little tool, itll make my life so much easier...

i officially hate IAT...*g*

NchantA
it's released now, you can find it on the main fravia's mirror page.
Iat based protection are not complicated at all, but much time consuming and repetitive, protection system are copying themselves
and relying more and more on iat based protection.
I'm watching what they'll do next ;)
regards,

+Tsehp
NchantA
02-05-2001, 04:35 AM
thanks to all, especially splaj+ for his help and emails, i got my target unpacked perfectly, after figuring out how to add the virgin iat myself :)

hey tsehp. im practising your tool atm, i attempted to use it on the softlocx, but it seemed to only get the kernel imports????

anyway thanks everyone...

NchantA
+SplAj
02-05-2001, 05:59 AM
Hi NchantA

to get the REAL 'IT' from say Fusionv2 with revirgin you have to MANUALLY change the 'IAT start RVA' from the default mutant IT to the destroyed IT. the real IT is not at 002A38A2 ;)

Try 249000 length F54, press resolve and the magic appears now :)

I hope everyone is having fun 'revirginating' those redirected API's ..... esp. 'hi' to Alexey :* (i love that emoticon)........and remember it's still a Beta tool...and will mature with feedback ;P

Thanks +Tsehp

+SplAj


Final Challenge - Unboxed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Final Challenge - Unboxed
PDA

View Full Version : Final Challenge - Unboxed

+SplAj
01-31-2001, 05:14 AM
Hi guys

I am getting bored with reversing now. Been there, done that }>. The tools available now make it a joke to unpack/disprotect targets (wait until you see +Tsehp new toy :D ) ....... and time is no longer free to
me exclusively . For the last 4 years slaving long hours a time until the early hours .... mmmmm I must be mad. Actually I am :o

However I wish to hand over an unfinished project that I have for the last 3 months and is undefeated for the last few years since Pepper retired from public view.

It's Unboxed 4.5+ from BroadCast Software.

I made a points keygen and other things but are too stupid and bored to finish this off completely.

Only skilled reversers apply please .........
especially interesting to Blowfish experts.

e-mail to :-

unboxed@splaj2000.com

just plain old 'Dave' from now on.....
(except when TITTY comes out BA )


Hasp4 memo1 Service 60,Service 61
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp4 memo1 Service 60,Service 61
PDA

View Full Version : Hasp4 memo1 Service 60,Service 61

john
02-01-2001, 06:04 AM
ASK has recommend to not use the old seed code
encryption.
Somebody already seen a soft protect with 60,61
service ?
I only found one for the moment

John
N/A
02-01-2001, 08:00 AM
have a look at the envelope that uses hasp4 :)
CrackZ
02-01-2001, 05:35 PM
Actually there are 2 issues here.

1. HaspCode() old version (shipped with HASP 3) was broken several years back by examining an old HASP driver and the enveloping application itself, AKS's envelope protection then was totally compromised.

2. New HASP 4 has a 'new' (dare I even flatter to call it that) HaspCode(), same old parameters, different returns NOT compatible with HASP 3 known algorithm. New HASP 4 envelope relies much more heavily on services 0x3C/3D which do block encryption / decryption.

I have about 5 HASP 4 envelope targets now (including 2 that I can 'research' with), the details of what I have know so far are not for consumption on a public message board.

Regards

CrackZ.
Rainor_
02-01-2001, 06:28 PM
last week I remove some enveloped from an CAD App, the protect part was the main DLL (VB6 DLL ) of course i had the dongle HASP4 M1 and was dead easyyyyyyyyyyyyyyyy.
only need FrogICE (some old meltice tricks)
and ''I suppose' some other tricks with debug register (of course SI APP crash every time that i set BPM bpx) i fire ICeDump and do tracex until IP is in the .text section and dump it (for some weird reason ID & Bhrama crash every time that i try to dump) so I use the old jmp eip trick to freeze app and use procdump.
Restore the entry point.

And now the funny part
After the dump the import table is some screwup (but without use function redirection tricks)
so i try to use a BPR to import range but BPR never trigger, hmm maybe some register tricks,
after 1hour I fire hiew to look enveloped dll, godddddddddddddddd the import table is waiting here like a virgin so i cut & paste it to me rebuild dll.

end of history
pd: IceDump /tracex rulezzzzzzzz without it I had to dig thru layers of weird encryptions and
of course SI crashes


New Software from the BSA!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New Software from the BSA!
PDA

View Full Version : New Software from the BSA!

spamal
02-01-2001, 10:20 AM
Finally, what we have all been waiting for-- quality software from our friends at the BSA

http://new.bsa.org/usa/freetools/gasp/gasp_c.phtml

WARNING: do not attempt to reverse engineer this program. That would be illegal ;P
Nolan Blender
02-01-2001, 12:19 PM
www.attest.com/demoexe/bsa/gasp_bsa.exe
for that direct downloading experience.
macilaci
02-02-2001, 02:09 AM
The old proggy was just a small stupid program collecting info from your computer, nothing more. I don't think it is worth to do anything with it. It may be useful for attacking BSA's server. You never know....

macilaci


intel floating point instruction set
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > intel floating point instruction set
PDA

View Full Version : intel floating point instruction set

OeDiFuZz
02-02-2001, 12:31 PM
Hi guys,
I need help very badly. Im cracking PC-cillin 2000. im already at a point were my fake serial was manipulated to produce a seed value ( i think). from this seed value it took some numbers again and placed it in a certain location. then it went back to manipulate my fake serial. it called a function were my serial was manipulated using floating point instructions!!!!
Hell, i dont know anything about floating point instructions. Can somebody direct me to the right way or is there anybody who has a copy of the intel floating point instructions?

I would appreciate any help. Tahnks in advance guys.
OeDiFuZz
Carpathia
02-02-2001, 02:11 PM
Check the Intel programmers reference manuals, or see Chapter 14 (I think) of Art of Assembly.

Regards

Carpathia
Bratsch
02-02-2001, 02:39 PM
Hi:

I have worked on a couple of targets like that. They may be a REAL pain. :P

Do not get intimidated by it. First thing, set up your data window to read floats. either by clicking on the data type in the upper margin of the data window, it will cycle between byte, word, dword, short float, long float, 10 byte float, until you are able to recognize your serial. the Format command has the same effect.

Any search on +intel +float +opcode will take you to the intel assembler manuals. Also if you search for the opcode you are trying to understand, you are going to land in a page of an assembler online manual with the details.
As an exemple,
http://developer.intel.com/design/pentium/manuals/24319001.pdf

You can easily spot and keep track where the intermediate results are stored. usual Hex and string data will show as "invalid" "denormal" or some weird 0.000001345-38 numbers in the data window set to float mode, but the results you are interested in will show as small integers (0000874523.0) or have small fractional parts. Hope this help.

Bratsch
Bratsch
02-02-2001, 04:24 PM
I forgot to add:

The float protections I have seen rely, as their main deterrant, on the use of float arithmetic itself. The numeric manipulations are quite trivial, unless the protectionist is a master in numeric methods. Float arithmetics does not lend itself to SHR ROR or XOR instructions, which are a privilege of bin and hex INTEGER numeric systems. The typical tests I have seen in float protections are something like: " If I divide the serial number by 1983, and then by 613 is the remainder equal to 0? If yes jmp good guy", sort of things.
OeDiFuZz
02-03-2001, 11:36 AM
Carpathia-- thanks for reminding me. i have forgotten about the Art
of Assembly. i already downloaded it a couple of months ago.

Bratsch-- thanks for your input.

i still have one more question guys. any one of you can answer. this may
a pretty dumb question but i really would know. i was reading a tut by
Wyatt wherein he was cracking a VB app which calculates the valid serial
using FPU instructions. there he explained some of the commands. my question
is where can i see in softice the status word register used by the
coprocessor (coz he was refering to C3,C2,C1,C0 as the "condition code"-
these are bits 14,10,9 & 8 of thte status word register)?

Thanks again guys.
McNy@Work
02-03-2001, 02:03 PM
OeDiFuZz (02-02-2001 02:34):
Hi guys,
I need help very badly. Im cracking PC-cillin 2000. im already at a point were my fake serial was manipulated to produce a seed value ( i think). from this seed value it took some numbers again and placed it in a certain location. then it went back to manipulate my fake serial. it called a function were my serial was manipulated using floating point instructions!!!!
Hell, i dont know anything about floating point
........
OeDiFuZz

PC-cillin 2000 ?? Just a piece of cakes, coz it didn't use "benefit" of Floating Point at all.
In Softice, type "wf f" to display the floating point stack in 10-byte real format.You will soon discover that , all calculations only use some very-long interger numbers. 8-)

U must ensure that register has been shown is "ST0, ST1,..and so on" , and NOT "MM0,MM1,..."

Pls, forgive me for my broken English 8)
Good Luck.
Kayaker
02-03-2001, 07:49 PM
Hi,

I stumbled across this basic overview of the FPU architecture and instruction set which might be of some help.

h*ttp://thunder.prohosting.com/~asm1/fpu1.txt

Regards,
OeDiFuZz
02-04-2001, 11:49 AM
McNy@Work-- You're forgiven ;-).Thanks man for your valuable help.
Im new to cracking but i've already cracked some apps that uses the x86
instruction set. I had no trouble cracking them. this is the first time
i've encountered FPU instruction set that's why i couldnt make any sense
on the figures i saw in the ST0, ST1,... and so on. hence i got lost in
the dark codewoods of FPU instruction set.

Kayaker-- i appreciate your help man. i'll take a look at that link.

'Til next time guys. thanks.
OeDiFuZz


Kernel level messaging on Windoze?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Kernel level messaging on Windoze?
PDA

View Full Version : Kernel level messaging on Windoze?

Morlac
02-03-2001, 02:15 AM
Hi everybody,
Can anybody tell me if its possible to redirect one hardware buffer to another hw buffer using kernel drivers?
I mean, lets say that i have a USB keyboard and i want to programme a driver that will redirect/send all commands from the USB kb buffer to the i8042 port buffer? Is it possible? any other technique that can work.
I cant wait for Numega to support USB kbs.

with regards,
Morlac
The Owl
02-03-2001, 02:57 AM
Can anybody tell me if its possible to redirect one hardware buffer to another hw buffer using kernel drivers?
I mean, lets say that i have a USB keyboard and i want to programme a driver that will redirect/send all commands from the USB kb buffer to the i8042 port buffer? Is it possible? any other technique that can work.
I cant wait for Numega to support USB kbs.

problem with USB is that it's a tad bit more complex system than the
old keyboard controller. for one, it's a full system bus with its own
protocol (the USB keyboard being just one of the devices); second,
NT has its own abstraction for drivers that i doubt would work in
NTICE context. maybe you can take a look at some Linux source code
and try to figure out whether the effort of making that work in NTICE
context is worth your time or not.


Morlac
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Morlac
PDA

View Full Version : Morlac

morlac
02-03-2001, 03:53 AM
Hi Owl,

After some snooping around SIce dis., i figured that it communicates to kb hardware directly. The 'Press ESC to Cancel Sofice' surely does use the hw directly.
Seems that im out of luck. :(

Thanx.
Iceman
02-05-2001, 08:06 AM
Any system debugger should not relay on the operatins system itself for processing input and output. NTICE makes no exception. The code youve seen is based on in -out instructions , but is as simple as intercepting an ESC. The real keyboard handler is much more complex and id IRQ driven.
As for writting a KMD wich "redirects USB"
to keyboard miniport , it is not possible into a documented manner.Nor it is as simple as copying some data. You can write hughe messy code , wich will have to patch your USB driver , and once you get USB - KBD key state redirect it trough a simulated IRQ to i8042. I sincerely doubt it can be realized
without having serious problems and implyes a
strong knowledge of both USB bus and the associated device driver , keyboard miniport , IRQ and interrupt handling in NT , notifications on device driver load image (youll need this to patch the USB driver) ,
and for PNP support a simulated normal keyboard. No book on Nt device drivers will
learn you how to do all this , and your code
(if itll ever work) will most likely break in nect service pack and / or NTICE build. And btw , if you do this , let NT think that USB
kbd did not changed while you trap it.


Copy Control
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Copy Control
PDA

View Full Version : Copy Control

codein
02-03-2001, 05:30 PM
Anyone any experience with copy control protection. I am looking for help in understanding the feature word in the protection. The rest of the protection is clear and I can make master floppies but need to add the feature word.
Any help or advice would be appreciated.

Codein


Fixing an vb app to run in windows2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Fixing an vb app to run in windows2000
PDA

View Full Version : Fixing an vb app to run in windows2000

sixaxis
02-03-2001, 06:20 PM
I have a simulation app that runs ok in win3.x, win95/win98 and nt4.
I has three main modules and uses vbrun300.
Two of the modules run in 2k but the third wont start, gives an error:
Stack overflow: Re-link program with bigger stack value.
(stack:reserve,commit)
I dont have the source and the developer was taken over and the app was dumped together with any support. An example of how you can get shafted by a software co.
Anyway,does any guru know whether it is possible to fix this kind of error.
btw the app no longer requires a hardware lock and installs from 4 floppies.

Thanks
disavowed
02-03-2001, 06:42 PM
vmware is always a possible solution :)
The Owl
02-04-2001, 04:42 AM
i assume it's a NE format executable. the NE header has a field called stack allocation, naive me thinks that changing that might help.
sixaxis
02-05-2001, 10:39 AM
Thanks for the responses.
I will have a probe.
I dont think there is anyway to force win2k to run a 'badly behaved app' although it runs fine in nt4 sp5.
The optimum solution would be to somehow patch the file/files but that is beyond my experience.
Cheer


Revirgin (iat rebuilder) final available.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin (iat rebuilder) final available.
PDA

View Full Version : Revirgin (iat rebuilder) final available.

tsehp
02-04-2001, 03:47 AM
you can download it on the main page :
tsehp.cjb.net
bb
02-04-2001, 09:28 AM
Is it going to be supported on NT4? Just curious...
stillnewbie
02-04-2001, 11:21 AM
Hi +Tsehp,

There are no files in the revergin.rar
:(
could you kindly check this out?
Thanks
regards
stillnewbie
JimmyClif
02-04-2001, 12:30 PM
Sure there are ;P

Don't open it with WinZIP but open it using WinRAR, hehehe
tsehp
02-04-2001, 04:17 PM
bb (02-03-2001 23:28):
Is it going to be supported on NT4? Just curious...

no support for nt4, sorry.
But I'm actually working on a win 3.0 version :)
nt4 is too old, and I had to include the psapi.dll to get the process list, just too lazy to add this, you should consider move to win 2k,
very easy to download on newgroups.
regards,

+Tsehp
stillnewbie
02-05-2001, 11:15 AM
Hi +Tsehp,
had a bad time d/l it :-(
finally it works :) .but has an error message when execute the revergin.exe
somrthing like violation acess
Violation d'accès à l'adresse 00405cd2 dans le module 'Revergin.exe'. %s de l'adresse
c02a6000
I don't understand french :(
btw my os is
win95
pentium166
32mb rams

regards
stillnewbie
Kayaker
02-05-2001, 01:06 PM
Oops, +Tsehp doesn't like Win95 any more than he does WinNT, so it won't work on Win95. Luckily he took pity on us Win98 holdouts, and by jove it works pretty good! ^_^

Kayaker
NeO
02-05-2001, 01:28 PM
Good job +Tsehp !!

NeO
tsehp
02-06-2001, 02:15 AM
thanks !
I'm still looking for a good soul who will manage to send me a working
safedisc 2 protected app to improve revirgin, especially with the problem mentioned in the recent cdilla thread.
later,

+Tsehp
NchantA
02-06-2001, 09:26 AM
hola tsehp+ ;)

im probably being a retard, but after reading your readme.txt (hastily written? ;)) it says in win98 to use the 'Load' button to load the executable, before you try and trace it...i dont see any load button (am i blind?) and when i try and trace i get an AV ;P

NchantA
NchantA
02-06-2001, 09:39 AM
hola tsehp+ ;)

im probably being a retard, but after reading your readme.txt (hastily written? ;)) it says in win98 to use the 'Load' button to load the executable, before you try and trace it...i dont see any load button (am i blind?) and when i try and trace i get an AV ;P

NchantA
tsehp
02-07-2001, 03:47 PM
ArthaXerXes (02-06-2001 20:15):
mmm, dear +Tsehp, your program does not work very well on my computer, I get random crashes...

For example I resolve several times the same IAT (to test) -> I get an exception (memory error)

As well, you should be able to add an heuristic to detect the IAT. This is possible.

There are also many interfaces bugs that you certainly noticed.
hi artha,
can you help me solving this by saying precisely the target, win
system and version you use and iat rva, length.

also, interface bugs you've noticed, that will speed my work.

concerning the heuristics, I don't really trust them, it's longer to locate them but for a better use of revirgin, you *must* use sice, just
to see where those iat resolves so I choose not to code this.

TIA
tsehp
02-07-2001, 03:49 PM
NchantA (02-05-2001 23:39):
hola tsehp+ ;)

im probably being a retard, but after reading your readme.txt (hastily written? ;)) it says in win98 to use the 'Load' button to load the executable, before you try and trace it...i dont see any load button (am i blind?) and when i try and trace i get an AV ;P

NchantA
it was a first version, just select the process at the left, do a resolve
and then you can trace the unresolved entries, download the new version.
regards,

+Tsehp
Anticode
02-08-2001, 02:48 AM
Tracer not supported under WinMe? why is that!?
Predator [PC/pGC]
02-08-2001, 06:03 AM
+Tsehp my friend, I'm afraid that I have the same problem as NchantA: doing what you say, I get a 'hangup' of Revirgin. (As soon as I try the tracer).

I used win98 build 2222. Tried it on Awave studio (www.awave.com) and on notepad.exe packed using tElock (which can redirect IAT as well).

I couldn't find a load button either, but you say it was for the old version so that can't be it.

Tia,

Predator
McNy@Work
02-08-2001, 09:01 PM
+Tsehp (02-07-2001 05:49):
it was a first version, just select the process at the left, do a resolve
and then you can trace the unresolved entries, download the new version.
regards,

+Tsehp

Predator [PC/pGC] (02-07-2001 20:03):
+Tsehp my friend, I'm afraid that I have the
....
I couldn't find a load button either, but you say it was for the old version so that can't be it.

Predator

If i weren't wrong, Predator is using the first version.
I had a first version too, the readme file is "readme.txt"
But in the newest version, readme file is "readme.doc"(was made some changed).
tsehp
02-09-2001, 01:48 AM
Predator [PC/pGC] (02-07-2001 20:03):
+Tsehp my friend, I'm afraid that I have the same problem as NchantA: doing what you say, I get a 'hangup' of Revirgin. (As soon as I try the tracer).

I used win98 build 2222. Tried it on Awave studio (www.awave.com) and on notepad.exe packed using tElock (which can redirect IAT as well).

I couldn't find a load button either, but you say it was for the old version so that can't be it.

Tia,

Predator

Ok, I'll test it again on win me using www.awave.com and report here.
don't forget for the tracer to work to put thread.dll into %systemroot%
later,

+Tsehp
spekkel
02-09-2001, 04:44 AM
Hi tseph,

well maybe a stupid question: where do i get the start rva and it's length..??
when i click the protectected file is asks me to use the rebuilder and when i do, it asks me to set the start rva and length. So it doesn,t gives these values automaticly,i looked with pe-editor but couldn,t find the values you used on your example:notepad(asp) .
I am using win98 first edition.

Thanks you for the hard work on app and greetzzz.

Spekkel
tsehp
02-09-2001, 02:49 PM
hehe that's the main job to do.
protected apps like asprotect packed exe won't give you iat start
and length, to find them try this :
the exe is running, set a bpx getmenu and select a menu item, sice
breaks, look at the call, if its like this call [425141] , then you've got an iat entry standing here, look at all the entries and locate the first,
substract the base and you have iat start, the length is easy to find.
SpeKKel
02-10-2001, 08:59 AM
OOOhh....yep i need more study (but i am so lazy)

Ok my prog is expired , and so i can't do it with the bpx on getmenu, and i thought this comparing is done before the whole prog is loaded (asp protected :unregistered version blablabla..), but of course i can't find this comparing (when i try trw, it craches ((and all my reg/file- spying utills are killed by asp.))

So any solutions or hints howi can bypass this ..

Thanks AGAIN.........SpeKKeL......


Suggestions...Thoughts...Maybe?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Suggestions...Thoughts...Maybe?
PDA

View Full Version : Suggestions...Thoughts...Maybe?

morlac
02-04-2001, 10:12 PM
Hi all,

I have been watching the scene closely for the past 2-3 years and i noticed that most tutorials assume that users have access to latest copyrighted tools. Now that you can find special free version of the advanced tools -- Ida3.85b -- and others that substitutes the need for the commercial ones, shouldnt there be a an alternative solution for those reverse engineers whom does not/won't use pirated tools?
I suggest a tutorial that explains the alternative way of doing things.
For example, becuase i cant use SoftICE at the moment, i had to improvise to do my debuggin, sometimes using M$-Visual Studio debugger or even W32Dasm. Dont miss understand me as i do not mean that the mentioned tools are not useful, they are. Its just that sometimes you can do your task easily in one tool and its a bit hard to do in another. And for new comers, It can really discourage them.

What do you think?
Muad'Dib
02-05-2001, 12:12 AM
Well...first of all W32DASM is copyrighted :) As for an alternative debugger, TRW is excellent. It is almost as powerful as SoftICE and just as useful for reversing. It is not free, but it is inexpensive and there is a trial. It might be a good idea for someone to write an essay explaining the differences between alternative tools and how to use them effectively, whether a cracking tutorial includes these methods or not.


Who know the name/password for VirtualGirl 1.54???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Who know the name/password for VirtualGirl 1.54???
PDA

View Full Version : Who know the name/password for VirtualGirl 1.54???

BadGuy
02-05-2001, 01:16 AM
I am looking for the name/password for the dish.
Help me please!!
NchantA
02-05-2001, 04:39 AM
can u read english? i was sure it says no crack requests here... stupid.


C-dilla iat-call fixes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > C-dilla iat-call fixes
PDA

View Full Version : C-dilla iat-call fixes

AndreaGeddon
02-05-2001, 12:44 PM
Hi, i'm reversing the game Carmageddon TDR2000 (safedisc). I have decrypted the .text and .data, decrypted import name functions, rebuilded OriginalFirstThunk, now the game is almost ready but... there are several call to the same iat value, for example
call [xxxxxxxx]
wich in my case always call the same function, but this makes the process crash. I examined the original program, and by calling the same iat value the DPALYER makes it call the right function.
Example:
call [005AF148]
the first time i meet this line it calls GetVersion, the next time it calls HeapAlloc, so i had to fix the opcode to point to the right iat value. My question is: have i to fix ALL the calls manually (arggggg)????
Is there a fixer, or can you tell me how to write one????
Thanx a lot
Bye
risc
02-05-2001, 02:24 PM
get unSafedisc v1.5.5 http://csir.cjb.net

:-)

or get 1.5.3 and look at fix_calls.asm ..

or code a proc to scan code section for all call dword ptr [wrapped_api] .. call them all, patch dplayerx to return to your proc, store call VA & [wrapped_api] & returned api address in an array ..

step through array looking for [wrapped_api] addresses which resolve to more than one api .. then fix the revelvant call's ..
AndreaGeddon
02-05-2001, 03:04 PM
>get unSafedisc v1.5.5 http://csir.cjb.net
of course I know you and your beautiful tools and site, but i was trying to decrypt it by myself :-)

>or get 1.5.3 and look at fix_calls.asm ..
this is really good! Maybe i'll stole it :-P

The idea of sniffing addresses from Dplayer sounds good, i'll try.
Thank you very much man!
Bye


java disassembling (not decompiling)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > java disassembling (not decompiling)
PDA

View Full Version : java disassembling (not decompiling)

keyser
02-05-2001, 01:43 PM
Have you heard of a program allowing to disassemble a java class file?
By disassembling i mean to find out the VM instructions, not the source code.

Thanks a lot.
Kythen
02-05-2001, 07:03 PM
IDA will do just what you're asking. :)

If that isn't what you want, I'm sure this link will provide you with some nice utils to play around with:
http://www.meurrens.org/ip-Links/Java/CodeEngineering/


quite strange app behaviour
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > quite strange app behaviour
PDA

View Full Version : quite strange app behaviour

NikDH
02-05-2001, 07:27 PM
Tried to crack an app which gives me some problems in patching it
I found with no peoblems the points to patch and what to put in to make the prog works ok
But when i try to apply any kind of patch and relaunch the prog i get a streange DialogBox telling me the app isnt correctly initialized
The most strange thing is that the prog hasnt any kind of CRC check (at my sight) and when i load it with symbol loader (which always stops at the ep of the prog when prog isnt patched) it shows me that dialog again
The dialog seems to appear before the prog has been executed and the same thing happens when i try to patch one of the dll of the prog and happens when i change the name to the prog too
Looking at the language of the text of the dialog, it which isnt english like the language of the prog but its italian like the language of my os, it should be a system dialog and not prog related one
But why does it appear every time i try to change something in the exe or its dll (file name too)?
I'm under win2k should be realted to that prog?
Tnx
NikDH
aimless
02-05-2001, 11:29 PM
Hullo,

NT/2K runs checks on each exe/dll in terms of CHECKSUMS. Always!

So, though you have checked the CRC, you must NOT have checked the CHECKSUM.

Do that, rectify it, and mostly, it should disappear.

If it still does not, get a resource editor, and try dumping the resources. Alternatively, try dumping the strings seen in the dialog.

If they are present there, then the protection is not defeated. If they are not there, its the OS Checksum.

Have Fun,
Yado
02-07-2001, 05:47 AM
Hi ;)
nice problems :) i'll wait you on our irc channel :)

byez.


softice crashing my system
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > softice crashing my system
PDA

View Full Version : softice crashing my system

OeDiFuZz
02-05-2001, 11:37 PM
Hi all,
Im having problems with softice on my system. before i was using WIN95,
S3 virge as video card and Softice v3.23. with this "old" specs on my
system, i had no trouble using softice. now i've upgraded to WIN98,
NVIDIA RIVA TNT2 as my video card and SoftIce v4.05. when softice is loaded in memory my system hangs, the screen is blank and only softice
is functioning. can anybody advice me as to what appropriate adjustments
i should make to my system?

thanks in advance guys,
OeDiFuZz
webmasta
02-06-2001, 11:04 PM
go back to Softice v3.24 or v3.25 ,should work fine I have the same computer =)
----------------
ryan/pGC

"Feel it then Eat it"
OeDiFuZz
02-07-2001, 01:36 PM
thanks man for your advise. my system is working now.
4oh4
02-12-2001, 08:48 PM
"....the screen is blank and only softice."

I may be stating the obvious, and it seems that switching to an earlier release has fixed your problem, but did you try "faults off"?

--4oh4
OeDiFuZz
02-14-2001, 01:27 PM
4oh4 (02-12-2001 10:48):
"....the screen is blank and only softice."

I may be stating the obvious, and it seems that switching to an earlier release has fixed your problem, but did you try "faults off"?

--4oh4

yes indeed you're stating the obvious... :-) anywayz, my system is already working and yes the "faults off" is in my winice.dat. what caused the problem is when i installed the window$ installer for win95 on my system which running win98. i think there was a bug or something... im not sure..... but thanks ,anyway, for kind suggestion.

OeDiFuZz


Lost in Space
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Lost in Space
PDA

View Full Version : Lost in Space

shymu
02-06-2001, 12:49 PM
OK,... Now I'm begging. In an earlier post I had asked
about expired vender key message when generating a
license other than permanent. I used lmvkey5 to check
the keys of my target and it reported 0-jan-0 for a
expire date ( permanent ). The only way I could generate
a license is permanent. I'm not complaining,... but I
just don't understand why I can't generate a license with
an expire date. I thought if the vender keys are expired
I wouldn't be able to generate a license either way.

Can anyone help me with lmrecode.c. I downloaded
from CrackZ's site. The doc files mention lmrecode 1.2
but all I have is a C file, don't I need lmrecode.exe. Does
someone have it?
webmasta
02-06-2001, 11:08 PM
It might help if you had some kind of compiler for that C source =)
Try Borland C++ or CBuilder and compile it into a .exe , well thats what most people would do =)
-------------
ryan/pGC

"Feel it then Eat it"


How to locate Call Relocation Table in .Exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to locate Call Relocation Table in .Exe
PDA

View Full Version : How to locate Call Relocation Table in .Exe

EverPresent
02-06-2001, 12:59 PM
I just read the essay by reverser, The "call relocation table' and its importance". I'm working on a program right now that uses a LOT of "call [ebp+14]" type statements.
Is there a better way to find the beginning of the call table? Not all of them are as easy to find (or as small) as the one in reversers essay. I imageine there is something in the PE file header that points to it, any help? Also, are there any other essay's that deal with the subject?
Kilby!
02-07-2001, 04:40 AM
If you use procdump, and use PE Editor, Directory, you will see the Import Table and Import Address Table, Virtual Addresses.

Iprocdump is available at all good tool stores :)

Additionally you may have to watch what, LoadLibraryA is doing, if the IAT et al is being created at run time.

Kilby...


Help with safedisc?? Anyone??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with safedisc?? Anyone??
PDA

View Full Version : Help with safedisc?? Anyone??

Ez
02-07-2001, 04:24 AM
Hi,

I have a problem with championship manager 00/01 v3.89.

I have the original cd, which is v3.81. I managed to disable the copy protection.

However I have since downloaded the latest patch (v3.89) and am asked once again to 'insert cd'. I want to know how I can crack this version, as I cant use the icd file on the original cd.

Any ideas?

thanx

Ez


RSA/DSA problem calculating X^(-1)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > RSA/DSA problem calculating X^(-1)
PDA

View Full Version : RSA/DSA problem calculating X^(-1)

DakienDX
02-07-2001, 07:44 AM
Hello everybody !

Can someone please help me. Both RSA and DSA use an calculation in the form of X^(-1), where X is an integer and the result is an integer too.

But as far as I know, X^(-1) is the same as 1/(X^1) and the result is a real and not an integer.

ex. 2^(-2) = 1/(2^2) = 0.25
ex. 10^(-1) = 1/(10^1) = 0.1

Thank you for any help.
goatass
02-07-2001, 12:06 PM
Hi there, from what I learned on RSA, they do not use integers they use BIG number which is a data type especially for the use of large number.
I don't know what calculations you are talking about exactly, there are millions of things you can do with RSA/DSA.

I guess what I'm asking is for you to give some more info on what calculation you are trying to achieve and for what.

goatass
DakienDX
02-07-2001, 12:24 PM
Hello goatass !

To be more specified, in RSA, the private exponent D is calculated D=E^(-1) mod ((P-1)*(Q-1)).

In DSA it's S=(K^(-1)*(SHA(M)+X*R) mod Q and W=S^(-1) mod Q.

I know that a "BigNum" is a kind of integer, at least it is no real data type.

The D from RSA can be calculated by using some tools (like RSA-Tool 2 by tE!), but in DSA you have to do those calculations everytime you want to sign a message or verify it.
Spath.
02-07-2001, 06:40 PM
Read again the definitions, RSA and DSA are
based on *modular* arithmetics, therefore
modular inverses are always integers. In short,
r is the inverse of m modulo n if there exist a
integer k such that k.n + 1 = m.r, which you
can solve (when possible) with for instance
the extended euclidean algorithm.
AdamA
02-08-2001, 03:45 AM
Hi,
look at http://indigo.ie/~mscott/
There are some DSA/RSA examples in this lib.

Bye,
AdamA
DakienDX
02-12-2001, 11:06 AM
Hello everybody !

Thank you all for your help! ;)


Hasp4-Service2: HaspCode() Info?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp4-Service2: HaspCode() Info?
PDA

View Full Version : Hasp4-Service2: HaspCode() Info?

DGR
02-07-2001, 09:33 AM
Hi there,

I'm working on a nice Hasp4 target and ofcoz it calls the HaspCode function... now I was wondering if there is nething known on the subject. The hasp3 version has been cracked but what about the hasp4 version? I can work around it because the results are checked immediatley but still, would be nicer to actually emulate it. Btw, the results aren't hardcoded... the pushed seedcode seems to be different for each call to HaspCode.

Tia and greetz,

DGR
CrackZ
02-10-2001, 07:43 PM
Hiya,

Without saying too much, I'd be very grateful if you would send to my e-mail the hasp passwords in your target, the seed codes and the known responses, for theory purposes only ;-).

Regards

CrackZ.
Martin McKeen
09-01-2001, 04:44 PM
Hasp4 usually has different sec table then older hasp. But if yo read the sec table, all algo remains the same.

But main benefit of hasp4 is new functions encode/decode.

The only place where they can be emulated is there:

http://dongleduplicate.nsys.by

DGR (02-07-2001 07:33):
Hi there,

I'm working on a nice Hasp4 target and ofcoz it calls the HaspCode function... now I was wondering if there is nething known on the subject. The hasp3 version has been cracked but what about the hasp4 version? I can work around it because the results are checked immediatley but still, would be nicer to actually emulate it. Btw, the results aren't hardcoded... the pushed seedcode seems to be different for each call to HaspCode.

Tia and greetz,

DGR


Problems with board?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Problems with board?
PDA

View Full Version : Problems with board?

vgb
02-07-2001, 10:45 AM
I usually check in every day from work at around 8am California time and later from home at 6pm. During the last week, my connections in the morning have been *unusually* slow - to the point of taking minutes to retrieve a message, if it retrieves at all. No problem in the evening.
Wondering if there are any stats showing the board usage/peak times etc. Overall connections to most other sites are fine. The RCE mb has been fine up until about a week ago.
Anyone having the same issues?

thanx,
vgb
hz
02-07-2001, 12:28 PM
Hi,
Yeah I have the same problem (except for
this evening) usually about 6pm GMT

regards
vgb
02-07-2001, 03:27 PM
It's now 1:15pm California time and no trouble at all.
Must just be peak traffic on the server

vgb
tsehp
02-07-2001, 03:52 PM
Yes I had it also, impossible for me to maintain it a gmt 12h-18h,
I guess it's the server that causes the problem but I'll check the mb
error logs.
I'll ask disavowed if he can check this and report here.
regards,

+Tsehp
disavowed
02-07-2001, 10:01 PM
just to inform everybody, we suffered a denial of service (actually a brute-force guess attack on a disavowed.net challenge) on monday. i've banned the ip mask from accessing the disavowed.net challenges, and emailed the assumed attacker with a warning
mike
02-08-2001, 11:32 AM
I was the one that did the brute-force guessing. I misinterpreted one of the clues on the discussion board and thought that was what I was supposed to do; I apologize for any trouble it may have caused.

I had, however, trouble connecting to the messageboard part of the site (but not the disavowed challenge) for several days before I started the guessing program; I assumed it was a problem with this part of the site.

I should have checked that such an action was permissable; again, I apologize for any trouble.
Antipodean
02-13-2001, 04:51 AM
I find that I regularly have problems trying to access the board (in fact any of the boards on the woodman server). The problem appears to be in the CGI server, as pinging www.woodman.com from the UK while waiting for a download gives about 160ms times. Any time after about midday GMT causes timeouts.
gs
02-13-2001, 05:40 AM
I have regularly had problems accessing the board at one time or another for almost as long as it is up. However, the connection has not been that slow all the time, sometimes it seems to be back to normal.
I guessed it was due to the proxies I use or the overall usage of the net, but there might be other problems as well.
I don't know if the problems only arise after 12:00 h (UTC), but that might be true.
tsehp
02-13-2001, 05:56 PM
checked the logs and saw that nothing wrong happened since
the 8/2/2001, check the routers and bottlenecks.
The daily logs are normal since this date, no attacks or bruteforcings.
Antipodean
02-19-2001, 09:06 AM
Hi

I may have given a slightly wrong impression due to the wording of my message.

What happens is that during the UK morning I can access all the boards OK, but after about Midday GMT it is almost impossible to view any individual threads on any of the boards, although the thread index will show (sometimes quite slowly).

While waiting for a message thread to display (even if the thread times out in my browser) I can still ping the woodman URL with echo times of around 160mS. This leads me to believe it is the CGI engine within the woodman server that gets loaded down and causes the time outs in displaying pages.

That said I had very little problem opening this thread just now. Please treat this as a heads up on a possible problem. Otherwise the board is great (although I prefer the Newbies board colour scheme - it is easier to read):)


dll swapping / re-asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > dll swapping / re-asm
PDA

View Full Version : dll swapping / re-asm

dive
02-08-2001, 02:23 AM
Sorry in advance if any of this is disgustingly newbieish or an FAQ.
My first foray into r.eng. has proved to be a tough nut to crack, and as near as I can tell, none of the usual/documented tricks are going to work. The program (for which I have lost all the source code/docs ;), and am therefore trying to find/bypass codes) seems to use 3 different numbers to calculate a good code, one relating to a cdrom serial, one from a hardware ID and another from within a file on the cdrom. For all my searching, it is evident that nothing silly like decrypting a good code ever happens :(. What I have managed to figger out is this: after a few hmemcpy's (one for each textbox in the code entry form) and a couple __vbastrcmp's happen, and if I trade a jz after this for a jnz, it accepts the code. *joy* .. or so it would seem... it just so happens that the program checks the code again just before talking to the hardware device to which it should upload a file, and without the correct code, it never gets there, and (just my luck) no more vbastrcmp's happen during the second code check, so I am starting to believe that the code actually serves as a crypt key for the file, which will probably be decrypted on the fly as it is uploaded to the hardware (the file is never visible software side, so it is no likely that any decryption/unlocking ever gets done long before uploading.)
My latest and greatest idea so far concerns a suspicious looking DLL which exports a few functions with names like _UCDecode and _UCEncode *bingo* ... i think.. even with an entry in sice.dat for the DLL, it complains that it doesnt know about any of those funcions before or after the application loads the DLL when I try to bpx them. However, I can see exactly where it gets loaded (right before those hmemcpys above), the problem is though, that I am too late trying to bpx them after the hmemcpy's since they never seem to be read from again after that.. any ideas?
Anyways, sorry for all the background, what i would like to try next, if it is possible, it to rework the DLL to that I can at least see what the encrypted version of the real codes will look like, and where they live after the dll calls, then maybe copy them to the place where the encrypted user-entered code should live, or even better, talk it into actually telling me what the real codes should be.... To do this, I believe that Im going to have to re-assemble the DLL from the listing I get from any of the available disassemblers, but Im having a hard time finding an assembler that will accept it.
Any thoughts/suggestions?


(X)Intermediate (x)Advanced (x)Expert help appreciated
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > (X)Intermediate (x)Advanced (x)Expert help appreciated
PDA

View Full Version : (X)Intermediate (x)Advanced (x)Expert help appreciated

nookie
02-08-2001, 06:02 AM
since us "newbies" don't seem to manage, I'd love some input from the more seasoned people on this board.

Target + Thread:

http://www.woodmann.net/cgi-bin/Ultraboard/UltraBoard.cgi?action=Read&BID=8&TID=684&SID=

If it is at all do-able, it would be great if a tut could come out of this target. I've spent so many
nights trying I'm very interested how you guys deal with such an obstacle.

thank you
x!
02-09-2001, 11:08 PM
made some progress. new input appreciated.


Question (stupid or not that is the question)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Question (stupid or not that is the question)?
PDA

View Full Version : Question (stupid or not that is the question)?

stanks
02-08-2001, 10:58 AM
Hi

I have one question for those who knows.
What happened with ftp.reversing.net

greetz


Very interesting target: AdSubtract Pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Very interesting target: AdSubtract Pro
PDA

View Full Version : Very interesting target: AdSubtract Pro

BlackB
02-08-2001, 12:30 PM
Hi all ;-)

Few days ago I've downloaded a cool program: AdSubtract Pro. It filters ads and popups while browsing the web.
More particular, it's interesting from reversing perspective, because it uses java to calculate a valid regcode, to display the "wrong regcode" message, etc ... .
The program itself is written in VC++. The .class java files are in a file called classes.zip. These get unzipped when you run the program and used when necessary. When disassembling the .class files (there are a lot of them) in IDA, you can see the "wrong regcode" messages.
When entering your name and regcode, they get stored in the registery, after that they're queried and get processed by the java .class files.
When your regcode is valid, a file "license." gets updated. This is also done by a .class file.
This license file gets validated with some method called MD5 (unknown to me), so it's very hard (maybe impossible?) to create one yourself.

Anyway.....the problem I have is that I haven't got the slightest clue on how to reverse this regcode generation routine. You know.....I tried it the old getwindowtexta (and all those other well-known api's), but when the javacode gets compiled (yea, don't forget, those .class files get compiled at runtime) and the javacode starts executing....you're totally lost.
BPR -ing on your username/regcode is no use.

So, if anyone 's up to a challenge (and thus can help me, give me hints/tips) :
http://www.adsubtract.com/bin/20082404/ad-pro.exe

see what you guys do with this :) I provided you some basic info so you don't have to worry about that anymore ;)

greets

The Blackbird aka BlackB
mike
02-08-2001, 02:17 PM
MD5 is a strong cryptographic hash function. You can't break it (at least, if you do break it, you'll be famous). You may be able to patch the compare.
goatass
02-08-2001, 11:15 PM
Hi, I don't know where you got the idea that this is written in VC++ but it's entirely written in java.
I like the developers, one of the class files is named: NetscapeSucks.class
gotta love it :)

If you want you can get JAD, get it from protools.cjb.net and decompile _0.class and MD5.class and you will see how the protection works. Basically it takes the activation code you entered checks to see if it's an evaluation code or a real one. Then it replaces certain characters with numbers. Then it stores the resulting number in a byte array and does some shifting and adding to it. Then it creates an MD5 object and calls some functions on the byte array. It then compares the results to another byte array that a function from the MD5 object generated. There are some other checks, I don't have the time to look at them now but I will soon and will let you know what I find.

goatass
goatass
02-09-2001, 01:38 AM
Hi BlackB, well I managed to make the program generate a license file, it was really simple.
All you have to do is call a method in the _0.class file, like this:
iM._0._0("SINGLE USER", "goatass", 0L, "C:\AdSubtract PRO\LICENSE");
the 3rd parameter (0L) is a long variable, it's 0 meaning your license will not expire, if you put 15L then the algorithm will do (Today+15), so your license will expire in 15 days, you don't want that.

What I did was write a small java program to do this call and create the license file. For it to work you need to extract the Classes.zip file and use the class files in the iM directory, since we gonna use their own functions to make us a license.

If you don't know how to do this post a message and I'll try to explain.

goatass
BlackB
02-09-2001, 08:25 AM
hi goatass ;) (funny nick btw, hehe)

i found out myself that i probably could use that procedure to make a valid keyfile, I only didn't know what some parameters stand for.
wel......you helped me out anywayz ;)
and don't worry, i'm able to code some simple java

thx again ;)

BlackB
BlackB
02-09-2001, 10:01 AM
arggggghhhh
this is so embarrassing, hehe.

i tried to import the _0.class file, but that doesn't work actually (becoz the class is not public i suppose?)

so....how did you do it :)

hehe

greets

BlackB
goatass
02-09-2001, 11:07 AM
Hi BlackB,
you don't import the class, you include the package it's in (iM)
at the top of your source code where the import statements are add:

package iM;
and then put your source code in that directory and run it. if it says Error: Wrong Name. then run it like this: java iM.YourCode

hope that helps

goatass
BlackB
02-09-2001, 12:06 PM
Well it's not really running that is the problem
It's compiling my darn java file:
package iM;

public class license {

public static void main (String args[]) {
iM._0._0("SINGLE USER", "BlackB", 0L, "C:\\Program Files\\AdSubtract PRO\\LICENSE");
}
}

errormessage:
cannot resolve symbol (line 6)
symbol: class _0
location: package iM

maybe i'm missing the clue of this
well, i guess so

greets

BlackB
goatass
02-09-2001, 01:42 PM
well extract the classes.zip, and then copy your class file into that iM directory. from outside that directory (one dir out) type:
java iM.license (it would run your file)

and change this: C:\\Program Files\\AdSubtract PRO\\LICENSE
to: C:\Program Files\AdSubtract PRO\LICENSE

goatass
BlackB
02-09-2001, 02:05 PM
heheheh.
okay.....i think you don't understand :)

a java source file (like a .cpp file for c++, a .pas file for Pascal), has the extension .java.
so, BEFORE you have a compiled .class file of that source you first have to compile :) pretty obvious
compiling a .java file is done with javac.exe .....now THAT gives the problem :) and that gives the error message.

and btw, the dubble "\\" are needed or the java compiler gives another three errors.

anyway, as you succeeded in creating a valid license file, i really wonder how you did it.
i use the java 1.3 sdk (which is the newest).

btw, we might better discuss this by email, coz this is going to turn out real embarrassing for one of us, heheh :P

greets (again)

BlackB
goatass
02-09-2001, 04:03 PM
Hey BlackB, I misread your previous post I thought you said it did compile.

Thanks for checking and yes I do know how java works and what a source file is, I did got it working remember ?

here is my code:

package iM;

import java.lang.*;

public class RegMe {

public static void main(String[] args) {

String ry = new String();
String sy = new String();
String az = new String();

ry = System.getProperty("user.dir");
if(ry.endsWith("/"))
ry = ry.substring(0, ry.length() - 1);

if(ry.startsWith("file:///"))
sy = ry.substring(7);
else
if(ry.startsWith("file://"))
sy = ry.substring(6);
else
if(ry.startsWith("file:/"))
sy = ry.substring(5);
else
sy = ry;
if(sy.length() > 2 && sy.charAt(0) == '/' && (sy.charAt(2) == '|' || sy.charAt(2) == ':'))
sy = sy.substring(1, 2) + ":" + sy.substring(3);
if(sy.length() > 0 && (sy.endsWith("/") || sy.endsWith("\\")))
sy = sy.substring(0, sy.length() - 1);

az = sy + "/" + "LICENSE";

iM._0._0("SINGLE USER", "goatass", 0L, az);
}
}

all the stuff before the iM._0._0() call does is find out the current directory you are in and formats it into a string and that is what the variable "az" is.

My code compiles fine I'm sure of it. Now you have to make sure that you have a directory called iM with all the class files from teh classes.zip file when you compile.

So make a directory called X, then unzip the classes.zip file to that directory so you will have the iM subdir and a couple others (not important), now put your java file in the X directory and compile it. Then copy the resulting class file into the iM subdir and from the X dir run: java iM.YourClassFile and it will make a LICENSE file in the current directory.

p.s I'm not embarresed I know what I'm doing, and you soundn't be either you are learning.

goatass
BlackB
02-10-2001, 02:20 AM
Okay, thx for all your effort.
The source code you gave is actually a more detailed version of mine, but actually identical.
I still got the same compiling errors.....and I read a doc about it and I had to use the option -deprecation to make the class file.
anyway, as well as your source as my source worked.....i guess we have different compilers, or a different version....don't know, anyway, it works :)

thx for all your time

greets

BlackB
goatass
02-10-2001, 06:51 PM
I use Java 1.18 and in my compiler I got the same problem but it was a "Warning" not an "Error" so it didn't matter.

goatass
tsehp
02-11-2001, 01:22 PM
thanks for this very interesting conversation, but actually we're kind
of missing some java essays, could one of you take the time to do
an essay about this clever reverse ?
in reward, your name will be famous ;)
TIA,

+Tsehp
BlackB
02-11-2001, 02:29 PM
I'm busy writing an essay....and....well, I'm writing it in name of myself AND in name of goatass, so we can both get famous ;-) hehe

greets

BlackB
goatass
02-11-2001, 05:54 PM
Hey guys, I was gonna write an essay about this protection but if BlackB is doing it I won't. If you need any help with it let me know.

goatass
zeduser
02-12-2001, 10:12 AM
Thanks for this post, I knew nothing about JAVA before this so dl'd a compiler, and after 1/2 hr and a few errors had a true license. I finally figured out the name of the java file must be the same as the "Public" declaration, also JAVA is very case sensative. Quite simple to do, thanks again, now I'll get a book on JAVA.


New info on AdSubtract Pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New info on AdSubtract Pro
PDA

View Full Version : New info on AdSubtract Pro

BlackB
02-08-2001, 02:05 PM
Well, I decompiled all the .class files in Décafé (java decompiler :P) , and euhm, well, it is possible to get a valid regcode this way, but you really gotta be an experienced reverser, which I'm not.......so
for the java experts here......let yourself go

maybe i could manage on my own.....but not with this stupid shareware version of décafé, hehe.
it would be cool if you could decompile, change the source code your way, and recompile and insert the recompiled .class files back to the zip :)
i'm sure the full version of décafé supports it, or another good decompiler....(?)

greets

BlackB


Goatass please help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Goatass please help
PDA

View Full Version : Goatass please help

LaptoniC
02-08-2001, 04:23 PM
I am trying to compile your RSA keygen source.Could you post your resource file too.Thanks.
goatass
02-08-2001, 10:16 PM
Hey, I e-mailed it to you, note that I redid the GUI since I sent it to +Tsehp so the source code will look a bit different.

If you have any questions feel free to ask.

goatass
seabreaker
02-10-2001, 02:02 PM
hey.. Goatass.. looks great. 1 prob. i see you have 3 edit boxes...

IDC_KEY equ 103
IDC_NAME equ 101
IDC_COMPANY equ 102

so..

name- 101
comp.- 102
and
key- 103...

my problem is.. i dont know what the dialog name is.. and i cant find it.. when i compile.. nothing happens :(

whats the dialog name ??

thanks, seabreaker
goatass
02-10-2001, 06:49 PM
it doesn't matter what the dialog name is, make something up and construct a new resource file. you can always take the actual keygen code and put it into your own template and compile that. I didn't include the resource file so people won't compile it and use it or send it to TMG without understanding it.

MyKeygen DIALOG 12, 23, 164, 89
STYLE DS_MODALFRAME | 0x8L | WS_POPUP | WS_VISIBLE | WS_CAPTION | WS_SYSMENU
CLASS "movingCls"
CAPTION "Goatass"

goatass


Asm help needed: What type of CRC is this?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asm help needed: What type of CRC is this?
PDA

View Full Version : Asm help needed: What type of CRC is this?

morlac
02-09-2001, 08:32 AM
Im trying to figure what type of a CRC this is code generate with no luck, assuming that its a CRC function:

--------------------------------------
push esi
mov edx, [esp+arg_0]
sub ax, ax
mov ecx, [esp+arg_4]
cmp ecx, edx
jbe short exit
loop:
mov si, ax
shr si, 0Fh
add ax, ax
or si, ax
mov al, [edx]
and eax, 0FFFF00FFh
add ax, si
inc edx
cmp ecx, edx
ja short loop
exit:
pop esi
retn 8
--------------------------------------

Can anybody help?

Best regards,
Morlac
Anonymous
02-11-2001, 02:23 PM
It's the summation of m terms (n-1)=(n-1)*2 MOD 65535 + n, where n is the nth term: it looks like a checksum calculation.
IcyDee
02-11-2001, 02:40 PM
That eqn. is not right, what about all those OR's and right shifts etc.
Anonymous
02-11-2001, 03:35 PM
IcyDee (02-11-2001 04:43):
That eqn. is not right, what about all those OR's and right shifts etc.

push esi
mov edx, [esp+arg_0]<=pointer to the first item
sub ax, ax <=initialize
mov ecx, [esp+arg_4]<=pointer to the last item
cmp ecx, edx
jbe short exit
loop:
mov si, ax
shr si, 0Fh <=this means:"put 1 in SI if SI signed value
is negative, 0 if SI is positive"
add ax, ax <=this means:"multiply current item by two,
in a 16 bit register"
or si, ax <=this means:"if last sum result is negative,
complement the value (set bit 0 to 1
if ax signed value was negative)"
mov al, [edx] <=next item in AL
and eax, 0FFFF00FFh <=mask AH with zeroes
add ax, si <=sum next item
inc edx
cmp ecx, edx <=finished?
ja short loop
exit:
pop esi
retn 8

This is the significance of "all those OR's and right shifts etc.". It's sufficient that you write a small program in C that contains a vector of values and the equation:

item=item*2e535+vector[counter];

and then put in an Assembler skeleton the assembly routine, and compare the results. In this way "all those OR's and right shifts etc." will become clear.
Regards
morla
02-12-2001, 07:52 AM
Thankx guy. This was a great help.

Thankx again


Does anyone know where to get unpacking(full) Miz+Sandman project!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Does anyone know where to get unpacking(full) Miz+Sandman project!
PDA

View Full Version : Does anyone know where to get unpacking(full) Miz+Sandman project!

NeO
02-10-2001, 01:11 PM
I found one at unpacking goods sit and at krobar's but they dont have everything!I was looking at sandman's page and i can't find it!

Thanks to everyone that help!

NeO
tantox
02-11-2001, 10:03 AM
I think saw it at h*tp://codersdomain.cjb.net/ but do not know whether is full or incomplete.
esther
02-11-2001, 11:17 AM
Hi guys,
codersdomains zip has errors.Krobars zip is the last revision of unpacking aspack of Miz and this is the only one .
theres no full or complete in the web :( as
I know.
esther
NeO
02-11-2001, 12:07 PM
The problem is that even Krobar Does not have any files in projeckt Directory!And if you read.txt there should be some tasks inside not empty directories!

NeO


ICQ2000b reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ICQ2000b reversing
PDA

View Full Version : ICQ2000b reversing

Czajnick
02-10-2001, 07:33 PM
Anybody tried to reverse ICQ2000's protocol ?
Any web sites about it ?
Tedd
02-12-2001, 10:56 AM
[ --Searching is good-- ]

two sites to try :

http://www.algonet.se/~henisak/icq/
http://www.student.nada.kth.se/~d95-mih/icq/

Have fun!

Tedd ;0}~
ThrawN
02-13-2001, 12:03 PM
Yes quite suprising believe it or not but a simple resource hacker and a hex editor is more than enough =)
have a lookt at icqcore.dll
thats where everythign of interest is
iv made several patches for things as a result


cracking 16-bits very old CDILLA protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > cracking 16-bits very old CDILLA protection
PDA

View Full Version : cracking 16-bits very old CDILLA protection

Rainor
02-11-2001, 01:43 AM
i'm get my hand in a DElphi 1 target it use some kind of license algo that use
CDILLA05.DLL where i can get info about it
it is and old CDILLA version???

Rainor


Ripe-MD any papers on this hashing algo ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Ripe-MD any papers on this hashing algo ?
PDA

View Full Version : Ripe-MD any papers on this hashing algo ?

goatass
02-11-2001, 05:59 PM
Hey everybody, I was wondering if anyone know of any papers on Ripe-MD it's similar to MD4 but made in Europe (I think), I can't find any good information on it, I have the cryptography books but they don't go into any detail they just say what it is and when it was developed (like I care).

Any help would be appreciated.

goatass
AdamA
02-12-2001, 03:30 AM
Hi,
try this: http://student.monterey.edu/Students_A-C/bunneyjohne/world/try/ripemd~1.htm

happy reversing
AdamA
goatass
02-12-2001, 07:41 PM
AdamA, thanks for the reply that url helped me alot, I figured out Ripe-MD and now I'm back to this stupid ElGamal implementation.

thanks for the help.

goatass
mike
02-12-2001, 08:39 PM
Are you writing your own bignum package, or using someone else's?

Have you looked at Wei Dai's Crypto++ package? It's really nice and free, too.
goatass
02-13-2001, 08:22 AM
No, I'm using the Miracl library, where can I get that Crypto++ package ?

goatass
lkk76
02-13-2001, 01:57 PM
Originally posted by goatass:
where can I get that Crypto++ package ?

Try entering Wei Dai's Crypto++ into Google and you'll have your answer in the first link of the results. ;)
goatass
02-13-2001, 10:22 PM
yeah yeah I know I wasn't thinking when I posted that message, I got it and it looks good so far.

goatass


Help on HASP service 3Dh (service 61)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help on HASP service 3Dh (service 61)
PDA

View Full Version : Help on HASP service 3Dh (service 61)

edge
02-11-2001, 09:35 PM
Is there any way to emulate this service? Is the encryption algorithm the same on all hasp rev3 dongles? Does anyone know what each return code means?

I'm trying to emulate a dos based program, at startup the program checks for the hasp 1,5,32h services (which i have successfully emulated), and during the program execution, it checks for the service 3Dh to load some pcx encrypted files, is there any way to emulate the encryption algorithm to decrypt those files at runtime?

Greetings,

Edge
CrackZ
02-12-2001, 06:26 PM
Hiya,

Service 0x3D is HaspDecodeData(), new to HASP 4 (I think HASP3 was just a trading name and if it calls this service the internals probably got upgraded). Parameters appear to be :-

EAX -> bytes to encrypt
ESI = number of bytes

Return parameters appear to be :-

EAX -> decrypted bytes.
ECX = 0 (status for the operation).

Interestingly, EDX appears to be returned as some sort of 'key', it changes depending on the data, not sure why, but EncodeData & DecodeData both work on 8 byte blocks.

Regards

CrackZ.

PS - I think I replied to your e-mail already ;-).
--
03-01-2001, 06:11 PM
Hello Edge ,

Don't tell me that your are working
on the soft FotoPlay 2001 !
For the moment nobody does i think the serv 61
edge
03-06-2001, 09:07 PM
-- (03-01-2001 16:11):
Hello Edge ,

Don't tell me that your are working
on the soft FotoPlay 2001 !
For the moment nobody does i think the serv 61

Hello, yes i'm actually working in the fotoplay 2001, and this year the target seems to be a hasp4 dongle, the same dongle for the 42 games which it is. All the games uses the services 1,5,32 at startup, but there r 9 of those games that uses the service 3D to decrypt some relevant pcx that makes the game unplayable. Any help in this service i would apreciate too much (thank u CrackZ), or better, help in the decryption algorithm, because after 3 weeks working on this service i think that i'm wasting my time, and i feeling a bit alone on this.
SyNTaXer
04-02-2004, 02:11 AM
2 edge :

years later ....
... you feel a bit alone on this, but you are'nt.

STX
dELTA
04-02-2004, 07:01 AM
Oh, for the love of god... :)
tgodd
04-02-2004, 01:08 PM
There are emulators available for the hasp4 on the market.

You ought to try those for insperation.
SyNTaXer
04-04-2004, 08:43 AM
i know the availability of those emus but most of them work in win9x only.
and the application uses real dos. hmm, there is maybe a chance to get it work in windows.
naides
04-04-2004, 11:58 AM
i know the availability of those emus but most of them work in win9x only.
and the application uses real dos. hmm, there is maybe a chance to get it work in windows.

I think Tgodd suggestion was more on the lines of :

Get one of the Emulators, Reverse Engineer it, and learn how they do it, then write your own for whatever OS you wish to use.
SyNTaXer
07-04-2004, 03:23 PM
anything new in this ?

it is possible to emulate the 3c or 3d funktions by hw or sw in dos ?

bye SyNTaXer
MeteO
07-18-2004, 01:59 PM
it is possible to emulate the 3c or 3d funktions by hw or sw in dos ?

Under NT-based operating system (NT/2000/XP) all DOS programs send all data to haspdos. The chain is haspdos.sys->haspvdd.dll->haspnt.sys. In latest hasp drivers(greater then 4.85) all calls from haspnt are redirected to hardlock.sys.

By hooking Read/DeviceIoControl/InternalDeviceControl of hardlock.sys possible to emulate this dongle(also fn HaspEncode/HaspDecode ;)


Revirgin error in w98se
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin error in w98se
PDA

View Full Version : Revirgin error in w98se

zeduser
02-12-2001, 10:05 AM
When revirgin starts it gives the error "Traceer not available in this version of win 9x"
Installed it on my buddies w98se sys and it seems to start & run ok.
Any ideas?
TIA
tsehp
02-13-2001, 05:46 PM
did you put the tracer.dll into %systemroot% ?
zeduser
02-13-2001, 06:57 PM
I have at present the 2 dll's in c:\;c:\windows;c:\windows\system;c:\windows\system32, all at the same time.
I assume %systemroot% is c:\windows\system?
It makes no diff, same error.
On the 98se sys it runs ok on, all 3 (exe & 2 dll's) are just on the desktop.
I took an old HD and installed 98se using 98lite as a barebones OS and it runs ok.
The sys I am trying to run it on is 98se installed over 95 OSR2, perhaps this is the problem?

Thanks for your reply
Poweroff
05-18-2002, 11:13 AM
I have the same problem
I install revirgin and it asked about trace.dll.
I copy this dll to windows directory. but without result.
I must re install my WIN98?
foxthree
05-18-2002, 07:35 PM
If it is the latest version of RV (v 1.31 or later .. be careful with the about box versions, they lie ;) ), you might benefit by reading the readme.doc. I quote from that:

"All further coding on win9x will now be stopped for two reasons :"

If you're getting tracer.dll is not found in your system32 error message, then look up the post on how RV uses timestamp to locate the DLL and how to fix this issue somewhere on this board. I'd written a source snippet to achieve the same but that was on Win2K. Nobody complained about this on Win98 SE AFAIK.

Hope this helps,

Signed,
-- FoxThree


ESSAYS ABOUT JAVA CRACKING ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ESSAYS ABOUT JAVA CRACKING ?
PDA

View Full Version : ESSAYS ABOUT JAVA CRACKING ?

jNS
02-12-2001, 12:03 PM
WHERE TO FIND THEM?
LatexX
02-23-2001, 10:56 PM
jNS (02-12-2001 02:03):
WHERE TO FIND THEM?

Check www.latigo.cjb.net

bye!
the analyst
02-24-2001, 05:17 AM
jNS (02-12-2001 02:03):
WHERE TO FIND THEM?

hello

i did 2 tuts about java :

1) a general newbie one :
http://www.oldreverser.cjb.net/java.txt

2)How to reverse a WEB chat protocol:
http://www.oldreverser.cjb.net/protreverse.txt

hope it can help
later,
the analyst / UCF


Help with manual unpacking!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with manual unpacking!!
PDA

View Full Version : Help with manual unpacking!!

NeO
02-12-2001, 04:09 PM
For Kayaker or evenone with ideas!

So i have one another Pecryp 1.02 the problem is not normal !If you opened it with Peedit you get .ficken in every section!In normal Pecrpy it's only in the last one!So i you use PeCrpy unapcker it opens it and at the he gets an eRROR!SO i have to unpack it manually!

[imagebase] 400000 ,OEP is 401000 , after /tracex command i used /pedump 400000 1000 D:\kl.exe!
And he says 400000 is not original Pehead!
Where should i find it???
If i use /dump 400000 1000 D:\kl.exe! it dumps it but the problem is that there is no Pehead so no MZ!!

You can convert a /DUMP [imagebase] [length of file] to a working PE as well afterwards using Procdump, PEditor or some other util. Assuming of course the packer hasn't pulled some other trick such as corrupting the Import table or the PE Header
Kayaker did you mean you the bhrama server!If i use bhrama server on Pecrpty 1.02 I get shut down off Loader!!

Thanks for helpinG!!

NeO
The Owl
02-13-2001, 05:31 AM
i suggest you take a look at the '/option p' part of the docs, especially the PE
header reload options. also, it's generally a good idea to take a look at the
in-memory PE header before attempting a /pedump, there are several values
there that must be valid (PE signature, num of sections, imagesize, section table,
object dir at least).
NeO
02-13-2001, 05:40 AM
The Owl do you know any tut with the example !So i can learn!!

NeO


ASM EXPERTS> Some C++ to ASM help? Please? :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ASM EXPERTS> Some C++ to ASM help? Please? :)
PDA

View Full Version : ASM EXPERTS> Some C++ to ASM help? Please? :)

x30n-
02-12-2001, 05:02 PM
What would this C++ code, look like in ASM ?

----------------
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd){

::EnumWindows(EnumWindowsProc, 0x0);
return 0x0;
}

BOOL CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam){
::EnumChildWindows(hwnd, EnumChildProc, 0x0);
return TRUE;
}

BOOL CALLBACK EnumChildProc(HWND hwnd, LPARAM lParam){
if(::SendMessage(hwnd, EM_GETPASSWORDCHAR, 0, 1)){
::SendMessage(hwnd, EM_SETPASSWORDCHAR, 0, 1);
::SendMessage(hwnd, EM_SETMODIFY, TRUE, 1);
::ShowWindow(hwnd, SW_HIDE);
::ShowWindow(hwnd, SW_SHOW);
}
return TRUE;
}
-----------------------
thanks everyone... :P

x30n-
CrackZ
02-12-2001, 06:37 PM
Hiya,

I don't want to state the obvious here ;-), but here goes anyway. Why didn't you just take VC++ and compile it, then disassemble the result?.

btw - this example looks suspiciously familiar to the very first Hello World in Petzold's Programming for Windows book ;-).

Regards

CrackZ.
x30n-
02-12-2001, 07:10 PM
cause i would like to see what this looks like in asm :)

i did not get this from a book. hehe.
goatass
02-12-2001, 07:47 PM
like CrackZ said, compile the VC++ code you posted and disassemble it and you will see how it looks in ASM, it's as simple as that.

All that code is is the main function of your application, and it contains the message loop so when u start your program it calls WinMain and processes the events in the message loop.

I suggest you goto ht*tp://win32asm.cjb.net and look at the beginner tutorials there you will see this all thing in assembly.

goatass
Malkocoglu
02-15-2001, 12:40 AM
Get VC++, make a project, In the project properties , select the Assembly Listing Option under C++/Category=Listing Files , there you have it... You dont have to dissassemble it...

IMHO this piece of code is not C++ , it is C...
Putting "::" in front of functions does not make it C++...
?ferret
02-15-2001, 07:26 PM
You say "potato", I say "potato++" :D


Nolan: encryption seeds 3 and 4 in flexlm 7.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Nolan: encryption seeds 3 and 4 in flexlm 7.2
PDA

View Full Version : Nolan: encryption seeds 3 and 4 in flexlm 7.2

abccba
02-12-2001, 11:11 PM
In Flexlm 7.2, the encryption seeds increase from 2 to 4. Furthermore, it adds CRO keys for further protection. How can I find seeds 3 and 4? It seems that Dan's method is not suitable now.

In addition, when I assigned seeds 3 and 4 by myself, demo.exe and lmcrypt.exe still can be compiled. But the license generated by lmcrypt.exe cannot used by demo.exe.
flexing
02-13-2001, 07:01 AM
seeds 3 and 4 are an optional feature from what i got so far, the cro/ecc stuff is optional as well....anyways flexlm 7.1 was improved a little, obtaining the seeds 1 and 2 wont work anymore as it did for v7.0(u need to do some additional work to get around the random functions which generate some random seeds ;)
E-
02-13-2001, 08:06 AM
Unfortunately the seeds are not stored in the daemon. The ECC specific seeds 3 and 4 are used to make the public and private keys. The daemon and/or the application read the SIGN= from the license file and only validate the signature, not the actual key. The private key used to do the signing is only compiled into the lmcrypt binary. Retrieving seed 3 and 4 will first be an excerise in factoring the ECC, then once the private key is determined, you must reverse how the private key is generated from the seeds. Good luck with this.
Kythen
02-13-2001, 12:28 PM
Actually, finding the seeds 1 & 2 and vendor key 5 are no different in v7.1 when CRO isn't used. The exact same principles from Nolan Blender's essay and the others still apply. When your target does use public key strength CRO however... I'd have to say you're pretty much screwed at making a license. Back to patching afaik.
abccba
02-14-2001, 12:47 AM
mm.. Yesterday, I have successfully compiled a daemon and corresponded lmcrypt.exe. It's my fault that I used the key5 for 7.0 instead of 7.2, so the license generated by lmcrypt cannot be accepted by the daemon. Now, I can generate key5 and extract vendor codes I assigned from daemon. :)

There are two more protection methods: one is public-key without CRO, the other is CRO.

According to the manual, we may define our public-key (public and private). Private keys will only compiled into lmcrypt.exe, so we cannot easily derive it from daemon, application, and SIGN license. Anyone has experience at public-key?

About CRO, how can I enable CRO option? Do I need correct CRO keys to enable this option? Is there any already exist keys?


30-day limit in asp-protected files..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > 30-day limit in asp-protected files..
PDA

View Full Version : 30-day limit in asp-protected files..

spekkel
02-13-2001, 03:35 AM
I want to kill the 30-day limit of an asp-protected file
by patching the memory..The problem is that i can't find where, or with what, the comparing is done.
I think the comparing is done before the prog is unpacked.

Any experience with this, without unpacking the file ??

Spekkel.......
Kayaker
02-13-2001, 11:25 AM
Try RegQueryValueExA and monitor for a HKEY/ROOT/CLSID entry. Some versions of Asp "hide" the install date info in here as a short cryptic string and check it during unpacking.
SpeKKeL
02-15-2001, 03:17 PM
Hi Kayaker,

Yep found it !!

Thanks you, the proggie now runs for ever by patching
the memory (just two bytes).
btw. after day-limit a clsid key is made, after calling this key a test eax,eax and setz bl does the comparing.

Greetings.........SpeKKeL.......
Kayaker
02-15-2001, 06:34 PM
Hi Spekkel,

An in-line memory patch on an Asprotect time limit. Nice job. (Might make a nice tut y'know hint, hint ;)

Regards,
Kayaker
SplAj
02-16-2001, 12:17 PM
Hi SpeKKel,

Yes a tut would be great. I am 'revirginating' my discompress.com site
thanks to +Tsehp & Woodmann and have a section on in-line patching. I made a few tuts for ASpack & Shrinker. But a current ASprotect fix would be useful

What ya think ?

SplAj
SpeKKeL
02-16-2001, 02:57 PM
Well don't think my tut would be so verry special because i am not so experienced as a lot of other crackers on this board!!

I'am intending to make a better patch and also try to by-pass the " protection error " messagebox witch will
appear sometimes when you try to make some other patches (it didn't troubled me this time).

So when i bring this to a succes , and i really understand what i have done!!> yep......i could write a tut.

btw: I didn't exactly made an inline patch but used risc's rpp 1.5....

Regards.........SpeKKeL.
Guest
02-23-2001, 06:03 PM
Hmmm, memory patching is helpful techniques, but I hate loaders... :)
As You know - ASPr v1.1+ encrypt OEP with CRC of few code parts, and not so easy to patch this shit... :(
But I found big essay (written by strange russian dude) about direct patching program protected by ASProtect v1.1. Loocks nice :)
Here is it: http://www.reversing.net/articles/master/adr.htm

Fuck, but it on russian, and I can read only disasm code dumps, but it enought... l;)
tsehp
02-24-2001, 07:12 AM
look at some past threads on this board, a guy and me managed to patch commview 2.1 in mem, the crc checks are easily found by a bpmb wherever you want into the target's code, last time I saw one, it was only checking the code once, relayed by a similar doing it a few instructions before the OEP is reached, this method is fast, easy to implement but sometimes doesn't make work your patched target on every versions of windows.


Asm help: Opcode JNB xxxxx help needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asm help: Opcode JNB xxxxx help needed
PDA

View Full Version : Asm help: Opcode JNB xxxxx help needed

morlac
02-13-2001, 09:58 PM
Hi guys,
Im faced with a problem.
How can i translate the JNB 'Jump not below' to C/C++ statement?
I tried the following:
if ( var < 3 ) {
statement1
} else {
statement2
}
but that translates to:
cmp var,3
jge ggg <-- should be 'jnb ggg'
statement1
ggg:
statement2

And according to the opcode docs 'JGE' is different from 'JNB'
so, what can i do?

Morlac.
The Owl
02-14-2001, 04:00 AM
so, what can i do?

maybe check the intel manuals (vol 2: instruction set, to be precise) and observe the difference between signed/unsigned compares (hint, hint ;-)).
morlac
02-14-2001, 06:52 AM
Hi Owl,

I did check the manuals before i asked. I always do. :)

I tried unsigned/signed integer compares but still the same.
'JNB' seems to depened on CF, but how? I dont have a clue. :(
The Owl
02-14-2001, 10:26 AM
hmmm.... guys, beat me if i understand what your problems are...

1. JNB is 'jump if not below', ie. when CF=0 (it's in the manual...).
CF is set to 0 for example by 'CMP' when the first operand is NOT BELOW
(ie. above or equal to) the second operand IF the values were being treated
as unsigned integers. CF is also set to 0 (cleared) by CLC for example.

2. JNB has two equivalent mnemonics: JAE (jump if above or equal) and
JNC (jump if no carry). it's quite logical (and confusing at first perhaps), since
they all test CF for the same value. an assembly programmer uses one over
the other to express what the purpose of the Jcc is: test for integer values
used in the program logic somewhere earlier or test for CF itself (which can
be used for signaling error from a previous function call as it is the case for
many DOS interrupts or VxD calls - just for example).

3. the following compiled by djgpp (gcc/dosx) will do what was asked for
(tweak the direction of the comparison and perhaps some optimization
flags if needed for your compiler):

int main()
{
unsigned int a,b;
if (a<b)
printf("a
");
}

the only thing you have to pay attention to is that BOTH sides of the comparison
should have the same signedness property (ie. a constant by deault is treated as
signed in c/c++, you have to either cast it or append a 'u' to make it unsigned).
morlac
02-14-2001, 09:07 PM
Thanx guys.

I got it right this time.

Cheers.
morlac
02-16-2001, 07:57 AM
Thanks alot for your time.
Hopefully ill return the favour sometime.

Morlac


Stop the fancy designs.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Stop the fancy designs.
PDA

View Full Version : Stop the fancy designs.

aimless
02-14-2001, 12:01 AM
The old board was faster.

On a different server or not, it was fast to load, fast to post and worked very well even with modems.

This board is very slow. I think the design is very bad. Keep it TEXT ONLy and no frames, tables, and stuff.

My opinion only. Other's opinions may vary, of course.

Really do not feel like visiting the board anymore. Takes 3-4 minutes to load. Not a good sign.

Tsehp, are you listening?

As ever
Carpathia
02-14-2001, 03:27 AM
Tsk, we're lucky to have this board at all, thanks to Tsehp and Woodman. We chose Ultraboard because it was the easiest way to get the forum up and running again.

Yes, it's slow sometimes, but 3-4 minutes is unfortunate. Try again a different time of day and you might find it loads pretty quick.

On top of this, I find the relevance of the board has increased ten fold. Gone are the mundane rants (almost, heh ;-), and elitist talk of reality reversing, and its back to its roots.

Just my thoughts

Regards

Carpathia
Clandestiny
02-14-2001, 08:15 AM
I actually like the design of the new board (though it initially took some getting used to). I have no complaints with the design, but with the speed. Not trying to "beat a dead horse" here, but I have a high bandwidth connection and it still sometimes takes me 1-2 minutes to load a single page. As was mentioned in a previous post, this bottleneck in speed seems to correspond w/ time of day.

Regards,
Clandestiny
mustapha
02-14-2001, 08:31 PM
Hi,
The disign is great (do not change it), and the speed is not too slow and not fast, in my case I have a bad connection and from the 3° world (i must say 9° world) it takes me 10 or 20 or 50 seconds to open a page. I think that it is important the hour in wich you visite the forum.


ASProtect 1.2 'Revirginated'
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ASProtect 1.2 'Revirginated'
PDA

View Full Version : ASProtect 1.2 'Revirginated'

hOrn_dOg
02-14-2001, 02:36 AM
ASProtect 1.2 (11/02/01) Revirginated (on Win2K)
================================================

IAT at RVA 0x66118 Length 0x5C4 OEip at 0x458F7C (LoL ~3 hours
manually found !)

Dumped.exe is 632kb

One 'problem' API at '00066260 00C1C424 0000 ?????? to_Resolve'just
replace with KERNEL32 GetProcAddress (use SI to get the memory
address)

Make a new section at 0x9E000 0x2000 long - named .SplAj :)
Paste IAT.bin to 0x66118 and IT.bin to 0x9E000. Fix up yer header
(OEiP & IT addresses) with PEeditor 1.7

It Runs ? ..... slight problem with a call to 'C7C6D8' but this is
just a high call with a 'C3 RET' so change the D8C670 at offsets
0x64FAC and 0x64FB0 (reverse byte order !)to C84F46 and put a value
of 'C3' at offset 0x64FC8.

Finished :)

BTW the ASprotect is AUTO registered now. Just try to protect
Notepad.exe and then run it......... NO NAG !!!!

hOrn_dOg (aka +SplAj)
SV
02-14-2001, 02:43 AM
Hi

Have rebuilded too ... but it's not registred :(
Nag screen is show at random !
Try to execute many time. (Hi Alex)

SV
hOrn_dOg
02-14-2001, 03:05 AM
Hi SV

Your right...about 20 runs then the NAG !

As R!sc always says..." you have more work to do "
but not today I have to treat the wife :*

hOrny
tsehp
02-14-2001, 07:21 AM
I'm disappointed by the new version,
only a small modification in the redirected iat's, just a push->ret instead of a call.

No more encrypted iat's on my asprotected 1.2 notepad.

Alexey, send us the source, we'll fight for you :)

regards,

+Tsehp
Kayaker
02-14-2001, 04:54 PM
You devils 3, is nothing sacred? Heh, heh. 8)
Kayaker
02-14-2001, 11:50 PM
Hi All,

I've been walking around the dungeons of Asprotect looking for where the shareware nag is written into a file. Just emerged for more supplies.

As usual the protection peeled like a banana under Revirgin. The shareware nag is in this little snippet (from Notepad) between the Import decryption routine and the OEP jump. BTW, I found a slightly different OEP for the packer on Win98SE.

:0068FB7C EB02 JMP 0068FB80
:0068FB7E FF2569152830 JMP [30281569]
:0068FB84 690005840808 IMUL EAX,[EAX],08088405
:0068FB8A 42 INC EDX
:0068FB8B 891528306900 MOV [00693028],EDX
:0068FB91 F7E2 MUL EDX
:0068FB93 89D0 MOV EAX,EDX
:0068FB95 48 DEC EAX
:0068FB96 09C0 OR EAX,EAX
:0068FB98 7510 JNZ 0068FBAA
:0068FB9A EB02 JMP 0068FB9E

Force the JNZ 0068FBAA and there's no nag. Interesting little routine that gives the delayed nag, not sure exactly how it works though. The value of [EAX] in IMUL EAX,[EAX],08088405 seems to be the determining semi-random factor, but doesn't seem to be stored outside of memory. I thought there might be a simple copying of these bytes to the file during packing, but it doesn't seem so. They exist as hex in the unpacked packer, but don't seem to be used directly.

So I broke on the btnProtectClick event in the unpacked packer and started tracing right up to where the packed image is written to file. Didn't find much 'cept lotsa Delphi bloat.

Well, back into it. If I haven't returned in 24hrs send help ;)

PS, no worries Alexey, I don't think anyone on this end is planning to distribute copies of Asprotect. Think of it as beta testing :)

Regards,
Kayaker
hOrn_dOg
02-15-2001, 08:05 AM
Hi , and todays OEiP is......458FD8 !

Everyday a new one Alexey ?

Ya knows we just play with your nice ASProtect, as we do with all the commercial boys, and sure I have no product bigger than 5k to protect so phear not I release a 'patch' exe protected with ASP ;)

Thanks for the challenges, as you know we would have nothing to reverse without you ;D

+SplAj


A little crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A little crackme
PDA

View Full Version : A little crackme

raven58
02-14-2001, 12:59 PM
Working on a crackme. Get type says this is a DOS executable file packed with ASPACK 1.082. After unpacking and saving the file using procdump, WDASM states that "PE file not in standard windows format- no string references". Should this crackme have been unpacked using a dos unpacker? Is there a way to see the string references in wdasm?

Thanks
goatass
02-14-2001, 05:19 PM
No there is no need to unpack it with a DOS unpacker, your problem is that the RVAs of the sections in the PE header are wrong, the reason why you are not seeing any strings is because your PE header is not pointing to the correct RVA of the RSRC section. You need to read some more about the PE header and some more tuts on unpacking.

goatass


I must be retarted
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I must be retarted
PDA

View Full Version : I must be retarted

ben
02-14-2001, 07:10 PM
OK, granted this is my first week (really 3rd day) of trying to be a hacker, I cant crack/hack/edit anything. i really cant even work softice correctly, i have no idea how to use it. can someone please help or give me a reference to a really good, simple tutorial. or even better, to talk me through using SI in a chat room. I have softIce v4.05 for win.
thanks,
Kriptonic
Carpathia
02-14-2001, 08:27 PM
http://crfb.cjb.net
http://www.cracking4newbies.com

or visit #cracking4newbies on EfNet (but please RTFM first ;-)

Regards

Carpathia


Help: Coding Filter Drivers on winnt/2k problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help: Coding Filter Drivers on winnt/2k problem
PDA

View Full Version : Help: Coding Filter Drivers on winnt/2k problem

morlac
02-14-2001, 09:50 PM
Hi everyone,
It seems that im asking alot these days.
All asm problems now solved and link correctly. My problem lies in something that i couldnt get from the DDK or the books that i have access to.

Let me explain the problem:

1- I made this filter driver and it attaches itself perfectly and detaches as well.
2- it intercepts all the calls that I want it to.
3- Depending on what I want, I either pass the request along to the next driver on the heirarchy or I do some processing.
4- Sometimes when im processing I need to call the target driver/lower on the stack ( the one am attached to) to do some work for me.
5- passing the requst down directly works fine.
6- Completing the request myself after some processing works fine.
7- The problem is that sometimes when im processing i need to call the attachd driver to do somework for me. And i need it to return to where i called it, not through a completion routine. The target driver does invoke IoCompleteRequest on the IRP. This doesnt work for me and i dont know why as the machine resets before emitting any bugcheck or telling that there was a problem.
8- i did try almost everything that i can think of but no luck.

Im using Driver::Works to do the coding and here is the psoudo code for what im doing.
--------------------------------------------
request is started as ReadFile operation(passes a buffer)
In the filter driver:
1 - get pointer to buffer supplied by the originator of request.(Lock buffer and map it to user space)
2 - decrypt buffer.
3 - if need to call target device(Im attached to it)
UnMap buffer and unlock it.
ValidateStackLocation(CURRENT);
ValidateStackLocation(NEXT);
*IoGetNextIrpStackLocation(m_Irp) =
*IoGetCurrentIrpStackLocation(m_Irp);
call target device(target will invoke IoCompleteRequest())
Lock/Map again.
else
.............
This doesnt work, It causes the machine to reset.
Why does it do that? The problem doesnt occur if i dont call target device. Is the I/O manager deleting the whole IRP? I need the buffer after the changes that should have been done at the target device

Please help if you can understand my problem.

Morlac,

PS - Im willing to show the actuall code that i wrote.
Iceman
02-15-2001, 05:53 AM
When IoCompleteRequest is called , that IRP is gone. NT nature is asyncronous , never forget that.
My advice is to build and roll down your own IRPs , if I understoo right your problem. Also quit using Driver Works it suxs , and youll learn more about NT's nature by using DDK kit directly.
In the future post this kind of question to NTKERNEL devel newsgroups, there you can find
real help , here you wont really find any NT experts.

Mail me directly and I can help you with some resources.

Ice [UKC]


welcome to your new moderator : +splAj
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > welcome to your new moderator : +splAj
PDA

View Full Version : welcome to your new moderator : +splAj

tsehp
02-15-2001, 06:05 AM
hi,
I will still be there off course, to administrate the site and the board,
but I have too much work while working on revirgin and can't moderate
the board as good as before.
+splAj is a talented and active reverser, he will soon set up here a site
oriented in unpacking that he had before. So good luck to him.
regards,

+Tsehp
Kilby!
02-15-2001, 06:11 AM
Good luck to the two of you !
NchantA
02-15-2001, 08:08 AM
yo splaj+ ;)))

have fun..and dont delete my posts ( i can be moronic ) hahahha

NchantA
Kugi
02-15-2001, 12:59 PM
Hi +Tsehp, +splAj,

Thanks for the good work you have done as moderator. Enjoyed your help.

Best wishes to the new moderator.

Regards, Kugi
vgb
02-15-2001, 07:46 PM
+splAj -

Welcome!

vgb
tsehp
02-16-2001, 07:04 PM
vgb (02-15-2001 09:46):
+splAj -

Welcome!

vgb
hey I'm still not dead ! but we needed a moderator to moderate the
moderators into this mb (6 registered moderators), just in case one
day we've got more moderators than users :)
what I like with +splAj is that he's able to make me understand better my own cracks, and manages to use my new tool better than me, so
I had to calm down a little for now.
Seriously, working on revirgin, the new softlock and later sd2 takes me too much time and splAj helped me a lot for this.
later,

+Tsehp


i need info
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > i need info
PDA

View Full Version : i need info

mustapha
02-15-2001, 06:25 PM
Hi to all,
1==I added some lines of code to a program and it works fine. I did not change the virtual size, I have to do it? It is necessary?

2==Can someone recommend me tuts/urls about extracting, inserting etc.. sections from/to a Pe file format?

3==Where can I find info about reversing CD copy-protections?

Thanks
Saludos
Mustapha
?ferret
02-15-2001, 07:21 PM
Hola,

I can be of assistance on 2 of he 3 ;-)

1) Adding to to the virtual size....if you find enough NOP's (90h) or Empty (0h) bytes in a program, you can insert your code there w/o making any changes.

3) The search engine on this board should give some results....one good tut for the 'basics' is the DREADed Guide To Cracking...There's a section on CD protections by MisterE that I found helpful.

as for your q about adding to the PE, that's still beyond my scope, I haven't gotten quite that ambitious yet ;-)
Clandestiny
02-15-2001, 09:21 PM
Hi Mustapha,

I'm no expert on code injection, but I had occasion to need to add some imports to the import table in a reversing project a while ago, and I ran across a couple of little related utilites you might be interested in for this purpose.

The first is Iczelion's Snippet Creator: here is a little description borrowed from protools.cjb.net where you can download it if you're interested...

- Can generate code snippets and save them as binary files.
- Support both TASM and MASM.
- Integrated PE editor
- Can insert the snippet into the target PE files as a new section or into any existing section or even in
PE header.
- You can call any functions that are imported by the target PE file.
- Full source code included.

The second one is IDDKing by SantMat. You can also get it from protools.cjb.net...

- IID King allows you to add imports to ANY PE file's import table.
- Allows you to specify how much MORE zero-padded code you wish to add to the end of the
section ".IIDKing" that is created when you change a PE file.
- You can run the program as many times on the program you wish!

Regards,
Clandestiny
Carpathia
02-16-2001, 02:02 AM
Im surprised no-one has yet mentioned neurals notepad essay. Its an excellent tute on code injection and pe manipulation.
http://neudump.cjb.net

My advice is to ignore snippet creator until you've done it a few times manually. Theres lots to be learnt from injecting code by hand. Once your confident you understand eveyrthing youre doing, you can use snippet creator to save time.

Regards

Carpathia


VBOX 4.30 Lang modules
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VBOX 4.30 Lang modules
PDA

View Full Version : VBOX 4.30 Lang modules

spamal
02-15-2001, 10:40 PM
Does anyone know where to get the VBOX 4.3 Lanugage modules? They used to be freeware, but now I think they have hunted down all freeware FTP mirrors and have started charging for them!


Help: An interesting ActiveX Server protection used by SolarWinds 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help: An interesting ActiveX Server protection used by SolarWinds 2000
PDA

View Full Version : Help: An interesting ActiveX Server protection used by SolarWinds 2000

Solomon
02-16-2001, 01:30 AM
http://solarwinds.net/

SolarWinds is a good network management tool package(or hacking toolkit or whatever). One of my friends asked me to reverse it.

I noticed that all the tools in this package are written in VB6. Each needs a unlock key when launched, it loads SolarWinds2000.exe to check the license code, which seems to be a ActiveX server. There is a Terminal Service Edition released by some warez group. I checked their crack. They replaced the original SolarWinds2000.exe(224KB) with a very small program(28KB). Perhaps they wrote their own ActiveX server.

I'm not a ActiveX or COM guru. Would u please give me some help? My version is "SolarWinds 2000 Professional Plus Edition", which can't be directly downloaded from their web site. I can't make the URL public here for some reason. If u r interested I can mail the URL to u. File size is 40MB.
Thx

solomon2000@gmx.net
Solomon
02-17-2001, 01:13 AM
Does anyone know which API is used in QueryInterface( )? So I can set a breakpoint. Thx
Solomon
03-28-2001, 11:14 PM
Today I get some hints when reading this security advisory:
http://razor.bindview.com/publish/advisories/adv_vbtsql.html

So I use ExeScope to examine the TypeLib of SolarWinds2000.exe. Interesting. The next step is to locate the entry point of each functions through CoCreateInstance/CoIntialize/... ? Seems that keygen is possible.

-------------------------------------------------------------------
SolarWinds2000; // SolarWinds 2000 Network Interface

Dispatch _Versions;
GUID={88ACBD6F-E6D8-4B1E-9302-599BF0D50377};
function QueryInterface(riid:^GUID; out ppvObj:^^void);
function AddRef: UI4;
function Release: UI4;
function GetTypeInfoCount(out pctinfo:^UINT);
function GetTypeInfo(itinfo:UINT; lcid:UI4; out pptinfo:^^void);
function GetIDsOfNames(riid:^GUID; rgszNames:^^I1; cNames:UINT; lcid:UI4; out rgdispid:^I4);
function Invoke(dispidMember:I4; riid:^GUID; lcid:UI4; wFlags:UI2; pdispparams:^DISPPARAMS; out pvarResult:^variant; out pexcepinfo:^EXCEPINFO; out puArgErr:^UINT);
property-get Item(out vntIndexKey:^variant): BSTR;
property-get Count: I4;
property-get NewEnum: ^IUnknown;
function LoadVersions;
function ShowVersions(out Index:^BSTR; Application_Name:BSTR; Package_ID:BSTR; DaysLeft:I2; Distributor:BSTR; Release:BSTR);
function About(out Component:^BSTR): bool;
property-get SerialNumber(out Component:^BSTR): BSTR;
property-get ComputerName: BSTR;

Class Versions;
GUID={32C50C99-5DCC-481A-A409-F85CF456A788};
function QueryInterface(riid:^GUID; out ppvObj:^^void);
function AddRef: UI4;
function Release: UI4;
function GetTypeInfoCount(out pctinfo:^UINT);
function GetTypeInfo(itinfo:UINT; lcid:UI4; out pptinfo:^^void);
function GetIDsOfNames(riid:^GUID; rgszNames:^^I1; cNames:UINT; lcid:UI4; out rgdispid:^I4);
function Invoke(dispidMember:I4; riid:^GUID; lcid:UI4; wFlags:UI2; pdispparams:^DISPPARAMS; out pvarResult:^variant; out pexcepinfo:^EXCEPINFO; out puArgErr:^UINT);
property-get Item(out vntIndexKey:^variant): BSTR;
property-get Count: I4;
property-get NewEnum: ^IUnknown;
function LoadVersions;
function ShowVersions(out Index:^BSTR; Application_Name:BSTR; Package_ID:BSTR; DaysLeft:I2; Distributor:BSTR; Release:BSTR);
function About(out Component:^BSTR): bool;
property-get SerialNumber(out Component:^BSTR): BSTR;
property-get ComputerName: BSTR;

Dispatch _Serial;
GUID={6910475C-6460-49FB-BBBB-41806D7EBF41};
function QueryInterface(riid:^GUID; out ppvObj:^^void);
function AddRef: UI4;
function Release: UI4;
function GetTypeInfoCount(out pctinfo:^UINT);
function GetTypeInfo(itinfo:UINT; lcid:UI4; out pptinfo:^^void);
function GetIDsOfNames(riid:^GUID; rgszNames:^^I1; cNames:UINT; lcid:UI4; out rgdispid:^I4);
function Invoke(dispidMember:I4; riid:^GUID; lcid:UI4; wFlags:UI2; pdispparams:^DISPPARAMS; out pvarResult:^variant; out pexcepinfo:^EXCEPINFO; out puArgErr:^UINT);
property-get SerialNumber: BSTR;
function MoveOldLicense;
property-get VID: BSTR;
property-put PID(^BSTR);
function NewSerial: BSTR;
function CalculateCheckSum(out Serial:^BSTR): BSTR;
function ValidSerial(out Serial:^BSTR): bool;
function GenerateKey(out Serial:^BSTR): BSTR;
function ExtractPackageID(out Serial:^BSTR): BSTR;
function ValidKey(out Key:^BSTR): bool;
property-get KeyError: BSTR;
property-put Key(^BSTR);
property-get Key: BSTR;
function Licensed(out ID:^BSTR): variant;
function MatchedKey(out Key:^BSTR; out Serial:^BSTR): bool;

Class Serial;
GUID={354731A4-7649-4273-B655-51796630CA4F};
function QueryInterface(riid:^GUID; out ppvObj:^^void);
function AddRef: UI4;
function Release: UI4;
function GetTypeInfoCount(out pctinfo:^UINT);
function GetTypeInfo(itinfo:UINT; lcid:UI4; out pptinfo:^^void);
function GetIDsOfNames(riid:^GUID; rgszNames:^^I1; cNames:UINT; lcid:UI4; out rgdispid:^I4);
function Invoke(dispidMember:I4; riid:^GUID; lcid:UI4; wFlags:UI2; pdispparams:^DISPPARAMS; out pvarResult:^variant; out pexcepinfo:^EXCEPINFO; out puArgErr:^UINT);
property-get SerialNumber: BSTR;
function MoveOldLicense;
property-get VID: BSTR;
property-put PID(^BSTR);
function NewSerial: BSTR;
function CalculateCheckSum(out Serial:^BSTR): BSTR;
function ValidSerial(out Serial:^BSTR): bool;
function GenerateKey(out Serial:^BSTR): BSTR;
function ExtractPackageID(out Serial:^BSTR): BSTR;
function ValidKey(out Key:^BSTR): bool;
property-get KeyError: BSTR;
property-put Key(^BSTR);
property-get Key: BSTR;
function Licensed(out ID:^BSTR): variant;
function MatchedKey(out Key:^BSTR; out Serial:^BSTR): bool;
Solomon
04-26-2001, 09:45 PM
hehe, I successfully managed to crack the full version, only a 3-byte patch.

My breakpoints are:
rtcCreateObject2 // to launch Local COM Server
__vbaLateMemCallId // call a method in the Local COM Server
__vbaBoolVar // Licensed = TRUE or FALSE?
disavowed
04-27-2001, 09:48 AM
glad we could help :)
machgun
04-28-2001, 12:35 PM
Solomon (03-28-2001 13:14):

So I use ExeScope to examine the TypeLib of SolarWinds2000.exe. Interesting. The next step is to locate the entry point of each functions through CoCreateInstance/CoIntialize/... ? Seems that keygen is possible.

Class Serial;
property-get SerialNumber: BSTR;
property-get VID: BSTR;
property-put PID(^BSTR);
function NewSerial: BSTR;
function CalculateCheckSum(out Serial:^BSTR): BSTR;
function ValidSerial(out Serial:^BSTR): bool;
function GenerateKey(out Serial:^BSTR): BSTR;
function ExtractPackageID(out Serial:^BSTR): BSTR;
function ValidKey(out Key:^BSTR): bool;
property-get KeyError: BSTR;
property-put Key(^BSTR);
property-get Key: BSTR;
function Licensed(out ID:^BSTR): variant;
function MatchedKey(out Key:^BSTR; out Serial:^BSTR): bool;

I would recommend to play with this interface a little bit more (for example, CreateObject with a VBScript and run it with wsh, call all these methods and peek all these properties, try and see what will come out) - seems to me they have a keygen embedded right in. ;)
Solomon
04-28-2001, 10:30 PM
yeah machgun, your good suggestion reminds me of the convenient way of script. I will try it. Several days ago I tried the way of C++ Builder. I wrote a COM server with C++ Builder to replace the original SolarWinds2000.exe, but it's not easy for me to let it work correctly. I have not try writing a COM client to call it.

BTW: The TypeLib definition produced by ExeScope is slightly different from that produced by C++ Builder though the target is the same SolarWinds2000.exe. Don't know whose bug it is.

Thanks.
Solomon
05-08-2001, 11:54 PM
It works!

Just call GenerateKey( ), a valid key will be generated.
qferret
05-10-2001, 09:04 PM
now that's a protection....call their own "GenerateKey()" function....they coulda just as well named it "CreateWarez()" }>
nchanta
05-13-2001, 07:58 AM
on the same note sa this discussion, i have been playing with a softlocx5.ocx protection...

the target uses a computer generated serial code, registration key, and an unlock code. i have keygenned the registration key (programmers own routine), but after it checks this it traces down to two __vbacalllateid calls. i have no idea what these do...

is there an easy way to trace into the code that these calls are executing ?

thanks

NchantA
Solomon
05-13-2001, 08:55 PM
Hi,

Try TLBDBG. It can generate symbolic info for COM interfaces, so this may help us to locate the entry point of each method in the interfaces. It only works with In-Process servers(DLL/OCX).
h**p://w*w.microsoft.com/msj/0399/comtype/comtype.htm

regards
SirMicha
05-27-2001, 02:09 AM
I'm glad to see I'm not the only one that has taken their time on this however; I seemed to be stuck. I've wrote a simple VBS script that will pullout most of the information from the COM, but no serial. Anyone have any ideas?

'Simple query query.vbs
dim comp1

set comp1 = WScript.CreateObject("Solarwinds2000.Serial", IDispatch)
myStr1 = comp1.GenerateKey()

WScript.Echo "Text: " & myStr1
Solomon
05-27-2001, 08:20 PM
hi,
You can get the serial from the registration dialog and pass it as a parameter to GenerateKey( ). Here is my script:

'This has been tested with SolarWinds 2001 Engineering's Edition FULL version

Option Explicit

Dim SolarWinds, Serial, Key

If Wscript.Arguments.Count = 0 Then

Wscript.echo("Usage: KeyGen.vbs SerialNumber")
WScript.echo("Example: KeyGen.vbs SWEE-7C4-D2Z6-Y2RQ-YK56-69Y6-Y786")
Else

Serial = Wscript.arguments.Item(0)
Set SolarWinds = CreateObject("SolarWinds2001.Serial")

If CBool(SolarWinds.ValidSerial(CStr(Serial))) = True Then
Key = SolarWinds.GenerateKey(CStr(Serial))
WScript.echo("Your serial: " & Serial)
WScript.echo("Your key: " & Key)
Else
WScript.echo("Your serial " & Serial & " is invalid!")
End If

End If
thriller
08-30-2001, 10:51 PM
solomon. i'm intersested in knowig more about this crack.
quick thin tho, is there anyway i can download 'solarwinds 2000 edition Engineering version...?????'
please write back,,and let me knwo if u can or cannot..

Solomon (02-15-2001 23:30):
http://solarwinds.net/

SolarWinds is a good network management tool package(or hacking toolkit or whatever). One of my friends asked me to reverse it.

I noticed that all the tools in this package are written in VB6. Each needs a unlock key when launched, it loads SolarWinds2000.exe to check the license code, which seems to be a ActiveX server. There is a Terminal Service Edition released by some warez group. I checked their crack. They replaced the original SolarWinds2000.exe(224KB) with a very small program(28KB). Perhaps they wrote their own ActiveX server.

I'm not a ActiveX or COM guru. Would u please give me some help? My version is "SolarWinds 2000 Professional Plus Edition", which can't be directly downloaded from their web site. I can't make the URL public here for some reason. If u r interested I can mail the URL to u. File size is 40MB.
Thx

solomon2000@gmx.net
goatass
08-31-2001, 08:00 AM
Solomon, great work man. I've keygened an earlier version and it was the same way as it is now but I'm sure they changed the algo a bit. I just took the keygen code out and wrote my own keygen but your way is just as good.
If you have the extra time you should write a paper explaining your method a bit more and possiblly talking about your findings on COM objects. Give us all something good to read :)

good job
goatass
Solomon
09-13-2001, 07:42 AM
hi thriller,

please leave your mail or drop me a mail, I will send the URL for SolarWinds 2001 EE(June 2001).

and thank you goatass for your suggestion.


Again interesting target: 2findmp3....wrapped with a Asprotect-alike
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Again interesting target: 2findmp3....wrapped with a Asprotect-alike
PDA

View Full Version : Again interesting target: 2findmp3....wrapped with a Asprotect-alike

BlackB
02-16-2001, 04:24 AM
Well, here we are again....with a new interesting target. Well, actually, I don't know if this protection's already defeated, but I never heard of it.
It's protected with SoftWrap (http://www.softwrap.com). Site already gives good info on the protection ;)

Summary: SoftWrap 's a commercial wrapper, that wraps and encrypts the original program. You have two options: 1. buy online, 2. buy by telephone. The first one connects to the net, you have to enter creditcard number, this number gets verified online, if everything's okay, the program gets unlocked.
In the second one you have to enter a regcode (41 chars long). I tried to fish for a valid serial, but didn't succeeded yet. I could however, make the program believe it was a right one, and was able to run the program. Of course, after exitting and re-running, I got the buy-me dialogbox again :-)

The "buy online" option may be better to attack...would be a matter of bypassing the server verification of the creditcard number....then probably i valid license is downloaded automatically (but hey, i didn't try this yet)

I also tried to crack the code itself, here are some things I found out:

1. anti-sice, anti-regmon, anti-filemon
------------------------------------

anti-sice is easy to bypass with frogsice (uses old createfilea method)
anti-regmon and anti-filemon is probably executed while installing the shareware product, because you can't run filemon and regmon afterwards. If you move your filemone/regmon files to another place and execute it, it works.
However, I noticed in the disassembly (IDA) that there are string references "SoftWrap cannot load while Filemon/Regmon running", but in practice they never show up.

2. Anti-cracking
---------------

Most of your cracking attempts will get logged (no idea where yet), and after 2 attempts, you get "Locked out of using the program". I have no idea where this is stored: i uninstalled the program, deleted all registery keys that remained and license files on the harddrive, but it didn't work.
Anyway, I was able to nop-out this check and succeeded to make the "buy it" option available again. This "nopping-out" is kinda tricky, as this jump-to-badboy isn't there yet if you look at it with a hex editor. So you have to take the previous instruction and change it in a cmp al, al .... so the next instruction (it's a JZ) will always jump ;)

3. license
---------

there are 3 licenses: one in the registery, one in the install directory and one in a subdir in c:\program files\SoftWrapLicense. they are .sw files.

4. last remark
-------------

when run, a file 2findmp3.locked.exe is created. This probably contains the unwrapped program, but entry point or IAT may be encrypted or something like that. didn't check this out either :-P

Well, that's all for now. Feel free to contribute on this one. I 'm sure I can manage alone, but it goes a lot faster if other people help too :-)
Last but not least: direct download link: http://www.npssoftware.com/2findmp3/retail/2findmp3v50Retailsetup.exe

enjoy ;)
greets

The Blackbird
Kilby!
02-16-2001, 09:16 AM
The ???????locked.exe file is explained in the softwrap FAQ.

The .exe you run is a loader, so it's not really a wrapper as softwrap seem to claim.

Therefore it's looking like safedisc, therefore it may be a good idea to look at the writeprocessmem.

If I get my copylok business finished at the weekend I may have a look at softwrap.

Regards,

Kilby...
BlackB
02-16-2001, 10:58 AM
New info:

The main .exe indeed is a loader, with quite some techniques to prevent cracking.....i'm still busy with finding some things out.

I wrapped notepad.exe with the wrapper (you can d/l it on the mainpage of softwrap) and just dumping the notepad.locked.exe while it is executed was enough to "crack" it. so i suppose that maybe with some slight changes, 2findmp3.locked.exe is also possible to crack that way. very very easy if that works.
the only problem i have now is that i can't get the loader to run the .locked.exe file no more coz i played too much with it with my hexeditor (it remembers crack attacks). i succeeded to disable that check, but there must be a silent second check which i can't find for now.......continuing searching ;)

greets

BlackB
BlackB
02-17-2001, 04:00 AM
A mail a wrote concerning new things I found out to analyst:

hi,

i managed to crack the loader so it always loads the program. actually
it wasn't that hard. the only thing important is to make sure the
"did-you-crack-me?" and "how-many-tries-left?" - memory locations are
set to the correct value, and not only reversing the jumps.

well anyway, there are a lot a lot of checks ;)

good point about his loader is that the maincode is exactly the same
with ANY program, and also its locations. that means that one crack is
enough to crack ANY program, hehe.

next step now is to remove the nag from the loader and i'm done.
well, not done completely because I want to work on several other
things too:

-unwrapping the main program
-finding out how in-the-name-of-satan/god softwrap stores how many
times you used it, or where it remembers you cracked it
-finding out how it encrypts/decrypts

and some other minor things :)

well, greets and cya

BlackB
DaV
02-17-2001, 01:45 PM
hi,

I use W32Dasm 8.93 for disasembling the soft and it's OK..and for debuging i have used TRW2000 (Liutaotao)...and i have succeed to patch the soft ..not completely...I try now the elimenate the first window its appear of Sofwrap loader .

Try with this two Tools...and tell me .

I tried to patch the 2findmp3.exe.

DaV.
SV
02-18-2001, 04:29 AM
Hi reverser

If you want to have a working exe.
'bmp resumethread x'
at break change eip to do only ret
in the loader now:
'a eip'
'jmp eip'
'x'
dump locked process and rebuild exe.
No loader needs :)

Regards SV
BlackB
02-18-2001, 06:10 AM
What exactly do you mean by rebuilding the .exe ? Running the rebuild option in procdump? with what options selected?
or is it manually rebuilding, and if so......what and how?

"rebuilding a .exe" is pretty vague you know:)

greets

BlackB
BlackB
02-18-2001, 06:30 AM
Well...I just managed to make a valid dump myself....without the need of rebuilding the exe ;)

greets

B.
SV
02-18-2001, 08:20 AM
Hi BlackB

I use my own tool to dump & rebuild.
I imagine you can use Procdump or others realigners to do !
Of course you can adjust manually raw offsets and sizes to correct sections values.

SV


Help to start
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help to start
PDA

View Full Version : Help to start

MP
02-16-2001, 12:24 PM
I have one software of electronics. The auther has closed his site hence no help is available. The programmer is asking the number in the registration box and my name so that he will send the code and I can decode to use it for 14 days. I tried to get some information in w32dasm
strings but failed. Guide me where to start?
This will be my beginning.
MP
mike
02-16-2001, 03:13 PM
Check out the newbie section of this site
Also #cracking4newbies on EFNet IRC servers


Jump if not below | another question to moderators
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Jump if not below | another question to moderators
PDA

View Full Version : Jump if not below | another question to moderators

__DuDu__
02-16-2001, 08:46 PM
i did a question about hash and i can't find it anymore i did +- 25 days ago and it's not on database someone deleted it ?

my other question is

add edx, 34
shl edx, 32
jnb 00404123

how can i check in what condidtion it'll jump if below ? the program is always jumping and i need to make it continue the xecution without jumping so i need to know how to find what makes it jump if below coz there's no cmp edx, eax \ jnb xxx !

of course i don't wanna patch ;)

tnx
__DuDu__
CoDe_InSiDe
02-17-2001, 01:03 AM
Hi __DuDu__

It depends that when your on the jnb xxxxxxxx the value in EDX is equal or above the value 00000000.
If it's equal or above it'll jump, otherwise it'll continue.
There's no need for a "cmp xxx, xxx" to make something jump, look at this example:

mov eax, 01
sub eax, 01
jz xxxxxxxx

In this example it'll jump because the value in EAX is 00000000 and so the "Z" flag is set when you enter the "jz xxxxxxxx".
Hope this helps.

Cya...

CoDe_InSiDe
Solomon
02-17-2001, 01:05 AM
According to the "Art of ASM",

JNB: jump if Carry = 0

The SHL instruction sets the condition code bits as follows:
1. If the shift count is zero, SHL will not affect any flags.
2. The Carry flag contains the last bit shifted out of the High Order bit of the operand.

So if u want it not to jump, the following condition should be satisfied:
(edx + 0x34) & 1 = 1 => edx & 1 = 1

regards


Finding Armadillo Entry Point???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Finding Armadillo Entry Point???
PDA

View Full Version : Finding Armadillo Entry Point???

Bubbleman
02-16-2001, 09:31 PM
HI,

i work on a program, that is protected with armadillo. I used the Armadillo Deprotector 1.1, to get an exe file, that is not protected. But when I try to run that file, it crashes. In the helpfile of Armadillo Deprotector, there this problem is also discribed. I have to find the entry point of the program. In the readme, there is an instruction, how to do that, but I couldn´t do that with success. Perhaps somebody can help me how to find the entry point of the programm which was protected with armadillo???

Thanks
Armadillo Killer
02-17-2001, 01:22 AM
Try my tiny ArmKiller from ProTools, it works better than Armadillo Deprotector :)

http://free.hosting.and.email.at.ebox.ru/~protools.fbi.ru/files/unpackers/armkiller.zip
Bubbleman_
02-17-2001, 07:07 AM
I know, In an earlier version of the program, I used Armadillo Killer, and it worked fine. But now It seems, that they used a newer version of Armadillo to protect their program. When I try to "un-armadillo" it with your Armadillo Killer, then my Computer crashes. And that seems not to be a problem with my Computer. This happens on all my three computers.
So I used Armadillo Deprotector to get a unpacked file. But this file has to be modified, to set the correct entry point. But I don´t understand the instructions, the programmer of Armadillo Deprotector made in his Readmefile of Armadillo Deprotector.
So I´m still looking for help.

Thanks
Armadillo Killer
02-17-2001, 08:06 AM
Do you use the latest version of ArmKiller ?

Latest ArmKiller.dll should has size = 16 384 date 10-Nov-2000

Bye.
the analyst
02-17-2001, 08:52 AM
hello

my unpacker works pretty good.
the point is, what does a guy learn using a tool that does all the job ?
my explanation to find the entry point is good..
and work every time, you just gotta try it again ;)
the other tool works fine , and does all the job for sure :)
but i don't see where it is better than mine tho...
each unpacker unpack files pretty good.
i don't like the 'nananere, mine ownz urs'

anyway, feel free to mail me , if you are still stuck with the OEP, i will be pleased to help you.

regards,

the analyst / UCF
Bubbleman
02-17-2001, 11:45 AM
Hi,

yes, I use the newest version of Armadillo Killer, but this version also creates a system crash, when I try to unpack the file. So I have to use Armadillo Deprotector. I will try it once again to find the Entry point. If I can´t find it, I will e-mail The Analyst, for help.

Thanks
Armadillo Killer
02-17-2001, 12:59 PM
Could you give me the link for Armadilled programm?
I would like to fix ArmKiller :)

Bye!
Bubbleman
02-18-2001, 05:58 AM
Sorry, but you can´t download the program. It´s on CD. And it is very big.
But I found the Entry Point now. Thanks
1212
03-05-2001, 05:24 PM
http://go2.163.com/~toye/tools/bw2k02.zip

The tools can find program's Entry Point.It very good!


Setting up a broadcast socket in a LAN as "license server"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Setting up a broadcast socket in a LAN as "license server"
PDA

View Full Version : Setting up a broadcast socket in a LAN as "license server"

DakienDX
02-17-2001, 07:37 AM
Hello everybody !

I've a program which tries to connect to a local (192.168.0.x) server to obtain a license from it.
I've tried to write a program that listens for connections of that program and returns a valid license on connection.

My problem is the following: How do I set up a TCP/IP (not UDP) socket to listen for broadcasts and how to I broadcast a message to all computers in a LAN? (I think it's 192.168.0.255, but I don't know)

The function "setsockopt" does not work with a socket opened as "SOCK_STREAM".


HIDING SOFTICE ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HIDING SOFTICE ?
PDA

View Full Version : HIDING SOFTICE ?

Treks
02-17-2001, 02:56 PM
ne1 has an idea how to hide softice from programs that quit with messages like "uninstall debugger and restart"?
blackos
02-17-2001, 03:46 PM
Hi man ... yes, of course : 3 ideas.

- use TRW200 from liutaotao instead (http://knlsoft.cjb.net)

- still using softice and hide it with a powerful tool made by frogsprint : frogsice !... (http://frogsprint.cjb.net/).

- take a look at newbies forum first, you'll certainly see everything you need about this subject .

:)
blak.
Muad'Dib
02-17-2001, 03:48 PM
watch out for frogsprint.cjb.net - it is M$IE hostile...though if you use M$IE you deserve it anyway :)
ThrillSeeker
02-18-2001, 09:14 PM
Your right, it's very hostile. It result in an endless bluescreen and I had to restore my registry.
hOrn_dOg
02-19-2001, 12:50 AM
Hi

Always go to www.protoools.com he has the latest tools here
- including FI, so no phear of Frogs anti M$ tricks at this site.

BTW IMHO this anti explorer stuff is a bit dated now , OK back in 97~98 to prove somethin, but hey Netscape is shit as well, so is Opera. In fact Widows is shit, BUT we reverse on it for fun so lets relax a little.

hOrn_dOg
SV
02-19-2001, 02:26 AM
Hi Treks

You can use Icedump too :
(In doc)
" - added anti detection code, should protect against most known methods
(int3/int2f/int41/int68/dr7/createfilea/testdebuginstalled). also there
is a way to detect illegal ring-0 entry attempts, check out PROTECT for
more details."

SV


2 +Tsehp about Revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > 2 +Tsehp about Revirgin
PDA

View Full Version : 2 +Tsehp about Revirgin

rot8
02-19-2001, 02:22 AM
First of all: THANK YOU for your great tool !

Now, some else:
1.I load my W98 (it is clean, just installed,w/o any Shedulers etc.).
2.Load my target.
3.Press Resolver.
4.Press Resolve Again.
IT is virgin (almoust :)
OK, again:
1.I REBOOT my W98.
2.Load my target.
3.Press Resolver.
4.Press Resolve Again.
Import Table is ...hmm... half-virginated :)

Any suggestinos ?

And else, could you make small button, which named "Make Ordinals clean".
Import Table will be MORE virgin :)

Regards, rot8.
+SplAj
02-19-2001, 04:29 AM
Hi Rot8

Tsehp won't mind me answering this one :)

A quick question.........did you try the 'tracer' function on those missing API's ?????

SplAj
rot8
02-20-2001, 04:16 AM
Hi +SplAj !

Not concerning tracer...
The problem is that Revirgin works 2 times in the SAME environment (clean W98 without ANY ....hmm..resident programs with the only target loaded) and put out DIFFERENT results !!!
How Can It Be ?

Now about tracer:
It does not work at all :)
It freezes W98 until "three fingers combination"
+SplAj
02-20-2001, 04:44 AM
Hi Rot8

Ok, you have a problem :-( Revirgin is still very much in Beta test form right now. +Tsehp did great work to get his program to function on Win98 and 98 SE. It works great on ASprotect. His primary 'target' :P , but there are other redirections that it ,currently , has a problem with. He is working very hard on this ;)

However the API's should be the same , every run, except possibly for those that have a 'memory match' with other DLL API's - If you have the IAT correctly located :)

Tell us your target and uplink the two API.txt files from Revirgin that show the differences. Maybe we can help further , maybe not.

SplAj
Kilby!
02-20-2001, 04:49 AM
Revirgin works really well on Copylok protected files.

I didn't have to use trace at all.

Kilby...
rot8
02-21-2001, 01:54 AM
+SplAj (02-19-2001 18:44):
Hi Rot8

However the API's should be the same , every run, except possibly for those that have a 'memory match' with other DLL API's - If you have the IAT correctly located :)

Tell us your target and uplink the two API.txt files from Revirgin that show the differences. Maybe we can help further , maybe not.

SplAj
OK. I give up. Think, it is some mystic =)

Target is Tag & Rename v1.8 at http://www.softpointer.com
It is unpacked and defeated.
Crack is released.
So I do not need any help =)

Thanks.

rot8.
+SplAj
02-21-2001, 09:12 AM
Hi Rot8

congrats on your success. I just DL the target and it is dis-protected by the new ASProtect1.2
being built 5th Feb 2001

My findings :-

OEiP 537058
IAT 13C1B8 len 828
make new section at 1E7000 len 3000

Only problem API was GetProcAddress ( as usual !) I restarted Win and did it 2nd time. Same results !!!

A bit of a tweek and voila.

I'll try again tonite on my home PC.

SplAj
tsehp
02-23-2001, 02:40 PM
Hey what's the problem with revirgin ?
ah ! it's solved, ok nice, so bye :)

If there's more asprotect problems in the future, and only for asprotect : write me directly, I will not anymore give info about asprotect on this mb.
Why ? because alexey didn't want to give my $500 for me to explain him how revirgin works and he's doing some naughty tests to see if revirgin is defeated :)

regards,

+Tsehp
BlackB
02-25-2001, 03:54 PM
Hehehe, what did I say about the Asprotect discussion some months ago? Yes, to keep it private......everyone was against my opinion then......what a sudden change of thought :P

Well you know.....the cat-and-mouse game between cracker/protector is fun and cool, but NEVER forget that if protections get reversed and patches are released, this may bring financial damage to the protector....thus.....I'm not surprised that Alexey 's doing this naughty trick. Well anyway, he has the right to do so.....I think he looses more money then we do ;)

Last thing I'd like to say: always be careful with so-called reverser/software author friendship. If I was a software author I'd try to infiltrate the reverser/cracking scene and set them up....yes I'm evil too. Luckely, i'm a cracker and not a software author *grin* ;)

greetz

BlackB


Adding licences to an NT server
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Adding licences to an NT server
PDA

View Full Version : Adding licences to an NT server

IcyDee
02-20-2001, 04:27 AM
Can anyone give me a start on where to look to increase a Windows 2000 server from 5 user licences?

(Sorry, I put NT in the subject!)


Problem With Revirgin !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Problem With Revirgin !
PDA

View Full Version : Problem With Revirgin !

DigitalBlade
02-21-2001, 01:49 AM
Hi !

I've problem with revirgin, after dumping a vboxed apps (vbox 4.3) after selecting it on left box (task box) of revirgin, it say that the IAT is damaged and that i can try to recalculate it. After this i try to use IT RVA from procdump (because IAT RVA is 0 ) but with no fortune :(( so, can anyone HELP ME PLEASE :)

TIA And sorry for my poor english :)
+SplAj
02-21-2001, 03:51 AM
AAAAAAHHHHHHH !!!!!!!!

Ok, ive got that out. Now Revirgin is a reversers tool :) to use a tool you have to understand why a certain tool is used over another and also how to use such a tool
In this case you are attempting to use Revirgin BEFORE your main tool .... your BRAIN ;)
Use this tool to locate the target RVA of the IAT by LoadLibraryA or some other appropriate API call. Revirgin cannot FIND for you this ....... YET ?

When found place this value on the 'IAT Start RVA' box with an estimated IAT length. Have a play.

So snippet :-

Brain:
If found target IAT RVA
then Proc Revirgin
Else Proc Duh
End
Revirgin:
Enter IATaddress in box 1
Enter IAT Length in box 2
Press 'IAT Resolver' button
If All API's found Proc 'Save'
Else press 'Resolve Again'
Proc Generator
Proc Rebuild
Blah Blah.......
Run dumped program
EndProc
End

Save:
Press button 'Save resolved'
EndProc

Generator:
Enter RVA of new section
Press button 'IAT generator'
EndProc

Rebuild:
Paste new IAT.bin & IT.bin
change OEip & IT values
EndProc

Duh:
Have a G&T, relax and watch TV instead
EndProc

"I can't get off this carousel.......... spaceman, I always wanted you to go, into space man"

SplAj
tsehp
02-23-2001, 02:46 PM
some help to find iat start and length :

launch the app and do :
-1 bpx getmenu or showwindow
f12 until you're back, check up where the call comes to.
you can have
call [51a4b8]
or call 51a4b8

check on those locations; you can have some jum tables like this :
jmp [51a487]
add eax, eax
jmp [51a489]
51a487 belongs to iat, it's always the last address pointer before the api.
you can also have some big holes between iat groups (softlock) don't worry, just take the very first iat you find in mem and calculate the global length of the table, considering the very last you find, revirgin
will take care of what is not an iat between.


Whatever
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Whatever
PDA

View Full Version : Whatever

Iceman
02-21-2001, 05:07 AM
My post was not about whatever it's best , since I frankly dont care.
As some of you said: "use whatever you see fit" ...

My post is about attitude. Attitude of Frog's Print , wich feels like he can play with hostile code and he thinks is funny , (if he does it , since I dont know if he really doit) , attitude of ppl who say
"You desreve it .... " and finaly attitude of ppl who say "I know better" , "Im an OS expert" , "Im an allmighty craker" & "Im a god who can judge anything" most of the time coming from ppl who are at most competent to judge a "Hello wrold" C program.

And about MS's policies and their "aggresive market conquest" , you all should realize that ANY company and any CEO would make the same if they would be able to doit. This is real life. Real life has no BORG . Gates did it. And he did it damn well.

If you really want to compete MS or M$ or whatever you guys name it , why dont you build your own companies? Youll see then how youll perspective about marketing issues will change. But before doing this , get rid of chimeras. They wont work out there.

Thx to all guys who supported me in ths thread . Bye all


Crackme challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Crackme challenge
PDA

View Full Version : Crackme challenge

crackme
02-21-2001, 01:45 PM
http://www.fluidstudios.com/3dme/crackme.html


Alexeys *new* trick ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Alexeys *new* trick ?
PDA

View Full Version : Alexeys *new* trick ?

+SplAj
02-22-2001, 12:36 AM
Hi fellow reversers,

We all know very well the redirected API trick that ASprotect employs to deter dumping and rebuilding protected exe's.

Well last nite I played with Rot8 target 'TagRename' from softpointer.com. When I had unpacked it with Revirgins help, the program still did not run. Further analysis showed the following call very early on :-

EAX=00000000 EBX=00710000 ECX=00000000 EDX=00000000 ESI=818AD11C
EDI=00000000 EBP=0081FE38 ESP=0081FE28 EIP=0127C784 o d I s Z a P c
CS=0167 DS=016F SS=016F ES=016F FS=1B57 GS=3356 DS:012835A8=00536778
ÄÄÄÄÄTAGRENAME!+0C44ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄbyteÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
0030:0053BC44 84 C7 27 01 00 00 00 00-00 00 00 00 00 00 00 00 ..'.............
0030:0053BC54 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0053BC64 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0053BC74 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0053BC84 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0053BC94 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0053BCA4 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0053BCB4 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0053BCC4 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0030:0053BCD4 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
0167:0127C783 90 NOP
0167:0127C784 833DA835280100 CMP DWORD PTR [012835A8],00 
0167:0127C78B 7406 JZ 0127C793
0167:0127C78D FF15A8352801 CALL [012835A8]
0167:0127C793 C3 RET

The CALL [012835A8] is really CALL 536778.

i.e. there is now REDIRECTED 'CODE' as well. In this case just 1 call to manually fix to point to the real 'call 536778' instead of the 0127C784 .Replacing the bytes 84C72701 at 53BC44 with 78675300 (reverse bytes) . Then the program ran sweet. BUT in the future maybe many of these with a twist of bitter lemon for us ???

So what else can he do ?

SplAj
tsehp
02-23-2001, 02:31 PM
he can do a lot of things, using registers , or making the calls bounce
in mem 1000 times :
1- the tracer can be used to detect this if the redirections became too complicated
2- considering asprotect, this will stay (unfortunatly) a private discussion, the guy takes too much info from this site ;)

regards,

+Tsehp
McNy@Work
02-24-2001, 01:01 AM
Hi,

Tag&Rename used this method since version 1.6 or 1.7 (it was protected by Asprotect 1.1x then).
It used a ASProtect API to do this.

p/s: SoftPointer had learned a bad habit from that guy. They updated and changed the program files without changing the date and updating news on their WebSite 8-) (Just for a smile...)
So, the call value and redirect value what u saw might not same with +SplAj ...
BlackB
02-25-2001, 04:03 PM
*ehem*

What did I post on this messageboard concerning Asprotect-discussion, some months ago? Yes, to keep it private.....nobody agreed with my opinion......what a sudden change of thought now :P

I think it's a good idea to keep in mind that we're the BAD guys, and he (Alexey) is the GOOD guy. He protects, we try to deprotect and thus also taking away money for him.
So be careful with the so-called reverser/author friendship.
And you know, if I was a protector, I'd infiltrate the crackingscene and try to set 'em all up. Yeah, I'm evil too, but luckely a cracker ;)

greets

BlackB
tsehp
02-26-2001, 05:55 PM
Now I agree with you blackB, at a certain level, we must keep things private, but we also could infiltrate some protector's msgboards and
set them up also, the bad news is that I don't know about some
existing ones, it must be too private for me to know.


Help NAG & Timelimit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help NAG & Timelimit
PDA

View Full Version : Help NAG & Timelimit

F.E.A.
02-22-2001, 07:13 AM
NAG &
Timelimit

Source: http://www.famatech.com/radmin20.zip
So first of all I’d like to say that I’m newbe here.
My steps:
1. I tried to find serial bpx GetDlgItemTextA works fine here, and next step is call with pushed address of s/n string. Ok first of all this function checks whether 2 first chars are 0, when it sees that they are not it continues to manipulate with registers containing those chars (another call), I couldn’t manage to understand what is it doing, but it then checks whether eax is 0, then it calls the function which writes some data in registry hklm\software\radmin\v1.01\ViewType\Data, but I do not understand how it calculates the address of data buffer size, then it read data from registry with size 80h, there is no so much chars and functions ends with error_code, but it never checks this data :(. hklm\software\radmin\v1.01\ViewType\Data – this is where registration data is stored (regmon – tells the same). (all prog params are stored in hkcu\software\radmin\v2.0\).
So I couldn’t understand this part ok.
2. I tried to get time check bpx GetLocalTime – the time was checked and I found the real program entry after checking is OK - 00aaaa07 – the entry of checking prog is 00AA91C9.
So I did ‘d 00aaaa07’ and ‘d 00AA91c9’ wrote down some hex numbers. But I couldn’t find any of them in radmin.exe or in any dll it loads (AdmDll.dll, raddrv.dll, visedll.dll) (on startup it loads only AdmDll.dll). (those dll loaded dynamically (LoadLibraryA), coz “tdump –em radmin.exe” tells that it uses only kernel32 and user32 functions) So those files all packed I tried to make a dump, but I couldn’t find those lines in dump too.
I will appreciate any help or tutors on such a case. Thank you all.


To understand if a program is crackable
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > To understand if a program is crackable
PDA

View Full Version : To understand if a program is crackable

Rokafeller
02-22-2001, 08:02 AM
Hi,
I have a pro, a small MIDI utility for Yamaha Tg33, which wants you to pay for it. I decided to crack it. I killed the nag, but when I slick on "Save" or "Save as" it tells me ut's a demo. How can I understand if I can crack it or wheter the function isn't present in the code?
Thanx
Rokafeller
tsehp
02-23-2001, 02:51 PM
you have to trace it until you see where the test to show this msg is.
try for example to invert the test and see what happens.
Clandestiny
02-23-2001, 10:01 PM
Hi,

Also, you could try to check the imports to see if the comdlg dll functions like GetSaveFileA are present. If they are, it strongly suggests the presence of the code and that the proggy is crackable.

Regards,
Clandestiny
Rokafeller
02-24-2001, 06:54 AM
well... i forgot the command line in sice to show imports!! what's it?
thanx


ultraboard interruption, should be ok now
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ultraboard interruption, should be ok now
PDA

View Full Version : ultraboard interruption, should be ok now

tsehp
02-23-2001, 02:25 PM
hi, my apologies for this interruption.
we had too much cpu time consumed in the past, so the isp disabled
cgi to save their server for the moment.
I had to reconstruct the database and improve the mb settings.
We are actually doing some speed tests to see if everything is ok,
then disavowed's cgi should be enabled saturday 8 am gmt.
but if this slows down the server again... we'll see.
regards,

+Tsehp
woodmann
02-23-2001, 07:06 PM
Well done!!!!!! (so far)

You have my gratitude.
Peace, Woodmann
Bratcher
02-23-2001, 09:16 PM
I don't know if this is a problem only for me or some one other ppl have noticed. Since the board is up and running after the last interruption I consistently get a "The document contained no data Try again later of contact Administrator" every time I click on a thread. If I just ignored it, the thread will eventually load and I can even post (like I am doing) but I suspect the board has a small, inconsequential, but nagging problem.
Kayaker
02-23-2001, 10:23 PM
I have the same problem, but only with version 4 of Opera. It looks like the thread topic i.e.

http://www.woodmann.net/cgi-bin/Ultraboard/UltraBoard.cgi?action=Read&BID=5&TID=1723&SID=

doesn't get redirected to the actual file i.e.

http://www.woodmann.net/Ultraboard/Public/HTML/B5/1723-1.topic.shtml

Changing redirect settings in Opera4 doesn't seem to make a difference. Version 5 Opera is OK, but slower than v4, IE works but is, well IE slow.

Wish I could get Opera 4 to work...
tsehp
02-24-2001, 07:03 AM
Yes it's normal, the mb now uses shtml, and some browsers have maybe not this feature.
I was forced to set the mb like this, there's a lot of people connecting here and it's improving everyday, the site hosts also disavowed's cgi scripts and we have to share some bandwidth with him.
esther
02-24-2001, 09:45 AM
you are right,some browsers does not works good in msg board
Netscape 4.04 is not working properly, it prompts a message box "document does not contain data" it can
still browse after clicking "0k",thats just a minor problem
IE works fine :-D
Thanks for your hard work on Revergin and msg board.

Best regards
esther
tsehp
02-24-2001, 02:34 PM
thanks esther, I just hope that one day, someone could set up a
reverse site as good as disavowed's, but oriented on reversing, on my side I'm not talented enough to build such good looking pages, and don't have anymore time for this, revirgin and administrating this board
is far enough for me.
I could have put some single html pages here, it would be faster but we could loose some mb functions.


I need to contact +Spath, privatley.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I need to contact +Spath, privatley.
PDA

View Full Version : I need to contact +Spath, privatley.

morlac
02-23-2001, 08:15 PM
Can anybody tell/email +Spaths email address.
Need to speak to him .


Challenge for all good crackers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Challenge for all good crackers
PDA

View Full Version : Challenge for all good crackers

Rokafeller
02-24-2001, 09:54 AM
Hi,
I'm trying to crack this prog; it doesn't save files coz it's a demo (a nag appears). i cant crack it (still trying) but I think it's a good playground to practise the art of cracking. tell me if you did it!ftp://134.147.176.16/pub/outgoing/heja/sy-list/PC/tg33demo.zip
(< 1MB)

Suggestions to enable saving?

Bye
Rokafeller
OeDiFuZz
02-24-2001, 10:38 AM
Rokafeller (02-23-2001 23:54):
Hi,
I'm trying to crack this prog; it doesn't save files coz it's a demo (a nag appears). i cant crack it (still trying) but I think it's a good playground to practise the art of cracking. tell me if you did it!ftp://134.147.176.16/pub/outgoing/heja/sy-list/PC/tg33demo.zip
(< 1MB)

Suggestions to enable saving?

Bye
Rokafeller

Hi Rokafeller,

there's a tut on immortaldescendats' website regarding disabled function. you shld visit the site.. the tuts there will help you... i think volatility's tut about a disabled function app dealt with a software called Circuitmaker (i can't remember the exact name) offers a help regarding your problem. you may also check out +Spath's essay about "Theory and Practice of Menu's Reversing" this will provide added info.

cheers,
OeDiFuZz


SmartCheck cause System Error with some target...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SmartCheck cause System Error with some target...
PDA

View Full Version : SmartCheck cause System Error with some target...

moZfet
02-24-2001, 12:43 PM
Hey! Hi there!

this boards sounds very, very well!

So perhaps someone here could help me :)

With some target, smartcheck causes System Error on some target that work very well outside SmartCheck...

Any idea, will be welcome


Recent information about CrypKey needed, tnx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Recent information about CrypKey needed, tnx
PDA

View Full Version : Recent information about CrypKey needed, tnx

moZfet
02-24-2001, 12:49 PM
Hi there!

I need more recent information than the Mav3rick essay on crypkey, I have also the yugung essay.

I need very, very fresh info, TNX


Armadillo 1.90 beta...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Armadillo 1.90 beta...
PDA

View Full Version : Armadillo 1.90 beta...

booyah
02-24-2001, 03:51 PM
hey guys.. *trying* to keygen this puppy! damn hard. does anyone want to help me? I am having trouble... and am lost. I could use any tips from you guys that have keygen'd armadillo or armadillo programs.

thanks in advance
Cast
02-25-2001, 02:17 PM
AFAIK Armadillo uses Blowfish for validating serials, no wounder you have a hard time :)

I suggest you read up on blowfish, and then try to identify it in the code, the arguments to blowfish should be easy to find when its first identified. Good luck.

Regards,
Cast
Cast
02-25-2001, 02:50 PM
From codegen.dll:

CreateCode:
mov eax, [esp+arg_8]
mov ecx, [esp+arg_C]
mov edx, [esp+arg_4]
push eax
mov eax, [esp+4+arg_0]
push ecx
push edx
push eax
call sub_10001130 ; Encrypt name + makedate data, and make serial format: X-X-X-X
add esp, 10h
retn

It encrypts like this:

BlowfishEncryption(const byte *key_string, unsigned int keylength=KEYLENGTH)
: Blowfish(key_string, keylength, ENCRYPTION) {}

check makedate and the parameters passed to it, rename and comment the
sub_10001130 code, and it will start to make sense :), i havent finished my keygen
for this yet, but i have a rough outline of it. I think this will be done soon.

Regards,
Cast
booyah
02-26-2001, 07:53 PM
hmm, well.. how can you get the key for armadillo? i dont belive that you can find it in the exe.. or memory... i belive you would have to bruteforce some how. any ideas????
booyah
02-27-2001, 03:57 PM
so no one can help me?? i would greatly appreciate it if anyone can help me out with this blowfish encryption.. can't seem to find anything on the web about it :(
CrackZ
02-27-2001, 05:42 PM
I think it would be useful for you to do some research on previous versions first. The v1.82/v1.83/v1.84 versions can be found around the web as can the key generator source code to v1.82/v1.83 & 1.84 (there was only a single alteration from v1.83 to v1.84).

As Cast has mentioned Silicon do use Blowfish, I can't honestly believe you couldn't turn up more on the web about it ;-) (maybe the source code will help).

Regards

CrackZ.
booyah
02-27-2001, 07:03 PM
Hey crackz! i have found the keygen source at your site. very helpful! however i do not see any tutorials/documentation on it! do you have links? :)

thanks all of you for your help


MemTurbo II offset disparity
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MemTurbo II offset disparity
PDA

View Full Version : MemTurbo II offset disparity

johnkul
02-24-2001, 08:45 PM
Getting different offsets with W32disassembler and Hexshop or Hexeditor. One goes to 47000 and the other to 22000 (about). Is the file "packed"? do I need visbas disassembler? It seems to be a simple "expiration date" crack, and this is one of my first. Having migraines over this! Please help.
MemTurbo II compacts your memory on the fly.
thanks!


Just another handle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Just another handle
PDA

View Full Version : Just another handle

Ceegee
02-25-2001, 03:44 AM
there's an app which delivers me a lot of useful sourcecode reversed from an java class file. But I can't possible copy it, cuz it's damn shareware. It's hard to crack .. asprotect i think!
but i can select the sourcecode with the mouse. When I push "Alt" + "C" there's a not-registered-warning. I can get the handle of this proggy, but i don't know how to get the selected text.


To +Tsehp: Since you did what you did to the MB, its being working quite faster! No delays in loadin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > To +Tsehp: Since you did what you did to the MB, its being working quite faster! No delays in loadin
PDA

View Full Version : To +Tsehp: Since you did what you did to the MB, its being working quite faster! No delays in loadin

Bratcher
02-25-2001, 12:13 PM
Except for the little problem with shtml. I use NS 4.01 and opera 4 so it is MY problem for being so retro.

Thanks for your time and effort.
I certainly have no way to pay you back!
tsehp
02-26-2001, 01:23 AM
I just learned a few days ago to use this program ;)
and changed the way it generates html, the pages are not anymore generated on the fly, but based
on pre defined shtml, takes more space but much faster, I was forced to do this because the entire
server of our isp was almost dead slow.
dELTA
02-26-2001, 05:46 AM
I don't know if this is the shtml problems that you were talking about, but everytime I click a thread to enter it now, I first get a message box "The document contained no data...", but then the page with the messages loads anyway. This happens for every message thread I enter? Any thoughts?
Brtascher
02-26-2001, 09:37 AM
dELTA ACE (02-25-2001 19:46):
I don't know if this is the shtml problems that you were talking about, but everytime I click a thread to enter it now, I first get a message box "The document contained no data...", but then the page with the messages loads anyway. This happens for every message thread I enter? Any thoughts?
http://www.woodmann.net/Ultraboard/Public/HTML/B5/1723-1.topic.shtml
tsehp
02-26-2001, 09:44 AM
after some tests, I've put back the mb to past settings, the msg read statistic wasn't functionning anymore, and the mb is still fast.
Just in case, report me if you see some speed problems in the future, I'm now quite sure the slowness
problem we had in the future didn't come from this msgboard.
regards,

+Tsehp


Can someone help me with this proggie?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Can someone help me with this proggie?
PDA

View Full Version : Can someone help me with this proggie?

Bubbleman
02-25-2001, 03:27 PM
Hi,

I work on a program for stocktrading. Its called Elliott Wave Analyzer. You can get it here:

http://www.stocksandfuturestrading.com/elliott/download.htm

I was able, to crack the first password box. But I have problems in finding the variables to get a Basic or Professional version. It´s a Vbasic prog. And one of the keyfunctions is __vbalenbstr. But I don´t know what it does?
Solomon
04-02-2001, 11:19 PM
__vbalenbstr: get the length of a string


for beginners at revirgin (iat rebuilder) important essay on what new section
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > for beginners at revirgin (iat rebuilder) important essay on what new section
PDA

View Full Version : for beginners at revirgin (iat rebuilder) important essay on what new section

tsehp
02-26-2001, 01:25 AM
you can look for it at :
http://www.woodmann.net/fravia/what_new.htm
it's the copylok essay done by kilby.


Good books on PE execution and file structure?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Good books on PE execution and file structure?
PDA

View Full Version : Good books on PE execution and file structure?

dELTA
02-26-2001, 06:02 AM
Is there anyone who can recommend some good books about the structure of PE files and the process of their execution?

I would like to get some real detailed knowledge about e.g. how the imports/exports work and are structured, and exactly how the sections and other PE-structure is designed.

I feel that a thorough knowledge about this is really good before being able to do some serious cracking work.

I know that the books by Matt Pietrek are recommended, but they aren't available anymore. :-( So does anyone have any suggestions about good book about this that can be found in the stores today?

Thanks!
Iceman
02-26-2001, 06:40 AM
A good overview of PE files is available at MS;s WEB site. nad the file is up to date. Search MSDN online for it.
rot8
02-26-2001, 07:48 AM
http://jump.to/ganz
Dokz section
dELTA
02-26-2001, 08:13 AM
Over at MSDN I find one article from 1994 by Matt Pietrek, and one article that claims to "describe in detail the internal features of PE/COFF file formats and its parameters". But then the article just ends, without any real content!? I'm sure it's because I'm stupid, but could anyone please tell me how I get to the actual content of this article:

http://support.microsoft.com/support/kb/articles/Q121/4/60.asp

Any link to some other MSDN articles related to this subject, other than these two I mention here, would also be greatly appreciated.

Thanks!
MO`K
02-26-2001, 10:34 AM
Chapter 9 -IIRC- Window32 systems programming secrets, Matt Pietrek.

It is there at ganz site. The chapter is very detailed, so prepare plenty of paper to print out, and walk around with for a day or two :)
BlackB
02-28-2001, 06:40 AM
I noticed that downloading from the ganz site extremely slow. so i've uploaded the Pietrek book on my webspace.
http://users.belgacom.net/blackb/PietrekBook.zip
this will be a LOT faster ;)

greets

BlackB
dELTA
02-28-2001, 01:45 PM
Thanks BlackB, I noticed it was VERY slow, always stalled after just a few tens of kilobytes.

But I got it with a 3,5 hours Flashget session with 10 threads and 30 second timeouts anyway. :-) But I'm sure other people would like to download that excellent book anyway.
Clandestiny
03-01-2001, 05:18 PM
Thanks BlackB,

I d/l the book from your site and it was quite fast :-)

Regards,
Clandestiny


How to strip the export tables of EXEs generated by C++ Builder?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to strip the export tables of EXEs generated by C++ Builder?
PDA

View Full Version : How to strip the export tables of EXEs generated by C++ Builder?

Solomon
02-26-2001, 07:12 AM
The EXE produced by C++ Builder compiler has a big export table. The member functions of various classes are listed in this table. This is a great help for reverse engineers. How to get rid of this list? TIA.
+SplAj
02-26-2001, 08:43 AM
Hi

Use ASprotect :)

SplAj
tsehp
02-26-2001, 10:46 AM
ha ha ha ha !
Solomon
02-26-2001, 09:40 PM
hehe, maybe I can write my own "strip" to erase this function list.


"Usage of ReVirgin" problems (reaction on TSehp/Killby)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > "Usage of ReVirgin" problems (reaction on TSehp/Killby)
PDA

View Full Version : "Usage of ReVirgin" problems (reaction on TSehp/Killby)

BlackB
02-26-2001, 07:23 AM
I practised using ReVirgin on notepad.....and that was no problem. Everything worked fine. But notepad is a too "everything-goes-fine" example program. It would be better if a little essay was written on how to unprotect Commview.
Anyway......here are some things that are not clear from TSehp's readme.txt:

-"IT.bin : the import table file generated after the trace, I choosed to put it at offset 0xe8d0 so this value was set on revirgin..."

This is not a really clear sentence. If I read this I wondered: Why did you choose offset E8D0 ? So I started to look in a PE-editor and E8D0 was the IT RVA. Great! So I succeed without too much trouble in unprotecting Notepad.

My next target....Commview v2.4. "Let's try this myself now", I thought.
Successfully found IAT RVA, Length, IT RVA. Now, the IT RVA is 12E12C as can be found in a PE-editor......but.....when looking at the dumped Commview, there is no such offset 12E12C. Okay, probably because it's a Relative Virtual Adress, right?
Now my question is.....what do I have to do to make this work? Add a new section with raw offset 12E12C and thus extend the dumped file with several bytes? Or should I search for another location in the dumped file that can be used. If so, how can I find such a location?

For these questions I've read the essay Kilby wrote....but that still didn't gave me any clarity on the case: He said that the IT RVA==761F8. Okay, then he writes:

"Starting at 741F8 highlight 1964 bytes (for that is the length of SSIT.BIN), and choose Replace with file, and choose SSIT.BIN.
Why not 761f8, well look at the section information, particularly at the Virtual & Raw Offset fields, on the .data and .rsrc sections."

Well, that's great Killby, but it appears to be that I do not own the game SuddenStrike, and that I just can't download a whole CD-ROM. It would be good if you explained why you choose 741f8 and not the most logical 761f8.

Then he writes:

"After saving this change, choose PE Editor in procdump and open ssdumped.exe and go into Directory and change the following fields:
Import Table Length
000761F8 000000CC"

Okay, now I'm totally lost.....if you just said you put the IT at 741f8 then why tell the PE the importtable is at 761f8 ??

There's also never mentioned (not in tsehp's readme or killby's essay) that other things, like raw-offset/virtual-offset should be aligned. Now, I know this, but I'm sure that many people who use ReVirgin for the first time, or just learn to unpack, know this.

Any two of you volunteer to write a detailed, easy-to-understand essay on CommView v2.4? I suppose not :P heheh, but some answers to my questions would be greatly appreciated. I bet they can help thousand other people too :P

greets

The Blackbird aka BlackB
+SplAj
02-26-2001, 08:24 AM
Hi BlackB

Yes unpacking with Revirgin is great fun.. but also a little strange.
The approach is NOT to replace the existing IT but build a NEW one at the end of the unpacked target. So 1st thing to do is simply DUMP the target and use PEditor 1.7 to see the sections. With the Cv2.4 I dumped the last section was at
RAW/RVA 0x170000 (SAME VALUE - IMPORTANT for pasting IT) . Just 'right-click' and ADD a new section some 0x3000 bytes long call .BlackB edit it to have an Vurtuel (sic) Size and Raw size of 00003000 and your done. Your new section is at 0x171000

Then dump the IAT & IT with Revirgin (rebuild) at 171000
and paste them in IT @ 0x171000 and IAT @ 0x1201E0.

Of course Cv2.4 WILL not run as it's very well protected and some more work is done.

I should make a tut SOON.....

SplAj
tsehp
02-26-2001, 09:20 AM
my two cents,
I'll upload a more clarified readme concerning the it location, I know its a trap when you first get to use it, you must know where to put the it, download the new readme pretty soon, btw I corrected some few bugs.

I'm still waiting for a good soul to send me a working safedisc 2 target,
so I can adapt revirgin to it.
I'll ask kilby to verify his essay,
thanks a lot blackb
risc
02-26-2001, 11:17 AM
erm 'tippex' didnt supply u with a safedisc v2 patched to no-cd exe?

yes/no ?

if no, /me will pester him again until he does!
Kilby!
02-28-2001, 05:40 AM
Firstly as I think I mentioned in the essay the topic of rebuilding is pretty new to me.

Therefore I may not have chosen the normal/proper way of doing something.

The original text of the essay was misplaced, and was rewritten from notes and SIce dumps.

This file was checked by a couple of people before sending for any obvious errors.

I think the problem comes from 2 omissions on my part;

1:
Not realigning the file sections

2:
Losing a sentance regarding the difference between Physical & Virtual addresses for the IT

Issue 1:

As the file was originally done for personal interest, I didn't align the virtual with the physical addresses.

Issue 2:

From Memory;
Regarding IT RVA==761F8 & 741F8, the 0x2000 byte discrepency.

I had originally I had placed the IT at the physical offset 761F8 and it didn't work.

When I looked at the sections with procdump, I noticed that the Physical and Virtual RVA where different.

There was an extra 0x2000 bytes in the Virtual section.

Therefore I subtracted 0x2000 from the physical offset, which gives 741F8, and this was where I pasted the IT there.

I then set the IT address with PEdit to the virtual address 761F8, (where the IT will be after loading.)

Hence the discrepency in memory addresses

With hindsight;

I should have realigned the sections
Deleted the .icd sections
Created a new section for this data

I have avoided adding and removing sections with Procdump as my machine gets seriously upset (usually requires a reboot), and wasn't strictly nessicary to make the file work.

I will go through the notes and dumps again.

If nessicary I will rewrite, or at least include the business about the physical & virtual addresses.

If I can get procdump to create sections without locking up my machine then I will expand the essay to include this, it is useful.

I may take a leaf out of ArthaXerXes book and do a .pdf version as a picture is worth a thousand words.

Apologies for any confusion caused,

Kilby...


About message formatting on bd
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > About message formatting on bd
PDA

View Full Version : About message formatting on bd

vgb
02-26-2001, 10:45 AM
Most of the msgs i read on the bd fit the width of the screen but there are always a few that require horiz scrolling to see them. Looks like the name column on the left is much larger.

A setting I can change or the poster?

ps. board is *MUCH* faster now!:*


ok who asprotect(ed) the newbie forum?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ok who asprotect(ed) the newbie forum?
PDA

View Full Version : ok who asprotect(ed) the newbie forum?

hz
02-26-2001, 03:45 PM
Hi,
I can access the board but not the actual posts. Anyone else having this problem?.

regards
tsehp
02-26-2001, 06:20 PM
do your browser accept shtml files ?
khz
02-26-2001, 07:06 PM
Hiya,
Aplologies if this is posted twice, I did send it before. Yes it does accept shtml, I am able to read the last two posts on nb forum and all yesterday. Arrgh now I'm getting a "your nik has already been taken" and now "your email has been taken" while I'm trying to send this.
Just cos our alexey annoys you, no need to take it out on me :-).

regards
Bratcher
02-26-2001, 07:20 PM
I guess if you are able to read this posting you have figured out your problem. Is it the "document contains no data" message window? just clicking OK will make it go
khz
02-26-2001, 07:31 PM
hiya Bratcher,

thanks for the reply. No its "post not found" I'm
getting with just the option "go back". Appears I can read anything posted after a certain time today but nothing else.

regards
hz
carpathia
02-26-2001, 08:08 PM
Yes. Other people are having this problem.
Kayaker
02-26-2001, 08:11 PM
There is some strange shtml problem going on with the boards. Using either Opera5 or IE5 with default settings, no firewall, the cgi script doesn't seem to kick me to the thread unless it's in html format. And yet I can view the shtml topics OK directly by clicking on the links. The threads seem to physically exist as both forms, i.e the latest threads for the Newbies Forum at
http://www.woodmann.net/Ultraboard/Public/HTML/B8/

933-1.topic.shtml 25-Feb-2001 19:02 16k
933.print.shtml 25-Feb-2001 19:02 3k
936-1.topic.shtml 26-Feb-2001 04:30 12k
936.print.shtml 26-Feb-2001 04:30 1k
938-1.topic.html 26-Feb-2001 14:34 15k
938.print.html 26-Feb-2001 14:34 2k
940-1.topic.html 26-Feb-2001 15:40 23k
940.print.html 26-Feb-2001 15:40 9k

Even this board seems to contain both forms, probably why some of us with problems can even actually access these threads

http://www.woodmann.net/Ultraboard/Public/HTML/B5/

1775-1.topic.html 26-Feb-2001 11:27 28k
1775-1.topic.shtml 26-Feb-2001 07:20 26k
1775.print.html 26-Feb-2001 11:27 8k
1775.print.shtml 26-Feb-2001 07:20 7k
1784-1.topic.html 26-Feb-2001 11:25 14k
1784.print.html 26-Feb-2001 11:25 2k
1788-1.topic.html 26-Feb-2001 17:31 25k ;the thread you're reading!
1788.print.html 26-Feb-2001 17:31 5k
1795-1.topic.html 26-Feb-2001 16:51 19k
1795.print.html 26-Feb-2001 16:51 3k

I get the same "go back only, do not Pass Go" option as Hz. The strange this is I was reading ALL the threads OK earlier today at work with Netscape, but in some of the cases I *did* get the "OK" button to press on and it did eventually load the thread file. Not so with these other browsers. There must be some subtle configuration difference between the browser's and how they handle the cgi script?

Anybody else having these experiences?

Kayaker


a request for comments : creation of a private asprotect forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > a request for comments : creation of a private asprotect forum
PDA

View Full Version : a request for comments : creation of a private asprotect forum

tsehp
02-26-2001, 06:22 PM
The main idea is to let *known* users discuss about this topic, without fearing alexey's visits to leach about our recent findings.
btw asprotect 1.2 has already changed, the oep are not reached the same way than before.
thanks for your comments.

+Tsehp
Lord Soth
02-26-2001, 06:51 PM
Good idea my friend. The developers don't help us by telling us what they did to protect, so there should be no reason that they know how we overcome their
protections.
The problem would be to set up trust for new users. You can never know if some
cracker is not a protector incognito hehe

LS

+Tsehp (02-26-2001 08:22):
The main idea is to let *known* users discuss about this topic, without fearing alexey's visits to leach about our recent findings.
btw asprotect 1.2 has already changed, the oep are not reached the same way than before.
thanks for your comments.

+Tsehp
josephCo
02-26-2001, 11:29 PM
I don't visit here often, but as far as a special forum for a special protection, get with the program. I don't want to sound high and mighty, but what was the reason for THIS forum in the first place? Was it so only crackers could share knowledge? If that was the case, I must have missed the signup sheet because I can't remember any such rule. I say share what you know or keep your mouth shut. If he learns from us - good. What would you be if he never updated again? Just another guy on a forum offering advice or some super-duper stud? So what if he visits here.. let him learn. Maybe in the next version he'll throw you something so wild that you won't be able to figure it out, now wouldn't THAT be fun! ;) Just my 2 cents worth. Keep it all free for EVERYONE!

joe
tsehp
02-27-2001, 01:22 AM
josephCo (02-26-2001 13:29):
I don't visit here often, but as far as a special forum for a special protection, get with the program. I don't want to sound high and mighty, but what was the reason for THIS forum in the first place? Was it so only crackers could share knowledge? If that was the case, I must have missed the signup sheet because I can't remember any such rule. I say share what you know or keep your mouth shut. If he learns from us - good. What would you be if he never updated again? Just another guy on a forum offering advice or some super-duper stud? So what if he visits here.. let him learn. Maybe in the next version he'll throw you something so wild that you won't be able to figure it out, now wouldn't THAT be fun! ;) Just my 2 cents worth. Keep it all free for EVERYONE!

joe

Keeping it all free for everyone will still be the ideas of those forums,
but asprotect is a different case, just imagine that you built a tool or a program that costed you a lot of working hours, that's the case with usual iat rebuilders that were made before like the famous r!isc ones or my recent tools.
Well Alexey uses to get info from our forums, and changes only some parts of his code, without inventing anything new, but enough for those programs to fail. He plays on the 2-3 weeks time between his new version, and the corresponding un protector that will follow, urging all his clients to update because the previous version is cracked.
Do you think that all those working hard reversers still share what they
found here ? It's wrong, I get a lot of personal e-mails about this topic, so the idea is to encourage those people to still share their knowledge, but this time not to make this guy win some bucks with all our work.
The idea only concerns asprotect, the rest will still be free and available to everyone, as long as the other protections schemes seems to evoluate just by the original ideas of their programmers.
AdamA
02-27-2001, 03:16 AM
Hi,
its a great idea to create a private asprotect forum. I think its not fair that Alexey earns money with our knowledge, so he can use his brain to improve asprotect.
Alexey has an easy game here, he looks at this forum and knows the weak points of asprotect. We should make the game for him a little bit harder.

AdamA
BlackB
02-27-2001, 03:49 AM
.....something I have said for months........and no-one would believe. But I'm happy some ppl have come to the same insight.

Btw, it is not so easy to put the Asprotect discussion in private. You know, there are hundred ways for the protector to infiltrate in the cracking/reversing scene and to get his knowledge.
Also, on what basis will you (tsehp) accept someone asking for new info on Asprotect and/or ReVirgin? People you know...yes...but it shouldn't be so hard for Alexey to act like me, BlackB. Well, the only reference are the emailadresses. :)
But still, it won't be easy to keep it private.

greets

BlackB
+SplAj
02-27-2001, 04:35 AM
Here is a snippet fro the ASprotect help file :-

QUOTE
=====
" All authors of protection tools state that their one is the best, so whom to believe? How can I be sure it is not just a regular trickery?

When you choose a protection, don't listen to authors - no programmer will confess his product is bad, or he/she may simply be mistaken apropos of his protections. You'd better consult your colleagues who already use this protection (e.g. meet them at forums); ask more competent programmers in the sphere of Software Protection to analyze your protection. If your previous protection was cracked and you have e-mail of the cracker, ask him to test your new protection. There's no doubt it would be interesting to him.

Our Protection Team will perform testing of your protection, point out its drawbacks, and advise changing or improving the protection. Contact the Protection Team...... "
UNQUOTE
=======

So I guess we are the the 'Team' :-D

I don't think a private forum will succeed. Yes, you can get some extra info about the visitor and try and 'validate' him
but hell, If I go to an Internet Cafe in any major City my ID will
be different.So a private e-mail group is feasable..... But for me this is a fun thing. I am hooked on 'reversing' - erm cracking :) and I can see the sad day when it will be too dangerous to be so open on the net as we are right now. Back to just DL targets and playing by myself }> or reversing shareware from Magazine CD's. I reverse hundreds of targets a year. How many do I keep ?..... about 5 programs in 5 years !!! The rest are just discarded as useless bloated crap. I keep lever arch files of SI screendumps and notes for reference.

I have only been really 'public' for the last year. I try to be careful, but still some people find I am in Canada or whatever.

So, my point of view is this, we are destroying some companies business model by reversing for FREE. BUT we also
ADD VALUE to the protector cos he learns. Just look at the development of ASprotect. Find some tuts from 2 years ago and it was friggin LAME, by today's standard. Cutting edge at the time. He has worked hard to improve his protection and actively pursues perfection. We take up the challenge by reversing lame software like 'TagRename' for fun.
I want him to earn money and survive and improve, else I have no fun and have to switch off my 2 PC's and revert to discuss the size of my Pirelli tyres and how many 'pints' I can drink in an hour and the size of that girls tits.......blah blah blah.

Long live the reverser/protector game

SplAj
G-RoM
02-27-2001, 06:48 AM
Tsehp :

Tell me... why asprotect is a so different case ? I see no difference between this one and Safedisc, VOB, securom, softlocx or whatever. You spent lots of time and poor Alexei broke your job with an update ? Dang :) How unfair :). Conceptually, if he break ur method very fast and easily, this is may be because ur solution is too trivial. Hiding ur discussions won't help if at the end u publicly release tool or whatever. And I am pretty sure u will or someone else will do so. U wanna own asprotect (or whatever) ? Design secrets weapons and never release them.

U are blinded by the fact u want to be recognized and hope to break for good ASProtect... Wake up, he will never give up (after all this is his business :).

Cheers,
nblender
02-27-2001, 08:48 AM
Well, I would hope Alexey would not give up,
else what would differentiate his product
from others :) He is providing quality support
to the people that bought his product. Of
course, the fact that the versions of asprotect
up till now have been broken suggests that
any program protected up till now with asprotect could be
deprotected and converted into warez by
skilled crackers, so maybe purchasing a generic
protector might not be such a good idea,
not to mention the additional memory requirement
of multiple occurrences of packed programs.
vgb
02-27-2001, 11:10 AM
Even tho I understand your point, +tsehp, I do NOT feel a private forum is a good idea. The main idea of our reversing is to learn. This would hurt that idea. Trying to validate users would become a horrible task and if Alexy could get a friend to get inside - he has the info. I see it as an ongoing battle between Alexey and the reversing community. Somewhere down the line, the cycle will break. The cost of additional changes to develop an uncrackable protection will become to much. Let's face it, other than government and high $$ financial areas that use very expen$ive encryption, etc - the average protection has been designed to stop the casual user from easily cracking it. There will always be people who want the challenge and have the time to spend hours/days cracking a certain protection. I think Asp will reach a point of no return where further development will be useless for it's targeted market. Also, if I were a customer of his and I kept getting updates because the protection had been cracked, I'd begin to look for another method.

vgb
carpathia
02-27-2001, 12:36 PM
This was always going to be a controversial thread ;-)

For what its worth, I agree with JosephCo and Splaj on this one. Alexei studies hard just as we do ourselves. We choose to reverse for fun, he chooses to apply his knowledge and pay his bills. I dont personally have a problem with that.

So each AsProtect version doesnt really change dramatically. Will keeping info secret fix this in any way ? IMHO, I dont think so.
Whereas if info is kept open and free to all, he may eventually decide to make a radical change, like joco says. Or who knows, someone else will learn him Alexei's methods, take it a major stage further, and produce another interesting protection.

I dont think anyone can deny that whatever your opinion, AsProtect has been quite a hot topic in the reversing community recently. Good. It makes a change. Let him earn his bucks, he is the one who had the initiative to use his (and undeniably) a lot of other peoples knowledge to produce something worthwhile.

Finally, I think a choice has to be made. Is the ultimate aim to be able to unwrap and crack all AsProtected applications, period?
Or do we want to eventually see progress in protection, want to be challenged, be forced to think like we all were in past days.

I was personally hoping the HCU-like elitism and hidden knowledge had been swept away for good. Well, lets see.

Regards

Carpathia
tsehp
02-27-2001, 04:54 PM
I'm not dreaming, he will surely get at least the info provided on this
private forum, but he's got to be approved by the actual people
that could access the forum, registered accounts with sufficient level.
But did you noticed something ? datarescue now spreads ida non gui,
softice is almost not updated and all those great tools will soon be outlawed on 2002 as fravia told me recently on our last meeting.
I don't personally think an open site or board will last forever and if we want to still share our knowledge, inner circles could be built.
I don't pay attention if he wins or not money, I just believe that at a certain level, good reversers stops to share what they discovered and only shares this knowledge with their friends or trusty people, so my idea was to make an attempt for those people to share what they know more easily.
Imagine you created a tool, and you know that at your level of programming, this could be easily defeated by an army of professional protectionnists, will you send them your sources telling them : hey, look what I've built, you can defeat this easily if you do this etc...
I just want to act the way they do : let the most important info, be shared with people that understands it and are trusty without only using e-mails, we could maybe gain a lot info if this kind of forums work.
But this isn't my decision, it is yours and actually my idea is far to have everyone's credits :)
later,

+Tsehp
Lord Soth
02-27-2001, 05:29 PM
heya +Tsehp,

Care to ellaborate on those points ? It's news to me..

LS

+Tsehp (02-27-2001 06:54):
But did you noticed something ? datarescue now spreads ida non gui,
softice is almost not updated and all those great tools will soon be outlawed on 2002 as fravia told me recently on our last meeting.

+Tsehp
CrackZ
02-27-2001, 05:32 PM
Hiya +Tsehp (nice job on Revirgin btw),

I'll be brief with my post. Consider the following :-

1. Alexey has many scene friends, I think you'd have a hard job filtering them out or blanking out any information you might try and hide on the 'other side'. Like any decent protectionist he's clued up and heals his software each time it gets breached, the conclusion can only be that a private forum would not work, regardless of all this 'free information' stuff I've seen flying about.

2. I like what G-Rom said, albeit rather tersely ;-), the problem with most of the unpackers and tools is their specific nature, it is this problem that allows Alexey and protectionists in general to make minor changes and break tools completely, you spend the next however many weeks finding out about the break / fixing your tool and bam! he does the same again, ad infinitum (and I really know how you feel ;-) ).

So the challenge isn't one for Alexey, its for you/the reversing scene, to develop better ways so that he can't keep making these trivial changes ;-).

My 2c and some.

Regards

CrackZ.
tsehp
02-28-2001, 01:46 AM
crackz, you have a point here, sure even if the forum is restricted, the
info will be known, even if it's delayed. So this closes the topic to me and forward me to maintain revirgin to always be up to date against
asprotect and other schemes also.

crackz, did you set up a new site ? if so, send me the link for me to add at the bottow of those pages.

regards,

+Tsehp
BlackB
02-28-2001, 02:34 AM
Well, I don't think they did that because of for us crackers :) They really don't like crackers @ Datarescue.....or, they certainly don't like me. hehe.
Just check the ida general forum.
And they aren't really convinced themselves that IDA will be prohibited.

well....nothing more to tell.....

regards,

BlackB

+Tsehp (02-27-2001 15:46):
But did you noticed something ? datarescue now spreads ida non gui...
+Tsehp
BlackB
02-28-2001, 02:37 AM
Well, I don't think they did that because of for us crackers :) They really don't like crackers @ Datarescue.....or, they certainly don't like me. hehe.
Just check the ida general forum.
And they aren't really convinced themselves that IDA will be prohibited.

well....nothing more to tell.....

regards,

BlackB

+Tsehp (02-27-2001 15:46):
But did you noticed something ? datarescue now spreads ida non gui...
+Tsehp
G-RoM
02-28-2001, 04:55 AM
Mr BlackB:

Well u should have known that datarescue doesn't like crackers... after all IDA was released several times... now think a bit and how would u react towards crackers if the works of ur life was spreaded for free ? I am pretty sure u would be upset.

Speaking about prohibition of tools, ur remark is a bit stupid since u need a debugger to develop ur software and eventually a disassembler (btw adding some printf blabla inside ur code could be assimilated to be a debugger). More generally if i follow you, compilers should be prohibited .. after that's what is needed to create tools :). How on earth would u justify that those tools are prohibited ? It would kill software engineering business. And I doubt governments would like to have all I.T. companies against their ass. Anyway we will have to wait and see about this.

Mr Tsehp :

Welcome to the reality :). Improving ur methods is the only way to go. The more technical and abstracted (from a particular scheme)they are, the more difficult they will be to fuckup. Now speaking about knowledge sharing, creating a such board wouldn't have helped imho. It is a question of trust... Personnaly i wouldn't trust people from a board... not for sharing "secrets" techniques or tricks.

Cheers,
Cast
02-28-2001, 03:34 PM
Since when did crackers start to copyright they'r knowledge :), i thought we where the ones deprotectiong intellectual property, and not protection our own knowledge. As far as i concern, all knowledge about protections should be spread, this helps the new reversers to learn. The reason for why people want an inner circle is as far as i concert just to make themself feel special, we we're/are all newbies once, we appreciated the help we got then, and we should repay that be spreading our work.

So what if protectionists learn from us?
They have the right to protect their property as good as they can :)
And even make money on their own products hehe.

Regards,
Cast
tsehp
02-28-2001, 04:50 PM
Cast (02-28-2001 05:34):
The reason for why people want an inner circle is as far as i concert just to make themself feel special, we we're/are all newbies once, we appreciated the help we got then, and we should repay that be spreading our work.

Excuse me but do you think such a msgboard, archive site, links all all the work to update this is meant to build a secret place for us to feel special ? I'd like you to think a little and not to deviate what I first meant by protecting some ideas against software protectors, thats all pal.
tsehp
02-28-2001, 04:55 PM
G-RoM (02-27-2001 18:55):

Mr Tsehp :

Welcome to the reality :). Improving ur methods is the only way to go. The more technical and abstracted (from a particular scheme)they are, the more difficult they will be to fuckup. Now speaking about knowledge sharing, creating a such board wouldn't have helped imho. It is a question of trust... Personnaly i wouldn't trust people from a board... not for sharing "secrets" techniques or tricks.

Cheers,
The more difficult they will be to fuckup, the most chances we've got is to team and focus on a difficult target, so the idea could stay and create a open public asprotect forum, the topic comes a lot on the rce msgboard, so much that people searching the web for asprotect to lock their lastest program will land on this msgboard instead of aspack site :)


Help with Folio LCF files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with Folio LCF files
PDA

View Full Version : Help with Folio LCF files

Maniac
02-27-2001, 12:50 AM
Hi all!

Have anyone information about licensing in Folio Views?


Tutorials about cryptogrphy used in shareware programs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Tutorials about cryptogrphy used in shareware programs
PDA

View Full Version : Tutorials about cryptogrphy used in shareware programs

draX
02-27-2001, 07:37 AM
maybe someone of you can help me. i'm looking for tutorials on how to attack programs protected by RSA, DES, DSA, Elgamal or other encryption methods. i found two tutorials about RSA but they don'T help me much, i also got some keygensources by tE! and duelist, but its hard to understand what they are doing without any comments. the book applied cryptography doesn't help me either cause it's to much theoretical, i'm looking for some practise with programs out ther, if someone could help me, that would be great
thx
draX
goatass
02-27-2001, 08:53 AM
Umm..what program are you working on ?
tE!'s keygens are excellent and if you don't understand them without comments you won't have much luck with cryptography, also the Applied Cryptography book is the theory of crypto like you said and that's why you need to read it and it's very important. Did you read my RSA paper ? it should help you out in locating the protection and identifying it..I have another ElGamal paper in the works but I'm home for break so I can't work on it. The method I suggest is to first locate the place where the check is located, then look around for any string refs of numbers that could be used in encryption, then try to figure out how the program verifies the key, if you know the formula it uses to verify then you can figure out what crypto algo it uses. Most likey it will use a signature (public/private key) algorithm when dealing with serial numbers, once again I don't know what program you are working on so I can't give you more details. Also check to see if there is some kind of Hashing happening to your username and company/e-mail or whatever (I'm assuming you are dealing with a serial number routine) check if there is a number that is used alot in calls it is most likely the modulus or prime see if that number is incremented or decremented by one (1) that should help also to isolate the other calls related to the algorithm.

Hope that helped
goatass
draX
02-27-2001, 11:00 AM
thx for your reply goatass, i'm not working on a special program, i was just looking for some papers that get me started in crypto reversing. as i said, the keygens didnt help me much, cause tE! and duelist doen't describe how they reversed the app. i'm not interested in the result, i want to see how it is done, if you get my point(my english is not that good). where can i get your paper? and when will your paper about elgamal be finished(i hope soon ;))

greetings draX
goatass
02-27-2001, 01:14 PM
You can get my paper from tsehp.cjb.net and zencrack2.cjb.net it describes alot of the basics on locating the crypto related functions. I do suggest you read the Applied Crypto book all the number theories are very important to understanding how it all works. tE! keygen for SecureCRT is very good because it has code to solve DLP and reduce the group a generator is in which is very helpful anf if you understand the theory you will have no problem understanding his source codes.

goatass
draX
02-27-2001, 02:28 PM
do you know if there are any tutorials about how to crack crypto protected programs? i mean not only the keygen sources. some sort of explanation would be of big help for me.
goatass
02-27-2001, 03:53 PM
No not really I had the same problem when I started working with crypto that's why you have to read the Crypto books and learn it yourself from scratch.

goatass
draX
02-28-2001, 01:18 AM
ok, i'll get as much info about crypto theory as i can(and try to understand them ;)) but can you make any suggestions on what to start first? are there any program that are good to practise on?
draX
02-28-2001, 01:18 AM
ok, i'll get as much info about crypto theory as i can(and try to understand it ;)) but can you make any suggestions on what to start first? are there any program that are good to practise on?
draX
02-28-2001, 01:20 AM
sorry for posting the above twice, i had some problem with my browser.
goatass
02-28-2001, 06:47 PM
yeah read the theory it's very important. I don't really know any programs that are easy to reverse when it comes to crypto. I do suggest you check out TMG's Keygenme #2 the one I wrote my paper on since it is very easy to spot the protection therefore you can focus on understanding it and if you get stuck there is my paper to help you. Once you do that get Duelist's keygen sources and go download the programs he has keygen sources for so you can use the sources as a guide.

feel free to ask for help if you get stuck.

goatass
Kilby!
03-01-2001, 04:57 AM
This is a little bit of a side issue.

A good way of getting a good basic knowledge of cyphers is "The Code Book" by Simon Singh (it's out in paperback).

It had reasionable info in RSA & DES, and the challenges (at the back of the book) are pretty good for learning the principles of decryption.

It's amazing how many shareware packages use the simplest of algorithms which could be broken by hand (if anybody was bored enough to bother, BTW KIATerm was one of them)

Unfortunitely the 10,000 UK pounds prize has been won.

Kilby...
draX
03-01-2001, 05:47 AM
thx for all your help goatass, i'm sure i'll have alot of questions when starting the real work, but its good to know that someone is there who tries to help you. thanks :)


Help trackin IO from a driver
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help trackin IO from a driver
PDA

View Full Version : Help trackin IO from a driver

isis
02-27-2001, 09:05 AM
I want to reverse a windows driver.
In fact I don't need to reverse the whole thing but just the IO made by the driver with the chip on the card.
Is there a tool that can do this without knowing the port address ?
Iceman
03-01-2001, 03:14 AM
What OS are we talking about , and what kind of device? As for tool's
such tool dont quite exist. Tools dont perform magic , they either spy a wery specific IO range , either are generic but they require some information from you.
isis
03-01-2001, 07:08 AM
talkin about win 9X.
The matter is to spy IO made by some driver, may be in the vxd, ma bye in the drv or in any dll called.
I'm lookin for a tool that can spy IO made by a proc.
If u got a tool that can spy range of IO port I could try to spy all the ressources allocated to the driver.
Thx for any tip.
isis
03-01-2001, 07:12 AM
talkin about win 9X.
The matter is to spy IO made by some driver, may be in the vxd, ma bye in the drv or in any dll called.
I'm lookin for a tool that can spy IO made by a proc.
If u got a tool that can spy range of IO port I could try to spy all the ressources allocated to the driver.
Thx for any tip.


Unpacking question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unpacking question
PDA

View Full Version : Unpacking question

__DuDu__
02-27-2001, 03:52 PM
Hi !

suppose a get a program packed with x and i unpack it manually
jmp eax note entry point etc and the program runs fine

how can i code an unpacker so any file packed by the program x will be unpacked by my unpacker ?

thanks in advance
__DuDu__
mustapha
02-28-2001, 05:47 AM
If you really want to write a unpacker, it is a wrong answer but if you want to ease you job just make a script for procdump.
+SplAj
02-28-2001, 08:29 AM
Try and analyse the 'de-cruncher' from one of the UG.
an automagic unpacker for the BiTarts stuff (..hey i'm polite now guys, usually I say BiTarts shits :) )

saw it at exetools.com

This launches the target, freezes the app before it destroys the IT, and then dumps it, correcting the IT and OEiP.....

i.e. it emulates YOU the manual reverser. So are you doing this as a challenge ?

BTW it did not work on my Win2K :) but my own dumps do
plus you still have further work to fix those unregistered bugs and it's no fun to use these tools, like CASPR etc as they just prove how fantastic these genii are over the rest of us mere Reversers :) and using them means we r lazy or lame or both.

SplAj
Jueteng Lord
02-28-2001, 01:55 PM
+SplAj (02-27-2001 22:29):

...it's no fun to use these tools, like CASPR etc as they just prove how fantastic these genii are over the rest of us mere Reversers :) and using them means we r lazy or lame or both.

SplAj

Its no fun to use SoftIce too as it just proves how fantastic these Numega genies are. And using them also means we are lazy or lame.

funny, this comments usually comes from those who cant make aspr unpackers :)
+SplAj
03-01-2001, 03:51 AM
:o

.....u r taking a bit of a 'GAMBLE' ribbing a :* mod :* like that !

SplAj }>


some information on parallel port access ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > some information on parallel port access ??
PDA

View Full Version : some information on parallel port access ??

booyah
02-27-2001, 04:01 PM
I am trying to send & recive data using the parallel port in Visual C++, does anyone have any documents on this?

thanks all :)
Kayaker
02-27-2001, 04:37 PM
Hi,

Check out
h*ttp://www.lvr.com/parport.htm
for lots of PP info

and WinIo v1.2, a dll that will probably do what you want at
h*ttp://www.internals.com

Kayaker


Hardest bite-board cube-pro ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hardest bite-board cube-pro ?
PDA

View Full Version : Hardest bite-board cube-pro ?

cichlidae
02-28-2001, 02:55 AM
Hi,

Is there anybody with experience for dongles from the brand Hardest
I can't find anything on the web about this dongle brand.


Attempt to apply ReVirgin on Pc Guard protection on app Iris
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Attempt to apply ReVirgin on Pc Guard protection on app Iris
PDA

View Full Version : Attempt to apply ReVirgin on Pc Guard protection on app Iris

BlackB
02-28-2001, 06:05 AM
Well, Pc Guard is pretty ASProtect alike, only better. I tried to unprotect the program Iris, which is a unbelievable powerful packet sniffer (a thousand times more powerful than commview btw). As the price (i think it was 1700$) is pretty high, a good protection is necessary ;)

Well, this is all of no importance actually. I just wanted to succeed in unpacking it with help of revirgin. So I launched Iris (don't forget to load icedump to avoid sice detection), launched revirgin.
IAT adress: BA478
Length: 12C0

Other useful info:
OEiP: 446C9C-400000=46C9C
ImportTable RVA: 12E12C

Revirgin recognizes ALL api's from the usual .dll's (kernel, gdi, etc...). But, it doesn't recognize ANY of the MFC42.dll . Anyway, I let ReVirgin make the IT.BIN and IAT.BIN, did everything, but of course, when running the dumped file it says "Can't find needed .dll".
Note that I dumped IT.BIN at 12E12C. This will result in an increase of the filelength. I realigned the sections with PE-editor. I also tried to add a new section at the end of the file (I think at 12F000), but that didn't work either. Disassembling was possible and IDA didn't complain about anything. The disassembling however ended after 2 minutes, and that's a little bit too fast for a > 1MB file. When looking at it I also had the impression that big chunks of the .exe are still encrypted.

When looking in PE-editor 1.7, all the API's are there but they have no dll name.

For people still not tired of trying to unpack these heavily protected apps, here's the url to download Iris: http://www.eeye.com/html/Products/Iris/download.html
The PC-Guard hompage: http://www.pc-guard.co.yu

Heh, I think I just want to do too much at a time, and pick the most difficult targets to test revirgin :) However, I have learnt quite a lot already after three days :)

Feel free to post your findings on this protection :)

Greets

BlackB
+SplAj
02-28-2001, 06:55 AM
Hi BlackB

Iris is also prewrapped with PEShiELD or somethin by AnAkin
then PCG32 is applied. The silly Laurentiou also failed to use the Licence system of PCG instead relying on his own feeble
serial algo.

Also check out offset ~62888 or so in the dumped exe, you should see an infamous name }>

Dont try and get the 'names' of those MFC's I informed Tsehp about my concerns in the early trials of Revirgin.
Just carry on regardless.It does not matter as these API's are 'nameless ones'

SplAj

Yes good work BlackB you are trying VERY hard, soon +BlackB ;)
SV
02-28-2001, 10:58 AM
Hi

I have unpacked this one and if it can help you
i post a complete rebuild IAT (generated to be
inserted in new section at 12F000).

Regards SV
SV
02-28-2001, 10:59 AM
Hi

I have unpacked this one and if it can help you
i post a complete rebuild IAT (generated to be
inserted in new section at 12F000).

Regards SV
BlackB
02-28-2001, 02:13 PM
Hehehe, +Splaj, it will still be a long run before I can put that + before my nick ;)
Btw, I noticed about that additional PE packing. I noticed it in hexworkshop when dumping it and iat ;)

Anyway, thx a lot splaj/sv/tsehp who're helping me on this unpacking subject, I already owe ya a lot.
At the moment of writing I'm with my girlfriend, and tomorrow too, so I don't have the time to test certain things out. Relaxation in life is also important ;)

well, gotta go......someone 's waiting, heh ;)

greets

The Blackbird aka BlackB
Kayaker
02-28-2001, 10:58 PM
Hiya BlackB,

Here's something to check if you're still having problems with MFC imports being resolved. I had this come up with earlier versions of Revirgin that I'd always meant to mention to Tsehp. But since I haven't tried it with the most recent version, I didn't want to complain *too* early in case he'd fixed it;)

There seemed to be a problem with some of the MFC Imports if the listing was interrupted by another dll Import. Even though the Import resolved OK and you could glean its ordinal value from the Save Resolved text file, once it was generated into the IAT the entry was 00000000.

Here's a section of the text file as resolved as it was going to get:

308 000494E0 6C2B5760 0A5C MFC42.DLL
309 000494E4 6C2B56EC 0685 MFC42.DLL
310 000494E8 00000000 001A RPCRT4.dll I_RpcBindingInqDynamicEndpointA
311 000494EC 6C303B14 035B MFC42.DLL
312 000494F0 6C31DE8E 0844 MFC42.DLL
313 000494F4 6C31DEB0 081E MFC42.DLL
314 000494F8 00000000 001A RPCRT4.dll I_RpcBindingInqDynamicEndpointA
315 000494FC 00000000 001A RPCRT4.dll I_RpcBindingInqDynamicEndpointA
316 00049500 6C30C3C7 187E MFC42.DLL

You can see that all the MFC4 imports are resolved, but in the corresponding IAT entry the MFC just preceding the RPCRT4 Import is now 0 instead of the ordinal value it should be.

000004E0 5C0A 0080 0000 0000 0000 0000 5B03 0080 \...........[...
000004F0 4408 0080 0000 0000 9433 0B00 0000 0000 D........3......
00000500 7E18 0080

I thought maybe this was because I_RpcBindingInqDynamicEndpointA wasn't resolved and I just had a weird app that actually used RPCRT4.dll. I fixed the pointers for both the missing MFC42 imports as well as the RPCRT4 ones in the IAT manually before pasting into the dumped file, but there was still a few things I had to check to get it to work right and the project kind of went by the wayside.

Anyway, check this out, it might still be an issue with Revirgin. In any case I'll give it another shot and let you know Tsehp.

Cheers,
Kayaker
tsehp
03-01-2001, 03:52 AM
Kayaker (02-28-2001 12:58):
Hiya BlackB,

Here's something to check if you're still having problems with MFC imports being resolved. I had this come up with earlier versions of Revirgin that I'd always meant to mention to Tsehp. But since I haven't tried it with the most recent version, I didn't want to complain *too* early in case he'd fixed it;)

There seemed to be a problem with some of the MFC Imports if the listing was interrupted by another dll Import. Even though the Import resolved OK and you could glean its ordinal value from the Save Resolved text file, once it was generated into the IAT the entry was 00000000.

Here's a section of the text file as resolved as it was going to get:

308 000494E0 6C2B5760 0A5C MFC42.DLL
309 000494E4 6C2B56EC 0685 MFC42.DLL
310 000494E8 00000000 001A RPCRT4.dll I_RpcBindingInqDynamicEndpointA
311 000494EC 6C303B14 035B MFC42.DLL
312 000494F0 6C31DE8E 0844 MFC42.DLL
313 000494F4 6C31DEB0 081E MFC42.DLL
314 000494F8 00000000 001A RPCRT4.dll I_RpcBindingInqDynamicEndpointA
315 000494FC 00000000 001A RPCRT4.dll I_RpcBindingInqDynamicEndpointA
316 00049500 6C30C3C7 187E MFC42.DLL

You can see that all the MFC4 imports are resolved, but in the corresponding IAT entry the MFC just preceding the RPCRT4 Import is now 0 instead of the ordinal value it should be.

000004E0 5C0A 0080 0000 0000 0000 0000 5B03 0080 \...........[...
000004F0 4408 0080 0000 0000 9433 0B00 0000 0000 D........3......
00000500 7E18 0080

I thought maybe this was because I_RpcBindingInqDynamicEndpointA wasn't resolved and I just had a weird app that actually used RPCRT4.dll. I fixed the pointers for both the missing MFC42 imports as well as the RPCRT4 ones in the IAT manually before pasting into the dumped file, but there was still a few things I had to check to get it to work right and the project kind of went by the wayside.

Anyway, check this out, it might still be an issue with Revirgin. In any case I'll give it another shot and let you know Tsehp.

Cheers,
Kayaker

I get it kayaker, for example just take this interruption :
494e4 : mfc import
494e8 : rpcrt4 import

I choosed the borland way of generating iat + it files, so the iat pointers *must* be interrupted by a dword 0 to interrupt the dll export list, in this case the interrupt should resilde in 494e8 and this entry should be 0, but in the target it's not, in the actual version of revirgin I just can't rebuild a rpcrt4 at this iat location, I'm oblidged to put a dword 0 and put this antry at 494ec, but this entry belongs to
mfc...do you see the problem, it's a windows problem.
maybe someone have an idea, maybe I can solve this giving up the borland way of creating iat files and switch back to m$ way, does someone have an idea on this ? if yes, I'll update in revirgin 1.01, soon available for 0$ except for alexey, 500$ :)
BlackB
03-01-2001, 02:08 PM
Frustration regarding iris, hehehe :P

All right, there must be something I'm doing wrong. Maybe a little detail that you guys see as normal, but that I never heard of (?)
Well, here's EXACTLY what I do to unpack IRIS. If I don't mention something then I also didn't do it:

-Run Iris.exe WITH Icedump to avoid detection. Dumping with PE-editor.

-Directly after dumping, I'm adding a section named .BlackB @ 12F000, virtual/raw size 20000 (just to make it big enough ;))
Nothing else is done.

-Revirgin is launched, IAT and IT are created after resolving with folowing options:
RVA: BA478
Length: 12F4
IT adress: 12F000
Length: 61C

-iris_dump.exe is opened in hexworkshop
IAT.BIN is dumped at BA478, number of bytes: 4658
IT.BIN is dumped at 12F000, 17562 bytes are added to iris_dump.exe

-PE-editor is launched.
Entrypoint is changed to 46C9C
Sorry, but even with the latest downloaded version, I get this as OEiP
Importtable RVA is changed to 12F000 and the length to 61C
Saving changes
To end, I let PE-editor realign the iris_dump.exe

-Disassembling with IDA runs perfectly, the entrypoint really looks like an entrypoint: starts with a 'push ebp'

-Running the iris_dump.exe: "Not enough memory to run application".

Well that's it. Some help is really needed. Goddamned, what am I doing wrong ? :)
IT.BIN and IAT.BIN are attached in Iris.ace
Note: download latest winace to extract!

greets

The Blackbird aka BlackB

ps to tsehp: there's nothing really wrong with revirgin, except for some bugs, but i'll soon make a list of them ;)
BlackB
03-01-2001, 02:11 PM
here it is ;)

BlackB
tsehp
03-01-2001, 07:30 PM
and for my two cents, I just corrected revirgin not to make this bug anymore on mfc42, it was coming from the code analyser (yes there is one !) that believed mfc42.dll exports were some iat redirectors,
you can set the up mem limit to stop the auto analyse now, I checked only the listing on iris 2.0 and this works fine.

regards,

+Tsehp
tsehp
03-02-2001, 02:02 AM
well I just did this :
launch the target, tracing with latest icedump 6.022
at oep 446c9c, do a /pedump 400000 46c9c [file]

launch your dump, the target runs !!!!!
(+splaj, I'll accept you to send me another target, I own you a night spent of cracking a target ;)

the target is included here

regards,

+Tsehp
BlackB
03-02-2001, 03:07 AM
pfffff, it 's just not fair :P
i'm working about two days on it with revirgin, while another simply does a /pedump :P

ah well, my day will come :) hehe

greets to everyone
thx to tsehp/splaj/cv/kayaker

BlackB
BlackB
03-02-2001, 05:41 AM
hmmm, just some little advice asking.....

I'm cracking for a cracking group for some time (two years or so), and....well......i'm starting to feel guilty to release cracks. You see, people like you (tsehp, +splaj, etc...) give me this good advice on reverse engineering, that I will then apply to make a stupid crack for all those lame people out there, not caring about what we do.
I'm having this thought for some time, but now that I'm busy with this asprotect/pc guard stuff, I'm really starting to feel uncomfortable with it.

On the other hand it's good that there are cracks for certain programs (like windows and other MS products) but I'd really hate to damage smaller companies by releasing a crack.
My doubts about releasing cracks also increased when I started a topic on the datarescue board concerning ida and cracking.......well, I just ask to give your opinions and thoughts about releasing cracks.....

thx

BlackB
G-RoM
03-02-2001, 03:12 PM
Mr BlackB :

First of all... fair or not, some people tries what is the easiest and for instance goes faster than you. This is a question of analysis and efficiency, then u know what is the most suitable with the tools u have. Speaking of that, sometimes I laugh a lot when i read posts about that and that, when people could use an existing hydra plugin that would do all the work in one single pass... I suppose nobody cared to check this. Not surprising... most people seems to need huge advertising and easy to use GUI.

Speaking of ur conscience wake up... Well well... Are u trying to get benediction of people in here to continue to release cracks ? U fear to harm little companies ? U should have thought about ur acts... besides I can't see why harming a bigger company would be ok. It is up to u to decide about ur life... makes ur choice urself and don't ask people in here to make u feel better. A crack is a crack... cost money for companies big or small... u know it... So now deal with it.

Cheers,
HalVar
03-03-2001, 11:12 AM
Iris is an eeye product. Eeye deserves to be hurt. Thats all I have
to say to this. Release it :-)
booyah
03-03-2001, 12:09 PM
i agree with him.
edward
03-03-2001, 12:45 PM
HalVar (03-03-2001 01:12):
Iris is an eeye product. Eeye deserves to be hurt. Thats all I have
to say to this. Release it :-)

Don't care about Iris...A crack has already been released some weeks ago :)
BlackB
03-04-2001, 08:07 AM
If a crack is already released weeks ago then it will not work for the latest version :P

Anyway, even if there's already a crack for it, I'm still interested in the protection......crack-minded damn people :P

greets

BlackB


http://www.researchindex.com/
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > http://www.researchindex.com/
PDA

View Full Version : http://www.researchindex.com/

The Owl
02-28-2001, 10:44 AM
use it wisely.
MO`K
03-01-2001, 04:09 PM
So good, i could cry ;)

Thanks alot.
TECH
03-01-2001, 04:55 PM
This is absolutely Brilliant.

Thanks


WinZip attack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WinZip attack
PDA

View Full Version : WinZip attack

mike
02-28-2001, 04:40 PM
As I promised, here's my paper on breaking WinZip, to appear in the FSE 2001 proceedings.

http://www.accessdata.com/zipattacks.zip

Abstract. In [BK92] Biham and Kocher demonstrated that the PKZIP stream cipher was weak and presented an attack requiring thirteen bytes of known plaintext. The deflate algorithm “zippers” now use to compress the plaintext before encryption makes it difficult to get known plaintext. We consider the problem of reducing the amount of known plaintext by finding other ways to filter key guesses. In most cases we can reduce the amount of known plaintext from the archived file to two or three bytes, depending on the zipper used and the number of files in the archive. For the most popular zippers on the Internet, there is a fast attack that does not require any information about the files in the archive.
The Owl
03-01-2001, 05:09 AM
could you please provide this document in a format that can be read on non-win32 platforms and on win32 platforms without a full installation of MS Word/Office? both .pdf and .html would do the job. thanks.
__DuDu__
03-01-2001, 12:25 PM
hi

can u provide in html format ? i don't have word or others shits, btw i can't get the program for access data to work here :( i added 5 files put password on them and the program seens to get the passwd but didnt show do i hvae to be registered ?

tnx
mike
03-01-2001, 03:19 PM
Yeah, sorry about the format. The publisher required either TeX or Word, and I didn't know how to use the former when I wrote this. I'm converting it to TeX w/ .eps graphics now, including some corrections that the editors asked for. From there I can generate .ps and .pdf versions. I sent Tsehp an HTML version sans graphics and he's going to post it in the new essays section of the Fravia site. When I get the conversion done, I'll post again.

As for the demo proggy, it's version 4 of the toolkit. It only recovers 10-character passwords. We've been on version 5 for a while, but didn't want to get hacked so it's not on the site yet for downloading :D

If any of you can come up with a viable business model that includes open-sourcing the password cracking code, I'd love to hear it.
mike
03-06-2001, 10:59 AM
Here's zipped postscript. No figures yet.

http://www.accessdata.com/zipattacks.ps.zip
Jack
03-06-2001, 05:54 PM
Einride/Phrozen Crew has made a zip cracker based on this known attack and it actually works very well.

PC ZipCrack 0.2b pc_zc02b.zip
mike
03-07-2001, 11:25 AM
Jack (03-06-2001 15:54):
Einride/Phrozen Crew has made a zip cracker based on this known attack and it actually works very well.

PC ZipCrack 0.2b pc_zc02b.zip

They may have implemented Biham & Kocher's known-plaintext attack, but I doubt they implemented this one, since I discovered it! But I'd be interested in getting a copy of that, just to make sure. The only links I've found are dead. Can you mail it to me?
mike
03-07-2001, 06:14 PM
www.cs.oberlin.edu/students/mstay/PRTKHome.exe

This is AccessData's Password Recovery Toolkit with the WinZip Divide & Conquer attack, PKZip dictionary and PGP secret keyring dictionary attacks activated.

It'll open any WinZip with 5 or more files in about 2 hrs regardless of password length. Enjoy!

WARNING: 7.5 Megabytes!


Finding the entry-point......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Finding the entry-point......
PDA

View Full Version : Finding the entry-point......

SpeKKeL
02-28-2001, 05:46 PM
Finding the real entry-point's of some packed prog's
is sometimes a real pain in the .... (for ME), i know that a lot jump at the end of an unpacking routine to the oep ( jmp eax,ebx or with a ret).
But sometimes this isn't traceable and then...?
A tried with some bpx's on getversion/getmodulehandleA and traced backwards..
But this isn,t also verry satisfactioned and also the prog bw2000 can't find it manytimes.

Are there better way's to do this ..?

thanks for some input,

SpeKKeL


Reverse Engineering forum down?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reverse Engineering forum down?
PDA

View Full Version : Reverse Engineering forum down?

Antipodean
03-01-2001, 05:41 AM
Hi

One of the last messages on that forum that I saw was from golem. looks like he might have managed to take it down. Does anyone know for sure?
Carpathia
03-01-2001, 01:51 PM
Hi,

If youre referring to Mammons forum, try

http://disc.server.com/Indices/37.html

Regards

Carpathia


Attention -> Possible new asprotect 1.2 scheme to reach the oep
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Attention -> Possible new asprotect 1.2 scheme to reach the oep
PDA

View Full Version : Attention -> Possible new asprotect 1.2 scheme to reach the oep

tsehp
03-01-2001, 07:43 AM
First, this is not my work, but a team work with
kayaker and +splaj, kayaker did the most important work, I just managed to make this target work with a little more work.

target : http://www.softshape.com/cham
chameleon clock

Normally, you trace the target until you find the oep, then dump it, reconstruct the iat's, paste them and that's all.

Now things changes a little, there's an interact between asprotect 1.2 and this target, here's how :

asprotect calls some target code at 492830, you'll see this with first icedumps trace after loading the target, this code makes local mem allocations, sets some flags, then it rets to asprotect, finally asprotect jumps to program's oep : 4aec88.
if you dump it there, the target will not work, the flags could be detected and the target crashes.
I choosed an easy way to solve this :
dump with oep 4aec88 but avoid asprotect to jump to 492830 before, so the mem is clear.
reconstruct iat's (thanks revirgin he he)
realign sections, but put the oep to 492830, and change the code here :seg000:00492944 pop ebp
seg000:00492945 jmp loc_4AEC88
seg000:00492945 start endp
see the jmp 4aec88, it was a ret before.

So the target self initializes what asprotect did by calling this call
and we jump to the normal oep.

two apps are actually known :
Advanced Link Catalog v1.00 (http://www.wizetech.com/alc/) and
Chameleon Clock 2.51 (http://www.softshape.com)

So alexey could apply the same scheme to other targets, or maybe change some things if he thinks to check if we have found something.

Again, thanks for the team work, and stopping me driving nuts with this one. ;)
regards,

+Tsehp
+SplAj
03-01-2001, 08:16 AM
Tsehp

Thanks for keeping me awake for the last 2 nights, shit my eyes are so swollen,red and blurry......actually just like that friggin chamelion :-)

Cheers!

I've found one to share back with you (? incorrect English) and you'll find this one has a funny blood shot iris as well ;)

Revirginated.........

SplAj
Kayaker
03-01-2001, 11:51 PM
Hey nice, by forcing the code in 492830 to process before jumping to the OEP, it does initialize the app properly. It's necessary to skip this code during the unpacking process, where it's normally called, before dumping because it will just cause all kinds of runtime errors later when running the rebuilt file. But even then you get an error at 4AEE12 because 0 is moved into a register instead of an address.

As Tsehp says, this code sets (Asprotect?) flags of some sort, but it *also* initializes the app by querying the registry of setup parameters for the program such as Language, TimeFormat, ShowDate, Reg, etc. I was able to get the program to run w/o having this setup code processed, the shareware nag ran OK and the program started, but this particular program uses a Winamp type Skin, which was never put on with the way I patched it, so it ended up as a very unobtrusive kind of invisible clock ^_^

With the other program mentioned, Advanced Link Catalog, I found it was only necessary to bypass the call to program code during unpacking, which can be found with /Tracex BTW, before dumping. For whatever reason it wasn't necessary to process the missed code before running the program at the normal OEP.

Now both programs have a registration routine tied into Asprotect, at least as far as that the Registration Key was probably generated during packing. I'm not sure if the registration routine is still viable in the unpacked file, but if it is the 256 byte reg key is still an effective protection to "properly" register the app without patching. ALC at least has further limitations that Hz and I were able to get around.

That said, what advice can we give to shareware authors in this new age of Share the Knowledge enlightenment? Well, I don't really know. I'm not a shareware programmer and I don't know how to beat the combined knowledge and skill of the reversing community. Sophisticated packing routines, registration protections, disabled demo programs, all a credit to their author's ingenuity and programming skills. All seem to fall eventually.

I think for most of us here the thrill is in the chase, reversing is just another aspect of programming, in which we're all interested. I think few of the members here who normally post actually distribute cracks (ooh that word tastes bad), fewer still even keep many of the programs they 'reverse' and would never have bought them in the first place.

I personally don't want to hurt any poor shareware programmer trying to make a buck by posting what I post. And I also know that I'm being a hypocrite just by doing so. But the reversing scene is not going to go away, crack distribution is not going to go away, the only way the shareware authors have a chance is if we all just shut up and go away ourselves. Ain't gonna happen. So if cagey shareware authors monitor this board and glean any new ways to come up with a protection scheme twist that will keep us up till the wee hours with swollen, red, blurry eyes, I say all the credit to them. They say the greatest technological advances occur during times of war. Which side are we on?

Vive la guerre ;)

Cheers,
Kayaker
tsehp
03-02-2001, 01:45 AM
It ain't do bad at all, those rce activities are first involved with cracking programs but we also serve to warn those shareware programmers about generic commercial protections that claim to be the ultimate protection, never cracked, etc... We also contribute for keeping the programs code available for people who want to verify
eventual conceiled activities inside.
It's kind like the napster case, killing the know and visible server, that the music companies could eventually control by asking napster to pay a small fee by each mp3 traded have much limited their loss.

But not, those tough guys believes really in their power and kill the monster, so all the napster customers will move to gnutella and get in touch with this peer to peer file exchange system, absolutely impossible to control.

So as long as people coming here don't request or upload ready made cracks, keygens, patches, we can stay, even if I was oblidged to remove the anti m$ pages as the evil empire requested...


asprotect and crypto
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > asprotect and crypto
PDA

View Full Version : asprotect and crypto

mike
03-02-2001, 01:05 PM
I keep seeing all these cracks using revirgin. Doesn't asprotect encrypt parts of the code until a valid reg# is entered? Seems like that would be the most straightforward way of doing it, and someone would have to buy a valid reg # and distribute it to get around it.
mike
03-02-2001, 02:04 PM
Woah! I have no idea why this posted so many times... Sorry!
risc
03-02-2001, 02:48 PM
its an optional extra, if u use asprotects serial scheme, u can choose to protect chunks of code too ..

didnt you RTFM? :-)

r.e. asprotect.hlp / examples ..
mike
03-02-2001, 04:19 PM
Well, perhaps if he made it a requirement then he wouldn't have so much trouble from this board ;D


My new website design! ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > My new website design! ;-)
PDA

View Full Version : My new website design! ;-)

BlackB
03-03-2001, 03:48 AM
Well, my new website design is online. See it as a bèta version of it, so...comments, opinions, etc... are welcome.

http://blackb.tsx.org

however, soon I'll setup my http://www.cracking4newbies.org (it already works, but have to remove the addframe ;) )

Thx, and regards

The Blackbird aka BlackB
goatass
03-03-2001, 08:32 AM
very nice BlackB, keep it updated with new stuff and I'll visit everyday :)

goatass


Question about te!'s RSA Tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Question about te!'s RSA Tool
PDA

View Full Version : Question about te!'s RSA Tool

draX
03-03-2001, 08:15 AM
when i use tE!'s RSATool with option "Use QNFS method only" i get a windows message(after the program is running for some time) about low diskspace on drive "c" and then the tool aborts. why do i get this message and is there a way to force the tool to use an other harddisk with more space left?
goatass
03-03-2001, 08:29 AM
when you use that function you are using the Quadratic Number Field Sieve (QNFS) Algorithm to try to factor a number. That function if you read about it in the docs you will see the funcky design of it. Basically it requires tons of memory and the RSA tool uses hard drive space as memory instead of killing all of your regular memory.

What you can do is set your %TEMP% path to another drive with more hard drive space or just not use that function.

goatass
draX
03-03-2001, 10:01 AM
thanks for your help again goatass, but where can i set this temporary folder? is it in the registry or where should i look for it?
draX
03-03-2001, 11:44 AM
i set the tempdir to a bigger hd, but it doesn't work. so i set the windows swap file to the bigger hd too, but still the tool quits after some time(but this time there is no error about not enough space). why does the tool quit even there is enough space(7gb)?
The Owl
03-03-2001, 12:57 PM
just as a sidenote, if his tool relies on the miracl library (which seems to be the
case), then the factoring algorithm in question is not the GNFS (of which i know
no publicly available implementation btw) but the MPQS (multiple polynomial
quadratic sieve). btw, what is the target number size in bits?
goatass
03-03-2001, 02:48 PM
Hi The Owl, he's using tE's RSA tool and if I'm not mistaken it does use the Miracl library. It uses QNFS not GNFS or MPQS. I don't know how tE implemented the function excatly, but if you run the tool and click the help button and scroll down a bit there will be an explanation on what this function is and about its memory usage.

goatass
draX
03-04-2001, 06:04 AM
thanks for your answers but how can i get the tool running like it should? i tried to run it 5 times and it quits everytime the windows-swapfile is ~1-1.5gb. does anyone have the same problem or knows how to fix it?
Nasdukar
03-04-2001, 07:23 AM
goatass (03-03-2001 04:48):
Hi The Owl, he's using tE's RSA tool and if I'm not mistaken it does use the Miracl library. It uses QNFS not GNFS or MPQS. I don't know how tE implemented the function excatly
goatass

Until you decide to seriously study cryptography, I suggest you stop
replying to every crypto related post, you're just making a fool
of yourself. Whatever is used in this tool, there's no such thing
as a "Quadratic Number Field Sieve", NFS algorithms are by definition
not quadratic. And as The Owl said, the Miracl library does not
contain any NFS algorithm. Do your homework.

-N
Predator_PC^pGC
03-04-2001, 09:49 AM
at least he's trying, N, instead of talking someone else down - now think about what kind of reply draX can use best and keep in mind what the aim of this msgboard is.. aa'ight.
Nasdukar
03-04-2001, 11:15 AM
Predator_PC^pGC (03-04-2001 07:49):
at least he's trying, N, instead of talking someone else down - now think about what kind of reply draX can use best and keep in mind what the aim of this msgboard is.. aa'ight.

Since you apparently have not followed Iceman's
thread, I will summarize it for you : people who
learn from tutorials and cookbooks instead of
reading academic work are taking the risk of
gaining twisted and fuzzy knowledge. Since these
people think they know this and that, they
sometimes reply to other's questions, and the
only result is disinformation. Wrong answers are
worse than no answer at all, because they
confuse people and propagate errors.

Which reply is most useful to him ? The same as
for everyone, it is the reply which contains the
more correct informations, and goatass' posts
are not in this category.

-N
goatass
03-04-2001, 11:37 AM
Nasdukar, what's your problem so I made a mistake, is it too hard for you to just say so you have to go saying all kind of shit. I have been studying crypto seriously but unlike you I started not long ago so newbies helping newbies, we make mistake we come back and correct them what's the big deal. After all this whether QNFS does or doesn't exsist doesn't matter because that was not the issue.
Whatever Iceman said it great but if we never made mistakes we would never learn, so what if we mislead some people when we find the mistake we come back and we correct it that's just the way it is. And I was not misleading drax because he was not learning what NFS is he was trying to get a tool working correctly.

You are here to bitch about people being wrong but you mised the entire subject of the thread and didn't answer drax's question so thanks for you posts.

thanks Predator_PC^pGC for standing up for me.

goatass
goatass
03-04-2001, 12:38 PM
drax, I ran the tool on a 256bits number using the QNFS option for about an hour straight and it never crashed or anything it worked just fine. I don't know what is the problem with your tool. What version are you using ? I'm using the 1.3 and the 1.2 and it works fine on both.

goatass
The Owl
03-04-2001, 01:11 PM
thanks for your answers but how can i get the tool running like it should? i tried to run it 5 times and it quits everytime the windows-swapfile is ~1-1.5gb. does anyone have the same problem or knows how to fix it?

the win9x swap file size has a natural upper limit of 2 GB, and other factors
could limit it even more. the reason i asked about the target number's size
was exactly for this purpose: to determine if the needed memory wasn't too
large in which case you will never factorize the number (on win9x at least).

now as for the rest of the thread (before you guys kill each other for good ;-)).
when i posted first, i did have a purpose which you managed to kill now, doh. so,
just for the record, i do know the tool in question (i had it before it was released).
i also knew it used the miracl library, my question was meant to ask if someone
knew whether the factorization algo 'QNFS' mentioned throughout the docs and
then quoted here was really some sort of NFS (in which case it must have been
implemented by the author himself) or there was a misunderstanding and it was
rather the MPQS. i just wanted to bring all this up - my way - and then discuss it
and clear up the confusion. oh well, next time.

finally, as iceman got mentioned here: he didn't say to 'dehumiliate people who
post without proper understanding of the subject matter', rather he suggested

1. 'self-censoring', ie. 'do not rush to answer if you are not sure your answer is
correct', and if you are unsure, then ask of course (instead of answering). there
is a difference between a '?' and a '.' - they express the intention of the poster.

note also that this 'self-censoring' can apply only in situations where the correct
answer is known and can be given (by someone), not for discussing new research
where noone is the wiser, in which case (intelligent) speculation is natural.

2. 'be technical or be erased', ie. if you happen to know the (correct) answer to
a question, then state it, possibly in a manner that the person asking the question
will be able to understand - there is not much teaching value in dehumiliation.
goatass
03-04-2001, 02:16 PM
The Owl, the reason I said something about the QNFS is not because I didn't know that did not exsist (no I didn't know it exsisted) it's because on tE! tool he talked about it so that means that he designed a way to implement it so therefore it can be done.
from his help file: "If the Quadratic Number Field Sieve (QNFS) Algorithm is needed to factor your number, a huge amount of memory is needed." So I came to the conclusion that this is a legit algorithm maybe not implemented by Miracl but can be done hence tE!'s tool.

Could you maybe give a quick explanation of what is the differences between the different NFS's to clear things up ?

This is a forum for learning that's all I'm trying to do, and teach whenever I can :)

goatass
goatass
03-04-2001, 02:45 PM
I found this the Applied Cryptography book, Ch. 11.4 Factoring :

"Currently, the best factoring algorithm is:

Number field sieve (NFS) [953] (see also [952,16,279]). The general number field sieve is the fastest-known factoring algorithm for numbers larger than 110 digits or so [472,635]. It was impractical when originally proposed, but that has changed due to a series of improvements over the last few years [953]. The NFS is still too new to have broken any factoring records, but this will change soon. An early version was used to factor the ninth Fermat number: 2512 + 1 [955,954].

Other factoring algorithms have been supplanted by the NFS:

Quadratic sieve (QS) [1257,1617,1259]. This is the fastest-known algorithm for numbers less than 110 decimal digits long and has been used extensively [440]. A faster version of this algorithm is called the multiple polynomial quadratic sieve [1453,302]. The fastest version of this algorithm is called the double large prime variation of the multiple polynomial quadratic sieve. "

That is QNFS if I understand this correctly.

goatass
The Owl
03-04-2001, 03:05 PM
from his help file: "If the Quadratic Number Field Sieve (QNFS) Algorithm is needed to factor your number, a huge amount of memory is needed." So I came to the conclusion that this is a legit algorithm maybe not implemented by Miracl but can be done hence tE!'s tool.

i know what he says in the help, and i tried to clear it up but somehow didn't find
a communication channel to him since. anyway, now i'm 100% sure that he did
use the MPQS (from miracl's factor.c).

Could you maybe give a quick explanation of what is the differences between the different NFS's to clear things up ?

i'm sorry but i never really delved into the depths of these factoring algorithms,
so i can't be of help. there are quite a few papers and even books on this subject,
use the researchindex site i gave earlier here to find them. beware, these algos
rely on heavy linear algebra and number theory, don't expect to understand them
without a serious background (one reason i didn't pursue the matter myself).
The Owl
03-04-2001, 03:11 PM
Quadratic sieve (QS) [1257,1617,1259]. This is the fastest-known algorithm for numbers less than 110 decimal digits long and has been used extensively [440]. A faster version of this algorithm is called the multiple polynomial quadratic sieve [1453,302]. The fastest version of this algorithm is called the double large prime variation of the multiple polynomial quadratic sieve. "

That is QNFS if I understand this correctly.

well, not exactly. as has been pointed out already, there is no such thing as a
QNFS, ie. a quadratic sieve is not a number field sieve. rather, in miracl's factor.c
you can find an implementation of a specific quadratic sieve, the MPQS. this has
been for some reason misnamed as 'QNFS'.
goatass
03-04-2001, 03:32 PM
Ok I follow you now. Thanks for the help.

goatass
tsehp
03-04-2001, 04:21 PM
Nasdukar (03-04-2001 09:15):
Predator_PC^pGC (03-04-2001 07:49):
at least he's trying, N, instead of talking someone else down - now think about what kind of reply draX can use best and keep in mind what the aim of this msgboard is.. aa'ight.

Since you apparently have not followed Iceman's
thread, I will summarize it for you : people who
learn from tutorials and cookbooks instead of
reading academic work are taking the risk of
gaining twisted and fuzzy knowledge. Since these
people think they know this and that, they
sometimes reply to other's questions, and the
only result is disinformation. Wrong answers are
worse than no answer at all, because they
confuse people and propagate errors.

Which reply is most useful to him ? The same as
for everyone, it is the reply which contains the
more correct informations, and goatass' posts
are not in this category.

-N
Fully agree with you, but you can choose another way to argue against goatass. This will keep those discussions at an high and polite level.
Thanks.
draX
03-05-2001, 03:58 AM
thank you all for your help :) . i tried some more times to factor a 256bit number but i didn't get the tool running yet(it still exits without an errormessage after it has been running for some time). is there something else i can do besides changing my OS? if not are there any suggestions about an OS?
Predator_PC^pGC
03-06-2001, 06:31 AM
So, Nasdukar, you say I have to listen to Iceman before I can talk myself?

Well now.

I reserve the right to have my own opinion and express it - if you can't handle that then that is completely your problem and not mine.

Don't even try to argue with me because it's of no use.

~Pred.
Nasdukar
03-06-2001, 09:32 AM
Predator_PC^pGC (03-06-2001 04:31):
So, Nasdukar, you say I have to listen to Iceman before I can talk myself?

Well now.

I reserve the right to have my own opinion and express it - if you can't handle that then that is completely your problem and not mine.

Don't even try to argue with me because it's of no use.

~Pred.

Hahaha, after a 80+ posts discussion all you can come with is a pathetic
"I have the right to have my opinion" ? Don't worry kid, you can have
any opinion you like and even express it, you should just know that if
you are that unable to argument them and convince people, your ideas
won't go far. I agree, discussing with you is of no use.

-N
goatass
03-06-2001, 10:00 AM
Nasdukar, it's of no use to talking to you also because you seem to think you are above everybody else and anything you say is right. I haven't seen a single constructive post made by you only ones that talk down people and argues with them.

You seem like the kind of person that sits in front of their computer all day long, have no friends, think you are above all and in my opinion useless to society and a total waste.

Additionaly you are building on what Iceman said in his many posts as he was the divine word, all he was doing is stating his opinion, no one said he was right.

p.s just because Predator doesn't want to waste his time discussing his opinions with you does not mean he is unable of argument or his ideas won't go far as you put it.

goatass
draX
03-07-2001, 02:14 AM
since i have started this discussion, i wanna tell you what i think about posting stuff and making mistakes. first of all a board like this one is a good service cause you have the chance to talk with other reversers if you get stuck or have problems. if someone makes a mistake in a post, its no big thing for me. i make mistakes too. i'll always make mistakes but thats not important as long as there is someone who tells me that its not right what i did or wrote. and i think thats the main goal of such a board! you can help others and others help you! so its no big deal if goatass made a mistake. instead of talking him down you could have just corrected him in a FRIENDLY way! but if thats not possible for you, i think such a board is the wrong place for you.

-draX
tE!
03-18-2001, 04:30 PM
Hi there, it's me the author of that crap tool :P

Just wanted to tell you all that The Owl is right. Of course
the factoring algorithm in the RSATool is MPQS not QNFS.

I messed it up due to lack of sleep and reading too much
about factoring methods. Maybe due to lameness even,
who knows :PPP

Nevertheless, you might find that tool a bit useful.
I will release v1.4 within the next days with some minor
bugs removed and with all QNFS references replaced by MPQS ;)

Time to stop misleading people, eh ?

Greets to The Owl.

tE!


Attn : MInoTHauR, please read (about RCE CD)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Attn : MInoTHauR, please read (about RCE CD)
PDA

View Full Version : Attn : MInoTHauR, please read (about RCE CD)

Aleph
03-03-2001, 01:57 PM
Hey Minothaur, I tried to answer your request for the RCE CD, but chello doesn't know you. "This user doesn't have a mailbox here" is the only answer I have.

Try opening a new adress on another server and mail me again.

Regards,
Aleph


Is there a "crack" for REALPLAYER to save movies (*.rm) on hd?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is there a "crack" for REALPLAYER to save movies (*.rm) on hd?
PDA

View Full Version : Is there a "crack" for REALPLAYER to save movies (*.rm) on hd?

BOSS69
03-04-2001, 07:13 AM
is there a way to save this stream video files from "realplayer servers" on hd? i could not find the movies in ie-cache or rp-cache even if i choose "buffered play". but when the files are stored in the memory cache there must be a possiblity to save on hd (maybe with a memory dump?).

thx
boss
disavowed
03-04-2001, 01:16 PM
get a program called "streambox vcr"
Flying Raichu
03-10-2001, 03:54 PM
the stories about reversing streambox vcr may be of interest as well; they involve adding code to the program:

http://zor.org/svcrunderground

-flying raichu


... diskcopy don't works... ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ... diskcopy don't works... ???
PDA

View Full Version : ... diskcopy don't works... ???

xyzero
03-04-2001, 08:04 AM
Hi,

I have a program that permits only 5 installs. I tried to copy (with diskcopy) the original disks... but nothing. (only original disks works). Why? What I can do?

TIA!
CaVeFiSH
03-04-2001, 12:56 PM
Try this:

-Install Linux and execute it
-Introduce the disk
-write: dd if=/dev/fd0 of=FILENAME
-Introduce a blank disk
-write: dd if=FILENAME of=/dev/fd0
-Now you have an exactly copy of the disk!!!

It´s EASY!!!

LiNuX Rules!!!

(sorry for my bad english I hope it will work for you :)
CaVeFiSH
03-04-2001, 12:59 PM
Try this:

-Install Linux and execute it
-Introduce the disk
-write: dd if=/dev/fd0 of=FILENAME
-Introduce a blank disk
-write: dd if=FILENAME of=/dev/fd0
-Now you have an exactly copy of the disk!!!

It´s EASY!!!

LiNuX Rules!!!

(sorry for my bad english I hope it will work for you :)
CaVeFiSH
03-04-2001, 01:03 PM
Try this:

-Install Linux and execute it
-Introduce the disk
-write: dd if=/dev/fd0 of=FILENAME
-Introduce a blank disk
-write: dd if=FILENAME of=/dev/fd0
-Now you have an exactly copy of the disk!!!

It´s EASY!!!

LiNuX Rules!!!

(sorry for my bad english I hope it will work for you :)
CaVeFiSH
03-04-2001, 01:04 PM
Try this:

-Install Linux and execute it
-Introduce the disk
-write: dd if=/dev/fd0 of=FILENAME
-Introduce a blank disk
-write: dd if=FILENAME of=/dev/fd0
-Now you have an exactly copy of the disk!!!

It´s EASY!!!

LiNuX Rules!!!

(sorry for my bad english I hope it will work for you :)
CaVeFiSH
03-04-2001, 01:04 PM
Try this:

-Install Linux and execute it
-Introduce the disk
-write: dd if=/dev/fd0 of=FILENAME
-Introduce a blank disk
-write: dd if=FILENAME of=/dev/fd0
-Now you have an exactly copy of the disk!!!

It´s EASY!!!

LiNuX Rules!!!

(sorry for my bad english I hope it will work for you :)
CaVeFiSH
03-04-2001, 01:04 PM
Try this:

-Install Linux and execute it
-Introduce the disk
-write: dd if=/dev/fd0 of=FILENAME
-Introduce a blank disk
-write: dd if=FILENAME of=/dev/fd0
-Now you have an exactly copy of the disk!!!

It´s EASY!!!

LiNuX Rules!!!

(sorry for my bad english I hope it will work for you :)
CaVeFiSH
03-04-2001, 01:04 PM
Try this:

-Install Linux and execute it
-Introduce the disk
-write: dd if=/dev/fd0 of=FILENAME
-Introduce a blank disk
-write: dd if=FILENAME of=/dev/fd0
-Now you have an exactly copy of the disk!!!

It´s EASY!!!

LiNuX Rules!!!

(sorry for my bad english I hope it will work for you :)
xyzero
03-18-2001, 10:13 AM
Hi CaVeFiSH,
First of all: sorry for the delay.
Well, the Linux procedure failed.
The disks are protected by a software called HANDPROT/EVERLOCK (lock disk copies and disassembler/debuging processes)...

Thank you very much (7x).

xyzero
dxl
03-18-2001, 10:39 AM
hi,

i think, on your disk is a file like cc.sys or similar, uh ? disks with this protection *cannot* be copied with normal pc-disk-drives. but if you´ve got an amiga (puh, who has one ?) with a special copy-module you can copy this disk. if not, you have to crack the application, i.e. remove the protection-check...

dxl


Cracking meeting
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Cracking meeting
PDA

View Full Version : Cracking meeting

BlackB
03-04-2001, 10:32 AM
Hi everyone,

I decided to organize a cracking meeting......why? Because the one with Fravia last year was really (REAL) good, and the other attenders were great people.
So, due to the success of the first 'cracking' meeting a second would be nice ;-)

If there's enough interest (and only if then), the cracking meeting will take place in Europe - Belgium - Ghent. There will be possibility to stay at night in a hotel for about 30$.

There's no fixed date yet, nobody has confirmed yet.....this message is just to see how many ppl are interested. If you are, just email me at cracking@softhome.net with preferrable period the meeting should take place. Months may and june are not available because the students among us have exams. Preferrable months are april, july, august and september. Especially april seems to be preferred by some people, hehe ;)

Questions/remarks/suggestions etc..... are also welcome.

Greets

BlackB
tsehp
03-04-2001, 01:49 PM
Count me in
BlackB
03-04-2001, 02:52 PM
You're counted in ;)
hehe
tsehp
03-04-2001, 04:26 PM
Ok my msg was three, I made the biggest one ;)
When this msgboard is slow, people (including me) press several times
post button so you're sure now that I want to come :)
Snacker
03-05-2001, 10:49 AM
Hi !

well a cracker's meeting would be really good but why not do it in Brazil ? i live here and depending on how many people are interested i can find a cheap place for them to stay or even in my farm, there are many beds there :P.

I'd like to go to Belgium but i really have no money :(

[]'z
Snacker
tsehp
03-05-2001, 01:52 PM
ArthaXerXes (03-05-2001 04:07):
I know this sounds paranoid, but I do not think that such meetings are cautious.

this is cautious as long as the good guys believe in the location we'll advertise here !
MInoTHauR
03-06-2001, 01:36 PM
My question are simple.This cracking is 3l33t only ?If no Count me in,If yes "dommage!"

P.S:Sorry for my bad english but i'm french
tsehp
03-06-2001, 03:03 PM
ArthaXerXes (03-06-2001 02:03):
err... I do not understand your answer. What did you mean ?

Just trying to joke about this, if blackB wants it secret he could only warn us by our usual mails and give a fake location here.
BlackB
03-07-2001, 09:12 AM
I don't care that software developers and anti-piracy organizations would know the date and place......they won't see on our faces that we are crackers, and even if they would know, I don't think anybody will have cracks/warez/serials with him. We're just a bunch of people drinking some beer and making fun, heh, and that we're crackers doesn't change anything about it.

greets

BlackB
fravia+
03-07-2001, 10:41 AM
I find too such meetings interesting and useful (you see people IRL, which is something amazing, at times) where you can discuss 'current affair' encountering refreshing different thoughts and positions.

I enjoyed a lot -for isntance- the meeting with +Tsehp and Frog's+Print in Paris couple of weeks ago (the oysters were particularly good, eh +Tsehp?:-)

I'll be in Brussels at least twice in the next months (in June together with _Mammon!).

If you'r organizing something nice (not too many 'crackers', eh, but many 'reversers', eheh) we may pop up and offer you a(nother) couple of beer-rounds (Kwak? ENAME!) eheh :-) Contact me @searchlores.org for details.

Independently of that, you should'nt be too paranoid (just a little) and by all means you should try to meet together IRL those friends that are working on the same lines. Nemo solus satis sapit. The more you contact people, the better... IMHO. Virtuality has huge limits indeed:-(

work well
fravia+
Aleph
03-07-2001, 01:52 PM
Well, if it's possible, count me in. That is if you fellow guys are not *too* elite-minded... I'm just snooping around for the last 4 years ;)

Regards,
Aleph

**********
PS: MInoTHauR, ecris-moi d'une autre adresse pour le RCE CD.
noos
03-07-2001, 03:17 PM
i'll will also be at least twice near brussels in the coming months, so count me in.. wouldn't mind showing off my drinking skills.. oh and of course discuss reverse engineer as fravia mentioned.. there will also be a small personal meeting in 2 weeks but I'm not yet sure if it will be public.. i'll let you guys knows.. :)

there is indeed no need to be paranoid, remember that we live double lives and they know nothing about our IRL one

cheers

noos

p.s. if more people from the netherlands are going, let me know.. we could travel together
tsehp
03-07-2001, 07:11 PM
fravia+ (03-07-2001 08:41):
I find too such meetings interesting and useful (you see people IRL, which is something amazing, at times) where you can discuss 'current affair' encountering refreshing different thoughts and positions.

I enjoyed a lot -for isntance- the meeting with +Tsehp and Frog's+Print in Paris couple of weeks ago (the oysters were particularly good, eh +Tsehp?:-)

I'll be in Brussels at least twice in the next months (in June together with _Mammon!).

If you'r organizing something nice (not too many 'crackers', eh, but many 'reversers', eheh) we may pop up and offer you a(nother) couple of beer-rounds (Kwak? ENAME!) eheh :-) Contact me @searchlores.org for details.

Independently of that, you should'nt be too paranoid (just a little) and by all means you should try to meet together IRL those friends that are working on the same lines. Nemo solus satis sapit. The more you contact people, the better... IMHO. Virtuality has huge limits indeed:-(

work well
fravia+
he he fravia, I'm sure the queen of saba enjoyed also the oysters,
maybe more the results ;)
I told you I didn't had the time for a meeting in brussels to speak about the copernic reversing project, but will surely not refuse a cracking meeting ! I'm sure you'll pardon me for this.
Laurent still didn't wrote me about the small program or project, but he can wherever he wants, btw I would be soooo happy if we can have the meeting in brussels, it's not so far after all.
regards
tsehp
03-07-2001, 07:15 PM
Aleph (03-07-2001 11:52):
Well, if it's possible, count me in. That is if you fellow guys are not *too* elite-minded... I'm just snooping around for the last 4 years ;)

Regards,
Aleph

**********
PS: MInoTHauR, ecris-moi d'une autre adresse pour le RCE CD.
Don't worry, the too elite minded's heads are too big for this forum,
you are surely counted in
NchantA
03-10-2001, 09:24 AM
unfortunately .au doesnt seem to be teeming with reversers, and i am far far away from europe ;P, i would love to meet sum real experienced cracka's but money is a luxory i cant afford, especially at school ;)

btw. .au beer owns your german beer *g*

NchantA
Elis
03-10-2001, 09:34 AM
svd and Dave and Peter are there in Oz, and many others (cristina too)... what do you want more?
LordSoth
03-10-2001, 07:02 PM
hmm, a cracking meeting sounds great. I wouldn't mind going (that is, if any
member of the forum doesn't mind... heh). Of course, it all depends on the
exact date, but I do need to take a trip to someplace in europe (not israel
that is..), so it can be great.

LS
_m
03-13-2001, 04:44 AM
AU might be a possibility.

LS -- EU in a hundred days or less? Email.

_m


New revirgin 1.01 minor update
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New revirgin 1.01 minor update
PDA

View Full Version : New revirgin 1.01 minor update

tsehp
03-04-2001, 01:58 PM
More simple to use but needs maybe a little beta test...
Now the iat file format is microsoft based, so the problem that we talked about on the iris topic is resolved, it's also more simple to use
because only one file will be pasted into the target, see the readme for details.
download at tsehp.cjb.net
tsehp
03-06-2001, 04:01 PM
Ok I surround, I'll use zip now.
But I managed to gain up to 40% space using winace.
For example revirgin.zip = 788 kb revirgin .ace = 473 kb

Where do you have problems with revirgin ?

later,

+Tsehp
tsehp
03-07-2001, 03:42 AM
ArthaXerXes (03-07-2001 00:58):
I do not really have problems with it, I just cannot figure it out. :-)
Its an iat rebuilder with a tracer included, working in a different way
than past ones that were working on dumped files.
Mine works on loaded targets, you give it the iat start, length and a place for dumping the resulted IT table.
It defeats redirected, encrypted, dispersed iat's modified by protection schemes like softlock, asprotect, vbox,...
What did you try on the tool ?
the analyst
03-07-2001, 05:22 AM
+Tsehp (03-06-2001 23:09):
Ok I surround, I'll use zip now.
But I managed to gain up to 40% space using winace.
For example revirgin.zip = 788 kb revirgin .ace = 473 kb

Where do you have problems with revirgin ?

later,

+Tsehp

hello Tsehp :)

congrats again with your Revirgin
i wanted to have a look at it, downloaded zip version (thx god)
but there is a lil mistake :)
the zip file contains the ACE file too
and there is no revirgin.exe ;)
only an ACE file, so the zip is useless heh
could u please remove the ace file in the zip , and update with the exe ?

thx
regards,

the analyst / UCF
tsehp
03-07-2001, 07:13 AM
the analyst (03-07-2001 03:22):

hello Tsehp :)

congrats again with your Revirgin
i wanted to have a look at it, downloaded zip version (thx god)
but there is a lil mistake :)
the zip file contains the ACE file too
and there is no revirgin.exe ;)
only an ACE file, so the zip is useless heh
could u please remove the ace file in the zip , and update with the exe ?

thx
regards,

the analyst / UCF
thanks !
sorry for this stupid mistake, you can download it now.
regards
tsehp
03-07-2001, 07:21 AM
ArthaXerXes (03-07-2001 04:02):
I have not yet tried the new version, but the old version had a very confusing interface, plus the fact that you need to supply the start and length of the IAT requires that you reversed a bit the executable...

I was hoping you had some program for lazy people, just one clik and hop, IAT rebuilt. :-) But still, it might come in handy...
the new has the same interface, I'm not very good for those things but I'm open for ideas for some modifications, it's not hard to with visual c++, so thanks to try to make a picture here of what I should change, this is not a problem.

You're also right about iat auto find, I actually simply go to the pe location if it's not corrupted, I could implement some heuristic searches, if you can provide me some algos I'll implement them.
I'm actually working on something else, renormalizing the exports from dll, just to impeach several names to point to the same address inside windows nt dll's. This is already done in icedump, so I have to port this on windows 2000.
regards,

+Tsehp
MackT
03-09-2001, 07:15 AM
+Tsehp (03-07-2001 05:21):
ArthaXerXes (03-07-2001 04:02):
I have not yet tried the new version, but the old version had a very confusing interface, plus the fact that you need to supply the start and length of the IAT requires that you reversed a bit the executable...

I was hoping you had some program for lazy people, just one clik and hop, IAT rebuilt. :-) But still, it might come in handy...
the new has the same interface, I'm not very good for those things but I'm open for ideas for some modifications, it's not hard to with visual c++, so thanks to try to make a picture here of what I should change, this is not a problem.

You're also right about iat auto find, I actually simply go to the pe location if it's not corrupted, I could implement some heuristic searches, if you can provide me some algos I'll implement them.
I'm actually working on something else, renormalizing the exports from dll, just to impeach several names to point to the same address inside windows nt dll's. This is already done in icedump, so I have to port this on windows 2000.
regards,

+Tsehp

'llo,
I made an algo for looking for original IAT. Its purpose is to trace at the OEP (you must have it) until you find a call of the first API. You will have an address in the original IAT so you just need to scan before and after it to have the range of the IAT. I have tested it on several packed executables and it seems to work very well.
If you are interested in it Tsehp, just mail me ;-)

Best regards,
MT
tsehp
03-09-2001, 04:55 PM
very interesting, you've got my mail right away.


armadillo killer not working :-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > armadillo killer not working :-)
PDA

View Full Version : armadillo killer not working :-)

roil
03-06-2001, 07:03 AM
well

i saw the new armkiller deprotector
but it is not working on the nanomities..
too bad, the guy who claim to have made the best unpacker, did a pretty bad job, it is not working, coz he is prolly not smart enouf to test on big files..
try to understand what is and how/when nanomites are on the files :)

try again
insert coin..

roil
risc
03-06-2001, 08:25 AM
roil (03-06-2001 05:03):

too bad, the guy who claim to have made the best unpacker, did a pretty bad job, it is not working, coz he is prolly not smart enouf to test on big files..
try to understand what is and how/when nanomites are on the files :)

you could do a better job? prolly you aint smart enough .

grrr


Armadillo Killer v1.2 Nanomites Edition
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Armadillo Killer v1.2 Nanomites Edition
PDA

View Full Version : Armadillo Killer v1.2 Nanomites Edition

ArmKiller
03-06-2001, 10:12 AM
I've sent the new version of Armadillo Killer v1.2 Nanomites Edition to Kaparo (Protools) . It removes nanomites in few sec :)

PS. I've never said that my ArmKiller is the best unpacker of Armadillo.
it's just an unpacker :)
the analyst
03-09-2001, 04:13 AM
ArmKiller (03-06-2001 08:12):
I've sent the new version of Armadillo Killer v1.2 Nanomites Edition to Kaparo (Protools) . It removes nanomites in few sec :)

PS. I've never said that my ArmKiller is the best unpacker of Armadillo.
it's just an unpacker :)

hello :-)

well, i'm afraid, but it is not working
i tested it on mirc, protected with nanomites..
you should have a look :)

and you did say that your unpacker was better than mine.
but i don't care much ;-)
roil was not so nice tho..

regards,

the analyst


Revirgin attempt on AD PicView
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin attempt on AD PicView
PDA

View Full Version : Revirgin attempt on AD PicView

BlackB
03-06-2001, 02:17 PM
URL: http://abroaddesign.hypermart.net/picview/picview.zip

Problem: When resolving, there are large gaps between groups of API's.

General info:
Base: 400000
OEip: 42322c
IAT Start: 106230
Length: 7a8 (not sure)

When looking to dumped and 'fixed' file with IDA:

1. End of OLEAUT32.DLL
00506278 extrn SysAllocStringLen:dword ; DATA XREF: j_SysAllocStringLenr
00506280 extrn byte_506280:byte:18h ; DATA XREF: sub_4070FCr

2. End of ADVAPI32.DLL
005062B4 extrn RegCreateKeyExA:dword ; DATA XREF: j_RegCreateKeyExAr
005062B8 extrn RegCloseKey_0:dword ; DATA XREF: j_RegCloseKey_0r
005062C0 extrn byte_5062C0:byte:158h ; DATA XREF: sub_407560r

so every .DLL has missing api's

When writing this I worked about 10 Mins on the target.....examining it further, but just wanted to give a notice ;)

greets

BlackB
tsehp
03-06-2001, 02:57 PM
Thanks blackB, I'll look for this.
I already had some iat's with very large gaps, it's normally working anyway.
BlackB
03-07-2001, 01:44 PM
.....gaps in import were due to softice detection.
Unloading sice or using frogsice solves the prob.
importtable resolves completely. inserted everything.....dumped fixed program runs without error, but the program doesn't start at all....it's like executing an .exe that does nothing but start and exit.
I traced through the code from start (OEiP) and there 'seem' to be additional checks, ....but whatever is done: or the program exits or the program crashes......investigating further.....

greets

BlackB
tsehp
03-07-2001, 06:38 PM
hi,
like I wrote you it's normal because the OEP you found is not a good one.
You have to trace the program from the start using icedump, it will first land to the usual ret, then trace again and you land to 0x4fe86c
insert the it.bin from revirgin and the target works.

I'm actually fixing the imports problem that we talked about with the owl on past threads, then I'll extend the tracer to work on the full app
to find the OEP, but only if the process is not too much time consuming.

regards,

+Tsehp


How to add attachments?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to add attachments?
PDA

View Full Version : How to add attachments?

mike
03-06-2001, 02:58 PM
There's a checkbox at the bottom of the post page, but I never see anywhere to do the attachment.
tsehp
03-06-2001, 03:00 PM
I had this problem with proxomitron, just disable all ad filter programs and make sure your javascript is enabled, that should be fixed, btw I send a test file.
mike
03-06-2001, 03:09 PM
+Tsehp (03-06-2001 13:00):
I had this problem with proxomitron, just disable all ad filter programs and make sure your javascript is enabled, that should be fixed, btw I send a test file.

Don't have any ad filters; JS is on. The rest of the board looks fine. All I see are Post and Back buttons.


Funny telephone listing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Funny telephone listing
PDA

View Full Version : Funny telephone listing

mike
03-07-2001, 06:07 PM
LIQUOR CENTER

861 N 1/2 Western Avenue
Los Angeles, CA 90029-0376

(323) IM-31337


Help needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help needed
PDA

View Full Version : Help needed

hoschi
03-07-2001, 08:27 PM
Hi,-

I need some strong help to make a keygen :-)
I've tried it many times, but no way :-(
Someone interested to help me....?
trinity ?
tsehp
03-08-2001, 12:58 AM
hoschi (03-07-2001 18:27):
Hi,-

I need some strong help to make a keygen :-)
I've tried it many times, but no way :-(
Someone interested to help me....?
trinity ?
it depends at what state you are...
Are still chasing the algo, or do you want to code it to calculate the serial ?
hoschi
03-08-2001, 05:24 AM
I think I've now knowledge about the three together working programms and and one who checks and generates the checksum/code out of disk id, serial, system id, date, time and and and :-(((( it's really hard to understand, what all there happens...
TonTon
03-08-2001, 08:47 PM
Which it's your really problem?
hoschi
03-09-2001, 04:53 AM
I can't figure out how the (serial) number is calculated :-( too unlock the prg.
too many informations get in and it's terrible to follow what happens :-(
tsehp
03-09-2001, 04:53 PM
sure, but you have to give us some more info to help, like the listing where it happens for example (if its not too long


Umm...how to get around IE hostility...not too hard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Umm...how to get around IE hostility...not too hard
PDA

View Full Version : Umm...how to get around IE hostility...not too hard

_Snatch
03-07-2001, 09:01 PM
Perhaps you did not know that the User-Agent field in the HTTP request header reveals what browser is being used of course with IE depending on your version it will be something like Mozilla 4.0 but you can find all that out with a nice winsock or web browser tracer like TracePlus Winsock or TracePlus Web. Check out http://www.sstinc.com for more on that. But anyway we are crackers not hackers right? So we can change the User-Agent to whatever we like. Well why not do it. I wont go into details on how to do it but it is not that hard to find and change. Well my friends. Am I the first idiot to figure this out?

Snatch
hz
03-07-2001, 09:17 PM
hiya _Snatch,

yeah you may be 1st, but I'm claiming 2nd, ^_^

regards
gs
03-09-2001, 05:37 AM
Ah, c'mon, did you ever read the archive of fravia's old pages ? (you're almost sittin'on't !) Or searchlores ?

Ever heard about atguard ? Proxo ? If not I should think it was high time to do so. Btw, Opera allows you to chose what is sent in the user-agent field. (Nah, not _this_ discussion again. For all means, go on using IE if you like - but you should at least know its flaws and prepare your countermeasures).

I'm not completely sure where to d/l the proggies from right now. For @guard you might try fosi. Proxo might be on searchlores, but then it might not. It's not that hard to find, I should think.
Elis
03-10-2001, 09:31 AM
words are only words, Snatch
code is code
please confute A+heist's essay at fravia (not the tone: the meaning and the content!)

Only when -and if- you will have done it I'll be disponible to read your trolls again if you do not, please abstain fom posting here.
noIE
03-10-2001, 11:21 AM
Elis (03-10-2001 07:31):

Only when -and if- you will have done it I'll be disponible to read your trolls again if you do not, please abstain fom posting here.
Where is the entire list of required reading before anyone dares to post on YOUR forum.
_Snatch
03-10-2001, 06:38 PM
lol thats a good one...its a little arbitrary as to what you need to read basically if anyone is l33t and above you then any essay they randomly decide to read you better figure out by ESP means which one it is and read it or else well you have not completed the required reading.

Snatch
nickname
03-11-2001, 10:42 AM
You really still using MSIE after having read it?

http://www.searchlores.org/athei_06.htm
_Snatch
03-11-2001, 12:04 PM
ya of course i am i already knew about the security issues and have written a program to delete all the cookies cache history and persistance data including the index.dat files for security reasons. its not the end of the world if you know whats going on and how to get around it. Microsoft is making a lot of the standards and will probably implement them better especially with XML and SOAP.

S*natch


debug versions of system dll's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > debug versions of system dll's
PDA

View Full Version : debug versions of system dll's

mike
03-08-2001, 02:11 PM
Is there someplace I can get debug versions of kernel, user & gdi for use with ida (or at least versions with named exports)?
MO`K
03-09-2001, 12:48 AM
Yes,

they are in the winxx DDK. check your local MS mirror, or try the search engine on their site.


com-port hookup
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > com-port hookup
PDA

View Full Version : com-port hookup

Rattle
03-09-2001, 09:32 AM
Hi,
I'm trying to reverse engineer a serial protocoll and I'm getting tired of using portmon for logging the traffic on the port. How can I hook up to the port in my own software (using vc++)?

/Rattle
tsehp
03-10-2001, 01:25 PM
m$docs

The file input and output (I/O) functions (CreateFile, CloseHandle, ReadFile, ReadFileEx, WriteFile, and WriteFileEx) provide the basic interface for opening and closing a communications resource handle and for performing read and write operations. The Microsoft® Win32® application programming interface (API) also includes a set of communications functions that provide access to communications resources. This overview describes the use of file I/O and communications functions, which enable applications to perform the following tasks:

· Open a handle to a specified communications resource.
· Set and query the configuration of a serial communications resource.
· Read from or write to a serial communications resource.
· Monitor a specified set of events that might occur for a given serial communications resource.
· Send a control command to the device driver associated with a specified communications resource, causing the driver to execute an extended function.

So you can start a hook on those api's while your program starts, sure your c++ app will have to filter with the process that used those api's and the port you want to filter.
Rattle
03-11-2001, 08:14 AM
This question should probably be in the beginners forum, but I really need a little more info on hooking in general to, if you could tell me where to read more about it would be nice :)

/Rattle
P.S At least now I know what calls to hook on ;)


HELP NEEDED
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HELP NEEDED
PDA

View Full Version : HELP NEEDED

MInoTHauR
03-10-2001, 08:15 AM
I have a problem with a proggy.When i disassemble it i don't have STR DATAS REF!
Please help me ???
Attentions,
MInoTHauR
CoDe_InSiDe
03-10-2001, 08:57 AM
Hi MInoTHauR,

Be sure that the program isn't Packed or Encrypted !!!
You can see that by either looking in the EXE with a Hex-Editor or by using a File Analyzer.
If it's Packed try to Unpack it yourself, or otherwise use an Unpacker and then disassemble the Program :)
Hope this helps.

Cya...

CoDe_InSiDe
MInoTHauR
03-11-2001, 06:58 AM
THX CoDe_InSiDe but i have forgotten to say that i have unpacked this proggy.In my opinion it's a problem of IAT & IT

Regards,
MInoTHauR
Aleph
03-11-2001, 10:50 PM
Hiya MInoTHauR.

Maybe it would help if you tell us what is the proggy, and where we can get it :-)

BTW, je me tue à te dire de me re-ecrire d'une autre adresse (RCE CD), celle que j'ai ne marche pas.

regards,
Aleph
darkelf
03-12-2001, 02:57 AM
Hi, there! :)

Did you tried to change all sections characteristics to E0000020 ?


AS strikes back
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > AS strikes back
PDA

View Full Version : AS strikes back

rot8
03-12-2001, 04:13 AM
Another new version of asprotect found.

Target was (unpacked & defeated =)http://homesoft.agava.ru/homebuh_download.htm (russian program).

1.Some new boring IAT tricks (GetProcAddress like, but now other funcs are involved: GetCommandLineA, GetCurrentProcessID, Free/LockResource, GetModuleHandleA, GetVersion ).
2.Integrity check slightly changed.

You have to dump program before ...[tsss, AS never sleeps :]..., otherway you will fix and fix and fix your dump =)

BTW: Last CASPR doesn't work.
SAC and UG where have you been ? :)
hOrn_dOg
03-12-2001, 04:45 AM
It appears that Alexey *makes* Asprotect1.2SE (Special Edition) versions for Russian programmers eh ? ;)

These tricks like in ChamelionClock are not featured in the DL version :(

hOrny }>


Tamosoft 'bloatware'
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Tamosoft 'bloatware'
PDA

View Full Version : Tamosoft 'bloatware'

splaj
03-12-2001, 05:52 AM
To whom it may concern ;)

FREE! anti-reverser info, unlike the Asprotect support team ;)

It appears that Tamosoft are declining, as most programmers appear to do, into bloating their recent releases to fat bastard proportions. I cannot believe ALL this extra codeis due to the RCE :) .Putting in huge amounts of anti-reverser code beyond the 'proved useless' ASprotect seems to be also pointless. So why has CV 2.5 jumped an extra 25% in size since CV2.4????

Anyway, I digress, here is the info that Tamosoft need to change for their next release. As I said FREE! info :)

Using Revirgin }> I unpacked the latest release and have the following points for you all regarding the 'anti-patching' algorithm that Tamo have employed since 2.4 and as nowhere have I seen a tut on this anti-reversing code I'll point it out now :-
Unpack:-
========

OEiP : 565090
IAT : 5721F4 (rva 1721F4 to 172AB8)
New Section 1CE000 (name :- .SplAj 3000 bytes)

Patch (raw==rva):-
==================

@ 1CD000 :

A975747D0FC420EEC9D8BA48C5140560
(This is the CV2.5 Self-Check algo final value)

@ 1CD020 :

BE00D05C00 MOV ESI,005CD000
8D7B04 LEA EDI, [EBX+04]
B904000000 MOV ECX,00000004
F3A5 REPZ MOVSD
E99172F9FF JMP 5642C5

@16563F :

74 TO EB ;JMP THE SIZE CHECK (EAX == AC500 - NOT !)

@1642B8 :
E9638D0600 JMP 5CD020 ; JMP TO OUR NEW PATCH CODE !
909090909090 NOP'S ; 6 X NOP FILLERS

@160390 :
8BC3 TO 33C0 ; FIX EAX==0 SO OLD REG *.CWL OK

@1652EB :
8B00E88ABAF1FF TO 90909090909090 ; FIX FOR WIN2K ONLY (FIX MEM prob)

Here is a screendump of the new code inserted at 5CD020 :-

EAX=0125C720 EBX=0125C720 ECX=D5C888B4 EDX=0080FA34 ESI=0080FA34
EDI=00400000 EBP=0080FA18 ESP=0080F9C8 EIP=005CD020 o d I S z a P c
CS=0167 DS=016F SS=016F ES=016F FS=0FF7 GS=12FE

____CV2!.data+0028_______________________________byte____________PROT_____(0)___

016F:005CD000 A9 75 74 7D 0F C4 20 EE C9 D8 BA 48 C5 14 05 60 ................

This 16 char (4 DWORD) numbers is end result of 4 x 0x5000 loop
and is taken from the actual code so any byte changes will result
in a corrupted Form that causes an exception..... this is Cv2.5b94
_________________________________________________________________________PROT32Ä

~
0167:005CD020 BE00D05C00 MOV ESI,005CD000 ;new code to
0167:005CD025 8D7B04 LEA EDI,[EBX+04] ;replicate the correct
0167:005CD028 B904000000 MOV ECX,00000004 ;end algo result
0167:005CD02D F3A5 REPZ MOVSD
0167:005CD02F E99172F9FF JMP 005642C5 ;jmp back to real code
0167:005CD034 90 NOP ;called by 5642B8

So try it, unpack it and then change a byte, for example the size check at 56563F. Boom the exe corrupts itself. There are 4 seperate occasions where the programs code checks itself. There is a massive loop and it does it 0x5000 times !!!

Now put in my extra code at 5cd020 and the 16 byte algo result at 5cd00 and then try and patch whatever you want.
It works.

+SplAj
'patch+play'

Fresh from vacation and butt-f*cking goosey good as ever
(erm... actually I am an idiot cos i forgot how to use Revirgin after 1 week !! I kept putting in the VA for the IT address and Revirgin told me I was an idiot, I wasted 5 hours with this... and thought Tamo put some sort of 'protector thread' on the IAT. mmmmm ?)


ReVirgin won't trace this ASPR
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ReVirgin won't trace this ASPR
PDA

View Full Version : ReVirgin won't trace this ASPR

Predator_PC^pGC
03-12-2001, 01:07 PM
Hello +Tsehp,

I tried using your wonderful tool on the following target: Cool Mouse v3.4 ( http://www.shelltoys.com/files/cmset.exe )

Problem is that revirgin won't trace the unresolved entries; that is .. it traces one of them (the one at the 'middle' of the list) but not the (quite long) list of entries at the end.
It just crashes, pretty hard ;-)

I'm running win98 build 2222.
I've successfully used the tracer on the Notepad included in your revirgin.ace
I'm using revirgin v1.0a

Original entrypoint: 876B
IAT RVA: D000
IAT length: 625h

I hope this'll be enough info.

BTW, could you change my email address (accountname Predator) from .com to .org ? :-) tnx......

TIA.
~Pred
Predator_PC^pGC
03-12-2001, 02:54 PM
btw plz ignore the other post with the same topic ;) something went wrong.
tsehp
03-12-2001, 05:12 PM
you made a little mistake, the iat length is not 625...
iat's are just dword entries pointing usually to an api address or can be redirected into asprotect code, with 625 you included other things than iat and even text bytes...
Predator [PC/pGC]
03-13-2001, 06:51 AM
Hm, that's odd. What would the length be, then?

I found 625h like Kilby says in his Copylok tutorial, the IAT ends with 10x '00' bytes. So I searched for the first occurence starting at the beginning of the IAT and I end up 625 after the beginning.

Why/Is that wrong?

Regards,
~Pred
+SplAj
03-13-2001, 07:20 AM
Hi ~Pred

glad you could log in now !

Ok my big mouth ( hot fingers) can't wait any longer to tell you
the obvious. After a BPX GetModuleHandleA (thats how I find the IAT) and get into the target code. you find youself looking at the area VA 40D000 (1st thunk down) so type in RVA D000 -I remember that now :) and get the lat mem address or estimate. You said 625, but I get last API at D2A4 so the length is D2A4-D000 = 2A4 ..... now build the IT bins ...

OK ?

SplAj
+SplAj
03-13-2001, 07:42 AM
erm sorry Alexey, that trick is

BPX GetModuleFilenameA

3 x F5 and F12 then dump the memory from the previous call address
eg d 4D014C

Your smack in the middle of the IAT

SplAj
Predator [PC/pGC]
03-13-2001, 09:24 AM
Hi +splaj ;)

I tried looking at the IAT with my hexeditor and found D2AE to be the last one.. so length is 2AE I think ;)

When resolving/tracing with revirgin I indeed get API names upto 2AE so that's probably it.

Thanks for the info ;) And for the email/pwd fix.

Greetings,
pred
Predator [PC/pGC]
03-13-2001, 09:27 AM
btw it's "ended" with 9x '00' bytes .. perhaps 9 would be fine as well instead of 10 ;)
Predator [PC/pGC]
03-13-2001, 11:23 AM
a'ight, I unpacked the app and it runs...

afterwards, it was much too easy ;-) just some new stuff..

but, there's 1 thing.. if you unpack the app, and run it, at VA 40821C, ecx is pointing to "nonexisting" memory while in the packed app it points to "existing" memory.. this causes a crash at the instruction at this address..

solved that by replacing those 2 bytes with 90h but I'm not sure if that was the most subtile way.. any suggestions, anyone? :)

greets,
Predator
tsehp
03-13-2001, 02:49 PM
Predator [PC/pGC] (03-13-2001 07:24):
Hi +splaj ;)

I tried looking at the IAT with my hexeditor and found D2AE to be the last one.. so length is 2AE I think ;)

When resolving/tracing with revirgin I indeed get API names upto 2AE so that's probably it.

Thanks for the info ;) And for the email/pwd fix.

Greetings,
pred

Excuse me for not taking the time to explain more, but you should not
work on the dumped file to do this, why ? because you could have mistakes between raw offsets and virtual offsets if you forgot to realign the sections -> raw = virtual for offsets and lengths.
use what +splaj told you and this will always work.

The aspr tendencies :
like I've already told, some target code called (some flags sets, and other inits) back to asp then go to oep. if you dump with the previous code called, this will crash, look for precedent topics.

some news I saw on commview 2.5 , some poor test iats like :
mov eax , [10054521]
ret

just for the target to see if asp is still in mem :) too funny.

A next revirgin version will soon be available, it will paste the it file directly in the target if sv sends me a good dll or it's source code ;)

but most important, it will analyse the links between code -> iat -> api
then reconstruct even some more iat entries for protection schemes like sd2, there's still work to do...

regards,

+Tsehp
Predator [PC/pGC]
03-14-2001, 02:51 AM
Well,
I never forget to realign the sections plus I know the difference between RVA's and raw offsets - I think I can just work on the dumped file ;-)

no disrespect to +splaj's way of locating the IAT ofcourse - but i choose my "own" way.

like, i didn't really read any tuts on revirgin/asprotect only the one by kilby, that's why i didn't know about the program calling asprotect api's or checking in mem if it's still there - but it wasn't a hard thing to think of reading the asprotect docs, after all.. ;-)


erm, btw
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > erm, btw
PDA

View Full Version : erm, btw

12
03-13-2001, 09:45 AM
btw pred..

thunks are terminated with a single NULL dword..

image import descriptors are terminated with 5 NULL dwords. ..


A nasty one!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A nasty one!?
PDA

View Full Version : A nasty one!?

meRlin
03-13-2001, 01:24 PM
Hello,
Read an article about a protection software package named InTether, this is maybe the "next generation" of our copy protection blah blah...
the article can be found here:
http://www.inside.com/jcs/Story?article_id=25476

Found an evaluation copy version 1.0 (does work on W2000) and protected a txt file with it, there is a few options to apply and one of them is that the file is been erased from your harddrive when the the evaluation time that has been set on the file gets expired.
They are working a lot to get this application none-crackable I think.
Apply this wrapper to a file then dump the "dg32.exe" from memory, do a listing of it and take a good look.
To understand this sort of protection I want to start a small project around this subject, to get some help from the forum.
(of course under the small project area) msg me if it sounds intresting!

ftp://yippee.dataline.net.au/utilities/fileanddiskutilities/intether.exe
I found 2 copies of the file and one of them does not work on w2000, I have the other one too if someone want's it.

meRlin
Latigo
03-15-2001, 02:42 PM
Wow this is very interesting!
I can see lots of learning with this babe :)
ill give it a try and share findings with you!
Bye!

Latigo
Killer_3K
03-15-2001, 04:51 PM
The actual data protection is very easy.. they didnt even bother to encrypt their code.. "new standard in document protection" my ass :)
meRlin
03-28-2001, 11:10 AM
Is there no one intrested in this target except for me and latigo??
Take a look inside one of the *.VXD or *.SYS (don't remember wich one) and you have the most complete list of screencaptures utility in the whole world :)

meRlin
Killer_3K
03-28-2001, 12:05 PM
The entire concept of this thing is worthless..
The data is distributed in 'packages'.. this means that the package must contain the data of the original file.. now what exacly prevents you from ripping the data decryption algo and just read the data from the package, decrypt it and save it to the hdd?
tsehp
03-29-2001, 02:33 AM
meRlin (03-28-2001 09:10):
Is there no one intrested in this target except for me and latigo??
Take a look inside one of the *.VXD or *.SYS (don't remember wich one) and you have the most complete list of screencaptures utility in the whole world :)

meRlin
You should start your project anyway, some people could join it as it evolves inside your topic.
goatass
03-30-2001, 11:35 AM
Killer_3k, it's not that simple...there is a massive algo that works on the password used (if not used the program uses a defaul one) and goes through like 256 rounds of calculations to generate the 2 decryption seeds, there is pretty much no way to reverse from this angle. The other way I'm thinking to go but didn't have time just yet is to figure out the encryption algo and reverse that to make a decryptor or a password finder. The last way is to make a bruteforcer which I've made that will go through all letters, numbers, special chars and try to find a password but it's not praticle due to the possible number of characters (256) and the number of valid characters in the password. The one major weakness in the encryption is that there are repeating patterns therefore you can guess ALOT of plain text.

meRlin, I'm interested in this project just haven't had the time to work on it lately but will get back to working on it very soon....
e-mail me if you want and we can figure out where we both stand on this.

goatass
Killer_3K
03-30-2001, 12:34 PM
goatass: the entire idea of this data protection is not the password.. if you want password protection use pgp :P and as you can see password is OPTINAL.. they put it in there just for the hell for it :P

anyhow the idea of this thing is that you can only run/read a certain doc X ammount of times for X ammount of time etc and after it times out the doc gets deleted and you cant read the doc again.. if i wanted a password protection i would have used pgp :P

if you know the password (assuming password was used) you can easily decrypt the data (took me around 5 min to write a decoder for it).. thus the entire concept of this thing (you-may-only-read-the-doc-x-ammount-of-times) is useless
goatass
03-30-2001, 04:11 PM
maybe I'm missing something here, but when I looked at it there was a default password that they used (if the user didn't use one) so yes a password is required to create the encryption seeds. Then there is a big round of calculations on the password that creates the encryption seeds...

From what I can see is that if you didn't enter the correct password (if the user chose to use one) then the bytes that decide how many times you can read the doc will not be decoded and therefore nothing will run.

If it took you 5 minutes to write a decoder could you please e-mail it to me just so I can take a look at it to see maybe I'm looking at this all wrong.

goatass
goatass
03-30-2001, 04:15 PM
Another thing I forgot to comment on that you mentioned...you said, "if you know the password it's easy to decrypt" well yeah obviously but that's not the case many time...if I get a hold of a package and have no idea what the password is I want to be able to find it or decrypt the file.....

try decrypting the file WITH OUT knowing the password

goatass
Killer_3K
03-30-2001, 07:06 PM
by decoded i mean something that will read the data from the package (assuming that you have a valid password), decrypt it and save it to the hdd..
as for as the password... as i already said, the entire concept of this protection is NOT password protection, if i wanted a password protection scheme i would use pgp.. the entire concept of this protection which is 'you may only read the file x ammount of times' cant be securely implemented..
if you want i can send you the decrypter.. it assumes you didnt use a password so it wont work with password protected packages :~

I know that its probably impossible to decrypt a package without knowing the password but it doesnt really matter as the concept of this thing is NOT the password protection..

if you want i can send you the decrypter but im sure that you can write one urself in around 5minutes or so :)
goatass
03-30-2001, 08:22 PM
You are missing the point here. Yes the idea of this program is to limit you to x number of uses, which when implemented with the default password (if the user didn't enter a password) would be very easy to decrypt the data stored in the package and retore the original file since the default password is known. BUT, if I for example write a paper, package it with a password that I picked and send it to you to read, you will NOT be able to read it not even once, so what the idea behind the password is to implement an extra measure of security because I might want to allow a person to read the document only once but I only want that person to read it and not anyone else, so you see the password is a good idea for the program to increase security.

You are assuming that the package would have no password, but assumption is the mother of all fuckups. If I was to use the program to protect my document I would for sure use a password even if I only let the other person read it once, I don't want anyone else reading it.

so to comment on what you said: "the entire concept of this protection which is 'you may only read the file x ammount of times' cant be securely implemented.." you are incorrect because by having the password you won't be able to even read the document once and you won't be able to decrypt it using your tool since you are assuming the person using the decryptor knows the password and in 99% of the time you won't know the password.

So, Yes the concept of this program is to limit the user to x number of uses but you can add an extra measure of protection against praying eyes by using a password.

You are saying that this protection is lame, but it's not it's pretty good because if I package something with a password you won't be able to read it. Yes PGP is great for encrypting messages but we are not encrypting messages here it's encrypting entire files, like MS Word document, MS PowerPoint file, etc. which you can't encrypt using PGP.

What I want to do is write a program that no matter what password was used to package a document would be able to decrypt the data and restore the original document.

I hope you are following what I'm saying here.

goatass
Killer_3K
03-31-2001, 02:55 AM
erm actually you can encrypt any goddamn data file with pgp.. that includes word docs&powerpoint stuff :)

yes the password thingy does make it impossible to read the document BUT as i already said like 10 times, the idea of this protection is that you may only read the doc X ammount of times.. as a proof to that read works.txt that comes with it.. they clearly state that the entire purpose of this protection is that you can allow people to only read smth you wrote x ammount of times.. they brag about how they block cut&paste operations, screencaptures&printing operations..
kinda like a time-bombed e-book :)

quote from works.txt:
"if multiple downloads are attempted, InTether automatically detects that the file permissions have been exhausted and disables copying."

basiclly they made a util that allows you to timebomb documents..

I am not arguing about the password scheme strength because im pretty sure you cant break it, but the concept of this thing is not the password, its the timebomb thing.. if the entire idea of this thing was the password then how come its optional and hardly even mentioned in their txts?
Eternal Bliss
03-31-2001, 09:44 AM
Hiya,
I think everyone misses the point here. 8P
Why argue about how good or how bad the protection is? Get together and see if we are bypass the protection about reading x times instead.
Ideas I have (not having seen nor tried the program),
1) Write your own program that will read what's on the screen
2) Have a program that will recover *ANY* files that are deleted
3) Write a program that copies from MEMORY the decrypted file and write it down (thus removing the reading x times protection)

Regards
EB
Killer_3K
03-31-2001, 01:30 PM
Eternal Bliss:
Writing a package data decrypter (gived that you have a password/no password was used) is not a problem, it took me about 5 minutes to do it :)
also you cant recover the deleted files because it does a secure wipe of them but it doesnt really matter, because as long as you have the package you can get the data

My point here is that this whole timebombed documents idea cant be implemented properly, i honestly dont care about the password protection, they might as well use pgp-style encryption on it, my point here that the whole concept of this thing is NOT the password, its the timebomb, thats the part that cannot be implemented securely as everyone can just read the data from the package and decrypt it (assuming no pw was used/you know the pw)..

to goatsass: I think its a waste of time to come after the password protection because even if you manage to break it they'll just change the algo to something stronger (blowfish+md5 comes to mind :))..
The whole hype about it is because this thing timebombs documents, its not the password..
and as i already said like 1243 times, thats the part that CANNOT be implemented securely..
goatass
03-31-2001, 06:16 PM
Killer_3k, I know that the point is the x number of uses, what I'm trying to make you aware of here is that I don't care what's the purpose of the program what I care about is if I get my hands on a package and it was packed with a password (which will most likey be the case 99% of the times) then what do I do to decrypt it.

You are always assuming that a document was packaged with no password and in that case yes the implementation of the timebomb will be weak but going back to you example of PGP, if you encrypt something with PGP but don't use a password or the password is known then you can say that PGP is useless too because I was able to decrypt the message with ease.

Do you see where I'm getting at ? you have to look at all of the security measures that the program has to offer to the user and not focus on only one of them. Because if I package something with a password then your weak implemented timebomb algo all of the sudden becomes so much more powerfull because you will not be able to decrypt the file at all not even the portion that determines how many times you can view the document.

By the way, using Blowfish wouldn't make the enryption that much more stroger, and again if I know the modulus for the encryption in Blowfish (just like you know the password for this program) I would have no problem decrypting anything.

The encryption algorithm used in this program is pretty good, all the rounds of encryption and table look ups makes it extremely hard to reverse.

Well I tried to make my point as clear as I can and if you still don't see my point it doesn't matter anymore.

goatass
Killer_3K
03-31-2001, 07:45 PM
Goatass: Hi :)
I see your point, but i think you are wasting your time.. IF you manage to break it rest assure that they will change it to something else (TEA/blowfish w/ MD5ed password as the key comes to mind) :)

Last time i checked the entire point of PGP is the password :) hardly the same thing as this program..

anyhow good luck attacking that algo =)

by the way, even if you manage to find an attack on cipher algo you will (prolly) still need a plaintext, and since this thing is supposed to encrypt .txts i doubt you will have any plaintext in most cases :)

Best Regards =)
goatass
04-01-2001, 04:07 AM
Killer_3k, I totally agree with you that this algo is a waste of time to figure out....I doubt they will use Blowfish, RSA or whatever because they spent so much time and money on designing this protection they won't just redo everything, but all they need to do is add another XOR or something similar to the algo and any decryptor tool would be defeated just like Alexi does with ASProtect.

BTW, there is planty of plaintext that I can use to make a bruteforcer. There is a section at the end of the file which is the encrypted information of how many uses the person has, whether or not they can copy and paste, etc. If you look at it you will see there is a repeating pattern there and that pattern decrypted is zeros. Also I know that the first DWORD in that section MUST return a 00000001 which they use to check whether the password used (if any) was the correct one...basically check if the decryption keys are the correct ones before trying to decrypt everything. I figured everything out already concering copy&paste, shreding of the file after use, x number of uses, etc. that's very easy (assuming again you know the password or none was used).

Anyways, I haven't seen this program being used anywhere yet so there is really no need to invest much time and effort in reversing the enc/dec algo (which I have figured out but haven't spent the time trying to reverse it).

Well I just got home from a club and I'm dead tired.....l8r

goatass


only a link
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > only a link
PDA

View Full Version : only a link

Mustapha
03-13-2001, 08:55 PM
http://www.cs.cmu.edu/~dst/DeCSS/Gallery/plain-english.html
Antipodean
03-14-2001, 05:59 AM
Hi.

Go here for a perl script that is supposed to decode it in 7 lines of code.
http://www.cs.cmu.edu/~dst/DeCSS/Gallery/qrpff-fast.pl
Mustapha
03-14-2001, 07:31 PM
it is only a test, so delete it.


Help for a software protection market research
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help for a software protection market research
PDA

View Full Version : Help for a software protection market research

keyser
03-14-2001, 02:17 AM
Hello,

I think it would be interesting to look at the economical aspect of software protection. Some times ago, I read a post from Tsehp complaining that Alexey was earning his living spying on us. Well, it is true, and I would go further considering that WE, CRACKERS have created the market of software protecting !

Focusing only on technical issues is not, I think, a wise or responsible attitude. Since we are at center of a fast growing industry I think we should try to know and understand it better.

So, I am looking for any article, study or any document of interest about our beloved "foes" :-) : their turnover, profits, marketing strategy, etc.

Thanks for your help.
Keyser.


Infos about the .NET support
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Infos about the .NET support
PDA

View Full Version : Infos about the .NET support

the_lover
03-15-2001, 01:09 PM
I read on IDA msgboard about this flag.Where I can find more infos??


Assembly help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Assembly help
PDA

View Full Version : Assembly help

dthomas
03-15-2001, 03:08 PM
I was attempting to disassemble a game that accesses the cd-rom. I know it accesses it at a push execution. I was wondering if it was possible to have that push access the hard drive, instead of the cd-rom. Thanks.
tsehp
03-15-2001, 05:35 PM
you've got to look at windows api's, here's one for example :

The CreateFile function creates, opens, or truncates a file, pipe, communications resource, disk device, or console. It returns a handle that can be used to access the object. It can also open and return a handle to a directory.

HANDLE CreateFile(

LPCTSTR lpFileName, // address of name of the file
DWORD dwDesiredAccess, // access (read-write) mode
DWORD dwShareMode, // share mode
LPSECURITY_ATTRIBUTES lpSecurityAttributes, // address of security descriptor
DWORD dwCreationDistribution, // how to create
DWORD dwFlagsAndAttributes, // file attributes
HANDLE hTemplateFile // handle of file with attributes to copy
);
Parameters

lpFileName

Points to a null-terminated string that specifies the name of the file, pipe, communications resource, disk device, or console to create, open, or truncate.
If *lpFileName is a path, there is a default string size limit of MAX_PATH characters. This limit is related to how the CreateFile function parses paths.

but there are a lot of other possibilities


"Hacker"-Contest -> Cracker Contest
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > "Hacker"-Contest -> Cracker Contest
PDA

View Full Version : "Hacker"-Contest -> Cracker Contest

DXL
03-16-2001, 05:48 AM
hey guys,

the wibu-team (german producer of a dongle) organizes a contest to crack a software protected with wibu-key. you can win DM 10.000,00 (~5.000$). You can get the protected program on 22.03.2001 at the wibu-homepage: http://www.wibu.de or at the CeBit in Germany :)
The wibu-Protections works with encrypted Import-Tables and API-checks within the program... , really nice protection :)

DXL
JimmyClif
03-16-2001, 06:34 AM
Ercept from here: http://www.wibu.de/us/mpress2001.htm#contest

WIBU-SYSTEMS gives the source code and changes only one function that is protected by WIBU-KEY. The hacker has to crack this function and to specify the secret calculation result

This sounds to me like : "OK, we're encrypting only 1 function with PGP and you got to tell us our secret pass"

Or am I getting it wrong? And they give the executable & the source code?
dxl
03-16-2001, 09:51 AM
This sounds to me like : "OK, we're encrypting only 1 function with PGP and you got to tell us our secret pass"

Or am I getting it wrong? And they give the executable & the source code?

hehe :)

if wibu will only give you the .exe and you have *no* access to the dongle, it could be really impossible to crack this file :( [but this situation is IMHO *not* realistic and does *not* proove the security of a dongle protection]. but if you´ve got the dongle (only for a short time, perhaps), you can crack IMHO *everything* dongle-protected application... i don´t know, if they will let you work at a PC with the dongle connected... if not, you´re right and then shit on this fucking contest and spend your time better somewhere in the sun :)

DXL
LordSoth
03-16-2001, 12:28 PM
IMO what is going to happen is they are giving the exe itself, even with source,
but without the dongle. I think they will be doing that in order to test how easy
it would be to crack their protection without the dongle. After all, some dongle
protections can be cracked without the original dongle. Think about it, they
pay $5000 or so for a whole team of crackers that try to brute force their
protection.
I say, leave'm and let the apps be warezed when it's out :p
That's our revenge :-)

If they wanna use us, they ought to pay the price heheh

LS
tsehp
03-17-2001, 07:13 AM
again the same story :
a part of the code is contained inside the dongle, so if you don't have it, you just get lost. you expose yourself, loose a lot of time and teach protector how to improve their products and they don't have to pay anything.

I'll crack this only if they give the dongle, to produce a working copy of this, like every serious target.
pffff ;-)

tsehp


Searching for CD-Cops protected app
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Searching for CD-Cops protected app
PDA

View Full Version : Searching for CD-Cops protected app

DakienDX
03-16-2001, 10:24 AM
Hello everybody !

Someone told me that CD-Cops protected executables would check the physical angle between the first and the last readable sector on the CD.
Does anybody have a target protected with CD-Cops (I couldn't find on the internet. I searched 3 days) ?
Or has anybody experience with CD-Cops and can tell me how it works?

Thank you for any reply !
LaptoniC
03-16-2001, 01:07 PM
I have one target protected with cdcops.If you want I can *try* to send *.w_x file and main exe.(My connection is 56k and I dont know if it works only to files.)More info is in mcLallo's essay.However his essay didnt helped me much because versions and rutines are different.
MAK
03-17-2001, 02:28 AM
I´d like a copy as well.. If u can find a server and upload it´ll be great...
Can u tell us the name of the target and the version of CD-cops...
Cheers
MAK
DakienDX
03-17-2001, 03:56 AM
Hello LaptoniC !

I'm interested in the target.
If you can't upload it somewhere you can send it to me by E-Mail and I'll upload it somewhere.
As far as I've read you need a file called CDCOPS.DLL (or like that) to run a protected executable, so I would need the main *.EXE, the *.w_x and the CDCOPS.DLL.
DakienDX
03-17-2001, 04:55 AM
Hello LaptoniC !

I also read something about *.qz_ and *.gz_
I think it would be helpful to include these files, too.

Could you please upload them, too?
LaptoniC
03-17-2001, 05:40 PM
I have uploaded protected exe and needed files.My program is programmed with Macromedia authorware it first runs this exe file and if it runs ok then it executes.Main job is to decypt exe file.mcLallo's CD-Cops decrypter wont work on this also.Anyway hope this helps.
http://sakir.virtualave.net/cdcops.zip
DakienDX
03-18-2001, 05:33 AM
Hello LaptoniC !

Thank you. I'll downloaded the file and see what I can find out.
LaptoniC
03-18-2001, 02:32 PM
Here is the translation of some messages in exe in case you need it

Tamam --> OK

Vazgeç -->Cancel

Lütfen bir Vitamin CD'si takýnýz. -->Please put one of Vitamin CD

Lütfen CD Sürücünüzde Takýlý Olan CD için Yükleme Kodunuzu Giriniz: --> Please enter setup code for the CD in drive

Lütfen Bekleyiniz.--> Please wait.

Bu CD orijinal Vitamin CD'si deðildir! -->This is not original Vitamin CD!

Eðer CD'niz orijinal ise lütfen üretici firma ile irtibat kurup aþaðýdaki numaralarý veriniz: -->If your is original please contact with producer and give below numbers:

Makina kodu: -->Machine Number:

Bu yükleme kodu geçerli deðil.--> This setup code is not valid

Geçersiz kod girildi.--> Invalid code entered

CD Sürücünüzde CD Bulunamadý.-> Could not find CD in your CD drive

CD-Cops STATUS programý çalýþtýrýlmalý! -> CD-Cops STATUS program should be run

Tüm lisanslar kullanýmda! ->All licenses are in use

CD-Cops Að Hatasý-> CD-Cops network error
DakienDX
03-19-2001, 10:09 AM
Hello LaptoniC !

Thank you again. :)


What happened to reversecourse.cjb.net?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What happened to reversecourse.cjb.net?
PDA

View Full Version : What happened to reversecourse.cjb.net?

Verulam
03-16-2001, 03:12 PM
It went off air quite a while ago and has not been updated since...


CTRL-ALT-DEL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CTRL-ALT-DEL
PDA

View Full Version : CTRL-ALT-DEL

Crudd
03-16-2001, 05:10 PM
Ive been screwing with this for the past few days. I need to intercept Ctrl-alt-del to make it do what i wunt instead of the task menu. Ive tried setting a keyboard hook but it still doesnt stop the task menu from coming up. I tried hooking int 9 in a vxd. I tried everything i can think of. If anyone can do this or tell me how (only if you know that it works). Thanks a million in advance.
Crudd
P.S. Its for a reverseme from http://reversemes.cjb.net
Predator_PC^pGC
03-17-2001, 04:06 AM
there's this api, where you can specify to set the "screensaver" "active" .. by doing so, ctrl-alt-del and the startmenu hotkeys and such don't work anymore .. .that'd be step 1

step 2 is hooking ctrl-alt-del keys as you did, and just proceed ... but the taskmanager won't popup

the api is called SystemParametersInfo and the flag you have to use is SPI_SETSCREENSAVEACTIVE

perhaps this will work .. it's not that i have tested it, the thing you want to do ;)

greets,
Predator
Crudd
03-17-2001, 01:19 PM
Yea, i found that. But this only disables it and doesnt let me alter whut it does. Thanks for trying though :)
Crudd
Snacker
03-17-2001, 04:56 PM
heya !

if you still needing it mail me and i'll send you the source on how to do that.

[]'z
Snacker
Crudd
03-18-2001, 01:33 AM
Hey Snacker, i dont have your email but i have whut you gave to SantMat. I havent gotten to try it yet but i will tomorrow. If you wunt check out the reverse me. Any other info you can mail me at Crudd@DrunkenBastards.com
Thanks,
Crudd
Snacker
03-18-2001, 06:29 AM
Hi Crudd !

I got the reverseme, unpacked it and did a loader that intercepts the keys and do what the reverseme wants ;).

btw my email is snacker@brcrackers.org.

cya
Snacker


VBOX 4.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VBOX 4.5
PDA

View Full Version : VBOX 4.5

lucita
03-17-2001, 05:27 AM
Whats happening with the cracking scene today?.
VBOX 4.5 was out a lot of time ago and there is no essay about reversing it. Anyone here tryed to reverse/crack an application protected with VBOX 4.5?. Was able to unwrap it?.

Thnx in adv.
Armadillo Killer
03-17-2001, 06:14 AM
Give us the link for a protected app, please.
tsehp
03-17-2001, 07:09 AM
hi,
you should read the past threads.
vbox has an iat encrypted scheme.
first you find the oep with icedump's tracer.
then you dump the target, and finally fix the iat's with revirgin.
and this is finished.

Actually the difficult one (IMHO) is safecast, safedisk 2 , currently working to fisnish revirgin's adapt to it.

regards,

+Tsehp
lucita
03-19-2001, 05:03 AM
The main feature of VBOX 4.5 (yes 4.5 not 4.3) isn't the encrypted iat, the great problem is that the main application is "distributed" into a couple of dll's, the exe is a 200kb shit that only loads the dlls and unwraps all to execute the app.
There is a *GREAT* difference between 4.3 and 4.5. (BTW: im able to crack 4.3). U cannot dump the exe, bcoz its only a loader, it actually dont have a single byte from the original exe. (well, i guess the icon).
I cannot point any URL coz the app i have encrypted is visio2000 from a Mocosoft cd.
Kilby
03-19-2001, 12:53 PM
Not wishing to start an arguement, so if I phrase this in a way which offends please forgive me, that is not the intent, I just can't think of another way to phrase it.

I cannot speak for VBox 4.3, though I can for earlier versions.

Quote:

The main feature of VBOX 4.5 (yes 4.5 not 4.3) isn't the encrypted iat, the great problem is that the main application is "distributed" into a couple of dll's, the exe is a 200kb shit that only loads the dlls and unwraps all to execute the app.

End Quote

Are you saying that VBox does this, or are you saying that thats how Visio is behaving ?

The version of Visio 2000 which I have installed (on this machine) which is an original version of Visio from last year is an exe of 45KB.

Visio32.exe :- 44.0 KB (45,056 bytes)

By Visios very nature it is a small .exe which calls multiple .dll files, it's a loader in it's normal state anyway.

Other progs of this kind are Adobe Indesign and Adobe Incopy.

This can cause fun with unpacking, as I discovered while experimenting with Crunch2. The uncrunch routine was re-entered multiple times, before the app actually ran.

It can look very strange when watching all the exits and re-entrys with SIce.

I know that .dll files are not that very different from .exe at a basic level, but are you suggesting that VBox, creates all nessicary exports within an .exe file and then calls them all in the correct order at the correct time ?

I could see an .exe being renamed to .dll but it is still an .exe.

Even at another level for a .dll wrapper being placed around the file with an export to the OEP, but that's about it.

Regards,

Kilby...
tsehp
03-19-2001, 01:35 PM
lucita (03-19-2001 03:03):
The main feature of VBOX 4.5 (yes 4.5 not 4.3) isn't the encrypted iat, the great problem is that the main application is "distributed" into a couple of dll's, the exe is a 200kb shit that only loads the dlls and unwraps all to execute the app.
There is a *GREAT* difference between 4.3 and 4.5. (BTW: im able to crack 4.3). U cannot dump the exe, bcoz its only a loader, it actually dont have a single byte from the original exe. (well, i guess the icon).
I cannot point any URL coz the app i have encrypted is visio2000 from a Mocosoft cd.

It's not also a problem and this feature was also quoted in the past thread :)

You notify sice loader to break at dll load and dump it, so it will make the main exe.
You can also rebuild the *dll's* iat with revirgin.
read this post, this crack was done in 10 minutes, the most difficult is to learn how to force sice to break at the dll main routine.
lucita
03-19-2001, 11:27 PM
Yes, maybe im wrong and VBOX 4.5 doesnt do that. Maybe i can rebuild the iat, if u can say me how to intercept the dll load.
Take note that if i set the Entry Point of the exe to zero, the application runs anyway bcoz when the OS resolve the iat, and it calls the dll main routine it makes some dirty tricks and all works fine. If there isnt a *HEAVY* relationship between the exe and the dll's when i set the EP of the exe to zero, obliously the exe MUST crash.
Maybe some of u (Killby, Tsehp) can explain those relation between exe and dll, and/or unrapping all those.
Kilby
03-22-2001, 04:10 AM
Sorry about the delay, I have been a bit busy playing with an OCX file.

The only play I have had wth VBox was a very quick dumping session a couple of months ago.

If U want to point me towards a 4.5 target I will have a look at that and even take some notes too :)

Kilby...
tsehp
03-25-2001, 12:21 AM
lucita (03-19-2001 21:27):
Yes, maybe im wrong and VBOX 4.5 doesnt do that. Maybe i can rebuild the iat, if u can say me how to intercept the dll load.
Take note that if i set the Entry Point of the exe to zero, the application runs anyway bcoz when the OS resolve the iat, and it calls the dll main routine it makes some dirty tricks and all works fine. If there isnt a *HEAVY* relationship between the exe and the dll's when i set the EP of the exe to zero, obliously the exe MUST crash.
Maybe some of u (Killby, Tsehp) can explain those relation between exe and dll, and/or unrapping all those.

Here's an extract of an answer (made by the owl) to such a question :

for OEP: icedump/tracex
for dumping: icedump/hydra/unvbox.dll/pedump
a quick receipt just in case:

1. iceload -n vboxed.dll
2. run your exe, click 'Try' or whatever to pass by the nag
3. winice breaks as vboxed.dll!DllMain gets called for the first time
4. still in winice: /tracex <start VA of first section> <end VA of first section>
addresses can be fetched from map32 output
5. wait for first break, then you will have to issue another /tracex with a
slightly lower upper bound (no algo here, use zen to guess it, trying never
hurts)
6. 2nd break should normally be at the OEP, time to dump
7. /hydra unvbox.dll
8. /pedump <dll base VA> <RVA of DllMain> unvboxed.dll

you can remove the point 7 if it doesn't work and rebuild the iat's with revirgin.

regards,

+Tsehp
lvcita
03-26-2001, 09:59 PM
I will try it, Thanks a lot.
Mario
12-07-2001, 06:52 AM
VBOX 4.5 target (5 megs)

http://www.morphink.com/cgi-bin/dl.pl?MorphInkTrial
Solomon
12-07-2001, 08:13 AM
Here is another interesting target packed by VBOX 4.5:

Visual SlickEdit v6.0c (you need to fill the form and get a trial key)
h**p://w#w.slickedit.com/purchase/pu_regtrial.php?platform=wb-nt

This time the packed target is not an EXE, but a DLL called vsapi.dll;)

BTW: it's really a great IDE for programmers


Running sice on vmware win98 guest
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Running sice on vmware win98 guest
PDA

View Full Version : Running sice on vmware win98 guest

treat_w
03-17-2001, 02:51 PM
Hi,
Has anyone tried running Sice on vmware? I installed a Win98 guest OS on vmware and tried running SICE on it. I am running win2000 on the PC. The reason I want to use Win 98 is because reverse eng is easier on it than on Win2000.
I ran into a whole bunch of problems:
- vmware uses its own graphics adapter driver which gets messed up with Sice. The Directdraw capabilites are limited in the vmware driver and the OS is not able to boot with Sice running.
- trying to run sice remotely. unfortunately sice only supports ne2000 compatile/3com 3cxxx cards for remote debugging. I have a 3com card, but vmware installs its own AMD PCnet ethernet adapter and doesn't recognize any other network adapter. So I was stuck there as well.
- serial debugging. I thought of using a null modem cable to connect com1 (for sice output) and com2 (for listening on). Unfortunately my PC has only one serial port, so I am stuck there as well.
I could install another card and try this route, but was hoping if someone else has figured out a more elegant way to do this.
Thanks


New chameleon clock......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New chameleon clock......
PDA

View Full Version : New chameleon clock......

BlackB
03-18-2001, 04:50 AM
Hi there reversers,

I downloaded the newest chameleon clock (17-03-2001), and i suspect that there are some changes in ASProtect protection.
I'm not really sure what the OEiP should be.....using tracex I come out on 4AEC30....but it's a call and it does not PUSH EBP; MOV EBP, ESP as every normal app starts. However, a little bit before that instruction there is a PUSH EBP, but it gets never executed.

RVA Start: BD144
Length: 688
IT RVA: 1130000
Length: 180

It's also little bit unclear where those "set memoryflags" call is made.....there are about thousands of calls :-/

Btw, I spoke to risc lately, and he told he gave Alexey some anti-cracking advice and he told we had to "fear", heheheh. Just mentioning ;-)

btw, tutorial on Iris/Revirgin is finished. You can view it at http://blackb.tsx.org - Tutorials section - Iris
A copy of the essay will be available soon at +tsehp's site (I hope, heh)

greets

The Blackbird aka BlackB
risc
03-18-2001, 08:26 AM
haha

i hate you so much right now (tm?)

'fairlight ate my hamster!'
MO`K
03-18-2001, 06:23 PM
BlackB,

None of my home unix/netscape boxes are able to read your pages. Three different unices, two different netscape versions and a HotJava, all failed!

The main site comes up well, and so are the mini-index pages. I opened the tutorials pages, it went fine, but when i requested a tutorial, it 404ed me. I tried several times, different pages, no help.

I remember reading your pages on a win32 box at work, and it works, IMO there is some non-portable HTML/scripting in there, please try to fix it
(Hint:/blackb/c4n.css was not found on this server :-)
SpeKKeL
03-19-2001, 03:50 AM
Hi blackb,

Well downloaded latest cham.clock 2.51.
I found 4aebfc as the entry point
and the beginning of the IAt at (4)bd140 till 4bd7ce

But when i tried to resolve the entry's, revirgin(1.01) keeps crashing on addresses like cc0343 etc, ???when i used the trace option.
Maybe i made some mistakes ????

Greetz SpeKKeL.
PK_BPX
03-19-2001, 05:42 AM
Yes...Chameleon clock OEP is 4AEBFC..:)
but you can't dump it at oep ,you must dump at
offset 4927A4 ,because some flag may be set
in memory!

and i also crashing when using revirgin 1.01 trace option.
but i fixed some address by hand !


GetDiskFreeExa - is this the right syntax ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > GetDiskFreeExa - is this the right syntax ?
PDA

View Full Version : GetDiskFreeExa - is this the right syntax ?

the snake
03-18-2001, 05:01 AM
Hi to whom can help.
I'm at work right now, and don't have any tools here.
I have a program that crashed on start-up with this messagew :
"FILE APPMANAGER.DLL IS LINKED TO A MISSING EXPORT GetDiskFreeExa-KERNEL32.DLL"
Can someone please check for me if this is the right syntax for this API, or the programer had a mistake ?
Thanks in advance for a quick reply...
the snake
SV
03-18-2001, 05:36 AM
Hi the Snake

I have only found this API (old one was GetDiskFreeSpace)
Nothing with only 'GetDiskFreeExa' !

Hope it will be useful ;)

SV

GetDiskFreeSpaceEx
The GetDiskFreeSpaceEx function obtains information about the amount of space
available on a disk volume: the total amount of space, the total amount of free
space, and the total amount of free space available to the user associated with
the calling thread.

BOOL GetDiskFreeSpaceEx(
LPCTSTR lpDirectoryName, // pointer to the directory name
PULARGE_INTEGER lpFreeBytesAvailableToCaller, // receives the number of bytes
on
// disk available to the caller
PULARGE_INTEGER lpTotalNumberOfBytes, // receives the number of bytes on
disk
PULARGE_INTEGER lpTotalNumberOfFreeBytes // receives the free bytes on disk
);

Parameters
lpDirectoryName
Pointer to a null-terminated string that specifies a directory on the disk of
interest. This string can be a UNC name. If this parameter is a UNC name, you
must follow it with an additional backslash. For example, you would specify
\\MyServer\MyShare as \\MyServer\MyShare\.
If lpDirectoryName is NULL, the GetDiskFreeSpaceEx function obtains information
about the disk that contains the current directory.

Note that lpDirectoryName does not have to specify the root directory on a disk.
The function accepts any directory on the disk.

lpFreeBytesAvailableToCaller
Pointer to a variable to receive the total number of free bytes on the disk that
are available to the user associated with the calling thread.
Windows NT 5.0 and later: If per-user quotas are in use, this value may be less
than the total number of free bytes on the disk.

lpTotalNumberOfBytes
Pointer to a variable to receive the total number of bytes on the disk that are
available to the user associated with the calling thread.
Windows NT 5.0 and later: If per-user quotas are in use, this value may be less
than the total number of bytes on the disk.

lpTotalNumberOfFreeBytes
Pointer to a variable to receive the total number of free bytes on the disk.
This parameter can be NULL.

Return Values
If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error
information, call GetLastError.

Remarks
Note that the values obtained by this function are of type ULARGE_INTEGER. Be
careful not to truncate these values to 32 bits.

Windows 95 OSR2: The GetDiskFreeSpaceEx function is available on Windows 95
systems beginning with OEM Service Release 2 (OSR2).

To determine whether GetDiskFreeSpaceEx is available, call the LoadLibrary or
LoadLibraryEx function to load the KERNEL32.DLL file, then call the
GetProcAddress function to obtain an address for GetDiskFreeSpaceEx. If
GetProcAddress fails, or if GetDiskFreeSpaceEx fails with the
ERROR_CALL_NOT_IMPLEMENTED code, use the GetDiskFreeSpace function instead of
GetDiskFreeSpaceEx.

QuickInfo
Windows NT: Requires version 4.0 or later.
Windows: Requires Windows 95 OSR2 or later.
Windows CE: Unsupported.
Header: Declared in winbase.h.
Import Library: Use kernel32.lib.
Unicode: Implemented as Unicode and ANSI versions on Windows NT.

See Also
File I/O Overview, File Functions, GetDiskFreeSpace
the snake
03-18-2001, 06:35 AM
Hi SV
Thanks alot for the quick reply.
I'm not sure what i'm going to do with this detailed post, not sure it'll be a good idea to try fix it by my self, it's just that the API looks like missing something...
Maybe just to e-mail the author about the problem..
Anyway, your reply is very appreciated.
Regards
the snake


here are some links to asprotected progs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > here are some links to asprotected progs
PDA

View Full Version : here are some links to asprotected progs

kantot
03-18-2001, 06:06 AM
http://vulcan.spaceports.com/~totnak/aspr.txt

there are still lots out there...


Lame protection cracking attempts, I need help.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Lame protection cracking attempts, I need help.
PDA

View Full Version : Lame protection cracking attempts, I need help.

Sven
03-18-2001, 06:52 AM
I've got a dongle protected program that I copied from work and I'm trying to get it to work dongle-less at home, but as I'm only an electronic engineer the only thing I can do is look at the data between the dongle and PC and use a RISC chip to search for a command from the PC and give the right responses.
This is NOT working at all.
The dongle appears to NOT give standard responses to standard questions, but to perform some mathmatical operation on the the data sent from the PC then send it back.
I've tried to use the standard reverse engineering "giant karnough map" method but I'm either missing something or it's too complex for me to solve, However it may use standard responses that my crappy little logic analyser is missing (again), so if anyone could help me I'll e-mail them the program (a set of 2 individual programs with a common interface) for them to have a look at.
ANY help will be gladly appriciated, thankyou.

(I know some assembly from using RISC processors so I thought I could have a go at codemangling myself however Borg gives me the most ammount of decompiled code I have ever seen in my life and I don't reconise 99% of the resisters called so *lol* to that)
Sven
03-18-2001, 07:36 AM
Or if anyone knows a program that would analyse the I/O on LPT1 and allow me to print it, that would be helpfull.
Thanks for anything.
aimless
03-19-2001, 10:08 AM
Sven (03-18-2001 05:36):
Or if anyone knows a program that would analyse the I/O on LPT1 and allow me to print it, that would be helpfull.
Thanks for anything.

Try

www.sysinternals.com

Search for PORTMON

or any other such util you may see fit. BTW, they work on APLHA and INTEL.

And are free (all of them!)

And golly! small too (none of them is above 200K mark!!)

And...fully GUI too (holy hell! those guys are good)

Have fun

Luv
Sven
03-19-2001, 02:02 PM
Thanks aimless, its just what I needed to look at the port activity (although I would still like a GUI dongle analyser if anyone knows of such a thing).
It's also very nice to know that some people are able to reply to less experienced people without flaming them, this is the only forum that hasn't flamed me when I posted my problem.
Squidge
03-19-2001, 04:59 PM
Personally, I've never had much success when trying to hack a dongle off a program by doing it this way. The dongles are normally very secure and the data between the application program and dongle are normally heavily encrypted.

The week link is normally the application program following the usual case of "I want you to implement this protection in 5 minutes" approach from some kind of manager, and so it goes like this:

CALL Dongle_Check
Test EAX,EAX
JE NoDongle
// Continue execution


Dongle cracking (rainbow version)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Dongle cracking (rainbow version)
PDA

View Full Version : Dongle cracking (rainbow version)

n03l
03-18-2001, 09:48 AM
Hi all on the board,

Anyone here who's got experience, or can help me with cracking this type of dongle (RainBow USB version)?

I've got a nice program(s) here to do video overlay that is using this damn dongle. The program comes in two parts. Part one (the main program) I've managed to crack, but the 2nd program, I can't seem to manage (it keeps crashing).

Any help / advice appreciated.

n03l
Predator [PC/pGC]
03-19-2001, 01:31 PM
heyaz friend.. i received your mail, will take a look at it asap

greets,
pred
n03l
03-19-2001, 04:12 PM
Hi Pred.

Would be great if you could fix the problem }>

CU soon when I'm back again.

n03l.


Companion disk to Barry Kauler's "Windows Assembly Language and Systems Programming"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Companion disk to Barry Kauler's "Windows Assembly Language and Systems Programming"
PDA

View Full Version : Companion disk to Barry Kauler's "Windows Assembly Language and Systems Programming"

dELTA
03-19-2001, 05:43 AM
Hi every, I'm searching for the companion disk to Barry Kauler's book "Windows Assembly Language and Systems Programming". This book is highly recommended by many crackers and I have only been able to get hold of the book, not the companion disk. :-( It should contain, among other things, a very good include file for Windows API:s.

I know that many of you must have it, and I would very much appreciate if someone could put up a link to it (or mail it to me).

When searching for it I found this page where The Owl lists filenames for such companion disks, but I cannot understand where these files should be?

Check it out:
http://members.dencity.com/jas/fravia/owlbook.htm

I also found a dead link to it on +Aescalapius open book pages (recently reopened!!)

Thanks everyone!
esther
03-19-2001, 11:00 AM
dELTA (03-19-2001 03:43):
Hi every, I'm searching for the companion disk to Barry Kauler's book "Windows Assembly Language and Systems Programming". This book is highly recommended by many crackers and I have only been able to get hold of the book, not the companion disk. :-( It should contain, among other things, a very good include file for Windows API:s.

I know that many of you must have it, and I would very much appreciate if someone could put up a link to it (or mail it to me).

When searching for it I found this page where The Owl lists filenames for such companion disks, but I cannot understand where these files should be?

Check it out:
http://members.dencity.com/jas/fravia/owlbook.htm

I also found a dead link to it on +Aescalapius open book pages (recently reopened!!)

Thanks everyone!

Hi Delta,
http://rs1.szif.hu/~tomcat/win32/packs.htm
take a look :)
regards
esther
m0sk
03-19-2001, 12:11 PM
hi dELTA,

a quick search with google for "asmprgw3.rar" leads to an index with all the disks that are on the page you mentioned ;)

http://cdata.tvnet.hu/~theowl/

have fun
dELTA
03-20-2001, 01:18 AM
Thanks guys!

Damn, I most often give up when Altavista and Ftpsearch offer me no hits, but it seems Google has passed Altavista in efficiency lately...
MO`K
03-20-2001, 02:38 AM
Yes, since they migrated to a 100% Linux base : )


Reversing Microsoft Reader .lit format to text format, any ideas?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing Microsoft Reader .lit format to text format, any ideas?
PDA

View Full Version : Reversing Microsoft Reader .lit format to text format, any ideas?

ultraungar
03-19-2001, 07:35 AM
Wondering if there are any thoughts to convert the .lit format used by the Microsoft Reader program to other formats.

There are programs to convert from several different to .lit but I haven't heard of anyone being able to convert it back to other formats.

If anyone has any ideas, please post.
MO`K
03-20-2001, 01:44 PM
I don't know of any progams that automate the task, but i my
give you a hint on writing your own.

First, get the "reader" application that processes the given file.
Look in its disassembly for some sort of an "open" function call.
Applications first open the target file, and use some sort of
handle -returned by the OS- to reffer to the file.

First find the function that opens the file, and pay a close
attention to the code that follows.

See if the code reads the values of particular offsets within the file, and note where it stores these values. You will see them reused later, so you will need to jot them down (the offset within
the file, its value as seen in the debugger, and memory location
where it is stored.)

Try to pick one value at a time, and hexedit it to a different value. The reader application will complain about an erraneous
value X, Bingo!

Some times the application will read the entire header at once,
and store it in a dynamic array. Use IDA to isolate the usual
open/malloc/read functions, and concentrate on the guts.
Note down the base of the array, and watch out for any variables being compared to an offset of ESI, EDI at rare times.

If the application reads an entire chunk from the file, note the
size of that chunk. mostly a paremeter passed to read() which
ends up in ECX ;P

I don't know about how much intimacy with the application are
you willing to have, and how important it is to you. So if really
intersted, let me know and i will write more on the topic.

Hunt down for those little closed-source DOS demos, which
happen to have a run time library for sound and graphics and
such. They are the easiest to understand, and you will grow so
little reversing muscles disassembling them.

Get SkyRoads, it is tiny and comes with 30 or so files, and the
game is really interesting. Hint, the sprite for the space jet is
hardcoded in the main app, but all the levels and their repectve
sound data are in files ; )
dan
03-21-2001, 12:34 AM
I think someone at alt.binaries.e-books is working on something. Ping the group and ask.
ultraungar
03-22-2001, 01:01 PM
Thanks for the hints. This is what I found from the bookwarez crowd.

================================

Ok now the correct instructions. Thanks to Chase for pointing out my
mistake along with the correct link.

Download and install wintask from http://www.wintask.com/

Open the lit file you wish to convert and make sure you're on the
first page of TEXT not the chapter listing. Take note of that number,
go to the last page you wish to convert and subtract the page number
of the first page of text from the last page you wish to convert. Now
go back to the first page of text.

Now open up wordpad. I use the name convert.doc on my desktop.

Now open the SRC file I've attached in WinTask and click on Play, then
a box should come up, click run, then click Ok. Now type in the
number of pages to convert (the number you calculated earlier). It
should handle everything.

I put a dialog box with some info in it, if you decide to modify and
redistribute it change it to "Convert by Tecnodude version
" add to the version number " Modifyed by: " your name or handle
and the current date. This way we can keep all the revisions separate.

Thanks
Tecnodude

--------------------
CallDialog Dialog
CallDialog PageD

BEGINDIALOG Dialog 337, 260, 350, 110
CAPTION "Convert by Tecnodude"
TEXT "Convert Version .03 by Tecnodude 1-19-2001", 59, 15
DEFPUSHBUTTON "&OK", btnOK, 125, 41, 75, 23
ENDDIALOG

BEGINDIALOG PageD 337, 260, 350, 138
CAPTION "Number of pages to convert"
TEXT "Please enter the number of pages to convert:", 55, 19
EDITTEXT pages$, 128, 42, 78, 20
DEFPUSHBUTTON "&OK", btnOK, 130, 78, 75, 23
ENDDIALOG
pages=val(pages$)
repeat
UseWindow("MSREADER.EXE|EBUI_CHILD|Microsoft Reader|1",1)
ClickMouse(Left,Down,54,62)
MoveMouse(84,654)
ClickMouse(Left,Up,84,654)

UseWindow("MSREADER.EXE|EBUI_CHILD|Microsoft Reader|1",1)
ClickMouse(Left,Down,31,131)
ClickMouse(Left,Up,31,131)

UseWindow("MSREADER.EXE|EBUI_CHILD|Microsoft Reader|1",1)
SendKeys("<Alt>")

UseWindow("WORDPAD.EXE|RichEdit20W|New WordPad Document - WordPad|1",1)
SendKeys("<Ctrl v>")

UseWindow("MSREADER.EXE|EBUI_CHILD|Microsoft Reader|1",1)
SendKeys("<pagedown>")
pages=pages-1
until pages<1

PS: <Dunamai> Von_Cha, one note. Make sure the Reader Font Size is at its default (middle setting)
ultraungar
03-22-2001, 01:04 PM
Now if we could just find Win Task ...


wisp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > wisp
PDA

View Full Version : wisp

sam
03-19-2001, 02:52 PM
Iv'e been looking at the Sandman's tutorial about the "wisp" program!.
I have been trying to find how the magic number is generated but can't find how it's done!.
It seems to write to the registry then reads it back again! I found a loop which seems to be checking the digits but can't see where any cmp instructions!.
Can anyone help!. I haven't been cracking for long but I am more interested how the program fetches the sn. than the crack it's self!.

Sam


FlexLM 7.0b target with no DLL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM 7.0b target with no DLL
PDA

View Full Version : FlexLM 7.0b target with no DLL

Malkocoglu
03-19-2001, 04:43 PM
I have a target app that uses FlexLM 7.0b
But it does not use any of the lmgr* DLLs...
I think they used the static FlexLM library(IMHO)
And the whole MFC is imported by its ordinals...
I BPXed at a nagging Messagebox but it is no use
And i dont have a sample "license.dat" file
Any suggestions to start with ?
And may ne1 send me a sample "license.dat"
file to yavuzhan@techie.com !?
Thx in Advance...
Perry
03-19-2001, 06:47 PM
Maybe you have that to read a bit more.
Your DLL probably is merged to main code and your "license.dat" have it other name i don't know. Probably at the main code is the name of the license file.

Regard.
Perry
Malkocoglu
03-20-2001, 12:52 PM
The application tells that it could not find the "license.dat" file... I dont know the format of that file
is that a binary file or a file that consists of some strings...
I think the DLL is not attached to the main EXE
because the PE header seems very normal...
They just used the static library not the import one...
Ne1 knows documentation os SDK about FlexLM ?
kFd
03-20-2001, 04:16 PM
There is a dedicated page about FlexLM and SDK at
url:hxxp://zencrack2.cjb.net/
There is a lot to read ...
kFd
Malkocoglu
03-21-2001, 01:04 PM
Thank U very much
That was just what i looked for...
Malkocoglu
03-24-2001, 02:06 AM
I got all the SDK and i read the info
But then i cracked the Proggie without using that information
They bought and used the FlexLM but they used it the silly way...
So i just made a function returning always 0
It is very silly of that company
who sells this crap-proggie for 3000 USD
Funny lamers...


Vbox 4.3 questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Vbox 4.3 questions
PDA

View Full Version : Vbox 4.3 questions

Poltergeist
03-19-2001, 08:37 PM
Has anyone tried unwrapping CorelDraw 10 trial? I've been playing around with this, but so far no luck (I think it's mostly my unfamiliarity with Windows based cracking, however). It seems to be protected with Vbox 4.3 (vboxm431.dll, vboxt431.dll, vboxz432.dll are the dll files in system dir.) The 'target' files are a bunch of small executables (coreldrw.exe, corelrve.exe, etc) which bootstrap larger .DLL files (coreldrw.dll) -- the large DLL files do not seem to be encrypted. The Vbox 4.3 generic unwrapper by UCF crashes back to Win2000, and I can't seem to make a working .exe through sice/procdump. I read the essay by Marigold to try to get some background on this protection, although it was written for 4.03. Looks like things have gotten a bit tougher since 4.03. (Was looking into doing the memory-patch trick with the .DLLs -- decided it would be easier to remove it altogether). Any hints/ideas/etc? Thanks
bAZiK
03-20-2001, 02:15 PM
Poltergeist (btw, are you German?),
I've done some VBOX reversing at MGI and Total-Idea Products (VBOX 4.3). If you beat VBOX one Time, it's quiet easy! Took me about 5 hours for the first App, 5 for each next ;-)

Where can I get the Corel Draw Trial? (I'll look at Corel.com in a few minutes). If you are interested, I can give you some Tips on reversing VBOX! :D

regards,
bAZiK
http://www.AmoK.am
Poltergeist
03-20-2001, 06:39 PM
I (somehow) got it to work today.. I was following the "How to manually remove Vbox 4.3 tutorial", and it wasn't working under Win2000. Tried again on a Win98 machine, and it worked fine. With Win2k, everything seemed to be going according to the tutorial, but the dump resulted in an "invalid executable file" according to the OS. I used Sice/Sice Backdoor Keeper/ProcDump. Will post more details tomorrow.
splaj
03-21-2001, 07:20 AM
Hi Polti

With NT did you try to 'rebuild' the dump exe with PEditor 1.7 to fix up the PE header correctly ?

SplAj
bAZiK
03-21-2001, 08:59 AM
Hmmm....I think, as SplAj said, you need to rebuild the file with PEditor with option "make pe header nt/2k compatible". Worked fine for me on 9x/NT/2K/ME.
(used TRW2K, ProcDump and PEditor for unpacking)

bAZiK
Cps530
03-22-2001, 12:43 PM
I'm experiencing the same problem. Where can I get PEditor 1.7 from?
Thanks.
bAZiK
03-24-2001, 04:58 AM
www.freak2freak.cjb.net
or
www,protools.cjb.net


Memories...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Memories...
PDA

View Full Version : Memories...

aimless
03-20-2001, 08:57 AM
Back recently.

Saw the boards in action

Usual questions. Usual replies. Usual flames. Usual apologies. Memories came flooding back.

Felt a tear drop in my eyes.

I don't think anything other than death can pull me away from here.

Luv U all

ForEver.
Epic
03-20-2001, 01:35 PM
wait, you're too young :=) Try to remember pre-cro+ times.

Kind regards
Boojum
03-25-2001, 01:40 AM
Wondering where everyone went.
POP! and it was gone.
Did SVD archive all that?
This could be cool (as well).
Fravia's site looks well.
Need some more time ...
Lend a guy some time? Spare timmmmeee, anyone...
tsehp
03-25-2001, 07:10 PM
where everyone went ? They dispersed on the several messageboard that still exists, a lot are still insidetheweb like but a big majority are still wandering from one to another.
The thing that really changed since several months now, is that people hesitate more and more to share the info they have, publicly off course. Info means work to provide and giving this for free to protectionnists is not in the mood anymore.
For example, do you see a lot of new emerging rce tools given with their sources ? nope, including mine...
But the places always serve to make contacts, and share the info later but privatly, just like the tip of the iceberg.


.NET MSIL Decompiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > .NET MSIL Decompiler
PDA

View Full Version : .NET MSIL Decompiler

ZenLoren
03-20-2001, 11:28 PM
Hi!

Just a flash message here

C# DECOMPILER?
http://www.saurik.com

gives very impressive results with the first release.

Thanks fly out to Jay Freeman for supplying this tool with
the source code!

ZenLoren


Reversing the swap file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing the swap file
PDA

View Full Version : Reversing the swap file

mike
03-21-2001, 02:48 PM
I'd like to add some functionality to windows to enable swap file cleaning while Windows is active. Windows allocates a lot more swap file than it actually needs, "just in case." It would be nice to be able to clean out those portions of the swap file that are not actually in use. I'm sure I'll have to write a VxD to do it; any pointers to sites dealing with vxd's and memory management?
Carpathia
03-21-2001, 08:12 PM
Best get a copy of the DDK for your platform from MSDN. Also, do a websearch for Driver Development FAQ, which provides a little useful info. You might want a to get checked build of your target platform too.

Also note that Id expect truncating the swap file to hinder performance. Windows reserves the expected amount of swap space so that it can grow efficiently (even tho potentially wasting a big chunk of disk space :- )

Regards

Carpathia
mike
03-22-2001, 01:27 PM
Didn't intend to truncate it, just overwrite the data.

Thanks
mike
03-23-2001, 11:34 AM
What's XP?
mike
03-23-2001, 11:36 AM
What's XP?
Squidge
03-23-2001, 04:07 PM
WindowsXP - Basically WindowsWhistler... I've tried lots of beta's and still not happy with it in general though - much prefer Windows2000.


cracking old CDILLA license manager
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > cracking old CDILLA license manager
PDA

View Full Version : cracking old CDILLA license manager

Rainor_
03-21-2001, 03:13 PM
ppl i'm cracking and old cdilla 16 bits license manager, target AUTODATA, the protection install a lot of crap and check serial using a dll named CDILLA05.DLL i can't find any info about this kind of protection in the net.
Anyone had info aboaut this old protection???

Rain:pr
goatass
03-22-2001, 09:27 AM
I'm currently working on a program that uses the same protection (SafeCast), it's 32 bit but it should function the same way. The version I'm working on is pretty new tho. When I'm done I'll try to post some info about it.

goatass
Aquatron
04-01-2001, 11:52 AM
Hello

I am newbie in this field but I don't know about C Dilla being 'old'. It is used in the latest 3D Studio Max and the keygen by Titan for that program works for a while and then the prog throws a 'authorisation error' back at you and the C Dilla system refuses to allow re authorisation. There is somehting hidden somehwere that cannot be deleted.

Pissed me off no end I can tell you, and I bet Titan were not too happy either.

Aquatron
Azazel
04-17-2001, 08:13 AM
Aquatron (04-01-2001 09:52):
Hello

I am newbie in this field but I don't know about C Dilla being 'old'. It is used in the latest 3D Studio Max and the keygen by Titan for that program works for a while and then the prog throws a 'authorisation error' back at you and the C Dilla system refuses to allow re authorisation. There is somehting hidden somehwere that cannot be deleted.

Pissed me off no end I can tell you, and I bet Titan were not too happy either.

Aquatron

Hi, I am currently working on a crack for Autodesk's Inventor Release 4
which happens to use the same protection system. And I guess I can at least tell you where there is something hidden as you call it. In general, what cdilla does is to decrypt one or more dlls which are stored in an encrypted way on the harddisk at load time.
As you might probably know, a reauthorisation is not possible, not even if you format the partition where The OS and the protected software are installed. So, that information must be stored at some other place on the harddisk. In case of Inventor R4 it is sector 32 on the boot harddisk (in some seldom cases it is a different sector). It should be noted that it's the same with Mechanical Desktop Release 5 which is also Cdilla-protected. As 3D Max is also an Autodesk product, I do assume that it shouldn't be much different.

PS: For Inventor and MDT there's an easy way of restoring the 30 day trial period. ie. just erase the content of sector 32 using a low level disk editor (eg. dskprobe.exe - an Nt/w2k recource kit utility).
Additionally, delete the .dat file which is located in the cdilla directory of your harddisk.

As far as the code generator is concerned, I do assume that this one only produces temporary authorization codes. You should check the About-Box of 3d Max to check whether you have a permanent license or a temporary one.


Installshield Unpacking/Decompiling?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Installshield Unpacking/Decompiling?
PDA

View Full Version : Installshield Unpacking/Decompiling?

Instabil
03-22-2001, 01:43 AM
The setup program of this package uses SETUP.INX, not SETUP.INS.
I don't know the difference between *.INX and *.INS. Is there any tool to unpack it. WisDec or
other don't work.

cu
reverser
03-23-2001, 11:38 AM
Instabil (03-21-2001 23:43):
The setup program of this package uses SETUP.INX, not SETUP.INS.
I don't know the difference between *.INX and *.INS. Is there any tool to unpack it. WisDec or
other don't work.
cu
see http://nekosuki.virtualave.net -> ISD6.0
Readme is in Japanese, but program itself is in english.
There's even a possibility to debug decompiled scripts.
Solomon
03-23-2001, 10:00 PM
hehe, that's my question. Thx for posting here ;)


Atria license manager
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Atria license manager
PDA

View Full Version : Atria license manager

dl
03-22-2001, 02:24 PM
I managed to successfully patch ClearCase :-) from Atria/Rational.
Well, but that's not enough for me, I want generate a license.
Can some good soul push me in the right direction?
OK, I am lazy, but I do not beg for a ready made license.
OK?
Cast
03-23-2001, 08:20 AM
Rational uses FlexLM, the vendor name is: rational, seed codes are:
seed1: e41c9815
seed2: 9e76f55d

Behavior: v6.0

I leave it up to you to verify these findings and find features + version(s)..

Keep your eyes out for template licenses generated during installation or eval licenses..

Regards,
Cast
dl
03-23-2001, 03:36 PM
OK. I am aware that Rational uses FlexLM in products like ClearQuest or Purify.
But I do not think this is the case with ClearCase. I will check this soon.

Can you give me more hints?

A license looks like this
ClearCase Temporary * 10 20001010 34a1b3fb.2c317a0c.02
And this does not look like a FlexLM license style :-(
gordon_freeman
03-25-2003, 04:42 AM
Hi,
It is possible to force ClearCase to use FlexLm instead of the Atria License Manager simply by patching the function : 'license_check_fcc_use_flexlm' in the 'libatriadxr.dll" ?


Where to download Flexlm SDK of Solaris platform
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Where to download Flexlm SDK of Solaris platform
PDA

View Full Version : Where to download Flexlm SDK of Solaris platform

HappyWolf
03-23-2001, 10:52 PM
When I seek the seeds of Sun Workshop 5.0 on Solaris 2.5.1 in the
way of Dan's method in Windows, I find the vendor daemon has not
lc_new_job(), lc_checkout(), etc. I want to download a set of Flexlm
SDK on Solaris for test. Could you tell me where to download it?
MO`K
03-24-2001, 10:40 AM
www.globetrotter.com/flexlm/lmdown.shtml

Get behind a proxy and fill in with bogus
info, they will make you repeat it over and
over, make sure you remember your bogus ID.
The e-mail must be correct though, make sure
you give them a web based e-mail and get to
that through an anonimyzing proxy, your
personal info are used to generate the key
sometimes, so you don't want to release a
serial which hashes to a date and your IP ;P

Also, the vendor of your target might provide
it for download, i know intel does.


Is there anyway to identify the version of aspack used to pack a program?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is there anyway to identify the version of aspack used to pack a program?
PDA

View Full Version : Is there anyway to identify the version of aspack used to pack a program?

ThrillSeeker
03-24-2001, 01:02 PM
Is there any way to indetify the version of aspack used to pack a program???'
Sphinx
03-25-2001, 12:31 AM
Apparently, you couldn't determine *really* what version was used if you just snoop around the exe file. The best thing to know it would be finding the program's entry point then classify it out, that is, if you already know the packer's entry point. If not, then try packing some apps with versions of ASPack then classify them. But that would be tedious! So use some file analyzers (like GetType) to determine the version. But what if the packer's entry point was intentionally modified? Then the manual entry point searching would be appropriate then. Greets!


New safecast essay
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New safecast essay
PDA

View Full Version : New safecast essay

tsehp
03-25-2001, 01:19 AM
check it out at :
http://tsehp.cjb.net/what_new.htm
Squidge
03-25-2001, 06:16 AM
Well, that's a neat place to store the license info and expiry date. Are there many others program that use a similar kind of protection? I've not seen many - most of them seem to rely on random scribblings of text in the registry which are all exposed using something like RegMon.
tsehp
03-25-2001, 11:46 AM
No it's the first time I saw this personaly. But don't forget that safecast is provided by the same company that built safedisc, and safedisc relies on a place on cd where the format is different, storing some keys to decrypt the executable. They could eventually manage in future versions to modify some portion of your hd to store this kind of info, but I really don't think that users would appreciate this, especially if they do a normal format and that their os reports some r/w errors.
This place is btw a good chosen place because it's not mapped by a normal logical partition, so even if you format your hard disk, the sector 32 will remain untouched.

regards,

+Tsehp
goatass
03-25-2001, 01:06 PM
Hey guys, nice essay +Tsehp and r!sc.

Just a side note, so far I worked on 4 safecast apps and all of them were very easy to break because after all the bullshit cdilla puts you through there are a couple small checks that when reversed the entire application is cracked and working 100%

that's my experience with it, I didn't really try too hard to understand the underlaying protection.

goatass
Squidge
03-25-2001, 01:55 PM
Must say I'm pretty much the opposite, if a new protection system comes out, I like to know as much as possible on how it works, rather than just how to crack the app that uses such a protection. I just find it interesting I suppose.

goatass (03-25-2001 11:06):
Hey guys, nice essay +Tsehp and r!sc.

Just a side note, so far I worked on 4 safecast apps and all of them were very easy to break because after all the bullshit cdilla puts you through there are a couple small checks that when reversed the entire application is cracked and working 100%

that's my experience with it, I didn't really try too hard to understand the underlaying protection.

goatass
tsehp
03-25-2001, 06:50 PM
goatass (03-25-2001 11:06):
Hey guys, nice essay +Tsehp and r!sc.

Just a side note, so far I worked on 4 safecast apps and all of them were very easy to break because after all the bullshit cdilla puts you through there are a couple small checks that when reversed the entire application is cracked and working 100%

that's my experience with it, I didn't really try too hard to understand the underlaying protection.

goatass

hi goatass,
but did you unpacked them or process patch ?

Actually I'm not focusing on cracking the app but retrieve back the original program by unpacking it and rebuilding the iat. Did you rebuilt the iat with a personal program ?

later,

+Tsehp
goatass
03-25-2001, 11:36 PM
Squidge, I agree with you I'm the same way most of the times, it's just lately I barely have any free time so I just patch :)

+Tsehp yes I unpacked it, used your revirgin and some other home made tools to create a fully unpacked file.

goatass
SV
03-26-2001, 02:35 AM
Hi all, tsehp, goatass

I have rebuild the reversi proggy (import and code fix)
and need some others SafeCast target to test rebuilder ;)

Please could you post some url ?

Thx SV
tsehp
03-26-2001, 03:09 AM
I only have the macrovision links, I'll ask r!sc if he knows some more.
Unlike vbox, they don't like to publish info about their customers ;)
LordSoth
03-26-2001, 04:30 PM
Impressive heh :)

One question though. Wouldn't a good AV scanner be able to pickup the changes made by Safecast to the physical drive ?
I admit I have no clue what sector 32 is used for, but what if malicious code
were put in it by some virus ?
Isn't there AV scanners that protect against stuff like that ?

LS
Rainor
03-27-2001, 09:25 AM
I'm working in a 16-bit SafeCast target (AUTODATA) 15 days trial, the target verify all license stuff using CDILLA05.dll, no wrapper or IAT stuff here only a lot of call to license manage functions. There is some place where i can get some kind of SafeCast SDF (ala FLexLM SDK) or info?????
Where i can found a DiskMon clone for Win98??? the only version is for NT/2K

Rain:pr
karakochev
03-29-2001, 02:03 PM
SV (03-26-2001 00:35):

Hi all, tsehp, goatass

I have rebuild the reversi proggy (import and code fix)
and need some others SafeCast target to test rebuilder ;)

Please could you post some url ?

Thx SV
you can test www.installshield.com
download demoshield I have made a loader for the executable but you can try the new +thelp's safecast essay on it
TOTEU
04-15-2001, 06:01 PM
Rainor (03-27-2001 07:25):
I'm working in a 16-bit SafeCast target (AUTODATA) 15 days trial, the target verify all license stuff using CDILLA05.dll, no wrapper or

Hi, there.
AUTODATA was my first experience with C-DILLA.Reading the essay
just got me remembering exactly this software.Back in ~1999 when I
solved it I used DISKEDIT to find/wipe out that sector.Usually after MBR sector 1 there are blank sectors till 63.I think CDILLA uses (nr of sectors+1)/2 to store its data.Mostly sector 32 with all newer HDDs.
Coming from boot virii times (96-99) I managed quite quickly to find that weird data stored in sect 32. It's funny that CDILLA hasn't changed its weird type of modifying HDD from 1999, and that this method still applies.

TOTEU "busy, but still around from time to time".Greets everyone.
tsehp
04-17-2001, 03:56 AM
karakochev (03-29-2001 12:03):
SV (03-26-2001 00:35):

Hi all, tsehp, goatass

I have rebuild the reversi proggy (import and code fix)
and need some others SafeCast target to test rebuilder ;)

Please could you post some url ?

Thx SV
you can test www.installshield.com
download demoshield I have made a loader for the executable but you can try the new +thelp's safecast essay on it

I'm afraid there are not, but you can still make sice trigger the kernel function I've described into the essay.
tsehp
04-18-2001, 02:32 AM
LordSoth (03-26-2001 14:30):
Impressive heh :)

One question though. Wouldn't a good AV scanner be able to pickup the changes made by Safecast to the physical drive ?
I admit I have no clue what sector 32 is used for, but what if malicious code
were put in it by some virus ?
Isn't there AV scanners that protect against stuff like that ?

LS

+splaj already tried some antivirus on this : no success.
not only sector 32 is used, but r!sc already saw some higher numbers,
this place is not used by windows and not included in partitions, it's a dead zone, very useful to store some info that you want to remain after a good old format.
only a low level format can get rid of it, or manually erase with an hex editor.


WebDetect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WebDetect
PDA

View Full Version : WebDetect

Squidge
03-25-2001, 06:28 AM
Has anyone reversed this yet? I'm not interested in cracking this app, I'm more interested in how it works. Connecting to the internet everytime a connection is available is the easy part, and grabbing the serial number of components inside your machine isn't too difficult either.

Thing is, there pages state the program will still be able to connect to the net after a full repartition and reformat of the targets drive and this is the part I'm wondering about. To me, it sounds like marketing crap as I see no way a program can load after a full reformat and reinstallation of windows. The only thing I can see happening is that it can store some kind of signature on the harddisk that survives formatting (like, eg Macrovision's SafeCast).

Anyone reversed it to see exactly what it does?


Is The Sand Man Still alive??????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is The Sand Man Still alive??????
PDA

View Full Version : Is The Sand Man Still alive??????

Jedi
03-25-2001, 11:09 AM
If some1 knows how to contact the sand man please tell me i need so ask him smth!
tsehp
03-25-2001, 06:55 PM
go to his site and watch inside all the forums, you'll find him.


softICE question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > softICE question
PDA

View Full Version : softICE question

gas can
03-25-2001, 12:21 PM
Hi all,
I'm having trouble finding the click counter mechanism in a program!.
+ORC in his tutorial talks of doing "snap saves" and "snap compares" and being able to print them out!.
How is this acheived in softICE!, I have read the pdf files and tried several ideas with no success!
ps. Another problem with +ORC tutorial is that when I follow his small debug routine to stop the system clock, it wont stop!. I run win98 but I've also tried the above in dos mode.
Please help, I have practised some of his more advanced articles and have built up a better knowledge of asm but I am stuck on this one!.

Sam
tsehp
03-25-2001, 06:55 PM
two easy ways :
first locate the window's handle by the hwnd command, then do a bmsg wm_leftbuttondown (or related) this will trigger the window's message handler, by tracing you could be soon or later inside the routine that count the clicks

second : count the clicks yourself ;) I'm not kidding but find the exact number of clicks you do before it quits, then scan the code to find a cmp eax, (number) or instruction related, do your list and try to patch them (ugly method).


How to generate Solaris's license with Flexlm6.1 SDK on Windows
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to generate Solaris's license with Flexlm6.1 SDK on Windows
PDA

View Full Version : How to generate Solaris's license with Flexlm6.1 SDK on Windows

HappyWolf
03-26-2001, 04:43 AM
Because I haven't Flexlm6.1 SDK on Solaris 2.5.1, so I want to generate
the of SunWorkshop 5.0 on Solaris with Flexlm6.1 SDK on Windows.
I have got the two seeds:
The real seed1: 0x1b55a399
The real seed2: 0xa91834d8
and the five vendor keys:
VENDOR_KEY1 0x74d8dbd7
VENDOR_KEY2 0x0e3ee474
VENDOR_KEY3 0x030776cf
VENDOR_KEY4 0xde024b81
VENDOR_KEY5 0xb7ef0e08
which were received with the help of Dan's essey. I emphasize that the
vendor key5 was calculated with the Noland blender's program called
lmrecode.c and the other were got with the adb debugger.

Then I modified the lm_code.h with the above seeds & keys, and compiled
lmcrypt.c on Windows' Flexlm6.1 SDK. When I ran
lmcrypt -i workshop5demo.dat -o license.dat -longkey
I got the message as following
"lc_init failed: Flexlm platform not enabled
Flexlm error: -48,52"
Could you indicate how to generate a valid license on Solaris with the
Flexlm6.1 SDK on Windows? Or you could tell me where to download
Flexlm SDK for Solaris(out of www.globetrotter.com).

Thanks in advance.

Tony
tom_324
03-26-2001, 07:27 AM
Use Nolan's tools from CrackZ site to generate new keys 1-5 for Windows platform.
Then use seeds you got from the original target to generate new license file. License generation is only seed dependant, keys 1-5 are for enabling FlexLM and eve no influence on license.

Tom
nblender
03-26-2001, 06:05 PM
What he said.

Also, you have to figure out the crypt filter or it's all for naught.
HappyWolf
03-28-2001, 07:11 PM
nblender (03-26-2001 16:05):
What he said.

Also, you have to figure out the crypt filter or it's all for naught.

Yes, I will try to understand the crypt filter. But at present,
with Dan's essey and your program I got a strange license.
Some features is licensed correctly and the other is wrong.

I can't understand the reason causing the phenomenon.


What to do when you receive ' Feature has expired' Flexlm Error
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What to do when you receive ' Feature has expired' Flexlm Error
PDA

View Full Version : What to do when you receive ' Feature has expired' Flexlm Error

festrie
03-26-2001, 10:51 AM
Is there a way to make a Flexlm License 'for ArcInfo 7.12, or Arcinfo 8.01' work when the date is expired?

I will appreciate the help...
Squidge
03-26-2001, 04:07 PM
I tried to force this to happen yesterday with Rational's Purify, set the date to 4 weeks in the future to expire the 15 day license, it expired and then I set the clock back 5 weeks. However, the bloody thing then said I had 3 weeks to evaluate it!

Why can't people expire there programs properly? I wanted some kind of "No, go away, this programs expired!" message but got none :(

Still, didn't take too long to patch the program to make it think that the license check out always succeeded, and then I just set my clock back to the original date. I'll create a proper license for it this weekend.

festrie (03-26-2001 08:51):
Is there a way to make a Flexlm License 'for ArcInfo 7.12, or Arcinfo 8.01' work when the date is expired?

I will appreciate the help...
nblender
03-26-2001, 06:40 PM
festrie (03-26-2001 08:51):
Is there a way to make a Flexlm License 'for ArcInfo 7.12, or Arcinfo 8.01' work when the date is expired?

I will appreciate the help...

Yes there is.

ArcInfo 7.12 and ArcInfo 8.01/8.02 use different algorithms for calculating the VENDOR_INFO field.

First, extract the seeds from the daemon IIRC it was just standard flexlm.

Build an lmcrypt with the correct seeds.

Update your license file, and process it with lmcrypt.

The VENDOR_INFO field has to be update to match the license key.
Using your favorite debuggger and disassembler, reverse the routine which matches
the license key to the VENDOR_INFO string and make a keygen.
kittykat
03-26-2001, 07:05 PM
NB, could you be more specific when you say "reverse the routine which matches the license key to the VENDOR_INFO string and make a keygen" . Perhaps, an essay on this would be welcomed by all. Vendors are becoming very clever in customizing flexlm and essays on how to overcome such as this "VENDOR_INFO" problem would be enlightening. Your last essay on flexlm - crypt filters was useful to me in reversing several programs :)
nblender
03-27-2001, 06:53 PM
kittykat (03-26-2001 17:05):
NB, could you be more specific when you say "reverse the routine which matches the license key to the VENDOR_INFO string and make a keygen" . Perhaps, an essay on this would be welcomed by all. Vendors are becoming very clever in customizing flexlm and essays on how to overcome such as this "VENDOR_INFO" problem would be enlightening. Your last essay on flexlm - crypt filters was useful to me in reversing several programs :)
Well, there's not much to say, except that the technique that they used in this particular
program was very similar to what many shareware authors use. The basic process is this:

1) the particular license line is grabbed.
2) the license key and the VENDOR_INFO string are grabbed.
3) the license key is passed through a custom transformation.
4) the output of the transformation is compared to the VENDOR_INFO string.
5) if they are the same, the key is good, else the key is bad.

This keygen is slightly unusual in that they use a lot of floating point math
in the calculations - a lot of shareware uses integer math or table lookups.

Here's a piece from the keygen:

dqNum_90 = (double) iNum_50;
dqNum_98 = iNum_84;
dqNum_98 = dqNum_90 / dqNum_98;
dqTmp = sqrt(dqNum_98) + 1.0;
fNum_10 = (float) dqTmp;
dqTnum = (double) fNum_10;
dqNum_a0 = iNum_84;
dqTmp = pow(dqNum_a0, dqTnum);
iNum_4c = (int) dqTmp;

and there's lots of that sort of thing.

Since everyone does it differently, it's not amenable to a generic solution.


PC Guard app
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > PC Guard app
PDA

View Full Version : PC Guard app

John Q 6Pack
03-26-2001, 12:39 PM
I am going to work on a PC Guard app for the 1st time. I have not worked on apps of this type as of yet. I have "looked around" in the app and it does seem formidable. Since it would seem that many protections are moving in this direction it is time to get my feet wet. Any information on tut's that are out there or just good old recomendations about how and where to start I would be greatful for. I want to get going on the "right" foot and not pound my head into the wall needlessly. I am and have been searching message boards and tut collections, however, I have not found much of anything related to PC gaurd. Thanks in advance....
drak0
03-26-2001, 04:19 PM
http://tsehp.cjb.net/

click on 'what new'

actually, the essay is here: http://www.woodmann.net/fravia/blackb_iris.html

good luck... i had some problems unpacking the file w/ revirgin.... but i suck :)

-drak0


IS there any body online here whom i can ask a question about flexlm right now?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IS there any body online here whom i can ask a question about flexlm right now?
PDA

View Full Version : IS there any body online here whom i can ask a question about flexlm right now?

festrie
03-27-2001, 05:48 AM
how to extract the seeds from the daemon IIRC in arcinfo 8.01 and arcinfo 7.12?

ps: what is seed and what is daemon IIRC?


Working on FLEXlm licensed targets.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Working on FLEXlm licensed targets.
PDA

View Full Version : Working on FLEXlm licensed targets.

nblender
03-28-2001, 01:30 AM
I would like to make (hopefully) helpful suggestions to those
of you who are emailing me. It's very important to understand
in general how to crack programs in general before asking questions
about FLEXlm based protections, otherwise any answers I or other
knowledgable people provide won't make much sense. Another
important thing is to read **and understand** the essays on FLEXlm
that reside on tsehp's site and CrackZ' site.

tsehp.cjb.net
zencrack2.cjb.net

These sites provide information on various approaches to generating
keys for FLEXlm protected programs.

Of course, it's very important to obtain the FLEXlm SDK (either 6.1 or
7.0 in this case) and to read and understand the documentation that
is provided with the SDK. Understanding what the calls do, and how
the protection is implemented simplifies both coding protections and
cracking them. For real cracking, Microsoft Visual C++ 6 (with sp3),
Windows NT, IDA, and Numega SoftICE are very helpful tools.

In general, I will not provide serials or keys to products in this
forum. If you just want a crack/license key, this isn't the right
place to be looking, but I'll bet a good look at www.searchlores.org
will help you.

Anyway, to understand how the seeds work, look at
http://www.woodmann.net/fravia/dan_fle5.htm

and the daemon you're looking for is named esri.exe most likely.
festrie
03-29-2001, 01:29 AM
Thank you very much nblender...

I would not disturb you again with such stupid questions:)

Wish you a nice day..
tsehp
03-29-2001, 02:38 AM
festrie (03-28-2001 23:29):
Thank you very much nblender...

I would not disturb you again with such stupid questions:)

Wish you a nice day..

Hey what's happening ? nblender provided an answer to your question
on the precedent topic , it didn't work ?
festrie
03-29-2001, 09:33 AM
Nothing had happened, I really appreciate the help of Nblender... unfortunatelly i really bored and forced him with my stupid questions , but nblender always respectfully and kindly answered my questions... I have difficulty to understand many terms becouse I am an ordinarry user...

Thanks everybody...


Midtown madness 2 (safedisc) defeated by Revirgin, need beta testers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Midtown madness 2 (safedisc) defeated by Revirgin, need beta testers
PDA

View Full Version : Midtown madness 2 (safedisc) defeated by Revirgin, need beta testers

tsehp
03-28-2001, 02:40 PM
hi,
(post corrected, thanks to r!sc and qferret for the discrete correction , but midtown madness 2 uses the same iat mangling than safedisc 2 targets)

I just finished latest version, and managed to get a working app in 3 minutes.
Just dumped the icd file, used revirgin on the running md2, revirgin patches automatically the dumped target to fix some calls that refers to bad iat's. Revirgin analyse the target and compares to all the resolved iat's, pasted the rebuilded IT.bin inside the dumped target and it works.
I need some beta testers that currently own original apps, just to see if revirgin manages to fix them all.
Write me at usual email,
lvcita
03-29-2001, 04:41 AM
Hi Tsehp:
I was testing revirgin and:
1-The exe give me an error in french. (I guess its a Delphi error). But anyways it runs.
2-I've tryed all, but i cannot resolve all the imports. I was testing Asprotect 1.2.
3-Im on a Windows 95 OSR2 (from 1996).

Greets.
tsehp
03-29-2001, 04:27 PM
lvcita (03-29-2001 02:41):
Hi Tsehp:
I was testing revirgin and:
1-The exe give me an error in french. (I guess its a Delphi error). But anyways it runs.
2-I've tryed all, but i cannot resolve all the imports. I was testing Asprotect 1.2.
3-Im on a Windows 95 OSR2 (from 1996).

Greets.
hi,
it's normal, the tracer is only working on 98, me and 2000.


help with revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help with revirgin
PDA

View Full Version : help with revirgin

generalhackbar
03-29-2001, 06:06 AM
Hi,
I used Revirgin 1.01 build 4 on w98 to unpack Tag&Rename 1.9(www.softpointer.com).
I found IAT start 13b1b8 and IAT length 82C.
But Revirgin can't resolve the imports "redirected", even after a "resolve again" and the tracer crashes my system...

(btw this target uses the same scheme as Chameleon Clock 2.51. There is one call to the target's code before the jmp OEP)

Thanks for our help.
tsehp
03-29-2001, 05:54 PM
downloaded the target and found this :
iat start 1561cc length 844 , try those right values and tell me.
NotMe
03-29-2001, 11:04 PM
I met the same problem with this target(Tag&Rename 1.9) too , while using revirgin 1.01 build4 .

Not very sure, but I believe it must be some Checksum or CRC checking in Asprotect... coz The program will crash or show strange behavier if u change the code of it.

Target: Tag&Rename 1.9 (fileversion:1.9.1.3)
HASH of Main fiile "TagRename.exe"(Using DAMN Hash Calculator )
=> MD5:9C4C6270408CE694CA8B03DD8650869F
tsehp
03-30-2001, 01:00 AM
(I'm not on the crc check)
I'm actually fixing revirgin for this target, update posted here pretty soon.
sv
03-30-2001, 02:05 AM
Hi

Some apis are pre processed !
In thunk, when called, you just have something like :

015F:00DCC85C A1DC35DD00 MOV EAX,[00DD35DC]
015F:00DCC861 C3 RET

And ...

015F:00DCC7D8 6A00 PUSH 00
015F:00DCC7DA E82D7CFFFF CALL KERNEL32!GetModuleHandleA
015F:00DCC7DF A3D435DD00 MOV [00DD35D4],EAX
015F:00DCC7E4 E83B7CFFFF CALL KERNEL32!GetVersion
015F:00DCC7E9 A3D835DD00 MOV [00DD35D8],EAX
015F:00DCC7EE 68E435DD00 PUSH 00DD35E4
015F:00DCC7F3 E8347CFFFF CALL KERNEL32!GetVersionExA
015F:00DCC7F8 E8DF7BFFFF CALL KERNEL32!GetCurrentProcess
015F:00DCC7FD A3DC35DD00 MOV [00DD35DC],EAX
015F:00DCC802 E8DD7BFFFF CALL KERNEL32!GetCurrentProcessId
015F:00DCC807 A3E035DD00 MOV [00DD35E0],EAX
015F:00DCC80C E8C37BFFFF CALL KERNEL32!GetCommandLineA
015F:00DCC811 A37836DD00 MOV [00DD3678],EAX
015F:00DCC816 C3 RET

As you can see, only api with no parameters (of course !) can be 'pre-processed'.

Regards SV
sv
03-30-2001, 05:24 AM
Hi reversers

There is an integrity check code .
Key is calculated (like checksum) and some parts are decrypted with this key.
Here it is 00555CAC :

-----TAGRENAME_SV!+0CAC---------------------------byte--------------PROT---(0)--
0167:00555CAC 30 61 17 85 0F B8 F4 25-72 E6 F1 EE 90 36 4C 62 0a.....%r....6Lb
0167:00555CBC A8 01 55 00 00 00 00 00-00 00 00 00 00 00 00 00 ..U.............
-------------------------------------------------------------------------PROT32-
015F:0055010F 8D55EC LEA EDX,[EBP-14]
015F:00550112 8B45FC MOV EAX,[EBP-04]
015F:00550115 E8CAF7FFFF CALL 0054F8E4
015F:0055011A 8D75EC LEA ESI,[EBP-14]
015F:0055011D BFAC5C5500 MOV EDI,00555CAC
015F:00550122 B904000000 MOV ECX,00000004
015F:00550127 F3A5 REPZ MOVSD
015F:00550129 33C0 XOR EAX,EAX
015F:0055012B 5A POP EDX
015F:0055012C 59 POP ECX
015F:0055012D 59 POP ECX

You can insert key (555cac) in unpacked exe and nop repz movsd.
After, you can patch 'register ? call' ;)

Regards SV
tsehp
03-30-2001, 03:54 PM
And now for my two cents :
I uploaded here the list that you can load inside your own version of revirgin. Your version, doesn't resolve the past alexey's trick that we mentioned here some weeks ago :
(imported from api)
first instr
instr 2
intsr 3
push instr 4 offset
ret

revirgin (private version) detects this since a while now, but the private version is not released immediatly after asprotect evolves (I prefer to let him ask his customers to upgrade their product, so he makes money and we're sure to unprotect much more of them :)

This revirgin version will be released pretty soon, just when the safedisc 2 beta test will be finished.

just a note, the unresolved thunks you'll see in the listing correspond to what sv mentioned. Hope this helps,
regards;

+Tsehp


CRC-Check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CRC-Check
PDA

View Full Version : CRC-Check

SirLeechaLot
03-29-2001, 07:31 AM
hi,

after manuelly unpacking an app I tried to run the program but a msg box popped up and told me "Corrupt File..Please Reinstall".
I tried to set a breakpoint on msgboxa but after pressing f11 I directly got to exitprocess.

So..whats a good bpx or method to get to the routine that verifies the checksum?

thanx for a little help

siRl
Scooby
03-29-2001, 10:16 AM
If it's unpacked, why not get a dead listing of it using something like IDA? The string saying it's corrupt may be right in the code segment :)
Kayaker
03-29-2001, 10:28 AM
Hi,

You could try CreateFileA (to get the name) and ReadFile. If it's a CRC check there's a good chance the proggy is reading at least a part of itself from the file on disk and performing a checksum. Also see if it seems to be performing a GetFileSize check on itself as well, which it may be using to detect being unpacked.

Kayaker
Kayaker
03-29-2001, 05:53 PM
Hi,

A couple of other things you could try. If it's a straightforward CRC check routine, there's likely a simple compare of the calculated checksum with what it *should* be. The real checksum may be hardcoded in the file somewhere which you could change to the calculated value, as one option for patching. The checksum will probably be a weird looking hex value you may see in EAX or another register, this is one clue of what's happening.

The other thing you might try if you have a hard time locating the checksum routine, and a technique I've been able to use successfully on a couple of occasions, is to do a SoftIce Trace on a suspicious section and see if there's any indication in the buffer logs that there's a multi-repeating loop, which *may* be the actual checksum routine. For example, if you do find a ReadFile call soon before your MessageBox call that you think might be being used to read the file in for a CRC check, set up a Trace between the 2 calls. Then peruse the Trace buffer. There'll probably be a s***load of code lines but if you find a relatively short loop that is being repeated over and over and over again, it might be the actual checksum procedure (i.e. read each byte in the file/section and perform some algorithm/summation on it, which will become the checksum value).

Just a couple of thoughts. Plus there could be more than 1 CRC check as well ;)

Kayaker
SirLeechaLot
03-30-2001, 03:12 AM
Scooby (03-29-2001 08:16):
If it's unpacked, why not get a dead listing of it using something like IDA? The string saying it's corrupt may be right in the code segment :)

I did that already but found nothing of interest.
I forgot to mention it. Sorry.
Kilby
04-02-2001, 09:11 AM
What's the app ?
SirLeechaLot
04-02-2001, 04:28 PM
Active Smart v1.3
http://www.ariolic.com/
Predator_PC^pGC
04-03-2001, 05:30 AM
OMFG

die.
CoDe_InSiDe
04-03-2001, 06:27 AM
?

CoDe_InSiDe
Kayaker
04-03-2001, 09:30 AM
I'm not saying this is where this crap came from, but this is one reason for NOT putting a direct, clickable link to shareware sites in posts. This leads the sites directly back to here. This we don't need.
Vasia Pupkin
04-04-2001, 09:19 AM
Please read EULA of Actve SMART
Kilby
04-04-2001, 11:04 AM
Oh dear,

I assume you are the author.

How can I phrase this.

It is legal to dissassemble and otherwise reverse engineer software (or indeed most anything else), though it may invalidate any warrenty with the item.

I am not sure that anybody here has used the app past 21 day limit.

Additionally as I remember software "ownership" is currently a grey area in most european countrys, and in the US essentially the customer owns the software, despite what the EULA says.

I take your point that you are not happy about your prog potentially being pirated.

Posting winzip eulas is not the way to do it, speak to the folks here, ask them to look at the protection on an older version.

It does work honestly !

I also suggest that you look in the associated archives and use the knowledge there to protect yourself better.

The information is free.

BTW, I am only really interested in the packer used, as I don't recognise it.

Tell me which packer it is and I will go away :)

Kilby...
Kayaker
04-04-2001, 01:13 PM
Kilby (04-04-2001 09:04):

BTW, I am only really interested in the packer used, as I don't recognise it.
Kilby...

Asprotect with a twist, a little different from normal :)

I have no interest in cracking and distributing this app either, this isn't where that kind of thing happens, but antagonizing the board by flooding it with EULA spam is probably the surest way to GET it cracked... ;)
Kilby
04-05-2001, 03:31 AM
That's the point I was trying to make.

Ahh, asprotect with a twist.

Thiat's the second time I have seen that twist in the last 2 days.

Kilby...
tsehp
04-05-2001, 06:18 PM
Kilby (04-04-2001 09:04):
Oh dear,

I assume you are the author.

How can I phrase this.

It is legal to dissassemble and otherwise reverse engineer software (or indeed most anything else), though it may invalidate any warrenty with the item.

I am not sure that anybody here has used the app past 21 day limit.

Additionally as I remember software "ownership" is currently a grey area in most european countrys, and in the US essentially the customer owns the software, despite what the EULA says.

I take your point that you are not happy about your prog potentially being pirated.

Posting winzip eulas is not the way to do it, speak to the folks here, ask them to look at the protection on an older version.

It does work honestly !

I also suggest that you look in the associated archives and use the knowledge there to protect yourself better.

The information is free.

BTW, I am only really interested in the packer used, as I don't recognise it.

Tell me which packer it is and I will go away :)

Kilby...
(sorry kilby)

The previous msg was deleted, in fact it was a big one containing the app's eula, without any interest for us.


Gearbox Connection Kit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Gearbox Connection Kit
PDA

View Full Version : Gearbox Connection Kit

Mr_T
03-29-2001, 01:12 PM
Hello.

Does anyone have any info on the the connection time monitor for the "Gearbox Connection Kit" from rockstar software

i.e. how it can be changed / disabled ??

(demo version link below)

http://www.rockstar.com/gearbox.shtml

http://www.rockstar.cnchost.com/gck25demo.exe

I am using the commercial version but I think(hope) the above version is the same.

Thanks.

Mr_T


Signlab 5.0 rev 6.2 - Compleate reverse
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Signlab 5.0 rev 6.2 - Compleate reverse
PDA

View Full Version : Signlab 5.0 rev 6.2 - Compleate reverse

AJ
03-29-2001, 04:21 PM
I have spent some time studying signlab 5.0. and found a few intereting things about it. First, I OWN the software for my vinyl art design company I jsut started. I purchased the ES2 package, adn realized it was the same file set as teh 5.0 demo you can download. Later I noticed that your package is based on the password you enter. I have not quite figured the algorytem yet, but I do know it's a base of 193... ok onto the reverse

downloading signlab 5.0 demo from cadlink.com is a first. the demo is a FULL working version, however, you can't save, and when you plot it scales down your image to 4" x 4" well, this is the easist of cracks.

got it yet? Good now install it.

the first think you need to do is pry the lid off of signlab with a good disassembler. I use W32dasm 5.1 the new version crashes to hell. now open your data refs and take a look for "DEMO version objects will be scaled down." well once you locate that double click and it wil take you right to it. now scroll up a few lines of code and you will notice a conditional jump... and we NEED that to JUMP.. what it does is jumps past the scaling down code.! so pop open your hex editor and change that offset's code.

goto 0003b1fd
change to EB18

YOUR DONE!

this version will nto save, hjowever it plots great. I have another crack written for the same program, with a differnt password (that looks for a dongle) but has ALL featurese, that crack will allow you to save and do work without "DONGLE NOT FOUND" interference. however, this crack will let you plot, but it really sux on the screen. after you plot some register is fucked and you have to exit the program and restat it.. infact if you just click the CUT button it's fucked. apparently one of the call bypasses I use most not puch or pop a register it needs. so im looking for that. if you interestd in that portion of my code simply reply to this message, or mail me at

deaddeer@mailcity.com


snpslmd on solaris...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > snpslmd on solaris...
PDA

View Full Version : snpslmd on solaris...

netman
03-30-2001, 06:42 AM
I tried to crack snpslmd on Solaris using SDK v6.1 and adb.
snpslmd implemented user crypt filter, so Nolan Blender's latest essay is a big help in this.
After two-day work, I go xor values and permutation table. (of course, lm_code.h is ready).
But lmcrypt I built just don't generate correct key.
I modified lm_code.h, lmkeyfil.c, lmappfil.c and all mentioned in NB's essay.
So help!!!
If it helps, I could post all info I got (xor/table/seeds).
Or someone out there who already have experience for snpslmd could help to check my extracted info?
Maybe I missed something tricky?
Anyway, thanks in advanced.

----
netman
nblender
03-30-2001, 04:13 PM
Post what you got so far and I'll have a look.

--nb.

Does anyone know a good place to store temporary files?

I have the 6.1 Solaris FLEXlm SDK here, and there's
enough people interested that it would be nice
if it was available.
netman
03-30-2001, 06:17 PM
thanks, NB!!!!
...
code:
.
.
.
VENDOR_KEY4 0xdf0ab4f1
VENDOR_KEY5 0x74f2127a
...
XOR:
0x3c, 0x31, 0x20, 0x2a,
.
.
.
0x38, 0x22, 0x21, 0x37
...
table:
{5,0,1,7,6,3,4,2}, /* idx 00 */
.
.
.
{3,6,4,2,0,7,1,5}, /* idx 15 */
.
.
.
{7,5,4,1,2,6,3,0}, /* idx 19 */

---
netman
nblender
03-30-2001, 07:12 PM
netman (03-30-2001 16:17):
thanks, NB!!!!
...
code:
ENCRYPTION_SEED1 0x987d844e
ENCRYPTION_SEED2 0xf43dc726

netman

The tables you have for the user filter is OK,
but the encryption seeds that you have are incorrect.

11d215b5 7d9256dd are the values that I got.
netman
03-30-2001, 08:14 PM
NB, big thanks for your help.
lmcrypt works now.
I will check my seeds more carefully. Thanks again...

[NOTE: I removed some info from my previous post. It contained all info to easy crack snpslmd. Need any help just mail me. ]
nblender
03-31-2001, 12:10 AM
netman (03-30-2001 18:55):
NB, big thanks for your help.
lmcrypt works now.
I will check my seeds more carefully. Thanks again...

[NOTE: I removed some info from my previous post. It contained all info to easy crack snpslmd. Need any help just mail me. ]
You're welcome.

FYI, arguments in slowlaris are passed in registers, so you have to set the register
corrseponding to the leftmost argument to zero
in order to get a null pointer passed in as the job ptr.

This also doesn't work on 7.2 and later versions.
Paul
03-31-2001, 04:32 AM
nblender (03-30-2001 22:10):
netman (03-30-2001 18:55):
NB, big thanks for your help.
lmcrypt works now.
I will check my seeds more carefully. Thanks again...

[NOTE: I removed some info from my previous post. It contained all info to easy crack snpslmd. Need any help just mail me. ]
You're welcome.

FYI, arguments in slowlaris are passed in registers, so you have to set the register
corrseponding to the leftmost argument to zero
in order to get a null pointer passed in as the job ptr.

This also doesn't work on 7.2 and later versions.
Paul Lee
03-31-2001, 04:43 AM
Sorry, I am mistake!!

How can get correct seed in flexlm 7.1 or higher!
I have read the lm_new.c file of v6.1 and v7.2a:

In v6.1, if the job is null, the set the memery zero, so I can get the correct seeds
if (job)
{
.
.
.
}
else
{
memset(t2.a, 0, sizeof(t2.a));
}

But in v7.2a, if the job is null, it return directly, so I can't get the correct seeds:

if (job)
{
.
.
.
}
else
{
return;
}

Thanks for any help!!!
nblender
03-31-2001, 12:18 PM
In order to get the seeds out with later
versions, you have to recombine information
from the job structure and the vendorcode
structure.

As it turns out, the algorithms used to distribute the data between the
VENDORCODE and the job structures are quite simple and based only on the first
character of the vendorname. Since lm_new.c is generated by lmrand2, it is
possible to totally reverse engineer how the seeds are extracted, then write a
program to recombine the data from the job structure and the vendorcode
structure, and recover the seeds this way. The essay nol_flex.htm contains a
detailed description of this.
Paul Lee
03-31-2001, 08:53 PM
nblender (03-31-2001 10:18):
In order to get the seeds out with later
versions, you have to recombine information
from the job structure and the vendorcode
structure.

As it turns out, the algorithms used to distribute the data between the
VENDORCODE and the job structures are quite simple and based only on the first
character of the vendorname. Since lm_new.c is generated by lmrand2, it is
possible to totally reverse engineer how the seeds are extracted, then write a
program to recombine the data from the job structure and the vendorcode
structure, and recover the seeds this way. The essay nol_flex.htm contains a
detailed description of this.

Thanks Nblender.
Is this essay's title "Information Hiding Methods used by FlexLM Targets
An Explanation of the FlexLM Seed Hiding System" ?
ic_ray
09-20-2002, 06:26 AM
dear netman and nblender,
Can you mail me permutation table of snpslmd ,I also want to try it and study it. Thank you
nblender
09-20-2002, 04:20 PM
I sent you the first 4 entries of the xortable and the permutation
table. This is enough to get you started, but I don't think it is
appropriate for me to send you a full solution.

--nb
jb1968
04-20-2004, 11:08 AM
NB, big thanks for your help.
lmcrypt works now.
I will check my seeds more carefully. Thanks again...

[NOTE: I removed some info from my previous post. It contained all info to easy crack snpslmd. Need any help just mail me. ]

my emailaddress is jb1968@163.com


Safedisc 2 : how can i get a valid dump? (r!sc??)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Safedisc 2 : how can i get a valid dump? (r!sc??)
PDA

View Full Version : Safedisc 2 : how can i get a valid dump? (r!sc??)

MackT
03-30-2001, 06:57 AM
'llo,
I tried to dump Hitman which is protected by safedisc2 but i get an corrupted exe (wrong datas) because i traced to the OEP (i think it's 40154C) with icedump and when sice pops up, the code is fully corrupted.

Thanks for your help...
MT.
risc
03-30-2001, 12:48 PM
0040154C public start
0040154C start proc near
..

why not 'bpm 40154c x' ?

or trace 100h bytes from hitmans entrypoint to this code (entrypoint at 40d1fd)

0040D27B loc_40D27B: ; CODE XREF: start+76j
0040D27B ; DATA XREF: start+4o ...
0040D27B jmp loc_40154C

and make sure u are using the original cd :-)

also, hitman uses safedisc 'api' .. this means after u have traced the process to entrypoint, a little bit of it is still encrypted.. im my hitman.exe, its the proc @ rva 401040

simply bpm 401040 x, and let the exe run, first break, it should be a jmp to the decrypt proc, second break, it should be the decrypted code ..

hey what a fucker. check the proc at 401040 :p

00401040 _WinMain@16 proc near ; CODE XREF: start+DBp
00401040
00401040 var_20C = byte ptr -20Ch
00401040 var_108 = byte ptr -108h
00401040 var_107 = byte ptr -107h
00401040 arg_0 = dword ptr 4
00401040 arg_8 = dword ptr 0Ch
00401040
00401040 sub esp, 20Ch
00401046 push ebx
00401047 push esi
00401048 push offset aHitboy ; "Hitboy"
0040104D push 0
0040104F push 0
00401051 call ds:CreateMutexA
00401057 call ds:GetLastError

also, system.dll is protected using the same technique . (except has two encrypted procs)


Agilent License Manager
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Agilent License Manager
PDA

View Full Version : Agilent License Manager

Genii
03-30-2001, 07:20 PM
Somebody heard about Agilent License Manager before ?
tsehp
03-31-2001, 01:41 AM
not me, you should provide us an url...
Genii
03-31-2001, 05:28 AM
I'm working on target from Agilent company ( Hewlett Packard previously ) . Their soft is very costly ( about 30000 USD ) and it's not a widely spreaded software , so I can't give an URL of this. I just thought may be someone worked before on Agilent targets.
roZes
03-31-2001, 07:41 AM
I have worked on it
genii
04-01-2001, 01:55 PM
Did you finish ?
Are they based on any existing LM ?
genii
04-04-2001, 04:51 PM
By the way the License Manager also called WSP License Manager.
May be someone know it by that name ?
TOTEU
04-15-2001, 06:29 PM
I think I know about it.The daemon is named hpeesofd because it was HP developed back in time.lmgr325c.dll AFAIK can be patched to return al=1 and make sure you have a license.dat with all features _a lot_ as I remember.Also you can retrieve good codes in memory with softice bpxing at the right time.This was for version 1.1x.Last is v1.3 and I dont have a copy to study it&share the details.
Cast
04-16-2001, 08:19 AM
Is it the hpeesofd daemon with the following seeds?:

1) 91721434
2) 75123438

- However i know for a fact that the license option is not used on the Agilent trials (anymore). The old HP VEE used it, but the Agilent VEE used a trial system with nags and limitations, i dident see any switch to a license option atleast. And what software from agilent still uses the old HP daemon ?

Thanks,
Cast.
genii
04-17-2001, 03:46 PM
All new targets from Agilent are not based anymore on FlexLM
like it was before. There is some new License Manager ( called WSP LM - also supports Sentinel dongles). I'm working on it now.
Jack
04-17-2001, 11:02 PM
I have patched ADS V1.1, and it worked.
I try the FlexGen for ADS V 1.3, but it failed.
I got the ADS V1.5 and it seems still use FlexLM 7.0g(or 7.1g? I forgot). But I couldn't get the linked library to create the signature for IDA. Does V1.5 use WSP LM? then why is there still FlexLM related files in the installed directory?
genii
05-04-2001, 03:34 PM
My target is Wireless communication kit , september 2000.
geza
06-10-2003, 08:02 PM
Originally posted by tsehp
not me, you should provide us an url...

http://www.agilent.com/cm/wireless/e6474/download.shtml
dELTA
06-11-2003, 04:11 PM
For christ sakes look at the posting dates of threads you reply to... :D

dELTA
squidge
06-11-2003, 04:24 PM
I know some people on here are patient, but I do think 2 and a half years is stretching it a little :)
geza
06-11-2003, 08:05 PM
i have look the date of the post, but i think it will be helpful if someone need the address.

i try to crack agilent software :e6474a, it use wspls.exe as a daemon. when i run the application dimas.exe, some menus need the dongle; if i delete the wspls.exe, then these menus seems work fine, it seems cracked, but i don't think it is true, i will check it carefully, maybe someone else can help me ?
carver
04-19-2004, 08:08 AM
anybody try to use "actix" visualization and analysis solutions ?
for example: viewing agilent e6474a*.sd5 files ?

older "actix" version, prior 4.1, use private *.axv files for licensing option and read dongle(support few dongle vendor) for verifying serial number from licensing files.

newer "actix" solutions based on sentinellm keys for store lisensing option.
but , protection not based on selninells, slm use only for store and encryption private vendor key.
"actix" call VLSgetFeatureInfo for asking keys and parsing vendor field for decoding licensing information.

i failled to reconstruct all slm field from parsing functions and asking for any ideas or sample "actix" slm keys ?
girl
04-20-2004, 01:57 AM
I had cracked it. -------true.
it's very easy.
:(
carver
05-02-2004, 03:56 PM
i also get running version, but have some problem.

serial number for actix solutions has many significance, for goog and bad option check.

for most licensed functions is need "good" answer, but for some check, like "is restricted demo version" is need "bad" answer.
no any explanation in code for answer polarity.

i can only compare program functions witch documentation, for checking good option contains in serial number.

do you resolve this problem ?

also i want talk about another wireless software, like for cdma/pcs/gsm solutions.


Palm Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Palm Reversing
PDA

View Full Version : Palm Reversing

the_lover
03-31-2001, 08:27 AM
I need to crack some small palm programs,but I don't know it's assembly language.

Where I can find PILA ASM reference & 68000 architecture infos?
nchanta
03-31-2001, 11:52 AM
hey ;)

when i first started palm (not long ago), i wanted to find a motorola asm reference to help me out...

try www.motorola.com

i didnt have much luck but who knows ;)

the asm isnt heaps different, it has a few quirks but due to it being better imho than x86 asm, its very easy to pick up...

NchantA
MO K
03-31-2001, 12:19 PM
shop here first
http://ti89.acz.org/references.htm
the tutorials are a bit calculator biased,
but you fill fish alot of generic info.

If you suspect to that your assembler is non-
standard, then pay a close attention to the
official doc http://ti89.acz.org/archive/68kpm.zip

There are many different syntaxes for the 68K
, so make sure you don't get confused by that.

There are plenty of palm emulators out there,
if you want to test your code on a PC, get
any of them. For a generic MC68000 emulator,
go to the "emulators" section in the above
mentioned page, and get the DOS based one,
right in the bottom of the page. It is a pure
68K environment, with minor console I/O
facility, no big library or system calls,
just enough to test the algos.

Hmmm, reversing; does the name "palmdeMON"
ring a bell? ;)
Go to carp's site and get the goodies.
http://carpathia.cjb.net

What else? yeah, tsehp's germinating mirror
is always full good stuff; there is an old
paper IIRC about palm, and there might be
newer ones.
Carpathia
03-31-2001, 12:26 PM
http://carpathia.cjb.net/680x0.txt
http://carpathia.cjb.net/68kguide.txt

Search the motorola site for the 68000 programmers reference. Specifically, the chip guide youre looking for is the 68328 for the older Palm Professional, and the 68EZ328 (the Dragonball) for later Palms, and all its derivatives (Handspring Visor, IBM Workpad etc).

You might also like to try my palm disassembler from the http://carpathia.cjb.net

Regards

Carpathia
the_lover
04-01-2001, 04:53 AM
Thanks!! I am studying now! ;)
Latigo
04-01-2001, 12:42 PM
I have written some tutes about palm reversing and palm asm coding.
Check them if you want at www.latigo.cjb.net
Bye and good luck! :)

Latigo


SENTINEL LM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SENTINEL LM
PDA

View Full Version : SENTINEL LM

vlsi
03-31-2001, 10:24 AM
please help me.... where can i find SENTINEL LM SDK or at least wlscgen.exe? i'm praticing with tuts from cyberheg and nolan blender (thanks to these cool guys) but i cannot find all the tools i need...
if someone can help me.
my email is xmitsurugi@hotmail.com
thank u all


Flexlm error
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm error
PDA

View Full Version : Flexlm error

Buz Killer
03-31-2001, 11:33 AM
Hi,

When I run makekey.exe I get the following
message :
"lc_init failed. FLEXLM key data has expired
flexlm error: -50,51"

What's wrong ?

regards,
Buzkiller(buzkiller@mail.ru)
nblender
03-31-2001, 02:16 PM
Buz Killer (03-31-2001 09:33):
Hi,

When I run makekey.exe I get the following
message :
"lc_init failed. FLEXLM key data has expired
flexlm error: -50,51"

What's wrong ?

regards,
Buzkiller(buzkiller@mail.ru)

Well, my guess would be that the FLEXLM key
data has expired.

The FLEXlm vendor keys contain an expiry date,
and if you're keys are too old (like some of the
demo keys that Globetrotter provides) FLEXlm won't
work after that date. Use lmkg or lmrecode to generate
non expiring keys, and all will be well.

--nb.
Buz Killer
04-01-2001, 03:34 PM
Hi Nolan,

I have created the updated keys with
lmkg6.exe (btw, thanks for such nice proggy)
Where do I put the seeds/keys and features
in Flexlm 6.1 ? Sorry for a "newbie"
question.

regards,
Buzkiller
(buzkiller@mail.ru)
tom
04-01-2001, 04:16 PM
...in lm_code.h

BTW, how about RTFM?

Tom
Buz Killer
04-01-2001, 06:18 PM
Hi,

RTFM is a great idea, but I don't have the manual, only 2 dirs :machind and
i86_n3. Where can I get any documentation on Flexlm ?

regards,
buzkiller
(buzkiller@mail.ru)
nblender
04-01-2001, 10:32 PM
The PDF files which are the FLEXlm documentation
set are in machind. Read them, for Globetrotter has
done a good job of documenting their program.
Although, of course, reading documetation would help,
here's a brief summary of what you need to do.

If you're using makekey (which is in many ways a very
limited program) you will have to put the keys in
the file lm_code.h. If you wish to use hte full program
keygen, lmcrypt, you will have to recompile the program with
the Microsoft Visual C++ compiler. I use version 6.

Edit lm_code.h in machind, and edit makefile
in i86_n3.
Use build.bat to build your executables (or nmake) and
you should be well on your way.
Buz Killer
04-04-2001, 01:26 PM
Hi Nolan,

I just installed full Flelxm 6.1 SDK.
Everything is working fine now.
Before this I didn't even have the manuals
in "machind" dir, because it was a RIP.

regards,
Buzkiller.


adding a msgbox to show the serial !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > adding a msgbox to show the serial !
PDA

View Full Version : adding a msgbox to show the serial !

__dUdU__
04-01-2001, 11:41 AM
lo

i've found like this

cmp ecx, [401339]

ecx = valid serial
401339 = entered one

after this cmp there's a jnz, i tried to when on the jnz line do (in sice)
'a'
push 0
push ecx ; to see my serial in the msgbox
push ecx
push 0
Call MessageBoxA
ret

but when i ran my prog i got a msgbox full of shit like 45srdfg2%@#$@#$@#$@ :(

can anyone help me doing this ?

thanks in advanced
DuDu
hz
04-01-2001, 12:53 PM
hiya,

two points here
1 the regcode you rare looking at will be
a hex value so you would need to either
insert a hex2ascii conversion proc or
maybe call wsprintf.
2 is the address the regcode the regcode
is at always the same, could have
been allocated memory and de-allocated
before it reaches the messagebox.

Kayaker has just written a tutorial using
a dll, using a dll would be perfect for
what you are trying to do and once
written could be used often in different
progs.

regards
buj
04-02-2001, 03:19 AM
push 0 or push 1 (ok and cancel buttons)
push title (i suggest a static address push 00403823 with the title string)
push text (push ecx)
push 0
call messageboxa

i don't suggest using the same register for both title and text..and make sure those registers actually point to the string. The reason why you're getting '$%^@!@#%' is because they point to some hex chars which are being converted to '@#$@#$#@$' in windows system font.
__dUdU__
04-02-2001, 08:03 AM
Ok i´ll try

what you mean with point to the string ?
i did ? ecx and got my serial in dec format is this what u mean buj ?

tnx guys


Vbox, PerlBuilder Tutorial by +Tsehp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Vbox, PerlBuilder Tutorial by +Tsehp
PDA

View Full Version : Vbox, PerlBuilder Tutorial by +Tsehp

SirLeechaLot
04-02-2001, 09:09 AM
hi,

i tried to work on that program but the adress werent the same so i think the tut belongs to the version a. I traced it the same way as tsehp described and came to a Call esi.
I think the oep is there because after pressing f10 i get into the program.
I dumped it and fixed the sections but the program crashes.
Did anyone try the b version and made a successfull unpacked exe?

thanx for any tips or help.

siRl
tsehp
04-02-2001, 07:17 PM
did you check the iat's ? are they valid ?
could you show (with a listing) where the program crashes and why ?
SirLeechaLot
04-03-2001, 10:31 AM
hy,

after reading some other tutorials I came to the conclusion to step into the call and look for a calculated value which is in eax and a ret.
loop it and dump it with procdump.
I will try that first.

btw. sorry for posting the link in "crc-check".

greetz

siRl

siRl
tsehp
04-03-2001, 07:34 PM
you can also use the /trace feature of icedump, much more easy
SirLeechaLot
04-04-2001, 08:22 AM
hy,

thanks for the reply.
do you know any good resources with tutorials about how to use the tracex command
to get to the oep and further processing with unpacking?
I just read the tut by predator and he mentions it shortly.
I would like a little more of explanation and a program to test it.

greetz

siRl


Patching neolite...??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Patching neolite...??
PDA

View Full Version : Patching neolite...??

SpeKKeL
04-03-2001, 05:04 AM
Well i want to patch a prog. packed with neolite.
I don't want to use a process(memory)-patcher but a simple piece of code witch i can add to the end of the unpacking routine.So i wrote this and jumped to it just before it reache the oep.But when i try to write something to a memory address it craches..??
something wrong with my code ??
push eax
push ebx
mov eax,00e9 < the byte to patch
mov [405392],eax <patch on address < and here it
craches ???
Any solutions ?? Thanks....SpeKKeL...
Predator_PC^pGC
04-03-2001, 05:25 AM
1, you can just put code like: mov dword ptr [400320], 0A

instead of moving 0A in eax ..(just an example)

2, neolite uses the VirtualProtectEx windows api to protect the memory from being overwritten by your code.. so, what you have to do is find the place in the file where it calls that api and jump right over it (there's a JNZ right in front of it if I'm not mistaken)... beware, there is more than 1 instance of VirtualProtectEx ;=)

should be enough info...
greets,
Predator [PC/pGC]
SpeKKeL
04-04-2001, 04:13 PM
Hi Predator,

Yep verry usefull info !!
I inserted my patch right after when the Bytes are written in memory(unpacked),So i didn't had any trouble
with the virtualprotect calls....(cause jumping over them gave a lot's of errors)

Greetz and Thanks again,
.........................SpeKKeL........


safedisc 2 need a complete game to finalize the revirgin's tests
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > safedisc 2 need a complete game to finalize the revirgin's tests
PDA

View Full Version : safedisc 2 need a complete game to finalize the revirgin's tests

tsehp
04-04-2001, 03:28 AM
hi,
actually revirgin (updated to safedisc 1 & 2) has fully succeeded on :
red alert 2 , nolf and f1rc (thanks artha), but I don't have all the game's files for the three cases and need to do a complete test before release.
So I need a good soul to upload all necessary files on a sd2 protected cd to do a complete test before I release latest revirgin version, mail me directly.

Tia

+Tsehp
risc
04-04-2001, 05:11 AM
requests for cracks, serials or warez will not be tolerated!

/me punishes tsehp
MT
04-04-2001, 07:00 AM
risc (04-04-2001 03:11):
requests for cracks, serials or warez will not be tolerated!

/me punishes tsehp

Haha, i luv you r!sc ;-P
MT.
tsehp
04-04-2001, 07:07 AM
gosh that's not working ! I failed !
Two weeks of work to improve revirgin, I was dreaming that people will send me tons of games cd's to crack them, and here's what I've got :-)
More seriously, if a guy owns safedisc 2 , he could announce this on the mb. (I didn't made a direct warez request...please...)
risc
04-04-2001, 08:24 AM
i got four originals at my last count . send me revirgin!
MackT
04-04-2001, 10:13 AM
risc (04-04-2001 06:24):
i got four originals at my last count . send me revirgin!

R!sc is right, it's better if you send us our new revirgin to test because we can't sent you our tons of cd's by e-mail... :-)

MT.
[yAtEs]
04-04-2001, 10:23 AM
oh oh, i've got 2 originals too ;d
[yAtEs]
04-04-2001, 10:28 AM
wtf, what is that strange face in my last post, i never typed that : ~
?ferret
04-04-2001, 01:37 PM
risc (04-04-2001 03:11):
requests for cracks, serials or warez will not be tolerated!

/me punishes tsehp

:D :D :D :D :D :D

classic....simply classic
tsehp
04-04-2001, 05:01 PM
[yAtEs] (04-04-2001 08:28):
wtf, what is that strange face in my last post, i never typed that : ~

the new ultraboard version is reading your mind ;-)
tsehp
04-04-2001, 05:05 PM
Ok, ok I'm giving up, I'll buy the games myself :-(

I just have to finish some code to auto-realign dumped target and include the it.bin at the end with a created section, update the pe accordingly and I'm done, just be patient for a few days.

regards,
[yAtEs]
04-05-2001, 05:15 AM
buying games just to crack is a serious business :P

so cos im friendly guy i would be glad to take them off ur hands when you have finished with them :P heh.
Kilby
04-05-2001, 05:46 AM
Much more fun to take them back to EB for a refund.
WlAda
04-05-2001, 10:03 AM
Hi,

is good to meake everything automat ? i love 1 iat.file,
then manually past to target. People can have in mind
that is reverser.

Sorry for too beers and bad english, wlada
tsehp
04-05-2001, 06:11 PM
Kilby (04-05-2001 03:46):
Much more fun to take them back to EB for a refund.

And even better, I'll directly test revirgin inside the man's store, just telling I want to try some games cd's before buying ;-)

btw MT will upload one, so guys you can stop trying to mail me some
150 megs packed files with all your cd's for me to test them all, I'll soon get my original game to test. Otherwise, I'll ask macrovision
to send me a list of their customers :-)


. THe ReVirgin PRoblem!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > . THe ReVirgin PRoblem!
PDA

View Full Version : . THe ReVirgin PRoblem!

NeO'X'QuiCk
04-04-2001, 04:14 PM
I have bin reading the The Blackbird tut about unpacking Iris!
I got to problem i cant find the ReVirgin!

How they can be found:

1. Run the program with a breakpoint on UpdateWindow (or another one), when SoftICE breaks, press F12 until you are back in Iris maincode. Then trace into every call you come across until you turn out to be in the jump table. A jump table looks like this:

Start partial code

015F:004469D8 JMP [004BAF4C]015F:004469DE JMP [004BAF50]015F:004469E4 JMP [004BAF54]015F:004469EA JMP [004BAF58]015F:004469F0 JMP [004BAF5C]015F:004469F6 JMP [004BAF60]015F:004469FC JMP [004BAF64]015F:00446A02 JMP [004BAF68]015F:00446A08 JMP [004BAF6C]015F:00446A0E JMP [004BAF70]015F:00446A14 JMP [004BAF74]015F:00446A1A JMP [004BAF78]015F:00446A20 JMP [004BAF7C]015F:00446A26 JMP [004BAF80]
End partial code

Now, scroll through the jump table and try to find the lowest jump offset (i.e. find the JMP xxxxxxxx where xxxxxxxx is the lowest value in the whole jumptable). Note that this jump table can be divided by a lot of other instructions, so you'll have to scroll to make sure you saw the whole jumptable.
Another method to find the lowest offset, is to take a random offset in the jumptable (like 4BAF80), type d 4BAF80 and scroll up in the datawindow until there's no more data, but only zeros.
In Iris, the beginning of the IAT is @ offset 4BA48C. Fill in BA48C in ReVirgin.

Could you help me where to fing it!

Thanks in advance!
NeO'X'QuiCk
tsehp
04-04-2001, 05:08 PM
hi,
you could have clicked search and typed revirgin, a lot of threads talks about this tool :-)

you can download the actual version at tsehp.cjb.net
risc
04-04-2001, 07:22 PM
dude . try scanning the code for references to the import table, and 'dd va' .. dd, displays them as they should be, its a lot easier trying to figure out the beginning and the end when u see it all as dwords.

and if all else fails, 'map32 process_name' . and dd the rdata VA or the idata VA .. and use alt-pageup / alt-pagedown to search

if that fails too . let someone else unpack it :-)
Kilby
04-05-2001, 03:43 AM
I think that you should possibly choose another (easier) target first.

r!scs tut on Settlers 3 is the best I have seen regarding the IAT it's length and position.

You don't need Settlers 3 to follow the theory, just patiance.

It took me about 3 weeks of reading and taking packers apart to get my head around what goes on in the tables, but then I'm a bit thick at the best of times.

The safedisc section in the crackers notes, also contains useful information.

There is some mention of finding the base of the table in my copylok tut too, that may help.

Regards,

Kilby...
SirLeechaLot
04-05-2001, 04:13 AM
Hi :)

please post the link to r!scs homepage cause
csir.cjb.net doesnt seem to work :(
and I´m really interested in his fine unpacking tuts.

greetZ

siRl
[yAtEs]
04-05-2001, 05:10 AM
you can get his packin tuts here
http://www.yates2k.co.uk/Pack.htm

or the settlers 3 one from here
http://www.yates2k.co.uk/cd/set3.zip

hrm change ur link back risc ;)
NeO'X'QuiCk
04-05-2001, 11:33 AM
Hello!

There was something wrong with my posting i didnt need reg.. i have it the problem that i could find the same . IAT Start RVA and lenght!
i got totally diferent numbers!

Aba4ac for start and lenght 132c.But as i was doing this the whole night trying to find 4BA48C. .The length in our case is 1308.But if i use my number i got lenght of ita 194 like Bla.. did!

so i did it with my number everthing was ok Except that i didnt get the whole import tables

Here:i got this
iris.exe
0194
index IAT_address value hint module function
--- -------- -------- ---- -------- --------
0 000BA4AC BFE82149 0025 ADVAPI32.dll ControlService
1 000BA4B0 BFE81534 00F7 ADVAPI32.dll RegQueryValueExA
2 000BA4B4 BFE814D1 00EF ADVAPI32.dll RegOpenKeyExA
3 000BA4B8 BFE8219A 0004 ADVAPI32.dll AccessCheckAndAuditAlarmA
4 000BA4BC BFE8216D 0008 ADVAPI32.dll AddAce
5 000BA4C0 BFE82149 0025 ADVAPI32.dll ControlService
6 000BA4C4 BFE82125 0001 ADVAPI32.dll AbortSystemShutdownA
7 000BA4C8 BFE82149 0025 ADVAPI32.dll ControlService
8 000BA4CC BFE82149 0025 ADVAPI32.dll ControlService
9 000BA4D0 BFE81644 00D8 ADVAPI32.dll RegCloseKey
10 000BA4D4 BFE8182B 00E4 ADVAPI32.dll RegEnumKeyExA
11 000BA4D8 BFE82065 00D9 ADVAPI32.dll RegConnectRegistryA
12 000BA4DC BFE81A07 00F6 ADVAPI32.dll RegQueryValueA
13 000BA4E0 BFE81376 00E1 ADVAPI32.dll RegDeleteValueA
14 000BA4E4 BFE8215B 0006 ADVAPI32.dll AddAccessAllowedAce
15 000BA4E8 BFE82125 0001 ADVAPI32.dll AbortSystemShutdownA
16 000BA4EC BFE8167D 00DC ADVAPI32.dll RegCreateKeyExA
17 000BA4F0 BFE815EA 0103 ADVAPI32.dll RegSetValueExA
18 000BA4F4 BFE82137 000E ADVAPI32.dll AreAllAccessesGranted
19 000BA4F8 BFE82125 0001 ADVAPI32.dll AbortSystemShutdownA
20 000BA4FC BFE8172A 00DB ADVAPI32.dll RegCreateKeyA
21 000BA504 BFE99F39 003A COMCTL32.dll ImageList_GetIcon
22 000BA508 BFECD896 002B COMCTL32.dll ImageList_BeginDrag
23 000BA50C BFECDA10 0032 COMCTL32.dll ImageList_DragShowNolock
24 000BA510 BFECD5F5 0031 COMCTL32.dll ImageList_DragMove
25 000BA514 BFECDD47 0037 COMCTL32.dll ImageList_EndDrag
26 000BA518 BFECD9C9 0030 COMCTL32.dll ImageList_DragLeave
27 000BA51C BFECD96F 002F COMCTL32.dll ImageList_DragEnter
28 000BA520 BFEB3662 0051 COMCTL32.dll ImageList_SetOverlayImage
29 000BA524 BFEB1DB4 002A COMCTL32.dll ImageList_AddMasked
30 000BA528 BFEB1BF4 0046 COMCTL32.dll ImageList_ReplaceIcon
31 000BA52C BFEB1D11 004B COMCTL32.dll ImageList_SetBkColor
32 000BA534 BFF223C3 00AA GDI32.dll CreateSolidBrush
33 000BA538 BFF2513C 0179 GDI32.dll SetBkColor
34 000BA53C BFF2148D 011A GDI32.dll GetObjectA
35 000BA540 BFF22842 00B0 GDI32.dll DeleteObject
36 000BA544 BFF21557 00C7 GDI32.dll Escape
37 000BA548 BFF2254C 01AC GDI32.dll TextOutA
38 000BA54C BFF250B4 0165 GDI32.dll RectVisible
39 000BA550 BFF22727 0162 GDI32.dll PtVisible
40 000BA554 BFF2507B 00A5 GDI32.dll CreateRectRgn
41 000BA558 BFF21A27 015E GDI32.dll Polygon
42 000BA55C BFF216EF 00FA GDI32.dll GetDeviceCaps
43 000BA560 BFF21481 013A GDI32.dll GetTextMetricsA
44 000BA564 BFF22621 0095 GDI32.dll CreateFontA
45 000BA568 BFF25135 019C GDI32.dll SetTextColor
46 000BA56C BFF21CB8 00CE GDI32.dll ExtTextOutA
47 000BA570 BFF223A2 00A1 GDI32.dll CreatePen
48 000BA574 BFF2267F 0096 GDI32.dll CreateFontIndirectA
49 000BA578 BFF21EDC 0134 GDI32.dll GetTextExtentPoint32A
50 000BA57C BFF22293 0072 GDI32.dll BitBlt
51 000BA580 BFF22D2D 0088 GDI32.dll CreateCompatibleBitmap
52 000BA584 BFF224D8 0089 GDI32.dll CreateCompatibleDC
53 000BA588 BFF22757 0166 GDI32.dll Rectangle
54 000BA590 BFF76DA8 01A3 KERNEL32.dll GetProcAddress
55 000BA594 BFF7B9B2 0228 KERNEL32.dll LeaveCriticalSection
56 000BA598 BFF777AD 01B9 KERNEL32.dll GetStartupInfoA
57 000BA59C BFF77716 018D KERNEL32.dll GetModuleHandleA
58 000BA5A0 BFF95A88 015C KERNEL32.dll GetCurrentThread
59 000BA5A4 BFF96347 015A KERNEL32.dll GetCurrentProcess
60 000BA5A8 BFF77A0F 0164 KERNEL32.dll GetDiskFreeSpaceA
61 000BA5AC BFF779D5 0158 KERNEL32.dll GetCurrentDirectoryA
62 000BA5B0 BFF779AE 02C1 KERNEL32.dll SetCurrentDirectoryA
63 000BA5B4 BFF8F4FC 02EB KERNEL32.dll SetThreadPriority
64 000BA5B8 BFFA1A1C 00AD KERNEL32.dll CopyFileA
65 000BA5BC BFF74361 020D KERNEL32.dll InterlockedDecrement
66 000BA5C0 BFF7B98D 00E1 KERNEL32.dll EnterCriticalSection
67 000BA5C4 BFF748B4 01E6 KERNEL32.dll GlobalAlloc
68 000BA5C8 BFF76DD7 01F1 KERNEL32.dll GlobalLock
69 000BA5CC BFF76E1B 01F7 KERNEL32.dll GlobalUnlock
70 000BA5D0 BFF7736F 0350 KERNEL32.dll lstrcat
71 000BA5D4 BFF77741 00C6 KERNEL32.dll CreateProcessA
72 000BA5D8 BFF88B8D 02F7 KERNEL32.dll SleepEx
73 000BA5DC BFF77978 01E1 KERNEL32.dll GetWindowsDirectoryA
74 000BA5E0 BFF77B30 0172 KERNEL32.dll GetFileAttributesA
75 000BA5E4 BFF77A90 017A KERNEL32.dll GetFullPathNameA
76 000BA5E8 BFF77844 019F KERNEL32.dll GetPrivateProfileStringA
77 000BA5EC BFF776F7 018B KERNEL32.dll GetModuleFileNameA
78 000BA5F0 BFF8516B 0181 KERNEL32.dll GetLastError
79 000BA5F4 BFF773A9 035F KERNEL32.dll lstrlen
80 000BA5F8 BFF8BCA7 012D KERNEL32.dll FormatMessageA
81 000BA5FC BFF8E0CD 0133 KERNEL32.dll FreeLibrary
82 000BA600 BFF748B4 01E6 KERNEL32.dll GlobalAlloc
83 000BA604 BFF77D81 0252 KERNEL32.dll MultiByteToWideChar
84 000BA608 BFF749D0 0235 KERNEL32.dll LocalFree
85 000BA60C BFF77332 035C KERNEL32.dll lstrcpyn
86 000BA610 BFFA142F 0262 KERNEL32.dll OutputDebugStringA
87 000BA614 BFF768A0 00D2 KERNEL32.dll DebugBreak
88 000BA618 BFF772F8 0359 KERNEL32.dll lstrcpy
89 000BA61C BFF77EB9 0111 KERNEL32.dll FileTimeToLocalFileTime
90 000BA620 BFF77F11 0112 KERNEL32.dll FileTimeToSystemTime
91 000BA624 BFF95A8E 02FE KERNEL32.dll TerminateThread
92 000BA628 BFF77F3D 00B2 KERNEL32.dll CreateDirectoryA
93 000BA62C BFFA0D34 01C8 KERNEL32.dll GetSystemTimeAsFileTime
94 000BA630 BFF8ABFA 00D6 KERNEL32.dll DeleteCriticalSection
95 000BA634 BFF842B1 020A KERNEL32.dll InitializeCriticalSection
96 000BA638 BFF76F66 00CD KERNEL32.dll CreateThread
97 000BA63C BFF813EC 015D KERNEL32.dll GetCurrentThreadId
98 000BA640 BFF92D08 02F6 KERNEL32.dll Sleep
99 000BA644 BFF7C8BD 0327 KERNEL32.dll WaitForSingleObject
100 000BA648 BFF7E06D 00A0 KERNEL32.dll CloseHandle
101 000BA64C BFF92CAF 0328 KERNEL32.dll WaitForSingleObjectEx
102 000BA650 BFF92BFF 028B KERNEL32.dll ResetEvent
103 000BA654 BFF92B8F 02CA KERNEL32.dll SetEvent
104 000BA658 BFF77590 00B6 KERNEL32.dll CreateEventA
105 000BA65C BFF776D0 0229 KERNEL32.dll LoadLibraryA
106 000BA664 6C3908A4 19FA MFC42.DLL
107 000BA668 6C375438 0D4B MFC42.DLL
108 000BA66C 6C3DB52A 10CF MFC42.DLL
109 000BA670 6C3753AE 0D16 MFC42.DLL
110 000BA674 6C3C45B1 188B MFC42.DLL
111 000BA678 6C380CCA 0441 MFC42.DLL
112 000BA67C 6C3C3B76 035B MFC42.DLL
113 000BA680 6C3814F8 1663 MFC42.DLL
114 000BA684 6C379C2B 09D0 MFC42.DLL
115 000BA688 6C3751E8 09FA MFC42.DLL

426 000BAB64 6C375C3C 0305 MFC42.DLL
427 000BAB68 6C3E7630 0E76 MFC42.DLL
428 000BAB6C 6C375836 01F5 MFC42.DLL
429 000BAB70 6C37FF44 0451 MFC42.DLL
430 000BAB74 6C373F15 039A MFC42.DLL
431 000BAB78 6C3DA477 047C MFC42.DLL
432 000BAB7C 6C37413F 03AD MFC42.DLL
433 000BAB80 6C3713B3 0D12 MFC42.DLL
434 000BAB84 6C3E014D 16D9 MFC42.DLL
435 000BAB88 6C37C181 0474 MFC42.DLL
436 000BAB8C 6C37BB36 0DC2 MFC42.DLL
437 000BAB90 6C387EBD 1903 MFC42.DLL
438 000BAB94 6C37A07D 03AB MFC42.DLL
439 000BAB98 6C381800 0B02 MFC42.DLL
440 000BAB9C 6C373EB0 0217 MFC42.DLL
441 000BABA0 6C3710F8 0497 MFC42.DLL
442 000BABA4 6C3C4132 1021 MFC42.DLL
443 000BABA8 6C382060 0ACB MFC42.DLL
444 000BABAC 6C374086 1040 MFC42.DLL
445 000BABB0 6C3FE9C2 1206 MFC42.DLL
446 000BABB4 6C3848DC 1205 MFC42.DLL
447 000BABB8 6C417CB0 0739 MFC42.DLL
448 000BABBC 6C417D10 1094 MFC42.DLL
449 000BABC0 6C374F28 096B MFC42.DLL
450 000BABC4 6C3D1AE3 11ED MFC42.DLL
451 000BABC8 6C3D194D 1323 MFC42.DLL
452 000BABCC 6C374B76 10F5 MFC42.DLL
453 000BABD0 6C374671 10FD MFC42.DLL
454 000BABD4 6C383719 131A MFC42.DLL
455 000BABD8 6C3D19D7 11B3 MFC42.DLL
456 000BABDC 6C3D19E4 11C1 MFC42.DLL
457 000BABE0 6C3D19DF 11AC MFC42.DLL
458 000BABE4 6C373FFF 095F MFC42.DLL
459 000BABE8 6C3D19DF 11AC MFC42.DLL
460 000BABEC 6C3D19DF 11AC MFC42.DLL
461 000BABF0 6C3D19D2 1361 MFC42.DLL
462 000BABF4 6C3D19D2 1361 MFC42.DLL
463 000BABF8 6C3D195C 100C MFC42.DLL
464 000BABFC 6C3E2711 1133 MFC42.DLL
465 000BAC00 6C38853D 1478 MFC42.DLL
466 000BAC04 6C3735BD 0EA4 MFC42.DLL

796 000BB12C 6C3CBD7C 18A7 MFC42.DLL
797 000BB130 6C3CBD6A 104B MFC42.DLL
798 000BB134 6C37D22B 0F21 MFC42.DLL
799 000BB138 6C3C3B8B 039B MFC42.DLL
800 000BB13C 6C38317F 17F1 MFC42.DLL
801 000BB140 6C38206E 1A06 MFC42.DLL
802 000BB144 6C3CAA2F 15CF MFC42.DLL
803 000BB148 6C3C90BD 1AE3 MFC42.DLL
804 000BB14C 6C3E7E78 0E72 MFC42.DLL
805 000BB150 6C373676 0EAA MFC42.DLL
806 000BB154 6C3D74CB 08F4 MFC42.DLL
807 000BB158 6C37EA89 0146 MFC42.DLL
808 000BB160 78003417 01B7 MSVCRT.dll _setmbcp
809 000BB164 7800AE78 004C MSVCRT.dll __CxxFrameHandler
810 000BB168 7800231A 02D6 MSVCRT.dll strncpy
811 000BB16C 780253CA 02C7 MSVCRT.dll sprintf
812 000BB170 780030B5 02AD MSVCRT.dll memmove
813 000BB174 78023383 01BB MSVCRT.dll _snprintf
814 000BB178 7802541C 02CA MSVCRT.dll sscanf
815 000BB17C 7800BDD3 00A8 MSVCRT.dll _beginthread
816 000BB180 7800C7D0 0252 MSVCRT.dll atoi
817 000BB184 7800BEDD 00C8 MSVCRT.dll _endthread
818 000BB188 7802A38B 025B MSVCRT.dll ctime
819 000BB18C 7802A875 02E5 MSVCRT.dll time
820 000BB190 780010ED 0273 MSVCRT.dll free
821 000BB194 78001BF1 00F9 MSVCRT.dll _ftol
822 000BB198 78001E18 0255 MSVCRT.dll calloc
823 000BB19C 78001000 02A6 MSVCRT.dll malloc
824 000BB1A0 7800ADBB 0044 MSVCRT.dll _CxxThrowException
825 000BB1A4 78029239 00F7 MSVCRT.dll _ftime
826 000BB1A8 78012D7C 01D3 MSVCRT.dll _strnicmp
827 000BB1AC 780029BF 02DA MSVCRT.dll strstr
828 000BB1B0 7802ED3A 0256 MSVCRT.dll ceil
829 000BB1B4 78028CEE 02DC MSVCRT.dll strtok
830 000BB1B8 780127CE 02CC MSVCRT.dll strchr
831 000BB1BC 78019F7E 01C0 MSVCRT.dll _spawnlp
832 000BB1C0 780205B7 01C6 MSVCRT.dll _splitpath
833 000BB1C4 780012EF 02FB MSVCRT.dll wcslen
834 000BB1C8 78003023 02A8 MSVCRT.dll mbstowcs
835 000BB1CC 7802109C 02B9 MSVCRT.dll qsort
836 000BB1D0 78012D00 02D0 MSVCRT.dll strcspn
837 000BB1D4 78016F5D 00E3 MSVCRT.dll _findclose
838 000BB1D8 78016E95 00E7 MSVCRT.dll _findnext
839 000BB1DC 78016DC5 00E4 MSVCRT.dll _findfirst
840 000BB1E0 78017A09 00AF MSVCRT.dll _chdir
841 000BB1E4 78012188 0261 MSVCRT.dll fclose
842 000BB1E8 78024336 0267 MSVCRT.dll fgets
843 000BB1EC 78022AA9 026C MSVCRT.dll fopen
844 000BB1F0 7800F56A 00CE MSVCRT.dll _except_handler3
845 000BB1F4 7800B20C 000E MSVCRT.dll ??1type_info@@UAE@XZ
846 000BB1F8 78002131 0058 MSVCRT.dll __dllonexit
847 000BB1FC 78004446 0192 MSVCRT.dll _onexit
848 000BB200 7800AC3F 0030 MSVCRT.dll ?terminate@@YAXXZ
849 000BB204 7800B908 00D7 MSVCRT.dll _exit
850 000BB208 7800F7DC 004B MSVCRT.dll _XcptFilter
851 000BB20C 7800269E 025E MSVCRT.dll exit
852 000BB210 7803B508 0092 MSVCRT.dll _acmdln
853 000BB214 78003E70 005B MSVCRT.dll __getmainargs
854 000BB218 78001DEA 0119 MSVCRT.dll _initterm
855 000BB21C 7800B426 0086 MSVCRT.dll __setusermatherr
856 000BB220 7803BB70 00A0 MSVCRT.dll _adjust_fdiv
857 000BB224 78003E6A 006D MSVCRT.dll __p__commode
858 000BB228 78003E64 0072 MSVCRT.dll __p__fmode
859 000BB22C 78003E5A 0084 MSVCRT.dll __set_app_type
860 000BB230 78003C1E 00BA MSVCRT.dll _controlfp
861 000BB234 7801419F 01E8 MSVCRT.dll _ultoa
862 000BB238 78004A69 013E MSVCRT.dll _itoa
863 000BB240 7FE990C2 00C8 OLEAUT32.dll GetErrorInfo
864 000BB244 7FE8227E 0009 OLEAUT32.dll VariantClear
865 000BB248 7FE81523 0006 OLEAUT32.dll SysFreeString
866 000BB24C 7FE81408 0002 OLEAUT32.dll SysAllocString
867 000BB254 7FCB734A 011D SHELL32.dll SHGetMalloc
868 000BB258 7FD07109 0109 SHELL32.dll SHBrowseForFolder
869 000BB25C 7FCB3BC4 011F SHELL32.dll SHGetPathFromIDList
870 000BB260 7FD18BE2 0148 SHELL32.dll Shell_NotifyIcon
871 000BB264 7FD16AFF 0142 SHELL32.dll ShellExecuteA
872 000BB26C BFF52471 012F USER32.dll GetParent
873 000BB270 BFF54C52 013C USER32.dll GetSysColor
874 000BB274 BFF559A1 008B USER32.dll DestroyCursor
875 000BB278 BFF51319 019B USER32.dll LoadMenuA
876 000BB27C BFF5308E 022F USER32.dll SetTimer
877 000BB280 BFF55836 01F7 USER32.dll SendMessageA
878 000BB284 BFF52DA4 011C USER32.dll GetMenuItemID
879 000BB288 BFF55413 0047 USER32.dll CopyRect
880 000BB28C BFF55102 0184 USER32.dll IsIconic
881 000BB290 BFF5249D 00F7 USER32.dll GetDC
882 000BB294 BFF52090 01E8 USER32.dll ReleaseDC
883 000BB298 BFF551F5 0102 USER32.dll GetForegroundWindow
884 000BB29C BFF555A7 014E USER32.dll GetWindowLongA
885 000BB2A0 BFF524BB 0212 USER32.dll SetForegroundWindow
886 000BB2A4 BFF520A4 00B5 USER32.dll EnableWindow
887 000BB2A8 BFF54FC5 00EB USER32.dll GetClientRect
888 000BB2AC BFF524DB 01A2 USER32.dll LockWindowUpdate
889 000BB2B0 BFF54F53 0153 USER32.dll GetWindowRect
890 000BB2B4 BFF52170 0172 USER32.dll InvalidateRect
891 000BB2B8 BFF55828 01F2 USER32.dll SendDlgItemMessageA
892 000BB2BC BFF52489 01FF USER32.dll SetActiveWindow
893 000BB2C0 BFF559F9 0195 USER32.dll LoadIconA
894 000BB2C4 BFF54EA5 0187 USER32.dll IsWindow
895 000BB2C8 BFF5156B 0239 USER32.dll SetWindowPos
896 000BB2CC BFF52130 00A4 USER32.dll DrawFocusRect
897 000BB2D0 BFF5141E 0266 USER32.dll UnregisterClassA
898 000BB2D4 BFF55BCD 0085 USER32.dll DefWindowProcA
899 000BB2D8 BFF52475 0113 USER32.dll GetLastActivePopup
900 000BB2DC BFF55918 00D3 USER32.dll FindWindowA
901 000BB2E0 BFF52DC6 0037 USER32.dll CheckMenuItem
902 000BB2E4 BFF5300E 015B USER32.dll GrayStringA
903 000BB2E8 BFF528DC 024F USER32.dll TabbedTextOutA
904 000BB2EC BFF527BB 01AA USER32.dll MapWindowPoints
905 000BB2F0 BFF553D4 0225 USER32.dll SetRect
906 000BB2F4 BFF51B3F 014A USER32.dll GetWindow
907 000BB2F8 BFF51F4A 003B USER32.dll ChildWindowFromPointEx
908 000BB2FC BFF5558C 019F USER32.dll LoadStringA
909 000BB300 BFF52485 0211 USER32.dll SetFocus
910 000BB304 BFF52176 00D2 USER32.dll FillRect
911 000BB308 BFF5548F 01C2 USER32.dll OffsetRect
912 000BB30C BFF55923 003A USER32.dll ChildWindowFromPoint
913 000BB310 BFF524D7 000E USER32.dll BringWindowToTop
914 000BB314 BFF54460 0007 USER32.dll AppendMenuA
915 000BB318 BFF520A8 017D USER32.dll IsChild
916 000BB31C BFF54706 0016 USER32.dll CallNextHookEx
917 000BB320 BFF53451 0261 USER32.dll UnhookWindowsHookEx
918 000BB324 BFF511D9 023F USER32.dll SetWindowsHookExA
919 000BB328 BFF524FB 011B USER32.dll GetMenuItemCount
920 000BB32C BFF551B1 00F9 USER32.dll GetDesktopWindow
921 000BB330 BFF55A6D 00A7 USER32.dll DrawIcon
922 000BB334 BFF54F36 00FB USER32.dll GetDlgCtrlID
923 000BB338 BFF55127 018B USER32.dll IsZoomed
924 000BB33C BFF55591 0285 USER32.dll wsprintfA
925 000BB340 BFF51BAD 018C USER32.dll KillTimer
926 000BB344 BFF54D54 0100 USER32.dll GetDoubleClickTime
927 000BB348 BFF512DE 0197 USER32.dll LoadImageA
928 000BB34C BFF55A38 018F USER32.dll LoadBitmapA
929 000BB350 BFF51670 00D4 USER32.dll FindWindowExA
930 000BB354 BFF52098 0246 USER32.dll ShowWindow
931 000BB358 BFF549C9 002A USER32.dll CharPrevA
932 000BB35C BFF5493E 0026 USER32.dll CharNextA
933 000BB360 BFF55171 018A USER32.dll IsWindowVisible
934 000BB364 BFF524EF 00DE USER32.dll GetAsyncKeyState
935 000BB368 BFF51ADA 00A6 USER32.dll DrawFrameControl
936 000BB36C BFF5447F 00AD USER32.dll DrawTextA
937 000BB370 BFF5545D 01D4 USER32.dll PtInRect
938 000BB374 BFF524E7 026A USER32.dll UpdateWindow
939 000BB378 BFF5554E 00CF USER32.dll EqualRect
940 000BB37C BFF52DCE 00B3 USER32.dll EnableMenuItem
941 000BB380 BFF550BA 003D USER32.dll ClientToScreen
942 000BB384 BFF51F2C 0280 USER32.dll WindowFromPoint
943 000BB388 BFF55A0F 0191 USER32.dll LoadCursorA
944 000BB38C BFF52D8A 0208 USER32.dll SetCursor
945 000BB390 BFF55072 01EE USER32.dll ScreenToClient
946 000BB394 BFF5248D 0200 USER32.dll SetCapture
947 000BB398 BFF523CB 01D7 USER32.dll RedrawWindow
948 000BB39C BFF51EEE 00F6 USER32.dll GetCursorPos
949 000BB3A0 BFF51B37 013B USER32.dll GetSubMenu
950 000BB3A4 BFF55708 01CF USER32.dll PostMessageA
951 000BB3A8 BFF526FC 01E7 USER32.dll ReleaseCapture
952 000BB3AC BFF552F6 013F USER32.dll GetSystemMetrics
953 000BB3B0 BFF51269 024D USER32.dll SystemParametersInfoA
954 000BB3B4 BFF524EB 010C USER32.dll GetKeyState
955 000BB3B8 BFF5412E 01AD USER32.dll MessageBoxA
956 000BB3BC BFF558C0 0017 USER32.dll CallWindowProcA
957 000BB3C0 BFF5564D 0236 USER32.dll SetWindowLongA
958 000BB3C8 BFE71267 000C VERSION.dll VerQueryValueA
959 000BB3CC BFE7152F 0001 VERSION.dll GetFileVersionInfoA
960 000BB3D0 BFE71494 0002 VERSION.dll GetFileVersionInfoSizeA
961 000BB3D8 762986ED 00EC WININET.dll InternetGetConnectedState
962 000BB3DC 7629817D 0106 WININET.dll InternetSetCookieA
963 000BB3E4 BFDF8DB3 0002 WINMM.dll PlaySoundA
964 000BB3EC 75FA159B 000B WSOCK32.dll inet_ntoa
965 000BB3F0 75FA156A 000A WSOCK32.dll inet_addr
966 000BB3F4 75FA1635 000E WSOCK32.dll ntohl
967 000BB3F8 75FA1807 0034 WSOCK32.dll gethostbyname
968 000BB3FC 75FA1661 000F WSOCK32.dll ntohs
969 000BB400 75FA18EB 0039 WSOCK32.dll gethostname
970 000BB404 75FA17D3 0033 WSOCK32.dll gethostbyaddr
971 000BB408 75FA1539 0009 WSOCK32.dll htons
972 000BB410 100029C0 0009 ecap.dll W32N_MakeNdisRequest
973 000BB414 10003640 0004 ecap.dll W32N_GetAdapterRegistryInfo
974 000BB418 10002E60 0002 ecap.dll W32N_CloseAdapter
975 000BB41C 10002840 000C ecap.dll W32N_OpenAdapterA
976 000BB420 10001A20 0008 ecap.dll W32N_IsWindowsNT
977 000BB424 10001A60 0006 ecap.dll W32N_IsWindows2000
978 000BB428 10002EA0 0003 ecap.dll W32N_DisableLoopback
979 000BB42C 10001A80 0007 ecap.dll W32N_IsWindows95
980 000BB430 10002BF0 0001 ecap.dll W32N_CancelPacketRead
981 000BB434 10002AC0 0010 ecap.dll W32N_PacketReadEx
982 000BB438 10002D60 0012 ecap.dll W32N_PacketSendEx
983 000BB43C 100019E0 000B ecap.dll W32N_OSGetPlatformVersion
984 000BB440 100019C0 0005 ecap.dll W32N_GetLastError
985 000BB448 60013320 0509 egui.dll ?
NeO'X'QuiCk
04-05-2001, 11:34 AM
Hello!

There was something wrong with my posting i didnt need reg.. i have it the problem that i could find the same . IAT Start RVA and lenght!
i got totally diferent numbers!

Aba4ac for start and lenght 132c.But as i was doing this the whole night trying to find 4BA48C. .The length in our case is 1308.But if i use my number i got lenght of ita 194 like Bla.. did!

so i did it with my number everthing was ok Except that i didnt get the whole import tables

Here:i got this
iris.exe
0194
index IAT_address value hint module function
--- -------- -------- ---- -------- --------
0 000BA4AC BFE82149 0025 ADVAPI32.dll ControlService
1 000BA4B0 BFE81534 00F7 ADVAPI32.dll RegQueryValueExA
2 000BA4B4 BFE814D1 00EF ADVAPI32.dll RegOpenKeyExA
3 000BA4B8 BFE8219A 0004 ADVAPI32.dll AccessCheckAndAuditAlarmA
4 000BA4BC BFE8216D 0008 ADVAPI32.dll AddAce
5 000BA4C0 BFE82149 0025 ADVAPI32.dll ControlService
6 000BA4C4 BFE82125 0001 ADVAPI32.dll AbortSystemShutdownA
7 000BA4C8 BFE82149 0025 ADVAPI32.dll ControlService
8 000BA4CC BFE82149 0025 ADVAPI32.dll ControlService
9 000BA4D0 BFE81644 00D8 ADVAPI32.dll RegCloseKey
10 000BA4D4 BFE8182B 00E4 ADVAPI32.dll RegEnumKeyExA
11 000BA4D8 BFE82065 00D9 ADVAPI32.dll RegConnectRegistryA
12 000BA4DC BFE81A07 00F6 ADVAPI32.dll RegQueryValueA
13 000BA4E0 BFE81376 00E1 ADVAPI32.dll RegDeleteValueA
14 000BA4E4 BFE8215B 0006 ADVAPI32.dll AddAccessAllowedAce
15 000BA4E8 BFE82125 0001 ADVAPI32.dll AbortSystemShutdownA
16 000BA4EC BFE8167D 00DC ADVAPI32.dll RegCreateKeyExA
17 000BA4F0 BFE815EA 0103 ADVAPI32.dll RegSetValueExA
18 000BA4F4 BFE82137 000E ADVAPI32.dll AreAllAccessesGranted
19 000BA4F8 BFE82125 0001 ADVAPI32.dll AbortSystemShutdownA
20 000BA4FC BFE8172A 00DB ADVAPI32.dll RegCreateKeyA
21 000BA504 BFE99F39 003A COMCTL32.dll ImageList_GetIcon
22 000BA508 BFECD896 002B COMCTL32.dll ImageList_BeginDrag
23 000BA50C BFECDA10 0032 COMCTL32.dll ImageList_DragShowNolock
24 000BA510 BFECD5F5 0031 COMCTL32.dll ImageList_DragMove
25 000BA514 BFECDD47 0037 COMCTL32.dll ImageList_EndDrag
26 000BA518 BFECD9C9 0030 COMCTL32.dll ImageList_DragLeave
27 000BA51C BFECD96F 002F COMCTL32.dll ImageList_DragEnter
28 000BA520 BFEB3662 0051 COMCTL32.dll ImageList_SetOverlayImage
29 000BA524 BFEB1DB4 002A COMCTL32.dll ImageList_AddMasked
30 000BA528 BFEB1BF4 0046 COMCTL32.dll ImageList_ReplaceIcon
31 000BA52C BFEB1D11 004B COMCTL32.dll ImageList_SetBkColor
32 000BA534 BFF223C3 00AA GDI32.dll CreateSolidBrush
33 000BA538 BFF2513C 0179 GDI32.dll SetBkColor
34 000BA53C BFF2148D 011A GDI32.dll GetObjectA
35 000BA540 BFF22842 00B0 GDI32.dll DeleteObject
36 000BA544 BFF21557 00C7 GDI32.dll Escape
37 000BA548 BFF2254C 01AC GDI32.dll TextOutA
38 000BA54C BFF250B4 0165 GDI32.dll RectVisible
39 000BA550 BFF22727 0162 GDI32.dll PtVisible
40 000BA554 BFF2507B 00A5 GDI32.dll CreateRectRgn
41 000BA558 BFF21A27 015E GDI32.dll Polygon
42 000BA55C BFF216EF 00FA GDI32.dll GetDeviceCaps
43 000BA560 BFF21481 013A GDI32.dll GetTextMetricsA
44 000BA564 BFF22621 0095 GDI32.dll CreateFontA
45 000BA568 BFF25135 019C GDI32.dll SetTextColor
46 000BA56C BFF21CB8 00CE GDI32.dll ExtTextOutA
47 000BA570 BFF223A2 00A1 GDI32.dll CreatePen
48 000BA574 BFF2267F 0096 GDI32.dll CreateFontIndirectA
49 000BA578 BFF21EDC 0134 GDI32.dll GetTextExtentPoint32A
50 000BA57C BFF22293 0072 GDI32.dll BitBlt
51 000BA580 BFF22D2D 0088 GDI32.dll CreateCompatibleBitmap
52 000BA584 BFF224D8 0089 GDI32.dll CreateCompatibleDC
53 000BA588 BFF22757 0166 GDI32.dll Rectangle
54 000BA590 BFF76DA8 01A3 KERNEL32.dll GetProcAddress
55 000BA594 BFF7B9B2 0228 KERNEL32.dll LeaveCriticalSection
56 000BA598 BFF777AD 01B9 KERNEL32.dll GetStartupInfoA
57 000BA59C BFF77716 018D KERNEL32.dll GetModuleHandleA
58 000BA5A0 BFF95A88 015C KERNEL32.dll GetCurrentThread
59 000BA5A4 BFF96347 015A KERNEL32.dll GetCurrentProcess
60 000BA5A8 BFF77A0F 0164 KERNEL32.dll GetDiskFreeSpaceA
61 000BA5AC BFF779D5 0158 KERNEL32.dll GetCurrentDirectoryA
62 000BA5B0 BFF779AE 02C1 KERNEL32.dll SetCurrentDirectoryA
63 000BA5B4 BFF8F4FC 02EB KERNEL32.dll SetThreadPriority
64 000BA5B8 BFFA1A1C 00AD KERNEL32.dll CopyFileA
65 000BA5BC BFF74361 020D KERNEL32.dll InterlockedDecrement
66 000BA5C0 BFF7B98D 00E1 KERNEL32.dll EnterCriticalSection
67 000BA5C4 BFF748B4 01E6 KERNEL32.dll GlobalAlloc
68 000BA5C8 BFF76DD7 01F1 KERNEL32.dll GlobalLock
69 000BA5CC BFF76E1B 01F7 KERNEL32.dll GlobalUnlock
70 000BA5D0 BFF7736F 0350 KERNEL32.dll lstrcat
71 000BA5D4 BFF77741 00C6 KERNEL32.dll CreateProcessA
72 000BA5D8 BFF88B8D 02F7 KERNEL32.dll SleepEx
73 000BA5DC BFF77978 01E1 KERNEL32.dll GetWindowsDirectoryA
74 000BA5E0 BFF77B30 0172 KERNEL32.dll GetFileAttributesA
75 000BA5E4 BFF77A90 017A KERNEL32.dll GetFullPathNameA
76 000BA5E8 BFF77844 019F KERNEL32.dll GetPrivateProfileStringA
77 000BA5EC BFF776F7 018B KERNEL32.dll GetModuleFileNameA
78 000BA5F0 BFF8516B 0181 KERNEL32.dll GetLastError
79 000BA5F4 BFF773A9 035F KERNEL32.dll lstrlen
80 000BA5F8 BFF8BCA7 012D KERNEL32.dll FormatMessageA
81 000BA5FC BFF8E0CD 0133 KERNEL32.dll FreeLibrary
82 000BA600 BFF748B4 01E6 KERNEL32.dll GlobalAlloc
83 000BA604 BFF77D81 0252 KERNEL32.dll MultiByteToWideChar
84 000BA608 BFF749D0 0235 KERNEL32.dll LocalFree
85 000BA60C BFF77332 035C KERNEL32.dll lstrcpyn
86 000BA610 BFFA142F 0262 KERNEL32.dll OutputDebugStringA
87 000BA614 BFF768A0 00D2 KERNEL32.dll DebugBreak
88 000BA618 BFF772F8 0359 KERNEL32.dll lstrcpy
89 000BA61C BFF77EB9 0111 KERNEL32.dll FileTimeToLocalFileTime
90 000BA620 BFF77F11 0112 KERNEL32.dll FileTimeToSystemTime
91 000BA624 BFF95A8E 02FE KERNEL32.dll TerminateThread
92 000BA628 BFF77F3D 00B2 KERNEL32.dll CreateDirectoryA
93 000BA62C BFFA0D34 01C8 KERNEL32.dll GetSystemTimeAsFileTime
94 000BA630 BFF8ABFA 00D6 KERNEL32.dll DeleteCriticalSection
95 000BA634 BFF842B1 020A KERNEL32.dll InitializeCriticalSection
96 000BA638 BFF76F66 00CD KERNEL32.dll CreateThread
97 000BA63C BFF813EC 015D KERNEL32.dll GetCurrentThreadId
98 000BA640 BFF92D08 02F6 KERNEL32.dll Sleep
99 000BA644 BFF7C8BD 0327 KERNEL32.dll WaitForSingleObject
100 000BA648 BFF7E06D 00A0 KERNEL32.dll CloseHandle
101 000BA64C BFF92CAF 0328 KERNEL32.dll WaitForSingleObjectEx
102 000BA650 BFF92BFF 028B KERNEL32.dll ResetEvent
103 000BA654 BFF92B8F 02CA KERNEL32.dll SetEvent
104 000BA658 BFF77590 00B6 KERNEL32.dll CreateEventA
105 000BA65C BFF776D0 0229 KERNEL32.dll LoadLibraryA
106 000BA664 6C3908A4 19FA MFC42.DLL
107 000BA668 6C375438 0D4B MFC42.DLL
108 000BA66C 6C3DB52A 10CF MFC42.DLL
109 000BA670 6C3753AE 0D16 MFC42.DLL
110 000BA674 6C3C45B1 188B MFC42.DLL
111 000BA678 6C380CCA 0441 MFC42.DLL
112 000BA67C 6C3C3B76 035B MFC42.DLL
113 000BA680 6C3814F8 1663 MFC42.DLL
114 000BA684 6C379C2B 09D0 MFC42.DLL
115 000BA688 6C3751E8 09FA MFC42.DLL

426 000BAB64 6C375C3C 0305 MFC42.DLL
427 000BAB68 6C3E7630 0E76 MFC42.DLL
428 000BAB6C 6C375836 01F5 MFC42.DLL
429 000BAB70 6C37FF44 0451 MFC42.DLL
430 000BAB74 6C373F15 039A MFC42.DLL
431 000BAB78 6C3DA477 047C MFC42.DLL
432 000BAB7C 6C37413F 03AD MFC42.DLL
433 000BAB80 6C3713B3 0D12 MFC42.DLL
434 000BAB84 6C3E014D 16D9 MFC42.DLL
435 000BAB88 6C37C181 0474 MFC42.DLL
436 000BAB8C 6C37BB36 0DC2 MFC42.DLL
437 000BAB90 6C387EBD 1903 MFC42.DLL
438 000BAB94 6C37A07D 03AB MFC42.DLL
439 000BAB98 6C381800 0B02 MFC42.DLL
440 000BAB9C 6C373EB0 0217 MFC42.DLL
441 000BABA0 6C3710F8 0497 MFC42.DLL
442 000BABA4 6C3C4132 1021 MFC42.DLL
443 000BABA8 6C382060 0ACB MFC42.DLL
444 000BABAC 6C374086 1040 MFC42.DLL
445 000BABB0 6C3FE9C2 1206 MFC42.DLL
446 000BABB4 6C3848DC 1205 MFC42.DLL
447 000BABB8 6C417CB0 0739 MFC42.DLL
448 000BABBC 6C417D10 1094 MFC42.DLL
449 000BABC0 6C374F28 096B MFC42.DLL
450 000BABC4 6C3D1AE3 11ED MFC42.DLL
451 000BABC8 6C3D194D 1323 MFC42.DLL
452 000BABCC 6C374B76 10F5 MFC42.DLL
453 000BABD0 6C374671 10FD MFC42.DLL
454 000BABD4 6C383719 131A MFC42.DLL
455 000BABD8 6C3D19D7 11B3 MFC42.DLL
456 000BABDC 6C3D19E4 11C1 MFC42.DLL
457 000BABE0 6C3D19DF 11AC MFC42.DLL
458 000BABE4 6C373FFF 095F MFC42.DLL
459 000BABE8 6C3D19DF 11AC MFC42.DLL
460 000BABEC 6C3D19DF 11AC MFC42.DLL
461 000BABF0 6C3D19D2 1361 MFC42.DLL
462 000BABF4 6C3D19D2 1361 MFC42.DLL
463 000BABF8 6C3D195C 100C MFC42.DLL
464 000BABFC 6C3E2711 1133 MFC42.DLL
465 000BAC00 6C38853D 1478 MFC42.DLL
466 000BAC04 6C3735BD 0EA4 MFC42.DLL

796 000BB12C 6C3CBD7C 18A7 MFC42.DLL
797 000BB130 6C3CBD6A 104B MFC42.DLL
798 000BB134 6C37D22B 0F21 MFC42.DLL
799 000BB138 6C3C3B8B 039B MFC42.DLL
800 000BB13C 6C38317F 17F1 MFC42.DLL
801 000BB140 6C38206E 1A06 MFC42.DLL
802 000BB144 6C3CAA2F 15CF MFC42.DLL
803 000BB148 6C3C90BD 1AE3 MFC42.DLL
804 000BB14C 6C3E7E78 0E72 MFC42.DLL
805 000BB150 6C373676 0EAA MFC42.DLL
806 000BB154 6C3D74CB 08F4 MFC42.DLL
807 000BB158 6C37EA89 0146 MFC42.DLL
808 000BB160 78003417 01B7 MSVCRT.dll _setmbcp
809 000BB164 7800AE78 004C MSVCRT.dll __CxxFrameHandler
810 000BB168 7800231A 02D6 MSVCRT.dll strncpy
811 000BB16C 780253CA 02C7 MSVCRT.dll sprintf
812 000BB170 780030B5 02AD MSVCRT.dll memmove
813 000BB174 78023383 01BB MSVCRT.dll _snprintf
814 000BB178 7802541C 02CA MSVCRT.dll sscanf
815 000BB17C 7800BDD3 00A8 MSVCRT.dll _beginthread
816 000BB180 7800C7D0 0252 MSVCRT.dll atoi
817 000BB184 7800BEDD 00C8 MSVCRT.dll _endthread
818 000BB188 7802A38B 025B MSVCRT.dll ctime
819 000BB18C 7802A875 02E5 MSVCRT.dll time
820 000BB190 780010ED 0273 MSVCRT.dll free
821 000BB194 78001BF1 00F9 MSVCRT.dll _ftol
822 000BB198 78001E18 0255 MSVCRT.dll calloc
823 000BB19C 78001000 02A6 MSVCRT.dll malloc
824 000BB1A0 7800ADBB 0044 MSVCRT.dll _CxxThrowException
825 000BB1A4 78029239 00F7 MSVCRT.dll _ftime
826 000BB1A8 78012D7C 01D3 MSVCRT.dll _strnicmp
827 000BB1AC 780029BF 02DA MSVCRT.dll strstr
828 000BB1B0 7802ED3A 0256 MSVCRT.dll ceil
829 000BB1B4 78028CEE 02DC MSVCRT.dll strtok
830 000BB1B8 780127CE 02CC MSVCRT.dll strchr
831 000BB1BC 78019F7E 01C0 MSVCRT.dll _spawnlp
832 000BB1C0 780205B7 01C6 MSVCRT.dll _splitpath
833 000BB1C4 780012EF 02FB MSVCRT.dll wcslen
834 000BB1C8 78003023 02A8 MSVCRT.dll mbstowcs
835 000BB1CC 7802109C 02B9 MSVCRT.dll qsort
836 000BB1D0 78012D00 02D0 MSVCRT.dll strcspn
837 000BB1D4 78016F5D 00E3 MSVCRT.dll _findclose
838 000BB1D8 78016E95 00E7 MSVCRT.dll _findnext
839 000BB1DC 78016DC5 00E4 MSVCRT.dll _findfirst
840 000BB1E0 78017A09 00AF MSVCRT.dll _chdir
841 000BB1E4 78012188 0261 MSVCRT.dll fclose
842 000BB1E8 78024336 0267 MSVCRT.dll fgets
843 000BB1EC 78022AA9 026C MSVCRT.dll fopen
844 000BB1F0 7800F56A 00CE MSVCRT.dll _except_handler3
845 000BB1F4 7800B20C 000E MSVCRT.dll ??1type_info@@UAE@XZ
846 000BB1F8 78002131 0058 MSVCRT.dll __dllonexit
847 000BB1FC 78004446 0192 MSVCRT.dll _onexit
848 000BB200 7800AC3F 0030 MSVCRT.dll ?terminate@@YAXXZ
849 000BB204 7800B908 00D7 MSVCRT.dll _exit
850 000BB208 7800F7DC 004B MSVCRT.dll _XcptFilter
851 000BB20C 7800269E 025E MSVCRT.dll exit
852 000BB210 7803B508 0092 MSVCRT.dll _acmdln
853 000BB214 78003E70 005B MSVCRT.dll __getmainargs
854 000BB218 78001DEA 0119 MSVCRT.dll _initterm
855 000BB21C 7800B426 0086 MSVCRT.dll __setusermatherr
856 000BB220 7803BB70 00A0 MSVCRT.dll _adjust_fdiv
857 000BB224 78003E6A 006D MSVCRT.dll __p__commode
858 000BB228 78003E64 0072 MSVCRT.dll __p__fmode
859 000BB22C 78003E5A 0084 MSVCRT.dll __set_app_type
860 000BB230 78003C1E 00BA MSVCRT.dll _controlfp
861 000BB234 7801419F 01E8 MSVCRT.dll _ultoa
862 000BB238 78004A69 013E MSVCRT.dll _itoa
863 000BB240 7FE990C2 00C8 OLEAUT32.dll GetErrorInfo
864 000BB244 7FE8227E 0009 OLEAUT32.dll VariantClear
865 000BB248 7FE81523 0006 OLEAUT32.dll SysFreeString
866 000BB24C 7FE81408 0002 OLEAUT32.dll SysAllocString
867 000BB254 7FCB734A 011D SHELL32.dll SHGetMalloc
868 000BB258 7FD07109 0109 SHELL32.dll SHBrowseForFolder
869 000BB25C 7FCB3BC4 011F SHELL32.dll SHGetPathFromIDList
870 000BB260 7FD18BE2 0148 SHELL32.dll Shell_NotifyIcon
871 000BB264 7FD16AFF 0142 SHELL32.dll ShellExecuteA
872 000BB26C BFF52471 012F USER32.dll GetParent
873 000BB270 BFF54C52 013C USER32.dll GetSysColor
874 000BB274 BFF559A1 008B USER32.dll DestroyCursor
875 000BB278 BFF51319 019B USER32.dll LoadMenuA
876 000BB27C BFF5308E 022F USER32.dll SetTimer
877 000BB280 BFF55836 01F7 USER32.dll SendMessageA
878 000BB284 BFF52DA4 011C USER32.dll GetMenuItemID
879 000BB288 BFF55413 0047 USER32.dll CopyRect
880 000BB28C BFF55102 0184 USER32.dll IsIconic
881 000BB290 BFF5249D 00F7 USER32.dll GetDC
882 000BB294 BFF52090 01E8 USER32.dll ReleaseDC
883 000BB298 BFF551F5 0102 USER32.dll GetForegroundWindow
884 000BB29C BFF555A7 014E USER32.dll GetWindowLongA
885 000BB2A0 BFF524BB 0212 USER32.dll SetForegroundWindow
886 000BB2A4 BFF520A4 00B5 USER32.dll EnableWindow
887 000BB2A8 BFF54FC5 00EB USER32.dll GetClientRect
888 000BB2AC BFF524DB 01A2 USER32.dll LockWindowUpdate
889 000BB2B0 BFF54F53 0153 USER32.dll GetWindowRect
890 000BB2B4 BFF52170 0172 USER32.dll InvalidateRect
891 000BB2B8 BFF55828 01F2 USER32.dll SendDlgItemMessageA
892 000BB2BC BFF52489 01FF USER32.dll SetActiveWindow
893 000BB2C0 BFF559F9 0195 USER32.dll LoadIconA
894 000BB2C4 BFF54EA5 0187 USER32.dll IsWindow
895 000BB2C8 BFF5156B 0239 USER32.dll SetWindowPos
896 000BB2CC BFF52130 00A4 USER32.dll DrawFocusRect
897 000BB2D0 BFF5141E 0266 USER32.dll UnregisterClassA
898 000BB2D4 BFF55BCD 0085 USER32.dll DefWindowProcA
899 000BB2D8 BFF52475 0113 USER32.dll GetLastActivePopup
900 000BB2DC BFF55918 00D3 USER32.dll FindWindowA
901 000BB2E0 BFF52DC6 0037 USER32.dll CheckMenuItem
902 000BB2E4 BFF5300E 015B USER32.dll GrayStringA
903 000BB2E8 BFF528DC 024F USER32.dll TabbedTextOutA
904 000BB2EC BFF527BB 01AA USER32.dll MapWindowPoints
905 000BB2F0 BFF553D4 0225 USER32.dll SetRect
906 000BB2F4 BFF51B3F 014A USER32.dll GetWindow
907 000BB2F8 BFF51F4A 003B USER32.dll ChildWindowFromPointEx
908 000BB2FC BFF5558C 019F USER32.dll LoadStringA
909 000BB300 BFF52485 0211 USER32.dll SetFocus
910 000BB304 BFF52176 00D2 USER32.dll FillRect
911 000BB308 BFF5548F 01C2 USER32.dll OffsetRect
912 000BB30C BFF55923 003A USER32.dll ChildWindowFromPoint
913 000BB310 BFF524D7 000E USER32.dll BringWindowToTop
914 000BB314 BFF54460 0007 USER32.dll AppendMenuA
915 000BB318 BFF520A8 017D USER32.dll IsChild
916 000BB31C BFF54706 0016 USER32.dll CallNextHookEx
917 000BB320 BFF53451 0261 USER32.dll UnhookWindowsHookEx
918 000BB324 BFF511D9 023F USER32.dll SetWindowsHookExA
919 000BB328 BFF524FB 011B USER32.dll GetMenuItemCount
920 000BB32C BFF551B1 00F9 USER32.dll GetDesktopWindow
921 000BB330 BFF55A6D 00A7 USER32.dll DrawIcon
922 000BB334 BFF54F36 00FB USER32.dll GetDlgCtrlID
923 000BB338 BFF55127 018B USER32.dll IsZoomed
924 000BB33C BFF55591 0285 USER32.dll wsprintfA
925 000BB340 BFF51BAD 018C USER32.dll KillTimer
926 000BB344 BFF54D54 0100 USER32.dll GetDoubleClickTime
927 000BB348 BFF512DE 0197 USER32.dll LoadImageA
928 000BB34C BFF55A38 018F USER32.dll LoadBitmapA
929 000BB350 BFF51670 00D4 USER32.dll FindWindowExA
930 000BB354 BFF52098 0246 USER32.dll ShowWindow
931 000BB358 BFF549C9 002A USER32.dll CharPrevA
932 000BB35C BFF5493E 0026 USER32.dll CharNextA
933 000BB360 BFF55171 018A USER32.dll IsWindowVisible
934 000BB364 BFF524EF 00DE USER32.dll GetAsyncKeyState
935 000BB368 BFF51ADA 00A6 USER32.dll DrawFrameControl
936 000BB36C BFF5447F 00AD USER32.dll DrawTextA
937 000BB370 BFF5545D 01D4 USER32.dll PtInRect
938 000BB374 BFF524E7 026A USER32.dll UpdateWindow
939 000BB378 BFF5554E 00CF USER32.dll EqualRect
940 000BB37C BFF52DCE 00B3 USER32.dll EnableMenuItem
941 000BB380 BFF550BA 003D USER32.dll ClientToScreen
942 000BB384 BFF51F2C 0280 USER32.dll WindowFromPoint
943 000BB388 BFF55A0F 0191 USER32.dll LoadCursorA
944 000BB38C BFF52D8A 0208 USER32.dll SetCursor
945 000BB390 BFF55072 01EE USER32.dll ScreenToClient
946 000BB394 BFF5248D 0200 USER32.dll SetCapture
947 000BB398 BFF523CB 01D7 USER32.dll RedrawWindow
948 000BB39C BFF51EEE 00F6 USER32.dll GetCursorPos
949 000BB3A0 BFF51B37 013B USER32.dll GetSubMenu
950 000BB3A4 BFF55708 01CF USER32.dll PostMessageA
951 000BB3A8 BFF526FC 01E7 USER32.dll ReleaseCapture
952 000BB3AC BFF552F6 013F USER32.dll GetSystemMetrics
953 000BB3B0 BFF51269 024D USER32.dll SystemParametersInfoA
954 000BB3B4 BFF524EB 010C USER32.dll GetKeyState
955 000BB3B8 BFF5412E 01AD USER32.dll MessageBoxA
956 000BB3BC BFF558C0 0017 USER32.dll CallWindowProcA
957 000BB3C0 BFF5564D 0236 USER32.dll SetWindowLongA
958 000BB3C8 BFE71267 000C VERSION.dll VerQueryValueA
959 000BB3CC BFE7152F 0001 VERSION.dll GetFileVersionInfoA
960 000BB3D0 BFE71494 0002 VERSION.dll GetFileVersionInfoSizeA
961 000BB3D8 762986ED 00EC WININET.dll InternetGetConnectedState
962 000BB3DC 7629817D 0106 WININET.dll InternetSetCookieA
963 000BB3E4 BFDF8DB3 0002 WINMM.dll PlaySoundA
964 000BB3EC 75FA159B 000B WSOCK32.dll inet_ntoa
965 000BB3F0 75FA156A 000A WSOCK32.dll inet_addr
966 000BB3F4 75FA1635 000E WSOCK32.dll ntohl
967 000BB3F8 75FA1807 0034 WSOCK32.dll gethostbyname
968 000BB3FC 75FA1661 000F WSOCK32.dll ntohs
969 000BB400 75FA18EB 0039 WSOCK32.dll gethostname
970 000BB404 75FA17D3 0033 WSOCK32.dll gethostbyaddr
971 000BB408 75FA1539 0009 WSOCK32.dll htons
972 000BB410 100029C0 0009 ecap.dll W32N_MakeNdisRequest
973 000BB414 10003640 0004 ecap.dll W32N_GetAdapterRegistryInfo
974 000BB418 10002E60 0002 ecap.dll W32N_CloseAdapter
975 000BB41C 10002840 000C ecap.dll W32N_OpenAdapterA
976 000BB420 10001A20 0008 ecap.dll W32N_IsWindowsNT
977 000BB424 10001A60 0006 ecap.dll W32N_IsWindows2000
978 000BB428 10002EA0 0003 ecap.dll W32N_DisableLoopback
979 000BB42C 10001A80 0007 ecap.dll W32N_IsWindows95
980 000BB430 10002BF0 0001 ecap.dll W32N_CancelPacketRead
981 000BB434 10002AC0 0010 ecap.dll W32N_PacketReadEx
982 000BB438 10002D60 0012 ecap.dll W32N_PacketSendEx
983 000BB43C 100019E0 000B ecap.dll W32N_OSGetPlatformVersion
984 000BB440 100019C0 0005 ecap.dll W32N_GetLastError
985 000BB448 60013320 0509 egui.dll ?
NeO'X'QuiCk
04-05-2001, 11:37 AM
PreCreateWindow@CCJFrameWnd@@MAEHAAUtagCREATESTRUCTA@@I@Z
986 000BB44C 600452C0 071E egui.dll ?messageMap@CCJFrameWnd@@1UAFX_MSGMAP@@B
987 000BB450 600452A8 06E7 egui.dll ?classCCJFrameWnd@CCJFrameWnd@@2UCRuntimeClass@@B
988 000BB454 60012C90 0179 egui.dll ?DockControlBarLeftOf@CCJFrameWnd@@UAEXPAVCControlBar@@0@Z
989 000BB458 60031C90 0043 egui.dll ??0CCJTreeCtrl@@QAE@XZ
990 000BB45C 60031D90 0088 egui.dll ??1CCJTreeCtrl@@UAE@XZ
991 000BB460 60044D98 071B egui.dll ?messageMap@CCJFlatSplitterWnd@@1UAFX_MSGMAP@@B
992 000BB464 6000F650 03FD egui.dll ?OnDrawSplitter@CCJFlatSplitterWnd@@UAEXPAVCDC@@W4ESplitType@CSplitterWnd@@ABVCRect@@@Z
993 000BB468 6000F550 0171 egui.dll ?DisableFlatStyle@CCJFlatSplitterWnd@@UAEXH@Z
994 000BB46C 6000FF70 0633 egui.dll ?SwitchView@CCJFlatSplitterWnd@@UAEHHHPAVCView@@@Z
995 000BB470 6000FE40 053F egui.dll ?ReplaceView@CCJFlatSplitterWnd@@UAEHHHPAUCRuntimeClass@@@Z
996 000BB474 6000FD20 061D egui.dll ?ShowColumn@CCJFlatSplitterWnd@@UAEXXZ
997 000BB478 6000FC10 032D egui.dll ?HideColumn@CCJFlatSplitterWnd@@UAEXH@Z
998 000BB47C 6000FB00 0621 egui.dll ?ShowRow@CCJFlatSplitterWnd@@UAEXXZ
999 000BB480 6000FA00 032F egui.dll ?HideRow@CCJFlatSplitterWnd@@UAEXH@Z
1000 000BB484 6003D090 0085 egui.dll ??1CCJToolBar@@UAE@XZ
1001 000BB488 6003CED0 0040 egui.dll ??0CCJToolBar@@QAE@XZ
1002 000BB48C 6003E420 02E2 egui.dll ?GetRuntimeClass@CCJToolBar@@UBEPAUCRuntimeClass@@XZ
1003 000BB490 6003D2A0 050E egui.dll ?PreCreateWindow@CCJToolBar@@UAEHAAUtagCREATESTRUCTA@@@Z
1004 000BB494 6003C4F0 04E6 egui.dll ?OnToolHitTest@CCJToolBar@@UBEHVCPoint@@PAUtagTOOLINFOA@@@Z
1005 000BB498 60012E60 01AC egui.dll ?EnableDockingSizeBar@CCJFrameWnd@@UAEXKW4DockFlatBorders@1@@Z
1006 000BB49C 60012F90 017D egui.dll ?DockSizeBar@CCJFrameWnd@@UAEXPAVCControlBar@@PAVCCJSizeDockBar@@PAUtagRECT@@@Z
1007 000BB4A0 6003C3D0 0119 egui.dll ?CalcDynamicLayout@CCJToolBar@@UAE?AVCSize@@HK@Z
1008 000BB4A4 6003CC50 04ED egui.dll ?OnUpdateCmdUI@CCJToolBar@@UAEXPAVCFrameWnd@@H@Z
1009 000BB4A8 6003C970 03CF egui.dll ?OnBarStyleChange@CCJToolBar@@UAEXKK@Z
1010 000BB4AC 60031360 0177 egui.dll ?DoPaint@CCJToolBarBase@@UAEXPAVCDC@@@Z
1011 000BB4B0 60026F40 0077 egui.dll ??1CCJReBar@@UAE@XZ
1012 000BB4B4 600393F0 008D egui.dll ??1CGfxSplitterWnd@@UAE@XZ
1013 000BB4B8 60012B80 0062 egui.dll ??1CCJFrameWnd@@UAE@XZ
1014 000BB4BC 60026F80 002F egui.dll ??0CCJReBar@@QAE@XZ
1015 000BB4C0 60039300 004A egui.dll ??0CGfxSplitterWnd@@QAE@XZ
1016 000BB4C4 60012AA0 0018 egui.dll ??0CCJFrameWnd@@QAE@XZ
1017 000BB4C8 60030E90 0086 egui.dll ??1CCJToolBarBase@@UAE@XZ
1018 000BB4CC 60027230 00E1 egui.dll ?AddBar@CCJReBar@@QAEHPAVCWnd@@PBDPAVCBitmap@@K@Z
1019 000BB4D0 600274E0 0145 egui.dll ?Create@CCJReBar@@QAEHPAVCWnd@@KKI@Z
1020 000BB4D4 6001EC00 0351 egui.dll ?Insert@CCJMemFile@@UAEKPAVCFile@@KKK@Z
1021 000BB4D8 60024C00 0399 egui.dll ?LoadMenuA@CCJMenuBar@@QAEHI@Z
1022 000BB4DC 6003D790 00E7 egui.dll ?AddDropDownButton@CCJToolBar@@QAEHIIH@Z
1023 000BB4E0 6003E060 039C egui.dll ?LoadToolBar@CCJToolBar@@QAEHPBDPAUTOOLBARINFO@@@Z
1024 000BB4E4 600132F0 03DC egui.dll ?OnClose@CCJFrameWnd@@IAEXXZ
1025 000BB4E8 6001F360 0641 egui.dll ?UpdateDiskFile@CCJMemFile@@QAEXXZ
1026 000BB4EC 6001EF30 01BD egui.dll ?Extract@CCJMemFile@@UAEKPAVCFile@@KK@Z
1027 000BB4F0 6003C3A0 011D egui.dll ?CalcFixedLayout@CCJToolBar@@UAE?AVCSize@@HH@Z
1028 000BB4F4 60030EE0 0650 egui.dll ?WindowProc@CCJToolBarBase@@UAEJIIJ@Z
1029 000BB4F8 6001E5D0 0653 egui.dll ?WriteString@CCJMemFile@@UAEXPBDH@Z
1030 000BB4FC 6001E7C0 04FD egui.dll ?Open@CCJMemFile@@UAE_NVCString@@IPAVCFileException@@@Z
1031 000BB500 6001EB60 00F3 egui.dll ?Append@CCJMemFile@@MAE_NPAVCFile@@@Z
1032 000BB504 6001EAB0 0341 egui.dll ?Import@CCJMemFile@@MAE_NPAVCFile@@@Z
1033 000BB508 6001E860 0546 egui.dll ?Save@CCJMemFile@@MAE_NXZ
1034 000BB50C 6001E9B0 038B egui.dll ?Load@CCJMemFile@@MAE_NXZ
1035 000BB510 6001EA50 012D egui.dll ?Close@CCJMemFile@@UAEXXZ
1036 000BB514 6001EA80 01CA egui.dll ?Flush@CCJMemFile@@UAEXXZ
1037 000BB518 6001E3D0 0025 egui.dll ??0CCJMemFile@@QAE@PBDI@Z
1038 000BB51C 6001E460 006D egui.dll ??1CCJMemFile@@UAE@XZ
1039 000BB520 6003C470 0571 egui.dll ?SetButtonInfo@CCJToolBar@@QAEXHIIH@Z
1040 000BB524 6003C420 01E6 egui.dll ?GetButtonInfo@CCJToolBar@@QBEXHAAI0AAH@Z
1041 000BB528 60039D40 061F egui.dll ?ShowColumn@CGfxSplitterWnd@@QAEXXZ
1042 000BB52C 60039C70 032E egui.dll ?HideColumn@CGfxSplitterWnd@@QAEXH@Z
1043 000BB530 6003E2C0 057A egui.dll ?SetButtons@CCJToolBar@@QAEHPBIH@Z
1044 000BB534 6003E180 0390 egui.dll ?LoadBitmapA@CCJToolBar@@QAEHPBD@Z
1045 000BB538 60034560 014B egui.dll ?Create@CGfxOutBarCtrl@@UAEHKABUtagRECT@@PAVCWnd@@IK@Z
1046 000BB53C 600345A0 0382 egui.dll ?IsSmallIconView@CGfxOutBarCtrl@@UBE_NXZ
1047 000BB540 600345B0 05F8 egui.dll ?SetSmallIconView@CGfxOutBarCtrl@@UAEX_N@Z
1048 000BB544 60034650 021D egui.dll ?GetFlag@CGfxOutBarCtrl@@UBEKXZ
1049 000BB548 60034660 03AE egui.dll ?ModifyFlag@CGfxOutBarCtrl@@UAEXABK0I@Z
1050 000BB54C 60034ED0 0223 egui.dll ?GetFolderRect@CGfxOutBarCtrl@@UBE_NHAAVCRect@@@Z
1051 000BB550 60034F90 024D egui.dll ?GetItemRect@CGfxOutBarCtrl@@UAEXHHAAVCRect@@@Z
1052 000BB554 60035350 00E8 egui.dll ?AddFolder@CGfxOutBarCtrl@@UAEHPBDK@Z
1053 000BB558 60035520 023F egui.dll ?GetInsideRect@CGfxOutBarCtrl@@UBEXAAVCRect@@@Z
1054 000BB55C 60035610 033C egui.dll ?HitTestEx@CGfxOutBarCtrl@@UAEHABVCPoint@@AAH@Z
1055 000BB560 60035830 0330 egui.dll ?HighlightFolder@CGfxOutBarCtrl@@UAEXH@Z
1056 000BB564 60036A10 035B egui.dll ?InsertItem@CGfxOutBarCtrl@@UAEHHHPBDHK@Z
1057 000BB568 60036A40 0246 egui.dll ?GetItemCount@CGfxOutBarCtrl@@UBEHXZ
1058 000BB56C 60036A60 05F1 egui.dll ?SetSelFolder@CGfxOutBarCtrl@@UAEXH@Z
1059 000BB570 60036B60 021F egui.dll ?GetFolderCount@CGfxOutBarCtrl@@UBEHXZ
1060 000BB574 60036B70 02E8 egui.dll ?GetSelFolder@CGfxOutBarCtrl@@UBEHXZ
1061 000BB578 60036B80 0538 egui.dll ?RemoveFolder@CGfxOutBarCtrl@@UAEXH@Z
1062 000BB57C 60036CB0 01FF egui.dll ?GetCountPerPage@CGfxOutBarCtrl@@UBEHXZ
1063 000BB580 60036CC0 05B7 egui.dll ?SetImageList@CGfxOutBarCtrl@@UAEPAVCImageList@@PAV2@H@Z
1064 000BB584 60036D30 05A4 egui.dll ?SetFolderImageList@CGfxOutBarCtrl@@UAEPAVCImageList@@HPAV2@H@Z
1065 000BB588 60036D00 0239 egui.dll ?GetImageList@CGfxOutBarCtrl@@UAEPAVCImageList@@PAV2@H@Z
1066 000BB58C 60036E30 0500 egui.dll ?PaintItems@CGfxOutBarCtrl@@UAEXPAVCDC@@HVCRect@@@Z
1067 000BB590 60036F60 024E egui.dll ?GetItemSize@CGfxOutBarCtrl@@UAE?AVCSize@@HHH@Z
1068 000BB594 60013120 034B egui.dll ?InitializeMenu@CCJFrameWnd@@UAEHIPAIH@Z
1069 000BB598 60012D30 01A8 egui.dll ?EnableDocking@CCJFrameWnd@@UAEXK@Z
1070 000BB59C 60037560 0321 egui.dll ?GetVisibleRange@CGfxOutBarCtrl@@UAEXHAAH0@Z
1071 000BB5A0 60037670 0331 egui.dll ?HighlightItem@CGfxOutBarCtrl@@UAEXH_N@Z
1072 000BB5A4 60037910 0232 egui.dll ?GetIconRect@CGfxOutBarCtrl@@UAEXHHAAVCRect@@@Z
1073 000BB5A8 60037A90 0250 egui.dll ?GetLabelRect@CGfxOutBarCtrl@@UAEXHHAAVCRect@@@Z
1074 000BB5AC 60037C40 062C egui.dll ?StartGroupEdit@CGfxOutBarCtrl@@UAEXH@Z
1075 000BB5B0 6001E4E0 0528 egui.dll ?ReadString@CCJMemFile@@UAEHAAVCString@@@Z
1076 000BB5B4 60012F50 0529 egui.dll ?RecalcAllExcept@CCJFrameWnd@@UAEXPAVCCJSizeDockBar@@@Z
1077 000BB5B8 600344E0 05C4 egui.dll ?SetItemText@CGfxOutBarCtrl@@UAEXHPBD@Z
1078 000BB5BC 600380E0 0539 egui.dll ?RemoveItem@CGfxOutBarCtrl@@UAEXH@Z
1079 000BB5C0 60038150 0385 egui.dll ?IsValidItem@CGfxOutBarCtrl@@UBE_NH@Z
1080 000BB5C4 60038180 0247 egui.dll ?GetItemData@CGfxOutBarCtrl@@UBEKH@Z
1081 000BB5C8 600381C0 024A egui.dll ?GetItemImage@CGfxOutBarCtrl@@UBEHH@Z
1082 000BB5CC 60038200 05C1 egui.dll ?SetItemData@CGfxOutBarCtrl@@UAEXHK@Z
1083 000BB5D0 60038240 05C3 egui.dll ?SetItemImage@CGfxOutBarCtrl@@UAEXHH@Z
1084 000BB5D4 60038280 0192 egui.dll ?DrawDragArrow@CGfxOutBarCtrl@@UAEXPAVCDC@@HH@Z
1085 000BB5D8 60038660 020B egui.dll ?GetDragItemRect@CGfxOutBarCtrl@@UAEHHAAVCRect@@@Z
1086 000BB5DC 60038790 00F2 egui.dll ?AnimateFolderScroll@CGfxOutBarCtrl@@UAEXHH@Z
1087 000BB5E0 600339D0 01D2 egui.dll ?GetAnimationTickCount@CGfxOutBarCtrl@@UAEJXZ
1088 000BB5E4 60013270 0519 egui.dll ?PreTranslateMessage@CCJFrameWnd@@UAEHPAUtagMSG@@@Z
1089 000BB5E8 600390B0 024F egui.dll ?GetItemText@CGfxOutBarCtrl@@UAE?AVCString@@H@Z
1090 000BB5EC 60039160 00E9 egui.dll ?AddFolderBar@CGfxOutBarCtrl@@UAEHPBDPAVCWnd@@K@Z
1091 000BB5F0 600391F0 021E egui.dll ?GetFolderChild@CGfxOutBarCtrl@@UAEPAVCWnd@@H@Z
1092 000BB5F4 60039230 0220 egui.dll ?GetFolderData@CGfxOutBarCtrl@@UAEKH@Z
1093 000BB5F8 60039250 055F egui.dll ?SetAnimSelHighlight@CGfxOutBarCtrl@@UAEXH@Z
1094 000BB5FC 60034820 0183 egui.dll ?DrawAnimItem@CGfxOutBarCtrl@@UAEXHHH@Z
1095 000BB600 60033F70 02E5 egui.dll ?GetRuntimeClass@CGfxOutBarCtrl@@UBEPAUCRuntimeClass@@XZ
1096 000BB604 60033F80 0049 egui.dll ??0CGfxOutBarCtrl@@QAE@XZ
1097 000BB608 60034250 008C egui.dll ??1CGfxOutBarCtrl@@UAE@XZ
1098 000BB60C 600491F8 073B egui.dll ?messageMap@CGfxOutBarCtrl@@1UAFX_MSGMAP@@B
1099 000BB610 6000DAE0 0645 egui.dll ?UpdateFont@CCJFlatButton@@MAEXXZ
1100 000BB614 6000DA30 0187 egui.dll ?DrawButtonBitmap@CCJFlatButton@@MAEXPAVCDC@@IAAVCRect@@@Z
1101 000BB618 6000D810 018B egui.dll ?DrawButtonText@CCJFlatButton@@MAEXPAVCDC@@IAAVCRect@@@Z
1102 000BB61C 6000D940 0189 egui.dll ?DrawButtonIcon@CCJFlatButton@@MAEXPAVCDC@@IAAVCRect@@@Z
1103 000BB620 60002100 05B1 egui.dll ?SetIcon@CCJFlatButton@@UAEXPAUHICON__@@VCSize@@@Z
1104 000BB624 60002130 05B0 egui.dll ?SetIcon@CCJFlatButton@@UAEXPAUHICON__@@0VCSize@@@Z
1105 000BB628 600020E0 0170 egui.dll ?DisableFlatLook@CCJFlatButton@@UAEXH@Z
1106 000BB62C 6000D6D0 055D egui.dll ?SetAlternateColors@CCJFlatButton@@UAEXKKKK@Z
1107 000BB630 60002160 0570 egui.dll ?SetButtonFont@CCJFlatButton@@UAEXPAVCFont@@@Z
1108 000BB634 6000D710 0199 egui.dll ?DrawItem@CCJFlatButton@@UAEXPAUtagDRAWITEMSTRUCT@@@Z
1109 000BB638 6003D180 0149 egui.dll ?Create@CCJToolBar@@UAEHPAVCWnd@@KI@Z
1110 000BB63C 6003D1D0 014F egui.dll ?CreateEx@CCJToolBar@@UAEHPAVCWnd@@KKVCRect@@I@Z
1111 000BB640 6003BAF0 024C egui.dll ?GetItemRect@CCJToolBar@@UBEXHPAUtagRECT@@@Z
1112 000BB644 6003D9A0 036B egui.dll ?InvalidateOldPos@CCJToolBar@@UAEXABVCRect@@@Z
1113 000BB648 6003DA90 01EA egui.dll ?GetButtonSize@CCJToolBar@@UAE?AVCSize@@PAU_TBBUTTON@@H@Z
1114 000BB64C 6003D8A0 03FF egui.dll ?OnDropDownButton@CCJToolBar@@UAEXABUtagNMTOOLBARA@@IVCRect@@@Z
1115 000BB650 60048780 0736 egui.dll ?messageMap@CCJToolBar@@1UAFX_MSGMAP@@B
1116 000BB654 60003340 04FE egui.dll ?OpenWindow@CCJCaption@@QAEXXZ
1117 000BB658 600024E0 0004 egui.dll ??0CCJCaption@@QAE@XZ
1118 000BB65C 6000F570 0015 egui.dll ??0CCJFlatSplitterWnd@@QAE@XZ
1119 000BB660 60002660 0050 egui.dll ??1CCJCaption@@UAE@XZ
1120 000BB664 6000F620 005F egui.dll ??1CCJFlatSplitterWnd@@UAE@XZ
1121 000BB668 6001A990 03EE egui.dll ?OnCustomDraw@CCJListView@@IAEXPAUtagNMHDR@@PAJ@Z
1122 000BB66C 6001B2F0 03F5 egui.dll ?OnDestroy@CCJListView@@IAEXXZ
1123 000BB670 60021210 03B0 egui.dll ?ModifyODMenuA@CCJMenu@@QAEHPBDIH@Z
1124 000BB674 60021990 039D egui.dll ?LoadToolbar@CCJMenu@@QAEHI@Z
1125 000BB678 6001B550 04E7 egui.dll ?OnUpdate@CCJListView@@MAEXPAVCView@@JPAVCObject@@@Z
1126 000BB67C 6001B560 061E egui.dll ?ShowColumn@CCJListView@@QAEXHH@Z
1127 000BB680 6001B5B0 0109 egui.dll ?AutoSaveColumnsOrder@CCJListView@@QAEXPBD0@Z
1128 000BB684 6001A7D0 0434 egui.dll ?OnInitialUpdate@CCJListView@@UAEXXZ
1129 000BB688 6001A470 001E egui.dll ??0CCJListView@@QAE@XZ
1130 000BB68C 6001F5C0 0026 egui.dll ??0CCJMenu@@QAE@XZ
1131 000BB690 6001A680 0068 egui.dll ??1CCJListView@@UAE@XZ
1132 000BB694 6001F720 006E egui.dll ??1CCJMenu@@UAE@XZ
1133 000BB698 6001AA30 0481 egui.dll ?OnNotify@CCJListView@@MAEHIJPAJ@Z
1134 000BB69C 6001B240 02F5 egui.dll ?GetStoredWidth@CCJListView@@UAEHH@Z
1135 000BB6A0 6001B320 010C egui.dll ?AutoSizeColumn@CCJListView@@UAEXH@Z
1136 000BB6A4 6001B1D0 0586 egui.dll ?SetColumnWidth@CCJListView@@UAEXH@Z
1137 000BB6A8 6001B170 0393 egui.dll ?LoadColumnWidths@CCJListView@@UAEXXZ
1138 000BB6AC 6001B050 054B egui.dll ?SaveColumnWidths@CCJListView@@UAEXXZ
1139 000BB6B0 6001AFC0 0108 egui.dll ?AutoSaveColumns@CCJListView@@UAEXPBD00@Z
1140 000BB6B4 6001AF10 0632 egui.dll ?SubclassHeader@CCJListView@@UAE_N_N@Z
1141 000BB6B8 6001AB70 0628 egui.dll ?SortList@CCJListView@@UAE_NH_N@Z
1142 000BB6BC 6001A380 05A0 egui.dll ?SetExtendedStyle@CCJListView@@UAEXK@Z
1143 000BB6C0 6001A360 0213 egui.dll ?GetExtendedStyle@CCJListView@@UAEKXZ
1144 000BB6C4 6001A3E0 016F egui.dll ?DisableColumnSizing@CCJListView@@UAEX_N@Z
1145 000BB6C8 6001A3D0 05D2 egui.dll ?SetMinimumColSize@CCJListView@@UAEXH@Z
1146 000BB6CC 6001AD70 033B egui.dll ?HitTestEx@CCJListView@@UBEHAAVCPoint@@PAH@Z
1147 000BB6D0 6001ABF0 00E5 egui.dll ?AddColumn@CCJListView@@UAEHPBDHH@Z
1148 000BB6D4 6001AC70 0113 egui.dll ?BuildColumns@CCJListView@@UAE_NHPAH0@Z
1149 000BB6D8 6001AD20 0114 egui.dll ?BuildColumns@CCJListView@@UAE_NHPAHPAVCString@@@Z
1150 000BB6DC 6001A3B0 05EC egui.dll ?SetRowColors@CCJListView@@UAEXKK@Z
1151 000BB6E0 6001A960 01FC egui.dll ?GetColumnCount@CCJListView@@UBEHXZ
1152 000BB6E4 6001A860 0134 egui.dll ?CopyRow@CCJListView@@UAE_NHH@Z
1153 000BB6E8 6001A7E0 03BE egui.dll ?MoveRow@CCJListView@@UAE_NHH@Z
1154 000BB6EC 6000D330 0012 egui.dll ??0CCJFlatButton@@QAE@XZ
1155 000BB6F0 6000D480 005C egui.dll ??1CCJFlatButton@@UAE@XZ
1156 000BB6F4 60001BA0 0002 egui.dll ??0CCJBrowseEdit@@QAE@XZ
1157 000BB6F8 600132B0 038D egui.dll ?LoadBarState@CCJFrameWnd@@UAEXPBD@Z
1158 000BB6FC 600130B0 034A egui.dll ?InitializeMenu@CCJFrameWnd@@UAEHII@Z
1159 000BB700 600132D0 0548 egui.dll ?SaveBarState@CCJFrameWnd@@UBEXPBD@Z
1160 000BB704 600371E0 0221 egui.dll ?GetFolderImageList@CGfxOutBarCtrl@@UBEPAVCImageList@@H_N@Z
1161 000BB708 60037220 019F egui.dll ?DrawItem@CGfxOutBarCtrl@@UAEXPAVCDC@@HVCRect@@H_N@Z
1162 000BB70C 60012E40 052D egui.dll ?RecalcLayout@CCJFrameWnd@@UAEXH@Z
1163 000BB710 60001C90 004E egui.dll ??1CCJBrowseEdit@@UAE@XZ
1164 000BB714 600337B0 064C egui.dll ?WindowCenter@@YAXPAUHWND__@@@Z
1165 000BB718 60019F40 05BF egui.dll ?SetItemColor@CCJListCtrl@@QAEXHK@Z
1166 000BB71C 60018F80 001D egui.dll ??0CCJListCtrl@@QAE@XZ
1167 000BB720 600190E0 0067 egui.dll ??1CCJListCtrl@@UAE@XZ
1168 000BB724 60003B30 0007 egui.dll ??0CCJColorPicker@@QAE@XZ
1169 000BB728 6001BD60 0022 egui.dll ??0CCJMaskEdit@@QAE@XZ
1170 000BB72C 60003C70 0053 egui.dll ??1CCJColorPicker@@UAE@XZ
1171 000BB730 6001BED0 006C egui.dll ??1CCJMaskEdit@@UAE@XZ
1172 000BB734 60033820 03A0 egui.dll ?LoadWindowTopLeft@CCJWindowPlacement@@QAEHPAVCWnd@@PBD11@Z
1173 000BB738 60033420 0045 egui.dll ??0CCJWindowPlacement@@QAE@XZ
1174 000BB73C 600334B0 0089 egui.dll ??1CCJWindowPlacement@@UAE@XZ
1175 000BB740 60013070 03C5 egui.dll ?NewMenu@CCJFrameWnd@@MAEPAUHMENU__@@IPAIH@Z
1176 000BB744 60013030 03C4 egui.dll ?NewMenu@CCJFrameWnd@@MAEPAUHMENU__@@II@Z
1177 000BB748 60034470 05A5 egui.dll ?SetFolderText@CGfxOutBarCtrl@@UAEXHPBD@Z
1178 000BB74C 60037D10 062D egui.dll ?StartItemEdit@CGfxOutBarCtrl@@UAEXH@Z
1179 000BB750 600339C0 0560 egui.dll ?SetAnimationTickCount@CGfxOutBarCtrl@@UAEXJ@Z
1180 000BB754 6000D510 026D egui.dll ?GetMessageMap@CCJFlatButton@@MBEPBUAFX_MSGMAP@@XZ
1181 000BB758 6002D340 053C egui.dll ?RemovePane@CCJStatusBar@@UAEXH@Z
1182 000BB75C 6002D010 02F3 egui.dll ?GetStatusPane@CCJStatusBar@@UAEHHAAVCCJStatusBarPane@@@Z
1183 000BB760 6002D060 00EB egui.dll ?AddIndicator@CCJStatusBar@@UAEHHI@Z
1184 000BB764 6002CFC0 05E0 egui.dll ?SetPaneWidth@CCJStatusBar@@UAEXHH@Z
1185 000BB768 6002CF20 00E6 egui.dll ?AddControl@CCJStatusBar@@UAEHPAVCWnd@@HH@Z
1186 000BB76C 6002CEE0 02A6 egui.dll ?GetPanControl@CCJStatusBar@@UAEPAVCCJStatusBarPaneControlInfo@@H@Z
1187 000BB770 6002CDE0 0504 egui.dll ?PositionControls@CCJStatusBar@@UAEXXZ
1188 000BB774 6002CD80 02DC egui.dll ?GetRuntimeClass@CCJStatusBar@@UBEPAUCRuntimeClass@@XZ
1189 000BB778 6002CB50 0038 egui.dll ??0CCJStatusBar@@QAE@XZ
1190 000BB77C 6002CC10 007E egui.dll ??1CCJStatusBar@@UAE@XZ
1191 000BB780 60017D20 001B egui.dll ??0CCJHyperLink@@QAE@XZ
1192 000BB784 60017E50 0065 egui.dll ??1CCJHyperLink@@UAE@XZ
1193 000BB788 600135C0 0063 egui.dll ??1CCJHexEdit@@UAE@XZ
1194 000BB78C 60013430 0019 egui.dll ??0CCJHexEdit@@QAE@XZ
1195 000BB790 60016020 0542 egui.dll ?ResetColors@CCJHexEdit@@QAEXXZ
1196 000BB794 60016050 012B egui.dll ?Clear@CCJHexEdit@@QAEXXZ
1197 000BB798 60015E20 0581 egui.dll ?SetColor@CCJHexEdit@@QAEXHHKK@Z
1198 000BB79C 600101B0 0060 egui.dll ??1CCJFlatTabCtrl@@UAE@XZ
1199 000BB7A0 6001A7C0 03FC egui.dll ?OnDraw@CCJListView@@MAEXPAVCDC@@@Z
1200 000BB7A4 60010020 0016 egui.dll ??0CCJFlatTabCtrl@@QAE@XZ
1201 000BB7A8 6001E730 01A3 egui.dll ?Duplicate@CCJMemFile@@UAE_NVCString@@@Z
1202 000BB7AC 6001E690 01A2 egui.dll ?Duplicate@CCJMemFile@@UAE_NPAVCFile@@@Z
1203 000BB7B0 6001EAA0 0172 egui.dll ?Discard@CCJMemFile@@UAE_NXZ
1204 000BB7B4 6001EE90 0352 egui.dll ?Insert@CCJMemFile@@UAEKVCString@@KKK@Z
1205 000BB7B8 6001F020 01BE egui.dll ?Extract@CCJMemFile@@UAEKVCString@@KK@Z
1206 000BB7C0 7FF2C97D 0012 ole32.dll CoCreateInstance
1207 000BB7C8 61010590 0001 proto.dll ?Analyze@CProtoApp@@QAEPAUPKT_INFO@@PAEH@Z
1208 000BB7CC 61020690 0002 proto.dll ?Proto@@3VCProtoApp@@A
1209 000BB7D4 77032BA8 0016 urlmon.dll CreateURLMoniker

As you can see there are some missing from 106 to 807!SO dont think that i right.i could get then with trace and not even with REsolve again!

That was the problem but i think that this target is easyer the Risc SEtlerss 3!

NeO
tsehp
04-05-2001, 06:00 PM
you only see mfc42 exports here, with ordinals numbers. those are not missing names or iat's but only exported functions by ordinals, and there are a lot on those horrible m$ mfc classes.

If an iat needs to be resolved again, it's because no name/ordinal
appears in the list, but a valid api address is there, so this address was generally just redirected.

Otherwise, the address needs to be traced, meaning that the entry
needs to be decrypted/demangled.

But in your case, all the entries all filled.


Kinda off topic. I need a good book on C++
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Kinda off topic. I need a good book on C++
PDA

View Full Version : Kinda off topic. I need a good book on C++

Latigo
04-05-2001, 09:01 AM
Howdy!
Can you recommend me a good book on C++?
I need to learn and never did anything on C++
Thanks!

Latigo
tsehp
04-05-2001, 06:13 PM
what a great decision ! mail me, I can send you teach yourself c++
in 21 days, great one to start.
Clandestiny
04-05-2001, 08:06 PM
Hi Latigo,

Thinking In C++ by Bruce Eckel is pretty good too. Email me and I can send you a copy of it.

Cheers :)
Clandestiny
Solomon
04-06-2001, 06:15 AM
I have the following books on C++:
C++ by example(for beginners, PDF, 3.6MB)
Effective C++, More Effective C++(not for beginners, HTML, 8MB)
ANSI-ISO-C++.Professional.Programmer.Handbook(PDF reference book, 700KB)

contact me if u r interested. u can also get some from onlinereferences.cjb.net.
solomon2000@gmx.net
Latigo
04-06-2001, 10:41 AM
Hi guys and thanks very much for your generosity.
I'll contact each and every one of you right now :)
Thanks again.

Latigo
tsehp
04-06-2001, 03:53 PM
btw, just asking, is someone interested and ready to contribute
on a new created forum here on c++ applied to rce ?

I just don't know if there are enough c++ coders here, but this maybe could be interesting ?
ThrillSeeker
04-06-2001, 03:53 PM
+Tsehp and Clandestiny, may i have a copy also?
Clandestiny
04-06-2001, 05:29 PM
+Tsehp (04-06-2001 13:53):
btw, just asking, is someone interested and ready to contribute
on a new created forum here on c++ applied to rce ?

I just don't know if there are enough c++ coders here, but this maybe could be interesting ?

Hi +Tsehp,

I think an RCE targeted C++ forum is a very interesting and good idea :-) I'd love to participate in (and have the support) of other reversers on C++ coding issues related to reversing.

Cheers,
Clandestiny
Clandestiny
04-06-2001, 05:34 PM
ThrillSeeker (04-06-2001 13:53):
+Tsehp and Clandestiny, may i have a copy also?

Hi ThrillSeeker,

Sure, I'll send ya a copy...but I'll need your email. Mail me direct, if you don't want to post it on the forum. The file is approx 1.7 megs, btw.

Regards,
Clandestiny
Latigo
04-06-2001, 06:55 PM
+Tsehp (04-06-2001 13:53):
btw, just asking, is someone interested and ready to contribute
on a new created forum here on c++ applied to rce ?

I just don't know if there are enough c++ coders here, but this maybe could be interesting ?
Latigo
04-06-2001, 06:56 PM
+Tsehp (04-06-2001 13:53):
btw, just asking, is someone interested and ready to contribute
on a new created forum here on c++ applied to rce ?

I just don't know if there are enough c++ coders here, but this maybe could be interesting ?

Well, i'm just beginning but i'm interested in it anyway :)
tsehp
04-06-2001, 07:26 PM
ThrillSeeker (04-06-2001 13:53):
+Tsehp and Clandestiny, may i have a copy also?
same for me, mail me directly.
tsehp
04-06-2001, 07:29 PM
Clandestiny (04-06-2001 15:29):
+Tsehp (04-06-2001 13:53):
btw, just asking, is someone interested and ready to contribute
on a new created forum here on c++ applied to rce ?

I just don't know if there are enough c++ coders here, but this maybe could be interesting ?

I'm dreaming of this since a while now, let this topic develop a little and see if we have enough c++ programmers here to animate this forum, maybe arthaxerxes and mostek if they are not too busy could be interested.

Hi +Tsehp,

I think an RCE targeted C++ forum is a very interesting and good idea :-) I'd love to participate in (and have the support) of other reversers on C++ coding issues related to reversing.

Cheers,
Clandestiny
MO_K
04-06-2001, 08:12 PM
RCEing C++,

am I the only one missing the point here?

Which part of reversing a C++ writen app
needs an special attention?

C++ only adds a layer of abstraction to C,
to accomodate the design and implementation
in an O-O way. After the compilation, this
layer boils down to -sigh- "bloat"; the stuff
that makes printing disasm-listings impossible.

If you want to investigate how a given C++
compiler translates the high level OOP
concepts and constructs to assembler, that
is fine, and will help you recognize patterns
in listings. But isn't that the same thing
flirt does? why waste time?

The next thing that comes to mind is manual
demangling, which is also a waste of time;
since each and every compiler in the market
has been *studied*, and well documented.

Here i go again, J0y~Ki11 ;)
tsehp
04-07-2001, 01:48 AM
[quote]MO_K (04-06-2001 18:12):
RCEing C++,

am I the only one missing the point here?

Which part of reversing a C++ writen app
needs an special attention?

quote]
not reversing, but building some reversing tools, just like revirgin for example that is entirely build with c++.
mo k
04-07-2001, 03:18 AM
ooooh, ok, i get it now ;)

Yeah that will be good. Just make sure you don't
let the volatile aspects of the application creep
into the main objects.

If you are into engineering, you can put the
user interface, and the standard code in the
base classes, and make it available to the extended
version of the application through inheritance.

Say for example a universal unpacker; you can
put the gui and DOS unpackers in the base classes, since they are unlikely to change.
And make the newest unpacker inherit this base
code -- voila, instant app. Then after stabalizing
all the versions of a given packer, put it into the
base, and initialize it each time with a constructor.

I don't know, may be after you implement such tool,
you will come to the conclusion that, yes, it is
better to write a C library of unpacking functions
and call them in an instant ;)

Home Team 1 : Joy~kill 2
mo k
04-07-2001, 03:58 AM
Speaking of the books,

If you want a good introduction to a given
technology, always read the most frequently
recommended book, even if you have to pay for it,
or if they are rock hard.
Make sure the recommendation doesn't come
from the publisher, or dumb amazonians. But a
respected publication, or perhaps the FAQ of the
USENET group dedicated to that technology.

I learnt C++ from Waite Group's Turbo C++
by Robert Lafore; it was a primitive book and
tought me a little about the language.
I then moved to the Borland C++ manual, which
was a misnomer, and tought nothing more than
how to use the BC3 IDE.
Down the road, i learnt the language from
different angels, without really learning the
language itself.

So, if you are buying a CS book, make sure it is tought in the univerisites. and that it has good
and sound excerises, if you have a programming
background, see if the examples are practical,
best books are those that stress the application
of a given technique in the real world, and also
provide an explanation of the theory behind it.
Books that stress the mathematical foundation
of a given techology are almost always perfect.
If a book tells you to implement a deque in
the language at hand, using a data structure
implemented in the previous chapter, know you
are in good hands. :)

All those commercial books come with little or no
excercises, because they are not meant to teach.

Avoid authors that try to impress you; Herebrt
Schildt is such one.

Buy only Adison Wesley and Prentice Hall books, the
rest are only to rip off the poor IT newcomers.

Learn the concepts behind the given language.
In C++ learn the guts of OOP, and perhaps its
alternatives. Read language independent books
that introduce the topic, in OOP, Booch is such
one. It is usaully better if the author discusess
the pros and cons of the given technology.
Die hard Fanatics of their own creation, Like
Bertrand Meyer are only good for the experienced
ones, they will take the newbie to a one way ride
to unsertainty.

Never buy platform dependent books, as an
introduction. They will concentrate on the OS,
the CPU, the Compiler, the IDE, but not the
topic at hand.

Look in the references or the Bibliography section,
if all the titles there, are by the same author or
publisher, bail out, it is a bait. O'Reilly books are
an exception, they are in a class on thier own,
but their C/C++/algos/data structures books suck.
mo k
04-07-2001, 04:00 AM
/*
* Continued from above, due to message size
* restrictions
*
/

Look at the examples in the book; some books
are writen by specialized programmers, if you see
the theme of a given type of an application
running throughout the chapters, bailout.
example, if the author comes from a financial
background, all the examples will have a banking
accent to them, which will narrow your understanding
of the application of the given technology.
Perl books are full of CGI examples.

Avoid books that devote major chapters to
"new" techniques; extreme programming is one such,
XML is another.
Unless the techology at hand relates to the other;
i.e. it is OK for an apache book to explain mod_perl.

See if the author has writen any other
books realting to the topic. See if the
book is a rehash from a previous book.
for example, if you want a data strucures
and algorithms book in C++, Robert Sedgewick
is your man, but wait, if you can get his C book
for half the price, you do just well, because it
is the same thing.
For another example Deitel&Deitel, these guys
have fooled many pros into their trust; their
books are sucky rehashes, avoid by all means.

Don't buy books that try too be everything --
there exceptions i know.
Get an introductory book, and applications book,
and a reference.
Most of the time, an electronic reference in better
than a hard copy one, for its instant reference
and search facilities. All the API references in the
world are somewhere online, so don't pay a penny
fore'm. On the other hand, a hard copy intro is
the best. If you are like me, and go through a
period of labor and meditation when learing
something new, then you know a good intro
book is the best thing to walk around with, and
take to the bathroom ;)

Finally, make sure the book is writen by a practicing
educator, if you are a beginner in the topic.
Professionals don't teach the alphabet, they
assume you are bathed and diabered, and they
will go right to the subject matter.
Latigo
04-07-2001, 11:03 AM
Thanks very much for such detailed explanation Mo_K!!!!!! :)

Latigo
tsehp
04-07-2001, 06:50 PM
Teach yourself c++ in 21 days was extremely interesting to me
for the first approach, almost every aspect of c and c++ is covered,
gradually and you don't get lost inside, every chapter is ended with a bunch of exercises so you just have to self estimate yourself at each chapter.

But ask mo k said OOP is a very important concept to understand, and in this book the concept is not very well covered with explanations, you'll just build some classes manually just without understanding how you should really build them to be well OOP compliant and more important how to make them really reusable.

Next you'll have to choose your c++ IDE, I'll advice you to choose borland c++ builder 5 and buy the related book teach yourself c++ builder 3 in 21 days, I will not even talk about ms visual studio and the mfc classes that are really belonging now to the past.
m0sk
04-07-2001, 10:24 PM
Hi,

I'm more like a c-coder myself, and never got far in learning c++. I can advise you *not* to buy `c++ primer by Lippman & Lajoie', as I found it to be not suited for a beginner (although the book was recommended lecture for my introductionary class in c/c++). My fellow students also found the book pretty useless. You'd better get `thinking in c++ by Bruce Eckel'; it seems to be pretty good from what I hear. Best of all, you can get it free at the authors' homepage (h**p://www.bruceeckel.com).

And now a question: what about `The C++ Programming Language by Bjarne Stroustrup'? *The* standard I guess...Can anybody recommend it? Would it be useful for c++ newbies with a firm background in c? (I realise though that c and c++ are really 2 completely different languages/concepts...)

Regards,
m0sk

BTW: Tsehp, can you elaborate a bit more on `ms visual studio and the mfc classes that are really belonging now to the past' --just curious ;-)
Maldoror
04-09-2001, 03:43 AM
+Tsehp:
"btw, just asking, is someone interested and ready to contribute
on a new created forum here on c++ applied to rce ?

I just don't know if there are enough c++ coders here, but this maybe could be interesting ?"

Not very bad idea!
I vote Yes.

Maldoror
miscreant
04-17-2001, 12:26 PM
Prentice Hall are very good, as are sams teach yourself series. Also try to find a chapter listing before you buy a book, otherwise you end up with 80% of the book on databases, and only 20% covering the language on the cover of the book.
mammon_
04-18-2001, 02:37 PM
have to agree with mo_k on a number of issues here.

Good Publishers:
A/W, Prentice Hall, MorganKauffman [sometimes].
'Iffy' Publishers:
R&D, O'Reilly
'No fargen way' publishers:
Sams, Wrox, Que, IDG, New Riders

The 'no fargen way' books seem the cheaper, easier route, but in the long run it is not worth it. You end up, at some point, having to relearn programming.

If a book turns out to be 'too hard', you have either chosen a book by a bad author [hint: hit the author's site before making a purchase, also do a google search on the title and see how many people say the book is awesome on their own pages], or you have more to learn than you realize. Do not shortcut by getting a 21-days book ... bite the bullet and do the learning. Of course if you don't want to be a good programmer then you can ignore this and buy whatever the hell book you like ;)

Another thing: Don't learn C++ ;P
Well, OK, learn it, just never use it. Writing your apps in C++ is the very first step on the road to becoming a Java whore. But then again, since most of you guys are on windows, I guess you can't get away from it...

Book Suggestions:
I liked Deitel & Deitel's 'C++: How To Program'. It is a good newbie book while at the same time teaching sound programming and supplying decent reference material.

However, as a 'road to c++', I recommend the following steps:

+Learn C Thoroughly+
Get the Kernighan book
Get the van der Linden book

+Use C for OOP-style stuff+
Get 'C Interfaces and Implementations'
Get a data structures/algorithms book by Standish or Sedgewick.

+Get a decent C++ book+
You're on your own here. Check the AW 'professional reference' [white cover w/ splash of color and blue back] series.

+Get a C++ Algo Book+
Probably Sedgewick is the best here.

+Get Some OOP Design Books+
Just to make sure you 'get it'.

Doing rce apps in C++:
um, why?
well, anyways, check out the Borg source code, you'll see some neat things. As always, the best instruction comes from looking at other peoples' source ... borg will give you some OOP-based disassembler code to play with.

_m
Fatboy Joe
04-19-2001, 06:40 AM
>C++ only adds a layer of abstraction to C,
>to accomodate the design and implementation
>in an O-O way. After the compilation, this
>layer boils down to -sigh- "bloat"; the stuff
>that makes printing disasm-listings impossible.

Where does this bloat come from? What exactly gets bloated?
I am curious about this.
strayed
04-19-2001, 09:05 AM
mammon_ (04-18-2001 12:37):
...

However, as a 'road to c++', I recommend the following steps:

+Learn C Thoroughly+
...
+Use C for OOP-style stuff+
...
+Get a decent C++ book+
...
+Get a C++ Algo Book+
...
+Get Some OOP Design Books+
...
_m

Hi there,
With all due respect to mammon_, do not follow the path he suggested. Learning C in order to approach to C++ is a wrong way. (However, I think that all of you are mastering C so this is not an issue ;) ). Take a look at AW ‘C++ in depth’ series - especially at Accelerated C++ by Andrew Koenig and Essential C++ by Stanley B. Lippman. All other books from this series are bleeding edge books (they are a ‘must’ read if you wonna be a hardcore C++ programmer). For general OOP concepts I would recommend Object-Oriented Software Construction 2nd ed. by Bertrand Meyer. However, I agree with mo_k that he is a little bit ‘Die hard Fanatic of its own creation’ – but for good reason! He teaches *pure* OO methodology.

mammon_ (04-18-2001 12:37):
...
Another thing: Don't learn C++ ;P
Well, OK, learn it, just never use it. Writing your apps in C++ is the very first step on the road to becoming a Java whore. But then again, since most of you guys are on windows, I guess you can't get away from it...
...
_m

C++ and Java were not born under Windows :P so it’s not clear what you mean. And beginning programming with C++ doesn’t necessarily mean that you’ll become ‘Java whore’ (only those poor, weak souls will ;) ).

regards,
strayed
mammon_
04-19-2001, 03:13 PM
clarification:

of course C++ and Java weren't born on windows. However, virtually all of the profes^H^H^H^H^H^Hcommercial IDEs for windows [and nearly all of the sample code, books, etc] are OOP-biased -- i.e. everyone seems to assume you are using C++ . The recognized alternatives are VB and Java, neither of which win any points for computational efficiency or procedural programming style.

Contrast this with Mac, where things like Smalltack and Obj-C and pascal run things as often as not, and unix, where C runs things. Windows OSes are geared towards C++ -- therefore if you are using windows, you probably cannot get away from C++. But you don't have to like it ;)

"learn c before c++"
I'll stand by this for a number of reasons.

C++ started as a preprocessor for C, and hasn't evolved much. Learn the underlying language.

C++ methods are the same as C functions; in fact, aside from the class notation and supporting language features [new() n' all that], you will be writing C code. Get good at it, or your code will suck.

C forces you to know what your code is doing at a more-or-less system level, particularly regarding memory management. You will learn the computational costs involved with creating new classes etc since you will be doing it all manually -- as a result you will [most likely] refrain from doing things like creating a class for each byte of data when you move to C++. Perhaps I have too dim a view of C++ coders ... but I've never known a good C coder who was a horrible C++ coder.It doesn't work like that the other way around.

Learning to implement algos and ADTs in C will teach you much about modular programming which you can easily miss in C++ lessons. A class hierarchy is its own API [stress the 'interface' part there]; there is no real need to design good interfaces and modular code since the language does that for you. If you think you will never need to know programming design concepts, then please, forge ahead in your ignorance. More coders like you mean higher-paying jobs for coders like me ;)

On second thought, scratch everything I just wrote. I think grugq might be right...

_m
mo k
04-19-2001, 05:06 PM
Oh father grugq, forgive us for we have sined,
lamerdom shall haunt us for life, or till slack
goes $rupt and ftp only ;P

I think that shell debugger is not too slow
after all, some of'em here need LiquidPlumber(tm)
to drain things down their heads.

P.S. wanna do a bloat comparison between
bjarne's and ritchie's?
write a main with a single return only and
disassemble it, now *that* is fscking bloat!

For the STILL curious, get Bruce Eckel's for C++
and Pohl and Kelley for C, nuff said.
Fatboy Joe
04-19-2001, 09:24 PM
Check the size of a program consisting of a return? This isn't an objective proof of bloatedness. Just because C++ has a slightly larger initialisation and shutdown sequence doesn't make it more bloated. So what if it comes out bigger when just a return is in the program? The same C program compiled is also way bigger than it could be, it copes with the fact that there is no code no better than the C++ compiler. Where does the C++ code really get bloated? A few extra bytes on initialisation and shutdown isn't "a layer of abstraction ... After the compilation ... boils down to "bloat" "
grugq
04-20-2001, 03:46 AM
grugq@chao :587 src}--$> cat main.c
#include <stdio.h>

int main (void)
{
printf("Hello World
");
return 0;
}
grugq@chao :588 src}--$> gcc -o c main.c
grugq@chao :589 src}--$> cat main.cpp
#include <iostream.h>

int main (void)
{
cout << "Hello World
";
return 0;
}
grugq@chao :590 src}--$> g++ -o cpp main.cpp
grugq@chao :591 src}--$> ls -l c*
-rwxr-xr-x 1 grugq other 6700 Apr 20 03:13 c*
-rwxr-xr-x 1 grugq other 7032 Apr 20 03:13 cpp*
grugq@chao :592 src}--$> ldd c
libc.so.1 => /usr/lib/libc.so.1
libdl.so.1 => /usr/lib/libdl.so.1
/usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1
grugq@chao :593 src}--$> ldd cpp
libstdc++.so.2.10.0 => (file not found)
libm.so.1 => /usr/lib/libm.so.1
libc.so.1 => /usr/lib/libc.so.1
libdl.so.1 => /usr/lib/libdl.so.1
/usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1
grugq@chao :594 src}--$>

Unfortunately this is a difficult argument to have because the term "bloat" is so vague. Does bloat mean extra instructions that needn't be there, i.e.

call function
movl êx, êx
test êx, êx

Or does it mean additional overhead during processing? i.e.

foo = fopen("file", "r");
while(1) {
ch = getc(foo);
putc(ch);
...

vs.

foo = open("file", O_RDONLY);
while((n=read(fd, buf, sizeof(buf))>0) write(1, buf, n);

??? These aren't very easy to answer and will depend one who you talk to. There are advantages and disadvantages to both. The FILE interface is portable to whatever platform implements a compliant C library, while the file access primitives interface is portable to POSIX compliant systems. This isn't a problem if you code has to only run on a POSIX compliant system, but it does raise the only issue that is important in the bloat discussion: what do you want from your program.

I personally want my programs to get me chics in bars, thats why I use C and the POSIX interface! ;-)

For the sake of arguement I will posit that bloat is any resource (disk space, CPU time, etc) extranious to the intent of the program. This means that any instructions, libraries, .data, etc. etc. which don't *need* to be there are bloat. In this instance I would say that using C++ to print hello world is bloated, I would also say that there are times (though I have yet to encounter any) when C++ is the right tool for the job. On a finaly note:

grugq@chao :608 src}--$> cat main.sh
#!/bin/ksh
echo "Hello World"
grugq@chao :609 src}--$> ./main.sh
Hello World
grugq@chao :610 src}--$> ll main.sh
-rwxr-xr-x 1 grugq other 30 Apr 20 03:25 main.sh*
grugq@chao :611 src}--$>

--grugq.
Epic
04-20-2001, 10:05 AM
at http://www.research.att.com/~bs/homepage.html

Kind regards.
strayed
04-20-2001, 10:50 AM
mammon_ (04-19-2001 13:13):
… However, virtually all of the profes^H^H^H^H^H^Hcommercial IDEs for windows [and nearly all of the sample code, books, etc] are OOP-biased -- i.e. everyone seems to assume you are using C++ .

Give an example of modern IDE for UNIX that is not OO.

mammon_ (04-19-2001 13:13):
… The recognized alternatives are VB and Java…

VB – true, Java – false. You can more often encounter Java in UNIX world.

mammon_ (04-19-2001 13:13):
…C++ started as a preprocessor for C, and hasn't evolved much…

‘hasn’t evolved much’ - ???!!! No comments…

mammon_ (04-19-2001 13:13):
… C++ methods are the same as C functions; in fact, aside from the class notation and supporting language features [new() n' all that], you will be writing C code. Get good at it, or your code will suck.

Nothing can be further from the truth. IMHO, you missed the whole point. Oh, yeah, I see what you mean: as soon as one gets to the point of implementing a member function (this is the correct name; ‘method’ comes from Java world) this will be a good old C – right? But this is a final point of your journey in C++. There is a hell lot of stuff to do before that ;)

mammon_ (04-19-2001 13:13):
… Perhaps I have too dim a view of C++ coders ... but I've never known a good C coder who was a horrible C++ coder.It doesn't work like that the other way around.

You know what? I have a completely different experience :). C and C++ are *different* languages. That’s true that you can do C coding with C++ (C++ is a multi-paradigm language be it for good or not). Here is a rather common situation: C expert is told that his next project should be in C++ (for whatever reason) – ‘Heh, in C++? No probs! After all, this is just a C preprocessor.’. And then bad things happen…
BTW, the good example can be found at h**p://www.embedded.com/1999/9908/9908feat1.htm. If some of you guys consider yourself at least intermediate C++ programmer try to identify what’s wrong with that C++ code (try to find at least two flaws – one technical and one conceptual) – and do your best to forget about the suitability of C++ for this particular problem ;p .
Bottom line, in order to be a good C++ programmer one should change his flow of thoughts (if he comes from C world). And this change is rather dramatic… That is why I said that the path C -> C++ is a wrong one. Before breaking something down to look what’s inside it try to learn how to use it in the first place.

(to be continued)
strayed
04-20-2001, 10:51 AM
mammon_ (04-19-2001 13:13):
… Learning to implement algos and ADTs in C will teach you much about modular programming which you can easily miss in C++ lessons.

That’s funny but C++ (as a member of OO community) is specifically designed to express ADT concepts. And it does this much better than C. In fact, this is one of the main reasons of existence of C++ ;-) . Be patient and try to *learn* C++. Then maybe you’ll understand that ADT and modular approach are packed into the concept of … yeah, class. Once you discover that amazing fact you won’t treat class as just a ‘notation’.

mammon_ (04-19-2001 13:13):
… A class hierarchy is its own API [stress the 'interface' part there]; there is no real need to design good interfaces and modular code since the language does that for you.

I’m sorry, but my poor C++ mind didn’t get it.

mammon_ (04-19-2001 13:13):
… If you think you will never need to know programming design concepts, then please, forge ahead in your ignorance. More coders like you mean higher-paying jobs for coders like me ;)

I want to believe that this is not a personal assault ;p .

That having been said I’m not discussing the C++ suitability for RE purposes. Neither I want to fire a flame war. The initial question was about good C++ books. Let me stress this - the right tool for the right job.

To MO_K:

Try these two test cases:
1. Write a main with a single return only.
2. Do nothing (literally).

I believe you will be :o by simplicity and elegance of the second approach ;p .

regards,
strayed

P.S. Ah, just in case – I’m not Windows advocate.
mammon_
04-20-2001, 12:43 PM
I disagree.

See above.

_m
mammon_
04-20-2001, 12:48 PM
I disagree.

See above.

_m
grugq
04-22-2001, 08:09 AM
I agree wtih above.

peace,

grugq
Latigo
04-22-2001, 10:11 AM
Thanks again to everyone for your info!

Latigo


Attacks against my site
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Attacks against my site
PDA

View Full Version : Attacks against my site

CrackZ
04-05-2001, 06:30 PM
Greetings to all;

I apologise in advance for posting this on the main messageboard but I'm guessing the majority of experts look here if anywhere first and right now I need some help.

For the last 2 weeks my site has come under very heavy and sustained attack from lamer(s) attempting to halt the router using DoS attacks (sound familiar?), its a very simple method and as fravia+ found out, its not fun to try and defend against.

Unfortunately the attacks over the last 2 weeks (I hate to say it) have been pretty successful in bringing the router to its knees, sometimes killing the site for 12hrs a day (and they are still continuing :-( ).

With this in mind my first request is for any advice from those of you who have experience in dealing with this sort of problem. I can furnish more technical information as required.

On a second note, perhaps more importantly (I'm VERY angry) and I have a good idea who the individuals are behind this, since the attacks co-incided with the exact same day I started frequenting a particular IRC channel. Yes, I'll be sure to start my search in Germany.

I'll not issue any more veiled threats on this post, right now I just want to contain these morons, since they use pretty dull and unintelligent techniques, although I'm also pretty sure they read these msgboards too.

Any advice would be welcomed in the first instance.

Regards and thanks in advance (this applies to the many good people who frequent this board and the scene).

CrackZ.
Lord Crass
04-06-2001, 12:27 AM
Unfortunately, there isn't too much you can do personally. The best you can do is find out what you're being DoS'd with (ICMP, UDP, invalid TCP packets, etc) and contact your upstream provider. They should be able to contact the appropriate upstream provider that they use and relay the info to them. Essentially the traffic has to be traced back to it's origin one step at a time. As long as the DoS they are using requires obscene amounts of traffic or a bizarre packet type, it can be singled out amongst all the other traffic and the source pinpointed. You just have to hope that all the upstream providers will cooperate in order to track them down. If even one link in the chain refuses to help, you're screwed.

If you happen to know the source's service provider, simply talk to them instead. Any ISP should be able to determine if a DoS is originating from one of their customer's links assuming they have someone who knows anything about network monitoring.
tsehp
04-06-2001, 02:14 AM
Hi crackz, we can also try something very easy :
I have enough place here to temporary host you if you want, you
move the site here, update your links.
Believe me on this : this place's admins are very efficient against those sort of attacks.
mail me directly if you're interested.
regards,

+Tsehp
EB
04-17-2001, 09:03 AM
Hiya crackz,
checkout http://grc.com/r&d/nomoredos.htm
I saw something about DOS and stuff. Maybe it might be useful.

Regards
EB
fravia+
04-17-2001, 02:29 PM
Dear friend CrackZ,
in my (personal) experience such attacks are mostly performed by rogue crackers paid by dongle companies (read Haladdin in most cases :-).

Your best retaliating chances are NOT through reverse tracking (wont work coz one of the rings will always fail, alas)... in my opinion you will be better served trough social reversing approaches (luring, faking, stalking, see my actual site at searchlores.org for a starter on these aves)

I suggest you build a fake avatar, then play it loose for a while, offering a lot, then infiltrate, discover, punish, destroy.

Such an approach takes quite some time -sure- but, believe me, revenge is a speciality that tastes better if served cold... and believe me, the moment when you find out and locate them 'phisically' is quite a nice experience, ehehe... at vindicta bonum vita iucundius ipsa...

Many of those, among +Tsehp's readers, that have really useful sites (and will THEREFORE be attacked soon or later) will experience similar problems, as +Tsehp and many other +HCUkers have.

You should actually be proud. No real knowledge site has ever existed without being HEAVILY attacked soon or later.

Fravia+
CrackZ
04-17-2001, 09:08 PM
Greetings to Fravia+ & EB.

Just a very quick note of thanks to both of you for taking the time to respond, I'll be certain to follow up your advice :-) and I have a feeling its going to be quite a chase.

Regards

CrackZ.


Fravia
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Fravia
PDA

View Full Version : Fravia

thrax
04-05-2001, 08:04 PM
Hey all...I was just thinking about this the other day, but fravia+ is really quite a fascinating enigma...Before his "disappearence" (or rather, relocation and loss of interest in software), he was really the fuel behind the reverser scene...See, not only, during his time was reversing an art, but it was also a philosophy. He put real thought into it, and, while most of us do this, he PUBLISHED them...Now that he is gone, though we still have his old stuff, a lot of the fuel i feel is gone, and I begin to wonder, just exactly what it was that pulled him away from the software scene...His philosophies were so strong, too...
disavowed
04-06-2001, 08:39 AM
seemed like he just got bored with it all (which happens to many reversers after a long enough period of time)

anyone have any other opinions/facts?
+SplAj
04-06-2001, 03:22 PM
Hi Guys from sunny M????? - Tsehp have you found the bar i'm in ?

I happened to 'find' Fravia site back in 1997
and started my apprenticeship from those early tuts. I got the message before I left for the desert in mid 1998 that Fravia
was sick to death of lamers and the direction the site was going. 'How to crack this target' just got too damn boring and it seemed that only a few took the clue to DIY and not read VERBATIM that this is the way or that is the way to crack. He started us off , showed us how to use the tools, gave us a 'code' of ideology (A level ) and let us get on with it. Not that i ever got in the +HCU - cos I never tried, too shy }>

Thanks Fravia - Even though he did not publish my tute on SeNTry2020 disk encryption...

See the geat names there. Like Frogs, who
described the Meltice trick, I think he did a bit of programming from this idea ;) BUT I think he found out there is no vxd in NT4 ;)

ha well back to my Guinness.....

CYA soooon

SplAj
tsehp
04-06-2001, 03:25 PM
I'm not the one that knows Fravia the best, but we already have two meetings so we have to discuss this topic in the past.

You should not search behind his words or read between the lines when he spoke on the site of his september thoughts, he's got bored with rce and found that learning to search the internet is much more interesting.

Actually, there is some projects emerging from his site, common projects to search better the web, so you can browse his site and contact him, he's easy to find.

Disavowed says that some reversers get bored after a while, and I agree with this, but I wouldn't say bored, I'd like better to speak about evolution. To my part, this evolution means to improve my programming skills, especially in c++ so I could later move permanently to this, but like f+ staying behind the curtain.
nblender
04-07-2001, 12:41 AM
Reverse engineering covers a large number of areas, and
cracking software protection is only part of it. Figuring
out what evil blocking programs like Cyberpatrol block,
searching out what aurate/radiate spyware is up to, or the
RealAudio sack lickers are up to are all part of reverse
engineering. It's by reverse engineering that many evils
are exposed.

I too learned much by visiting Fravia's site. I think
that maintaining the tradition of releasing essays should
be continued.

I do think that learning about searching is very important
too. There's lots of good information that's out there.

Tsehp: you're doing a great job by keeping the mirror going :)
wutever0
04-09-2001, 08:45 PM
can someone tell me +fravia's site?...is it the one at www.instinct.com/fravia ? i tried to download it once using HTTrack but it was MAJOR BIIIIG.
also im a newbie and i didnt find many newbie tutorials there (mostly very advanced articles) but i have to admit that +fravia's site is very very very professional and looks like the fuel for TRUE reversers these days.
tsehp
04-10-2001, 07:13 AM
nblender (04-06-2001 22:41):
Reverse engineering covers a large number of areas, and
cracking software protection is only part of it. Figuring
out what evil blocking programs like Cyberpatrol block,
searching out what aurate/radiate spyware is up to, or the
RealAudio sack lickers are up to are all part of reverse
engineering. It's by reverse engineering that many evils
are exposed.

I too learned much by visiting Fravia's site. I think
that maintaining the tradition of releasing essays should
be continued.

I do think that learning about searching is very important
too. There's lots of good information that's out there.

Tsehp: you're doing a great job by keeping the mirror going :)

thanks a lot.

Sure this place happens to be very active because of cracker's visits and contribution, I'll never treat them as they were criticized like it was on recent ida support msgboard, as long as those guys remains
ethical crackers. Ethical cracking means to follow some simple rules, never mass spread a cracked app but keeping it for yourself, and cracking means to make sometimes a lot of re efforts to understand how does work several software protections.

This msgboard is also opened to guys/concepts dealing with general rce and not applied to cracking software, but people dealing with such technology will not usually contribute a lot, exposing their names, to cracking related places. I made everything to gather everybody here, refusing only elitism and sarcastic people, bringing nothing to this community and discouraging newbies in their self-evolution.

fravia is still the same guy as before, with the same approaches and still writing such a good essays, only the main subject has changed :
he's not dwelling with code anymore but interested by the global internet and how to search inside, and the main changes is that you don't have anymore such humoritic and concise essays about general subjects written by me, just because I really suck into writing such masterpieces, I prefer to remain silent and keep on programming rce tools, that's much better ;-)


Looking to Hire someone to help create a patch for anti cheat
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Looking to Hire someone to help create a patch for anti cheat
PDA

View Full Version : Looking to Hire someone to help create a patch for anti cheat

dsolis
04-05-2001, 10:57 PM
Hello. I am looking to hire someone to create a patch for Rogue Spear multiplayer online game. We play via www.zone.msn.com and There are 4 cheats going around that have made tournament play unbareable... too many cheaters. I am not rich but I am willing to pay someone a reasonable rate .... please no one that wants to get rich off of me . :) I have the two cheat patches that people use to enable themselves to cheat . Just in case you need them let me know ill send them to you.
spamal
04-06-2001, 02:46 PM
hehe if you accept money then it is called "Programming", not "Reversing"

Basically you are hosed unless they patch the server side. The problem is not in the cheaters, it is in the lazy server admins that leave the software holes open.

An extreme measure is to terminate the offender's TCP connection using nefarioius methods, but that is highly illegal, so don't do it!

If you search you can find better alternate servers.
dsolis
04-06-2001, 03:28 PM
With this game you log onto www.zone.msn.com and then someone hosts a game . All 16 players are on our hosts server. Why cant we make them download something in order to play on our server that would not allow them to cheat?


Help!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help!
PDA

View Full Version : Help!

Stony
04-06-2001, 10:10 PM
Hi,

A freshmen is looking forward your kind help. the problem is that command ' bpx hmemcpy' cann't hold back the register error. though the command 'bpx MessageboxA' do work, the program is already out of registration. Then how can i find the line which the 'USER32|MessageBoxA' ?

Thanks

Stony
mo k
04-07-2001, 02:56 AM
try the newbies page, and restate your problem
clearly.
They are enthusiastic about helping newcomers,
so explain to them your problem.

Peace


Get some e-books here
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Get some e-books here
PDA

View Full Version : Get some e-books here

Solomon
04-08-2001, 04:58 AM
h**p://pcbook.51soft.com/ebooks/index.asp


New revirgin 1.10 major update
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New revirgin 1.10 major update
PDA

View Full Version : New revirgin 1.10 major update

tsehp
04-09-2001, 03:09 AM
Download at tsehp.cjb.net

added (and tested) support for safedisc 2, it will also auto realign your dump and paste the it.bin file at the end.

safedisc 2 games that were revirginized :
red alert 2
nolf
f1rc

and also the safecast trial you can download at macrovision.com

You cannot ask me how this works, there are much much threads/topics about my tool on this msgboard, but I'm available to debug the new version, it was beta tested by r!sc and me but it surely needs some more test, about 25 % of code was rewritten.

regards,

+Tsehp
Lord Crass
04-09-2001, 08:09 AM
Nice piece of work! The mangled option is very interesting. Unfortunately, my Win9x version is not supported by the tracer! Any future plans for supporting Win98SE (4.10.2222A)?

Is much work required to reconfigure the tracer to work under other Win versions?
risc
04-09-2001, 09:45 AM
hi, ltns . you securom freak ;-)

i got 4.10.222A .. and the tracer works .. make sure u got thread.dll in %windir% or whatever it says .. or was it tracer.dll ...

revirgin supports all windows but 95, i think ..
tsehp
04-09-2001, 02:39 PM
risc is right, but I have to advertise on this on the readme + site page,
tell me if it still doesn't work after crushing the old files, tracer and thread were rewritten.

I'm actually debugging the tracer to make it work with hitman (sd2).

If I have not too much work debugging this new version, I'll begin to adapt the tracer for revirgin to find the app's OEP, but I have to do some speed tests, if it goes more than 50% slower than icedump's tracer, I'll give up this option.

take care,

+Tsehp
Lord Crass
04-09-2001, 08:35 PM
Yes, I have the file in the windows\system dir (although shouldn't it still work being in the same directory as revirgin since the current dir is part of the dll search path?)

It performs three searches on functions to check if the win version is compatible. The first two pass okay, but the last one (a search through IFSMgr I think) fails and up pops the message that the tracer can't be used with this version of win9x.
tsehp
04-10-2001, 07:00 AM
Lord Crass (04-09-2001 18:35):
Yes, I have the file in the windows\system dir (although shouldn't it still work being in the same directory as revirgin since the current dir is part of the dll search path?)

It performs three searches on functions to check if the win version is compatible. The first two pass okay, but the last one (a search through IFSMgr I think) fails and up pops the message that the tracer can't be used with this version of win9x.

Ok lord, I surrender :-)

send me the target on my usual e-mail, I'll fix this.
Lord Crass
04-10-2001, 10:49 AM
This message pops up as soon as I run revirgin. It doesn't matter what program I'm attempting to trace. Revirgin won't give me the option of tracing anything. What did you want me to send you?
iceagle
04-11-2001, 01:17 AM
risc (04-09-2001 07:45):
hi, ltns . you securom freak ;-)

i got 4.10.222A .. and the tracer works .. make sure u got thread.dll in %windir% or whatever it says .. or was it tracer.dll ...

revirgin supports all windows but 95, i think ..

But revirgin doesn't support winnt4,which doesn't
support toolhelp functions.
sigh...
tsehp
04-11-2001, 04:11 PM
Lord Crass (04-10-2001 08:49):
This message pops up as soon as I run revirgin. It doesn't matter what program I'm attempting to trace. Revirgin won't give me the option of tracing anything. What did you want me to send you?

This message comes from the main program that doesn't manage to patch your win version, send me your kernel32.dll compressed and I'll fix this.
tony b.
04-11-2001, 07:13 PM
Sorry for potentially newbie questions, but...

What tool(s) do you personally use to get a good dump of SD2 to revirginate (procdump, icedump, ...)?

Is Icedump enough to bypass the SD2 anti softice under W9x? Because without Icedump, I get "unload debugger," but with Icedump, "insert correct CD." I am wondering if there is more anti softice after that last nag. (I don't have any SD CD's, but I'm experimenting with the old Ra2.zip and decryption key that r!sc posted here months ago.)

Best regards,

t.b.
Lord Crass
04-11-2001, 07:51 PM
Ah, I just realised, it may not be getting my win version properly because the kernel32.dll was modified by icepatch some time ago. Could this be the cause? I'll email you the kernel32 file as well.


Further info
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Further info
PDA

View Full Version : Further info

Hoof Arted
04-09-2001, 04:54 PM
In my quest to figure out why my w32dasm is not working on windows 2000 SP1, I have tried to debug it with the Windows Debugger and w32dasm causes the following error. I would presume that this is the cause of the crash.

Access violation - code c0000005 (first chance)
*** WARNING: Unable to verify checksum for w32dasm.exe
*** ERROR: Symbol file could not be found. Defaulted to export symbols for w32dasm.exe -
eax=00000000 ebx=00700fca ecx=fffffffd edx=fffffffe esi=0065c034 edi=00000001
eip=0044bb74 esp=0065bff0 ebp=0065c00c iopl=0 nv up ei pl nz ac pe cy
cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00010213
w32dasm!_GetExceptDLLinfo+4ab00:
0044bb74 c6441e0220 mov byte ptr [esi+ebx+0x2],0x20 ds:0023:00d5d000=??

Does this mean anything to anyone? How can we solve this problem?

Thanks for the help

Hoof
Hoof Arted
04-10-2001, 05:38 AM
More investigation has provided the following :

The problem seams to be with the code located here :

0044BB74 |> C6441E 02 20 MOV BYTE PTR DS:[ESI+EBX+2],20
0044BB79 |. 43 INC EBX
0044BB7A |> 8B4D 18 MOV ECX,DWORD PTR SS:[EBP+18]
0044BB7D |. 49 DEC ECX
0044BB7E |. 3BD9 CMP EBX,ECX
0044BB80 |.^72 F2 JB SHORT W32DSM89.0044BB74

At this point, the registers reflect the following :

ECX = 9EFF8E00
EDX = 9EFF8E00
EBX = 5E (Started at 0)
ESP = 0065DB24
EBP = 0065BD40
ESI = 0065BD68
EDI = 00000001

I could be wrong here but looking at the code snip, I would say that it would be a very long time until EBX >= ECX.

Any info ?

Hoof


CAN YOU REVERSE THE MDE FILE FROM ACCESS 97 ) - :
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CAN YOU REVERSE THE MDE FILE FROM ACCESS 97 ) - :
PDA

View Full Version : CAN YOU REVERSE THE MDE FILE FROM ACCESS 97 ) - :

Scottish_Newbie
04-09-2001, 08:23 PM
Having setup a company with a clever guy, we developed software which was sold on licence, he left Scotland but not before creating the MDE Database which contains the code I need to alter to sell the full package, question is can it possibly be reverse engineered and could someone take it on as a project I am desperate to get this thing back on the road. (see attached file)

Best regards from Scotland.

Gary Dolan (keep up the service people it does make a diff to people like me) !!!!!!!!!
Epic
04-13-2001, 09:28 AM
I'm sure also you can do it, try a web search.

BTW, I can't believe that yours is a real thread. What a lame.


"British firm develops 'unbreakable' polymorphic encryption"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > "British firm develops 'unbreakable' polymorphic encryption"
PDA

View Full Version : "British firm develops 'unbreakable' polymorphic encryption"

disavowed
04-10-2001, 09:05 AM
http://www.computeruser.com/news/01/04/09/news12.html
http://www.bit-arts.com/
qferret
04-10-2001, 02:50 PM
hmmmm.......wonder why we can't download the eval copy w/o telling them exactly who we are? ;-)
Kilby
04-11-2001, 04:09 AM
Hmmm,

they don't appear to have a demo version of it at all.

As a thought Disavowed could have raised more interest by placing Bit-Arts in the title.

Still I have found a new thing to play with, their MP3 delivery system :)

Kilby...
+SplAj
04-11-2001, 04:23 AM
OMG this CANNOT be Bi-Tarts 'Titanium' cos it's cracked within 10 mins of me receiving the evaluation 2 months ago. Even your stupid RED BOX - warning in the 'mutant' is gone ;)
.........$999 CRAP.

Also I made ASM key gens for me , myself and I (Tsehp reminded me of the 'moral issue' of keygens for joe public) from the Titanium algo. But now they use a stupid e-business registration method but you can still unpack the fusion2, cruch2, trialcrap, etc etc so they have not released any targets for US to play with wrapped in a polymorphic mutant, cos they are SCARED. Don't bother talking to them they just fill yer e-mail with prono !

Come on Bi-Tarts show us yer new 'mutant', bring him on.....

SplAj

BTW disavowed did you not see the titanium.zip on the server for a few months ??? it's gone now.
SpeKKeL
04-11-2001, 08:07 AM
Hajo,

I spend some time in cracking their trialwrap program
but no results ...
Made some dumps after the"purchase/continue" message
oep:401000 ? and no damaged Iat ?
Still not working ,any idea's ?

Spekkel
+SplAj
04-11-2001, 10:16 AM
Hi SpeKKel

I had the DeveloperSuite from a week or so ago, maybe something changed, but my trialwrap (build 5.1.0.0) target has IAT at 134000 and OEiP 401000 (bytes there ;-A124654F00)

Make sure you catch the FULL IAT+IAT at 5134000 and dump it
with peditor 1.7 (last API is VariantCopyInd)

See my attached .bin file and paste into raw 134000 and set the IT address to 134000 and do the rebuild with PEditor1.7

I DL Crunchv2 just now and will try that, but the procedure should be the same.

SplAj
+SplAj
04-11-2001, 10:44 AM
Hi , Just DL Crunch2EU (like i'm gonna pay TAX !!!)

the procedure is exactly the same 10mins to dump + rebuild.

IAT/IT at Raw 221000 (VA 621000) OEiP 401000. Copy+paste vanilla dumping with PEditor.

baa
SpeKKeL
04-11-2001, 03:15 PM
Thanks for reply

Strange>> my computer crached (happens all the time)
But i suddenly got the message that my trial was expired...
Set some breakpoint on cslid (regqueryvalueExA) etc but can't trace were it puts it expire info so i have another
problem.I' am going to try some other bpx's

see you later....Spekkel......
+SplAj
04-12-2001, 04:20 AM
Greetings

Yes Bi-Tarts are FISHING, they watch the forums and crack sites 24/7, paranoid that newbies DARE crack their shits....

In the current economic downturn for tech stocks I bet they wished they did sell out to M$oft last year when they were approached, cos nobody (reversers) took much notice of Bi-Tarts then.

Now their shits are unpacked, keygened, and all VXD tricks and the stupid time system in netdet.ini and the registry root are well known......... and once you unpack the shits its a ONE BYTE patch to make them == registered ! :o

So , I repeat, bring your polymorphic mutant to the table, never mind the 'professional' services of ZDnet. If they can't crack Titanium in 3 days and we can in 10 minutes.............
say no more, and please no more stupid prono in my e-mail
my hand hurts............................. with deleting them }>

SplAj
+SplAj
04-12-2001, 04:24 AM
Greetings

Yes Bi-Tarts are FISHING, they watch the forums and crack sites 24/7, paranoid that newbies DARE crack their shits....

In the current economic downturn for tech stocks I bet they wished they did sell out to M$oft last year when they were approached, cos nobody (reversers) took much notice of Bi-Tarts then.

Now their shits are unpacked, keygened, and all VXD tricks and the stupid time system in netdet.ini and the registry root are well known......... and once you unpack the shits its a ONE BYTE patch to make them == registered ! :o

So , I repeat, bring your polymorphic mutant to the table, never mind the 'professional' services of ZDnet. If they can't crack Titanium in 3 days and we can in 10 minutes.............
say no more, and please no more stupid prono in my e-mail
my hand hurts............................. with deleting them }>

SplAj
ZenLoren
04-12-2001, 04:59 AM
Greetings to all

> Yes Bi-Tarts are FISHING, they watch the forums and crack sites
Yes! 100% correct proof the below site http://www.vnunet.com/News/1120202

John Safa must have got the url from this forum or _m forum &
now shouts at above site.

Just a small copy paste of the saying from above site

John Safa, a former cracker and CTO of security vendor BitArts, said: "The cracking community now has a C# decompiler, which unravels application code. If you got on the inside of a network using this tool, you could do anything."

zenloren
SpeKKeL
04-12-2001, 06:09 AM
Thanks Spaj,

Now again i have 30 day's to unpack ,
should be enough......(.i think )
SpeKKeL
04-13-2001, 02:59 AM
Yep

No problem after all > Trialwrap like a virgin, even by me!!

Thanks to The great " + " 's and their tools

Greetz Spekkel.......
SpeKKeL
04-13-2001, 07:31 AM
Also "de-crunched" crunchv2 > took me somemore time
I noticed that the way you dump your prog. could make some great differences:

After pasting the IAt'

-dump with trw2000 gave memory exception errors.
-dump with procdump > can not load hownolock.dll ???
-the only working dump was done with peeditor like splaj
said....

SpekkeL
Zig
04-14-2001, 09:15 AM
Hi,

i having trouble getting trial-wrap to produce working (not evaluation) output exe. i have unpacked the main program and everything seems to be ok (i thought this was meant to be the hard bit ;-), bi-tarts doco is very mis-leading!). It still produces a working bitarts_evaluation.exe as expected. i have tried to make patch to produce registered output.exe's and it would seem that it worked... until you try to run them. the standard trialwrap rego box appears when you run out.exe, but clicking "continue" (to evaluate protected app) will display "Error starting program" from out.exe's trialcrap loader.
I know this isnt enough info for a straight out answer. But hopefully someone out there with some bi-tart experience (kilby, splaj?) can give some pointers on what to look out for.

thanks,
Z

btw, i have version mentioned in posts above
nblender
04-14-2001, 10:12 AM
+SplAj (04-12-2001 02:20):
Greetings

Yes Bi-Tarts are FISHING, they watch the forums and crack sites 24/7, paranoid that newbies DARE crack their shits....

SplAj

I think they're probably making the big claims to drum up
sales rather than because they think that their protection
is unbreakable -it's kind of like the claims that with a few
short classified ads, you can make your fortune! It
doesn't matter if the protection sucks pond water as long
as unsuspecting software developers purchase their product.
If it keeps having to decrypt code in memory, that has to do
wonders for the product performance too. I think that
claiming that their product is unbreakable with evidence to
the contrary indicates that Bi-Tarts are making fraudulent
claims and should be reported to various consumer agencies.
Zig
04-14-2001, 10:49 PM
wouldnt you know it, i had another go only minutes after making last post and must have found the correct place to patch in 2 minutes flat ;-). thanks anyways... i can only agree with the above post ;-)

Z


Bit-Arts are boasting and lying have a look
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Bit-Arts are boasting and lying have a look
PDA

View Full Version : Bit-Arts are boasting and lying have a look

Kilby
04-11-2001, 04:31 AM
Appologies regarding poasting a message to point to another message on this board.

But I feel the subject may be overlooked if I don't

Have a look at Disavoweds, message regarding
"British Firm develops Unbreakable Polymorphic Encryption"

Many of us have a real problem with Bit-Arts.

Not cracking their stuff but their attitude and lies.

Here is a quote from the computer user article,
--------------------

To date, the firm says that its products remain uncracked by attempts from the cracking community as a whole, and several world renowned testing laboratories.

--------------------

That isn't exactly true is it :)

I feel a grudge match developing :)

Kilby...
JimmyClif
04-11-2001, 05:35 AM
Of course they are lying... what would be the point saying the truth?
After all it's a business and they need the customer who eats lies out of their hands...

I feel a grudge match developing

Wasn't Bit-Arts getting shred to pieces a few months ago? I don't remember the context but it was of a published crack somewhere...
SpeKKeL
04-11-2001, 07:59 AM
H'm Any of you had some experience with their programm:Trialwrap ?? cause it is troubling my brains !!
Made some dumps after the "purchase/continue message" but till now anything fails...
think the oep is 401000 and didn't notice an damaged
iat.

SpekkeL
woodmann
04-11-2001, 03:24 PM
Bit-Arts must be fishing for something. I find it strange they would talk big shit and not allow you to download something to evaluate.
Peace, Woodmann
tsehp
04-11-2001, 04:06 PM
SpeKKeL (04-11-2001 05:59):
H'm Any of you had some experience with their programm:Trialwrap ?? cause it is troubling my brains !!
Made some dumps after the "purchase/continue message" but till now anything fails...
think the oep is 401000 and didn't notice an damaged
iat.

SpekkeL
splaj and me made some past tests with revirgin applied to titanium from bi-Tarts , no problem ever. Easy dumps and easy resolve, maybe it's time for us to apply for a job in their company ;-)

I don't see what's the problem with their advertisement, sure their product remains uncracked, we simply remove it entirely from the target :-)
Kilby
04-12-2001, 07:15 AM
I just find it strange about such a large lie.

So pardon my thoughts in this Email, I appear to have been reading way too much Robert Anoton Wilson.

I could see them claiming that their product was difficult to crack (hmmmm), or that it slows down crackers so much (hmmmm), but to be so boastful.

It looks like thay are trying to land themselves in the brown and smelly, big time.

I assume that this has a lot to do with their MP3 product (with napster being in the mainstream press regularly).

As for polymorphic code, which is constantly changing 'while it is running', that also sounds like crap to a certain extent.

These are my thoughts on that point ;)

1:Normal self modifying code, which possible due to the amount of honesty thay appear to have

2: Something like the old RNC protection on the Amiga where, large blocks of encrypted code existed (these all had to be illegal instructions)

Therefore the following process occured

a: illegal instruction is executed
b:the exception vector points to a decrypt routine
c: the instruction is decrypted and executed
d: exception routine is exited
e: next instruction is executed (so back to point a)

Oh yes Bi-Tarts I want that performance hit on my applications, it will meake me really happy.

or

3: The app IS constantly modifying itself, therefore eating processor cycles.

Oh yes Bi-Tarts I want that performance hit on my applications, it will meake me really happy.

This brings an interesting thought however for point 3,

If the code was constantly being modified but all code would have to be valid hence a dump would work anyway :)

However another thought comes to mind, if that is really happening then actual instructions could be used to fingerprint the dump ;)

If either 2 or 3 are true then I suggest that Intel and AMD own Bi-Tarts, and want to force us to upgrade our processors.

Regards,

Kilby... the ever happy !
Lord Crass
04-12-2001, 07:35 AM
Ahh, Amiga/ST 68000 protections! I remember that one. They also had a trace vector decryption routine where they put the decrypt algorithm at the trace vector address, then stuck the CPU into trace mode for a few hundred instructions or so.

Lotsa fun..


InstallShield script Decopiling v 6.xx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > InstallShield script Decopiling v 6.xx
PDA

View Full Version : InstallShield script Decopiling v 6.xx

karakochev
04-11-2001, 11:58 AM
Does anybody know something about decompiling IS - (may be some ideas )v 6.xx
Anticode
04-12-2001, 03:01 AM
karakochev (04-11-2001 09:58):
Does anybody know something about decompiling IS - (may be some ideas )v 6.xx

There is one called "isd" at http://nekosuki.virtualave.net/
karakochev
04-12-2001, 07:04 AM
10x


How to import new API:s to a program?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to import new API:s to a program?
PDA

View Full Version : How to import new API:s to a program?

-[Z]-
04-12-2001, 01:03 PM
How to import new API:s to a program?
JimmyClif
04-12-2001, 01:26 PM
Read Neural's essai about Notepad reversing (excellent!) @ neudump.cjb.net
[Thanks nu, you got me hooked on win32asm]

There you will get a link to a code snipped taken from a virii code called COMPILED_SCANNING_CODE where he explains how to use it...

Do the whole tut... you won't regret it ;)

that's nuff for today..
JC
-[Z]-
04-12-2001, 03:41 PM
Nice girl too:)
Harlequin
04-12-2001, 07:39 PM
Here are a few more:

h**p://www.woodmann.net/fravia/W32QEdit.htm
h**p://www.immortaldescendants.org/database/essays/yates/Import_tables.txt
h**p://oberon.spaceports.com/~codeinj/tutorials/group4/hal_Shield.htm

Checkout Extasy's essay @
h**p://biesvaren.leidenuniv.nl/~reverse

you should try having a root about in Krobars other section here:

h**p://whateverhosting.com/krobar/other1.html
Clandestiny
04-12-2001, 09:02 PM
You also might want to check out 2 proggies at protools.cjb.net

1) IDDKing
2) Iczelion's Snippet Creator

They can both be used to add new functions into the import table. Reading the tuts is of course good advice as well ;-)

Regards,
Clandestiny


reverse of xor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > reverse of xor
PDA

View Full Version : reverse of xor

__DuDu__
04-13-2001, 01:12 PM
Hi !!

whats the reverse of XOR ?

my problem is :

a number xored by another one == 6C
what are these 2 numbers ? how can i find them ?

Regards
DuDu
davy jones
04-13-2001, 01:40 PM
hmm, u cant .. u can xor 6Ch with ANY number you like, and then u will have two numbers to create 6Ch .. but without knowing the first or second xor, u cannot get the original numbers..

x xor 6c = b == b xor x = 6c ... . ? xor ? = 6c .. not possible to calculate the original values ..

10 xor x == 6c . u can calculate x .. x xor 10 = 6c, u can calculate x ...
mike
04-13-2001, 03:12 PM
xor is just addition in a galois field. Your question is like asking what two numbers add up to 6c. That's one equation with two unknowns, and is therefore underdetermined. For example,

0 XOR 6C = 6C
1 XOR 6D = 6C
2 XOR 6E = 6C
3 XOR 6F = 6C
4 XOR 68 = 6C

etc...

If, however, you know two of the numbers, you can calculate the third. XOR is its own inverse, so you can use it like this:

? XOR 25 = 6C
? XOR 25 XOR 25 = 6C XOR 25
(these cancel)
? = 6C XOR 25 = 49
-newbie
04-13-2001, 03:52 PM
"galois field"... lol :D dude, i dont think i'm up to that maths level, but asking to reverse xor is like asking to reverse addition. u cant get a or b from a xor b, just like u cant get a or b from a+b. thats how i think of it at least.


help fully unpack NeoLite plz... (newsbin pro)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help fully unpack NeoLite plz... (newsbin pro)
PDA

View Full Version : help fully unpack NeoLite plz... (newsbin pro)

drak0
04-15-2001, 01:58 AM
Hi,

I can't seem to get an unpacked version of newbin to run! ( http://www.newsbin.com/cgi-bin/fcount.cgi?nb331b6.zip ) I unpacked it fine (oep: 44c41f)... but when I run the dumped version it says "The application failed to initialize prperly (0xc0000005)..."

The app just ran in the tutorial that I read about neolite 2.0.

I dumped it w/ PEditor 1.7.

I was thinking that the IT was hosed... but I can't find the IAT start/length... I have only seen tuts about asprotect...

Well... i'm tired and will look again tomorrow...

Thanks in advance!

-drak0
Kayaker
04-15-2001, 05:46 AM
Hi,

I think the reason for the error is a dump with PEditor is a memory dump after the program has started and certain values have been initialized, etc. You should do a raw dump of the file at the end of unpacking code with Icedump.
/DUMP 400000 [size of image] [filename]
Then use PEditor to change the OEP and use its Dumpfixer option. This should give a working program.

If you compare the 2 dumps you'll see that there are several differences in the .data section starting at Virtual Offset A8000. You can replace the already written-to .data section of the PEditor dump with the virgin one from the raw dump method to prove this is the problem.

The Imports aren't encrypted with Neolite and the program should run fine as dumped, but if you want to see them with PEditor or W32Dasm, you need to change the RVA of the Import Table to the real one, not the one pointed to in unpacking code. This is an address in the Optional Header that points to the Image_Import_Descriptor (IID) table, a set of 5 DWORDS that gives information about each dll. One way to find this address is to do a hex search for the starting address of the IAT, which is at 89000, the beginning of the .rdata section. If you search for "009008" you'll land in the middle of the IID table. Find the starting address offset for this table and change the RVA and size of the Import Table as shown in PEditor to the correct values (A4F90 and 104) and you should see the proper Imports in a disassembly.

Kayaker
drak0
04-15-2001, 09:24 AM
Hi Kayaker... let me explain exactly what I did and you can tell me if it's wrong or not....

Kayaker (04-15-2001 03:46):
Hi,

I think the reason for the error is a dump with PEditor is a memory dump after the program has started and certain values have been initialized, etc. You should do a raw dump of the file at the end of unpacking code with Icedump.
/DUMP 400000 [size of image] [filename]
Then use PEditor to change the OEP and use its Dumpfixer option. This should give a working program.

Ok, at first (because I didn't know it was neolite) I did a 'bpx getversion' and when the target broke, i scrolled up and there was the OEP. I did a 'bpm 44c41f x' and reran the program ==> it broke at the OEP. i then changed the code to 'jmp eip' (but i wrote down the values that I over wrote). I got out of SI and did a full dump with PEditor. I opened the dump w/ hiew, went to offset 4c41f and changed the 2 bytes back. And finally I changed the entry point of the dump.exe.

That should give me a working dump right???? that's the same thing as using icedump right? I would use icedump but i'm using win2k and SI from the new driver studio... and when i patch ntice.sys, reboot, and fire up SI, I get a BSOD :(

As far as the other stuff you said... i'm going to have to read that again :)

Thanks!

-drak0
SpeKKeL
04-15-2001, 02:07 PM
Hi DraK0

Try trw2000 > bpx 44c41f > makepe > fully unpacked and just run fine......(957kb)

SpeKKeL
drak0
04-15-2001, 03:43 PM
SpeKKeL (04-15-2001 12:07):
Hi DraK0

Try trw2000 > bpx 44c41f > makepe > fully unpacked and just run fine......(957kb)

SpeKKeL

hi spekkel,

I would love to try TRW2000... but there is NO nt support (win2k sp1) :( I don't get why the hell this is being so difficult...

the dump i make w/ pedump is 944kb and w/ procdump is 916kb i believe....

this should work???

-drak0
drak0
04-15-2001, 03:47 PM
Oh yea, I also dumped with the new version of NT ice dump... and got the exact same results as w/ PEditor (after i realigned the sections w/ 'dumpfixer')

:(
goatass
04-15-2001, 03:50 PM
sup drak0 :)

Well I haven't looked at the program but it seems like something similar to what Kayaker said, the error you are getting doesn't look like an error from a bad pe header or executable. Try breaking on the messagebox that gives the error and see what calls it and try to figure it out from there.

goatass
Kayaker
04-15-2001, 11:03 PM
Hi,

I did a dump as you did by setting a 'jmp eip' at the end of unpacking code and dumping with PEditor and, not surprisingly, got an identical working dump as when doing a raw dump with Icedump. Sorry, I hadn't realized from your 1st post that you had done it this way, I thought maybe you had done an image dump after the program had started and this was the cause of your problem.

So it sounds like this might be a Win2K specific problem and you need to scope it out on your system as goatass suggests.

Regards,
Kayaker


Recognizing valid code sequences in .text section
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Recognizing valid code sequences in .text section
PDA

View Full Version : Recognizing valid code sequences in .text section

nblender
04-16-2001, 10:30 AM
Hi,
Currently I have a requirement to detect valid x86 code
sequences for a bruteforcer. Does anyone have any suggestions
for detecting valid code sequences? False positives are
a problem because it slows the process down, but some are
OK.

Thanks for any help you can provide,

--nb.
Kayaker
04-16-2001, 11:43 AM
Hi,

You could try LDE32, a Length-Disassembler Engine. LDE32 is a library which may be used to determine length of any x86 instructiion, i.e. to provide partial disassembling.

SV gave me the heads up on this one, so full credit to him. It can be used to extract valid code sequences from redirected API calls for example, so it might suit your needs.

Hard to find, but I finally dug it up at
h**p://www.geocities.com/hfxiov/polymorphic/ide32.zip

Kayaker
nblender
04-16-2001, 03:40 PM
Kayaker (04-16-2001 09:43):
Hi,

You could try LDE32, a Length-Disassembler Engine. LDE32 is a library which may be used to determine length of any x86 instructiion, i.e. to provide partial disassembling.

SV gave me the heads up on this one, so full credit to him. It can be used to extract valid code sequences from redirected API calls for example, so it might suit your needs.

Hard to find, but I finally dug it up at
h**p://www.geocities.com/hfxiov/polymorphic/ide32.zip

Kayaker

Thanks muchly - I'll have a look :)
disavowed
04-16-2001, 11:19 PM
that guy used some interesting var names:
(from disasm.inc in the .zip):
"test ebx, C_FUCKINGTEST"
Latigo
04-17-2001, 10:50 AM
Kayaker (04-16-2001 09:43):
Hi,

You could try LDE32, a Length-Disassembler Engine. LDE32 is a library which may be used to determine length of any x86 instructiion, i.e. to provide partial disassembling.

SV gave me the heads up on this one, so full credit to him. It can be used to extract valid code sequences from redirected API calls for example, so it might suit your needs.

Hard to find, but I finally dug it up at
h**p://www.geocities.com/hfxiov/polymorphic/ide32.zip

Kayaker

Good! this is what i was looking for :)
Thanks!

Latigo


softice 4.04 nt/20k + loader = proublem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > softice 4.04 nt/20k + loader = proublem
PDA

View Full Version : softice 4.04 nt/20k + loader = proublem

larry h
04-17-2001, 08:04 PM
With softice loaded i have no functional proublems. It goes in and out of service with the ctrl-D button.The trouble comes when I use the loader ,it opens but to translate i get errors. Do I need something more?. What about symbols where and how to use them. Also when I ctrl-D into SI and use Task I get "no LDT" when I type hwnd I get
"can't find windows desktop. Is it how I'm loading it or the lack of some files.
please help me....
larry h
-newbie
04-18-2001, 12:57 AM
what you are seeing is normal... when you use the loader and the module has no symbols, you get a harmless error you can ignore. you can use symbols with your own executables if you compile with the right options and translate the symbols in the loader, as explained in the numega dox.

as for task, well, under nt this only gives 16 bit tasks if there are any, and only for a wow (windows on windows) process. better use addr or proc. for hwnd, you need to be in some context that has actual windows... try something like 'addr explorer' to switch to the explorer context and then type hwnd.


+Tsehp,some things about revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > +Tsehp,some things about revirgin
PDA

View Full Version : +Tsehp,some things about revirgin

?????
04-17-2001, 11:26 PM
as I got the lastest version, I did't know how to use some new funciton.
1. Nb import. What's that??? what can it do?
2. Tracer buttom. If I push that bottom, I can only see a big wall, nothing on it,just a big wall.how can I use the function???
Regards!
tsehp
04-18-2001, 02:27 AM
????? (04-17-2001 21:26):
as I got the lastest version, I did't know how to use some new funciton.
1. Nb import. What's that??? what can it do?
2. Tracer buttom. If I push that bottom, I can only see a big wall, nothing on it,just a big wall.how can I use the function???
Regards!

1-nothing do to, it's just an counter
2-it's a future function, actually under dev ;-)


Sentinel Inquiry
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel Inquiry
PDA

View Full Version : Sentinel Inquiry

madmax!
04-18-2001, 04:19 PM
I just came across an app with the now well documented Sentinel LM protection, with the rainbow activator as well (Hyperchem 6.03 if your curious)...I read the essays from last year about messing with the license files, but restoring the EXE to original condition was so easy for this app! simple pedump w/icedump and fixup exitprocess reroute...are all sentinel protected proggy's like this or is it just this implementation?!?

madmax!
(nice board you guys have here btw)
goatass
04-18-2001, 05:40 PM
yeah it's just this particular implementation, I've seen other much more complicated then this one. The actual protection system is weak so it's not gonna be all that hard no matter how it's implemented but there are other additional things that can be done to make life a f**king nightmare.

goatass


Peer review...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Peer review...
PDA

View Full Version : Peer review...

Ryan
04-19-2001, 07:40 AM
Hi crackers,
I was recommended by a friend to approach this board because of the gathering of crackers or reversers. Basically, I have written a little protection program (activeX) to be used by visual basic programmers. It is similar to vbolock and others.

The point is, I would like to have your opinion on this ocx that I wrote. At the moment, there is only the demo version because I have yet completed the full version which is available upon registration. I don't want to boast about how good or well protected this ocx is because I am not a cracker and I don't know how well it will stand against attacks. I don't believe in selling snake-oil. If this ocx turns out to be rubbish, I will just remove it from my website and think of something else. So, please give me your honest opinion.

And one final thing, I am not sure how much to charge users. The reason why I charge users for this ocx is because they will be charging others. All other programs of mine are free.

It is packed using UPX just to make it smaller. Nothing is changed in the header and you can unpack it easily with upx itself

Name of program is RTReg.
URL for it is http://rtsoft.cjb.net

Thanks!
Ryan

Hope I am not asking too much.
goatass
04-19-2001, 12:41 PM
Hey there, I personally don't do this often but if you want to supply us with a program that uses your protection that would be very useful instead of having us (me) install VB and create a test program.

Another thing, this is off your web site:
"Impossible to unlock the FULL VERSION without the correct registration code"

Nothing is really impossible to break.

goatass
goatass
04-19-2001, 12:45 PM
sorry, I just looked the zip file and there is a demo in there, ma bad.

goatass
Ryan
04-20-2001, 04:25 AM
Hi,
thanks for showing interest. Like I said, I am not sure how well the protection is employed and thus, have not actually started selling it. In the demo.zip file, there is a demo exe compiled to use the ocx. Everything that is required is in the zipfile including the key generator. :)

Hope you can tell me if it is possible to get a FULL Version without using the key generator and the Program Code used.

Thanks again.


Help patch SoftICE (nt version) please :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help patch SoftICE (nt version) please :)
PDA

View Full Version : Help patch SoftICE (nt version) please :)

drak0
04-19-2001, 03:58 PM
Hi,

I am using the version of ntICE from DS2.0.1 and nothing works to hide it from evil packing programs (or anything else that wants to find it)

Well, from what I gather, it's pretty easy to hide SiwvidStart in siwvid.sys and NTICE in nmtrans.dll... all you have to do is change the values in a hex editor right??

Well, I was looking at a program called Detect.exe (part of nticeset) and it tells the various ways it can detect NTICE... well, how on earth do I patch:
1. Back Door Interface
2. Int3 on UnhandledExceptionFilter
3. Int1

are there other ones i'm missing? is there any literature on this? i was unable to find any...

Any help would be appreciated....

Thanks,
Drak0
SplAj
04-20-2001, 05:26 AM
Hi

use EliCZ macro set for 405 !!!! and type in the 'hide' commands (PNTICE / PUHF / UINT 0 1 / PBCHK bla bla)
rather than patching the files - VERY dangerous after version 4.01. cos 4.05 gave all sorts of shit , that pntice.ini is a nice conundrum ;)

Play a safe game of hide and seek }>

NB:-
I posted the macros in the newbie MB a few weeks ago BUT you must have them if you DL Pntice and Nticeset ???

+SplAj
drak0
04-20-2001, 10:10 AM
SplAj (04-20-2001 03:26):
Hi

use EliCZ macro set for 405 !!!! and type in the 'hide' commands (PNTICE / PUHF / UINT 0 1 / PBCHK bla bla)
rather than patching the files - VERY dangerous after version 4.01. cos 4.05 gave all sorts of shit , that pntice.ini is a nice conundrum ;)

Play a safe game of hide and seek }>

NB:-
I posted the macros in the newbie MB a few weeks ago BUT you must have them if you DL Pntice and Nticeset ???

+SplAj

Hi Splaj,

See, I would have no problem using Hide.exe (pntice), but it doesn't hide SI from everything... from what i can tell... just meltice. That Detect.exe (nticeset) still decets BackDoor, etc... And i'm using the SI from DS2.0.1 so NTall doesn't work either...

Any suggestions? Should Hide.exe hide from all documented SI checks?

Thanks,
drak0
drak0
04-20-2001, 01:56 PM
welp, i get what pntice does now :) I've never used macros b4... oops :)

all of the macros seem to work... except "PUHF (Patch UnhandledExceptionFilter)"

Detect.exe still detects that for some reason... it says "NTice DETECTED via... INT3 on UnhandledExceptionFilter"

Any thoughts?

Thanks,
drak0
tony b.
04-21-2001, 08:52 PM
Try this one for DS2.0.1 SoftICE (build 63):

macro puef="uint 3; eb (codeaddr+a)+@(codeaddr+6)+28abb eb"

(assuming you have EliCZ UINT macro installed)

Regards,

tony
+SplAj
04-22-2001, 03:59 AM
Thanks tony b.

............fully cloaked again ;)

+SplAj
drak0
04-22-2001, 10:46 PM
Awesome! thanks :)

tony b. (04-21-2001 10:52):
Try this one for DS2.0.1 SoftICE (build 63):

macro puef="uint 3; eb (codeaddr+a)+@(codeaddr+6)+28abb eb"

(assuming you have EliCZ UINT macro installed)

Regards,

tony


+Tsehp,Can you post a tutorial on Tag&Rename 1.9
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > +Tsehp,Can you post a tutorial on Tag&Rename 1.9
PDA

View Full Version : +Tsehp,Can you post a tutorial on Tag&Rename 1.9

newbie
04-19-2001, 09:53 PM
Hi ,+Tsehp:
I am unpacking the proggy now,I find it EOP at 6e7c,IAT 1561cc,length 844,so I dumped it,and pasted IT.bin,but it still can't work,how can I do??? Would you please give me a tutorial ,OK?
Best Regards!
Kayaker
04-20-2001, 02:40 AM
Forgive me, but this makes me want to cry. This forum is supposed to be a portal to learning and knowledge. There could be many reasons why your dump doesn't work. Giving up and asking for a tut is not the solution. You need to take it one step further and understand *why* it's not working. Try breaking on the error message and see what's causing it. Set a 'BPM address X' on the error address given and you should be able to break before it crashes. There's likely an invalid memory address being accessed because of a redirected API call.

Now you need to trace to this exact address in the *packed* file and find out what it *should* be processing. Then you work from there. You may find you can simply patch this point with a RET, a valid flag/address, or the correct API call which perhaps you can edit in Revirgin and regenerate an IT. If this works and you get past this point and get another error, repeat the process until you've exhausted all possibilities. This is a lot more work than getting someone else to write a tut, but you'll learn a lot more. Then YOU write a tut about it and contribute to the knowledge base.

Please don't take this as a put-down, I'm only trying to help and to help this board. I don't know, with almost 500 members on this board we should be awash with new, creative ideas, innovative techniques and just a pure reversing-for-the-hell-of-it mentality. I know it's not just me who feels this board could be better. I'm not trying to be leet. I'm not trying to be judgemental. And neither am I dissing the board. I'd just like to see this forum and everyone on it reach their full potential. Learn and pass on what you learn, at any level. Follow tuts to a point, then give up on them and find your own path through the codewoods. Think different! Then teach others your new ideas. Above all, remember the name of this forum - Reverse Software Engineering - please let's strive towards whatever that ideal might mean and shy away from simply becoming another cracking site. Excuse the diatribe, but I love this board and just want to see the quality maintained.

Regards,
Kayaker
SV
04-20-2001, 02:46 AM
Hi
That's right Kayaker (lo ;)).
To newbie, there is already a thread about T&R with some tricks:
http://www.woodmann.net/cgi-bin/Ultraboard/UltraBoard.cgi?action=Read&BID=5&TID=2312&SID=

Cheers
SV
SplAj
04-20-2001, 05:35 AM
Kayaker,

you should win the next Nobel Peace prize for your diplomatic and eloquent MB replies.......

I will propose you and I think SV will second it ;)

+SplAj
Kugi
04-20-2001, 10:58 AM
Hi All,

If SV does not second it I will. Well done Kayaker.

Regards, Kugi
Kayaker
04-20-2001, 02:05 PM
SplAj (04-20-2001 03:35):

you should win the next Nobel Peace prize.......

+SplAj

Heh, heh, Mother Teresa I ain't ^_^ Thanks for the support guys, appreciate it. I'm glad that the sentiment is generally shared, gives me hope for the board after all ;)

Cheers,
Kayaker
woodmann
04-20-2001, 02:13 PM
Well said, props to you all.
hz
04-20-2001, 03:22 PM
hiya,
"Nobel Peace", oh cmon this guys head won't fit in his helmet if you keep that up;).
regards
hz
04-20-2001, 03:23 PM
hiya,
"Nobel Peace", oh cmon this guys head won't fit in his helmet if you keep that up;).
regards
Kayaker
04-21-2001, 02:36 PM
hz (04-20-2001 05:23):
hiya,
"Nobel Peace", oh cmon this guys head won't fit in his helmet if you keep that up;).
regards

S'OK, I can always buy a bigger helmet ^_^
+SplAj
04-22-2001, 05:23 AM
better to rent one .......

http://www.globaleffects.com/rentalC1.html

take yer pick I paid the deposit, hz will pay the balance on return

+SplAj

PS
==
while browsing I picked up the sexy S1030, looks great on me }>
tsehp
04-23-2001, 04:17 AM
newbie (04-19-2001 11:53):
Hi ,+Tsehp:
I am unpacking the proggy now,I find it EOP at 6e7c,IAT 1561cc,length 844,so I dumped it,and pasted IT.bin,but it still can't work,how can I do??? Would you please give me a tutorial ,OK?
Best Regards!

btw excuse me for lamelessly trying to back to the first message from newbie ;-)

as kayaker said, some iat entries can lead to nowhere, revirgin now detects simple ret ones, or just let some direct inside code references (like an iat leading to 410544) and will not try to resolve them, trace them and you will crash because there is no api at the end.
alexey in asprotect is actually spending his last bullets and putting some entries like this :
iat leads to :
mov eax [01455212] (asprotect some kind of flag)
ret

well in this case, you create yourself in some free space of the dumped exe the routine that takes the real value and point the iat to it.
lots of cases, so experiment and come back here if you want to ask some precise questions, I'll be pleased to answer them.
+SplAj
04-23-2001, 09:41 AM
Hi newbie and +Tsehp (or Tshelp as someone posted hehehe )

Thanks for bringing us back to the point of the Q. If you do the 'search' query on RCE for 'TAG&' you will get a few threads that
disect this target since late 2000. The first by SV then also by me from Rot8 Q - sorry SV - thought I found somethin new ;) but you had it covered already ;) .........So we all yawned and said aaaaaaaahhhh tag&rename AGAIN boring...... !

However we MUST not forget that our foe Alexey is very much in here and obviously changes things for his customers ASAP - good service BTW ! and obviously this target has had some cosmetic surgery so we must keep up with him.

This means i'll DL it soon and have another look...ahhhhh tag&rename AGAIN....}>

SplAj
NotMe
04-23-2001, 12:32 PM
This means i'll DL it soon and have another look...ahhhhh tag&rename AGAIN....

SplAj

Is there a new tr19? I don't think so.
NewBie
04-23-2001, 02:11 PM
Thanks +Tsehp!,Maybe I will be back soon.
And Kayaker,your advice are very precious.
Sv, I had read your post,but I can't find 555ac in my dump.
Kayaker
04-23-2001, 07:18 PM
Hi Newbie,

I'm glad you didn't take my post as a rebuke, it wasn't meant as such. I just d/l T&R, I'll have a look at it and see if I can't make more positive suggestions this time. Of course if it's like the latest Asprotect where API's other than GetProcAddress are unresolved, it could take a bit of work...;)

Regards,
Kayaker
Kayaker
04-24-2001, 12:47 AM
Hi All,

Yup, this is this weeks version of Asprotect ;) To get to the OEP you now need to trace into a JMP [EBP-14] which contains a lot of SMC. You need to single trace through this and set advanced breakpoints to get out of the half-dozen or so loops until what appears to be the correct OEP:

0167:012F9A24 8944241C MOV [ESP+1C],EAX
0167:012F9A28 61 POPAD
0167:012F9A29 FFE0 JMP EAX ;551370

Start IAT at 1571CC, Length 844

Revirgin resolves everything except about 11 Kernel calls. This is where Asprotect is getting tricky, a couple of these can be replaced with GetProcAddress but the rest seem to be doing different things or seem to be other redirected API's such as GetModuleFilenameA, GetModuleHandleA and who knows what else. This is why you need to scope out what's happening in the packed file.

It can be done, it's a lot of work, I'm still slowly working through another app protected like this, but man, what a learning opportunity to study the redirection implementations if you're into that kind of thing.

Cheers,
Kayaker
NewBie
04-24-2001, 01:54 AM
Thanks,Kayaker, I will try.
tsehp
04-24-2001, 02:07 AM
Thanks to report here when someone manages to find what the left entries are doing, I'll update revirgin to automatize it.
SplAj
04-24-2001, 04:12 AM
Hi I had a go last night and as suspected things always change a little ....I had a auick look last night...

Beloved Revirgin still has a few probs with the following entries (using Win ME Arabic Enabled) :-

15721C 012DC468 --> GetProcAddress
157220 012DC818 --> GetModuleHandleA
157230 012DC86C --> GetCommandLineA
157348 0054FA78 --> SizeofResource
157380 0054FAF8 --> LockResource
1573B8 012DC834 --> GetVersion
157410 012DC864 --> GetCurrentProcesId
15741C 0054FB24 --> FreeResource

And also maybe when this IAT/IT is corrected there is that dead end call as explained previously. But I never got that far as was school homework for the kids.........

So 'newbie' get a better handle as this is a common one ;) and welcome to RCE. Glad we did not p*ss you off or put you off.

SplAj
rot8
04-25-2001, 01:42 AM
There are some trick under ASPR ;)
Author use MD5 hash of code section to decrypt some resources, such as TMainForm etc ... =)
So, good luck !
tsehp
04-26-2001, 02:08 AM
SplAj (04-23-2001 18:12):
Hi I had a go last night and as suspected things always change a little ....I had a auick look last night...

Beloved Revirgin still has a few probs with the following entries (using Win ME Arabic Enabled) :-

15721C 012DC468 --> GetProcAddress
157220 012DC818 --> GetModuleHandleA
157230 012DC86C --> GetCommandLineA
157348 0054FA78 --> SizeofResource
157380 0054FAF8 --> LockResource
1573B8 012DC834 --> GetVersion
157410 012DC864 --> GetCurrentProcesId
15741C 0054FB24 --> FreeResource

And also maybe when this IAT/IT is corrected there is that dead end call as explained previously. But I never got that far as was school homework for the kids.........

So 'newbie' get a better handle as this is a common one ;) and welcome to RCE. Glad we did not p*ss you off or put you off.

SplAj

wow he did found something new this time !
I'll download tag+rename and correct this.
rot8
04-26-2001, 10:26 AM
+tsehp, who do you mean, when say
"wow he did found something new this time !" ? ;)
rot8
04-26-2001, 10:27 AM
+tsehp, who and what do you mean, when say
"wow he did found something new this time !" ? ;)
+SplAj
04-27-2001, 05:03 AM
T&R 1.9 is finished Unpacked on both WinME & Win2K...until next week when Alexey reads this and changes to (re)build h

OEiP 0x551370

The IAT/IT is correct as newBie said at 0x1571CC. I fixed up the new IAT at offset 0x249000 with a new section .SplAj length 0x3100.

The only problem came with the 'Initialisation Error' that is programmed in the code so it must be an anti-dump trick ;)
This is fixed by changing the 4 bytes at offset 0x556CBC to ACA05500.

Look at the ORIGINAL code called by 0x5513B3.... trace it and you will see what I mean.

The rebuilt IAT/IT is enclosed.....see attached tagrename.ace

+SplAj
rot8
04-27-2001, 01:12 PM
15721C 012DC468 --> GetProcAddress
157220 012DC818 --> GetModuleHandleA
157230 012DC86C --> GetCommandLineA
157348 0054FA78 --> SizeofResource - internal author's redirect
157380 0054FAF8 --> LockResource - internal author's redirect
1573B8 012DC834 --> GetVersion
157410 012DC864 --> GetCurrentProcesId
15741C 0054FB24 --> FreeResource - internal author's redirect

He uses such technic to decrypt resources "on the fly".
+SplAj
04-29-2001, 03:47 AM
Hi guys I had chance to play further with the latest T&R 1.9
protected with ASprotect 1.2 (evolution) version...

After unpacking and fixing up the dumped exe I tried to patch the opening 'nag screen' not to show ... and I came across the SAME hash/encryted code loop as I described in my 'Bloatware Commview 2.5' message a while ago... that crashes the exe if any bytes are changed. So this routine was not made up by Tamo but our dear friend Alexey !

So how to bypass it. Rather easy actually... just read my notes below and that should get you on your way :-

TagRename v1.9 (DL 26th April 2001)
===================================

OEiP @ 0x551370 / IAT @ 0x1571CC length 0x844

Create new section .SplAj @ 0x249000 length 0x3100
and use Revirgin to restore the API calls and create a new IT 249000
an paste it in your dumped exe.

Set the OEiP and IT addresses with PEditor 1.7 and fix it up to be Win2K compliant (rebuilder)

It does not run :-(

Problem at 0x5513B3 Call [556CBC] - was a high call that did this in Windows ME :-

0187:012DC7C8 833DA835410000 CMP DWORD PTR [004135A8],00
0187:012DC7CF 7406 JZ 012DC7D7
0187:012DC7D1 FF15A8354100 CALL [004135A8]
0187:012DC7D7 C3 RET

Now we have got rid of ASprotect this call no longer exists so the exe CRASHES !
But 'Call [004135A8]' is actually equivalent to 'Call 00550AAC' ;).....
so change the 4 bytes at offset VA 556CBC to AC0A5500
(thats raw offset 156CBC for Hex editor)

Fixed :-)

Now it runs.

Next is the 'encryted' checksum problem. If you patch any bytes in the unpacked exe
then you get an 'initialisation error' cos you f*cked the checksum. This is stored
in VA 0x556CAC (raw 156CAC) and the expected value is 879FCC2641A64A6893E91A5A5C8777ED. This is just before the above 0x556CBC bytes !

The code that puts this value there is at 0x550A19, check it out at the REPZ MOVSD !

So just PUT the expected bytes in the dumped exe with a hex editor and change the code that 'pokes' the wrong hash to point to 556CCC ;) so it is always correct ! Change 1 byte at VA 0x550A22 :- AC to CC (raw 150A22) . Now you can patch what you want ;)

Note: this 'checksum' error is also generated with a 'BPX' in SI as part of the calculation !!! .... so a BPX 550A21 would generate an error before. Now it won't ;)

SplAj


Still don't know what happened on the messageboard...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Still don't know what happened on the messageboard...
PDA

View Full Version : Still don't know what happened on the messageboard...

tsehp
04-21-2001, 01:22 PM
Hi I just managed to reactivate it by reinstalling it, I think that one of the server's admin messed up with the perl execute rights...
+SplAj
04-22-2001, 03:55 AM
erm as Shaggy says 'it waznt me' ....

:o

+SplAj
tsehp
04-23-2001, 04:29 AM
again one attack from the lybians ;-)
(I know this is off topic to rce, this topic will be moved to general topics ;)


Is this problem related to incomplete/corrupt imports?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is this problem related to incomplete/corrupt imports?
PDA

View Full Version : Is this problem related to incomplete/corrupt imports?

jrg2k
04-21-2001, 11:42 PM
I have some programs (most unpacked by myself) that work correctly in Win9x but give a "App failed to initialize correctly" in Win2000. What bothers me is fact that the original (packed) app runs correctly in Win2000. Is this somehow related to the imports table?
Is there any way to fix the exe image?
tsehp
04-23-2001, 04:31 AM
maybe some api exports are not known on win2000, or maybe you have to convert the pe format (look at pe editor from yoda)


WW32packed program and Revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WW32packed program and Revirgin
PDA

View Full Version : WW32packed program and Revirgin

LaptoniC
04-22-2001, 06:50 AM
I am trying to unpack wwpack32'ed program named OptiPerl v3.0 (http://www.xarka.com/optiperl) I have unpacked it with trw2k.Program runs but import table is corrupted.When I dissamble no import function is represented.(I have changed the charecterictic to code for w32dasm) I have run Revirgin and it said import table is corrupted so I tried Revirgin 1.01 and found that iat starts at 1A3208 and ends at 1A3BC0.So I changed IAT start RVA to 1A3208 and length to 9B8.I have hit IAT resolver button.Then I put 1A3208 to IAT RVA box and hit iat generator.I used IT Section includer by SV and made new exe with dumped exe and it.bin.Exe runs again but when I hit import unctions in w32dasm only name of dll is shown no name is seen.
Any help will be appreciated.
SV
04-22-2001, 01:23 PM
Hi
To have right functions names in W32dasm, you need to have only one .idata section (included one).
Perhaps have you another one ?

Regards SV
LaptoniC
04-22-2001, 04:38 PM
I have one idata which is from original exe but if i delete it exe crashes I guess I should change charaecteristics of other section below this.Could you look at this program ?
Kayaker
04-23-2001, 01:00 AM
Hi,

I've been playing with this proggy myself for the past few days. I had just done an Icedump /PEDUMP on it, it ran OK and the Imports names were fine in PEditor. I didn't really notice the fact that W32Dasm couldn't resolve the Imports until your post. So I started comparing dumping methods a bit.

If you do a RAW dump with Icedumps /DUMP, or use the TRW Pedump the program runs fine, but the IMAGE_THUNK_DATA array that the 1st Thunks point to contain the direct API addresses (i.e. BFF76DA8 ), instead of RVA's which are pointers to the ASCII names of the Imports (i.e. GetProcAddress). So you don't see the Imports listed even in PEditor, just the addresses. Not a big deal until you start looking at the disassembly.

If you use Icedumps /PEDUMP it rebuilds and appends an .idata section, but as SV mentions, there's now 2 copies of .idata. If you rename (not delete) the original .idata then W32Dasm picks up the Import module (dll) names, but not the correct individual API names. Instead of the API functions, something is pointing W32Dasm to some other area of the file and what it picks up is garbage. You can search and find where this garbage is coming from in the file, but I can't figure out why it's pointing to where it is. The PE Header pointer to the IT is correct. The "garbage" is actually coming from within the .text section.

You must be getting the same kind of thing with a Revirgin paste on top of your TRW dump. This is really curious. I've tried playing with the BSS, Reloc and TLS sections a bit (couldn't think of what else to do) but can't figure why W32Dasm is screwing up this way. Usually if the PE Header IT pointer and the IAT is correct, it can usually resolve the Imports.

In any case, back to basics. The best way I found to dump and rebuild it completely is with a RAW Icedump '/DUMP ImageBase ImageSize Filename', use PEditors Dumpfixer option to realign the file, fix the OEP, and paste a fresh Revirgin IT on the end of it. With this method W32Dasm recognizes all the Imports.

Kayaker
tsehp
04-23-2001, 03:59 AM
LaptoniC (04-21-2001 20:50):
I am trying to unpack wwpack32'ed program named OptiPerl v3.0 (http://www.xarka.com/optiperl) I have unpacked it with trw2k.Program runs but import table is corrupted.When I dissamble no import function is represented.(I have changed the charecterictic to code for w32dasm) I have run Revirgin and it said import table is corrupted so I tried Revirgin 1.01 and found that iat starts at 1A3208 and ends at 1A3BC0.So I changed IAT start RVA to 1A3208 and length to 9B8.I have hit IAT resolver button.Then I put 1A3208 to IAT RVA box and hit iat generator.I used IT Section includer by SV and made new exe with dumped exe and it.bin.Exe runs again but when I hit import unctions in w32dasm only name of dll is shown no name is seen.
Any help will be appreciated.
he he, I think I've seen the error :
you told about "Then I put 1A3208 to IAT RVA box "
what is this iat rva box ? I only made IT Rva box, and this it rva box must usually correspond to the beginning of your future (.idata) section, just look again at the wordpad examples, you'll see the added section into the fixed wordpad.
regards,

+Tsehp


how to avoid Smartcheck detection ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how to avoid Smartcheck detection ???
PDA

View Full Version : how to avoid Smartcheck detection ???

moZfet
04-22-2001, 09:23 AM
any Idea?
CoDe_InSiDe
04-22-2001, 10:17 AM
Hi moZfet,

i don't use SmartCheck so much so i also don't know any protection against it, but i think i've read somewhere that it searches for it's WindowClassName (with API = FindWindowA) :)
Hope this helps...

Cya...

CoDe_InSiDe
KaKTuZ / TMG
04-23-2001, 04:49 AM
let me elaborate a little. indeed, the only smartcheck detection i know of, finds if it is loaded by the WindowClassName of smartcheck.exe and then sends two WM_CLOSE messages to it (two, to surpass the closing confirmation). Your task is then either to patch the windowclassname in smartcheck, OR, alternatively, find the string in the offending program and patch there.

HTH.
4oh4
04-27-2001, 06:33 PM
This got me thinking about an old crackme....released maybe a year or so ago.

I never did crack that bast$*@, but if I remember right... Filemon logged the crackme as checking the SChck registry entries which store the last opened files.

Oh.... I always wondered why any vb shareware programmers didn't check for app.path & "\" & app.name & ".sup"

I think that's how that'd be done in vb anyways, but it'd be too easy to check for the presence of that SChck file in the app's directory.
nchanta
05-01-2001, 12:51 AM
there is also a known detection for SC by searching for the 'smrtchck.tsf' file in c:\%windir%, rename this file and it will destroy that detection...

NchantA


Which protection use .lxk licence files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Which protection use .lxk licence files
PDA

View Full Version : Which protection use .lxk licence files

moZfet
04-22-2001, 09:25 AM
and a soft called license.exe

for install license files?

Thanks a lot!


Ho Kan I Use Int13h In Win32?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Ho Kan I Use Int13h In Win32?
PDA

View Full Version : Ho Kan I Use Int13h In Win32?

SmallBoy
04-22-2001, 10:05 AM
Thank You For All My Good Friends In The Little World!
I recieve many information & i can continue My Work Better From The Last!

Thanks Again!
SmallBoy3000
Aimless
04-22-2001, 11:40 AM
Download lesson 5 from ORC's tuts

Disk Accesses are explained in Detail! And I MEAN in detail!!!

Better than ANY book

As ever
Aimless
04-22-2001, 11:42 AM
Download lesson 5 from ORC's tuts

Disk Accesses are explained in Detail! And I MEAN in detail!!!

Better than ANY book

As ever
aimless
04-22-2001, 11:43 AM
Download lesson 5 from ORC's tuts

Disk Accesses are explained in Detail! And I MEAN in detail!!!

Better than ANY book

As ever
SmallBoy
04-23-2001, 05:44 AM
Hi AimLess,
How Can I Find This Lesson On The Net?

Please Let Me The Internet Address Of It!

Very Much Regards
SmallBoy3000
Rainor
04-24-2001, 11:00 AM
ORC tutorial 5.1 only deal with old INT13 for MSDOS, for Win32 you need something called thunking take look at HexWork Shop DLL, I found some info about thunk in MSDN but look like I need take a NASA degree to read or write a damm sector.

R
Kythen
04-24-2001, 12:54 PM
I don't know the answer personally, but I do know a few areas you might want to look into.

1. Get the MS DDK (Driver Development Kit). Good chance that it will have something about your question. Also, you may want to look for some asm device driver tutorials. They may have something as well.
2. Look into ASPI programming. I know that's how you do direct sector stuff with CD-ROM's and the like. Quite possible that you could do the hard disk stuff in the same manner

HTH!
[yAtEs]
04-25-2001, 03:59 AM
Rainor (04-24-2001 01:00):
I need take a NASA degree to read or write a damm sector.
R

rotfl, i've been trying to read a CD sector w/o aspi for a long time now, bloody int simulation gives me a head-ache (;
solution:thunk to a 16bit dll
kill3xx
04-25-2001, 06:51 AM
[yAtEs] (04-24-2001 17:59):
Rainor (04-24-2001 01:00):
I need take a NASA degree to read or write a damm sector.
R

rotfl, i've been trying to read a CD sector w/o aspi for a long time now, bloody int simulation gives me a head-ache (;
solution:thunk to a 16bit dll
thunking is one of the most cleaner method but u can consider other solutions that work w/o ring0 hack-o-rama:

win9x:

CreateFileA \\\\.\\vwin32 -> DeviceIOControl + VWIN32_DIOC_DOS_IOCTL / VWIN32_DIOC_DOS_INTx (documented on MSDN)
Kernel32!VxDCall -> Int31hDispatch -> SimulateRM_Int 0x13 / 0x2F / ..

ofcoz u've to provide < 1MB 16:16 lpBuffer (GlobalDosAlloc,MapLS/SL,etc)

winNT/2k : just open the physical drive and use Read/WriteFile(Ex)

Best Regards,

kill3xx


This process can't be dumped!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > This process can't be dumped!
PDA

View Full Version : This process can't be dumped!

zampt
04-22-2001, 12:40 PM
Hi ya all!

I have a procdump/Vbox 4.3 problem.

I tried to crack "F-Secure Antivirus v4.09"
for win 95/98. I made a jmp over the iat cryption and then a "jmp eip" at "jmp ebx",
but when I selected the task in procdump and
tried to make a dump it said:

"This process can't be dumped!!"

Please give me some hints.

zampt
CoDe_InSiDe
04-22-2001, 01:26 PM
Hi zampt,

Have you tried to use the "Partial Dump" instead of the "Full Dump" ?
Most of the time that works better :)
Hope this helps...

Cya...

CoDe_InSiDe
tsehp
04-23-2001, 04:08 AM
Or you can use icedump's function /pedump , very powerfull.


If board works again then...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > If board works again then...
PDA

View Full Version : If board works again then...

Petroff
04-22-2001, 07:31 PM
Hi guys.
Yesterday I downloaded a small handy cd-rom util which examins important sectors on both empty
and already recorded cd-roms. It uses standard name->serial registration validation. I quickly
found (with beloved sice) offending routine and tried to figure out serial number from it without
success. It is possible to patch program to accept serial number in format xxx-xxxxxxx (fourth
character must be "-") but author was smart enough to include well hidden CRC check and before
searching for CRC compare I decided to find correct serial number for my name. The main reason
for my decision was that I already saw this kind of serial manipulation in many schemes I've seen
till today. Of course this is not easy at all, and I hope that there is someone who can help me.
Let's see the code:

EBX=0
EDI= points to serial number entered
ESI= fourth digit of serial (ASCII hex) (If entered "2" -> esi = 32)

:0041A4C4 cmp dword ptr [0042F59C], 00000001 ;always equal
:0041A4CB jle 0041A4D9

;skipped... due to forum msg restrictions :)
|
:0041A4D9 mov eax, dword ptr [0042F390] ;lookup table to exclude
:0041A4DE mov al, byte ptr [eax+2*esi] ;characters from adding and
:0041A4E1 and eax, 00000004 ;to determine the end of string

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0041A4D7(U)
|
:0041A4E4 test eax, eax
:0041A4E6 je 0041A4F5 ;if equal then char or end of string
;skip adding

####################### bloody magic starts here ############################################

:0041A4E8 lea eax, dword ptr [ebx+4*ebx] ;at the 1st iteration eax=0
:0041A4EB lea ebx, dword ptr [esi+2*eax-30]
;now ebx = 4th number entered
;I saw this so many times in many apps...
############################ and ends here ##################################################

:0041A4EF movzx esi, byte ptr [edi] ;get next digit in esi
:0041A4F2 inc edi ;inc pointer
:0041A4F3 jmp 0041A4C4 ;cycle till the end of serial

After this ebx holds magic number which is NEGATED and divided with constant 186A0h. REMAINDER
of this division is then compared with two bytes (4F59h) calculated from my name. If equal good
guy, otherwise...
The rest is common, name->serial combination is placed in windows registry and after restarting
the other routine fetches that from registry, does the same calculation and sets global variable
"Registered" true or false accordingly.
I wonder if this is some common mathematical manipulation on arrays I know nothing of. I've tried
to place this on paper but only to find out that the number must be very big unsigned int so
after negation and division EDX (remainder) holds the right value. It could be any int since
there is almost infinite amount of numbers that satisfy this condition.
1D5F9h div 186a0h = 1 and remainder 4F59h
669D9h div 186a0h = 4 and remainder 4F59h etc.
I suppose it is possible to write a little program which does reverse logic but it asks for
good mathematical background. I think. I finished school long time ago ;)
If any of you guys could help...

Petroff


How do I use icedump?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How do I use icedump?
PDA

View Full Version : How do I use icedump?

zampt
04-23-2001, 07:18 AM
First of all, thanks for trying to help me!

I have only used procdump, so I could need som hints on how to use icedump.
What should I do after using softice to patch
f-sec.

*How do I dump?

*How do I fix pe-header and import table?

zampt
CoDe_InSiDe
04-23-2001, 07:33 AM
Hi zampt,

Well i assume you installed Icedump right?
Then read the Manual and all become clear ;)

Cya...

CoDe_InSiDe
tsehp
04-24-2001, 02:17 AM
yes, in the manual you'll see a lot of commands, the most usefull to me are :
/pedump (automated dump, fixing the pe)
/trace or /tracex to find the program's oep
/protection to look for certain protection schemes that dwelve with interrupts or seh through the idt.
Cast
04-24-2001, 01:38 PM
is it just me or does Icedump for windows NT not support these features ? - all i can use with icedump for NT is pagein..

Maybe i dident config it right - i donno
zampt
04-25-2001, 02:18 AM
Hi !

Thanks for all the help, I will try to use Icedump.
One other thing, if I use TRW then I will need to
fix the pe of the dump, am I right?

Once again..thanks!

zampt
CoDe_InSiDe
04-25-2001, 03:49 AM
Hi zampt,

Yes you need to change the OEP and maybe some other stuff in the Sections :)

Cya...

CoDe_InSiDe


+SplAj - website location ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > +SplAj - website location ???
PDA

View Full Version : +SplAj - website location ???

Clandestiny
04-23-2001, 08:40 PM
Hi +SplAj,

In my recent searches for some unpacking tuts, I just happened to remember your discompress.com site. Seeking it out, however, I got a 404 not found error. Have you changed locations? The url would be great :)

Many Thanks,
Clandestiny
SplAj
04-24-2001, 03:56 AM
Hi
discompress is still in existence, but not on WWW cos
I donated my space for a worthy cause last month ;)

but now I hope that I get my space back as I used less than 10megs
and I have a backup on my HD at home...somewhere. It will return soon

Basically my thoughts on unpacking are to DL ALL the packers and then use them on notepad.exe then test yourself to manually unpack WITHOUT procdump and icedump (well use it hide SI and do screendumps for your files). Just MANUALLY find the OEiP and then use the 'e eip eb fe' loop and dump with PEditor then rebuild as necessary !
- make notes on each packers attempts to hide the OEiP and how the
API's are scrambled/hidden/redirected in IAT/IT.

Then you are well practised for 'shareware' targets ;)

"I'll be back"
Clandestiny
04-24-2001, 05:54 PM
Hi +SplAj,

Thanks for the good advice :) This is actually the very first time I've manually attempted to unpack something without ProcDump, but I just had great success with my UPXed Windows calculator. (yeah, I know ...probably the easiest packer around ;P... but I'm quite excited nonetheless). In your opinion, what should be my next step... ie. which packers are relatively straightforward for an unpacking newbie like myself. I plan on studying packers in some detail and I would greatly appreaciate a little guidance in this direction.

Thanks,
Clandestiny
+SplAj
04-25-2001, 03:57 AM
I would try PEcompact on notepad.exe next....

Actually unpacking is rather boring after a while. It is just a hunt for that final POPAD and JMP EAX in almost ALL packed
targets . Most use the APlib compression code as well. So there is not much difference actually between them. Just goto www.exetools.com and DL the packers and use them on notepad.exe and that's it. Make notes and look for those 'signature' bytes at the end of unpacking and hand over to the original program........

You should also study the PE structure cos some packers like 'telock' f*ck around with the number of sections. Instead of say 0005 you get FFFF and this upsets PEditor and icedump dumping until you correct it BEFORE dumping. So you should get used to looking at the memory around 40000 for the 'PE' start and understand what the next 50+ bytes mean to the
exe; start address , sections blah blah .......

Also your next step would be to FIND the IAT + IT in the target
and understand if it's been f*cked with or not... and nowadays it probably has ;) So most time you have to use a bpm 'itaddress' w to watch the IT being mapped then destroyed. So you have to DUMP this section then continue to the OEiP then DUMP again (after checking the PE header) and then copy+paste the good IT back. Then there are the redirected API tricks that are fixed with Revirgin }>

Practise makes perfect.....

I found the backup and will upload soon.....
SplAj
04-25-2001, 08:06 AM
Ok it's up .... try the telock tut .....and

OMG IT IS ALL SO NAF :( so old and dated......but still I have some good ideas to put in there...... I have a lot of work to do to bring it into 2001 !

CYA

mini me
Muad'Dib
04-25-2001, 11:17 AM
Hey +SplAj...I would like to have the archive of the site to put on my site (http://muaddib.immortaldescendants.org) because I recently decided the purpose of my site should be an archive of the best cracking sites...if you could mail it to me I would appreciate it! Thanks.
JMI
04-25-2001, 03:59 PM
Could you post a URL for the restored website please. Google can't find Discompress or discompress.com. Thanx.
SplAj
04-26-2001, 04:04 AM
Hi.....but it's not a 'crack' site ;) just a 'prep' site , like a school , for newbies and the idea I had was just to concentrate on unpacking MANUALLY using as little 'tools' as possible but to MAXIMISE the brain ! - the best tool available with a little training.

From my own experience trying to follow some unpacking tuts it was all rather confusing ....I thought that a centralised place for unpacking info was needed ...so www.discompress.com was born.

I borrowed the name from some unpacking tut in translated French ;)

If I could help a few new RCE on the right path then I am happy :-D

I want to update it soon. I should have a bit of time in the vacation period again to update it and bring in some upto date
tuts ;) using revirgin and the new features in icedump and PEditor1.7 etc etc.

You know the problem is it is really hard to put down some HTML explaining it. Someone once complained about the quality of tuts. He was right, the focus is usually on the lines of "do this, do that, voila, bob's yer uncle, tac tac , aren't i clever dude" :-(

To make a proper tut complete with the real scenario and a comprehensive follow through is labor intensive :-( cos newbies take a tut VERBATIM and then apply it to the next target which has usually evolved ! - because of the tut ! and the newbie gets frustrated cos he can't find memory location 167:4512AD in the new target !.......ASprotect and ASpack are prime examples of this evolution cycle.

let me update it before I package it up for you.

+SplAj
Clandestiny
04-26-2001, 08:59 AM
+SplAj,

Thanks man for uploading the site :) Your newbie tuts are actually quite good (some of the better ones I've seen so far). For the most part, I try not to follow tuts as a "recipe book" but more as a reference applied to different but similar targets.
IMO, its more interesting that way ;)

Regards,
Clandestiny
+SplAj
04-26-2001, 09:18 AM
Clandestiny, thats the way... ;)

The brain beats all protections NOT a tut......

So did you like my te!lock0.71 tut ? I ran through it again myself and it is pretty comprehensive. Should make you think about what you are trying to achieve !

te!lock.80 is the latest and I did some notes a few weeks ago on theEgoiste new tricks and will write a new tut 'soon' - his section renaming spoof is a nice touch ;)

+SplAj
Clandestiny
04-27-2001, 08:59 PM
+SplAj (04-25-2001 23:18):
So did you like my te!lock0.71 tut ? I ran through it again myself and it is pretty comprehensive. Should make you think about what you are trying to achieve !
+SplAj

Hi again +SplAj,

Heh, I knew there was a reason the te!lock tut was under the "advanced" section ;) !!!

I'm currently giving it a go (and learning a lot in the process). I reread the pe docs and the suggested import rebuilding tut with a fair degree of comprehension, but I'm finding that applying the theory is a whole different ballgame. Following the steps in the tut is no problem...BUT understanding the rationale behind each one of them is a bit more challenging being as I'm the newest newbie to manual unpacking. At the risk of asking a lame question, one thing that is puzzling me is the debugger detection. After setting a bpx on LoadLibraryA, I'm in the loop at 004C4E8. Here it was my first impulse to set a bpx directly after the jump so as to get myself out of the loop and continue single step tracing through the code. Alas, shortly thereafter, I'm thrown out w/ an ExitProcess() and a "Debugger Detected" MessageBox. What exactly is the procedure to escape from this detection portion of code? In contrast, in your tut you go on to set some additional bpm's which avoid this problem ??? ...but like I said, my first impulse is to first single step through this unfamiliar code. Likely, there is some simplistic solution for this, but it has me stumped. Of course I have IceDump loaded (version 6.3) with "/protect on". Needless to say, I have a few additional ?'s, but I'd like to clear up this debugger detection issue and snoop around in te-lock's code a little more before asking them.

Definately I have a LOT yet to learn about unpacking !!!

Cheers,
Clandestiny

PS. You know you've opened up a can of worms
getting me to look at te-lock :p ... ??'s * infinity ;)
Clandestiny
04-28-2001, 12:08 PM
Scratch that last debugger detection problem I mentioned... After tracing a little more carefully I was able to bypass the "Debugger Detected" check. The SMC confused the issue a bit for me at first since I'm not used to tracing code that changes right before my very eyes. Needless to say, after single step tracing for quite some time excepting a few carefully set bpxes to speed my way through the loops, I have concluded that tracing the entire unpacking routine is not the way to go. This was my approach for UPX and PE Compact and though it was admittedly not the most efficient method it was not unfeasible since it allowed me to get familiar with the feel of packer code minus SMC. With te-lock though I'm quickly concluding that a more efficient use of the bpx and bpm (as you illustrated in your tut) is a better approach.

Stumbling onwards through the codewoods...

Clandestiny
Clandestiny
04-28-2001, 12:10 PM
Scratch that last debugger detection problem I mentioned... After tracing a little more carefully I was able to bypass the "Debugger Detected" check. The SMC confused the issue a bit for me at first since I'm not used to tracing code that changes right before my very eyes. Needless to say, after single step tracing for quite some time excepting a few carefully set bpxes to speed my way through the loops, I have concluded that tracing the entire unpacking routine is not the way to go. This was my approach for UPX and PE Compact and though it was admittedly not the most efficient method it was not unfeasible since it allowed me to get familiar with the feel of packer code minus SMC. With te-lock though I'm quickly concluding that a more efficient use of the bpx and bpm (as you illustrated in your tut) is a better approach.

Stumbling onwards through the codewoods...

Clandestiny


How is protect Solid Edge 9?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How is protect Solid Edge 9?
PDA

View Full Version : How is protect Solid Edge 9?

mssmsoft
04-24-2001, 01:46 AM
Can someone tell me how type of protection is applied on solid edge version 9?
There is a tutorial for this?
Thanks in advance
Cast
04-24-2001, 09:27 AM
SolidEdge uses flexLM - i think there is a tuturial someone on fravias on howto crack it, but its not too hard. I have only had the oppertunity to look at SE8 and UG16 from UGS though.


How Can Read CD-Rom Sector's In Win32?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How Can Read CD-Rom Sector's In Win32?
PDA

View Full Version : How Can Read CD-Rom Sector's In Win32?

SmallBoy
04-25-2001, 06:01 AM
If you use mscdex Function's in Win32, It'll Be Failed!!!
Oh... I'm Very Angry About This Problems In Win32 But I Must Control Sector In My App32!!

Can You Mail Me Your Sources/Helps About This Problem!
If It's Possible, Please Send Me ASPI Functions And How To Use It!

SmallBoy3000
[yAtEs]
04-25-2001, 06:46 AM
How Win32 Applications Can Read CD-ROM Sectors in Windows 95

http://support.microsoft.com/support/kb/articles/Q137/8/13.asp

http://support.microsoft.com/support/kb/articles/Q100/0/27.asp

I have some aspi programming tutorials on another computer somewhere, email me if you want them.

regards, yates.
IcyDee
04-26-2001, 02:42 AM
And on NT and W2000 you should look for information on the SPTI (SCSI Pass Through Interface)


Opcode length recognition
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Opcode length recognition
PDA

View Full Version : Opcode length recognition

Latigo
04-25-2001, 12:44 PM
Hi!
Currently im developing some kind of tool that has to parse opcodes.
When i started studying the subject i found that many disassemblers make intense use of look-up tables to find out about the which opcode is the one being read.
Now my question is..
Are these tables necessary? Isn't there any way to know , by examining the opcode encoding, how many bytes an opcode takes?
All i pretend is it's length!
Btw when i say 'opcode' i mean the opcode byte + the other bytes which make the complete instruction.

Thanks in advance!

Latigo
mammon_
04-25-2001, 01:22 PM
You would do well to check Appendix B of the Intel Arch Software Developer's Manual, Vol II [which, if you're doing any sort of disasm work, you should have readily available by now :) ]. Personally I found that Intel's "method" for "organizing" their instructions had too many exceptions to be used reliably ... in my opinion the only way to get an accurate reading is to disassemble the entire instruction.

Anyways, Appendix B gives a bit-by-bit listing of the opcodes, and points out which bits are set to indicate the presence of a modr/m byte, disp, etc.

Now, at the risk of sounding horribly out of touch, why would anyone care about the length of an instruction and not about disassembly of the same? You just counting the number of instructions in a program for the sheer, unmitigated hell of it?

_m
MAK
04-25-2001, 02:16 PM
I guess the lenght of an upcode is nice to know if u want to make intelligent tracers

Her is a package that contains what u need..
Credits goes to he author...
mo k
04-25-2001, 03:46 PM
>Currently im developing some kind of tool that
>has to parse opcodes.
aren't we *all* ; )

>When i started studying the subject i found >that many disassemblers make intense use of >look-up tables to find out about the which >opcode is the one being read.
many? it is about the only fscking way,
dynamic programming beats the pants off
nested conditions, both interms of speed
and size, when it comes to parsing languages
with small constructs --integers in this case.

>Now my question is..
>Are these tables necessary? Isn't there any >way to know , by examining the opcode >encoding, how many bytes an opcode takes?
Unlike those programing languages where the
lenght of a string is encoded in the *header*
of the string, the intel instruction format
does not have an easy way to determine the
ending or the begining of a given instruction.
This is called a varibale lenght instruction.
Some CPUs have instructions of a predetermined
lenght, RISC comes to mind.
In intel, in order to do any analysis on the
instruction stream, you have to implement
all the logic necessary for a complete
disassembler. You cann't just wiz around
looking for a hot-byte, ala boyer-moore.

>All i pretend is it's length!
No, you either do it all the way, or never.
You will get, the lenght, the type, the
operands, their locations, their sizes, etc. etc.

Sir do you want to super-size your happy meal? ;P

Go read what mammon told you to read -trust him- and ask whatever other problems
you have at the newbies board,
the answers you will draw will be helpful to
them aswell.

P.S. Latigo, from what you have been asking
lately, i sensed that you are finally seeing the
light, keep up, coding is the way to go.
penfold
04-26-2001, 09:31 AM
you could search the internet for

; LDE32 -- Length-Disassembler Engine
; FREEWARE
;
; programmed by Z0MBiE, http://z0mbie.cjb.net

that urls dead now , but the source code is availble somewhere ..

its a good engine, will open up the door into decoding opcode lengths for you .. only works with normal x86 opcodes, not fpu, not mmx, not 3dnow, etc .. and a couple of x86 opcodes it screws up on (test word ptr [xx], test word ptr [reg?], i think are the only ones)

just study intel docs, long and hard :-)

later, latigo

penfold (co cracker of codesafe :-)
Latigo
04-26-2001, 10:05 AM
Hey guys thanks for the replies! Such an honour to get advice from leet chaps like you :).

Mammon_: I'm coding a tool which adds self-modifying capabilities to the .code section of a given PE file. That is why i need to recognize opcodes (lengths). Or at least that is why i _believe_ i need to know :)

Mo k: It's good to know i'm finally seeing the light! Now that you say it, i'll trust m_ :)

penfold: great thing! i'm gonna study that source.

Mak: you talking about what penfold pointed?

Bye and thanks.

Latigo
MAK
04-26-2001, 03:18 PM
Yep
I´ve got lde32
But how the hell do u attach files?
tsehp
04-26-2001, 05:40 PM
MAK (04-26-2001 05:18):
Yep
I´ve got lde32
But how the hell do u attach files?

I made a recent global reinstall, so some settings disappeared, now you have 500k for one file.

my two cents : not unlike arthaxerxes who gave me the idea, I didn't wanted to reinvent the whell and used the available nasm c libraries to disassemble programs into my exe's . it's using some simple lookup tables for each opcode , args, etc... maybe you could also check this.
Latigo
04-27-2001, 09:41 AM
+Tsehp (04-26-2001 07:40):
MAK (04-26-2001 05:18):
Yep
I´ve got lde32
But how the hell do u attach files?

I made a recent global reinstall, so some settings disappeared, now you have 500k for one file.

my two cents : not unlike arthaxerxes who gave me the idea, I didn't wanted to reinvent the whell and used the available nasm c libraries to disassemble programs into my exe's . it's using some simple lookup tables for each opcode , args, etc... maybe you could also check this.

Thanks Tsehp!
Where can i get these nasm c libraries you mention? in the nasm package?
tsehp
04-27-2001, 02:40 PM
here they are, but you'll have to modify them a little to make them usable in c++

regards,

+Tsehp
Latigo
04-28-2001, 03:03 PM
+Tsehp (04-27-2001 04:40):
here they are, but you'll have to modify them a little to make them usable in c++

regards,

+Tsehp

Thanks mate!
MAK
04-30-2001, 02:00 PM
well if u still need LDE32 here it is...


FYI: Verance Watermark challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FYI: Verance Watermark challenge
PDA

View Full Version : FYI: Verance Watermark challenge

KaKTuZ / TMG
04-25-2001, 01:27 PM
hey guys,

i just came across a very interesting reading concerning the Verance Watermark (the digital watermark used in DVD-Audio to protect from piracy), the public challenge to break it and the further results for the challenge participants.

very interesting, check it out.

http://www.theregister.co.uk/extra/sdmi-attack.htm

regards,

KaKTuZ / TMG
mo k
04-25-2001, 06:56 PM
we had a similar one on the scene for a while,
try Muadib and The+Q's toolme.


injecting debug symbols back into images
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > injecting debug symbols back into images
PDA

View Full Version : injecting debug symbols back into images

Diodato
04-25-2001, 06:27 PM
There are tools to strip debug information from images, extract them etc.
But has anyone come accross any tool that basing on a MAP or SYM file can inject such debug symbols back into images?
CrackZ
04-26-2001, 04:05 PM
Hiya,

With the greatest of respect and maybe I am missing something ;-), but what exactly would be the point in doing this?.

If you are interested solely in the theory or structure of 'debug information' I would think it better to approach the problem from the other side first.

Regards

CrackZ.
Diodato
04-26-2001, 04:34 PM
There are some quite interesting programs that help during sftwre development phase. Allow me not to mention their names. And they are used on the compiled executables. Independantly if the executable has or not the debug information. But having the debug symbols eases life quite a bit in refferencing. With IDA you can apply appropiate signatures to identify static libraries, assign names etc. Produce the MAP and incorporate that back into the executable as debug info (either as new or augmenting the existant one). And that's basically what I want to do.
But of course beeing a lazy one, I wanted first to find out if any such tools have been already developed before starting to implement my own to introduce debug symbols in images.
tsehp
04-26-2001, 05:30 PM
I just published on what new page the new mostek's ida plugin, but you will only reinject debug info into sice as an nms file, maybe this could help you
tom
04-27-2001, 02:37 AM
Is there a way to convert NMS file into Microsoft program debug database file (pdb) ?

Tom

PS. I am just another lazy programmer who would like to use this interesting tool for
reverse engineering purpose :)
Diodato
04-27-2001, 05:33 AM
+Tsehp,

Seems the ida2size_002.rar file is corrupt. Can you verify that, and if so replace it?

My ultimate goal is to write an ida plugin to do the task of injecting the debug information back into the image. But I'll start first with the MAP or SYM.

About the pdb files - I am unable to find any documentation of it's file format. Guess M$ is again keeping the specifications to itself.


how to use asprotect?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how to use asprotect?
PDA

View Full Version : how to use asprotect?

potato
04-26-2001, 12:27 AM
I have no idea how to use asprotect
can you please explain how it is working and how to use it?
tsehp
04-26-2001, 02:12 AM
asprotect is a test protection program to see if revirgin still works ;-)
asprotect is a packer : it uses compression to gain size on all the exe sections, it also infects the exe with some time trial & registration routines and also wraps the exe's iats.
look on the site on packing/unpacking section.
SplAj
04-26-2001, 04:33 AM
"...asprotect is a test protection program to see if revirgin still works "

LOL }>

...and it does, the ASprotect 'team' still can't stop our bella Le'virgin

here is the latest from this weeks ASprotect 1.2 (re)build g :-

push 00000001
push 80000000
push offset [\\.\Revirgin]
Call CreateProcessA
cmp eax, FFFFFFFF
je THANKGOD_...BUT_HE_MIGHT_START_REVIRGIN_LATER:-(
call OHNO!_CRY_A_LOT_OF_TEARS! :'(
....

+SplAj


hey gang
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > hey gang
PDA

View Full Version : hey gang

my_avatar
04-26-2001, 02:07 AM
Hey all,
Its been quite awhile (dont know if anyone remembers me, seems like someone else likes the nickname I picked too :).

Just wanted to say high, and I've missed spending time with my old friends (and softice, and wdasm ;).

laterz all,
myAvatar
Kugi
04-26-2001, 10:21 AM
Hi,

Sure, I remember you. Have some of your threads in my "good reply" folder. Good to see your post.

Regards, Kugi
tsehp
04-26-2001, 05:43 PM
my_avatar (04-25-2001 16:07):
Hey all,
Its been quite awhile (dont know if anyone remembers me, seems like someone else likes the nickname I picked too :).

Just wanted to say high, and I've missed spending time with my old friends (and softice, and wdasm ;).

laterz all,
myAvatar

hiya, you should register, then nobody could use this name, use a proxy if you want to keep your anonimity.
qferret
04-27-2001, 03:55 PM
Good to see ya again MyAv....I don't make it in as often as I'd like anymore either, but do pop in when I can ;-)


New versions of ASProtect, where?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New versions of ASProtect, where?
PDA

View Full Version : New versions of ASProtect, where?

dELTA
04-26-2001, 03:40 AM
I often see people talking about lots of new updates of ASProtect, but on the ASProtect homepage there are very seldom updates? Where do you get these latest versions from? Is the file on the ASProtect page updated without it being mentioned, or what (e.g. right now the homepage says that the last update was February 4th)?
Kilby
04-26-2001, 03:58 AM
Asprotect, is updated without any mention being made on the home page.

This prevents those who may waish to unwrap asprotected files from having any advance warning.

The first they know of the new version is when their target won't unwrap as expected.

It can be a real bummer.

Kilby...


Vbox (4.4) come back?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Vbox (4.4) come back?
PDA

View Full Version : Vbox (4.4) come back?

blonde h@cker
04-26-2001, 06:15 AM
the vbox version used for adobe golive 5 doesn't seem to use getprocaddress (or it can hide it!).
How can we defend from Wei Jun Li now?
tsehp
04-26-2001, 05:45 PM
can you make it available for me to test it with revirgin (which doesn't use getprocaddress )
I don't want to fill their form, mail me directly
tsehp
04-27-2001, 02:33 PM
I think it's an error, this target uses vbox430 actual dlls...
blonde h@cker
04-30-2001, 02:10 AM
probably i made some mistakes, but i can't find a good eip (no jmp [some reg], only a call 401000) and the golive.exe imports itself like dll, and the program that drive the applications seems to be the "scl.dll", in few words, i don't know how to dump it. Can you help me in some way?


Imports Libraries
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Imports Libraries
PDA

View Full Version : Imports Libraries

Hoof Arted
04-27-2001, 03:47 AM
Does anyone know where I can get the import libraries for MFC42.DLL and Wsock32.dll?

Hoof


hi,gang
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > hi,gang
PDA

View Full Version : hi,gang

next
04-27-2001, 06:22 AM
i am a novice,now i try to crack some eda software.who can give a whole example about it.my tools have softice/w32dasm/ida pro/hiew.etc.
best regards.
Clandestiny
04-27-2001, 09:01 AM
Hi next,

Before asking someone on this board to "give you a whole example about it", I would advise you to read some of the MANY RCE tuts. There are a number excellent newbie tuts out there just waiting to be found by someone with the motivation to search for them. Forgive me if I sound critical. To criticize is not my intent...BUT RCE is a field where you absolutely have to do some personal research before asking for all of the answers. A good place to start would be right here on the local +fravia search engine perhaps followed by a visit to +Sandman's newbie tuts page.

And with this said, if you have some specific questions regarding a protection, one of your tools, or just plain ol' reversing in general don't hesitate to ask either here or at the Newbies Forum. There are many here willing to help...BUT only after you do your homework ;)

Regards,
Clandestiny
next
04-28-2001, 10:19 PM
where is it?
how do i find it?
can i post my the protected target exe to you?


revirgin Q
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > revirgin Q
PDA

View Full Version : revirgin Q

madmax!
04-27-2001, 07:27 PM
Came across an old scheme recently...Where the first few instructions of an API are copied to local process then the JMP API is adjusted to "middle" of API...Its obviously based upon a simple opcode scheme..I was wondering if Revirgin is able to handle such schemes? The sample I have appears to be packed with PeX 0.99 btw..If revirgin doesnt handle this, it could be a pain to rebuild IAT.

madmax!


How PEX 0.99 Redirects API's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How PEX 0.99 Redirects API's
PDA

View Full Version : How PEX 0.99 Redirects API's

Kayaker
04-27-2001, 11:36 PM
Hi All,

Madmax!'s post made me dig up some old notes that I'll pass on if it can help anyone. You're right, Revirgin doesn't seem to handle what Pex does. But that's not why I'm writing. Pex .99 is actually a very interesting packer to study for anyone wanting to see an example of wtf a "redirected API" is, what with all this talk of it with Asprotect and such (you listening Clandestiny ;)

I'll use the example of packing Win98SE Notepad with Pex 0.99 with the Import encryption option. The IAT start RVA is 4062e0 in the regular file, same in the packed file.

I'll actually be discussing what's happening in the packed file, but if you want to unpack it, what I did was to break into the Import encryption routine by setting BP's on pops and popads until I found it. There's probably a better way to do it using an API, I just kind of winged it through the code as I went along. I've found that *sometimes* pops and popads are like little stable islands in Self Modifying Code (SMC) that you can set breakpoints on. Actually, a quick way to get close to the OEP and bypass even the Import encryption routine is to break on VirtualFree. A few SMC runs with RET's after this is the jump to the OEP, where you can dump an unpacked file, albeit with corrupted IT, as usual.

:0040D03C 50 PUSH EAX ;4010CC for Notepad
:0040D03D C3 RET

Now comes the interesting part. Continue into notepad after unpacking. The 1st Call is at
4010d3 Call [4063e0]
If you display the contents of 4063e0, which is an address within the IAT, you see it points to 40d6d7. This is actually the concept of a "redirected" API. Normally this should point to the ASCII API name, but, well, it's redirected.

Go to 40d6d7 and there's an immediate jump to GetCommandLineA:
:0040D6D7 E9FEEEB7BF JMP KERNEL32!GetCommandLineA

This is the simplest situation, a direct jump. Now how do we know that the bytes E9FEEEB7BF jump to that API? If you add the effective RVA at the end of the 40d6d7 line, where the jump actually takes place from, with the offset in the bytes, you get the API address. i.e.
40d6d7 + 5 bytes = 40d6dc.
Add 40d6dc + BF B7 EE FE (reverse order) = BFFBC5DA = Address GetCommandLineA
E9 is just the opcode for far jump.

You can use Exescope for example on Kernel32.dll to confirm that BFFBC5DA is the start of the GetCommandLineA function.

...continued...
Kayaker
04-27-2001, 11:37 PM
OK, on to the next Call in notepad.
401119 Call [406390] which addresses 40d4e8
Take a look at 40d4e8 and you see

:0040D4E8 EB01 JMP 0040D4EB (JUMP )
:0040D4EA AD LODSD
==> 0040D4EB 2BD2 SUB EDX,EDX
:0040D4ED EB01 JMP 0040D4F0
:0040D4EF AF SCASD
:0040D4F0 68041DFABF PUSH BFFA1D04
:0040D4F5 E9BAA2B6BF JMP BFF777B4

Now that's an ugly collection of bytes. The jump to the API is the last one and can be calculated the same as before.
40d4f5 + 5 bytes = 40d4fa
40d4fa + BF B6 A2 BA = BFF777B4 and jumps to GetStartupInfoA.

The only problem is that the real GetStartupInfoA is actually addressed at BFF777AD, 7 bytes earlier. What's happening? Well *some* of the jumps to API's in Pex actually have up to several lines run in program code instead of API code. If you look at the start of this API, you see where they would normally be run:

KERNEL32!GetStartupInfoA
:BFF777AD 2BD2 SUB EDX,EDX
:BFF777AF 68041DFABF PUSH BFFA1D04
:BFF777B4 64FF32 PUSH DWORD PTR FS:[EDX]

Notice the 2 "EB01" lines in the program code. This equates to "jump 1 byte", so you can see how the LODSD and SCASD lines are just pure garbage code and are never executed. Instead the SUB EDX,EDX and PUSH BFFA1D04 lines, which are the first 2 lines of the API code, are executed in program code, then the final jump is offset by the number of bytes already executed.

...continued...
Kayaker
04-27-2001, 11:40 PM
This type of redirection is done throughout the code, generally only an EB01 is used in Pex .99, so it's simple to follow, but it could be anything. Here's another example, in this case the EB01 creates SMC, so you need to *read* the bytes, not the converted ASM line.

:0040D4FA EB01 JMP 0040D4FD (JUMP )
:0040D4FC 16 PUSH SS
==> 0040D4FD 57 PUSH EDI
:0040D4FE EB01 JMP 0040D501
:0040D500 17 POP SS
:0040D501 6A21 PUSH 21
:0040D503 EB01 JMP 0040D506
:0040D505 192B SBB [EBX],EBP
:0040D507 D2EB SHR BL,CL
:0040D509 011B ADD [EBX],EBX
:0040D50B 68671DFABF PUSH BFFA1D67
:0040D510 E90BA2B6BF JMP BFF77720 ;jump to API

But the real API address is at:

KERNEL32!GetModuleHandleA 
:BFF77716 57 PUSH EDI
:BFF77717 6A21 PUSH 21
:BFF77719 2BD2 SUB EDX,EDX
:BFF7771B 68671DFABF PUSH BFFA1D67
:BFF77720 64FF32 PUSH DWORD PTR FS:[EDX]

Cool huh?

...continued, I hate the message size limit...
Kayaker
04-27-2001, 11:41 PM
Here's one more, with a bit more SMC. See if you can sort out what's important in these bytes in "encrypted" code and then see if that matches up with what would normally be done at the start of the API.

:0040D791 EB01 JMP 0040D794
:0040D793 0F58EB ADDPS XMM5,XMM3 
:0040D796 0110 ADD [EAX],EDX
:0040D798 59 POP ECX
:0040D799 EB01 JMP 0040D79C
:0040D79B 115AEB ADC [EDX-15],EBX
:0040D79E 0112 ADD [EDX],EDX
:0040D7A0 6840800000 PUSH 00008040
:0040D7A5 EB01 JMP 0040D7A8
:0040D7A7 17 POP SS
:0040D7A8 6A00 PUSH 00
:0040D7AA EB01 JMP 0040D7AD
:0040D7AC 196A00 SBB [EDX+00],EBP
:0040D7AF EB01 JMP 0040D7B2
:0040D7B1 1B6A02 SBB EBP,[EDX+02]
:0040D7B4 EB01 JMP 0040D7B7
:0040D7B6 1D52EB011E SBB EAX,1E01EB52
:0040D7BB 51 PUSH ECX
:0040D7BC EB01 JMP 0040D7BF
:0040D7BE 1F POP DS
:0040D7BF 50 PUSH EAX
:0040D7C0 E95B82B4BF JMP BFF55A20

Real API:

USER32!LoadCursorA
:BFF55A0F 58 POP EAX 
:BFF55A10 59 POP ECX
:BFF55A11 5A POP EDX
:BFF55A12 6840800000 PUSH 00008040
:BFF55A17 6A00 PUSH 00
:BFF55A19 6A00 PUSH 00
:BFF55A1B 6A02 PUSH 02
:BFF55A1D 52 PUSH EDX
:BFF55A1E 51 PUSH ECX
:BFF55A1F 50 PUSH EAX
:BFF55A20 E9B9B8FFFF JMP USER32!LoadImageA

Hope this was enlightening.

Regards,
Kayaker
beierno
04-28-2001, 12:45 AM
Hi kayaker

Just to clear something up for me, but its not actually the redirected API calls that 'confuses' revirgin but more the adding of a offset to the API call or......
I'm on deep water ;)
beierno
goatass
04-28-2001, 10:34 AM
Kayaker, that was very cool thanks for that post it's very informative.

great job.

goatass
Clandestiny
04-28-2001, 10:58 AM
Hiya Kayaker,

Many thanks for sharing your notes. I've already read it through a couple of times...and saved it on my hd for future reference :)

Cheers,
Clandestiny
Kayaker
04-28-2001, 12:47 PM
Hi,

Hey, I'm glad people found the scheme used by Pex as interesting as I did. I forgot to mention there's an article on API hooking that discusses a somewhat similar redirection technique. A lot of people have probably been to this site before anyway, but there's some great articles here too:

API Spying Techniques for Windows 9x, NT and 2000
Yariv Kaplan

h**p://www.internals.com/articles_main.htm

BTW, I realize I was using the phrase RVA (Relative Virtual Address), when I 'spose VA would've been more accurate.

beierno, I can't answer your question because I don't know how Revirgin traces redirected calls. If I did know, I'd have to be killed anyway to protect the secret. So it's just safer if I don't even hazard a guess ^_^

Kayaker
madmax!
04-28-2001, 03:03 PM
Well, understanding it is the "easy" part...Now its about unpacking it...I guess the only solution lies in customized unpacker for these situations..Unless you wanna fix all the "modified" API entries, but that could be cumbersome =P

madmax!
SplAj
04-29-2001, 04:14 AM
Hi kayaker.

read your 'tut' with interest and I am sure Tsehp is 'heads down' as we speak ;) .... I have not DL pex or tried it out yet, but my thought about using code to emulate 'part' of the API call is a little dangerous and not 'future' proof ? if Kernel32.dll changes slightly then the packed proggy passes incorrect parameters based on an old Win 95 API then who knows what the f*ck will happen. OR does this re-direction actually TAKE code from the beginning of the API and THEN emulate it so as always to be current ?

Just a thought before I have my morning coffe and I wake up ...duh }>

SplAj
Kayaker
04-29-2001, 06:15 AM
Hi Splaj,

That's a darn good question to be asking before your morning coffee :)

Luckily Pex comes with source. I certainly don't profess to fully understand it, even after several coffees, but it appears to be an implementation of that Yariv Kaplan API hooking technique I mentioned. The compression routine itself is based on the APLIB compression library. The API redirection routine is down near the bottom of pex_loader.asm.

It does seem to read the first few lines of the API's while the file is mapped into memory. Apparently it uses the original IAT to get the API name, then GetProcAddress to get the function address. It seems to use internal 1 and 2 byte opcode tables to match valid opcodes with the API code.

At line 592 you can see where the EB01 + garbage byte are inserted into the code:

@fix_pointers:
push 3
pop ecx
mov word ptr[ebx],01EBh ; junk jmp $+3
mov byte ptr[ebx+2],al ; bogus byte
add dword ptr[ebp+@passed],ecx ; inc counter
add ebx,ecx ; inc pointer
_trash 0C7h

movzx edx,dl ; mask edx
add dword ptr[ebp+@passed],edx ; inc global counter
@copy_func_bytes:
mov cl,byte ptr[eax] ; copy bytes from
mov byte ptr[ebx],cl ; *eax to *ebx
inc eax ; increment pointers
inc ebx ;
dec edx ; decrement counter
jne @copy_func_bytes
jmp @next_opcode ; go to next opcode

I'm hoping someone can explain to me what the "_trash 0C7h" line means. The author uses "_trash" and "_junk" lines throughout the code, always tabbed over in the comments section. I've not seen this before, what does the underscore signify in MASM?

An interesting study in any case, there's BPX detection in there as well.

Kayaker
+SplAj
04-29-2001, 08:24 AM
Greetz Kayaker,

I tried in vain to get pex.zip and nfo.zip from protools :-( -.......jeez I am as crap at web surfing as fishing for serials in crackmes ;) even after my coffee !

Could you 'upload' these two zip files (only teeny size according to protoooooooools) as attachments here on the MB. I am sure Bart don';t mind !

TIA

SplAj
Kayaker
04-29-2001, 12:32 PM
I'll try, but this board (not the other boards) has always kicked me out of being logged in when I post a message.

Even if it doesn't work, I just now got the file anyway from

http://www.suddendischarge.com/download.query?id=0x30A4141F
Kayaker
04-29-2001, 01:00 PM
Looks like my 1st post didn't go through. I can't upload to this board, seems it doesn't like me, though I can to the other boards. In any case, I just now d/l the file from:

http://www.suddendischarge.com/download.query?id=0x30A4141F
()whore
04-29-2001, 11:06 PM
hello kayaker. Very nice, I even understood it which is the amazing part. But a little knowledge is a dangerous thing. Now for some strange reason I think I can trace through smc and understand it.


eLicense, need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > eLicense, need help
PDA

View Full Version : eLicense, need help

none
04-27-2001, 11:48 PM
Recently i've stumbled upon nonstandard
(or at least so it seems to me) version.
If runservice.exe, which is part of the online registration sheme/protection, along with
vtcpack24.dll and zsapi.dll, is disabled, ie not loaded at all from registry or killed at runtime,
unpacked proggy crashes immediately, or in a few minutes - few mouse moves.

Proggy, AC Explorer Pro is a mapping and database utility for Asheron's Call. Can be found here (edit out url if it's inappropriate),
w w w.zuggsoft.com

regards
LaptoniC
04-28-2001, 06:24 AM
Put a breakpoint on freelibrary and trace a little bit you will see jump very near.Dump with icedump or stop it at these point by
a eip
jmp eip
in softice then dump with procdump.


bilieve it or not
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > bilieve it or not
PDA

View Full Version : bilieve it or not

Mustapha
04-28-2001, 07:39 AM
http://www.software-key.com/


how i crack it?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how i crack it?
PDA

View Full Version : how i crack it?

next
04-28-2001, 10:31 PM
hello:
who can crack synplify6.2 of PC PLATFORM
? it's url is www.synplicity.com.i have downloaded it.i try to crack it too.i disassemble it with w32dasm .but i cann't find the same lmgrxx.dll as
modelsim/powerpcb ,etc.so i don't know how crack it.that is, i cann't find key1,2,3,4,5/seed1,2
who can crack it or give me a tips?
Best Regards


Asprotect 'upgrading' question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asprotect 'upgrading' question
PDA

View Full Version : Asprotect 'upgrading' question

Sorvat
04-28-2001, 10:56 PM
Hi all in the msgboard. This question is for anyone who's working (or has finished) on latest versions of AsProtect.

¿Anyone could unpack and make working .EXEs?
If yes, please post something about it. Or just mail me an URL of where can i get some kind of tut....

Thanx in advance


help needed with vbox 4.2-protected app
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help needed with vbox 4.2-protected app
PDA

View Full Version : help needed with vbox 4.2-protected app

machgun
04-29-2001, 04:25 AM
I'm a newbie in unwrapping, so please don't bash me too hard. :)

Recently ran into QDesigner 8 (formerly PowerDesigner from Sybase, now offered by Quest) - it's wrapped with vbox 4.2 (at least about box in trial dialog says so). I tried procdump 1.6.2 with vbox 4.2 plugin on, but it doesn't seem to unwrap correctly - IAT doesn't seem to be rebuilt properly and resources are not recovered except for those that were not encrypted. OEP is recovered ok. App crashes with page fault when started.
Can anyone provide me a quick tutorial on how to dump and fix this app? I feel like I'm missing something here but as I am really new to manual unwrapping, I'd gladly accept any help.

For those interested, I can provide URL to download the trial (53 megs).


3D-FTP 4.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > 3D-FTP 4.0
PDA

View Full Version : 3D-FTP 4.0

no name
04-29-2001, 07:07 AM
I'm trying to crack the latest version of 3d-ftp, which can be downloaded from www.3dftp.com

First I tried to disassemble it with IDA, but all I got was a pile of junk.

Then, when I tried to break in with softice, I always found myself somewhere in msvbvm50.dll. Pressing F12 doesn't help, it either gets me into some other function in the dll or it just closes softice and never gets back. So far I haven't been able to find a way to get into the application code :(. It's very frustrating...

Is there anyone out there who can help me ???


java reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > java reversing
PDA

View Full Version : java reversing

jimmy
04-29-2001, 01:43 PM
Hi!
Can anybody tell me where i can find java reversing tutorials?
Examples how to find serial/name etc...?
Thx very much

bye

jimmy
Latigo
04-29-2001, 02:40 PM
Hi!
I have a couple of java tutes reversing at my site..www.latigo.cjb.net
Hope that helps!

Byeeeeeeeeeeeee

Latigo
goatass
04-29-2001, 09:34 PM
It's pretty simple actually, just get JAD and decompile the class files and you will be able to easily find the place of the serial calculations and make a keygen or whatever.

goatass
the analyst
04-30-2001, 03:33 AM
jimmy (04-29-2001 03:43):
Hi!
Can anybody tell me where i can find java reversing tutorials?
Examples how to find serial/name etc...?
Thx very much

bye

jimmy

heya :)

i did 2 tuts about that subject.

- introduction to java reversing :

http://www.leelouonline.com/users/bofh/java.txt

- Reversing a WEB chat protocol:

http://www.leelouonline.com/users/bofh/protreverse.txt

hope it can help
later,

the analyst / UCF

www.oldreverser.cjb.net


thx but...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > thx but...
PDA

View Full Version : thx but...

jimmy
04-30-2001, 06:14 AM
Thx to everybody
for the answers, but my file is cripted. It use a class file and an extern file .bin. I have decripted the first part, and i suppose to have understand the next part of cripting :).
But if anybody knows tuts with examples of java cripted files plz tell me.

thx again and bye

jimmy
mike
05-02-2001, 01:51 PM
Well, what kind of encryption is it? DES? Blowfish? Vigniere cipher?
Truncated linear conguential generator?

If you can't tell, send me the decompiled code & I'll have a look.

If it's strong encryption, the best you'll be able to do is a dictionary attack.
jimmy
05-02-2001, 05:15 PM
Hi mike,
I don't know the name of the encrypt. The prg is VisualRoute 5.0b.
It is composed of 2 principal files:
vr.bin and vr.class
I have decompiled vr.class with jad, and i have found a first decrypt of vr.bin. I have added my save routine in Java and compiled it again. This patch save the new file. I have JADed this new file, cos it is a class, but a new loading of bin is maked. Sorry for ambiguos post, but if u want look at this prg.

Thx & bye
mike
05-03-2001, 02:46 PM
So there's no password, just a fixed transform to unobscure the code. That ought to be easy to reobscure; just invert the "crypting" code to create a new bin file, or remove the decryption code entirely from the class file and just load the decrypted one directly.


IDA Pro reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IDA Pro reversing
PDA

View Full Version : IDA Pro reversing

Appendix
04-30-2001, 01:19 PM
Hi. I find interesting essay about IDA Pro 4.15 reversing (http://www.reversing.net/articles/master/002/ida2.html), but it on russian :(
My russian is not so good (may be some peoples want to translate?), but I learn some new ideas how to enhance IDC engine. Stil waiting IDC MP3 Player =)
--
04-30-2001, 04:55 PM
http://babel.altavista.com/

;)


NetObjects Fusion MX Vbox v4.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > NetObjects Fusion MX Vbox v4.5
PDA

View Full Version : NetObjects Fusion MX Vbox v4.5

LaptoniC
04-30-2001, 03:28 PM
I have tried but couldnt achived to unpack it.It is very different than vbox 4.3.Does anyone tried this and can give me a clue.Thanks for any help


Linux
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Linux
PDA

View Full Version : Linux

Sorvat
04-30-2001, 08:02 PM
Hey, just a question, I need to know about any good linux cracking resources in the net.
Just want to learn, thanx
Carpathia
04-30-2001, 09:07 PM
Try hcunix.org / hculinux.cjb.net


Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing
PDA

View Full Version : Reversing

A_m_A
05-01-2001, 01:19 PM
Anybody know a linux reversing site?
i know hculinux.cjb.net. Are there other sites with tutorials on linux reversing?

thx very much
meRlin
05-01-2001, 03:12 PM
Hi,
There is UIC's site in italian, and a couple moore with a few tutorials.
I suggest that all of us intrested in learning to crack linux applications get together under the Mini Project Area here, then we can work together from scratch.
I do not have much experiance in the subject but want to learn (where is the best tool, how to set them up etc..), 1 software is all that I've been cracking so far (pretty easy).
There was another posting about where to find a good linux reversing site, I think we should "grab" that fella too!

meRlin
A_m_A
05-02-2001, 04:37 AM
Hi meRlin,
thx for ur answer.
I have found 3 italian sites for linux reversing:
quequero.cjb.net
masparev.cjb.net
racl.oltrelinux.com
If u find other sites plz REPLY.

thx meRlin

bye

P.S. : thx for your tutorial
grugq
05-02-2001, 04:48 AM
well cracking != reversing. and the easiest way to reverse most linux applications is with vim.

However, assuming that you somehow find a shareware application that you absolutely must have and can't shell out the cash for, you will want to crack it. Cracking on Linux is damn easy, you can control they entire environment of the application, the system calls can be trapped via LKMs, the library calls can be trapped via LD_PRELOAD, the binary can be examined in all the usuall ways (i.e hex editor == biew, disassembler == objdump (if its trivial, like most binaries are), IDA (if it hasn't been protected, like most binaries are), or the bastard (if it is a real protected binary and you are willing a developing tool))...

I would suggest that all you aspiring linux crackers take some time out from your busy lives and learn how to use linux first. Then you can tackle writing an LKM to expand ptrace() to actually be useful. For those of you that want to get a little glimpse of where Linux reversing could go, try your hand at some of the root kit binaries that get posted to incidents@securityfocus.com, those are enlightening as to the quality of skript kiddie code... Additionally, you might want to look at the tools we have archived at http://packetstorm.securify.com/linux/reverse-engineering/ I think they have an old version of the bastard as well as my tools (hehe, old!).

you should look into mb.hcunix.org, and www.hcunix.org, because "linux cracking" started (publicly, that is) with SiuL+Hacky's essays back in 96->97 (??)... there is a lot of groud to cover, and you have to learn unix first. If you only know how to get by on a shell account you will quickly find ourself outclassed by the targets you seek.

For lack of research, lack of historical perspective, and lack of respect for the coders that are trying to make Linux a viable commercial entity, I am forced to club to death 1800 baby seals for each of you.

Thanks to the kernel patch from the HCUnix team, I can automate this task...

-------------
# mknod /dev/seal b 666 0
# cat basher << __EOF__
#!/bin/ksh93

for ((i=0;$i<2;i=$(($i+1))))
do
for ((j=0;$j<1800;j=$(($j+1))))
do
/bin/club -d /dev/seal -c 1 -T "Thwack"
done
print "Slaughtered $j seals!"
done

__EOF__
# rm -rf /dev/seal
# /bin/clean_up_blood /bin/club

------------------

peace,

grugq.

for ((
Epic
05-02-2001, 08:40 AM
Here are some *nix (especially Linux) reversing tips, for you! windose crackers outside.

0. Install and learn how to use a decent *nix system. See
http://www.hcunix.org/epic/FASQ.html

1. You do not have to crack anything because
a) already open-source
b) an open-source implementation is available
c) not worthy to crack.

2. The best *nix cracking tutorial is the kernel. Learn!! C, read the kernel source.

3. #include "grugq's post"

4. If you're going to crack VmWare, do not!!

5. Try bastard. http://bastard.sourceforge.net/ But it assumes that you know
some assembler already :=)

6. Yeah, the Italians are VERY GOOD *nix crackers!! Learn Italian.

7. Learn some asm. Visit Konstantin's and _m's asm sites. Read, understand and learn.

8. Do you aware of something called "thread"?

Lol.

Epic

ps: missed all good days.
A_m_A
05-02-2001, 10:13 AM
Thx for your posts epic and gruq
Obey!

Learn LKM, thread and process is good?

thx very much
mammon_
05-02-2001, 03:53 PM
I have to agree for the most part with grugq's and epic's posts. Linux cracking is either really easy or really hard.

If it's really easy, it's because the native linux facilities for doing cracking are quite powerful -- grugq speaks the ways :)

If it's really hard, it's usually because
* you don't know how to use the tools
* you know nothing about the ELF format
* you know nothing about the C stdlib
* you know nothing about linux

The first step natch is to looking into your standard tools, a hex editor [biew, it is like hiew], a disassembler [ldasm will be familiar for newbies, it is like W32Dasm], and a debugger [ddd is good, as are the other gooey front ends to gdb like GVD and Insight and such. UPS is excellent, but you have to spend the time learning it, and it is really only useful for source-debugging]. If you have IDA 4.16, it runs under WINE. If you want softice, try PrivateIce, but it is tough to get working :)

Next, get the ELF file format from Intel or from the Teensy Linux Program site or from linux assembly.org. Write a good ELF header parser using #include <elf.h> until you are sure you know what everything in the program does.

Then, learn C. Pay attention to the weird things you can do with libraries :) Look at the linux assembly language sites to learn about the C calling convention and system calls; maybe write two or three asm programs. Once again, the whirlwind teensy guide is good.

Finally, learn the rest of linux. Read THC's hacking LKMs guide.

If you already know cracking [i.e., if you do more than just follow essays] then this should make linux cracking quite easy. Else, hit up the afore-posted sites and grab some essays.

_m
meRlin
05-03-2001, 05:50 AM
Yes!
You are all (almost) pointing to that cracking linux is not needed, what about learning linux this way have you thaugt about that?????
I would like to learn lin(un)ix and how it works, why should'nt I try to reverse it??
Yes maybe I want to reverse vmware and why not? maybe the hardest part with it is to get it up and running in a "slack" ditrubution!
I could try to reverse anything I want don't I?
As always this is all about learnig or?
To set up pIce (as _mammon said) is not an easy part, it involves maybe a pice of cake to you (compile the kernel so it would fit) but it is not for me as I'm new to these stuffs.
All I (we) need is a little help to get started with it.
I have read all tutorials that I found even the italian one with a bad transate from altavista.

meRlin
Epic
05-03-2001, 09:21 AM
http://www.linuxdoc.org/
http://www.hcunix.org

:=)
grugq
05-03-2001, 12:30 PM
[quote]meRlin (05-02-2001 19:50):
Yes!
You are all (almost) pointing to that cracking linux is not needed, what about learning linux this way have you thaugt about that?????

no we haven't, because it is a stupid idea. If you want to learn Unix, which is something I would recommend, read books and play with a shell. Don't think that you can get very far by pouring over the asm dump of '/bin/ls'... "ooooh. It seems to test the return value of opendir() for '0'... hmm, another 2 days of study and I will know what that means!"

I would like to learn lin(un)ix and how it works, why should'nt I try to reverse it??

apples and oranges.

Learning by doing. Get a Unice, install it and read && play. That is learning. If you want to reverse, reverse; but don't think that one will lead to the other. Reversing is very time consuming and learning Unix takes a very long time as well, why combine then for an astronomical indenture to your computer? You would be much better off listening to _m and learning C backwards and forwards. Get a copy of the C puzzle book and Reverse those... try your hand at obfuscated code. Reading asm is damn easy compared to reading well obfuscated C...

Yes maybe I want to reverse vmware and why not?

because reversing it is a waste of time, there is a freeware version which will give you access to the algo's used. If you just want to crack vmware, then go for it. There are tutorials on the internet so you won't even have to strain your brain.

maybe the hardest part with it is to get it up and running in a "slack" ditrubution!

no. That is very easy, even an idiot can do it, you should have no trouble.

I could try to reverse anything I want don't I?

er... yes? Not sure what that sentence is trying to say asie from some angst filled teenage hormone ridden american bullshit of independence and prividge laden statement.

As always this is all about learnig or?

yes. Learning means reading books, not reading asm dumps. If you don't read the Intel manuals how can you expect to know what people are talking about when the discuss r/m bits on an opcode? By that same token, unless you read books on Unix how will you learn to understand what I ment by a cmp of the opendir retval to 0? You can't reverse if you don't know what you are looking at.

To set up pIce (as _mammon said) is not an easy part, it involves maybe a pice of cake to you (compile the kernel so it would fit) but it is not for me as I'm new to these stuffs.

So? Do you think that we sprang full formed from the brow of some god? Well, actually, I did, and _m might have... The point is, everyone has to learn sometime. I would suggest that you compile your kernel before messing with pIce. As an asside, an assembler level debugger is less useful on Unix than DOS. Unix is extremely portable, running on almost every platform that can boot. If you want to use Unix as an expert, learn C. C is the lingua franca of Unix, not ASM (as in the win32 world, ooo 2 platforms x86 *and* Alpha!)...

All I (we) need is a little help to get started with it.

You have it.

I have read all tutorials that I found even the italian one with a bad transate from altavista.

Well, that isn't a very good place to start. Try www.linuxdocs.com rather. Those italian tuts were mediocre, like so many others in the scene. Its depressing really, you think that someone would bother to write some decent documentation.

peace,

grugq.
mammon_
05-03-2001, 02:12 PM
Once again grugq speaks words of wild wisdom, a treacle of truth. We *did* spring full formed from the brows of the gods on high.

OK, so you don't want to 'crack software', you want to 'learn linux'. This means you do not have to reverse engineer it, since the kernel, the libraries, the filesystem, and every significant subsystem are well documented and available in source code form -- you might as well reverse engineer orange juice.

If you can't read the source and/or docs, then your chance of understanding what is going on by decompiling the binaries is nil -- no more, no less.

Read the TLC lkm guide. Hit the LDP sites and read tlk [the linux kernel] along with the Guides, and a few how-tos. Hit hcunix.org and read dose's stuff and redplait's stuff and my stuff [hint try www.hcunix.org/$HANDLE for better info than is on the main page].Hit Kenton Lee's site and learn how X works. Hit linux assembly dot org for the finer details.

...

Now for what I don't get: reverse engineering is the attempt to reproduce the engineering process [in the computing paradigm, this is 'source code'] based solely on the examination of the result of that process [a 'program'] ... meaning, in the sense of 'reverse engineering linux' in order 'to learn linux', that you are trying to recover the source code in order to learn how the OS works.

However, the source code is readily available -- reverse engineering open source software is like hacking the wheel to pieces and then re-inventing it with the splinters.

Now, if what you mean by 'reverse engineering' is 'cracking' --and, since you bring up vmware [what? no OSS? :)], I suspect it is-- then you will ignore everything gruq and Epic and I have posted because you are NOT trying to learn linux, you are trying to learn how to crack linux programs *without knowing a thing about linux*.

Remember how the lamest, most pathetic crackers on windows were the ones who had no clue how windows worked? It's the same thing. Learn the damn OS.

_m
mo k
05-03-2001, 02:43 PM
ROFL,

remember, grugq said that most linux applications
are cracked with vi alone. right?
That means, don't disassemble every exe
that comes your way, it *could* be a shell
script ;P

First, before you go into specific linux internals,
learn the api interface of unix in general. Get
rich stevens' "Advanced" and "Illustrated" and
code!
Most of the crackworthy applications are meant
to be portable, so they retain the same interface
with all systems. Except in very little places.

But be warned, if you are not a programmer,
you will have a tough time learning the guts
of the system. Everything is scriptable: from
the boot loader to the window manager.

My tip is, don't concentrate on cracking alone,
you will definetly have a good time there, just
sport a sense of curosity, and play.

Have fun


DLGTEMPLATE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DLGTEMPLATE
PDA

View Full Version : DLGTEMPLATE

p:g:
05-02-2001, 05:17 AM
Did anyone try to load a dialog box resource from a program instance into memory? If so, can help me?
Dr.Golova
05-02-2001, 07:30 AM
Hi, this code ripped from PE Encrypter - it use DialogBox loaded directly from memory.

lea ecx,[ebp+DlgTemplate]
lea edx,[ebp+DlgProc]
push ebp
call [ebp+_CreateDialogIndirectParamA],eax,ecx,0,edx,WM_USER

[skip]

DlgTemplate dd WS_SYSMENU or WS_CAPTION or WS_VISIBLE or DS_3DLOOK or DS_MODALFRAME or WS_POPUP or DS_CENTER
dw 0,0,1 ; num of items
dw 100,100,100,20 ; x,y,dx,dy
dw 0,0 ; menu & class
db 'E',0,'n',0,'t',0,'e',0,'r',0,' ',0,'P',0,'a',0,'s',0,'s',0,'w',0,'o',0,'r',0,'d',0,0,0 ; the title of the dialog
@wordalign Addon,0
dd ES_PASSWORD or ES_LEFT or WS_VISIBLE or WS_CHILD or WS_BORDER or ES_AUTOHSCROLL
dd 0 ; ext. style
dw 5,5,90,8 ; x,y,dx,dy
dw 1 ; control id
dw 0ffffh, 81h ; class id = "edit"
db 0,0 ; edit text
p:g:
05-02-2001, 09:58 AM
Thanks a lot,
But my assembly language knowledge is not so good: don't you know where I can find the same example but written in C language?
I'm more expert in writing program usin' the C and the API.


Problem with VBox 4.3 tut by Fravia under Win 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Problem with VBox 4.3 tut by Fravia under Win 2000
PDA

View Full Version : Problem with VBox 4.3 tut by Fravia under Win 2000

eLastx
05-02-2001, 11:21 AM
I`m trying to extract VisualCafe by Webgain which is packed with VBox 4.3. The dump is successful and I can run it under Win 98. But when I try to run it under Win 2000 it fails with an error ("... could not be initialized"). Any clues?
Sorry for such a lame question but I`m just curious why an unboxed app runs under a certain os and fails under another.
mike
05-02-2001, 01:55 PM
Because VisualCafe is a windows 98 app & doesn't run under win2k?
eLastx
05-02-2001, 03:02 PM
mike (05-02-2001 03:55):
Because VisualCafe is a windows 98 app & doesn't run under win2k?

Not really :(
It`s a Java Tool which runs under Win 2000. But only if it`s boxed in VBox.
tsehp
05-02-2001, 03:23 PM
the response could rely on iat's used...
some api names are not the same between win 98 and win 2k, so what did you used ti dump it ?
eLastx
05-02-2001, 04:42 PM
I used procdump with "rebuild new it" checked and made a full dump. The other options failed. Attempts with TRW2000 were unsuccessful.
+SplAj
05-03-2001, 03:40 AM
Hi,

Some part of the dumped exe PE Header is wrong using ProcDump this way... did you try to dump + fix up with PEditor1.7 ?

Sometimes you still get 'C000000005' errors in WinNT/2K and then you start playing around with the PE Header voodoo to fx it :-(

SplAj
Cps530
05-03-2001, 06:52 AM
That's exactly my problem with an application. I tried to use PE Editor 1.7 but no success. I don't know where to start from. Has someone any additional information? Thanks so much.
eLastx
05-03-2001, 10:45 AM
It`s as SplAj said:
the dumped file throws an 'C000000005' error. I fixed the checksum and rebuild the it with PEditor but I can`t get rid of the error. That`s so frustrating :(


CommView 2.6....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CommView 2.6....
PDA

View Full Version : CommView 2.6....

+SplAj
05-03-2001, 04:17 AM
CV2.6 is dis-ASprotected and patched...
mmmmm nothing new to report :-( RV is still the 'cock of the school' and bashes ASProtect API redirection to a pulp :-p

I will not post any OEiP/iT etc addresses so you can have some fun
The only thing I will add is the real CRC checksum should be :-

F69788A7C2385B8294C6E100412DE4BA

HEX edit this to raw 0x1758BC and then check out the code called at VA 568FD1 ... so change the address to point the wrong CRC somewhere else ;)

BTW I did not like the new 'pinky' icon so changed it. I have attached it for you if you don't like tamo's icon either......

'patch+play'
+SplAj
NotMe
05-04-2001, 02:37 PM
8)

ImageBase : 400000
EntryPoint : 169588
IAT Start RVA : 1761F4
IAT Length : 8CC
tsehp
05-05-2001, 06:57 AM
well done,
I'm currently working to ease again the task of the big fat lazy reverser that I'm actually:-)
The revirgin tracer is almost finished, it will allow to easily find the target's oep, this tracer is finished on win2k, almost on win9x, then a temp revirgin version will be released.
This tracer could also be used to improve the iat tracing, avoiding the small list (alexey's lame attempts to stop revirgin) of iat's that are not resolved by the current tracer.

regards,

+Tsehp
+SplAj
05-06-2001, 04:39 AM
Opinions on the 'CRC' check system.....

I have seen this anti patching scheme on previous CV versions. I thought it was a Tamo add-on. Now I saw it on T&R1.9.... For sure this layer of anti-patching' code is NOT part of ASP1.2....So WTF is it, a module 'add-on' to ASP ? a new Alexey program ? a new Alexey's friend program ? I don't know...only that it's possible to dick it in 5 minutes once you trace the algo to it's
end and see what the real CRC code is REPZ'd. Then just emulate it in
the disprotected exe ;)

Your comments please...

SplAj
Grievoe (restored)
05-20-2001, 09:59 AM
What's the packer of Commview 2.5?
I can't use the aspr(v1.2) unpackers downloaded from http://protools.cjb.net .
With the helps of IDA, hiew and td32, I found that CV2.5 has five layers ecryption routines, each of which has random garbages inserted, at the very first beginning.


Armadillo protected soft
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Armadillo protected soft
PDA

View Full Version : Armadillo protected soft

LaptoniC
05-03-2001, 06:23 AM
My previous question didnt get any reply.I guess it is due to it is so short and look likes crack request.So I will try to be more specific in this post hopefully
I am working on armadilo protected soft which I havent seen before.It doesnt create *.tmp file it just shows register dialog if you give wrong serial it just quits no trial option.So I couldnt managed to unpack it.Anyway, I have problems with it when I try to use SoftICE.Trw2k runs smoothly but SoftICE crashes all the time.Here is the snippet when I run my app with icedump 6.0.23(Protect on swich is activated)

0167:10005852 C685B4FDFFFF01 MOV BYTE PTR [EBP-024C],01
0167:10005859 C685A4FDFFFF01 MOV BYTE PTR [EBP-025C],01
0167:10005860 8365FC00 AND DWORD PTR [EBP-04],00
0167:10005864 0F018D8CFCFFFF SIDT FWORD PTR [EBP-0374]
0167:1000586B 8B858EFCFFFF MOV EAX,[EBP-0372]
0167:10005871 83C008 ADD EAX,08
0167:10005874 8B18 MOV EBX,[EAX] ;Here icedump stops
0167:10005876 83C010 ADD EAX,10
0167:10005879 8B00 MOV EAX,[EAX]
0167:1000587B 25FFFF0000 AND EAX,0000FFFF
0167:10005880 81E3FFFF0000 AND EBX,0000FFFF
0167:10005886 2BC3 SUB EAX,EBX
0167:10005888 83F81E CMP EAX,1E
0167:1000588B 7535 JNZ 100058C2
0167:1000588D 8B852CFCFFFF MOV EAX,[EBP-03D4]
0167:10005893 8B8D2CFCFFFF MOV ECX,[EBP-03D4]
0167:10005899 8B807C020000 MOV EAX,[EAX+0000027C]
0167:1000589F 338180020000 XOR EAX,[ECX+00000280]
0167:100058A5 8B8D2CFCFFFF MOV ECX,[EBP-03D4]
0167:100058AB 89817C020000 MOV [ECX+0000027C],EAX
0167:100058B1 834DFCFF OR DWORD PTR [EBP-04],-01
0167:100058B5 EB0B JMP 100058C2
0167:100058B7 6A01 PUSH 01
0167:100058B9 58 POP EAX
0167:100058BA C3 RET
0167:100058BB 8B65E8 MOV ESP,[EBP-18]
0167:100058BE 834DFCFF OR DWORD PTR [EBP-04],-01
0167:100058C2 0FB685A4FDFFFF MOVZX EAX,BYTE PTR [EBP-025C]
0167:100058C9 85C0 TEST EAX,EAX
0167:100058CB 0F853D010000 JNZ 10005A0E
0167:100058D1 83C8FF OR EAX,-01
0167:100058D4 83F8FF CMP EAX,-01
----will continue--------------------------
LaptoniC
05-03-2001, 06:25 AM
Icedump cant handle this and it results in bsod or sometimes total system crash.I have tried frogsice latest builds and two betas I got same result.It crashes.I have tried to change conditional jumps or to jump 100058B7 line but it gives same result.
This check as far as I know is IceCream check like below.As you have noticed they are different on (ADD EAX,10) line.I dont know what it points.Any help will be appreciated.

-------Snippet from CrackZ's Anti-Debugging & Software Protection Advice-------
ICECream detection (Windows 95).
Get the Interrupt Descriptor Table (IDT) with the SIDT command.
Get the address of Interrupt gate 1.
Move 16 bytes back.
Check if byte is 1Eh - if so SoftICE is running.

SIDT FWORD PTR opIDT <-- Store IDT.
MOV EAX, DWORD PTR [opIDT+2] <-- EAX=IDT.
ADD EAX, 8h <-- EAX has INT 1 vector.
MOV EBX, [EAX] <-- EBX=INT 1 vector.
ADD EAX, 16h <-- EAX points at INT 3 vector.
MOV EAX, [EAX] <-- Get EAX=INT 3 vector.
AND EAX, 0FFFFh
AND EBX, 0FFFFh <-- Remove selectors.
SUB EAX, EBX <-- Find displacement.
CMP EAX, 01Eh
JZ SoftICE_3.0_is_running
-------Snippet from CrackZ's Anti-Debugging & Software Protection Advice-------
ps:I have also tried to find magic values for keygenerartion.Duelist released source code for Armadillo 1.8 I have debugged demo version and its keygen algo is same as my app.However I couldnt saw the values he used in keygen.
the analyst / UCF
05-03-2001, 04:57 PM
[quote]LaptoniC (05-02-2001 20:23):
My previous question didnt get any reply.I guess it is due to it is so short and look likes crack request.So I will try to be more specific in this post hopefully
I am working on armadilo protected soft which I havent seen before.It doesnt create *.tmp file it just shows register dialog if you give wrong serial it just quits no trial option.So I couldnt managed to unpack it.

hello

hmm as far as i know
if you get the register dialog, it is coz soft ice is detected..
i did study armadillo quite a lot but i didn't look the last version yet.
however , i'm pretty sure about the sice detection ;)
try to run icedump and also put :
/protect ON
it should not be hard to bypass it and then unpack it.

last version changed a bit tho.
my unpacker doesn't work anymore .
there is something i have to study somedays, but it is pretty similar to previous armadilled version.

regards,

the analyst
LaptoniC
05-04-2001, 10:22 AM
Maybe you dont know but if programmer doesnt define default license there is no trial option.Try it with demo of armaillo if you want.So only way to run is to have good license.Reversing conditional jumps doesnt help because some of program code is crypted.I am confused.If anyone wants to try I have uploaded this file to h*tp://digital-avatar2.com/members/fikman/flasher.zip
the analyst / UCF
05-06-2001, 04:41 AM
LaptoniC (05-04-2001 00:22):
Maybe you dont know but if programmer doesnt define default license there is no trial option.Try it with demo of armaillo if you want.So only way to run is to have good license.Reversing conditional jumps doesnt help because some of program code is crypted.I am confused.If anyone wants to try I have uploaded this file to h*tp://digital-avatar2.com/members/fikman/flasher.zip

"Maybe you dont know but if programmer doesnt define default license there is no trial option."
"Try it with demo of armaillo if you want"

;-) well i bet you didn't listen to me ..
every version of armadillo i tryed (last ones), i couldn't play with it coz it asked me to register...
with icedump ran of course..
but heck, there is another soft ice detection , that if you AVOID it, armadillo runs very well, without register shit..
How do you think that guy that wanna try armadillo will do if they can't try it but only buy ?
no sence ...

the analyst
ThrawN
05-06-2001, 10:06 PM
I am working with 1.90 which was the newest version 3 weeks ago. It still creates the tmp file when you hit the nag. But when you click Ok and go into the program it also creates ANOTHER tmp file that was 16bytes and contained the text "‘”¼Ó•ûQ„—Ñ¡¤Ð" everytime i ran it. Around 2 secs more it created a tm0 file which disapeared pretty quick. Also Iv noticed the old methods of fixing the section that contained the X's didnt fully work now. The section that contains the X's also now contains code.

Does anyone have any more information they can share with me? THanks
LaptoniC
05-07-2001, 02:42 AM
;-) well i bet you didn't listen to me ..
every version of armadillo i tryed (last ones), i couldn't play with it coz it asked me to register...
with icedump ran of course..
but heck, there is another soft ice detection , that if you AVOID it, armadillo runs very well, without register shit..

I bet you dont listen me too :) Anyway just to inform you, I tried to run my target without installing softice I mean on fresh windows.So it is same again it says "this program needs security key to run.if you supply one you wont get this prompt again".If you click cancel program closes if you click ok reg dialog appears.I know it doesnt make any sense making software without trial option but if you dont define defaults license this is the way program runs.
the analyst / UCF
05-07-2001, 06:52 AM
LaptoniC (05-06-2001 16:42):

;-) well i bet you didn't listen to me ..
every version of armadillo i tryed (last ones), i couldn't play with it coz it asked me to register...
with icedump ran of course..
but heck, there is another soft ice detection , that if you AVOID it, armadillo runs very well, without register shit..

I bet you dont listen me too :) Anyway just to inform you, I tried to run my target without installing softice I mean on fresh windows.So it is same again it says "this program needs security key to run.if you supply one you wont get this prompt again".If you click cancel program closes if you click ok reg dialog appears.I know it doesnt make any sense making software without trial option but if you dont define defaults license this is the way program runs.

the guys who protected it is just a fucking retard then :)
coz if you can't try it, there is no sence.
looks like he doesn't handle armadillo that good, or he is just completely fucked ;)
dunno if there is still away, but i think you can bypass that dialog thingy
there is something to patch ..

later,

the analyst
the analyst / UCF
05-07-2001, 06:57 AM
ThrawN (05-06-2001 12:06):
I am working with 1.90 which was the newest version 3 weeks ago. It still creates the tmp file when you hit the nag. But when you click Ok and go into the program it also creates ANOTHER tmp file that was 16bytes and contained the text "‘”¼Ó•ûQ„—Ñ¡¤Ð" everytime i ran it. Around 2 secs more it created a tm0 file which disapeared pretty quick. Also Iv noticed the old methods of fixing the section that contained the X's didnt fully work now. The section that contains the X's also now contains code.

Does anyone have any more information they can share with me? THanks

what do u mean by 'The section that contains the X's also now contains code." ?
coz the section that contains X's is the code section.
so i guess it contains code ;)
what did u mean ?


VBox 4.3 expired
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VBox 4.3 expired
PDA

View Full Version : VBox 4.3 expired

eLastx
05-03-2001, 06:39 PM
I`m still trying to dump VisualCafe under Win2000 but the trial periode has expired. Is there a way to let VBox think, the trial periode has just started?
I deleted the the whole program, the VBox license files and all registry entries but still expired. Another attempt was the dialogboxparama return method (thx to Victor Porguen) but I still have a RaiseException.
Anyone can help?
pm
05-04-2001, 02:11 PM
As far as I remember you also have to delete 2 files:

c:\osYYYYYY.bin
c:\windows\system\wsYYYYYY.ocx

(YYYYYY are numbers)

After delete those reinstall the application and it should be fine. I hope :)

pm
Dr.Golova
05-05-2001, 12:50 PM
1) Use registry spy (RegMon) find two keys in CLSID, where VBox _write_ (use filters) info. Kill Him!!!
2) Kill all files in \Windows\VBOX
3) Kill all c:\osxxxxxx.bin
4) Kill all c:\Windows\System\wsxxxxxx.ocx
5) Reinstall application.


Packer Source Codes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Packer Source Codes
PDA

View Full Version : Packer Source Codes

Clandestiny
05-03-2001, 06:45 PM
Hi All,

Having been studying a little about packers as of late, I started thinking I might gain a better understanding by looking at some commented source code. So far I've looked at Protools and Iczelions win32asm site, but didn't see much in the way of source. If any of you guys know of a site where I can d/l source for a (preferably simple) packer I'd really appreciate the heads up :-) C, C++ or asm source please.

Thanks,

Clandestiny
Kayaker
05-03-2001, 08:59 PM
Hi Clandestiny,

You've probably already caught that there's source for PEX (sudden discharge), and the source for the aPLib compression library it (and aPack, and a bunch others) use is available at

h**p://members.nbci.com/_XMCM/jibz/apack/dload.htm

And there's also a forum that seems to be packer oriented where you might find something interesting:

h**p://groups.yahoo.com/group/exelist/messages/

Cheers,
Kayaker
Muad'Dib
05-04-2001, 11:33 AM
I believe that UPX is opensource. Also, if you would like, SantMat and I are working on a packer type utility that adds a password dialog box and encrypts/protects a program with a password. If you would like the source, send me an E-Mail.
Clandestiny
05-04-2001, 05:42 PM
Hi Kayaker,

Thanks for the heads up :) I've d/l several sources and the forum looks pretty cool too.
As always, you are a wealth of useful information ;)

Cheers,
Clandestiny
Clandestiny
05-04-2001, 05:47 PM
Hi Maud'Dib,

Many thanks to you as well for your kind offer. Yeah, I'm interested. I'll mail you direct.

Cheers,
Clandestiny
madmax!
05-06-2001, 02:01 AM
I noticed Maud mentioned a packer w/password option...Well, heres a little something i put together last summer for fun...Its functional, and i recall re-indexing the IAT to prevent easy dumping (before RV,etc came out)...I never got around to releasing/finishing it, oh well =) the about box was the best feature!

madmax!
Clandestiny
05-06-2001, 07:13 PM
Thanks MadMax :) I'll have a look.

Cheers,
Clandestiny


only demo version?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > only demo version?
PDA

View Full Version : only demo version?

WlAda
05-05-2001, 10:54 AM
Hi,
target:AED Tools
h**p://www.superdownloads.com.br/download.cfm?stats=7601

program is packed and protected by
ASProtect (? maybe that's why one section name is .aspr)
Program was unpacked and IT was rebuilt
(thank's go to revirgin)
OEip=4633e6 IAT begin at RVA 66000

Now it seems to me that the program is only demo version which can't be registered. The test on address 41c569
gives always the same result because the local variable (ebp-10h) is set to the constant value regardless of any check
(reg./not reg) => dialog with unregistered
message is always displayed. The original unpacked version look into win registers for item named Key. It's here possibility
that the code of unpacker can unpack 2 different versions (reg./not reg) of program ?

subroutine of unpacked program:

0041C4F0 push ebp
0041C4F1 mov ebp, esp
0041C4F3 push 0FFFFFFFFh
0041C4F5 push offset aXig ; "+xdG"
0041C4FA mov eax, large fs:0
0041C500 push eax
0041C501 mov large fs:0, esp
0041C508 sub esp, 88h
0041C50E push ebx
0041C50F push esi
0041C510 push edi
0041C511 mov [ebp-88h], ecx
0041C517 mov dword ptr [ebp-10h], 6 (!)
0041C51E mov eax, [ebp-88h]
0041C524 cmp dword ptr [eax+800h], 1
0041C52B jnz short loc_41C542
0041C52D mov ecx, [ebp-88h]
0041C533 mov dword ptr [ecx+804h], 1
0041C53D jmp loc_41C85D
0041C542 ; ---------------------------------------------------------------------------
0041C542
0041C542 loc_41C542: ; CODE XREF: seg000:0041C52Bj
0041C542 mov edx, [ebp-88h]
0041C548 cmp dword ptr [edx+800h], 1
0041C54F jnz short loc_41C556
0041C551 jmp loc_41C85D
0041C556 ; ---------------------------------------------------------------------------
0041C556
0041C556 loc_41C556: ; CODE XREF: seg000:0041C54Fj
0041C556 jmp loc_41C569
0041C556 ; ---------------------------------------------------------------------------
0041C55B db 4Ch ; L
0041C55C db 5Dh ; ]
0041C55D db 12h ;
0041C55E db 1Ch ;
0041C55F db 51h ; Q
0041C560 db 0C0h ; +
0041C561 db 0C8h ; +
0041C562 db 32h ; 2
0041C563 db 3Dh ; =
0041C564 db 0A7h ; º
0041C565 db 0A2h ; ó
0041C566 db 0EAh ; O
0041C567 db 4Ah ; J
0041C568 db 0A5h ; Ñ
0041C569 ; ---------------------------------------------------------------------------
0041C569
0041C569 loc_41C569: ; CODE XREF: seg000:0041C556j
0041C569 cmp dword ptr [ebp-10h], 6
0041C56D jnz short WithoutDialog
0041C56F push 0
0041C571 lea ecx, [ebp-74h]
0041C574 call sub_417EA0
0041C579 mov dword ptr [ebp-4], 0
0041C580 lea ecx, [ebp-74h]
0041C583 call j_MFC42_2514
0041C588 mov dword ptr [ebp-4], 0FFFFFFFFh
0041C58F lea ecx, [ebp-74h]
0041C592 call sub_40B0F0
0041C597
0041C597 WithoutDialog: ; CODE XREF: seg000:0041C56Dj

thank for ANY help, vlada
Dr.Golova
05-05-2001, 01:04 PM
Similar that the part of a code is encrypted. It cannot be deciphered without availability of a correct key. A capability partially encrypt a code, that unavialable in the nonregistered version and to decipher it "on fly" if there is a key is one from main dignities of ASProtect.


phone reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > phone reversing
PDA

View Full Version : phone reversing

Predator_PC_pGC
05-05-2001, 11:05 AM
I have 2 cellphones, siemens c25 and nokia 8890. I have this cable which I can use to connect the siemens to my PC.

I was wondering if anyone here ever tried reversing the software of a mobile phone.. because it looks like fun ;)

-Pred.
+SplAj
05-06-2001, 03:58 AM
Servus Predator

h**p://gsmfree.rulez.at

Gluck auf

Ich bin es SplAj
Predator_PC_pGC
05-06-2001, 07:50 AM
Danke splaj,
luckily I can read german ;)

I was not really referring to unlocking the phone though.. but more like, reading the full image - changing some stuff, whatever that would be - then write it back ;) IDA doesn't know of a C25 processor though and it does not support Nokia at all it seems.. that could be a little problem.. ;)

Oh well I'll keep on searching. Thanks for the url.

Schüss,
Ich bin es Predz :)
latigo
05-06-2001, 01:48 PM
Hi Pred :)
I've been looking for stuff like this for a long time. If you ever get some info on this subject, please let me know.
I kinda quit my search long time ago due to (apparent) lack of material
on the web. I wanted (want) to tweak a motorola phone.
But any info will be ok.
See ya.

Latigo
rot8
05-06-2001, 01:50 PM
Most of developers use ñ166 MC.
It is RISC.
Think about it ;)
rot8
05-06-2001, 02:04 PM
Whoops...
I meant C166 ;)

All the software for GSM phones is:
buggy proggie with..
1. Buggy GUI.
2. Stolen sequences of bytes, which do some job (unlockin, changin IMEI etc..)

nothing to reverse ;)
qferret
05-06-2001, 09:22 PM
I have seen a shareware utility to change some of the logos etc. on Nokia's...(actually, I think I found it because of a q posted in the newbies forum at one time [quite some time ago])

so it is definitely possible
Predator_PC_pGC
05-07-2001, 04:39 AM
rot8, thanks very much for your kind info ;-)

so a RISC disassembler is step 1.
now an app that can read the rom image and write it back to the phone.

i don't know any programs that do one of these things :)

perhaps someone else does?

thnx,
Pred.
rot8
05-07-2001, 08:52 AM
Predator_PC_pGC (05-06-2001 18:39):
rot8, thanks very much for your kind info ;-)

so a RISC disassembler is step 1.
now an app that can read the rom image and write it back to the phone.

i don't know any programs that do one of these things :)

What programs you want to get ?
IDA 4.15+ disaccembles c166 bins perfectly.
And there are huge collections of FLASH (not eeprom used for mobile firmware) files and programs to upload FLASH files into phone can be found in Internet.
So, try ;)
But I guess it is very hard target to reverse, such as 1-2mb of RISC code ;)
And also you must know schematic of target phone and most functions of ASIC chips, that are in the phone. ;)

Good luck.
qferret
05-07-2001, 11:00 PM
Hey Predator...if you're interested, the name of the shareware proggy is LogoManager....you could tear that apart and see how it interfaces with the phone, etc......may or may not help

/me shrugs ;-)
Latigo
05-08-2001, 09:30 AM
Hey Pred..i found some link here.
I don't know if you gonna learn or what, but you surelly will laugh :)
Give it a try: www.phonebashing.com

Bye!

Latigo
Predator_PC_pGC
05-09-2001, 03:26 AM
I'm afraid I don't have ida 4.15 or higher (I got 4.04) but thanks rot8 for all your info;

thanks Latigo for that good laugh ;)

tnx qferrety but i know about logomanager and it isn't what i'm looking for :)

thanks everyone ;) thanks to my family and friends and collegues and those who supported me and... LOL!!

pred.


Office 2000 help??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Office 2000 help??
PDA

View Full Version : Office 2000 help??

Sniper_J
05-07-2001, 12:22 AM
Ok, I burned a cd from my friends Program Files of Office 2000, but when I try to install it, it doesn't work. It has all the files, but no way to get them to work. Hit me back up if you can help
Kilby!
05-08-2001, 06:35 AM
I'm sorry caller you have me confused with somebody who is interested.

I take it you didn't look at the content of the board then ?

Kilby...
+SplAj
05-08-2001, 08:27 AM
BIG HINT......you should have copied the Office CD......then you could have clicked on that 'SETUP.EXE' icon :-)

simple uh ?

duh


Together v5.0 -- Java FlexLM license protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Together v5.0 -- Java FlexLM license protection
PDA

View Full Version : Together v5.0 -- Java FlexLM license protection

Solomon
05-08-2001, 04:05 AM
Target: h**p://164.109.49.29/files/products/together/controlcenter/1340/windows/together.exe(53MB, written in Java)

This one either needs a 15-day Eval license file named "eval_license.lic", which will be mailed to you after u register on their site for downloading, or FlexLM license server(v7.2d), according to "flexlm.config".

Here is my eval_license.lic:
FEATURE TogetherControlCenterEval together 5.0204 23-may-2001 \
uncounted BBFE2D15F78F HOSTID=DEMO

I have checked C:\Together5.0\lib\misclib.zip. It contains a package named "flexlm", which seems to be the Java implementation of FlexLM(I have decompiled the whole package). But I can't locate the place where this package is referenced, coz there are too many *.class files. (I have decompressed C:\Together5.0\lib\together.jar and searched in this jar for "flexlm", but no useful info)

So my question is: How to locate the 15-day check?
If so we can patch it or make a valid license file.

Thx for your help.
EVC_ViPeR
05-08-2001, 09:24 PM
I only have one experience with FlexLM using Java. If you found the folder flexlm, extract the file 'license.class'. Decompile it with JAD and there should be a function named 'checkout()', modify it to just return 0; and recompile and put it back to the jar file. This is just a hint based on other target. Wish this helps.

EVC_ViPeR
Solomon
05-08-2001, 11:47 PM
Thank you for your guidance?B I will try it.

BTW: Many ppl think highly of this UML tool. They compare it with Rational Rose.
crkr
05-11-2001, 03:30 AM
Solomon (05-07-2001 18:05):
Here is my eval_license.lic:
FEATURE TogetherControlCenterEval together 5.0204 23-may-2001 \
uncounted BBFE2D15F78F HOSTID=DEMO

Hmm.
Decompiling with jad gives a file named 'zx.jad' where you can find the following:

========================================================

public zs j() // starting at line 551
{

// ...

aj = new zah(af, x, y, ab, ac, ad, ae);
ao = an;

// ...

int j1 = 1;
int k1 = aj.a(1, al, am, j1, c(ao));

// ...

if(k1 == 0)
{
// good guy :-)
// ...
} else
{
// bad guy :-(
// ...

bb = aj.c();
IdeMessageManagerAccess.getMessageManager().getDefaultPage().printMessage(3, " License checkout failed: " + e());
if(n)
System.out.println(a(true) + " License checkout failed: " + e());
aj = null;
return null;
}

// ...
}

public static final int a = 30; // starting at line 1164
public static final int b = 6;
public static final int c = 30;
public static final int d = 8;
public static final double e = 1.25D;
public static final int f = 1;
public static final boolean g = true;
public static String h = "Cannot connect to license server";
public static String i = "

Together will not start without a valid license key AND proper license
management configuration. If you do not yet have a license key, click
Get License to request an Evaluation key at the TogetherSoft website.

Please write togethersoft.com if you need further assistance.
";
public static final int j = 1;
public static final int k = 2;
public static final int l = -1;
public static int m = -1;
public static boolean n = false;
public static boolean o = false;
public static String p = "flexlm.config";
public static final String q = "gubed.mlxelf";
public static final String r = "gubedlluf.mlxelf";
public static String s = "esnecil.dlo";
public static String t = null;
public static String u = " Together License Management";
public static String v = "oisoft/util/ui/plaf/windows/icons/Error.gif";
public static String w = "oisoft/util/ui/plaf/windows/icons/Question.gif";
public static int x = 0x13deeaac;
public static int y = 0xb0c8d383;
public static int z = 0xa2a1a978;
public static int aa = 0x10806c1;
public static int ab = 0x5d5e5687;
public static int ac = 0xbc9a61d6;
public static int ad = 0xa450a0eb;
public static int ae = 0xc420010c;
public static String af = "uphfuifs";
public String ag[] = {
"GpsJoufsobmVtf", "for internal use", "UphfuifsDpouspmDfoufs", "controlcenter", "UphfuifsXijufCpbse", "whiteboard", "UphfuifsFoufsqsjtf", "enterprise", "UphfuifsTpmp", "solo",
"UphfuifsDpnnvojuz", "community", "UphfuifsEfwfmpqfs", "developer"
};

// ...

========================================================
Solomon
05-12-2001, 07:49 AM
Thx crkr!

I patched "zx.class" and bypassed the initial check, but after I changed the sys date to year 2002 it tried to connect to a license server, even if I patched
zah.a(int j, String s, String s1, int k, String s2).
Need further digging.

Thx again.
crkr
05-12-2001, 09:59 AM
If you are familiar with FlexLM you should be able to build a valid license file using the information provided.

I am sure someone is releasing a ready made solution soon ...
Haldir
05-14-2001, 12:03 PM
I recommend reversing the Flexlm Server, well it is 7.2d, but it's still more easy than reversing the java code
poekie
06-11-2001, 08:37 AM
I didn't succeed in breaking the protection this way... anyone else had any luck?
plastiko
10-08-2001, 05:33 AM
I'm currently writing a diploma work about java applications and security, and one of my test-objects was together. you can use my findings to start this great development tool called together ... cheers, :D plastiko :D

WORK

flexlm.config:
flexlm.feature = TogetherControlCenterEval
flexlm.licensePath = eval_license.lic
flexlm.debug=gubed.mlxelf
flexlm.fulldebug=gubedlluf.mlxelf

NOTES:
1) last two lines only enable tracing informations :p and are optional - tracing informations are really useful for hacking :)
2) first line is not evaluated at all
3) second line is the name of the lic-file to use, most important entry

eval_license.lic:
FEATURE TogetherControlCenterEval together 5.5 permanent uncounted \
E6F3D618C7CF HOSTID=ANY

NOTES:
1) optimal values taken from src-code, correctnes of feature important

additional directory
open "together.bat" and choose one of the directories before the misclic.zip file. mkdir "flexlm" and save the attached "license.class" into.

RUNNING
.exe or .bat or anything you want.

TEST
- date set to 2002
- working with a big project
- changes to default and project configuration entries

... works fine!

ps: the values displayed in a previous post are not the content of the vendor-structure; these are the encrypted values of the vendor structure, so not usable with flex-tools

ps: this msg-board rules!
jomamameister
10-08-2001, 08:58 AM
here are some updated links
windows
h**p://a1612.g.akamai.net/f/600/1325/9d/www.togethersoft.com/files/products/together/controlcenter/1534v3/windows/vm/together_1534v3.exe

hpux
h**p://a1612.g.akamai.net/f/600/1325/9d/www.togethersoft.com/files/products/together/controlcenter/1534v3/unix/others/together_1534v3_others.bin

solaris
h**p://a1612.g.akamai.net/f/600/1325/9d/www.togethersoft.com/files/products/together/controlcenter/1534v3/unix/solaris/together_1534v3_solaris.bin

linux
h**p://a1612.g.akamai.net/f/600/1325/9d/www.togethersoft.com/files/products/together/controlcenter/1534v3/unix/linux/together_1534v3_linux.bin

enjoy,
jomamameister
Unregistered
10-09-2001, 11:27 AM
plastiko,
please realize that by disassembling and patching a few java apps you do *not* prove the insecurity of java per se. remember this when you write your diploma thesis :-)

any comments from more experienced authorities on this?

also realize that there is absolutely *no* need to patch anything here. a valid license file can be generated using the information provided by the disassembled file containing the encrypted seeds and by using your eyes and your brain, hehe.
just browse through the file, find some bit operations regarding the encrypted seeds that obviously do some encoding tricks, decode the encrypted values and feed those values into your beloved flextools and make your own license file.
yes, you *can* use the well known flextools :-)

i wonder why nobody has released a ready made solution yet. any comments from more experienced authorities on this?

as plastiko has pointed out, it is very important to keep the flexlm.config and license file concise.

open your eyes and your mind!

good luck,
crkr
plastiko
10-09-2001, 01:44 PM
don't worry about my work, you don't know the content ... ;)

ORIGINAL
int ar = 0x17deeaab;
int as = 0xb4c8d384;
int at = 0xa2a1a978;
int au = 0x1080480;
int av = 0x5d5e5687;
int aw = 0xfc9841d8;
int ax = 0xc07286a2;
int ay = 0xa0424122;

DECRYPTING
av = ~av;
aw++;
ax ^= at;
ay |= au;

TOSTRING
these are the values passed to the public license(vendor, d1, d2, k1, k2, k3, k4) constructor, from left to right:

together
17deeaab
-4b372c7c
-5d5e5688
-367be27
62d32fda
-5eb5ba5e

FINALLY
values printed with an Integer.toString(value, 16) after "decrypting". maybe someone would like to feed some tools and try to find out the seeds ... and finally build the correct and long awaited valid license key. I reached my "goal" after one hour and I stopped, cuz no time to invest in the study of this protection (out of scope). maybe later, if not too late ...

cheers, :Dplastiko:D


Register contents at exe startup......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Register contents at exe startup......
PDA

View Full Version : Register contents at exe startup......

+SplAj
05-08-2001, 08:44 AM
I have a stupid technical question about HOW the registers EAX/EBX/ECX/EDX/ESI/EDI etc are given their values at program startup under Win2K and NT as these O/S are more careful with their memory managment and give 'access violations' or 'exceptions' ;)

This is because I have been analysing some packed/unpacked targets
and notice that especially EDI register changes when loaded by symbol loader or just double-clicked and when the program calls it's first API this EDI value can crash the unpacked program in win2K- Hi Alexey ;)

With unpacked CV2.6 with SI loader EDI == 25h and runs fine. With double-click EDI == 0469DEF8 and causes an exception in 1 of my Win2K PC's. In the other 2 it loads OK either way. I thought this could be a speed issue......as the PC that won't load CV2.6 with Win2K is a PIII 1ghz machine and the other 2 are PII 266 and Cel333.
But I did not check with SI yet as I am at work ;) - erm in the office playing with this problem !

So again my question. Where does the register settings come from at exe launch ?

Is there a MS or other technical guide like for the PE format ?

Hope I explained this problem ok !

SplAj
_m
05-11-2001, 01:51 PM
Check pietrek and the usual places; this gets documented a lot by vir guys. This might help:

http://vx.netlux.org/texts/html/i46t.html

_m
Kayaker
05-12-2001, 08:58 AM
Hi,

Interesting question, I've always kinda wondered about this myself. It looks like you can get most of the info by typing 'proc -x taskname' in SoftIce. If you type 'proc' without the -x option you get the pointer to the Process Database, pProcess. For Win98 anyway this is the address in ESI. ECX and EDX seem to be pointers within this database as well. The extended params listed with the -x option describe some of these entries, including the Environment Database.

EAX is obviously the OEP, and for Win98 EDI is 00000000. EBX is 00000000 if SI loader is used, but 530000 if not (put a CC at program OEP and set BPINT3). The article _m gave a link to mentions this 530000 value as well with Win95, no idea what it's for. Interestingly, the MOD command gives the location of the PE header in memory.

Kayaker
+SplAj
05-13-2001, 03:46 AM
Hi guys. Thanks for the URL. Looks like the virii guys know more about pe than everyone...and they give some good bedtime reading.....as usual ;)

The Q was really about Win2K cos in Win98/ME I tested several exe and got EDI==0 everytime. In Win2K 'normalised' exe gives an EDI reg number in range 1B ~ 2B ? but in that unpacked CV EDI had a BIG number that stuffed up the API return.
So it is the damn problem in Win2K I am still bi-curious about ;)

SplAj


msgboard interruption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > msgboard interruption
PDA

View Full Version : msgboard interruption

tsehp
05-10-2001, 04:15 PM
sorry for this little interrupt.
The isp disabled cgi-bin because of too much cpu time consumed by this script. I'm actually fixing this by changing the database system.

To clean up a little the database, all the unanswered topics from newbie's forum older than 2 weeks will be deleted.

regards,

+Tsehp


16 bit Dongle Program, need advices or help debugging
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > 16 bit Dongle Program, need advices or help debugging
PDA

View Full Version : 16 bit Dongle Program, need advices or help debugging

__DuDu__
05-12-2001, 10:28 AM
Hi !

i got a small dongle program 52,9kb, its 16bit and i dont think that its a known dongle that protectcs it, can anyone give me some help ?

i launch the program and in a dos box i see Checking..then a red screen appears if the dongle isn't connected and a press any key to exit too, i setted a bpio -h 378 r and after breaking i did bc* and press 4xF12, i landed here:

83C404 ADD SP, 04
8006542E10 ADD BYTE PTR [2E54],10
8006552E10 ADD BYTE PTR [2E55],10
8006562E10 ADD BYTE PTR [2E56],10
8006572E10 ADD BYTE PTR [2E57],10
8006582E10 ADD BYTE PTR [2E58],10
8006592E10 ADD BYTE PTR [2E59],10
80065A2E10 ADD BYTE PTR [2E5A],10
80065B2E10 ADD BYTE PTR [2E5B],10
2AC0 SUB AL,AL
A2AE31 MOV [31AE],AL
A25C2E MOV [2E5C],AL

at the line add esp, 04 i did 'd 2e54''and i got this =C=191B4
after passing all ADD's the values above are overwritten with MSMAIARD

tracing more i found some calls, movs, cmps but i can't find anything significant to patch ;/

can someone give me advices or help me debugging it ? *g* im lost ;(

Tnx in Advance
DuDu


Revergin:redirected api's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revergin:redirected api's
PDA

View Full Version : Revergin:redirected api's

stillnewbie
05-12-2001, 11:16 AM
Hi all,
need some help on this

0 0012B814 BFF748B4 01E6 KERNEL32.dll GlobalAlloc
1 0012B818 BFF7FFF0 0319 KERNEL32.dll VirtualAlloc
2 0012B81C BFFA19F5 00D8 KERNEL32.dll DeleteFileA
3 0012B820 BFFA082B 0237 KERNEL32.dll LocalLock
4 0012B824 BFFA0F73 01D9 KERNEL32.dll GetTimeZoneInformation
5 0012B828 BFF8E150 0138 KERNEL32.dll GetACP
6 0012B82C BFFA08BC 0342 KERNEL32.dll WriteProfileStringA
7 0012B830 BFF9E1D3 0304 KERNEL32.dll TlsFree
8 0012B834 BFF84A5F 02C9 KERNEL32.dll SetErrorMode
9 0012B838 BFF7B9B2 0228 KERNEL32.dll LeaveCriticalSection
10 0012B83C BFF90FAF 028E KERNEL32.dll ResumeThread
11 0012B840 BFF8F4FC 02EB KERNEL32.dll SetThreadPriority
12 0012B844 BFF77844 019F KERNEL32.dll GetPrivateProfileStringA
13 0012B848 BFF77284 0353 KERNEL32.dll lstrcmp
14 0012B84C BFFA18B8 01CE KERNEL32.dll GetTempPathA
15 0012B850 BFFB3FF7 01C1 KERNEL32.dll GetSystemDefaultLangID
16 0012B854 BFFA0A62 0320 KERNEL32.dll VirtualQuery
17 0012B858 0081C468 0000 ?????? to_Resolve

17 0012B858 0081C468 0000 ?????? to_Resolve
I can't find the the real api for this.
I disassenbed this address but it only
points to push ebp ???

Could you guys kindly help me?
btw the prog is Advanced Disk Catalog
TIA
regards
stillnewbie
rot8
05-12-2001, 12:05 PM
Look at the next instructions after push ebp.
It must be ret somewhere there ;)
Look at the arguments, that are pushing in the stack and moving into regs before ret .....
stillnewbie
05-12-2001, 10:43 PM
rot8 (05-12-2001 02:05):
Look at the next instructions after push ebp.
It must be ret somewhere there ;)
Look at the arguments, that are pushing in the stack and moving into regs before ret .....

Hi Rot8,
Thanks for the input but some of the unresolved address points to mov eax,[eax]
it leads you to nowwhere :'(
Hope someone take a look at this :-P
regards
stillnewbie
emulder
05-21-2001, 09:09 AM
stillnewbie (05-12-2001 20:43):
Thanks for the input but some of the unresolved address points to mov eax,[eax]
it leads you to nowwhere :'(

Hi there :-) ,
Did you trace the unresolved imports in the orignial executable?
Maybe they aren't used at all, or just try to replace those entries
with the GetVersion address ....
maybe this helps
regards
e.
tsehp
05-21-2001, 12:17 PM
while waiting for a new version that will solve this :
1-try the mangled scheme option, it will make an attempt to tell if those entries are used
2-bpmb them before loading and make the prog run for a while, you'll also see if they are used
3-try an ida session

alexey usually does this with entries unused or very small api's. when you trace it, just put the module + name or put the address before resolving again.

when the global tracer will be finished (pretty soon) , I'll automatize all this.

regards,

+Tsehp
stillnewbie
05-22-2001, 09:32 AM
Heya Guys,
Thanks for the input,
Advance Disk catalog is the worst I have seen lately :P.It redirects the api and its
encrypted :/. +Tsehp thats great news and thanks for your harddwork and looking into it :)

Best regards
stillnewbie
madmax
05-22-2001, 05:38 PM
I have looked at targets from this same author (www.elcomsoft.com) and the wrapper is quite interesting...The PDF decryption program had api redirection with this behavior mentioned above:
mov eax,[eax] blah blah

its actually replaced simple apis (getprocessid,etc) by retrieving the values ahead of time and thus not even using api after OEP...thus, it would be very hard for revirgin/imprec to detect this...what i did was bpm the suspicious [eax] area, and you will find out what the value is and then figure out the API to correct manually...there were 3-4 of these if i recall in PDF program...if your lucky, you will find the routine during unpacking where it executes all the apis, all in a row! then its easy to fix...

btw, there was also a redirection for resource APIS (lock/loadresource) along with one in USER32.DLL for DialogBox.... It was interesting to see, but unpacking this is not easy for newbies =(

good luck,
madmax
madmax
05-22-2001, 06:00 PM
just read the thread on 'AFR + aspack...',
they explain what i was talking about, its the sixth or seventh reply, check it out for good reading...btw, its asprotect =)

madmax
Rainor_
05-22-2001, 07:51 PM
yeah, i know that is ASPR just a typo when i write the title


Any kind of help on HardLock dongle reversing can help me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Any kind of help on HardLock dongle reversing can help me
PDA

View Full Version : Any kind of help on HardLock dongle reversing can help me

moZfet
05-12-2001, 01:50 PM
thanks a lot

reversing, not emulation thanks a lot!

moZfet
TNT
CrackZ
05-12-2001, 03:11 PM
Hiya.

Start out by decrypting hardlock.vxd, use the testapi.exe program included in the SDK. Examine the 5 * 8 bytes returned from the dongle. Examine the 2 functions (11 K-EYE & E), one is a FEAL cipher, the other a block cipher.

Good luck ;-).

Regards

CrackZ.


'bout napster 2.0.10
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > 'bout napster 2.0.10
PDA

View Full Version : 'bout napster 2.0.10

0x400
05-13-2001, 05:49 AM
hi ppl,

i was just wondering - has anyone looked how are those new file flow tracking mechanisms working (and ways how to disable/fool them). this seems to be quite interesting.

have a nice reversing :)


Sentinel SuperPro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel SuperPro
PDA

View Full Version : Sentinel SuperPro

Aldavan Diablo
05-13-2001, 04:38 PM
Hey people, I realize I should be posting in the newbie area, but I would actually like someone with a clue to read this...

I'm hoping you can help me... I've read goatass' tutorial on cracking Sx32w.dll for Flexi-Sign Pro. I am a registered user of the software, I have a hardware key and the latest version of the app (I used DumpSentinel v0.2 to dump the contents of my flexisign key, if anybody has doubts). The hardware key (sentinel superpro) however, is a constant pain in my ass... the program crashes every time there is a lot of data traveling through the key, or if there is another key attached to it (ie: Graphix Advantage (superpro) or Microsource POS (scribe), both of which I use frequently and legitimately own). At any rate, I thought I would try to use the tutorial to crack the app... I have since discovered that I lack the appropriate grey cells. I am hoping you can direct me to someone who can give me a hand, or supply me with a "fixed" version of Sx32w.dll. I would appreciate any help you could give me.

Thank you,
Aldavan Diablo


Microsoft Activation Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Microsoft Activation Protection
PDA

View Full Version : Microsoft Activation Protection

DaWsOn
05-14-2001, 02:35 AM
As you know or not M$ uses a new piracy-protection system..called Activation protection OS uses some information about your current hardware and produce a uniques key (like a serial) and u had to put that key to activate the Windows..Anyone working on to crack this?

p.s:Until windows xp build 2469 all protection cracked..But 2469 is still uncracked...
nchanta
05-14-2001, 05:32 AM
this seems akin to the Microsoft Reader protection.

http://www.microsoft.com/reader/download.asp

i think it ask's you to active it, which then enables M$ to let/not-let you download and run copyrighted/protected eBooks, which are sold over the net.

interesting...
Solomon
05-14-2001, 11:07 PM
2469 is cracked. I saw a patch for 2469 and someone claimed that it worked coz he had tried it.
Solomon
05-14-2001, 11:14 PM
The crack is "2469_solarixpatch.exe"
daWsON (restored)
05-20-2001, 10:10 AM
Solarix made 2 cracks for 2469 and none of them work...
Solomon (restored)
05-20-2001, 10:15 AM
I installed 2469 moment ago and applied his crack.
It extends the expiration date to 11/11/2001 , when a new beta will be released
daWsON3k (restored)
05-20-2001, 10:15 AM
--------------------------------------------------------------------------------
Solomon (05-14-2001 18:0:
I installed 2469 moment ago and applied his crack.
It extends the expiration date to 11/11/2001 , when a new beta will be released
--------------------------------------------------------------------------------

set date 14 days aheasd and reboot...see a fucked OS
decx
06-03-2001, 03:14 PM
From what i know about the new activation protection is from reversing Microsoft Outlook 2002 installer. It uses RipeMD it seems, but it might be modified a bit, but its most likely is RipeMD cuz of the initialization constants used in the code matchs the RipeMD values, these are:

067452301h
0EFCDAB89h
098BADCFEh
010325476h

from:
sub_35F355B3 proc near
arg_0 = dword ptr 000000004h

mov eax, [esp+arg_0]
xor ecx, ecx
mov [eax+2Ch], ecx
mov [eax+30h], ecx
mov dword ptr [eax+18h], 67452301h
mov dword ptr [eax+1Ch], 0EFCDAB89h
mov dword ptr [eax+20h], 98BADCFEh
mov dword ptr [eax+24h], 10325476h
mov dword ptr [eax+28h], 0C3D2E1F0h ; modified?
retn 4

sub_35F355B3 endp

The RipeMD-call itself is very long, so i wont bother pasteing it here, but the code will hash and fixup the serial in different valid formats being normal keys or OEM keys.

you can get our partially finished sourcecode from:
http://www.sltgods.com/decx/mskg.asm
Warning: Its 164KB - Alot of lines to figure out :)

- Decx
kill3xx
06-04-2001, 04:49 PM
decx (06-03-2001 13:14):
modified a bit, but its most likely is RipeMD cuz of the initialization constants used in the code matchs the RipeMD values, these are:

067452301h
0EFCDAB89h
098BADCFEh
010325476h

from:
sub_35F355B3 proc near
arg_0 = dword ptr 000000004h

mov eax, [esp+arg_0]
xor ecx, ecx
mov [eax+2Ch], ecx
mov [eax+30h], ecx
mov dword ptr [eax+18h], 67452301h
mov dword ptr [eax+1Ch], 0EFCDAB89h
mov dword ptr [eax+20h], 98BADCFEh
mov dword ptr [eax+24h], 10325476h
mov dword ptr [eax+28h], 0C3D2E1F0h ; modified?
retn 4

sub_35F355B3 endp

The RipeMD-call itself is very long, so i wont bother pasteing it here, but the code will hash and fixup the serial in different valid formats being normal keys or OEM keys.

you can get our partially finished sourcecode from:
http://www.sltgods.com/decx/mskg.asm
Warning: Its 164KB - Alot of lines to figure out :)

- Decx

Interesting.. atm i'm very busy and not have time to dig into ur sources or WPA itself.. but u'r right is not RIPEMD but the more strengthened version RIPEMD-160 (or maybe a RIPEMD160-MAC)... anyway u've done a good work poking (m$ jargon ;) with their new toy and i'm pretty sure that u've made happy some people at M$ >)

Best regards,

Kill3xx


HCUnix strainer (repost)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HCUnix strainer (repost)
PDA

View Full Version : HCUnix strainer (repost)

grugq
05-20-2001, 09:18 AM
[This is a repost of the strainer text itself. Thanks to Carpathia for salvaging it from his cache. The deadline for the strainer is july 31st. All submissions of completed assignments should be sent to hcunix_at_lokmail_dot_net, you will not get a reply unless you receive credit. No querys will be answered, but amusing questions might get posted and ridiculed :-) ]

A strainer is supposed to winnow the wheat from the chaff, it should
enable those with prospects to advance while keeping the riff-raff
out. This strainer is no different in that respect but the similarities
to previous strainers end there. The typical +HCU strainer has been
to crack (not reverse, no one ever turned in src code to replicate the
fucntionality of the target) a win32 application. This is a reverse
engineer's strainer, if you fancy yourself a reverse engineer then you
will enjoy, and be challenged by, this strainer.

After talking this over with Mammon_, we feel that it is important to
present a variety of challenges to allow each entrant the oppurtunity
to excell in one arena. That said, a certain amount of knowledge
about everything is required to be a successful Reverse Engineer, and
this strainer will demand proficiency in a variety of areas.

The Strainer:

Aquire 3 credits via any of the following:

1. Write an ELF binary encrypter. (1c - 2c)
* This program should be run over a binary and produce an
encrypted binary. When run this encrypted binary will
perform identically to the original binary, save for the
need to supply a password.
* This is for the Linux 2.2.x x86 platform only.
* If you can create a program which does not require Linux,
does not use assembly language and does not require an
external program to run, then this counts as two (2) credits.

2. Reverse Engineer this program. (1c)
* Supply src code which, when compiled, replicates the function-
ality of the target and when disassembled produces output
identical to that of the target. In short, reproduce the src
from the binary.
* Write a paper on how you reverse engineered the target.
Include any tools that you wrote (src form).
* URL: http://grugq.hcunix.org/kgm

3. Write a replacement for ptrace(2). (1c - 2c)
* This must be implemented as a LKM. It should have a man page
describing its use and a sample application which makes use
of your implementation.
* If this is superior to the standard ptrace(2) implementation,
i.e. provides better functionality, the this counts as two (2)
credits.

4. There is no number 4.

5. Write a CPU module for the bastard. (2c)
* This CPU module can be for any CPU that is not x86. This
means you can write for SPARC, StrongARM, Motorola, etc. etc.
* If this assignment is completed and fully functional, it
counts as two (2) credits.

6. Write a process dumper. (1c)
* This should either attach to a given PID and dump the process
into a valid ELF format, or execute the target program and
then dump it into a valid ELF format.

7. Write an object code re-linker. (1c)
* This should be able to import additional objcode into a given
binary. This should be portable (i.e. non-x86 specific) and
can use the libbfd library.

All assignments must be turned in with a paper describing the work as
well as src code to any and all tools which you wrote to complete the
work. All src code remains copyright the author, but must be released
open source (i.e. pick a license which allows others to use and adapt
your code and release under that. GPL, Perl Artistic, BSD, etc. etc.).
In addition to the src code you must write a man page for the tool,
this is not needed for quick hacks you wrote while working on something.
The complete passing assignments will be posted on the internet following
the end of the strainer.

Any information you need to complete these assignments can be found
on the internet. If you are having problems with something you have
two choices, find a solution or give up.


msgboard problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > msgboard problem
PDA

View Full Version : msgboard problem

tsehp
05-20-2001, 09:19 AM
hi,
this 24 hour interruption was due to our isp that uninstalled a critical
perl module necessary to make this msgboard work.
I couldn't restore the msgboard while it was broken, because with the new database system (mysql) all the files wasn't accesssible by my ftp account. So we had to wait that the isp reinstall everything, and I was forced to start again from my last backup. The isp wasn't able also to restore those files from its backup.
This means that all the messages since the 15/5/2001 are lost forever
I'm really sorry for this, woodmann and me are making radical moves for this not to happen anymore.
Best regards,

+Tsehp
tsehp
05-20-2001, 10:59 AM
Tsehp
I sent you my archive from woodman 16/17the May via e-mail just now
I don't know when the MB went down (18th ?) but I am sure we can reconstruct the last days from others archive... Everybody look in your cache and copy the html (like 2836-1.topic.htm) to a new folder and compare them with mine. If there is more info then post them here.

SplAj

Tsehp's note :

I actually rebuilt everything up to 17/5/2001 with splaj's cache.

If someone did visit the forums after this date up to 18/5 and find some messages that doesn't appear here, report me fast please.
tia


license.dat about Sun Workshop 5.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > license.dat about Sun Workshop 5.0
PDA

View Full Version : license.dat about Sun Workshop 5.0

happyWolf (restored)
05-20-2001, 10:17 AM
I tried to crack sunwlicd on Solaris using SDK v6.1 and adb.
sunwlicd implemented user crypt filter, so Nolan Blender's
latest essay is a big help in this. I found the two seeds,
the five keys, xor values and permutation table:
The 1th seed: 1b55a399
The 2th seed: a91834d8

The 1th key: 74d8dbd7
The 2th key: e3ee474
The 3th key: 30776cf
The 4th key: de024b81
The 5th key: b7ef0e08

xor values:
int xorvals[]=
{
0x1e, 0x16, 0x3e, 0x24,
0x04, 0x1e, 0x1e, 0x13,
0x15, 0x0c, 0x2d, 0x33,
0x3d, 0x21, 0x26, 0x2e,
0x12, 0x34, 0x01, 0x2b
};

permutation table:
permute_t tab1[] = {
{0,4,5,3,1,2,6,7}, /* idx 00 */
{4,0,5,2,1,3,6,7}, /* idx 01 */
{7,1,3,4,0,5,2,6}, /* idx 02 */
{4,7,3,6,1,5,2,0}, /* idx 03 */
{0,3,7,4,2,5,6,1}, /* idx 04 */
{4,3,5,6,7,0,1,2}, /* idx 05 */
{2,7,4,0,6,5,3,1}, /* idx 06 */
{4,5,1,7,0,3,6,2}, /* idx 07 */
{1,0,5,4,3,6,7,2}, /* idx 08 */
{2,7,5,3,0,6,1,4}, /* idx 09 */
{3,5,7,0,6,4,2,1}, /* idx 10 */
{7,6,5,0,4,3,2,1}, /* idx 11 */
{3,4,5,6,0,2,1,7}, /* idx 12 */
{0,4,6,3,5,2,1,7}, /* idx 13 */
{1,5,0,2,6,3,4,7}, /* idx 14 */
{2,6,5,7,4,3,1,0}, /* idx 15 */
{2,3,0,5,1,7,6,4}, /* idx 16 */
{1,7,4,2,3,0,6,5}, /* idx 17 */
{1,5,2,3,4,7,6,0}, /* idx 18 */
{3,0,6,7,4,5,2,1} /* idx 19 */
};

But I can't get the right license. Could you, especially nblender, help
me? Thanks in advance.
nblender (restored)
05-20-2001, 10:17 AM
Hmm - check your XOR table.
int xorvals[]=
{
0x1e,0x16,0x3e,0x24,
0x04,0x1e,0x1e,0x13,
0x15,0xc9,0x2d,0x33,
0x3d,0x21,0x26,0x2e,
0x12,0x34,0x01,0x2b
};
is what I have.
happyWolf (restored)
05-20-2001, 10:18 AM
[quote]nblender (05-14-2001 23:23):

Thanks a lot


A strange thing about Flexlm 6.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A strange thing about Flexlm 6.1
PDA

View Full Version : A strange thing about Flexlm 6.1

sadWolf (restored)
05-20-2001, 10:20 AM
When cracking the matlab 6.0 licensed by Flexlm 6.1,
I met a strange thing. I found that lc_set_attr was
called with the parameter: 41,35,44,b,f,4. So I think
none of user encrytion algrithm and user crypt filter
is used. After I got the seeds and keys, I generated
the license.dat. But the key of some feature is right,
the other is wrong. Could you give me some hints?
xyzeng (restored)
05-20-2001, 10:20 AM
Look article <<flexlm v6.1 lc_new_job()>> by Dan.
Any question?Email me.
xyzeng (restored)
05-20-2001, 10:21 AM
xyzeng@263.net (added by admin)


Her's my strainer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Her's my strainer
PDA

View Full Version : Her's my strainer

Arthaxerxes (restored)
05-20-2001, 10:22 AM
Write an obfuscationner that Imhotep cannot defeat.
I mean a program that generates obfuscation, not manually added obfuscation.
Arthaxerxes (restored)
05-20-2001, 10:23 AM
btw I do not mean that Imhotep is the absolute desobfuscationner, but for the moment I have not found obfuscation that really confuses 1.8.
Plus this would help me to greatly enhance the tool, which would in the end benefit to everybody.
risc (restored)
05-20-2001, 10:23 AM
hey arthrexes
wondered if u tried it on VOB & COPYLOK ? (lock?)

they use nicer obfuscation than safedisc

opcodes jumping into opcodes to actually do stuff required(copylok), and huge dodgy lumps of obfuscation with one or two real opcodes mixed in (vob)

just wondered
Arthaxerxes (restored)
05-20-2001, 10:24 AM
thanks for the tip, I have to check that out...
Do you have any sample to spare ?
IcyDee
05-20-2001, 02:48 PM
The basic principle here is that a program that is generated from C or C++ can have obfuscation added 'between the source code lines' which confuses disassemblers and SoftIce disassembly.

The only reason that you succeed with SafeDisc is because they have compiled their code in 'release' mode. This means that their obfuscation cannot change registers and so they are limited in what they do. (Jumps, mainly). You can therefore look for the signatures of these limited sequences of code and remove them.

If however the code is compiled in 'debug' mode (i.e. is not optimised) then it is possible to use most of the registers. The reason is that each line of source code generates machine code which is 'self-contained'. i.e. most register values are not remembered from one C source code line to the next but are always re-loaded. So, in this mode it is possible to make obfuscation code which cannot be distinguished from real code (e.g loading registers, moving from data segment to a register etc.). You would not be able to remove this code automatically since the code uses the same instructions as the 'real' code.

If you wish I can send you a sample of code generated in this way.
IcyDee
05-20-2001, 02:49 PM
Oh, bye the way, what happened to your message-board?
evil-risc
05-20-2001, 03:43 PM
copylok doesnt jump into opcodes that do stuff required, i made a mistake .. just has 10, 20, 30, 40 byte chunks of junk code that sometimes looks like real code, and alters registers, but basically does nothing .. just like icydee said :-)

looks a lot trickier to remove than the safedisc junk code (which imhotep really makes a fuckin mess of (misses 50% of junk, removes 10% of good code & an internal exception if i select 3 sections to imhoptamize at the same time from a fully decrypted dll))

; copylok junk code unjunked by hand
00618261 cmp dword ptr [ebp-4BCh], 0
00618268 jnz near ptr byte_6182F1
0061826E mov edx, dword ptr ds:unk_6597D5 ; junk
00618274 jnz short loc_618277 ; junk
00618276 db 0B9h ; ¦ ; mov ecx, aaaabbbb
00618277 loc_618277: ; CODE XREF: icd1:00618274j
00618277 xor eax, eax ; aaaa
00618279 xor ecx, ecx ; bbbb
0061827B jz short loc_61827E ; junk
0061827D cdq ; junkie
0061827E loc_61827E: ; CODE XREF: icd1:0061827Bj
0061827E mov ebx, 425D0C23h ; junk ;)
00618283 mov edx, ds:dword_65BB84 ; junk
00618289 clc ; etc.
0061828A dec ecx ; etc.
0061828B clc ; etc..
0061828C mov ecx, [ebp-114h]
00618292 mov edx, [ecx+0Ch]
00618295 add edx, [ebp-2E0h]
0061829B push edx
0061829C call sub_60B97A

same code 'deobfuscated' by hand :p

00618261 cmp dword ptr [ebp-4BCh], 0
00618268 jnz near ptr byte_6182F1
0061826E db 8Bh, 15h, 0D5h, 97h, 65h, 0, 75h, 1, 0B9h, 33h, 0C0h
0061826E db 33h, 0C9h, 74h, 1, 99h, 0BBh, 23h, 0Ch, 5Dh, 42h, 8Bh
0061826E db 15h, 84h, 0BBh, 65h, 0, 0F8h, 49h, 0F8h
0061828C mov ecx, [ebp-114h]
00618292 mov edx, [ecx+0Ch]
00618295 add edx, [ebp-2E0h]
0061829B push edx
0061829C call sub_60B97A

looks fuckin awful :-)

you can get an example copylok file from http://ftp.gamesweb.com/pub/patches/cossacks_dvdpatch.exe

you need to 'crack' the installer to get dmcr.exe out of it though (2 minutes job reversing jumps)

dunno about any vob exe's floating around the web, try buying a game
risc
05-21-2001, 06:52 AM
i used imhotep from protools, 1.6

level 1, 2, 3 just make the code messier

level 4 seems alright, except misses a lot of junk code, and also deletes a lot of good code that looks like junk

i.e.

jmp $+2
mov eax, 85480a26h
xchg ecx, eax
nop
nop
mov eax, 85480226
xchg ecx, ecx
sub ecx, eax
jmp loc_1
db 89h
loc_0:
xchg ecx, eax
jmp loc_2
loc_1:
jmp loc_0
loc_2:
push sth
push sthelse
push eax
call blah

he has a few 'polymorph' techniques to move values into registers, which imh1.6 removes


What is ZoneAlarm doing?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What is ZoneAlarm doing?
PDA

View Full Version : What is ZoneAlarm doing?

zz (restored)
05-20-2001, 10:30 AM
I've been a loyal ZoneAlarm user for quite a long time. Today, however, I came across another great firewall, the Tiny Personal Firewall (www.tinysoftware.com).
I downloaded the application, installed it and rebooted. When my computer was back up again, I started browsing the web and doing other stuff as usual. I had ZoneAlarm also running in the background. After a while, a dialog from the Tiny firewall popped up, asking me if I wanted to give ZoneAlarm permission to connect to the internet. The address was 222.zonelabs.com, port 80.

I'm sure that I had disabled the Check for updates option in ZoneAlarm, so why the hell is it trying to connect to the ZoneLabs server? I just can't think of a good reason.

Any ideas why ZoneAlarm is acting like that?
Could it be spyware?

I'm a bit paranoid about stuff like this, so I uninstalled ZoneAlarm immediately, and I won't be reinstalling it any time soon.
goatass (restored)
05-20-2001, 10:31 AM
run a packet sniffer while zonealarm is running to see what is it that it's sending to that server which seems to be a web server since it's using port 80. It could be logging something, check it out.
goatass
NotMe (restored)
05-20-2001, 10:31 AM
zz,
What u mean is ZoneAlarm or ZoneAlarm Pro ?? or both??
zz (restored)
05-20-2001, 10:32 AM
--------------------------------------------------------------------------------
NotMe (05-16-2001 08:40):
zz,
What u mean is ZoneAlarm or ZoneAlarm Pro ?? or both??
--------------------------------------------------------------------------------

I was using the free version of ZoneAlarm.
vgb (restored)
05-21-2001, 02:19 PM
After reading your message, I emailed ZoneAlarm. With their permission what follows is their response.
vgb

=================
Thank you for taking the time to write us about these rumors. ZoneAlarm and
ZoneAlarm Pro absolutely do not collect any surfing data about users'
behavior. The only information Zone Labs ever sees from an end-user is: (1)
your registration data (if you chose to supply it), (2) your version and
registration numbers (if you have one) every time you "check for updates"
(if you have that option marked in the configure panel), and (3) Alert data,
when you click the More Info button on an Alert. This information does not
get shared with anyone else, as we guarantee in our privacy statement on our
Web site.

Zone Labs never receives any other information from ZoneAlarm or ZoneAlarm
Pro clients and cannot retrieve any other info from your machine. Since our
products do not log users' surfing behavior, there is no way for this
information to be retrieved.

ZoneAlarm does leave elements in the registry after an uninstall, but our
FAQ details how to remove them in the event of a problem. That information
is found at http://www.zonelabs.com/support.htm

You specifically mentioned 222.zonelabs.com and Port 80. 222.zonelabs.com
handles registration info, alert analyzer, and version updates. Port 80 is
specified because the information going to 222.zonelabs.com is HTTP traffic,
which is transmitted through Port 80.

Zone Labs is a company formed by software engineers, exclusively for the
purpose of creating great software. Please let me know if you have any
additional questions.

Best regards,
Mischa

-----------------------
Mischa Garner
Zone Labs, Inc.
Direct: 415-341-8225
Fax: 415-341-8299
mgarner@zonelabs.com
=================================
loc (restored)
05-21-2001, 02:19 PM
yes, its spyware.. ZoneAlarm is crap
vgb (restored)
05-21-2001, 02:20 PM
--------------------------------------------------------------------------------
loc (05-17-2001 20:13):
yes, its spyware.. ZoneAlarm is crap.
--------------------------------------------------------------------------------

Is this your gut feel, your opinion or do you have real facts that this is the case?
+SplAj
05-22-2001, 04:39 AM
Hi

Using ZA own features,
did you try and block this access in the 'restricted zones' options
like 222.zonelabs.com resolves to 215.15.66.222

Does it still try and connect after this blocking ? If so then it would be spyware !

SplAj


microsoft's registration scheme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > microsoft's registration scheme
PDA

View Full Version : microsoft's registration scheme

disavowed (restored)
05-20-2001, 10:33 AM
anyone have any experience with microsoft's you-must-register system, like the one used in office2000? looks like some stuff is going on in lvreg.dll, but i don't feel like tracing it, especially if it's already been done
AdamA (restored)
05-20-2001, 10:33 AM
Hi,
the main code for product registration is in osa.exe and mso.dll,
just look for RegWiz* strings in mso.dll.
happy reversing,
AdamA
disavowed (restored)
05-20-2001, 10:34 AM
hmm.. no "regwiz" strings in mso9.dll or osa9.dll...
AdamA (restored)
05-20-2001, 10:51 AM
There must be a mso.dll in your microsoft shared folder.
Its a ~9Mb DLL, so disassembling lasts a while;-)
I have the german version of OfficeXP, maybe there are some differences.
It seems that the main code is in this file.
happy reversing,
AdamA


Info about Softice urgently needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Info about Softice urgently needed
PDA

View Full Version : Info about Softice urgently needed

roocoon (restored)
05-20-2001, 10:53 AM
Hi.
Maybe somebody has the solution to the following problem or can supply some Softice info.
Running Win2K Pro Workstation, updated with SP1 and later updated with SP2 (a version just before the final SP2). Softice is set up to run in Manual mode.
All was well until I got the final SP2 and decided to install it.
I started by uninstalling the older SP2.
Major mistake!!! Don't do it.
It uninstalled, Win2K rebooted and got stuck on the logon popup.
"The system cannot log you on because the Domain PIII-600 is not available" (PIII-600 is my computer's name. It's set up in a Workgroup and not a Domain).
No way to get around it. Safe mode, DOS mode or whatever.
A search for solutions, took me to MS's Knowledge Base.
According to them, the problem has to do with mixed Security modules (rsaenh.dll) (and schannel.dll according to some other link). (It looks more like the system changed from Workstation to Server somehow).
You're supposed to run the Maintenance console (that's the name?) and replace these files.
In my system it doesn't run. It complains that txtsetup.sif is corrupt or missing.
It's not. It's the one from SP1.
So now what? The system identifies itself as Win2K with SP2Free and most of the files are from SP1 or original.
Replacing these 2 files manually (booting with Win9 didn't help. I still have some other files from SP2 that might conflict. And the Registry still has SP2 stuff in it.
1) Any way to get around the logon screen?
2) Any way to reinstall SP2 pre-final again? (that should match things up).
3) Does somebody know or can compare the registry to see what's the difference between Softice running in Manual mode versus in Boot-up mode. Maybe I can hex edit the change and bring Softice up during logon, bypass it and see what happens.
Thanks in advance for any ideas.


AFR + aspack + revirging
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > AFR + aspack + revirging
PDA

View Full Version : AFR + aspack + revirging

Rainor
05-20-2001, 08:36 PM
Anyone look Advanced Find & Replace 1.4.0 at http://www.vknoware.com/
look like a new version of asprotect (at least an unknow version to ASPR)
So i use revirgin and got some interesting result, some funtion like GetVersion, GetCurrentThreadID are completely emulate by ASPR so there in no way to trace back (only SEN) other funtions like GetModuleHandleA (RVA 98330) use some type of brach so if you trace it with eax=0 you never found the correct api entry. Finally after all import table rebuild i found that some procedure are redirect (static procedures inside .exe not imported APIs) and some string point to ASPR code, so if you remove ASPR you got tons of crash.
I finally manage to crack it , usign some loader coz i cant remove the damm ASPR.
BTW if a delphi proggy.
Any idea ???

R
tsehp
05-21-2001, 01:49 AM
Don't worry I'll soon take care of this, I'm still on the revirgin's tracer development but this new version of asprotect is planified.
while I finish this, maybe +splaj will find a temp solution, we'll see.
If you really can't remove asprotect, you can also make temp solution and use r!sc's process patcher, this method is fast and impossible
for the protector to block, but you don't have the revirginized program.

later,

+Tsehp
Kilby
05-21-2001, 03:57 AM
Having spent a lot of time on asprotect, recently you appear to be most of the way through the process.

Asprotect changes quite a bit every few weeks,.

The GetVersion and friends are fun tp play with, it's just enough to irritate you if you forget to not the values down the 1st time you run it.

I was annoyed to discover the redirected calls, initially, but they can be coped with, they as not as nasty as they first appear.

It sounds like you where almost there, have another try, then look at the newst elcomsoft product, if you really want to see asprotect in it's full glory :)

Regards,
Kilby...
Rainor_
05-21-2001, 08:59 AM
i was able of revirgin the proggy and found GetVersion & co APIs, the problem was with the delphi code, some code are called using redirections, buts the pointer to this redirections are store in the static data declaration , not in the import part.

R
Rainor_
05-21-2001, 09:00 AM
i was able of revirgin the proggy and found GetVersion & co APIs, the problem was with the delphi code, some code are called using redirections, buts the pointer to this redirections are store in the static data declaration , not in the import part.

R
+SplAj
05-21-2001, 09:30 AM
psst Rainor_ 3 things :-

wot did you do with the call at 0x4942AC that puts 58C81501 in location 0x495F8C ? (was 94424900)
before going to the OEiP at 494564 ? , also the RET at 401014 - pfff Alexey come on :(

Did you re-locate/emulate those 2 calls at 115C904 & 115C90C :-

Push EBP
MOV EBP,ESP
Pop EBP ......

Did you emulate the mov eax, 816CC38C & C0005A04 & FFF40AA5 in the last 3 calls 115C8FC, 115C8C4 and 115C8F4 repectively somewhere else ?

game on }>

SplAj
Rainor_
05-21-2001, 01:00 PM
hmm i miss something, here is what i do
i found OEP using DEDE, icedump to break in the original OEP usign /tracex OEP after that, dump the target realign all sections, use revirgin to get correct import & paste it in a new section, of course i update all PE header info (OEP & import table) after all the proggy crash so i found in no time the
call [0x495F8C] , fire Softice trace this call.
The question, there is some info/essay about how emulate ASPR APIs call, or how avoid
or get the static modify data???? do i had to trace all ASPR stuf???????

R
+SplAj
05-22-2001, 06:07 AM
Hi again

mmmm I've been thinking, maybe we need a quick 'dll' builder module in RV that would take the place of these 'redirected->code' in the API jmp table now. RV struggles to create a 'valid' IT from missing info and the alternative of putting in dummy API then changing the code of these dummy API calls in the JMP table to JMP to your new poking routine .......is a big PITA.

Better to have a dll that you can make RV link to and make these stupid code emulation in your customised dll.

Just a thought. I've only had one cuppa coffee so far.......
+SplAj
05-22-2001, 07:05 AM
ahh thats better, 2 more coffees while debugging and MUCH better brain power now ;)

Look at this stupid code I found to get the missing API's :-

0187:0115C868 6A00 PUSH 00
0187:0115C86A E8DD7BFFFF CALL KERNEL32!GetModuleHandleA
0187:0115C86F A3D4351601 MOV[011635D4],EAX
0187:0115C874 E8EB7BFFFF CALL KERNEL32!GetVersion
0187:0115C879 A3D8351601 MOV 011635D8],EAX
0187:0115C87E 68E4351601 PUSH 011635E4
0187:0115C883 E8E47BFFFF CALL KERNEL32!GetVersionExA
0187:0115C888 E88F7BFFFF CALL KERNEL32!GetCurrentProcess
0187:0115C88D A3DC351601 MOV [011635DC],EAX
0187:0115C892 E88D7BFFFF CALL KERNEL32!GetCurrentProcessId
0187:0115C897 A3E0351601 MOV [011635E0],EAX
0187:0115C89C E8737BFFFF CALL KERNEL32!GetCommandLineA
0187:0115C8A1 A378361601 MOV [01163678],EAX
0187:0115C8A6 C3 RET
0187:0115C8A7 90 NOP

Thats a BIG clue from Alexey, thanks mate ;)

Now you can fill in 3 more of the 7 missing API's directly with Revirgin at RVA :-

GetCurrentProcessA
GetCurrentProcessId
GetCommandLineA

mixed for your pleasure ;)

25 000981E0 0115C8FC 0000
97 00098318 0115C8C4 0000
111 00098350 0115C8F4 0000

...and the duplicate calls of the above. Getting closer ?
+SplAj
05-23-2001, 03:21 AM
Ok, I'm feeling dejected nobody else is playing the 'game'......... where
are you guys ?

I will not post more ramblings here but the full monty is attached for your pleasure :-

ASdisprotect v. SplAj

Game Over Alexey .....}>
'patch+play'
+SplAj
madmax
05-23-2001, 03:49 AM
I looked at this target, and it was "easy" after working on PDF program from elmcosoft.com...I noticed you seemed to do a little work with the RET 0004 trick...This bugger had me crashing for a while too, till i finally found it =) I just placed a RET 0004 where JMP [PTR HERE] was, both instances and had no probs...If i recall, one of them was at 406DD4. The himem relocation trick kinda gives itself away since aspr jumps back to the programs mem (400000==>4D0000) to make the alteration...I found it by enabling /tracex min. to max., and will do so in future...It could be trickier if he found another way (not using writeprocmem of course) to alter stuff...

madmax!
Kilby
05-23-2001, 04:17 AM
Splaj, I'm willing to play the game :)

Advanced PDF wasn't too bad, though the user32 one caught me out for a while, it was so simple to fix I needed help (thanks SV).

Though it was interesting to note that the registration window was the only part of th app to use that call, so I wonder if asprotect took particular care of it ?

I have noticed in one newer app that there is a redirected internal call in the form of
call [xxxxxxxx]

The call is internal to the app.

I needed more coffee to figure out what I wanted to do about it.

The IT mangling also appears to have changed in this app, no longer the stretches of zero bytes, I have seen in other asprotected apps.

Note: I recoment Percol Rocket Fuel as the coffee for aspr work.

Kilby...
+SplAj
05-23-2001, 04:55 AM
madmax
_____________________________________________
I just placed a RET 0004 where JMP [PTR HERE]
_____________________________________________

Yes, you are completely right. In the cold lite of day and after sending my findings to Tsehp for RV development and having thought it out now I realise it is a simple RET 004 that will suffice in offsets 406CE4 and 406DD4 :-) BUT late last night after a few hours in the codewoods with several whiskeys+ice (or was it several hours in the codewoods and a few whiskeys+ice ?) I thought my first solution was the dogs bollocks....but it did not impress the wife, she went to bed without me :-(

hehehe
madmax
05-23-2001, 05:09 PM
Kilby, I also found it strange how it disregards all calls to load/lockresource except for the reg box in PDF program...Must be unimportant APIs, but thats an assumption by alexey i guess...
I just finished yet another of the products from elcomsoft.com, the Advanced office 2000 pro...It
was an easy rebuild for the IAT with imprec...But fixing those redirected calls was not as easy as in AFR, which had only 2....It involved manually inserting the "virgin" section into the dump...Then, as a last bonus there is a little "check" from the author, PUSH FF / PUSH 04 / CALL GetProcAddress...This will obviously return 0 unless API is hooked...This could be cracked by rerouting API like splaj mentioned, but the return value from ASPR hooked API is never used! so easy crack =) take a look!

madmax


Serious Sam - new safedisc ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Serious Sam - new safedisc ???
PDA

View Full Version : Serious Sam - new safedisc ???

DakienDX
05-21-2001, 05:14 AM
Hello everybody !

I recently came across the game "Serious Sam".
There are many bad sectors on the CD and you need it everytime you start the game.
It has two sections ".icd1", ".icd2" and a third one ".idata".
I don't know which copyprotection was used on it (icd = old/new safedisc ??), but it was quite simple to be bypassed.

It runs fine under Turbo Debugger 5.0, but you can't set any breakpoints or the program will crash.

It checks only one time for SoftICE via CreateFileA(). You can't use BPX or BPM neither, but a BPR on the ".data" section works fine.
Then you are somewhere in a TEA decryption-algo. You can now easy find the password (128-bit) and decrypt the ".code" and ".data" by hand using any TEA(old)-implementation.

The program's idata (not ".idata", it's the copyprotection's idata) is readable without any problems from the original program, only the names of the DLLs and functions are encrypted with a simple algo, which you can find via "BPR AddrOfFirstDLLPointer RW". When you have decypted the idata with this algo, you can insert all the sections in the EXE and delete ".icd1", ".icd2" and ".idata".

The only thing left is to find the correct pointer to the import table, which should be very easy and to find the entrypoint, which is also very easy. Just search for a call to "__set_app_type" and go a few bytes back to the "Push EBP".

I hope I could help someone with this short descrition of the protection.

I would also like to know the name of the protection.
risc
05-21-2001, 06:41 AM
its copylok / copylock . they probably have a webpage advertising how strong and unbreakable there protection is, dunno the url though (2 minutes at google.com reveals http://www.panlok.com , but, i only see a protection called codelok, heh, maybe they renamed it!)

new copylok is just as weak, with one extra icd section (they rename original programs idata -> icd0, and encrypt with tea). and after decryption of the code section, they scan it for call dword ptr's (ff 15's) & jmp dword ptr's (ff 25's), and then mangle into call wrapped_api, nop. pretty silly to decrypt a 100% virgin code section, and then mangle it

i think he has a little stronger anti debugging on win9x though, constantly morphs some decrypt keys using debug registers (maybe just dr7, i cant find him abusing any other dr's), so any bpm's screw up decryption.

ive never debugged earlier versions so i cant be sure if this is new or not. but from what you say, not being able to bpx or bpm, its probably not new. just annoying . (i had to run the game under win2k so i could bpm safely :-))
Kilby
05-21-2001, 06:57 AM
It sounds a bit like copylok.
DakienDX
05-21-2001, 11:19 AM
Hello risc !

Thank you. Now the enemy has been named and can be defeated !

I haven't found any more antidebugging code in it.

Just BPM and BPX don't work and CreateFileA checks for SoftICE.
evil-risc
05-21-2001, 11:40 AM
i used icedump to find the debug register key morphs . /protect on , broke on access to idt, first time he was setting dr0..7 to 0, all other times he was reading dr7 ..
ThrawN
05-21-2001, 08:32 PM
Dam my serious sam version which i just picked up from EB in aus yesterday has no copylok only a pathetic CD check :(
DakienDX
05-22-2001, 04:39 AM
Hello ThrawN !

That's bad luck.

My version is 1.00; the 1.00c Update doesn't alter the SeriousSam.exe, so you we've only one encrypted program yet.

I'll check if you can crack the file without an original CD (and without a installation and it's DLLs :( )
madmax
05-22-2001, 05:48 PM
Im not sure if this is the new safedisc, but I looked at Hitman47 from Eidos recently, and it was pretty straightforward...The antidebugging can be annoying...I modified winice.exe a little (frogsice prone to crashing and another reason) and loaded icedump, cause i noticed IDT access...But still it crashed! I came across a routine that searches high mem (C0000000) for strings like SoftICE, TRW by ..., Frogsice,etc...LAME crap i must say...But its easy to get around, just find a mov dl,[blah] and change to mov dl,xx where xx is a rare opcode...runs fine now under softice.

madmax
DakienDX
05-26-2001, 04:51 PM
Hello madmax !

It is not THE new SafeDisc (v2.05.30/v2.10.30) which I've found in "No One Lives Forever" and "Black & White", but I thought it could be a very old version of SafeDisc or a "low budget" version for people who don't have enough money to buy a "full-featured" version.

This game took me about two hours to find a correct TEA-key and one more to decrypt the imports, SafeDisc 2.10.30 took me two days !
EBFE (restored)
05-26-2001, 04:52 PM
all you have to do is to hide softice and bpx on __set_app_type or __getmainargs to get into the standard c pe header. the msvcrt imports are not protected by copylok so a bpx wont fuck up the tea key.
patch an endless loop into the .text cave and reset eip to this loop, exit sice and dump the whole process with procdump. scroll some bytes up and you will find 00425996 to be the original entry point.
the api calls do not pass any further check (like safedisk) so your dump will perfectly work :/
DakienDX
05-26-2001, 04:53 PM
Hello EBFE !

I don't want to seem aggresive, but your reply seems to be in the wrong place. I'll shortly explain why.

"all you have to do is to hide softice" - Why ? We use SoftICE only ONE time to get the TEA-key and the copyprotection checks only ONE time for SoftICE. BPX MessageBoxA -> everything OK. (Btw, I think most of the people on this board have patched SoftICE against the most common detection methods)

"bpx on __set_app_type or __getmainargs" - How do you know that the game has a "standard c pe header" ? It would be more likely to look for GetVersionA, since it is used in most high-level programming languages in the startupcode.

"msvcrt imports are not protected by copylok so a bpx wont fuck up the tea key" - If we break finally on a msvcrt import, where should we look for the TEA-key ? How do we know that TEA was used when we simply ran the program until it is unpacked ? Or should we try to bruteforce it ? (We've 8 bytes of encrypted and decrypted data, so why not bruteforce a 128-bit password) ?

"patch an endless loop into the .text cave" - well, remember to change it back in the dump.

"reset eip to this loop, exit sice and dump the whole process with procdump" - If we wanted to dump the process and hope that the imports may work I wouldn't have started this post. I had fully unpacked the protection before I posted anything about it.

This is a reversing board, not a dumping board.
dead-sexy ;)
05-28-2001, 06:35 AM
hoho, copylok sux!

he uses the cd for verification only, the key is stored internally in the exe and is mophed using "crcs" of his own protection code..

brute force will take forever, but stealing the raw key, and his morph table, and his code, you can create the final key with ease..

i will demonstrate soon

you can find oep by running the app with no cd, bpm messageboxexa x.. hit f12, click ok

search ebp-400 l -1 for the imagebase (useually 00 40 00 00)

you should find his magic morph table, -18h is the beginning of this ..

:s ebp-400 l -1 00 00 40 00
Pattern found at 013F:0098F5DC (000000E0)
:dd 98f5dc - 18 l 100
013F:0098F5C4 00619117 BFF70000 BFF60000 00AB08B0 ..a.............
013F:0098F5D4 00AB0750 00AB0BF0 00400000 00000000 P.........@.....
013F:0098F5E4 001A0400 00018000 001FF000 00000000 ................
013F:0098F5F4 00191000 00010000 001EF000 00000000 ................
013F:0098F604 001B7C00 00002000 00217000 00000000 .|... ...p!.....
013F:0098F614 001B9A00 00034000 00219000 00000000 .....@....!.....
013F:0098F624 001ECC00 00001000 0024D000 00000000 ..........$.....
013F:0098F634 001ECE00 00001000 0024E000 00000000 ..........$.....
013F:0098F644 001EDE00 00008000 0024F000 00000000 ..........$.....
013F:0098F654 001F0A00 00000C00 00257000 00000000 .........p%.....
013F:0098F664 001F1600 00003000 00258000 00000000 .....0....%.....
013F:0098F674 001F3C00 00001000 0025B000 00000000 .<........%.....
013F:0098F684 001F3E00 00002000 0025C000 00000000 .>... ....%.....
013F:0098F694 00000000 00000000 00000000 00000000 ................
013F:0098F6A4 001F5600 00001654 0025E000 001340CA .V..T.....%..@..
013F:0098F6B4 00AB0C50 00AB0910 006190DB 00AB0970 P.........a.p...

this table + 0ech -> OEP , 98f5c4 + ec -> 98f6b0 -> 001340CA, the entrypoint RVA for tropico ..

you can find the import table info searching the process for this encrypted string 'EZDP' .. string -4 = image import descriptors ..

in icd2 section ..

:dd 65b000 l 10
0030:0065B000 001E4000 50445A45 3D20474C 00692520 .@..EZDPLG = %i.

works with all versions ive tried

r!sc

4 days since my first , since my first time debugging copylok, he died :~, hreh
dead-sexy ;)
05-28-2001, 06:38 AM
hoho, copylok sux!

he uses the cd for verification only, the key is stored internally in the exe and is mophed using "crcs" of his own protection code..

brute force will take forever, but stealing the raw key, and his morph table, and his code, you can create the final key with ease..

i will demonstrate soon

you can find oep by running the app with no cd, bpm messageboxexa x.. hit f12, click ok

search ebp-400 l -1 for the imagebase (useually 00 40 00 00)

you should find his magic morph table, -18h is the beginning of this ..

:s ebp-400 l -1 00 00 40 00
Pattern found at 013F:0098F5DC (000000E0)
:dd 98f5dc - 18 l 100
013F:0098F5C4 00619117 BFF70000 BFF60000 00AB08B0 ..a.............
013F:0098F5D4 00AB0750 00AB0BF0 00400000 00000000 P.........@.....
013F:0098F5E4 001A0400 00018000 001FF000 00000000 ................
013F:0098F5F4 00191000 00010000 001EF000 00000000 ................
013F:0098F604 001B7C00 00002000 00217000 00000000 .|... ...p!.....
013F:0098F614 001B9A00 00034000 00219000 00000000 .....@....!.....
013F:0098F624 001ECC00 00001000 0024D000 00000000 ..........$.....
013F:0098F634 001ECE00 00001000 0024E000 00000000 ..........$.....
013F:0098F644 001EDE00 00008000 0024F000 00000000 ..........$.....
013F:0098F654 001F0A00 00000C00 00257000 00000000 .........p%.....
013F:0098F664 001F1600 00003000 00258000 00000000 .....0....%.....
013F:0098F674 001F3C00 00001000 0025B000 00000000 .<........%.....
013F:0098F684 001F3E00 00002000 0025C000 00000000 .>... ....%.....
013F:0098F694 00000000 00000000 00000000 00000000 ................
013F:0098F6A4 001F5600 00001654 0025E000 001340CA .V..T.....%..@..
013F:0098F6B4 00AB0C50 00AB0910 006190DB 00AB0970 P.........a.p...

this table + 0ech -> OEP , 98f5c4 + ec -> 98f6b0 -> 001340CA, the entrypoint RVA for tropico ..

you can find the import table info searching the process for this encrypted string 'EZDP' .. string -4 = image import descriptors ..

in icd2 section ..

:dd 65b000 l 10
0030:0065B000 001E4000 50445A45 3D20474C 00692520 .@..EZDPLG = %i.

works with all versions ive tried

r!sc


PalmDemon
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > PalmDemon
PDA

View Full Version : PalmDemon

critter (restored)
05-21-2001, 12:34 PM
anyone have a working link?
CoDe_InSiDe (restored)
05-21-2001, 12:54 PM
Hi Critter,
You probably tried Palmdemon.cjb.net ?
That link redirects to www.amazingcolors.com which is down (i think )
Because www.cracking4newbies.com doesn't work either and that also redirects to amazingcolors.com
Hope this helps.

Cya...

CoDe_InSiDe
Critter (restored)
05-21-2001, 01:31 PM
ah cheers


ExeScope Question - making a form destroy itself
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ExeScope Question - making a form destroy itself
PDA

View Full Version : ExeScope Question - making a form destroy itself

__DuDu__
05-21-2001, 10:05 PM
I can see the resources with exescope, and i have a nag with a ok button what kind of code should i add to this form to when it create it destroy itself, i tried it without luck :(

object FormReg: TFormReg
OnCreate = FormDestroy
OnDestroy = FormDestroy
OnShow = FormDestroy

tnx in advance

_DuDu__
__DuDu__
05-23-2001, 10:35 AM
no one can help me :(((
__DuDu__
05-23-2001, 09:41 PM
i need to remove this..plz someone..delphi programmers help me plz !

tnx

__DuDu__
Carpathia
05-24-2001, 07:31 PM
The functions you pasted are irrelevant, since they only respond to an aready pending message. Try injecting code to send a WM_CLOSE to the handle of the form. You may need to work on the close handler too, to suppress any prompts.

Only destroy the form if it performs some function during initialisation, otherwise, prevent the creation of the form instead.
Lord Rhesus
05-25-2001, 07:14 AM
This is a simple trick by Predator NLS which you can find along with others in 'Crackers Notes'. Get cracker's notes from www.immortaldescendants.org . I find this trick works most of the time:

The fastest way to crack NAG Screens is to use a Hex-Editor and your eyes. Start
your program and wait till the NAG Screen pops up. Now note down the captation of
the window and the first words of the dialog message. Then open your EXE (or DLL) and
search for the noted string. If you found it, scroll up and search for the 4 bytes
FF FF FF 80 ... and if they were there replace the 80h by 90h. After this patching, start
your program and you will never see the NAG again.
Sometimes it's necessary to press a button to continue. In this cases you must often use
a debugger!
pm
05-26-2001, 04:46 PM
Hi,

I think this 'trick' will solve your problems
Write this in eXescope

object FormReg: TFormReg
enabled=false

Probably you'll have a new messagebox after running the program, but that you can easily kill

pm
__DuDu__
05-26-2001, 04:48 PM
PM u saved my life :)


Linux Flexlm SDK Kit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Linux Flexlm SDK Kit
PDA

View Full Version : Linux Flexlm SDK Kit

roZes
05-22-2001, 01:57 AM
Hi

Do anyone have linux version of flexlm SDK, can you please share with me. ( anything above 6.1)
thanks
roZes


MS Access
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MS Access
PDA

View Full Version : MS Access

vicka
05-22-2001, 05:24 AM
Hi
I got a problem with a program written in MS ACCESS !!!!!! This issue is discussed in some page on fravia's site(pepper2.html ?). But I can't find anything more.....
Could you guys give just a tips on cracking such "shit" ?
Thanx for all :)
LaptoniC
05-22-2001, 03:13 PM
You may look msaccess.htm at Tsehp's site.Hope it helps.


Is there any way to make w32dasm disassembly editable ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is there any way to make w32dasm disassembly editable ?
PDA

View Full Version : Is there any way to make w32dasm disassembly editable ?

zouzouni
05-23-2001, 12:40 AM
Is there any way to make w32dasm disassembly editable ?
+SplAj
05-23-2001, 03:13 AM
yes

Harlequin made a dll and a patch for WDasm893 to do what you want... i.e you want to make a 75 to EB in WDasm directly without closing and using Hex editor ?

Protoooooools should have it.
p0thEAd
05-26-2001, 04:50 PM
if you mean to be able to comment the code , then u got to use IDA ;)


Some problem with proxies may arise here...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Some problem with proxies may arise here...
PDA

View Full Version : Some problem with proxies may arise here...

tsehp
05-23-2001, 07:30 PM
Hi,
I'm forced to ban more and more proxies to impeach a really-not-wanted-here guy (golem) to come here and flood us with his knowledge. He actually could have exhausted all his direct ip's, and now is using some anonymous proxies.
I'm forced to ban also those anonymous proxies he's using, so this could impeach yourself to connect on the messageboard.
If this happens, the only fast and working solution is to make a direct connection, sorry for this. I don't want to set a messageboard with messages to moderate before publishing or registering people before publishing messages, this is not needed actually.

Sorry for the problems,

+Tsehp


'snpslmd' XOR and Permutation Tables
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > 'snpslmd' XOR and Permutation Tables
PDA

View Full Version : 'snpslmd' XOR and Permutation Tables

roli
05-24-2001, 04:13 AM
Can anybody send me the XOR entries and Permutation table required to compile 'lmcrypt' for 'snpslmd' daemon ?

I know (from a previous thread) that 'netman' & 'nblender' have the info necessary for this.

Thnx in advance,
roli
friedi
06-11-2001, 06:28 AM
Disassemble snpslmd and find the xor's.
Nolan Blender
06-18-2001, 11:28 PM
Actually, it's not so easy now - the routines
that are in the later versions of flexlm
crypt filters are actually inverses of the
routines in the filter generator. The way
to approach this problem is to rip the filter
and modify it so that you can tell if the
routine is reaching the final return - then
you can brute force out the xor tables and
permutation tables.

I think the tables appeared in an earlier
message, but I'm not sure.

--nb.
Bill Fox
07-03-2001, 07:22 AM
Goto www.senyasoft.com, request sourse code for purchased "snpslmd key generator"- named Synopsys Common Licensing 1.1;-)
Bye
Bill

Thnx in advance,
roli[/quote]
roli
07-03-2001, 04:03 PM
thanks Bill - I'll try your advise...
roli
roli
07-06-2001, 03:05 AM
Bill Fox (bfox),
Shame, shame !!!

Your advise is non-worthy - the site manager
requires MONEY for 'snpslmd' info, which has been released in this forum some weeks ago ! - Shameless guy !
Bill Fox
07-12-2001, 07:35 AM
No!!! This my 2000 Yars works.
roli
07-16-2001, 08:36 AM
...:)...


eEye Iris 3.00
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > eEye Iris 3.00
PDA

View Full Version : eEye Iris 3.00

hOrn_dOg
05-24-2001, 07:05 AM
LOL :-)

Laurentiu disprotected his latest iris.exe ver 3 with 'CryptX'

LOL ........te!te!te! ;)

have phun

www.eeye.com
disavowed
05-24-2001, 09:52 PM
eeye is starting to go downhill.. an exploit for retina was released a little while ago, and secureiis was found to be exploitable a few days ago
disavowed
05-24-2001, 09:54 PM
figures... look what they spend all their time doing when making updates (from http://www.eeye.com/html/Support/Iris/New.html):

"Added more hints to the 'Did You Know'."

:)
emulder
05-27-2001, 06:21 AM
hOrn_dOg (05-24-2001 08:05):
LOL :-)

Laurentiu disprotected his latest iris.exe ver 3 with 'CryptX'

LOL ........te!te!te! ;)

have phun

www.eeye.com

What is 'CryptX' ?
+SplAj
05-27-2001, 07:01 AM
LOL .........tE!8.......
+SplAj
05-27-2001, 07:11 AM
Iris 3.00 (tE!lock8 + Sheriff Licence System)
=============================================
Ok, back to reality. I tried again to play the 4 versions of violin I bought...
as well as the piano(Win32) but my violin system still can't see my VGA card or
my USB ports.....I don't have a T1 to D/L the latest CD.img .... :-(

So I revereted back to the piano (Win32) and hacked around Iris3 from eEye.com.
Ahh that's a better tune....

Ok my old friend Laurentiou made a *new* version. But wait WTF is new ? Well
packing it with tE!lock instead of PeShiELD is a new erm , challenge ! , -ok
don't snigger at the back. Some ppl can't get past this new protection. As the
target is 'protected' with tE!lock you should D/L it from www.exetools.com and dump/rebuild it then
IDA it to study what tE! has done. See that latest 'dummy' section renaming tool
? Fake a known packer like UPX or CryptX ;)

I found some interesting stuff. But what I was after was the 'end-point'. Where
tE! code gives control back to Iris.exe
Have a look at your 'rebuilt' tE! disassembly. I found some interesting code at
:-

.SEC:004098F6 mov ecx, 109h
.SEC:004098FB lea edi, unk_409909[ebp]
.SEC:00409901 mov esi, edi
.SEC:00409903
.SEC:00409903 loc_409903: ; CODE XREF: .SEC:00409907j
.SEC:00409903 lodsb
.SEC:00409904 xor al, [esi]
.SEC:00409906 stosb
.SEC:00409907 loop loc_409903

(It will only be interesting to *YOU* once you've reversed tE!lock and study it
a while ;) )

This 'loop' injects the last interesting bit of code before revealing the OEiP
and passing the hand back to the original exe. This code is fixed in every tE!
lock protected app. So we could call it the 'signature' bytes. So we need to
search for the following series :- "B9,09,01,00,00,8D,BD,09,99,40,00,8B,F7" at
an appropriate moment. In Win98/ME run icedump with /protect on and set eax to
the same number less 80000000 (eg eax= 8010604E then set eax = 10604E) to
bypass the IDT check. Now search with SI for the bytes. Found here at VA 55FEEE
so set a BPX 55FEEE and press F5. SI pops so press F10 until the 'loop' is
finished. Now press F8 until you see the usual POPAD (here at VA 56005) and you
are there at OEiP 46286C. Now, for those of you new to tE!lock, you will not
know that he plays with the PE header. Namely that he makes the section counter
to FFFF instead of 0500 (or no. of sections there really are - reverse byte
order) so you need to put this back at 400000+PE+7th&8th bytes. Now you can
EBFE or use ICEdumps PEdump ? err no cos the IT is f*cked as well. Check out
the mapping/destroying of the IT at offset VA 483318+ Either let it map the
IAT/IT then dump the exe to copy+paste this IAT/IT in a destroyed OEiP DMP or
use RV to rebuild the IAT/IT
for you.

Fix up the DUMPED.EXE and it should run ? NO ? WTF!. Well check out another nice
feature of tE!lock The MUTEX. Don't run away screaming in phear. Laurentiu just
checks for the existence of a child-process in memory. What is he looking for ?
well would you guess he chose the name "IrisMutex". OMG what a big clue. So 2 or
3 things to do. 1) make notepad.exe protected in tE!lock with the same name
mutex and run it. Launch Iris 3 and it should run. :-) and it does, Q.E.D. Repack
Iris Dump with tE!lock...erm we aint finished playing yet ! or reverse a JMP

So lets be coding gods and REVERSE A JMP ! Set a BPX CreateMutexA and fire up
your dumped.exe and SI will pop at 4473C1. See GetLastError call. He checks for
the 'IrisMutex' if found eax will return with an expected result 'B7'. See that
JNZ 4474D0 well make it a JE 4474D0. That fixed it ! Cool I just joined the
l33t ;)
+SplAj
05-27-2001, 07:13 AM
Right. We have iris.exe revirginated. Look around. 15 day trial. How? it used to
have PCGuard and a proprietry serialisation system. What no 'SplAj' in the dump
anymore so a serial with the name 'SplAj' is allowed again ?. But wait how the
f*ck do I enter a serial now anyway ?

Look through the exe for 'Licence'...... found something :- WTF is ACUDATA and
SHERIFF.... What is that folder doing in the Windows directory 5358-8621-2429
-7641-5701 with those 3 *.sls files ?

So I browsed the WWW for Acudata and saw it was a reseller of Sheriff
-software.com Licencing system :- http://www.sheriff-software.com Read the
blurb. Sounds familiar ? THE DOGS BOLLOCKS program just for you. Only $550
dollars for complete peace of mind !!! LOL. See there is a keygen in the SDK !

Don't register to get the files just browse the following folder :-

http://www.sheriff-software.com/zipfiles

- another security flaw !!!

How to get the codes ? Well in the
Registry already half the info is there for you:-

Product Name Iris Evaluation
Product ID 5358-8621-2429-7641-5701
Product Secrets ?1
?2
?3
?4

Ok. read the info. The 'secret' keys are plain or encrypted. Guess where they
are stored ? YES in the dumped exe ! How f*ckin lame man. What sort of Licence
system is this ! It's too embarrassing. Candy from a baby. Look in the dumped
exe for the string 5358-8621-2429-7641-5701. See after this the byte sequences
1) 41,61,6D,36,14,14 bla bla ( 4 secrets with 0Eh x 00 in between) 2) 42,62, bla
bla 3) 43,63, bla bla 4) 44 64 bla bla. These are the 'encrypted' secrets ! So
study the IDA disassembly of the slsGen.exe and you will see the bit you are
interested in. Altenatively set a BPM rw on the memory location of these 4
encrpyted keys and you will soon find the 4 plain versions for your keygen !
Childs play. Much easier than reversing a JMP

Now you can fill in the 4 secrets 1) 0763 - ******** 2) 2482- ******* 3) 3739
- ******** 4) 3739- *********** (do some of your own work bud) and you have a
master keygen available WOW! Expire iris by deleting the 3 sls files in the
folder and re-run Iris, Laurentiou thanks you for 'evaluating' (LOL what did I
evaluate?) and supplies you with your own 'users reference code' to make a full
Licence key. Do it now.

Game over Sheriff.....all sing 'I shot the sheriff, but I swear i did not shoot
the deputy....' ahh you're all too young to remember that one ;)

So you can even forget your dumped.exe :-( Once the licence is made, Iris is
yours for as long as you want to evaluate it. BTW it IS and evaluation
version....... no graphs are available etc :-(

disavowed did his homework and found , as I did, there is nothing +new here. Just
a new help file !

'patch+play'
+SplAj }>

BTW after several pints of Guinness....you don't need a *nix challenge you can do
a lot of natural 'straining' the next day......
disavowed
05-29-2001, 09:51 PM
hey +splaj, nice job finding that /zipfiles dir on the site. i think i might finally upgrade from capturenet pro to iris now (capturenet was "bought" by eeye and used as the basis for iris, afaik). keep up the good work, dude. you're one of the few skilled reversers left on this board

and for those of you who wondered what that comment about the *nix challenge was about... don't mind +splaj, he's just pissed because he can't disassemble the challenge :P
disavowed
05-30-2001, 12:00 AM
yay, all registered. that was fun
splaj.. turns out you don't even need to decrypt the encrypted secrets.. the cleartext secrets appear in the dump. i was able to register the program from scratch with just BinaryTextScanner (and SlsGen.exe).. no softice, no ida, no hex editor.. how simple :)
e1m0
05-30-2001, 01:38 PM
hmm, im having trouble. i do not understand how to dump this?! my exe wont even run after i dump it. please give me instructions on how to dump it, or even upload the .BIN and dumped .EXE
?!

thanx
e1m0
tsehp
05-30-2001, 02:41 PM
first tell us how you did the dump
e1m0
05-30-2001, 02:56 PM
well, i dont know. i just did it severaly ways, trying to follow what +SplAj said... none of them have worked yet :(
disavowed
05-30-2001, 04:56 PM
well, i tried using procdump initially, however trying to dump iris caused procdump to crash. and since i didn't have softice running in the background, i didn't feel like rebooting just to have access to icedump. so, seeing as how i had no other process dumping tools on my computer, i decided to just whip something up in visual basic to dump the entire process from memory after it was loaded (via ReadProcessMemory API). worked beautifully :)
e1m0
05-30-2001, 10:57 PM
wahaha! nice ! care to share the code/program with me....? i cant even get the thing to dump right. i used icedump.. didnt work.. i used procdump and got the same thing as you, crashed. dont have softice cause it does not work properly on windows 2000.

e1m0
edward (copied)
05-31-2001, 01:51 AM
Splaj, thanks for your essaye on Iris and telock.
But please allow me one small note on the sheriff LS:
I think you can't create a valid registration-key for
Iris using the slsgen-program. It just creates a trial-
registrationkey, 'cause it's only a demonstration program
itself. Just try it, register Iris, and turn your system clock
some months ahead...the evaluation is expired.
But maybe some modification on the slsgen.exe would help
We'll see.....
regards
blowfish
05-31-2001, 04:30 AM
SlsGen.exe can generate a unlimited license key. I have tried the same with SecureIIS(It's not packed) and successfully registered it, even if I changed the sys date to year 2002.

BTW:
In order to make a valid license key, there is no need to dump the packed exe. Just set a BPX on one of the following 2 SLS APIs, then set a BPM on the encrypted secret array, we can find the plaintext of the 4 secret keys.

//slsapi.h
HRESULT WINAPI SLS_CreateChallenge(SLS_SECRET *pSecretArray, int nSecrectSize, const BYTE *pbStream, int nStreamSize, SLS_CHALLENGE *pChallenge);

HRESULT WINAPI SLS_VerifyChallenge(SLS_SECRET *pSecretArray, int nSecrectSize, const BYTE *pbStream, int nStreamSize, SLS_CHALLENGE *pChallenge);
+SplAj
05-31-2001, 04:52 AM
The problem with the 'Domonstration has expired' is with PCG still in
the reg+windows with the tE! packed iris.exe. If you unpack it you have no probs.

Check out the registry key :-

HKCR..{F4A40EAF-137C1FDB-7377EC72}

And 'PCGwin32.li3' in your windows folder.

Running Regmon/Filemon is a big help ;)

Delete both and the demo is reset for another 15 days. So better UNPACK the bastard. AGAIN FYI take care of the FFFF sections in the PEheader....

I repeat. D 400000, scroll down to see 'PE' then count to the 7th & 8th bytes. See the FFFF. Change it to 0500. THEN you can dump
if you sorted out the IAT/IT already.

Try dumping with PEeditor1.7. My favorite (until I get LordPE ;) - y0da have you got my envelope yet!)

Tell us more your experience.

+SplAj
e1m0
05-31-2001, 02:23 PM
ok... i must be dumping at the wrong places... i dumped with peditor.. and changed the FFFF part..it said it wasent a valid win32 app.... ARGH

where do i dump at guys? from xxxx to xxxx WHERE? :)

thank you for being so patient with me guys, heh ;)
Kilby
06-05-2001, 03:07 AM
Gentlemen,

It's back to work on Iris as 3.1 is now out
LaptoniC
06-07-2001, 07:05 PM
I have tried to unpack v3.1. I have managed to find oep and fixed Pe header.When I run it program just hangs and only way to close it is via ctrl+alt+del.I can't fix iat.I have tried revirgin v110b9b but some entries couldnt be resolved.Some of them redirected and some of them just 0.I have tried to resolve again button several times.Also I have clicked once more Iat resolver button.Suddenly some of the entries just dissaperad and some of the redirected entries resolved.

I have used 6c000 as IAT Start RVA and 1500 as IAT length.
Thanks
tsehp
06-08-2001, 04:35 PM
ok, I promise this is my next one, but thanks to save me some time and email me + post there the oep, I'll do the rest.

later,

+tsehp
madmax
06-10-2001, 02:41 PM
I tried this first with RV, but was also experiencing crashing upon execution...I then tried using ImportRec, and was successful..But you must cut the thunks at certain positions (read the TIPS.txt included)...Im sure RV will work as well...As for the MuteEx check, Im not sure if this is universal with all winXX, but in winME, a mutex MPRMutex seems to be created before execution of iris.exe (or any for that matter??)...So hex edit "IrisMuteX" to "MPRMutex" and the packer check is defeated. Havent looked at protection yet though =) Have fun

madmax


disassemblers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > disassemblers
PDA

View Full Version : disassemblers

defiler
05-27-2001, 02:59 PM
http://www.spiralspace.com/programming/disassembler/
Kayaker
05-27-2001, 07:33 PM
Very nice. At the main page there's also a nifty Stack frame demo and even some SoftIce info. Thanks for the link.

Kayaker


How do I calculate target in vbox?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How do I calculate target in vbox?
PDA

View Full Version : How do I calculate target in vbox?

dec
05-27-2001, 03:21 PM
Hi there all great reversers!

I wounder if anyone can help my, you see I have a
problem. How do I calculate the end of a program
that is Vboxed?

You see, I like to dump a Vbox app from its OEP and to its end station. When using procdump this is made the dumper, but if I know how to make the calculation I do not have to depend on procdump to save my day.

Hope anyone has the time to replie!
-Ms dec
tsehp
05-27-2001, 05:30 PM
normally you should use softice with icedump, those are much better
to do some clean job, and even use my tool, revirgin, to rebuild the dumped target's iats.

to calculate the length, just do a map32 command into softice, then you'll see all the sections of it and be able to calculate the length,
you should do a visit to the site's essays about unpacking.
madmax
05-28-2001, 08:52 PM
Funny this silly vbox came up, I just looked at an old vbox 4.3 target, and I was unable to get RV or IMPREC to rebuild good IAT...RV never resolved most of the entries, and IMPREC returned VirtualAlloc for most! heh...Its not a complicated redirection scheme, but I guess hard to get around in "general"...Actually, the hydra plugin included w/icedump still works sometimes, but what about future versions =( u guys have any luck w/vbox stuff?

target was derive 5.04 from texas instruments btw

madmax


Not good: This forum can't keep the indent
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Not good: This forum can't keep the indent
PDA

View Full Version : Not good: This forum can't keep the indent

Solomon
05-27-2001, 08:38 PM
continuous blanks will be translated into one blank char. That's not good for reading.

How to keep the indent when posting?
Thx
tsehp
05-28-2001, 01:31 AM
do you mean posting a listing ? can you send me the doc you wanted to send for me to fix this ?
otherwise you can still upload the file.
Solomon
05-28-2001, 08:15 PM
yeah, I forgot that I could use attachment. Sorry ;-)


CopyLok AntiDebug
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CopyLok AntiDebug
PDA

View Full Version : CopyLok AntiDebug

Luke
05-29-2001, 06:49 AM
Seems there's a bit of confusuion here concerning the ADT of CopyLok.
Actually there're 3 little tricks:

1. Meltice (createfile SICE)
2. check dr7 (debugger check)
3. clear all drx regs (to disable possible BPs)

Meltice is only executed once.

While dr7 check and drx cleaning happens quite often (i.e. in between the decryption process.)

They gain ring0 to read/write drx regs by using div 0 exception handler pretty much like old SD1 did.
Needless to mention that all are useless in W2k or in W9x with icedump protection.
tsehp
05-29-2001, 07:29 AM
yes but some protections (asprotect) uses some seh_handlers that already clears the debug registers, just by calling some interrupts and I can swear you that it really works on nt, look at my essay concerning asprotect.

the best thing I know is to use icedump, enable the /protect command
that forbids any access to the idt table, concerning the debug registers there is TMHO not a lot of things to do instead tracing || searching for those instructions or watch sice go mad when you step above a call that contains such treatments.
evil-risc
05-29-2001, 05:47 PM
erm, the clearing drx in ring0 doesnt wipe breakpoints ..

you can bpm copylok exe's ..

the dr7 check, isnt a check, it uses dr7 & 3ffh to morph decrypt keys (0 if no breakpoints set)

'Needless to mention that all are useless in W2k or in W9x with icedump protection.'

icedump wont help at all . /protect on catches read / write to idt for his illegal ring0, but since its called 3,000,000 times, you would have to /protect on /protect off 3,000,000 times to bypass it, and u cannot patch the code due to 'crc's also used to morph decrypt keys

where was the confusion?

bpr is my best friend

and tsehp,

you already know seh is pathetic for wiping debug breakpoints ! :-) there is only one way to debug aspr, and thats bpm's :d
Luke
05-30-2001, 04:14 AM
>erm, the clearing drx in ring0 doesnt wipe breakpoints ..

So? What does it do? Huh? Go have a look at the fucking Debug support facillities of x86 IA32 cpus. And then tell me what clearing drx regs really does. Go ahead.

>you can bpm copylok exe's ..

Maybe ya should look at SICE's implementation of BPM which seem NOT to use dr0 - dr3 in all cases. (i.e you can't bpm on ranges > 4 byte with hardware bpm, well, using 4 bpms will make 16 bytes...)

>the dr7 check, isnt a check, it uses dr7 & 3ffh to morph decrypt >keys (0 if no breakpoints set)

Ok, maybe not too precise what i said before but actually the dr7 check changes behaviour of app when BPs are set, so i guess basically it's a debugger check, isn't it?

>'Needless to mention that all are useless in W2k or in W9x with >icedump protection.'

>icedump wont help at all . /protect on catches read / write to idt >for his illegal ring0, but since its called 3,000,000 times, you would >have to /protect on /protect off 3,000,000 times to bypass it, and >u cannot patch the code due to 'crc's also used to morph decrypt >keys

Ok, i agree on that.

BR.
evil-risc
05-30-2001, 05:43 AM
>erm, the clearing drx in ring0 doesnt wipe breakpoints ..

-So? What does it do? Huh? Go have a look at the fucking Debug support facillities of x86 IA32 cpus. And then tell me what clearing drx regs really does. Go ahead.

ooh , your angry!

well, it clears them, basically, but doesnt stop softice's breakpoints for some reason ..

>you can bpm copylok exe's ..

-Maybe ya should look at SICE's implementation of BPM which seem NOT to use dr0 - dr3 in all cases. (i.e you can't bpm on ranges > 4 byte with hardware bpm, well, using 4 bpms will make 16 bytes...)

ok, so bpm loadlibrarya x and bpm sendaspi32command x break every time they are executed in copylok exe's, even though debug breakpoints have been cleared, well, it must be magic hey? unless setting dr0..3 to 0 in ring0 DOESNT wipe debug breakpoints .. (well, vwin32 manages to do a good job, but, everything else apears to fail)

take a look at new laserlock, he wipes dr0..3 a lot more times than copylok does, and still, debugbreakpoints work ..

>the dr7 check, isnt a check, it uses dr7 & 3ffh to morph decrypt >keys (0 if no breakpoints set)

-Ok, maybe not too precise what i said before but actually the dr7 check changes behaviour of app when BPs are set, so i guess basically it's a debugger check, isn't it?

erm, its anti-debugging (like u said in the topic to your post), not a debugger check..

like hooking int 1 or int 3, or crc'ing the code section of kernel32/user32 a couple of times, or crc'ing your own code, just anti debugging ..

hmmmm
tsehp
05-30-2001, 02:32 PM
>ok, so bpm loadlibrarya x and bpm sendaspi32command x break every time they are executed in copylok exe's, even though debug breakpoints have been cleared, well, it must be magic hey? unless setting dr0..3 to 0 in ring0 DOESNT wipe debug breakpoints .. (well, vwin32 manages to do a good job, but, everything else apears to fail)

hi r!sc, you remember the sd2 injector you sent me that I finally managed to reverse, remember this code :IFSMgr_Ring0_FileIO
0028:C01392D4 55 PUSH EBP
0028:C01392D5 57 PUSH EDI
0028:C01392D6 56 PUSH ESI
0028:C01392D7 83EC30 SUB ESP,30
0028:C01392DA 8BFC MOV EDI,ESP
0028:C01392DC 51 PUSH ECX
0028:C01392DD 50 PUSH EAX
0028:C01392DE B90C000000 MOV ECX,0000000C
0028:C01392E3 33C0 XOR EAX,EAX

following this code, the drx are voided, so it was rendering your injector cloaked against bpmb, but when you patch the vwin32 code ti jump above the drx voids, the bpmb works again.

so, I still don't why in some cases voiding the drx does nothing and in such vwin case, it really does. You were talking about some thread contexts, sure that if some drx are voided into another, sice will still be able to bpmb into the context where they are intact...vast problem, sorry the answer is not in mine.


crackz site
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > crackz site
PDA

View Full Version : crackz site

tsehp
05-29-2001, 05:19 PM
It is now directly indexed by our local search engine below.


A strainer, or perhaps just a challenge for the interested.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A strainer, or perhaps just a challenge for the interested.
PDA

View Full Version : A strainer, or perhaps just a challenge for the interested.

Fatboy Joe
05-29-2001, 05:31 PM
All this talk of technical challenges reminded me of one that I haven't had a chance to undertake myself. Since I think it would probably actaully be a fairly decent if different strainer involving reversing and a little programming I figured I'd write it up and share it to see if anyone fancies tackling it. I don't know if anyones really planning on doing serious strainers or if there is gonna be any reward for it, but I guess if you are looking for ideas, please free to try this one.

In a recent freak storm I had some memory fried, not completely, the computer still boots up with it, but certain physical locations of the memory are corrupt. As you go about your usual bussiness strange things start to happen, intermittent faults caused by having the memory not perform as intended. There is a program called memtest[1] that allows you to test the memory and which particular locations are broken, but most operating systems (afaik) don't allow you to specify that certain parts of your ram are dodgy. You can quite often specify that you only want to use only the first xxxxMB of memory with your optrating system. This however is a bit lame if the error is towards the start of the memory module as you can't use all the memory that occurs after it. A nice guy came up with a patch for the linux kernel to prevent just the physical pages that are corrupt being used called badram[2]. It does take out a whole page (4k on a typical linux i386 box) for even a bit's error, but this is a whole lot better than the xMB after the fault.

What I would like to see done is some kind of program to solve the problem on Windows 2000, and any other flavours of Windows you see fit. On linux it's relatively simple, not least because you can look at badram. With Windows 2000 you will (I assume) need to study the kernel and it's memory management in particular. Then once you understand how it allocates memory you will be able to figure out how to prevent the particular parts of memory from being accessed. Ideally you should be able to take a config file like the badram program does to specify the locations, but that is the only requirment apart from working that I would place on this task. There are obvious issues about people having different versions of kernels and the such like but I will leave that completely open ended, solving those types of problems is a whole other challenge.

It's pretty open ended since if anyone is going to do this, the results are likely to be a lot better and more interesting if originality is allowed :)

[1] http://reality.sgi.com/cbrady_denver/memtest86/
[2] http://rick.vanrein.org/linux/badram/
tsehp
05-30-2001, 01:41 AM
All the conditions are here to make a pretty good strainer on windows
To help you start with this one, I'll attach to this post the inc files for win2000 / win me, so you don't have to download the entire ddk on m$, which is 68megs :-( you need winace (www.winace.com) to decompact it.

I hope everyone here will agree with this strainer subject.


softice not showing up?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > softice not showing up?
PDA

View Full Version : softice not showing up?

some dude
05-29-2001, 08:35 PM
on win2k, tnt card. when i start softice, then hit ctrl + d... it seems it comes up, but i cannot see the black dialog?! what?!!! how can i fix this m8's?
rot8
06-02-2001, 02:54 AM
1.Use old versions of detonators, or better use drivers from manufacturer of your card.
2.Add
---------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice]
"KbdMethod"=dword:67416E5A
--------------
into registry.


Bi-Tarts have a new Transvestite "chairperson"......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Bi-Tarts have a new Transvestite "chairperson"......
PDA

View Full Version : Bi-Tarts have a new Transvestite "chairperson"......

+SplAj
05-30-2001, 03:39 AM
Hello all,

my 'friend' just told me that Bi-Tarts have a new setup and new products to play with .........TiTTY II is released and is there for D/L just for 'us' :-)

www.bit-arts.com

Jihad to go...

+SplAj }>
Kilby
05-30-2001, 03:51 AM
I want Audio Wrap <sulk>

Perhaps it won't play Steps, S Club 7 and Queen, and then I will leave it alone on grounds of good taste.

But it's STILL not available for download.

Kilby...
evil-risc
05-30-2001, 07:35 PM
just something i found annoying and un-needed ..

after installing Titanium he said 'you have to restart yoru pc - ok - cancel' .. i choose cancel and he hard rebooted me, no warning, no shutting down .. after skipping scandisk and getting back into windoze .. i run titanium shortcut on my desktop ..

omfg ! my pc has frozen !

lame ass mother fucking debugger detection code . no warning message, no clean safe exit of the process, he just locks up my pc ..

if im not mistaken, titanium is aimed towards programmers ? for a secure way for them to distribute there programs ?

do programmers use debuggers ?

now let me do the maths, and figure out how many other people are going to be REALLY ANGRY with this lameness produced by bi-tarts :/

maybe i am going crazy in my old age .. perhaps only evil crackers use debuggers, and 'programmers' can code bug free programs first compile, all the time ..

(imho) the right thing to do is a msg box, exit, and if evil cracker bypasses msgbox / exit, its his fault if he looses data / hair ...

grr

bpx test_debug_installed (f12, f12, f12 :)

the simple things that make me happy.

the simple things that make me angry ..
+SplAj
05-31-2001, 04:58 AM
eviL-R!sc

now you join the jihad ;)
+SplAj
05-31-2001, 05:13 AM
Ok big boys ,

did you slay the mutant ? (now 4 of the f*ckers, it's gettin like Quake ! ) and get to the OEiP at 0x49840C ? Lots of mutex calls now instead of TerminateProcess (they use Int2E ala ASPR, learned some new trick)

The IAT/IT is at 0x5222F8 (watch it being created and destroyed. So better stop it being destroyed then !) Search for the bytes C6,04,0F,00 and F3,AA around 628+++ and replace them with NOP(90)

There is a new anti-dump trick similar to CRC check. They use the 1st section size as a check (00073E00) compared with the value stored at raw 228004 (reverse byte order). There is a memory 'repz' whatever if the value of EDI is not 0 ;).

So change the value at 228004 to your new dumped section size (mine is F6381, so poke 81,63,0F,00 with hex editor)

Then it runs ? Of course it's still an evaluation but it loads f*ckin 100 times faster.

Thats another point to BiTarts shite. You don't need to set ANY bp
to get in. There is a 10 second window to CTL-D into the program, sniper debugging !

have phun

+SplAj }>
anon-splaj
06-27-2001, 07:20 AM
Just checked out my old fiends site to get the latest on Titty...... well they took it away again !

http://www.bit-arts.com/titanium.html

No D/L !

check out the 'corporate' info where they explain 'child like' what a reverse engineered rebuild is ;)

+SplAj
Kilby
06-27-2001, 10:20 AM
And I'm still waiting to play with their MP3 delivery system :(
Eternal Bliss
06-28-2001, 06:47 AM
ArthaXerXes (06-27-2001 06:28):
I cannot believe they sell their crap 2.5 Geforce 3...

"Crunch" the world's most secure PE compressor and encryptor...
"titanium" the ultimate secure software delivery solution...

Well, after looking at their web site, I only want to hire their webmaster.

Why do they bother to struggle ? Cannot they sense their own futility ? :-)

Well, there will always be people who trust companies that claims they are god...
8P

Regards
EB
Kilby
07-02-2001, 03:58 AM
Just goes to prove that Hydrogen is only the second most common element in the universe.

With Stupidity being the most common

Kilby...
tsehp
07-02-2001, 04:38 AM
I still don't get where the mutation engine is, r!sc, splaj and me had a cracking session on this case and all the app's we've tested we're so easy to dump and iat fix, maybe the mutant decided in a good intelligent move to destroy itself ?
Kilby
07-02-2001, 08:23 AM
Maebe the mutation involved it becoming a cast member in Deliverence.

Complete with extra fingers and webbed feet.

Kilby...
Kilby
07-04-2001, 11:49 AM
Today I have been snubbed by the Bi-Tarts

They have removed the information about their MP3 wrapper from their web site.

I can only assume that they have given up.

Possibly even because they have now employed somebody who actually knows what they are doing ?

So to cheer everybody up here is a link to their site, which as a truely heartwarming story.

h**p://w*w.bit-arts.com/fraud.html

I just hope that nobody sues them for regarding the information which they collect at registration time.

Kilby...
woodmann
07-04-2001, 03:40 PM
The fraud thing was pretty funny.
Hey, maybe the new IT guy will hire someone who can use point and click html software.
(How do you make a link work?)
I was also saddened to see the mp3 crap disappear. I so wanted to get it.

If I put a mutant engine in my truck what would happen?

Why didnt I think of making a website with obscene claims of security to make money?
WHY DAMN IT

Oh shit, I have got it!!!!!!
I have software that I developed called DISKRAPER. It will transmit user information with wireless technology. That way you dont even need a connection to the internet. It has patented CLARVOIYANT powers and can automatically detect someone thinking of commiting fraud.
Now when someone tries to install the software without the proper license, our software will instantly send really bad vibes to a software police officer in the general area.

I wonder what that dude in california did to attract so much attention that cali police would contact people in england?

Sorry for the rant, I could continue but then I might just be making stuff up.
Peace, Woodmann
Kilby
07-05-2001, 03:24 AM
I am a developer and I use Deplhi and VB, can I please buy your product.

I understand that all I have to do is press a button to meake it work so it must be good

Kilby...


Exception Handler Howto ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Exception Handler Howto ???
PDA

View Full Version : Exception Handler Howto ???

Malkocoglu
05-30-2001, 02:25 PM
I have a target that is packed with a home-made packer...
Now i defeated the Encryption part, i traced all the decryption routines and after the decryption, the code does not do more than an exception by mov[eax], eax (here eax is 0)
After this instruction, Neither TRW nor SICE cannot trace it
Maybe they do but i dont know what to do to make them trace it ?
Will you give me a hand please ?
Thanks in advance...
tsehp
05-30-2001, 02:40 PM
Malkocoglu (05-30-2001 12:25):
I have a target that is packed with a home-made packer...
Now i defeated the Encryption part, i traced all the decryption routines and after the decryption, the code does not do more than an exception by mov[eax], eax (here eax is 0)
After this instruction, Neither TRW nor SICE cannot trace it
Maybe they do but i dont know what to do to make them trace it ?
Will you give me a hand please ?
Thanks in advance...

as always, I'll invite you to document yourself on the intel's pentium docs, section interrupts and seh.

this instruction generates an int 0 , sice will not trace this, unless you set a right bpmb into the right handler.
you have to look inside the idt, to find the handler's address so you can trace it.
latigo
05-30-2001, 04:12 PM
Howdy don't know how usefull this will be to you but anyway..
Whenever a SEH handler is set, you are likely to see something like this:

PUSH OFFSET HANDLER
PUSH FS:0
MOV FS:0,ESP

Trace this program you are talking about till you get to the PUSH OFFSET HANDLER part.
This is the exception handler and that address is where the CPU will direct flow of execution after the interruption is generated.
You could BMP OFFSET HANDLER X to make sice stop there.
Those are my two centavos :)
Bye

Latigo
latigo
05-30-2001, 04:14 PM
I meant BPM instead of BMP :)

Latigo
hz
05-30-2001, 04:26 PM
its ok latigo we get the picture ^_^
Malkocoglu
05-31-2001, 01:26 PM
Ok Ok i passed it now i am going deeper...
BTW does this section map look familiar to any of you ?

.rdata RVA: 0008D000 Offset: 0008D000 Size: 00019000 Flags: C0000040
.data RVA: 000A6000 Offset: 000A6000 Size: 00008000 Flags: C0000040
_TEXTLH RVA: 000B3000 Offset: 000AE000 Size: 00001000 Flags: C0000040
_TEXT_HA RVA: 000B4000 Offset: 000AF000 Size: 00011000 Flags: C0000040
.rsrc RVA: 000C5000 Offset: 000C0000 Size: 00023000 Flags: 40000040
.protect RVA: 000E8000 Offset: 000E3000 Size: 00024000 Flags: E0000020


argh :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > argh :)
PDA

View Full Version : argh :)

Halvar
05-31-2001, 04:29 PM
Just something for those that didn't want to move to UNIX :-) --> The UNIX strainer was a lot less work than this one.

Good luck to all who want to try it. Win2k memory management is complex.

Cheers,
Halvar


The widening gap
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > The widening gap
PDA

View Full Version : The widening gap

Epic
06-01-2001, 01:22 AM
Well, i'm not sure that this post belongs here, but anyway +TSehp will take
appropriate precautions and move the post, if necessary.

I was trying to learn something from the recent "flame war". It is wise to do
so, especially if you were a part of it. Here are my humble findings:

The gap between the beginner and the experienced "software protection reverser"
is widening. Software protection schemes (SPS) were highly evolved and the
evolution is still going on.

This, makes the lifes of the beginners more difficult. Years ago, a decent
information on assembler and a couple of tools were enough for getting
rid of an SPS. Now, even intermediate reversers have troubles on deciding
what to do first with the SPS.

The minimum information level which is necessary to cope with an SPS is
increasing. This is widely known and very discouraging for the beginners.

In the history, it was more easy to choose the path of wisdom. Now it is
much more difficult. Therefore, the number of "lamers" is increasing.

This increase disturbs and discourages (also) the experienced reversers,
coders. The uneasiness spreads and makes the scene imflammable.

Another finding is the "impossibility of communication". As you may agreee,
it is not easy to communicate with a "new" person. You may share the same
socio-cultural background, same language etc. It is still difficult.

Think about the messageboards (or even e-mails). Different people with
different backgrounds, values, even different ethics. Without the aid of
face to face meeting, commmuniactions is VERY difficult (if not impossible).

The virtual means of communication is "rude" by default. You can not smile,
can not make gestures, no eye-contact etc. One must be very careful about
his wording/style in order not to be misunderstood.

These are only some humble findings. No solution proposals yet.

Kind regards.
Kilby
06-01-2001, 03:46 AM
I agree with a lot of what you have sead.

However, there are a lot of protection systems out there that are easily bypassed, provided the beginner actually reads up on the subject in the first place.

Annoyance comes from several sources but heres one which isn't covered very often

Aiming too high and not listening when being told to lower their sights

This is often a problem, for those new to the reversing.

Please excuse the example I have chosen, but it is STILL a current topic.

Ath the moment it can appear that everything is packed with asprotect.

DON'T WORRY it's not the case it just feels like that when you can't unpack it.

But the person new to unpacking just sees that he/she has to be able to unpack asprotect, it is their Holy Grail.

You just can't do that, you have to work up to it, you can't just do it by the numbers (not all the time anyway)

Learn to unwrap other packers and find out how they work.

You will still get a real buzz out unpacking them even though it's not aspr

Once you learn to unpack, the details already on the messageboard, give more than enough information, on the asprotect wrapper.

But once you can get past the basic aprotect wrapper theres a whole new world of what the author can do with the asprotect API, and it is much more fun hello s-spline, advanced directory printer and flexy, all of which have their own little tricks

So for the newer members, please don't set your sights too high.

Listen if an experienced person says to look something easier, at least consider it, they could easily have ignored your post.

If they say to read a certain tut or essay then do so, once again they could have ignored you, but they didn't. The essay may not appear relevant, if it dosn't then read it again, you probably missed somthing.

Regards,

Kilby...
Fatboy Joe
06-01-2001, 05:03 AM
It's been mentioned before, I think it's time to create it now. A well written FAQ shouldn't need to be updated frequently and will pay for itself thousands of times over :)
tsehp
06-01-2001, 01:08 PM
entirely agree with all this, all the work is needed to build on the intermediate stage, when the cracker finally understands that he uses a very usefull knowledge, but silled if only used to cracking. It's also great fun to code something, same thinking methods but more generous.

I had started a little faq, but don't have actually the time to finish it, also my english feels pretty bad
Kythen
06-02-2001, 02:17 PM
If there's any way I can help out with this FAQ, I'd be happy to do so!
tsehp
06-03-2001, 03:34 AM
woodmann told me last evening that he will take charge of this faq, watch for the related thread into general topics, he will upload his version and allow everyone to make the necessary additions/modifications.

this work will surely get better if it's team work, like rl, this place needs some rules and advices, so to be accepted they must be made by everyone here.

regards,

+Tsehp
woodmann
06-03-2001, 05:54 PM
You can find the latest version of the FAQ here:

http://208.50.16.104/Ultraboard/Public/HTML/B11/367-1.topic.html

I will keep it updated on that thread.

Peace, Woodmann


Hasp4 envelope cracking...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp4 envelope cracking...
PDA

View Full Version : Hasp4 envelope cracking...

Malkocoglu
06-01-2001, 03:34 AM
I have a target processed by Hasp4 Envelope...
"bpio -h 378" does not work , only deviceiocontrol does...
But even i crack it i have to unpack the EXE ?
Any info or XP about this ?
Below is the section map of that EXE in case it is asked...
Thanks in advance...

.rdata RVA: 0008D000 Offset: 0008D000 Size: 00019000 Flags: C0000040
.data RVA: 000A6000 Offset: 000A6000 Size: 00008000 Flags: C0000040
_TEXTLH RVA: 000B3000 Offset: 000AE000 Size: 00001000 Flags: C0000040
_TEXT_HA RVA: 000B4000 Offset: 000AF000 Size: 00011000 Flags: C0000040
.rsrc RVA: 000C5000 Offset: 000C0000 Size: 00023000 Flags: 40000040
.protect RVA: 000E8000 Offset: 000E3000 Size: 00024000 Flags: E0000020
CyberHeg
06-01-2001, 11:06 AM
Regarding breakpoints you should try FreeEnvironmentStringsA

So far I know the hasp4 envelope uses the Hasp Decode feature using the dongle to decode data from the .exe file. So unless you have the dongle or access to it it's almost a waste of time.

The best manual ever is made by Aladdin (maker of hasp) and can be found on www.hasp.com
Malkocoglu
06-01-2001, 12:58 PM
If i have the dongle can i dump it ?
What will i have to do to dump it correctly
and restore the OEP ?
Yes i did it for some simple protections
But is there something special to HASP
that i should know ?
CrackZ
06-01-2001, 01:55 PM
Just adding briefly too CyberHeg's post.

If you have the dongle : of course you can dump it, the HASP4 envelope with the dongle connected is little better than any of the PE packers out there (it doesn't need to be). I suggest you investigate IceDump's /trace switch. After dumping at OEP, most likely there will be a HASP API to contend with too.

Setting a breakpoint as you describe is pretty pointless, the HASP4 envelope has several layers of SEH and decryption, the new decodedataservice() is a block decryptor which decrypts portions of the encrypted sections in 1000h chunks, frankly it isn't worth the time you dumping these and trying to fix them up, let the envelope do all the work for you ;-).

Small Note to CyberHeg, I have some info. that might be interesting re HASP 4 ;-).

Regards

CrackZ.


Harlequin's "Protecting against TerminateProcess" - impossible to work
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Harlequin's "Protecting against TerminateProcess" - impossible to work
PDA

View Full Version : Harlequin's "Protecting against TerminateProcess" - impossible to work

DakienDX
06-01-2001, 07:05 AM
(First part, since my message is longer than 4098 bytes)

Hello everybody !

First of all, I don't want to talk about who is able to program good programs and who's not.
I haven't seen much of Harlequin so I can't judge him, this error could have happened to erverybody.

To come to the main subject of this post, you know that Harlequin tried to find a way to protect programs from being terminated by trojan horses. They use the API-function TerminateProcess() to terminate a process. This function doesn't send any warning to the application being terminated and just kills it.

Harlequin tried to fix this by injecting some code into Kernel32.dll to call an external library which asks if you wish to allow the program which tries to terminate an other one to do it.

He called GetCurrentProcessId to get the PID of the process calling TerminateProcess() and the creates a snapshop of all processes and compares the PID with them to get the path of the calling program.
This is a good idea and well implemented.

But... This isn't made at first.

At first he tries to get the path of the application to be terminated.
He does it the following way:

Term proc
Start:
mov eax,dword ptr[esp+4] ;get the PID from the stack
mov PID,eax ;and save it

and then compares the "PID" to the processes in the snapshot. But the "PID" isn't the ProcessID, it's the HANDLE of the process to be terminated, so you can't find any matches in the snapshot, because you would compare if the PID and a HANDLE are the same. If it doesn't find any match, it returns with EAX = 0. This forces the Kernel32.dll patched code to exit without terminating. This does mean two things: 1.) you can't terminate any process any longer, 2.) since the return to the calling process is made via a "ret" and not via a "ret 8" (since TerminateProcess() has two parameters on the stack), the calling process has the stack 8 bytes to low and will probably crash.

I don't know if there is a way to get the PID of a process if you have only it's HANDLE.

(Continued in the next part)
DakienDX
06-01-2001, 07:06 AM
(Last part)

But now the question: Why did it work with the example PID.EXE included in the package together with the other sources? What made Harlequin think his code works?

TerminateProcess() jumps to this code:

pushad ; save all regs - IMPORTANT (*)
push 0AFFC5F96h ; lib: HTerm.dll
call 76D4h ; LoadLibraryA
test eax,eax
je @@1
push 0AFFC5FA0h ; func: Term
push eax ; lib base
call 6DACh ; GetProcAddress
test eax,eax
je @@1
call eax ; call Term - IMPORTANT (*)
test eax,eax
jne @@2
@@1:
popad
ret ; BUG - should be "ret 8"
@@2:
popad
push esi ;replaced instruction
push edi ;replaced instruction
call 0A298h ;replaced instruction
jmp 25CBBh ;back to TerminateProcess

Remember this?

Term proc
Start:
mov eax,dword ptr[esp+4] ;get the PID from the stack

This doesn't set EAX to the value passed to TerminateProcess(), but to the value of EDI (since the PushAD) !

In the PID.EXE example program he uses this code

mov edi,[PIDStruct.th32ProcessID] ; IMPORTANT (*)
push edi
push offset format
push offset PID
call _wsprintfA
call MessageBoxA,Hinst,offset PID,offset FileName,0
call OpenProcess,PROCESS_TERMINATE,0,[PIDStruct.th32ProcessID]
mov Phand,eax
call TerminateProcess,Phand,0 ; HANDLE, ExitCode

Since EDI isn't chanced by Windows, EDI contains the PID and so it can find the path of the process to be terminated in the snapshot.

Again, I didn't want to attack Harlequin, I only wanted to tell and explain you, why his patch doesn't work as it should and so doesn't protect our firewalls from being terminated by trojan horses.
hz
06-01-2001, 12:36 PM
Hiya DakienDX,
I found it very informative, thanks.
"Again, I didn't want to attack Harlequin", I'm sure Harlequin won't
regard it as an attack, we are all here to learn, right?.
regards

Man that was a polite response, does that get me in the new "elite" forum? ;D
Lord Rhesus
06-01-2001, 01:51 PM
Harlequin's working in dark dingy foreign lands at the moment so he probably won't be able to reply. But yes your absolutely right, we can assume that when Harlequin was writing the HTerm.dll and was looking for where the handle was located on the stack he must have noted down what the handle was and searched the stack for it. At the first occurrence (which was edi's value as left from the pusha) he must have assumed that this was the handle when actually it was the value further along the stack. A simple fix for this would be to change the code in Hterm.dll from:

;---code snippet start---
;@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
; Term Exported function
;@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Term proc
Start:
mov eax,dword ptr[esp+4] ;get the PID from the stack
mov PID,eax ;and save it
;---code snippet end---

to:

;---code snippet start---
;@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
; Term Exported function
;@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Term proc
Start:
mov eax,dword ptr[esp+38h] ;get the PID from the stack
mov PID,eax ;and save it
;---code snippet end---

Well spotted DakienDX!
DakienDX
06-01-2001, 02:12 PM
Hello Lord Rhesus !

Your suggestion won't fix the problem.

mov eax,dword ptr[esp+38h] gets the parameter pushed originally on the stack to TernimateProcess(), but this is NOT the PID, but the HANDLE to the process.

A HANDLE is something like 10h,14h,18h,..., but a PID is something like FFFF5353h,FFEFA742h,FFFE8681h or similar.

I think (as far as I know) that it's impossible to get the path of a process if you have only it's HANDLE (and not it's PID) with standard API-calls.
Lord Rhesus
06-01-2001, 04:22 PM
doh! Silly me, I didn't read the post properly and I thought that the only problem was the stack push. When I posted the *fix* (be it not an actual fix as it doesn't solve the underlying problem) I only tried it using the pid program before posting. Just before checking the message board again I tried to see if it would ask when I tried to kill something in procdump (which uses terminateprocess). It didn't, all I can say is doh!
Kayaker
06-01-2001, 07:13 PM
Hi guys,

I see what you mean. It looks like the HANDLE of the current process, which is passed to TerminateProcess before term.dll is called and saved with the pushad, is being compared in Loop1 with the PID stored in the PROCESSENTRY32 structure after Process32First/Next is called. It's like comparing apples and oranges.

Start:
mov eax,dword ptr[esp+4] ;get the PID from the stack
mov PID,eax ;and save it

invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0 ;create a snapshot
mov Shnd,eax
mov eax,SIZE PIDStruct
mov PIDStruct.dwSize,eax
invoke Process32First,Shnd,offset PIDStruct
Loop1:
mov eax,dword ptr[PIDStruct.th32ProcessID]
mov edx,PID
cmp eax,edx
je FoundIt
invoke Process32Next,Shnd,offset PIDStruct
test eax,eax
jne Loop1
RET

It's in the 2nd part where the actual PID is retrieved from the calling process with GetCurrentProcessID, compared *again* with the PIDStruct.th32ProcessID value, and when a match is found in Loop2 jumps to the MessageBox giving you the option to abort the TerminateProcess.

FoundIt:
invoke lstrcpyA,offset Proc1,offset PIDStruct.szExeFile
invoke GetCurrentProcessId
mov PID,eax
invoke Process32First,Shnd,offset PIDStruct
Loop2:
mov eax,dword ptr[PIDStruct.th32ProcessID]
mov edx,PID
cmp eax,edx
je GotYa
invoke Process32Next,Shnd,offset PIDStruct
test eax,eax
jne Loop2
.
.
invoke MessageBoxA

Since the current process is always going to be the one which called TerminateProcess in kernel32.dll, I'm wondering why Loop1 is there at all. Why not just call CreateToolhelp32Snapshot, which creates a handle to the snapshot which is used by the other Toolhelp32 API's, then go through the Process32First/Process32Next routine, comparing the PIDStruct.th32ProcessID value and the GetCurrentProcessID returned PID as it does anyway in Loop2?

It just sort of looks like
Start:
mov eax,dword ptr[esp+4] ;get the PID from the stack
mov PID,eax ;and save it

and Loop1 are redundant since we know we can get the current PID (the terminating program) with GetCurrentProcessID.

Kayaker
DakienDX
06-02-2001, 03:14 AM
Hello Kayaker !

The first loop was actually meant to get the name of the program which is to be terminated.

A "C:\WINDOWS\SYSTEM\ATI32KEY.EXE wants to terminate a program. Continue ?" message would not do the thing it was meant to do.
It should do a "C:\WINDOWS\SYSTEM\ATI32KEY.EXE wants to terminate C:\Program Files\FireWallAntiVirus\FireWallAntiVirus.exe. Continue ?" message to inform the user what's going on.

Therefore the first loop was implemented, but if it fails, it exits without asking if a program is allowed to terminate a UNKNOWN program.
Harlequin
06-29-2001, 04:55 PM
Hi

First of all I need to say that if you are looking for high quality programming you will not find it in my work :-) I do not profess to be a programmer just someone who likes to play with a few bytes here and there. I have no expertise and am like many only learning as I go. My work is available only because I am prepared to make a fool of myself if it helps others in some way. Obviously my intention is to help others by sharing what I do know, but, if indeed some learn by my mistakes then thats ok too, the end result is the same :-) Whilst it is most certainly true that no matter how much you know there is always someone who knows more, the reverse is also true. As such I am a firm believer that the more information avaiable the easier it is to progress. Please forgive me if I make errors but the only sure way not to do so is to do nothing!

Secondly I would like to appologise for my delay in responding to your posts, as Lord Rhesus mentioned I have been away and have only just returned.

Ok.

The error which you point out is of course correct, I wrote this soution in a big hurry and then had to go away almost immediatly afterwards. However I also had noticed the error before I left and had made an attempt at a workaround. This I sent to +Tshep who replaced the original with the new one, as the original had only been up a few hours I did not think that anyone would have downloaded it, sorry. Download the current source code to see my changes.

You pointed out that there is no way to determine the process ID via its handle and on this I have to agree, I have not as yet managed to find a way to do this either. So I have been unable to find a hard and fast solution to the fault. What I have done is to ammend the code so that is searches through the last 40 dword values on the stack checking for a PID. This is not and ideal solution as the application which calls the TerminateProcess API may not have used this stack etc etc. It will trap more instances of the PID though and therefore more often display the name of the application which is to be terminated. The second change I made was to simply display a default message box which informs that an application is trying to Terminate another even though the name of the process to be terminated was not identified. This does work and has been working for me for some time without problem.

To be honest I am a little disappointed, I wrote this thing very quickly as one possible answer to a potential problem. It was not intended to be a final solution, I was hoping that during the time I was away mayby someone would have improved on this idea and/or bettered it. I accept that the faults you point out are valid, However I included all the source code, an explanation of what my intentions were and a full description of how kernel32.dll was injected. I intentionally did not make a patch program and sincerely believed that any one capable of implementing the changes to kernel32.dll would also be capable of altering and improving my code. Surely it would have been better to use this as an opportunity to not only point out a fault but to offer an alternative or a fix? this way others may have learnt more still, myself included :-)

Harlequin
tsehp
06-30-2001, 07:56 PM
to have a processId with it's handle :
use what kayaker says : snapshots, then you'll get into the following structure :typedef struct tagPROCESSENTRY32
{
DWORD dwSize;
DWORD cntUsage;
DWORD th32ProcessID; // this process
ULONG_PTR th32DefaultHeapID;
DWORD th32ModuleID; // associated exe
DWORD cntThreads;
DWORD th32ParentProcessID; // this process's parent process
LONG pcPriClassBase; // Base priority of process's threads
DWORD dwFlags;
CHAR szExeFile[MAX_PATH]; // Path
} PROCESSENTRY32;

so you can build a struct of processId running, then for each procId, use :
HANDLE OpenProcess(

DWORD dwDesiredAccess, // access flag
BOOL bInheritHandle, // handle inheritance flag
DWORD dwProcessId // process identifier
);

with each of processId's you have on first structure, you compare to the handle you've found on the stack and you're done.
Harlequin
07-01-2001, 08:30 PM
Hi +Tshep

Thanks for the input, if only it were that simple!
I had previously tried using OpenProcess to determine the handle of the process to be terminated however...
While OpenProcess does indeed return a handle to the process it does not return THE handle. This can be demonstrated by sequencing several OpenProcess calls one immediatly after the other. Each call returns a new, unique handle.

As I need to make a direct correlation between the handle which was orignially passed to TerminateProcess and the process ID this method will not work.

This problem is still bothering me and a solution must be possible so any input is eagerly welcomed.

About the best I have at the moment is to inject Process32Next to save the PID of the last check. This still is not a good solution as the terminating process could have done the identification checks in bulk saving all the handles and then looping through to terminate them. There are also no guarantees that the process was not found on the first pass using Process32First.

Harlequin
Fake51
07-12-2001, 01:03 PM
I think I found a working solution to the problem. If it's of any interest I can post it here, tho I haven't completed the code yet. I checked Harlequin's essay on Tsehp's mirror, but couldn't see any updates, so I figured the problem was still around.

Blue skies
Fake
Harlequin
07-12-2001, 06:24 PM
HeHe

I would love to see your solution. You are correct in thinking that I haven't found a way around it yet. I am currently looking into API hooks as an option, hoping to avoid the necessity of patching the system dlls too.

Please post your code or email me you might just be in time to stop me becoming a bald, alchoholic pill popper.

Harlequin
Fake51
07-13-2001, 06:39 AM
Well, I hope this will stop you in time, as otherwise you will end up like me, swearing, hissing, bitching at,not to forget cursing, threatening, and hating Microsoft, and their stupid company politics and/or lameass programmers.

Well, a quick sum up:
We have:
- handle to the process being terminated
We need:
- processId of process being terminated (actually just the name, but the processId is a quick way to the name)

So I started debugging windows, to figure out how to attain the goal. A good old gut feeling told me that TerminateProcess had to convert the handle given to it to something else. And after looking a bit into it, I found out that it does. The handle is turned into an address in memory that contains info about the process. If you do a "proc" when in softice, you'll see that in the first column after the name, there is a value, usually round 81xxxxxxh. This is the address of the particular process (referred to from here on as pProcess, since that's the softice name).
This pProcess is calculated from the handle given to TerminateProcess plus the equivalent pProcess for the current process. Ofcourse, this is worth more or less nothing, if it's not possible to relate the pProcess to the ProcessId. Here comes the beautiful part, the pProcess and the ProcessId are technically the same, only difference lies in an xor function. To get the ProcessId from the pProcess, you xor by a specific value, and vice versa with same value.
So, now the goals that need be attained have changed:
- Get pProcess of current process, to be able to get pProcess of process being terminated
- Get xor value needed to turn pProcess into ProcessId

Amazingly, this is actually quite easy. The handle for the process to be terminated we have. The rest we can actually get from the nice and simple GetCurrentProcessId function.
This function first pushes the pProcess of the current process onto the stack, and doesn't delete it from there (goal one achieved). Then it moves the xor value to eax, and xors eax with the stack. Thus the stack will contain the pProcess of the current process, and eax will contain the ProcessId. Xor the two and you get the xor value.
Now, in the address space of pProcess for the current process, pProcess+44h holds a pointer to an index of all the currently running processes. Add 8 to the pointer, plus the handle to the process to be terminated times two, and you get an address in the index, that holds the pProcess of the process to be terminated.
The best part of all this: this should actually be a universal way to achieve what we need, from win95 to winMe.

Now, if you'll excuse me for a minute:
MICROSOFT SUX!!!!!!!!!!!!
I spent more than eight hours debugging the system, searching the memory, analyzing the pProcess structure and stuff. All because Microsoft doesn't want you to be able to get your hands on the pProcess address (I'm lacking an api for converting the ProcessId into the pProcess in kernel32), or allow you to obtain a ProcessId for any given process. Bastards piss me off.
Sorry, steam venting.

Blue skies
Fake

Ps. I included the source of my program+the dll needed. The code to obtain the correct ProcessIds is in the dll. Do excuse the lousy coding discipline of mine, everything is a mess (which is why I wrote this lengthy and probably unnecessary and/or boring txt). Hope you find what you need tho.
Fake51
07-13-2001, 06:44 AM
Sorry for posting again, found out it didn't include the source for the dll. Here it is.

Blue skies
Fake
the analyst / ucf
07-13-2001, 07:48 AM
very nice
but :

Faketexe.asm is empty..
the dll one is ok
well, it maybe works for someone else, but not for me, so i thought it was good to note it ;)
regards,

the analyst
Fake51
07-13-2001, 09:29 AM
Thanx for noting, I'll try again.
Tho, in fact, the main program isn't of overly big importance here, and would probably just show the incredible mess a programmer can output. The hook inserted in kernel32.dll that calls the dll is almost exactly the same as Harlequins, and the rest is just a front for the program (create trayicon, check for other hooks in terminateprocess, that kinda stuff). Oh, and the program wouldn't actually work, seeing that it needs fakefix.vxd. Ah well, guess I'll include that one as well then.
Fake51
07-13-2001, 09:31 AM
And here's the VxD.

Blue skies
Fake
kill3xx
07-13-2001, 05:21 PM
hi Fake51..
u'r working in the right direction but u've made some mistakes:

--------------------------------------------------------------------------------

Now, in the address space of pProcess for the current process, pProcess+44h holds a pointer to an index of all the currently running processes. Add 8 to the pointer, plus the handle to the process to be terminated times two, and you get an address in the index, that holds the pProcess of the process to be terminated.

--------------------------------------------------------------------------------

1st pb)

as u can find f.e. in the Pietrek's book at offset 0x44 of pProcesss (actually PDB, Process Database) it stored the pointer to the process handles table.. that holds an array of structures with the infos for handles to kernel object opened by the process.. every entry has this simple struct:
DWORD Flags
LPVOID pKernelObject

pKernelObject is a pointer to the "header" of corresponding kernel object (PDB,TDB,KEvent,ecc.).. now u know that an handle is nothing less than a biased index in the process handle table..
so given a pPDB and a handle u can retrive the pointer to related kobj easely:
mov ebx,pDB
mov eax,Handle
mov edx,[ebx+eax*2+8]

so forgetting optimizations&&codingstyle this snippet is correct:

call GetCurrentProcessId
mov ecx,[esp-8]
mov edi,[ecx+44h]
mov edx,[esp+24h]
rol edx,1
mov edx,[edi+edx+8]

but (.. eheh there is alway a "but").. this indexing works only under > win98.. u can check f.e. the differences r.e. K32!OpenProcess..

win95

BFF7B6E7 ISetHandlesTableEntry proc near ; CODE XREF: sub_BFF7B728+1D25p
.text:BFF7B6E7 ; sub_BFF87477+8F25p
.text:BFF7B6E7 ; sub_BFF87477+E325p
.text:BFF7B6E7 ; sub_BFF93D55+E225p
.text:BFF7B6E7
.text:BFF7B6E7 pPDB = dword ptr 8
.text:BFF7B6E7 HandleEntry = dword ptr 0Ch
.text:BFF7B6E7 pK32Obj = dword ptr 10h
.text:BFF7B6E7 Flags = dword ptr 14h
.text:BFF7B6E7
.text:BFF7B6E7 push esi
.text:BFF7B6E8 mov eax, dword_BFFBC2A0
.text:BFF7B6ED mov esi, [esp+HandleEntry]
.text:BFF7B6F1 push eax
.text:BFF7B6F2 call KERNEL32_97
.text:BFF7B6F7 mov eax, [esp+pPDB]
.text:BFF7B6FB mov edx, [esp+pK32Obj]
.text:BFF7B6FF push edx
.text:BFF7B700 mov ecx, [eax+44h] ; // PDB.ProcessHandlesTable
.text:BFF7B703 mov [ecx+esi*8+8], edx ; // HandleEntry.pK32Object = pPDB
.text:BFF7B707 mov ecx, [eax+44h]
.text:BFF7B70A mov eax, [esp+Flags]
.text:BFF7B70E mov [ecx+esi*8+4], eax ; // HandleEntry.dwFlags = flags
.text:BFF7B712 call IIncrK32ObjRefCount ; increment kernel object reference count
> ....
.text:BFF7B725 ISetHandlesTableEntry endp ;

win98 or above
.text:BFF7DAB3 ISetHandlesTableEntry proc near ; CODE XREF: sub_BFF7DB02+1D25p
.text:BFF7DAB3 ; sub_BFF89AE0+8925p
.text:BFF7DAB3 ; sub_BFF89AE0+DE25p
.text:BFF7DAB3 ; sub_BFF9594C+E525p
.text:BFF7DAB3
.text:BFF7DAB3 pPDB = dword ptr 8
.text:BFF7DAB3 HandleEntry = dword ptr 0Ch
.text:BFF7DAB3 pK32Object = dword ptr 10h
.text:BFF7DAB3 Flags = dword ptr 14h
.text:BFF7DAB3
> ....
.text:BFF7DAB8 mov esi, [ebp+HandleEntry]
.text:BFF7DABB mov edi, esi
.text:BFF7DABD cmp esi, 0FFFFFFFFh
.text:BFF7DAC0 jz short loc_BFF7DAC7
.text:BFF7DAC2 mov edi, esi
.text:BFF7DAC4 shr edi, 2 ; // scale index
> ....
.text:BFF7DACD call KERNEL32_97
.text:BFF7DAD2 mov eax, [ebp+pPDB]
.text:BFF7DAD5 mov edx, [ebp+pK32Object]
.text:BFF7DAD8 push edx
.text:BFF7DAD9 mov ecx, [eax+44h] ; // PDB.ProcessHandlesTable
.text:BFF7DADC mov [ecx+edi*8+8], edx ; // HandleEntry.pK32Object = pPDB
.text:BFF7DAE0 mov ecx, [eax+44h]
.text:BFF7DAE3 mov eax, [ebp+Flags]
.text:BFF7DAE6 mov [ecx+edi*8+4], eax ; // HandleEntry.dwFlags = flags
.text:BF

so the handles biasing (scale) factor is changed under win98 (among other changes)... so u've to add the win95 case tu ur code.. a good idea is to make ur decision based on the different value of PDB.Type (0x5 win95 , > win98 0x6)..
if u want to see some of above considerations in action i suggest u to download the Elicz RTx lib:
he has exploited (hi Elicz! ..really cleaver idea indeed.. damn it was so obvious ;) a internal kernel32 function to "emulate" remote threads but u can find the code for adjusting a process handle table entry too..

2nd pb)
u've assumed that the process handle is alway at index 0x1.. well call it safe programming but a little bit of paranoia is welcome here... so i suggest u to add some safety checks and if the ptr doesnt mach a table scanner =P

As usual : all credits to Matt Pietrek & sorry for my crappy english...

Best regards,

kill3xx
Fake51
07-14-2001, 12:35 PM
Hi

Cheers for the info, didn't have the opportunity to check the prog on win95, only win98.
Anyway, thing works on my win, and I wasn't gonna release the program as such, just figured I'd post my solution to the problem if anybody could use it.

Blue skies
Fake
Harlequin
07-15-2001, 08:08 PM
Hi Fake51

Thanks for the info I suffered a major crash at the hands of MS over the weekend and am in the process of re-formatting and rebuilding. Believe me there are few curses you could use for MS that I did not think of late sat night when i was sitting burning candles, inserting floppies and trying to remember everything i have forgotten about dos.

So i am here on a one legged system that could freeze any second just to let you know that I am not being ignorant by not getting back to you and will take a look at your code just as soon as I am stable again.

I don't know though, does it run on linux?? :-)

I have never been so tempted before.

Harlequin
Fake51
07-18-2001, 10:50 AM
The best way of protecting yourself against Windows failing on you? Go Linux. Lol. Anyway, hope you can use it. With the info added by Kill3xx it should be possible to make a win95/98/ME general protection against the misuse of Terminateprocess.

Blue skies
Fake
DakienDX
07-21-2001, 04:46 AM
Hello everybody !

I started this topic, but went four weeks to Spain right after opening it.
Sorry for that.
I haven't read all the replies in detail, but I'll do it in the next days. And continue working on the topic.


WinCE cracking..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WinCE cracking..
PDA

View Full Version : WinCE cracking..

goatass
06-02-2001, 10:14 AM
Hey everybody, do you guys know of any WinCE cracking tutorials, tools, etc. ?

goatass
TBD
06-02-2001, 01:58 PM
tools: IDA Pro 4.04 for iPAQ stuph, works
on others too ...

most (all?) CE programs are jnz badguy ...
easy to crack

TBD
Kythen
06-02-2001, 02:09 PM
Hey goat :)

I don't know of any tuts offhand, but I did find some info on MS's site.
http://www.microsoft.com/windows/embedded/ce/guide/processors/all.asp -> lists all supported processors
http://developerstore.com/devstore/product.asp?productID=7568&store=TOOLBOX_NA -> order form for eval version of the development kit for CE
(includes a debugger)
BTW... find me on IRC or icq sometime!
goatass
06-02-2001, 06:14 PM
Thank alot guys....

Kythen my friend, long time....I'll have to find you on IRC...chatch you later bro.

goatass
latigo
06-03-2001, 05:39 PM
Hey goatass..
There is stuff about WinCE cracking out there..
Remember Ghiri's strainer a couple of years ago?
Well, he wrote some stuff about WinCE reversing..
I'll check my hd and let you know.
Bye now!

Latigo
latigo
06-03-2001, 06:11 PM
Hello mate!
i've just returned from a long journey into my Hd..
and guess what?
I found a bunch of stuff that can be considered collector's items nowadays since Ghiribizzo's page has been down for quite a long time.
I once had downloaded all of +Ghiri's site and now i'm the happy owner of his leet stuff :)
Not only that, but i found lots of info about coding and developing on the CE platform.
All this stuff was downloaded a couple of years ago, this means that there must be some more updated stuff. But as starters, this is more than what you need.
The whole package is about 40 megabytes. If we chop down the devel stuff we get a 1 or 2 megs weight.
What should i do? mail? ftp?
You tell me.
Bye goatass.

Latigo

Pd: my mail is latigo_at_ciudad_dot_com_dot_ar
Kilby
06-04-2001, 03:27 AM
I only have once CE target behind me, but I will mention the sole difficulty I had (apart from the normal wierdness I seem to suffer).

That was getting info on the Hitachi SH3 processor found in the HP Jordanas.

It's all well and good being able to dissassemble it with IDa, but WTF is the hex representation of the change I want to make

Apart from that it went pretty much like any normal Win32 target.

If somebody wants to cover the Win CE scene, i reccomend getting some processor documentation online first.

Kilby...
goatass
06-04-2001, 02:42 PM
hey guys thanks for the help, Killby I have the HP Jornada 548 and I'm trying to learn to crack/code programs for it. I'll look around for some info on processors and post them for people to check out.

Latigo I will e-mail you now and I'll put up my personal ftp server for you to dump it on there and if you don't mind I'll post it for others to check out. Only with your permission that is :)

thanks
goatass
Simimi
06-04-2001, 04:00 PM
Ever tried a searcg at fravia+ namazu search engine for ipaq? You may discover nice stuph, eh...

http://www.searchlores.org/cgi-bin/search?query=

Dark essays?


Safedisc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Safedisc
PDA

View Full Version : Safedisc

Fake51
06-02-2001, 12:32 PM
I'm having a problem with Safedisc. The encrypted file I'm working on is Thief 2: The Metal Age. Thing I'm trying to do is unwrap main executable, seeing that I have the game installed from original cd.
The problem lies in fixing the imports: they are ofcourse rerouted to Dplayerx.dll. From what I've read about Safedisc, the reroute normally works something like:
- push # of Api function to call
- push # of import module, i.e. 0 or 1 (as it only reroutes calls to kernel32 and user32
- call main dll routine.
- return with address of Api function
- jump to function

The version I'm working does the first three steps, but instead of returning with the address of the api, it jumps from inside the call. This is ofcourse not a problem, but when I looked inside the routine I found that the Api chosen by the routine didn't depend solely on the function # passed to the routine. It also depends on where the call to the Api came from.
Which leads to the real problem: calls from the main exe can go thru the same reroute, but result in different Api calls (which they do). Thus, trying to use something like Import Reconstructor on the import table will result in the program crashing (I'm guessing the same would happen with Revirgin, but I haven't been able to try since the darn thing doesn't work on my machine - don't know why).
Anybody tried this version of safedisc or had a go at Thief 2? Suggestions would be appreciated. Right now I'm figuring that I'll probably have to rip the code out of Dplayerx.dll and then insert it into the main exe, but if there's an easier way i'd love to go there instead.

Cheers
Fake
tsehp
06-03-2001, 09:33 AM
rv should work on win98, win_me, and 2000.
the last version manages to rebuild safedisc's imports, they are mangled. one iat entry can lead to several api's, but rv takes care of this by reassining the calls to the right iat's.
Fake51
06-06-2001, 09:44 AM
Well, first off Revirgin doesn't work on my version of win98. I found that the problem lies in a part of the code, that tries to locate some code in a VxD. Searching for the code that Revirgin does gave me a position in vwin32.vxd, but seeing that I don't have any actual source of revirgin, I'm not sure that that's what Revirgin is looking for (altho my guess would be yes). Revirgin cant't locate this code, coz it starts searching at 0c0290000h, and the code is located at 0c0283d7ah under my version of windows. Fixing Revirgins code searcher made the tracer load, but so far it's just hung on me when I've tried to use it (which is the reason why I'm not sure i found the correct location in mem for revirgin).

Anywho, guess I'll try and dl the latest version of Revirgin and see if it'll fix my safedisc. I'm almost thru unwrapping it, only the hard labour part (ripping data out and inserting it) left.
Btw. how does revirgin fix the problem of one iat leading to several different api's? I'm just going with ripping out the code that figures the right api to choose and then inserting it somewhere. Any other method?

Fake
Fake51
06-07-2001, 07:26 AM
Tried the latest Revirgin - doesn't have the same problem of loading the tracer. Seems nice.

Cheers
Fake
madmax
06-07-2001, 02:36 PM
I've been working on softice inline patching for safedisc like r2's essay describes for vbox 4.5...It seems to be the same for safedisc, but the memory is protected using virtualprotect...You can easily intercept it and change params to leave read_write...I was considering a more universal option in which an inline patch would call an external general routine and create a imports.txt like Rv/importrec generate...Thus, it could be imported and modified further for the tricky APIS. This seems more useful and more practical as crashing is a prob with inline patching =)
lemme know what u guys think of such an idea!

madmax
tsehp
06-07-2001, 02:39 PM
tell me if it manages to fix your problem.
I've tested on 5 different sd2 programs, but it still can evoluate...who knows ;-)
ThrawN
06-11-2001, 10:52 PM
Thankyou dude, your information has been more than usefull. I wasnt sure entirly about unwraping sd2 but what you said made things suddenly a lot clearly ;). Hope i can unwrap this red alert2 now
Fake51
06-12-2001, 04:19 AM
Cheers for the info

well, at least to some degree you're right, Thief 2 is a mighty fun game. Was interesting unpacking it too, tho, never delved much into unpacking. The version of Safedisc on Thief 2 is basically a laff, if you ask me. As soon as I ripped the important code out of the general api reroute, it was easy to figger out what was going on, and then just put in some code of my own.
Anywho, thanx for taking the time to give as much info as you did. You considered wrapping that info up as an essay and dropping it on tsehp's mirror?

Blue skies
- Fake
ThrawN
06-14-2001, 10:16 PM
Im having problems with myst3. Iv extracted the loader and the dplayerx.dll but the loader is aparently not a valid win32 program. Is there a special particular method for extracting these files?
ThrawN
06-16-2001, 06:00 AM
Yes im not entirly sure what dll is what. Iv sorted out the loader for sure. But the names are all shown as what apears as ramdom names?
not dll's either tmp files that are dll's renamed :)


unpacking nonexecutable files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > unpacking nonexecutable files
PDA

View Full Version : unpacking nonexecutable files

qferret
06-02-2001, 03:32 PM
I have a file packed with upx .84 (version doesn't support unpacking) Is there a tool available that can unpack files other than .exe's and .com's? (tried to dump process with Procdump, no dice)

If I try manually.....it's an activeX control...would breaking on LoadLibrary and then proceeding with "normal" UPX procedure work?

gonna play with it, but if anyone has any suggestions, insight, it would save some of my diminishing hair LOL
Kayaker
06-03-2001, 12:33 AM
Hi ?ferret,

How about putting a CC at the OEP of the ocx and setting a bpint3, change the code back with the 'a' command, and as you say, unpack upx as usual?

I've done this on Neolite packed dll's and it's worked well. Never tried it on an ocx though.

Kayaker
qferret
06-03-2001, 10:06 PM
thanks for the tip Kayaker....now I just need to find the CRC check LOL....this guy went all out.

I haven't run across any SoftIce tricks yet, but when I change the opcode at the PEP to CC and run the program even if all I do is use the a command to replace the original byte and then cntrl-d out of Sice.....program crashes. I think it's reading from the file itself, not the copy in memory (for a CRC)...if I'm way off base, kick me in the head, I'm just speculating at this point ;-)

well, back to my tracing.

btw....what VB6 API is used to load an .ocx? ...then I wouldn't have to patch to break ;-)
Ryan
06-04-2001, 02:49 AM
Hehe,
didn't I say it is fun and tricky? I have been trying to get you guys to try it. Million thanks to you qferret. Hope you crack it, that will mean it sucks and I won't charge users money next time. :)

Thanks again
Ryan
noname
06-04-2001, 11:19 AM
qferret (06-03-2001 20:06):
thanks for the tip Kayaker....now I just need to find the CRC check LOL....this guy went all out.

I haven't run across any SoftIce tricks yet, but when I change the opcode at the PEP to CC and run the program even if all I do is use the a command to replace the original byte and then cntrl-d out of Sice.....program crashes. I think it's reading from the file itself, not the copy in memory (for a CRC)...if I'm way off base, kick me in the head, I'm just speculating at this point ;-)

well, back to my tracing.

btw....what VB6 API is used to load an .ocx? ...then I wouldn't have to patch to break ;-)

Hey ?ferret,
my way is to add a line in winice.dat
exp=c:\thename\the.ocx

Then reboot your windows and load the exe again
the next thing is set a break point in the memory on the ocx entrypoint.
bpm xxxxx x
you will able to break in the ocx ;=)
theres a exitprocess api which close the exe strange ... :D

noname
qferret
06-04-2001, 11:54 PM
OK, quick update b4 I go to bed and slip into a 4 1/2 hour coma ;-)

I finally found where to dump. Took a while today.

1.) I suck at unpacking

2.) My PC has decided it hates SoftIce after more than 5 minutes or so of debugging

Kinda cool though, I used to have to shut down for an hour or so, b4 I could get it to boot w/o an exception in VMM (01) ....now I'm running a dual boot....W98 won't let me in, I boot into W2k & let it "check the drive for consistencey" ;-) ....then I can reboot into W98 & all is well, until I debug anything for more than 5 minutes again LOL.

anyway...I found the spot....ProcDump still won't let me dump the process though.....could I get someone to explain in plain terms how to dump using IceDump? (I suck worse at deciphering commandline style examples w/ the brackets & shit than I do at unpacking LOL)

I' ll try to figure it out tomorrow afternoon, but I'll accept any help offered ;-)

Look out Ryan, here I come hehe
qferret
06-05-2001, 12:00 AM
btw...I finally found the end of the routine when I quit pissin around & figured out how to use /tracex w/ /option t L

(BIG thx to the IceDump team....btw, the CD player & tetris are cool, even if I can't stay in Softice long enough to enjoy them LOL)
Kayaker
06-05-2001, 01:24 AM
Hi ?ferret,

Strange problem you've got there with SI crapping out on you after 5 minutes. You got a temperature monitor on your CPU or something that goes apeshit if it's not getting feedback while in SI?

Anyway, for what it's worth, I usually do raw dumps with Icedumps /DUMP command, rather than using /PEDUMP, because I like to have the Raw Offsets and Sizes of the sections in the dumped file match up with those of the Virtual image I just dumped from. Addresses as seen in W32Dasm or SI directly match up with the offsets in a hex editor, and it's easy to find the IAT and other sections. Not such a big deal if you know a /PEDUMP will produce a working exe, but if the Import table is mucked up I just find it easier to work with this way. After making any necessary changes with a hex editor you can always rebuild the PE file to get rid of excess padding and reduce its size.

I usually start by noting the Size of Image of the file with PEditor, then when I find the OEP and the place to dump use
/DUMP [image base] [image size] [c:\filename]

[image base] is usually 400000 for exe files, but for your dll would be 10000000 I guess. [image size] is the size you saw with PEditor.

Then you need to change the OEP and code characteristics of the 1st section to E0000020 (usually). And most importantly, use the dumpfixer option of PEditor to make the ROff=VOff and RSize=VSize. If everything went well this last step will now show the icon of the file properly. If the Imports look good you're laughing. If not, you need Revirgin ;)

A basic /PEDUMP would be
/PEDUMP [image base] [OEP] [c:\filename]
where [OEP] is a Relative value without the image base added. i.e. if you find the OEP is 401234 then you use 1234 here.

Hope this helps,

Kayaker
CoDe_InSiDe
06-05-2001, 02:03 AM
Hi Kayaker,

"You got a temperature monitor on your CPU or something that goes apeshit if it's not getting feedback while in SI?"

This message doesn't really below to this subject but I'M having this damn problem ;)
I can't stay in SoftICE very long (or in Games ;) )
You know any solution for that problem, or anyone else?
Thanks in Advantage.

Cya...

CoDe_InSiDe
Kayaker
06-05-2001, 02:36 AM
Hi Code_Inside,

Heh, bit of a digression here, eh? Maybe we should move it you know where.

I had this problem when I got my new 600 and started blasting in Quake (hard level, god mode, BFG cheat manic attack frenzy) :)

Computer shut down with sort of an "Are you Nuts?" immediacy to it. I bumped up the upper temp shutoff limit in BIOS by 5 or 10 degress and it was OK.

There's always installing extra fans, getting a better CPU heatsink, or "painting" your existing one with some kind of heat-dissipating goo (forget the name of it). Not sure why mild-mannered SoftIce would have this effect though.

Kayaker
Ryan
06-05-2001, 03:46 AM
qferret (06-04-2001 21:54):
OK, quick update b4 I go to bed and slip into a 4 1/2 hour coma ;-)

I finally found where to dump. Took a while today.

1.) I suck at unpacking

2.) My PC has decided it hates SoftIce after more than 5 minutes or so of debugging

Kinda cool though, I used to have to shut down for an hour or so, b4 I could get it to boot w/o an exception in VMM (01) ....now I'm running a dual boot....W98 won't let me in, I boot into W2k & let it "check the drive for consistencey" ;-) ....then I can reboot into W98 & all is well, until I debug anything for more than 5 minutes again LOL.

anyway...I found the spot....ProcDump still won't let me dump the process though.....could I get someone to explain in plain terms how to dump using IceDump? (I suck worse at deciphering commandline style examples w/ the brackets & shit than I do at unpacking LOL)

I' ll try to figure it out tomorrow afternoon, but I'll accept any help offered ;-)

Look out Ryan, here I come hehe

Hey,
congrats on unpacking it. Well, the packing using UPX is just to make it lame. :) The interesting stuff is after you unpacked it. I promise you more sleepless nights like what I had when I coded it. ;)

I am sure someone will be able to crack it someday. hehe

Thanks for your interest again.
Ryan
PS. Treat it like a crack me.
Ryan
06-05-2001, 03:51 AM
I forgot... Be sure to try the lastest version (26th May) and not a previous one. :)
www.rtsoftware.org

Thanks
Ryan
qferret
06-05-2001, 10:05 PM
Sometimes I make more work for myself than I have to LOL

/dump worked beautifully w/o any PE mods necessary ;-) ...now the real fun begins hehe

umm....ryan, no offense, but please don't tell me which ver of your software to crack ;-)

the one I'm workin on is a couple of weeks older than that...but I'm not doing this to help you make $ (yes I know that it is [up to this point] freeware). I'm doing it to challenge myself (besides, once I figure this ver out, it's just a matter of figuring out the updates, unless you do a complete revamp)
Ryan
06-06-2001, 04:17 AM
qferret (06-05-2001 20:05):
Sometimes I make more work for myself than I have to LOL

/dump worked beautifully w/o any PE mods necessary ;-) ...now the real fun begins hehe

umm....ryan, no offense, but please don't tell me which ver of your software to crack ;-)

the one I'm workin on is a couple of weeks older than that...but I'm not doing this to help you make $ (yes I know that it is [up to this point] freeware). I'm doing it to challenge myself (besides, once I figure this ver out, it's just a matter of figuring out the updates, unless you do a complete revamp)

Hi,
believe it or not, I am writing softwares so that I have things to put on my CV and not for the money. In fact, I work in a totally different environment which is more technophobic than any others. :) Back to the software writing point of view, well, making money from it is in the lower priority. Besides, I will be writing totally different types of software soon and it will be for students assisting in their revisions. You will know when I release them. :)

The difference between the newer version and the older version... well, there is more things that will make your life more difficult (with a few interesting tricks), with a few bugs repair and I believe better way of coding. ;) Promise you there will not be an update in the next two weeks or so because I have run out of ideas at the moment. :)

Thanks again
Ryan
NchantA
06-06-2001, 11:10 AM
hiya qferret ;)
ltns

yo also to ryan hehe

qferret, i was reading above and noticed that you keep say 'procdump wont work' with it. i too have noticed this before, procdump refuses to dump a .dll attatched to a process, no matter what u do ;)

for a work around use PEEditor or equivelant from protools or suddendischarge, it should dump .ocx/.dll fine ( a nice tool )

icedump is imho the best way around it (yay for /pedump)

peace

NchantA


What is going on with this simple cmp ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What is going on with this simple cmp ?
PDA

View Full Version : What is going on with this simple cmp ?

__DuDu__
06-03-2001, 07:54 PM
cmp byte_404678, '-'

thats how i saw in iDA then i did in sice 'd 404678' the real serial showed up "643729674" my problem is: I cant figure what part of 643729674 is being cmp'ed with '-' so i cant add the '-' and continue debugging :/

tnx
__DuDu__
Rage9
06-03-2001, 09:46 PM
quite simply:
cmp byte_404678, '-'

is nothing more then compare one byte at memory location 404678 to the character '-' not too hard to understand.

-brad
mo k
06-03-2001, 11:05 PM
it is comparing the 6 to a '-'.


On average, are softwares hard to crack?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > On average, are softwares hard to crack?
PDA

View Full Version : On average, are softwares hard to crack?

An Eyewitness
06-03-2001, 08:06 PM
Ok, my story so far. I made ages ago a program call crackTest.exe. It's a simple dialog box. If you type 5 in it it say Good passwd, if you type anything else it say wrong passwd. It was a toy to test if I would some day be able to crack it and say good passwd all the time. I haven't gave any attention to cracking since months now but last friday for fun I try that crackTest again and, to my surprise, I cracked it.

So I went and tested my strenght on Spinner Plus. With surprising ease I managed to stop its skin modification detection mecanism. And later I tried L0phtCrack 3.0 and succeeded too, and then mIRC 5.71 and with some help I managed to register it.

I was surprised by the simplicity of those softwares. I'm definitely a newbie cracker. It took me a while yesterday to figure out what test eax, eax could be. And I only know some of the most common commands of VC++ debugger (the debugger I used). So I'm asking, on average, are softwares hard to crack? How many of them have sophisticated anti-cracking protection? And what about games? I'm just wondering what I should be expecting.
qferret
06-03-2001, 09:25 PM
For the most part, software protections are getting more sophisticated than they used to be....not that they're much harder, just more complex.

The basic rule off thumb has always been.....The more $$$ the company wants for their software, the lamer the protection will be ;-)

Much of this is because large companies buy licenses for commercial protections, while individuals program their own. Figure out how to beat the commercial protection, you got all proggies using it, until they update.

Many programs have weak protections and the authors don't care. The app itself has no limitations anyway. Simply register on the honor system. Examples would be WinZip and mIrc. They both have nag screens that pop up, but that's the only difference between registered and unregistered versions.

So, I guess the answer to your question is.......no, if you know the basics and use your head, and the resources available to you.
Rage9
06-03-2001, 09:49 PM
i would say no, some people just take no time to protect there software, yes expecialy big componeys cuz they feel that even if we do break threw any kind of encryption there are still plenty of people out there buying the stuff, so on average the less expencive most likely the easyer to crack, but not always.

-brad
tsehp
06-04-2001, 01:13 PM
and its entirely normal, its just a market point of view, very simple.
take newsrover for example, the soft is cheap, I made a crack for it at every version and every time they add more and more checks (actually 25-30 points to patch)
the soft costs about 30$ but they only have a few for them to survive, so they better have a good protection for it.

In the opposite, some big software companies, pretending that they invented a new *mutant* technology, work on their protection system for several months and give us a challenge resolved in 5 minutes ;-)

so there are no pre build rules for this, but if you search for something hard to crack, just to improve your analysing skills and cracking experience, just look at the biggest threads here, you'll find the applications that entertained us the most.

regards,

+Tsehp
madmax
06-04-2001, 03:19 PM
I was most involved with mass cracking back in 96-98, and the routines then were usually simple...A CRC was not common, and patches were easy...But the popularity of the net and open access to cracks led authors to become more aggressive (Bpftp for example)...Some put nasty tricks, deleting c:\windows\*.* and shit if tampering was detected...Now keygens seem to be preferred, as it shows more skill (mostly persistence)...I still wonder why ppl keygen progs only to have it change in 3 days w/new release heh...Anyways, lately the trend has been to forget protection and just use packers...Thus, someone with mediocre unpacking skills (or an unpacker) and newbie cracking skills can get far...The good news is most of the big programs are still easy, as they have a huge customer base and cannot change keys every week...Just my two cents!

madmax


Awave studio 7.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Awave studio 7.0
PDA

View Full Version : Awave studio 7.0

()whore
06-04-2001, 01:30 AM
Hello,
Well I will try my luck here since I found no takers in the newbie messageboard. I am posting about a program (Awave studio 7.0), I thought I unpacked and cracked but I have been fooled. While the program would work ok dumped and patched I did more testing and found it would crash when saveing files.
The heart of the problem is a redirected api call (GetProcAddress). In the packed .exe this call was directed to a section in the packing code

005ce1e8 push ebp
... mov ebp,esp
... mov edx,[ebp+0c]
... mov eax,[ebp+08]
... cmp eax,[005db348] ; mem=ffffffff
... jnz 005d3a0e
... mov eax,[edx*4+005db348] ; gets pointer to decryption code
... jmp 005d3a1e
005d3a0e push edx
... push eax
... call kernel32!GetProcAddress
005da1e pop ebp
... ret 0008

This code checked if -1 was pushed if so then return a pointer to some decrpytion code (005cb4bc) in eax else just go ahead with the api.
I have a working IAT thanks to revirgin but that call it wouldn't resolve. I manualy pointed this call to GetProcAddress and that seamed to work. However at one place the program needs the pointer returned from the original (unpacked program) function to decrypt the save file code.

push 04
push ffff
call [4b3...]
move esi,eax
...
...
call esi

I had it patched to skip this check and it didn't seams to be needed untill I tried the save functions.
I could work around this by patching the address to the save file decryption at the right place but in the dumped version there is NOTHING in memory where the decryption routine should be. While in the packed .exe there is code.
I am guessing that somewhere in the packed .exe the code is writen to that location and that my dumped version never runs the unpakcing code so no code gets placed there.
How can I get around this? It seams devlish that even though the program is unpacked and dumped fine it is still useing code from the unpacker. Please help give me some pointers if you can. I am several days on this and running out of steam.

Well I spent today trying to inline patch the program so I wouldn't have to deal with the missing code. I was able to change the oiep and get it to patch the program but the crc check is kicking in. I can skip this check while in SI to see that it works but I can't seam to get around this either, at least not without SI. I can't patch the jump because it is packed code. I have been following Predetors tute on this program but my version is packed with a differnt version of Asprotect. The CRC isn't hardcoded into the .exe like in his tute. Neither was the oeip (it was xor with another number wich was in .exe)

can someone give me some pointers here. I feel I am close to finishing this but can't seam to get over the last hill.
Thanks.
()whore
Kilby
06-04-2001, 05:08 AM
Ok,

You are working through this weeks version of asprotect, or by the time you read this yesterdays version :)

First thing I suggest that you do is d/l asprotect, and read through the documentation.

Asprotect is more than just a wrapper, you can use aspr to further encrypt sections of code within an app, and decrypt it through the asprotect code.

A recent one I have found is to remove api calls from the IT, and use these calls via the asprotect code.

This meant fixing the IT by hand, and also injecting code from the asprotect wrapper back into the exe (where I assume it had originally been).

I could have created these calls but getprocaddress had been mysteriously removed from the IT :(

What you will have to do is trace the code in the 'original' asprotected target, and see what happens.

You may be lucky and find it jumps back into the .exe

If not then it's a case of finding a suitably sized hole to place the NEW code into.

If I have time tonight I will have a look at it (but real life will probably get in the way)

Kilby...
()whore
06-04-2001, 01:51 PM
Thanks for the tips. I will dl asprotect and read through it. Will also try dumping the part of asprotect code that is getting called form my .exe and patching it into my dump. I think that will work.
peace,
()whore

Real life is allways getting in the way. :)
madmax
06-04-2001, 03:10 PM
How ironic this thread is, I was just about to post the same findings from new Advanced PDF Password Recovery Pro (www.elcomsoft.com)...It appears that ASPR decrypts certain pieces of the programs code through this GetProcAddress reroute...It first checks for ASPR by PUSH 0 / PUSH FF / Call getprocaddr....this will return 0 unless hooked, which returns the PTR to an ASPR decrpytion routine (i assume)...I fear this routine may require a valid key, as its always tied to the registration functions =( Anyways, even if you fake everything it will cause an exception...I'm going to explore this further as well, but it'd be nice to have registered sample heh =)

madmax


How Can I Use Thunk For Reading Sectors From CD-ROM?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How Can I Use Thunk For Reading Sectors From CD-ROM?
PDA

View Full Version : How Can I Use Thunk For Reading Sectors From CD-ROM?

SmallBoy
06-04-2001, 03:20 AM
After I Recieving Many Information About Reading Sectors From CD-ROM, I Want To Write A Dll And Make A 16Bits Dll But I Can't Connect It To A 32Bits Dll Because Of Low Information On Thunk In 32Bits Dlls.

Please Help Me If You Have Any Information About Reading Sectors From CD-ROM/ASPI Programming/Thunk Scripting

Most Regards
SmallBoy3000
kill3xx
06-04-2001, 04:58 PM
SmallBoy (06-04-2001 01:20):
After I Recieving Many Information About Reading Sectors From CD-ROM, I Want To Write A Dll And Make A 16Bits Dll But I Can't Connect It To A 32Bits Dll Because Of Low Information On Thunk In 32Bits Dlls.

Please Help Me If You Have Any Information About Reading Sectors From CD-ROM/ASPI Programming/Thunk Scripting

Most Regards
SmallBoy3000

U've to use QT_Thunk directly plus some under-documented api :

Load/FreeLibrary16, GetProcAddress16, MapSL/LS, ecc.. there are some articles out there (DDJ,WDJ, Pietrek/Schulman and from other non m$ sources), and some examples (ElicZ site f.e.) so i suggest u to spend a few minuts digging with google ;)

Best Regards,

Kill3xx

p.s. u can read CD sectors ala Bleem via K32!VxDCall0 too
Smallboy3000
06-05-2001, 01:37 PM
Please Help Me On K32!VxDCall0
kill3xx
06-06-2001, 10:53 AM
VxDCall0 (better VxDCall0@0/@32,it's prototyped as WINAPI and expects
the service id/number as 1st param) is the undoc, but well known ;),
kernel32 internal API to invoke win32 VxD services (for more infos
get/read Pietrek/Schulman books or play with sIce/TRW2k);
it's exported by kernel32.dll, win9x ver only ofcoz, by ordinal 0x01.

The method of reading cd-rom sectors is not too different from the
one u know (btw i'm guessing u've read the MSDN art. which use
the thunk compiler):
among others win32 vxd services exported by VWIN32.VXD there's
Int31_Dispatch (serv# 0x2a0029) that u can guess reflects
a request down to DMPI host:
IIRC Bleem!,or at least the ver i've played with, read raw sectors
using DPMI_Simulate_Real_Int( 0x2f + AX = 0x1510 + cmd code = 0x80);
naturally the buffers must be allocated with GlobalDosAlloc
and the ptr passed as RM address

Best regards,

kill3xx
Smallboy3000
06-06-2001, 03:14 PM
Hi,
Please Help Me/Give Me Any Way/Sources About To Create Dll By Using Thunk Script.

Most Regards
SmallBoy3000
IcyDee
06-08-2001, 02:16 AM
Bear in mind that thunking will not work on W2000, only W9X and ME.

An alternative would be to use the ASPI interface which would work on all W9X and ME platforms and on W2000 (if ASPI is installed) or you could use the SPTI on W2000/NT


winCE stuph
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > winCE stuph
PDA

View Full Version : winCE stuph

TBD
06-05-2001, 05:50 AM
i was asked by fravia to write an essay
about CE platforms and StrongARM specific

thou i have no time yet (busy with my
thesis) i want to start right away ...

if anyone wants to help or to exchange
info, you know, mail me

TBD

ps. email at tbd (at) usa (dot) net


RE : /me asks stupid mem allocation question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > RE : /me asks stupid mem allocation question
PDA

View Full Version : RE : /me asks stupid mem allocation question

kill3xx
06-05-2001, 10:28 AM
Hi +Tsehp,

...quoting by hand (donno why u've locked the msg =)

a big dilemna; I need to allocate some mem above the 0x7fffffff wall on win9x to
write a global "fault" handler.
I have two choices :
1-the vmm services way : _pageAllocate, etc... and I'm too lazy to take this a first choice
2-the api way, so here's my question : is there a way to allocate + have a handle to allocate such mem, even if I normally should use some ring0 code for those purposes.

1) using the undocumented VirtualAlloc 0x80000000 flag
#define MEM_SHARED_ARENA 0x80000000
PVOID pt = VirtualAlloc( 0, 0x1000, MEM_COMMIT + MEM_SHARED_ARENA,
PAGE_READWRITE );

2) using MMF - win9x MM map the pages for a MMF to the shared arena - side effect: a MMF lays _always_ at
the same linear address in _all_ memory contexts despite the process map it or not

HANDLE hFileMap = CreateFileMapping( INVALID_HANDLE_VALUE, 0,
PAGE_READWRITE, 0, 0x1000, 0 );
if ( hFileMapping )
{
PVOID pt = MapViewOfFile(hFileMapping, FILE_MAP_WRITE, 0, 0, 0x1000);
}

3) more esotic :
emulating kernel32 behaviour using (via K32!ORD_1) the VMM win32 vxd services
_PageReserve(PR_SHARED) and _PageCommit (PC_USER + PC_WRITEABLE)

Best Regards,

kill3xx
tsehp
06-07-2001, 02:11 AM
thanks for your reply, the msg was locked by error, I just tried to delete it, now its done.
I only used a mappedfile to have this, auto made in high mem.

thanks for the other interesting tricks.
tsehp
06-07-2001, 07:18 AM
btw,
if someone knows an easy solution for this :
I'm writing a small asm program that is called from any process running in win9x, so it's copied inside this mappedfile I have, just above the 7fffffff limit.
But I need to access a variable that was previously declared in the code that copied this small code into the mappedfile, this variable resides in low mem, but when the code is copied into the mappedfile, the variable can't be accessed anymore if the code is called from another process. So I'm just looking for a way to have a variable that directly resides in high mem and declared in c++, not assembly.
tia

+Tsehp


vbox 4.5 tut some problem with iat fixing proc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > vbox 4.5 tut some problem with iat fixing proc
PDA

View Full Version : vbox 4.5 tut some problem with iat fixing proc

LaptoniC
06-06-2001, 05:10 AM
I am trying to follow new tut about vbx 4.5.Everything is ok untill this iat fix proc.

017F:0700ED95 MOV [EBX],EAX ; moving it to its place in the iat
017F:0700ED97 ADD EBX,04

I have tried to enter mov [ebx],eax in softice but it allways change to mov [ebx],ax.I have assembled this proc with masm and now another problem comes.
cmp eax,000 turns to 83F800 which is 3 bytes.
how ever in original proc it is 4 bytes long.

Thanks.
JimmyClif
06-06-2001, 06:08 AM
I may be not much of a help with VBox but here are my ramblings:

>I have tried to enter mov [ebx],eax in softice but it allways change to mov [ebx],ax
did you write?: mov dword ptr [ebx],eax

>cmp eax,000 turns to 83F800 which is 3 bytes.
>how ever in original proc it is 4 bytes long.
Most people try to save bytes... you try to have more? *g*
Fill in a nop if you really want to give away this space... it does the same anyway.
PS: test eax,eax is only 2 bytes ;) and does the same too.
Kilby
06-06-2001, 07:51 AM
Something in the back of my head says you should specify that it's a double word, when assembling in softice.

Kilby...
LaptoniC
06-06-2001, 04:34 PM
I have tried using dword and it worked.I have dumped this proc to a file and I have tried to load it by icedump load command each time I have tried.I have tried 5 times and every time Vbox gives error at
017F:0700EDFE CALL 0700EE15
and it dies at this call.It doesnt fix the iat.What am I doing wrong.I have done exactly like this.
Found oep bmp oep x.I have traced it the first api call getversion which points to call 0700EDDB to I have wrote a 700ed91 and put proc here.When I am at 700EDDB I have changed ebx to 80f000.I have looked what is at ebx by dd ebx and then wrote e ebp+4 xxxx which is dword at ebx.However it gives two error and never comes to bpx I have put on 700edc3.
What I am doing wrong here ?Any help will be appreciated.
tsehp
06-07-2001, 02:35 PM
I wrote droid, for him to read this thread and eventually update the essay if necessary.
I'm trying this app with rv ;-)

later
tsehp
06-08-2001, 02:14 PM
still no news from droid.

I used revirgin to fix this one, and it just made it, just as easily as previous vbox versions...;-) Lol Lol Lol

Just read the revisited essay, I added all the info that I paste here for you on win2k
oep 5b002f
iat start 407000
len d10

use the auto section+it paste on the dumped target and this will work fine, btw I absolutely didn't found any traces of mangled scheme inside the new vbox 4.5, I'd also like to know what is really new inside ;-)

If there's nothing new more than the 5 instead of 3, we'll just have to consider all what we said on this thread as useless and switch back to the good old vbox 4.3 essays, waiting for something new to be done.

best regards,

+Tsehp

ps:here are the it.bin + resolved iat for the most lazy of you
LaptoniC
06-08-2001, 05:17 PM
I have pasted your it to my dumped xmetal but it didnt worked.My mouse turns to busy state and then program dies only way to close it by ctrl+al+del.What can be wrong ? I have used SV's it includer. I cant use revirgin to paste iat because when I was working with iris 3.1 I have forwarded my clock and opened xmetal accidentaly it is already expired.Sorry for asking so much question but I am trying to learn unpacking
tsehp
06-09-2001, 01:42 AM
My it is working on win2000, hope you didn't made it on win9x ;-)

How do you expect revirgin to work if xmetal21 is not working ?
Sorry but you have to learn to reset the vbox 4.5, read the previous essays concerning this on vbox 4.3, publish here what you've found and I could help you

regards

tsehp
LaptoniC
06-09-2001, 01:44 PM
I have Xmetal 2.0.3.099
I have found entrypoint same as in essay 5B4865. I have dumped it I have put 5B4865-400000=001B4865 I have pasted your it with Sv's program and it desnt work.I have tried thison both win2k and win98 se
hz
06-09-2001, 03:30 PM
hiya,
may be way off base here but did you remember after you added the new section to go to directory and change iat pointer to point to new section. Just a thought (rare) as I have forgot to do a couple of times.
regards
r2r2
06-09-2001, 06:00 PM
laptonic: read the part that follows the inline patch, you'll see it'll never bpx at the intended address, that doesnt mean the work isnt done..

tsehp: you're probably 100% right =)
i'm gonna check how to unpack this program with revirgin in w9x. (i didnt try to, initially)
be sure i'll mail/post results there and update/(remove if useless, tho maybe it can help writing a universal unwrapper?) my tut in consequence.

thanks for your comments,
r2
tsehp
06-10-2001, 10:02 AM
laptonic : learn to reverse is the goal of this mb, not learn to insert the it.bin file I provided you to compare with attemps/results...

r2: it should also work on win9x; I didn't tried because on vbox the revirgin's tracer is unstable, you can do it but 5 iat by 5, and save your work every time you trace more, when all the traced is complete,save the text file, then resolve with fix sections checked and rv will auto update your dumped target, add the section and fix the pe.

Actually I'm finishing the new tracer (5 times faster, much more stable, works in ring0) so I don't have the time to try it on win9x because I'm finishing writing some int handlers for the tracer. But tell me your results/problems and I'll help you.

regards,

+Tsehp
madmax
06-10-2001, 02:49 PM
I was wondering whether the builtin BHRAMA function of PEDUMP/ICEDUMP should be utilized in such a case...I know a sample vbox plugin still works for 4.3, so 4.5 cant be much different =)
Nothing against RV/imprec (these 2 are lifesavers!) but it might be good to explore plugin coding as a 2nd option...With a working plugin, PEDUMP alone will suffice...Ive not become familar with writing such plugins, but it seems interesting..Plus, you could actually release the plugin and be famous =) (safedisc 2 100% working would be nice!)

madmax!
tsehp
06-10-2001, 06:47 PM
Yes, interesting, but following this option you assume that the plugin is protection and version dependant, and open read to everyone, meaning less work for the protectionnists to make them fail. Sad but true, imho one of the reasons that this place is just the tip of the iceberg.

That's why I choosed another way, build an app, without releasing the source, and maybe in the future (with the help of reversers addicted to it) adding some code's obfuscation, but actually the level of attempts to make the tool fail makes this not worth the case.
r2r2
07-08-2001, 11:49 AM
just to let you know i'm going to update my tut very soon (now that im on holidays..), because a few details/mistakes were left.

also i really had troubles fixing the iat with revirgin (not an uptodate version), and i'm going to retry with rv 1.10 build9 asap.

thanks for your interest.
hobferret
07-25-2002, 10:03 AM
Hi r2r2 did you get anywhere with this I got a prob with 0040f780 if i trace into it it goes to peekmessagea and interlocked increment but none of these work. just wndered if you or somone else had any ideas - this is on w98 not 2000. I am jst doing it for sumthing to do in spare time but it is bugin me cos i cant fix it.
hobferret
07-27-2002, 10:12 AM
Hiya I managed to work it out. It wasnt the IA @ 80f780 which was PeekMessageA but another @ 80f74c which was GetMessageA - revirgin told it was InterlockedIncrement. 4 these who are interested I found it by settings a bpm xxxx:0080f74c r and eventualy ended up in the vboxt.dll which gave me the correct call. Ope this is of som interest to sombody out there!
haec_est
08-05-2002, 06:56 PM
these two api are often (always ?) redirected in a different
way, at least in v*ox 4.5+ ...

thi was ripped from mm fir*eworks...

0008:0700eb50 e819000000 call 0700eb6e
0008:0700eb55 ff742410 push dword ptr [esp+10]
0008:0700eb59 ff742410 push dword ptr [esp+10]
0008:0700eb5d ff742410 push dword ptr [esp+10]
0008:0700eb61 ff742410 push dword ptr [esp+10]
0008:0700eb65 ff158cc30407 call [USER32!GetMessageA]
0008:0700eb6b c21000 ret 0010

so rv trace command, will follow the 'call 0700eb6e' but
it call others api so rv will be confused...

0008:0700eb6e 56 push esi
0008:0700eb6f bed0a30507 mov esi,0705a3d0
0008:0700eb74 56 push esi
0008:0700eb75 ff150cc20407 call [KERNEL32!InterlockedIncrement]
0008:0700eb7b 833dd0a3050764 cmp dword ptr [0705a3d0],64
0008:0700eb82 751b jnz 0700eb9f
0008:0700eb84 e85449ffff call 070034dd
0008:0700eb89 85c0 test eax,eax
0008:0700eb8b 74f7 jz 0700eb84
0008:0700eb8d e8da9fffff call 07008b6c
0008:0700eb92 85c0 test eax,eax
0008:0700eb94 74ee jz 0700eb84
0008:0700eb96 6a00 push 00
0008:0700eb98 56 push esi
0008:0700eb99 ff1508c20407 call [KERNEL32!InterlockedExchange]
0008:0700eb9f 5e pop esi
0008:0700eba0 c3 ret

the same for PeekMessageA :

001b:0700ebbf 55 push ebp
001b:0700ebc0 8bec mov ebp,esp
001b:0700ebc2 e8a7ffffff call 0700eb6e
001b:0700ebc7 ff7518 push dword ptr [ebp+18]
001b:0700ebca ff7514 push dword ptr [ebp+14]
001b:0700ebcd ff7510 push dword ptr [ebp+10]
001b:0700ebd0 ff750c push dword ptr [ebp+0c]
001b:0700ebd3 ff7508 push dword ptr [ebp+08]
001b:0700ebd6 ff15d4c30407 call [USER32!PeekMessageA]
001b:0700ebdc 5d pop ebp
001b:0700ebdd c21400 ret 0014

these seems to be the only api redirected in this way, so
if your v*oxed proggy import apis from user32.dll check
twice rv generated iat :)


some proxies ip
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > some proxies ip
PDA

View Full Version : some proxies ip

SadWolf
06-06-2001, 04:54 PM
Hi,everyone.

Our government adopts a ip-limited access policy. So I can't
access some website, such as fraviaMB.cjb.net and
www.safeweb.com and so on. I want to access everywhere
with no limit. Could you give me some proxies ip?
Thanks in advance.

Best regards,
SadWolf
vgb
06-06-2001, 05:54 PM
SadWolf (06-06-2001 14:54):
Hi,everyone.

Our government adopts a ip-limited access policy. So I can't
access some website, such as fraviaMB.cjb.net and
www.safeweb.com and so on. I want to access everywhere
with no limit. Could you give me some proxies ip?
Thanks in advance.

Best regards,
SadWolf

Try this -

http://tools.rosinstrument.com/proxy/proxies.htm
SadWolf
06-06-2001, 06:00 PM
Try this -

http://tools.rosinstrument.com/proxy/proxies.htm[/quote]

I tried it, but I can't login
woodmann
06-06-2001, 06:17 PM
This is a clean ip. It does not reveal itself as a proxy, yet it is anonymous.

208.57.0.100:80

It should work in every situation ie: accessing Delphi forums. (they block proxy servers)

email me when that proxy dies, I will get you a fresh one.

Peace, Woodmann
SadWolf
06-08-2001, 01:00 AM
woodmann (06-06-2001 16:17):
This is a clean ip. It does not reveal itself as a proxy, yet it is anonymous.

208.57.0.100:80

It should work in every situation ie: accessing Delphi forums. (they block proxy servers)

email me when that proxy dies, I will get you a fresh one.

Peace, Woodmann

Thanks a lot!
ThrawN
06-16-2001, 07:12 AM
Thanks for sharing. I think its finaly stoped though. I cannot view pages now outside some local list they have.
DO you have another simular proxy?

Thanks
Solomon
06-16-2001, 08:01 AM
find more proxies here:
w*w.multiproxy.org
woodmann
06-16-2001, 04:35 PM
Heres a new "clean" one
211.61.251.247:8080
spookey
12-29-2002, 01:44 AM
What exactly makes a proxy “clean” other than the fact that it doesn’t identify itself as a proxy, and it doesn’t show your actual IP address?

I’ve been to many sites that post lists of anonymous and “elite” proxys, but have also read about proxys set up by different agencies to collect information about the persons using them.

I can't see a good way to actually check these connections, other than for speed and availability.

Any thoughts or suggestions?

Thanks
Woodmann
12-29-2002, 03:30 AM
Howdy,

Your understanding of a "clean" proxy is correct.
I dont use the "rosin instrument" site any more because
what they list as anonymous are not. "Multi proxy" has a more
accurate list and also shows the country to make it even easier
to pick a proxy.

As far as logging proxy requests for the purpose of gathering
information, I suppose in some of the more restrictive country's this may be true but, I think it is not feasible to actually look at each request then look at the site they requested.

Most proxy's are open because someone was to lazy to make sure such ports are closed. Once someone notices all the traffic
going through the server and figure out its the proxy port that is open, they then get closed. This is most likely why proxy's close in a matter of days.

About the only way to check whos proxy you are using is to run the ip address through a "Whois" database and see what it returns. If the address looks "funky" then dont use it.

Peace, Woodmann


Nice Update
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Nice Update
PDA

View Full Version : Nice Update

Perry
06-06-2001, 07:28 PM
Hi CrackZ,
Very nice update of your site.

Regards.
Perry.


Hasp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp
PDA

View Full Version : Hasp

shymu
06-07-2001, 07:54 PM
I'm working on a hasp protected program ( MC 7.2 ) . I have the hasp.
I changed the trial dates and get an error " sim not initialized " does anyone know
what this means and how to fix this. I read Crackz tuts on hasp but I'm stuck on what
to do by having the hasp. MC 7.2 uses hasp 70.exe .I know this is easy but I'm stuck.
I thought by having the hasp, passwords and changing the expiring date etc I would be OK.
Anyway how do I initialize the hasp ?
CrackZ
06-08-2001, 12:28 AM
Hiya.

OK, I apologise in advance, but I'm going to be harsh (I've already posted on the flames / humor forum in general response to this).

I'm sorry to say it seems apparent you did not seek to do any HASP research, like reading the HASP manuals which describes all of the HASP services in concise assembly language right down to the registers the parameters to hasp() are in.

Had you read the manuals and my document quite closely you would have discovered the only HASP that reads memory from the HASP dongle in MC is service 32h or ReadBlock(), had you read further you would know that only 2 types of block read are performed, had you read further still you would know which parts of that buffer control the time expiry, had you then read the HASP API guide and been slightly familiar with ASM you would perhaps know how to emulate this functionality.

Sorry, this is really harsh, but I don't believe you've done the required groundwork and this go's also for Sami's post on the Sentinel target (see the newbies forum, thanks +Tsehp for moving it there ;-) ).

Regards (and please take note of what I have said, note I've still provided you with the answer).

CrackZ.
none
06-08-2001, 04:31 PM
GEE,....Just wanted to play with the hasp and had a question on an error message I overlooked in doc's I read .

By the way,.. patching all that code is a crude way to go. The program runs fine without a hasp or patching. ( hint : redirection ) Impossible you say, think again.

I have not run up against any program that was not a breeze,.. including what I see currently discussed now. If you bothered to look Crackz you may have noticed I haven't posted but a few times. When I do post a question it is stupid,..... I sometimes go blank at the obvious.

I wanted to share my knowledge and answer posts, but fear flaming. That and the fact my writing skills are poor,... You see CrackZ we all can't be gifted like you.

Your best talent though was judging me.

NOTE : this took me 45 min to write,................ but you knew that !!
tsehp
06-08-2001, 04:50 PM
Keep cool all of you, we're just trying to make here some simple guidelines, written now inside the new faq :
people get sometimes bashed on those forums, just because they did not made the minimum work : search the docs, essays (5000 here now !) everything and link what you've found to the precise question that you want to ask.

So the guy that brings you all the document needed to work on your projects can answer you fast and precisely.

And if people here find those questions as *easy level*, they will just be put on newbie's forum.

I'm sure you will all agree with this, otherwise we'll write a new faq ;-)
CrackZ
06-08-2001, 11:14 PM
Hiya, /me places his diplomatic hat on.

OK, the reasons I was harsh with you.

1. Your error message is inside a disassembled listing of hasp70.exe in the clear, very easily cross referenced and easily understood (if you read the HASP guide or patched or whatever). I'm not clear even now whether you are actually claiming to have read the manuals.

2. If your cryptic hint to how you achieved something without a HASP or patching is meant to demonstrate how crude my suggestions are, I wonder somewhat about the wisdom of 1.

3. On this messageboard of 558 or whatever it is members I would dearly love to know everyone, dearly love to select their profiles, dearly love to know their level of expertise.....see where this is going, I don't have time to read and monitor and file and collate and internally digest every single post made my every single individual on 5 message boards.

4. Yes, I apologise for judging you, I am entirely prepared to accept your message board skills may not be indicative of your real life ones, thats why I wrote at the top it would be harsh, I'm fully prepared to accept my infallability of human nature, that I judge people by their posts.

+Tsehp, I'm not angry and I don't think your poster here is, just justifying what I think is pretty reasonable ;-).

To the poster : Once again, this isn't a flame, lets consider it good experience in diplomacy for both of us.

Regards

CrackZ.


CrypKEY
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CrypKEY
PDA

View Full Version : CrypKEY

Duelist
06-08-2001, 07:53 AM
Hello everyone!

Nice to be with you guys.

I'm doing some investigation on the newest CrypKEY, and I was hoping someone could provide me some links to apps protected with it (preferably 5.5.x or 5.6.x).

Hope this post isn't out of the theme/spirit of this board. Thank you all, and please e-mail/post some links if you can.

Duelist / keelis@hushmail.com
Kythen
06-11-2001, 03:19 PM
Well, I managed to find one app in a quick search. Based on this page:
http://www.lindseysoftware.com/WebUpdates/webupdates.htm
it would appear this company uses Crypkey 5.6. Website includes a demo request form. There is a link to a Crypkey setup.exe as well

HTH

Kythen


Question about FlexLM license
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Question about FlexLM license
PDA

View Full Version : Question about FlexLM license

skew
06-08-2001, 10:20 AM
I have C compiler for mips cpu.
The name is Diab C compiler.

I tried to generate a license data file.
At last, I generator a good working license data file.

But...
I have two versions of that compiler.
v4.1a and v4.3f

v4.1a use lmgr325c.dll and v4.3f use lmgr326b.dll
I successfully generate license file for v4.1a with FlexLM SDK 6.1f
But I failed generate license file for v4.1a with FlexLM SDK 5.12b

I don't understand why I fail.

could you know about this?

thanks.

ps:
Can I upload test environment ?
(sample c code, batch file for compile, minimizied c compiler)
It is small. (966,590 bytes)

My company bought this compiler.
So, I have real license file.
Kythen
06-08-2001, 12:06 PM
There is a special number in each major FlexLM version (ie, 5.12, 6.x, 7.0, etc.). In order to make licenses for older FlexLM versions, you have to patch in the correct number in your license generator. There is an essay that tells you exactly how to do in on Tsehp's main site.

HTH!

Kythen
skew
06-08-2001, 07:55 PM
Oh, I'm sorry.

my essay was something wrong. (misstyping. :()

I successfully generate license file for v4.3f with FlexLM SDK 6.1f
But I failed generate license file for v4.1a with FlexLM SDK 5.12b

v4.1a use lmgr325c.dll
and I work with FlexLM SDK 5.12b.

I don't understand why I fail.

thanks
tom_324
06-09-2001, 08:51 AM
FlexLM license is depending upon seeds only, so you can generate 5.12 license with 6.1 SDK. Just check lmcrypt. Hint : lmcrypt -verfmt

Tom


Where can find VB4+ p-code format ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Where can find VB4+ p-code format ?
PDA

View Full Version : Where can find VB4+ p-code format ?

smith
06-08-2001, 11:56 AM
Please, tell me, where i can find decription
of Visual Basic 4+ p-code format and
decsription of Virtaul Mashine ?


Environment space in Windows Me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Environment space in Windows Me
PDA

View Full Version : Environment space in Windows Me

[KSC]
06-11-2001, 12:09 AM
Hi all,
Recently I'm having problem with the environment space in Windows Me. When my PATH setting is up to a certain length, it seems that a vxd prompts me that it's out of environment space when I just get in to windows (then the system will hang). In win98 or previous windows, I can add a line SHELL=C:\WINDOWS\COMMAND.COM /E:2048 in config.sys to fix it, yet it does not work anymore in Me, is there anyone can help?
Thanks
tsehp
06-11-2001, 04:42 PM
well usually I do the opposite, but this thread was moved from general topics to general rce ;-) thanks if someone knows a reply.
Anticode
06-13-2001, 04:51 PM
I'm not sure about this but it worth a try:
checkout registry key
HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\SessionManager\Environment\ConfigEnvSize

Anticode.


Awave Studio 7.3 - AsProtect unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Awave Studio 7.3 - AsProtect unpacking
PDA

View Full Version : Awave Studio 7.3 - AsProtect unpacking

Instructor
06-13-2001, 01:16 PM
Hi, I want to manual unpack 'Awave Studio v7.3' (www.fmjsoft.com)
I found the OEP at 4B3A3C (B3A3C) and made a dump with icedump,
then I fixed the dump with PE-Editor and added a new section.

My problem is to find the jump table, I found this:

4B06D0 jmp d [4BF4E4]
4B06D6 jmp d [4BF4E8]
4B06DC jmp d [4BF4EC]

goto 4BF4E4 and scroll up and found this place for the IAT Start:
4BF000. I'm not sure, if this the right IAT Start and I not found
the IAT End, can anyone help me?

thx instructor
SpeKKeL
06-13-2001, 03:11 PM
Yep,

Think you're right >> beginning at bf000 ;length of IAT 51c,Try to resolve the
unresolved ........

SpeKKeL
Instructor
06-13-2001, 11:49 PM
Hi Spekkel,
thanx for the first, but how you get the IAT lenght
of 51C? In 'Predators' tutorial he wrote about nine '00'. In 'Awave' are many areas with '00'.

cu inst
Kayaker
06-14-2001, 01:07 PM
Hi Instructor,

What I usually do to find the IAT start with Asprotect is check the address in EDI *immediately* on breaking into the Import decryption routine during unpacking (a GetProcAddress call, F12 a few times to find the loop). The first Import that goes through the routine isn't always exactly at the start of the IAT, but usually it is.

To find the IAT endpoint, once you've broken out of the Import routine loop, *immediately* check the value in EDX, I've found that this always contains the last IAT address that was processed.

With most Asprotect versions, I've found this checking of EDI/EDX addresses to work in almost all cases to delineate the IAT. (Can't check right now, but I *think* I've got the registers edi and edx right)

Other than that, you can usually make a good guess where the IAT endpoint is anyway. Each dll, or group of Imports in a dll that may be listed more than once, is terminated in the IAT by a 00000000 as you mentioned. In earlier versions of Asp, there may have been several groups of 00's between dll's, but the latest versions seem to have given up on this ruse.

It's just a matter of recognizing the final Import address, which usually seems to be a resolved one, so look for the last BFFxxxxx or 7xxxxxxx and you've got your length.

Kayaker
Instructor
06-16-2001, 02:23 PM
After work with Revirgin's Resolver and Again Resolver some entrys are empty, what must I do
with this:

awave.exe
01F8
index IAT_address value hint module function
--- -------- -------- ---- -------- --------

58 000BF0F4 00D0C864 0000 ?????? ??????

62 000BF104 00D0C86C 0000 ?????? ??????

83 000BF158 00D0C834 0000 ?????? ??????
84 000BF15C 00D0C85C 0000 ?????? ??????

130 000BF214 00D0C468 0000 ?????? to_Resolve

141 000BF240 00D0C818 0000 ?????? to_Resolve

161 000BF29C 00D0C898 0000 ?????? ??????

314 000BF510 BF231007 0000 ?????? to_Resolve
315 000BF514 BF231007 0000 ?????? to_Resolve
316 000BF518 BF231007 0000 ?????? to_Resolve
317 000BF51C BF231007 0000 ?????? to_Resolve

I work with Tracer and Resolve again, but it doesn't work.

thx for your help
tsehp
06-16-2001, 07:03 PM
again I will encourage people to do a little searches before asking those questions :
use the messageboard search feature and use some searches related to revirgin:
the entries you names are alexey's last little tricks, this will be fixed when I'll finish the new tracer, they are not serious enough to engage a new revirgin dev.
this was exactly the same case than numerous ones before, read the splaj related thread about those entries :
for example :
1-some are mov eax,[xxxxxx]
ret

easy to guess->kind of check if asprotect is still present, emulates some single api's that just bring back some single mem values, if this entry is real used, find the value it gets and hard-code it into your dumped target

2-other entries are :
1-code blah blah
2-jz not going to
3-getprocaddress
4-code blah blah

so just replace all this with getprocaddress and it will work fine.

to ease some work, just fix the iat that are really used, you'll see that half of them are really necessary. email for further help.

regards,

+Tsehp
Exocist
07-11-2001, 05:05 AM
hi you top blokes :D

I only joined up today, I have spent the best part of my day learning the techniques found in this forums text and felt confident enough to practice on BeatCreator, packed with ASProtect 1.2 I think...

I'm posting in this thread for 2 reasons, 1) I also have a intrest in Awave Studio 7.3 and have got to the same problems with unresolved API's 2) I am also at the same place with BeatCreator too :)

now... I have managed to use the tracer to resolve one of the 'unresolved' apis to GetProcAddress, heres the current IAT I have: (attached)

IAT Start RVA: 9D000
IAT Length : 72C

now... being a newbie here I have been going thru pages looking for the thread you mentioned tsehp but the search function only allows me to search thru the last 30 days, I wondered if this thread was mentioned some while ago, I would love to read it. I've had a taste and now I want more :D

I've always found asprotect to be the thorn in my side, I would love to be able to defeat it. Today is the first day I have used icedump and revirgin, both tools are awesome, thanks a lot!

@ Instructor

did you manage to defeat Awave Studio 7.3? I wrote a process patcher for it, the crack is only 3 byte changes, if you intrested
let me know... I would love your knowledge on unpacking Awave if you have succeeded :)

thanks again guys :D

-Ex ;)
splaj
07-11-2001, 06:04 AM
Hajo

heer wee goo ;)

method of attack RV v ASPr
=====================

Set BPX GetVersion
start target. SI pops. f12 and scroll up the code window.
You will see a cluster of GetWhatWeNeed APIs.

WRITE DOWN THE FIXED MEMORY ADDRESS that EAX is saved eg

0187:00F5C7DA E82D7CFFFF CALL KERNEL32!GetModuleHandleA
0187:00F5C7DF A3D435F600 MOV [00F635D4],EAX
0187:00F5C7E4 E83B7CFFFF CALL KERNEL32!GetVersion
0187:00F5C7E9 A3D835F600 MOV [00F635D8],EAX
0187:00F5C7EE 68E435F600 PUSH 00F635E4
0187:00F5C7F3 E8347CFFFF CALL KERNEL32!GetVersionExA
0187:00F5C7F8 E8DF7BFFFF CALL KERNEL32!GetCurrentProcess
0187:00F5C7FD A3DC35F600 MOV [00F635DC],EAX
0187:00F5C802 E8DD7BFFFF CALL KERNEL32!GetCurrentProcessId
0187:00F5C807 A3E035F600 MOV [00F635E0],EAX
0187:00F5C80C E8C37BFFFF CALL KERNEL32!GetCommandLineA
0187:00F5C811 A37836F600 MOV [00F63678],EAX

F5

Run RV get your IT traced as much as possible.
WRITE DOWN THOSE MISSING APIS ADDRESS like :-
A0C8FC =>
A0C8C4 =>
etc etc

Close target.

Load target again with same BPX GetVersion

SI pops.

Now unassemble those missing API address you wrote down in RV.. like U A0C8FC, look at the code/API ;) U A0C8C4 etc etc

See some link to the same memory location stored by the GETWhatWeWant API cluster !!! Link them in to RV. EXP the repquired API to get the dll memory location. (eg EXP GETVERSION will show you its memptr)

Now PROBABLY 2 of these API will be code like PUSH EBP, blah POP EBP ,RET004
You only need the C20400 RET004 (actually KERNEL32!ORD_2F is RET004)

manually fix resolved.txt and rebuild the exe. Then you have some more phun :-) confused ?

+SplAj
Exocist
07-11-2001, 03:30 PM
thanx +SplAj

I will start from there and see how things go :) thanks a lot ;)

-Ex ;)
Exocist
07-11-2001, 05:31 PM
he he, damn this is fun :)

I have rebuilt my import table (BeatCreator) and added the following entries:

GetCommandLineA
GetVersion
GetCurrentProcess

and 2 entries (as you already knew!) to the KERNEL32!ORD_2F , both of these were together. and... as you obviously already know, I run the proggie , I have placed a BPX on my Getxxxxxxx entries above jut to make sure they are OK and they are, now I have to determine the cause of my crashing,

what else should I know? :)

BTW, Awave is packed in ASProtect 1.3, the API cluster approach you mentioned above appears to have changed as the EAX values seem to point to unintialised memory?? I probe into that more to make sure I'm not talking crap :) heheh

-Ex ;)
Exocist
07-12-2001, 01:42 AM
well... now I am stumped :)

i actually got the program to run by bypassing a CALL location, a 'trial version for blah blah..." dialog comes up as it should but then the program dies with ExitProcess()

whats more, the CALL i bypass contains a pointer to a memory location that should contain the application path ie:

C:\PROGRAM FILES\ZERO-X\ZERO-X BEATCREATOR\ZEROX_BC.EXE

my dumped version points the correct memory location at the same CALL but the text above is not present, some pointers within the dumped .exe must still be out of alignment....

i need some help if anyone is reading... I feel so close to getting this right :/

thanks,

-Ex ;)
Exocist
07-12-2001, 02:03 AM
BTW,

if anyone is intrested I have upped the proggie (in it's original state) to [www.filesanywhere.com] along with my IT.TXT & IT.BIN

login: zeroxbc
pass: unpack

thanks again,

-Ex ;)
Exocist
07-12-2001, 03:39 AM
hmmm, I found out that my pointer is fine, the problem is in the CALL to:

208 0009D34C BFF676CF 0195 KERNEL32.dll GetModuleFileNameA

from my dumped.exe, it comes back from this CALL with EAX=0 which is not good, consequently it isn't updating the program memory with the C:\PROGRAM FILES\ blah blah mentioned above.

I have done a compare with the packed .exe registers and the unpacked registers at the time of the CALL, they are all fine...

the packed .exe jumps back into asprotect and from there calls GetModuleFileNameA

016F:00A25234 SUB EDX, EDX
016F:00A25236 PUSH BFF92366
016F:00A2523B PUSH DWORD PTR FS: [EDX]
016F:00A2523E MOV FS: [EDX], ESP
016F:00A25241 JMP BFF676DC

damn I'm getting lost now, sorry for all the posts, I'm just hoping some of you have experienced what I am talking about, it would be nice to know that I have dumped and rebuilt the .exe alright and all I need now are some adjustments to make it work??!?

-Ex ;)
frUstrAted_SplAj
07-15-2001, 07:24 AM
Hi Ex

can't get your rar file since Thursday (f*xkin filesanywhere needs nukin, even got my own splaj account and still no f*xkin files come back out, tried all methods, copy your files to me , OK but still bombs out part d/l, even e-mail gets me zilch....so sorrry FUCK ahh thats better)

Anyway finally d/l awave7.3 (sooooo slow) and I can confirm my GetVersion hint still works. All 6 GetWotIWant API's cluster are there eventually, you must get back to ASPR code with F12 )

+SplAj
Exocist
07-15-2001, 09:32 PM
hey +SplAj

thanks for the efforts m8, cool to know about Awave 7.3, I will take a closer look, sounds like patience is the key to that one :) it's crazy considering the crack for it is only 3 bytes he he

i have coded a process patcher for zero-x beatcreator, i found during the unpacking process it jumps into the 401000 - 500000 range twice and bangs some bytes into the programs location, this appears to be the perfect time to apply the patches without getting the 'protection error 15' crap.

still, I would love to learn how to unpack this thing properly, I know it would boost my skill levels considerably if I can see the whole project thru, if you still intrested, where can I place the files so you can grab them and take a look?

thanks man.

-Ex ;)
splaj
07-16-2001, 03:31 AM
+splaj@y-a+h+o-o.c-o-m

...without any +- ;)
Exocist
07-18-2001, 11:36 PM
just saying a big thanks to +Splaj :D thanks man, you have helped me incredibly :)

-Ex ;)
Instructor
07-20-2001, 12:13 AM
Thanx to all, who posted in this topic.
But some questions are open for me.

Last results:
I used the new Revirgin v.1.11 Build 17

awave.exe
01F8
index IAT_address value hint module function
===========================================================================

58 000BF0F4 BFF84936 15B KERNEL32!GetCurrentProcessId

62 000BF104 BFF8C5AC 149 KERNEL32!GetCommandLineA

83 000BF158 BFF92DFC 1DC KERNEL32!GetVersion

84 000BF15C BFF9622C 15A KERNEL32!GetCurrentProcess

130 000BF214 00D0C468 0000

141 000BF240 00D0C818 0000

161 000BF29C 00D0C898 0000

============================================================================

If I right click on 130 / 000BF214 / 00D0C468 / 0000 and then 'Enable trace' / 'Tracer' it shows me the following adress:

BFF76DAC

Addr:BFF76DAC Ord: 419 (01A3h) Name: GetProcAddress (search the adress in WDasm)

Must I insert this in Revirgin or the 'Ret 0004'???

The same with the second open entry....

141 000BF240 00D0C818 0000

BFF7771A

Addr:BFF7771A Ord: 397 (018Dh) Name: GetModuleHandleA (search the adress in WDasm)

the third open entry can be in 'user32.dll', after 'tracer' it crashes the programm.

How is the correct name of the function Ordinal:002F??, which to insert in 'Revirgin-name of the function'

thx Instructor
att@kk
07-20-2001, 04:35 PM
Exorcist - here's what you need to do ...

Firstly, your IAT length is wrong. You've used 700 when it should be 744. Your last export in your .bin is "WINSPOOL.DRV OpenPrinterA" - here's the exports that you are missing (from my ReVirgin saved text):-

451 0009D728 7FE7183E 00B7 WINSPOOL.DRV OpenPrinterA
===============================================
452 0009D730 7FE4FDB7 0075 comdlg32.dll PrintDlgA
453 0009D734 7FE4613E 006E comdlg32.dll GetOpenFileNameA
454 0009D738 7FE4618F 0070 comdlg32.dll GetSaveFileNameA
455 0009D73C 7FE458D2 0069 comdlg32.dll CommDlgExtendedError
456 0009D740 7FE45FD2 006C comdlg32.dll GetFileTitleA
===============================================
As you can see - GetOpenFileNameA sorts out your blank .exe name problem.

Secondly, you know where +SplAj has explained that there will be 2 Kernel32!Ord_2F's close together. Well, in this case there is only one - the second one in your list. You need to use the technique he described and you will find that where you have obtained the first Ord_2F you should find "GetModuleHandleA" instead.

Here's your ReVirgin text file:-

198 0009D324 BFF67463 01F1 KERNEL32.dll GlobalAddAtomA
199 0009D328 BFF66DAF 01FE KERNEL32.dll GlobalLock
200 0009D32C BFF8B9D7 01F5 KERNEL32.dll GlobalDeleteAtom
201 0009D330 BFF6169B 002F KERNEL32.dll
202 0009D334 BFF6169B 002F KERNEL32.dll
203 0009D338 BFF66DF3 0204 KERNEL32.dll GlobalUnlock
204 0009D33C BFF66E15 01FA KERNEL32.dll GlobalFree

Here's mine ...

198 0009D324 BFF7748F 01E4 KERNEL32.dll GlobalAddAtomA
199 0009D328 BFF76DDB 01F1 KERNEL32.dll GlobalLock
200 0009D32C BFF9AF8F 01E8 KERNEL32.dll GlobalDeleteAtom
201 0009D330 BFF7771A 018D KERNEL32.dll GetModuleHandleA
202 0009D334 BFF7169B 002F KERNEL32.dll
203 0009D338 BFF76E1F 01F7 KERNEL32.dll GlobalUnlock
204 0009D33C BFF76E41 01ED KERNEL32.dll GlobalFree

The rest of your work is correct. Sort these two bits out and you are away.

I noticed that once I'd got my dumped file working, the message when you open the program didn't decrement the amount of uses anymore (mine's stuck at 38 out of 50 left). This means that the wrapper decrements the number - the virgin (dumped) Beatcreator.exe only reads it (therefore no wrapper = no program expiry!). Thus all you are left to do is nop out the nags - if you can be bothered.

Anyway, this is a fantastic program for beat manipulation. So good that I went and ordered the genuine version from Button today - I implore anyone else who's going to use it (once they've learnt how to unpack it) to do the same. Button deserve the money for this one.

Finally, many thanks to +SplAj for his posts on this topic - I wouldn't have been able to have sorted this out and learnt what I have without him.

Take care

att@kk
Exocist
07-21-2001, 08:00 AM
hey att@kk

thanks for the info, I have this sorted now too, thanks to +Splaj and hence my thank you's to him in the thread above. this was a good learning curve for me, thanks for taking the time to respond with such great info. You have enlightened me on a couple of areas I let 'slip through the gaps', thanks again, it is appreciated :)

-Ex ;)
att@kk
07-21-2001, 06:09 PM
Exorcist

No problem - just trying to help. I learnt a lot too as the only unpacking I'd done before were games (a couple of Codelok examples).

I take it you read a certain magazine then - this 50 try version isn't available off the ZeroX/Button website. Saw your original post and then by coincidence saw it in the shops on the magazine cover - I bought it on the strength of your post thinking it would be a good learning project.

If you want to have a go at some other cool stuff, the April issue (I think) of the same magazine had a load of 14 day limit Timeworks plug in demos on the cd. Didn't buy that one myself so haven't tried them but if you have it then they should keep you busy for a while.

Did you manage to sort out AWave? Regards ...

att@kk
+SplAj
07-25-2001, 05:27 AM
....and for anybody who is still trying to unpack this target....

here is my preliminary tutorial, attached for your pleasure.....suits you sir ;)

+Spl/\j
'patch+play' }>
Kilby
07-25-2001, 07:08 AM
Splaj,

I found a similar redirect in a target a few weeks ago.

The internal calls where being redirected through the ASPR code, but there was no decryption taking place.

I can't remember what it was, but I will check my notes when I get home.

I certainly think that this is authors simply using the aspr API rather than a new version.

Kilby,,,
+SplAj
07-25-2001, 08:47 AM
Hi Kilby glad the 'Frankie Fingers' are behaving ;)

I RV'd this target at the weekend cos ppl had a few probs with it. I noticed that stupid himem call but ignored it cos I just wanted to see if anything was new re RV v ASPR ;)

I got one of those funny hunches last night and hacked away and traced the code , watched it xor, shl blah blah some 4xxxxx code so assumed it was decrypting ;)

But in this game as in everygame ASSUME:NOTHING.

To test , I just re-built a regular OEiP dump (without calling that F1C774) and it seems to work also ? and maybe only extensive use of the Awave features will show what tricks this decrypt /aspr call does ? I was just happy to get a registered unpacked runner call Xwave at 2 am this morning :-)

I new somebody would question that 'decrypt' statement in the tut :* Like I said it's a prelim for discompress.

PS "Alexey" hows the weather in Germany ? viagrakom.de, nice ISP, I connect to faaker.com ;)

+SplAj
Kilby
07-25-2001, 10:06 AM
Splaj,

the good Doctor did nothing about the fingers, I have just started reading what I have typed ;)

I think the target was advanced directory printer, but my memory is a bit crap.

I ain't disputing what you found, rather I was expecting to come across something like that in the near future, but haven't as yet.

There was nothing other than, jumping off to some aspr code, lifting the real address from a (small) table and jumping the the NORMAL addr.

All I did was modify the jump table to jump to the 'proper' address.

Two other strange things though;

1: I had to add 2 entrys to the IT as they where completely missing from the apps IT, (used when the dialogbox asks for the recursion depth).

2: The unpacked and rebuild app didn't crash as often when there where a large number of directorys & files to process :P

Apart from that the only other thing I had to do was to correct a spelling mistake in the app, and should have changed the default font size for the printouts.

All in all a strange unpack.

Kilby...
cerb^^
07-25-2001, 12:52 PM
Hi,

+SplAj can you please explain how you get to the IAT Length of 0x508. I cant find the right entry for that.

Thx
cerb^^
Exocist
07-27-2001, 02:11 PM
Splaj,

you rock mate, I have learnt heaps from you. Your tutorial gave me a good laugh too when you mentioned about renaming the Awave.exe

quote "fuck off, I am a coding God", I believe you are :D haha, funny shit ;)

thanks again for a sweet tutorial, I'm just about to start working on Awave again following your tut.

-Ex ;)
+SplAj
07-28-2001, 04:26 AM
LOL yes a coding god ...... I picked up some tips from woodmann a few weeks ago. I repeat the excercise once a week to keep in tip-top condition and I enjoy it soooo much........ the wife joins in sometimes.

Not sure if that thread is still available with the 30 day search curtailment :-( ....... maybe woodmann can put it in the faq cos it's such a good tip for aspiring RCE big heads ;) :)

+Spl/\j }>
karmal
07-28-2001, 10:39 AM
hi

+splaj, i have read your tut. i have a problem with it:
i cannot find the last entry (DialogBoxParamA). could you explain me how do you found this entry?

thx

karmal
woodmann
07-28-2001, 01:17 PM
+SplAj (07-28-2001 02:26):
LOL yes a coding god ...... I picked up some tips from woodmann a few weeks ago. I repeat the excercise once a week to keep in tip-top condition and I enjoy it soooo much........ the wife joins in sometimes.

Not sure if that thread is still available with the 30 day search curtailment :-( ....... maybe woodmann can put it in the faq cos it's such a good tip for aspiring RCE big heads ;) :)

+Spl/\j }>

ummmmmm, was I drunk or something?

Peace, Woodmann
Silly_prefix_Kilby ;)
07-28-2001, 03:07 PM
Well if you use Imprec (ducks and covers), it happily shows the address pointed to for getmessageboxparama.

simply get to the oep and dissassemble the address that you have noted down.

Kilby...


Armadillo Killer 1.3 (CopyMem Edition)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Armadillo Killer 1.3 (CopyMem Edition)
PDA

View Full Version : Armadillo Killer 1.3 (CopyMem Edition)

ArmKiller
06-14-2001, 02:36 AM
Hi all!

Here is the latest version of my Armadillo Killer (with CopyMem support) for Armadillo v1.7-2.0 and keygen for it.

By.
Duelist
06-14-2001, 06:02 AM
That keymaker.exe looks a bit like my old Armadillo KG. Would it have been too hard to keep the credits to whom they belong?

If you can say you did it yourself, I apologize for this post.

Peace...
LaptoniC
06-14-2001, 06:41 AM
I have looked your armadiilo source code.I have found where magic key is pushed however I coulnt found any key for aother prog at same location.As Armadillo is protected by blowfish then if we can spot the key for it all armailloed programs can be cracked easily right ?Could you give me a hint to reverse it.I am working on program which dont have trial option.It asks serial every time it starts and if you give bad serial it quits.Thanks an sorry for any typo error my 3rd finger of right hand is cut I can only write with my left hand :(
Duelist
06-14-2001, 09:04 AM
Armadillo uses certificates. A valid key should decrypt _one_ of the certificates (depending on wether it is a trial-key, full-key, etc), using Blowfish. Armadillo tries to decrypt all of the certificates, checking if decryption was valid using a simple check: if the FIRST_DWORD in the certificate equals NOT SECOND_DWORD, it went fine and registration is complete.

You cannot get the encryption password in memory, plus it is different for every Armadillo program, and is based on the encryption template chosen by the programmer; a bruteforce approach is needed (unless you have a valid key supplied by the author).

I hope these tips help, might not be valid for the newer versions tho.
LaptoniC
06-14-2001, 10:27 AM
Thanks for the reply.I will try.Btw as far as I know new Armadillo(2.xx) use public cryptograpy.
ArmKiller
06-14-2001, 12:19 PM
LaptoniC (06-14-2001 08:27):
Btw as far as I know new Armadillo(2.xx) use public cryptograpy.

It looks like a crap (look at the CodeGen.h -> CreateCode2 function)
Where is the private key??? I think that profi like Duelist will show us
the truth soon.

PS. Sorry Duelist, keygen.exe - is YOUR work, you're the master!
I've just recompiled it, for a smaller size. Excuse me again :(
Duelist
06-14-2001, 12:38 PM
ArmKiller, I didn't mean to go so hard on you. I've no problem that you recompile the KG for any purposes you wish, all I said was that you could/should have kept at least a small credit.

Continue your good work on Armadillo, and thanks for the kind words. :-)
the analyst =)
06-22-2001, 10:46 AM
Duelist (06-14-2001 10:38):
ArmKiller, I didn't mean to go so hard on you. I've no problem that you recompile the KG for any purposes you wish, all I said was that you could/should have kept at least a small credit.

Continue your good work on Armadillo, and thanks for the kind words. :-)

hello

well, i tested that keymaker, and it only works for basic registration right ?
it still uses the old registration, but if you look the 'pro' one, it is something different ;) that's why duelist master ;p keygen worked
and again AFAIK, the basic registered version will expire ;) (30 days limited or something)
so so , some more work is up to be done i guess :)
duelist, did you have a look at that registration pro ?

talk to you later on IRC brother :)

regards,

the analyst
Duelist
06-22-2001, 04:04 PM
the analyst =) (06-22-2001 08:46):

well, i tested that keymaker, and it only works for basic registration right ?
it still uses the old registration, but if you look the 'pro' one, it is something different ;) that's why duelist master ;p keygen worked
and again AFAIK, the basic registered version will expire ;) (30 days limited or something)
so so , some more work is up to be done i guess :)
duelist, did you have a look at that registration pro ?

talk to you later on IRC brother :)

regards,

the analyst

As you may have noticed from the posts above, only ArmKiller is responsible for including this modified (even if only cosmetically) version of the old KG. :-)

Its very likely that it won't work for the Pro version; I don't even know if it works for the basic one, but I guess I'll trust you on that. :-P

I did not look at the new registration systems, but will try to do so sometime soon. Did you look at them yet, analyst?

Duelist.
Duelist
06-22-2001, 04:05 PM
Sorry, double posted.
the analyst / UCF
06-23-2001, 05:08 PM
Duelist (06-22-2001 14:04):

As you may have noticed from the posts above, only ArmKiller is responsible for including this modified (even if only cosmetically) version of the old KG. :-)

Its very likely that it won't work for the Pro version; I don't even know if it works for the basic one, but I guess I'll trust you on that. :-P

I did not look at the new registration systems, but will try to do so sometime soon. Did you look at them yet, analyst?

Duelist.

hey ;)

well, that old keygen works on basic version..
which uses old registration system to say compatible ;)
i didn't check the new one yet, coz i don't have much time nowadays ;)
im in belgium atm btw ;) real life is taking all my time.

basic system just give a 30 days limited license as far as i know.
Pro version uses most likely P.K.A.
elgamal can be something to check ;-)
for now, im gonna sleep.
later bro

the analyst
hz
06-24-2001, 04:36 PM
hiya,
Little off topic. I have only recently come across
a couple of armadillo protected progs and found it a bit of a change. Would any of you be prepared to mail me some links to armadillo protected progs?.

tia.


XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > XP
PDA

View Full Version : XP

unlock
06-15-2001, 12:49 AM
news for a new protection microsoft


HWND error message
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HWND error message
PDA

View Full Version : HWND error message

Wizard
06-15-2001, 08:40 AM
When I use Softice HWND command under WinNT, I got the following error :
"Unable to find a desktop window"

Does someone know why ?
tesla
06-19-2001, 07:35 AM
>Try to do a MessageBox(NULL, "test", "test", MB_OK), you will have >one window.

I experienced problems (window is not displayed) with using NULL handle under Win XP beta2 like there is no desktop window. Any suggestions?
Wizard
06-19-2001, 09:29 AM
Well, even with "MessageBox(NULL, "test", "test", MB_OK)", I still got the same error message.

Never mind, I'll use a window spy instead !

Thx
tony b.
06-20-2001, 08:18 PM
maybe you're in the idle context when you break into softice... try something like 'addr explorer' or 'addr <some_window_app>' (use 'proc' to get a list).

regards,

tony
nEOasM
06-26-2001, 03:20 AM
Try the 'proc' command first. When u get the list of processes name like 'Editplus' then try the following command :hwnd Editplus


Install Shield 6 stuff?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Install Shield 6 stuff?
PDA

View Full Version : Install Shield 6 stuff?

nasedo
06-16-2001, 06:30 AM
Hi all,

first of all, thanks to all people who stay this good job up!!!
tshep you're a king!

Come back to my problem, I would to know if script decompiler, full working depacker, full working enpacker and/or tutorials or/and any intersting WWW source ?

I can undestand why people don't wanna give very intersting info in public area. So if you want to write me an email, you will be the welcome.

A big thanks!!

Nasedo
nasedo
06-16-2001, 10:19 AM
I mean install shield script who install software

not the install shield software
Kythen
06-16-2001, 12:24 PM
For unpacking InstallShield 6 cab files, use i6comp. You should be able to find it at most of the good tool sites like suddendischarge and programmerstools. To decompile IS6 .inx (script) files use ISD from http://nekosuki.virtualave.net/
Both are great tools and have saved me a ton of time on some of my projects!


Chariot Ganymede VOIP 4.1 - FlexLM License Crack?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Chariot Ganymede VOIP 4.1 - FlexLM License Crack?
PDA

View Full Version : Chariot Ganymede VOIP 4.1 - FlexLM License Crack?

tom
06-17-2001, 04:16 PM
Can anyone make the license for this guy.

Here is the download link. They are using FLEXLM.

http://www.netiq.com/support/chariot/product_updates/version_41/default.asp
decx
06-17-2001, 06:07 PM
Looks like a request to me. I have worked on Ganymede, and if u got any specific questions about the flexlm implementation ask them.
woodmann
06-17-2001, 07:33 PM
:D


Binary Interception of Win32 Functions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Binary Interception of Win32 Functions
PDA

View Full Version : Binary Interception of Win32 Functions

tom_324
06-17-2001, 05:55 PM
Take a look at:

http://research.microsoft.com/sn/detours

Source code included.

Tom


Safecast
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Safecast
PDA

View Full Version : Safecast

rimmy
06-18-2001, 12:43 AM
Hi everybody !

I'm trying to crack an eval program which is protected with the C-dilla SafeCast v.3.21.040. Besides, the program is protected with the Flexlm. The program consists of several protected executables and dll's. So, if I get to unwrap them and to find the license keys I'll get the full version of it.
Well, when I started working on it I didn't have any experience in Safecast,
I only could find some tutorials on Safedisc cracking. But I succeeded in unwrapping 3 exe's and finding the flex-keys to all of the exe's. While looking for the keys I had to replace the protected lic-files by the real flex-licenses and broke the Safecast licenses. Now I have stuck and can't unwrap the other exe's because the Safecast displays "Your license to use this product has become temporarily broken etc." and it asks me to enter the Response Code to run the application. I tried to reinstall the program but the Safecast remembers all.

Does anyone know how to root out the Safecast "memory" in order to reinstall the program ?
Are there any tutorials or info on Safecast cracking ?
Did anyone succeed in getting "Response Code" in order to run the application under the Safecast protection ?

Best regards.
IcyDee
06-18-2001, 05:52 PM
I read a message thread somewhere on this board about how they put information into low numbered sector on the HDD (above sector 32) which can only be removed with a low level format.
Lord Crass
06-18-2001, 10:39 PM
You can also use HexWorks to directly edit the disk sectors. I believe it's sector 32 on your root drive that contains the safecast data.
evil-risc
06-19-2001, 07:02 AM
sector 32 - 63 can contain license data, see fravia's homepage, tsehp wrote sth about it ..

you have to null the first couple of bytes of license data in whichever sector it lies in, and delete the license off your hd (c:\c_dilla\blah)
rimmy
06-19-2001, 06:03 PM
Yeaah, the Safecast writes its data into the hdd space between Cylinder 0 Side 0 Sector 1 and Cylinder 0 Side 1 Sector 1, that is between the MBR and the logical C:\-boot sector. Using HWS it could be found beginning with physical sector 32. Eeach time the Safecast setups it makes a new record in that space increasing the sector number (33,34 and so on). Yes, it's sufficient to zero the first word of the record, delete all the C-dilla regs and bdxxxxxx.dat-files and the Safecast starts from the zero countup.

Thanx !
karakochev
06-22-2001, 09:13 PM
3 mounths ago I put a proggy on my site that automaticly removes C_dilla safecast system
http://karakochev.search.bg
rimmy
06-26-2001, 03:05 AM
Well, I did it. I mean unwrapping 13 exe's and 10 associated dll's of the above-mentioned program. Now I have some experience in safecast cracking and can say that the newfangled Icedump and Revirgin turned out to be rather useless for solving the task, moreover, they made me waste lots of time. So, I had to use the classical scheme for unwrapping both the exe's and dll's, that is pep+jmp_eip+F5+external_dumping. Procdump (v1.6.2) coped with dumping the exe's, but failed with the dll's. PEditor (v1.7) nicely dumped the dll's stopped at "pep". The only operation I had to do after dumping was changing the image base of the dumped dll's (with PEditor, of course), and no redirection, no IAT resolving. That's all.

Good luck !
goatass
06-26-2001, 10:29 PM
How about you write a tutorial on how you did it so the rest of the scene could benefit from your findings.

goatass
rimmy
06-27-2001, 02:13 PM
I don't think I found something of interest to the rest of the scene while cracking the program. I just did some routine work. I recommend to read the tutorials written by Predator, BlackB and Kilby. They can be found at http://tsehp.cjb.net. Those tutorials helped me very much. I think anyone will be able to unwrap anything after reading them.


Thief 2 but not target specific
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Thief 2 but not target specific
PDA

View Full Version : Thief 2 but not target specific

Fake51
06-18-2001, 05:52 AM
Since my last post I'm actually still working on Thief 2. Managed to get the thing working without any help from Safedisc dll's, that is, almost working. There's one thing that puzzles me, and since I'm in the middle of exams I haven't had time to work on it much. So I'm hoping somebody might have been thru it, and can give me some peace of mind.

Problem is, every once in a while, Thief blinks the screen (it's done once when the game is loading into the start menu, and when it has just loaded a mission). When it does this, it (well something anyway) seems to be loading the file into memory again, without reloading the import table. Thus, when the game tries to go on loading, gpf gets in your face. What's getting on my nerve is, that it would seem that the debug breakpoints have been disabled in some fashion, and I don't know how. So, the question is, how would one go about doing something like that? And at the same time reloading the file into memory? Any help would be cool.

Blue skies
Fake
TC
06-18-2001, 05:17 PM
Possibilities:
a) Safedisk API (i think its Thief2 doesnt use it though)

b) IAT wrong rebuilded, but calls correct so code like:
mov ebp, [SomeIATaddress]
bla:
...
call ebp
jmp bla
would fuck up as the FF15-calls are fixed to the correct import but the API-calls like the above one stay directed to the wrong api
hedgehog
06-19-2001, 07:51 AM
I had similar problems with Safecast. Apart from the "FF 15" calls, there are api calls via different registers, as TC described for ebp and JMPs to api adresses. - I wrote down my experiences and a way to handle this problems and sent it to +Tsehp some days ago, perhaps he will publish it. Otherwise, i could send it to you by mail.
Fake51
07-02-2001, 11:31 AM
Hi again

Sorry for taking so long to reply, been busy.
Bout my problem: I took into consideration the way safedisc redirects the API's (with the check for FF 15), and since I checked that the calls were sent to the right places, I'm rather sure that's not the problem.
I'll try to sum it up again: What happens is, that when I load my version (unpacked and fixed) it runs fine up until a moment when the screen flicks (I'm not entirely sure why it does so, but am guessing it's setting up the display or rather testing it). When the screen is restored (before the Thief 2 menu is loaded) it seems that the program has been reloaded from the HD and put into memory WITHOUT the import table having been processed again. Thus, since I put my iat another place, the original iat is there and points to nothing. What puzzles me is that Softice won't break on a bpm, altho something is clearly being moved around in mem. I fixed the problem first by saving a copy of the memory place i needed, and when it had been altered just moved it back. This worked up till the game had loaded a saved game, or you'd start a new one, when the proggy crashes (due to a GPF I'm pretty sure, tho everything justgrinds to a halt). Now, the question is, why wouldn't softice break, when something in memory was being moved around?

If anybody has info or similar experiences, would be cool to hear.

Blues skies
Fake


Adobe 5 READER (godammit, READER!!) is S-ICE hostile
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Adobe 5 READER (godammit, READER!!) is S-ICE hostile
PDA

View Full Version : Adobe 5 READER (godammit, READER!!) is S-ICE hostile

aimless
06-18-2001, 09:37 AM
Install Acrobat Reader 4
Open a .pdf file
Assume ICE is in background
No Problem

Install Acrobat Reader 5
Open a .pdf file
Assume ICE is in background
DOES NOT OPEN.

CTRL+ALT+DEL does NOT show the process. Is this paranoid? Or am I just going crazy.

Me? I have Win98/SE (yeah!)

Leads anyone?
rickz
06-18-2001, 06:59 PM
same for me on a win2k installation.
madmax
06-18-2001, 09:21 PM
Its not so much Adobe, but rather the InterTrust plug-in with filename DOCBOX.API...It checks for sice using IDT method and CreateFileA/SICE, so you need to either use FrogSICE, Icedumps /protect feature, or better yet modify your winice.exe and other files, as was done in the old days =) I recommend this, as more and more programs are using anti-debug stuff, and frogsice/icedump are nice but not perfect! Anyways, to get around the IDT check, i patched DOCBOX.API at offset 0x34A65 to change jz ==> JMP
I assume u can handle that! Have fun

madmax!
Russ
06-18-2001, 09:45 PM
This is a paste from Acrobat's readme (C:\Program Files\Adobe\Acrobat 5.0\Reader\ReadMe.html).

"Debugging with Acrobat Reader 5.0
If you need to use a debugger while Acrobat Reader 5.0 is running, to enable debugging remove the InterTrust directory and DocBox.api plug-in contained within it from the Acrobat 5.0/Reader/Plug_ins directory. [416341]"
That's to easy.

017F:37034A59 668B5144 MOV DX,[ECX+44] ;IDT read at interrupt 11?
017F:37034A5D 6681F20005 XOR DX,0500 ;8500 XOR 0500 = 8000
017F:37034A62 F6C61F TEST DH,1F ;10000000 (80) AND 00011111(1F) = 00000000 ZF = 1
017F:37034A65 7505 JNZ 37034A6C
017F:37034A67 B801000000 MOV EAX,00000001
017F:37034A6C 3BC7 CMP EAX,EDI

Just change your IDT+44 to something besides 0085 (mine is 008E with sice unloaded). There are two more cheesy meltice tricks that I'll let you find (or use FrogsICE).

Or just do what madmax said. I see he beat me to the post.


problem with "phantasm v1.5b3 DingBoy"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > problem with "phantasm v1.5b3 DingBoy"
PDA

View Full Version : problem with "phantasm v1.5b3 DingBoy"

synphony
06-19-2001, 08:55 PM
Hi

I am trying to unpack an executable program crypted by "phantasm v1.53 DingBoy" (my fi245 says). one of my friends tells me to do unpacking by using Undbpe v1.50. I've tried, but failed. The small message box reads "dbpe not found". I want to know what "phantasm v1.53 DingBoy" is and what tool can be used to deal with it. What is more important is what should I do?

Many thanks!
CoDe_InSiDe
06-20-2001, 12:15 AM
Hi synphony,

You can try to Manually Unpack it :)
I don't know if this one is difficult ;)

Cya...

CoDe_InSiDe
+SplAj
06-20-2001, 04:21 AM
found a copy :-

http://www.crackinguniversity2000.it/cracking/Nuovicrack/

filename:- dbpe153.zip (~500k)

The one from http://programmerstools.com (old protooooools) link still does not work 100% (33.9k only) +1 year later, I tried in June 2000 to get it and again just now :(

So D/L and protect notepad.exe as usual..................

tell us the experience ;)

+SplAj

BTW y0da's latest LordPE FX version (fully registered !) is available from programmerstools (better than PEditor1.7)

BTW2 stools of a programmer ???
+SplAj
06-20-2001, 04:53 AM
y0da

I see the LordPE from stools is NOT registered version.....but it says so in the about box 'thank you for buying' instead of 'the full version costs $13' !

phewww...............my $15 investment is still safe :-)


tElock 0.81
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > tElock 0.81
PDA

View Full Version : tElock 0.81

Singe
06-20-2001, 04:16 AM
I dumped a tElock packed exe to disk and im getting problems with the resources(?) ex,DialogBoxParamA returns -1...resources seem to be ok as Exescope and other programs view them perfectly...the virtual offset of the .rsrc section seems also to be ok..wtf?
+SplAj
06-20-2001, 04:40 AM
just checked out :-

http://egoiste.cjb.net

can't see te!lock0.81m? where did you get it from ?

Here is my unpacked te!lock0.80 for you to study......

}>
Kilby
06-20-2001, 06:43 AM
Hey Splaj,

what's happened to discompress lately

Kilby...
disco
06-20-2001, 07:41 AM
http://59327516776/discompress/

www.discompress.com :-

the 1 year domain registration expired and Vince'daMan has no visa card ;)

maybe make a cjb jmp to ????

BTW I see r!sc (http//csir.cjb.net) works in radio now ;)
so is cjb a retired crackers jobseekers referal site }>
evil-risc
06-20-2001, 09:36 AM
hey im not retired, just tired ;-)

find me some nice porn site for me to redirect it to, if your not too keen on radio #1
disco
06-20-2001, 09:51 AM
oi!

radio #1 is ok, just the tune selection ;)

please choose 'Trance' :)

BTW I am looking for Placebo MP3 rip of that nice tune 'a friend in need is a friend indeed'..............

}>
Kilby
06-20-2001, 10:50 AM
redirect ok

h**p://www.daisysroom.com
Singe
06-21-2001, 02:54 AM
nope,actually it's tElock 0.8:)
but that unpacked exe is probably stil no help for me since I don't know how you fixed those damn resources...
+SplAj
06-21-2001, 03:35 AM
Singe

Sorry, I read your thread slowly now and saw you were unpacking 'a' te!locked target...not te!lock itself....and you unpacked it but it does not run ?

The only te!lock0.80 'target' I found so far was Iris3. I made some summary of the time I spent unpacking it, I assume you read the thread already.

The tricks to be aware of are the sectioncount set to FFFF - BTW fixed if you use LordePE to dump ;) . The MUTEX (if programmer utilised this feature, BPX CreateMutexA to check) and the usual IT redirection. You can just stop the IT being destroyed or use RV to rebuild it. In this case I prefer to stop the destruction and dump the section and copy+paste in the final dump.

Also the SI detection is a bit tame , for Win9x use icedump /Protect on

So, have another go. Tell us your experience and I will try to help if your still stuck......as will lovely-r!sc cos he once wrote an unpacker for te!lock ;)

BTW still no Placebo link :(
Singe
06-21-2001, 03:45 AM
I am actually doing unpacker for tElock;) it has a mutex catcher atm (patch kernel and get the string that is pushed on stack) and also dumps target to disk with good oep.Import rebuilder is also 90% done..but I suck with resources:(


Hasp Envelope help please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp Envelope help please
PDA

View Full Version : Hasp Envelope help please

LaptoniC
06-20-2001, 12:59 PM
I am working on program which uses HASP Envelope. I saw that it only uses service 1 and service 2 I have used Crackz Haspcode addon and found return codes I have put this values after hasp rutine but it gives error saying that cant load ..... some unreadble charecters.Here is what I have found.

0167:007ABADE 8B45B0 MOV EAX,[EBP-50]
0167:007ABAE1 50 PUSH EAX
0167:007ABAE2 6A00 PUSH 00
0167:007ABAE4 6A01 PUSH 01 ;service 1
0167:007ABAE6 E8661F0000 CALL 007ADA51

0167:007ABC8B 8B45B0 MOV EAX,[EBP-50]
0167:007ABC8E 50 PUSH EAX
0167:007ABC92 8B4D0C MOV ECX,[EBP+0C]
0167:007ABC95 33D2 XOR EDX,EDX
0167:007ABC97 668B544162 MOV DX,[EAX*2+ECX+62]
0167:007ABC9C 52 PUSH EDX
0167:007ABC9D 6A02 PUSH 02 ;Service 2
0167:007ABC9F E8AD1D0000 CALL 007ADA51

At this point
Pass2=7729
Pass1=771D
Seed=FC0
So with the help of haspcode addon
Part1 0000C1BB
Part2 0000D69F
Part3 0000EA59
Part4 00005FF5

Program breaked two more times for hasp again but this time service was again 2 but it doesnt pushed directly as push 2 instead moving to eax then push eax.I have filled registers with above ones but it didnt worked.I utilize haspcode command at 7ADACD where return codes put.Could you give me hints to reverse this program.You can download it from http://www.ideyapi.com.tr/download/down/guncelleme/idestids.exe It needs hasp95dl.vxd and Csh.dll which I have attached.Thanks.
CrackZ
06-20-2001, 05:28 PM
Briefly :

See your e-mail for a reply.

Use the /HASPCODE switch at address 7ADAC7, thats where it needs to fill EAX->EDX with the response codes to a given seed, note the parameters 2 lines before (push ebp). First seed used is FC0 then 5FF5.

That takes care of the decryption, however a HASP API is decrypted at 664534 and you need to force service 5 & 33 to good to make the program start.

Regards

CrackZ.
LaptoniC
06-22-2001, 02:03 PM
I have managed to run it.However after it runs it crashes immediatiely after I choose any function like new open etc.
Here is how I came to this point
bpx on freeenvironmnentstringsa

Because it is protected with envelope, I couldnt put my emulation code and redirect to that location.However I have done this.
I have assembled below emulation code and put this to 7CB318 (3CA318h). When it first breaks which is service 1 I have changed eax to 1 and changed call at 7ADAC8 to call 7CB318. Envelope unpacked and program stopped again which is service 5 I have changed eax ebx and ecx to 1 and changed hasp api call at 664535 to 7CB318.Program starts how ever when I try to hit New button program firstly executes service 32 then service 5 and it crashes. My only guess is I missed some services ? or some wrong code in emulation.However, what ever I try for service 32 it crashes at same location of Mfc32.dll and same values of registers.

1) I want to unpack it after decrypting envelope how can i find OEP and unpack it? I tried to bpr 401000 401000+27B86D which range of first section.My computer just hangs.I have used tracex but it couldnt found it also.
2) Is there any error in my emulation or this program needs another dll or something? Thanks

Regards,
LaptoniC

-----------Registers when mfc42.dll crash--------
EAX=9999999a CS=0167 EIP=5f4164fa EFLGS=00000202
EBX=00000001 SS=016f ESP=009ff358 EBP=009ff3bc
ECX=00b85654 DS=016f ESI=00b85654 FS=3ef7
EDX=00688640 ES=016f EDI=00ba2fa0 GS=0000
-----------Registers when mfc42.dll crash--------

--------------Emulation Code---------------
cmp bh,1 ;IsHasp ?
jnz @nextservice
mov eax,1 ;HaspConnected
ret
@nextservice:
cmp bh,2 ;HaspCode
jnz @service5
cmp eax,0FC0h ;Service2 called 3 times 2 times with seed FC0 and once with 5FF5
jnz @itsanother ;Thanks CrackZ for pointing this
mov eax,0C1BBh ;put correct values for this.Use haspcode addon of icedump
mov ebx,0D69Fh
mov ecx,0EA59h
mov edx,05FF5h
ret
@itsanother:
mov eax,03FE9h ;same again response codes for service 2
mov ebx,0DA77h
mov ecx,07BA8h
mov edx,031A7h
ret
@service5:
cmp bh, 5 ;HaspStatus ?
jnz @service33
mov eax,1 ;MemoHasp
mov ebx,eax ;MemoHasp
mov ecx,eax ;Port #
ret
@service33: ;Write Block
cmp bh,32h ;
jz @service32
xor ebx,ebx
xor ecx,ecx
ret
@service32: ;Read Block
xor ebx,ebx
xor ecx,ecx
ret
--------------Emulation Code---------------


Iris v3.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Iris v3.2
PDA

View Full Version : Iris v3.2

BlackB
06-22-2001, 06:32 AM
Good day ladies 'nd gentlemen ;-)

BlackB finished exams and is back in reversing business :-)
First of all, I 'moved' to Win2k lately and I'm currently writing a small tutorial for newbies on how to install and use their cracking programs on it, 'coz it costed me some time to solve the problems that come with it.

Anyway, first thing I did was checking for a new Iris version, and what did i notice.....v3.2 is wrapped with Asprotect this time, yesyes, hehe. I didn't try much yet except finding de OEiP with SoftICE. Now, I noticed that the NT version of icedump only supports the command pagein d/pagein l but no usefull commands like /tracex or a softice hiding option. Frogsice neither works with Win2k, so I suppose I'd better crack it in Win98 right? :) The person that can give me some advice on this will get mentioned in my upcoming essay ;-)

Last little thing: what has been happening past month with our lovely little protections like asprotect? :)

greets goto +Splaj, +Tsehp, Kilby, r!sc, ....my mother, father, sister, grandpa, grandma....i know i'm getting pathetic, but i always wanted to be lame for a second on a msgboard :-P

BlackB
mebe
06-22-2001, 08:32 AM
How about finding a way to get us the real ..exe version of Iris 3.2 to work with, instead of fussing around with a limited evaluation version that can't be made to work fully anyway no matter what you do to it ...peace
madmax
06-22-2001, 04:55 PM
Im not sure how to work with Sice and other tools under NT, never tried...Im sure some other can comment on this...I would advise patching winice itself, its most secure and stable! Anyways, as for Iris 3.2, its not ASPR packed...Thats just telock with the optional "change name" function...telock is easily removed under winme with icedump/importrec/rv...I prefer importrec cause it cuts the thunks easily...Rename "IrisMuteEx" to "MPRMutex" which winME creates upon execution...read the prior thread on iris 3.0 for more info..btw: OEP is 47c70c, IAT is 488000, length is about 1700...be sure to change the # sections ("PE+8" word) from FF FF to 04 00 before dumping!

madmax
+SplAj
06-25-2001, 04:28 AM
hi blackB - and greetz madmax ;)

LOL LOL ...Iris.exe has ASPR section ..... LOL LOL :-)

OK NT/2K SI shit...

I have a big advantage in this topic cos I only EVER do my serious cracking/reversing in the office - which has been NT4 and now 2K (cos of Tsehp and RV!) for the last 4 years.
Learned a lot about anti-SI from frogs ;) and EliCZ - He made a quick patcher and dumper for NTice.sys 3.25/4.00 - search for NTICESET / PNTICE, and some macros to hide SI dynamically. That was a few years ago now....

Since we are currently on several flavors of 4.05 build it is best to run Detect.exe (attached for you) and reverse it, then you know what to do ;)

- don't forget the nmtrans.dll or symbol loader won't detect SI either }>

+SplAj

BTW when you have done this please contribute your findings to the FAQ :-)
LaptoniC
06-25-2001, 01:07 PM
I thank you guys especially +SplAj for helping me on Iris.Finally I have unpacked this.I found my mistakes and learned a lot from them.I think import recostructor is the tool for telock like madmax said
Thanks again for your help you guys rock.


Computer architecture book
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Computer architecture book
PDA

View Full Version : Computer architecture book

spamal
06-22-2001, 01:16 PM
Can anyone recommend a favorite advanced computer architecture book? Preferably one that is in print and available on the net.

My Intel 8086 manual is getting a little dated...

Thanks,

spamal
Joda
06-22-2001, 02:20 PM
Hi.

Well i don't know, if this book is for advanced readers, but maybe u can check it out in your local book store.
I have the German version, but i guess it will be like the same in English:

"Computer Architecture - Structures and Concepts" by Andrew S. Tanenbaum / James Goodman.

It covers the hitory of computer architecture, computer-system organisation, the plain of digital logic, of microarchitecture, of the operating-system-machine, of the assembly language and the architecture of parallel computers.

Cya,

Joda
BlackB
06-23-2001, 07:16 AM
I had to buy the Tanenbaum book for school. I learned a lot, but I can assure you that there are lots of complex stuff in there :-)
I understand these things now because I had to study it for my exams, but when you just buy the book to read just before going to bed, it will be hard sometimes :-)

ah well, it's a very good book, very well explained. take your time and learn ;)

greets

BlackB
Carpathia
06-23-2001, 10:24 AM
Also try "Structured Computer Organisation", again by Tanenbaum. I imagine theres some of crossover between the two books, so check the on amazon before you buy.


Isn't it suitable to raise this question here?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Isn't it suitable to raise this question here?
PDA

View Full Version : Isn't it suitable to raise this question here?

synphony
06-23-2001, 05:39 AM
Suppose we are both on the same BBS or forum, how can i detect your ip address?

regards to all !
woodmann
06-23-2001, 03:50 PM
Are you trying to discover the real identity of someone or just log ip's?

Anyway it doesnt matter, It takes a huge amount of effort to track ip addresses without having access to the server. If you try to do it without permission then you will just get caught sooner or later.

What if the person you are trying to identify is behind an anon proxy?
What if the proxy's are chained?

There are other ways to identify someone. You just have to be clever.

And no this isnt the place to ask such questions. I'm in a good mood today :D
So do your research and poke around some other sites that deal with such exploits.

Peace, Woodmann
synphony
06-24-2001, 12:26 AM
Thanks a lot,woodmman. i'll never do it again later!
Predator_PC^pGC
06-25-2001, 03:31 AM
lol


aspack site down ? Need latest asprotect with latest revirgin dev
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > aspack site down ? Need latest asprotect with latest revirgin dev
PDA

View Full Version : aspack site down ? Need latest asprotect with latest revirgin dev

tsehp
06-25-2001, 08:34 AM
hi,
just wanted to test the latest rv with latest asprotect, but the site is down, and I can swear it's not my fault ;-) who has the latest asprotect download ?

the revirgin's tracer is now working fine on win9x and me, and the beta will soon be available, the new tracer can resolve vbox 4.5 encrypted iat 15 times faster than before, the tracer option allows you to trace a prog like icedump, set put some limits to freeze and later dump the app, I'm almost finished.

I also have to make a decision :
asprotect and latest vbox4.5 begins to wrap some api like this :
iat entry 1
code 1
code 2
real api call
code 3
ret

and a check inside the main exe verifies if tha api was called, splaj did a quick fix by directly putting the api address into iat entry 1, so all the code around is useless, but we can imagine that they could improve this.

solution 1 : put into rv an option to redirect the iat to a rva offset into your dump that will contain the same code, but this could be long to build if later they make 100 iat's like this.

solution 2: transform the interesting code into a fake dll, so revirgin could point the iat's to those api call wrappers, harder to do but much more harder to defeat.

solution3: discussion is open and suggestions are welcome...

regards,

tsehp
+SplAj
06-25-2001, 09:43 AM
Tsehp

pssst, maybe Alexey retired ;-)

.........just in case tho' the dll is the way to go for me. You provide a blank 'template' dll and if code is found as before , build it, fill it with the code from aspr , link the IAT/IT to it and bobs yer uncle.

wow, can't wait for that tracer }>

CYA soon , still waiting for my best trousers to come back from the cleaners ;)
Kilby
06-25-2001, 10:23 AM
I downloaded a version just over a week ago.

But it's probably out of date already.

Regards,

Kilby...
tsehp
06-27-2001, 07:05 PM
+SplAj (06-25-2001 07:43):
Tsehp

pssst, maybe Alexey retired ;-)

.........just in case tho' the dll is the way to go for me. You provide a blank 'template' dll and if code is found as before , build it, fill it with the code from aspr , link the IAT/IT to it and bobs yer uncle.

wow, can't wait for that tracer }>

CYA soon , still waiting for my best trousers to come back from the cleaners ;)

false alarm, it was a temp shut off for the site, maybe some rush of malcontent clients claiming for a refund ;-)

dll seems to be the best option, but it have to be loaded dynamically, so we're still oblidged to paste some loading code inside the target...

the tracer is working on every program that I submit to it now, I just have to
build a small disass into the tracer's window and we're on, then I'll adapt it to win2k. I'll uploat the beta before sunday,regards.
Eternal Bliss
06-28-2001, 06:41 AM
+Tsehp (06-27-2001 17:07):
+SplAj (06-25-2001 07:43):
Tsehp

pssst, maybe Alexey retired ;-)

.........just in case tho' the dll is the way to go for me. You provide a blank 'template' dll and if code is found as before , build it, fill it with the code from aspr , link the IAT/IT to it and bobs yer uncle.

wow, can't wait for that tracer }>

CYA soon , still waiting for my best trousers to come back from the cleaners ;)

false alarm, it was a temp shut off for the site, maybe some rush of malcontent clients claiming for a refund ;-)

dll seems to be the best option, but it have to be loaded dynamically, so we're still oblidged to paste some loading code inside the target...

the tracer is working on every program that I submit to it now, I just have to
build a small disass into the tracer's window and we're on, then I'll adapt it to win2k. I'll uploat the beta before sunday,regards.

tsehp,
I finally had some time to try out ReVirgin and also compared it with MackT's Import Reconstructor... 8P
One thing I notice is that with ReVirgin resolving import seldom work for me. I am not sure why. 8P But I am able to unpack aspack itself (downloaded 2 days ago) with the imports nicely built.
Sometimes, I make use of both the programs to build the import table because occasionally, ReVirgin is able to find the imports but not MackT and vis versa. 8P
And I use MackT's to enter the RVA of the import table and size in ReVirgin too. 8P

Regards
EB
SpeKKeL
06-29-2001, 12:25 PM
Hajo,

Can't wait for your new RV.
Keeps getting better and better,
Last version tried on PEcompact1.50
(i know it isn't asp.) and worked 100%!

Greetz SpeKKeL....
tsehp
06-29-2001, 07:49 PM
I just studied mackT new tool, the presentation is different than mine, more compact but I still prefer my old good iat table, even if it takes more place, I go quicker with it.
It lacks a real tracer, but a little more better done concerning the disass trace section, it just looks at the iat entry and report the first api call encountered, but this could lead to failures if alexey calls severals around.

After a while, I came to the idea to add a new function :
show listing when an Iat doesn not lead to the main api, I could maybe let the user set some limits and paste this code at the dumped end, then entering into the iat the code's rva... what do you think ?
Eternal Bliss
06-30-2001, 07:43 AM
+Tsehp (06-29-2001 17:49):
I just studied mackT new tool, the presentation is different than mine, more compact but I still prefer my old good iat table, even if it takes more place, I go quicker with it.
It lacks a real tracer, but a little more better done concerning the disass trace section, it just looks at the iat entry and report the first api call encountered, but this could lead to failures if alexey calls severals around.

After a while, I came to the idea to add a new function :
show listing when an Iat doesn not lead to the main api, I could maybe let the user set some limits and paste this code at the dumped end, then entering into the iat the code's rva... what do you think ?

Are you refering to something like cs:call dword ptr [IAT_Entry] where IAT_Entry is the VA of some codes that is in a totally different address space and not 00400000? I have seen something like that in azpr.exe (unpacked last night). It is used to call DialogBoxIndirectParamA and also uses FindResource, LoadResourceA, LockResource. I had to copy and write that section of the code in a empty part of the file and patch the call.

If that is what you are refering to, I think it is a great idea. 8) Save a lot of trouble and time. 8P
Also, is it possible to have the option to rearrange all the IAT according to the dlls? 8P

Regards
EB
madmax
06-30-2001, 08:56 AM
Im not sure how necessary it is to save that whole routine with the load/lock/freeresource apis with dialogbox api as well...If i recall, in elcomsoft.com products the load/lockresource apis are replaced by null reroutes, which assumes they are not important apis! But you can easily spot these when rebuilding the IAT and fix em, then replace the entry leading to the routine you copied with a simple dialogbox API...I think the advanced pdf program was like this...My two cents =P

madmax
tsehp
06-30-2001, 07:39 PM
eternal bliss : exactly, code is located inside asprotect and make some eventual tests to jump above the api call, especially if some parameters are null...

madmax: you're also right, at this point all this mess leads to a unique api, and it's normal because otherwise he would have extract the original code into another place, it's just some mess put arount the api call to confuse the live tracer.

But if we simply invert the process by importing this code and paste it at the dumped target's end, we don't have to trace those routines no more and the process is simplified. Maybe I'll wait a little more to see how things evoluate on this subject, adding such a functionnality while it's not very imperative is maybe not worth the case at the moment.
Eternal Bliss
07-01-2001, 07:22 AM
Hiya,
this is going to sounds quite lame but I have a question about ReVirgin... 8P

There is IAT Resolver which I know what it is for.
There is Resolve Again button which I am supposed to click on after IAT Resolver for the redirected APIs. This all goes well.
But after that what is to be done?

Right-clicking on an empty entry gives me the choice of Enable Trace and Trace. What is the difference between them?
I tried Trace and usually it crashes and I have to go into Sice to revert a conditional jump to bring tracer.dll out of a loop. 8P
I tried Enable Trace and the entry is changed to to_resolve. So, naturally, I would click on Resolve Again but then, the entry becomes empty like before. 8P

Then there is the Tracer button which brings up this window with 4 edit boxes. Do I fill them in or what do I do with them? 8P When I try launching an app, it gives me a non-english error message that starts with "Impossible" so I thought it might be because the packed app is already running (so that ReVirgin can resolve the entries in the first place). I am totally lost. 8P

Ok. Enough of my lameness. 8P
I have attached a tut on unpacking azpr with this message. heh

EB
tsehp
07-02-2001, 04:32 AM
yes I admit my interface is sometime a little hard to understand, when you have clicked resolve again, it only fixes the redirected api calls and eventually addresses that you've manually put inside the iat entry.

When you click enable trace, it puts the iat entry into a rv internal state, here they are :
1-resolved
2-not resolved
3-redirected (to resolve)
4-traced (to resolve)

to resolve means that an address is found and you have to click resolve again.

The tracer button is the next future feature of revirgin : trace an app to dump it when it lands to the oep.

Now you've found the failure : you had to patch a jmp to avoid my tracer to go to an infinite loop, so I think that I could do this task :
when the tracer is blocked on this case, I could also add an option to disass the iat entry, select the line entry to trace, this line should contain a call [xxxxxxxx] so when doesn't care anymore about the tests around.

splaj : finally the dll template is a bad idea, just because they can put later some check code to see in the real protection is present, the above one seems simpler, maybe coupled with a an option to import the selected code into the dumped target.
NotMe
07-02-2001, 04:54 PM
Eternal Bliss (06-28-2001 04:41):
tsehp,
I finally had some time to try out ReVirgin and also compared it with MackT's Import Reconstructor... 8P
......
..ReVirgin is able to find the imports but not MackT and vis versa. 8P
And I use MackT's to enter the RVA of the import table and size in ReVirgin too. 8P

Regards
EB

Are you sure you can do it successfully like this way?
My answer is NO !!! Coz they handle the "Size" in different ways.

If you got "IAT Start RVA" and "IAT Length" in Revirgin, and wanna put it to MackT's ,
you need plus 4 to the IAT Length .Or you may get an uncompleted Import Table in MackT's.

Actually, I prefer RV ^_^ .
tsehp
07-02-2001, 05:39 PM
a pre beta is available, with a new tracer, that is also used to trace an entire app.
notme, write me if you want to test.

about RV, the interface is far to be perfect from my point, I used to work a lot on the internal code and a lot of friends helped me to debug it, but I'm still open for suggestions to improve the ergonomy.

regards,

tsehp

MODIFICATION : 3/7/2001 I have enough pre beta testers ! stop writing me, I'll do soon an announce here for the real beta. Please be patient.
Eternal Bliss
07-03-2001, 04:46 AM
NotMe (07-02-2001 14:54):
Are you sure you can do it successfully like this way?
My answer is NO !!! Coz they handle the "Size" in different ways.

If you got "IAT Start RVA" and "IAT Length" in Revirgin, and wanna put it to MackT's ,
you need plus 4 to the IAT Length .Or you may get an uncompleted Import Table in MackT's.

Actually, I prefer RV ^_^ .

Well, I am sure I know what I am doing although I might not be saying what I thought I wanted to say. 8)
Regards
EB
tsehp
07-03-2001, 05:44 PM
btw, saw that mackt's lacks the trap flag tracer and mine is a reusable dll,
I don't know how to contact him, so if he reads this or someone can report him :
I'm ready to send him the documentation of my dll, so he could add it to his rebuilder.
Eternal Bliss
07-04-2001, 05:37 AM
+Tsehp (07-03-2001 15:44):
btw, saw that mackt's lacks the trap flag tracer and mine is a reusable dll,
I don't know how to contact him, so if he reads this or someone can report him :
I'm ready to send him the documentation of my dll, so he could add it to his rebuilder.

Hiya,
I talked to him before and he said the the tracer is there. Just need to patch the messagebox. 8P
I will bring the copy I have next time and attached it. He dcc'd to me in irc. Hope he wouldn't mind me doing it. 8P

Regards
EB
Eternal Bliss
07-05-2001, 05:37 AM
I have attached the copy of ImportREC with the 3rd tracer enabled.
Regards
EB
vile_evil_live_splaj
07-05-2001, 07:04 AM
As a nice challenge please discompress the following elcomsoft target :-

http://www.mailutilities.com/downloads/

get the Advanced Email Extractor PRO 2.2

and have some phun, I did for 1.5 days :-)

I struggled with that USER32! call at 0x430344 - DialogboxIndirectParamA ??? called to create the 'New' (40A862)
and ''New Search' (406235) menu selections. hehehe

There are a few more tricks to patch as well - LOL 'crypt API missing' blah blah

Oh and a nice email back to elcomsoft re the crash "we are very-very sorry" blah blah. Nice one guys.

BTW I hope you sort out Adobe, I got that ebooks 2.2 ripper thingy yesterday but was busy with this AEE Pro first }>

+SplAj
Kilby
07-05-2001, 08:57 AM
Hey Splaj,

I have been having enough trouble with netnak, flexy and ehr ebook thiing.

I don't need another one of those buggers

Kilby...
evil_vile_live_splaj
07-05-2001, 09:31 AM
--------------------------------------------------------------------------------
ehr ebook thiing
--------------------------------------------------------------------------------

Kilby

r u learing a scandinavian language ? if so can you help me with my Miele spindrier, I can't follow the control/dial cos it's in Norwegian. The wife leaves for vacation next week and I am on my own for 6 weeks :-) so need to wash & dry my clothes at least twice in that period .

I'll write down the exact words and you can help me translate. I need a cycle that you put in your wet clothes and they come out dry and crease free :-)

haagen daas

+SplAj }>

Oh BTW did you unpack Elcomsoft AEE pro 2.2 yet ? it's a bastard.
NchantA
07-05-2001, 09:54 AM
hey splaj+ and kilby ;)

ebook thing looks wiked, im unpacking as fast as i can hehe ;)

'API Not Found, please contact techincal support'

is that a trick? or my bad iat rebuilding. i did have trouble with the dialogbox crap, but i think i got it sorted out.

i got no invalid/suspect with imprec, which is my savior. ill have another look tonite of course. plz email/post me if u can splaji

NchantA
Kilby
07-05-2001, 10:14 AM
I wish I was learning a scandinavian language, but it's this bloody mose key I'm forced to use on this machine.

Papertape for a monitor and a morse key for input ain't the way to go.

I have been using a Toshiba Libretto and a JP Jordana too much lately. Now I can't get used to the spacing on this keyboard in work :(

Real life is in the way of unpacking at the moment, but I'm watching what's going on with asprotect.

It's like the Z80 days watching the various versions of the DJL Speedlock evolving.

Kilby...

Now doctor Frankenstein about those fingers you supplied me with !
Kilby
07-05-2001, 10:22 AM
Hey Splaj,

I forgot

If you want a bit of fun look at advanced directory printer.

Loadresource and Lockresource are completely missing

What's more where the usual do nothing IT entrys didn't exist.

That confused me for ages, especially as the end of the IT was right against some code so I couldn't add a couple of entrys to the end of the table.

Kilby...
NchantA
07-06-2001, 12:32 AM
hey Kilby, splaj+ all...

ive unpacked the ebook asshole. just gonna finish it off ;) the thing runs fine (finally) ;)

kilby, im not sure why mine worked and yours didnt. ttu soon

NchantA
NchantA
07-06-2001, 02:12 AM
killed it! one nopped jge blah and it its full...

ima tutor it for all the ppl that wanna know how i unpacked + cracked it. coming soon ;)

NchantA
Kilby
07-06-2001, 03:46 AM
I was probably paying attention to other things :(

DOH !
NchantA
07-06-2001, 07:08 AM
dont stress mate ;) and thanks for the tip on the dialogbox api ;)

nC
madmax
07-07-2001, 12:44 AM
Well, this email extraction program was similar to the adobe password proggy...Specifically, it also had the dialogbox reroute and I think the ASPR check (push 00,ff,call getprocaddress)..thus it didnt take 1.5 days =P

since there's no "jump" table, I had to be creative and fix the two NULL APIs in KERNEL32 on startup to point towards a RET 0004...Im not sure if virgin sections were required, but instinctively I manually dump the sections right after decompression to avoid those pesky ASPR mod's...Did you need to do this??

madmax!
Kilby
07-07-2001, 11:24 AM
Ermm, Gentlemen (and ladies if there any),

this is a DOH moment,

It appears that not only am I unable to type, but also read my own notes :(

I added the WRONG api call (4 bloody times)

As far as I can assertain, aspr has not changed for ages, except for the API check.

I'm off to integity check the rest of my brain

Kilby...
NchantA
07-08-2001, 03:22 AM
poor poor Kilby

friend u need some time off aspr for a while i think eeh, it challenges the rest of us that are even partly sane *g*

madmax: if you are reffering too the 'push ebp | mov ebp, esp| ect..' sections then you can *very* easily change those pointers (using ImpREC ;D) to FreeResource and LoadResource respectively. if u use ImpREC (im not sure about RV) you can even put in the right calls simply by looking at the surrounding imports for example:

kernel32!LoadRecord {example only ;P}
rva:101201 ptr: 293u2u3283 < bad api
kernel32!LockBLah

the last two aspr products i cracked i have done so by simply looking at the surrounding API's and slotting the correct ones in :D fuck alexy heheheheeh

and yes the push ff, getprocaddress must be patched. its one jne ;)

nC [PGC] [EVC]
evil_vile_live_splaj
07-08-2001, 04:31 AM
Hi madmax, the redirected user32!DialogBoxParamA (NOT Indirect as in the code ;) was my newbie experience :-)

My tip for ASPr is set a BPX GetVersion and F12 then see those nice mem locked GETxxxxxxxxx API's you will need to fill in the few blank API' that RV cannot trace :-

0187:00E3C7D8 6A00 PUSH 00
0187:00E3C7DA E82D7CFFFF CALL KERNEL32!GetModuleHandleA
0187:00E3C7DF A3D435E400 MOV [00E435D4],EAX
0187:00E3C7E4 E83B7CFFFF CALL KERNEL32!GetVersion
0187:00E3C7E9 A3D835E400 MOV [00E435D8],EAX
0187:00E3C7EE 68E435E400 PUSH 00E435E4
0187:00E3C7F3 E8347CFFFF CALL KERNEL32!GetVersionExA
0187:00E3C7F8 E8DF7BFFFF CALL KERNEL32!GetCurrentProcess
0187:00E3C7FD A3DC35E400 MOV [00E435DC],EAX
0187:00E3C802 E8DD7BFFFF CALL KERNEL32!GetCurrentProcessId
0187:00E3C807 A3E035E400 MOV [00E435E0],EAX
0187:00E3C80C E8C37BFFFF CALL KERNEL32!GetCommandLineA
0187:00E3C811 A37836E400 MOV [00E43678],EAX

And there is usually the push FFFFFFFF on the 1st GetProcAddress that is nothing more than "mov eax,1" to bypass the api crypto message. I usually make the call 4xxxxx to this point (1 byte patch) Also as madmax pointed out there is no jmp table to conveniently patch the RET004 so I redirect the OEiP and patch it on the fly, replacing dummy API with some code
then jmp OEiP.

I spent the w/e *doing* all the 'Advanced' mail utils from Elcomsoft and also the updated SmartWhois 3.2 from our friends at Tamo :-)

phew I need a break........but I am still working on cracking that crypto for the 'Save' set a BPM 4A5380 R and see the 32k x 16 'real' reg codes. See the comparison at
0187:00419F3B 8BD0 MOV EDX,EAX
0187:00419F3D 8B74241C MOV ESI,[ESP+1C]
0187:00419F41 B904000000 MOV ECX,00000004
0187:00419F46 8BFA MOV EDI,EDX
0187:00419F48 33C0 XOR EAX,EAX
0187:00419F4A F3A7 REPZ CMPSD

and you have the anser but not a real serial....YET !

+SplAj }>
stinky_tsehp
07-11-2001, 03:31 PM
Eternal Bliss (07-05-2001 03:37):
I have attached the copy of ImportREC with the 3rd tracer enabled.
Regards
EB

tried on the notepad asprotected included with mine, the "trap flag" tracer doesn't work on entries rva 63f0-63f8...

so my offer is still there : I offer my tracer.dll with doc to interface with importrec,
ant this new tracer (not seh based but pure ring0 code) will soon work also on win nt/2k/xp...

regards,

+Tsehp


Java protection w/ Crypted Class Loaders: Help, my brain is melting !!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Java protection w/ Crypted Class Loaders: Help, my brain is melting !!!
PDA

View Full Version : Java protection w/ Crypted Class Loaders: Help, my brain is melting !!!

Clandestiny
06-28-2001, 10:24 PM
Hi All,

I stumbled across this Java target recently and (to my untrained Java eye) it appears to be a bit unique. The target is called VisualRoute5.1c and it is available to be downloaded from:

ht*p://download.cnet.com/downloads/0-10145-100-5197284.html?tag=st.dl.10145-106-1.lst-3-13.5197284

First off, I'll be upfront here and admit this is the very first Java protection I've attempted, but I think I can honestly say I've investigated it pretty thouroughly for someone who's never composed a Java bytecode in their life ;)

Here are my findings so far:

The protection seems to consist of 3 main parts:

1) An .exe loader which loads the main .class file via the MS wjview commandline Java class loader.
2) The main class file named vr.class
3) An encrypted vr.bin file

Using JAD to decompile the vr.class file, I discovered that it functions as a loader itself, decrypting and dynamically loading a portion of the vr.bin file as a new class. This appears to be the sole purpose of vr.class and there are no other references to the protection at this point.

Realizing this, I inserted a couple of lines of code to write out the decrypted portion of the vr.bin to disk. Now, I have a new class file which is fully decompilable with JAD. Decompiling my new class, I soon discover that it too possesses loader functionality. Like the original class, it too appears to decrypt a part of that .bin file and dynamically load a new class. ...And here is where I've become stuck....

A couple of ideas have crossed my mind, but I haven't been able to successfully implement them yet (even assuming they would be worthwhile approaches)... Here they are anyway though:

1) First, I thought to rewrite the original class such that it would load the new class from my decrypted disk image. If it was reading the class from my decrypted version, I figured I could make another patch which would write out the next decrypted class to disk before it was loaded just like I did for the first one. So far I haven't managed to successfully rewrite the original loader - probably due to the fact that I've never coded in Java before and many of its "object oriented" intracicies seem to elude my "procedural programming" background.

2) Secondly, I thought to piggyback some of the code where it reads / decrypts the .bin in the second loader, into my original loader and recompile it. For this idea, all I can say is that it recompiled and wrote an empty file... Of course I could have easily done something wrong / overlooked something here too.

After having worked on this for some days now and read quite a few of the (quite scarce) Java Reversing tuts, I have to admit I'm stumped. I'm not sure what the next attack should be or indeed if I am even approaching this protection from the right direction. It would seem that the only tools at my disposal are my JAD decompiler and Filemon. I downloaded a *rudimentary* Java debugger, but it has proved all but worthless for these dynamically loaded classes.

At this point my brain is melting :'( and I'll REALLY appreciate any insight / help / tips anyone can provide.

BTW, in case you just want to take a quick look w/o downloading the target, I'm attaching my 2 decompiled .class files to this post. There is both the original class and my decrypted class within.
original class = vr.jad
decrypted class = vr1.jad

Thanks In Advance :-)

Regards,
Clandestiny
Kayaker
06-30-2001, 03:35 AM
Hi Clandestiny,

Well, you tweaked my interest on this one. Before I started I knew dick-all about Java. Now I know only slightly more than dick-all but, undaunted by my ignorance, I press on ;p But I digress.

Looking at the Filemon output it looks like there are numerous classes decrypted from the original vr.bin file. None of these classes are written to disc however, so I figured they must be being run from memory. So I took a look at things from the more familiar confines of Softice.

Tracing into the original loader VisualRoute.exe shows it calling CreateProcessA with the executable name and command line parameters 'wjview /cp:p vr', which as you mentioned is loading the vr.class file in the MS Java loader. After this is a WaitForSingleObject call which apparently passes control to the loader.

To follow the code from this point I set a bpx on K32Thk1632Prolog, which sets up the stack frame for any system Calls that follow. F11 out of the break and F8 into the next Call (just before K32Thk1632Epilog) and you can trace into whatever program code is called next from Kernel32.

After a couple of calls to OLE32, progam flow led into Msjava.dll at:

0167:7A99691C PUSH EBP
0167:7A99691D MOV EBP,ESP
0167:7A99691F MOV EAX,[EBP+0C]
0167:7A996922 PUSH ESI
0167:7A996923 SUB EAX,00000439
0167:7A996928 JNZ 7A99694B (NO JUMP)
MSJAVA!.text+591A

It seems this is where the java classes in the vr.bin file are "unpacked". This code is called several times, (with a new value in eax) and each time it seems there is new java code in memory (I dumped a total of 46000 bytes of code, and that was only up to the nag box showing!) This code continues to be called once the main window begins to show. The memory address for me began at 1090000.

I haven't been able to disassemble any of the dump(s) with JAD yet, but it seems this is a parsing problem. I get the error message "JavaClassFileParseException: Not a class file (incorrect magic)". The ASCII in the dumps are clearly Java though.

Sooo, I'm wondering if you could patch Msjava.dll to write each class to disc as it's produced. You'd have to find exactly where in the code the class has been decrypted. Or maybe there's a table with all the class names with pointers to the rest of the Java code somewhere. Take a look at Msjava.dll in Exescope and maybe you can load it in winice.dat and break on some of the likely functions (Class_GetName perhaps?). If this works, Filemon shows that the program looks for Msjava.dll in its home directory first, so you could have a patched version just for Visual Routes.

I haven't gone any further with this, but I think the above address in Msjava.dll would definitely be a starting point to figure out how all the classes are decrypted from vr.bin.

BTW, what was the code you wrote to write out the decrypted portion of vr.bin?

Kayaker
Clandestiny
06-30-2001, 03:01 PM
Hiya Kayaker,

First let me say thanks for the reply :). Your suggestion to include the msjava.dll in the winice exports really put things in back into perspective for me. From reading your post, it seems we approached the task on 2 different levels. I was trying to attack it from a strictly source code level, ie. decompiling the .class, injecting code to get it to write out the 'unpacked' class to disk, and then recompiling. Of course, I ran into trouble when I realized it was 'unpacking' another loader which it would use to decrypt and load another class... ad infinitum. Being as I don't know dick-all about Java either, I couldn't get a coding solution to work (ie. rewrite the loader to load the patched, 'unpacked' classes from disk). And every tut I've read on Java reversing lead me to believe SoftICE was useless with Java. Well, apparently that belief is a misconception (at least in this case). Stick with the tools you know, eh ? And who ever heard of Java unpacking anyway ;) ?

Things are finally looking up over here though :-) Following your advice, I included the Msjava.dll into my winice.dat exports and then proceeded to disassemble it to get a listing of all of my bpx options.
And whaddya know ? I recognized the defineClass() function straight from the decompilation of the original vr.class and ClassLoader class its inherited from. Now, I've done more investigation that I want into that Java ClassLoader class and I knew I'd found the ticket right there. Indeed, defineClass is one of the ClassLoader class's very own functions.

***************************************************************

defineClass
protected final Class defineClass(byte data[],
int offset,
int length)

Converts an array of bytes to an instance of class Class. Before the Class can be used it must be resolved.

Parameters:
data - the bytes that make up the Class
offset - the start offset of the Class data
length - the length of the Class data

Returns:
the Class object which was created from the data

***************************************************************

Now, I had everything I needed. All I needed to do was fire up Visual Route in the Sice loader, set a bpx on java_lang_ClassLoader_defineClass0 and wait for Sice to break. Looking at the parameters pushed on the stack and my definition of the defineClass I had both the pointer to the location in memory of my 'unpacked' class and its size.

017F:014E0FFC 8B5508 MOV EDX,[EBP+08]
017F:014E0FFF 897D04 MOV [EBP+04],EDI 
017F:014E1002 896E08 MOV [ESI+08],EBP
017F:014E1005 FF7510 PUSH DWORD PTR [EBP+10] //the size of the class in memory
017F:014E1008 FF7514 PUSH DWORD PTR [EBP+14] //the offset where the class begins (0)
017F:014E100B FF7518 PUSH DWORD PTR [EBP+18] //the pointer to the class image in memory
017F:014E100E FF751C PUSH DWORD PTR [EBP+1C]
017F:014E1011 FF7520 PUSH DWORD PTR [EBP+20]
017F:014E1014 FF5214 CALL [EDX+14] //call loadClass function here
017F:014E1017 81C414000000 ADD ESP,00000014
017F:014E101D 837DEC00 CMP DWORD PTR [EBP-14],00
017F:014E1021 64891D00000000 MOV FS:[00000000],EBX
017F:014E1028 7526 JNZ 014E1050
017F:014E102A F6460455 TEST BYTE PTR [ESI+04],55

Using IceDump I was now sucessfully able to dump the class from memory using the pointer and size from the defineClass parameters. In doing this though I noticed a pecularity (which may have been responsible for the Parse Errors you got from your dumps). It seems that the class pointer from the defineClass function is offset by 8 bytes. Indeed, there seems to be a signature sequence of bytes that defines the beginning of a class and enables you to tell where it begins. Having examined the structure of several other classes now, it seems to be :

CA FE BA BE 00 03 00 2D

By dumping with the pointer + 8 and class size, I was able to get a perfect JAD decompilation of my first 'unpacked' class (named Console.class, btw). And thats about where I am right now. I'm in the process of dumping all of the dynamically loaded classes. When I get them all dumped, I'm optomistic that the protection won't be too hard to find.

What a novelty, "unpacking" a Java app. And they tout Java as being a "secure" language... I guess we've just proved its vulnerable to the "tried an' true" after all ;)

Thanks again for your help, Kayaker :) Let me know if you get your dumps working.

Cheers,
Clandestiny
qferret
06-30-2001, 07:04 PM
hmmm.....using Sice on JAVA....I trust an essay will be coming eventually? ;-)
Kayaker
07-01-2001, 09:05 PM
Hi All,

Did anyone say you couldn't use Softice with Java? ;)

Here's my contribution, just for ?ferret. You handle the rest of it Clandestiny :)

Clandestiny, that was the spot alright! Just before the Call [edx+14] to java_lang_ClassLoader_defineClass0 in msjava.dll you can dump all the java classes just as you said. After doing a few of these I got bored with it and decided to try patching msjava.dll itself to do all the dumping.

BTW, that Call [edx+14] address just seems to be sitting in memory somewhere, no module name given in SI. Do you think that is the ASM for vr.class? And if it is, might you not also be able to code some java lines to dump each class as they come around? Not being able to code this in java myself, I did it with an inline patch.

It worked and I got 130 class files out of it. Then it was 1 line in JAD to decompile them all to readable .jad files. I was considering releasing a patcher for msjava.dll, but I'll just up a zipped copy of my dll. It may not work on everybodys system. It's a Win98SE version, v5.00.3167, File date Apr23 '99, File size 942,080 bytes. Let me know how it goes.

What I did was to set a bp on java_lang_ClassLoader_defineClass0 and immediately jump to the inline patch from there. The Virtual Size needs to be set to the Raw Size (D8000), and the characteristics to E0000020.

Here's the jump point:

------------------------------------------
msjava!com_ms_security_SecurityClassLoader_internalDefineClass
:7A9B7BF2 E9090F0B00 JMP 7AA68B00 ;jump to patch
:7A9B7BF7 90 NOP
:7A9B7BF8 8B4508 MOV EAX,[EBP+08] ;return point
------------------------------------------

The variables:

------------------------------------
000D8AB0 433A 5C4A 6176 6100 2E63 6C61 7373 0000 C:\Java..class..
000D8AC0 0000 0000 0000 0000 0000 0000 0000 0000 ................
000D8AD0 2558 0000 0000 0000 0000 0000 0000 0000 %X..............
000D8AE0 0000 0000 0000 0000 0000 0000 0000 0000 ................

D8AB0 = 7AA68AB0 = "C:\Java"
D8AB8 = 7AA68AB8 = ".class"
D8AC0 = 7AA68AC0 = 3 full dwords for null terminated "dword to ascii" conversion. I used this to increment the filenames (i.e. Java1.class to JavaFFFFFFFF.class)
D8ACC = 7AA68ACC = filename incrementer
D8AD0 = 7AA68AD0 = wsprintfA format-control string (%X)
D8AD4 = 7AA68AD4 = store object handle for CreateFileA
D8AD8 = 7AA68AD8 = pointer to number of bytes written for WriteFile
D8AE0 = 7AA68AE0 = buffer for lstrcpy/lstrcat commands, and final filename
---------------------------------------

...continued...
Kayaker
07-01-2001, 09:07 PM
And the patch:

--------------------------------------
:7AA68B00 60 PUSHAD ;save registers
:7AA68B01 FF05CC8AA67A INC DWORD PTR [7AA68ACC] ;increment filename counter
:7AA68B07 FF35CC8AA67A PUSH DWORD PTR [7AA68ACC]
:7AA68B0D 68D08AA67A PUSH 7AA68AD0
:7AA68B12 68C08AA67A PUSH 7AA68AC0
:7AA68B17 E875CA4E45 CALL USER32!wsprintfA ;converts incremented dword to ascii
:7AA68B1C 58 POP EAX ;silly non-conventional wsprintf
:7AA68B1D 58 POP EAX ;needs the 3 dwords that were pushed
:7AA68B1E 58 POP EAX ; popped off the stack!

:7AA68B1F 68B08AA67A PUSH 7AA68AB0
:7AA68B24 68E08AA67A PUSH 7AA68AE0 ;filename buffer
:7AA68B29 E8CAE75045 CALL KERNEL32!lstrcpy ;copy "C:\Java" to buffer
:7AA68B2E 68C08AA67A PUSH 7AA68AC0
:7AA68B33 68E08AA67A PUSH 7AA68AE0
:7AA68B38 E832E85045 CALL KERNEL32!lstrcat ;concatenate with incremented ascii
:7AA68B3D 68B88AA67A PUSH 7AA68AB8
:7AA68B42 68E08AA67A PUSH 7AA68AE0
:7AA68B47 E823E85045 CALL KERNEL32!lstrcat ;concatenate with ".class"

:7AA68B4C 6A00 PUSH 00
:7AA68B4E 6A20 PUSH 20
:7AA68B50 6A02 PUSH 02
:7AA68B52 6A00 PUSH 00
:7AA68B54 6A01 PUSH 01
:7AA68B56 6800000040 PUSH 40000000
:7AA68B5B 68E08AA67A PUSH 7AA68AE0 ; pointer to filename
:7AA68B60 E876EF5045 CALL KERNEL32!CreateFileA
:7AA68B65 A3D48AA67A MOV [7AA68AD4],EAX ;save object handle
:7AA68B6A 6A00 PUSH 00
:7AA68B6C 68D88AA67A PUSH 7AA68AD8 ;# bytes written
:7AA68B71 FF7510 PUSH DWORD PTR [EBP+10] ;size of class
:7AA68B74 8B4518 MOV EAX,[EBP+18] ;start of class signature
:7AA68B77 83C008 ADD EAX,08 ;8 bytes to the right is
:7AA68B7A 50 PUSH EAX ;start of class proper
:7AA68B7B FF35D48AA67A PUSH DWORD PTR [7AA68AD4] ;object handle
:7AA68B81 E84BE45045 CALL KERNEL32!WriteFile ;write the damn thing
:7AA68B86 FF35D48AA67A PUSH DWORD PTR [7AA68AD4]
:7AA68B8C E8DC545145 CALL KERNEL32!CloseHandle ;close its handle

:7AA68B91 FC CLD ;routine for zeroing out filename buffer
:7AA68B92 BFE08AA67A MOV EDI,7AA68AE0
:7AA68B97 B906000000 MOV ECX,00000006
:7AA68B9C 33C0 XOR EAX,EAX
:7AA68B9E AB STOSD
:7AA68B9F 49 DEC ECX
:7AA68BA0 83F900 CMP ECX,00
:7AA68BA3 75F9 JNZ 7AA68B9E

:7AA68BA5 61 POPAD ;restore registers
:7AA68BA6 55 PUSH EBP ;replace original code
:7AA68BA7 8BEC MOV EBP,ESP
:7AA68BA9 83EC24 SUB ESP,24
:7AA68BAC E947F0F4FF JMP 7A9B7BF8 ;jump back to program code
--------------------------------------

I haven't tried the patched msjava.dll with any other java apps. Might work. Might not. Usual disclaimer applies. Haven't found the protection in the decompiled class files either but KeyValueLine.jad looks interesting ;)

This was fun! Regards,
Kayaker
Clandestiny
07-02-2001, 06:52 PM
Hi Kayaker,

GREAT job on the Java dumper :) I tried it out today and it works perfectly. One problem though... By any chance did you get a decompiled V.class ? I'm badly needing a copy of it and it does not show up in my listing of dumped classes which is strange given that Splash.class needs it loaded in order to run. If you've got a copy over there from your dump, please send it over to me. I'm getting ready to test my Java class reloader patch to MsJava.dll, but I need to get a recompilable version of my patched class. Right now I've *almost* got Splash.class to recompile for me, but I've had a big problem with the imports :( Damn Java compiler has *way* to much error checking ;) I found out that I basically had to recreate the directory structure of the Java "package" of imported and referenced classes for Splash.class in order to get it to recompile. I've got em all but that V.class which I can't find to save my life.

Later,
Clandestiny
Kayaker
07-02-2001, 07:39 PM
Sure Clandestiny, check your mail.

I tried it with another Java app, and it dumped its class files, but these weren't packed in a .bin file anyway, so all it did was duplicate the class files that were already present. At least it indicates that the patch should work as a class dumper in all cases.

Kayaker
qferret
07-02-2001, 08:09 PM
Kayaker (07-02-2001 17:39):

At least it indicates that the patch should work as a class dumper in all cases.

Kayaker

Very Cool 8)
Duelist
07-03-2001, 07:04 AM
Very nice approach on this one, congratulations!

I've done this application myself in the past, but I coded a decrypter for vip.class, your approach is much clever. Will you be releasing the class dumper anytime soon? ;-)

Clandestiny, you can restore package directory structure by using "jad -d decompiled -r *.class", and you'll get everything in the place it should be. V.class is actually the class where the protection resides, as far as I remember.

Keep up the nice work. :-)
Kayaker
07-03-2001, 03:16 PM
Duelist (07-03-2001 05:04):
Very nice approach on this one, congratulations!

Will you be releasing the class dumper anytime soon? ;-))

Thanks Duelist. Clandestiny did the hard work of ferreting out java_lang_ClassLoader_defineClass0 from the mess of import functions, I just whipped off a dumb dumper patch.

Ahh, but a stand-alone class dumper utility that will work on any system? Yes, that's the next logical step and I've already begun work on the idea. The 1st thing I'd like to do is parse each class in memory to get the original filename, instead of just saving them to a default name.

If anybody finds any more apps with these encrypted/packed class files, I think both of us would appreciate word of it just for testing purposes.

Cheers,
Kayaker
Rex
07-08-2001, 03:07 PM
Hi guys!

I've came across this app some time ago. Few notes: it is pure (almost) java and no tampering with Windows native dlls is needed. The dll is just bootstrapper to run java VM - if you have JDK or runtime installed try to run 'java vr'. If you decompile vr.class found in the install dir - you'll see as you rightly mentioned that it functions as class loader to load from vr.bin. The vr.bin contains classes that are mangled - the vr.class does the loading and decoding. So I have taken the decompiled vr.class (using jad) and reworked it a bit to dumper - pure java...works on all platforms
Also if you look into data directories there are filesnames that end with '+' - those are crypted too. So I have taken a look and made the decryptor.
A small note: the included sources worked with older versions - in the last one I think they did this:
vr.class loads another vr.class from vr.bin - the values or algorithm is a bit different (uses other constants) - so you have to dump the vr.class from vr.bin and then use that as a base for dumper.

Hope this helps and brings a java approach to this...

Rex

As it seems there can only be 1 attachement I post source code to dumper here and as attachement will be the decoder for *.txt+ files....
---------------- file dumper.java starts here ----------------------------
// Dumps all classes from vr.bin and puts the .class files to appropriate dirs
// Made by Rex
// usage: java dumper

import java.io.*;
import java.util.Hashtable;
import java.util.Enumeration;
import java.util.StringTokenizer;

public class dumper
{

public dumper()
{
g_by = null;
g_cl = new Hashtable();
}

public static void main(String [] args)
{
(new dumper()).dumpAll();
}

private static String eName(String s)
{
char ac[] = s.toCharArray();
for(int i = 0; i < ac.length; i++)
ac[i] ^= 'Z';

return new String(ac);
}

public void dumpAll()
{
char c = File.separatorChar;
if(g_by == null)
{
g_by = new Hashtable();
long l = 0xea1255adaabefa07L;
RandomAccessFile randomaccessfile = null;
try
{
randomaccessfile = new RandomAccessFile("vr.bin", "r");
randomaccessfile.seek(randomaccessfile.readInt() != 0xdeadfeed ? 0 : randomaccessfile.readInt());
while(randomaccessfile.getFilePointer() < randomaccessfile.length() && l == randomaccessfile.readLong())
{
String s1 = randomaccessfile.readUTF();
byte abyte2[] = new byte[randomaccessfile.readInt()];
int k = randomaccessfile.readInt();
randomaccessfile.readFully(abyte2);
if(k == 1)
g_by.put(s1, abyte2);
}

}
catch(Exception exception)
{
System.out.println(exception.toString());
}
finally
{
try
{
randomaccessfile.close();
}
catch(Exception _ex) { }
}
}
Enumeration enum = g_by.keys();
int count = 0;
while (enum.hasMoreElements())
{
String s = (String)enum.nextElement();
byte abyte0[] = (byte[])g_by.get(s);
if(abyte0 != null)
{
int i = 7;
for(int j = 0; j < abyte0.length; j++)
{
i = i * 67 + 1021;
abyte0[j] ^= i;
}

try {
StringTokenizer st = new StringTokenizer(eName(s), ".");
String filepath = "./";
String filename = null;
if (st.countTokens() > 1) {
int j = st.countTokens();
for (i = 0; i < j - 1; i++)
filepath = filepath + st.nextToken() + "/";
}
filename = st.nextToken() + ".class";
try
{
(new File(filepath)).mkdirs();
} catch(Exception _ex) { }
FileOutputStream fo = new FileOutputStream(filepath + filename);
System.out.println(count++ + " Dumping file " + filename + " into directory " + filepath);
fo.write(abyte0);
fo.close();
} catch (Exception e) { System.out.println("Error: " + e); }
}
}
}

private Hashtable g_by;
private Hashtable g_cl;
}
Clandestiny
07-10-2001, 07:01 PM
Hi Rex,

Thanks for replying :) Recoding the vr.class was my first approach. Unfortunately, being as I've never coded in Java, it took me much futile effort to realize I lacked the skills to get a Java coded dumper to work. It's nice to see a working implementation of it though ;) Thanks.

Kayaker's suggestion to have a look at the Msjava.dll was the ticket for me. Using the tools I know (ie. Sice and IceDump), I was able dump the relevant classes from memory and decompile them. From there it wasn't too terribly difficult to locate the protection in the Splash.class. After finding the protection, I actually disassembled the class, patched the opcodes in a hex editor, and wrote a small reloader patch into Msjava.dll so that it would reload that particular class during runtime. The prog now reloads the patched class and *thinks* its registered...no keygenning or Java coding required ;-). Perhaps not the optimal solution from a distribution standpoint, but hey I don't distribute cracks anyway ;)

BTW, Rex (or anyone else) have you ever ran across any other "packed" or "encrypted" Java apps ? If more of these exist, I was thinking about writing a small stand-alone reloader prog to runtime patch the Msjava.dll for reloading patched classes on demand. I've been hunting around a bit, but every Java prog I find seems to have its .class files sitting right there in naked plain view.

Regards,
Clandestiny
Rex
07-11-2001, 03:13 AM
Hi Clandestiny and others!

I play with Java for some years onw so I have chosen the Java approach. What I was trying to tell is that the Visual Route is (almost) pure Java. Lemme explain: if you look into Solaris or Linux distribution they are almost the same - the only difference is in bin directory as this contains native files (for ICMP/ping as this cannot be done in Java). The vr.class, vr.bin and data directories are the same. That means that you can create pure Java (as I have done) dumper, keygen, decryptor....

To this kind of protection: I haven't really seen it anywhere else. The more usual way to handle the protection of Java code is to use some kind of scrambler that removes the real names from classes, renames the classes and changes the code the way it is hardly understandable (in case of good protectors you won't get a shit from it - it's a mess)

Hope this helps and brings a bit light into Java matters. If anyone has some serious questions in the field of Java try to ask me. If I know the answer I'll gladly share it with you.

Rex

Clandestiny (07-10-2001 17:01):
Hi Rex,

Thanks for replying :) Recoding the vr.class was my first approach. Unfortunately, being as I've never coded in Java, it took me much futile effort to realize I lacked the skills to get a Java coded dumper to work. It's nice to see a working implementation of it though ;) Thanks.

Kayaker's suggestion to have a look at the Msjava.dll was the ticket for me. Using the tools I know (ie. Sice and IceDump), I was able dump the relevant classes from memory and decompile them. From there it wasn't too terribly difficult to locate the protection in the Splash.class. After finding the protection, I actually disassembled the class, patched the opcodes in a hex editor, and wrote a small reloader patch into Msjava.dll so that it would reload that particular class during runtime. The prog now reloads the patched class and *thinks* its registered...no keygenning or Java coding required ;-). Perhaps not the optimal solution from a distribution standpoint, but hey I don't distribute cracks anyway ;)

BTW, Rex (or anyone else) have you ever ran across any other "packed" or "encrypted" Java apps ? If more of these exist, I was thinking about writing a small stand-alone reloader prog to runtime patch the Msjava.dll for reloading patched classes on demand. I've been hunting around a bit, but every Java prog I find seems to have its .class files sitting right there in naked plain view.

Regards,
Clandestiny
luc
07-11-2001, 11:01 AM
So it dump each class it load on disk..
Bye
Luc
Rex
07-12-2001, 03:54 AM
luc (07-11-2001 09:01):
So it dump each class it load on disk..
Bye
Luc

Modifying standard ClassLoader won't help as it's not it that does the class loading - it is done by vr.class. vr.class extends ClassLoader to provide loading from vr.bin - that's exactly what ClassLoaders are for - loading classes from 'unusual' locations. For example you have JarClassLoader (that loads from .jar archives) or URLClassLoader (that loads from provided URL whether raw classes or jars) in standard Java runtime.

Rex
guruace70
11-02-2003, 08:58 PM
Modifying standard ClassLoader won't help as it's not it that does the class loading - it is done by vr.class. vr.class extends ClassLoader to provide loading from vr.bin - that's exactly what ClassLoaders are for - loading classes from 'unusual' locations. For example you have JarClassLoader (that loads from .jar archives) or URLClassLoader (that loads from provided URL whether raw classes or jars) in standard Java runtime.

Rex
:o

You may want to try on the BIG stuff: hxxp://silicongenetics.com/. If you found something exciting, please let me know.
Clandestiny
11-12-2003, 10:16 AM
:o
You may want to try on the BIG stuff: hxxp://silicongenetics.com/. If you found something exciting, please let me know.

Perhaps, but a little more info would be in order. Without a bit more to go on, this sounds suspiciously like a crack request. Have you looked at this target yourself? Does this target use a similar method of loading encrypted .class files?
Have *you* found something exciting?

Regards,
Clandestiny
guruace70
11-13-2003, 12:33 AM
Without a bit more to go on, this sounds suspiciously like a crack request. Have you looked at this target yourself? Does this target use a similar method of loading encrypted .class files?
Have *you* found something exciting?

Regards,
Clandestiny[/QUOTE]

I could not find a right Java debugger right now. I will look at it in detail and come back to you. I have had my hands on over 100 big stuffs, so it is unlikely a crack requrest.
dELTA
11-13-2003, 05:31 AM
Had your hands on over 100 big stuffs, huh? Yeah, now I'm sure there's no doubt in anyones mind anymore... :rolleyes:

PS.
Randy Spears had his hands on over 100 big stuffs too (and also inside a bunch of cracks for that matter)...


windows XP hardware-sensing product activation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > windows XP hardware-sensing product activation
PDA

View Full Version : windows XP hardware-sensing product activation

spamal
06-29-2001, 01:37 PM
Regarding questions about what hardware changes would trigger a reactivation, Nieman
told me that the reality is, as expected, less dramatic than what many people fear. "Basically, if you do a substantial upgrade, you'll be asked to reactivate," he said. "Standard upgrades—adding a new hard drive or network card, for example—won't require you to reactivate." Also, making many changes to your system will eventually trigger a need to
reactivate. Nieman compared the hardware configuration check to the one Windows uses to determine whether you need a new driver when you add hardware to your system and then
reboot. For security reasons, Microsoft won't say what exactly triggers the reactivation.
spamal
06-29-2001, 02:23 PM
from win2k mag...

Additionally, you can choose to activate your OS by calling Microsoft and reading the 50-digit number to a carbon-based life form (rather than sending it to a silicon-based server). The recipient will then read a 42-digit number to you, which you key in to complete your activation. Unfortunately, that's a one-time-only 42-digit value; should you need to reinstall the OS on that system, you must call Microsoft to get another code.

As I explained last month, a Microsoft server then stores your 50-digit code and your product key in a database. If someone tries to activate a different machine using your product key, the database will see that someone's tried to install the same copy of the OS on two different machines and will refuse to authorize the activation. Additionally, every time you boot that system, the system recomputes the 50-digit value and, if it's too different from the one used to activate the system in the first place, the OS will demand that you once more connect to the Internet to reactivate your copy. Small hardware changes won't require reactivation. If, however, you lend your neighbor your Windows XP CD-ROM and product key and he installs it on his system and tries to activate it, the Microsoft server will see a radically different set of hardware trying to activate an already activated copy of Windows XP, and will tell your neighbor's system not to activate itself.

But how much hardware difference is "too much"? Nieman wouldn't say because (1) Microsoft hasn't finished Windows XP yet, so anything he'd say might change, and (2) he didn't want to make life easier for pirates. A reasonable answer, but I argued that a determined bunch of people with a closet full of hardware and a day or two to play around could (and would) soon figure that out, so why not just release the information anyway? He demurred, but told me to stay tuned, because Microsoft might publish that information come shipping time anyway.
tsehp
06-29-2001, 07:27 PM
Such a big deal ! They seem to have reinvented a big heavy wheel that will crush
normal and legal users as always... Reversers will always find a solution for this,
and the result could be a big rush on protection-removed future copies of windows xp ;-)

A beginning of public discussion almost began on this subject, but concerning office xp. We should not expose some serious info here before their final release, just to make their protector's life harder.
spam
07-01-2001, 10:40 PM
Agreed. Will pursue project "underground" and publish here only as needed.


To make a point on latest asprotect 1.2, applied to aoepr.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > To make a point on latest asprotect 1.2, applied to aoepr.exe
PDA

View Full Version : To make a point on latest asprotect 1.2, applied to aoepr.exe

tsehp
06-29-2001, 04:55 PM
with this elcomsoft prog, you can recover your encrypted m$ outlook passwords
here's what to do with revirgin when you have dumped the exe.
I've included my iat table as attachment...

after examining iat's
4d1460->push ebp mov esp,ebp pop ebp pointed to code loc 45299c with 4d1564, this code loc does the same
you have to hard code the 45299c (dumped target's code loc that does the same) value into IT of your exe,
if realigned, just go to rva offsets d1460 and d1564 off course.

4d1474 returns ffe5f60b in eax, but looking at the var it's just the same as [11d35dc], so just put
the right api address by hand into revirgin

same technique for 4d14fc (getversion) 4d1478 (getcurrentprocessId)

aoepr checks for asprotect api presence at
seg000:0040251C push 4 ; lpProcName
seg000:0040251E push 0FFFFFFFFh ; hModule
seg000:00402520 call GetProcAddress
seg000:00402525 mov ds:dword_4C8A08, eax
seg000:0040252A test eax, eax
seg000:0040252C jnz short locret_40254C <-naughty

also, a test for registration is at 40276e

seg000:0040276E test eax, eax <-change this please ;-)
seg000:00402770 jnz short loc_402774
seg000:00402772 xor eax, eax
seg000:00402774
seg000:00402774 loc_402774: ; CODE XREF: sub_4026CC+A4j
seg000:00402774 pop edi
seg000:00402775 pop esi
seg000:00402776 mov esp, ebp
seg000:00402778 pop ebp
seg000:00402779 retn
seg000:00402779 sub_4026CC endp
seg000:00402779

I included the small code that alexey used to initialize the pointers.

0177:011CC7D8 PUSH 00
0177:011CC7DA CALL KERNEL32!GetModuleHandleA
0177:011CC7DF MOV [011D35D4],EAX
0177:011CC7E4 CALL KERNEL32!GetVersion
0177:011CC7E9 MOV [011D35D8],EAX
0177:011CC7EE PUSH 011D35E4
0177:011CC7F3 CALL KERNEL32!GetVersionExA
0177:011CC7F8 CALL KERNEL32!GetCurrentProcess
0177:011CC7FD MOV [011D35DC],EAX
0177:011CC802 CALL KERNEL32!GetCurrentProcessId
0177:011CC807 MOV [011D35E0],EAX
0177:011CC80C CALL KERNEL32!GetCommandLineA
0177:011CC811 MOV [011D3678],EAX
0177:011CC816 RET

So with those init's, he can avoid redirecting tha iat entries to the api wrapper, he just emulates the result.
Well as long as he limits to simple iat's, it's not a real problem...Otherwise he's forced to emulate all of them,
then we'll see a new os rise : asprotect winbloze...

cia,

tsehp


help crack foxweb for suddendischarge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help crack foxweb for suddendischarge
PDA

View Full Version : help crack foxweb for suddendischarge

tsehp
07-01-2001, 03:52 AM
hi,
again the suddendischarge site still have problem with their own host program.
Just click tools at their main page www.suddendischarge.com and you'll see the
"evaluation expired" message.

can someone crack this please ? ;-)
evil_SplAj
07-01-2001, 05:06 AM
Hey Kayaker , do you want to delete this crack request and ban the author or should I !!! ;)
......actually looks like a good virgin challenge, can't see any cracks/serials on astalavista / google etc etc

Arbitar :* , here is a good test for your special uber-l33t skills, forget snagit :-)

+SplAj }>
Kayaker
07-01-2001, 05:37 AM
evil_SplAj (07-01-2001 03:06):
Hey Kayaker , do you want to delete this crack request and ban the author or should I ;)

+SplAj }>

Ahhh, judgement call isn't it? Maybe leniency and directions to the FAQ might be in order in this case. I'll let you decide. :D

I can't see why there's always this 30 day problem with the host program, I mean, according to the home site an unlimited license is only $14,950. Maybe we could take up a collection, let's see, with 623 members that would be...mumble...click...carry the 1...only $24 each!!

Or, how about making it a mini-project, heh heh?

Kayaker
tsehp
07-02-2001, 04:24 AM
(got a hard way coming back to the mb, being auto banned by the stupid bot, I've built for this)

ok, things are fixed now at suddendischarge, I used your card number splaj (stolen from you when you came to visit me in Paris) to reactivate 30 more days to the sudden discharge site license. :-)


Is this legal?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is this legal?
PDA

View Full Version : Is this legal?

Stick
07-01-2001, 05:41 PM
I've cracked a piece of server software. As I'm aware, it's legal to crack a piece of software and use it myself. I'm not planning to distribute the software, but is it legal to run the server software and allow public access to it? I tried looking at the various laws on cracking, but I wasn't able to find out if it was legal or illegal.

Thanks in advance
IcyDee
07-01-2001, 06:16 PM
It is legal (in some countries) to 'reverse engineer' a program that you own.

It is not legal (in any country AFAIK) to 'crack' a program which you do not own, or have not paid to be 'unlocked'.

So, if you have a legal copy, why do you need to run a cracked copy on your server?
Stick
07-01-2001, 07:06 PM
The software had a few restrictions that I removed. The thing that interests me, that if people are accessing the server, does it still classify as personal use?
Romeo DeVille
07-01-2001, 10:23 PM
No, it's not legal, if you want a simple answer without an explanation.

And if you're so concerned about 'legality', why do you crack programs you didn't write anyway?
spam
07-01-2001, 10:45 PM
The DMCA still has to be played out in the courts, but it does have a provision allowing for reversing software that you own for your own safety and protection... however, you can not share your results with others. It is probably legal, but it will be up to the mood of the judge on that particular day.
Eternal Bliss
07-02-2001, 05:00 AM
IcyDee (07-01-2001 16:16):
It is legal (in some countries) to 'reverse engineer' a program that you own.

It is not legal (in any country AFAIK) to 'crack' a program which you do not own, or have not paid to be 'unlocked'.

So, if you have a legal copy, why do you need to run a cracked copy on your server?

I always thought that even if you pay for a software, it is NOT yours. It's just that you pay for the RIGHT to use it but not OWN it.

Regards
EB
qferret
07-02-2001, 04:16 PM
Good point EB....you "purchase" a "license" to use the software (on a single computer unless specified otherwise)

The EULA for most software specifically prohibits distribution of full versions, reverse engineering, disassembling, etc.

If you can't even look at a disassembly legally, how can you crack (or in this case, it sounds more like a valid patch) without it being illegal.

Of course alot of this depends not on legality, but your country of origin's amout of cooperation with other authorities ;-)
p1lchard
07-05-2001, 01:04 PM
Certainly in the UK if you buy software you OWN it, period; this is irrespective of the EULA. Reverse engineering it is also legal, as it comes under fair use for something you own. This may well change when Europe gets its own version of the DCMA.. although I believe this won't happen for a good while yet :)
QC_SplAj
07-16-2001, 05:03 AM
Everything is legal.......until a law is made.....

for u yankees :-
http://www.lgu.com/publications/softcopy/8.shtml

for u Euroboys:-
http://www.lgu.com/publications/international/3.shtml

....and the rest of us can crack away merrily :-)

Salam }>
splaj
07-22-2001, 04:49 AM
Poor Elcomsoft have lost one of their employees to the FBI ;)

http://www.cnn.com/2001/LAW/07/20/ashcroft.cybercrime.ap/index.html

and check out the latest at Elcomsoft re the aebpr v. adobe saga............


help with dissasemble of dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help with dissasemble of dll
PDA

View Full Version : help with dissasemble of dll

ET
07-03-2001, 02:10 AM
i need help reverse engineering a dll.. i've done the usual things like bypassing jumps and such, but even though the license.exe (that calls the dll) says the program is activated/registered, it still runs in demo mode.. this is my first attempt at anything other than crackme's, and so far it isn't going good.. i think i bit off more than i can chew! but i've racked my brains, and can't give up now.. please help me understand what i've missed..

here's what i've done so far:

if you search the substrings, you'll find 'Code Successful!'.. above that in the code is a test function followed by a jump.. i've changed the test function, changed the jump, even NOP'ed the test and jump.. everything gives me the 'Code Successful!' window, but the program still operates in demo mode..

any help greatly appreciated.. i have to say i've been getting great help so far from the Lockless 2K forum and their crackers over there..

-ET
rimmy
07-03-2001, 03:29 AM
How do you know that the program runs in demo mode ? You've got to find something like "I'm running in demo mode" in the program itself. Then trace the code backward and find out why it makes such a stupid decision, correct it and everything will be OK.
CoDe_InSiDe
07-03-2001, 03:41 AM
Hi ET,

I've taken a quick look at it :)
Check where the call (Not the Ordinal call ;) ) will go after the "Code Successfull".
There you'll see it'll search for a file called "ffx2.lic" dunno if you already have that or that it exists or something :)
It also opens Registry keys here and there ;)
so there are probably more checks to see if your really Registered or not ;)
Hope this helps.

Cya...

CoDe_InSiDe
ET
07-03-2001, 09:44 AM
CoDe_InSiDe (07-03-2001 01:41):
Hi ET,

I've taken a quick look at it :)
Check where the call (Not the Ordinal call ;) ) will go after the "Code Successfull".
There you'll see it'll search for a file called "ffx2.lic" dunno if you already have that or that it exists or something :)
It also opens Registry keys here and there ;)
so there are probably more checks to see if your really Registered or not ;)
Hope this helps.

Cya...

CoDe_InSiDe

thank you very much for looking at this!

how do i know this is still operating in demo mode? this is a dll to an image filter, and in demo mode it has a red X over the image..

i can't find any ffx2.lic files on my system, unless it creates them on the fly.. i do have a ffx2.dll and ffx2dlg.dll.. regardless, i removed the call to ffx2.lic, but still a no go.. big red X..

i also removed the call to the environment variables, but it still operates in Demo mode.. i can see in the registration information it generates a 'fingerprint' number of your system. i assume a keygen is really what i need, but that's above my head..

any other pointers? please help me figure this out! if you want the complete program this dll goes with, it's BigFX FilmFX 2.32.. you can downloadl it here:

http://www.bigfx.com

-ET
Fake51
07-03-2001, 10:06 AM
Instead of searching for the switch between full and demo mode, you might want to consider searching for the code, that smothers the image with that big red X. I think one or two of Orcs docs cover the issue, and Fravia's site has some texts on the issue. It might be worth the trouble (since some dumbass programmers leave very obvious marks in the code, clearly showing where they smother the image).

Blue skies
Fake
ET
07-03-2001, 12:02 PM
Fake51 (07-03-2001 08:06):
Instead of searching for the switch between full and demo mode, you might want to consider searching for the code, that smothers the image with that big red X.

ahh, good idea.. i'll start a search immediately.. thanx!

-ET
ET
07-03-2001, 01:57 PM
*sigh* with my meager skills, i couldn't locate where the code put the red X over the image.. i would very much appreciate any help in decyphering this puzzle, i'm very eager to learn what i'm doing wrong..

-ET
ET
07-03-2001, 06:08 PM
ET (07-03-2001 11:57):
*sigh* with my meager skills, i couldn't locate where the code put the red X over the image.. i would very much appreciate any help in decyphering this puzzle, i'm very eager to learn what i'm doing wrong..

-ET

anybody?

-ET
qferret
07-03-2001, 08:29 PM
I haven't actually checked the program, but here's a few ideas.

it's looking for the .lic file.....It will check for this at program start too, and who knows how many other places. Create the file. Download Regmon and Filemon from sysinternals.com and find out what reg keys it's checking & what bytes in the file it's checking.

Between those 2 programs and BPX'ing a few API's that access/read from/write to files (check your API reference, get one if you don't have one). You should be able to create a license file from the ground up.

You may be right though, it may be more than you can chew at this time......but don't let that stop you from giving it the ol' college try! ;-)
ET
07-04-2001, 12:55 AM
qferret (07-03-2001 18:29):
it's looking for the .lic file.....It will check for this at program start too, and who knows how many other places. Create the file. Download Regmon and Filemon from sysinternals.com and find out what reg keys it's checking & what bytes in the file it's checking.

i got those two programs (thank you very much, good stuff) and used them.. at no time during the licensing program did i see the mysterious ffx2.lic file show up as being called in Filemon.. i did use regmon to open the regedit locations called by the licensing program, but most of the locations were empty when i went there.. does it create these on the fly? perhaps i'm not looking for the right thing..

Between those 2 programs and BPX'ing a few API's that access/read from/write to files (check your API reference, get one if you don't have one). You should be able to create a license file from the ground up.

i'm not sure i understand what BPXing is (bypassing?)..

You may be right though, it may be more than you can chew at this time......but don't let that stop you from giving it the ol' college try! ;-)

i'm sure now i've got a mouthful of code i can't chew! definitely over my head, but i'm learning tons fast.. PLEASE keep looking at this and pointing me in the right direction.. i'm very eager to figure this out, and gratefull for the help i've received.. :)

although i'm sure i'm coming across as an annoying college idiot, i haven't been in college for 12 years! bear with me.. this is exciting!

-ET
CyberHeg
07-04-2001, 01:12 AM
Instead of looking into patching this you should rather try keygenning it. Why? Simply because it's easier. I broke this program so time ago so lemme see if I can refresh my memory.

The license file you are all talking about is created during the installation. It is containing some system infomation and a time stamp if I remember correct. This is nothing to worry about.

You should try to enter a fake code into the license manager program and follow it. If I remember correct it will be directly compared byte for byte with the real serial. Atleast I remember that the real serial gets calculated in memory and if you enter that one then you get success.

So how to keygen this? The code in the dll uses that license file like you guys wrote and does all other good stuff in order to make a real serial. What I did was instead of letting the compare happen then I would return the serial and actually changing the parameter list of the function.
In C syntax I modified it to something like

char *(cannot remember the name of the export) (char *prollyname, and whatever goes there)

(the important part is the char * at the front instead of void or bool which was there originally)

Then I made sure the address of the string which holds the serial after the generation gets returned in eax so the above syntax will be used.

Keygenning this was actually the easiest part. Instead of ripping out the code I just called the dll and grabbed the serial out on return.
Now there are no more worries. The license file created during installation will be used and a code generated for you.

Just as a test. If you choose to make this keygen. Try first to generate a key on a clean computer just before the installation of the program. Next try to generate again when asked for it from the program. Those generated keys will not be the same.

My point of all this is that why waste time on ripping code/patching when the auther kindly gave you most of the needed to make a keygen.

Hope this is helpful to you.

// CyberHeg
morlac.
07-04-2001, 04:59 AM
Hi ET,

I think i came by a similar problem 2 years ago with a plugin for lightwave and Photoshop.
I remember that removing the license check or even generating one was very tiresome. So, I opted for removing the red 'X' mark.
How I did it? Well, first i rendered an image with a default resolution first and I then looked at the dimensions of the X. Then I searched the code for those numbers and violla. I cought it. There were two calls to the the big red 'X' routine. Actually, there were 2 different functions that handle the 'X' drawing.
I cant remember but what i said. Sorry. Hopefully, Itll give you an idea.

Morlac.

PS - When looking at the 'X', try measuring its height and width.
ET
07-04-2001, 12:32 PM
Hi ET,
I think i came by a similar problem 2 years ago with a plugin for lightwave and Photoshop.
I remember that removing the license check or even generating one was very tiresome. So, I opted for removing the red 'X' mark.
How I did it? Well, first i rendered an image with a default resolution first and I then looked at the dimensions of the X. Then I searched the code for those numbers and violla. I cought it. There were two calls to the the big red 'X' routine. Actually, there were 2 different functions that handle the 'X' drawing.
I cant remember but what i said. Sorry. Hopefully, Itll give you an idea.

Morlac.

PS - When looking at the 'X', try measuring its height and width.

morlac,

this seems like the easiest fix (in light of how hard it is to patch the dll).. but the X is dynamic in size, not fixed.. i've used it on movies as little as 280x160 and as big as film res (4096x2024).. always there, covering the whole image from corner to corner.. because of this, i can't find any reference or obviosity as to where the X is actually calculated.. i DO know which program part it's in.. the program comes with a few dlls, one EXE for licensing, and two After Effects filters (one film grain, one film color).. it's the film color filter that puts the X on the image.. i've decompiled it, but again, with my meager skills i'm obviously missing the right code.. perhaps if someone else took a peek..? ;)

CyberHeg (07-03-2001 23:12):
Instead of looking into patching this you should rather try keygenning it. Why? Simply because it's easier. I broke this program so time ago so lemme see if I can refresh my memory.

i have assumed from the beginning this would be the final route taken..

The license file you are all talking about is created during the installation. It is containing some system infomation and a time stamp if I remember correct. This is nothing to worry about.

You should try to enter a fake code into the license manager program and follow it. If I remember correct it will be directly compared byte for byte with the real serial. Atleast I remember that the real serial gets calculated in memory and if you enter that one then you get success.

how exactly do you follow/trace the comparison? softice? i haven't used it much so far, just w32dasm and hex editors (and now filemon/regmon)..

So how to keygen this? The code in the dll uses that license file like you guys wrote and does all other good stuff in order to make a real serial. What I did was instead of letting the compare happen then I would return the serial and actually changing the parameter list of the function.
In C syntax I modified it to something like

char *(cannot remember the name of the export) (char *prollyname, and whatever goes there)

(the important part is the char * at the front instead of void or bool which was there originally)

Then I made sure the address of the string which holds the serial after the generation gets returned in eax so the above syntax will be used.

ok, i'm lost.. logically, i completely understand what you're saying.. i just don't know how to implement it.. if you return the serial# into eax, how do you retrieve it?

Keygenning this was actually the easiest part. Instead of ripping out the code I just called the dll and grabbed the serial out on return.
Now there are no more worries. The license file created during installation will be used and a code generated for you.

YES, this is exactly what i'd like to do..

Just as a test. If you choose to make this keygen. Try first to generate a key on a clean computer just before the installation of the program. Next try to generate again when asked for it from the program. Those generated keys will not be the same.

you're saying read the eax register before installing/licensing, then read it again after? if i modify the code to put the correct serial into eax, how do i read eax?

My point of all this is that why waste time on ripping code/patching when the auther kindly gave you most of the needed to make a keygen.

Hope this is helpful to you.

// CyberHeg

thank you very much, this is very helpful! i'll start researching these strategies immediately.. i'm a little shakey on how to change the code to push the correct serial into eax, then read it back at the right time, so i'm sure i'll be asking more questions..

this would make a great tutorial if anybody would look at the code! ;)

-ET
woodmann
07-04-2001, 02:57 PM
Without trying to sound negative........

ET, You have been given many ways to complete your task. If you really want it you will do it, no matter how long it takes.
Then, you write the tutorial.

Peace, Woodmann
ET
07-04-2001, 03:40 PM
woodmann (07-04-2001 12:57):
Without trying to sound negative........

ET, You have been given many ways to complete your task. If you really want it you will do it, no matter how long it takes.
Then, you write the tutorial.

Peace, Woodmann

yes, i know.. i don't take offense to what you're saying.. at the same time, i've explained i'm new to this and am very willing to learn.. i've been given many pointers from people that i have pursued to the best of my abilities.. but if nobody else ever looks at the code, i only seem to be getting more confused as to the best direction to take.. with all due respect, i've been told 4 exact things to look for (not necessarily on this board) that just aren't there.. i've exasperated my limited knowledge, and as the title says, i'm asking for 'help' so that i can learn..

sorry if i've asked too many questions..

-ET
woodmann
07-04-2001, 03:48 PM
Questions are fine. I dont think you will be able to convince anyone to look at the code for you.

I want you to be able to do this for yourself. If you have to take a few steps backwards then thats what you have to do.
Your patience is important at this point, Relax and try a little "zen". It is at this time where you will make your best progress.

Peace, Woodmann
sarge
07-16-2001, 02:00 PM
Are you sure the code in question is not using the "Overlay" function of an ImageList control. The overlay function is specifically designed to do what you are seeing. It actually merges one picture with another; it may be that your program is merging an "X" with the original picture. Either find the "X" image and make it blank (thus the overlay will mix "nothing" with the original picture = original picture), or
disable/bypass the overlay command code.

PS. Due to my inexperience, this got posted twice! Sorry, all!


Reverse .mde (compiled Access database)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reverse .mde (compiled Access database)
PDA

View Full Version : Reverse .mde (compiled Access database)

07-03-2001, 06:13 PM
What is the fastest way of reversing of mde database (Access'97)?
Some serial checking is done in a compiled VBA script.
Thanks in advance.
LaptoniC
07-05-2001, 05:49 AM
Read the essays http://www.woodmann.net/fravia/pepper2.htm and http://www.woodmann.net/fravia/msaccess.htm on Tsehp's site.Hope it helps.


Quick Time 4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Quick Time 4
PDA

View Full Version : Quick Time 4

SciTech
07-04-2001, 02:29 AM
Does anyone know the cracking procedure for finding a valid serial for the program Quick Time 4?


Unix Program problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unix Program problem
PDA

View Full Version : Unix Program problem

blade-r
07-04-2001, 06:12 AM
Hi,
I've a problem with a unix program, i must generate a valid serial for this proggy but i can't understand what appen when i send a serial code to server. I've find a routine that (i think:) ) is interesting:

LNDecrypt(%s)

:0040A660 8B44240C mov eax, dword ptr [esp+0C]
:0040A664 81EC14020000 sub esp, 00000214
:0040A66A 89442410 mov dword ptr [esp+10], eax
:0040A66E 53 push ebx
:0040A66F 8B9C242C020000 mov ebx, dword ptr [esp+0000022C]
:0040A676 56 push esi
:0040A677 8B842438020000 mov eax, dword ptr [esp+00000238]
:0040A67E 57 push edi
:0040A67F 8BBC2430020000 mov edi, dword ptr [esp+00000230]
:0040A686 55 push ebp
:0040A687 8BAC243C020000 mov ebp, dword ptr [esp+0000023C]
:0040A68E 8B8C2444020000 mov ecx, dword ptr [esp+00000244]
:0040A695 8B942448020000 mov edx, dword ptr [esp+00000248]
:0040A69C 8944241C mov dword ptr [esp+1C], eax
:0040A6A0 8B84244C020000 mov eax, dword ptr [esp+0000024C]
:0040A6A7 894C2418 mov dword ptr [esp+18], ecx
:0040A6AB 8B8C2428020000 mov ecx, dword ptr [esp+00000228]
:0040A6B2 89542414 mov dword ptr [esp+14], edx
:0040A6B6 89442410 mov dword ptr [esp+10], eax
:0040A6BA 850DD4C24400 test dword ptr [0044C2D4], ecx
:0040A6C0 0F84BF000000 je 0040A785
:0040A6C6 6A02 push 00000002
:0040A6C8 68D0C14400 push 0044C1D0

* Reference To: KERNEL32._lopen, Ord:028Eh
|
:0040A6CD FF15EC7A4600 Call dword ptr [00467AEC]
:0040A6D3 8BF0 mov esi, eax
:0040A6D5 85F6 test esi, esi
:0040A6D7 0F8CA8000000 jl 0040A785
:0040A6DD 8B84242C020000 mov eax, dword ptr [esp+0000022C]
:0040A6E4 8D4C2424 lea ecx, dword ptr [esp+24]
:0040A6E8 50 push eax

* Possible StringData Ref from Data Obj ->"LSADMAPI"
|
:0040A6E9 6868D04400 push 0044D068

* Possible StringData Ref from Data Obj ->"%%lu : %s : %s"
|
:0040A6EE 6858D04400 push 0044D058
:0040A6F3 51 push ecx

* Reference To: USER32.wsprintfA, Ord:0264h
|
:0040A6F4 FF15407D4600 Call dword ptr [00467D40]
:0040A6FA 83C410 add esp, 00000010
:0040A6FD 83F801 cmp eax, 00000001
:0040A700 7E24 jle 0040A726
:0040A702 8D4C0423 lea ecx, dword ptr [esp+eax+23]
:0040A706 80390A cmp byte ptr [ecx], 0A
:0040A709 751B jne 0040A726
:0040A70B 807C04220D cmp byte ptr [esp+eax+22], 0D
:0040A710 7414 je 0040A726
:0040A712 3DFF000000 cmp eax, 000000FF
:0040A717 730D jnb 0040A726
:0040A719 C6010D mov byte ptr [ecx], 0D
:0040A71C C64404240A mov [esp+eax+24], 0A
:0040A721 C644042500 mov [esp+eax+25], 00

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A700(C), :0040A709(C), :0040A710(C), :0040A717(C)
|
:0040A726 8B442410 mov eax, dword ptr [esp+10]
:0040A72A 8B4C2414 mov ecx, dword ptr [esp+14]
:0040A72E 8B542418 mov edx, dword ptr [esp+18]
:0040A732 50 push eax
:0040A733 8B442420 mov eax, dword ptr [esp+20]
:0040A737 51 push ecx
:0040A738 8B4C2428 mov ecx, dword ptr [esp+28]
:0040A73C 52 push edx
:0040A73D 50 push eax
:0040A73E 55 push ebp
:0040A73F 53 push ebx
:0040A740 57 push edi
:0040A741 51 push ecx

* Reference To: KERNEL32.GetTickCount, Ord:0145h
|
:0040A742 FF157C7A4600 Call dword ptr [00467A7C]
:0040A748 8D4C2444 lea ecx, dword ptr [esp+44]
:0040A74C 50 push eax
:0040A74D 8D842448010000 lea eax, dword ptr [esp+00000148]
:0040A754 51 push ecx
:0040A755 50 push eax

* Reference To: USER32.wsprintfA, Ord:0264h
|
:0040A756 FF15407D4600 Call dword ptr [00467D40]
:0040A75C 83C42C add esp, 0000002C
:0040A75F 8BF8 mov edi, eax
:0040A761 6A02 push 00000002
:0040A763 6A00 push 00000000
:0040A765 56 push esi

* Reference To: KERNEL32._llseek, Ord:028Dh
|
:0040A766 FF15D87A4600 Call dword ptr [00467AD8]
:0040A76C 8D842424010000 lea eax, dword ptr [esp+00000124]
:0040A773 57 push edi
:0040A774 50 push eax

* Reference To: KERNEL32._lwrite, Ord:0290h
|
:0040A775 8B2DE87A4600 mov ebp, dword ptr [00467AE8]
:0040A77B 56 push esi
:0040A77C FFD5 call ebp
:0040A77E 56 push esi

* Reference To: KERNEL32._lclose, Ord:028Bh
|
:0040A77F FF15F47A4600 Call dword ptr [00467AF4]

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040A6C0(C), :0040A6D7(C)
|
:0040A785 5D pop ebp
:0040A786 5F pop edi
:0040A787 5E pop esi
:0040A788 5B pop ebx
:0040A789 81C414020000 add esp, 00000214
:0040A78F C3 ret

* Referenced by a CALL at Addresses:
|:0040A9CC , :0040AAE4 , :0040AE4F , :0040B04D , :0040B27B
|:0040BAFB , :0040BB89 , :0040BBBB , :0040BC5A , :0040BCF9
|:0040BD2C , :0040BDFA , :0040BFF6 , :0040C0D9 , :0040C0FD
|
:0040A790 81EC90010000 sub esp, 00000190
:0040A796 E8451C0000 call 0040C3E0

* Possible StringData Ref from Data Obj ->"USPInitialise"
|
:0040A79B 6820D14400 push 0044D120
:0040A7A0 6A01 push 00000001
:0040A7A2 E8C91C0000 call 0040C470
:0040A7A7 8D442408 lea eax, dword ptr [esp+08]
:0040A7AB 83C408 add esp, 00000008
:0040A7AE 50 push eax
:0040A7AF 6801010000 push 00000101

* Reference To: WSOCK32.WSAStartup, Ord:0073h
|
:0040A7B4 E8C5320000 Call 0040DA7E
:0040A7B9 85C0 test eax, eax
:0040A7BB 7411 je 0040A7CE

* Possible StringData Ref from Data Obj ->"USPInitialise: WSAStartup failed"
|
:0040A7BD 68FCD04400 push 0044D0FC
:0040A7C2 6A01 push 00000001
:0040A7C4 E8A71C0000 call 0040C470
:0040A7C9 83C408 add esp, 00000008
:0040A7CC EB05 jmp 0040A7D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7BB(C)
|
:0040A7CE E81D000000 call 0040A7F0

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040A7CC(U)
|
:0040A7D3 C705F8D0440001000000 mov dword ptr [0044D0F8], 00000001
:0040A7DD 81C490010000 add esp, 00000190
:0040A7E3 C3 ret

:0040A7E4 CC int 03
:0040A7E5 CC int 03
:0040A7E6 CC int 03
:0040A7E7 CC int 03
:0040A7E8 CC int 03
:0040A7E9 CC int 03
:0040A7EA CC int 03
:0040A7EB CC int 03
:0040A7EC CC int 03
:0040A7ED CC int 03
:0040A7EE CC int 03
:0040A7EF CC int 03

* Referenced by a CALL at Address:
|:0040A7CE
|
:0040A7F0 57 push edi
:0040A7F1 B8FFFFFFFF mov eax, FFFFFFFF
:0040A7F6 BF60424600 mov edi, 00464260
:0040A7FB B900010000 mov ecx, 00000100
:0040A800 F3 repz
:0040A801 AB stosd
:0040A802 5F pop edi
:0040A803 C3 ret

I think that with this function i can create a valid S/n but i can't understand how the encryption scheme works.... can anyone help me Please !!

Thank you

P.s. sorry for my poooor english... :)
mo k
07-04-2001, 07:01 PM
awesome, unix apps using win32api (ok, crtl and winsock ; )

It is not a unix program. maybe a key generator "for" a unix program.
either way, you will need to rtm.
blade-r
07-05-2001, 03:14 AM
Sorry, i'not correctly explain my situation :)) i've a win32 proggy that i must use to send a license code to an unix app.. so i whant know if i can use the win32 part to make a keygen..

thank for your reply

Bye
mo k
07-05-2001, 06:29 AM
The code is bogus. this is not dec-ryption
routine, nor the bad_guy/serial check, nor
the key transfer.

the excerpt imo only shows the after math,
the decryption is already done. if all is well,
you will find something if you dump eax
after 0040A6E8 executes. In the same spirit,
try inverting the flags, while in the debugger,
just to make it to 0040A755, then dump the
three top elements on the stack.

the top most one is a destination buffer for some
string. beneath it is the format string, and below
that is the string getting printed.

I suggest you write down the format string,
and the to_be_printed_string (i.e. the third one)
and compile a C printf to test them.
I think the author is abusing the format strings,
to confuse crackers. see what he did before in
0040A6EE.

While at 0040A6C8, dump the variable getting
pushed. that is the name of the file it is writing to.
I think he is using very primitive encryption
by writing junk *information* using twisted
format strings, and reads them back in his
own twisted way, not very brilliant ; )

Other than those two locations, there isn't anything else.

GetTickCount is called, but the value is not
used as an encryption seed, just pushed on
the stack and *may be* gets printed
into some string.

Do me a favor, and dump ecx while at 0040A755, and note down the formating string.
count the number of variables getting printed, the %s that is. if find no %s, then sonofa bitch
is doing stack tunneling, please let me know what he is doing, i think my pyschic cracking
abilities are improving ; )

see if eax is a small number after wsprintfA execs.
if it is a small number (i.e. less than hundred,
then he did indeed print out the tick_count)
So, the next logical step is, where is he taking
all this information? find some consecetive
memory locations, some range, where he is
building the buffer for the string to be sent
to the unix box.

Wait sniff the disassembly for the transfer function (send and sendto.)

He is likely to encrypt the string before sending,
to eliminate any packet sniffing. so you will
need your good judgement in this. I think
you are close to the location, there is
the connection setup after all; unless it
is a cut from a good ol net transfer log, in which
case, all these golden strings are just some
silly debug messages ; )
mo k
07-05-2001, 06:41 AM
Stack Tunneling.

This is where you push more vairiables on
the stack, than the following function call
needs or checks for.

the function will be happy poping whatever it
needs from the stack, and leave the rest alone.

wsaprintfA requires two arguments, the second
is a format string. if the second string contains
a %, then it will pop an extra variable from
the stack.

in the above case, if the third variable getting
pushed, is the number of tick count since windows
started, and the second string contains a %d,
a %u, or the likes, then the code must have looked like

wsprintf(p_buf, "%d", GetTickCount);

If the however, the author wrote

wsprintf(p_buf, "yayayyaa");

then the third *optional* paremeter will not get
poped off the stack, since it is not needed.

he will then pop it later, for his own evil mysterious ways ; )


Securom *new* load process informations ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Securom *new* load process informations ?
PDA

View Full Version : Securom *new* load process informations ?

DaffyDos
07-04-2001, 10:58 AM
Securom *new* load process
Does someone decribes the loading process of SINTF32.DLL and others library (under win2K)in the new securom. I need to patch a software...and all informations are welcome !
DaffyDos
Gadix.
07-05-2001, 12:04 PM
Read risc tutorial of OutCast-Securom

In the tutorial risc talk about "bad calls". Search & patch the next code:

(extracted from TrickStyle....)
:0054D28A 8B0A mov ecx, dword ptr [edx]
:0054D28C 3B08 cmp ecx, dword ptr [eax] <--- "Checks the CRC"
:0054D28E 7409 jz 0054D299 <--- Change 74 to EB

You can forget the "bad calls" ;)

Gadix


Clonecd......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Clonecd......
PDA

View Full Version : Clonecd......

spekkel
07-04-2001, 03:50 PM
Still trying to unpack clonecd...but can't get it to work.
It makes a temp. file with a random name from where it runs.
So i did dump this file, made a new import-table (all resolved), but still keeps craching
in some loop function?!
Any one who had experience with this prog.??

SpeKKeL
AdamA
07-05-2001, 05:40 AM
Hi,
try CASPR 1.012, it unpacks CloneCD without Problems.

happy reversing,
AdamA


Anti Loader Mechanism
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Anti Loader Mechanism
PDA

View Full Version : Anti Loader Mechanism

tigeros
07-05-2001, 10:21 PM
Ok, finally I make a loader work under
both win2k and win98 to patch a ASProtect 1.2x protected app.
But I have a big question, when I use
WriteProcessMemory too early, it says
Protect Error .15 etc. But I got to work
aorund this problem.

Could anyone tell me something, how is such
action being detected by ASProtect? Any
hint about it?

I try to search forum, but you can search
only msg within 30 days, It really not
enough.
madmax!
07-06-2001, 12:24 AM
I'd say some sort of CRC mechanism is at work...I've seen such loops in ASPR layers, so just be sure to patch right before return to OEP.

madmax
tigeros
07-07-2001, 04:39 AM
Yes, I know that CRC check. I have found
out the part of CRC check in 1.2x.
But about the anti loader mechanism I really
want to know something about it.


Psst buddy... wanna work for the Union?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Psst buddy... wanna work for the Union?
PDA

View Full Version : Psst buddy... wanna work for the Union?

jobber
07-06-2001, 08:10 AM
Eurocontrol
- A5-A6-A7 - Expert - Architecture de sytèmes HQ-2001-AT/055 End: 24.08.2001

A5-A6-A7 - Expert-Sécurité des systèmes CE-2001-AT/052 End: 19.07.2001


ALLOY
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ALLOY
PDA

View Full Version : ALLOY

yazid2
07-06-2001, 11:02 AM
Hi,
I try tu crack Alloy 1.10.6.200, Or find the crack.
Could you help me please, You can find it at :
http://www.vdsworld.com/cgi-win/download.exe?file=http://www.pgware.com/cgi-bin/downloads/download.pl?alloy.exe
Thanks

My mail is : yazid@t2u.com

I find this :

The program can be registered with a file called
alloy32.key wich contains the keyid and the name crypted.

To test the registration without creating a keyfile
we can only put a name and a keyid in
the alloy32.ini in the same directory of alloy.

It use the alloyck.dll to decode the keyid wich is
in the alloy32.ini.

Like this :

%1 = @algorithm(DECODE,BLOWFISH,%%blowfish,keyid)

%2 = @algorithm(DECODE,SAFER-SK128,%%safer,%1)

%3 = @algorithm(DECODE,GOST,%%gost,%3)

%4 = @algorithm(DECODE,TWOFISH,%%twofish,%3)

%5 = @algorithm(DECODE,3WAY,%%way,%4)

And after it compare the result to ???

PS if you try to unpack the alloyck.dll
the program will give you an error message, because
the program look for the size of the dll and compare it at first.

To use the alloyck.dll in Visual DialogScript scripts
the code is : external alloyck.dll,425322

Without this code it return an error

Good luck
yazid2
07-08-2001, 11:58 AM
Are you not strong enough to crack this log


help! sentinel superpro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help! sentinel superpro
PDA

View Full Version : help! sentinel superpro

boxx
07-06-2001, 02:55 PM
i found the app commucate with the dongle only by ReadFile().and the the length of returned data read is zero. i 'm really confused.
what's going on?
Thanks .
Crayser
07-06-2001, 04:33 PM
how could you communicate with the dongle. I want to crack a prog protected with the sentinal superpro dongle too but I don't know how to begin.
boxx
07-06-2001, 11:55 PM
bpio 378,and F12 to get into the app code
Crayser
07-07-2001, 05:40 AM
Does 378 stands for LP1? In my application it doesn't break when there is no dongle.
Is the function of every dongle of sentinel superpro the same?
the analyst / ucf
07-07-2001, 03:21 PM
hey,

i advise you to get the sentinel manual :)
and read about the api.
it will help a lotta more than bpio and such wanks.
it describes the api, what they do return , error code ..
Also get the IDA's sigs files of sentinel ;)
you will see what api is called in the code, and just read the manual.
who said RTFM ? ;-)
you gotta read CrackZ's dongles tutorials.
w**.zencrack2.cjb.net

my 2 cents.
regards,

the analyst
Crayser
07-08-2001, 10:16 AM
is it possible to crack a program protected with a dongle by checking when and where it tries to connect the dongle.
i built to the LPT port an oscilloscope with memory that shows me if there was a connection with the lpt port. than i set a bp where it was checkes first the port. from there on i compare the assembler code with and without a dongle. and i want to change the points where they differ from each other. makes it a sence? the sentinel superpro dongle is checked only at the beginning of the program.
i think i can't set a bp on the input/output because the programm doesn't use the important driver of win and maybe there is a self written driver in the program that sice can't detect.
i know it's circular but i don't know how to crack it in another way.

ps: sorry for my english it's not my motherlanguage
xiaoxiaoc
07-15-2001, 01:24 PM
i can crack it,but I know English a little,Sorry,
you can FTP the soft,E-mail to i the address
xiaoxiaoc
07-15-2001, 01:42 PM
i can crack it,but I know English a little,Sorry,
you can FTP the soft,E-mail to i the address
I think BPIO 378 or 278 are not be used,because the "dog"has used VXD technology. It's work in zero especially grade ,so we can't stop it.But the anti-vocabulary VXD can find out the problem in silent .
Crayser
07-15-2001, 03:58 PM
ok i will send you the files i thing you need to crack the programm to your e-mail..
after a very long time of tracing through the code here the results of my work.. i found a call where is only a jump after kernel uses the deviceiocontrol. and after that the dongle is checked. but i expacted something like a test and a conditional jump. what should i change there? it still jumps back and comunicates with the dongle but where?

everybody tells me to read the manual. i just found some tutorials and programms for sspro but not a manual on zencrack site.
the analyst / ucf
07-15-2001, 06:15 PM
Crayser (07-15-2001 13:58):
ok i will send you the files i thing you need to crack the programm to your e-mail..
after a very long time of tracing through the code here the results of my work.. i found a call where is only a jump after kernel uses the deviceiocontrol. and after that the dongle is checked. but i expacted something like a test and a conditional jump. what should i change there? it still jumps back and comunicates with the dongle but where?

everybody tells me to read the manual. i just found some tutorials and programms for sspro but not a manual on zencrack site.

i would like to have it too.
is it possible ?
as i said above, you should really get the sentinel API guide.
You wouldn't loose your time, and you would understand what's going on actually.
First time i cracked a sentinel, i didn't really understood what happened, and i just patched around , and used deviceiocontrol.
get the doc, RTFM , get IDA's sig files, fire up soft ice and let's rock ;)
nothing much actually.

my 2 cents,

the analyst
Crayser
07-17-2001, 02:59 AM
no problem but first you must tell me which files do you need. I can't send you the whole program because it's too big (about 400mb). But the check is only at the beginning and the program loads a few dll's before it comes to the messagebox. I used only 3 files to come to the deviceiocontrol. And there is an other file with messageboxa (but that's too late). Or maybe you need the vxd file. I'm not sure if the way I took was right.

Where do I get the doc and the manual? on zencrack2.cjb.net there are only some older tutz and some programs.

crayser
goatass
07-17-2001, 07:51 AM
Hey Crayser, you need to get those old papers, and some of them are not that old and they are still very valid. Check out my paper on FlexiSign PRO it will help you alot since I explain almost everything in there and I have a link to the sspro manuals in there aswell. You can get it at zencrack2.cjb.net and on tsehp.cjb.net and I suggest you read them all before continuing because from what I read in your posts you don't understand what's going on in the protection and your approach is not wrong but not a very good one. When it comes to the new sspro version you need to do some reading before trying to reverse it.

You must read, don't try reversing it before you read the manuals, trust they help A LOT.

goatass
the analyst / ucf
07-17-2001, 08:13 AM
Crayser (07-17-2001 00:59):
no problem but first you must tell me which files do you need. I can't send you the whole program because it's too big (about 400mb). But the check is only at the beginning and the program loads a few dll's before it comes to the messagebox. I used only 3 files to come to the deviceiocontrol. And there is an other file with messageboxa (but that's too late). Or maybe you need the vxd file. I'm not sure if the way I took was right.

Where do I get the doc and the manual? on zencrack2.cjb.net there are only some older tutz and some programs.

crayser

setup a FTP server ;)
and i leech it from there ;)
actually , as goatass said (hey mate btw ;) , forget that stuff and read manual, essays ..
you better emulate the dongle , instead of patching around, with some lucky guess.
;-)
look around for that manual.
really, it helps a LOT.

regards,

the analyst
Morlac.
07-17-2001, 09:15 AM
Crayser,

Although your method is valid and can lead to a good results, its a waste of time. The Readfile() and DeviceIOControl() functions are located inside the dongle object file that gets linked to the app it self. When you patch there, you are actually patching the dongle driver that is linked to the app. If you go up in the calling heirarchy, you will come to the dongle documented apis used by the app. So, as everyone is telling you, you should get the API documentation ( availalbe from http://www.rainbow.com/tech/files/SentinelSuperPro/Manual/SentinelSP6DevelopersGuide.pdf )
This PDF will explain alot. And you need the Signature file from zencrack2.cjb.net.

The reason why you need to do this is because the app is quite huge and that can mean lots of checks. Some are hidden.
Once you apply the sig files to you assembly, you will see which part of the code is checking the dongle.
And then making an emulator for the dongle will be quite easy if you can intercept each and every call made to the dongle.

...only my 2 cents.

everybody,
Morlac
Crayser
07-18-2001, 02:32 PM
thank you for all your tips.
I will read the manual and some tutz I've also read but my personal experience is that I learn better by cracking a program than only by reading. If there are many information I often forget what I read at the beginning. But with practical learning (for example communication with you guys and describing some questions with regard to the code itself) would help me understanding much more.

Now to the files:
I will make a file server but not until 1 maybe 2 weeks. On my second pc there is much to do and now I've few time. Maybe I can upload is somewhere but if you want I'll send it to your E-Mail account the first for cracking necessary files.
Ok now I know that my way is a wrong one :) but I don't know which one is the right. But before you answer the question I will read some doc etc. and maybe find the answer alone ;-) .

Crayser
Crayser
07-19-2001, 05:24 AM
when I want to emulate the dongle, I must know the answers of it. I know every call that communicates with the dongle but I don't know what it sends me back. I could compare (with and without the dongle) on every call the values and change them but I think there is a better way to find it out. To emulate the dongle I need every answer of it. It took me much time to find all the calls.
Morlac.
07-19-2001, 08:42 AM
Crayser,

Well, you can always find what is expected from the dongle by looking at the code that follows the call to the dongle even if you dont have the dongle.
You will either find a direct check of the results, or, you can see that the code manipulates the value and then checks it.
You can always reverse that and you should get the actual results.
So, you dont really need the whole content of the dongle. But if you like to write a full emulator, then, use a dumper utility and then write your emulator. This has advantages in that if you missed one call, then itll work becuase you supplied the whole dongle contents.
Otherwise, you have to keep looking.

Molrac
shark
03-21-2002, 03:31 AM
i think u may be a chinese!
place add me to friend by QQ.
my number :5080518
may be u can hlep me!
thank you!


About Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > About Reversing
PDA

View Full Version : About Reversing

Joda
07-07-2001, 12:09 PM
Hi all.

I have a general question about reverse engineering. Most boards or webpages, that are giving information about that theme seem to be damned to be somewhere in the mid of guy-playing-with-code and evil-cracker information.
Often theres not even a distinction between cracking and reversing.
So what is reversing?
Is it just something, some guys do when they are bored or is it something that also exists in the real world - something that (few) ppl use, to earn their money?

I'm asking this question, because that whole theme is really fascinating me - i am really at the beginning and my non-existent mathematical intelligence isnt making things better, but i wonder if that stuff is of any use for my life - or for the life after my education
(talkin about software reversing, not social reversing which IS really needed to get a real idea of who i am and what the world around me is [in my opinion]).

I read something about legacy systems, where reversers are needed to maintain them - but i didn't find any real information about that on the net, don't even know what it is.

Any thoughts are welcome :)

Joda
qferret
07-07-2001, 09:01 PM
welll....for the most part, I think what *we* do, is helpful in real world situations as far as, we try to learn everything about how programs work right down to how they interact with the operating system.

As for the distinction between reversing and cracking.....cracking is just circumventing the protection......when reversing, we try to understand what's going on & why....I think most of us do a bit of each.

Example:

Patching a jump or fishing a serial = cracking

Adding an import to the program to make a window stay on top = reversing

Just my humble opinion ;-)
cuddly_SplAj
07-08-2001, 07:06 AM
...and of course the ultimate programmers nightmare..... the k3yg3nn3r }>

How must it feel to have your commercially protected treasure ripped apart and some one reverse your algo and release a keygen :-(

raped & dumb naked }>

mmmmmmm, maybe i'll release my bi-tarts keygens now }>

Also, reversing comes in useful, I just found UltraEdit does not run under W2K-SP2.... :-(

+SplAj
cuddly_SplAj
07-08-2001, 07:10 AM
f*cks I pressed refresh and posted twice....well did anyone else have a prob with UE8 with SP2 ???

+SplAj

-------------------------------------
original boring repeated text replaced !
-------------------------------------
drak0
07-08-2001, 01:00 PM
I have win2k+sp2 and ultraedit works fine for me... just not softice.

are you using driverstudio 2.0.1 or the new beta?

-drak0

cuddly_SplAj (07-08-2001 05:10):
f*cks I pressed refresh and posted twice....well did anyone else have a prob with UE8 with SP2 ???

+SplAj

-------------------------------------
original boring repeated text replaced !
-------------------------------------
CrackZ
07-10-2001, 07:10 PM
Hiya to all.

Given the opportunity to post some mindless opinions, how could I possibly resist ;-).

The whole reversing vs cracking debate is a pretty cyclical one, every 2 or 3 months its the topic of a thread or 2 and its been done to death. I don't regard most of what go's on here as much more than simple 'protections' cracking and I don't seek to ridicule those that find this is their interest, at the end of the day though the challenge seems always to be to break the minds of whichever protectionist happens to be on some some target x that you downloaded from the web this week.

To Yoda : The whole 'lets call it reversing' on websites is just a simple counter measure for many dubious cracking sites to try and prevent being removed instantly, it was one of the very first things I did in 1997 (at least thats the way I see it anyway), in some ways simple cracking tutorials might be regarded as somewhat more intelligent than the millions of key generator repositories.

I disagree somewhat with splaj, I don't think reversing or whatever the politically correct term is today should even be remotely connected to protection circumvention, I find now (I didn't in my early years) that cracking protections provides pretty scant amusement and scant real knowledge, I also find that the people who have abandoned this approach are actually much more knowledgable for it (I need not mention any names).

Personally for me, its now a simple cat and mouse game every time, a game I can't win and a game I'm pretty bored of, a new version of software x this week, we deprotect it the next and so on.....(in the immortal words of +gthorne) I think I expressed this pretty much on another thread not so long ago.

I recognise the need however that not everyone feels like I do, to get people interested in say 'reversing' we have to appeal to the 'cracking mentality', its probably what got 99% of us started in the first place, it did with me.

I do really believe now it is time for some of us to start producing meaningfull material, real reversing information (not here's how I deprotected and broke the mind of this protectionist), look at say 3 or 4 essays (Stone, +spath, Iceman & Quine), those are documents that will and have stood the test of time, reversing <leim application vx.y> will not.

I've gone on one of my protracted rants yet again ;-), at the end of the day if you are content to deal with just protections cracking then so be it your perogative and good luck to you too, I don't think you'll learn much more than pretty trite repititions in the process though ;-) (prove me wrong).

Regards and then some.

CrackZ.
nblender
07-11-2001, 12:43 AM
Reverse engineering is required to keep programmers honest.
Often evil software (like radiate/aurate) and snake oil
encryption are figured out by reverse engineers, and
bad software behavior is made public. Reverse engineering
is sometimes required for legacy systems, and this can lead to
heartache, especially if you have the file specs and source
and it's still not clear what the program is up to.
This thread should be moved to the general discussions though I think.
mYstiC_SplAj
07-11-2001, 03:44 AM
Wow CrackZ you knew what I was going to say already ;)

Ok, this is my final lame point on this boring topic.....}>

The career of a cracker/reverser/programmer/protectioninst :-
===============================================

1) You start of your career on the darkside, learning all about SI and debugging. You crack some shits and think you are the nuevo-cracko-leeeto. The adrenaline rush is 100% pure.

2) After 1-2 years you get fcksin good . Any target can be fixed
somehow. You start learning to program ASM. The adrenaline rush is 50%

3) After another year your ASM is pretty good too and you've got some skill there bud. You can make patches & keygens et voila. - now the moral Q 'do you release them or not & do you join a group or not ' ...... ? Here will decide your future a little. No more adrenaline rush.

4) After another year you have done it all, unpacking everything, making keygens, coding patches, some tools, dongles are defeated....blah blah. You definately stop releasing your shit to the lamers.

5) After ~4 years you come to realise it is a cat and mouse game
and start learning some real programming skills and actually think about protection.....can you do it, can you make a better safedisc.
Can that stuff you learned be useful now ?

6) Those fcksin lamers keep nagging for keygens and cracks so you realise the whole world is full of lamers :-( ....So you switch sides. Become a protectionist or programmer of utilities. No more
cracking except for nostalgic reasons. Mr White.

Or the wife trashes your PC's threatens to divorce you and take the kids with her..........and you give it up to become the perfect husband and father and live happily ever after :*

.......now where did I put that tongue in cheek emoticon ?

+SplAj
'patch+play'
hilarious thread all 'revers
07-11-2001, 03:54 AM
}>
Joda
07-11-2001, 07:01 AM
Hmmm.

Interesting and sad - looks like nearly noone on this board seems to be interested in the question, or interested in thinking about it.
How come

I think that on this board there are really many guys that have an idea of reversing, who can code stuff, add new functions to programs, maybe guys, that can crack every damn protection in the world.
What the masses are inheriting from them are mostly every apps around for absolutely no money, all games that are coming out on every console be it a gaming console or a pc.
But are they damned to keep this skills for the time after their work? Coming home, maybe totally exhausted from work and sitting down, starting their progs and beginning the stuff that they are really interested in and living with that sense of paranoia that in every moment their door could be broken up and the police coming in, busting them and scanning their pc, sometimes crushing a whole group.
I'm searching a sense behind the sense :).
[ Perhaps the elite of the reversers are programmers for big companies and in the evening cracking the protections they created because that's their way to say "c'mon boss go fuck yourself" ;). ]

+Splaj - your reply receives a negative touch through your concentration on the feeling of the "commercial programmers". Do we care about their feelings? Wasn't there something else, that the oldschool crackers and reversers tried to imply with their new born skills? Some general idea of the world perhaps that keeps us all together that for me and most of the guys leaving the scene seem to be totally vanished.

I know that my posts can be really chaotic and perhaps i should accustom myself writing a summary at the end :P.

We are living in a world that will not need a god to be destructed if humanity continues to act how they do at the moment so I'm seeking every answer i can get - perhaps answers will some day change something.

cyall

Joda
nEgAtivE+SplAj
07-11-2001, 08:20 AM
Hi Joda ;)

Legacy reversers are the one that maintain an existing system cos the programmer/seller has gone bust..... so they either buy an expensive upgrade with all the problems a new system creates or keep fixing/adapting the old system ;)

The world will destroy itself without reversers/crackers, there are more fundamental problems for the worlds leaders to worry about
than the demise of M$ and Intel - and now AMD !

Police kicking down the door, mmmm one small guy cracking software he never uses and does not release to the public or try and profit from. Baaaa. No. Just go to your sunday market and
see all those DVD's CD's Fake Levis RoBeek, N1ke etc etc. Not one has the brand name +SplAj with the trademark 'patch+play' on it ! Not guilty.

hey, but let loose a virus or try and hack the local bank atm. THEN YOU ARE IN *BIG* FCKSIN TROUBLE !

So, sorry I was 'negative' for you. You have to really concentrate on my splurj cos in there is a message ..... I like unpacking, I like cracking, I like reversing algos and making keygens :-) BUT I ain't no Hambo or member of a group bla blah. I got into this 'public' domain regarding cracks cos i HATE CD checking......and wanted to rid the world of the stupid idea of having a costly CD in your PC for the kids to destroy and then what, buy it again :-( anyway I disappeared off the face of the real world in early 98 and resurfaced in late 99 after practising my SI skills on as many PC magazine CD's I could get on each trip outa here ;)

Now I have the internet........and here i am, R!sc blew the world of PC game CD's apart, so i am not needed for that crusade, nothing to do with piracy ! My comment on keygenners is valid...... it's a purer form of reversing , ask Duelist ;) so now I like to concentrate on 'commercial disprotection'.....

My wife hates (me ? ) and my 3 PC's and often swears she will bin them if I don't give up cracking ! I crack all day at work, then come home with targets I D/L and carry on all night. About 10 hours a day ! FOR PHUN }>

The weekend I save for the swimmming pool and beach BBQ...but I still stew over some S/W problem and how to tackle it :-)

I can give it up anytime I want .........:-)

and my profession.........OFFSHORE TAX CONSULTANT :)

OK ?
Fake51
07-11-2001, 10:43 AM
An interesting side to this to topic is the fact, that most (perhaps all) of the reversers/crackers around here, that do manage to pull off some nice code, tend to release it for free. Examples include code such as:
- icedump
- frogs ice
- revirgin
- safedisc annihilator
- wdump
- and countless others
I'm not saying that people are total idealists, going for the "software should be free", but seemingly most ppl share the feeling that knowledge should be free and public - hence they give away what's theirs.

Apart from that more positive side to the discussion, i have to say I'm inclined to see myself as a common (or uncommon, not exactly sure which) thief - I grab software I need, make it work and keep it. Not proud of it, but that's life.

And of course, as quite a few ppl have mentioned, reversing is fun, like a chess game. Can't seem to put the analytical side of my brain to rest, lol.

Blue skies
Fake
woodmann
07-11-2001, 01:28 PM
I hesitate to answer this post, I'm sure there are a few others also.

I would imagine that most of the people that hang out here reverse/crack stuff because they enjoy the challenge. It's like a game of chess, trying to out think, out wit another person.
I suppose it has a practical use for a software programmer, but I dont know how many here actually write software for commercial release.
If you had to maintain a legacy system then I would definitly think that the ability to reverse and understand different OS would be very important. You have to be able to keep hardware that is no longer supported running, and integrate software so it would suit a particular need. (if I understand correctly)

I could have studied dongle protection and made a very lucrative carrer selling cracked software that is worth tens of thousands of dollars. I didn't because thats not what I want. I want knowlege.
I enjoy the fact that there is this little group that can keep the software people honest. If they thought they could get away with it you would be paying for everything like it or not.

The original point before I started yapping?
Oh, Do it because you want to know/learn/understand/entertain yourself.

Peace, Woodmann


shell and reverse problem, HELP please!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > shell and reverse problem, HELP please!
PDA

View Full Version : shell and reverse problem, HELP please!

tudou
07-07-2001, 04:26 PM
Guys,

WinAce has a ASpack2.0 (or higher?) shell. The compressed winace.exe is 250K or so. I used ProcDump to get is out of the shell sucessfully. The new exe file is about 2.5M, and it runs normally. But when I tried to use W32DSM to reverse the 2.5M exe, I could't find any useful ASM code. It seems that the reverse procedures terminates at the "entry point". What's happening?

Any response is appreciated!
CoDe_InSiDe
07-07-2001, 05:17 PM
Hi Tudou,

You can try to change the Characteristics of the first Section to E0000040 (In file 400000E0 ;) ), because W32Dasm has some troubles with that ;D
Hope this helps.

Cya...

CoDe_InSiDe
tudou
07-07-2001, 06:32 PM
Thanks, CoDe_InSiDe,

could you please show me more detail how to do this using ExeScope or other PE editor? I am a newbies in a PE architecture file. :(

By the way, I checked the 2.5M exe with FileInfo. It is found that it is made from DELPHI. So, if it IS from DELPHI, can it be reversed by W32DSM? In other words, can W32DSM reverse any exe file regardless what kind of language was used to make the exe?

Thanks!

tudou

CoDe_InSiDe (07-07-2001 15:17):
Hi Tudou,

You can try to change the Characteristics of the first Section to E0000040 (In file 400000E0 ;) ), because W32Dasm has some troubles with that ;D
Hope this helps.

Cya...

CoDe_InSiDe
qferret
07-07-2001, 08:52 PM
you can do that in procdump:

click the PE Editor button -> load the file -> click the sections button -> highlight the section name -> right click on it -> make changes
qferret
07-07-2001, 08:55 PM
Delphi hehe...explains the 2.5 MB....

W32Dasm can disassemble it, but it will probably be worthless.....it doesn't like Delphi string refs, Delphi doesn't use the usual API's, & it's bloated as hell & hard to trace with a deadlisting.

Try DeDe....;-)
CoDe_InSiDe
07-08-2001, 12:30 AM
Hi qferret,

Hehe, i don't need to say anything anymore ;)

Cya...

CoDe_InSiDe
tudou
07-08-2001, 02:07 AM
Thanks, guys!


VB3 Pcode *grumble* *swear*)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VB3 Pcode *grumble* *swear*)
PDA

View Full Version : VB3 Pcode *grumble* *swear*)

NchantA
07-08-2001, 03:43 AM
Good afternoon all. i have a program written in Visual Basic 3, compiled in PCode. i wasn't aware that there was such a thing until i tried to reverse the program but there is ;) i am *quite* sure on this.

the program is protected by a dongle, a messagebox pops up on startup telling me the dongle is not there. the dongle is a 'Microguard' made by 'Infosystems'. i havent heard of either. mg32.dll mg16.dll and mg32.vxd seem to be the backbone of the dongle routines, however it is my ahhh 'zen' thoughts that tell me that the program will be one of those :

if (DonglePresent) then ProgramIsRegistered;

on startup ;) hehe anyway, i desperatly need help understanding the vb3 pcode. the main .exe is 1.1mb and exdec nor the wonderful new WK debugger will even think about decompiling it. i have tried numerous things and have come up with nothing

any help will be appreciated

nC [PGC] [EVC]
MyName
07-10-2001, 06:45 PM
Dodi VB3 decompiler name is vbdis3*.* Solve all problem.
qferret
07-10-2001, 09:01 PM
Does dodi's decompiler work on pcode? *shrug*

I know had a rather complicated VB4 pcoded app awhile back.....finally gave up on the damn thing LOL

Hats off to JoCo for helping eliminate the problem for VB's 5 & 6 ; - )
NchantA
07-10-2001, 09:23 PM
as i said above i have already tried DoDi's decompilers

they both crash. would u like a screenshot? :P as it is, i have only ever had one program that ever worked with DoDi's shitty decompiler. and it was gey anyway.
bar
07-10-2001, 10:19 PM
i have the same problem with a 16bits
vb3 compiled in PCode +dongle
the program is protected too with a dongle
WIBU-KEY dongle from German supplier WIBU
i got this snippet with dodi's decompiler
but i c ant patch the EVIL !
-gv0BFA(181) = fn1465("M_MISC", "181", "The dongle could not be found. Please exit the software.", gv0750.M9570 + gv06E6.M9547)
-Call sub4592(1)
l0106 = Val(fn1465("GENERAL", "DongleCheckTime", "5", gv0750.M9570 + gv06E6.M92A9))
If l0106 < 0 Then l0106 = -1
If l0106 = 0 Then l0106 = 5
check for dongle every 5 minutes !
-If l0106 = mc0126 Then
Call sub055E(fn1465("GENERAL", "NoDongleCheck", "Cannot check the dongle because the port is busy", gv0750.M9570 + gv06E6.M92A9) + " (LPT" + LTrim$(Str$(m0020 + 1)) + ")", mc0058, "")
the program name is astrow
from AMANO
://xxx.amano.be/TIME/astrow.html
the evil in details.
Eternal Bliss
07-11-2001, 07:53 AM
nchanta,
I finally remember what that API is called... DllFunctionCall... that's for vb6... maybe vb3/4 has it too?? Tried that getprocaddress thing?

Regards
EB
MyName
07-11-2001, 11:04 PM
You program protect? (yes =patch ne header). You program big (no work shareware Dodi program).

Dodi best tool planet VB3. (You use exdec VB3. No. only VB5+VB6! You moron? )

You have URL you program? Give me. I show easy patch. VB3=cracked!
NchantA
07-12-2001, 08:26 AM
Moron? No need for that. I was well aware that exdec wouldnt work before i even tried, but i was getting desperate. (hi joco ;P)

are you suggesting in your rambling that DoDi's vb3 discompiler wont work because its shareware? if so then maybe you could share your elite version with me, since mine has an obvious flaw. (although i have my doubts).

the programs size is 1.1mb.

NchantA
MyName
07-12-2001, 11:12 AM
1.1 MB. Too big (You look Dodi code?)

exdec on VB3! (Think miracle happen)

Need PRO program. You elite. You find.

Give me url. I fix. 5 minutes.

VB3=cracked!
cluesurf
07-12-2001, 12:00 PM
MyName (07-12-2001 09:12):
1.1 MB. Too big (You look Dodi code?)

exdec on VB3! (Think miracle happen)

Need PRO program. You elite. You find.

Give me url. I fix. 5 minutes.

VB3=cracked!

Myname,
you seem very agitated when ppl cracking dongles.

>Give me url. I fix. 5 minutes.
>VB3=cracked!

You are fuc**** arrogance.

cluesurf
MyName
07-12-2001, 11:15 PM
Why dongle problem you make angry? Make laugh. Easy patch. You see.

Arrogance=know use tool?. Yes arrogance!

You ask help. Say no exdec. Say yes vbdis3*.*.
You say no work. Say PRO.
You say no. Say give URL. I fix.
You say f* arrogance. Say sorry. Help best can.

You next program notepad? Make laugh.
NchantA
07-14-2001, 03:46 AM
unfortunately this program is not exactly something u can find on the internet. like most dongle protected programs, its specialized software. i will indeed look for a 'PRO' version of DoDi's although i dont think it will help that much anyway. i think i will lend the program to an expert who can actually crack this, instead of a rude, ego-inflated vb3 'king'. I doubt u actually bought your version, so i see no reason to waste my time providing a link to you, when obviously it is much easier to send me this magical version u are possessed with.

NchantA
MyName
07-14-2001, 10:10 AM
Brain.

Talk. Talk. Talk. Do nothing. Still no find Dodi tool. No able search. Make laugh.
Talk. Talk. Talk. Do nothing. Don't need Dodi tool. Use softice. You no know how. Make laugh.
Talk. Talk. Talk. Look VB codes = offset softice. You know asm no need Dodi tool. Make laugh.
Talk. Talk. Talk. People here help you. You brain hear people? Only know tool.
Talk. Talk. Talk. You 3x insult Dodi. Still ask tool. You insult poor englis.
What do here?

NchantA = (Gey Scrippty Kiddie Troll) /spite on floor
NchantA
07-16-2001, 08:14 AM
hahahhahaahahah

amusing as you are, you really have no F**** idea do you? PCode is *interpreted* code. which means you cant disassemble it, cant trace through the programs code as you normally would. instead you have to jump around the vb3XXXXX.dll while ir reads in bytes from the .exe as it would a data file. your a dipshit, now stop acting as if you have a clue how to crack. If you dont have any more 'helpful suggestions' please stop posting and save us all some time.

NchantA
CoDe_InSiDe
07-16-2001, 09:39 AM
Hi NchantA,

Hehe ;)

MyName: keep going with the English Talking ;D
very amusing (Make Laugh) ;)

/me stay out of it !!! :)

Cya...

CoDe_InSiDe
MyName
07-16-2001, 10:15 AM
NoBrainMyname.

Talk. Talk. Talk. I talk rot.
Talk. Talk. Talk. I brainless.Make laugh.
Talk. Talk. Talk. have DoDi tool.No know to use. Make laugh.
Talk. Talk. Talk. can't help you. My brain sux.
Talk. Talk. Talk. Me insult Dodi.I'm gey.I poor englis.
MyName = (Gey Scrippty Kiddie Troll) /spite on floor
Kilby!
07-18-2001, 11:09 AM
Oh Bugger !

and so the sadness decends.

It's strange that a civil question can end up with this thread isn't it.

Nchanta isn't the troll, script kiddie, or the person with piss poor attitude.

The people around who can DO, tend not to boast or have ego problems, so please give it a rest.

No wonder I have a significant lack of enthusiasm again.

Kilby...
MyName
07-18-2001, 08:47 PM
NchantA:

Make laugh.

>pcode=*interpreted* (You correct)
>you cant disassemble it (You no correct)
>cant trace through the programs (You no correct)

VBRUN300 = asm
VB3 program = small asm program = Load VBRUN300.
VBRUN300 load pcode module memory
VBRUN300 = execute pcode. (Yes dissassemble VBRUN300)
Watch VBRUN300 pointer move in pcode module = Set BPR on pcode module memory

You watch VBRUN300 interpreted pcode. pcode opcode = offset in VBRUN300 (Set BP on opcode. Yes!)
You understand?
Easy.
NchantA
07-19-2001, 05:48 AM
which means you cant disassemble it = correct
cant trace through the programs code as you normally would = correct.

if you wish to ahh 'correct' my mistakes please be sure to include the entire context. as i said before you cannot dissassemble the vb3 pcode program, i never said you cant dissassemble the crappy .dll. and yes i was also correct in saying you cant trace through the program as you normally would. instead you have to bpm on the part of the .exe that you wish to break on. you end up in the retard vb3.dll and you have to jump around as it reads in data from the programs .exe.

as i dont have a decompiler i have no idea what to bpm on. ive tried dodi's 16bit and 32bit decompilers, both 'overflow'.

ive talked to joco and he cant help me, so ive decided to send the dongle protected programs to some people that may actually be able to help.

NchantA
Morlac.
07-19-2001, 08:51 AM
Hi guys,

I tend to think of p-code as a set of instructions for the executing module. Much like microcode in CISC microprocessors.
So, I think that you can disassemble VB p-code, its just that the instructions to perform the intended operation looks a lot bigger and different than normal disassembly of x86 programmes.
You see, for me, to disassemble a programme, is to take a look at the different instructions that makes the programme work. No matter how strange these instructions will look like.

Molac.
dadolson
07-19-2001, 06:21 PM
Dongles - serial port = bitch to bypass.

When Source 1st compiled, dongle data is used to set offset into data area for single or multiple fixed data elements poped during exe load. Each Dongle is serialized with specific internal data, no 2 are alike (kind of like a GUID or a Lan card address). If you loose a dongle due to failure, program mod is also sent for new dongle. Compare is run using dongle data and derived offset address to ensure dongle is still on machine. Look for dll from dongle vendor...


link: Windows Product Activation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > link: Windows Product Activation
PDA

View Full Version : link: Windows Product Activation

disavowed
07-10-2001, 08:04 PM
damn, i wanted to be the first to post that link :)
anyway, it was a good read. too bad they didn't also post a paper explaining how they "discovered" all of that info (like a description of their disassembling and tracing process)
Solomon
07-10-2001, 11:15 PM
http://www.licenturion.com/xp/


sspro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > sspro
PDA

View Full Version : sspro

splaj
07-11-2001, 04:08 AM
but it's a nice reply ;)
goatass
07-11-2001, 10:34 AM
There is really no need to have an O-Scope on your lpt port. All you have to do is read the sspro manual and you can very easily figure out that is going on. There are 3 ways I go about finding where the program calls the dongle, first, which lately hasn't worked very often, is to set a BPIO -h 378 which will break with every access to your lpt port. Another way is to set a BPX DeviceIoControl which is how you would communicate with a VXD and sspro uses a VXD to access the dongle. Lastly I use BPX CreateFileA and look what file is being opened until you see that it's opening SENTINEL.VXD then you F12 back a few times and you will be where the application loads the VXD for later use and following that you will see sproFindFirstUnit, sproRead, etc.

I really suggest you read the papers on CrackZ site they are very helpfull and also get the API manual for the sspro dongle from his site.

good luck

goatass
goatass
07-11-2001, 10:36 AM
oh crap, ignore this post....actually Tsehp+ delete it if you can.
it was suppose to be a reply but for some reason it made a new post out of it....

ma bad

goatass
MeteO
07-18-2001, 02:12 PM
Why you do not try to trace all calls to dongle via emualor? It's so easy.
goatass
07-19-2001, 09:20 AM
MeteO, you said trying to trace via emulator, explain what you mean by emulator ??

goatass


lost on unpacking, need hints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > lost on unpacking, need hints
PDA

View Full Version : lost on unpacking, need hints

UnpAckEr_SplAj
07-11-2001, 04:20 AM
any url hint is appreciated !
__DuDu__
07-11-2001, 01:33 PM
Hi,

i've been trying to unpack a program that is protected by an unknown packer, not that i can't find what packed it, the company developed a packer specially for their programs, I break on loadlibrary and trace the code but it arrives at a part with a lot of self modifying code, anyone can give some hints coz i get lost on this part...i need to know if loadlibrary is a good bpx why not getprocaddress ?

any hint is appreciated !

__DuDu__
Silly_prefix_Kilby ;)
07-11-2001, 04:30 PM
Their own packer, hmmmm

ir a hackerd existing one, either way, lets rid the world of this evil creature :)

Kilby...

BTW I couldn't be arsed to login


Flexlm use LM_A_VENDOR_ID_DECLARE , how to crack ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm use LM_A_VENDOR_ID_DECLARE , how to crack ?
PDA

View Full Version : Flexlm use LM_A_VENDOR_ID_DECLARE , how to crack ?

mark
07-10-2001, 08:42 PM
Hi everybody!

My target is GC-Powerstation, it's proctection is Flexlm + Sentinel Dongle.
Flexlm uses LM_A_VENDOR_ID_DECLARE to change HOSTID to GC_DONGLE ID (ex. HOSTID=GC_DONGLE=1234 ).
If I make a license which HOSTID=ANY, the program can't pass.
How can I crack this target ?
cast
07-11-2001, 04:17 AM
An obvious method would be to patch the dongle on the program, and emulate it to a id, say 1234 - then make a license with the hostid emulated. I have seen stuff like that before, but useually without a sentinel this works:
HOSTID=SENTINEL_ID=0

due to the obvious hostid of 0 with no dongle connected.
Morlac.
07-11-2001, 07:52 AM
Or, you can compile your Daemon ;-)

If you used the Daemon that gets built when you compile a new license generator, you get a demo daemon. Rename and use that as the apps daemon.
Worked for me.

PS - Dont forget to setup you license.dat file to correctly reflect the use of a Daemon.
CatKing
07-12-2001, 11:42 PM
Try to trace l_new_hostid routine.
req
07-13-2001, 01:37 AM
Please post a link for download :-)
Willebul
07-13-2001, 03:03 AM
ftp.graphicode.com


is this code tricking me ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > is this code tricking me ?
PDA

View Full Version : is this code tricking me ?

__DuDu__
07-11-2001, 08:21 PM
MOV EAX,[0040B760] ; EAX = Ah that is the lenght of the entered serial
CMP EAX,[0040B768] ; Compare EAX to the right serial ?! if yes where's the right serial ? d *40b768 or d 40b768 ?
JNZ 00408A12 ; jump if serial isn't equal EAX (if i patch this to je it goes to the registered msgbox else nothing happens)

Tnx in Advance
DuDu

/me slaps spiaj and kilby for being bad guys in my last post, be nice now ;)
CoDe_InSiDe
07-12-2001, 12:43 AM
Hi __DuDu__,

Your saying that if you Patch the JNZ to JZ you get the Registered Message Box?
But if i see about what you posted, it only Compares the Serial Length with the correct Length ? :)
Maybe some more info...? ;)

Cya...

CoDe_InSiDe
__DuDu__
07-12-2001, 04:15 AM
Hey CoDe_InSiDe :-)

Your saying that if you Patch the JNZ to JZ you get the Registered Message Box?
yes, patching it i get the 'Thanks for Registering MsgBox'

[quote]But if i see about what you posted, it only Compares the Serial Length with the correct Length ? ? 0040B768 d 0040B768 d *0040B768 ? whitch one of them ?

I think so, but how can I get the lenght thats being compared with the len of the entered serial ??

im thinking im in a protection that only checks the lenght of the serial :p

Tnx in Advance
__DuDu__
CoDe_InSiDe
07-12-2001, 01:32 PM
Hi __DuDu__,

Oh hehe ;)
Then just use "d 40B768" and look in the Data Window ;)

Cya...

CoDe_InSiDe
__Dudu__
07-12-2001, 03:43 PM
Hi Code, tnx for helping me, look i did what u did say to me and got it
:? eax
0000000A 0000000010 ""
: d 0040B768

018F:0040B768 02 00 00 00 B0 08 B7 00-00 00 00 00 00 00 00 00 ................
018F:0040B778 00 01 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................

so, is it comparing my serial to 2 ? dont think so coz it didnt jump when i passed the instruction :-/

tnx in advance


remember NE-files? ... need HELP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > remember NE-files? ... need HELP
PDA

View Full Version : remember NE-files? ... need HELP

gloryx
07-13-2001, 04:15 PM
... hay to all

... i'm first time here

... want good wishes for all good guys

... but now i need help - please continue reading

... my friend took me CD with one older proggy (expiried trial) from 1996 year

... NE-file with self-loader (packer) -win31

... after a lot of searching hours i found - nothing - no tools, no tuts, no discus, ....

... please, if anyone know about that (if remember that past time - win31 proggys) post here - any idea, web adress...

... thnx in advice
mo k
07-14-2001, 12:01 AM
You are better of not touching it.

win3.1 applications where buggy. the kernel
had no control over them. the win32api (duh)
was very primitive and most of it never existed.

Everything ran in real mode, and you can pretty
much guess what everyone was allowed to do.

If you are serious about this, you will need to study
the calling convention of the win16 api, get the docs (free with borland c.)
and get some real mode asm references. Good
Luck.

Or you can upload the app to a public ftp server, so *some* of us take a look at it
this sunday ; )
mo k
07-14-2001, 12:10 AM
How could i forget this. The Schulman series.
Or get Fravia's watered "Taskman" version, really good.

Search tsehp's for "taskman disassembly".

Also read Older articles from Matt Pietrek's
column "under the hood" IIRC, from MSJ. it is online
at MS's site. I haven't touched it in ages ; )

P.S. anyone noticed how lame pietrek was becoming?
i don't know about win98 saving him, but last time
i checked, he was into mfc guis >: /
gloryx
07-14-2001, 05:48 PM
... thnx mo k

... i just running to search that you said

... if i found more usefull infos about stupid ne-files reversing i'll post it here

... thnx again

... have a nice day
gloryx
07-19-2001, 08:37 PM
... can't search into deep past anymore

... i feel like archeologyst

... i give up


How to patch Registry Settings by Crack?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to patch Registry Settings by Crack?
PDA

View Full Version : How to patch Registry Settings by Crack?

TheDutchJewel
07-14-2001, 04:55 AM
I want to make a crack that doesn't only patch EXE-files but also change registry settings. Is this possible? With which prog?

Thanks in advance.
TheDutchJewel

(I also posted this message in Tools of our Trade Messageboard Forum, but i think it's the wrong Forum for it)
Solomon
07-14-2001, 05:04 AM
Probably you have to write your own tool.
NotMe
07-14-2001, 12:15 PM
You can try Clickteam Patch Maker
http:///www.clickteam.com
TheDutchJewel
07-14-2001, 04:01 PM
@NotMe
Thanks for the link. Nice prog, but it can't change registry settings (only read them to use for directory path).
Any prog else?

TheDutchJewel
NotMe
07-15-2001, 01:35 PM
Oops!! So sorry for misleading u 8( ... Maybe, Solomon is right
SpeKKeL
07-15-2001, 03:25 PM
Get " Tola's patching engine v1.8 "
You can make your .reg files and add them
to your crack.

SpeKKeL....... (dutch ??)
TheDutchJewel
07-16-2001, 12:48 PM
Yes! TPE works. Only one little prob: a message pops-up when importing the reg-file. But i asked already Tola to fix it.

I found an other patcher that can do the job:
Visual Patch (http://www.indigorose.com). It's an evaluation version, so cracks works only 10 days. Lash cracked version 0.9.0.2 beta, but that works only for the prog, not for the cracks. Who knows a good crack for it?

CU, TheDutchJewel


Inline memory patching Asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Inline memory patching Asprotect
PDA

View Full Version : Inline memory patching Asprotect

Instructor
07-15-2001, 04:53 AM
Hi, is it possible to inline memory patching asprotected software?
Is there any tutorial about this?

thx for your help
45xc
07-15-2001, 08:28 AM
just experiment

its like patching a program thats been compressed 4 times :p

just hook into each layer, everytime hooking the exit point, so you can hook into the new layers..

if crc is used, you may have to patch that to use the real crc (crc may be used to decrypt oep amoung other things)

i patched it hooking where he repz movsd's the unpacked data into its real va's .. about 4 patches + the 'crack' patch .. @ the repz movsd's, esi / edi contain a base for you to use to patch the new code .. (patch using [edi+xx] or sth)

go fourth, and experiment! took me around 3-4 hrs to get a 2 byte patch done, hehe


Revirgin minor update -> Auto locate IAT start + length added !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin minor update -> Auto locate IAT start + length added !
PDA

View Full Version : Revirgin minor update -> Auto locate IAT start + length added !

tsehp
07-16-2001, 02:12 PM
you can try it at usual location tsehp.cjb.net, the version 1.11 is here to download.
Please report me directly any bugs, thanks.

+Tsehp
Maggot
07-16-2001, 05:13 PM
The only thing i want to say is Thank you :)
tsehp
07-16-2001, 05:36 PM
Maggot (07-16-2001 15:13):
The only thing i want to say is Thank you :)

yes but I was first very against this feature...just because it doesn't help newbies that absolutely need to know how to locate iat's by themselves so I hope this new feature will be used with wisdom. It's search domain is restrained by two dwords meaning we are at the start/end of iat domain, but iat start will always point to a valid one, so it's still more easy to locate the real iat domain. I already encountered some iat separated by about 100 zero filled dwords so be careful with this new feature.

I'm always open to new features, everyone is free to ask here.

regards,

tsehp
Maggot
07-16-2001, 07:48 PM
I think it´s going to help newbies in some way. Cause when
they cant find the iat by themselves, they will hopefully find
it with your Revirgin. And if they are curious like most of us,
they will scream "How the hell did Revirgin find the iat".
Thats when (i hope)they will try harder to understand.

"Can i reverse Alexey Solodovnikov when he dies?"
hz
07-16-2001, 08:43 PM
hiya.
"Can i reverse Alexey Solodovnikov when he dies?". How would you know he was really dead and it wasn't just his latest trick?.
Be a sad day for us if anythin happened to AS, he provides 50% of the fun on this forum. He has a good sense of humour top. Cheers AS.
regards
nc
07-16-2001, 11:00 PM
tutor on aspr nearly done ;)

expect it very soon, (i am making some small modifications after some ppl helpfully proof read it, thanks LaptoniC).

btw tsehp, sorry bout the beef in the other thread.

NchantA
CoDe_InSiDe
07-17-2001, 12:32 AM
Hi +Tsehp,

I've downloaded Revirgin, but i've got some weird messages ;)
I haven't tried the program itself (I don't use Revirgin so much ;) ) but i get the messages at startup.

First of all i need to copy/overwrite the 2 .dll's with the ones from the .zip and they need to be copied/overwrite in the %systemroot% (My case C:\Windows\) right? :)
Ok, well i did that and i first started Revirgin from within the .zip file and i get this Message:

"Argument incorrect pour l'encodage de date" ??

Something with the programs date i think dunno :)
Ok, then i copied Revirgin.exe on my desktop and runned it, i get this message:

"Violation d'accés à l'adresse 004075D0 dans le module "REVIRGIN.EXE". Lecture de l'adresse BFF60000."

Hmm, reads from a bad Memory address i think ;)
But when i click "Ok" the program just starts :)
And sometimes i get some message that i need to update "thread.dll" and/or "Tracer.dll" (also at startup) ?? ;)

Heh, that's weird while i'm writing this post i discovered that i can't run Revirgin.exe from "C:\" and/or from "D:\" ?? ;D

Well that's it for now ;)

Cya...

CoDe_InSiDe
tsehp
07-17-2001, 06:27 AM
hz (07-16-2001 18:43):
hiya.
"Can i reverse Alexey Solodovnikov when he dies?". How would you know he was really dead and it wasn't just his latest trick?.
Be a sad day for us if anythin happened to AS, he provides 50% of the fun on this forum. He has a good sense of humour top. Cheers AS.
regards
entirely agree with you ;-)
how can black exist if white is not present ?
asprotect still remains my favorite target, most creative, copied by a lot of other schemes and no stupid ads like : the ultimate protection scheme in the world
tsehp
07-17-2001, 06:29 AM
CoDe_InSiDe (07-16-2001 22:32):
Hi +Tsehp,

I've downloaded Revirgin, but i've got some weird messages ;)
I haven't tried the program itself (I don't use Revirgin so much ;) ) but i get the messages at startup.

First of all i need to copy/overwrite the 2 .dll's with the ones from the .zip and they need to be copied/overwrite in the %systemroot% (My case C:\Windows\) right? :)
Ok, well i did that and i first started Revirgin from within the .zip file and i get this Message:

"Argument incorrect pour l'encodage de date" ??

Something with the programs date i think dunno :)
Ok, then i copied Revirgin.exe on my desktop and runned it, i get this message:

"Violation d'accés à l'adresse 004075D0 dans le module "REVIRGIN.EXE". Lecture de l'adresse BFF60000."

Hmm, reads from a bad Memory address i think ;)
But when i click "Ok" the program just starts :)
And sometimes i get some message that i need to update "thread.dll" and/or "Tracer.dll" (also at startup) ?? ;)

Heh, that's weird while i'm writing this post i discovered that i can't run Revirgin.exe from "C:\" and/or from "D:\" ?? ;D

Well that's it for now ;)

Cya...

CoDe_InSiDe

Ok I'll fix this for you, can you send me the exact version of windows you're using ?
I'll check right away on win_me this evening.
CoDe_InSiDe
07-17-2001, 06:46 AM
Hi +Tsehp,

I'm using:

Win98SE 4.10.2222 A

Cya...

CoDe_InSiDe
goatass
07-17-2001, 09:48 AM
Tsehp, make the error messages in English will ya :))

just busting your balls pal

cheers
goatass
CoDe_InSiDe
07-17-2001, 10:22 AM
Hi goatass,

Yes, that would be a good thing too ;)

Cya...

CoDe_InSiDe
McNy@Work
07-17-2001, 01:41 PM
CoDe_InSiDe (07-17-2001 04:46):
Hi +Tsehp,

I'm using:

Win98SE 4.10.2222 A
...
CoDe_InSiDe

Same windows version and same message, but the address is different.

message:

"Violation d'accés ?l'adresse 004075D0 dans le module "REVIRGIN.EXE". Lecture de l'adresse BFF61000."
tsehp
07-18-2001, 01:39 AM
hiya,
it's the rv kernel patcher that causes the problem, this will soon disappear in version 1.2 when I'll port the tracer to win nt.
I'm re installing win98 today and will fix this.

About the french error messages, those comes from borland c++ builder 5 french version, so three solutions :

1-send me a english borland c++ 5 trial cd rom
2-translate the french error messages into english into those libraries
3- learn french ;-)

maybe if someone can create an iso image I can download it...SLAP no crack/warez requests...grrr

regards;

+tsehp

tsehp
seir
07-18-2001, 10:44 AM
+Tsehp (07-18-2001 01:34):
About the french error messages, those comes from borland c++ builder 5 french version, so three solutions :

1-send me a english borland c++ 5 trial cd rom

tsehp

Borland C++ Compiler version 5.5 is available for free:
http://www.borland.com/bcppbuilder/freecompiler/

- seir
tsehp
07-18-2001, 03:19 PM
seir (07-18-2001 08:44):
+Tsehp (07-18-2001 01:34):
About the french error messages, those comes from borland c++ builder 5 french version, so three solutions :

1-send me a english borland c++ 5 trial cd rom

tsehp

Borland C++ Compiler version 5.5 is available for free:
http://www.borland.com/bcppbuilder/freecompiler/

- seir

thanks but it's the whole i.d.e. that I need ;-)
tsehp
07-18-2001, 03:21 PM
tested on win98 and win 2000 and fully working.
sorry for the problems occured by build 15.
CoDe_InSiDe
07-19-2001, 12:18 AM
Hi +Tsehp,

Hey no problem, Bugs are everywhere ;D

Cya...

CoDe_InSiDe
tsehp
07-19-2001, 07:08 AM
also added today (who pays me for this ;-)
a combo box to show unresolved entries.
stillnewbie
07-19-2001, 11:16 AM
+Tsehp (07-19-2001 05:08):
also added today (who pays me for this ;-)
a combo box to show unresolved entries.

Alexy pays :D
Btw I have test its great even in win95 :)
ThankYou Tsehp

Heya CoDe_InSiDe,

>Bugs are everywhere ;D
yeah CoDe_InSiDe }>
stillnewbie
07-19-2001, 12:17 PM
stillnewbie (07-19-2001 09:16):

Hiya CoDe_InSiDe,
>Bugs are everywhere ;D
>yeah CoDe_InSiDe }>

erhem Just joking
Btw thanks for the file.You have added sumthing hahaha its funny :-D
>Bugs are everywhere ;D
>yeah CoDe_InSiDe }>[/quote]
CoDe_InSiDe
07-20-2001, 12:05 AM
Haha stillnewbie ;D

Cya...

CoDe_InSiDe
tsehp
07-20-2001, 07:12 AM
the next step is to change the tracer to make a generic one, it's working under win9x and manages to trace an app from start to beginning, allowing you to locate oep and later dump it.
I'm porting it to win2k so I needed to develop a kernel mode driver to make the same things than win9x, it's soon finished, maybe before august.
regards,

tsehp


How to unpack EXE protected by Cexe v1.0a?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to unpack EXE protected by Cexe v1.0a?
PDA

View Full Version : How to unpack EXE protected by Cexe v1.0a?

thedutchjewel
07-18-2001, 12:38 AM
How to unpack EXE protected by Cexe v1.0a?

CEXE EXECUTABLE COMPRESSOR 1.0A 25.05.2001 SCOTT LUDWIG / TINYWARE INC.
Compresses a input exe into a smaller output. It also has the option of skipping icons in the output. However it only runs on WinNT, Win2000 and above - won't run on Win95 or Win98.

Thanks in advance.
TheDutchJewel
tsehp
07-18-2001, 07:09 AM
thedutchjewel (07-17-2001 22:38):
How to unpack EXE protected by Cexe v1.0a?

CEXE EXECUTABLE COMPRESSOR 1.0A 25.05.2001 SCOTT LUDWIG / TINYWARE INC.
Compresses a input exe into a smaller output. It also has the option of skipping icons in the output. However it only runs on WinNT, Win2000 and above - won't run on Win95 or Win98.

Thanks in advance.
TheDutchJewel

what did you tried to unpack it ? tools + methods ?
Wizard
07-19-2001, 02:16 AM
Quote from readme.txt :

"When the compressed .exe is run, you are actually launching a
version of dexe.exe, which decompresses the compressed resource
into a temporary file, then launches this temp file with the
command line parameters given to dexe. Dexe waits for the target
executable to return, then deletes the temp file and returns the
right result code."

So, to unpack, run the packed proggy, look for the .tmp file created in the same directory, copy and rename it to 'unpacked.exe' and there you are !

Wizard
thedutchjewel
07-19-2001, 12:10 PM
I tried to y'r sollution, but i didn't work. :( Perhaps because the cryptor isn't Dexe but Cexe. But perhaps also because i tried to unpack an DLL file: MSO.DLL from MS Office XP Pro, cracked by UCF on 15-7-2001! (http://210.74.232.34/Winzheng/$www.winzheng.com$/wON-officexp_only_patch.zip)!
I cracked the file before myself (it works!: i removed the 50 times trial period), but the UCF version is better i think because when you tries to activate it comes with an message that the prog is already activated; with my file nothing happens (als good, but as said, UCF is better). That's why i'm interested in unpacking that DLL-file. ;)

Anyone with some ideas about how to do it?
Thanks, TheDutchJewel
thedutchjewel
07-19-2001, 12:13 PM
Here are some mirrors to the cracked and encrypted MSO.DLL:

Mirror 1:
h**p://www.multimania.com/ockefeller74/cc/won-officexp_only_patch.zip

Mirror 2:
h**p://www.multimania.com/ailey4dfih/dladen/won-officexp_only_patch.zip

TheDutchJewel
Wizard
07-20-2001, 02:21 AM
You can be sure this DLL is not packed with CEXE... because CEXE CAN'T compress DLLs !!!

Wizard
Yado
07-20-2001, 04:11 PM
Uhmm , i've downloaded the .dll , but why you say it's crypted ? i dont see any crypt on it

Yado of Lockless.
thedutchjewel
07-21-2001, 01:52 AM
Some reasons why i think the UCF-cracked DLL is protected:

1. check it with FILE INSPECTOR XL (h**p://www.mesa-sys.com/~codomain/)
2. new PE-section in UCF-cracked DLL: .annina
3. different file size: (original [Dutch version]: 9995680, UCF-cracked DLL: 9994240)
4. different Entry point: (original DLL [Dutch version]: 4330h, UCF-cracked DLL: 13EB7h)
5. when opend with W32Dasm there are no References in UCF-cracked DLL

TheDutchJewel
thedutchjewel
07-21-2001, 01:55 AM
Some reasons why i think the UCF-cracked DLL is protected:

1. check it with FILE INSPECTOR XL (h**p://www.mesa-sys.com/~codomain/). By
Compiler/Packer/Protector:
Cexe 1.0a (Heuristic: 7,5%)

Signature: < 00 00 00 53 56 8B 75 0C 57 8B 7D 08 83 FE 01 74 0A
FF 75 10 56 57 E8 91 02 00 00 33 DB 3B F3 0F 84 9B 42
26 00 83 FE 01 0F 84 CF 00 00 >

2. new PE-section in UCF-cracked DLL: .annina

3. different file size: (original [Dutch version]: 9995680, UCF-cracked DLL: 9994240)

4. different Entry point: (original DLL [Dutch version]: 4330h, UCF-cracked DLL: 13EB7h)

5. when opend with W32Dasm there are no References in UCF-cracked DLL

TheDutchJewel


digital rights management
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > digital rights management
PDA

View Full Version : digital rights management

akki
07-18-2001, 12:59 PM
about 8 months ago i purchased a pc game rental from blockbusters. it seems a company (then) called aegisoft corp had gotten several games companys to buy into this. the company is now defunct (it was bought out by real media for thier DRM package). i am at a loss on this one, someone better then me needs to take a look at it. (i'm willing to send the game). i think this would be an excelent prog to right a tut on, as
a). the company is no longer putting out the product (no moral issue here)
b). some screwed up form of this protection could now be in use in realmedia stuff.
qweasdzxc
08-19-2003, 10:00 PM
Digital Rights Management is the key to the new online service called Movielink.com ... it seems that they update your mediaplayer (be it real or winders), and give you 30 days to watch the media the first time, then 24 hour of free reign over the file. looks like it's going to be about $5(us) a movie.

I wonder if they will get off the ground though, considering that I can rent a movie at blockbuster cheaper, and rip it in 15 minutes.

I'm still going to look at the code though;)


revirgin???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > revirgin???
PDA

View Full Version : revirgin???

blat
07-19-2001, 11:30 AM
hi,

when I try running revirgin I got message:

error you must copy your thread.dll and tracer.dll into windows sytem
root.

I have done this and reebooted my computer but I still got the message
I use w98 v4.10.1998

regards

bf
stillnewbie
07-19-2001, 12:08 PM
blat (07-19-2001 09:30):
hi,

when I try running revirgin I got message:

error you must copy your thread.dll and tracer.dll into windows sytem
root.

I have done this and reebooted my computer but I still got the message
I use w98 v4.10.1998

regards

bf

Hiya,
>error you must copy your thread.dll and tracer.dll into windows sytem
>root.

you have mistaken,the dll files should copied in the windows directory,not
windows\system

regards
stillnewbie
bfat
07-19-2001, 04:51 PM
thanks

regards

bf


Quick warning to all RCE Webmasters.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Quick warning to all RCE Webmasters.
PDA

View Full Version : Quick warning to all RCE Webmasters.

CrackZ
07-19-2001, 01:51 PM
Hiya.

This is a general warning to all RCE webmasters just to check very carefully their e-mail attachments; I'm sorry if this sounds patronising if you do it already ;-) but better safe than sorry.

There is an individual distributing an attachment by the name of 015200-006 estimated.doc (it purports to be a tutorial which of course you may (if your hands were too quick for your brain, run without thinking)).

I've literally just done 10 minutes analysis on this and basically its nothing more than one of the ubiquitous sub7 trojans which (haven't verified this yet, connects you unwittingly to some central IRC server), its also unlike many of the other sub7's in that its not really well concealed, (its not packed) and compiled in Delphi.

It installs itself with hidden attributes as SCam32.exe (get it ;-) ) in your /system directory, there are a few other files too (also hidden), one of them, sci1.dll is plaintext and quite interesting :

admin@defacers.com
asl@uofg.com.ua
boloh@263.net
crackz__@hotmail.com
crayser@gmx.net
emersa@ponferrada.com
goatass@newavedesign.com
inet@microsoft.com
it_tomorrow_today@confused.com
leszek@dubiel.pl
lmmendoza@go.com
lword@world.std.com
meteo@null.net
mikicom@teleline.es
morlac@hotmail.com
mpietrek@tiac.com
none@foryou.com
quotes@call4cms.com
reg@extreme-dm.com
sope@rediffmail.com
tanuki@pannotia.com
theanalyst@hushmail.com
vinoprem@yahoo.com
xiaoxiaoc@8848.net

This guy doesn't like some people it seems.

The trojan ensures its run by several entries in the registry, SCam32.exe is nothing more than a dropper for the IRC client Sirc32.exe (hidden inside your /recycled directory), the root class of exefile is also changed to ensure Sirc32.exe gets run everytime you execute something as is one of the RunOnce (can't remember if its that one) keys. It also seems to have several of its own configurable entries in LOCAL_MACHINE/SirCam and below.

Anyway, I plan a good look inside this and will probably post a document of how this thing really operates in due course, in the interim.....

Regards and heads up.

CrackZ.
goatass
07-19-2001, 03:40 PM
wow I'm on the list, I'm touched :)

CrackZ buddy thanks for the warning and I'm looking forward to see your paper on it, so don't be a lazy limie and do it :P

goatass
the analyst / ucf
07-19-2001, 05:20 PM
goatass (07-19-2001 13:40):
wow I'm on the list, I'm touched :)

CrackZ buddy thanks for the warning and I'm looking forward to see your paper on it, so don't be a lazy limie and do it :P

goatass

im on it too
wow, im gonna cry ;) touched too
heh
can't wait to see crackz's lazy powered paper on it ;-)
i couldn't get that mail yet, sadly..
thx for the warning CrackZ :)

best regards all,

the analyst
Duelist_
07-19-2001, 09:18 PM
http://www.protectorplus.com/virus_info/worms/sircam.htm

Could that have anything to do with it?

Cheers,

Duelist
CrackZ
07-20-2001, 01:50 AM
That'll teach me to post on this board BEFORE searching the web ;-).

It looks pretty uhm much like this is my nasty, didn't find the C:\My Documents part though but I'm sure thats just cosmetic, might still be worth some analysis just to *see*.

The warning still stands ; /me goes off to re-acquaint himself with www.google.com.

Regards

CrackZ.
Sope
07-21-2001, 02:15 AM
I too on the list
Thanks Crackz for the warning.
Warm Regards to all!

Sope
fuckin_furious_splaj
07-29-2001, 08:00 AM
and I just got it 20+ times from a guy called Gianluca (libero.it) regarding some help he needs with EasyCD creator and also Lettara generica gengy

f**** you wap ass hole i'm comin after you buddy . yes I can see your fu***** e-mail irc jenji@libero.it

F***** W****** !!! - he's just a lamer

btw tnx CrackZ + ZoneAlarm Pro


Lingoware 3 Crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Lingoware 3 Crack
PDA

View Full Version : Lingoware 3 Crack

Andhy
07-20-2001, 10:42 PM
Alguém tem ou sabe onde eu posso encontrar o Crack do Lingoware 3? ???
Já faz um tempão que eu tô atraz e não encontro... :'(
Desde já obrigado. :-)
hz
07-20-2001, 11:19 PM
is this another RV error message?
CoDe_InSiDe
07-21-2001, 12:38 AM
Hi hz,

Haha, i don't think so ;)
This sounds more like a crack request to me ;)

Cya...

CoDe_InSiDe
nofurs
07-21-2001, 10:16 AM
Looks like he didn't find his girlfriend oep :-D
Snacky
07-21-2001, 05:57 PM
LEIA :

Use this board if you need help on general topics about reversing. Registered Members can upload files, with a 500k limit. FLAMES, CRACK AND SERIAL REQUESTS WILL BE REMOVED.

Use esta board para assuntos gerais sobre engenharia reversa. Membros registrados pode fazer upload de arquivos com até 500k, DIFAMAÇÕES, REQUISiÇOES DE CRACK E SERIAIS SERAO REMOVIDOS.

Sera que voce nao tem capacidade pra entender isso ? vc acha que aqui todos sao seus escravos e se vc pede um crack eles te atendem ? nao é assim nao, se vc nao percebeu a lingua default dessa board é ingles..salvo agora que estou tendo que te ensinar boas maneiras ja que pelo que vi voce nao tem nenhum conhecimento na lingua inglesa, ou se faz de desentendido e assim só piora a situação brasileira na scene..vc envergonha a gente e gente como voce tem que morre !!!

I just explained him the rules of the board, anyway its a crack request and should be deleted :]
matag@llos
08-22-2001, 06:59 PM
Andhy (07-20-2001 20:42):
Alguém tem ou sabe onde eu posso encontrar o Crack do Lingoware 3? ???
Já faz um tempão que eu tô atraz e não encontro... :'(
Desde já obrigado. :-)
woodmann
08-22-2001, 08:03 PM
Thank you people, My language skills are terrible.

Peace, Woodmann


Asprotect V1.3?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asprotect V1.3?
PDA

View Full Version : Asprotect V1.3?

LunarC
07-22-2001, 11:34 AM
Well! I ran across Winsniffer 1.22 at winsniffer.com
This program is basically similar to Iris or Spynet!

well i would like to peek inside its protection but found out that it was packed with ASprotect V1.3 as reported by File Info V2.45a by Michael Hering! I try another scanner PeScan and it says the file wdsm.exe is protected by asprotect v1.2

I went and check the aspack.com ! the latest file is asprot V1.2

my question is! is there really V1.3 exist or somebody play around with peheader?

well! i try to hexedit it but no nfo is available!
somebody would like to clarify? or better still i'll mail to Mr. hering if i have time

cya
Alexey Solodovnikov
07-22-2001, 02:57 PM
LunarC (07-22-2001 09:34):
I went and check the aspack.com ! the latest file is asprot V1.2

my question is! is there really V1.3 exist or somebody play around with peheader?

well! i try to hexedit it but no nfo is available!
somebody would like to clarify? or better still i'll mail to Mr. hering if i have time

cya

You can ask me by e-mail :) I'm ready to help.

Alex.
hz
07-22-2001, 03:44 PM
Hiya Alexey,
Man I have got some q's for yer ;). keep it going.
regards
Alexey Solodovnikov
07-22-2001, 04:34 PM
You're welcome, bro.
NchantA
07-23-2001, 12:40 AM
love or hate eh? ;)

im a great admirer of your work budd, sorry bout the up and coming tutorial, but someone had to do it ;)

your tricks are a welcome distraction, as most shareware are really mindless in their protections these days. Its good to see a protectionist that keeps abreast of forums like this, actually trying to improve his product instead of lying about it, and relying on flashy websites and marketing. remind you of someone splaj? (Bi-Tarts die :))

good luck alexey, im not even going to try and spell your last name aha.

nc.
Kilby
07-23-2001, 03:36 AM
Hey Alexy,

Just to say thanks for giving us something interesting to work on.

As several folks have said asprotect, is the one product that dosn't offer the world, but offers more than any of the others on the market.

But could you please let us know when an update is released, so as we can have a little race amongst ourselves :)

Regads and best wishes,

Kilby...
Kilby
07-23-2001, 04:05 AM
LunarC,

It's safe to assume that it's some form of 1.2, as Alexy appears to have a habit of updating asprotect without telling anybody (anybody around here anyway).

I dunno what way the file typer/identifier decides which version of asprotect it is but it probably isn't a couple of bytes containing the version information.

regards,

Kilby...
sv
07-23-2001, 07:15 AM
Hi reversers

Interesting target, some code are crypted but you can add yours to show real password.
For example ftp case :

015F:0040505C 6A04 PUSH 04
015F:0040505E 6838AF4000 PUSH 0040AF38
015F:00405063 FF75FC PUSH DWORD PTR [EBP-04]
015F:00405066 FF157C754000 CALL [0040757C]
015F:0040506C 83C40C ADD ESP,0C
015F:0040506F 85C0 TEST EAX,EAX
015F:00405071 7523 JNZ 00405096
015F:00405073 8B45FC MOV EAX,[EBP-04]
015F:00405076 83C005 ADD EAX,05
015F:00405079 50 PUSH EAX
015F:0040507A EB4A JMP 004050C6

and
0167:0040AF38 50 41 53 53 00 00 00 00-00 00 00 00 00 00 00 00 PASS............

Include idata file.
Kilby
07-23-2001, 07:35 AM
Long time no chat SV, hope you are keeping well,

You can also redirect some of the other print routines to return the password instead.

The anoying thing is that it only appears to grab the password if it's on the standard port on the last version.

A small but important oversight, especially for those users of proxy servers.

Kilby...
LunarC
07-23-2001, 10:33 AM
thanks all!
Hey is it really you alex? nahhh I don't buy it!
Alexey Solodovnikov
07-23-2001, 03:18 PM
LunarC (07-23-2001 08:33):
thanks all!
Hey is it really you alex? nahhh I don't buy it!

It's really me. As I said before you can reach me by e-mail to check it :)

Alexey VeryLongRussianSureName ;)
NeO'X'QuiCk
07-23-2001, 06:36 PM
What is your Email Alexey Solodovnikov

NeO'X'QuiCK
tsehp
07-23-2001, 07:09 PM
hiya alex ,
when will as 1.3 be available for download ? Or can you leave it here as an attachment ? (I'm half dreaming ;-)

this is not crack request, but prot request ;-) don't flame me please :-)

tsehp
NchantA
07-23-2001, 11:44 PM
LOL tsehp ;)

i dont mind withholding the unpacking tutorial until the next version is released, if indeed there even is to be a new version or new flavour soon. im sure tsehp will agree with me here. although i will honour any personal requests.

NchantA
tsehp
07-24-2001, 07:30 AM
yes nChant, and you can be sure that the "Alexey" that is speaking here will consider as a pleasure to help us adapt the tutorial to version 1.3 ;-)
nchanta
07-26-2001, 09:11 AM
WebSite watcher v3.21. http://www.aignes.com
very interesting. i have a dump and iat RVA aswell as size.

this looks to me like a new trick of alexys, i may be wrong though.

it seems that the IAT jmp table doesnt actually jump to the api anymore. instead it jumps to a little bastard routine, which does a few things and then push ADDR_OF_API and then ret's into the api.

highly annoying. after using imprec to patch in the full rebuilt iat (attatched, pleaz notify me if there is an error), the program crash's. its trying to find the piece of memory that jumps to the api, instead of jumping to the damn thing.

is this as unusual as i think or am i retarded?
LaptoniC
07-26-2001, 12:32 PM
Hi Nchanta, :)
I guess your OEP is wrong according to my lame findings :)
OEP: 00165608 IATRVA: 0016E178 IATSize: 00001828
My IATRVA maybe wrong (0016E250 maybe just you found),but I am dead sure about the OEP.
Icedump tracex first stop at 54D52C but it is fake.If you look at closely you will see that it checks .key file in the directory and registry key.When you retun from this call you will be again at asprotect code.So when you retun from this call again use tracex comand and program will stop at entrypoint.Then do what ever you want :)
However my dumped exe didnt run with my fixed iat.Anyway maybe my iat start is wrong or it is looking some code from asprotect.I have attached my iat hope it helps.
hz
07-26-2001, 03:59 PM
Hiya,
nothing new in this version from v3.20, for imprec use
0016E17C 00000824
LaptoniC's OEP is right. EB's tut explains better than I would how to fix up the unresolved, its posted on the board somewhere.
regards
+SplAj
07-28-2001, 04:11 AM
OEiP VA 565608 (rva 165608 )
IAT va 0x16E17C L 0x81C
.NewSec 0x1E3000

LOL imprec !!!!! WTF is wrong with RV ???

PROBLEM IS 'InitialiseCriticalSection' is ALREADY done and flagged by aspr ;)

check the disa and see flag is set at [56B430] == 01 .......
so code at 402210, 40239D and 40270C can never be called....... SO clear ALL the variables around this area ;) everything to 00.

It's also a Delphi5 .........

managed to decode that wswatch.cfg. The checksum code is from 49B160 to 49B228. Also there is nice SEH by the programmer and any interference gives a nice messagebox with a RED PIRATE icon ......LOL nice touch.

I attach some bits of info (the iat 'SPLAJ' is for Win98/ME cos kernel_02F is used for RET004)

+Spl/\j
'patch+play'
FlyingRaichu
08-23-2001, 12:00 AM
thought some in this thread might be interested in checking out the just released website-watcher 3.21 crack.
there is a long description of the crack; splaj and this thread is given much credit in the discussion on unpacking and fixing.

and i wanted to say thanks in person as well.
-flying raichu


2 questions about Asm Programming resources
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > 2 questions about Asm Programming resources
PDA

View Full Version : 2 questions about Asm Programming resources

zit
07-22-2001, 05:14 PM
1. Has anyone read Barry Kauler's book Windows Assembly Language & Systems Programming : 16- And 32-Bit Low-Level Programming for the PC and Windows? I'm thinking about forking out the $$$ but wanted some feedback first. Are there any better books out there (this one was written in 1997)?

2. Has anyone tried ShADe and CodeFumbler's Ultra Ide-asM visual IDE that uses Ultra-Edit for creating programs in Win32 assembler?
See http://lightning.prohosting.com/~cfumbler/

What do think about it? Does it work in WinME?

Thanx,
zitterbe
latigo
07-22-2001, 05:30 PM
Barry kauler is usually recommended, i have not read it tho'.
You can take a peek at the digital version which is all around the web.
About the UE addon, i don't even have UE :)
Bye!

Latigo
mo k
07-22-2001, 09:34 PM
BK's book is imho over recommended.

I read the electronic version, and i wasn't very
happy with it.

If you are forking the money, you might as well
spend it on "selected" books from the MindShare series.

They will teach you the AI32 architecture. Then
with whatever left from your book budget, you
can spend it on paper, to print out Iczelion's
tutorials, and some chapters from the Pietrek book.

If there is still some money left out, i would get
the latest edition of Barry Brey's kitchen-sink-intel-doc-book.
Which is a good alternative to the 3 intel PDFs combined.
Tezza
07-23-2001, 01:54 AM
I have the book and I think it's crap. Iczillions tutes would leave it in the dust.

The addon from shades for ultra ed is also crap (at least with win 2000) as it doesn't work.

Hope this helps.
zit
07-23-2001, 04:30 AM
I'll stick with Iczellion.
I have the PDF version of Matt P's book on PE format which is pretty fine IMO. I was just looking for a good asm book.

zitterbe
the analyst / ucf
07-23-2001, 09:48 AM
zit (07-23-2001 02:30):
I'll stick with Iczellion.
I have the PDF version of Matt P's book on PE format which is pretty fine IMO. I was just looking for a good asm book.

zitterbe

i have that book too.
electronic version.
a friend of mine shared me the book (the real one this time , heavy and paper powered ;) and i have to say that it is not that good.
of course you learn stuffs from it, but i don't recommend it.
matt's Programming secrets is way better, and for asm, you shud read icz's tuts as ppl said.
i'd not buy the book by kauler, but get the electronic version only.
this is just my humble opinion.

regards,

the analyst


asprotect api what a chaos
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > asprotect api what a chaos
PDA

View Full Version : asprotect api what a chaos

NikDH
07-22-2001, 08:23 PM
Hi to all,
i'd like to know a good way to follow to get rid of asprotect api when i unpack a program

Just every advice is appreciated :)
Tnx a lot

See ya
NikDH


protection with vb and ocx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > protection with vb and ocx
PDA

View Full Version : protection with vb and ocx

NikDH
07-23-2001, 11:51 AM
Hi to all
was working on a protection made 4 vb progs
Its an ocx component which nags when
u r not registered and ask 4 the regcode
When u put in a valid regcode it sets a property
that original prog has to check to know how it has to behave: registered or not
So my question is
How can i know where this property value is stored in memory?
The program checks its value using the
__vbaBoolVar() function but i've no info about it
Does some of u know anything more about it ?
See ya
NikDH
goatass
07-23-2001, 12:48 PM
hi, that API checks to see whether a variable is True or False, 1 or 0.
So for example, if you entered the correct regcode that variable will be set to 1 so when __vbaBoolVar() is called it will return true telling the application that it's registered and it can continue.

Since this program is VB you can use SmartCheck to see what it does, it might tell you where this flag is stored. You can also use FileMon and RegMon to see where on the hard drive or registry the program may store this flag. In order for it not to ask you for a regcode every time you open the program it has to store this flag somewhere. The other thing you can do is trace the OCX with SoftIce and find out where is the regcode checking algo and disassemble it and study it. You could make a keygen or just a regcode for your name.

good luck
goatass
NikDH
07-23-2001, 06:23 PM
>You can also use FileMon and RegMon to see >where on the hard drive or registry the program >may store this flag. In order for it not to ask >you for a regcode every time you open the >program it has to store this flag somewhere.

Well i think the program will store my regcode and check 4 it every time it needs: this way its much better 4 the program security

>The other thing you can do is trace the OCX >with SoftIce and find out where is the regcode >checking algo and disassemble it and study it.

Thats a good idea but in disasming it i havent had anything familiar to deal with :)
Perhaps u can gimme some hints on debugging ocx
See ya
NikDH
goatass
07-23-2001, 08:54 PM
That's what I mean, the program will store the serial and check for it when needed but you need to figure out where it is stored and FileMon and RegMon will help you.

If you could upload the OCX file I could look at it....tracing it would be the same as tracing anything else.

goatass
Kilby
07-24-2001, 04:05 AM
Hi Sorry to butt in,

I have only worked on 2 .ocx files, active skin and something else.
As goat ass says they are just like any other .exe file to dissassemble

If you pass it through IDA it will dissassemble very happily (providing it's not packed).

From there you can find your suspect routines and set breakpoints on them

BPM works best I found.

Regards,

Kilby...
NikDH
07-24-2001, 06:00 AM
Hi to all,
i've already disasmed the ocx with ida and cought the code but its not as clear as 4 exe
In ocx there r functions that r not called as dll function:
in a dll they r exported and the origianl program call them with call far
in an ocx the things r much more complicated coz there r no functions exported but the ones 4 the ocx managing (installing and disinstalling it)
So its quite hard to identify what a function does if we dont know its name and we have to deal only with vb api (which r imported by vb dll)
It should be useful to know something more about function like __vbaBoolVar()
It seems to take one param in the stack but its not a mem addr but it seems like a var ID
Tried to reverse the function in the vb dll and it seems to look somewhere in the mem 4 the value of the BoolVar, whats strange is that the addr it reads is not in the ocx mem zone
Is it normal ?
goatass
07-24-2001, 12:58 PM
Dude you are making this way too complicated.
OCX don't have exported APIs because they don't export anything, they are accessed through interfaces, but that's besides the point. All you do is, you trace the application from where you enter the serial number until you see that it jumped to the OCX code, at that point you trace until you see that it's doing something that looks like serial generation or anything related to serial generating/comparing. At that point you write down the address of where you think the key gen routine is and use IDA to take a broader look at the code.

OCXs are not DLLs, therefore you will not find exported functions in them to set BPXs on.

What I do many times is use IDA to locate key areas where I think the protrection might be in, then I load the application, break in and start tracing until I'm in the OCX code, then I set a BPX on the address I noted from IDA, F5 to it, and trace it to see what happens.

Don't make this too complicated, it's not.

goatass
NikDH
07-25-2001, 02:54 AM
Perhaps what i need is to study the com technology coz ocx use com tech :)
It seems __vbaBoolVar() takes a obj reference and i need to know much more about that
If someone will provide me some url or doc about this topic it will be great :)

Tnx to TTom 4 his kindness :)

See ya
NikDH


About REVIRGIN
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > About REVIRGIN
PDA

View Full Version : About REVIRGIN

neo
07-23-2001, 10:47 PM
I wonder something is the problem with me or is the problem with REVIRGIN.I was trying that example that is in the zip file .. i dumped the exe that is not problem..

I opened packed exe the reg.. and change the Oep 4010cc and i press Fetch Iat ..THen i pressed ITA resolved and resolve again and i got the same as in reso...txt

But next part is weird.. i know i have to trace what i didnt get i did and all was fine except the last to
131 00006500 00801E74 0000 ?????? ??????
132 00006504 00801E90 0000 ?????? ??????
133 00006508 00801EAC 0000 ?????? ??????
134 0000650C 00801EC8 0000 ?????? ??????
135 00006510 00801EE4 0000 ?????? ??????
136 00006514 00801F00 0000 ?????? ?????? <<<<<I get crash or freeze
137 00006518 00801F1C 0000 ?????? ?????? <<<<<i get crach or freeze

For trace i used trace all and i got crash then i said i will do ti again and i trace manually one by one and when i got to last to i alwasy go the freeze or crach or shtu down of the whole pc

so i wonder if i did something wrong... ??
Did some else got the same problem as me

NeO
NEO
07-24-2001, 10:44 AM
Because normally you would use trace on that api you would get traced and after trace you would press REsolved again and you would api.. i dont know but i didnt have problem before i think but i am not sure i have win 98 and softice but i dont think that is the case..

NeO
Neo
07-24-2001, 10:54 AM
I found it Advice : this tracer can crash or freeze your computer, so better choose tracer with about 5-10 selected entries then save the imports text file, if your pc crashes, you can load resolved imports at continue where it crashed.

So it normal but the hell i cant get that last 2 api's

NeO
NeO
07-24-2001, 11:10 AM
Maybe i forgot to write that after i resolved(2 twice ) i got the same result as you see in zip in resolved.txt.. after i used trace that is where a problem beginned..

NeO
tsehp
07-25-2001, 02:03 AM
the problem resides on the iat length : put 238 instead of 240, the two last ones are invalid entries. (read the doc)
the auto fetch feature just locates the iat entries but you have to correct it yourself sometimes.

so the two last ones will disappear from the list.


Hardlock Key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hardlock Key
PDA

View Full Version : Hardlock Key

Sedoy_H
07-26-2001, 04:37 AM
I need help. Where i am can find the algoritm K-EYE ?
How key crypt data which HL_CODE.


This Blows - Everyone should have a look at this
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > This Blows - Everyone should have a look at this
PDA

View Full Version : This Blows - Everyone should have a look at this

FatHead_Slim
07-26-2001, 06:07 AM
http://dailynews.yahoo.com/h/nm/20010717/ts/tech_hacker_arrest_dc_1.html

http://www.dibona.com/dmca/index.shtml
spamal
07-26-2001, 08:35 AM
join the fight here:

http://www.onethumb.com/index.pl?section=freedmitry
disavowed
07-26-2001, 04:51 PM
meanwhile, i haven't found a single ebook that's downloadable that i can use this program on. seems like everywhere i look, you have to pay before you can download the books. anyone have any advice?
drak0
07-26-2001, 10:35 PM
Hi.

There is this site www.netlibrary.com that allows you to download their software and actually download ebooks from their site. The thing is... only a certain amount of ppl can have a book 'checked' out at a time and shit like that. It does all this service authencation crap before you can actually view the book

I tried to reverse this little project a while ago... but to no avail... to make the program not care about the server... and just open the book and read it... then it would be AWESEME! :) But... sadly... I got sidetracked and forgot about it until now...

Anyway... the selection is very limited on that site unless you can go thru a university which licenses tons of ebooks. Maybe i could make a temp account for this board so people can get all the books that my univ. has :)

Hrmm... I wish I didn't install SP2 :( fuken microsoft... now I have to fight to get SI working again... O well.... later..

-drak0

disavowed (07-26-2001 14:51):
meanwhile, i haven't found a single ebook that's downloadable that i can use this program on. seems like everywhere i look, you have to pay before you can download the books. anyone have any advice?
Kilby
07-27-2001, 03:37 AM
Part of why people are so pissed at adobe is precisely this.

If you read the details of the app, you need to have the 'token' on your machine.

So to decrypt the book back to a 'normal' PDF you need to have bought.

So only the legal owner can actually decrypt it in the first place.

In certain parts of the world it is your leagl right to be able to make a backup of something you have bought.

Kilby...
Kilby
07-27-2001, 04:30 AM
I see that the e-book password recovery app has been removed from elcomsoft.

So is that why Adobe dropped the case ?

Kilby...
tsehp
07-27-2001, 06:51 AM
The app was put to the main page for download tsehp.cjb.net
If adobe + dmca have this level of democracy sense, the internet will never ease their totalitarist though, I just can't believe that in this country a guy could be jailed so easily.

lets spread the app, with cracked exe please (can't do on the site for legal purposes )

regards,

tsehp
mo k
07-27-2001, 10:18 AM
Brave step Tsehp, i congratulate yu for it.
?ferret
07-31-2001, 10:05 PM
You'd be surprised at the number of idiotic laws that survive in the US ;-)
NchantA
08-13-2001, 12:19 AM
www.nchanta.com for the full version cracked by me for pgc

Nc
mike
08-14-2001, 04:56 PM
Anyone know details of the system? I.e. from the short description above, it sounds like the "token" is a key to decrypt the book. In the past, Adobe's protection has been 40-bit, which is eminently crackable. I heard they may be going to 128-bit, though.
Squidge
08-19-2001, 06:53 PM
Adobe now support 128-bit encryption technology in there new Acrobat 5.0 proggy. So there's no reason why they can't use it in other programs too now.


Visual Basic Program, __vbavarsub, __vbavarmul
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Visual Basic Program, __vbavarsub, __vbavarmul
PDA

View Full Version : Visual Basic Program, __vbavarsub, __vbavarmul

NB
07-27-2001, 10:31 PM
hello, i've got a visual basic 5 programs seems it uses 3 functions to make serial, look what i got with smartcheck

__vbavarmul
-lhs (variant)
|-signed long.Lval = 658448104 0x273F1EE8 // 658448104 = my input
-rhs (variant)
|-double.dbval = 2.8678

then next instruction is

__vbavarsub

unsigned long pvar 6681540 0x0065F3C4
unsigned long lpsrc 6681444 0x0065F364
unsigned long argc 7007268 0x006AEC24

then __vbavarint
number(variant)
|-double.dbval = 1887750985 that is the serial

can anyone help me, i need to know whats being multiplied, my input with what ? i think my input * something = the values that are in __vbavarsub but dunno witch one of them :(

Tnx in advance
Solomon
07-28-2001, 03:11 AM
OLE Automation use a common structure named VARIANT to process most kinds of variables. VB functions(such as __vbavarsub, __vbavarmul) also use this structure to pass parameters. The following declaration is cut from <oaidl.h> from VC++.

typedef /* [wire_marshal] */ struct tagVARIANT VARIANT;

struct tagVARIANT
{
union
{
struct __tagVARIANT
{
VARTYPE vt;
WORD wReserved1;
WORD wReserved2;
WORD wReserved3;
union
{
LONG lVal;
BYTE bVal;
SHORT iVal;
FLOAT fltVal;
DOUBLE dblVal;
VARIANT_BOOL boolVal;
_VARIANT_BOOL bool;
SCODE scode;
CY cyVal;
DATE date;
BSTR bstrVal;
IUnknown __RPC_FAR *punkVal;
IDispatch __RPC_FAR *pdispVal;
SAFEARRAY __RPC_FAR *parray;
BYTE __RPC_FAR *pbVal;
SHORT __RPC_FAR *piVal;
LONG __RPC_FAR *plVal;
FLOAT __RPC_FAR *pfltVal;
DOUBLE __RPC_FAR *pdblVal;
VARIANT_BOOL __RPC_FAR *pboolVal;
_VARIANT_BOOL __RPC_FAR *pbool;
SCODE __RPC_FAR *pscode;
CY __RPC_FAR *pcyVal;
DATE __RPC_FAR *pdate;
BSTR __RPC_FAR *pbstrVal;
IUnknown __RPC_FAR *__RPC_FAR *ppunkVal;
IDispatch __RPC_FAR *__RPC_FAR *ppdispVal;
SAFEARRAY __RPC_FAR *__RPC_FAR *pparray;
VARIANT __RPC_FAR *pvarVal;
PVOID byref;
CHAR cVal;
USHORT uiVal;
ULONG ulVal;
INT intVal;
UINT uintVal;
DECIMAL __RPC_FAR *pdecVal;
CHAR __RPC_FAR *pcVal;
USHORT __RPC_FAR *puiVal;
ULONG __RPC_FAR *pulVal;
INT __RPC_FAR *pintVal;
UINT __RPC_FAR *puintVal;
struct __tagBRECORD
{
PVOID pvRecord;
IRecordInfo __RPC_FAR *pRecInfo;
} __VARIANT_NAME_4;
} __VARIANT_NAME_3;
} __VARIANT_NAME_2;
DECIMAL decVal;
} __VARIANT_NAME_1;
};


flexlm + linux
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flexlm + linux
PDA

View Full Version : flexlm + linux

pchouk
07-29-2001, 08:01 AM
I read a lot of good essays about Flexlm and Linux but I cannot find Flexlm SDK for LINUX anywhere.
I'm looking for Flexlm SDK 6.1 for LINUX or at least related libraries to link with.
TIA


hey where can I find v-box 4.5 tut??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > hey where can I find v-box 4.5 tut??
PDA

View Full Version : hey where can I find v-box 4.5 tut??

f_v_man
08-02-2001, 07:23 AM
can anyone paste the link for vbox 4.5 tutorial
I dont seem to find it.
CoDe_InSiDe
08-02-2001, 09:07 AM
Hi f_v_man,

http://www.google.com (I found it in 2 seconds there ;) )

Cya...

CoDe_InSiDe


SoftIce Backtrace Buffer Disassembler - A new tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SoftIce Backtrace Buffer Disassembler - A new tool
PDA

View Full Version : SoftIce Backtrace Buffer Disassembler - A new tool

Kayaker
08-04-2001, 02:45 AM
Hi All,

I wrote a new Win9x reversing tool, TraceDis, that I hope might prove useful. It's made to work in conjunction with SoftICE to allow convenient viewing and saving of Backtrace logs. It combines a raw dump from memory of the addresses contained in the Backtrace buffer with a disassembler.

The Backtrace feature of SoftIce, which allows you to log all instructions executed within a specified address range, is a very powerful option that I think isn't used to its full potential because of the difficulty of working with the disassembled trace. Only the *addresses* of the lines logged are stored in the Backtrace buffer, the disassembled output you see with the SHOW or TRACE commands is generated internally by SoftIce.

You can do multiple screendumps of the trace with IceDump, but this isn't a good option for large traces. What TraceDis does is parse the addresses contained in a dump of the Backtrace buffer and disassemble those addresses in the target program while the program is loaded in memory. The results are a readable disassembled output much as you would see in SoftIce.

It works with Self Modifying Code (SMC) as well as packed programs using high memory addresses during unpacking. You can also use it to help manually trace redirected API calls. All dependant on the quality of your Backtrace in the first place of course.

It has a feature which allows you break into SoftIce, either specifically at the Program Entry Point of the target program, or at any time you wish after it is loaded, to access the address space of the program. This is simply an obsolete, never-used API invoked at a couple of places in TraceDis that you can set a breakpoint on.

I think it will be a handy utility to take full advantage of SoftIce's tracing abilities, simply because you can now view and save the traces outside of SoftIce. There's a complete help file giving examples of its usage.

I owe a large vote of thanks to +Tsehp for the major contribution he made by kindly providing a C source dll which converted the opcode instructions to readable assembly instructions. Not only did this save an immense amount of time (I'd still be decoding opcode mnemonics), it ensured the accuracy of the results.

I hope you find it useful once you've figured out wtf it's all about ;) and I'd appreciate any comments or bug reports to help improve it.

Cheers,
Kayaker
latigo
08-05-2001, 03:22 PM
Hey Kayaker..
Cheers for the new tool :)
I seem to have a problem trying to download it..
I get a 404.
Is it me?

Latigo
Kayaker
08-05-2001, 08:22 PM
latigo (08-05-2001 13:22):
Is it me?
Latigo

Hi Latigo,

No, it's me ;)

I've always had a problem posting attachments on this forum for some reason, still don't know why. So I had to cross post on the Newbies forum. You can d/l the file OK from there. Sorry about the mixup.

Cheers,
Kayaker
tsehp
08-07-2001, 02:33 AM
hiya,
thanks for your new tool kayaker, I'll try it today on win2k, hope for me it's working.

In this message you'll find a upload test for kayaker's new tool, I'll try to fix this upload problem from my vacation place. :-(

good news : the new tracer for revirgin is now working on win9x and nt, so I'll add now some dump fonctionalities into revirgin + some fixing for recent asprotect's evolutions (emulation of small api's like getCurrentThreadId and other that our beloved splaj discovered), available here in the month of august.

regards,

tsehp (in the rain)

postnote : the upload worked, you can download kayaker's tool on my attachment.
Kayaker
08-07-2001, 04:00 PM
Thanks for fixing up a link +Tsehp. Let me know if it works on Win2K.

I want to try to get it working on NT as well. I have access to an NT machine, but not with SoftIce installed, so I'm error checking the old fashioned way with MessageBox calls all over the place. LOL, feels like stone-age debugging ;p

Kayaker


Reverse engineering in WinNT/2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reverse engineering in WinNT/2000
PDA

View Full Version : Reverse engineering in WinNT/2000

BlackB
08-07-2001, 02:58 AM
Hi all ;-)

Yes I'm still alive. I'm currently working in a bank in Brussels-Belgium to pass my long vacation time (oh yes, being student has a lot of benifits, hehe).
I've got internet access here, so I make it a habit to check the messageboard every morning and afternoon.
I've been out reversing since I started programming Visual C++ 6 mfc, so no time for now. Anyway, I noticed that when working with Win2k there are a lot of disadvantages when cracking such as: no 'bpr' command in softice (can anyone tell me why??), no Frogsice, no /pedump /trace(x) support in icedump, no hmemcpy, and I'm sure that there are lots of other things that I'm not yet aware of. These 'small' things are a major drawback for using an excellent OS as Win2k when reversing....so I thought it would be a good idea to write tools specific for Win2k that would make good solutions for the major drawbacks.
As my programming knowledge concerning reversing matters is about nill, it 's (almost) impossible and too time robbing to make this work. Therefore I'd like to ask if there are people that are willing to work with me. Preferrable people that can code in Visual C++ mfc....NO not pure win32 as this is such a waste of time. It's of course possible to use API's with visual c mfc. The mfc's main framework should save us a lot of time as we don't have to worry a lot about the look of the program (nice visual editor in visual c :)). Actually you don't have to worry about anything at all except the program's specific code of course. Just mentioning all this because a lot of reversers don't like visual c mfc, and I really don't see why... :P
So, people interested: let me know. People that can provide me good programming info on reversing tools are also more than welcome!

greets and already thx,

The Blackbird
kill3xx
08-08-2001, 05:38 PM
BlackB (08-07-2001 00:58):
disadvantages when cracking such as: no 'bpr' command in softice (can anyone
tell me why??),no Frogsice, no /pedump /trace(x) support in icedump, no
hmemcpy, and I'm sure that there are lots of other things that I'm not yet aware

bpr is implemented hacking ptes P bit and post-chaining the #PF path..
it's a cleaver trick but it's easy to do only when u've to deal with
a relative simple demand paging implementation as in win9x..
when u move on winNT/2k land where the MM is more complex
the implementaion of BPR became more difficult since u've to
deal with IRQL, VADs tree, section&prototypes ptes and so on..
i've done a lot of reversing session on win2k MM and #PF / #GP paths
recently and i can assure u that implemeting things like icedump /protect
(the pax alike part) or BPR isnt a simple task.. (just check MmAccessFault or
MiResolveXXX call tree i u'll see what i mean).. even ntice is using nasty things
like disabling paging via cr0 and other "weird" tricks to left
MM internal out of the door...
/trace or /pedumb are less problematic indeed

[quote]
of. These 'small' things are a major drawback for using an excellent OS as Win2k
when reversing....so I thought it would be a good idea to write tools specific
for Win2k that would make good solutions for the major drawbacks.

some magic words: .. DDK , Viscarola + Nagar + Salomon/Russinovich books,
google/deja .. and a lot of patience with tasty BSODs..
good work/luck ;)

that can code in Visual C++ mfc....NO not pure win32 as this is such a waste of
time. It's of course possible to use API's with visual c mfc. The mfc's main
framework should save us a lot of time as we don't have to worry a lot about the
look of the program (nice visual editor in visual c :)). Actually you don't have
to worry about anything at all except the program's specific code of course.

MFC is a waste of time for this kind of prjs - at least for non gui part..
even frameworks like DriverStudio are useless (btw i dont like it).. is better
to spend sometime learning how to code drivers using plain c + DDK

Best regards,

kill3xx

p.s. Elicz and Mamaich are interesting site for ur task


TrialMaster
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > TrialMaster
PDA

View Full Version : TrialMaster

AdamA
08-07-2001, 07:19 AM
Hi,
does anyone know TrialMaster(www.geeworks.com/trialmaster/) protected apps?

thanks,
AdamA
BlackB
08-07-2001, 08:12 AM
How many times did we see "you can be sure your intellectual property is safely distributed and tried before they're purchased" before... :-)
As from what I've read I would guess it's SoftWrap's successor (http://www.softwrap.com).
Personally I don't think this piece of protection software will make a lot of trouble when trying to unwrap it. Never heard of it either, and never saw an app protected with it.
Some of us going to have a fun (short/long??)time with it :-)

greets

BlackB
AdamA
08-07-2001, 09:45 AM
Hi,

at this time i was a little bored, so i thought about an generic TrialMaster KeyGen.
At their site you can read(about Geeworks):
"Geeworks was founded by Peter Chiu, an ex-Microsoft Windows NT developer..."
I think more fun you can't get anymore.

greets,
AdamA
+SplAj
08-08-2001, 06:24 AM
well, this proved a 5 minute challenge while eating my burger for lunch ( no harrisa - too hot for me) with the free hand I did this :-

Start Trialmaster (lite - the other std don't run yet - CRC ?)
see the nag screen to register
get into SI
BPX GETVERSION
F5
press 'Start Now'
SI pops
F12 back to the target (now a strange thread like 4c54fd1.bmp)
set EIP to 435C6A (this is the OEiP)
type E EIP EB FE
F5
DUMP that file 4c4c545c.bmp whatever with LordPE as dumped.exe , edit the raw offset 35c6a from EB FE to 55 8B and thats it. You are free to patch+play :-) no more trialmaster wrapper - the dumped exe is FULLY fixed as original cos it IS the original !

BTW direct links :-

h**p://www.geeworks.com/trialmaster/tm20.exe
h**p://www.geeworks.com/trialmaster/tm20lite.exe

+SplAj }>
'patch+play'
AdamA
08-08-2001, 07:46 AM
Hi,
so we know how to dump it(thanks +SplAj),
for those who are interested in crypto,
they use RSA in following way:
md5=MD5(name+email+2nd part of Prod. ID)
chksum(md5)=md5[0]+...+md5[15]
serial=chksum^d mod n (serial is Base36)

have fun,
AdamA
+SplAj
08-08-2001, 08:40 AM
Just D/L standard again today and this one launches.

Tried the same trick and the OEiP is 435C1A for this std version. Dumped and runs fine... tried resetting the clock back and forward 20 years and it still runs. What can i say, you can MD5 and hash and mash as much as you like but in those immortal words... 'if it runs it can be defeated' and it is ;) so who wants to waste 2 years studying the algo ?

+Spl/\j }>
'patch+play'

BTW probably the last post from me for a while...... what's that you whispered ? .............' thank god :-) '

OK
CYA........Guinness here I come.
CoDe_InSiDe
08-08-2001, 03:45 PM
Hi Everyone,

I looked at that TrialMaster thing a little bit and you can indeed defeat it "very" easy ;)
My method is a bit different then the one from +Splaj ;D
Anyway this is for the Standard version (Haven't tested it for the Lite version, btw +Splaj Standard has some debug Tracing tricks ;).
So read my attachment if your interested ;D

Cya...

CoDe_InSiDe
CoDe_InSiDe
08-08-2001, 03:52 PM
I just checked the lite version and it's exactly the same ;)

Cya...

CoDe_InSiDe
CoDe_InSiDe
08-13-2001, 03:37 AM
Hi Everyone,

I also took a look at that SoftWrap Wrapper and it's as easy as Trialmaster ;)
So if anyone is interested here's my solution (Btw actually no need for an Attachment like my previous solution ;) )

Run the Wrapped Program and you'll get an evaluation Window.
Get into SoftICE and put an Breakpoint on "WriteProcessMemory".
Get out of SoftICE and press the Button "Try It".
When SoftICE breaks type "BC *" and type "d esp+0C" and look at the data window.
There'll be an Offset that points to the Code that'll be copied into the real Program.
Type "d (Offset you'll see there, it's in reverse like 10 F5 66 00 == 0066F510)" and then replace in the Data Window the first 2 Bytes (Ofcourse remember those 2 Bytes) with "EBFE".
Get out of SoftICE and now the Main Program runs in a loop.
Dump the Main Program with ProcDump for example, you can recognize it because the
name contains ".locked.exe".
Now open the Dumped file in an Hex Editor and go to the OEP, replace "EBFE" with the normal Bytes and save the file.
TaTaam, File Unwrapped ;)

Ok, err ... have fun with it ? ;D

Cya...

CoDe_InSiDe
BlackB
08-13-2001, 04:44 AM
I reversed the softwrap protection a few montsh ago....i even wrote a tutorial for it ;p
http://users.belgacom.net/blackb/softwrap.html

greets :)

BlackB
CoDe_InSiDe
08-13-2001, 05:44 AM
Hi BlackB,

Hehe nice one ;)

Cya...

CoDe_InSiDe
NchantA
08-13-2001, 11:48 PM
i also did a short tutor on softwrap, but i cheated a bit ;)

although i didnt go into as much detail as BB

nC
dELTA
08-14-2001, 10:18 AM
BlackB, in your tutorial you say this regarding what the wrapper does to protect the wrapped processes from dumping:

"...write the decrypted code to the process, write garbage to memory to prevent dumping..."

but when you dump it you do it right before the ResumeThread call. So is this garbage written to the process while it is executing then?

And also, i'm just a bit curious, what is this garbage that is written? The usual import table corruption? That seems a bit dangerous to do while the program is running I think?

What else, other than messing with the imports, are usual techniques of corrupting an executable image in memory to prevent dumping but still not trash the execution of the protected process? I can see several things that can be destryed in the PE-header in memory to accomplish this, but I would love to hear about some other used techniques.

Thanks!
ThrawN
09-22-2001, 02:57 AM
I also worked with softwrap 1.32 sometime ago, and I dont recall intercepting garbage code be'in writen to the locked process? it only writes the decrypted code to the entrypoint (how much is calculated from the exe size) and resumes the process

Forgive me if i am wrong tho ;)

ThrawN


YUY2 video references
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > YUY2 video references
PDA

View Full Version : YUY2 video references

Nodens
08-10-2001, 04:05 PM
does anyone know where can i get the YUY2 video format references ?
Morlac.
08-12-2001, 02:33 AM
HI there,

Perhaps asking at http://forums.projectmayo.com/ is better for you if not faster.

Morlac


Memory address ref.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Memory address ref.
PDA

View Full Version : Memory address ref.

Hoof Arted
08-10-2001, 05:16 PM
Ok, I will try explain this in the best way I can. I am working on a target that has a complex serial generation routine. I have decieded that the best way to create a keygen is to inject code to MSGBOX it to me. The problem I have is that the BOX shows the correct serial when I am running the target in a debugger, olly or w32dasm, but when I run it natively, the box is empty.

I am making a reference to a memory address that does not seam to change, and always contains the serial. It is quite obvious that this is not the case or it would work without the debuggers. So, my question is this, why does the memory location have the serial when running under the debuggers and not when running on its own?

Any help would be great.

hoof
Hoof Arted
08-10-2001, 06:24 PM
Ok, I have got it working but I would still like to know why the address changes when using a debugger.

All I did, to fix my problem, was use a PTR to the address so that it will use any address that the system assigns.

Thanks

Hoof
Morlac.
08-12-2001, 02:27 AM
Hi there,

Perhaps is has something to do with dynamically allocated memory.
Maybe the debug session memory allocation routine returns different PTR to what the realtime routine does. Actually, you should never rely on the memory allocation routine returning the same position in memory everytime you run your programme.

Morlac


How to reuse a dongle - Hardlock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to reuse a dongle - Hardlock
PDA

View Full Version : How to reuse a dongle - Hardlock

Maximilian
08-11-2001, 02:46 AM
hello guys,

i found a dongle per accident. i dont know what program it was for but with gogle i found that it is a "Hardlock FAST E-Y-E". can i use their software to secure a program which i write with the dongle i have.

Bye
CrackZ
08-11-2001, 06:42 AM
Short and simple answer : YES

However you'll need to do 2 things :

i). Identify the integer MOD_AD of the Hardlock you have 'found', easy if you just compile one of their sample programs that implements HL_LOGIN() and check the return value whilst incrementing the MOD_AD, 7 is no dongle, 0 is dongle found, just trap the MOD_AD.

ii). Identify the flavour of E-Y-E you have, look at the casing colour, there are a fair few of them, some have memory, others like the Black E-Y-E don't, the program testapi.exe which you can get from Hardlock, used with the right MOD_AD will give you an indication of the dongles facilities.

Regards

CrackZ.
Maximilian
08-11-2001, 12:01 PM
thx, i will try it
Maximilian
08-14-2001, 10:45 AM
hi again

here is the next problem: it takes ~4 secounds to test one MOD_AD
4*2^16 secounds ~ 3 days !

isnt there another possibility?
Unoticed_Max
08-17-2001, 01:07 PM
Help!
I found the MOD_AD=061Ehex, but hlcrypt dont run and tell me about a "Test Dongle" and a "Red Dongle". what are they for and has someone cracked them or unpacked them or know a way to work without them.

Please help me, Bye.
CodeKeeper
08-25-2001, 11:54 PM
Hi,

the "test dongle" is the one you want to program, black (silver scews=with memory, gold screw=without memory, called RAM - runtime programable. the ROM area is only porgramable with special hardware). the "red dongle" secures the HLCrypt program itself. in total you have three E-Y-E chips in chain ... one on the programming card holding your personal algorythm (used for HL_CODE), the second for HLCrypt, the third is the target.

CK
Maximilian
08-26-2001, 11:02 AM
well thanks,
but is it possible to run hlcrypt without a red dongle or a test dongle? i want to secure some of my own programs with hlcrypt from becomming stolen on lan partys, because i dont know so much programming to secure my programs with the api and i dont have the sources of all programs.

has anyone cracked hlcrypt or can do it? are there any cracked versions on the internet?

Maximilian


Info req. about M$ACCESS MDE files reversing.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Info req. about M$ACCESS MDE files reversing.
PDA

View Full Version : Info req. about M$ACCESS MDE files reversing.

Morlac.
08-12-2001, 02:31 AM
Hi all,

I have this app here and it was written in Access+vbasic. It was saved as a MDE app. This means that all parts are compiled and stored in the MDE database.

Is there any tool/doc/tutorial that can help me?

Morlac
mo k
08-12-2001, 03:05 PM
I have gathered alot of info regarding access dbs, and writen even some little tools to convert MDBs to
other formats, but nothing
about MDE files.

My only suggestion would be, to find the VB function(s) that load access dbs, they could be
generic resource loading functions, that use a flag
macro to indicate MDEs.

Break at the function and trace to the point where it checks the flag.

(Note: it has been ages since i coded for MS platform, but i know the MS mentality very well ; )

Say if VB calls a LoadResource function (totally mythical function btw.)
and LoadResource takes a module handle, a resource ID, and a flag for a resource type, it might look like this:

HGLOBAL LoadSomeObsecureResource(HMODULE hModule, HRSRC hResourceID, RT_MDEFILE);

this is a totally bogus function, RT means Resource Type : )
and the MDE loader is 99% likely to look like this.

Step into the resource loader, to the point where the third paremeter is compared to a
list of items. This is a 'switch' statement in the Win32API source code,
so it will be a series of compares and jumps, to the
point where you are routed to a function call, this
most likely the MDE file format loader, turn off the
code window and trace. make sure you have your
trace buffer to the MAXIMUM : )

You will have the entire MDE parser in your SICE log, just keep track of the 'offset range' of your
main function, and ignore all the random high/low offsets that you might run into,
they are likely to be message handlers (WndProc or DefWndProc),

you will need to retrace several times, chase function paremeters (keeping calling conventions in mind)
to label the variables in your log accordingly.

The most important thing is, to figure out how to
"Read" MDE files programatiacally. Programmers invest time
and money in their skill, you might as well.
Figure how to do it in visual basic, and RIP the algo
off of the library that handles MDEs.

Right Click on the app, QuickView, and make sure
you understand the use of every function in there, good luck ; )
Morlac.
08-13-2001, 02:28 AM
mo_k,

Thanks for the help. I'll try it.
The thing that causes the problem is the fact that MDE files are opened by Access. In the MDE files, there are embedded VB modules.
This is the trouble. If I can extract the VB code out of it... then the rest is easy.
Thanks again.


FLEXlm 7.2f
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXlm 7.2f
PDA

View Full Version : FLEXlm 7.2f

bfox
08-13-2001, 03:42 AM
Hi ALL!

You have direct link to download FLEXlm 7.2f?

Tnkx
Bill


Tame a Tiger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Tame a Tiger
PDA

View Full Version : Tame a Tiger

CccT
08-13-2001, 06:31 AM
Chess Tiger engine for the Fritz / ChessBase GUI :
http://www14.brinkster.com/ccct/Tiger.zip
160 Kb (copy link to browser)
Note: .exe is .eng in the Fritz / ChessBase GUI

Bugs: no copy protection but renaming Tiger.eng and
Tiger.dll to e.g. Beast.eng and Beast.dll seems to be impossible: the engine cannot be loaded by the GUI .
HexWorkshop: No apparent mutual links , at least not
in ASCII or Unicode .
There may be a name-protection in Dword .
There may be API calls to Chess32.dll that is part of the GUI but SoftIce may catch more API calls.

Todo : Renaming Tiger.eng and Tiger.dll to e.g. Beast.eng and Beast.dll to make engine matches possible between Tiger and "Beast"(Tiger) in the Fritz / ChessBase Gui. (Running an engine against itself is the best method to discover its weaknesses.)

A fast download of the Fritz / ChessBase GUI is available from the official ChessBase site:
Base pack : Fritz6 Demo
http://161.58.237.201/download/f6demo.zip
Service pack(s) :
http://161.58.237.201/download/fritz6e.zip

Note: the service pack(s) must be installed on top of Fritz6 Demo in the same folder.

Let me know if someone succeeds to rename Tiger :
CccT
goatass
08-13-2001, 01:31 PM
perhaps the dll is loaded via LoadLibrary which requires a dll name and when you rename it the application can't find that dll anymore. Check out the CreateFileA, LoadLibrary, and GetModuleHandle APIs with SI and see how the application is loading these 2 files you are trying to rename....

goatass


Telock 0.9 ......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Telock 0.9 ......
PDA

View Full Version : Telock 0.9 ......

SpeKKeL
08-14-2001, 09:21 AM
Hajo,

Tried playing with revirgin and imprec on
a telocked notepad, seems not to work..
All redirected ....and they won't want to trace.
Manually they are easy to resolve but this
takes some hours.Is there a better way to
resolve ??

Greetzzz Spek.
SpeKKeL
08-16-2001, 12:19 PM
Okeeeee,
Just for those who are interested:

Found out that revirgin crashed on the redirected api's (found by revirgin ) that contains a "NULL DWORD".
So simply removed them on the saved iat.txt file and loaded this again,>> now all api's were traced without a problem....
and the telock notepad.exe was succesfully unpacked.

+Tseph (Maybe a routine in revirgin could check this so it doesn't crash )

Ciao, SpeKKeL.....
Bloody
08-21-2001, 03:40 AM
Hi Spekk, Tsehp,

I successfully rebuilt it w/ imprec w/ its tracer l3.
Go get it at http://hyperion.spaceports.com/~mackt/Packed.zip
(tracer enabled)

I hope mackt will not shout on me for posting this url :-\

Regards,
Bloody


Windows CE hex editor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Windows CE hex editor
PDA

View Full Version : Windows CE hex editor

spamal
08-15-2001, 04:24 PM
Does anyone know of a hex editor that runs on the IPAQ Pocket PC (Windows CE platform)?

TIA,

Spamal


The controversial findings of Prof. Felten who cracked the new SDMI digital music protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > The controversial findings of Prof. Felten who cracked the new SDMI digital music protection
PDA

View Full Version : The controversial findings of Prof. Felten who cracked the new SDMI digital music protection

BlackB
08-17-2001, 05:12 AM
Hehe, I love this :-)
This article is as controversial as the DeCSS program. Believe me, SDMI would do anything to prevent the publishing of this paper.

This is the link to the paper that reports the working of SDMI and how it can be cracked. Now THESE guys are reverse engineers. I think noone of us is that good.....ah well....it was a university team under supervision of a professor, what else could you expect huh ;-)

enough talk:
http://www.theregister.co.uk/extra/sdmi-attack.htm

I'm going to publish this on my site, I suggest as much people as possible do the same. If a few thousand people do this, they can't do shit.

greetz

BlackB
Tezza
08-17-2001, 04:26 PM
He, he, he I was just reading in a HIFI magazine that the University team had been threatened with legal action if they released the papers and the team decided not to release it.

Just goes to show you can't hide the TRUTH.

Excellent stuff!
tsehp
08-18-2001, 02:47 AM
strange, the link doesn't work anymore ;-)
BlackB
08-18-2001, 05:54 AM
*SIGH* On what pathetic planet do we actually live on!?...... after reading some more articles concerning civil rights and the 'big industry' I have to conclude once more that this place we live on is so so sad.
We almost all grow up in a capitalist world where money is important, but until now I did not fully realize the global money- and powersickness that's ruling our world.
It may be a dark view, but from what I've seen (yet) of the world, there's no way I can express this in a more positive way.
In my life money is important too, but I've sworn to myself that this cancer of humandkind will never fully control the things I do.
However, living in this moneysick world provides me with the will to keep going my way ;-) ....talkin' about at least one positive note, hehe.

greets,

BlackB
Carpathia
08-18-2001, 06:27 AM
Ouch, you sound pretty depressed.

I think you've maybe been reading too many of +fravia's rants lately ? ;-)
BlackB
08-18-2001, 09:58 AM
Well, there are some serious personal issues that probably influence (time by time) my view on certain things.
And no I didn't read +Fravia docs lately, hehe. However, I think he has a good pint in many of his writings.
BlackB
08-18-2001, 09:59 AM
point even
disavowed
08-19-2001, 12:20 AM
yes, join fravia! fight capitalism by not buying food at supermarkets!! :)
(if you don't know what i'm joking about, don't worry)
qferret
08-20-2001, 08:18 PM
;-) hcraeser tekram esufnoc ot gnippohs elihw backwards klaw tsuj I
Kilby_cant_be_arsed_to_login
08-21-2001, 03:33 AM
For those of you who havn't already done so.

Read Robert Anton Wilson, particularly the Illumantis Trilogy and the Schrodringers Cat trilogy.

Many methods of changing modern corporate life are in these books.

But best of all theyre also funny and full of sex & drugs.

Regards,

Kilby...


ProTools website?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ProTools website?
PDA

View Full Version : ProTools website?

Zeduser
08-17-2001, 07:05 AM
Does anyone know what has happend to the ProTools website at protools.cjb.net??

All I get is a redirect to some strange page.
CoDe_InSiDe
08-17-2001, 07:18 AM
Hi Zeduser,

I don't know what happend to protools.cjb.net but you can better go to the "normal" URL ;)

www.programmerstools.com

Maybe you already knew this URL i don't know :)

"Site em manutencao" <- Site under construction ?? ;)

Cya...

CoDe_InSiDe
Zeduser
08-17-2001, 06:19 PM
CoDe_InSiDe (08-17-2001 05:18):
Hi Zeduser,

I don't know what happend to protools.cjb.net but you can better go to the "normal" URL ;)

www.programmerstools.com

Maybe you already knew this URL i don't know :)

"Site em manutencao" <- Site under construction ?? ;)

Cya...

CoDe_InSiDe

Thanks for the URL, got right to it


PC Guard 4 mauale unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > PC Guard 4 mauale unpacking
PDA

View Full Version : PC Guard 4 mauale unpacking

gratiz
08-17-2001, 08:45 AM
i tried to unpack cpu cool v6.2 but had no luck. does someone know how to ?
Js
08-17-2001, 12:44 PM
Hiya gratiz,
Highly likely somebody knows how to. What is it packed with?. Its always helpful if you supply a little information. What problems do you have trying to unpack it, what have you tried?. BTW why does the header of your post refer to PC Guard 4 and then you ask about cpu cool v6.2?.
gratiz
08-17-2001, 06:33 PM
cpu cool is a pc guard 4 packed app. so i asked for examples how to unpack this app.
after the programm is unpacked in memory i dumped it.set the oep to 46446e. then i start it and a error msg pops up. when i try to rebuild the iat Revirgin cant find anything. and thats my prob.
Hz
08-17-2001, 07:01 PM
Oh so pc guard 4 IS the protection, thank you for enlightening me, never heard of it but I'm interested now. Suppose I could be putting my foot back in my mouth here but have you tried Imprec with it?.
Hz
08-17-2001, 07:03 PM
Man I can't even remember who the f*ck I am now. I had to re-register as Js cos I couldn't post as Hz, now I can't post as Js.
Hz
08-17-2001, 07:27 PM
Hiya gratiz,
Where did you d/l v6.2 from?
gratiz
08-18-2001, 08:39 AM
get it there :
http://www.talknet.de/~podien/CPUCOOL9.ZIP
Hz
08-18-2001, 01:29 PM
Hiya,
I used Imprec and it rebuilds no problem. Your
oep is right, iat for imprec
start 00087000 size 55c
Unfortunately all the string refs in WDAsm are in german, I only know three words of german, Fraulein, ya and danke so don't think that will help you much ;)
gratiz
08-18-2001, 03:05 PM
thanks much.
seems to be a revirgin bug. it works fine with imprec but it doesnt work with revirgin. i hope it will be fixed soon.
thanks much again


SMARTCHECK
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SMARTCHECK
PDA

View Full Version : SMARTCHECK

sun7
08-17-2001, 04:10 PM
Where can I download Numega Smartcheck ?

Thank u in advance.
aimless
08-18-2001, 09:16 AM
ha ha ha ha ha ha.....

You ~gotta~ be kidding...

That's blatant, buddy.

Anyways..

try goodle
search for "smartcheck" + "warez"
or
"smartcheck" + "filez"

Have Phun


Dongle Tutorials
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Dongle Tutorials
PDA

View Full Version : Dongle Tutorials

KuB3
08-17-2001, 04:27 PM
Hi u lot :)
As I'm a pretty new newbie I would ask u guys some links to good dongle reversing tut's.
I found w**.zencrakz2.cjb.net some time ago with amazing tut's on the subject but it doesn't work anymore...404...
Tried to find on google but without results...
Hope one of u got some links 4 me :)
JMI
08-18-2001, 12:36 AM
It appears that you simply have mispelled the URL. Try h**p://zencrack2.cjb.net. (leave out the "Z" at the end of your "zencrackz2") It works fine from here.

JMI
JMI
08-18-2001, 12:38 AM
It appears that you simply have mispelled the URL. Try h**p://zencrack2.cjb.net. (You left out the "c" and added a "Z" at the end of your "zencrakz2") It works fine from here.

JMI
KuB3
08-18-2001, 07:19 AM
Thx, you are true...I misspelled the link in the forum but last night I write the link you gave me and it didn't work...now it works ( conspiration of my ISP surely...:) )
Thx again...


FlexLM 7.1 Target solution
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM 7.1 Target solution
PDA

View Full Version : FlexLM 7.1 Target solution

manuva
08-19-2001, 03:13 AM
heya,

i´m working on the creation of a license file for autodesk autocad 2002 (i know that i could use the -RISC or -ODT files, but i only wanne know the creation process of v7.x files) what is protected with FlexLM 7.1f, but i need some help on it . I used IDA (4.04) with the sig files for flexlm and i think i found some promising calls, but if i try to take a closer look on that ..i dont found the job structure/ vendor codes or something else usefulness :( [as i said ,that is my first flexlm 7.x target , before i only had contact with 5.x and 6.x versions ...] .
So, can anyone give my some tips/hints on FlexLM 7.1 cracking targets ? (a link to the 7.1 SDK would be nice, or a link to some essays or something like that)

thanks
/ manuva


acudata sheriff protected software
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > acudata sheriff protected software
PDA

View Full Version : acudata sheriff protected software

hansi123
08-19-2001, 04:19 AM
hallo,

who has information how to get the 4 secret keys in acudata sheriff protected software, or how to crack it ???

http://www.sheriff-software.com

thanks
disavowed
08-19-2001, 01:43 PM
don't know about acudata, but in iris, the 4 keys were in cleartext in the dump of the program, which i saw with my hex editor
Geez
08-22-2001, 07:13 AM
What is your target? :-) Maybe I can help.....

That protection is a waste of time to implement. Every implementation have to pass the product id which is a 16 char len string (4x4 group). The SDK have a utility, which generates the "secret" keys from the ID what a sheriff licenser get from acudata, but there is a good way to bypass the need of that ID....it's an easy one (took me 20 mins to make the SDK work for me)

Regards,
Geez
hansi123
08-24-2001, 11:11 AM
hallo geez,

target program is too big for download (~50M).

Is it possible to get the 4 secret keys debuging the program with trw2000 or
softice - and how ?.

Please tell me more about the way to make the sdk work for you

thanks

hansi123
hansi123
08-24-2001, 11:13 AM
hansi123 (08-24-2001 09:11):
hallo geez,

target program is too big for download (~50M).

Is it possible to get the 4 secret keys debuging the program with trw2000 or
softice - and how ?.

Please tell me more about the way to make the sdk work for you

thanks

hansi123

Please tell me a correct email so that i can contact you. Thanks.
disavowed
08-24-2001, 11:25 AM
dump it, then use a text scanner to "grep" out the strings, and search for 4 "keys" in a row
Kythen
08-24-2001, 01:15 PM
Actually, those four secret keys will not necessarily be plain-text in the app. They only appear if the Challenge/Response feature is used, as they are a parameter to the CreateChallenge function. Otherwise you have to use a different method to get them. Also, the secret keys can be in an encrypted binary format, as they are in the sample app included in the SDK. I haven't looked at the whole thing enough yet to say how to find the keys or how the encryption affects them if they are in that format though.
hansi123
08-25-2001, 02:04 AM
btw, here is an easy way to refresh the trial period

- delete the xxxx-xxxx-xxxx-xxxx licence folder
- delete the hkey - localmachine - acudata registry item
- delete the files winsusrm.dll and winsusrx.dll in windows\system folder

restart the proggy - an the trial period will be restored
toteu
09-10-2001, 03:54 PM
Acudata Sheriff is a piece of crap....:)
You can always use their keygen to work with any application
Step by step:
1. download SDK
2. use Sheriff Administrator/Licence/Registry
to get Product Name,Product ID,Licence Path
3.use Sheriff Licence Key Generator/Register
with Product Name/Product ID
bpx messageboxa => error secret 1
trace in call before messageboxa
you will quickly find all secret codes (1,2,3,4)
++++++++
Example:
Iris Evaluation 3.5 eeye.com ( it is crippled afaik)
maybe it is working with full version !!!
You will obtain:
Product Name: Iris Evaluation
Product ID: 53588621242976415701
Secret 1: 0763198587520863
Secret 2: 1854207696431774
Secret 3: 2482159371598169
Secret 4: 3739062840623850
Obtain user reference code with ShAdmin/Licence/Confirm Buy
or by own software registering window and you can issue any type of licence with SheriffLicenceKeyGen :D

Now, everybody isn't Sheriff a piece of crap ?!?
Contact me if you know any other software protected by Sheriff
:D :p :p
Solomon
09-13-2001, 04:07 AM
SecureIIS(also from eEye) is also protected by it


The new MS protection scheme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > The new MS protection scheme
PDA

View Full Version : The new MS protection scheme

Goat
08-20-2001, 12:44 AM
I'm having trouble reversing the new MS protection scheme such as Office XP, Visio 2002, etc. (the certain software doesn't matter) Anyway I'm having trouble finding any leads to the segment where it checks A)How many times I've opened it and B)How many days I've used the software. It would be easier if it didn't make so fucking many registry calls upon loading so I wouldn't get lost in the code everytime I break on RegQueryValueExA or equivalent. When I disassemble in IDA either the Visio.exe or the DLLs it uses, I can't find any of the text from message/dialog boxes so I dunno now. Never reversed MS software, and anyone who has and wouldn't mind e-mailing me would be greatly appreciated.
JMI
08-21-2001, 02:22 AM
Personally I don't know anything about the new MS protection scheme, but I remember copying an earlier thread on the subject that contains information about a RipeMD scheme for protection. It also has a reference to source code related to this issue. The thread was dated May 15, 2001 and titled "Microsoft Activation Protection". I don't have the direct URL, but could e-mail it to you if you can't find it with the information I've provided.

JMI
JMI
08-21-2001, 02:34 AM
A quick search finds that the URL for the thread mentioned in my previous post is h**p://208.50.16.104/Ultraboard/Public/HTML/B5/2863.print.html

JMI
xOANINO
08-27-2001, 08:56 AM
Hi,
i made the general crack for OfficeXP by patching MSO.DLL. This is the ~5mb file you find around the net. It was released by UCF in the mid of July. Email me (xoanino@hotmail.com) if you want help about cracking it yourself.

Anyway, if you're planning to make a keygen, as far as i remember the relevant key verification algorithm (together with the nasty CRC checks)is decrypted runtime, that's why you can't find anything with IDA. But i could be wrong, i'd have to recheck my IDA db about it.

Btw, if you want to crack Visio, it could be that my MSO.DLL (if visio uses that for Windows Product Activation) works for it too.

Regards,
xOANINO [UCF]
mutantem
08-28-2001, 03:40 AM
I have started revesing Product Key, I have been reading licenturion document and I have found at pidgen.dll routines to validate product key, also I have found the "secret" key to validate them using RIPEMD160.

But I have determined exactli the validation method. We can start a discussion/cooperation about it ...
Kythen
08-28-2001, 08:04 AM
Just a quick note for you all...

I haven't looked at the protection scheme, so I can't say for sure what that hash algo is. However, more than one algorithm uses those 5 initial values. What you actually have to look for are the other constants used in the different rounds of the algorithm. Those are the only truly unique identifiers of an algorithm. Just as an example, SHA and its descendants use those same seed values. Just by looking at them, you have no way to tell whether you are working with SHA or a modified RIPE-MD as suggested above. Look through the rest of the algorithm to tell, then let us know what you find :)

Regards,
Kythen
mutantem
08-28-2001, 10:16 AM
I have checked them and I'm pretty sure, ofcourse nobody is perfect :-)
decx
08-29-2001, 02:40 PM
As you can read in previous posts i posted some code ripped from MS algo, im pretty sure this is either SHA or RipeMD, as the initialization constants are the same, except R4 seems either modded, or i looked at the wrong code when researching it. Looks as its RipeMD-160, and since it does not seem to use any public key technology, but only hashing algorithms it is fully reversable, as there is no need for heavy factorization or bruteforceing. I think its more interesting to check how it determines the OEM keys etc. For there are beta keys, OEM keys etc. supported, some seems to include an expiry date, the rest is just ripping out the code basically, albeit it is rager large :)
mutantem
08-30-2001, 03:06 AM
You are totally right I think it isn't a public key system. I prefer to reverse how to validate keys.

How they determine if it is an OEM key or not is using the 3 digits of the productid.
tsehp
08-30-2001, 03:49 AM
I'm ready this very interesting thread as it evolves,
don't want to make some censorship at all and even don't give this place too much importance, but please don't give too much details of what you've found in this public place until the rtm of windows xp, ucf and other groups did some great jobs to provide us some working betas and m$ could change their protection system pretty fast before the final release, so it's maybe better to keep all this private at this time.

regards,
mutantem
08-30-2001, 06:06 AM
I'm sorry, I have been reading Fravia since years and I don't want to cause any problem. If some one is interested on continue working e-mail me.
tsehp
08-31-2001, 01:25 AM
don't be sorry, you don't have to.
m$ is responsible for the removal of some part of fravia's pages and was the only company that was able to threaten seriously our beloved, solid, isp.
m$ protectionnists would have their job seriously eased if they learn sensible flaws in their protection scheme, on this messageboard.

I'm just sure that they new protection system is again a pure joke, and the result will bring a bunch of malcontent legal customers to the cracked version instead of re-activating their windows on each hd format or each time they change something critical into their pc ;-)
BlackB
08-31-2001, 02:26 AM
...if I can add a comment.... I 'd suggest to even PGP encrypt internal emails discussing the protection. I know this sounds pretty paranoid, but you would be amazed how many e-mail providers violate their privacy 'policy'. Also keep in mind that we're 'dealing' with Microsoft, a very big and powerful company that has, if not the biggest influence in the IT software market.
In my opinion it shouldn't be difficult for MS to gather all our emails, contact the mail providers to 'ask' them to send mails discussing the activation code system. Don't forget about the stupid DMCA law either! (speaking of the DMCA: http://www.zdnet.com/zdnn/stories/news/0,4586,5096421,00.html?chkpt=zdhpnews01).
Again, I'm not paranoid, but just be realistic in what is possible in this world (everything as a matter of fact).

greets,

BlackB
Hoof Arted
08-31-2001, 03:00 AM
Don't forget about the stupid DMCA law either! (speaking of the DMCA: http://www.zdnet.com/zdnn/stories/news/0,4586,5096421,00.html?chkpt=zdhpnews01).
Again, I'm not paranoid, but just be realistic in what is possible in this world (everything as a matter of fact).

http://uk.eurorights.org/
BlackB
08-31-2001, 05:06 AM
found a songlyric on the net ;-)

D.M.C.A.

Young boy, you bin playin' with our toy
I said young boy, you ain't givin' us joy
I said young boy, you stop acting so coy
We all got our own attornies

Young boy, just get down on your knees
I said young boy, better pay us our fees
Buy a license, cause I'm sure you find
It's much better than doing time

Let's go and play with the D.M.C.A.
We'll make you pay with the D.M.C.A.
Cause we copyright music, we copyright text
And we'll copyright oxygen ne-xt

Let's go and play with the D.M.C.A.
We'll make you pay with the D.M.C.A.
We got big shiny lawyers
We like our royalties
We can do whatever we pleease

Young geek, what you saying about me
I said young geek, that's proprietory
I said young geek, take that post off your site
Or you're gonna have a big fight.

So what, if our coding is bad
I said young geek, open source is a fad
And just pay up, or the D.M.C.A.
Will make a big dent in your day.

Let's go and play with the D.M.C.A.
We'll make you pay with the D.M.C.A.
Cause we copyright music, we copyright text
And we'll copyright oxygen ne-xt

Let's go and play with the D.M.C.A.
We'll make you pay with the D.M.C.A.
We got big shiny lawyers
We like our royalties
We can do whatever we pleease

Young geek, we were making the news
We said, we know - love bugs give us the blues
We were trying just to make it all run
When the D.O.J. stopped our fun.

That's when we called our attorney
He said "I know, how to make the law pay
There's a ruling called the D.M.C.A.
And it might just be jackpot day"

Let's go and play with the D.M.C.A.
We'll make you pay with the D.M.C.A.
Cause we copyright music, we copyright text
And we'll copyright oxygen ne-xt

D.M.C.A

Let's go and play with the D.M.C.A.
We'll make you pay with the D.M.C.A.
Young boy, young boy, cause we've got legal aces
Young boy, young boy, cause we'll win any cases

D.M.C.A.
just bow down the the D.M.C.A.
Young geek, young geek, this is our finest hour
Young geek, young geek, cause we got total power.

D.M.C.A.
D.M.C.A.
D.M.C.A.


Media Player totally locks up Win2k system
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Media Player totally locks up Win2k system
PDA

View Full Version : Media Player totally locks up Win2k system

BlackB
08-21-2001, 04:03 AM
Hi all (again),

I'm having a problem that is bothering me for months and months and months. It's only one little thing, and I'm getting very vvery VERY frustrated of it. It's the following: My Win2k system totally locks up when I'm using Winblows Media Player 7.1 (other versions too). This happens randomly, that means that I can start Media Player for one time or three times or ten times before it locks up my computer. Once I think I have a pattern, it locks up at a totally different occasion.
I tried about everything: updating ALL drivers for all hardware, updating ALL software, uninstalling software that could interfere, changing bios config (like disabling agp 4x, disabling dma support, etc...), searching the 'knowledge' base of microsoft, reinstalling mediaplayer, blablabla....I think I could add a few thousand more of things I tried.
When my system locks up, even SoftICE won't be able to popup, so it's a real FUCKED (sorry :P) lockup. It shouldn't be a hardware fault as Media Player did work perfectly when I installed Win2k. The problems started when I installed Service Pack 2 (I know,this is funny) and Memturbo. Memturbo was installed for cracking purposes btw. Anyway, I uninstalled Service Pack 2 and Memturbo but the problem persisted.
Other thing I've found out was that Norton Antivirus Corporate edition v7.5 had something to do with it: with the antivirus loaded Media Player crashed my system after I started it about two times. After uninstalling it it lasts for about 10 starts, but it still locks up. This is getting a serious problem as those lockups damage files every time I have to reset: a lockup recently trashed some of my emails.
I have thought on what you are thinking now: reinstall Win2k. Sure, but then I still don't know what is causing the problem, and chances are big it will happen again.
Removing Media Player is also a solution, but does anyone know of a program that has the same capabilities: playing mp3, ripping cd's, playing mpg/asx/asf ? I'm afraid not as some file types are Microsoft-only.
I know that probably noone can help me with this, but I tried so many things that even the method with the slightest chance of a solution should be tried. Therefore I'm hoping someone can tell me something I didn't try yet, or has the same problem. Thx for all your time, and to end, here's my systemconfiguration:

Hardware:
AMD Duron 750 Mhz
Soltek KV75 motherboard with VIA chipset
384 MB SDRAM 133 Mhz
Seagate Baracuda II ATA 66 (or is it 100...dunno anymore) 15 GB 7200 RPM
ACTIMA CD-ROM 50x
Soundblaster Live Player
MSI Riva TNT 2 32 MB AGP
3Com 10 Mbit Ethernetcard
Motorola Cable Modem

All latest drivers for all hardware installed

Software at startup:
Win2k (UK/US) (updated to latest version)
Office 2000 (NL)
Adsubtract (latest)
ICQ (latest)
Soundblaster Live center (latest)
Microsoft IIS 5.x (updated to latest)

SoftICE is uninstalled for now.

ANY (serious) hints, ideas, suggestions, thoughts, i-dont-care-what-else are VERY welcome!

thx and cya

fuckin' furious frustrated freakin' BlackB
Kilby_cant_be_arsed_to_login
08-21-2001, 06:00 AM
I've been having real hassles with Win 2K, usually being caused by installing software, or virus checkers crashing.

For the most part it is more stable than 9X & it's friends.

The two most memorable occaisions where:

When vshield crashed (due to a corrupt floppy disc), it took down 2K completely.

Visio also took down 2K when the database server was installed.

Both fixes where to reinstall the whole damn machine from clean.

SP 2 also increases the problems.

Hot fixes are even worse for the machine.

The best suggestion I can give is to do a clean install, then install SP2 then install your apps last.

Regards,

Kilby...
BlueStar
08-21-2001, 04:30 PM
Hi blackB

Sorry for my bad english in first.
I think your problem it's the VIA chipset (hardwar problem)

==> Soltek KV75 motherboard with VIA chipset.

I had the same problem with the motherboard VIA, because antivirus Norton crash, of the that I launch it.
I have try all possibilities ..but nothing, at the end of account I oblige to change the motherboard VIA with Intel 815e chipset.
tried to change the motherboard..
I think that you are going to even change the CPU..

BS.


Cloning a dongle (HASP)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Cloning a dongle (HASP)
PDA

View Full Version : Cloning a dongle (HASP)

Anticode
08-22-2001, 07:55 AM
Hi,
Is it possable to clone a HASP (MemoHASP-1) dongle? does a tool to do that exists?
Does anyone have a working snippet to write to the HASP memory, including the hidden area? i tryed to compile and run the code from bajunny's tutorials, it reads the HASP memory, but writing doesn't seem to to work at all...

Any help is appreciated
Cheers,
_Anticode.
goatass
08-22-2001, 08:25 AM
There is no software that can write to every cell on the dongle since some of them are read-only and can only be written to with the proper hardware which I doubt you have.
So no I don't think there is a way to completely clone a dongle, I could be wrong tho. CrackZ you should know ?

goatass
Squidge
08-22-2001, 01:45 PM
I've never actually cloned a dongle, but what I have done is find out exactly what calls a program makes to a dongle, and then because there was no real algorithms used (they just initialised the dongle and then read the dongle's memory) I wrote my own version of the software dongle interface and placed it in the same directory as the application. It's works fine, and as of yet, all the updates have worked and assume the dongle is permanently on the parallel port.

The problems come when the application programs use the algorithm's inside the dongle, and these are normally very well protected and extremely difficult to figure out (I won't say impossible, but it could takes a LOT of money and time - perhaps even years).
CrackZ
08-22-2001, 02:55 PM
Hiya,

MemoHASP-1's were broken internally about 4 years ago, the HaspCode() algorithm which makes up the only *hidden* part of the HASP dongle services (other than the memory) was recovered from an old driver binary, the algorithm was in the clear and has been published.

As for reading and writing memory, well I can suggest 2 very simple ways, there is a haspedit.exe utility available from HASP themselves which allows programming of the EPROM memory, just insert the appropriate HASP passwords, plug in your dongle and edit at will.

If you can't find this utility, a quick editing of one of the sample programs would suffice, service 4 or service 51 (writeword or writeblock) would do (again you'd need those HASP passwords ;-) ).

Goatass, I think you may have hurried your reply and confused a few dongle types ;-), inevitably there are non-public access areas on most dongles, HASP have reserved themselves 16 bytes, and Sentinel too reserve themselves parts to burn in information like passwords/developer ID's and a serial number, to confuse matters further one can designate in say Sentinel's EPROM, read only cells, this is sidetracking somewhat though.

To Anticode, drop me a line as to the name of your target, I might be able to help more, moreover you might be able to help me with another program for my list ;-).

Regards

CrackZ.
Anticode
08-22-2001, 07:55 PM
Hi again,
First, Thank you all for your replies.

To CarckZ:
This is and old version of mind's PhonEX call tracking software (win16).
http://www.mindcti.co.uk/public_html/products.html
I don't think the program is available for download (broken link).
If you want i can send you the program and dongle dump, just one little problem: the program's language is not in english.

Thanks again,
_Anticode
CrackZ
08-23-2001, 12:50 PM
Hiya Anticode,

Search, search, through my HASP archives ;-), I have a Mind-iPhoneEX Billing Software record (possibly this is another product, same company though it seems, & its in English too, what a bonus!).

I'm interested to grab a look at your target and dump, so drop me an e-mail and we'll set something up.

Regards

CrackZ.
Anticode
08-24-2001, 04:46 PM
Ok, check your mailbox.
Martin McKeen
09-01-2001, 04:32 PM
There is full hasp clone available, including new hasp4 encode/decode functions:

http//:dongleduplicate.nsys.by

Anticode (08-22-2001 05:55):
Hi,
Is it possable to clone a HASP (MemoHASP-1) dongle? does a tool to do that exists?
Does anyone have a working snippet to write to the HASP memory, including the hidden area? i tryed to compile and run the code from bajunny's tutorials, it reads the HASP memory, but writing doesn't seem to to work at all...

Any help is appreciated
Cheers,
_Anticode.
MeteO
10-11-2001, 07:57 PM
It is possible to clone HASP dongle. In attach i've put haspgrab utility, which can write hidden words of dongle.
Note! You can clone dongle only with same open passwords.
Unregistered
11-02-2001, 02:39 PM
Hi, guys

We cloning dongles 100%. With all new functions and memory offsets.
Look there http://dongleduplicate.nsys.by
MeteO
11-02-2001, 10:04 PM
Martin, when you'll get your own .com/net/org site?

I've register undongled.com, wold you like to join to this site?
Unregistered
11-06-2001, 03:20 PM
Thanks, MeteO.
Seems that there is no page at your domain undongled.com
Why? You want to give it to me?
MeteO
11-06-2001, 05:29 PM
For hosting undongled.com

Mail me if you can help.


Here we go again...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Here we go again...
PDA

View Full Version : Here we go again...

dELTA
08-22-2001, 09:53 AM
http://rootcore.can-host.com/files/hackhotmail.txt

:-)
disavowed
08-22-2001, 10:01 AM
old news (no offense)

it's been patched, anyway: http://www.securitynewsportal.com/article.php?sid=1594&mode=thread&order=0
dELTA
08-22-2001, 10:10 AM
Ok, sorry about that (and no offense taken). :-)


Retina v4.2 and Iris v3.5 (easy crack)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Retina v4.2 and Iris v3.5 (easy crack)
PDA

View Full Version : Retina v4.2 and Iris v3.5 (easy crack)

XtremeX
08-22-2001, 03:01 PM
These are the latest products from EEye. There are very easy to crack, infact Acudata Seriff is. Seriff is a product similar to FlexLM...and as I sad before it's easy to crack. I dowloaded the two progs from eeye, and with no mods they will work for 15 day as evaluation versions. I created my own license keys hopping to get a full vers... but it didn't happen.
This is where ur help would be meanfull: Can I make the evaluation vers. to be fully functional. I mention...after I created my own valid keys Retina functioned nomather how the system clock was set (1 year before or ahead) but still as evaluation vers. Who could tell me how can I make a FULL VERSION out of it. Thanks (I will post the crack to... but I don't think somebody of u elit3 guys doesn't know how to crack that shitty Sherrif)
Hz
08-22-2001, 05:54 PM
"but I don't think somebody of u elit3 guys doesn't know how to crack that shitty Sherrif". Cmon some of u elit3 (but exceedingly dumb) guys, rise to this polite challenge (cunningly? disguised cr*ck request) and cr*ck it
for him ;)
disavowed
08-22-2001, 09:41 PM
afaik, iris (the one that's downloadable from eeye's website) is crippleware, in that some features can't be "unlocked" even with valid keys
BlackB
08-23-2001, 02:55 AM
Yes, they got smart and made *real* evaluation versions :-) In my opinion the only effective way to protect your software.... in addition to watermarking which prevents that registered copies should be illegally spread. Don't know if watermarking would be effective in eEye's case, but it is in Datarescue's case: who did see any warez version of IDA Pro 4.05 or later? I didn't.

greets

The Blackbird
mute
08-23-2001, 05:28 PM
I don't think IDA watermarking is the reason ... watermarking can be always defeated.
xtremex
08-23-2001, 05:57 PM
But if I register the product at eeye site, would thay make me download a full ver or just generate the right keys for me. Disavowed - if ur right than it means I can't do shit with what I downloaded, and key gen is nonesens, is it? (It realy isn't a way to get a full scanner from eeye - I would really need a sec scanner in W2K) 10q
ThrawN
08-23-2001, 11:44 PM
To *obtain* a registered and full copy of iris you must provide credit card details and your Buissness name. They will contact you by phone to verify the order and then you will be shiped the cd
:)
BlackB
08-24-2001, 03:22 AM
mute (08-23-2001 15:28):
I don't think IDA watermarking is the reason ... watermarking can be always defeated.

I'm sure that if no watermarking was added, there already would be warez versions of IDA v4.15 or later. I know several persons that use a copy of IDA (bought by the company they work for) at homhe, but don't spread it because of the watermarking.

greets

The Blackbird
Samurai Joe
08-24-2001, 04:42 AM
just to tell you guys... you can find the cracks for ida 4.15 and 4.16 on yahoo.
BlackB
08-24-2001, 06:40 AM
Samurai Joe (08-24-2001 02:42):
just to tell you guys... you can find the cracks for ida 4.15 and 4.16 on yahoo.

Sure there are cracks for the demo version, but a cracked demo version is nothing compared to a real retail version.
In other words, cracked evals of IDA suck :)
disavowed
08-24-2001, 11:23 AM
the only reason to "register" the iris demo is so that it doesn't expire

and as for ida, even though ida itself may be watermarked, i don't think the updates are (i used the official 4.15 update (which was a bitch to get) on the watermarked 4.04 pro)
Aleph_
08-24-2001, 01:18 PM
disavowed (08-24-2001 09:23):
and as for ida, even though ida itself may be watermarked, i don't think the updates are (i used the official 4.15 update (which was a bitch to get) on the watermarked 4.04 pro)

You're so... moderated, Disavowed :) I'm searching for this very update for months, and I'm starting to find 'bitch' is quite a nice word here.
BTW, what happened to disavowed.net ?

Regards,
Aleph (unable to log in... SQL error again :(
tsehp
08-24-2001, 01:39 PM
(still in vacation until 3 september)
I'll have the new version of ub after this date, this log error is a random one and we can't prevent it until the new version...be patient.

my words about ida + watermarking : it's up to our sense of trust in the future not to spread a watermarked version of ida, detecting a watermark is sooo simple, just read the essay I've made and the general method is to get two different versions, crack then and byte compare the exe's...then you can reverse. But the "ethical" reversers that use this wonderful tool will buy it, just to make this company last as long as possible.
That's the reason to me why ida is not spread.

Iris is crippled, maybe protected by a key that enable some crypted code in several functions, but one bought and correctly cracked, and the spreading process starts, available on your favorite ftp based software with a good search function ;-)

new rv is working fine and will be spread in september too, best regards,


adjusting UCL HASP emulator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > adjusting UCL HASP emulator
PDA

View Full Version : adjusting UCL HASP emulator

eXe
08-22-2001, 05:27 PM
hi,
I find this commercial emulator but it has to be changed for
use on each prog.
Prog. without dongle popup:
HASP
The specificed key is not connected. (1000)

prog have Nslms32.dll
NetSentinel Win32 Client DLL.

How to do it.
I have dongle to if it is necessary.
eXe
NchantA
08-22-2001, 09:35 PM
im not exactly sure what your post means, but i think you should be looking more for help on cracking the actual dongle protection here, instead of using a 'generic' dongle emulator.

learning to emulate the dongle within its own code, brings many rewards.

NchantA
CrackZ
08-23-2001, 12:43 PM
Hiya,

There seems to be a screw loose with your logic.

UCL's HASP emulator is for HASP keys, the dll you mention is for NetSentinel (made by Rainbow), these are 2 *competing* dongles, therefore I can't imagine for one minute that the dll you have found supports HASP keys.

The error you get doesn't match any of the API status codes I know for either dongle (probably developer defined), so no clue there, you'd better work out which it is you have HASP or Sentinel before proceeding any further with this ;-).

Regards

CrackZ.
eXe
08-24-2001, 12:15 PM
ok
1. hardware is labeled "HASP 119"
2. when it is removed apears message box
+------------------------------------------+
|error
|-------------------------------------------|
|HASP
|The specificed key is not connected. (1000) |
|
| +----+
| | OK |
| +----+
+------------------------------------------+
3. I find juist NetSentinel Win32 Client DLL.
Nslms32.dll

so, where to look ,
how to identify dongle ?

assume that is HASP, do you know how to adjust
UCL HASP emulator ? ? ? that was my 1th Q
Kythen
08-24-2001, 01:22 PM
It would appear this app can work with either type of dongle (I've run across such apps before). I would assume that the HASP code is statically linked inside the exe, so to find it you'll have to do some disassembly and searching. Personally, I agree with NChanta that emulating the dongle yourself is a better path to follow. After all, getting something to work is nice... but understanding how and why it works is far better :)

If you really want to mess with the UCL emulator, I would guess that you need to know the seeds,passwords,id, and the memory contents. I think the info is stored in the registry, but not sure as I don't use the util.

Regards,
Kythen


what's the version of FlexLM which uses lmgr327a.dll?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > what's the version of FlexLM which uses lmgr327a.dll?
PDA

View Full Version : what's the version of FlexLM which uses lmgr327a.dll?

Solomon
08-23-2001, 02:18 AM
Is it v7.0a?
I just want to get the corresponding SDK, so have to know the version. Thx.
Kythen
08-23-2001, 08:05 AM
Yes, you are correct in that it's FlexLM v7.0. However, it isn't necessarily v7.0a, it can be any build of v7.0 as they all use the dll name lmgr327a.dll. You should be able to use any build of the v7.0 SDK to make your licenses. (Last build is probably best of course)

Regards,
Kythen
Solomon
08-24-2001, 03:18 AM
Thanks Kythen!

This is used by Intel C/C++ Compiler v5.0


Hi CrackZ can u help ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hi CrackZ can u help ???
PDA

View Full Version : Hi CrackZ can u help ???

Trineyetra
08-24-2001, 02:10 AM
Hi, im new to this forum and have read your awesome pages and had quite a brush with hasp dongles and managed to beat also a few. am curious about ur hasp/sentinel tool and how it beats the envelope ;-).

Now i have come across a new dongle . this is rainbow-goldensoft (china's) "Microdog" dongle. if any1 has any info about it and could guide me.. i tried some checks and it relies a lot on its vxd to do the decoding.

will be glad if ne1 could help


FLEXlm License
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXlm License
PDA

View Full Version : FLEXlm License

gravy
08-24-2001, 02:20 PM
How to I go about cracking FLEXlm after using a vendor key generator (Flexlm SDK 7.0d)?

-gravy


vendorcode6 ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > vendorcode6 ?
PDA

View Full Version : vendorcode6 ?

cryptic_one
08-26-2001, 09:03 AM
I found this in a dll
"(lm_handle * &,vendorcode6 &)+7"

what is vendorcode6 ?

lt


Asprotect + time trial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asprotect + time trial
PDA

View Full Version : Asprotect + time trial

NikDH
08-27-2001, 05:45 AM
Hi to all,
i can see that lately the asprotect + time trial protection is very used

I usually prefer to crack asprotected prog with mem patching coz its quite simple and fast

When the prog is expired a nag is shown and so
i break on the function that shows the nag and with stack command i backtrace the code till the condition that checks 4 expiration of the prog

Its usually 1 or 2 mem flags involved in this check
and so its quite easy to find them

Lately i tried to use this method with quickwiper and express newspictures but i wasnt able to find anything interesting

It seems they use ring swithing b4 showinf the nag so the stack command is unuseful to backtrace to the condition

What to do with it ?

Tnx in advance :)

See ya
NikDH


In-memory patching question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > In-memory patching question
PDA

View Full Version : In-memory patching question

Czaj-nick
08-27-2001, 06:18 PM
In short - I need to build loader that patches DLL used by my process. I only want to patch it once, just after process is loaded, I don't want/can't wait.

Currently I've solved it by debug API, I try ro patch every DLL loaded , in my LOAD_LIBRARY_DEBUG_EVENT handler. It works in both W98 and 2k. But I don't like it, I think debugging slows down my target :(

Is there any way to check the base address of particular module just after CreateProcess, or to hook library loading without using debug API ?
anon
08-28-2001, 12:32 AM
"The base address is the starting address of a memory-mapped EXE or DLL and is an important concept in Win32. For the sake of convenience, Windows NT and Windows 95 uses the base address of a module as the module's instance handle (HINSTANCE)."

from MSDN article "Peering Inside the PE: A Tour of the Win32 Portable Executable File Format"

by Matt Pietrek
DinDon
08-28-2001, 01:30 AM
You could try to inject a new DLL, expressely written by you for your purposes, using a CBT hook (SetWindowsHookEx), and put your patching jobs in the DLL entry point (from there you could find the base addresses of all the previously loaded DLLs).

Grab a nice exemple of this technique at http://codeguru.earthweb.com/dll/apihijack.shtml

Have fun!
Czaj-nick
08-28-2001, 04:57 AM
[quote]anon (08-27-2001 22:32):
"The base address is the starting address of a memory-mapped EXE or DLL and is an important concept in Win32. For the sake of convenience, Windows NT and Windows 95 uses the base address of a module as the module's instance handle (HINSTANCE)."

I don't need main module's handle/base. I get process's handle, and want to obtain base address of one of DLLs it uses, in this process address space.

How to enumerate modules, given the process handle ?

Or maybe I don't understand something ?
Czaj-nick
08-28-2001, 08:34 AM
DinDon (08-27-2001 23:30):
You could try to inject a new DLL, expressely written by you for your purposes, using a CBT hook (SetWindowsHookEx), and put your patching jobs in the DLL entry point (from there you could find the base addresses of all the previously loaded DLLs).

Grab a nice exemple of this technique at http://codeguru.earthweb.com/dll/apihijack.shtml

Have fun!

Hmm , I'm not sure If i understand it properly. I create DLL with empty HookProc (not exactly - it contains CallNextHookEx), all just to force Windows load my DLL into my target process ? Ughhh.
However, if I understand well, after doing my job I can safely Unhook, exit my loader, and let the target go on... It seems to be a good solution.

BTW, when will my DLL be loaded ? Will all DLLs imported by my target be loaded already then ?

One more question - if I'm already in my DLL's DllMain - what's the best way to determine base addresses of previously loaded DLL's ? Just walking through taget's PE structures ?
mike
08-28-2001, 12:08 PM
I did this once a while ago under 9x, but don't have access to the code anymore. Here's what I remember.

You load the DLL with LoadLibrary and get a handle to it. Then use GetProcAddress to get the address of the function you want to patch. Before you modify anything you have to change the flags on the page to writeable;
use VirtualQuery to get the current page flags & VirtualProtect to modify them.

see http://usa3.hostrack.net/woodmann/fravia/iceman.htm
DinDon
08-29-2001, 02:23 AM
when will my DLL be loaded ? Will all DLLs imported by my target be loaded already then ?
You can be sure that the DLLs loaded by the kernel loader (that is: all the DLLs requested by the target's PE header) will all be there already!

One more question - if I'm already in my DLL's DllMain - what's the best way to determine base addresses of previously loaded DLL's ? Just walking through target's PE structures ?
Why do you want to make again the work which someone else has already done? I'd rather use EnumerateLoadedModules() inside DBGHELP.DLL. Look at
http://msdn.microsoft.com/library/en-us/debug/hh/winbase/dbghelp_9lwz.asp

Have fun!


DElphi DFM ,adding controls
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DElphi DFM ,adding controls
PDA

View Full Version : DElphi DFM ,adding controls

NSDWarrio
08-28-2001, 01:53 PM
I want to add a new control to a existing Dlephi EXE file. WHen i modfiy a control in a form it works perfectyl, but crashes whne a new control is added.
Im using DFM explorer and BRW 45 to get ti running
DinDon
08-29-2001, 09:08 AM
That's would be great, but AFAIK it cannot be done!
Adding controls means not only to modify the .DFM file (and consequently the RCDATA resource in the executable file), but also the .PAS file (and consequently the .DCU, which gots linked in the code section of the executable itself). That's so because you have to modify the declaration of your TForm class in order to contain the new component declaration, which in that way will be created...

Regards.


SetWindowsHookEx problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SetWindowsHookEx problem
PDA

View Full Version : SetWindowsHookEx problem

Czaj-nick
08-28-2001, 07:29 PM
I've just tried using SetWindowsHookEx for the first time. Global hooking (with thread ID = 0) works pretty, my DLL gets attached to everything around :)

But I can't make a hook on a particular thread.
I do the following:
1. spawn my target using CreateProcess(..., &pi)
2. get pi.dwThreadID (id of main thread of just created process, isn't it ?)
3. pass it to InstallHook (that is in my DLL)
4. in InstallHook (in DLL code) i run SetWindowsHookEx.
But it returns NULL, and sets last error to ERROR_INVALID_PARAMETER (that probably means invalid thread ID)

What's wrong with this approach ? Is it possible at all ? I can't find any examples doing it this way...


Why unpacked files dont run on win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Why unpacked files dont run on win2k
PDA

View Full Version : Why unpacked files dont run on win2k

LaptoniC
08-29-2001, 04:28 PM
I have problems with Win2k.My unpacked files work on Win9x and WinMe but Win2k.What is the reason for it?.I have unpacked lastly Ulead GIF Animator 5 (vbox) with the help of revirgin.It worked on win9x but not on win2k.I have attached my revirgin output.Also revirgin changes some 00000 entries to RPCRT4.dll I_RpcBindingInqDynamicEndpointA.With these entries program dont run even in Win9x so I have deleted them.Is this is a bug ?.Thanks.
aimless
08-31-2001, 12:52 AM
Unlike Win 9x, Win NT and more recently Win 2K, CHECKS the CHECKSUM/CRC of each file before execution.

If it finds a flaw, it will not work.

Then again, you could have it so because NT/2K calls files differently from Win 9X.

My guess is: Get a Checksum/CRC correcter, do the necessary and blas. It SHOULD run.

have Phun
tsehp
08-31-2001, 01:28 AM
and some api names were changed, actually rv rebuilded import are guaranteed to work if you stay on the same win major+minor version, all is explained into the manual.
LaptoniC
08-31-2001, 09:26 AM
I have put correct crc of file but I dont think it is the problem.Because some files without correct crc also runs on win2k.I have also tried to use Make Pe header win2k compatible command. in Peditor's rebuilder.
LaptoniC
09-09-2001, 11:32 AM
I found the problem.Problem is the missing imports.In win9x some imports from mfc42.dll was missing.I have tried to use revirging on win2k.Revirgin gaved bad result ie wrong import names duplicate imports however it resolved correctly this missing imports in win9x.It is interesting.Thanks for your help.
RaX [e!]
09-13-2001, 11:17 AM
it's not interesting! it's a pain in the arse!!!


Is there any software crack for HASP4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is there any software crack for HASP4
PDA

View Full Version : Is there any software crack for HASP4

shir
08-30-2001, 01:38 AM
Hi,

I'd like to know that
whether HASP4 has been cracked yet or not?

regards
nc
08-30-2001, 06:45 AM
pfft, i crack hasp4 after breakfast each morning.

nC *g*


Welcome To First Persian Crack Stroe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Welcome To First Persian Crack Stroe
PDA

View Full Version : Welcome To First Persian Crack Stroe

NomorE49
08-31-2001, 11:26 AM
Hi,
We Live In Iran And We Worked On Many Projects... About Cracking, ViRII Making, ...
If You Have Any Knowledge About Above Matters You Can Join To Our Group.

We Can Help About Unpacking, Unprotecting, Undongling, Cracking, ...

We Wait For Your Requests/HelpS!

Have A Good Luck In Cracked World!
E-mail: nomore49@bigfoot.com
web: www.ics.funurl.com
NomorE49
gloryx
08-31-2001, 03:17 PM
... hi

... i don't see your web address

... please post it

... regards
noname
09-01-2001, 11:10 AM
NomorE49 (08-31-2001 09:34):
Hi,
We Live In Iran And We Worked On Many Projects... About Cracking, ViRII Making, ...
If You Have Any Knowledge About Above Matters You Can Join To Our Group.

We Can Help About Unpacking, Unprotecting, Undongling, Cracking, ...

We Wait For Your Requests/HelpS!

Have A Good Luck In Cracked World!
NomorE49

Well no recruiting here :) .If you want to share knowlege here you are welcome
here.
If you are providing cracks please fu** off .

Good day :)


How to find free space in the code section?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to find free space in the code section?
PDA

View Full Version : How to find free space in the code section?

roar
09-01-2001, 10:49 AM
Hi,
How to find the free space in the code section of a 16 bit windows executables? Are any tools available/


Need help on HASP Envelope?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need help on HASP Envelope?
PDA

View Full Version : Need help on HASP Envelope?

nvk
09-01-2001, 10:58 AM
HI,
If i have a hasp dongle, Can I find encrtipt/decript code for hasp envelope? are any tools available to find envelope & its reversing?


Hasp and Hasp4 emulator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp and Hasp4 emulator
PDA

View Full Version : Hasp and Hasp4 emulator

Martin McKeen
09-01-2001, 04:29 PM
The only place where hasp Hasp4 generic functions are emulated is there:
http://dongleduplicate.nsys.by


Sorry for the big messageboard interruption.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sorry for the big messageboard interruption.
PDA

View Full Version : Sorry for the big messageboard interruption.

tsehp
09-08-2001, 03:20 PM
Coming back from vacations, your isp just tells you after 1.5 year :
Just be gone in 10 days, and then shut down your account after 2, leaving your poor chances of verifying your backups and downloads.

And that was the problem + big Ultraboard based failures, we had lost all the rce general board messages, so I had to reconstruct the whole big archive and it took a long time, I just hope that this interruption didn't discouraged you to come here and trade your knowledge.

They can shut down the site, they can't kill the knowledge and archives, so we're back and more motivated as ever.

Now all the files have been transfered to this new php script, much faster and reliable, I hope you'll like it.
We'll try to change the colors in the future as long as there are suggestions.

regards,

Tsehp
Js
09-09-2001, 08:24 AM
Hiya,
Board looks great. Thanks to all involved.


Problem loading SoftIce in W2k server.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problem loading SoftIce in W2k server.
PDA

View Full Version : Problem loading SoftIce in W2k server.

ddtl
09-09-2001, 10:30 AM
Hello.

Recently i downloaded and installed SoftIce 4.05 for NT/W2k (i have
W2k adv. server, build 2195+sp2), but something strange happens:
whenever i try to start softice (Ctrl+d), everything freezes, but
softice's window doesn't pop up. The only time i could get it pop up,
is when i use boot startup mode and immediately after softice loads
(before window's graphics screen appears).

Does somebody knows how to solve that problem (write-protection
is disabled)?

ddtl.


Sentinel LM help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel LM help
PDA

View Full Version : Sentinel LM help

LaptoniC
09-09-2001, 11:25 AM
I am trying to crack a program which is protected by Sentinel LM v7.1.1.It use lsapiw32.dll.I put bpx on VLSrequestExt and found featurename,version,units required.It breaks two times however version and units required is always zero.Are they zero or they changed this function ?

Also there is no exported function "computeVendorCode".I have also tired to apply signature to this dll file but still I cant find vendorcode.


what API calls for a program to close itself ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > what API calls for a program to close itself ?
PDA

View Full Version : what API calls for a program to close itself ?

WoZX
09-09-2001, 08:07 PM
as above

thx.
Kayaker
09-10-2001, 01:14 AM
Hi WoZX,

The usual final API is ExitProcess. It's usually called directly after the main window procedure, in MASM something like

invoke WinMain
invoke ExitProcess, eax

in Softice something like

Call xxxxxxxx ; start of main code
push eax ; zero
Call ExitProcess

There's usually common shutdown API's just before the return as well such as CloseHandle, FreeLibrary, EndDialog. A protection routine might use its own call to ExitProcess with its own particular shutdown routine such as writing to the registry.

TerminateProcess is used in unconditional process killers of other programs like Procdump and PEDump have as a feature.

Hope this helps,

Kayaker


Either new aspr, better implementation or asshole author code ;)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Either new aspr, better implementation or asshole author code ;)
PDA

View Full Version : Either new aspr, better implementation or asshole author code ;)

nchanta
09-10-2001, 10:07 AM
Hola all, tis me again.

feels nice to post on this nice new board ;)

pastel colours and a much kewler interface tsehp ;)

neway back to my topic, i was reffered to this by a friend on #c4n (hi lost).

AiS Watermark Pictures Protector v2.1
http://www.atomintersoft.com

its got the weirdest implementation of aspr ive seen (i think :p )

i unpack as normal/ fix imports as normal, seems nothing new there (it makes me wanna think this isnt a new ver, but i cant be sure).

but after i fix everything and goto run, it seems the bastard BSOD. i traced it to the first api call a 'EnterCriticalSection' one. i dont think the CriticalSection is Initialised????????

anyone can help me plz ;)

NchantA
tsehp
09-10-2001, 11:15 AM
checking out with new rv (soon on beta)
nchanta
09-10-2001, 09:23 PM
ohh goodie.

hi tsehp+ btw, how is rv going?

do u know if rv could help in fixing new securom shit?
LaptoniC
09-10-2001, 09:44 PM
Damn it is very though.I have completed only part of it.
OEP 11A59C IAT 124190 import is rebuilded with imprec.

0045E754 7404 jz 0045E75A change to jmp
0045E75F 7413 jz 0045E774 change to jmp
004C5976 E8FD8DF9FF call 0045E778 nop it
0045E46C FF1500185200 call dword ptr [521800] should be call 004C5828

it doesnt ends here.It checks asprotect alot.Very pathetic author :)
Js
09-11-2001, 06:05 AM
Hiya,
Reccomend you take a closer look inside the 0045E778 proc.
"Very pathetic author", why?, name of the game is make it a bit more difficult isn't it? ;)
sv
09-11-2001, 09:08 AM
Hi all, Nchanta, tsehp :)

Happy to read you again :)

Have rebuil a valid IT (exe works with some patches (AS checks)).
I send IT if it can be usefull.

SV

Sorry but attachment doesn't seem to work :(
sv
09-11-2001, 09:13 AM
Upload works now !
Thx Tsehp :)
Js
09-11-2001, 10:26 AM
Hiya sv,
Nice to hear from you. Beat you to this one, still haven't got that f****** aqua though ;).
tsehp
09-11-2001, 06:22 PM
first, I'll pray for people that died in this horrible terrorist attack for a long time...

finally I've made it work, pretty good implementation but only tests in mem if asprotect is present.

1-with new rv (soon available) trace and find oep 51a59c
dump your target with procdump while rv's tracer holds the program frozen with the tracer

use fetch iat, resolve iat's, show unresolved, use 'api emulator' (new function to resolve latest asprotect small api emulation)
everything is resolved but two entries, trace them and make a resolve again... then iat generator, the new it is dumped into your dump that is realigned.

2-I'll assume you didn't deviated the first asprotect entries inside the target before reaching the oep

403eb0 patch to jmp (you've forgotten this laptonic)
next laptonic's work :

0045E754 7404 jz 0045E75A change to jmp
0045E75F 7413 jz 0045E774 change to jmp
004C5976 E8FD8DF9FF call 0045E778 nop it
0045E46C FF1500185200 call dword ptr [521800] should be call 004C5828

and the target loads, I let you the final work to reg it, asprotect is removed.

regards,

tsehp
tsehp
09-11-2001, 07:25 PM
Originally posted by sv
Post attachment test

Here is error text :

Warning: SAFE MODE Restriction in effect. The script whose uid is 10012 is not allowed to access /tmp/ais_idata.zip owned by uid 0 in /usr/local/plesk/apache/vhosts/woodmann.com/httpdocs/vbulletin/upload/admin/functions.php on line 1606

Warning: fopen("/tmp/ais_idata.zip","rb") - Undefined error: 0 in /usr/local/plesk/apache/vhosts/woodmann.com/httpdocs/vbulletin/upload/admin/functions.php on line 1606

Warning: Supplied argument is not a valid File-Handle resource in /usr/local/plesk/apache/vhosts/woodmann.com/httpdocs/vbulletin/upload/admin/functions.php on line 1607

Warning: Supplied argument is not a valid File-Handle resource in /usr/local/plesk/apache/vhosts/woodmann.com/httpdocs/vbulletin/upload/admin/functions.php on line 1608

Warning: SAFE MODE Restriction in effect. The script whose uid is 10012 is not allowed to access /tmp/ais_idata.zip owned by uid 0 in /usr/local/plesk/apache/vhosts/woodmann.com/httpdocs/vbulletin/upload/admin/functions.php on line 1629

those problems are now over, re upload please !
Kilby
09-12-2001, 09:28 AM
If you wanna see a properly implemeted asprotect have a look at iglooftp 3

http:\\w*w.iglooftp.com

It's a stinker :)

Kilby...
SpeKKeL
09-12-2001, 02:45 PM
HaJO !

Well again about the iat from aiswpp:i downloaded sv's iat and i'am wondering how the 2 directed api's on :

170c968:push ebp
mov ebp,esp
mov eax,[ebp+08]
pop ebp
ret 004
and on
170c974 :push ebp
mov ebp,esp
ret oo4
are traced to : kernel's lockresource (170c968)and the second to
kernel's freeresource (170c974)
I thought i must use kernel 's ord_2f (ret 004) or a getprocaddress ......

Could someone explain how they did trace to the lock/free resource..

Van de la SpeKKeL.... :confused:
tsehp
09-12-2001, 03:10 PM
Originally posted by SpeKKeL
HaJO !

Well again about the iat from aiswpp:i downloaded sv's iat and i'am wondering how the 2 directed api's on :

170c968:push ebp
mov ebp,esp
mov eax,[ebp+08]
pop ebp
ret 004
and on
170c974 :push ebp
mov ebp,esp
ret oo4
are traced to : kernel's lockresource (170c968)and the second to
kernel's freeresource (170c974)
I thought i must use kernel 's ord_2f (ret 004) or a getprocaddress ......

Could someone explain how they did trace to the lock/free resource..

Van de la SpeKKeL.... :confused:

ha ha ha ha , this funny board self detected some jokes inside your listing:p

all those entries are to emulate a ret4 , a normal ret with add esp,4 and that's all.
SpeKKeL
09-12-2001, 03:26 PM
yEP ,

mAYBE THE QUESTIONS WERE TO
SIMPLE....

:) :o :p ;) :D

tHANKS +TSEPH

tHINK A'VE GOT THEM ALL

:D sPEK..


How Can you remove it's CRC?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How Can you remove it's CRC?
PDA

View Full Version : How Can you remove it's CRC?

Peter
09-11-2001, 12:57 AM
I tring to remove Cachex for Internet Explorer 4.0 CRC,but it is very hard. Who can help me? If you how to remove it's CRC?
Thanks!
softwrae down address:http://www.mwso.com
Have some for it tutor?
Please tell me ok?
:(
Tech
09-11-2001, 11:03 AM
I know this sounds dumb but I'm only starting out: whats crc ? some kind of protection ?
Clandestiny
09-11-2001, 08:56 PM
Hi Tech,

CRC = "cyclic redundancy check". The CRC is an algorithm used to detect changes in a file. It is not a protection scheme per se, though it may be used as such. When not applied to a software protection, the CRC may serve as a form of error checking (ie. to detect data corruption). When applied to a protection, it will be used to deter casual patching of an .exe or .dll. The algorithm may be as simple as summing up all the bytes in the file and comparing it to a correct value, or it may be substantially more complex, being performed only on critical portions of the file. The vulnerability of the CRC is that the program must typically open and read itself using an API like CreateFileA or MapViewOfFile. These API's along with the other win32 file I/O functions (ie. OpenFile, ReadFile, _hread, _lseek...ect) are the attack points when seeking to disable a CRC. Obviously an API monitor will be invaluable in this type of situation. BTW, +Spath has an excellent article describing the CRC algorithm...Should be easy to locate on +Tsehp's site with a quick search.

Hope this answers your question.

Cheers :)
Clandestiny
tsehp
09-12-2001, 08:59 AM
an easy trick to locate where the crc check is :
make sice break before the crc occurs, just do a single bpmb on your patched instruction. When the protection needs to check the bytes, it will trigger sice just at this address. then you have to reverse the crc to see where the final value is compared.

lots of tutorials for this, I remember in some old asprotect ones.
Tech
09-12-2001, 11:50 AM
thanks Clandestiny, i've actually come across crc before without knowing it. I think it was in Regview(http://www.regview.com/) but whenever I patched the exe it said it was corrupt after I ran it. I got it working in the end tho...:)


Memory dumping 16bit code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Memory dumping 16bit code
PDA

View Full Version : Memory dumping 16bit code

Anticode
09-11-2001, 05:37 AM
Hi,
Anyone knows a 16bit/NE memory dumper?

_Anticode.
Kayaker
09-12-2001, 03:38 PM
Hi _Anticode,

Check out

h**p://groups.yahoo.com/group/exelist/messages/

There's a recent thread thread there asking sort of the same thing, or maybe searching some of the earlier posts might give you an answer.

Besides that, are you looking for an auto-dumper, or can't you just dump the memory from Softice itself?

Kayaker


Woh Yeah!!!!!!! :d
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Woh Yeah!!!!!!! :d
PDA

View Full Version : Woh Yeah!!!!!!! :d

nofurs
09-11-2001, 06:06 AM
Hiya all,
Nice to be back in this new board.Cheers to those
working hard to made the board up again.
Tsehp,Spaj,Kayaker :cool: :p :D
erm back in a few hours and guy I forgot sorry :p
WOODMANN :D
cluesurf


help dummies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help dummies
PDA

View Full Version : help dummies

fido_sr
09-12-2001, 06:04 AM
i am reallly new to this iwas trying to run carmageddon 1 with out the cd but no success
i cracked all the popups about the Cd not being in the drive but dont have clue abt the message that splashes across the screen saying 'Please Insert the Carmageddon Cd' i couldnt find this mssg in dsm strng ref.
This mssg i am talkning is not a window pop up but full screen display.
Fake51
09-12-2001, 09:19 AM
When trying to crack cd-checks, it is often more useful to go for the cd-check itself, than the error msg's. Thus, instead of trying to figger out how to make soft-ice break when the game is displaying it's string "gimme cd", try and find the place where it figures out that there is no cd. This is often done with getdrivetypea calls and others like it.
Check Tsehp's mirror for student essays, there's a cd-project in there somewhere, with some nice essays. Also check R!sc's page for some ok cd-check essays.

Fake


Soft Sentry tutorials
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Soft Sentry tutorials
PDA

View Full Version : Soft Sentry tutorials

Antipodean
09-12-2001, 06:57 AM
Does anyone have any pointers to Soft sentry tutorials? I have an app that appears to use Soft Sentry for its registration. It allows 30 days free use, and then you have to send in the number it quotes to get a registration code. It looks like one of those "number-from-the-disk" schemes.

The only thing I have used so far to dig into it is WDasm32, but once the screen gets to asking for the registration number it will not single step the screen because it is in the NT innards.
ZenLoren
09-12-2001, 09:11 AM
Hi
I had 1 tuts SoftSentry ver 3.0
Hope its helps

Loren
Scally6
09-12-2001, 01:07 PM
Hi Antipodean,
I found an app some time ago that used softsentry 3.?? that didn't function the same way this tut sorts. It was just a case of changing the exe so it didn't jump to the ssentry dll file which lived either \windows or windows\system and tweaking a reg entry if I remember right. If you still dont get it, post the app's url.
Scally
Antipodean
09-13-2001, 05:59 AM
Thanks for the tutorial Zenloran, although as Scally6 says, this particular app uses a DLL, which although not called by a Soft Sentry name has SS entry points. I will have to investigate the possibility of just bypassing the DLL entry points :)

The app is a route map application that came on a magazine CD, and is not downloadable from the original providers web site. It is called Route Tracker, and was issued on an english magazine. Potentially useful as it can be hooked to a GPS to keep track of where you are. :)
Scally6
09-13-2001, 05:44 PM
If that dll was called auto2k.dll, then its just a case of making sure it doesn't get called from the exe. None of the stuff I dl'd coped with this version & even protecting an exe with the softsentry prog gave different results. I couldn't believe the protection was so simple but it was.
Scally


Softice Help needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice Help needed
PDA

View Full Version : Softice Help needed

nyx
09-12-2001, 07:52 AM
I can't seem to set bpx's with the A in the end,like GetDlgItemA
the A is read by ice as a invaild command

sorry if this is dum,but I can't figure it out
Fake51
09-12-2001, 09:11 AM
Not really the right forum but anyway:

Are you sure you're loading the right exports? Check your winice.dat file, to see if you're loading exports from user32.dll, kernel32.dll and what else.
You can also try and load the exports from these manually using symbol loader, then you should be able to figure out if this is the problem.

Hard to help here, you do not supply much info.

Fake
Tech
09-12-2001, 12:12 PM
What windows version you using? I think the A only applies to windows 2000/NT otherwise drop it...
Tech
09-12-2001, 12:13 PM
oh yea try set a breakpoint on GetDlgItem instead of GetDlgItemA...


Killing rogue processes under Windows!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Killing rogue processes under Windows!
PDA

View Full Version : Killing rogue processes under Windows!

Dr Apocalypse
09-12-2001, 11:13 AM
How do you kill a rogue process without rebooting windows?

I just ran a DOS prog under WinME and it crashed (surprise!) so I delete it, but it says:

Cannot delete CHFONT.BIN: Access is denied. The source file may be in use.

Taskmanager is useless, so I ran a few utils like procdump, Ramhak to see if any processes were still running but no dice!

Is there something like the 'ps' command Unix has available?

How can I identify what has attached itself to CHFONT.BIN so I can 'kill -9' it ;)

DrA.
tsehp
09-12-2001, 02:37 PM
All I can tell you is using the win api and make a prog in c++ , otherwise there are apps on the net that make the same things, but you have to find them.

you can use the terminateProcess api, or either send a wm_quit win msg if this app processes windows msgs.
But if it's frozen into an endless loop, win 9x or win_me are not real preemptive multitask systems, so you can't like unix kill any process you want, unlike (the beloved) win nt.
Dr Apocalypse
09-12-2001, 04:01 PM
I never got on with C or C++ so that's out :( You know in yourself when somethings beyond your ability, C was that stage!

I have got NT4 on a CD somewhere, but the damn thing will probably work under that /:

So it's either find a util to do the job, or reboot Windows! Guess which one I'll end up doing!

I've got some Win API docs though so I'll read up on your suggestions, if only to understand the problem further!

Thanks!

DrA.
tsehp
09-13-2001, 02:07 AM
I don't really know in detail what win 9x does to terminate a process, maybe it calls the same api, but for this api to work it must get an handle for it, then free it's resources.
but this app, crashed and doesn't respond to win requests, it just simply won't be closed on win 9x.
Aimless
09-13-2001, 03:21 AM
Go to www.sysinternals.com

Download 'pstools.zip'

Open 'pskill.exe' in command prompt

Have PHun
Dr Apocalypse
09-13-2001, 01:23 PM
Thanks for the replies!

pstools only works on NT/2000 maybe XP, but not on my OS, WinME so I couldn't use them :(

I really looked forward to some good old command line useage as well! Would upgrading to WinXP give more control over processes like Unix does? I used to use IBM's AIX in my last job that's why I'm more familiar with a command line environment!

DrA.
tsehp
09-13-2001, 02:29 PM
win xp == win2k == win nt, with improvments but the foundations are the same, pure win32 code and now the future m$ standard for win 9x users, good news to me for app's stability.

The commands are all documented but much powerless than real linux system, but if you search for linux look and feel, I remember there are some shells that allows to command a nt4 with kind of linux commands.
Dr Apocalypse
09-15-2001, 07:19 PM
Hey, thanks for link Artha, quite a loaded gun this little tool ;) just hope I don't shoot the wrong process!

Have to recreate a 'rogue process' scenario now and try it out, or better still, upgrade to XP like tsehp suggests!

DrA.
Dr Apocalypse
09-16-2001, 10:10 AM
W32Dasm not work in XP? F*$K, F*$K and double F*$K!

I like playing in W32Dasm :)

No W32Dasm, No XP! Simple as that!

Thanks for letting me know ;)

DrA.


[OT] We are close to you friends
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > [OT] We are close to you friends
PDA

View Full Version : [OT] We are close to you friends

BobTheRock
09-12-2001, 02:43 PM
Sorry guys, I know this is post is out of topic but I really felt the need to express my grief for what is happened to the USA. We are close to you all.

An italian.
Woodmann
09-12-2001, 03:01 PM
Thank's Bob.

Peace, Woodmann
Tech
09-12-2001, 03:02 PM
*sniff* *sniff* :(
tsehp
09-12-2001, 03:13 PM
off topic but exceptionnal.

Actually, we all are Americans.
Tech
09-12-2001, 03:41 PM
Originally posted by tsehp
Actually, we all are Americans. ?
Kayaker
09-12-2001, 07:30 PM
Originally posted by Tech :..:
?

Meaning we are all hurt and affected by this immense tragedy no matter where we live around the world.

We share in the loss, Condolences to all from Canada.

Kayaker
Woodmann
09-12-2001, 08:13 PM
Very nice Kayaker,
This is a crime against all people living in free country's.

Peace, Woodmann
the snake
09-13-2001, 02:37 PM
To the American nation, i will use this little stage to pass on condolences to the families of the victims and to wish full recovery for those who got wounded.

We are all in the same "boat" (That's what we say in Hebrew).

All i can wish this days is Peace, ALL over the world.

the snake
Israel
stealthFIGHTER
09-13-2001, 03:03 PM
I would like to join with BobTheRock and the snake.

PEACE TO WHOLE AMERICA!

sF


Unknown Cipher
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unknown Cipher
PDA

View Full Version : Unknown Cipher

XtremeX
09-12-2001, 03:07 PM
Maybe this topic, I just posted, seams unappropriate in this forum.
Although it resambles a hardware reverse engeenear issue, it could easly be found in a software implementation too.
Im talking about reversing an unknown crypto cipher, implemented in a chip.
I was wondering what type of algorithm this cipher uses. Whether it is a block or a stream cipher. As far as I know it could be both, but I must say that my knowledge in hardware implementation of crypto ciphers is not so good. Therefor I ask your opinion, and maybe your colaboration in reversing it.
The cipher works like this:
- it's response-challenge based
- challenge = 6 random bytes (that you provide)
- response = 2 bytes (generated by the algorithm)
- key = 6 bytes (48-bits)

Code:
ATR; // card is reseted, and it outputs the first bit from memory (512bits long)
FOR 1 to 110 Pulse_CLK; // Pulse CLK till the 111th bit}
Pulse_RST
Pulse_CLK // Write to bit 111
FOR 1 to 177 do Pulse_CLK // Provides the cipher with data
128 bit DATA + 48 bit KEY = 177 (as far as I see it)
FOR 1 to 48 do // send the 48bit challenge
set bit 1..48 of challenge
Pulse_CLK
EndFor
FOR 1 to 8 do // Read output
FOR 1 to 160 do Pulse_CLK;
readOutputBIT;
So...
The Algorithm needs 177 clocks to initialize + 48bit of challenge
And then it outputs one bit after every 160 clock cycles.

I wonder what could it be. A delayed stream cipher or a block cipher (a hash alg. like this could be implemented in both ways).
Any of you guys keen in crypto hardware that could give me an answer please feel free. Other ideeas of reversing this are also wellcomed.
Thanks


Rewrite Spro developer id ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Rewrite Spro developer id ???
PDA

View Full Version : Rewrite Spro developer id ???

haec_est
09-12-2001, 06:29 PM
hi,

do you have notice about this task ? it's an idea that went to me some day ago.

:confused:

where can I found some stuff about the spro hardware, or about the sentinel driver ?

thanks.
MeteO
10-11-2001, 07:59 PM
Maybe easy to use dongle emulator?
haec_est
10-13-2001, 08:51 AM
Originally posted by MeteO
Maybe easy to use dongle emulator?

...and where is the funny part :) ???

Btw i was intrested in how sentinel driver work, the
protocol used in communication between driver and
hardware, and how is physically made a superpro (wich type of eeprom) and so on...

I searched for older sentinel driver (the new ones
are too complicated for me :( )... but no luck :(

Can you say me where i can find such type of info ?

thanks,

haec_est
MeteO
10-14-2001, 07:07 PM
1. Decrypt param block via decryption routine.
2. Analyze which type of dongle have a deal
3. Send command into dongle
4. Retrieve result and return via encrypted spro_Api_Packet.

spro_Api_Packet structure are here(part of my Sentinel dongle emulator):

;
Packet struc
Sign DW ?
BufSize DW ?
field_4 DW ?
Status DW ?
DongleType DB ?
field_9 DB ?
UnitNumber DB ?
OsType DB ?
field_C DW ?
field_E DW ?
field_10 DW ?
field_12 DW ?
data DB 28 DUP ( ? )
FunctionCode DW ?
Unkn DW ?
MemoryAddress DW ?
MemoryContents DW ?
AccessCode DB ?
rsv DB ?
WritePassword DW ?
xtraPassword1 DW ?
xtraPassword2 DW ?
field_3F DB ?
mappedAddr DW ?
portType DW ?
MaskInts DW ?
deviceRetryCnt DW ?
contentionRetryCnt DW ?
padding1 DW ?
flags1 DD ?
contentionMethod DD ?
contentionRetryInterval DD ?
Packet ends

;
Response EQU offset Packet.xtraPassword1
DevId EQU offset Packet.AccessCode
CELL EQU offset Packet.MemoryAddress
QueryLen EQU offset Packet.MemoryContents

;
; Sentinel SuperPro internal functions
;
fn_SPRO_INITIALIZE = 00h ; RNBOsproInitialize
fn_SPRO_GETVERSION = 01h ; RNBOsproGetVersion
fn_SPRO_SET_UNIT_INFO = 02h ; RNBOsproGetUnitInfo
fn_SPRO_GET_UNIT_INFO = 03h ; RNBOsproSetUnitInfo
fn_SPRO_CFG_LIB_PARAMS = 06h ; RNBOsproCfgLibParams
fn_SPRO_FIND_1ST_UNIT = 08h ; RNBOsproFindFirstUnit
fn_SPRO_FIND_NEXT_UNIT = 09h ; RNBOsproFindNextUnit
fn_SPRO_READ = 0Ah ; RNBOsproRead
fn_SPRO_EXT_READ = 0Bh ; RNBOsproExtendedRead
fn_SPRO_DECREMENT = 0Ch ; RNBOsproDecrement
fn_SPRO_WRITE = 0Dh ; RNBOsproWrite
fn_SPRO_OVERWRITE = 0Eh ; RNBOsproOverwrite
fn_SPRO_ACTIVATE = 0Fh ; RNBOsproActivate
fn_SPRO_QUERY = 10h ; RNBOsproQuery
;
; Sentinel Scribe internal functions
;
fn_SK_INITIALIZE = 00h ; RNBOskInitialize
fn_SK_GETVERSION = 01h ; RNBOskGetVersion
fn_SK_SET_UNIT_INFO = 02h ; RNBOskGetUnitInfo
fn_SK_GET_UNIT_INFO = 03h ; RNBOskGetUnitInfo
fn_SK_CFG_LIB_PARAMS = 07h ; RNBOskCfgLibParams
fn_SK_READ = 0Bh ; RNBOskRead
fn_SK_WRITE = 0Ch ; RNBOskWrite
fn_SK_ENABLE = 0Dh ; RNBOskEnable
;
; Sentinel Pro internal functions
;
fn_PRO_INITIALIZE = 00 ; RNBOproInitialize
fn_PRO_GETVERSION = 01 ; RNBOproGetVersion
fn_PRO_SET_UNIT_INFO = 02 ; RNBOproGetUnitInfo
fn_PRO_GET_UNIT_INFO = 03 ; RNBOproSetUnitInfo
fn_PRO_FN4 = 04
fn_PRO_FN5 = 05
fn_PRO_CFG_LIB_PARAMS = 06 ; RNBOproCfgLibParams
fn_PRO_QUERY = 09 ; RNBOproQuery
haec_est
10-15-2001, 01:11 AM
Thanks for the infos... :)

Very usefull !!!


How to convert RVA to RAW Offset in a program?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to convert RVA to RAW Offset in a program?
PDA

View Full Version : How to convert RVA to RAW Offset in a program?

Solomon
09-12-2001, 11:21 PM
In my little program I just open the PE file(using CreateFile, not LoadLibrary), read the byte stream and get some RVAs.

How to convert the RVA to the corresponding RAW OFFSETS?
I know there are such tools but wonder how to implement this.

Thank you very much for your hint.
CoDe_InSiDe
09-13-2001, 12:49 AM
Hi Solomon,

It's actually very easy, but maybe difficult to explain ;)
Suppose you want to convert the OEP from Virtual to Raw Offset.
And the OEP = 0000135F
Now first thing you need to do is subtracting the ImageBase, In the PE Header the OEP doesn't have the ImageBase so it's not needed now :)
Then you must find out to which Section this OEP belongs.
Suppose we've got the following 2 Sections:

1st Section
Name: .text
VirtualSize: 00001000
VirtualOffset: 00001000
RawSize: 00000C00
RawOffset: 00000400

2nd Section
Name: .data
VirtualSize: 00001000
VirtualOffset: 00002000
RawSize: 00000800
RawOffset: 00001000

Then you must check (beginning from the first Section) if it's VirtualOffset is equal or lower then the VirtualOffset you want to convert (this case our OEP = 0000135F) :)
The first Section has VirtualOffset = 00001000 so that's lower then our OEP and so that's good ;)
If the VirtualOffset would be equal to our OEP then we already found the correct Section, but if it's lower then you need to check the second Section if that VirtualOffset is "higher" then our OEP.
If so then we need the first Section.
If the VirtualOffset of the second Section is still lower then our OEP we need to continue searching in the same way :)
Ok, so in this example we need the first Section ;)
So after you found the correct Section then you can do this to convert it:

OEP - VirtualOffset + RawOffset
0000135F - 00001000 + 00000400 = 0000075F

So 0000075F is the converted OEP :)
Now the only thing that's left is to add the BaseAddress of where you load the Program in memory, with ReadFile for example ;)
And that's it i hope you understand about what i'm talking here ;)
There are maybe some other ways but i always do it like this :p

Cya...

CoDe_InSiDe
Solomon
09-13-2001, 03:43 AM
Thank you CoDe_InSiDe for your so detailed illustration. :)

I just finished my little prog using this section_table_traversing algorithm. Now I have a deeper understanding of PE structure.

thx again
CrackZ
09-16-2001, 08:40 AM
Hiya,

I know its a while since this thread was 'active', but anyhow.

I wrote a function many moons ago to do this conversion, I've pasted it here, all it relies on you doing is passing a pointer to the PE header and the RVA you desire converting, (how you get the PE header is your business ;-) ).

; ##################################################
; RvaToRaw() - Takes a rva and converts it to a raw offset.
; Returns : EAX=raw.
; ##################################################

RvaToRaw proc pe_header:DWORD, rva:DWORD
push ebp ebx ecx edx esi edi
xor eax, eax
mov ecx, rva
cdq
mov edi, pe_header
mov ax, word ptr [edi.3ch] ; offset 'PE'
add edi, eax
mov dx, [edi.6h] ; number of sections
add edi, 0f8h ; start of sections

RvaToRawLoop:
mov eax, [edi.0ch] ; virtual address
cmp eax, ecx
ja RvaToRawDone
add edi, 28h ; next section
dec edx
jnz RvaToRawLoop ; last section drops out of the loop

RvaToRawDone:
mov eax, rva
mov ecx, [edi-1ch] ; previous sections virtual address
sub eax, ecx
mov ecx, [edi-14h] ; previous sections raw offset
add ecx, eax
xchg eax, ecx

RvaToRawEnd:
pop edi esi edx ecx ebx ebp
ret
RvaToRaw endp

Amend, use, abuse or improve it to your needs.

Regards

CrackZ.
Solomon
09-16-2001, 08:37 PM
Thank you CrackZ for your nice source!


How to add DLL funtions to SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to add DLL funtions to SI
PDA

View Full Version : How to add DLL funtions to SI

JohnnyBoy
09-13-2001, 01:54 AM
I am trying to crack a VB3 program. I have done all the resurce search and found that the program uses keylib16 for the validation of the key. I have used w32dasm to look inside keylib16 and know that the function that needs crack is pp_tcode.
I have added keylib16 in winice.dat but I cant do a bpx pp_tcode.
what I need is to see the values imported and exported from this DLL. My fist attemt to make a crack on this function is to set the export value to a fixed 07 and NOP the rest. The value 7 vill give me a full pro version.


SI, VB and function in DLL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SI, VB and function in DLL
PDA

View Full Version : SI, VB and function in DLL

JohnnyBoy
09-13-2001, 02:19 AM
Trying to Crack a program written in VB3. The key is calculated in a DLL called keylib16. The function that do the calculation is pp_tcode. This function is returning a 0 if the key is wrong. A 1-7 gives me access to the softvare.

I try to set a bpx pp_tcode but SI tells me this symbol is not defined. I add keylib16.dll to winice.dat, but no change.

How do I get SI to set a bpx on the funcion pp_tcode:confused:

When I try the Symbol loader it tells me that no debug information is available.

(As you can see, I am new to this)
Aimless
09-13-2001, 03:18 AM
Hallo,

I suggest that you understand the following first:

What exactly is the API call? I mean take ANY API. Let us see..hmm, lets take 'ExitProcess' as the API.

Now, Microsoft and ourselves can easily refer to 'ExitProcess' as a means of calling that function.

However, the machine cannot understand any of this 'ExitProcess' junk. It can understand only addresses. What it means is that for each API, there is an address. How does softice load all addresses, and thereby, the names ? It simply opens the file as exports from the Loader.

What has happened is, you know that a function called as 'some_vb_func' is being called. You put a breakpoint on that. BUT, the softice does not know this. It can know only addresses. And this conversion from name to address is done by adding the exports to softice, using the loader. And pray, how do you load it? You first need to find out in which dll, the func resides as an exported function. Then give the name of that dll in the export. And voila.

Have Phun
JohnnyBoy
09-13-2001, 06:11 AM
I have tried to load the keylib16.dll into SI. Cant see the functions inside SI.
I have tried to use the SI loader. Same result.
The keylib16.dll is a 16bit DLL. Is this why I cant load the dll?

I just wont to get a breakpoint inside the function pp_tcode to see what values the function is returning and change them to somthing that opens the software.

the software can be found at: h**p://www.performancetrends.com/programs/DyDM-w95.exe
Antipodean
09-13-2001, 06:30 AM
Are you trying to use softice on a 32 bit opsystem? If so, then it will not recognise the 16 bit DLL name when setting breakpoints as it considerers the app to be all running under a 16 bit VM.

If you are running on Win 3.x with a suitable version of SI, then I have no explanation.
JohnnyBoy
09-13-2001, 07:52 AM
Yes, I am running SI on Win98/second edition.

Ok! I have the knowlage abot what function I want to debug but I cant get the name as a bpx. I can see in w32dasm the adresses the functions have. Can I use this info to search for the call with an adress instead of a name and set a bpx on that adress?


How to find free space in the code section?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to find free space in the code section?
PDA

View Full Version : How to find free space in the code section?

cah
09-13-2001, 04:32 AM
How to find free space & lengthen of code segment in 16 bit windows executables? how to analyse. Are any tools/ utils available?

cah


How to use UCL HASP Emulator?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to use UCL HASP Emulator?
PDA

View Full Version : How to use UCL HASP Emulator?

cah
09-13-2001, 04:35 AM
How to use Ucl Hasp Emulator? If we know dongle data like Pass word 1 & 2, Hasp ID, Return codes etc..

Any one can help in this regard?

cah


OT: #Cracking4Newbies on IRC ?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > OT: #Cracking4Newbies on IRC ?!
PDA

View Full Version : OT: #Cracking4Newbies on IRC ?!

Hateman
09-13-2001, 10:07 AM
Sorry for the offtopic message.

If been out of biz for some years now but would like to see whats running today. But couldn't find the below channel anymore on IRC.

Does anyone know what happend to the C4N / Cracking4Newbies channel on IRC ?
Is there a comparable channel online today ?

Thanks for the help.

Be safe out there !
Tech
09-13-2001, 10:36 AM
Try one of the EFnet servers - #cracking4newbies
Hateman
09-14-2001, 03:31 AM
Thanks for the help Tech :)
Tech
09-14-2001, 02:20 PM
No problem :)


In Win2K how to defeat the anti-debug trick of ASProtect?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > In Win2K how to defeat the anti-debug trick of ASProtect?
PDA

View Full Version : In Win2K how to defeat the anti-debug trick of ASProtect?

Solomon
09-14-2001, 01:47 AM
In Win9x, with the aid of SuperBPM, IceDump, and FrogsICE, it is comparatively easy to bypass these tricks. Some tricks can be defeated manually using SoftICE/TRW2000.

But in Win2K, these tools don't work any more(I can't find the corresponding version of SoftICE to let it work with IceDump).

Recently I just want to go further on unpacking. Sure ASProtect is a good choice for practice;) I have the experience of manual-unpacking earlier versions of ASProtect. But it seems difficult to find the OEP of latest version because breakpoints seldom get hit.

I heard of the following anti-debug/anti-unpacking tricks may be used in ASProtect:
1. IDT check
2. clear debug register dr0~dr7
3. MeltICE
4. INT 3 backdoor of SoftICE
5. BPX detection
6. lots of SEH
7. CRC
8. polymorph
9. API hook & redirect & emulation
......
Some of the above are privileged operations, so they need administrator token in Win2K Server.

My question is:
How to bypass the anti-debug tricks in order to find the OEP? Is there a convenient way?
Yes this target has been talked about too much but I have no clue to find the OEP yet. And thank you for your guidance.
tsehp
09-14-2001, 07:05 PM
brand new emerging tool to do this :

the revirgin tracer, download and see the readme.

in summary, the rv tracer allows you to run the app and define like icedump's tracer some oep domains to freeze the app.

When you locate the oep, actually use procdump on the beta and it works, so you don't need anymore sice or another tool to be loaded.

my tracer actually have very small countermeasures against detecting it, but when some will appear, I'll code some countemeasures asap :cool:
+SplAj
09-16-2001, 04:50 AM
In the mean time.....;)

If you have the DriverStudio version of SI and have D/L that latest
NTICE.SYS for XP/2K from Compuware then I can tell you the offsets to patch in Nmtrans.dll / Ntice.sys / and Siwvid.sys as to hide your softice in Win2K ;)

Also to get to the OEiP for ASPR target in Win2K follow the Int2E about 21 times and your nearly there ;) I wont post here (yet) exactly the solution ;) cos RV will find the OEiP for you so Alexey
should not be concerned with a manual trick.

Also the problem I see from testing RV with the tracer is you HAVE to know what the f*ck you are doing with ASPR EiP tricks and one way is to follow the RET at the ASPR OEiP and see the 'higher' code (eg 550000) it rets to then set a trace between 401000 and that 550000.

Normally aspr dips a couple of times back into real code and sets a few redirection pointers , maybe Initializing some critical sections (greetz Nchanta) before finally being at the OEiP so you should LOG all those entries cos you will have to make a JMP patch to fix your dump as well as tracing the redirected code back to the original code and patching that as well.

I point you to w*w.glocksoft.com (AAAnalyzer 1.06 & EasyMailf as current ASPR targets) See the tricks :-)

have phun as usual :-)

+Spl/\j
Solomon
09-17-2001, 01:28 AM
Thank you +tsehp and +SplAj :D

Now I have all the SoftICE versions(got from w**.exetools.com), including DriverStudio v2.0, v2.01 and v2.5b2. And I downloaded the latest patch NTICE.SYS from Numega's site(http://www.compuware.com/products/numega/drivercentral/resources/whistler.htm).

INT 2E occurs too frequently coz many progs invoke this for sys service.
+SplAj
09-17-2001, 06:38 AM
Patching SI DriverStudio 2.x in Win2K/NT4
=========================================

(c)2001 SplAj

Objective :- To hide SI from lame detector code :-)

1) NTice class driver check(meltice)
2) BHCK boundschecker check
3) GF,MJ check
4) UnhandledException check
5) SIWVID class driver check
6) Int 1
7) Actual installation of SI in the registry.....
etc

Approach :- Understand the tricks/methods of detection
and trick them in return :-)

WARNING
=======
Patching system drivers like NTICE.SYS is VERY risky. Please
do not blame the MB or it's owners/admins for any PSOD that may
occur after patching (....looks purple on my Sony ) You patch and
play at your own risk ;) make sure you reset the CHECKSUM !!! - use LordePE.

I choose 'xTice' as the replacement for NTice. It can be any ascii ;)

A) NTICE.SYS (in sys/drivers)
=============================

(Latest update ICEBABY from compuware: 'ver'== DriverStudio tm 2.01 (build57)
file size 1,275,590 says 4.2.1 (build 58) in properties.)

patch the following offsets : (but LOOK 1st !)

1) 1FC63 : GF.......MJ to xF........xJ
2) 4869B : Kernel32!UnhandledEx..... to 32!xnhand
3) CE2C0 : Unicode N.T.i.c.e to x.T.i.c.e
4) CE2E4 : Unicode N.T.i.c.e to x.T.i.c.e
5) CE990 : Unicode N.T.i.c.e to x.T.i.c.e
6) CEC30 : B.c.h.k.d to x.c.h.k.d
7) D6150 : Ascii NTice to xTice

reset checksum ! and make a backup !

B) NMTRANS.DLL (in SI directory)
================================

1) patch the ASCII \\.\NTice to \\.\xTice
(MUST match the 'x' to same as NTICE patch)

C) SIWVID.SYS (in sys/drivers folder)
=====================================

2 patches:- Look for UNICODE \S.i.w.v.....
and replace with \.x.i.w.v.......

reset checksum ! and make a backup !

REBOOT and check for the presence of SI with 'detect.exe'
included as a zip attachment.

+Spl/\j
(c)2001
+SplAj
09-17-2001, 06:42 AM
the attachment ..........
Solomon
09-17-2001, 10:24 PM
:) That's great!
The unicode string "\\.\Siwvid" in NTICE.SYS also need to be changed, or SoftICE window will not pop up:)

After the above modification, SoftICE can be detected only by int 1.

Many Thanks!

BTW:
I got many errors(runtime access violation error) when running the dumped G-lock EasyMail v3.22 build 100. Don't know why.:confused:

I took the following steps to dump it:

1. Find the OEP manually(OEP = 006EAFC0):
xxxxxxxxx: POPAD
015b4283: JMP EAX

2. change the JMP EAX to JMP EIP, then use ProcDump to make a full dump, with the following options checked:
Recompute object size
Optimize PE structure
Use actual import infos

3. Use "Import REConstructor 1.2 Final" to resolve the import functions and paste the new IT into the dumped exe. Only 5 functions have to be manually resolved:
2F5280: GetCommandLineA
2F541C: (use GetModuleHandleA to emulate RET 4)
2F5488: GetVersion
2F54FC: GetCurrentProcessId
2F550C: (Use SetLastError to emulate RET 4)

4. Change the EntryPoint of the dumped exe to 2EAFC0(6EAFC0).

then run it,but too many runtime errors:( What's wrong with what I did?:confused:

Sorry for so many questions/requests;)
+SplAj
09-18-2001, 01:34 AM
Solomon

great work to find that last code before JMP EAX .... I so enjoy that in Win2K. More satisfying than waiting 30 mins for Icedump to do everything ;)

Please use RV now in Win2K, Tsehp worked VERY hard to bring us the tracer and API emulator. Works great :-)
For any RET004 use LockResourse API , this is the correct one. Anything else will corrupt the stack (plain ret) or EAX has a new value or worse 0 !!!

RV is auto coded to paste LockResource ;)..............

I unpacked and fixed EasyMail3.22 in 15mins under Win2K + RV. Thats 4x as fast as usual than in Win98/ME.

I enclose my RV resolved.txt and IAT to paste at 0x3FD000

Also patch those bytes at offset 0x2C7068 ..4E 4F 54 20 etc
with an hex '0D' then any name you like to replace the rest of text 'OT REGISTERED'.. like +Spl/\j :2001 - fits perfect :D

Also try LordPE to dump...........

+Spl/\j
tsehp
09-18-2001, 04:53 AM
the api emulator works now on win98, oep are also very easy to find using rv's tracer on win 2k, read the manual.
I usually choose eip stop domain 400000 until 600000 and press "until back" all the time, until the listing shows the usal
push ebp
... without any rets in proximity.

then you dump with procdump (rv's new function pretty soon I promise)

only a very small problem resides, aspr just tests sometimes for the iat tracer to have arguments, like a call to an api function, so that's why some getprocaddresses are not found and the tracer lands into nowhere, actually enter the api address manually and I also soon fix this.

another target from glocksoft, awaiting better....

analyser.exe has some tests to detect if aspr is present or not.
first dump and resolve with rv, the last entry that is not found by api emulator doesn't work with the tracer (soon :D ) but you can enter address of getprocaddress

then dump with rv + procdump oep is 504154
empty all the bytes around 508430 , it's still the mem alloc trick, first discovered by splaj on wswatch

you've got a redirected call by aspr here :

seg000:00504170 change this
seg000:00504170 ; was redirected into aspr to reach 503cec
seg000:00504170 call sub_503CEC
seg000:00504175 nop

and finally remove the nag here :

1
seg000:00447CD1 change this
seg000:00447CD1 mov eax, 2
seg000:00447CD6 nop
seg000:00447CD7 test eax, eax

included is the usual it.bin + rv resolved import's text file.

does someone has the new aspr sdk ? I'll be interested to see how it is asked to include such tests inside the target.

regards,
Solomon
09-18-2001, 08:59 AM
I learned a lot from this post and successfully unpacked several asprotected progs with RV. Thank you masters

BTW:
some data for Advanced Administrative Tools v4.31 build 720
OEP = 0061A598
RVA of IAT = 2221E0, length = A34
one redirected call:
CS:0061A5B4 call [0061EE4C] ===> call 00619B7C
exit_2
09-25-2001, 04:03 AM
What SuperBPM does in Win9x, tries NTdump's (part of NTiceSET) "Preserve BPM" to do in NT.
Uradox
12-18-2002, 12:10 PM
A small post much later :)

I did the patching required to hide ntice DS 2.7, sice window wouldnt show when requested. Found some patches that did the same thing as posted here - they did the same.
Just curious if this is a common problem?
JMI
12-18-2002, 05:35 PM
Uradox:

One can assume that you have made a patch in the wrong place. Did you try the patch posted by nikolatesla20 in the Tools of the Trade Forum here on 10-23-02, titled: "Driver Studio *2.7* anti detect patches" It works fine on my Win2k Sp3. We have not had reports here of anyone losing the SI window after using that patch.

If you used the exact addresses shown in the Solomon thread it is extremely unlikely that they would work because that was a discussion of "'ver'== DriverStudio tm 2.01 (build57) file size 1,275,590 says 4.2.1 (build 58) in properties.)" +Spl/\j cautioned to "Check first" for the proper addresses. Did you "check"???

Try reloading SI and try nikolatesla20's patch.

Regards.
Uradox
12-20-2002, 08:50 AM
Ah yes my stupidity for not checking offsets :)
Sorry


SI, VB and a 16bit DLL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI, VB and a 16bit DLL
PDA

View Full Version : SI, VB and a 16bit DLL

JohnnyBoy
09-14-2001, 06:25 AM
Working on a software from:
h**p://www.performancetrends.com/programs/DyDM-w95.exe

The software is written in VB3 and protected by a 16bit DLL called keylib16.dll.

I have found out that the function pp_tcode returns a value that opens upp the software.

I have tried to load the dll in winice.dat but I cant set a breakpoint at the function inside the DLL.

The symbol loader tells that there is no debug info.
Is there another way that I can produce a NMS file for the 16-bit DLL?


HELP: Error translating debug symbols...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > HELP: Error translating debug symbols...
PDA

View Full Version : HELP: Error translating debug symbols...

DGR
09-14-2001, 07:01 AM
Hi all,

I'm running WindowsXP final and have gotten the debug symbols for it... they are all .pdb files. Now when I try translating them through softice symbol loader I get the message:

Error: No debug information found

Is there a way to translate them without .dbg files? Or am I pretty much screwed : / I really hoped that these symbol files would do the trick.
Andox
09-15-2001, 06:32 AM
Hi
i got the exactly same problem.

does rebase.exe work for you? it should be able to retrieval the debug info from ntoskrnl.exe but it does not work for me.

(Rebase.exe -b 0x400000 -x . ntoskrnl.exe)
DGR
09-26-2001, 04:01 AM
Tried that too, but without luck :/

Guess were pretty much screwed for now.


telock 0.90
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > telock 0.90
PDA

View Full Version : telock 0.90

telexxingou
09-14-2001, 10:42 AM
please, someone know if an unpacker for telock0.90 exist ?
i really need it :(

very thanks for your help

Byebye
+SplAj
09-16-2001, 04:25 AM
Hajo

Best unpacking tool is BRAIN :-)

Other tools to assist:-

SI
Icedump
LordPE
RV

TE! tricks - anti SI, Anti dump (section count =FFFF and IAT is mapped, relocated then destroyed)

Solution :-
========
Load target in SI (after running Icedump)
BPX VirtualProtectEx
F5
F12
S CS:EIP L EIP+100 EB,02,CD,20,61
Set a BPX on the memory were the 61 (POPAD) is. F5
Press F8 carefully cos your nearly at the OEiP ;)

At OEiP change bytes from 55 8B to EB FE (loop)
Use LordPE to dump (with load section header from disk on to solve the section count FFFF trick)

Then use RV to rebuild the IAT/IT (or stop TE from destroying the
IAT/IT once you know the VA offset)

Fix up your dump (OEiP pointer, EB FE -> 55 8B, IAT pointer etc)
and TE! is gone :-)

+Spl/\j
nchanta
09-16-2001, 06:47 AM
hola unpax0r king ;)

thanks for the compressed telock essay, will come in handy ;)

your student...

NchantA
telexxingou
09-19-2001, 07:21 AM
very thanks for your help :)

do you have url for BRAIN ?
Icedump is working with Win2k ?

thanks
byebye
+SplAj
09-19-2001, 08:09 AM
http://www.vh.org/Providers/Textbooks/BrainAnatomy/BrainAnatomy.html

:D
telexxingou
09-19-2001, 08:27 AM
LOL :)
sorry my english is very not perfect !!!

maybe Brain is near my head, isn't it ? ahahahaha
Thanks :)
+SplAj
09-19-2001, 09:17 AM
Near your head....
---------------------
yes you are getting warmer .... roll your eyes upwards :cool:

Ok one last thing about tE!lock is the 'Mutex' feature which MOST programmers have not a clue and think it is a Teletext alternative to find cheap holidays.....

But some are clever enough to implement this in the tE! packed ( protected :confused: ) exe.

To bypass this feature (if the programmer took Egoiste advice)
is to set BPX CreateMutexA and see if a check is made on existence of tE!lock code. Usually they give a big clue by giving easy name like 'my_Mutex_check' duh. A simple JMP instead of JE is all that is required - Maybe tE! codes some encrypt/decrypt code soon around his mutex ? :confused:

Hope that helps some more. You can see this feature in the target Iris 3.x from eEye.com - search for my oh um 'super tut' on the MB describing tE! unpacking and Sheriff Licence butt fucking in Iris 3 a couple of months ago.... ppl here have such short memories :D

+Spl/\j
telexxingou
09-19-2001, 11:17 AM
really thanks :)

My level on packed/crypted exe is very low :(
now i'm begin with your help :)

thanks
byebye
SpeKKeL
09-19-2001, 12:29 PM
Just watch that api's that contain a "0"-dword and delete them .

just try on a te-locked notepad !!

Spek.
Bengaly
09-23-2001, 01:13 AM
heya +P ;D

just wanted to say hi ;D
i love +reversers i am contacting everybody i can
till now:
+Sandman
+Tsehp

and now you ? :D


Revirgin 1.2 beta just released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin 1.2 beta just released
PDA

View Full Version : Revirgin 1.2 beta just released

tsehp
09-14-2001, 06:58 PM
1.2 beta
The tracer is entirely redesigned, and a device driver has been added to support win2k + future xp.
A function ‘api emulator’ is added, it resolve asprotect’s small api emulation, like getcommandlineA or getProcessId for example, use them after a resolve again or unsuccessfull tracing.

A tracer is added, it’s provided to help you find the target’s oep and dump the app (using procdump actually)

see the readme.doc for details

The install is now on a msi, done on a cracked wise installer but uncomplete, so you'll have to bear the evaluation messages when you install it for a little time.

beta available at tsehp.cjb.net

regards,

tsehp
Js
09-15-2001, 04:55 AM
Hiya tsehp,
Sounds good. Do I need a tracer to find where to get it from?;)
regards
tsehp
09-15-2001, 06:21 AM
Originally posted by Js
Hiya tsehp,
Sounds good. Do I need a tracer to find where to get it from?;)
regards

he he ! at usual place : tsehp.cjb.net on the main page !
SpeKKeL
09-16-2001, 02:18 PM
Don't know if i'am the only one but
using the api/emulator revirgin crashes..
Tried several times on aiswpp.exe as you explained
but it keeps going wrong when i use this option.
Have reinstalled and throwed away urlier versions of
thread and tracer.dll.
Using w98 (first ed.)With or without icedump running.
I didn't got any error messages, revirgin freezes......brrrr.

Just to inform you and to get some response from other
users...

Spekkel

;)
tsehp
09-16-2001, 05:42 PM
Originally posted by SpeKKeL
Don't know if i'am the only one but
using the api/emulator revirgin crashes..
Tried several times on aiswpp.exe as you explained
but it keeps going wrong when i use this option.
Have reinstalled and throwed away urlier versions of
thread and tracer.dll.
Using w98 (first ed.)With or without icedump running.
I didn't got any error messages, revirgin freezes......brrrr.

Just to inform you and to get some response from other
users...

Spekkel

;)

ok, give me more details :
aiswpp : what iat did you tried with the api emulator

w98 : don't have it but only win_me, it freezes when ? when loading when resolving ?
SpeKKeL
09-17-2001, 02:04 AM
Ok,

tried with : oep 51a59c
start 124190
length 7b8

After iat-resolver and resolve again there are 7 entries open:

170c548 red/emul.
170c90c red/emul.
170c960 (no comment)
170c968 (no comment)
170c928 (no comment)
170c958 (no comment)
170c974 (no comment)

Now when i choose one of them (doesn't matter which one)
right-click and try api-emul revirgin freezes.. :confused:

Spekkel
SpeKKeL
09-17-2001, 02:22 AM
BTw when i use the option trace, only the redirected (get command linea, getcurrentprocessid, etc) 5 entries are still left.

Spek
tsehp
09-17-2001, 02:17 PM
thanks spekkel,

download the new msi now, it's fixed. It was only a problem when the tracer was unloading itself from main target.

The 5 entries left are emulated api's.

try them, you can all select them and do at once.

regards
SpeKKeL
09-18-2001, 09:00 AM
Okeeee

All goes well, no more freezing allllll resolved !

Thanks ....Spekkel ;)
tsehp
09-18-2001, 03:49 PM
keep looking for the build versions now...

the goal is to add now some dumping features on the tracer, and also to prevent some alexey tricks, I'll give more details if you email me:D

actually no known targets resisted to this new beta, the goal is to find one... (what a self sufficient lamer I am... :p )


Revirgin 1.2 beta just released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Revirgin 1.2 beta just released
PDA

View Full Version : Revirgin 1.2 beta just released

tsehp
09-14-2001, 06:59 PM
1.2 beta
The tracer is entirely redesigned, and a device driver has been added to support win2k + future xp.
A function ‘api emulator’ is added, it resolve asprotect’s small api emulation, like getcommandlineA or getProcessId for example, use them after a resolve again or unsuccessfull tracing.

A tracer is added, it’s provided to help you find the target’s oep and dump the app (using procdump actually)

see the readme.doc for details

The install is now on a msi, done on a cracked wise installer but uncomplete, so you'll have to bear the evaluation messages when you install it for a little time.

The thread will only be followed on rce general forum.
tia;

tsehp


How to find HASP Envelope & reverse it?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to find HASP Envelope & reverse it?
PDA

View Full Version : How to find HASP Envelope & reverse it?

cah
09-14-2001, 10:48 PM
How to find hasp envelope & reverse it ? Are any tools/utils to available to reverse hasp envelope?

Is any tutor can help me?

cah...


serial of sharewares
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > serial of sharewares
PDA

View Full Version : serial of sharewares

Felipito
09-15-2001, 11:32 AM
hi,
i wan´t to know how can I make out the serial of sharewares with the help of softice, when I don´t know how long is the serial....I see some sharewares with serials very long (CloneCD).
Thanks and Sorry if the question is to easy, but I´m a newbie!!!
Felipito
Tech
09-15-2001, 03:10 PM
Your question is a bit confusing so this might not be the answer you want, but basically most programs have different forms of protection, it's not the same for all programs. Some programs like you say require you to enter a serial number of the correct length, you basically have to find the protection first and then examine it to see where it checks if your serial number length is correct. Take some beginner cracking tutorials and you'll get the idea...


How to decrypt files with newer cd-cops 32 copy protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to decrypt files with newer cd-cops 32 copy protection
PDA

View Full Version : How to decrypt files with newer cd-cops 32 copy protection

speed123
09-15-2001, 01:12 PM
Hallo,

who can help me decrypting files protected with newer cd-cops 32 copy protection.

The old mcLallos decrypter (http://www.gamecopyworld.com) no longer works / crashes with a page-fault.

Company Homepage: http://www.linkdata.com/cdcops.htm


Getting a Process's Address map?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Getting a Process's Address map?
PDA

View Full Version : Getting a Process's Address map?

Lutrosis
09-15-2001, 08:29 PM
I'm writing a little app that will scan the area in memory where the text displayed in the console of a particular game is stored, looking for text that it can interpret as commands; in other words, I'll run this app, and then the game, and the app will moniter the section of memory where the console is stored looking for commands that I've typed into the console.

It's a simple enough idea, I've already written code to find the start of the console, along with code to read commands. But I'm not happy with it - rather than starting the search at the beginning of the program's address space, I have to start it at a hard-coded address. It works - since the memory is allocated just after the program starts up, it's usually in just about the same spot, but I don't like hard-coding memory addresses.

How would I get the Address map of the process so that I'd know which areas of memory are readable, allowing me to scan *all* of the process's readable memory?

I know it can be done without too much trouble, I have a program that does it, among other things. I've checked the program's dependencies and can't find an API call that looks like it would do the job.

I have a feeling this post belongs in the newbie forum, as I'm hoping it's a simple answer. Anybody able to throw some hints at me as to where to start looking?
Kayaker
09-16-2001, 02:07 AM
Hi Lutrosis

Interesting question, what are you using the app for, as a game trainer? Will you be patching a memory location, or are you just monitoring the text commands for some other reason?

I'm not sure exactly what it is you're trying to do. If you're trying to scan memory paged out by a program on initialization I'd think you'd have to code a vxd to have access to the addresses. If your own app loads the program in question you could inject a dll to have access to the processes address space as if it was its own.

If you are typing commands in on a console, could you not create a patch, either in the file or in memory, to monitor the variable that holds the keyboard input say, rather than doing an overall memory scan for a particular sequence of bytes?

If the variable holding your text command is passed to a call, maybe to a routine which scans the ascii bytes or somthing, you can probably reference it to the stack frame pointer EBP. To get the values of the local variables or of the passed parameters of a call, you can reference EBP, i.e.:

mov eax, [ebp-4] ;copy local variable 1 into eax
mov ebx, [ebp+8] ;copy passed parameter 1 into ebx

If you find such a location in the program code you could patch it to intercept the address and make any changes to it you want. Even if the address isn't used implicitly in a call you still might find it sitting somewhere on the stack unchanged and can reference it there. There may be other ways to intercept the console text as well such as hooking keyboard input.

What is the program you mention that does what it is you are trying emulate? That might help answer the question.

Cheers,
Kayaker
Lutrosis
09-16-2001, 12:00 PM
Thanks for the reply =) Actually yes, it is a game trainer of sorts that I'm working on. I've been playing around with a program called Game Trainer, and it has me intrigued. A good way to get some more replay value out of older titles, if you ask me.

But having to alt-tab in and out of a game to search for various values in memory is a pain, especially on some less-than-stable games that like to crash occasionally when you do that. So I figured, why not write a similar program that takes its commands from the game's console? Unfortunately, I don't have all that good an idea of what I'm doing yet. I've dabbled in cracking for the past week or two (for the intellectual challenge - I remove the software when I've cracked it), and while I can crack simple protection schemes and get the general idea of what's going on from the asm (enough to write a keygen for the last app I worked with), I'm still a beginner.

Basically, I want to know how GameTrainer does what it does - generate a map of a process's address space so that it knows which memory locations are readable and which aren't. Finding the console is easy, because it's always found in the same section of memory somewhere, and that section of memory always starts at the same address. But in order to emulate the program's functionality, I need to be able to search *all* of a process's readable memory for a specific value.

I've decided to change my approach somewhat. Rather than re-invent the wheel here and mirror the functionality, I'm just going to have my program act as an interface for GameTrainer. It will moniter the console for commands, and then have GameTrainer execute those commands, writing the results back into the console when necessary.

All the same, I'd like to know how one would go about generating the address map of a process's memory. I'm considering e-mailing GameTrainer's author to ask for a hint that would get me started.
Kayaker
09-16-2001, 05:39 PM
Hi Lutrosis

I had a quick look at Game Trainer. It generates a map of a process's address space by using information returned from VirtualQueryEx.

VirtualQueryEx function provides information about a range of pages within the virtual address space of a specified process.

DWORD VirtualQueryEx(

HANDLE hProcess, // handle of process
LPCVOID lpAddress, // address of region
PMEMORY_BASIC_INFORMATION lpBuffer, // address of information buffer
DWORD dwLength // size of buffer

OpenProcess is used to get the handle of the process for the call, and the address pointed to by the 3rd parameter is a MEMORY_BASIC_INFORMATION structure which is filled when the call returns.

The MEMORY_BASIC_INFORMATION structure contains information about a range of pages in the virtual address space of a process. The VirtualQuery and VirtualQueryEx functions use this structure.

typedef struct _MEMORY_BASIC_INFORMATION { // mbi
PVOID BaseAddress; // base address of region
PVOID AllocationBase; // allocation base address
DWORD AllocationProtect; // initial access protection
DWORD RegionSize; // size, in bytes, of region
DWORD State; // committed, reserved, free
DWORD Protect; // current access protection
DWORD Type; // type of pages

The program also uses the Toolhelp32Snapshot series of API's (there's 12 of these, undocumented in the Win32API reference, get updated info from MS) to scan for active processes.

If you set a breakpoint on VirtualQueryEx here and display EDX (the MEMORY_BASIC_INFORMATION structure) in the data window you'll see the address, state and protection of each memory region being processed by the call. The data is then printed out by the program with wsprintfA.

0167:00401C58 6A1C PUSH 1C
0167:00401C5A 52 PUSH EDX
0167:00401C5B 89442424 MOV [ESP+24],EAX
0167:00401C5F 50 PUSH EAX
0167:00401C60 A188204100 MOV EAX,[00412088]
0167:00401C65 50 PUSH EAX
0167:00401C66 FF1514624600 CALL [KERNEL32!VirtualQueryEx]

After each call the BaseAddress is added to the RegionSize (retrieved from the MEMORY_BASIC_INFORMATION structure) and this new address is used as the lpAddress of the next VirtualQueryEx call, so it sort of steps through each memory region this way and writes out the information from the MBI structure.

This is actually a nice example of a memory mapper routine using VirtualQueryEx. Hope this helps some.

Kayaker
Lutrosis
09-16-2001, 11:13 PM
Many thanks ;) I actually did check out the Toolhelp32Snapshot functions when I saw them listed in the disassembly, and I tucked the knowledge away for future use, though for my particular program I'm using FindWindow/GetWindowThreadProcessId, as I'm only going to support a few games (if that many - depends on how long this project keeps my interest ;) ). I'm fairly disappointed in myself for not finding that function immediately, but that's what the forums are for I suppose. Thanks again!


2 hours program limit, how to catch that?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 2 hours program limit, how to catch that?
PDA

View Full Version : 2 hours program limit, how to catch that?

nop-erator
09-16-2001, 04:43 AM
hi,
i've downloaded some programs (www.crocodile-clips.com) that have a program usage limit of two hours. I already tried GetSystemTime and stuff like that, but I don't know exactly how to go on. Perhaps someone of you could help me?

bye,
NOP-erator
Tech
09-16-2001, 06:44 AM
wow what a coinsidence, I download this a few days ago so I can do my electronics coursework. I am too now trying to crack it so I can finish my work. I'll let you know if I find anything
nop-erator
09-16-2001, 07:09 AM
hey,
that would be cool! thank you in advance!

bye,
NOP-erator
Bengaly
09-16-2001, 07:59 AM
Heya..
well, u can try several stuff to try and find where the check is actually made..
try to move clock forware [after 2 hours]...than probably the program will have a check and exit, or tell ya a message...write that message...
open 32dasm and search the string..if u find it than what u can try is to find where the check is.
i.e: cmp xxx, 2D0 (2D0 = 720minutes = 2 hours)
if u find it that u can increase the time, or nop [which not required] or try to fine a un/conditional jump and change it to "Jmp"..

thnx
Bengaly :)
Tech
09-16-2001, 10:14 AM
Originally posted by Bengaly
(2D0 = 720minutes = 2 hours)
arn't there 120 mins in 2 hours ;)
nop-erator
09-16-2001, 11:43 AM
hi,
i think that i found something out: if you delete the .ini file in the same directory, the program comes up with "error with time validation security". after changing some jumps i could "delete" that message, but the program is still expired and i can't find the correct jump. from this memory address: 423B74 is started to remove all the jumps that jump to 4240CC. then at 423C68 i noped the jump out. after that, as i said, the time error message didn't appear anymore. but the program still shows that it is expired. please help!

thanks,
NOP-erator
Bengaly
09-16-2001, 02:01 PM
About my latest Post...
heheh i haven't notices, sorry..
what i was thinking about 720 :/

anyway u got the idea 78h = 120dec :-)

sorry for bad post :]
Solomon
09-17-2001, 01:24 AM
try the following breakpoints after accelerating the clock:
KillTimer(or SetTimer)
GetTickCount:D
Tech
09-17-2001, 04:26 PM
Argh this is really annoying me I can't seem to crack this program. I managed to remove the nag but then all the functions were disabled so I couldn't add any components to my circut. Could someone please help me as I really want to crack this program... you can download it from http://www.crocodile-clips.com/m6_1_3A.htm
Solomon
09-18-2001, 02:49 AM
Just delete the following to re-enable 2-hour trial time:

1. HKEY_LOCAL_MACHINE\SOFTWARE\StubPriv
2. File "croctech.ini"

You can write a loader to do this every time before launching its main exe.
nop-erator
09-18-2001, 10:26 AM
tech, i had the same problem. i managed it to remove the nag and "time violation" stuff, but it was still expired. sh*t!

this registry key deleting and croc.ini deleting stuff doesn't work for me

NOP-erator
Tech
09-18-2001, 11:30 AM
whats a loader? Oh and deleting the ini + the reg thing does work for me... nop-erator, if you tried to install crooctech again make sure you delete any instances of croctech.ini. Oh and solomon how did you work that out ? Thanks by the way :D
Solomon
09-18-2001, 09:10 PM
nop-erator said that INI file caused "error with time validation security" message, so I use CreateFileA & ReadFile to watch how it checks this INI file. During this trace I found some interesting strings(registry key names):D The algorithm dealing with the INI file is boring, I don't want to waste my time to figure it out;)
DakienDX
09-22-2001, 06:14 AM
Hello erverybody !

I downloaded the files to, just for fun. It wasn't that hard to find the right memory locations.
Since I don't want to present you a readymade patch, I'll give you just one clue.

Try searching for "Cmp ESI, 0EE6B2800h". ESI will contain the number of secounds left divided by six. (every 6 secounds this will decrease by 1).

You should freeze the counter. ;) Good luck. :)

(Btw.: This works in Technology, Chemistry and Physics)


Reversing a algorithm: 4 bytes read - 8 bytes written
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing a algorithm: 4 bytes read - 8 bytes written
PDA

View Full Version : Reversing a algorithm: 4 bytes read - 8 bytes written

DakienDX
09-16-2001, 05:32 AM
Hello anybody !

New messageboard, new reversing problems...
Well, we need to register now. Why not?

I've a little problem. I want to reverse an encryption algorithm, but don't know how this should be done in this chase. I've a feeling that it's an easy one, but my mind is out of order for this algo. I've tried two days to reverse it, but without any results.
Below is the decryption loop. The first 8 bytes of the encrypted data are unencrypted. They're used as start values for the other data blocks in a kind of CBC mode. My problem is: Only 4 bytes are read, but 8 bytes are written. In reversing, I should look like this

Mov EAX, [ESI]
Mov EDX, [ESI+4]
Xor EAX, [ESI+4] ; I don't know the old values
Xor EAX, [ESI] ; as above

But I don't have the old values of the memory locations.
Here's the Decryption Loop:

Mov ESI, CryptedData
Mov EDI, LengthOfCryptedData
Shr EDI, 3
Crypt1:
Mov EBX, [ESI+4]
Add EBX, [32BitPassword]
Xor EBX, [ESI]
Add ESI, 8
Mov ECX, 0Eh
Crypt2:
Mov EAX, [ESI]
Mov EDX, EAX
Ror EBX, 4
Xor EAX, EBX
Add EAX, 0A235832Ch
Add EAX, ECX
Rol EAX, CL
Sub EAX, EBX
Xor EAX, [ESI]
Xor EAX, [ESI+4]
Mov [ESI+4], EDX
Mov [ESI], EAX
Dec ECX
Dec ECX
Jnl Crypt2
Dec EDI
Jne Crypt1

I would be thankfull if somebody could give me a clue.
DakienDX
09-18-2001, 12:39 PM
Hello everbody !

Seems I'm not the only one who has trouble with this algorithm. Or is it just to easy for your?

Well, to make it easier, here's a pseudo-code listing in chase you don't understand my ASM :)

C = 1
PW = (DATA[C+1]+PASSWORD) XOR DATA[C]
1:
C = C+2
L = 0Eh
2:
X = DATA[C]
Y = DATA[C]
PW = ROR(PW, 4)
X = (X XOR PW) + A235832Ch + L
X = ROL(X, L)
X = X - PW
X = X XOR DATA[C] XOR DATA[C+1]
DATA[C+1] = Y
DATA[C] = X
L = L-2
REPEAT UNTIL (L < 0) 2:
REPEAT UNTIL ENDOFDATA 1:
DakienDX
09-18-2001, 03:05 PM
Hello Fake51 !

The target is HL-Server. The decryption algorithm is the one used in the target. I want to add some more network executions to HL-Server.
Well, my problem is not unpacking the target but repacking it. (Since I've already patched it!)
Because of this I'm trying to reverse the algorithm, since I want to add 2 patches to the protected version. I know the CBC-like code might make some trouble, but my first goal is to reverse it.
mike
09-18-2001, 04:48 PM
What's your goal? Do you want to recover the 32-bit password?
DakienDX
09-19-2001, 10:59 AM
Hello mike !

I don't want to recover the password. I have all passwords. (each PE-section is encrypted with it's own)
As I've written I want to repack the target to see which bytes have changed from the old one to the patched one.
Because of this I need to have the reversed algorithm to re-encrypt it.
This is no stream algorithm, it's a block algorithm, this means you have one proc for encrypting and one for decrypting.
mike
09-19-2001, 12:48 PM
OK, the code is a Feistel cipher with 14 rounds (L in your pseudocode).

A feistel cipher works like this:

Split data into two halves, A and B

FOR R = 0 TO L
SWAP (A,B)
B = B XOR F (A, R PASSWORD)
NEXT R

Note that the code you posted goes the other way (this is the inner loop):

FOR R = L TO 0
B = B XOR F (A, R, PASSWORD)
SWAP (A,B)
NEXT R

Rewrite the decryption code you posted like this and it'll be a snap to change it into the encryption code.
mike
09-19-2001, 01:01 PM
By the way, F in the code above is this:

F (A, R, PW) =

(ROR(A XOR PW + A23532Ch + R, R) - PW) XOR A

You have to also toss in those extra instructions for maniplulating PW (the initialization before and the rotates during) before calculating F.

So the whole thing looks like this

PW = (B + PASSWORD) XOR A
For R = 0 to L
SWAP(A,B)
PW = ROR(PW,4)
B=B XOR F(A,R,PW)
NEXT R
DakienDX
09-19-2001, 02:19 PM
Hello mike !

I'm going to test the code. I've searched about 70 different crypting algorithms for this code, but like fate is, I haven't found it.

It looks like a cipher with 8 rounds to me. It starts at 14, decrements each round by 2 and ends at -2. Is this right or have I understood something wrong?

Is Feistel one special algorithm or just a name for a group of similar ones?
mike
09-19-2001, 07:52 PM
You're right, it's an 8-round cipher. Sorry about that. You won't find it described anywhere because it's insecure. Differential cryptanalysis would make short work of this. Feistel ciphers are a class of ciphers. DES is probably the most famous Feistel cipher; Blowfish is another. Any cipher that splits the block into halves, xors a function of one half into the other & swaps halves is a Feistel cipher. They make them that way because they're trivially reversible.
DakienDX
09-20-2001, 01:27 PM
Hello mike !

Thanks to you the code works now.
My problem was that I hadn't realised the SWAP(A, B) code and put it in the first line in encryption and decryption. :( So it had to fail.

Thanks again :)


some new tricks from bi-tarts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > some new tricks from bi-tarts
PDA

View Full Version : some new tricks from bi-tarts

tsehp
09-16-2001, 06:32 PM
hiya,
just tried my new tracer (from revirgin beta) on fusion v2, from www.bit-arts.com

traced until 401000 , dumpd with procdump on win2k (I'll add the dump feature pretty soon, promised) , rebuilded iats without problems
begin 24b108 len e0c , you'll have to correct a little what the auto finder gave:(

rv inserted the new it into the dump, changed the oep to 401000,then problems :

I just think that like aspr, fearing the iat's protection system annihilation, they are forcing more and more apps to rely on tests for protection shell present or not, we already saw a lot of bunch of mem allocated by aspr and tested later by the target, with the consequences you can imagine if you don't "fix" this into your dump.

But bi-tarts found another trick , checking the pe with encrypted values (xored :) ) into the protection section of your dump, here are some addresses just for you to play and discover :
all in va's :
6d1002 : 0d (not encrypted) designed to check for num of sections, but if you make rv work, the dump will contain 0e sections, so change this value

4ee55f (xored with e5) contains old oep rva = 2d1000 change to 001000 to have the normal 401000 oep check

the others if you're lazy: 64a04f (xored a0) ; 6bcf2c (xored ce) ;
6cd041 (xored d0) ; 6cd38e (xored d3) and 6cd45c (xored d4),
finally check at 6d1004 change to ed5f1 , this value is tested with the ed5f1 contained into pe.

So more and more checks for protection shell into the main programs, I would be very interested how in aspr and in other schemes, they provide some sdk or guidelines for programmers to include such checks into their code, anyone have the sources ?
(very indirect warez requests from me again, soon to be auto banned of my forum, I promise ;)

hey, look at what's provided on their site, concerning their protection system :

***
After spending three days attempting to bypass the copy-protection features, we were unable to use the evaluation application in an unauthorized manner".

E-testing labs (ZD Labs)
***

pray for them, be a nice guy

:rolleyes:
nchanta
09-17-2001, 12:19 AM
bi-tarts have actually coded something usefull? ;)

i find it hard to believe tsehp hehe...

unless bi-tarts fusion just jams in checks willy-nilly, then there must be user called API that does these silly checks. maybe they stole the idea from asprotect... ;P

what program were u unpacking tsehp?

NchantA
______________________________

Gravity was invented by Issac Walton. It is chiefly noticeable in the autumn when the apples are falling off the trees.
tsehp
09-17-2001, 01:45 AM
no no, believe me, this time they really managed to find something new :

download www.bit-arts.com fusion v2 latest, and dump + rebuild with the info I provided.

The checks are not some mem checks like aspr does actually to see if protection is still there, but only some checks inside the pe-header :
1-num of sections
2-oep
3- last value I found, didn't look any further.

contact me if you want the dump + rv files, I'll mail them (too big for here)
+SplAj
09-17-2001, 04:17 AM
hmmm saw these same tricks in Titaniumv2 , IntallCrap, Digicrap etc etc when I rebuilt them in July for a competitor of theirs ;)

greetz Kop....... :-)

What tsehp describes is familiar...

xor the checking code with 1 byte.. used a calculator to fix that one ;) ....Overwite memory if OEiP and/or 1st section length are incorrect... the fixed values are stored for comparison in the exe so just change them as required ;)

Pretty lame duh.... also the stupid red 'Evaluation' box takes 5 seconds to bypass......

Did not mention the *new* tricks here cos nobody gives a shit about these big headed tranny braggers.....

Seems that checking the OEiP pointer is now becoming a standard anti dump policy. Thats one of the checks in lame aiswpp.exe (401000 = AX register = 1000 but real oeip 51a59c so error ! OEiP stored in the PE header offset 0x128)


Hasp4 dumped, next what ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp4 dumped, next what ?
PDA

View Full Version : Hasp4 dumped, next what ?

malkocoglu
09-17-2001, 03:27 AM
I have 4 executables enveloped with Hasp4
I also got the dongle for them
I dumped all of them by both IczDump
and ATM's dump command...
I also used pesplit/pejoin tools...

Of course the dumped executables dont work without polishing
I have these sections on one of the executables

.text
.rdata
.data
.rsrc
.tls
._textlh
._hext_ha
.protect

I kill the ._textlh , ._text_ha and .protect
I found the OEP and fixed the PE header bu i still cannot run them
When i dissassemble the EXE dumped by ATM
The EXE seems OK except the Entrypoint
I can see the functions EXE calls clearly
And the Flags for the .text is OK
I think I have a problem with the imports section
Cause when i run the EXE, it dies somewhere in 157:BFFxxxxxxx..
But i dont know what to do next...
Any suggestions, starting point, tutorial ?

Thanks in advance...
Malkocoglu...


How to find free space in the code section?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to find free space in the code section?
PDA

View Full Version : How to find free space in the code section?

cah
09-17-2001, 04:08 AM
How to find free space & lengthen in the code segment of NE files? Any tools to find this & analyze?

Any tutor will help me?

cah...


Just wanna say hi!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Just wanna say hi!
PDA

View Full Version : Just wanna say hi!

cTT
09-17-2001, 04:59 AM
Hello all...

I just drop this note to say hi to everyone ... some of you know me ... some don't.

Hi to everyone anyway and it's looking good this MB :D

Best regards...
decx
09-17-2001, 05:03 AM
Long time no see, cTT :)
cTT
09-18-2001, 01:49 AM
Originally posted by decx
Long time no see, cTT :)

So you can say! Whats up decx? Still on irc? :p


What's wrong with the Message Board
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What's wrong with the Message Board
PDA

View Full Version : What's wrong with the Message Board

DakienDX
09-17-2001, 03:09 PM
Hello Everybody !

Something seems to be wrong with the Message Board !
I can't access the Tools of our Trade Board since yesterday and it took me about 20 page reloads to get to the "Post new topic" window, I never came to the topic list.
When the board was new everything was working fine, but now it's timeout, HTTP error "server busy".
Has the Board moved to South Africa, Singapour or Wladiwostok?

I'm not using a proxy server, no background antivirus software and when turning of my firewall, there is the same problem.

tsehp, could you tell me what could be wrong or what you've changed the last days?
tsehp
09-18-2001, 02:44 AM
Yes I've experienced the same problems, a single traceroute shows that sometimes 80-100% of packets are lost just 2 routers before our provider, woodmann is checking this with the isp actually.

But you still can wait for 5 minutes or try to reload, it works after 4-5 attempts.

later
DakienDX
09-18-2001, 10:35 AM
Cool ! This time it took me only 15 reloads to get to the post/reply window.

Originally posted by Js
Hiya,
Hey what a coincidence, I live in Wladiwostok ;). I have had the same problems + "I am tired waiting for command" or something similar, well pardon me while I take a typing course ;). I reformatted my drive and everything is fine now.
Hi Js !

Wladiwostok was only a point on earth far any from me, like Singapour of South Africa. But I think South Aficanian Reversers and Coders will have the same problems when at least 80% of the data packets get lost on the way to the Board and from the Board.
Seems unlikely that we will meet on the street tomorrow, doesn't it, Js ? :)

Hi tsehp !

One more question: If I'm loged in and open a board link in a new frame and try to post/reply, I must enter my user name and my password again. I've set my profile to send my password through cookies. Is this a normal behavior, or is there a mistake on my site of the connection?

What's the difference between the "Normal Mode" and the "Enhanced Mode" vB Code in the posting window? ("help" doesn't give me a clue)
DakienDX
09-18-2001, 10:56 AM
Hello again !

Some more things...

If I reconnect during posting (IP changes), the Board wants me to login again and then tells me that the thread does not exist and I should contact the administrator.
All I've written is gone then!

What does "Post a poll" in the post dialog do?
Looks like it posts many instances of the post I make.
I didn't try it since I think it doesn't look too good when the first ten post on a page are called "Test how posting works" :(

And before I forget it:

:D The new board looks great! :D

Thanks to all who made it possible and keep it running.
tsehp
09-18-2001, 03:32 PM
login problem : only dependent of cookies, just remove any filter you could have and empty all your woodmann cookies in your dir, then it will work

vb normal/enhanced : just don't know... you should see for all the other questions :
www.vbulletin.com online manual, I've learnt here.
tsehp
09-18-2001, 03:40 PM
Originally posted by DakienDX
Hello again !

Some more things...

If I reconnect during posting (IP changes), the Board wants me to login again and then tells me that the thread does not exist and I should contact the administrator.
All I've written is gone then!

What does "Post a poll" in the post dialog do?
Looks like it posts many instances of the post I make.
I didn't try it since I think it doesn't look too good when the first ten post on a page are called "Test how posting works" :(

And before I forget it:

:D The new board looks great! :D

Thanks to all who made it possible and keep it running.

again, this seems again a cookie problem...

for the poll look at the example on the new test thread I made

I just got the info, the mb problems at 18/9 were due to our host that's improving its network and does some maintenance, the bandwidth will be *3 in 30 days:)
DakienDX
09-19-2001, 11:16 AM
Hello tsehp !

Thank you for your information. (at least I know what poll does and that my cookies are bad :) )

I tried to thank you ealier, but the board wouldn't let me. :(

I hope the board will run more stable in 30 days.

Good bye and more thanks


XP and SoftIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > XP and SoftIce
PDA

View Full Version : XP and SoftIce

+NeWbiE
09-18-2001, 11:35 AM
Any compatible version of SoftIce for XP? :D
Solomon
09-18-2001, 08:59 PM
try DriverStudio v2.5 beta 2.
or DriverStudio v2.01 + NTICE.SYS from Numega's site(http://www.compuware.com/products/numega/drivercentral/resources/whistler.htm).

get DriverStudio from exetools.com
+NeWbiE
09-19-2001, 04:39 AM
Thnx for the info but cant find Driver Studio on exetools.com any exact links? Thnx Again
Solomon
09-19-2001, 06:38 AM
h***://mud.sz.jsinfo.net/per/aaron/ftp.txt
+NeWbiE
09-19-2001, 07:31 AM
cant connect to ftp 421 too many users :(
DGR
09-26-2001, 04:04 AM
As for now no version of softice works on XP, I'm hoping that Driverstudio 2.5 final will support it but I am not sure. There is a way to get it working but for that you'll need the debug symbol files (.dbg and .pdb) from files like ntoskrnl.exe... and as for now I have not been able to find them. Btw, they do need to be from the same version as the ntoskrnl.exe or else it won't work.
+NeWbiE
10-01-2001, 07:42 AM
Damn boring withou softice...No debugging..No fun ;)
Solomon
10-01-2001, 08:15 AM
:D How about DriverStudio 2.5 RC1 ? Has anyone tried that? Also can be got from exetools.

I just formated my XP 2600, so can't try it:(
DGR
10-02-2001, 01:23 PM
Nope, DS2.5 RC1 won't work either and neither will the final... that one only works with WinXP RC2. I have no idea when XP will be supported... hope it'll be soon tho :/


Poll example...do you like this board ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Poll example...do you like this board ?
PDA

View Full Version : Poll example...do you like this board ?

tsehp
09-18-2001, 03:38 PM
just vote to test the poll, this will be deleted later, especially if "no" is too numerous :D
Carpathia
09-24-2001, 02:33 PM
I'm all for democracy, but is a sample of 3 votes really representative ? :)

Anyway, you asked for opinions, heres mine..

I thought ultraBoard was naff but tolerable. This forum is now looking more akin to a gamers forum than anything of serious discussion:

You need to create an account just to post a message (have your life story handy when you sign up). Ballache navigation, private messaging, online visitor lists etc.. why is this tiresome stuff needed ? I wonder how many people this puts off; I dont think I've seen a single person on this forum who used to frequent it before it went sugar and spice (with ultraboard).

Hmm, whats next...

Avatars ? The servers struggling for bandwidth, so why allow attachments and infinitely useless graphics in posts ? an average thread with 10 replies could mean as much as 200k of GIF. Fine, this wont slow the server noticeably, but it never hurts to be lean. As for attachments, private webspace is cheaper than muck.

So we have an all singing all dancing messageboard, whoopee. But it also makes it a pain to access the actual thing you came here to look at: The content.

Im wondering If im the only old cynic who cant be done with these sorts of gimmicks. This board is full of people interested in reversing (and therefore implcitly interested in coding). Why not ditch this junk and build a board which actually functions as a decent forum ? Or at least reopen the poll if only to prove im on my own with this one ;-)

On a hiding to nowhere..
Carpathia
tsehp
09-24-2001, 03:48 PM
maybe all the possibilities of this places can divert some real serious reversers from their actual duty on such a place.

All those smileys and avatars are kind of unproductive and bandwidth consuming, but they're here also to bring a good ambiance, and make the threads without sadness at all.

I needed an easy to install, fast and secure for backups messageboard, you know about the problems I had in the past with servers closing up our accounts and other moskitoes biting the place every day, so this place feels good to me.

I'm not a perl wizard, and can't have the time to code a forum myself on c cgi, so the win32 asm forum used the same and what's the problem ?

regards,

tsehp
Woodmann
09-24-2001, 06:27 PM
Howdy,
Thank's Carpathia, I wish everyone would post some comments about what they like and what they don't like.

I dont particularly like to have to log in to post a comment, we must be getting spoiled :P
As for the rest of the stuff, I have it all shut off in my browser. I also only want the content.

I like this board because it's fast and really easy to back up. It was something we did quick in a hurry. Perhaps after we resolve our bandwidth/backbone problems we can start tweaking things. Until they finish server upgrades I won't know what is causing the problems.

People, If you hate this board speak up, you won't hurt my feelings. Tell me what you want.

Peace, Woodmann
CrackZ
09-24-2001, 08:31 PM
Greets to all,

I'll keep this short and sweet since I might descend into uncontrollable ranting, and that might not be in tune with the 'good ambience' being maintained around here.

I personally don't care about the colours / fantastic features / avatars / gif's / modes / e-mail notification / 50 varieties of emoticons / and 1001 all singing/all dancing bloody options, I just want a flipping board I can post on, that doesn't take hours to login and hours to load because of useless trimmings. Like Carpathia I'm also not amazingly keen on the 'please insert your life story' required to register (but I'll accept that as a necessary evil even though it probably discourages a few people from bothering).

Actually I didn't really think much of UB, I just got pissed off with it forgetting I was logged in on some of the forums and thinking I was on the others, didn't enjoy having to reload the main page again to login after perusing the posts either, thats just me though, I like to peruse, post and go, not spend hours with a system designed to frustrate me ;-).

I take the point about ease of setup. No-one's offering to write anything better after all.....guess we'll have to live with it, but I demand my right to vote NO! ;-).

A final point, one which I feel is the most important since it was touched on by Carpathia & Woodmann. Like them, I come here for the content ONLY, what I really want is a forum sans gimmicks and avec content.....quality content, lucid intelligent posts or questions that I want to read ..... instead what I appear to have is a fractional collection of 5 message boards with 1 or 2 posts on each every few days and more gifs/emoticons than one can shake a proverbial stick at ;-).

Regards and some.....

CrackZ (Official Cynical Bastard).

Well there you go,
Woodmann
09-24-2001, 09:10 PM
OK people, lets throw some more gasoline/petrol on the fire.

f0dder my friend, don't be shy, get on the boards and post!!!!

The only way things can change is if all of you let me know what you want.
If you don't want to post your feelings then please email me. Woodmann(at)woodmann(insert a dot here)com.

We need your input peeps.

Peace, Woodmann
DakienDX
09-25-2001, 02:15 PM
Peace and Harmony to everybody.

When I came accross this post yesterday evening, about five minutes after Carpathia made it, I wanted to reply at once after having read it. I push the onto post reply and started to write. But more then a "Hello Carpathia" came not into my mind. I knew I wanted to write something, but I knew not what and decided to go to sleeping and to think about it the next day. I could not sleep since I knew Carpathia was right with what he said about the board. The old one looked more simple and had none of the many advanced functions this one has, but it was more related to the topic of this forum. I switched of of the private messaging, buddy list, and many more things when I registered, but I knew not why. My mind said me to do this. Now I know why. If I want a warm, userfriedly and helpful program I buy Windows, Office, CorelDraw and such things. But I chose the cold user interface of SoftICE, Turbo Debugger, Norton Commander and the DOS command line. So it is with the board. You're pleased to have such a great thing like the new board, but when you remember the old board, you notice that nothing important was missing. It used smilies, it had UB-Code instead of vB-Code, you could use [IMG] too. I know the loading problems are chaused by the server, not by the board, but if you've 20kb of text and 200kb of pictures, it may effect the bandwidth and the content. I like the new colors. They look better than the old ones, but it's only a personal feeling how something is looking good and how something is looking bad.

Peace and Harmony
DakienDX
09-25-2001, 02:33 PM
Sorry, but something went wrong when posting. I had much problems when trying to access the board, so I think I aborted the posting when I thought the connection was dead, but the board actually did the post, but I didn't notice and did it once again.

Peace and Harmony
DakienDX
09-26-2001, 11:06 AM
Thanks for deleting the double post :D
CoDe_InSiDe
09-27-2001, 12:43 AM
Hi Everyone,

I'll drop in too ;)

Well i like the Board, i don't care about the fancy colours or the numerous options, but if the Board will become unstable because of this then why not simply remove this stuff? :)
After all the content is ofcourse the most important :D

Ok this was my little speech hehe ;)

Cya...

CoDe_InSiDe
Bengaly
09-27-2001, 12:31 PM
heya guys,

well if you are talking about this belletine, and comments about it,
than i'd say the last one was better then the corrent one, but it's only a problems with upgrading than it's ok with me, i know there are some new stuff that making this page alittle slow, but be alittle patient ;D.
it will be all ok in the end, don't you worry ;D
im ust say the new bulletine has 100000 bugs keep us from enter the forum :(( dont worry, be happy ;D
nofurs
09-28-2001, 06:36 AM
Heya all,

This board is fast loading and its better than UtraBoard ;).The only prob encounter is it sometimes got an error "tired of waiting...".
And I "repeat" again :P the user name is not flexible.Tsehp could kindly change back my username back to cluesurf :P
Thanks

best regards

cluesurf
tsehp
09-29-2001, 06:32 PM
Originally posted by DakienDX
Peace and Harmony to everybody.

When I came accross this post yesterday evening, about five minutes after Carpathia made it, I wanted to reply at once after having read it. I push the onto post reply and started to write. But more then a "Hello Carpathia" came not into my mind. I knew I wanted to write something, but I knew not what and decided to go to sleeping and to think about it the next day. I could not sleep since I knew Carpathia was right with what he said about the board. The old one looked more simple and had none of the many advanced functions this one has, but it was more related to the topic of this forum. I switched of of the private messaging, buddy list, and many more things when I registered, but I knew not why. My mind said me to do this. Now I know why. If I want a warm, userfriedly and helpful program I buy Windows, Office, CorelDraw and such things. But I chose the cold user interface of SoftICE, Turbo Debugger, Norton Commander and the DOS command line. So it is with the board. You're pleased to have such a great thing like the new board, but when you remember the old board, you notice that nothing important was missing. It used smilies, it had UB-Code instead of vB-Code, you could use [IMG] too. I know the loading problems are chaused by the server, not by the board, but if you've 20kb of text and 200kb of pictures, it may effect the bandwidth and the content. I like the new colors. They look better than the old ones, but it's only a personal feeling how something is looking good and how something is looking bad.

Peace and Harmony

What was unknown for non administrators :
ultraboard is written in perl, old script language and not previously made to exploit mysql at full rank, so the script took too much cpu time on previous host, and we were finally thrown out.

I made a last backup, ultraboard said : backup complete, then I tried to upload the whole post's database to this host, and I realised that all the rce forum was gone. Thank you again ultraboard, but the lucky step was that they finally managed to retrieve a last tape backup, containing the precious posts, and I have to reformat them all.

And finally ub is not supported anymore, the contacts doesn't respond, so we had no choice to choose this script.

when we don't have bandwidth problems, it's rocking tremendous fast, backups takes only 5 minutes, it's just to me a pleasure to maintain.

So, sure there's a lot of features, but if you don't like them, thinking they are too cosmetic, well turn them out.

my goal : maintain the database at all cost
woodmann's : find a host/server to host the whole thing
DakienDX
09-30-2001, 04:56 AM
Hello tsehp !

I don't know what script language is used in UB.
I don't know what script language is used in vB.
I don't know anything about these languages.
I don't know how to backup these boards.
I don't know how to restore them.
I don't know how much CPU time they need.
I don't know how to use all their features.

I don't know anything about these things.

But why I'm here?

I think to learn.
I think to teach.
I think to get knowledge.
I think to share knowledge.
Clandestiny
09-30-2001, 09:15 AM
Hiya,

Thanks for all your work +Tsehp and Woodman. We all owe you guys one :) Just wanted to say I like the format of the new board, in spite of its extra features. The avatar feature is actually pretty cool (still working on finding a good one though :D ). I'd have to agree with ArthaXerXes that aesthetics and functionality should go hand in hand wherever possible.

Regards,
Clandestiny

PS. +Tsehp, a word of thanks for all your hard work on Revirgin. Its an awesome tool! Just recently had my first chance to try it on an Asprotected app (my first ever go at Asp, btw) :D
tsehp
10-01-2001, 12:32 AM
hi clandestinity, good to hear you back.
revirgin is still in dev and far to be finished, I'm still working on the tracer for it to manage to execute as much as possible protection schemes, I'm actually fixing a te-lock problem discovered by spekkel.

Woodmann bought us a server :D we'll soon be installing all the stuff on it, the difference will soon be amazing, we'll have much more bandwidth + space. we had to do this choice, as long as visits rised from 4000-500 / day from beginning of the year up to 1300 visits / day actually. We gathered people coming from other closed sites. Just like suddendischarge, actually closed, I made them an offer to host them but no response :confused:

regards,

+Tsehp
nchanta
10-01-2001, 01:20 AM
i love the colours ;) much more aesthetically (no spell checker yet hehe) pleasing. the ability to turn off the sometimes annoying nsmilies is kewl, it does take a fair bit of my slow slow slow modem bandwidth to get going, but that may be due to the messed up server problems aswell...

some of the abilited options are good, and the login before post thing, probably discourages more lamers and crack requesters than knowledge seeking newbies/hardcore crackers.

all-in-all a nice effort
kemo
10-11-2001, 01:19 AM
Hi there Kemo here,
Just wanna say,just love this board,I am very new to cracking but am learning fast,I had a problem with a piece of software i was trying to crack,i posted on this board about the problem and within 24 hours the software was working,can't ask for much more than that.enjoy the reading here too....
keep up the good work
Kemo :p


Hmmz. trouble logging in with old username/password
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hmmz. trouble logging in with old username/password
PDA

View Full Version : Hmmz. trouble logging in with old username/password

Argoth
09-18-2001, 03:53 PM
Great thing u guys did to the messageboard! It looks fresh! ÷)

But, I now have a problem, the E-mail adress I gave while signing up doesn't exist anymore. They closed that one, so I don't know if some mail was sent about the changes on this board.

Is there any way I could get my old username back?

Grtz

Argoth
Tech
09-18-2001, 04:09 PM
I couldn't get my old username back either for some reason... ah well, the new message board was worth it :)
tsehp
09-18-2001, 06:44 PM
Originally posted by Argoth
Great thing u guys did to the messageboard! It looks fresh! ÷)

But, I now have a problem, the E-mail adress I gave while signing up doesn't exist anymore. They closed that one, so I don't know if some mail was sent about the changes on this board.

Is there any way I could get my old username back?

Grtz

Argoth

you were changed to argoth ;)
tsehp
09-18-2001, 06:45 PM
Originally posted by Tech :..:
I couldn't get my old username back either for some reason... ah well, the new message board was worth it :)
there are two logins containing tech, mail me to make the corrections
Argoth
09-19-2001, 06:00 PM
Well, thats about it. Thanx again!

Grtz

Argoth


Revirgin & CommView2.6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Revirgin & CommView2.6
PDA

View Full Version : Revirgin & CommView2.6

evaluator
09-18-2001, 04:52 PM
Revirgin 1.1 can't handle CommView2.6(Tamos)
imports.
Appears, this file protected with
"Developers License" version for Tamos.
But CommView3.0 normally handled.
It's protected with maybe new version
of aspr, and Caspr v1.100 cannot unpack.

For Revirgins beta version.
Solomon
09-18-2001, 09:59 PM
CommView 3.0 build 140 with latest RV beta.

After "IAT resolver" and "Resolve again", there are 13 functions unresolved:
(IATRva)
19125C
191260
191274
191318
191388
1913D0
191414
191434
19143C
191474
191478
191480
191AB0 (empty function name)

IAT Start RVA:00191208
IAT Len=000008E8
EP=00401000
tsehp
09-19-2001, 06:25 AM
you should try :
api emulator
then enable trace on the still redirected ones and trace tjem
->getprocaddress

finally, look with sice on last entries :

579f00 & 579ecc = lame attempts to hide a ret4 = lockresource

and finally : 579e4c = sizeofresource , partially emulated

so only 3, not auto found, working on this actually
Solomon
09-19-2001, 06:44 AM
yes, I tried it again, just got the same result. good
evaluator
09-19-2001, 04:31 PM
tsehp but how about commview 2.6?


Asprotect again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asprotect again
PDA

View Full Version : Asprotect again

LaptoniC
09-19-2001, 02:12 AM
I had some problems with new asprotect it is really headeche.Program is Aha-soft ArtIcons v2.52 h*tp://www.aha-soft.com

Everyting is founded by Revirgin great tool!

Recently all asprotected softs checks asprotect in memory a lot.What I mean is not directly checking the memory locations for some bits.Instead it maps addresses to asprotect memory and calls from there.So if no asprotect no code to run.
Only way to make it run -in my opinion- dump asprotect memory and make new section and paste it.Then change asprotect memory locations with the ones with your loader at the end.I have completed only part of it

loader contents
dump CF3405
dump CFC4A8

change dwords at 5067C0 5067D0 and 5067D4 so that they will point to loader.

However with this modifications program runs but when exits it gives error.Before going deep inside I want to learn that, is there a anyway to fix this, other than making loader and pointing to it?Sorry for my bad english hope you understand.
Thanks
Kilby
09-19-2001, 03:13 AM
usually they are in the form of

CALL [xxxxxxxx]

xxxxxxxx JMP RealCallAddress

Usually there are 3 or 4 of these near the initialisation of the app.

What I have done in the past is simply replace the call [xxxxxxxx] with

CALL RealCallAddress
NOP

I think a previous version of articons was the first time I saw this.

As I metioned before, the future look of asprotect is in IglooFTP, unless I did something real dumb with the IT that night.

Kilby...
+SplAj
09-19-2001, 06:43 AM
Kilb,

what is the prob with IGFTPRO ? I saw your previous thread and d/l immediately but found no probs, unpacked and fixed main exe as well as the PowerUP and PowerDL exe's that were aspr'd. I saw no news on this target over the sad week so assumed all was fixed.

Only prob is fixing the many MFC42 calls to make it registered ;)

So, here are my IAT for all 3 exe's...........

+Spl/\j
Kilby
09-20-2001, 06:15 AM
I will go and have a look at iglooftp 3 again.

Last time I looked at it the entrys where all over the place and made absolutely no sense at all.

I looked at it twice, just to make sure.

Obviously I was too tired that night.

(well that's my excuse anyway)

Regards,

Kilby...


Help with SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with SI
PDA

View Full Version : Help with SI

JohnnyBoy
09-19-2001, 03:01 AM
I know, I have post this before. But I still have not got a answer.

Im workíng on a crack protected by keylib16.dll.
I have tried to load this 16-bit DLL into SI. I have tried everything I know but nothing works.

the software can be found at: h**p://www.performancetrends.com/programs/DyDM-w95.exe

The function I want to debug is the function pp_tcode, but I cant set a bpx on it. (Symbol not defined)

I have done som testing with w32dasm to see what is done inside the function. I belive that the function only is returning an interger that tells if the key is valid. I belive that a 0 is anvalid, but what number vill open up the software???? (1-50)
To understand that I think I need to understand more about the "trigger code" procedure.
Another way of solving this is to crack the pp_tcode function with alot of NOPs and set the value to 1-50 and try,change value, try,change value ....

description of the function can be found at h**p://www.softwarekey.com/helpdesk/plusman/keylib/pp_tcode.htm

I hope this is the key to my success. If not I have to try another idea. To test some other idea I need to get breakpoints inside keylib16.dll

Regards JohnnyBoy
Solomon
09-19-2001, 03:43 AM
If this dll is not packed, try inserting an INT 3(opcode is 0xCC) into the function of pp_code, then set a BPINT3 in SoftICE.:)
+SplAj
09-19-2001, 05:10 AM
... and you loaded the dll with SI Symbol Loader (File\Load Exports) before starting the target ??? as well as using a resource editor /wdasm etc to see the export function names
so you can BPX on ???

I know sometimes a dll refuses to play with SI. Maybe try TRW2000 as this loads ALL api functions automagicdynamically. No need to use the Load Exports or add them to winice.dat.

16bit targets are bastardos :-( good luck.

+Spl/\j
JohnnyBoy
09-19-2001, 06:45 AM
I started SI Loader
File/Open module => C:\WINDOWS\SYSTEM\Keylib16.dll opened successfully
File/Load Export => Error: Unknown error

hmmm!

:mad:
?ferret
09-19-2001, 09:41 PM
try Edit->SoftIce Initialization Settings->Export tab->Add->add your .dll

if you have a symbol file for the .dll you can load that under the symbols tab

reboot

your .dll should now be loaded

(The File/Open Module would be to load your target program, which you can tell symbol loader to break at entry point)
JohnnyBoy
09-20-2001, 09:45 AM
Originally posted by Solomon
If this dll is not packed, try inserting an INT 3(opcode is 0xCC) into the function of pp_code, then set a BPINT3 in SoftICE.:)

Start with w32dasm and find the pp_tcode at 0001.7da3 offset 0008463.
Went in Hex Workshop and whent to that 00008463. Looked at the code and compared it with the w32dasm window. Im on the right spot :D
Inserted the int3 code to be executed first in the function.
Save the file and made a bakupfile of the original.

Tried w32dasm on the changed file to see if I added the Int 3 on the right place. Everything looks fine.

Lets try the software.

The software tells me that the licence file is corrupted and that some files is unreadable.

At least the bastard is shaked, but not stired, yet ;)

The Int3 thing do not seam to work. The software must check the size of the keylib16.dll file or its CRC. I will try to add just a NOP and se if its still get BAZOKA.

Best try so far!!!! Thanks alot


Copy Control Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Copy Control Protection
PDA

View Full Version : Copy Control Protection

MuT
09-19-2001, 07:45 AM
Are there any tutorials or tools available that deal with Copy Control protection?
DakienDX
09-19-2001, 10:45 AM
Hello MuT !

There are some tutorials, but the ICA site is down at the moment.
Perhaps I can help you.
What's your problem?
MuT
09-19-2001, 08:45 PM
I've got one package (unavailable thru dwld) having 2 cores. 1st part uses Netsentinel w/a license file while 2nd part uses Copy Control protection. I believe I can handle the 1st part myself. But for the 2nd part, I have no info. at all about it. Seem that it needs a serial from CD to activate. When the main program is invoked CCMV32xx.EXE and a data file is created. Before digging in, I'd like to study some tutorials if available. Would appreciate if you can provide one and any hints are welcomed.
ZenLoren
09-20-2001, 12:02 AM
Hi

Does your target have CClook.exe file ?
This file will gives some more info which is required
i.e. whats the copy control serail no. & product serial
no. What product code is used etc... etc...

Give us some more details.

Regarding Tuts i have one by Cbolo in Polish & also an
converted into english. But its very old. So i guess i might
be of no help. See attachment.

Regards,
Loren
DakienDX
09-20-2001, 11:07 AM
Hello MuT !

CopyControl is a floppy disc protection system. There is an option available called Unlock-It, which can be used on media which is no floppy, like CDROM, internet or network.

It installs an copy of the product license to your program dir (hidden dir) and creates a temporary serial number. This number is random and will not be generated again, even on the same system and the same Windows installation.
You have to send this number to your software manufracturer and he will send you an unlock-code.
As far there are no tutorials on unprotection CopyControl protected files (DOS files can be unprotected with a freely available unprotector and Windows files can be "cracked" by patching three bytes. The tutorials are all about how to create master discs, since CopyControl is mainly used for floppy discs.

Creating an unlock-code is no nice work and pure DOS-cracking. (It will work only one time since you temporary serial is always different)
You should check how the program was protected by using CCLOOK.
Please tell us the product-code, the CopyControl serial and version and how the files are protected (shell or object). If the files have the shell option set, you should have an easy game, if it was by object method, it can be more easier, but also more difficult, depending on how the protection is bound to the program.
MuT
09-20-2001, 11:34 AM
Thanks everybody for the info. Glad that I haven't yet started digging. Shown below are from CCLOOK. The product code and Serial Number are fake for obvious reason, it's an engineering software w/2 modules. I've just finished (I hope) with the one using Netsentinel. For the module using Copy Control, now it's expired. Where should I start? This module has many features to be activated. BTW, the title PROGWIN.EXE actually exist in different name in the installed directory. Perhaps, the name before protection?
============================================
Protection status : 0

Product Code: PROGNAME
Product Serial Number: 123456789
Master or installed copy: Unlock-it unactivated copy
CopyControl version number: 2.01
CopyControl serial number: 702
Install to drive type: Both hard and network
Number of concurrent network users: 1
Directory containing protection: C:\Prog\PROGDIR
Display error code: Yes
Action if illegal copy: Return to OS
Virus checking enabled ?: No
Next update number: 1

Filename:.Protect: Execs: Execs: Expiry: Max: Features
................Type: /Copy: Left: date: Days:
PROGWIN.EXE: object: no limit: no limit: 1.4.1999: no limit: 0

Secure sigon message
Unauthorised message
Expired message
Part or all of licence has expired
Diagnostic Information
0000fdff 0000 0000053a
b7a1 b8ae 3e 3c 008b
0a ff ff
0010,0010,0017,0009,000a,0015
0014,0016,0039,0009,0003,0015
000c,0012,002e,000a,0003,0014
0000,0000,0000,0000,0000,0000
0014,0017,0003,0009,000a,0015
DakienDX
09-20-2001, 12:34 PM
Hello MuT !

Since I've written the serial is randomly generated, you could have posted it anyway. But that doesn't matter now.
We know that the program has been protected with CC 2.01, and is protected by the object method. This means that somewhere in the code there is a call to the CopyControl routine which fills the buffer given by stack with a special structure.
So I suggest to download CopyControl 2.01 from http://www.microcosm.co.uk and study their help file. You don't need to activate it (since you would have the same problem you've now: how to do it ???). It includes detailed information of the structure filled by CC routine.
You should the search for any code which checks data in this buffer. If you're lucky, the program only checks for the return value of the CC proc (0 = all OK) or the status word (0 = all OK).
It could also check for the number of network users, the expire date, the serial and some other (read the helpfile of CC).
Then you can change the check to whatever you like.

If you have problems finding the CC proc, just link the LIBs included in CC 2.01 to one of you programs and see how the code you're searching for should look like.
MuT
09-20-2001, 08:51 PM
Hi, DakienDX

Thank you very much for the info. I've started looking at the prog. and see that the error messages are after some CMPs which really expect zero return values. Inside this main prog. there is no call to ext. CCxxxx.dll. In the separate chk/activation prog, the activation errors are after CALLs to CCCHANGE_SGO inside CCCHNG32.DLL. Is it worth tracking and patch the activation prog. (it's much smaller, 700kb compared with 6mb of the main prog) or should I concentrate on working with the main prog? I really appreciate your hints. The info you provided above is very helpful. Further suggestions are welcomed.
ZenLoren
09-20-2001, 11:38 PM
Hi

Can you upload your progname.ccc & ccontrol.sys ?
It would be inside your folder.

C:\Prog\PROGDIR

Regards,
Loren
MuT
09-21-2001, 01:59 AM
The files I upl. are on the install CD. I'm not sure if it's exactly the same as the ones installed on my PC at home. Now I've only the CD image on my office's PC. If you need the ones installed, tell me. I'll upl again once I'm at home. BTW, this morning I saw 'CCMB' CMP in the routine jumped to by the CALL just before the zero CMP JMP to the expiry message. I planned to start checking the stack tonight. Hope that it's not equipped with anti-sice algos.
ZenLoren
09-21-2001, 05:17 AM
Hi,

can you provide the original *target*
Product Code : ?????????
ProductSerial No: ?????????

Regards,
ZenLoreN
MuT
09-21-2001, 09:37 AM
CYM. BTW, it's using anti-sice. Still not sure what kind.

Best regards
DakienDX
09-21-2001, 01:44 PM
Originally posted by MuT
Hi, DakienDX

Thank you very much for the info. I've started looking at the prog. and see that the error messages are after some CMPs which really expect zero return values. Inside this main prog. there is no call to ext. CCxxxx.dll. In the separate chk/activation prog, the activation errors are after CALLs to CCCHANGE_SGO inside CCCHNG32.DLL. Is it worth tracking and patch the activation prog. (it's much smaller, 700kb compared with 6mb of the main prog) or should I concentrate on working with the main prog? I really appreciate your hints. The info you provided above is very helpful. Further suggestions are welcomed.

Hi MuT !

The call to the CC proc needs not to resist in an external DLL, it could be linked into the program. There are some samples how to call the CC proc in the CCDir\SAMPLES dir.
Have you downloaded and read the CC help file?
If yes, you should know what to look for. For expample

Mov DWord Ptr [StartOfBuffer], "BMCC"
Mov Byte Ptr [FunctionByte], 0
Push Offset StartOfBuffer
Call SomeAddress ; _cc = CC proc
Or EAX, EAX
Je GoodBoy
Call BadBoyMessage

Now you should find any references from the buffer start max. 512 bytes forward and check the values read and checked. The CC help file contains detailed information about the structure of the buffer.

Since I think you want to crack the program forever and not only generate one unlock-code which works only one time, the work on the routine which checks the unlock-code is a waste of time in my opinion. It is pure DOS debugging with many useless checks.
Why do you want to deal with much asm anti-debugging code, which at it's end will only generate a ONE-time unlock-code, when you can easy crack the program forever by just patching C++ or Delphi code?

From reading my text, you should know that it is NOT worth to trace through the activation program, since patching it will just show you an "Thank you for registering" message, but CopyControl will be still unactivated. So the .CCC and CCONTROL.SYS files are not needed for this task.

Please post any questions or email me any non-public questions.
MuT
09-22-2001, 01:31 AM
Hi,

Thanks for guiding. I won't waste time playing with the activation routine as you wrote. Finally I got thru the antisice and explored the codes around the data block. I saw the code that decrypted and encrypted again the CC code block using 0x5A, and some kind of signature before and after the code block. The first call uses function '0' with expiry error code. I cleared the ret code and fixed the expiry date in the memory. This bypassed the expiry chk and the soft. ran with another 3 calls to function '3' with '0' ret. Then an error msg appears: Failed to load critical file(s), and the soft terminates. I could see the first screen after fcn'0' call and the menus appeared after the error msg. I'm not sure if this is relating to CC. From FileMonitor, there're a lot of NOT FOUND msgs with CCMV32AA.Lxx files. But I'm still not sure if they're related. Will dig deeper.
DakienDX
09-22-2001, 02:06 AM
Hello MuT !

The CCMV32AA.Lxx (and the CCMV32AA.EXE) are used to verify the unlock-code. They're written to the tempdir or the windir and are DOS programs (only the .EXE). CCMV32AA.EXE gets some information on the commandline like the PCODE and reads the rest from CCMV32AA.Lxx.
Good you've found the call to the CC proc. You should set an breakpoint on the first instruction of the proc and see how often it is called. (normally only once, but it could be called more times for logging in network users, as documented in the CC help file)
You should patch the CMP instructions after all calls, since a new call to the CC proc will overwrite you patched memory locations.
I've never seen xoring the buffer with some value, but the author could have implemented it to confuse the "user".
Also it it possible, I wouldn't change something in the CC proc. I got strange results on some programs when doing that :(

Keep on working and you'll succeed soon. You're on the right way. (I hope so :) )
MuT
09-22-2001, 05:15 AM
Hi friends,

Now it's clear that the Features field (offset 352) of the CCMB block must be filled with FFFF, otherwise nothing can be done even though I can enter the main menu. This soft. has many options and the CC routine is called from more than 200 locations. Where is the CCMB block from: .ccc or .sys? Is it possible to decrypt, modify, then encrypt again? Rewrite the CC routine is my current choice.

Best regards
DakienDX
09-22-2001, 06:20 AM
Hello MuT !

In this case (>200 _cc calls) you should try to patch the CC proc itself. The CCMB is not stored in a readable form anywhere, it is rebuild every time by a _cc call. As I said, unlocking it is one possibility (but it's the worst), patching is the other, more easier.

Rewriting the CC routine should be the best choice in this case.
MuT
09-22-2001, 12:47 PM
Hi,

I fixed the CC_body to clear the expiry and get the Feature field the way I want. Now, the soft. is usable but not 100%. Out of 39 options I can enable 33 max. Anyway, at the moment using 3 codes I can cover all, enough for my own use. Thanks a lot for all helping hands.

Best regards
DakienDX
09-22-2001, 01:11 PM
Hello MuT !

Sometimes the feature word has values which disable some features. For example in CC 3.03 bit 2 (=2) disables floppy activation under WinNT and bit 7 (=128) converts the program into a demo version. So setting 65535 as feature word isn't what you want.
Dissektor
09-22-2001, 10:28 PM
http://ids0a.cjb.net/

try the tutorial or you could mail UnforgiveN
he is ready to help
MuT
09-23-2001, 12:24 AM
Hi,

DakienDX: I also saw similar things, eg. bit 7 has to be 0. The best I could get was from FFFFFFBF, BE (33 options enabled, some not the same). BD got 32 options. FF got 20 but contained 3 options not enabled by BF, BE, or BD.

Dissektor: Thanks for your info. My problem seems to be slightly different from what posted though.
DakienDX
09-24-2001, 11:47 AM
Hello MuT !

It came just into my mind when reading "FFFFFFBF". You have probably set only the 32bit feature word. You should know that there is also a 16bit feature word at the beginning of the buffer. It's included for backwards compatibility only and includes only the bits 0 to 15 of the 32bit feature word, but it could be still checked for some values. (If you've set it too, please excuse my suggestion :) )
Do you know if all 39 options can be enabled in one copy? Is it possible that the Netsentinel license file unlocks the missing options?
MuT
09-24-2001, 08:47 PM
Hi,

From BPR, it seems that the 16-bit Feature was not read at all, but I didn't try to change the value. Also I didn't trap the Netsentinel call. Seem to me that it should be possible to enable all 39. Will check it up again. Thanks for your suggestions.

Best regards


MessageBoxA inside MFC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MessageBoxA inside MFC
PDA

View Full Version : MessageBoxA inside MFC

UnderCover
09-19-2001, 04:21 PM
Hi,

first i have a MessageBoxA that opens everytime when i start the prog and it has a Ok button so i must click in order to continue..as this program uses MFC i coudlnt patch it as i do with other programs,

* Possible StringData Ref from Data Obj ->"Thank you for trying this "
->"Demo."
|
:00422949 BE60AD5400 mov esi, 0054AD60
:0042294E 8D7C2444 lea edi, dword ptr [esp+44]
:00422952 6A00 push 00000000
:00422954 8D542448 lea edx, dword ptr [esp+48]
:00422958 898594000000 mov dword ptr [ebp+00000094], eax
:0042295E 6A40 push 00000040
:00422960 F3 repz
:00422961 A5 movsd
:00422962 52 push edx

* Reference To: MFC42.Ordinal:04B0, Ord:04B0h
|
:00422963 E86EBE0900 Call 004BE7D6 -> show msgboxa
:00422968 8B44241C mov eax, dword ptr [esp+1C] ->eax = 1 after
:0042296C 85C0 test eax, eax
:0042296E 7451 je 004229C1

so in 00422963 i entered in MFC and saw the call to MessageBoxA but i can't patch mfc42.dll, anyone can give me some direction ? i was thinking on making the prog thinks i've clicked ok but i need to mov eax, 6 before the call to Msgbox ?

tnx in advance
UnderCover
Solomon
09-19-2001, 09:02 PM
1. first change "Call 004BE7D6" to "add esp, xxxxxxxx", where xxxxxxxx is the number of bytes to balance the stack, coz it pushes some parameters into the stack before calling MFC subroutine.

2. change "je 004229C1" to "nop"

:00422963 E86EBE0900 Call 004BE7D6 //add esp, xxxxxxxx
:00422968 8B44241C mov eax, dword ptr [esp+1C]
:0042296C 85C0 test eax, eax
:0042296E 7451 je 004229C1 //nop, nop
UnderCover
09-20-2001, 10:19 AM
first change "Call 004BE7D6" to "add esp, xxxxxxxx"

how will i know what xxx is ? the program runs the message wont show but it crashes after start... :(
UnderCover
09-20-2001, 01:33 PM
ArthaXerXes, patching this call by nopping it make the program crashes.
Solomon
09-20-2001, 09:02 PM
1. write down the value of ESP register right before executing this call,
2. execute this call.
3. write down the value of ESP after executing this call.
just subtract the two values, you will get xxxxxxxx:D

Originally posted by UnderCover
first change "Call 004BE7D6" to "add esp, xxxxxxxx"

how will i know what xxx is ? the program runs the message wont show but it crashes after start... :(
UnderCover
09-20-2001, 09:49 PM
ye Solomon, worked tnx :]


Tshep help mE!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tshep help mE!!!
PDA

View Full Version : Tshep help mE!!!

Nio-shai
09-19-2001, 06:59 PM
hi Tshep

i 'v been trying to unpack a prog that uses the method of ASPR but it's not ASPR ...

i don't whant a serial or to crack this prog just to lern how to unpack it ....

url : h**p://www.softpile.com/Utilities/Password_Recovery/Review_08401_index.html

i'v found the EOP = 40c35a
and the start IAT = 12000
but the size had a problem ...
at ImpREC it tald me the size is = 2F8
at Revigin it tald me the size is = 370

but i used imprec to fix the AIT and i fixed it just like it should be

6bc968: is : lock resource
6bc950: is : get current process
6bc974: is : free resource
6bc928: is : get current process id
6bc960: is : get command line A
6bc990: is fixed to an user32 dll instad a keranel32.dll to :
dialog box inddirect param A

the fix is done and the prog DO RUN!! but!!! if i try to push the about or the register it crashes :( what can i do ??? i can't find anything to do about it !!! plz help !!!
tsehp
09-21-2001, 02:06 AM
Originally posted by Nio-shai
hi Tshep

i 'v been trying to unpack a prog that uses the method of ASPR but it's not ASPR ...

i don't whant a serial or to crack this prog just to lern how to unpack it ....

i'v found the EOP = 40c35a
and the start IAT = 12000
but the size had a problem ...
at ImpREC it tald me the size is = 2F8
at Revigin it tald me the size is = 370

but i used imprec to fix the AIT and i fixed it just like it should be

6bc968: is : lock resource
6bc950: is : get current process
6bc974: is : free resource
6bc928: is : get current process id
6bc960: is : get command line A
6bc990: is fixed to an user32 dll instad a keranel32.dll to :
dialog box inddirect param A

the fix is done and the prog DO RUN!! but!!! if i try to push the about or the register it crashes :( what can i do ??? i can't find anything to do about it !!! plz help !!!

get revirgin :P
Nio-shai
09-21-2001, 07:52 AM
Tsehp !

i did used RV with both sizes
if i use the 2F8 size then it's like ImpREC
if i use the 300 size it gives me in the end of the table some
pointers that leads to nowhere!!!

come on Tsehp don't leave me hanging in the air .... and plz check
this prog ... i realy whant to lern so plz hlp me to lern what was wrong....

:confused:
Kayaker
09-21-2001, 12:50 PM
Holy shit. And when you're done with that one Tsehp, I've got a few crashing rebuilt programs that you could work on as well ;)

Heh, heh, welcome to Asprotect. It looks like you've picked up most of the Asp tricks, the redirection to an address holding the API return value or to a short section of garbage code, the Kernel/User reference flip, the code running a few lines of API code before jumping into the API, etc. But I'm thinking your problem lies beyond Revirgin. As you say, the program runs but only crashes in certain cases.

Soooo.... what error message does it give? Have you traced to that address in the unpacked file and compared it with the original packed file? This may have nothing to do with imports, but just a code section that tries to access packing code (which now no longer exists).

The About box may be trying to access user registration info which would have initially been read from the registry during unpacking and stored in a high memory address. Often just bypassing the call or redirecting it to your own value might solve the problem.

Start by confirming all the missing unresolved IAT entries. What I do is do an initial pass with Revirgin then list out all the problem addresses. The ones listed "to_Resolve" can usually be fixed by selecting EnableTrace/Trace, and will likely be GetProcAddress and GetModuleHandleA. (BTW Tsehp, the trace feature for these 2 APIs works really well now on 9x :)

For the remaining ones it looks like you figured them out, but what I do to double check what's happening is to break in the original file after it has been unpacked, say with GetStartupInfoA, and unassemble each redirected IAT address with the 'u' command. This should immediately tell you what code is replacing what should be a direct jump to an API starting address.

As I say, if you've nailed down the imports, and made a proper dump, the problem probably lies beyond the call of duty of Revirgin. I think the IAT size difference between RV and Imprec isn't important, use the larger size and RV ignores what isn't important I believe.

Methinks you just need to dig a little deeper and treat this as trying to find a particular patch point. Good Luck.

BTW, just a minor point, but it's preferable to NOT use direct links to shareware sites in postings. I know it's convenient, but any click on the link can be directly referred back to here. We got enough problems as it is if you know what I mean ;)

Kayaker
tsehp
09-22-2001, 01:58 AM
sorry for the short response, but I'm kind of busy those days.

the size is a pure guess, you can check it by yourself while looking at the it table, look at the pointers or stop the size just before the ascii characters begins.

rv & imprec will only fix iat, but you still have some kind of anti dump code now inside targets, look at the other asportect recent threads.
Nio-shai
09-22-2001, 02:11 PM
Kayaker hi!

tnx for replaying me since Tsehp is busy ...

well i found that it's true that when i want to see the the about
box in the PACKED file it first calls some :
LOCK RESOURCE
LOAD RESOURCE
and then it calles the dialog box!!!
:eek: :D

but in the dump file those things doesn't exist!!!

but about the REGISTRATION box the windows not only crash it
also giving me the BLUE SCREEN !!! so i can't trace it !

but now for fixing the dialog box of the DUMP file ... i looked and didn't find a tut or an esey about how to fix those kind of thing so i'll be more then happy if some one can give me some help with this thing ...
:confused:
BTW : sorry about putting the link to the site .. didn't know about this .
:confused:
Kayaker
09-24-2001, 01:52 PM
Hi Nio,

It's kind of hard to say what your problem is. I do remember those resource api's you mentioned being associated with a FindResourceA call that I think can also be redirected by Asprotect. It's been a while so I forget the exact details.

What unresolved IAT entries did Revirgin come up with, and more importantly, what did you "fix" them to?

The other issue is, are you 100% certain that you've got the right OEP? That BSOD sounds pretty severe. If you've got a "workable" dump (i.e it crashes, but you might be able to patch it), you may get Runtime Error messages, but if you're getting a BSOD you may have deeper problems and should double check the quality of your dump.

Kayaker
+SplAj
09-25-2001, 04:19 AM
Is the code similar to this :-

==> 00E5C898 55 PUSH EBP 
0187:00E5C899 8BEC MOV EBP,ESP
0187:00E5C89B 53 PUSH EBX
0187:00E5C89C 8B5D08 MOV EBX,[EBP+08]
0187:00E5C89F 8B4518 MOV EAX,[EBP+18]
0187:00E5C8A2 50 PUSH EAX
0187:00E5C8A3 8B4514 MOV EAX,[EBP+14]
0187:00E5C8A6 50 PUSH EAX
0187:00E5C8A7 8B4510 MOV EAX,[EBP+10]
0187:00E5C8AA 50 PUSH EAX
0187:00E5C8AB 6A05 PUSH 05
0187:00E5C8AD 8B450C MOV EAX,[EBP+0C]
0187:00E5C8B0 50 PUSH EAX
0187:00E5C8B1 53 PUSH EBX
0187:00E5C8B2 E8157BFFFF CALL KERNEL32!FindResourceA
0187:00E5C8B7 50 PUSH EAX
0187:00E5C8B8 53 PUSH EBX
0187:00E5C8B9 E87E7BFFFF CALL KERNEL32!LoadResource
0187:00E5C8BE 50 PUSH EAX
0187:00E5C8BF E8807BFFFF CALL KERNEL32!LockResource
0187:00E5C8C4 50 PUSH EAX
0187:00E5C8C5 53 PUSH EBX
0187:00E5C8C6 E8917BFFFF CALL USER32!DialogBoxIndirectParamA
0187:00E5C8CB 5B POP EBX
0187:00E5C8CC 5D POP EBP
0187:00E5C8CD C21400 RET 0014

Nio, this was Alexey latest trick a few months ago
Just make the Revirgin manual entry to be USER32!DialogBoxParamA
and you are fixed.......... this is an API twister i.e. Alexey made DialogBoxParamA call into aspr code to emulate it via DialogBoxIndirectParamA . :D

BTW the above code is from an Elcomsoft target Aeepro and I think your target is from the same stable................

+Spl/\j
Kayaker
09-25-2001, 10:16 PM
Originally posted by +SplAj

<SNIPPET> some poor hapless Assprotect code gleefully ripped out by the throat, stepped on, probed prodded poked mutilated and examined endlessly. Then mercifully put to death.
<ENDSNIPPET>

+Spl/\j

Yeah, that was it Splaj, thanks for reminding me.

As Far As You Know??!! :rolleyes:

Kayaker
+SplAj
09-26-2001, 04:23 AM
hwdy, did I 'really' say those <SNIPPET> nice thing about aspr <END> ???

nice forgery Kayaker ;) ...... but you missed 'patch+play' :D

and I phear aspr is not 'dead' Alexey will return soon :p .......................

Bit quiet around here ?
tsehp
09-26-2001, 06:27 AM
the site was impossible to connect since sunday, so there are not a lot of contributions, but the stats shows a lot of log attempts.

Woodmann is actually making a big decision, mine is already done : we have to change again the isp.

regards,

tsehp

ps : splaj, again some tracer fixing for te-lock then I'm back to our latest task ;-)
+SplAj
09-26-2001, 09:35 AM
so they lie when it says server bizzy....... u & woody are the bizzy ones....

shame really after all hard work :(

lets have some fine French wine with some spaghetti bolognese again soon , you need a break :D

(thats a foreigners idea of fine cuisine :; )
Woodmann
09-26-2001, 01:30 PM
Yes Bolognese sounds nice, can I have a lame watered down American beer please?

Peace, Woodmann
+SplAj
09-27-2001, 01:32 AM
yes you can have a budwhatever.....but I suggest we share a crate of Champagne to really make a mess of the carpet ;)
tsehp
09-27-2001, 07:01 AM
yes splaj, you own us a real mess on my son's pants or mine if you choose, I'll be really happy to see this happen again ! he he!

one of my woman clients saw us when we were on 2nd floor of eiffel tower, you and wood should come back again pretty soon before terrorists make it blow away:D
(pathetic sense of humor, I know...)
Nio-shai
09-27-2001, 07:31 PM
tnx all for u'r help the : Dialog Param A was the API that fixed it all
:D
thanks u all !!!


Unpacking !!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unpacking !!
PDA

View Full Version : Unpacking !!

Nio-shai
09-20-2001, 03:31 AM
hi Tshep

i 'v been trying to unpack a prog that uses the method of ASPR but it's not ASPR ...

i don't whant a serial or to crack this prog just to lern how to unpack it ....

url : http://www.softpile.com/Utilities/P...8401_index.html

i have dumped the file ...

i'v found the EOP = 40c35a
and the start IAT = 12000
but the size had a problem ...
at ImpREC it tald me the size is = 2F8
at Revigin it tald me the size is = 370

but i used imprec to fix the AIT and i fixed it just like it should be
with size of 2F8..

the fixing R:

6bc968: is : lock resource
6bc950: is : get current process
6bc974: is : free resource
6bc928: is : get current process id
6bc960: is : get command line A
6bc990: is fixed to an user32 dll instad a keranel32.dll to :
dialog box inddirect param A

the fix is done and the prog DO RUN!! but!!! if i try to push the about or the register it crashes what can i do ??? i can't find anything to do about it !!! plz help !!!


UK-INFO (PC F*Rmat Mag Sept 2001
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > UK-INFO (PC F*Rmat Mag Sept 2001
PDA

View Full Version : UK-INFO (PC F*Rmat Mag Sept 2001

Scally6
09-20-2001, 01:19 PM
Has anyone attempted this prog? It was a 7day trial on the mag but its got me tearing my hair. It uses an ini file in \windows, a 'table' file in win\system, as well as three key files in the home dir, which are different to the three same name files in each of two sub-dir's of the home dir and also a file named IOU.sys in c:\, as well as reg entries and two/three crypt dll's.
Paranoid or what?
It has protection against moving the clock back, even within trial period. I found the majority of reg entries but regmon crashes on me & there are a lot of entries. Wdasm is able to disassemble this MFC42 app, but the obvious stuff is probably doubled up elsewhere in the prog. I was gobsmacked that they didn't pack it with something as well but hey? It looked like an easy target before I started trying it;).
Anyone played with it? (I had a look around the site & it doesn't seem to be d'loadable.
Scally


Revirgin stops responding on tELock(FlashFXP 1.4)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin stops responding on tELock(FlashFXP 1.4)
PDA

View Full Version : Revirgin stops responding on tELock(FlashFXP 1.4)

Solomon
09-21-2001, 03:03 AM
FlashFXP v1.4:
http://bigskysoft.tucows.com/files2/ffxp14.zip

OEP = 0052B8B0

Fill this into Revirgin(1.2 beta 3) then press "Fetch IAT", it causes 100% CPU utilization.
OS: Win2K server build 2195

Do I need to change NumberOfSections from FFFF to 9 in the memory?
tsehp
09-22-2001, 01:56 AM
Yes I located the problem, it comes from the way rv calculates the process size, I fixed this.

You can download again the new file, the build num is unchanged.

regards,

tsehp
Solomon
09-22-2001, 08:57 AM
bug disappeared. thx
tsehp
09-24-2001, 07:27 AM
u welcome, never hesitate to signal some more while in beta test.
Nitrus
09-24-2001, 03:00 PM
Just curious if you could send me a brief tutorial on unpacking flashfxp when you are done. Thanks in advance, Nitrus.
Latig0
09-28-2001, 09:51 AM
Nitrus!!
My old pal!!!!!
hehe
Long long time no see buddy :)
How's everything?
Hope you're allrighty..
Hugs..

Latigo
Solomon
09-29-2001, 12:12 AM
hi Nitrus,

Please read the post by +SplAj:
h**p://www.woodmann.net/forum/showthread.php?s=&threadid=1810

for FlashFXP 1.4,
OEP = 0052B8B0
IT = 00533000

Set a "BPX VirtualProtectEx", F12, then press F10 to trace a while, you will see the "JMP [ESP-30]". OEP = dword ptr [esp-30]. Suspend it with a "JMP EIP", then use the RAM Editor of WinHex to change the NumberOfSections from FFFF to 9. Make a full dump with LordPE & kill the process.

Set a "BPX LoadLibraryA do "db *(esp+4)", re-run FlashFXP. When you see "oleaut32.dll", press F12, then scroll up a few lines, you will see the following code:

001B:00576C14 JMP 00576B9E
001B:00576C16 MOV EDX,[EBP+0040AFBE]
001B:00576C1C MOV ESI,[EBP+0040AFAE]
001B:00576C22 TEST ESI,ESI
001B:00576C24 JZ 00576FC7
001B:00576C2A ADD ESI,EDX
001B:00576C2C AND DWORD PTR [EBP+0040B0AA],00
001B:00576C33 MOV EAX,[ESI+0C]
001B:00576C36 AND DWORD PTR [ESI+0C],00 <---------------Clear the Import Table
001B:00576C3A TEST EAX,EAX
001B:00576C3C JZ 00576FC7
001B:00576C42 ADD EAX,EDX
001B:00576C44 MOV EBX,EAX
001B:00576C46 PUSH EAX
001B:00576C47 CALL [EBP+0040AF18]
001B:00576C4D TEST EAX,EAX
001B:00576C4F JNZ 00576CE1
001B:00576C55 PUSH EBX
001B:00576C56 CALL [EBP+0040AF1C] <--------------Here is LoadLibraryA( )
001B:00576C5C TEST EAX,EAX
001B:00576C5E JNZ 00576CE1

Clear all breakpoints, set a "BPM 576C36 X", then re-start FlashFXP. When SoftICE pops up again at CS:576C36, just type "dd esi", you will see the good import table :) Dump the IT & IAT.(esi = 533000h, IT length = 1CCh, dump length = 3000h).

Paste the IT & IAT(total 3000h bytes) to the dumped exe at file offset 133000h, fix the EntryPoint & Data Directory. All is OK.

Hope this helps.:)

Seems that both RV & ImportREC can't rebuild the IT without manual modification of the FlashFXP's code.
Bengaly
09-29-2001, 05:13 AM
Heya...

about flashFXP u should try talking to Nchanta, he already
unpacked flashFXP - pGC :)
send him a prvt msg and have fun =)
cya
.........................:::Bengaly:::..........................................................
Nitrus
09-29-2001, 05:58 AM
Thanks everyone. I had already successfully built a new exe before i received your messages. Also, hi Latigo. LTNS, how are things.
nchanta
10-01-2001, 01:07 AM
hola latigo, nitrus ;) bengaly thanks for the reference ;D

splaj+'s essay explains it all, however if someone wants a more "in-depth" tutor especially concerning the IAT rebuilding, then email me nchanta@optusnet.com.au and ill whip one up...
Unregistered
10-10-2001, 10:23 AM
Originally posted by Solomon
hi Nitrus,

Please read the post by +SplAj:
h**p://www.woodmann.net/forum/showthread.php?s=&threadid=1810

......

Set a "BPX LoadLibraryA do "db *(esp+4)", re-run FlashFXP. When you see "oleaut32.dll", press F12, then scroll up a few lines, you will see the following code:

001B:00576C14 JMP 00576B9E
001B:00576C16 MOV EDX,[EBP+0040AFBE]
001B:00576C1C MOV ESI,[EBP+0040AFAE]
001B:00576C22 TEST ESI,ESI
001B:00576C24 JZ 00576FC7
001B:00576C2A ADD ESI,EDX
001B:00576C2C AND DWORD PTR [EBP+0040B0AA],00
001B:00576C33 MOV EAX,[ESI+0C]
001B:00576C36 AND DWORD PTR [ESI+0C],00 <---------------Clear the Import Table
001B:00576C3A TEST EAX,EAX

... ...

Seems that both RV & ImportREC can't rebuild the IT without manual modification of the FlashFXP's code.

hi, ya

just notice here, excuse my english:

001B:00576C1C MOV ESI,[EBP+0040AFAE]
001B:00576C22 TEST ESI,ESI

the MOV and TEST are used to check if IAT are wraped, ESI gets the RAV of IAT. so at the line 001B:00576C22, type:
r esi 0
go the OEP, dumped it, u get a unwraped IAT, isnt it?

regards.
Unregistered
10-10-2001, 08:59 PM
Have you tried that? You will not get a good IT in such way coz a GPF will appear:)
The following instructions which destroy the IT/IAT are in a loop(loop for each imported DLL). That means they will be executed many times. Suspend it before the whole loop begins, then dump the IT/IAT. I prefer the following way to suspend a process, coz it will cause no CPU utilization, while "JMP EIP" causes 100% CPU utilization:
push 7FFFFFFF
call kernel32!Sleep

Originally posted by Unregistered

001B:00576C1C MOV ESI,[EBP+0040AFAE]
001B:00576C22 TEST ESI,ESI

the MOV and TEST are used to check if IAT are wraped, ESI gets the RAV of IAT. so at the line 001B:00576C22, type:
r esi 0
go the OEP, dumped it, u get a unwraped IAT, isnt it?
ThrawN
10-10-2001, 09:09 PM
Originally posted by nchanta
hola latigo, nitrus ;) bengaly thanks for the reference ;D

splaj+'s essay explains it all, however if someone wants a more "in-depth" tutor especially concerning the IAT rebuilding, then email me nchanta@optusnet.com.au and ill whip one up...

optusnet.com.au :))) oo another australian cracker
Gday mate :P

ThrawN


PCGuard 4.03 demo unprotecting
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PCGuard 4.03 demo unprotecting
PDA

View Full Version : PCGuard 4.03 demo unprotecting

evaluator
09-21-2001, 05:12 PM
This protector have very hard anti-debuger
code. But I catch in memory original IT (before
it was erased) and then found oeip.

I am interesting:
1. How analise and set correct IT values
(generally).
2. Can you do debug PCGuard.
DakienDX
09-22-2001, 01:40 AM
Hello evaluator !

What do you mean by "analysing" IT values in general? Could you be more specified and tell us what you would like to know exactly.

I remember once debugging PCGuard for DOS. It nearly used no real anti-debugging code, just many time-consuming loops when deprotecting the next 30 bytes where the next decryptor was located :) )

Could you tell me where to download the target or PCGuard? I've only found a firewall, a password-lock for you computer and an old version 3.0 with the name "PCGuard".
evaluator
09-22-2001, 04:31 PM
goto url
http://www.sofpro.com
direct url is
http://www.sofpro.com/files/demo/pcgw32d.zip
evaluator
09-22-2001, 05:32 PM
So I catch original IT in memory, insert it
in dump file and now I need IT RVA address
& size, IAT size (IAT RVA not a problem).
So maybe you know some tools for
analyzing those IT values?
Or easy for understanding tutorial?
I read r!scs tutorials but they are not easy.(

I treed many variants and found maybe good
values, but I'm not sure.
Program runs and successfully "Wdasmed".
This is my check. Is it enough?

If somebody know interesting program
protected with PCGuard, please tell me!
I already deprotect IRISv3.50.2 (PCGuarded)
and now working "hard" for crack! It has
grandiose IT! Section size 133 Kbytes!
Who want to join me?
Solomon
09-23-2001, 12:34 AM
Is IRIS v3.502 protected by PCGuard or TELock?
evaluator
09-23-2001, 01:11 AM
By PCGuard.
In header you see "wrong" protector name
+SplAj
09-23-2001, 05:28 AM
Greetz guys,

esp. Solomon who is VERY active :D ...............be careful with diagnosing a certain protector/packer or Egoiste will be laughing too loud ....

extract from rebuilt te!lock .exe :-

--------------
tElockv085.Reminder.Another instance of tElock is already running!.Licensed to: Public.A TMG production. (c) 2000-2001 by tE!..aspack..pklstb..PCGW32.PEPACK!!.CryptX.BitArts..BJFnt..PELOCKntUPX!.....shrink..neolite.peco....WWPACK..petite.PESHiELD.aspr... Contact:.. WWW:.http://egoiste.cjb.net.. Email:.tmgfreaks@softhome.net.Error.Please do not drop more than -one- file.
-------------

Yes protector is fake -> PCGW32 section name == tE!lock.

BUT having said that the code IS ALSO using PCGuard as the timelimit feature on 'wrapped' exe. Once unwrapped this .lic check is gone and only the stupid 'sheriff' system remains...

Remember Laurentio (eEye/Iris programmer) will also be laughing ;) cos it is an eval version. Those graph functions disappeared after v3 released.

Please refer to previous threads on 'Iris' v2 - v3.5 over the last 5 months or so. The search engine is fully working . Best full info thread is started by hOrn_dOg.

BTW my Iris 3.501 is protected with 'Neolite' ;) duh NOT . That damn tE! again.................If you don't believe me try my tE!lock dumping quick tut from a few days ago. BPX VirtualProtectEx...............whatever :D

.....and of course a good tool for IT stuff is 'Revirgin' !!! and again I recommend LordPE FX cos it defeats most lame anti-dump tricks.....

+Spl/\j
evaluator
09-24-2001, 01:53 PM
Dear Solomon, Dear +SplAj!!!
Thank you for replays.

1. Forgirvme, but section names in iris.exe is "PELOCKntT".
Maybe you have another version?? I downloaded it in 2001/08/30 from
http://www.eEye.com/html/Products/Iris/IrisDemo.exe size=3295589 byte.
File iris.exe size=841728 crc32=E49C94FC, date-27.08.01

2. +SplAj, my english is bad and maybe you don't understand me when you
wrote: good tool for IT stuff is 'Revirgin'...
I wrote: "I catch original IT in memory" (before it will erased)! Why I need Revirgin?
So will be good if some greet (you!) master will write little tutorial about:
"How analyze and set correct values in PE header for original ("virgin") IT"
Or little program!

3. About cracking demo. I think, this is not full demo because for today I crack
2 restricted functions: Decoder and address book 10 entry limit. For me it's enough!
But I'm tired to trace inside MFC42.DLL (shit:( I think it will be non solid to publish
this partial crack. Or no?
+SplAj! That is your serials for IRISv1.01 beta I have? (Can't believe!) Thanks for it.
So if you want, I will upload for you those virgin IT section or full unprotected iris.exe
for proffy crack!!!

Sorry for eNgLiSh!
+SplAj
09-25-2001, 04:45 AM
Hi evaluator

I have a good story about the serials, yes 'splaj' was banned from registering iris so I released some in the name of 'Laurentiou' (eEye programmer). Then when he was online in the GRC.com forums about scanners he was always bugged for new serials by those lamers that don't know a sniff from a cold :D :D :D

Ok, lets step back from this current Iris3.502. Please download all previous versions of te!lock from .05 to 0.90 from w*w.exetools.com and practise ....... you will see from the later versions a nice 'fake known packer' option. This is what Laurentiou is doing with each build of Iris now. The section names will be random selection of ASpack, Neolite, PCGW32, etc etc. See my previous snippet above. Thats what tricks most ppl ..... good idea from Egoiste :D

It's still same old te!lock and you can unpack in 10 mins if you know about the te! tricks like mapping the IAT and destoying and the FFFF section count etc. I have repeated myself many times explaining how to MANUALLY fix tE! locked targets.... and others :D .That's why I am here !. I made several tuts for discompress.com on many different protectors/packers (sadly gone from the server since woodmann changed ISP a few weeks ago)

So yes, for tE!locked targets maybe you don't need RV but sometimes it's quicker to tag on a new IAT/IT instead of catching
the real one and copy+pasting it .... or even do both methods for practise ,whatever

I will NEVER release any Keygens or Auto-unpackers for the masses. Thats my policy now. Maybe a few select cracks for
some anal retentive programmers targets ??? They know who they are :D

But I think you fixed Iris3.5 now anyway :cool: ...............congrats.

+Spl/\j
evaluator
09-25-2001, 12:01 PM
Dear +SplAj!
I am shaked! So I jumped over two protection?!! Comic!
Please, excuse me, tE!Lock.

+SplAj, tell me please, were I can find tutorials about assemblers instructions,
for better understanding debug process. I can understand only jmp and call instructions (& nop:),
but what means these pop, push, xor, etc.?
By the way, from what country are you?
+SplAj
09-26-2001, 03:30 AM
Ok ASM.... the masters are Hutch , EliCZ , Iczelion etc etc........ and they hang out at W32asm.cjb.net

Get MASM and the tuts from Iczelion and your away. The forum is super duper too....but DONT say your into RCE cos they are a bit anal about our fine art (regardless of the fact that they do it as well but not in public) . Make a new handle for that forum ;) ....... they are ace guys and many others are there willing to help with ASM as well....

BTW do a search in google and you'll find the Great Me :D

Spl/\j
Kayaker
09-26-2001, 11:33 PM
Originally posted by +SplAj

BTW do a search in google and you'll find the Great Me :D

Spl/\j

Hey Spl/\j, what's the radio frequency? :)


HomeSite 4.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HomeSite 4.5
PDA

View Full Version : HomeSite 4.5

Argoth
09-22-2001, 06:30 PM
I might need some help with HomeSite 4.5. I just need something so I can start examining the code. My problems:

- I can't disassemble with w32dasm
- I can't set any bpx ( It doesn't work, only API functions will break)

Thats about it, does anyone know some more about the HomeSite protection?

Grtz

Argoth
Fake51
09-23-2001, 04:46 AM
Hi

Well, far as I remember the Homesite protection is rather weak, but I'm not sure whether they updated it or not. Cracking version 4.0 was a walk in the park.
Anyway, check Tsehp's mirror for a tut on homesite. It'll tell you something like "check the target with regmon" to find the counter.
Will have a look at it myself, would be fun to see if they changed their protection.

Fake
Argoth
09-28-2001, 07:23 PM
Only, where is thehp's page? I tried tsehp.cjb.net, but it's not there

Grtz

Argoth
Woodmann
09-28-2001, 07:29 PM
Howdy Argoth,
woodmann.com is the main site.

Peace, Woodmann
Fake51
09-29-2001, 03:53 AM
It's very easy to get at Homesite, tried the new version myself. Basically it just keeps a counter in the registry, where it stores the # of days left. The # doesn't start at 60 (60-day trial) but something different. To get a 40060 day trial, just add 40000 to that #. Use regmon to catch the call (hint, they are stupid enuff to check the value every time u open the about box).
The rest is not the big deal. Remove the splash by checking the createwindowexa calls and then kill the one that shows the nag. That's pretty much all there is to it

Fake


Commandos II: SafeDisc protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Commandos II: SafeDisc protection
PDA

View Full Version : Commandos II: SafeDisc protection

Solomon
09-23-2001, 02:31 AM
I got the 3-CD release from FLT. They don't remove the SafeDisc protection, only 3 BIN/CUE images. This one gives me a big headache. Currently I'm reading the tuts from cdchecks.cjb.net.

Nice to get your help
DakienDX
09-23-2001, 03:13 AM
Hello Solomon !

What SafeDisc version is it?
Do you want to crack it yourself or just get a copy not needing the CD?
Do the 3 CDs work to run the game?
Solomon
09-23-2001, 03:37 AM
I use daemon-tools to open the BIN/CUE then install it. After installation the main prog is a single 8MB exe. The bytes exactly following the magic string "BoG_ *90.0&!! Yy>" are:
00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 1E 00 00 00 21 00 00 00. According to ArthaXerX¨¨s, this is the version number(h**p://w*w.yates2k.co.uk/cd/artha_safedisc.html).

Someone else has burned it to CD and it runs well.

I just want a good copy(cracking requests?:rolleyes: ) coz it will cost me a lot of time to crack it by myself. I will try burning it into CD first.

BTW: this is really a great game. I will buy it later;)
Solomon
09-23-2001, 04:47 AM
FLT provides working crack in CD3.
my fault:D
DakienDX
09-23-2001, 07:02 AM
Hello Solomon !

This could have happened to anybody ! :D
But remember, if there is an update for Commandos II, it'll only run with a working CD, since it's protected again by SafeDisc.
So best is to burn a working copy AND crack it to run without CD yourself, so you don't have to wait some days until someone has released a crack.
Bengaly
09-26-2001, 05:21 AM
heya...
Also u can try the Unpacker by R!SC,
It will Unpack the latest SafeDisc Protection and all the mapping stuff...
Get it and try it on Commandos.

Get the unpacker here :
www.gamecopyworld.com
---------------------------------------
Have fun :-)


installshield 6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > installshield 6
PDA

View Full Version : installshield 6

deadkid
09-23-2001, 06:47 AM
i have lightwave 7 by -=T R i N i T Y=-
You must do the following instructions or setup will fail
At the "Select Components" screen
Select everything "except Content and Sentinel drivers"
im using (i6comp by:fossil & morlac) to decompile the data1.cab
i want to make it so that Content & Sentinel drivers are nolonger an option...
but im not sure what file to edit in installshield to change the options
i cant seem to find any setup.ins script to decompile....Any ideas
DakienDX
09-23-2001, 07:23 AM
Hello deadkid !

1.: Don't ask how to get cracks working !

2.: Can you read (can't you?) "Please, no Crack or Serial requests as it offends our intelligence"

3.: As InstallShield is no reversing tool, this post belongs to none of the forums, apart from "General considerations, off topic problems, Humor, Flames" perahps, try it. (Check it, your deleted topic could be here.)

4.: You can't use i6comp to decompile DATA1.CAB, just to unpack it.

5.: I've never heard that someone patched a SETUP.INS. They just created a new project and took the SETUP.INS from that project.

6.: Are you sure if it's InstallShield 6 if you've no SETUP.INS? You could look for a .MSI file. Then it can be ANY installation system which supports the Windows Installer Service.
tsehp
09-24-2001, 07:33 AM
Originally posted by DakienDX
Hello deadkid !

5.: I've never heard that someone patched a SETUP.INS. They just created a new project and took the SETUP.INS from that project.

you can, it's some compiled script language with tokens, read my borland c++ essay and other installshield related.
DakienDX
09-24-2001, 10:46 AM
Hello tsehp !

I don't know your Borland C++ essay. Where can I find it? (I'm to lazy to search)
Well, a BASIC interpreter is also some kind of compiled script language, but it's easier to understand. :) (source code appended to the interpreter and compiled at runtime)
But since the .INS file structure isn't so well documented (I personally know no document) I thought it would be easier to create a new project and use it's SETUP.INS.

Sorry, but I was confused about THAT kind of post !
goatass
09-24-2001, 01:03 PM
Hey guys, InstallShield version 6 and up uses .INX files not .INS files, they are very similar in structure but different that's why there is no decompilers for the .INX files. As for changing the options for the installation, creating a new project with the InstallShield SDK is my suggested approach. Make sure you used the same version SDK as the installer used by the application.

That's just my opinion.

Goatass
DakienDX
09-24-2001, 01:58 PM
Hello goatass !

I have a decompiler for .INX files. :)

What's the difference between InstallShield and InstallShield SDK?
goatass
09-24-2001, 03:31 PM
well it depends what you call what. I refer to InstallShield as the installer that you execute when you want to install something. The installshield SDK I refer to the tool you get from InstallShield site to make your own installations.

BTW, you mind sharing with the rest of us your decompiler for the .INX files ?? The one's I've seen don't work.

goatass
deadkid
09-24-2001, 07:55 PM
isDcc 2 by Mr. Smith.
http://protools.cjb.net/
This is a slightly extended version of Andrew de Quinceys installshield decompiler.
Kythen
09-24-2001, 10:18 PM
First of all, there is an IS6 decompiler, and a good one at that. Get ISD from h**p://nekosuki.virtualave.net

Second, unless you really know what you're doing, changing an IS script is not the best way to go. If you're doing this to learn about IS and INS/INX files, then by all means go ahead and explore. If you're just doing it to make LW7 easier to install for your friends though, don't bother. Just use it as the group released it. Chances are very good they made it that way for a reason.

Regards,
Kythen
DakienDX
09-25-2001, 12:53 PM
Hello goatass !

I meant ISD when talking about a .INX decompiler. I found it somewhen on w*w.suddendischarge.com. I've nerver used it to decompile a .INX for some purpose, just to see if it's working and put it then to my "OTHER" directory.

Hello Kythen !

I didn't know the address of ISD's homepage, but the version there is the same I have from w*w.suddendischarge.com. It's listings look in a way of chaos. I don't know if InstallShield accepts this listings, I've never tried it.

Hello deadkid !

Why don't you buy LightWave 7? It can't be SO expensive. It's only protected by ONE dongle. Have you thought of buying InstallShield? With East and West Language Packs you should get a single user licence for only $7.000

At this point I want to thank Preacher and The Archivist.
They kept up Suddendischarge for so long time. Tragically their server's harddisc has crashed and it's down now and the tools are lost. I wish them all luck they can get to find a new server.

Memories to their work will always remain in our hearts.


Demo watermark in printout and object copy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Demo watermark in printout and object copy
PDA

View Full Version : Demo watermark in printout and object copy

MuT
09-23-2001, 09:45 PM
I've got a demo soft. for making engineering calculation sheets. It contains blank forms, similar to MathCAD, and spreadsheets, similar to Excel. The objects on the blank form can be equations, texts (eg.imported from MS-Word), charts, or pictures. The equations can also be linked to its spreadsheets.

I've studied this demo for some time and so far found that it's equipped with the following protections:
1. nag screen with 30-day time limit.
2. the created files can't be reopened.
3. can't create more than 1 form and 1 sheet.
4. can't protect the spreadsheet cells.
5. put unregistered msg. with the printouts and all the objects copied.

The soft. is coded using Delphi. Recently released patch by FCN cleared only 1. I've already removed 1, 3 and found a workaround for 2. 4 isn't important to me. What's important is 5, which I can't find the text that is used in the watermark anywhere. The objects pasted in Word appear with the mssg. in picture format. How to deal with this? How is the message inserted in the object we copy? TIA.

Best regards,
tsehp
09-24-2001, 07:36 AM
you answered by yourself, it's in picture format.

So you better look for some bitmap related api used :
BitBlt
CreateBitmap
CreateBitmapIndirect
CreateCompatibleBitmap
LoadBitmap

and some other related to device context
look at win docs and check some essays related to anti advertisement
DakienDX
09-24-2001, 10:32 AM
Hello MuT !

You could load the .EXE into a resource-editor and look at all bitmaps. It may take some time, but if you're lucky you can search for the resource id. It could be used by "Push 0000xxxx" (where xxxx=hex resource id) or by "Mov EAX, 0000xxxx".
If you haven't so much luck and it has a recource id of 0,1,2,... you could search it forever. In this chase I would use tsehp's method, too.
(searching for "Push 00000000" will get many search results :) )
MuT
09-24-2001, 08:54 PM
Hi,

I also thought about this and already checked the resource but didn't find the watermark. What're other possible ways to embed the bitmap into their soft. I'm not familiar with Delphi. Just wonder if it's Delphi that complicates this. Thanks for all suggestions.

Best regards
MuT
09-25-2001, 07:36 PM
Hi all,

After all I found it using resource editor. It's a picture assignment in TMAINFORM under RCDATA. Previously I looked only in the long BITMAP section. After removing the assignment, everything looks OK. Thanks for the guidance.

Best regards
chronos
12-24-2004, 02:37 AM
Hi, I am working on an application for creating cartoon animations (can be exported as a Flash or QuickTime movie). I've successfully removed the time trial limitation but I can't defeat the watermark. In all exported movies, it has a "TBS" watermark but I can't find it in the string references or the bitmap resource.

Is there a way to embed an image in the program itself? If so, are there any tools that can aid me in location the images? So far, I've used Resource Hacker and exescope but can't locate the images.

Thanks for the help.
Silver
12-24-2004, 07:40 AM
Necrophilia is bad...

It is trivial to create a bitmap in memory directly from code. For example, the bitrmap data itself may be in some enciphered format somewhere in the exe. A section of code simply creates some heap space, adds a bmp header, deciphers the bitmap data and then uses it as required. There is absolutely no need to embed the entire bitmap as a resource etc. Perhaps you should look for API calls that deal with manipulating gfx rather than loading them (Bitblt etc).
naides
12-24-2004, 08:47 AM
Disagree with Silver: Necrophilia has its charms. . .
At least Chronos searched the board, and found one thread somewhat related to his problem, so at least he did not revived the corpse to say: "Great thread, thank you" as it is customary.
JMI
12-24-2004, 11:22 AM
chronos was doing what with the dead? And on Christmas Eve. Oh the shame of it all. :devil:

Regards,
chronos
12-26-2004, 08:53 PM
lol you guys are unbelievable :P


Softice Startup
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice Startup
PDA

View Full Version : Softice Startup

Tech
09-24-2001, 02:41 AM
When I installed softice I chose to have it startup with windows(win2k) but now I want it so I have to manually start it up every time as some programs I use quite often have shortcuts on the CTRL+D key so how can I make it so I have to manually start it every time I want to use it?
DakienDX
09-24-2001, 10:35 AM
Hello Tech !

Well, it shouldn't be to difficult. Just go to your "NuMega SoftICE" program group in the startmenu and change the default startup method there. I hope you haven't deleted it. If you have, you must configure the softice service to start manually in the service manager.
You can start SoftICE by executing "NET START NTICE" (i think it was "NTICE", I'm using Win98 :) )
Kayaker
09-24-2001, 01:32 PM
Even better, use the ALTKEY command to change the default hot-key from Ctrl-D, then you've always got Softice charged up and raring to go ;)

Kayaker


Viva, manual unprotecting!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Viva, manual unprotecting!
PDA

View Full Version : Viva, manual unprotecting!

evaluator
09-24-2001, 01:45 PM
Hello!
Here I present manually unprotected program:
TMGs "Kawa v5.0 Professional Edition Keygenerator"
Search & download it from WWW.CRACKS.AM

This program is protected by unknown protector (for me; If You know, tell me).
Can be TMGs internal protector or tE!Lock internal release. Made by Hackers, unprotected by newbie 8-)
With these tools I do nothing:
GUW
IMPREC
REVIRGIN
PROCDUMP

So good protector. But!
Also main program perform new (for me) kind of protection: data section entries mangle.
(?mangle is correct word here?) See file heheKawa.exe. Hehe, what tool can recover data!?
So problem can solve in one way: debug, catch in memory original rdata and data sections
before they will modified and dump them. (OEP also needed). Also base relocation table in memory erased,
so I not erase last section and paste relocs from original file, but then (just for funny)
I insert in last section deprotector code also dumped from memory! For proof's analyze!
I only can't handle "great" icon problem on file "property tab". Teach me!

So I am interesting:
1. Authors of Imprec and Revirgin: Your comments about TMGs prog!
Maybe your programs filed because PE-header is very funny corrupted?
2. Newbies (like me): lets make competition in manual unpacking! (Can you do this?:)
3. What protector is? Hey, TMG! Tell something!
4. Are my IT & IAT values in header correct?
5. Tell me, what other hard anti debugger protector like this and like PCGuard;) you know and
lets unprotect interesting program protected with that protector.

Best regards!
& sorry for eNgLiSh!
evaluator
09-25-2001, 12:08 PM
UnPack 2.2 detected protector as tE!Lock, but included 7 unprotectors
can't unprotect this file. Also unti-debuger code is more hard then tE!Lock v0.90 has!
So internal version can be!

Dear tE!
If you read this, please, point me to program protected with latest INTERNAL version of tE!Lock.
I am very interested, can I jump over protection?
Also, excuse me for mistake about TMGs internal protector and tE!Lock internal version!
tE!Lock is from TMG
CoDe_InSiDe
09-26-2001, 12:49 AM
Hi evaluator,

Wow long time i posted here ;)
Anyway i've looked at it (just a quick look) and it seems it's either some new or atleast not a public version of tElock :)
Or it's another Packer/Encrypter that looks like tElock, if so i think Inferno made it because of the string "Coypright (c) 2000 by Inferno [TMG]" ;)
This string can also be for the Keygen but i don't think so hehe ;)

Cya...

CoDe_InSiDe
CoDe_InSiDe
09-26-2001, 02:11 AM
Hi evaluator,

Ok, i Unpacked the file and took a little closer look and it's probably indeed tElock but a version i don't know ;)

(Maybe tE made a non-public version for TMG? :) )

Cya...

CoDe_InSiDe
evaluator
09-26-2001, 01:31 PM
Thanks for replay, CoDe_InSiDe!

How you think, this is hard anti-debugger code or no?
If you know about more hard anti-debugger protection, tell me please.

I compared tE!Locks unprotector code end this unknown and found only one common string:
GDI32.DLLUSER32.DLLSHELL32.DLLKERNEL32.DLL

But not name is actual here, actual is this: nor ImpRec, nor Revirgin 1.1.1.18 can't do
anything with this proggie! Even if you give them true values (grab from my file).
What's happen?
ImpRecs and Revirgins authors: it is not actual?
CoDe_InSiDe
09-27-2001, 12:31 AM
Hi evaluator,

Hard Anti-Debugger? no it's simple you don't even need ImpRec or Revirgin (well if you maybe want to Unpack it "fast" then you can use them ;) )
I Unpacked it without them and you can easily bypass the protections :)
The Decryption Code is a little different then normal tElock (for example ebp = 'BCHK' , eax = 00000004 , int03 i can't remember this from tElock but i also haven't checked the old versions good enough yet ;)

Btw, you've Unpacked the file right? Same way as me then probably without both tools since you're saying they can't handle it ;)

Cya...

CoDe_InSiDe
tE!
09-27-2001, 10:30 PM
that one's a private version assembled for inferno/tmg.
one out of +35 different versions in the meanwhile. i think
i start loosing digest. for most versions, differences are very
small but there're a few which are a lot different. most versions
are not released to public and never will.

as i state in telock's help file i don't keep sources of old
or modified versions, coz they're of no use for me. furthermore
i don't keep copies of private compilations i made, that's
why i can't point you to "TMG internal" version(s), evaluator.

in the meanwhile i'm @ v1.1 and have to send some thank
you's over to you guys here. you helped me to improve a
lot of things. before anyone asks now where to get new a
version...you don't need it. sooner or later you will run
into it while cracking a shareware prog or something.

also, this telock project starts to beome very very boring.
no clue if i will go on working on it.

tE!
evaluator
09-27-2001, 11:14 PM
Hi, CoDe_InSiDe!

1. Are you newbie??

2. I wrote about ImpRec & Revirgin because they can't handle this program
and it maybe is actual for programmers. Also try you and tell me results.

3. So you can't tell me about some other protector with hard anti-debugger code. Or can?

4. Go to my other post and try manually unpack "PCGuard 4.03 Demo".
Then tell me how you do it, what tools you use, is PCGuard hard protector or no.

16h. I tryed to to post it!
CoDe_InSiDe
09-28-2001, 03:18 AM
Hi tE! / evaluator,

tE!:
Argh, all those versions :D
It would be a pitty if you stop working on tElock.
Maybe you can try to find some new fresh interesting stuff ;)

evaluator:
1. Ofcourse, who isn't ;)

2. I don't like to use ImpRec or Revirgin (Sorry Mack_T/Tsehp ;) ) they're good tools but i simply don't like to use them :)

3. Hmm, Hard Anti-Debugger Code... Maybe you can try PE-Protect v0.9, it's a rather old one but a good one if i can remember it correctly ;)

4. PC Guard v4.03 DEMO, hmm i've never really tried PC Guard, i will do that sometime dunno when ;)

Cya...

CoDe_InSiDe
evaluator
09-28-2001, 10:01 AM
Thanks, tE! for your replay!

With tELock v0.90 anti-debug code I have no problem. (backdoorz?:)
Infernos version looks little better.

CoDe_InSiDe!
I already tried Pe-Prot. It's out of my little knowledge.
I don't know ASM instructions (except jmp, call, ret, nop) and
registers window in debugger is Magic for me!
I only found one little trick for jump over anti-debug code and it not works as yet with Pe-Prot.
If you know, point me to easy for understand tutorials about ASM and debug.
Thanks!


ViaTech eLicense System
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ViaTech eLicense System
PDA

View Full Version : ViaTech eLicense System

xor37h
09-25-2001, 07:33 PM
Hi people,

I got some questions concerning ViaTech's eLicense System, I hope you can help me out, or atleast give me some ideas.

How can I locate the ProductID, VendorID and Password for an eLicense wrapped application ?

I know that eLicense is using RC5 along with some custom cipher, is it an standard RC5 implementation, do you have any information on their custom encryption ?

Thanks, xor37h
Woodmann
09-25-2001, 08:53 PM
Please do some more research. You have to make some kind of an effort and show your work.
What have you done so far?

Peace, Woodmann
xor37h
09-25-2001, 11:54 PM
Thanks for your reply Woodmann,

Well I guess that I have done what most everyone have done when cracking eLicense targets, that being unpacking them to remove the server license layer.

This is in itself not a big challenge, nor is it anything which requires a big deal of skill or efford.

I dont really feel that I have anything to show or anything to prove on this issue, it was just a request for comments from anyone who might have done some true reverse engineering on this matter.

Have a nice day, xor37h
Kythen
09-26-2001, 12:46 AM
Hmmm RC5 you say? May have to have a look sometime when I get a chance. Have you found anything so far or just doing research and seeing what others have found already?

Oh and btw... I don't think you really have to prove/show anything xor37h. There are enough of us around that know what you do :) (Thanks for sharing those keygen sources!)

Regards,
Kythen
Croma
10-29-2001, 06:13 PM
Hi xor37h,
i'm studying eLicense protection.
i'm trying to get ProdID, VendID and Password from encrypted exe.
i'm finishing a sort of Proxy to answer with a fake but good license everytime the program ask for it.
i need these ID and password to generate the good license.
i would be very happy to our knowledgement about eLicense with you.

Greets,
Croma
Woodmann
10-29-2001, 08:03 PM
Originally posted by Kythen

Oh and btw... I don't think you really have to prove/show anything xor37h. There are enough of us around that know what you do :) (Thanks for sharing those keygen sources!)

Regards,
Kythen

xor37h,
Sorry for the pissy reply earlier. I knew not what you have done. If you still desire, I shall look and see what I have concerning ViaTech.

Regards, Woodmann
peterg70
11-04-2001, 10:51 PM
Hmmmm

Damn release a proxy elicense software which has an INI file with it.

These have the Codes and passwords to register each software.

Might be worth downloading them and tracing through to find the codes and cross compare.

Anyway Damn have a working elicense proxy server. for 3 products (the version i have)

Maybe name the target so we can have a look
Muad'Dib
11-06-2001, 07:33 PM
I've done a bit of work on eLicense myself. I haven't reversed for over 2 months due to more important obligations, but you can (or used to be able to, its still around) get the demo eLicense packager from the ViaTech site. It also comes with something that will remove licenses from your computer if you know the product number. I recommend you reverse that program and see which database(?) it queries to find out which license goes with which license number. It shouldn't be too hard, I was just starting to work on it before i stopped reversing for a while...maybe I will start again soon.
Woodmann
11-06-2001, 08:40 PM
Nice to see you Muad'Dib

Peace, Woodmann


Tips pointers for cracking a crypted license file type protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tips pointers for cracking a crypted license file type protection
PDA

View Full Version : Tips pointers for cracking a crypted license file type protection

SuperCali
09-25-2001, 09:09 PM
Hello,
I was wondering if anyone could give me some pointers on cracking software with license files with crypted keys. I am trying to crack one such program now but am not making any real advances. The license file consits of ones name and email (cleartext) and a key. This file is then used to determin what one can and cannot do in the program i.e. add new templates, save them, max templates etc. Also the temporary license I have is one month.

What I've done so far is manage to remove the time-limit and get the program to load without the keyfile. This however sucks as all options are set to off and the expire date is set to feb 1979 or something like that, although the check is removed? So the two options as I see them are:
1. Keygen it, or at least make it accept a key of your choice.
Harder for me as it would probably require me to break the key right?

2. Make it set all options on no matter what key is used.
me thinks this will eb easier... or?

The problem is the methodology, any tips would be greatly appreciated. Are there any special calls I should breakpoint etc. etc. From what I've seen parts of the protection are really lame, which makes me even lamer for not being able to crack it ;). The program is pretty much commented like a book so finding the time expire etc. wasn't a problem. I know this was a bit vague but I am looking for any general pointers as I am still a newbie.

// SuperCali
DakienDX
09-26-2001, 10:46 AM
Hello SuperCali !

Can you tell us what target you're talking about?
If you can't, please tell us what programming language it was written in and how the key looks like? (hex, base64, decimal, binary, ...)

You could try to set BPX on CreateFileA for example. If there's something like "CheckKey=831268015600825612" in the keyfile, you should set and BPM on the memory location where "CheckKey" is stored. You could find some algorithm this way which converts the key into some binary data which can be checked for "x-bit set" or "divisible by x" or something like that. (I don't think there is a code like

Cmp Byte Ptr [Key+5], "E"
Je AllOptionsEnabled
Cmp Byte Ptr [Key+5], "D"
Je AllOptionsDisabled

this in the program. :) )
I hope this will help you.
SuperCali
09-26-2001, 12:23 PM
Hello,
The program is ms visual c++ 6.0. The key is in the following format, although I cannot find it in the keyfile itself, only in the program about box:

HEX:

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

Having looked closer at the keyfile (xxx.dat) it seems to me that it is infact a dll. I need have a closer look at the target. I could post the target on my site and email you the link if you want to have a look for yourself. Well I try what you have suggested and have a closer look and see what more I can do. Thanks for the help.

// SuperCali
SuperCali
09-27-2001, 09:59 PM
Hello,
Well I have had a closer look (and found another way to make it accept any key, but alas same problem... no options :( ). I have managed to add some options although they are not permanent, so the settings arn't saved :(. The crypto it uses is either RSA or MD4/5, which I am not sure as it seems to use both. The problem is that crypt algo support is builtin in the program and used not only for the license key. I have found the place where it calls the RSA and MD5 routines but I am having serious problems understanding the code in those sections.

question:

mov eax, dword ptr [eax+00000560]

How do I see what address eax+560 is pointing to?

// SuperCali
DakienDX
09-28-2001, 08:36 AM
Hello SuperCali !

In case it's RSA or MD4/MD5 and you have to leave the crypto part intact, I can't tell you much how to work further, but you could now post the target and a download location, or, if you don't like, post no target and send the location via email to me.
I can't say if I can do anything, since RSA is a special problem which may take forever to reverse and MD4/MD5 are one way functions, but I can try to help you.
CoDe_InSiDe
09-28-2001, 08:49 AM
Hi SuperCali,

"question:

mov eax, dword ptr [eax+00000560]

How do I see what address eax+560 is pointing to? "

in SoftICE type "d eax+560" ;)

Cya...

CoDe_InSiDe
SuperCali
09-28-2001, 02:42 PM
Hello,
OK thanks for your help so far anyhow. Here is a link to the file (c.a. 4.5Mb) :

h**p://www.lotr.nu/target.ace

// SuperCali
DakienDX
09-29-2001, 05:10 AM
Hello SuperCali !

The program isn't a so difficult target at all. It has it's registration information stored plaintext in the license file. It uses RSA-2048 to check if it's valid. Since it's nearly impossible to reverse RSA-2048 in the next 100,200,300,... years, you need to patch one (exactly three :) ) byte and the check if the license file is valid has disappeared. Now you can edit the license information to what you like to.

I've done the patches so far, if you want me to send you the patched license file please let me know.
SuperCali
09-29-2001, 08:24 AM
Thanks for having a look, and for the information. I will have another look at the program and see if I can crack it myself. At least I know it's possible now ;). The problem is I am using trw instead of softice and am still getting use to it, so that might be what is complecating the whole thing. I will give it another shot before I ask you to send the file. Thanks.

// SuperCali
DakienDX
09-29-2001, 11:56 AM
Hello SuperCali !

Good to know not all people accept cracks without asking deeper how they work. You need not to use SoftICE, of course you can use TRW too (in my case TD and a hex-editor did the job :) )
SuperCali
09-29-2001, 03:19 PM
Hello,
I am still having problems with the target (forever newbie it seems, I should read more esays ;) ). Like I said before I have found the license check areas (multiple but only one seems to matter) at rva 0041A346, and that is where I'm concentrating my efforts. Am I on the right track or lost? There is one call at the above mentioned rva and then a check if eax = 1 then license does exsist so jump, then later there is another call and check, has license expired, if eax = 1 then no jump continue. My guess is that the program needs to be patched somewhere in one of the three of four calls inside 41A1D1. Well I would appreciate any hint if you can give one without making the answer to obvious. Thanks.

// SuperCali
DakienDX
09-30-2001, 04:19 AM
Hello SuperCali !

You're on the right way. You should follow 0041A1D1 until you reach many LIBEAY32-calls (MD5, RSA) in a subfunction. At the end there should be a "Sete AL". Just set it to "Xor EAX,EAX;Inc EAX" and the license file check is gone. (I hope I haven't said too much to help you). Now you can edit the license file. (One more hint: Change the expire date there, not in the .EXE)
SuperCali
09-30-2001, 03:18 PM
Hello,
Cracked it :)! Thanks ALOT for your help (maybe the last hint was to percise but I apprecitate it none the less). I have actually learnt quite alot from this target, but I wouldn't have without your help. Well so what did I do.

Well I did pretty much what you suggested. I then analized the enabling/disabling of the options. 19 options in all, each 2 bytes, fill with FFFFFFFF to enable (actually only the first three need be filled the others just require that one bit has a non-zero value) anything else to disable. I found the date but still don't quite get the format it is stored in, but I'll look at it closer now that I am done and see if I can't figure it out properly. Well now time to find another target to practice on.

// SuperCali
SuperCali
09-30-2001, 07:25 PM
Well had a closer look and the date seems to be encorperated into the key and thus one cannot make a generic patch for it as the "hex values" change according to the user info. Howevr one can make a patch by chaning the key user info to what one wants and the replcing the key fields and options fields with FFFFF etc. etc. This results in teh time limit being nullified.

// SuperCali
DakienDX
10-01-2001, 10:35 AM
Hello SuperCali !

Good to hear you've done it. I'm sorry I gave you the final hint, but when having a RSA_Verify and EAX can be 0 or 1 on return, there is not much I can hide from you. :)
I've found out that you can set complete block starting at the expire-offset and going over 84(dec) bytes to FF, so all checks I've found return "feature avaible" from now on. :)


wdasm8.93 segfault?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > wdasm8.93 segfault?
PDA

View Full Version : wdasm8.93 segfault?

macma
09-25-2001, 09:41 PM
Hi,
Has anyone ever had trouble with wdasm893 segfaulting (or whatever
the apropriate MS term is)? It happens under wine, and two separate
win98 installations I have.

It only happens on one particular program (4MB exe file), which I doubt
has any significant protection on it. All other programs dissassemble
fine.

cheers,
hanimex
CoDe_InSiDe
09-26-2001, 10:28 AM
Hi macma,

Well the file doesn't have to contain any protection but sometimes W32Dasm calculates values a bit wrong or performs some wrong actions on certain things :)
So i suggest to check the PE Header of that file very closely (just in case the whole file but the PE Header is probably the problem ;)
And try to find something strange...? :D

Cya...

CoDe_InSiDe
Bengaly
09-27-2001, 12:47 PM
hehe, heya...

always listen to code :)
but when checking the PE don't forget to check the RESOURCE size, ppl love to fuck it up for ANTI-32DASM trick ;D

I am used to that shit already ;D

Have fun..
macma
10-02-2001, 11:09 PM
Thanks, rebuilt header with LordPE10D.zip
and all is well!

Cheers,
Hanimex


Odds Wizard v1.33
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Odds Wizard v1.33
PDA

View Full Version : Odds Wizard v1.33

parma fan
09-26-2001, 07:22 PM
I am a newbie and I need help to crack this program.
To find out a serial is not a hard task.

Here's the problem:
1) When I press "File -> Register..." on a menu, program gives a new window with a single textbox to write a serial and to buttons "Close" and "Help".

2) When I enter a good serial for my computer the "Close" button turns into "Register!" button. Then I click on that new button and I get message "Your copy of Odds Wizard has successfully been registered!" I everything looks great.

3) But next time I run this program it tells me that it ain't registered and I have to do everything all over again.

Why does the program keep saying it ain't registered? I don't know what's wrong.

thanks
Solomon
09-26-2001, 11:59 PM
1. decompile it with DeDe.
2. Open "FairR.pas", see 2 suspicious routines£º
procedure TForm3.RegCodeEdChange(Sender: TObject);
procedure TForm3.Button3Click(Sender: TObject);

3. get a serial "84ADA957" at the following pos. This seems to be a fake serial? Or the prog never save the serial to registry/file, so you must input it every time when you want to use the full function? Have you tried its full functions with this serial before re-start it?

0047AA8A 8B1564784C00 mov edx, [$4C7864]
0047AA90 3B02 cmp eax, [edx] <-----------Here
0047AA92 7537 jnz 0047AACB

* Reference to pointer to GlobalVar_004C899C
|
0047AA94 A198784C00 mov eax, dword ptr [$4C7898]

* Reference to field GlobalVar_004C899C.OFFS_0174
|
0047AA99 80B87401000000 cmp byte ptr [eax+$0174], $00
0047AAA0 7529 jnz 0047AACB


Help me, about unaspack OCX !!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help me, about unaspack OCX !!!
PDA

View Full Version : Help me, about unaspack OCX !!!

wjy88
09-26-2001, 09:45 PM
hiya:
Why after I use unaspack unpack 1.091 a OCX ActiveControl (use aspack 2.11 pack) it can use in win98 but can't use in
win2000 ? I use "regsvr32 XXX.OCX" In win2000 Then the
system show a message "loadlibrary failed!".

The ActiveControl download site:
www.trustsoft.com/cell2000.exe (http://www.trustsoft.com/cell2000.exe)
Thanks
evaluator
09-27-2001, 01:46 AM
I have W98 but aniway try:
1. open your file in PEditor or some other pr. and correct checksum.
2. Try unpack it also with CASPR. Before unpack rename or move out caspr.ini,
then also correct checksum if needed
wjy88
09-27-2001, 01:51 AM
:)
wjy88
09-27-2001, 02:15 AM
Originally posted by evaluator
I have W98 but aniway try:
1. open your file in PEditor or some other pr. and correct checksum.
2. Try unpack it also with CASPR. Before unpack rename or move out caspr.ini,
then also correct checksum if needed
I DO SO.But Also Can't use.
Under win2000 use "regsvr32 xxx.ocx" .The System show a messagebox "xxx.ocx is not a executable file and no registration helper is registrered for this file type.":confused:
evaluator
09-27-2001, 11:26 PM
Last try: use sections characteristic wizard in
PEditor and try other values.
And if it not works:
If packed (original) OCX works under W2000, forget "Unpacking" and enjoy with ASPACK!


Unpacking Asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unpacking Asprotect
PDA

View Full Version : Unpacking Asprotect

Nitrus
09-27-2001, 12:21 PM
Welp using tsehp's new tools i decided to take a crack at my first ASPROTECT app. My target "IgooFTP". I had found the original entry point which was at (0047F732) and managed a successful dump of the image. The only thing that seems to be giving me trouble is the damn import table. I do believe i had found it at (0048A110) with a length of EF6, but i could be wrong. Any way I tried pasting it together and stuff, dump fixed all the sections, changed the directories, and the bugger still didn't work. Could someone be o-so kind enough to give this app a go and tell me if i have the whole import table? Thanks in advance, Nitrus.

PS. If you would like to help or you wish to see my dumped exe, email me @ fruityjunkie@hotmail.com.


Unpacking Asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unpacking Asprotect
PDA

View Full Version : Unpacking Asprotect

Nitrus
09-27-2001, 12:27 PM
Welp using tsehp's new tools i decided to take a crack at my first ASPROTECT app. My target "IgooFTP". I had found the original entry point which was at (0047F732) and managed a successful dump of the image. The only thing that seems to be giving me trouble is the damn import table. I do believe i had found it at (0048A110) with a length of EF6, but i could be wrong. Any way I tried pasting it together and stuff, dump fixed all the sections, changed the directories, and the bugger still didn't work. Could someone be o-so kind enough to give this app a go and tell me if i have the whole import table? Thanks in advance, Nitrus.

PS. If you would like to help or you wish to see my dumped exe, email me @ fruityjunkie@hotmail.com.
+SplAj
09-28-2001, 06:19 AM
Yes the OEiP is correct and the IAT starts at 0x8A000 see attached resolved.txt....

Needs a tidy up at the end , .NewSec at offset 0x174000 for IAT/IT

Kilby where R U :p .............

+Spl/\j :rolleyes:
Kilby
09-29-2001, 07:32 AM
Where am I, working as usual :(

Fighting with another packer, and wishing I had not been such a cabbage with iglooftp that evening (Hust call me Homer).

Anyway, on with work and my hunt for tasm again, due to losing my HD :(

Kilby...


Better then ASPR...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Better then ASPR...
PDA

View Full Version : Better then ASPR...

Nio-shai
09-27-2001, 07:50 PM
hi all
i'v being trying to unpack a prog that use a ASPR method but
after i have found the OEP and then dumped it i used RV to fix the AIT and RV found all API's and fixed it ...
BUT ...
when i tryed to run it , the prog didn't crashed or run ... (wired)
i traced the packed code and saw that after few calles it does
a : RET
the : RET takes us back to the packed file and then jumps to the code...
so i have found-out that the prog is doing this all over the code and i can't fix them all (there r too many of them..)
what can i do ??:(


Help on Hasp seeds & return codes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help on Hasp seeds & return codes
PDA

View Full Version : Help on Hasp seeds & return codes

cah
09-27-2001, 11:14 PM
How to find Seed codes & 4 return codes, if I have hasp dongle data like passwords, Id & memory contents.

Any tutor or help on this regard.

cah...
goatass
09-28-2001, 08:13 AM
Hey cah, I'm going to assume you are using HASP version 3 here since you didn't mention anything about the version. Anyways you have to locate the call to the hasp routine with service 2 and the parameters to this function are the 2 passwords, a seed code and the service number (2 for HaspCode). Once you located it write down the passwords and the seed code and find the util called UCLhasp and use it to generate the return codes or you can use ICEDump to do the same thing.

Normally when the hasp routine is called the service number will be in BH, the seed in AX, pass1 in CX and pass2 in DX. A good BPX to set in order to break in the main hasp routine is GetEnvironmentStringsA, F12 twice and you will be at the point where the routine stores the returned values (in your case the return codes). Trace down a bit more past the RET and you will be returned to the calling function, scroll up a little passed that call and you will see the passwords being pushed on the stack and the service number.

Well you need to do some reading so check out CrackZ site (link at the bottom of the MB) and read some papers on HASP.

goatass
CrackZ
09-28-2001, 05:34 PM
Hiya,

Better still, if you have the passwords, download haspedit.exe or use any of the win32 HASP test applications from Aladdin's site (also on any of the HASP CD's), plug in the passwords, the seed you want the return codes for and hey presto! click the HaspCode() button ;-).

Regards

CrackZ.
cah
09-29-2001, 04:11 AM
Reply to goatass & CrackZ,

Thanking you both for responses, I am very newbie for RE.

I opened haspedit.exe ( win32, v6.2) with pass1 & pass2, I got only hasp id, but no seed code & return codes. My doubt is: Is it possible to get seed code & return codes if I have hasp dongle?.
I am visiting regularly CrackZ’s site also, very useful for RE. I noted his tips & Hasp emulation code.

Hello! Mr. CrackZ,

I got a target NE file(AccuPrint v1.6), I don’t find much information on NE file format to lengthen code segment to insert hasp emulation code.

How to find hasp envelope & reverse it, if I have a dongle .
Can you tute me or any tips for me

cah...


Need help on HASP seeds & return codes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need help on HASP seeds & return codes
PDA

View Full Version : Need help on HASP seeds & return codes

cah
09-27-2001, 11:17 PM
How to find Seed codes & 4 return codes, if I have hasp dongle data like passwords, Id & memory contents.

Any tutor or help on this regard.

cah...
MeteO
10-11-2001, 07:40 PM
/**************************************************************************
*
* This code is only for demo and educational use!
*
* The HASP(R)codegenerator and its documentation are copyrighted by //UCL.
* All rights reserved.
*
* This is *complete* HASP seed code generator for NetHASP(TM), MacHASP(TM),
* DataHASP(TM), TimeHASP(TM), SerialHASP(TM), HASP36(TM), MemoHASP36(TM),
* NetHASP36(TM), OpenHASP(TM), HASPCard(TM) of Aladdin Knowledge Systems Ltd.
*
* (c)1998 by MeteO, Fixit
* e-mail us: meteo@null.net
* admin@fixit.spb.ru
*************************************************************************/

#include <stdio.h>

long pwd;
char al_buf[8];
static unsigned char ch[10];
unsigned int tab[64];
unsigned int seed,j,k;

HASP_rows[8][8]={
{0,0,0,0,0,0,0,0},
{0,1,0,1,0,1,0,1},
{1,0,1,0,1,0,1,0},
{0,0,1,1,0,0,1,1},
{1,1,0,0,1,1,0,0},
{0,0,0,0,1,1,1,1},
{1,1,1,1,0,0,0,0},
{1,1,1,1,1,1,1,1}
};

/***************************************
The table is represented as triads
***************************************/

void xor_pwd(void)
{
int i;

pwd^=0x09071966; /* Guess, whose birthday.. ;) */

for(i=0;i<8;i++)
{
al_buf[i]= pwd & 7;
pwd = pwd >> 3;
}
};

/***************************************
Main function (HASP_seed)
Original code by bajunny
****************************************/

void emulate_func2( unsigned short seed)
{
int i, j;

for(i=0;i<8;i++)
{
ch[i] = 0;
for(j=0;j<8;j++)
{
seed *= 0x1989;
seed += 5;
ch[i] |= (tab[(seed>>9)&0x3f]) << (7-j);
}
}
}

void main(void)
{
int i;
printf("\nInput 1st HASP password:");
scanf("%4X",(int*) &j);
printf("Input 2nd HASP password:");
scanf("%4X",(int*) &k);

pwd=(long) k*0x10000+j;
printf("\nInput HASP seedcode:");
scanf("%x", (int*) &seed);

xor_pwd();

/************************************
Compute universal secret table
*************************************/

for(i=0;i<8;i++){
for(j=0;j<8;j++){tab[i+j*8]=HASP_rows[al_buf[i]][j];}
}

for(i=0;i<8;i++){
for(j=0;j<8;j++){printf("%1.1d",tab[i*8+j]);}
printf("\n");
}

emulate_func2(seed);

for(i=0;i<4;i++)
{printf("%2.2X%2.2X ", ch[i*2+1],ch[i*2]);}

}

// ------------- end of transmission -----------------
cah
10-11-2001, 11:43 PM
Hayya, Mr. MeteO

Many thanks for your help & reply.
Can you help me, How to make hasp dongle emulator for particular flavour of hasp data. I hope you are very expert in this area. Please help me
cah...
MeteO
10-12-2001, 04:02 AM
See attach.
cah
10-14-2001, 11:16 AM
Many many thanks. I trying to complie it. I have doubts for asm compile. Already I sent personal mail to you. Please help me. I hope you will help me or give me make file

cah...


website capture tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > website capture tools
PDA

View Full Version : website capture tools

mike
09-28-2001, 11:18 AM
What are some good tools for grabbing an entire website, pictures & all?
UnderCover
09-28-2001, 09:42 PM
Teleport Pro search at at google.com
DakienDX
09-29-2001, 02:27 AM
Hello mike !

For downloading entire websites (viewing them offline) I would suggest GetRight Browser. It's included in GetRight (I think you know it :) )
(h**p://www.getright.com/get.html)
jomamameister
10-05-2001, 06:24 AM
Teleport Pro is very good. I can provide a p*tch for the latest if needed. pm me or email me.
jomamameister
http://www.google.com/ribbon2.gif
ThrawN
10-05-2001, 08:12 AM
Hmm i just use IE heh, it does the job - save website pictures an all ;) even can save it as one compressed file :)

ThrawN
donMAMAvomito
10-07-2001, 12:40 PM
greetings

its a personal choice..but i'd rather for webzip..

(options like .chm, .zip generations etc)

tremendous tool..get it from hxxp://www.spidersoft.com

(i suppose the latest is 4.1)...pm me for the crack or find it yourself..

best regards
donMAMAvomito
passing_lurker
10-07-2001, 07:57 PM
i like wget.

http://www.qtm.net/~twegscheid/wget.html might help if youre on win.


Loader for ASPr?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Loader for ASPr?
PDA

View Full Version : Loader for ASPr?

evaluator
09-29-2001, 05:06 AM
Ok, using ImpRec & revirgin we can "unpack" ASProtected file, disassemble and
reverse. But what after? You will distribute "Revirgined" file??
So we need special loader for asprotected programs.
I know only "Launcher Generator V 1.03" by T3X with messagebox. But it is like toy, not solid.
Is somebody working on this problem?

I think in some case this will useful:
In august I maked mammoth patch for DijiSecret (TamoSofts encryption program with 448bit-key)
in this comic way:
1. unpack with CASPR;
2. Crack;
3. Repack with ASPR1.2 (regged by SAC for SAC:);
4. Create patch file using WinPatch.
(maybe manually unpacked files are not supported for this way)

Now in newest programs Aspr code is slightly changed and this way maybe will not works.
But anyway, try it.
Fake51
09-29-2001, 03:56 PM
Firstly, distributing an unpacked file is not much of a problem, major concern is size. Secondly, unpacking, cracking, then repacking, seems to be going too far, considering what's needed. Instead, I'd suggest inline patching, either thru a loader, or thru a vxd. Ofcourse, if the program does a lot of crc'ing, that's gonna be a problem. But then the option of hooking dll's presents itself. This is one of the better options, since it's very hard for protections to guard against this.
In short, seems to me you gave yourself too much work.

Fake
evaluator
10-01-2001, 02:40 AM
Thanks for replay, Fake!

You wrote:
"I'd suggest inline patching, either thru a loader, or thru a vxd."
1. So, if you know a loader-maker, which can handle aspr(v1.2) protection, tell me!
(except "Launcher Generator V1.03")
2. Were I can find tutors about "inline patching... thru a vxd"?

My english is small and can't understand this:
"the option of hooking dll's presents itself."
"hooking dll's" is another method or "thru a vxd" method?
Please, try for me easy english.

You wrote:
"distributing an unpacked file is not much of a problem"
Under "distributing" I mean publishing a crack.
Read more about: "CRACKS.AM Crack Submission Rules"
Fake51
10-01-2001, 05:56 AM
1. I don't user loader makers myself. If I do go thru the process of making a loader, I code one myself.
2. Tuts about inlining can be found on tsehp's Fravia mirror
3. Hooking a dll (or actually hooking an API), means taking over the api. For instance, in the old days of vbox 4.02 and 4.03, it was possible to get around the vbox wrapping, without unwrapping the file. The method was, to take over the "LoadLibraryA" Api in Kernel32.dll, and check for the right call from the program. That way, it might be possible to patch the right part of the program, and change it back straight after it has been executed. Anyway, you'll also find tuts on hooking apis on Tsehp's mirror.
4. Thru a vxd. This is basically just the idea that, thru a vxd you can do anything you want. I usually use it to patch code, or hook an api. Since there are no limits to vxds (they run in ring-0), you can do what you want. Patching with a vxd might be along the lines of: waiting for the program to reach the right place, then patch it, and then perhaps repatch it to avoid crc checks. For more info on vxds, go to Iczelions homepage, win32asm.cjb.net

I hope this helps.

Fake
evaluator
10-01-2001, 08:29 AM
Thanks for replay, Fake!

Now I understand all you wrote.
And it is not for me, because! I am not programmer.
Now you also will understand, why I want loader.
+SplAj
10-01-2001, 09:17 AM
The logic of releasing cracks in 2001
=========================

Dear fellows of this fine institution;

In the good old days making your tiny patch file and spamming them out to the crack sites was great fun........especially receiving e-mails from desperate lamers pleading for the latest version of 'X' crack from you ;)

However, it seems today that the internet is dying. No revenue ==> No funds ==> No ISP's left ==> boring life in the real world is our destiny :-( It appears the only e-business model still working is the god old prono site. Even google lets you search for prono jpg's...... So it annoys me when I submit a crack to the likes of cracks.am etc etc to be bombarded with prono links everytime I research these sites for a ready made crack to compare them to my fine works of programming ;)
So by cracking targets we are helping some bastard earn cash.
Ok I can live with that.

But as a past upload 'member' I demand prono free crack access when I decide to d/l something I need. Also using 'certificates' before allowing access is something I abore - i.e. cracks.net

So , my planned action. Lets boycott sending our cracks until we get 'membership' of this money making enterprise :-)

A +Spl/\j get rich quicker scheme ;)
evaluator
10-10-2001, 01:14 PM
yO-yE!

Today I created a loader for asprotected program (DijiSecret 1.1 build 272)!!!
CASPRv1.100 can't handle this file.
And this is "standart" loader created by "DZA Patcher 1.3"!
NO "thru vxd" or "dll hooking"! (maybe this is "inline"? I'm not sure)
Because I don't know ASM (& any program language), please, help me
little:
I found (using HIEW) instruction code for write 1 byte in memory address:
mov b,[address],0XXh
But how I can write multiple bytes?
I tried this: mov d,[address],0(4byte)
but bytes are written reversed, even if I also reverse.

For example I want replace string "evaluation version" with:
"NotEpad is GrReat!"

It's hard to write for each byte 7 byte= 126byte!
Help me!
Also tell me if you know newest version of CASPR.

Resume: This fact possible means: Death of ASPR anti-loader future.
Clandestiny
10-10-2001, 06:41 PM
Originally posted by evaluator
yO-yE!

Today I created a loader for asprotected program (DijiSecret 1.1 build 272)!!!
CASPRv1.100 can't handle this file.
And this is "standart" loader created by "DZA Patcher 1.3"!
NO "thru vxd" or "dll hooking"! (maybe this is "inline"? I'm not sure)
Because I don't know ASM (& any program language), please, help me
little:
I found (using HIEW) instruction code for write 1 byte in memory address:
mov b,[address],0XXh
But how I can write multiple bytes?
I tried this: mov d,[address],0(4byte)
but bytes are written reversed, even if I also reverse.

For example I want replace string "evaluation version" with:
"NotEpad is GrReat!"

It's hard to write for each byte 7 byte= 126byte!
Help me!
Also tell me if you know newest version of CASPR.

Resume: This fact possible means: Death of ASPR anti-loader future.

/me shakes my head in disbelief...

WTF is this? ..."point and click" cracking?

Don't take this the wrong way Evaluator, but I think you're in a little over your head on Asprotect. Unpacking Asprotect is a little more involved than running CASPR (or any other auto-unpacking-magic) app on a target. Don't get me wrong here. I'm all for taking on challenges and reaching for knowledge beyond ones present ability... BUT without ANY knowledge of asm, programming, or basic memory addressing, you're like a blind man hoping to randomly stumble upon a solution. IMHO, you need to back up a step (or several) and begin at the beginning by learning asm and the PE format. Once you've mastered this knowledge, you'll have the foundation to try some of the more advanced RCE topics like anti-debug and unpacking. IMHO, RCE / cracking is *not* all about the glamor of realeasing "ready made patch for target X" with your name attached. It *is* about hard work, patience, self-education, and creative thinking. There are many kind people on this board willing to give of their precious free time to help and answer the questions of those seeking knowledge... There is no shame in being a newbie. BUT, how can you make use of the tips offered in response to your query on process patchers if you don't even know basic asm? IMO, if you're serious about learning this art of RCE, you need to begin at the beginning and build a good solid foundation for your knowledge. Admittedly, this is not glamorous. In fact its long, tedious, time-consuming, and difficult to teach yourself from ground zero up... Trust me, I know. But in the end it will be worth it.

/me steps down off my soapbox

I apologize in advance if this is a little off topic, but I just couldn't help throwing out my 2 cents after having followed this thread for some time.

Best Regards,
Clandestiny
Woodmann
10-10-2001, 08:37 PM
Greeting's all,

Clandestiny, I have very strong feelings about what you have written.

The basis of all I believe to be RCE is in knowing "the code". And of course some zen.

I do not want these comments to be mis-understood. I only want to re-inforce their importance.

I see too many who undertake projects above their abilities. If you want to progress then you must understand the most basic. This will only make you stronger in the future. I have been down the road of "please help me understand" and I was denied because I did not understand the basics of what I was trying to do.

Please, with all respect, don't jump into something that you do not have a basic understanding of. If others hold your hand and you do not possess the understanding of what you are trying to reverse, you will not gather knowledge, you will only gain a robotic response until you face your next challenge.

My future hopes are to start something that teaches the basics of the basics. I do not want anyone to stop "seeking", I only want you to have a greater understanding of what you are trying to do.

Peace, Woodmann


Missed magic moment with Icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Missed magic moment with Icedump
PDA

View Full Version : Missed magic moment with Icedump

evaluator
09-29-2001, 05:12 AM
If I start Winice and then load Icedump but don't set any bpx or bpm, protectors can't detect
Winice and normally runs! And I can trace in code and also can use /TRACEX command.
BUT!
If I only do this: set some breakpoint, immediately clear this breakpoint and...
Magic moment is missed! Now protectors crashes or detects Winice!
Same is with Frogice. So I can only: Restart.
What is a life without BP?
Can I solve this problem?
DakienDX
09-29-2001, 05:23 AM
Hello evaluator !

What SoftICE, ICEDump and Windows version are you using?
Which protectors detect SoftICE?
Are you running BoundsChecker in the background?
What type of breakpoint makes this happen?
Anything more interesting? (What's the color of you carpet, how big is your freezer,... :p )
evaluator
09-29-2001, 08:23 AM
Win98SE
winice v4.05 build 334
icedump v6.0.2.3
Breakpoints: BPM BPX
Protectors: tELock, PCGuard
I have not "BoundsChecker in the background" :)
Carpet color same as freezer, freezer lengs not same as carpet :(
DakienDX
09-29-2001, 11:57 AM
Hello evaluator !

I'll check if I can replicate the "error" on my computer. Please be patient. :)
(I've no SE of Win98, but the "error" could happen there too.)
evaluator
10-01-2001, 02:39 AM
DakienDX!

I think, this is GENERAL problem. BPMs not allowed!
Tell me, with newest versions of Winice is same problem?

Another magic:
So "PCGuard4.03Demo" crashes when I set "BPM 401000":
MSR LastExceptionToIp=0043F9BB

Ok, restart PC (& IceDump) and now set this BPs:
BPM 401000
BPX 43F9BB
Then press F5
Oops! Now it not crashes here and breaks on our BPM! Magic!
Press F5, again breaks on BPM, press F5 and..
Now it crashes in second layer: 4329BB (PCGWIN32.EXE is twice protected).
And now this magic trick (also BPX 4329BB) not works.

Ok, forget BPM. Now check how works BPX.
Restart PC (& IceDump), set:
BPX 41392B (it's OEP)
and press F5. "File damaged!"
Ok, clear BPX and set new:
BPX 432000 (here starts second layer)
Winice breaks. Make dump from 432000 to 43F000, then press F5. Program runs!
You will see in dumped file's first byte is "CC"! (in original FC)
Now we know, why we have error.

EXCLUSIVELY for you I upload 1 layer deprotected PCGWIN32.EXE :
http://www.geocities.com/teset_dowonlad/layer2.zip

PCGuard 4.03 Demo:
http://www.sofpro.com/files/demo/pcgw32d.zip
DakienDX
10-01-2001, 10:27 AM
Hello evalutor !

I'm using the same SoftICE version as you. I have none of these problems on my computer. All BPX/BPM work fine. So I can't help you much :(
Sorry. :(


3D Studio 4.2 and Safecast
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 3D Studio 4.2 and Safecast
PDA

View Full Version : 3D Studio 4.2 and Safecast

Silent
09-29-2001, 11:55 AM
1) i'm not quite sure wich version of safecast it uses, but since it creates a c:\cdilla i assume it uses safecast as protection. how can i find out the version number of this sc?

2) tfl put a stupid keygen on the cd instead of cracking this program. but the program hasn't a normal 'enter serial here' dialog, it opens a html-file that asks for the number. but it does not use the default-browser for this, it opens the file with IE. and this doesn't look good on my system, since i uninstalled everything that was part of IE.
looks pretty funny if you click on 'register' and a white page pops up with two radio-buttons in the middle but no images, text or anything else :). i tried to go through the registration process by opening the html-file with opera, but this didn't lead to a registered version, even if i saw the 'thanks for registering'-screen so,

3) this means i am not able to register it and therefore not able to execute this programm. is it possible to get rid of safecast without being able to run the target? (R!SC's unsafecast 2.02.40 only said 'random error' as i tried to dump it)

4) if it is possible, where can i find tuts or other additional informations about this protection besides the tut from tsehp 'Reset the time limit'?

ps: where can i get the latest unsafe*-files from R!SC? protools and player's tools seem to be down at the moment.
Argoth
10-05-2001, 06:01 AM
Ey,

Can't u just rename your browser's exe file into IE.exe and put it into the dir where IE is supposed to be? I don't know if this works (maybe you'll have to copy some dlls too), coz I still have my IE installed for this kind of occasions :)

Grtz

Argoth


Revirgin 1.2 Fails tracing Kernel32
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin 1.2 Fails tracing Kernel32
PDA

View Full Version : Revirgin 1.2 Fails tracing Kernel32

r00t
09-29-2001, 12:30 PM
I'm testing revirgin 1.2 beta 4 in my Windows 95 machine.
With all the programs i've problems with kernel32.dll, cannot detect any kernel32 api.
Even in the little list where are all the modules for that exe, kernel32 doesnt appear.
Maybe u can add a 'attach' module. I mean i can select the dll if i know the exe uses it.
I have the same problem with kernel32 when i use imprec 1.2, (btw: imrec 0.6 works fine, the problem is it cannot trace redirected apis).

Greets, and keep with the good work.
tsehp
09-29-2001, 06:22 PM
get at least win98, it's not tested on win95, much too old ;)


Vbox 4.6 ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vbox 4.6 ???
PDA

View Full Version : Vbox 4.6 ???

Dissektor
09-30-2001, 06:15 AM
Ran into this in Authorware 6 trail. tried previous essays 'bout v4.5 . dont work an crashes . looks like new encryptions.

Any help is welcome
meaculpa
01-23-2002, 04:04 AM
Hi,
Your assumptions are correct!
The newest version is 4.6.1, could someone please help us out
by supplying a Vbox Builder SDK of the newer versions (from 4.3 up).

Thanks in advance.

ciao,
Solomon
01-24-2002, 03:29 AM
I have tried Authorware 6 trial with ReVirgin & ImpREC, both can successfully resolve the API entries. Only 2 redirected have to be manually fixed.

IAT RVA API Name
240DA0 GetMessageA
24104C PeekMessageA

OEP = 61BA30, IAT RVA = 24095C, IAT Length = 814

my unpacked exe runs well. WeiJunLi has to work hard;)
+SplAj
01-24-2002, 04:31 AM
Hi Sol

What was the trick code that stopped IAT builders finding those API's ?

I am baulking at D/L 65megs just to DIY. Thanks.....

Spl/\j
Solomon
01-24-2002, 04:39 AM
hi SplAj,

here are the 2 redirected ones. The 2 "CALL 0700EB6E" are the trick. It's not a long journey to trace into this call.

:u *640da0 l 40
0023:0700EB50 CALL 0700EB6E
0023:0700EB55 PUSH DWORD PTR [ESP+10]
0023:0700EB59 PUSH DWORD PTR [ESP+10]
0023:0700EB5D PUSH DWORD PTR [ESP+10]
0023:0700EB61 PUSH DWORD PTR [ESP+10]
0023:0700EB65 CALL [USER32!GetMessageA]
0023:0700EB6B RET 0010

:u *64104c l 40
0023:0700EBBF PUSH EBP
0023:0700EBC0 MOV EBP,ESP
0023:0700EBC2 CALL 0700EB6E
0023:0700EBC7 PUSH DWORD PTR [EBP+18]
0023:0700EBCA PUSH DWORD PTR [EBP+14]
0023:0700EBCD PUSH DWORD PTR [EBP+10]
0023:0700EBD0 PUSH DWORD PTR [EBP+0C]
0023:0700EBD3 PUSH DWORD PTR [EBP+08]
0023:0700EBD6 CALL [USER32!PeekMessageA]
0023:0700EBDC POP EBP
0023:0700EBDD RET 0014


how can the register dialog be shown ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how can the register dialog be shown ?
PDA

View Full Version : how can the register dialog be shown ?

UnderCover
09-30-2001, 02:58 PM
Hi !

I got a program and i saw with exescope that it has a dialog to enter serial and click Ok to register ! but how can i see this dialog while the prog is running ? is there a way ?

tnx
Kayaker
09-30-2001, 09:59 PM
[Hi UnderCover

Ooh, hidden reg boxes. My favorite ;)

There may be a menu item or hotkey to call up the reg box, if indeed it has the code to do that. If it's a demo, the code to call up the reg box may have been removed, but the resource hasn't, so you still see it with Exescope.

If you're sure it's a fully functional app and the method to call up the reg box is purposely hidden, then you need to do a bit of exploring. Check the menu item resources with Exescope or WDasm and see if there are any listed that you don't see in the program, you may be able to enable the menu item and access the reg box.

Some hidden registration windows are part of the About box resource, there may be 1 or 2 hidden edit controls in the DialogBox. I remember one where you had to click on a bitmap 3 times to enable the hidden controls. Or maybe an accelerator key (Ctrl-R is a common lame one) might call it up.

You can try setting a 'BMSG <hwnd> WM_KEYDOWN or WM_COMMAND' on the About box and press some keys or mouse click on parts of the window and see if it breaks, meaning the Dialog code is monitoring for this kind of input.

If the proggy was really sneaky it might even look for a reg entry or keyfile that the author may have sent on registration, only then enabling access to the dialog box for serial number entry.

Couple of ideas anyway,

Kayaker
nchanta
10-01-2001, 01:04 AM
as kayaker mentioned, a keypress or click in about box in a weird place, is common place.

i tend to check with exescope under the 'Accelerator' tree option. It will show you all of the various combinations of keys that the author may be using. if there are more than a few, it gets tedious though ;P

NchantA
Solomon
10-01-2001, 01:10 AM
I don't think it's necessary to bring the hidden window/button to front. It's only a alternative.

If a prog can be registered, it must store the registration info somewhere in your disk, either in a file or in the registry.

If the reg info is stored in a file, just use FileMon to find it, then use "BPX CreateFileA" or "BPX GetPrivateProfileStringA" etc. to trace it.

If the reg info is stored in the registry, use RegMon to find the suspicious registry key, then "BPX RegQueryValueExA" to trace it.


/tracex crashing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > /tracex crashing
PDA

View Full Version : /tracex crashing

nchanta
10-01-2001, 01:33 AM
i have only come across this problem twice so far, but a new protector has been brought to my attention (non-commercial), that manages to crash /tracex every time. im just interested as to why/how this could be happening. Is it detecting icedump some how ???

NchantA

P.S i might be able to get a copt of a protected file uploaded with permission, if anybody has the want/need ;)
+SplAj
10-01-2001, 01:59 AM
Hi NchantA

Dont need icedump myself ................of course I do Owl , thanks ;)

Maybe the detection is a Timer bomb , single stepping sloooooows the code a lot, so a few appropriate timers in protected codewoods while you have a cup of coffee waiting for the /tracex range to pop ......well, the programmer could do terrible things to his own code if his Timer call returned more than a few milli-secs range ????

I don't see how they can detect 'Icedump' cos it's fully protected against any vxd access (like Bi-Tarts tried that one, duh :rolleyes: )

Maybe set a BPX SetTimer ? and trap it. Just a thought :-)

+Spl/\j
+SplAj
10-01-2001, 06:18 AM
in /tracex U R not in SI...... just stepping code slower....it's just a thought about timing detection difference from point 'A' in the code to point 'B' by me. We need the target to play with NchantA ;)

hey maybe we should delete this thread about defeating Icedump !!! :eek:

+Spl/\j
tsehp
10-01-2001, 04:58 PM
Yes NchantA, upload it there. I'll raise the max upload limit to 1meg for non starting members. This file interests me a lot as I am actually exactly protecting rv's tracer against detection.

cia,

tsehp
:D
nchanta
10-02-2001, 08:44 AM
;)

im waiting for the author to agree to give to u guys ;) s/he probably will, but i take no chances ;P

it is a beta i *think*, and just in case it was a fluke im going to try and tracex it again tonite :P
tsehp
10-06-2001, 07:53 PM
Originally posted by ArthaXerXes
Hey old man, how does rv behaves with Safedisc 2 and SecuROM ?

(the young man)

send me a sd2 cd or prog and I'll tell you;)
Unregistered
10-09-2001, 05:14 AM
hi dudes, u guys talk bout my protector *GRINS*
oh i can detect icedump (it's really easy)
iam almost sure that u guys already have the file...
so go and destruct it

^DAEMON^ [UG2000/MYTH]


Delphi serial check, any ideas on what to breakpoint?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Delphi serial check, any ideas on what to breakpoint?
PDA

View Full Version : Delphi serial check, any ideas on what to breakpoint?

SuperCali
10-01-2001, 04:22 PM
Hello,
Well done one target found the next, although it seems to be much harder :|. I am looking at the delphi target Muzicman 4.0 Build 909. The problem is I have no idea what to breakpoint to get close to the serial routine as the normal breakpoints don't work. There is no confirmation/acknowledgement of either wrong or right code to break on. I have also tried breaking on for example createfilea to see when it checks the license file (which I don't have) but no luck, I kinda get lost tracing routines that seem to have little to do with the license. Aslo alot of problems with the program crashing when certain bytes are patched. I would appreciate any help.

// SuperCali
The Philosopher
10-01-2001, 11:48 PM
Originally posted by SuperCali
Hello,
Well done one target found the next, although it seems to be much harder :|. I am looking at the delphi target Muzicman 4.0 Build 909. The problem is I have no idea what to breakpoint to get close to the serial routine as the normal breakpoints don't work. There is no confirmation/acknowledgement of either wrong or right code to break on.
// SuperCali

Hi

Did you try to use DaFixer's DeDe. If not try it. Everything is easier.
ftp.balbaro.com
Last version is 3.00b
Solomon
10-02-2001, 04:55 AM
The version in its web site is different: V4.0 Build 930.
h**p://w*w.muzicman.com/code/mzminstall.exe

Seems that this one can't be registered coz it will ALWAYS show "unregistered version" in its splash form(read the following code). I can't find where to enter the so-called serial number :(

Decompress it with UPX, then use DeDe to get the asm list:

procedure TSplashForm.FormShow(Sender: TObject);
begin
{
0052B074 push ebp
0052B075 mov ebp, esp
0052B077 push $00
0052B079 push $00
0052B07B push ebx
0052B07C mov ebx, eax
0052B07E xor eax, eax
0052B080 push ebp

* Possible String Reference to: 'ér‡íÿëë[YY]Ã'
|
0052B081 push $0052B0FD

***** TRY
|
0052B086 push dword ptr fs:[eax]
0052B089 mov fs:[eax], esp

* Possible String Reference to: 'Unregistered Version '
|
0052B08C push $0052B114
0052B091 lea eax, [ebp-$08]
0052B094 push eax
0052B095 mov eax, dword ptr [$572A6C]
0052B09A mov eax, [eax]
SuperCali
10-02-2001, 07:25 AM
First of all I'd like to say that the version I have is Build 925 or 927. See according to the site when I downloaded it said version 927, the program says 925 so I am unsure. There is a registration box under settigns, registration.

Well I've looked some more at teh target and it seems rather strange!? Once decompiled in IDA I found several references like "Please register etc" and a "entered serial number", howevere I can't find any place where these functions could be called from. I did however find one interesting function:

test eax, 80000000h
setz al
ret

at rva 40f1a5. However chaning this to for example setne crashes the program with wome strange error after inisilization. I would be willing to bet my right hand that it crashes due to some CRC like check, becuase the error message is something like, before the program terminates:

"Exception EOIeSystemErrror in module muzicman at 1152a5. The operation completed successfully. "

Also I found two routines called readownerkey and writeownerkey (in DeDe) which call the following code:

push ebp
CODE:00557205 mov ebp, esp
CODE:00557207 add esp, 0FFFFFEE0h
CODE:0055720D push ebx
CODE:0055720E xor edx, edx
CODE:00557210 mov [ebp+var_120], edx
CODE:00557216 xor eax, eax
CODE:00557218 push ebp
CODE:00557219 push offset loc_5572DC
CODE:0055721E push dword ptr fs:[eax]
CODE:00557221 mov fs:[eax], esp
CODE:00557224 push 1 ; uMode
CODE:00557226 call SetErrorMode
CODE:0055722B mov [ebp+uMode], eax
CODE:0055722E xor eax, eax
CODE:00557230 push ebp
CODE:00557231 push offset loc_5572BC
CODE:00557236 push dword ptr fs:[eax]
CODE:00557239 mov fs:[eax], esp
CODE:0055723C mov eax, ds:dword_574808
CODE:00557241 mov bl, [eax]
CODE:00557243 mov [ebp+VolumeNameBuffer], 0
CODE:0055724A push 0 ; nFileSystemNameSize
CODE:0055724C push 0 ; lpFileSystemNameBuffer
CODE:0055724E lea eax, [ebp+FileSystemFlags]
CODE:00557251 push eax ; lpFileSystemFlags
CODE:00557252 lea eax, [ebp+MaximumComponentLength]
CODE:00557255 push eax ; lpMaximumComponentLength
CODE:00557256 lea eax, [ebp+VolumeSerialNumber]
CODE:00557259 push eax ; lpVolumeSerialNumber
CODE:0055725A push 105h ; nVolumeNameSize
CODE:0055725F lea eax, [ebp+VolumeNameBuffer]
CODE:00557265 push eax ; lpVolumeNameBuffer
CODE:00557266 lea eax, [ebp+var_120]
CODE:0055726C mov edx, ebx
CODE:0055726E call sub_404024
CODE:00557273 lea eax, [ebp+var_120]
CODE:00557279 mov edx, offset loc_5572F4
CODE:0055727E call sub_404104
CODE:00557283 mov eax, [ebp+var_120]
CODE:00557289 call sub_4042C0
CODE:0055728E push eax ; lpRootPathName
CODE:0055728F call GetVolumeInformationA
CODE:00557294 test eax, eax
CODE:00557296 jz short loc_5572A0
CODE:00557298 mov eax, [ebp+VolumeSerialNumber]
CODE:0055729B mov [ebp+var_4], eax
CODE:0055729E jmp short loc_5572A5
CODE:005572A0 ; ---------------------------------------------------------------------------
CODE:005572A0
CODE:005572A0 loc_5572A0: ; CODE XREF: sub_557204+92j
CODE:005572A0 xor eax, eax
CODE:005572A2 mov [ebp+var_4], eax
CODE:005572A5
CODE:005572A5 loc_5572A5: ; CODE XREF: sub_557204+9Aj
CODE:005572A5 xor eax, eax
CODE:005572A7 pop edx
CODE:005572A8 pop ecx
CODE:005572A9 pop ecx
CODE:005572AA mov fs:[eax], edx
CODE:005572AD push offset loc_5572C3
CODE:005572B2
CODE:005572B2 loc_5572B2: ; CODE XREF: CODE:005572C1j
CODE:005572B2 mov eax, [ebp+uMode]
CODE:005572B5 push eax ; uMode
CODE:005572B6 call SetErrorMode
CODE:005572BB retn

If one nop's out the seterror code functions one can change the code inbetween otherwise not. Interestingly ther is a function called checkownerkey at 557188 but it is not called from anywhere in the program taht I can find!? The unregistered version from teh spalsh can be removed by changing 52630c to c3 btw. Well this is how far I have come until now, but I would really need some help as I am completely stuck at the moment. Thanks for all the ideas.

// SuperCali
SuperCali
10-02-2001, 07:33 AM
Originally posted by Solomon
The version in its web site is different: V4.0 Build 930.
h**p://w*w.muzicman.com/code/mzminstall.exe

Seems that this one can't be registered coz it will ALWAYS show "unregistered version" in its splash form(read the following code). I can't find where to enter the so-called serial number :(

Hello there is a registration box under settign in the program. Click the > (play icon looking button) at the bottom of the vertical row of five icons in the middle of the app, then settings and you'll see it.

// SuperCali
Solomon
10-02-2001, 11:52 AM
strange:D
I have not figure out where the reg key is stored:(
Used RegMon, but no luck
And also used CreateFileA & GetPrivateProfileStringA, nothing found:o

Checked all the references to TSettingsForm::KeyEntry(which is a EditBox), no luck yet.

This prog saves the reg key to EventLog.txt, but never read it out when it launches.
SuperCali
10-02-2001, 12:23 PM
Originally posted by Solomon
strange:D
I have not figure out where the reg key is stored:(
Used RegMon, but no luck
And also used CreateFileA & GetPrivateProfileStringA, nothing found:o

Checked all the references to TSettingsForm::KeyEntry(which is a EditBox), no luck yet.

This prog saves the reg key to EventLog.txt, but never read it out when it launches.

My problem too, I can't find where it stores the key, or the function to compare the key! When one looks in DeDe at the function checkownerkey it simply points to some function which as far as I can tell never is called :(!? I cracked some previous versions of the app by simply disabling the protection features ( back then it only displayed a message and paused your playlist after a "random" amount of time, it was a simple patch of say 3-4 bytes along with one c3 for the check routine that crashed the program). Now the protection however is completely diffirent, but I'm not giving up till this baby is history ;)!!!

B.t.w. there is a function that is called twice during execution, once rigth at the beginning, and once right at the end in which it displays the not regged limit 400 database message (555958). There is a point there when it sleeps, why does it call sleep at that point (5559c5)? Also the answer might lie in the database file. From what I gather the program uses .dbt ending for non-registerd users and .db for registered ones, I'm gonna look into that some more. Well back to work, see if I can't get past it.

// SuperCali


Borland C++ Builder 5.0 Enterprise Edition
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Borland C++ Builder 5.0 Enterprise Edition
PDA

View Full Version : Borland C++ Builder 5.0 Enterprise Edition

+NeWbiE
10-02-2001, 07:39 AM
Hey folks!

I just installed Borland C++ Enterprise Edition 5.0 60 day Trial and when I tried to crack it it just expired :D

So I read Theshp's tutorial about the version 4.0 but there seems to be some complex things for me like "BoundsChecker" I really dont know whats that!

So I am wondering if anyone can help me with cracking this puppy?Resetting timer would be great just for now :)

Lastly I see that its protected with SentinelLM .Anyone can help me with this.....:confused:
nobody
10-02-2001, 09:27 AM
Search the assay collection in old fravia site. Around mid/late 2000 somebody wrote about the Delphi
5.0 protection: "Rainbow trials Delphi five enterprise trial edition by macilaci". C builder uses the same protection. I think Kayaker wrote another Tut on C Builder around that time.
Also NolanBlender and CyberHeg wrote several assays about the SentinelLM protection.

In WKT site you may find a spanish assay with an alternative approach.
+NeWbiE
10-05-2001, 04:47 AM
No luck on findind mentioned tutorials...Only the one that +tsehp wrtoe...Any exact adress for others? Thnx...:rolleyes:
vgb
10-05-2001, 10:33 AM
Go back and look some more. I just went to the site and found the Delphi five tut and several others. Using the bcb4 tut by +Tsehp and the delphi five you should be able to crack the trial. You will also want to get the BCB5 update from Borland. After you have the original instqlled properly you will have to work on the patch.

Good luck,

vgb
nobody
10-05-2001, 10:45 AM
The Tsehp server does not address the tuts with an express URL, so you will have to navigate to them. These are the instructions:

Got to the page http://tsehp.cjb.net/ (It is hyperlinked below).

Scroll down and find the "entrance to the fortress". Click on it. It says you may not use Microsoft Internet Explorer to get into it. I have not tested if it is indeed IE hostile, I use a different browser.

It will take you to a page intitled:

"reverser's archives" Scroll down

The links to the tutors I mentioned are in the list below.

At this point you cand use the word search utility of the browser and locate the links:

"Inprise Delphi 5 Trial Cracking Getting the installation password by cracking the
Installshield script ~Nolan Blender"

Sentinel License Manager Cracking... No more Rainbow Trials ~CyberHeg

Rainbow trials Delphi five enterprise trial edition by macilaci ~Recommended

And some more. . .
+NeWbiE
10-05-2001, 11:10 AM
Thnx for the info.....


Softice + foreign (non US ) keyboard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Softice + foreign (non US ) keyboard
PDA

View Full Version : Softice + foreign (non US ) keyboard

Ninho
10-02-2001, 09:30 AM
Hi Folk !
------------ added (edited) by author :
After some reverse eng-ing , found an easy workaround : the <> key works correctly when the CAPS LOCK is OFF . For whom it may
be of use to ...:)

Nonetheless , if somebody could tell me why the anonymous FTP at S*ftICE.com refuses connections , please help ! Password required ?

------------ original message :

I've been using SoftICE 4.05 . Small problem is this : with non US (regular 102-key extended AT) keyboard , it mostly works, but annoyingly the extra key between the left-shift and the 3rd row letters (key#45, 'PC' scan code = 56h ) does NOT work with SICE's internal keyboard driver ; on my national KB , this key has the chars < > , which I aint able to pass to WinICE thus :- (

Browsing the Numega www site I found a reference to a fix for non US keyboards , but the link ( at their FTP site ) is not working ( maybe it's on purpose ... )

As I have , uh, lost my serial # , so I cannot just ask Numega for that file...

Anybody a hint ? Probably I could hack the SoftICE kb driver by myself , that would be much time lost I'l afraid ...

Alternatively I suppose I might define a winice 'macro' for the > ,
but that is not too elegant is it ;)
--
/\/. - welcome to post AND mailto: NOSPAMninho@multimania.com


Can Someone Please Give Me Some Tips In Cracking Password Protection On .exe Files.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Can Someone Please Give Me Some Tips In Cracking Password Protection On .exe Files.
PDA

View Full Version : Can Someone Please Give Me Some Tips In Cracking Password Protection On .exe Files.

Mogsey
10-02-2001, 12:41 PM
I have got an .exe file which is password protected. I have got the password, but the password was only valid between specific dates. When I type in the password nothing happens as the password has expiered (no warning messages come up), even if I back up the clock it is still locked, you just have to close the password box. I opened the .exe file with softice and a backdoor addon, but I am totally lost within the assembly code. Any help would be most appreciated.

Regards

Mogsey
nobody
10-05-2001, 10:57 AM
1.The program has to read the date at some point. BPX on getsystemtime
getlocaltime, and try to understand how it encodes the date and then where it compares it with another (encoded) date.

2. The program detects date tampering. At some point, it wrote to a file, to the registry or both, the date. run the program under Filemon and Regmon and hunt down for weird file and registry access.

3. Try to install the program in another computer, this time notice, with filemon and Regmon, when the program writes down information to detect date tampering and learn how to defuse it.

Have fun, that is the point of cracking.
Mogsey
10-05-2001, 12:16 PM
Thanks for the tips I will give them a try, I have got a feeling it may be storing the password info in user32.dll.

Just one other thing I have been trying to detect the password box using softice and breakpoints I have used the usual ones such as getmessageboxa, Createwindow, createwindowexa, showwindow but softice is not breaking on any of these do you have any ideas on what to do.

Thanks alot for you time it is appreciated.

Regards

Mogsey
nobody
10-05-2001, 03:11 PM
[QUOTE]Originally posted by Mogsey
Thanks for the tips I will give them a try, I have got a feeling it may be storing the password info in user32.dll.

user32.dll is a windows system library. I doubt the program is storing any information in that file, because: That file is used by several, perhaps all the programs you are running, and it could not be modified in any way, by storing some password information without crashing the system. On the other hand, FUNCTIONS contained in that library may well be used to store the password somewhere else.

Just one other thing I have been trying to detect the password box using softice and breakpoints I have used the usual ones such as getmessageboxa, Createwindow, createwindowexa, showwindow but softice is not breaking on any of these do you have any ideas on what to do.

I am not sure if I completely understand your question.
Are you trying to catch the program creating the password box?
In that case find a tool named Ispy, it is shareware in the net. This will help you find out the handle of the message box. then use "Bmsg [Handle: word] wm_destroy". Sice will break when the box is destroyed, deep inside the windows kernel. F12 out of it until you get to your program code. A box is usually created and destroyed inside the same call. This may help you find the area in the code where the box is created.

Alternatively, Look in the imported function list of the program, either by Dissasembling or by using "Quick View" This will help you narrow down the API that creates the Box.

If you want to catch the program READING your password out of the box, try BPX hmemcpy, if you use win9x.


Write to NTFS
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Write to NTFS
PDA

View Full Version : Write to NTFS

tentakkel
10-03-2001, 04:37 AM
Hi

Maby it is the wrong plase to post it - but i dont know wher else to do it.

Does anyone have a small program that enables you to write to a NTFS file system from dos mode?:confused:
Wizard
10-03-2001, 05:13 AM
h**p://www.sysinternals.com/ntw2k/freeware/NTFSDOS.shtml

(did you really try to SEARCH by yourself ?)

Wizard
mike
10-06-2001, 10:22 AM
NTFSDOS won't do it unless you buy the pro version for an obscene amount of money. I think Christophe Grenier has a free read/write NTFS driver for Linux (and a floppy image for a linux boot disk with everything you need on it for replacing the admin password).

BTW, changing bytes in an existing file is a LOT easier than creating new directory entries, resorting the B Trees, allocating space in the bitmap table, etc. What is it that you need to do?
tentakkel
10-07-2001, 08:39 AM
Originally posted by mike
NTFSDOS won't do it unless you buy the pro version for an obscene amount of money. I think Christophe Grenier has a free read/write NTFS driver for Linux (and a floppy image for a linux boot disk with everything you need on it for replacing the admin password).

BTW, changing bytes in an existing file is a LOT easier than creating new directory entries, resorting the B Trees, allocating space in the bitmap table, etc. What is it that you need to do?

My win 2k is broke completely down! - ok I try to those repare at the instalation CD - it didn't work :( - so I have to make a reinstall - but then it gonna del all the files i the documents directory :eek:

So I would like to rename my "c:\Documents and settings" derectory. (thats why i would like a Read/Write to NTFS)

But I have thorgth of a nother solution - I think I'm gonna try to split my HD in two partisions - them I install Win on the free partision (f:) - then i supose that i can go from my win on f: and see wats on the "old" c: - and then get the files - and finaly del the old c: (and maby then rename my f: to c:)

Does anybody knows if it's gonna work? - or have another Idea?
tentakkel
10-07-2001, 08:43 AM
Originally posted by Wizard
h**p://www.sysinternals.com/ntw2k/freeware/NTFSDOS.shtml

(did you really try to SEARCH by yourself ?)

Wizard

"...NTFSDOS.EXE is a read-only network file system driver for DOS/Windows that is able to recognize and mount NTFS drives for transparent access..." - line 5 h**p://www.sysinternals.com/ntw2k/freeware/NTFSDOS.shtml

yes I have tryed to SEARCH by myself )
tsehp
10-07-2001, 09:07 AM
use partition magic, resize and create a new partition, reinstall a new win2k or :
boot the cd in recovery console, then you log into your crashed win2k, then the cmd line allows you to do anything you need
Unregistered
10-08-2001, 10:17 AM
Originally posted by tsehp
use partition magic, resize and create a new partition, reinstall a new win2k or :
boot the cd in recovery console, then you log into your crashed win2k, then the cmd line allows you to do anything you need

Nope - You have only acces to the \winnt\ and subs directorys from the consol (so you cant rename the c:\documents and settings folder)

But the partision think soved the thing :-)
mike
10-08-2001, 05:18 PM
Well if all you want is to make backups of stuff in a directory, use NTFSDOS! You have to pay to get a version that will WRITE to it (that's the hard part) but the READ ONLY version is free. I'm sure Christophe Grenier's linux driver also lets you read, and it is free and, like I said, you can download the floppy boot disk image. He uses it for changing the Admin password.


Cant get tracer work in XP!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Cant get tracer work in XP!
PDA

View Full Version : Cant get tracer work in XP!

+NeWbiE
10-05-2001, 04:55 AM
Revirgin's tracer doesnt work on XP it says

"Cant use tracer in this version of WinNT"

Any solution for this?
tsehp
10-05-2001, 05:06 AM
I have a problem :
softice still doesn't work on winxp, theowl told me I have to wait for numega's final ds release 2.05 or 2.06

I use sice to debug my tracer, so as long as sice doesn't work, mine will not also work.

Thanks if someone can notify me
Hoof Arted
10-05-2001, 08:46 AM
Dont mean to speak out of turn here but I think that XP has quite some security in place to stop debugging on systems by users who do not have permission. They tried to implement the same thing in Win2K but this pretty much had no effect on what you could an could not do. I was wondering if this had anything to do with it.

Make sure that your XP account has the "Debug programs" "local security policy" rights under "User Rights Assignment". To access this, run "secpol.msc" from the Run menu, make changes and Reboot.

Dont know if it helps but it might be worth a look.

Hoof
+NeWbiE
10-05-2001, 11:12 AM
Lets wait and see :(
tsehp
10-06-2001, 07:45 PM
so somebody got details how they did the thing work ?
impeaching sice to redirect idt for int's 1 , 3 and others ?
making a check if winxp seh is not called ?

just to know if we could add later a 'crack' right into the security tokens

later:p
DGR
10-07-2001, 07:29 AM
Well, driverstudio 2.5 final still only supports XP Rc2 and not the final (as released by Devilsown) so that's bad news : /

I haven't actually tried it but since Numega are saying it my guess is that it's true. The only way to get softice working is by using those debug symbol files (ntoskrnl.dbg/.pdb) which are impossible to get at the moment so it seems...

Back to win2k for me for now I guess.
+NeWbiE
10-07-2001, 08:06 AM
Damn I hate M$ ! I cant go back and install other shit!
tsehp
10-07-2001, 09:05 AM
numega ds 2.5 is still not released, I checked this yesterday
They surely will post an update pretty soon, just like they did after win2k was released
Bengaly
10-09-2001, 12:32 PM
hm...
DriverStudio 2.5 is out, cuz i have it here on HD full instalation :-)
but i dont know if it suppotrs WinXP cuz i dont have winXP installed, if i will i will tell you all.

Thnx
Bengaly
EtErNaL_L0ser
10-09-2001, 12:38 PM
Patiently waiting for the answer!

btw where did you find it?
tsehp
10-09-2001, 04:50 PM
Tsehp > will ya stop asking some indirect warez request on this damned site

Eternal_looser > well, but... you know this is just to test the system

Tsehp > will ya stop will ya ?

Eternal_lloser > but...

Tsehp > Shut up ! now this is for the last time : no warez requests, ok but ds 2.5 is not a warez, it's a necessary tool :

download a keygen for numega product, register on their site by giving your mums address, then download the latest version and finally ask me for a good lawyer when dmca will prosecute all registered ip's on their server
tsehp
10-10-2001, 01:51 AM
Originally posted by Bengaly
hm...
DriverStudio 2.5 is out, cuz i have it here on HD full instalation :-)
but i dont know if it suppotrs WinXP cuz i dont have winXP installed, if i will i will tell you all.

Thnx
Bengaly

here's the page downloaded today concerning 2.5 :

Welcome to the Compuware DriverCentral Premium Site
DriverStudio 2.5 is nearing release to manufacturing and Beta participation is now closed. Our thanks to all of you who participated in this program.

We’ve received some really great feedback. Your responses have helped make this version of DriverStudio truly the best ever!

NuMega DriverStudio v2.0.1 available to subscribers!
DriverStudio v2.0.1 is available for download here. It includes numerous enhancements to SoftICE, as well as updates to the other DriverStudio packages. Current subscribers will also receive a CD within a few weeks. Read the list of features.

Updated File for SoftICE for Millennium
The existing debugger.exe file for SoftICE for Windows Millennium Edition has expired. Please replace it with the one available here.

Download the Latest Update!
As a registered Compuware NuMega user, you can automatically download updates from DriverCentral. Check out the latest product updates.

DriverStudio Issues with Windows 2000 RC1
Registered DriverStudio and SoftICE Driver Suite users, download a update to SoftICE for use with Windows 2000 RC1 (Build 2072).

Attention SoftICE Users with IBM Thinkpads
The SoftICE universal video driver does not always work properly with IBM Thinkpad systems using the NeoMagicGraph 128XD video chip. Find out what you need to do.

Notice to SoftICE 3.25 Users
We've created an interim build of SoftICE that supports Windows 2000 Build 2000 and Build 2031. Check out this document to download the appropriate files.

Product Feature Surveys
Find out what the driver development market thinks about specific topics. As a DriverStudio customer, only you have the ability to view all the survey results and suggest questions of your own.
EtErNaL_L0ser
10-10-2001, 04:11 AM
Never thought of Numega Proggies as warez ...Sorry
DGR
10-11-2001, 04:40 AM
Well, since were quoting from the Numega website now here's my part:

"*Upgrades and New Products
Windows 2000 Debug Symbol Translation Patch

NuMega DriverStudio v2.5 and SoftICE DriverSuite2.5 now available! "

And then when you click the link:

"Introducing DriverStudio's 2.5 Release
DriverStudio Version 2.5 & SoftICE Driver Suite Version 2.5
DriverStudio Version 2.5 promotes the development of high quality drivers and accelerates the development life cycle in three important ways:

...ladidadida...

Feature Benefit
New for all DriverStudio components
Support for Windows XP (RC2) Improves time-to-market of device drivers for Windows XP by allowing developers to quickly build device drivers for the new Windows XP operating system."

There, support for RC2 only atm... but I guess that when XP is released in stores (26th of this month?) an update will get out soon.
EtErNaL_L0ser
10-16-2001, 05:43 AM
Damn how you could manage to get that "heaven update" site lol :)


new method for softlocx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new method for softlocx
PDA

View Full Version : new method for softlocx

HypnoticZ/TNT
10-06-2001, 12:21 PM
well i friend of mine give the fusion to crackit
and i do this trick to unpack
i load the fusion
i open the pe editor and go to taskes i found this task and i make a full dump :)

all seems looks to work but must correct the eip coz the file crashe if attempt to run :(

anyway this maybe helps

regardz hypnoticz


Sentinel problems I think
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel problems I think
PDA

View Full Version : Sentinel problems I think

MTB
10-06-2001, 08:25 PM
Ok
Here are the details. Target T A S a thermal model program similar to femap. Finally jumped and NOPed all the appropriate tests (yes there are alot).

Program starts up, I can save and export over 300 nodes ( demo limit ), no nasty demo messages etc.

However when I select any option the save and save as button is greyed out!!!

Does anybody have a clue as to what is going wrong here? Other than reversing error? I suspect a hidden check somewhere without an error message?

Currently using IDA and w32dasm as my tools, I have access to si but am shying away from it because of complexity.

Thanks
MTB
Kayaker
10-07-2001, 12:23 AM
Hi MTB,

This sounds like a menu reversing problem. The Save menu item is disabled, the 1st thing to do is ungray it. Often this is controlled by a GetMenuItemID / EnableMenuItem API call sequence. What you can do is run an API monitor on the various Menu API's and see what's being used to control displaying the menu bar.

You can usually do a crude patch so that all menu items are enabled, but it's better to find the exact location where the decision is made to enable or disable the Save item. If you do find a flag that determines this, it may also lead back to other code that determines the functionality of other parts of the program. Enabling the menu item control is no guarantee of it being linked with the code to actually execute the function, but it's usually the 1st step. A true crippled demo may not even have the code, in which case you're generally stuck.

There is really no other solution than to use Softice. You must learn to use this tool to its utmost as it is the only way to seriously reverse. We did a mini-project on enabling menu items a while back which included finding the menu code once you've enabled the menu item by tracing its WM_COMMAND message when selected.

The best explanation of the whole process I've seen is Clandestiny's summary of that project, which I've attached as a zip file. That should give you a good starting point to get playing with Softice ;)

The original project is at

http://www.woodmann.net/forum/showthread.php?threadid=126

Let us know if this is what you need.

Hey, Clandestiny. I "found" this on my hardrive while looking for notes on the question, and realized it had never been published! That's terrible, this is a good reference tut. I think you should post it at the main site, I mean it was spawned here, why should the knowledge we get out of the project forum lay buried in old messages that few are likely to read?

Cheers,
Kayaker
Kayaker
10-07-2001, 12:27 AM
Hmm, upload didn't seem to work with Opera. Trying again with IE.

Nope, still a problem. I caught the error message this time:

Warning: Unable to create '/usr/local/plesk/apache/vhosts/woodmann.com/httpdocs/vbulletin/upload/tmp/mixvibes_tut.zip': No such file or directory in /home/httpd/html/upload/admin/functions.php on line 1603

Warning: Unable to move '/tmp/php2VDbw2' to '/usr/local/plesk/apache/vhosts/woodmann.com/httpdocs/vbulletin/upload/tmp/mixvibes_tut.zip' in /home/httpd/html/upload/admin/functions.php on line 1603

Help! ISP magicians Woodmann and Tsehp :D
Clandestiny
10-07-2001, 09:22 PM
Thanks for the compliments Kayaker :)

Always meant to send that tut over to +teshp to put up on the main site... But being the perfectionist that I am, I kept waiting to find the time to polish up a few details ;-) ...And I kept waiting...And waiting... And then I got involved in new projects and forgot all about it.

As they say, better late than never...so here it is. I'll try to u/l it if the board will let me. If it won't, feel free to email me MTB and I'll send it to you direct.

Cheers,
Clandestiny
MTB
10-08-2001, 06:40 PM
Thanks :) Kayaker and Clandestiny. The tutorial is just the thing I needed!!!!

BTW outside of crackz's site is there any other good repository of tutorials that I should be looking at? I am primarily looking for Sentinel and HASP dongle tutorials / information. It amazes me at the expensive software that uses such a lame protection scheme. Especially the JNZ followed by "Dongle not found or running in demo mode etc" message. It doesn't require a lot of reversing skill to get around this stuff.

So onward to start learning how to use Softice! Do you recommend any particular version over another. Currently running window$ 98SE.

Thanks Again
MTB


HELP: i cant trace (no F10 or F8)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HELP: i cant trace (no F10 or F8)
PDA

View Full Version : HELP: i cant trace (no F10 or F8)

donMAMAvomito
10-07-2001, 12:56 PM
greetings

when i was cracking Brian Laras Cricket (codemasters)..i came upon a section of code...

bpx getdrivetypea

(ok..now the proggy did not break...)...

then i tried bpmb getdrivetypea x

(this time proggy break..but cant use f8 or f10..cursor simply

wont move..i mean i cant trace...)

what could be the problem...

(i tried SUPERBPM by elicz..but still no work...)

i suppose program has some anti-trace mechanism..please explain how to get past..

please help me...

best regards
donMAMAvomito
exit_2
10-12-2001, 04:41 AM
Hello,
I found similar question in General forum. But I can answer there too.

It is very old trick, which EliCZ published maybe 1-2 years ago. They set debug breakpoint and if SICE trace, it stop on it. It is not very clear because on Win9x it can sometimes do problems, but on WinNT it working fine. They used it on Win9x too, but I think they stole it from EliCZ (maybe not :D ).

Exit
asad
10-17-2001, 11:25 PM
Hello, are you working on Brian Lara Cricket update?. I was also looking to crack it's update, (for noball fix) but could not bypass SecuROM protection. If you want to skip the cdrom detection method, there is a simple trick, search "%sinit\cricket.val" and change it to "cricket.ini ". Now it will try to search cricket.ini that is in the same directory, where you run the .exe, and skip the cdrom.
asad
asad100@hotmail.com
Aimless
10-17-2001, 11:57 PM
Hullo,

Can you be a little bit more specific on "what" it is that you are trying to do?

In "cracking " BLC, are you trying to bypass CD copy protection? or are you trying to generate a Cd key or bypassing the CD check, or what ??

A simple way, if F10 or F8 do not work, is to use the commands T and P in a macro like thus...

* Using the T command *

Try using T =cs:eip 50 (check out the ice manual for the meaning)

* Using the P command *

1. Breakpoint on the location where you want the tracing to stop
2. Create something like

MACRO pfft = "P; pfft;"

This should loop you around using P until you hit the BP. Of course, you can also use P RET instead of P.

Have Phun


Help needed to unpack and dissasemble file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help needed to unpack and dissasemble file
PDA

View Full Version : Help needed to unpack and dissasemble file

Mogsey
10-07-2001, 01:44 PM
Can anybody please help me to unpack and dissasemble a file. I have tried all the file analysis to try and detect what type of security sytem it is using and non of them can reconise it. Is it possible that the original programmer has created there own security sytem. I have tried opening the file using IDA Pro 4.0 but it only opens a small sample of code and the rest is comes up unexplored.

Any help will be most appreciated, as I have spent nearly 2 weeks trying to crack the file and got no where.

Thanks

Mogsey
Unregistered
10-07-2001, 01:50 PM
Which file ?? url ??
donMAMAvomito
10-07-2001, 02:07 PM
greetings

exactly..which target are you talking about..

give the url..so that i may be able to further this..

best regards
donMAMAvomito
Mogsey
10-07-2001, 02:23 PM
It's an .exe file if it would help I can email it to you.

Thanks
donMAMAvomito
10-07-2001, 10:41 PM
greetings

first: is this application downloadable from the net. if so i will obtain a copy for myself and unpack it..it will save you the trouble of mailing it to me...

also..is it a dos or a win32 app...

here are some tips for you to try your hands once more...

first..assuming its a vc++/bc++ app..(no vb/delphi please..)

* try symbol loader of numega..if proggy does not break at start with [invalid] values (change the .code section characterisits to make it break..i will not explain this in detail..fravias essays should make it clear)

* ok now do a bpx getversion and press F5..

* proggy will hopefully break..look at the code window and see that the name is the same as that of proggys; if so you have arrived at the start section..go back a few lines to something like this

xxxx: push ebp
mov ebp,esp
..
..
..

note down the value of (xxxx) this is the OEP (original entry point)..if the code window shows dll or anything else keep pressing F5...

* ok now clear all breakpoints (bc *) and set load the exe once more using symbol loader..set bpx xxxxx (you noted it down)..
press f5..the proggy will break..assemble jmp eip at current eip..remember to note down the previous overwritten bytes..

* do a procdump/icedump/adump whatever...

* change the PE entry point to the noted (xxxx). and replace the
overwritten bytes using a hex editor..

*exe is now unpacked and ready to run..

this is a very general technique and must be adapted...like for example...screwed up IAT's..or even vb or delphi appz..for that matter even encrypted sections that are decrypted at runtime...
CRC checks...

just use your brain...

keep me posted...

best regards
donMAMAvomito
Mogsey
10-08-2001, 05:03 AM
Thankyou for the informative reply I will give it a try and let you know the results

Thanks

Mogsey


Tracing problem with SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Tracing problem with SoftICE
PDA

View Full Version : Tracing problem with SoftICE

donMAMAvomito
10-07-2001, 01:51 PM
greetings

i was trying my hand at Brian Laras Cricket (codemasters)..a pretty old game..but neverthless..

this is what happened..

set bpx Getdrivetypea (hmm..no break)
set bpmb getdrivetypea (ok ..get break)

but after F12....
no more F8 or F10..just freeze..cant single step..

please tell me what kind of anti-tracing mechanism this software is using...

(also..i load up SuperBPM by elicz..then the proggy simply goes into a loop..i thought some error in superbpm..but..no..works on other codesafe stuff i tried)

please help me..

best regards
donMAMAvomito


Help on HASP4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help on HASP4
PDA

View Full Version : Help on HASP4

cah
10-07-2001, 10:54 PM
How to dump HASP4 data? Any tools/util to dump?

Any tutor help on this hasp4 dump

ragards,
cah...


SoftIce and tElock 0.92a
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SoftIce and tElock 0.92a
PDA

View Full Version : SoftIce and tElock 0.92a

Unregistered
10-08-2001, 05:48 AM
hi

I have packed a progi with tElock 0.92a and i made a inlinepatch. But is only working, if Sice is not loaded, or Frogsice is running.

I have found two (known tElock 0.90) SiceChecks and i patched them; (Frogice Code 07, code 02) ....and there are 2x int3 (Frogice Code 00)

There is a SiceCheck that i was'nt able to find and bypass, and the Progi crashes, because tElock find SoftIce. (sorry for my english ;) )

hi...

Ich habe ein Progi mit tElock 0.92a gepackt und einen Inlinepatch dazugemacht. Patch funktioniert aber nur, wenn SoftIce nicht geladen ist. Ich hab zwei SiceChecks entfernen können( FrogSice: Code 07,Code 02), finde aber den dritten nicht.

Frogsice zeigt noch zwei int3 an, Code 00; damit kann ich aber nicht allzu viel anfangen.

Meine Frage: Wo erkennt Progi noch, dass SoftIce am Laufen ist? Es dürfte etwas mit den INT3 zu tun haben, wo FrogSice Code 00 ausgibt. Wie kann ich diesen SiceCheck entfernen? (Progi entschlüsselt sich falsch, wenn der noch vorhanden ist)

ciao
SilberFuchs
tsehp
10-08-2001, 10:55 AM
I'm sorry but you didn't translated your question in English, you should edit your message (if already done, do not consider what I said)

cheers

tsehp
Fake51
10-08-2001, 11:11 AM
He is asking how to locate the (and remove) the int03 checks to locate Softice. He is also asking if anyone knows where in telock these checks are hiding, so as to make it easier for him to find them, plus how one removes them.

Having never played with telock, I can't say where in the code, they're hiding. I usually just trace the code, till it either takes a wrong turn, or till I find the int 3.
Anywho, search Tsehp's mirror, and look for tut's on packers, that use anti-sice. That should give some good hints.

Fake
^DAEMON^
10-09-2001, 10:12 AM
i haven't checked out latest telock version like u, but maybe u know that iam one of the authors of the good old tEunlock...

so he is using this int 3 for causing an exception... this exception must occour! he has an handler for it... (go and fetch jeremy gordon's documents about structured exception handling in win32!)

u need to understand what exceptions are and how coders use em to write anti-debugging code...!
then come back and try again!

ich weiss dass dir das im moment nicht viel bringt aber saug dir diese docs! und versuche zu verstehen was da abgeht, dann wirst du auch verstehen warum du das nicht einfach wegnoppen kannst!

DAEMON :cool:
SilberFuchs
10-10-2001, 01:58 AM
hi

in tElock 0.90 i have found 2 Sice check, int3 (with magic values) and int68. I NOPed the conditionaljump after the INT and the Inlinepatch worked fine.

in the new version, i made the same, but it must be another Sicecheck on int3 (SI break 2times), but there aren't any "Magic Values". FrogIce tell me Code 00:

My Question: How can i remove this Checks? or how works INT3 in this case?

i have read the manual on Exception, oh my god ;) is difficult, but i keep trying to understand and i will read the tut's on the Tsehp's-mirror.

Ciao :)
SilberFuchs
^DAEMON^
10-10-2001, 02:27 AM
hi silber,

anyway it's not that hard int3 is causing a debug exception...
this exception is caught by the handler in fs:[0] (holds the pointer to the exception-handler)

an exception handler is setup like this way:

lea eax,[ebp+offset_handler]
push eax
push dword ptr fs:[0]
mov dword ptr fs:[0],esp

the lea eax,......
push eax

could also be replaced by:

call over_handler
mov ebx,[esp+0ch]
...
...
...
xor eax,eax
ret

over_handler:
push dword ptr fs:[0]
mov dword ptr fs:[0],esp

now go and learn more... (tip: put a bpm @ the handler!)

:D ^DAEMON^ :D
tE!
10-10-2001, 11:58 PM
lo!

telock .92 has a shitty bug on those lamea** dos applications
called windows 95 and 98 when dbg detection is turned on.

that's why i released .92a (one day after .92) where this is fixed.

just wanted to let you know. also want to let you know that
the entire telock project has been discarded. the last 1 1/2
years i spent much time on it with no satisfying result. in the
meanwhile the sourcecode of telock reached ~230k and it's
a pain in the *** to modify or implement new things.

i changed telock's name to tepack, since that's what describes
the program best and i want it to be. i'll work on better/faster
compression (not using aplib, even if it's nice) and compatibility.

somewhen in the near future i will start a new protector project
if i have enough free time, so better don't wait for it. when it's
ready for sale i'll let you know (lol)

greets,

tE!//TMG
^DAEMON^
10-11-2001, 12:27 AM
hi ego,

hope to hear soon of u, coz we talked already yesterday to each other...

daemon
SilberFuchs
10-14-2001, 01:46 AM
hi...

ok, now i have some idea about what SEH and exception is ;)

in the handler of tElock is this:

......
cmp eax,C0000094 for division by zero
......
cmp eax,80000004 for Single Step
jz
cmp eax,80000003 for int3
...

but i'm new in this things, what are the follow steps?

i have traced the Code, but i haven't understand, what's going on. ....
----------------------------------

Okay, ein bißchen was weiß ich jetzt über SEH und Exceptions. Im Handler von tElock findet man obigen code, mit dem ich aber nicht recht weiß, was anfangen. auch ein Weitertracen im Handler hat mir nicht recht viel Klarheit gebracht.
Kann mir jemand einen Tip geben, auf was ich jetzt achten muss?

thanks & ciao
SilberFuchs :)
^DAEMON^
10-14-2001, 07:59 AM
okay, wenn du den handler genauer untersuchst wirst du mit ziemlicher wahrscheinlichkeit feststellen dass der handler mit xor eax,eax - ret endet

die context structure erhält man über esp+0Ch, context_structure+0B8h enthält die eip! dieser pointer wird irgendwo im handler wahrscheinlich verändert, es sei denn es is ne single step exception oder ne breakpoint exception.... du nimmst einfach diesen wert denn das is die nächste eip nach der exception (zu der der handler returnen wird)

spiel dich einfach mal damit!
^DAEMON^ :D
Unregistered
10-14-2001, 11:07 AM
hi ich muss mich hier auch mal einmischen, weil ichs auch noch nicht so richtig versteh. In diesem Handler werden unter anderem auch die Debugregister verändert, wozu ist das genau gut, kann man so auch eventuelle Bpx's/Bpm's löschen ?

onoskelis

hi ^DAEMON^, the Debugregister values will also be changed in this Handler, whats the secret about it ?
Unregistered
10-15-2001, 01:59 AM
wenn man einen bpm setzt dann wird die lineare adresse in den debugregistern der cpu geschrieben... die debugregister können normalerweise nur über ring0 verändert werden... aber wie das eben so ist mit m$... gibt's eben mehr wege! z.b über seh (also die context_structure) somit kann man wie du es schon gesagt hast die bpms killen (funzt auch unter NT/2K)

^DAEMON^
^DAEMON^
10-15-2001, 06:14 AM
sorry but i thought i would be easier for those peoples if i answer the questions in their mother-language....

^DAEMON^
tE!
10-15-2001, 01:46 PM
there's nothing in that german text what you don't already
know f0dder. i'm very sure about that :))
songzi
10-15-2001, 05:43 PM
x
Js
10-15-2001, 05:59 PM
thats not a kiss, is it?
EtErNaL_L0ser
10-16-2001, 05:40 AM
lol te! btw your new is site is really cool...
Unregistered
10-16-2001, 01:01 PM
ok, thanks DAEMON, but this Debugregister erase will not work in my own Code. If i set a BPM before my Handler this BPM is also working after the Handler. hm, I think i must learn still alot, but i'm on the way :-)

onoskelis
^DAEMON^
10-17-2001, 12:28 AM
hmmm this depends on the operating system u are using!
try the following:
i assume u are using some os above w95(a,b,c)
so set dr6 to 0
and write 0155h to dr7

explanation of this would be too much...
:D

^DAEMON^
^DAEMON^
10-17-2001, 01:06 AM
...... read above .......
onoskelis
10-18-2001, 10:51 AM
thanks DAEMON and f0dder, this should help. I have also found that this is explained in the Intel Pentium Manuals, i think i must read this to understand ;-)

onoskelis
Unregistered
10-24-2001, 12:43 PM
Hi

I wrote this because all of you are talking about debugging and bypassing the a/d tricks used in tELock. Have you ever thought how to remove a protection using disassembler, compiler and brain only? This is my approach I ever use (it's about writing ungeneric unpackers). Hope you will like it :-)

The tools I use are HIEW to disassemble the program, text editor and TASM to compile the unpacker. First I disassemble at the program entry point with HIEW. If the packer does not use polymorph layers it is very easy to rip the code that decrypts the first internal encryption layer. HIEW is also good for manual removing the used fake macros which make the disassembly hard to understand (and long to trace all those JMPs without seeing the real next instruction). tELock doesnt use too much fake macros in latest versions so you'll not need additional tool like StoneHead's MOW (macro nopper) which replaces all known fake macros with NOP. So patch all that fake instructions with NOP (its offten happened to patch only the first byte of the instruction because it masks the real instruction). Then find where is calculated the relative offset (call next_line; pop ebp). Look where is the decryption loop and what is used in it. Just rip the code without the annoying macros and add to the program you will code (of course you need code that loads the PE file in memory, finds entry point of the program, etc. - all this can be found in unpacker sources on the net).
After ripping the decryption code you have to compile and run your program on the protected file. If everything is ripped OK you will get a file that has decrypted the code that decrypts the second internal layer.
Now look with hiew the code after the first decryption loop. If its good looking go rip next internal layer, add to your program, compile and run on the protected program (not on the decrypted from previous usage file!)
If you find some a/d code in the decryption layer - think a little bit if it's used for decryption (in most advanced protectors) or just to stop debugger. Rip the code and add emulation of the A/D trick (example is the tricks used by DAEMON in his protector which are using SEH: set SEH, do a decryption loop, execute invalid instruction or anything that will trigger the SEH and change decryption key in the exception handler - replace the trigger instruction with a CALL to the ripped exception handler).
That's all about getting a good looking and easy to understand main code of the protector. Maybe it will have some other internal layers but the approach is clear enough to understand it.
Now you are close to the real antidebugging stuff that makes debuggers/tracing tools to crash ;-)
Again its easy to defeat these tricks: remove all fake macros (use MOW /add macros if needed/), disassemble the file with your favourite disassembler (w32dasm need the file to be fixed) and find all a/d tricks, the code that decrypts/decompresses the sections, decryption&jmp to the original entry point. It will take you some time to understand all that code but when you rip only the parts that do the real decryption you will have an automatic unpacker. Of course you need to fix some values in PE header (entry point rva, imports rva, some other stuff).
Test the unpacker with several crypted files and fix the bugs you made.

That's the approach I use to make unpackers and to defeat a/d tricks using only disassembler and brain. There are some cryptors that are restructuring the PE file and you have to make rebuilder (imports, resource, exports, relocs) but that's advanced stuff...

Greetings to tE! and DAEMON

Best regards,
Unknown One/[TMG]
SilberFuchs
11-13-2001, 03:45 AM
hi

yesterday i was able to make the Inlinepatch for tElock 0.98 ....works now with Sice :)

thanks for all, who helped me on the Exceptions Handling. it was totally new for me, but very interesting.

-----------------------------------------------------

hi

so, hatt zwar seine Zeit gebraucht, aber jetzt läuft der Inlinepatch für tElock 0.98, und zwar mit Sice :)

Ich möchte mich hier bei allen bedanken, die mir dabei geholfen haben. Das mit dem Exception Handling war mir nämlich völlig neu, aber sehr interessant.

Ciao
SilberFuchs


uk-info 6.5 info required...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > uk-info 6.5 info required...
PDA

View Full Version : uk-info 6.5 info required...

sadsack
10-08-2001, 01:46 PM
hi guyz, well this iz me first post, and i bet i dont get any luck here either, its concerning uk-info disk v 6.5 or 4.1, does anybody know how 2 find the protection on this poxy proggy, as i aint got no hair left 2 pull out,... the 6.5 version came from pc format magazine, not that its gonna help much, it wont even let me reinstall it as it knows ive gone past the 7 day trail limit, also req serial number infomation.. any help at all would be great..

thanx in advance

londinium
Clandestiny
10-08-2001, 05:05 PM
Hiya londinium,

Well, if the prog performs some sort of check prior to reinstallation there's a high probablility that this information is stored in 1) the registry or 2) a hidden file.

Have you tried Regmon (registry monitor) or Filemon (file monitor)? If you don't have them, they can be obtained at sysinternals.com. You can likewise follow up on any suspicious registry or file accesses via an API monitor. An API monitor will guide you toward an optimal selection of breakpoints.

Regards,
Clandestiny
sadsack
10-08-2001, 05:40 PM
hi clandestiny m8, ill try them out but i dont hold out much hope, i tried "check disk" done a comparison but that wasnt much help either, i checked out the registry and removed all info regarding i-cd (there the makers of the proggy), and that still didnt work, ive got an old p75 did a quick reformat of a 800 meg drive, and it installed fine, now i only have 6 days left before i have to reformat the hd again.... anyone care 2 give any more help pleeze...
Scally6
10-11-2001, 05:07 PM
Hi Sadsack,
This baby/pig is protected with Crypkey. There are a couple of tuts out there relating to other versions but not the one from the pc format cover. It supposed to be easy but I got not joy after trying both tuts I found & trying to ident other 'get authorization' code in the thing. I guess some of the guys on the list with more experience will be lol but I spent around 8 hours before I d'l'd the crypkey protection wrapper to have a look at it. I got nowhere much. Using filemon you'll see that after expiry it checks for randomly named files all over your hd. (That makes me mad) I deleted at least 20 of these <1k randomly named suckers (e.g in c:\iou.sys & others everywhere) & also what I could see in the reg but never managed to achieve a successful reinstall. Doing the above you get back to the 'pro trial' (with no days left) rather than the reduced se version but I never got further than that.
I also loaded it on an old machine & tried to look for differences in sice but there were so many & the machines so different that I got pissed with it & gave up/moved on.
I deleted it now but if I remember right it first unpacks the cryp95e.dll * crp9516.dll creating a temp file for the last one. This checks the jsm95*.*in c:\windows\system, the ukid.ini in c:\windows & the several *.rst/ent/41s files scattered in the i-cd/map & the other directory (bt, I think) against the ones in its own directory.
If anyone's interested I'll reload it & have another go
Scally
sadsack
10-11-2001, 06:52 PM
well ive been cross ref using disk master again, jeez so many filez, wot a nitemare, many of the filez i found in program_files/installshieldinstallationinfomation/0987124f ****ect/ as well as prog filez/ common filez/installshield ECT,
and other numerous places, many of the filez had time diff & crc diff, after being installed and deleted, & yes m8 we prob r being laffed at...... if i get any furver ill let u know...

sadsack
Scally6
10-13-2001, 04:35 AM
Hi Sadsack,
You could try reinstalling with regmon & filemon. These may show what else it's leaving on the HD to show its expired. If it aint in the reg or a file, it may be writing to the hd directly. I think some virii do this & aren't easilly detected by av progs but I doubt its that evil. I think that it was a dos prog I saw do this but can't remember what it was.
I guess its much more likely to be a random key in the reg, so regmon is your best bet. If I remember right, the thing checks for a previous version on first run rather than when its installed.
Scally
sadsack
10-13-2001, 10:11 AM
fanx 4 the info m8, ill give it a go, summit i did notice the program installs to same dir, (wherever u install 2) the same main .exe 3 times in same place, but only 1 file u find, (all hidden turned on) cant work that wun out....


flexlm in matlab 6.1 (UNIX)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flexlm in matlab 6.1 (UNIX)
PDA

View Full Version : flexlm in matlab 6.1 (UNIX)

tapo2001
10-09-2001, 02:41 AM
Hi there, I am trying to analyze matlab 6.1 under linux. There is one call to lm_set_attr with 0x4a parameter (discussed in a Nolan Blender essay). Since I have the target on linux and I am using gdb for debugging I am not able to bpx lm_matlab (vendor daemon), because it is called by lmgrd! Do you have some hints?
Futher did someone already work on that target?

The point is that lm_checkout is never called! Any idea why this happends?

Bye,
Tapo
jomamameister
10-09-2001, 05:41 PM
i have sovled my matlab v6, r12 demo on win98. my matlab works forever. perhaps i can dig up my work and tell you what i did, even though i used other tools than you will use. please pm me if you think this will be of assist.
jomamameister


u talk about me :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > u talk about me :)
PDA

View Full Version : u talk about me :)

Unregistered
10-09-2001, 05:12 AM
hi dudes, u guys talk bout my protector *GRINS*
oh i can detect icedump (it's really easy)
iam almost sure that u guys already have the file...
so go and destruct it :)

^DAEMON^ [UG2000/MYTH]
nchanta
10-09-2001, 06:10 AM
eheh, hi DAEMON

i havent given the file to anyone, as per your wish's
but since u seem to consent with it being among us select few who read this board, ill try and get it posted

/me pokes daemon

i havent had a lot of time to actually look into this due to continuing work IRL, but i give it to all you people that do have time ;)
nchanta
10-09-2001, 06:15 AM
i cant seem to post attatchments...
nofurs
10-09-2001, 08:47 AM
Heya Guys,
I'll upload it here ;)
SpeKKeL
10-09-2001, 09:18 AM
:confused: virus found...... PE_ZMORPH.ax....:confused:

SpeK
Unregistered
10-09-2001, 09:49 AM
read the subject, this should be enough, or keep off!

DAEMON!
^DAEMON^
10-09-2001, 10:02 AM
hmmm just want to say, that it's not that hard! there is always this one rule: if code is executeable it can be broken... i know that, of course! nobody cracked it so far... but i think it will be broken next days (weeks).... so go boys and give ur best!

:( DAEMON :(
+SplAj
10-11-2001, 07:41 AM
:rolleyes: ...... duh, excuse me.....

What r we supposed to do with old teunlock1 ??? just dump and fix up the 11mb exe ??? :eek:

why ?

Servus ^Daemon^

U R the UG for lamers bringing out automagic unpackers with your ace coding skills. Nothing wrong in that - I think you gave most of source code with unpacker, great. BUT Newbs should study and learn. But nobody does :mad: . They just wait for latest release and think they are UG's too. Same scenario with ALL auto-unpackers, especially with CASPR !!!

BUT here we try to TEACH USAGE OF THE *BRAIN* in RCE..........so that one day every one could knock up their own unpacker if they wanted. Back to my stupid question :-

R U saying Nchanta is mystified with teunlock1 + icedump /tracex
and so we should figure out the problem. I can't believe this ??? BUT , if this really is the target Nchanta was scared to upload for us then I say we make a challenge on the other board and find your tricks.

Then fix icedump source/re-compile and your trick is defeated ???

I don't readily have access to Win98/ME but I d/l the supposed target and will take a peek soon.

Greetz to Egoiste as well. Excellent cracker and programmer, lots of source code given to us to build on esp. with keygens. BTW i'm sure you appreciated we taught to manually defeat te!lock rather than use unpackers ;)

It's great to see you *ace* guys frequent the all-new-super-lubed-RCE-MB and give us some challeges and tips as well :cool:

Spl/\j
+SplAj
10-11-2001, 08:02 AM
duh, sorry for stupid question.....just checked IP ......... Nchanta is is playing a doppleganger game ;)

clusurf==nchanta

so 'old' target is valid , just protected now.....

Later
^DAEMON^
10-11-2001, 08:07 AM
:) hi splaj,

i've had no other exe than teunlock here as i gave out my protector to some crackers out there... so try it...

u'll like it! iam sure.... and yeah it's true it has icedump detection
and /tracex crashing

good luck
^DAEMON^
+SplAj
10-11-2001, 09:13 AM
^DAEMON^

/me smiley...... maybe ?

see attachment
^DAEMON^
10-11-2001, 09:21 AM
read subject :)))

anyway most failed :)

please let me know if u traced or dumped the file....

^DAEMON^ ;)
+SplAj
10-11-2001, 09:26 AM
^DAEMON^

I just checked my rebuild on another PC. Seems I cocked up a clean ExitProcess call......

Anyway I rebuilt the file and it appears functional. I used Win2K at my work PC....

thanks for the challenge.

+Spl/\j
^DAEMON^
10-11-2001, 09:32 AM
so u didn't trace..... hehehe :)

fatal errrrrrrroorrrr
better destruct loader code... and see anti.debugging
u'll need this for further versions
+SplAj
10-11-2001, 09:34 AM
^DAEMON^

As I said I don't use Win98/ME or Icedump ........ but for sure If I get time I will analyse the dumped code with your extra poly protection and TRY to understand it ..................

+Spl/\j
Unregistered
10-11-2001, 11:08 AM
Hiya +SplAj,
yes I did upload the file cuz nchanta can't upload any file

clusurf==nchanta
nope :D
btw I'm cluesurf ;)

regards
cluesurf
Bengaly
10-11-2001, 11:29 AM
ehehehem daemon's stuff
Seems to easy for you eh? :-)
No such challange for HCUkers :-) .
cya
Benji
nofurs
10-11-2001, 11:39 AM
Heya all,
I have done it just like +SplAj not tracing at all
and its 11mbs :P.Not yet rebuilt the imports :(.
cya ;)
tsehp
10-11-2001, 03:51 PM
Trying to follow what's happening here and finishing rv's tracer to also trace a te-locked notepad spekkel sent me:

what's the real news about this *impossible* to trace app ?

Will someone finally upload it there ? So the challenge will be complete. Don't do if it's usual int1/int3/int68 bchk meltice anti single step code, it's more than defeated at this time.

Thanks to reupload/send it to me, so my next days will be busy again ;-)
^DAEMON^
10-12-2001, 12:36 PM
hiya... as i already said this version available to u is pretty old and the imports can be rebuilt pretty easy (tracing is damn hard!)
dumping and rebuilding was pretty easy in this version, so i'll go and give u another version soon!

till then ^DAEMON^

and bengaly please shut up...
nofurs
10-15-2001, 08:53 AM
Heya +Tsehp,
The anti-debug is written in opcodes.Icedump /tracex does not work for this program.its prompts illegal protection error .Trying to resolved using but failed.Its strange that when selecting the file in Revirgin it doesn't prompts the error and ask you to fetch the IAT ;P,anyway I just click it and resolved and it automatically resolved 2 times ....
the second time is slow and it prompts errors and it doesn't resolved at all ;PP
Anyway you can download the file and take a look ;)
cya
cluesurf
^DAEMON^
10-18-2001, 12:58 AM
hmmmm if someone else was/is able to crack it please post a message here or mail me the file back to cdaemon@gmx.net!
thx

^DAEMON^ :D
nchanta
10-18-2001, 07:57 AM
excuse me splaj+.

i am not cluesurf, and i never masquerade as other people. i was hardly 'scared' to upload the file, i didnt upload for two reasons:

1. i was told not to give the .exe out willy-nilly and
2. i couldnt upload with my post.

i also wasnt very perplexed with the packer, i simply wanted to know (refer to original post) how daemon managed to detect the tracer.

simple question, that i feel still hasnt been answered?

NchantA.
^DAEMON^
10-19-2001, 02:05 PM
just try it!

^DAEMON^
Unregistered
10-19-2001, 05:39 PM
Does that happen to be win2k compat?
^DAEMON^
10-20-2001, 01:12 AM
this file has got some header problems and won't work under 2k normally my protector IS compatible!

^DAEMON^
penfold
11-03-2001, 04:13 AM
i'll destruct it if you pay me $20 per hour.

hehe might be able to afford a packet of ciggies once im finished !

WOAH !! 6 seconds for it to execute / decrypt / whatever . feel the panic!

anyway, nice that it dosnt crash on my pc, or detect icedump, or detect softice . good work daemon! (win98se, sice4.0, icedump 5.17 hehe)

11,595,776 byte imagesize? hehe who the fuck coded that shitty unpacker! have they never heard of VirtualAlloc :)
tsehp
11-03-2001, 06:40 AM
Gosh this app doesn't let my tracer come in...congrats, I'm on this daemon ;)

can you re upload a win2k compatible ?
tia,

tsehp
^DAEMON^
11-03-2001, 09:29 AM
but wait i'll upload a new version soon (the file is normally compatible but my protector fucked the header in some way)

till then ^DAEMON^ :cool:
tE!
11-03-2001, 09:39 AM
I fear there's more than this app which don't let
your your tracer "come in".

Bah, know what Tsehp...I'm sick of win2k full ***STOPs
and KMODE exception.

Best use for revirgin was to test new BCWipe 2.36.1 on its
installation folder...
tsehp
11-03-2001, 12:40 PM
Te, why don't you upload it ? I raised the upload limit to 1 gig.

Daemon, the dp-borg2 is now traced, nice exports table trick ;)
evaluator
11-06-2001, 02:09 AM
Hi ^DAEMON^!

I like "unpacking"-deprotecting and
your protector is very interesting but
it is very NOT interesting deprotecting
SOME files!

It will very intersting if you will protect
your protector itself and upload here!
H3Xenoic
11-06-2001, 04:48 AM
hi

penfold, i think the 11mb exe is part of the 'tricks' ? having a huge padded section full of zero takes just 1 line in source ;)

*hint* best to check any large VSize numbers over RSize in the sections of target exe just to be aware about this in advance ;)

BTW I would have copied lots of code in there as well while expanding to really fux the dump with a repeat .loop REPZ or something :rolleyes:

however in this case just re-align the dump and petit size again :)
^DAEMON^
11-07-2001, 02:11 AM
hahahahaha :) na the 11mb isn't a trick, r!sc coded this shit :) don't know why he didn't use virtualalloc ? anyway hrm i don't release the protector i always just give out a few files, this way no one can do an unpacker :D

^DAEMON^

-------------------------------
love me hate me fuck me
-------------------------------
evaluator
11-07-2001, 04:11 PM
Hi Daemon!

I understand, why you won't publish your protector.
Also you can understand, why is not interesting deprotecting
SOME file.
!INTRIGUE NEEDED! Once again:
if you will upload here self-protected protector,
it will very interesting to deprotEto! (at least Previous_Version)

One critical note:)
Your protector is extraordinary &+but nonSOLID!

Here I submit dump file with one reconstructed Imported Function.
So can be reconstructed all others... I set OEP not 410000...
In other way, we can also reconstruct jump_table & calls to jump_table.

Question:
Does your protector
A. move jump_table &
B. change calls in program code for this?
Or you make it manually!?

GOTO post10825
^DAEMON^
11-08-2001, 01:04 AM
the import wrapper can be configured

options are:

-no mutation (let import table where it is, if 1 then jmp table is mangled)
-wrap api calls
-wrap all (normally random choosen if not 1)

i've got a test in 3 weeks, so no time for this project! i'll improve it soon :) there are a lot of things need to be done!

^DAEMON^ :D
evaluator
11-13-2001, 06:31 AM
Hi, Daemon!

As I found same IAT-redirection trick uses also telock98(at least).
My question is for history purpose:
How is author of this trick?

Hi, Tsehp!
If Solodovnikov will add this trick to ASPRotect...
You can close your RV project...
OR you must force your tracer to trace until real EXPORT. Is this possible???

My suggestion:
1. Lets make big pause in RV project!
2. Collect new anti-tricks
3. Come back with turbo-enhanced RV
^DAEMON^
11-13-2001, 07:02 AM
hmmmm 98% of the code is done by myself.... just very few tricks i have stolen from "k-kryptor"... all other i've done on my own...

the disassembler borg is something special it can't even be dumped if i don't protect the file!

anyway 3 weeks to go for my test... :(

iam pretty sure all of u will like the latest version....
200kb of poly code etc...
better anti-dumping
more code mangling
etc...

/me tries to kick your asses :D

^DAEMON^

---------
THE BIG PINK PUSSY IS BACK!
---------
+SplAj
11-13-2001, 07:37 AM
^DAEMON^

GOOD LUCK :D
Bengaly
11-13-2001, 08:34 AM
Yeah yeah relly good luck,
whatever u do Deamon,
Splayi and Tsehpi will kick it :-)
keep scramble and put more unneccery code in it and it will be even more nOneffective :-)

"Everything has a Flaw that's how the light gets" it heheh :-))

have fun
^DAEMON^
11-13-2001, 08:57 AM
bengaly how often should i tell u ??!?! eh ?
EVERYTHING CAN BE BROKEN!
THERE IS ALWAYS THIS RULE:

IF CODE = EXECUTEABLE THEN BREAKABLE!!!!

i can only improve it and make it harder!!!
and i'll do....

hmmmm also i think they like the protector, hopefully

so long, the test is going to be really hard :(
wish me luck!

^DAEMON^
+SplAj
11-13-2001, 10:06 AM
^DAEMON^

I did mean *good luck* with the EXAM :D

but you can kick bi-tarts butt for luck though ;)
Bengaly
11-13-2001, 11:29 AM
hehehe...

anyway DEAMON, than make it Profitble if its hard to unpack or so, just like aspack...
it will be handy u know :)
cya
^DAEMON^
11-15-2001, 06:35 AM
maybe even some of u have got a few ideas....
about anti-debugging other ways to detect soft-ice
(then i do)

or some usefull tricks
maybe anti-dumping without modifying pe-header or api-hooking
every information can be usefull

maybe some tips for better import wrapping ???

^DAEMON^ :)
Lord_Soth
11-15-2001, 11:19 AM
DAMN DUDE!!

That's a VERY nice animation ;)
tsehp
11-15-2001, 03:25 PM
Originally posted by evaluator
Hi, Daemon!

As I found same IAT-redirection trick uses also telock98(at least).
My question is for history purpose:
How is author of this trick?

Hi, Tsehp!
If Solodovnikov will add this trick to ASPRotect...
You can close your RV project...
OR you must force your tracer to trace until real EXPORT. Is this possible???

My suggestion:
1. Lets make big pause in RV project!
2. Collect new anti-tricks
3. Come back with turbo-enhanced RV

sorry but it seems that you really don't know how rv works...
let me explain :
I first coded some disasm code to fix the first schemes, first instr api executed then jmp to real api, or api call redirected, and it was working fine, just like imprec on first days.

Then aspr, vbox and other schemes began to mangle their iat calls, it was almost impossible to code a disam to decrypt/demangle them, so the tracer was began 10 days after first rv version.

Actually, 90% of my work is focused on the tracer, just because when this tool runs, it gets the first priority on the system and executes the apps, iat calls, everything.

This tracer serves iat resolving, and the only way to avoid it to go inside the api is to emulate the api... alexey made a first attempt with simple ones, but I also emulated them, so this was easily fixed. If someone tries to emulate all of them, he will have to build a different version for every kind of windows and every build ;)

Like theOwl said in past posts, the tracer is a very important tool, It can also be used to dump programs, just like icedump on win9x, and later could also be used to build a boundschecker-like program, used to make all kind of reports you want, maybe opening it's behaviour and make it react with a script language could be very interesting.
tsehp
11-15-2001, 03:26 PM
btw, Daemon, I have to thank you for your anti tracing features
that are actually solved.

can you do more please ? I feel I'm close to whatever was possible to invent, but I'm sure you can surprise me on a new version maybe ?

best regards,

tsehp
^DAEMON^
11-16-2001, 02:07 AM
yeah sure i think i'll add r0-tracer instead of my lame "r3 engine" which is really damn slow :)))

actual version is beta 6.5....

but wait i've got exam soon.... 2 weeks exactly

^DAEMON^ ;)
tsehp
11-16-2001, 02:22 AM
and what will this change ?
^DAEMON^
11-16-2001, 02:27 AM
@ least a nice speed improvement!
have u seen the carry flag trick in it ??? dp-teunlock....
maybe u have some advices for me :)

till then....

^DAEMON^ :p
tsehp
11-17-2001, 05:41 AM
carry flag ?
I only fixed the seh that is called to generate the key, used to decrypt the code after the loop that calls this seh itself (pofd with tf flag set)

rv was loosing control after this.

can u locate me this carry flag trick inside dp-borg2 to see what happens ?

tia

tsehp
evaluator
11-17-2001, 03:32 PM
Viva Tsehp!

Today I successfully tested your TRACER with these protections:

PCGUARD (latest)
TELOCK 0.98
PE-PROT 0.9
also DAEMON'S protected file "DP-Borg2.exe"

This is GREAT! For example "GUW32 v1.0 beta8" can't trace these apps.

Failed for trace:
PELOCKnt v2.04
DAEMON'S protected file "DP-tEunlock.exe"

***
Now my STORY about tracing unresolved IAT entries:
When in my WIN98SE I choose unresolved entry and click on TRACE command...
my PC immediately RESETS.
This is new for me in new version. In older versions RV and program only crashes.
End of STORY.
***
Shaolin
11-17-2001, 05:32 PM
lol, another one wich has problems with latest RV on Win9x?
Wtf, all guys in here are using Win2k? I tested latest RV on a different comp with Win98, and if I select tracer it crashes the computer! Anyway, for Win95 users it can turn into a real drama, but I won't talk about this anymore because I don't want my post deleted again.
Woodmann
11-17-2001, 05:51 PM
Go ahead post away. you have until Sunday night until I start deleting.

Woodmann
Lord_Soth
11-17-2001, 06:09 PM
hey tsehp,

I've never used your tracer, or that of IceDump unfortunately..
Remember that I once asked you about a tracer, for a
tool I wanted to code ?
This that will work ?

LS
tsehp
11-17-2001, 07:28 PM
Originally posted by evaluator
Viva Tsehp!

Today I successfully tested your TRACER with these protections:

PCGUARD (latest)
TELOCK 0.98
PE-PROT 0.9
also DAEMON'S protected file "DP-Borg2.exe"

This is GREAT! For example "GUW32 v1.0 beta8" can't trace these apps.

Failed for trace:
PELOCKnt v2.04
DAEMON'S protected file "DP-tEunlock.exe"

***
Now my STORY about tracing unresolved IAT entries:
When in my WIN98SE I choose unresolved entry and click on TRACE command...
my PC immediately RESETS.
This is new for me in new version. In older versions RV and program only crashes.
End of STORY.
***

1- can you save me some time and send me url for pelock + dr-teunlock.exe please, I'll take a look.

2-when the tracer doesn't find a valid api address, or is simply leaded to a ret into special iat entry, it just rets and goes wild.
Windows just can't intercept it, because of ring0 proviledges and this simply leads to a reboot/bsod/crash
I had a lot when I first coded it and that's not finished, but never had some damages on my hd ;-)

I have to code a protection that will stop it before it rets out of iat entry pretty soon, that's why beta is still inside rv actual build...

spekkel alredy sent me sw3 that holds two crashing entries, I'll normally have the time to fix them sunday/monday.

regards.
tsehp
11-17-2001, 07:30 PM
Originally posted by Shaolin
lol, another one wich has problems with latest RV on Win9x?
Wtf, all guys in here are using Win2k? I tested latest RV on a different comp with Win98, and if I select tracer it crashes the computer! Anyway, for Win95 users it can turn into a real drama, but I won't talk about this anymore because I don't want my post deleted again.

Shaolin, before I begin again to delete your posts :

1-a really big bunch of users, including me uses this tracer on win98, so be professional and tell us :
-the app + url
-iat entry
-method you used
And you will be considerated, otherwise, deleted...

2-where did you see that rv was supported on win95 ?
evaluator
11-18-2001, 04:49 PM
Hi, Tsehp!
"dp-teunlock.exe" is here! Cluesurf submitted
as attachment "dp-teunlock.zip"! Look at fourth replay in this thread.
(attachment.php?s=&postid=8939)

About "PELOCKnt v2.04" protection.
I have Gabler's old protector "PE-PROT v0.9"
This file is first time internally protected (2nd section),
then with "PELOCKnt v2.04", then selfprotected.
From start to 407000 RVtracer is successfull, then crashes.
You can find "PE-PROT" at "exetools.com".
Shaolin
11-18-2001, 05:03 PM
evaluator, as far as i know PE-PROT doesn't mess with import table, but I might be wrong.
tsehp, the *tracer* hangs on my Win95 with any packer/protector I tried...Now I understand the problem and why it crashes like that, and it's indeed quite difficult to find a reliable solution...Anyway, I think u shouldn't have done of it a PUBLIC beta, but only a beta for your betatesters. ehrm, enough critics:D hope u will fix that soon:)
Shaolin
11-18-2001, 05:08 PM
oh, were did I see that RV is supported on Win95?
Well, a quote from your "Documentation":

added an auto kernel patcher, so revirgin should work on every win9x past and future versions.
When someone says Win9x I also think at Win95 anyway.
evaluator
11-19-2001, 01:12 AM
Shaolin
In this case I wrote not about resolving import
but about tracing app. from start to OEP.
This is another tracer.
And finally, why you are unregistered?
tsehp
11-19-2001, 01:34 AM
Originally posted by Shaolin
oh, were did I see that RV is supported on Win95?
Well, a quote from your "Documentation":

added an auto kernel patcher, so revirgin should work on every win9x past and future versions.
When someone says Win9x I also think at Win95 anyway.

yes, you're right.
But I actually have 3 partitions : win me , win2k server and win xp.
It's pretty time consuming to make a support on win98 + win2k as long as win98 will disappear. So I wont be supporting for win95, you should better upgrade at least to win98se or win2k pro.
^DAEMON^
11-19-2001, 07:05 AM
hi tsehp,

hmmm maybe u allow me a personal qwestion,
how old are u ??? (me is just interested)

(iam 21)

^DAEMON^
tsehp
11-19-2001, 12:39 PM
I'm older than arthaxerxes which is 14 , and younger than splaj, which is 65 ;)
tsehp
11-19-2001, 02:49 PM
me too !

Ok, I'm 33 . Remember my past comment : I'm too old for this ;-)

Daemon, your dp-teunlock just kills my tracer after 0x10000000 instructions traced...

I think I'm not gonna sleep tonite...

Seems like an exception that dp self generates, I'll take a look.
+SplAj
11-20-2001, 02:18 AM
I did not know I was this young. :eek:
^DAEMON^
11-20-2001, 05:35 AM
hiho some nice news, maybe ur interested

hmmmm perhaps u figured out that i've implemented an oldschool trick to prevent /protect on..... just disabling the screen for a short amount of time.... so now yesterday i found a way while playing around to stop icedump popping up on accesses to idt :) u'll get the example soon!

:D ^DAEMON^ :D
evaluator
11-20-2001, 07:12 AM
Tsehp!
dp-teunlock.exe very often crashes under debuger. I think,
here can be some BUG, because DP-Borg2.exe not crashes!
So forget it and wait for new DP version.
How about PELOCKnt? Did you solve problem?
If you want, I will upload here problematic files (35kb zip).
tsehp
11-20-2001, 07:57 AM
Originally posted by ^DAEMON^
hiho some nice news, maybe ur interested

hmmmm perhaps u figured out that i've implemented an oldschool trick to prevent /protect on..... just disabling the screen for a short amount of time.... so now yesterday i found a way while playing around to stop icedump popping up on accesses to idt :) u'll get the example soon!

:D ^DAEMON^ :D

I already notified theOwl about your /protect on trick, that actually works against 6.024 icedump. he will surely make the necessary changes. I'm still on your #$*&&$ of dp-teunlock
grrrr ;-)

pretty good work, instead.

regards,

tsehp
tsehp
11-20-2001, 07:59 AM
Originally posted by evaluator
Tsehp!
dp-teunlock.exe very often crashes under debuger. I think,
here can be some BUG, because DP-Borg2.exe not crashes!
So forget it and wait for new DP version.
How about PELOCKnt? Did you solve problem?
If you want, I will upload here problematic files (35kb zip).

thanks but I can't stand the following thing :
icedump manages to trace anyway, and not rv, and I'm about to locate the guilty instr around 0xf06900 0xf069ff...

Let me fix my bug and then I'll look at pelock, one thing at a time
;-)
^DAEMON^
11-20-2001, 08:39 AM
:) hehehe sleepless nights ???

hmmm i already thought that someone will tell the owl about the detection.... on the other hand i don't know if he is able to protect against that! so maybe iam in the next whatsnew.txt *grins*

there is no need any longer to disable the screen... icedump just doesn't catch sidt instruction! new tricks....
/me tries to be l33t, hehehe (@ least i try)

^DAEMON^

8 years now of reversing....
exit_2
11-20-2001, 09:25 AM
Hello Daemon,
EliCZ's DumpXDT accesses GDT (and goes ring 0) and icedump doesn't detect it.
I think it is maybe one year old prog and I think The_Owl know it.

Btw: I think it is not good solution switch prog from ring3 to ring0 with methods like IDT, LDT, DIV0 (lame c-dilla's trick) and etc. I think better way is use Kernel32!ord0001 calls (VxD calls) or VxD.

Exit
evaluator
11-20-2001, 09:32 AM
Daemon!
I simple don't use "/PROTECT" option...
^DAEMON^
11-20-2001, 09:53 AM
hi exit!

haven't seen u a long time :) ähm i don't switch to r0!
it's just for detecting sice and icedump.... i don't manipulate therefore somethin....

(okay but only for anti-bpx)

^DAEMON^
evaluator
11-20-2001, 04:25 PM
Splaj's revirgined file crashes under
my win98se. Here I submit more "virgin" one.
evaluator
11-20-2001, 05:01 PM
Hey-hey, Splaj!
Only now I check your "SPLAJ-teunlock1.exe"
& it is broken file!
Here works only 3 import functions, because
their JMPs are not mangled!
You must repoint also mangled JMPs to new
IAT location!
tsehp
11-20-2001, 08:22 PM
Originally posted by ^DAEMON^
hiho some nice news, maybe ur interested

hmmmm perhaps u figured out that i've implemented an oldschool trick to prevent /protect on..... just disabling the screen for a short amount of time.... so now yesterday i found a way while playing around to stop icedump popping up on accesses to idt :) u'll get the example soon!

:D ^DAEMON^ :D

yes in on port 3c5
or al,20
out port 3c5

black screen.

not triggering while latest icedump 6.024 traces your app, but triggering on rv :-(
tsehp
11-20-2001, 08:23 PM
Originally posted by ^DAEMON^
:) hehehe sleepless nights ???

there is no need any longer to disable the screen... icedump just doesn't catch sidt instruction! new tricks....
/me tries to be l33t, hehehe (@ least i try)

^DAEMON^

8 years now of reversing....

/me thinks you didn't checked its source... it does make some emulation for sidt.
^DAEMON^
11-21-2001, 02:16 AM
ooooopssss sorry but i did a mistake! in my source forget the last news....

shame on me :)

^DAEMON^

hmmm could u gimme icedump 6.024 ??? (would be nice)
evaluator
11-21-2001, 02:35 AM
Yeah, Tsehp!
Why you wrote about new ICEDUMP??
I didn't said about it, because I was planning
surprise for Daemon's future DP version!
OK, you are lucky guy, Daemon!
I sent to you private message with URL.
^DAEMON^
11-21-2001, 06:04 AM
thx! :)

hmmm i found icedump 5.17 :D nice! so i can add "SUPPORT" for this one too....

^DAEMON^

hmmm i'll check out the tracer later today... hopefully it worx with k-kryptor... let's see
evaluator
11-21-2001, 07:19 AM
plEasE,plEasE,Daemon!
If you will kill ICEDUMP 6.024 tracer,
I will CRY! Don't be THE DAEMON!

BTW, what is a "k-kryptor"?
Newest cruel anti-DD, or old one?
& where I can found it?
tsehp
11-21-2001, 07:43 AM
Originally posted by ^DAEMON^
ooooopssss sorry but i did a mistake! in my source forget the last news....

shame on me :)

^DAEMON^

hmmm could u gimme icedump 6.024 ??? (would be nice)

latest icedump is always at
icedump.tsx.org

I wonder what you used to also cause a problem to the rv win2k version, I'll find out ;-)
tsehp
11-21-2001, 07:45 AM
Originally posted by evaluator
Yeah, Tsehp!
Why you wrote about new ICEDUMP??
I didn't said about it, because I was planning
surprise for Daemon's future DP version!
OK, you are lucky guy, Daemon!
I sent to you private message with URL.

no no, sidt support is here since long on icedump.

If I remember almost since the tracer was coded.

I just added mine since build 10 (still not available)
evaluator
11-21-2001, 12:50 PM
Ye-Yo, Daemon!
Today I had free time & MASTRUBATO DEPROTETO
also your DP-Borg2.
Have pFun!
Send your suggestions via...
^DAEMON^
11-21-2001, 01:33 PM
hmmm i downloaded it @ least, but had no time yet to bring it to my puter @ home.... no emulator is 100% so time to search the bugs in their new tracer... hopefully i find a bug soon :) muahahaha

all of risc's latest programs were protected by k-kryptor!
like poxylok 1.3b and unsafedisc 2.30.31 and those! get em and try to unpack them! k-kryptor is one of the best protections i know of! hats off r!sc and noodle!

^DAEMON^ :D
evaluator
11-22-2001, 04:51 AM
WOW, Tsehp!
I check K-Kriptor &&
this is crasy one!
It crashes ICEDUMP's tracer!
And your RVtracer also!
It firs emulates part KERNEL export instruction
and then jumps to this instruction!
I have downloaded "UnSafedisc" from
www.programmerstools.com (in august)
^DAEMON^
11-22-2001, 07:13 AM
hehehe i've got several betas of k-kryptor and a unpacker for each beta :)

sorry but i can't spread em! some dudes out there have got my unpackers.... maybe u are lucky and get em...

k-kryptor.k2 + unpacker
k-kryptor.k4 + unpacker
k-kryptor.k5 + unpacker
k-kryptor.k8 + rebuilder
k-kryptor.k9 (this one i don't own :() but a nice workin unpacker :D

i totally bored r!sc to death.... he doesn't gave me any new beta... :(

^DAEMON^
tsehp
11-22-2001, 07:45 AM
Originally posted by evaluator
WOW, Tsehp!
I check K-Kriptor &&
this is crasy one!
It crashes ICEDUMP's tracer!
And your RVtracer also!
It firs emulates part KERNEL export instruction
and then jumps to this instruction!
I have downloaded "UnSafedisc" from
www.programmerstools.com (in august)

I'll surely have work in the future when I'll be finished with dp-teunlock.

TheOwl doesn't answer me about dp-teunlock...
But he's surely reading those threads regularly so it will surely be updated pretty soon.

It's great to find such protections before having to deal with them inside aspr or vbox.

btw, can't access protools.cjb.net since yesterday, can u ?
are there "replacement" servers for suddendischarge or other alternatives to protools ?

cia,
^DAEMON^
11-22-2001, 09:24 AM
hi tsehp, seems that they are down! also codersdomain
the only one active is exetools.com
sad but true!

^DAEMON^
tsehp
11-22-2001, 03:53 PM
I asked woodmann if he's ok to help them a little. We'll see.

dp-teunlock : on w2k, my tracer crashes at f0639f , just because here the code is unvalid (bad decrypted)
you maybe have used a trick to detect it, and then a bad key is used to decrypt those instructions...
almost the same than dp-borg2 , but maybe not with the int1 called in signle step mode that was calling the seh and generating the key to decrypt the code further.

I'm getting closer.... Nice tricks ;)
evaluator
11-22-2001, 07:41 PM
Yeah!
K-Kryptor is TERRIBLE!
But I'm also!
Daemon, check me file if all is ok, please.
Unfortunately I have not "safedisc"-protected
files and can't check if all is OK.

So I traced into program and wrote
"IT.TXT" for RV. Then RV created for me "IT.BIN",
I paste BIN in DUMP &&& then I BUILD NEW
JUMP TABLE.

EnjoE guys with latest art of
MASTRUBATO DEPROTETO 8)

p.s.
not FindCloseChangeNotification but
CloseHandle must be in my IT.
^DAEMON^
11-23-2001, 02:33 AM
some nice k-kryptor stuff for the weekend :)

grrr filesize too big - error i'll add it to another location on the board
and paste the url afterwards here

^DAEMON^
^DAEMON^
11-23-2001, 03:45 AM
k-kryptor.k4+my k-unkryptor.k4
^DAEMON^
11-23-2001, 03:49 AM
k-kryptor.k5+ my k-unkryptor.k5
evaluator
11-23-2001, 04:35 AM
Hi,Daemon!
This versions of K-Kryptor are from good old time!
They don't know about CODE MANGLING and WIN-EXPORT RIPPING!
This EXPORT RIPPING is terrible~:0! Since yesterday I'm shocked!
As I presumed, this type of protectors (also probably your DP)
can't handle RDATA-like sections, only IDATA can, OK?

Tsehp, Daemon!
Let's close this thread, because it is too big.
We simple can continue in new thread...
{;called: "We was talking about Mojo;}

Tsehp!
1. Seems, you again waste time on dp-untelock...Forget it!
I think, it probably contains bug. Reason: Latest DP-Borg not crashes!

2. If would you like, let's make vendetta-thread: "PROTECTOR'S DEADFIELD"
in PROJECT AREA.
^DAEMON^
11-23-2001, 05:00 AM
evaluator,

hmmm a new thread would be great!
hmmmm dp-teunlock has NO BUG!
i assume that it's crashing somewhere inside the tracer!
dp-borg doesn't have this feature any longer!
therefore it loads much faster

loading a 1 mb exe with my protector took about 1.5minutes in beta 6.0!

and yeah the stuff is pretty old BUT! take a look @ it!!!

^DAEMON^
^DAEMON^
11-23-2001, 05:51 AM
disassembly of poxylok

it's a rar file renamed to zip, k ????
^DAEMON^
11-23-2001, 05:52 AM
binary file of the import loader of poxylok
^DAEMON^
11-23-2001, 05:53 AM
hiya all,

1. ähmm i !REALLY! don't know WHY IAM DOING THIS HERE !!!!
i didn't want to give these files out... anyway those files are pretty old
already, so hopefully risc and noodle don't get angry! and guys take a look
@ this shit here!

2. u can't compare those versions of k-kryptor to those
today exist, anyway it was a really nice game for me (unpackers)

i've included a nearly complete disassembly of poxylok which is actually
protected by k-kryptor.k9 (beta9)

3. i don't rel. the other stuff i've done! (sorry :)

4. decrypted.bin is the "decrypted & unpacked" import loader of poxylok...
take a look here :)

^DAEMON^ - 22.11.01

(k-unkryptor.k9 has got around +2000 lines of code ;-)

PS: RISC please don't be angry with me!
evaluator
11-23-2001, 05:41 PM
OK, today I MASTRUBATO DEPROTETO also "SafediscV2.30.31Dumper".
Daemon, submit another files protected
with your newest beta.

I will eat...

BTW, tutor needed?8-0
tsehp
11-23-2001, 06:00 PM
Originally posted by ^DAEMON^
evaluator,

hmmm a new thread would be great!
hmmmm dp-teunlock has NO BUG!
i assume that it's crashing somewhere inside the tracer!
dp-borg doesn't have this feature any longer!
therefore it loads much faster

loading a 1 mb exe with my protector took about 1.5minutes in beta 6.0!

and yeah the stuff is pretty old BUT! take a look @ it!!!

^DAEMON^

sure dp-teunlock have no bug, but I have to finish this one, as icedump manages to trace it on w9x, and I want the same result on w2k, just to finish all possible known emulations...

I think I've located the trick, I'll see ya on the new thread.
evaluator
11-24-2001, 03:11 AM
Daemon!
Can you submit here following files
"deprotected" with your "k-unkryptor.k9":
1. "SafediscV2.30.31Dumper"
2. "SafediscV2.30.31Rebuider"
Simple I want compare with my work.
^DAEMON^
11-26-2001, 02:04 AM
hi evaluator
as long as i don't get the whole k-kryptor.k9 i won't do anything!
anyway i had a great weekend! i've tested icedump 6.0.2.4 this weekend... and found already several "BUGS"

new /tracex detection
and
new icedump detection

etc.....
ähmmm where do u wanna post the new thread, tsehp ???

^DAEMON^
tsehp
11-26-2001, 12:06 PM
well do it there it's not a problem.

dp-teunlock should be traced as they are no new tricks.
But you use drX to contain the key, used to decrypt the code later, and rv is actually crushing the drX just at the first seh's instruction (called by the int 6)

that's why it's crashing, I'm actually figuring out why the debug registers from context_record contains bizarre values under rv ;)

regards.
^DAEMON^
11-27-2001, 01:41 AM
hmmm but dp-borg is getting traced correct ??? strange....
maybe i'll post a new version earlier than u have thought
(i've implemented the new tricks yesterday)

is this rv tracer available to the public ???
(need to download and search for bugs :))

^DAEMON^ :D
tsehp
11-27-2001, 05:14 PM
I was talking about dp-borg two weeks ago.
The actual rv tracer is downloadable at home page, but only version 1.2 beta 9 public version.
When I have time to finish dp-teunlock the beta build 10 will be available with several new features.

cheers,

tsehp
evaluator
11-28-2001, 03:19 AM
Tsehp!
You wrote:
"When I have time to finish dp-teunlock the beta build 10 will be available with several new features."

So you fixed also "PELOCKnt v2.04",
or you forgot it?
tsehp
11-28-2001, 03:55 AM
Did I say I was working on PELOCK ?
^DAEMON^
11-28-2001, 04:11 AM
hehe, strange that no one gave me more tips on anti-debugging :)))
just don't know why....

arg 2 days to go till EXAM!
grrrr
^DAEMON^
evaluator
11-29-2001, 04:26 AM
Daemon!

GENERALLISSIMO tip for anti-debuging & protecting:

_F_O_R_G_E_T_ _I_T_!_
^DAEMON^
11-29-2001, 04:33 AM
hehehehe :) yeah, maybe....
anyway iam closing the doors SOON...!

^DAEMON^
^DAEMON^
11-29-2001, 09:56 AM
good god, the fear of the test tomorrow is killing me.....
can't touch the keyboard any longer.... cold sweat!!!!!

shit can't sleep tonight
help me!!!!!!!
^DAEMON^
tsehp
11-29-2001, 01:07 PM
And last night my 2 months old kid had a terrible nightmare and...

for godsake, create a related thread on off topic section, on this place we stick to rce talking.

thanks a lot.


Can anyone help me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Can anyone help me
PDA

View Full Version : Can anyone help me

kemo
10-09-2001, 05:18 AM
Hi there,
I have a program i have been trying to crack for quite a few days now,i am very new at this,but have learned a lot of the basics,when i click on the register button i have an option to enter a reg key,but above the reg key is a fixed serial number,so i think that the reg key has to correspond with the serial,can anyone help me out here,its driving me nuts,I am not asking for a crack,but if anyone wants a copy of the software i would be most willing to send it to you,its only about 400kb or so..
thanks a lot
kemo
EtErNaL_L0ser
10-09-2001, 10:30 AM
Go and check academy database at

http://tsehp.cjb.net
kemo
10-09-2001, 10:55 AM
thnx for the reply i'm looking at it now :D
Unregistered
10-09-2001, 05:33 PM
hi again kemo,
hope the help helped,
jomamameister
kemo
10-10-2001, 01:33 AM
i'm reading up on a lot of the tutes,but i have not come across anything like this yet,maybe i need to read a lot more :)
hehehe
kemo
kemo
10-10-2001, 01:43 AM
Thanks very much jomamameister,
god that was quick,nice to see someone with the gift,ive spent days on that :(,the help certainly did do the trick,thankyou my friend.........
yours thankfully
Kemo


BPX according to ST0 value
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > BPX according to ST0 value
PDA

View Full Version : BPX according to ST0 value

Cps530
10-09-2001, 06:53 AM
Does anyone know if it's posible, in SI, to break when ST0 has a specific value? For example, I want to break when ST0=12345. Thanks
Solomon
10-10-2001, 02:09 AM
currently no way:D


Nice Securom trick
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Nice Securom trick
PDA

View Full Version : Nice Securom trick

aurora
10-09-2001, 10:34 AM
If you ever debugged a Securom protected game,you probably
know this neat little trick: If you p ret from a securom call
your 'trace bar' is locked.ie F10 does nothing.if you manually
set eip ,you can go on. Does anyone know how this works?
exit_2
10-11-2001, 09:51 AM
Yes we know this trick :) It is very old trick, which EliCZ published maybe 2-3 years ago. I don't know If Sony found it, but I think they stole it from EliCZ. It work very simple, they set debug breakpoint. It isn't very clear and I think it is dangerous on Win9x.

Exit
aurora
10-12-2001, 11:13 AM
Originally posted by exit_2
Yes we know this trick :) It is very old trick, which EliCZ published maybe 2-3 years ago. I don't know If Sony found it, but I think they stole it from EliCZ. It work very simple, they set debug breakpoint. It isn't very clear and I think it is dangerous on Win9x.

Exit

what did he publish? a crackme? i don't understand your explanation.they et a hardware bp on the return address and
then? or does a hardware bp that is not set by softice 'halt' the
code bar ?

btw it works fine on 9x
exit_2
10-17-2001, 04:57 AM
I think EliCZ never publish any crackme. Do You know EliCZ's work ? He publish this trick in one of his prog (now I don't remember name).
Trick is simple. They set hardware breakpoint. I think they use SEH like EliCZ but it can be done via RING0 too. They set it to instruction and if You trace, SICE stop on it. You can't trace more.
Simple, but it work.

Exit


sentinel spro - no need for devID
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > sentinel spro - no need for devID
PDA

View Full Version : sentinel spro - no need for devID

Unregistered
10-09-2001, 10:44 AM
hy,

some day ago, while i was playing with a spro
is turned out that :

FormatPacket(packet, 0x404);
Initialize(packet);
FindFirstUnit(packet, 0xFFFF);
FindFirstUnit(packet, 0xFFFF);

... and now you can read the dongle, without
bruteforcing devID... istant access :-)

driver version : 5.30, 5.38

now the question is how it can work ???

and if i wanna read ALL dongle memory (algo included)
how can i do???

haec_est
Morlac.
10-11-2001, 02:54 AM
Hi there,

The reason for this effect will be apparent once you reverse engineer the sentinel driver ( get an old driver, much easier and tidier code to understand , I used ver2.1). Basically, the dongle hardware has no lock to prevent any read from it before any other initialisation.
So, what actually happens when the dongle recieves a FindFirstUnit() & FindNextUnit() <- Identical functions
the drivers reads the dongle DevID and compares it to the value the user passed down. If it matches, then good guy.
In the case of 0xffff, Its just a bug in the driver the got introduced in the more recent driver updates.
Older drivers didnt allow for the 0xffff trick.
-------------------------------------
psudo code for the FindFirstUnit function from the driver
------------------------------------
FindFirstUnit(packet)
{
packet->unitnumber = -1;
findnextunit(packet);
}

FindNextUnit(packet)
{
.........

start:
setup_port(); // initialize the parallel port & dongle
sendInstruction(0x85);
result = ReadCell(1, &DevIDl); // Same as SproReadCell(...)
if(result){
release_port();
goto start;
}
if( DevID == 0) {
//// Why is this happening? Whats the secret????!!!!
query(0x0BC614E);
release_port();
goto start;
} else {
if( DevID != packet->DevID) {
release_port();
packet->result = error;
return;
}
ReadCell(5, &Num);
if(Num != 0) {
release_port();
goto start;
}
ReadCell(0, &serial);
packet->serial = serial;
packet->error = unit found;
return;
}
---------------End of code ----------------------
Hope this clarifies what you want to understand.

As you can see from the code, there are a few unexplained
issues that I encountered, like whats Cell 5 is supposed to be
and that query(0x0BC614E).
Well, hope I helped.

Morlac
haec_est
10-13-2001, 09:07 AM
hi,

thanks for your answer... very usefull. :)

Now i had only a little problem, i wasn't able to find a so old driver over the net, only 5.x version...

where i can find that drviver ?
justo to study it a little bit...

thanks,

haec_est
Morlac.
10-15-2001, 11:41 AM
I can email the old .sys file.
Address?

Morlac
haec_est
10-16-2001, 08:52 AM
this should work : haec_est@hotmail.com

thank you,

haec_est


What do you want to see in this forum?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > What do you want to see in this forum?
PDA

View Full Version : What do you want to see in this forum?

Kayaker
10-10-2001, 12:01 AM
Hi All,

Now that the ISP problem has settled down (emoticon for miscellaneous extremeties being crossed), it's time for some feedback on what people would like to see here, suggestions for types of projects and what they'd like to learn, and offers of new projects. For those who haven't participated before you can look at the earlier projects (find that thread-sorting box thingy and select 'from the beginning') and see the kinds of topics that have been covered.

The site was initially developed as a place for people to work on reversing projects together and learn from each other. Hopefully the projects would encompass a wide range of topics, covering different aspects of the subject. It's really up to everyone on the board who wants to participate to try to develop some interesting projects. It can cover protection, code injection, encryption, programming aspects of reversing, using the tools, anti-debugging, system modification, packers, languages (we STILL haven't had a VB-specific project yet introducing the basics of VB breakpoints!), and so on.

Ideally, over a period of time the projects would introduce newcomers to the different tools, techniques, and things to look out for when reversing. Preferably it's not meant for people to just throw up the latest proggy they can't figure out, but instead that they think this would make a good project. Usually defining a few tasks, from easy to more challenging, that the poster has already worked on gives people a few common goals with which to discuss things.

But it's really wide open. As always, this is a newbie friendly forum and was meant for people to feel comfortable asking questions. Ideally we'd like a range of projects that would appeal to all, some more basic, some more difficult. But this should also be a place to discuss any ideas people may have. General reversing ideas that may not fit elsewhere as a topic for extended discussion. Maybe some of you are working on a tool or program that you'd like to discuss or get help with? Would people like to see programming related discussions here? Any other ideas?

Might we start a group effort of some kind, dealing with a major reversing project of some sort? There was a suggestion at one time of having a multi-input project a la - sourceforge.net
(Yeah right, I know C., what's the likelihood :rolleyes:

Just a few ideas for feedback. In the meantime there's always the old serial sniff or crackme project ;p

Cheers,
Kayaker
Woodmann
10-10-2001, 08:48 PM
What up G's,

"what would I like to see"

Any project no matter how small or large.
Any target you all desire. (no direct links please)

Practice is the only way I/You/We can progress. I don't care if it's a 8 year old serial fish tut.

If I have to I will recirculate old/new/unknown crackme's just to keep people in the loop.

I'm a shitty tut writer and an even worse crackme writer.
But, If you don't practice then you will fall behind. ( I am living proof).

Post anything you desire, easy attracts the new, hard attracts the skilled.

Peace, Woodmann
()whore
10-10-2001, 09:47 PM
Hello Kayaker,
I just finished reading Clandestinies tute on mixvibes pro, a project started in this forum. Great fun to read because I took part in the project. This project forum is realy one of the best places to learn how to crack. So keep up the good work. I haven't been cracking much but if I had a choice I would like to see a target dealing with VB.
Peace,
()whore
meaculpa
10-18-2001, 02:51 AM
Hi All,
Hmm...
Perhaps (IMHO) we can start with something easy and then progress to more difficult stuff. Lets, for example, skip ActiveX and other component based reverseing for now, and start with something "general".

How about we start with:
1) simple name/serial - fishing
2) more advanced name/serial - calculating
3) simple time-trial - patching
4) more advanced time-trial
5) simple funtionality adding - notepad etc.
6) more advanced funtionality adding - disabled functions etc.
and so forth........

We should also try and keep the targets as small as possible,
(crackme's are sometimes excellent) and unbloated as possible - in order for us to distinguish the trees from the woods...;)

What do u guys think;)

I'm also the list-owner of the cracking4newbies group over at Yahoo.Groups - but haven't started anything...... ( i would need some mods to help with this group)........if it helps with anything we can also utilise that

Ciao,
.MeaCulpa
Scally6
10-30-2001, 12:53 PM
As someone still struggling with basics (& time), I tend to agree with Meaculpa.
The last couple of q's I've put on the newbies forum haven't got any responses and its frustrating spending hours poking around and not getting anywhere, particularly after reading zillions of tuts that don't seem to directly relate to what I'm doing.
Most of what I've learnt has been in this forum - as well as most of the support I've got. (Thanks guys)
The last prog I posted a q about on the newbies might make an interesting project for people like me as there are three ways to crack it - Serial, keyfile or 'repair' the print/save disabled functions. It's in vis C, not packed & looked like it was going to be easy when I first d/l'd it...... I've still not managed it, although I've not yet looked at restoring the print & save functions mainly because I'm fairly sure I'll be able to do it and the keyfile rebuilding or sussing the serial part was what I was interested in learning about. I think something like this might show that there are more than one way of skinning (some) cats and it would demonstrate three methods of approaching a target.
So, is anyone here interested in having a go at it - knowing that I still don't have a solution? (its h**p://progenysoftware.com/downloads/genelinestrial.exe)
Otherwise, I'd really like to see some basic stuff guys.
Scally
MH2K
10-30-2001, 01:17 PM
You're download is here:

h**ps://secure.max.net/cgi-bin/sform/progenysoftware.com/Downloads/GenelinesTrial.exe

cya, mh2k
Scally6
10-30-2001, 06:40 PM
Tnx,
The link I gave still works OK for me but I'll d/l the legacy & update files from this site to see if there are any clues hidden
Scally
MH2K
10-31-2001, 05:04 AM
Hi Scally6,
Well, repairing (you can hardly call it that) is really simple. Just a single byte change.
I know you rather keygen it or so, but I always go for the easy way. ;)
maybe this helps

Fire up w32dasm,
Look for string "to unlock the software..."
scroll up, you'll see it's called from 42BC4B
from there scroll up and you see a conditional jmp.
Change to unconditional and it's fixed.
I think this jmp is where the prog should normally jump when it is registered and skip the unlock dialog.
Just before the jump the decision is made if the key is valid at call 42BC2F
Too complete it (make it pretty) you can disable the demosplash at startup.
The call from 42BC2F is called three times including from 44559E. Scroll down, you see LoadBitmapA. Go down a bit and you'll see a conditional jmp JNE. Change to JE and byebye splash.
You could also try to display a registered splash, if that is possible. I prefer without (less work and loads faster ;) )
Cya,
mh2k
Scally6
10-31-2001, 12:21 PM
Hi mh2k,
Thanks - I must admit I couldn't figure where the check of the keyfile was despite the blatant clue in the listing but Id really like to work on getting the keyfile to function, rather than patching. (I know its crazy but I don't want the app, just using it to try to learn)
Maybe I can now work backwards becos I know the end point, so thanks again.
Scally
MH2K
10-31-2001, 12:41 PM
Hi Scally6,
well, learning that's what it is all about. :D
You will profit the most if you figure out the keygen.

I found with ResHack there are indeed as you said two splash bitmaps. Demo is 261 ~ 105h and registered 109 ~ 6Dh.
Ok, with ResHack you can replace the bitmaps, but this really makes it simple and it works too, but I'd rather solve it using w32dasm, without replacing a large bitmap.
Does anyone know what to look for in disassembly? How is this bitmap resource called? I couldn't find it.
any help is appreciated!
greetz,
mh2k
jomamameister
10-31-2001, 01:27 PM
first, some thoughts. i see more and more progs going into some kind of protective packing for either the. exe and/or the .dll's associated with them. more things will also happen online. maybe the net will become a big repository for all of our future apps and the only way you'll access them is through password protected servers, etc.

with that said, maybe a section devoted to unpacking. we need more projects that deal with comtemporary projects that are packed in some way. everything that macromedia uses has been packaged to protect the app inside. ulead also uses a similar schema. we need intelligent tools to work with , including the best, our brains, and we need to know how to use them effectively from those among us who are more skilled in a certain area. let's have a thorough tutorial that is well thought out and covers everything about the project, and make no grand assumptions that those reading should be way up here at this level of cracking knowledge, or at least grade the tute possibly if you must. if the project needs to be unpacked, show us exactly how. if it's got messed up importtables afterward, show us exactly how to fix it. how, exactly, did you find that ghost-like eip? revirgin, come on, show us, walk through another tutorial on some useful app that you know is out there waiting on us. practice makes perfect, right?

i just saw the cryptography section here and i think that's important because more and more apps are being protected with a more complex schema than crc32. we need to know how to do that ourselves for our own apps and how to bypass it, too.

maybe a separate tutorial section like we used to have on fravia's old site--the student database. also make use of .zip and archive stuff for us so we can download, say, a whole month or year of tutorials. i do a lot of personal requests from people all over the world who want help cracking a prog and i write tutorials all the time. several are in the old database here, some are in the new and some have been on astalavista. i know we can upload stuff at the time, but a separate place just for writers and searchers would be welcome.

some people don't want to learn anything about what we know ourselves. all they want is a crack or a patch. that's ok, maybe there can be a separate area strictly for crack/serial requests with no intent of teaching going on.

thanks for the opportunity to find a useful outlet for our requests and dreams here, and for caring about the scene.
jomamameister
Js
10-31-2001, 02:27 PM
Hi jomamameister,
I like a lot of what you say but my vote is definitely against a request section.
regards
JimmyClif
11-01-2001, 02:43 AM
Hola Kayaker,

Hum... I dunno... I agree on a large base with Woodmann...

But back to topic:

You know as much as I do that it is rough to make it right for
everyone... It is simply not possible to start with the easiest and
work the way up to something harder as there are "new"
newbies coming in every couple of days wanting the easiest to
start with while other ones are already more progressed... (and
as it always is - no one ever checks the "old" threads.)

I think it should remain "as it is"... Life should just go on as usual.
Somedays there are more projects, some days there are fewer,
some days there are real easy challenges, somedays there are
harder. It all depends on the maintainer of the thread !

Newbies/Advanced are welcome to post and maintain targets as
long as it doesn't sound like a crack request (and of course as
long as they know what they are leading theirselves into)

I never thought that anything was wrong with "The Mini Project
Area" and I still believe in this.

Regards,
JimmyClif
Rage9
11-01-2001, 08:44 PM
Well if your new start with my first crackme i posted and work to 3, btw if anyone who had an essay for 3 has it please update it in the thread.

-rage9
Kayaker
11-01-2001, 09:37 PM
Hi All,

Heya JimmyClif ;) Glad to see you're still floating around. I think you've hit the bottom line there in your observations. It's an open forum for projects and so far it's been pretty good in general, but it just depends on what people post and the interest that it generates. Sure, it'd be nice to have a bunch of projects on the go so that people could tune in any time they wanted to and select one at the level and topic they desired, but this place just isn't that structured.

We've already covered a lot of good stuff before, but as you say, who really reads the old threads? An ongoing project is always more fun anyway. There's been some projects that have really taken off, and some that have fizzled. There's been some good suggestions and sentiments expressed re this forum, and I hope they can be fulfilled.

To be perfectly honest I'm not sure what to suggest. I'm happy to continue "moderatin'", for whatever that's worth, if people want. But I have limited time to devote to maintaining any kind of structured approach to the projects. The only thing I want to see are people having fun working on *any* kind of project together, I don't care if it's the simplest serial sniff. Indeed, I'd *like* to see the newbie kind of questions that show that even this is a big challenge to them, but that they've suddenly learned something new.

As far as I'm concerned people can post what they want and ask any questions they want. I think everyone can use common sense and judgement when it comes to any shareware target. I think we can actually do better than just how to patch "App X", there are deeper teachings than that, but that is where the basics lay...

I think Woodmann suggested recycling old crackmes. We could just post one here every week or so at random if people wanted to try that, just so there's something. A majority of them already have solutions, (which of course can be read), but for those who wanted to try them and get "real time" help from others on the board it could be useful. On the other hand, from the less than overwhelmingly enthusiastic responses seen previously in many project postings, I fear these may end up in the discarded 0-1 response category (I deleted several before opening up the threads to the past 100 days).

Time will tell I suppose.

Kayaker
npanic
05-09-2002, 11:08 AM
As meaculpa mentioned, adding func. like password protection on Notepad or another little prog. I have very little experience on that field(also that field), but i would love 2 follow the project.
crUsAdEr
05-09-2002, 12:00 PM
Hi npanic,

Read Kayaker's excellent series on adding functionalities with Regmon, FileMon and a few more... also razzia's notepad tutorial.. i have found them really informative and newbie friendly...

They can be found at krobar's site...

cheers,
crUsAdEr
npanic
05-09-2002, 12:09 PM
Hey crUsAdEr...

I allready red quite a few tuts on adding funcs, razzia did some of them. I think i will go dead with that kinda project with the skills i have. But thank u for suggesting it, and maybe after i has finished the project im fighting with know, i maybe will give it a try.
(My project now is inlining the new ASProt 1.2+ ;-) )

BTW, i have downloaded all krobar's tut a few month ago, so yes i have red about this and that. I think its a good idea 2 concentrate on one thing at the time, that's biggest problem i have, to do that ;-)

Okay here it goes again: Krobar's tutorial collection is the best available.
kugi
05-09-2002, 05:33 PM
Hi Kayaker,

If it isn't broken, don't fix it. This forum is not broken! It is kind of like a river. Sometines slow and sometimes you come to a water fall and think you will never be able to survive. Good stuff.

Your efforts to improve the forum are commendable. Keep up the good work.

Regards, Kugi
Kayaker
05-09-2002, 11:16 PM
Thanks Guys ;->

A project involving adding functionality would be awfully cool. Notepad would be a good target because it's been written about before and the techniques could be duplicated. Password protection as npanic suggests is an interesting idea. The file could be encrypted before it's written to disk, it's in a memory mapped area that could be accessed from an inline patch or by calling a dll. A simple xor routine would suffice, the real work would be in the supporting code. Signature bytes would have to be written into the file to recognize it, and maybe a decrypt key. Point of attack perhaps right after notepad memory maps the file, for reading the file, and just before the file is written to make the encryption changes. If notepad is to have a password feature now, getting rid of the file size limitation would make it more useful as well.

How about something like an enhancement to one of the tools we regularly use? Maybe the ability to save logs or other useful feature from some little utility. Adding a right click functionality or even toolbar buttons can make using a program you use often a lot more convenient.

I'm easy to ideas, if anyone wants to begin developing such a project by beginning analysis I'd lend a hand.

Thanks Kugi, couching that in terms of a waterfall I may not survive is something I can relate to, lol. And I've seen some big'uns - and sometimes wished I hadn't!
Hey man, how can you only have 6 posts, you've been around for *ever* ;p

Cheers,
Kayaker
mike
05-21-2002, 10:32 PM
Embedding encryption would be cool. How much room do we have to play with? Some "encryptors" I've seen were so pressed for room that they were too simple and I could break the encryption in my head. If you're going to add encryption, do it right.

That said, it doesn't have to be large. RC4 is still a strong cipher if you use it right, and it's tiny.
Kayaker
05-22-2002, 12:50 AM
Hello Mike,

Thanks for the reply. I think we'd all love to see a project along those lines. I'd be interested in just how to implement a good encryption into your own code, let alone trying to break it. I'm still reeling from just reading your dissection of the 'simple' encryption routine in the selftest thread, lol! Thanks for the mathematical breakdown, man it's time to take out the books again :-)

I've been to your website, with your experience I think it's awesome that you're here contributing to the forum. Cryptography is a deep field I've not spent much time in myself, but that other project you just replied to will be a good study.

How much room do we have to play with? As much as you want. What exactly is embedding encryption, and how are some encryptors pressed for room, as in no room to code a decent encryption?

Cheers,
Kayaker
mike
05-22-2002, 02:58 AM
Hi Kayaker!

Pressed for room as in not changing the size of the .exe, just using what space was left over or could be gleaned by eliminating other functionality.

If you're going to add a section, then you can put whatever kind of crypto you want in there.

I think RC4 is really good for this project, though, since it's so small you can memorize the code and is easily implemented in ASM.


+HCU Cracking Guide
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > +HCU Cracking Guide
PDA

View Full Version : +HCU Cracking Guide

Bengaly
10-10-2001, 05:45 AM
Hello all.

I have Posted my Cracking Guide aimed to those
Who feel need to crack or learn few trick and trubleshooting.
The guide located in http://tsehp.cjb.net

I hope you will enjoy it, ohh yeah and if you want to print
It make sure you have 40 Pages :-)

Cya All
Bengaly
EtErNaL_L0ser
10-10-2001, 06:11 AM
Cool essay for beginners :)
evaluator
10-10-2001, 04:31 PM
Bengaly!
Here one boy called "Code_Insaide" said me,
that he is newbie!
Your comments?!
Bengaly
10-10-2001, 05:05 PM
heheheh

Ain't we all newbies ?
U think that if u crack 4 years u a master ?
you wanna be good crack 10-20 years than don't call your self "newbie" , the guide was to get ppl interested, did i ever said it
Would help more advanced ?
Did u see me screaming i am the best ?

Any way CoDe_InSide is a funny dude, he likes to joke
But if he feels that way i can't stop him can i ?

I can always update the guide, make it 200 pages, you think it will make me Advanced cracker ?

w8ing for reply.
cah
10-11-2001, 04:29 AM
Hello, Bengaly

I am unable to locate the HCU Cracking Guide, Can you help me, give me exact location

regards
cah...
Bengaly
10-11-2001, 05:20 AM
the Guide is at HCU page:

http://www.woodmann.net/fravia/HCU-Cracking%20guide.htm

This is a direct link.

if it can't be reached, try http://Tsehp.cjb.net
Click the hompage loho, and scroll down, the first link is the Guide.
cah
10-11-2001, 10:18 AM
Hayya, Bengaly

Finally, I down loaded your cracking guide, I will enjoy by reading this.

thanks,
cah...
Bengaly
10-11-2001, 04:05 PM
Cah,

cool.
I hope you will enjoy Reading it,
If anyone think the guide should get Updated, dunno
to 200 pages or soo, drop a message.

Bye, cya, adios, shalom, cyonara,
nofurs
10-12-2001, 08:34 AM
Originally posted by evaluator
Bengaly!
Here one boy called "Code_Insaide" said me,
that he is newbie!
Your comments?!

Ideed he's a small boy :D
Bengaly
10-12-2001, 12:25 PM
When did i say i am an Advanced ?
and if again CoDe_InSiDE think i am one (newbie)
than he probably right, do i crack 20 years ???
CoDe_InSiDe
10-12-2001, 12:59 PM
Hi Everyone,

Bengaly == Newbie?

But ofcourse, like he said who isn't :D
But uhm.... Evaluator, when did i say to you that Bengaly's a Newbie?
I can't remember it :D

And Cluesurf, yes i'm a small boy 9.1 years old ;)

Cya...

CoDe_InSiDe
EtErNaL_L0ser
10-12-2001, 01:44 PM
Ok lets get back to the topic : CRACKING :D
CrackZ
10-13-2001, 09:18 AM
Hiya,

I've just read the first few pages of Bengali's 'Cracking Guide' and whilst I don't wish to get at him directly, I think it illustrates why everyone who writes a tutorial or tutorial(s) should have someone double check their articles or at least proofread it.

1. "Windows as you don't know, does not use Interrupts anymore"

This is plainly incorrect and stupid.

2. "Every Register is divided to low/high bit:"

I think actually in the context its supposed to be byte, since the diagram below suggests that, high and low bytes of si/di/bp anyone?.

3. "IDA is a first class Dissasembler, very recommended. [Dos interface]."

Yes and there is even now a windows version, unless 4.04's idag.exe is classed as 'DOS'.

4. "IceDUMP hides SoftICE so no app can detect it :-)"

Blatently untrue, ask the owl if he thinks this is the case ;-).

5. "Crackers do not tend to Code in Visual Basic, As it is heavy, UN optimized, slow, using DLLs And not Portable without them".

Perhaps this is so, but how the hell can you say VB is heavy and unoptimsed without qualifying it some way ;-).

6. "Double WORDS (DWORD) - 32 Bites"

Ahem, bytes maybe?.

7. Various other factual inaccuracies.

"real cracking began 10 years ago"
"borden" ; 1st paragraph

Try 30 ;-) or more.
Is this english?.

I only read the first 3 pages or so, and I found those 'errors' (as well as a fair few others were I being really pedantic about it).

Don't get me wrong here, I've got no objection to anyone writing tutorials but you could at least check the very basic information you provide for factual accuracy, or ask someone to proofread your texts.

Regards

CrackZ.
EtErNaL_L0ser
10-13-2001, 10:10 AM
Ahah you are right CrackZ but I think article is still coll for newbies at least intermediate ones ;-)
Bengaly
10-13-2001, 10:18 AM
CrackZ

-"Real cracking began long ago, something about 10+ years."
-"All interrupts were deleted and were rewrite from
Scratch to what we know as "API" ...yeah they do exist, in dos.
But I am talking about windows, maybe they exist in windows as well, but in API form.
-Ha "Borden" ha should be spelled “Burden”, my fault
-"Every Register is divided to low/high bit:", yeah bytes, I don’t think when u write at 3am u can remember much,
-"IDA is a first class Disassembler, very recommended. [Dos interface]." , ahh I never used
IDA, didn’t know about win version either, only dos.
-“Ask the owl if he thinks this is the case”, ha give me email.
-"Double WORDS (DWORD) - 32 Bites" , bytes, ha another fault occurred in 3am.

Keep reading, u are a good help to me, I like people to fix me up, it makes them think,
Better, just don’t be a sissy-lala on me will ya ? ;-)
ah, why i write in 3am ? cuz it's fun and quite, writing 40 pages straight from the head feww seems allot of work when u write in the night ain't it?
also no asm book here so i am sorry for any bad info.
anyway, i can always double check, but as i said this tutorial didn't ment for "known" ppl, so mabye it was a bad mistake to publish it anyway, ah i'll tell tsehp to take it off, ppl are flaming me too much, even in irc u aren't much of a "Friend" as well.

ill have a quick to talk rizz on stuff i need, Toleration is off when u are being well not respected, even when u are trying to avoid such ppl who seems to track u down.

anyway, i hope u happy now "CrackZ"
have fun in ur life as i in my self.
blah blah blah here and alittle there,
i also would be supprised even if u read until this part. :/

bye bye
Js
10-13-2001, 10:44 AM
Bengaly,
Don't be over sensitive, accept it as constructive criticism, do as he suggests, read it through, correct any inaccuracies. If there are things you aren't sure of or just don't know then ask someone who does. I'm sure people appreciate your enthusiasm.
regards
Hz
CrackZ
10-13-2001, 10:44 AM
Hiya Bengali,

Thank you for your somewhat less than lucid response. Please understand that in my post I was trying to gently prod you into correcting some mistakes and NOT publicly humiliate you.

Consider if you will :

i). What is the point of a 40 page document that tells newbies (your audience) to read the manual umpteen times when you yourself plainly haven't.

ii). What is the point of teaching newbies about subjects you plainly know very little about, you've never used IDA (your words not mine) and you are all of a sudden in a position to tell people its very good and they should use it, thats just plain laughable.

iii). "Every Register is divided to low/high bit:, yeah bytes", I still don't think you've grasped that this is still wrong. I'm afraid to say at 3am I do still remember basic x86 architecture where as it has escaped you at both 3am and now.

iv). The other mistakes are all blatently false, before you start telling everyone how to do things don't you think it would be wise to have some sort of basic appreciation of the facts before you tell people icedump can "hide apps so none can detect it", look on the other msgboard, I think theres even a thread about icedump being detected.

After making these harsh points, let me present the carrott, I'm very pleased indeed you chose to write a tutorial for newbies, I'd like to see many more people do it, please though, have the humility to accept your inaccuracies, and correct them ;-), that was the idea behind my post, writing a 3am bodge job tutorial with misleading information isn't going to help anyone.

Please also understand, this isn't a 'flame', I have nothing to gain or prove by doing so, maybe you need to be a little less aggressive in your receipt of criticism?.

FYI, I did read all of your message (even if the last few lines were less than succinct), my point wasn't to single out you for criticism, it was a wider point that you yourself have acknowledged, that it might be good to have essays which newbies are going to read, proofread.

I look forward to your updates ;-).

Regards

CrackZ

"Official member of the whinging old bastards party" and chairman of the campaign against this msgboard of frills ;-).
nofurs
10-13-2001, 11:20 AM
Heya Bengaly,

Criticism is the best way to learn from mistakes and more ever
its a friendly contructive one :)

cya ;)
Best regards

cluesurf
Carpathia
10-13-2001, 04:10 PM
What in GODS name has this tripe got to do with HCU ?
Bengaly
10-13-2001, 04:32 PM
hm..

Criticism, i can handle such thing, what crackz said was true on cases i did forgot / was my faults.
i won't hide / lie anything, of course i can Update it.
but still i think this need to be put down out from tsehp.cjb.net
i hope ppl did enjoy read somehow this essay.
i'll contact tshep to get all my stuff out, as this latest essay
was not the only problem i got flamed by.
more and more comes and use me as "todays joke"
same thing happened on the barcode tut, it was ok indeed,
still ppl laught at me.
so it seems even crackz didn't ment it, this was the last straw who cracked the chamel's back.
probably i won't be in mIRC anymore, only but to say few words to those who actually "cool" with me.
say hello to pgc's ppl [ what's left of it now ] and keep with my life.
ppl should know that i only tried to contribut as much as i can,
but no one [except few] liked it.

i hope u will be happy all now.

thanx to rizzah, the only man who helped me in irc,
i won' forget ya.
CrackZ
10-13-2001, 06:59 PM
Hiya Ben,

I'm sorry that my posts appeared a bit harsh (perhaps on reflection they were), it was never my intention to demoralise or demotivate or belittle you in anyway, you evidently have much enthusiasm for helping people (something many of us here (some of the older types ;-) ) do not any longer).

I would urge you not to take your material down at all, instead just ask some people for feedback and fix the errors I mentioned (I'm sure many others here would be happy to review changes / make suggestions), it'll be a better doc for it ;p.

Please understand, I don't want you to 'stop contributing' or feel your a laughing stock, if I've done that, I'm sorry, the scene needs more people like yourself with fresh blood / motivation, not self-appointed whining bastards like me ;-).

Anyhow, lets close this thread on that note and no hard feelings ;-).

Regards

CrackZ.
Woodmann
10-13-2001, 08:56 PM
Greetings to you all,

To Bengaly,

I see no need in removing your writings. I enjoyed the tut and found it informative.
I will be more than happy to proof read it again and make the corrections needed.
For those who do not write/speak english well it easy to make simple mistakes. Please don't confuse the criticism
for flaming, that is not the intent.

I would be proud to have CrackZ read my works. I have only the best regards for his opinion.

In this time where very few people write tut's, it is important to keep your works available. Please forget about simple mistakes and take pride in what you have written (I have not the confidence of you to write my own).

If you still desire to have your works removed, please email me personally. I won't like it, but I will respect your wishes.

Peace, Woodmann@woodmann.com
Kayaker
10-13-2001, 11:41 PM
Hey Bengaly,

Cheers on the tut. Take what is being said to heart, putting the effort into writing a reference tutorial for others is a noble cause. It's the best thing to come out of this board, wanting to help others learn, and providing needed information. You've got nothing to feel bad about, and you should definitely consider a rewrite (and retitle) and keep it posted on the site. It's not easy to write a good tut, it takes a lot of hard work and research. I feel the biggest thing you get out of it is what you've taught yourself while writing it.

My main positive suggestion might be to condense each section down a bit, treat each part as a smaller section and focus in on what it is that you're trying to get across. You've got enough information in there that I think would be better dealt with separately to give it the credit it deserves.

Enthuisiasm to contribute to the knowledge base is exactly what we want around here, don't give up the fight ;)

Cheers,
Kayaker
+SplAj
10-14-2001, 01:40 AM
Bengaly

There is a story of the young bull and the old bull looking down on a field full of cows....... of course the young bull wanted to rush down and bang em all......... however the old bull had some very wise words.............

Listen & Learn

+SplAj
EtErNaL_L0ser
10-14-2001, 03:40 AM
Keep up good work man...

To err is homan right? Don't be desperate....Just fix your essay and make it better :)
Bengaly
10-14-2001, 04:34 AM
heya all.

Well i will surely try to Fix this essay and Pre-Check it with others
Before i will release it again.
allot of ppl did replied nice posts here, even CrackZ.
Being a rush on someone at first can be a cruel thing to do.
but i have saw ppl did somehow think it's a good worth reading.
so i will fix the damm essay, and let you also enjoy more pages ;)
my only goal is to help, sure i can handle errors, i am human as well, and yeah rushing to releasing it was a bit of mistake as +SplAj mentioned.

p.s
Carpathia : it has nothing to do with HCU ;)
it just on tsehp's hcu pages so i called it that way :)

Cya all next time and thanx for support.

splaj...fixed :D
+SplAj
10-14-2001, 06:08 AM
...and that would be Carpathia to all of us , please don't mispell here in this place ...... unless it's bi-tarts ;)
Axion
10-15-2001, 03:52 AM
I think this tutorial writer has done a great job and should be recognised for his efforts.. Therefore I have posted the tutorial on my site, and many people are benefitting from it. Ofcourse there are going to be some errors in a tutorial so large as this, but that just proves this dude is human. I think he has done a great job!

Well done Bengaly!

-Axion
Co-Founder of Axion Network Tutorials
http://www.axion-network.net
Bengaly
10-15-2001, 06:01 AM
F0dder....hehe :D

Axion didn't steal my Tutorial for his own webPage.
Actually i made the tut for Axion, and than posted at tsehp's
Cuz it will be vital to all ppl who don't know axion's page
also to read it from tsehp's page.
so i made 2 version (hcu / axion)
Don't flame axion, he is a cool dude.
about the asm..i don't know

cya all :D
Axion
10-15-2001, 06:09 AM
Thanks bengaly...
f0dder,
Every single one of the tutorials I offer to visitors is made for my site. There is only one tutorial which wasnt, and I specifically got permission from the owner. I firmly believe against this and I would condemn anyone who does. I am with you on this matter.
As for the person asking for interested writers in a book. That was me, and I think its fairly unfair you bring that up. I have presented a great idea for a book, how could this be a bad thing? Considering each person involved reaps the benefits this is nor selfish or disrespectful for anyone in the channel. If you would like to let me know how it is I would happily review you thoughts. The entire time I have tried to remain as sensitive to peoples thoughts as I can. I apologise if my interest in a book like the one I presented offended you.. but I dont see how such a thing could.

Please reply with your thoughts, I would like to resolve this issue, Im aware one person not likeing me is a big problem.. and I'd like to fix that.

Regards
-Axion
nofurs
10-15-2001, 06:38 AM
Axion

oringinal from F0dder:

>And one of these guys was in #win32asm on day, asking us to >write
>stuff for them to put in a book and sell...

We do it for fun and laughter and not for money.... Knowlege is free like Bengaly's tute said.
Btw your offers offended ppl.Another thing don't cross posting too much on the board...

cluesurf
UrgeOverKill
10-15-2001, 10:49 AM
Originally posted by Bengaly
CrackZ

-"Real cracking began long ago, something about 10+ years."
-"All interrupts were deleted and were rewrite from
Scratch to what we know as "API" ...yeah they do exist, in dos.
But I am talking about windows, maybe they exist in windows as well, but in API form.
-Ha "Borden" ha should be spelled “Burden”, my fault
-"Every Register is divided to low/high bit:", yeah bytes, I don’t think when u write at 3am u can remember much,
-"IDA is a first class Disassembler, very recommended. [Dos interface]." , ahh I never used
IDA, didn’t know about win version either, only dos.
-“Ask the owl if he thinks this is the case”, ha give me email.
-"Double WORDS (DWORD) - 32 Bites" , bytes, ha another fault occurred in 3am.

Keep reading, u are a good help to me, I like people to fix me up, it makes them think,
Better, just don’t be a sissy-lala on me will ya ? ;-)
ah, why i write in 3am ? cuz it's fun and quite, writing 40 pages straight from the head feww seems allot of work when u write in the night ain't it?
also no asm book here so i am sorry for any bad info.
anyway, i can always double check, but as i said this tutorial didn't ment for "known" ppl, so mabye it was a bad mistake to publish it anyway, ah i'll tell tsehp to take it off, ppl are flaming me too much, even in irc u aren't much of a "Friend" as well.

ill have a quick to talk rizz on stuff i need, Toleration is off when u are being well not respected, even when u are trying to avoid such ppl who seems to track u down.

anyway, i hope u happy now "CrackZ"
have fun in ur life as i in my self.
blah blah blah here and alittle there,
i also would be supprised even if u read until this part. :/

bye bye
UrgeOverKill
10-15-2001, 10:54 AM
whooops!, sorry a little quick on the buttons......

Z your right, in order to properly xplain to newbies how to do it, we should start them out with the correct info first.

Nice tut Bengal, actually read it myself...... not bad.

UoK
Bengaly
10-15-2001, 11:23 AM
UrgeOverKill..heheh

don't worry it's all fine now.
i'll send new fix-up version ;)
keep reading..if want ;)

bye bye
EtErNaL_L0ser
10-15-2001, 11:38 AM
I am gonna write a generic Sales Agent Cracking The Registry Approach tutorial hope +tsehp will publish it
evaluator
10-22-2001, 05:50 PM
Hi Bengaly!
What a magic dll is this:

;EXP=c:\windows\system\shell232.dll

I not found in my win98se! and I removed
this line from winice.dat

Hi CoDe_InSiDe!

Guys made some mistake about what you sad
to me:)
CoDe_InSiDe
10-23-2001, 12:44 AM
Hi evaluator,

Hehehehe :D

Cya...

CoDe_InSiDe
Bengaly
10-23-2001, 07:14 AM
hi..

Seems Win98SE does not use:
EXP=c:\windows\system\shell232.dll

but it is on WIN98 :-)

Bye..
esther
10-23-2001, 07:45 AM
To Bengaly,

>Seems Win98SE does not use:
>EXP=c:\windows\system\shell232.dll

>but it is on WIN98 :-)

thats your typo eror man ;PPP
win98 doesn't has this file
shell232.dll ;PPP
it should be

EXP=c:\windows\system\shell32.dll
without the quotes

regards
esther
esther
10-23-2001, 08:32 AM
your right f0dder ;)

but he didn't check if theres a shell232.dll in win98 before he made conclusion saying that theres is just like me ;)
Apologies man ;)
Bengaly
10-24-2001, 04:49 AM
Well i never check that dll before, nether the less i care
but yeah its Numega problems, that i haven't tried look if its true cuz i though it is :-)
well..anyway someone should ghive numega a little letter saying that to them :-).
evaluator
10-25-2001, 12:48 AM
Hi Bengaly!
1. So before Numega removes "sell232.dll"
you can remove it from your TUTOR!

2. Here guys sad to you, that ICEDUMP is not
ANTI-ANTIwinice tool(as you wrote).
Of course sometimes it can't help us, BUT!
moreTime it helps! So you can wrote in your
TUTOR:
ICEDUMP IS ANTI-ANTI...IN 99%
Bengaly
10-25-2001, 01:51 AM
well...i nkow i must update my new tut and
I already have in some matters just not sent to Tsehp yet :-)
but keep correct me in some ways so i can finally give that tut
the Right shape it has to.
Thanx
Bengaly
Bengaly
10-25-2001, 01:58 AM
well...i nkow i must update my new tut and
I already have in some matters just not sent to Tsehp yet :-)
but keep correct me in some ways so i can finally give that tut
the Right shape it has to.
Thanx
Bengaly
evaluator
10-25-2001, 01:27 PM
Hi Bengaly!

As I found, trick "EBFE" crashes MyTRW2000. (Can be only my?)
I upgraded this trick to more "stable" variant:

90
EBFD

3 bytes, 2 instruction. This will work underwater:)
You can write it in your TUT as addition for EBFE.

Best regards!
Bengaly
10-28-2001, 02:18 AM
heya..

Great thanx, i'll add this "fix" to the tut for TRW2000 users.
but i know i works fine in SoftICE though..
keep add more stuff so we will make is rox.
ok cya bye.


Icedump for NT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Icedump for NT
PDA

View Full Version : Icedump for NT

Unregistered
10-10-2001, 06:21 AM
Hello,

Strange that there's no filedumping feature integrated
in Softice.

I also encounter problems during installation of the
Icedump drivers under NT.

Do you need to copy the: ntid.exe, icedump files to
your system32 directory? I am working under NT4.

Does anyone have a solution to install this tool?

Thanks,

Marc
haec_est
10-10-2001, 02:49 PM
...yes, u must copy ntid.exe and the icedump file that
match your sice version under system32\drivers
and run it. ;)

enjoy.

;)


Editing DOS encrypted files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Editing DOS encrypted files
PDA

View Full Version : Editing DOS encrypted files

Unregistered
10-10-2001, 06:28 AM
Hello,

Can anyone give me some tips to edit the hex codes from
DOS encrypted/packed files? There are some codes I want
to change (they are mapped under SoftIce). In a hex
editor, the opcodes are invisable.

Also can you tell me what exactly an overlay is?

Thanks a lot,

Marc

maf00@writeme.com


Revirgin vs VisualProtect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin vs VisualProtect
PDA

View Full Version : Revirgin vs VisualProtect

nikkov
10-10-2001, 07:13 AM
How use Revirgin for repair import Visual Protected
programm (h**p://www.visagesoft.com/)?

Nik
+SplAj
10-11-2001, 04:15 AM
Nik,

thanks for the links to this nice site. As usual they brag like crazy
about being the dogs bollocks protection system :p

They appear to have lots of nice toys to play with. One annoyance is that they forgot Win2K SP2 o/s !!!.......

I unpacked VisualProtect.exe & GenerateLicense.exe in 10 mins. Did not need RV as IAT /IT is intact. Just the original code is encrypted.

Next I made my own licence for the stupid system. Try the attached .vpl licence file after d/l VP.... I made a licence for RCE community ;)

how did I do this !!!! ..... find the encryption string. They used 'vp100' and from this you can fake the licence system. So if you have atarget just run it / dump it then look for .vpl with hex editor and a few bytes back you'll see the required string.......;)

+Spl/\j
:p :p :p
+SplAj
10-11-2001, 04:20 AM
:rolleyes:

just delete the .txt from the end and place in your visage directory.....
Solomon
10-11-2001, 10:17 AM
Hi SplAj

How to recover the imported DLL_name/function_name strings?

I just got VisualProtect & traced it. Time is stored in a file named C:\sysxxxxx.bin. Both IT & IAT can be dumped directly from memory(OEP = 593540, IT = 59F000, IT length = 1B8, IT is followed by IAT), but the imported DLL names and functions names are encrypted. Though the function names are decrypted at runtime, they are always decrypted to the same temp buffer. :(

thx for your help:)
Solomon
10-11-2001, 08:27 PM
hello ArthaXerXes,

I tried your loader with the latest VisualProtect itself and it didn't work. The loader told me "Everything went fine" but VisualProtect still show me a nag:(

I just want to practice my unpacking skills with this baby:D
nikkov
10-11-2001, 09:34 PM
Thanks!
I'm successful generate license file for VisaulProtect,
and other their products.
Nik
+SplAj
10-14-2001, 06:53 AM
Solomon

Did you trace the api for encrypyted Kernel32 & User32 yet ? (only these two api are fully encrypyted) I'm sure you traced to the second level of redirection, yes ? There you see the answer.........

What I did was to dump the api function addresses and then paste them into exe. i.e a API memory image exe.

However at the weekend I played a little and managed to trick RV with pasting the list into the resolved.txt and then RV made an IAT/IT.

I made it for Win98 SE ...... iat attached. Paste into raw 0x19F000.

Message to tsehp ..... can you have a look at this second level redirection in Visualprotect. If you want some notes then I can help. But you know the problem immediately you run RV... and more important the solution :)

+Spl/\j


Date Specified Time Trail
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Date Specified Time Trail
PDA

View Full Version : Date Specified Time Trail

Daveb
10-10-2001, 10:55 AM
Can any one either help me out or point me in the right direction of a good tut.
I am trying to crack a program that uses a time trial which expires at a specific date, using win32dasm. The program warns you that it will expire when 3, 2 and 1 day(s) are left.
I would be very greatful if someone could show me what to look for.

Thanks for your time

Daveb
Unregistered
10-10-2001, 08:28 PM
If it's not packed, it may be quite easy to patch it to remove the time limit. Just try "BPX GetLocalTime" in SoftICE or search the "expired" etc. in the string references of W32Dasm, you will find some clues.

If it's packed, you can try either a loader or unpacking_and_patching it.

Furthermore, if it can be registered, try to find the serial or make a valid keyfile to remove the time limit.

Originally posted by Daveb
Can any one either help me out or point me in the right direction of a good tut.
I am trying to crack a program that uses a time trial which expires at a specific date, using win32dasm. The program warns you that it will expire when 3, 2 and 1 day(s) are left.
I would be very greatful if someone could show me what to look for.

Thanks for your time

Daveb
nobody
10-11-2001, 09:02 AM
You want to use dead listing first, Windasm, and that is a valid approach.

Search the dissassembled listing for date reated APIs getsystemtime, getlocaltime. Also zero on API that do time conversions. You will find a comprehensive list in here: h**p://www.vbapi.com/ref/f/filetime.html. This may show you potential areas for further analysis.

It is doubtful that the D-day date is hardcoded in the program, but it may not be twist-encoded. Look up the typical date storing formats of windows. I have found a number of programs that encode dates as " The number of seconds since january 1 1980 at 00:00:00" I think visual C programs use that method. translate the date of program demise into such formats and look for a hardcoded Hex number similar to it in the code and data of the dissasembled program.

Try your luck looking for the warning messages. The date handling routine should in some way call the display of these messages, if they are explicitly available in the file.

Lastly, deadlisting approach may be inpractical or unecessarily difficult. Fire SoftIce.
Daveb
10-11-2001, 09:24 AM
Thanks for the reply, I have found out that the program is getting the date from my satelite, as the program uses my Satelite DVB card to get the correct date. The expiry date is also updated via the DVB card via satelite. The only advantage I have is I have a copy of the program before and after it was updated, do you know of any programs that will compare the code of to .exe files, the files are not protected in any way.

Thanks again

Daveb
Bengaly
10-11-2001, 10:26 AM
read my Guide :-)
Unregistered
10-12-2001, 06:16 AM
Originally posted by Daveb
Thanks for the reply, I have found out that the program is getting the date from my satelite, as the program uses my Satelite DVB card to get the correct date. The expiry date is also updated via the DVB card via satelite. The only advantage I have is I have a copy of the program before and after it was updated, do you know of any programs that will compare the code of to .exe files, the files are not protected in any way.

Thanks again

Daveb

This Shareware utility, h**p://www.hexworkshop.com can compare two hex files. It is not the only app, and perhaps not the best, but it may help you.

I doubt that the application stores the date inside the .exe file. An .exe file that modifies itself on disk is quite cumbersome to implement. I would bet the program writes the expiry date in one or several files and or the registry. If you could track down where the date is stored, you may try to find the code that reads the date and process it.
If the program obtains the date from an external source, i.e. the DVB card, I doubt the Windows API are going to be helpful. Try to locate the code that display the message: "2 days left" and backtrace from there. Somehow the code has to know the current date, and the expiration date and has to compare and substract one from the other before displaying such message. Hope this helps.
Daveb
10-12-2001, 10:58 AM
Thanks for the reply, I have back-tracked from the expiry message and it seems to keep refering back to kernel32.dll is this a likely place to store expiry info. The only thing is the expiry information is sent by satelite and I have a copy of kernel32.dll before and after the the expiry information was sent and I can't find any differences.

Thanks

Daveb
Fake51
10-12-2001, 12:57 PM
You wouldn't normally store information in kernel32.dll. One of the reasons being that the file is in constant use by the system, so you can't really write to it. Other than that, writing to kernel32.dll risks fucking up the whole system. In short, they're most likely not hiding any information in kernel32.dll

Fake
Daveb
10-12-2001, 06:40 PM
Thankyou everyone for your help, I have finally tracked down the information, it was stored in the registry, does anyone have any idea how to interpret the data in the registry.

Thanks

daveb
Fake51
10-12-2001, 07:30 PM
Damn hard to say anything, if you don't give us something to go on. The program could keep the value in the registry as a compare value, and the read it at program startup to check against the system time. This would be the easiest. As to interpret the data in the registry, well if it's not obvious, then track the check in the program down, and find the compare (or whatever).

Fake
boonlia
05-31-2004, 06:28 AM
Thanks for the reply, I have back-tracked from the expiry message and it seems to keep refering back to kernel32.dll is this a likely place to store expiry info. The only thing is the expiry information is sent by satelite and I have a copy of kernel32.dll before and after the the expiry information was sent and I can't find any differences.

Thanks

Daveb

The kernel32 reference is just to check the current date and not the expiry date. Check with softice as to where it compares the date.

Boonlia
boonlia
05-31-2004, 06:30 AM
Thankyou everyone for your help, I have finally tracked down the information, it was stored in the registry, does anyone have any idea how to interpret the data in the registry.

Thanks

daveb

Just mail me at prince@bppl.net.in and i will send you the complete litrature regarding registry


armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > armadillo
PDA

View Full Version : armadillo

SpeKKeL
10-10-2001, 01:06 PM
I was playing with the latest armadillo and succesfully unpacked the files which i armadillo-ed (like notepad).
But when i tried to unarmadillo the "armadillo.exe" .........It keeps
craching.
I think it has to do someting with the manner of dumping (with the other files i dumped the .tmp0 -files and made an valid iat.

Tracing to the oep (latest jump is :jmp eax in some kernel ?? routine and here i can't give an jmp eip because dumping prog's
won,t work anymore) give at the oep :41d0dc jmp 41d0dc ?????
Maybe the prog is in an other way protected.

Any ideas ???

Greetz SpeKKeL..........
Js
10-10-2001, 02:32 PM
Hiya SpeKKel,
Sorry can't help you out here but I sent you a pm re something else.
regards
Hz
Unregistered
10-10-2001, 04:53 PM
hi SpeKKel,
since version 2.1 i think, the code Section -splitted in 4kByte Parts- is a second time encrypted and will be decrypted only if code in a Part is used. Notebooks Codesection is under 4kByte and therefore its constantly decrypted.
Set a Breakpoint an 'WriteProcessMemory' and you will find it.

onoskelis
Unregistered
10-10-2001, 05:07 PM
<EDIT> a little correction, the Parts arent 4kByte they are 16kByte.
SpeKKeL
10-11-2001, 04:07 AM
h'mmm ,

I see that a lot of fuctions of the prog. are calling the writeprocessmemory..but how must i now go on ??
Tried several dumps after these calls but that leads to nothing.

:confused: Spek
Unregistered
10-12-2001, 06:36 PM
hiyaho,
my english is not so good,but i will try to explain.
choose VirtualProtectEx as breakpoint. On the first break you will find the CopyMemII runtimeEncryption Routine, there are two jmps to bypass it:
test ecx,ecx
jz ...

On the twelfth Break you will find the CopyMemII Decrypt Routine and a second decrypt Routine (simple xor) . This second you can't bypass or better you should'nt, because the whole codesection is encrypted from start (thats new in this version) , but CopyMem you must (also two jmps) .
One way to decrypt and dump the whole Code is to change the parameters 'Size' for the MemoryAllocation Function (DestinationBuffer for ReadProcessMem, find this first!) , and 'Size' / 'SourceMemory' for ReadProcessMemory. Look in the .tmp0 file for this Infos, Size must be the Size of the 'XXX...' Area and SourceMem the StartAddress of this Area (eg. 401000) . You must change the 'counter' for the decrypt Loop, so that all the code is decrypted. If its decrypted dump it and change the dumped code with the XXX's.
The OEP that you have found is right.

good luck :-)

onoskelis
DakienDX
10-13-2001, 02:15 AM
Hello SpeKKel !

I've debugged Armadillo some time, too. It debugs it's own process. So when there is a call to some encrypted code, Armadillo knows it, since it's the debugger, and decrypts it. Just writing a proc which reads all memory occupied by the protected application doesn't work. The code must be executed (correct me if I'm wrong, but I placed my memory-reading proc in a unused part of the code segment and it didn't work)
If you want to have a BPX: try DebugBreak or DebugActiveProcess

I haven't looked at the decryption loop in any way, but it could be Blowfish or an other block cipher (I don't know :()

I haven't much time to look at it at the moment since I'm just back from holidays and my computer cries for a "format c:" :D
SpeKKeL
10-13-2001, 03:52 AM
Whow lot's of info , thanks.
Going to work on it these day's I'll keep you informed...

Greetz


how to Find flexlm 6.1x Seed1&2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > how to Find flexlm 6.1x Seed1&2
PDA

View Full Version : how to Find flexlm 6.1x Seed1&2

wpj
10-11-2001, 02:57 AM
hi all ,
How to find real seed1 & 2 code?
i have trace to lc_init but not found define seed1&2.
hope any one help me.
Unregistered
10-14-2001, 12:14 PM
finding seeds1&2 is usually easy for flexlm 6.1x as you can read in tutorials at crackz and/or tsehp site

anyway, if you have problems with a particular target, post a link or upload it somewhere or name it at least :-)
meaculpa
10-19-2001, 05:42 AM
Hi wpj,
I have the same problem.
Have you managed with your target, perhaps we can work
a little together and try and better understand this.
Drop me an email.

Regards,
MeaCulpa


Missing address
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Missing address
PDA

View Full Version : Missing address

catalis
10-11-2001, 03:52 AM
Hi, there
This is my first tread here. I just want to know why is it that
some address in Soft-Ice doesn't exists in the dissambled file.
I mean how am I suppose to patch the file if I can't find the
offset.
:)
nobody
10-11-2001, 09:21 AM
The address you read in softIce does not correspond to the address you find in the hex editor or dissassembled list. The address you see in Sice is the sum of a base image (typically hex 04000000 or hex 04100000) plus an offset that correspond to the position in the disassembled or hexedited file. The base image in which the program is loaded may change from program to program. The simplest solution is NOT to use the address of the relevant code as a tool to locate the instruction in your hex editor or dissasembler. Instead, write down some 16 to 20 bytes of code close by the instruction you plan to locate and use it in a search with your hex editor or dissasembler. in one or two tries, you will get to the code area you want to find.


how to see the DD library name under linux
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how to see the DD library name under linux
PDA

View Full Version : how to see the DD library name under linux

tapo2001
10-11-2001, 09:16 AM
Hi,
I'm using ltrace. I do not understand how to see the name of the library (.so) to which the call is made. Do you know how to do that?
Actually I used "nm" in the library files listed in LD_LIBRARY_PATH but no one has the name retuned by ltrace:

#ltrace <exeName>
..
..
libFunc(...)
..
..
# nm -s <LD_PATH_1>
..
..
# nm -s <LD_PATH_2>
..
..
no one has libFunc inside!!!

Can you help me?
Tapo


VxD Keygen Rip
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > VxD Keygen Rip
PDA

View Full Version : VxD Keygen Rip

Kayaker
10-11-2001, 01:31 PM
Hiyas,

OK, Less talk, more action. There's always something new to learn, so here's a nice crackme by the_dux that deals with tracing in vxd code.

There's a basic serial routine within the vxd that you need to extract and build a keygen for. This part is fairly straightforward. The interesting part is in understanding how a vxd is accessed by a program, which Win32 and VMM API calls are used to call and load the vxd, and how the basic messaging system within a vxd is constructed.

You don't need to know how to program a vxd (though it would help immensely ;), but a basic knowledge is helpful. I'd recommend at least 2 items to help:

Iczelion's VxD Tutorials:

http://win32asm.rxsp.com/tutorials.html

The Virtual Machine Manager Services (VMM) Help file. You may be able to find vmm.hlp elsewhere, but I had finally dug it up at a page that no longer works, so I'll upload it here (400k) as well for reference.

A reliable way to break into a dynamically loaded vxd I use is with
BPX VXDLDR_LoadDevice
and trace from there. Or you can find a Win32 API to break on as it's called.

Have fun,

Kayaker
Kayaker
10-11-2001, 01:36 PM
And here's the elusive VMM help file...
Clandestiny
10-11-2001, 03:26 PM
Hiya,

Hehe. If I didn't know better, I'd say you read my mind Kayaker. ;) Actually, I'd given your query for project ideas some thought in the last couple of days and was going to suggest a .vxd related project myself... was even kicking around the possiblity of coding a small crackme with all of my newfound vxd programming skills. :D Looks like you beat me to it. LOL, great minds think alike, eh ;)

Cheers,
Clandestiny
Kayaker
10-11-2001, 05:25 PM
Originally posted by Clandestiny
Hiya,

.. was even kicking around the possiblity of coding a small crackme with all of my newfound vxd programming skills. :D Looks like you beat me to it. LOL, great minds think alike, eh ;)

Cheers,
Clandestiny

Hi yourself,

Well don't let that stop you, I'd like to see your vxd crackme as well. Make it a mean and nasty one too :D

K.
Fake51
10-11-2001, 07:41 PM
Like the idea of a vxd project, but find it a bit sad that you chose a serial based crackme as target. One can actually crack this target without understanding how a vxd works at all. Took me five minutes to go thru it.
It ofcourse makes it easier, if one can use the live approach, see the key routine in action, but it is still so simple that it is not much of a problem to rip it. Besides, seems that the interesting thing about vxd's is not that it is possible to have the serial scheme inside them, but what it is possible to do with a vxd.
Anyhay, just thought I'd chip in.

Fake


DriverStudio 2.5 RC1 Loader Problems!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DriverStudio 2.5 RC1 Loader Problems!
PDA

View Full Version : DriverStudio 2.5 RC1 Loader Problems!

DGR
10-12-2001, 10:32 AM
ok, I installed Driverstudio 2.5 rc1... but somehow I can't seem to load applications with the loader anymore.

I run the loader, open an application (.exe) and then when I press the "load symbols" it gives me an error that it can't find the debug information. Couldn't u load an app through symbol loader so that u rbeak in immediately at the program entry point?

I dunno what the deal is, or what I could be doing wrong but has anyone else the same problem and more important... a solution?

TIA,

DGR
zeroone
10-13-2001, 05:10 AM
first you open the exe file that you want to track.
then open file menu

Module->Settings->Debugging

the default option is "Load Symbol information"

you must change it,select "Load Executable" and "Stop at WinMain,Main,dllMain" option

click ok button,then press load, a messagebox display,click ok,u rbeak in immediately at the program entry point.
DGR
10-13-2001, 07:32 AM
Ah, many thanks... gonna have to try that. But now my copy of Driverstudio (2.5 RC1) is expired newayz (since yesterday) : /

Hope final gets released soon... (with XP support *pray* *pray*)
roocoon
10-14-2001, 11:11 AM
In my Win2K SP2 system the loader doesn't seem to behave properly all the time. It could load the program and popup the Softice window, or it could just complain about the symbols and not popup the sice window. Random. Trying a few times and opening various tabs of the loader in random, seems to wake it up.
What's good with 2.5RC1 is that it seems to work properly with NVidia-based cards at last.
What's not so good is that it stopped working with my old Matrox Millennium II. No sice window popup.
Go figure...


Little problem with a Sentinel dongle...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Little problem with a Sentinel dongle...
PDA

View Full Version : Little problem with a Sentinel dongle...

Dantes
10-13-2001, 07:36 AM
Hello gentlemen,

I am currently trying to get rid of a Sentinel dongle protection in a family of software available here:
http://www.autoship.com/downloads.htm

All the softs are controlled by the same installation disk, which decides if you're running them as demo, or as full products. If you install the softs without authorisation, they will automatically run as demos (of course... :).

Those softs are VB6 Pcodes, with no code to do the dongle checking in them. Actually, everything is in a DLL included in the authorisation disk, called Aship300.dll.
This DLL imports functions from NSLMS324.DLL (the Sentinel code), and exports functions such as "AuthorizedToRun", "AuthorizedToContinue" and so on...

OK, so it seems that this is the place where everything happens. I'm no dongle expert, and I've spend quite some time trying to get a grasp on the protection scheme. And still no result.

If someone could have a look on this DLL code, and give me some hints about how the scheme works, that would be really nice.

Thanks a lot
/Dantes

PS: I attached the DLL, which is around 100K unzipped. So if you don't want to download the full thing, and just have a static look...
haec_est
10-15-2001, 01:26 AM
if "AuthorizedToRun" is something like :

cmp ...
jne ...
mov eax,1
...
xor eax,eax
ret

try to reverse the dll for anwser always positive, else
you can emulate the dongle response in the NSLMS324.DLL

for this task download the manual from sentinel site,
and see what the proggy want from those function.

haec_est
MeteO
10-20-2001, 08:53 PM
It was here:

Contact with me: meteo@null.net
ZaferBSCA
10-24-2001, 06:17 PM
i wonder if there are any dongles left which are not emulated by meteo.. ;)

meteo, will you be ever making a web page giving away these sources of your dongle emulators?

keep the cool work..
MeteO
10-25-2001, 11:19 AM
I could make it, but who give me normal hosting(without BSA intervence, without banners) ;). I could put all of my public code emulators of Sentinel, HASP, Hardlock, Novex, Wizzykey, Microguard and other...
UrgeOverKill
10-25-2001, 11:44 AM
Originally posted by MeteO
I could make it, but who give me normal hosting(without BSA intervence, without banners) ;). I could put all of my public code emulators of Sentinel, HASP, Hardlock, Novex, Wizzykey, Microguard and other...

wtg, MeteO ! !
jomamameister
10-25-2001, 12:10 PM
please email me at:
jomamameister@yahoo.com
i have fixed the problem for you on autoship and would be glad to show you exactly how i did that. presumably the fix would be similar on all their products. it is only a two bye fix and you are registered. i would need for you to verify the mechanics of your prog though, since i'm not familiar with its capablilities.
jomamameister
goatass
10-25-2001, 03:42 PM
Hey MeteO e-mail me and I'll get you on my box, it's on a cable modem but I should have no problems hosting you and I have plenty of HD space.

goatass
goatass@newavedesign.com


Detect IceDump?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Detect IceDump?
PDA

View Full Version : Detect IceDump?

stealthFIGHTER
10-13-2001, 10:18 AM
Hi all,

is it possible to detect IceDump? (I mean something like this: CreateFileA('\\.\SICE'). Any VxD?

Thank you
EtErNaL_L0ser
10-13-2001, 01:56 PM
As far as i know Icedump is free of VxD so its impossible to detect....At least I think so ;)
Unregistered
10-13-2001, 04:08 PM
hehe
L4t1g0
10-13-2001, 09:57 PM
Icedump is not vxd free :)
Check the docs and the source.

y0 y0 /\/\od3st One !!
ThrawN
10-13-2001, 10:32 PM
Icedump IS a vxd pretty much
self loading.
If you look at it you could code a icedump detector simular method to getting the hotkey opcode in the sice vxd. I dont really see the point tho, a cracker is going to see whats going on and fix this easyily

ThrawN
EtErNaL_L0ser
10-14-2001, 03:43 AM
Gotta update my knowledge :)
stealthFIGHTER
10-14-2001, 02:18 PM
Another (better ;)) question ... is it possible to detect Soft-Ice, while IceDump is loaded?

Regards

sF
^DAEMON^
10-15-2001, 08:12 AM
f0dder, better go and check out my protector :)))
it has got CLEAN icedump detection...

:eek: ^DAEMON^
EtErNaL_L0ser
10-16-2001, 05:26 AM
The question is where to get it ^Daemon^ ?

:)
^DAEMON^
10-16-2001, 07:54 AM
http://www.woodmann.net/forum/attachment.php?s=&postid=8939

download it there :)

^DAEMON^
EtErNaL_L0ser
10-16-2001, 10:39 AM
Good work bud btw you r from EVC as R!sc ?
^DAEMON^
10-17-2001, 12:31 AM
na, not from EVC....

DAEMON -> [UG2000/MYTH] ;)
EtErNaL_L0ser
10-17-2001, 05:16 AM
heheh ok thnx for the info


binary uploads in virtual process space using ice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > binary uploads in virtual process space using ice
PDA

View Full Version : binary uploads in virtual process space using ice

Aimless
10-13-2001, 11:15 AM
Hullo,

I am using Softice 4.05 on NT 2K.

I am currently cracking application 'X'

This application loads a host of dlls, and other files (delay-loads, getprocessinfo, loadlib...etc). No problem.

It also loads pure binary dumps into virtual address space of app 'X'

These binary dumps form part of the code, needed to do things.

It loads more than 30 binary dumps (easily checked by filemon, createfilea, readfilea...etc)

And it loads these dumps at the start of the program.

Now, I need to know where each bin dump has been loaded into memory.

Map32/proc does not help.

query 'X' does help

But, the query command shows the memory allocated to .dlls and associated .exe and even certain objects.

I can definitely see my binary dumps. 30 of them at different address ranges in the same process address space.

But, I CANNOT see their file names associated.

This causes a big headache to understand which dump is being used by which dump file.

Is there any way to know this is ICE, or by any other means .??

Any assistance greatly appreciated.

Regards


keygen help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > keygen help
PDA

View Full Version : keygen help

eko
10-13-2001, 02:33 PM
hii
i'm tring to build a keygen for (well its not a program .) its decrypt a pdf that has been encrypted with open file plugin. ( see attachment)

well. i idid some debuging

got to the routine
cuz my auto string longer than 9 chars .

00404D33
the rouinte our data ( product id,inputstring,auto string)

with some strings inside the file ...

i think the main thing are calls for 004053A0

actully i think i got what the call do

---------------------------------------------------
004053A0 proto firststring:DWORD, 2ndstring:DWORD
they must be bigger than 0

for i = 1 to len(firststring)

b = asc(firststring[i])-asc(2ndstring[i])
if b < 041h then b =b+ 01Ah ; 041h = 65 = 'A' , 01A = 26
mov [i+00413AF0],b ; did have better way to write it
next i

inc i
mov [i+00413AF0], 00 ; the NULL in the end

return 1
if thiere len = 0 then return 0 and dont do the loop ofcourse
-------------------------------------------------------------

now here i stuck.....

after i do all the calc things .... there is nothing to do . al the jump are going or to a msgbox " worng auto string " or they end the program .......

i realy need help in here

bye

eko

p.s
sorry , my english is not very good ;[


Any CD-COPS 32 Sample ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Any CD-COPS 32 Sample ?
PDA

View Full Version : Any CD-COPS 32 Sample ?

un4giv3n
10-14-2001, 06:33 AM
LongLive Crackers ,
Here I am looking for some samples on CD-COPS 32 CD Protection . If there you have any , Cracked or Not Cracked on ... Feel free to send me a hint .

Thanks
DakienDX
10-14-2001, 08:01 AM
Hello un4giv3n !

It's been some time, but you could try this (http://www.woodmann.net/forum/showthread.php?threadid=1503) one.
Sorry, but I've deleted my research-results and I haven't the target any more. :(
aurora
10-18-2001, 11:57 AM
hey dakien,when will the review of the latest safedisc be finished?
over the next week ???
:D

blackcheck
DakienDX
10-20-2001, 04:47 AM
Hello aurora !

What do you mean ?


Help Me Plz!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help Me Plz!
PDA

View Full Version : Help Me Plz!

Unregistered
10-14-2001, 07:07 AM
SAFEDISC V2, i dont know how to...
Woodmann
10-14-2001, 11:40 AM
?


Suggestions for, relativly new, good learning targets?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Suggestions for, relativly new, good learning targets?
PDA

View Full Version : Suggestions for, relativly new, good learning targets?

SuperCali
10-14-2001, 04:43 PM
Hello,
I was wondering if anyone here could recommend some new targets that are good for a newbie to practice on (not complete beginner but very close ;) ). I have gone through quite a few tutes, but most of the ones I tried are for older targets that are not readily available. I would appreciate something fresh and fun ;). Well have a nice and relaxing Sunday everyone.

b.t.w. Solomon (if you read this thread :) ) did you ever get anywhere with Muzicman target? I looked at it for ages but got stuck so decided to leave it for a while, but if you have any "new" tips I'd appreciate it. Thanks.

// SuperCali
Solomon
10-14-2001, 08:31 PM
I have deleted MuzicMan for days:D


Any one knows about "Avtype_info"?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Any one knows about "Avtype_info"?
PDA

View Full Version : Any one knows about "Avtype_info"?

Unregistered
10-15-2001, 02:20 AM
I'm tring to "customize" a dll. I have found how to "costomize" it but it seems that the program that calls this dll is performing a sort of checksum on the dll itself, using info stored right after the string "AVtype_info".
I would like to be able to create the correct data after my "customizations".

Thank you for any help.

swissknife
swissknife
10-15-2001, 02:28 AM
I'd like to add that i found many .exe and .dll on my system that contain this string, so i think it's something related to PE file structure. Also searched CBuilder an VisualC include files for that string, finding nothing.

swissknife


Who can remove the VB5's Nag? HELP!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Who can remove the VB5's Nag? HELP!!
PDA

View Full Version : Who can remove the VB5's Nag? HELP!!

Unregistered
10-15-2001, 04:00 AM
Who can remove the VB5's Nag? HELP!!
http://go6.163.com/ddxia/crackme/ACiD_BuRN2.zip
Protection : NaG / nAME-sERIAL / anti Smart check
I can solve the name-serial and anti smart check and Nag's time limit.
but the NAG i can't remove:-(
help me!!
Unregistered
10-18-2001, 03:54 AM
£¿£¿hard£¿£¿


Hope this helps newbies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hope this helps newbies
PDA

View Full Version : Hope this helps newbies

Axion
10-15-2001, 04:01 AM
Hi, I've been working on a website dedicated to teaching people a variety of computer concepts. The site is intended for not only beginners but also advanced users. Please use this site as a resource, it should be a one stop website for all your learning needs. I have devoted endless time into the creation of this site, I hope it is of assistance to newbies and experts alike.

Without further ado, heres the link.. please let me know what you think:

http://www.axion-network.net
Solomon
10-19-2001, 04:11 AM
We all hate VOTE!!!:mad: :mad:
Bengaly
10-19-2001, 05:46 AM
hahaha

lol, no one said u should vote :-)) :D :D :) :D
Solomon
10-19-2001, 06:00 AM
;) ;) ;)

Originally posted by Bengaly
hahaha

lol, no one said u should vote :-)) :D :D :) :D
Bengaly
10-19-2001, 06:43 AM
solomon ? :-)
Johhny
10-23-2001, 08:06 AM
I went to the site and found no voting stuff? I think its a great site.
thanks for the link!!
Bighting-Boon-baby
10-27-2001, 10:12 PM
k thanks


With what is this packed?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > With what is this packed?
PDA

View Full Version : With what is this packed?

Unregistered
10-15-2001, 06:57 AM
h**p://www.cabbala.net/lahna/lahna111.exe

Wdasm8.9 gets nothing out of this...
I have tried with softice, but because of a lack of skills, failed. :(
Anyone know with what is this packed?
Dede cannot do anything with it. :(
I have run some FIle analysers on it, but the all say unknown.
Please help me.
nofurs
10-15-2001, 08:03 AM
Heya,
The program is not packed.
I suggest you read tutes on using DeDe
http://www.balbaro.com/dafixer/papers.html
cya
Unregistered
10-17-2001, 05:41 AM
Well I've read most of those, and looked trough the rest of them quickly a minute ago (Well, fast enough to see if they're of any use to me:))

They don't help me. Well, I'm not sure If that link gives you the same version I have, but mine is packed. (Well, according to my knowledge, at least.)

What else can it be, if there's nothing to be seen with Wdasm? The Author changed some bytes? what? Tell me some reasons that could be behind this.

I must check that latest version, although I think it's the same as mine.

Thanks is advance.
Unregistered
10-17-2001, 10:56 AM
hi u must have 2 winDASM versions 1 for VB and 1 for Borland delphi . windasm patched for VB has some probs to display delphi stuff

best regards

dyci
hobgoblin
10-17-2001, 01:45 PM
Hi there,
The prevoius poster is right. If you disassemble a delphi with the "wrong" version of W32dasm, you will run into problems.
About the program:
It is not packed, but all the text strings you will see is in Finnish. But if your only looking for an easy way to crack it, try enter a phony name\serial and do a bpx hmemcpy in softice...
LaptoniC
10-18-2001, 08:55 AM
Source code is in delphi.

k:=-1;
a:=1;
for i:=0 to length(name) do
begin

j:=ord(name[i]);
j:=j shl a;
a:=a+1;
k:=k+j;
end;
key:=variant(k);

Hope it helps :p
Unregistered
10-30-2001, 05:32 AM
Thanks for your answers, but:

LaptoniC:
Well, I tried to make a Turbo Pascal program from that source you gave me, (with some adjustments of course) and it does produce a number, but it's not the reg-num. At least the prog won't accept it. Should I use Delphi, isn't it just (/nearly) the same, just in DOS?
Does it have an effect if I declare key as an integer and not with this : key:=variant(k);? I couldn't make it work (in tb) like that. So I just used (in var section) k : integer and then later on key := k . So what is the prob? Or wtf is that source of yours? :D

hobgoblin:

Well, how can I be sure? The only vb - "patch" I have is the program VBRefs, which processes the alf - files. But this isn't the thing you mean, is it? Where could I get this "delphi" - version? I assume that mine is vb-ver. because I see NO string references at all. It would be nice to have those damn Refs.
So I'm after the Delphi-WDasm-version now. :)

(And just in case mine is not patched for vb (I haven't pacthed it myself, do they make 2 diff. versions, or is this a reverse-engineering-thing of somekind?), where could I get the _real_ vb-patch?) (Not VBRef, if that's not what ppl mean with that patch.)

Thank you all again :)


What can I use on win2k instead of bpx hmemcpy?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What can I use on win2k instead of bpx hmemcpy?
PDA

View Full Version : What can I use on win2k instead of bpx hmemcpy?

Unregistered
10-15-2001, 07:20 AM
What can I use on win2k instead of bpx hmemcpy?

windows2000 doesnt have this bpx what would you use
here instead

Cheers
Solomon
10-15-2001, 09:09 AM
GetWindowTextA
SoftModalMessageBox
...............

Learn Win32 API programming, then you will know what API you should use to set a breakpoint:D

grab a book named "programming windows" from exetools.com and read it.
good luck.


unpacked file won't run on win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacked file won't run on win2k
PDA

View Full Version : unpacked file won't run on win2k

Unregistered
10-15-2001, 10:58 AM
Hi,
After reading thru amois' essay on crypkey,
I did another exercise with swish, but the prob is that the unpacked file runs pretty well under win9x, but not under winnt/win2000
where do i get it wrong ?
LaptoniC
10-15-2001, 01:19 PM
I think your import(s) are wrong.Maybe you can try to rebuild import on win2k.Because if some entries are wrong or not resolved in win9x in win2k they are resolved without errors.
Solomon
10-15-2001, 08:18 PM
I tried CrypKey with ImportREC, it worked well under Win2K:D

I will try RV too;)


Problem with Winhex
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problem with Winhex
PDA

View Full Version : Problem with Winhex

Fake51
10-15-2001, 03:40 PM
I'm going thru the motions with Winhex, version 9.92.
The problem I've encountered has to do with the serial scheme. It's easy to figure out where it get's the entered codes, also easy to see where it stores them. The problem is I can't figure out where the heck it does anything to them, compare, modify whatever. It doesn't seem to access them at all.
If anybody has had a crack at it, or anybody has a good idea, please help me with this one.

Fake
Solomon
10-15-2001, 08:30 PM
The serial entered from a registration dialog is just a FAKE one.:D It's a misleading in order to distract your attention.

The real serial is stored in a keyfile named "USER.txt". The content of this file is like the following:

User: "who"
Addr1: "who cares"
Addr2: "who knows"
Code1: 24859A91A107AB8001A0E00302000000
Code2: 303D0EE70AD0641BD89E57A64DD164C5

If you get a real keyfile, you will see "Genuinely licensed ..." in the About dialog.

WinHex uses the keyfile to dynamicly decrypt some code in its exe. So without a valid keyfile it can't be keygened. egis/CORE made a keygen after some group had released a valid key.:)
Fake51
10-16-2001, 08:02 AM
Cheers mate.

Yeah, figured out about the keyfile a couple hours after my post, but didn't get around to edit it (was way too sleepy at that time). Anyway, gonna play around with it a bit, see if I can make things happen.

Fake

PS: Just debugged the thing some more: Seems Mr. Fleischmann is well aware that Egis/Core made a keygen, they've been blacklisted in the program, hehe
Unregistered
10-16-2001, 09:47 AM
Solomon. Your Avatar Teddy bear is annoying.
Solomon
10-16-2001, 09:23 PM
hehe, I can't find a appropriate image
I will change it:D

Originally posted by Unregistered
Solomon. Your Avatar Teddy bear is annoying.


Steganography
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Steganography
PDA

View Full Version : Steganography

raven58
10-15-2001, 03:55 PM
This little freeware program deals with the concept noted in the subject and is relevant in light of how some communication occurs over the internet today. It opens with a "nag or splash screen" with a disclaimer message. If you agree, you are taken into the program and an interesting one it is. If you disagree, you exit the program. Of course, it would be interesting to bypass the nag and go straight to the program and thats the aim of this little mini-project. Now I will say that this newbie played with it for a while and could not solve it. So we look to others for assistance and a detailed explanation as to how they accomplish the objective. Hopefully, those of us they couldn't solve it will add to our knowledge. Of course there is the possibility that no one solves it.

Raven58
Js
10-15-2001, 06:36 PM
bpx destroywindow, f12 back till you see where the nag is called from, replace the CALL MFC42!ORD_09D2 with mov eax,1. I'm
not proud, quick and dirty but it works.
BlackB
10-17-2001, 03:44 AM
Some more detailed explanation ;-)

Set a breakpoint on ShowWindow. When the nag is drawn, click
on the accept button. You should be back in softice then. Execute
the ret's until you're back in to the main program. (this is basic
stuff, you should know)

001B:0040F9AD MOV DWORD PTR [ESP+00000084],00000000
001B:0040F9B8 CALL 00410A22
001B:0040F9BD CMP EAX,01 <-
001B:0040F9C0 PUSH 00
001B:0040F9C2 JNZ 0040F9D4
001B:0040F9C4 MOV ECX,[ESI+20]
001B:0040F9C7 PUSH 00008009
001B:0040F9CC PUSH 00000111

You land where the arrow is.
001B:0040F9B8 CALL 00410A22 draws the nagscreen and checks
what button you pushed.
If the 'Accept' button was pushed EAX=00000001 if the 'Don't accept'
button was pushed EAX=00000002.

Solutions? (didn't try them tho, it's up to you)
1. edit the call with a hexeditor so eax always gets the 01 value
without showing the nag (it's a matter of tracing the call with
softice and understand how things work)
2. replace the call instruction with 'mov eax, 01'

Well, hope this was a bit more interesting then the above reply :p
Good luck.

greets,

The Blackbird
Js
10-17-2001, 05:26 AM
you want to offer a more detailed explanation, fine, you don't like the above explanataion, fine too.
"Well, hope this was a bit more interesting then the above reply"
leave it out
raven58
10-20-2001, 12:38 PM
Js and blackb, I guess that was an easy exercise. I see that by changing the call at 40f9b8 to mov eax, 01 the nag is eliminated and everything works fine. And so it does.Sounds like both of you know this inside out. Of course for this newbie and perhaps others it was "wow", how did they arrive at destroywindow and showwindow, what lead them to this call,how did they get into the code etc. Seems like you took different paths to the same objective. It would be appreciated , at least by me, if you could expand this somewhat. Perhaps a tut might be called for so us newbies can increase our knowledge. Your time and effort is much appreciated.

raven58
jomamameister
10-23-2001, 11:02 AM
what i did was to do a lookup in restorator for a dialog and fonud it to be 134 in dec, then convert that to hex = 86. after disassembly in w32dasm look for the dialog 86 in the dialog section and it is easily found. Do a double-click on that and you land at the exact call to the dialog box. search a little higher and you see that it is in turn called by 0040F9A4. Go to that spot and you see some code:

:0040F99E 6A00 push 00000000
:0040F9A0 8D4C2408 lea ecx, dword ptr [esp+08]
:0040F9A4 E8A729FFFF call 00402350
:0040F9A9 8D4C2404 lea ecx, dword ptr [esp+04]
:0040F9AD C784248400000000000000 mov dword ptr [esp+00000084], 00000000

* Reference To: MFC42.Ordinal:09D2, Ord:09D2h
|
:0040F9B8 E865100000 Call 00410A22 <--xor eax, eax, inc eax, nop, nop 31C0409090
:0040F9BD 83F801 cmp eax, 00000001
:0040F9C0 6A00 push 00000000
:0040F9C2 7510 jne 0040F9D4
:0040F9C4 8B4E20 mov ecx, dword ptr [esi+20]

so as you see above, just replace the call at 0040F9B8 with the code you see there and the call to the nag box is never initiated and the correct value is forced in eax. 1 = yes, 2 = no now the cmp is always true and the prog loads correctly. hope this helps.
jomamameister
raven58
10-23-2001, 07:44 PM
Jomamameister, thank you for your insight. I have never heard of or used "restorator". Perhaps you would be willing to explain for us newbies how it is used on the program in question, whats its intended purpose is, etc. I would also be curious to learn why you took the tact that you did. As noted in posts above, there are many ways "to the top of the mountain". Yours marks a third approch in addition to "destroywindow" and "showwindow' Perhaps I am beating "a dead horse" here, but I believe we can learn a lot more , especially use of the tool"restorator"

Thanks, raven58
Kayaker
10-24-2001, 01:37 AM
Hi Raven58,

Restorator is a resource editor (beware cracking this one - CRC check(s) then it deletes its files in its home directory) somewhat similar to Exescope. I actually prefer the freeware Resource Hacker

h**p://rpi.net.au/~ajohnson/resourcehacker , or the Toolz sites.

Sometimes you can successfully delete a resource after patching the code which calls it, and occasionly just deleting the resource is enough if the app is really lame. And of course a resource editor is always handy to see any "hidden" string or dialog resources.

While it's a little difficult tracing back in this app because of the MFC code, you can sometimes use FindResourceA to locate where a particular resource is being loaded and short circuit the call to it, i.e.

BPX FindResourceA if esp.8 == 86

will break when the 2nd parameter of the FindResourceA call (the pointer to the resource Id) is equal to 86h. If it finds the resource there is usually a call to LoadResource/LockResource immediately afterwards. You may find a patch point tracing back from there.

Kayaker
jomamameister
10-24-2001, 09:29 PM
restorator is more than simply a resource editor. it can also do extractions and insertion of said resources, and can make patches. i use restorator routinely on lots of progs just to see what's inside. frequently you can see the dialogs, bitmaps, or strings that may provide a clue. as i said earlier i looked for a hex number in the prog that corresonded to the dialog that i was looking for and then backed traced it through w32dasm. there is a new version of restorator out, 2.51, h**p://www.bome.com/restorator and has a 30 day time limit. this is a very limited expose' of restorator, but it is an excellent tool. i mention it in all of my tutorials.
jomamameister
Kayaker
10-25-2001, 01:20 AM
Hi Jomamameister,

You've made better use of Restorator than I ;-) I agree it is a nice resource editor and is great for extracting resources. Plus it can make a resource patcher if you want to distribute a crack I guess.

It does all that Resource Hacker does, but I like ResHack because it allows you to modify and recompile Delphi resources on the fly without having to dump it to disk first. I've noticed Restorator craps out on (not-so) large Delphi forms ("text exceeds memo capacity"). Maybe the newer version works better.

I'm not sure if Restorator handles changes in file size very well either, and I can't seem to simply delete a resource entirely. All depends on what you want to use it for, Exescope still works OK too for regular stuff.

regards,
Kayaker
Mandelbrot
01-15-2003, 04:38 PM
I tried to use this hide and seek program to one image I have,but it just exits the program when I do it..no such problem with any other image!! What might be the problem? I really wish to know if my pic. is steganoed or not..any help is welcome..It is a jpg pic. I downloaded from a website, and seems to be the key to enter there..there is just this image on the site,and I know from other sources,that there's a lot more on that site..TIA
And I'm a complete newbie to this genre..
Kayaker
01-16-2003, 12:18 AM
It seems all this program does is hide a data file in a jpeg, the maximum size of the data file that can be 'safely' hidden dependant on the jpeg compression already present. It knows nothing about the jpg otherwise, other than it's dealing with a valid jpg.

When you say it exits with your jpeg does it crash or exit quietly? The jpeg itself looks OK otherwise? Can you give a link or up the jpg, it's really hard to guess anything otherwise.

Kayaker
peterg70
01-16-2003, 01:06 AM
It is a jpg pic. I downloaded from a website, and seems to be the key to enter there..there is just this image on the site,and I know from other sources,that there's a lot more on that site..TIA

Now this sounds interesting any chance of a link (send via PM or email). It will be interesting if the information to access the site is encrypted into the jpg via steno.

peterg70
Kayaker
01-16-2003, 12:52 PM
Hi

Um, thanks for the link. I suspect there's not much going on here, the reason this jpeg app couldn't handle the file is simply because it's a gif file not a jpg/jpeg. If you were to look at it in a text or hex editor you'd see the file begins with GIF89a. It exits because it's supposed to.

As for the source on the web page there's no href html tags indicating a link associated with the picture, just a standard align / img src / alt tag set. I rather doubt there's much going on behind a mislabelled 15kb picture file, unless this is getting really cloak and dagger and there's a secret password buried in there somewhere. Looks more like a site under construction/deconstruction. (Aha, that's just what they *want* you to think...)

Actually, if we make use of Woodmann's latest Searching Games lesson, if you were to use tracert.exe on that website link you would find it actually resolves to a different DNS name. If you enter this DNS name in your browser instead of the original link you find a directory listing - recently modified and empty! So it's possible the site you're looking for just doesn't exist anymore.

Kayaker
dion
03-20-2003, 06:50 AM
OOT: just wondering if you guys had looked at +Ma games, its fun, sadly i dont have many time online :(


can anyone help me with cryp95e.dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > can anyone help me with cryp95e.dll
PDA

View Full Version : can anyone help me with cryp95e.dll

sadsack
10-15-2001, 08:49 PM
hi guyz, can anyone pleeze help me with crypkey files, whats the easiest way 2 find out the password or better still, hex code addresses 2 change 2 bypass the protection .....
Solomon
10-15-2001, 09:46 PM
Does it use Crypkey Instant or SDK?
What's the URL?:D

read the tut by amois:

h**p://www.woodmann.net/fravia/amois_sf_editor_2002_english.htm
sadsack
10-16-2001, 01:22 PM
theres no url m8, its a file i have, is there any way i can send it 2 u.. ??
Solomon
10-16-2001, 09:21 PM
solomon2000@gmx.net:D
Scally6
10-17-2001, 12:41 PM
Hi Sadsack/Solomon,
I'm following this one with interest. I've reloaded the file but only had 1/2 an hour to play with it & can't seem to find the oep via getprocaddress. Procdump seems to dump it OK using 'unknown' option but obviously the ep & header are screwed.
|Scally
Scally6
10-17-2001, 05:47 PM
Hi guys,
I dl'd the tut & app that was recommended by Solomon but when I try & run the sf thingy, I get an error message saying that the required file cryp95e is not found. It's there alright, so is this an instability in crypkey where a previous app can f* up a newer one?
I'll play some more when I got more time but the more I see, the wierder this thing becomes.
Scally
Scally6
10-18-2001, 06:21 PM
Wierd is not the word. I had filemon/regmon sitting on this on (re)install after cleaning the reg & naff 1K files from everywhere (20+) and it recreated a temp directory I'd used for a wdasm dump/procdump dump (& deleleted+removed from the recycle bin). I've tried patching the dumped exe (which runs, but exits before running the prog proper) and the original file but it never seems to get to the condx jumps that choose between the demo/std/pro versions of the file. The use of mfc42 may mean I've missed something but I'd sure like to know where I'm going wrong.
The (3) Crypkey tuts I've d'l'd & the apps they refer to don't seem to help. Even the one Solomon mentions in the post above doesn't seem to apply with the app I d'l'd - which went straight into the crypkey 'not authorised' screen rather than the 14day demo its supposed to be.
Can anyone with more experience shed some light on this protection please? So far I guess I have four apps I don't want eating up my hd space but not being able to understand how this works is really bugging me - particularly because the earlier tuts say its an easy protection to defeat.
Scally
Solomon
10-25-2001, 02:50 AM
yes CrypKey is easy to unpack. Finding the OEP is easy.

I just played with SF Editor 2002 and successfully unpacked it. It runs well in my Win2K server. No errors encountered.;) Only the offset changes coz the version differs.

To find the OEP, sure you can use GetProcAddress as a breakpoint. But I use another way. Change the section characteristics to E0000020, load it with SoftICE symbol loader, press F10/F8 to trace it from the beginning. After a short while, you will find the OEP:)


how hide softice in win2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how hide softice in win2000
PDA

View Full Version : how hide softice in win2000

Unregistered
10-15-2001, 11:18 PM
Hello. Am having troubls hide softice in windows 2000. Could some one explain this? How keep other programs detecting I am use softice.
EtErNaL_L0ser
10-16-2001, 05:09 AM
Did you try IceDump..If no check h**p://protools.cjb.net
Unregistered
10-16-2001, 10:05 PM
I do try to install icedump as you say but have trouble makeing it work. Works win98 ok but no win2000. Is different install? How? much thanks.
DakienDX
10-20-2001, 06:27 AM
Hello Unregistered ! (nice name :) )

Have you used the version from the WNT directory?
Have you used the version according to your SoftICE version?

How did you try to install the Win2000 version?
Unregistered
10-24-2001, 09:43 PM
Thanks you DakienDX for reply. Sorry I takeing so long but thought no one to reply. I have found how install icedump on win2k but still softice being detected. Icedump works win98 to hide softice but not on win2k. I still look for good tool for hideing softice. If you know one please do let me know.
Solomon
10-24-2001, 11:28 PM
pls read the old thread:

http://www.woodmann.net/forum/showthread.php?s=&threadid=1806
Unregistered
10-26-2001, 10:34 PM
Much thanks Solomon. That what I needed. Working to patch ntice now. Thanks for help, I am new to this so much is needed.
Unregistered
10-27-2001, 01:04 PM
That exact what I need. Works great. Thank you again.
DakienDX
10-27-2001, 01:44 PM
Hello Unregistered !

This time I was the one taking too long to reply :)
I'm usually sleeping at 4.43 AM :)
Good to hear that someone else has helped you.


jump generator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > jump generator
PDA

View Full Version : jump generator

amois
10-16-2001, 01:18 AM
I am searching for Kayaker's Jump Generator. I could'nt find on the net.
Kayaker
10-16-2001, 12:27 PM
Gee, I don't even remember creating that one. Is it any good?

Heh, No I don't think that was mine. If you saw it at one of the high quality professional Toolz sites, then it *definitely*wasn't mine ;)

I did a little jump proggy example thingy during a project a while back, but I don't think that's what you want. Do you mean an Opcode Jump Generator? Neural Noise made one and there's a few others around as well.

You might find what you're looking for at

h**p://www.programmerstools.org/

regards,
Kayaker

PS, If I create any more cool toolz I don't know about, let me know.
Js
10-16-2001, 02:31 PM
Hiya,

Kayaker, I have a feeling he means your backtrace buffer disassembler.
Kayaker
10-16-2001, 03:53 PM
Originally posted by Js
Hiya,

Kayaker, I have a feeling he means your backtrace buffer disassembler.

Hi,

If that's the case, wait until the hot new improved version Clandestiny and I have been working on. Complete with vxd, winice memory patching, BCHK triggered INT1 Softice popup for target memory access, and auto search/dumping of the Softice backtrace buffer for viewing or saving.

Easily crackable commercial version also available for a nickel...

:D

Kayaker
Scally6
10-16-2001, 07:19 PM
But does it make toast?
Regards
Scally
amois
10-16-2001, 09:02 PM
I don't know exactly this Kayaker's Jump Generator. My friend said to me. I have a problem about BPR and BPRW SoftIce commands. When i try to run thoose commands, 99% my computer is crushing. Also, MAP32 and MOD commands don't work. Therefor i need alternative for SoftIce back tracing.

regards
amois
Kayaker
10-16-2001, 11:58 PM
TO DO LIST: Implement breakfast features for Scally. LOL :D

Those are strange symptoms amois. If Softice is working properly the MOD command should display the windows module list, the command either works or it doesn't. MAP32 as well as BPRW might appear not to work if you use the module name given under TASK and the filename is longer than 8 characters. You need to use the full name you see under MOD instead (which is rather ironic). A guess is that you may be working with a funny filename, change it to a standard 8 character filename and see if that works.

If you're crashing on the BPR commands this is really strange. Is this only when using the Trace option or does it occur on ReadWrites as well? If the advanced breakpoint you set while setting up the backtrace is never reached (or if you didn't set one), then the system might never return to Softice, your system will seem to hang and maybe you crash.

How does your system work when just dealing with notepad? Try breaking at program start using the SI loader and set up a backtrace with
BPRW Notepad T

Then set breakpoint a few lines down, or on an API, that you know will be called. Then press F5. Softice should immediately break and the SHOW command should show you the code lines just executed within the address range of notepad. Try this and see if it works.

Read the Softice Command Reference for the exact usage of the BPR trace functions.

The backtrace buffer disassembler/dumper is meant ultimately to be able to save the output of ongoing traces. It works with an existing backtrace you've done, or to one with the program loaded so you are able to access its memory or trace packed code. Normally you use the SHOW or TRACE commands. You need to make sure you can generate a backtrace in Softice properly first.

Then make toast ;)

Hope this helps,
Kayaker
Unregistered
10-17-2001, 08:00 AM
I am just reflecting my problem directly from SoftIce.

:task
TaskName SS:SP StackTop StackBot StackLow TaskDB hQueue Events
Loader32 0000:0000 007FB000 00800000 2FD6 3037 0000
Notepad 0000:0000 0063D000 00640000 2B8E 2E0F 0000
Wincmd32 0000:0000 0070E000 00720000 2BC6 2C17 0000
Pstores 0000:0000 0056D000 00570000 250E 298F 0000
Stmgr 0000:0000 0056C000 00570000 2A5E 2AC7 0000
Wmiexe 0000:0000 0056B000 00570000 25DE 0000 0000
Msmsgs 0000:0000 0069D000 006A0000 29A6 25C7 0000
Ctmix32 0000:0000 0063D000 00640000 216E 295F 0000
Newsupd 0000:0000 0063D000 00640000 284E 2967 0000
Internat 0000:0000 0057D000 00580000 2786 27CF 0000
Systray 0000:0000 0063D000 00640000 26BE 280F 0000
Taskmon 0000:0000 0063E000 00640000 248E 2507 0000
Rpcss 0000:0000 0056D000 00570000 1F4E 1F6F 0000
Explorer 0000:0000 005A9000 005B0000 2266 227F 0000
Mstask 0000:0000 0056D000 00570000 1A9E 1B1F 0000
Mprexe 0000:0000 0072E000 00730000 193E 199F 0000
MMTASK 1E57:1F80 00B2 201C 201C 1B26 1E6F 0000
MSGSRV32 15C7:7D40 0174 7DDE 7DDE 15A6 0C5F 0000
KERNEL32 * 0167:1218 00034530 00044530 00D7 0C5F 0000
:map32 notepad
:map32 wincmd32
:mod notepad
hMod Base PEHeader Module Name File Name
:mod wincmd32
hMod Base PEHeader Module Name File Name
:bprw notepad t
Module Not Found
:bprw wincmd32 t
Module Not Found
Bengaly
10-17-2001, 11:40 AM
Heya all...

*g*, someone asked help..give it to da man ;D
Jump Generator by Muad'D1 ;D

anyway, get the JumpGenerator from :http://muaddib.immortaldescendants.org

Work Well
Js
10-17-2001, 12:52 PM
Bengaly,
he isn't alking about jump gen.
Kayaker, look how much interest I generated in your backtrace disassember, do I get a percentage?
Kayaker
10-18-2001, 12:57 AM
Sure Js, you name the cut and I guarantee the cheque is in the mail...

Amois, it looks like maybe Softice doesn't have any data on the loaded modules, so the commands requiring a module name fail. When a program is mapped into memory, winice monitors the loading of each section of it including the dlls it uses.

For example, when I load notepad and immediately Ctrl-D into Softice I see this in the command window:

WINICE: Load32 Obj=0001 Add=0167:00401000 Len=00004000 Mod=NOTEPAD
WINICE: Load32 Obj=0002 Add=016F:00405000 Len=00001000 Mod=NOTEPAD
WINICE: Load32 Obj=0003 Add=016F:00406000 Len=00001000 Mod=NOTEPAD
WINICE: Load32 Obj=0004 Add=016F:00407000 Len=00005000 Mod=NOTEPAD
WINICE: Load32 Obj=0005 Add=016F:0040C000 Len=00001000 Mod=NOTEPAD
WINICE: Load32 Obj=0001 Add=0167:7FCB1000 Len=00086000 Mod=SHELL32
WINICE: Load32 Obj=0002 Add=016F:7FD37000 Len=00001000 Mod=SHELL32
......

Do you see this? If not, then Softice probably isn't behaving properly.

Softice likely gets some of the information it needs for certain commands from the Process and Environment Database. If you type
: proc -x notepad
you should see lots of pointers to process information.

When you type MOD you should see:

:mod notepad
hMod Base PEHeader Module Name File Name
2667 00400000 817156C8 NOTEPAD C:\WINDOWS\NOTEPAD.EXE

From the PEHeader address you can get the information you see in the MAP32 command:

:map32 notepad
Owner Obj Name Obj# Address Size Type
NOTEPAD .text 0001 0167:00401000 00003E9C CODE RO
NOTEPAD .data 0002 016F:00405000 0000084C IDATA RW
NOTEPAD .idata 0003 016F:00406000 00000DE8 IDATA RO
NOTEPAD .rsrc 0004 016F:00407000 00004FB8 IDATA RO
NOTEPAD .reloc 0005 016F:0040C000 00000A9C IDATA RO

I'm not sure why TASK gives you some information, but these other 2 commands don't. Perhaps one of your other programs is interfering with Softice for some reason, try a reboot with minimal programs loaded, get rid of wincommander and anything else that starts up automatically. Are you running on a network? (Pstores looks familiar). Try not logging on and see if SI behaves any differently.

As a desperate measure try reinstalling Softice. I'm not sure what your problem might be otherwise.

regards,
Kayaker
amois
10-18-2001, 02:09 AM
I erased Win Me, than installed Win 98. Now SoftIce is full working. I don't have problem's about MOD, BPR etc..

Thanks to Kayaker for helping.

regards
amois
Bengaly
10-18-2001, 09:42 AM
Heya all..

ahh ok sorry, i though u ment JumpGenerator ;-)
didn't know he ment BackTrace utile.
BackTrace is cool, but never worked ;-) no BPR/BPMs works..(win98),

anyway cya


PC-Lint 8.0 anyone?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PC-Lint 8.0 anyone?
PDA

View Full Version : PC-Lint 8.0 anyone?

Dantzig
10-16-2001, 01:48 PM
Does anyone one where I can download a copy
of Gimpel PC-Lint 8.0?

Kinda hard to track this one down.... :(

Thanks!


SPARC / Solaris Reversing tips please :).
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SPARC / Solaris Reversing tips please :).
PDA

View Full Version : SPARC / Solaris Reversing tips please :).

SuperCali
10-16-2001, 02:52 PM
Hello,
I have tried for a long time to find information about reversing on the SPARC platform / Solaris mainly without any luck. I was wondering if anyone here has some tips or pointers, or even links ot material concerning the matter. Even finding information about SPARC assembler isn't easy. Also I have asked this on other boards, anyone know if it would be possible to write a piece of software to either:
1. intercept and fake return HOST-ID calls on SPARC or
2. redirect calls to another utility?

How are HOST-ID calls handled?

Any help would as usual be greatly appreciated. thanks in advance.

// SuperCali
4oh4
10-17-2001, 12:29 PM
heya,

I seem to remember at least a couple linux re tuts on fraviaa's old site, but can't remember whether there wer any sun tuts. But there is a unix tut section at h**p://azrael.mine.nu/underground/
and I remember at least one sun tut, maybe more.

Hope that helps a bit,
william
SuperCali
10-17-2001, 03:09 PM
Thanks alot for the link, I'm looking at it now and it seems cool, at least one essay there for Sun and a couple for unix in general.

// SuperCali
Aimless
10-18-2001, 12:02 AM
...or try going to Mammon_'s site.

...Greythorne's linux reversing site is good too...

(Search for the same name on Google)

Have Phun
UrgeOverKill
10-18-2001, 11:48 AM
Hiya,

I seem to remember that platform, so I dug into my library and found a book that will help you Super. Its called
'Sparc Architecture, Assembly Language Programming, & C'.
The author is ' Richard P. Paul' and the ISBN is
'0-13-876889-7'.

With that info you should be able to get a copy, I seem to remember buying it at B&N a few years back...

Looking thru it now, theres really alot if info in it. Let me know if you can't get one.

UoK
Unregistered
10-19-2001, 09:42 PM
I don't mean to sound sarcastic, but "man gethostid" would be a good start.

There an "ID PROM" (allegedly) on the motherboard that the Sparcs read from on boot. They drop this 32-bit identifier into a kernel variable (I believe called "host_id"). There's a function in libc called "gethostid" that simply retrieves and returns the kernel variable.

So, you could: 1) modify the variable in the kernel after boot, 2) remove the call from libc.so and replace it with one of your own, 3) if it's a statically linked binary, you can isolate the call to gethostid and repair the function in the original binary, 4) or if it has to make a syscall to get the kernel variable (it might, I'm guessing here) you could replace the system call.

Actually, I'm looking at it a quick bit now, and it looks like gethostid is actually a call to sysinfo, which is SYS_systeminfo, so you'd probably want to target that instead.

hth
SuperCali
10-20-2001, 02:31 PM
UrgeOverKill thanks alot for the info I'll see if I can get ahold of the book over here. Really appreciate the help :)!!!

Unregistered... doh... for some reason I never thoght to look in the man pages as I suspected it would be kinda hush hush as it is heavily relied upon for protections... oh well :|, then again it's not like it's some super-secret formula for world domination so I guess it was obviuos it would at least have a notice in there about it.

Thanks for the other info aswell.

// SuperCali


How to revers the statement 'AND'
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to revers the statement 'AND'
PDA

View Full Version : How to revers the statement 'AND'

Unregistered
10-16-2001, 04:53 PM
How to revers the statement 'AND'
ex. AND EDI,7F in this case edi=1398C and the answer =C
How to get EDI if i have C and 7F ??
Fake51
10-16-2001, 06:38 PM
You don't

Fake
Unregistered
10-16-2001, 06:43 PM
'AND' is not completely reversible, because it loses some information. only the bits that were '1' in the known operand are recoverable, while the information the bits that were 0 are lost.

Example

0110 ox6 and
1101 oxD
-------------
0100 ox4

if you know the result, ox4 and one of the operands, oxD, you know that the other operand has the binary form 01?1, which reduces the universe of choice quite a bit: either 0101 or 0111

But if the operand you know is 0000, the other operand cand be any thing, from 0000 to 1111. I am using 4 bit numbers for sake of clarity in this example.


Unpacking Tag&Rename..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Tag&Rename..
PDA

View Full Version : Unpacking Tag&Rename..

hobgoblin
10-17-2001, 02:31 AM
Greetings on the board,
I haven't posted anything for a long time since I've somehow been away from the cracking scene for a long time.
But the other day I decided to try to manually unpacking Tag&Rename (latest version). But after trying for some time, I need some help. I have unsuccesfully been trying to find OEP by breaking on some of the api's. But so far I haven't found something that doesn't accquire a lot of singlestep tracing afterwards.
Could someone who has been looking at this program please tell me how they found the OEP? And how they managed to dump from there?

All kinds of hints will be appriciated...

regards,
hobgoblin
Js
10-17-2001, 05:37 AM
Hiya hob,
Welcome back. May be worth your while doing a search, seem to recall a fair bit of discussion about t&r not so long back.
Ever hear anything from tiamath these days?.
regards
nofurs
10-22-2001, 12:05 PM
Originally posted by hobgoblin
Greetings on the board,
I haven't posted anything for a long time since I've somehow been away from the cracking scene for a long time.
But the other day I decided to try to manually unpacking Tag&Rename (latest version). But after trying for some time, I need some help. I have unsuccesfully been trying to find OEP by breaking on some of the api's. But so far I haven't found something that doesn't accquire a lot of singlestep tracing afterwards.
Could someone who has been looking at this program please tell me how they found the OEP? And how they managed to dump from there?

All kinds of hints will be appriciated...

regards,
hobgoblin

Hi Hobgoblin,

There are couple ways to find the OEP.
1)use api
2)icedump /tracex 400000 402000
3)bpr xxxxxx xxxxxx rw
4)bpm xxxxxx rw
5)use the original OEP

Now I'm explaining the last one ;)

bpx getmodulehandlea after a few tracing
you can see a popad and ret .f8 and you find this similar
code.step through and the last call f8
EAX=00000001 EBX=00DC05C4 ECX=00D90000 EDX=C10CFFD8 ESI=00D90000
EDI=00DB0000 EBP=0062F379 ESP=0086FE04 EIP=00DC1AD0 o d I s z a p c
CS=0137 DS=013F SS=013F ES=013F FS=211F GS=0000
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄbyteÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
0030:00000000 9E 0F C9 00 65 04 70 00-16 00 D0 0A 65 04 70 00 ....e.p.....e.p.
0030:00000010 65 04 70 00 54 FF 00 F0-4C E1 00 F0 6F EF 00 F0 e.p.T...L...o...
0030:00000020 00 00 00 C8 28 00 D0 0A-6F EF 00 F0 6F EF 00 F0 ....(...o...o...
0030:00000030 6F EF 00 F0 6F EF 00 F0-9A 00 D0 0A 65 04 70 00 o...o.......e.p.
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
0137:00DC1ACD 8D4000 LEA EAX,[EAX+00]
0137:00DC1AD0 55 PUSH EBP 
0137:00DC1AD1 8BEC MOV EBP,ESP
0137:00DC1AD3 83C4F4 ADD ESP,-0C
0137:00DC1AD6 E85516FFFF CALL 00DB3130
0137:00DC1ADB 0F856B23FFFF JNZ 00DB3E4C
0137:00DC1AE1 E82228FFFF CALL 00DB4308
0137:00DC1AE6 E8DD6FFFFF CALL 00DB8AC8
0137:00DC1AEB E86C79FFFF CALL 00DB945C
0137:00DC1AF0 E89BA4FFFF CALL 00DBBF90
0137:00DC1AF5 E85223FFFF CALL 00DB3E4C <------F8 
0137:00DC1AFA 8BE5 MOV ESP,EBP  
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

bpx getmodulehandlea again...util you reach 00DBF549 and dump it with peditor

EAX=BFF70000 EBX=00DD34D0 ECX=C10CF108 EDX=BFFBFA00 ESI=0086FCA3
EDI=0086FDF8 EBP=0086FC84 ESP=0086FC5C EIP=00DBF543 o d I s Z a P c
CS=0137 DS=013F SS=013F ES=013F FS=211F GS=0000 SS:0086FC80=00000013
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄbyteÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
0030:00000000 9E 0F C9 00 65 04 70 00-16 00 D0 0A 65 04 70 00 ....e.p.....e.p.
0030:00000010 65 04 70 00 54 FF 00 F0-4C E1 00 F0 6F EF 00 F0 e.p.T...L...o...
0030:00000020 00 00 00 C8 28 00 D0 0A-6F EF 00 F0 6F EF 00 F0 ....(...o...o...
0030:00000030 6F EF 00 F0 6F EF 00 F0-9A 00 D0 0A 65 04 70 00 o...o.......e.p.
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
0137:00DBF53E E8094FFFFF CALL KERNEL32!GetModuleHandleA
0137:00DBF543 8945FC MOV [EBP-04],EAX 
0137:00DBF546 8B450C MOV EAX,[EBP+0C]
0137:00DBF549 50 PUSH EAX <-----------here
0137:00DBF54A 8B45FC MOV EAX,[EBP-04]
0137:00DBF54D 50 PUSH EAX
0137:00DBF54E E8014FFFFF CALL KERNEL32!GetProcAddress
0137:00DBF553 8945F8 MOV [EBP-08],EAX
0137:00DBF556 837DF800 CMP DWORD PTR [EBP-08],00
0137:00DBF55A 0F8500010000 JNZ 00DBF660
0137:00DBF560 F7450C0000FFFF TEST DWORD PTR [EBP+0C],FFFF0000 
0137:00DBF567 0F8599000000 JNZ 00DBF606  
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

Fixing the iat

use revirgin to fixed the iat.There are some emulated api's.You have to use softice and
find out .an example
iat=170000
use this command
bpr 170000 170100 rw and you will see a call xxxx .put a dd 570000
coz 570000-400000=170000
step in that particular call

you will see some codes in the data window
bff...
next step is to uassemble that bff...
and see whats that api.
There are tutes about asprotect on using Revirgin and imprec
you can find ImPrec on this site http://mackt.cjb.net
http://ebliss.cjb.net
http://tsehp.cjb.net
http://http://rotaderp.cjb.net

its a very brief explaination
hopes this helps ;)

Orginal from Js
>Ever hear anything from tiamath these days?.

He's IN-THE-NET find him :D
Js
10-22-2001, 12:44 PM
would never have thought of that.
hobgoblin
10-23-2001, 02:31 PM
thanks for the info...
I will definitly look into it.:-)
regards,
hobgoblin


Need a mentor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need a mentor
PDA

View Full Version : Need a mentor

Johnny_Boy
10-17-2001, 03:29 AM
Want to crack the software Dyno Datamite form Performance Trends.
The program is a VB3 program and is protected by keylib16.dll.
I have tried to use Dodis decompiler to see what the program is doing. Dodis decompiler gives me somes qlues about what functions that are used inside keylib16.
I have tried to add a INT3 inside the keylib16 to be able to add a breakpoint inside keylib16. Works but Still have problem to follow the logic.
The function pp_tode are returning a 0 on wrong password/name/machine. 1-50 opens the software. (I think a 9 will give me the full version).
I am a newbie. I have done 10+ different tutorials, but they are all non-VB programs. I have read all the VB tutorials that I have found. Many of them are VB4-VB6 and uses SmartCheck. SmartCheck do not work om 16-bit .

I want to have some that can guide me.
I have been trying for 2-3 month now.
Aimless
10-18-2001, 12:09 AM
Try using alternative tools...

* Boundschecker (16 bit version ie ver 5.0 and below)(and/or)
* VB Debugger Standalone (debugs even if compiled with p-code) (- try the same from programmerstools.org)

Boundschecker will give you the same results as Smartcheck. With the added benefit that you can dump the bce files it generates (same a smartcheck sce files) into text files using the util it proviedes called bce_dump.exe. Load the text file in your editor and search away (I recommed Ultra edit 5.0)

Alternatively use the VB debugger. (Tho' I have not verified its ability to function on 16 bit proggies)

(Search the web for the same. On google)

Have Phun


splash screen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > splash screen
PDA

View Full Version : splash screen

theeta
10-17-2001, 04:43 PM
Hi....can anyone suggest me a method to remove the splash screens of programs like bo2k,netsonic pro etc????
Do we have any special APIs for these??
Solomon
10-17-2001, 08:41 PM
You can try the following APIs:

CreateWindowEx(A): create the splash window

ShowWindow: show the splash window

DestroyWindow: destroy the splash window

KillTimer/SetTimer: the splash screen automatically disappears after some time interval

good luck:D
Aimless
10-18-2001, 12:00 AM
...alternatively, you may try using Regmon and disable the splash screen (assuming that the proggy has the option to do that)

...or maybe use a resource modifier proggy and delete the splash

But just in case U do the above, make sure you check for CRC, Checksums etc... (in short, always keep a backup)

Have Phun


challange ... ;]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > challange ... ;]
PDA

View Full Version : challange ... ;]

liaisons_
10-17-2001, 09:33 PM
might be fun to some of you, and i wanted to see if anyone could explain what is going on in these, and whats the difference (hint hint, very, VERY little)

might make a good essay ... READ README.TXT for information !

contact me @ luxlux01@netscape.net if you have comments, questions, solutions, ect ect ;]

DONT FORGET TO READ readme.txt :D :D


FlexLM help please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FlexLM help please
PDA

View Full Version : FlexLM help please

meaculpa
10-18-2001, 01:47 AM
Hi,
Need some help with FlexLM reversing please.
Target: Materials Studio (formerly MSI, now Accelrys)
Looks like it was build with v7.0c, I'm using SDK v7.2h.

Please help me with the SoftIce part, I can't figure out what to
BPX with, to start getting the vendor codes and seeds?

Does anyone know where i can contact some Flex experts such as Nolan Blender, SiuL+Hacky, Pilgrim or Dan.....

Thanks in advance

Regards,
.MeaCulpa
Perry
10-18-2001, 06:36 AM
Maybe, if you give us more information where we can to see your work.

Anyway, read the Dan Essay.

Perry.
meaculpa
10-19-2001, 02:48 AM
Hi Perry,

Could you be a bit more specific on what you would like to see. ??
Perhaps another question - if i disasm the target exe, and see no
licencing calls, it means they're using the libmgrxxx.dll method, right?
Also the essay from dan, is for custom crypt filters, (sounds like this is a rare protection method), how do i know if i'm dealing with crypt filter?
Thanks is advance

Regards
.Mea
newbius
10-23-2001, 11:19 PM
I think it might be crypt filters. Try tracing down lc_set_attr and see if it attempts to set LM_A_USER_CRYPT_FILTER. If your seeds are good, but you're not getting valid licenses, check for this.
Kythen
10-23-2001, 11:58 PM
Actually read over both Dan's essay (which is not on crypt filters) and Nolan Blender's essay.

Also, what do you mean by not finding any licensing calls? Did you not find any in the imports? Then check any other dll's in the program. If you still don't find any of them importing the flexlm dll functions, then your target used the library. In that case you identify critical functions like lc_init, lc_new_job, l_n36_buff, l_sg, lc_checkout, and lc_set_attr. There are a few nice tricks involving strings to make that identification process easy. You'll see what I mean in the essays, but if it doesn't make sense I can explain more thoroughly (I want ppl to explore and learn on their own, not just spoonfeed answers).

After you identify those critical functions, check to see if there are any funky attributes are used, like those crypt filters, or a vendor defined hostid. If so, deal with them accordingly (we'd be glad to help ya if you do run into some), otherwise just follow the above essays and you should be just fine. Make sure to set your LM_BEHAVIOR entry in your SDK to v7.0 and not the v7.1 though! Don't want your license gen thinking it has to use those signatures and not the normal key :)


Rce Cd
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Rce Cd
PDA

View Full Version : Rce Cd

BillBoy007
10-18-2001, 03:51 PM
Would anyone be willing to burn me a copy of the free RCE Cd. I've tried to get hold of it but can't (email address for UK doesn't work) . I'd cover any costs involved.
Cheers,
Bill.
Clandestiny
10-18-2001, 05:45 PM
Hiya BillyBoy,

Sorry about the late reply. I got your request and meant to respond sooner. Anyway, I'll be happy to send ya a copy of the RCE cd. Please email me your shipping info and I'll get it in the mail.

Cheers :)
Clandestiny
EtErNaL_L0ser
10-19-2001, 05:12 AM
I am from Turkey and I dont think you can send it to me so would you mind uploading it to a ftp?
Bengaly
10-19-2001, 05:41 AM
Heya...

ask him what version of RCE CD u need, there are version :D
I have the "Special Edition" CD :-)
cya
nofurs
10-19-2001, 06:44 AM
original from Eternal_Loser
>Hmm...
>I am from Turkey and I dont think you can send it to me so >would you mind uploading it to a ftp?

They have done that long time ago but some idiots puts virus in
the ftp site :mad: .Later they decide not to put it .

original from Bengaly

> I have the "Special Edition" CD :-)
>cya

what's so special about your version you didn't tell me ;)
Bengaly
10-19-2001, 06:52 AM
Clue-Surf :-)

*g* ask the one who made the Special Edition CD :-)
I don't have the regular RCE cds so i can't tell the differences
But mabye there are few new fetures.

Cya all..

btw:
doesn't turkey has post offices ? :)
Clandestiny
10-19-2001, 09:56 AM
Hiyas,

Well, it looks like you have a choice: The RCE Special Edition or The RCE Special Edition ;) Thats the only version I have.

To EtErNaL_L0ser:
Contact me via email if you're interested in the cd.

Cheers,
Clandestiny
EtErNaL_L0ser
10-19-2001, 10:34 AM
Mail sent thnx...
Hoof Arted
10-20-2001, 04:49 AM
Is this cd full to the max or is it possible to rip an ISO of it and have it uploaded somewhere?

Hoof
Clandestiny
10-20-2001, 10:03 AM
Originally posted by Hoof Arted
Is this cd full to the max or is it possible to rip an ISO of it and have it uploaded somewhere?
Hoof

The cd is full to the max (650 / 700 megs on the disk), though I could possibly u/l it somewhere if someone could get me the space.

Regards,
Clan
EtErNaL_L0ser
10-20-2001, 02:36 PM
any news about Cd....ClanDestiny?
Aleph
10-20-2001, 08:47 PM
Hiya all.

First post on the new board, w0w :D Been way too busy IRL :(

Hiya Clandestiny. Does your reply means that you're now an active distributor in UK, and that I can send UK's request back to you, or did I continue to serve 'em as well ?

Anyway, just a thing I'd like to clear up, acting as one of the volunteer for the RCE CD (BTW, the list is still at w*w.idca.com/~thesandman/RCE/Requests.html ) : I had lately a lot of requests for the "Special Edition CD", so I'll say it here, once and for all : I've never heard about a special edition CD. I've sent 'round 150 CDs everywhere in the world in the last 6 months, and they were all the from the same ISO I received from one of the volunteer.

So, as far as I know, sorry boys : no "Special Edition CD".
But, Bengaly, if you truly have the "special edition", I'd be interested in a copy, or at least a ls -lR, to know the differences. Let me know.

regards,
Aleph

PS: sorry for my english, I'm not practicing a lot those times.
Clandestiny
10-20-2001, 09:14 PM
To EtErNaL_L0ser :

I emailed you yesterday... I take it you didn't get my message? Well, anyway I sent it again just now. If you don't recieve it this time, perhaps you can verify your email address with me...

To Aleph:

Good to see you're back :). BTW, I'm not really an "official" distributor at all ;). I've sent out a few RCE cd's to a handful of individuals in the past who've expressed an interest, but I'm not on the list as an active distributor. I can, however, confirm for you the existance of the RCE Special Edition cd since its the version I've got myself. If you're interested, feel free to drop me an email.

As I mentioned previously, if someone can get me the 700 megs of space, I don't mind uploading the ISO somewhere.

Regards,
Clandestiny
nofurs
10-20-2001, 09:24 PM
Hiya Boongaly and everyone ;),

http://www.idca.com/~thesandman/RCE/RCEMenu.zip
compare the menu system with your cd menu see if its the same
Btw this is a RCE CD I do hope you guys should follow the 'LendWARE' schemes.

1 Blank CD
Enough postage stamps to cover the return of your cd.

cya...
EtErNaL_L0ser
10-21-2001, 03:20 AM
ClanDestiny Can you mail me at engineer@isnet.net.tr You can use PGP if you want :)
Hoof Arted
10-26-2001, 03:03 PM
Thanks to Clandestiny, I am in a position to make the cd available for a SHORT time on the web via FTP. The required arrangements will be made and I will let you know shortly.

In the past, it has been customary to pass the cd around via distributors and the likes. I think that in this new age of broadband internet, the iso can be downloaded in 8 hours or less. When the ISO is available, I and many others would proberbly like the assistance of being able to have other locations to obtain it. If you do download it and can host it, put it up and let us all know.

Hoof
EtErNaL_L0ser
10-26-2001, 03:56 PM
Great job guys...I am looking forward to it....
Hoof Arted
10-29-2001, 01:58 PM
Right, the ISO can be downloaded at.......... Uhhh.... I need to keep some control so drop me an e-mail and I will hand you the info. Please also include your download bandwidth to try judge how long each person will take. Cable modem (512k) can take 6 - 8 hours. Dial up, :-) well, forever but I can work with you.

The D/L is divided into 15*30Mb files. I do not want anyone who starts to not finish so lets have order and the FTP will stay up. I will keep it up as long as possible.

Once again, if you can host the files somewhere, then do it.

Hoof
EtErNaL_L0ser
10-29-2001, 02:55 PM
Would you mind sending me FTP info ..My mail is engineer@isnet.net.tr thnx!
clatter
10-29-2001, 10:44 PM
Hoof Arted,

Would you mind sending me the URL also?

my e-mail is codecode14@hotmail.com I have a Cable modem connection so it should be very fast.

Thank you!

P.S. I read your Ollydbg tutorials and fell in love with that program. Thank you!
kp_
10-30-2001, 06:47 AM
Hello Hoof Arted!

Please send me the URL too.
I can provide 700 megs of space or even more if needed. If you allow me to download it from you I can put it on and will accept reqests for downloading too. I have a limit on outgoing data (4Gb/day and 8Gb/5 days I think - after it I'll be banned :) ) so I won't post the address here but I'll email it to anyone who asks for it if I have some bytes remaining for that day ;) )
I would be happy if I could help others to take the cd too.

Thanks and waiting for your reply,

kp
esther
10-31-2001, 04:19 AM
>In the past, it has been customary to pass the cd around via >distributors and the likes. I think that in this new age of >broadband internet, the iso can be downloaded in 8 hours or >less

Does everyone here has broadband??? If not good luck ;)
+Sandman
11-03-2001, 03:30 AM
As the original creator of the RCE cd, I know of no 'special Editions' of this cd, besides, the original CD was filled to the max, so any 'special Editions' of this would mean a loss of some of the old data from the original cd.

However, just before I created the master CD I added some extra files to the cd without properley checking them and it was here a couple of minor viruses sneeked in without me noticing. By the time this was spotted, several CD's had already been sent out. Subsequent releases of this cd were sent out cleaned of these two viruses. This might be where the confusion arises of the 'Special Edition' CD's. They are both identicle, but the latter is virus free.

My web page at idca.com has been frozen in time for well over a year now, I have no access to it what-so-ever, the isp hosting it is no longer active, they do however continue to host my page out of respect, to which I am eternally gratefull to them. This means I am unable to remove/alter/add those volunteers who have offered their services in distributing the RCE cd. If anyone still want's a copy of this cd then seek it here, in the forums rather than from my web page.

Regards & Respects to you all

+Sandman

P.S. I send my personal thanks to Woodmann & +Tsehp for keeping the true spirit of reversing alive within these forums. Now that is an achievement all on it's own.
Bengaly
11-03-2001, 07:16 AM
OMG i can't belive...
itss...itss...+Sandman....:0
sandman u rox, where have u been hiding ?
i lost ur reply to my email , and i have send ya another one..hoping to get replied again..

seeing the "spiritual" cracking teacher talks in public....
/me is shocked...finally u are here :-))

hope to get reply to my last email..(shanytc@yahoo.com)

p.s:
OMG U ROX :-)
UrgeOverKill
11-03-2001, 08:46 AM
Welcome back +Sandman...

wow most of my reference mats are from you !!

glad to see you back on the scene ....
esther
11-03-2001, 12:36 PM
Originally posted by UrgeOverKill
Welcome back +Sandman...

wow most of my reference mats are from you !!

glad to see you back on the scene ....

Greetings Sandman,
Ltns ;)Hope things are well best regards
Clandestiny
11-04-2001, 05:37 PM
Originally posted by +Sandman
[B]As the original creator of the RCE cd, I know of no 'special Editions' of this cd, besides, the original CD was filled to the max, so any 'special Editions' of this would mean a loss of some of the old data from the original cd.

Hiya,

I know there's some confusion regarding the special edition cd. The opening screen of my own RCE cd clearly states "Special Edition" though I have no idea weather the realease was intended as a special edition or not. For clarification purposes, I'm uploading a .jpg image of the opening screen as it is on my version of the RCE cd.

Regards,
Clandestiny
peterg70
11-04-2001, 10:13 PM
Is this still available for Download in ISO form

If so could someone send the link to me at the following address

rcecd_request@yahoo.com underscore between rcecd and request

Thanks in advance
Hoof Arted
11-05-2001, 03:54 AM
ok, Maybe the line in my last message was not clear enough. To avoid this becomming a bun fight and the total destruction of my bandwidth, I would like an e-mail from you if you want this ISO. Also let me know when bandwidth you have so that I can try plan for usage. I dont want to be a bitch about this but I need to keep control. If anyone who already has an account and the download path give this infomation out on this board or anywhere else, I will pull it. If you have an FTP server an can host it, I will upload it to your site.

Hoof
kp_
11-06-2001, 06:36 AM
Hi Everyone!

I succesfully downloaded the RCE ISO (thanks again Hoof ;) ) and anyone who needs it can download it from me. So if you need it then please email me, and please let me know your bandwidth too. I will reply you as soon as you can download it and give you the details. (if I get many requests then maybe you'll have to wait a few days because of my outgoing data limitation)

Best regards,
kp
?ferret
11-06-2001, 10:04 PM
YOU'RE ALIVE! LOL

Hola vato,

Hope things are going well for for you & I think I can speak for all when I say we miss havin you around....pop in from time to time & say hi (basically what I've been doing lately hehe):rolleyes:

later amigo,

?ferret
Unregistered
11-07-2001, 05:14 AM
Hello Hoof Arted!

Please send me the URL too. My email is fkaps2000@yahoo.es
I have cable modem.
Thanks.
Hoof Arted
11-09-2001, 05:11 AM
Ok, I have sent +-3.6 GB of data in the last 5 days and there is more to go. I just want to say to people that the ISO image that is available is VERY large. I would reccomend that people download the volumes and put it all back together on their own systems. You can save yourself about 160Mb worth of download this way. For Dial up users, dont even think about trying the ISO. You will never finish.

I do not want to ban the download of the ISO image itself but I have had some people download the volumes AND the ISO. If this is you and you already have the volumes, please stop. One or the other, it is the same thing, exactly the same size and hash. Give some others the chance to use up all my bandwidth :D

Also, send an e-mail to KP_ if I am not able to respond quickly enough. Hopefully all the people busy downloading at the moment will be able to finish this weekend and we can start a fresh batch of downloadees :) . And for those of you who do not know, the ISO needs to be burned back to cd or you must extract it to disk with something like Winimage.

Happy downloading.

Hoof
binbin
11-11-2001, 12:09 PM
I'm new here.
Anyone can tell me what the CD contains?
kp_
11-11-2001, 03:58 PM
Hi all!

You can download the RCE ISO volumes from me too. Let's make Hoof some free time and email me instead if you need it!

Best regards,
kp
stealthFIGHTER
11-11-2001, 04:55 PM
Hi kp_,

i'll be pleased, if you send me your URL [stealthfighter@another.com].

Thank you very much

sF
seeker
11-13-2001, 10:47 PM
hi guys. I just finished downloading the volumes and assmbled the ISO. However, problem is, when I try to burn the ISO onto disk, Nero gives me a few options, which leaves me kinda confused.

first off, what should i specify for "type of image"?? there's data mode 1, data mode 2, and HFS. And should i check the "raw data"? How about the settings like "block size", "scrambled", "swapped"?

sorry to ask this kind of thing, but I'm really new here to ISO burning. This is the first time i've actually downloaded an ISO.

Thank you all.
Lord_Soth
11-14-2001, 01:09 AM
HIya Seeker,

What version of Nero are you using ??

I dont have all that options. I only have Data 1 and
Data 2 modes heheh
In any case, when I usually burn CDs that contain files
I use ISO 9660 (the default) and data mode 1, which
seems to work just fine.
I don't remember the differences between all the modes,
but since these are just files, data 1 will probably work
for you, and you can probably also leave the other checkboxes
alone :)

LS
seeker
11-14-2001, 02:05 PM
hey thanks. Yup - mode 1 works...
Unregistered
11-14-2001, 06:07 PM
I d/l the volumes, how do I assemble the ISO??

I never had to do this before. By the way, what does ISO stand for?
Hoof Arted
11-15-2001, 02:28 AM
To assemble the ISO from the volumes, download winrar and extract the *.rar file. It will then extract all the other volumes to form the one large ISO.

Hoof
UrgeOverKill
11-15-2001, 07:42 PM
hmm, it seems that i can't unzip my rar file. My zip prog is giving me an error msg that it 'cannot write to the disk (disk full?)'

I have Zip Magic 4.0. and plenty of disk space. It does this on the disk and when I copied the disk to a temp file on my c drive, same, same.

anybody else have the same prob.?:confused:
Hoof Arted
11-16-2001, 02:58 AM
Did all the MD5 hashes total up? Try getting winrar. SW version will work.


Cryptography ( As posted by EtErNaL_L0ser)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Cryptography ( As posted by EtErNaL_L0ser)
PDA

View Full Version : Cryptography ( As posted by EtErNaL_L0ser)

Woodmann
10-18-2001, 06:30 PM
Why dont we have a forum dedicated to Cryptography?To discuss DES MD5 El-Gamal RSA PGP and others....
Bengaly
10-19-2001, 06:47 AM
Sound cool, but 80% of the ppl won't understand
The topic ;-) unless it's interested in some way or
some ppl actually learn it :-)
but i'd say..GO FOR IT :-)
bye
EtErNaL_L0ser
10-19-2001, 10:38 AM
I am reading Applied Cryptography and its software implementation seems to be fun and challanging :)
Kythen
10-19-2001, 05:28 PM
I'm all for it! I'd also speculate you'd get a few more advanced RE ppl to crawl out of the shadows for such a forum, as it's one of the primary areas of research lately. It's good to have someplace for the more advanced RE enthusiasts to play. There's a spot for newbies, and one for general RE topics, but not much for advanced things... and especially crypto.

Cheers! :)
DakienDX
10-20-2001, 05:39 AM
Hello everybody !

Sounds good :D

But we must define what belongs to the forum and what not.
I think we wouldn't like posts like "how does asprotect crypto work?" :(

We must define if only known cryptography belongs into the forum or if we can discuss algorithms which seem to be real cryptography, but are only XOR/ROR/ROL/ADD/SUB algorithms in the end. (I know real cryptography uses this too, but in an other way)

We must also prevent posts like "Can please somebody bruteforce RSA-xxx in program yyy for me?"

If all these things are checked, then why not a crypto board? :)
EtErNaL_L0ser
10-20-2001, 11:28 AM
I am totally agree with u Dakien No Lame Post! :) And starting with XOR would be really cool :)
DakienDX
10-20-2001, 04:33 PM
Hello EtErNaL_L0ser !

I would like to start with
@@1:
Lodsb
Xor AL,1
Stosb
Loop @@1
Is this o.k. for the beginning? :D
Or should e start with something more difficult like adding one ROR? :D

Hello tsehp !
Hello woodmann !

Who's going to be the moderator/administrator for the crypto board if we get one?
Woodmann
10-20-2001, 05:33 PM
A moderator for the Crypto forum huh?

Lets figure out the direction the forum shall take first.
If you are happy with what you have discussed then I will start the forum.

As always, use common sense, (I know that you all will),
and everything will be wonderful.

Oh, post some gudelines to include on the front page.

Peace, Woodmann
EtErNaL_L0ser
10-21-2001, 04:34 AM
Dakien I am real newbie in software implementation ýf cryptography even XOR :) lol I better watch the forum and learn we can start with reading in www.counterpane.com . Really good essays :)

And who will be the moderator? Woodman +tsehp or another +HCU strainer would be ok I think

Out of the topic I wonder who voted for No! lol
DakienDX
10-23-2001, 11:55 AM
Hello woodmann !

I agree with you. We must have everything discussed clearly before starting a new forum.

I see 19 "yes" and one "no" in the poll. But only 9 replies (three from me, one from you). So I think we should hear more voices on the topic before deciding about if (or if not) we should create a new forum.

A reply from someone being familiar with cryptography would be a nice addition to this poll.

Final question: What can we use the forum for?
I think no one can explain why RSA works or why SHA was converted to SHA-1.
All other crypto algorithms are well documented and commented by cryptographical specialists.

So the question: Not "if" or "if not", just WHY
Woodmann
10-23-2001, 01:55 PM
DakienDX,
You raise a very good point.

I shall leave it too you all, what reason do we start this forum?

I don't see any restrictions. You can discuss anything related to crypto.
Of course I would like to see how it works and how, if possible, it can be reversed/defeated.

Peace, Woodmann
McCodEMaN
10-23-2001, 03:52 PM
Greetings!

I belive that this is an excellent idea!
Over the years I've practised RCE the relationship with cryptography has grown, and I belive that you all feel the same.
Today the knowledge and understanding of cryptography tend to have a major impact on both RCE and computer science in general.

So why should we start this forum when they already exist elseware?

The answer is simple and I think we can come up with many good reasons. I for one hope that that this forum (if created) will help ppl. to exchange ideas on how to apply the knowledge on RCE tasks, along with cryptography in general.

Best Regards
\\McCodEMaN [TRES2000]
EtErNaL_L0ser
10-26-2001, 02:57 AM
Although I am the owner of this suggestion I think we should close this topic because topic has more than 200 views but only 22 votes.This s**.Even +tsehp didnt make a little comment on subject :( .So we better close this topic

Best Regards

CARTMAN aka DaWsOn aka EtErNaL_L0ser
DakienDX
10-26-2001, 01:18 PM
Hello everybody !

I can't vote again, but here's my vote no. 2: "NO"

I think EtErNaL_L0ser is right, we should close this topic.

270 views and 22 votes is nothing unusual, and tsehp may be busy at the moment (I can only find one post in the last 11 days from him), but this discussion arrived a dead point.

Cryptography may be discussed as before on the RCE General, because is has to do with general reversing (most of the time :) )
EtErNaL_L0ser
10-27-2001, 04:59 PM
Great to hear that!
DakienDX
10-28-2001, 01:23 AM
Hello everybody !

Well, ok, start a new forum. If it's blessed by tsehp, it shoud become true. Here's my bless. (as if anyone woud care about that :) )

Can someone correct the "\n" in the "Mini Project Area" 's forum description and the "with a 500k limit" in "Reverse Software Engineering General" 's forum description on the way to the new forum?
DakienDX
10-28-2001, 10:25 AM
Hello ArthaXerXes !

Thank you.

It was nothing special, but it was anoying when looking at it every time going to the board. :)
tsehp
10-28-2001, 12:07 PM
1- I'm not tired ;-) (artha likes to bite me here, because he's 10 years younger than me, but even ten years couldn't maybe corrupt a great amount of grey matter I built since those long and tiring rce years (3 in total,whaou !)

A cryptology forum is badly needed, this feature is really not well covered on our archives and really deserves some comments,
me thinks that we should directly start it without moderator at first, then we can naturally choose the guy that will participate the most.

So it's just created, just tell me if the name deserves to be changed.

LONG LIFE TO THE Rce cryptographics !!!
DakienDX
10-28-2001, 12:43 PM
Hello tsehp !

LONG LIFE TO THE Rce cryptographics !!! :)

You should now change all forum descriptions to "flames, crack, serial and bruteforce requests will be removed" :)
EtErNaL_L0ser
10-28-2001, 02:05 PM
Yeah no lame post! But some resources :)
McCodEMaN
10-28-2001, 06:55 PM
Greetings everyone!

I'm glad to see that a forum finally was created for such a important and thrilling subject, as I belive that this is!
I hope to see many interesting posts in the future , and perhaps even share some of my ideas.

Regards
McCodEMaN
mike
10-29-2001, 12:23 PM
Originally posted by DakienDX
...
I think no one can explain why RSA works or why SHA was converted to SHA-1.
...

I can do both.

First is Fermat's Little Theorem:

a^(p-1) mod p = 1, where p is prime, ^ is exponentiation, and a is any number less than p. So

a^b mod p = a^(b mod p-1) mod p.

That implies that for n=p1 * p2 * ... * pk, the product of kdistinct primes, that a^(p1-1)(p2-1)...(pk-1) = 1. This product in the exponent is usually called phi(n).

So a^b mod n = a^(b mod phi(n)) mod n.

So pick two large primes p and q, and multiply them to get n. Then phi(n) = (p-1)(q-1).

Now, you want a two step process, encrypt then decrypt, so that you get the same number back. Well, a^1=a, obviously, so you need two exponents whose product equals 1 mod phi(n).

Pick e at random, and since you know phi(n), you can calculate

d = e^-1 mod n

Publish n and e as your public key. In order to break the code, you need to find d. You could calculate it if you knew (p-1)(q-1), but the only way anyone knows how to get that from n is to factor it. This is very hard.

Then to encrypt your message M, you have

C=M^e mod n

and to decrypt you have

C^d mod n = M^ed mod n = M^(ed mod phi(n)) mod n
= M^1 mod n = M.

Voila!

SHA was probably changed to SHA-1 to avoid an attack that works somewhat like differential cryptanalysis. I say probably because a guy later found an attack that works on SHA-0 but not on SHA-1. If anyone is interested, I can post the reference.
EtErNaL_L0ser
10-29-2001, 01:29 PM
Leonhard Euler and Pierre de Fermat both prime-number guys! They got great theorems :)

One mus know them all!
Sphinx
11-12-2001, 07:06 AM
hello you all

well i would say get this topic of the ground, i`m very in too this
i sure want to learn more on this. I have been searching on the web and collection info but as said before you have to have a background to fall back on becuz it`s very very hard. The math involved ain`t easy.

also rv it is difficult becuz lot of cyphers work on the idea big key so hard to brute force. It takes time sometimes lots of it. math is involved to calc the time needed to crypt and decrypt it.

i`m checking this thread often now

Sphinx
Sphinx
11-12-2001, 07:15 AM
maybe you can look here h**p://www.claymath.org/prizeproblems/index.htm
these are some big math problems unsolved (yes you can win money) but my point is some off these problems are used in cryptography cuz No one is yet able to use a function to get to an answer in stead you`ll have to go by all possibilties takes time a lot of time just think of prime numbers we can generate them but we can`t say

function p(x) = prime (p is a function not yet discoverd)
say i want the 100th prime number fill in x=100 and you get your 100th prime number

the p versus np problem is something like that too


Dongle indentity
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Dongle indentity
PDA

View Full Version : Dongle indentity

MTB
10-18-2001, 07:56 PM
Green dongle approximately, 6~7 years old, about ~1.5 inches (~40 mm) long. Any ideas on what type it is?

Yes I looked at it closely, but the stickers are long gone, and the writing on it is also history.

I have never seen one like this!

Thanks
MTB
Willebul
10-19-2001, 03:14 AM
Sounds like a Activator , they came out in different colors , logo on the label was a porcupine
Bengaly
10-19-2001, 06:57 AM
Try ask CrackZ..he know dongles as well
or try the HCU pages, mabye there is some info there.
bye
ZaferBSCA
10-20-2001, 03:58 PM
yep, it sounds like activator.. many dongle models were in some different colors (eg. hasp; red/white) but what's different in activator is that;
activator protected programs generally fails to run with "no green/yellow/red.. activator plugged" error message.
MTB
10-20-2001, 08:46 PM
Ok, I will ask the user if there was ever a porcupine on the decal, the other question to ask the group is does anyone have a IDA signature for this dongle?
Thanks for the info.
MTB
MeteO
10-20-2001, 08:46 PM
zafer:

I've never seen HASP with colors other than white and red(also blue - it's TimeHASP)). Sentinel dongle delivered with gray color. Activator/Aegis delivered with green/red/yellow color, Novex with white-gray, Wizzy-key with black such Hardlock...
Willebul
10-22-2001, 04:41 AM
I did some digging on the Activator

Company that did it was called SSI , Software Security, Inc.
dont seem to exist anymore

If you get some of the following files installed it should be an Activator

SSIPDDP.SYS - Parallel Port Physical Device Driver
SSIDDDP.SYS - Parallel Port Virtual Device Driver
SSIVDDP.DLL - DLL used by the Virtual Device Driver

SSIACT.386 - Parallel Port Device Driver
DDINST32.EXE - Win32 Utility to automate device driver i
DDINSTAL.HLP - Help file for DDINSTAL.EXE and DDINST32.EXE
CHECKVDD.EXE - Utility to check for a loaded Virtual Device
CHECKLPT.EXE - Utility that reports the LPT# and Port Address
used by the device driver

Regards
Willebul
MTB
10-22-2001, 05:57 PM
Thanks for all your help fellow reversers, I would be lost without you!

Willebul
Bingo I found some of the files! Thanks.

My next problem >> is this dongle like Hasp or Sentinel or is it a different design software speaking? Does anybody have documentation for the dongle or tutorials for it?

The target was decompiled by W32dasm and IDA, however IDA doesn't recognize the code and comes up with some unintelligent error message. I probably can beat it with W32dasm but prefer to use IDA. Any suggestions on what went wrong?

Thanks
MTB


Problem patching packed ones
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problem patching packed ones
PDA

View Full Version : Problem patching packed ones

wbe
10-19-2001, 07:53 AM
What I know:

It is hard to patch the unpacked executable though may be not impossible. I tried dZa Patcher, worked on my PC but not on others. Aspatch said "not enough space at the end".

What I don't kow:

Do RVAs change from PC to PC? Both the disassembler (unpacked) and sice (packed) shows the same code at any specific RVA of the executable. So where is the problem? Neither patcher nor loader work except on my PC. I'm confused.

Are there any loaders that will do S&R job on "packed" executables? I couldn't find one.

Any comment greatly appreciated.
nofurs
10-19-2001, 11:06 AM
Hi,

Different operating systems affects the loader or patched file.
example win98 notpad doesn't runs in win95 unless you have fixed i.t and iat...
wbe
10-23-2001, 05:26 PM
Originally posted by cluesurf
Hi,

Different operating systems affects the loader or patched file.
example win98 notpad doesn't runs in win95 unless you have fixed i.t and iat...

That's for sure.

Any specific answer about the RVA stuff?
Solomon
10-23-2001, 08:40 PM
hi,

for already unpacked progs, there is no need to use a loader. Just patch the unpacked exe/dll files directly.

To patch packed ones, one way is using a loader, the other is SMC(self-modified code).

The RVAs of instructions/data in Win32 EXE/DLL never change, so does the ImageBase of EXE. But the ImageBase of DLLs may change(relocation occurs), so the VA of DLLs may also change (VA = ImageBase + RVA).


need some help with rsagent
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > need some help with rsagent
PDA

View Full Version : need some help with rsagent

-=elgura=-
10-19-2001, 01:32 PM
hi

i try to remove salesagent from a macromedia application.
and i do need some help here..

is there any tutors about it... i've seen capac's tut. on it
but i need more :-)

or if some one can give me some hints to go by..

see ya
EtErNaL_L0ser
10-19-2001, 02:17 PM
I will write an essay on Sales Agent Cracking after my damn Physics MidTerm over :(

But not sure if its posted on tsehp.cjb.net :)
DakienDX
10-20-2001, 06:15 AM
Hello -=elgura=- !

Would you mind telling us some information? :)

What have you found out so far?
Which target are you working on?
-=elgura=-
10-20-2001, 07:29 AM
hi

i've read capac's tutorial about unboxing rsagent and the tutorial works well on flash5 try&buy
but i want to manually remove it like "unpacking".
and i need some help on the crc check too.

as you can see i don't got far yet...
EtErNaL_L0ser
10-20-2001, 11:21 AM
my approach is so clean no unpacking and no crc maybe so newbie :) but you wait to wait until next friday when I took my physics exam :(

but my approach works on all sales agent progies including all Macromedia Apzz
-=elgura=-
10-20-2001, 03:58 PM
ok dude

i'll wait till you are done with the exams.
just post a reply here :-)
evaluator
10-22-2001, 03:08 PM
Hi, -=elgura=-!
By the way, I found on AARONs web page
"unpacker" for rsagent-ed programs.
I think, it will interesting for you.

Hi, EtErNaL_L0ser!
So you like laughing about poor newbies?
I think, little mp3 from poor newbie will help
you in your exams! Check attachment~:-)
EtErNaL_L0ser
10-26-2001, 07:34 AM
Laughing at newbies!? I am a biggggggggggggg newbie myself so I have to laught at myself first lol.

Btw I couldnt pass Physics Exam :rolleyes:
Anyway.Now Rsagent essay up check http://eternall0ser.cjb.net/

One copy is mailed to +tsehp dont know if he is going to publish it though.

Hope you will like the essay any comment? mail to eternal_l0ser@yahoo.com Have phun! :D
nofurs
10-26-2001, 11:01 AM
Hi erm EtErNaL_L0ser,

Nice tute keep up the good work man ;)

cheers
cluesurf
EtErNaL_L0ser
10-26-2001, 11:37 AM
Thnx man its my very first tutorial :)
evaluator
10-27-2001, 12:11 AM
Pardon! EtErNaL_L0ser!
H3Xenoic
10-30-2001, 01:56 AM
hey , sorry about your physics exam :-( also it seems you failed the 'removing' salesagent test by unpacking as promised !!!!!

Did you read the previous threads in AUGUST on RSAGNT for ideas ???

http://www.woodmann.net/forum/showthread.php?s=&threadid=741

H3Xenoic
evaluator
10-30-2001, 05:27 AM
Hi guys!

Sorry again, EtErNaL_L0ser! I removed mp3 attachment.
Probably I not understand you because my little english.

-=elgura=- mistakely started new thread "hi" about this problem.
There I submited my easy "tut" about "unpacking" from
stupid rsagent "protection". Check please, if something is wrong.
Or we must go back to this thread?
nofurs
10-30-2001, 05:56 AM
Originally posted by H3Xenoic
hey , sorry about your physics exam :-( also it seems you failed the 'removing' salesagent test by unpacking as promised !!!!!

Did you read the previous threads in AUGUST on RSAGNT for ideas ???

http://www.woodmann.net/forum/showthread.php?s=&threadid=741

H3Xenoic

Heya H3Xenoic,
>hey , sorry about your physics exam :-( also it seems you failed the 'removing' salesagent test by unpacking as promised !!!!!

Did you read carefully about Eternal_L post?He didn't promissed
that!!!!

original from Eternal_L
>my approach is so clean no unpacking and no crc
EtErNaL_L0ser
10-30-2001, 06:24 AM
Thnx for the point cluesurf!

I am little newbie has so less info about unpacking.And my life is so busy with computer engineerin so that I dont have much time to take unpacking practise :mad:

And evaluator! That mp3 was really c00l!
:D

C ya guys back to Calculus! lol


need info on ROR and ROL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > need info on ROR and ROL
PDA

View Full Version : need info on ROR and ROL

javelin
10-19-2001, 08:32 PM
i was wondering what ROR and ROL do.
Bengaly
10-20-2001, 03:35 AM
ROR - Rotate Right
Usage: ROR dest,count
Modifies flags: CF OF
.---------------. .-.
.->| 7 ----------> 0|--.->|C|
| '---------------' | '-'
'---------------------'
Rotates the bits in the destination to the right "count" times with all data pushed out the right side re-entering on the left.
The Carry Flag will contain the value of the last bit rotated out.

ROL - Rotate Left
Usage: ROL dest,count
Modifies flags: CF OF
.-. .---------------.
|C|<-.--| 7 <---------- 0 |<-.
'-' | '---------------' |
'---------------------'
Rotates the bits in the destination to the left "count" times with
all data pushed out the left side re-entering on the right. The
Carry Flag will contain the value of the last bit rotated out.
javelin
10-21-2001, 04:38 AM
Thanks for the info.


vbox43
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vbox43
PDA

View Full Version : vbox43

dads
10-20-2001, 01:22 AM
Following Dezzie's great tut I am able to find the
oep of ulead's visual cad (wrapped with vbox 4.3).
When I try to do a dump with procdump. I get an illeagal operation error. Is there something I am missing?
javelin
10-20-2001, 02:36 AM
You might want to try:

http://www.woodmann.net/fravia/tsehp_vbx43tut.htm
dads
10-20-2001, 09:25 PM
The vbox4.3 version is not the intermiated version discribed by teshp. When I try yo run my dumped file I get a page fault. My unvboxed exe won"t run, oep was recalculated, but no good.

ps the proggies are imsl's visualcadd and ulead's photo explorer. Thanks.
javelin
10-21-2001, 04:36 AM
you have to fix the iat of the dumped file
with importrec or revirgin


telock >0.92 unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > telock >0.92 unpacking
PDA

View Full Version : telock >0.92 unpacking

lungenkrebz
10-20-2001, 06:36 AM
hi,
does anybody know how i can manuell unpack a *.exe that is encrypt with the new telock (0.92-.0.96)?
i wasn't able to make a good dump, because i can't came through the encryption routine.
Does anybody know a good breakpoint?
I've test VirtualProtectEx,Loadlibrarya and Getprocaddress, but those aren't work.
tia
l_krebz
CoDe_InSiDe
10-20-2001, 08:39 AM
Hi lungenkrebz,

I would suggest to:

Try it again and try to bypass the protection...
If you fail then:
Try it again and try to bypass the protection...
If you'll fail again then:
Try once more and try once more to bypass the protection...
Now if you still don't succeed then my suggestion is to:
Try it again and uhm etc.... :D

Cya...

CoDe_InSiDe

P.S. GetProcAddress doesn't work? hmm... maybe try to inc something to that breakpoint...? ;)
^DAEMON^
10-20-2001, 09:18 AM
me is improving telock to the maximum....

your life will get harder....
(just wait!!!)

^DAEMON^
CoDe_InSiDe
10-20-2001, 09:29 AM
Hi ^DAEMON^,

Yeah!
We shall all be waiting for it ... :D

Cya...

CoDe_InSiDe
SpeKKeL
10-20-2001, 10:09 AM
Just dumped and rebuild a notepad locked with te 0.96
Repaired iat and works.

Before dumping adjust the anti dumping at memory 400086
in 05 00.
I dumped from the entry point (jmp eip) and hiewed later back to
push ebp ,mov ebp,esp..(pedump didn,t work i thought..)
After this repair iat with your favourit !! iat repair tool !

btw. set a getversion bpx and look at 4010cc (entry-point)
see that iat's(not all) are not encrypted..

SpeKKeL :p
lungenkrebz
10-20-2001, 10:44 AM
i tried again ...
but i worked on 0.95 and getprocaddress work (don't know why) after breaking in getprocaddress i breaked on virtualprotectex and code is decrypt.
but why is 0.92a more secur than 0.95?
thx
l_krebz
SpeKKeL
10-20-2001, 12:05 PM
First try finding the oep Set bpx getversion and tracex with icedump to the oep.
Then dump (read my post above)

Spek


VB6 Crackme Practice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > VB6 Crackme Practice
PDA

View Full Version : VB6 Crackme Practice

Kayaker
10-21-2001, 02:57 PM
Hi All,

Here's a VB6 crackme with 6 or more built-in serial number, nag and timer tasks. I've just started it, managed to register it and patch out one of the nags. I have no idea what VB breakpoint to use to try to get at the timers though.

I thought this might make an interesting project, there's several tasks here, including getting rid of the splash screen if possible, and I think several ways to attack the problems. It would be great if everyone could come up with a solution to one of the tasks so we could all learn how to approach these protections in VB.

Good luck and learn.

Kayaker
EtErNaL_L0ser
10-22-2001, 01:05 PM
Valid Serial is : 349-345-345-667 :) But damn it it was so easy that i couldnt learn anything ! :mad:
EtErNaL_L0ser
10-22-2001, 01:17 PM
I di more and make some patch...Couldnt defeat crackme2 though :(

ps:its a rar file so clear .zip part :)
Unregistered
10-23-2001, 07:27 AM
If you want to have more challenge, why not try Code-Lock from Dream Impression? It is VB too. :)

w*w.dreamimpression.com/code-lock.shtml

It is for those who like challenges and are not afraid of losing. *grin*

Regards
Ryan
EtErNaL_L0ser
10-23-2001, 07:53 AM
Check my nick I am a loser myself lol! Anyway I will give a shot to code-lock :)
Though and interesting protection. No luck :(
figugegl
11-02-2001, 01:48 PM
still interested in this crackme? i wrote a brief tut in german, i might translate it in english. i couldn't kill the last timer though :(

figugegl
Sphinx
11-02-2001, 02:08 PM
hi all

i`m back on the board and im going to give this crackme a try

i`ll post my findings if i have any ;)

l8er

Sphinx
nazxul0101
11-06-2001, 01:29 AM
yeah crackme #1 was pretty easy, its the #2 I am having trouble with..i don't even know where to start :(

can anyone give any advice.. i tried putting the allmighty hmemcpy break on it and hit the cancel to see if i could trace backwards.. but no luck

just need a kickstart!!! hehe

nazxul
Kayaker
11-10-2001, 01:32 AM
Hi,

I had a chance to look at the Crackme #2 tonight, the one like a regular reg box but with a disabled OK button. There's 2 options here, the code is monitoring your s/n as you input it and doing a check behind the scenes, enabling the OK button only if the s/n matches a certain check. Or the OK button is disabled to begin with during it creation.

I tried breaking on hmemcpy as you did to see if I could find some behind-the-scenes action on the s/n, but couldn't reach any suspicious code. In that case what you can do is run an API monitor on it as you select the crackme #2 from the menu and see what code is called in creating the dialog box.

VB still calls regular kernel and user functions, so you can select the 2 most useful window creation API's to monitor for controls being enabled/disabled - CreateWindowExA and ShowWindow. It's a little trickier monitoring through the VB code, but use APISpy32, select the 2 User32 API's, and then select MVSBVM60.dll as an added module. Pause the trace until just before you select the menu item for the crackme.

As soon as you've gotten an API report saved, you can use a windows class utility (like Winshow) to get the HWND's of each of the controls on the dialog box if you want to use them to reference those listed in your report.

You should get something like:

-------------------------------------------------
6601FD34: CreateWindowExA
DWORD:00000004, // extended window style
LPSTR:0000C2A2, // pointer to registered class name
LPSTR:00E9E238:"OK", // pointer to window name
DWORD:4C012000, // window style
DWORD:00000018, // horizontal position of window
DWORD:00000020, // vertical position of window
etc.

6601FD3A: CreateWindowExA = A88
---------------------------------------------------

You can see the "OK" string obviously listed in this case, A88 being returned as the Hwnd of the control.

The other API call immediately after is:

----------------------------------------------------
66036638: ShowWindow
HWND:00000A88, // handle of window
DWORD:00000005) // show state of window

6603663E: ShowWindow = 0 (MSVBVM60.DLL)
---------------------------------------------------

Let's take the last one first. The 2nd parameter, Show state of window, is 00000005h. You can use an API reference that lists the windows constants to find that this stands for SW_SHOW. If it was 00000000h it would be SW_HIDE. So obviously this API isn't causing us problems. (If you'ze all want a good API Constant utility, do a search for and d/l API-Toolshed).

So now check out CreateWindowExA. We know this is the call which creates the OK button. (VB is really weird...). The 4th parameter Window style is 4C012000. This one is a little harder to parse out the contributions to each window style possible from that flag value without some guesswork. Luckily there is an identical Enabled control we can use to compare with, the Cancel button.

Look a little further down the APISpy32 trace and the next CreateWindowExA call creates the Cancel button.
CreateWindowExA (DWORD:00000004, LPSTR:0000C2A2, LPSTR:00E9E318:"Cancel", DWORD:44012000...

The 4th parameter window style flags for this one is:
44012000
Compare it to the Disabled control - 4C012000
and the difference is 08000000h

Back to checking API Toolshed, and you find:
Const WS_DISABLED = &H8000000

So there's the answer, the OK button is being set Disabled during its creation by that one flag.

Now you can set a

BPX CreateWindowExA do "dd esp+10"

as you select from the menu, and break when you see the disabled 4th parameter 4C012000h displayed. If you change it to 44012000 the OK button will be enabled when you return to the crackme (runtime only). Then you can treat it as a regular reg box and use 'bpx __vbaStrCmp' to find the ironic p-code s/n ;-)

Hope this helps,

Kayaker
nazxul0101
11-12-2001, 07:18 AM
Thanks a bunch kayaker, that really did help..ALOT. I knew there was an API spying prog out there, just have no clue how to find it..ill look around though

I think i tried breaking on CreateWindowExA, but i had no clue where to go from there..and yes I even tried to figure out off the top of my head what numbers were being pushed onto the stack before the CreateWindowExA API was called, but didnt know where to find out what the numbers meant.. api toolshed? interesting I will have to look for that

After tracing through everything I just gave up and went on to figuring out how to kill that nice looking splash screen at the beggining :D Which i am still working on.. I will go back to #2 as soon as I find that darn APIspy32

back to REing

nazx
meaculpa
11-20-2001, 04:46 AM
Hi All,

Could someone please sort me out:))

The first serial part is quite easy. You can get the serial with a hex editor or with Softice (strcmp, or createwindowexa) or with SC6 by looking at the click_ sections..........

The second serial with the disabled "OK" button, is tricky. Yes again you can trace it in SoftIce, until the position where you see 44012000 at esp. (Refer to the thorough post of Kayaker above).
BUT....how do we crack/patch this?

I have learned the following:
Look at the following code (from hexedit)
0000B600: 05 00 63 6D³64 4F 4B 00³04 01 02 00³4F 4B 00 04 ..cmdOK.....OK..
0000B610: 68 01 E0 01³74 04 86 01³08 00 11 02³00 13 FF FF h. .t.¶.......ïï
0000B620: 03 2B 00 00³00 03 09 00³63 6D 64 43³61 6E 63 65 .+......cmdCance
0000B630: 6C 00 04 01³06 00 43 61³6E 63 65 6C³00 04 80 07 l.....Cancel..°.
0000B640: E0 01 74 04³77 01 11 03³00 14 FF FF³03 25 00 00 .t.w.....ïï.%..

You see 2 buttons, one enabled and one disabled.
After the name of the button (cmdOK or cmdCancel) there is 5 bytes open and then the text of the button (OK or Cancel)
After the label name (text button name) there is 11 bytes and then we get .......the enable/disable flag !! It also looks like the total command is 0x26h bytes in length.
Can anyone say if these coincide with API constants or something like that. ???

But, beware! It looks like this is ONLY true if the button is disabled/greyed to start with. This can not change en enabled button to the disabled state. Anyone has more experience on this?

Now without boring all further, i would like to find out if there is a more "scientific" way in going about these disabled items??

I have one other idea, can someone say if this is stupid??
Why do we bother tracing the disabled buttons, the msvb6xxx.dll handles all these interpretations right? Why can we not patch the
dll instead? Any comments / rants / raves ??

Ciao,
.meaculpa
figugegl
11-20-2001, 08:13 AM
.meaculpa:

thanks for using my statements in your post :-)

i've been playing around for quite a while with editing resources in vb applications, mainly while reversing crackmes.

i even thought of coding a kind of resource editor. unfortunately i don't code in vb, i don't even have vb installed on my pc. so i can't emulate grayed/disabled/... buttons etc. that's why i didn't code it.

i think this would be an interesting miniproject and would like to be part of it.

figugegl
meaculpa
11-21-2001, 01:28 AM
Hi figugegl,
I hope you forgive me for _borrowing_ 2 lines from our conversations. :=)

I couldn't agree with you more. I certainly does not look like everyone has this basic matter in their skillsbase.
I think we can certainly make this a new mini-project, and several of us has small seperate nuggets of information that we could share.

It is always good to have some basic lessons, covering important aspects that relate to our ......uhmm.........hobbies.

Regards,
.meaculpa
Sarge
11-21-2001, 01:16 PM
Just FYI, some of this is available in the "Decompiler Discussion" forum.

Sarge
meaculpa
11-26-2001, 01:34 AM
Hi All,
Please refer to my update regarding this in the "Decompiler Discussion" forum.

Regards,
.MeaCulpa
Snoop
11-10-2002, 06:27 AM
Hi all, a word to say that there is another newbie in da reversing shit! Maybe i should of not got started in this world as it been doing a week that am not sleeping! :D Jne there je that cmp this ctrl-d that break there F-10 this, dump that, ?eax... wouuuuuushhhhhhh... what a world!!! But yall know what?? i looooove it.. am an experience programmer and am just realizing that no mather how much complex you can code some things, well it all end's out at the same place.. in the mov this an jmp there thing! And from there nothing is impossible (Well i think..). This is fascinating me.. (Sorry for my english).
Nof blah blah.

---> Ryan, why wont you get somebody to test you code-lock stuff and stop acting like you do over here? Man it's been doing a couple week am reading without replyng or some and my word for you is that youre unbeleavable.. And this maybe not a compliment... :rolleyes:

--> All others! I've been searching alot, in this board and elsewehere for tut's of all kind and for some crackme and example, i learned alot, but the majority of tut's and example out there are out of date... :( link not good, version change.. etc. Woodman pointed us out (newbie) for some good tut's up to date and i did them (i.e. auto ftp premium) that was nice.
Some body could point me to a good start for vb apps? dont mind if it's some crackme or soft on the market.. purpose is knowledge and that's all. I've search alot but none that i've found fullfilled (is this ok???) my need's. I do not know nothing bout vb reversing apart that i got all tools to reverse it, smartcheck and other's.
(Till then, i'me working on this vb crackme with the best of my knowledge... who is maybe not so good!!! :D )
Snoop
Kayaker
11-10-2002, 06:46 AM
Hi

I'd suggest going to the AntiCrack RCE site listed at the bottom of the page and access the Crackmes, Reversemes, Reverser course and Forum links listed at the top of the anticrack.de page. You should be able to find several VB and other crackmes and lots more information there.

Kayaker
Snoop
11-10-2002, 04:51 PM
Thank's Kayaker. I Guest that If i dont find nothing there to gain knowledge well am either stupid or blind!!! ;)

Have a nice day.

Snoop
Paul333
11-20-2002, 09:41 PM
Thanks Kayaker i really learn a lot from your posts on api stuff!!....

Theres an easier way to enable the disabled "ok" button for anyone wanting to trace from it ..Use SHOWIN..I use it all the time for disabled functions.sometimes it works sometimes it doesnt but nearly always with VB apps..im working on the same prob at the mo with another project :)

h++p://www.freebits.co.uk/download/showin.exe

paul333
sarge
11-21-2002, 04:02 PM
Another method to find the disabled button:

----------Begin COMMAND BUTTON----------
Name: cmdOK
(Offset d/h: 46592/B600)
Caption: OK
(Offset d/h: 46602/B60A)
Left: 360
Top: 480
Height: 390
Width: 1140
(Offset d/h: 46608/B610)
Enabled: False
(Offset d/h: 46617/B619)
TabIndex: 2
(Offset d/h: 46619/B61B)
Default: True
(Offset d/h: 46622/B61E)
----------End COMMANDBUTTON---------

As you can see, the enabled property is set to false in the GUI properties , and "lives" at file offset 0xB619-0xB61A. It should be easy now to hexedit that byte.

This output was created by "RACE", available at:

h??p://www.decomplier.com

Sarge


Registry question + trw2000 questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Registry question + trw2000 questions
PDA

View Full Version : Registry question + trw2000 questions

SuperCali
10-21-2001, 04:20 PM
Hello,
Is there any way to know from where (RVA) a program accesses a specific reg entry? Say for examlpe I know that at location xyz in the reg the program reads a number and if non zero is does this or that. How do I find the RVA where it reads the xyz value. Do I need to set a breakpoint on registry reads and then manually check? The probelm with that is I only have access to trw at the moment and don't know how to return to the trw to set a breakpoint after program execution. If I press ctrl+w (or was it m anyhow), as it says in the manual, the computer hangs. Thankful for any help.

// SuperCali


zip protected files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > zip protected files
PDA

View Full Version : zip protected files

Unregistered
10-21-2001, 06:05 PM
hi

I wonder if it is possible to decrypt a passwordprotected
zip file using softice???

I have tried for many ours without any luck setting different
breakpoint --- tried to patch the zip file......but no luck

I have also tried som of the zip cracker program with bruta
force attack and plaintextattack but no luck
If the password contains many and different characters I believe
it will take loooong time

If this is possible without the real password can someone please give me som hints ???

best regards

bf
Unregistered
10-21-2001, 06:26 PM
do some research before asking !!!!

google.com is your start point

watcha waiting ? google.com now
Solomon
10-21-2001, 08:14 PM
No way. Only brute-forcing. That's the answer:D

h**p://w*w.password-crackers.com/pwdcrackfaq.html
Unregistered
10-22-2001, 01:50 AM
hi

thanks for replying

Be shure I have searched a lot at google.com but find
no info on how to decrypt zip protected files without the password.

Okey Solomon the only way is bruta force!!!!!!!!!!!!!!!

Maybe I have missed some good brute force program??

best regards

bf
sv
10-22-2001, 02:54 AM
http://www.elcomsoft.com/archpr.html

The program is very fast: for ZIP, brute-force attack speed is up to five million passwords per second on modern CPUs like Pentium II
• Guaranteed decryption (usually, within the hour) of most WinZip archives (with 5+ encrypted files) is available; it works regardless the password complexity and length
• The program can work with archives containing only one encrypted file

Try it !
Unregistered
10-22-2001, 04:26 AM
thanks sv

I will try it.

regards

bf
UrgeOverKill
10-22-2001, 03:49 PM
geeze, where was this proggy a few years back !!

looks like a little gem.
mike
10-27-2001, 07:31 PM
If you know the file was made with WinZIP or NetZip and there are more than five files, my cracker will open it in about 2 hours guaranteed. See
h**p://www.accessdata.com/Product81_Overview.htm?ProductNum=81

Or you could code your own from the essay I posted on fravia in March.

Is anyone interested in coding one based on the essay? I'm prohibited from distributing my code :(

(Since I got paid for developing it, it belongs to accessdata)

Did anyone download the copy I linked to a while back? I was told it had to be taken down, but someone must have downloaded it...
mike
10-29-2001, 12:05 PM
UrgeOverkill wrote:
>Where was this program a few years ago?

I hadn't written it yet! :)

I wrote:
>Is anyone interested in coding one based on the essay? I'm
>prohibited from distributing my code :(
>
>(Since I got paid for developing it, it belongs to accessdata)

Looks like Elcomsoft did it recently! It's about time...
DakienDX
10-29-2001, 11:51 PM
Hello everybody !

The ZIP crypto algorithm may be discussed in the RCE Cryptographics. If someone needs more information about it, download any version of PKZIP for DOS (I'm not sure if it's included in other versions) and read the documentation. It's described there very well.


need help!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > need help!
PDA

View Full Version : need help!

clatter
10-21-2001, 08:02 PM
I have a real challenge to crack any help would be appreciated! Its at the following site you can down load directly if interested in this difficult one.

h**p://www.keil.com/demo/evaldl.asp?p=C51

What Ive done so far is as follows. Program is in a wise installer wrapper called wk51v612.exe but all I did was run it through winzip and I got the whole thing exposed! All the various executables and files are now visible.

Problem is how to approach it next. There is a setup.exe that you can run. You can choose eval. version but if you do you never have a menu for selection of a registration etc. If you choose full version a serial number is asked for. Then a key disk is needed.

Its funy because you can get to the executables without actually installing the program but they have all sorts of limitations unless you do the full install using the setup.exe

Do I approach this by running setup.exe and tracking down the serial number and then seeing what the key disk does or do I take another tack?

I actually have the correct serial number and a working key disk because I purchased the program but I am challenged by trying to crack it.

Any help in the general direction would by much appreciate.

Right now I am trying to find a breakpoint in the setup.exe program and then break the serial number request. I expect what will happen is that this will generate some requirement for the key disk.

This is hard one for such a newbie as me.

Any help is much appreciated!!!!!


how to modify the Vpraster pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to modify the Vpraster pro
PDA

View Full Version : how to modify the Vpraster pro

colin
10-22-2001, 12:12 AM
I already know the encryption method of Germany Vpraster pro. But I cannot modify it, I see there's a section named _TEXT_HE at VPR.DLL, how could i do it? Pls help me.


An simple name/email/serial crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > An simple name/email/serial crackme
PDA

View Full Version : An simple name/email/serial crackme

javelin
10-22-2001, 03:36 AM
This should be easy to do.

Object create keygen.
javelin
10-22-2001, 03:37 AM
here is the crackme
figugegl
11-04-2001, 08:29 PM
i keygened it. post questions here if you need help.

figugegl
iMa
11-05-2001, 09:09 AM
Hi Javelin,

Let me Give it a Try... But If I can't proced I'll ask a lot of questions... =)
nazxul0101
11-06-2001, 12:53 AM
agh! console! what do I set a breakpoint for in a console program?!

Is there a good site for learning how to code a keygen in c?

nazx
figugegl
11-06-2001, 05:32 AM
there are no useful breakpoints in the crackme, you have to unpack and look at the listing, or to trace it until you come to the right spot (hint: addr 4011C0).

figugegl
Sphinx
11-06-2001, 07:11 AM
hi all

I`m working on it but figugegl i think you are wrong about no breakpoints you can use.
i had such a crackme before and you can set a breakpoint on the input of your name and such, don`t ask me witch ones i don`t remember the exact ones sorry i`ll post it if i have them

Sphinx
figugegl
11-06-2001, 09:12 AM
there are ReadConsole and WriteConsole but they're not used in this crackme. i haven't found a useful breakpoint.

but the program is relatively small and it wasn't a big deal for me to trace to the important code.

sphinx: plz tell me if you find a useful breakpoint.

figugegl
Hoof Arted
11-06-2001, 01:41 PM
Just a tip for you guys. This prog is packed so you wont see the breakpoints used by it. Dont bother downloading the normal unpacker for this packer type though, as it cannot unpack this version. It can be done with the right tools though.

figugegl - I have the name and e-mail XOR :-) routine sorted but the final serial calculation has got me a little stumped. Is your keygen ripped or did you re-write it in something else?

Hoof;)
figugegl
11-06-2001, 07:13 PM
Hoof Arted: I've written my keygen in C (lcc win32). Mail me if you want the source code.

The final serial calculation is a little confusing...

figugegl
nazxul0101
11-08-2001, 11:41 PM
Im not giving up on this one..you said the right tools.. and you said a normal unpacker would not work (which I realized after trying) Are you talking w32dasm?

nazx
Hoof Arted
11-09-2001, 04:42 AM
Open the exe with a HEX editor or use a tool like GETYPE. Once you have identified the packer, you can find an unpacker or read some tutes on how to unpack it yourself. You will find though that the packer, in some cases, can unpack for you but in this case, will not.

Hope it helps

Hoof
npcracker
12-10-2001, 10:18 PM
:( :( :mad:

hi all,
i cant start it all. i am crying give me some hint.
nazxul0101
12-13-2001, 06:25 PM
Ok, so I figured out what was used to pack it, only problem is when I try to unpack it, it says the program version that was used to pack is obselete, and wont unpack it..

any help?

has anyone succesfully unpacked it?
Hoof Arted
12-14-2001, 02:30 PM
There are two possible things that you can do.

1) You can find a tutorial on unpacking UPX manually

2) You can use ProcDump

Hoof

PS. Obviously, option 1 will teach you the most.
Rage9
12-14-2001, 03:09 PM
could someone post on how to do it with procdump? I have read some tutorials, but i seem to be stuck, everytime i try to dump the file from memory, it keeps telling me i cant do it... any help?

-rage
Js
12-14-2001, 10:49 PM
Hiya,
I'm still having login problems with this board, I sent you an email,
let me know if you did/not get it.
regards
Rage9
12-16-2001, 12:55 AM
Thanks so much JS, makes so much sence now, working on keygen...

-rage
theCaller
12-16-2001, 12:30 PM
Hi,

last night I coded this half solution; half because I think I've reached the username, email & serial algo but the output serial seems not to be good by the program. (Invalid Serial)

I guess the solution to the problem should reside in the way the program gets the input from the user calling proc 00401000 (RVA)...
but I'm a bit :confused: (confused)
any suggestion?

thnx.
Rage9
12-18-2001, 12:19 AM
Well needless to say guys, i solved it, wooo!!! Challenging, i dont usualy do keygens.... but its late so im not going to program the keygen tonight, ill start it tommorow, im not sure if ill get it done though, probobly need to spend time debuging it like every other program i write, over and out...

-rage
Rage9
12-19-2001, 01:21 AM
Well im so damn tired and im finally done! woo! Anyways i tryed out quite a few combonations and they seemed to work, so give it a try, it should work, it does for me. Well i have to get up and go to school tomorrow, so leavea messge or somthing....

-Rage
javelin
12-19-2001, 06:12 PM
To theCaller:

i cant asmble? the asm code so i cant check what is happing :(

but if StdIn is keeping the '\n' then that is the problem

code used to read user input

void readln(char *s)
{
int i=0;
char ch;
cin >> resetiosflags(ios::skipws);
while (cin >> ch, ch!='\n') s[i++] = ch;
s[i]='\0';
}

----------------------------------

To Rage9:

Keygen works fine for me also

Nice Job

------------------------------------

To All:

please post or email me
suggestions, comments, Improvement ideas

Regards

Javelin
theCaller
12-20-2001, 07:13 AM
nice hint javelin!!!! thnx!!!

it was the damned '\n' !!!!!!

in order to assemble the file just use the BUILDC.BAT in the bin directory of the hutch's masm32 distro.

i've attached the code & console executable.
Viper
12-24-2001, 07:57 PM
is anybody else haveing a prob dl ing the file?


w32dasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > w32dasm
PDA

View Full Version : w32dasm

hax
10-22-2001, 09:07 AM
Hi can some one help me ,when i save with w32 i can't reopen
the wpj file i click on project and a box comes up saying
could not find source file ,as you can imagen its a pain ,
plus can't seem to print . i am runing w32 8.93.
i would be very gratefull for some help cheers Hax
esther
10-22-2001, 09:36 AM
Hi,
just click menu on Project and a dialogbox will ask for the file.

1)where did you saved the project file?(wpj)
2)use a wordpad open up the *.alf and print

regards
esther
10-22-2001, 10:03 AM
heya
you must open an exe or dll for disassembled first and then save it .I am not quite sure why you can't do that.
wbe
10-23-2001, 03:25 AM
The name and the directory of the file you've disassembled with w32dasm should not be changed later. Otherwise you get that message. Restore the original file name and/or the directory.
Aimless
10-23-2001, 10:08 AM
Also...

If your wdasm directory is too deep in the structure...

or, U have patched the same using the W32WinDISM patch which enables U to have the strings in unicode and comments abilities.

from programmerstools.org

...Have Phun
MH2K
10-24-2001, 04:21 PM
Where did programmerstools go? anybody know?

I thought it used to be
www.programmerstools.com

anyway.. couldn't find it

a bit too tired to search for it, maybe tomorrow

cheers, mh
?ferret
10-24-2001, 08:26 PM
Originally posted by MH2K
Where did programmerstools go? anybody know?

I thought it used to be
www.programmerstools.com

try .org ;)

or protools.cjb.net


Message left in process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Message left in process
PDA

View Full Version : Message left in process

Unregistered
10-22-2001, 10:34 AM
So I'm patching this program the other day and I noticed the name of the serialization process was called "Bozos live here".

Anybody encouter anything like this before???
Kythen
10-22-2001, 12:33 PM
It's an internal function inside user32.dll or kernel32.dll, don't remembe which off the top of my head
UrgeOverKill
10-22-2001, 03:32 PM
sure, don't you know that Bozo the clown is actually a famous cracker??
Aimless
10-23-2001, 10:10 AM
...older time app

Uses the bozos_live_here api (check ORC's tuts on what that means)

Simply put, the programmer is using Microsoft APIs to do the serial validation..

Easy to crack, though.

...Have Phun


Driverstudio2.5 timelimit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driverstudio2.5 timelimit
PDA

View Full Version : Driverstudio2.5 timelimit

Braindead
10-22-2001, 02:15 PM
Hi all,

Does anybody know how to remove the time limit for driverstudio 2.5RC1?
I mean something else then setting the system time back.
MeteO
10-25-2001, 11:38 AM
This is dissasembled code by cr0aker

DSConfig: Time-limit checking procedure:

Calling from here...

call ds:GetSystemTime
lea eax, [esp+390h+SystemTime]
test eax, eax
jnz short loc_403A68
mov eax, offset sub_405D60
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403A68: ; CODE XREF: sub_403790+2CFj

mov ax, [esp+390h+SystemTime.wDay]
cmp ax, 3
jnb short loc_403A7A
mov eax, offset sub_405BE0
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403A7A: ; CODE XREF: sub_403790+2E1j

cmp ax, 6
jnb short loc_403A87
mov eax, offset sub_405C60
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403A87: ; CODE XREF: sub_403790+2EEj

cmp ax, 9
jnb short loc_403A94
mov eax, offset sub_405CE0
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403A94: ; CODE XREF: sub_403790+2FBj

cmp ax, 0Ch
jnb short loc_403AA1
mov eax, offset sub_405D60
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403AA1: ; CODE XREF: sub_403790+308j

cmp ax, 0Fh
jnb short loc_403AAE
mov eax, offset sub_405DE0
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403AAE: ; CODE XREF: sub_403790+315j

cmp ax, 12h
jnb short loc_403ABB
mov eax, offset sub_405E60
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403ABB: ; CODE XREF: sub_403790+322j

cmp ax, 15h
jnb short loc_403AC8
mov eax, offset sub_405EE0
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403AC8: ; CODE XREF: sub_403790+32Fj

cmp ax, 18h
jnb short loc_403AD5
mov eax, offset sub_405F60
jmp short loc_403AE5

; ---------------------------------------------------------------------------

loc_403AD5: ; CODE XREF: sub_403790+33Cj

cmp ax, 1Bh
mov eax, offset sub_405FE0
jb short loc_403AE5
mov eax, offset sub_406060

loc_403AE5: ; CODE XREF: sub_403790+2D6j
; sub_403790+2E8j ...

push eax ; lpTimerFunc ; PREDEFINED PROCEDURE!!!
push 2710h ; uElapse
push 1962h ; nIDEvent
push esi ; hWnd
call ds:SetTimer
jmp short loc_403B0B

Anyway, we set timer and break in one of predefined procedure. All these
procedeures have the same format.

Calling checking procedure:

sub_405EE0 / sub_405BE0 / sub_405C60 / sub_405CE0 / sub_405D60 / sub_405DE0 /
sub_405E60 / sub_405EE0 / sub_405F60 / sub_405FE0 / sub_406060

sub esp, 20h
mov eax, [esp+20h+uIDEvent]
push esi
mov esi, [esp+24h+hWnd]
push eax ; uIDEvent
push esi ; hWnd
call ds:KillTimer
lea ecx, [esp+24h+SystemTime]
push ecx ; lpSystemTime
call ds:GetLocalTime
lea edx, [esp+24h+FileTime1]
lea eax, [esp+24h+SystemTime]
push edx ; lpFileTime
push eax ; lpSystemTime
mov [esp+2Ch+FileTime2.dwLowDateTime], 0D57AFA20h ; PREDEFINED
mov [esp+2Ch+FileTime2.dwHighDateTime], 1C15522h ; TIME LIMIT
call ds:SystemTimeToFileTime
lea ecx, [esp+24h+FileTime2]
lea edx, [esp+24h+FileTime1]
push ecx ; lpFileTime2
push edx ; lpFileTime1
call ds:CompareFileTime
test eax, eax
jl short loc_405F4A
push 0 ; lParam
push 0 ; wParam
push 10h ; Msg
push esi ; hWnd
mov dword_41DC9C, 1
call ds:PostMessageA ; TIME EXPIRED!!!

loc_405F4A: ; CODE XREF: sub_405EE0+51j

pop esi ; ALL IS OK!
add esp, 20h
retn 10h

sub_405EE0 endp
MeteO
10-25-2001, 11:39 AM
Winice95: Time-limit checking procedure:

Calling from here... :

loc_111D8: ; CODE XREF: start+1Dj

call sub_113EE ; THIS ONE!!!
jb loc_111EC ; JMP if bad date
mov si, offset aWin_com ; "win.com"
call sub_164E6

loc_111E5: ; CODE XREF: start+27j

call sub_174A9
jnb loc_111F0

loc_111EC: ; CODE XREF: start+2Dj

mov ah, 4Ch
int 21h ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
; AL = exit code

Calling this checking procedure...

sub_113EE proc near ; CODE XREF: start+2Ap

mov ah, 2Ah
int 21h ; DOS - GET CURRENT DATE
; Return: DL = day, DH = month, CX = year
; AL = day of the week (0=Sunday, 1=Monday, etc.)
cmp cx, 2001 ; YEAR
jnz loc_1140F
cmp dh, 9 ; MONTH
jbe loc_11418
cmp dh, 10 ; MONTH
ja loc_1140F
cmp dl, 15 ; DAY
jb loc_11418

loc_1140F: ; CODE XREF: sub_113EE+8j
; sub_113EE+16j

mov ah, 9
mov dx, offset aThisVersionOfW ; "This version of WINICE.EXE is no longer"...
int 21h ; DOS - PRINT STRING
; DS:DX -> string terminated by "$"
stc
retn

; ---------------------------------------------------------------------------

loc_11418: ; CODE XREF: sub_113EE+Fj
; sub_113EE+1Dj
clc
retn

sub_113EE endp
SuckerX
10-28-2001, 06:19 AM
Hi,

Using NT. Where is this timecheck located?
MeteO
10-28-2001, 03:40 PM
See subroutine at .init.14730e(hex offset 13730e) - this sub must return zero.


Crackz Page
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Crackz Page
PDA

View Full Version : Crackz Page

henryz
10-22-2001, 08:09 PM
Anyone know if he's packed it in for good? Or is there a new page (other than the shield.or.jp page)?
henryz
10-22-2001, 08:20 PM
Guess I was just being lame and lazy. Sorry.
EtErNaL_L0ser
10-23-2001, 03:45 AM
Grab Teleport Pro and pack it yourself :)


w32dasm for win 98se
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > w32dasm for win 98se
PDA

View Full Version : w32dasm for win 98se

hax
10-23-2001, 06:14 AM
I you can see on the board i have had probs with myw32dasm.
i just wonderd is there a version just for win98 se.or does
w32dasm work with all the versions of windows. cheers Hax
esther
10-23-2001, 06:57 AM
You can use it in win9xx .even winnt but the debugger doesn't works.
read your email ;)


how do i edit the asm code in trw 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how do i edit the asm code in trw 2000
PDA

View Full Version : how do i edit the asm code in trw 2000

Monkey
10-23-2001, 09:33 AM
Hi !
I'm using trw 2000 and win 98 II
When i am trying to edit the asm code for ex:
cmp eax,0de0 to cmp eax,abcd it won't work why?
Or this push 01414566 to push b1c1d1e1.
It looks like when the first is a number it's ok
but when its a letter it's not ok.
what is wrong ??? I can edit the hex code but not
the asm code.

Monkey
Aimless
10-23-2001, 10:13 AM
Try entering it as 0xb123bd00 instead of b123bd00

Or, try entering it as "b123bd00h" rather than "b123bd00" (note the -h- at the end mentioning that it is a hex number rather than a normal decimal)

...Have Phun
Monkey
10-23-2001, 03:01 PM
Thank's it works, you saved me a lot of work thank's.


How to trace/find files from WISE self-extracting installer?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to trace/find files from WISE self-extracting installer?
PDA

View Full Version : How to trace/find files from WISE self-extracting installer?

cah
10-23-2001, 11:19 AM
How to trace files from WISE self-extracting installer? That means which files are installing where, looking inside files without installing.

Any mentor's help appreciated
thanks in advance
cah...
DakienDX
10-23-2001, 11:42 AM
Hello cah !

Are you looking for a WISE unpacker or for a utility to display the contents of the WISE installing executable?
cah
10-23-2001, 10:45 PM
Hello Mr. DakienDX

I want both WISE unpacker & utility to display its contents.

Thanks in advance

Cah...
DakienDX
10-24-2001, 10:50 AM
Hello cah !

This program can unpack WISE archives made with the WISE and with the ZIP compression. It's by some german author. I've deleted some files from the archive, but they only contained the PASCAL (not Delphi) source code of the program. If you want to have it, just search for "E_WISE" in your favourite search engine.


mouse-si
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > mouse-si
PDA

View Full Version : mouse-si

JesseJames
10-23-2001, 04:26 PM
Does anyone know how to get the mouse to work good in softice....I got it to work when a used a mouse with serial connection. I´m using a wheelmouse now PS2 and it just gives flickering text...it sucks..I+ve tried other similar mouses with the same result...anyone having a solution...It will make my day

JJ
Kayaker
10-23-2001, 04:31 PM
Hi,

I think you may need to select the Intellimouse option as well as the PS2 setting when installing SI. Give it a shot anyway.

Kayaker


ad-aware&reghance2.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ad-aware&reghance2.0
PDA

View Full Version : ad-aware&reghance2.0

Unregistered
10-24-2001, 12:28 PM
Any useful tips regarding this 2 programs...
Both of them are delphi,,packed with pecompact,,and crucial dialogs are probably crypted...any help would be apreciate...thanx a lot....
Js
10-24-2001, 04:46 PM
Hiya,
Depends on what you mean by useful help, what have you tried?.
Its easily unpacked with icedump /pedump.
Unknown One
10-26-2001, 03:20 PM
Use File Scanner by SMT. It unpacks the file perfect. Use next commands:

fs -u Ad-aware.exe
fs -rn -spl Ad-aware.exe
fs -c Ad-aware.exe

After that you'll have a working unpacked file. I don't see where is the problem with unpacking because many tools including ProcDump unpacks it (needs to fix the imports RVA in PE header because the original imports are left untouched - its at rva 0e2000h). Using debugger is just waste of time.

Best regards,
Unknown One/[TMG]
nofurs
10-27-2001, 10:44 AM
original from Unkown one

>Using debugger is just waste of time.

Cracking is time assuming and even unpacking.

learn it or lose it :)
Unregistered
10-28-2001, 01:03 PM
unpacking went fine,but i think it is better to unpack with unpec.Point of good attack is still mangled somehow....
Js
10-28-2001, 02:34 PM
Hiya,
OK I admit I didn't look too close, but what are you attacking?. I only noticed an easily rmoved nag, something else?
regards


Protools?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Protools?
PDA

View Full Version : Protools?

McCodEMaN
10-24-2001, 04:32 PM
Greetings!

I've been trying to access protools website a few days now, does anyone now if it's only down temporary or if it's for good?

regards
McCodEMaN
stealthFIGHTER
10-24-2001, 04:42 PM
Hi McCodEMaN,

try here: h**p://www.exetools.com. You can find here a lot fo tools too.

sF
Unregistered
10-24-2001, 08:44 PM
thanks stealthFIGHTER

cool link!
McCodEMaN
10-25-2001, 07:18 AM
Greetings stealthFIGHTER!

Yes sure, this is an nice site too.

\\McCodEMaN
stealthFIGHTER
10-31-2001, 02:19 PM
I think the site is up again: h**p://www.programmerstools.org/
DakienDX
10-31-2001, 03:03 PM
Hello everybody !

In the good old times we had suddendischarge, but now... :) ;) :( :mad: :confused: :confused: :confused:
McCodEMaN
11-01-2001, 06:39 AM
Greetings DakienDX!

Yes I agree, it's to bad that they closed down the site, one can only hope that it's temporary!

regards
McCodEMaN


unpacking inno-setup
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking inno-setup
PDA

View Full Version : unpacking inno-setup

fizzik
10-24-2001, 11:02 PM
g'day from downunder, i am trying to crack express web pictures 1.41 from h**p://www.express-soft.com/ftp/webpics.exe . when i loaded it int w32dasm there was no code, so i assume it needs to be unpacked. i have never unpacked anything before, so i was hoping someone could point me in the right direction, maybe an unpacker for inno-setup?
cheers fizzik
Solomon
10-25-2001, 12:40 AM
hello fizzik,

I think you'd better read some manual-unpacking/PE tuts first. There are many such tuts in Fravia/tsehp's site.

This prog is packed with "ASPack + ASProtect".

1. the end of ASPack:

001B:00E175BB MOV [EBP+00442F11],EAX
001B:00E175C1 POPAD
001B:00E175C2 JNZ 00E175CC
001B:00E175C4 MOV EAX,00000001
001B:00E175C9 RET 000C
001B:00E175CC PUSH 00E11AD0 <---------------the OEP of ASProtect
001B:00E175D1 RET

2. the end of ASProtect:

001B:00E2367A POP EAX
001B:00E2367B ADD EAX,FBDE93BA
001B:00E23680 POP ESP
001B:00E23681 ADD EAX,EBX
001B:00E23683 MOV [ESP+1C],EAX
001B:00E23687 POPAD
001B:00E23688 JMP EAX <---------------------OEP of webpics

so we get OEP = 500584(RVA = 100584)

Make a full dump with LordPE at the OEP. Reconstruct the IT/IAT with RV/ImportREC. All OK.

good luck
Js
10-25-2001, 02:57 AM
Cmon Solomon,
"If u want the already unpacked exe, I can mail it to u", whats that about?, you provided enough information more for him to try it himself, you are basically offering a crack, its not what this board is about.
regards
Solomon
10-25-2001, 06:01 AM
hello Js,

Just take it easy. I don't mean to send sb. a cracked prog. ;)
I send this file in case that he may need it to compare his unpacked exe with mine to find out where is wrong. The file is too big to post as a attachment here.
Kayaker
10-25-2001, 11:46 AM
Hiya guys,

I don't really care what you email to each other privately, but I guess we should at least *try* to keep our noses reasonably clean to avoid any more ISP problems which can shut down this board.

The first step is please DO NOT use direct links to shareware sites as was done in the original post (I changed it). This could potentially be a flashing beacon saying "We're f***ing with your app" when the shareware author suddenly gets several d/l's over a few days all referred back to here.

Posting cracked exe's as attachments can't be too cool either because now the server is directly hosting material in violation of copyright infringement laws, yadda, yadda, yadda...

Besides, helping someone with *how* to approach a problem is OK, that's what this board is all about. But at least let the guy show that he's taken the information, learned from it and used it to try to solve the problem on his own before offering him a fully unpacked exe. Someone deserving this boards help *should* be a knowledge seeker, not a crack seeker, and should be quite happy with that.

regards,
Kayaker
Solomon
10-25-2001, 10:19 PM
That's OK. Sure we must follow the rules to avoid trouble;)
I'm not a newcomer of this board, so I know the rules, coz they have been emphasized so many times by the moderators and others.

BTW: In most cases "unpacked" is not the synonym of "cracked". We all know this, right?:)
Kayaker
10-25-2001, 11:23 PM
Originally posted by Solomon
T

BTW: In most cases "unpacked" is not the synonym of "cracked". We all know this, right?:)

We all know this yes ;-) Luckily that's usually just where the real fun begins, getting unpacked to work.

I'm glad everyone understands, this is just to try to protect the board so we can continue to enjoy it for a long time.

Cheers
Kayaker


Softice and XP Pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice and XP Pro
PDA

View Full Version : Softice and XP Pro

hobgoblin
10-25-2001, 07:42 AM
Greetings,
This question may have been discussed before, but I haven't been around for a while, so here it is:
Is there a way to get Softice installed on Win XP Pro? And working?
Is it fair game, or are there any spesific problems I then should be aware of?
All kinds of input are welcomed....

Regards,
hob
DGR
10-25-2001, 08:27 AM
Installed yes, working no... but now that XP is in stores I expect an update from numega soon.
UrgeOverKill
10-25-2001, 10:36 AM
am i correct to assume that the NT version of sice would work better than 98 ??
EtErNaL_L0ser
10-26-2001, 02:52 AM
Originally posted by UrgeOverKill
am i correct to assume that the NT version of sice would work better than 98 ??

You cant use holy 'bpx hmemcpy' bp in NT :)
UrgeOverKill
10-26-2001, 10:42 AM
Originally posted by EtErNaL_L0ser

You cant use holy 'bpx hmemcpy' bp in NT :)

I mean a cleaner install since that XP uses the same kernal that NT does. I would figure that there would be a patch to use the existing ntsice than to develop a *new* xpsice.
EtErNaL_L0ser
10-26-2001, 11:42 AM
We cant say the same kernel as NT. Its based on NT .But its far more developed . Or they want us to think so.lol :D
DakienDX
10-26-2001, 01:21 PM
Hello EtErNaL_L0ser !

We can say it is far more developed, but we can't guess in which direction.

Of course many things have changed, but I stay at Win98 and WinNT4. In my oppinion, they're easier to handle and to use (and I don't mean the graphical changes :eek: )
EtErNaL_L0ser
10-27-2001, 05:28 AM
Yes Win98 best for cracking but my motherboard really s** so only good os is Windows XP or LinuX :)
EtErNaL_L0ser
10-27-2001, 04:55 PM
useless? huh? newbies like it! lol
DGR
10-28-2001, 04:14 AM
Well, hmemcpy was only usefull when everything else failed (getwindowtext, getdlgitemtext etc...) but other then that not really nessecary. There are always other ways to get there.
EtErNaL_L0ser
10-28-2001, 11:41 AM
Originally posted by DGR
Well, hmemcpy was only usefull when everything else failed (getwindowtext, getdlgitemtext etc...) but other then that not really nessecary. There are always other ways to get there.

Heheh you got me there :) .Sometimes bpx getwindowtexta and getdlgitemtexta doesnt work so I use hmempcy and yes I am a so lame person that I dont read Win32 APi Reference :D
UrgeOverKill
10-30-2001, 01:24 PM
I was wondering if you could use the XP DDK from Microsoft to help install NTice on the XP os...
UrgeOverKill
10-31-2001, 11:38 AM
awwww poop!
DakienDX
10-31-2001, 02:56 PM
Hello everybody !

This doesn't sound so good. Anyway, I never thought of updating to WinXP.

Win2000 and WinME made me stay at Win98 and WinNT4. :)
UrgeOverKill
11-08-2001, 08:57 PM
jus to let yas know numega has a patch out for the beta 2 XP. drill down to the driver central area, they even have the install info too....
Unregistered
11-10-2001, 11:14 AM
does the xp beta2 ntice.sys available from numega work in the final xp pro corp?

havent xp installed but need sice to work.

thx for answer
DGR
11-10-2001, 01:19 PM
Nope, it won't work... You'll need a special update for WindowsXP final and I sure hope Numega will release it soon.
MrTiger
11-10-2001, 04:07 PM
Hey ppl,

This has been said to work. Can somebody test it please. Hmemcpy still won't work though.

would say: install the 4.05 version of SoftIce for 98 and select the windows 98 compatibility settings under the compatibility settings.

The basic settings are as follows:

If an older application gives you trouble when running Windows XP, you can set the compatibility properties manually so that the program runs in a different mode, such as Windows 95, or in a different display or resolution setting. To set the compatibility properties for a program:

Right-click the executable or the program shortcut to the executable, and then click Properties.
Select the Run this program in compatibility mode check box.
From the list, select an operating system that the program runs in comfortably.
If necessary, also change the display settings and/or resolution, or disable the Windows XP visual themes.
Run the program again when you're finished changing the settings. Adjust the compatibility settings again if the program is still not running smoothly: a program that's unhappy on Windows 2000 may flourish on Windows 98.
Unregistered
11-10-2001, 11:01 PM
The Numega update for XP beta 2 is on the URL below.

h**p://www.compuware.com/products/numega/drivercentral/resources/whistler.htm


Under Protectors Attack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Under Protectors Attack
PDA

View Full Version : Under Protectors Attack

evaluator
10-25-2001, 07:59 AM
Poor newbies are under protectors attack!
During IRISv3.60.1 unpacking I found PCGUARD and tELock much enhanced.
1. PCGUARD became untraceble with ICEDUMP's "tracex". Messagebox: "Error code: 000000"
2. PCGUARD with TRW2000 [INT41 OFF] stops my system (without any BP)
2. tElock96 now not allows breakpoints BPM, BPX. BPR yet can be...

Check guys, if this happens also on your systems.
tE!
10-25-2001, 09:17 PM
Wasn't it 'Poor software developers under crackers attack' ?
Seems times have changed. Maybe I'm too old for this buiz :]
Solomon
10-25-2001, 11:13 PM
hehe, humorous:D

Why don't try Win2K? In Win2K, privileged operations are not allowed under the context of normal users. It's not an easy task to switch from ring 3 to ring 0 unless some security vulnerabilities of M$ have been found. This will disable some nasty anti-debug tricks of the exe protectors.
evaluator
10-26-2001, 12:56 AM
Hi tE!

Yet your protection is traceble,
I can unpack telocked files without
any BP. (I mean virgin unpacking)
By the way, tE check my deprotected
tElock96.exe, all is OK? What IT size has
original file?
evaluator
10-26-2001, 01:53 AM
Hi Solomon!

1. So under w2000 you telock's anti-BPM-BPX future not works? But ICEDUMP works under w2000?
2. telock yet isn't major problem. How about PCGUARD? If you have IRIS v3.6,
check this: can you set BPM for example on 401000?

Hi again tE!

Little question:
Why you not protect your tElock.exe files with tElock? You not trust tElock!?
Will be good, if next release you will do it! (& I will submit here depro..:)
Solomon
10-26-2001, 03:58 AM
have not tried latest tELock yet. IceDump has WinNT/2K versions.

h**p://w**.eeye.com/html/Products/Iris/IrisDemo.exe

I just checked IRIS 3.6. Seems that it is packed twice. Yes I can't set BPM, but I can use BPX.

the first layer:

001B:010C526B LEA EDI,[EBP+0040AE01]
001B:010C5271 MOV ECX,0000002C
001B:010C5276 REPZ STOSB <-----------------self-destroy
001B:010C5278 STOSW
001B:010C527A JMP 010C527E
001B:010C527C INT 20 VXDJmp 2464,7F61
001B:010C527F JMP [ESP-30] <-------------------OEP of 2nd layer?

the second layer:

001B:00586283 LEA EDI,[EBP+0040AE01]
001B:00586289 MOV ECX,0000002C
001B:0058628E REPZ STOSB
001B:00586290 STOSW
001B:00586292 JMP 00586296
001B:00586294 INT 20 VXDJmp 2464,7F61
001B:00586297 JMP [ESP-30] <------------------OEP of IRIS

OEP = 47D766.
Correct ImageSize with LordPE before a full dump.
It's a bit hard to rebuild IT(don't forget to correct ImageSize first). Both RV 1.25 & ImportREC 1.3 failed. does anyone know how?
evaluator
10-27-2001, 12:08 AM
Hi, Solomon!

Iris 3.60.1 is protected with two protector: tElock & PCGUARD.
BPX you can set because tElock is not latest version.
Please, confirm iris.exe file size and crc32. My is 821760 byte, crc32=C4A33CE8.
If your is same, I will upload for you virgin RDATA section.

That addresses you wrote is not IRIS.EXE but is EEYELIC.DLL! Wich is also
protected in same way!

Also test this! Don't set any BPM (if you already set, restart PC), start
IRIS.EXE from "SYMBOL LOADER" and try /TRACEX 401000 490000.
In my case IRIS displays error messagebox. If you have same result, this means:
TRACEX engine now can't handle new PCGUARD protection.
Solomon
10-27-2001, 05:27 AM
my IRIS.exe(v3.60 build 2) is 821760 bytes, just the same as yours.Currently I have no tool to calculate the CRC. I registered in their site & d/l yesterday. The URL I wrote above is for exe, not a DLL. Or try this URL:
hx*p://xxx.eEye.com/html/Products/Iris/Download.htm?id=0529.225946.952095

I can't find a corresponding IceDump version to work with my SoftICE from DriverStudio v2.01 build 57. :( I'm using Win2K. So what I do is manually finding the OEP.:D
evaluator
10-27-2001, 06:26 AM
OK!
You have newest version. I will download it now.
For CRC32: goto http://damn.to , find and download program
"HASH CALCULATOR". Good prog.

About tElock96: you can download it from AARON's page or grab my "unpacked" one,
then protect (with anti-debuger option) for example NOTEPAD and
test if bpm-bpx allowed.
EtErNaL_L0ser
10-27-2001, 07:42 AM
You unpacking wizards....Admirations....lol
evaluator
10-27-2001, 09:37 AM
Hi Solomon!
OK!
I downloaded and unprotected IRIS.EXE
For you here I put virgin RDATA and DATA sections.
And don't forget:
NOTEPAD is GREAT!

About telock96.exe IT size. Hehe! I forget hexadecimal, not 100 but A0 is correct.
Also tE's anti-CASPR trick "unlocked"!
tE!
10-27-2001, 10:05 AM
so you leeto unpacked tElock96.exe ?
as far as i remember i packed that one with aspack 2.11.

good job, congratz!
evaluator
10-27-2001, 01:04 PM
Hi tE!
When I sad: tElock is protected with tElock?
I know it is Aspack + your 1 byte anti-Caspr
trick. Simple tell me A0 is correct IT size?

And once again!
Why you not protect your telock with self-telock?
Don't trust your SON?
In next release do it & I will deprotEto:) your
SON!
tE!
10-27-2001, 11:45 PM
--quote-------------------------------------
By the way, tE check my deprotected
tElock96.exe, all is OK?
--end----------------------------------------

your 'deprotected' telock96.exe. a bit
confusing imo, or do you call aspack
a protector ?

ah, yes. and to make 1 thing clear:

DAEMON has *nothing* to do with
all existing tElock versions. He said
he will improve it. this only means
that i gave him the tElock source
and that there might be a new pe-
protector coming up soon. but for
sure its name will not be 'tElock'.

hi DAEMON btw :)
evaluator
10-28-2001, 01:26 AM
Hi Guys!

Today I am very happy! I finished deprotecting DLL!
This is EEYELIC.DLL, which comes with newest versions of IRIS.
As IRIS.EXE this DLL also protected with two protectors: PCGUARD & tElock.
This DLL has little export table, which is moved by tElock. & I restore also
this export table. So probably 99% my deprotected one is like original.
Newbies!!! Do it! Hi CoDe_InSiDe! You, as Turbo Newbie...
Here I uploaded archive with three deprotected EEYELIC.DLL, latest DLL (yesterday DLDed)
is encrypted. Let's make competition! Also I included 1MB tutor:) Have pFun!
http://www.geocities.com/teset_dowonlad/eeyelicdll.zip
File size 348756 byte

Hi tE!

I forgot to change word. Forgive me or I will cry:)

Hi Solomon!

Have you problem with my package?
Solomon
11-05-2001, 09:09 PM
hi evaluator,

This one gave me some headache;) , so I decided to put it aside for several days. :D

Today I successfully dumped the whole IT/IAT from memory and make a working exe for IRIS 3.602

IT RVA = A18B8 (the same as your result)
IT length = 17C
dump length = 5710

Thx!

just paste the attachment to raw offset A18B8 and fix PE header.
(rename *.rar.txt to *.rar first)
Solomon
11-05-2001, 10:07 PM
The guys of eEye changed the ver to v3.603;)
evaluator
11-06-2001, 01:48 AM
Hi!
Seems, I understand PCGUARD - ICEDUMP problem!
So PCGUARD displays error messagebox if I set TRACEX range
from 400000. But if I set TRACEX range outside of EXE,
PCGUARD not detects tracer. So PGGUARD hasn't true anti-TRACEX future,
probably it is "lame" trick.

Hi Solomon!
Why you submit your dumped IT? I already submitted whole RDATA section
in my attachment! (i3602.zip)
Seems, you not read my previous replay.
More interesting is deprotecting EEYELIC.DLL! Read previous replay.
evaluator
11-10-2001, 04:05 AM
Hi!

Good news about TRW2000 and PCGUARD protection:
Since yesterday TRW2000 not crashes! (Don't know why8)
So my alert is in false. Eh, windws,windws...

Hi, tE!

I found interesting "bug" in telock98.
If section's RAW size is like this number:
0000C248 (as sets PROCDUMP)
telocked file will broken!
Then if I correct number like this:
0000C400 OR 0000B000,
telocked file will good.

So if telock will correct RAW sizes before locking, all will OK!

P.S.
If you will release new version, please self protect it,
or farser more: protect it with some your unknown-internal protector!
& when I will UNPACK-DEPROTETO it, I will very happy:)
evaluator
11-15-2001, 04:22 PM
In monday DAMN release keygen for
IRISv3.60.3 Retail!
Seems IRIS authors became very angry
and they changed download URL for demo.
SCANDAL!


how2patch "outlook express"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how2patch "outlook express"
PDA

View Full Version : how2patch "outlook express"

help
10-25-2001, 10:25 AM
wha.. i'm trying to patch outlook express in order to prevent it from replacing the '<' & '>' chars in *txt signatures.. anyone got an idea how to start?


dll/keyfile help requested
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > dll/keyfile help requested
PDA

View Full Version : dll/keyfile help requested

Scally6
10-25-2001, 12:53 PM
Could use some help with this, please. It's a save/print disabled demo which uses a dll (cerber32) for a check on its keyfile. Although there is a register dialog which asks for two codes, I couldn't figure it & so am trying to rebuild the keyfile (The codes requested are a 'pin' which is numeric & less than 16 digits and a 'key', also less than 16 characters but can be numeric/character. Theres a check for len <10h)
The key file 'sig' (no extension) in the app's directory is zero length on installation & filemon looks for a file of 1k, so I created a file 4096 bytes long.
Using createfilea, I broke into the dll AT 100051AD. It moves the contents of the sig file into memory at 794240 with the code at 100021b8.
As far as I could see the sig file is only read into memory on prog load and not re-read when you try to use the unlock screen.
I've spent the last couple of days trying to work out how it decides that the keyfile is no good but haven't got anywhere except for depleting the rainforrests with all the paper I used.
The check seems to begin at 1000158d and moves chunks of the sig file around - There's a check for the first byte in the sig file being ff but I think it's looking for a number here. Judging by what flys around the registers, I think its actually looking for 24 (18h) numbers.
I've singled stepped through this dll & into the exe as far as the point where the handle (105h)for the demo splash is loaded (69h for the clean one) many times but I just can't see where I'm going wrong.
I seem to be getting nowhere so can someone give me some pointers please?
(The app itself isn't much use to me - it only seems to do what a lot of other progs of its sort do - but I'd really like to understand how it does what it does in the dll) It can be d'l at h**p://progenysoftware.com/downloads/genelinestrial.exe (2mb)
Tia
Scally
Scally6
10-29-2001, 01:09 PM
Pretty Please? Still need some help. Another 3 hours of fruitless code following only makes me take back what I said about ff being wrong as the first in the sig file.
The prog plays with the contents regardless of which way I go. There are also some refs to 2d etc. but following several routes left me unclear as to where it wants them.
If it uses something that'll take too much time for someone with more experience to suss, them please let me know if I'm barking up the wrong tree.
Frustrated Scally


Need help on HASP EMULATION
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help on HASP EMULATION
PDA

View Full Version : Need help on HASP EMULATION

cah
10-26-2001, 01:16 AM
To,
All HASP Emulators,

I am newbie for RE. I got one hasp dump with assembly source code. I want dig more about assembly compiling to vxd.
I knew that c:\windows\system hasp95.vxd & hasp95dl.vxd are the key files for emulation. I have a doubt that which vxd work for win98. What to compile? That means hasp95.vxd or hasp95dl.vxd. What is difference between these two? How to compile asm to vxd. I am using masm6.11. Can any one send me make file for this vxd?

Any mentor’s help appreciated.

Thanks in advance
Cah…


VB start-up code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB start-up code
PDA

View Full Version : VB start-up code

riPPadoGG
10-26-2001, 03:25 AM
Hi All,
1. When load a VB program in SIce, the entry point is always a call to "ThRUNtMain" or something similar. Then when I traceon, or continue to do F12 I never jump back to the program code..
Why??How can I break into the start-up code of a VB program??
2. How does a p-code compiled program gets interpreted in the system? Any method to convert it into native code??
3.I have a 19Mb VB program which fails Win32Dasm (maybe because of the size). Can you disassemble some part of a file in Win32Dasm??
4.How can you get string references of VB programs in IDA??
regards
and TIA
riPPadoGG


Installshield script help!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Installshield script help!!!
PDA

View Full Version : Installshield script help!!!

boxx
10-26-2001, 05:29 AM
How to recompile it or postion the cmp and jmp.
Help me , with details.

Thx,.....
DakienDX
10-26-2001, 01:00 PM
Helo boxx !

As You've written, "InstallShied script help", is is a script language, no jmp, no cmp which can be patched, you can try to figure out how the script language works.

Please read also this (http://www.woodmann.net/forum/showthread.php?threadid=1846)

I can't hep you more, since I don't know what you want to do.


ida scripts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ida scripts
PDA

View Full Version : ida scripts

glopglop
10-26-2001, 02:08 PM
i'm currently playing with the enveloppe of program for learning a beat more about ida.
I've made an idc script who must mime a part of the code that scan the export section of the kernel and found the right functions by applying a signature alogorithme.
But it seems i can not access to external adress within the idc script !!
(ex my kernel is at BFF70000, and the Dword function is sending FFFF(error)

if someone knows how to bypass this behavior i will be glad to hear about it !

thanx in advance


Softice and Windows ME. -------- HELP!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice and Windows ME. -------- HELP!!!
PDA

View Full Version : Softice and Windows ME. -------- HELP!!!

Enlil
10-26-2001, 07:27 PM
I loaded up the si405w95 files and did everything I was supposed to, and when I boot up I get the message the the version (3.2) of softice that I have is outdated. What version should I have?

What would be the exact file name?
EtErNaL_L0ser
10-27-2001, 02:29 AM
Get SoftIce 4.05 from h**p://fosi.da.ru and get Win ME patch for SoftIce from h**p://protools.cjb.net check debuggers section.have phun!
Enlil
10-27-2001, 03:34 AM
I got that already and installed it.
But, it seems that the ver of SI that I have is too old.
What, and where can I get the latest version of SI.
I've tried all the FTP searches for SI and I can't seem to find a good ver that werks with this ME patch.
EtErNaL_L0ser
10-27-2001, 05:23 AM
read here

h**p://softice.tsx.org
DakienDX
10-27-2001, 12:41 PM
Hello Enlil !

You'll need the WinME DDK from Microsoft's internet site in order to install and use SoftICE on WinME.
Enlil
10-28-2001, 01:10 AM
Thanx. I'll D/L it and try it.
If I can't get it to work I may be hollerin' at you again
nazxul0101
11-05-2001, 04:40 AM
Originally posted by EtErNaL_L0ser
read here

h**p://softice.tsx.org

that site has nothing there, do you know of another place where I could get it?
zeroone
11-05-2001, 04:40 PM
Originally posted by nazxul0101

that site has nothing there, do you know of another place where I could get it?

try this
www.exetools.com
nazxul0101
11-06-2001, 12:49 AM
Originally posted by zeroone

try this
www.exetools.com

Thanks for the link man, but I just realized how retarded I was (wmldr), used that.. works just fine now..no more (wrong version)

but thanks man

i bookmarked it ;)

nazx


recognize UNICODE strings
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > recognize UNICODE strings
PDA

View Full Version : recognize UNICODE strings

hax
10-27-2001, 04:00 AM
Some one told me that there is a patch you can put with w32dasm so it reads UNICODE strings.if there is can some one tell
me where i could poss get it.if thereis'ent one.is there anymore softrware that reads UNICODE strings.please can someone help i am still learning.cheers Hax
wbe
10-27-2001, 04:25 AM
Change offsets 0x16B6C-0x16B6D to 98 F4 and you're done.

Good luck.
Unregistered
10-27-2001, 11:27 AM
Maybe it's time to switch to IDA ? Consider this solution to your endless problems with w32dasm!
Aimless
10-27-2001, 11:51 AM
* Go to www.programmerstools.org

* Go to the decompilers section. W32Dasm is right there at the top

* There are many other addins to the W32Dasm in that link

* Take the one by Harlequien

This will ensure that UNICODE facilities are present in W32Dasm

Alternatively...

* Go to www.sysinternals.com

* Download the strings.exe from the utilities section

...Have Phun


Crypkey KeyGen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Crypkey KeyGen
PDA

View Full Version : Crypkey KeyGen

peterg70
10-27-2001, 06:52 AM
Hi Guys,

Need some help

First off
Target http:\\www.rebis.com
Under Support/Security Rebis Security Manager.

Things i know so far.
Uses Crypkey and each package in the software has different master/user keys.
Version cryp95e.dll present and used.
Reblock.exe is exe used for calls. Able to trap with w32dasm and examine.

What i would like help with
I would like to use the SiteKey Generator that is supplied with the SDK for Crypkey to Create licenses for this product. If i enter the site key for the product into the SiteKey Generator it tells me it for another company.

Have worked out that each client has a companynumber and passnumber. (I Have found these - part of Ckchallenge)

What i want to do is rekey the sitekey generator for my companynum/passkey so that it will generate the codes correctly so that i can register each component as i like.

I would rather a keygen than a hack since continous upgrade/patchs will make me hack again and again. Plus multiple hacked over 18 applications each with their own codes/keys

Any help is appreciated.
peterg@freewebemai.com
peterg70
12-04-2001, 07:40 AM
Need Help with this still

Duelist if your still around Can you have a look at this


Zipped up Site
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Zipped up Site
PDA

View Full Version : Zipped up Site

peterg70
10-27-2001, 07:22 AM
Any chance of putting a zipped up copy of the whole site as is onto the front page.

I would like to download all the essays and search through them myself.

You could then do an update every quarter or what ever.

Thanks in advance
EtErNaL_L0ser
10-27-2001, 07:39 AM
Search for Teleport Pro or WebZip!
DakienDX
10-27-2001, 12:41 PM
Hello peterg70 !

Haven't you followed our bandwidth battle in the last weeks?

If we ZIP it and make it available for download, the speed of the board would decrease very much.

And who should ZIP it? tsehp sitting 24 hours a day in front of his computer and updating it? Or a CGI script which takes so much CPU time that the board is kicked again in two days?

I think people who are able to download the whole site (perhaps 10 MB, I don't know :( ) can afford reading and replying online.
peterg70
11-04-2001, 09:52 PM
Umm

I didn't mean the Forum Board I meant the Essays etc which is a separate part.

Secondly the update would only be a complete zip evey six months and could be storage on those free sites thus elimating any load on bandwidth, CPU time and any other excuse.

It would allow the site to be backed up in a zipped format elsewhere.


Is it really that tough? ;)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Is it really that tough? ;)
PDA

View Full Version : Is it really that tough? ;)

Ryan
10-27-2001, 12:42 PM
Yo all,
it's Ryan here, author of code-lock. Why don't you guys try my ocx? Is it because it is really that impossible to crack it? Or is it because it is in VB and you don't think it is worth the time to do so? Don't forget that this ocx can support any programming languages that uses ActiveX...

Com'on, give it a try and tell me what you think of it. ;)
Is it good enough to cost US$200?

Best regards
Ryan
Unregistered
10-27-2001, 12:45 PM
Damn,
forgot the URL for it. LOL
w*w.dreamimpression.com/code-lock.shtml

*grin*
enjoy!
EtErNaL_L0ser
10-27-2001, 01:20 PM
Visual Lame language lol! Its tough for a newbie like me but not for +HCU strainers!
Ryan
10-28-2001, 05:54 AM
Originally posted by EtErNaL_L0ser
Visual Lame language lol! Its tough for a newbie like me but not for +HCU strainers!

Sigh, another one thinking that a programming language is lame... The fact is, only the programmer behind any language can be lame. He can use C++/C/Java whatever to write a program, but if he is lame, anything he writes is lame. You can't blame the langauge.

Similarly, visual basic is not lame. The only lame ones are:
1) The author (if he can't write a decent program)
2) The cracker (if he can't crack it and says it is because visual basic is lame)

Regards
Ryan
tsehp
10-28-2001, 06:26 AM
I don't blame you, meaning you can advertise here for your latest protection system and urge rookie crackers to finally test freely your product, so you know what you're doing..

And I'll repeat : I don't blame you for this.

But what's the point ? ocx protection resided in vb, resides in m$ vb api's possible to reverse, even a cv debugger is now available.

The only really hard protections are the ones that you just can't even see, without any tool available.

So why don't you post some amusing crackme's based on your system on newbie's forum ? some people will take the challenge, but please stop your $ advertisements ;)
Solomon
10-28-2001, 09:56 PM
I think no one will try it until your protection gets so famous as ASProtect;)
Ryan
10-31-2001, 08:28 AM
I will take heed your advice. I will make an example out of my programs and let you guys try cracking it. *grin*
Please don't disappoint me. hehe
Ryan
11-02-2001, 06:52 AM
As promised, I have attached a little crackme for you to try... it will show you what code-lock can do. (or maybe cannot do) ;)

Crack it to your hearts contents.

Regards
Ryan
Jamran
11-06-2001, 03:03 PM
... might help if it worked.
Ryan.
11-06-2001, 09:15 PM
Well, if you have tried meddling with it, I am not surprised to see that message. LOL

If you haven't done anything to it, and just run it after setup, I would like to know what system you are using. I tried it on Win9x, WinNT and they work fine.

Regards
Ryan
Ryan
11-07-2001, 05:11 AM
Err... I think I should tell you that the program will not run if you have NuMega SoftIce loaded in memory.
Jamran
11-07-2001, 01:25 PM
I'm running Windows ME (4.90 - 3000), it happened right after install and SoftIce wasn't running...
javelin
11-07-2001, 08:34 PM
i got program.exe runing and saying registered to: Javelin Vastalia

user data:
5644D35319A77CE9B1CB12AD4CBCC9DEE9CD7764

name: Javelin Vastalia

Key:
B66090F61B6ABF468983CE4EA14729ACC12FCBD055380F988D26B7E9DCEA87047026EE6E68A6E17F5740BCFFC2D51FFEE663093D3E0939145EF744A358DCE6CBA2AB2B86AD0716FB31118C6E
Ryan.
11-07-2001, 10:16 PM
Originally posted by javelin
i got program.exe runing and saying registered to: Javelin Vastalia

user data:
5644D35319A77CE9B1CB12AD4CBCC9DEE9CD7764

name: Javelin Vastalia

Key:
B66090F61B6ABF468983CE4EA14729ACC12FCBD055380F988D26B7E9DCEA87047026EE6E68A6E17F5740BCFFC2D51FFEE663093D3E0939145EF744A358DCE6CBA2AB2B86AD0716FB31118C6E

By using the keygen provided by code-lock? :)
Ryan
11-15-2001, 08:02 AM
Com'on guys,
is this the best you can do? Use the keygen provided by myself and tell me you make it run? Anyone less lame than that?

I'm still waiting for my app to be cracked. :)

Yawn...
Kayaker
11-15-2001, 11:58 AM
Maybe no one cares?

My guess is if it was in a piece of shareware, someone would spend the time to crack it. Then want to be the one to release it. I don't think many would want to freely beta test your $200 protection so you could improve it, and *then* find it in a piece of shareware. Sad state of affairs, but that's just the way it is. VB doesn't seem to be that popular a protection target anyway as you can probably guess.

I don't think taunting people helps your case any either.

Kayaker
Ryan
11-15-2001, 07:33 PM
Originally posted by Kayaker
Maybe no one cares?

My guess is if it was in a piece of shareware, someone would spend the time to crack it. Then want to be the one to release it. I don't think many would want to freely beta test your $200 protection so you could improve it, and *then* find it in a piece of shareware. Sad state of affairs, but that's just the way it is. VB doesn't seem to be that popular a protection target anyway as you can probably guess.

I don't think taunting people helps your case any either.

Kayaker

Well, for one, I think I have enough protections in it to discourage most people... Thus, my decision to make it a demoware. If you have been following this app, you might probably know that it was freeware while I was improving it. This version 2 is going to be there for probably a long long time until I think of something even better to put in the protection. Or maybe when I learn how to code in C++ and make an ocx out of it.

My intention of making people crack it is not so that I can improve it. But to see how strong it is and whether it is worth that amount of money. I don't believe in snake oil. ;)

Regards
Ryan
Roy
12-13-2001, 09:31 PM
As said earler there is no big need to use some aditional stuff for visual basic. if you have decompiler it wont help, else it is quite easy to make such thing yourself.

VB is lame because it requires various ocx'ses, dll's they work noticeably slower and uses more memory.

And actualy what the point of that stuff? We usualy crack program that uses these protection dlls, not the dll itself.
Ryan
12-14-2001, 08:23 AM
Originally posted by Roy
And actualy what the point of that stuff? We usualy crack program that uses these protection dlls, not the dll itself.

You are missing the point of this protection. Well, try cracking the 'program' I supplied. Make it full version. Make it show that it is registered to you. Make it work without the ocx. Download it and see the list of tasks you can choose to do.

Enjoy.
Ryan
Ryan
04-12-2002, 10:00 AM
Hi all,
still no news? Really? No one bothers to try cracking it? Why? Because it is VB? What if all programs start being protected by VB?

Or is it really too difficult to crack? Maybe I should give a reward for those who crack it?

Ryan
foxthree
04-12-2002, 10:23 AM
Hi Ryan:

I was browsing the board the other day and looked at your posting(s). What my other RCE fellow members say is absolutely "true". Has anything new been done in CodeLock... Ummm, Errr.. No... I guess not. So, until something new is done and appears in a "shareware", people won't bother to crack it.

In any case, I took a look at your Codelock protection scheme. My observations are below:

(1) It is highly unreliable. Even after downloading your demo program, installing it and running it on W98, causes Page Fault in KERNEL32.dll. (NO!!!! I DID NOT HAVE SICE RUNNING ON IT!!!) So I thought I'll fix the bug ;) I load SoftICE and the usual hider ;) (i wouldn't reveal which one but you know anyways) and run it ... darnn now a new pagefault and this time in MSVBVM60.DLL. ME for a second thinks, it is your tricks !!! But can't be lol.... so reboot load SoftICE and protector, and re-run your app... COOL , it loads? WHY???

Pls.. see my continued post...
foxthree
04-12-2002, 10:30 AM
(2) Your anti-dumper is a straight rip of the demo "antidump.zip" source code. You didn't even bother to customize this one. No. of Sections FFFF eh? Did you think guys on this board don't know this one *YET*???

(3) I'm just a "learning" newbie. Even I came to know that you're using somekind of hard disk serial no to lock your proggie (with some other stuff added, it doesn't matter, tho' does it) and your user data is a SHA1/RIPEMD hash of some kind. Imagine what "experienced" reversers could do?

Finally, like Kayaker said taunting doesn't take it any where. People must get interested in your protection. Release it in some commercial high-value app and you'll see people ripping it out ...

BTW, I'll have to admit that the protection is slightly tougher "BECAUSE IT IS IN VISUAL BASIC" and SoftICE doens't jell well with VB. But just wait until the time comes my friend, and you'll notice CodeLock is "unlocked"...

Signed,
-- FoxThree

PS: I'll continue to work on this one and keep you posted so don't think I'm just making statements. Also, all my above statements are about the "protection" and not the "person" :D
Ryan
04-12-2002, 12:20 PM
(1) It is highly unreliable. Even after downloading your demo program, installing it and running it on W98, causes Page Fault in KERNEL32.dll. (NO!!!! I DID NOT HAVE SICE RUNNING ON IT!!!) So I thought I'll fix the bug I load SoftICE and the usual hider (i wouldn't reveal which one but you know anyways) and run it ... darnn now a new pagefault and this time in MSVBVM60.DLL. ME for a second thinks, it is your tricks !!! But can't be lol.... so reboot load SoftICE and protector, and re-run your app... COOL , it loads? WHY???

Interesting. I have to admit that I don't know why. ;)
Maybe you have to restart the computer after installing it to correctly register the ocx? :) Does it crash anymore after you restarted Windows?

(2) Your anti-dumper is a straight rip of the demo "antidump.zip" source code. You didn't even bother to customize this one. No. of Sections FFFF eh? Did you think guys on this board don't know this one *YET*???

I didn't code that antidump stuff stuff. My code-lock used to be packed with upx, then I came across tELock and I used it instead. Well, I don't think the protection of code-lock lies in tELock... Just think of it as the first layer to the whole maze... :) There is no point in hiding which packer I use. Note: I use the word packer and not protector. ;)

(3) I'm just a "learning" newbie. Even I came to know that you're using somekind of hard disk serial no to lock your proggie (with some other stuff added, it doesn't matter, tho' does it) and your user data is a SHA1/RIPEMD hash of some kind. Imagine what "experienced" reversers could do?

Deriving the Userdata is one thing. Figuring out the code for that userdata is another...

Finally, like Kayaker said taunting doesn't take it any where. People must get interested in your protection. Release it in some commercial high-value app and you'll see people ripping it out ...

I am not taunting people. I just want people to CRACK my program. Weird as it is, I would be happier if someone can crack it. LOL

PS: I'll continue to work on this one and keep you posted so don't think I'm just making statements. Also, all my above statements are about the "protection" and not the "person" :D

Cheers, I would be very happy if you can break my program. Really. Just remember that there are many layers of protection to code-lock...
nikolatesla20
04-12-2002, 03:04 PM
Well I deleted your crackme from my hard drive after I got done rebooting - I run Win2K and nope I don't have SI installed on it - your program's installer made my computer reset.

That is the thing I don't like about VB. I used to program in VB all the time, and I would see wierd crap like that. Like a program not work on someone's machine for no reason at all. Sometimes you would get obscure error messages like "Error 15 an error has occured". WTH is that? So I use VB yet for quick projects, but I will say it is fairly unstable sometimes for distributables....

Also, there is a fine line sometimes between "protection" and "virus". :D

I would say the only thing you may have going for you is some reversers may not be familiar with the details of COM... but still a dll is a dll...

-nt20
Ryan
04-13-2002, 12:27 AM
Originally posted by nikolatesla20
Well I deleted your crackme from my hard drive after I got done rebooting - I run Win2K and nope I don't have SI installed on it - your program's installer made my computer reset.

-nt20

I installed and tried out the crackme on a WinXP and a Win2K machine a few weeks ago and it ran perfectly well on both of them.

Sorry if the installer made your computer reset. You may want to tell Bill Gates that his VB installation wizard crashes your Win2K. ;)

Ryan
Aimless
04-15-2002, 05:16 AM
I just wonder what type of precedent is this setting. Can this request mean that we can now advertise the products and use this msgboard as beta testers inc.?

The issue is not of posting a crackme, or requesting a test check of the software that you have just build. Its the way that it was done that left it feeling so...cold.

It turns out to be a war of words between programmer and cracker rather that simply finding out how tough the protection really is. A better approach would be to simply request the same and politely stand aside while crackers do the job.

I do not think that crackers are a football team who needs a blasting from the coach to get fired up. A simple "please" will go a longer way than "C'mon you wimps, crack this up your a**, ha! ha!

Approach is also important.

I am sure some kindred cracker will crack this thing for you.

Best of Luck.

...Have Phun
Lbolt99
04-18-2002, 08:19 AM
Cheers, I would be very happy if you can break my program. Really. Just remember that there are many layers of protection to code-lock...

And the purpose of cracking it would be _______ ??
Ryan
04-18-2002, 09:38 AM
Originally posted by Lbolt99

And the purpose of cracking it would be _______ ??

Be the first to crack Code-Lock? 8P
Be the first to crack a good VB protection? 8P

Ryan
Woodmann
05-04-2002, 01:12 AM
Howdy,

Perhaps you have coded the worlds first "uncrackable"
protection.

Now what?

Peace, Woodmann
Ryan
05-04-2002, 08:19 AM
Originally posted by Woodmann
Howdy,

Perhaps you have coded the worlds first "uncrackable"
protection.

Now what?

Peace, Woodmann

Hi,
if I really coded the world's first "uncrackable" protection, then it would just mean that the crackers in this forum are not good enough to crack the protection. I will have to try somewhere else to get someone to crack it.

I don't believe in "uncrackable". Maybe just very very difficult to crack...

Believe it or not, I stress again that I would be happier to see my protection cracked and to see it "uncrackable".

Till then,
Ryan

PS. foxthree... I hope you have not given up... ;)
npanic
05-09-2002, 07:24 AM
If this forum is the only place u releashed a Code-Lock protected proggy, then maybe, just maybe ur right that it's not cracked yet, but if it's spread all over cyberspace then u can be sure that it has been ripped apart,cracked,hacked, and maybe even abused in a way u don't even have the imagination to understand.

BTW, if u really r so hooked on getting ur protection cracked, then why don't u release it elsewhere. We r newbies here, just learning, and ur protection is not that exciting. I rather crack WinZip a few times more that wasting time on ur stupid VB protection.

P.S.
I don't hate u, i just don't like ur childish way to ask for help...
I'm hard but fair,,, u only got what u deserved, no more and nothing less.
Ryan
06-05-2002, 02:07 PM
Originally posted by npanic
We r newbies here, just learning, and ur protection is not that exciting. I rather crack WinZip a few times more that wasting time on ur stupid VB protection.

P.S.
I don't hate u, i just don't like ur childish way to ask for help...
I'm hard but fair,,, u only got what u deserved, no more and nothing less.

Well, for one, my protection is much more interesting than normal VB programs. Check out the anti-smartchecks if you want, although smartcheck is pretty useless in cracking my program. Just a little diversion tactic... ;)

Secondly, my protection is not stupid either. It is far more intelligent than more VB protections I see. You can crack WinZip a thousand times for all I care. But you won't learn anything much after cracking it 10 times. Maybe you are aiming to code a key generator using assemble langauge by heart...

I don't care what you say about the protection because I know you will not be able to crack it since 1) you are a newbie 2) you know next to nothing besides cracking WinZip 3) you will never progress if you just crack WinZip and call yourself a cracker.

Be leet
Ryan
Eustace
06-11-2002, 01:07 AM
@ first i didnt wanted to respond on this thread, but as continued reading ur childish replys, i just got more irritated as i was and i felt that i just must reply on this.

So so, u made the 'ultimate protection'? Hoera! And u are asking a newbie to crack it? That's lame dude. Ur asking for something that u by forhand know that we cant do it. Does that gives u satisfaction? I think that just proves that ur protection is just above the average noob-level and becoz of that, the newbies cant crack it. Or are u scared that some real cracker cracks it and therefor u ask a newbie to do it?

I suggest that u crack the program ur self and then improve the protection.
And if u are a cool guy, write a tutorial about it so that the newbies can studie it ;)

btw, why code in VB? Vb is from Micro$oft and M$ = Evil, so VB = Evil. So we can make the conclusion: Ryan = Evil, or is it Ryan = M$:confused: :p
Ryan
06-11-2002, 11:13 AM
So so, u made the 'ultimate protection'? Hoera! And u are asking a newbie to crack it? That's lame dude. Ur asking for something that u by forhand know that we cant do it. Does that gives u satisfaction? I think that just proves that ur protection is just above the average noob-level and becoz of that, the newbies cant crack it. Or are u scared that some real cracker cracks it and therefor u ask a newbie to do it?

I post it here because this is the only messagaboard with a big collection of crackers, from newbies to oldies. It does not give me satisfaction that no one can crack it at all. I repeat again that I am even more happy when someone finally crack it.

I suggest that u crack the program ur self and then improve the protection.
And if u are a cool guy, write a tutorial about it so that the newbies can studie it ;)

Unfortunately, I have limited talents. I can only code but not crack. That's why I am asking the specialists in this area.

btw, why code in VB? Vb is from Micro$oft and M$ = Evil, so VB = Evil. So we can make the conclusion: Ryan = Evil, or is it Ryan = M$:confused: :p

I take it that you are using linux? If you use any of MS's programs anywhere, anytime, then you must be evil too... an also hypocrite as well. ;)

Best regards for even bothering to reply.
Ryan
Eustace
06-11-2002, 01:26 PM
btw, why code in VB? Vb is from Micro$oft and M$ = Evil, so VB = Evil. So we can make the conclusion: Ryan = Evil, or is it Ryan = M$ :confused: :p

I take it that you are using linux? If you use any of MS's programs anywhere, anytime, then you must be evil too... an also hypocrite as well. ;)

M$'proggies ? Yeah, only to crack ;)
CrackZ
06-16-2002, 06:04 PM
Hiya,

I don't normally read this forum so forgive my late arrival to this thread ;-).

Rather than indulge in what seems to be a fairly pointless slagging match, perhaps both sides here should consider the following points :

1. To Ryan : if you want us to take your protection or stated aims seriously, take us seriously, produce a crackme or trial with a stated goal, i.e. an endpoint to be reached, better yet give us your end product protector as you might ship to a developer, since ultimately your system has to withstand internal scrutiny.

As I'm sure you are aware, the analysis that you are searching for would cost a lot of $ and might not prove very effective either, so there also has to be an incentive for someone (us?) to sit down for a day just for the hell of it tracing your code, writing code thats boring to trace is easy, writing code thats truly innovative is a different ballgame altogether, the playground pissing contest mentality just won't fly here ;-).

2. Everyone should lose the issue as to what language the protection is coded in, since its pretty much irrelevant, the stated challenge or goal is to assess how effective this product really is. All a runtime protection system buys you, is time, and well implemented encryption might buy you safety from key generators. Don't bet on it though. A very well implemented system might also save you from 'generic' attacks i.e. crack 1, crack them all.

3. Ryan : consider your attaching of a value to your product as a bad thing, asking us to attach a value might be a better idea ;-), there are bad protectors costing thousands of $ and good ones costing tens of $ (and vice-a-versa), its a very big jungle out there, consider whether your product actually brings anything really new to the market and also how it compares with those that are already out there.

I respect you for posting here, or at least for trying not to sell snake-oil. Consider also that unless you are actually prepared to 'HIRE' or incentivise some 'REAL' crackers your software might just have to find out the hard way, when it winds up in the commercial world.

My 2c and then some.....

Regards

CrackZ.
Ryan
06-17-2002, 03:27 AM
Originally posted by CrackZ
1. To Ryan : if you want us to take your protection or stated aims seriously, take us seriously, produce a crackme or trial with a stated goal, i.e. an endpoint to be reached, better yet give us your end product protector as you might ship to a developer, since ultimately your system has to withstand internal scrutiny.

I have earlier on produced a crackme that is similar in format to some of the crackmes I downloaded and has uploaded it onto this site. It is on the first page and has been download 229 times. My product has already been shipped and ready for download and use. The ocx that is in the crackme is slightly older but anyone can always download the newest and replace the old one.

As I'm sure you are aware, the analysis that you are searching for would cost a lot of $ and might not prove very effective either, so there also has to be an incentive for someone (us?) to sit down for a day just for the hell of it tracing your code, writing code thats boring to trace is easy, writing code thats truly innovative is a different ballgame altogether, the playground pissing contest mentality just won't fly here ;-).

Well, I think the code won't be too boring to trace and might be interesting... The helpfile available from the shipped package (available on my site) tells you all the functions there are in Code-Lock and I believe it would interest any crackers who are not bias against the language it is written in.

2. Everyone should lose the issue as to what language the protection is coded in, since its pretty much irrelevant, the stated challenge or goal is to assess how effective this product really is. All a runtime protection system buys you, is time, and well implemented encryption might buy you safety from key generators. Don't bet on it though. A very well implemented system might also save you from 'generic' attacks i.e. crack 1, crack them all.

Agreed thoroughly.

3. Ryan : consider your attaching of a value to your product as a bad thing, asking us to attach a value might be a better idea ;-), there are bad protectors costing thousands of $ and good ones costing tens of $ (and vice-a-versa), its a very big jungle out there, consider whether your product actually brings anything really new to the market and also how it compares with those that are already out there.

Initially, when Code-Lock was in beta stages, I posted a request to gauge how much a protection like this would cost. Well, the response is similar to the postings in this thread... "Vb = bad = lame", "I can't be bothered to crack vb" etc etc etc...

As for whether my product has brought any new ideas in protections, well, only a cracker can find that out. I can only say that I have added some pretty new stuff but am not sure if it has been used before.

I respect you for posting here, or at least for trying not to sell snake-oil. Consider also that unless you are actually prepared to 'HIRE' or incentivise some 'REAL' crackers your software might just have to find out the hard way, when it winds up in the commercial world.

I respect you for posting such a decent post unlike some of the newbies. Well, you are one of the oldies and maybe that influences your thinking. Code-Lock is already in the commercial world waiting to be cracked but I have not found anyone showing me that it has been done.

Regards
Ryan
Ryan
07-15-2002, 05:25 PM
Well,
I had to sacrifice one of my freewares for Code-Lock. Slice-n-Save is now demoware and is protected by Code-Lock. Now that there is a real program, will there be anyone cracking it? Or will I be told that it is not worth the time and effort again?

http://www.rtsoftware.org

Regards
Ryan
Kayaker
07-17-2002, 09:35 PM
Hi,

I've been trying for a few days now and I just cannot connect to your site. Home or work, any browser, with or without personal firewall. The closest I can get is with Opera, there's a small frame at the bottom of the page with a button that leads to an error message page:

Websense Enterprise
"Your Websense policy blocks this page at all times."

I'm assuming this isn't part of the protection :p , so I figured I'd let you know...

Kayaker
Woodmann
07-17-2002, 09:56 PM
Howdy,

The link works, somewhere you are picking up an internet filter.

I can email the file to you its only 1.04.
Let me know.

Peace, Woodmann
ZaiRoN
07-18-2002, 08:16 AM
Hi!

Kayaker, i had the same problem some days ago but today i have download the file without any problem.

time to inspect this code_lock....

ZaiRoN
Ryan
07-18-2002, 12:32 PM
http://www.soundcheck.hostingextreme.com/~rtsoftware/slice_n_save.zip
http://rtsoftware.digitalrice.com/slice_n_save.zip
http://rtsoftware.host.sk/slice_n_save.zip
http://www.maxi-web.net/rtsoftware/slice_n_save.zip

One of them should work... :)

Slice-n-Save Version 1.05
Last updated 18th July 2002

Regards
Many thanks
Ryan
Athlon
07-18-2002, 12:42 PM
*This is only my opinion* I think when you guys crack it (I say when cuz I know someone will) Don't tell him how wait till he has a few clients then release the tut so we can all tear apart it protection. and I'm sure everyone here knows the purpose of him doing this cuz he is to cheap to pay someone to test it for him so he wants us to find the weaknesses so he can improve on it anyway just my 2 cents and Ryan your protection will be cracked and reversered and tore apart and put back together again its happen to every protection that has come and yours is no different I aint saying it will happen right away but it will happen ;)
nikolatesla20
07-18-2002, 01:57 PM
Hey your slice n save program looks pretty cool - I mean I like the GUI and the cool graphic "When it just doesn't seem to fit".

HAHA nice function in the ocx "killFileMon" ;)

-nt20
Ryan
07-18-2002, 05:01 PM
Originally posted by nikolatesla20
Hey your slice n save program looks pretty cool - I mean I like the GUI and the cool graphic "When it just doesn't seem to fit".

HAHA nice function in the ocx "killFileMon" ;)

-nt20

Hi,
nice to see this is finally getting somewhere. ;)

Do crack it. Good luck.

Regards
Ryan

PS. If you like my programs, feel free to register privately. heehee :)
nikolatesla20
07-19-2002, 12:38 AM
damnit ryan, right now your ocx is useless. I can't create a project in VB with the demo code-lock.

The Initialize never returns true, even when I use your own demo files. I'm using vb5. Are there special requirement for this or what ?????!?? (like vb6)

Also, having a registered ocx is not good on your system - for example, I installed Slice It demo, and then installed Code-Lock demo, and both ocx's apparently registered because now I get weird error messages :p

LOL see this message came up when I clicked the "register" button lol

//webpages.charter.net/nikolatesla20/duh.jpg

tee hee

-nt20
Ryan
07-19-2002, 12:54 AM
Originally posted by nikolatesla20
damnit ryan, right now your ocx is useless. I can't create a project in VB with the demo code-lock.

The Initialize never returns true, even when I use your own demo files. I'm using vb5. Are there special requirement for this or what ?????!?? (like vb6)

-nt20

Calm down. ;)

The ocx will not be active if it is run during design time. This is because there are a few traps set and will be "dangerous". So, I deactivate it when it is in design time. Compile the project and you will get Initialize to return TRUE, else, it will be EMPTY. :) It's all said in the help file. :P

If you compile the "full version", it won't run until it has been converted to a data file and then recreated by code-lock itself. That will create the "full version" meant for your computer.

If you compile the demo, it will run then moment it is compile.

Regards and many thanks
Ryan
Feel free to ask me any questions.

Unlike what one of the crackers think, I am not so cheap that I don't want to employ someone to test out my protection. The reason why I don't want to pay is because I wouldn't know if the one I paid can find the weak areas of my protection or crack it. And I am not ashamed to say that no one had purchased or use Code-Lock yet, pushing me to convert my own freeware to become a demoware (which I hate). If Code-Lock had been paid by programmers, I wouldn't mind sharing the money with anyone who can crack it. ;)

Append:
damn. you are altering your message while I was replying to yours. heehee.

Ya, I thought of that bug after I release Slice-n-Save using Code-Lock. ;) Maybe I should release a full version to the public but include something else to active Code-Lock when the user is registered.
nikolatesla20
07-19-2002, 01:04 AM
Thanks for the reply ryan.

Actually, I had thought about that design time feature - but I still can't seem to get it to work during run time, I put in a messagebox telling me the result of the INitialize function and it always returns false even during run time (compiled)

I will look into it more later, maybe it was just a problem cause by having the multiple ocx's like I said before. I have to unregister one of them and then see what happens

but I do also have a few ideas for "cracking" it too..;) I'd give a few hints but I dont want to give anything away yet until I try my ideas.

-nt20
nikolatesla20
07-19-2002, 05:19 AM
I still cant get code-lock to initiallize, with the demos or with my own code. It doesn't seem to like vb5? hmm I have no idea. I made a "full" version, then simply made a dat file for it with the code "12345678", and then just removed one text label and recompiled it as the demo version. Both versions had references to code-lock.ocx component. I have a messagebox the displays the return value of the Initialize() call. The demo version always still returns false.

I know your slice-n-save program runs fine, but that was vb6 - I just can't get the ocx to initialize yet for some reason at all. :(
The instructions are easy to follow, but I swear it just won't work..

Even if I just try to run the demo.exe that comes with the code-lock example files, it does not run at all, it just exits.

I also unregistered the code-lock.ocx that came with slice-n-save so the computer doesn't get confused :p

-nt20
Ryan
07-19-2002, 11:48 AM
Originally posted by nikolatesla20
I still cant get code-lock to initiallize, with the demos or with my own code. It doesn't seem to like vb5? hmm I have no idea. I made a "full" version, then simply made a dat file for it with the code "12345678", and then just removed one text label and recompiled it as the demo version. Both versions had references to code-lock.ocx component. I have a messagebox the displays the return value of the Initialize() call. The demo version always still returns false.

I know your slice-n-save program runs fine, but that was vb6 - I just can't get the ocx to initialize yet for some reason at all. :(
The instructions are easy to follow, but I swear it just won't work..

Even if I just try to run the demo.exe that comes with the code-lock example files, it does not run at all, it just exits.

I also unregistered the code-lock.ocx that came with slice-n-save so the computer doesn't get confused :p

-nt20

>The demo version always still returns false.

Hi,
do you mean that the full version you did return TRUE while the demo version returns FALSE? I don't think the problem is that it is vb5 because the ocx itself is vb6.

One thing... did you at any point of time run smartcheck on the program? I am not supposed to tell you this... but if you did, the initialize will always fail. :P

Regards and many thanks
Ryan
nikolatesla20
07-19-2002, 01:49 PM
No, the full version I made also returns false - actually I'm not sure because you really cant "run" the full version once protected? I thought you had to use the demo version and then enter your code to get the watermark and then you could really use the full version.

Nope - I am not doing any type of debugging at all right now. I don't have SI running at all, I dont have smartcheck or anything like that. Of course the best way to *defeat* a protection is to gain as much knowledge about how it works as you can, so I thought I would USE code-lock and get familiar with it. But for some reason it doesn't like me :p Slice-n-save runs fine , that's why I wondered if it was a vb5 problem or something like that.

I am going to load vb6 at work today and try again and see what happens.

I'm not very knowlegeable with vb cracking yet, for example, reading vb resources and the like, but I know about ocx's and com pretty well so I do have some ideas I'd like to try, but I wish I could get an app to work first :)

-nt20
Ryan
07-19-2002, 03:57 PM
No, the full version I made also returns false - actually I'm not sure because you really cant "run" the full version once protected? I thought you had to use the demo version and then enter your code to get the watermark and then you could really use the full version.

Yup, you are right. The full version will run if you use the demo version to create it from the .dat file. BTW, there is a demo.exe in the sample.zip file... It should run without any problems...

Nope - I am not doing any type of debugging at all right now. I don't have SI running at all, I dont have smartcheck or anything like that. Of course the best way to *defeat* a protection is to gain as much knowledge about how it works as you can, so I thought I would USE code-lock and get familiar with it. But for some reason it doesn't like me :p Slice-n-save runs fine , that's why I wondered if it was a vb5 problem or something like that.

The version of code-lock from the site is a bit older than what I use in slice-n-save. But that shouldn't stop you from using it in your own project. Besides, it is a demo version, should run without any problems at all.

I'm not very knowlegeable with vb cracking yet, for example, reading vb resources and the like, but I know about ocx's and com pretty well so I do have some ideas I'd like to try, but I wish I could get an app to work first :)

Good luck. ;)

Regards
Ryan
sandworm
07-24-2002, 09:52 PM
ahhhh Dear Ryan you raised me a good laugh!!!
but ok the fucking froggy will give you some hints:

1/

still wondering why you haven't sold any code-lock??
you seem to be a clever guy, Imagine your a shareware
programmer wanting a good protection for free what do you do ?

You download the demo of code-lock and after you download a software
protected with a registered codelock ocx and thank you Ryan u've got
a code-lock for free!!!!

One solution could be to fuse the ocx with the exe with fusion but you
can only do it on your own productions, seem that u'll have to cripple
the data file creator or advertise more on the fact that registered users will
have a personnalised codelock!!

2/ well if I understand well you compress the full_version exe with zlib
and after encrypt it, then if the user register, the ocx decrypt and decompress
the full exe. This full exe is itself protected by the ocx againts other use
of it on another pcs

ok well done for the first part, didn't even try to decrypt the exe I'm just a newbie
but I'm sorry to say that U're protection is almost totally useless to protect the full
version exe:

Well I cracked your full_version demo program in less than 5 minutes. How ?
I haven't even bothered debugging you ocx, I simply wrote my own codelock ocx, responding what your app whant to hear.... it is so easy...Excepted for the the getstring (moreover when like me u haven't downloaded the full ocx ;-) ) but be sensible, I'm pretty sure no one among your future customers will use it because it's painfull and when a guy spend 200$ for a protector he wants a turn key solution. And moreover even if he is willing to add some code he will use the simplier auth method well simplier for the crackers too...

As a conclusion The getstring is your only rempart against my method so manage to automate
the process for your customers to really use it (sadly however it me refrain newbies but will be piece of cake for more experienced crackers and you beautiful work is sadly compromised, don't waste more time on useless anti-debugging tricks!!!)

Ok, I've teased you a little, hope you won't get angry, because I respect your work. Good luck and good work you seem to be smart u'll certainly find other tricks. And be careful not giving your codelock for free if you want to sell it !!!

ps: Will I receive a reward for this analysis ;-)
Athlon
07-25-2002, 01:19 AM
lol sucks for you ryan you go sandworm :D
Ryan
07-25-2002, 07:08 AM
still wondering why you haven't sold any code-lock??
you seem to be a clever guy, Imagine your a shareware
programmer wanting a good protection for free what do you do ?

You download the demo of code-lock and after you download a software protected with a registered codelock ocx and thank you Ryan u've got a code-lock for free!!!!

You are wrong there... I presume that you have not seen the full version of Code-Lock? There are some inputs that need to be fed into Code-Lock for it to work as full version. ;) Also, do you think a self-respecting, easy to trace company would dare to use a unpaid version of Code-Lock and distribute its own sharewares? ;)

One solution could be to fuse the ocx with the exe with fusion but you can only do it on your own productions, seem that u'll have to cripple the data file creator or advertise more on the fact that registered users will
have a personnalised codelock!!

They do get their persionalised version. Just that I don't declare it loudly to the public. :)

2/ well if I understand well you compress the full_version exe with zlib and after encrypt it, then if the user register, the ocx decrypt and decompress the full exe. This full exe is itself protected by the ocx againts other use of it on another pcs

ok well done for the first part, didn't even try to decrypt the exe I'm just a newbie but I'm sorry to say that U're protection is almost totally useless to protect the full
version exe

Well analysed. Yes, this is the basic function of Code-Lock.

Well I cracked your full_version demo program in less than 5 minutes. How? I haven't even bothered debugging you ocx, I simply wrote my own codelock ocx, responding what your app whant to hear.... it is so easy...Excepted for the the getstring (moreover when like me u haven't downloaded the full ocx ;-) ) but be sensible, I'm pretty sure no one among your future customers will use it because it's painfull and when a guy spend 200$ for a protector he wants a turn key solution. And moreover even if he is willing to add some code he will use the simplier auth method well simplier for the crackers too...

Well, not quite right. I have already thought of this loop hole which is why I introduced the getstring function. Well, if someone is willing to pay $200 I am sure he will use every single function there is. And will pain-stakingly do it. My own app (Slice-n-Save) is FULL of such functions. ;)

As a conclusion The getstring is your only rempart against my method so manage to automate the process for your customers to really use it (sadly however it me refrain newbies but will be piece of cake for more experienced crackers and you beautiful work is sadly compromised, don't waste more time on useless anti-debugging tricks!!!)

It won't be a piece of cake because, they won't know which string is which for what and getstring can be used in hidden functions not seen on the controls at all. ;)
I didn't put much anti-debugging tricks in Code-Lock. If you are talking about SoftIce detection, it is due to telock and not my code. I have only a few anti-tricks which I would say is quite interesting. ;)

Ok, I've teased you a little, hope you won't get angry, because I respect your work. Good luck and good work you seem to be smart u'll certainly find other tricks. And be careful not giving your codelock for free if you want to sell it !!!

ps: Will I receive a reward for this analysis ;-)

I am not angry at all. I am very flattered someone actually thinks through the whole protection and can come up with a method rather than just watching by the side like Athlon giving useless comments. :)

But your analysis is based on the fact that you have already got a full version of the program which means that you have already paid of it and is intending to warez it out to the public. If you don't have the full version of the program you intend to release, you will never be able to figure out the getstring functions.

Keep up the good work. If you are a newbie, you will go far. I personally don't think you are a newbie.

As for reward, I am quite reluctant to do so because you only pointed out the loophole that I already know. But how can I point it out to you that I know of it before you tell me without telling you the loophole itself? ;P Well, since you are my first "decent" theoretical cracker, I promise you a US$30 payment the minute I get my first Code-Lock customer other than myself. heh. :) Now, go figure a way for me to pay you when the time comes without me knowing who you are.

Best regards,
Ryan
sandworm
07-25-2002, 09:11 AM
Was just some little jokes to tease you,

1/ I don't want any money

2/ Effectively I haven't seen you full version ocx just
some assumptions of my part to tease you. But don't trust
too much in your customers, the world is full of surprises and of
bad intentionned people.

3/ I unterstood you implemented the gettsring because of my method and it was pretty well done.

The reason why I said no one will use it is what I've seen with asprotect:

Alexey have implemented such ways of improving asprotect and it was much much painless than your method, the curstomers just had to add labels to the source code and the app would have been harder to unpack. And finally among the customers who used it ? nearly No one, people just push the protect button and don't take care of the options. that's what happen in the real world. So, automate the process so the customers will have nothing to do!!!

Finally you'r wrong thinking that your getstring will do the trick against the building of a new ocx. once I have the full version running u're dead "if it's run it can be defeated" : sooner or later u'll have to decrypt a string and here is how it will be defeated.

1/find in the exe a routine decrypting a string, the assembler equivalent of secure.getstring(i) that the only difficulty because visual basic is weird to trace and I don't want to waste my time on this but I'm sure it's far to be impossible.

Once done u're dead, the cracker will tamper this part right in memory like blackcheck first did with redirected api of safedisc

here the traduction in vb of what the cracker will do:

for i=1 to big_number

array(i)=secure.getstring(i)

next i

after the last string decrypting there will be a page fault the cracker will land back in debugger and will dump the memory zone containing the array to a file

Now he have a well structured file with all the strings decrypted
and he can emulate your getstring function very easely

Don't dream it's nearly impossible to protect a running program against piracy especially in vb not because you're a bad programmer but because vb is an high level langage and wasn't conceived to take control of what happen at a lower level where the battle take place :(

To finish you said :

But your analysis is based on the fact that you have already got a full version of the program which means that you have already paid of it and is intending to warez it out to the public. If you don't have the full version of the program you intend to release, you will never be able to figure out the getstring functions.

It's clear but if a bad intentionned guy manage by illegal(false credit card number) or legal way to have the full version of your program he will crack your prot and spread the full version on the net.

There no avantages between your codelock and the old way of doing: sending the full version with a serial to the customer once paid. You claim that your code-lock can avoid the spreading of a single version to other computers but if the full version is cracked it's wrong and your protection is useless or if not doesn't deserve to be paid 200$ because your competitors are more secure and moreover with them the customer can try a fully functionnal trial.
sandworm
07-25-2002, 09:36 AM
just forgot one thing

i've not seen how exactly the getstring is implemented so just making assumptions but i think you add a section with them at the end a the file. So, I hope that you add them encrypted if not it's even easier
nikolatesla20
07-25-2002, 02:54 PM
Actually sandworm, this is the approach I was taking. I was creating a Code-Lock.ocx emulator. I wrote my own ocx which responds with the appropriate answers :)

However, yes, the problem will be GetString. GetString, according to the documentation, takes in an integer and returns a string. What I wanted to do was create a layer in between the app and code-lock. I have successfully done this on the demo program when I compiile it (I can capture all communication between the program and code-lock), BUT it would be more difficult to do on an already compiled program. COM likes to use GUIDS everywhere. No big deal, you can compile your new emulator to be binary compatible, so the interface stays the same. BUT now you need to somehow still create the old code-lock ocx within your new ocx. Since you haven't changed the GUID you are screwed. I tried a few things, I went into regedit and changed the CLSID GUID manually, etc, but then code-lock's Class Factory fails. Really I don't know why it should but it does.

See if you created a successful layer on a precompiled app you could just capture the communication and make a table with the strings so you could emulate it. Right now the rules of COM are what stand in your way - BUT I still have a couple other ideas to try - perhaps use late binding to create code-lock object, this way you can create by name, not hardcoded GUID. The system looks up the guid in the registry. I haven't tested that yet tho.

the ideas behind this protection are good - for example , not having functions at ALL in the demo. That is the correct way to do it. And the full version is encrypted and compressed so there is no way to crack it first off unless you can decrypt it (which, by the way, could be done - look at safedisc).

I think the real answer is that if this protection were used on large commercial valuable programs, it would be defeated quickly because there would be a want to defeat it. Right now it's kinda just practice ? :D

Ultimately OCX is a dll, and everyone knows "DLL protections are dead !"
-nt20
Ryan
07-25-2002, 04:07 PM
I applaud both nikolatesla20 and Sandworm... I am impressed with you guys or gals.

And yes, the strings for GetString is encrypted. :)

And yes, I have been thinking of automating the getstring function. However, I have to admit that I have limited skills in this area and I have limited time to test it out. Programming is my second job after my hard day's of work.

I am very very happy that my little Code-Lock is getting attention from the two of you. If it was to be cracked, I would be happy that it was by either one of you. ;)

Most people will go straight to unpacking it and patch the hell out of it. But little do they know that the moment they unpack it, they land straight into my little trap and will never get a function Code-Lock. :P

Best regards and thanks
Ryan

Tonight, I will be able to sleep with a smile on my face. ;)
sandworm
07-25-2002, 05:10 PM
first to nikolatesla20:

whaouh well done man you're far better than I, I'm not enough skilled in programming in general and in ocx in particular to follow you on this path!!
But with your approach there's still a weak point: you will have to test all forms all option all buttons etc to find all the strings and with a big app you can miss some strings. for sharewares however it is a very good solution, will be very happy to see the result of your researchs keep us informed!!

Ultimately OCX is a dll, and everyone knows "DLL protections are dead !"

I completely agree!!!!!

to Ryan:

that's too much honour for a little newbie like me and in fact I havn't done a lot , my self code ocx just consist of several subs with only one or two lines of codes in each. The only problem is for getstring but as I said once a piece of code decrypting a line is found in memory it's finished. Don't want to test that because first I don't have a registered codelock ocx and secondly I am not sure to have the skills to find it I explain why :

Here is your big error Ryan you thinked most people will unpack then patch your ocx but you are wrong nobody will even try. Why ? because it's vb6 and it's very very hard to trace a vb prog because you allways shift between msvb dlls kernel.dll user32.dll and the main exe which is a succession of call to vb dlls.

On the contrary making a new ocx is dead simple and all crackers immediatly see it. You thinked it was a pure accident if me and nikolatesla20 both followed the same way ? And I think that's a reason why more experienced crackers don't even take care, they have seen that your prot rezide in an ocx and already knew how it could be bypassed.

Now if you absolutly want your last function getstring to be cracked and if nikolatesla20 fail with his approach I advice you to try to contact acid burn the specialist in vb cracking and he will quickly achieve your dying code-lock by explaining how to find theses famous locations or perhaps with another home made good trick ;)

Finally for the decryption of the full version all you need is a sha specialist try to ask to mike in his forum if he is willing to try to defeat your encryption
nikolatesla20
07-25-2002, 11:03 PM
Well, well, Code-Lock Create.exe, used to create the .dat file, is packed. No problem, I got it dumped. Found the entry point - (right below the "VB5!" string reference duh). Fixed IAT..

Hmm no crash, it just exits right away..bpx on ExitProcess, yep it runs but jumps right to exitprocess....Hey look I can use VB disassembler on it. Ok WHOA it's P-Code ! Nice. Thankx a lot ! LOL

Running it in a p-code debugger now, found an exe size check at 00417776......:D heh heh heh

-nt20
Athlon
07-25-2002, 11:48 PM
Where do my post's keep going :(
nikolatesla20
07-26-2002, 12:39 AM
YES! Code - Lock Create.exe is unpacked and running. After unpacking, address 00417791 needs to be changed to a "BranchT" instruction (reversing the jump to jump if the file size IS different), change from 1C to 1D. Now...how does this thing go about encrypting....or rather, where does it store the "program code"...(the only part we really care about)

:D

OOPs, still a little bit more to do, I see the "create" button isn't enabled now.

-nt20
Ryan
07-26-2002, 07:45 AM
Originally posted by nikolatesla20
YES! Code - Lock Create.exe is unpacked and running. After unpacking, address 00417791 needs to be changed to a "BranchT" instruction (reversing the jump to jump if the file size IS different), change from 1C to 1D. Now...how does this thing go about encrypting....or rather, where does it store the "program code"...(the only part we really care about)

:D

OOPs, still a little bit more to do, I see the "create" button isn't enabled now.

-nt20

Grin... and the traps set in...

Why not change it to a 'Branch' ie. 1E ? Then it will jump always? :)

BTW, good work.

Enjoy
Ryan
;)
sandworm
07-26-2002, 09:34 AM
good job nikolatesla20, what are the vb dissassembers
and p-code debuggers u use? I wasn't aware of these tools...
sandworm
07-26-2002, 10:44 AM
nikolatesla20,
I found one wktvdbdebug do u have a good doc explaning p-code and what the opcodes mean, seem that I have to learn a lot on this subject!!!

Abiut the traps I think Ryan use the createmutex trick of telock
quote from telock help file:

[Enable Mutex check]
This option is for software developers only(!). Normal users can't use it because it needs changes in the source code of the file being protected.

Using a named mutex object for protection purposes is rather new stuff and the first Compressor/Protector which uses it is tElock.

It's very simple: At runtime the tElock decompression/unlocking routines create a named, owned mutex in unsignalled state. Read the corresponding chapter in your WinAPI documentation to find out more.

Mutex Objects are usually used for thread synchronizations. You can directly check if such object exists using some lines of own code in your program! That means the protection itself is stored in your application's code and not in the attached decompression/unlocking routines.

You only have to add a few lines of code to achieve this. If your check fails, you can be sure that someone tried to bypass the unlocker or that he tries to run an unpacked version of your program. You decide by yourself what to do then... However, I recommend you to simply EXIT your program, maybe with some random delay. Doing harmful things to someone else's PC is not advised and will probably bring you into trouble.

If the unlocker cannot create the mutex for whatever reason (that's not if the mutex already exists, e.g. when you run 2 instances of your program), it will abort and exit. That's the only disadvantage I noticed. But don't worry, this will most likely NEVER happen.

You must enter a string(name) for your mutex object in the Editbox next to the checkbox. It has to be zero-terminated, must be 8 to 63 Characters long and must not contain any Backslashes ('\'). Make sure that this string is exactly the same as the one you will use in your program's source code for the check(s) ! Names are case dependent !

Don't worry about the mutex object after your program quits. It will be destroyed by Windows automatically. During runtime it doesn't do/harm/affect anything. So, feel free to use this feature.

Example codes for your check(s):

ASM (Borland Turbo Assembler):
-----------------------------
.DATA
mymutex db "YourMutexStringHere",0 ;same string as specified in tElock!
.CODE
call CreateMutexA, 0, 1, offset mymutex
call GetLastError
cmp eax, ERROR_ALREADY_EXISTS
jnz ExitProgram

DELPHI:
-------
CreateMutex(nil, True, 'YourMutexStringHere');
if (GetlastError() <> ERROR_ALREADY_EXISTS) then close;

C/CPP:
------
CreateMutex(NULL, TRUE, "YourMutexStringHere");
if (GetLastError() != ERROR_ALREADY_EXISTS) {
YourExitRoutinesHere;
...
}

do a bpx createmutexa and launch your unpacked app to see!
nikolatesla20
07-26-2002, 02:27 PM
Thanks sandworm, I'll look into it - I see his program does have a string reference to OpenMutexA, and it also uses ReadProcessMemory along with GetCurrentProcess. I need to figure out what the program is reading from itself.

-nt20
nikolatesla20
07-26-2002, 03:05 PM
Thanks for the mutex tip, sandworm. It is using that! It looks for a mutex named "DICLDC2". You could patch it to not care like so:

I found the program calls "OpenMutex" when you move the mouse over the label to create a file. I managed to bpx into the movement and found the call.

Patch offsett 0041691 to a BranchT from instead of BranchF. Mutex check is gone. ! :)

Or you could create a simple C program the simply creates a mutex with this name (works !) or you can do my next workaround.

If I just run the original Code-Lock Create.exe first, THEN run my unpacked version, the button is now enabled and I can create a file that works.

teLock thinks that this is such a great protection, it is NOT. I can use ProcessExplorer to see all the named mutants the program owns, and compare it with my unpacked app. Also, you could just run the original app like I did and leave it running, which gives you the mutex you need, then start the unpacked app. There are several options. :)

I've managed to successfully enter the debugger on clicking the label (it's a label, not a button).

Now time to do some P-code reading...

-nt20
nikolatesla20
07-26-2002, 04:52 PM
Just an interesting side note, teLock uses ReadProcessMemory to make sure you don't have breakpoints set up where it doesn't want you to. For example, if you put a bpx on CreateMutexA this program will not even start up. teLock sees the bpx and exits. A solution on Win2k you can bpx on CreateMutexW, which is called by CreateMutexA, or you could "bpx CreateMutexA + 1", so the bpx is on the line below the "push ebp" of createmutexa.

-nt20

P.S Mutex check is gone, read my post above. Now on to the dirty work.

I already know it takes the program code and changes it to a hex string. ALso, it uses a random number to start a sequence. Then it makes a NICE big number with a bunch of crap and you hex program code in the middle of it. I THINK this is the reg code. not sure tho.
javelin
07-26-2002, 06:50 PM
I got Code-lock Create.exe unpacked and rebuilt the iat
but i cant find the Oep :(
nikolatesla20
07-26-2002, 07:01 PM
Just open the file in WinDASM (first make sure you edit the sections so WinDasm can read them, use LordPE or PEditor)

Then look at the only string reference, "VB5!" The code line that pushes the string is the OEP. (push xxxxxxxx)

Here is an update :

0041B7EB "Processing File...."

0041B8E9 zlib!Compress
(compresses the file into an array in memory)

0041B938 AryLck
(lock the compressed array, and use kernel32!rtlMove
Memory to copy array back to original uncompressed
array)

0041B981 Creates <program name>.tmp file, with the
compressed data in it.

0041BBBC Writes some sort of number to the file (at the end)
Not sure what this is for yet

0041BBC6 "Creating data file...." This is what we want to see!

0041BC50 data file first created, it's ugly.

0041BC9B temp file is deleted.

0041BE47 name of file, as well as some extra info, is tacked
on at the beginning of the .dat file.

0041BC50 is the important call, it creates the data file with the "encrypted" data in it. The data is compressed in the temp file, and then this routine finishes it up by encrypting and making a new .dat file.

The program goes on to finish up the data file, for example, it tacks on the strings that you wanted to encrypt.

That's all I'll share for now. You can put breakpoints on these critical areas to track what the program does.

-nt20
sandworm
07-26-2002, 07:41 PM
ouch you've passed the second speed no one can stop you now!!

Unfortunatly I'm stuck at the beginning, I've rebuilded the exe it seem to work, just exit because of the size check.

But when I want to study it with wktbde it crash when I hit the run button.

Please tell me what p-code debugger you use. if it is this one, tell me what's your oep iat lengh and rva etc to see if it's a pb with my unpacked exe.

concerning the ocx, I've seen it call a mutex with the same name.
Have you ever dumped a packed ocx? I don't exactly know how to proceed
nikolatesla20
07-26-2002, 07:49 PM
Yep that's the debugger I am using, I have both win98 and win2k

I stepped into the encryption routines, ..but I'm no encryption expert.

Um, just to speed collaboration I've attached a small gift..

Hey, he wanted us to crack it, so get off my back. Group effort !

Load up the file in WTK debugger, Run it, then press GO after it loads. Now put put in a program you want to create the dat for, and a program code. Move the mouse over the create button. Press CNTRL + P to activate the debugger. Click the left mouse to click the button. Boom. You should be in the debug.

Help me oh encryption experts! :)

NOTE: This is the DATA FILE CREATOR program, not the ocx. If we can figure out the encryption method we can decrypt the dat file without the ocx :)

-nt20
sandworm
07-26-2002, 10:21 PM
hello nikolatesla20,

I know, you'r doing all the hard work but please don't get angry
if I'm not helping you, I'm still a newbie and all that is beginning to be very hard to follow for me
I never used a p-code debugger and I don't know anything about p-code:(

moreover I can't help you for the encryption I don't know anything about it too, so all I can do for the moment is follow the leader

however, I think that perhaps I've found something interesting:

I'm not sure because don't know why code-lock refuse to decompress a .dat for me even with the good serial but, "feeling the code" I wonder if Ryan doesnt simply use zlib to encrypt/decrypt his strings because in the debugger I see my string after a call to zlib and after an encrypted string :p

Am I right Ryan or is it too good to be true ?
nikolatesla20
07-26-2002, 10:46 PM
No, don't worry about it sandworm, you helped me on that mutex thing. I forgot to look up the important info like I should have.

Looks like the strings are encrypted too of course, below the zlib!compress call you can see several calls which cultimate in the encrypted string, which is then tacked on the end of the dat file.

I'm starting to get bored with this I think it's time to move on to CuteFTP secure server 1.0. They didn't even pack it, its naked as a jaybird...

-nt20
nikolatesla20
07-27-2002, 04:24 PM
That's right, I have no life. Maybe I'm slightly obsessed. I've never stepped thru p-code before, it's a nice learning experience.

Anyway, I found a couple of checks for SmartCheck right off. The first checks for <programname>.sup, which is a file SmartCheck would create. If there is a SUP file it won't run. There is also a check for "schkcore.dll" in memory. I just renamed the file it looks for.

The whole form_load event consists of setting the form's caption, and then checking several gazillion crap, using readprocessmemory. It checks to see if you have any bpx's set in "crucial" DLLS. First off, the DLL function names are just byte strings, so you can't see them just looking at the p-code, it builds them dynamically. The debugger will show them to you when the string get built , however. Here is the little loop that goes thru the array of (ReadProcessMemory) bytes, which were read from the DLL functions, and sees if there is a breakpoint. If there is, it sets a flag:

00420481: 04 FLdRfVar 0065EC94h <---- Start of loop
00420484: FC Lead1/CI4Var
00420486: 04 FLdRfVar 0065F328h
00420489: 9E Ary1LdI4 <----- Load the byte from array
0042048A: F5 LitI4: -> CCh 204
0042048F: C7 EqI4 CCh,8Bh ? <---- compare it with int3 "CC"
00420490: 1C BranchF 00420498 »
00420493: F4 LitI2_Byte: -> FFh 255 <-- int3 ? Yes, set flag
00420495: 7A ImpAdStI2
00420498: 04 FLdRfVar 0065EC94h
0042049B: FE Lead3/NextStepVar <---- go back up
004204A1: 13 ExitProcHresult

You can code a Branch right after setting the form's caption, to jump to the ExitProcHresult opcode at the end of the form procedure, and the program still runs fine, skipping all of these weird checks. BUT maybe some of them are necessary who knows. I've got p-code on the brain now!

I still can't run it in SmartCheck yet, it exits because of an invalid page fault somewhere. I'm not sure if this is a "protection" in the program, or a problem with SmartCheck not working 100% with my unpacked and rebuilt program. Either way, it still runs in the WKT debugger just fine.

-nt20
nikolatesla20
07-29-2002, 04:04 AM
For anyone that wants to run the code-lock keygen in a debugger.

NO THIS ISN"T A NEW KEYGEN for CODE-LOCK. I wish :p I'm not that good at crypto ! THIS IS the keygen that comes with the program demo.

Here is Keygen unpacked. You can run it in WKT debugger.

I still can't get SmartCheck to run either of these. Still don't know if it's a rebuilt file problem or not. "Pretty" sure I've removed all anti smartchecks...

ALso there is a check for ProcDump in code-lock create.exe, it checks for a window title, "Procdump Request" which is the title you get if you try to do a scripted dump. This is also in the Form_Load event. Theoritically, you can skip the whole form_load event and be check free.

ADDITIONAL: I was thinking about this program over the weekend and I thought, there is possibly one "weakness". When you are running a protected app, and you click "register", the code -lock register window comes up. Now, you enter your info. OK now you click "register". If you code isn't right, the register window exits pretty quick. If it's right, it takes a LOT longer, because it's decrypting the *.dat file. SOOOO, it somehow must know if the code is right BEFORE it even tries to decrypt the dat file. What I mean is, it's not just decrypting the *.dat file with the info you give it, and if you have bad info, the decyption is just junk. It DOESNT EVEN TRY to decrypt UNTIL your code is right. So I am thinking it must know what the program code is somehow. There must be a way to find that maybe by bruteforcing. Like I said there is obviously a decision being made as to whether to even bother to decrypt the dat file at all. The data that decided this has to know the correct usercode, your name, and most important, the correct reg key. The program somehow combines these and checks whether they are correct in some way before it even bothers to decrypt the dat file. I am thinking it also must know the "program code". so this must either be in the dat file (unlikely) or in the user code (also unlikely) or in the reg key (very likely).

THE IMPORTANT PART of this is that to decrypt a dat all we need is the PROGRAM CODE, which is most likely a "private key" of a public key system. We already have the keygen to generate our user code then. Once we have a full version *dat file decypted, it is simple to create a code-lock emulator remove all protection checks if desired.

-nt20
nikolatesla20
07-29-2002, 04:48 PM
Not that I plan on being able to decrypt the *.dat file AT ALL, but this is valuable info for any attempt:

The "session" key is first created by calling MSVBVM60!rtcRandomize and MSVBVM60!rtcRandomNext - this may be a weak point in the protection, perhaps VB has a weak RNG. I appears that it is then mixed with your "Program Code".

The temp file that gets created is simply the original file zlib
compressed. I sucessfully can uncompress this file to restore the
original. This means that the data fed to the encryptor is a simple zlib compressed data. For a normal executable, the header is "MZ" this is a short string obviously, but could allow room for a type of plaintext attack. The compressed bytes at the beginning of exe's for zlib from this program are always:

78, 9C

I tried a couple different programs and got the same bytes. Hey, its a start :p

I traced three different programs thru the encryption file creation
process, and the encrypted data starts at offset 17 hex in the file, after the file is completed with headers and all. Ciphertext comparisons can begin at this offset then :)

So if you knew the encryption method you could search for keys until the plaintext matched. Hey, it's only 2 bytes I know but it would be cool to try.

It is also good to know first what the length of the key may be, this may lead to a clue...this is the output from the rand generator, my "Program code" (NIKOLATESLA) and a bunch of more calcs. and string concantenations.

Stack dump is enabled and relative to ESP<-EBP.
Freeing Addrs: 0012F98Ch 0012F95Ch
FStStr -> '311AE180' <----------- rtcRandomNext
Freeing Addrs: 0012F94Ch 0012F918h 0012F908h
Freeing Addrs: 0012F98Ch 0012F95Ch
CVarStr -> '311AE180'
FStStr -> '311AE1804DE4BCFF' <---- Tack on another rtcRandomNext.
Freeing Addrs: 0012F94Ch 0012F918h 0012F908h 0012F8F8h
FStStrNoPop -> '4E494B4F4C415445534C41' <-- Hex for my name "NIKOLATESLA"
FStStrNoPop - 'F4ECE758F6337EDD927B3F1E6239A7C5722F3837'
Concat- '4E494B4F4C415445534C41' + 'F4ECE758F6337EDD927B3F1E6239A7C5722F3837'
FStStr - '4E494B4F4C415445534C41F4ECE758F6337EDD927B3F1E6239A7C5722F3837'
FStStrNoPop - '93C9978B27096B21DC0FBD9D3617D1DA'
Concat-'93C9978B27096B21DC0FBD9D3617D1DA' + '4E494B4F4C415445534C41F4ECE758F6337EDD927B3F1E6239A7C5722F3837'
FStStr - '93C9978B27096B21DC0FBD9D3617D1DA4E494B4F4C415445534C41F4ECE758F6337EDD927B3F1E6239A7C5722F3837'

Obviously, if that last string is the whole session key, I would say it would be almost impossible.

Alternatively, you could simply compress the Demo version program with zlib and use some of the bytes at the start as the plaintext. Chances are between the two programs those compressed bytes may not change all that much. In fact, I think this would probably be a very viable option.

Not sure yet on the encryption method itself tho. Sorry.

-nt20
bart
07-29-2002, 08:53 PM
cracking freeware ;), man i luv this board
evaluator
07-30-2002, 06:28 PM
Hello!

I'm can't beleave when at start this thread was not killed..

I performed search on my HDD & archives for VB6-apps and found nothing.
(:& in feature will nothing:)

As I know, thet VB is made for non-programmer people. Or I'm wrong?

Here my 3 Q:

1. Hey nikola20, why you trash on this time!? Letz do something crazy..
2. Hey, bart! Is something new on protectorz scene?

3. Hey Ryan, do you know any programming language!?
Athlon
07-30-2002, 06:38 PM
Woodmann had to see a good reason to leave it what that reason is has still got me ;)
Kayaker
07-31-2002, 12:36 AM
Being fair to people in a community messageboard?

What's this all about? Being open-minded, learning, reversing, watching someones efforts, or is it simply about attacking the ENEMY for the sake of it? Read it or don't, the thread is a valid one.

Kayaker
Ryan
07-31-2002, 01:06 AM
Originally posted by Kayaker
Being fair to people in a community messageboard?

What's this all about? Being open-minded, learning, reversing, watching someones efforts, or is it simply about attacking the ENEMY for the sake of it? Read it or don't, the thread is a valid one.

Kayaker

You have my fullest respect, Kayaker.

To Evaluator,
Yes, I know programming languages like assembly, C++ and Java. And in addition, VB. Do you? The best of all is that I know the REVERSE of all the above languages too. Do you? Why do I choose VB to program Code-Lock? 1) How many people are like you, shunting VB? (To my advantage) 2) How many people are proficient in cracking VB? (To my advantage again) 3) How many people shiver at the sight of pcode and complains about the lack of tools for pcode cracking? (To my advantage again) What's so special about assembly or C++? Yes, they can do lower level protections but how many of them cannot be bypassed? If you still don't see the point, you will never see the forest for the trees.

Regards
Ryan
Athlon
07-31-2002, 01:21 AM
Being fair to people in a community messageboard?

What's this all about? Being open-minded, learning, reversing, watching someones efforts, or is it simply about attacking the ENEMY for the sake of it? Read it or don't, the thread is a valid one.

Kayaker

The part is he is doing this for financial gain now if some actual reversers come along and released anything VB i wouldnt mind and im sure there wouldnt be as bad a replys as there was but its like he is using us for testing his software so he can improve it let me ask you this would anyone here help alexy improve asprotect?
Woodmann
07-31-2002, 01:52 AM
Easy Athlon,

We are all aware of whats going on here.

We asked Ryan to step up and he did. I would think that was obvious from the earliest posts.

Alexy is no stranger to this place. We respect him greatly:D

Peace, Woodmann
esther
07-31-2002, 01:56 AM
Hiya Ryan,Kayaker,
Just ignore evalutar,he just doesn't know how to joke :p
Athlon
07-31-2002, 02:04 AM
:D Ok,

<------------Chilled :cool:
nikolatesla20
07-31-2002, 02:52 AM
Im always willing to learn new things, that's why I was looking at this little project.

In my opinion, this protection is pretty good. You wont ever recover the full version unless you can figure out the encryption. BUT of course you get it from someone that already has it, and use a dummy code-lock.ocx to use it anywhere.

The fact that the only tool I can use is the WKT debugger DOES hamper some progress. It would be nice to get these to run in SmartCheck but oh well. Maybe I'll figure it out sometime.

I attempted to unpack the code-lock ocx, I got most of it, but I am actually tiring from this right now sorry to say, it's taking too much of my time - the biggest reason is I think the ocx is ALSO p-code and I have no way to debug it at all then. I also need to come up with a good tool to give me COM object function pointers, so I can get the function offset in the file of each function. I actually think such a tool would be useful a lot, for in the future if more COM style protections come about. It would mainly help in creating layer dlls, etc. I am going to work on that some other time tho.

I am going to move on for a while to practicing keygenning, it's a skill I need to improve upon. Code-Lock has been interesting !

-nt20
Ryan
07-31-2002, 04:56 AM
Thank you to all that has supported this little project.

As seen, one reason why I coded Code-Lock in VB and in pcode is because of what I mentioned earlier. It hampers cracking if you code it well. This is partly due to the fact that there is not a lot of tools for pcode cracking. Smartcheck and SoftIce are useless. Imaging cracking with just Win32asm and nothing else...

Instead of seeing this point, some of the crackers with narrow minds jump to the conclusion that VB stuff are useless. The only useless thing is their mind, unwilling to learn new things.

You can code low level protection stuff in Assembly etc but all can be bypass. You can add in obfuscation but to me, using VB pcode itself is obfuscation. ;P

Like I said in my first few posts, Code-Lock consist of many layers of protection. First of which is unpacking. Then there is pcode tracing and understanding how pcode works. I believe nt20 learnt a lot about pcode after Code-Lock. There is also a layer of anti-stuff that nt20 manage to detect too. Then, there is a layer of encryption, one for watermarking etc etc.

I believe that if a group of crackers come together, they will succeed in cracking Code-Lock. However, as seen in this little project, most crackers shut their mind the moment VB is mentioned. The only reason I can see if that they are no capable of cracking VB because they are too lazy to learn.

Like what CrackZ has said, one should look at the protection and not the language. I use VB because it allows me to convey my protection idea easier too and also makes it more difficult to crack.

In some cases, one might think that I am taking advantage of the crackers to test my protection without paying. But like what I said earlier, I will pay if someone can point out to me something that I miss and when I get my first customer for Code-Lock other than myself. ;)

Thanks and best regards to all
Ryan
evaluator
07-31-2002, 08:54 AM
Thanks all for replies:)

Before continue Logical fights (I love them),
maybe will good to make POLL about VB?
evaluator
07-31-2002, 04:58 PM
YU-HUU!

I catch you, Ryan, on LIE!!

Eustace asked to you:

>if u are a cool guy, write a tutorial about it
>so that the newbies can studie it

then your answer was:

>Unfortunately, I have limited talents. I can only code but not crack.
>That's why I am asking the specialists in this area.

!!!!!!

Now you wrote to me:

>Yes, I know programming languages like assembly, C++ and Java.
>And in addition, VB. Do you?
>The best of all is that I know the REVERSE of all the above languages too.

YOUR COMMENTS, pLEAsE!
sandworm
07-31-2002, 08:55 PM
waouh this thread has warmed up since my last visit ;)

Evaluator although I respect you a lot as one of the unpacking kings, I think you're not fair with nikolatesla He has done a great job till now and it was far from being useless:

I agree with Nikolatesla when he say that the protection is pretty well though. Instead of speaking and speaking to know if Ryan can use another language than vb (who cares) or if he want to use us to make money (Isn't fravia site dedicated to help shareware programmers to write better protections?) please help Nikolatesla to find a way to decrypt the archive I unfortunately don't have the skills ;)

Ryan you didn't answered me, do you use zlib to encrypt your strings or do you use a encryption algorithm of your own? If you use zlib better switch to the second option ;)
Moreover I would like to dig around that getstring function, can you make another demoprogram using the getstring function?
nikolatesla20
08-01-2002, 12:57 AM
sandworm,

I walked thru the string routines too and they are compressed and then encrypted and tacked unto the end of the *.dat file. So sadly, yes, they are encrypted too. But like I said I didn't really spend too much time in the encryption routines.

-nt20
Ryan
08-01-2002, 01:40 AM
To Evaluator:
Never look at things on surface values. I thought you should know that as a cracker... I did say I have limited talents and that I can only code and not crack. Do I mean that I can only code but can't crack Code-Lock or do I mean I can only code but not crack at all? ;) And it doesn't really matter which is which. Also, in a crackers' forum what do you think a POLL about VB will be?

To Sandworm:
-nt20 has answered your question for you. What I suggest you do is to slowly work your way up to the level of -nt20 and then later learn about encryption. Start by unpacking again. :)

Regards
Ryan
sandworm
08-01-2002, 09:52 AM
to nt20:

"I walked thru the string routines too and they are compressed and then encrypted and tacked unto the end of the *.dat file"

Yes but after the decryption+decompression of the dat file into the full version exe are they still compressed+encrypted or only compressed in the full version exe? If they are only compressed you can use zlib to decompress them :D
And if they are still encrypted+compressed perhaps the encryption algorithm is weaker on the strings than on the file if not it would take years to be print them ...
This is what I wondered, hope I explain myself good enough with my poor english.

To Ryan

Following nt20 advices I can now unpack your files too (just had problem with the oep, you thought a poor sizecheck and openmutex trick were enough to prevent unpacking?:D )

But as unpacking is usefull to try to defeat the encryption algorithm it is useless for the way I choosed to defeat the ocx

As I keep saying to you I don't want to focus on the encryption, it's the strongest part of your protection and perhaps will be impossible to crack (although for me it's not really software protection it's only a matter of encrypting a file it can be done by any programmer, the protection part what add value to code-lock is the ocx).

On the other hand the ocx is the weak part and I wanted to focus on getstring to finish the cracking but if you don't want it to be tested, after all it's your baby. I know that you prefer to see us spending a lot of time to defeat all your tricks and improve them later but if we can't choose by ourselves the way we want to crack I prefer to stop, you piss me off.
Ryan
08-01-2002, 04:24 PM
Originally posted by sandworm
to nt20:
On the other hand the ocx is the weak part and I wanted to focus on getstring to finish the cracking but if you don't want it to be tested, after all it's your baby. I know that you prefer to see us spending a lot of time to defeat all your tricks and improve them later but if we can't choose by ourselves the way we want to crack I prefer to stop, you piss me off.

Interesting... In what way did I stop you from analysing the getstring function? My baby is in your computer. Do what you wish. I thought you gave up because you didn't post anything for a while. So I thought it might be too difficult for you thus advice you to work your way up.

Regards
Ryan
sandworm
08-01-2002, 05:11 PM
my english must be really awfull, nobody understand me :(

Like as said earlier I can't test your getstring function because the example vb program you furnished with your demo code-lock don't use the getstring function !! So, that's why I asked you to write another little demo program but this one using getstring. Anyone understood ?
sandworm
08-02-2002, 11:14 PM
hello Ryan are you finally willing to give me a demo program using all the functionnalities of code-lock including the famous getstring?

nt20 :

I have time to loose this night and I though about the serial generation. Playing with Ryan's keygen, suddenltly a light as fired!! For the same informations, if you push several times generate key,you get another serial why the hell? I think I understood why:

I agree with what you say nt20, the program code must serve as a key for decryption. So as foxthree has seen SHA-1 in the code this is what I think Ryan does:

serial1= SHA-1 hash of mangle(name and user data)=>first part+SHA-1 hash of mangle(program code)=>secondpart

When you type your serial, code-lock compare the first part of your serial1 with the SHA-1 hash he has done himself with mangle( name and user data) if it's ok it decrypt the .dat with the second part of the serial.

but there's a problem: once someone as a valid serial he can make a keygen: from the second part of the serial he has the private key for decryption and by figuring how name and user data are mangled he can easily reconstruct the first part of the serial for any name/user data. Conclusion he can easily keygen it!!

So to avoid that, Ryan encrypt the serial1 with a random key (this key change each time you push on the generate serial)
to make serial2 that you see on the screen. But for code-lock to retrieve serial1 from serial2, the decryption key must be somewhere in serial2:

serial2=serial1-encrypted+decryption_key

So if I'm right, I think the best method to make a keygen for a code-lock protected app is:

1) Have a valid serial2 for this app

2) Figure out what is the method used to encrypt serial1 into serial2 and where in serial2 is the decryption key

3) Figure out how are mangled(name and user data) to construct your own first parts

YOU CAN NOW MAKE A KEYGEN FOR THE APP!!

Well this is what I thought, I can be wrong! What do you think of this analyse, hope you've understood what I meaned perhaps it's not very well explained!!!

In all case if I'm Right it's rather good news because it means that a keygen for code-lock protected program is technically feasible!!

SO PLEASE GUYS READ THIS POST AND TELL ME IF I'M DREAMING OR IF I MAY BE RIGHT
Ryan
08-03-2002, 10:42 AM
hi,
the code-lock.ocx which comes with my Slice-n-Save has that function. Why don't you use it?

Your theory about the key... Well, you have got the demo version with the keygen.exe. Try it and see. :)

Regards
Ryan
sandworm
08-03-2002, 03:44 PM
Ryan, to see slice and save use getstring I need the full version
off slice and save. I think you'r not willing to give it to me just to test the interaction with getstring, that why I proposed that you coded a demo program using getstring
nikolatesla20
08-03-2002, 04:44 PM
sandworm - the ocx that comes with the slice - n - save demo HAS the full function of getstring.

Just unregister ( "regsvr <path to old ocx> -u" ) the old ocx ( the ocx that comes with the code - lock demo), then register the ocx that comes with slice- n- save instead . YOu can either ("regsvr <path to slice-n-save ocx>) or just run slice-n-save. I see that it seems to register the ocx automagically if it sees it's not registered already.

Now use THAT ocx in your own demo, and use getstring in your demo to see how it worx.

-nt20
sandworm
08-04-2002, 03:15 PM
"Now use THAT ocx in your own demo, and use getstring in your demo to see how it worx."

well this is what I first tought but sadly it isn't that simple :)

As Ryan explained in an earlier post you need to feed the registered ocx with some values to use it or it won't work!!!
Nevertheless I tried to be sure (after unregistering the demo code-lock) and it defenitively don't work

so two solutions ryan give us the info needed to use the registered code-lock (I don't think so ) or he make himself a little demo-program using getstring. I think he understood well but don't want to do it perhaps he his afraid to see that his ocx isn't secure...

In all case I'm very bored of this attitude from Ryan and want to take somean holiday break. He will manage himself to improve his protection

congratulations for your good work nt20 you learned me a lot!!
Ryan
08-06-2002, 11:36 AM
Originally posted by sandworm
As Ryan explained in an earlier post you need to feed the registered ocx with some values to use it or it won't work!!!
Nevertheless I tried to be sure (after unregistering the demo code-lock) and it defenitively don't work

so two solutions ryan give us the info needed to use the registered code-lock (I don't think so ) or he make himself a little demo-program using getstring. I think he understood well but don't want to do it perhaps he his afraid to see that his ocx isn't secure...

There is a third solution... as a cracker, crack it and make it use getstring... :)

I am no afraid that my ocx is cracked. I will be very happy.

The reason why I don't respond sometimes...
My working hours are like this:
Monday: Work from Monday 7 am to Tuesday 3pm
Wed: Work from Wed 7 am to Thursday 3pm
Friday, Sat and Sun: Work from 7am to 7pm

Regards
Ryan


Crypto api test problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Crypto api test problems
PDA

View Full Version : Crypto api test problems

Unregistered
10-27-2001, 02:26 PM
I was trying to test the RSA keys generated by the windows crypto api.

So I generate the key pair and export them to two files.

As the private key's one is encrypted, I had a loot at the pubblic one.

It should be:
BYTE bType;
BYTE bVersion;
WORD reserved;
ALG_ID aiKeyAlg;
DWORD magic; // Has to be RSA1
DWORD bitlen; // # of bits in modulus
DWORD pubexp; // public exponent
// Modulus data follows

I find that keysize=512bits and e=65537(default value)

I looked at the modulus, it is:
54C101F2283AE773F57A3EB03CCF7DD8D61AE197FF8B8AAA632B35AFBF289F26B8DFF3E6D2105C1E5AD5629F00B5479742612C02C8AA18E4F98CAA1714C17BA

I put it in this useful utility from tmg
http://www.secretashell.com/TMG/rsatool2.zip and I found that is not the product of two prime numbers, but of many little numbers.

This is wrong.
And I cant understand where's my error.

Lookin for help...

sappox
DakienDX
10-28-2001, 01:08 AM
Hello Unregistered !

I have a quite fast computer and quite much (and fast) memory in it. I just know that RSA-256 wil take about 2 hours to decrypt and that it's impossible to decrypt RSA-512 (even with a 2GB swap file) on my computer.

I've never played with the crypto api, but it is possible that you have to reverse the number to (try to :) ) factorize it.
Unregistered
10-28-2001, 04:54 AM
ArthaXerXes
I'm not sure, as it doesn't work, but the publickeyblob structure should be the one I described, so that should be the modulus.

I don't want to factor a 512bit modulus but it results to be the product of more than 2 numbers.
how could you calculate (p-1)(q-1) if n=pqrs??????

there's something wrong but i can't understand what..

I generated another publickeyblob, this time the modulus is
B5259E051CD80678479D70FEA750910238DB0AD95AD4950772B79CBD42FDD916DB825A1716061366B46742BCD48F9B346BB0E1016D424291598E02D59DFCD9DF

This time is a 512bit one,put when I try to factor with rsatool2, it results
PRIME FACTOR: 577
PRIME FACTOR: 1FDB8DE50B
PRIME FACTOR: 10A5DD714B3E182A9E2F9D08B6B1A72DC1A15B69E44A8EB72EAB0969BB5787530052A7078C14241922F48B177A3B1D84BF97DD0D84C3AD3D0302B

Please help..

Thanks
Unregistered
10-28-2001, 11:36 AM
I didnt think at that problem.

You were right.
Many thanks.

Sappox


After unpacking aspr it doesn't run ?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > After unpacking aspr it doesn't run ?!
PDA

View Full Version : After unpacking aspr it doesn't run ?!

Nio-shai
10-27-2001, 02:46 PM
hi all

yes ASPR again...

i have unpacked a ASPR prog and after i try to run it it just live on the ststem but doesn't run ..
i have found the OEP: 48fa10 and dump it and fix the sizes and then used Revigin and ImpREC an both progs automaticly found and fixed all invalid sections ( nothing for me to do...) then fixed the dumped file and tryed to run it . all i got was a prog that live in my system but the prog doesn't shows it self it invisabled...

is there a new trick in ASPR ?? because i check at UnpackingGods and talked to CAS and he told to try the new version of CASPR v1.1000 and it gave the same resolt ...

plz help me and others to lern....
esther
10-27-2001, 11:00 PM
Hiya,
Did you change back the original codes
ebfe
to
558b
kp_
10-29-2001, 09:23 AM
I have the same problem.

I found a prog packed with aspr (fi sais it's aspr 1.2), but none of the unpackers succeed in unpacking it. So i dumped it, found the OEP, then found the import table in mem (because in this case RV failed to give the correct address). Then revirgin reconstructed and pasted it, i fixed the section characteristics, run it, and no gpf, no error msg, everything else runs like before but the unpacked prog isn't doing anything.

What's the problem? Esther, could you explain what did you wanted to say in your previous post?

Anyway, there are some strange(?) entries in the import table. Some of them have 0000 address and there are 3 imports from kernel32.dll without name, they have only ordinals (23,24,25).
I checked kernel32.dll but it doesn't contain entries with these ordinals. What are these? (some different version of kernel32.dll?)

kp
Js
10-29-2001, 05:13 PM
Hiya,
Would be better if you said what app it is causing you the problem.
kp_, "because the import table revirgin gave me from the OEP was crap", don't you think if would be more respectful to the author of this great tool if you re-phrased that to maybe "in this case RV failed to give the correct address"?. Bad attitude==no help.
regards
kp_
10-29-2001, 06:26 PM
Hi!

I didn't want to speak evil about revirgin. (and sorry for my really bad english, I can't feel the differences between the meaning of two synonymes - now I chose a bad word) I know it's great and a _really_ useful tool - that's why I use it. And I've seen several cases when it found the correct table. Now it didn't and I know I can't always expect that revirgin finds it. Sorry Tsehp if I insulted you with my prev post. I have an idea how much work you had with it and how much knowledge is behind it. I respect your work. I would be happy if I would ever be able to create such a gorgeous prog like revirgin. And sorry Js if I wrote something that made you such furious.

I regret I caused indignation with my really first post :(
Next time I'll check the dictionary before typing a word.

Bye,
kp
H3Xenoic
10-30-2001, 01:42 AM
Hi

How did you get the OEP ? are you SURE its correct ! Some aspr targets have a dummy start that sets a few variables as an anti-dump trick.

The IAT final few missing API should be traced again 'manually' in SI with a 'U xxxxxxxx' where xxxxxxxx is the memory of aspr code call given by RV. You should see what you need ;)

If you try RV with Win2K it can 'emulate' these missing API without
crash. Under Win98 'emulate' seems to fail (last 1.2 beta4)

Anyways there are LOTS of previous threads on unpacking aspr
just search ;)

H3Xenoic
kp_
10-30-2001, 07:26 AM
Hi H3Xenoic!

Thank you very much for your reply.
I used ReVirgin's tracer to get the OEP. I'm not sure if this is the _real_ OEP, maybe I was mislead by a dummy start like you mentioned. I will post a code snippet If i get home,it looks like a normal entry point for me but I can never know, I'm not that experienced (far not experienced :( )
btw how can I be sure about it? Is there any database of the code found at the entrypoints for different compilers? - I don't want to rip it out from a file info program...
Maybe it's a bad entrypoint and this misled ReVirgin when tried to get the import table from the OEP (sorry again for my first post +Tsehp and Js). I think the import table I found manually is correct and will try under win2k to trace them.
I tried to get the entrypoint as read in r!sc's tutorials (bpx GetVersion or GetModuleHandleA or GetCommandLineA), I only found a "good-looking" entrypoint with ModuleHandle but that wasn't the one. I tried tracing and found the entrypoint I mentioned but seems that one isn't good either. (maybe I should have traced further - I will try). Is the a third method? An "ultimate" method I don't know about? :)

Maybe I misunderstood you but I mentioned entries with 0000 address. I don't think U 0 will give me anything useful. I know the metod you told, but what should I do with these? (or maybe I found a fake table?) Or are they unused entries?
And ReVirgin does this too when tracing an entry isn't it? Or do I know it wrong?
And yes, ReVirgin. Is there any documentation on how it is working eg. what method it is using to get the good entries, how does it fix the missing apis, etc... I read the doc in the package and read the essays I found about it but I'm interested in this more deeply and would need some more. - If possible of course.

Well I think it's enough of questions. ;)
Thanks in advance to anyone who answers.

Bye,
kp

ps. sorry for my lameness and bad english..
H3Xenoic
10-31-2001, 01:46 AM
Hi

Here is the old splaj tut on RV v. ASPR on Awave studio 7.3. It shows a good approach.

Of course maybe the programmer included his own anti dump tricks like size check and crc etc etc.
This you have to find yourself, or name the target you have trouble with and probably the tricks are known already ;)

Note:-
Newer RV can 'emulate' those API cluster and also fix that dummy code 'ret004' with 'LockResource'.
(The original thread is still alive but any attachments from the old MB (ultrabord) are missing)
H3Xenoic
10-31-2001, 01:47 AM
attachment :-
kp_
10-31-2001, 05:41 AM
Hi H3Xenoic!

Thanks for your help again. Now I'm going to dig myself into my prog again, and hope this time i'll have luck. I don't name my target advisedly because I don't want anyone to solve this problem for me. I wouldn't learn anything from it then...

Best regards,
kp
Nio-shai
11-01-2001, 10:47 AM
tnx u guys ....

i founded that there was a function that done a check if the packer is there a simple jge to jmp and that's all....

btw : CASPR 1.1000 done the gr8 unpacking....
H3Xenoic
11-05-2001, 12:51 AM
kp_

did you rebuilt CommView 3.1 aspr target succesfully yet ?
kp_
11-05-2001, 03:21 AM
Hi H3Xenoic!

I didn't name it but you are right (3.0 btw, but I'm suprised anyway ;) ) No, I didn't succeed yet since I didn't have enough time (and because I'm lame). Did you? If yes, then please don't tell me the right OEP just say yes :)

Best regards,
kp
H3Xenoic
11-05-2001, 03:40 AM
cv 2.4/2.5/2.6/3.0/3.1 yes ;)

actually I am on the update link of all aspr protected sw from Elcom, Tamo, G-lock etc etc so immediately rebuilt the latest releases when I get news :D

I can manually make an IAT with notepad cos i know these exe so well :p

If you want help with CV3.0/3.1 I can tell you there is a size check and a CRC/HASH calculation on the code so any changes mean *crash*

If you want further *clues* then just ask.
+SplAj
11-08-2001, 01:21 AM
hi newbs

I made a draft 'arrogant bastard version' unpacking tutorial. Could someone try it and give some feed-back to me, don't be shy :o

I can then fine tune it into a 'technical reference' tutorial on aspr unpacking :D

it's attached :-
esther
11-08-2001, 06:49 AM
Originally posted by +SplAj
hi newbs

I made a draft 'arrogant bastard version' unpacking tutorial. Could someone try it and give some feed-back to me, don't be shy :o

I can then fine tune it into a 'technical reference' tutorial on aspr unpacking :D

it's attached :-

Hi SplaJ,
Your 'arrogant bastard version' unpacking tutorial is
excellent ;)especially the Last Words :D :D :D
I got a request,about the tute on Flashfxp.I did ask someone to send to me but he's more *arrognant* than you,he didn't replied my mail ;) ;).Could you upload it here please :PPPP

Thanks

best regards
ignorant esther ;)


hi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hi
PDA

View Full Version : hi

-=elgura=-
10-28-2001, 07:52 AM
yes a nice tutor indeed..

but i'm looking for a way to unpack it from sales agent.

but you gave me some good hints in your tutorial... tanks alot.

see ya
EtErNaL_L0ser
10-28-2001, 11:26 AM
Yuo want the hard way.Heheheheh +tsehp was kindly published my essay :)

http://www.woodmann.net/fravia/eternal_Aspack_211.htm
evaluator
10-29-2001, 06:29 AM
Hi -=elgura=-!

You started new thread for old problem?
If I correctly understand, you want manualy convert file FLASH*.TTY to
working file FLASH*.EXE? Or no?
-=elgura=-
10-29-2001, 03:08 PM
yes it's right.. i did. but it was a mistake, i took the wrong button.

and the thing i want is to find a way to "unpack" rsagent from the exe.

i've read some tutorials about it and i got me some ideas that i'm working on.
if you got some trick that will help me on my way.. let me know.

see ya
evaluator
10-30-2001, 01:55 AM
Hi -=elgura=-!

I have not FLASH 4, but I analyzed (only now) this Macromedia products:

1. Authorware 5.2
2. Director 8.5
3. fireworks 4
4. UltraDev 4
5. Freehand 10

All have same protection and this protection is:
FINAL PLACE OF STUPIDITY!!!

I found in 'ProgName'.TTY files little part at start of program code encrypted.
But they will be decrypted in memory when you run program!
So all you want is:
Dump process 'ProgName'.TTY, copy from dump to 'ProgName'.TTY this part of code(replace)
and rename 'ProgName'.TTY to 'ProgName'.EXE!
Now you have full version of program. Enj...
Tools needed: some memory dump-able program and some hex-editor.

***END OF SUPER TUT ABOUT REVERSING ALL MACROMEDIA PRODUCTS***

Or you want something else?


a newb ie question?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > a newb ie question?
PDA

View Full Version : a newb ie question?

EtErNaL_L0ser
10-28-2001, 02:09 PM
Anyone can enlighten us on simple XOR encyrption and other simple encryprion schemes? :confused:
Unregistered
10-29-2001, 09:20 AM
I (wrongly, maybe) guess that the Eternal Loser question deserves a deeper answer, because it seems that he/she wants to know more about general, theoretical principles, and not only about the strength of the related algorithms.
Beside, from a theoretical point of view, the XOR-based algorithms are anything but weak; on the contrary, XOR-based algorithms are theoretically inviolable. This principle was stated in 1917 by Gilbert Vernam; he demonstrated that a text ciphered by XORing with a random-generated key (the "worm") never can be deciphered, provided that the text and the key are the same size.

From a practical point of view, the system (as is, at least) is useless. Sending to the recipient two texts of the same size is equivalent to duplicating the amount of information and simply halving the risks.

So, in practice, more "handy" worms are builded up by multiplying two primes L1 & L2; in this way, the sequence will show a L1xL2 periodicity (allowing the use of the methods described by ArthaXerXes).

A practical implementation can be found inside the InstallShield Package For The Web (in versions 2.xx, at least) where the packed files are crypted (and decrypted) using a worm generated by Xoring the password and another value, then XORing the result with an hardcoded byte sequence; the second operation in order to destroy the generated periodicity
EtErNaL_L0ser
10-29-2001, 11:48 AM
Thnx but I didnt able to say what I wanted to know.Now I make it more clear :)

In some essays it says proggie xors a table for example to get the valid serial.What does this means?
DakienDX
10-29-2001, 12:00 PM
Hello EtErNaL_L0ser !

An example:

A program uses your user name as a password for a xor encryption algorithm. Then it encrypts some data (perhaps 8 times 00h or it's name) with the given password. The encrypted data is your serial number then.

If this sounds familiar to someone, ... (Armadillo :) )
EtErNaL_L0ser
10-29-2001, 01:33 PM
Now I got the idea thnx!
NikDH
11-10-2001, 09:13 AM
Originally posted by ArthaXerXes

Quantum cryptography relies on one-time-pad ciphering, and it works ! The advantage of this system is that you cannot intercept the message without modifying it, hence if Oscar intercepts the transmition between Bob and Alice, it will be discovered at once.

If it interestes i'd like to give a deeper info about this fantastic topic:

This is coz of the Heisenberg indeterministic princip
He tells there r couple of mesures (ie speed and position) 4 which
which u cant get a deeper precision of a certain value (depending on the precision of the other one) in misurating one of them

If u try to guess the exact position of an atom u'll perturbate its speed and vice-versa

Thats coz at quantistic dimension the act of observion implies the perturbation of what u'r observing coz u've to get a signal and signal implies to spend energy and energy transimts from the observer and observed modifying both their states

If oscar intercepts the msg he perturbates the states of the atoms, quantum of energy,... and he get the msg corrupted
and so alice knows thats msg has been intercepted

See ya
NikDH
Lord_Soth
11-10-2001, 07:41 PM
Quantom encryption can hardly be said to WORK.
Yeah, in theory it's unbreakable, but in reality,
it's of no use.
It can't be implemented (not yet at least, quantum mechanics hasn't evolved enough).
Besides, I'm not sure there is a sure way the
real recipient can ever read the message without
the risk of corruption as well..

I forgot the paper I read about it, but it has
many problems (so does quantum theory actually..)

LS


Need a list of Sentinel protected program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need a list of Sentinel protected program
PDA

View Full Version : Need a list of Sentinel protected program

MeteO
10-28-2001, 03:44 PM
I need a list of sentinel-protected program, also available for download (for support by my Sentinel dongle emulator).
Last work: Delcam Powermill 4.0.16
MTB
10-28-2001, 07:13 PM
FEMAP a finite element modeler version 8b. In lay persons terms, it generates the input deck ( typically nastran ). Uses a sentinel key. I also have version version 4.5, 5, 6, and 7 on CD.

http://www.sdrc.com/femap/index.shtml

Warning it is about a 50Mb down load.

Good Luck
McCodEMaN
10-28-2001, 07:44 PM
Greetings MeteO!

Well, first of all let me say that I'm not a 100% sure, but if I remembers right I think that Adobe after effects 4.0 Production Bundle for Win. uses v5.37.
You should perhaps also look closer at 3d Smax and LightWave 3D.

Regards
McCodEMaN
Unregistered
10-29-2001, 04:28 AM
Marine Navigation System
w**.transas.de/dowload/tsunamis.zip (14.7M)
EtErNaL_L0ser
10-29-2001, 05:42 AM
Borland C++ 5.0 Enterprise Edition use it too!

Beware its more than 100 mb!
Unregistered
10-29-2001, 10:10 AM
Wysiwyg 3.5E
h**p://www.wysicad.com/files/Wyg350we.exe (~40MB)
Unregistered
11-02-2001, 05:13 PM
Hi there,

Tecplot 9.0 (very(!) good graphics package by a company "Amtec") uses it.
They have a demo version for download only.
I searched hard for the real program (and I haven't found a dongle emulator yet...enter YOU !!

PS: Prog is 10 MB, sometimes found on gnutella progs or i can email to you or something.

Greetings!

O.L.

mailto: olieser@operamail.com


how to add a api call ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to add a api call ?
PDA

View Full Version : how to add a api call ?

SpeKKeL
10-28-2001, 03:52 PM
How do i manually change a call like :call [xxxxxxxxx] in exmpl. :
call getprocaddress ?
I don't mean in memory but change the exe or dll it self.
Tried with hiew but this didn't work(or i did it the wrong way..)

Greetzzz Spek
Aimless
10-28-2001, 09:20 PM
You cannot.

Not only do you have to change the call xxxx to call getprocess, you also have to change the thunks (if there are any) and the entries in the import table.

A better way would be to:

1. Get a PE modifier
2. Add sections to your PE or fill it with 0s or NOPS
3. Write your code there
4. Get your call to JUMP/CALL from there

But do take note to include the name of the API in the import table. THough, you may not REALLY need to do this as the PE probably imports the stuff. Try looking at the currently imported APIs. If your API is there then you can complete the same in the 4 steps.

...Have Phun
SpeKKeL
10-29-2001, 01:13 AM
Thanks aimless yep that's a good way to do it..

Ciao


Cracking a kind of password...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cracking a kind of password...
PDA

View Full Version : Cracking a kind of password...

BZDraconian
10-28-2001, 06:38 PM
I would like to know if there are any easy to use Windows cracks for cracking "application/x-www-form-urlencoded" type passwords.
And example of this kind would be: http://disc.server.com/disc-maint.cgi?id=1. I would also like to know if it is possible to hack passwords using Microsoft Front Page Editor.
Aimless
10-28-2001, 09:16 PM
Do you, perchance, also play Diablo ??
BZDraconian
10-29-2001, 05:51 AM
Now I play BattleZone all the time. Managed to cheat in multiplayer mode too...hehehe!


Rsa > 512
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Rsa > 512
PDA

View Full Version : Rsa > 512

Unregistered
10-29-2001, 01:16 AM
Hi,
How or what should i use to break > 512 rsa key, RSATool cant do it, just like factor from miracl(RSATool == miracl factor?), so what, should i ask santa claus for some cray?

bart
EtErNaL_L0ser
10-29-2001, 02:07 AM
This forum intend to discuss insight of cryptography not how to break them....
DakienDX
10-29-2001, 11:00 AM
Hello Unregistered !

Why don't you buy yourself a computer for $5 000 000 ? I'm sure it will be able to break RSA-512 in less than a week :)
mike
10-29-2001, 02:54 PM
Um.. The reason they use RSA is because it's hard to break. For instance, if you can factor any of the challenge numbers at RSA.com then you can get from $10K to $200K. The smallest is 576-bits, not too much bigger than what you want to factor.

In other words, it ain't gonna happen.
Unregistered
10-31-2001, 07:15 PM
distributed.net maybe??
Woodmann
10-31-2001, 08:34 PM
Originally posted by Unregistered
distributed.net maybe??

Interesting site. Even with the power they claim, it will still take, maybe 3 years. I think the financial incentive, however small, makes it obvious that there has to be a better way to try and break this besides overwhelming computer strength.

Then again, maybe I am talking out my ass :P
Feel free to tell me so :) I can take it.

Peace, Woodmann

(I should have read the stats page. So 4 years maybe)
EtErNaL_L0ser
11-01-2001, 03:14 AM
With paralel computing it would take less.For example in university we have a project called ASMA which connects more than 30 computer together to solve complex problems ;)
McCodEMaN
11-01-2001, 12:50 PM
In August 1999, RSA-155 (a number with 512 bits)
was successfully factored after seven months by
smaller groups.
This was done by using the NFS and about 300
workstations and PC:s, this result could today be
achieved alot faster by a well-organized group of
users, perhaps Distributed.Net is such an organization?
However, the cost for breaking it is still to high for
most attackers!

regards
McCodEMaN
goatass
11-01-2001, 01:27 PM
If this RSA implementation you are talking about in some application you are trying to break? if so I suggest finding a weakness in the implementation of RSA in the application.

goatass
McCodEMaN
11-01-2001, 02:00 PM
Thats true, insecure implementation is likely the most easy
way to obtain a successful attack.
However, this would not be an attack at the RSA system, so
everything depends on your purpose!

regards
McCodEMaN
tE!
11-02-2001, 04:09 PM
RSA-518 - factored in less than a second...

E:
10001
N:
1FCA57ACAC6156F69315EAF1A9D6314EDB8CBCF0746F888BF290557FEC4689C71
D:
77F50EE08396CA8FA4751016D6C76748292CE7C66F966DA9A7A2FAFDBA94715
P:
3
Q:
A98C7E43975C7A7865CA3A5E34765C4F3D9945026CFD82EA6301C7FF96CD897B

Someone smells what I want to say ?

:)
Kythen
11-02-2001, 04:26 PM
Hehe... nice one tE ;)

Always a good reminder that we have to be careful what we say when talking about crypto stuff!

Cheers!

Kythen
Unregistered
11-02-2001, 04:47 PM
Originally posted by tE!
RSA-518 - factored in less than a second...

E:
10001
N:
1FCA57ACAC6156F69315EAF1A9D6314EDB8CBCF0746F888BF290557FEC4689C71
D:
77F50EE08396CA8FA4751016D6C76748292CE7C66F966DA9A7A2FAFDBA94715
P:
3
Q:
A98C7E43975C7A7865CA3A5E34765C4F3D9945026CFD82EA6301C7FF96CD897B

Someone smells what I want to say ?

:)

Woah, I feel like mom just smacked me with the wooden spoon on my ass. :O
Unregistered
11-02-2001, 11:51 PM
Have you factor 512 rsa in seconds!
How did you do that? what did you know from start?
Unregistered
11-03-2001, 07:59 AM
P i much smaller than Q?

tE tell me, how you(i mean DAMN) have cracked key from ASProtect?

bart
tE!
11-03-2001, 08:45 AM
Hi there.

As you might have noticed one of the prime factors of N
is 3 and as you know the size of P and Q should normally not differ too much. All I wanted to say with posting that example
is that it depends also a lot on carefully chosen parameters for
the RSA system (goatass already said it might be useful to
search for weak points in the implementation). The N I posted will be factored in no noticable amount of time by every lame
factoring program which starts with trial division by small primes.

---

Recca/DAMN could break the RSA-1024 system in older versions
of Asprotect, because he discovered a weakness in Asprotect's
primenumber generator. Alexey used a .dll (which has been
stored inside the asprotect.exe as compressed resource) to
generate both primenumbers P and Q. To manage this he used
some shitty pseudo random number generator (PRNG) routine to generate
512 bits of 'random' data for each number, P and Q. Then he tested if those numbers are prime. If not -> increase number
and test again. <- Loop. The prng he used was similar to the C rand() function. But it comes even worse. As SEED value for this
crap generator he used a 32(!) Bit value which was some mixture
of ThreadID XOR some Timestamp if I remember right :(

Well, everyone can see now how it was possible to break this
lame crap. There was no need to factor the public modulus N.
All efforts could be reduced to a complexity of max. 2^32
bruteforce attempts using the ripped prime number generator
from Alexey and perform one trial modulus operation for each
seed value, thus each generated primenumber. Basically:

1) seed=-1;
2) seed++;
2) Prime=GeneratePrimeUsingAlexeysShit(seed);
3) remainder=N%Prime
4) If (remainder==0) -> P=Prime, Q=N
5) Else goto 2

Infact the complexity wasn't even 2^32 (means you would
not start with seed=0) because of the timestamp he used in the
seed. TMG released keygens for asprotected programs, too and
we measured on my Athlon 800 that it was possible to factor
*every* asprotect key in max. 12h. We could find parameters
P&Q for some programs in less than 20 minutes even. Not bad
for such super-secure program like asprotect :)

Sidenote: As many other routines in Asprotect (compression, polyengine...) the .dll Alexey used hasn't been coded by himself, as usual...Well, at least he's good in 'borrowing' other peoples
code.

Another leeto who fucked up his RSA-512 'protection' in his
ugly Asprotect clone was/is Bruno Branciforti in his
License Control v1.01 application. I'm not gonna post here
what he did wrong, because we released a keygen for this
program and good old Bruno already tried to bother us on
IRC for info how we made that (the moron came into our
chan using a fake nick and introduced himself as cracker - lol).

Oke, hope someone finds this posting useful.

Regards,

tE![TMG]
McCodEMaN
11-07-2001, 02:52 PM
Greetings!

True, the factorization example you described above is done in seconds, and I guess you used your own tool (rsa tool 2) to solve it?! Also, it's an excellent example on how one not should select primes.

regards
McCodEMaN


finereader five try&buy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > finereader five try&buy
PDA

View Full Version : finereader five try&buy

macilaci
10-29-2001, 01:32 AM
anyone got info about this protection?
i discovered some strange values inside the finecom.dll to control the saving mechanism and splash4 value inside win.ini but nothing more.

regards
macilaci


HASP Service 3C
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HASP Service 3C
PDA

View Full Version : HASP Service 3C

amois
10-29-2001, 04:58 AM
Does somebody have data about HASP Service 3C ?
I saw first time and i could'nt find any document on the net.

regards
amois
MeteO
11-02-2001, 05:53 AM
This is new HASP4 HaspEncode function. See aladdin HASP4 programmer manual.


Basics of Cryptography
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Basics of Cryptography
PDA

View Full Version : Basics of Cryptography

Aimless
10-29-2001, 07:17 AM
Sorry to mention this...

...but I read applied cryptography and is quite unwieldly for my, perhaps, too simple brain.

Could there be a document (not here of course, but elsewhere too) that describes cryptography, minus the mathematical/calculus functions etc...? More so, with an applied example that we can use? To something that I am familiar? Like notepad.exe or so...?

I am seeing more and more source codes for cryptography on the net, but they are TOO advanced and they might as well be useless cause my basics are not good enough in these circumstances.

I also understand that mathematics ~ IS ~ necessary for the same, but then something that introduces the same, GRADUALLY.

I would appreciate a few pointers in the right direction.

Thank You.

...Have Phun
EtErNaL_L0ser
10-29-2001, 08:06 AM
You can check Cryptography section in h**p://www.damn.to

Hope that helps

Also w*w.counterpane.com has some good links..
tsehp
10-29-2001, 08:48 AM
aimless,
I reached this cryptography subject when I came to remove the ida's watermarks, I had to deal with the license file that is encrypted with a 1024 rsa key.

The big deal was to locate the functions that were dealing with this key, you can have two techniques to succeed on this :

1-bpm the encrypted values, hoping to land into the good function
2-getting to know some math to eventually try to understand what happens inside the listing

Rsa's math are not very complicated to understand, but it's a very necessary step if you really want to handle the problem globally, so we should not kick math out of those discussion, because they are pretty essential to understand the mechanism.

I can provide here as much as rsa docs as you want, just ask me and I'll post my docs on this place, this could maybe be a good start ?

regards,

tsehp
Vox Humana
10-29-2001, 09:17 AM
Yes, sure:
http://www.fortunecity.com/skyscraper/coding/379/lesson1.htm (etc.)

and

http://www.cs.bris.ac.uk/~cooper/Cryptography/crypto.html

Vox Humana
EtErNaL_L0ser
10-29-2001, 09:17 AM
That would be great if you post your docs +tsehp! :)
Aimless
10-29-2001, 10:25 AM
Tsehp,

I would really appreciate it if you can provide documents on cryptography on your page, or as wherever you see fit. My email id is also present, if you do want to take that path too.

Thank you very much for the offer. And the assistance of all of you above who has managed to answer this thread.

...Have Phun
Kayaker
10-29-2001, 11:01 AM
Hiyas,

There's a goodly selection of Crypto (and other) docs at

http://www.ebcvg.com/enc_dec.html

Some links are broken, but many are fine.

Kayaker
DakienDX
10-29-2001, 11:13 AM
Hello everybody !

If someone is searching for a specified crypto agorithm, perhaps I can help.

I've 50 MB of crypto source codes (but they're 40 MB zipped :) ), so if anyone is interested in, again, a specified algorithm source code, please email me.

I won't upoad it some where, since I think it would be deleted very fast. (404warez.html :( )
Kythen
10-29-2001, 12:43 PM
I just want to point out that most cryptography *is* mathematics. You quite simply won't be able to understand what's going on and why things are done a certain way without knowing at least some of the math behind it. I would suggest looking for some papers/books on basic number theory first, then going ahead to the crypto essays, etc. You'll be able to get a lot more out of them once you have the background. If you or anyone else needs any help with the math stuff, I'd be glad to explain as best I can. :)
McCodEMaN
10-29-2001, 12:49 PM
Greetings aimless!

I think that looking at RSA is an easy way to start the journey, and perhaps even look at some really easy ciphers like Vigenere.
In my RSA essay I talk about:

-One-way functions.
-Hard-core bits.
-Basic Modular arithmetic .
-RSA, selecting primes, Key size and some factoring methods.

RSA Essay (http://www.geocities.com/Vienna/Opera/5748/rsa.htm)

Also I have written some essays about really simple ciphers, if you like I can mail them. The Vigenere essay however, can be found here:

Vigenere Essay (http://www.geocities.com/Vienna/Opera/5748/vigenere.htm)

Hope this helps.

Regards
McCodEMaN
UrgeOverKill
10-30-2001, 01:34 PM
I've read the book 'Cracking DES' and is exceptional reading.
I don't think you can get it now but the info in there is great!

Almost a must read.....
tsehp
10-30-2001, 02:00 PM
Originally posted by EtErNaL_L0ser
That would be great if you post your docs +tsehp! :)

Ok here it is, it's a mathematica4 notebook. It's all in French but all the formulas are there.

good reading.
Aimless
10-31-2001, 04:02 AM
Thank you all of you. I am started on the basics path already.

...Have Phun
EtErNaL_L0ser
10-31-2001, 05:14 AM
Thnx tsehp gotta update my french knowledge :)
j!m
11-01-2001, 09:00 AM
hi everybody,

you should find good crypto resources at
h**p://www.ussrback.com/crypto/tree.html

(especially 'cracking DES'...)

another good start for rsa is rsa.com ;) where you can find a good FAQ

see ya


other debugger than softice?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > other debugger than softice?
PDA

View Full Version : other debugger than softice?

zed
10-29-2001, 10:13 AM
hi im sure youve noticed softice and winxp are like me and speaking english :D, so should i wait till i get an update or use an other debugger, but im new in this scene( :D ) . I think there is no way to learn how to crack a program without softice, cause i didnt find any other working tutorials. Help is welcome!

ps:
Aimless
10-29-2001, 10:17 AM
Try using Ollydbg. Its a good one. It does not debug upto the kernel level, but it manages to move around, and then some.

Search "ollydbg" on google, and go to the home site of this debugger.

...Have Phun
zed
10-29-2001, 11:10 AM
thx 1st, but i think im installin win98 again, because the wish to become a cracker is greater than the wish to launch a program 3 seconds faster, but thx anyway
DakienDX
10-29-2001, 11:42 PM
Hello zed !

You can try TRW2000. It's a little strange to handle (it doesn't accept the 'enter' key on the numeric keyboard). Sometimes it's break-on-condition-breakpoints work not as they should. I haven't played much around with it.

Turbo Debugger is a good choice. I use it myself for most work.
DakienDX
10-30-2001, 10:19 AM
Hello f0dder !

To be honest, I've no idea! It should be possible somehow with TD32INST.EXE, but I've never looked at it.

I've never needed to be able to break a running process. The only thing I know and use is "Attach" to a running process. Of course the you can't do some things like reload or similar then.


softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice
PDA

View Full Version : softice

Dan
10-29-2001, 05:03 PM
im having trouble getting it to load. im running windows ME and i cant update the autoexec.bat file. ive tried using the "workaround" provided by microsoft but it doesnt seem to work. any sugestions?
DakienDX
10-29-2001, 11:33 PM
Hello Dan !

What workaround by Microsoft do you mean ?

Please read also this (http://www.woodmann.net/forum/showthread.php?threadid=1994).


Cracking From Win ME ... help .. Please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cracking From Win ME ... help .. Please
PDA

View Full Version : Cracking From Win ME ... help .. Please

Crackpipe2k
10-30-2001, 07:56 AM
okey i'm completely new to this cracking thing and my goal was to make a keygen for mirc 5.81. I tried bmsg, and bpm, and stuff but i never could get back to the mirc code. Then i used a bpx on messageboxa and after one press of f21 i got back into the mirc code. but after i scrolled up and saw something that looked like it varified the serial i set a bpx on it. When i redid the try and register with bogus serial it stopped right where the break point was but lead me through like 50 jumps .... with each jump it got more confusing. So if anyone would like to tell that this is a very ambitious project for a newbie or let me know if you have tried. Or some hint to what all this means. Anything you think that would help me create the keygen.
EtErNaL_L0ser
10-30-2001, 12:03 PM
Did u get Windows ME Sice patch from Ms?
crackpipe2k
10-31-2001, 09:17 AM
i'm and idiot ... i just didn't scroll up high enough in softice so when ever it was breaking it was breaking past the authentication. And i also had to edit my winice.dat like crazy so it would load all the export tables i needed.


Prog a KeyGen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Prog a KeyGen
PDA

View Full Version : Prog a KeyGen

bINARy ShocK
10-30-2001, 11:11 AM
ive cracked the crackme#2 fromBengaly and know the algo:
a=9360 + 195(+1)
b=9555 + 196(+3)
c=9751 +199(...)
d=9950 ...

after input ("abc"): Key= 9360(a) + 9550(b) + 9751(c)
but how can i create a keygen??? thx
stealthFIGHTER
10-30-2001, 02:22 PM
procedure Keygen;
var counter : Byte;
___ Eachar, Eachar1, Temp, Temp1, Serial : Integer;
begin
__Eachar := 0;
__Eachar1 := 0;
__Temp := 0;
__Temp1 := 0;
__Serial := 0;
__for counter := 1 to length(edtName.text) do
__begin
____Eachar := Ord(edtName.text[counter]);
____Eachar1 := Eachar;
____Temp := Eachar * Eachar1;
____Serial := Serial + Temp;
____Temp1 := Eachar;
____asm
______sar Temp1, 1
____end;
____Serial := Serial + Temp1;
____Serial := Serial - Eachar;
__end;
end;


hex, dec, ascii (Convertion)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hex, dec, ascii (Convertion)
PDA

View Full Version : hex, dec, ascii (Convertion)

bINARy ShocK
10-30-2001, 11:25 AM
http://go6.163.com/krobar/other/key33.htm
-Tutorial for building a keygen
does any body know what:

Decimal value 74 (ASCII character J) corresponds with registration code U874J93

means???
Rage9
10-30-2001, 02:00 PM
Decimal value 74 (ASCII character J) corresponds with registration code U874J93

means???

Could it be how he found the 'J' in the registration code?

-Rage9


Serial Crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Serial Crack
PDA

View Full Version : Serial Crack

wonderwoman
10-30-2001, 11:42 AM
Hi

I am trying to crack the activation code for a program called Omniview. When you try and register the program it asks for a Activation code and expiry date. I have used Sice and set a breakpoint to messagebox, and it break on an invalid code just before the invalid code message appears. I have also used wdasm32 and found out that there is a code for a trial and a code for the full version I just don't seem to be able to find the correct serial number in the regesters.

Can someone please help me

lucy
EtErNaL_L0ser
10-30-2001, 12:00 PM
Try 'bpx hmemcpy' trace down the code and check values with 'd ecx' 'd edx' etc to see where it checks serial...good luck
wonderwoman
10-30-2001, 12:13 PM
Thankyou for the reply

When I tried to use the hmemcpy breakpoint sice keeps breaking as soon as the breakpoint is set and when I exit that break point,
it just open up again at the same point I eventualy have to switch the breakpoint off.

Thanks

Lucy
EtErNaL_L0ser
10-30-2001, 01:41 PM
hmemcpy executed when there is a read/write to memory so before setting the breakpoint you have to open serial box enter a junk serial and before you press ok fire up to softice and write 'bpx hmemcpy' close softice and press ok..Boom :)
wonderwoman
10-30-2001, 01:48 PM
Hi

Thanks how I did it, but it seems to get into some sort of loop I press f12 to move on to the end of the section, there is a pause of about 5 seconds and the same loop reapears, the same happens if I keep on using x to exit it keeps on looping around, thats why I tried messagebox, but I think that open sice to late.

I am totally lost, please help me

lucy
CoDe_InSiDe
10-30-2001, 02:08 PM
Hi wonderwoman,

Ok, just do exactly what EtErNaL_L0ser said about "hmemcpy" and then when you break type for example "BC *" (without the quotes ;) ) to clear the breakpoint.
Because otherwise you keep breaking on hmemcpy :)
And i think that this was your "loop" right? ;)

Cya...

CoDe_InSiDe
Aimless
10-30-2001, 09:56 PM
WonderWoman,

I think that you are rushing into this too fast.

If Omni(whatever) is an "commercial" application with the programmers having even "some" knowledge of protections, you will ~NOT~ find the correct serial.

Simply because, unlike the tutorials of yore, no one compares serial numbers any more (except proggies like Winzip and a few others). What they do compare, are hashes or numbers (plain or encrypted) with each other. And not to mention the integration of the routines in the main one...and table lookups perhaps...encrypted with 1024 bit keys maybe...and then some!!

So do NOT try to look for the echo. In most cases, it will not be there. You'd rather start searching for how to bypass time and expiry dates based on "CONDITIONAL" flow. Or do considerable reasearch and try to figure out HOW the algorithm works, and then TRY to rip it...

...Have Phun
EtErNaL_L0ser
10-31-2001, 05:04 AM
Aimless even Flash 5 which they want you to pay more than 600$$ does that compare ;-)
wonderwoman
10-31-2001, 06:02 AM
Hi

Thanks everyone for the info.

From what I can gather the program seems to assign the compter an ID when you install the program, it then must create a serial number from the ID. It also seems to have a binary based expiry date.

When the program is activated it restricts you to only opening 1 file instead of the usual 250. How hard would that be to crack? Thats if I can do the serial number!!

Let me get this right when you use hmemcpy you get to the serial page and enter any serial number and before you press ok you set the breakpoint. Then when sice is activated you disable the breakpoint and press f10 to continue through the program, as I never seem to get the chance to press the OK button without sice popping up.

Where am I going wrong?

Thanks

wonderwoman
EtErNaL_L0ser
10-31-2001, 12:31 PM
Hmmm are you sure that you are only working with the proggie you wanna crack because hmemcpy breaks where there is *any*
read/write to memory so dont set any breakpoint enter a junk serial fire up to softice set your breakpoint close softice press ok booom you are in softice clear your break point with 'bc *' and trace the code....
MH2K
10-31-2001, 12:44 PM
And maybe close all other running programs?
like a double-click mouseprog.?
I'm just guessing here..
jomamameister
10-31-2001, 12:56 PM
please give some advice here---- this forum positively states:
"The Newbies Forum
For newbies and above. Please, no Crack or Serial requests as it offends our intelligence "

what am i missing here? there are like 4 or 5 replies and yet no one mentions what i just did. we need help to know where to place specific requests such as a request for help cracking or unpacking a program. if this is the inappropriate place, then where is the appropriate place? maybe we can have just simple cracking area and one for unpacking requests. think about it moderators and help us. thanks
jomamameister
EtErNaL_L0ser
10-31-2001, 01:42 PM
We didnt give any serial # / crack away we just tried to show how to remove that junk serial # bug! :p
Clandestiny
10-31-2001, 09:42 PM
Hiya Wonderwoman,

Its really nice to see a girl on this board once in a while :) And judging from the 12 replies you've gotten in 2 days, I'd say quite a few folks would agree with me ;)

Without downloading the target, I can only offer you some general suggestions/approaches. If you're in need of more specific help, I'd suggest providing a url to the target so that someone can take a closer look at the prog in question.

First, as aimless mentioned, chances are that you will NOT find the valid code in one of the registers. Even in basic key gen algorithms, there are often multiple mathematical checks across all or parts of the key.

2. You can probabaly gain a bit more information about your target from the Wdasm listing. Specifically, what APIs does the program use for text entry? GetDlgItemTextA, GetWindowText, ...ect. These APIs will also provide useful breakpoints or even provide a good boundary for setting up a backtrace. And sense you mention an expiry date, you should also spy out the timer APIs used by the program. These might include GetSystemTime, GetLocalTime, and GetTickCount to name just a few. Of course, expiry dates often smell of registry entries so it couldn't hurt to take a look at the registry access APIs either (RegCreateKey, RegOpenKey, RegQueryValue...ect).

3. Check for suspicious registry accesses using Regmon. Expriy information is sometimes stored in the registry.

4. Check for suspicious file accesses using FileMon. Snoop around any .ini or other initialization files the prog uses. Expiry information is sometimes stored here as well.

5. Gain a mental picture of code flow, particularly during initialization and during the serial # entry. An API monitor is a great resource in this situation and you can use it to spy real-time on all of those text entry, timer, and registry access APIs you found in Wdasm. Try to see significant patterns by correlating the order and proximity of the function calls. You could also use this information to set intelligent boundary breakpoints for a backtrace.

6. Make the most of your tools. The backtrace range feature of SI could be used effectively in a situation like this. A range could easily be defined between the text entry API and the invalid code message box such that you can examine the exact sequence of code flow between these 2 breakpoints. The syntax for the backtrace is bprw "module name" T. Check SI documentation for more details on this useful feature. Also, check out Kayaker's nifty TracDis tool. Its currently the only way to save SI backtraces to a file and version 2 will soon have a handy autodumping feature to boot.

Well, thats about all the general advice I can think of right now. Good Luck and keep learning :)

Cheers,
Clandestiny
Bengaly
11-01-2001, 01:53 AM
well..still u can do it,
read tuts from krobar.cjb.net
it has cool tuts there...
i also recommend u yo read the guide i did (need to send new one ;-)) maye it will help for now till next time. (tsehp's) page.

p.s

CoDe_ heya :-)
i will get my new computer today :-)
so i can be online weee...
EtErNaL_L0ser
11-01-2001, 03:06 AM
What a girl on the board where? lol!
wonderwoman
11-01-2001, 10:36 AM
Thanks everyone for your replys it is very much appreciated!!!

I will just have to keep reading the tuts because I am getting know where with the code, I can follow the it easy enough, but it uses differnet codes to activate different features and the codes are created from the computer ID. I have tried using regmon and it definetly does not store any information there. I can't seem to work out the algorithm which creates the serial number.

Anyway once again thanks for your support

wonderwoman


What means NOP???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What means NOP???
PDA

View Full Version : What means NOP???

bINARy ShocK
10-31-2001, 02:31 AM
...and how can i nop a function(?) out??? please give me an example. thx
Aimless
10-31-2001, 03:46 AM
Its very difficult to NOP a function. You actuall NOP a function-call !!

xxxx:yyyyyyyy 67345667 call some_func
xxxx:yyyyyyyy 34123445 cmp eax, 1c
xxxx:yyyyyyyy 45767889 jnz 23446661
(assuming the above is some disassembler output...)

Here, if you were told to NOP out the function some_func, you would have to:

1. Download a hex-editor
2. Open the file in hex-editor
3. Search for "67345667" without quotes
4. Replace these with "90909090" without quotes

Now if you disassemble this file AGAIN, you will see...

xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 90 nop
xxxx:yyyyyyyy 34123445 cmp eax, 1c
xxxx:yyyyyyyy 45767889 jnz 23446661

This process is called NOPPING a function-call.

...Have Phun
Phueghy
10-31-2001, 11:55 AM
if you have too much time, you could check, what memory address the function calls, jump there and nop out every opcode till the corresponding ret.. but that's just stupid. so have better follow the method aimless told us.
just for the sake of it, *g
Phueghy
nobody
11-01-2001, 09:49 AM
If the function is called often it is unpractical to nop every function call.
Another trick is to change the first instruction of the function with a "RET" instruction, efectively bypassing the function code. It is important to adjust the stack if necessary.
bINARy ShocK
11-01-2001, 11:34 AM
but whats the difference?
Aimless
11-02-2001, 08:08 AM
No special difference...

One is a longer method

Other two are very short...

A matter of asthetic appeal (or sometimes protectionist check to see if function exists...)

...Have Phun


xtr help :[
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > xtr help :[
PDA

View Full Version : xtr help :[

Unregistered
10-31-2001, 05:59 AM
Anyone here know xtr?
i wanna know what it is but can not find any fact.

vulio
kp_
10-31-2001, 06:37 AM
Hi!

Check this one: http://www.ecstr.com/
There are some papers and a demo prg with source too.

Best regards,
kp
McCodEMaN
10-31-2001, 06:50 AM
Greetings!

Here is some basic knowledge:

XTR is a public key cryptosystem that uses a specific
multiplicative group of a particular finite field (Fp6)
as its underlying group.
By using a specific trace-representation of the elements of
the group, and performing all computations using this representation,
it only uses about 1/3 of the bits for signatures and encrypted
messages.

regards
McCodEMaN


Break-point for p-code..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Break-point for p-code..
PDA

View Full Version : Break-point for p-code..

Unregistered
10-31-2001, 08:47 AM
I am trying to crack a few VB p-coded programs.. Octopod 3.2, and another Bridge program. Octopod fails JosephCos p-code decompiler.
It seems that the program has a system specific serial. It checks it during the start-up ie before displaying the first Splash Screen.(Not Registered..)
Any Break-points to break on to the start-up code of a p-coded program??
PLEASE HELP..
I have been struggling with this for some time...
regards
riPPadoGG
wbe
10-31-2001, 05:01 PM
You're looking for this:

http://vacarescu.addr.com/WkT/vbdebug/downloads.htm

Good Luck
riPPadoGG
11-02-2001, 09:36 AM
Hi wbe,
Thanks a lot.. I have been struggling with p-coded ones..
I have started playing around with the debugger..
Thanks again..
regards
riPPadoGG


Morfit V5 3D Engine License Protection System
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Morfit V5 3D Engine License Protection System
PDA

View Full Version : Morfit V5 3D Engine License Protection System

alex
10-31-2001, 10:50 AM
Hi to evryone!!!

I'm new here, and I'm very glad to see how many people, that wants to find knowledge, are there!

Ok, the problem now...

For the last ~5 days I'm going mad with the Morfit Engine (www.morfit.com) License System. Anybody knows this engine?
It's a 3D SDK for various programming languages (VC++, BC++, BCC++, Delphi. VB) and it's very interesting, indeed for peoples like me that wants to create 3D games...
Ok, the story is that the previous version of Morfit, 4.0, that it's based on a dll (morfit.dll), was free.
After sometime the engine becomes COMMERCIAL (arghhh) so all my plans go to hell...
I admit that the non-commercial version is only $49, but I want to evaluate it first! But morfit doesn't gives this possibility so... I'm forced to crack it!

The hard thing is not in how the program that uses the morfitc.dll register it, is enough to call a function like:

Morfit_engine_register_license(char*, char*, char*..., double regcode_1, double reg_code2);

I founded all the informations required, but, once compiled, the your exe doesn't run. So what is the trick?

Reading various topic in the Morfit's Forum, I discovered that, when you buy a license, Morfit Ltd. will give you a "License.h" file that contains something (like struct? or some #define I think!) that, once edited with the informations supplied by Morfit Ltd. itself, and inserted in your exe, permits the program to run.

The Question Is : "How to re-build this infos?"

I hope that what I explained is clear, I admit that my english is not well, but I think that you got it...

If someone could help me... please do ;-)

my email: psycho_alex_2000@yahoo.it.

For further question or infos you can write me at the email address mentioned above.

Thanks to evryone.
Alex


Iso image file format
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Iso image file format
PDA

View Full Version : Iso image file format

godel
10-31-2001, 11:39 AM
Anyone knows how to identify a .iso file? Specifically, does this format have "identity marks" in the first bytes like MZ for .exe or RAR for .rar files?

Thanks
DakienDX
10-31-2001, 02:49 PM
Hello godel !

A normal ISO file has no special marks. You can Identify most of them when the first 8000h bytes are 00h, the file size is divisible by 2048 and at 8000h (or at 53000h) it starts with 01h,"CD001",01h. If you have a RAW image, one sector is not 2048 but 2352 bytes long. This means the header is not located at 8000h but at 2048*16+16=9310h.

This only counts on Mode1 sectors, other sector types have other offsets and data.


manually unpacking telock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > manually unpacking telock
PDA

View Full Version : manually unpacking telock

-=elgura=-
10-31-2001, 04:21 PM
anybody know anything about manually unpacking telock???

i've been trying to unpack it with getprocaddress but i can't find to the OEP.

is it the wrong api??
i've tryied to trace trough the code but it got anti-debugger tricks in it so soft ice just craches.

and i can't find any tutorials on telock on the web.

so i need some help here!!
nofurs
11-01-2001, 09:11 AM
Originally posted by -=elgura=-
anybody know anything about manually unpacking telock???

i've been trying to unpack it with getprocaddress but i can't find to the OEP.

is it the wrong api??
i've tryied to trace trough the code but it got anti-debugger tricks in it so soft ice just craches.

and i can't find any tutorials on telock on the web.

so i need some help here!!

Hiya,
search Rce general threads.
-=elgura=-
11-01-2001, 01:49 PM
thanks for the help :-)


ECC and Flexlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > ECC and Flexlm
PDA

View Full Version : ECC and Flexlm

Perry
10-31-2001, 05:12 PM
I would like to know if someone had worked on
the ECC method and the implementation in Flexlm.
Is there some essay over this?

Regard.
Perry.
McCodEMaN
11-01-2001, 07:35 AM
Greetings!

Hm, so you want to find the ECC seeds 3 & 4 and calc. ECDLP so that you can find "d" ? is this correct?

regards
McCodEMaN
Kythen
11-01-2001, 05:17 PM
It's been worked on, but not too much progress has been made yet, at least as far as I know. Currently we're all still stuck with patching in one form or another.
Perry
11-01-2001, 08:41 PM
__________________________________________
so you want to find the ECC seeds 3 & 4 and calc...
__________________________________________

That's right, maybe patching is a solution now (and for ever!)
but i would like to study dearly the ECC implementation on Flexlm.
I had worked full over this but i haven't exit :-((

Regards.
Perry.

pd. someone has some information.
McCodEMaN
11-01-2001, 11:34 PM
Greetings Perry!

I'm sad to say that I haven't really studied this specific issue any closer for quite a while. However, I'll scan my old cd:s and see if I can find any old notes.
But I suggest that you start by reading the excellent essays
by Dan and Nolan Blender if you already haven't, that would probably be the best way to start out!

I think you can find them at: tsehps site (http://tsehp.cjb.net/)

regards
McCodEMaN
tongxl
04-06-2003, 04:07 PM
Originally posted by McCodEMaN
Greetings!

Hm, so you want to find the ECC seeds 3 & 4 and calc. ECDLP so that you can find "d" ? is this correct?

regards
McCodEMaN
:confused: sorry but what is ECDLP and where to get it?
ZaiRoN
04-06-2003, 05:00 PM
Hi tongxl,

ECC = Elliptic Curve Cryptography
ECDLP = Elliptic Curve Discrete Logarithm Problem

google will help you to find lots of info about it :)

Regards,
ZaiRoN


ocx?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ocx?
PDA

View Full Version : ocx?

Schrink
11-01-2001, 08:36 AM
Hi,

I'm trying to crack one ocx. Protecton works this way: if you register you will receive module tralala.bas which should be inclouded in every VB project and which has the licence number. If you dont have that module loaded ocx displays boring nag screens (I have removed it easy) and it won't let you to compile the project with message 'licence not found'. It seems that this message is displayed by VB.

So, please, is there anyone who can explain to me this concept, or who can point me to some tutorial about activex cracking. My question is: which file is telling to VB that there is no licence? OCX? Or that module I don't have? Or do I have to crack vb to compile files without asking for licence?:rolleyes: I have no idea where to search.

Thanks.

Schrink


TMG keygenme #3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > TMG keygenme #3
PDA

View Full Version : TMG keygenme #3

goatass
11-01-2001, 01:23 PM
Hey everyone, I am working on TMG's keygenme #3 and I got stuck at when I couldn't make any valid keys. I studied the Elgamal signature algorithm and the RipeMD-160 used and I figured the RipeMD part and the ElGamal stuff but it never makes valid keys. I think my problem comes when I try to reduce the generator of the group. Did anyone check it out at all or could help me out with ElGamal. Math isn't my strong side but that's why I'm asking for help :)

If someone is interested in this I can post my commented IDA file and my source code for the keygen that I made (in C++).

p.s. I'm not doing this to join TMG so save your flames.

thanks
goatass
Kythen
11-01-2001, 05:15 PM
Hey goatass! :)

Find me on irc and I'll see what I can do to help you out. I worked on this one a while back and still have my notes.
Sab`
11-01-2001, 07:15 PM
goatass it uses md5 not ripemd160, this might answer as to why
your keys are invalid. Also just follow the miracl library to see what each function call does or figure it out manually. Once done use the solving method found in index.c in miracl library should do the trick. Heya Kythen btw. -Sab
goatass
11-02-2001, 08:38 AM
Hey Kythen and Sab, what's going on with you two, long time no talk.

Sab, the reason why I thought it was using RipeMD is because it used it in Keygenme #2 and I recognized the init functions and the hash loops and in my keygen I implemented RipeMD and hashed my username and it gave me the same exact hash value as the keygenme gave me when I traced it hashing the same username.
Maybe it is MD5, I ripped out the hashing loops and put them in my keygen that's why I'm getting the correct hash but I have in my head that it's RipeMD for some stupid reason.

I think I'm missing something with the Number Theory part of things.

Thanks alot guys, hopefully we can get this thing figured out so we can move to Keygenme #4 which looks very interesting :)

goatass
goatass
11-05-2001, 12:58 PM
some more help please.....

When I try to solve the DLP using tE!'s dlp util from his SecureCRT source codes on his web site, I can never get the correct X. I tried rearranging the factors of my p-1 since he mentioned in there that their order matters but I never get the correct X since when it does the verification of y=g^x mod p the y that is generated doesn't match the one I used to solve the DLP.

Prime, P = C9D94F46D0984F43
Genrator of a group, G = 4B45042B684BCBD1
public key, Y = 91D4D6EF46B05C78
private key, X = 1AA4EF ??? not sure

verification = 3A29A50EA6C6DD99 doesn't match Y from above.

factors of p-1: 2, 232D4D, 2DE7A0949A5

tE!, perhaps you could shine some light on my problems, I'd really appreciate your help.

goatass
goatass
11-05-2001, 03:05 PM
I'm a retard, I figured out why I get wrong X values, my array of prime factors was one unit too small so it skipped the last factor. Fixing that I get X = 6C18DA28FDD8FEF1 but now when I use it in my keygen it generates wrong signatures.

My keygen goes like this (mainly tE!'s code):

/* create m from hashed name */

mip->IOBASE=256;
mip->INPLEN=16;

cinstr(m,RipeMD);

mip->IOBASE=16;
x1=mirvar(0);
cinstr(x1,EG_1);
power(m,3,x1,m2); //m2=m^3 mod x1
mirkill(x1);

mip->INPLEN=0;
/* Input Bignumbers */
cinstr(p,EG_p);
cinstr(g,EG_g);
cinstr(x,EG_x);
cinstr(y,EG_y);

//--------------------------------------------------
// generate a random K
decr(p,1,p);
bigrand(p,k);

incr(p,1,p);
copy(k,k2);
copy(k,k3);

/* a=g^k mod p -> Serial part 1 */
powmod(g,k,p,a);
copy(a,a2);

//-------------------------------------------------
//M = (x*a + k*b) mod (p-1)
//a = g^k mod p
//b = k^-1 (m - x*a) mod (p-1)

decr(p,1,p);
copy(p,p2);
copy(p,p3);

// x2=xa mod p-1
multiply(x,a,x2);
divide(x2,p2,x3); //z=x2/p-1 p2(3rd param)=remainder
//copy(p2,x2);

// x3=M-x2
subtract(m2,x2,x3);
divide(x3,p2,x2);

// x3=k*b mod (p-1)
// m=b/k mod p-1 ( 1/k (mod p-1) first, then b*1/k (mod p-1) )
// Serial part 2

xgcd(k2,p,k2,k2,k2); //eXtended Greater Common Divisor (1/k (mod p-1))
multiply(x3,k2,x2); // (1/k (mod p-1) * x3 mod (p-1)
divide(x2,p3,x3);
copy(x2,b);

//-------------------------------------------------

cotstr(a2, szR1);
cotstr(b, szR2);

// strcat szR1 and szR2 and print to screen
//--------------------------------------------------------------------------------

/* y^a*a^b mod p = g^M mod p */

/* Verify serial */
incr(p,1,p);
powmod(y,a2,p,d); //d = 91D4D6EF46B05C78 ^ serial1 mod p
powmod(a2,b,p,c); //c = serial1 ^ serial2 mod p
mad(c,d,d,p,p,m); //m = c * d mod p
cotstr(m, szM);
SetDlgItemTextA(hDlg, EDIT_VERC, szM);

/* Verify name */
powmod(g,m2,p,m);
cotstr(m, szM);
SetDlgItemTextA(hDlg, EDIT_VERN, szM);

The results from the above two verifications don't match and they should, and that's where I'm lost.....

goatass
Kythen
11-05-2001, 06:11 PM
At first glace I see you don't check to make sure k is relatively prime to p-1. Considering p-1 is even, you have less than a 50/50 chance of getting a relatively prime random number. That'll put a damper on your ElGamal stuff any day ;)
There may be other problems of course, but i'll have to sit and look it over more carefully.

Cheers!
Kythen
McCodEMaN
11-06-2001, 01:28 PM
Greetings goatass!

Look at this algorithm:

UserName - text line
Hash = HashMD5 (UserName);
m = Hash ^ 3 mod hp
a = G ^ K mod P
m - X * a
b =----mod (P-1)
K
RegCode = {a, b}

regards
McCodEMaN


using sice under 2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > using sice under 2k
PDA

View Full Version : using sice under 2k

markedone
11-01-2001, 01:48 PM
ok this qualifies me as uber newb.

I have been using sice under windows 95/98 for over a year now,
to some success. I have recently upgraded to windows 2k advanced server, and promptly installed sice 4.05 for 2k.

I am having trouble however using some techniques such as:
bmsg <hwnd> wm_gettext
and the like. When i try to break like this, sice accepts it as valid,
but the program will not break on the message. If i try the same
program under win98 it will break. :(

Can somebody enlighten me as to what i might be running into,
or point me in the direction i might look to figure out what i am
doing wrong.

Thanx all :)
mark
EtErNaL_L0ser
11-01-2001, 03:20 PM
Did you edit your ntice.dat file which is in C:\winnt\system32\drivers

????
markedone
11-01-2001, 03:25 PM
Thank you for reading.

I tried, but maybe i missed something, below is what i have:

INIT="ALTKEY ALT i;lines 60;wd 8;X;"

EXP=\SystemRoot\System32\ntoskrnl.exe
EXP=\SystemRoot\System32\ntdll.dll
EXP=\SystemRoot\System32\kernel32.dll
EXP=\SystemRoot\System32\user32.dll

; WINICE.DAT
; (SystemRoot\System32\Drivers\WINICE.DAT)
; for use with SoftICE for Windows NT (versions 3.0 and greater)
;
; ***** Examples of export symbols that can be included *****
; Change the path to the appropriate drive and directory
EXP=\SystemRoot\System32\hal.dll
EXP=\SystemRoot\System32\csrsrv.dll
EXP=\SystemRoot\System32\basesrv.dll
EXP=\SystemRoot\System32\winsrv.dll
Aimless
11-01-2001, 11:17 PM
Often...

0124 Window Class xxxx (this is the register window)
....0987 Edit Control xxxx (this control accepts username)
....098C Edit Control xxxx (this control accepts password)
....05CF Button xxxx (this is the OK button)
....3456 Button xxxx (this is the CANCEL button)

...is the case.

MANY a times, if you put:

BMSG 0987 WM_GETTEXT, or BMSG 05CF WM_COMMAND, you will NOT break, even thought the breakpoint is able to be set.

Under these circumstance, ALWAYS set a Message Breakpoint on the parent WINDOW and not the controls within the window.

You can:

BMSG 0124 WM_GETTEXT or BMSG 0124 WM_COMMAND will work.

...Have Phun
markedone
11-02-2001, 10:01 AM
thanks for all of your help guys, it seems to be working... :)


help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > help
PDA

View Full Version : help

Unregistered
11-01-2001, 07:46 PM
can anyone supply me the tools and document of elan LM license manager and sentinel LM license manager.
i do need it to crack ......
Aimless
11-02-2001, 08:11 AM
Could you please search google.com with the same parameters as you have given in your message ??

You will be surprised at the materials...

...Have Phun


How to patch a VB3 exe?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to patch a VB3 exe?
PDA

View Full Version : How to patch a VB3 exe?

Solomon
11-01-2001, 08:39 PM
Decompiled it with VB3 decompiler and found the dongle checking code snippet, but how to patch a VB3 prog?

How to find the pseudo opcode of the decompiled Visual BASIC statements? :(

for example, here is the routine to check the dongle:

Sub Command1_Click (Index%)
Select Case Index
Case 0
Call sub04C7(2, 1) <----------------------check license
Unload Form1
inputForm.Show
Case 1
End
End Select
End Sub

Sub sub04C7 (p0326 As Integer, p0328 As Integer)
.................
If (p0328% = 0) Then Exit Sub <--------------------- no need to check dongle
................. <------------------------ dongle check here
End Sub

so I want to change "Call sub04C7(2, 1) " to "Call sub04C7(2, 0)", or change "If (p0328% = 0) Then Exit Sub" to "If (p0328% = 1) Then Exit Sub". But how to find the corresponding opcode in the exe?
Aimless
11-02-2001, 08:02 AM
Use the VB P-code debugger...

Reach the line of pcode where you want it to (in your case, the call...)

Change the display to assembly or check out the address...

Use a RVA to VA converter on the address to find out the physical offset in the file...

Modify to heart's content...

www.programmerstools.org ->Debuggers Section (if you are having trouble locating the VB Debugger...)

...Have Phun
Solomon
11-03-2001, 05:19 AM
great. I will try it. Thx aimless:D
JohnnyBoy
11-05-2001, 06:49 AM
Cant find the debugger
I have searched thru h**p://www.programmerstools.org/
The one I found was for VB5/VB6 and was called "WKTVBDebugger". What about VB3.
I maybe stupid but I have a similar VB3 problem.
Solomon
11-05-2001, 06:59 AM
I have found a essay about VB3 EXE:
http://www.woodmann.net/fravia/dukeess.htm

But have to search for M$ VB3 compiler to study the exe, which is not an easy task coz it's too old.:(
Unregistered
11-05-2001, 08:03 AM
Hi Solomon,
Sent you an email.
regards
Solomon
11-05-2001, 08:50 AM
I successfully got the compiler. Many thx:)
JohnnyBoy
11-06-2001, 05:34 AM
Originally posted by aimless
Use the VB P-code debugger...

Reach the line of pcode where you want it to (in your case, the call...)

Change the display to assembly or check out the address...

Use a RVA to VA converter on the address to find out the physical offset in the file...

Modify to heart's content...

www.programmerstools.org ->Debuggers Section (if you are having trouble locating the VB Debugger...)
Cant find it!
I have tried Dodis decompiler. Almost work but I get alot of errormessages. Do I have to have VB# installed to have dodi work?
If so I am interessted in where to find VB3?
(Someone have mailed it to Solomon?)

...Have Phun


Is it possible to write win32 appz in asm?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is it possible to write win32 appz in asm?
PDA

View Full Version : Is it possible to write win32 appz in asm?

bINARy ShocK
11-02-2001, 12:26 AM
such like vb or delphi???
Solomon
11-02-2001, 01:21 AM
Absolutely yes!

But you have to do the things that should be done by compilers of high-level programming languages, such as pushing the parameters for sub-procedures etc. It's a tedious task. Why don't we leave them to compilers?

My opinion is: Don't write programs with pure Win32 ASM unless it's absolutely necessary(for efficiency, smaller exe size, low level direct access of hardware etc.).

I recommend "C/CPP + inline ASM".

I know some win32 asm lovers may blame me for this, but who cares. We CAN have different opinions:D
Aimless
11-02-2001, 01:41 AM
www.win32asm.net

or

win32asm.cjb.net

...Have Phun
DakienDX
11-04-2001, 02:16 PM
Hello bINARY ShocK !

win32asm.cjb.net is a good resource to learn ASM. You can also go to the board directly (http://board.win32asmcommunity.net/). Try downloading the tutorials and misc programs with source code and understand them. You won't find any reversing related thinks there. (but here :) )

Hello Solomon !

I love ASM, but I don't blame you for anything. You might follow the "Holy War" between high-level and low-level languages here (http://board.win32asmcommunity.net/forumdisplay.php?forumid=20). (I don't like war. You won't find me there anywhere. :) )

Hello aimless !

www.win32asm.net doesn't work any more. (has it worked ever before? :) )


Multi Screen ans SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Multi Screen ans SI
PDA

View Full Version : Multi Screen ans SI

JohnnyBoy
11-02-2001, 04:09 AM
At home I use 2 screens. The main screen is atached to a 3dfx Vodoo3 card and the 2:nd screeen is atached to a Matrox MGA Millenium card.
When I install SI it ask me if I whant to use the matrox card. I change the card to 3dfx and check the Universal box. Test the screen and its seems to work.
Reboot.
Press ctrl+D and SI pops up OK. The problem is that the mouse pops up a window everytime I move the mouse. (The same vindow as it you press right-mouse-button)

I look at winice.dat and see a row with monitor. This line is set to monitor=0.
The mouse is a std MS mouse attached to the PS2 port.
JohnnyBoy
11-04-2001, 09:41 AM
Reinstall of Win98se and the problem was solved
DakienDX
11-04-2001, 01:44 PM
Hello JohnnyBoy !

I had this kind of problem too. But this came because the "Video Utility" didn't like to accept any company names starting with a number. So "3dfx" failed, since the "Video Utility" made some lines in the WIN.INI which where empty instead of containing the video cards name and manufracturer.


passwords used in installshield
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > passwords used in installshield
PDA

View Full Version : passwords used in installshield

racasan
11-02-2001, 07:20 AM
has anyone any advice on the password system used in installshield
Aimless
11-02-2001, 07:58 AM
Are you asking for information on the conversion of evaluation version of Installshield to full passwords?...or...

.... the passwords asked ~during~ installations of software by Installshield, like NuMega softwares...??

Specify the same please.

...Have Phun
racasan
11-02-2001, 12:07 PM
sorry my question is in regard to the password
racasan
11-02-2001, 12:13 PM
sorry try again

sorry my question is in regard to the password asked for during installation
Aimless
11-02-2001, 11:39 PM
Understand that the passwords asked ~during~ installations of the scripts can be done in any way that you program natural applications.

For example, the passwords asked during NuMega installations are actually numega validation routines that they themselves have built.

Perhaps a more detailed explanation is in order...

(1)
Installshield is actually an executable file installer. This installer can be PROGRAMMED using VC++ (try using the Enterprise version of VC++)
(OR)
it can be use to run an application.

(2)
Alternatively, as a part of its installation procedure, it can run an executable.

Now, if I were NuMega, what I would do is, use my own algorithms to create and validate the password. Use this source code (probably written in VC++) and incorporate it as part of the Installshield script, so that when Installshield begins setup, it asks for this password.

Or, as Numega, I could ALSO write an exe, pack it as a part of the setup, uncompress it temporarily and run it to ask me the password, it OK then proceed or else exit setup (a very rare method, but.)

Therefore, to crack passwords asked DURING an installshield setup:

Step 1: Need an installshield decompresser. www.programmerstools.org -> Utilities section

Step 2: Need to run the program, to break the CAB files into its individual files.

Step 3: Figure out where the protection is, using the usual sniffing techniques...

Step 4: Do what is necessary.

...Have Phun
racasan
11-03-2001, 06:26 AM
ok well I looked at some de-compactors, but non would work on the exe I whish to look at (the packer used is "PackageForTheWeb 4") so I have now downloaded this packer program and I am packing my own files to see what I can find?
DakienDX
11-04-2001, 01:52 PM
Hello racasan !

The password system in PackageForTheWeb is not very difficult to crack. There are many password crackers for PFTW before 2.03, but after that the password is not used any more to protect the installer, but to protect the data.

The cipher used is a very simple xor stream-cipher. If you can't find it out, I could post the cipher and how to reverse it in the RCE Cryptographics.
Unregistered
11-05-2001, 07:48 AM
Hi DakienDX
Thanks for the information; any help would be appreciated, as I am very stuck with this project at the moment
DakienDX
11-05-2001, 11:55 AM
Hello everybody !

I decided to post how to reverse the PFTW cipher here. Let's start.

1. Take the password-protected .EXE
2. Seek to the end of the .rdata section
3. Take the DWord there as the length of the following block
4. We don't need the block so go to it's end
5. Copy the data from there until the end of the file to a file (be sure to strip any VerySign signatures if present)

Now you've the encrypted file. It's a encrypted Windows .CAB file.

The decryption goes the following way:
1. Exchange the higher four bits of each byte with the lower four bits
2. Do a "NOT" on each byte
3. Xor each DWord with 13358607h

Now you've unprotected the password-independent part.

You need to Xor the whole file with the password now. Read LengthOfPassword bytes, Xor them with the Password and save them again.

The problem: We don't have the password !

The solution: We know the structure of .CAB files

"MSCF", 00h, 00h, 00h, 00h, DWord_LenOfCAB, 00h, 00h, 00h, 00h, xxh, 00h, 00h, 00h, 00h, 00h, 00h, 00h, 03h, 01h, yyh, 00h

xxh = I don't know
yyh = 01h, 02h, 03h (I don't know)

So we can recover 30 characters from passwords up to 32 characters.

Now you should have the password (or can guess it very easy or bruteforce it).

Enter it in the PFTW archive and PFTW will do the rest.
decx
11-05-2001, 01:55 PM
If you mean the *OLD* install shield passwords, and non PFTW, its kinda simple, just disassemble the setup file (even if 60mb+ it will only disassemble the exe wrapper (in w32dasm) dident try in ida) Looking around you will notice a stringcompare, being lazy inverting it will make it unpack and install as the password is not actually used to decrypt anything. Atleast not on the installshield passwords common before PFTW and still used in some packaged installs (ie one file only setups).
Unregistered
11-05-2001, 02:31 PM
Hi DakienDX
Well your information did the trick. I feel very pleased to have finally solved this problem (although the password was that obvious I could have cried)
Anyway thanks
Unregistered
11-06-2001, 01:00 PM
Hi DakienDK.

Let me begin by saying I am impressed by your post. Quick, simple and robust.
I only have one question, and you may opt not to answer (Magicians never reveal their secrets?)
Did you deduce the stream crypto out of the dissasembled program or did you dig some documentation somewhere in the net?. Thanks
DakienDX
11-06-2001, 02:09 PM
Hello Unregistered (rascan?) !

I found out the crypto algorithm some years ago myself. I had no internet access at that moment, but had to do some work at a company with a fast (2GBit) internet connection. I downloaded some programs protected by PFTW. When I saw the password dialog, I searched for a deprotector, found one and tested it on one archive. Because it worked I did not do more research.

Some days later I decided to use the programs I had downloaded, but I also noticed that only two of them where protected by PFTW 2.02 and the other five by PFTW 2.04.

Because versions starting with 2.03 encrypt the data in the archive, I got a "disc full, 4096MB free disc space, free some more space" after using the deprotector I had downloaded on a 100MB PFTW file.

This made me use Turbo Debugger on the PFTW archive, and four hours later...

Generic PFTW password deprotector working with all version of PFTW (especially >=2.03 :) )


Cryptography's Shining Ciphers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Cryptography's Shining Ciphers
PDA

View Full Version : Cryptography's Shining Ciphers

Aimless
11-02-2001, 09:19 AM
As you must already know, there are a ~plethora~ of operating systems in the world.

From the most simple to real time ones like QNX and so on. And even more exotic ones, I am sure.

However, most of the world can be divided into Windows, Unix and Mainframes. (ignore the Unix Flavours please)

The rest are all ~niche~ operating systems, used for very specific purposes, which may occasionally find space in the real world.

In the light of the above paragraph...

Just as there are zillions of operating systems, but only 3 worth really know as most of the world is on it, can I understand which cryptography ciphers are in ~MOST~ use today? The ones I can say cover up more than 95% of the cryptography ciphers today.

DSA, Blowfish, DES, RSA are the ones I can immedately think of (Triple DES, though there, is a variant of DES, hence not included)

Any assistance will be appreciated. This is because I am finding TOO MANY ciphers on the net to really focus myself.

Thank you.

...Have Phun
goatass
11-02-2001, 09:35 AM
Hey aimless, from what I've seen used in applications I'll have to say RSA is the most popular among developers, also Elgamal is pretty popular. I've also seen DSA used but not as much as the above two.

Hope that helped any
goatass
Aimless
11-02-2001, 10:45 AM
Thank you.
McCodEMaN
11-02-2001, 02:33 PM
Greetings aimless!

This is some ciphers that is widely used to encrypt data, and therefore worth a closer look:

Blowfish and Twofish, two block ciphers that has key dependent S-boxes.

TripleDES (3DES), uses DES three times, normally with three different, unrelated keys.
This makes it stronger than a single DES but also slower that
most new block ciphers.

Elliptic curve cryptosystems (ECC), not widely used,
but everybody knows them, so to say!

And as goatass said, RSA and Elgamal is also worth looking at.

However, I think that you should start by looking at RSA
and DES. This way you've studied both an asymmetric cipher and
a symmetric cipher.

regards
McCodEMaN
mike
11-02-2001, 10:36 PM
You should be aware of Rijndael, the new AES. It'll be most popular in most new applications.
McCodEMaN
11-03-2001, 12:27 AM
Greetings Mike!

I agree this is something thats worth taking a closer look at!
In fact, I have a little program for encrypting files using the
Rijndael algorithm. It's only 84,1K so if anyone want it, let me know.

regards
McCodEMaN


IDA auto param recognition on OLDER versions with VALUES!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA auto param recognition on OLDER versions with VALUES!!
PDA

View Full Version : IDA auto param recognition on OLDER versions with VALUES!!

Aimless
11-02-2001, 09:29 AM
Just for your information, thought I should share this knowledge with you, though I am sure MANY would have already thought of it...

IDA 4.xx version starts giving you the parameters for your disassembly. A very helpful feature this. But what happens to users who are using 4.04, or worse, 3.80 ??

More over, I know the parameters (like hwnd, lpCmdLine) etc. But I do not know the VALUES that these contains...decoded like MB_OK|MB_EXCLAMANTION and so on...

Would it not be great to have that in IDA? And in versions as old as 3.80 ???

Well, here I have found out a way. Humble and simple, but workable...

* Download ollydbg. (yup!)
* Open your program through it and it will AUTOMATICALLY show you the parameters of around 1500 APIs (with facility to add your own!)
* Run the program
* Select all and save the disassembly to file (warning, it can be QUITE big)
* Use ultraedit and strip off everything, except the addresses and the comments (parameters, with values!!)
* Create idc script which says MakeComm(address,"comment")
* Load your proggy in IDA
* F2, apply the IDC..

VOILA !!! INstant param recognitions, with character graphichs AND values of parameters.

Enjoy.

...Have Phun (Maybe I should write an essay for the uninitiated ??)
Polaris
11-04-2001, 01:37 PM
Aimless,you have pointed out a great possibility.

I have written a proggie that converts the ollydbg-dump to an autocommenting IDC script.

How can I upload it?

(Just ask and I'll email it ...)

Polaris - The Master Of Nebulah Frost
Polaris
11-04-2001, 01:48 PM
Sorry!
Here is the file...
Carpathia
11-04-2001, 03:05 PM
Autoparam recognition for older versions of IDA has been around since late last year, courtesy of Spath.

http://frogsprint.cjb.net
Aimless
11-05-2001, 12:14 AM
With values for each params...?

...Have Phun Carp.
Unregistered
11-10-2001, 07:40 PM
Originally posted by Carpathia
Autoparam recognition for older versions of IDA has been around since late last year, courtesy of Spath.

http://frogsprint.cjb.net

Um the autoparam recognition that Carpathia speaks of is not complete. If I name arguments in a function by hand IDA will not reflect this in the calling routines. API calls are usually the simplest to figure out what push corresponds with what argument. It is calls within the program itself where it would be more useful. Maybe an IDC script can be made to do this?!?

Snatch
Anticode
11-12-2001, 05:24 AM
what do you exactly mean by "with values for each params"!??
Aimless
11-14-2001, 02:58 AM
Instead of showing :

push xxx ;uType
push yyy
push zzz
push aaa
call MessageBoxA

It will show:

push xxx ; uType: MB_OKCANCEL | MB_ICONEXCLAMATION
push yyy ; lpCaption: "This is a Grea Idea"
push zzz ; lpText : "Sure Is"
push aaa ; hWnd
call MessageBoxA

...Have Phun
Lord_Soth
11-15-2001, 11:59 AM
So either an IDC script or some other way around it
need to be found. any suggestions ?? :)

LS
Polaris
11-17-2001, 07:13 AM
Please use my proggie,it's avalaible for download in an upper post...
Please note that using an IDC script to load into IDA comments generated by OllyDbg is not a good idea,as the dump-file is most of the times really big...
More than this,IDC is really slow in what concerns I/O operations,so...


Unpacking Tutorials
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Tutorials
PDA

View Full Version : Unpacking Tutorials

riPPadoGG
11-02-2001, 09:40 AM
Hi All,
I am finding this board really cool and useful ;)
I want to know where I can get good comprehensive tuts on manual un-packing.
Any sites dedicated for this??
(I know risc, stone pages and ofcourse reverser++ ;))
Have a nice time cracking..
regds
riPPadoGG
McCodEMaN
11-02-2001, 01:20 PM
Greetings!

Sure, there is many essays on this subject!
E.g. our site:[TRES2000 (http://www.geocities.com/Vienna/Opera/5748/index.htm) , go to EssayDatabase and select unpacking!

Also, there is: tsehp.cjb.net/ (http://tsehp.cjb.net/)

regards
McCodEMaN
Eternal_Bliss
11-03-2001, 04:36 AM
http://ebliss.cjb.net
riPPadoGG
11-03-2001, 08:39 AM
Tks.. mcCodEMan..
That was a cool site. I will have to download the tutorials.. and start crashing my PC..
And EBliss..
I've been to your site. Many times. The idea of crashing the PC was indeed from you ;) But this time I want to unpack the exe in the end.
Your VB tuts are my reference.(truth.. you have all the common __vba* functions analysed somewhere in your tuts..)
I would like more p-code tuts from you..
thanks a LOT...
and happy cracking for the week-end..
regds
doGG
stealthFIGHTER
11-03-2001, 12:27 PM
I think you should download ID-Rip.zip from h**p://www.immortaldescendants.org/.
JMI
11-03-2001, 02:37 PM
Anyone downloading ID-Zip from the Immortal Descendants site should be advised that it is infected with a virus. It has an OpenMe or ReadMe exe of 12,096 K. I've forgotten what Norton called it, but it was something similar to "Bloodshed." It may not be a white power, but it still may be dangerous to your machine's health.
stealthFIGHTER
11-03-2001, 05:44 PM
Maybe, your Norton is too sensitive. Maybe :)
DakienDX
11-04-2001, 02:32 PM
Hello JMI !

I can't find a "OpenMe or ReadMe exe of 12,096 K" or similar. It contains some exefiles, but all are OK with NAV and under SoftICE.
jomamameister
11-04-2001, 08:55 PM
i just scanned the id zip with my innoculate it pe and found no viruses, either.
jomamameister
McCodEMaN
11-05-2001, 11:19 AM
Greetings!

I can't help it, have to say it!

Perhaps Norton isn't the best choice today, sure it still scores
well in various tests, but only because of it's pricetag and easy-to use-design!
Norton is not very good at detecting virusinfected files, it's almost better at faking detections. That's not true though, but I hope you understand what I'm trying to say..
A good choice would probably be F-sec. (Avp + F-prot) or just AVP by it self!

regards
McCodEMaN
JMI
11-05-2001, 11:43 AM
I don't know enough about the relative effectiveness of the competing Virus Detection software to make an intelligent comment. I can only repeat that when my scheduled full disk scan for Virus was run after I had downloaded the entire Immortal Descendant's site from their web page button for downloading, and before I had opened the portion of their essays that contained the ID-Rip.zip, Norton advised that there were two files that contained a Virus which I believe it identified as "Bloodshed".

I have the two files in "quarantine" and they are both exe files, which with QuickView have a title that contains the name "OpenMe." I do not know very much about Virus code, but the two files definately are exe's. I have no explaination as to why I received them with my download and others didn't, but thought it was prudent to pass on the word, just in case.
JMI
11-05-2001, 01:02 PM
Just a follow up on my earlier post. I re-downloaded ID-RIP.zip and uncompressed it to a folder and re-ran Norton AntiVirus on the folder without detecting any virus. This made me wonder how I got the original notification and upon checking into some of the features of Norton Antivirus which I had not used before it provided a report on the files in my quarantine folder.

Although I am relatively sure that when I received the original notification, it identified the folder with ID-Rip.zip and containing the virus, the Norton Antivirus report stated that their "original location" was in my "windows/temp" file, which means they could have come from anything I downloaded on the net in the previous couple of days. I can only assume, since the program was scheduled to run while I was not at the computer, that it somehow mis-identified the folder or I mis-read its description.

In any case there does not appear to be any problem with the ID-RIP.zip file and my apoligies to ID for creating any appearance of a problem, though my intentions were simply to alert the community to a possible problem I thought I had identified. Next time I'll double check the identification of the source before I post any warning on the Board.
Lord_Soth
11-07-2001, 08:10 PM
what is this ID-rip ??

This might be funny coming from an ID memnber.
Well, I was one before we disbanded...

Damn, btw, I never got a chance to DL the entire
site...

LS
McCodEMaN
11-08-2001, 05:51 AM
Greetings Lord_Soth!

The ID-rip is a rip of your (ID's) website!

regards
McCodEMaN


Where to start ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where to start ??
PDA

View Full Version : Where to start ??

DaveGahan
11-02-2001, 11:28 AM
This is my first post in here .. I wanna be a cracker I have an okey knowledge with C++ ;) .. and I need the right tuts/web site to start with the art of cracking .. I have all the tools I need Softice - windasm- ida pro - unpackers .. etc .. I know some ppl may have asked this question before but I hope u have the time to answer me ..

tnx
urs
Dave
Aimless
11-02-2001, 11:42 PM
Hello DaveGahan,

You may actually need to read the FAQ first.

Alternativelu, you may also read the Beginners essays on Tsehp's mirror of Fravia.

...Have Phun
Bengaly
11-02-2001, 11:55 PM
hi.
try read easy essays first.
u'll find them at www.krobar.cjb.net
or www.tsehp.cjb.net .
or finally thje guide i did at tsehp\s page if u want:
http://www.woodmann.net/fravia/HCU-Cracking%20guide.htm

have fun.
DaveGahan
11-04-2001, 05:48 AM
tnx for the info guys

Very nice sites .. lots of info there :)

tnx a bunch
urs
Dave


How come ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How come ?
PDA

View Full Version : How come ?

dunno
11-02-2001, 06:29 PM
I have unpacked and cracked an Aspacked app. When I repack the cracked app its main icon vanishes. Why, and what should I do to restore it?

Is there a way to patch an Aspacked file without unpacking it first? I used a patcher made for packed files. When I tested it on another PC, patcher failed to work. Why? Is there a reliable way of creating patchers for packed programs for the purpose of releasing cracks?

Thanks.
Woodmann
11-02-2001, 07:19 PM
"Is there a reliable way of creating patchers for packed programs for the purpose of releasing cracks?"

There might be a way. You got money?
dunno
11-03-2001, 06:04 AM
Yes, I got money. I am a man of wealth.
Unregistered
11-03-2001, 03:09 PM
Have you checked out the tools at programmers tools?

You didnt mention any specifics so I will say that you will need some understanding of the code you are working with.
Unregistered
11-03-2001, 03:27 PM
Hi,
"Yes, I got money. I am a man of wealth". lend us a couple of bob then ;)
Unregistered
11-03-2001, 03:29 PM
if you want to patch .exe, then you can use "DZA Patcher" (get it from protools)
if you want to patch .dll, you can still use it for your soul, but on other computers/os most likely will fail because it doesn't support relocation.
DakienDX
11-04-2001, 02:02 PM
Hello dunno !

The "Aspacked app" has compressed resources. Because the main icon and the version info should be viewable when dealing with the file, these resource entries where moved to the packer's code section and are uncompressed.

The icon vanished because you deleted the packer's section (or perhaps if you've unpacked it wrong). Since the the icon isn't in the unpacked resource section any more, you can't see it.

"Why" - Because we don't like uncompleted work, do we?
"What" - extract the main icon, the main icon group and the version info from the packed executable and add it to the unpacked one. (and delete the old references to the packer's section first)
dunno
11-04-2001, 06:02 PM
Yes!... This is the answer I was waiting for. Specific enough and well explained.

Now, I've learned why it vanishes and what I should do to restore it. And in fact, I restored it a couple of minutes ago.

Thank you very much DakienDX.


Why?????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Why?????
PDA

View Full Version : Why?????

A.O.A
11-02-2001, 08:05 PM
hi

why can't win32dasm unassemble certsin progs like wisecroft ripper.....
what will i need the?

bye
enjoy cracking
Aimless
11-02-2001, 11:47 PM
I am sure you must have heard of anit-debuggin code? The code that stops your debugger dead in its tracks?

Well, there is also something called as anti-disasm code. This codes actually throw off you disassembler.

however, try IDA. It ~may~ work.

...Have Phun


Revirgin 1.2 beta 7 released.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Revirgin 1.2 beta 7 released.
PDA

View Full Version : Revirgin 1.2 beta 7 released.

tsehp
11-03-2001, 03:09 AM
All the app's look and feel is changed.
Tracer is improved and more stable ;)
I began to code the dumper.

Please help me to test again the tool, and especially locate every app that will impeach the iat/dumper tracer to work.

This thread will be closed due to recent protector's flames, mail me directly to help the beta test phase.

many thanks,

Tsehp


cobol cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > cobol cracking
PDA

View Full Version : cobol cracking

Unregistered
11-03-2001, 11:50 AM
How to crack a Cobol app. I would a tutorial example to help.
Thanks
JKZ


tsehp, please add "refresh process list" feature to Revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > tsehp, please add "refresh process list" feature to Revirgin
PDA

View Full Version : tsehp, please add "refresh process list" feature to Revirgin

Solomon
11-03-2001, 01:14 PM
coz this does nothing with any protector, so I post here.

If I run a prog after Revirgin(v1.2b7), this process doesn't appear in the pull-down list, so I can't select it unless I restart Revirgin.

Thx for your attention.
esther
11-03-2001, 10:45 PM
Originally posted by Solomon
coz this does nothing with any protector, so I post here.

If I run a prog after Revirgin(v1.2b7), this process doesn't appear in the pull-down list, so I can't select it unless I restart Revirgin.

Thx for your attention.

Hi,
click right mouse on "Select the process to attach"
you will see "refresh" ;)
update :P
the more you refresh the more applications in there it seems
probably a bug..
tsehp
11-04-2001, 02:44 AM
thanks,
I've corrected the bug, and the "refresh" right click was replaced
by a button, easier to find for people that doesn't know revirgin.

regards,

tsehp
Solomon
11-04-2001, 06:32 AM
I deleted all the files of previous version(including the 2 DLLs and *.sys in system directory), downloaded the latest "Revirgin.msi" and extracted it to a directory with WinRAR, then copy the 2 DLLs to %systemroot% and *.sys to %systemroot%\system32\drivers. But Revirgin.exe still says "please update tracer.dll to the latest version in your %systemroot% directory":(

Seems that the version of EXE is not the same as that of DLL.
Thx agagin
Unregistered
11-04-2001, 11:57 PM
slt tsehp_rv !
moi aussi j ai le meme probleme.
please update tracer.dll ........

la meme chose que la derniere fois.

casa.
tsehp
11-05-2001, 03:47 AM
ok je remets une version complete en téléchargement

ok, I'll upload a brand new recompiled version to download

ich werde eine neue Version stellen habe download

chinese : #~l%ù$£££ $£££ && (sorry I don't have the right character set ;)

The wise installer doesn't change the revirgin.exe when you just "reinstall" with new msi, so better uninstall first.

tsehp

ps: when rv makes this messages, it only detects that the file dates between rv.exe and tracer.Dll are different, you can also make a date change, but better download latest versions.
Solomon
11-05-2001, 06:12 AM
It's ok now. I just changed the file date with a "touch" command.

Let's continue IAT rebuilding with this great tool:D
JMI
11-05-2001, 11:28 AM
Neither Revirgin 1.2b6 nor 1.2b7 came with updated Thread or Tracer DLL's. I'm wondering if the 4/1/01 version of Thread.dll and the 4/23/01 version of Tracer.dll are the latest versions and, if not where we can get the newer versions. I also had problems getting 1.2b7 to work without the request for an updated DLL. After installing this version several times without success, I installed 1.2b6, which seems to accept my version of the Tracer. Loading 1.2b7 over 1.2b6 seems to have made 1.2b7 accept them as well, which it wouldn't do on my machine if 1.2b6 was unloaded first.

No complaint intended. Just trying to stay current with your great tool and hoping some day I might have the skills to contribute to to RCE in some useful way.:confused:
Unregistered
11-06-2001, 05:18 AM
Originally posted by tsehp
ok je remets une version complete en téléchargement

ok, I'll upload a brand new recompiled version to download

ich werde eine neue Version stellen habe download

chinese : #~l%ù$£££ $£££ && (sorry I don't have the right character set ;)

The wise installer doesn't change the revirgin.exe when you just "reinstall" with new msi, so better uninstall first.

tsehp

ps: when rv makes this messages, it only detects that the file dates between rv.exe and tracer.Dll are different, you can also make a date change, but better download latest versions.

Hi JMI,
delete revirgin.exe thread.dll tracer.dll
reinstall using the second option "Repair" ;)

ps dicktator :D :
>>ok je remets une version complete en téléchargement
>>ich werde eine neue Version stellen habe download
It seems JMI doesn't understands what you are trying to explain erm don't have translator to translate ;PPP
JMI
11-06-2001, 12:12 PM
Just thought I'd explain the problems I've been having loading the new version 1.2b7 because it might help someone else who is making the same errors I was making. I had Revirgin 1.1 installed and running and it used thread.dll dated 4/1/01 and tracer.dll dated 4/23/01. Part of my original confusion was that I understood the initial instructions to be to install the dll's in the "system" folder. I assumed that meant the C:\windows\system folder.

Every time I attempted to install Revirgin 1.2b7 I got the "please update tracer.dll to the latest version in your %systemroot% directory" dialogue. Looking in my "C:\windows\system" folder I still had the "older" versions of the dll's, and assumed they hadn't been "updated" causing the program not to work. Part of my confusion was that I didn't realize that %systemroot% mean it was installing the dll's into "C:\windows", rather than into "C:\windows\system."

I then tried installed 1.2b6, and but because I was still looking in the "C:\windows\system folder" I saw only that the dll's again were not "updated," but the program now worked and identified itself as version 1.2. I then loaded version 1.2b7 "over" 1.2b6 and the program seemed to run, but there was no "refresh" button mentioned by Tsehp, but I assumed it was operating with the correct dll's, but was again wrong because I wasn't looking in the "root" directory of the "system" folder. It was actually running with the dlls from version 1.2b6.

Having now discovered that I should have been looking in the "C:\windows", rather than "C:\windows\system" folder, I deleted all tracer and thread dlls and reinstalled 1.2b7 and continue to get the error message.

Soloman's message mentions "*.sys" files and deleting those also, but a search of my "C:windows" and "C:windows\system" folders finds no "*.sys" files dated in 2001 so maybe this indicated he is not running Win98SE like I am. I'm not sure.

I believe I downloaded Revirgin 1.2b7 again after Tsehp stated he had recompiled it, but I will try again from the start, first trying to reinstall my current version of 1.2b7 with the repair feature, both with uninstalling first and without uninstalling, and then try again after downloading the file "again" and starting from step one.

Thanks again for the great program.
JMI
11-06-2001, 04:54 PM
Just a final report on the effort to make Revirgin1.2b7 stop putting up the dialogue that it needed an update of thread.dll.

Nothing I tried, including downloading the file again would get 1.2b7 to accept the dll that comes with the download, apparently because, as Tsehp stated, there is a difference in the date between the dll and the exe. The exe is dated 11/4/01 and the dll is dated 11/3/01. The only thing which seemed to work, as Tsehp also stated, is to change the date of one or the other to make them the same. Apparently Tsehp hasn't had time yet to upload a recompiled version, and considering all the good work he's been doing, it is not suprising.

Solomon stated that he used a "touch" command to change his date. I don't know what a "touch" command is, but had a successful result using WinCommander to make the dates of the exe and the dll the same. Should work for the rest of you until that next upload.

Tsehp - I'm wondering what resolution your using for your screen. On my machine the main dialog of Revirgin now overlaps the bottom of the screen and has a "thumb" to scroll to the bottom portion to see all of the controls. Not a problem to use at all and I can always adjust my own screen resolution to make it smaller.

Thanks again for a great tool.


trw2000 is a good crack tool !!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > trw2000 is a good crack tool !!!!
PDA

View Full Version : trw2000 is a good crack tool !!!!

coolgn
11-04-2001, 12:13 AM
:cool:
Bengaly
11-04-2001, 01:24 AM
well it can be handy i guess..
but why use old fashioned ? ;-)
Sice is much better...:)
also trw2000 keeps expire...so i kicked at it hehehe :)
anyway be sure to use what ever u need to help ya crack and contribute some how hehe ok , cya..
Bengy-
DakienDX
11-04-2001, 02:23 PM
Hello Bengaly !

Even if it doesn't expire ( :) ) I think it is not as handy as SoftICE for the kind of work we do.

It ignores about 10% of all BPX, 40% of all BPM and all BPR I set outside of APIs in the main program (0040xxxx normally)
McCodEMaN
11-05-2001, 10:59 AM
Greetings Bengaly and DakienDX!

Well, I'll agree that it's not as powerful as Softice!
However, sometimes when one don't need all that power, it's
fun to have an other tool to play with. :p :D

regards
McCodEMaN
binbin
11-11-2001, 12:24 PM
A good tool on win9x.
Need'nd install and i can take it in a floppy disk.
Unregistered
11-11-2001, 03:39 PM
huh, didnt knew that TRW has BPR (?) Is that true? What version are u using?


How to know which algo is used ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > How to know which algo is used ?
PDA

View Full Version : How to know which algo is used ?

MarcElBichon
11-04-2001, 03:08 AM
You can find on the net how to resolve many algo (cryptographs works)

But how to know which algo is used in software or crackme (TMG crackmes) ? Do there exit tutorials ?

thanks

Mike
decx
11-04-2001, 06:05 AM
First of all, when you know it uses some kind of encryption, see if you can detect the encryption type, is it hashing, secret key, or public key alike. Then you can look at the encryption initialization constants, like SHA and MD5 is easy to detect as they have some constants like :

T1 0xd76aa478
T2 0xe8c7b756
T3 0x242070db

etc. Many other algorithm has similar tags known as initialization constants. If you cant find any of those, try looking at the source code of the most likely to be used algos. I have a small archive os assembly listenings of encryption algos, this way i can compare the assembly code pretty quick to determine the encryption used.

But the question is not always to detect the encryption, its mainly a question about howto break it. You wont want to be factoring a large RSA, ElGamal or ECC. But for the hashing, small rsa's ( N <= 256bit max..) and secret key algos its definitely possible.
But be aware that some companies has simple proprietary encryption algoes designed inhouse, these are useually simple xor encryptions. Dont let that fool you, and happy cracking :)
decx
11-04-2001, 10:12 AM
I think i should post an example too, this is from MD5 used in a very popular CAD program.
Analysing the licensing system will lead you to the suspicion it uses some kind of encryption to generate and validate the keyfiles, actually it was simple since it contained names like NewUserHashFingerprint etc. So knowing it was a hashing algo was rather obvious, but determining the algo was done pretty quick too. Observe the assembly listenings below:

.text:5388C590 mov eax, [esp+arg_0]
.text:5388C594 xor ecx, ecx
.text:5388C596 mov [eax+14h], ecx
.text:5388C599 mov [eax+10h], ecx
.text:5388C59C mov dword ptr [eax], 67452301h
.text:5388C5A2 mov dword ptr [eax+4], 0EFCDAB89h
.text:5388C5A9 mov dword ptr [eax+8], 98BADCFEh
.text:5388C5B0 mov dword ptr [eax+0Ch], 10325476h
.text:5388C5B7 retn
.text:5388C5B7 sub_5388C590 endp
.text:5388C5B7

Now looking in md5.c we see this:
void
md5_init(md5_state_t *pms)
{
pms->count[0] = pms->count[1] = 0;
pms->abcd[0] = 0x67452301;
pms->abcd[1] = 0xefcdab89;
pms->abcd[2] = 0x98badcfe;
pms->abcd[3] = 0x10325476;
}

Pretty obvious huh? :)
Traceing further will also reveal the Tx constants.

When you see a call with a lot of ror, shr, mov, add, lea etc. juggeling with alot of numbers, you might want to look at it in ida and check out what it might be.
goatass
11-05-2001, 08:09 AM
Hey MarcElBichon, the toughest part is identifying what algo is used. You have to know the algorithms especialy how they check valid signatures or how they decrypt. I wrote a paper on keygening tE!'s keygenme #2 which used RipeMD-160 hashing and RSA signature. When I started looking at it I had no idea what I was looking at, so I looked around and I found places where error messages are generated and I saw some string refs. for MIRACLE so I started looking into crypto algorithms, checked out tE! site, got some source codes looked them over and looked over the disassembly of the keygenme and started labeling founctions until I isolated the checking routines, then identifying them was a bit easier.

You just have to know how signature checks, initialization routines, decryption routines, etc, for different algorithms look like in assembly and that will make life much simpler.

goatass
Sphinx
11-16-2001, 08:50 AM
hello all,

i know that something is using MD5 but how de hell do you start with reversing this??
thanks to this thread i could indentify the algo used but after this what do you do next?

i really could use some suggestions
I started searching for all info i can find about md5.

Thx Sphinx
DakienDX
11-16-2001, 09:46 AM
Hello Sphinx !

Reversing MD5??? Well, do it and you'll be a very rich man. :)

If you know that MD5 is used, you must find out how.

It could be used like "Serial = MD5(UserName)+MD5(EMail)" or "If MD5(LicenseFile) = RSADecryptedValue then FileInfoOK else RegBadFile".

I suggest to set a breakpoint in the MD5 proc, when you reach it, do a "P RET" and set a breakpoint on the call to the procedure. So the next time you'll know which data is hashed by MD5. After that you can trace further and se which value is compared to the hash value. Few patches for the beginning or keygen to go further and your problem is solved.

Easy, isn't it? :D
Unregistered
11-17-2001, 06:13 AM
Most MD5 implementations have 3 functions:

MD5Init - Initialize the MD5 hash variables
MD5Update - Update the MD5 hash against the data
MD5Finish - Translate the hash variables to a string (or was it 4 longs)

So you can rename the function names in IDA or something and it will make your job a whole lot easier.
Sphinx
11-20-2001, 02:56 AM
hello again,

thanks for the replies now i know how to start I`m on my way now.

l8er

Sphinx


Vbox 4.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vbox 4.3
PDA

View Full Version : Vbox 4.3

fla
11-04-2001, 06:12 AM
Hi there,

I'm not experienced in cracking packed applications.
I've read some tuts (tsehp.cjb.net & others), but I don't find the same code & the same addresses as in my sice.
I'm tryina crack VBOX 4.3 under WinME with sice 4.05.
(I tried different upackers too, but the result was an .EXE which doesn't run properly, of course.)

As far as I can understand there r different versions of VBOX 4.3.
Could some1 gimme any info/links/tuts/advices about VBOX 4.3 cracking ?

Thanx
DakienDX
11-04-2001, 02:36 PM
Hello fla !

You can't find the same addresses, since they differ in each version, but they code should be there.

Go to tsehp's page (tsehp.cjb.net) or use the direct link here (http://www.woodmann.net/fravia/dezzy_vbx43tut.htm)
McCodEMaN
11-05-2001, 10:43 AM
Greetings fla!

If you like you can try my essay, it's very easy to follow
(if you ask me..)!
TRES2000 (http://www.geocities.com/Vienna/Opera/5748/front.htm) (look for it at our essays).

So give it a try, if you still can't resolve it, let us know
where your at and we'll go from there..

regards
McCodEMaN
Unregistered
11-05-2001, 01:56 PM
DakienDX, McCodEMaN,
Thank u guys, 4 replying me this soon !

DakienDX: Yess, I think there r different versions even 4
VBOX 4.3...
(I've already read this essay. 10k u 4 the link anyway.)

McCodEMAn: I've had a look at ur page. Nice made, really. But my problems remain...
Wot I'm tryina say is that in ol essays (including ur too), there r such addresses & such a code:

0187:0700BB39 FF15C8210407CALL[KERNEL32!GetProcAddress]
0187:0700BB3F 8BF8 MOV EDI, EAX
0187:0700BB41 3BFB CMP EDI, EBX
0187:0700BB43 0F849D010000 JZ 0700BCE6
0187:0700BB49 8B7616 MOV ESI, [ESI+16]
0187:0700BB4C 037508 ADD ESI, [EBP+08]
0187:0700BB4F 395DDC CMP [EBP-24], EBX

The very problem is not that I don't understand the code, but that I don't find it. I bpx GetProcAddress & so on & so on, but I don't reach :700BB39 at ol... I tried 2 find it by scrolling the screen in SICE & I found it, but the code was not as the 1 described above...
I'll give 1 more try & if still nothing, I'll give u a snippet of the code I c in my SICE.
I begin thinking that there r different versions of VBOX 4.3 :|
Another thing that makes me think so is that... In the tuts I read, there was said that VBOX 4.3 doesn't detect SICE+ICEDUMP & TRW2000. Not true ! Tryina catch VBOX 4.3 with TRW2000 my comp hangs (blue screen), & with SICE+ICEDUMP VBOX 4.3 gives me a message that I use a debugger... (But only sometimes; sometimes not).

That's ol. 10x once again people 4 the help.
McCodEMaN
11-06-2001, 01:14 PM
Greetings!

Thats not true!
I've never written that vbox don't detect softice, and
I have a hard time beliving that Tsehp have made
this statement!
If you look at the beginning of my essay you'll see
that I used "Softice backdoor keeper" to bypass
this ADT!
An secondly, Vbox 4.3 will not detect TRW, if you use it
with: "Faults: off"

regards
McCodEMaN
fla
11-06-2001, 03:18 PM
...

First: A, yeah... I understand now that u r right about both SICE & TRW...
(I'm gonna try TRW again.)

Second: I tried wot is written in ur (& in other tuts):
1. I open my SICE & I bpx GetProcAddress.
2. I start the VBOXed application.
3. In my SICE I don't c the code u describe in ur tut, but after F12 I c the following:

016F:78003BF8 50 PUSH EAX
016F:78003BF9 FF15CC300378 CALL [KERNEL32!GetProcAddress]
016F:78003BFF 85C0 TEST EAX,EAX
016F:78003C01 0F8437B70200 JZ 7802F33E
016F:78003C07 6A00 PUSH 00
016F:78003C09 FFD0 CALL EAX
016F:78003C0B C3 RET

Wot's the problem ? :|

Third: As was in SICE, hunting around, I found such a string: 'VBOX 4.3.0.21 Special Build'. U know anything about that ?

10k u
McCodEMaN
11-08-2001, 07:55 AM
Greetings fla!

I can't at this first glance say that I rec. the version!
Anyway, the method is still the same, IAT.....then
find "jmp ebx",...edit... dump...fix...done!

regards
McCodEMaN
fla
11-08-2001, 04:00 PM
McCodEMaN - 10k u very much 4 ur reply. A... I think I'll have wot 2 do this weekend (reading some more tuts &... Keep tryin' ;)

10x once again.

P.S.
I tried with TRW200 - 'faults off', but... When I start the VBOXed prog & the TRW2000 is active - the blue screen of death appears :|
I think this is a new version of WeiJunLi's mind :|...
dads
11-08-2001, 07:56 PM
what is the proggie? And url?
Smile
04-15-2002, 05:08 PM
Hi, I'm new here and I'm also trying to crack an app protected with vbox 4.3

I've tried TWR2000 v1.22 and even with faults off vbox detects the debugger and doesn't start the vboxed app.

The app that I'm tryin to crack is located here "http://wcarchive.cdrom.com/pub/bws/bws_52/TurboCADProfessionalv8TrialNoReg.exe"

Very good CAD program. See "www.turbocad.com" for more details if are interested in the program.

If anyone experienced in using twr2000 or softice could help I would be very thankful.


Packed / dumped apps and IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Packed / dumped apps and IDA
PDA

View Full Version : Packed / dumped apps and IDA

Rage
11-04-2001, 10:36 AM
1) Whith non-packed apps everything is ok and IDA uses correct flirt signatures :) , but if the app (eg ASProtect) is packed - I unpack it, dump it and load it with IDA, wait till the analysys finishes and then I load FLIRT signatures, but nothing happens :confused: - the analasys (L1 - first pass of FLIRT) lasts only a few seconds and there are no functions found. Is there solution to this problem??

2) Is there a way to unpack pieces of code created with ASProtect macros REG_CRYPT_BEGIN and REG_CRYPT_END. Can caspr do it (or any other unpacker?), can it be done manualy?
tsehp
11-05-2001, 04:21 AM
concerning your second question, and imho :
the crypted parts are made with elliptic curve scheme and a external key is used to decrypt them if you buy the program. So consider them just like they were missing from the code, you've got no way to decrypt this.
Dr.Golova
11-05-2001, 07:39 AM
1) Just correct sections attributes for code section (must be executable).
2) For decrypting you need valid license key :( If you have it, use it, run "hidden" feature, and crypted code wall be decrypted by ASProtect kernel. Now just dump code section and paste it to dump. May be little patch needed after this operation - program must be sure thet hi is registered for running encrypted part.
Rage
11-05-2001, 02:36 PM
Thanks :cool:


Secrets & Lies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Secrets & Lies
PDA

View Full Version : Secrets & Lies

Bengaly
11-04-2001, 11:38 AM
heya all..

today i found at our libary at coolege/uni the book
"secrets&lies" by Bruce Schneier
the same author who wrote "applied cryptography" book...
i think i am going to scan and Reweite it to TXT format, else there is already an ebook on it...tell me what you think ?
DakienDX
11-04-2001, 01:31 PM
Hello Bengaly !

I don't know what the book is about. Would you mind telling us something more specified? (apart from "lies behind cryptography")

I think you should know if really someone is interested in this before scanning a whole book.
tE!
11-04-2001, 06:12 PM
/me ist interested
Woodmann
11-04-2001, 07:57 PM
Thats a mighty big book to scan. (400+pages i think)

I doubt there is an E-book, he has already written about the flaws in Ado**s E-book format.

Peace, Woodmann
Solomon
11-05-2001, 06:17 AM
I don't think TXT format is a good format for e-books;)
but we should say thanks for your warm-heart.
Bengaly
11-05-2001, 09:04 AM
this is what written in the Back of the book for description:

"just as applied cryptography was the bible for cryptographers in the '90s, so secrets and Lies will be the official bible for INFOSEC in the new millenium, i didn't think it was possibal that a book on business security could make me laught and smile, but schneir has made this subject very enjoyable "

The author says this:

" i have written this book partly to correct a mistake.
Seven years ago i wrote another book: Applied Cryptography.
in it I described a mathematical utopia: algorithms that would keep your sepest secrets safe for millenia, protocols that could perform the most fantastical interactions,-unregulated gambling, undetectble authentication, anonymous cash-safely, and secretly.........bla bla
The result wasn't pretty, readers belived that cryptography was a kind of magic security dust that they could sprinkle over thier software and make it secure.....bla bla

got the idea?

hope so tell me if u think i should make it an ebook or something.
bye
bengaly
McCodEMaN
11-05-2001, 10:17 AM
Greetings Bengaly!

As Woodmann said, it's a mighty big job, but if you feel that
you're up for it, I for one will read it!

regards
McCodEMaN
ZenLoren
11-08-2001, 04:11 AM
Hi Bange!

Just to let you know don't forget to use OCR FineReader 4 or 5
on scanned pages. Will convert the text 90-95% accurately.

Good Luck
Regards,
ZL
McCodEMaN
11-08-2001, 06:04 AM
Greetings ArthaXerXes!

Yes, that would be one way to obtain the information, if anyone like to buy it, it's about $17.99 at Amazon.com!

regards
McCodEMaN
Bengaly
11-08-2001, 08:54 AM
Heya fellas..

i am using Ommipage v5.0
and it does the work greate only minor stuff like letter 'e' / 'r' needed to be edit, other it works great..
i have sent tE a beta including the first 5 pages, and he said it looks cool, so i will continue scanning it and will post it when finished..if hehe takes too MUCH time..

yeah i respect the idea of buying the book, i rather support the author, but i have no visa Card so.... heheh

anyway Bruce has allot of money :)
BlowFish took him High :)

also i found at libary another Crypto book , i forgot the name ao i will post it later something about "internet security" name, really cool stuff with math and explanations, so i would like to scan it as well..

Cya all for now.

Bye bengi
McCodEMaN
11-08-2001, 11:33 AM
Greetings Bengaly!

Sure, I know what you mean, one can perhaps not
buy all books, that one wish to read.
It would be kind of expensive....
Anyway, I can't wait to see the final result!

regards
McCodEMaN
mike
11-09-2001, 11:53 AM
He didn't make ANY money off of Blowfish or Twofish. Both are free and in the public domain. He is making money off of the solutions he proposes in Secrets and Lies.
newham
11-09-2001, 11:29 PM
Thank you, Bengaly. but can you post here how the project is going? i want to read it eagerly.

newham
disavowed
04-07-2005, 12:39 AM
I just stumbled upon this thread while searching for something else. I read this book a few years ago. For those of you who are considerring reading it, don't waste your time. I can sum up the entire book with the following: "Systems are complex and are difficult to secure."
mike
04-10-2005, 08:56 PM
Yeah, Bruce didn't write that book for security people; he wrote it for managers & suits who often think that security is a feature you can add in after-the-fact, that it's a product you can buy.

You summed it up very well, but Bruce was trying to beat it into their heads with every illustration of that point he could think of.


Revirgin problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Revirgin problem
PDA

View Full Version : Revirgin problem

neetocin
11-04-2001, 05:01 PM
I have just installed Revirgin 1.2 beta build 7 on my Win98 computer and rebooted. No matter what I try can't get it to start. It complains: "Please update tracer.dll to its latest version into your %systemroot% directory" I have try moving tracer.dll to C:\, C:\WINDOWS\System, and C:\WINDOWS\SYSTEM32. I did a fresh install and should have no problems. Anyone help?
Solomon
11-04-2001, 07:00 PM
I got the same problem. Maybe there is a version mismatch between the EXE and DLL in the "Revirgin.MSI".


Unpacking SafeCast [Help]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking SafeCast [Help]
PDA

View Full Version : Unpacking SafeCast [Help]

TheBlock
11-04-2001, 08:56 PM
how can i unpack a program packed with safecast.
How can I find the OEP?
How can I fix the IAT?
Please need help.
The only thing I have found about Safecast is the tsehp & R!sc that only explane how to reset the time limit.

Thank You in advance
TheBlock


Unpacking SafeCast [Help]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unpacking SafeCast [Help]
PDA

View Full Version : Unpacking SafeCast [Help]

TheBlock
11-04-2001, 09:11 PM
how can i unpack a program packed with safecast.
How can I find the OEP?
How can I fix the IAT?
Please need help.
The only thing I have found about Safecast is the tsehp & R!sc that only explane how to reset the time limit.

Thank You in advance
TheBlock


Crypkey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crypkey
PDA

View Full Version : Crypkey

peterg70
11-04-2001, 10:22 PM
Originally posted in TOTT

Hi Guys,

Need some help

First off
Target http:\\www.rebis.com
Under Support/Security Rebis Security Manager.

Things i know so far.
Uses Crypkey and each package in the software has different master/user keys.
Version cryp95e.dll present and used.
Reblock.exe is exe used for calls. Able to trap with w32dasm and examine.

What i would like help with
I would like to use the SiteKey Generator that is supplied with the SDK for Crypkey to Create licenses for this product. If i enter the site key for the product into the SiteKey Generator it tells me it for another company.

Have worked out that each client has a companynumber and passnumber. (I Have found these - part of Ckchallenge)

What i want to do is rekey the sitekey generator for my companynum/passkey so that it will generate the codes correctly so that i can register each component as i like.

I would rather a keygen than a hack since continous upgrade/patchs will make me hack again and again. Plus multiple hacked over 18 applications each with their own codes/keys

Any help is appreciated.
rcecd_request@yahoo.com
Unregistered
11-06-2001, 05:31 PM
Bump
peterg70
11-08-2001, 05:29 AM
Come On i need some help here

No one done a Crypkey generator software????????

The software is available and ready for download from the web site.

Anyone else working on crypkey.
Solomon
11-08-2001, 07:57 AM
Unpacking a CrypKeyed prog is a 5-minute task, while keygenning it may cost several days or more.

So why don't we choose the easier way?;)
Kythen
11-08-2001, 11:49 AM
Crypkey is not just a packer. About a thrid of the apps that I've seen use it have it included as regular library/dll calls. Unless you're good and experienced at keygens (especially crypto), stick with patching.

Regards,
Kythen
Solomon2000
11-08-2001, 07:02 PM
yes Kythen you are right. I forgot the other Crypkey formats.
peterg70
11-09-2001, 05:37 AM
Guys

I can't patch because of checks and other little things that have been coded into software. Simplest way to bypass security is to generate the right code.

Also alot of licenses to crack for (18 Applications)

Plus everytime i upgrade i need to do this all over again.

What i need to do is use a keygen for this that has options for each module.

I have the SDK for crypkey which has a keygen for their examples which is hardcoded to their example codes. I want to modify this so i can use it for any company/product codes.

Kythen : your right i'm not a keygen crypto person THATS why i asked for help.

TIA
Kythen
11-09-2001, 06:26 PM
Checks and other little things? Sounds like more fun, not a reason to stop! :)

Regardless, what I would suggest trying is patching the crypkey dll's themselves, not your target app. Make an emulator of sorts, much like you would for a dongle protected app. I believe CrackZ used such a method in one of his tutorials, so you may want to check that out for examples. You shouldn't have to modify the emulator much, if at all, between upgrades of your target. Only when a different version of crypkey is used will a major change be needed.

I'm sorry if this isn't the answer you're hoping for, but I really believe that one should try and take things a step at a time when learning cracking. Just jumping in over one's head more often than not leads to little understanding and mostly discouragement, and my goal is to help ppl... not lead them into some false sense of understanding.

Cheers!
Kythen
CDotic
11-12-2001, 03:56 AM
Hello Peterg,

I am Rebis user. I have generated keygen for it. But it was old style (homemade) protection. The new one is Crypkey.
I am still not moved to new Rebis products. But Crypkey solving will be interesting in the future. Some scenarios:

Scenario 1. Historical retrospective
1. Is Crypkey keygenned sometime? Yes by mr.Duelist (Core) - "Crypkey Instant 5.x include keymaker". Good.
Crypkey Instant is protected with Crypkey of course. This keymaker is suitable to ALL Crypkey protected software (with the same release). Good.
2. As it always happens - Rebis uses newer Crypkey version. Bad.
3. What inside the Duelist's keygen? Look into cr-ck50.exe. Compiled with Intel compiler 4.5. Wow, SSleay library (v.0.9.x) ! Heavy crypto? Bad.
You can find SSleay source, build it, generate Flirt signatures, apply signatures to IDA disassembled code. Seems only basic big number routines inside (mod, exp,...). Not so bad.
4. So how the Duelist's keygen worked and what is changed in Crypkey new version?...

Scenario 2. Guess-work attack
Crypkey allowes key moving. Idea is key info substitute (in process memory) when key is decrypted from old place, but still not encrypted to new one...

Scenario 3. SDK investigations
You have SDK for Crypkey.Nice! There are variants...

Best regards,
CDotic
peterg70
11-12-2001, 06:48 AM
Nice to see someone else who has or will have same problems as i do now

A few notes.
Duelist Keygen doesn't work at all for products that require options. Rebis makes you select different options therefore never have been able to use duelist keygen.

Crypkey found out about the keygen and modified their system to ensure the keygen didn't work.

I think the SDK is the way too go.

I have found company number/product id and site code but need to modify the site keygen to use it correctly.

If you need the SDk can point you in the correct direction
CDotic
11-13-2001, 02:02 AM
Hello Peterg
CYM
Regards


SI 4.05 and WinME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SI 4.05 and WinME
PDA

View Full Version : SI 4.05 and WinME

Unregistered
11-05-2001, 02:16 AM
I know you guys are going to kick my ass, but..
I have seen some posts on here about WinME users using Softice 4.05..

HOW? it just crashes my system..
can someone direct me to a page on setting it up? thanks!

testure
zeroone
11-05-2001, 04:11 PM
you can try it.

download the patch of softice 4.05 for windows me.
http://kernel32.top263.net/sice4me.zip

and use it.

good luck!
Phueghy
11-06-2001, 12:19 PM
there used to be some link whre its detailly explained.. i hope i'm gonna find it..
i guess u need the WinNT DDK in order to use SICE with WinME.
a, just found it. use the instructions from NuMega @
h**p://www.compuware.com/products/numega/drivercentral/tech_tips/windows-me_6_30_00.htm

regards, Phueghy
DakienDX
11-06-2001, 02:04 PM
Hello Phueghy !

Please DON'T post direct links to shareware pages, since they can trace from which page the access came.

What would M$ say if they see that someone is comming from this page. (where we discuss how to remove their copy protection)
Or what would NuMega say? I think most of us don't legally own SoftICE.

I think we've enough problems without this.


Need some help for revirgin 1.2 feature
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need some help for revirgin 1.2 feature
PDA

View Full Version : Need some help for revirgin 1.2 feature

tsehp
11-05-2001, 04:14 AM
Cause I'm lacking some time , I need some help from a c++ programmer.

first possible task :

In rv since 1.2 , you've got a fetch iat feature, this feature is simply a recursive c++ function that searches for calls and tests then if they lead to an iat entry. It starts from oep and follows all calls until such entry is found, then another small routine tries to locate iat start rva + length.

Actually the function is pretty simple and needs to be improved/debugged, sometimes it goes into some endless loops especially with apps with self-modifying code...

second possible task :

I'm also planning in the future to integrate into rv some countermeasures again anti softice tricks. The purpose is not to reinvent the weel as icedump/frogsice are fully covering the problem. But those features are not very well covered on win nt at this time, to my knowledge only ntall from pulsar is available, but made in year 2000 and not updated.
Revirgin already uses a small device driver called rvtracer.sys, so if someone wants to improve it to cover such topics, please contact me.

If someone wants to help, I'll send this person the necessary sources to test this feature, rv is mainly coded with c++ builder 5.

I'm closing this thread, thanks to mail me directly :
tsehp@yahoo.com

regards.


Opnet Modeler 7.0 Licensing system
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Opnet Modeler 7.0 Licensing system
PDA

View Full Version : Opnet Modeler 7.0 Licensing system

maneeshs15
11-05-2001, 08:51 AM
Dear Woody and All,

I have a really interesting problem on my hands. This is regarding Opnet modeler 7.0 which is a network simulation software. I installed a copy of this software but it is asking for a license. Since I dont have a license it prompts me for a add license wizard. This wizard has 4 options. Offline, Email, Express and some other option. I tried cracking at the offline option. Tried using the W32 dasm. It crashes and gives a Dr Watson error on NT. Then I tried Softice which works fine but I am unable to sort the logic behind the code. It jumps to some opvoss_Thread_data_key function everytime there is a call to a dll export. From there it is getting some GetTLSValue call to kernel32.dll. Being a amateur at cracking I need the assistance of you guys.

:) Something about myself I am 29 from India working as a network designer for AT&T Solutions. Anyone please feel free to contact me in case of any specific issues that I can address. I am attaching the files modeler.txt which is decompiled for of the exe file modeler.exe. For guys who like challenges, the entire package can be downloaded from : -ftp.lri.fr/LRI/soft/asspro/alagha/Opnet.zip

Anyone need a Netviz4.0 cracked dll nvlic32.dll please contact me. That is my first crack and proud to do that although it was easy. My e-mail is maneesh_sharma@yahoo.com

Bye and take care

Waiting for some desperately needed help

Maneesh


c++ question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > c++ question
PDA

View Full Version : c++ question

UnderCover-
11-05-2001, 02:26 PM
hello,

i'd like to know if i can use GetWindowText and SetWindowText in this case, i've been trying all day long and im getting error after error:

int nada;
int entered = GetDlgItemInt(hDlg, EDIT_NAME, &nada ,true);
int calc = entered * 31337 ;
calc = calc - 9989 ;
SetDlgItemInt(hDlg, EDIT_SERIAL, calc, TRUE );

tnx in advance.
UnderCover
Solomon
11-05-2001, 07:05 PM
what's the error message of your compiler?
That's important:D

try SetWindowTextA instead of SetWindowText. Actually SetWindowText is only a macro. It's not a function. It will be translated into SetWindowTextA or SetWindowTextW by the pre-processor according to another macro UNICODE.

<winuser.h>

#ifdef UNICODE
#define SetWindowText SetWindowTextW
#else
#define SetWindowText SetWindowTextA
#endif // !UNICODE
UnderCover-
11-06-2001, 10:27 AM
int nada;
int entered = GetWindowText(hwndnumber,serial,sizeof(number)); // user will only enter numbers
int calc = entered * 31337;
calc = calc-9989;

until this part it compiles but when i try to print calc using SetWindowtext i get:

error C2664: 'SetWindowTextA' : cannot convert parameter 2 from 'int' to 'const char *'
Conversion from integral type to pointer type requires reinterpret_cast, C-style cast or function-style cast

here is my SetWindowtext : SetWindowText(hwndserialshow,calc);
UnderCover-
11-06-2001, 01:44 PM
Hi,

lemme tell what i need:
use GetWindowText to get what the user input (it'll be only numbers)

suppose he enter "123" then i'll do

x = 123 * 31337

then i want to use SetWindowText to put x on screen.

Regards
UnderCover
AllYourBase
11-06-2001, 03:16 PM
You need to convert the calc from an integer to the list of characters representing the integer probably using wsprintf:

int wsprintf(
LPTSTR lpOut, // pointer to buffer for output
LPCTSTR lpFmt, // pointer to format-control string
... // optional arguments
);

eg:

char szBuffer[255];
wsprintf(szBuffer, "%u", calc);
SetWindowText(hwndserialshow, szBuffer);
UnderCover-
11-06-2001, 06:16 PM
Hello,

suppose i enter 1234 as number doing this manually i should get 2994004 as serial but im getting -546467

int calc,nada;
nada = GetWindowText(hwndnumber,serial,sizeof(number));
calc = nada * 2.8678;
calc= calc - 546487;
wsprintf(final,"%d", calc);
SetWindowText(hwndserialshow,final);

i think the program is assuming nada is the size of serial here :
nada = GetWindowText(hwndnumber,serial,sizeof(number));

if anyone can help me with this
tnx in advance.
AllYourBase
11-06-2001, 06:26 PM
GetWindowText returns the length of the text (assuming its successful) not the actual text:

Return Values
If the function succeeds, the return value is the length, in characters, of the copied string, not including the terminating null character.

Instead use StrToInt on the variable which recieves the window text (serial?)

eg:

calc = StrToInt(serial) * 2.8678
Unregistered
11-06-2001, 06:55 PM
hello,

what should i declare to use strtoint ?
error C2065: 'StrToInt' : undeclared identifier
Solomon
11-06-2001, 07:12 PM
try this:

wsprintf(final,"%lu", calc);

"%lu" means "long unsigned integer".:D
UnderCover-
11-07-2001, 01:21 AM
Hi solomon, thats not the case :/
the problem is getting wha the user inputs in GetWindowText and multiply with some value.

what the user inputs i char so i think it needs casting or something like that.
Solomon
11-07-2001, 01:50 AM
use atol( ) to convert string to integer
#include <stdlib.h>

pls refer to MSDN for the following C runtime functions:
atof, atoi, _atoi64, atol
UnderCover-
11-07-2001, 02:02 AM
char number[100]={0};
GetWindowText(hwndnumber,name,sizeof(number));
atol(number);

error C2296: '*' : illegal, left operand has type 'char [100]'
Solomon
11-07-2001, 02:19 AM
char number[100]={0};
GetWindowText(hwndnumber, number, sizeof(number));
int n = atol(number);
n *= 2237;

I just compiled the above code with VC++ 6. It works.
Try changing "char number[100]={0}" to "char number[100]".

Originally posted by UnderCover-
char number[100]={0};
GetWindowText(hwndnumber,name,sizeof(number));
atol(number);

error C2296: '*' : illegal, left operand has type 'char [100]'
Unregistered
11-07-2001, 08:14 AM
tnx solomon it worked :) i just had to change n *= 2237; to n = n * 2237;

dunno why..
Clandestiny
11-07-2001, 04:43 PM
Originally posted by Unregistered
tnx solomon it worked :) i just had to change n *= 2237; to n = n * 2237;

dunno why..

Hiya,

n *= 2237 is just another way of way of saying n = n * 2237 and both of these expressions should evaluate exactly the same. This notation is just a syntactical shorthand in the C language. Of course, you can also use the other arithmetic operators in this way ...+=, -=, /=...ect.

Regards,
Clandestiny


SoftIce v4.05, VB6, and Win2kSP2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce v4.05, VB6, and Win2kSP2
PDA

View Full Version : SoftIce v4.05, VB6, and Win2kSP2

acidx
11-05-2001, 07:42 PM
I sat down, wrote a simple vb program that had username and password authorization all hard coded into the program. The reason for this was to learn more about softice. Now, i load the exports for msvbvm60.dll and set a break point on anything to do with the vb dll and the program never breaks into softice when it gets called. Any comments and/or suggestions would be greatly appreciated
Aimless
11-06-2001, 04:49 AM
I trust that you have used SOFTICE to shift to your applications address context, BEFORE setting the breakpoing?

Trust you have already DONE your regular "ADDR yourapp" ~before~ setting something like "BPX crackfunction".

...Have Phun
acidx
11-06-2001, 10:53 AM
thank you for replying, and no i wasn't doing what you mentioned but even when i did figure that out nothing really seemed to change unfortunately. it still just won't break.
Unregistered
11-06-2001, 01:10 PM
Hi,
if you also have msvbvm50.dll in your sys folder then when you set a bpx use msvbvm60!__vbawhatever rather than just
bpx __vbawhatever, try that anyway, dont forget two underscores.
acidx
11-06-2001, 01:25 PM
i think i've tried virtually everything. in my winice.dat i have

EXP=C:\WINNT\system32\msvbvm60.dll

I load the program, Project2.exe it's a p-coded vb6 program that i coded for testing like i stated above.

i load the vb program using symbol loader, set the break point using

bpx MSVBVM60!rtcMsgBox

since i figure if it's going to break on anything it should break on the damn messagebox the program shows. I've also tried the ADDR command before setting the breakpoint and that doesn't help whatsoever it seems.

from there i enter the X command to return to the program, click the command button that checks the user/password's with the hardcoded ones in the program. and softice never breaks.


Where to get rtm compatible with tlink?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where to get rtm compatible with tlink?
PDA

View Full Version : Where to get rtm compatible with tlink?

Mtz
11-06-2001, 12:08 AM
First I found tasm32 and tlink32. Then I found, that I couldn't compile the examples on tuts with them. (16-bit segments, what can I do about it?) After this I found tasm and tlink. I realized, that tlink needs this rtm.exe to run. I had one one my hd, but it just causes an error (unhandled exception or sthing like that..) Where could I get a version which works with tlink?:confused:
Solomon
11-06-2001, 12:19 AM
why don't you search for it?

Just type "tasm5.zip" in google, you will get the 4MB TASM 5.0.
for example, h**p://bigluo.tz163.net/download/tasm5.zip
Mtz
11-06-2001, 03:17 AM
Well, I was just looking for the one file, not the whole tasm5. In fact I think that I have an older version. Maybe I should dnld this Tasm5 then. Thank you!

-Mtz


Flair38
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Flair38
PDA

View Full Version : Flair38

Unregistered
11-06-2001, 09:23 AM
Anyone got (or know where to get) Flair now that datarescue has pw prot. the folder?

TIA
DakienDX
11-06-2001, 09:58 AM
Hello TIA !

Please try here :

46 4C 41 4D 45 53 2C 20 43 52 41 43 4B 20 41 4E 44 20 53 45 52 49 41 4C 20 52 45 51 55 45 53 54 53 20 57 49 4C 4C 20 42 45 20 52 45 4D 4F 56 45 44 2E
Guest
11-09-2001, 06:50 AM
DaikenDX ! Stupid Motherfucker !
DakienDX
11-09-2001, 09:04 AM
Hello Guest !

Why are you so rude to me?

I just translated the forum description to hexadecimal.

I just repeated in short what was said by ArthaXerXes in his Announcement. It should be there until 11-20-2001, but when it vanishes, it doesn't mean that the unwritten law vanishes too.

Originally posted by ArthaXerXes
Please, do not post cracks/warez requests in any forum, especially not in TOT.

TOT is to discuss the tools, not to get them ! This includes, without being restricted to, Driver Studio and IDA.

Using pirated versions is a common thing for a cracker, but this does not enables you to post requests here. Ask your friends or search the web if you need something.

Requests will be simply deleted without prior notice.
Guest
11-10-2001, 07:33 PM
Originally posted by DakienDX
Hello TIA !

Please try here :

46 4C 41 4D 45 53 2C 20 43 52 41 43 4B 20 41 4E 44 20 53 45 52 49 41 4C 20 52 45 51 55 45 53 54 53 20 57 49 4C 4C 20 42 45 20 52 45 4D 4F 56 45 44 2E

Translation is "FLAMES, CRACK AND SERIAL REQUESTS WILL BE REMOVED." Anyway I bet he felt special that he was able to do that and everyone should be happy that DakienDX has such skill. Can't answer a simple question with a simple response. Figures. Hmph.

Snatch
DakienDX
11-11-2001, 05:10 AM
Hello Snatch !

OK, your oppinion.

Posting the same text in many replies gets a bit boring after some time, because many people ask for warez or cracks on this board.
Since I don't want to change the contents of the sentence, I've to change it's outlooking.
I could have also used RSA-399 to encrypt the message, but who would have been able to read this after that?
If I'd posted the plaintext (I know the hex is 'plain'), 'Unregistered' might have just looked at it, said 'HAHA' and posted a new request. This way he had to do some work to find out that not everything is as easy as he thinks.

Most people here see that the hex does not start with 'www' or 'http'. So it isn't interesting to them.
Solomon
11-11-2001, 06:23 AM
hehe :D


softice 4.05 - load up problem HELP!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice 4.05 - load up problem HELP!
PDA

View Full Version : softice 4.05 - load up problem HELP!

koza
11-06-2001, 10:27 AM
i've got softice 4.05... win 98 and S3 Virge DX graphics card.
it used to work fine.. but now when i load it up through the autoexec.bat entry.... i get first the memory report fine... then the next screen screws up something like

While initializing device SICE
(some garbage chrs. here)

then windows shuts down....

this happened to me once before... but got corrected when i had to reinstall windows on my machine. is there any way short of complete windows reinstall to correct this???


Unpacking PELocknt v2.04 (modified by Xoanino)...?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unpacking PELocknt v2.04 (modified by Xoanino)...?
PDA

View Full Version : Unpacking PELocknt v2.04 (modified by Xoanino)...?

DGR
11-06-2001, 01:54 PM
I'm a complete newbie at unpacking, but I have this program packed with the thing mentioned above. Now I'm running Windows2000 (and soon XP) and this packer doesn't work on 2k :/ Now I wanted to see if it's possible to unpack it, but since I only have win2k installed that would mean I also have to install Windows98.

So, is it possible to unpack this... has anyone done it in the past... does anyone have some tutorials/info I can read before attempting. (Basically I want to know if it's possible/done so that I don't start installing Windows98 for nothing, hell... can hardly believe I'm gonna install 98 just for this heh).

Tia and take care,

DGR
DakienDX
11-06-2001, 02:22 PM
Hello DGR !

First of all, PELockNT works fine on Win95, Win98, WinNT4, WinNT5 ! I don't know what problems you've got on Win2000(perhaps running a debugger :eek: )

As far as I remember, unpacking PELockNT was a interesting, but also very long way.

If you want to, I can send you a unpacker by xOANINO for all versions.
DGR
11-06-2001, 03:58 PM
Well, this is a version of PelockNT modified by Xoanino :) So his unpackers don't work (think I tried those) and maybe that's also the reason for it not working with win2k. Anywayz, I found a deprotected version of the file, running fine in win2k... so no need to install 98 again ;)

Cheers for the help tho hehe
xoanino
11-09-2001, 05:21 AM
Uahahahahhahahahahh :) Never thought to see a thread like this :)

You're trying to unpack Impact emulator, right ? :)

Anyway, let's see if i remember .... there's nothing trivial changed in pelocknt, just encryption keys of the various layers.....

If you have the source code to my unpacker (u should, coz i distributed it if i remember), try to change the keys to "SARA" (in hex) or "ARAS".... it should work that way.

And also the exe identifier tag, should be "SARA" or "ARAS", or the modified unpacker can't recognize the file.

As far as i remember, that should be the only changes needed.
Recompile the source and try.
peterg70
11-09-2001, 05:44 AM
Hmm Impact Emulator.

Is that still around. I thought it was stopped from development??

Damn that was a good emulator just wished it had kept going in development.

A se la vita
DGR
11-09-2001, 11:03 AM
Hehe, it was indeed the Impact emulator :)

Well, it was hard to find any nfo on unpacking pelocknt in general, let alone with the mods u added Xoanino but in the end appearantly it was quite easy. But yes, impact works fine now on 2k and that was the only reason for me wanting to unpack it.

Thanks for the reply tho Xoanino, I think I might unpack it for fun later newayz ;)

Take care,

D.
^DAEMON^
11-16-2001, 07:41 AM
nice to see xoanino is still alive! hmmm never tried pelocknt but anyway each protection can be broken.... maybe if there is no poly layer u don't need an debugger... just a disassembler!
disassemble - cut & paste -> emulate everything

^DAEMON^
DakienDX
11-16-2001, 09:38 AM
Hello ^DAEMON^ !

If this task would be so easy, why should we use SoftICE?

"just a disassembler" - and an assembler, or do you calculate fifty xor, add, sub, ror, rol, ... in you hex-editor?

Nice avatar! I remember having seen it somewhere, but I don't know where at the moment. :D
^DAEMON^
11-16-2001, 02:25 PM
hmmm just copy and paste that's enough, u can defeat EVERY protection this way (just emulate the shit)

worx perfectly for k-kryptor...

^DAEMON^
DakienDX
11-16-2001, 02:44 PM
Hello ^DAEMON^ !

I don't know k-kryptor. Would you mind to tell me where I can find it and how to 'emulate' everything?
Why "just copy and paste"? I don't understand that. Perhaps I do if I find k-kryptor.

Btw: What do you mean by your signature?

---------------------------------
THE BIG PINK PUSSY IS BACK
---------------------------------

My signature is pink and you use my avatar. I know, everyone registered here can use it. But what do you want to say with that?
Unknown One
11-17-2001, 12:45 PM
Hi

First I would like to greet Daemon and Xoanino for their great work on unpackers!

Now about the cut and paste stuff while coding unpackers. Someone asked before a year in UCF's channel about unpacker for the modified by Xoanino PELOCKnt. I got the file (it is the same Impact emulator) and began to analyze it.

I already wrote in this forum about using only disassembler to defeat protector and I made decrypting of the PELOCKnt layer (only) using w32dasm, hiew and my lovely tool MOW.

PELOCKnt (as most protectors) uses a lot of fake jumps to make tracing longer and annoying so I removed them everytime I removed an internal encryption layer using MOW by Stonehead (an modified version where I added some more macros used in newer protectors: EB02CD20 for example :-)

After MOWing the file I ripped the first layer to my program (it is DOS asm code which loads last section of the file, processes it and writes back to the file :-). Then ran my program on the crypted file (always working with copy of it). These steps are done until all startup internal decryption layers were ripped.

After ripping the last internal layer I used again MOW to get the whole protector layer cleaned (of course manual cleaning with MOW is required for some fake jumps :)

Analyzing the rest of the protector part (after the internal decryption layers) took me some time but I found the changed encryption keys (as Xoanino already wrote) and changed them in his great unpacker. After simple recompiling and running it on the Impact emulator I got it decrypted (still compressed with PE-PACK 0.99 - greets to ANAKiN for his best implementation of aPLib - it still beats most packers using even the latest version of this compression library).

The rest of unpacking is easy :-)

BTW the PELOCKnt 2.04 works under win2k :) I did all unpacking job under this OS and tested if the file works of course.

If anyone is interested I can send him my DOS source and some text files with the ripped parts of the modified PELOCKnt.

The part where Daemon talks about cut'n'paste and emulating is interesting when fighting with protectors which use SEH in their decryption code. Emulating means replacing all instructions that cause exception with a call of the ripped exception handler (Hi, Daemon :-)

I think that's enough about unpacking without using debugger. If there are any questions you can contact me at unknone@mail.com or on IRC.

Best regards
Unknown One/[TMG]
^DAEMON^
11-19-2001, 07:12 AM
Hi dakien, i just took the avatar coz i think it's a nice one

the big pink pussy has nothin to do with you - just my quit message normally used in efnet.....

cut & paste is best u can do!
(hi UNO :) i'll come back SOON!)

k-kryptor can be found on all latest programs done by risc
like unsafedisc or poxylok.... u can find em everywhere....
just download em and try to break the protection :) u'll like it!

^DAEMON^
Unknown One
11-20-2001, 07:15 AM
Some people asked be about tutorial on ungeneric unpacking and using disassembler only for cut and paste approach of coding unpackers.

There is a short example using disassembly of PELOCKnt 2.04 unmodified version (same for the modified Impact emulator). The source code given below is used on the modified PELOCKnt and works only for it because it reads part from the file at constant offset - no PE header analyze is done.

Tools used:
HIEW, TASM, MOW (with few macros added by myself - read at the end about them), text editor, hex calculator

1) Open in hiew the target file (PELOCKNT.EXE). Press enter twice until you get the disassembly view. Press F8 to show PE header and F5 to go to the entry point. You will see next code:

.00057000: EB03 jmps .000057005 -------- (1)
.00057002: CD20C71EEB03 VxDcall 03EB.1EC7
.00057008: CD20EA9CEB02 VxDjmp 02EB.1CEA
.0005700E: EB01 jmps .000057011 -------- (2)
.00057010: EB01 jmps .000057013 -------- (3)
.00057012: EB60 jmps .000057074 -------- (4)
.00057014: EB03 jmps .000057019 -------- (5)
.....

It's full of shits, isn't it? :confused: Better to go to the next step :D

2) Run MOW on the target file. Open the file PELOCKNT.NOP with hiew and go again to the entry point as done in 1). You will see next better looking code:

.00057000: 90 nop
.00057001: 90 nop
.00057002: 90 nop
.00057003: 90 nop
.00057004: 90 nop
.00057005: 1E push ds
.00057006: 90 nop
.00057007: 90 nop
.00057008: 90 nop
.00057009: 90 nop
.0005700A: 90 nop
.0005700B: 9C pushfd
.0005700C: 90 nop
.0005700D: 90 nop
.0005700E: 90 nop
.0005700F: 90 nop
.00057010: 90 nop
.00057011: 90 nop
.00057012: 90 nop
.00057013: 60 pushad

Now scroll down until you reach the first internal decryption layer. You will recognize it very easy (as in most protectors :)

(I removed most NOPs because they are waste of space)

.00057038: E800000000 call .00005703D -------- (1)
.0005703D: 90 nop
.00057041: 90 nop
.00057042: 5E pop esi
.00057043: 90 nop
.00057047: 90 nop
.00057048: 0F014EF4 sidt [esi][-000C]
.0005704C: 90 nop
.00057053: 90 nop
.00057054: 83C65F add esi,05F ;"_"
.00057057: 90 nop
.0005705B: 90 nop
.0005705C: 8BFE mov edi,esi
.0005705E: 90 nop
.00057061: 90 nop
.00057062: B90B260000 mov ecx,00000260B
.00057067: 90 nop
.0005706D: 90 nop
.0005706E: B487 mov ah,087 ;"Ç"
.00057070: 90 nop
.00057077: 90 nop
.00057078: AC lodsb
.00057079: 90 nop
.0005707F: 90 nop
.00057080: 32C4 xor al,ah
.00057082: 90 nop
.00057085: 90 nop
.00057086: 32C1 xor al,cl
.00057088: 90 nop
.0005708D: AA stosb
.0005708E: 90 nop
.00057091: 90 nop
.00057092: 49 dec ecx
.00057093: 90 nop
.00057099: 90 nop
.0005709A: 75D4 jne .000057070 -------- (1)
.0005708B: 90 nop

Now I will copy all that code with remove all NOPs and you will see that it is really easy to understand it (all hex opcodes are remove too and some labels are added):

.00057038:call .00005703D ; Call next line to get delta offset
.0005703D:nop
.00057042:pop esi ; ESI contains the delta offset
.00057048:sidt [esi][-000C] ; Maybe a/d trick? Who cares :D
.00057054:add esi,05F ;"_" ; ESI points to the area to decrypt
.0005705C:mov edi,esi ; EDI too
.00057062:mov ecx,00000260B ; Lenght of decrypt area
.0005706E:mov ah,087 ; Decrypt key :)
label_1:
.00057070:nop
.00057078:lodsb
.00057080:xor al,ah
.00057086:xor al,cl
.0005708D:stosb
.00057092:dec ecx
.0005709A:jne .000057070 -------- (1) ; jmp label_1

3) Now rip all that code in your assembler program (because it is really easy to it in asm). My example is DOS code. It opens the input file, moves file pointer to the pelock layer (because file size is bigger than one segment and I didnt wanted to waste my time with intersegment loader), reads 4000h bytes (pelocknt layer) into buffer and does the decryption (look at the end the whole piece of code). This is how looks decryption of the first layer which is copied and pasted into my source :D

mov ah,3fh
mov cx,4000h
lea dx,buffer
int 21h
mov read_len,ax

lea bp,buffer
cld
;======= Layer 1
lea si, [bp+009ch]
mov edi, esi
mov ecx, 0000260Bh
mov ah, byte ptr [bp+006fh] ; get the decryption key from the pelocknt layer
u1:
lodsb
xor al, ah
xor al, cl
stosb
dec cx
jne u1

After that the buffer is written at it's place in the file so you will have the ability to analyze it again.

4) Open with hiew again the file with the decrypted first layer and go to entry point, scroll a bit to find the code after the first layer. You will find again a code full of shits. Run MOW on it and analyze again with hiew. You will find the second decryption layer and just copy'n'paste it into your source :)

5) Repeat all previous steps until you get the whole pelocknt layer decrypted. Run MOW on it and disassemble it with your favourite disassembler (IDA should work without any problems on the file but w32dasm needs some modifications to be done to the PE header to get it to work - delete all sections before the PELOCKnt one and set it's section characteristics to e0000020h).

After disassembling and analyzing you will find all nice anti-debugging tricks that mister Marquis De Soiree used (sorry that I explained how to get into that too easy).

Now the full source code of the program that decrypts the PELOCKnt layer of Impact emulator:

.model tiny
.code
.386

crlf equ 0dh,0ah

org 100h
start proc
jmp begin

mess_01 db 'Modified PELOCK-NT 2.04 decryptor v1.00',crlf,'$'

f_name db 'DDD.EXE',00h
f_handle dw ?
read_len dw ?

begin: mov ah,09h
lea dx,mess_01
int 21h

mov ax,3d02h
lea dx,f_name
int 21h
jnc open_ok ; If not error - continue
jmp exit

open_ok:
xchg ax,bx ; BX is file handle
mov f_handle,bx ; Save it
mov ax,4200h ; SetFilePointer
mov cx,0002h ; Hardcoded position of PELOCK-NT layer
mov dx,3000h ;
int 21h ; Do it

mov ah,3fh
mov cx,4000h
lea dx,buffer
int 21h
mov read_len,ax

lea bp,buffer
cld
;======= Layer 1
lea si, [bp+009ch]
mov edi, esi
mov ecx, 0000260Bh
mov ah, byte ptr [bp+006fh]
u1:
lodsb
xor al, ah
xor al, cl
stosb
dec cx
jne u1

;======= Layer 2
lea si,[bp+0124h]
mov edi, esi
mov ecx, 00002583h
mov ah, byte ptr [bp+00f9h]
u2:
lodsb
xor al, ah
xor ah, cl
stosb
dec cx
jne u2

;======= Layer 3
lea si, [bp+0232h]
mov edi, esi
mov ecx, 00002475h
mov ah, byte ptr [bp+0207h]

u3:
lodsb
xor al, ah
xor ah, cl
stosb
dec cx
jne u3

;======= Layer 4
lea si, [bp+02dah]
mov edi, esi
mov ecx, 000023CDh
mov ah, byte ptr [bp+0296h]
u4:
lodsb
xor al, ah
mov bh, cl
and cl, 07h
ror al, cl
mov cl, bh
xor ah, cl
stosb
loop u4

;======= Get checksum

write_file:
mov ax,4200h ; SetFilePointer
mov bx,f_handle
mov cx,0002h ; Hardcoded position of PELOCK-NT layer
mov dx,3000h ;
int 21h ; Do it

mov ah,40h ; Write decrypted part
mov cx,read_len ;
lea dx,buffer ;
int 21h ;

mov ah,3eh
int 21h

exit:
mov ax,4c00h
int 21h
start endp

buffer label byte

end start

=========================================
Now about the macros I added to MOW:

EB03 - jump over next useless code
CD20?? - disassembled as VxDcall

These 5 bytes can be patched with NOPs

Adding a macro in MOW is easy:
SetM(440, #$EB+#$03+#$CD+#$20, 'ÐÐÐÐÐ');

Recompile it and you can use it on PELOCKnt.
Maybe there are some other macros I missed now (I lost the modified MOW source :() but you can find them when MOWing with the original version and looking with hiew.

That's all. Hope you will understand it.

Greetings to Xoanino, DAEMON, tE!, all friends in TMG, UG, UCF

Cheers
Unknown One/[TMG]
^DAEMON^
11-21-2001, 06:28 AM
hey uno! hmmmm did ego talk to u already coz of the project ????

i'll be back soon, on irc!
^DAEMON^
xoanino
11-22-2001, 08:58 AM
Hi,
is this k-kryptor technique the same as Yado's krypton 3 (he calls his technique "k-exceution", so i presume its something similar) ?

Ehehehe ... well, if its that, i and another guy of the scene were developing a crypter using that "technology" (we called it "windowed execution") already 2.5 yrs ago. Then i spoke to yado about it on one of our usual chats on IRC, and krypton3 was born.

If this k-krypter is something similar, i presume it uses its own pager which executes blocks of memory, after descrambling/decrunching them... all driven by a more or less advanced SEH which catch page faults and loads the correct next page to be executed. Of course in this way, a cracker can't find the whole decrypted section/sections in memory once for all, but just the small part which is being executed at the moment. So if these new crypters works this way, well .... seems i had a good intuition, at least.

Anyway, i'd really like to see how those things are implemented ... since i never had the time/will to finish my own crypter. Maybe the other guy is still working of it, don't know. I left that project long ago after very little coding. No, i won't say who he his, but i doubt he reads this board, anyway.

I never attempted to analyze krypton3, or this k-kryptor, or anything else of the new "stuff"..... basically coz you folks tends to abuse with irritating and obfuscating code, fake jumps, etc.... and i get very very bored already in the beginning. I think you've the idea :) Usually, i tend to spend lot more time to "deobfuscate" the code in an IDA-readable form than to analyze the "real" part of the protection.

That's why i've, more or less, left.

To finish, in my opinion : use less obfuscating code, and spend more time on the "core" of the protection. In this way you can attract even old lazy people like me to "analyze" your (good) works.

Bye all! i'm glad to see someone remembers me sometimes :)

xOANINO
DakienDX
11-23-2001, 09:40 AM
Originally posted by ^DAEMON^
Hi dakien, i just took the avatar coz i think it's a nice one

the big pink pussy has nothin to do with you - just my quit message normally used in efnet.....

cut & paste is best u can do!
(hi UNO :) i'll come back SOON!)

k-kryptor can be found on all latest programs done by risc
like unsafedisc or poxylok.... u can find em everywhere....
just download em and try to break the protection :) u'll like it!

^DAEMON^

Hello ^DAEMON^ !

OK. Apology accepted. :) I was confused a little bit when scrolling some posts and seeing my avatar all over the place.

Sorry for replying so late, but I wasn't home the last days.
^DAEMON^
11-26-2001, 05:30 AM
no problem :)

^DAEMON^


Good time to get into cracking?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Good time to get into cracking?
PDA

View Full Version : Good time to get into cracking?

Unregistered
11-06-2001, 02:41 PM
Is now a good time to start cracking? I've read some of the newbie tuts and understand them ok (succesfully cracked about 4 progs on my own), but to become an expert its gonna take time. Is now a good time to start cracking? or are new unbreakable protections on the way as some sites seem to say :(?
Argoth
11-06-2001, 03:12 PM
You see, they will always make new protection schemes and crackers will always try to break them. They will create apps which are easy to crack and they make apps which are harder. This is how it is and how it will be. So...just start

Grtz

Argoth
Woodmann
11-06-2001, 05:54 PM
Howdy,

What was that old saying?
Something like, there's a crack in everything, thats how the light gets in.

There ya go

Peace, Woodmann
binbin
11-11-2001, 12:16 PM
Good!
Let's start,Now


Disassembling Morpheus...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Disassembling Morpheus...
PDA

View Full Version : Disassembling Morpheus...

AllYourBase
11-06-2001, 03:09 PM
Hi all,

Erm this is my first post so let me start by saying hi :D

My prob is this - I tried disassembling Morpheus so I could add functionality (automatically searching for more sources, disabling ads, fix bug of missing files) using W32Dasm. Instead of proceeding to do all its processing it almost immediately came up with a disassembly containing the menu resources and not much else. It ends with the line stating the entry point. Obviously I cant do much with it.

Now I dunno if this is a common problem (but hey I'm in the newbie forum :D ) any help would be greatly appreciated.

AYB
Kayaker
11-06-2001, 05:33 PM
Hi AllYourBase,

Welcome to the board. In order for WDasm to recognize a section as code, the Code Characteristics need to be set as Executable/Readable (60000020) or Executable/Readable/Writeable (E0000020). Look at the start of the WDasm disassembly and the Flags entry will list it, i.e.

Object01: .text RVA: 00001000 Offset: 00001000 Size: 00004000 Flags: 60000020
Object02: .data RVA: 00005000 Offset: 00005000 Size: 00001000 Flags: C0000040
..
..

It sounds like you may have a packed or otherwise protected file. If the 1st section isn't one of the executable types, try changing the Code Characteristics of it with a PE Editor (E0000020 if you want to add functionality). Missing the Import Module details as well?

Kayaker
AllYourBase
11-06-2001, 06:07 PM
Kayaker,

Thanx for the info. As a followup here is the object listing from the disassembly:

Number of Objects = 0005 (dec), Imagebase = 00400000h

Object01: RVA: 00001000 Offset: 00001000 Size: 00000000 Flags: C0000040
Object02: RVA: 000F1000 Offset: 00001000 Size: 00000000 Flags: C0000040
Object03: RVA: 0011E000 Offset: 00001000 Size: 00000000 Flags: C0000040
Object04: RVA: 00132000 Offset: 00001000 Size: 00113A00 Flags: C0000040
Object05: RVA: 00246000 Offset: 00114A00 Size: 00090000 Flags: C0000040

edit: yes its also missing the import details

I'm going to have a play about with a PE Editor but if there's anything you can add with this new info? Thanx a lot,

AYB
Kayaker
11-06-2001, 08:36 PM
Hi AYB,

Try running a file identifier such as FileInfo or GetTyp on it, it may tell you the packer/protection used. The size info has also been suppressed. You should be able to get a disassembly on it by changing the code char. of the 1st section from C0000040 to E0000020, but it'll probably be useless anyway from all indications.

You'll likely need to dump an unpacked version of it and rebuild the Import table. You've got some fun ahead ;-)

Kayaker
CoDe_InSiDe
11-07-2001, 12:32 AM
Hi AllYourBase,

This is just a little guess because i don't have Morpheus ;)
But if i'm correct Morpheus is a little "bigger" version of KaZaA right?
KaZaA was Packed with "PeX" so maybe Morpheus is too :)
So uhm do what Kayaker said and use a File Identifier ;)

Cya...

CoDe_InSiDe

P.S. actually it doesn't matter with what it's Packed just Unpack it manually :D
bl00dbath
11-07-2001, 12:58 AM
Hey AllYourBase,

FileInfo says its packed with PEX 0.99b. Its not hard to unpack at all, only took me a minute and the rebuilding of the import table was easy. There were a couple of API that wouldn't resolve, (using ImpREC, I'll be a Revirgin man soon +tsehp;)) so I just took a shot in the dark and chose which API looked like it might fit because I don't really like to play around with unpacking. :)

The dump runs fine though, so maybe I was right. Lets just pretend anyway. :)

If you need any help unpacking or want my dump, just let me know.

Regards,
bl00dbath
AllYourBase
11-07-2001, 04:41 AM
Hey guys,

Thanx for the help! :D

However I'm new to this whole unpacking thing... do I have to do it manually? If someone could point me in the direction of some tutorials or such like I'd be most grateful (particularly pex ones ;) )

Thanx again,

AYB
AllYourBase
11-07-2001, 06:25 AM
update: just unpacked it using a prog called DeX it now disassembles ok.
cdump50
01-24-2002, 01:15 PM
Hi.. I had fun unpacking, removing all ads and popups for morpheus 1.33

It also starts with google.com instead of the *useless* musiccity.com

Here a link if you want to download it:

Link removed because it pointed to a crack

It will only be there for 14 days so hurry up if you want it

If you improve it further more please let me know at
cdump50@yahoo.com


IDAPro problem??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDAPro problem??
PDA

View Full Version : IDAPro problem??

MTB
11-06-2001, 06:27 PM
The target is Co__V, a ray trace program used in optics, protected by an Activator dongle.

IDA version 4.04 seems to have problems dissassebling it, however W32dasm 8.93 seems to be working ok. First section of both dissassemblies are posted below.

First can I get IDA to work on this code?

Second why didn't IDA pick a sigature file for it?

I probably can crack it using W32dasm, but really would prefer to use IDA since it does a significantly better job.

Thanks
MTB

--------------------------------------------------------------------------
IDA posted below

5F401000 ; Format : Portable executable for IBM PC (PE)
5F401000 ; Section 1. (virtual address 00001000)
5F401000 ; Virtual size : 0009628B ( 615051.)
5F401000 ; Section size in file : 00096400 ( 615424.)
5F401000 ; Offset to raw data for section: 00000600
5F401000 ; Flags 60000020: Text Executable Readable
5F401000 ; Alignment : 16 bytes ?
5F401000 ; Exported entry 3030.
5F401000
5F401000 model flat
5F401000
5F401000 ; ---------------------------------------------------------------------------
5F401000
5F401000 ; Segment type: Pure code
5F401000 _text segment para public 'CODE' use32
5F401000 assume cs:_text
5F401000 ;org 5F401000h
5F401000 assume es:nothing, ss:nothing, ds:_data, fs:nothing, gs:nothing
5F401000
5F401000 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
5F401000
5F401000
5F401000 public MFC42_3030
5F401000 MFC42_3030 proc near ; CODE XREF: MFC42_1168+Ap
5F401000 ; MFC42_1169+11p ...
5F401000
5F401000 arg_0 = dword ptr 0Ch
5F401000
5F401000 push esi
5F401001 push edi
5F401002 mov edi, ecx
5F401004 cmp dword ptr [edi], 0
5F401007 jz short loc_5F401032
5F401009
5F401009 loc_5F401009: ; CODE XREF: MFC42_3030+43j
5F401009 mov eax, dword_5F4CB000

--------------------------------------------------

W32dasm below

:00401000 CC int 03
:00401001 CC int 03
:00401002 CC int 03
:00401003 CC int 03
:00401004 CC int 03
:00401005 E90F030000 jmp 00401319

* Referenced by a CALL at Address:
|:009A34A5
|
:0040100A E9BA020000 jmp 004012C9

* Referenced by a CALL at Address:
|:009A3719
|
:0040100F E997020000 jmp 004012AB

* Referenced by a CALL at Address:
|:0040128B
|
DakienDX
11-07-2001, 11:26 AM
Hello MTB !

The code IDA has disassembled is a disassembly of MFC42.DLL, starting at the beginning of the code section.

I suppose that the W32Dasm listing is the start of the program you want to disassemble.

I don't know what the problem is, but I think IDA has been somehow set to disassemble all used DLLs. (even I don't know if that option exists)

I've just tried IDA 4.04 and IDA 4.1 on eight files using MFC42.DLL and could not reproduce the error.

What platform (DOS, Win32 Console, Win32 GUI) and version of IDA are you using?

Is it possible to upload the .EXE and the needed .DLLs somewhere? (if needed)

BTW.: If this threat leads to an "Anti-IDA-Tricks" post, we should discontinue it very soon. :)
MTB
11-07-2001, 08:27 PM
Hi DakienDX
First of all thanks for helping me with this problem.

IDA 4.04 running under windows 98SE

I have a high speed modem on this end, so I can upload the entire program if you want to some local ftp or other site. The other option, would be to zip the installation disk, then using RAR, break it down to 1.4 Mb size pieces and email it to you.

I also could burn you a copy of the CD and snail mail it someplace.

Your call.

Thanks again
MTB:)
DakienDX
11-08-2001, 11:17 AM
Hello MTB !

I think burning the program on a CD is a bad idea.

Even if it has 650 MB, it would be easier to download.

How big is the program?

I think uploading would be a good suggestion. Please email me the link, since too many downloads may kick the program before anybody has it completely downloaded.
If you plan to upload it on a FTP, please email me also the username and password.
MTB
11-08-2001, 06:41 PM
DakienDX
Zipped the CD up 45Mb's. Do you have an FTP site, or know of one we can use?
MTB
DakienDX
11-09-2001, 10:35 AM
Hello MTB !

Since the problem how to get the files from you to me isn't of public interest, I won't reply on this topic any more.

Please email me your email address and we will communicate by that way.


IDA 4.4 doesnt disassemble VB5 &6 softs ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IDA 4.4 doesnt disassemble VB5 &6 softs ?
PDA

View Full Version : IDA 4.4 doesnt disassemble VB5 &6 softs ?

Problem
11-06-2001, 07:53 PM
why ? is there anything i can do for it to disassemble ?
Aimless
11-06-2001, 10:03 PM
...Heh!!

Send me your "legal" copy of IDA, in 5 MB chunks daily, and and I'll see what I can do :))

...Have Phun
Problem
11-06-2001, 11:39 PM
of course i dont own a legal copy of ida !! im 16 years old, i only study, i cant buy it. i would buy if i had money. well that doesnt come to the case, the version i have here was carded by SHOCK and should be full...

bye
riPPadoGG
11-07-2001, 09:28 AM
Hi..

This may not be directly related to the question you posted..
But, (if you want to dissassemble VB5/6 exes) there is a patch available for Win32Dasm(made by Lazarus) which makes Win32Dasm show the string references in VB.
Win32Dasm dissassembles most VB5 VB6 PEs.. sensibly.. ie there is some extra protection..

regards
riPPadoGG
DakienDX
11-07-2001, 10:26 AM
Hello aimless !

This sounds like a warez request. :(

But I think 'Problem' has IDA 4.04 and not 4.4.

So if you want IDA 4.04 search the internet.

If you want IDA > 4.04 (full, uncracked), buy it. 4.18 is the actual version.
Unregistered
11-07-2001, 10:34 AM
I saw no warez reguest, just a simple question. Problem, try
riPPadoGG's suggestion.
regards
DakienDX
11-07-2001, 10:43 AM
Hello everybody !

I wasn't talking to Problem when complaining about warez because I directed it to aimless, and I think he will understand that I was just joking when talking about it as good as I think that he was joking too when asking Problem to send him IDA by email daily.

So, peace everybody and smile again. :) :) :)


an simple crackme #2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > an simple crackme #2
PDA

View Full Version : an simple crackme #2

javelin
11-07-2001, 12:47 AM
this should a little harder than the last one
javelin
11-07-2001, 12:49 AM
here is the crackme
figugegl
11-08-2001, 12:27 PM
this crackme is very very very similar to the previous one. it uses only a slightly different algo.

Name: figugegl
Email: figugegl_2000@yahoo.de
Serial: WYGYGYGPGWPPPPYYPGGWPYPP

and in my opinion there's a bug in it this crackme. in the final calculation routine it uses the length of the string at address 4080D8 instead of the lenght of our modified name.

figugegl
d4d0
11-08-2001, 09:47 PM
Hi all,

it is an honour for me to post my first message on this messageboard :)
I agree with figugegl, the 2nd crackme used the same template of the first (and I used the same template for the keygens too
:D )
I think there is no bug, because, as far as I can remember, the 1st crackme used the same way to loop, although I think the way it loops weird. Maybe the author could do some more optimized iterations..

And about a breakpoint to get in the code, I think the best way to find it is unpacking the proggie and looking the imported functions. I used one breakpoint on a function (can't remember the name right now) and then searched my name and BPMed it.
You could also breakpoint at the comparison routine (it is a well known one)

sorry for my bad english and for my lameness

cya
d4d0
br00t_4_c
04-20-2004, 01:16 PM
Hey all,

Just a couple of quick n00bish questions (sorry). Anyhoo, I'm experiencing some difficulty unpacking this app. I am attempting to unpack this app manually and I have done all of the standard things...
1) Patch the bytes at raw offset 7CB to E9FBFFFFFF to throw the app into an infinite loop just before it jumps to the original entry point
2) Dump the process while it is in an infininte loop to disk using procdump
3) Edit the entry point of the dumped file using procdump so that it points to the OEP (which I believe should be at RVA 1400)

once I've done all this the app crashes when I try to start it. Now I've noticed a couple of strange things... which I won't waste your time describing, just need to know if I'm on the right track... for some reason the application seems to be doing something funny in kernel32 on startup and when I try to automatically unpack with a tool like Procdump, procdump seems to believe the OEP is somewhere around the base address for kernel32?? This clearly isn't correct... For some reason my approach ain't workin'... any thoughts would be greatly appreciated :confused:


E changed to 1 in RSA algo.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > E changed to 1 in RSA algo.
PDA

View Full Version : E changed to 1 in RSA algo.

Problem
11-07-2001, 01:24 AM
I heard that DAMN changed e to 1 in ffxp to crack it, yes i know e is the public exponent but how it helps changing it to 1 ?

tnx
DakienDX
11-07-2001, 10:12 AM
Hello Problem (we all have them, don't we?) !

Very easy!

M = C^E mod N (C = ciphertext, M = message)
and
C = M^D mod N (C = ciphertext, M = message)

We don't know D and it's very difficult to get D in reasonable time.
We know E.

So if we change E to 1, D must be 1 too and we have

M = C mod N
and
C = M mod N

and so we have C = M if M < N.


SnetinelLM sdk 7.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SnetinelLM sdk 7.1
PDA

View Full Version : SnetinelLM sdk 7.1

Unregistered
11-07-2001, 06:01 PM
How do i get the sentinelLM sdk?

I found it but it is password protected.


kids....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > kids....
PDA

View Full Version : kids....

Lord_Soth
11-07-2001, 07:53 PM
I just decided to stop by after so long that I've
been outa the loop.
First thing I see is a discussion about a Special
Edition RCE CD.
Well, as one of the very first ppl to receive this
CD, I tell you all, there is only ONE version.
The special edition text is a part of the original
gun jpeg that was selected for the opening screen.
As the nice +Sandman said, there have only been
other versions without viruses in them...

I'm glad to see most of you still roam this place
and keep up the good work :-)

LS

PS.
Damn I didnt see those smilies on the left. Gotta
learn to use'm more often ;)
Aimless
11-07-2001, 11:03 PM
Plaground of the lions deserted.

Cats, fierce, but cats neverthless have moved in.

Anyways, cubs CAN grow up to be lions.

...Have Phun
figugegl
11-08-2001, 05:17 AM
the puppy grows and will become a lion some day...

figugegl


Hi everyone
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hi everyone
PDA

View Full Version : Hi everyone

Lord_Soth
11-07-2001, 07:56 PM
Been a long time, just wanted to say hi to everyone
on this forum. Glad to see everything is still the
way it was, or actually, much more complicated.
Damn guys, what has been going on here in the
past year ?? :)

LS
Woodmann
11-07-2001, 08:10 PM
Hi Lord_Soth,

Nice to see you here.
What has been going on in here?
All kinds of things. Have you checked out the cryptography forum ?

Peace, Woodmann
Lord_Soth
11-07-2001, 08:33 PM
Just glanced for a few seconds..

Crypto is a tough topic. Algos become better and
better, and you know what, even the implementations
of them become better, which makes them less and
less interesting, at least for me...

Like crypto is used in securing systems, and hackers
learn to bypass it if possible, because frankly
they can't do anything about it.
Ain't mathematics sucks ?? :)

LS
JimmyClif
11-07-2001, 09:26 PM
wb LS LTNS ;)

JC
goatass
11-07-2001, 09:40 PM
Lord Soth my good friend, how are you? long time man where have you been?

This board is alive and doing great the board's crew are kicking ass as usual.

well good to have you back.

goatass
?ferret
11-12-2001, 08:11 PM
Long time no see....wb amigo
tsehp
11-13-2001, 02:23 AM
yes, didn't hear about you since march. did you crash your pc and modem ? ;)

now the major sites were attacked and some closed, we host actually immortal's archives + crackz's zencrack on our private server. I hope for long now.
McCodEMaN
11-13-2001, 08:41 AM
Greetings Lord_Soth!

Nice to see that you're back on the board!
About Crypto:
True, since factorization of a secure cryptosystem is
vey hard, the best way to obtain a successful attack
is to find an insecure implementation.
Even though factorization is hard, I find cryptographics
very interesting and to be a must know...

regards
McCodEMaN
Lord_Soth
11-13-2001, 04:26 PM
Yeah, more likely a RL crash tsehp..

I've been working+studying more than anything lately.
Now that the cutbacks in the hi-tech businesses are felt
all over the globe, i found myself without a real job hehe
Damn, I've almost completed a full featured ESMTP
mail relayer for linux, with a Java GUI no less.
Darnit..

In any case, I've got a bit more time nowadays so I'm
trying to catch up on what's going on in the scene.

And btw, I've DSL now, my modem has been fired :-)

LS
UrgeOverKill
11-14-2001, 08:48 AM
welcome back Lord_Soth!

wow first +Sandman, then Lord_Soth... whew!

seems like old timers week. ;)
esther
11-22-2001, 07:44 AM
Hiya LS,

Hope you are fine too ;)

esther
morlac
11-22-2001, 07:04 PM
Nice to see some of the old folks come back while I hate the reason. I hope that you'll find a better job.
Again, welcome back. :)
Lord_Soth
11-23-2001, 05:22 AM
It's not only about my RL job dude.

There were other stuff too...

LS


Revirgin users !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Revirgin users !
PDA

View Full Version : Revirgin users !

SpeKKeL
11-08-2001, 02:59 PM
Okee,

Well a new tool is always with bugs and need to be
improved .
New options,faster,better looks etc.
Allso R.V is changed in look and code but there's
still a lot of work to do.
To know what the majority of users like or dislike is
important to the maker, so hereby the next question:

-Tracing in RV "could" lead to crash/freeze your system
To code something that will never crash is impossible.....
However before tracing there are some "sign's" you can see
crashing is to be expected. (like refs with zero's).
So should r.v give a warning (msg-box)before tracing on those
entries ? or what.........?
Are there better options ??

THANKS for all your input

SpeKKeL..
McCodEMaN
11-09-2001, 12:34 PM
Greetings!

I'm not replying to the post above, I just like to say that I find the
later versions of revirgin more stable. Frankly, I have not had any
real problems with the later one yet!

regards
McCodEMaN


FTP mirror or other ressource for Num*ga files ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FTP mirror or other ressource for Num*ga files ?
PDA

View Full Version : FTP mirror or other ressource for Num*ga files ?

Czerno
11-08-2001, 03:21 PM
Hi All !

Tho not crucial , I'll like to get an add-on for S*ftICE advertised
at their site ( its their "keyboard.zip" kbd driver editor ) ;
but as you know that FTP is no (longer ) accessible to
anonymous :=(

Any good soul knows where I could find that file ( for SICE 4.05 ),
and / or possibly browse the FTP ( possibly a hidden mirror
there-of ) ?

Great thanks !

Czernobyl


A SoftIce Question.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A SoftIce Question.
PDA

View Full Version : A SoftIce Question.

nobody
11-08-2001, 07:52 PM
Hi.

I need some expert guidance with this problem.

I am trying to crack some software. It has a license manager that, as far as I can tell, is designed by the software developers.
The package has several modules (.exe or .dll files), that are loaded when you activate choices in the program menus. So far so good.

I have been able to detect that the program can tell "authorized" or "not authorized" by reading a flag stored in the data segment: something like this:

.
.
.
mov EAX, DWORD PTR [00564560] ; ds:00564560 holds a value of Ox00000001
test EAX,EAX
jz good boy
.
.
.
bad boy

Now. Based on this, someone, somewhere in the program examines the license state and WRITES to the position ds:0056456 the value of the flag: 00000001 bad boy
00000000 good boy.

I want to detect that function to activate all modules at once.

In an attempt to pinpoint the code that sets up the flag at DS:00564560
placed a brake point in softIce like this:

BPR ds:00564560 ds:00564560+4 W.

I was hoping to catch the code that WRITES the value of the flag, to be able to identify the code that validates the license.

The problem is: IT NEVER BREAKS.

I have follwed the ds:00564560 area on the data window from the point the program starts, ( I break with BPX get version) as it loads

Initially, it is filled with question marks ??????, meaning, that area of the memory ha not been mapped yet.
eventually, as the program loads, it becomes full of data, but, despite being targetted with a BPR ( or a BPMB or BPMD etc) SoftIce does not seem to break when this critical(for me) area of memory gets wrritten with the value of the critical flag.
Any Idea why???

Thank you
CoDe_InSiDe
11-09-2001, 12:44 AM
Hi nobody,

Maybe it doesn't work because you're using "ds".
Try using "cs" :)

"BPR cs:00564560 cs:00564560+4 RW" (Maybe also include the R for Read)

Hope this helps.

Cya...

CoDe_InSiDe
riPPadoGG
11-09-2001, 07:46 AM
Hi..
I just remembered something from one of Razzia's VB Tut..
always use the selector 30:

Suppose you want to break when
ds:<some_value> is written into,
Then always do
page ds:<some_value>
page is a soft-ice command. page will display the linear address of ds:<some_value>
then do
bpr 30:<linear_address_of_some_value> 30:....................... w

Also,
I fail to see the point in coDe_InSiDe's suggestion..
Please correct me if I am wrong..

regards
riPPadoGG
NikDH
11-09-2001, 08:21 AM
Originally posted by nobody
Hi.

The problem is: IT NEVER BREAKS.

I have follwed the ds:00564560 area on the data window from the point the program starts, ( I break with BPX get version) as it loads

Thank you

Hi nobody,
if i remember well the bpr command let sice pop only
if the addr is changed inside the context u put the bpr in
That addr should be modified from another context
and u wont catch it
nobody
11-09-2001, 02:43 PM
Thank you for your responses.
Rippadogg: I did look for the linear Address and set the breakpoint using the "universal " selector 0030. I can definitely tell it points to the right area of memory when I do d 0030:0056......
But still no lock.

CodeInside: I tryed the selector cs: and I tryed explicitely writing the selector displayed in the data window 0187: with no positive results.

NikDH: Yes, it is plaussible that the flag gets written by some .dll in charge of security, and it uses an address context different from the program's current module address context in which I set the breakpoint. If that is the case I see few other alternatives. Question for you: Is this a documented behavoir of SoftIce or is it something you have observed/deduced?

Thanks again
Unregistered
11-10-2001, 05:47 AM
Originally posted by nobody
NikDH: Yes, it is plaussible that the flag gets written by some .dll in charge of security, and it uses an address context different from the program's current module address context in which I set the breakpoint. If that is the case I see few other alternatives. Question for you: Is this a documented behavoir of SoftIce or is it something you have observed/deduced?

Thanks again

Well dont know if its documented but i know the bpr command uses dr register to store the memory address u'r interested in
but the dr registers r context dependent, every time theres
task switch the dr register get changed
So the bpr method to break will work only if u can get
the right context to set bpr in

So we r quite sure that the flag is set from a context different from the one u put the bpr in, so how can another task which lives in a different context get the permission to write into an address it doesnt own ?
Perhaps using OpenProcess(), ReadProcessMemory(), WriteProcessMemory(), so try to bpx on some of them
and look for the address they wanna change
Make us know of coz

See ya
NikDH
NikDH
11-10-2001, 05:58 AM
Originally posted by Unregistered

Well dont know if its documented but

See ya
NikDH

Its me again :)
Now i'm registered and its much better :)

What i wanted to say is that u can find specifics about
the dr registers on the intel manuals

See ya
NikDH


LMD Tools version 5.0 crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > LMD Tools version 5.0 crack
PDA

View Full Version : LMD Tools version 5.0 crack

Unregistered
11-09-2001, 12:56 AM
Please help me to crack LMD Tools 5.0 for Delphi 3.0.
The trial version always asks to run IDE while I want to run compiled file that are using LMD components.
DakienDX
11-09-2001, 09:00 AM
Hello Unregistered !

As I said to TIA and as the rules of this board say:

46 4C 41 4D 45 53 2C 20 43 52 41 43 4B 20 41 4E 44 20 53 45 52 49 41 4C 20 52 45 51 55 45 53 54 53 20 57 49 4C 4C 20 42 45 20 52 45 4D 4F 56 45 44 2E

(I think he understood this now :) )

or more simple

FLAMES, CRACK AND SERIAL REQUESTS WILL BE REMOVED.

You can't just come and ask somebody to crack a program for you or ask for help without telling us what you need to know or where you're stuck in the cracking process.

We don't ask for readymade cracks,
we discuss and create them.

We don't ask where to get the Tools Of Our Trade,
we search and use them.

I don't know what "LMD Tools 5.0 for Delphi 3.0" is, but I'm sure most of the board members wouldn't put it in the list of "Tools Of Our Trade"

This doesn't mean that you're a bad boy from now and forever, and this isn't directed only to you, but to all people who make posts like your's, unimportant if they know what they're doing or if they don't.

Anyway, please tell us where you're stuck, what questions you have and what you've found out so far.
Unregistered
11-13-2001, 02:19 AM
Thanks for your info. I'm new here, and sorry for annoying you.
DakienDX
11-13-2001, 11:07 AM
Hello Unregistered !

You did not anoy me. We were all 'new here', so we've all made some mistakes.

Could you please tell us where you're stuck and what your problems are?

If you don't know anything about cracking and were just searching for a crack-request-board, I'm sorry, but you've found the wrong place for this.
If you wish to learn how to crack, I suggest to read some tutorials and try understanding them.
Solomon
11-13-2001, 09:01 PM
Pls drop me a mail, I have a tut on how to crack it;)

Originally posted by Unregistered
Please help me to crack LMD Tools 5.0 for Delphi 3.0.
The trial version always asks to run IDE while I want to run compiled file that are using LMD components.


A challenge ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > A challenge ?
PDA

View Full Version : A challenge ?

Woodmann
11-09-2001, 05:57 PM
Howdy peoples,

I was out drifting aroung the internet and came across something that might be of interest.

http://www.shyfile.net

They offer a challenge to break their encryption.
The money is not that much but it's a challenge just the same.
( I dont quite understand the date of juli 2011)

You opinions please.

Peace, Woodmann
UrgeOverKill
11-09-2001, 08:34 PM
jus was at the site, kinda funny, now its please....
DakienDX
11-10-2001, 08:10 AM
Hello everybody !

The homepage is a Windows Killer! When I load it, my computer freezes for about one secound and works fine after that. If I keep the page open in the background, two minutes later my computer shows a black DOS-screen with grey letters saying "Windows protection error, Please press any key..." and my computer is locked.

This is no imagination, it happened 10 times this morning! And only when having visited this site!

Please, can somebody tell me if you have the same problems?

(Be sure to save and close any important files and programs :) )
goatass
11-10-2001, 10:14 AM
DakienDX I was on that site using Win98 and IE5 and it worked just fine I don't know why you were freezing.

Woodman I think they put the date of July 2011 because they assume thier encryption is unbreakable so they pretty much give you all the time you want to try and break it. Personally I think that company will go under within a year or two :) None the less their cryptor is interesting and should be investigated.

I'm not all that advanced with encryption algos and such so I doubt I'll be able to break it myself but if some other people want to give it a shot we can work on it together eventhough it might be a waste of time since no one is using it anyways.

goatass
Woodmann
11-10-2001, 11:27 AM
Howdy,

DakienDX, Win 2K IE5 and Opera, no problems. It might be some java crap they are running.

UrgeOverKill, Please ?

Well encryption is new to me, I never really looked at it much. Perhaps I will see what I can learn.

Peace, Woodmann
Unregistered
11-10-2001, 12:02 PM
To get the algorithms used in this app, just goto online decoder and view source, its all there in javascript. To me it looks like its proprietary (if im right, im sure it can be cracked by cryptoanalysis, if its made by an amateur)

If anyone have heard of the algorithms used in this, plz post about it, he might have found the algos in a book or so :)
Kythen
11-10-2001, 12:43 PM
Download their trial program. It has a VB6 exe that will give use the encryption rountines. Decryption routines can be found in 3 versions (Spanish, German, and English) which are javascript text files named as dll's.

Let the mayhem begin! :)

Cheers!
Kythen
Lord_Soth
11-10-2001, 12:51 PM
What an insteresting way of decoding and encoding.
I don't quite understand it. They say the text
is encrypted using stuff from my PC, probably
information gathered by the browser, plus using
the clock as well (maybe..).
I don't get it. What's all this online decoder ?

LS
mike
11-10-2001, 06:14 PM
There's no way of knowing whether you got the right key, because there's no information about the contents of the file. If he said "It's all english text," then one could figure it out. As the challenge stands, it's impossible in principle.
goatass
11-11-2001, 01:19 AM
Nearly 95% of these challenges that you find online are unbreakable unless you have the time and computer power to brute force them, they do not prove anything about the algorithm itself.

Since the algorithm is in Javascript it's easier to investigate how it works so it might be worth the time. The encrypted bytes are only A-Z (probably not including all the letters) and the encrypted text is much larger then the original message so there is a great deal of padding but I think the number of bytes to pad is constant and might be that number 0400 (the number I see you might see some other number) at the beginning of an encrypted message.

I don't know these are just quick observations I came up with.

goatass
McCodEMaN
11-11-2001, 12:55 PM
Greetings!

It's always fun with new challenges and I've been looking
at the website, however I have to agree with mike:
I think this challenge is a no go....

regards
McCodEMaN


using softice with map file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > using softice with map file
PDA

View Full Version : using softice with map file

UnderCover-
11-09-2001, 07:39 PM
Hi

when i use a map file in softice and type

? eax
unsigned long = 0x204, "\0\0\x04d\x04"

is there a way to get it back to the normal ?

thanks.
UnderCover-


about a nag dos crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > about a nag dos crack
PDA

View Full Version : about a nag dos crack

robertyonghu
11-09-2001, 08:04 PM
I am cracking a dos exe program. Unfortunately, It is not a single program but a serials programs. The first programs will read the input file(i.e file.ccf),and use system to call the second and third programs to do the job. Maybe in the third program it test whether you are a valid user. How can I trace from the first program into the second program and so on?
Unregistered
11-09-2001, 09:28 PM
hmmm, hard to say at first. But I would start w/the TSR's(Terminal Stay Resident) and go from there. Then check w/the PSP's, (Program Segmented Prefix) this way the info gathered in the beginning of the first program is carried over and over using the PSP's. I do belive you can use Softice or your fav debugger to trace how the program 'calls' one another.

PSP's are those undocumented areas of DOS that was never really understood, so be careful...
Aimless
11-10-2001, 02:24 AM
Take a single .exe file. Split it into 3 parts. To run the .exe therefore, you need all the three parts. If one of the parts is missing, then obviously it will not run.

This is the principle behind a series of programs required to run the same. In this circumstances, do not try wasting your time figuring out where the proggie snaps. Instead, load softice (perhaps for DOS, if necessary. You will find may sites hosting the still used DOS version of ICE), log all the necessary calls (do your mapv86 first to get the ranges) and then subsequently try and figure out in which proggie it snaps. Kind of like attacking the protection from the behind. The simple approach does not work here as this is DOS and memory can be written anywhere (unless you are running it from a command window and not PURE dos), lotsa self-modifying code availablity, polymorphizm available and so on. Sourcer 7 or 8 can be used to disassemble the necessary. IDA is good, but Sourcer's summary of the INTS at the end makes it make me use that more for DOS cracking.

Also, if these programs are interlinked, you need not do the tracing manually. Softice will do it for you. At the beginning just note the limits of each program in memory (use mapv86 command) and keep a close eye on the segments (not the offsets) and when they change, you will know you are now in another program.

And yes, make sure you have downloaded and have ready Ralf Brown;s interrupt list.

...Have Phun
DakienDX
11-10-2001, 03:48 AM
Please only post in one forum at the same time
(I've just seen that this post is discussed here, but I've already replied in the RCE General, so here's my reply)

Hello robertyonghu !

Do you know if them program only reads file.ccf in the first program?

If it does then the programs must exchange then registration data somehow. This can be done by commandline passed to INT 21/4B00 and at PSP:0081 in the called program, by using the inter-program-communication-area at 0040:00F0 (size 16 bytes) or by hooking one interrupt and calling it from the 'child'-process.

If you don't find the critical point that way, you should search for the 'bad-boy' message in the loaded program, which checks the user-info, and set a breakpoint on RW to this location.

If you're lucky, the program is in C++ and you land in the program at once, else you've to trace until you reach the end of the interrupt handler. (either 10h or 21h)

Now you should look for the condition when the 'bad-boy'-message pops up. (maybe by searching for some data of the file.ccf in memory)
NikDH
11-10-2001, 06:08 AM
Originally posted by DakienDX
Please only post in one forum at the same time
(I've just seen that this post is discussed here, but I've already replied in the RCE General, so here's my reply)

If you don't find the critical point that way, you should search for the 'bad-boy' message in the loaded program, which checks the user-info, and set a breakpoint on RW to this location.

If you're lucky, the program is in C++ and you land in the program at once, else you've to trace until you reach the end of the interrupt handler. (either 10h or 21h)

Now you should look for the condition when the 'bad-boy'-message pops up. (maybe by searching for some data of the file.ccf in memory)

Hi to all,
well i'm not very expert about dos cracking but what about looking 4 some functions used to show writings on the screen just as printf() that r statically linked into the exe ?

If the prog is in c++ its probable it uses the printf() to show the bad-boy nag on the screen and that function is recognized easily by ida in the lorg, u can put a bpx on it and w8 4 the program to call it and so look what kinda msg its showing

See ya
NikDH
robertyonghu
11-10-2001, 07:20 AM
I have try to use the soft-ice to trace,but unfortunately it can't work with my program. The program use extended memory.It says extended memory is controled by another memory and exit.
Later I load soft-ice with parameter /emm 13192 (allocate some extended memory ). At this time it do not say the extended memory is controled by another program but can't work correctely. I use tr to load the first program but it can't trace into the second program.
DakienDX
11-10-2001, 07:32 AM
Hello robertyonghu !

Are you using SoftICE for DOS?

If yes, you have to load it in your CONFIG.SYS (Device=[path]\S-ICE.EXE) and you mustn't use HIMEM, EMM386 or QEMM.

If you trace, you can't get to the next program. It should be possible, but there is so much DOS and BIOS code in these call that you will make some mistakes tracing and lock up your computer or simply run the program without stopping at the entrypoint.

Anyway, setting breakpoints is more comfortable and much easier.

If you're using SoftICE for Win9X or WinNT there shouldn't be this kind of problems.
robertyonghu
11-10-2001, 10:34 AM
Yes I am use the softice for dos,because This program can't run in windows(it was written by fortran language,maybe some old verson). When it is run in windows,windows automatic restart to pure dos.
I have managed to let it compatible to softice now. And I am painfully trace in them. Yes I have lost my way in the bios and dos code. When I enconter the dos and bios interrupter, I usually can't intercept the program. Some interrupter can't be trace in and when you step over it you can't get back.
This is my first dos crack and I never used fortran. Are Fortran language special?


about a dos program crack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > about a dos program crack
PDA

View Full Version : about a dos program crack

robertyonghu
11-09-2001, 08:08 PM
I am cracking a dos exe program. Unfortunately, It is not a single program but a serials programs. The first programs will read the input file(i.e file.ccf),and use system to call the second and third programs to do the job. Maybe in the third program it test whether you are a valid user. How can I trace from the first program into the second program and so on?
DakienDX
11-10-2001, 03:34 AM
Hello robertyonghu !

Do you know if them program only reads file.ccf in the first program?

If it does then the programs must exchange then registration data somehow. This can be done by commandline passed to INT 21/4B00 and at PSP:0081 in the called program, by using the inter-program-communication-area at 0040:00F0 (size 16 bytes) or by hooking one interrupt and calling it from the 'child'-process.

If you don't find the critical point that way, you should search for the 'bad-boy' message in the loaded program, which checks the user-info, and set a breakpoint on RW to this location.

If you're lucky, the program is in C++ and you land in the program at once, else you've to trace until you reach the end of the interrupt handler. (either 10h or 21h)

Now you should look for the condition when the 'bad-boy'-message pops up. (maybe by searching for some data of the file.ccf in memory)


MSComm32/Read parameters
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MSComm32/Read parameters
PDA

View Full Version : MSComm32/Read parameters

JohnnyBoy
11-09-2001, 10:06 PM
I have at last cracked the Alfano Go-Kart timer/datalogger software. The software check the serial number inside the datalogger device and compare it to the licensfile. The Software is a VB5 program an I have used SI for the crack.

My problem now is that I want to make a copy of the download device for the datalogger. I have made somthing that communicate with the datalogger, but something is wrong in the design.
I want to see what the original device is transmitting and compare it with the data my device is transmitting. There is alot of different "sniffers" around on the net, so thats no problem. The problem is how do I get the properties of MSComm32 in runtime.
Tried SmartCheck to see if that gives me the properties of how MSComm32 is used inside the program.
I have tried the trial-and-error method for to many hours.
(9600/8/N/1 hmm dosent work, lets try 2400/8/N/1 hmm dosent work..... and so on)

Some people say sleep can make marvelous things to the human race. It is 5:00 in the morning and I think I will give it a try ;-)
NikDH
11-10-2001, 06:23 AM
Originally posted by JohnnyBoy

The problem is how do I get the properties of MSComm32 in runtime.
Tried SmartCheck to see if that gives me the properties of how MSComm32 is used inside the program.
I have tried the trial-and-error method for to many hours.
(9600/8/N/1 hmm dosent work, lets try 2400/8/N/1 hmm dosent work..... and so on)

Hi to all,
well i've not reversed the mscomm32.ocx yet (perhaps i'll do it who knows eheh) but if i remember well the serial port can be programmed by the int under simple dos :)
Now i cant remember which r the specific interrupts and memory location to use but i think that if u look at ralph brown u'll surely catch them
Using that informations think u'll be able to know the properties of the connection (but i'm not so sure about it coz lotsa time has passed)
Make me know about it

See ya
NikDH
Sarge
11-15-2001, 01:13 PM
I have "cracked" mscomm32.ocx, Version 6.0, as used under
VB6. Might it be the same one you are using? If so, maybe I
can help. I could talk you through analyzing the executable,
or you could tell me were to get it, and I could try to do it
for you.

(Actually, this is one of the simplest OCX's to crack; it is quite small!)

Sarge
JohnnyBoy
11-19-2001, 08:41 AM
I have develop the hardware. Alot more difficult than the Software.
I want to improve the software from Alfano.
I want to know the baudrate,databits, parity and stopbits that the program use.
The program uses MSComm32. I want to se the properties used/sent to the control.
I think that they are sent just before receiving data, and they shoulkd not be changed until the close of the port.
Sarge
11-19-2001, 09:35 AM
Well, as I asked...How do you want to do it?
Should I talk you through the code, or do you want to send me
the program?
JohnnyBoy
11-20-2001, 03:23 AM
The software can be found at:
h**p://alfano-usa.com/Download/alfano.zip

The path thru the app to find the section where the MSComm32 is called is:

Francais -> English: (More readable that way)
Files -> Import Data from Alfano -> Start Scan

Now the Comport is ready to receive data from the Alfano timer.

What I want to know is only the parameters for MScomm32.
Sarge
11-20-2001, 10:11 AM
I downloaded the program just after my first reply; the OCX is the
same one I have already done. (I had to check to be sure that
my decompile of the MSCOMM 6.0 ocx used in VB6 would be the same as whatever was used in VB5).

If you have a hex editor, I can show you how to find the control's
default properties. Of course, they may change programatically,
but if you look at them, they are the standard control setup in the app.
(Hint: Baud is 9600)
JohnnyBoy
11-20-2001, 11:21 AM
The first thing I tried was to set the hyperterminal to 9600/8/N/1 and tried to understand what the Alfano was sending.
All I saw was rubbish.
I belive that it is mutch slower than 9600. I think it can be as slow as 300.

I whant to understand how I can read the parameters to MSComm32 with SI in runtime, because I think the parameters are changed by the program.
To do that I need to have a BP on a "ComOpen" function in MSComm32. I do not know what function inside MSComm to set the BP on.
Another way is to look in the memory for a register for the comport. The problem is that I do not know what to look for.
Sarge
11-20-2001, 05:09 PM
Well, I can only say two things:

1. 9600 (among other things) is what is in the comm control in the app.
This does NOT mean that this is what the com port will actually
run at; the program may change this.

2. You say you see only garbage; I assume you mean you don't
see text. Are you sure that you SHOULD see text? How do you know that the data isn't binary. Did you try the monitor mode?
It may give you a clue. (Since I obviously don't have the hardware, I can't generate or look at "live" data).

If you think that investigating the comm control is worthwhile, I will help you decipher the app data. But remember, this is only the configuration of the control as it is initialized, the program may change this during the runtime.

Sarge
JohnnyBoy
11-21-2001, 03:08 AM
I will start looking at the "garbage" bytes I get and try to get the binary data that I get.
When I get the data fo a file I will try some ideas I have.
First I will test a simple XOR.
Second try will be that 1:st nibble is one figure and second nibble is the second.

Is there a decompiler for VB5 like there is one for VB3 (Dodi)?

It will take at least to after this weekend

I´ll be back!!
Sarge
11-21-2001, 09:26 AM
Ok, thats the spirit! Attack the program!

Some thoughts:

So far, you only have the baud rate (again, assuming what is in the control is what the app uses); you will need at least the full setting data, ie: 9600,N,8,1 or whatever. I agree that, given the 9600, you can probably assume the rest, but you might want to make sure first. The second most common is 9600,E,7,1.

You can make a good guess as to the baud rate that is actually used just by watching how fast the data streams into the Procomm monitor window. There is an easily determined difference between 9600 and 300; if you are not sure, make come kind of connection to another serial source (another computer, or a second com port on the same computer) and send data to yourself at both baud rates. You will certainly see the difference! If the data is coming at 9600, then the rest of the settings in the control probably ARE the settings in the app.

If you need help to "decode" the rest of the control settings, I'll be happy to walk you through the code.

Good luck

Sarge
NikDH
11-21-2001, 10:04 AM
Originally posted by JohnnyBoy
To do that I need to have a BP on a "ComOpen" function in MSComm32. I do not know what function inside MSComm to set the BP on.

Hi to all,
well i can suggest u a little that shoudl work to find the bpx on the ComOpen function :)

Load the ocx into one of urs vb project and uses the ADDR
vb instruction to show u the addr in memory of the
ComOpen() function (use a dialogbox to show the address)
So use sice to locate that addr in mem and see whats the corresponding position in the ocx file when u find it
well patch the ocx putting a int3 where that function starts
So sice will pop everytime that function is called everywhere :)

See ya
NikDH


can soft-ice for dos be load in the lower memory
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > can soft-ice for dos be load in the lower memory
PDA

View Full Version : can soft-ice for dos be load in the lower memory

robertyonghu
11-10-2001, 07:38 AM
I am trying to crack a dos program. I use soft-ice v2.08. How ever the program can't work correctely by another program control the extended memory. Can I load the soft-ice in the lower memory?
DakienDX
11-10-2001, 07:58 AM
Hello robertyonghu !

You have to load SoftICE as a device driver in the CONFIG.SYS.
You must not load HIMEM.SYS, EMM386.EXE, QEMM386.SYS or any other memory manager.
You must load it before any other Device, DeviceHigh, Install or InstallHigh command.

Please read the documentation about the commandline options of SoftICE.
robertyonghu
11-10-2001, 10:44 AM
I have maneged to let the program compatible with softice, However I haven't got documentation for this verson softice. Will you please send a copy to me? my email is robertyonghu@yahoo.com. thank you!
DakienDX
11-10-2001, 11:07 AM
Hello robertyonghu !

Sorry, but I don't have the documentation for SoftICE 2.08.
I suggest to search the internet for SoftICE 2.80. It includes the documentation and CONFIG.SYS samples. There are two versions going around. One is from the original from SoftICE Suite, one is hacked by someone. (As far as I remember. I've just debugged one time with SoftICE for DOS :) )

Answer to your post in the Newbies Forum:

You can change the behavior of Windows starting a program in a DOS session by editing it's .PIF file.
I've never seen anything in Fortran, so I can't help you here. :(
Unregistered
11-10-2001, 01:07 PM
Originally posted by DakienDX
Hello robertyonghu !

Sorry, but I don't have the documentation for SoftICE 2.08.
I suggest to search the internet for SoftICE 2.80. It includes the documentation and CONFIG.SYS samples. There are two versions going around. One is from the original from SoftICE Suite, one is hacked by someone. (As far as I remember. I've just debugged one time with SoftICE for DOS :) )

Answer to your post in the Newbies Forum:

You can change the behavior of Windows starting a program in a DOS session by editing it's .PIF file.
I've never seen anything in Fortran, so I can't help you here. :(

Heya,
soft-ice v2.08 or soft-ice v2.80 works only on dos 6.22
you can load the dos program in windows dos prompt mode
c:\*.*\siw95\util16\dldr 'your dos program'

regards
stillnewbie
Unregistered
11-10-2001, 01:09 PM
Originally posted by Unregistered

Heya,
soft-ice v2.08 or soft-ice v2.80 works only on dos 6.22
you can load the dos program in windows dos prompt mode
c:\*.*\siw95\util16\dldr 'your dos program'

regards
stillnewbie

with softice for windows of course ;)

stillnewbie
robertyonghu
11-10-2001, 09:21 PM
Thanks to all the help
I have managed to find the documents. It is not easy for the old verson softice.


Sentinel Micro UX
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel Micro UX
PDA

View Full Version : Sentinel Micro UX

tr-
11-10-2001, 10:20 AM
Anyone got the Sentinel Micro UX api?


Is there a tool like frogice on NT/2K?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is there a tool like frogice on NT/2K?
PDA

View Full Version : Is there a tool like frogice on NT/2K?

binbin
11-10-2001, 11:00 AM
I have a software only run on NT.But, if softice is running, the program make a fatal error.
Unregistered
11-10-2001, 10:45 PM
Try NTall. can be found on tools sites.
zeroone
11-11-2001, 05:24 PM
Originally posted by binbin
I have a software only run on NT.But, if softice is running, the program make a fatal error.

try nticedump


Info
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Info
PDA

View Full Version : Info

mustpha_mond
11-10-2001, 03:35 PM
Hi to all,
After my retirement, sometimes i visite this nice site (and design) just to share something, read about "Web bugs" (& Guidelines for Using Web Bugs)

http://www.privacyfoundation.org/resources/index.asp

..... ahh who could imagine :)
Unregistered
11-10-2001, 03:45 PM
it would be Mustapha Mond, and sorry for posting it there.


Need help for Revirgin 1.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need help for Revirgin 1.2
PDA

View Full Version : Need help for Revirgin 1.2

ash
11-09-2001, 03:13 AM
Well i tried to crack Freehand10 italian version protected with Vbox 4.5 .

I got to the entry point dumped the .exe then came to revirgin
to resolve the import table. It took some time to resolve it
but even after that when i selected the show unresolved option there many of them unresolved.

The tracer didn't helped.

Please help me.
Solomon
11-09-2001, 04:56 AM
"trace" the unresolved ones, then "resolve again".

Just try it.

:)
SpeKKeL
11-09-2001, 05:13 AM
Strange,

Just Dl freehand10 >are you sure it's Vbox protected ????
I couldn't find nothing..Just reversed some jumps in the exe-file

CIao SpeKKel
ash
11-10-2001, 12:01 AM
Originally posted by SpeKKeL
Strange,

Just Dl freehand10 >are you sure it's Vbox protected ????
I couldn't find nothing..Just reversed some jumps in the exe-file

CIao SpeKKel

U may have downloaded the english version which is Rsagent protected but the italian and other versions are Vbox wrapped.
Need ur help!
ash
11-10-2001, 12:04 AM
Already tried it tracing the unresolved one's makes the sytem reboot.
tsehp
11-10-2001, 05:14 AM
ok two reasons :

1-the tracer is sent to a tracer's trap (some useless instrcutions like push[0] that will make a terrible crash.

2-vbox 4.3 has changed again and I could need to make some improvments, so send the downloaded app to my mailbox + iat entries you can't trace

btw, what's best to do concerning the bad iat to trace ?
The only way to guess them is to locate the refs = 0 , they don't have refs into loaded target's code

I just don't have the time to code an "intelligent" disassembler that will decide to throw the tracer or not in the entry, mangled code schemes will also hide some useless code that will anyway crash the tracer

I usually check some entries with sice before tracing them, maybe putting a small window that disass the entry could add something interesting ?

I'm waiting for everybody's suggestions on this.
tsehp
11-10-2001, 09:24 PM
and the problem is fixed, the tracer was stopping too early so rv was displaying the address correspondind as iat first address entry as result.

Here's the first part of iat listing, with first entries resolved, I'll let all of you take the time to trace the ones with ????
freehand 10.exe
10F8
index IAT_address value hint module function
--- -------- -------- ---- -------- --------
0 003FC000 77DBA3D0 01A7 ADVAPI32.dll RegQueryValueA
1 003FC004 77DB83EE 0185 ADVAPI32.dll RegCloseKey
2 003FC008 77DBA900 0195 ADVAPI32.dll RegEnumValueA
3 003FC00C 77DB89F0 019E ADVAPI32.dll RegOpenKeyExA
4 003FC010 77DB8C69 01A8 ADVAPI32.dll RegQueryValueExA
5 003FC014 77DB9200 0189 ADVAPI32.dll RegCreateKeyExA
6 003FC018 77DBA5DE 0188 ADVAPI32.dll RegCreateKeyA
7 003FC01C 77DB9514 01B3 ADVAPI32.dll RegSetValueExA
8 003FC020 77DBE77D 01B2 ADVAPI32.dll RegSetValueA
9 003FC024 77DB8B3F 019D ADVAPI32.dll RegOpenKeyA
10 003FC028 77DBA3A4 0191 ADVAPI32.dll RegEnumKeyA
11 003FC030 77B736C3 0056 COMCTL32.dll PropertySheet
12 003FC034 77B55482 0032 COMCTL32.dll ImageList_Draw
13 003FC038 77B6824A 005A COMCTL32.dll _TrackMouseEvent
14 003FC03C 77B55C19 002D COMCTL32.dll ImageList_Destroy
15 003FC040 77B55986 0046 COMCTL32.dll ImageList_ReplaceIcon
16 003FC044 77B560B8 002C COMCTL32.dll ImageList_Create
17 003FC048 77B54C2F 0033 COMCTL32.dll ImageList_DrawEx
18 003FC04C 77B55AA3 004B COMCTL32.dll ImageList_SetBkColor
19 003FC050 77B521C7 0011 COMCTL32.dll InitCommonControls
20 003FC058 77F4B076 0053 GDI32.dll DeleteEnhMetaFile
21 003FC05C 77F4E693 008E GDI32.dll EnumEnhMetaFile
22 003FC060 77F48154 0045 GDI32.dll CreatePatternBrush
23 003FC064 77F43F9E 0211 GDI32.dll UnrealizeObject
24 003FC068 77F68525 000C GDI32.dll Arc
25 003FC06C 77F46CD6 016F GDI32.dll GetTextCharacterExtra
26 003FC070 77F464BF 0050 GDI32.dll DPtoLP
27 003FC074 77F4819F 01F0 GDI32.dll SetPixel
28 003FC078 77F576E6 0038 GDI32.dll CreateFontA
29 003FC07C 77F45BD6 018B GDI32.dll InvertRgn
30 003FC080 77F4A439 0162 GDI32.dll GetROP2
31 003FC084 77F471AD 0128 GDI32.dll GetCurrentPositionEx
32 003FC088 77F4825B 015F GDI32.dll GetPixel
33 003FC08C 77F58504 0027 GDI32.dll CreateBitmapIndirect
34 003FC090 77F456D5 010E GDI32.dll GetBitmapBits
35 003FC094 77F456B3 01D3 GDI32.dll SetBitmapBits
36 003FC098 77F48B40 011B GDI32.dll GetCharWidthA
37 003FC09C 77F68DAA 00B3 GDI32.dll FrameRgn
38 003FC0A0 77F682F1 004C GDI32.dll CreateRoundRectRgn
39 003FC0A4 77F4125A 0167 GDI32.dll GetRgnBox
40 003FC0A8 77F4551D 01AE GDI32.dll Polygon
41 003FC0AC 77F682DA 0035 GDI32.dll CreateEllipticRgnIndirect
42 003FC0B0 77F43F59 004B GDI32.dll CreateRectRgnIndirect
43 003FC0B4 77F45C29 0020 GDI32.dll CombineRgn
44 003FC0B8 77F5ECF4 01C2 GDI32.dll RoundRect
45 003FC0BC 77F561FE 00AE GDI32.dll FillRgn
46 003FC0C0 77F4F3CB 0133 GDI32.dll GetEnhMetaFileA
47 003FC0C4 77F459CF 016E GDI32.dll GetTextAlign
48 003FC0C8 77F56C6E 01A0 GDI32.dll Pie
49 003FC0CC 77F494FC 002D GDI32.dll CreateDCA
50 003FC0D0 77F568CB 009A GDI32.dll Escape
51 003FC0D4 77F4A5D5 005E GDI32.dll EndPage
52 003FC0D8 77F4A4DB 0207 GDI32.dll StartPage
53 003FC0DC 77F68FDA 0001 GDI32.dll AbortDoc
54 003FC0E0 77F4A6C5 005C GDI32.dll EndDoc
55 003FC0E4 77F4AB24 0204 GDI32.dll StartDocA
56 003FC0E8 77F5893A 014A GDI32.dll GetKerningPairs
57 003FC0EC 77F4954C 00A0 GDI32.dll ExtEscape
58 003FC0F0 77F573DB 008F GDI32.dll EnumFontFamiliesA
59 003FC0F4 77F574C7 0090 GDI32.dll EnumFontFamiliesExA
60 003FC0F8 77F477AA 00A3 GDI32.dll ExtTextOutA
61 003FC0FC 77F4804C 0039 GDI32.dll CreateFontIndirectA
62 003FC100 77F47987 0179 GDI32.dll GetTextExtentPointA
63 003FC104 77F46D29 01F7 GDI32.dll SetStretchBltMode
64 003FC108 77F43FC6 01D0 GDI32.dll SelectPalette
65 003FC10C 77F4810D 01B4 GDI32.dll RealizePalette
66 003FC110 77F45719 019E GDI32.dll PatBlt
67 003FC114 77F46323 01F4 GDI32.dll SetROP2
68 003FC118 77F463F8 01B7 GDI32.dll Rectangle
69 003FC11C 77F41F4D 0123 GDI32.dll GetClipBox
70 003FC120 77F479A1 0177 GDI32.dll GetTextExtentPoint32A
71 003FC124 77F43297 0159 GDI32.dll GetObjectType
72 003FC128 77F43A04 004A GDI32.dll CreateRectRgn
73 003FC12C 77F449AA 0124 GDI32.dll GetClipRgn
74 003FC130 77F5652B 01FD GDI32.dll SetViewportExtEx
75 003FC134 77F42FF3 018A GDI32.dll IntersectClipRect
76 003FC138 77F46E60 0049 GDI32.dll CreatePolygonRgn
77 003FC13C 77F6E06D 0135 GDI32.dll GetEnhMetaFileDescriptionA
78 003FC140 77F44E7E 01DF GDI32.dll SetDIBitsToDevice
79 003FC144 77F53D97 0152 GDI32.dll GetMetaFileBitsEx
80 003FC148 77F45693 0044 GDI32.dll CreatePalette
81 003FC14C 77F47EF2 0158 GDI32.dll GetObjectA
82 003FC150 77F44A5C 0110 GDI32.dll GetBkColor
83 003FC154 77F449DA 0172 GDI32.dll GetTextColor
84 003FC158 77F450A4 01C8 GDI32.dll SaveDC
85 003FC15C 77F45171 01C1 GDI32.dll RestoreDC
86 003FC160 77F44B67 020D GDI32.dll TextOutA
87 003FC164 77F4590D 01F9 GDI32.dll SetTextAlign
88 003FC168 77F616E0 0142 GDI32.dll GetGlyphOutline
89 003FC16C 77F573F7 017C GDI32.dll GetTextFaceA
90 003FC170 77F57770 015B GDI32.dll GetOutlineTextMetricsA
91 003FC174 77F5EA2A 0164 GDI32.dll GetRasterizerCaps
92 003FC178 77F47A1A 017F GDI32.dll GetTextMetricsA
93 003FC17C 77F453D5 01DE GDI32.dll SetDIBits
94 003FC180 77F469AB 0032 GDI32.dll CreateDIBitmap
95 003FC184 77F470AE 012D GDI32.dll GetDIBits
96 003FC188 77F44505 002B GDI32.dll CreateCompatibleBitmap
97 003FC18C 77F41B02 01D6 GDI32.dll SetBkMode
98 003FC190 77F41D83 004F GDI32.dll CreateSolidBrush
99 003FC194 77F412F9 0168 GDI32.dll GetStockObject
100 003FC198 77F56F4A 005A GDI32.dll Ellipse
101 003FC19C 77F43F70 01CD GDI32.dll SelectClipRgn
102 003FC1A0 77F44AAA 0046 GDI32.dll CreatePen
103 003FC1A4 77F45F0C 0192 GDI32.dll MoveToEx
104 003FC1A8 77F45FF9 018E GDI32.dll LineTo
105 003FC1AC 77F4427F 012E GDI32.dll GetDeviceCaps
106 003FC1B0 77F41DB1 002C GDI32.dll CreateCompatibleDC
107 003FC1B4 77F43C2C 0052 GDI32.dll DeleteDC
108 003FC1B8 77F41E25 0026 GDI32.dll CreateBitmap
109 003FC1BC 77F4158A 01CF GDI32.dll SelectObject
110 003FC1C0 77F418D0 01D5 GDI32.dll SetBkColor
111 003FC1C4 77F419E6 01FB GDI32.dll SetTextColor
112 003FC1C8 77F46E79 0208 GDI32.dll StretchBlt
113 003FC1CC 77F43673 0055 GDI32.dll DeleteObject
114 003FC1D0 77F433E0 01FE GDI32.dll SetViewportOrgEx
115 003FC1D4 77F68F23 0212 GDI32.dll UpdateColors
116 003FC1D8 77F46985 0028 GDI32.dll CreateBrushIndirect
117 003FC1DC 02370000 0000 ?????? ??????
118 003FC1E0 77F45ABA 018C GDI32.dll LPtoDP
119 003FC1E4 02380000 0000 ?????? ??????
120 003FC1E8 77F5550C 0097 GDI32.dll EnumMetaFile
121 003FC1EC 77F6838C 01C0 GDI32.dll ResizePalette
122 003FC1F0 02390000 0000 ?????? to_Resolve
123 003FC1F4 023A0000 0000 ?????? ??????
124 003FC1F8 023B0000 0000 ?????? ??????
125 003FC1FC 77F45A1D 01EA GDI32.dll SetMapMode
126 003FC200 77F455BC 01AF GDI32.dll Polyline
127 003FC204 023C0000 0000 ?????? ??????
128 003FC208 77F50AA9 001B GDI32.dll CloseEnhMetaFile
129 003FC20C 023D0000 0000 ?????? ??????
130 003FC210 023E0000 0000 ?????? ??????
131 003FC214 77F460AE 0202 GDI32.dll SetWindowOrgEx
132 003FC218 77F4E407 0036 GDI32.dll CreateEnhMetaFileA
133 003FC21C 023F0000 0000 ?????? ??????
134 003FC220 77F4E369 00BA GDI32.dll GdiComment
135 003FC224 77F56E92 0165 GDI32.dll GetRegionData
136 003FC228 02400000 0000 ?????? ??????
137 003FC22C 77F45659 015D GDI32.dll GetPaletteEntries
138 003FC230 02410000 0000 ?????? ??????
139 003FC234 77F51E67 0134 GDI32.dll GetEnhMetaFileBits
140 003FC238 02420000 0000 ?????? ??????
141 003FC23C 77F446AE 0127 GDI32.dll GetCurrentObject
***TRUNCATED

as you can see, the 3fc004 leads to regclosekey and this is the first one traced, the same procedure can be applied to whatever entry, just make them one by one and save the text file regularly you sometime can have a crash if you repeat tracing too often.

Thanks for submitting the problem and helping me improve the tool's accuracy.

and if you want to laugh, read the bad side of the thread on general forum ;)
ash
11-10-2001, 11:39 PM
Thanks !!!!!
evaluator
11-11-2001, 04:19 AM
Hi!

Question:
1. This VBOX wrapper works like ASPRotect with IT (emulates), or
like telock or PCGUARD (executes IT and then erases).

Can you tell me what proggs (with not big download size)
uses this protection. I will check this protection.
+SplAj
11-11-2001, 05:06 AM
Tsehp

I unpacked latest Sm*rtWh**s 3.3 and C*mmV**wRA addon from
tamosoft - greetz to them.

Whilst the CVRA was pretty straight forward in W98/ME I had some pronb in Win2K cos RV can't see the process as runs a service ????

SWhois3.3 had 3 or so layers of call to get LockResource and FreeResource !

This was the first time I saw these API called in *normal* 4xxxxx program code, not high aspr code :eek: . I had a lot of manual tracing to do to get the real call (actually I new what the API was from the resolved.txt already), but manually traced to see wtf was going on. Someone (hi SV) could confirm this please.....rastaman, cos i got high :rolleyes: ...........

Also the hash/crc code was different. Someone has *optimized*
the routine to save a few clock cycles ! movsd x 4 instead of repz.

Looks like Alexey has been giving some tips ;)

Spl/\j
tsehp
11-11-2001, 12:24 PM
I'm overworked !
I'm actually finishing some clean emulation for all anti tracing tricks that spekkel sent me (thanks a lot, spekkel for your searching work)
Then I'll switch to this problem splaj, can u send the download urls to my mail box, this will remind me the next step !

soon,

tsehp
ash
11-12-2001, 12:38 AM
Hi
tsehp

Well i tried what u suggested for Freehand10 i tried tracing the unresolved imports 1 by 1 and the tracer puts a text in the particular import "traced" then i clicked resolve again and nothing happened .

What should i do.
tsehp
11-12-2001, 02:06 AM
download latest version
SpeKKeL
11-13-2001, 04:02 AM
HowdY Splay,

Did unpack Smwh3.3 and i think all works fine.....
But had to adjust some things cause i've doubts about 2-api's like 53d35c and 53d400 (ret004 ?? virtualfree ???)
That's why looping in next code goes wrong:

0177:0040439E JLE 004043B4
0177:004043A0 MOV EAX,[EBX*8+EDI]
0177:004043A3 INC EBX
0177:004043A4 MOV [0053B640],EBX
0177:004043AA TEST EAX,EAX
0177:004043AC JZ 004043B0
0177:004043AE CALL EAX
0177:004043B0 CMP ESI,EBX <value esi: AC
0177:004043B2 JG 004043A0
when ebx reaches 42 the value ac whitch supposed to be in
esi changes i think it has to do with an wrong api call
that doesn't set esi back.
(well i think they're wrong)
When i manually put esi back on ac all runs smooth...

Greetz,
SPekkeL
SpeKKeL
11-13-2001, 04:29 AM
Sorry my scream was to early !

I thouht if they wheren't to resolve they must be ret 004 !
And yes they were, so all resolved and skiped the
jz 87200 !(size sw3.3)

See you...:p

Spek
+SplAj
11-13-2001, 05:16 AM
SpeKK hehehe Lock & Load :p

Tsehp, nice anime of you 'bashing away' :eek: , but your thingy is a whopping 8k !!!! thought we had to be <2k .......

hmmmmm

:D :D now I make my 'tongue in cheek' anime gif :D :D ........
SpeKKeL
11-13-2001, 03:22 PM
Been everywhere seen everything ,only the lock loadresource
api i missed ??!?:confused:
I could use some tips resolving those two(seems indeed that
as diplaying some windows(options) the prog gives errors on reading...

T I A (maria) Spekkellllll
ash
11-14-2001, 01:15 AM
The latest version worked great thanks
+SplAj
11-14-2001, 01:44 AM
SpeKK

heer is my iat for SWho3.3

hmmmmm its an '.ace' file just delete the .zip ext............
SpeKKeL
11-14-2001, 03:18 AM
Thanks,

Just the same...only the 13D35C lockresource and 0013D400 freeresource........

Can you remember how you discovered those 2 ?!!?

Spek and play ?
+SplAj
11-14-2001, 07:43 AM
SpeKK

as I said, I did a *lot* of manual tracing with F8 key to get these final 2 api's ;)

Is this API redirection code in 'regular' exe code or aspr code ????
.............tamosoft are learning/teaching some co-operative anti -rebuilding tricks with Alexey............

does your rebuild work ???

Spl/\j
SpeKKeL
11-14-2001, 08:21 AM
Sometimes ??

I discovered that i don't have to use load and freeresource but can use the ord_2f ** B U T** when setting breakpoints in the prog. the options like"country-codes" doesn't work >> ERROR reading*(&(%$(&*_ or something like that.
Allso changing the jz in a jmp (eb) has the same effect .
Ahum go reading your latest tut. remember something about
hash crc
:eek:

Still bbizzy SpeKK
SpeKKeL
11-14-2001, 02:37 PM
Yeah Yeah,

After looking your Beautifull tut aspr. all works Super gut..
No more errors after hash correction! (hash,hash..)
(still using ord_2f ((sorry))

See you

VAn der Spek
tsehp
11-18-2001, 02:36 AM
Originally posted by +SplAj
SpeKK hehehe Lock & Load :p

Tsehp, nice anime of you 'bashing away' :eek: , but your thingy is a whopping 8k !!!! thought we had to be <2k .......

hmmmmm

:D :D now I make my 'tongue in cheek' anime gif :D :D ........

I could have mistaken, but the actual limit is 20k...


volatilities essay on unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > volatilities essay on unpacking
PDA

View Full Version : volatilities essay on unpacking

fizzik
11-11-2001, 05:45 AM
hi i've been searching for volatilities essay on manual unpacking for a while and i cant seem to find it. could someone point me in the direction of it, if they know where it is. cheers
Unregistered
11-11-2001, 07:01 AM
Originally posted by fizzik
hi i've been searching for volatilities essay on manual unpacking for a while and i cant seem to find it. could someone point me in the direction of it, if they know where it is. cheers

Hi,
h**p://tsehp.cjb.net
try your luck in this
h**p://wxw.immortaldescendants.org/#wn
fizzik
11-11-2001, 11:42 PM
cheers


SetClipboardData() in VC++
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SetClipboardData() in VC++
PDA

View Full Version : SetClipboardData() in VC++

-=EtnieS=-
11-11-2001, 07:08 AM
I'm having a lot of problems trying to implement a Copy to the Clipboard function in my keygen.

Especially SetClipboardData() disturbs me...

Can someone explain that API to me ? .. I'm a newbie in C++, so I don't understand the concept of data handles too.. ;)
Solomon
11-11-2001, 08:22 AM
read MSDN in the site of M$.

or just get a book named "Programming Windows". It is detailly explained in it.
binbin
11-11-2001, 12:18 PM
VC??
Just type F1.
I like MSDN CD.
binbin
11-11-2001, 12:21 PM
Copying Information to the Clipboard
In the Label application, the application-defined EditCopy function copies the current selection to the clipboard. This function does the following:

Opens the clipboard by calling the OpenClipboard function.
Empties the clipboard by calling the EmptyClipboard function.
Calls the SetClipboardData function once for each clipboard format the application provides.
Closes the clipboard by calling the CloseClipboard function.
Depending on the current selection, the EditCopy function either copies a range of text or copies an application-defined structure representing an entire label. The structure, called LABELBOX, is defined as follows.

#define BOX_ELLIPSE 0
#define BOX_RECT 1

#define CCH_MAXLABEL 80
#define CX_MARGIN 12

typedef struct tagLABELBOX { // box
RECT rcText; // coordinates of rectangle containing text
BOOL fSelected; // TRUE if the label is selected
BOOL fEdit; // TRUE if text is selected
int nType; // rectangular or elliptical
int ichCaret; // caret position
int ichSel; // with ichCaret, delimits selection
int nXCaret; // window position corresponding to ichCaret
int nXSel; // window position corresponding to ichSel
int cchLabel; // length of text in atchLabel
TCHAR atchLabel[CCH_MAXLABEL];
} LABELBOX, *PLABELBOX;

Following is the EditCopy function.

BOOL WINAPI EditCopy(VOID)
{
PLABELBOX pbox;
LPTSTR lptstrCopy;
HGLOBAL hglbCopy;
int ich1, ich2, cch;

if (hwndSelected == NULL)
return FALSE;

// Open the clipboard, and empty it.

if (!OpenClipboard(hwndMain))
return FALSE;
EmptyClipboard();

// Get a pointer to the structure for the selected label.

pbox = (PLABELBOX) GetWindowLong(hwndSelected, 0);

// If text is selected, copy it using the CF_TEXT format.

if (pbox->fEdit)
{
if (pbox->ichSel == pbox->ichCaret) // zero length
{
CloseClipboard(); // selection
return FALSE;
}

if (pbox->ichSel < pbox->ichCaret)
{
ich1 = pbox->ichSel;
ich2 = pbox->ichCaret;
}
else
{
ich1 = pbox->ichCaret;
ich2 = pbox->ichSel;
}
cch = ich2 - ich1;

// Allocate a global memory object for the text.

hglbCopy = GlobalAlloc(GMEM_DDESHARE,
(cch + 1) * sizeof(TCHAR));
if (hglbCopy == NULL)
{
CloseClipboard();
return FALSE;
}

// Lock the handle and copy the text to the buffer.

lptstrCopy = GlobalLock(hglbCopy);
memcpy(lptstrCopy, &pbox->atchLabel[ich1],
cch * sizeof(TCHAR));
lptstrCopy[cch] = (TCHAR) 0; // null character
GlobalUnlock(hglbCopy);

// Place the handle on the clipboard.

SetClipboardData(CF_TEXT, hglbCopy);
}

// If no text is selected, the label as a whole is copied.

else
{
// Save a copy of the selected label as a local memory
// object. This copy is used to render data on request.
// It is freed in response to the WM_DESTROYCLIPBOARD
// message.

pboxLocalClip = (PLABELBOX) LocalAlloc(
LMEM_FIXED,
sizeof(LABELBOX)
);
if (pboxLocalClip == NULL)
{
CloseClipboard();
return FALSE;
}
memcpy(pboxLocalClip, pbox, sizeof(LABELBOX));
pboxLocalClip->fSelected = FALSE;
pboxLocalClip->fEdit = FALSE;

// Place a registered clipboard format, the owner-display
// format, and the CF_TEXT format on the clipboard using
// delayed rendering.

SetClipboardData(uLabelFormat, NULL);
SetClipboardData(CF_OWNERDISPLAY, NULL);
SetClipboardData(CF_TEXT, NULL);
}

// Close the clipboard.

CloseClipboard();

return TRUE;
}


Hello,I am a cracker of China.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hello,I am a cracker of China.
PDA

View Full Version : Hello,I am a cracker of China.

zhenlong
11-11-2001, 09:23 AM
Hello,I am a cracker of China.I like crack.
Solomon
11-11-2001, 09:26 AM
hehe, funny:D
binbin
11-11-2001, 11:27 AM
hehe,haha.
Funny?
Funny.
Aimless
11-12-2001, 12:23 AM
A very warm welcome.

I hope you bring with you a knowledge of cracking which we all can share.

Feel at home.

...Have Phun
smallball
11-14-2001, 11:37 AM
hi£¡i came from china too!
you can email to me:zzglf@163.net
datm
11-22-2001, 08:40 AM
Ð´Ð´ÖÐÎÄ¿´ÔõÃ´Ñù£¡
winworm
11-28-2001, 01:04 AM
I am from China too.
binbin
11-28-2001, 08:10 AM
ÖÐÎÄÒ²ÐÐ°¡¡£
ºÇºÇ¡£

learning...:D


Armadillo 2.x
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 2.x
PDA

View Full Version : Armadillo 2.x

captain=trip
11-11-2001, 09:49 AM
can anybody please give me some tips how to remove an armadillo 2.x protection?

regards
***captain-trip
captain=trip
11-14-2001, 05:19 PM
it's Armadillo 2.1
I want to manually unpack it

thanks
***captain-trip


Tag&Rename 2 whatever
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tag&Rename 2 whatever
PDA

View Full Version : Tag&Rename 2 whatever

+SplAj
11-11-2001, 10:01 AM
Tsehp

just a quick support message. I just rebuilt T&R2 from softpointer - greetz to them as well ;)

latest RV performed 99.9%. Got every API fixed with trace/emulate feature with *no* crash :D on Win2K SP2.

only one teeeny prob:-

0 001A81A4 77E8693D 010D KERNEL32.dll GetCurrentThreadId

RV missed the start of the call by a few bytes. Just manually entered the start of API and found 100%

Thanks mate. Took me only 15mins while my new colleague was out of my office for lunch ;). Congratulations.

Spl/\j
Bengaly
11-11-2001, 02:33 PM
*G* Splaj you never supprise :-)))
as i always say...Congratz ....
/me hope he could be his new colleague hehe :-))

Cya and good day.
Bengi
asterikz
08-28-2002, 07:30 PM
hi
could you please give me some hint for dumping tag & rename.
i have problems finding the oep.
using softice 4.05, winice, iceload
tag & rename 2.0 build 2
i put a bpx createfilea and after that i f12 five times(the next f12 would run the prog and tracing with f8 finally leads into some kernel api i can't handle). then i used /tracex 400000 600000 and i get a hit at 5982b8 that looks like the OEP.

push ebp
mov ebp, esp
add esp,-00c
push ebx
push esi
push edi
mov eax, 597cb8
call 407298<-this call finally leads to getmodulehandlea

i use /pedump 400000 1982b8 dump.exe
i found out that there are 2 section the program needs
i dump them to disk
/dump e11000 17000 dump1.bin
/dump e30000 c000 dump2.bin
then i use PEDITOR to add the sections to my dumped exe and adjust the image size to e3c000 and the virtual offset.
the program runs and hangs. nothing happens. i think its not the real OEP. can you halp me?
thanx a lot
asterikz
_Servil_
08-28-2002, 08:55 PM
asterikz t&r is a delphi app, dede will find for you.
Stone()
08-29-2002, 10:27 AM
Hehe +SplAj, you're a lucky one. I wish that RV would behave with me like it does with you.
+SplAj
09-02-2002, 01:37 PM
Holy shit i thought someone hacked my account :(

....That original T&R2' post is almost a year old and I had a nice beta from Mr Smart that fixed the aspr GetWhatWeWant API's ......
just for me haaaah :)

So I just d/l 'NEW' T&R2.1 (what is with this guy...read the history file and he needs to go back to skool) and tried that ASPR plugin ...it failed. So now I have to write my own. So reverted to the manual way and fixed it in 30mins. Everyone should take care with that plugin, it gives false API or none resolved (which is better)... and you get runtime errors and spend days debugging.

While travelling I also fuxed that Adobe GoLive Vbox trial with Imprec tracer... that worked nicely... funniest was the passenger on the jet asked me what the 'black screen' was that kept appearing on my notebook hehehehehe.

Well u go away on vacation .........and the mods re-arrange the store just like Walmart ;) ...I need to lurk around and find my way again...... 'Packing + Unpacking Forum ' wtf duh .????...

it's gooood to be [arrogantly] back :)

Spl/\j
SpeKKeL
09-08-2002, 12:00 PM
Hope you've had a good vacation and there aren't damaged to much of your braincells ...

Yep untagged and renamed this prog without to much prob's.
Seems imprec1.4 sometimes refuses to load a plugin ?? tried with
imprec 1.3 and here all goes smooth?!
About that latest plugin>it's never released cause of that kernell
patching stuff
:eek:
seems the one before does it's job ok(asprbeta2)
But who cares, manually resolving gives more satisfaction i think ?! :D

h'mm mis some old posts since the forum is rebuilded, wonder what they used imprec or r.v..

Ciao,

Spekkel
foxthree
09-08-2002, 06:58 PM
Hiya +SplAj:

Welcome back.... we missed u. :)

Signed,
-- FoxThree


vramdir
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > vramdir
PDA

View Full Version : vramdir

Unregistered
11-11-2001, 07:42 PM
i read an essay by thunderlord detailing his adventures with disassembling the vramdir vxd (http://www.woodmann.net/fravia/lordthu1.htm). the essay was interesting and helped me in understanding how he removed the 30-minute limitation, but i'm still unsure about one thing:

vramdir's author claims that the registered version is "a little bit faster than the trial version" -- can anyone tell me what this translates to in code??

thanks,
tom


Crypkey SDK.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crypkey SDK.
PDA

View Full Version : Crypkey SDK.

Ziggie
11-12-2001, 12:34 AM
Hello,

I'm new to crypkey decoding and I'm trying to decrypt
a crypkey sdk prog. Can anyone point me in the right
direction?

Thanks,
Ziggie.
peterg70
11-12-2001, 06:50 AM
Which version of the SDK and which program in the SDK

I am currently trying to modify the SDK files to generate sitekeys.

If you have any info let me know may be able to help out


help with unpacking webpics.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help with unpacking webpics.
PDA

View Full Version : help with unpacking webpics.

fizzik
11-12-2001, 02:14 AM
i posted a question about this a few weeks ago, since then i've read LOTS of essays on manual unpacking, though i still can't seem to get my head around making softice break so i can find the oep. The file ive been trying to unpack is from h**t://www.express-soft.com/ftp/webpics.exe . i would REALLY appreciate it if someone could point out the packer of this file, and steer me in the right direction of finding the oep. cheers

(ive had this prog for a little while now and im getting real frustrated with it)
CoDe_InSiDe
11-12-2001, 02:41 AM
Hi fizzik,

Well, the Packer is ASProtect :)
To unpack i suggest to first read some other threads on this Message Board, because there are enough ;)

Cya...

CoDe_InSiDe
NikDH
11-12-2001, 05:13 AM
Originally posted by CoDe_InSiDe
Hi fizzik,

Well, the Packer is ASProtect :)
To unpack i suggest to first read some other threads on this Message Board, because there are enough ;)

Cya...

CoDe_InSiDe

Hi fizzik,
code_inside is absolutely right but i shouold give u some advices right now:
finding the oep isnt very hard task even with asprotect

The first thing u need is a tracer and if u've icedump its perfect
with the command /tracert

First of all u've to let aspr unpack the prog in memory and dump it to the hd so u've a copy of the original file
This copy wont work coz it has wrapped import table and wrong oep

Where's the oep in the original file?
In the .text section of coz
Usually its the first section of the dumped copy of the program but there r lotsa more efficient ways to identify it
So note down on a paper the addr where this section
starts and ends and so lets restart the packed program
U've to break inside it before aspr starts unpacking it and use the /tracert command giving the starting and ending address u've noted before
This way sice will trace the program and will pop every time the eip will land between the address u've given it
This will mean the before or after u'll surely get the oep :)

See ya
NikDH
hobgoblin
11-12-2001, 03:08 PM
Well, I tried your approach:no luck.
(I think you mean /tracex not /tracert though.
Maybe somebody could post a way to get Sice to break at OEP when the program starts to run?
I think the OEP is 401000, but how stop there?
Using /tracex didnt' work for me...
NikDH
11-12-2001, 07:35 PM
Originally posted by hobgoblin
Well, I tried your approach:no luck.
(I think you mean /tracex not /tracert though.

I think the OEP is 401000, but how stop there?
Using /tracex didnt' work for me...

Hi hobo,
well i was confused u r right about /tracecx

What do u exactly get using this kinda approach ?

U say sice never pops when using /tracex ?

Be sure to have icedump loaded and test /tracex functionality

Try putting any breakpoint and when sice pops use tracex command using current eip and following instruction address
if sice pops u r sure /tracex works well

So u've to check to have set correctly the /tracex params
Try to check out the icedump manual for them

Another reason coz sice hasnt popped is coz the limit u've set doesnt identify a the .text section of the prog
and so the eip never gets between the limit set
Try with other sections till u find .text section
Think u can locate .text section quite easily analyzing the program when its unpacked in memory and is running normally
Make us know

See ya
NikDH
+SplAj
11-13-2001, 05:09 AM
Hi

RCE#1 arrogant bastardo to the rescue.......

Did you try my 'aspr v commview 3.1' tutorial ? in there is my splajomatic way of getting the OEiP via the last 61,FF,E0 in aspr code before handing control to original exe ........
this is the quickest way I know :cool:

Otherwise just set a /tracex 401000 550000 for webpics and wait 45 minutes until si pops at 504CCC :p

USUALLY the normal start code bytes are 55,8B,EC.........

If you want me to hold yer hand just ask :o I can make a mini 'OEiP' tut if you still can't get it ...............an arrogant bastardo version of course :D
Unregistered
11-13-2001, 09:07 AM
Splaj,

You are an arrogant bastard all right, but you help, me and the board in general.
I'll take that any day.

Note: Have you been in the army????
Unregistered
11-13-2001, 10:28 AM
Hiya,
+Splaj, please check your pm.
regards
hobgoblin
11-13-2001, 01:00 PM
Hi there,
Thanks for the info. Yes, I have read your tut on comview posted recently. Nice work. But unfortunately your described way of finding the last bytes of code of the unpacking code doesn't work when I try it. (I'm on winMe, but I don't know whether that has do do with anything).
I can see what I did wrong when I tried the /tracex command in icedump. I was too impatient.:-) I only waited for a few minutes...
Okey, I'm off to try to unpack Webpics manually. I did a lot of unpacking in the past, but after being away from the cracking scene for a long time I have a lot to learn. Alexey(?) sure have developed the asprotect since the last time I unpacked it (that must have been one of the first version he put out).

regards,
hobgoblin

BTW, about being arrogant: Na, I don't think your that special.:-)
I have seen worse while surfing on the net for the past 4 years....
Kayaker
11-13-2001, 10:58 PM
I remember those discussions Hobgoblin. Learned a lot about unpacking from you. In the 'good 'ol days' of dumping Aspack sections ;)

regards,
Kayaker
+SplAj
11-14-2001, 02:02 AM
hob

---------------------------------------------------------------------------------
I can see what I did wrong when I tried the /tracex command in icedump. I was too impatient.:-) I only waited for a few minutes...
---------------------------------------------------------------------------------

Alexey is putting MORE useless code to stretch the single-stepping time. Half a year ago my old notebook PII 266 used to take ~20mins against aspr. Now it's up to ~45mins :-(

Just press Ctl-D back in to SI any time to see that loop ;)

So,

I'll make a WinME OEiP tut just for you...........it's real easy.......just maybe a prob to make the bpm/bpr etc 'stick' ;)

.......and yes the OLD ~ 0.8 aspr was a laugh. No IAT redirection and the OEiP hard coded in the compressed exe ...... Alexey learned quickly :D

Spl/\j

PS i'm finished with being an Arrogant Bastardo now, that 30 day reality trial as 'unregistered' suggested was a bitch to crack. I'm sticking to fuxxing shareware only from now on :D
Solomon
11-14-2001, 06:39 AM
Has anyone tried CloneCD v3.110?

It redirects many functions of USER32.DLL and puts many "holes" in the IAT. Wants to bore us to death? but I think we can defeat this easily by enhancing ReVirgin/ImpREC or write plug-ins for them, coz all the redirected API calls have the same pattern:

push xxxxxxxxx
................
push YYYYYYYY <------------------somewhere in the middle of an API function
ret

I just found OEP = 401000 and managed to rebuild the IT/IAT, corrected a redirected call(call [004CC4BC] =====> call 00401584), but still got "EAccessViolation". Don't know why. Maybe it puts some data in ASprotect?:confused:
DakienDX
11-14-2001, 11:24 AM
Hello Solomon !

I remember that kind of redirection. I came accross it some time ago.
I don't remeber where, but it was no ASProtect.
(great, now we don't know where ASProtect got it from :) )

So you can't set a breakpoint on the API, because you never get there.
NikDH
11-14-2001, 07:51 PM
Originally posted by Solomon
Has anyone tried CloneCD v3.110?

I just found OEP = 401000 and managed to rebuild the IT/IAT, corrected a redirected call(call [004CC4BC] =====> call 00401584), but still got "EAccessViolation". Don't know why. Maybe it puts some data in ASprotect?:confused:

Hi solomon,
its probably asprotect api
Putting code inside asprotect and reading it there its asprotect api (kill3xx docet)

The program checks 4 asprotect presence putting data inside asprotect mem space so unpacking it its hard work
To catch where the err happens just put faults on

When u find where he puts data just look inside the original file what its looking 4 and patch the unpacked one so he can get it
Its better 4 u not to patch the code that checks the asprotect api but to simulate asprotect presence allocating memory and filling the allocated zone with the approprieted data :)
Thats coz the program should check it many times

Usually asprotect creates kinda table filled with the address of the mem zone where asprotect api r present
If u find the where the table is u can fill it with static values
so u dont have to allocate mem but u can just put asprotect api data inside the pe if i'm right :)
Make me know

See ya
NikDH
Solomon
11-14-2001, 08:29 PM
hi DakienDX,

Thx for your reply. I'm sure it is a new version of ASProtect, maybe v1.3 or higher, who knows, coz Alex hides it. Yes I can't set a breakpoint at the entry point of some APIs, but we can set it at the end of the API, e.g the "RET" instruction.:D

Originally posted by DakienDX
I don't remeber where, but it was no ASProtect.
(great, now we don't know where ASProtect got it from :) )

So you can't set a breakpoint on the API, because you never get there.
Solomon
11-14-2001, 09:16 PM
YES NikDH u are right!
Tracing the unpacked exe, I saw it pushes some 00E9xxxx and attempts to copy the MainForm resource data there, where 00E9xxxx is in the addr space of the packer or in the heap. Then I got "EAccessViolation".
ASprotect evolves quickly and gets tougher.(greets Alex)

Originally posted by NikDH

Hi solomon,
its probably asprotect api
Putting code inside asprotect and reading it there its asprotect api (kill3xx docet)


I'd like to crack larger programs than crackmes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I'd like to crack larger programs than crackmes
PDA

View Full Version : I'd like to crack larger programs than crackmes

zed
11-12-2001, 08:57 AM
im learnin since 2 weeks and i've cracked some games n stuff, but now ich want to crack winace or acdsee or microangelo, but there is so much code inside i think it'd take hours to find the right registers. So do you know some tutorials for me or maybe you can give me a gew tips. thanks for reading...
Bengaly
11-12-2001, 11:27 AM
heya Zed...

Look Jumping into a Deep pool without knowing how swim seems like a drastic jump aint it ?
2 weeks wont even make ya crack the medium crackme :-)
not talking about Winace etc...
it's not that u are bad or something, u just need more and more practice....
there are allot in cracking than 2 weeks can't tell, not mention 2 years..
So keep reading Tutorials at krobar.cjb.net will be a good start..

Cya soon

Bengi
seeker
11-13-2001, 10:56 PM
well it really depends IMO. I did jump in, but later got back out after realizing that the "normal" (if there is such a word) programs were too difficult to begin with. So i did a couple of crackme's, got the principles and the ideas correct - and then jumped in!

you can't really say that nobody can do it within 2 weeks - hey i did. You just have to have the aptitude, and the "cracker's mentality" there already... one thing good for me is that i already had working knowledge of some basic assembly already, so it helped. Plus i already had lots of experience in debugging programs (mine and others), although at a level higher than asm.

So it really depends. But you are correct to say that one should always start out with the basic tutorials first.

Originally posted by Bengaly
heya Zed...

Look Jumping into a Deep pool without knowing how swim seems like a drastic jump aint it ?
2 weeks wont even make ya crack the medium crackme :-)
not talking about Winace etc...
it's not that u are bad or something, u just need more and more practice....
there are allot in cracking than 2 weeks can't tell, not mention 2 years..
So keep reading Tutorials at krobar.cjb.net will be a good start..

Cya soon

Bengi
DakienDX
11-14-2001, 11:51 AM
Hello seeker !

I suppose in this two weeks you've unpacked fourteen packers, fourteen protectors, fourteen copy protected CDs, bruteforced fourteen RSA-keys and cracked (guess how many, yes...) fourteen copy protected floppy discs.

Or is 'cracking' to you just replace 74h/75h with EBh?

I didn't post this to attack you, just to show you some aspects of 'real' cracking.
You can't learn this in two weeks, you can't learn it in two years, perhaps in twenty, but then cracking would be different because we've new operating systems, new tools and new protectors. Or do you think that in twenty years anybody will use VBox, Hardlock or TRW2K any more?
seeker
11-14-2001, 01:57 PM
Originally posted by DakienDX
Hello seeker !

I suppose in this two weeks...

Or is 'cracking' to you just replace 74h/75h with EBh?

I didn't post this to attack you, just to show you some aspects of 'real' cracking.

yeah? seems more like an attack (not personal, of course, but still..) to me.

lighten up man. What's your prob? I'm just basically replying to the post, which is just talking about the crackmes. Cant u move beyond crackmes? who ever said that you have to jump into "packers, protectors blah blah blah yada yada yada" straight after the crackmes?

i'm just trying to encourage somebody to stretch his limits if he feels so inclined to. That a crime?

so what's your prob??? :rolleyes:
DakienDX
11-14-2001, 02:15 PM
Hello seeker !

I've no problem. :)

Well, I though it took you two weeks to learn cracking, which means more to me than just doing crackmes. I've never done any crackmes myself, so I can't talk with you when discussing if a crackme is good for starting cracking or not.

I didn't realize that you were just talking about 'crackmes' and not the whole 'cracking'. Sorry for missunderstanding you. :rolleyes:

But the post looked to me as I understood it:

"normal ... programs ... too difficult ... crackmes ... then jumped in ... within 2 weeks - hey i did"
Unregistered
11-14-2001, 05:19 PM
This is where a debugger comes in, or the string references in w32dasm.

For example you can look at the string references in w32dasm and notice it says "The key you entered is incorrect", that means it just checked if the serial was right, look a bit back to see where it was called from and patch it. Depending on the program this might be a bit difficult though :)

Or you want to crack a cd check in a game. Load the debugger, put a breakpoint on kernel32!getdrivetypea and start the game. If it breaks you know you are probably in the cd check.

After you have found where the protection is the actual cracking is no more difficult for a 10mb exe compared to a 10kb exe.
DakienDX
11-15-2001, 01:10 AM
Hello f0dder !

You said WinRar? A 'not-so-well-working authenticity verification'?

Well, I'm a registered user of WinRAR, and I've seen many keygens for it claiming to be compatible with the lastest versions, but not working with any version after 2.50. They make it look registered, but AV doesn't work. The cracks are really 'lame' and of course not working.

So you can crack a program, keygen it to say 'registered', or keygen it to work the same as the registered version, which hasn't been done so far on WinRAR. I've never done any research on it, but why should I? I'm a registered user. :)
zed
11-18-2001, 01:09 PM
Respect @ DakienDX, i dont know much people, who ve bought a program

But tell me how can be differences between keygens????

oh, thx for post, im working...
DakienDX
11-18-2001, 01:56 PM
Hello f0dder !

The keycheck algorithm was changed after version 2.50. The DOS version 2.50 was the last one released, so there were no limitations for the keycheck under Windows. Registered users had to write to rarsoft to get an updated key. (Or I had because they didn't have my email)

Hello zed !

Keygens can work or they can seem to work. In the example of WinRAR I compared a keygened file for my name with my registered file. Not supprising they looked different, but there were missing about 100h hex character (~120 bytes) at the end of the keyfile. I think this data is used for generating the AV, but nobody knows what data is missing (of course every user has different keys), so nobody knows what he should keygen there actually.

I once keygened a program (I won't tell it's name here, it was a security monitor). It used a main program, a DLL and a VxD.
You could enter a serial in the main program. It was a quite complex algorithm to generate valid keys. When I'd finished it I entered it and the program said "Thank you for registerering". I noticed that the program's window title showed "Unregistered". So I restarted it and came again to the "Please register" dialog. I tried it some more times and always got the same result.

I finally found out that the DLL checked the key too, but in a different way. So I coded again and the keygen seemed to work, no register dialog poping up, no window title saying unregistered. But I wasn't able to use the security options on more than two files at the same time.

Checked again, found (guessed) that the VxD also checks the key somehow. I hardcoded an "Int 3" on init (non dynamic VxD) and somehow found the check before Windows GUI was loaded. Coded again.

"Error communicating with driver" - This time a fixed value was checked from the VxD. Replaced it. Finally keygened it. It works now, but there is still a value which is checked for "0" or "1" which I don't know what it is for. If it's "0" or "1", everything is OK, else... (unregistered)

I found two keygens and a serial by well known cracking groups on the internet. The two keygens just bypassed the the first check, the serial worked with the second check too, but not with number three and four.

Next example: CDRWin. It has two checks which say registered or not, one who says "pirated" later, two who will burn damaged CDs if not correct and still four bytes with unknown function.

Conclusion:
The author has sometimes left a backdoor in his key-verifycation, which will make all available cracks useless.

A similar example is a internet-program, which accepts keygenned serials, but when going online it connects to it's homepage and refuses the 'check-key'. Because the check is made on the company's server we can't keygen it.


MD5 works but RIPEMD-160 does not work
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > MD5 works but RIPEMD-160 does not work
PDA

View Full Version : MD5 works but RIPEMD-160 does not work

niki
11-13-2001, 12:00 AM
Hi Everyone,

It is easy to get the MD5 fingerprint of a file by going to

http://www.fourmilab.ch/md5/md5.zip

then extracting md5.exe from md5.zip and typing
md5 followed by the name of the file and hitting Enter.

*******************************

The official RIPEMD-160 home page is at
http://www.esat.kuleuven.ac.be/~bosselae/ripemd160.html

This is RIPEMD-160
http://www.nic.com/~cheah/rmd160.tar.gz

PROBLEM
==========================
rmd160.tar.gz does not contain a .exe file that can be used to
get the RIPEMD-160 fingerprint of a file!?

QUESTION
==========================

IS IT POSSIBLE TO USE WINDOWS SYSTEM TO GET THE RIPEMD-160
FINGERPRINT OF A FILE and if so HOW ????

Thanks in advance,
Niki.
Solomon
11-13-2001, 12:39 AM
Just modify "main.c" in rmd160.tar.gz to get it to work under windows. Replace the <unistd.h> and the relative functions with appropriate windows routines. "rmd160.c" and "rmd160.h" are platform-independent.

regards
Unregistered
11-13-2001, 09:39 AM
Checkout http://www.witeg.prv.pl tools&toyz section

bart
Unregistered
11-13-2001, 11:01 PM
hi bart !
nice to see you in this forum.!
bart is one of the best keygener in the polish scene
more than 200 keygen source for free!
asm,c,hash,crypto...
in his PACKs 1.2.3.4.5.6...

hxxx://atena.eu.org/~fixer/zrodla.html

ouspixa
niki
11-14-2001, 02:12 AM
Than you all for your replies are very much appreciated.

I only know how to use the .exe files.

For example, in the way that you can post this URL
http://www.fourmilab.ch/md5/md5.zip
which contains a .exe file that can be used to get the MD5 fingerprint of a file, is there a URL that can be posted which contains a .exe file that can be used to get the RIPEMD-160 fingerprint of a file?
DakienDX
11-14-2001, 12:12 PM
Hello niki !

I would suggest using "DAMN Hash Calculator".
It includes MD5, RIPEMD-160, CRC32 ( :) ), SHA-1, SHA-256, SHA-384, SHA-512 and many HAVAL variants.
Niki
11-20-2001, 01:13 AM
Thank you all so very much.

Your helpfulness is even more overwhelming than your knowledge
and your knowledge is incredible.
Firstly, you gave me expert advice and when I could not use the expert
advice because of my own lack of knowledge, you actually put an
attachment that I can use to get the RIPEMD-160 hash of a file.

I had posted on so many boards asking how to get the RIPEMD-160 hash of
a file but nowhere is there such knowledge and helpfulness as there is
here.

To honor your knowledge with more questions I am only beginning to
learn. For example, there's a program called AutoWipe which can be
downloaded from
http://www.inetprivacy.com/ftp/awipe.exe
AND/OR
ftp://ftp.inetprivacy.com/awipe.exe
I was facinated how it counted down from 15 days and then expired.
If it was on day 6 and you uninstalled the program and then installed
it again, it "remembered" and was still on day 6 when it was
re-installed. I had no idea at all how it did this. From reading on the
internet I got a clue what it did to the computer. Searching the
registry for "AutoWipe" I found deleting
HKEY_LOCAL_MACHINE\Software\iNetPrivacy\AutoWipe
caused it to simply lose count and revert back to the 15 days.

That was so simple but it took me ages to work it out.

Another program was more devious. Ultra Lingua which can be downloaded
from
http://www.simtel.net/pub/simtelnet/win95/lang/ule30.zip
counted down from 30 days. Deleting this
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\PSEMEE
restored the computer to its original state. Took me months to find
that out and how I eventually did it was I used a program called
InCtrl4(In Control 4) which can be downloaded from
ftp://ftp.zdnet.com/acq/downloads/pub/zd/PCMag/inctrl4.zip
The program InCtrl4 showed me that Ultra Lingua made the write to the
registry as "PSEMEE". Ultra Lingua was so devious it did not write to
the registry in its own name!

Now I'm completely baffled again.
Does anyone know how to restore computer to its original state after
installing and uninstalling UltraEdit?
http://www.ultraedit.com
ftp://ultraedit.com/uedit32.zip
ftp://ftp.btsoftware.com/pub/download/nt/uedit32.zip

It is most extremely ethical to know what changes a program makes to
your computer. This is especially true when a program tries to hide
from the PC user the changes it makes to the computer. It is in this
most extremely ethical search for truth that I wish to know how to
restore computer to its original state after installing and
uninstalling that UltraEdit program.

Thanks in advance,
Niki. depo_us9@yahoo.com


Crykey MK II
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crykey MK II
PDA

View Full Version : Crykey MK II

peterg70
11-13-2001, 05:49 AM
Okay

Need some thoughts please

I tried to disassemble skw.exe (site key generator) no luck.

Had a quick look has the usual .text, .data .tls .rdata .idata .edata .rsrc and .reloc

Followed by Have, a nice, day!

Thoughts on best way to handle this or if you have seen this before.

TIA
CoDe_InSiDe
11-13-2001, 05:58 AM
Hi peterg70,

"Have, a nice, day!"

Are those 3 Sections, or is it a line behind the last Section? :)

Cya...

CoDe_InSiDe

P.S. Can you maybe upload or give an URL for the file? :D
Solomon
11-13-2001, 07:25 AM
I'm also interested in the SDK files:D
Kythen
11-13-2001, 06:24 PM
skw.exe is packed with Crypkey's normal packer/encryptor. Those "Have" "a nice" "day!" sections are the code and data for the decrypting/unpacking code. I've found WinDbg, the debugger from the windows sdk to be very handy in unpacking such exe's. You can trace through them, then do a full dump of it with procdump, because windgb is controlling the process. No breakpoints or icedump or any other messy stuff to deal with :) Finding the OEP is easy... it's held in a memory location and then jumped to with jmp [whatever].
Unregistered
11-14-2001, 07:57 PM
If your looking for the SDK for Crypkey

Do a google search for SDK and Crypkey

I hear korean sites are useful sites for downloading
Solomon
11-14-2001, 09:31 PM
GREAT! I just found v5.5b in a korean site;) cheers

Originally posted by Unregistered
If your looking for the SDK for Crypkey

Do a google search for SDK and Crypkey

I hear korean sites are useful sites for downloading
Ziggie
11-14-2001, 11:17 PM
I found Crypkey 5.7 sdk but it's passworded :(.

Ziggie
Unregistered
11-15-2001, 04:20 PM
Ziggie

Where did you find it?? Google can seem to find anything these days.

I need a refresher course in Search engine searching !?

Off to the fravia site again.
CDotic
11-16-2001, 06:12 AM
Ziggie/Unregistered:
Search for Crypkey SDK: ["Crypkey SDK" "Crypkey Instant" "Crypkey STEALTH"]
Search for Installshied password recovery: [installshield password crack]
Solomon
11-16-2001, 08:40 AM
The password of this InstallShield version is very easy to crack.

Here is the fomula:

(00F143AC + 2 * (ASCII sum of password) ) ^ 00051993 = XXXXXXXX

XXXXXXXX can be found with SoftICE.:D


Fixing PE headers to run under XP?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Fixing PE headers to run under XP?
PDA

View Full Version : Fixing PE headers to run under XP?

Dr Apocalypse
11-13-2001, 10:50 AM
Is it possible to fix programs that run perfectly under WinMe/98 but return:

xxxxxxxx.exe is not a valid Win32 application

Under XP? I noticed this with unsecurom dumped files!

I have tried utils like PEditor 1.7 that has options to make EXE's NT/Win2k compatible, but no luck!

DrA.
Unregistered
11-17-2001, 06:22 AM
Maybe try LaZaRuS's tool PE-Validator
Dr Apocalypse
11-17-2001, 08:16 AM
Thanks, but have already tried about every possible util from protools to do with PE headers, some I just plain don't understand!

The only thing PE Validator said was wrong was 'SizeOfImage' but made no difference to it's execution!

Unsecurom does not run under NT/w2k/XP but has an asm source, so it could be recompiled by a more knowledgeable person to run under XP, but not by me!

Thanks for the suggestion, but looks like this is an excercise in futility!

DrA.
LordCrass
11-17-2001, 01:38 PM
The headers in XP should be the same as in 2K. I cracked Diablo2 a while back and had to fix the header to work for Win2K and the same file now runs properly under XP as well. If the file isn't too big, perhaps attach it to a message here.
DakienDX
11-17-2001, 02:53 PM
Yes, I unpacked Diablo II too. I didn't use an automatic unpacker. I never did on CD-copy-protections.

Then I replaced the sections in the original file with the unpacked ones and corrected IT and OEP. It worked.
Then I looked at the section's physical size and corrected it to the lowest 200h boundary I could find. It worked.
Then I deleted the three SecuROM sections. It worked.
Then I moved the PE header to 80h. It worked.
Then I removed any space in the exe which was not covered by the first 400h header bytes or by the sections. It worked.
Then I corrected the checksum. It worked.

I was sure that I had a Windows compatible file now.

Indeed, it worked on Win98, Win98SE, WinNT, WinME, Win2K. My friends were impressed and we played it all the night.

Two days after that one of my friends told me that he could not play in the internet any more and that the official updates wouldn't work.

Then why had he asked me to crack it even if I warned him that he won't be able to play in the internet any more. So compatibility is a aspect with more than one possibility.

Sorry to post things like this but it's the mood I'm in at the moment.

I hope I showed what points can be checked if a file won't run on NT systems.
Not only the checksum is important. Other possibiliities are a objects physical size, the location of the PE header, the header's size, parts between sections not belonging to them, how the file is aligned. Many more to say, these are the most common.
Dr Apocalypse
11-17-2001, 03:18 PM
Hmmm...

Maybe it would be better if someone looked at unsecurom and saw why it creates files that don't work under XP! Mind you, the prog itself won't run under XP, unless you bypass the OS check :) now that I could do!

DrA.
VLuka
11-18-2001, 12:14 PM
LordCrass: a sample is here (http://www.gamecopyworld.com/cgi-bin/dl.cgi?cmr2_109!zip). This is unsecurom-ed CMR Rally 2 v1.09. I think that it has something wrong with sections but I don't know how to fix them yet - I'm just a learning newbie :)
DakienDX
11-18-2001, 03:01 PM
Please no direct links to other pages outside the forum!

Hello VLuka !

I download the file and noticed two things:
1. The Import Table Pointer (PE+00D8h) points outside of the file.
2. The import table is not fully rebuilt, some API calls point to the addresses of the Win9? functions.

I couldn't test more since I haven't the game or the DLLs.
Dr Apocalypse
11-18-2001, 09:27 PM
How did you determine points 1 & 2?

I have G-Rom's 'makepe' tool, that let's you rebuild the import table from a list of dll's, but couldn't get it to work! I have the original of Colin McRae 2 but can't even unwrap my original cos unsecurom won't work so used VLuka's link to try it out! He He!

Made a list of dll's the EXE imports but makepe chokes on the rebuild?

dlls:
msvcrt.dll
kernel32.dll
ddraw.dll
dsound.dll
dinput.dll
winmm.dll
user32.dll
advapi32.dll
gdi32.dll
ole32.dll
msacm32.dll
binkw32.dll

Even when something does work with this tool, the EXE comes out 4x bigger?

So how do I rebuild the import table and fix the Import Table pointer!

Damn newbies, eh!

DrA.
VLuka
11-21-2001, 01:00 PM
Ok, thanks for the reply. I've checked Import Table and tried to rebuild it and still no good. I'm searching now what else can it be :)
Gadix
11-22-2001, 05:33 PM
Hehe, yes, dumped's files by public version of UnSecurom (1.0) don't work under NT/2000/XP. This is due WinNT/2000/XP check if VirtualOffset of the sections are equal to VirtualOffset+VirtualSize of the previous section. Also check if SizeOfImage are equal to VirtualOffset+VirtualSize of the last section. ImportAdressTable(IAT) must be a valid address, but is not a necessary value, you can change to 0

Gadix[WKT!2001]

PD: checksum is not needed for exes
DakienDX
11-23-2001, 05:12 PM
Hi f0dder !

I wasn't talking about the IAT (PE+0080h), but about the "Import Table Pointer (PE+00D8h)". This entry is not important for importing DLLs. When looking at it, it is '0' in most cases or points to the beginning of the OriginalFirstThunk.

I thought it might be possible that XP doesn't like any invalid pointers in a Win32 exe.

"SizeOfImage are equal to VirtualOffset+VirtualSize of the last section"?
I don't know about it when loading an .EXE, but it isn't important any more after the .EXE is loaded. Many unprotected programs have an '.data' section where this check doesn't apply, because the VirtualSize is bigger than the PhysicalSize. So there could be a PhysicalSize of 2000h and a VirtualSize of 58ACh and the following section starts at the next boundary. (Real example from a program working under WinNT/Win2K/WinXP).
Dr Apocalypse
11-23-2001, 08:11 PM
Thanks for the info Gadix!

Will there ever be an XP friendly version of unsecurom 1.0 so I can redump my older games?

I grabbed a few PE docs to try to understand some of the structures, but alas, I have a long way to go, sniff! I'm totally lost!

Thanks for all the input, hope I haven't wasted anyones time!

DrA.
Dr Apocalypse
11-26-2001, 01:58 PM
OK! Working with the Colin mcrae2 EXE that Vluka found, I did some more poking about in the header and found the SizeofImage is suspect!

From Gadix:

Also check if SizeOfImage are equal to VirtualOffset+VirtualSize of the last section

Last section of file is .rsrc (Virtual size= 1560h virtual address = 863000h, added together = 864560h) Size0fImage reported as 465000h!!

So last section is bigger! Do I need to alter SizeofImage to compensate!

DrA.
VLuka
11-27-2001, 02:55 AM
Ok, I have fixed CMR2 1.09. Here's what I've done:

- corrected VSizes to VSize(x) = VOffset(x+1) - VOffset(x)
- corrected last VSize to VSize(last) = SizeOfImage - VOffset(last)
- corrected .rdata flags to C0000040

Now it works under XP :)

Thanks for Your precious time. You're the best of the best (as said in R6) :cool:
Dr Apocalypse
11-27-2001, 11:52 AM
:)

He he, it took a while to understand that (x+1) meant the next sections offset, but having figured that out I fixed the sections with Procdumps PE editor (Sections Editor) and also set the data characteristic to C000000H.

.text vsize = 0010F000 (no change)
.rdata vsize = 00005000 (originally 0000421C)
.data vsize = 0034E000 (originally 0030F090)
.rsrc vsize = 00002000 (originally 00001560)

vsize(last) = Size0fImage (465000) - Last section Voffset (463000) = 2000

EXE now works :D

Thanks for the 'spoon feeding' lesson!

DrA.


IDA Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IDA Question
PDA

View Full Version : IDA Question

Unregistered-
11-13-2001, 12:44 PM
Whats the difference between

mov edi, [ebp+arg_8]
mov edi, [ebp+var_8]

please a good explanation :-)
DakienDX
11-13-2001, 02:35 PM
It's very easy :)

arg_? points to a parameter, var_? to a variable. Everything clear? I don't think so. :)

Lets show an example:
Push Offset Param1
Push Offset Param2
Call TestProc
Add ESP, 8

...

TestProc:
Push EBP
Mov EBP, ESP
Sub ESP, 8
Mov EDI, [EBP+arg_8]
Mov EDI, [EBP+var_8]
Mov ESP, EBP
Pop EBP
Ret

If we follow the code, at the beginning of TestProc there's the return address at [ESP], the pointer to Param2 at [ESP+4] and the pointer to Param1 at [ESP+8].
With the "Push EBP" each value is increased by 4 so Param2 would be at [ESP+8].
Then we make EBP=ESP, so we can access Param? by [EBP+?].

But why do we do this?

Simple: We can decrease ESP by a count to get space for local variables. So the [EBP+?] is still valid, but we can also access [EBP-?].

You must imagine that arg_? is a positive number and var_? is a negative number.
So accessing [EBP+var_8] means [EBP-8], which will access the data which is currently at [ESP].

We must take care to never access data under [ESP], because this data will be destroyed with the next "Push" instruction.

So we write down:
The address space over EBP+8 is used for accessing parameters given to the procedure.
The address space between ESP and EBP is used for local variables. Their values will be random on init and will loose their values on exit of the procedure.
[EBP] contains the old value of EBP at the begin of the procedure, which must be resored at the end
[EBP+4] contains the return address and must also stay intact

All this rules only apply to normal programs. Protectors may sometimes use ESP and EBP in other ways to prvent debugging and disassembling.

Historical Review
Why don't we use just ESP+? to access both local variables and parameters?

1. We would have to change the '?' after each "Push" and "Pop" intruction.

2. In 16-bit code there is no [SP+?]. You can only use [BP+?] to access the data on the stack (as well as BX, SI, DI)
And we all know that the PC started at 16-bit code. :)
Kayaker
11-13-2001, 09:31 PM
Hi DakienDX,

Damn, that was such a clear explanation even I understood it :p

Welcome aboard the firing line as mod btw ;)

regards,
Kayaker
DakienDX
11-14-2001, 01:28 AM
Hi Kayaker !

Thanks. I'll do my very best. :)

What ever this will be and how complicated this will be. :D


Only IDA 4.17 can disassemble this dll...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Only IDA 4.17 can disassemble this dll...
PDA

View Full Version : Only IDA 4.17 can disassemble this dll...

mdos
11-13-2001, 01:13 PM
I'm starting to look at reversing this app, which is using a DLL to perform it's registration checks. The extension is not dll, but the file seems to be a standard PE DLL. I launch w32dasm 8.93 and have a go at it, but it comes up with nothing for the .text code section. So I launch IDA 4.17, and it works, only the code is all in the .data section.

Hmmm....

I check out the file with UltraEdit, and it looks like SizeOfCode == 0 in the PE header.

Is this the result of a packer?
How did IDA know to find code in the .data section?
Why did w32dasm choke on it?

Thanks.
Aimless
11-15-2001, 01:27 AM
You will have to search for a document called:

quine1.htm

on fravia's site (Tsehp's/Woodmann's mirror, now)

Learn the anti-wdasm trick there.

Then search the net for newer tricks (to garble even IDA)

...Have Phun


Any good SEH documents out there ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Any good SEH documents out there ?
PDA

View Full Version : Any good SEH documents out there ?

Lord_Soth
11-13-2001, 04:53 PM
LS
tony b.
11-13-2001, 05:20 PM
Matt Pietrek's "A Crash Course on the Depths of Win32 Structured Exception Handling", from the 1997 MSDN... excellent.

regards,

tony
Kayaker
11-13-2001, 05:52 PM
Hi LS,

Here's a few more.

Win32 Exception handling for assembler programmers by Jeremy Gordon
http://www.GoDevTool.com

Some source from EliCZ
http://www.anticracking.sk/EliCZ/infos/SEHall.zip

And there's 2 examples at Iczelion's
http://win32asm.rxsp.com/files/SehEn.zip
http://win32asm.rxsp.com/files/SEH.zip

Cheers,
Kayaker
Lord_Soth
11-13-2001, 06:58 PM
thanks guys :)
Unregistered
11-13-2001, 08:32 PM
YES it's GREAT! It gives me many hints when unpacking progs protected with SEH tricks, such as ASProtect etc;)

h**p://wxw.microsoft.com/msj/0197/Exception/Exceptiontop.htm

Originally posted by tony b.
Matt Pietrek's "A Crash Course on the Depths of Win32 Structured Exception Handling", from the 1997 MSDN... excellent.

regards,

tony


help on a llittle crypto mission : -)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > help on a llittle crypto mission : -)
PDA

View Full Version : help on a llittle crypto mission : -)

Bengaly
11-14-2001, 04:46 AM
heya guys
i am in thins contest which i can get 300 points.
this will rank me up in the mabye 1 position and will win Thundercats toys :-))
so polease give it a shot like me :-)

here is the Encrypted Message i need to DEecrypt:

@!*%)!]EN_(!E%)IE:$%\E%\E+<):$]_E<:EN<:Y\E*<%]E+*!as!EN_(!E%)AEEN<:Y\E*<%]E:$%\E%\E@!*%)!]IE.!E<]!E]!<~%)#E?_"E*_"~E<)~EN*!<]AEE$_E*?)/S_IE$_.E%\E!,!]?_)!OEE!,!]?_)!E%\E@%)!E.!E\$_"*~EM!E*<)~%)#E%)E<M_":E@_"]E~<?\E@]_(E)_.AEE!/N!**!):IE*%_)S_E.%**EM!E#*<~E:_E$!<]E:$<:AEE%\E!,!]?:$%)#E<**E]%#$:OEE?!\E!,!]?E:$%)#E%\E@%)!E*?)/S_E_"]E!)!(%!\E$<,!E)_:E(<~!E<E\%)#*!E(_,!E:$<:E.!E&)_.E_@E\%)N!E.!E<]]%,!~AE%)E@<N:E%EM!*%!,!E%:E%\EM_:$!]%)#EN$!!:<]<E<)~E:?#]<AEE:$<:E%\E:_EM!E")~!]E\:__~IE.!E.%**EN_):<N:E?_"E<:E:$%\E:%(!E:_(_]]_.AE]_#!]E<)~E_":E@!*%)!]IE:$%\E%\EN<:Y\E*<%]E\%#$%)#E_@@AE

Authors note:

The KGB, roughly the Soviet Union’s equivalent to the CIA, often used one-time encryption pads. These pads had symbols and characters that changed from message to message. They were thought to be unbreakable, unless you had the key that was on the other pad. This puzzle is similar to that, because I randomly selected the alphabet, or did I? If you can decode it, you may have a job waiting for you at the CIA.

Here are a few things to remember. In the English language, the most common used letter is "E". On a key bored the most common button pushed is the "space key". Using these two things, and some luck you should have a message that will read as if it were a perfectly typed instant message. If you can successfully find which Key I used as "E", I would suggest assigning the key right next to it as "F" and so on. BTW the vary first word of the message is a ThunderCat word. That is a word appearing only in ThunderCat related areas. Also look for patterns. Like any conversation, this one has many small words. The repetition of the same letter sequences over and over again usually mean s it is a word. Each symbol then respects another letter. There is a strict 1 to 1 bases, meaning that no where in the puzzle does it take more then one symbol to from a letter.

Good luck

any post will get me up thinking thanx u..

btw, io may think that _ is " " spaceBar ascii, i may get wrong though.

cya guy.
thanx Bengi
Fake51
11-14-2001, 08:07 AM
Hi

If u use Winhex it has a function to analyze a file's contents. That way u can see what characters are the most commonly used. Go with E as being one of the top three or four. Then apply the hints given. Using some sort of hex replace function should ease your work considerably. Good luck.

Fake
Bengaly
11-14-2001, 08:23 AM
Hey,
thanx for the winHex tip...
from the analyze graph it told me, it seems that E is 'E' but the second most used is Spacebar than so winHex tells me the second most used is '!' so i guess we have a start here..
i will try to analyze more..
hope to seemore help ,
thanx
Bengi
MH2K
11-14-2001, 10:16 AM
He Bengi,
Solved it for you :D

Here's the encryption table:

E space
! e
_ o
% i
) n
< a
: t
] r
\ s
* l
$ h
~ d
N c
# g
? y
@ f
" u
A .
M b
I ,
Y '
S -
+ p
O ?
. w
, v
( m
& k
/ x

the small a and s character in the encrypted message are not changed.

Also, I played around a bit with spacing to see the words more clearly, so there might be some double space left somewhere.

Here's the message:
feliner come in, this is panthro at cat's lair please come in. cat's lair this is feliner, we are reading you loud and clear. ho lynx-o, how is everyone? everyone is fine we should be landing in about four days from now. excellent, lion-o will be glad to hear that. is everything all right? yes every thing is fine lynx-o our enemies have not made a single move that we know of since we arrived.in fact i believe it is bothering cheetara and tygra. that is to be under stood, we will contact you at this time tomorrow. roger and out feliner, this is cat's lair sighing off.

Good luck,
cya, mh2k
Bengaly
11-14-2001, 12:01 PM
man, u l33t
thank you for helping me, i very appriciate it..
now i can *mabye* be in the 1 position :)))
and again thanx u rox.


SmartCheck detection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SmartCheck detection
PDA

View Full Version : SmartCheck detection

dunno
11-14-2001, 05:21 AM
I have a VB5 app which kills Regmon on start and crashes my W98 when ran with SmartCheck. I tried PGC's patch on Regmon but it didn't work.

I've searched thru the disassembled string references hoping to find any path/file name/file extention/VxD reference to SmartCheck/Regmon but failed to find one.

Is there a known method/tool against SmartCheck detection?

Thanks.
Dr Apocalypse
11-14-2001, 06:33 AM
Have you tried WinExpose Registry from h**p://www.shetef.com

This was the registry monitor I used before upgrading to XP,
but the blasted thing won't run under it now, even XP's compatability option fails to run it :(

DrA.
4oh4
11-14-2001, 11:09 PM
As for regmon detection, the only tricks that I've run across were searches for its class name among open processes. More than likely pgc's patch just changed the class name to something else. Try searching for 'filemonclass' in a hex editor and changing it to something else. I think that's what it was anyways.

For smartcheck detection, you can use the same technique. There might be more techniques for avoiding smartcheck detection but I don't tackle too many vb apps/crackmes so I really couldn't say.
dunno
11-15-2001, 04:57 PM
Thanks for your replies.

Taking a closer look, I've found a reference to SIWVID among the strings. I think it is the display driver of Sice. However, the proggy works in absolute harmony with Sice even without the aid of Icedump. Thanks Sice I got my reg number but I'm confused. Why to put that check there if it does nothing at all?


Softice and large memory configuration
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice and large memory configuration
PDA

View Full Version : Softice and large memory configuration

Anticode
11-14-2001, 08:36 AM
Hi,
I recently upgraded my computer to a P4 with 512MB ram.
I have tried to run softice (from driverstudio 2.01) on my WinME:
I edited winice.dat to reflect the memry configuration,
Restart the computer with softice.

I get BOSD with a message that VCACHE faild to allocate memory.
if i set the entry in winice.dat to a lower value (128), windows will now load but now I get from time to time exception 0E inside softice.

Any Ideas!?
DakienDX
11-14-2001, 11:31 AM
Hello Anticode !

Please open your SYSTEM.INI, search for "[vcache]", insert two variables "MinFileCache=" and "MaxFileCache=" and set their values to a number of kbytes.
I suggest to set it to 65536, since nobody will have the need for a 512MB file cache. :)
64MB are OK for me, I don't need more, but I haven't tried more. So if it doesn't work for 128MB, try 64MB.
kp_
11-14-2001, 11:36 AM
Hi!

I had 24Mb in my prev. computer so I had PHYSMB=24 in my winice.dat. In the one I use now there is 512, but it went correctly with the 24Mb setting. After setting PHYSMB=512 it didn't start - BSOD if I remember good (this was on 98SE btw). So I wrote it back to 24 and it runs fine since then. Just set it to 24 or some little value :)
btw: Why does softice need this value? Does anyone know?
I only have a little problem. I think it isn't in connection with the mem setting, but who knows :)
Sometimes it does not read the INIT line until the end but olny some characters (~15). Sometimes it's ok, and starts perfectly.
Anyone knows why? (I think it's not beacuse it's too long since in most cases it starts up and processes the INIT line fine)

Hope it will work for you too.
Best regards,
kp
DakienDX
11-14-2001, 04:01 PM
Hello kp_ !

Please read this (http://www.woodmann.net/forum/showthread.php?threadid=804) post for an explanation.


lost W32Dasm file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > lost W32Dasm file
PDA

View Full Version : lost W32Dasm file

UrgeOverKill
11-14-2001, 08:50 AM
Does anybody know where I can find the help file for w32dasm??

mine doesn't seem to open correctly...
DakienDX
11-14-2001, 11:35 AM
Hello UrgeOverKill !

I could send it to you by email, but I think it would be easier to search for the whole W32Dasm package in the internet. It should be located on many sites (~600kb) and since I don't know your W32Dasm version, this way should be the best.


A question...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A question...
PDA

View Full Version : A question...

hobgoblin
11-14-2001, 01:42 PM
I short question: why does my computer reboot when I try to sue the trace function in Revirgin? (I'm on winME). Is this something that can be avoided by shifting to win2K?
regards,


Microsoft Activation Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Microsoft Activation Protection
PDA

View Full Version : Microsoft Activation Protection

JMI
11-14-2001, 02:41 PM
Back in May to early June there was a thread here on the Microsoft Activation Protection. Doing some research recently on the subject I came across an article by a German company by the name of Fully Licensed GmbH that has apparently done an indepth analysis of the activation process. They have placed their article on the net and made it freely downloadable and distributable. At the conclusion of the article there are links to their web site which has some source code which they wrote to help them analyse the process and they have a tool to help examine the activation code.

Thought this might be of interest to some of you so I'm uploading the text file here. Their site is hxxp://www.licenturion.com. Hope it's helpful.

JMI

I seem to be unable to attach the text file so the downloadable file can be found at hxxp://www.licenturion.com/xp/fully-licensed-wpa.txt


IDA v4.15 leaked / stolen.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA v4.15 leaked / stolen.
PDA

View Full Version : IDA v4.15 leaked / stolen.

CrackZ
11-14-2001, 03:21 PM
Hiya all,

I wanted to put my 2c on this one since I've just seen it.

I'm really angry that someone could and would actually be so stupid as to steal this for a few MB's on a few lousy sites, and also totally compromise a legitamate end-user, its this sort of practise that really pisses me off in the scene and I hope some of the more intelligent people around here will agree with me.

Of course, all the lameasses who couldn't afford or be bothered to buy IDA will now be downloading like morons just to see a few extra features they didn't need anyway.

I'm disgusted.

CrackZ.
Unregistered
11-14-2001, 05:29 PM
What does it matter? Every program gets pirated, and it has exactly the same effects on the makers of the program. I don't think it's very usefull to single out one program that should not be cracked or stolen.
Unregistered
11-14-2001, 08:47 PM
I Agree with the above post by unregistered.
I think CrackZ is being a little hard on the good people that help others. CrackZ doesn't even answer email messages when someone needs help so It's all fine with me if he's "sick"
Solomon
11-14-2001, 09:40 PM
If I have money I will buy it. But I can't afford it at the present($299/$495). I'm a poor guy.:(
Aimless
11-15-2001, 01:25 AM
Where? Where?

...Have Phun
DakienDX
11-15-2001, 01:38 AM
Hello aimless !

Please no requests or this post will be closed. (deleted?)

I found it too, but I thought it was a cracked version, until CrackZ posted it here.

But why do you need it? As CrackZ said "just to see a few extra features they didn't need anyway". CrackZ is right. Even the 4.18 hasn't new features you need as cracker.

Download the 4.1 Freeware version. Or do you need to disassemble your hand calulator's or your GameBoy's ROM?

Would you like it if every year one of your programs which you paid $500 for is stolen and you aren't able to receive any more support or updates?
Unregistered
11-15-2001, 08:19 AM
Kudos goes to ArthaXerXes for acutally making some sense here.
I believe that CrackZ has a right to be mad also; just like the programmers that coded the programs that he has cracked. ie: on his website there is a listing of 'dongled' programs that he has helped to or has cracked.
So in retrospect in looking at CrackZ's post; I wonder if he's more concerned with the legimate end user of the program; or mad because, he paid money for 'his' copy and now people can get it for free?
that being said I think ArthaXerXes has made a couple of good points in his post and thats my 2c.
DGR
11-15-2001, 08:46 AM
I must say I'm in doubt about this one... I am glad to see it released and yes, I will be using it. On the other hand my problem with this release is is that it's at the cost of a end-user. While it's true that warez are always hurting someone it's usually the companies producing the software... and as for Datarescue, I don't see why they should be spared while other (very) good companies get hacked and cracked all the time (numega? w32dasm? maya/3dsmax etc...).

But, the fact that this release might be stolen from an end-user DOES make it less nice for me. I also don't like carding releases, for the same reason... it's at the expense of a single, innocent person who has nothing to do with the whole scene/thing. And that's also the case with this one...

Still, I am glad to see it released... no, I might not need all the newest functions but as with all software a new version is not released without reason so it's always nice to have that newer version.
Lord_Soth
11-15-2001, 11:43 AM
What does the freeware version of IDA give us and what
are the limitations compared to a regged version ?
Is it worth using or should ppl just go for the warezed
version ??

The way I see it, crackers (or reversers heh) such as ourselves could usually go away with the freeware version
as long as it's good enough for us, and leave the full
versions alone for those who really wanna buy them.
I think DataRescue should think about this point.

In any case, while I dont like theft of any kind, I don't
object to warez. Simply because in our commercialized
world, companies and businesses make way too much
money off the end users. And I don't mean hard working
people. I'm talking about the capitalism and the ripoff
attitude companies have.
Warez tends to balance that somehow, even if it's actually
an illegal act.

Warez does other good things for the software vendors
and not a single person on earth can state otherwise.
We all know what warezed versions of Win95 did for
MS..

So, to balance it all, we have on one side the bad things,
which are theft and hurting other end users, and on the
other hand we've got a fight against capitalism and
actually improving one's circulation.

The same goes for games. I can count too many games
I've had from friends burning copies for me, then I went
out and bought the original (to play on bnet for example)
or because a new game or xpac came out that I wanted
so I went and bought it knowing what the original game
gave me (lots of fun usually hehe)..

There's good and bad, and I don't think IDA should be
singled out among the other softwares on the planet.
Games, apps and even (YES!) IDA, gets warezed. Accept
it, and take the good of it and the bad of it...

LS
LaptoniC
11-15-2001, 11:48 AM
I really cant understand the attitudes towards IDA.Everyone gives SoftICE, and other numega apps,w32dasm,resourcer,etc freely. We see them as a tool but not IDA. I really cant find the "why" of this question.
DakienDX
11-15-2001, 12:09 PM
Hello everybody !

The point in stealing IDA and releasing it is that IDA includes the key and the signatures of it's real owner.

So if a version gets pirated, the user who paid money for it will loose his right for updates and support.

If you distribute SoftICE for example, the only one who gets harmed is Numega, because we can easily generate working serials for SoftICE. So no 'registered' user of SoftICE will get harmed.

But as tsehp showed (http://www.woodmann.net/fravia/tsehp_ida.htm) us, there are many ways to follow the pirated version to it's user. We don't know a way to remove the signatures, because we don't no which data is a signature and which not.

So we harm a user, not only the software company.
Kythen
11-15-2001, 12:34 PM
First, I'm sure CrackZ is mad that it was a legitimate user that got screwed over by some greedy sceners, not that it was warezed over all. It pisses me off too in fact. Yes, everything gets warezed. But come on... you shouldn't screw over a guy from what he legitimately paid for just because you want a certain program. We're theives, yes, but that doesn't mean we don't have lines that shouldn't be crossed.
As for why people treat IDA differently from other tools...
IDA is so far above and beyond any other tool of its kind, and many people respect the guys at Datarescue for it. For what it can do and the time I'm sure they put into it, the price they set on it is probably lower than what it should be! (at least IMO). Yeah, IDA's gonna get warez... but Datarescue is a company I and a lot of others like, so we hope that the damage is kept to a minimum.

Regards,
Kythen - saving up for his legit copy of IDA :)
CrackZ
11-15-2001, 03:32 PM
Hiya,

My main point to this post, which several people have picked up on here, was NOT the fact that IDA had been warezed, I'm not in the "we shouldn't crack this particular software because its good" religious group. IF someone had actually 'cracked' it by removing the protection then I think even DataRescue would have taken their hats off.

What I objected too here is the fact that this version was stolen from a legitamate end-user, who will no doubt now be feeling DataRescue's wrath for sharing his copy, there was no attempt made to even conceal where it came from.....(not even a trivial one), and thus someone (who could just have easily have been me - yes I admit to sharing my copy) who has paid $495 has now donated without their consent their name and copy of IDA to a zillion lamers who didn't need it anyway.

On a secondary point. It always amazes me the number of people who MUST have the latest ever versions of every piece of software without ever really knowing why they need it.....as some other people have pointed out here, the freeware version or 4.04 that still kicks around the web is perfectly adequate for just about everyone.

It saddens me actually that people still proclaim their divine right to have every single piece of software their exploding HD's continually demand, of course I won't expect to see any of them buying or cracking soon, and I bloody well hope no future versions of IDA leak so you can all sit with 4.15 whining about why you don't need / but must have v4.xx in the future.

Regards

CrackZ.

[OLD WHINING BASTARD].
Mario
11-15-2001, 05:44 PM
Wow ! where are we heading to ?

I thought this place was preparing us for free reverse education.
I'm rather astonished the way some people react because a holy star has been shared with the whole scene. Who knows if the person did intentionally share it, or just bought it for the masses.

How do you know it was stolen? do you know the person ?
why are you so radical when others try to touch what you already have ? Aren't you open minded ?

Where's your sense of freedom ? where's your sense of harmony ? Why do we all fight for liberty and freedom ?

How do you feel when you give a sweet mango to someone who can't reach the top of the tree ? Don't you feel happy ? Don't people loose their lives when they try to help others.
Have we all forgotten the real essence of life ?

Stop quarelling on a piece of software and think of what this board is meant for. If someone has stolen or decided to share out this copy of the software, so what ? It's not the first time, and neither will be the last.

Blessed is the person who decided to help out others, and let him have my eternal gratitude.

My special thanks for "Revirgin", which is a rare piece of diamond which can't be estimated. It's more than a friendly, sentimental and very outstanding tool. When something goes wrong tsehp
doesn't complain. He cares for us all and frequently updates it.

Why can't we all be happy for others.

BUT WHY DID YOU BRING THIS TOPIC HERE ?
If you feel your inner ego hurt , then complain elsewhere and thus we can avoid problems.
UrgeOverKill
11-15-2001, 06:49 PM
All of you guys have made excellent points, I have the freeware version and have been using for years. Its good enough for what I do, if I *really* need it, then I will buy it, is damn hard to learn anyway.

I don't think its a major deal that this ver. is out, its just a refresher of the current ver anyway.
CrackZ
11-15-2001, 07:05 PM
Ah, how silly of me, I can see the errors of my ways in daring to suggest that screwing a licensed user was immoral at the very least.

In light of this, if all licensed users of IDA v4.1.8 who dutifully paid their $495 would please queue up in an orderly fashion to donate their copies, names and future support for the greater good of this predominantly selfish, self-serving excuse for a scene, (who don't know why they need the latest version of the software anyway) then I'm sure all will be well.

I also fail to see what this has to do with ego, your deluding yourself if you think this place really educates anyone, other than in the art of cracking the neverending latest versions of particular protections ;-), perhaps it should also have crossed your minds that I might be in a very good position to say that it was indeed STOLEN, since I tend to check my facts before posting.

Oh well, my cause is lost, and I've seen enough.

Regards

CrackZ.
4oh4
11-15-2001, 07:12 PM
man-oh-man.....

Regardless of your opinion/use of warez, there exists only 3 possibilities to this 'leaked/stolen' release in my mind:

1) This is a carded release.
Don't shed too many tears for the victim because he will be able to call the cc company and have the purchase removed.

2) The original buyer leaked it himself.
It's his own damn fault, so let it be.

3) The original buyer shared it with someone else who leaked it.
It's his own damn fault, so let it be.

Did I miss something here? If you're taking the stance that warez are alright (if illegal) and you're only burned about the "innocent victim" (original buyer), than just realize that no matter how this release got leaked it's his own damn fault.

....my $.02
Lord_Soth
11-15-2001, 07:39 PM
1. aye.

2. Indeed, and it's his right as well..

3. agree 100%.

Regarding choices 2 and 3: If the guy leaked himself the
program, he knowingly (it's his right) screwed himself
up (he knew he wont have updates etc..) and thus it
was his choice (nothing you can do about it there..).
For option 3, if he shared it with some1 and sonehow now
it's pirated, he should blame himself (he got himself into
the mess).

I often give copies of original games I buy to my friends,
and they in turn do the same for me. So what ??
I don't care.

Bottom line: Screwing a person over is, yes, immoral and
sleazy. However, I'm not gonna cry about it and get
pissed off by such a trivial matter such as that.

Life has enough important issues to get worked up by
, without feeling sorry for ONE (and we are talking about
only ONE) end user.

hehe, this is kinda funny though. If you hear of a person
that died in a car accident who you have no relation to,
or in a terrorist attack or whatever way, you don't get
pissed off and go cry about it. Sure it's not nice to hear,
but the truth is people care less if it's not some1 they know.
With this in mind, if I don't get worked up by one person
who died in an accident, more so I won't get worked up
by a person losing $495 !!

Hell, I don't think they deserve $495 for IDA. But since
they call the price, I can't do much about it except not
buy it :)

LS
DakienDX
11-16-2001, 10:10 AM
Hello Lord_Soth !

Games? Interesting. So you won't be able to get the update 1.04.52 of your game, just because a friend of you pirated 1.04.51?

In my oppinion not. You can download game updates freely, serial numbers get (if they get) locked only for the internet games, but why are there keygens for games? Even if you go to the game store which is located right under/over/left/right of your home, the game's companies won't be able to track you back, because you've no personalized version of the game. Even if you've registered online with your real name and address, you can always say "I'm not guilty. Someone hacked into your online server and stole my serial number."

Many people replied on this topic. Some had good arguments, some not. The ethic question is as old as software itself, maybe older. We could talk forever about this and wouldn't get to an end. So why should we? We've to do more important things.
Lord_Soth
11-16-2001, 12:38 PM
heh, doh bro,

Lemme just clarify one thing.. Yup I won't have a problem
with any game update or patch. True, I might buy a game's
xpac or something like that if I think I really need it.

The thing is, you're trying to convince me that user wont
have updates because he will be tracked down, or identified
and thus he's lost his registered copy.
A couple of things come to my mind now.

First, read again the post by 4oh4. Logic dictates, it's
his own fault, no matter how you look at it, and with
which of the possibilites.
The second, why should I care he lost $495 and his life
time updates ??
I didn't warez his copy, I didn't hurt him myself. As far
as I'm concerned, I donno this guy, so why should I care ??
You think I'm a fuck for saying that ?? Let me refer you
to my earlier post about deaths.

Let me ask you this: if an israeli person would get crushed
under a truck (let's say it's an israeli celebrity for the sake
of argument), and it somehow got to the press in your
country. You take a look either in the paper, TV or whatever
you like.
What is your opinion on it ?? Do you get pissed off about
it ? sure it's not nice to hear, but do you really get pissed
off about it ??

Now come and tell me, that a death is not worse than
a guy losing $495 and updates for life, out of HIS own
fault.

No place to feel sorry for him.

If he got hacked (the "4th" possibility), it's either he or
his admin did a lousy job of securing the system, OR
it was completely not his fault, in which case, if he could
prove it, DataRescue will surely take that into consideration.

Either it's his fault (which means he gets squat), or it's
not his fault (hard to prove, but then DataRescue will
not harm him, totally.. heh)

LS
DakienDX
11-16-2001, 01:26 PM
Hello everybody !

I just downloaded IDA 4.15. It contains the following string in it's .KEY file:
"Thomas Wright, DVDMods, 1 user, special"

So what do we know about him? Typing "DVDMods Thomas" into google, we get two entries.

w*w.dvdmods.co.uk:
We know it's a company located in the UK.
They sell Modchips for DVD-Players.
They disable the DVD copy-protection.
They bypass the region code.

What do they do different than we do?

They use IDA to reverse some code they're not supposed to reverse, we do the same too.

So basically a reverser spent his money to give the 'scene' a present.

Why are we complaining about that? We help each other. That is what this board is supposed to do.

We should not talk about which of us are better and which not. We can't make someone change his attitude to some things.

Perhaps Thomas Wright is someone of us.
Perhaps he passed IDA to someone of us, who should help him with a problem in it.
Perhaps this someone distributed it.

Too many times "Perhaps".

I don't know.
I don't want to know.
I don't want to judge on this.

For me this post is closed.
For you this post could be closed, do what you think you must do.

Again, why are we complaining about that? We help each other. That is what this board is supposed to do.
GMouser
11-16-2001, 02:48 PM
I noticed the same in the IDA.key file. I'm going to stick to my own legit copy, ver 4.1.0.451.
Anticode
11-17-2001, 04:53 PM
Look waht Pierre has to say about it: h**p://www.datarescue.com/ubb/Forum1/HTML/000267.html
blade
11-23-2001, 09:55 PM
I've followed all the long posts here & I, as many ppl, landed to my own conclusions.
I think Crackz has gone away because he had no chances at all His identity is known. The circumstances about how he got from Datarescue this tool are known too. His activities far from having a low profile as they should be, were too much public. All we have known sometime dialogs like "Hey, you know where can I get this Dongle SDK?"...followed by "Sure, Crackz has it in his page for downloading, but he doesn't give the password to unpack it nor respond e-mails" were common place in the scene...making people to talk about him for years with no good comments...I'm openminded to help everybody newbies & experts [I guess] without discrimination. Nobody is better or worse than anybody. However I don't like this kind of people that think they're in the Olympus like holy cows believing themselves they are smarter than everybody at security soft companies because they have broken this or that protection.
blade
11-23-2001, 10:00 PM
[Sorry moderator for posting twice consecutively, but I have to resume this post... I won't post here again in several days]

......

The world and particularly this one is small enough..We all [almost] know ourselves & we know who's who. As Zen teaches you're a greater person when you feel you are really smaller...
Now it's clear enough that the main reason for Crackz to runaway is that Pierre and his company put his eyes over the big Mr. Wright's footprints that the alternative channel distribution of the software has produced. He seems to be angry with everybody in this bizz. But, all we know, he is only angry with himself. As I see He has cooked himself in his own cookin' oil...
HypnoticZ/TNT
11-24-2001, 05:24 AM
Hi there :)
I read all thread and i decide to tell my opinion about all this...
and i say why to use the stolen version from ida 4.15?
if you want the latest's version go and buy :)
but i think ida 4.04 is the best options for all here :)

And now about Blade abd this : I think Crackz has gone away because he had no chances at all His identity is known. The circumstances about how he got from Datarescue this tool are known too. His activities far from having a low profile as they should be, were too much public. All we have known sometime dialogs like "Hey, you know where can I get this Dongle SDK?"...followed by "Sure, Crackz has it in his page for downloading, but he doesn't give the password to unpack it nor respond e-mails" were common place in the scene...making people to talk about him for years with no good comments...

You have try to ask him nicely ?
And ask me about comments and i tell you :)
Clandestiny
11-24-2001, 08:26 AM
Sure, Crackz has it in his page for downloading, but he doesn't give the password to unpack it nor respond e-mails" were common place in the scene...making people to talk about him for years with no good comments...

Hiya,

Well I can't speak for other's experiences, but I had the audacity to email him for help on my first key-gen when I was a VERY green newbie and CrackZ not only responded, but had a look at the target and offered me some constructive help to boot.

Regards,
Clandestiny
HypnoticZ/TNT
11-24-2001, 11:44 AM
Thanks for reply me Clandestiny :)
This goes to blade and i continue if ask something from him nicely you get help, crackz is very helpfull person ask enything you want but nicely :)

Regardz HypnoticZ :)
Snatch
11-24-2001, 06:28 PM
CrackZ made a huge mistake. Period. He shared his copy he deserved what he got. Especially since whomever he shared it with surely did not know him anywhere but on the internet. Because if I had a friend whom I had a non-internet relationship with that did that to me, he would be in more trouble than he coudl imagine. So the bottom line is that he pirated the software and is now complaining that everyone is pirating it. What is the difference? Yes, he lost his license and his name and location are now public. Taking his anger out on everyone in this way is a bit childish though instead of owning up and taking responsibility for his actions.

Once a cracker, always a cracker. He will be back. The internet is lame for those reasons. He can always resurface as someone else and right now it looks like that may be his only option. He will do it though. Can he keep his new identity secret without telling anyone since as he learned his lesson already you cannot trust anyone. Who knows. He will be back though, I can practically guarantee it. It is the way this internet world works that allows him this unique opportunity.

Snatch
Carpathia
11-24-2001, 09:55 PM
Since CrackZ doesnt seem to be visiting to defend himself, I thought id just make two observations:

Firstly, for those complaining he doesnt respond to emails, remember that he already hosts one of the few truly useful reversing sites on the net. Is this not enough ? You think he has time to respond to every single email from people who only mail him for their own benefit ? He doesnt *owe* you anything. Hypnoticz is right.

Secondly, its dangerous to jump to conclusions about CrackZ being actually the guy whose IDA was compromised. If you knew CrackZ better, and you took the time to read his post (i mean, actually READ it), youd realise hes more voicing concern about the principality of the situation, rather than poor old Thomas himself. The whole childish attitude of 'I dont give a flying fuck about anyone I dont know personally' is fairly prevalent now, and its a real shame people think this way.

Regards

Carpii
CrackZ
11-24-2001, 10:32 PM
I'll keep my response brief to this thread, since it didn't actually seem to have much life in it the last time I visited.

Firstly,

To blade : In 4 years of being on the web I have password protected a mere 5 SDK's, 4 of them FLEXlm and 1, SentinelLM, these downloads were for people who I knew that were really interested in these particular LM's, not for willy-nilly downloading by the masses, yes I could have hidden them, but to be honest with you they weren't really very well protected as many people pointed out to me (doh), and most that asked, received.

I will also say that during my time playing with this stuff I tried to help people, its hard faced with 2 line e-mails saying 'gimme password for this' to guage whether you are dealing with a serious reverse engineer or someone simply collecting downloads, see my IDA posts on this, the masses will download, only a handful will actually see any benefit.

Secondly,

To anyone else, please read the post of Carpathia below, it is perhaps far more eloquent than some of my lengthier posts on this matter and says what I probably should have written in the first place.

Regards

CrackZ.
CrackZ
11-24-2001, 10:41 PM
Sorry for the double post.

I realise now that last line should have read 'above' and not below, /me mutters something about minor details .....

Regards

CrackZ.
JMI
11-25-2001, 12:26 AM
Crackz

Since you seem to be reading this thread, please check out the thread on this forum on requests for copies of your site, which I downloaded just before you closed it. In my last post, I indicated I will not offer copies of the whole site, per Woodmann's request, but would be willing to pass on some individual files from the site at member's requests. Please give me your views on your preferences for any distribution of this material. I will honor your request, by either public or private message on what distribution I might make of those files.

Thanks for all of your efforts over the years and don't drop out completely, even if some of our readers fail to understand issues that exceed their grasp and/or personal interest.

On the IDA v4.15 Full issue: it seems to have been overlooked that the cracked demo version of v4.15, which although it dosen't have functionality for other systems found in the full version, still does most everything most of us here could likely need, and has been available for many months.
Snatch
11-25-2001, 01:43 AM
You see what I said earlier was a little harsh and a rather unfair attack on CrackZ. I do not deny that he has contributed a lot to the scene and has done much good stuff. He made a mistake by sharing his copy. You are right we do not know if it was his copy specifically that was stolen or not. We do know that he in fact shared it which is illegal and piracy no matter how you view it. I do not like that he judged people either and says this person is a serious reverser and should have this tool and this one should not. Grow up. If these masses want to download, let them. That is how people learn, curiousity that is. And you do seem to be one to promote learning. Who cares if they know why it is better or not. If they play around chances are they will figure it out. It was funny when I said I needed IDA Pro people tried to drill me down about why I needed a later version. When I responded people knew I had done my homework so they tried to offer alternate solutions. Hello. I am smart enough to know there are always alternate solutions. I came to ask about IDA Pro though. Oh well. I just wanted to say that yes CrackZ is a good guy who made a mistake. His actions lead us to believe a conclusion that may not be a good one but convince me in only one direction thus far. He has helped many people though and I do respect that. But his little opinion about this downloading of the masses I just have to disagree with. And yes when a new minor revision of WinAmp comes out, I will be the first to download it. To have the latest version, yes. But I always read the version history and see what I should expect to be different. Most people do that that I know. Thats what makes me excited to have a new version. I want to check out feature x or bug fix y.

Snatch

Snatch
nblender
11-26-2001, 09:51 AM
Originally posted by Snatch
You see what I said earlier was a little harsh and a rather unfair attack on CrackZ. I do not deny that he has contributed a lot to the scene and has done much good stuff. He made a mistake by sharing his copy.

One of the points I think that you're missing is that the copy
that was released didn't belong CrackZ. Look at what he's
written again, knowing that it wasn't his copy.

I don't know the full details of what happened though.

--nb.
dx50azlm
09-20-2002, 05:34 AM
I'm a big fan of IDA v4.04, but just decided to install v4.15 (cracked version) to see if it had anything else I needed in it. My conclusion is that v4.04 is just fine for me (less time for cracking these days => less need for a sophisticated disassembler). I noticed that the cracked 4.15 version has a major problem with it. When browsing the dead listing, if you right click on an address it usually brings up the context menu. If you have IDA open long enough, you're sure to press both the right and left mouse buttons in some order while you're browsing code, but this seems to kill the program :confused:

I'm not sure if this is a byproduct of a faulty patch, but it sure is annoying to left click on a piece of assembly code and have the entire program quit. This makes me want to buy the program even more now, but it'll have to wait until other payments have ended :) Anyone else have this problem?
SiNTAX
09-20-2002, 08:22 AM
Originally posted by DakienDX

But why do you need it? As CrackZ said "just to see a few extra features they didn't need anyway". CrackZ is right. Even the 4.18 hasn't new features you need as cracker.

Download the 4.1 Freeware version. Or do you need to disassemble your hand calulator's or your GameBoy's ROM?

Well I have a good use for it.. disassemble my DVD player's ROM which is based on a ST20 processor (so I can finally stop writing my own ST20 disassembler) :)
bart
09-20-2002, 05:11 PM
Hellou CrackZ

If i remember there was full HIEW version on your site some time ago and you are talking about stolen IDA copy, no comment...
JimmyClif
09-20-2002, 05:47 PM
Who the hell digs out 10 month old threads ?
DakienDX
09-20-2002, 05:49 PM
Hello everybody !

If you look at the posts' dates, you'll notice that they're ten months in the past.

There were split opinions about the topic and we were quite happy when this topic wasn't topic No. 1 to talk about any more.

bart, CrackZ had a full copy of HIEW on his page, but without the HIEW.KEY file which identified the user, and a keygen for an older version. In IDA you need the IDA.KEY file to run IDA, not like in HIEW, and you can track every copy back to the user with help of the ingrained signatures in IDA and the belonging modules. I hope you see the difference between both cases.

I'm sure that in the interest of all members as well as in respect towards CrackZ we should not start discussing if it was good or bad again.

Well, JimmyClif was the first one. ;)
Snatch
09-21-2002, 03:08 AM
Ya I agree why not just close this thread it really is old and past us all now. Leave the past in the past and stop resurecting old threads.

Snatch
Woodmann
09-21-2002, 03:50 AM
I agree.

This is old news.

Peace, Woodmann


Inside Windows Product Activation (WPA)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Inside Windows Product Activation (WPA)
PDA

View Full Version : Inside Windows Product Activation (WPA)

Kayaker
11-15-2001, 02:30 AM
Some of you crypto wizards might be interested in this document:

Windows Product Activation (WPA) as implemented in Windows XP

h*tp://www.licenturion.com/xp/fully-licensed-wpa.txt

The text details how the Windows Installation ID, a number consisting of 50 decimal digits generated by msoobe.exe, and which is sent to MS in return for a Confirmation ID to complete the registration process, is derived from the Product ID and your hardware configuration. It doesn't discuss the Confirmation ID of course, just how your hardware config is used to generate the Installation ID.

Kayaker
Kayaker
11-15-2001, 11:28 AM
Doh! My apologies, I see JMI already posted this a day ago on the RE forum. Guess I missed it the first time around. So much for the scoop, heh. In any case, it's interesting and crypto based, so it might as well be mentioned again here.

http://www.woodmann.net/forum/showthread.php?threadid=2139
Cmefantastic
01-17-2002, 10:48 AM
Way off topic mate, sorry bout that.

Was putting off doing the XP crack so the days counted down.

HAd to reset bios yesterday, now Xp has got clever with the date change and can't log on. Is there a Dos based crack can use, am i insulting anyones intelligence, sorry guys.
Woodmann
01-18-2002, 07:26 PM
Howdy,

Does the puter even boot?
Does it boot then stop and say "no way"?

Anyway, Maybe you should just nuke the partitions and
re-format.

Peace, Woodmann
Rummy
07-15-2002, 07:40 AM
Looks like about 6 months since the last msg on this thread. I've searched this board and the internet generally and not found anything really useful about the algorithm(s) used by WPA.

On this board it was mentioned that some variant of RIPEMD (-160?) was possibly part of the activation scheme. Around the internet, there doesn't seem to be any real keygens.

From what I can see, an activation code would have to be more than a simple hash of the CD key and "unique" system identifier, because changing just one bit of the system ident. would completely alter the hash value. Since one is apparently allowed to make certain hardware changes without triggering re-activation, there has to be other stuff going on.

On this board, there were a few threads, now months old, about taking the reversing of the whole WPA scheme underground. Does anyone have any new information they wouldn't mind sharing? Could be done through private email (with or without PGP) if it's still considered sensitive information.
MTB
07-16-2002, 03:12 AM
Normally I don't respond to these requests but since it is in the RCE section I will.

There are several cracks running around the net for XP and XP Office. They operate by doing a hardware search then coming up with a key, note I have NOT tested it. According to the discussions I have seen it takes the program about 10 attempts to get it right. So if you want the crack I suggest you search in the usual places for it, then reverse it.

I hope your math is up to the task, I hear it is pretty nasty.

MTB
Rummy
07-16-2002, 07:45 AM
It only generates product keys, which would normally be found on a legit certificate that comes with the product. The only thing that does for you is give you something that can be used to activate the product with over the phone.

There's no info out there that explains (or attempts to explain) how an activation code is genned from this key or where in the boot process the key is verified to give a go/no-go indication.

News stories claiming the WPA is "totally" cracked are just wrong. The way I see it, almost a year after release the MS WPA scheme has yet to truly be "cracked" by anyone.

Thanks for the response, in any case.


Can someone tell me how to crack ocx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Can someone tell me how to crack ocx
PDA

View Full Version : Can someone tell me how to crack ocx

devilsword
11-15-2001, 04:20 AM
I have got some cool ocx controls such as ButtonXP 1.2 from www.Station-Media
ExPopupMenu control from www.exontrol.com
I didn't know how to crack,I think it is not same with C program
Thanks in advance
Solomon
11-15-2001, 04:39 AM
What programming language do they use? C++/VB/Delphi?

OCX is actually a DLL.

I suggest using ExeScope or other tools to examine its COM interface before disassembling it. Maybe the interfaces are documented in its help files.

regards
Unregistered
11-15-2001, 05:03 AM
Let me know if you find somewhere a crack for ?

Mike
Kilby
11-15-2001, 05:12 AM
Hmm this has turned into a crack request :(

OCX are easy enough with IDA and SICE.

However I assume that you can't really be arsed to learn, so why should I be bothered to help you out.

Kilby...
NikDH
11-15-2001, 01:01 PM
Originally posted by devilsword
I have got some cool ocx controls such as ButtonXP 1.2 from www.Station-Media
ExPopupMenu control from www.exontrol.com
I didn't know how to crack,I think it is not same with C program
Thanks in advance

Hi guy,
well i cracked that program little time ago and i can say its a good target if u wanna learn how to crack ocx
Well i just suggest u to use sice and ida to study it
and to run the sample program that uses the ocx so u can see where it makes checks when some progs call its functions

See ya
NikDH
devilsword
11-15-2001, 08:43 PM
Originally posted by NikDH

Hi guy,
well i cracked that program little time ago and i can say its a good target if u wanna learn how to crack ocx
Well i just suggest u to use sice and ida to study it
and to run the sample program that uses the ocx so u can see where it makes checks when some progs call its functions

See ya
NikDH

It displays a snag dialog
the display of dialog used many msvbvm60.dll functions
I cannot locate the right call in my target program.I only locate
the funtion on the msvbvm60 .I think it is not that my wanted.
I must locate in the ocx code.How can I do?
NikDH
11-16-2001, 07:25 PM
Originally posted by devilsword

It displays a snag dialog
the display of dialog used many msvbvm60.dll functions
I cannot locate the right call in my target program.I only locate
the funtion on the msvbvm60 .I think it is not that my wanted.
I must locate in the ocx code.How can I do?

Hi guy,
try to look at the ocx imports and see what its using
Think u should see a function thats like "msgbox" something
like this :)
Try to bpx on it and see whats going on

See ya
NikDH
devilsword
11-17-2001, 02:34 AM
Originally posted by NikDH

Hi guy,
try to look at the ocx imports and see what its using
Think u should see a function thats like "msgbox" something
like this :)
Try to bpx on it and see whats going on

See ya
NikDH

The snag dialog look like a sub VB From.
It seem that it is not easy to locate the call
I didn't know where I trace into the ocx
I stick into kernel.user.msvbvm60
How did I find the right place?


Flexlm Stupid Uqestion !!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm Stupid Uqestion !!
PDA

View Full Version : Flexlm Stupid Uqestion !!

F5BJR
11-15-2001, 07:28 AM
i have an error when i run the daemon :

keys : xxxx yyyy zzzz uuuu vvvv contact glob.... ..to get ...
.... updated vendors keys

the software run without this stuff ! ! !

an ideas ??

Pierre


Beginners question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Beginners question
PDA

View Full Version : Beginners question

Morin
11-15-2001, 03:05 PM
Hello everybody!

I have a small beginners question I was hoping someone might be able to help me out on. I've started looking into cryptography a bit and have been finding it very interesting. The concepts and math behind the algorithms are initially difficult but I'm getting there slowly, and more importantly enjoying it.

My question though pertains to breaking implementations of various algorithms. I've seen many places where people talk about an implementation being broken due to a weak random number generator. It may be my own lack of knowledge thats preventing me from understanding this but I can't for the life of me figure out how you could utilize the fact that a weak generator was used to break an implementation. Even more then that, how would one go about realizing that the number generator used in the first place was weak? Any insight you guys could give about this kind of stuff would be of great help.

Thanks!
Kythen
11-15-2001, 06:08 PM
Well, a good many algorithms use random number generators for getting prime numbers or other values used inside the algorithm. If you have a RNG that has a limited range for it's outputs, you can exploit that fact when brute forcing a key or value in the algorithm you're trying to break. For example, say you have some RSA implementation you're trying to break. Many times N will be too big to do any practical brute-forcing. But say the programmer used the normal C/C++ rand() function when making the primes. rand() outputs a 32-bit number. So now, all you have to do is brute force all the possible outputs of that rand() function and run them through the prime generator until you get the correct one(s). Real scenarios that you run into will vary of course, but this should give you an idea of why RNG's are a prime target for crypto breaking :)
mike
11-15-2001, 09:56 PM
Dave Wagner and Ian broke Netscape's SSL because they initialized the RNG with the timer, and the time was stamped on the packet. Quickbooks uses DES to encrypt the data, but stores the key in the file. I broke Winzip because they encrypted twice with a stream cipher under the same key and leaked info about the rng state. Lots of ways to screw up crypto implementations.
Unregistered
11-15-2001, 10:37 PM
Didn't know Winzip used a RNG system??

Simple hashing with password or at least password used as key.

hmmmmm Need to read up a bit more
DakienDX
11-16-2001, 01:32 AM
Hello Unregistered !

ZIP encryption puts 12 bytes of 'random' data in front of the compressed data. Since it is a stream cipher, the encrypted compressed data will always look different. So you can't tell if two encrypted texts are the same of not (or single bytes of it).


revirgin 1.2 beta 9 released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > revirgin 1.2 beta 9 released
PDA

View Full Version : revirgin 1.2 beta 9 released

tsehp
11-15-2001, 03:28 PM
fixed all anti tracing apps that were sent to me by spekkel.

still waiting for new ones.

I'll finish then to add "service" support for nt for +splaj and finally finish the dumper.

regards,

tsehp
tsehp
11-17-2001, 08:16 PM
still build 9 but corrected the following bug :
when api address wasn't found, the tracer wasn't stopping anymore while going out of iat entry.
This has been fixed and tested on win2k only, on spekkel's sent of sw3 entry at address 0x53c4a4.

Next release : further code to be able to trace this entry (aspr trick) + service support on win2k as requested by splaj.

later.


Crackme #3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crackme #3
PDA

View Full Version : Crackme #3

javelin
11-15-2001, 03:31 PM
changed serial calculations a little
javelin
11-28-2001, 04:01 AM
anyone keygen this yet or that needs some help?
d4d0
11-28-2001, 10:49 PM
Hi javelin,

I keygenned this crackme in a quite different way. As the code you need rip to produce a keygen is pretty big and you compare
the parts of the serials "clearly" (with no encryption) I thought that making the crackme a "self-keygen" was a good idea.

Based on the concepts presented by Kwazy Webbit in one of his tuts, I injected code (lots of it) in one of the crackme's caves and .. it worked :D

So, I have a working keygen to your crackme #3: your crackme #3 :p

sorry for the bad english

cya

d4d0


Trail Sentinel LM Shell
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Trail Sentinel LM Shell
PDA

View Full Version : Trail Sentinel LM Shell

Unregistered
11-15-2001, 09:16 PM
I have download a trial shentinel lm shell 6.2

It can make license only for the computer it is installed.
How can I enable it to be a general license maker?

any help?
DakienDX
11-16-2001, 01:40 AM
Hello Unregistered !

Try to search for the values which are used to generate a computer specified license. It could be things like Windows install date, Windows serial number or HD serial number. I know all this things are quite unsecure, but even a registered user needs a kegen if the protection uses this values to calculate the license.

If you've found the 'important' values, write a keygen which reads this values from the machine it's being executed on and you've completed your task.


w32dasm 9.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > w32dasm 9.0
PDA

View Full Version : w32dasm 9.0

Unregistered
11-16-2001, 01:23 PM
i've seen a non-working link for this..is there a real 9.0 version or its fake?
Unregistered
11-18-2001, 03:37 AM
I have it,

It's a UPX packed 8.93 modified by J.Ping............he's obviously got exited with a hex editor.

Stay with the original 8.93 (use Harlequins dll patch on one copy)

Spl/\j


A tricky Proggy, Help me !!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A tricky Proggy, Help me !!
PDA

View Full Version : A tricky Proggy, Help me !!

Unregistered
11-16-2001, 05:11 PM
Hi everybody!

I have a progg that tricks me every time I'm trying to trace it, its a program for micro controllers a c-compilator.
My problem is that this prog i I'm using is freewere white the limitation in the code size, but in my compilition I need
some rows of code more that the program letting me have.
I need it only once so I don't wont to by the proggy.
Well I'm just modify the maximum code size in the progg, but easier sad then dun,
I end up in some kind of nested loop, I think the programmer knows his assembler.

If there is somebody out ther who kould help me to fool the loop the download is here http://infotech.ir.ro/cvavre.zip 2115 in size

// Oskar //
oskar_leder@hotmail.com
Hoof Arted
11-17-2001, 03:14 PM
Do you not fucking read?!!! This is a forum, not a crack store!!!!

Then again, only messages posted that offend the moderators will be censored.

Kewl, have fun.

Hoof

(PS. No need to ban me for starting a flame war. If the censoring of posts is going to go on the way it has been then I am not interested in posting on this board any more anyway. Why dont you guys come up with some rules, CLEAR rules that apply to EVERYONE including MODERATORS???? That way, you know where you stand and if your message will be there tomorrow!!)
DakienDX
11-17-2001, 03:33 PM
Hello Hoof Arted !

We have rules. They say not to post any crack/warez request, so everyone should should censor those posts. This is just what you did and what I did some times, too. Nobody will ban us for this.

Quoting someone I don't remember now:
"All people are equal. But some of them are more equal than others."

Here are more messages that offend somebody else, but this somebody else has no possibility to kick users and so the whole story vanishes in the sand. However if someone feels offended and is sitting in a higher position, he might react harder than someone else. This problem is not only restricted to this forum, it happens every day in everyone's life. There are always people who have more power and people who have less power. We can't change it. We can try, but most of the time it gets more worse than it was.
Lord_Soth
11-17-2001, 06:00 PM
Hoof Arted,

You can't identify a crack request if it's done in a right way. Or actually, you can't identify a lamer cracker that
wants others to tell him how to crack the protection so
he'll have the prog.
Now, I'm not saying this guy is a lamer, but I AM saying
it might be a disguised request. Maybe he wants us to
tell him what to do, and then he wont bother again.

I say, stick for those ppl that come here, share and learn,
and leave the lamers that come and go alone, they don't
concern you, and you can't stop them either hehe

LS
Fake51
11-18-2001, 07:03 AM
Originally posted by DakienDX
Hello Hoof Arted !

Quoting someone I don't remember now:
"All people are equal. But some of them are more equal than others."

Slight rewriting of George Orwell, "Animal Farm"

Fake
DakienDX
11-18-2001, 07:19 AM
Hi Fake51 !

I didn't want to make anyone think he's an animal. :D
Here's the correct text:

Orginally taken from George Orwell, "Animal Farm"

ALL ANIMALS ARE EQUAL
BUT SOME ANIMALS ARE MORE EQUAL THAN OTHERS

"Listen!", said the teacher, "For tomorrow you all write a 500 word interpretation of these two sentences. Work hard, I might collect them and give marks on them. Please note down your first impression on a piece of paper and rewrite it in formal english in your exercise book. Start now. You've 38 minutes left."
oskar leder
11-18-2001, 12:58 PM
Hi again !
Thank´s for nothing i fooled the loop by myself.
This was not a crack request, I was hoping that somebody could push me in the right direction
I was thinking I was stuck in a loop mad just to fool me but it wasen't (I think) the problem was to
find the right line of code (jmp near edx*4+xxxxxxxx) the program passing this line many many times and jumping to the same
address except the last one.
for me a tricky one for others not.

Thank's Lord_Soth not judging me in advance and sorry for my bad spelling sorry for everything !!

Oskar Leder
Clandestiny
11-18-2001, 08:29 PM
Hiya

Lord Soth made a point here that I feel bears acknowledgement... The point being that it is *sometimes* difficult to discern a genuine query for help from a disguised crack request. This is especially true with some of the newbie posts. After all, a newbie is by definition, the newest beginner to a field and may yet lack the vocabulary of our RCE trade. Consequently, even with a desire to learn, there is often a burden placed on the newbie's shoulder's to prove he/she is not a "lamer". The fact that not every one who visits this forum has a strong command of the English language makes matters even more difficult.

Having taught myself literally from the ground up, I can attest to the level of prerequisite knowledge facing a beginner in this field. Though its been nearly a year and a half since I first began RCE, I can still remember my first few "cracks"...Y' know, the infamous "change je to jne" (executed without even the knowledge of what an API was). LOL, I still can't believe that I actaully cracked a prog without even knowing what an API was! ...But that little half-blind taste of cracking was enough to inspire me to continue on and actually *learn* something by key-genning that self-same application I'd already cracked (took me 2 whole months of communing with the ASM manual for that first key-gen ;) ) Did my ignorance automatically qualify me as a "lamer"? Does the fact that my first crack was made with the intent to pirate a piece of software still qualify me as a "lamer"?

Clearly, I have learned much from that point and I have been fortunate enough to find a few friends along the way to mentor me through my newbiehood. Indeed, more recently I'm finding my interest in "cracking" evolving more towards pure "reverse code enginering" and programming than simply removing protections from shareware. I suppose my point with this is that the ignorance and attitudes we begin with do not have to be the ones we end up with. Its too easy to become arrogant and cynical as we progress... I have to check my own reactions sometimes. I have to consciously remember where I began and how much further I have yet to travel on this quest for knowledge.

I absolutely do not condone the proliferation of crackz, warez, or serialz on this vast web of ours. But with that said, how many of us got into RCE because we wanted / needed to crack an application for our personal use? Realistically speaking,, how many of us took our *initial* interest in cracking from a facination with the arcane, abstract, theoretical world of academia? I'd hazard to say VERY few individuals here would make that claim. Rather, cracking is more a hands-on, learn-by-the-seat-of -your-pants, slightly illicit thrill that hopefully becomes a stepping stone to the more "legit" persuits of pure reverse code engineering, programming, and data security. Like it or not, there is a symbiotic relationship between crackers and protectors.

As such, I have to take the defense of Oskar. Given the proliferation of crackz and serialz, I'd have to say that demonstrating a desire to crack an application oneself over searching for a ready-made crack indicates a desire to learn. Probably many of us began our interest in RCE in a similar fashion. I personally did not percieve the above post as a blatant crack request, but my criticism lies in *how* the query for help was phrased. As they say, its all in *how* you ask the question... And asking a question while openly admitting a desire to pirate the software in question is a poor judgement call given our current legal problems with trialware.org and such... I'd not suggest deleting posts like this, but perhaps asking the author to revise them.

Well, thats it folks... No flames intended. Just my few cents worth of thoughts...

Best Regards :)
Clandestiny


TRW2k (Win95/98 v1.23) problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > TRW2k (Win95/98 v1.23) problem
PDA

View Full Version : TRW2k (Win95/98 v1.23) problem

4oh4
11-17-2001, 02:54 PM
First off, I've dl'ed a couple of previous demo versions over the last 6-8 months or so and both crashed win98se hard. This was just from working on my own apps, so there's no possibility that it was some anti-debugging tricks. A couple of weeks ago I dl'ed this regged version and was pleasantly surprised. It seems great for situations that don't require rebooting for sice.

Over the past week or so my keyboard gets somehow disabled after I exit trw2k. Has anyone else experienced something like this?

If I can solve this problem I'll more than likely buy a copy because I'd like to encourage new versions, etc.

Just a note, but I tried visiting the trw2000.yeah.net site but everything's in chinese and I can barely read english ;) let alone chinese. Does anyone know of an english mirror?
fPc
11-23-2001, 12:49 AM
hi,
here is trw2k's site, pure in en, hope u can find the answer:
w**.knlsoft.com/TRW2000/index.html

trw2000 is flexable, but may crash in some computor, i thought it's not compatible with ur graphi-card.
4oh4
11-24-2001, 12:07 PM
woohooo @ the english page

Thanks for the link. There's a bug reporting form to fill out and mail. I'll run some more tests and give that a whirl.

As far as the graphics card compatibility thing..... The only ill-effect that I'm getting is my keyboard gets locked up (quite frequently now that I've been using trw more often). I'm having no problems at all with the display.

From what I've gathered so far, the kb lockup happens after I set breakpoints of any kind, and after clearing and resetting and clearing the breakpoints several times the keyboard sometimes gets restored. It's annoying as all hell to set a "bpx getwindowtext" only to not be able to type anything in the box afterwards! Then I figure if I'm going to reboot I might as well boot up with sice eh?
fPc
11-26-2001, 11:58 PM
yes, sometime TRW make me crazy *_*. in my office, it lockup one computor when started, while in others not. and i dont know the reason.
One hint: if it crashed in higher version like 1.23, then u should try the lower version.

there is a patched-trw 1.22, chinese interface, but more stable, give me ur email~~~~;)
bauhaus68
11-28-2001, 10:24 AM
I'm using TRW2k 1.23 on winME and got the same kb lock problem, evertime I have to press ctrl+alt+del to call up the 'close application' combo box and press 'cancel', the kb will then resume normal. I simply don't know why.
4oh4
11-29-2001, 12:45 PM
.....oh my fPc! A chinese version? I hadn't thought about trying an earlier version, mainly because of the problems that I had trying to use the earlier demos. By chinese interface, do you mean the trw loader or the actual debugger iface? Would I have to install chinese text support or whatever that's called?

Bauhaus68:
The weird thing about the kb lock is that the ctrl+n/m combos still work and you can still type bpx's in trw. That's strange eh?
fPc
11-29-2001, 08:40 PM
hi,
ok, you can d/l it here:
Link removed since it pointed to a pirated version of TRW

ofcourse, only interface use chinese, the kernel is still en. u will see strang chars when start it~~
dion
08-01-2002, 03:46 AM
is there anyone can reproduce the keyboard bug? please tell me how to do that, coz it just happened to me rarely, so i get stuck when i wanna to catch it.
thx
luvtocrack
08-01-2002, 08:23 AM
My keyboard sometimes quits working after returning from TRW to Win98. Usually when I press the CTRL key it starts working again.
dion
08-02-2002, 10:58 AM
thanks, luvtocrack. trying now what u said.
dion
08-03-2002, 01:09 PM
wow! it works luvtocrack. but... can u tell me what makes trw sticks like that ? and what the matter with ctrl key ?
dion
08-05-2002, 03:30 AM
quote :
Usually when I press the CTRL key it starts working again.

hi, luvtocrack, do u mean that there's a time when ctrl key didn't solve the bug, with word 'usually' ?


FlexLM Tools ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM Tools ?
PDA

View Full Version : FlexLM Tools ?

Grizzly
11-17-2001, 02:58 PM
Hi everbody,

since CrackZ page has been closed recently,
I am looking for some of the Flexlm Tools:
Nolan Blender's lmvkey5 v1.0 & lmrecode.
prs's FLEXlm Key 5 Generator.

Does anybody have them or know where
to find them ?

cu
grizzly
JMI
11-17-2001, 03:55 PM
I don't want to become a central clearling house for CrackZ's files but I did, as he suggested, a teleport download of his site a couple of days before he closed it. If those files were in his collection then I have them on one of my hard disks. If you'll send me your URL I'll send them to you as e-mail attachments.
FreeDragon80
11-28-2001, 11:28 AM
Thanks to JanDebug for the stuff :)
jEssE
11-30-2001, 08:29 AM
I'm cracking NetIQ Chariot, and I have got the five keys and two seeds. need a SDK to generator the valid key.


some ebooks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > some ebooks
PDA

View Full Version : some ebooks

Mustapha Mond
11-17-2001, 06:05 PM
For those that have the time for reading
http://www.securitywriters.org/ebookdb.php
hint: some of this links works if you go to the parent/root directory


Problems with a slm 7.1 sdk installation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems with a slm 7.1 sdk installation
PDA

View Full Version : Problems with a slm 7.1 sdk installation

UrsusA
11-18-2001, 06:07 AM
I have a problems with slm 7.1 sdk setup. Installation stops to the error message installation files corrupted. If someone knows the correct file sizes of the installation files (ie. setup.bmp, data1.cab, data2.cab... ) it would be a great help to solve the problem.
Regards,
UrsusA


particular tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > particular tool
PDA

View Full Version : particular tool

NikDH
11-18-2001, 07:03 AM
Hi to all,
well i'm looking 4 a tool to cheat games as GameWiz32
It has to do mem search 4 values i put in thats all
but it has to work as sice: no win32 apps with a window,...
it has to be a system debugger or perhaps a sice plugin (sice plugin doing this work should be fantastic)
It should be a great idea writing sice plugin myself modifying icedump code but i'll do this if no other tools already exist doing this work :)
Make me know

See ya
NikDH
DakienDX
11-18-2001, 07:28 AM
Hello NikDH !

I don't know GameWiz32. But SoftICE can search for values too. Just execute "s ProgBaseAddress L FFFFFFFF DataBytesLittleEndian". If it's the right value, "e" it, else search for more by starting at LastFoundAddress+1.

If you're searching for something which shows any values which have decreased/increased since the last search, you'll get a memory problem in most games, since you've to store the complete memory of the game somewhere to be able to compare which values have changed. And sometimes your one memory dump won't help, because too many values have decreased/increased.
Unregistered
11-18-2001, 08:04 AM
You don't have to tell sice to search from OffsetFound+1, you can just type s<enter> and it will search for the next reference.
NikDH
11-18-2001, 09:50 AM
Originally posted by DakienDX
Hello NikDH !

I don't know GameWiz32. But SoftICE can search for values too.

Tnx 4 ur answer but it would be great if u would try GameWiz32
so u can have a clear idea what i need

Its a tools that finds every number equal to value i put in
and so i've to change that value in the game and the prog makes another search and so on at the end i'll find the only mem address which stores the data to put bpm

See ya
NikDH
Anticode
11-18-2001, 10:17 AM
There is a similar tool called gamehack (www.gamehack.com)
Hope it helps.
DakienDX
11-18-2001, 10:35 AM
Hello NikDH !

I've just downloaded the tool. It doesn't seem to do anything what you can't do with SoftICE. I tried it on a few programs (no games installed) and, well, nothing special to say. I got an "Out Of Memory" when trying to search in a DOS-Box. I know a similar tool, but not something that you're searching for.

I would suggest to code such a thing you're searching for yourself. It isn't difficult. Read some documentation on Windows Hooks (for making a hotkey). I hope you're familiar with OpenProcess, ReadProcessMemory, WriteProcessMemory and VirtualProtectEx. If not, much documentation is also available.

If you don't find anything, search on MSDN. They don't show you ASM examples, but the general way of using these procedures. Make sure not to save the memory locations of found data in the Hook DLL, because it is hooked into all processes (unless you specify to hook only one) and takes much memory.
Lord_Soth
11-18-2001, 10:39 AM
You can't use Game Wizard under windows, no matter
which version.
Game wizard works only in DOS, reliably...

I think GameHack should work. not sure..

LS
DakienDX
11-18-2001, 10:48 AM
Hello Lord_Soth !

We're talking about GameWiz32, not Game Wizard. The "32" stands for "32-bit-windows" (who would have gussed that? :) ). The executable is a Win32 itself. It works fine in Windows, but it can't do anything that SoftICE can't do, too.

Hi NikDH again !

If you want to write a SoftICE plugin, be very careful. You're at system level there. So if your plugin crashes, Windows will too.

Some games don't 'like' it when SoftICE is running in the background, even if you've started ICEDump. 3dfx-cards don't seem to show SoftICE any more in Windows (under some configurations) after DirectX was initialised once and you tried access the SoftICE screen.
NikDH
11-18-2001, 02:14 PM
Originally posted by DakienDX
Hi NikDH again !

If you want to write a SoftICE plugin, be very careful. You're at system level there. So if your plugin crashes, Windows will too.

Some games don't 'like' it when SoftICE is running in the background, even if you've started ICEDump. 3dfx-cards don't seem to show SoftICE any more in Windows (under some configurations) after DirectX was initialised once and you tried access the SoftICE screen.

Hi dakien,
u r right when u say sice does the same work as the GameWiz32 but theres a little difference:
how can i do to look 4 a value like 0x03 in memory ?
Well i'll surely find too many results and so GameWiz32 asks u to make that value change and do another search so upon the previous results GameWiz32 makes other searches of the new value and so on untill u find the mem location u r intersted in to make the cheat

Well i can make the same work handly but its very very long work and having such a tool will surely speed up the search work

See ya
NikDH
DakienDX
11-18-2001, 02:43 PM
Hi NikDH !

Searching for 03h is indeed difficult with SoftICE. But you have to search for 00000003h in most cases, you could restrict the search only to the '.data' segment. (no possibility in SoftICE, you must start the search at the beginning and stop when it has passed the end).

Hmm..., 03h = 3/4 Lives? Looking for this may also be difficult with GameWiz32, because you've only 3/4 free shots. It would be easier to search for ??? health, ??? money. If this is not possible, bad luck. Are games really that important? Cheats won't work in online games.

A tool not needing to switch to Windows for? Sorry, I can't help you with that.

I've never tried to program such a thing, but what should I do with it? Anyway I don't know any GDI32/OpenGL/DirectX, so how to get a window on the game's screen and remove it later without leaving some pixel in the game?

Simple answer: Don't cheat. :p
NikDH
11-19-2001, 10:06 AM
Originally posted by DakienDX
Hi NikDH !

Searching for 03h is indeed difficult with SoftICE. But you have to search for 00000003h in most cases, you could restrict the search only to the '.data' segment. (no possibility in SoftICE, you must start the search at the beginning and stop when it has passed the end).

Hmm..., 03h = 3/4 Lives? Looking for this may also be difficult with GameWiz32, because you've only 3/4 free shots. It would be easier to search for ??? health, ??? money. If this is not possible, bad luck. Are games really that important? Cheats won't work in online games.

Hi dakien,
well i like cheating and i think its very good reversing exercise

About online games who knows if they work or not :)
There should be some holes in the protocol and u can use them to cheat there too

When u say that i can makes searches only in .data section think its true in almost all the cases but not always
Some game programmers should keep cheating data in other memory zone allocated at runtime
Anyway i thank u very much 4 ur help :)

See ya
NikDH
MH2K
11-20-2001, 01:03 PM
Hi,

I tried gamehack, but it doesnt work on XP

I have cheat-o-matic and it does work on XP, or at least for some games. I just tested with 3D pinball.

here's a download and explanation in German (but it probably speaks for itself) The small and rather old prog is in English:
hxxp://members.tripod.de/Paradigma2000/OMatic.html

explanation in English:
hxxp://wxw.gamehacking.com/data/tutorials/comguide.shtml

cya, mh2k
NikDH
11-23-2001, 09:42 AM
Originally posted by MH2K
Hi,

I tried gamehack, but it doesnt work on XP

I have cheat-o-matic and it does work on XP, or at least for some games. I just tested with 3D pinball.

Hi mh2k,
well i already know those tools and i can say they r very useful
but they cant resolve my problem both them need a gui
and i cant use tools with gui coz of the switching between games and the program itself isnt allowed

See ya
NikDH
DakienDX
11-23-2001, 10:08 AM
Hello NikDH !

Back again. :) Seems that nobody knows a tool for your 'work'. You don't have a dual monitor system, do you?

Here's my suggestion (again): Write a program which hooks into all processes and does the search you like to. There should be some sources of DLLs used to hook prcesses with the help of SetWindowsHookEx in many places. So you would only need to write a main loop waiting for the keypress callback and do the search you like.

I think you don't need a (good looking, well performed) GUI, do you? :D
NikDH
11-24-2001, 06:06 AM
Originally posted by DakienDX
Hello NikDH !

Back again. :) Seems that nobody knows a tool for your 'work'. You don't have a dual monitor system, do you?

Here's my suggestion (again): Write a program which hooks into all processes and does the search you like to. There should be some sources of DLLs used to hook prcesses with the help of SetWindowsHookEx in many places. So you would only need to write a main loop waiting for the keypress callback and do the search you like.

Hi dakien,
u r telling me that with a dual monitor my problem is solved ?
That should be interesting coz i got them in office (not on my pc but i should take them hehe) so i should try this solution
Well i've already thought about writing an app that doesnt need a gui but that shows the results in a file so i can see them at the end of the work but what about a sice plugin ?
That should be a wonderful idea i think :)
So i've to study icedump src :)

See ya
NikDH


trying to cheat games
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > trying to cheat games
PDA

View Full Version : trying to cheat games

NikDH
11-18-2001, 07:09 AM
Hi to all,
well i'm trying to cheat games but i've some problems
The approach i'm using in cracking them is the mem search of values that changes and putting bpm on them
but the problem is how to search values in memory ?
If i use tools like GameWiz32 i've to switch between the game and the program window and thats not allowed coz in most of the cases my pc hangs why ?
Is it possible to avoid this brhaviour in my pc ?

Otherwise does it exist any other tools that do mem search operations without the need of switching between windows
something like sice should be great
Make me know

Tnx in advance
NikDH
Cheads
11-27-2001, 05:52 AM
You can do searches in sice.. not very easy/smart for games though

try '?'

Chead
^DAEMON^
11-27-2001, 06:06 AM
best is to do your own tools...
be creative!

(maybe a softice extension)

^DAEMON^
DakienDX
11-27-2001, 11:16 AM
This thread was already discussed in TOT, "particular tool". Link here (http://www.woodmann.net/forum/showthread.php?threadid=2169).


need Sentinelpro help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > need Sentinelpro help
PDA

View Full Version : need Sentinelpro help

Unregistered
11-18-2001, 04:52 PM
Hi-

I am trying to run program w/o dongle at Home. I am licenced user so I have dongle, I have dongle ID , Application Serial Number and all the keys but , I can not install program at home as it goes in to demo mode and I can not do anything.

I am a newbie so don't know much about dongle crack but would like to learn only this application at Home.

So please help me.

Thanks
Newbie


Info Needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Info Needed
PDA

View Full Version : Info Needed

Unregistered
11-18-2001, 09:19 PM
Can someone let me know what the name of the software is that can idendify the type of protection/compression that has been done on an exe.

I need to work out what the protection is before i can do anything about it.

Also why does revirgin have error messages in french?? (the pop ups)
Can these be converted or fixed?

Thanks
Clandestiny
11-18-2001, 10:33 PM
Hiya,

You would be looking for a "file analyzer" tool. Try exetools.com. Of course, the file analyzer may not be able to idenfify the packer, as is the case with the more recent versions of Asprotect. You can also have a look @ the section names in a PE editor. Sometimes they will also give you a clue as to which type of packer / encryptor is being used.

For your second question, I believe the French error messages in Revirgin have been discussed before and attributed to +tsehp's use of a French version C++ compiler.

Regards,
Clandestiny
Bengaly
11-19-2001, 02:24 AM
hehe heya.

FileInfo rocks my world :-)
naa, it does help allitle...hmm...mabye allot :-)
anywya use it..

cya
Bengi


Sentinel SuperPro dongle protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel SuperPro dongle protection
PDA

View Full Version : Sentinel SuperPro dongle protection

jholmes
11-19-2001, 01:24 PM
Hello!

I have a program that is protected with the Sentinel SuperPro dongle connected to the printer port. Does anyone know about a way to bypass the need of dongle?

Thanx in advance
John Holmes
jholmes@start.no
MTB
11-19-2001, 06:56 PM
Yes it's possible to get around the dongle, however you need to do some work. I recommend you read frog's print great essay on dongle reversing. Most if not all of the protections are so lame almost any newbie can get around them, that includes me!! So rev up your favorite search engine and find the essay. After that you will need a hex editor, and a decompiler either w32dasm or IDA (hint w32dasm is easier to use but is limited). Ok I forgot one last thing, a brain (or least half a brain). See the links that are posted at the bottom of the home page of RCE.
Good Luck
MTB
HypnoticZ/TNT
11-28-2001, 06:09 PM
Mate sorry ( MTB )
but you forget one person could help in this the DONGLE GOD :)
if you dont know who is i say you is CrackZ :)

jholmes read the tutorial about virtual gibbs this tutorial is usefull and has the emulator about sentinel appz :)
is from crackz :)
MTB
11-28-2001, 07:21 PM
HypnoticZ/TNT sorry to inform you but crackz's site is history, like Osama. So jholmes needs to be able to find tutorials easily.

Jholmes if you can find crackz's stuff, download, burn multiple backups and savor it.

MTB


Decompiler Discussion
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Decompiler Discussion
PDA

View Full Version : Decompiler Discussion

Sarge
11-19-2001, 01:43 PM
Well, here is a copy of the post I made on another thread, titled
(I think) "Lack of quality on this site":

-----------------(Start 1st Post Copy)----------------
Well, how about this:
Q. Where and why is a controls index value included twice in a VB6 app?
A. Once in the FORM level code so the form can access it, and once in the
control level code so the control itself knows.

Q. How do you find the StartUp module and whether it is a FRM or BAS?
A. "Walk" the exe structure to find the file-type signature, "walk" the file-type
signature/structure to find the file-header info, parse the file-header info to find
the embedded app start-point, parse the embedded app start-point to determine
the app signature, vector off the app signature to find the app entry-point,
"walk" the entry-point signature/structure to find the StartUp module, parse the
StartUp module for its type and name.

Q. What is the key signature for a CommandButton, contained in a FrameBox, which is itself
contained in a FrameBox, which is contained by the SECOND Form in a VB6 SDI (Single
Document Interface) app?
A. 4 (In hex: 0x04). Note: TRICK QUESTION...It is ALWAYS 4; whether placed in a Frame, or in
the Form itself.

Haven't seen this here yet...even though this forum is describe as "Decompiler Discussion Forum". Anyone
know where a discussion forum that has real discussion, is?

Sarge
------------------(End 1st Post Copy)--------------------------

When questioned about my statement of "Decompiler Discussion
Forum", here was my reply (also from the same thread):

------------------(Start 2nd Post Copy)--------------------
Well, I kind of assumed from the concept of "reverse engineering" that, if you were talking about code, you must be decompiling.
If it was a piece of electronics you were reverse engineering, I
would have assumed you were trying to re-create the schematic.

But...
I'm still waiting for the answer...Where the %*&% is a true,
reasonably intellectual, non-flame discussion group???

Sarge
-----------------(End 2nd Post Copy)---------------------------

Comments, anyone?

Sarge
Kayaker
11-19-2001, 09:26 PM
Useful information Sarge. Could this be used to explain how a disabled control is encoded in the PE file? I'm thinking of the VB6 Crackme#2 example where the OK button is disabled. It can be enabled run time, but can a control attribute be changed by modifying the file?

I made a VB6 test app with 1 button, either enabled or not. If I set an Index value for each in the Properties window I can see the 2 Index references in the Form and Control level code as you mention. btw, it seems like this doesn't apply if you *don't* specifically set an Index value? I don't see the reference duplicated in this case.

For the disabled button I chose an Index value to be equal to 7A99h. You can see that referenced twice in the file, the 1st instance is the 1st WORD value, the 2nd is just after the "OK" string:

Disabled Button:

00000599 997A 0800 436F 6D6D 616E 6431 0004 0102 .z..Command1....
000005A9 004F 4B00 0299 7A04 8007 E808 DF02 7701 .OK...z.......w.
000005B9 0800 1100 00FF 0204 00

For the enabled button the value is 7B99h:

Enabled Button:

00000599 997B 0800 436F 6D6D 616E 6431 0004 0102 .{..Command1....
000005A9 004F 4B00 0299 7B04 8007 E808 DF02 7701 .OK...{.......w.
000005B9 1100 00FF 0204 00 .......

I'm thinking that the Enabled = False Property value is encoded somewhere in the Control level code in the disabled example. You see an extra WORD value of 0800h in the disabled hex for example. I know in Delphi the Enabled Property is only encoded if it is FALSE, if it is the default TRUE then it doesn't seem to need to be specified.

If I mess with any of the hex under the disabled button code I get an Invalid File Format error. In Delphi however I've been able to do exactly this and recompile the code successfully using ResHacker. Are there ways to make a hard modification to a VB6 file resource and have it run? More to the point, is there a way to *know* what words and dwords in the PE file might represent certain properties? If I mess with the extra 0800h value and change it to 0900h, then the file runs but the button doesn't show at all (so it might actually be the Visible property value I'm fiddling with).

Meaculpa had asked me if there was a way to make a permanent patch to the runtime solution of temporarily changing the WS_DISABLED flag of CreateWindowExA I gave in the VB6 Crackme#2. I saw your post and thought it might help answer the question, which is why I split the thread.

This is new info you've supplied us with, so I'd be happy to see a discussion of it.

Regards,
Kayaker
javelin
11-20-2001, 12:27 AM
Disabled button

00000599 997A 0800 436F 6D6D 616E 6431 0004 0102 .z..Command1....
000005A9 004F 4B00 0299 7A04 8007 E808 DF02 7701 .OK...z.......w.
000005B9 0800 1100 00FF 0204 00

Enabled button

00000599 997B 0800 436F 6D6D 616E 6431 0004 0102 .{..Command1....
000005A9 004F 4B00 0299 7B04 8007 E808 DF02 7701 .OK...{.......w.
000005B9 1100 00FF 0204 00 .......

Edited button
should be enabled

00000599 997A 0800 436F 6D6D 616E 6431 0004 0102 .z..Command1....
000005A9 004F 4B00 0299 7A04 8007 E808 DF02 7701 .OK...z.......w.
000005B9 1100 00FF 0204 0000 00
Kayaker
11-20-2001, 12:35 AM
Yup, that works javelin. So you just delete the Enabled = False entry (I guess it was that after all) and shift everything over by a WORD until the zero delimiter. I would have thought this might have upset some address pointers, but it seems to work OK. Cool.

Kayaker
Sarge
11-20-2001, 03:25 PM
Not bad, gentlemen! (Or is one or more of you a Lady?)

Two things:

Yes, the index is "not there" if you don't indicate it; more correctly, it is a "0", which more normally be a valid index value,
except the "valid index" flag is not set. So, the data still actually
DOES appear (that is, there is a data byte in that spot in the code) but its unused as its "not the index".

Yes, the concept (CONCEPT only) of removing the two code bytes is correct; the reason is that VB thinks in terms of default data (start thinking like this yourself when reverse engineering this stuff, its a lot easier!). That is, if the button is disabled, the value of the "Enabled" property must be "False", so VB sets the code to say "Enabled False". If the button is enabled, the value of the "Enabled" property is "True", so VB does nothing! Why? Well, if it is not specifically marked as "False", it must be "True", so why waste the code? Thus, by removing the two bytes of data that show the button as disabled, it automatically becomes enabled.
However, you must be carefull in thinking that you can actually just cut two bytes out of the code and move the remainder back
two bytes. There are many addresses that may now be invalid.
It would be better to overwrite these two bytes with some other
two-byte property; one that is innocent and won't change the operation of the button.

Sarge
Sarge
11-20-2001, 03:49 PM
Here's another thought: The data sequence for the command button disabled is "08 00"; the data sequence for the command button enabled is [no data]. The "08 00" is basically saying "Enable (08) = False (00)". So, based on the concept of
IF ITS NOT FALSE IT MUST BE TRUE, we should be able to say
"Enable (08) = True(FF)". So, try changing the 00 after the 08 to an FF. Then you won't need to move anything, or overwrite with anything that may not be innocent.

Sarge
stealthFIGHTER
11-20-2001, 04:08 PM
Hi Sarge,

is it possible to use same/similar technique for menu enabling/disabling in VB applications? I tried to enable menu item using SoftICE but I only 'ungrayed' the menu.

Thank you
sF
Sarge
11-20-2001, 05:16 PM
Hi,

The menu concept is similar regarding the enable data; it is assumed disabled unless otherwise stated. The enable property for menus is 5 (hex: 0x05), thus a menu item that is disabled is
"Enabled (05) = False (00)"; in the code that is obviously "05 00".
If the menu item is enabled, no code is used.

If you read the previous messages, you will see why it might be better to try "05 FF", but I don't know if that will work---never tried it! Let me know, I'd be interested.

Also, remember that just making the menu text enabled (or even visible, if it happens to be invisible), does just that: it makes the menu text enabled (ungreyed) or visible. It has NOTHING to do with whether or not there is any code that supports that menu selection!

Sarge
Kayaker
11-20-2001, 09:03 PM
"I See", said the blind man to his deaf dog ;-)

Rather interesting the way VB inserts its Control properties into the PE file. Make a few test apps with VB and select various combinations of properties other than the defaults and you start to see a pattern when you compare them.

For a single button control, the *default* byte sequence defining the attributes of that control (VB5) appears to be encoded by the 13 bytes following the null terminated ascii Caption label ("OK" in this case):

----------------------------------------------
Default Property values used on a button
5A8 4F 4B 00 04 90 06 38 04 CF 03 EF 01 11 00 00 FF OK....8.........

The 1st byte value after the null-terminated label defines that it's a button (bit of a guess there) = 04h

The next 4 WORDS are the Position of the button control:
Left.. 0690h = 1680
Top... 0438h = 1080
Width. 03CFh = 975
Height 01EFh = 495

The next 2 bytes (1100) I can't define, then there's the terminating 00FF.
------------------------------------------------

If you modify a property from its default you can see how it's defined.

------------------------------------------------
Enabled = False - 2 bytes
5A8 4F 4B 00 04 90 06 38 04 CF 03 EF 01 08 00 11 00 OK....8.........
5B8 00 FF
the difference is the 0800. Sure enough as Sarge mentions, changing it to 08FF enables the control.
------------------------------------------------

------------------------------------------------
Visible = False - 2 bytes
5A8 4F 4B 00 04 90 06 38 04 CF 03 EF 01 09 00 11 00 OK....8.........
5B8 00 FF
defined by 0900, change to 09FF to make visible.
------------------------------------------------

------------------------------------------------
Appearance = Flat (instead of the default 3D) - 2 bytes
5A8 4F 4B 00 04 90 06 38 04 CF 03 EF 01 11 00 00 1F OK....8.........
5B8 00 FF
difference appears to be 001F.
------------------------------------------------

------------------------------------------------
BackColor = &H008000FF - 5 bytes
5A8 4F 4B 00 03 FF 00 80 00 04 90 06 38 04 CF 03 EF OK.........8....
5B8 01 11 00 00 FF .....
appears to be defined as 03 + the color value 008000FF
------------------------------------------------

------------------------------------------------
Appearance = Flat + BackColor = &H008000FF - total 7 bytes extra from default
5A8 4F 4B 00 03 FF 00 80 00 04 90 06 38 04 CF 03 EF OK.........8....
5B8 01 11 00 00 1F 00 FF .......
------------------------------------------------

You can go on like this forever. What we really need now is a listing of all the identifiers for each property. From this it appears that you can scan the control level code for a control and determine what properties are defined different from default. So far it seems that
Appearance = 00
Back Color = 03
Enabled = 08
Visible = 09
etc.

You can do the same thing with a menu and see that 0005h disables a menu item. Change it to 0004h and it's enabled again. Damn! That is too easy ;-)

5EA 45 6E 61 62 6C 65 64 00 FF Enabled..

609 44 69 73 61 62 6C 65 00 05 00 FF Disable....

This looks great for basic reversing of disabled / not visible controls, where the fact that they *are* disabled means that this must be specifically defined, therefore it's easy to switch them back with a byte change (doesn't do anything about runtime changes though). But what about *adding* bytes to change an attribute? As soon as you do you're going to screw up a bunch of address pointers. The next thing is to find what pointers are important, and if it's possible to fix them.

I'm trying to get a handle on how the VB specific parts in the code section are structured and how they are referenced to each other. Plus, if there are any pointers within the other sections that would need to be changed if you do start moving chunks of hex around.

It seems that beginning at the start of the .text section, first is defined the Project, then the Form, then the Controls in reverse order to which they're added, along with the attributes we've just been discussing, then the Menu items. Then there is the name of the project file and some other stuff, then a big bunch of zeroes.

The fact that there seems to be a large buffer of zero padding makes one think you could add or delete bytes from the Control code to modify the control attributes, and then shift things around without changing the file size or any code that comes after. Then you'd only need to change a minimum number of pointers to readdress the controls from where you made the change down to the zero padding, which could absorb any changes.

After the zero padded section, a new section of code starts that defines something more about the controls and menu items. I'm trying to make heads or tails of what that describes:

B28 436F6D6D 616E6431 00000000 0C004400 Command1......D.
B38 00000000 00000000 4838E99C D5DDD511 ........H8......
B48 8111909F FE04505E 4738E99C D5DDD511 ......P^G8......
B58 8111909F FE04505E 4C38E99C D5DDD511 ......P^L8......
B68 8111909F FE04505E ......P^
etc

You mentioned VB uses Form Level code and Control Level code, how do the 2 levels relate to each other? It seems the Control code for each window component is nested within the Form code, and that they appear to follow each other in the PE file. Are there pointers in the Form level code or elsewhere that reference each of the components in the Control level code? This would be the first thing to determine if you're going to modify the code somehow.

Oh yeah, and does anybody know if there is a resource viewer around that recognizes VB resources?

'bout it for now.

Kayaker
Sarge
11-21-2001, 09:49 AM
Very impressive! You are where I was, long ago.

Here's some hints:

1. You are correct that 0x04 indicates the command button type. However, it is NOT the 0x04 that immediately preceeds the 0x90-0x06 word. This 0x04 means that the following 4 words (8 bytes) are the size and position data.

2. The 0x11 that follows is the tab index; the data is a word (2 bytes).

3. The termination is NOT 0x00-0xFF, since the 0x00 is the second byte of the tab index. The termination is actually the 0xFF and the sequence of bytes that follow it. Since you didn't give them here, I can't tell you what they are, but I will bet is is probably a 0x02, 0x03 or 0x04. (0x05 is also possible, but is not usually found in a control button section)

4. Yes, "visible" is 0x09, and the data is a byte.

5. As for the desired "list of identifiers", yes, thats the way to go. But be prepared for a bit of work (My notes are at least 50 pages long!)

6. Your comment about adding bytes is valid; the concept of screwing up any following address pointers is a very real concern.
However, I have had very little need to actually add a missing attribute into an app; presumably, the app already does whatever it is supposed to do, and you don't really care that the appearance of the button is 3-D and you want to change it to Flat; obviously it works either way, now that you have been able to enable it.

7. As to the FormLevel code vs ControlLevel code:
Look at my note #3 above about the termination codes. The reason there is more than one is because the control is a child of the parent form, and thus is actually "embedded" within it. The byte sequence after the 0xFF tell how the embedding occurs. Here is an example:

----------Begin FORM----------
Name: frmProperty (SDI)
Caption: Property Value
ScaleMode: 1 - Twip
FontTransparent: True
AutoRedraw: False
BorderStyle: 4 - Fixed ToolWIndow
Icon: (DEFAULT ICON)
LinkTopic: Form1
MaxButton: False
MinButton: False
Left: 2655
Top: 3135
ScaleWidth: 5400
ScaleHeight: 1215
ShowInTaskbar: False
StartUpPosition: 1 - CenterOwner
----------Begin TEXTBOX----------
Name: txtPropValue
Left: 135
Top: 315
Width: 5070
Height: 300
TabIndex: 1
----------End TEXTBOX---------
----------Begin COMMAND BUTTON----------
Name: cmdCancel
Caption: &Cancel
Left: 3735
Top: 720
Width: 1335
Height: 360
TabIndex: 3
Cancel: True
----------End COMMANDBUTTON---------
----------Begin COMMAND BUTTON----------
Name: cmdOK
Caption: &OK
Left: 2190
Top: 720
Width: 1335
Height: 360
TabIndex: 2
Default: True
----------End COMMANDBUTTON---------
----------Begin CHECKBOX----------
Name: chkPropValue
Caption: Check1
Left: 135
Top: 315
Width: 5070
Height: 300
TabIndex: 4
----------End CHECKBOX---------
----------Begin LABEL----------
Name: lblLabel
Caption: &Enter property value:
Left: 135
Top: 60
Width: 4365
Height: 225
TabIndex: 0
----------End LABEL---------
----------End FORM---------

This example program is "VISDATA.EXE", found in the VB sub-directory. Notice that the various controls are contained within the form. This is exactly how they are in the code.

Good luck
Sarge
Kayaker
11-22-2001, 07:04 PM
Thanks for the info Sarge, it starts to make sense once you look at the .frm file.

I've seen your discussions in that "other" decompiler forum ;-) At least we're relatively spam-free here, so I hope you can generate the kind of brainstorming sessions you were looking for. What's the potential for a simple VB resource editor, as opposed to a full blown decompiler?

I was thinking it would be possible to find virtual address pointers to the start of a project or form and walk your way down to the control level, to figure out how the VB components are put together. I tried finding a few pointers to see if I could get into a linked list which tied together the various parts, but I couldn't come up with any hits.

You mentioned the byte sequence after the 0xFF tell how the embedding occurs. Here's mine, it begins with the 02h as you guessed. What significance do the final few dwords have?

0000059B 43 6F 6D 6D 61 6E 64 31 00 04 01 02 00 4F 4B 00 Command1.....OK.
000005AB 04 08 07 48 03 BF 04 DF 02 11 00 00

000005B7 FF 02 04 00 00 50 00 00 00 EC D8 86 4C 6E DF D5 .....P......Ln..
000005C7 11 81 11 F6 AE 82 22 20 5D ......" ]

Begin VB.CommandButton Command1
Caption = "OK"
Height = 735
Left = 1800
TabIndex = 0
Top = 840
Width = 1215
End
End
Attribute VB_Name = "Form1"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False

Cheers,
Kayaker
meaculpa
11-26-2001, 01:31 AM
Hi All,
I hope you are all well.

I don't want to bore anyone with the complete detail, or
duplicate work already done (and posted), but i got a little
further. My complete notes are also available.....

Disabled 2 (with everything else)
00001225 636D 6442 7574 746F 6E32 0004 0107 0042 cmdButton2.....B
00001235 7574 746F 6E32 0002 5901 0316 0000 8004 utton2..Y.......
00001245 4006 2C01 B004 E803 0800 0900 1102 0013 @.,.............
00001255 FF14 FF16 011B 7B00 0000 1F00 2901 2A00 ......{.....).*.
00001265 FF03 3200 0080 0200 000A 00 ..2........

636D 6442 7574 746F 6E32 //button name
00 //terminating zero
04 //command button type
0107 00 //still unknown
42 7574 746F 6E32 //button caption
00 //terminating zero
02 //still unknown
5901 //index value - see above
0316 0000 80 //BackColour with value &H80000016& (1600 0080) see above
04 //4 words button dimentions follow
4006 //dimention data - see above
2C01 //dimention data - see above
B004 //dimention data - see above
E803 //dimention data - see above
0800 //this button is disabled
0900 //this button is NOT visible
11 //still unknown
02 00 //tab index value
13 FF //for this button Default=true
14 FF //for this button Cancel=True
16 01 //for this button DragMode=Automatic
1B 7B00 0000 //Help Context ID
1F00 //the button appearance = flat
2901 //for this button Style=Graphical
2A00 //the Focus Validation is set to CausesValidation=false

later,

Regards,
.MeaCulpa
josephCo
11-26-2001, 02:00 AM
Heya guys :) It's been quite a while since I've been here.. and there's some nice stuff :) BTW Sarge.. good work on sharing what you've learned :) Umm as far as decompiling forms, I think I've got a list of all controls and their representation somewhere. The only thing I don't have (in paper form) woud be all custom objects. Umm it's been several months (at least) since I've worked with this part of the EXE. I'll see what I can dig up and if all of you could create a "wish list" I'll put together a zip of what I can find.

Good luck!!

joe
Sarge
11-26-2001, 10:08 AM
(This message may appear multiple times; somehow I got dumped)

Wow! Take a few holiday days off and....%$^#$

1. A Resource decompiler/editor? Hmm...good thought; don't know what it would take, though...have to do some research.

2. 0xFF begins/ends the embedded sequence. The data following the 0xFF tells a) What new embedded level to begin, or b) what existing embedded level to use, or c) what existing embedded level to end, etc.

3. Where is the VB6 "Crack2" that you mentioned; it would help if we were all "on the same page"?

4. Use the sample output I posted from the VISDATA.EXE file, and compare it with a hex listing of that file. You should easily see how the 0xFF ?? ?? ?? sequence works.

(Sidebar: How much should I tell you, vs how much do you want to find out for yourselves? I hesitate to respond to meaculpa's post by just giving him his missing answers [no offense intended];
but I am not sure where to draw the line)

5. Josephco, glad to see you here. I have the exedec program, but frankly don't know how to use it properly, I am always getting error messages! How about a hint? Also, I will be the first to admit that I am still missing about 3 of the codes, mostly because I have not yet found the proper IDE and/or property settings that create them. I would LOVE to compare notes.

6. I have attached a BMP file that may spark your interest, if I can get it to go. The 100k limit means it is a 16-bit color pallette; hope it show up!

Sarge
Sarge
11-26-2001, 10:10 AM
PS to meaculpa:

Please check my post dated 11/21, item #2.

Thanks

Sarge
meaculpa
11-27-2001, 03:30 AM
Hi All,

@Sarge:
I see you "hesitate to respond" to my posts? I hope i am not that far beyond hope ? :))

In your post dated 11/21, item #2 : 0x11 is the tab index value.
You refered to this from Kayaker:
0000059B 43 6F 6D 6D 61 6E 64 31 00 04 01 02 00 4F 4B 00 Command1.....OK.
000005AB 04 08 07 48 03 BF 04 DF 02 11 00 00

000005B7 FF 02 04 00 00 50 00 00 00 EC D8 86 4C 6E DF D5 .....P......Ln..
000005C7 11 81 11 F6 AE 82 22 20 5D ......" ]

So you say the tab index is directly after the 4 words of the resources. ? But the button in the above (your) example is enabled.

From my buttons i got the following after the 4 data/position
words:

0800 //this button is disabled
0900 //this button is NOT visible
11 //still unknown
02 00 //tab index value

My button resource looks like this:
Disabled 2 (with everything else)
00001225 636D 6442 7574 746F 6E32 0004 0107 0042 cmdButton2.....B
00001235 7574 746F 6E32 0002 5901 0316 0000 8004 utton2..Y.......
00001245 4006 2C01 B004 E803 0800 0900 1102 0013 @.,.............
00001255 FF14 FF16 011B 7B00 0000 1F00 2901 2A00 ......{.....).*.
00001265 FF03 3200 0080 0200 000A 00 ..2........

Am i doing something wrong? If so please help.

This post is getting too long, so i will continue in a new one.

(How about sharing your 50+ pages of notes :))

@Kayaker: Any comments on this so far?

Regards,
.MeaCulpa
meaculpa
11-27-2001, 03:40 AM
@Sarge:

Right where were we......

If i look at 2 cases of dubble buttons i get this:

disabled
0000123B 0002 0100 0418 06E0 0147 0457 0308 0011 .........G.W....
0000124B 0200 FF03 3200 0080 0100 000A 00 ....2........

disabled
0000126E 0002 0000 04F0 00E0 0147 0457 0308 0011 .........G.W....
0000127E 0000 FF03 2B00 0000 0206 00 ....+......

and the next 2:

enabled
0000123B 0002 0100 0418 06E0 0147 0457 0311 0200 .........G.W....
0000124B FF03 3200 0080 0200 000A 00 ..2........

disabled
0000126C 0002 0000 04F0 00E0 0147 0457 0308 0011 .........G.W....
0000127C 0000 FF03 2B00 0000 0306 00 ....+......

I am showing only the part after the button caption text.
In all of the buttons, after the enable/disable (0800 part) there is the 11 0000 or 1102 0000

Do i understand you correctly in saying the tab index part is:
1100 and 1102 (respectively) and not 0000 and 0200.

I appreciate the help.

As far as the 3 (perhaps more) bytes go that are unknown to me,
can you give me a small hint. ?

Regards,
.MeaCulpa
Sarge
11-27-2001, 09:37 AM
Back up a step!

My question in reference to giving you hints was only that "do you want me to just tell you the answers" or " do you want to find out for yourself"? I was/am not sure how much to just "give" (= no thinking on your part) or just "hint" (= lots of thinking on your part). Nothing in the question referenced you abilities!

No, I did not say the tab index is directly after the resources. I said that the tab index property is indicated by a 17 (hex 0x11); it may or may not be next in the sequence. Big difference! Think of it like this:

01 02 03 04 05 06 09 0A

In this example, assume all data is one byte long. This byte sequence would be decoded like this:

01 = Property to be accessed
02 = Data for property #1

03 = Property to be accessed
04 = Data for property #3

05 = Property to be accessed
06 = Data for property #5

09 = Property to be accessed
0A = Data for property #9

This type of analysis tells us two things:
1. Each property that is being set, as well as its value
2. The missing 07 and 08 are the default values (where 07 would be the property and 08 the data for property #7, IF they were there).

So what? Well, note that property 9 came directly after property 5, in this case. However, had the missing property #7 existed, it would have come between #5 and #9. So, to say that the tab index property (0x11) comes directly after the Size/Position property (0x04), isn't always true; the visible property (0x09) may come in-between. However, here is why I think that piece of confusion occurred: I was not (and as yet, am not) directly analyzing your byte sequences; I am only telling you what you have wrong or are missing. Please do not relate my info/explanations directly to the code you are submitting. Rather, re-analyze your code using the new (hopefully helpful) info that you now have.

Now, the reason I brought this up was as a result of one of your previous posts that had this:

636D 6442 7574 746F 6E32 //button name
00 //terminating zero
04 //command button type
0107 00 //still unknown
42 7574 746F 6E32 //button caption
00 //terminating zero
02 //still unknown
5901 //index value - see above
0316 0000 80 //BackColour with value &H80000016& (1600 0080) see above
04 //4 words button dimentions follow
4006 //dimention data - see above
2C01 //dimention data - see above
B004 //dimention data - see above
E803 //dimention data - see above
0800 //this button is disabled
0900 //this button is NOT visible
11 //still unknown
02 00 //tab index value
etc....

In this post, you will note the second line up from the botton is
"11 //still unknown ". But, but, but.....I had already responded to Kayaker with the info that 11 is the tab index. PLUS, you yourself said that the following bytes (02 00), were the tab index value.
Doesn't it follow, then, that 11 must be the tab index property, so that the 02 00 can be the tab index data? Once you realize this (that ALL of the data in this byte sequence operates in a similar manner), you should be able to fill in the missing properties. After all, you seemed to have realized that 08 is the enabled property (with its following single byte of boolean data), and that 09 is the visible property (also with its following single byte of boolean data); similarly, you should be able to determine that 11 must be the tab index property, with its following word (= 2 bytes) of the index number!

Hope this is clear.

As to sharing my notes, this is sort of what I have already asked:
"How much help to give". I certainly don't want to supply "crib notes" (Umm, does anybody use them anymore?), I would rather force you to think.

Also, if you want, you can send me your exe file, and I will respond with the analysis results (but NOT how I got them) so you can compare them to your own work.

Sarge
josephCo
11-27-2001, 02:29 PM
Howdy all :)

I have done this for most things I've come across. I hope I haven't upset anyone by posting this. I too am curious as to how much to give and how much to help. For me, finding everything out by myself was more fulfilling than reading it somewhere (I don't think any of this is on the net anyway). I can only hope that everyone else is as thrilled as I am about the new grand discoveries in the wide world of VB EXEs!!

Sarge-

I wouldn't mind comparing notes ;) I'm a horrible note taker and to be honest my terminology isn't up to date or probably even correct (I know jack squat about VB coding). I've just figured everything I know out by myself (mostly). My decompiler isn't as advanced as Golem's but it works for me :) I'm more of a hobbiest when it comes to this than a decompiler writer. As far as ExDec goes... umm it was never really intended to be released. I had a few beta testers that were supposed to report back to me with problems/errors and I was going to fix them. Well as time went on, it was posted on a few tool pages and I lost all control over who could use it. In my private version I have fixed all known errors, HOWEVER there's too much "decompiler" information inside it to release the new version - sorry for any troubles it may have caused.

CommandButton - 0x04

1 Caption text
2 Index Word
3 BackColor color
4 Size size
8 Enabled boolean
9 Visible boolean
a MousePointer Byte
11 TabIndex Word
13 Default boolean
14 Cancel boolean
16 DragMode Byte
17 DragIcon pic
18 TabStop boolean
19 Tag wtext
1b HelpContextID DWord
1c MouseIcon pic
1d Font font
1e WhatsThisHelpID DWord
1f Appearance Byte
22 Picture pic
23 DisabledPicture pic
24 DownPicture pic
25 ToolTipText text
26 OLEDropMode Byte
27 MaskColor color
28 UseMaskColor boolean
29 Style Byte

Umm I don't have the structs readily available here, so you'll have to figure them out on your own (until I can rip them of course).

joe
Sarge
11-27-2001, 03:34 PM
Hello!

For the record, I agree with all your codes. I will also be a smartXss and tell you that you forgot CausesValidation and RightToLeft :) , but we'll let those codes be homework for the others. (Just wait until they get to OCX's!) I would suspect that, once all the codes for all the controls are known, their next step would be to analyze the entire exe to find the VB app structures, instead of doing an eyeball view of a hex dump.

Ok on the exedec; I can understand your reasoning.

Keep on trucking!

Sarge
Kayaker
11-28-2001, 12:14 AM
Hiya JoCo, I was hoping you might poke your nose in if I changed the message title ;D Ahh, you guys have got the goods on the rest of us on VB decompiling, can't even compete ;-) I'm just happy both of you are willing to help the rest of us learn.

It's kind of intriguing really. Rip apart and understand an unknown file format from first principles. You kind of need to put aside your preconceptions from regular PE files. Heh, it's time to break out Visdata.vbp, IDA, Google, a hexeditor and a big pot of coffee methinks and get a look at the big picture ;)

I did find one file that's related to the subject:
Visual Basic Project Files Structure
h*tp://www.techtutorials.com/tutorials/vbproject.shtml

I suppose to output any kind of tabulated listing of VB components you need to be able to "walk" the file. Sarge, you said

Q. How do you find the StartUp module and whether it is a FRM or BAS?
A. "Walk" the exe structure to find the file-type signature, "walk" the file-type
signature/structure to find the file-header info, parse the file-header info to find
the embedded app start-point, parse the embedded app start-point to determine
the app signature, vector off the app signature to find the app entry-point,
"walk" the entry-point signature/structure to find the StartUp module, parse the
StartUp module for its type and name.

Can one of you give a clue to that first step, finding the file-type signature, in the PE file? Just a taste now, not the whole bottle. This needs to be savoured slowly like a bottle of fine wine to be fully appreciated ;-)

Thanks and cheers,
Kayaker
meaculpa
11-28-2001, 02:54 AM
Hi All,
I hope you are all well.

@Sarge:
No offence taken whatsoever. Thanks for the help so far. My mistake was i did not think the tab index value could be a word.
Lol, another piece of the puzzle fits......
When i took a step back it struck me : everything follows a pattern of (incremented by 1 ) values when you look at the first 2 bytes......., LOL, stupid me ;)
Thankyou so far, will post findings/ outcries for help/ ameliorations later.

@Kayaker:
Say, you are not a student of Zen are you :)
Love your way of _thinking_.

Regards,
.MeaCulpa
Sarge
11-28-2001, 09:11 AM
Kayaker:
Start at the beginning of the file, just as you would suspect. Assuming it is an executable, it must have a DOS header. Parse the DOS header (the structure of the DOS header is available EVERYWHERE!) to find the file type, which should be 17744.
Whoa! Where did that come from?....Hint, when you find the file type, view it as a DWORD (Double Word = 4 bytes) to get this value, then view it as ASCII to see why.

Meaculpa:
Your concept of "incremented by 1" indicates some inspiration on your part. Great! But it is incomplete. Think about this: What happens if a default value occurs in the byte stream? Go back and view my 01 02 03 04, etc. example with specific attention to 07 and 08. Now, rephrase your epiphany.

Wait until you start Fonts and Images!

Sarge
josephCo
11-28-2001, 02:12 PM
Kayaker -

I'm not exactly sure where this fits in, but from a vb point of view.. everything starts from the VB5! structure.

good luck and have fun everyone!!

joe
Kayaker
11-28-2001, 08:40 PM
Originally posted by Sarge

A. "Walk" the exe structure to find the file-type signature, "walk" the file-type
signature/structure to find the file-header info, parse the file-header info to find
the embedded app start-point, parse the embedded app start-point to determine
the app signature, vector off the app signature to find the app entry-point,
"walk" the entry-point signature/structure to find the StartUp module, parse the
StartUp module for its type and name.

Sarge

You sure choose a cryptic way of viewing PE+28h ;)

Kayaker
Sarge
11-29-2001, 09:25 AM
Give the man (woman?) a cigar!

Ok, here's the thinking:
To be able to decompile a VB app, you have to first FIND the VB app!. You really don't want to do this by scanning a file to find a sequence of bytes, like you do visually in a hex editor. Rather, you want a program that can do it for you. To find the elusive VB app, you have to start at the beginning of the PE file, and "walk" your way through all the pointers/vectors/offsets/addresses that eventually take you from the "MZ" at the beginning, through the DOS header, to the PE signature, to the PE header, to the PE option header, etc, etc, etc, until you finally FIND the VB structure. Then and only then can you begin to attack the VB app contained within the PE exe.

Now, you COULD write the program to do a byte-by-byte compare of your target file, and it would work much like you do manually in the hex editor: Start at the beginning of the file and scroll and scroll and scroll...until you see what you want ("PE"). But this is a) very slow, and b) won't help when offsets and addresses are used (as the will be in the VB app structure), because they won't necessarily have a fixed value. So, let's not try to run before we can walk; rather, we will build up our knowledge in a manner that should make it a sound basis for the really intense stuff later.

As a side note, the data/structures/pointers/etc that we find will be only applicable to VB6 (thats what I use, thats all I have). The app structure for VB5 is similar (works very parallel to VB6) but not identical. If you are using VB5, you have even more work cut out for you!

Programming hint: now that you can find the file type signature, put the code in a subroutine, called from your main code, and try it against various file types. (You will have to either include the FILE/OPEN dialog box, or temporarily hardcode the filepath of the target file). Make your subroutine fill the DOS structure, and return an error code indicating whether the file type is PE or not.
Continue in this manner, with various subroutines for the various structures. We will use this knowledge later.

Now, if you don't want to do this programatically, but would rather have copious (COPIOUS!!!) notes and reams (REAMS!) of paper, so that you can decompile by hand, go for it.

So, there are my thoughts, comments, etc. If this is not the desired path, speak up!

Kayaker: Keep up the good work! Let me know when you find the VB app, then we'll take the next step.
iorior
11-30-2001, 04:50 PM
heya guys!

I have already work on what you're talking about:

http://www.programmerstools.org/decompilers.htm#vbde

iorior
Sarge
11-30-2001, 10:45 PM
Very Nice!

I use RACEVB6. Gives more graphic info and "recovers" embedded graphic images. I'll try to attach a BMP of it.

Maybe the three/four of us should get together some time.

Update: Can't attach my 16 color BMP, its too big. So I tried a mono (black and white). Don't know how it may come out. If you
are interested, here's the email address from the FAQ:

18)What is your Email address?
Send all Emails to: onlinec@bellsouth.net
Be sure to use "RACEVB6" as the subject.
Sarge
11-30-2001, 10:50 PM
Ugh! I just checked the mono BMP...Ugly. You might want to go ahead and check out the Email address. their BMP is much nicer!
Also, you get the whole FAQ.

Any of the "masters" of this board, can you up the attachment size to maybe 200k?

Sarge
josephCo
11-30-2001, 11:56 PM
Umm it's been a few days since my last check-in. I haven't had much time to browse the net.. but I've been thinking about all I've read. Sarge, you said you could not decompile pcode yet.. if you have enough information about the procedures (there's tons of structs that need to be identified) and their subroutines, then (and only if you want it) I could help you get to the guts of decompilation. I have choosen one way and I believe golem has gone another. hehe There's tons of information that needs to be digested before the switch from forms decompilation to code decompilation is done. Using ExDec you could probably figure out almost everything needed. I have written an advanced disassembler for native that COULD start to do some decompilation (object.method and other simple stuff).. but it's in the very early stages. I don't even have a proper "loader" installed hehe. If you (or anybody else) is interested in some output.. I believe I could manage to throw some together. The only problem atm with the disassembler is that I haven't completely added all the FPU instruction.. so it won't work on files with a lot of math :(

Umm hehe kinda funny.. I must have just had a brain fart because I lost my train of thought and can't remember where I was going next :( haha anyway... almost all of what I know is for the sharing.. but I'm not one to just GIVE stuff away without knowing the person will use it for "honorable" purposes (also I'd like to know that the person has done their homework - just ask the creators of the pcode debugger :)

later all

joe
Sarge
12-01-2001, 08:35 AM
iorior:

I have had some time to play with your program. I would like to upgrade my "Very Nice!" to "Very, Very Nice!" :) . Now, if you could contribute some knowledge or insights, that would be great.

Josephco:
Believe me when I say I KNOW that there is a big difference between Forms code and Modules code! One of the reasons that I have not done that (or even the PCODE-vs-NCODE) is that it was not my original intention. However, as I began to attack VB6 apps, I found that I had to do much analysis that turns out to be very applicable to decompiler functions. So, it is with a sort of serendipity that I fell into this. I have been happy to part with my limited knowledge of forms and controls, which, I realize, is far
behind what others have done. But, I was unable to find anyplace on the 'Net where the low-level basics were even being discussed, much less having the knowldege made available. (Sort of forces the question, "Why is VB decompiler knowledge so closely guarded? What makes IT special?"). Anyway, off of my soapbox....Sure, I would love to know as much as I can; if you want to teach, I'll listen. Your contribution of the CommandButton codes is an example (of course, there are a lot of other controls also). It is kind of hard to carry on multiple levels of "school" here; you don't want to get too far ahead of the new-guy. But I am chafing at the bit and yes, I would like to learn more. I think my next venture will be to determine control events, but I am only guessing that that is a logical next step.

As you preach, so shall I learn...

Sarge
josephCo
12-04-2001, 03:58 PM
Umm I just need to know what direction you need to be pointed in and what you may need :) (This goes to anybody that's interested and is willing to work hard)

As to the 'decompiler knowledge' being kept secret.. The only things I can say about this are 1) In the wrong hands this has potential to be very damaging to software companies 2) Money has been made from this in the past and the people that know how to do it have grand dreams of getting rich (I don't want to be rich, just able to pay my bills with a bit left over :) Hrmm what next?

joe
SargeG
12-05-2001, 03:23 PM
Hi all,
I had to re-register, so now I'm using this new "handle"; but it is the same old me.

Josephco:
Absolutely do I understand the possibilities for mis-use. But I also have to trade that off vs the reverse engineering genre.
I guess I am hoping that anyone who is disciplined enough to put forth the rather intense effort to learn for themselves, will also be have to wisdom to not do anything they shouldn't. I am not comfortable with the concept of giving out my work, but I AM comfortable with discussing/teaching what I know to enable someone else to program his/her own creation. I just will not give out the knowledge without some degree of certainty that it is deserved; that is, that the recipient has put forth some effort and is not just a "gimmee this, gimmee that". In short, I will give lots of hints, but few definite answers. Like a teacher, I want others to think; also like a teacher, I will correct when in error. Often, I will even answer a specific question! Interest just seems to have dropped recently.

Sarge
josephCo
12-05-2001, 04:38 PM
Hehe I was going to ask if the conversastion has gone private or whether everyone is just busy with other things. Seems that the two of us are pretty much the same in our beliefs :) If I wanted to piss on one person in particular (G****) I'd release all the information that I have. I have nothing against him.. he's helped me and I've helped him.. there isn't even a rivalry between us. The only thing I would say is that at times he's a bit too cocky.. but I'm sure that's warranted :) Anyway josephco_@hotmail.com is my email addy if you'd like to ask anything that you'd rather not ask on a public board. Umm everybody have fun and good luck!!

joe
SargeG
12-05-2001, 05:41 PM
Thanks for the e-address. You'll be hearing from me.

I'm kind of hoping that everyone interested is hard at work applying what we have discussed, learning on their own, and making some progress. I hope to see some more interest/questions in the future. Kayaker and meaculpa may yet return; iorior may yet make a contribution. Maybe even someone new will pop up!

Good luck all

Sarge
Kayaker
12-05-2001, 11:20 PM
Lost but not forgotten ;-)

I'd be more than happy to see further VB discussions in one form or another if anyone wants to take up the cry. I'd like to take a look at iorior's code when I get the chance, to get a top-down look at things and see how forms are handled. I just wanted to see those interested be able to discuss what they wanted in a friendly environment and get a few new ideas flowing around. You never know what can develop.

I agree you shouldn't give away the fort, people should have to be serious and work for their fun. Personally I'm too caught up in my own project to give over to a new major endeavour completely, but it doesn't mean I won't play with the idea ;) If anyone else wants to take on a project to fully understand VB and get help with it, now's your chance. Don't pass up the opportunity!

Regards all,
Kayaker
SargeG
12-06-2001, 09:06 AM
Thanks!

I was just thinking about you this morning, so I'm not surprised to find a response from you.

I have made an inference that your questions about enabling a control in the code was related to the VBCrackMe #2 you had
mentioned. This implies that this is at least some of the "other project" you had mentioned. Good luck! [Come back when you get stumped on the FF 02 03 04 sequences :) ]

Sarge
meaculpa
12-06-2001, 09:12 AM
Hi All,
Sadly, i'm also more busy with less time to play ;(
Would like to get my teeth into this more, over the coming
holiday season.

Until later, take care.

Regards,
.MeaCulpa
Kayaker
12-06-2001, 10:49 AM
Originally posted by SargeG
I have made an inference that your questions about enabling a control in the code was related to the VBCrackMe #2 you had
mentioned. This implies that this is at least some of the "other project" you had mentioned

Sarge

Hi Sarge

Heh, no I meant my own reversing tool program I've been developing for the past several months. (surprise, non-VB related ;) Probably why I don't want to take on a new project, I know they can evolve and grow into a never ending monster. A little tweak here, a little tweak there, damn, I'm sure I can save a few bytes if I recode this section, gee a toolbar would be nice...you get the idea ;)

Kayaker
SargeG
12-06-2001, 11:24 AM
1. Ok, my mistake.

2. Been there, done that.

3. Please include automatic dishwashing as a option!

Sarge
stealthFIGHTER
12-09-2001, 03:55 PM
Hello all,

please, can anybody post in attachment (or send it to me) some example program (created in VB) with enabled/disabled button/menu? (I don't have VB to create one ).

I'm much obliged to YOU!
sF
SargeG
12-09-2001, 08:31 PM
There is a file attached that has two command buttons.
One has the caption "ENABLED", the other has the caption
"DISABLED". That, and their "Left" properties, are the only
insignificant differences. The significant difference is that one
has its enabled property set to True and the other has it set
to False.

Good luck
Sarge
SargeG
12-13-2001, 10:21 AM
All:

For anyone who is interested, a parallel discussion can be found
at:

http://decompiler.com/

Choose "discussion", then "MS Visual Basic" (under the Decompiler heading). There are a large number of posts there, (but some are actually reasonably intelligent), that have to do with a slightly different path to decompiling. Someone who can
put the two together may want to seriously make notes.

Thanks

SargeG
josephCo
12-19-2001, 02:11 AM
*silence*

hehe I tend to avoid decompiler.com. Although there (at times) is some intriguing conversation, most of the time it's just begging for this or that and the occasional flaming of a person. Hahaha also my french isn't so good, so I can't contribute to the one good current thread :/ Umm any vb projects going on? I'm fairly busy most of the time, but could probably steal some time from something if the cause it good :)

joe
Ryan
12-19-2001, 04:26 AM
Originally posted by josephCo
*silence*

hehe I tend to avoid decompiler.com. Although there (at times) is some intriguing conversation, most of the time it's just begging for this or that and the occasional flaming of a person. Hahaha also my french isn't so good, so I can't contribute to the one good current thread :/ Umm any vb projects going on? I'm fairly busy most of the time, but could probably steal some time from something if the cause it good :)

joe

Hi joco ;)

Well, I have been asking people to try my active x... To date, they have not cracked it. Maybe you can do something about it? I am sure your newest version of exdec should be able to digest it. :)

I have my own thread in the Mini Project forum.

Regards and respect,
Ryan
josephCo
12-19-2001, 02:09 PM
Ryan

Hehehe I've given up cracking a LONG time ago :) Sorry to disappoint you. But if your active x is PCode, then I might take a look at it. Anyway.. good luck!!

joe
Ryan
12-19-2001, 02:41 PM
Originally posted by josephCo
Ryan

Hehehe I've given up cracking a LONG time ago :) Sorry to disappoint you. But if your active x is PCode, then I might take a look at it. Anyway.. good luck!!

joe

Hi,
yes it is in PCode. Feel free to take a look. You might even *recognise* it... ;) Grin

Thanks,
Ryan
josephCo
12-20-2001, 03:17 AM
okie... I'll see what I'll find :) But as I told you a while back, exdec doesn't handle OCXs or DLLs. Good luck with everything :)

joe
Ryan
12-20-2001, 06:58 AM
Originally posted by josephCo
okie... I'll see what I'll find :) But as I told you a while back, exdec doesn't handle OCXs or DLLs. Good luck with everything :)

joe

hi,
by the way, since the xoom server is down, is there any other place I can get the newest version of exdec?

Thanks
Ryan
josephCo
12-31-2001, 02:11 AM
Sorry for the delay (I'm a lazy arse sometimes hehe ). Umm There is no updated version of ExDec available. I have a private version but atm it'll stay that way. As far as your OCX goes, I've rebuilt almost everything needed to run it through ExDec. I've had to add a few structures and change the format a bit, but nothing really major. If all goes well, would you like me to send you the output? Don't worry.. if I can decompile it, I won't share what I find with anybody (I hope you believe me) :)

joe
Ryan
12-31-2001, 09:05 PM
Originally posted by josephCo
Sorry for the delay (I'm a lazy arse sometimes hehe ). Umm There is no updated version of ExDec available. I have a private version but atm it'll stay that way. As far as your OCX goes, I've rebuilt almost everything needed to run it through ExDec. I've had to add a few structures and change the format a bit, but nothing really major. If all goes well, would you like me to send you the output? Don't worry.. if I can decompile it, I won't share what I find with anybody (I hope you believe me) :)

joe

Hi,
sure, that will be great. Maybe I can tell you what the exact source look like in some of the procedures. ;)
ryan(underscore)thian(at)hotmail(dot)com(remove_this_too)

Ryan
Kayaker
12-31-2001, 09:47 PM
Hi,

I'm glad to see you're finally getting some input on your protection Ryan. Good luck. Cheers Joe.

Regards,
Kayaker
Snatch
01-01-2002, 12:12 AM
Correction this is the definitive list straight from MSVBVM60.DLL property listing for a CommandButton :).

CommandButton - 0x04

[0 Name text]
1 Caption text
2 Index Word
3 BackColor color
4 Size size [4 Left, 5 Top, 6 Width, 7 Height]
8 Enabled boolean
9 Visible boolean
a MousePointer Byte
[b FontName text]
[c FontSize Word]
[d FontBold boolean]
[e FontItalic boolean]
[f FontStrikethru boolean]
[10 FontUnderline boolean]
11 TabIndex Word
[12 Value]
13 Default boolean
14 Cancel boolean
[15 Parent]
16 DragMode Byte
17 DragIcon pic
18 TabStop boolean
19 Tag wtext
[1a hWnd]
1b HelpContextID DWord
1c MouseIcon pic
1d Font font
1e WhatsThisHelpID DWord
1f Appearance Byte
[20 Container]
[21 RightToLeft]
22 Picture pic
23 DisabledPicture pic
24 DownPicture pic
25 ToolTipText text
26 OLEDropMode Byte
27 MaskColor color
28 UseMaskColor boolean
29 Style Byte
[2a CausesValidation]

This is why I dont like the trial and error method as some things never appear until it is too late :). For all curious folks out there this stuff is easy. I am thinking about releasing full lists of all of them but I think you should all use your brains and figure it out yourself as the experience is valuable. Here is your hint. Get MSVBVM60.DLL SP5 loaded in IDA. Load the symbols included with the service pack. Go to this offset. You actually do not even need the symbols for this but it makes it easier. 6600B4C8. That is the offset of the Button property listing. It goes in order by index so VB runtime can read a byte and then index the property as a jump table
mov eax, CommandButtonPropertyVTable
mov ebx, ReadInPropertyByteValue
jmp[eax+ebx*4]
Of course the 04 signifies CommandButton and it looks up the table there. Anyway figuring out the data type corrisponding to each property is a little bit different but easily doable just spend some time surfing through. If you look into the pointers in the table they each point to a structure with the offset to the string name of the property, 8 bytes describing the data type and then the last 4 bytes describe the default. Anyway now everyone has the tool to make a PERFECT form decompiler of standard VB controls no excuses ;).

Snatch
josephCo
01-01-2002, 02:01 AM
As I said earlier (or maybe it was on another forum) I don't really use text files anymore. I used to keep them updated all the time, but it became a big pain in the arse. A lot of my dirty work is done by using VB5.OLB / TLBINF32.DLL (using C makes it a bit more difficult). Sarge, you could easily incorporate this into your project (but remember I can't code worth sh*t using VB.. so don't ask me for help hehe). But here's a snippet from one of my procedures:

rc = CoCreateInstance(&mCLSID_TypeLibInfo, 0, 1, &mIID_IUnknown, &obj_TLinf);
rc = QueryInterface(obj_TLinf, &mIID_TypeLibInfo, &int_TLinf);

/* m_TLInf.AppObjString = "<Unqualified>" */
sTmp = SysAllocString(L"<Unqualified>");

rc = Set_AppObjString(int_TLinf, sTmp);
SysFreeString(sTmp);

/* m_TLInf.ContainingFile = Path & "VB5.OLB" */
sTmp = SysAllocString(L"vb5.olb");

rc = Set_ContainingFile(int_TLinf, sTmp);
SysFreeString(sTmp);

/* With m_TLInf.TypeInfos.NamedItem("_Form").VTableInterface.Members */
rc = Get_TypeInfos(int_TLinf, &int_TypeInfos);

rc = Get_NamedItem(int_TypeInfos, &sTmpT, &int_NamedItem); /* 13 */
SysFreeString(sTmpT);
rc = Get_VTableInterface(int_NamedItem, &int_InterfaceInfo);
rc = Get_Members(int_InterfaceInfo, &int_Members);

items = iOffset = 0; /* These are really shorts, so clear the hiword */
rc = Get_Count(int_Members, &items);
for (o=1;o<items;o++) {
rc = Get_Item(int_Members, o, &int_MemberInfo);
rc = Get_Name(int_MemberInfo, &sTmp);
rc = Get_VTableOffset(int_MemberInfo, &iOffset);
if (iOffset == index){
rc = Get_Parameters(int_MemberInfo,&int_Parameters);
rc = Get_Count(int_Parameters,&count);
rc = Release(int_Parameters);
rc = Get_InvokeKind(int_MemberInfo,&iKind);
if (iKind == 2){ //get
b=pop();
c=pop();
sprintf(buf,"Get_%ws %s %s \n",sTmp,c,b);
free(c);
free(b);
}
else if (iKind == 4){
b=pop();
c=pop();
sprintf(buf,"Put_%ws %s %s\n",sTmp,c,b);
free(c);
free(b);
}
else
...
...
so on and so forth...

hehe it seems this snippet has more comments than what I usually use (lucky me!).

Anyway, to everyone and nobody in particular:

HAPPY NEW YEAR!!!!

May the new year bring you happiness and good fortune.

joe
Snatch
01-01-2002, 06:02 AM
Haha JoCo. Looks like I wasnt the only one to be playing around with VTable's and COM :). Definitely useful in the land of VB decompilation. A very interesting technology COM is. I had to read a 700 page book about COM and ATL to fully understand the beast. Clever concept but much extra code required to implement the interfaces. Alas, once I know the technology it becomes obsolete and we await to see how SOAP and .NET change the technology. Anyway, cracking .NET programs is going to be the next generation and could pose some problems but now you just need to write a CLR decompiler and you can decompile managed c++, c#, vb all in one swoop. Actually protection was a huge issue so I believe Microsoft will release an encryptor. As if we cant unpack that hah! But if the encryptor is well nested with the CLR it could pose some challenges. We just have to wait a month more til the final release and see. Happy new year!


encrypt Elan LM Key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > encrypt Elan LM Key
PDA

View Full Version : encrypt Elan LM Key

helmut
11-20-2001, 04:31 AM
Hi,

i search for a tool to encrypted a decrypted Elan LM Key!

can anybody HElp me, thx a lot


Information requrired
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Information requrired
PDA

View Full Version : Information requrired

peterg70
11-20-2001, 07:01 AM
Guys

Whats the correct API to trap when i want to i want to break into the code when i click on button like "register" so that i can trace what it does from when i click the button

I know User32.dll:getwindowtextA and others for the text but i think i need the something for when a button is depressed

TIA
peterg70

PS finally managed to rebuild the exe for crypkey what a bloody pain but at least i have a working one.

Later on i want to add some fields on the dialog that i can type values into rather than hexing the code all the time. Is there any software that does that ?
Clandestiny
11-20-2001, 08:15 AM
Hiya,

Well, in this case you'll probably want to set a Windoze message breakpoint.

Syntax in SI is "bmsg "hwnd of window / control" "message".

You first will need to get the handle of the button in question. This is easily accomplished using a tool like Windowse. It will also be helpful to get the button's ID #.

As for the specific message breakpoint, you have a couple of options. Specific mouse-click related breakpoints are a possiblity as in:

BM_CLICK
WM_LBUTTONDOWN
WM_LBUTTONUP
BN_CLICKED

Or alternately, you could just set a conditional breakpoint on WM_COMMAND if the LOWORD is equal to the ID for the button in question.

WM_COMMAND
wNotifyCode = HIWORD(wParam); // notification code
wID = LOWORD(wParam); // item, control, or accelerator identifier
hwndCtl = (HWND) lParam; // handle of control

This will break you right into the middle to the main message processing loop for the application. Basically, it'll look like a giant set of "IF" statements. And as you trace you'll be watching each of these comparisons to find out where your button ID is compared to the LOWORD(wParam). When you find this point, the following code / function call should point you to the code that is executed in response to this button having been clicked.

Regards,
Clandestiny


Reversing Safecast - The Solution
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing Safecast - The Solution
PDA

View Full Version : Reversing Safecast - The Solution

TheBlock
11-20-2001, 02:07 PM
After posting a question about unpacking Safecast, and seeing that anybody had replied me, I have seen that not a lot of people are able to unpack something packed with safecast.
I have unpacked all the new Autodesk Releases, all of them are protected with safecast.
The first problem I had was that I thougth that it was the main exe the one that was packed, simillar to VBox, but I was wrong.
Lets resume a bit how the protection works.
There is a main executable that calls some functions of a dll (adlmbase.dll) this dll is the one used to display the dialogbox of the evaluation period and the one who calls the cdilla driver that will be used to unpack de things that are crypted.
I haven't studied how to make an expired evaluation to work again but anyway Tsehp & R!sc wrote a nice tutorial about how to do it (Hi Guys!! :P)
So I'll asume you are still in evaluation period. what I did was execute the program,when de dialogbox appears, put a bpx on -CreateFileA, and then click on next, to start evaluating the program. Then saftice will break, F12 and you probably are in CdillaXX.dll code. Now disable the bpx and put a new bpx on getversion. F5 to continue, program should break on some diferent files, those files maybe are crypted take a note of some of them, and when you are bored disable the bpx to let the program finish loading. Now using HexWorkshop open those noted files to see if they are cryped just looking it you will know if they are crypted or not. take note of the crypted files.
....
....
....
I'll give you a day to try those things and maybe you will be able to finish unpacking by yourself, this should be the goal of any cracker, be able to make things by your own, whitout help.
Why I'm doing this instead of writing a tutorial? Cause by this way I make you think a bit and you don't crack anything without knowing what you are doing.
I hope you like this new way of teaching.

P.S. If you think you can continue the Forum Tutorial DO IT, or if you do it in a diferent way, please post it here.

P.S.2: Sorry for my really poor english level.

TheBlock.

Limits were make to be broken, PROTECTIONS TOO.
TheBlock
11-21-2001, 10:03 AM
New Day, New part of the tutorial. If you have tryed what I explaned you yesterday you probably have fond the crypted files.
This is a good beggining. Not a lot of things remaind to finish with the tutorial.
Lets continue.

The files are Crypted, not packed. What I want to tell you is that no changes will be needed after dumping the files.
Lets continue with the procedure.
We will start again. Execute the program. When the dialogbox appears, put a Bpx on CreateFileA, click on Next Button to start the evaluation. Softice Will break then F12, you should be in Cdilla dll code, F12 2 or 3 times, until you exit from cdilla dll. Now put a bpx on GetVersion. F5 to continue. when softice break, press F12 to see if we are in the right place (taking a look at the green line you will see what file is being traced, as soon as this green line displays the name of the crypted dll stop doing anything. disable the bpx (BC*) and go back with Ctrl+Up Arrow until you see the begining of the routine.
Normally you can identify the begining of a routine by searching a

int 3 // or nop
int 3 // or nop
push EBP
mov EBP,ESP
....
...
...
Take not of the RVA that corresponds to that begining of the function.
then put a bpx on that Push EBP. now press F5 Again.
if the Sice break again on that push EBP, now press a, then return. Then write, jmp eip, press return again, F5 to exit. now the program stops loading.
Get Peditor and dump the dll that you want to decrypt. (i'm not going to explane how to do it, i hope you have enough level to know it).
Now the only thing that reminds is to fix those two modified bytes. just open hiew and go to the ofset where you assemble a jmp eip. and correct it with the right values, normally it should be 558B.
You have decrypted the dll. Repeat those steps for every crypted file.
Now the only thing that reminds is to fix the adlmbase to stop displaying the dialogbox and fix all the checks on the license that are done.
I wont comment how to do this but setting a bpx on DialogBoxParamA and doing a bit of trace you will find it.

The functions that i patched (adlmbase.dll) were:
XXXX Authorize XXXXXXXX
XXXXCheckLicenseXXXXXXX
XXXX CheckClientLicenseXXXXXXX
All those functions must return eax=0.

That's all, if you have do it right you should have a full working version of the program.
The only programs that I have crakced are the ones from Autodesk, if you know any other program protected with SafeCast Let me know it.

I hope you have learned how to do it.
Now if you think you can write a nice tutorial would be great for everyone who don't know about this forum.

Any questions will be answered here, don't mail me cause I don't respond any mail.

TheBlock
Lord_Soth
11-21-2001, 11:38 AM
Maybe no one was really interested in your target ?

You assumed because none have answered they can't
unpack it. Maybe they couldn't get their hands on that
target ??
maybe they dont give a flying f**k ??

LS
TheBlock
11-21-2001, 01:50 PM
Maybe, anyway after finding the way to do what I was trying to do i thought it would be nice to let the people know how I did it. I know there are people that can unpack SafeCast. r!sc already wrote an unpacker for an older version. If my litle explanation helps at least one person i'll already be happy.
Don't know why are you so rude with me, I don't know if i have said something wrong, if this is the case I'm sorry.
Sincerely
TheBlock
Lord_Soth
11-21-2001, 05:19 PM
I dont think I was too rude. If i was, you have my apology. :)
This happens sometimes. Ppl post something and nobody
replies. From the first words in your post it was annoying
to see that you *assumed* not many can unpack it.

anyways, enough said. Why don't you make an essay
out of it ?

LS
TheBlock
11-22-2001, 05:20 AM
I was trying to see if anybody have a diferent way to unpack safecast. My way works fine in almost all aplications but for example, for unpacking 3D Studio Max 4 I had a lot of problems to find the OEP cause GetVersion wasn't called at tge begining. In this case what I did was trying to make the program to call one of those decrypted files to se what was the imagebase, then after breaking on Cdilla code I pressed F12 until all the cdilla code was executed and then with Icedump loaded I used the \tracex function using the Imagebase I had found before. So finally I could find a good place to dump the file.
If anybody else have any other way to do it would be very helpful if you post it here, so I can make a better tutorial.
Thank you in Advance


crypt strings
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > crypt strings
PDA

View Full Version : crypt strings

pjg
11-20-2001, 04:35 PM
Can you give me a help?
I'm finishing a vb program that will be released as freeware or cardware. One thing that I hate is when lamers change the strings (like the name of the author) of the .exe. I want to avoid this, so I decided to encrypt the executable using programs like upx and PECompact. But for every encryptation program there is a decrypt application, many of them made by crackers like yourself, which shows the extremely knowledge you have (I know, knowledge is power :). So my questions are:

1 - If I use lets say UPX, can I change in my program the section names called upx to something else without damaging my program (I just want to confuse lamers, not stop crackers)?

2 - I know how to make a simple XOR encryptation to a file, but how to encrypt an exe, keeping it as an executable?

Sorry for the long post and I hope you understand my reasons. Thank you very much
Solomon
11-20-2001, 09:01 PM
You can pack your prog with UPX, then use any Hex Editor to change the section name to any string(can't be too long):D

Try visiting w*w.exetools.com, there are many packers/protectors which can stop lamers;)

Better use p-code compiling options:D

good luck
pjg
11-21-2001, 04:15 AM
Thank you very much Solomon. I've been at exetools and at protools and there's no solution :rolleyes: (every crypter has a decrypter). I have to do my own :)

Thanks for the p-code tip (it's what I'm doing). Anyways, WKT did a great job ;)
Idcrisis
11-22-2001, 05:13 AM
Even if you change the section headers to some non standard value using, say using ProcDump->PE Editor, any cracker can use FileInfo. FileIno still detects UPX after changing the section headers(even though UPX/GetTyp can't). Then all one has to do is change the headers back to UPX0 and UPX1 to be able to decrypt the executable with UPX itself.

The best thing to do is executable integrity checks, ideally your own, you can make do with CRC.
Aimless
11-22-2001, 06:26 AM
In your program, instead of:

PROGRAMMED BY : "Mr. Super"

key in:

PROGRAMMED BY: chr(54)+chr(58)+chr(34)+chr(20)....

and so on.

You get the idea

(Note the above ascii char/hex are not equal. They are just examples.)

...Have Phun
pjg
11-24-2001, 08:07 AM
Thanks Idcrisis and aimless, I will take that into acount. I already tried a CRC check, but that doesn't work when you are just changing plain text (unless my CRC was not very good).


Iris 3.6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Iris 3.6
PDA

View Full Version : Iris 3.6

Crudd
11-20-2001, 06:34 PM
Well, ive been trying to unpack this bastard with no luck. It has anti-si,anti-/tracex, and anti-fi. All the sections are named 'BJFnt' except the rsrc section. Ive tried a few unpackers for BJFnt but none seem to work. Im pretty much lost, anyone who would like to give me some pointers or have a look at the proggie yourself its at eeye.com and there arent any cracks released for it yet, not that i have found anyway, so it must be quite a challenge, prolly more than im up to.
Crudd
Solomon
11-20-2001, 09:05 PM
Pls read the old posts.
Evaluator and I posted a thread about IRIS 3.6 demo unpacking.
v3.603 full version has been released as warez.:D
stillnewbie
11-21-2001, 05:33 AM
>v3.603 full version has been released as warez.:D [/B][/QUOTE]

:mad: WTF!!!

pointing ppl to newbies to warez?
promoting warez is not allowed here!!!
Solomon
11-21-2001, 06:58 AM
Calm down:cool:
Did I post any warez link here? or did I tell sb where to get warez in this board? I just show the fact.

BTW: How do you think about the thread "IDA leaked/stolen"? Did the author of this thread point ppl to warezd IDA?

so take it easy. Don't be too sensitive:D

Originally posted by stillnewbie
>v3.603 full version has been released as warez.:D

:mad: WTF!!!

pointing ppl to newbies to warez?
promoting warez is not allowed here!!! [/B][/QUOTE]
stillnewbie
11-21-2001, 09:38 AM
[QUOTE]Originally posted by Solomon
[B]Calm down:cool:
>Did I post any warez link here? or did I tell sb where to >get warez in this board? I just show the fact.
Fact? he only ask how to unpack blah blah....

>BTW: How do you think about the thread "IDA leaked/stolen"? >Did the author of this thread point ppl to warezd IDA?
>so take it easy. Don't be too sensitive:D

Ask the author that post this thread.There's free Ida version in Datarescue ftp site.Am I promoting warez???

.
+SplAj
11-21-2001, 10:08 AM
----------------------------------------------
Fact? he only ask how to unpack blah blah....
-----------------------------------------------

no he did not cos he said he :-

"Ive tried a few unpackers for BJFnt but none seem to work".....
^^^^^^
well he did not understand the tricks in te!lock.... we have discussed this dozens of times, tE! has some new tricks .... a new one is the pe size (use LordPE to fix this before dumping) ..... as well as the SEH.......

but anyway what he needs is 'WKT te_unpacker1.2' ........

Else if he shows genuine 'manual' unpacking notes/discussion then we can help. As solomon said.. it's been fried several times.

So no cheating with those automagic unpackers or you'll NEVER learn nowt..........
stillnewbie
11-21-2001, 10:25 AM
Originally posted by +SplAj
----------------------------------------------
Fact? he only ask how to unpack blah blah....
-----------------------------------------------

no he did not cos he said he :-

"Ive tried a few unpackers for BJFnt but none seem to work".....
^^^^^^
well he did not understand the tricks in te!lock.... we have discussed this dozens of times, tE! has some new tricks .... a new one is the pe size (use LordPE to fix this before dumping) ..... as well as the SEH.......

but anyway what he needs is 'WKT te_unpacker1.2' ........

Else if he shows genuine 'manual' unpacking notes/discussion then we can help. As solomon said.. it's been fried several times.

So no cheating with those automagic unpackers or you'll NEVER learn nowt..........

>Well, ive been trying to unpack this bastard with no luck.
>It has anti-si,anti-/tracex, and anti-fi.All the sections
>are named 'BJFnt' except the rsrc section.
>Ive tried a few unpackers for BJFnt but none seem to work. >>>Im pretty much lost, anyone who would like to give me >>>>some pointers or have a look at the proggie yourself its at
>eeye.com

He did but failed but he also failed using unpacker ;)
(stop)


Can't send keystroke ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Can't send keystroke ?
PDA

View Full Version : Can't send keystroke ?

rubik
11-20-2001, 11:21 PM
Question : if i send a keystroke (postmessage->VK_A) to a particular application's window, and it doesn't seem to be doing anything with it (it is suppose to, if i hit A on the keyboard, it does something) , what does that really mean ? does the app somehow know i'm sending it messagers and not accepting it ?

My code works fine, i use findwindow to get the handle to the window i want to send the keystrokes to. If i select, let's say, notepad's window and test my code, it does exactly what i want, but when i use the handle of this app i want to debug, it seem to discard it. Help !

More information on this particular application. What it does when i run the exe is, it launches a DLL and it looks like the entire program is running in the DLL, and by sending keystrokes to thw exe window, it does not pass it down to the DLL. Help !
Carpathia
11-21-2001, 05:41 AM
You didnt saywhat windows message you were using, but dont forget the response might be due to WM_KEYDOWN, WM_KEYUP, not just WM_CHAR.

Carpii
rubik
11-21-2001, 10:45 AM
I am sending the correct WM_CHAR messagers, i've tested it on other applications, they receive it just fine. Is there a way for me to send it directly to the process instead of it's parent window, which seems to be dropping it ?
Carpathia
11-21-2001, 11:53 AM
The point I was trying to make, is that WM_CHAR message is typically formed by an application calling TranslateMessage API, after a WM_KEYDOWN and corresponding WM_KEYUP message has been received. If the application is doing whatever is does by handling the actual WM_KEYUP or WM_KEYDOWN message, then manually sending a WM_CHAR message may not trigger the handler you are trying to invoke.

Sending a message to a process makes no sense. They must be sent to a Window with a valid HWND. Also, there is no practical way for the app to determine if the message originated from the keyboard handler or from your little test app.

Regards

Carpathia
rubik
11-21-2001, 11:56 AM
I have also tried to send keydown+keyup messagers, with the same effect, works on all other apps except this one i'm debugging. So basically i'm stumped, how come this app doesn't respond to my key messagers ? I also checked the return value and it was successful. I used sendmessage, postmessage, postthreadmessage , all to the same effect. This app run fullscreen btw. Is there anything you can think of ?
Lord_Soth
11-21-2001, 12:05 PM
How about you try and dig into the code that handles
keypresses in your program ??
See what kind of message it processes.

For a C based program, this is most easily done, breaking
inside the window procedure.
For an MFC program, it's a bit trickier. There is a function
for every message, assuming the programmer overide
it. (for example: OnKeyDown).
First check how the app is processing keystrokes, then
try to use the appropriate message and format.
It should work, unless there is more validation that
we are not aware of..

LS
Idcrisis
11-26-2001, 03:17 AM
Downlod The Customiser from Wanga International and send all the API calls that you want to manually and visually before doing anything programmatically. It will be a great help.


Is there a decompiler for VB5 like there is one for VB3 (Dodi)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is there a decompiler for VB5 like there is one for VB3 (Dodi)?
PDA

View Full Version : Is there a decompiler for VB5 like there is one for VB3 (Dodi)?

JohnnyBoy
11-21-2001, 03:09 AM
Is there a decompiler for VB5 like there is one for VB3 (Dodi)?
koyaan
11-27-2001, 02:48 PM
"smart check" is kinda handy...
but be sure to get the latest version
imo 4

cheers
koyaan


Unloading SofticeNT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unloading SofticeNT
PDA

View Full Version : Unloading SofticeNT

Wizard
11-21-2001, 09:29 AM
To load SICE under NT, you have to execute 'ntice.bat' which executes this command : 'net start ntice'.

Although Numega claims it can be done, is there anyway to unload SICE ?

Wizard
DakienDX
11-23-2001, 09:10 AM
Hello Wizard !

Try "net stop ntice". There should be a link in the start menu, too.

I thought there was also a batchfile included doing this. But might be my mistake.


SI + w2000 = couilles ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SI + w2000 = couilles ?
PDA

View Full Version : SI + w2000 = couilles ?

Ali
11-21-2001, 05:20 PM
hi all,

i'm a newbie,

i have the feeling (after reading a few things) that install SI on my win2000's OS is a bad idea.

Am i wrong or not ?

Should i install softicev4.05 or a preview version ?

Many thanks for any answers
UrgeOverKill
11-25-2001, 04:49 PM
i have the feeling (after reading a few things) that install SI on my win2000's OS is a bad idea.

Why was it a bad idea? If you want to get rid of it, simply uninstall it through you control panel.


good ebook site..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > good ebook site..
PDA

View Full Version : good ebook site..

Lord_Soth
11-21-2001, 10:10 PM
Hey guys, get:

http://hoganbooks.com/freebook/weball.html

Choose the whole listing, and then DL the zip. It contains
many book links :-)

LS
JimmyClif
11-21-2001, 10:44 PM
Thanks... very useful :-)

JimmyClif


www.hexalock.com
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > www.hexalock.com
PDA

View Full Version : www.hexalock.com

IcyDee
11-22-2001, 04:42 AM
Does anyone know of any titles protected by this 'new' copy protection system?

It will be interesting to see if it stands up for more than a day or so once it is released :D

Reading between the lines it appears to be an API approach. The developers of the program include copy protection code in their code. I can't see this being any more secure than a wrapper, indeed it will probably be less secure.

IcyDee
DakienDX
11-23-2001, 09:27 AM
Hello IcyDee !

I don't know any titles, never heard of the protection.

A wrapper should be more secure, since nobody can patch any code in it (most time :) ).

But someone can easily make a program which will remove the wrapper from any program, at least with the same version.

Using the API method can be done in two ways. A bad one and a (nearly) good one.

Calling an external DLL can be easily defeated by replacing the DLL with an own DLL which emulates all the calls.

The better method is the 'object' method, where the copy-protection is linked with the main program. You can't write a replacement, since there is no external DLL. You can't 'unwrap' it, since there's no wrapper.

You need to know which functions belong to the copy-protection, so you can patch them in the main program. This must be done for every program protected, if you don't write a generic function finder/replacer which can be used on all protected files with the same version.
IcyDee
11-23-2001, 11:16 AM
The strength of a particular program probably depends upon how it is attacked. Certainly if a generic wrapper is used then it is possible to create a generic unwrapper which makes cracking new titles very easy. If the protection is 'compiled in' to the original program then a generic crack is more difficult, however...

I think the number of things that an API can do are limited. There can't easily be very much encryption of the code, the copy protection code will be easily spotted by IDA since it will (nearly) always look the same. I would guess that this would make manual removal of the copy protection very easy. Take SafeDisc for example. In Version 2 they include an API as well as the wrapper. If you look at how these titles have been cracked the removal of the API code is only a minor inconvenience dismissed in a few lines of description in the tutorials.

IcyDee.


Win 2000 Dial-Up Password
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Win 2000 Dial-Up Password
PDA

View Full Version : Win 2000 Dial-Up Password

Idcrisis
11-22-2001, 05:46 AM
Anyone know how I can find the Dial-Up passwords in Win2000? All programs to check behind the asterisks don't work in Win2K. I had three options but I can't find the URL. If anyone has any of these or another approach it would help.

i) Fravia's page article on how to change the dial-up DLL resources to make the edit box a non password edit box. I don't remember which DLL was to be patched.

ii) There is a dial-up sniffer which is used to get the encrypted passwords of all these free ISPs. I lost the URL and the name of that proggie.
Idcrisis
11-28-2001, 01:36 AM
OK here's the latest:

i) Using Exescope to change the password edit box in RASDLG.DLL is no use. The text there is actually ********
:(

ii) Found the dial-up sniffer. Its called RASSPY. It's the solution to all free ISP blues. But it doesn't work on Win2K. :mad:

iii) #cracking4newbies...thanks cynica_l...the answer is portmon by the filemon guy. sniffs the COM port....gives the password, the only way to do it without cracking the cryptography. Maybe someone should think about that.

Time to run naked down the street.
NikDH
11-28-2001, 09:24 AM
Originally posted by Idcrisis

ii) Found the dial-up sniffer. Its called RASSPY. It's the solution to all free ISP blues. But it doesn't work on Win2K. :mad:

It doesnt work on win2k and NT coz they doesnt RasApi and RasApi r not implemented at all under them

See ya
NikDH


What I can expect from InterLok?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What I can expect from InterLok?
PDA

View Full Version : What I can expect from InterLok?

neviens
11-22-2001, 10:55 AM
Hi all!
Has anybody a practice with Interlok shareware protection from
PACE? What is a right aproach to this beast? Any links, literature?
TIA,
Neviens.
Kythen
11-25-2001, 09:21 PM
I've found Interlok to be very easy to eliminate (at least the wrapper version, never seen the API one). Just be sure that you don't use SoftICE, as Interlok uses a "fun" little vxd that will reboot your system if you're messing around with SI. My recommendation is to use an API level debugger like WinDbg (the debugger from the Windows SDK). Trace through your target app with it and you'll see how basic the wrapper is. A function call or two for the nag, and then a jump to the OEP. If you use WinDbg, you can even just dump it with procdump while the debugger is running because it's controlling the target process. :) No modifications should be required after dumping, but you may have to edit the debug info part in the PE header in order to get IDA to disassemble it. Just zero it out and you should be fine.

Cheers!
Kythen
tony b.
11-25-2001, 10:27 PM
word up to that.

also, tsehp wrote this essay quite a while ago, if you haven't seen it yet: h**p://www.woodmann.net/fravia/tsehp_installpro62.htm

best regards,

tony
exit_2
11-29-2001, 03:37 AM
Hello,
anyone have whole protector ? I want to look to it, not protected files, but protector. Pace hasn't free evaluation version, but maybe someone have it.

Thanks Exit
neviens
11-29-2001, 03:54 AM
Thanks Kythen for suggestions and Tony for link. My case is a little
different - protected .dll (renaissance sound plugins) not .exe
Still working on it. Source is here: h**p://www.waves.com/
Neviens.
NikDH
11-29-2001, 05:42 AM
Originally posted by Kythen
Just be sure that you don't use SoftICE, as Interlok uses a "fun" little vxd that will reboot your system if you're messing around with SI.

Hi kythen,
think its quite easy to use the antisice trick just search the
search driver string in the vxd and change it :)
Perhaps u can study the vxd and find out where its rebooting the system (perhaps it should access the cr0 register) and work on it

See ya
NikDH
Kythen
11-29-2001, 12:04 PM
Yeah, you can go in and eliminate that rebooting code, but it's not so easy to find actually. There is a ton of similar looking code tossed throughout that vxd. It really is just easier to use a different debugger. If you want to see what's doing the rebooting, look at the essay on Interlok written by Frog's_Print I believe. It does a semi-hidden output to the keyboard controller's reset port.

Cheers,
Kythen
JMI
11-30-2001, 06:35 PM
Perhaps the article Kythen was referring to is:

Interlok VxD vagaries defeating the anti-debug trick inside tpkd.vxd, Written by macilaci

It has a good discussion of the rebooting feature of the Interlok vdx. The article is at:

http://www.woodmann.net/fravia/tpkdml.htm

The Interlok manuals are available on line, or at least an interim version. They are pushing their new dongle, called iLok.

Hope this is helpful. If you are interested, I have their readme file in text format which has several interesting point about their protection scheme in it. Most of my exterience with Pace was with removing their protection from Mac music software, which I did for years, before attempting to expand my reversing skills to the PC OS.


Greetings..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Greetings..
PDA

View Full Version : Greetings..

hobgoblin
11-22-2001, 03:28 PM
Hi there,
I'm looking for a tool I used to have ( I lost it in a HD crash a while ago). It converts letters and numbers to ascii values. I can't find it at Protools ( I can't get in, the site seems to have serious problems. Sudden Discharge is gone, so there is not much help there either). If someone could point me in a direction to find this tool, I would be grateful.

TIA,
hobgoblin
tsehp
11-22-2001, 03:55 PM
I'll post a link to exe tools down on the others.

We could have to host a mirror on the next days to rely on a good site for rce tools publishing.


Book:I want to be a real cracker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Book:I want to be a real cracker
PDA

View Full Version : Book:I want to be a real cracker

RevoQer
11-23-2001, 02:03 AM
lame sentence i know but which very interesting book helped you to become quickly an amateur cracker?? thx for reading
JimmyClif
11-23-2001, 02:25 AM
Start here:

http://www.woodmann.net/fravia/rce-faq.htm

It's the FAQ... Well, it's far from being perfect but it will help getting you started.

JC

PS: A lot of us started with the +ORC tutorials...
Here is a page (even in German - brrr ) wkw.anticrack.de
which got all the ORCPaks as download.
RevoQer
11-23-2001, 03:31 AM
1st thanks
2nd i'm german, hehe
evaluator
11-23-2001, 06:02 PM
What means "cracker"?
Where can I found tutors about this?
Im newbie here;;


Debugger Tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Debugger Tool
PDA

View Full Version : Debugger Tool

peterg70
11-23-2001, 07:23 AM
Looking for a debugger that can log what calls and jmps are made when i do certain things.

For example. If i enter a incorrect serial number and push the register buttom the software will produce a sort of a trace of what calls are made from my start point to my end point.

Then when i enter a correctly formatted serial number it will show again the trace so i can compare it to the original.

This sort of utility would be bloody useful in W32dasm debugger.
As it will show loops in the code where the serial number is check for each byte.

PS how can i get w32dasm to run the debugger without decompiling the exe first.

Also how can i jump straight to a DLL rather than disassembling the exe in w32dasm. (Some exes are hugh and no point in disassemble when the code is in a DLL)

TIA
Peterg70
Hoof Arted
11-23-2001, 08:04 AM
Hi,

You may have already done this but have a look at OllyDbg 1.05. This is very quickly becomming a tool of the trade and is accepted by many crackers. It is MUCH quicker than w32dasm.

Go here : h**p://home.t-online.de/home/Ollydbg/

Hoof
Clandestiny
11-23-2001, 08:45 AM
Hiya,

Actually, you can use SoftICE for this purpose by making use of its backtrace range feature and setting breakpoint traps.

The syntax is bprw "module name" T

Once the trace has been logged, you can use the SHOW
command to display the results of your trace.

For making multiple traces for comparison puposes, you'll have to make use of Kayaker's backtrace buffer disassembler TracDis since SI does not have any built in means of saving traces out to a file.

Cheers,
Clandestiny
peterg70
11-24-2001, 12:39 AM
thanks for the Info about Ollydbg.

Looks good but need to learn how to use it. Any info on using it would be good especially tracing the command and viewing API calls (similar to w32dasm)

thanks again:p :p :p :D :D :D :p :p :p


Save function disabled
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Save function disabled
PDA

View Full Version : Save function disabled

octapus
11-23-2001, 11:25 AM
I have downloaded a program called " The VR Worx 2.0". It's creator says that save function is disabled in Demo Version. When i click on SAVE or SAVE AS menu it shows a message that "You have a Demonstration Message...." etc.

I disassembeled the program with IDA and found the point where WM_COMMAND message is passed on to the program. Therefore i found what is executed when Save button is pressed.
I found no connection in that point with any Save Dialog from Common Dialogs DLL. Only a call to MessageboxA and then return to normal DlgProc waiting for messages.

So i went for the opposite direction. I found in imports section the Call to GetSaveFileName function of commdlg32.dll. GETSAVEFILENAME ICALL IS BEING USED ONCE IN THE ENTIRE PROGRAM.
In it's parameters pushed I found the Text that Save Dialog should show in it's bar("VR WORKS 2.0 Panorama Save as")". It's for sure that that function should be called
when pressing Save in the File menu. I wrote all the references to this call (where GetSavefilename is) up to five levels. There were about 12 of them. I breakpointed all of them but when pressing Save it never breakpoints.

I tried to see how getopenfilename is called and it was very straightforward. Right where WM_COMMAND message is executed it calls a function where GetOpenFilename is and it simply works.

So i tried the following things.
1) I pushed the window handle
and called the function where GetSaveFileName is ( that function has one argument of dword size). To tell the truth i couldn't understand what should be pushed and i did it blindly. As a result when i went through the code with Softice it created a GPF and started the program's EXCEPTION HANDLING PROCEDURE before showing Windows Familiar GPF and finally it exited.
2) The part where wm_command executed the code for SAVE menu had a call. Inside it , a function pointer was being used. I edited manually the data memory location where the fuction points to with the mem loc of starting Call where GetSaveFilename is. Still i can't imagine what should be pushed.
3) I tried the two ways above but not with the call which contains the GetSaveFileName but with a call that contains the call i mentioned above( this one had to arguments of dword size). GPF again.

It seems that the programmers have removed some code from the program before compiling it. You think there could be a way to link the Save Menu with it's true code?

Maybe this looks like a crack request but all i want is some clue to continue. If anybody has the time to deal with it you are welcome.
(site where program is : h*tp://www.vrtoolbox.com/downloads.html . It's size is about 1,4 MB) .

Note : After some more searching in the Internet i found that the other demo programs this company gives in it's site have cracks for the current newest version on the Internet.Their limitation is the same.So i had the thought to see how the cracking is being implemented on those and maybe it's the same with this one two.
Maybe this works since the same company made them. I will try it in the meantime while i wait for some answers.:confused:
Kayaker
11-23-2001, 01:51 PM
Hi octapus,

What needs to pushed for GetSaveFileName is a pointer to an OPENFILENAME structure that contains information used to initialize the dialog box. You may need to find or recreate its structure. Here's a matching SI display and source code for a basic GetSaveFileName call. You should be able to find similar code if the authors haven't deleted it. It might not be a direct jump from your wm_message to the save routine, there might be some other code that needs to be run or has been removed as well.

BTW, this didn't sound like a crack request at all, your explanations of how you approached it help others learn, simple as that.

OPENFILENAME structure:
0030:10004207 0000004C 00000000 00000000 1000429C L............B..
0030:10004217 00000000 00000000 00000001 100042E4 .............B.. 
0030:10004227 000001FF 00000000 00000000 00000000 ................
0030:10004237 100042C4 00280006 00290024 100042E0 .B....(.$.)..B..
0030:10004247 00000000 00000000 00000000

0167:100015A0 55 PUSH EBP 
0167:100015A1 8BEC MOV EBP,ESP
0167:100015A3 81C4CCFEFFFF ADD ESP,FFFFFECC
0167:100015A9 57 PUSH EDI
0167:100015AA 56 PUSH ESI
0167:100015AB C705074200104C000000MOV DWORD PTR [10004207],0000004C
This is the pointer to the start of the structure, its size is always 4C by default
mov ofn.lStructSize, SIZEOF ofn

0167:100015B5 C705134200109C420010MOV DWORD PTR [10004213],1000429C
0167:100015BF C605E442001000 MOV BYTE PTR [100042E4],00
0167:100015C6 C70523420010E4420010MOV DWORD PTR [10004223],100042E4
0167:100015D0 C70527420010FF010000MOV DWORD PTR [10004227],000001FF
0167:100015DA C70537420010C4420010MOV DWORD PTR [10004237],100042C4
0167:100015E4 C70543420010E0420010MOV DWORD PTR [10004243],100042E0
0167:100015EE C7053B42001006002800MOV DWORD PTR [1000423B],00280006
0167:100015F8 6807420010 PUSH 10004207
0167:100015FD E82A110000 CALL comdlg32!GetSaveFileNameA
0167:10001602 83F801 CMP EAX,01
0167:10001605 0F8596010000 JNZ 100017A1

;===============SaveFile Proc============================
SaveFile proc uses edi esi

LOCAL hMemory: DWORD
LOCAL pMemory: DWORD
LOCAL SizeReadWrite: DWORD

; --------------------------------------------------------------------------
; Initialize OPENFILENAME structure associated with GetSaveFileName function
; --------------------------------------------------------------------------

mov ofn.lStructSize, SIZEOF ofn
mov ofn.lpstrFilter, OFFSET strFilterSave
mov [globalBuffer],0
mov ofn.lpstrFile, OFFSET globalBuffer
mov ofn.nMaxFile, (SIZEOF globalBuffer)-1
mov ofn.lpstrTitle, OFFSET strTitleSave
mov ofn.lpstrDefExt, OFFSET strSaveExt
mov ofn.Flags, OFN_LONGNAMES or OFN_EXPLORER or OFN_HIDEREADONLY or OFN_OVERWRITEPROMPT

invoke GetSaveFileName, OFFSET ofn
.IF eax==TRUE

invoke CreateFile, OFFSET globalBuffer, GENERIC_WRITE, FILE_SHARE_WRITE,\
NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_ARCHIVE, NULL
mov hFile,eax

DO SOMETHING

invoke WriteFile, hFile, pMemory, edi, ADDR SizeReadWrite, NULL

invoke CloseHandle, hFile
invoke GlobalUnlock, pMemory
invoke GlobalFree, hMemory

.ENDIF

ret
SaveFile endp
;===============End SaveFile Proc========================

Hope this helps,
Kayaker
octapus
11-26-2001, 08:06 AM
Hi Kayaker

Thank you for your answer.
Well the pointer to the OPENFILENAME
structure is right above it. And before being pushed the struture is being filled with everything needed. All these commands are inside a FUNCTION. Let's name it SAVE_FUNC. Isn't it logical that when something is going to be saved, there should be a call to SAVE_FUNC?
As i have stated above SAVE_FUNC has one parameter (argument) and also that GETSAVEFILENAME exist once in the whole program. So if something ( like a program project ) is going to be saved SAVE_FUNC should definitly be called.

Well I put breakpoints on the start of SAVE_FUNC and on the start of the function that refers to SAVE_FUNC and it never breaks.

Apparently the code executed when pressing Save is not linked at all with CALL_FUNC in any way. But still in that code ( of Save ) there is a call to a pointer in memory. And this pointer is filled everytime before the call happens.

NOTE : Since i refered to it before there is one XReference to CALL_FUNC.
+SplAj
11-26-2001, 08:52 AM
Octa..
====

seems you are nearly there :D. Just need to relocate the pointer for 'eval' message to the real code that opens the save dlg box :rolleyes:

for all , here is the more direct link to d/l target, don't bother wasting your time filling in the stupid boxes ;)

h**p://vrtoolbox.com/download-demos/VRWorxDemo.exe
octapus
11-27-2001, 07:58 AM
This target seems to have its own EXCEPTION HANDLING routine. So everytime i try to replace the function pointer to "bad message" ( points somewhere where MESSAGEBOXA executes ) with one that points of SAVE_PROC ( check how i define SAVE_PROC above) it always breaks with a GPF.

Maybe i am very close but i can't think of a way to finish the job.


How to download the Messageboard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to download the Messageboard
PDA

View Full Version : How to download the Messageboard

JMI
11-23-2001, 03:35 PM
Perhaps this is a subject that belongs in the "Off Topic" section but since it involves a "tool" I thought I'd try my question here. I've been attempting to download a browseable copy of the board for several days using Teleport Pro and have run into a problem that I can't solve even after I rtfm, or the help file in this case.

The problem is that the vBulletin program contains thousands and thousands of files and I am having trouble getting it to restrict its downloading to those that are relevant. If I understand the program, those seem to be the "showthread", "printthread", "forumdisplay", and "index" files which would give me the listing for the various forums, the threads in vBulletin format and the text printable form of the thread. The problem is that Teleport does not seem to like my attempts to limit the thousands of files of types: member; newpost; calendar; usercp; editpost; register; sendtofriend; announcement; privatemessage; etc. most of which are not accessable except at the adminstrative level and of no use to me anyway for purposes of having the actual threads to review offline.

Another problem is that after downloading 5-8 thousand files Teleport seems to stop saving the files to disk and I find nothing limiting the number of files it can save after the program is registered.

If anyone can help me with Teleport or tell me how to download the threads from this board or suggest another download program that they believe works more effectively than Teleport Pro, I would appreciate the advise.


w32dasm help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > w32dasm help
PDA

View Full Version : w32dasm help

trojan
11-23-2001, 04:03 PM
I am new to cracking but I understand the basics of assembly language, and
know how to use "w32dasm disaasembler" and the hex editor "hiew"

In the examples of the "w32dasm" disasseembles below, I show to examples of
the "jmp" instructions. Some of them I am able to enterpret like:

:0040117F 7504 jne 00401185 --- I can change this jmp by
changing the "75" in Hiew
:00401183 EB03 jmp 00401188 --- I can change this jmp
by changing the "EB" in Hiew

If i change the 75 to a 74 in the "jne" instruction it will change it to a
"je". And with the "jmp" I can change the "EB" to another jump instruction
if needed.

There are however some jump instructions that do not look familar to me and
I have be unable to change them. They appear as a regular "jmp" instruction,
but the hex is not familar to me and I do not know how to change it. Here is
an example of what I am talking about:

:00401C95 E99C6F0000 Jmp 00408C36 --- I do not know how to change these jmp's
:00401CA5 E916000000 jmp 00401CC0 --- I do not know how to change these jmp's

As you can see it interprets E99C6F0000 and E916000000 as "jmp" instructions, but the hex doesn't appear as a "jmp" instruction which should be "EB" like in the other example.

Are these special "jmp" instructions or are they misinterpreted by w32dasm?
Can anyone tell me how to change these? Everytime I try to change them I end up screwing the exe up.

Here is a more complete view of coding examples that I have used above:
----------------------------------------------------------------------------
--------------------------------------------------------------------
:00401178 8B442414 mov eax, dword ptr [esp+14]
:0040117C 85C0 test eax, eax
:0040117E 57 push edi
:0040117F 7504 jne 00401185 --- I can change this jmp by changing the "75" in Hiew
:00401181 33FF xor edi, edi
:00401183 EB03 jmp 00401188 --- I can change this jmp by changing the "EB" in Hiew

----------------------------------------------------------------------------
--------------------------------------------------------------------

:00401C95 E99C6F0000 Jmp 00408C36 --- I do not know how to change these jmp's
:00401C9A 90 nop
:00401C9B 90 nop
:00401C9C 90 nop
:00401C9D 90 nop
:00401C9E 90 nop
:00401C9F 90 nop
:00401CA0 E80B000000 call 00401CB0
:00401CA5 E916000000 jmp 00401CC0 --- I do not know how to change these jmp's
----------------------------------------------------------------------------
--------------------------------------------------------------------
DakienDX
11-23-2001, 04:21 PM
Hello trojan !

There are 'short' and 'near' jumps (JMP) and jump-if-condition (JIC). The 7xh (JIC) and EBh (JMP) are 'short' ones. They can jump from the end of the current instruction (EIP+2) from -128 to +127 bytes further.

The 'near' JMPs have the opcode E9h. They jump from EIP+5 from -(2^32) to +(2^32-1) bytes further. For this we need the form E9h, xxh, xxh, xxh, xxh.

The 'near' JICs have no one-byte-equivalent, but they have a two byte opcode. It is 0Fh, 8xh, xxh, xxh, xxh, xxh. You must replace the 7xh with the 8xh opcode to get the same kind of JIC.

When you try to change a 'near' JIC to a 'near' JMP, you'll need only five bytes instead of six for the instruction, so the last byte of the JIC will be added to the next instruction. You can change the last byte of a JIC to 90h (NOP) when patching it to a JMP.

Changing 'near' JMP to 'near' JIC is not possible, since a JMP is five bytes long and a JIC needs six bytes.
trojan
11-23-2001, 06:35 PM
Finally --- Thanks for clearing that up.

I can now move on --- whew :D
JMI
11-23-2001, 08:20 PM
Hello trojan!

I don't know if you want to get this far into the code at this point, but there is one other thing that might be helpful in looking at assembly code that provides both additional information and an alternative method of changing certain jump instructions without nopping them out or changing the op code. I'll try to explain using two of the examples from your original question.

Looking at :00401C95 E99C6F0000 Jmp 00408C36 you will know that because of the E9 it is a "near" jump as DaikenDX stated in his reply. But you also know from the bytes which follow the E9 how far the jump will be. The way this is calculated is as follows:

:00401C95 to the end of the instruction is 5 bytes, so

:00401C95 + 5 = :00401C9A

To this address you add the next four bytes to find the next instruction, but you add the bytes in "reverse" order. 6F9C, not 9C6F

:00401C9A + 6F9C = :00408C36

Like wise,

:00401CA5 E916000000 Jmp 00401CC0 can be understood as

:00401CA5 + 5 (length of instructions bytes) = :00401CAA

:00401CAA + 0016 (not 1600) = :00401CC0

What this gives you is another possibility of "moving" the result of the instruction without changing the E9 operand. You might simply add (in reverse order) more to the Jmp instruction to have it jump to a different instruction, say for example skipping a subroutine you don't want called. Just a possibility.

Understanding this method of calculating where the jumps go, and why, will help you to understand the concept of the call relocation table and how you can determine it from the dead listing produced by the disassembler. There was a good article on this method of viewing the dead listing for cracking without a debugger, which I'll find and list in a following reply for those who might find it useful.

If you already knew this, no offense intended and it might be helpful for others.

p.s.
The article is entitled The "call relocation table and its importance" by reverser+. It's in the essay database and can be found at http://www.woodmann.net/fravia/frarul1.htm.
trojan
11-24-2001, 09:40 AM
I had no prior knowledge of that.....Very interesting information and very helpful. Thanks for your reply.

I once had a sniplett of code that was supposed to mean somthing to me, but at the time I did not know what it did. From time to time I would look at it and try to comprehend its functionality. After gathering much more knowledge of programming I decided to try it again, and was finally able to do something with it.

Every little bit helps...even if it doesn't help you in the beginning.

Thanks


SI + w2k + mouse
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI + w2k + mouse
PDA

View Full Version : SI + w2k + mouse

Ali
11-23-2001, 08:33 PM
Hi,

my setup is softice v4.05 + w2k 5.00.2195

i installed softice and things are not going to bad

nevertheless, the mouse has a particular comportment :
when i move it (physically) the cursor don't move and
menus are lighting on in a special fashion...
(the mouse isn't one of those intelligent ms mouse... :-)

setting are :
Mouse setup : PS/2 Compatible
Display Adapter Setup : Standard VGA and Universal Video Driver
Starting mode : System

My video card is an ATI Radeon SDR

If anybody has an idea...

Many thanks for any help |:->
Anticode
11-26-2001, 05:15 AM
did you select the right mouse in the mouse confuguration?
if yes, it seems that your mouse isnt compatable with softice
I would have replace the mouse with m$/logitech wheel mouse


How can I reverse the Java Class File into its orginal source code?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How can I reverse the Java Class File into its orginal source code?
PDA

View Full Version : How can I reverse the Java Class File into its orginal source code?

Alawi
11-24-2001, 02:14 AM
I have the binary version of a project containing Java Class Files, Applets and Jars and I want to reverse all this files to its orginal source code in order to be apple to develope this code. is that possible? How can I do that? which tools?
Solomon
11-24-2001, 05:06 AM
There are many Java decompilers/disassemblers such as JAD, DeCafe, NMI's Java decompiler, IDA etc. Most of them really work.
Just do a google search, you will find them. *.JAR can be decompressed with WinRAR.
And you can find some java reversing essays from http://www.woodmann.net/fravia/what_new.htm.

good luck.:)


Crackme #4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crackme #4
PDA

View Full Version : Crackme #4

javelin
11-24-2001, 02:37 AM
Object Find the valid serial
Hoof Arted
11-24-2001, 05:43 AM
Crackme crashes on "OK" click under WinXP.

Hoof
ThrawN
11-24-2001, 08:26 AM
Nor win98se and Win2k
Just crashes :(
javelin
11-25-2001, 04:34 PM
Hoof Arted & ThrawN i think i got the error fixed

try this one


NE1 :: Got a local copy of CrackZ site b4 it went down????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > NE1 :: Got a local copy of CrackZ site b4 it went down????
PDA

View Full Version : NE1 :: Got a local copy of CrackZ site b4 it went down????

gadget
11-24-2001, 06:38 AM
I am such an assh0le!!! For months I was 'going to dload that site...'

Is there ne 1 that could throw me a ziped copy of the site, or is ne 1 unofficially mirroring it????

At least immortal descendants gave uz a zipped copy!!!

TIA

gad^get
gadget@hotmail.com
HypnoticZ/TNT
11-24-2001, 11:48 AM
Yes me to please if anyone has a copy of crackz site i need it to
i lost my own :(

regardz HypnoticZ :)
JMI
11-24-2001, 02:50 PM
As I stated in my 11-20-01 post on the "General" board, I downloaded CrackZ' site two days before he closed it. I also stated that I didn't want to become a central clearing house of his files, but I have e-mailed certain files to members requesting location of specific files. The entire data base is approx. 213 KB, not really very large and I have it in a Teleport Pro down load, which means that it is offline browseable, as if it was his original site.

I've never actually attempted to zip or winrar compress a file or an entire directory before but have both programs on my disk. Usually I'm only uncompressing someone else's files. I'll give it a try.

I'm not sure if CrackZ would object to copies of his entire site being distributed by others. I believe that there still remains a complete copy of the site on Woodman's server, but I believe that CrackZ has requested that it not be made available through that source. If I don't hear anything from him, or Woodman, within a few days objecting to the distribution, I'll attempt to make it available in a zip file and maybe it can be uploaded to an ftp server somewhere for general distribution.

In the mean time, if there is a spefic file that you are looking for, I probably can send it by e-mail.
Woodmann
11-24-2001, 03:26 PM
Hi,
CrackZ request was to not have his entire site spread all over the internet.

I do believe that specific files would be ok for your own reference.

I'm sure that CrackZ will pop in and let you know his feelings, until then please dont spread his site.

Peace, Woodmann
JMI
11-24-2001, 05:50 PM
Since Woodman has been kind enough to host this site and keep all of us able to exchange information about reversing and such, I am more than happy to comply with his request. Unless CrackZ wishes to give his blessings to the concept, I will refrain from uploading or passing on copies of his entire site.

Since there appears to be no general objection to the sending of specific files from the site, I will continue to assist members with some specific requests, but I ask that anyone wanting a file that was on the site to do their own search for the file before taking the easiest route to make the request here. We don't learn anything about the art of searching if we don't try on our own and learning is what this Board is supposed to be about.

Again my thanks to Woodman for keeping this effort on the net.
tsehp
11-25-2001, 03:49 AM
When fravia told me :
I'm shutting my site down, please close your mirror.

I answered him : Your site is too useful, and its essays belongs to the people that finally made them. You will not be able to
shut down all the earth's mirrors so do I.

I was ok to remove his name from the entire mirror, just to let his new site be correctly refered by search engines.

This time, we face a dilemna. I was always involved to free knowledge, and my opinion is that his site should be available to download, with his name removed if he wants to do so.

But he personally ask us not to make it available. So until he gives us his word, we still can't support to host a zipped copy of his site available for all.
morlac
11-25-2001, 08:32 AM
Hi guys,

Excuse some rants coming your way.... ;)
There is something that I dont understand about this community or actually the community that I feel a belonging to.
I always thought this community promotes knowledge and free learning. But then comes those actions by different ppl who decide to shutdown their sites/pages and disallow anybody from 'giving' it out to ppl. <-not being specific at all
I can honestly say that I have NO right what so ever to complain about such an action. It his/her work after all.
My complaint or actually my idea is to create an archive. This archive can hold a zipped version of the site that got shutdown.
Ofcourse after the approval of the owner. We should promote/incourage ppl to make such a backup of their site.

Now, look at CrackZs page and fravias before. If it wasnt for tsehp, the majority of this community would have lost a valuable archive of knowledge. But what about CrackZ site???
Cant we at least publicly archive the information/essays that were contained on his site? Perhaps some xtra important files as well ;) ?

well, what do you think?

Morlac.
CrackZ
11-25-2001, 11:27 AM
Hiya,

Just 2 things I want to add to this thread.

1. The whole reason for closing my site to the public was precisely this - I don't want it public ever again. My site and this community is project I have finished with, a stage in my life that I am moving on from, regardless of all the free knowledge cries we have raging around here, that is my decision, my right, my <anything else you care to insert here> and I'd hope some of you would respect it.

2. In the last week of my site I encouraged all those who I knew would like it, to download it, hi JMI ;-), if you were not fortunate enough to do so then there are people on this msgboard happy to send you the files (of that I'm sure). If Tsehp/Woodmann wish to facilitate this, just indicate so here and I'll u/l a final archive of my site to you so that you might help anyone who did not snaffle themselves a copy, if the RCE CD project is still alive I'll donate the final archive there too.

I'm sure many of you can see contradictions in what I've posted with points 1 & 2 but I'm hoping you can see what I'm trying to achieve here from my personal perspective.

Regards

CrackZ.

NB - My e-mail remains open if anyone would like to e-mail me directly wrt obtaining a copy of my site (it has a few extra fixes actually, since I just can't stop tinkering with it ;-) ).
JMI
11-25-2001, 01:51 PM
I confess I'm more than a little confused by both Tsehp and CrackZ' responses (and honored to have such folks, and Woodmann and Morlac, responding to a thread I'm involved with).

Tsehp suggests that "Fravia's board" was closed and that he wanted to save the archives of those files, but they remain available from at least two other sites on the web, both with all the old materials and new submissions, but with a different focus. They still have almost the same front page as here. (They even contain the essays from Project 9 relating to cracking M$ targets that have been removed from this site (apparently) because of M$'s threats, so the point of saving the knowledge seems somewhat misplaced, although I understand the point that the new "Fravia" boards not being updated as "fravia", but as "Searchlore." And I'm sure that there are many now, like me, with more harddisk space than current skill, who are downloading full sites relating to these subjects for offline reading. (I actually have copies of both the "new" Fravia site and this one saved to disk and CD, and have been trying to download this board for more careful study of some of the threads. Damn vBulletin makes thousands of files, making that process much more difficult. )

I also agree that knowledge should be shared, but respect Crackz' desire that his "site" not become "Public", but am having trouble reconciling your points 1 & 2. Perhaps I might suggest a method that would permit both points to be accomplished, that being privacy of your "site", with distribution of your "knowledge and data."

Two things make the CrackZ site what it was (is). There is the "look and feel" of the site, with the web pages and the links to the various materials and comments contained from CrackZ. Second, there are the files and essays, many of which were contributed by others and were archived there. I have no idea whether the files on the various protections were all contributed by CrackZ or not, but most were not available anywhere else on the web.

It would be a relatively simply thing not to distribute CrackZ' "web pages, comments and links" and thus maintain his request for the end of the "site's" public life (although it remains in the "public domain" with those of us who followed his advise to download "all" of it just before he closed it.) Removal of the "linked" Index file, for example, or substituting the last one without the links, and his other "pages" would remove the "look and feel."

But, while maintaining CrackZ' wish that his "site" not be "public", it would still be relatively easy to "distribute", or make available, the essays and files themselves, without CrackZ' web pages and links. In other words, a "zipped" file could be made of the raw materials (with a message, if it is his wish, that stated that the files were "contributed to the reversing community by CrackZ", since the contribution deserves such credit).

As to my personal choice, I'd encourage CrackZ to give his permission for the distribution of at least those files and essays as a group. I'm not sure exactly where you stand from your response, and perhaps it reflects that you haven't reached a final decision on that aspect yet.

It does appear that you do not object to our sharing some "individual" files with members who might request them. If I've gotten this wrong, please advise and I'll refrain from that as well, until we hear from you further.

CrackZ, I would appreciate receiving any additional files you have that were not on the site when it closed. Most of your materials are beyond my current level, but I'm attempting to educate myself to a point where I can attempt some of the reversing addressed by you materials. I'll e-mail you with my address, if you are so inclined. Again thanks for your efforts.
gadget
11-25-2001, 02:14 PM
Yes, I know that not making a local copy is to my disadvantage, but there wasnt really any warning that this was going to happen...so in the spirit of spreading knowledge CrackZ I would be really greatful to you if you could share a copy with me...thats all I was after...public or private site...there have been too many knowledge casualties in this comunity over the last two or so years...you know the sites that have gone...who's sites next...??? At least I still have a few *secure* VX knowledge sites to refer to.

Enough rambling, I'll send you (CrackZ) an email, and hope that you can help?

gad^get
gadget@hotmail.com

PS the acad2002 files that you put up a month or two ago were a life saver, big thanks man!!! Now that's something I really did need ;=)
morlac
11-25-2001, 02:19 PM
One thing that I forgot to mention in my previous post.
Its a problem for me and I think for others as well with a limited connection to the net.
Im on 56K modem. The connection is quite expensive for a jobless person like me. Around 30$ a month and not to mention that I have to pay for using the phone line.
For me this means grabbing as much info and then going offline to study the material at my pleasure.
Then I hear about the RCE CD project, I get excited and happy.
Finally, an archive that any reverse eng. would be proud to have.
I must admit that I heard about the RCE project from this thread.
And I support the project. If there is anything that I can do to help. Just let me know and Ill do the best I can.

CrackZ, I know that you were addressing the general ppl in your post, but I would like to say the following:
Yes its your project and your life. And I completely support/respect your desecion. Its something I went through and completly understand.
Im not trying to 'suck' to someone here. Im just being honest.
But please, JMI makes a good proposition in my opinion.

my 2cents.

Morlac. :)
CrackZ
11-25-2001, 04:46 PM
Hiya gentlemen,

I'll work something out in the next week or so, right now I have some final fixes I want to do and then theres the upload speeds ;-) (or lack of). Anyhow, all that have contributed on this thread I will contact in due course.

Regards and thanks.

CrackZ.
HypnoticZ/TNT
11-26-2001, 05:34 AM
Heya guys :)
I read carrefully the thread's from all here and i want to say
i respect the crackz work those years but i think crackz made a big mistake here, the mistake is to close the site coz is a full from usefull informations about wannabes,reverse engineers and protectionist's. At least one mirror of crackz site deserve to be open as fravia's mirror :)

regardz to all here HypnoticZ :)
nofurs
11-26-2001, 12:27 PM
Originally posted by HypnoticZ/TNT
Heya guys :)
I read carrefully the thread's from all here and i want to say
i respect the crackz work those years but i think crackz made a big mistake here, the mistake is to close the site coz is a full from usefull informations about wannabes,reverse engineers and protectionist's. At least one mirror of crackz site deserve to be open as fravia's mirror :)

regardz to all here HypnoticZ :)

Heya HypnoticZ,

Respects his wished my friend.

Anyway CrackZ could you mail me a copy too
my email is cluesurf@yahoo.com

Just a Review:
Hi CrackZ,
Please ignore my previous mail I send ya ;PPPP
coz I lost the copy of your site :( :( :(
Thanks and best regards

cluesurf
Syrus
11-27-2001, 02:24 PM
Hi Guys,
Yo Crackz
I would love to also have one copy of your great site i just missed it last days :(

- thx
GMouser
11-27-2001, 06:42 PM
I'd also like a copy of his www page, for prosperity of course.
MTB
11-27-2001, 07:49 PM
Yes I to would like a copy, even though I have a good portion of the newer stuff, I never bothered with the older stuff which I now regret never downloading.

So what other good reversing sites are out there?

Yes I did look at the links at the bottom of the Bulletin Board, except for the "old fravia's site", they are little lacking compared to Crackz's old site.

Thanks
MTB;)
Woodmann
11-27-2001, 08:27 PM
Hi,

Can we let this rest for a while.
We are working on some alternatives. Please be patient
until we find a solution to this.

Thanks, Woodmann
tsehp
11-29-2001, 01:03 PM
As crackz requested me, I had to lock this thread.

All I can give as info is that we will surely publish a zipped version according to crackz and woodmann, just to be sure that it conforms now to what we promised to our isp.

Please be patient.

tsehp


hard1ock envelope without dong1e?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > hard1ock envelope without dong1e?
PDA

View Full Version : hard1ock envelope without dong1e?

swissknife
11-24-2001, 07:14 AM
I'm looking at a prog protected with
hard1ock envelope and i don't own the
dongle.

Before starting an attack i'd like
to know if hl envelope can be broken
without the original key

TIA
swissknife
DakienDX
11-24-2001, 10:11 AM
Hello swissknife !

A HL-Crypt (Hardlock envelope) protected program cannot be deprotected without the original dongle.

Each Dongle has it's unique encryption paramters and the algorithm (if there is one) is unknown.
MeteO
12-08-2001, 08:53 PM
HL-Code function was already discovered(like HASP_SEED code), but you need to dump 8Kb of some HL-queries. Do no ask me to spread original sequencies to recover HL-code. It's possible to dump HL-protectedprogram without dongle.
DakienDX
12-09-2001, 06:23 AM
Interesting, never heard of it before.

According to Aladdin the encryption is different in every dongle, not only the keys. Do you know how it works but don't want to publish it or have you only read it somewhere? It could be false report like "I can crack PGP in eight hours". If you don't want to talk over it in public, you can send me an email. (or a private message if you like to) I would be interested since I use Hardlocks sometimes for my own.
MeteO
12-16-2001, 09:03 PM
HL_code was cracked at 1996 by guys at www.safe-key.com, they sell their software emulator. At Russia HL_code was discovered by kab, some months later by guys at //UCL.

But for succesfully emulating hardlock dongle you need to dump 8K of dongle data.
DakienDX
12-17-2001, 11:38 AM
Hello MeteO !

I know the www.safe-key.com homepage. I have their Hardlock dumper and used it also on some of my dongles. They offered to send an evaluation version of their emulator to people who send them Dongle dumps. I sent them one of my dumps, but then their site went down and I never heard from them again. So if you can tell me where I could get the emulator now (I'm asking for the eval version, so this is no crack/warez request :( ), I could do some more research.

But this does not change the problem. If you don't have the Hardlock, you can't dump it and therefor you can't unpack it, unless Aladdin uses a weak algorithm or weak keys. (what I don't expect)
UrgeOverKill
12-17-2001, 04:13 PM
Question, when emulating a dongle I know there are others out there that use ISA slots, but can emulation be done with PCI's ??

Being that ISA's are quickly becoming a thing of the past, I would think that cracking the progie would be the matter of choice.

I have a few emulating programs but they require the ISA slots, can they be converted toward using the PCI's ??
scooterk
12-18-2001, 12:48 AM
Hi,
I was wondering where to look for a possible schematic to construct a dongle. I happened to see a project once in a book on the AVR microcontroller, but very little info on the web.
scooterk
mueller5321
12-18-2001, 04:19 AM
Just for information.
The hardlock dongle have multiple security features.

First with your customer number from aladdin a signature is
written inside a special programming hardware.
(Programminghardware ISA or PCI card).
It is also possible to fetch a different signature from a so called masterdongle.
With this signature and a number which you have to insert during prgramming. The basis dongles ar crypted.
You can only reach them after this on your parallelport via the burned moduladress.
So you can check if a dongle is available or not by a simple check
with HL_LOGIN with your specific moduladress
(Customer.Nr -> Signature; Signature + Module offset -> Module Adress of the Dongle;Signature+??+Sub Module offset burned in Dongle -> Cypherparameter)

Additional the the offest moduladress, which you insert during programming you can insert a second value the submodule adresse. Together which the crypt algorithm is defined.

But intresting to now is, that this crypto algorithm is blockbased on a specific value. So if the algorithm is known it seams to be not the big deal to get the correct values for the not known parameter. The Module offset can only be 0 - 31!!
The submodule offset only 0-about 30000.
Brute force is possible without a problem.
The first value you must know is the moduleaddress.
But this is easy to get. just look to the call of the HL_LOGIN function. The value is on the stack:-)
Together with the evaluation version (no costs) it should be possible to get some additional algoritm but the main algorithm
for the cypher is only inside the dongle.
Is it somewhere available???
But also there is a possible solution.
The cypher is blockbased (8-Byte or 64 bit)
Only the first 8 bytes are different the following blocks of 8 Bytes are equal.
So it seams to me, if the envelope use no additional cypher,it should be possible to crack with a simple cleartext attack.
Ok i know we have not the original dongle but some parts of code hold more than 16 x 00. so if you get a sequence which is repeated you can get the the dongle result .
And also additional information. The algoritm is symmetric :-):D
MTB
12-18-2001, 06:55 PM
Originally posted by scooterk

I was wondering where to look for a possible schematic to construct a dongle. I happened to see a project once in a book on the AVR microcontroller, but very little info on the web.

[/B]
Scooterk

I have an interesting document that has a schematic and description of how a sentinnel dongle works. Rnboi2c.zip is the file name. If you can't find it on the web send me a message. There is also somebody on this BB that has a project started to emulate a dongle in hardware.

MTB
scooterk
12-18-2001, 11:09 PM
Hi MTB,
I appreciate your response and would like to discuss this futher.
Email me ...
scooterk
scooterk88@hotmail.cxm
cah
12-19-2001, 10:50 AM
Hayya, Mr. SCOOTERK,

I tried the rnboi2c.zip by google, no result. Please mail me if you have this.

Do you have stuff to duplicate hasps?

thanks in advance

cah...
scooterk
12-20-2001, 08:53 AM
I myself was looking for some help on this.. waiting for MTB to contact me, so far no response...
scooterk
cah
12-20-2001, 09:46 AM
Hayya, Mr. SCOOTERK

I checked my database & I down loaded this file from Mr. Crackz's site long ago.

Please ckeck your mail. I cont upload here, it exceeded file size to max upload size.

cah...
scooterk
12-21-2001, 12:22 PM
Hi cah,
I don't have your email but if would like to try to email me the file
that would be great.( I don't know how large it is)
scooterk
scooterk88@hotmail.com

Thanks cah :) CYM.. scooterk
ramin_rad2000
03-19-2004, 05:13 AM
So guys if hardlock shell can't be defeated,why anyone should use hl_api?!! :confused:
nikita@work
03-26-2004, 05:26 PM
So guys if hardlock shell can't be defeated,why anyone should use hl_api?!! :confused:

always there is some way ;)
envelope can be stripped without original donlge...
sope
03-27-2004, 05:09 AM
Hello nikita@workenvelope can be stripped without original donlge...
Just curious to ask, r u planning to share info of unpacking hardlock envelope without dongle OR its still private stuff ?

Regards, Sope.
nikita@work
03-27-2004, 12:44 PM
Hello nikita@work
Just curious to ask, r u planning to share info of unpacking hardlock envelope without dongle OR its still private stuff ?

Regards, Sope.

private, but if you have envelope version that i don't... it will be interesting for me to support it ;)
ramin_rad2000
03-30-2004, 05:09 AM
private, but if you have envelope version that i don't... it will be interesting for me to support it ;)
So which version do you need?we are using hardlock since 2 years now,may be i can find something ;)
nikita@work
03-30-2004, 12:16 PM
So which version do you need?we are using hardlock since 2 years now,may be i can find something ;)

there is no any build history, but i think because hl is no longer supported there was a few version in last two years... and i have all of them...

but i'd like to see version list you have ;)


REQ:Help with Dongle cracking....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > REQ:Help with Dongle cracking....
PDA

View Full Version : REQ:Help with Dongle cracking....

grumster
11-24-2001, 07:29 AM
Hi all - first time here :D

We have a beta version of a package on the comp @ work that uses a dongle - I would like to have the app at home to work with. Is it possible to bypass the dongle checking part of the app so I can do this?

I have no idea whatsoever about this sort of thing :D
Any help or info would be great.

Thanks for your time.
DakienDX
11-24-2001, 10:20 AM
Hello grumster !

You must tell us which Dongle was used on the program and how it was used.

The name of the Dongle would be helpful, if you don't know, describe how it is looking. (color, size, logos, serials, ...)

Try also to check if the program is protected by a wrapper or by API calls. If API calls are used, do they encrypt/decrypt some data?
grumster
11-25-2001, 01:39 PM
Hi DakienDX - thanks for the reply.

Ok - The dongle is dark blue in colour with a little window on one side (looks like an eprom inside) - plugs into serial port. I think it may be called Hardlock - I have the driver installation files if they are any use. The readme contains this :

HLDRV32.EXE Hardlock Installation 32bit
(Windows 95/98, NT4/2000)

I have no idea how to check how the program is protected.

Hope this helps and thanks for your time :)

regards

grumster
DakienDX
11-25-2001, 02:26 PM
Hello grumster !

Please look at the protected .EXE if it has a '.protect' section? (string in the first 1000h bytes normally)

Look at the code section (normally '.code' or 'CODE'). Is it encrypted (many different characters) or unencrypted (some patterns might repeat, there are many (10%-20%) hexadecimal 00h in the code). There is usually code at 1000h in the .EXE.

What and how does it say when the Dongle is not found? (Command line/MessageBox/Dialog, Title/Text)
grumster
11-25-2001, 08:04 PM
Ok

First of all I have no idea how to "..look at the protected .exe" as you suggested - sorry, total newbie here.

When the hardlock is not found - pops up error box with message:
Hardlock API error code 19. >OK

I can up the .exe if you would like to look at it .

Thanks again for your time - much appreciated.

:cool:
DakienDX
11-26-2001, 12:06 PM
Hello grumster !

When you execute a program protected by HL-Crypt, a box pops up with the title "Hardlock Protection System" and the error message "Error 7 : Hardlock not found." or "Error 1009 : Cannot open Hardlock driver."

So the program should be protected by the object method using APIs. This could mean that it's possible to run the program without the dongle, after some patching of course (if the program doesn't use the encryption via the API).

BTW. Do you know any ASM or how to work with a hex-editor?
grumster
11-26-2001, 09:02 PM
Ok thanks - I checked again and the error box is definately how I described.

"Do you know any ASM or how to work with a hex-editor?"

erm... ASM - sorry , no idea what that is. HEX editor? - the last time I used a hex editor was on my Sinclair Spectrum (48k mem and rubber keyboard ) back in the 80's *grin*.
I guess hex is still hex though - I think I still remember the principles.

g
DakienDX
11-27-2001, 01:42 AM
Hello grumster !

If you don't know any ASM, you've found the wrong place here. Under this aspect, it looks like a "Can somebody crack me the Dongle" request, which isn't allowed here. (FAQ (http://www.woodmann.net/fravia/rce-faq.htm)) You should start learning some programming language, then switching to ASM, read many tutorials and after that perhaps come back here and explain where you're stuck and what problems you have.
grumster
11-27-2001, 10:16 AM
No DakienDX - this is definately NOT a crack the Dongle for me request at all. I posted a request for help on another board and was sent a link to here. All I need is some help - I stated quite clearly that I am a total newbie. I have no Idea where to start which is why I posted in this forum.

Maybe I should come back to the newbies forum when I've had more experience.

Thanks for your time anyway.
DakienDX
11-27-2001, 11:44 AM
Hello grumster !

The problem here is the following: To 'crack' one target you need to replace some instructions in an very easy case. If you don't know any ASM, which is the programming language you do everything in when you're cracking something, you won't be able to follow help from this board. You should know at least how the windows API works and what the more simple ASM instructions do, and, when we're talking about Dongles, what a Port is and what it has to do with a Dongle. Sorry, but this is a fact and no punishment.


How to create a patcher and..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to create a patcher and..
PDA

View Full Version : How to create a patcher and..

RevoQer
11-24-2001, 11:08 AM
hi folks
i've found a getvolume blablabla API which returns on my pc WIN98SE whats that? And how can i create a Patcher(only hex-cange)
4oh4
11-24-2001, 12:14 PM
I'm assuming that you're talking about the GetVolumeInformation api. If you consult the win32 api help file or the msdn library you'll get a solid description of that function.

.....as for the "And how can i create a Patcher(only hex-cange)" question..... Do you just want generic info, or is this related to the GetVolumeInformation question? Do you want to patch kernel32.dll?
RevoQer
11-25-2001, 01:24 PM
thanks for your help
plz excuse my post, perhaps i was drunken
I have found a patch engine that works with hex value replaces
and creates a stand alone com. i knw how to prog that, my question was too stupid,
but tnx and sry
4oh4
11-25-2001, 11:32 PM
That's alright. Who hasn't made a drunken post from time to time. :)

I was actually a bit surprised since I'm working on something with kernel32.dll as well, and the same function as well. I was more surprised than anything at all.


Some pointers reagrding disabled features please...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Some pointers reagrding disabled features please...
PDA

View Full Version : Some pointers reagrding disabled features please...

SuperCali
11-24-2001, 11:40 AM
Hello,
Been looking at a new target but have gotten stuck again. I have disabled the annoying nag, and the expiration thingy yet I can't seem to enable some disabled options, never done that before and don't know what to look for or how to do it. I don't know if the options are even compiled into the demo at all, not that they matter anyhow but it's good reversing practice! Also I can't get the license agreement to disappear, it's probably not hard but I cannot find it :(... I have no debugger except wdasm at the moment so all has been done with dead listings so far. Otherwise the target was rather simple, if anyone wants to have a lok at it:

WinTar SCSI 2.30 (about 900Kb)

Thankful for any help!

// SuperCali
TheBlock
11-27-2001, 01:42 PM
I would recommend you to download Softice, it will help you so much.
Putting a bpx on EnableMenuItem you will find the way to enable the disabled menu items. Once enabled you can continue tracing to see if the functions are compiled with the demo program or if they have been removed. Another way to enable disabled options is to check directly to the Resource section, using Exescope or Borland Resource workshop will let you change the resource of the program graphically so it will be much easier.

TheBlock


api hooking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > api hooking
PDA

View Full Version : api hooking

4oh4
11-24-2001, 04:12 PM
The target makes a call to a function in kernel32.dll. How should I go about altering the output from that function? I recall some essays on fravia's site that dealt with renaming the system dll and then replacing it with another one which either passed control to the original dll or handled the stuff itself, acting as a sort of api filter. Elicz did some work on api hooks as well, but admittedly a bit more than what I'm looking for.

It's not a big deal, just something that I thought would be a good learning experience.

I don't think process patching will work here because the target makes this call at various unset times. It seems a bit much to take the replace-the-system-dll-with-another-one route. Is there a method that's somewhere inbetween (complexity-wise)?

...just a thought, but is there a way to "lock" memory access in such a way that I could patch the variable (used in the api call) in memory once and it wouldn't get altered by subsequent calls to the same api function?
4oh4
11-24-2001, 09:28 PM
Well, I've searched back through fravia's site and read and reread Lone Runner's essay (http://www.woodmann.net/fravia/fragas1.htm). That technique seems to be the best I guess. The only thing (so far) that I'm unsure of is how exactly he deals with the undocumented functions. There are 122 (I think it was) of them in kernel32.dll.

If anyone's worked through this before, I'd appreciate any help I could get. :confused:
Fake51
11-24-2001, 10:35 PM
When I cracked the older versions of vbox, I patched the kernel to look for a specific pattern, more or less only emitted by vbox (actually it was only emitted by vbox, as it was the name of one of the vbox dll's). All it took was patching the first five bytes of the api to a far jump to whatever part of memory was usable (enuff of that in kernel32.dll), then do a short check to see if the right procedure had called, and then jump back. Doing so is not noticeable in speed, since windows sux anyways (and since u know what u're doing and u don't try to take over the cpu for hours at a time). For this I used a vxd. Worked perfectly.

Fake
Kayaker
11-24-2001, 11:44 PM
Hi 4oh4,

Just an idea, what about creating a loader which injects your dll into the address space of the target. Then you should be able to patch the IAT jump table for that particular API to call your dll function instead of the API. Your dll then calls the API but deals with the return value before passing that back to the original call.

For a good loader/ dll injection implementation take a look at Iczelion's IczDump, your dll is a black box at this point. Once loaded you'd have to find the IAT jump table entry. If this is a one-off target you could probably just find it in memory and patch it with the address of your dll's function. If you want a more generic API-hooking technique you'd have to walk the import directory to find the jump table address for your API(s).

You've probably seen the articles at h**p://www.internals.com/articles_main.htm as well as the APISpy32 site, Good info here. MS has published its own Detours API hooking source, though I never digested that one. Check out how Harlequin handled patching Kernel32 to intercept the TerminateProcess call in his recent essay as well. Though I think he had problems with determining the ProcessId of the calling process. Inject your dll and you have complete control over the address space of the target program ;)

Just out of curiousity what API are you trying to intercept?

Kayaker
garph0
11-25-2001, 06:31 AM
for the injecting parte there is also a good work of yoda called forcelibrary. a quick search should give you some link :)
for the hooking part s0rr0w made a tool: you can find it at
http://francesco.netsigners.com/
there there is also an old version of my injector sw (i think sorrow named it GIT or something like that), but probably Yoda's one is more effective :)
afaik for the undocumented functions there should be no problem, but you need to know the signature (parameters) and what each parameters mean.
hope this helps

work well

g
4oh4
11-25-2001, 12:57 PM
Well I typed a long post and apparently my cookie timed out or something cause it was all lost. -dammit-

Anyways, I'll make this post much more brief to avoid anymore problems. :)

Fake51:
I read that (or maybe just a similar) essay on fravia's site. IMHO LoneRunner's method is more flexible though, since it doesn't have to be target specific. Also, I have very little experience dealing with vxds. While this is a learning exercise for me, I don't want to overwhelm myself. :)

Kayaker:
Since this is a one time reversing task I'm going to give your loader suggestion a shot. I ran across those essays you linked to in my search last night....all except the one from Harlequin. I wonder why the tut search engine didn't turn it up. I've read it before, but never actually tried his technique because I read a thread on this board I believe about a problem with his code. Btw, GetVolumeInformation is the api I'm after.

Anyways, just to make sure that I understand the theory here:

my loader has to:
1) load the target
2) wait for it to unpack itself (neolite 2.0 w/ max compression)
3) locate the GetVolumeInfo entry in the IAT (either on-the-fly so to speak or from previous sice excursions)
4) patch that entry with my dll's function address

my dll's function has to:
1) call the original GetVolumeInfo api
2) alter the values returned by it to fit my needs
3) return the bogus info to the target

Is that right, or did I miss/forget something? If that's basically it, then the only thing I don't completely understand at this point is the IAT patching. The dll and loader coding won't be a problem.

I've got a pe.txt (by luvelmeyer or something like that). If I read and completely understand the description of the import directory and all the other import related topics will that be enough? ...or are there other essays that I'll need to read?

garph0:
I ran across forcelibary in last night's search. I'm sure befor I'm finished I will have searched through all the source examples that I've found on api hooking, but for now I'd like to code the loader myself. That way I'll learn more. ;) That link is dead though. I google'd for s0rr0w and found a msg board that was in french, but dealt with reversing and the like. There was a link to s0rr0w.net but it too is dead. I've never seen your program or GIT.

I've decided against LoneRunner's proxy dll method, but I'd like to try it sometime in the future. I still don't understand how he dealt with the undocumented functions though. How would I go about getting the parameters for the functions when all that I can get from dumbin's output is the ordinal numbers of the functions?

Thanks for all the help!

edit:
That wasn't so brief after all eh? ;)
JMI
11-25-2001, 02:16 PM
4oh4,

The article you were looking for is

http://www.woodmann.net/fravia/harlequin_Kernel32.htm

Another that might be of interest is

http://www.woodmann.net/fravia/pna3.htm

Its entitled "How to hook any API function in kernel32.dll
with simple exports of your own DLL " by pna and also from the essay database.

Good luck

P.S. I've located Hookit.zip in my archive if you need/want it. Let me know. I believe it is the one from the pna article. I also have the Fake.dll asm file and probably have the SrcGen.exe, but haven't quickly located it yet.
garph0
11-25-2001, 07:25 PM
hi 4oh4 :)
sorry, i didn't notice that sorrow site is down... i'll post a good link as soon as i'll have it.
should you need an hand i'll be glad to help you (if i'm able, of course ;) )

good work,

g
4oh4
11-28-2001, 09:29 PM
Thank JMI, I'd like to take a look at those files if you wouldn't mind up'ing them.

Thanks for the offer of help garph0. I appreciate it.

As a matter of fact I've got a couple of questions. ;)

The first is that my replacement function for GetVolumeInfo isn't working quite right. I pasted the masm source below. What this is supposed to do is (once the hook is established) when the target calls GetVolInfo this gets called instead. Then I call GetVolInfo, retrieve the volume serial and alter it, and finally return the altered volume serial to the target. Keep in mind that I'm only grabbing the volume serial and filling the dword with the address of the actual volume serial. I'm not altering it at all, and I'm not returning any other info at all to the target. The target in this case not being the actual target, but a little test program I wrote for the occasion. I hope that makes sense.

MyGetVolumeInformation proc lpRootPathName:DWORD,lpVolumeNameBuffer:DWORD,nVolumeNameSize:DWORD,
lpVolumeSerialNumber:DWORD,lpMaximumComponentLength:DWORD,
lpFileSystemFlags:DWORD,lpFileSystemNameBuffer:DWORD,
nFileSystemNameSize:DWORD
;just for completeness sake (even though I don't deal with
;them now I provided buffers for all the data
invoke GetVolumeInformation,addr szRoot,addr volBuff,30h,addr volSer,addr maxComp,\
addr sysFlags,addr sysName,30h
;mov offset of the volume serial into eax
mov eax,offset volSer
;mov that offset into the buffer passed to MyGetVolInfo
mov [lpVolumeSerialNumber],eax
;clear eax
xor eax,eax
;and mov 1 into it so that it doesn't return an error
;in case the target has error checking in place
mov eax,01h
ret
MyGetVolumeInformation endp

Now keep in mind again that all the fake function is doing at the moment is grabbing the volume serial only and filling the provided buffer with that serial. But it's not working on my little test app. Could someone who's better with asm coding than me tell me what the problem is. Of course it has to be the way that I'm taking the volume serial and moving it into the buffer, but I don't see the error.

The second question has to do with the actual IAT patching. Do I just use do something like this:

From my loader:
1) use LoadLibrary to load my dll
2) use GetModuleHandle and GetProcAddress to get the address of GetVolumeInformation (and MyGetVolumeInformation as well)
3) use WriteProcessMemory to replace the address of the original api with the address of mine

Is there more to it? (of course between steps 1 and 2 I'd have to use CreateProcess to launch the target)

Thanks for all the assistance. It's much appreciated.

edited to disable the smilies that were fucking up my code
JMI
11-29-2001, 01:13 AM
4oh4:

Here's a copy of HookIt. I'm not sure it's the one from the pna essay, but it should do the trick. I haven't found the Fake.dll file yet and I don't have the ScrGen.exe file. I recall that I didn't file this essay until long after it was written and don't believe I was able to contact pna to get his original. If I find Fake.dll on my HD I'll send it along later.

Hope the HookIt file helps.
Kayaker
11-29-2001, 02:40 AM
Originally posted by 4oh4

edited to disable the smilies that were fucking up my code

Don't you hate those :DWORD smiley faces? :D

Hooking the API aside for the moment, you'd have to take into account the target program may be expecting more than just the VolumeSerialNumber returned it what it *thought* was its own call to GetVolumeInformation. So you fake your own call to fill the buffers the targets API call has already set up, referenced to the stack, and change the one you want.

This code works as an include module under a button or something. Every parameter is included, though your target may actually use NULL for some of them. DupeTarget proc is supposed to be how your patched target behaves, it pushes exactly the same things, but calls your dll function instead.

;================================================
DupeTarget proto
MyGetVolumeInformation proto : DWORD, : DWORD, : DWORD, : DWORD, : DWORD, : DWORD, : DWORD, : DWORD

.DATA

lpRootPathName db "C:\",0
lpVolumeNameBuffer dd 48 dup(?)
nVolumeNameSize DWORD (48)
lpVolumeSerialNumber DWORD ?
lpMaximumComponentLength DWORD ?
lpFileSystemFlags DWORD ?
lpFileSystemNameBuffer dd 48 dup(?)
nFileSystemNameSize DWORD (48)

.CODE

DupeTarget proc
invoke MyGetVolumeInformation, ADDR lpRootPathName, ADDR lpVolumeNameBuffer,\
nVolumeNameSize, ADDR lpVolumeSerialNumber,\
ADDR lpMaximumComponentLength, ADDR lpFileSystemFlags,\
ADDR lpFileSystemNameBuffer, nFileSystemNameSize
ret
DupeTarget endp

MyGetVolumeInformation proc Lprootpathname : Dword, Lpvolumenamebuffer : Dword,\
Nvolumenamesize : Dword, Lpvolumeserialnumber : Dword,\
Lpmaximumcomponentlength : Dword, Lpfilesystemflags : Dword,\
Lpfilesystemnamebuffer : Dword, Nfilesystemnamesize : Dword

invoke GetVolumeInformation, Lprootpathname, Lpvolumenamebuffer,\
Nvolumenamesize, Lpvolumeserialnumber,\
Lpmaximumcomponentlength, Lpfilesystemflags,\
Lpfilesystemnamebuffer, Nfilesystemnamesize

.if (eax)
PUSH eax ; save return value in case program uses GetLastError

push [ebp+14h]
pop eax ; push/pop frame pointer to 4th parameter into eax
mov eax, [eax] ; returned lpVolumeSerialNumber value
xor eax, 0A881A6DEh ; this creates DEADBEEF on my system ;-)

lea ebx, [ebp+14h] ; pointer to the lpVolumeSerialNumber pointer
mov ebx, [ebx] ; lpVolumeSerialNumber pointer
mov dword ptr [ebx], eax ; mov modified value into lpVolumeSerialNumber address

POP eax ; restore true return value
.endif
ret
MyGetVolumeInformation endp
;===============================================

Disassembly:

DupeTarget proc
0167:10001000 FF35CD4A0010 PUSH DWORD PTR [10004ACD]
0167:10001006 680D4A0010 PUSH 10004A0D
0167:1000100B 68094A0010 PUSH 10004A09
0167:10001010 68054A0010 PUSH 10004A05
0167:10001015 68014A0010 PUSH 10004A01 ; ADDR lpVolumeSerialNumber
0167:1000101A FF35FD490010 PUSH DWORD PTR [100049FD]
0167:10001020 683D490010 PUSH 1000493D
0167:10001025 6839490010 PUSH 10004939
0167:1000102A E801000000 CALL 10001030
0167:1000102F C3 RET

MyGetVolumeInformation proc
0167:10001030 55 PUSH EBP
0167:10001031 8BEC MOV EBP,ESP
0167:10001033 FF7524 PUSH DWORD PTR [EBP+24]
0167:10001036 FF7520 PUSH DWORD PTR [EBP+20]
0167:10001039 FF751C PUSH DWORD PTR [EBP+1C]
0167:1000103C FF7518 PUSH DWORD PTR [EBP+18]
0167:1000103F FF7514 PUSH DWORD PTR [EBP+14] ; Lpvolumeserialnumber
0167:10001042 FF7510 PUSH DWORD PTR [EBP+10]
0167:10001045 FF750C PUSH DWORD PTR [EBP+0C]
0167:10001048 FF7508 PUSH DWORD PTR [EBP+08]
0167:1000104B E8721A0000 CALL KERNEL32!GetVolumeInformationA
0167:10001050 0BC0 OR EAX,EAX
0167:10001052 7414 JZ 10001068

0167:10001054 50 PUSH EAX
0167:10001055 FF7514 PUSH DWORD PTR [EBP+14]
0167:10001058 58 POP EAX
0167:10001059 8B00 MOV EAX,[EAX]
0167:1000105B 35DEA681A8 XOR EAX,A881A6DE
0167:10001060 8D5D14 LEA EBX,[EBP+14]
0167:10001063 8B1B MOV EBX,[EBX]
0167:10001065 8903 MOV [EBX],EAX
0167:10001067 58 POP EAX
0167:10001068 C9 LEAVE
0167:10001069 C22000 RET 0020

==========================================

I guess you could implement your loader in various ways, walk the import directory of the target and find the jump table address to GetVolumeInformationA and patch it with your function, or maybe use GetProcAddress to find your kernels address and search for that hex string in the targets memory and patch it as bytes. Being packed makes it a bit of a bother, else you could simply inline patch in some dll loading code. You've got all the ideas for the loader right, I'm not sure about the exact IAT patching details myself.

Cheers,
Kayaker
4oh4
11-29-2001, 03:25 AM
Thanks again for that file JMI.

.....and thanks to kayaker. You always seem to throw useful info my way! ;)

I'm a bit coded-out for tonight but I'll take a better look through your code tomorrow. I especially appreciate all the comments and I'm sure that I won't have too much trouble understanding everything once I get some rest.

I was planning on providing support for all the params (not just the volume serial num). It's just the way I deal with this type of stuff. It's easier for me to sort out the (my) bugs by taking things one (baby) step at a time.

It's too bad that you're not familiar with this sort of IAT patching though. -shucks-

Btw, in case you're interested hutch released v7 of his masm32 package. I've dl'ed it but probably won't get around to installing it till tomorrow or the next day.
garph0
11-29-2001, 08:51 AM
Hallo 40h4 :)
kayaker has explained that stuff really well, and i was thinking of helping a little with the IAT patching stuff:
you may need some knowledge of the PE format, try getting this

"Peering Inside the PE: A Tour of the Win32 Portable Executable File Format" by Matt Pietrek (March 1994)

there are also some good works by John Robbins, but i don't remember the title right now...

putting it simple: every time you compile a program which imports some function from a dll, the linker does some work to provide support for relocation: since every DLL can be loaded in different places in memory from time to time, when you issue a call you don't have something like this

call _AddressOfFunction

but this

call _SomeAddressInTheSpaceOfYourProgram

and at SomeAddressInTheSpaceOfYourProgram you have something like this

jmp DWORD PTR [AnotherAddressInYourProgramSpace]

at AnotherAddressInYourProgramSpace you find the real imported function address. this is done simply because doing so the PE Loader has only to fix the values found at the last address (AnotherAddressInYourProgramSpace) to handle all the possible relocation issues.

the AnotherAddressInYourProgramSpace is placed in a table called IAT which means Import Address Table. You see that you can easily redirect all the calls from the original function to your function by simply patching that last value, and keeping the original value to be used as a function pointer if you need to call the original function.

So you need to find the Import Table in memory.
the PE loader works by memory mapping the whole executable, and then fixind the addresses in memory. Given an address tha you know being inside the target program, you can search backwards ad try to find a valid PE header (you can simply read the first bytes of the file before using it and then search for those, or you can seek for the strings MZ and PE, which are found in the exe header, look in the article for help :)
anyhow, when you safely land on a valid PE header in the target address space, you can safely suppose it's your header :) and the start reading header fields, and search for the IT.
The IT starts with a chain of IMAGE_IMPORT_DESCRIPTOR structs

all fields are DWORD size

-------------------
| Characteristic | RVA of IMAGE_IMPORT_BY_NAME struct
-------------------
| TimeDateStamp | build of the file
-------------------
| ForwarderChain | you may handle this in the future :)
-------------------
| Imported Dll Name | RVA of imported DLL's name
-------------------
| FirstThunk | RVA of IMPORT_ADDRESS_TABLE struct
-------------------

you need the 3 RVAs, let's suppose that you need to find the address of the function IsWindow() in User32.dll.
0) you find the PE header of the target program and read the IT address in the header

1) you start walking the list of IMAGE_IMPORT_DESCRIPTORS of IT, checking the name field, until you find the entry relative to User32.dll (remember that we are talking about RVAs, you need to add the ImageBase value (usually 0x400000 in windows for executables, but you should better read it from the PE header) for it to make sense:
Address = RVA + ImageBase)

2) ok, now that you have found the correct entry, you use the Characteristic RVA to find the Name Lookup Table (NLT) in memory (remember! is another RVA!).

the NLT is an array of DWORDs, each one is the RVA of a struct containing a WORD (function ordinal) and a zero terminated string (function name), so

3) you walk down the NLT until you find the function you need. let's suppose this is entry 7 in you NLT array.

4) the field FirtsThunk of the IMAGE_IMPORT_DESCRIPTOR contains the RVA of the Address Lookup Table (ALT), an array od DWORDs

5) every DWORD is the virtual address (NOT the RVA!) of the corresponding function in NLT, so in ALT[7] you have the address you were searching for (it points to the real funcion, not to the name as in NLT, excuse me if the drawing below isn't clear :) )

graphically:

NLT IAT (ALT)
--- ------------ ------ <----\
/--->| R |------>| 44 |<---| | |
RVA | | V | ------------ | VA | |
| | A | | GetMessage | | | |
------------------- | --- ------------ ------ |
| Characteristic |--/ | R |------>| 95 |<---| | |
------------------- | V | ------------ | VA | |
| TimeDateStamp | | A | | IsWindows | | | |
------------------- --- ------------ ------ |
| ForwarderChain | |
------------------- RVA -------------- |
| Imported Dll Name |--->| "User32.dll" | |
------------------- -------------- |
| FirstThunk |----------------------------------------------------/
------------------- RVA

ok then, i hope it's clear enough... quite a little playing with pointers and addresses, but once you get to the PE header you cannot miss the thing :)

work well,

g

PS

thanks to sorrow: much of the contents of this post comes from one of our works, and the pe playing is his field :) hi, bro.
Kayaker
11-29-2001, 01:54 PM
Hiyas,

Anyone interested might want to look at the Messin' with the Import table project we had a while back. The attachments seem to have disappeared, but I'll try reuploading the original target I've got somewhere on my hd.

http://www.woodmann.net/forum/showthread.php?threadid=162&perpage=15&pagenumber=1

One of my recommended readings (easy to understand!)was
[yAtEs] Understanding Import Tables
which can now be found in the Immortal Descendants Archive ID-RIP on the main page (was under database/essays/yates/Import_tables.txt)

The equally good TiTi essay upped by Clandestiny (now deleted as well!) can be found here:
h**p://pluto.spaceports.com/~titiasm/essays/imptab.zip

Also check out FatBoyJoe's PE format by Offset listing while you're in the ID archive, *very* useful reference for walking the PE file (I think it was called something like 'exe-hdr.html')

As garph0 just nicely demonstrated, it's sometimes handy to get a reverser's condensed version of something like the Peitrek or Luevelsmeyer tome ;)
h**p://spiff.tripnet.se/~iczelion/files/pe1.zip

Kayaker
JMI
11-29-2001, 04:08 PM
If you downloaded the ID-Rip that Fatboy article is at

immortaldescendants/database/essays/fboyjoe/exe_hdr.html

for those of you who didn't, here it is as a text file. (the board doesn't permit uploading html formated files.)

Again thanks for a very informative thread.
Kayaker
11-29-2001, 07:05 PM
If anyone is interested I reuploaded the include program for the Messin' with the Import table project

http://www.woodmann.net/forum/attachment.php?s=&postid=11206
4oh4
11-30-2001, 04:04 PM
garph0:
Is the address that GetProcAddress returns actually the rva of the function in the name lookup table or the address of the function in the address lookup table?

edited for the sake of coherency
JMI
12-02-2001, 03:17 PM
Finally found the Fake It dll Asm mentioned in my prior posts on this thread about the pna article.

Hope it's of use.
garph0
12-03-2001, 03:30 PM
Is the address that GetProcAddress returns actually the rva of the function in the name lookup table or the address of the function in the address lookup table?

GetProcAddress returns the address you find in the Address Lookup Table entry relative to that function. it's already an address you can use.

remember, though, that GetProcAddress gets the functions from the EXPORT TABLE of the modules it seeks.
so you have two types of hooking:
1) the functions you are going to hook are implicitally linked to your executable, so you can find them just walking the import table, and patch it in memory.
2) the functions you are seeking are loaded at run-time via the LoadLibrary/GetProcAddress couple. in this case you have two possible solutions:
2a) you at the beginning hook LoadLibrary (or LoadLibraryEx) and GetProcAddress, so you can track the functions loaded dynamically, and cheat with the return values if you need
2b) you can change the export table of the module containing the function so any subsequent call to GetProcAddress done FROM YOUR ADDRESS SPACE (beacause the modified page will be copied for your process use) will return the value you've written.

hope this clears something.

g
4oh4
12-04-2001, 02:26 PM
garph0.....we're on the same sheet of music buddy. :)

You've not only answered my question, but the other questions I had too.

I'm not sure why, cause sice keeps taking a shit on me (I've only managed to successfully trace into the GetVolumeInfo call once), but ebp+14 == 0. The example that you posted (kayaker) doesn't seem to modify the volumeserial buffer. I'll try crossing my fingers and loading sice again tonight and hope it doesn't lock me up again. Trw gives me a black screen of death as it breaks on GetVolumeInfo, so I don't have another option but sice. Well I even tried debugging with w32dasm but ebp+14 was either filled with ?'s or 0's (I can't remember but I think it was 0's) so I can't check the contents of regs with w32dasm.
Kayaker
12-04-2001, 06:43 PM
I don't know what the problem might be 4oh4. After the real call to GetVolumeInformation the buffers should contain the returned values of lpVolumeSerialNumber, lpMaximumComponentLength, lpFileSystemFlags, lpFileSystemNameBuffer:

016F:10004A15 762C1831 000000FF 00004006 33544146 1.,v.....@..FAT3
016F:10004A25 00000032 00000000 00000000 00000000 2

After changing VolumeSerialNumber:
016F:10004A15 DEADBEEF 000000FF 00004006 33544146 .........@..FAT3
016F:10004A25 00000032 00000000 00000000 00000000 2

Are you trying this in the program itself or your own code? Stack error?

Kayaker
4oh4
12-06-2001, 08:39 PM
heya kayaker

I've tried it on both my own test app and the target itself. The author is changing the hdd serial based scheme to something else though so I suppose it doesn't *really* matter now.

This is very interesting of a thing for me though and I'm not giving it up, just moving it to the back burner while I work on other projects.

Thanks again everyone for the suggestions, files, and ideas.

edit:

I didn't see the question about the stack error. No there was no problem with the execution of the code. It's just that the actual volume serial was returned unaltered.


Wise installation system and script decompilation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Wise installation system and script decompilation
PDA

View Full Version : Wise installation system and script decompilation

LaptoniC
11-25-2001, 04:43 PM
I am trying to decompile wise installation scripts.I know most of the functions prototypes parameters etc.I decompiled Oxbuttons v6.0b htxx://www.opaquesoftware.com Here is my decompilation

Rem Oxbutton Test Script
Rem Oxbutton Test Script
Rem Oxbutton Test Script
Set Variable SERIALKEY to 111
Set Variable SOURCEKEY to 962
Set Variable ALT_SERIALKEY to 441
Set Variable ALT_SOURCEKEY to 938
Set Variable ALT_KEY to %ALT_SERIALKEY%
Set Variable KEY to %SERIALKEY%
Rem Main script body starts here
Prompt "Enter Serial number" Variable LIC
Rem Divide Serial number to two pieces starting from 7 th position
Parse String "%LIC%" into CTLNO and REGID
Set Variable ORDCHAR to Mid$(REGID,1,1)
If ORDCHAR Equals "T" then
Get System Information into DATE
Set Variable DATE to Concat$(Mid$(DATE,7,2),Mid$(DATE,1,2))
Set Variable CHECK to Mid$(REGID,2,4)
If DATE Greater Than "%CHECK%" then
Display Message "bad"
Set Variable REGID to
End
End
Set Variable TMP to 0
Set Variable TMP2 to 0
Set Variable COUNT to 0
Set Variable REGID_LEN to Len(REGID)
While COUNT Less Than "%REGID_LEN%" loop
Set Variable ORDVALUE to 0
Set Variable ORDCHAR to Mid$(REGID,(COUNT+1),1)
Rem There is 1Bh at the end of this function but I dont know the meaning of it.
Set Variable ALL_CHARS to 0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz
Set Variable ORDVALUE to Instr("%ALL_CHARS%","%ORDCHAR%")+47
Rem These are in the script two times but it doesnt make any difference
/* Set Variable ALL_CHARS to 0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz
/* Set Variable ORDVALUE to Instr("%ALL_CHARS%","%ORDCHAR%")+47
Set Variable TMP to TMP+((COUNT+1)*(KEY+ORDVALUE))
Set Variable TMP2 to TMP2+((COUNT+1)*(ALT_KEY+ORDVALUE))
Set Variable COUNT to %COUNT%
End
Set Variable TMP to KEY * 10000-(TMP+(TMP*10))
Set Variable TMP2 to ALT_KEY * 10000-(TMP2+(TMP2*10))
If CTLNO Length Equal To "7" then
If TMP Equals "%CTLNO%" then
Set Variable RESULT to TRUE
Else
If TMP2 Equals "%CTLNO%" then
Set Variable RESULT to TRUE
End
End
EndIf RESULT Equals "TRUE" then
Set Variable REG to RS
Set Variable PASSWORD to TRUST-1
End

Protection is like this.
This guys doesnt belive Wise own password system.As you know you can unpack files with e_wise and similar tools.However you will be surprised when you unpack files.Unpacked files named *.eox are crypted.So when you enter correct serial program unpack crypted files and decrypt it with oxcd.dll oxdfiles function.In the script below information is present
seg000:3C9B aTempOxcd_dll_0 db '%TEMP%\oxcd.dll',0
seg000:3CAB aOxdfiles db 'oxDFiles',0
seg000:3CB4 a41Compdir_2123 db '41%COMPDIR%\*.*',0Dh,0Ah ;indir 41 isnt important here
seg000:3CB4 db '2123984',0Dh,0Ah ;Key
seg000:3CB4 db '21-1',0Dh,0Ah ;parameter
seg000:3CB4 db '41%XNAME%',0 ;outdir
seg000:3CDE db 32h ; 2

So it seems to calling like
call oxDfiles,offset indir,2123984,offset parameter,offset outdir

I have tried to load dll and call this function but it didnt worked.In previous version I made a bruteforcer which was able to find decryption key within 1 sec.(Key space is limited to FFFh you will see if you dissamble oxcd.dll)
However this bruteforcer didnt worked on this version.Maybe they crypted several times I dont know.
According to this script 4355594T123 or 4377572123 passes this checks however when I enter one of these serials and I choose full version option it doesnt works.If you have any information about wise installation script please help me.Sorry for my english and long post but I want to show that I indeed worked on this and I got stuck :(

In the attached zip file you will find below files

Lap_oxbut.wse --> decompiled script of orginal setup
Lap_oxbut.bin --> binary of above one
script.bin --> original script binary.
wisescript.txt --> some information about wise scripts

Note:If you dont have wise unpacker you can unpack files via running setup with /x parameter.Password is TRUST-1 :)

Thanks for reading this.I will appreciate any help.
LaptoniC
11-25-2001, 04:50 PM
Ooopps forgot to attach :)


SoftIce Video Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce Video Problem
PDA

View Full Version : SoftIce Video Problem

mhb
11-25-2001, 05:42 PM
I have been using SoftIce on this system for quite sometime without any problems. Today, when I hit Ctrl-D I get a black screen with a "Signal Out Of Range 125kHz - 173kHz" message.

I can get back with F5. I have reinstalled my video driver - Nivida and ran the video test for SoftIce. I guess I have installed something along the way that has caused this problem, but don't know what.

Thanks,
mhb
mhb
11-28-2001, 08:04 AM
Found the problem. SoftIce didn't like the Nvidia choice. I choose standard VGA, checked off the Universal Video box, rebooted, and all is now fine.

Thanks to all who took a look at the post.


InstallSjield compiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > InstallSjield compiler
PDA

View Full Version : InstallSjield compiler

karakochev
11-25-2001, 10:47 PM
Hi.
Does anyone knows where to download an installshield compiler
(only a command line compiler ) for v.5-v.6
Thanks
karakochev
11-25-2001, 11:30 PM
I know where to find the decompilers.
The problem is that I can't find a suitable Installshield compiler
that compiles the sourse to *.ins, *.inx scripts files.
The one included in VC6 is with restricted use.
I think it would be very suitable to download from somewhere
the commandline compiler from the IS pack.I tried to do this from
w*w.installshield.com but there is a lot of scarbage and you must download hundreds of MBs before finding this little proggy(installshield compiler)
JMI
11-26-2001, 01:03 AM
It can usually be quite useful to use the search button on the top of the forum before you post a question because it is always possible that your question has already been asked and possibly answered. If you use the feature and type in "installshield" you will find 26 previous posts about the subject, some even with post from you, which discuss the general subject. Several of them refer to the installshield utilities which are used to compile .inx files and several have suggestions where you might acquire those files.

I make this reference, not in any way to give you a hard time, but to try to reinforce the value of learning how to search for information, because that is how we find information when someone helpful is not right there to answer our questions. If you master this skill, and there are extensive articles on the fravia site devoted to learning this craft, you will find most things that you want on the web.

If you can't find them anywhere else after you do a search with the names revealed in the previous posts, send me a message and I'll try to provide them. I downloaded Installshield some time ago and believe I still have the files on my HD.

Searching for them will help teach you something. Giving them to you without some effort on your part teaches you nothing and does not advance your skills, which is what this is supposed to be about.

Good hunting.
DakienDX
11-26-2001, 11:33 AM
Hello karakochev !

Sorry, but there is no Command Line Compiler available for InstallShield. The only way is to use the build-in compiler in InstallShield. The program's size grows with every version, the demo version has about 100MB, the full version about 400MB (I'm lucky that I'm receiving updates on CD :) ).

The only available InstallShield 'compilers' are the programs to pack and unpack .CAB files. But they can only pack files which were created with the same version of InstallShield. I tried I5Comp and I6Comp too, but I wasn't able to pack anything with it.
karakochev
11-26-2001, 02:04 PM
Thanks DakienDX ,
I thought that there isn't a command line comiler only in the demo versions( like it is in Borland Delphi's demos).
So it is not so easy for one who does not have the entire IS suite(400MB) :-).
I know the rest of the information about the IS unpackers.
Thank for your time
and have a nice day
JMI
11-26-2001, 11:15 PM
Guys, I believe you are mistaken to believe (say) that there is no "command-line" compiler in (for) Installshield, unless we are having a misunderstanding about the term itself. I quote from a programmer's site

h**p://www.ticz.com/homes/users/nlewis/Menu.htm#HTML/

who distributes, free, a program designed to assist the compilation process. He states:

"1. InstallShield Professional 6 provides two command line utilities that can be used to build a previously created project: Compile.exe, which is used to compile script files, and ISBuild.exe, which is used to build the media defined in the project. Designed to be run from a DOS batch file, these utilities offer a powerful and flexible way to create automated builds of an installation project.
One drawback to using these utilities is the fact that the command lines needed to successfully compile a project's script files and build its media tend to be quite long. And because these utilities rely heavily on the use of hard-coded DOS paths, build scripts created on one computer system may not function properly on another if Compile.exe and ISBuild.exe have been installed into different locations on the two systems. And finally, these utilities do not support the automation techniques commonly used today, such as the VBScript support offered by the Microsoft Windows Scripting Host.
The ISProjBuild control was created to provide an automation interface to the InstallShield Professional build tools in a system-independent manner. Instead of using hard-coded paths to the location of Compile.exe and ISBuild.exe, it reads this information from the registry so that these utilities can be launched regardless of where they were installed on the local system. And the various include paths, flags and other options normally passed on the command line have been wrapped up a set of automation objects."

This suggests to me that there is, indeed, a "command line" compiler for scripts in the program. It is indeed available with the "demo" version and on my Win98 SE machine is stored in C:\*\common files\InstallShield\IScript. It is only 163K and there is also compiler.dll, iscript.dll, ISDBG.exe, and Isdbg.chm files. (Although I confess I've not tried any of them yet. ISDBG appears to be a script debugger, but I'm not sure yet.) It would seem that if you can use a decompiler on the script, you should be able to re-compile the script with this program.

There is also a tutorial on the installshield compilation process at

h**p://www.cs.duke.edu/~jjw2/installshield.html

which includes at

h**p://www.cs.duke.edu/~jjw2/setup.html#includedir

a template to go with the tutorial which might provide some insight on the workings of a "compiled" script.

Again, just a small sample of what I was able to locate in just a few minutes with a google search for "installshield compiler." There are still more then 15 hits I haven't looked at yet. Give it a try.
I would guess that a search for "compile.exe" would generate a great many hits of non-related compilers, but one never knows (how about Installshield & compile.exe) and there is probably an ftp site with the Demo program on it somewhere, from which you might be able to download just the compiler.exe.

Don't give up without a search.
DakienDX
11-27-2001, 01:31 AM
Hello JMI !

I know Compile.exe and ISBuild.exe, but I don't see them as command line compilers, since you can't compile any projects with only using these two files and it's .DLLs. Even if you've installed the full version, you can only use them in a very limited way to compile a project. Most features need to be pre-'compiled' with the GUI, only the final steps can be done by those programs (which is done by the GUI also). So you can't use them to recompile a decompiled and changed script, which I suppose was the reason for starting this thread.
JMI
11-27-2001, 03:24 AM
Hi DakienDX, glad to see you have your avatar to yourself again, but still at a loss to understand how the pink pussy suddenly became a little pervert. Talk about a lifestyle change. Anyway, on to the business at hand.

Please don't misunderstand my question as anything other than a request for further knowledge. I've stated I have zero experience actually using InstallShield, but have been reading a lot on the subject and a "little" knowledge can be (is) a dangerous thing. From your statement that you are receiving updates by CD I am assuming you are a knowledgable user.

Having seen several programs on the InstallSite which claim to permit their editors to work with Installshield scripts and some of then even claiming to invoke the Installshield "compiler", I'm wondering if your statement, that one can't decompile, edit and then recompile with compile.exe, is based upon an unsuccessful attempt to do so, something you may have read, or have been told?

It would seem, logically, that Installshield would have to have provided its users with a facility to edit their scripts, which after all is simply a company constructed language, which their compiler, compiles. Do I understand you to be saying that the problem is that one can not decompile, edit and then recompile, only edit, and compile? And if this is so, does this mean that the "decompilers" don't actually give you an editable script to work with? I was under the impression that the script itself was a file with extension ".rul", but again, because of lack of actual experience, this may only be the file that gets compiled, and one which isn't effectively decompiled.

What is unclear, and again I don't doubt your statement, why, especially if one has the program (full or demo), one can't decompile the file, edit the script and recompile. Is it because we would not have the original project files and the decompilation process does not give us enough materials to have a "project" to recompile?

I'm not trying to make this into Installshield 101, mostly seeking advise on whether my assumptions are headed in the right direction.

Thanks for your help in this and many other threads. Keep it coming.
Unknown One
11-27-2001, 10:46 AM
Hi, rednik Karakochev :)

If you find a small command line compiler which is _compatible_ with InstallShield please mail me the url at unknone@mail.com

starshinka Unknown One :D
DakienDX
11-27-2001, 11:24 AM
Hello JMI !

Of course you can do some research on your own. I won't kill you for this. Anybody can make mistakes, so it's better if someone checks if there are any.

The .RUL files are the InstallShield script files, and a decompiler (at least the two I know) tries to produce the original source, but it won't be able to get it in a recompilable form for several reasons. Even if it would get it, the right project file, to compile it with InstallShield, would be missing. I tried the decompiler on one of my own source files and got a similar source which worked with my project with just a few warning messages.

But the usual user or cracker will not have the project files available. So he can decompile the script and see how it works (i.e. how a serial is calculated, which file is checked for the file version to be able to install an update, ...), but he won't be able to change anything (skip register dialog, skip file check, ...) and recompile it to be working.

I think this is what the post was originally started for: A command line compiler which doesn't need the big demo or even the bigger full version. Not how the author of a project can make minor changes to a decompiled source script, when he lost his original .RULs, but has still his project file and all required components left.
karakochev
12-06-2001, 06:02 PM
If it is interesting to someone the compiler could be downloaded from ftp://ftp.inet.ru/pub/ISWI15BASE/iswi/Common/InstallShield/IScript/Compile.exe
or ftp://ftp.inet.ru/pub/ISWI15BASE/iswi/Common/InstallShield/IScript/
using the same version of compiler.dll ,which the script you have decompiled had used makes you recompile exactly the same
Just have to find the original compiler.dl
DakienDX
12-09-2001, 05:52 AM
Originally posted by karakochev
Just have to find the original compiler.dl
Maybe you can ask the software's publisher for it. :)

I know the problem. With InstallShield's .CAB tools, you can only add/replace files to/in archives made with the same version and build number as your InstallShield copy.


UPX unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > UPX unpacking
PDA

View Full Version : UPX unpacking

theeta
11-26-2001, 03:40 AM
hi there....i was working on a worm(server file) that can be downloaded form http://subseven.slak.org.....the problem being that it's packed with UPX.....
i have UPX unpackers but they don't seem to work...( giving message that the file is hacked,broken and can not be unpacked)
any help???
DakienDX
11-26-2001, 11:44 AM
Hello theeta !

UPX versions less than 1.00 can not be unpacked by UPX itself. You can use ProcDump for them.

Two more things:
1 - This is a RCE Messageboard (=Reverse Code Engineering) and not a Hacking Board.
2 - There should be an unpacked version of SubSeven available on the internet.
theeta
11-27-2001, 07:46 AM
got it..
thnx...

theeta.
swissknife
11-27-2001, 08:00 PM
You can also try file scanner.
This prog unpacks most of the older packers.

The process in not perfect. If you unpack a file packed with upx >1 with upx itself you get better results than unpacking with file scanner.

Also procdump runs a file to unpack it while i belive file scanner does not.

All best


VB decompiling
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > VB decompiling
PDA

View Full Version : VB decompiling

Nodens
11-26-2001, 09:10 AM
I'm working on a vb4 project but when i disassemble it all i see is a call to ThunRTMain located in vb40032.dll.
I could disassemble vb dll but this would take a long time.
I wonder if there is a tool to facilitate disassembling or a vb decompiler around there.
I found dodi's vb decompiler but my version for vb4 doesn't seems to work :'(
Another question : Supposing i succed in cracking a vb4 target (using smartcheck or a decompiler) how can i patch it ?

ps : i tried WKTVBDE but seems only work for vb5&6 :'(
jomamameister
12-05-2001, 10:35 AM
w32dasm 8.93 with the vb enhanced features will work for you, so you can see what is being called.
j


Delphi Breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Delphi Breakpoints
PDA

View Full Version : Delphi Breakpoints

T-Jax
11-26-2001, 05:46 PM
Does anybody know some good breakpoints for programs made with Borland products? I mean something to use when trying to find out some serial number. I have Windows 2000, so I can't use HMEMCPY either. Thanks.
Woodmann
11-26-2001, 06:52 PM
Howdy,

First read the FAQ for this site, then try that search button.

Did you even bother to read this forum?

And thats "daddy" being nice.

Peace, Woodmann
Kayaker
11-26-2001, 09:03 PM
T-Jax,

Try the boards Search function, you'll get plenty of past hits on Delphi discussions. You'll learn a lot more by reading them too. Consider it part of the research process ;) Here's a random one you can start with:

http://www.woodmann.net/forum/showthread.php?threadid=1876&highlight=Delphi

Kayaker
T-Jax
11-30-2001, 05:49 PM
Thanks, Kayaker.


online-RegCode-check trick
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > online-RegCode-check trick
PDA

View Full Version : online-RegCode-check trick

Solomon
11-27-2001, 04:19 AM
Target: Ace Clock Pro 3.6
hxxp://w*w.aceclock.com/files/ace_clockpro36.exe

This prog uses registration code. It is packed with two packers(one is ASPack). I successfully unpacked it(OEP = 605F70) and found the boolean flag of unregistered/registered with DeDe.

* Reference to field TAceClock.OFFS_044D
|
005FEFAB 80B84D04000000 cmp byte ptr [eax+$044D], $00 <----Registered or not?
005FEFB2 0F8596000000 jnz 005FF04E

By patching this flag I got a fake registered version. The time-limit and nag disappeared. The reg info is stored in the following places.

HKEY_CURRENT_USER\Software\ECrewDev\AceClockPro\Info\1 <----Name
HKEY_CURRENT_USER\Software\ECrewDev\AceClockPro\Info\2 <---Company
HKEY_CURRENT_USER\Software\ECrewDev\AceClockPro\Info\3 <--- Mail?
HKEY_CURRENT_USER\Software\ECrewDev\AceClockPro\Info\4 <--- Key?

But you still can not use the "Adjust data/time via Internet" feature, coz it will always check whether you are a legal user by sendind the following http request to its home:

GET /products/aceproclock/check.php3?user=xxx&email=yyyy HTTP/1.0

If your name is not in the database, it will refuse to adjust date/time. Simply blocking it with a firewall will not work. With a "BPX WS2_32!connect" I have found this online check and patched the "JZ", but the date/time of my machine still kept unchanged. Strange? Don't know why. It may use non-blocking socket, coz the return value of GetLastError() after connect( ) is 0x2733. I didn't see the data sent to internet time server even with a sniffer.

001B:005D38C1 CALL 005D3778 <--------- check if you are a legal user
001B:005D38C6 TEST AL,AL
001B:005D38C8 JZ 005D39DB <-------jump if illegal
001B:005D38CE LEA EAX,[EBP-04]
001B:005D38D1 PUSH EAX
001B:005D38D2 LEA ECX,[EBP-18]
001B:005D38D5 MOV EAX,[0060A488]
001B:005D38DA MOV EAX,[EAX]
001B:005D38DC MOV EDX,005D3A14 <-------msgConnecting to time server
001B:005D38E1 CALL 005BF780
Idcrisis
11-28-2001, 02:49 AM
First of all your problem cannot be solved by changing a flag because it relies on data which is sent from the server. It is like a save-disabled menu item with the code for saving not there at all. Therefore it is impossible, what you are trying to do.

If you insist, persist, desist and resist common sense, which is why you have come till here on this target anyway ;) then...

you can manually telnet to <whatever their server> and do

GET /products/aceproclock/check.php3?user=dummy&email=dummy@email.com HTTP/1.0

Then get the response. You can take a look at it and figure out what it can be changed to to reflect a proper return.

Then you can look at the code which is meant to execute after the program supposedly gets the date time from the server and see what it does with the values. There will be a call to one of the brethren of SetSystemTime with these values.

You can try changing the URL it is accessing to something you can control, point the base URL to 127.0.0.1 or whatever. You can change the PHP reference too if you wish. Then you can run a small web server (use indy TCP components in Delphi) at that URL to keep getting the date/time from an independent time server and returning values in the format that you think the server should return.

It will be an extremely interesting task.

The word impossible usually means superstition ;)
Solomon
11-28-2001, 03:38 AM
Thank you Idcrisis for your reply:)

yes the traffic of this prog can't be blocked, no matter whether it is connectiing to its registration-check server at home or internet time server:D

I just tried other winsock APIs as breakpoints such as send//recv etc. It's a challenge to analyze its 'protocol'.

Your substitution way is really good:D


help with juno browser
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help with juno browser
PDA

View Full Version : help with juno browser

XonioX
11-27-2001, 11:29 PM
Can anyone show me where i can look to find info about the juno browser. I use the service and for 120.00 a year you can't beat it. However I do not wish to use the browser because it is a tank. If I x out of the browser it also ends my internet session. Where should I begin to look to see how I can trick it into thinking I am still logged in or just getting rid of the process period. The browser is based on IE 5 (another reason I do not wish to use it). I know this question is kinda lame but if any one has any ideas it would be greatly appreciated.

Thanks
DakienDX
11-28-2001, 12:28 PM
Hello XonioX !

This is not a lame question. It's basic reversing, you're on the place we (try to) do it.

I don't know the Juno Browser. I suppose it's a program which lets you surf as long as you want in the internet and you pay yearly fee for it. Please correct me if I'm wrong.

I don't think the application who has the control over the internet connection is integrated into the Juno Browser, so I think it's an external application which checks somehow if the window of the Juno Browser is still on the task list (and perhaps if it's the foreground window). So you should look if you can find this application and see what it is checking for.

I can't help you much more without some infos about the Juno Browser. So please tell us anything what looks important to you. (how is the connection made, what tasks are active when running it, does it download advertisments in the background, ...)
XonioX
11-28-2001, 09:29 PM
I did some reading on it and it very similar to the aol browser. It has looksmarts search engine integrated in the top with several channel links. There are also links to read, write,and internet. It allows you to choose whether you want to connect to just the email service or the internet. One thing I have found that if I hit ctrl alt del and force it closed. The warning box that says if i close the browser I loose my connection still pops up. I select no then I get the warning box for this task is not responding. By selecting end task it will close it anyway and i am still connected to the net and free to use opera without the extra hinderance of loosing system resources. However I would still like to figure out how to close without having to go through that process. There are no ad banners running while it is open however when you connect to the internet you see several ads. I am also running win 98
peterg70
11-28-2001, 10:27 PM
If the Juno Browser uses IE 5.0 to connect to the internet via a modem then isn't it jsut using the dialup connection as per standard windows. Go to tools/Internet Options/Connections and see if a dialup connection is present

If so you can go to the dialup networking icon in your My computer and double click on the dialup connection Something like JUNO etc. and this will connect you up. I assume OPERA has a method of activation a dialup connection as well so check the options button.

You can also retrieve the password if it has one by using a password thief or the fravia method of reversing all **** hashing to plain text.

then you can run any kind of software over the dialup connection. provided the ports are open.

Your description of end tasking the IE5.0 sounds like the dialup connection popped up but you shutdown the internet explorer.

Let us know if this is so
Peterg70
XonioX
11-29-2001, 02:03 AM
about a month ago i did play around with the dial up connection properties and this was interesting. I set it to use ie 5.5 as the default browser and not juno's. when I would start the dial up connection it would start however it automatically switched back to the juno browser. and ie5.5 did not come up ever. After that I deactivated the dial up connection in windows. This thing(juno) has it's own dial up connection built in and connects to the net without using the one from windows. It's funny though beacuse when I force clodese the browser my computer runs ten times faster on the internet whith a different browser vs. theirs. So it is probably sending and recieving all kinds of info I do not need as well as let them know where I have been or am headed. These guys may in fact be dirtier than aol. Last night I read an article where they were planning to lease out the space of their "free users" computers to third parties to create some kind of supercomputer. Maybe they have been doing that to me all along as well, maybe not. Also without it up my firewall goes off 90% less.
DakienDX
11-29-2001, 11:43 AM
Hello XonioX !

You could use TerminateProcess to get rid of the Juno Browser. It shouldn't be able to protect itself from being terminated by this function. You could program a loader which starts the dialup program and terminates the Juno Browser as soon as it's found on the task list. This way you should have what you wanted to have without going through the process of cracking the software.
Woodmann
11-29-2001, 04:12 PM
OK, let me see if I understand this,

The browser and the dialer are linked as one.

Fire up the "house" brand dialer and do not link it
to any browser. It should just dial and show the little connection box on the tool bar.

I have never heard of a dial-up with a "smart" connection to know if its browser is running but,
If Juno is a free service I wouldnt be surprised.

Peace, Woodmann
XonioX
11-30-2001, 02:36 AM
Actually they offer free service and pay. The free users get screwed with bad connections and many many ads. I pay but all I want is the connection not their software. Simply terminating the process works well. But here is something interesting. A port probe from there server shows up on my firewall if the browser is not running down I go. it's the damdest thing. For 9.95 a month maybe I am simply getting what I am paying for.
peterg70
11-30-2001, 08:25 AM
Hmmm

This sounds like a job for a emulator. Something that dials up the connect, terminates the process and listens on a port and sends the correct answer.

can you supply some info on what port and packet information it is requesting. It may be that it trying to check the name version of the browser which can usually be fixed quite easily
XonioX
11-30-2001, 06:33 PM
IP: 64.136.16.77
DNS: m14.jersey.juno.com

that is where the tcp port probe comes from

port 3900 or 5050 maybe?

I am still interested in learning how to completly reverse this browser where would be a good place to start to get info on doing that. The more I found out about them the more it is becoming a moral imperative to change the reality of the crappy browser hell in which I am forced to exist.

Determined

XonioX
XonioX
12-07-2001, 08:20 AM
I ran a couple of test's. The first was normal startup. I used filemon to see what files it was calling. Rnaaap was calling
C:\Program Files\juno\bin\junosmm.dll and logging it into the same place, junosmm.log. The log lists your disconnection. If it shows that the disconnect fails it says this. Juno's servers will read it. So you need a clean copy of the log file saved somewhere else so that when you connect again it looks like everything was cool the last time you discon. In other words use xcopy in dos and create a batch file. From this junosmm.dll it instantly moves to the executor. and juno starts up. Currently I have simply been force closing. But where does the alert come up from? The one where if you close juno you get discon?within the executor? In the juno.ini file it loads somewhere around 30 to 35 dll's most system some juno specific. My main question is when you use dial up net. How the hell does juno initialize by itself? it is not the default. Opera is.
Is that dll the initializer or are those dirty bastards just hacking me and attempting to make me use their crappy browser?

Determined

XonioX


w32dsm can't disassemble c++ builder exe?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > w32dsm can't disassemble c++ builder exe?
PDA

View Full Version : w32dsm can't disassemble c++ builder exe?

binbin
11-28-2001, 08:13 AM
it halt while loading the exe.
Solomon
11-28-2001, 09:06 AM
unpack first:D
fPc
11-28-2001, 09:07 AM
hi,
don't know which file to disassambly: C ++Builder it self or sth. compiled by that. if its the later one, then try to learn DEde, and maybe should be unpacked first..

:)
binbin
11-28-2001, 09:44 AM
It unpacked exe.
to test, i maked a exe file using CB.
and it cant be disassambled too...
my CB is 5.0
Idcrisis
11-28-2001, 10:47 AM
c++builder files by default are disassemblable by w32dasm. binbin, either the file was packed after compilation( read up on packing), or the code section type was changed manually.

does w32dasm crash or show nothing?

if it crashes then read up on anti-w32dasm tricks
Zero
12-11-2001, 05:00 PM
Should be no prob,
if you think it is packed, and don´t know with what ever,
give FileInspector or ProcDump a chance.

Hey, what about learning manually unpacking ?


hmemcpy not in ME, please chastize here
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > hmemcpy not in ME, please chastize here
PDA

View Full Version : hmemcpy not in ME, please chastize here

daprean
11-28-2001, 10:58 AM
If this question has been asked a hundred times before maybe the answer should be in a FAQ. But I have searched high and low to find out how to get hmemcpy to work in winme. Maybe theres someone out there who doesnt feel to bad arse to answer a simple question. And maybe they can put it in a FAQ so that people like me wont ask anymore and they are not required to sport a bad arse attitude.
hobgoblin
11-28-2001, 12:44 PM
Hi there,
I have been using WinME for a year now, and putting a breakpoint on hmemcpy works everytime for me. This may not be of much help, but as far as I know, there should not be any problem using a bpx hmemcpy when you're on WinME. (But Win2K is totally different story). I'll take it that you're talking about using Softice.


UPX and NAV
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > UPX and NAV
PDA

View Full Version : UPX and NAV

Lord_Soth
11-28-2001, 11:07 AM
Any1 know wtf is wrong with NAV and UPX ??

When autoprotect is enabled, running any kind of UPX
packed file causes the system to almost grind to a halt.

LS
DakienDX
11-28-2001, 11:59 AM
Hello Lord_Soth !

I've never had a problem like this. I'm using NAV 2001.

I once had a problem with only one file packed by DIET 1.45f (DOS packer) which made the manual scan hang, but a email to Symantec and this problem vanished with the next NAV definitions.

Always try to get the latest virus definitions every week.
Lord_Soth
11-28-2001, 07:20 PM
not a problem with the virus definitions bro.
it's a problem with NAV2000.

LS
McNy@Work
11-29-2001, 05:01 PM
YOUR SYSTEM PROBLEMS

NAV can't work well with other AVP.
If u ever installed other AVP in your OS , u may got this problem.

As I know, .exe using UPX1.04 always happen the problem u said.
Lord_Soth
12-01-2001, 04:41 PM
I've never installed any other AVP, just NAV2000.

My system is not the only one suffering from this. The homepage
of the program I use that has the problem specifically says it's
a problem with UPX and NAV. Apparently it was reported by many
users.

LS
McNy@Work
12-02-2001, 02:53 PM
PeEditor 1.7 by yoda & M.o.D. got this problem ^_^
so i unpacked it ,and repacked it with the latest upx for myself.

exe file using UPX version 0.9x to 1.0X may get this problem,but the author of UPX had fixed it in later version(Do u know what he did ???). In my case, version after 1.06 is OK

other AVP (i used McAfee) work with NAV2000 would make the problem worse. PE-editor 1.7(b4 i fixed it) spend at least 5 minits to show the program window !! If only NAV alone , cost about 3 minutes ...

So, I use NAV2002 now, never happen this problem again.


An unusual CRC check, I guess
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > An unusual CRC check, I guess
PDA

View Full Version : An unusual CRC check, I guess

dunno
11-28-2001, 11:08 AM
Hi to you all,

I'm working on a smart program which is not packed but which (I suspect) has a CRC check. I call it smart because when you patch the "registered-or-not" flag the program starts without the nag screen, does not display "UNREGISTERED" string neither on its caption nor on the About box however, it does not work at all. You just see the GUI and that's all. It does not perform its intended functions when you click on them, and it eventually terminates itself in a completely random fashion in 5 minutes or 2 days time. I made a loader which appropriately patches the required bytes and it works perfectly.

The problem is; I exactly know where to patch but I don't want to use a loader. Instead, I'd like to inject a piece of code at the end of its original code which would jump to the exact location, change the required bytes and let the program run smoothly as if it is registered.

To exemplify:
.
.
.

Referenced by a call at ....

00402600: mov eax, dword ptr [004B5BA4]
00402605: xor ecx, ecx
00402607: and eax, 112000C2
0040260C: cmp eax, 112000C2
00402611: sete, cl ; changing this to "setne" lets the program run as if it is registered.
00402614: mov eax, ecx
00402616: ret
.
.
.
Now, where to put my jump-to-the-end instruction. At 00401000?, right before RVA 00402600?, or right after the last significant byte towards the end where 00's begin?

Here is the code snippet which I try to inject:

.
.
... Zeros begin here...>
0049137A: push 00xxxxxx (the original instruction which I should replace in order to jump here)
0049137F: push eax
0049138D: mov al, 95
00491382: mov byte ptr [00402612], al
00491387: pop eax
00491388: jmp 00xxxxxx (back to the RVA of the following instruction where I jumped)

Program crashes w32dasm. I got all the above info from another dasm. It works well with SoftIce. Reg routine is crypted and its too hard for me to decrypt. So, no chance of serial fishing.

What should I do to defeat this CRC check? I have no idea where this check is implemented

Module entry point: 0045B9A0

Any comment well appreciated. Thanks.
Fake51
11-28-2001, 01:46 PM
First of all, you should try to see, if adding your code will stop the program. If not, then you could try to set the entrypoint to your code, so you wouldn't have to overwrite any of it's code. Else, you could also try to patch the entrypoint, and then patch it back like you suggested. This, however might give u a problem with a crc check on disk (the program might crc-check the file on disk, not the file loaded in memory).
You could ofcourse try and spend more time on the crc-check, first of all trying to figure out which method it is using (just set a bpm where u want to patch, if that doesn't work, try and bpx createfilea, it might try and open and read from itself)

Fake
Lord_Soth
11-28-2001, 08:24 PM
OpenFileA is also used *sometimes*, so is _lopen.

BTW, your best bet besides CreateFile is actually
MapViewOfFile...

LS
DakienDX
11-29-2001, 11:23 AM
Hello dunno !

An other possibility is that the program does it's CRC check on the loaded program, so altering the code segment may be detected, but you could also create a new section, set it's attributes to executable and insert your code there.


elcom apps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > elcom apps
PDA

View Full Version : elcom apps

_Servil_
11-28-2001, 04:41 PM
hi folks, maybe this question is stupid,
but i'd like to try unpack/debug elcom soft software
'cause it changes regcodes in each version and get 'em ever
too late

could any1 advice what packing method used (& if possible suggest an unpacker) and how (if even) to trap common dialog routines (seems their soft doesn't use win api calls)

TIA
Kilby
11-28-2001, 06:46 PM
Elcom uses good old asprotect, and a check to see if the aspr api is resident.

Their apps are usually written in Delphi, hence you don't get all the calls you are expecting.

Kilby...
DakienDX
11-29-2001, 11:33 AM
Hello _Servil_ !

They also use the ASProtect key signatures, so even if you're able to unpack an ASProtected application, some code will be still missing without a valid registration key.
Kilby
11-29-2001, 07:00 PM
DaikenDX,

blacklisted serials are useful ;)

Kilby...
DakienDX
11-30-2001, 01:37 AM
Hello Kilby !

Blacklisted serial are good for unpacking, but are disabled in the next version. Please correct me if I'm wrong, but ASProtect allows only one password for the key signatures (= serial) and this changes as soon as the serial appears on the internet. There are some hash values that the serial is compared against, but only the actual password for ASProtect is a 'good' serial.
sv
11-30-2001, 03:57 AM
Hi all hello kilby :D

In serial you have a Common key used to decrypt code and a personal part.
If you have a blacklisted serial you can decrypt code and save .text section !
I use same serial to rebuid ARCHPR new version.

SV


ASCIIs in executeables [w95]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASCIIs in executeables [w95]
PDA

View Full Version : ASCIIs in executeables [w95]

koyaan
11-29-2001, 10:11 AM
after having read lesson 4 (1) of +ORC's tutorial
i decided to do like he suggested and wrote a little
c-prog to find strings in executeables...

but when i compare the offsets given by my prog they
dont allways match with the offsets given by w32dasm

e.g(getright.exe (version 4.2)):

kaf:
145818 -> h*tp://www.getright.com/remove_ads.html

w32dasm:
* Possible StringData Ref from Data Obj "http://www.getright.com/remove_ads.html"
|
:00401BA2 68187A5400 push 00547A18

am i missing something here :) ?

since i am a complete newbie, help would be greatly appreciated
(i am sure its something obvious....)

cheers
koyaan

ps: glad to have found the door to a really fascinating new world of possiblities, cheers to all crackers, theres a new newbie in town...
DakienDX
11-29-2001, 11:16 AM
Hello koyaan !

You must know that Win32 programs have 'segments', which have a virtual address space where they are loaded into. Your program searches for strings and displays their physical offset. These 'segments' have a virtual size, a virtual address, a physical size and a physical address. Physical means here the place in the file and it's real size. The virtual address is a position in memory where the program is loaded into and the virtual size the memory size the program allocates.

It is nothing unusual that the data from 400h in the original file is loaded into the memory at address 00401000h. So if your program would find a string at 484h in the file, W32Dasm would show it at address 00401084h.

If you go onto a disassembled line in W32Dasm, it should show you the 'virtual' address, but also the corresponding 'physical' address.

All segments are defined in the PE-header. You should search for some information on it and try to understand how it works.
koyaan
11-29-2001, 08:55 PM
yeah i will thanks....
thought it would be something like that...

/me googles
Aimless
11-30-2001, 02:56 AM
alternatively...

try putting your wdasm green bar on the line which you want to find the address of.

On the left hand side the address you see is the "Virtual Address". that means, as it is in memory

On the STATUS BAR, you will see an address. This is the physical address in the file.

Your status bar adderss and the proggy-you-wrote address should be the same.

...Have Phun


Need help with IDA Plugin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Need help with IDA Plugin
PDA

View Full Version : Need help with IDA Plugin

Polaris
11-29-2001, 04:18 PM
I am seeking for someone who can compile for me an ida-pro plugin. I am running IDA 4.04 shocked release. If anyone can help please contact me directly. :)


ExitProcess and TerminateProcess
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ExitProcess and TerminateProcess
PDA

View Full Version : ExitProcess and TerminateProcess

wbe
11-29-2001, 04:28 PM
What's the difference between the two? Is there any other API used to terminate (exit) a program?

Thanks
Fake51
11-29-2001, 05:04 PM
Exitprocess is used by a program to terminate itself. Terminateprocess is used by a program to terminate another program.

Fake
Solomon
11-29-2001, 08:57 PM
TerminateProcess doesn't give the victim a chance to free resources, while ExitProcess does.

Sure the best description is in MSDN.
DakienDX
11-30-2001, 01:45 AM
This function terminates the specified process and all of its threads.

[...]

Remarks
The TerminateProcess function is used to unconditionally cause a process to exit. Use it only in extreme circumstances. The state of global data maintained by dynamic-link libraries (DLLs) may be compromised if TerminateProcess.

TerminateProcess causes all threads within a process to terminate, and causes a process to exit, but DLLs attached to the process are not notified that the process is terminating.

Terminating a process causes the following: All of the object handles opened by the process are closed.
All of the threads in the process terminate their execution.
The state of the process object becomes signaled, satisfying any threads that had been waiting for the process to terminate.
The states of all threads of the process become signaled, satisfying any threads that had been waiting for the threads to terminate.
The termination status of the process changes from STILL_ACTIVE to the exit value of the process. Terminating a process does not cause child processes to be terminated.

Terminating a process does not necessarily remove the process object from the system. A process object is deleted when the last handle to the process is closed.

Maybe not the best description, but all you need...
wbe
11-30-2001, 04:35 PM
You are a great asset for this Forum.

Thanks a lot.


WhereIsIt 3.21 (aspr 1.22-1.30 ?)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > WhereIsIt 3.21 (aspr 1.22-1.30 ?)
PDA

View Full Version : WhereIsIt 3.21 (aspr 1.22-1.30 ?)

mnk
11-30-2001, 05:03 AM
hmmm,

I was wondering, WII ( w*w.whereisit-soft.com ) has version 3.21 out.

It's identified as being packed with asprotect 1.22 (FI) and asprotect 1.2*-1.30 (peid) but caspr 1.012 can't make head nor tails of it ?

Anyone has success in unpacking this automatically, or what would be the best way of action to unpack this target?

btw: if you use the ecl keygen it works for a very brief while so you can dump the encrypted code, if any?

thanks
mnk
12-01-2001, 10:36 PM
maybe I posted this in the wrong area?
evaluator
12-02-2001, 03:38 AM
1. Your post sounds like crack-serial request.
In this case you are in "wrong area".
2. If you want to learn "unpacking",
you can read "tutorials" about it..
Bye-bye-bye!!!
mnk
12-02-2001, 08:16 AM
hmmm, how shall I word this. If you see a tut that says "intermediate", then, most of the time I can follow the train of thought and actually know whats happening and learn things. As "advanced" ones most of the time assume an imo very thorough knowledge of IAT and PE stucture, which, sadly, is not one of my trades.

I started back in the days of dos with a nice old version of SI and I even used "bubble chamber" next to Sourcer.

now, I never am confronted with native windows32 programming and I don't know the latest asprotect tricks. I've attempted some IAT rebuilds after dumping, but most of the time I'm left with a loader patch or something because of instability.

Sadly, I don't have time to make for studying the entire PE 32 + windows API as this is very, very far from my daily occupations, so I am just here looking for hints.

After some hardship, I eventually cracked just about every single program I set my mind on (reget(dx), wincmd + 2crcs, bestcrypt 6-7, some dongles, the bat! (when it was packed), some ftp clients/servers, ...) and I do this for the challenge and fun (and I prefer hard code patches to keygens, inline patches etc, since I loath the registry).

Now, I never succeeded to see structure in whereisit, yet I've been using it for a while and tried several times to target this.

Now, I got a new IDA3.15 (the cracked version, not the full) to play with, which seems handier in some fields, and I was eager to give this another go as it might shed some new light on the, for me hard, whereisit 3.*.

I never thought the day would come I needed to prove worthyness and l33tness on a HCU board. *snif* :(

this is all so silly, please aide

thanks

btw: maybe I should stick to the same nick for some time
evaluator
12-06-2001, 02:11 PM
Hey!

I unpacked your:) WhereWasIt!
And here also (as in DigiSecret) activated special ASPR-trick.
Thanks, for point!
So what help you want?
riPPadoGG
12-10-2001, 04:00 AM
Hi,

Did you manually unpack or use some tool??
Please explain how you did it..
I having all sorts of trouble with Asprotected programs..

regards
riPPadoGG
+SplAj
12-10-2001, 07:33 AM
hi mnk et al

Please don't think you have to prove anything here EXCEPT the willingness to learn.

If you look back only a few months you will see that evaluator came here as a newb, got some pointer......and off he went and ripped aspr to bloody shreds :D

NOW he is the aspr reference manual :D

So please DO refer to the tuts as a starter on manual unpacking. We can help you if you try and come back with some progress report. It is a great joy to get a running rebuilt target de-aspr'd. However, please be aware that you are not just defeating aspr, but the original clever, resourceful programmer himself - HINT ;)

Pick an easy target to just dump and rebuild, like the 'glocksoft' stuff. eg. AAAnalyser. At least these nice targets run still as shareware without aspr wrapper time-check.

Delve deep, keep notes and make a LOT of /screendumps to refer back to..........

Good luck

Spl/\j
evaluator
12-10-2001, 09:44 AM
Wow!
After unpacking and testing I deleted my ArtWork:(
OK. Here I submitted idata.bin. Paste this at 2FC000
of dump. Values for PEditor
IT 2FC000, size 1E0
OEP 002A7B2C

But! Proggie will crash because special check.
Try crack callers to FarJumps FF25ECC36F00 & FF25C4C46F00
Soon I will write crazyTut about WhereHasShe and others..


Help on toshiba AAC ( mpeg 4 audio ) encoder / player
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help on toshiba AAC ( mpeg 4 audio ) encoder / player
PDA

View Full Version : Help on toshiba AAC ( mpeg 4 audio ) encoder / player

Nitch
11-30-2001, 09:53 AM
Hi all ...

http://ccollomb.free.fr/Toshiba-full.rar

I tried to remove serial and other stuffs from this prog ( the serial inside archive is mine so please don't spread it )

The program uses a dll which is crypted and reencrypted after execution, it also uses a system driver spssys.dll

I can't trace with sice but the proggy runs perfectly with sice. Icedump and frogsice didnt help.

Hope you can help me, regarding I plan to remove SDMI limitations afterwards ...

Inside this we can find such code :

mov eax, dr6
or eax, 00002000
mov dr6, eax
mov eax, 00000000
mov dr0, eax
mov dr1, eax
mov dr2, eax
mov dr3, eax
mov eax, dr6
and eax, FFFFDFFF
mov dr6, eax

or this :

CLI
mov EAX,CR0
mov [ebp+0x08],EAX
and EAX,0xFFFEFFFF
mov CR0,EAX
mov EAX,[EBP-0x0C]
mov [ESI],EAX
mov EAX,[EBP-0x08]
mov [ESI+0x04],EAX
mov EAX,[EBP+0x08]
mov CR0,EAX
STI
DakienDX
11-30-2001, 11:18 AM
Hello Nitch !

I looked at the code.

Mov EAX, DR6
Or EAX, 00002000
Mov DR6, EAX ; #1
Mov EAX, 00000000
Mov DR0, EAX ; #2
Mov DR1, EAX
Mov DR2, EAX
Mov DR3, EAX
Mov EAX, DR6
And EAX, FFFFDFFF
Mov DR6, EAX ; #3

Cli
Mov EAX, CR0
Mov [EBP+0x08], EAX
And EAX, 0xFFFEFFFF
Mov CR0, EAX ; #4
Mov EAX, [EBP-0x0C]
Mov [ESI], EAX
Mov EAX, [EBP-0x08]
Mov [ESI+0x04], EAX
Mov EAX, [EBP+0x08]
Mov CR0, EAX ; #5
Sti
The BD Flag is set. This means that any access (read/write) to a debug register (DR?) will cause an expection.
A move to DR0 causes an expection and the affiliated handler will be called.
The BD Flag is cleared again so an access to any debug register won't ransom an expection any more.
The WP Flag is turned off (Write Protect). I presume that the memory area at [ESI] and [ESI+04h] isn't supposed to be written by the program. So you can guess what it does.
The original value of CR0 is restored.

One more thing is on my mind. Some people here aren't as honest as they appear to be. People from cracking groups are reading this pages just as you. So if you post your serial numbers and full programs here, they're most probably to appear the next day on many warez pages.
Nitch
11-30-2001, 12:38 PM
Ok I removed the serial, I don't want any lamer to play with it, I just intended to show my purpose was to crack the program and not use it.

About your advices I understand it BUT

1/ I was able to trace between #2 and #3 with sice without any problem

2/ You was right, softice was killed in the ESI writes

Whats shall I do ? What can I do ?
Kayaker
11-30-2001, 12:42 PM
Originally posted by DakienDX
[i]One more thing is on my mind. Some people here aren't as honest as they appear to be. People from cracking groups are reading this pages just as you. So if you post your serial numbers and full programs here, they're most probably to appear the next day on many warez pages. [/B]

I didn't check, but if this linked to a serial number it's a liability to us. I took the liberty of removing the link. If anyone objects or you want to change the file to get rid of the serial/crack, then just tell me.

PS, just noticed your post Nitch, but had already deleted the link, sorry. If you want to edit your 1st post with the new link then go ahead.

Kayaker
Nitch
11-30-2001, 12:52 PM
Sorry again, I am a beginner with this forum :D
DakienDX
11-30-2001, 01:54 PM
Originally posted by Nitch
1/ I was able to trace between #2 and #3 with sice without any problem

2/ You was right, softice was killed in the ESI writes

Whats shall I do ? What can I do ?

SoftICE uses the debug registers itself. So you can trace the code, but the expection which is expected to happen (and probably also needed somehow in the decryption process) will not happen. If the program clears the debug registers you can use BPR to set breakpoints or BPX if no integrity checks are made. If you say SoftICE runs with the program then the values written to [ESI] and [ESI+04h] must be restored somewhere.

The main goal should be to find the place where the serial is checked. Or do you want to run the program without any serial? Finding out how the DLL is decrypted is one goal on the way to the main purpose.

Sorry, I can't give you any more clues at the moment, but I had still no time to check the target.
Nitch
11-30-2001, 06:54 PM
I understand about sice troubling what happens.

Well, I tried to find where was the serial first because I plan to remove SDMI limitations too.

The problem in the dll is that it is crypted and recrypted after execution.

I really don't know where to start.

Sice is killed when tracing the write on [ESI] I mean sice is disabled and the program continues to run.


Is there any unpacker for Asprotect 1.2 ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is there any unpacker for Asprotect 1.2 ??
PDA

View Full Version : Is there any unpacker for Asprotect 1.2 ??

TrixMan
11-30-2001, 04:56 PM
Is there any unpacker for Asprotect 1.2 ??
When i'm trying to unpack the app with 'guw32b8' it saying "invalid exeption"
Or is there a way to unpack it some other way?

Thank's

TrixMan
^DAEMON^
12-03-2001, 03:14 AM
yes there exist one, but not available to the public... sorry!

^DAEMON^
crispeater
12-03-2001, 06:39 AM
I thought Caspr (+GUI) worked on asprotect up to 1.2?

Although it ain't working on ver 1.2x/1.3 (as id'd by PEiD) released August 2001.

Try www.programmerstools.org and

www.exetools.com
TrixMan
12-04-2001, 02:07 PM
Hi :)

Thank's for your help, i manage to unpack it with Caspr in
"dos mode" not with the GUI.
But stil it's protected with some other protection, in GUW32
i get the message "Detected cryptor: Armadillo??".
I'm trying to unpack it with unpacker for Armadillo with no
sucsess :(
Is there any way to 'see' in the code whith what kind of protector they are using ??
I also have problems to open it in dasm but not in ida i
think they have som kind of anti debugging code,
how to know ??
And my TRW2000 is behaving strange.

TrixMan
CoDe_InSiDe
12-04-2001, 03:16 PM
Hi TrixMan,

"Is there any way to 'see' in the code whith what kind of protector they are using ??"

Well, you can recognize it by looking at the Codes at the beginning of the Packer Code ;)
For example you "can" recognize ASProtect by looking at the Entry Point for something similiar to this:

68 xx xx xx xx E8 01 00 00 00 C3 C3

Or (For ASProtect) just Trace/Breakpoint and see if it Decompresses somekind of Delphi program stuff hehe ;)
Hope this helps.

Cya...

CoDe_InSiDe
TrixMan
12-05-2001, 06:00 PM
Hi !

First it looked like this
68 01 40 49 00 C3 AA 80

And now it looks like this
53 55 56 57 6A 2A 8B DA

I don't know how to proceed.
This is a game <5M and the protected file is 237 kb, if somone is
interesting to have a look i can mail the file or the link to the game.

TrixMan
^DAEMON^
12-06-2001, 03:30 AM
post the url here....
TrixMan
12-06-2001, 01:11 PM
Well here it is

//xxx.alawar.com/BDwarves.exe

TrixMan
Gamer
12-08-2001, 10:29 AM
Why Don´t you pay 25$ and you have a game with
no nagscreen ??
Viper
12-08-2001, 02:14 PM
Correct me if I'm wrong but wouldn't that defeat the purpose of what this forum is about?
TrixMan
12-08-2001, 06:31 PM
Hi !

It' not the money who is the problem, it's how I gonna
bee able to unpack the game and then reverse it.
It's more a challenge to me and a way to get
some "know how" out from it.
Over the last week I got no further in my attempt to reverse it.

TrixMan
trix_man@hotmail.com
riPPadoGG
12-12-2001, 12:24 AM
Hi..
Why don't you just unpack it manually??
It is easy..(ALMOST)
You will learn new things..
and you will be satisfied..
regards
riPPadoGG


Help me hide SI (win2k sp1) please...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help me hide SI (win2k sp1) please...
PDA

View Full Version : Help me hide SI (win2k sp1) please...

drak0
11-30-2001, 08:01 PM
Hi,

At work I use Borland Builder (with Visual Slick Edit as my editor).. I've recently had to install SI for some driver debugging....

After I installed SI, the VBox protection of VSE kicks in and won't allow VSE to run :(

I remember a while ago, I had some macros in my winice.dat file that I could call to effectly hide SI from most (all?) of the ways to catch it. These macros were based on PNTice (i think)

I've tried NTall and haven't had much...

So, can anyone help me out with this... Borland's editor is VERY VERY VERY bad!

Thanks :)

-drak0
_Servil_
12-01-2001, 04:37 PM
try Programmer's tools link at the bottom of th epage, there's several SI-hiders in the debugger section, didn't try so far however some could work 4U


can anybody help me for reversing delphi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > can anybody help me for reversing delphi
PDA

View Full Version : can anybody help me for reversing delphi

erdem2001
12-01-2001, 05:38 AM
I am trying reverse Delux Vb to delphi recoder it will found on
hxxp://wxw.deluxsoftware.com/ demo version but it limited 200
lines and it cant save recoded files. Please help me to overcome
this limitation.


Geforce / w2k & softICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Geforce / w2k & softICE
PDA

View Full Version : Geforce / w2k & softICE

c01d
12-01-2001, 10:13 AM
Been reading the threads on this topic - no real solution seems to have been hammered out - just wondering if there is an update to this issue?

I have found this: "Any problems should be resolved by upgrading to SoftICE version 4.05 or later. If this is not possible, try using the 5.xx series of Detonator drivers"
source: http://www.geforcefaq.com/faq.cgi#sw:app:softice:probs

I really dont want to use these drivers :(

/edit I have tried using the latest Windows XP/2000 Drivers(v21.83)
roocoon
12-02-2001, 01:02 AM
The Softice that comes with DriverStudio works fine for me (Win2K, TNT2, latest Detonators). Not a GeForce card but at least the same drivers.
Anticode
12-02-2001, 08:41 AM
You can get newer Detonator driver (v23.10 ) from h**p://www.guru3d.com/files/pafiledb.php?PHPSESSID=&action=viewfile&fid=284&id=10
I have GForce MX200 and had no problems using softice with either versions though.


Quick Win programming constants interpretation ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Quick Win programming constants interpretation ?
PDA

View Full Version : Quick Win programming constants interpretation ?

Czerno
12-01-2001, 06:36 PM
Please , folk ,
What do you use for a quick reference to convert from numeric Wind*ws-message-numbers ( and so on ) to their SDK name ?

Any handy list of constants , sorted for our needs , around ?

By the same topic , I seem to have noticed a ref to some add-in
for the IDA-pro so it does the job for us - but I am not the organized type , did not write it down :(

Sure someone will help , for His ( whoever's ) sake !

Thx
--
Czerno
Kayaker
12-01-2001, 07:24 PM
Hi

I use API-Toolshed mostly to get constant values and their names, it's continually updated. You'll find it on google.

Kayaker
Aimless
12-02-2001, 02:36 AM
Try this:

win32asm.cjb.net

Site of Iczelion (PC member)

Select tutorials section

scroll down

Select api-constants.zip file

The best around, perhaps...

...Have Phun
Anticode
12-02-2001, 08:24 AM
Here is an idc script i constructed,
It creates a WindowsMessages Enum type
Czerno
12-02-2001, 08:48 AM
its all in the Subject :)
Snatch
12-02-2001, 05:46 PM
why not simply grab all of the header files for any current good c compiler. winnt.h etc... they do have all the constants


S-Ice - just freezes everything
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > S-Ice - just freezes everything
PDA

View Full Version : S-Ice - just freezes everything

temicro
12-01-2001, 07:27 PM
I hit Ctrl-D to bring up SoftIce and all it did was freeze all activity, including mouse(no window came up)...then hit F5 to return to Windows.....
Am I just slow? hehe
I'm a newbie to rev. engineering :D but think it's cool to modify programs, for any reason. I used to do a little on an old macintosh, but don't know much about doing it on a PC.

*goes to search forum to make sure this topic hasn't been covered* ;)

====EDIT====
(found it's my drivers)
always helps to search first...one thing though...what's this driverstudio stuff and where can i get it? :D

thanks...
temicro
12-02-2001, 02:38 PM
i got it working...i guess..i re-installed the latest drivers and restarted, got a blue screen... my computer "took a dump" or whatever :)
(first time it did that, i uninstalled Softice..hehe)

then when i got to my desktop, i hit ctrl-d, and the little screen came up with a bunch of gibberish :D

i have tutorials, so i should be ok for a bit.
Aimless
12-04-2001, 09:23 AM
Its impolite to talk to yourself.

But seriously...

You MUST be on NT or above.

And a good thing is to use the Universal driver.

And try to run softice MANUALLY, rather than configuring it to run as a service or at Boot time.

...Have Phun


help the moron
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help the moron
PDA

View Full Version : help the moron

sercher
12-01-2001, 08:53 PM
This is officially my first post. I hope to have a great future sharing and learning with everyone willing. I have one question I would like help with. I've explored fabias beautiful site and it interested me very much. Does anyone know of any fundamental sites created to help morons like me get started with my search to find the real internet. I am very willing and -- according only to myself -- very able to learn everything I can about searching the internet as vastly as I can. Any comments would help out. thanks and I'm glad to be here.

sercher:confused:
sercher
12-01-2001, 08:55 PM
sorry for mispelling your name, Fravia
Woodmann
12-01-2001, 09:16 PM
Howdy,

First you can look at some of the old essays to get a general idea.

Then you need to go to Searchlores.org.
Fravias new site.
You have picked an excellent subject to learn.
If you desire a challenge, send me a private message and I may be able to hook you up.

Peace, Woodmann


Driver Studio 2.5 and IceDump 6.024
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driver Studio 2.5 and IceDump 6.024
PDA

View Full Version : Driver Studio 2.5 and IceDump 6.024

Asassin
12-01-2001, 09:17 PM
Hi,

I just got the newest Driver Studio, since my old SoftIce didnt like USB hardware. The SoftIce which is included in DS 2.5 is 4.2.5.

Now I have the following problem. I can't get newest IceDump working with this SoftIce version it seems. I know that the w9xMe Version of IceDump 6.024 only supports SooftIce up to version 4.21.53, but is there any way to get it working for this version of SICE ?

This error occurs when I try to start Icedump for v4.21.53 : VXDLDR failed to load icedump

Greetings

Asassin


Hello!Everyone!I am a cracker of China!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hello!Everyone!I am a cracker of China!
PDA

View Full Version : Hello!Everyone!I am a cracker of China!

crackhl
12-01-2001, 09:18 PM
Hello!Everyone!I am a cracker of China!

My name is Crackhl.

crackhl[CNCG] Cai Niao Cracking Group
crackhl[BCG] Beginner's Cracking Group
crackhl[FCG] The Free Cracking Group
crackhl[CCG] China Cracking Group

Welcome to China Crackforum.
http://www.chat001.com/forum/crackforum/index.html

Who is a cracker of China too?
My OICQ is:9499515

I like crack very much.
I'm good at crack.

Thank you.
crackhl
12-01-2001, 09:29 PM
CNCG Cai Niao Cracking Group
BCG Beginner's Cracking Group
FCG The Free Cracking Group
CCG China Cracking Group

Welcome to China Crackforum.
http://www.chat001.com/forum/crackforum/index.html

Welcome to BCG Crackforum.
http://www.chinabcg.net/cgi-bin/lb5000/leoboard.cgi

Welcome to FCG.
http://www.cn778.net

Welcome to KanXue Studion.
http://www.pediy.com
Woodmann
12-01-2001, 09:29 PM
Hi,

What kind of crack do you like?

I actually prefer the crack from NYC, although I hear that crack from Detroit is pretty good.
I dont like Asscrack, its nasty.

Later
crackhl
12-01-2001, 09:31 PM
CNCG Cai Niao Cracking Group
BCG Beginner's Cracking Group
FCG The Free Cracking Group
CCG China Cracking Group

Welcome to China Crackforum.
http://www.chat001.com/forum/crackforum/index.html

Welcome to BCG Crackforum.
http://www.chinabcg.net/cgi-bin/lb5000/leoboard.cgi

Welcome to FCG.
http://www.cn778.net

Welcome to KanXue Studion.
http://www.pediy.com

My E-mail:crackhl@21cn.com
:D
Solomon
12-01-2001, 09:33 PM
We can't read your Chinese characters:D
crackhl
12-01-2001, 09:44 PM
In China,the best Cracking Group is CCG(China Cracking Group)

I like this crackforum.
The people are very friendly.
:)
Woodmann
12-01-2001, 09:54 PM
Hi,

Are china crackers called fortune cookies?
sercher
12-01-2001, 10:08 PM
thats the funniest thing I ever heard
JMI
12-02-2001, 12:05 AM
Crackhl:

Welcome to you and all new readers from China. Although your English language skills are far better than the Chinese languages kills of many of our readers, especially mine, you, and some of the other new Chinese members are being gently teased because of the use of the phrase "I like crack."

In english this is generally understood as saying
"I like crack cocaine," a drug that people smoke.

In english we usually would say "I like to crack or I like cracking." People would not ordinarily make fun of such a thing except for this particular meaning of "crack." Although everyone knows what you mean, it is something easy to make a joke about.

You and those you talk to on other forums might want to check out exetools.com, on the links at the bottom of the main page. I believe that Aaron, who hosts the site and the forum is also from china. They have many of the tools you will need.
crackhl
12-02-2001, 11:48 PM
Oh!I'm sorry.:p
Thank you.:)
My English isn't good.
Because I am a schoolboy in the middle school in China.

By the way.

In China the best Crackforum is KanXue Crackforum.
http://www.chat001.com/forum/crackforum/index.html

In China the biggest forum is LeoBoard Forum.
http://www.leoboard.com/cgi-bin/leoboard.cgi
peterg70
12-03-2001, 01:17 AM
I know crack requests are a big no no but what about advertising????

my 2c worth


help cracking PE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help cracking PE
PDA

View Full Version : help cracking PE

dipeshrestha
12-02-2001, 12:53 AM
I am newbies and just started cracking few months ago. i am facing problem cracking with PE executables. Please guide me through the way.
thanx in advance.
Aimless
12-02-2001, 02:31 AM
hello,

you will have to be <quite> specific on this board, if you want a reply. Your required assistance in cracking PE files lies in what areas? Crypto? compression? serial/reg? key files?...what?...you get the idea.

Also, it would help if you provided with the name of the application and showed us that you have *at least* tried to crack the same.

...Have Phun
dipeshrestha
12-03-2001, 12:08 AM
Hi aimless

sorry for being unspecific. actually i am cracking Download Accelerator Plus 5 (DAP 5) for days but i could not trace a program and find its reg serial. I used bpx getwindowtexta in
S-ice but...

please help me.
stealthFIGHTER
12-03-2001, 01:57 PM
Hello dipeshrestha,

I recommend you to start with something easier. DAP5 is a bit harder to defeat. (Maybe I'm wrong but as you said you're a newbie ... ;)).

Regards,
sF
dipeshrestha
12-04-2001, 02:46 AM
Hi buddy,
Actually a friend of mine had challenged to crack the DAP5 for him. so i desperately need to crack it however hard it may be. So please guide me through the step and help me to crack it.

Do u have any idea where to start from.

thanx:confused:
Aimless
12-04-2001, 05:04 AM
You will have to spell out your approach. The old approach of a "memory-echo" no longer works in carefully crafted programs.

Instead of trying to find a valid "serial/user" combination, I may suggest you actually search for, and disable the bad-boy jumps (conditional). Note however, that this will be possible if the code is unencrypted/uncompressed. If it is compressed/encrypted, you may need to identify/break/reverse the necessary compression/encryption using ready made tools.

Start easy. Try cracking Winzip 6.0 or above for easy "memory-echo" approach to the same.

...Have Phun


Here is a stuff up
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Here is a stuff up
PDA

View Full Version : Here is a stuff up

peterg70
12-02-2001, 01:40 AM
Guys.

Need some help. I have a crypkey wrapped exe. I was attempting to unpack it and i accidently clicked on authorise and lost my trial 7 days.

Does anyone know how to restore the 7 days trial. Have read mayrcri essay but that was older version.

If you want the name of the proggie let me know.

I have deleted all the 4kb files but still refuses to run.
scorpie
12-02-2001, 09:17 AM
Hello,

The solution I have done was to reformat the hardisk, but it is not elegant.

Sometimes ago, you mentioned that you succeeded in reconstructing the SKW. Could you kindly share the knowledge.

Regards,

Scorpie
peterg70
12-02-2001, 06:08 PM
I have all the calls to the Cryp95e.dll trapped and they answer with the correct answer as per the crypkey manual but still no luck. There must be a way to reset the program to give me a new trial. I patched the crypkey in memory to avoid CRC errors etc by changing the register.

Regarding SKW.exe If you need a copy of the unpacked i can email but the method used was to trace through the code until the IAT was decrypted and use procdump to dump the proggie. Then used revirgin to rebuild remaining IAT. Then patched the remaining crc check in the SKW.exe.

I haven't had the time to do much more than do a quick look at the exe. Still haven't registered the SKW.exe yet.

I have noticed more programs appearing with crypkey wrapping and site code locks. But there is a lack of good quality information around which details the method of operation. Wish i could contact duelist and get the source code for those keygens.

Oh by the way the proggie I was trying to get to work is paqrat Can someone have a look and possibly unpack the bloody thing. I keep getting errors cause i have installed too many crykey software on to the machine.

If anyone knows how to clean out the harddisk from any presence of crypkey let me know.

File path h**p://www.paqrat.com/
Registry
scorpie
12-03-2001, 08:46 AM
Hello peterg70,

Thank for the reply.

I would appreciate very much if you could send me the unpack SKW.exe. Let's see what we can do with that.

Bye,

Scorpie
ZenLoren
12-03-2001, 10:06 AM
Hi to all

Use Norton Ghost utility for future targets!

Well the info will be of NO use for your current situation, but will be helpful for *future targets*. Just in case if you are formating your hard-disk.

I'll explain briefly what this Utility does.

Genereally i create partition on hard-disk. C: D: E: etc... Install windows & all the minimum softxx that i might require to c:

Next i create an image file using Norton Ghost of the drive where we have install all programs generally C: & save the file to D: drive. Thats the reason for drives D:

Having finished doing this, i generally start installing the target soft... with 7 days or 3 hours etc... limitation. If i am enable to finish the work within the time period i load the image file stored earlier using the utility which brings back the earlier state of the machine & for that we don't have to reformat the hard-disk & need not reinstall the win9x....

Generally it takes 3-4 minutes on my machine to bring back the
earlier state of machine before the target was installed. Saves lots of time. Also the time taken depends upon the nos of softxx installed on your hard-disk & CPU speed.

Hope it will help you all for your future targets.
Well more info can be found using the utility.

Btw, I am using ver 5.1 of it (enough for me)
Latest ver is already out. Happy Searching!

Regards,
ZenLoren
treta
03-22-2002, 10:35 PM
Hi
I never used Norton Ghost, but from the description the same result
can be obtained (and much easear) with a virtual machine installed under vmware with the undoable option selected.
All you have to do is saying to discard changes and or operation system is virgin again. In fact you can use this feature to extend
ad infinitum your trial period.
Solomon
03-23-2002, 05:39 AM
Install it in VMWare and crack it!
treta
03-23-2002, 05:24 PM
Hi Solomon,

From your comment maybe you (or any other one) can tell me about something i haven't yet dare to try.
Is it safe to install softice under vmware?
You see, scice is suposed to run below the operating system, but
the os installed in the virtual machine is not the real os.
dELTA
03-23-2002, 09:26 PM
Yep, my friend tried to install SoftICE under VMWare, and never got it to work properly. :-( If anyone succeeded in doing this, please tell us all how you did. It would be very interseting to hear!


about RV and duplicated exports
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > about RV and duplicated exports
PDA

View Full Version : about RV and duplicated exports

evaluator
12-02-2001, 03:13 AM
Hi, Tsehp!
Hi, Solomon!
When I resolved IAT entries from CVv3.1 , interesting
fact appears. Sometimes same entries are called with
another names. For example: "GlobalAlloc" & "LocalAlloc",
"lstrlen" & "lstrlenA" and other.
Then I disassembled KERNELL.DLL and found:
this exports has same address.

My question:
What name will more right and will more compatible with
other OS(w2k,nt)? (my is WIN98SE)

Solomon!
If you have CVv3.1, please do for my this:
.resolve IT under your w2k and submit here IT.TXT.
Use this values:
IAT 001C9258
IAT SIZE 970
Thanks.
+SplAj
12-02-2001, 05:21 AM
hmmmm cv3.1 seems to change since I made my 'tut'......

anyhow here is my cv3.1 W2k resolved with IAT at 1st thunk 1A0230....

I have to d/l again now and check wtf :D

[/me edites 5 mins later : build is now 161 against my 156...]

check yer e-mail eval I sent you a nice challenge :D

Spl/\j
+SplAj
12-02-2001, 07:14 AM
eval

here is the latest (unconfirmed!) resolved W2K Sp3b3.051 for CV3.1b161 ......
evaluator
12-02-2001, 10:07 AM
Hi +SplAj!
Thanks for replay.
Shit! I have CV3.1.0.160.
Ok, so, what one is more right?

first case
7 001C9274 KERNEL32.dll LocalAlloc
15 001C9294 KERNEL32.dll lstrlenA
16 001C9298 KERNEL32.dll lstrcpynA
71 001C938C KERNEL32.dll lstrcpyA
72 001C9390 KERNEL32.dll lstrcmpA
86 001C93C8 KERNEL32.dll SetThreadLocale
87 001C93CC KERNEL32.dll SetProcessWorkingSetSize
108 001C9420 KERNEL32.dll IsBadReadPtr
201 001C95A0 GDI32.dll SetBrushOrgEx
376 001C9860 USER32.dll IsDialogMessageA
461 001C99B4 USER32.dll DestroyIcon
565 001C9B88 ADVAPI32.dll AbortSystemShutdownA
566 001C9B8C ADVAPI32.dll ControlService

second case
7 001C9274 KERNEL32.dll GlobalAlloc
15 001C9294 KERNEL32.dll lstrlen
16 001C9298 KERNEL32.dll lstrcpyn
71 001C938C KERNEL32.dll lstrcpy
72 001C9390 KERNEL32.dll lstrcmp
86 001C93C8 KERNEL32.dll AddAtomW
87 001C93CC KERNEL32.dll BuildCommDCBAndTimeoutsW
108 001C9420 KERNEL32.dll IsBadHugeReadPtr
201 001C95A0 GDI32.dll FixBrushOrgEx
376 001C9860 USER32.dll IsDialogMessage
461 001C99B4 USER32.dll DestroyCursor
565 001C9B88 ADVAPI32.dll CloseServiceHandle
566 001C9B8C ADVAPI32.dll OpenSCManagerA

Or both can be?
+SplAj
12-02-2001, 10:35 AM
565 001C9B88 ADVAPI32.dll AbortSystemShutdownA
or
565 001C9B88 ADVAPI32.dll CloseServiceHandle

duuuuuuuhhhhh ?

must be result of different builds ? but it looks like each 'build' is genuine own IAT......no 'pick+mix' allowed cv3.1b160 DIFFERENT from cv3.1b161 ;)

well all I can do is rebuild cv3.1b161 soon on both Win98SE and Win2K ....the wife will kill me for sure before I finish....:rolleyes:

BTW :D did you get the challenge :p

Spl/\j
Solomon
12-03-2001, 12:40 AM
hi

I tried CV v3.1 b161 on my Win2K SP0 build 2195 and I got different result. In Win2K, "lstrlen" is the same as "lstrlenA" too.

Here is my data:
OEP = 5B28A8
IAT RVA = 1C9258, length = 970

There are only 4 entries unresolved.

IAT RVA Addr value
1C93C0 5B1FAC
1C9410 5B202C
1C9480 F7C548 (this is GetProcAddress)
1C94D4 5B2060

The above 3 remain unresolved, coz CV seems to use ASProtect API to modify the corresponding IAT entry:

001B:005B20E8 PUSH EBP
001B:005B20E9 MOV EBP,ESP
001B:005B20EB PUSH ECX
001B:005B20EC XOR EDX,EDX
001B:005B20EE MOV [005C873C],EDX
001B:005B20F4 XOR EDX,EDX
001B:005B20F6 MOV [005C8740],EDX
001B:005B20FC XOR EDX,EDX
001B:005B20FE MOV [005C8744],EDX
001B:005B2104 MOV [005BC918],EAX
001B:005B2109 MOV EAX,004074E8
001B:005B210E MOV [EBP-04],EAX
001B:005B2111 MOV EDX,005B202C <--------- new addr value
001B:005B2116 MOV EAX,[EBP-04]
001B:005B2119 CALL 005B20A8
001B:005B211E MOV EAX,00407588
001B:005B2123 MOV [EBP-04],EAX
001B:005B2126 MOV EDX,005B1FAC <--------- new addr value
001B:005B212B MOV EAX,[EBP-04]
001B:005B212E CALL 005B20A8
001B:005B2133 MOV [005C8738],EAX
001B:005B2138 MOV EDX,005B1FAC <--------- new addr value
001B:005B213D MOV EAX,[EBP-04]
001B:005B2140 CALL 005B20A8
001B:005B2145 MOV EAX,00407360
001B:005B214A MOV [EBP-04],EAX
001B:005B214D MOV EDX,005B2060 <--------- new addr value
001B:005B2152 MOV EAX,[EBP-04]
001B:005B2155 CALL 005B20A8
001B:005B215A POP ECX
001B:005B215B POP EBP
001B:005B215C RET

I have uploaded the original setup package of CV 3.1b161 to yahoo brifecase to ensure that we are always talking about the same version.
h**p://us.f1.yahoofs.com/users/ab932d34/bc/software/cv3.zip?bcvm3W8AJqGcudJo

saved txt:
+SplAj
12-03-2001, 01:22 AM
hi guys

looks like tamo/alex have worked together on this latest cv3.1 b161.

1) as you mention the 'resourse' api are now redirected inside REGULAR code with no chance to auto trace with RV/imprec....

........I mentioned this new 'redirection' in smartwhois3.3 post a few weeks ago.....

2) also they changed the CRC/HASH algo into ripeMD whatever....

hmmmm nice

thanks for the update guys , thats crackers and protectors alike :D
evaluator
12-03-2001, 02:22 AM
1. TuMo;) have "developer license" of cASPR:)
2. Those "regular-code redirected API" is
trick for totally newbies. IAT entries are
overwriten by code. So you must simple
resolve IAT on OEP.
3. Lets make pause in CV and lets analyze
DigiSecret (also by TuMo). Here released
another cASPR trick. ok?
evaluator
12-03-2001, 01:13 PM
Ye-Yo!
1. Today dld new DigiSecret, "unpacked" && cr0cked
2. I found place where decripted ORIGINAL(!) export names.
So now WE can sure about correct export names!!!
SPLAJ! Can't beleave, you don't know about it??
3. As I understand, those "LockResource" & "FreeResource"
are free replacements. OK, SPLAJ!?
AND this replacements NOT works with DigiSecret!
I SIMPLE.... hihihihi. Guess, what I did!!

Solomon, would you like test my cr0ck0? Please! I am interesting
if my rebuilded IT will work under your w2k.
evaluator
12-04-2001, 08:07 AM
OK, job done!
Here are right export names for CVv3.1.0.161
(size=803328 crc32=F5444359)

001C9294 KERNEL32.dll lstrlenA
001C9298 KERNEL32.dll lstrcpynA
001C938C KERNEL32.dll lstrcpyA
001C9390 KERNEL32.dll lstrcmpA
001C97E0 USER32.dll RegisterWindowMessageA
001C9860 USER32.dll IsDialogMessageA
001C99B4 USER32.dll DestroyIcon
001C9B10 SHELL32.dll Shell_NotifyIconA
001C9B18 SHELL32.dll DragQueryFileA
001C9B2C SHELL32.dll SHGetPathFromIDListA
001C9B38 SHELL32.dll SHBrowseForFolderA
001C9B54 0025 KERNEL32.dll (ordinal,inW2K has names?)
001C9B58 0024 KERNEL32.dll (ordinal)
001C9B5C 0023 KERNEL32.dll (ordinal)
001C9B70 WINMM.dll PlaySoundA

Also, Solomon, if you stop program at OEP, RV resolve for you:
001C93C0 KERNEL32.dll SizeofResource
Solomon
12-04-2001, 08:21 AM
In win2k, the 3 ordinals are:

001C9B54 CompareStringA
001C9B58 CompareFileName
001C9B5C CommConfigDialogW

yes RV can resolve 3 modified entries at OEP, actually I just manually resolved them days ago:D

Thx
evaluator
12-05-2001, 03:34 AM
Hi, Solomon!

Disassemble KERNELL.DLL with Wdasm,
find ordinal(23-25) export references and
look if other export names presents.
Anyway, you can remove that names from IT.TXT.
BTW, can you compress and upload somewhere
for me KERNELL.DLL?

Have you checked DigiSecret?
Here finally activated cASPR's trick,
that is inactive in CV!
AND this trick is better then STUPID redirection
inside main code!
Also, did you found place, where cASPR decrypts
export names?!!

Hi, SPLAJ!
What about "CRC/HASH algo into ripeMD" you talk
and why we need it? You can't force CV to run?
i can:)
tsehp
12-05-2001, 03:40 AM
to resolve the duplicated exports, here's what we need :
an asm coder could do the following task :
in all notorious dll's kernel32.dll , shlwapi , user32 etc...
when rv loads, take all thos dll's exports and redirect them to new addresses inside the own dll by forwarding them for example :

export1 contains apix1 apix2
forward apix2 to adrx2 inside the own dll

the goal is to have for each export 1 address for 1 duplicate.

after this, rv will make the difference and take the real name, compatible with all platforms.

theOwl already did this when you launch icedump, it's pretty hard to do on w2k causes a driver is needed...
Solomon
12-05-2001, 04:18 AM
hi evaluator,

here is my kernel32.dll.
h**p://us.f1.yahoofs.com/users/5f65830d/bc/%ce%d2%b5%c4%ce%c4%bc%fe/kernel32.rar?bc_rkX8Angd3rTPk

my unpacked CV quits silently too. What's the trick? It's not a CreateMutexA/File CRC:(

I will check DigiSecret later, hope I can learn new stuff;)
evaluator
12-05-2001, 05:11 AM
Hi, Tsehp!
Hi, Solomon!

Tsehp, as I sad, I found "magic" moment & place,
where cASPR decrypts export names, so now WE ALL GOOD GUYS
can be 100% sure about this problem.

Solomon, CV exits because of SIMPLE FILE SIZE check!
At 5B3247 CALL returns current size in eax ,
5B324C compares to C4200 (original CV size),
5B3251 not jumps:(

So, ACCELERATE YOUR FANTASY!
If you failed, post again.
Solomon
12-05-2001, 07:57 AM
damn! It uses FindFirstFileA(wrapped by TSearchRec) to get the file size, that's why my breakpoints CreateFileA/_lopen/GetFileSize never get hit.

If I change the JZ at 5B3251 only in memory, it runs well. But if I change this in the disk file, I always get a "Unknown Application Fault" message box. Why? there seems to be no further crc check after this jump.

Thx for the reply:)
+SplAj
12-05-2001, 10:34 AM
dear eval

can you stop playing a me-myself-and-I tune and show us the notes ;)

What is this 'caspr' ???? ........the one by SAC ?????

I am interested in how you got round patching the cv3.1 b161 exe
to run.......... WITHOUT a loader ??? I'm sure solomon is too.

BTW the wife DID kill me, I say this with my last breath :eek:
evaluator
12-05-2001, 12:53 PM
Hi, SPLAJ!
Hi, Solomon!

Dear SPLAJ!
1. under word "cASPR" I mean ASPR. Little joke:)
Another joke for you: "SmartWhoWas"
Guess what program I mean!

2. of course, I can't kill terrible Tamos-protection
because I'm musician, not-programmer. But I have terrible
fantasy (musician)!
I compose funny&easy code... Later about it.

Solomon!
After you reverse that JS in memory and execute,
did you restore back this byte? (SPLAJ!!)
If you not restored and CV runs, this is very strange!
+SplAj
12-06-2001, 01:46 AM
OK i'm laughing at myself....

be careful with the word 'caspr' as this is not your copyright.
I was mistaken into thinking you used the :eek: CASPR :eek: auto-magic-unpacker and this is NOT allowed here on the RCE MB :p

The CV3.1 b161 was fixed with a SMC patch.... Solomon has the details. Now I see you did that too. I'm warming to you :D

I often resolve the IAT while EB FE at the OEiP. BUT I NEVER REALLY CONSCIOUSLY THOUGHT there would be a different resolve result than if you just let the target proggy run and then use RV/imprec......But now it's bloody obvious that a new anti tracing trick is to RE-RE-DIRECT the IAT into regular code as a SHORT TERM solution to our exploits, until Alexey comes out with a new version. It must be time , its been 14 months since the last ASProtect 1.2 :o

Ok please send me & tsehp what you found about this ORIGINAL place you are talking about....TIA.

Keep hard trancing my musical cracker :D

Spl/\j
evaluator
12-06-2001, 04:38 AM
I think, here is no reason for secure this,
because A.S. already knows, what happens. So:

***Start of crazy TUT for SPLAJ & TSEHP from just_Evaluator!***
Now very easy way for catch original IAT names in cASPR protection.
Target CVv3.1.0.161 (size=803328 crc32=F5444359)

As you know, after full unpacking in memory,
cASPR writes his own IAT. OK?
Lets make: BPR 5C9258 5C9BC0 (CV)
SICE breaks, when cASPR will try write his first
IAT entry at 5C9258.
at EAX we see value that will written at EDX.
hm, but-but-but what tries to hide ESI???
Tape: d ESI
SALUT!
Now press again F5. OOPS!
SICE breaks on second write attempt && you already
see second name.
So press F5, look at display and EnjoE!
Of course, special ASPR-trick names will not decrypted.
(GetCommandLineA, etc., this is another job:)
Also, when ORDINALs without name will decrypted you
will see at ESI register ordinal's value.
I attached two screendumps.
In addition:
1. if after bp you will trace little, you will
also find decryptor engine..
2. Before OUR action, print "RESOLVED.TXT" & check:)
***End of crazy TUT for SPLAJ & TSEHP from just_Evaluator!***

Tsehp! Beta draft, DO NOT DISTRIBUTE!!
tsehp
12-06-2001, 07:16 AM
I'm just disgusted, I didn't knew it was so easy...
I'll code an automate to do this ;)

ASPR usual way to build iat didn't seems to change a lot since a long time, before building rv I made an essay (look at the archives) with a small asm prog to rebuild iat.

but it's always target/protection/version dependent , but concerning a general iat rebuilder, this info just can't be used.

But always useful when our tools don't locate the api function name
evaluator
12-06-2001, 10:46 AM
1. When I use tracer with ASPRotected files,
aspr-engine(dll) lands in another(lower) memory
location. With S+ICEDUMP this dll lands in same
place as in clear windwz.
Suggestion: maybe if you will move tracer and thread dlls
in higher area (~30000000), this will not happens?

2. Will be good, if you add to IT.BIN production engine
"NO HINTS" option. So if we want, RV will create
IT.BIN only by export names (as IMPREC). Of course
except ORDINALS.
Shit, yesterday I during 1 hour was manually removing those
hints...

3. I read about "unSafedisc v2.40"! But failed for find:(
Probably this file can be protected with newest KKryptor
& will good for tracer test and for my hobby:)
JMI
12-07-2001, 02:10 AM
Great reading material. Keep it coming.

Evaluator:

Here's a copy of unSafedisc v2.40.10 for you to practice on.

Apparently file size it too large to attach. Sorry. Send me a PM with an e-mail address or upload address and I'll send you the file.
evaluator
12-07-2001, 02:10 PM
At "forums exetools" one good guy
uploaded for me "unSafeDisk".
UNFORTUNATELY v2.40.10 exe files are
NOT protected:(
Have you POXYLOCK?
JMI
12-07-2001, 03:26 PM
Yes!

Attached.
JMI
12-07-2001, 03:36 PM
By the way, Safedisk 2.2.2 is shareware and available "everywhere." You would download and "protect" "unsafedisk v 2.40.10 yourself and then take it apart. Just a thought.
evaluator
12-08-2001, 02:46 AM
Thanks, JMI!

But you made "little"mistake!
When I wrote:
"UNFORTUNATELY v2.40.10 exe files are NOT protected"
I mean not a "Safedisk" protection. I mean R!SC'c
terrible protectoin!
For example try debug "your" file "poxylok.exe"......
For more info about it, go to ^DAEMON^'s post:
http://www.woodmann.net/forum/showthread.php?s=&threadid=1897

I had "deprotected" "SafediscV2.30.31Rebuilder" &
"SafediscV2.30.31Dumper". In last one I probably missed 3 exports.
Now I will download "SafeDisk" and will test my work.
evaluator
12-08-2001, 08:50 AM
Tsehp!

Today I performed special test:
I loaded into RV Solomon's "resolved.txt" for CV under W2K,
(my sys-W98se) and I CV displays error:
CAN'T LOAD USER.EXE
This is simple because of those shit HINTs!
So YOU have real reason for remove HINTs.
Or at least add special option to IT.BIN production engine.

Tsehp! SPLAJ!
VERY IMPORTANT!

If I correctly understand, you & SPLAJ think:
these 2 special ASPR-redirects to little code inside
ASPR-dll are:
1. LockResource (xxxxC954 in dll)
2. FreeResource (xxxxC960 in dll)

If so, you are wrong since this trick is released!
Confirm if you think so and I explain...
evaluator
01-06-2002, 07:11 AM
just unpacked CVv3.2.0.171.
Seems TuMOS read this thread and changed file size ckeck!
Now program displays RUNTIME ERROR after about 75 second:)
I'm too lasy for find their trick, I manage in other way..
I will keep in mind TuMOS:)
+SplAj
01-06-2002, 07:50 AM
Of course they read it, they luv it that we discuss their nice CV+aspr here........keeps em bizzy codin..... better than sittin on their ass and playing quake3 on the office lan :D


IDA is a problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IDA is a problem
PDA

View Full Version : IDA is a problem

ON'error
12-02-2001, 10:53 AM
I want to eliminate the nag screens and disable the deletemenu api's. the 2nd i'Ve neVer tried and i dont know what breakpoint i should set for the 1st problem. the "normal" breakpoints doesnt work on this nagnag. can you help me?
mnk
12-02-2001, 07:37 PM
you're trying to crack IDA?

I'm no expert, but let me try to give my opinion on this:

you might eventually manage to remove the nag screens and maybe manage to ungray some menuitems, but given you're stuck here it seems unlikely you'll get further than this.

You should know IDA is not just like most programs around and does a more than fair efford in protecting itself from easy reversing.

The most inpacting imo is the fact that beside the grey items, the actual functions to eg produce a list file etc are physically not present in the code.

The most real, but far from easy, short and practical way of tackling this kind of problem would be to graft these functions from a very comparable full version you have access too into the limited program.

Far from easy, but it can be done as "Team DiSTiNCT" has shown by releasing a cracked IDA 4.15 demo version. They got it right on try two, as the first crack didn't allow creation of lst files.

If you're really into this may I suggest maybe, for educational reasons, finding the rar release of that demo and then also the 'good' (it messes up when I don't 'save my projects') crack "ida415cr2.zip" and compare the code of the original and the cracked version, with added routines.

This might look fun and challenging, but let me tell you from own experience you might have the tendency to overestimate your chances of success. :)

About 6 months ago I tried to graft over 35kbyte of code (>300 routines) into a different application and after three days and nights of relaying endless nested looping routines I just ceased and labeled "not worth it" even though I know it wasn't all that impossible. Maybe not in my league but for certain not worth the effords. :)

I might not have succeeded in my initial goals, but I did learn a lot and have gained a fair amount of problem assessment capacities.

good luck!
mnk
12-02-2001, 07:40 PM
for the ones wondering, that 35k of code consisted of the complete set of routines to write chunks of encoded wave data and some progress report display routines. :)


Help with mIRC stats
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with mIRC stats
PDA

View Full Version : Help with mIRC stats

Argoth
12-02-2001, 11:00 AM
Haven't been posting here for a while, but I came from time to time to read through the posts, but here's my latest problem.

Some friend of mine asked me to crack mIRC Stats 1.18. So I tried to do this. Bad luck, a keyfile is needed (called License.txt) to get it registered. First of all: I hate that. And then, I tried to disassemble it. No success here, only some RVA crap. Then SI didn't want to popup on OpenFile. So Im kinda stuck here, if only I could disassemble it well...

I'd appreciate it if anyone could have a swift look at it and maybe give me some clues. d/l url: http://home.wanadoo.nl/argoth/mIRC Stats 1.18.zip

Grtz all
Viper
12-02-2001, 11:47 AM
check the link it dont work
stealthFIGHTER
12-02-2001, 03:34 PM
Hi Argoth,

I see you speak about keyfile. Have you tried following (not only OpenFile) breakpoints?

ReadFileA
WriteFileA
CreateFileA (my fav. ... :))

Bye,
sF
ZaiRoN
12-02-2001, 04:28 PM
Originally posted by Argoth
I tried to disassemble it. No success here, only some RVA crap. Then SI didn't want to popup on OpenFile. So Im kinda stuck here, if only I could disassemble it well...
Grtz all

i have given him a (fast...) look.
the proggie is packed with upx and maybe this is the reason you are not able to disassemble it.
the OpenFile api is not imported by the proggie so SI didn't popup. use (as stealthFIGHTER said) CreateFileA and ReadFile;)

byebye,

ZaiRoN
Argoth
12-03-2001, 02:08 PM
Ok, thanx for your help. I'll have a look for a upx unpacker and I'll try to break on the other API


SPM license server
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SPM license server
PDA

View Full Version : SPM license server

2000hoschi
12-02-2001, 04:00 PM
Hi everybody ;-)

somebody experienced in cracking the SPM license server ? I've many troble with it, to understand how it works.....?!?!

Can somebody tell me a little bit more ? ;-)
Hoschi


CDILLA 2 reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CDILLA 2 reversing
PDA

View Full Version : CDILLA 2 reversing

taxerz
12-02-2001, 07:26 PM
Hello all,

Someon can help me to reverse CDILLA 2 ??
I'm working on NHL 2002 :D

So i f anyine have a tut on this protection please email or reply on the board.

Have a nice day.
crispeater
12-03-2001, 06:50 AM
You can use R!sc's UNSafedisc app. You'll find this, plus a tutorial at

http://codeseekers.com/gf/

Or are you wanting to do it yerself?

A certain MOD of this forum has written some detailed notes on SD2, also available at the above link. Just click on "safedisc tools"

Would you believe it! I've just checked that site and the links to the files is down!!

Mail me and I'll send all the info I've got to you

crispeater@hotmail.com


+ORC's missing lessons....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > +ORC's missing lessons....
PDA

View Full Version : +ORC's missing lessons....

koyaan
12-02-2001, 08:07 PM
i know he states in his tutorials that you receive them "if and ONLY IF" you mail +him back, but....

+ORC is disappeared, so nobody will ever receive this lessons again,

wouldnt it be the right thing if some people who have them make them public?

greets
koyaan
Bengaly
12-03-2001, 12:15 PM
hn..tsehp.cjb.net hsa all published ORC's essays...so
u sould find it there..
bye bye
Zero
12-11-2001, 04:53 PM
Try this:
h__p://w*w.reverse-engeneering.de

I jope you have a fast connection. The full release ist 46 MB ;-)

regarts,
Zero
JMI
12-11-2001, 09:13 PM
I believe that some of the +ORC tutorials remain "missing". However if you had taken the time to search, perhaps with google for "ORC tutorials," you would find a lot of information on what is available.

It would appear that the "reverse-engeneering.de" is offering what are generally known as ORC packs that include not only the essays, but the very old programs that are discussed. Most of these you don't need, but they are available. There are a number of sites that are offering the ORC packs and one in particular offers the ability to download the "packs" individually, rather than as a very large file. You'll find then at:

hxxp://home.online.no/~reopsahl/files/orcpaks.htm

There is a site that has the +ORC tuts in text format, only 197 K, including tut 9.4, without all the old programs attached at:

wxw.geocities.com/SiliconValley/Network/1598/tutz.html

There is also Chinese site at :

hxxp://www.ebook007.com/

that has most of the +ORC tuts in an eBook format, and its only 432 K. If you can't find that one. send me a PM with your e-mail and I'll send it to you.

If you have any interest in the old riddle about the disappearance of +ORC and the search for his missing page, try:

hxxp://www.home.aone.net.au/byzantium/orc.html

There really is alot of information out there if you are willing to search for it and take the time to learn how to do it. There are several good articles on the Fravia site with information about this skill/art.
koyaan
12-11-2001, 10:35 PM
i informed myself about orc and his tuts before posting this...
i got the complete orc-pacs...

what i am talking about are the lessons he claims to send the people who mail him back, since he is gone nobody will ever get them again, unless someone has already got them and makes them public...

the lessons i mean are:

Lesson 4.3, Time protections in Windows, advanced cracking
Lesson 4.4, Quiver protections in Window
Lesson 6.2, Funny tricks (some other)
Lesson 7, Intuition and luck
Lesson 8.3, How to Wincrack, a first conclusion (III)
Lesson 9.4, How to Wincrack, Hands on (4)
Lesson A.2, Advanced cracking (Internet-Dos)
Lesson B.1, Zen cracking (basic)
Lesson B.2, Zen cracking (exercises)
Zero
12-11-2001, 10:49 PM
well koyaan,

what about offering these tuts to the public ?

and JMI:
you are right that the paks contain useless stuff but sometimes there are newbies, who are glad to get the complete package with proggis like pooldemo.exe ;-)

regarts,
Zero
JMI
12-12-2001, 01:21 AM
koyaan, I intended no offense with my reply, but you had not indicate that you had found any of +ORC's tuts and were only looking for the "missing" and there are often posts here where someone has done no basic research before posting.

As I stated in my previous post, some of the series remain "missing" as far as I have been able to determine. But the 9.4 tut, How to Wincrack, Hands on (4), is not among the missing. I have a copy and it is, as I stated, available in the zip file at:

wxw.geocities.com/SiliconValley/Network/1598/tutz.html

The point I was making about not needing the older programs was simply that the essays themselves are available without a major downloading project for those of us on 56K modems or less. And of course, most of the tuts are actually available at the Fravia site here.

If someone wants the 9.4 tut I'm attaching it here. If anyone finds the others on the koyaan list I also would urge that they be made available.
koyaan
12-12-2001, 08:33 AM
at least one of them, great :)

and i didnt take your posting as an offense i just wanted to clear things up...

cheers
koyaan
Bengaly
12-19-2001, 12:04 PM
if you understand this, you will never ask again ;-))

http://www.woodmann.net/fravia/modernze.htm


How to crack P-Code?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to crack P-Code?
PDA

View Full Version : How to crack P-Code?

crackhl
12-03-2001, 12:16 AM
Who can?
riPPadoGG
12-04-2001, 09:07 AM
Hi friend..
Welcome to the quest..
I posted a similar question in the board few weeks ago..
Got only one reply. A pointer to the WKT site, they have a debugger. I have downloaded it.. Dunno what I'll do with it..
:)
good luck!!!
regards
riPPadoGG
Viper
12-04-2001, 07:24 PM
i downloaded the same thing
only it dont work on all vb p-code apps
Solomon
12-04-2001, 08:20 PM
There are also some p-code tuts on WKT site. Their v1.3 debugger works well on my Win2K.

Or you can search in google by typing "p-code"+"tutorial"+"crack".

for example:
h**p://www.woodmann.net/fravia/cb_vb6_1.htm
h**p://www.woodmann.net/zen/Tutorials/Cp375i.htm(get it from mirrors of CrackZ's site)

Besides WKT p-code debugger, there is a p-code disassembler called ExDec.

As far as I know, M$ never release an official VB Virtual Machine Specification(if you know pls tell me about it), so have to do some reversing to understand pseudo instruction.


A little project...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A little project...
PDA

View Full Version : A little project...

temicro
12-03-2001, 02:10 AM
There's a new program out called RAM Cheat, which allows you to change a value(ie: score in a game). The name is pretty self explanatory. It requires 2 codes(1 window) to register.

I'm a newbie, and would like to see the steps necessary to ~debug~ a prog similar to this one.

I'm not asking for a crack or anything, but maybe some hints. I want to learn this myself and I think this would be a good way....(along with reading tuts).
Let me know how long it takes for you experienced guys :D

You can get it here ===>> h**p://xmapper.tripod.com/ramcheat.zip
Cheads
12-03-2001, 06:09 AM
using softice and doing some serial fishing doesn't take long... if you know what api break on =)

Chead
Kayaker
12-03-2001, 07:36 PM
All right, I'm sure we can do better than that. This is supposed to be an instructional forum after all. I started to write last night that this might make a good beginner target to learn to follow the reading of a .cfg file, but that it had a wicked floating point register keygen routine. Easy to patch, more difficult to keygen. The true scheme seems to be buried a little deeper than what first appears.

It doesn't matter what level you're at, you always start with the basics. Virus check. Install monitoring (InCtrl5). Filemon and Regmon on first opening. Figure out where reg info is kept, limitatons, and devise an attack.

Read a registry entry:
RegCreateKeyEx do "dd esp.8"
RegOpenKeyEx do "dd esp.8"
RegQueryValueEx do "dd esp.xx"

Read a file:
CreateFileA do "dd esp.4"
ReadFile do "dd esp.xx"
_hread do "dd esp.xx"

Is the "apparent" reg routine really the real one?
Could the reg box be a crackers ruse and the real reg info is sent in another manner? (commonly with .reg files, could be any other email file as well)

Things to look for in this target:
Easy keygen - the first routine you come upon
Difficult keygen - any others ;-)

What is the //SICE check being used for? Does it do anything anti-sice?

Where is the info kept that calls up a nag box after several sessions? Can you patch it to *not* increment this 'counter'?
This nag routine opens up the .hlp file. Can you redirect the code so that it calls the registration box instead? (may be tricky)

There's a 2nd nag that pops up after a set amount of time (15 or 20 minutes). Where is the timer check for this one?

Cool Task:
Run APISpy32 on it with all the Kernel32 functions added for monitoring, but pause the trace until you select Manipulate Memory. View the output and get a succinct lesson on how to write to memory.
To do this successfully you need to specify a writeable memory address, such as the start of the .data section in notepad.
1. Setup and run APISpy paused until you're ready.
2. Create a new project in RamCheat and select the already running process notepad. In the bottom window select Edit/NewItem and specify the start address of the .data section (or elsewhere writeable) and a value in decimal.
3. Select Memory/Manipulate and start APISpy32 tracing just before you select Inject Preferred Value Now. Analyze the trace.

Now find a way to break into Softice on the *currently running* notepad process and confirm that your new memory value has been written.

Note that until registered you can only *decrease* a value not increase it, so you need to find a memory address that doesn't contain a zero. If you do try to increase the value you'll get another nice nag box. Perfect reversing target to search and destroy that nag routine and allow all values, without having to register of course ;-)

Cracking to find the serial, ho hum on to the next one, is NOT the final prize, it's only the beginning of a reversing session where you can rip apart the code to pieces and do anything you want. THAT is the Holy Grail imho :-)

Cheers,
Kayaker
Kayaker
12-04-2001, 11:41 PM
Temicro,

You say you want to learn, that's cool. Detail a bit what you've tried and where you're having difficulties and we'll see if we can help. The first step would be to visually find where and how your registration details are kept in the .cfg file.

Regards,
Kayker
temicro
12-12-2001, 01:58 AM
compared to an iceburg....i see the iceburg, but haven't touched it yet ;)
...
i need to get familiar with common terms/strings etc.. used, like jump, call, and all those :)

sorry it took so long to reply, been quite busy with a new job, and i installed winxp, so i'll have to re-install stuff


Tages
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Tages
PDA

View Full Version : Tages

Cheads
12-03-2001, 05:34 AM
Seems like there's a new copyprotection out (used on Moto Racer 3) see what they write about it here:

http://www.licensing.thomson-csf.com/news/tages_milia.html

Regards
Chead
blackcheck
12-09-2001, 11:18 AM
sweet...

do you have the cd ?
what language ?
can you copy it ?
did you crack it ?
Cheads
12-10-2001, 03:55 AM
I'm afraid I don't have the cd, just read about it =(

Chead
blackcheck
12-10-2001, 10:25 AM
http://www.cdrom-guide.com/ubb/Forum21/HTML/001775.html

http://www.rankourpics.com/gcw/games/pc_moto_racer_3.shtml

how disappointing...


Enabling menu item in delphi target ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Enabling menu item in delphi target ?
PDA

View Full Version : Enabling menu item in delphi target ?

MrSmith
12-03-2001, 07:34 AM
Hi,

I'm working on a program, written in Delphi4, where I would like to enable a disabled menu item (printing).
First I used Restorator to look into the resources. There the menu item was not marked as disabled and so I thought it must be disabled somewhere in the program code.
Therefore I used Dede to disassemble the Delphi program. I found the formCreate event for the form, which defines the menu and disassembled it. But unfortunately I didn't find a call which disables the menu item :-(

I'm not a Delphi expert, so how would the menu item be disabled in Delphi ?
Has it do be inside the formCreate event or can it be somewhere else ?
Is there a recommended way for enabling disabled menu items ?

Cheers,

MrSmith
4oh4
12-03-2001, 01:24 PM
The most often seen (for me) method of disabling/enabling menu items in delphi is as the menu item is being accessed. It's the "onclick" event if memory serves. Of course, as with any language, it could occur whenever the programmer desires.
stealthFIGHTER
12-08-2001, 10:18 AM
Hello MrSmith,

if you want, I'll send you test program that enable/disable the menu I've created. I've tried to examine it using DeDe and I think it should be clear to you :).

I think the menu is disabled on startup (in many cases) so there cannot be any 'onclick' action.

Regards,
sF


Enabling menu item in delphi target ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Enabling menu item in delphi target ?
PDA

View Full Version : Enabling menu item in delphi target ?

MrSmith
12-03-2001, 07:35 AM
Hi,

I'm working on a program, written in Delphi4, where I would like to enable a disabled menu item (printing).
First I used Restorator to look into the resources. There the menu item was not marked as disabled and so I thought it must be disabled somewhere in the program code.
Therefore I used Dede to disassemble the Delphi program. I found the formCreate event for the form, which defines the menu and disassembled it. But unfortunately I didn't find a call which disables the menu item :-(

I'm not a Delphi expert, so how would the menu item be disabled in Delphi ?
Has it do be inside the formCreate event or can it be somewhere else ?
Is there a recommended way for enabling disabled menu items ?

Cheers,

MrSmith
4oh4
12-04-2001, 02:14 PM
Just in case you didn't see it, I replied to your dup post in the newbies forum. I'm not sure how informative it is though.

I wish I had a delphi example (or could code one) with runtime menu disabling, but the closest thing I can give you is a link (hxxp://www.undu.com/DN961101/00000015.htm) which is really to the point and gives you a nice short example of this. I'm not exactly sure how delphi code gets translated into api calls and what not, if it's similar to vb or whatever. But I'd imagine that a "mniUndo.Enabled" translates into a call to EnableMenuItem or one of the other menu apis. Per the win32api help file:
"The CreateMenu, InsertMenu, InsertMenuItem, LoadMenuIndirect, ModifyMenu, and SetMenuItemInfo functions can also set the state (enabled, disabled, or grayed) of a menu item."

So what I'd suggest is to fire up apispy and filter on all the menu apis. It's a LOT quicker than sice to spy on runtime menu handling believe me. Then find out which of the apis is used to disable the menu item(s) in question and look up the params of that api. Then handle it from there. For example, if it uses EnableMenuItem, check the uEnable param for MF_DISABLED and/or MF_GRAYED (some people use both flags even though MF_GRAYED disables AND grays it....weird) and patch it out with an MF_ENABLED (0h I believe) and don't forget to add the constant of BY_COMMAND/BY_POSITION if the program uses one of those flags as well. I think kayaker or maybe it was Lord Soth wrote an excellent essay on menu reversing. If you can't find it I'll grab it off the rce cd and ul it for you.

Man, I didn't intend to type all of that but I got tired of seeing your post with lots of views but no replies. If I wasn't so unsure of my knowledge of delphi, I'd have gotten off my ass and given you a better reply the first time. ;)

Shit, now we've got two threads in two forums..... Ah hell, I'll leave that for the mods to deal with. :)


How to load Borland debug info into IDA (4.1.5 for example) ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to load Borland debug info into IDA (4.1.5 for example) ?
PDA

View Full Version : How to load Borland debug info into IDA (4.1.5 for example) ?

writer
12-03-2001, 02:03 PM
I have executable and companion .tds file with Borland style debug information, sources are not avaiable.
The question is how to load this Borland debug info into IDA ?
Aimless
12-04-2001, 09:21 AM
To my knowledge...

Ida 4.17 and above can load borland debug files.

Dunno about 4.15

Do this:

Go to datarescue
Download the 4.18 demo there
Try it in the same.

...Have Phun


Need help, asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help, asm
PDA

View Full Version : Need help, asm

ON'error
12-03-2001, 03:10 PM
.MODEL TINY
.CODE

ORG 100h
PrgAnfang: jmp Ausgabe

HALLO: db 'Danke für eure Hilfe!'
db 0dh, 0ah, '$'

Ausgabe: mov bx, cs
mov ds, bx
mov dx, OFFSET HALLO
mov ah, 09h
int 21h
mov al, 00
mov ah, 4Ch
int 21h
END PrgAnfang

hi, can someone tell me how to compile and link this code with
tasm or masm? i dont know which parameters i should use.
thanks anyway
Aimless
12-04-2001, 05:15 AM
Maybe reading the manuals...?
matthew
12-08-2001, 04:02 PM
I don't know if that will work with masm, but once you've got your code written properly... compile like so:

ml /c /coff proggy.asm
link /subsystem:windows proggy.obj

dunno if subsystem windows will work for whatever you are doing.

btw, use MASM.. its far superior to TASM.. and the reason most peeps in the cracking/virus-writing communities use it is for nostalgia. free tasm is so damn old ;) better off to use the new masm and the win32 api.

http://win32asm.cjb.net
DakienDX
12-09-2001, 07:59 AM
Originally posted by matthew
ml /c /coff proggy.asm
link /subsystem:windows proggy.obj

[...]

btw, use MASM.. its far superior to TASM..

The code ON'error posted is plain DOS ASM. So you can forget about '/coff' and '/subsystem:windows'. If you want to do anything for DOS in MASM you need MASM for DOS, which is not included in MASMv6/MASMv7 from win32asm.cjb.net and not available freely. (you can have it for $19.99 from Microsoft if you're a registered user of VC++)

Yes, read the manuals. This is about reversing, not compiling.

MASM is only better in two categories over TASM. Have you ever tried to write a VxD with TASM?
TASM takes members of 'Struct' as global if they don't start with '@@'

TASM has a MASM compatible mode, MASM is incompatible with TASM source.
CrackZ
12-09-2001, 11:20 AM
I used TASM.

tasm filename.asm
tlink /3 /t filename

Generated a .com without any problems and works as expected when you run it.

Regards

CrackZ.
DakienDX
12-09-2001, 11:37 AM
Here're my config files:

[TASM.CFG]
-iC:\TASM\INCLUDE
-m
-ml
-q
-zn

[TLINK.CFG]
-LC:\TASM\LIB
-3
-c
-C
-d
-x
-yx+

[TLINK32.CFG]
-LC:\TASM\LIB
-c
-x
-V4.0

This files must be located in the TASM\BIN folder. I'd never had any problems with them.

".MODEL" and ".CODE" are from MASM, in TASM it's called "Model" and "CodeSeg". This shows again that TASM is compatible and MASM not. :)
B-Boy
12-09-2001, 05:04 PM
Originally posted by DakienDX

MASM is only better in two categories over TASM. Have you ever tried to write a VxD with TASM?
TASM takes members of 'Struct' as global if they don't start with '@@'

in ideal mode, tasm can handle several structures with different member variables of the same name.

bye
B-Boy
DakienDX
12-10-2001, 11:28 AM
Originally posted by B-Boy
in ideal mode, tasm can handle several structures with different member variables of the same name.

Yes, but in Ideal mode TASM isn't MASM compatible any more. Because all WINDOWS.INC files use "xyz Struc", the Ideal mode isn't so good for this since it requires "Struc xyz".


how can i start cracking dos program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how can i start cracking dos program
PDA

View Full Version : how can i start cracking dos program

dipeshrestha
12-04-2001, 02:53 AM
Hi friends,

i had just think for cracking some dos program. but i dont know from where to start. bpx ***** dont work with it.
do i need any other tool than W32DASM and softice. please help me.

thanx
Aimless
12-04-2001, 05:12 AM
DOS works on INTs

Windows works on APIs

You get the idea.

To crack DOS, study INTs. Go go google and search for:

+"Ralf Brown" +"interrupt list"

The most comprehensive ever.

Try using Sourcer 7 (freely available on all major toolz site) and try using that.

Wdasm8.93 works OK for DOS programs. And yes, boot into DOS directly (bad luck if you are on NT or above) and run Softice for DOS.

...Have Phun
DakienDX
12-09-2001, 06:50 AM
I've merged the above two posts to one single thread

Hello dipeshrestha !

When debugging DOS programs, you must use DLDR.EXE to load them into SoftICE (located in UTIL16 under SoftICE directory). Turbo Debugger is also nice (better) for DOS cracking. SoftICE for DOS makes some trouble (http://www.woodmann.net/forum/showthread.php?threadid=2106) under DOS >6.22. I don't know about CodeView, Microsoft's DOS debugger, I've never seen it. IDA works fine on DOS programs, W32Dasm a bit strange (some work, some not). Sourcer might be good, but I've never used it.

I would suggest using SoftICE for Windows with DLDR to load and debug the program and IDA to disassemble.
dipeshrestha
12-10-2001, 12:11 AM
thanx DakienDX for ur valuable suggestion but where can i find the dldr.exe for softice i dont have that stuff in my machine. so pls help me.

Also give me help to find good essay on cracking dos application.

thank you:confused:
DakienDX
12-10-2001, 11:36 AM
Hello dipeshrestha !

DLDR.EXE is located in the UTIL16 directory under the SoftICE installation directory. If not you've probably forget to install it and you have to remove SoftICE and reinstall it.

I can't give you any special tutorials for DOS since DOS programs have nearly no rules what they are allowed to do. DOS programs usually check (if they do) very often if SoftICE is loaded. Don't trace into BIOS area too much. Study INTs as aimless said. Nothing more to tell. Just try it.

If you don't rename DLDR.EXE it you can even use it with ICEDump. It's syntax is self-explaining when you execute it. (you must be on DOS command line)
dipeshrestha
12-10-2001, 10:06 PM
Hi DakienDX,
Thanx for ur valuable suggestion. i will now try for it. if i face some problem i will ask for u . is that be OK.

dipeshrestha
riPPadoGG
12-10-2001, 11:10 PM
Hi,
This might help.. :)
Search google for Buckaroo Banzai tuts..
Also read ORC tuts..
regards
riPPadoGG


Softice breakpoints sometimes leave nasty int 3 !?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice breakpoints sometimes leave nasty int 3 !?
PDA

View Full Version : Softice breakpoints sometimes leave nasty int 3 !?

MrSmith
12-04-2001, 05:42 AM
Hi,

I'm using SI 4.05 under win98 and everything works fine. But I noticed that SI sometimes leaves nasty "int 3" instructions at the places where I originally put my breakpoints.
When and how that happens is difficult to describe, but whoever experienced it will know what I mean. The only way to get rid of these pseudo int 3 instructions is to reboot. My simple question is:

Is there a simpler, better way to remove those pseudo int 3 instructions ?

Many thanks,

MrSmith
JimmyClif
12-04-2001, 11:51 AM
Int3.. Int3.. Where are thou from ?

Oh well, SI sets an Int3 in your code ( in mem) at the place where you want to break.. when you finally break it writes the real bytes back to place. If you dump the prog it can happen that all your set breakpoints are still Int3's...

(Puh - shitty explication :( )

Anyway... before you dump you should always disable all your breakpoints using " bc * "

The only way to get rid of these pseudo int 3 instructions is to reboot
Did you try " faults off " ? All the prog should do is crash then... no need for rebooting.

..JC..
MrSmith
12-04-2001, 12:38 PM
> If you dump the prog it can happen that all your > set breakpoints are still Int3's...

No no, I'm not talking of dumping.

I'm talking about stepping through and setting breakpoints in a normal, unpacked program.
It happens like this: You set a bpx, run the prog (F5), that breaks and you press F5 again without removing the bpx. Now the prog continues and runs normal. If you then exit the prog and go back into softice to remove the bpx after the prog has terminated, then I sometimes come across this problem. If I now start the program, without SI, it crashes. And if I use SI to look for the reason (starting it with the SI loader, disassembling some code) I see that at the position where my original bpx was there is now the int 3 instruction left, which SI inserted earlier.

I "guess" when I start a prog by double clicking on it win98 doesn't always load it freshly from disk. If the prog just terminated win98 might keep it in memory for a while so that it can be restartet much faster if the user starts it again.
If this is true, then it might be that the manipulations SI did to the prog in memory (like inserting int 3) make trouble even when I start it again by double clicking. Rebooting helps because it obviously gets rid of everything what is in memory.

Phew, this was a lot of typing. I just hope it makes things clearer and not worse.

MrSmith
Js
12-04-2001, 01:52 PM
Hiya,
Its a fairly common occurrence with Visual C programs if you EXIT the program without disabling the breakpoints. Solution is usually as JC says, disable breakpoints or use bpmb address x instead of bpx address. Never had it happen in anything other than VC proggies.
regards
Czerno
12-05-2001, 05:48 AM
The rumor has it( sorry I don't remember whom to credit here ) that there is an elusive bug in S*ftICE ( some
versions ? some Win versions ? ) that could cause these
problems to creep in :
- a page , into which S*ice has put an int 3 ( bpx ) ,will
get paged to disk and ultimately written back to the
original .exe disk file without s*ice noticing it , so that
the EXE might be corrupted .

I have not yet noticed the phenomenon myself , but
just in case - I would advise debugging only A COPY
of an original exefile (or dll !) Otherwise , in case that bug is real - and it might well be a consequence of Win
9x's and/or NT's treatment of "file mapping" - then you'll
end up quickly with crucial files subtly corrupted :~(
in a sense that would be an example of "immanent justice" , an implied punishment for our "crimes" ;=)

Another hint : use a BPM X whenever you can instead
of BPX : I wonder why so many would-be hackers
still use 'int 3' type BPs as though they were still
debugging on a 80286 ( BTW , I am still operating 2 80286-AT clones , and I LOVE them - but that's another story ...) . On a 80386 + , "int 3" BPs are necessary
ONLY if the code you are debugging might "roam" inside
memory space , or once you have exhausted all the four
HW breakpoints ( clear or disable one of these others )

HTH

--
Czerno
^DAEMON^
12-05-2001, 07:22 AM
hmmm that was a pretty strange bug in older versions of soft-ice + combination of windows (i didn't came across that in w98se, yet) but i had the situation pretty often in w95...

as this previous guy already told u, better go and use bpms or bpr instead of bpx (or another debugger :)

^DAEMON^
Roy
12-05-2001, 11:17 PM
That is almost true howewer it wont corrupt original exe it only corrupts chashed one.

For example when you make some changes to the program (in memory) and the decide to backup it before aplying them to file you may find that file is already changed and backup is corrupted too, but if you reboot- original file will be fixed, but copy wont. ints also remain in file causing crashes when trying to run it.

Solution: make backup BEFORE starting your work then you will be able to overwrite corupted original thus refreshing chashe.

For safety reasons dont try to patch file after you used softice on it you may completely damage it by writing all that damaged content to disk.
DakienDX
12-09-2001, 05:07 AM
Hi everybody !

The search function did it again. We had this problem already in this (http://www.woodmann.net/forum/showthread.php?threadid=243) post some time ago.


System freeze on BPR in SIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > System freeze on BPR in SIce
PDA

View Full Version : System freeze on BPR in SIce

crispeater
12-04-2001, 07:02 AM
Can anyone shed some light on a puzzling phenomena for me?

In Sice (4.0.5), whenever I "BPR xxx:xxxxxxx xxx:xxxxxxxx rw" on an ASPROTECT 1.2/1.3 target, my system freezes. It matters not whether any "add-on" is running (icedump, icepatch, loader etc) and it happens every time.

Does anyone know why? And if ya do, is there any way around it?

It would certainly stop me scratching ma heed!

TIA
Aimless
12-04-2001, 09:18 AM
Could be:

* Anti-ICE code.

* Using Windows ME

* Code messing up Ring-0

* Maybe you need to try *without* the "add-in"

Alternatively...

Get an UNASPROTECT (or something like that) deprotector for the same. Run your exe through it. Work on the newly created uncompressed/uncrypted exe. Run reVirgin to make imports or use PDUMP32 to do the same.

...have Phun.
^DAEMON^
12-05-2001, 07:25 AM
hi dude, ever thought of virtualquery ??? :) think about that

^DAEMON^
crispeater
12-06-2001, 06:28 AM
Thanks for the replies folks.

No "generic" unpacker on public release will unpack this app for me (which is why I'm doing it manually!) and yeh, it most likely is anti-sice code. I just wondered whether this was a common characteristic of Aspro which could be quickly overcome.

It's not a major deal as the OEP is easy enough to find with IceLoad.
Anyway, it was more a puzzzle than a major prob, but thanx for spending the time to answer.

Catch yas all later.

Oh, and Merry Xmas! Ho Ho Ho ;)


Is it ME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Is it ME
PDA

View Full Version : Is it ME

peterg70
12-04-2001, 07:13 AM
Guys,

Is it me or do people simply not read what people write. How about answering what someone asks. Or offer ideas to lead down the path they asked.

Answers like don't bother its too hard for a newbie and Why Bother are not constructive or useful.
Answers like find OEP and unpack are a waste of bandwith. I know i have to find the OEP Its rule one of unpacking.

I have been asking question lately on crypkey. Yes i am a newbie to the task of crypkey. It pisses me off that this has stumped me badly but i want to understand the method of operation and the way the protection is implemented. In this way when they release a new version i.e. 5.2 5.5 and now 5.7 i am able to adapt easily since the protection is never revamped significantly to hinder the bypassing of the protection.

Back in the days of fravia. I worked with the guys working on the FlexLM system. I couldn't care less about changing JNZ to JMP etc. We all started to pool our information and to decryt it. Then tools were created to generate the keys etc for the program. Well crypkey is the same sort of program but no one seem to be interested with this?? This is causing it to be used more and more which means we will have problems later on.

Anyway take the above with a grain of salt (or some jim beam)

:o :o
Peterg70
Aimless
12-04-2001, 09:31 AM
Most persons here are newcomers (like it or not) including myself.

It gets quite boring to reply questions about commercial software when even the basics are not clear to a majority over here!!

Cause, cracking commercial crypto/compression software requires QUITE an effort (contrary to what THE tutorials would have you believe :))

Elder ones are just too busy or are not interested in YOUR specific area of interest as cracking commercial apps takes time.

You SHOULD try the cryptographics forum more often.

Email me if you want to start this exercise on a one-to-one basis. Maybe we can do it together.

...Have PHun
jsteed
12-04-2001, 10:10 AM
CrypKey is a completely reversible protection scheme. You can easily create your own key generator which will work with any Master/User code combinations. Since you have the SDK these are the general steps to follow: 1. create a protected program with the SDK (notepad.exe works well for this purpose).
2. Take the Site Key that the protected NotePad gives you (write it down since it will change each time you ask for it), and put it into the CrypKey license generator, (SKW.exe). You will get a Site Code that unlocks the protected program. All of this you have already done judging by your post.
3. Use SI to trace through SKW.exe as it converts the Site Key into the Site Code.
4. Disassemble SKW.exe and print out the sections of code that do this conversion (a stack of paper about 1/4" thick);
5. Now back in SI trace step by step through the conversion process annotating your printout. You will find that the Site Code is based on the SiteKey and a password which is contained in the User Code.
6. The whole process of generating the Site Code is completely reversible. In other words you can take a "trial Site Code" and reverse it to find the all of the parameters that the software author set (e.g. trial length, options enabled, etc). With that information you can generate your own licenses.
7. You will have to build your own license generator to do step 6. The whole process should take 1-2 weeks of evenings. It is a very good learning exercise in writing a key generator as it uses a very simple scheme.
8. Good luck.:)


Hi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hi
PDA

View Full Version : Hi

Lauriel
12-04-2001, 08:08 AM
Hi all, im a newbie cracker and I have been cracking now about 6 months and I have been stuck with ultraedit 8.0. I have done a "crack" to it, but It didnt work when I pathed the file..
So if anyone knows why, please tell me.

cheers.
:D
Lauriel
12-04-2001, 08:09 AM
Umm..
Aimless
12-04-2001, 09:14 AM
Whoops....

Are my eyes getting rheumetic ? Or is that DakienDX's logo ??

Anyways...

Ultraedit 8.0 is slightly advanced. May I suggest WinZip 6.0 or above for the same (as a starter??)

...Have Phun
Lauriel
12-06-2001, 02:40 AM
I have already cracked winzip 6.0 and some other versions...
h8er
12-06-2001, 03:48 AM
Ultraedit 8.0 is a packed program (i think Aspack) probably the patch don't work because the exe is packed so first you must unpack it... or try to patch the packed program (a bit more difficult)
+SplAj
12-06-2001, 04:10 AM
hmmm

I don't think UE is/was ever packed ?

Just set a bpr <memory range> rw on the bytes you want to patch..........this is called CRC. A system to check if the file has been modyfied by a virus called RCE.

Spl/\j


Try to unpacker this file!It from China Cracking Group!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Try to unpacker this file!It from China Cracking Group!
PDA

View Full Version : Try to unpacker this file!It from China Cracking Group!

crackhl
12-04-2001, 08:22 AM
Who can unpacker this file?
It from China Cracking Group!
It very very easy!
But you must let it run in 98/ME/NT/2000.

Download:
http://www.pediy.com/temp/Notepad.zip

If you finish doing it!:D
You can E-mail to Crackhl@21cn.com

Thank you!:cool:
Aimless
12-04-2001, 09:11 AM
Please.

Post these kind of things on the Mini-Project areas.

NOT the newbies area.

...Have Phun
crackhl
12-04-2001, 09:24 AM
I'm sorry.:eek:


GetType 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > GetType 2000
PDA

View Full Version : GetType 2000

JMI
12-04-2001, 02:43 PM
Kind of a stupid question, but my DOS is very rusty. I'm trying to use GetType 2000 (030) and there is no readme file. When I start the file in a dos window, the parameters flash by too fast to catch, except the last portion. I've tried the \p instruction which usually worked to stop scrolling, but it doesn't work here, apparently because the program has its own internal \p parameter.

Any help on how to stop the scroll or a copy of those parameters would be appreciated.
Fake51
12-04-2001, 03:20 PM
Just run command.com. This should open up a dos window. Then go with alt+enter, this should maximize the window. Then try and run the program again.

Fake
JMI
12-04-2001, 04:33 PM
Thanks for the reply but this is what I've been doing. The problem is that the paramater listing takes two screens and I can not stop the scrolling with the /p command which I usually use. I've managed to use a quick press of the "break" key to see the top of the first screen and it identifies a "/?" as a way to bring up this listing as the help file, but I still can't get it to stop with just the first screenful. I've tried reducing the font size and that didn't help either. Maybe I need to increase my screen resolution, which effectively reduces the objects printed to screen.

Any other suggestions?
JimmyClif
12-04-2001, 04:45 PM
Heya JMI,

You can pipe it into a file using for example dir in command.com

dir > result.txt

Regards,
JClif
4oh4
12-04-2001, 05:06 PM
I can't recall (it's been so long since I've used GetType), but can't you just use a "| more" as in most dos apps that spit out pages of info?
PHaX
12-05-2001, 06:00 AM
Hi folk!
Instead of "/p" what you could use on the original GT(W)
you now have to type "gt2 .. | more"
more is a Windows/DOS tools.

regards
PHaX


Some questions about HASP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Some questions about HASP
PDA

View Full Version : Some questions about HASP

neviens
12-04-2001, 03:01 PM
Hi all!
Currently trying to reverse NetHasp4 protected application. So far I dumped
all sections of app. with icedump, found
an OEP of protected exefile, realigned
sections, assembled together with hexed.
As I expected, it doesn't work, because I noticed something wrong with imports
table (.idata), .reloc section also sems unusualy long. Can anybody suggest a
right approach for IAT and relocations
repair (revirgin?), and what more tricks I can expect from this protection.
Strange, but amount of information about HASP 4 (or 5), is very little, unpackers also don't exist. Last one was
memohasp, what I found on the Net.
Is it because these are fully hacked, or
impossible to hack ?
TIA
Neviens.


CrackZ's Reverse Engineering Page
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CrackZ's Reverse Engineering Page
PDA

View Full Version : CrackZ's Reverse Engineering Page

Plot
12-04-2001, 06:49 PM
Hi
I cant seem to reach CrackZ's reverse engineering page, anyone have any mirrors?

I want the zendenc Flexlm tutorial :(
JimmyClif
12-04-2001, 06:54 PM
Check this link out ;)

http://www.woodmann.net/forum/showthread.php?threadid=2208

I guess you have to wait :-)

Regards,
JimmyClif
Woodmann
12-04-2001, 08:01 PM
Hi Plot,

I think I can find what you need. Give me a few hours and let me make sure it is small enough to email.

Peace, Woodmann
JimmyClif
12-04-2001, 09:50 PM
Wood,

Instead of emailing it right and left why not making it as a temporary download on this board ?

JimmyClif
JMI
12-05-2001, 12:25 AM
I have the tutorial. It is Nolflex3.htm. It was in the tutorial subdirectory of your Zen subdirectory and is only 11K. It is an article by Nolan Blender.

Woodman with your permission I'll either send it to him or provide a zip file on a follow-up post, at your choosing. Or maybe you've already sent it. Let me know.
tsehp
12-05-2001, 03:33 AM
it's already planned, a zipped file will be available here.


removing nag
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > removing nag
PDA

View Full Version : removing nag

dipeshrestha
12-04-2001, 09:18 PM
Hi buddies,
i have downloaded some crackme from crackmes site. One crackme is to removing the nag and it is coded in VB6. I have generate its keygen but i cant remove the nag from it. Please give me help to remove nag screen from the program. i had read many essay on that but it wont help

dipeshrestha
riPPadoGG
12-04-2001, 11:02 PM
Which crackme is it??

Please read your posting again..
It is too vague..
;)
dipeshrestha
12-05-2001, 01:10 AM
Hi friend,
actually i am giving only the example of crackme. i dont know how to remove the nag of any program however i can do serial fishing. so let me guide through the process.

thanx
npcracker
12-18-2001, 09:53 PM
Hey all,
why didnt some one reply. i am also waiting for that answer. help me removing nag

npcracker
m0sk
12-18-2001, 10:35 PM
Originally posted by npcracker
Hey all,
why didnt some one reply. i am also waiting for that answer. help me removing nag

npcracker

npcracker,

I don't want to sound too harsh, but this board's policy clearly states that you should first of all show us what you've tried. This way, people will see where you're stuck and will be able to give hints to get you on track again.

Well, maybe you can begin by browsing the ID-archive (link is at the bottom of this page!). And don't forget to have another look at the faq, link also at bottom of this page ;-)
riPPadoGG
12-19-2001, 08:00 AM
If this one helps you..

The usual way of removing a nag is..

Trace on.. (F10)from some starting point..
Trace on..

When you execute some call, You can see the Nag popping up..
Nag is shown by the "call"
Breakpoint on the call.. Go iside the call next time.. and so on..

Finally you will find a "call" which is the actual culprit.. ie if the call hadn't been there, the nag would not have been there..
NOP it.. ie replace the call with NOPs by opening the exe in a hexeditor..
--NOPing being the simplest method ;)

OK..
Get ANY tut on nags and proceed on a weak(an old Win3.1 exe perhaps?) target for start..
--Need not have to be a protected exe, remove the about box of an uprotected exe.. ;)
I am telling you YOU WILL SUCCEED WITHIN A DAY...
j!m
12-19-2001, 02:42 PM
Nag exercices

for those who want to start with some easy and interesting targets, i suggest you :

www.moraff.com (http://www.moraff.com)

this site is full of FREEWARE games, the only annoying thing is a nag screen displayed when you exit the prog that recalls you the time you have played the games.

As a beginning i suggest you bpx createDialogParamA and then look for the windows message handling routine that should not be far...

bye

j!m
npcracker
12-19-2001, 10:23 PM
Hi all,
thanks for all who had reply. actually i dont know any thing about removing nags. i dont know from where to start. now i will try from ur hint.

thanx to all

npcracker :D :D :D
riPPadoGG
12-19-2001, 10:37 PM
http://zor.org/krobar/

They have a section on nag tuts..


use INT 1 to detect SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > use INT 1 to detect SoftICE
PDA

View Full Version : use INT 1 to detect SoftICE

Solomon
12-05-2001, 03:04 AM
I saw a prog uses the following code(from SplAj several months ago) to detect debugger:

INT 1
CMP AL, 51H
jz SoftICE_not_found

int 1 is a single-step interrupt. I just can't understand the magic byte 0x51. Any description about it? Thx
tsehp
12-05-2001, 03:32 AM
int 1 triggers sice handler if loaded.
this ax value could have been set by the program's own handler.
But if sice is loaded, the program's seh handler will not be called, that makes the point.
Solomon
12-05-2001, 04:10 AM
I got it. thx:D


Crypkey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crypkey
PDA

View Full Version : Crypkey

peterg70
12-05-2001, 07:08 AM
Anyone who has the SDK can you PM me your Sitecode for the SKW.exe please i need to test something out.

You must send via PM
JMI
12-05-2001, 01:50 PM
peterg70:

Is there some reason why you are unwilling to search for your own copy? In a previous thread, started by you, you were provided with more than enough information on where you could find the SDK and how to obtain the password for Installshield. Are you unwilling or simply unable to do a little work on your own? I know the files are available on the "Korean" site that a google search would reveal, because I downloaded them from there myself. It is even on the ftp site of one of the links listed on this forum.

You have complained in other threads about no one helping you, but you do not show any indication that you have done anything to first attempt to help yourself. We learn nothing if we do nothing and simply expect others to give us what we want. If you show that you have made an effort and not had success, someone here, including me, will probably help you to the extent we can.

This is not intended to be a rant or necessarily personal, but is directed at the process by which we learn about this craft. Try first, and then ask, and as others have said, say what you know so far.

Good luck!
peterg70
12-05-2001, 05:17 PM
JMI

I thank you for the response.

I have downloaded the SDk pack both 5.5 and 5.7 and unpacked the skw.exe for the 5.7

If you read the above above you will see i asked for the sitecode not the authorisation code for the skw.exe. The site code is useless to anyone to unpack or register the skw.exe. The reason i need the number generated by the skw.exe licensing is to examine what the options are inside the skw.exe. To do this i need to get a number from someone elses HD since each time i generate a number on my machine i have the same encoding numbers.

Therefore if i can get someone elses SKW.exe i can then examine what encoding numbers are in the sitecode to better understand it.

Like i said in previous post i didn't ask someone to crack/keygen the product rather to point me in the correct direction.

Anyway thanks for the response
JMI
12-05-2001, 07:14 PM
peterg70:

Your follow-up post is much more informative about what you are doing and where, apparently you need help. Again, my purpose is not to be a critic, but to show where there is some inconsistency in your post that confuses the response.

First, you stated:

"If you read the above (thread) you will see i asked for the sitecode not the authorisation code for the skw.exe. The site code is useless to anyone to unpack or register the skw.exe."

Let me say that I am a complete novice at working with CrypKey, but the manual, at page 7 states that:

"Send us your site code via email, fax, or phone, along with the other information outlined in Section 1.4.1: Registering with Kenonic to Get Your Developer Keys."

So it does not appear accurate to state that the "site code" is useless for registering.

I assume that you are looking for the Developer Keys, generated after one sends the company the Site Code and they run it through their program to make Developer Keys. I would assume that the skw.exe has a routine to check some form of hash of the site code and the site key to determine whether it is "legitimate." Have you located that?

Did you notice that your skw generated a skw.key file, the first time you ran it? Did you notice, from the manual, the different language at the top of the "license dialogue box" when it is licensed and unlicensed? (See page 8). Maybe examining how that dialogue is changed will lead you to the code which checks the site key. Just a thought. Somewhere there is probably a "good boy-bad boy" jump that finds what you entered in the box as a valid site key to "license" the program.

Your post becomes confusing in the later portion where you ask:

"Therefore if i can get someone elses SKW.exe i can then examine what encoding numbers are in the sitecode to better understand it. "

Are you confusing the ske.exe with the site code you first requested? Is it the site code only that you want?

You also might want to check out a post I made on the General section of about November 11 or 14, about the Microsoft Activation Process that includes a reference to an article explaining how MS calculates site codes and it has links to tools to examine your own machine's M$ "site code", which might give you some understanding of the workings of the CrypKey's determination of that number.

Share a little more about what you think a different site code will permit you to discover and I probably will share my own code.

Have you considered simply altering the code generated for your machine to see whether it checks it after it is first determined. It might be calculated every time the program is started, but that seems unlikely.

Keep trying, your making a good start.
peterg70
12-05-2001, 07:46 PM
A few quick answers

1) I don't require the developers keys because any target you look at has them. I don't want to protect my programs with crypkey i want to remove crypkey from the program

2) I have registered the skw.exe file Thats not my problem. What i want is the site codes from someone elses skw.exe so i can decode them to examine what bits belong to PC and what are part of the general codes. Hell i might even register their skw.exe for them if needed.

3) it would be best that you look and understand the crypkey coding as it not comparable to microsucks product.

4) the skw.key is only part of the encryption process. The SDK is useless unless you understand the implementation of crypkey into the target.
scorpie
12-06-2001, 07:12 AM
Hello,

I am interested in Crypkey, but not yet dig deep enough. Here is my understanding about Crypkey:

In order to license a proggie (including SKW.exe), four (4) parameters are required:

1. Master Key: constant 44 bytes.
2. User key : variable length depends on password (point 4 below).
3. Application name: maximum 8.3 format
4. Password to be used in SKW.exe when generating the license.

Master key(1) and Application name(3) can easily be found once the proggie is "debugged" ("break on" site code or similar). The user key can also be obtained "not far" from (1) during debugging, so the only required information is the password for generating licenses. The password has some correlation with the user key (JMI is absolutely correct that this password has something to do with "hashing function" or crypto in general). I have mentioned to Peterg70 that I am not yet familiar with unpacking, so if I can get his unpacked SKW.exe, I might be able to help him.

His request about the site code can be avoided if he partitions the hard-disk, so more than one OS'es can be installed on one computer.

If Peterg70 contradicts his statement that he can give the unpacked SKW.exe to the ones who are interested in "learning" Crypkey, but he never does that (again JMI is right with his postings), then I will have to do it myself (will take more time until I am familiar with unpacking).

Bye,
Scorpie
jsteed
12-06-2001, 11:07 AM
Here are a variety of SiteKeys. This should give you all the information needed to build a key generator. The Site Codes vary each time a protected program is accessed because the computer's system time is incorporated into it.
peterg70
12-06-2001, 05:42 PM
Scorpie

Check your PM i sent it ages ago requesting an email address from you so i can attach the program.

I have progressed alot further since last time.

I have a skw.exe that is registered and have been able to register other peoples SKW.exe.

You are right about the password being required to generate passwords but All i need to generate passwords is the password , the company number and the Program ID number.

The company number is encoded inside the site code. so this isn't a problem. The Program ID can be also found inside the site code.
The Password is my next step.

The user key and Master Key are inside the target and are easily found by examining the parameters passed to the init_crypkey function. You can also find the filename as well.

The company number and passnum are passed as part of the ckChallenge routine. (Not sure what to do with these yet)

All in all starting to get to grips with this protection system. Just have to get the password from the system somehow.

Peterg70
scorpie
12-06-2001, 11:12 PM
Peterg70,

Nice reply and progress.

I have sent my e-mail address to you (kindly check your PM).

Thank and bye,

Scorpie
peterg70
12-07-2001, 07:03 PM
Scorpie you should have the unpack skw.exe by now. If not let me know.

Peterg70
scorpie
12-08-2001, 06:17 AM
Hello Peterg70,

Thank for the unpack SKW.exe.

I have done something on it, but frankly speaking it does not work on Win2K SP2. I will install on the other OS, and see whether we can "reverse" the password.

Reagards,
Scorpie
peterg70
12-08-2001, 07:16 AM
Would be good to reverse the password

Currently i am bruteforcing the password.

A note with the password there are collisions in the generation

i.e. the USER ID applies to multiple passwords

TRY AAAAA then up to AAAAG same USER ID

Also 5 and 6 letter password provide the same length USER ID
Same with 7 or 8 letter passwords

Most of my applications are 7 or 8 letter password and it can take a while to bruteforce especially when multiple USER ID

POST NOTE:
I decieded to relax and approach the user key password from another angle.

Further investigation has found that the encryption of the password works on 2 letters at a time of the password and will generate the same user key part everytime regardless of where in the password the 2 letters are.

So after removing the CRC wrapper from the user key and simple comparison with each pair of possible characters 00 to ZZ Found that there are only so many possible codes finds a useable password (may not be the original but it works.)

So instead of 24+ hours to find valid password now 2 secs decode

So thats the end of crypkey for me. Not much else to do.
If you need any pointers or info let me know

peterg70
peterg70
12-09-2001, 02:45 AM
Scorpie

If you need some more info contact me via email But i have done as much as i can with the crypkey.

I will be writting up an essay (maybe) on it but don't count on it.
But basically the following is required.
Get the SDK
Unpack the SDK (install password)
Unpack the SKW.EXE
Modify SKW.exe (two byte to change)

From target get the following
Filename
User Key
Site Code

Enter config into SKW.exe (FILENAME,PRODID,COMPANYNUM,PASSWORD)
Product ID and CompanyNum are encoded into the Site Code.
Password is Encoded into User Key (easy to find due to encoding collisions)

Generate any sort of license (unlimited, limited runs/day)

Done

I haven't played with network (floating licenses) but assume its the same.

Anyway CASE closed (unless i missed something)
scorpie
12-09-2001, 06:22 AM
Hello Peterg70,

Nice finding if you can patch the SKW.exe, so it can license any programs.

My progress so far is not much. I have Crypkey SDK 5.7, but it can not be licensed on Windows 2000 (there is an error message "Unknown Crypkey error..."). So, I can not do much on win2K. I switch to windows 98SE, and I can license the SKW, and your SKW.exe can be debugged. I can eliminate the "Site code from other company..." by patching two location in the SKW.exe, but the resulted site key is not valid. I will try to dig further, but your finding will certainly a good input.

I have notice that Microsoft Debugger or TRW 1.23 work fine for "unpacking" SKW.exe; don't you think so ?

I am looking forward to your essay. This is the first Crypkey essay with this kind of aspects.

Bye,
Scorpie
peterg70
12-09-2001, 03:25 PM
Scorpie,

I debugged the skw.exe with ollydbg on WinME. The unknown crypkey error is probably due to you deleteing the 4kb files it creates on your harddisk.

Unpacking the skw.exe was done using w32dasm(before I found ollydbg), procdump and revirgin.

If you patched the code in the two places then you shouldn't have a problem generating codes for the skw.exe. If you need more info email me on that.

I have yet to see an essay on accutally registering the exe using crypkey codes. Most essays have been bypassing the crypkey system. This way you don't modify the exe and you won't need to upgrade the license until crypkey changes the way it works.

Though i must say on reflection the protection is not to robust. Okay the key generating may use some advanced crytography but its not random so therefore there is a method to the madness.

peterg70
liu029
12-11-2001, 08:41 PM
It's easy to write a site_key generator. You don't have to reverse the SKW.exe. All the secrets are hidden in SDK. Furthermore, you don't have to get the password from your target, because its user_key is enough. All you have to do is:

1. get the user_key and site_code
2. get the levels and options
3. set version, copies, runs or days information
4. generate the site_key (call SDK's functions)

That's all. :)
peterg70
12-12-2001, 01:25 AM
I agree that is all that is required to do.

But why waste such a useful frontend which does all the checking and authorising for you.

And it more fun to decode the the system than rather program your own site code generator.

Call me lazy but why program something when i can reverse it ;-)
cqfan
12-29-2001, 10:14 PM
hi liu029

i have the SDK 5.5 and 5.7
i unpack the skw.exe

can you hint me how to use the sdk without the password to make a kegen?

thanks


softice config
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice config
PDA

View Full Version : softice config

cuculinn
12-05-2001, 01:43 PM
when i try to uncomment exports in my wince data and reboot, s-ice pops with "break due to page fault (0eh).fault+0000.or I get
"quit one or more memory resident program in auto exec.bak or config.sys or remove unnessasary utilities."when i do this then i get "vfat device initialization failed." can anyone out there help me ,i am green newbie with very little exp of s-ice but some with other debuggers!help would be much appreciated.should i use a boot menu?
DakienDX
12-09-2001, 05:02 AM
Hello cuculinn !

If you'd searched the forums (or only this forum), you would have found this (http://www.woodmann.net/forum/showthread.php?threadid=2136) post some days ago.

Your problem looks like the one described there. If it does not help, it could be possible that you've really to many programs loaded in CONFIG.SYS and AUTOEXEC.BAT. Then you've probably a new computer which you've never formated and so all vendor specified drivers are loaded at boot time. (DOS MouseDrv, DOS SoundDrv, DOS CDRomDrv, DOS [not needed anyway]Drv, ...)
You must remove as many drivers as necessary for your computer.

HIMEM, EMM386, DISPLAY, KEYB, MODE should be OK, but the rest isn't needed most of the time.


inline patching TElock 0.85f
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > inline patching TElock 0.85f
PDA

View Full Version : inline patching TElock 0.85f

-=elgura=-
12-05-2001, 03:52 PM
i've been trying to make a inline patch on a telock packed file but i can't find a place to redirect to my patching code.

i've search for byte-sequenses in a hexeditor without luck.
and when i trace through the code it is always changing and that's probably why i can't find it in a hex editor...but.

is there any permanent code anywhere where i can place the jump?


Maybe off-topic, but...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Maybe off-topic, but...
PDA

View Full Version : Maybe off-topic, but...

hobgoblin
12-05-2001, 03:57 PM
Greetings,
I need a good low level recovery prorgam. One of my disks gave me some heavy problems tonight, and I'm trying to recover some important files. Somebody have some good suggestions?
TIA,
hobgoblin
LaptoniC
12-05-2001, 06:26 PM
I suggest you to look at Tiramisu if your boot sector gone.It is very good recovery program.If only some files or directories gone I can suggest you FinalData (http://www.finaldata.com) and Directory Snoop (http://www.briggsoft.com)
Hope it helps.FinalData and Directory snoop is easy to fix.
Roy
12-05-2001, 11:23 PM
I suggest getdataback, now dont remember who made it.
It is the best (I tryed almost all available recovery software when my disk was formated) also you may try to use disk explorer if your disk is not damaged too much so you will be able to browse it almost as normal. (also it is the best file undeleting tool)


Smartcheck and Windows Me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Smartcheck and Windows Me
PDA

View Full Version : Smartcheck and Windows Me

h8er
12-05-2001, 05:29 PM
Is Smartcheck compatible with Windows Me?? When i try to debug a program it crash immediatly...


IDA v4.17 leaked / stolen.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA v4.17 leaked / stolen.
PDA

View Full Version : IDA v4.17 leaked / stolen.

Snatch
12-05-2001, 08:52 PM
Hiya all,

I wanted to put my 2c on this one since I've just seen it.

I'm really angry that someone could and would actually be so stupid as to steal this for a few MB's on a few lousy sites, and also totally compromise a legitamate end-user, its this sort of practise that really pisses me off in the scene and I hope some of the more intelligent people around here will agree with me.

Of course, all the lameasses who couldn't afford or be bothered to buy IDA will now be downloading like morons just to see a few extra features they didn't need anyway.

I'm disgusted.

Snatch.

Now for the truth: IDA v4.17 is coming to a dump site near you. It is the standard and has this key file:
<IDA Pro key file v4.1.7>
Roger Cross, 1 user, std, 7/2000

So it is your choice whether you need IDA Pro v4.15 Advanced or IDA Pro v4.17 Standard. Advanced just includes support for 10 more processors and controllers though that most people do not have any use for. So for I think everyone that reads this message, the choice is obvious which version of the tool is right for you. And who knows with a little ingenuity maybe you can turn a Standard version into Advanced by copying files from the older version. =].

Snatch
JimmyClif
12-05-2001, 11:59 PM
HUH ?

Sounds kinda familiar... maybe it's a deja-vu...

JClif
CrackZ
12-06-2001, 07:26 PM
Snatch : Just tell me which part of the word 'moron' you don't understand and I'll be happy to explain in minute detail exactly how it describes you perfectly.

In fact, we (many of us) remember your begging for months on IRC for recent copies of IDA, you never knew why you wanted it then, and from what I can see you don't know why you need it now (the real truth hurts eh?).

Never mind, yet another fucked IDA user, seems you couldn't even wait for zillions to get hold of it from the warez scene before posting this poor guys details all over a public msgboard, although since its sat on a pretty public FTP (you could guess the l/p with some thought) its probably not going to be long before someone leaks it.

Don't post a reply to this one, it might cause me to rant uncontrollably further.

CrackZ.
Woodmann
12-06-2001, 08:00 PM
Rant on !!
Snatch
12-12-2001, 10:52 PM
Originally posted by CrackZ
Snatch : Just tell me which part of the word 'moron' you don't understand and I'll be happy to explain in minute detail exactly how it describes you perfectly.

In fact, we (many of us) remember your begging for months on IRC for recent copies of IDA, you never knew why you wanted it then, and from what I can see you don't know why you need it now (the real truth hurts eh?).

Never mind, yet another fucked IDA user, seems you couldn't even wait for zillions to get hold of it from the warez scene before posting this poor guys details all over a public msgboard, although since its sat on a pretty public FTP (you could guess the l/p with some thought) its probably not going to be long before someone leaks it.

Don't post a reply to this one, it might cause me to rant uncontrollably further.

CrackZ.

Explain how I am a moron. Actually that won't be necessary. You need not make yourself seem any more childish.

I was begging for IDA? I didn't know why I wanted it? Wow. First off, I did ask a few people for IDA. Oh did I forget to tell you I got on my hands and knees and begged too? I didn't know why I needed it? Well I do recall explaining when anyone asked(I assumed people wouldn't need to ask unless they didn't know the features already themselves) exactly why whether it was automatic parameter identification or because the older version had a bug that I ran into often.

About the IDA it is an interesting copy it is not complete and noone is sure of its origin. Never made it to warez either so who knows. I encourage everyone to get it and figure out how to make it complete heh. And let CrackZ whine. Who cares? I don't.

Rant on, my man. Rant on. Maybe you will actually have something intelligent to say.

Snatch


windows ce rce tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > windows ce rce tools
PDA

View Full Version : windows ce rce tools

tsehp
12-06-2001, 07:20 AM
Hi,
I want to start a little section concerning emerging windows ce devices, does someone knows some related tools useful on ARM / StrongARM processor ?
Disassemblers others than ida ?
debuggers ? Eventually windbg included in platform builder 3.0 ?

tia.


win xp keygen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > win xp keygen
PDA

View Full Version : win xp keygen

mambox
12-06-2001, 09:49 AM
First!!
i dont ask where to find this.!

my question is only to know if the xp serial scheme got reversed to a keygen or any topic covering this?

i wasnt online since weeks so dont blame me for ignorance.

thanks
Woodmann
12-06-2001, 04:35 PM
Yes
JMI
12-06-2001, 07:53 PM
Don't know if there is actually a KeyGen for the serial activation, but haven't seen one in my searches.

There is one calling itself "win XP keygen", but it is actually allegedly a keygen for the CD serial. Actually it is only a lame dialogue box that contains 5 CD Key codes that the author got from somewhere. It doesn't "generate" anything.

I'm not sure why anyone would want to run XP, (just a personal view) but there are releases of the corporate version that are reported to work and which do not have the activation system in them. However the downloads are approx. 450+Mg, and at the speeds most of those sites operate, would take about 20+ hours on a 56K modem line.
^DAEMON^
12-07-2001, 01:58 AM
h**p://www.licenturion.com/xp/fully-licensed-wpa.txt

^DAEMON^
JMI
12-07-2001, 02:35 AM
mambox:

I would highly recommend that you make use of the search button at the top of the forums page. Typing "microsoft activation" into the box will lead you to several informative threads about this subject, including the article referenced by ^DAEMON^ ,which was actually posted here on 11-14-01. Using the site from that earlier post you will also find some tools for analysing some of the things checked by the activation system.

Going to google and typing "microsoft activation" and/or "microsoft activation protection" will get you many many more articles to review. Searching for "win xp kengen" would have lead you to this article:
mambox
12-07-2001, 10:56 AM
ok,thanks for the answers,i'll investigate all links now!
mambox
12-08-2001, 06:11 AM
seem kinda nasty...if they work by checking an internal database,who is probably the job,look effective waste of time.
My main was to modify the corporate serial so cant look like thousand installed corporate with same sn.
People on there are not stupid but do not change the serial in registry :)
activation jump in the next reboot.

anyway learned a bit how wpa worked.thanks
DakienDX
12-09-2001, 06:04 AM
At least in Win98 you can patch the verification DLL before entering the serial number and so it accepts all nunbers as input.
(Anonymity total :D )

I don't know if this works on WinXP or Win2000, but I had never any effort installing it. :) It works on ME too, but I don't know if Microsoft checks the serial somehow online. WinNT and Win95 have the old serial scheme, so they where no problem.
morlac
12-09-2001, 10:57 AM
Evening ppl,

Im running what appears to be a professional XP OEM Corporate full version. Thats what the 1.5$ cd says ;) . I've had no pop ups what so ever regarding activation or time limit. My question is how to tell the truth of what I installed?
Is it really what is says? an oem corporate full version
or is it a cracked version with newer files replaced from an old one?
What files is there to check as I cant see the wpa file that stores the activation data?

Any help will be appretiated.
oh, Has the M$ update site any prbs with progIDs being duplicated? Cause man, Im 90% sure that all the ppl in my country have the same serial :o .

Morlac
DakienDX
12-09-2001, 11:24 AM
Originally posted by ArthaXerXes
Indeed. I wrote an essay that describe the procedure. It is available on the Nexus, I do not remember which one it is though.
Possible, never heard of it, but when having reformated my HD there are not much possibilities connecting to the internet before you're forced to enter a valid serial. So a boot disc with HIEW 5.31 is your only friend. :) I don't know when I did it the first time, but I'm sure it was before I had a connection to the internet.

Originally posted by morlac
Is it really what is says? an oem corporate full version
or is it a cracked version with newer files replaced from an old one?
You can look at the CD. If it's not bootable some files have been replaced for sure. After that you could look at the CD image (you must make one). If it says something of NERO, ADAPTEC, ... in the TOC it's not the original. If it says CDIMAGE 2.46 by Microsoft, Redmond it's probably original.
morlac
12-10-2001, 11:00 AM
Originally posted by DakienDX

You can look at the CD. If it's not bootable some files have been replaced for sure. After that you could look at the CD image (you must make one). If it says something of NERO, ADAPTEC, ... in the TOC it's not the original. If it says CDIMAGE 2.46 by Microsoft, Redmond it's probably original.

Thanks man, Ill post back. After I check it.
oh, the CD is bootable.

Morlac.

M$ name is every where with their address as well.
So, I guess its original.
Still, any body knows which files are replaced in that cracked version were files are replaced by an older version?

Thanx


Packed programs and Imprts Table
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Packed programs and Imprts Table
PDA

View Full Version : Packed programs and Imprts Table

Ivanov
12-06-2001, 02:16 PM
I have been trying to understand how to reconstruct Imports in packed/encrypted programs.

Tuturials like +Tsehp's and others keep talking about IT and IAT.
Can any one explain me what is the diference ?

Is it that IAT is the Image Descriptor Table ?

Thanks
CoDe_InSiDe
12-06-2001, 03:44 PM
Hi Ivanov,

Here's some little explaination from a Tutorial from myself ;)

- Import Lookup Table (ILT)

An RVA (Relative Virtual Address) to an Table that contains RVA's to the names of the API's that belong to the *.DLL :)
The "Base Addresses" of the API's are not placed in this Table but in the IAT.
The Import Lookup Table RVA can be left empty.

- Time/Date Stamp

The Time/Date the IT was created by the Compiler.
The Time/Date Stamp RVA can be left empty.

- Forwarder Chain

Index of first forwarder reference.
The Forwarder Chain RVA can be left empty.

- Name (Of *.DLL or *.EXE)

This is an RVA that points to the Name of an *.DLL or *.EXE where this "Import Directory Table" belongs to.
The Name doesn't have to contain .DLL or .EXE (For example it can be KERNEL32).
The Name (Of *.DLL or *.EXE) RVA cannot be left empty (It can be left empty but then it means the IT has finished, because there are no more *.DLL or *.EXE to be Imported ;) .

- Import Address Table (IAT)

This is an RVA that points to an Table almost identical to the "Import Lookup Table".
But the difference is that in this Table the RVA's to the API's will be replaced with the corresponding "Base Addresses" of the API's.
The Import Address Table RVA cannot be left empty.

Try to find some document about the IT ;)
Hope this helps.
Cya...

CoDe_InSiDe


Rebuilding Missing Imports.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Rebuilding Missing Imports.
PDA

View Full Version : Rebuilding Missing Imports.

riPPadoGG
12-06-2001, 11:57 PM
Hi All,
I am back looking for help again.
I am finally trying to manually unpack a packed exe.

Yesterday I gave Aha-Soft Art-Icons a try. (My 1st try for that matter).
I used icedump to find the OEP. I am rather confident that I came along the right path till this point.

I dumped and fixed(dump-fixing, changing OEP) the exe, ran it again. It did not run. :)
Checked and found out that It was jumping to an INVALID region.
So fired up ReVirgin.

I started the original exe and traced to what appeared to me was the import table...
It looked like this...
mov [eax], al
jmp [some location]
mov [eax], al
jmp [some location]
mov [eax], al
jmp [some location]
mov [eax], al
jmp [some location]
mov [eax], al
jmp [some location]
mov [eax], al
jmp [some location]
.......so on...

The jumps above defenitely pointed to APIs.

I found out the start and end of jump table, Filled in the details in ReVirgin. ReVirgin worked for some time,
and came up with almost nothing.
ie, no imported funtion was resolved. :confused:

So, after all this garbage, the question is, Where have I gone WRONG?
Also, are what all are the other programs which will help us to rebuild the IT. I can spend time tracing. So it need not be that AUTOMATIC.

regards,
Thanks in Advance..
riPPadoGG

NB: I WANT TO UNPACK SOMETHING DESPERATELY THIS WEEK-END...
Viper
12-07-2001, 10:15 PM
I gave this a try [my first manual unpack too]
i used s-ice, icedump, peditor,procdump{didnt want to look to hard if i didnt have too, for the oep}:D
also procdump will give you a idea of where too look for the IT and the length. just take those values and put them in revirgin and do a IAT fetch then do IAT Resolver, you will have to resolve again

doing it this way i got more then 95% of the IT then i got stuck
anybody got a idea how to continue from here?:confused:
Js
12-07-2001, 10:26 PM
Hiya,
Looking forward to a +Splaj special on this myself.
tsehp
12-08-2001, 07:51 AM
the missing iat can be found in three ways :
1-use api emulator if it's a aspr
2-use the trace (it can reboot, so better save your stuff)
3-trace manually to locate the api

with those three methods, you can find every iat entry
riPPadoGG
12-10-2001, 03:53 AM
Hi Admiral,

I was just praying that someone experienced with Asprotect will reply. (experienced -> has played around with :p)

What is API Emulator? How do I use it?

Also, please not that, I could not resolve even a single API with Revirgin. Revirgin says that it is redirected/emulated. :rolleyes:
So I was guessing that API emulator should be used..

Please come up with some help, or a tutorial for the worst AsProtected program.. :)

regards
riPPadoGG

and HAPPY REVERSING
:D
Solomon
12-10-2001, 04:17 AM
In ReVirgin, just press "Resolve again" when you see some "redirected/emulated". Then these entries will be resolved.

If the API name is empty, right click on it and select "trace" or "API emulator" in the pop-up menu. In most cases these entries will change to "redirected/emulated/traced". You can press "Resolve again" now. If it is still empty/unresolved, maybe you have to manually resolve it with your debugger.

Sometimes you may get a GPF, so better save your work by pressing the "save resolved" button.

good luck

Originally posted by riPPadoGG
What is API Emulator? How do I use it?

Also, please not that, I could not resolve even a single API with Revirgin. Revirgin says that it is redirected/emulated. :rolleyes:
So I was guessing that API emulator should be used..
:D
evaluator
12-11-2001, 04:17 PM
Hello!

LETS AUTOMATE ASPR IT REBUILDING!

XXXXC960 is KERNEL32.dll GetCommandLineA
XXXXC90C is KERNEL32.dll GetModuleHandleA
XXXXC958 is KERNEL32.dll GetCurrentProcessId
XXXXC548 is KERNEL32.dll GetProcAddress
XXXXC928 is KERNEL32.dll GetVersion
XXXXC968 any Export from same DLL (I use FATALEXIT:)
XXXXC974 any Export from same DLL

in other version(new?):
XXXXC914 is KERNEL32.dll GetVersion
XXXXC93C is KERNEL32.dll GetCurrentProcess
XXXXC944 is KERNEL32.dll GetCurrentProcessId
XXXXC8F8 is KERNEL32.dll GetModuleHandleA
XXXXC94C is KERNEL32.dll GetCommandLineA
XXXXC954 any Export from same DLL
XXXXC960 any Export from same DLL

Report bugs:)
riPPadoGG
12-11-2001, 09:52 PM
Hi All,

I just managed to unpack two As-protected apps yesterday.

1. A BIG THANKS to ALL.. especially, the Admiral, Viper, Js, Solomon(Your tips did it btw), Evaluator, and Eternal Bliss, Predator, BlackB..(for the tuts)
2. ReVirgin is a great tool.. but you should know how to USE IT.. ;)

regards
riPPadoGG

:D
Viper
12-14-2001, 10:16 PM
riPPadoGG

since im sure there will be others asking for unpacking tuts, it seems to be growing in intrest. how about posting links to the tuts u got or upload them, if nobody objects.

Later
Viper
riPPadoGG
12-15-2001, 12:25 AM
Hi Viper..

The only up-to-date tuts I KNOW are the ReVirgin essays(Predator, BlackB) in http://www.woodmann.net/fravia/index.htm ;)

and Eternal Bliss tut no 42(Are there other?).. Please search google for this. (Doesn't use Revirgin)

There is a tut by the Admiral himself, but probably written before the Revirgin ERA :)

These are enough, but you will have to play around with api-emulator and tracer.. The tuts do not discuss these in detail.
Please refer to the previous threads by the Admiral, and Solomon.

THIS IS IT!!(as i know it)

+Splaj tuts are on the way.. :p

regards
riPPadoGG

Eternal Blissssssssssssssssssssssssss...
Is your page down?
riPPadoGG
12-15-2001, 12:32 AM
One more thing..

More about +Splaj tuts.. Refer to the thread +Splaj tuts..

:cool:


hmemcpy does not break!! in Win98!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hmemcpy does not break!! in Win98!!!
PDA

View Full Version : hmemcpy does not break!! in Win98!!!

riPPadoGG
12-07-2001, 12:13 AM
Hi All,

I have come across two programs that use name/serial protection, but simply will not break on hmemcpy.
(I use Win 98).
The interesting part is hmemcpy does not break even when you are entering the code :eek:

The programs,
Guitar Calculator 1.0 -http://www.guitarcalc.com/download.html
Devalipi Pro 3.2 -www.devalipi.com/pages/download.html

Guitar Calculator is packed with PETITE. Devalipi is not packed.
I used FrogIce, no detection messages.

How do you proceed with such programs??

regards
riPPadoGG

ENJOY CRACKING...!!!
JMI
12-07-2001, 12:45 AM
riPPadoGG;

Welcome, I would highly recommend that when you seem to have run out of answers that you try the "search" button at the top of the forum. If you use that button and do a search for "Hmemcpy" you will find that alot of people have had questions about it not working for them, although it really does not work on W2k. What you will find is that windows uses various API calls to retreive text from dialogue boxes, besides hmemcpy. Review these prior posts, including the one cited below, and it will give you good clues on other bpx to try.

http://www.woodmann.net/forum/showthread.php?threadid=1933&highlight=hmemcpy

There are also good articles on the +sandman's site on using Softice and getting it to work for reversing.

Good luck.


Driver Studio 2.6 released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driver Studio 2.6 released
PDA

View Full Version : Driver Studio 2.6 released

bauhaus68
12-07-2001, 11:26 AM
Take a look at drivercentral

h**p://w*w.compuware.c*m/products/numega/drivercentral/default.asp
nunofgs
12-13-2001, 08:29 AM
Originally posted by ArthaXerXes
Yes, DriverStudio 2.6 is available.

Key features : full XP support, PDB7 format support.

damnit... why hasn't it been warezed? I bet lots of people would like to see this release... guess we gotta wait :(
nunofgs
12-13-2001, 04:32 PM
Originally posted by ArthaXerXes
And due to recent events, a warez version is not going to happen before the new year...

recent events???
Roy
12-13-2001, 08:37 PM
I think at least ntice.sys file can be enough. (as update for softice 4.05) It is only 1.2 mb uncompresed (350kb compresed) and that is actualy all that we need(well siwvid.sys and siwsym.sys nay be required but that is actulay complete softice debuger). It is posible to post even on cracks site. Probably not many of us are going to write drivers.

Could someone send me that ntice.sys file? I will try to make small version of softice debuger.
nunofgs
12-14-2001, 03:04 AM
Originally posted by Roy
I think at least ntice.sys file can be enough. (as update for softice 4.05) It is only 1.2 mb uncompresed (350kb compresed) and that is actualy all that we need(well siwvid.sys and siwsym.sys nay be required but that is actulay complete softice debuger). It is posible to post even on cracks site. Probably not many of us are going to write drivers.

Could someone send me that ntice.sys file? I will try to make small version of softice debuger.

I did install softice for nt and I tried to use ntice.sys but it did not work... unfortunatly, my only hope is driverstudio 2.6.
Roy
12-14-2001, 06:09 PM
So do you have driver studio 2.6 ? If not then where from did you get that driver. It must be from 2.6 version of driver studio.
If you used ntice.sys from numega website then it wont work. It is for winxp 25xx (beta) version and not good for 2600 release. We need it from driver studio. Howewer i cant guarantee it to work, I just hope they didnt changed it too much.
|BoomBox-
12-16-2001, 04:17 AM
My post dssapeared... "Recent events" means a lot of groups being busted... Guess I'll try a different link... http://www.usdoj.gov/opa/pr/2001/December/01_crm_643.htm
DakienDX
12-16-2001, 11:27 AM
Hello |BoomBox- !

Sorry, but no HTML code is allowed here. You can use vB Code here only. Please also do not post any direct links on the board.

Simply turn off "Automatically parse URLs" when posting or use h**p instead of http.

I edited your link above to look as it should.
|BoomBox-
12-17-2001, 02:18 PM
Oh, okay. Why no direct links? Worried about the refer? :)
DakienDX
12-17-2001, 02:24 PM
Hello |BoomBox- !

Yes, we're worried about the referer. We have enough problems with some people trying to kill this page. If more people know about this page, more of them will attack it, especially companies.

You can say that you've a firewall blocking the referer, I've one too, but there are always ways to get past it and some other users following the link will not have one. So our problems will increase.


Using Olldbg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Using Olldbg
PDA

View Full Version : Using Olldbg

peterg70
12-08-2001, 02:37 AM
How do i set an conditional Breakpoint Log so that the expression that is logged is two memory addresses.

I.e. The condition is met and the string at memory 0040A010 and 0040A910 is logged to the the log file.

I have tried STRING [0040A010] & STRING [0040A910] and plus etc

Any Ideas??

May be some links for examples of conditional logs might help
matthew
12-08-2001, 04:06 PM
You could post to the win32asm board, but make sure it doesnt look like you are cracking anything.. they dont like that stuff.

http://board.win32asmcommunity.com/


Breakice for DS 2.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Breakice for DS 2.5
PDA

View Full Version : Breakice for DS 2.5

TheFCE2
12-08-2001, 06:08 AM
NTice.sys

offset 324deh

original bytes: 72h 08h

change to : f8h c3h

don't forget to re-calculate NTice.sys' checksum.

A simple tool for doing that can be found here :

h**p://www.collakesoftware.com/files/setcsum101.zip

No big deal, I know. I just needed the functionality. Perhaps it's useful for someone else, too.


VBoxM430
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VBoxM430
PDA

View Full Version : VBoxM430

Ivanov
12-08-2001, 12:54 PM
Hi all,

I've just unwrapped a program protected with VBoxm430.
After dumping and fixing the E.P. to the O.E.P, I executed the dumped file and received the message :

"File xxx can't load at the desired address, and is not relocatable".

I tought the problem was rwlated to the ImageSize and incresed it, but without sucess .

Any help will be apreciated.
DakienDX
12-09-2001, 07:46 AM
Hello Ivanov !

Every Win32 program has a desired load address. This means, that it is loaded to that address if it's available. This is usually 00400000h or 10000000h.

If this address is used by a different program, the program gets relocated and is loaded to a different location in memory. This means that the loader (Windows or the packer) changes all direct memory references (i.e. Mov EAX, [00402384]) to the new load region in memory. But since the loader does not know what calls need this patching, there is a relocation table which gives information about that.

Since you don't need to relocate .EXE files normally, this table was maybe removed from the program by the author or by a packer. So it can't be relocated any more if the desired address is occupied already and you get the error you described.

VBox handles the relocation itself, so you have two possibilities getting the relocation table. Catch it in VBox when it gets decrypted and insert it in the unpacked .EXE.
Look at which address the program is loaded by VBox, dump the program, occupy this address so VBox is forced to load it to an other address the next time, run it again, dump it again and calculate the relocation table from the differences between the two dumps.


Softice doesnt work? try this....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice doesnt work? try this....
PDA

View Full Version : Softice doesnt work? try this....

matthew
12-08-2001, 04:12 PM
Any newbie having problem with softice? Doesnt work on your target platform? (win2k or 2inxp ;)
Try ollydbg.. in most cases its nicer to use than softice anyways, and it is easier to get working..

http://home.t-online.de/home/Ollydbg

I'm not going to tell you how to use it though, if you have any asm experiance you should be able to get it working.

Matt,


I need CD-Cops protected exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I need CD-Cops protected exe
PDA

View Full Version : I need CD-Cops protected exe

LaptoniC
12-08-2001, 05:07 PM
If you have any cd protected with CD-Cops prefarably v1.76 or higer please contact me.I am testing my CD-Cops decryptor.Thanks.You can email me by clicking to my profile.
DakienDX
12-09-2001, 06:14 AM
Hello LaptoniC !

I see you did more research after I had stopped working on the target. Sorry, but I dont have your (http://www.woodmann.net/forum/showthread.php?threadid=1503) files available any more. Or are you searching for more targets? I once asked Link Data to send me a Demo CD, but they wanted to know my company's homepage, my full address, my bank account, more things they don't need to know, so I gave it up. :)
LaptoniC
12-09-2001, 08:04 AM
I have tested my unpacker with two protected cd but they were from same company and I want to be sure that it works.Then I will release it.
Man, how many months has been passed.8 months and I have a unpacker.I am damn slow but I didn't gave up :D
DakienDX
12-09-2001, 08:14 AM
Hi LaptoniC !

Very good. But Win16 with TDW 5.0 wasn't the thing I wanted to do the rest of my life. :) Just because of some problems with ICEDump in Win16 code. :( Anyway, there are not so many programs protected by CD-Cops out there in the world. (or at least where I live :) )
LaptoniC
12-12-2001, 09:05 AM
I have uploaded my decryptor incl. source and tutorial to my homepage.If you are interested you can download from my site (http://mrstop.da.ru) This decryptor is just for v1.76 but maybe it can give some ideas to you.


Proteq dongle emulation lib(src included)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Proteq dongle emulation lib(src included)
PDA

View Full Version : Proteq dongle emulation lib(src included)

MeteO
12-08-2001, 09:02 PM
Nope. See the source.


Need Help - FlexLM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need Help - FlexLM
PDA

View Full Version : Need Help - FlexLM

XeNoSiS
12-08-2001, 11:20 PM
I am looking for a little guidance on a FlexLM application. I notice that it uses the lmgr325c.dll. So I loaded that into the Symbol Loader and bpx'd lc_init and lc_checkout. I am having a problem finding the flexlm information. Here is the code surrounding the lc_checkout:

PUSH 00004000
MOV EAX,[0026E4C4]
PUSH 0026E0D8
PUSH 00
PUSH 01
MOV ECX,[EAX]
PUSH 00271860
PUSH 00271980
PUSH ECX
CALL LMGR325C!lc_checkout
MOV [00271A80],EAX
TEST EAX, EAX
JZ 00261A72

Thanks,
XeNoSiS -- Newbie
:confused:
xlat
12-09-2001, 06:40 PM
I dont know any backgrounds but...

although the call would apear the same
by order of pushes and way of return if
PUSH 00004000
PUSH 0026E0D8
PUSH 00
PUSH 01
PUSH 00271860
PUSH 00271980
MOV EAX,[0026E4C4] ;Load offset at mem loc
MOV ECX,[EAX] ;load data at offset
PUSH ECX ;push data
CALL LMGR325C!lc_checkout
MOV [00271A80],EAX ;store answer
TEST EAX, EAX ;AND with no store
JZ 00261A72 ;Only if zero
elsestuf:
to keep this short
by writing the Order like in your example you allign od and even sized opcode in double word boundaries, keeping the cache look aside buffer awake and things like that
Read somthing in "making streamed MMX routines" at Intels place.
Or somewhere else ;-)
XeNoSiS
12-09-2001, 09:18 PM
With A LOT OF HELP, I finally figured out why I wasn't seeing the information that I was looking for. It turns out that an external .DLL was calling the lmgr325c.dll for the flexlm. I loaded it up into IDA and worked with a very wise flexlm individual, who promptly "showed me the way".

Thanks,
XeNoSiS
peterg70
12-09-2001, 09:20 PM
Ummmmm

I think he was after a reversing question rather than a compiling issue.

What you offered is a compiling issue doesn't help him at all.

Then again neither does this post.


AddVectoredExceptionHandler( )
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AddVectoredExceptionHandler( )
PDA

View Full Version : AddVectoredExceptionHandler( )

Solomon
12-09-2001, 05:57 AM
new feature of SEH API:
h##p://msdn.microsoft.com/msdnmag/issues/01/09/hood/hood0109.asp
DakienDX
12-09-2001, 08:06 AM
Yes, but only on WinXP.

Why should I use WinXP? Just because of this? Never? Never!


Iczelion home page
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Iczelion home page
PDA

View Full Version : Iczelion home page

UrgeOverKill
12-09-2001, 10:11 AM
Anybody know what happened to Iczelions home page?? I've been trying to access it for a couple of days now with no luck.
DakienDX
12-09-2001, 10:24 AM
Hello UrgeOverKill !

I've no problems. win32asm.cjb.net or the direct link http://spiff.tripnet.se/~iczelion/ works perfect.
Aimless
12-09-2001, 11:33 PM
Iczelion's ORIGINAL page (with lotsa toolz/warez/etc) no longer exists. It was taken apart about 2 years ago.

However, his WIN32SAM page still goes strong.

http://win32asm.cjb.net/

...Have Phun
UrgeOverKill
12-10-2001, 12:19 PM
hmm, I had it bookmaked as win32asm.rxsp.com and was using it until a few days ago....

anyway thanks for the update!!


help, or is there a program?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help, or is there a program?
PDA

View Full Version : help, or is there a program?

Rage9
12-09-2001, 11:46 AM
Is there a reference out there, so that i can find out what parrameters are being pushed for different sendmessages... ex:

6aff push fffffff
50 push eax
68b1000000 push 000000b1 <---- I need to know what msg this is
51 push ecx
ffd6 call esi <---- call SendMessageA

any help?

thnks

-rage
DakienDX
12-09-2001, 12:30 PM
Hello Rage9 !

Try WINDOWS.INC. You'll find it at http://spiff.tripnet.se/~iczelion/files/windows.zip.
Rage9
12-09-2001, 01:44 PM
Thanks a ton man.

-Rage
m0sk
12-09-2001, 01:56 PM
OllyDbg has auto parameter recognition.
peterg70
12-09-2001, 03:31 PM
Does Ollydbg have a way of displaying the parameters sent to and API and returned from the API similar to what w32dasm did.

I have yet to find this but hey i am learning to use this debugger still (Its a damn good debugger)

Also how do you get it to rememeber to leave breakpoints active when you shut it down and restart Seem my breakpoints get deactivated when i restart ollydbg although the conditional logs seem to be there but just need to be reactivated.

Peterg70
Rage9
12-10-2001, 05:11 PM
Thanks for pointing me to OllyDbg, it is so much easyer to use then softice, awsome!

-Rage
Rummy
12-11-2001, 07:40 AM
Maybe, but in SoftIce all you have to do is "WMSG 0B1" and you immediately get:
EM_SETSEL

Of course, it won't do that for other common API parameters. I'm going to check out OllyDbg myself.


HASP Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HASP Protection
PDA

View Full Version : HASP Protection

octapus
12-09-2001, 03:27 PM
I recently downloaded a sort of CAD program to crack. I installed it and to my curiosity i observed some files called hardlock.vxd, hardlock.sys, e.t.c . I saw the version info and i read the name of the company. It was Alladin Systems. Well it is the first time i meet a dongle protection and therefore a HASP also. So I read every document i had about HASP.

Now, the program in protection operates in its full form for about 14 days. After that i haven't tried what happens( i didn't change any date either to see responses ). I checked the exe section ( a very large one ~ 8 MB ) and there was no .protected section. In fact there were the normal sections with their normal names. So for sure the .exe is not envelope wrapped.

I went into ftp.hasm.com and downloaded the directory HASP they had. It was about 180 MB. Read some manuals on what protections are there. From the descriptions inside i believe that my protection must be using a TIMEHASP. Now my problem is how to recognize the _hasp call. I have FLAIR and ran its tools with hasp32b.obj found in ft.hasp.com but the signature file that got out of the process (which i put in SIG directory of IDA) didn't recognized any functions. I believe that may be due to the fact that the .obj file is meant for the latest version of hasp. My hardlock.vxd and hardlock.sys are v2.35.

Can anybody tell me a pratical way to find _hasp. Of course if you could give me an .obj or a ready .sig file which can work with my Demo IDA 4.18 it would be better. Crackz site which closed down could have given me the information i needed probably. Why isn't it put somewhere like Fravia's Mirrors. It doesn't have to be updated ( of course if it updates when something like that happens wouldn't be bad all) .
DakienDX
12-09-2001, 03:48 PM
Hello octapus !

Your problem are not wrong HASP signatures. If you've a HARDLOCK.VXD the program is protected by Hardlock. This is a high-budget Dongle from Alladin. There are some documents available at their homepage describing the HL_API very detailed. So if the program is not protected by the wrapper method and does not use online decryption the chances are very high that you don't need the dongle to crack the program. I don't know if there are .SIG files of Hardlock available for IDA, but you should be able to write a demo program yourself which uses the HL_API and create the .SIG files from that demo program.
CrackZ
12-09-2001, 07:26 PM
Hiya,

Actually hardlock.vxd on its own isn't indicative of a Hardlock since HASP drivers install it as well ;-).

Since you haven't got a .protect section it would appear you don't have any of the wrappers either of these dongles has the facility to use.

Grab your hex editor :

1. Search for plaintext string 'HASPDOSDRV', if you find it, you've got a HASP.

2. Search for plaintext string '**CPG', theres more on this one, usually the version number, if you find it, you've got Hardlock API.

Anything else, send me the target name or target file and I'll tell you exactly what you've got ;-) (or I'll try too).

Regards

CrackZ.
octapus
12-10-2001, 08:11 AM
Thank you for the replies, DakienDX and especially CrackZ

I searched for both cases of plaintext and

1) There was no "HASPDOSDRV" nor small letters neither capitals
2) I found this :

**CPG_HK_AK_HV_MAZ_GBS_TS*15-Nov-1995*V3.50**  ¤ÅUWVRQS_ófÑC

It seems that the program is protected with Hardlock API v3.5

Well this program is about 40 MB of download in compressed form.
If CrackZ would be kind enough to try it i can send the URL.

For the moment since it is sure that we are dealing with Hardlock, my
only problem is the lack of tutorials on this protection. I have only one.
Well, i noticed something while i did a search on "dongles" generally on
the web :

I found few spanish sites ( anyway non-english ) that contained a lot of CrackZ
tutorials, maybe all. But i found no english language site. My only option would be
to try those automated machine translators but the words they leave out are a lot.

To DakienDX:

Lets suppose that i write a demo program of mine which uses HL_API. I haven't checked
what i have downloaded about HL_API( i don't have them on this computer ) but in order to
call those hardlock APIs shouldn't I have some declarations which calls them
from a dll or something that should be linked when i compile?

If they are called from a hardlock DLL file, i should probably unpack the DLL.
If it is the latter occasion than there should be again a .lib or .obj file.

NOTE : My target file in it's IMPORT Section calls only one DLL ( except for the Windows DLLs)
And that .dll has program functions inside. In fact it exports 854 functions( all of the them
with names and sometimes parameters ).

I don't understand what is the difference between the process that i followed to create .sig and the one i would follow if i did my own program using HL_API.
DakienDX
12-10-2001, 11:16 AM
Hello octapus !

The Hardlock API uses .LIB and .OBJ files. This means they're linked into the program at link-time. An archive called API.ZIP should be available at Alladin (1.6MB) as well as some more examples. I would suggest the ASM.ZIP (75KB), too. It is only for DOS real and protected mode, but you see the implementation of the API (also HLOCKAPI.ZIP, 100KB) the easiest way in my opinion. You can also read MAN_?.ZIP, where '?' is the language you need (should be on their FTP). The API manual gives good information about the names of the linked functions and their parameters.

Sorry if I said that this must be Hardlock, but I've never done anything with HASP and the drivers say that they're for Hardlock. The diagnostics program supports HASP, but I didn't know that this is done through the same drivers.
MTB
12-10-2001, 07:53 PM
Octapus
Since you state, the program was for download, please post the location, I will give it a quick look.

If it has an easy implementation, I will give it a go with you. Note most implementations of dongles are lame and lamer. I actually find it harder to reverse shareware stuff! This targe probably is easy especially if it let's you run for 14 days before it even looks for it.

I suggest you try finding a document by "Frog's Print" named "Dongle Bashing end of an Era". It's been out for a long time and not much changes.

MTB;)
MTB
12-10-2001, 07:55 PM
Octapus
Since you state, the program was for download, please post the location, I will give it a quick look.

If it has an easy implementation, I will give it a go with you. Note most implementations of dongles are lame and lamer. I actually find it harder to reverse shareware stuff! This targe probably is easy especially if it let's you run for 14 days before it even looks for it.

MTB;)
octapus
12-11-2001, 03:55 AM
The URL is www.liftdesigner.com

Now yesterday before DakienDX replies i did a check on the Internet for Hardlock. I found this site :

ftp://ftp.aladdin.de/pub/hardlock/

And I download c.zip ( larger than 1 MB ) since my program is made in c++. I dind't had the chance to get asm.zip cause the connection was closed ( i know it was very small file). But i found
hlw32_mc.lib (for Microsoft Visual c++) and
hlvdd.lib

I made signature files out of them but they didn't recognize any function. I also searched for text "hlvdd" and "hardlock.vxd" inside with IDA but didn't find any thing. In fact i didn't let it finish because it was at the end almost and hadn't found anything.

Since i too thought that there must be mush easier than what its protectioon implies, i did a little work. I found the messageboxa which says something like "Hardlock not found". it's not exactly the same. If i went above about 100 lines a found a jne which passes this call which has inside messageboxa but instead a dialog shows up asking for some password,seed , i don't even remember.

And something strange, the messageboxa, shows up only once. After that no matter how many times you run it, it doesn't show up. Maybe after all, this is an easy protection. I really don't have mush time this week. But when i find something i will post a reply
cah
12-19-2001, 11:01 AM
To
All Dongle reversers

How to duplicate hasp dongle hardware? Did any stuff available on this subjet?

thanks in advance

cah...
lixus
12-20-2001, 08:12 PM
Hey octapus.

I had a quick look at the target and found some things that may be of some importance.

This program uses hardlock api as a part of the protection scheme.
I found that the following three hardlock high level apis are used.

HL_LOGIN : address 00401328
HL_CODE : address 004012E1
HL_LOGOUT : address 00401027

With these parameters:

HL_LOGIN(28305, 1 (LOCAL_DEVICE) , nothing, nothing)
With nothing I mean 8 zero bytes.
If REFKEY and VERKEY is zeroed they are not used.

HL_CODE("LIFTHDLK", 1)

HL_LOGOUT()

All three used in a function at address: 006B9000

If these three hardlock API calls returns eax = 0
you will pass this call. If not you get the "No Hardlock found" message.

So, to make this work without a dongle, just make those calls return eax = 0.
If you pass, a little dialog show up. I think this was the dialog to witch you refered
with the "seed" codes or whatever...

It has three edit boxes.

Serial number:
Expiration:
Authorization code:

It allso has a label with the text "Hardlock NO: xxxxxxxx"
And the ok button is disabled if the "right" values are not entered.

If the dialog box refuse to show up then try deleting the last lines in the ld30.ini file and restart the app.
In my ini file they look something like this:

[AUTORxxxxxxxxxxx]
SOme value:Some value= Some text

Anyway, I found some values that made the ok button enabled, but when I clicked it
a message box came up with some text like "Bad authorization code".
I didn't have any time to reverse this further, so I decided to stop there, sorry.
All I can say is that I think that the values supposed to be written in those edit
boxes has something to do with the validation of the program modules, because I tried
to set the expiration to zero and then all the modules became invalid :(

About the HL_CODE call..
The 8 bytes "LIFTHDLK" are supposed to be crypted with this call.
I couldn't find any check on those bytes close to this call.
And i haven't really tried to find out wether the rest of the protection code uses the
crypted return bytes from this call. I patched the modid in the exe to fit a hardlock dongle of mine.
Then I let the program run, and the
little dialog asking for some values showed up.
So it worked that far. Maybe the crypted bytes is used later in the code that checks if the
authorization code is correct, I don't know yet. Anyhow, good luck with this target.

I hope this information will help you.

/lixus
lixus
12-20-2001, 09:10 PM
The returned crypted bytes is used to produce the number displayed as the
"hardlock no:" in the serial/expiration/auth code dialog.

.text:006B90CA lea eax, [esp+1E0h+var_1C0] ; Address to buffer to be crypted
.text:006B90CE push 1 ; Indicates that only one 8 byte block
.text:006B90D0 push eax ; is to be crypted from the buffer
.text:006B90D1 xor esi, esi
.text:006B90D3 call HL_CODE
.text:006B90D8 add esp, 8
.text:006B90DB test ax, ax ; If ax = 0 then everything is fine
.text:006B90DE jz short loc_6B910E ; Next HL_LOGOUT

.....

.text:006B911D mov edx, [esp+1E0h+var_1C0+3] ; Now crypted bytes
.text:006B9121 mov eax, [esp+1E0h+var_1C0+2] ; ..
.text:006B9125 mov ecx, [esp+1E0h+var_1C0+1] ; ..
.text:006B9129 and edx, 0FFh
.text:006B912F push edx
.text:006B9130 mov edx, [esp+1E4h+var_1C0] ; ..
.text:006B9134 and eax, 0FFh
.text:006B9139 push eax
.text:006B913A and ecx, 0FFh
.text:006B9140 push ecx
.text:006B9141 and edx, 0FFh
.text:006B9147 push edx

.text:006B9148 push offset aDDDD ; "%d%d%d%d"
.text:006B914D push offset unk_93BF50
.text:006B9152 call _sprintf

As you can see here, the first 4 crypted bytes in the 8 byte buffer are converted
to dec. This decimal value stored at offset 0093BF50 is the hardlock no.
It's later used in the code that checks the dialog input.

/ lixus
octapus
12-21-2001, 03:54 PM
Thank you for your truly helpful comments on this target LIXUS.


Crashing DeDe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Crashing DeDe
PDA

View Full Version : Crashing DeDe

stealthFIGHTER
12-09-2001, 03:34 PM
Hello,

I want to ask if anybody has the same problem as me. I use DeDe. I start it and choose a program (it wasn't packed/protected) then I push process button. Once the program is loaded DeDe asks me to push the OK button (in message). I push it - at this moment the program freezes and DeDe too. I didn't see this ever before on my computer. I have installed Delphi 3 and Delphi 6 (under Win98). I use DeDe v2.44 and v3.00b.

Is it possible that the program has some anti-disassembly macros or anti-DeDe code? If yes, is it possible to locate this code/macros?

Thanks,
sF
|BoomBox-
12-14-2001, 01:07 PM
Um. Haven't used dede before. Never heard of it, actually, but I have been "sleeping" for a bit ;]

Um. Freeze? Sounds like anti-dede code, yah. Maybe generic anti-debug trick, don't know though... can you set dede to ignore Int 3? Might wanna do a search for anti-dede or whatever... and yes, you can always find and "discourage" ;) whatever anti-debugger you happen to find...

Good luck :)


opcode generator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > opcode generator
PDA

View Full Version : opcode generator

dunno
12-09-2001, 07:21 PM
Looking for an opcode generator program.

Say, I'd like to patch some 4 bytes to "movsx eax, word ptr [ebx+ecx]" and it will give me "0FBF040B" or vice versa.

Any advices?

Thanks.
peterg70
12-09-2001, 09:22 PM
Most disassembles have assemblers built in.

Ollydbg is an example Load a program into it and go to a blank area in the memory map and assemble whatever and you will see the numbers or enter the numbers and the code will appear.

Hview is another alternative (don't know if it assembles)
DakienDX
12-10-2001, 11:22 AM
Hello dunno !

HIEW is a very good program, as peterg70 said. You can assemble 16-bit and 32-bit intructions in both 16-bit and 32-bit code segments. You can even search for things like "Mov ?, [EAX+?]" and it will find all intructions according to your search. HIEW has a built in disassembler and assembler and opens files in shared mode, so you're able to view many files which you cannot view else.


reversing savegame file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > reversing savegame file
PDA

View Full Version : reversing savegame file

2_a_day
12-10-2001, 02:48 AM
I am attempting to write a savegame editor. The save file in question uses some type of compression. I am wondering how the decompression algo can be determined.

Thanks for any suggestions.
DakienDX
12-10-2001, 10:52 AM
Hello 2_a_day !

You need to debug the game which stores the savegame. You must find the compression algorithm there as well as the decompression. If you're lucky you can recognize it as a well known one, if you're not you need to copy the code from the program to your source. Be sure to check if it's compression or cryptography, because you may be hunting a ghost if you don't know what you're looking for.


How to crack XLA sheets
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to crack XLA sheets
PDA

View Full Version : How to crack XLA sheets

BUTORBUTOR
12-10-2001, 03:23 AM
Does anyone knows which Break Point can be used in softice to crack forms made for xla macro's from Excel ?

I've used BPX messageboxa, lstrcmp, __vbastrcomp, hmemcpy, getdlgitemtext, getwindowtext but softice does not popup ...
peterg70
12-10-2001, 03:26 AM
Just use excel's built in VBA its should show you the project.

Send me a PM with the name of the xla and i will see what is possible.

peterg70
BUTORBUTOR
12-10-2001, 04:03 AM
Oops, I forgot to say that the excel macro has been 'Compiled' because when I try to open it with the VBA débugger I get a message telling me that the project can't be displayed.
If i only had the message asking me for a password, this would not be very difficult with softice ...


Need Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need Help
PDA

View Full Version : Need Help

fujikzh
12-10-2001, 06:29 AM
Hello,

i am new on reverse enineering, but cracked several tiny progs
yet. Now I have another proggy and can't go on.
Is there soneone else, who can help me or give me a few hints.

Here ist the prog: cardblaster.zip (http://mondfee.de.tf/cardblaster.zip)

fuji
+Sandman
12-15-2001, 10:29 AM
Greetings....

I see you have no reply's as yet to your request for help with this program...

Hardly surprising since you have not made any attempts to explain where abouts your stuck with this program. Short of giving you an a-z explaination of how this program works we dont know how to help you.

What have you so far learned about this program's protection system? what part is of it is giving you problems?. Is this a VB program?, does it employ a known protection system?, what have your tools told you about this program?. You need to explain yourself better if you want other people to help you.

Regards
+Sandman


Reprogramming a passcode generator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reprogramming a passcode generator
PDA

View Full Version : Reprogramming a passcode generator

peterg70
12-06-2001, 06:24 AM
Guys

I have located a generate password code function but i want to be able to enter from AAAAA to ZZZZZ as the input (this normally comes from a dialog input) and collect the keys generated. I have managed to locate the routine that is called and where the input and output go but what sort of routine do i need to generate all the combinations

As example the following code illustrates

Mov EDI,004029283 (This moves the dialog string into memory)

Some tests to ensure string is not blank etc.

call 004003000

when it return from this i want to save out to file the first code and another memory address as well. Then increase the memory address to the next possible code and continue to do this until all codes done. Then close the output file.

I know this is possible but what is needed is the question
peterg70
12-08-2001, 03:54 AM
Okay i have made this solution into blank area of code and called the routine

Can someone make it more elegant without using registers or stack

00408520 INC BYTE PTR DS:[40A57A]
00408526 CMP BYTE PTR DS:[40A57A],5A
0040852D JLE MASTER-K.004036F1
00408533 INC BYTE PTR DS:[40A579]
00408539 MOV BYTE PTR DS:[40A57A],41
00408540 CMP BYTE PTR DS:[40A579],5A
00408547 JLE MASTER-K.004036F1
0040854D INC BYTE PTR DS:[40A578]
00408553 MOV BYTE PTR DS:[40A579],41
0040855A CMP BYTE PTR DS:[40A578],5A
00408561 JLE MASTER-K.004036F1
00408567 INC BYTE PTR DS:[40A577]
0040856D MOV BYTE PTR DS:[40A578],41
00408574 CMP BYTE PTR DS:[40A577],5A
0040857B JLE MASTER-K.004036F1
00408581 INC BYTE PTR DS:[40A576]
00408587 MOV BYTE PTR DS:[40A577],41
0040858E CMP BYTE PTR DS:[40A576],5A
00408595 JLE MASTER-K.004036F1
0040859B INC BYTE PTR DS:[40A575]
004085A1 MOV BYTE PTR DS:[40A576],41
004085A8 CMP BYTE PTR DS:[40A577],5A
004085AF JLE MASTER-K.004036F1
004085B5 INC BYTE PTR DS:[40A574]
004085BB MOV BYTE PTR DS:[40A575],41
004085C2 CMP BYTE PTR DS:[40A574],5A
004085C9 JLE MASTER-K.004036F1
DakienDX
12-09-2001, 07:29 AM
Hello peterg70 !

In ASM you can do nearly nothing without registers and stack. Your code is the only possible without registers. But I would suggest to invent an own number system having 26 values for each digit. So you increment the counter number by one, divide it by 26, take the remainder and add 41h (= 'A') to it and store it. Repeat this until the initial number is 0 (same as converting a number to decimal, only divide by 26 and not by 10). This method makes all strings like A..Z, AA..ZZ, AAA..ZZZ, AAAA..ZZZZ, ... If you don't like this, you must set the start value for the counter to 26+26^2+26^3+... until you've reached the desired value.


SoftICE 4.2.5 keyboard mapping
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE 4.2.5 keyboard mapping
PDA

View Full Version : SoftICE 4.2.5 keyboard mapping

B-Boy
12-10-2001, 04:22 PM
Hi.

I've just installed 4.2.5 on my system (Win98SE), and while I was playing around, I noticed that the keyboard mapping has changed quite a bit since 4.05. My keyboard is non-US, so I'm looking for a way to patch SoftICE's keyboard mapping to 'fit' my keyboard.
I'd be very glad if someone had a glue for me on that subject.

Thanks..


[not] initializing softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > [not] initializing softice
PDA

View Full Version : [not] initializing softice

2_a_day
12-11-2001, 01:58 AM
I have found softice to be useful on occasion, but many programs on my computer object to it being installed. Is there some way i can choose whether or not softice is to be loaded each time i boot ?

thx
Solomon
12-11-2001, 02:09 AM
What's your platform?

if Win9x, you can make a multi-boot config by changing the config.sys/autoexec.bat

if WinNT/2K, you can select "manual start" mode.
DakienDX
12-11-2001, 11:49 AM
Hello 2_a_day !

I've written a small (25 bytes) program which checks if scroll-lock is activated at boot time. It clears it and exits with 1 if it was set, else with 0. So you can write the following code in your AUTOEXEC.BATLoadSI
If ErrorLevel 1 Then C:\PROGRA~1\SOFTICE\WINICE
I've choosen this key because I don't know any program which uses it any way.

[LOADSI.COM]
B8, 40, 00, 8E, D8, F6, 06, 17, 00, 10, B0, 00, 74, 02, B0, 01, 80, 26, 17, 00, EF, B4, 4C, CD, 21
Czerno
12-11-2001, 11:59 AM
Assuming Wind*ws 9x , the DOS Multiconfig method
may be overkill , another simpler method here :

in your Autoexec.bat file , after any necessary
stuff ( you may have none yet ; then create an
\Autoexec.bat file on your startup disk and start
from scratch ) , just add smthng along :

----------- autoexec.bat ---------------------------------
@echo OFF
rem ark : you must have set a path including
rem : your 'command' directory , else add
rem PATH %path%;%windir%\command

CHOICE /T:N,10 Launch WinICE
IF NOT errorlevel 2 GOTO Ice
win
echo - autoexec.bat : back from Wind*ws -
GOTO End

:Ice
cd c:\progra~1\softice
winice
echo - autoexec.bat : back from the ICE ! -

:End
----------------------------------------------------------------

You should also have edited your text file : \MSDOS.SYS
( remove its RHS attribs ! ) so it has a line reads :

BOOTGUI=0

-----------------------------------------------------------------

Here you are ! Customize at will !
Even simpler , instead of the CHOICE command , you
could have used a good old PAUSE line and breaking
with Ctrl-C as necessary ... Enjoy

--
Czerno
JMI
12-11-2001, 01:04 PM
Here's another alternative that I believe I got from one of the newbie sites, maybe "cracking for newbies", on how to set up and run softice. It also had a sample configuration file, for example did you know you can change your screen colors of the softice windows?. (I don't much care for a black background.) Anyway it pauses the boot process and puts up a simple menu and you enter your choice by pressing "1" or "2" or "3". On my menu list "1" starts softice and then Win, "2" starts Win without softice, and "3" boots to dos. Hitting "enter" starts the "default" choice.

You will see a line from the config.sys file portion that allows you to define which choice is the default (MENUDEFAULT) which determines which choice is made if you do nothing or hit "enter". You can choose whichever you want as the default The number that is directly after the "MENUDEFAULT" entry is the countdown time before the default is selected. Mine is "15", which simply means that I've 15 seconds to make a choice before the "default" is selected for me. To bypass the timer I either simply hit "enter" (which chooses the "default", "1","2" or "3".

Place the following lines in your Autoexe.bat file:

:SICE
C:\PROGRA~1\NUMEGA\SOFTIC~1\WINICE.EXE (or whatever is the path to your softice directory)
goto common

:NORM
goto common

:DOS

:common

Then add the following to your config.sys file:

[MENU]
MENUITEM SICE,Windows 9x with SoftICE
MENUITEM NORM,Windows 9x
MENUITEM DOS,MS-DOS-Modus
MENUDEFAULT SICE,15

[NORM]

[SICE]

[common]

You can also change the order of the choices. For example you could list "NORM, Windows 9x" first and then it would be the choice of the "1" key and if you also used "MENUDEFAULT NORM, 15", you could also press "enter" to skip the timer (it's just a bigger target on most keyboards than a number key) and it would boot to win without softice.

Hope this helps.


Gift: ICCAVRIDE.EXE rdata
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Gift: ICCAVRIDE.EXE rdata
PDA

View Full Version : Gift: ICCAVRIDE.EXE rdata

evaluator
12-11-2001, 03:53 PM
Hello!
I want make little gift for all.
My terrible manual work: reconstructed
RDATA section for ICCAVRIDE.EXE
Paste it in dump at 19B000 hex.
Values for PEditor:
OEP 00001000
IT RVA 19B000, SIZE 124
Disassemle and kill this bad proggie!
www_imagecraft_com

Program will failed for run because of
special ASPR-code check. Try kill "FatalExit" callers:)
Soon I will write, how easy it is..


Something different
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Something different
PDA

View Full Version : Something different

iso8859-1
12-11-2001, 06:37 PM
'lo all

I wonder if you might help me. It's about detecting CS-cheats programs (more generally cheat programs for multiplayer games). Ok, it would be easy to get the cheat and then build a special detection-routine, everything has to be of course encrypted and protected against disassembling/debugging or they could just detectionprogram.

My question: Is there another method? A more general approach? A way you can detect loaded/injected dlls or modifications to the loaded client.dll of the game?

If you want to see a good cheat - www.mpcheats.com - it's under the GPL, so source is available.


+Splaj Tuts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > +Splaj Tuts
PDA

View Full Version : +Splaj Tuts

riPPadoGG
12-12-2001, 12:09 AM
Hi All,

I am looking for the +Splaj tuts..(manual unpacking -- I want to unpack more, telock/pc guard/vbox)
I searched the forum and went to all the urls given... No luck :(

Anyone has all the tuts? Please send it to me?
Any working url???

regards
LOVE YA ALL..
:D

riPPadoGG
JMI
12-12-2001, 01:31 AM
I believe that I downloaded most, if not all of the discompress site before it "went off the air." Perhaps +Splaj would have something to say about distributing the set. If he doesn't object, I'm sure I could upload them somewhere if somebody has a spot. I'll check my HD and see how big a file it might take.
riPPadoGG
12-12-2001, 08:32 AM
Hi..
Splaaaaaaaj..
If you are out there...
Can you please give us a confirmation??

Thanks in advance..
Really looking forward to those famed ones...
:rolleyes:

regards
doGG

HAVE A NICE TIME REVERSING..
;)
JMI
12-12-2001, 10:42 AM
+Splaj has given his blessing for distribution of the zip file from discompress.com and has asked if I have two additional tuts that he published. I'll check to make sure I have a "full set", but I need some place to upload them. I'm not sure, but don't think I can make a 1Mg+ attachment here.

Anyway, give me a day or too to get organized. Then we'll get it done. The zip file actually gives the "full" look and feel of the original web site, with operating links to the various pages and materials.
riPPadoGG
12-13-2001, 06:47 AM
Thanks YOU..

+Splaj...
JMI...

regards

riPPadoGG

:rolleyes:
JMI
12-13-2001, 02:58 PM
Just an update on the progress of providing an upload of the discompress site. I've located the draft essay on C.V. 3.1 that +Splaj said he would like included, but have not located his draft tut on Awave Studio 7.3. I've asked +SplAj if he would send it but if anyone downloaded it from the thread here in June before it was removed you can send me a PM and I'll give you an e-mail address to send it along so it can be included. I've also asked +Splaj if he would like to include something he mentioned about "html unencrypted" that I don't recall seeing anywhere.

With additions, the file will be slightly over 1 Mg so I will still need someplace to upload it if many people want to download it. I've already received some PM requests and will follow-up as soon as I determine whether I can add those additional files.

Up to the minute-late breaking news:

Woodmann has kindly offered space to upload the discompress materials as soon as I can finish trying to track down those last materials I mentioned.
stealthFIGHTER
12-13-2001, 03:39 PM
Hi all,

for those who are impatient: (some of the +Splaj's tutorials)
[http:))www.volny.cz/autechre/files/others/unp.zip]

For list of packers see next reply by JMI.

sF
JMI
12-13-2001, 03:48 PM
And so you'll know what's in this zip, it includes the tutes on unpacking pecompact 133; petit 2.2; Aspack 1083; Aspack 2.1; and VBox 4.1.

And for those of you who don't want to wait for the full upload of the discompress site, you will find +SplAj's latest two tuts as zip attachments here:

http://www.woodmann.net/forum/showthread.php?threadid=2001
riPPadoGG
12-19-2001, 09:00 AM
Hi All,

Any update on this JMI?
Have you uploaded?

if yes please give me a link..

thanks in advance

doGG
JMI
12-19-2001, 12:51 PM
Hello to all who are following this thread:

I have been working to co-ordinate with +SplAj and Woodmann the uploading of the former Discompress Site and wanted to figure out the best way to include the two new essays by +SplAj on Awave Studio and CommView 3.1, but I didn't want to make any changes to the original work to identify the two new essays without +SplAj's express request that I do so. During the discussion of how to handle this +SplAj has advised that he has more material that was on the site that is not in the zip file that was available when I downloaded it.

However +SplAj advised that he is extremely busy at the moment and asked for a few weeks to complete his current backlog before addressing this issue. Sometimes real life interfers with reversing and we will all just have to wait a short while until he has the available time to feed our hunger for his knowledge and experience.

As the previous posts have indicated, the essays from the site and his two new essays on Awave Studio and CV 3.1 are available here now. And to keep your interest up and as a reward for patience I am attaching +SplAj's page from the site on "signature bytes."

If you read the two new essays you will see +SplAj used signature bytes to locate the OEP of these asprotected targets. The reason this is important, as explained in the essays, is that asprotect has figured out how to slow down the the /tracex function and this is an alternative method to locate the OEP without waiting for the slowed down process to work. This is a useful concept for us to study, learn, and apply, but don't forget that some of the protectors also read these pages (hello Alexey) and try to find ways to get around the methods that are developed to defeat their latest tricks. If they didn't make changes, eventually we would have nothing interesting to try to reverse.

We have to keep studying, learning and investigating. Be sure to check out the recent threads involving very recent changes discovered in asprotect, particularily about re-re-directed import table entries and self modifying code.

Regards.
+SplAj
12-19-2001, 04:24 PM
Hi guys

thnks for your request and patience. JMI is one of those real rare nice guys :-D

As I said to him I am too buzy to fart right now. BUT I still have the orginal folder intact on my crashed & burned notebook,i.e. fuxed network card, fuxed screen (unless I punch it )and fuxed battery :(

Then I need to check the integrity of the files.
Anyway it was a lame attempt to get ppl started on the road to defeating packers/protectors/cryptors.......and actually the best way is to learn the PE header a bit, pay y0da for LordPE Armaggedon, get an IAT rebuilder (u know) and pack/protect/crypt NOTEPAD.EXE and use that as a target ;)

That's it, I'm around if anyone has Q's.......5 or 10 mins a day.

BTW today i learned 'mate' meant a queer pufta in some parts of the world, oh ummm. .....Oh and WinNT4 PC cannot drill down more than 6 levels of directory on a shared Win2K PC :-( Now I just fuxed the office network by installing Win2K....nobody can see their shared files....duh.....back to work. CYA. Oh, merry xmas to all RCE ....blah blah :D

Who wants to be a millionaire ?

Spl/\j
Viper
12-23-2001, 11:40 AM
or are the updates all done :confused:
JMI
12-23-2001, 01:43 PM
+SplAj asked for some more time, when he is not too busy to fart, to get his sh*t together. I, for one, will give the man some room until he's ready to fart. hehe.

Regards.
Viper
12-23-2001, 02:04 PM
thats cool im not one to stand between a man and his fart or behind for that matter hehe:D
just eager to learn
JMI
12-23-2001, 02:48 PM
Imagine having to try to cook holiday meals wearing that old WWI gas mask, waiting for the big event. Besides, as he said, he's been "fixing" the office network.

Enough of this fun, I'd better get Christmas shopping. Put it off as long as I could.

Best wishes to the RCE world and hopes for a more peaceful new year for all.

Regards.
riPPadoGG
12-24-2001, 02:52 PM
Yeah..

Take time... Me on vacation.
BREAK FROM SOFT-ICE. :cool:
Viper
01-04-2002, 12:04 AM
now who needs a break from SI :D

Later
Viper
Viper
01-05-2002, 07:35 PM
just a check to see if +SplAj is able to fart freely now
:D
riPPadoGG
01-06-2002, 06:06 AM
still waiting..
with a few te-locked and armadilloed files in my hard drive..
anybody out there???(not me... pink floyd:))
sllek
01-26-2002, 02:59 PM
Krobar has just had a major update to his site.

Seven +Splaj tuts (including a couple of Asprotect) are included in the unpacking section

http://zor.org/krobar/
Viper
01-26-2002, 05:36 PM
thanks for the insite sllek, and thanks krobar for the update with +Splaj tuts :D


Java programs cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Java programs cracking
PDA

View Full Version : Java programs cracking

PoVVe(R)
12-12-2001, 06:47 AM
How can I start cracking Java programs with SoftICE?

Program is JavaScheduler v4.0 and I need to enter code.

Thanx
iso8859-1
12-12-2001, 08:54 AM
There are java-decompiler out there.
Since java uses it's own bytecode, it is actually possible to decompile a java-program back into java (only comments and variable-names missing). Sorry, can't help you how or where to get one, but a friend of mine used one with success.
koyaan
12-12-2001, 11:20 AM
google.for
jad java decompiler

worked for me....

cheers logic
stealthFIGHTER
12-12-2001, 04:49 PM
Hi,

You can visit the Analyst's page (huup://oldreverser.cjb.net/). There is nice tutorial: Java reversing (three apps in one tut).

Good luck,
sF


Help on Delphi>-<ASM Combo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help on Delphi>-<ASM Combo
PDA

View Full Version : Help on Delphi>-<ASM Combo

ON'error
12-12-2001, 10:48 AM
...

var
Form1: TForm1;
First,Second,Final: Variant;

...

procedure TForm1.Button1Click(Sender: TObject);
begin
asm
mov eax, 2
mov ebx, 6
add eax, ebx
mov Final, ebx
end;
edit3.text:=inttostr(Final);
end;
end.

hi,
i dont know, why my pc tells me that the operand size(!translationPROBLEM)is not the same.
If noone can help me or dont want to, then youve got a tutorURL maybe.

thx anyway
Js
12-12-2001, 01:06 PM
Hiya,
Tried to send you a pm but it says I'm not logged in :confused: so I have sent an email, (maybe) . :)
stealthFIGHTER
12-12-2001, 01:59 PM
Hi,

try to declare the variations as Cardinal (or LongInt) and not as Variant.

Btw. I think, that the code is so easy that you don't need to use asm:

EAX := 2;
EBX := 6;
EAX := EAX + EBX;
Final := EAX;
Edit3.Text := IntToStr(Final);

or

EAX := 2;
EBX := 6;
EBX := EBX + EAX;
Final := EBX;
Edit3.Text := IntToStr(Final);

or in ASM

asm
mov eax, 2
mov ebx, 6
add ebx, eax
mov Final, ebx
end;
Edit3.Text := IntToStr(Final);

(btw. in your example the value in Final will be '6' (as it is the value that is moved from EBX) because you typed add eax, ebx. If you want to add eax to ebx you must type add ebx, eax. Then the value in Final will be '8'.

sF
ON'error
12-12-2001, 02:29 PM
hi, 1st thx for ur reply but i know that i can add 6 and 2 in another way. But i want to use asm in 32bit, else i have to prog an exclusiveOr or a shiftLeft function to use them in VB. And win32asm isnt an option 4 me, cause im very lazy. I just have some problems to understand pascalsyntax and the compiler-messages. what means "Operamds size isnt the same"@mov Final, ebx.
stealthFIGHTER
12-12-2001, 04:16 PM
Hi,

what version of compiler do you use? Have you tried to look into Help? I've found this (I think this can be the solution):

=============== Paste from Help ===============
Error: Operand size mismatch

Description

The size required by the instruction operand does not match the size given.

In the sample above, the compiler will complain because the 'offset' operator produces a 'dword', but the operator is expecting a 'byte'.

program Produce;

var
v : Integer;

procedure Assembly;
asm
db offset v
end;

begin
end.

========================================

The solution, for this example, is to change the operator to receive a 'dword'. In the general case you will need to closely examine your code and ensure the the operator and operand sizes match.

program Solve;

var
v : Integer;

procedure Assembly;
asm
dd offset v
end;

begin
end.
=============== Paste from Help ===============

I think this is clear. Btw. have you tried to declare the vars. as Integer or Cardinal?

sF
ON'error
12-13-2001, 06:29 AM
ive made a huge mistake, but its fixed. When ive compiled the program and click on my button a message pops up with EAccesViolation blabla cant read FFFFFFF or something like this. and now the line: edit3.text:=inttostr(Final); is highlighted.
to quit this thread could somebody send me a code which uses asm in delphi? thx a lot
stealthFIGHTER
12-13-2001, 01:57 PM
Hello,

try my tutorial #44; (how to make a kg for ... using delphi + asm) or look at this:

*******************************************

var ECXINT, ESIINT, EAXINT : Cardinal;

asm
mov eax, eaxint
mov ecx, ecxint
mov esi, esiint
mov esi, eax
xor esi, ecx
test esi, $321952
jz @yes
add eax, eax
xor eax, $13218
shl ecx, $2
jmp @end
@yes:
shl eax, $4
shl ecx, $3
@end:
mov esiint, esi
mov eaxint, eax
mov ecxint, ecx
end;

*******************************************

I hope it helps you a bit :)

sF


Basic Softice use
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Basic Softice use
PDA

View Full Version : Basic Softice use

matthew
12-12-2001, 11:08 AM
I haven't used softice in a while, and can't remember how to get breakpoints to work. You need to set them up for a specific program don't you? How do you get softice to debug that program?

Just starting softice and setting bpx messageboxa didnt do much of anything, so i guess it needs to have scope on that program.

Matthew.
JMI
12-12-2001, 01:25 PM
Matthew:

The rude response would be "rtfm."

The polite response would be that reading and/or re-reading the manual would be a good idea. Also using the search button at the top of the forums would get information about breakpoints. There are also articles that could be found by a google search using "softice+breakpoints". Just a gentle reminder that learning where and how to look is one of the most helpful things you can learn about reversing.

I'm attaching an article by Rhayader that explains breakpoints in softice that have conditional statements which cause the program to break and display the specific portion of the API that you might be interested in. It also would be helpful to review some of the API's that are valuable for reversing. Again check the search button for previous threads on this issue.

Also check out the +sandman's site which has several tutorials on softice.

Good luck.
Snatch
12-12-2001, 10:45 PM
Kind of aside from the point but everytime a newbie asks a basic question he gets pounded. Not everyone is as good as figuring things out or finding things as everyone else. JMI did a good job by pleading for him to try other means to avoid these questions but he did answer the question. That's what counts. I hope more people follow JMI's example.

Snatch
JMI
12-12-2001, 11:30 PM
I just used the search button at the top of the forum and reviewed a few of the past posts on this subject and was reminded of a good site reference made by CoDe_InSiDe back in August of this year to http://c4nfaq.cjb.net.

It has frequently asked questions about how to set up and use softice and I think this is where I got the menu set up details for choosing to boot into sice and windows or just windows that I described in a recent thread on the newbie forum.

Certainly worth checking out if you need a refresher on the basics of softice, and pass through with a thanks to Carpathia for the effort of maintaining the site for those of us who are trying to get up to speed.
kugi
12-13-2001, 11:36 AM
Hi JMI,

Way to go! Provide the correct answer (read the manual) and then get the newbe on his way by giving him what he needs to know. I like your style.

Regards, Kugi


softice - loading a .dll's export table
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice - loading a .dll's export table
PDA

View Full Version : softice - loading a .dll's export table

2_a_day
12-12-2001, 11:10 AM
I would like softice to recognize the functions of a specified dll. In loader32.exe I have added my dll to Edit->Init Settings->Exports, but when I search for a function name (using exp SomeDllMethod or exp [MangledName]) I still find nothing. BTW, I have restarted softice after adding the dll. Any ideas?


need 3d max help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > need 3d max help
PDA

View Full Version : need 3d max help

edhct
12-12-2001, 01:08 PM
My crack won't work now that I am trying to instal it on my new computer with XP.

Need help.

Do I need a different crack or maybe disable something in XP??

Thanks
stealthFIGHTER
12-12-2001, 04:29 PM
Hi,

look into attachement. (btw. I don't know where I get the file from - sorry to the author ;)).

sF
MTB
12-12-2001, 07:58 PM
Hiya edhct

I have a crack tutorial for versions 2.5 and 3.1 from the god of undongling "++CRACKZ++". However since his site was taken down he asked that nothing be spread from his site. So if one of the administrators wants me to post the tutorial I will, otherwise your on your own.

Hopefully you know how to use Softice because IDA or W32dasm will NOT work on these targets because of stuff.

May the force be with you.
MTB:D
_Servil_
12-13-2001, 04:50 PM
2edhct ::

what U need is cdilla 3.24 update
available from discreet's web or ftp
Lord_Soth
12-16-2001, 06:40 AM
What you really need is "Inside 3D Studio Max" you little punks...
:)

Do you wanna learn how to do face deformations and editing meshes ?
Do you have an urging need to know how to do complex boolean
operations on objects ?
Do you wanna know how to do complex 3d lofting ?
Would you like to know how to use all the "normal" operations in
a better way ?
Wanna know every finer point about the soft ?
Wanna know how to create great materials and animate them ?
Wanna know what is 2.5D snapping ?

hehe
you get the pic ?

LS
JMI
12-16-2001, 05:27 PM
It is just me, or does this original post carry the rather pungent odor of a blatant crack request? I know +Tsehp is trying to take some much deserved time off from helping all of us figure out redirected and mangled import tables so perhaps Woodmann will make that determination.
Woodmann
12-16-2001, 05:47 PM
Hi,

I think LS handled it well.
There is no reason anyone would need the software without the manual. Unless they were a genius, in which
case they would prolly have the money to buy it.

Peace, Woodmann
Lord_Soth
12-18-2001, 07:42 PM
hehe yup woody :)

btw, the manual is nice, but usually
only describes the changes from the
previous version.

the inside 3ds max series is the best
resource to learn about this software,
IMO.

and yes ppl, the point was, this sounded
like a crack request, so hence the
sarcasm...

LS


stuck with securom
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > stuck with securom
PDA

View Full Version : stuck with securom

acab
12-12-2001, 09:51 PM
I'm attempting to reverse new securom protection.
What I found was the usual 3 calls to WriteProcessMemory / cd-rom activity / more (11) WriteProcMem's.
Stepping a little more after the last WriteProcMem I eventully came to a jmp eax to the original entrypoint.
I dumped the whole process by hand and fixed the e.p. and as expected the dumped exe crashed.
The crash was caused by a call EnterCriticalSection pointing to an object not previously initialized.
So I replaced some crap at the beginning of the code with a call InitializeCriticalSection.
The program crashed again...
This time it was caused by a page fault within the first call (securom placeholder for getversion).
So I ran the original exe again and dumped a few pages of securom memory.
Then I pasted them inside a new section into the dumped exe.
What I expected this time was a new crash...
So I stepped carefully within the first call (the usual securomized getversion) and...
GREAT!!! No more page faults. The securom routine ended up executing the "real" GetVersion call...
Unbelievable! I Stepped within a few other calls and the whole thing seemed to work quite right.
So I disabled b/points and let the proggie run.
"Mmmmmm... Hey, how mutch time does this f*cking game take to load??????"
[...]
What I found out is that the proggie just loops somewhere after the first 12/15 calls.
And here's where I got lost...:(((
Can anyone help?

Phanx a lot,
acab
blackcheck
12-13-2001, 10:17 AM
what game are you working on ?

you need to rebuild the securom api calls in order
to completly remove securom.
in theory it's possible to dump/crack the securom
api handler ,but it sure is the wrong way.

as you probably noticed securom api calls always go through the SAME call

ie

call dword ptr [503972]

the return address on the stack tells the securom
code what api should be called

so what you do is:

search the text section for the ff25 ... (api call)
push the address of the next instruction (the ret address)
onto the stack then call the securom function (that you modifed
to return the real api in some register) and then create a
new iat.

just read r!scs tut on securom,it's much more detailed

or just use unsecurom or revirgin =)
acab
12-13-2001, 01:36 PM
1st of all let me say that I'm aware of your works against cd protections since a couple of years ago and I respect 'em!
So thanks master for your reply!!!!

>what game are you working on ?
Who wants 2 be millionaire (but dunno the correct english name)

>in theory it's possible to dump/crack the securom
>api handler ,but it sure is the wrong way.
I don't think there's a right and a wrong way to crack; there are just working and non working cracks. And mine is (still?) not working. This post is for those who are interested or can contribute to this different approach.

>as you probably noticed securom api calls always go through the SAME call
>call dword ptr [503972]
>the return address on the stack tells the securom
>code what api should be called
>so what you do is:
>search the text section for the ff25 ... (api call)
>push the address of the next instruction (the ret address)
>onto the stack then call the securom function (that you modifed
>to return the real api in some register) and then create a
>new iat.

Yes, I already knew this.

>or just use unsecurom or revirgin =)
Unsecurom just don't work. However if I wanted a ready made crack I'd have downloaded one from megagames or I'd have played this silly game from the raw-cloned cd.
What I'm interested in is the protection itself; is understanding why and where the dumped exe behave differently from the original one; is "decrypting" the table used by securom to get the original api address; is, as usual, having some fun with someone else code.

Thanks again,
acab
blackcheck
12-13-2001, 05:08 PM
<This post is for those who are interested or can contribute to this different approach.>

that's how your post should have started...

ok let's see... i don't have any of my notes here.

as far as i remember the api handler has almost no subroutines and is pretty easy to understand. it takes the return address and computes the api address using some tables that rely on the
cd and crcs. so you dumped the securom code and the tables
and it works for some of the calls but not for all.

maybe the tables change on runtime (find out how)

oh, there's another possibility
sometimes the api handler doesnt return the right api
but a securom address (at random) add some code
to check whether returned addresses are within the cms section.
acab
12-13-2001, 08:33 PM
<This post is for those who are interested or can contribute to this different approach.>
that's how your post should have started...

ok, you're right!

>oh, there's another possibility
>sometimes the api handler doesnt return the right api
>but a securom address (at random)

and you're right again!
sometime the handler returns the address of the handler itself instead of the api func address
when this happens inside the original exe, the handler returns the correct address the next time it's called, but the dumped exe doesn't behave the same way and just keeps on looping somewhere...
i'll check this.

THANKS a lot for your help!

oh, just another little question: inside the handler there's a strange short call i can't properly understand
this routine usually calls kernel32!ord0001 but it seems it can occasionally call DeviceIoCtrl instead
could you explain this?

Thanks again,
acab
blackcheck
12-14-2001, 04:21 PM
<oh, just another little question: inside the handler there's a strange short call i can't properly understand
this routine usually calls kernel32!ord0001 but it seems it can occasionally call DeviceIoCtrl instead
could you explain this?>

i don't remember and i don't have a securom game
in this loose palace of excile...


Anti-disassembler tricks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Anti-disassembler tricks
PDA

View Full Version : Anti-disassembler tricks

SiNTAX
12-13-2001, 08:04 AM
Just wondering if somebody knows of a tool to circumvent the anti-disassembler tricks that are used f.ex. in sd

With anti-disassembler tricks, I'm referring to the following sort of code sequences:

<< snippet from ~df394b.dll >>
1000100c: 70 0d jo 0x1000101b
1000100e: 77 03 ja 0x10001013
10001010: 87 ff xchg %edi,%edi
10001012: 90 nop
10001013: 78 0b js 0x10001020
10001015: 87 ff xchg %edi,%edi
10001017: 77 00 ja 0x10001019
10001019: 79 05 jns 0x10001020
1000101b: 87 d2 xchg %edx,%edx
1000101d: eb ef jmp 0x1000100e
1000101f: 03 eb add %ebx,%ebp
10001021: 07 pop %es

The disassembler is confused and doesn't disassemble the 0x10001020 offset correctly. (note: this is an objdump disassembly).

This also fools: IDA, W32Dasm

It's easy to manually 'correct', but I don't like the 'manually' aspect ;-)

I'm sure somebody already worked on this kind of stuff, so instead of me re-inventing the wheel, I thought I'd ask here.
MTB
12-13-2001, 07:43 PM
Hiya SiNTAX

I have also seen the effects of anti IDA/W32dasm stuff. Sometimes only IDA is affected, other times only W32dasm.

First of all I WOULD like to know how to manually fix this problem. Second have you seen ANY tutorials on this type of stuff?? I have not. Also do programmers buy this sh*t or do they create it themselves?

FYI, my current project dissambles fine in W32dasm :), however IDA is sent of to LaLa land, and dissassembles some DLL (not the exe I started with) :mad: so any pointers from you would be appreciated.

One program that uses this crap is 3Dstudio Max.

Thanks
MTB:D
JMI
12-13-2001, 10:17 PM
I haven't seen an automated anti-disassembler fixer in my searches but I did come across this zip file that has a couple of things by ?ferret and Kayaker and an article on self-modifying code that might be of some interest on the anti-disassembler issue.
SiNTAX
12-14-2001, 03:00 AM
MTB.. to fix this in IDA, you just convert the 'faulty' instruction to 'unexplored' and then convert the correct offset to code. So in this example, go to line 1000101f then press 'U', then move to offset 10001020 and press 'C'

1000100c: 70 0d jo 0x1000101b
1000100e: 77 03 ja 0x10001013
10001010: 87 ff xchg %edi,%edi
10001012: 90 nop
10001013: 78 0b js 0x10001020
10001015: 87 ff xchg %edi,%edi
10001017: 77 00 ja 0x10001019
10001019: 79 05 jns 0x10001020
1000101b: 87 d2 xchg %edx,%edx
1000101d: eb ef jmp 0x1000100e
1000101f: 03 eb add %ebx,%ebp
10001021: 07 pop %es

Anyway this kind of code is most probably autogenerated, as if you look at sd, you see that it all sort of looks the same. Probably is done using some polymorphic engine (a la virus code) to get some 'variation'

Hmm I sure could use r!sc's maid matilda ;-)
Maldoror
12-14-2001, 05:17 AM
Originally posted by SiNTAX
MTB.. to fix this in IDA, you just convert the 'faulty' instruction to 'unexplored' and then convert the correct offset to code. So in this example, go to line 1000101f then press 'U', then move to offset 10001020 and press 'C'

1000100c: 70 0d jo 0x1000101b
1000100e: 77 03 ja 0x10001013
10001010: 87 ff xchg %edi,%edi
10001012: 90 nop
10001013: 78 0b js 0x10001020
10001015: 87 ff xchg %edi,%edi
10001017: 77 00 ja 0x10001019
10001019: 79 05 jns 0x10001020
1000101b: 87 d2 xchg %edx,%edx
1000101d: eb ef jmp 0x1000100e
1000101f: 03 eb add %ebx,%ebp
10001021: 07 pop %es

Anyway this kind of code is most probably autogenerated, as if you look at sd, you see that it all sort of looks the same. Probably is done using some polymorphic engine (a la virus code) to get some 'variation'

Hmm I sure could use r!sc's maid matilda ;-)

Hello SiNTAX

First of all I don't think that the problem is at a specific address. The whole snippet seems meaningless to me.
The antidissassm tricks are very interesting to me.
I would like to explore this dll. Could you send it to me(if it is not very large)?

2. I don't know any way to autogenerate these tricks. But...who knows :)
Here is an example of an antidissassm trick.
Usually it is used when you write a protection in asm.
Suppose you have:
mov eax, offset func
call eax
The opcodes for call eax are: FF D0

Now change your code in this way:
mov eax, offset func
db 0EBh
call eax

Obviously the compliler will generate the sequence:
EB FF D0

The dissassembler (i.e. IDA) will dissassemble
mov eax, offset func in the right way.
But what to do with EB FF D0?
EB is the opcode for jmp, so you will see:
00401013 EB FF jmp short near ptr loc_401013+1
00401015 D0 68 5F shr byte ptr [eax+5Fh], 1

Note that this EB FF D0 don't change the program flow.
At the loc_401013+1 we have FF D0 so the next instuction is our call eax ;)

Greetings!
Maldoror
SiNTAX
12-14-2001, 06:01 AM
Maldoror,

The DLL is from a Safedisc2 executable, so take your favourite sd2 title and run it. It extracts 2 dll's to your temp dir, so if you break on LoadLibraryA, then halt the executable and copy the DLL's from your temp dir.
The dll is called '~df394b.dll' -- it's full of these code sequences.

And you are right that the code snippet seems meaningless, that's because it IS meaningless.. ie. it doesn't really do anything, you might well replace it all with NOP's.
The code doesn't change any flags, registers, ... so it can be injected at random locations in the real code. And to prevent a simple search 'n replace, it uses different instructions.

here's a properly decoded sequence:
----
1000653E EB 07 jmp short loc_10006547
10006540 ; ---------------------------------------------------------------------------
10006540
10006540 loc_10006540: ; CODE XREF: .txt2:10006547j
10006540 8B C0 mov eax, eax
10006542 78 06 js short loc_1000654A
10006544 90 nop
10006545 79 03 jns short loc_1000654A
10006547
10006547 loc_10006547: ; CODE XREF: .txt2:1000653Ej
10006547 EB F7 jmp short loc_10006540
10006547 ; ---------------------------------------------------------------------------
10006549 35 db 35h
1000654A ; ---------------------------------------------------------------------------
1000654A
1000654A loc_1000654A: ; CODE XREF: .txt2:10006542j
1000654A 7F 09 ; .txt2:10006545j
1000654A jg short loc_10006555
1000654C
1000654C loc_1000654C: ; CODE XREF: .txt2:10006557j
1000654C 90 nop
1000654D 87 C0 xchg eax, eax
1000654F 78 09 js short loc_1000655A
10006551 87 FF xchg edi, edi
10006553 79 05 jns short loc_1000655A
10006555
10006555 loc_10006555: ; CODE XREF: .txt2:1000654Aj
10006555 77 00 ja short $+2
10006557 7F F3 jg short loc_1000654C
10006557 ; ---------------------------------------------------------------------------
10006559 87 db 87h ; ç
1000655A ; ---------------------------------------------------------------------------
1000655A
1000655A loc_1000655A: ; CODE XREF: .txt2:1000654Fj
1000655A 8B 4D E4 ; .txt2:10006553j
1000655A mov ecx, [ebp-1Ch]

-----

The code between 1000653E and 1000655A does nothing, except fuck up IDA/W32Dasm/... auto-disassembly.. ie this is what you normally get (without intervening):

1000653E EB 07 jmp short loc_10006547
10006540 ; ---------------------------------------------------------------------------
10006540
10006540 loc_10006540: ; CODE XREF: .txt2:10006547j
10006540 8B C0 mov eax, eax
10006542 78 06 js short loc_1000654A
10006544 90 nop
10006545 79 03 jns short loc_1000654A
10006547
10006547 loc_10006547: ; CODE XREF: .txt2:1000653Ej
10006547 EB F7 jmp short loc_10006540
10006547 ; ---------------------------------------------------------------------------
10006549 35 db 35h
1000654A ; ---------------------------------------------------------------------------
1000654A
1000654A loc_1000654A: ; CODE XREF: .txt2:10006542j
1000654A 7F 09 ; .txt2:10006545j
1000654A jg short loc_10006555
1000654C
1000654C loc_1000654C: ; CODE XREF: .txt2:10006557j
1000654C 90 nop
1000654D 87 C0 xchg eax, eax
1000654F 78 09 js short near ptr loc_10006559+1
10006551 87 FF xchg edi, edi
10006553 79 05 jns short near ptr loc_10006559+1
10006555
10006555 loc_10006555: ; CODE XREF: .txt2:1000654Aj
10006555 77 00 ja short $+2
10006557 7F F3 jg short loc_1000654C
10006559
10006559 loc_10006559: ; CODE XREF: .txt2:1000654Fj
10006559 87 8B 4D E4 8D 45 ; .txt2:10006553j
10006559 xchg ecx, [ebx+458DE44Dh]
1000655F 08 8B 11 52 50 6A or [ebx+6A505211h], cl

Offset 1000655a is not properly decoded anymore.

(I hope this is 'readable' in a browser ;-)
SiNTAX
12-14-2001, 06:12 AM
ArthaXerXes,

Ah.. I knew somebody must have done this before ;-) Saves me the trouble.. was thinking of writing an IDC script to clean up this mess.

I'll give imhotep a go...
JMI
12-18-2001, 10:59 PM
If you're looking for further reading materials on anti-debugging tutotials, Krobar has a selection in his "Complete" section.

Regards.
SiNTAX
12-19-2001, 03:26 AM
And where can I find Krobar's material?

Anyway imhotep does a decent job at cleaning the cruft from sd
JMI
12-19-2001, 01:26 PM
Searching would be a good place to start. Typing "Krobar" into google immediately gives at least three alternative locations for "tHe Krobar Collection." The one I've been using is at :
http://www.krobar.cjb.net


Does As-Protect use "Exception handling"?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Does As-Protect use "Exception handling"?
PDA

View Full Version : Does As-Protect use "Exception handling"?

riPPadoGG
12-13-2001, 08:24 AM
Hi All,

I unpacked Cresotech Type Recorder.. AsProtect 1.2..
But when I ran it after unpacking, there came in a message-box saying that an Error occured as memory in the range of E00000+(message had the exact memory loc) was accessed.
The interesting point was that it was not a Windows message, Soft-Ice did not break(was faults on). I used Symbol loader, and noped out the call to the wild..(3rd one from OEP) The proggie ran like anything..

My question is why did Windows/S-Ice did not complain about the exception?
Is this due to "Exception handling from within the program??"

regards
riPPadoGG

HAVE A NICE TIME REVERSING :)
+SplAj
12-13-2001, 09:48 AM
yes it's possible the programmer used SEH.

If you see code like

push ebp
push 403616
push dword ptr fs:[edx]
mov fs:[edx],esp
....

then the new exception handler code is 403616 and the exceptions will be filtered there....?

However, what you found is a 'fixed' link to redirected code to aspr code that is no longer there....(same technique as the IAT redirection)

Try and re-run original exe and set a bpr/bpm on that location and trace it to it's real code.

eg

48E818 Call [49068C] == aspr Call FEC784 == Call 48E534

so in the unpacked code hex edit the hardcoded 84C7FE at offset 0x9068C with 34E548 (reverse byte order !!!) and that one is fixed....next prob ;)

Hope that helps ?

Spl/\j
riPPadoGG
12-14-2001, 01:36 AM
Hi +Splaj...

Yes, that is correct.
It might very well be a call redirected to some really valid part of code.
Looking back, NOPing out was TOO hasty..
The program actually kicks off(GetModuleHandle et al) from the Call before.. :mad:

What sort of a doGG am I?

PANT PANT...
SNIFF SNIFF SNIFF...

:p

regards
riPPadoGG

NB: Looking forward to your tuts..

LIFE IS SHORT... BYTE HARD... ;)
JMI
12-14-2001, 02:23 AM
riPPadoGG:

Here's a snippet from one of those tuts, since is addresses the specific point +SplAj raised and you discovered. Our resident "coding God", see text below, had just finished unpacking and fixing the import table of Awave Studio 7.3, an Asprotect 1.2 protected target. He then tried to run his unpacked file, called "dumped.exe" and discovered two additional issues, one of which was a reference back to Aspr code that wasn't there anymore, which was important for the proper working of the program. Here it is:

____________________________________

Try and run your dumped.exe and you get a message' EXIT you must not rename the program executable file [Awave.exe].'
Yeh ? well fuck off I am a coding god and can do anything to you that I want. So rename your dumped.exe to Xwave.exe and use an hex editor at raw offset 0xD9520 and 0xD952C and change Awave to Xwave ;)

Re run Xwave.exe and whoooo WTF we crashed and burned at some goddam 0xF1C774 ???

Lets debug ;)

Start Awave.exe with Symbol Loader and trace till we find when we get to F1C774 :-

I found it at : 0187:0046D5D4 CALL [004EBA08] ->

EAX=00498101 EBX=00F30A44 ECX=00000001 EDX=00F35648 ESI=00000000
EDI=004EB858 EBP=816B09D8 ESP=007BFD38 EIP=0046D5DA o d I s Z a P c
CS=0187 DS=018F SS=018F ES=018F FS=2297 GS=0000
------------------------------------------------------------------
0187:004EBA08 74 C7 F1 00 00 00 00 00-00 00 00 00 00 00 00 00

------------------------------------------------------------------
0187:00F1C774 55 PUSH EBP
0187:00F1C775 8BEC MOV EBP,ESP
0187:00F1C777 53 PUSH EBX
0187:00F1C778 56 PUSH ESI
0187:00F1C779 8B5D0C MOV EBX,[EBP+0C]
0187:00F1C77C 8B7508 MOV ESI,[EBP+08]
0187:00F1C77F 8BC3 MOV EAX,EBX
0187:00F1C781 E8E25DFFFF CALL 00F12568
0187:00F1C786 A3B435F200 MOV [00F235B4],EAX
0187:00F1C78B 8B15B435F200 MOV EDX,[00F235B4]
0187:00F1C791 8BC6 MOV EAX,ESI
0187:00F1C793 8BCB MOV ECX,EBX
0187:00F1C795 blah blah blah..............

CALL [4EBA08] is a redirected call to the memory pointed there :- F1C774 and because this code is no longer available in our Xwave.exe - we are running without aspr remember, we need to figure out what this call does. It is NOT an API call but does decrypt some code and returns (RET 008 = = very important) to our code at 46D5DA.

My tactic was to re-run Awave.exe and just after this call had been made to decrypt some code and then dump at 46D5DA. Re-do the fix up with LordPE , Entry Point, IAT/IT bin reloaded etc etc and then change the bytes at offset EBA08 in this dump from 74 C7 F1 to a spare location, like raw offset F0000 and then put a RET 008 . So patch :-
At raw offset 0xEBA08 replace the 74 C7 F1 with 00 00 4F and at raw offset 0xF0000 put the bytes C2 08 00 -> RET 008 and save.

rerun the Xwave.exe and I think we are close ;) still evaluating .....but f*ckin close ......................
____________________
end of snippet

I've got all the +Splaj materials to upload except something he mentioned about "html unencryption" and if I don't hear from him by sometime tomorrow I'll upload the original discompress materials + the latest tuts on Awave Studio and CV3.1. When you read the tut on CommView, don't forget to check out the long thread, started by evaluator discussing changes in the protection with a later build of version 3.1. Very informative reading. You'll find it here:

http://www.woodmann.net/forum/showthread.php?threadid=2263

regards and cudos to the author of this tutorial series. He really shows the way for us to follow and learn.


RE:Neolite..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RE:Neolite..
PDA

View Full Version : RE:Neolite..

hobgoblin
12-13-2001, 02:27 PM
Greetings,
I'm looking for tuts about how to manually unpack neolite packed programs. Any hints?

TIA,
regards,
hobgoblin
JMI
12-13-2001, 03:21 PM
hobgoblin:

Are we being just a tad bit lazy? Let me sing that same old tune one more time. "Did you use the search button?" or that other old favorite: "Did you search anywhere else?"

Typing "neolite+tutorials" into google (www.google.com) quickly produced 4 pages of references including two from the fravia site on the very first page. It also mentioned CoDe_InSiDe's homepage as a place to look.

The two fravia tuts are:

http://www.woodmann.net/fravia/text/eb_tut32.txt
by enternal bliss

and

http://www.woodmann.net/fravia/Neolitepackeddll.htm
by Bit Reaper

Surely you can make the same effort at searching. It didn't hurt much at all, and took very very little time. There are even tutorial search site you might want to learn about and check out.

O.K. enough sermon.
Hope those files and hints help.
hobgoblin
12-13-2001, 03:53 PM
First of all: thanks for the response. I always like to be helped.

For your information: I typed in neolite+tut in google and altavista. Result: nill (try it for yourself...)

And one question: do you have a problem with the kind of requests I just made?
Do you know anything about what lies behind a request like that?
Sometimes there is a reason for people making what you view as "lazy requests"...
If it bothers you, why don't you just ignore it?
(and that's what I probably should have done in this case...)
Your answer just pissed me off a little bit...

But back to beginning: I appreciate your helpfulness.

regards,
hob
JMI
12-13-2001, 04:13 PM
hobgoblin:

It's ok if you're pissed off, but that was not my intent. If your post said something like "I've searched for tuts on neolite, but having no luck, any hints" I would have skipped the "tad bit lazy" part, but I'm also trying to get more people to make an effort and, as others have stated, show that they have made an effort and what that effort is. Since you didn't say you had done anything already, I simply took the opportunity to spread the message that searching on one's own is the preferred first step. Of course I can't know "what lies behind a request like that" and that's why it might be helpful to say a bit more about what does lie behind it. And if you think about it after your blood stops boiling, the phrase "a tad bit lazy" was a question, not really an accusation.

I have no explaination for your lack of success on google. As I said, I typed in "neolite+tutorials" and got four pages. I took your challenge and typed in "neolite+tut" on google and got three pages with most of the same references.

Since I have no way of knowing what you know, I also mentioned the tutorial search engines, because they might be news to others reading the thread. You'll find a good tutorial search engine here:

http://reversersearch.da.ru/

and a good link list to things reversing here:

http://dmoz.org/Computers/Hacking/Cracking/

Using the search button here will led to some informative threads here discusssing neolite packed programs and unpacking issues.

I've already done war and it's often very loud, usually very messy and sometimes you can't figure out who the enemy is. I'm certainly not one of yours.

As Woodmann would say in closing
Peace.
hobgoblin
12-14-2001, 03:56 AM
Just want to say ;) and thank you for the search-tip.

regards,
JMI
12-14-2001, 04:05 AM
You are welcome and if you haven't come across it already, or if somebody else wants it, here's a tut by CoDe_InSiDe on manually unpacking Neolite 2.0, with a packed notepad to practice on.
nofurs
12-14-2001, 06:23 AM
Greetings,
JMI Why don't you just give the url ;)
Sorry for sapmming the url guys
http://members.home.nl/code.inside/

Hi Hobgoblin,
Could it your browser has problems? I found what
JMI found of course without the quotes ;)
JMI
12-14-2001, 12:22 PM
Greetings cluesurf:

The only reason I didn't give the url for Code_InSiDe was that I had mentioned his home page in the previous post and one of my main goals is to encourage people to search on their own. I happened to have the Neolite tut on my HD, so I though I'd just offer it anyway. There's lots of other interesting stuff to be found on CoDe_InSiDe's homepage, so give it a check. If memory serves, this was the major tut on Neolite there.

Just to clear up one point from cluesurf's post, I don't use quotation marks at the start or end of what I put in the google search box. That was done only to try to make as clear as possible where the words I used started and ended. Next time, I'll just display it like this:

neolite+tutorial

so there will be no confusion. I really recommend that anyone without much experience at searching check out the section on

How to search

at the fravia site at http://tsehp.cjb.net . It can be accessed from the link at the bottom of the main page here. They have a page of search engines and search forms. Some of them no longer work, but it is a good learning place. The tutorial search form reference I gave is, I believe, associated with Fravia. At least it uses a picture from his original site.

Just as an example of what you might need to find, a tutorial you are reading might be talking about a version of a program that is no longer available at the official site and the code may be quite different from the details discussed in the tut. If the program is not too old, often you can search for the title and version and find somewhere that has a copy of the older version for downloading.

Last night I was looking for a copy of version 7.3 of Awave Studio to follow along with the +SplAj tut on that version that I will be uploading for distribution with his discompress site materials. The current version is 8 and the only one available at the company's site, and often after a tut has been posted somewhere the authors of the software or their protection company make changes in the code. I haven't checked version 8 yet to see if they tried to get around +SplAj's discoveries, but it is a larger file with likely many changes. Maybe the protection has changed because of the tut, maybe not.

A good example of the confusion this can cause is the thread here started by evaluator with posts by +tsehp,+SplAj, and others, discussing Revirgin and import tables on CommView 3.1. This is another of the tuts +SplAj did that will be in the upload. Use the search button at the top and under user name enter evaluator or +SplAj and you'll find it.

+Splaj's tut was about version 3.1, but hadn't identified the build number. Evaluator, working on the same version number, 3.1, discussed getting different import table results. +SplAj downloaded the latest version and got even more different import table listings and it turned out that the latest version, at that time, was 3.1.161 and evaluator was using 3.1.160, and the original tut was written using 3.1.156, so that explained why everyone was getting different results with the same version number. Helps to check the build number, often found in the About box of the Help dialogue.

So if you are trying to follow a tut line by line, rather than learning just the method of attack, you need to have the exact same version and build. Searching for an alternative download site may be the only way to find it. Even if you're like me and don't read many other languages, and I have great respect for those reversers who aren't native english speakers who are trying this in what is to them a foreign language, you can often find older version of programs on Russian, Chinese, Japanese, and Korean sites, to name but a few. Usually the program names are in english and if you move your cursor over the page and look at the bottom of your browser you will often see when you have located a zip or rar file for downloading. Give it a try. There is some amazing stuff out there.

Regards.
CoDe_InSiDe
12-14-2001, 01:26 PM
Hi everyone,

Bleh, my Neolite Tutorial :D
I'm gonna re-do it sometime, because it's not detailed enough hehe ;)

Cya...

CoDe_InSiDe
JMI
12-14-2001, 04:16 PM
Just a quick note on the two +SplAj tuts on Awave Studio and CV 3.1; for those who don't want to wait until I upload the discompress site with the additions. Those two files are available as attachments to the the thread here:

http://www.woodmann.net/forum/showthread.php?threadid=2001

Posted it on the thread about +SplAj's Tuts and mention it here only because I mentioned his tut in the previous post and someone might want to check it out.

Enjoy.


PACE Interlok
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PACE Interlok
PDA

View Full Version : PACE Interlok

metodej
12-14-2001, 07:27 AM
Hi,
I am really new here. This is my first post.
I am searching for some help with PACE Interlok. I am trying to unlock Waves Restoration Bundle which uses Interlok tpkd.vxd version 3.0.7.817
Ihave readed the neviens thread about this and all the mentioned tuts but it seems to me that it is all about NT system.
I am using W 98.
Could somebody help me?
Maybe I am trying to work with no easy prog as I am not very experienced.

Metodej
JMI
12-14-2001, 12:56 PM
There doesn't seem to be a great deal out there, perhaps because much of the Pace protection was focused in the music area early on, but they provide, or at least did provide the protection for InstallShield installation program and there is also a +Tsehp article on the What's New page called "Installshield pro 6.2 Eval". I haven't checked out many InstallShield articles for a while. Some of them are focused on the script, rather than the Interlok features, but the +Tsehp article discusses getting by the Interlok feature fairly easily. It's also written from the point of view of nt/w2k, but maybe Interlok doesn't know about OllyDbg, don't know, but it might be worth a try.

I remember on the MAC I had to use a debugger it didn't recognize to get to study the code because it bombed the current popular brands. There they used a wrapper that added code sections and used a short key word to add to a checksum of the code sections, both before and after they were decrypted, to decryp the real programs code sections, but the final "magic key" to decrypt the real code was visable in memory and I had located the code that lead me to where they put it and I used it to do my own decryption of the code, but MAC coding was very different from the PC. They would load smaller code sections as needed and use a central jump table to index procedures within the sections as they were loaded.

If you find anything else, please post it here.
metodej
12-16-2001, 05:05 AM
Hi JMI,
Thanks for your quick post.

I found and readed Tsehp article about Installshield eval before I posted my question actually. It seems to me it does not help with W98 VxD. I have allso tried the Olly Dbg - my computer shut down immediately when I first loaded Olly and then opened the Waves plugin in CoolEdit. Olly has interesting featue "Attach to Process". When I tried this, it did not shut down, but I have found only Waves plugin in memory map, not the evil Tpkd. VxD which I think only serves as loader/unpacker for the plugin dll. I think it loads the dll, unpacks it and checks for the days left in trial or for registered version. It vanishes from memory then. Does anybody think I can use the memory map window of Olly to rebuild the plugin dll into shape when that tpkd.vxd is not needed any more? the Olly Dbg has the feature to backup memory content. I saved it, but it did not look like the code/data/res. I have downloaded the Olly Dbg only last week and I am not familiar with it yet. So mybe I am asking some silly questions.

Thanks a lot.

Metodej
metodej
12-16-2001, 05:25 AM
One more thing I forgot to mention.

There is a TNT crack for PACE Interlok tpkd.vxd out there (search Astalavista), but it works with previous version of Interlok (PACE's InterLok 3.0.3.793).

Metodej


Another protecton system bites the dust..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Another protecton system bites the dust..
PDA

View Full Version : Another protecton system bites the dust..

+Sandman
12-15-2001, 10:01 AM
Greetings friends...

Some of you might have noticed that my RCE page expired a few days ago after being frozen in time for well over a year now. The owners of ***.idca.com have my eternal grattitude for protecting my web page all these years against hackers and (4) threatened law suits, their support is a great loss to us all. There are no plans to resurrect my antique web page, besides, it can be found on the RCE CD.

From time to time I recieve a tutorial that begs to be read and learned from, one such tutorial was recieved a few days ago and this one I feel deserves the attention of every newbie.. Its written by Eisenbeiss.. a newbie cracker.

All I will say is this... being able to defeat a protection system is one thing, but to be able to do it in such a away that then makes the author(s) think twice about their claims that "that once the programme has been purchased it cannot be copied for use on any other machine without reverting to its trial status. "

The moral of this story for newbies is... The more the protectionist(s) claims their program/protection system can't be broken, the weaker their claims become when you call their bluff!.

I have attached Eisenbeiss tutorial for everyone to read and learn from..

Regards

+Sandman
Eternal Bliss
12-15-2001, 01:21 PM
Tanner Street London Bridge...
hmm... Damn. If only I have seen that essay earlier... Could have pop over and see how that lameass look like. 8)

LOL
EB
:D
dunno
12-15-2001, 04:33 PM
If I'm not mistaken, it's been a long long time since Softwrap had bitten the dust.

I've once downloaded a crack for a softwrapped app. and enjoyed very much the nag screen of it (attached) after the crack.

Read BlackB's essay (attached) to learn the story about it.
esther
12-16-2001, 09:06 AM
Originally posted by dunno
If I'm not mistaken, it's been a long long time since Softwrap had bitten the dust.

I've once downloaded a crack for a softwrapped app. and enjoyed very much the nag screen of it (attached) after the crack.

Read BlackB's essay (attached) to learn the story about it.

Well As you said its been a long time ago :D.
It does makes a different that a newbie has wrote a good tute
thumbs up :cool:
Bengaly
12-17-2001, 01:41 PM
I don't care about anything u says,
but this thread was from +Sandi :-))
which means my teacher still there and active :))

+SandMan rocks my world

bye bye and take care, especially Snadi :))
Aimless
12-19-2001, 01:11 AM
Tsk, Tsk...

Such love.!!

Almost indecent...

Nice to know you and the teacher are still on and close to each other.

Somehow...reminds me of the movie re-unions though.

...Have Phun


RCE CD ? How to get it ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RCE CD ? How to get it ?
PDA

View Full Version : RCE CD ? How to get it ?

tttung
12-15-2001, 11:59 PM
Hi everyone here
From threads here and some other places I heard about RCE CD project. Searching old messages here I know that it was realeased but I couldn't find it anywhere online. Anyone has any idea how could I get this CD. I really really want it.
Thank you all very much
TTT
stealthFIGHTER
12-16-2001, 07:48 AM
Hello,

read here: http://www.woodmann.net/forum/showthread.php?s=&threadid=1953&perpage=15&pagenumber=3

You can ask kb_ for the cd. I've dowlnoaded it from him.

Good luck,
sF
acab
12-20-2001, 08:16 AM
Any one interested in downloading the RCE cd, feel free to mail me:
acab[at]softhome[point]net
Hoof Arted
12-20-2001, 09:24 AM
Available here as well.
Viper
12-25-2001, 08:41 PM
Thanks for the download KP_
mitrix
01-04-2002, 01:04 AM
How to download REC CD ?
My address is MITRIX(AT)21CN(DOT)COM.
Solomon
01-04-2002, 11:08 AM
I have got it. Thx aCab for sharing!
MTB
01-04-2002, 07:04 PM
Me to Please.

mtb_4_god at yahoo.com

Thanks
Yes the mtb was taken at yahoo so I had to make something up


A good starting point?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A good starting point?
PDA

View Full Version : A good starting point?

matthew
12-16-2001, 02:53 AM
As this is the newbies forum, can someone give me direction as to where I can find good simple tutorials? Essays are nice and plentiful, but without a little beforehand knowledge you won't get as much from them... I have a decent knowledge of softice, assembly, and some of the processes involved in cracking. But I'm usually on the programming side of the assembly, so this 'cmp eax [esp+08]' type stuff is a little bit confusing.

It's sucks that the sandmans site is down, but it was hard to find a bunch of the older programs anyways, making it that much more difficult to learn from for a newbie.

I'm downloading essays as I type! So please don't harass me, I'll take a look at them in the morning when I can think clearer.

Thanks, matt.

/I have a Win2k machine, Driver Studio 2.5, masm, & a bunch of cracking-related tools/

BTW, can you dump screens from softice into a text file? Something that you could look at later and comment on? (I AM reading the manual, but if I can't find anything you guys are my backup;)
stealthFIGHTER
12-16-2001, 07:42 AM
Hi matthew,

>>BTW, can you dump screens from softice into a text file?

Yes, you can dump screens using IceDump (more at http:))icedump.tsx.org).

(maybe I would recommend you to use Win98 OS, because lot of newbies have problems with using SoftICE under Win2000, especialy with hmemcpy/memcpy breakpoint ;).

For essays you can visit ID archive; the link is at the bottom of the main page of this forum :);

Regards,
sF
S.Holmes
12-16-2001, 09:52 AM
Hello everyone.
I'm a newie too but more newbie than matthew is as I don't know a lot of assembly, softIce, etc.
My question is: can i hope to learn cracking without being a programmer?
If not should I learn assembly (it looks pretty hard IMHO) or any other suggested language?

I've read the famous +ORC tuts and they are interesting, nut boy they are really outdated; does any similar material (organic and complete tutorials) up to date exist ?

Thanks a lot for your attention
S. Holmes

P.S. Any other italian guys here? Italian scene seems a bit sleepy!
?ferret
12-16-2001, 12:27 PM
Some programming background is helpful, if just to know the general flow process of how programs work. It is not absolutely necessary however. Get a softice command reference and an API guide and study them.

As for simple tutorials, I have a few at qferret.cjb.net. I specifically chose programs that were easy enough for newbies, and wrote the tuts with newbies in mind. The programs shouldn't be too hard to find either.

Good luck and have fun.
JMI
12-16-2001, 06:48 PM
Matthew, S.Holmes:

Unless you are reviewing a program compiled from a system that the debuggers don't translate into assembly language you are going to need some basic understanding of assembly, simply because that is the language that you use to "read" the disassembly of the code from its "higher" programming language. With some exceptions, not necessary relevant, here you don't get "source" code to look at, only assembly.

Among the thing you have to have some general understanding about is the register system of the PC world and how information in moved into and out of these registers as it is processed by the operating system. Programming skill is useful when you want to patch or change code, but even if you don't do that, you still need a general understanding of what the assembly is telling you the program is doing as it works its way through the author's code.

As an example from Matthew's post, if you don't know what the ax register is, or even about 16 bit or 32 bit registers (and now maybe even 64 bit) or where it is shown in the softice output or what esp+8 means, and what it means to set a flag after a compare, you can't very well look at a data or other windows in softice with much understanding of what you're looking at or what might happen after the compare is made or the assembly opcode executes. Without some of this basic knowledge, you are more limited to attempting to follow, line by line only, somebody's tutorial without actually having much grasp of what the author was talking about and unable to use the information very well if the version number of a target has changed and the information you were looking for is now at a different address.

As ?ferret said, the softice reference has some basic information about the registers and how they work and these general concepts. Its available everywhere. Another great source for assembly information is, of course

http://spiff.tripnet.se/~iczelion/

and there are several other masters of this art whose works and sites are discussed in other posts. Iczelion's site has tutorials and source code also and is working.

There are also many articles, some mentioned here in other threads, found through the search button, discussing softice and breakpoints, and on the fravia site on the Links at the bottom of the forum.

It's like anything else you learned in school or anywhere. Certain basic concepts are necessary to understand the art, but they shouldn't be beyond the grasp of anyone who wants to make the effort and is willing to do some work. We don't just wake up one morning and start speaking and understanding assembly language. If you show that you have made an effort and are having trouble, someone here likely can and will help.

But there are still many things that can be learned from tutorials, that have little to do with "how do I crack program X v 123." Pay attention to how various programers provide for the registration of their program and where they hide the information after it is registered. Is it in the win register or a file on the HD? Do you know the tools that permit you to find out what is being registered and where? Do you know what files a program is writing to your HD and where? What are the tutorials telling you that this company is using as their methods, because maybe (and maybe not) the next version will use the same system or one you read about in a tutorial about another product.

If you really want to LEARN about RCE, keep notes and store things in an organized system on your HD or other media. You could keep tutorials on programs that use Asprotect, for example, in one place and then you can study the evolution of the protection and the methods of attack used by those with more experience and skill than your current level. In short, make it a LEARNING PROCESS, not just an attack on one program or another. Using your brain is, of cource, the best tool and the essential one in the process and you can approach this as an exercise in trying to out think the original programmer. Since a great many of the programs that are cracked are of little or not much vaule to most people, it is this intellectual challenge that the game is really all about. Lucky for us that it is generally a great deal easier, but not necessarily easy, to circumvent a protection system than it is to create a good program itself.

Regards.
MTB
12-16-2001, 07:18 PM
Matthew, S.Holmes

From a Newbie, some advice, since it's free you may ignore it, or you may profit from it.

1. Using a disassembler (IDA preferred, or W32dasm fast, easy, not as powerfull as IDA) to create a DL (Dead Listing) most times is easire than using SICE at least for me!

2. Minimal programming experiece is required, ie do you know how a jump works ( go to statement ), do you know what hex is? ETC.

3. What is actually more important (my opinion only) is to know how the code works ie (a piece of software that you use day in and day out). You will understand the error messages when you screw up something, and if the data is mangled you will immediately know.

4. Tutorials,the simple advice, read as many as you can get your hands on. Unfortunately the ++Crackz++ site is history (I thought it was the best) you can try the fravia site.

5. Operating systems best one for cracking is 98SE, everything seems to work on it. (Yes I know it's not very stable but those are the breaks).

I would suggest for you to pick a first target, then search for tutorials on it (even old versions), FYI most authors/companies never update their protection schemes (except for the big ones ie Micro$oft, Autodesk etc). I actually find shareware significantly more difficult to manipulate than dongle software, so beware!

Good Luck
MTB
JMI
12-16-2001, 08:54 PM
+Sandman has reported that his site closed a couple of days ago, but that doesn't mean that his tutorials are not available. A little quick searching with

sandman+crack*

led to this site

http://cgi.t35.com/digitalhack/textfiles.htm

which had a zip file of 55 +Sandman tutorials and numerous assembly language text files, including a primer and other basic documents. They're near the bottom. Check it out and keep searching. There's likely a +Sandman mirror out there with nearly everything from his site. Another example, Krobar's site has tutorials 1-74, and a whole bunch of other sites essays. There's some great assembly materials in the +Greythorne essays. It also has the Softice Manual, Reference, and quickstart guides,

Regards.
S.Holmes
12-17-2001, 12:22 PM
I really appreciate your help!
It's nice to see that in the web places where people is willing to help still exist. It's not always the same in real life :( .

JMI : I came here after learning a lot of things from Fravia's wonderful lore on searching the internet. Then I learned that Fravia had an old frozen site realting to the art of cracking and then i digged my way till here!
PC is my hobby and in my mind there is nothing worst than using something that appears to your mind as a black incomprehensible box. That's how I deal with my studies, with my life, etc.
So I will certainly follow your advice and I already began downloading tutorials, guides, howtos, etc. If I dont understand them now they will come handy in the future (I hope).
I will probably not have many hours to dedicate to RCE so I don't hope to become a good cracker, but i would like to learn as much as i can, relatively to the time real life graciously give me.
If I understood well my way should be:
1) Assembly and registers
2) How to use the "tools of the trade"
3) Then experimenting with as many tuts as i can.
This seems interesting; I hope I'll be able to do it
:o

?ferret: thank you for the link to your site; many many interesting things there. I already have found all the tools and many tuts.

MTB : LOL I use WIN98SE and I wouldn't change it for WinXP neither if Bill would send it to me free of charge for Christmas. I don't know but it looks like a sort of trap for the mind to me. They really want you not to undestand how your puter works... sad ....

May I ask here a question about SoftIce or am I off topic? I saw a section for the tools so I think I should post there (Ok, I manipulated the dat file for entering the exact amount of RAM I have as told from Sandman in his tut Softice for beginners - 512M - and after restarting PC crashed : not enough memory to initialize Vcache on a ugly blue screen; booted again in ****mode (don't know in english, when it loads the minimum, provisory ?? :P) changed the amount to 32M and afterwards everything ok, why??)

Again thanks to everyone for your help.
S.Holmes
S.Holmes
12-17-2001, 12:33 PM
SoftIce inconvenient already solved with the SEARCH function.
Sorry :rolleyes:
S. Holmes
JMI
12-17-2001, 02:20 PM
S.Holmes:

Now you see what I mean when I advise people to try the search button before they post a question. Just wanted to reply to some of the points of your reply so that my previous post doesn't confuse the issue too much.

You don't actually need to have a detailed grasp on how to code in assembly to learn how to reverse the code that someone else has written. I'm not advocating that you don't learn some coding skills, but only saying that what you need for reversing is at least a basic understanding of the assembly operation codes so that you understand what the program is doing, even if you are not sure exactly why. By this I mean, as an example, that you understand when an instruction is fetching 2 bytes from a memory address, or adding what is in one of the registers to what is in another register or at some memory address, or whatever is happening. These are just examples of things that happen in the stepping through the code or in looking at a dead listing. The goal is understanding at least WHAT is happening, the WHY is a bonus.

For example, the code may compare a serial number you have entered in a dialogue box with some coded number in memory or one actually in the code without encryption. It may process what you entered and that routine which processes the entry might have to pass through a routine that give a mathamatical result that says it is a "good boy" or "bad boy." You need a general understanding of what the code is actually doing to what you entered if you want to try to actually get a valid registration code. Maybe you can find a simple "good boy vs. bad boy" jump and change the condition of the jump from a jump only if a certain condition is found to always jump, but these simple protections are not as often found, or not as obviously, in the more difficult programs.

You may learn how to change the text of a box to display that it is registered but you might not actually have converted it into a fully functional program, or the full code may not actually be there, and the program is "crippled" and can't be made into a full working copy.

Many programs are packed, either by the compiler or some protectionists product. You need to have a general understanding of how to manually unpack or you are at the mercy of those who make unpackers and protectors, and they are in a constant race to make small modifications to their stuff to get around the others latest trick. +SplAj and others with vast experience make it look easy, but part of that is based on knowing how the code and the packing/unpacking has to work.

Again, simply as an example, a win program generally uses some of the API to call various defined sections of code to do things like open windows and place buttons. Things that you don't have to re-invent each time. References to these things are generally found in what's called the import table and, by definition, they should be placed at a certain spot in the code of a PE. Many of the protectors try to hide, mangle or otherwise mess with this import table so that if you are able to look at or dump the code from memory it doesn't make sense or doesn't lead to where it appears it should go.

But I believe it to be true to say that the code can't actually run in an encrypted state and a re-directed, or re-re-directed import table has to eventually lead back to the correct spot in the API or the windows won't draw correctly or the buttons that are supposed to work, don't work. This is what programs like revirgin attempt to do for us, find the right address without the mess added by the protectionist.

The protectors try to keep you from looking at the code because they know that if you can look at the code and study it long enough, you can figure out their protection, if you understand WHAT you are looking at. That's why they try to detect and blow-up the debugger code and why programs have been constructed by people who really, really, really know how to code in assembly to try to hide softice from the people who want to make it crash. (Thanks Owl)

So if you learn how to unpack, or use an unpacker, the protection may include changes in the original code to make the program crash without the protection in memory or because of the protections changes. Again you need to understand what the debugger is showing you when the crash occurs and where, so you can go there and look at the code and try to figure out how to change it so it doesn't crash there anymore and then look for the next problem. All these things require you to know what the code is doing at the spot you are looking at, but again you don't necessarily have to know WHY the programmer or the compiler chose to put that code at that spot, just that it has to be fixed to run "correctly."

This is a very simple overview of some issues that get very complicated, but the bottom line is that if you don't begin to understand WHAT the code is trying to do at the spot you look at it, you are not likely to make much progress in reversing. These are the kinds of things you can learn from the tuts even without the program to try it on. What code did the author attack and what changes did the author make and what was the result to the code, not just the program. Sometimes it doesn't make a lot of sense as you first read it, but after you read more you will realize that you have seen alot of the same stuff before and begin to recognize patterns of attacks and techniques to try yourself. As I said, its a learning process and it should be ongoing.

Keep searching and keep studying and when you have specific questions, come ask someone here to help, but say what you have done and where you are stuck or confused and likely you will find the help you need. I'm still spending a great deal more time studying the art than practicing it, simply because I want to understand WHAT I'm doing, not just doing, step by step, what someone else layed out for me in a tutorial. I try to figure out the WHY of what worked, so the next version of the program, with code in different places or different methods is a challenge, but not impossible.

Regards.
JMI
12-18-2001, 07:17 PM
For anyone just starting out you will find a good collection of information on the Krobar Tutorial Collection site. It has a good section titled "Begin" which has many, many tutorials and reference materials gathered from other sites for one to review. It has several good references on assembly language for the beginner. The entire beginners section, of 9.6 mb can also be downloaded as a single zip file or you can download the individual reference materials or tutorials.

There is also a section which has collected groups of tutorials from many places on the web, many of which have had their individual sites closed now. While it isn't the only such collection, it is extensive. I believe the entire collection is now over 100 MB.

There should be enough information there to give anyone a good start and lots of reading material. It's at:

http://www.krobar.cjb.net

Regards.
riPPadoGG
12-19-2001, 08:51 AM
++ to Krobar collection from me too..
I have benefited a lot from those..

;)

HAVE A NICE TIME CRACKING


softice for winxp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice for winxp
PDA

View Full Version : softice for winxp

Nemesis]
12-16-2001, 09:29 AM
hi all am new here Id like to no why hmemcpy not working ? in windowxp is there anything I can do .. I dont know please help
i have the latest NuMega DriverStudio 2.5 for winxp.

Thanks
Nemesis]
JMI
12-16-2001, 05:08 PM
Nemesis]

As I do with many of my posts I would urge you to look around the board and various forums and perhaps use the search feature before you just post a question without showing something to indicate you've made at least some effort on your own.

On the Newbie forum, about 10 or 11 items below your post there is a thread identified as HMEMCPY which should be a big hint that it might give you some information.

On the Tools of the Trade Forum there are threads about Softice and WinXP and about Driver Studio 2.5 and 2.6 that address issues about the compatability, or lack thereof, of softice and WinXP.

You will find that people here are most/more helpful when you show that you have done some basic homework and indicate what you have done, whether it is a coding question, a searching question, or even just a general question.

I'm sure there is a great deal of information on the NuMega Forum addressing these issues. Maybe you've looked already, but your post doesn't indicate that you have made any effort on your own. Those other threads here seem to have a rather clear answer for your question, if you just look around.
Nemesis]
12-16-2001, 05:26 PM
thanks for your reply

I have found something cool very entersting here
http://www.microsoft.com/WINDOWSXP/pro/using/howto/gettingstarted/multiboot.asp

I got your point JMI

Nemesis]
JMI
12-16-2001, 05:40 PM
One last small point that I've also mentioned on one prior occassion. I may be mistaken, I have been before, but I believe that the avatars are supposed to be identifers of individuals, somewhat like their nick. You are assuming an older version of the avatar of +Splaj and you can read his humorous response when I mentioned this to another new member in the HMEMCPY thread on the Newbie Forum.

Not only did you get the point of how to make this work better for all of us, you provided additional information for others and that's always the best response.

Also, its best if you don't post direct urls here to software companies. It provides the administrators of the pages you visit a direct link back here. Two easy ways to prevent this is to turn off the "automatically parse URLs" buttion under the Options for your post, or use something like hxxp or wxw in the address of the url

Regards.


IceX by Mamaich for Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceX by Mamaich for Softice
PDA

View Full Version : IceX by Mamaich for Softice

Xorax
12-16-2001, 04:58 PM
Is this extension by Mamaich still around?
I found a link for it from protools pointing to his website(www.mamaich.f2s.com) but his site is down . Does anyone know where i can get hold of it? btw, it sounds like a great extension for softice with scripting support and all.
Thxs a million.(especially to Mamaich)
Xorax.
Maldoror
12-20-2001, 04:45 AM
Mamaich can be found here:
www.reversing.net
You can post a message in the forum.
Knowing russian language is an advantage ;)

Maldoror
mamaich
12-20-2001, 08:22 PM
Yes. My site was killed for no reason. I will reopen it somewhere in a few weeks. Possibly on h**p://www.mfiles.f2s.com
I've stopped working on IceX. I'm trying to make another project on its base, but I will upload IceX with sources to my new site.


Odd softice behaviour
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Odd softice behaviour
PDA

View Full Version : Odd softice behaviour

matthew
12-16-2001, 10:45 PM
I've been having a problem with softice where I will assemble something into memory (usually messing with the ws_style on another app), but after i'm done the app still acts like its been patched....

For example, I set a breakpoint on the push ws_styles.. of notepad.exe, change it to remove the system menu.. It works, i'm happy. I exit softice. Run notepad, system menu is still gone! Am I going to have to reboot every time I want to remedy this?
DakienDX
12-17-2001, 11:26 AM
Hello matthew !

I think the problem has already discussed on the Board. You could have used the search function.

Anyway, try this (http://www.woodmann.net/forum/showthread.php?threadid=2282) and this (http://www.woodmann.net/forum/showthread.php?threadid=243) to find an answer.


reversing the binary code of .exe and .dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > reversing the binary code of .exe and .dll
PDA

View Full Version : reversing the binary code of .exe and .dll

Alawi
12-17-2001, 02:44 AM
I want to reverse the binary code of a small package contains an
.exe file and some .dll files (I think it is orginally written in Delphi or VB)? is that possible and what tools may I used to do that?

Can I directly reverse this binary code into Java source code directly???

Thanx in advance for your help:confused:
DakienDX
12-17-2001, 11:46 AM
Hello Alawi !

You need a disassembler to reverse code. Popular ones are IDA and W32Dasm. But for Delphi and VB there are some other ones. One called DeDe can be used for Delphi applications. It works more as a decompiler than a disassembler. I can't tell you the name of a VB decompiler since I've never seen one, but I know there are available some of them.

Why do you want to get Java source code? You can normally only reverse to ASM or to the language the program was originally written in. I don't think there is a tool available doing this. Of course, it's not impossible, but noone needs such a thing.
Alawi
12-18-2001, 02:05 AM
Actually I am writing a program in Java and I need to write a compnent that communicate to some devices and I found that there is a program that communicate to those devices but it do more things, So what I want to do is to reverse this code to Java, modify and use just the part that I am intersting in.
He I think I found that this program developed using VC++? So what the the tool that I can use?
mike
12-21-2001, 12:46 PM
Sounds like you're trying to use stuff that's platform-specific. For that you need to use native calls (and makes me wonder why you are using java)
Alawi
12-21-2001, 01:35 PM
No becuase I will my component will connects to a remote machine with a standatd protocol


Wild idea: BOCHS
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Wild idea: BOCHS
PDA

View Full Version : Wild idea: BOCHS

SiNTAX
12-17-2001, 05:04 AM
Just thinking.. anyone ever investigate BOCHS as a cracking tool?! ie. full machine emulation, so you have total control over your target.. and with some coding you could add checkpointing/state logging to it.
Ofcourse it lacks windows internals know-how, so one would have to add that to the code in order to keep your trace target confined to your current windows task (otherwise you would trace task switches et all)

Anyway I don't know if it would even run a protected game, haven't tried that yet...
Czerno
12-17-2001, 12:36 PM
Not confident the quality ( accurateness) of emulation woud be
good enough ! Don't forget many programming tricks relye on
half documented "lore" ...
Plus , think of the speed ! Imagine emulating the
single-stepping of your target ? A 8088 would easily
outperform that ! And this is assuming that the emulator
correctly emulates the IA32 debugging facilities ( or has
equivalent or superior capabilities built-in )

Just a first thought reaction of course , I never ran Bochs - would
love to learn I was wrong :)

--
Cz.
SiNTAX
12-18-2001, 02:58 AM
Sure.. your thoughts are valid ones, but don't forget that BOCHS runs Win95/NT so it already emulates quite a substantial bit of ia32.
Performance is ofcourse of a concern, but it's not all that bad.. in the newly release 1.3 version there is a disk image of linux included, and it actually boots at a pretty decent speed.. I was surprised.
Anyway it would probably be too much work to get it into a decent shape to even compare it with SICE.


Dead Tracing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Dead Tracing
PDA

View Full Version : Dead Tracing

Bardiche
12-17-2001, 06:11 AM
Hello all. I have an idea for a new Windows project, one that I expect has been attempted before, although I could find no trace of it on the net. Ideally, this is what I would like to do:

I want to be able to record a program's path of execution, storing register values and memory read/writes. The prog would record only changed values to conserve space. Ideally, this might be facilitated through a callback function on each trace command. This recording would then be superimposed upon a dead listing for viewing and analysis later (or maybe into an IDA plug-in).
The "debugger" part of the program would not need any user-interface at all. A command line parameter could be used to designate the conditions for the initial breakpoint. You would then process exclusions (e.g. ignore calls to kernal, etc) and a conditional endpoint (or max bytes recorded) through a callback function (or maybe a script file).

I am not nearly as knowledgable at low-level opsys concepts as I would like to be, but I am studying pretty hard at it. I was hoping that any of you might be able to point me to some good references of study regarding low-level debugging, or maybe point out any problems that you might see with my idea. Maybe there is a much easier way to do this?
I think that I could have wriiten this without too much trouble using the Win32 Debug API, but alas, my first target is a 16-bit Windows program. Apparently, these 16-bit apps own the Win16Mutex, so the Debug API will not let you suspend their execution. I guess that leaves me with the debug interrupts.

Thanks for your time,

Bardiche
DakienDX
12-17-2001, 11:54 AM
Hello Bardiche !

I don't know your coding skills, but you've choosen a very hard kind of program you would like to create. Can you tell us why you want to create such an application, because it would be easier to give you some hints after that. (i.e. unpacker, cheater, bug finder, patcher, ...) The only thing I can point you to at the moment is ICEDump. It comes with full source code and a build-in tracer which does not need user interaction.
Bardiche
12-17-2001, 06:28 PM
Thanks for the reply DakienDX.

My target is a Win16 app, as I mentioned. My aim is to create a utility that would enable additional processing of the Win16 app's data files. The data is encrypted, but I have already obtained the decryption algo via winice. The problem lies in the complexity of the data's encoding. (The encoding has proven to be a far better detourent than the crypto!) You see, the data consists of many different object structures, packed using different algos for each different object type. As if this were not complex enough, when creating such a data file, a very specific sequence must be followed to write the objects, and again the sequence depends on the object (or set of objects) being written. Note: The encoding was not implemented as a protection scheme, but as the programer's idea of the best way to handle the data.

Of course it would be possible to obtain all of the info I need to master this decoding using winice and a good dead listing, but it seems like a horrable use of my time. I figured that writting the Trace app would take quite a bit of time also, but at least I would learn some nice things along the way!

Thanks for your recommendation of IceDump. I hadn't looked at that prog in a long time, and it turns out that it has a command "TRACE" that does just about exactly what I wish to do, except that it does not work on 16-bit code. Reading the doc on it, they give some hints as to what may need to be done to allow it to work with 16-bit code ("i.e. no V86 mode support, mainly due to some lazyness in emulating 16 bit instructions"). Looking at the Trace source, I also noticed that it uses the SUSPEND functions, which also only work with 32-bit code, so that would also need to be handled.

IceDump may still be my best bet though, but I will certainly need to do some more research on V86 mode, emulating 16-bit instructions, and suspending 16-bit threads. I thought that I was a pretty decent searcher, but I am still having some trouble finding good references to writing trace code for Win16.

Thanks for your help,

Bardiche
Aimless
12-19-2001, 01:28 AM
Do not, at *ANY* point in time, underestimate the amount of code lines that you can get with this program. It will be TOO MUCH for you to handle.

Want a taste of things to come? Without loading softice and all??

Do this:

1. Download ollydbg
2. Run a trace with record (with <TRACE OVER SYSTEM DLLS> option ON!)
3. Run your app
4. See the lines of trace.
5. More than 40,000+ in a single APP!!

You want to analyze that??

But yes, your motives for these are noble indeed. Just remember, it is definitely possible, but of no practical use UNLESS you wait for the new version of OLLYDBG which will actually COMPARE traces !!

And NO, this post was *NOT* an ad for Ollydbg :)

...Have Phun
Bardiche
12-20-2001, 08:44 AM
Hey Aimless, thanks for the info. You raise a very valid point in the potential for huge amounts of output data. I have considered this, and it is that very reason why I think that a callback function is needed in the trace. You could use it to execute algorithms for excluding data that is already known.
The code that you would put in your callback function could be complex indeed. Algorithms like those used in some processors to pre-process code would be very helpful, allowing you to recognize and record only the data needed to manipulate future code. A simple example might be a loop that XORs every element in an array. Only the orginal array need be known, not all of the data created by the loop procedure. Writing code to do these things would end up being extremely complex, I'm sure, but it *would* be an interesting excercize. :)
But as you've said, even taking steps to return the minimum amount of data could still leave you with a huge dump. I have taken my targ's IDA listing and converted it into an Access database. It has turned out to be very helpful in analyzing portions of code, using SQL and custom VBA algos. (Not that it doesn't have it's drawbacks...ever try to do an update query in Access on a table with 600,000+ records?) I think that a TRACE dump would work very well with this data.
I had already taken a cursory look at ollydbg, well, long enough to see that it does not work with my targ's 16-bit code. Pity though, because it does look like an interesting program.

Bardiche


KMD in asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > KMD in asm
PDA

View Full Version : KMD in asm

^DAEMON^
12-17-2001, 10:07 AM
Hi,

hmm iam searching for documentations about kernel mode driver in asm (tasm sources would be best)....

^DAEMON^
DakienDX
12-17-2001, 11:59 AM
Hello ^DAEMON^ !

What type of Kernel Mode Drivers do you think of?

VxD on Win9X ?
SYS on Win9X ?
SYS on WinNT ?
WDM on Win9X and WinNT ?

VxDs are the best in MASM, WDM in VC++, SYS mainly in C++, perhaps other too.
But you know, nothing is impossible. :)
Gadix
12-17-2001, 06:24 PM
Hello Daemon

KMD docs-sources:

http://www.cmkrnl.com/faq.html
http:/yoda.cjb.net

One suggestion: if KMD is for your protector this is not a good idea: KMD only runs in administrator mode (remeber user-mode)

Gadix
^DAEMON^
12-19-2001, 02:15 AM
hi,

nope the url cmk.... is useless!
i wanna write a sys (NT) driver
yoda sux!

^DAEMON^
^DAEMON^
12-20-2001, 05:42 AM
hmmm kmd (sys) will only run in admin (supervisor) mode....
puhh then i'll need to use r0 exploits...

anyway sad to see that there is no help
(and please don't point me to elicz page, coz the sources are terrible no documentation etc... etc...)

^DAEMON^
DakienDX
12-20-2001, 11:02 AM
Hello ^DAEMON^ !

If you want to search for Ring0-exploits in WinNT: Good luck. You'll really need it. But there is no need for it anyway.

Try to get the WinXP source code. :) Analyse it. Change it. Fix all problems. Recompile it. Give it an other name. Sell it. Get rich.

But don't ask me where and how.
TheFCE2
12-20-2001, 06:06 PM
I'm currently writing a KMD for W2K / XP.

Write me an email or something.
tony b.
12-20-2001, 08:15 PM
Yoda has a sample:
h**p://y0da.teamunknown.com/snippets/TracerKMD.zip

regards,

tony

ps. whoops, i see you said "yoda sux"... hmm.. personally, i just use the NT DDK, which has masm in it (but i find C much easier and quicker).
^DAEMON^
12-21-2001, 02:00 AM
puhhh i need tasm sources or documentations about it!
DakienDX
12-21-2001, 10:58 AM
Hello ^DAEMON^ !

I'm sure you would get more help by the people here if you would be more conductive. I hope you understand what I mean. If you would discuss your 'powerful' protector in public, it wouldn't be a protector any more, but the topic would be more interesting to many people.
If you want to really keep it secret, why are you posting here?
If you just come here and say "I need this and that,... quick,... hurry,... this one sucks,... that one sucks,... oh no,... you are so stupid" then why do you think anybody is willing to help you?
^DAEMON^
12-23-2001, 05:03 AM
sorry i know, but isn't it the fact that there aren't any good docs out there ? i found all the links the people posted here... and they didn't really help me... so iam sorry! masm is really cruel in my opinion (i can't handle it :)) and did u ever saw a source by elicz ?? maybe this is only true for me, but i can't read em... (only portions) so please don't be angry with me! discussing my protector in public, hmmm iam currently busy with a new homepage - where iam going to discuss about protecting better... maybe u'll visit it... available in about one or two weeks! h**p://cdaemon.piranho.de (or .com .org)
thx ^DAEMON^ :D
TheFCE2
12-26-2001, 03:12 AM
For my KMD I started out looking at C sources and documentation about kernel drivers in general. I then just converted stuff to Asm. Took me quite a while to get started though.
daze666
12-31-2001, 12:41 AM
Hi Daemon,
I'm also looking for KMD ASM sources, could only find the one by Elicz. Found a nice site by some german guy with some good links though: http://www.wischrop-net.de. Not ASM, but this site got me started anyway (I mailed the guy and asked for his C source code, I'm reversing his KMD now, together with the C source and the ElicZ ASM source, I hope to be able to reconstruct it in ASM).
Daze


IDAW and Amante's plugins (Q was asked on REMB forum too )
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDAW and Amante's plugins (Q was asked on REMB forum too )
PDA

View Full Version : IDAW and Amante's plugins (Q was asked on REMB forum too )

Czerno
12-17-2001, 01:20 PM
Hi , Gang !
I asked this one on the other reversing forum ( REMB ) where it
has evoked no echo . Sorry about the 2ble post if you've seen
the other one already ...

Here's the problem : Using IDAW - the free 4.1 version - I
wanted to try Amante's extensions ( plugins ) , yet could not
have IDA eat those plugins - it complains about every non-comment line .

Hence asking : are these plugins any compatible with the free
IDA ? Or is it me so dude ;) Not that I really crave for the plugins,
IDA is useful per se , but hey ! if it works , it should work for me
too shouldn't it ?

--
Cz.
Aimless
12-19-2001, 01:16 AM
I guess they did not tell you.

The plugins will work with ONLY the graphical version of IDA.

Try the IDAG instead of the "older" 4.04 shock carded version...

And it works perfectly!!

Sorry, guess plugins are NOT supported on IDAW.EXE

...Have Phun
Czerno
12-19-2001, 10:09 AM
> guess they did not tell you.

They never ever did :)

>Try the IDAG instead of the "older" 4.04 shock carded version...

Aye but ... there is a free version of that ? I didn't even realize
they had a graphical IDA at all ( I had long been used to an old
IDA for DOS , very effective yet )

> Sorry, guess plugins are NOT supported on IDAW.EXE

Seems it does look for the pluggins and read'm too , only
doesn't understand this one from Amante4 :(

> ...Have Phun

Thanks , Aimless ! Anyway I do not really like automated tools ,
I decrypted binary code ( BIOS ) for years using no more , and often less than , Debug.exe or equivalent DRDOS's SID ...

But to be sure , it would be HARD to do that sort of exploring
applied to the Wind*ws guts :)

Merry X-mas or whatever you will !

--
Cz.
Nodens
12-19-2001, 02:52 PM
maybe you can try Mammon's idc script they will do the same things as Amante's plugin but in a less user friendly manner ;)
Anticode
12-26-2001, 03:39 AM
maybe Amante cares to release the sourcecode for the plugins? :D
Nodens
12-29-2001, 06:29 PM
would be great if amente do so :)
Amente didn't release plugin for ver > 4.15 :'(


remove debug printing of kernel32
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > remove debug printing of kernel32
PDA

View Full Version : remove debug printing of kernel32

Solomon
12-18-2001, 01:25 AM
Here is the SoftICE history. I just want to disable the debug output of kernel32. How? I tried DbgView from sysinternals, it can't capture this string. Which prog prints this string?

kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
NTICE: Load32 START=77CA0000 SIZE=80000 KPEB=FF844020 MOD=clbcatq
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
NTICE: Load32 START=78000000 SIZE=46000 KPEB=FF844020 MOD=MSVCRT
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
kernel32!xxxandledExceptionFilter
Solomon
12-18-2001, 02:28 AM
shit! This string is from NTICE.SYS! I removed it.
Lord_Soth
12-18-2001, 07:16 PM
hmm, why would you wanna remove it ?

why does it bother you, and dont you
think there's a reason it's there ?

LS
Solomon
12-20-2001, 06:49 AM
because it is printed too frequently and it coz the history buffer full. I just want to save softice history and analyze it later. Increasing the buffer size is a alternative.
DakienDX
12-20-2001, 11:15 AM
Hello Solomon !

You can simply patch your KERNEL32.DLL. You need to locate OutputDebugString and replace the first three bytes with a C2h, 04h, 00h ("Ret 4") because it has no defined return value.

Of course you need to do this in DOS mode, since KERNEL32.DLL is opened under Windows all the time. If you're on Win9X you can also use the WININIT.INI for this job.
Solomon
12-20-2001, 08:14 PM
DakienDX,

thx for your reply. OutputDebugString is a ring 3 API, NTICE.SYS does not use this to print this string. I have changed "kernel32!UnhandledExceptionFilter" to a empty string, but it still prints out many empty lines("\n\r" only).


Loading Data in memory,
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Loading Data in memory,
PDA

View Full Version : Loading Data in memory,

SpeKKeL
12-18-2001, 03:42 AM
How to load a certain amount of data in memory ??

Is it possible to load some data on a certain place in memory and how to do this ??(add section ??)

when a unpacked target checks ( or calls back to) it's main code
and there isn't any this leads to crashing or disabling etc..
Instead of nopping and jumping the dumped target, i thought that
this could be an easier way ???

Spekkel:rolleyes:
Kayaker
12-18-2001, 07:11 PM
Hi Spekkel,

I would think you should be able to do a few things. Say there's a jump to a high memory address which is no longer valid in your unpacked file. If you know the code is important to run you can always redirect the jump or call into an empty writeable area of memory and emulate the code by writing in the opcodes that describes the code. If you need (and know) any variables you can enter those in an empty memory address as well if the originals are "missing". Basically an inline patch in your dumped target.

The simplest case is inserting a CC return where you know the code isn't really important to run, this is just a little more elegant than nopping. If it's just a particular needed variable to be retrieved that was placed in a memory address by now nonexistant unpacking code, then you should be able to supply that as well if you know it (or can create it through code).

Where you find the empty space is up to you. If you need more bytes than that provided at the end of a writable section you can always add your own section and the memory is entirely yours to play with. Often you can gain a few extra empty bytes at the end of the .text or .data section by increasing the Virtual size to be equal to the Raw size in the PE header. Depending on how you dumped it it may already be like this, which is why I prefer raw dumping over a PE optimized dump.

Hope this helps,
Kayaker
Lord_Soth
12-18-2001, 07:46 PM
There should be plenty of room at the
end of most or at least SOME of the
sections. After all, it aligns on boundaries,
big boundaries :-)

And if you must add a section, then
you should be prepared to do the necessary
patching to make the code work from
there...

LS
SpeKKeL
12-19-2001, 03:14 AM
Thanks,

Ok, about inline patching > there are to much jumps/calls to the
high area where the original code is to make an inline patch(there are not only little checks but big routines)

So i want to copy memory loc xxxxxxx till xxxxxxxxx paste it in my
dumped exe and it must be loaded at the original location........

Spekkel
CoDe_InSiDe
12-19-2001, 03:47 AM
Hi SpeKKeL,

Then just make a new Section ;)

Raw Address somewhere at the end of the File (Copy the Memory Code there) and the Raw Size of it (Just count it or something ;) it doesn't have to be exactly the size of the Code, can also be more but not less :D ).
Virtual Address, the original address of the Code :)
Virtual Size, same as Raw Size but "round" it ;) (You know like 00001000 / 00003000 etc...)
Make Characteristics 400000E0 (Should be enough ;) )
Oh and the name of the Section, well you decide ...

Ok, this is just a quick description i hope it's enough hehe :)
If you don't know how to add a new Section then use a Tool, or better yet get some Tutorial and do it Manually ;)

Cya...

CoDe_InSiDe
Bengaly
12-19-2001, 04:45 AM
CoDe hehe...
haven't ya left yet ? :)
/me is counting the days ;p :p ;)
hm...hm..h.m....cya later :)
Kayaker
12-19-2001, 11:18 PM
Originally posted by SpeKKeL
Thanks,

Ok, about inline patching > there are to much jumps/calls to the
high area where the original code is to make an inline patch(there are not only little checks but big routines)

So i want to copy memory loc xxxxxxx till xxxxxxxxx paste it in my
dumped exe and it must be loaded at the original location........

Spekkel

Hi

The problem is that you just can't dump the opcodes you see while tracing in high memory packed code anywhere in a file. The addresses have to match and all variables have to be accessible. Rewriting the code is still your best bet. You should trace the routine you think needs replacing very carefully and determine what it's doing and how best to emulate that. It may only be passing a variable you can supply yourself in another way. If it's decrypting some code perhaps then you may need to rip out a keygen style replacement for it.

You could try creating your own section which has an RVA identical to the packed code and replace dumped bytes. Try a Softice backtrace on the section of code you're exploring, keeping it as small as possible, and check it out with SHOW. Then you can trace through and find each call, and if the opcodes haven't been changed since the backtrace recorded the instruction (i.e. code hasn't been overwritten) then sequentially do a raw dump of as many lines as you can that you know will follow the proper code flow. These you can paste into a chunk of code you can try inserting at your newly created high memory address. Your problems will be to supply the variables and to have legal access to whatever area of memory was used originally on your particular system at that particular time.

Not really an easy task for a large section of code. I'd be very interested to see if this would work though because Spekkel, you've given me an intriguing idea. The tool I've been writing, and now with Clandestiny's help is really beginning to grow, is made to work interactively with doing Softice backtraces. You can disassemble any backtrace you've done into a listview for examination or saving. Presently you can only look at it in Softice, and you can only do /screendumps of the backtrace history. The SI backtrace buffer records the exact sequence of commands executed as addresses, these addresses are disassembled with the target file loaded, into the list view. You can break into the address space of the program and set up new backtraces on program runtime code or break at program entry.

Now at some point in the code during the disassembly routine, I have access to the exact sequence of opcodes that were executed between the users backtrace start and ending points. We should be able to save these as they are going through into a binary file which could be pasted as hex code. With a little more coding of the Listview it might be possible to allow the user to pick and choose the opcodes from sections of the backtrace, sort of like a codebank.

I don't know how useful this feature might be, or even if the results would work, even if you wrote every byte manually. But you've given me this idea and I can't shake it, heh ;) If anyone can sucessfully recreate a reasonably large section of packing code that is needed by a dumped program, by following the sequence of commands recorded by the Softice backtrace, and have it execute in the proper address space by creating their own section, then I solemly pledge to try to create an easy way to assemble those instructions into a file which can be pasted into a section.

This would be a good project actually, I'd like to see a tut on it ;) We both are trying to make this a good reversers tool, so if there's something useful that could be implemented into it we'd like to try to provide it. Anybody see any flaws in the logic? The question is, could you successfully emulate a section of high memory packed code? Interesting.

Regards,
Kayaker


Altering protection flags on pages with SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Altering protection flags on pages with SI
PDA

View Full Version : Altering protection flags on pages with SI

SiNTAX
12-19-2001, 03:28 AM
Is there a simple way to alter a page's protection bits with soft-ice?!
DakienDX
12-19-2001, 11:22 AM
Hello SiNTAX !

SoftICE does not allow to do this. But you can use ICEDump with it's option /PAGEFLAG to do the job.


RNG and relative primes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > RNG and relative primes
PDA

View Full Version : RNG and relative primes

goatass
12-19-2001, 09:02 AM
How do I check if a number I generated is relatively prime to another number? I'm using the mircle library for the big number functions.

Thanks,

goatass
Kythen
12-19-2001, 12:00 PM
You check to see if Greatest Common Divisor (GCD) for the two numbers is 1.

ie. z = GCD(x,y)
if z equals 1 then you have relatively prime numbers

In MIRACL this would be:

egcd(x, y, z);
if(z == 1)
{
// the numbers are relatively prime
}
goatass
12-19-2001, 04:37 PM
Kythen my friend how are you?

Here is what I got for code:

sz1=mirvar(1);

decr(p,1,p);

do {
bigrand(p,k);
egcd(k,p,y2);
} while ( (compare(y2,sz1))!=0 );

incr(p,1,p);

The problem I have with this is that I get a small number from the RNG that when I do these ElGamal calulations:

// x3=M-x2
subtract(m2,x2,x3);
divide(x3,p2,x2);

on it I get a negative number and this screws up the rest of the claculations.

goatass
Kythen
12-19-2001, 07:13 PM
Doing quite well here, just finishing up the barrage of exams/projects/papers/God-only-knows-what-else that comes with semester's end.

And from what I can see, your problem has a very simple solution...

do
{
do
{
bigrand(p,k);
}while(k < SOME_LIMIT);
egcd(k,p,y2);
} while ( (compare(y2,sz1))!=0 );

Just keep repeating the bigrand call until you get a number that's both big enough and is relatively prime to p.

You may want to check some of your other calculations though, as the size of the random number k should not matter unless it's something like 1.
Sab`
12-19-2001, 09:17 PM
Heya Goatass (: , Kythen where you been hiding? (:
goatass
12-19-2001, 10:52 PM
Kythen, I think I might have some other issues with my calculations I'll check it out again.

Good luck on all your exams and stuff, I'm so glad I'm done with school eventhough social life blows now it still feels good not to have exams and papers.

Sab my friend how are you, long time no talk, how you been? how's life been treaing you?

I love this board it brings together all these great friends :)

talk to you later

goatass
goatass
12-24-2001, 08:42 AM
Hey ArthaXerXes, I'm haven't looked too deeply into how thier PRNG works but from the docs I can tell you that it uses the IRAND function which like you said gets a psuedo random long number and uses it as the seed to the main PRNG fucntion.
All of the none-cryptographically secure RNG routines in the miracl library use the IRAND function so they are not very strong but they do say so in the docs. The strong_rng function suppose to be the cryptographically secure PRNG function. I haven't looked at all how it works so I can't give you any details on it.

goatass


im afraid
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > im afraid
PDA

View Full Version : im afraid

ON'error
12-19-2001, 09:06 AM
hi,
i dont know whether a cracker codex exists or not,
but i just want to ask you if you would crack a program
which is programmed by a cracker. beacause i've found a very
nicy game on the net and if i live in the states i would buy
it immediately but im on the other side of the ocean.
oh i want to add that the programmer has left a warning similar
to "if you crack my software ill kill you!". So what?
riPPadoGG
12-19-2001, 09:14 AM
Remember...,
You are on the other side of the ocean..
Rip it into pieces...

This programmer ought to have some respect left ;)

from the other side of the globe
riPPadoGG
stealthFIGHTER
12-19-2001, 04:50 PM
Hi ON'error,

heh, give us the url of the app an we'll kill it :D....ble....
(I'm on the other side of the ocean too)

sF
ON'error
12-20-2001, 03:58 AM
thhp://pages.prodigy.net/thekemmlers/ppxdemo.zip

im a newb so i cant crack such a prog, but if you want to give me a x-mas present....

please send me your work

ps: id like to no how do uve uploaded ur avatar?
DakienDX
12-20-2001, 11:09 AM
Hello ON'error !

You can upload your own avatar if you've more than 30 posts. It needs to be a GIF file smaller than 50x50 pixel.
Originally posted by ON'error
please send me your work
Well, what do the FAQ say about that kind of requests? Be ashamed!
Hoof Arted
12-20-2001, 12:12 PM
Damn, I see another thumping comming. Oh well, at least this time it is not me.

In the words of Woodmann, "Peace"
ON'error
12-20-2001, 01:02 PM
:rolleyes:
@DakienDX
sry, ur right!
dont send me the cracked version. this is a legal message board and i dont want to do illegal thing while usin this board.


[Cracking Securom....]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > [Cracking Securom....]
PDA

View Full Version : [Cracking Securom....]

XICO2KX
12-19-2001, 08:39 PM
Hi guys! :)
I'm new here...
A guy from the " Cracking France Forum" told me about this forum!
Anyway, I would like to ask your help! =}

This is my problem...
I have a game protected by "Securom *new*" - the protection was detected using "ClonyXL" and I manually checked the existence of the "sintf16.dll", "sintf32.dll" and "sintfnt.dll" files on my C:\WINDOWS\SYSTEM\ directory...

I can run the game with no problems using "Daemon Tools 2.88" (with the bin+cue file) or the "Generic SecuROM crack v6.0" (with the burned CD) or by using "Insektors 1.1"...
But I need to be able do modify the game's main executable to "crack it"(*) and I can only do that by unpacking/unwrapping it first! - I've been collecting some info about this and I already have some basic knowledge about the Securom working scheme!

(*) - Let's just say I need to run the game without the CD, only for "convenience reasons"! ;)

I'm still just a "newbie" in this cracking stuff, although I can already "remove" some simple CD checks!
But these "commercial protections" are way too beyond my actual cracking skills... :rolleyes:
So I'm asking for your help!

I found a tutorial on how to *manually* unpack it at http://www.woodmann.net/IDArchive/ID-RIP/database/tornado/notes092000/p09_4.html ... But that's a bit too much for me... (like I said before, I started only some time ago!) :rolleyes:
And I was trying to find something that could do that hard/boring unpacking/unwraping part for me.. :p

I already know about "UnSecurom 1.0", but that doesn't work, because it's only compatible with the first version of "Securom"... :(

And then I found "ProcDump32 1.6.2" which comes included with a plug-in called "Securom Brahma client unwrapper v1.01", and it claims to be able to dump/unpack "Securom > r2" protected executables (although it's rather old - from March 1999)...

But I follow all the instructions in the readme.txt file and I still can't do it!
I start "ProcDump32", load the "Brahma Server", load the game, load the "securom unwrapper plug-in" (loader.exe), select the protected executable, click OK on the alert box, and then it appears a message "Process 0xFFF????? will be dumped." (of course there are other stuff instead of the question marks!) on the "Bhrama server" window, but then nothing appens! :(
The only button avaliable is still "Abort"...
And if I try the "Unpack" command I get an error message like "This process can't be dumped !!" ...
Or if I try the "Dump" (Full/Parcial) feature, I get "Process is not 32 bit or can't be loaded or is already finished !" ...
Did anyone of you guys already used this tool before?

And that's it...
So, do you guys know how I can pull this off?
How can I unwrap/unpack the executable file?
Is there any other tool that can help me?
Or ProcDump32 works fine but I'm doing something wrong?
Do you know where can I find more info on doing this "easily"?

I hope someone experienced on cracking the Securom protection can give me a hand with this... :D

P.S.: And sorry for any kind of mistakes on my message... It's because english is not my natural language... =P
JMI
12-19-2001, 09:06 PM
XICO2KX:

I'm not a gamer myself, so I haven't looked at this system other than to follow threads here on the subject. Just wanted to direct your attention to a thread on the "General" forum at the bottom of the main page where several members recently discussed this protection scheme. Maybe you will find some useful information there and welcome aboard. Probably someone else who has some direct information about securom will also be of more direct help.

And some would argue that english is not a "natural" language. Too many ways to spell the same sounds. At least we have some of the worst spelling combinations in the whole world, IMHO, and your post was fine.

Regards.
Aimless
12-20-2001, 03:09 AM
Are you talking DIABLO-2 ??

...If so then the solution is already on hand.

...Have Phun
acab
12-20-2001, 08:23 AM
If you want to crack the game yourself, there's a R!sc tutorial around.
If you can't find it / don't properly understand it, drop a line to the forum.
If you just need the game cracked, you're in the wrong place: search the net and you'll find what you need.
aCaB
XICO2KX
01-03-2002, 11:29 AM
No, I just wanted to be able to crack it for myself... :rolleyes:

And I'm not trying to crack "Diablo 2"!
But what do you mean by "the solution is already on hand"?
Is there a new tutorial about Securom-cracking for Diablo2 that could help me out a bit?

Anyway, I'm actually trying to crack a rare h-game called "Viper M1"!
I couldn't find any "No-CD crack" for it, so I decided to crack it for myself!
But I'm having a lot of fun learning all these Securom cracking stuff! ;)

And I already know about R!SC's tutorial!
It's on the page I mentioned on my first message - it has 4 tutorials there related to Securom!
I've already read it and it helped me understand more about how to crack the protection, but I think it would be easier to rebuild the IT using ReVirgin instead of coding asm to do that...

But I've been reading a few "manual unpacking" tutorials (about procdump32 and revirgin) these last few days and things are starting to make sense to me! :D
I think I'll be able to make some progress if I dump the file with Procdump or IceDump and then rebuild the import table with ReVirgin! :D

I'm currently trying to learn how to work with OllyDbg instead of SoftIce...
I didn't knew it before reading some of your posts on this forum, but I already tried it and I think it's a great tool! ;)
I'll just have to learn how to use all the commands properly now...
But I still don't know how to dump the memory using only OllyDbg (I can't use IceDump with it no more!)... :(

But when I have some more free time I'll resume trying to crack the game again...
And I'll let you know when I run into any more problems!
Which is meant to happen for sure! :p

Anyway, thanks for the help guys!
See ya soon! :)

P.S.: By the way...
What does "IMHO" mean anyway? :confused:
JMI
01-03-2002, 11:55 AM
XICO2KX:

IMHO is one of the group of abbreviations used in "computer skeak". This one is short for In My Humble Opinion. Others you will see here include AFAIK which is short for As Far As I Know, and the rather rude RTFM which means Read The Fu*king Manual.

Happy New Year and keep Reading.
goatass
01-03-2002, 12:53 PM
JMI just to add to your first post talking about the english language and spelling. What's the deal with silent letter??
If they are silent why have them?

Stupid language :)

just wanted to add my own uselss two cents.

goatass
JMI
01-03-2002, 01:30 PM
Goatass:

The use of "*" in place of other letters is usually an indication that the writer does not feel the need or, perhaps feels that it is not appropriate to use common expletives in general conversation. The letters are not "silent," there is just no need to use them because everyone recognizes the word with the missing letters. I have no problem with the words or those who chose to use them, but I grew up at a time when it was not considered polite to use them in general public conversation.

But I assume your comments were intended as ironic and humorous and I only responded more formally for the benefit of those who might not truely understand this "native" tongue. I happen to believe that general civility towards one another is a preferred way to express thought, even if we think that the person to whom we are responding has demonstrated a general lack of good sense or laziness. With this attitude, one can give most questions at least a civil response, even if we add a bit of humor or tease, or prod to "do the right thing" along with it. Certainly one is less likely to be persuasive with a rude remark than a considered reply, and such replies are ofter just a stroking of the writers own ego.

But enough of manners 101. Time to get back to work.
Kilby
01-04-2002, 05:11 AM
HI,

Having spent tke last few weeks working on securom, the way that the IAT is resolved is different from the likes of asprotect and early versions of Copylok.

All API calls pass through the same routine, and the return address of the API call is used to give the reall call address.

There is no redirected table to resolve.

The only real option for securom, is to find and resolve all the calls yourself.

This is not hard, the calls can even be be found from a dump using hexworkshop, from there you can produce your own table of addresses to resolve.

This method works with everything released up to Dec 2001, though I havn't worked on the newest version that turned up in mid December.

However watch for certain addresses causing the securom routine to crash, and have a look to see why.

Regards,

Kilby...
XICO2KX
01-04-2002, 06:28 AM
Yeah!
You're absolutely right! :p

As a mather a fact, after I posted my message I started thinking about what I wrote and I figure that that couldn't be right...
There is no IAT table to reconstruct (no need for ReVirgin!) because all calls are made to the same... call... as you correctly said!
I think I was too sleepy when I wrote my message... :p
And I got a bit lazy to write another one correcting what I wrote... :rolleyes:

By the way, Kilby...
Didn't you write a Copylok tutorial (featuring ReVirgin) for Tsehp's page?
I think I remember reading something with your name on it! :)

Anyway, yesterday I've been investigating a little bit more OllyDbg and I reached the conclusion that I can't go nowhere with it... :(
It doesn't even reach the "JMP EAX" command and it keeps stopping at commands like "HLT", "CALL -1" or "IDIV 00000000" (division by zero)...
Possibly some weird anti-debugging tricks (that I didn't have time to investigate properly)...
It's a pity that this great debugger still isn't able to bypass this anti-debugging tricks... :(
Or maybe I still don't know how to work with/configure it the right way!
And I can't find any way to dump the memory contents with it either... :(
I guess I'll have to go back to good old SoftIce (and IceDump)! :D
And I still have a lot to learn! :)

I've reinstaled Windows a couple of weeks ago and I still haven't installed SoftIce yet, and I got to study for some exams at school next week, so I won't install it yet because I don't want to waste to much time with this right now...
But I'll start working on it again when I have some more free time!
And I'll let you know when I have some more problems then...

And thanks for the help again guys!
IMHO, you're the best there are! :D
Kilby
01-04-2002, 12:50 PM
Hi,

Yeah I did a copylok and also a Bi-Tarts tute.

One of the nice things about saferom in a way is that it's predictable.

You know where certain bits of code will be, and it's great to play with.

However this also brings a disadvantage to the generic dumpers in that even a very small change in the code wqill render the dumpers useless.

As far as I can tell the recent code chain securom (October / November) time where nessicary because Creative DVD drives wouldn't work with the protection checks.

Personally I cannot see any (real) difference in the actual protection routines, but all the dumpers stopped working anyway.

My own dumper is now at the 90% stage and uses a slightly different approach so minor securom code changes should be tolerated :)

It will not go on public release.

Keep on working at Securom it's nice to work with.

If you however want to start breaking some new ground, in regard to tutorials have a look at laserlok, it's not too hard and theres no essays on it either :)

Kilby...

Soon to be insearch of a new target (he hopes).
XICO2KX
01-05-2002, 06:29 AM
Humm... :rolleyes:
I don't want to spoil all your fun breaking on new ground and figuring out out to crack the LaserLok protection ( www.laserlock.com ) all by yourself, but...
As a mather a fact, I already found a tutorial about how to crack Laserlok a couple of days ago! :D
It's in spanish though... :(

You can check it out here:
* http://espejo.hypermart.net/tutes/mesiash.htm [ http://gamescrk.cjb.net/ ]

It teaches how to remove this protection from the game Messiah using two different approaches!

I couldn't find any english tutorial, though... :(
So, have fun cracking it! :D
And I hope I've helped you a bit! ;)
Kilby
01-07-2002, 12:36 PM
Hehe,

I was suggesting that you may find it interesting to play with laserlock, as it hasn't been done to death in the tute scene.

I have found that the best method of learning how a protection works is to write a tut about it.

I still have a while till I can move on to a new target, as I have a bit of work to do on my first bit of 80x86 asm coding since 95.

Kilby...
froghunter
01-07-2002, 01:29 PM
heya

>I don't want to spoil all your fun breaking on new ground and >figuring out out to crack the LaserLok protection ( >www.laserlock.com ) all by yourself, but...
>As a mather a fact, I already found a tutorial about how to crack >Laserlok a couple of days ago! :D
>It's in spanish though... :(

>You can check it out here:
>http://espejo.hypermart.net/tutes/mesiash.htm

well, you can use some translator such as :

http://www.freetranslation.com/

this bastard pisses you off if you enter an url ending with htm
and not html..
so save the page source on your hard disk and edit it with notepad ;)
Patch the function isValidURL like this:

function isValidURL(str,blnRequired){

return true;
}

pretty much like cracking eh ? ;-)

now you can translate that tutorial :)

enjoy!

Frog Hunter.
XICO2KX
01-07-2002, 08:02 PM
Thanks froghunter! :D
I didn't knew www.freetranslation.com yet!
I only knew world.altavista.com ...
But I only use it as a last resort because the translation is not perfect and sometime it even translates words that were'nt supposed to be translated! :p
And I can understand spanish rather well, so I don't need a translator...
But I forgot to mention it to Kilby!... :(

And Kirby...
Sorry, I miss understood you! :p
I understood that you were saying that you were going to start cracking Laserlock and not suggesting me to do it!...
I have to start reading the messages with more attention! :rolleyes:
Anyway, I don't think I have any games protected with Laserlock, but if I ever get one, I'll try to crack it for myself to see if I learn a bit more! ;)
Thanks for the tip! :)


Help CommView 3.1 (build 156)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help CommView 3.1 (build 156)
PDA

View Full Version : Help CommView 3.1 (build 156)

Zurito@~
12-20-2001, 09:51 AM
Hi

I´m loking for CommView 3.1 (build 156)

Regards
Zurito@~
Kayaker
12-20-2001, 10:49 AM
Sure, no problem. I can help with that:

http://www.tamos.com/download/main/

Er, that is what you meant, right? I'm sure you didn't mean you were looking for an easy crack or patched app, because you won't get that here.

Kayaker
Zurito@~
12-20-2001, 01:43 PM
Sorry Kayaker

h**p://www.tamos.com/download/main it is the Build 161 :(
I'am looking for Build 156

regards
JMI
12-20-2001, 01:49 PM
And if you had taken the time/effort to look around here (as in using the search button) you would have found that there are extensive materials posted here about CommView 3.1, specifically directed at build 156, 160, and 161. There's even an essay by our resident "coding god," +SplAj addressing this target and an extensive thread about the latest asprotect tricks in build 161.

Generally, to get help here you should show that you have done some work/searching on your own, say how far you've gotten and where you are stuck and you will find people here that have the talent and the knowledge to help. The purpose here is to help you learn to do the work of reversing yourself, not do it for you.

If you already have this material, and the desire for build 156 suggests that you are attempting to follow the +SplAj tut, you should indicate that's what you're doing, so it doesn't just look like a crack request.

CommView3.1, the downloadable version, is crippled, but freeware and those types of programs are often mirrored on sites other than the software company. Do a google search for CommView 3.1 and the chances are that alternative sites will have an older version. I believe I may have build 156 on my HD. If, after searching, you still can't find it, post again and maybe I can help.

Regards.
Zurito@~
12-21-2001, 09:30 AM
Hello
I am reading the tutorial CommView 3.1 Written by +Spl/\j.

Somebody could explain to me better as solving these APIS:

090 001A03B0 005881EC 0000 ?????? ??????
109 001A03FC 0058826C 0000 ?????? ??????
154 001A04B0 005882A0 0000 ?????? ??????
Is there a form but easy to resolve?

... others will be FreeResourceand LockResource.
because he knows it?
These 2 API have a RET004 from the stack, so just selecting a random API will fail you with a RET. Take care. Look at the ALPHABETIC names of the resolved.txt. You get a big clue from this .
For the item 109 this i LockResource <= = as he knows it?
you will see a PUSH blah RET004 code.

Please they can respond in an easy English , sorry my bad English

I am a beginner, I would be appreciated they explained to it in an easy way

Thank you
DakienDX
12-21-2001, 10:41 AM
Hi Zurito@~ !

Perhaps ASProtect isn't the best choice to start with.
Of course, you would like to have the program cracked, but if you're not familiar with unpacking, tutorials may not solve your problem, even if they're written in easy English.

English is the only language here. It's difficult for people whose natural language is English to speak it in an easy way. I might have problems too understanding your Spanish. (If I'd learned it some time ago :) )
JMI
12-21-2001, 11:09 AM
Zurito@~

+SplAj said do the following:

1. "Close all programs"

2. "set bpx GetVersion"

3. "start CV.exe.

4. "F12 back to API cluster"

U 005881EC (your address for 090 001A03B0 005881EC )

5. "see ... link to ... API cluster (in) EAX ... location."

6. "Match ... memory (address in EAX, his = BFF9FA9F) to the API."

7. Try U "memory address from EAX" (his= BFF9FA9F)

8. use API address + name to resolve 090.

090 +"your code address (001A03B0) +"BFF9FA9F 02F5 KERNEL32.dll SizeofResource"

Your "BFF9FA9F" may be different. Use what you find.

next entry

U 0058826C (109 001A03FC 0058826C )

repeat 6, 7, 8.

Next entry

U "next address",

then 6, 7, 8.

Next entry, etc.

Regards.
Zurito@~
12-21-2001, 12:20 PM
There is something that I don't make in a correct way,

that that is do I make bad?

attach files screen from Api cluster

Regards
JMI
12-22-2001, 10:58 PM
Zurito@~

Do you know how to use softice, icedump, softice loader, Revirgin, and LordPE? If not you must learn first.

What I wrote before is for after you have found the OEP, dumped the exe and done E EIP EB FE , used Revirgin to trace the import table and are tracing the "unresolved."

If you can use these tools then, if Softice is running, and icedump loaded, start Softice Loader and load cv.exe. At the dialogue box, press "yes". Softice starts, you are now at "Invalid" ASPR code.
BPX GETVERSION, enter, F5

Softice breaks at "API Cluster", like your screen dump.

Write down the address of the "ret" from bottom of "API Cluster" and screendump, like +SplAj said.

F5 again, then F12 many times until you see "CommView!.text+ (address) in Softice.

S (ADDRESS OF API CLUSTER RETURN, YOURS=017ac7f5) L FFFFFFFF 61,FF,E0

like this S 017ac7f5 L FFFFFFFF 61,FF,E0

Write down the address of POPAD.
+SplAj's = 17C3875,
Mine = 17C387D
use your address.

BC* , control-D, close CommView.

Load cv.exe with Softice Loader again. Breaks at "Invalid"

BPR (YOUR ADDRESS) (YOUR ADDRESS)+ 3 R IF EIP==(YOUR ADDRESS)

Mine was BPR 17c387d 17c387d+3 R IF EIP==17c387d

F5, you should be at
61 POPAD
FFEO JMP EAX

F8 You should be at OEP.

E EIP EB FE , BC* , F5

Now you dump with LordPE or ProcDump.

If you follow so far, now you use Revirgin.

Regards.
Zurito@~
12-23-2001, 08:44 AM
JMI

I know how to use softice, icedump, softice loader, Revirgin, and LordPE.
I have been able to finish with success the tutorial, but the only thing that I don't understand it is like is solved:

090 001A03B0 005881EC 0000 ?????? ??????
109 001A03FC 0058826C 0000 ?????? ??????
154 001A04B0 005882A0 0000 ?????? ??????

JMI Wrote:"If you follow so far, now you use Revirgin." here this my problem
As it is known that:
090==SizeofResource; 109==LockResorce and 154== FreeResource?
Doesn't Revirgin solve them and would I like to know like it becomes manually?
U 5881EC don't work (see my scren in attach)

Regards.
Thank you JMI for your effort in helpme :)

PD: I make a great effort in writing in English, sorry my bad English
+SplAj
12-23-2001, 09:12 AM
Hi Zurito

sorry I could not send you CV.......

Ok you are on the right track and JMI, the gentleman, has prodded you into the right direction. What you now have to understand is the 'Resource' api calls have been emulated by aspr - never called and re-directed like others. This point is actually months old now....... trace the calls manually, if they occur ? Just believe that RET004 has to happen........ so just 'use RV to 'emulate' those calls.

The next builds are MUCH more fun to fix ;)

Spl/\j

JMI, and all merry xmas
JMI
12-23-2001, 01:15 PM
+SplAj :

Merry Xmas back at ya. I noticed some things that were "different", while most were the same, when I found cv3.1.156 for Zurito@~ on a German site so he, and I, could follow along with your essay. My OS is Win 98 SE (hear the sound of crashing..., thinking about going to NT or 2K) so I was using the markers you described for that OS. I'm trying to increase my understanding of what I'm seeing in Softice, especially when it is somewhat different from what is described,and why it worked out that way, or didn't.

The original break occurred at the "Invalid" entries and F5 got to the API Cluster at the same address as the essay. After the screendump you said to press F5 again and "trace back", indicating that one would end up at a himem point "at 16f:017axxxx or whatever." Nothing I tried at first got me back to an address that appeared to be "CommView" that was in the 0174xxxx range, so I assumed I did something stupid, or didn't "trace" the way you did.

When I first reached the API Cluster I didn't notice the identifer "cv" at the bottom, so at first I didn't realize that "cv" was "CommView" because later there really is "CommView" code identified at the bottom of Softice. I first tried F12 to "trace back" and passed the "cv" code and, after several more GetVersion's, I got to some "CommView" code at 02802C88.

Anyway, the reason this would be a problem for dummies like me, was that from this address, S EIP L FFFFFFFF 61,FF,E0 will, of course, never find a POPAD around 017xxxxx. U 17C3875 showed me the code, at a slightly different location, was approximately where it should have been, but I couldn't get there yet.

After several failed attempts at the search function, after tracing back to "CommView" code, I reread your Awave Studio essay and there you took a slightly different search approach, instead of EIP as the starting address, you had used the address of the "ret" at the end of the "API Cluster." I tried that, and gave that formula to Zurito@~, because I hadn't found my own error yet, and that one, S 17AC7FA L FFFFFFFF 61,FF,E0 worked fine, except it gave me a POPAD address of 17C387D , rather than your 17C3875, but after the F8 through the jump, OEP ends up at exactly the same address as in the essay. When I realized that the "cv" was also(?) or aspr "CommView" code I "traced back" to an address in "cv" below 017Axxx, where searching with the EIP should work. Duh!

I still haven't figured out or understood how the API Cluster and OEP are at the same addresses as the essay and the POPAD is this small difference on the same OS and same build of CV. But it is a good lesson that one can't blindly expect to follow a tut, line by line and always see everything exactly the same. Brains, and sometimes (my) lack thereof, still required.

Is it correct, as it appears, that one could do the search for the OEP right after you come out of the first F5 and F12 at the API Cluster, without an additional F5, trace back, using the address of the "ret" (017F:017AC7FA or whatever) from the API Cluster? I haven't had time to try this on other aspr softs, and I understand the changes evaluator, our musician friend (greetings to you as well and thanks for the heads up) has reported on the 160-161 builds of CommView about the re-re-directed API, and more interesting tracing ahead.

If your time permits, I was also wondering what Load32 was putting in memory with the following:

WINICE: Load32 Obj=0001 Add=0187:02801000 Len=00005C00 Mod=COMMVIEW
WINICE: Load32 Obj=0002 Add=0187:0280B000 Len=00002000 Mod=COMMVIEW
WINICE: Load32 Obj=0003 Add=0187:0280D000 Len=00000A00 Mod=COMMVIEW
WINICE: Load32 Obj=0004 Add=0187:02812000 Len=00000200 Mod=COMMVIEW
WINICE: Load32 Obj=0005 Add=0187:02813000 Len=00000A00 Mod=COMMVIEW
WINICE: Load32 Obj=0006 Add=0187:02815000 Len=00001400 Mod=COMMVIEW
WINICE: Load32 Obj=0007 Add=0187:02817000 Len=00000000 Mod=COMMVIEW

This happens if you use F12 and trace until you see "CommView" at the bottom of the Code window. All the rest of my tracing of aspr was in 017F: and I haven't gotten back to this code yet. Are these the CommView sections finally decrypted by aspr? They are the proper number, 7, of the sections of CV, excluding the 3 aspr sections, but the length doesn't seem to fit, even though I realize they were packed before. Maybe they are imports or exports or dlls. Got to learn more. Always more to read.

Zurito@~

After Christmas, I'll see if I can give you an "easy english" trip through Revirgin and tracing "unresolved" if the master's words of wisdom are still too difficult for you to follow, but then you still will not understand the "why," only "how" to fix build 156. As +SplAj said, cv3.1 build 161 handles API's another way.

Regards to all:
JMI
12-24-2001, 03:28 PM
Zurito@~

You wrote that your search using U5881EC did not lead you anywhere. You must not have been at the OEP.

After you start Softice Loader and load cv3.1.156 and set BPX GetVersion and F5 and then F12, follow steps to get to OEP at 589878. When you are there you can start looking at "unresolved."

U 5881EC; U 58826C; and U 5882A0 will then show good aspr code. Give it a try.

Regards.
Zurito@~
12-25-2001, 10:49 AM
Hi

See my attach file JMI, please

Regards.
Viper
12-25-2001, 11:18 AM
Parse error: parse error in /home/httpd/html/upload/attachment.php on line 61
JMI
12-28-2001, 02:26 PM
Zurito@~

Sorry but I am still to busy to deal with this issue right now. You have to understand how to use Softice to break on and trace various addresses related to the IAT and the re-directed entries.

For now, I recommend that you carefully review +SplAj's comments in the article on the General board here on Awave Studio 7.3, begun on 6-2001. He makes some specific comments on how to trace the entries found in RV. Remember that in looking at some of the entries you will sometimes see that they are within a groug of similar API's, such as KERNEL32. This is also a good clue that the "unresolved" entry is also within that group.

I believe that thread is at

http://www.woodmann.net/forum/showthread.php?threadid=1675

That's all for now.

Regards.


softice bug?, durin a jmp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > softice bug?, durin a jmp
PDA

View Full Version : softice bug?, durin a jmp

ON'error
12-20-2001, 01:06 PM
from uncracked ida:

.text:0040289F jmp short loc_4028A2
...

.text:004028A2 xor dh, dl
.text:004028A4 shl edx, 1
.text:004028A6 inc edx
.text:004028A7 inc ebx
.text:004028A8 or eax, eax
.text:004028AA jnz short loc_40289B
.text:004028AC jmp short loc_4028AF

hi,
when softice reached 40289F and i press f10(p) softice jumps but i dont see where it jumps to.
when i tried to find 4028A2(in SI) i only find 4028A1 with a stange adress(like 3245:35765554).
After typin f10 few times i finaly see the highlighted line again, but i dont know what is exclusiveOred[;)] and i really tried to find it. Is it a softice error?
Fake51
12-20-2001, 06:37 PM
It's not an error on Si's part, it's a protection approach: You jump to the middle of an opcode. Softice will disasm the code opcode by opcode, instead of looking at the code flow. If, in si, you press . and then return, si will jump to the current eip. Thus, it's just a trick, to make you debug some code, that you would rather jump over, or run it before you get a chance to see it.

Fake


VB Serial Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB Serial Protection
PDA

View Full Version : VB Serial Protection

XeNoSiS
12-21-2001, 08:56 AM
I am trying to learn VB debugging and have chosen to do so on 3DFTP 4.0. The only tool I have for p-code debugging is WKTVBDE. I know that Smartcheck is the recommended app, but some of us that haven't been able to find it have to resort to less able applications.

Can someone out there throw me a bone here? Being my first VB attempt... I am quickly learning that IT SUCKS!

:confused:
riPPadoGG
12-23-2001, 06:52 AM
Hi..
Is this a good idea? P-Coded apps are not friendly. I would suggest you to try the normal compiled VB apps for the start. When you become familiar with the function calls in msvbvm*0.dll, move on to p-code :)

P-Coded apps use the same functions, from the same msvbvm*0.dll... So, they are crackable, but getting off with a starting point is a bit hard..(as disassembly is always a problem)

p-code tip,
Try JosephCos VB discompiler if you want.

Read Razzia's tut, about VB reversing. Serial fishing is dealt with..

regards
riPPadoGG

:)

NB: I myself have struggled a lot with p-code apps... Since this forum has helped me a lot(with unpacking :) thank you all!!) Can someone come up with some good tuts/posts/anything ??? ;)
XeNoSiS
12-27-2001, 11:57 AM
Ok, well I agree that working with p-code wasn't the smartest thing for a newbie like me. BUT I tried to load the app into JosephCo's VB Decomp and it crashed with a fatal error that I emailed to him a few days ago. Second I was able to finally break on the "Verify" button click. Being the inexperienced person that I am.... I stepped through the whole process until the "Invalid MessageBox" appears. So I came up with this block of code <pasted below> that I am currently working on deciphering. Another important note is that it compares parts of the serial I entered against all of these strings:

A563E9NL2Q72
A343J5JJS222
AC4KJ3228Q64
A442682QQ87A
A322X6NQSS3S
AA6KK3J4JU74
AC4KS6NQJW7A
AG6KP922LN64
AG6JF828Y83U
A982GTC4BH52
AA4P4QUNBB4U
A727UQY89M5S
AF4PZPU2K582
AE8NVNCJTK82
AG2N5MUJ5Z8J
AK67NWWMU2F5
AP26FYERCSBT
AX2P7YSR8SBD
AT2K5PJPYJAV
AK23VN292CFT
TJ4E79ALH4L.

So it looks like there is some heavy math involved. Here is some comments that I extracted from the Verify process as well:
;Decrypt
;01
;Encrypt
;Scramble
;Unscramble
;BinToSer
;SerToBin
;IntToBin
;BinToInt
;GetDivs
;Error: Can't split data into groups because is a prime number!
;RearrangeBits
;Error on xorStrings

These give me a good idea that he is doing quite a bit with the code entered and the way he is comparing it to stored value.

Any more thoughts? Tell me if I am way off base and I don't have a clue... But I think I have done some pretty good analysis work so far. Especially for a new new newbie. Someone has already posted a working serial online, so this is strictly for learning purposes at this point.

<Verify Button Clicked>
741BEA99 . 66:83F8 00 CMP AX,0
741BEA9D > B8 00000000 MOV EAX,0
741BEAA2 . 0F94C0 SETE AL
741BEAA5 . F7D8 NEG EAX
741BEAA7 . 50 PUSH EAX
741BEAA8 . 33C0 XOR EAX,EAX
741BEAAA . 8A06 MOV AL,BYTE PTR DS:[ESI]
741BEAAC . 46 INC ESI
741BEAAD .^FF2485 94ED1B7>JMP DWORD PTR DS:[EAX*4+741BED94] ; MSVBVM50.741BE058

741BE058 > 58 POP EAX
741BE059 . 090424 OR DWORD PTR SS:[ESP],EAX
741BE05C . 33C0 XOR EAX,EAX
741BE05E . 8A06 MOV AL,BYTE PTR DS:[ESI]
741BE060 . 46 INC ESI
741BE061 . FF2485 94ED1B7>JMP DWORD PTR DS:[EAX*4+741BED94]

741BD947 > 0FBF06 MOVSX EAX,WORD PTR DS:[ESI]
741BD94A . FF3428 PUSH DWORD PTR DS:[EAX+EBP]
741BD94D . 33C0 XOR EAX,EAX
741BD94F . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
741BD952 . 83C6 03 ADD ESI,3
741BD955 . FF2485 94ED1B7>JMP DWORD PTR DS:[EAX*4+741BED94]

741BDE59 > 0FB706 MOVZX EAX,WORD PTR DS:[ESI]
741BDE5C . 8B55 AC MOV EDX,DWORD PTR SS:[EBP-54]
741BDE5F . FF3482 PUSH DWORD PTR DS:[EDX+EAX*4]
741BDE62 . 33C0 XOR EAX,EAX
741BDE64 . 8A46 02 MOV AL,BYTE PTR DS:[ESI+2]
741BDE67 . 83C6 03 ADD ESI,3
741BDE6A . FF2485 94ED1B7>JMP DWORD PTR DS:[EAX*4+741BED94]

741BEC87 > 33C0 XOR EAX,EAX
741BEC89 . 8A06 MOV AL,BYTE PTR DS:[ESI]
741BEC8B . 46 INC ESI
741BEC8C . FF2485 94F11B7>JMP DWORD PTR DS:[EAX*4+741BF194]

741BEA92 > 6A 00 PUSH 0
741BEA94 > E8 635BF0FF CALL MSVBVM50.740C45FC

740C45FC $ 66:837C24 04 0>CMP WORD PTR SS:[ESP+4],0
740C4602 . B8 00000000 MOV EAX,0
740C4607 . 0F85 D9F20500 JNZ MSVBVM50.741238E6
740C460D > FF7424 0C PUSH DWORD PTR SS:[ESP+C]
740C4611 . FF7424 0C PUSH DWORD PTR SS:[ESP+C]
740C4615 . 50 PUSH EAX
740C4616 . E8 48EFFFFF CALL MSVBVM50.__vbaStrComp

740C3563 > $ 55 PUSH EBP
740C3564 . 8BEC MOV EBP,ESP
740C3566 . 53 PUSH EBX
740C3567 . 56 PUSH ESI
740C3568 . 57 PUSH EDI
740C3569 . 837D 10 00 CMP DWORD PTR SS:[EBP+10],0
740C356D . BE 00000000 MOV ESI,0
740C3572 . 74 06 JE SHORT MSVBVM50.740C357A
740C3574 . 8B45 10 MOV EAX,DWORD PTR SS:[EBP+10]
740C3577 . 8B70 FC MOV ESI,DWORD PTR DS:[EAX-4] ; EAX=UNICODE "AZZZZZ" Entered String
740C357A > 837D 0C 00 CMP DWORD PTR SS:[EBP+C],0
740C357E . BF 00000000 MOV EDI,0
740C3583 . 74 06 JE SHORT MSVBVM50.740C358B
740C3585 . 8B4D 0C MOV ECX,DWORD PTR SS:[EBP+C] ; 3dftp.00446868
740C3588 . 8B79 FC MOV EDI,DWORD PTR DS:[ECX-4] ; ECX=UNICODE "AP26FYERCSBT" From App
740C358B > 3BFE CMP EDI,ESI
740C358D . 8BDF MOV EBX,EDI
740C358F . 73 25 JNB SHORT MSVBVM50.740C35B6

740C35B6 > 8BDE MOV EBX,ESI
740C35B8 .^EB D7 JMP SHORT MSVBVM50.740C3591

740C3591 > 837D 08 00 CMP DWORD PTR SS:[EBP+8],0
740C3595 . 75 36 JNZ SHORT MSVBVM50.740C35CD
740C3597 . 85DB TEST EBX,EBX
740C3599 . 74 28 JE SHORT MSVBVM50.740C35C3
740C359B . 8BC3 MOV EAX,EBX
740C359D . D1E8 SHR EAX,1
740C359F . 50 PUSH EAX
740C35A0 . FF75 0C PUSH DWORD PTR SS:[EBP+C]
740C35A3 . FF75 10 PUSH DWORD PTR SS:[EBP+10]
740C35A6 . E8 3FA40000 CALL MSVBVM50.740CD9EA

740CD9EA /$ 56 PUSH ESI
740CD9EB |. 57 PUSH EDI
740CD9EC |. 8B7C24 10 MOV EDI,DWORD PTR SS:[ESP+10]
740CD9F0 |. 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C]
740CD9F4 |. 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14]
740CD9F8 |. 33C0 XOR EAX,EAX
740CD9FA |. F3:66:A7 REPE CMPS WORD PTR ES:[EDI],WORD PTR DS:[ESI]
740CD9FD |. 74 05 JE SHORT MSVBVM50.740CDA04
740CD9FF |. 1BC0 SBB EAX,EAX
740CDA01 |. 83D8 FF SBB EAX,-1
740CDA04 |> 5F POP EDI
740CDA05 |. 5E POP ESI
740CDA06 \. C2 0C00 RETN C

740C35AB . 85C0 TEST EAX,EAX
740C35AD . 74 0B JE SHORT MSVBVM50.740C35BA
740C35AF > 5F POP EDI
740C35B0 . 5E POP ESI
740C35B1 . 5B POP EBX
740C35B2 . 5D POP EBP
740C35B3 . C2 0C00 RETN C

740C461B . C2 0C00 RETN C
NikDH
12-29-2001, 06:05 AM
Originally posted by XeNoSiS
Ok, well I agree that working with p-code wasn't the smartest thing for a newbie like me. BUT I tried to load the app into JosephCo's VB Decomp and it crashed with a fatal error that I emailed to him a few days ago. Second I was able to finally break on the "Verify" button click.

Well i think WKT is better in this case
using it u can step the code and see where the problem is

One of the probl is to learn what opcodes mean but after a little bit of stepping think ull learn the most important ones

Just be careful to Branch opcodes that make u jmp away

Well i've just cracked some pcoded apps even if i've never seen pcode before and havent read any tute about it
Think WKT debugger is really great tool

See ya
NikDH
josephCo
01-06-2002, 03:23 AM
The algo is a bit complex. BTW do you have symbols loaded into softice? It might help a bit, but then again maybe not hehe. I haven't tried much, but you've got an email or 2.

Good luck!!

joe
riPPadoGG
01-06-2002, 06:05 AM
Hi JosephCo,

Nice to find you here.
I have also tried to crack p-coded apps too... But with very limited success. I very comfortable with normal VB proggies.
I am even unable to break into the actual program code of a p-cde app.(like the one you get when you disassemble the normal one)
Also, every VB app starts like this...
call Thruntmain

and jumps off into msvbvm*.dll..
How can I go into the real start-up code??

I have been searching for the answers for too long...Any good docs to be read?

regards and tks in advance..
Cheers for the work you have done on VB decompiling..

doGG
josephCo
01-07-2002, 03:22 PM
Hehe PCode is an interpreted language. This means that 1 byte will be read and then there will be a jump to the corresponding (inside msvbvm*.dll) procedure that will work its magic. All your tracing inside msvbvm*.dll is the actual code being executed. You'll see something like MOV AL, BYTE PTR [ESI] then a JUMP EAX*4+XXXXXX (where XXXX is some address). When you execute those commands, then you have just read a new excode and jumped to its procedure. If you have symbols loaded into softice, you should be able to get a vague feel for how everything works. Using an old (most likely buggy) version of exdec, you might be able to have more success. There is no current version available and I most likely don't plan on releasing anything new. I would however help in the creation of any new tools (provided the author is serious and not wanting everything handed to him on a silver platter). I firmly believe in helping those that try to help themselves ;)

joe
riPPadoGG
01-11-2002, 09:36 AM
Hi JosephCo..
Big thanks for the response.
One more clarification needed.

What is this call to ThRuntMain?
This seems to go into msvbvm*.dll and never come back. I do not have the patience(apologies, that is a born trait) press F8 till it breaks back:)..
Please throw some light.

regards
doGG..
SargeG
01-12-2002, 12:52 PM
*****VERY SIMPLIFIED EXPLANATION******
*****DETAILS OMITTED FOR CLARITY******

"ThunderForm" is the name of the VB window (the one that you don't see; its sizes are set to 0) that contains the code that makes up your app. Basically, to run VB, windows gets the location of the procedure that handles VB apps, then jumps to the entry point of it (Main). When your app terminates, the procedure is ended (usually with a return value that is ignored), and the program is ended.

Note that the start address is very significant to a decompiling effort; you should start there, with a hex dumper/editor.

SargeG

PS: Two thoughts:
1. The start of this discussion sounds like a "Crack Help" request; is this the place for it?

2. If this discussion is/was not a crack help request, but a real desire to learn, why not try the MiniProjects Area, under decompiler stuff, where the ins-and-outs of writing a decompiler are discussed in much greater detail.


which API?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > which API?
PDA

View Full Version : which API?

wbe
12-21-2001, 09:00 AM
1. Which API in a program should I trace for checking whether a specific file exists in an (un)specified directory.

2. For .ini manipulation, which API(s) may be used other than Read/WritePrivateProfileStringA?

3. Which API(s) create a file in a directory (CreateFileA?)

Thanks
DakienDX
12-21-2001, 10:29 AM
Hello wbe !

If you've searched on the internet instead of posting here, you may have found the following results in the Windows API guide. The directory doesn't matter. You need to monotor the functions _lopen, OpenFile, CreateFileA and CreateFileW.
Only Read/WriteProfileString, or you need to create a simple .INI file processor yourself. But I' sure this is not what you need.
Well, look at 1., but use _lcreat instead of _lopen.Look around for WIN32.HLP. It might be 8MB, 12MB or 24MB big. (depending on help file compression)
Solomon
12-21-2001, 10:35 AM
1. you can also try FindFirstFileA. If the target OS is WinNT/2K/XP only , programmers can use native API such as ZwCreateFile/NtCreateFile etc, though this is not recommended.
wbe
12-21-2001, 04:30 PM
Thanks to you all.

Well, I do have lots of files, tuts, etc. on my HD about "Win32.hlp" but none of them give me the simple yet concise information a beginner needs. I get suffocated inside all those templates, instances and procedures. I think most of them are targeted for developers or for people in the know or may be I do not have the correct files at all.

It is this forum that I always get satisfactory answers to my specific questions from the reverse engineering aspect.

Thanks again.


ahhh short delphi keygen question!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ahhh short delphi keygen question!!!
PDA

View Full Version : ahhh short delphi keygen question!!!

ON'error
12-21-2001, 10:48 AM
hi,
how can i get the ascii value of a string("r")? in vb6 is the function asc(String) but in delphi 4?
DakienDX
12-21-2001, 11:00 AM
Hello ON'error !

Byte := Ord(Char)
String := Chr(Byte)

I hope this helps.
ON'error
12-21-2001, 03:51 PM
...
edit3.text:= ord(copy(Name,2,1)) calls an error. ord('r') not.
incompatible types! it should exist a mix between vb n' delphi.
do someone of you have a keygen source in object pascal?:

I just want to add all ascii values of the bytes from a string.
stealthFIGHTER
12-21-2001, 06:12 PM
Hello:

1) edit3.text is String
2) ord(copy(Name,2,1)) is Integer
Of course these types are incompatible :).

To convert Integer to String you must use IntToStr function.
Type: edit3.text:= IntToStr(ord(copy(Name,2,1)));

sF
ON'error
12-22-2001, 04:29 AM
yes, i forgot to write this in my post, but though if i use inttostr() there comes an error.
ManKind
12-22-2001, 11:29 AM
You can find some Turbo Pascal 7 keygen sources at this site:

http://kickme.to/ManKind2K

Download the archive1 ... Don't flame me, you asked for object pascal and version 7 of Turbo Pascal is very much object orientated :))

Delphi is indeed a very powerful compiler :))

Regards,
ManKind
stealthFIGHTER
12-22-2001, 05:35 PM
Originally posted by ON'error
...
edit3.text:= ord(copy(Name,2,1)) calls an error. ord('r') not.
incompatible types! it should exist a mix between vb n' delphi.
do someone of you have a keygen source in object pascal?:

I just want to add all ascii values of the bytes from a string.

I think you mean this:

var i, CharVal : Integer;
__ SomeString, Result : String;

for i := 1 to length(SomeString) do
begin
__ CharVal := Ord(SomeString[i]);
__ Result := Result + IntToStr(CharVal);
end;
edit1.text := Result;

You can visit my page - I have some tutorials how to make kg (Delphi sources).

Author := 'sF'
ON'error
12-23-2001, 07:49 AM
jup, thanks now ive finished my keygen 4 bengalys 3rd crackme!


I need help...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > I need help...
PDA

View Full Version : I need help...

AlpHakK
12-21-2001, 09:47 PM
I'm a beginner.My IDA pro is a demo vision,I want to save a file after work,but "save" is disabled,how could I do?

Thanks!:)
Solomon
12-22-2001, 12:43 AM
buy;)
DakienDX
12-22-2001, 04:01 AM
Hello AlpHakK !

It's very simple. Get the SDK.
Create your own file-format for IDA.
Implement a file save function in it.
Compile your plugin.
Start debugging.
Find and correct errors.
Your problem is solved.
Snatch
12-23-2001, 03:56 AM
Originally posted by DakienDX
Hello AlpHakK !

It's very simple. Get the SDK.
Create your own file-format for IDA.
Implement a file save function in it.
Compile your plugin.
Start debugging.
Find and correct errors.
Your problem is solved.

Haha. It's very simple :). That is a good idea though I had never even thought of that.


a very hard nut ! ! !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > a very hard nut ! ! !
PDA

View Full Version : a very hard nut ! ! !

eight
12-22-2001, 07:58 AM
Hi

First my english is not so good but i hobe you understand me.
I have a problem with a prog his name is cb97(file size 700 kb)
The program start´s with a reg box (name/serial) nothing else.
1.It has a Si check ( when you load ice dump Si work´s)
2.wdasm don’t work (debug error)
3.a temp file is generat where the fake serial is check´t (so i think)
4.on startup reg flag is check´t (so I think)

the prog is no public so I must send the file.
anyone will help me?

regard´s eight
DakienDX
12-22-2001, 08:20 AM
Hello eight !

This Board is supposed to help people who're stuck somewhere in the cracking process and can tell where they're stuck and what they've found out so far. Not just to come here and ask "Target is ..., it needs a serial number and a name to register, I think it somewhere checks the registration, who helps me to crack it?"

Please tell us something more about you and the program. Can you use SoftICE?
Do you know if the program is packed? If yes, with what packer?
Have you found the registartion check?
Do you know anything about the format of the registration data?
Which programming language was used?
Do you know if the registartion depends on the username entered?
Is the program a Win32-PE?
Do you know what is different between the registered and unregistered version?
Is the registration checked via online check or offline in the program?
Do you know ... ?
... ?
Do you know ... ?
... ?
Do you know anything more which could be useful?
eight
12-22-2001, 01:01 PM
Hi

My first step´s with Si
the program is for W9x
packed ? i don´t now
language ?
no online registration
offline

The program don´t start´s without the right serial
when you make a dubble click on the exe a window is popup this is not the right serial/name(reg flag check) put in the right on

My way....not finished
name/serial box Name: eight
serial: 1122-3344 registration data
bpx hmemcpy
F5
ok buttom
1*F11
7*F12
main program code (ARM1234!.text) 1234 number change´d by every new start is a temp file creat from the exe .
we land here
017F:10004E20 lea eax,[ebp-0100] /ebp-100 is the leng of my name
8*F12
we land here
017F:10004e26 lea eax,[ebp-0200] /ebp-100 is the leng of my serial

I think the check is here (ARM123.....)
017F:10004e76 call 10002c46 /registration check routine ? is very hard code for me i have the call traced many hours !
017F:10004e7B Test al,al
017F:10004e7D JNZ 10004F21 /jump to the good message
017F:10004e83 Mov esi,[kernel/32!getlasterror] /bad boy

when i change the flag on 10004e7d to jump to the good boy a window is popup your serial/name is corekt thank you ! when i pushed the ok buttom the prog runs for 2 sec and than aboard it
debug error message !

I´m a neawbie and i was interestet how to get the right serial or reg flag !

Sorry for my bad english

I hope you can help !

regard´s eight
DakienDX
12-22-2001, 02:12 PM
Hello eight !

This looks like Armadillo to me. It uses Blowfish to generate valid registration keys, a secure encryption algorithm, if you don't know. The author supplies a password which is choosen different for every protected application. If the program allowed to run in trial mode, it wouldn't be a hard task to unpack it. There are some unpackers available, but they rely on dumping the program when it is decrypted. But in this example this happens only if you've a valid key. Simply changing a 'flag' won't help here.

Can you tell us from which date the program is? So we could think of Armadillo versions not released at this time. If someone knows a way to tell the Armadillo version used to protect a file, this would help. I only worked on the earlier versions of it, (1.8x) but keygenning might work somehow.
eight
12-22-2001, 04:18 PM
Hi DakienDX

I think you ar on the right path !
When i check the prog with regmon i see it use key files in the registry.
HKLM\software\the Silicon Realms Toolworks\Armadillo

The exe file is from 20.juli.01
no trial mode
Viper
12-22-2001, 05:41 PM
This Armadillo.
when i scaned it with PEiDentifier it came back
Armadillo 1.xx - 2.xx. if it helps the linker version was 83.82
DakienDX
12-23-2001, 05:09 AM
Hello eight !

Here's some information from Armadillo's history page:

28Jun2001: Armadillo 2.01
The newest version of Armadillo is now available for download. In addition to the features of the beta (listed below), this version corrects one additional bug and adds a new feature, Modification Keys. (Please see the help file for additional details.)

So it could be the 2.x version in your program.
hex0r
12-23-2001, 05:57 AM
with one know finger print, name and key not so hard to remove armadillo. i've done it on armadillo 1.9
eight
12-23-2001, 06:57 AM
Hi DakienDX

I check it with file inspector he say´s found a signatur armadillo 1.80 !

right or wrong ????
eight
12-23-2001, 08:29 AM
Hi Viper,

any success with the prog ?
Viper
12-23-2001, 09:17 AM
i think this is the check routine
:0040B680 arg_0 = dword ptr 8
:0040B680 arg_4 = dword ptr 0Ch
:0040B680
:0040B680 push ebp
:0040B681 mov ebp, esp
:0040B683 push edi
:0040B684 push esi
:0040B685 push ebx
:0040B686 mov esi, [ebp+arg_4]
:0040B689 mov edi, [ebp+arg_0]
:0040B68C lea eax, ds:40E3A0h
:0040B692 cmp dword ptr [eax+8], 0
:0040B696 jnz short loc_40B6D3
:0040B698 mov al, 0FFh
:0040B69A mov edi, edi

Please correct me if im wrong
eight
12-24-2001, 10:05 AM
Hi

can anyone help us ?
I think we need a specialist here :confused:

regard´s


Armadillo cracking tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Armadillo cracking tutorial
PDA

View Full Version : Armadillo cracking tutorial

Rainor
12-22-2001, 01:32 PM
i'm looking for armadillo cracking tutorial, all turorial that i get don't include crackin the serial/key scheme , need to know if serial/key is use to calculate some decryption key for the packed .exe
froghunter
01-07-2002, 07:58 AM
hey,

Armadillo doesn't use the name / serial as decryption key of
the protected exe.
The new beta version of armadillo seems to mangle the IAT:)
It is pretty easy to dump the process and to have a fresh and clean executable, but it still miss the imports.
I coudln't work on it yet, but i will :)

hope it helps
regards,

Frog hunter
^DAEMON^
01-08-2002, 10:01 AM
hiho,

didn't took a deeper look @ the latest armadillo but it still remains @ the idea to create a .tmp file then decrypting and writing data in there.... and before resuming the thread they use writeprocessmemory to insert a part or the complete first section (dunno remember) iat mangled ???? huh.... can't be too hard :D (@ least i think so) dump before they load it up into memory (most protections keep a clean import table in there! before loading!!!)

^DAEMON^
froghunter
01-08-2002, 02:14 PM
hello mates ;)

i actually did unpack the latest armadillo.
the 2.5 beta doesn't include most of the protections.
BUT it doesn't work with a .tmp file anymore :)
actually, the IAT mangling is weirdo ;)
and don't happen on every API used :)

the mangled api are not often used, the one that appears often is
exitprocess :) (terminate process and so on are also mangled, but not used that often ;)

give it a shoot ;-)

Enjoy!

Frog Hunter
tester123
01-11-2002, 09:34 AM
Hi,

I have tried to unprotect a program (callstation v 2.1) protected by Armadillo . I did with ArmKiller 1.3 but this un-armadillo did not recognize the Armadillo version. I did also with The analyst's Armadillo deprotector. It can unpack but when I run the unpacked program it crashes.

So anybody can help me to manually unpack an armadilled program.
froghunter
01-12-2002, 07:56 AM
hello :)

did you try to find the OEP for that protected application ?
if you read analyst's manual , there is a need for some later
versions to find the OEP manually.
as he said, he didn't add the autoput OEP feature to prevent
lamers to use the tool.
Anyway, im gonna check that app out if i got the time.
Last armadillo 2.50 beta is easy to unpack tho.
Once you understand their "IAT' trick :)

Greetings,

frog hunter.
Poweroff
05-10-2002, 03:45 PM
Last armadillo 2.50 beta is easy to unpack too
I have program protected by Armadillo. How I can recognize which version of Armadillo used for protection?
PeID 0.7 by unpacking gods give only "Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks". And other unpacker tools give the same - only type of protection but not version.

UnArmadillo v1.4 and other sooner version can't worked because - version not supported.
Armadillo deprotector 1.1 - coded by tHE ANALYST - can see two processes in list of runing processes, but after unwrapping - getting file competely indentical with original program. I try unwrapped both proceses and both of them give original program.
LordPe - can unwrapped process successfully and I can grabbing resources of protecting program but can't runing it cos PE information damaged.

the question is: how I can recognize version of armadillo protection and how I can resurect PE header of unwrapped file?
Best Regards
Maxim
The_Snake
05-10-2002, 04:44 PM
hey goto:got this page (http://www.exetools.com)

you find Armadillo un-packers

hahaha!!!!!

Greetz to:ShRkS,MackT,Y0da,& you
:D
Poweroff
05-10-2002, 04:50 PM
I already have all armadilo unpackers from this site
They not worked for my protected program and also don't give version of protection. I think you don't read completely my post.
Or maybe you have newest soft then unarm1.4 and Armdep11?
VtE
05-10-2002, 07:40 PM
Hi Poweroff,

I am at the same point that you.

the question is: how I can recognize version of armadillo protection

I proceed by elimination.
If those two version UnArmadillo v1.4 and Armadillo deprotector by THE ANALYST don't work, then you have the chance that your program are protected with Arma between 2.1 and 2.52.

But the lastest version 2.5x don't create a temporaly file "armxx.tmpx" anymore and there is no "XXXX" section too.

The version 2.1 and 2.2 still have the temp "armxx.tmpx" file and they still have the "XXXX" section.

Check the temp file, and you have a better chance to know what version you have.

Someone correct me if I am wrong.
crUsAdEr
05-10-2002, 09:00 PM
Hi all,

Just thought i would post more details here... hopefully armadillo wont cause a problem anymore... it is not a tool to remove armadillo but with this knowledge you will be able to defeat all current version of armadillo....

As I have posted before, use bpx SetProcessWorkingSetSize to get OEP...

However, dont trace into the call edi, when you are at that address, record down edi, that is OEP and then do bpx WriteProcessMemory... this is because armadillo act as a debugger that debugs the protected program, it encrypt the text section of the protected program, once the encrypted code is executed, exceptions occurs and the debugger (armadillo) will take control and decrypt the code appropriately... it has anti tracing trick as well so that is why once we trace into the call edi, armadillo will detect its debugee being trace and exit quietly...

The trick to overcome copymem is to find the procedure that decrypt the text section and force it to decrypt the whole text section instead of 1000h bytes only... to find this routine, at call edi do bpx WriteProcessMemory and then wait till sice breaks, press F12 once and you will be inside the this decrypting routine.... F12 once more you will be right outside the routine....

The signature of the decrypt routine is like this,
.text1:004B06A6 6A 00 push 0
.text1:004B06A8 8B 4D 08 mov ecx, [ebp+arg_0] <===== where to decrypt
.text1:004B06AB 51 push ecx
.text1:004B06AC E8 AE 00 00 00 call sub_4B075F ; THIS CALL DECRYPTS OUR CODE :>
.text1:004B06B1 83 C4 08 add esp, 8
.text1:004B06B4 25 FF 00 00 00 and eax, 0FFh
.text1:004B06B9 85 C0 test eax, eax
.text1:004B06BB 75 07 jnz short loc_4B06C4
.text1:004B06BD 32 C0 xor al, al;

This is taken from armadillo 2.51 (i think) itself... you can find this routine by searching for WriteProcessMemory and then scroll up, or you can just do a hex search for "6A 00 8B 4D 08"... you will be able to find it... you can disassemble any prog protected with armadillo cos these code and not encrypted at all!!!!

Trace inside the call and you will find out how simple copymem is!!!! You will see that this call is called from 2 different places... the othe places has one minor difference, the first parameter pushed on stack is a "1" and not a "0" anymore... hence you can guess what these param are for heh :>>....

Now you have a few ways of patching the exe to defeat copymem...
1. Stop armadillo from ever encrypt the code section (1 byte patch)
2. Patch the decrypt routine so that it decrypt the whole text section instead of 1000h bytes (changing 1000h to the text section size)
3. Patch the routine above that i posted to make it a loop so that it will decypt the whole text section by simply incrementing the variable in [ebp+arg_0] (this is what i have been doing cos i din think of the first method :<.. but good fun)...

After this.. copymem is defeated altogether, IAT rebuilding is not that hard, espcially on win2k.. even win98 you can simply bypass the redirections by inline patching the old way of patching VBox...

Hope this is clear enough an explanation and armadillo wont be a problem anymore! :>

I have never tried Remi and Silbufusch's way, though i think their way can defeat armadillo eventhough we dont have the right password??? Not very sure, armadillo is really bloated, such a pain to reverse compare to neat code by Alexey...

That is all folk,
Regards,
crUsAdEr
Hwoarang
05-11-2002, 12:15 PM
i have some questions about arma iat redirection
first of, this is how iat is redirected on my win98 (not se)

017F:82F64C68 683D70F7BF PUSH KERNEL32!ReadFile
017F:82F64C6D E9390A033D JMP BFF956AB

That doesn't seem to be runtime allocated by arma loader..methinks it's the memory which win32 allocates for storing command line??
Jump to bogus api=RET, so u just have to make a redirection which patches those jmp fake api with C3 to be recognized by iat rebuilders

Second, im really intrigued about this code bcoz it's really weird:

; here follows code from arma loader, GetProcAddress called *normally* to retrieve address
; of an api...normal parameters are passed to stack (api name and module base..in this cycle of ;the loop "ReadFile" string with Kernel32 base address
017F:00608646 FF1524116100 CALL [00611124] ; just call *Kernel32*'s GetProcAddress

;now happens the odd thing...eax does NOT contain the api address in Kernel32 for ReadFile, but
;it points to the redirected memory which will jump to this api!!!
;how does this work???

017F:0060864C 8945E8 MOV [EBP-18],EAX
017F:0060864F 837DE800 CMP DWORD PTR [EBP-18],00
017F:00608653 7528 JNZ 0060867D
017F:00608655 C7052C54610003000000MOV DWORD PTR [0061542C],00000003
017F:0060865F 8B4DE0 MOV ECX,[EBP-20]
017F:00608662 51 PUSH ECX
...blahblah..
Poweroff
05-11-2002, 06:58 PM
Sorry fo lame question, I try to answer it by self but maybe somebody help?

I download from programers tools frogsIce - it successfully hide SoftIce from Armadilo loader but now I have a question:
SetProcessWorkingSetSize, WriteProcessMemory and other functions is not documented in SoftIce (maybe only my version?).
How I can set breakpoints on this functions? How I can find adresses of its?
Hwoarang
05-12-2002, 03:26 PM
hey Poweroff read your softice documentation, especially the part about editing winice.dat
or use the "load exports" command from Loader32.exe (found in Softice directory) and point to Kernel32.dll (found in your windows\system directory) and open it.
and u can set bp on WriteProcessMemory after

hummm...can't anyone explain what happens with that GetProcAddress in armadillow?


armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > armadillo
PDA

View Full Version : armadillo

hex0r
12-23-2001, 12:02 AM
Hi All!

I have armadillo protected program with no trial enabled and i have name and key not for me, how can i run this program with this key and name on my box?
DakienDX
12-23-2001, 05:17 AM
Hello hex0r !

I've a the same discussion already under the this topic (http://www.woodmann.net/forum/showthread.php?threadid=2405). Please follow it there. But you could help too. If you've one valid key it might be easier to create more valid keys. But don't publish it here in public, since not all people keep information, like registartion data, secret to shield it's legal owner. So if you would publish it here, you would see it one day later on your favourite crackz-size released by four different groups.


Hiding SI in WINNT4/2K DS2.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hiding SI in WINNT4/2K DS2.5
PDA

View Full Version : Hiding SI in WINNT4/2K DS2.5

+SplAj
12-23-2001, 09:24 AM
Hi guys ,

did anyone need to hide DriverStudio 2.5 SI from those analy retentive types who want to detect \\.\NTICE etc etc ????

OR..... R U just waiting for DS2.6...........working on XP soon ???

Anyways, it's done for me..... and anyway what fuxin build is it ? SI :- DS2.5.0 ( b240 ) or properties :- 4.2.5 (Build 824) duh ???

merry xmas to all RCE :rolleyes:

Spl/\j
B-Boy
12-23-2001, 06:21 PM
erm sorry for maybe posting to the wrong thread (winnt) but..

i managed to hide sice 4.2.5 (build 240) and 4.2.6 (build 336) on my win98 system, but i have trouble with icedump, it simply doesnt want to load.. seems to be for different builts of sice :(,
(funny thing, the 4.2.6 says its 4.2.5 when loading..)

as xmas suxx, i'll simply say bye :)


newbie questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbie questions
PDA

View Full Version : newbie questions

Spade
12-23-2001, 11:24 AM
I am an absolute beginner so please forgive me if the below questions appear so stupid to you.

1. What is the difference between "ret" and "ret 000x"? Does ret 0004 moves 4 lines up, 4 bytes up or four calls back, or what?

2. At 0041BCD0, I have the dialog saying "trial is ended". The dialog offers me two choices; Register... or Quit. According to the below snippet, how do I arrive here (0041BCD0)? Tried returning at 0041BCB0, at 0041BCCB and 0041BCD0, no hope. The call at address 0041BC63 is called from another address. Just two lines up of it there is a conditional jump. Reversing it fools the program but it starts right from the scratch, ie., you loose all your settings.

The installation date is encrypted in a .dat file in Windows directory. Deleting this file also starts the program from the scratch. I couldn't find where the actual time comparison is made. I played with compare string, get system time, get local time, system time to file time functions but no hope.

3. Why do authors sometimes use nop in their code?

Thanks in advance.

* Referenced by a CALL at Address:
|:0041BC63
|
:0041BCB0 56 push esi
:0041BCB1 8BF1 mov esi, ecx
:0041BCB3 E868FAFFFF call 0041B720
:0041BCB8 8B442408 mov eax, dword ptr [esp+08]
:0041BCBC C706D0FA4200 mov dword ptr [esi], 0042FAD0
:0041BCC2 894604 mov dword ptr [esi+04], eax
:0041BCC5 8BC6 mov eax, esi
:0041BCC7 5E pop esi
:0041BCC8 C20400 ret 0004

:0041BCCB 90 nop
:0041BCCC 90 nop
:0041BCCD 90 nop
:0041BCCE 90 nop
:0041BCCF 90 nop

* Possible Reference to Dialog: DialogID_0139
|
:0041BCD0 B839010000 mov eax, 00000139
:0041BCD5 C3 ret

:0041BCD6 90 nop
:0041BCD7 90 nop
:0041BCD8 90 nop
:0041BCD9 90 nop
:0041BCDA 90 nop
:0041BCDB 90 nop
:0041BCDC 90 nop
:0041BCDD 90 nop
:0041BCDE 90 nop
:0041BCDF 90 nop
:0041BCE0 56 push esi
:0041BCE1 8BF1 mov esi, ecx
:0041BCE3 E818000000 call 0041BD00
:0041BCE8 F644240801 test [esp+08], 01
:0041BCED 7409 je 0041BCF8
:0041BCEF 56 push esi
:0041BCF0 E881300000 call 0041ED76
:0041BCF5 83C404 add esp, 00000004
DakienDX
12-23-2001, 01:36 PM
Hello Spade !

(1)
Push EAX
Push EDX
Call Proc1
Add ESP, 8

(2)
Push EAX
Push EDX
Call Proc2The two exapmles should show the difference. As jou know, a procedure ends with a return, a "RET". If you "PUSH" something on the stack, ESP gets decremented by 4 (if the value is 32bit). So in example (1) ESP gets decremented by 8, then the Proc1 is called and after that the stack pointer is restored. In example (2) it's different. ESP doesn't get restored after the call, so the procedure must take care itself to change ESP back to it's normal value. So Proc2 needs to return with a "RET 8" instead of a "RET"
Usually dialogs are shown by a "Push DialogID" and a call to a procedure creating the dialog. So you must find a "Push 00000139h" in your example. Or you can try to catch the procedure where the date-file is opened. This can be done by _lopen, OpenFile, CreateFileA and CreateFileW.
Authors do not use "NOP" in their code. Must compilers have two switches. One is to give the file it's smallest size, the other to give the file the maximul execution speed. If the program is written for speed, the compiler inserts "NOPs" after each procedure so that the following is aligned on the next 10h byte boudary, which is faster to access in memory.
?ferret
12-23-2001, 05:55 PM
By the looks of your snippet, 41BCD0 isn't directly referenced in the program (no "Referenced by CALL at xxxxxxxx")

So, the program probably has a Call EAX where EAX == 41BCD0
To find this you can either set up a backtrace buffer in Softice, or try IceDump. Then set a BPX on 41BCD0 and see what the last line executed before that was.

And since the value 139h is placed in EAX during that call, 139h is probably not pushed directly to create the window.....Push EAX is probably used to fill that parameter for the function.

Once you find out where the call to create the window is you should be able to figure out how to bypass it....depending on how many calls are indirectly referenced through registers, you may have to use the above methods a few more times to find what you need.
Spade
12-24-2001, 07:45 AM
Thanks a lot.

The info you two provided was very helpful. Good news is, the program now works flawlessly on my PC.

It is very clear that this was only the beginning. Still got much to learn. Anyway, well begun is half done.

Thanks again...
IcyDee
12-28-2001, 01:24 PM
Originally posted by DakienDX
Authors do not use "NOP" in their code. Must compilers have two switshes. One is to give the file it's smallest size, the other to give the file the maximul execution speed. If the program is written for speed, the compiler inserts "NOPs" after each procedure so that the following is aligned on the next 10h byte boudary, which is faster to access in memory.[/list] [/B]

If the only reason for a NOP was to align on a word boundary then there would only ever be a need for upto 3 nop instructions which the example above shows is not the case.

It is more common to see a lot of NOP instructions because the program has been compiled in 'debug' mode or more precisely it has 'incremental linking' set on. In this mode each routine or module is 'padded' with a number of NOP instructions, usually to a 16 byte boundary. In this way if the code is changed slightly in that routine or module, typically by adding a few more bytes, then the extra space will be taken up by the padding and the program will not need to do a full link (since no other routine has changed address).

So the presence of a lot of NOP instructions means that the programmer has been sloppy and has not bothered to produce a 'release' version.
DakienDX
12-30-2001, 12:05 PM
Hello IcyDee !

If I say "on the next 10h byte boudary" this is the same as "a 16 byte boundary". I've never seen anything in Win32 which was aligned on a 32-bit-word boundary. All programs which use the "speed" feature use 10h bytes (= paragraph). The examples I've seen in debug mode use sometimes 1000h (=4096) bytes of NOPs or CCs between external .LIB files bound in.


asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > asprotect
PDA

View Full Version : asprotect

silverstorm
12-23-2001, 10:07 PM
hello.. sorry..
i have problem unpackin software protected whit asprotect new versions..

i found entry piont..
an dump whit icedump.. and whit revirg a try to reconstruct the iat
but a have probelms whit some apis.. that apis made reference to a call not a api function..
how y do to repair this problem ?

thanks
SiLvEr StOrM

p.d. sorry for my english :(
Solomon
12-23-2001, 10:09 PM
What's the URL?:D
silverstorm
12-23-2001, 10:30 PM
on this moment not have url here.. i have in home.. but a see on www.fileflash.com many files are protected whit asprotect.. and all a think use the same proteccion example:http://secureaction.com/chat/download/chat.zip
and i want to learn to umpacking this proteccion..
and. thanks
merry cristmas.. to all..
:)


Help Icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help Icedump
PDA

View Full Version : Help Icedump

dipeshrestha
12-24-2001, 12:34 AM
Hi
its me agian dipeshrestha

recently i had got chance to read the article about the icedump and i had download it from icedump site. i unpack it and copy in my system.

i added one line "c:\numega\iced\icedump.exe" right after the line "c:\numega\winice.exe" . i am asumming that the ice dump will load after softice loaded. but to my horror it doesnt load i have to run it again manually.

i dont know whats the problem please help me.

dipeshrestha
TRUE NEWBIE
Viper
12-24-2001, 12:51 AM
this may be a lame way to do it but its the only way i found to work, put a link to it in your statup folder, it will load all the time. its not the best but it works
DakienDX
12-24-2001, 04:05 AM
Hello dipeshrestha !

When SoftICE is loaded in AUTOEXEC.BAT, it runs WIN.COM itself which starts Windows. So any lines after the call to SoftICE won't be processed ever.
riPPadoGG
12-24-2001, 04:13 PM
Didn't know S-Ice started win.com...
That clears up certain mysteries... tks...
Viper
12-24-2001, 04:36 PM
i didnt know it did either
dipeshrestha
12-26-2001, 12:25 AM
I dont know that softice run win.com. so i have to load icedump from startup.

thanx to all.

dipeshrestha
Kayaker
12-26-2001, 04:24 AM
Hi guys,

You should dig out +Spath's Softice Internals (not sure if it's in the ID-rip archive, was on Crackz anyway), it's a great read on how SI loads up and works.

"17. load and execute WIN.COM"

regards,
Kayaker
Bengaly
12-26-2001, 04:29 AM
Installing IceDUMP:
-------------------
Extract the ZIP file (32bit with dirs.).
It is not important where to Extract IceDUMP.
Once extracted, should see Dirs:
TOOLS / W9X / WNT
| | +--------------------> WinNT VxD versions of SoftICE
| +---------------+
MASM include files |
|
SoftICE win9X versions (Dos as well)
In this dir you should see allot of Dirs
Every dir represents SoftICE version,
Starting from DOS->Windows SoftICE versions.
Also there are some other Dirs for small
Utile (mp3 player..)

The first thing you do before running the IceDUMP exe file (VxD)
Is to ensure your SoftICE version, you can do that by loading SoftICEAnd press VER
You will be given The SoftICE information.
For example, my SoftICE version is:

SoftICE 4.0.5 (Build 334)
Copyright (c) 2000 Compuware Corporation. All rights reserved

This means i have SoftICE 4.05 Build 334)
So I Run SoftICE for Windows98, so in IceDUMP Dirs for w9x
I need to enter the sub dir called: 4.05.334
And load the specific VxD for my SoftICE version.
*You don't need to put IceDUMP files in SoftICE directory.

My IceDUMP is installed at: D:\Dont Tuch\MyDucoments\Cracking\Ice Dump\w9x
Where SoftIce is installed at: C:\Program Files\NuMega\SoftIce95
You see, there is no need to move any files, when running the right IceDUMP VxD
Version for your SoftICE it will automatically patched in memory and be ready to use.
And you can use more options IceDUMP have :-)

Have Fun.

p.s:

there is a new version of iceDump, so u should grasp it :-)
npcracker
12-28-2001, 12:49 AM
Hi all

good discussion over here. I am also facing some problem with my s-ice. I cannot use my mouse while i am inside the soft ice. i have installed mouse.drv in softice initialization settings. but it doesnot work.

please help me.

npcracker:(
Bengaly
12-28-2001, 01:19 AM
Hi,

i have installed mouse.drv in softice initialization settings. but it doesnot work.

well, open sice's mouse driver setup, and choose ur type or mouse, mostly old mouses will work in Com-2 , new mouses with PS2 ...
although when using mouse in sice, i dont recommend with the Wheel onto of it , cuz it goes crazy in Sice :)
cya later
npcracker
12-30-2001, 02:02 AM
Hi bengaly

i have done what ever u had said to me . but the damn mice is not moving in sice
please help :confused:
stillnewbie
12-30-2001, 09:23 AM
Heya npcracker,

check or tick or choose ;p ps2 mouse,and Microsft intellimouse
and restart softice might help ;).

To bengaly,
old mouse uses serial port which is com1 not com2 ;)
ThrawN
12-30-2001, 09:43 AM
Remember softice does not support a USB mouse. I use the PS2 convert on my shit MS mouse, and the wheel does go funny, sometimes =)

ThrawN
npcracker
01-07-2002, 12:49 AM
Hi all

after all my mouse still is not moving in the sice. i have done whatever u had said but..............:( :( :( :( :(

npcracker needs help
Viper
01-07-2002, 03:46 PM
hi npcracker

try this in S-ICE type Set Mouse on

see if that will get you going
dipeshrestha
09-22-2004, 04:46 AM
Hi all,

I am facing odd problem over here. i have searched forums for my problem but cant find one. So i am going to revive this old thread ;-). Actually after formatting my HDD, i installed sice 4.01 under w98se. after that i tried to load icedump. but icedump cannot be loaded. i tried all version of icedump but doesnt load. it runs well before i format by HDD. I cannot figure out what the problem is. So can anyone guide me with that?

dipeshrestha
dipeshrestha
09-22-2004, 11:46 PM
sometimes quick reinstall will solve the problem. ;-). i reinstalled sice and prob solved
JMI
09-23-2004, 11:06 AM
It is usually a good first step to try to resolve problems, particularly on a freshly formatted HD. :yay:

Regards.
dipeshrestha
09-26-2004, 12:04 AM
Hi JMI,

When i saw your reply, i am quite sure that you must have said "Use Search Button on top" or "paste some link to threadid".... :p :p. Anyway it was not the case this time. Hope you wont mind... :smug:

dipeshrestha
JMI
09-26-2004, 06:55 PM
Actually, I was responding to your statement of: "i reinstalled sice and prob solved". Since you had re-installed it on a clean HD, it should have worked, unless something glitched. Re-re-installing usually resolves such issues, since there shouldn't have been anything preventing it from working correctly. :yay:

Regards,


Merry Cristmas and Happy New Year !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Merry Cristmas and Happy New Year !
PDA

View Full Version : Merry Cristmas and Happy New Year !

Al Solodovnikov
12-24-2001, 06:48 AM
Hi,

I would like to congratulate you with Merry Christmas and Happy New Year!

We have a lot of fun in this year, and I'm sure that we'll have
more fun in the New Year too. Especial congratulations to Admiral (TSEHP :) and his Revirgin. Hope, you should work on new
versions very very often ;)

Alexey Solodovnikov
DakienDX
12-24-2001, 07:19 AM
Merry Christmas and Happy New Year to you too, Alexey Solodovnikov !

I hope I'll participate the fun in the new year too.

Of course, Merry Christmas and Happy New Year to all here.
goatass
12-24-2001, 08:54 AM
Happy Holidays to everyone on this board, even the people that just read and don't participate :)

This year has been a good one, we saw great improvements in the software protection industry and we also saw great improvements in the reverse engineering field thanks to all of you.

Expect the new year to bring us new and exciting projects, so don't drink too much this New Years as to save some brain cells.
Just kidding :)

So what do people want to do in the new year?

I for one would like to study some more crypto related protections and perhaps delve into some of the latest anti-copying protections used on music CDs.

Happy Holidays and keep up the great work,

goatass
Js
12-24-2001, 09:05 AM
Seasons greetings to you Alexey. Live long and prosper.
vgb
12-24-2001, 11:33 AM
Merry Christmas and a very Happy New Year to all the RCE!

vgb
?ferret
12-24-2001, 03:25 PM
Happy Holidays to Alexey (been awhile, good subject for your first post in the new forum *G*)....and to everyone else here.
JMI
12-24-2001, 03:39 PM
Alexey LongRussianSurname:

Thank you very much for keeping this RCE effort very interesting. Your efforts and changes keep us on our toes and our minds working. Hope you and yours have a Merry Christmas and a Happy New Year. Same to all the RCE crew, where ever you may be.

Regards.
Woodmann
12-24-2001, 10:59 PM
Seasons greetings,

I just want to say that everyone who comes to this place,
Thank you all for just stopping by. I never would have thought that this place would help so many people. For me thats all I ever wanted, pass on the knowledge, make sure you can find it and get it for free. The only reason I do this is to make sure it stays free. As long as you keep visiting then I will know it is worth the effort.
Thanks to you all :D

Peace, Woodmann
cah
12-25-2001, 10:15 AM
To,
All RCE Group of Reverse Engineers

Merry Xmas & Happy New Year

cah...
Bengaly
12-26-2001, 04:34 AM
Merry Xmas to all RCE members

I hope the new year will much facinating and interesting ...

Cya ya Next year :-))..ya in 6 days ;-)

RCE ForEver
NikDH
12-29-2001, 06:22 AM
Originally posted by Al Solodovnikov
Hi,

I would like to congratulate you with Merry Christmas and Happy New Year!

We have a lot of fun in this year, and I'm sure that we'll have
more fun in the New Year too. Especial congratulations to Admiral (TSEHP :) and his Revirgin. Hope, you should work on new
versions very very often ;)

Alexey Solodovnikov

Hi alexey,
thank u very much 4 all ur hard work
and tnx 4 helping me to improve my very little knowledge

Merry Christmas and Happy New Year

See ya
NikDH
evaluator
12-30-2001, 02:59 AM
Hippy new yer, A.S.!
I want say "THANKS" to you for your two interesting packers(ASPACK&ASPROTECT),
because they are good targets for learn "UNPACKING".
(Yet I can't understand why second packer produces bigger files..)
Now at Cracks.Am is aviable my crack for DigiSecret v1.1.278
This is my newyear-gift for you.
So in last words I want say:
in new year
WE will continue enjoy with unpacking
YOU will continue work and make money
THEY(software developers, who byed your and other protector) will cry..
tsehp
12-31-2001, 04:21 AM
Happy new year to all.

Alexey, I have also to congratulate you for all the tricks you teached me indirectly with your nice and fast evoluating versions of aspr.

I decided for this year to put a delay on 1 month between the day I manage to include new evolutions in rv against your nice tool, just to let your customers have the time to sell the new versions of your product, and also because you are a pretty positive person, never attacking anyone here; and especially because you understood like a lot of wise people here that learning is the final goal of all this place.

It seems that I finally manage to add more emulation for your new aspr 1.4 trick as splaj discovered, but now we'll be working on your new anti tracing trick (ao2000pr 1.11 protection).

pretty nice work ;)

best regards,

tsehp
tsehp
01-02-2002, 03:44 PM
hi artha,
I have other reasons :
1-It's better to release something stable and tested (you know where).

2-delaying the release could also harden the work of a protector that is unfortunatly forced to release its protection as fast as possible, in one month the protections gets to more customers but when the countermeasure is released, it will also attack more targets already updated with the protection's new version. But this is not my primary goal.

I think it's time here to show some respect to such guys, oriented on the protective side, just because the wall between us is pretty thin.
evaluator
01-03-2002, 03:06 AM
Tsehp!

Now you became STRATEGOS


Rather Very Easy VB Challenge...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Rather Very Easy VB Challenge...
PDA

View Full Version : Rather Very Easy VB Challenge...

Nick
12-24-2001, 11:42 AM
he, i found this in www.try2hack.nl
whatever, here it is..

EasyVbasicChallenge (ftp://200.24.7.230/_Nick/~ Upped By nick_Insomniac/%7_DedicationToRedratForum)
Kayaker
12-24-2001, 12:49 PM
Hi,

I haven't been able to connect to the ftp site, is it OK, Dead or just Slow?

Kayaker
Viper
12-24-2001, 01:13 PM
i think its just slow
mitrix
12-25-2001, 01:54 AM
Hi all

EasyVbasicChallenge
Nick
12-26-2001, 12:08 PM
Originally posted by Viper
i think its just slow

Dunno what happened to you guyz, i downloaded on 5k/sec with an ISDN 64 :)
Viper
12-26-2001, 04:29 PM
i dont know what happened either but one time i checked and the board was down alltogether and the next time it might as well been down cause it was slow
vbdisease
01-07-2002, 05:25 PM
hi,

it easy to get some passwords (4) with some tool like good old customizer. it will show you the passwords and hidden editboxes.

but theres still one question:

WHAT TO DO WITH THESE PASSWORDS??? NO "well done cracker"
, no sweeties. grmml....:(

regards,
vbdisease


macro prob..I need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > macro prob..I need help
PDA

View Full Version : macro prob..I need help

Viper
12-24-2001, 01:52 PM
Can somebody tell me whats wrong with this
macro any = "bpx getwindowtexta do \"d esp->8;p ret;\" "
i also tried
macro any = "bpx getwindowtexta do 'd esp->8;p ret;' "
neither worked
can anybody help me out with this
Js
12-24-2001, 02:08 PM
"BPX GetWindowTextA DO \"D d esp->8;pret \""
Js
12-24-2001, 02:19 PM
Just realised its the same, I pasted it from my winice.dat and it works fine for me.
Viper
12-24-2001, 02:26 PM
thats odd for some reason its not working for me
Js
12-24-2001, 02:33 PM
I give up, seven times I logged in and still getting "you are not logged in"
JMI
12-24-2001, 02:33 PM
Viper:

This is an extract from an article titled "Rhayader's Softice Tips.." which I attached to one of my previous posts. He said:
----------------------------
Let's take a look at GetWindowTexta first. It's declared as:

int GetWindowText( HWND hWnd, LPTSTR lpString, int nMaxCount );

GetWindowText use stdcall calling convention. That means that argument will be pushed right to left. Since SoftIce pop up before the prologue code is executed, the EBP stack frame isn't set up yet. So we had to use ESP to adressed the argument. Here's how the stack will look like when SoftIce pop up:
...
[ESP+0Ch] - nMaxCount
[ESP+08h] - lpString
[ESP+04h] - hwnd
[ESP+00h] - return EIP

When the function return, GetWindowTexta will put the text it retrieved to the location pointed to by lpString (LPTSTR is a long pointer to a null terminated string). Thus, we had to use SoftIce's indirection operator (it's the * character, same as C language, see Chapter 8. For example, the command:

D *(esp+8)

means, "show in data window, the location pointed to by the content of esp+8". Since, this is a very common operation, SoftIce had a shorthand for it: esp->8. Allright then, now we can set the breakpoint such as this:

BPX getwindowtexta DO "D esp->8;"

And when we hit F12, we return to the caller and the text we entered will sit nicely at the top of the data window, waiting for us to set up a BPR with it :) Why don't we do a return to the caller automatically? Well, in my case, the screen flashes, and I hate it. But, if you want to try, you can set the breakpoint as:

BPX getwindowtexta DO "D esp->8;P RET;"

Now, let's take a look at GetDlgItemTexta. It is declared as:

UINT GetDlgItemText( HWND hDlg, int nIDDlgItem, LPTSTR lpString, int nMaxCount );

The only difference is nIDDlgItem, which is the ID of the control to get the text from. The stack will look like this:
...
[ESP+10h] - nMaxCount
[ESP+0Ch] - lpString << here it is
[ESP+08h] - nIDDlgItem
[ESP+04h] - hwnd
[ESP+00h] - return EIP

And the breakpoint to set (I had a feeling that you already find out ;)

BPX getdlgitemtexta DO "D esp->C;"
___________________

His breakpoints do not have the "\"s shown in your first example and maybe that is the problem. try

MARCO ANY = "BPX getwindowtexta DO "D esp->8;P RET;" "

Hope that works.

Js wrote, before he gave up, that your second example has single quotes instead of double quotes around "D esp->8;P RET;"

I've unchecked smilies, I don't know why they are showing up.

Regards.
Viper
12-24-2001, 03:00 PM
Originally posted by Js
I give up, seven times I logged in and still getting "you are not logged in"

i tried the way u put and it froze my comp had to log off thanks for replying thoughu too JMI thanks
Viper
12-24-2001, 04:14 PM
Originally posted by JMI
BPX getwindowtexta DO "D esp->8;P RET;" well the above works if you just type it in SI and MARCO ANY = "BPX getwindowtexta DO "D esp->8;P RET;" " just dont work at all every time i try it and I restart it deletes the macro-body if i try to enter it in SI i get a unterminated macro body or something like that

BTW JMI i have seen that example u showded i took a look at it just b4 posting here i also looked at the SI manual it says to use those maby i'm to close to the problem to see the answer.
here is what the manual said
If you need to embed a literal quote character (") or a percent sign (%) within the macro body, precede the character with a backslash character (\). To specify a literal backslash character, use two consecutive backslashes (\\).

this is what my current macro settings look liike
MACRO dlg="bpx getdlgitemtexta do \"d esp->c;pret;\""
MACRO win="bpx getwindowtexta do \"d esp->8;pret;\""

previous
MACRO dlg="bpx getdlgitemtexta do "d esp->c;pret;""
MACRO win="bpx getwindowtexta do "d esp->8;pret;""

this is where it just erased the whole body :mad:
Viper
12-24-2001, 04:21 PM
:) OH Yea thanks for the reply JMI
JMI
12-24-2001, 04:44 PM
Viper:

I rechecked the Command Reference for Softice and found the following:

The macro-body parameter must be embedded between beginning and ending quotation marks (“). The macro-body is made up of a collection of existing SoftICE commands, or defined macros, separated by semi-colons. Each command may contain appropriate ‘literal’ parameters, or can use the form %<parameter#>, where parameter# must be between 1 and 8.
When the macro is executed from the command line, any parameter references will expand into the macro-body from the parameters specified when the command was executed. If you
need to embed a literal quote character (”) or a percent sign (%) within the macro body precede the character with a backslash character (\). Because the backslash character is used for
escape sequences, to specify a literal backslash character, use two consecutive backslashes (\\). The final command within the macro-body does not need to be terminated by a semi-colon.
____________
In both your original examples, the final "P RET" has a ";" after it So do your other MACRO examples. This may be the problem. Having re-read the Reference, I recall why "\"s are used.

Looks like

MARCO any = "BPX getwindowtexta DO \"D esp->8;P RET\" "

should work.

Good Luck.
Viper
12-24-2001, 05:55 PM
well almost :D
the "BPX getwindowtexta DO \"D esp->8 part of MARCO any = "BPX getwindowtexta DO \"D esp->8;P RET\" " works fine now the only thing i cant get now is the pret
guess ill have to use the good ole f12 unless anybody has a better idea

Thanks for the help on this JMI


Size of Delphi exes..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Size of Delphi exes..
PDA

View Full Version : Size of Delphi exes..

riPPadoGG
12-24-2001, 03:26 PM
HI ALL,

I have just learned Delphi..
but,
1. I found that a simple "hello world" app has 300k+ (in Delphi 5 default compiler settings). Can I reduce this? I wish I could use Delphi for key-genning.. (Currently I use Borland C++ or masm32 if code is rippable)

2.Does delphi has any external dll dependencies?(such as msvbvm for VB. I have seen Delphi control moving to vcl5.dll while tracing Delphi apps)

regards
doGG

IN ANY CASE CHEERS TO BORLAND..
stealthFIGHTER
12-24-2001, 06:34 PM
Hello riPPadoGG,

I use D3. My compiled "hello world" program has < 200 kB. But when I want to make a small application (kg/patch), I don't use VCL. I code in non-VCL. After compilation the EXE size is +- 50 kB (uses Windows, Messages, SysUtils;). And this file contains: 14 kB bitmap file and 1 kB icon file. So after packing my final program has about 30 kB.

sF
Solomon
12-24-2001, 09:01 PM
hi riPPadoGG,

For small exes, I suggest you try KOL(http://gregor.mastak.ru/~kol/). It's a good partial alternative of VCL.

yes VCL(VCL*.DLL) can be dynamically linked to your exe or statically linked.
NikDH
12-29-2001, 06:13 AM
Originally posted by riPPadoGG
HI ALL,

...(Currently I use Borland C++ or masm32 if code is rippable)

2.Does delphi has any external dll dependencies?(such as msvbvm for VB. I have seen Delphi control moving to vcl5.dll while tracing Delphi apps)

But if i'm right even Borland C++ builder has external dll dipendencies too
Is it right ?

See ya
NikDH
riPPadoGG
01-01-2002, 02:22 AM
Hi All...
I was on vacation to a beautiful place...Sorry for the delay...

Being a complete newbie towards Delphi...
How can I compile without VCL??

If I can make 50k Delphi keygens(unpacked), then it is COOOOL..

Btw, my Delphi version is 5..
regards and many thanks..

doGG
NikDH
01-01-2002, 06:44 PM
Originally posted by riPPadoGG
Hi All...
I was on vacation to a beautiful place...Sorry for the delay...

Being a complete newbie towards Delphi...
How can I compile without VCL??

If I can make 50k Delphi keygens(unpacked), then it is COOOOL..

Btw, my Delphi version is 5..
regards and many thanks..

doGG

Thats what i was saying before about Borland products way of working:
both C++ builder and Delphi have external dependencies
If u wanna have 50k keygens unpacked u've to pay the price
to have external vcl files installed on that pc
and thats an higher price than the mfc external dipendencies ones coz these last files r into the standard installation of
M$ Windows

See ya
NikDH
stealthFIGHTER
01-01-2002, 07:42 PM
Originally posted by NikDH

Thats what i was saying before about Borland products way of working:
both C++ builder and Delphi have external dependencies
If u wanna have 50k keygens unpacked u've to pay the price
to have external vcl files installed on that pc
and thats an higher price than the mfc external dipendencies ones coz these last files r into the standard installation of
M$ Windows

See ya
NikDH

Hmm, I don't think you have to install some vcl files.
I've compiled 20 kB Delphi project under Win98 and then I used it under Win2000 - no problem (I have no special vcl files installed under Win2000).

sF
NikDH
01-01-2002, 08:34 PM
Originally posted by stealthFIGHTER

Hmm, I don't think you have to install some vcl files.
I've compiled 20 kB Delphi project under Win98 and then I used it under Win2000 - no problem (I have no special vcl files installed under Win2000).

sF

Well i'm not very expert with delphi but i sometimes use Borland
C++ Builder and it requires its external dependencies 4 sure
Well i think its quite strange 20kB delphi code works well without its vcl but have u checked if on win2k machine there r some vcl files coz u've said there r no special vcl files but what does special mean?

See ya
NikDH
zacdac
01-01-2002, 08:40 PM
G'day

Delphi uses standard libraries built by Borland which are complied with the executable when it is built.

The forms library is rather large and accounts for a large percentabe of the 300k hello world example.

Search for delphi examples using the win32 api calls for forms instead of the standard delphi forms library.

The win32 api can be a large learning curve but using it instead will mean the same hello world executable comes down from 300k to 10k.

Zac Dac
stealthFIGHTER
01-01-2002, 09:13 PM
Originally posted by NikDH

Well i'm not very expert with delphi but i sometimes use Borland
C++ Builder and it requires its external dependencies 4 sure
Well i think its quite strange 20kB delphi code works well without its vcl but have u checked if on win2k machine there r some vcl files coz u've said there r no special vcl files but what does special mean?

See ya
NikDH

Yeah, I have "clear" installation of Win2000 - no sw installed! And the little app still works!

Here is little example of non-VCL (WinAPI) application (it is quite big, because it contains a bmp logo [14 kB] and an icon [11 kB] and it is compiled with D6 :)).

sF
riPPadoGG
01-02-2002, 07:23 AM
Hi SF..
Me TOTAL NEWBIEE..(in Delphi...) ie You are talking above me head..
What is the difference between VCL and non-VCL??
Can I have a piece of that source-code???
:)
regards
doGG
zacdac
01-02-2002, 07:49 AM
Try this link...

h**p://www.delphi-resource.com/articles/raw_api.shtml

Zac Dac
Idcrisis
01-11-2002, 07:04 AM
riPPadoGG,

Go to Project->Options->Packages and check the "Build with runtime packages" option.

You resultant exe will be then around 15K in size!

The runtime stuff to be given with the exe with be somethings like rtl50.bpl and vcl50.bpl.

These are somewhat like (in principle) msvcrt*.dll, msvbvm*.dll etc.

This single fact alone is the reason why so many ignorant people should stop saying Delphi and VB in the same breath and claim foolishly that both are RADs which produce bloated code. VB is not even flea on Delphi's back when it comes to RAD. VC++ is not one when it comes to optimised code.

Delphi and Builder and BC++ use the same compiler, different parsers, the compiler being superlative in its optimization, and jesus heals :o
riPPadoGG
01-11-2002, 09:30 AM
Hi..
This is a late reply..
Thank you all.. The link was really helpfull.
I might finally code my next key-gen in Delphi... I am planning to rip the code.. :)
regards and thanks to ALL.
HAVE A NICE TIME CRACKING...
doGG


Asprotect 1.4 !!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asprotect 1.4 !!!
PDA

View Full Version : Asprotect 1.4 !!!

+SplAj
12-24-2001, 05:39 PM
LOL got ur attention now :D

Is there a *new* aspr version or not ......

NEW API CLUSTER TRICK !!!!
==========================

JS sent me a new target but I was too bizee fuxin Bi-Tarts new Titty3 'kryptor' (pfff)
hey trannies yer shits r decrypted and sent to favorit store for ppl to d/l ;)

Back to this new trick :-

'Reg Organizer 1.2' from ChemTable Software

I rebuilt the exe with RV, slight prob with LENGTH of IAT auto-fetcher ? [001AE134 to
001AF0F4 is correct range, and NOT contiguous,ie lots of 00 padding between dll?], but could not see the usual API 'cluster' just as JS
mentioned ??? so, lets run.. duh no way, stack is corrupted ? But I missed the dummy
1st dip into real code at 419350 to set memory variables, then back to aspr then onto
401000 OEiP. So I redumped at 419350, set OEiP to this and patched JMP 401000 at 419507.
Now runnin....NO ! got STACK corrupted still....that RET at 401256 and made exception ???

0167:00401214 803D586C5A0000 CMP BYTE PTR [005A6C58],00
0167:0040121B 7538 JNZ 00401255
0167:0040121D B8BC114000 MOV EAX,004011BC
0167:00401222 E8597B1000 CALL 00508D80
0167:00401227 A3FC575700 MOV [005757FC],EAX
0167:0040122C B8F0575700 MOV EAX,005757F0
0167:00401231 E84A7B1000 CALL 00508D80
0167:00401236 A300585700 MOV [00575800],EAX
0167:0040123B E888311700 CALL KERNEL32!GetModuleHandleA <==was is das???
0167:00401240 8B15446B5A00 MOV EDX,[005A6B44]
0167:00401246 8902 MOV [EDX],EAX
0167:00401248 8A4514 MOV AL,[EBP+14]
0167:0040124B 3401 XOR AL,01
0167:0040124D 8B15506B5A00 MOV EDX,[005A6B50]
0167:00401253 8802 MOV [EDX],AL
0167:00401255 5D POP EBP <== corrupts stack in regular code
0167:00401256 C3 RET

But tracing in ASPR returned GetCommandLineA in EAX *NOT* GetModuleHandleA ???:-

0167:00E2CA17 90 NOP
0167:00E2CA18 6A00 PUSH 00
0167:00E2CA1A E8597AFFFF CALL KERNEL32!GetModuleHandleA <==DUMMY API for IAT rebuilders !
0167:00E2CA1F FF355036E300 PUSH DWORD PTR [00E33650] <==GetCommandLineA API
0167:00E2CA25 58 POP EAX <==POP'd into EAX !!!
0167:00E2CA26 C3 RET <==in aspr OK, but STACK WRONG for us

See the GetModuleHandleA in EAX is discarded, EAX is pop'd with GetCommandLineA ptr !!!
So this is the *NEW* variant of the APICluster trick we all got used to for several months.

Similar tricks for the other GetWhatWeNeed API calls :-
eg GetVersion poked into [E33640]

0167:00E2C9D3 90 NOP
0167:00E2C9D4 6A00 PUSH 00
0167:00E2C9D6 E89D7AFFFF CALL KERNEL32!GetModuleHandleA <==DUMMY API for IAT rebuilders !
0167:00E2C9DB FF354036E300 PUSH DWORD PTR [00E33640] <==GetVersion API
0167:00E2C9E1 58 POP EAX <==POP'd into EAX !!!
0167:00E2C9E2 C3 RET <==in aspr OK, but STACK WRONG for us :(

Here are my findings for the Usual Suspects :-

[E33640] ==> GetVersion
[E33644] ==> GetCurrentProcess
[E33648] ==> GetModuleHandleA
[E3364C] ==> GetCurrentProcessId
[E33650] ==> GetCommandLineA

You have to change the RV/Imprec tracer in IAT rebuilding to the correct API *NOT* GetCommandLineA...........but woooa it's 1am 25/12/01 and I can hear sleigh bells... Santa is coming with my new notebook :D better get to bed or he won't deliver it.......

So, goodnight from him and goodnight from me ;)

PS sorry for the late response JS and thanks for the tip off .....

Spl/\j
endeavor
12-26-2001, 12:37 PM
Originally posted by +SplAj

There is a very fine line between “hobby” and “mental illness.”

..in my own way i find myself crossing that fine line all the time :cool:

..but in the meantime - happy holidays :)

endeavor
Viper
12-26-2001, 04:39 PM
Who don't like crossing that line more times then not? :D
evaluator
12-31-2001, 12:21 PM
Hello, SPLAJ!

Some interesting old-trick-enhansements added to this version,
I managed all... Prog runs from 401000, you did some wrong..
In attachment another NEW-YEAR GIFT - idata for ...
paste it at 1AE000h (5AE000), in values for peditor:
IT 001AE000
SIZE 00000134
+SplAj
12-31-2001, 05:49 PM
hi eval,

you chasin my ass again to become king unpaxor !!! good luck for 2002 :D

Spl/\j
sv
01-11-2002, 12:09 PM
Hi

I have 2 differences with eval's IT :(
First at 5ae3e4:
AS code is:
0167:0133CA38 55 PUSH EBP
0167:0133CA39 8BEC MOV EBP,ESP
0167:0133CA3B E8507AFFFF CALL KERNEL32!GetVersion
0167:0133CA40 5D POP EBP
0167:0133CA41 C20400 RET 0004
eval have GetVersion and i have found FreeResource
and at 5ae4f4, eval have justEvaluator and me LockResource.
others are same ;)

EIP is 401000 but call 419350 must be done before.

SV
evaluator
01-13-2002, 03:37 PM
For Spek resolved.txt


Dsa
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Dsa
PDA

View Full Version : Dsa

AdamA
12-25-2001, 06:06 AM
Hi,

has somebody tried to solve the DLP from Dictation Buddy(www.highcriteria.com)?
They use DSA-160 for serial checking.

merry xmas,
AdamA
goatass
12-25-2001, 11:54 AM
Have you tried reversing it? were you able to locate all the parameters for the DSA algorithm?

goatass
goatass
12-25-2001, 05:46 PM
I'm playing with the application now and I located where the real work happens.
Firs the application takes the username and using an array of characters it mangels the username and sends that to the SHA hashing algorithm and that is used to generate a signature and verify the one you entered.

The p,q,g, and y I found are a bit hard to tell which one is what. The shorter number is "q" since that is a factor of p-1 but I can't tell which one of the other number is p, g, and y.

Once I can figure out which number is which it wouldn't take too long to solve the DLP.

As a side note, when I put the p,y, or g into tE!'s RSA tool to check it's size it shows that it's not 160bit but 90bit, I don't know.

I'm gonna keep playing with it and see where I get to.

Some RVAs to check:

004121AA: call sub_411F10 --> calls everything below
00412062: call sub_411690 --> mangle username
00412071: call sub_410920 --> hash using SHA
00412081: call sub_411D90 --> verify signature
004436D1: jz loc_4437ED --> final flag check, nop out and you will be registered. Still need to find the checks when the application starts up.

goatass
tE!
12-25-2001, 06:33 PM
ArthaXerXes:
"DSA-160 should be no problem to forge. Try the p-rho method."

You use pollard-rho to solve a discrete logarithm, not to 'forge'
a signature. If it's possible to forge a signature there's no need
to solve the dedicated mathematical problem of the used
algorithm at all.

For last version of Dictation Buddy forging a signature was
possible infact. Now the author understood shit, but nevertheless
updated his routines to check for our previously found 'universal'
serial *g*

tE![TMG]
AdamA
12-26-2001, 06:08 AM
I found following params:
p=008943f7937bf9f769e6a1e3eb3248ecae1a350fa1
q=00d5f653b008a5314c0021
g=003990903a9d769a588a04adc26fbba81165dc5aef
y=002f5ab7d02eb0ce64d40107c7257846dcbb5bf93a

I tried it with p-rho, but after hours of calculation it ended with x=0 :confused:

AdamA
tE!
12-26-2001, 09:44 AM
ArthaXerXes:

The serial wasn't "AAAAAAAAAAAAAAAAAAAAA" but
4C4E.2622.2222.2222.2222.6626.SEF7.34S7.9XQP.

It has been found by one of our members, who has a bit more
of a clue about crypto than you.

If you would know wtf you're talking about you'd understand
that it is -necessary- to analyze the cryptographic scheme and
even to understand it before it is possible to *forge* a signature
without recovering the private key x.

Poor you if you think using (some probably 'borrowed') pollard
to solve the dlp is more 'l33t' whatsoever. Why is that ? Because
one has to copy/paste the parameters in a piece of source code
and wait some time for the calculations ? Or why ?

And go on labeling things that they meet your needs. Decreases
your reputation, but who gives a shit eh ? Main thing is you put
your ego in some safe place.

Looking forward to see the next great crypto-keygen of you.
Keep on the great work in that buizz, as you did in the past.

(lol)
tE!
12-26-2001, 10:01 AM
Oh, and for those of you reading this thread who really want
to solve this dlp...index calculus might work well in this case...
goatass
12-26-2001, 02:00 PM
tE! and ArthaXerXes you're both skilled guys and good people, this agressiveness towards each other is not necessary and the least constructive. Both AdamA and myself are trying to learn, we could use both your help and knowledge. I'm sure that goes for others that are reading this forum.

It is easy for you to say, "just solve the DLP" or "forging the signature is easy" but for us less knowledgeable individuals about crypto it would be highly appreciated if you could provide us with some explanation on how certain things are done.

ArthaXerXes: I also think that the numbers AdamA and I saw in the disassembly are incorrect because Q suppose to be a factor of P-1 and it's not and P is not even a real prime. Maybe I'm missing something but when I tried solving the DLP it took a couple hours and I got 0 at the end as well.

tE! mentioned using the index-calculus to try and solve it so I'm playing with it now to see if I can figure out how to do it.

goatass
goatass
12-26-2001, 02:38 PM
ArthaXerXes, yes you are right "p" is the prime but what I was saying is that the P that we found = 008943f7937bf9f769e6a1e3eb3248ecae1a350fa1
fails the primality test therefore is either a badly chosen prime by the author or is not the correct prime used in the DSA calulations in the program.

I'll give your routine a shot and see what I get.

goatass
tE!
12-26-2001, 03:45 PM
Oh, well. I've always been more or less aggressive. Guess what,
sometimes more, sometimes less :> Be lucky you don't have to
suffer me in real life. Hehe.

goatass: According to primality tests using trial division by small
primes and 90 iterations of Miller Rabin, the p you posted -is-
prime.

For your approach to solve things (also for the miracl/index.cpp
based source arthaxerxes posted)... check your 'long iter;'
parameter...i fear there will be an overflow error in your routines
which will end up in trash (after some hours of waiting)...

goatass, am i right you tried to solve this dlp using miracl/index.c
based source code ? you should get that x=0 result then after
approx. 11h (depending on your machine's speed o'course). if
you just going to extend range of "iter", i wish you all good luck
and lots of time...Hint: i wouldn't try this approach on a windows
machine, since it will most likely crash before you see any result :)

If anyone has a -good- implementation of index-calculus with a
fast relations finder, please contact me. I offer a fullblown 'Hello
World'-application in VB for exchange :P
goatass
12-26-2001, 04:03 PM
tE! you are correct in every one of the assumptions you made :)

Ok so how do we go about solving this thing when solving the DLP is not a good approach and I can't seem to find any good index-calculus implementation.

Would forging the signature be feasable here?

p.s. see your response to my post was nice and non-aggressive, I knew you could do it :)

goatass
goatass
01-13-2002, 11:37 AM
So AdamA did you ever manage to make a keygen or something for this application?

goatass
AdamA
01-14-2002, 03:52 AM
Hi goatass,

its not possible to write a keygen without the private key.
But you can try to keygen Total Recorder, it is DSA-80, not so hard like Dictation Buddy.

AdamA


defeating frogsice help please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > defeating frogsice help please
PDA

View Full Version : defeating frogsice help please

daze666
12-25-2001, 08:29 AM
Hi,

As I'm always in search of reversing knowledge, I tried to reverse frogsice yesterday. I wrote a little program that installed a SEH handler, put 'BCHK' in EBP, so that Frogsice would detect it.

In earlier versions of frogsice (v.40), frogsice would install a int 3 hook, by calling Hook_V86_Int_Chain with eax=3. If an application would call INT 3, it would call the frogsice handler, which would check for EBP=BCHK and if so, it could replace the original INT 3 opcode with a division by zero, so the original SEH handler would still be called.

However, In the latest version of Frogsice (v1.0 and higher), the Hook_V86_Int_Chain is called only once, and eax is not 3, so it doesn't install a int3 hook chain anymore. Also, it doesn't replace the original int 3 instruction anymore, but the original SEH handler is still called !?!?! I tried to intercept the int 20 calls, so I would see which VMM call would be used to accomplish the int 3 hook. The only suspicious call is 'Install_Exception_Handler, but I found it had nothing to do with the int 3 hooking. I am clueless now. Does anybody know how Frogsice checks for int 3 SEH's ? Any information would be greatly appreciated ! Thanks,

Daze
BTW, no , I'm not a commercial protection writer, just a newbie/medium cracker in search of knowledge :-)
daze666
12-27-2001, 02:30 PM
I already thought that a delicate subject like 'hacking frogsice', THE utility of OUR community :-) would not get too much response :-) Anway, I spend some quality time reversing frogsice the last days and learned a lot. For example, I thought that the only way to hook an intterupt was to call the Hook_V86_Int_Chain, never knew you could do it "manually" :-) Anway, found out a lot, but I think that a lot of ppl would not like me to make the life of protectionists easier, so I won't discuss it here :-) Keep up the good work,
Daze
Snatch
12-28-2001, 03:12 AM
Yes and the people who do not want that are the lamers in these large cracking groups that just want to have it easy. The rest of us are in this as a learning experience and dont want to make trivial cracks. Please do describe what you learned. Share the knowledge. Better protections is what the cracking community is all about.

Snatch
Kayaker
12-28-2001, 04:10 AM
Originally posted by Snatch
Yes and the people who do not want that are the lamers in these large cracking groups that just want to have it easy. The rest of us are in this as a learning experience and dont want to make trivial cracks. Please do describe what you learned. Share the knowledge. Better protections is what the cracking community is all about.

Snatch

Hi,

I can't help but echo that sentiment, let alone that learning more about hooking interrupts would be very interesting. At your own discretion Daze666.

Regards,
Kayaker
daze666
12-28-2001, 12:06 PM
Hi Snatch & Kayaker,

I agree with you, but there are some points of concern here. Let's say that +Frogs released a tutorial with a few ways to detect his own frogsice. This tutorial would be about detection tricks that he could not find a solution for (otherwise he would have implemented it :-). Stupid commercial protectionists could then simply copy & paste the code and charge tons of money for their protections (I already saw a 'VB plugin' which would return a simple 'TRUE' or 'FALSE' for softice detection. Completely useless protection, but the coder charges $65 for it !!! Now, I think it would be a bad thing if these stupid ppl could simply copy & paste some code to make a GOOD protection, without ANY effort (only the effort of the cracker, for giving the protectionists the information, the protections wouldn't even have to understand the detection routines, just copy and paste it).

I spend a lot of time reversing Frogsice the lasts days and learned a lot about Ring0, VxD programming and the VMM. I found 2 ways to detect Frogsice (well, actually 3, but one is not completely bullet proof). As said, I don't think it's a good thing to take stupid protectionists to a higher level, so I won't post them here (don't bother asking). However, as I came here to ask for information about the Frogsice Interrupt hooking in the first place, I can't deny you my findings on this subject.

This is not some 'completely new' information, there is a lot about it on the internet. It was new for me though :-) Ok, this is how Frogsice hooks intterupts:

sidt IDT_address ;store the IDT at mem location 'IDT_adress'
mov ebx, offset IDT_address+2
mov ebx, [ebx]
add ebx,24 ;interrupt number * 8 bytes, int 3 in this example, so ebx points to the int3 info now

MOV DX,[EBX+06] ;get first part of the old int 3 hook procedure
SHL EDX,10h
MOV DX,[EBX] ;get second part
mov eax, offset Save_adres ;See below
add eax,1
mov [eax], edx ;save old int 3 address

mov eax, offset I3hook ;pointer to new int 3 procedure
cli ;Let CPU ignore maskable external interrupts, before installing new interrupt
MOV [EBX],AX ;save it to IDT
SHR EAX,10h
MOV [EBX+06],AX ;save second part to IDT
STI ;Let CPU respond to interrupts again

I3hook is the address of the new int 3 hook procedure (the one Frogsice installs). The old Int 3 procedure address (pointing to Softice if it's running, or to the VMM if it's not) is saved and pushed upon exit of the frogsice int 3 hook procedure and followed by a ret. The frogsice int3 procedure looks as follows (before it is installed)

Frogsint3_proc_begin
....
cmp {did user check the 'int 3 hook option}
jne save_adres
.....
.....
cmp firsttime, 0
jne execute_Org_Int3
......
.......
push 00000000 <-replaced by original INT 5 hook
ret
....
Save_adres:
push 00000000 <- replaced by previous INT 3 hook (softice or VMM)
ret
Execute_Org_Int3:
......
push 00000000 <- replaced by VMM INT 3 hook
ret

So, as you see, the 'push 000000' is overwritten with the old int hook addresses, by code like the
mov [eax], edx instruction in the procedure above, so after executing this new hook procedure, it always returns to the previous procedure. Well, not always :-) If you check the 'Hook int 3' option in Frogsice, frogsice will NOT return to the previous hook procedure, but will chain to the previous INT 5 hook (Frogsice also hooks a new procedure to INT 5, so this one chains to the 'previous' INT 5). After that, the same code is executed again, but this time the hook chains to the VMM INT 3 hook
This is used to 'defeat' the 'BCHK' detection. Softice will not see the 'BCHK' value, because int 3 is simply not passed to softice anymore !! This explains why the 'i3here = true in softice doesn't break anymore and why your program crashes if you set a bpx in softice (softice puts a 'CC' on your breakpoint adress, but since softice doesn't handle the INT3 anymore, your original code isn't restored over the 'CC' code again and your program will crash because of this mangled code)

That's it, I won't say no more :-) If you want to know more, reverse it yourself and study a lot of Ring0/VxD info/sources/tutorials (there are not too many good ones though, ironically one of the better ones is the Frogisce v.40 sourcecode :-)
A last hint though, to make reversing frogsice easier: frogsice encrypts itself in memory, to prevent detection. It decrypts before execution and then encrypts right after. This is done by a simple XOR (at least in version 108_9). For reversing purposes, it's a pain in the ass, so just remove it. In version 108_9, win98 version, nop the following 4 bytes:
00007037: 90 30
00007038: 90 02
00007647: 90 30
00007648: 90 06
Have Phun,

Daze
Snatch
12-30-2001, 11:18 PM
Thanks for the information. I have actually been quite interested in softice protections and how to defeat them and how to build them stronger. As for your comment, frog may not know how to defeat certain tricks if he releases all his information. Protectionists get better. Big deal. The fact of the matter is that there is no such thing as an unbeatable protection only ones that take time. Of course with web checks nowadays you can call those unbeatable as with cd keys and such but thats a seperate subject and those checks can only be beaten by hacking the server you wish to target. That is a different field though. And what we are discussing here is still reversable no matter what :). But it is at your disgresion because as you said if you want to figure out just reverse frogsice yourself it is a project but one you will probably learn some invaluable information from.

Snatch
Clandestiny
01-02-2002, 07:37 PM
Hiya Daze,

Good job reversing! Intriguing thread... Many thanks for taking the time to share what you learned. That was a very lucid explanation and quite good timing ;) since I'm needing to hook an interrupt in SI myself for the project Kayaker and I have been working on. I've never worked with the IDT before either, but I think I've now got a good place to start.

Best Regards :)
Clandestiny
daze666
01-03-2002, 12:37 PM
Good to see that the info was useful to you guys.

Clandestiny, I'm also working on a project that involves interrupt hooking in SI, that's why I wanted to figure out how frogsice works. Also, check out the sourcecode from icedump (distributed in the zip file), it contains some valuable info !

Remember that reading the IDT in windows 9x/ME is possible from Ring3 in your program, no need to write a VxD. NT/2000/XP are a little bit better protected. If you want to write/read the IDT in NT/2000/XP, you HAVE to write a KMD and there's VERY little info about this subject on the internet. There's a example source by ElicZ and one by Y0da (check out their websites) that got me started... If you have any questions or want to share info about our projects, feel free to contact me...
/edit
it IS possible to read the IDT in NT/XP without writing a KMD, I found a cool piece of code by EliCz that proves it :-)
/edit

Daze


Merry Xmas & Happy New Year
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Merry Xmas & Happy New Year
PDA

View Full Version : Merry Xmas & Happy New Year

cah
12-25-2001, 10:10 AM
To,
All RCE Group of Reverse Engineers,

Merry Xmas & Happy New Year
cah...
Viper
12-25-2001, 10:21 AM
Right back at ya ;)


crackme time-crippled
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > crackme time-crippled
PDA

View Full Version : crackme time-crippled

eDu
12-26-2001, 06:49 AM
At first I hope all of you have had a very good Xmas.

I'd like to know if somebody knows where can I get a crackme

that is time-crippled, that works for some minutes, then closes

the application with or without a nag screen, (wrote in C++ would

be better).

Thanks for some helps.
:)


Help on Windows MS Installer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help on Windows MS Installer
PDA

View Full Version : Help on Windows MS Installer

cah
12-26-2001, 09:48 AM
How to Unpack MS Installer? Any unpacker/utils available for msi?
Help on this apprecaited.
Thanx in advance
cah...
_Servil_
12-26-2001, 11:14 AM
cah you mean the .msi files i suppose....

i'm using FAR manager with archive support and ut§s handles as .DOC (office) file

no prob to extract...
cah
12-26-2001, 11:37 AM
Hi,
yes, I want to unpack *.msi file. Where to find this FAR Manager? Can you give exact URLor location?

cah...
_Servil_
12-26-2001, 05:00 PM
you can d/l FAR eg. from this URL:
h**p://www.uic.nnov.ru/~ruiv/plugring/cgi-bin/downld.cgi?Lang=Eng

probably then you'll need to look there for additional plugin handling MSoffice fotrmat, since i'm using tons of pluigins and lost overview over them a long time ago ;)) i'm not sure now which one is that, it might be something like "Text Converter", i'm not sure at this time, you can try find it htere..
MH2K
12-27-2001, 10:29 AM
This is probably the right plugin

h**p://w*w.uic.nnov.ru/~ruiv/plugring/downld/files/fdb101.zip
_Servil_
12-27-2001, 03:55 PM
"DocFile Viewer"


Softice problem.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice problem.
PDA

View Full Version : Softice problem.

hobgoblin
12-26-2001, 02:08 PM
Greetings,
I have a small problem. I have installed Driverstudio 2.6. I have modified the winice.dat so exp= points to where it is supposed to do. I have in the settings menu of the softice loader hooked the little box saying the program shall break at program start (winmain...). But still the program starts without the loader stopping the execution at the beginning of the code. I have never had any difficulties before, but I have then run on WinME and Win98. I have not until now used Win2ooo or WinXP. (I'm running XP now). I can't find any refererences to this problem in the guides either. So if someone have some good ideas, I'll be grateful.
TIA and regards from
hobgoblin
Snatch
12-27-2001, 02:48 AM
Can you give some examples of the many tools that do this I wasnt aware. Also if you want to break at the begining and worst comes to worst you could just edit the file manually and put an int3 at the entry point and change that byte back after it breaks. That would seem to work.

Snatch
hobgoblin
12-27-2001, 11:12 AM
Thanks for the input.
But this isn't something that happens only to one specific program. It happens no matter what program I try to run via the loader.
Have somebody else encountered the same problem?
UrgeOverKill
12-27-2001, 12:33 PM
Hi Hobgoblin,

I installed 2.6 on my system and haven't encountered anything like that. I have a new P4, but everything works ok for me.
hobgoblin
12-27-2001, 01:51 PM
Did you install Softice only or did you install the whole package?
regards,
UrgeOverKill
12-28-2001, 09:42 AM
I installed the whole package.......


rsa
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > rsa
PDA

View Full Version : rsa

ZaiRoN
12-26-2001, 04:17 PM
hi,
i want to learn something about rsa crypto.
after some readings i'm looking for a program that use rsa.
any hint?

thanks in advance...

ZaiRoN
bart
12-28-2001, 11:10 AM
Checkout Access Lock 1.5, 280bit key, this was my 2nd RSA app,
there are bunch of fakes so watch out :)

h**p://www.softheap.com/lock.html

bart


"Magic Card"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > "Magic Card"
PDA

View Full Version : "Magic Card"

Bengaly
12-27-2001, 02:27 AM
hi guys, and merry xmas to u all,
i would like to ask u if someone ever Cracked the so protection called "Magic Card" - this annoying little thihng that will will reSet ur computer every time u reboot it, this can be found in Unis/cooleges etc..
this thing is boot up before windows,
probably it can be deactivated via bios? anyone :P
cya next yeay :)


W32DASM shows n0thinq
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > W32DASM shows n0thinq
PDA

View Full Version : W32DASM shows n0thinq

ON'error
12-27-2001, 06:41 AM
hi,
is a file packed when my disassembler doesnt show any code?
and how can i know how it is packed? its a crackme from ZeroCoder.
ZaiRoN
12-27-2001, 07:31 AM
hi,

is a file packed when my disassembler doesnt show any code?
maybe;)

and how can i know how it is packed?
you can do it manually looking for the sections name...if you find a section called ' Upx' then the file is almost certainly packed with upx.
you can also do it using some tools like gettype or something else.

its a crackme from ZeroCoder.
post the link in the miniproject area;)

byebye,
ZaiRoN


Driverstudio 2.6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driverstudio 2.6
PDA

View Full Version : Driverstudio 2.6

octapus
12-27-2001, 11:41 AM
Could you tell the warez group that released DriverStudio 2.6? Or would that be against the regulations set by the messageboard administration.
That is because i can't find any warez refering to this recent version you are saying that came out in the open.
Snatch
12-27-2001, 02:20 PM
I know that CORE released the keygen. The release I first obtained did not have any nfo or diz files in it so I am not sure. It also included a sn.txt which one serial. Rumor had it that CORE released the whole thing with the keygen which I think they did but this other release is a little more mysterious could just be a CORE release that someone found a single serial for and repackaged.

Snatch


IDA unload\remove binary from database
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IDA unload\remove binary from database
PDA

View Full Version : IDA unload\remove binary from database

Calento
12-27-2001, 01:21 PM
I was using IDA to reverse some program and i did
File->Load file->Additional binary file
IDA seemed to append the data from the file to the end of the
database with a header.
Now my problem is i don't want this added file on my database
and i don't know how to remove it:(
If this was some text editor i could simply remove it but IDA
doesn't let me and the database seems to be in binary format.
The patch feature only lets me change and not remove (and only a
few bytes at a time?).

The thing is i don't want some extra non needed data on my
database just to take up my windows scroll and take up memory.
I already added comments to my database so i can't just
disassemble it again without loosing my comments.

Anyone have any idea how to remove it? or maybe how to get all
my comments from it to put on a new database?


Packer identifyer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Packer identifyer
PDA

View Full Version : Packer identifyer

n03l
12-27-2001, 01:45 PM
Hi all, I have a small program that is packed with somekind of packer. I have tryed some unpacker's, but up till now no luck.

Is there a tool to let me know what type of packer is used?

n03l.
Viper
12-27-2001, 02:38 PM
yea a file anlyzer
stealthFIGHTER
12-27-2001, 05:09 PM
Originally posted by n03l
Hi all, I have a small program that is packed with somekind of packer. I have tryed some unpacker's, but up till now no luck.

Is there a tool to let me know what type of packer is used?

n03l.

Um, read the attachment.

sF
_Servil_
12-27-2001, 07:42 PM
PE iDentifier 0.7 Beta by snaker & Qwerton
------------------------------------------

PEiD detects most common packers, cryptors and compilers for PE files. It can currently detect around 260 different signatures in PE files.

PEiD is special in some aspects when compared to other identifiers already out there!

1. It has a superb GUI and the interface is really intuitive and simple.
2. Detection rates are amongst the best given by any other identifier.
3. Special scanning modes for *advanced* detections of modified and unknown files.
4. Shell integration, Commandline support, Always on top and Drag'n'Drop capabilities.

There are 3 different and unique scanning modes in PEiD.

The *Default Method* scans the PE files at their Entry Point for all documented signatures. This is what all other identifiers also do.

The *Hardcore Method 1* scans the PE file's Entry Point containing section for all the documented signatures. This ensures detection of around 80% of modified and scrambled files.

The *Hardcore Method 2* does a complete scan of the entire PE file for the documented signatures. You should use this mode as a last option as the small signatures often tend to occur a lot in many files and so erroneous ouputs may result.

The scanners inbuilt scanning techniques has error control methods which ensure generally correct outputs even if the last mode is chosen. The first two methods produce almost instantaneous outputs but the last method is a bit slow due to obvious reasons!

We intend to update the signatures quite often to keep pace with this ever involving scene :)
Please report all bugs and ideas to Qwerton -> qwaci@gmx.net
Please report new signatures or packer info to snaker -> snaker@myrealbox.com

ALL SUGGESTIONS, IDEAS, BUG REPORTS AND CRITICS ARE WELCOME.

Greets
------

Qwerton, CHRiST0PH, uno, DAEMON, VAG, SAC, Gamumba, SnowP and all the rest at UG, Michael Hering, tE!, pusher, CoDE, BaND, Snacker, MackT, skamer, Clansman, innuendo, dshadow, cokine, AiRW0lF and all the rest at EMB, Carpathia, LordofLA, r!sc, NoodleSPA, SiR_dReaM, CHoRDLeSS, JaCK, p0tHEAD, XasX and all at TNT! and all who helped with PEiD :)

snaker, cokine, Iczelion, Clansman, Z-Wing, Unknown One/TMG, PeeWee, DnNuke, sinny/BAFH, all the other nice people in CiA, UG2001 and all of you who helped us develope PEiD. Thanks!

snaker & Qwerton Productions
-2001-
Viper
12-27-2001, 07:54 PM
PE iDentifier 0.7 Beta is good
i suggest u try file insPEctor XL i think its a little better
peterg70
12-27-2001, 09:45 PM
Sounds Like an advertisement ??
Viper
12-27-2001, 09:59 PM
if im not mistaken the post by _Servil_ was mostly taken outof the txt file that comes with PE iDentifier
npcracker
12-28-2001, 12:37 AM
I have got chance to read the tut by Splaj on packed exe. And he had explained so nicely with the packed notepad.exe. But how come he know that predictable number of byte in ASpack Petite and other.

if i found a new software that is packed with new packing software, may i able to know the predictable byte of that code as done by splaj.

You can find splaj tutorial in the thread called
SPLAJ TUTORIAL in newbies area.
GeneralD
12-30-2001, 07:25 AM
Hi , npcracker.

I`ve got v. good pack-analyzer.
If you want it, mail me (it`s about 500Kb)

I`m sure that it will tell you what is programm packed with.

If not, try Hackers View , `cause most of authors of packers leave info in packed file :))

Best regards
GeneralD

mailto generald@poczta.onet.pl
npcracker
12-31-2001, 10:35 PM
Hi GenaralD

thank u for ur unpacker.

npcracker
riPPadoGG
01-01-2002, 03:14 AM
Hi..

1.Any working link to insPEctor XL
2.Any file analyzer that supports other Windows exe types such as NE?? - too much to ask??;)

regards
doGG
ThrawN
01-01-2002, 04:20 AM
UN PACK does i think. Correct me if i am wrong though

http://www.programmerstools.org/files/unpackers/un-pack.zip
Viper
01-01-2002, 07:01 AM
hey riPPadoGG,

h**p://www.exetools.com is the link i got it from

ThrawN, so there are no attacks on the forum from people who might want to see it closed
please take a look at this
http://www.woodmann.net/forum/showthread.php?s=&threadid=2312

especially the post by |BoomBox- and DakienDX
ThrawN
01-01-2002, 08:31 AM
Ok dokie sorry bout that

=)


IAT help please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IAT help please
PDA

View Full Version : IAT help please

LaptoniC
12-27-2001, 05:18 PM
I am little bit confues about IAT.I am working on one program whichs kernel32.dll import is crypted.However I see kernel32.dll its name and stuff in IAT but there is no kernel32.dll entry on import table even invalid one.I know how to decrypt them decryptin is not problem but I want to learn that if I can fix this import table without attaching mine.I want to learn whether IAT is destructed or not.Thanks.
CoDe_InSiDe
12-28-2001, 02:12 AM
Hi LaptoniC,

Yes the Import Table only consists of the User32.dll Entry.

BUT... the Import Table starts at 00007548 (Virtual/Raw Offset doesn't matter in this case ;) ) look a little further down at Offset 00007574.
You'll see there these 4 Dwords:

7B8AFFFF = NOT this value and you'll get the RVA to the ILT for Kernel32.
FF8FFFFF = NOT this value and you'll get the RVA to the IAT for Kernel32.
04790000 = RVA to the name "Kernel32.dll"
FFFFFFFF = NOT this value and you'll get 00000000 hehe :D

See?
Now you can easily rebuild the Import Table, but i don't know if it's everytime with the same amount of Bytes behind the Import Table...?
Hmmm, ah well.... just Decrypt the API Names and make a new "Kernel32.dll" Entry behind the "User32.dll" Entry with these 4 Dwords (actually 3 Dwords since the last one is 00000000 ;) )

Hope this helps a bit.

Cya...

CoDe_InSiDe
LaptoniC
12-28-2001, 05:22 PM
Hi thanks for your response I know how to decrypt the name of functions here is decrypt function

decryptimport proc near ; CODE XREF: sub_40D488+Bp
CODE:00402A70 imul edx, ds:Key, 8088405h
CODE:00402A7A inc edx
CODE:00402A7B mov ds:Key, edx
CODE:00402A81 mul edx
CODE:00402A83 mov eax, edx
CODE:00402A85 retn
CODE:00402A85 decryptimport endp

at first Key is the RVA of Kernel32.dll name.What I want to learn is i it possible to make valid import by taking NOT of dwords you said.Is kernel32.dll importslie in Import table or should I made new one ? I am little bit confused about and I saw today that I unpack without understanding some basic things :rolleyes:
CoDe_InSiDe
12-29-2001, 02:15 AM
Hi LaptoniC,

Ofcourse it's possible to make a valid Import for Kernel32 because you got the 3 important NOT Dwords.

The ILT (Import Lookup Table)
The IAT (Import Address Table)
And the RVA to the name, that's all you need ;)

The IAT and ILT are also present so you don't have to create those.
The only thing you need to do is to Decrypt those API Names and make a new Kernel32.dll Entry behind the existing User32.dll Entry.
So the Kernel32.dll Entry looks like this:

84750000 00000000 00000000 04790000 00700000

Place it behind the User32.dll Entry and Decrypt the API names then it should work ;)

Cya...

CoDe_InSiDe

P.S. i like to know if those NOT Dwords are at the same place behind the Import Table in other Protected and/or dumped files? :)
LaptoniC
12-29-2001, 08:52 AM
In the zip file I pasted the apinames could you show me how it can be possible.

I guess it is same for all protected exes.I am dealing with again CD-Cops :) .I did generic unpacker which works upto and including v2.04.However sometimes CD-Cops crypts kernel32.dll imports and patch exe in runtime to fill realimport names via decrypting the name of the function and then GetProcAddress.So after decryption decrypted exe doesnt work because of missing Kernel32.dll imports.
CoDe_InSiDe
12-30-2001, 06:42 AM
Hi LaptoniC,

I rebuilded the Kernel API names according to the Text file you included in the .zip :)
But i miss one API dunno which one it is ;)
But also no RVA in the ILT/IAT points to that 'missing" API, so uhm who cares... :D
I've attached the Rebuilded File and the file works, but i get an Message Box:

"Info"
"Could not find parent"

But i don't run a Window with a name like "Akademedia" hehe ;)
So check the file on how i did it.
Hope this helps.

Cya...

CoDe_InSiDe
LaptoniC
12-30-2001, 06:52 AM
Thanks for your help.This file will really help me :)


Newbie Crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Newbie Crackme
PDA

View Full Version : Newbie Crackme

Hoof Arted
12-28-2001, 07:13 AM
Hi all,

I came across this crackme and it interests me as it would make a very good storming session. The object of the crackme is to complete all 5 stages and keygen where required.

There is no file protection and it appears to have been coded in ASM. It would be nice if a few of us could get involved here and maybe a few of the more experienced guys could show us how to rip the algorythms from the file and use it in a keygen.???? A keygen could be programmed in any other language but it would be better to see how the algo is ripped.

I have already passed the first two stages (Without keygenning the first) and have come a bit stuck on the third, I will get there though. Have a look and see if you think it might be worth the effort.

Hoof
Hoof Arted
12-28-2001, 07:14 AM
Cannot get the file up, 3k to big.
Viper
12-28-2001, 08:39 AM
can u up to another sight and link it?
Hoof Arted
12-28-2001, 10:45 AM
Ok, here it is.

h**p://royalaxx.host.sk/files/tutorial/ra_crckm2-nob.zip

I think it is interesting anyway. Newbies will like it as it has several levels. The object, is to sniff and keygen as per the NFO.

Keen to hear some comments, especially on the 3rd stage.

Hoof
Viper
12-28-2001, 02:32 PM
when dled it comes back as a bad zip
ZaiRoN
12-28-2001, 03:15 PM
which browser are you using?
i had the same problem using opera.
strange but explorer work well...

ZaiRoN
Viper
12-28-2001, 03:39 PM
useing ie 6 here
finely now i got the file :D
Hoof Arted
12-29-2001, 11:24 AM
Stage 1

It would appear as though all the action happens here:

00403F57 . FF15 30F34300 CALL DWORD PTR DS:[<&USER32.GetDlgItemTe>; \GetDlgItemTextA
00403F5D . 8BF0 MOV ESI,EAX
00403F5F . 83FE 02 CMP ESI,2
00403F62 . 8935 40CA4300 MOV DWORD PTR DS:[43CA40],ESI
00403F68 . 0F8C 22010000 JL ra_crckm.00404090
00403F6E . 83FE 23 CMP ESI,23
00403F71 . 0F8F 19010000 JG ra_crckm.00404090
00403F77 . BA 01000000 MOV EDX,1
00403F7C . 33C9 XOR ECX,ECX
00403F7E . 85F6 TEST ESI,ESI
00403F80 . 8915 18794300 MOV DWORD PTR DS:[437918],EDX
00403F86 . 7E 40 JLE SHORT ra_crckm.00403FC8
00403F88 . BF 60C94300 MOV EDI,ra_crckm.0043C960 ;ASCII "Hoof Arted"
00403F8D . 4F DEC EDI
00403F8E > 83F9 12 CMP ECX,12
00403F91 . 7D 2F JGE SHORT ra_crckm.00403FC2
00403F93 . 69D2 7ED31252 IMUL EDX,EDX,5212D37E
00403F99 . 0FBE440F 01 MOVSX EAX,BYTE PTR DS:[EDI+ECX+1] ;Next chr to EAX
00403F9E . 41 INC ECX ;Next chr
00403F9F . C1FA 09 SAR EDX,9
00403FA2 . 81E2 80CFCFFF AND EDX,FFCFCF80
00403FA8 . 0FAFC2 IMUL EAX,EDX
00403FAB . 40 INC EAX
00403FAC . 35 9F9F0000 XOR EAX,9F9F
00403FB1 . C1C0 05 ROL EAX,5
00403FB4 . 0FAFC1 IMUL EAX,ECX
00403FB7 . 99 CDQ
00403FB8 . 33C2 XOR EAX,EDX
00403FBA . 2BC2 SUB EAX,EDX
00403FBC . 3BCE CMP ECX,ESI ;Reached end of Username ?
00403FBE . 8BD0 MOV EDX,EAX
00403FC0 .^7C CC JL SHORT ra_crckm.00403F8E ;Not, so go back to f8e

When the name is received, it cycles through one character at a time and does it little magic trick on the val of EAX. It then compares your HEX value of your entered serial with the Value in EAX. In my case, "Hoof Arted" = 72467A80 so I would need to enter the serial "1917221504" to pass Stage 1.

Now, following the little algo used above, it is quite easy to see what it is doing and you could probably sit and work it out with a calculator. Trying to code it is another thing. I will try work on a visual basic keygen (only language I know) the problem is that it cannot handle large numbers easily.

This is where the ripping of the algo comes in. It would be great to see a little tutorial on how the rip the asm and create a keygen. Any takers :D ?

Stage 2

Stage 2 is a "password" stage but the password is not hardcoded. You need to "beat" the algo. The action happens here:

00403CFA . FF15 2CF34300 CALL DWORD PTR DS:[<&USER32.GetDlgItemIn>; \GetDlgItemInt
00403D00 . 8BC8 MOV ECX,EAX
00403D02 . 81F9 78563412 CMP ECX,12345678
00403D08 . 890D 1C794300 MOV DWORD PTR DS:[43791C],ECX
00403D0E . 7D 1B JGE SHORT ra_crckm.00403D2B

Above we can see that our HEX val of our serial is tested for >= to 0x12345678. So we meet the first criteria by entering, as a password , "305419896". This then enables us to go to the next part of the checking routine.

00403D2B > B8 EFCB6672 MOV EAX,7266CBEF
00403D30 . 890D C0C84300 MOV DWORD PTR DS:[43C8C0],ECX
00403D36 . F7E9 IMUL ECX
00403D38 . 8BC2 MOV EAX,EDX
00403D3A . C1F8 14 SAR EAX,14
00403D3D . 8BD0 MOV EDX,EAX
00403D3F . C1EA 1F SHR EDX,1F
00403D42 . 03C2 ADD EAX,EDX
00403D44 . 25 452E0000 AND EAX,2E45
00403D49 . 03C1 ADD EAX,ECX
00403D4B . 35 15180000 XOR EAX,1815
00403D50 . 03C1 ADD EAX,ECX
00403D52 . 25 82790000 AND EAX,7982
00403D57 . 03C1 ADD EAX,ECX
00403D59 . 25 9A810000 AND EAX,819A
00403D5E . 03C1 ADD EAX,ECX
00403D60 . A3 CCC84300 MOV DWORD PTR DS:[43C8CC],EAX
00403D65 . 05 F07FFFFF ADD EAX,FFFF7FF0
00403D6A . 3BC1 CMP EAX,ECX (ECX = 12345678, EAX = 1233D700)

It stores a copy of our serial entered and proceeds to run a little algo. The end result is then compared to our serial again. This is quite a strange thing as how can what we enter be the same as the serial that has been changed? I sort of got this by chance. A bit of zen helped me I suppose but just check this out.

You enter serial 0x12345678 and the modified version is then 1233D700. No match there.

The difference between these two is 7F78. Dont know if it means anything but add it to your 0x12345678 and you get 0x1234D5F0. Convert to dec and enter it as a password and you will see EAX = 1234D5F0, ECX = 1234D6F0 ( Close).

The difference again is 0x0100. Add this to serial and you have your required password.

To complete stage 2, password is 305452784. Now, I am sure, due to the way the calculation is done, that there are possibly other passwords that would work. I have not checked. Any mathematic geniuses could give some input?

That is as far as I have gone. I will be working on the other stages when I can and will be trying to keygen the first stage. My source code will be attached. :p Dont care if you dont like VB.

Hoof
Rage9
12-29-2001, 02:11 PM
Well im on the case, post a keygen as soon as i get too it. Hoof Arted you should have put a warning or somthing i wana figure it out too!! but good job!

-Rage
Hoof Arted
12-29-2001, 02:27 PM
Rage, I thought about posting the info I have. This way, it is sort of a tutorial for those who know alot less then me but at the same time, generates interest in the remaining 3 tasks.

For those who are actually following this thread, it is in your best interest to look at all the data and see HOW it works, and not that it does work. I am very keen to see what other do with Stage 3 and onwards. :) . I will not post direct answers to the remaining tasks untill you guys have made some progress.

Have a good time.

Hoof
Rage9
12-29-2001, 02:49 PM
finished level one and read your comments, i would be more then happy to walk you guys through making an assembly keygen i did it for javilins, on to stage 2...

-Rage
Rage9
12-29-2001, 03:44 PM
level 2 is some odd sheet, but i think i can clear something up....

00403CFA . FF15 2CF34300 CALL DWORD PTR DS:[<&USER32.GetDlgItemIn>; \GetDlgItemInt
00403D00 . 8BC8 MOV ECX,EAX
00403D02 . 81F9 78563412 CMP ECX,12345678 ;your password has to be at LEAST that big in hex
00403D08 . 890D 1C794300 MOV DWORD PTR DS:[43791C],ECX
00403D0E . 7D 1B JGE SHORT ra_crckm.00403D2B

00403D2B > B8 EFCB6672 MOV EAX,7266CBEF
00403D30 . 890D C0C84300 MOV DWORD PTR DS:[43C8C0],ECX
00403D36 . F7E9 IMUL ECX
00403D38 . 8BC2 MOV EAX,EDX
00403D3A . C1F8 14 SAR EAX,14
00403D3D . 8BD0 MOV EDX,EAX
00403D3F . C1EA 1F SHR EDX,1F
00403D42 . 03C2 ADD EAX,EDX
00403D44 . 25 452E0000 AND EAX,2E45

;everything above simply clears EAX and EDX , queer huh? a couple of xor's would have done it just fine...

;Below is the routine... ECX holds your entered serial

00403D49 . 03C1 ADD EAX,ECX
00403D4B . 35 15180000 XOR EAX,1815
00403D50 . 03C1 ADD EAX,ECX
00403D52 . 25 82790000 AND EAX,7982
00403D57 . 03C1 ADD EAX,ECX
00403D59 . 25 9A810000 AND EAX,819A
00403D5E . 03C1 ADD EAX,ECX
00403D60 . A3 CCC84300 MOV DWORD PTR DS:[43C8CC],EAX
00403D65 . 05 F07FFFFF ADD EAX,FFFF7FF0
00403D6A . 3BC1 CMP EAX,ECX (ECX = 12345678, EAX = 1233D700)

basicaly it does nothing but preform a few calculations to see if you serial is within the routine.... so basicaly if you xor you serial with 1815, and add your orriginal serial to that, then add your serial with 7982(h) and then with your original serial again and then AND eax (which is your current serial in generation) with 819A(h), add eax with your origianl serial again and add FFFF7FF0(h) to it you will find out if it falls within the routine... mabe i'll write a program to figure it out...
(h) = hex

Well im outa here for now... onto level 3...

-Rage
Rage9
12-29-2001, 06:29 PM
I decided to code the program (which doesnt really work too well, without a debugger you cant tell what the values are.... and gets into a weird loop.. :)
Here are a few more that will work for Level 2 (tested and approved):

305422032
305427472
305446928
305427472
305739248

once i rework the program ill see how many there are but how many do you need for a keygen huh?

Off to level 3 woo!

-Rage
ThrawN
12-30-2001, 08:06 AM
We can almost copy the algo exactly as it is =) w00t i love asm.
-----------------------------------
mov edx, 1
mov esi, namelength
mov edi, name
xor ecx, ecx
calc:
cmp ecx, 12h ; Calculates only 12 characters of the name
jge finish
imul edx, 5212D37Eh ; Simple maths
movsx eax, byte ptr [edi+ecx] ; move character into EAX
inc ecx
sar edx, 9
and edx, ffcfcf80h
imul eax, edx
inc eax
xor eax, 9f9fh
rol eax, 05
imul eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, eax
cmp ecx, esi
jl calc

finish:
; EDX is our calculated serial. Use wsprintf and use whatever you want to display the serial =)
----------------------------------

Make whatever changes you need to get it to work in your compiler. I prefer masm.
Step2 will come later, i had a theory for a keygen but further testing proved it wrong heh. Brute forcer works fine but sucks.
ZaiRoN
12-30-2001, 10:46 AM
the valid serials follow a specific cyclic scheme.
these are all valid serials (numbers in dec):

- 305422032 305422033 305422036 305422037
add 32 to 305422032 and you'll find:
- 305422064 305422065 305422068 305422069
add 288 to 305422064 and you'll find:
- 305422352 ...
+32 to 305422352:
- 305422384 ...
+160 to 305422384:
- 305422544 ...

+32, +288, +32, +160, +32, +288 and so on...
so, there are a lot of valid serials.

ZaiRoN
Hoof Arted
12-30-2001, 10:50 AM
This is very good stuff. I just hope that you are all making notes as a full tutorial for newbies would be a good idea.

I am still stuck on stage 3, but will deliver a report on what I have found soon.

Hoof
Rage9
12-30-2001, 06:13 PM
lol, im getting closer, i would be done if i didnt have to work :rolleyes: but i have a general format for the serial:

rA-xxxxxxxx-xxxxxxxx-xxxxxxxx

anyways the x's must be of hex value equal to or less then the letter F in just that case.

It first checks that it is 1D(h) letters long then for the 'r' then the 'A' and finaly for the three '-'s and then splits up the routine into 3 seperate memory locations.... trying to figure out the rest... will have done soon...

-Rage9
Rage9
12-30-2001, 06:48 PM
Im kinda 'zen-ing' my way through the encryption code, and i think i just hit a rock....

I trace through the code but it is taking for ever so i just breakpoint on the cmp routine at the end of the serial routine and take a look where its being stored... I convert the 3 sections of hex into dec and plug them in.... and it didn't work.... so i ran it with the serial i 'thought' was it in there break pointed on the end and took a look.... it was a different serial... hypothosis:

Its alot like stage 2, only with your name mixed in there, ouch!
the routine is not small at all either!!! well i think im done for tonight, ill pick it up tommorow...

-Rage
Hoof Arted
12-31-2001, 03:53 AM
This is really starting to get to me now. :rolleyes: It would appear as though the programmer has copied code from system DLL's and things to limit the use of function calls. This is what is catching us. I think that the best way to tackle this problem is to see what each call in stage 3 does. Here is a bit of info I have:

004039C2 . 68 B8C94300 PUSH ra_crckm.0043C9B8
004039C7 . 6A 10 PUSH 10
004039C9 . 68 D0C94300 PUSH ra_crckm.0043C9D0 ; ASCII "12345678"
004039CE . 890D B4C84300 MOV DWORD PTR DS:[43C8B4],ECX
004039D4 . E8 773D0100 CALL ra_crckm.00417750
004039D9 . 68 BCC94300 PUSH ra_crckm.0043C9BC
004039DE . 6A 10 PUSH 10
004039E0 . 68 E0C94300 PUSH ra_crckm.0043C9E0 ; ASCII "77777777"
004039E5 . E8 663D0100 CALL ra_crckm.00417750
004039EA . 68 C0C94300 PUSH ra_crckm.0043C9C0
004039EF . 6A 10 PUSH 10
004039F1 . 68 F0C94300 PUSH ra_crckm.0043C9F0 ; ASCII "0ABCDEF1"
004039F6 . E8 553D0100 CALL ra_crckm.00417750
004039FB . A1 BCC94300 MOV EAX,DWORD PTR DS:[43C9BC] ; Section 2 to EAX byt it is now "37777777"
00403A00 . 8B0D B8C94300 MOV ECX,DWORD PTR DS:[43C9B8] ; Section 1 to ECX is still "12345678"
00403A06 . 68 E4C84300 PUSH ra_crckm.0043C8E4
00403A0B . 50 PUSH EAX
00403A0C . 51 PUSH ECX
00403A0D . E8 7E560100 CALL ra_crckm.00419090 ; XOR EAX and ECX - Result in EDX
00403A12 . 8B15 C0C94300 MOV EDX,DWORD PTR DS:[43C9C0] ; Section 3 to EDX is still "0ABCDEF1"
00403A18 . A1 E4C84300 MOV EAX,DWORD PTR DS:[43C8E4] ; XOR'ed total to EAX
00403A1D . 68 E8C84300 PUSH ra_crckm.0043C8E8
00403A22 . 52 PUSH EDX
00403A23 . 50 PUSH EAX
00403A24 . E8 B7BF0000 CALL ra_crckm.0040F9E0 ; Something is done with values. Total in EAX is "049F4A96"

The call "CALL ra_crckm.00417750" would appear to be nothing more than a function to push the literal hex value of our serial parts to memory. But, it does something strange. The "77777777" I origionally entered for part 2 of my serial is now "37777777". This could just be due to size issues. Any info ?

The second call of interest is "CALL ra_crckm.00419090". This appears to be used to XOR the first and second part of my serial.

The third call, I have no idea. Looks like some floating point math going on there but I am not sure.

Hoof
Rage9
12-31-2001, 01:49 PM
Im moving in for the kill, i found the routine.... i think.... but i wana help you with the above part, its quite simple really:

004039C2 . 68 B8C94300 PUSH ra_crckm.0043C9B8
004039C7 . 6A 10 PUSH 10
004039C9 . 68 D0C94300 PUSH ra_crckm.0043C9D0 ; ASCII "12345678"
004039CE . 890D B4C84300 MOV DWORD PTR DS:[43C8B4],ECX
004039D4 . E8 773D0100 CALL ra_crckm.00417750

;Above call sends 12345678 to the routine to see if it falls within
the encryption.... just like stage 2

004039D9 . 68 BCC94300 PUSH ra_crckm.0043C9BC
004039DE . 6A 10 PUSH 10
004039E0 . 68 E0C94300 PUSH ra_crckm.0043C9E0 ; ASCII "77777777"
004039E5 . E8 663D0100 CALL ra_crckm.00417750

;same thing only with '77777777'

004039EA . 68 C0C94300 PUSH ra_crckm.0043C9C0
004039EF . 6A 10 PUSH 10
004039F1 . 68 F0C94300 PUSH ra_crckm.0043C9F0 ; ASCII "0ABCDEF1"
004039F6 . E8 553D0100 CALL ra_crckm.00417750

;again the call to the routine with 0ABCDEF1

The tracing of the call is a bitch, but how i found what i think is the routine (I use OllyDbg, it is awsome!) just keep holding F7 to step trough the code and then when i see the serial being writen to memory breakpoint on on it and at the start of the routine... now im not totaly sure if im in the right spot but im pretty sure because it gets broken on a hell of alot...

l8er

-Rage
Rage9
12-31-2001, 01:59 PM
Ok, start tracing at 0040D100 that is the start... its writen to memory at ... 0040D133 , its really long, lots of calls.. hehe

-Rage
Hoof Arted
01-07-2002, 06:05 AM
I am officially stuck on stage 3. Would it be possible for someone who has done this more than I have to have a look and see what is going on ?
Viper
01-07-2002, 08:57 PM
If i'm reading this right the numbers , or is it , go through a final one-sided check see

:0040394A 8A81D0C94300 MOV AL,[ECX+0043C9D0]
:00403950 3C2F CMP AL,2F
:00403952 7E04 JLE 00403958
:00403954 3C3A CMP AL,3A
:00403956 7C18 JL 00403970
:00403958 3C40 CMP AL,40
:0040395A 7E04 JLE 00403960
:0040395C 3C47 CMP AL,47
:0040395E 7C10 JL 00403970
:00403960 3C60 CMP AL,60
:00403962 0F8E49010000 JLE 00403AB1
:00403968 3C67 CMP AL,67
:0040396A 0F8D41010000 JGE 00403AB1

now am I wrong or does this show that if al is less or equal to 60h or 96 ascii or " ' " then it should jump to the bad boy
also i think it shows that if it is greater or equal to 67h or 103 ascii or "g" then it should jump to the bad boy again

if im right the x's in rA-xxxxxxxx-xxxxxxxx-xxxxxxxx should be the letters a,b,c,d,e,f.

so would this be right or did i just jump the fence in left field and run into trafic :D

oh i almost forgot it does this for each of the three groups
Viper
01-07-2002, 09:12 PM
BTW i found the start at 4038A2
Hoof Arted
01-08-2002, 02:49 AM
You are somewhat correct.

As far as I can tell, the serial has to be of the same format but the characters can be 0 - 9 and A - F. (Must be upper case - for conversion to hex value)

My previous posts show what happens next. It would be nice if the writer of this crackme was able to give some info on this as it is interesting the way he has done things.

Hoof

PS. If Stage 3 is considered easy, then stage 4 and 5 are going to make us stop reversing all together. :)
Rage9
01-08-2002, 03:01 PM
sheet man, theres two more levels?? sorry i kinda took a break to catch up on some mic. things, but ill jump back in and see if we cant figure this out...

-Rage
Rage9
01-08-2002, 03:05 PM
oh i forgot, thereticaly we COULD cheat and figure out a serial the way we figured out one for level 2 (just keep adding the diffences until we get the right one....), and just skip this and move on.... up to you guys i guess, i would prefer though that we figure it out and keygen it... l8er

-Rage
Viper
01-08-2002, 09:05 PM
ok what i dont get is why it compares to G
i see what u mean about 0-9 but the hex value for "A" is greater the it is for "a" so that would make it jump to the bad boy address

does any body else see it this way too
0-9
G
a-f
i think thats all it really wants to see

once it finds G it just goes to the next call other wise it continues to check lowercase a-f

conversion of letters and numbers can take place wether their upper or lower case just returns a diffrent hex code

ie:
A = 41h
a = 61h

also while deep deep in the many calls i found it useing what i entered in stage 1

could it be useing previous stages to figure the serial in the current stage??
Viper
01-09-2002, 07:49 PM
Just takeing a chance to correct my self , please correct this if it wrong, trying to figure the third one out . its getting to me too :).

ok here goes: this checks if you between 0-9 [ includeing 0 and 9]

:00403950 3C2F CMP AL,2F " / " one up is 0
:00403952 7E04 JLE 00403958
:00403954 3C3A CMP AL,3A " : " one down is 9
:00403956 7C18 JL 00403970

this checks to see if were between A-F [ again includeing A and F]

:00403958 3C40 CMP AL,40 " @ " one up is A
:0040395A 7E04 JLE 00403960
:0040395C 3C47 CMP AL,47 " G " one down is F
:0040395E 7C10 JL 00403970

this checks to see if were between a-f [ includeing a and f]

:00403960 3C60 CMP AL,60 " ` " one up is a
:00403962 0F8E49010000 JLE 00403AB1
:00403968 3C67 CMP AL,67 " g " one down is f
:0040396A 0F8D41010000 JGE 00403AB1

any thoughts on this??
Hoof Arted
01-10-2002, 03:06 AM
Ok, I now understand why you say that you can use lower case char's.

As far as I understand it, the app calls a function to send back the hex value of each CHR. i.e. 1A2B3c4d = 0X1A2B3C4D. So I suppose it does not matter if the chars are lowercase or not.

Hoof
Hoof Arted
01-13-2002, 08:32 AM
I am following your instructions and I am trying to rip the ASM as you have show. I am using RADasm to do the keygen but it is having a probem with the line "AND EDX,ffcfcf80h"

The error is "Test.asm(104) : error A2006: undefined symbol : ffcfcf80h"

Any suggestion ???
ZaiRoN
01-13-2002, 08:40 AM
try this:

and edx, 0ffcfcf80h

ZaiRoN
Hoof Arted
01-13-2002, 08:59 AM
100% - Thanks
ZaiRoN
01-13-2002, 04:01 PM
as we already know, the serial is something like that: rA-s_1-s_2-s_3
the fundamental thing in this level is how the "call 417750" manages our s_i (i=1,2,3).
the returned values of this call are 3 dword:
1° dword 0000000b
2° dword s_i'
3° dword 0000000b'
where (values in hex):
- b=1, b'=0 if (s_i < 40000000) or
- b=2, b'=1 if (s_i < 80000000) and obviously s_i >3fffffff
- b=2, b'=2 if (s_i < 40000000) and..
- b=3, b'=3 if otherwise

but what's s_i'? i wrote it because if s_i < 40000000 then s_i is modified in some way (for the moment it doesn't interested us) ;otherwise s_i' = s_i.

after that, 4 calls:
- call 419090: take s_1' and s_2' as input and make foo = (s_1 xor s_2). then convert foo in "b foo' b'" as before

- call 40f9e0: take s_3' and serial_level1 (oh yes...look in the first part of this level, you'll found some lines of code used in the level1:) and return a particular value:
if s_3 > tot (i don't know yet the specific value of tot:( but 60000000 < tot < 70000000...) the returned value is "b foo' b'"
if s_3 < tot it's another story...

- call 40d100: converts serial_level1 in the right format (b serial_level1' b')

- call 40d840: compare "b foo' b'" with "b serial_level1' b'" and if equals we are registered;)

so, now you can found a right name/serial combo but the level isn't still complete!
in particular: if s_3 < tot, what happens??? the answer is in the "call 40f9e0".

for the moment it's all. it's not much detailed because I don't have spent much time on it but (i think) it could be a good starting point for the final goal;)

ciao,
ZaiRoN
Viper
01-13-2002, 06:24 PM
man i hate fpu code :mad:
has any body else found this in the code as well??

.text:0040F9E0 sub esp, 10h
.text:0040F9E3 fld dbl_434C50
.text:0040F9E9 fcomp ds:dbl_432008
.text:0040F9EF push ebx
.text:0040F9F0 push ebp
.text:0040F9F1 push esi
.text:0040F9F2 mov esi, [esp+1Ch+arg_8]
.text:0040F9F6 push edi
.text:0040F9F7 mov eax, [esi]

i havent had much experance with fpu although iv dled the manual from intel.

anybody here good with this??
BTW this is only a sample of what i found but it is part of 3rd level crackme

ok seem somebody has seen it judging by the referance to 40f9e0
ZaiRoN
01-13-2002, 06:40 PM
oh yes!
what you have posted is only the beginning... in that call you will find much more fpu instruction....
btw, we are here to learn so put here the code that makes problems to you and someone (i hope) will help you;)

ZaiRoN
Rage9
01-14-2002, 01:25 AM
where can i get a manual on fpu? i have never hurd of it until now, no wonder this has us all going bloody insaine.........

-Rage
Viper
01-14-2002, 04:54 AM
h**p://developer.intel.com/design/pentium4/manuals/245471.htm
Viper
01-14-2002, 04:32 PM
hope somebody can make sence of it
naturaly i can copy what the calls mean from the manual but what do they mean\do??

.text:0040CF80 ; sub_40F470+2Ep ...
.text:0040CF80 fld ds:dbl_432010
.text:0040CF86 fcomp ds:dbl_432018
.text:0040CF8C fld ds:dbl_432010
.text:0040CF92 fld ds:dbl_432018
.text:0040CF98 fstp dbl_434C50
.text:0040CF9E fnstsw ax
.text:0040CFA0 test ah, 40h
.text:0040CFA3 jnz short loc_40CFCC
Viper
01-19-2002, 12:46 AM
anybody still working on this crackme??

maby the senior members can point us in the right direction :D
Kythen
01-19-2002, 04:09 AM
Hmmmmm... this is a newbie crackme? I can see why most are stuck at lvl 3 and up. That floating point code that Viper posted is from a function in freelip (a bigint package). I haven't taken any sort of close look at the code yet, but zen instinct says level 3 has a bit of crypto to it. I can see for sure that levels 4 and 5 do. ;) Level 5 uses MIRACL though, not freelip. The crypto's caught my attention enough that I think I just might have to work on this one a bit and help you all out :)

[edit: Ok, level 3 is actually a very simple algorithm. It just looks all fugly because it uses freelip. Why the author used freelip for it, I don't know. It can be done entirely with 3 DWORDS. Anywho, for those of you working on this, I would suggest downloading freelip and miracl. You *will* need them for levels 4 and 5. Grabbing the pack of keygen sources and the crypto tools from tE! would be highly advisable as well. If anyone has any questions, just post 'em or PM me. :)]

Cheers!
Kythen
Viper
01-19-2002, 07:49 PM
when u say freelip and miracl are these apps or source code in c++??
Kythen
01-19-2002, 11:04 PM
Both are bigint C source code libraries. You can get MIRACL from from:
f*p://ftp.compapp.dcu.ie/pub/crypto/miracl.zip
and freelip from:
h**p://www.und.nodak.edu/org/crypto/crypto/numbers/programs/freelip/freelip_1.1.tar.gz
Viper
01-19-2002, 11:18 PM
thanks for the links


Happynewyear gift.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Happynewyear gift.
PDA

View Full Version : Happynewyear gift.

gAnZ
12-28-2001, 05:51 PM
http://www.reversing.net/targets/HALC.EXE
we must crack it !
;)


VB Decompilation...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > VB Decompilation...
PDA

View Full Version : VB Decompilation...

Snatch
12-29-2001, 01:58 AM
Well well. I felt this subject needed a new thread and since I am presenting a new idea I hope it is appropriate. What I notice always is that people are willing to put up for less than perfect. I was working with JoCo on the VB Decompiler right when he began the project I believe and I noticed that we had two fundamentally different approaches. Compile tons of sample applications and compare and analyze. Good luck with some of the structures as pointers in there can be relative to many things as in the begining of the structure or some other offset. I had a different method. Disassemble MSVBVMx0.dll and vbx.exe and vbax.dll. Start putting things together about what is actually going on. What you find is simply amazing and can help you write a decompiler that will knock the socks off all others. First of all, VB has options to make about 12 different types of projects from activex controls to dlls. Each is treated in very slightly different ways. You actually save time by realizing exactly where the differences lie. I cannot write a decompiler without doing it this way because there might be some possibilities left out. Of course this is tough and a lot of work but it amounts to about the same believe it or not. I looked over the list of command button properties that JoCo provided and I definetly noticed it was incomplete. Not doubting that he has the rest but point in case it is easy to miss over stuff. However, he has a program out and I do not. I just wish people would rethink their approach. The VB program files are not packed and do not even attempt to be protected. Although the code is very overbloated and complicated. Hello world! Symbol files. Freely available from Microsoft. Perhaps some of you have also taken this approach but it seems not. I dont have to ask questions about the format because there are no mysteries. Just assembly code my friends. I am thinking about providing my notes too because I am never going to have time to write the decompiler but I really would rather that everyone have an absolutely complete reference to aid them. I have many data structures and the entire form system decoded or partially decoded. I need to keep searching to fill in a few gaps still. I just gave up because of time. I would much rather be wasting it on writing a decompiler but we dont always get what we want.

Snatch
josephCo
12-29-2001, 02:11 PM
Well met old friend ;) As you pointed out my example was missing some things and I've added most of what I know to ExDec and stopped using files (good or bad.. you decide). When offering help, I have to go through my code and rediscover what I did in the first place haha. But I for one would like a copy of your notes :) My work is in no means complete and I'm sure your work would definately compliment mine. As always I'd share what I was able to with whoever needed it (with your blessings of course). Whenever you have a bit of free time, just zip up whatever you feel is appropriate and send it over to josephco_(at)hotmail(dot)com (haha since my last public display of an email address on this board I've been flooded with porn advertisements!!! Lets see if this will change it hehe).

Thanks in advance,

joe
SargeG
12-30-2001, 09:16 AM
Here, here!

Well said! I too, have disassembled the VB IDE (VB6 for me). I also DO allow for the various different type of exe's that VB6 makes, although I don't make a big deal out of explaining/displaying that info for the user; he usually doesn't care! Also, a lot of info has been traded on "that other forum"
[ask Joe about it, I don't want to offend him :)] I even posted my start-up routine for parsing the PE file to find the VB structure. I'm a believer in group knowledge.

Fine, let's all trade notes. Who goes first? Who do we trust? How do we determine what info is needed by who? Or do we start at the beginning so we all walk together?

SargeG
Snatch
12-30-2001, 03:53 PM
Unfortantely I am on vacation from school where my computer is now so I do not have access to all my notes but I will shortly and then I will email them. I do have Visual Studio 6.0 SP5 professional on my dads computer at my ease though so I think my present to the reverse engineering community will be an interesting tool that I will rewrite originally made by Matt Pietrek in an MSDN article. What it does is converts Typelibs to MAP or DBG files. This is very useful in not only integrating the MSVBVM60.dbg file in service pack 5 but now you can integrate another msvbvm60.dbg with slightly different information with the whole COM interface description in there for all events and methods of the controls implemented. VB6.exe and VBA6.dll have no VBA6.dbg or VB6.dbg for service pack 5. The only ones I know of were released on the original CD which is about 5 service packs ago ;). I thought about using the original ones because there are some very nice symbols in there but why not use the typelibs instead and stay current. VBA6.dll/1 and VB6.exe/3. MSVBVM60.dll/1 and MSVBVM60.dll/3. Those are the type library resources in the files. Of course there are the .olb files as well that bind to MSVBVM60.dll. Anyway the possibilities are endless. Too bad I do not know how to make IDA .til files so I could add the type information in and it could automatically identify paramters of say EXEPROJECTINFO* types ;). So that will be my new years present hopefully I will have it done in a few days. The old dos version does not work very well and does not let you have seperate typelib files from the dll/ocx/exe. I am going to update it and throw a windows GUI on it. Believe me this tool can make figuring what the hell is going on in the vb runtime a lot easier.

Snatch
SargeG
12-31-2001, 09:17 AM
I, too, would like any notes you may have. Also, of course, I will be happy to share with you any of my info. The dbg files for VB6 sound neat! How do we want to handle all this sharing?

SargeG
Rummy
01-03-2002, 03:55 AM
Ditch VB. VB3, VB4, VB5, VB6, ... VB9999999 - all garbage. If you deal in VB you deal in merde. Sometimes there will be a target that uses VB and, in turn, requires a VB solution. So be it.

But if VB is your choice of programming "languages" - and I use that term loosely - then you are hopelessly behind the curve and should give up right now. Do not quarrel with Master Rummy. Accept my words as a fact. Un Fait Accomplit, as it were.

Make the break. VB is garbage, merde en fact.

Sorry to offend, as I'm sure I've done, but VB will get you nowhere fast. Accept the fact that c'est vrais. Tant pis. Grow up, kids, because you will never contribute anything worthwhile to the scene if you persist in the use of VB.
Snatch
01-03-2002, 04:45 AM
I completely disagree with you. VB is a great learning language. And there are many crackers that suck shit at coding. I cant believe how few crackers can actaully even write a resource dumper the write way that works on all executables. I started out as a coder, cracking came later. And I started by writing disassemblers and exeviewers. I used to exclusively write in visual basic. Then I realized the language is crap and sucks for anything useful. But for learning it is a great tool. Programming concepts are invaluable. Now I can never ever use VB again for I know the power of Visual C++ and with MFC it makes coding a little let painless and boring. I hate to tell you but windows assembly is just plain dumb if you dont have a use for it. I want rapid development and power. I can not stand writing user interface code for 99% of the time. I want to write the actual program logic code. Of course I will never write another line of VB again though unless it is to test my decompiler. A decompiler is a good project though. It teaches you much about cracking an interpreted target and is a coding and reversing challenge in itself. And now VB.NET is going to be just as adequate a language as J++ and C# or managed C++. They all compile to the same thing its just different syntax. So please dont rant on without respect for tools. VB is Bill Gates brain child which is why we are nowhere near seeing the last of it because he likes it so much since he implemented and created the idea. Nobody should ever use VB for any program after they really know how to code though. You cant write a decompiler or even an exevier though in VB. Use a double data type lol. Any language that doesnt support unsigned variables is weak. Not to mention the API upon which it is based. Respect VB for what its worth, a good decompilation target and a great learning tool. But we should all move on and become proficient coders in a more powerful language.

Snatch
SargeG
01-03-2002, 09:14 AM
I'll go even further:

The single most over-riding reason for VB is speed. Not of execution (obviously), but of development. RAD is an absolute must for any support or test tool that needs to be ready before the product-that-is-to-be-tested. Sure, the shipable/sellable app will certainly be written in non-VB, but I can just see the powers-that-be saying "Oh, you need another full software project, with its time and cost and manpower constraints, to test and support the software project you just finished? Sure, we don't mind if you are late and overbudget!" Sorry, don't think so. VB is invalulable in throwing together those mini-apps that make supporting and testing the big app possible. Not to mention (so why am I?) that almost anybody can maintain them; that's where we usually start the new-hires, so they can be productive while they learn the product.

Sarge
Snatch
01-03-2002, 04:59 PM
Friend you have not learned MFC and that is the bottom line. MFC development is just as fast as VB with out a doubt. Not to mention that you get pointers and native data types. But it is your choice as you said if you just want to play around. I dont play around. I write my application once and never rewrite it again. I dont need to bother this way. Its RAD and its good. I suggest you learn MFC as you will be able to agree with me on this point. Not to say that VB wont work but um you say RAD? Hah the reason I switched from VB to C++ a long time ago was cuz I saw the limitations of VB with certain things and tried to get around them and wasted more time trying to get around them then I did just writing them in the other language. You will see what I mean. Try writing a disassembler in VB like I did. It is ugly and painful and much easier in C++. So is anything that requires binary translation ;). But the bottom line is it is just our preferences no big deal. We can still share the wealth.

Snatch
SargeG
01-04-2002, 11:31 AM
Nope, sorry, won't fly. I particularly like "I write my application once and never rewrite it again." Try doing that in a testbed environment, you won't last long. As for limitations, there are constraints in any language; the limitations are usually the ability of the programmer.

I particularly like the emphatic statement many people make:
"Its not a real programming language". Hmm, how did they make that determination? I can write instructions in a given syntax, compile it, and get an operational app. Thus, I have written a program. Which part is not real? And how does having C syntax make any difference from having Basic syntax? It doesn't, its just the language. Same-O Same-O.

Finally, how dare VisualC call itself "visual"? In VisualBasic, at least the visual part is understood; I select a form and I get an already define form. It is definitely a visual aspect. Can I do that in VisualC? Nope. In fact, that is one of the big disappointments in that connotation; "VisualC" implies that I get forms, just like in VisualBasic, but that I program in C syntax, not Basic syntax. But is that the case? No.

Point is, there is strength to both, but I have yet to see VB RAD be beat by C RAD.

SargeG
Snatch
01-04-2002, 12:44 PM
Heh we should probably end this silly argument but I guess it serves an interesting point. Namely one of that in C all I have to do to read in the exe headers is this:

IMAGE_DOS_HEADER DosHeader;
File.Read(&DosHeader, sizeof(IMAGE_DOS_HEADER);
IMAGE_NT_HEADERS32 NTHeaders32;
File.Read(&NTHeaders32, sizeof(IMAGE_NT_HEADERS32);
IMAGE_SECTION_HEADER* SectionHeaders = new IMAGE_SECTION_HEADER[NTHeaders32.FileHeader.NumberOfSections];
File.Read(SectionHeaders, sizeof(IMAGE_SECTION_HEADER) * NTHeaders32.FileHeader.NumberOfSections);

etc... and so on.

It is the specific use here that makes C++ especially appealing. That good old winnt.h file has every portable executable structure and signature defined in there with every flag etc. Now talk about RAD. I did not have to make my own structures, I do not have to worry about DWORDs that could throw off VB's long type. The nature of any binary viewer application is much more supported and more rapidly developed in C++. I know it can be done in VB but with much more work(I have done it my first EXEVIEW application with a dissassembler was in VB). But it takes more work and it is plain in clear and I have written the code for both. Of course the visual aspects are much easier. I wont even touch that point. But this is an actual code application. Heh anyway maybe we should end this discussion it isnt leading us any progress on the decompiler and that is our goal here after all. Just our preferences and we could probably argue for years about it ;).

Snatch
SargeG
01-04-2002, 01:39 PM
Well, I certainly agree that this could go on and on.

As for the ease of reading files, you are correct...as least a far you have interpreted my postings. What has NOT been said here is the ease of reading files in VB using the API (the details of which need not be discussed). The reason for this lack of "high power" VB action is simply simplification (Wow, how's that for alliteration?). Don't forget, many of those reading this forum for information are not fully experienced; I feel obligated to explain the facts as easily as possible. I would much rather say "use the SEEK command" then have to explain how to use an API. This continues to put the emphesis on learing what is desired, without forcing the added burden of learing HOW to learn it.

As an aside, how does your short, easy to write code, teach me the ins-and-outs of the PE file? All it does is GIVE me the answers, when I want to know HOW TO GET the answers.

Besides, isn't writing a reverse engineering app in VB, the very language that you want to reverse, have a sort of irony to it?
As the saying goes: "If you can't see the poerty in that, you have no soul"

SargeG
Snatch
01-04-2002, 11:52 PM
Heheh well you are certainly entitled to work in VB and if you produce the same results who cares in truth. We all have our own understandings and tools to help us better understand. We might as well share our knowledge in a form that everyone can understand which shouldnt be too tough since most reverse engineers have a base knowledge about programming that is pretty strong. It is ironic that you are writing a decompiler in the language you are decompiling. DoDi's biggest mistake was doing that with his VB3 decompiler. I got his decompiler to decompile itself into perfectly good source. Of course it took a few hours of analyzing his VB protector to see how to reverse the protection and rebuild the file. It actually isnt too hard. So I hope you take your own words of advice if you ever release something and change the language. Otherwise your tool can be its own kiss of death. And believe me this is the truth ;).

Snatch
SargeG
01-07-2002, 08:38 AM
Ha! I love this! You are the first person to point out this delimma!
Yes, you hit it! Do I really want to release a program that can "undo" itself? I of course asked myself that question before I got started. My answer? "uh, um, well, ah, hmm!" Actually, I don't know. If the purpose of the program is to help learn, and someone wants to learn how to decompile VB, then it must of course work on itself. But then, do I receive any benefit? SHOULD I receive any benefit? If this is to be a freeware/shareware program, does it matter? Or should I....well, whatever. This is too much an ethical consideration that my overworked mind can't handle right now. (Ask me again in a few weeks when after I work out a few minor bugs.)

SargeG
Snatch
01-07-2002, 01:35 PM
Hehe :). Actually I have something I would like to point out to the masses. To write the perfect decompiler you have to disassemble and understand MSVBVMx0.DLL perfectly. Of course the interpreter does not access all the data in the exe and theres a lot of useless stuff the compiler puts in. But to make a decompiler you need to satisfy the interpreter for the reason that any VB protections will only satisfy the interpreter and can strip out all the garbage. After the interpreter is satisfied then you can add the information from the compiler VBx.EXE and VBAx.DLL so you can make use of all the extra unneeded information for a better decompilation. But all the code that makes use of that should be conditional and there should be an option to use it or not because as I said protections will throw things off. Of course a sophisticated enough protection can still satisfy the interpreter but do some very clever initialization stuff to still throw the decompiler off but in this case I would consider the file packed not protected so much and unpacking would be needed. Just some thoughts.

Snatch
moogman
01-07-2002, 02:09 PM
On the topic of decompiler protections, surely all protection wrappers have some sort of custom stub where it encrypts/packs the actual vb exe. So logically, this stub would have to unencrypt/unpack the vb exe information into memory somewhere. Forgive me if im wrong, but would that mean that it would be possible to make a program to find the memory location of the vb exe data and decompile that rather than the actual exe file? Im not sure how one would do this mind, since im not that advanced at low-level stuff like this. Twas just a thought though

-moogman


SmartKey Unshell!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SmartKey Unshell!
PDA

View Full Version : SmartKey Unshell!

SmallBoy
12-29-2001, 11:03 AM
Hi,
Althouth there is many unshellers But i can't find any unsheller about SmartKey Protection!:confused:

Please Send Me Any Unsheller/Address to recieve it!
:(

Most Regards
SmallBoy3000

SmallBoy3000@yahoo.com


Sentinel SuperPro v6.1 Unsheller!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel SuperPro v6.1 Unsheller!
PDA

View Full Version : Sentinel SuperPro v6.1 Unsheller!

SmallBoy
12-29-2001, 11:13 AM
Hi,

After i use Spuica It Can't Unshell My EXE Protected By Sentinel SuperPro Version 6.1

Please Guide Me More!
:confused:

Most Regards
SmallBoy3000
SmallBoy3000@yahoo.com
CrackZ
12-29-2001, 05:48 PM
Hiya.

The ICA's Sentinel Shell unwrapper was designed to be used with the original dongle connected, in fact I think even good old Procdump has support for dumping with the dongle connected since execution resumes in the first section at OEP for Sentinel shell protected applications.

If you do have the original dongle, contact the ICA guys to see whats going on or try ProcDump or Icedump, finding the OEP ought to be pretty easy too ;-). I can't imagine the ICA unpacker does very much more than a dump of the unpacked image.

If you don't have the dongle, the Sentinel shell is still vulnerable since its decryption depends on a sproQuery() response, a sliding 32-bit XOR key actually. One can actually check if it is the correct key as a checksum of the decrypted area is included as part of the 'is the unpacking all safe and correct code', all one needs to do is guess 1 or 2 likely plaintext bytes and the whole thing can be bruteforced (depending on section size) in less than a few hours, well done Rainbow, since I'm out of this game pretty much, did I mention that the decryption checksum is one of the main features of your protector that actually compromises your entire protection (pretty much) ;-), or it at least prevents us having to write something more sophisticated anyway.

Anymore details needed, drop me a msg here or e-mail.

Regards

CrackZ.
nblender
01-05-2002, 11:41 AM
Is it possible you could tell what your 6.1 target is or where to get the 6.1 sdk since the latest one on rainbows pages is 6.0.

Thanks

--nb
SmallBoy
01-08-2002, 01:40 PM
If you want to see one of example programs that protected by SS6.1 Tell Me To Send It For You!

I buy original ss6.1 from it's company!

SmallBoy
SmallBoy3000@yahoo.com


ShitXP & SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ShitXP & SoftICE
PDA

View Full Version : ShitXP & SoftICE

GeneralD
12-29-2001, 03:05 PM
Hi,

This is my first post to this forum so please don`t shout/laugh at me. I am a "happy" user of ShitXP and I`ve heard then only one version of SofiICE runs on it. It is DriverStudio 2.6, but I don`t know where to get it. Every link I`ve found is dead .... Please help me !!!

Best Regards
GeneralD
mailto generald@poczta.onet.pl
Woodmann
12-29-2001, 05:07 PM
Hi,
Perhaps a kind hearted soul will help you.
You have not looked hard enough to find it.

Peace, Woodmann
Viper
12-29-2001, 05:33 PM
looks to me like he dont even plan on comming back to the board
GeneralD
12-30-2001, 07:03 AM
Why do you thik so , Viper ???

Best
GeneralD
Viper
12-30-2001, 07:14 AM
just the way i took your post
i suggest you look alittle harder for it i know its out there i myself found a half a dozen lnks in just a few min. working i might add.

just try a little harder

BTW im not being a hard ass just giving a little free advice
GeneralD
12-30-2001, 03:02 PM
maybe you`re better than me in searching info on the net ???

i`ve downloaded DS 2.5 and it`s also working on XP

thx for help

best
GeneralD
Snatch
12-30-2001, 11:25 PM
I have DS2.6 but heh if I could have found half a dozen links in a few minutes I would have been impressed with myself. Viper anyway youll share how you managed that? No search engine would do. I mean right after something is released the search engines have no way of knowing about it and sometimes they dont rescan pages for months on end. Maybe you used a trick that I dont know. A good ftp search engine?

Snatch
Aimless
12-31-2001, 02:12 AM
If you do not like XP (ShitXP, as you call it!!) then maybe you should stop using it!

I hate when people try to be neo-pseduo-intellctually-stimulating-super-elite-stud-assholish-cracker-hacker-phreaker.

Start using Linux for God's sake and stop "Shitting" XP.

...Have (Shittish) Phun!
GeneralD
12-31-2001, 05:05 AM
neo-pseduo-intellctually-stimulating-super-elite-stud-assholish-cracker-hacker-phreaker ...
GeneralD
12-31-2001, 05:13 AM
All in all I`d like to thank all those who someway helped me (those others too :->) .

Happy New Year , reversers !!!

Best regards
GeneralD


awesome packed file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > awesome packed file
PDA

View Full Version : awesome packed file

ON'error
12-30-2001, 05:45 AM
hi there,
perhaps you know image styles a shareware gfx prog.
for practise only i want to register it (only one s/n required)
but 1st i'D like to disassemble it, but no!! w32dasm or ida shows nothinq so i run nearly all file analyzers and ive found out that the compiler was c++, huh wow!!! (ironic) but no packin informations. if i hadnt found a key on astalavista i would think its uncrackable.
what can i do now?
peterg70
12-30-2001, 06:50 AM
If it Image Styles that I downloaded

Then its packed with UPX and modified to hide the fact. Just do a manual unpack as per any other UPX unpacking.

If you can't recognize the packer then you have 2 options
1)
Upgrade your filechecker software that identifies the packer
OR
2)
Manually Unpack the program. This is not hard too do typically just run it in a debugger (like ollydbg) and when you see the program jump to the start of the code. Launch Procdump and dump it. This way the debugger holds the program from executing and it is fully depacked. It may need some revirgining
(Hmmm is this the right terminology).

Peterg
ON'error
12-30-2001, 11:23 AM
but the file is modified/hacked/protected says UPX
which program shows me the prot.??
Viper
12-30-2001, 12:35 PM
what version of image styles do you have ON'error
Viper
12-30-2001, 01:16 PM
i just got version 1.75 if this is the version u got the it is infact packed with upx { upx0.71 or 0.72} according to file insPEctor XL but according to PE iDentifier it showes it as useing UPX-Scrambler RC1 {i always use more then one analyzer}
Js
12-30-2001, 10:08 PM
Hi,

Since you didn't ask specifically about unpacking it, I suggest you attack the keyfile it saves in windows folder.
ON'error
12-31-2001, 06:24 AM
now im informed(?rightword?). good tips,
i wasnt able to unpack it but im a newB so im reading some tuts about packin/unpackin and ill crack the bitch
so long
ThrawN
12-31-2001, 06:46 AM
If your new to unpacking UPX then check out http://www.mesa-sys.com/mercution/hf/tutorials/misc/upx.htm
And perhaps http://dghtserver.de/images/bullets/evd/stuff/files/tutorials/lesson7.zip

UPX is a great packer for a NewB to start with, very simple.

Any other questions then feel free to ask.

---------
ThrawN


UPX-Scrambler rc1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > UPX-Scrambler rc1
PDA

View Full Version : UPX-Scrambler rc1

Viper
12-30-2001, 12:48 PM
has anybody had any luck unpacking a program that uses this?
stealthFIGHTER
12-30-2001, 01:45 PM
Hello,

I've unpacked file (packed by UPX and scrambed by UPX-scr.) in a sort time (I was really surprised :)). It was easier than unpacking an UPX only (I think, heh).

sF
Viper
12-30-2001, 02:29 PM
do you have a draft tut on how u did it by any chance im haveing a little prob with it
cant seem to find a starting point, guess im to close to the prob.


Loading a dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Loading a dll
PDA

View Full Version : Loading a dll

stealthFIGHTER
12-30-2001, 03:42 PM
Hello,

I have a program that uses its own dll. The dll has some interesting export functions. I've added the path to the dll into winice.dat (I've copied the dll into %SYSTEMROOT% directory) :

EXP=c:\windows\system\bla.dll

But once I want to set a breakpoint (after restarting) on some of the functions >> Symbol not def.... Is it possible to use these (export) functions (as breakpoints) or it is nonsence (and I am lame)?

Thanks,
sF
Aimless
12-31-2001, 02:17 AM
Try ensuring that CASE-SESITIVITY in not ON in softice (though by default, it is off).

Other than that, try this final step:

1. Do NOT copy it to %systemroot.
2. Instead, let it be present in your app folder (say, c:\MyApp)
3. Set path in ICE to point to that directory (as in EXP=c:\MyApp\bla.dll)
4. That SHOULD work.

...Have Phun
DGR
12-31-2001, 06:57 AM
Or just use the symbol loader to load the exports from the dll.

File -> Load Exports and voila...
Kayaker
01-02-2002, 08:05 PM
Hi sF,

All those ways should work to load your dll into Softice. To make sure they are loaded you can type
EXP <partial-name>
in Softice. For example if your dll exports the function _blafoo then you if you typed
EXP _blaf
you should get the calling address of that function. Then you should be able to set a breakpoint on the name or the address.

You can use this too when you're reversing if you forget, or want to peruse, the exports. For example 'EXP reg' will give you all the standard advapi32.dll registry breakpoints.

Cheers,
Kayaker


so cold is SoftICE [introduce me too]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > so cold is SoftICE [introduce me too]
PDA

View Full Version : so cold is SoftICE [introduce me too]

D.elete
12-30-2001, 06:00 PM
hi eb,

need a good link where to find tutorial on Soft_CE, w32Dasm, IceDump...
any other site than krobar?

tnx.
Viper
12-30-2001, 06:04 PM
try searching this fourm or google useing +crack +tutor
Viper
12-30-2001, 06:19 PM
here's something to get you started though h**p://astalavista.box.sk/
JimmyClif
12-30-2001, 07:40 PM
Actually a tutorial of SI,Wdasm etc.. is called a manual

Wdasm for example has a Help Option in the Menu, if you check that one out you will find a complete Tutorial how to use it.

For SI.. it's the SoftIce command reference/Using SoftIce.. get it here:
*** hatschoum://www.geocities.com/SiliconValley/Ridge/1237/

Icedump.. erm.. doesn't it come with a manual?

:rolleyes:

*** yes the link is correct... Search the web with this and you'll find a hidden cracking page behind it ;)
Viper
12-30-2001, 08:17 PM
actualy the icedump does come with a manual its the doc file usaly in the [drive letter]:\[path installed icedump]\[w9x in my case]\doc\icedump6.txt

this is how mine looks
c:\icedump\w9x\doc\icedump6.txt
D.elete
12-31-2001, 10:32 AM
tnx to all,
but, JimmyClif, i can't find

For SI.. it's the SoftIce command reference/Using SoftIce.. get it here:
*** hatschoum://www.geocities.com/SiliconValley/Ridge/1237/

*** yes the link is correct... Search the web with this and you'll find a hidden cracking page behind it

maybe i'm so newbie, that i cannot understand what ypu mine.

again, thankss
Viper
12-31-2001, 11:54 AM
i had a prob with this too
check here
h**p://www.geocities.com/SiliconValley/Ridge/1237/crackmain.html
?ferret
01-01-2002, 11:37 AM
JC was simply trying to give you a lesson in effectivr searching. he gave you a good clue to use if you knew how to run search engines. go to google, type in "www.geocities.com/SiliconValley/Ridge/1237/ " (with the quotes) and check out the 2nd & 3rd results as a matter of fact #3 has the words softice command reference right in the description. Hehe....as a matter of fact, assuming the author of the main page is in fact the same person that uploaded the indirect pages.....you now know the real name of a cracker, although at this stage we don't know which cracker.
D.elete
01-01-2002, 11:53 AM
dear ?ferret
wish you [and also all the ppl here] a wwwonderful 2k+2.
again, all of you have my best thankxx.

ciao!


Vintage NE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vintage NE
PDA

View Full Version : Vintage NE

riPPadoGG
01-01-2002, 01:24 AM
Hi All,
Happy New Year...
I am back after a small vacation.. :)

Hi.. I have an NE (Win3.1) file which is packed(alas!!!)..
So I face with the follwing problems..

1. S-Ice does not break on entry-point with Ice-dump :)
2.How do I edit an NE file? Any file editor?? I use PE-Editor.. but that is PE, no support for NE :(

regards
riPPadoGG


Windows XP product type
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Windows XP product type
PDA

View Full Version : Windows XP product type

Roy
01-01-2002, 10:17 AM
I found intresting thing about windows xp. There is one file in inf folder sysoc.inf where windows components are listed like that

TerminalServer2=setupqry.dll,IndexSrv,TsOc.inf,hide,6
if you remove word hide they wil be shown in control panel->ad remove->windows components.

What is very intresting, that windows instalation contains all nesecary files for other system types, for example server version.

Unfortunately some components refuses to install. Probably needs to change system type to server.

So, does someone know how to change product type for windows XP this is posible for windows nt 3 and 4. Unfortunately I dont have softice for windows XP.


ASPI call log
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ASPI call log
PDA

View Full Version : ASPI call log

SiNTAX
01-02-2002, 09:37 AM
As I'm interested in how the actual CD protection is done in SD, I wrote a replacement Wnaspi.dll that redirects the call to the real Wnaspi.dll but logs whatever info I want.

However, SD didn't seem to be calling SendASPI32Command from my dll. I wasn't able to perform more detailed debugging to see what was going on as my Win98 decided to go FUBAR on me GRMF!

Anyway before writing that lib, I did some hacking with SI and I'm sure it was using SendASPI32Command from Wnaspi.dll (bpm LoadLibraryA X ; wait till it loads Wnaspi, then bpm SendASPI32Command X)

Does anybody know of a decent description of what SD actual issues to the CD drive?!


.TIL files in IDA Pro 4.1.5 and above...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > .TIL files in IDA Pro 4.1.5 and above...
PDA

View Full Version : .TIL files in IDA Pro 4.1.5 and above...

Aimless
01-02-2002, 09:50 AM
Any idea HOW these are created?

Or, whether we have an option in IDA to create our own API parameters/TIL files? For example, a dll that I may have created, would have functions with certain parameters.

I need to create a .TIL file for that. No information is present on the NET (at least not the kind I need).

Pointers anyone...?

Have Phun
Snatch
01-02-2002, 03:42 PM
Interesting I was going to ask the same thing. I could not find any information about those mysterious til files. My guess is that the SDK could create them? I need the same thing I have some symbol files with structures that I would like to define type information for. And have it show up on the stack, auto parameter identification, etc... properly. Perhaps some registered users know something we dont?

Snatch


problems with cracking a program: need a hint (most parts in German)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > problems with cracking a program: need a hint (most parts in German)
PDA

View Full Version : problems with cracking a program: need a hint (most parts in German)

nop-erator
01-02-2002, 04:49 PM
I'm trying to get a valid serial for "TZ-Strip Poker 2" :D for hours, now! I just can't find the correct position. I don't want a complete walkthrough (i suppose i even won't get it here), just a hint. you can download the program from here: http://www.tz.to/download/spiizip.exe

thank you very much!

nop
Bengaly
01-02-2002, 05:37 PM
what a nice way for a crack request ;p
riPPadoGG
01-03-2002, 02:12 AM
Hey,
If you really gave it a try, come on and give more details..
Where did you get stuck?
What all did you try???

cheers...
doGG
nop-erator
01-03-2002, 05:07 AM
hey, this is NO crack request, really. here are the details, and everything I tried. (btw: I'm still a newbie)

First I tried to disassemble it with Win32dasm. I couldn't find anything useful. Of course, the next tool is used was SICE. at the very beginning i first tried how the serial has to look like, it has this format: (x for a number, l for letter) xxxx-xxxx-xxxx-llllllll(as much letters as you want). I typed in a fake serial like 1111-2222-3333-noppy and nothing happened after pressing "ok". So I set a breakpoint on hmemcpy before pressing ok the next time. I pressed F12 till i was in the program code and searched for my serial: "s 0 l ffffff "1111-2222-3333-noppy". I found it once, deleted all the other breakpoints, and set a bpm on the address. After some tracing i found out, that the serial is changed into this: "111122223333noppy". So I searched for the memory location of this serial and also set a breakpoint on it. I pressed, i think it was 3 times, F5 to halt on the code where this new serial is being changed. The only interesting location i found was 017F:4114ED. There was a loop where something was done with the characters, but I didn't understand what exactly. After this loop and some lines of code, i return from a call and just don't know where to go on. I think i'm on the completely wrong way, am I?

looking forward to get some hints now...

noppy
goatass
01-03-2002, 01:07 PM
Hey man, it's good to see that you atleast tried reversing it yourself before asking for help.

Some things to try, normally I start with BPX GetWindowTextA and GetDlgItemTextA they usually drop you near the serial routines. Using hmemcpy is another good BPX but it requires more backtracing in many cases and if you are not very knowledgeable about assembly it makes life more difficult.
Next you said you found a place where the serial you entered was cleaned up and the dashes where removed, so what you should do is write down the RVA where you found that and look it up in wdasm32 so you could have a broader view of the routine and look what calls this routine and follow it from there.

keep us posted on your findings and we will try to help more.

goatass
SilberFuchs
01-03-2002, 01:31 PM
hi nop-erator

jo, du bist schon an den richtigen Addressen 8)
schau dir einfach die folgenden Codezeilen genauer an. besonders die Vergleichsoperationen.

ps: patchen ist noch leichter, nach dem Prinzip: eine Null im Speicher=Vollversion, eine 1 = shareware; Ansatzpunkt: wähl mal die 2. Dame zum spielen :D

Ciao
SilberFuchs
JMI
01-03-2002, 01:37 PM
Und auf english, bitte?

Regards.
nop-erator
01-03-2002, 02:49 PM
@goatass: I tried GetWindowTexta, too, but that didn't help me much. I just used bpx hmemcpy, to jump into sice to find my serial in memory. looking up the RVA address and looking at the code in win32dasm had the same effect. it just doesn't help me. i don't know how to go on.

@JMI: Translation: "hi nop-erator, yeah, you've found the correct adresses already 8) just look more intensively at the following lines of code. especially the comparison stuff. ps: patching is much easier, with the princip (?): zero in memory=full version, 1 = shareware; helping point: choose the second woman."

@Silberfuchs and the rest: The problem is, that I can't find interesting comparinsons after this loop at 4114ED! After some tracing I return two times, then there is a comparison like this "test eax,eax" (i think it was at: 4111EA), and i jump a little further, till i can see three calls. how to go on? in the calls, there are a lot of other calls. i can't find any interesting comparison routines in them. Perhaps I "übersehe" (oversee :D) something?

Noppy
4oh4
01-03-2002, 04:12 PM
The link to the english version of that site doesn't seem to point to the right page. I don't suppose that someone who actually reads german (I think?) would know if there is an english version of that software?
SilberFuchs
01-03-2002, 05:08 PM
hi nop-erator

nach deinen Beschreibungen dürftest du auch an diesen Stellen gewesen, nachdem die "-" aus der Serial entfernt worden sind. Mach mal einen bpx auf eine dieser folgenden Codezeilen und starte das Programm NEU; Si breakt.

Durchtrace einfach mal diese codezeilen und gib am Ende drauf acht, was mit eax passiert, ob eax=null oder ob eine 1 nach eax kopiert wird. Geh dann raus aus dieser Routine und schau was mit dem Wert in eax gemacht wird; den Rest dürftest selber auch hin kriegen

:004113EE 8BCE mov ecx, esi ;..................hier stehst du
:004113F0 E82B000000 call 00411420;...........Serialcheck?
:004113F5 85C0 test eax, eax
:004113F7 7414 je 0041140D
:004113F9 8B4604 mov eax, dword ptr [esi+04]
:004113FC 85C0 test eax, eax
:004113FE 7407 je 00411407
:00411400 8BCE mov ecx, esi
:00411402 E829010000 call 00411530

:00411407 33C0 xor eax, eax ;..........Vollversion
:00411409 5E pop esi
:0041140A C20C00 ret 000C

:0041140D B801000000 mov eax, 00000001 ;............Shareware
:00411412 5E pop esi
:00411413 C20C00 ret 000C

i must write in german, my english is to bad, sorry

Ciao
SilberFuchs
Viper
01-03-2002, 07:06 PM
Originally posted by SilberFuchs
perhaps so
hi nop-erator

after your descriptions you might also in these places been, after " - " from the Serial removed are. Mach times one bpx on one these following code lines and starts the program NEW; SI breakt.

To Durchtrace simply times these code lines and give at the end drauf eight, what occurs with eax whether eax=null or whether from 1 eax is copied. Go then raus out of this routine and schau which with the value into eax one makes; the remainder would be allowed to do also wars

Please tell me if i got it wrong :D
i know i got some errors ohwell
nop-erator
01-04-2002, 04:49 AM
Hey Viper,

your translation program is really bad :). Actually Silberfuchs (btw: the entire german youth does that) speaks in slang. That's why your program had a lot of problems.

here is the correct translation:
"After your descriptions you should have been at the places, where the "-" where removed from the serial. Set a breakpoint on one of the following code lines and restart the programm. SICE will break.

Trace throught the lines of code and look what happens to eax, if eax==null or if there is a 1 copied to it. Then leave this routine and look what happens to the value in eax; the rest shouldn't be hard for you."

I'll do that this afternoon silberfuchs, thank you!

noppy
nop-erator
01-04-2002, 08:29 AM
hey silberfuchs,

danke, ich habs geschafft. ich glaub ich wär nie von selbst draufgekommen, dass ich das programm neu starten muss. trotzdem: eigentlich war mein ziel eine gültige serial zu bekommen, allerdings hab ich auch in dem call da nix sinnvolles gefunden. kannst mir vielleicht da weiterhelfen?

btw: ich würd noch gern einen trainer programmieren, wo man immer gewinnt :D. Wie würdest du vorgehen, um da ranzukommen?

cya,

nop

translation:
"hey silberfuchs,

thank you, i managed to crack it. i think i would have never found out to restart the program, and break at the same location. anyways: originally my target was to get a valid serial. but although i had a look at his call there, i couldn't find any thing that looks like a serial comparison routine. can you help me with that please?

btw: i would like to code a trainer, so that you win always :D. how would you start to find the correct addresses?

cya"


Need help on Sentinel Dongle!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help on Sentinel Dongle!
PDA

View Full Version : Need help on Sentinel Dongle!

cah
01-03-2002, 07:10 AM
To,
All dongle reverses

How to find type of Sentinel Dongle like Cplus/Pro/Super Pro?
How to read this dongle data?

Help on this appreciated
Thanks

cah....


Idea request please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Idea request please
PDA

View Full Version : Idea request please

LaptoniC
01-03-2002, 05:06 PM
I am requesting an idea for my current problem.I am trying to fix IAT table of cd-copsed exes.Only kernel32.dll imports are crypted and decryption is version dependant.So I need generic way for rebuilding IAT.I have important datas
1.In the original exe adress pointers are virgin.
2.I know which functions will be used from kernel32.dll because I store input and output of GetProcAddress.I made a struct like this

hookiat struct
fname db 40 dup(?) ;function name
fof dd ? ;function address
hookiat ends
I have allocated iatsize of this struct.Filled memory are with input and output of GetProcAddress.

3.I have initialized IAT so I will have address of functions from import dlls

Problems
1.First Thunk and Name members of kernel32.dll import are missing.I can find the name member but there is no *generic* way to find first thunk.
2.I dont know how to find which one comes from kernel32.dll imports or other dlls so I can skip it.
Could you suggest me a pseudo code or better asm code for this.Thanks.I have uploaded 4 files,
calisan.exe working rebuilded exe.
dump.exe dumped executable with my unpacker.
init.exe exe with initialized IAT.
origin.exe crypted original exe.
htxp://misterstop.kolayweb.com/files/hookproj.zip
IcyDee
01-03-2002, 06:17 PM
I gather you have trapped the API GetProcAddress which you are using to store the function name. Would it help to also trap LoadLibrary and then associate the name of the library with the handle used by GetProcAddress. They you would know which ones were for kernel32.dll.

Otherwise can't everything be worked out from the address of the function? For example, if you look at the PE structure of kernel32.dll you will see what address ranges there are, you can look through the export table of kernel32.dll to find the function names which match the function address. I am sure all this is possible with ReVirgin.


How to make a BPX at POPAD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to make a BPX at POPAD
PDA

View Full Version : How to make a BPX at POPAD

mitrix
01-03-2002, 07:24 PM
How to set a BPX at a certain instruction?
Such as POPAD,i want to make a breakpoint at POPAD in Si
and i dont know where it is.
JMI
01-03-2002, 09:23 PM
Mitrix:

The code for POPAD has a certain form which can be used to search the code for the address, and then you set the breakpoint of the address you find. This issue is discussed in great detail in +SplAj's articles on CommView 3.1.156 and Awave Studio 7.3. You will find both articles and the page from his "discompress" page which contains the "signature bytes" to search for, down a few entries on this forum titled _SplAj Tuts. The fast way is to use this:

http://www.woodmann.net/forum/showthread.php?threadid=2355&pagenumber=1

Regards,


anti disassembler tricks x86
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > anti disassembler tricks x86
PDA

View Full Version : anti disassembler tricks x86

dominator
01-04-2002, 05:45 AM
Hi,

i'm looking for some good anti disassembler tricks.
can anyone provide some to me. i don't need windows
spezific trick. i do programming under linux.

thanx
Snatch
01-04-2002, 12:50 PM
Try looking at SafeDisc2 code. Ugh is all I can say. It is the most disgusting code known to man. Pages of garbage that the disassembler is confused by. Of course we have a nice tool Imhotep to eliminate all that garbage. Or you can look on Fravia's old site where me and a few otherse had some anti disassembler tricks. Check Tsehp's mirror. Packed files dont trick the disassembler but wont disassemble.

Snatch


BitArts Titanium 3 softice detection.....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > BitArts Titanium 3 softice detection.....
PDA

View Full Version : BitArts Titanium 3 softice detection.....

cjack
01-04-2002, 01:00 PM
Hi All!!
Is there someone who can tell me how bypass softice detection of new software releases from BitArts?? (like Titanium v3....)
I'm trying to bypass detection with few classic methods but nothing to do!!! frogsice nothing..... sigh!!!
Thanks
cjack
01-04-2002, 03:37 PM
hem....errata corrigge!!!! The new version of Titanium is 6 and not 3...
+SplAj
01-05-2002, 04:59 AM
LOL Bi-Tarts released a new 'protection' scam, call it Titty 3 or SoftLarx 6 , whichever takes yer fancy. It don't matter.

Use Icedump for Win98/ME or WinNT4/2K/XP with SI patched to avoid the lame tricks. CreateFileA \\.\SICE is rather dated and the VXD trix don't work in WinNT4/2K/XP ;)

Also if you unencrypt say, Fusion v3 or Crunch v3 then prepare to play a 'patch' game cos they check the PE Header for IAT and OEiP pointers a LOT. That is the so-called 'Mutation' code LOL. Just set a BPR on the PE header offset+100 and see the 'decoded' sections that you have to patch;)

Fusion v3 is on your favorit exe site to play with and compare ;)

Don't bother with Cruch v3 as it makes 52k notepad into whopper 110k crap duh ?

Spl/\j
cjack
01-05-2002, 08:28 AM
Thanks for the suggestions splaj (is a honor talk to you!)
I have installed Icedump (I use DriverStudio 2.6) however Titanium v6 still intercepts softice and therefore it stops the loading (better...stay in the background TaskList).
cjack
01-05-2002, 09:23 PM
Thnx SplaJ....with W98 and Icedump the BitArts tricks to detect softice are fucked!!!! Under W2000 it does not work :-(

SplaJ....only another thing.... I'm trying to locate the "jump" instruction to the decrypted code...but I cannot locate it!!! Do you know how Titanium pass control to decrypted program???
+SplAj
01-06-2002, 01:29 AM
The QUICK way is to bpx GetStartUpInfoA and GetVersion after the 10 secs wait to press 'Continue' . These two api are *usual* 1st API to get called by real exe's. Trace back to 55 EB EC........
If you try /Tracex in Icedump then I think you wait 2 hours with still no result ???

The titty/softlarx creates a new 'thread' insxxx.tmp and any BPX TerminateThread will get you from the insxxx.tmp to the exe eventually....

Also the 'time' control is in Netdet.ini (Windows dir) see [Routing.extent{CRITICAL ENTRY}]
NetDat%0000010101........
and also in the registry, eg Titaniumv3 =='titaniumv3EvalautionNoMeBitArts' also full of binary 0/1. If you DELETE BOTH TOGETHER, then the evaluation restarts.

For Win2K/XP DS2.6 I have created a new .ini for this version using EliCZ patcher, OR I can tell you how to manually hex NTICE.SYS etc to hide SI from detection......

Spl/\j
cjack
01-06-2002, 04:36 AM
Thanks for the suggestions, they will be precious!!!
Hide softice under Windows2000 interest me A LOT because I hate Win98 and I work everytime on 2000...... Now I go to play with BI-TT-ARZ bugs......see you soon!!


TZ-Strip Poker 2 cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > TZ-Strip Poker 2 cracking
PDA

View Full Version : TZ-Strip Poker 2 cracking

nop-erator
01-04-2002, 05:02 PM
Hi,

I can't understand why my previous post was closed. Obviously the reason is, that most parts where in german. seems that someone hasn't seen the translation of EVERY german post! The reason i or someone else (silberfuchs) posted in german was, that silberfuchs doesn't speak english very well, and that's why I always added a translation!

anyways, i just wanted to tell you, that i've found the correct adresses for a crack and even for a TRAINER!! :D
The crack makes the program a full version, and with the trainer you'll have the possibility to set the girl's money, and you can activate an option that allows you to win ALWAYS! I'm sure that you all know what that means......hehe :D

Now to Silberfuchs (and the other, too, of course): I also would like to get a valid serial. can you point me to some important addresses?

btw: the trainer and crack will be out tomorrow (saturday), or sunday. it will be downloadable from my website (h**p://noperator.de.vu). I'll also update this post if it will be finally released.

thank you again.

nop
Kayaker
01-05-2002, 03:28 AM
Well, I guess I should respond to this...

Hi nop,

I can't say anything about the other thread, but as for your 'announcement' in this one, the trainer is a good idea. Why don't you really contribute and write a tut on how you did it? As far as posting that you're going to be providing a crack and giving a link for it, what you do is your own business, but you should know by now this is against board policy. You wanna spread cracks? Keep it on a crack site, OK?

Kayaker
SilberFuchs
01-05-2002, 05:22 AM
hi Noperator

you should just know, where the Serialcheck has to be; it's easy to find, but i don't know, if it's possible to calculate back (=zurückrechnen??)...if not, you can make a little bruteforce :)

go and search ;)

...und vielleicht solltest du dein voriges Posting ein wenig editieren?

jo, ciao
SilberFuchs
nop-erator
01-05-2002, 09:14 AM
hi,

first to Kayaker: after your post I tried the second time to find somewhat that looks like board policy/rules. I can't find anything. Writing a tut about all the stuff I've done is a good idea. But where to publish it? on my website? i don't think that i've enough visitors that it would be worth to write such a big thing. btw: i already wrote an interesting tutorial on cracking a game and making a keygen. perhaps i should publish it on my website nevertheless.

nop
Samneric
01-05-2002, 11:27 AM
In one of your earlier posts in the other thread you said:
> The only interesting location i found was 017F:4114ED.
> There was a loop where something was done with
> the characters, but I didn't understand what exactly.

I thought that you would have gone back there to look again by now, but I guess not. That loop is near the end of the sub that verifies your regcode (after the hyphens '-' have been stripped). The string that you input isn't compared to another string (so you can't fish for a 'correct' regcode) - but it is passed through an algorithm to check it.

The subroutine is at 00411420. It returns 1 (good) or 0 (bad).

I found it easier to understand what is happening by converting the disassembled code to pseudo-C (not fit to re-compile but good enough to follow along with). I've attached it to this post.
nop-erator
01-05-2002, 12:26 PM
thank you very much for your effort samneric! This helped me a lot. It really seems, that it is not possible to "invert" the algorithm to get a valid serial, right? the only possibility would be brute force, wouldn't it?

thanks again. I'm already writing my trainer, but have some problems......

nop
Samneric
01-05-2002, 02:17 PM
Originally posted by nop-erator
It really seems, that it is not possible to "invert" the algorithm to get a valid serial, right? the only possibility would be brute force, wouldn't it?

Not at all! That's how keygens are created - by reversing the algorithm. (Not to mention the sanctioned program for generating valid registration regcodes...)

Unless I missed something, the regcode consists of 2 parts:
1) a 3-digit string at the start of the regcode
2) the rest of the regcode from the 4th char on

Part 1 is handled in the first loop by copying the first 3 digit chars (minus leading zeros) to str2[] and then converting str2[] to a numeric value via _atoi().

[I notice that leading zeros (0x30) are twice omitted from strings submitted to _atoi() - so maybe the programmer is unsure how they affect the returned value??]

Part 2 must begin with "02" and is run through the algorithm in the last loop to create a 'total' number. That total is added to the numeric value determined by Part 1. The resulting value must be evenly divisible by 999.

So you should be able to start with any old recode you want that begins with "02dddddddxxxxx..." and then run it through the steps in the last loop that create a total. Then divide that total by 999. Subtract the remainder from 999 and convert the result to a 3 digit string to tack onto the beginning of your regcode.

But I don't know if the alphabetic string on the end ('xxxxx...') is used elsewhere to contain the registered user's name. I haven't looked into that and I probably won't either. Your choice of targets caused major domestic disharmony here... :)
nop-erator
01-05-2002, 02:25 PM
> Your choice of targets caused major domestic disharmony here...

:D

hmm, at last, it seems to be too difficult for me. i looked at the code in sice again, and compared it to your c-pseudo-code. your exaplanations are pretty clear, but i still don't know how i would keygen this program now. and actually i don't want to know it now. i'm gonna wait some month, improve my cracking skills, and then try it again. I'm sure that will have a bigger effect finally. but anyways, thanks for your help again. I'm gonna choose other targets in the future..... :D

nop


Cracking VOB ProtectCD need Help ! Urgent
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cracking VOB ProtectCD need Help ! Urgent
PDA

View Full Version : Cracking VOB ProtectCD need Help ! Urgent

D°N $iMoN
01-05-2002, 07:33 AM
Ok i have some problems cracking a game that is protected with ProtectCD---'MILLIARDENQUIZ' german game like WWTBAMillionaire(Using ClonyXL it tells me VOB ProtectCD). I read r!sc's tut about cracking Protect CD but I think i do something wrong. R!sc's tutorial was the only tut i found explaining VOBProtectCD unwrapping and rebuilding. Someone know where to find another tut ? Maybe in german ?

General: If I open the *.exe file with a disassembler, there are no commands at all, its blank. I thought maybe it's encrypted and tried ProcDump.....no chance.

Then I tried to do it like it was written in the tut.

1st problem: How to patch SoftIce in memory ? I tried to patch it like it was written in r!sc's tutorial but still: °DEBUGGER DETECTED°
(I've the FrogsIce LogFile if someone want to take a look I'll send it or post it)

2nd. With ProcDump looking for the *.vob files, I can't find any ! (PE Editor--Sections) Only .code/.rsrc/.idata/.data Sections !
Is the file encrypted ? If yes how ? Isnt it ProtectCD ?

Finally: How to use IceDump at all ? Anyone know a good tut ? or can tell me ?

Aight a lot of questions, I really hope someone is able to help me. I'm bored of cracking games with unsafedisc and checking 4 getdrivetype messagebox and all that . I want to get a little deeper in reverse engineering.

ThAnKs To Everyone who might spend his time to help me !!

D°N $iMoN
D°N $iMoN
01-05-2002, 08:37 AM
ADD ON: File Analyzing

insPEctor XL tells: NFO 1.0(Heuristics 5,56%).

I've tried UnNFO 1.0 but it says: File is not protected with NFO 1.0

What the hell is that ?
Viper
01-05-2002, 12:14 PM
Originally posted by D°N $iMoN
ADD ON: File Analyzing

insPEctor XL tells: NFO 1.0(Heuristics 5,56%).

I've tried UnNFO 1.0 but it says: File is not protected with NFO 1.0

What the hell is that ?

try another anlyzer
with that anlyzer if u get a low Heuristic, and it didnt work then its not the right one, i would suggest u try PE iDentifier 0.7 Betain my experance the to together usuly are right on the money :)
D°N $iMoN
01-05-2002, 01:27 PM
I tried PEiDentifier v0.7B------''nothing detected, sorry mate''

but thanks

any other ideas ?
D°N $iMoN
01-05-2002, 01:41 PM
(FrogsIce Logfiles)

=> Dmq
** SOFTICE DETECTION ** code 07, at 0177:009D87F7
Interrupt:68h >eax=00004300h ebx=BFF70000h ecx=009D852Ch
edx=00A04812h esi=00A048AAh edi=00000000h ebp=005BAE44h

=> Dmq
** SOFTICE DETECTION ** code 0B, at cs:10101CAE
Attempting to load: SICE (string ref at cs:00C3FD90)

=> Dmq
** SOFTICE DETECTION ** code 0B, at cs:101022E8
Attempting to load: SIWVID (string ref at cs:00C3FD90)

=> Dmq
** SOFTICE DETECTION ** code 0B, at cs:10102921
Attempting to load: NTICE (string ref at cs:00C3FD90)

FIRST THAT----SOFTICE AND FROGSICE

THEN FROGSICE WITHOUT SOFTICE:
=> Dmq
** SOFTICE DETECTION ** code 0B, at cs:10101CAE
Attempting to load: SICE (string ref at cs:00C3E620)

=> Dmq
** SOFTICE DETECTION ** code 0B, at cs:101022E8
Attempting to load: SIWVID (string ref at cs:00C3E620)

=> Dmq
** SOFTICE DETECTION ** code 0B, at cs:10102921
Attempting to load: NTICE (string ref at cs:00C3E620)

=> Dmq
** SOFTICE DETECTION ** code 01, at 0177:10109F14
Interrupt:03h >eax=00000004h ebx=101340BCh ecx=009D3C75h
edx=00000000h esi=BFF7771Ah edi=101340B0h >ebp=4243484Bh

SEH proc address at cs:1011C944

WHAT SHALL I PATCH TO HIDE SOFTICE ?
XICO2KX
01-05-2002, 02:07 PM
I think IceDump ( http://icedump.tsx.org/ ) also has some neat things to bypass Anti-SoftIce tricks! :)
Try it!

And have you checked R!SC's tutorial on Settlers3, where it teaches how to defeat the VOB protection?
You can get some hints from there! :D
I've sent you the file as an attachment! ;)

Or try this nice tutorial about removing the VOB protection from "America - no peace beyond the lines":
* http://espejo.hypermart.net/tutes/VOB3x.htm
It's in spanish though... :(

I hope I've helped! :)
D°N $iMoN
01-06-2002, 06:34 AM
XICO2KX:

Thank you first for the links. The r!sc tut (i said it above) do i already have. But it is different from the ProtectCd Version that i have. The spanish tut you linked, seem to be exactly the explanation i need. But my problem is: I do not speak a word spanish !

Is anywhere a translation of this tut available ? Any other tuts in ENG/GER ?
XICO2KX
01-07-2002, 07:49 PM
Oh... Yeah! Sorry! :p
I was in a rush when I first read your message and I didn't pay attention to the part where you said you had already read R!SC's tutorial!
Sorry! :p

Anyway, here's a rough translation of that page using Altavista's "Babel Fish Translator" ( http://world.altavista.com/ ):
* http://world.altavista.com/urltrurl?url=http%3A%2F%2Fespejo.hypermart.net%2Ftutes%2FVOB3x.htm&lp=es_en&tt=url&urltext=&doit=done
I hope it helps! :D

But the translation engine is not perfect, so if you still don't anything important, just let me know and I'll translate that part for you! :)
I'm actually portuguese, but the spanish language is similar to the portuguese one, so I understand it rather well! ;)


Soft ice keyboard problem (qwerty to azerty)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Soft ice keyboard problem (qwerty to azerty)
PDA

View Full Version : Soft ice keyboard problem (qwerty to azerty)

froghunter
01-05-2002, 01:40 PM
hello everyone!

i just installed Driver studio 2.6 to have the latest soft ice.
Everything works fine *BUT* my keyboard is an azerty one !
And soft ice use it , like if it was a qwerty one !
Hence "a" becoming "q", "z" becoming "w" and so on..
pretty irittating i must say, especially while setting some break points :)

bpx ;essqgeboxq is not that leet ;-)
i looked on the numega's web site, and found a lil utility in asm
that is used to fix that problem..
Sadly, i coudln't make it work, even the german keyboard file
provided as example doesn't work, so i assume i ain't doing
anything bad!

If someone could help me with that problem, i would be
very happy ;-)

Best regards and happy new year everyone :)

Frog Hunter :)
froghunter
01-06-2002, 09:06 AM
hello

i still miss a solution ;(
noone has this problem ?
it is quite boring to play with the keyboard under soft ice :(

Thx again

Frog hunter
froghunter
01-06-2002, 02:53 PM
salut ;-)

my problem is that my keyboard is an azerty one.
im french ;-)
But, under soft ice, it assumes it is a Qwerty keyboard, so
im fucking pissed!
do you use a french keyboard like me ? :)
i want to use my azerty keyboard under soft ice without any troubles :(

can you help me ?

merci bcp ;)

frog hunter
froghunter
01-07-2002, 06:53 AM
hey!

well, i sort of patched my brain aswell :)
but i dont' like it very much that way ..
I already played with that keycode thingy, but couldn't make it works.
First, im using win9x and the last soft ice.
winice.exe , winice.vxd and dat are in the c:\windows\ folder.

I have been trying to patch it using that file, but it keeps saying
keytable not found, or something similar!
even with the german.key that comes as an exemple ..

i don't know what im doing wrong :(

keycode winice france
or keycode winice germany (from the sample)

i got the same result :(

if someone could try it out, i would really appreciate it!
thx

signing off,

Frog Hunter
sv
01-07-2002, 09:38 AM
Hi Frog Hunter

French ??? ;)

Hexedit your C:\WINNT\system32\drivers\ntice.sys
At b4ee2 you must see SIWK (search if not) and after some data like 'qwerty...'.!!
Yop
You can edit as you want it. Save after & dont forget to recalculate new checksum (.sys'one have to be right).
Use the nice PEditor to do (for example!).

SV
froghunter
01-07-2002, 01:16 PM
Good day :)

>French ??? ;)

yes sir ;)

>Hexedit your C:\WINNT\system32\drivers\ntice.sys
>At b4ee2 you must see SIWK (search if not) and after some >data like 'qwerty...'.!!
>Yop
>You can edit as you want it. Save after & dont forget to >recalculate new checksum (.sys'one have to be right).
>Use the nice PEditor to do (for example!).

oh, i didn't think about this at all.
I have been using the win9x version so the file one has to
edit is : c:\windows\winince.vxd

then it is pretty much the same!
thx for the idea, i didn't even think that would be that simple ;)
i already did a lil patch for further installations hehe ;-)

Amicalement ;P

Frog hunter
B-Boy
01-10-2002, 05:30 PM
well i hope anyone will find this useful.. :)

bye


delphi source code for a patcher
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > delphi source code for a patcher
PDA

View Full Version : delphi source code for a patcher

ON'error
01-05-2002, 04:28 PM
hi and happy new year,
ive seached the web, but it isnt so easy like searchin for keygen source, do you know a tutor or can mail me an example?
would be nice(ive nothin to do).
see you later alligator ; )
stealthFIGHTER
01-05-2002, 05:54 PM
Hi!

Try my web page (Delphi kg tutorials). Or try Crackmes server (you can find lot of sources as solutions there).

Regards,
sF


vb5 cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vb5 cracking
PDA

View Full Version : vb5 cracking

Viper
01-05-2002, 08:33 PM
well I need a litle help with this I've never seen this b4 I came across a program that uses MethCallEngine in the Msvbvm50.dll now I cant find the compare routine also it dont work with smartcheck {runs in smart check but with no info but a repeating timer}.

I tried looking for tutors on this but failed to any that covered this call. anybody got any ideas
Snatch
01-05-2002, 10:34 PM
Is MethCallEngine even an export in MSVBVM50.DLL? If it is disassemble it and look at whats going on shouldnt be too hard. And if it is in the VB DLL then its doubtful that its a protection should just be normal VB generated code that noone has stumbled upon yet.

Snatch
Viper
01-05-2002, 11:05 PM
it is a call heres a clip from quick view

00cc 00101e51 GetMemVar
039c 00109c1b IID_IVbaHost
0063 00109c29 MethCallEngine
0056 00109cb3 ProcCallEngine
00da 00109ca3 PutMem1
00ce 00109c7c PutMem2

this is from ida

ENGINE:0F102FFC public MethCallEngine
ENGINE:0F102FFC MethCallEngine proc near
ENGINE:0F102FFC
ENGINE:0F102FFC arg_0 = dword ptr 4
ENGINE:0F102FFC
ENGINE:0F102FFC sub [esp+arg_0], eax
ENGINE:0F103000 mov ecx, offset unk_F0FE302
ENGINE:0F103005 jmp loc_F0FD243
ENGINE:0F103005 MethCallEngine endp

jumped call...

loc_F0FD243: ; CODE XREF: ProcCallEngine+Fj
ENGINE:0F0FD243 ; MethCallEngine+9j
ENGINE:0F0FD243 push ebp
ENGINE:0F0FD244 mov ebp, esp
ENGINE:0F0FD246 sub esp, 78h
ENGINE:0F0FD249 push ebx
ENGINE:0F0FD24A push esi
ENGINE:0F0FD24B push edi
ENGINE:0F0FD24C mov ebx, edx
ENGINE:0F0FD24E mov [ebp-50h], ebx
ENGINE:0F0FD251 mov [ebp-6Ch], ecx
ENGINE:0F0FD254 mov edx, dword_F10F064
ENGINE:0F0FD25A or edx, edx
ENGINE:0F0FD25C jnz loc_F10356B
ENGINE:0F0FD262 mov edx, dword_F10F06C
ENGINE:0F0FD268 mov edi, [ebx]
ENGINE:0F0FD26A mov esi, [edi+34h]
ENGINE:0F0FD26D mov [ebp-54h], esi
ENGINE:0F0FD270 mov esi, [edi+4]
ENGINE:0F0FD273 mov esi, [esi+14h]
ENGINE:0F0FD276 mov esi, [esi+0Ch]
ENGINE:0F0FD279 mov [ebp-2Ch], esi
ENGINE:0F0FD27C

from what i can see its like this calls all the vb exports
humm i think i just got lost again :confused:
josephCo
01-06-2002, 03:28 AM
You would have a VB5 PCode program on your hands. 2 options for live debugging. WKT debugger and softice (with symbols loaded). With symbols loaded BPX DOEXDISP and that should break you at the first excode that is executed (softice). WKT debugger will have it's own options (it's a nice tool).

Good luck!!

joe
Viper
01-06-2002, 10:03 AM
thanks for the point in the right direction i tried WKT and after the app starts it causes a GFP in the MSVBVM50.DLL so now im off to try SI

later
Viper


Sice + NUM-Key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Sice + NUM-Key
PDA

View Full Version : Sice + NUM-Key

SilberFuchs
01-06-2002, 08:26 AM
hi @all

it's possible to activate the NUM-Key just when Sice start?
probably in the winice.dat?

Kann man irgendwo einstellen, dass automatisch schon der Zahlenblock aktiviert wird, wenn Sice startet?? (also, dass man nicht immer die NUM-Taste drücken müssen)

ciao
SilberFuchs


VTpack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VTpack
PDA

View Full Version : VTpack

PoWeRGuArD
01-06-2002, 01:11 PM
hello my friend

How is unpack VTpack? Where i can find VTpack crack tutorial?

PoWeRGuArD


VB-Bytecodes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB-Bytecodes
PDA

View Full Version : VB-Bytecodes

vbdisease
01-06-2002, 02:35 PM
Hi Folks,

iam targeting a vb3 app and already disassembled it with dodi-disassembler. i found the following code:

[...]
Dim l0070 As New Field
On Error GoTo LE038
If gv01EE = 2 Then
Panel3D1.Visible = True
Exit Sub
End If
[...]

These are the corresponding bytes:

45 49 B6 7E 38 05 32 49 86 2A 34 00 F8 37 6D 39
00 35 2C 00 35 49 3D 38 B0 0E 6E 4A 38 00 72 4C
09 C0 35 49...

I already figuered out, that
494B- No Spaces
4948 = 1 Space
4945 = 2 Spaces
4942= 3 Spaces
4935 = 4 Spaces
4932 = 5 Spaces (thanks to _duke_)

but, hrmm, i thought the compare (the one i want to kill) with
the 2 would have some corresponding byte-code, like 02h.
But its not there. could someone help me by decoding the bytes?

ah i forgot:
EC 35 = End if

Regards!
vbdisease
Snatch
01-06-2002, 04:48 PM
Are you sure thats thats the right code for that pcode area? Haha VB3 newline tokens are quite funny. I am surprised Microsoft got away as much as they did with those little bastard tokens!

Snatch
vbdisease
01-07-2002, 04:36 AM
jo snatch,

its the right bytecode, for sure! But i missed some bytes, sorry.
here they are:

45 49 B6 7E 38 05 32 49 86 2A 34 00 F8 37 6D 39
00 35 2C 00 35 49 3D 38 B0 0E 6E 4A 38 00 72 4C
09 C0 35 49 4A 1F F8 05 45 49 EC 35 ...

so, 4A 1F F8 05 = Exit Sub, nice to know..hehehe.
I also found, that 34 00 = variable gv01EE.

but where the hell hides the compare with 02h??

vbdisease

------
i prefer tolkien, not tokens :o)
peterg70
01-07-2002, 06:48 AM
vbdisease

Best bet is what i do with Java .class files i want to modify.

I Change a byte in the token area and then run it throught the decompiler. Then Compare the decompiled version against the original decompiler version with a text comparer (the one with xtgold is fine).

In this manner i can find the spot to change. I would change the bytes that are 3X to one up or one down. i.e. 37 to 36.

Then run it through the decompiler and check the change in the code.

Note some of the changes will cause the decompiler to crash or stop decoding. Still look at the decompiled file to examine where it got up to.

Hope this helps.
Peterg70
Snatch
01-07-2002, 08:15 AM
45 49 B6 7E 38 05 32 49 | 86 2A 34 00 F8 37 6D 39
00 35 2C 00 | 35 49 3D 38 B0 0E 6E 4A 38 00 72 4C
09 C0 35 49 4A 1F F8 05 45 49 EC 35 ...

Clearly the bytes between the |'s are your compare bytes. I am guessing that it points to constant data elsewhere and that is where the decompiler gets the 2 from. Maybe try to figure out how those could be possible address references? That is the only thing I can think of because as far as I know VB does not do weird things with immediate data. So 0x02 should be 0x02.

Snatch
SargeG
01-07-2002, 08:55 AM
I did this a long time ago. (A VERY long time ago). As I remember, the 02 is not kept as 02, but as a memory address, in which the 02 is stored.

More importantly, I never needed to worry about it. The point of attack I used was the "gv01ee =". I know for sure it is a one byte change to make the "=" into a "<>"; what I don't remember is what the byte change is. If this is a sufficient method for you, I could possibly (emphesis on possibly) look it up, but no guarantees that I even still have my notes.

Also, you could easily make two programs, one with a line:
"x=y", and one with a line "x<>y", then compile both. The one byte difference should be obvious.

If I'm off base with this, then...."NEVER MIND!"

Good luck,

SargeG
vbdisease
01-07-2002, 09:12 AM
thanks ppl,

finally i found the b*tch. :)

as snatch mentioned its between these bytes:

| 86 2A 34 00 F8 37 6D 39 00 35 2C 00 |

The first four bytes refer to the variable used,
the next byte is the smelly one:

F8 = 2

I played a bit with the byte (sounds funny :) ) and found the following:

F8 = 2
ED = 1
E5 = 0

with this my app died..hehehe...
it would be great to have more token revealed..how knows...maybe sometime YOU have to crack a vb3 app!
SargeG, if it takes not to much time, i would be interested in that =/<> change thingie, sorry dont have vb3 to compile.

regards
vbdisease


My New KeygenMe --- Give it a try ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > My New KeygenMe --- Give it a try ;-)
PDA

View Full Version : My New KeygenMe --- Give it a try ;-)

GodsJiva
01-07-2002, 01:46 PM
Aloha...

Just finished coding a nice keygenme, thought some people here might enjoy it!

[Get fixed version from first reply; scroll down]

Smile...
GodsJiva
01-08-2002, 08:33 PM
gahh... PEditor's hardcore realign (just done to save a few bytes :P ) causes random crashes on some machines apparently...

here's the exe without realignment if yr having crashes. its functionally the same as above so if it dun crash for you, dun worry :)

free choccy biscuit for first person to keygen it, btw! ;)
nikolatesla20
08-09-2002, 07:36 PM
As you know, I have been working on this, and I posted some results in another thread.

Anyway, I did spot your hash, now that I think about it, hehheh it's the 32 char string, this is 256 bits.

Thanx for the tip maybe now I can figure it out.

-nt20
GodsJiva
08-09-2002, 07:38 PM
Hehe, have fun :)

Lateral thinking!
nikolatesla20
08-09-2002, 07:39 PM
I would not consider this a keygenme #1, I think its too hard, it would be more like a number 5 or 6 in my opinion...

-nt20
GodsJiva
08-09-2002, 07:39 PM
It was #1 cos its my first. Not rated on any scale :) crackmes.de gave it a 2/10! seemed low :(
nikolatesla20
08-09-2002, 08:47 PM
crackmes.de ?

Well maybe its because they were just cracking it, not keygenning it? Cracking it would be simple, its the keygen ...

Keygenning is just hard for me to get my head around sometimes, I am very very good at unpacking and even code injection (really good at code injection, as my logo indicates), but keygenning just always seems hard for me.

Maybe a person doesn't have to be good at everything...

-nt20
GodsJiva
08-09-2002, 09:24 PM
Fair enough, I'm not complaining... you're only the second person to have a go.

Do whatever you want, whether you're good at it or not, as long as you enjoy it and maybe learn sth :)
banshee
08-18-2002, 09:40 AM
Hi, GodsJiva!
Working on your keygenme. Finally, I think, I'm at the same point as nikolatesla20 described. Just one question: can routine called at 00401639 reversed just theoretically? You said something about md5.
Anyway very nice work ;) I studied a lot working on it.
GodsJiva
08-18-2002, 01:49 PM
I'm glad you're enjoying it and you're learning something, thats what it was made for :-)

That is the md5 call, yes.

All you need to know is that it will produce a hash of whatever is passed to it, there isnt any way to reverse it, the chances of having two similar inputs giving the same md5 output is very very small, and its far too slow to bruteforce.

Oh and also there is no need to brute force it or reverse it.

Welcome to the lateral thinking part of my keygenme :)

Look around!
nikolatesla20
08-21-2002, 10:01 PM
Ok, I am back from vacation, and would not mind MAYBE taking some more time looking at this.

Now, as I explained before, I am not very experienced in keygenning. I've only done one so far, and I used TMG Ripper to rip it and it worked great !

However, I start to get lost in all the instructions after a while, it's not just necessarily the FPU stuff, that's not that hard altogether, just keeping track of where everything is gets frustrating to me after a while.

So, I ask GodsJiva, is there any way you can guide a new guy to keygen like me, with just a few clues in some way to your keygenme.

It's a well known fact you have to start small, and you said this is a keygen #1, so I am starting small, but I still can't get my head around it yet. As you saw before, I got some of it, but I start to get lost after a while. I know that there is some table translation going on (with xlat) , and it appears to do some work on the first 8 chars of the serial. But I haven't nailed down the details.

My gut tells me ever since I started working on this thing, that the md5 hash stuff seems like a distraction. I mean the whole theory behind md5 is that no two message digests will be the same if even a little bit of the input changes. So how can you get the same hash from different user/ passwords? The program compares the generated hash to a hardcoded hash, you would have to have the exact same inputs I would think to get the exact same output, or at least take the input and somehow CONVERT it to a valid input to create the hash...

Can you give me a small trail to get back out of the woods? Not asking for answers, just some hints or clues or something. I realize now that the md5 routine wont be able to be worked with too much...

Thanks either way, I guess...

-nt20
GodsJiva
08-22-2002, 01:54 PM
you said this is a keygen #1

Its only keygenme #1 cos its the first one i wrote! Not on any scale of difficulty!

but I start to get lost after a while.

I suggest you do what I do when I'm keygenning something... take it slow, work out each stage at a time, and WRITE EVERYTHING DOWN!

or at least take the input and somehow CONVERT it to a valid input to create the hash...

*g* You'll like that bit. But as you say, not relevant yet ;)

You were doing well with the equations and stuff... work out exactly whats going on it that section first. How much is input? How much is output? Which bits are lost?

I'm afraid this keygenme isn't very typical of things that are usually keygenned... simply because doing it logically is a head-fuck. In some parts looking at the details is absolutely necessary, in some parts its insane. That's why I made it.

Sorry to be so cryptic but I dun want to give too much away just yet :) Take it slow, write things down, and think think think is my advice.

Hope you had a nice vacation btw :)

Anyone else out there trying this? Hows your go coming banshee?

Smile and Enjoy,
banshee
08-22-2002, 03:59 PM
Didn't have much time, but I'm still alive ;)
Gonna continue on weekend.
banshee
08-26-2002, 09:34 AM
OK I think I've found something interesting:
after comparing two hash strings there is "call ecx", and at ecx there is md5 input string converted to hex. One thing - the string must be valid instructions (4 bytes), it must set eax 1 and return. The most simple is

xor eax, eax
inc eax
ret

but it doesn't seems to be valid. Am I on the right way?
cyberheg
08-26-2002, 09:47 AM
You are correct and it is the only real solution, just remember to encode the message in the correct form (hint: use uppercase) and you're one step further.

// CyberHeg
GodsJiva
08-26-2002, 01:37 PM
Nicely done!

The trick was to look ahead and not shout bruteforce-impossible!!! as soon as you saw the md5 hash :-)

Cyberheg - have you successfully keygenned it?

Smile
nikolatesla20
08-26-2002, 02:10 PM
Yes, I saw too, I did do the look ahead. One thing I have learned while learning to keygen is that it doesn't matter what all math and crap is being done, what matters most is what the program checks for, so you should look there first, which is what I did.

When I first started, I noticed that the return value from this function would never be a 1 unless the call ecx was performed correctly. And this call was loaded from the hash value.

So yes, I saw it too, I just didn't feel like doing anything about it until after vacation. And by then I forgot again about it.

The only problem is the hash is still compared with the hardcoded hash BEFORE it gets to the call ecx.

-nt20
cyberheg
08-26-2002, 03:15 PM
Easy, peasy.

No GodsJiva, I am not entirely done with it because of lack of time.

However I spent part of saturday and sunday on it and would consider myself 95% done. I found out whats worth finding out, rewrote the whole serial check to C and only need to finish reversing a last part of it.
I would say it's not really hard, all it takes is time. As for the md5 hash I got my guess correct in 2nd attempt. Again you don't need alot fantasy of what the program wants.

What makes it more time consuming then other targets is that you wrote it entirely in asm. Normally if it would be written in C there are patterns more easy to recognize and at some points your code could have been optimized better but then again it would only have come to my advantage then.

One thing which annoys me is that the serial check is beeing run every time the dialog is updated. This means whenever you switch window or do anything else it's beeing called atleast twice. This is annoying because you have to enable and disable breakpoints all the time unless you want the program to break whenever it feels like it.

To answer nt20's comments:

I learned the hard way exactly the opposite of what you write. If you overlook all the math and crap and go directly to the end result at some point of time you will wonder how the values ended up like they did. All this work just to go from start again and see how it's performed.

So what if the hash is done before the code is called. You should consider this as a service so you wouldn't have a crashing crackme instead.

// CyberHeg
GodsJiva
08-26-2002, 04:55 PM
Easy, peasy.

Goodie, I was hoping someone would say that so I can make an even more evil kgme number 2...

However I spent part of saturday and sunday on it and would consider myself 95% done. I found out whats worth finding out, rewrote the whole serial check to C and only need to finish reversing a last part of it.

Cool, I'd like to see it in C... I'll pm my email if thats ok with you. Which part are you still reversing? The fp bit?

What makes it more time consuming then other targets is that you wrote it entirely in asm. Normally if it would be written in C there are patterns more easy to recognize and at some points your code could have been optimized better but then again it would only have come to my advantage then.

Not much point optimising sth short like this. And I like asm :)

One thing which annoys me is that the serial check is beeing run every time the dialog is updated.

Hehe, sowwy :)

Hope you enjoyed it.

Smile!
nikolatesla20
08-26-2002, 06:54 PM
cyberheg,

I agree with you that eventually you will have to go back and see how things are calculated, but my main point was - you might go thru all the math routines and calculation routines and then when it gets time to do the comparison, you find out for example that only the last three characters matter.

So like I am saying my point is there is no reason reading thru calculations unless you know they are actually being used. Some of them may simply be for distraction, to drive you crazy trying to work them out. Find out what the program actually wants first, and then go back and see where it comes from. That way you dont waste time on stuff it doesn't care about.

That was what I was trying to say :)

-nt20
cyberheg
08-31-2002, 08:46 AM
OK, finished.

I'd like to either post my source of the keygen or just a valid serial but before I do that I'd like to hear of it's ok. Not that I fear that there is anything illegal about it but I might spoil some fun for others.

// CyberHeg
cyberheg
09-01-2002, 03:41 PM
Ok here is a valid serial combination from my keygen. Hopefully this encourages others to finish it too:

Name: CyberHeg
Serial: JA,7<2 B%$$Q@(^8

// CyberHeg
nofurs
09-01-2002, 04:13 PM
Hi Cyberheg,
I just don't believe my eyes you are giving cracks in here?!?
cyberheg
09-01-2002, 04:35 PM
Heh!
I don't believe my eyes you can't read.

In my opinion a crack is a program which will defeat a comercial program.
If this would be a comercial program I would agree with you and not do it. However there is nothing comercial about this crackme. It was made as a task to defeat and has nothing to do with warez. You can call is "name and serial" or "trial and response" if you like those terms better. It doesn't change anything as there are noone getting unhappy here. I even got permission by the guy writing the crackme before doing it. Ofcourse if the gang behind this webboard feel this is incriminating they are free to remove it but since there are no company behind it and the program was written only to be broken I don't see any problem with it.

// CyberHeg
nofurs
09-01-2002, 04:50 PM
Hi again,
Once a cracker always a cracker ;)
its a crack doesn't matter if its a commercial program ;)
ZaiRoN
09-01-2002, 05:55 PM
hi cyberheg/cluesurf,

it seems just that your argument is ended here; in any case i would want to add two words in order to prevent that other persons join to the argument.

cluesurf, what you have said about crack_release is right but this time it's different; the proggie is only a crackme and (like cyberheg said) it is only planned for being resolved.
i'll leave the name/serial where it is because cyberheg has put it in order to only help the others to solve this keygenme.
i don't like this type of approach but sometimes a name/serial combination can help much more than words...

please, leave this thread only for those who wants to solve the crackme ;)

regards,
ZaiRoN
nofurs
09-01-2002, 06:11 PM
Hi Zairon,
>it seems just that your argument is ended here; in any case i >would want to add two words in order to prevent that other >persons join to the argument.

Dunno maybe its my attitude thats how I feel and if you think its
ok that's settled ;) But a question if everyone cracking other crackmes in this mini project and they post the same thing user and serial what will ya do ;)
ZaiRoN
09-01-2002, 06:30 PM
Hi cluesurf!

>if everyone cracking...what will ya do
i'll ban them!!!

oh, i'm only joking :p
i hope and i don't believe that someone will make it :)

regards,
ZaiRoN


ao2000pr IDATA + IATthunk_tricks KILLER method
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ao2000pr IDATA + IATthunk_tricks KILLER method
PDA

View Full Version : ao2000pr IDATA + IATthunk_tricks KILLER method

evaluator
01-07-2002, 02:11 PM
Hello!
Here I submitted IDATA+KILLERCODE for progg
"Advanced Office 2000 Password Recovery"
dump prog. at OEP(401000).
Paste my IDATA from 19A000h to 19E000h,
in PEDITOR enter values:
IAT RVA: 19A000; SIZE 0000013C
TLS RVA: 199000
Clear relocs.
Now set MY EIP: 0019D600...

Who can, will understand!
Soon I will write little tut, how forever
kill IAT_THUNK based tricks.

PS
Instruction at 59d632 forces jump..
crUsAdEr
02-09-2002, 11:06 AM
Hi evaluator,

Well, this is a long ago thread but i am kinda stuck on DigiSecret
it's 1.1 (build 283)...

I unpacked it, rebuilt IAt normally... the dump doesnt crash like u said but it keeps popping up empty error messages, (1 every second ) and filled up my screen until i kill task!!!!

I think this is a kind of check in DS itself, but i remeber i said sometimes ago about some new AsProtect trick that only activated in DS 1.1 that makes my dump crash, could you explain further?

I downloaded your xdata.bin for APF but i dont have the same version anymore, looking at it din help me much!!!

Thanx,
Hope u still remember this thread :>
evaluator
02-09-2002, 01:39 PM
Here i uploaded for U.
Now upload your IT.TXT and IT.BIN
PEditor values:
EIP 145AD8
IT RVA 155000, SIZE 1A4

PS
this is for DS1.283
crUsAdEr
02-09-2002, 02:01 PM
Yep thanx...

Here is mine...
RVA is 1D2000 , size 194h

Shall try urs after my dinner...
:>... u had no problem at all???

Erm.. how do i attach file???
evaluator
02-09-2002, 02:36 PM
paste in dump at 155000
crUsAdEr
02-09-2002, 03:58 PM
Sorry, i mean how do i upload file???

Hmm urs work fine!!!!!! tink it's cos my IAT is smaller than yours... somehow...

Argh... i tot it's some stupid protection by Tamo again!!! That is the annoying part, u can never be sure whether it's your import table or whether it's some anti dumping trick!!!!
Anyway thanx...

Can you tell me how do upload file so in the future i can upload mine as well:>

Thanx,
evaluator
02-09-2002, 05:04 PM
Compress in zip, then press CHOOSE.
tony b.
02-09-2002, 06:38 PM
hi evaluator,

newbie question: how did you break at OEP? bpm 401000 x
did not work, so i am now waiting for /tracex to finish.
i shall try manual tracing if this does not break in an
hour or two. but please tell us your procedure.

also, did you work with ao20pr_p.zip or ao20pr_s.zip?
(i assume the target is the current one from
elcomsoft.com.

thanks. best regards,

tony
crUsAdEr
02-09-2002, 08:48 PM
Oh okay...

Thanx... I realise that u cant add attachment when u want to edit ur post... anyway here is my IT if you are interested, i guess it's just Revirgin gave me the wrong IAT size and that makes the whole lot difference.. anyway wat was that new AsProtect feature you were talking about?


softice for a newbie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice for a newbie
PDA

View Full Version : softice for a newbie

cornel
01-07-2002, 05:49 PM
hi
Can anyone tell me in a simple understanding english how to use the F-keys in SI.I have read through a few tutorials
but the explanation thy give for like F8/F10 IS UNCLEAR TO ME.
What i like is a sort of example where the function keys can be explain to me.For me it looks as if F8 and F10 do the same thing iDUNNU.
Thanks
T
MTB
01-07-2002, 07:07 PM
cornel
I could be mean and say RTFM but I will not. Go to sandmans site and down load his Softice tutorials. Hint one steps into the code, the other steps over it.
MTB
cornel
01-12-2002, 04:17 AM
Hi
Is there perhaps someone who can give me a link to sandmans website cos i can;t open his site on my server.
Another question i have installed softice but now i can't open acrobat reader the latest version, i must disable softice, restart and then open AR, any suggestions.
I have read through a tutorial crackme2 by Acid Burn, but when i want to check the serial number by d edx it shows me a hello dude message, so where can i see the serial number or what must i do.
Is there someone out there who can perhaps help me.

Thanks
naides
01-12-2002, 07:25 AM
Hi.
Answer to your acrobat problem ( this is a quote from a post made on an acrobat review site):

"Acrobat Reader 5.0 and Acrobat 5.0 refused to load in my computer all of the sudden. They would go loading modules until getting to DOCBOX.API and then stop. I uninstalled and reinstalled the program to no avail. I installed it in a different computer and had no problem. I located the offending file in the plug-in subdirectory of the ap called InterTrust. Then I realized that Adobe did not inter-trusted users with a debugger (Softice) running in their system. by either de-activating the debugger or deleting the distrust folder the reader loads just fine. If this was a security measure, was rather lame. Adobe, why don't you trust programmers?"

So Acrobat has a debugger detection device contained in the folder ....\Intertrust...! delete that folder and acrobat will not mind of your softice.

MTB:
I once went to see a doctor.
The doctor said: RTFM and handed me a thick volume with the title " Harrison's Internal Medicine". I was supossed to learn my way to the lingo, and figure out my problem, and then find myself the solution to it by thoughfully reading the book.

By asking an expert, or a doctor, you try to save yourself the pain, and the re-discovery process of having to invent the wheel again. What is obvious to you is quite difficult for some one else. But do not scorn us, the newbies: We are asking questions, so we are in learning mode.
riPPadoGG
01-12-2002, 10:56 AM
Yea... buddy...
Times are bad.
Adobe is nowadays high on anti-RCE...
Please use IceDump along with S-Ice..

As for difference between F8 and F10, Go ahead and figure it out yourself. Break with S-Ice...go to a "call"...press F8, go to another call press F10. You will know the difference by yourself buddy, believe me.

Anyway best of luck with S-Ice. That is a damn nicely coded tool..

regards
doGG
Snatch
01-12-2002, 11:03 AM
Good example with the book and doctor. I kind of agree. What is even more silly is "RTFM". Do you know how long it took me to discover what it stood for. I thought M=message at first then later learned manual. But anyway here is the appropriate response.

F8=Step(go into a call instruction)
F10=Step(go over a call instruction)

Adobe sucks yo. Now that I know that intertrust trick I am much happier. I was having problems with Softice and Acrobat until I started using the latest version of the debugger and acrobat and docbox.api just didnt load but acrobat worked anyway. Annoying stuff.

Snatch
MTB
01-12-2002, 07:25 PM
naides

I am a newbie, the only way to learn softice is the hardway. I suggest to everyone here you find tutorials by sandman, mammon and fravia regarding softice.

Let see where do I start, the manual if you want to call it that sucks, or just is dated (really dated). The interface reminds me of code I used in the late 70's could do anything you wantted but took 2 years to learn under the guidance of a Sr. Engineer with 20 years experience.

I am currently trying to learn softice by REDOING a crack I did with IDA. Who knows I may learn how to use this hostile program!

As for the value of softice in reversing dongle codes is minimal, IDA is a much better tool in my opinion, not to mention it's a hell of a lot easier to use. My interest primarily is dongle protected software, which typically is easier to reverse than shareware.

May the force be with us in our exploration of Softice.

MTB
JMI
01-12-2002, 07:52 PM
Here's a file that may provide some help in your adventures. Its from the #Cracking4Newbies site.

You'll find the ~Sandman's tuts on the Krobar site. Type Krobar in Google and you should find it without any trouble.

And if Snatch had taken the time to read this:

http://www.woodmann.net/fravia/rce-faq.htm

he wouldn't have been in the dark about RTFM. It and other important and useful information is there available for all who look around.

Enjoy.

Regards.
MTB
01-13-2002, 04:26 PM
Is anyone interested in starting a softice for newbies class? I have a small target that was worked on before on this board. You will new SI (softice) running either using 98SE or NM, not 2K or XP, I am using 98SE.

Just an idea.

MTB


crackme for newbies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > crackme for newbies
PDA

View Full Version : crackme for newbies

cornel
01-07-2002, 06:07 PM
Hi
Can anyone tell me where can i get crackme tutorials cos the crackme.cjb.net website doesn't work.I don't want to download large programs to start with.
Thanks
Viper
01-07-2002, 07:40 PM
try searching this fourm for the new crackme web sight
ZaiRoN
01-08-2002, 06:24 AM
try this: h**p://www.crackmes.de/

ZaiRoN


Help a newbie plz :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help a newbie plz :)
PDA

View Full Version : Help a newbie plz :)

Flack
01-07-2002, 08:08 PM
Hey guys,
Im new here and would love it if someone could point me in the right direction, i.e. where should I start? (preferably some simple tutorials)
I have softice and w32dasm (im not sure if they're the latest though).
What other tools should i look for?

Anyway, Im looking forward to learning a lot here. :)

Thanx

Flack
Viper
01-07-2002, 08:41 PM
get smartcheck for vb apps
also doa search on this fourm and on a search engine like google ie: cracking tutor
Snatch
01-07-2002, 09:14 PM
OK here is your list. At least with this I have no trouble with the targets I am interested in of course I am weak in unpacking and IAT/PE rebuilding but maybe someone can complete my list.

IDA 4.15 Advanced Registered (4.17 Standard Registered is incomplete but might do too) from Datarescue
Driverstudio 2.6 from Numega
Resource Hacker 3.3.3
WinHex latest version

This is enough for me for the most part of course I have more tools but these are the fundamental core tools that almost all jobs require. Everything else is a little more specific.

Snatch
Viper
01-07-2002, 09:24 PM
for unpacking i would say get
revirgin
pe-editor or procdump
icedump {for your version of softice}
quick view {makes a neat list of imports used by the app}

have fun
Viper
MTB
01-08-2002, 06:34 PM
Hiya Flack
At the bottom of the RCE bulletin board is a link to Fravia's old site. Down load and read, then down load some more. There is a ton of stuff there! Hopefully in a few weeks we will see a zipped version of crackz's site which will complete your training. This will take a while, my first dongle crack took almost 6 months (ok some time of in between stuff), the second one took only 1 month, the third took 2 weeks.

Good Luck
MTB
JMI
01-08-2002, 07:31 PM
Flack:

Welcome. There was a thread from another member not too long ago where the same general question was asked. There was some good pointers provided by several members for one starting our and what one needed to study to get up to speed. Check it out.

The best advice I can give is don't try to jump in with both feet without acquiring some basic background knowledge first. I know it's hard to not start cracking Asprotect protected targets the first day, but there is alot of "learning" that goes into understanding what the heck one is doing, even when just following somebody's tutorial. Anyway, give this thread a read and go from there.

Good Luck.

Regards.

http://www.woodmann.net/forum/showthread.php?threadid=2375
matthew
01-08-2002, 07:51 PM
Hey thats me!

Give me a minute and i'll add a post to this that has all the links and tools i've gotten.
Snatch
01-08-2002, 08:14 PM
Oh ya just as an obvious duh. Go learn assembly language. Before I even bothered learning to crack I knew how to program some cool asm programs. The problem with newbies on these boards is they want to jump right in. You need to take 3 steps back first and not even think about cracking which is very difficult to do. If you want to crack anything and actually know what you are doing then I suggest buying a book on assembly language does not have to be windows but just assembly in general.

Snatch
matthew
01-08-2002, 08:23 PM
Tips and stuff - by a newbie, for uber newbies. - matthew (w)

Links:
http://fraviamb.cjb.net = RCE messageboard.. this one.
http://win32asm.cjb.net = Win32 asm tutorials, useful to know
http://board.win32asmcommunity.net = Dont ask for cracks. only for learning win32asm
http://tsehp.cjb.net = maintained still i think... essays and such
http://msdn.microsoft.com = for looking up functions, under windows ... win32 api reference
http://protools.cjb.net = tools you need
http://softice.tsx.org = softice for 9x and nt
http://www.exetools.com = forum and cracking tools, their ftp has the latest stuff. get password from the message board
http://astalavista.box.sk = compare your cracks to theirs
http://icedump.cjb.net = addon to softice, dump screens, listen to music
http://cracking4newbies.cjb.net = faq for cracking and softice
http://www.wotsit.org/ = right link i think. try .com .net .. file formats listed
Find some crack me sites. dont remember the links.
Those are off the top of my head, might have forgotten something.

Tools:
Procdump32 (dump process' to disk)
Icedump (add functions to softice.. dump screens and play music)
Softice/Driver Studio (debug at the hardware level if you wish)
File Analyzer (shows some usefull info about files)
DumpPE (dumps PE stuff, info... )
FileMonitor (monitors programs' access to the file-related api(?)
RegistryMonitor (monitors programs access to the registry)
ResHacker (basic functional resource editor)
W32dasm (win32 dissassembler. make dead listings)
IDA (same, generally)
SoftSnoop (api monitor)
FrHed (freeware hex editor for windows)
UN-PACK (good unpacker, alternate to procdump, but different)
Masm 7 package (by hutch, if you want to learn to program)
RadAsm (IDE for programming win32 assembly. bit new but very good)
Revirgin (more advanced. i dunno how to use it, good for api and pe)

Documentation:
Platform SDK (from MS.. tonnes of info. function lists, like msdn)
ID-RIP (get the whole site from somewhere, follow along with the tutes)
Sandman's tutes (find them somewhere. follow along too, thats how you learn)
Win32asm by iczelion (win32asm tutes)
Other misc tutes for win32asm (explain some PE, odbc, etc)
Find more essays for cracking at tsheps site

Tips:
Put a big cork board next to your computer to pinup not only deadlistings, code, functions, and addresses, but playboy women.
Get an electric kettle and a stack of instant noodle (mr. noodle or ichiban, whatever). get a water cooler for the kettle, or just keep some water nearby so you can eat at all times when you cant make it into society.
Coffee machine if possible, drinking more than 200 cups within a day might kill you though.
Toilet in room. If possible have it done. Cannot leave computer always. Use a bottle for those times when you cant get upstairs at 3:00am or you'll wake your parents.. sad but true.
Jolt Cola. its like coke/pepsi (cant really think of which) and coffee, the ultimate drink. hard to find here in canada at least
Learn to spell. Talking on message boards with bad grammer and spelling looks bad. If you really suck say you speak another language.

More realistic tips:
Keep a notepad handy, pen too.
Just follow through the tutorials, you'll pick stuff up.
If you dont succed, take a break, then try again.
If you keep failing, wait a while, then try again with clear memory (sleeeep). Or just move on and dont get frusterated. But come back later.
Learn assembly. Maybe not right away, but sometime. Usefull to make patchers and keygens too.

There, a generic list of things to help newbs. just refer them to this from now on :) add to it too if you want, i'm only a newb myself.
Kayaker
01-08-2002, 10:06 PM
matthew, that's one of the funniest things I've read in a long time! And it's all true :)

You forgot the tip about working on your computer on an exercise ball so you can keep yourself in shape to spend hours in front of the computer.

Cheers
Kayaker
matthew
01-08-2002, 11:51 PM
Yeah :) I still need something other than a bottle.. and a water cooler. My Slushie cups are decent for water storage, however.

I'd like an exercise bike for in front of the computer.. If it has decent handlebar/console you can lean on it, and they are comfortable. And I'm not kidding, lol!

Have a good day ;)
Aimless
01-09-2002, 01:32 AM
You might try looking at:

www.eccentrica.org/Mammon/ (a very respected cracker/hacker...and beyond)

where he explains the basis needed for cracking.

However, before you read that site, you need to understand your priorities. What do you want to be? A cracker or a reverse-engineer. If you are looking at the first, then the site is OK.

else if you are looking for latter, you might try searching on google for "Christina Cifuentes" (a PHD in reverse engineering and decompilation).

I would suggest you try out the "cracking" bit first.

My idea of study would be:

1. Cracking password protections. Winzip is easy enough.
2. Cracking Time limited protections.
3. Cracking CD access protections.

You will learn your MOST from these 3 things. Then you can move to intermidate stuff like:

1. PE file format
2. Compression
3. Private Encryption

and maybe subsequently to advanced like:

1. Public Encryptions
2. Dongles
3. Hardware/Systems Programming

The tools you MUST have are:

1. Softice (4.05 version. All around the web. Just search)
2. IDA 4.04 advanced version (all around the web. just search)
3. Filemon (freely available on www.sysinternals.com)
4. Regmon (same site)
5. W32dasm (all around the web. and then some!!)
6. ResHack (from www.programmerstools.org)
7. Psedit or Hiew (same site above)

Do not try to get into details like Procdump or even use Icedump for Softice. You WILL get confused. Go a step at a time..and you progress will be FASTER than most.

Epilogue: Try using FrogsICE before you start running any program. Find it on www.programmerstools.org

...Have Phun
Flack
01-09-2002, 05:25 PM
Wow, thanx for all of the tips guys!
Looks like I have a long, exciting road ahead of me :)

Flack


IceDump and driver studio 2.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IceDump and driver studio 2.5
PDA

View Full Version : IceDump and driver studio 2.5

matthew
01-08-2002, 03:46 AM
How do you use IceDump with Driver Studio 2.5.0 build 240?
donMAMAvomito
01-08-2002, 08:21 AM
greetings dude

the latest version of icedump i know of 6.0.24..

support

w9x - 4.2.1 build 530

nt/2k/xp - 4.2.5 build 785.. (shipped with Driverstudio 2.5 RC1)

so it might work for u ...try it out..

else use driverstudio 2.0..(full support included by icedump for 9x/nt/2k/xp)

or else

wait for some more time..the icedump team will release the new version supporting DS 2.6.. ;)

hope this help u..

best regards
donMAMAvomito
froghunter
01-08-2002, 08:37 AM
heya

icedump already supports DS 2.6 ;-)
greetings,

frog hunter
donMAMAvomito
01-08-2002, 11:35 AM
greetings

hmm..u are probably right..

is softice 4.2.5 build 785 is what ships with DS 2.6..coz i dont have a copy yet..

i still use softice 4.01 + icedump and it has served me very well for a long long time and prolly will for time to come

anyways..sorry if i have misled somebody..

best regards
donMAMAvomito
Dinetti
01-10-2002, 05:10 AM
Latest Version 6.025
hxxp://icedump.tsx.org
(Danger: Crazy Popup Cascade)
Good Luck Dinetti
ON'error
01-13-2002, 04:53 AM
why should i use driver studio, cause i've got no problems without?


DriverStudio 2.6 + XP problems again...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DriverStudio 2.6 + XP problems again...
PDA

View Full Version : DriverStudio 2.6 + XP problems again...

WARM3CH
01-08-2002, 06:16 AM
Hi you all,

Well I guess this is not a new issue, yet I could not find any answer for the problem so I started this thread.

I've installed DriverStudio 2.6 and SoftICE do not break on any program's OEP and also I have problems with breakpoints (like bpx MessageBoxA).

I've heared that some ppl did not face these problems; so the question is: "What's wrong with the new SoftICE? In what situations it works and in what situations it does not?"

I've been working with SoftICE from the old DOS days till now so I'm quite familiar with the settings so I don't think I've missed anything "obvious"...

Anyone can help?
hobgoblin
01-08-2002, 11:47 AM
Greetings,
I wish I had some solution for you, but unfortunately I have some problems on my own. Sice breaks on bpx MessageBoxA on my machine. But when I hit F11/F12, it gets redirected into code oblivion someplace...
A question: Does Softice, when you use the loader, break on program start? I have tried all the settings possible, but it never breaks, no matter what kind of program I try to load.
It has been awful quiet about any problems when running Softice on XP.
What about the rest of you guys? Does it work perfectly on your computers?

regards,
hobgoblin

PS. I know others on other boards have experienced problems similar to ours, but they haven't been able to sort it out.
WARM3CH
01-08-2002, 12:10 PM
Hi,

The same problem here. It does not break on program load, no matter what the program be.
About F11/12, I've read about this problem in this forum, and as far as I remember, there was a suggestion to manually set a break point on ss:esp and then pressing F5 instead. Yet I think all these problems have things in common and there should be a solution that fix them all. I'm sure there is a solution as NuMega released this version exclusivly to support XP, and now it has so many problems...

Regards
WARM3CH
_Servil_
01-09-2002, 06:25 PM
CONFIRMATION ;((

and more... the loader doesn't load proggy w/out debug info...
silly.

btw, to bpxkpoints: if i set breakpoint manually in debugged app it works, however _some_ API calls are _sometimes_ working, it's exactly same as with ds2.5.
looks like another 50mb of wasted download.. ;(

..and next issue: after finishing& restarting debugged app all breakpoints set within it's code are deleted, of course I can kick'em back there from history, but it's not too comfortable (usually by this step i'm loosing clue and have to start from beginning :D)
LordCrass
01-11-2002, 09:47 PM
I have similar problems with 2.6, but no problem with breakpoints being wiped after a prg is closed. However, breakpoints do seem to be ignored randomly sometimes and a bd/be seems to fix the problem for a while.

The other problem I have (and more severe) is that a CTRL+D will sometimes reboot the entire system with no warning.
Nodens
01-13-2002, 08:16 PM
i tested ds2.6 on two different computers running winxp and i eXPerienced some problems :'( Here's my 2 cent :

- Loader doesn't load target (just says no debug symbol)
fix : go to module/settings, tab debugging.Reload cool it works now ;) Seems something isn't good initialized before enterring this window ?

- Loader doesn't stop at winmain. I tried PeEditor (put CC to entrypoint) but it doesn't break neither. I verified 'faults' status is 'ON'. When i generate an interruption it breaks ('GENINT' command). When i generate an interruption without faults == on it crashes doh ;)

note : i tested if it was something to do with softice startup (boot, manual, etc......) but it doesn't seems to.

anyhelp appreciated !! :)
ThrawN
01-14-2002, 09:38 AM
I had weird problems also, bp's being cleared and the like (same as you guys) and also random chance of sice resetting apon entering.
Break and Enter no longer works either :\

Just have to improvise


G6 FTP server
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > G6 FTP server
PDA

View Full Version : G6 FTP server

jomamameister
01-08-2002, 09:26 AM
hello all,
i'm looking for some guidance in finishing this unpacking project on the g6 ftp server.
what i have done:
1. unpack file through dumpfx
2. used revirgin 1.2 to create an iat resolved .txt file
3. not all references are resolved, they are simply zeroes or numeric references to a module that doesn't show up in the modules listing in revirgin when the proc is running.
4. used revirgin to insert this mostly resolved file into the end of the dumped.exe

of course, it still does not work.
most importantly, i seem to be missing the new oep for the unpacked .exe, as it is exactly the same as before
any suggestions for me to try next to retrieve the new oep and to get these possible references to an obscure module? or anything else i may be leaving out.
thanks,
jomamameister
Js
01-08-2002, 10:04 AM
Hi,
Can't help with the unresolved iat as I didn't on this occasion use
rv. Problems when resolved are around Getmodulehandlea and it checks the file size with FindfirstfileA. Erm not much help at all really sorry about that.
regards
Clandestiny
01-08-2002, 11:06 AM
Hiya,

G6 ftp, eh? ...That app brings back *bad* memories ;) Indeed, this is quite a difficult Asprotected prog to unpack using a number of Alexy's most recent tricks. Suffice it to say, I found the OEP unpacked it, and rebuilt the IAT but it never actually ran correctly. I kept getting some weird stack corruption that I never could figure out and patching the crash points only led to more crashes. This was actually the first AsProtected app I ever tried and I wouldn't have even made it as far as I did w/o some help from Kayaker. Indeed, he sent me quite a nice, *detailed* explanation for manually unpacking Asp apps. I don't think he would mind if I shared it here ;)

-------------------------------------------------------------------------------
Original explanation follows...

Finding the OEP

1. Start Icedump and load the app
2. Display the address 401000 in the data window
3. Set a bpx VirtualAlloc, press F5 around 11-13 times until the code at 401000 changes and is recognizable (for this Delphi app it will be easy)
4. As soon as the code changes set a bpx GetProcAddress. Press F5 until it breaks (will be 2 or 3 more VirtualAlloc breaks first)
5. As soon as GetProcAddress breaks, press F12 about 3 times until you see:

0167:011FF984 AC LODSB
0167:011FF985 80F800 CMP AL,00
0167:011FF988 74DD JZ 011FF967
0167:011FF98A 80F806 CMP AL,06
0167:011FF98D 7506 JNZ 011FF995
0167:011FF98F 8345F804 ADD DWORD PTR [EBP-08],04
0167:011FF993 EBEF JMP 011FF984
0167:011FF995 53 PUSH EBX
0167:011FF996 56 PUSH ESI
0167:011FF997 53 PUSH EBX
0167:011FF998 8D5DF8 LEA EBX,[EBP-08]
0167:011FF99B 53 PUSH EBX
0167:011FF99C 80F802 CMP AL,02
0167:011FF99F 7406 JZ 011FF9A7
0167:011FF9A1 0FB60E MOVZX ECX,BYTE PTR [ESI]
0167:011FF9A4 41 INC ECX
0167:011FF9A5 EB05 JMP 011FF9AC
0167:011FF9A7 B904000000 MOV ECX,00000004
0167:011FF9AC 01CE ADD ESI,ECX
0167:011FF9AE E8C1FCFFFF CALL 011FF674
0167:011FF9B3 5B POP EBX ; return from GetProcAddress
0167:011FF9B4 EBCE JMP 011FF984
0167:011FF9B6 61 POPAD
0167:011FF9B7 E83A000000 CALL 011FF9F6

The loop from 011FF984 to 011FF9B4 is consistent in every Asprotect app and is where the IAT is decrypted. You can trace through this loop as many times as you like checking out how each API is decrypted.

6. AS SOON as you reach the above code after the 1ST GetProcAddress, display EDI, this will be the IAT Start. Each Import address is inserted starting here. Some of them will be regular API addresses (i.e. BFFxxxxx), but most of them will be redirected. Revirgin or Imprec will trace and rebuild most of these later.

7. Disable all breakpoints. To continue tracing manually you need to get out of the loop. Do this by setting a bpm on the call after the popad:
BPM 11FF9B7 X
If you now check the address in EDX, this will be the END of the IAT. So you can get the Length of the IAT by subtracting this value in EDX with the earlier one in EDI. *Sometimes* this doesn't hold, you need to check the IAT in the data window and see if it all makes sense.

8. I could tell you how to continue tracing manually from here to find the OEP, and it's actually good to know, but from here you can just set the /tracex. Some Asp apps break in the .code section *before* the real OEP. With G6ftp the 2nd /tracex break IS the OEP. Dump it as soon as you reach it with
/dump 400000 170000 filename

OEP = 503ee4
170000 = size of file

9. Use PEditor to change the OEP to the proper one, make VA=RA and VS=RS for each section, and change the code characteristics of the 1st section to E0000020. If you've done this right, the icon should now show.

10. Use Revirgin or Imprec to rebuild a valid import table and attach it to the end of the file (at hex offset 170000).

11. There's a bunch of other issues since RV/Imprec will not resolve all the API's. This is a (series of) Asp tricks that is easy to fix, but will require several more paragraphs to explain ;)
Clandestiny
01-08-2002, 11:10 AM
...Explanation Continued...

Rebuilding / Resolvign the IAT:

There are 11 unresolved entries with RV. The 5 ones labelled to_Resolve can be Traced with EnableTrace/Trace. The trace function seems to actually work with this version! The API address should resolve, but the name doesn't. I use Exescope to match up the addresses with the names, then edit in the dll name and api name. If you select ResolveAgain the Hints column should update correctly.

These 5 entries are usually duplicate GetProcAddress and GetModuleHandleA. This used to be the extent of Asprotect tricks, now you have to deal with the other ones on the other 6 IAT entries.

20 0010D208 011FC468 0000 ?????? to_Resolve
21 0010D20C 011FC818 0000 ?????? to_Resolve

25 0010D21C 011FC86C 0000 ?????? ??????

63 0010D2C4 011FC818 0000 ?????? to_Resolve

105 0010D374 011FC874 0000 ?????? ??????
122 0010D3B8 011FC834 0000 ?????? ??????

130 0010D3D8 011FC468 0000 ?????? to_Resolve
132 0010D3E0 011FC818 0000 ?????? to_Resolve

147 0010D41C 011FC864 0000 ?????? ??????
148 0010D420 011FC85C 0000 ?????? ??????
150 0010D428 011FC87C 0000 ?????? ??????

Should be:

20 0010D208 BFF76DA8 01A3 KERNEL32.dll GetProcAddress
21 0010D20C BFF77716 018D KERNEL32.dll GetModuleHandleA

25 0010D21C BFF8C5DA 0149 KERNEL32.dll GetCommandLineA

63 0010D2C4 BFF77716 018D KERNEL32.dll GetModuleHandleA

105 0010D374 BFF92F1B 01DC KERNEL32.dll GetVersion
122 0010D3B8 BFF92F1B 01DC KERNEL32.dll GetVersion

130 0010D3D8 BFF76DA8 01A3 KERNEL32.dll GetProcAddress
132 0010D3E0 BFF77716 018D KERNEL32.dll GetModuleHandleA

147 0010D41C BFF84948 015B KERNEL32.dll GetCurrentProcessId
148 0010D420 BFF96347 015A KERNEL32.dll GetCurrentProcess
150 0010D428 BFF92F1B 01DC KERNEL32.dll GetVersion

--------------------------------------

There's part of the unpacking code that has this routine:

0167:011FC7D8 6A00 PUSH 00
0167:011FC7DA E82D7CFFFF CALL KERNEL32!GetModuleHandleA
0167:011FC7DF A3D4352001 MOV [012035D4],EAX
0167:011FC7E4 E83B7CFFFF CALL KERNEL32!GetVersion
0167:011FC7E9 A3D8352001 MOV [012035D8],EAX
0167:011FC7EE 68E4352001 PUSH 012035E4
0167:011FC7F3 E8347CFFFF CALL KERNEL32!GetVersionExA
0167:011FC7F8 E8DF7BFFFF CALL KERNEL32!GetCurrentProcess
0167:011FC7FD A3DC352001 MOV [012035DC],EAX
0167:011FC802 E8DD7BFFFF CALL KERNEL32!GetCurrentProcessId
0167:011FC807 A3E0352001 MOV [012035E0],EAX
0167:011FC80C E8C37BFFFF CALL KERNEL32!GetCommandLineA
0167:011FC811 A378362001 MOV [01203678],EAX
0167:011FC816 C3 RET

The values returned from each of these calls are stored in variables that the program accesses later on after it's unpacked, rather than making the calls directly. There's a few ways you could approach the next problem.

You could trace in packed and unpacked code to find where the call to the variable is made and change it directly to a Call to the api, opcode bytes are preserved.

Or write yourself the return value in unpacked code somewhere and change the call address. You might have to do this if the app is really tricky and runs some code that is *only* in unpacking code, you'd need to duplicate the code.

I've learned that the easiest way is to access the memory of the original proggy and unassemble the redirected address pointed to in the IAT. Then decide what API name and address you want to set each unresolved IAT entry to and edit it into Revirgin and then update the .bin file. I set a break on some early api like GetStartupInfoA so it breaks in unpacked code and then unassemble each address.

Take the 1st example:

25 0010D21C 011FC86C 0000 ?????? ??????

:u 11FC86C

mov eax,[1203678]
ret

[1203678] = 8171AD30 ; return value from GetCommandLineA

That's it for the redirected code that's there. Knowing this you can go back to Revirgin and edit in the name and address for this api.

2nd example:

105 0010D374 011FC874 0000 ?????? ??????

:u 11FC874

push ebp
mov ebp, esp
pop ebp
ret 4

This is another new Asprotect twist, a short piece of garbage code made only to confuse Revirgin et al. What I do is replace the api with something that pushes no parameters, such as GetVersion. Or you could just nop out the call in the unpacked code. If I remember correctly, ALL of above 6 unresolved entries can be replaced with a simple ret. I think in most cases the api return value is never used in any important code, this is just an Asprotect routine that comes up all the time now.

There is another one that's kind of interesting. FindResourceA, Load/FreeResource, are also other unresolved apis that come up sometimes. These caused some problems with Revirgin because FindResourceA is a Kernel32 function that was grouped with the User32 calls. The rebuilt file wouldn't even load with this one.

Once you've edited in all the missing api's, create a new .bin file ready for pasting. There's an auto-fix feature in RV, but I've never used it, I like to do everything manually so I know exactly what is going on. Uncheck the Autofix Sections feature and set the IT RVA to the end of the file (170000), then click IAT Generator and create a .bin file ready to be pasted into your file at 170000.

Then use PEditor to add a section (I call mine .kayaker of course ;), and manually insert enough bytes to the end of your dumped file to create a section large enough to hold the .bin file. (I used 3000 filled with 0's). Then just paste it in.

You still need to fix up the pointer to the IAT table and its size in the PE header. This is at offset PE+80

00000180 0000 1700 7C01 0000 ....|...

which points to RVA 170000 and size 17C. (The size isn't really critical). Notice why I like doing raw dumps to work with rather that using Procdump or whatever. WYSIWYG when it comes to raw and virtual addresses, makes rebuilding the file so much easier. You can always repack the file with Asprotect if you want ;)

Now if you're really lucky the proggy should run as is. In many cases however you may still have some work to do, this depends on what the programmer has implemented. There may be crippled functions and there may be a nag. There may be something else happening that causes a crash which you need to ferret out. Asprotect has options to be set as a time trial and/or requiring a keyfile. Or the programmer may have used his own protection routine.

There's 2 interesting things that happens when you skin Asprotect alive like this (I've used the phrase Like peeling a banana). If it's set as a time trial, the #days you have left at the time you dump it will be hardcoded into the dumped file. I've dumped at 1 day and 30 days left in an app and was told so by the nag box. Then I compared the 2 files and saw where that was stored. (Just don't change it to 00)

The other thing is that the registry, where the CLSID value is stored, is no longer read. This was all done in Asprotect code and this is where is checks your days left/key code. You can set a bp on RegQueryValueExA and break in unpacking code and watch it happen.

To prove that Asprotect code is no longer used, try deleting those sections at the end of the file and rebuild the PE header to reflect this. You can clean out a lot of the crap and make the file smaller this way. You need to make sure your IAT is referenced to the correct address of course.
Clandestiny
01-08-2002, 11:14 AM
...Explanation Continued...

Runtime Errors / Crash Points:

503ee4 is the OEP. Sort of ;)

This is why I like to trace manually, so there is no discrepancy. I think I mentioned Asp sometimes goes into program code to do some nastys before the OEP. This is one of those times ;) I just didn't follow up by manually tracing or doing another /tracex as you did.

As soon as I changed the OEP the program started crashing with Runtime errors. I remember this as a familiar thing I first came upon in Chameleon Clock. We had a thread about it. I found this weird solution to dump the file only after BYPASSING that piece of unpacking code that jumps into program code which seemed to be causing all the problems.

4C894C is where /tracex 1st broke after the IAT decryption routine. The CS:EIP indicated it was called from 12008F9.

0167:012008F0 833D8035200100 CMP DWORD PTR [01203580],00
0167:012008F7 741E JZ 01200917
0167:012008F9 FF1580352001 CALL [01203580] ;4C894C
0167:012008FF 8D95CCD7FFFF LEA EDX,[EBP+FFFFD7CC]

So if you change 4C894C to a RET (or bypass the jz) you immediately return back to 12008FF without the code having been run. Then you continue tracing (or use /tracex again) to the real OEP at 503ee4 and dump the file.

-----------------

Now what did this do? If you check the code at the Call EAX where you saw it crashing:

0167:00403A9C 8B04DF MOV EAX,[EBX*8+EDI]
0167:00403A9F 43 INC EBX
0167:00403AA0 891DB0745000 MOV [005074B0],EBX
0167:00403AA6 85C0 TEST EAX,EAX
0167:00403AA8 7402 JZ 00403AAC
0167:00403AAA FFD0 CALL EAX
0167:00403AAC 3BF3 CMP ESI,EBX
0167:00403AAE 7FEC JG 00403A9C

You see that it cycles through EAX. ESI is the #cycles (6D) and EBX is the counter.

If you DON'T bypass that piece of unpacking code, the cycle crashes at EBX=0D when EAX=40F604. Now you can step into each EAX and you notice many of them are simple RET's. So if you replace 40F604 (hex offset f604) with a RET, the routine returns gracefully.

Or, check out the jump table pointed to by
MOV EAX,[EBX*8+EDI]
and change the address there to 00000000. If EAX=00000000, the JZ statement skips over the Call EAX.

If you DO bypass that piece of unpacking code and work with that dump instead, the EAX cycle continues on past EBX=0D (and others) and doesn't crash until EBX=31 (EAX=4712f8). This doesn't sound too great, but it does sort of show the kind of thing Asp does, and how you can fiddle with it.

Now bypassing that piece of unpacking code doesn't solve all the problems. You still need to treat each crash point individually, usually by changing the call to a RET.

I found the program crashed when EBX was 31,32,33,34,35, 51,54, 6a,6c.
For 31-35 I either changed the 1st byte of the address to C3, or I changed the value in the jump table pointed to by [EBX*8+EDI] to 00000000.

Same with 51,54 and 6a,6c. The only problem is I got a bad system crash. I think there may be an import problem still, I'm not sure if RV really got them all. You know the GetProcAddress calls in the IAT encryption routine? The last one is the last IAT address processed, and I think RV may have missed some. It "finds" the end of the IAT by looking for 00 terminators. But Asprotect may scatter the IAT addresses a little further or try to hide them.

Or maybe you just need to patch it differently. I used RET's, and in many cases this is all you need, but maybe some of the code is necessary and you need to trace a bit further before changing something to a RET.

Who knows? At this point of rebuilding all bets are off. I don't really know what all these screwed up calls really do. Some can be ignored by using a RET, maybe others are critical. This is cutting edge Asprotect, so your mode of attack is as good as any. I just want to give you an idea of what's going on, it's hard to be definitive with any one program.

I found I could set a BPM on
0167:00403AAA FFD0 CALL EAX
in the *packed* file as well, so you could always compare the routines with the unpacked version, even bypass some of them to see if they are really critical to running the program. (I used the 'if ebx==xx' qualifier on the bpm for easy tracing)

Heh, see why I don't crack much anymore? I've had my fill of Asprotect and unless I *really* want the program I won't bother jumping through its hoops except to keep my hand in it. I've been able to patch several Asprotect apps this way, but I've still got a few I could never patch fully, it just depends on how lucky you are and how much work you put into it.

BTW, to trace to the OEP manually: remember the jmp [ebp-14] at 11ffe6c I mentioned? Set a bpm here and trace into it, F8 single step everything. There are about half a dozen short loops that you need to get past before the OEP at:

0167:01219E00 8944241C MOV [ESP+1C],EAX
0167:01219E04 61 POPAD
0167:01219E05 FFE0 JMP EAX ;real OEP

Just keep a close eye on the SMC code and see where you can exit the loops, then set advanced bpm's until you see the above code.

----------------------------------------------------------------------------------

Maybe this will give you some ideas or at least get you started in the right direction. Like I said, I never could resolve the runtime crash issues in the dumped & rebuilt app. Finally, I got boored and opted for the registry CLSID hack. If you make any more progress, I'd be very interested in learning what the source of those crashes are.

Cheers,
Clandestiny

PS:

Hey, Kayaker... You *really* should publish this as a tut ;) IMO, its one of the best step by step explanations of Asprotect I've ever ran across. Hope you don't mind that I shared the wealth :D
jomamameister
01-08-2002, 11:44 AM
thanks to all. i will read these teachings carefully and keep persuing this and let you know. this has given me food for thought.
jomamameister
evaluator
01-08-2002, 01:16 PM
Clandestiny, OOPS!

YOU WROTE:

""""""
push ebp
mov ebp, esp
pop ebp
ret 4

This is another new Asprotect twist, a short piece of garbage code
made only to confuse Revirgin et al. What I do is replace the api
with something that pushes no parameters, such as GetVersion.

"""""""""""

Wrong!

Those "short piece of garbage codes" are special control codes
for programmers. You can place any export name from same dll.(:FatalExit:)
Usually in many programs this future is inactive and nothing happens.
(Lasy programmers:)
BUT IF they will activate this ASPR-future, your unpacked+revirgined EXE
will crash!
For example:
Digisecret 1.1.272 & 1.1.278
ArtIcons 3.12
CloneCD 3.2.3.1
AO2000pr..

For AO2000pr I just submitted IDATA+ASPRtrickMANAGERcode.
GOTO:
http://www.woodmann.net/forum/showthread.php?s=&threadid=2476
Kayaker
01-08-2002, 03:53 PM
Originally posted by Clandestiny

Hope you don't mind that I shared the wealth :D

Hi

Did I really write all that crap? Nope, don't mind, but I did remove a small snippet about manually tracing to the OEP to protect the innocent. All the rest is likely already public knowledge anyway. Not that it matters too much, people just seem to use /tracex now anyway. Or like Splaj, get impatient enough while waiting for /tracex to cook his dinner to come up with an even better way. Personally I like his AB (arrogant-bastard) technique ;) , but I can't seem to get out of the habit of manually tracing (almost as quick as /tracex anyway after you've done it 17 or 170 times, heh.)

Not sure if anyone else breaks into the IAT loop and uses the EDI/EDX values to get the IAT start and ending location as it is being processed. How DO you guys do it? Jeez I hope you don't all just depend on automagic patching apps like RV to do *everything* for you!

Besides, if you've missed tracing within that IAT decryption loop then you've missed out on the heart of Aprotect protection. If you're not learning something from cracking an app, then you're just cracking it.

Cheers,
Kayaker


Packed Apps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Packed Apps
PDA

View Full Version : Packed Apps

Argoth
01-08-2002, 01:31 PM
When I download an app, I usually try to crack it too, or at least modify it so it doesn't expire. But I ran into a lot of packed apps lately. When it is a serial protection this isn't really a problem, but when there is some other one, like a keyfile, I usually disassemble the file and try to patch it. You guys always seem to know how it's packed and how to unpack it.
I tried to do Download Boost 2002 and MemMonster, which can be found here:

http://www.desktopcycler.com/down0101.html

How do I know with what kind of packer it's packed? I already have cASPr for ASP packed files, but there are lots of other packers, are there unpackers for every one of them?

I'd appreciate some hints,

Grtz

Argoth
Snatch
01-08-2002, 02:15 PM
See the link to Programmers Tools at the bottom of this page. Well try it it really works! There is an unpackers section on the page. Little did you know there are some that support a multitude of unpackers not to mention some generic ones. Check them out and hope you find out what your target is packed with :).

Snatch


Wanted Good API tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Wanted Good API tutorial
PDA

View Full Version : Wanted Good API tutorial

dipeshrestha
01-08-2002, 10:58 PM
Greetz Cracker

Please tell me the site from where i can found the API function with its full description.

dipeshrestha
Solomon
01-08-2002, 11:06 PM
get MSDN library(3 CD) or read it on M$ site:D
Snatch
01-08-2002, 11:41 PM
Where can I download or order the MSDN Library most current edition (January 2002 or whenever the last was released). I checked Microsofts site and all it had were ways of ordering the MSDN Library yearly subscription when I just want it once not a whole year of it! There must be some place to get it. Does anyone know the current edition and maybe a place to download it? I hate having to read it online because there is no index and everything takes a little longer. The CDs would be nice.

Snatch
Aimless
01-09-2002, 01:23 AM
You might try to take a look at the ftp of borland, under Delphi 2.

You should find the win32api.zip file there. But remember to take the 11MB one which unzips to 24 MB. (as the ones generally on cracker sites is 8MB zipped which unzips to 11MB which is incomplete!)

If you STILL do not get that, let me know on my email id, and I shall send the file across to you on your email id (if you have one) in sections, which you can later rejoin.

...Have Phun
XICO2KX
01-09-2002, 03:49 PM
Maybe you should try downloading the "Microsoft Win32 Programmer's Ref" document at this page ("docs" section):
* http://217.128.240.230/cs/tools.htm (CrackStore)

It's a *big* HLP file with all the info you need to know about Win32 APIs! ;)
I check it all the time I need some info or description about an API function! :p

I hope this helps! :)
dipeshrestha
01-09-2002, 10:07 PM
Thank u for all.

Now i will get it.

dipeshrestha ;)
matthew
01-17-2002, 11:08 PM
h**p://***.microsoft.com/msdownload/platformsdk/setuplauncher.asp
fiddler
01-18-2002, 05:23 AM
Hi dipeshrestha

try

http://spiff.tripnet.se/~iczelion/

Plenty of stuff to keep you going.
The API is also in one of the help files

Try also
http://board.win32asmcommunity.net/
and search for RadASM, also in the help file.

cheers
fiddler


first real unpacking task
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > first real unpacking task
PDA

View Full Version : first real unpacking task

vbdisease
01-09-2002, 06:51 AM
hi ho,

i need some hints for my first *real* unpacking task.
i followed many threads about aspr, most of them going
over my head, but i wanted to try it myself.
before today i used unpack-toolz (like caspr..) or
did it via trw (pnewsec,makepe...). Now i stumbled about
this app:

h**p://208.38.138.151/icontoany/i2asetup.exe

peid said its asprotected (v1.22x - v1.3). so i found
something to play and learn! :)

after reading many tutz about unpacking i started my quest
of searching the OEP. i traced till my fingers bleed. :(
but, i found nothing really satisfying. till the trace,
i found out, that this app is a d5 app. hrmm.. i started
dede, attached it to active process and decomplied the b*tch.
the build-in pe-editor told me the OEP would be 4B1B75.
glad about my first victory i started procdump162 to dump the process.
then i launched rv 12b9 and attached it to running app.
its give me the following message:
"image import deskriptor corrupted, enter the OEP..."!

Ha, i had the OEP! i thought...tried it and received a lot of garbage :(
so, that wasnt the correct one.
i begun to tace again, it tooked me many hours, and everytime i thought
i found the real OEP, i tried it out in rv...with no result.
my "best" IT.txt is attached.

so, dudes, could someone give me a clue what i did wrong?
i begin to think that my starting point may be wrong.

someone out there who takes my hand and lead me trough the
troubled streets of unpacking?

regards
vbdisease
ZaiRoN
01-09-2002, 09:14 AM
hi,

i suggest you an easiest unpacking session for the first time.
without offence, it's only a little advice;)

ZaiRoN
vbdisease
01-09-2002, 09:30 AM
hi zairon,

sure, its not the easiest (if its really asprotect), but

a) easy things are easy to handle with the well known toolz,like
icedump, trw-makepe, etc.

b) why not learn walking on a rocky road?

i just wanted to know if iam not totally lost...
it would be great, if someone could also take a glance at the prob.

regards
vbdisease
ignatz
01-09-2002, 01:07 PM
hmmm.

if you want to learn something, maybe you could first pack a program with asp 1.3 or something else, and the unpack it. like this you always know if you are on the right track.

hope it helps
farewell
-Ignatz
riPPadoGG
01-11-2002, 09:51 AM
Hi there..
Read the tuts in Fravia+ page given along with Re-Virgin.
Do excatly as they say. Use Ice-Dump for dumping the app. set the range outside the unwrapping segment(the one to which the EP is initially) and let in break... You will find your missing friend.
Now use Re-Virgin to create a virgin IT..
Search this forum as to how to use trace and api emulation.. U are gonna needem.
that should be it...
regards
doGG
vbdisease
01-11-2002, 03:12 PM
i will...thx, dudes! :)

vbdisease

ps.: i managed to unpack aspack version by "hand", as described in some tut, but still it dont work for his g$§"§! app..cant find the oep...:( maybe someone tried it?


morpheus anti-sice tricks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > morpheus anti-sice tricks
PDA

View Full Version : morpheus anti-sice tricks

ignatz
01-09-2002, 07:48 AM
hi

i read a previous thread about morpheus. I got a working dump using DeX but that´s not all i´m interested in.

first of all i´d like to understand the anti-sice tricks used by PeX better.

i figured the int03-SEH trick (code02) as described by +Frog's Print & +Spath

after this test there is at least one more, which i cannot elude.
it works similar to the int03 seh.

the difference is that the exception is generated by an invalid
mov al, [ebx]
generatin an exception.

the exception handler will return to exitprocess ;(

if i bypass the falty instruction i end up with a messagebox
+--[PeX ...]----------------------------------+
| unable to load library |
+----------------------------------------------+
(which seems fake to me.)

and afterwards i´m pushed into exitprocess again. *darn*

any help greatly appreciated
farewell
-Ignatz
SilberFuchs
01-09-2002, 09:52 AM
hi

i have found one Sice-Check, thisone you described, and nothing more, and the Progi starts without any problem...

just tracing from Entrypoint a few lines

"
Each time you'll meet this trick, you'll see:
-SI = 4647h
-DI = 4A4Dh
Which are the 'magic values' used by SoftIce.
"

i patched so: -si=0000 ......

Ciao
SilberFuchs
ignatz
01-09-2002, 01:02 PM
hi

i changed the
int 03
jmp edx

to

div al (al = 0 this will generate exception)
nop
---
i also tried the si = 0 tick but morpheus won´t run.

my version is 1.3.3
strange thing.
morpheus does also recognize TRW2000 and refuses to run although the sicedetection fails.

thanks a lot
farewell
-Ignatz
XICO2KX
01-09-2002, 03:43 PM
I don't know if this helps, but on the link below you'll find some info about 12 different anti-SoftIce tricks... ;)
* http://217.128.240.230/cs/003.htm (CrackStore)
Snatch
01-09-2002, 04:13 PM
Ya I just unpacked the PEX and then I had Morpheus and Kazaa running with Softice loaded without a problem. It is simply the packer that checks for Softice which is pretty cool of it if you ask me.

Snatch
ignatz
01-09-2002, 04:34 PM
actually,
it´s very nice that morpheus relies on the 100% secure pex encryption ;)

farewell
-Ignatz
SilberFuchs
01-09-2002, 07:35 PM
hi

i downloaded the version 1.3.3 and the patch works fine :)

patch:

mov si,0000
mov di,0000

Ciao
SilberFuchs
ignatz
01-10-2002, 11:57 AM
still doesn´t work for me ;(

but thanks for your big help and support ! :)

maybe i´ll figure it out some day.

farewell
-Ignatz


Softice detection in general...(and hiding)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice detection in general...(and hiding)
PDA

View Full Version : Softice detection in general...(and hiding)

Snatch
01-09-2002, 04:20 PM
I have a simple question for the brains out there. It seems as if the only good ways to detect softice apart from doing silly things like looking for the files or using the registry which dont tell whether it is loaded or not and is a very bad technique and not too hard to defend against I reckon. But aside from those all the tricks seem to use VXDCall ?, Int ?, or a handful of API calls. Now am I missing something or could I put a global wide hook on all of these calls and then return what I like. A program that has a list of trapped calls such as Int 21h, Int 41h, Int 48h, Int 3h, the VXDCalls and API's, and then the program would let you choose the return values based on the input values and not call the actual routine. Wouldnt that set anti softice tricks behind permanently. I admit I am a newbie in this field so maybe I am missing something fundamental but it would seem that a program of this sort would be the universal Softice hider.

Snatch
Kayaker
01-10-2002, 08:21 PM
Hi Snatch,

Seems reasonable, though I'm just getting into this myself. From the testing Clandestiny and I have been doing lately there seems to be little problem in hooking the IDT and installing your own error handler, even with Icedump /PROTECT loaded. INT 1 hooking while debugging in Softice using INT 1 as a breakpoint is problematic ;-) , but the rest are OK.

The question probably is, do you chain to the original interrupt handler or not, and how do you determine from whence the interrupt came? In our code the interrupt is going to be generated by ourselves after hooking the IDT.

While in our handling routine (which will take msecs to seconds in time to complete) there *may* be an interrupt generated from outside. We can easily detect our *own* interrupt by scanning for the bytes we inserted. If there happened to be another of the same interrupt called we would have to handle it if it warranted handling by the system. Either we let our own app crash (try for a clean exit), or we let the system handle it, necessitating chaining, and hope it returns gracefully to our code. Depends if it was chained back to us I would assume. This Reentrancy problem is a real issue.

In your case, from the way you put it, you want to protect Softice for example, so I assume you would want to *know* if the interrupt(s), VXDCalls, etc. that you hook are being generated from a potentially bad app that is trying itself to detect SI. Or, you hook them explicitly and don't allow any of the interrupts to be handled by other than yourself. If you write in a vxd you will have priority over Ring3 apps, so if you test the registers for whatever signature bytes might be used (ax/bx, "FG-JM", BCHK...) you should protect from the standard techniques.

But, what if the SI detection is from a VXD call such as VMMCall Get_DDB? The vxd could have overwritten the IDT itself, kicking you down the line on having priority over the interrupts n'est pas? Who's on first, No he's on second, What's on third? ;) How do you protect the IDT from a vxd? Do you always RE-hook the interrupt once again? RE-RE-hook perhaps? Icedump protects the IDT, but only from Ring3 apps.

Interesting thought about the program letting you choose what you want to do. Once you're out of vxd code though you're at the mercy of the system unless you can suspend the thread of the app that caused the interrupt I would think, or whatever thread that led to you. I haven't checked, but will a BSOD accept more than a single keystroke as input? Something a little more advanced would be to access Softice itself to help and use it for I/O, however Icedump does it. Or register a dot command such as Softice EXtension (SEX) does to communicate with Softice.

I did see a protector (or would that be deprotector, I really can't differentiate any more, they both fight on the same battleground it seems) which handled a lot of the common Softice detection routines, no not Frogsice or Icedump, I know I have it on my hd somewhere but my filing system still kinda sucks ;)

BTW, why the hell does Adobe Acrobat try to access the LDT? (Try a .pdf file with Icedump /PROTECT on ;)

Cheers,
Kayaker
Snatch
01-11-2002, 10:48 AM
Very interesting problem. You have to hook the hook routine. So when an application tries to hook it you can pretend to let it hook the table when in truth it hasnt. Something like that. To make sure the application can never hook anything ahead of you. Or if they do you have the hook routine hooked so you rehook in front of their app as you were saying. None of this sounds easy simple or even documented. But in theory something good should be possible ;). Figuring out if it is the app or something legal is a problem too. Maybe you could use the process handle to determine. And why the hell does acrobat use the LDT? I know for a fact that Acrobat's docbox.api wont load with softice present and will without it. Are they trying to hide something? Wouldnt surprise me after they got so angry when Dmitry Skylarov talked about their silly weak ebook encryption scheme.

Snatch
Kayaker
01-11-2002, 10:13 PM
Just a little banter about an interesting topic...

There's actually a series of Window functions already set up to handle interrupts that you could use, including Hook_V86_Int_Chain.

mov eax, Interrupt ; number of interrupt to hook
mov esi, OFFSET32 HookProc ; points to hook procedure
VMMCall Hook_V86_Int_Chain

jc not_installed ; carry flag set if procedure not installed

"Installs a hook procedure that the system calls whenever the specified interrupt occurs.
Any number of virtual devices can install a hook procedure for a given interrupt. The system always calls the last hook procedure first. A hook procedure either services the interrupt or directs the system to pass the interrupt to the next hook procedure. If no hook procedure services the interrupt, the system reflects the interrupt to the virtual machine.

This service is recommended instead of hooking the V86 interrupt vector directly. "

------------------------

I think the last line is the key. If an application was trying to access the IDT for, shall we say 'aboveboard' reasons, the programmer might choose to use the Windows functions to do it. All flags and registers are saved for you in a Client_Reg_Struc structure, nice safe programming, guaranteed from MS itself ;)

If a 'protector', or vilest of all, a virus, were trying to install its own hook procedure it might try to hide that fact by doing it directly with sidt. If it was trying to detect Softice it would likely do it by

Hook IDT -> Detect Softice by chosen method -> UnHook IDT
or
Hook IDT -> Detect Softice by chosen method -> Leave Hook installed

If a 'deprotector' were trying to circumvent that it would need to get in after the app hooked the IDT but before SI was detected. This could be a matter of a few lines of code. The only thing I can think of is use a loader and wait until the app loads its vxd. Somehow you need a way to detect when the IDT has been changed. Immediately rehook the IDT and intercept the interrupt yourself.

Or you detect when the app dynamically loads a vxd with CreateFileA. I think it could change the IDT in its loading call (DIOC_Open) even before CreateFileA returns anyway, but you *might* be able to install over that or handle return values from DeviceIoControl before it shuts itself down (or whatever it's going to do). If it craps out on you in a BSOD without using DeviceIoControl you're probably screwed anyway. But then this would be extreme and is no way for an app to handle the fact that SI is loaded.

I see scenarios where you might be able to handle it in an 'application specific' form, but only the guru gods know if there's a more global method ;p

Kayaker
Snatch
01-11-2002, 10:57 PM
This is definetly an interesting topic. It drives straight into the topic of emulation. If you had an emulator doing everything then it would be a walk in the park to find the interupt or hook calls. Or native assembly sidt. Of course it would be slow but if its just a tool for debugging than that is a small cost. Emulation sounds like a great unpacking technique. Instruction by instruction. You have complete control of the target before anything is done. Just have to keep updating it for different targets doing different things. A thought. Lots of work required but the payoff would be the ultimate softice hiding tool.

Snatch
tony b.
01-12-2002, 10:30 PM
About Adobe's Softice detection - from what i have seen,
this is caused by the Intertrust docbox plug-in. It does
only the standard CreateFile() trick, so its easy to
bypass. You can also just delete the Intertrust docbox
plug-in from the Adobe plug-ins dir, as i did, since its
not really useful for anything (well i haven't seen any
docbox protected stuff anywhere)

regards,

tony (btw, the above is on NT -- dunno what they might
do for 9x)
Clandestiny
01-14-2002, 06:54 PM
Originally posted by Kayaker

If a 'deprotector' were trying to circumvent that it would need to get in after the app hooked the IDT but before SI was detected. This could be a matter of a few lines of code. The only thing I can think of is use a loader and wait until the app loads its vxd. Somehow you need a way to detect when the IDT has been changed. Immediately rehook the IDT and intercept the interrupt yourself.

Hi guys,

Interesting question. How exactly do you detect when the IDT has been changed? To me its seems related to the question of 'how do you detect read / write access on a memory range ?'... If you could detect a write access on the memory range for the IDT, you could theoretically rehook the interrupt the IDT at the changed address before any nasty anti-SI tricks had a chance to be performed. I know there are at least 2 ways to detect memory reads and writes...

1) Detecting write access across a *range* of memory can be accomplished by marking the corresponding page table entrys as 'not present' for those addresses. When an access on one of those addresses occurs, a page fault is generated and hooked to determine if the faulting address lies in a specific range.

The VMM reference touches on this issue a bit in its discussion of virtual memory:

-----------------------------Excerpted from the VMM Reference------------------------------
"The 32-bit linear address space used by the Intel 80386 and later microprocessors is divided into 4 kilobyte units called pages. Each page can be assigned specific permissions, and can be mapped to any 4K section of physical memory. The base physical address of a page is its page frame address. A page can also be marked not present, in which case it does not map to any physical memory.
Page mapping is possible because of page translation, the mechanism by which the CPU translates linear addresses to physical addresses. A linear address can be viewed as a combination of two values: a 20-bit page number, and a 12-bit offset (4K = 2^12 bytes). The CPU uses the page number to locate a page descriptor, which contains a page frame address and other information. Adding the offset to the page frame address yields a physical address.

A page that is marked not present does not map to any physical address. Attempting to access such a page triggers a page fault. Typically, a page is marked not present if has been temporarily swapped out to disk or if no physical storage has been allocated for the page. In addition, virtual devices may mark a hooked page as not present in order to trigger a page fault every time the page is accessed. The system does something similar for instanced pages."
------------------------------------------------------------------------------------------------
SoftICE actually employs this method to implement the range breakpoint (bprw) command and this is discussed in +Spath's SoftICE internals essay.

We can speculate some obvious drawbacks to trying to use this method for detecting access on the IDT. First, there is no way to distinguish between memory reads (which would occur all the time as the processor goes to look up the handlers for various system interrupts) and memory writes (which would occur mostly only when a specific application hooked a vector in the IDT). Most likely chaos would ensue at any attempt to implement such a scheme, but even if it didn't, the performance hit would probably be formidable.

2) The second method of detecting memory access relies upon using the internal debug registers. The debug registers have the added benefit of being able to detect the *type* of access (read or write). They are also used by SoftICE to implement the bpm commands. One might be able to use the debug registers to watch access and prevent hooking of a couple of the key IDT interrupt vectors used in SI detection. The drawback here is that there are only 4 debug registers. And of course, there's the possiblity that there might be some conflict w/ SI over the control of the debug registers. I really don't know. Its an interesting topic and I'm just speculating here.

As for how to tell if the access was performed by something legit?... I don't even want to venture specluation on that difficult issue ;)

Cheers,
Clandestiny
Kayaker
01-15-2002, 12:23 AM
Originally posted by Clandestiny

Interesting question. How exactly do you detect when the IDT has been changed? To me its seems related to the question of 'how do you detect read / write access on a memory range ?'... If you could detect a write access on the memory range for the IDT, you could theoretically rehook the interrupt the IDT at the changed address before any nasty anti-SI tricks had a chance to be performed.

Hiya,

Now we're getting into the meaty stuff...

Your question is a good one that strikes into the heart of the matter. If we assume an app will use Ring3 to hook the IDT (of course we all know what happens when we ass-U-me don't we? ;) , then if you are in Ring 0 you should be able to detect that. How is unclear, but there is code available that does just that, even if it's shrouded in some mystery.

My thought was more on a Ring0 - Ring0 equal footing basis. If the app was using a Win9x vxd, NT kmd or sys file could a change to any critical system area be detected? Is it possible to protect certain areas of memory against any kind of read/write such that a fault could be redirected to your own exception handler?

Again, +Spath's document is always illuminating.

------------------------------------------------
"BPR is SoftICE's breakpoint on memory range, which can detect read
and write accesses to a (hardcoded) maximum range of 400000h bytes.
This is done by marking the corresponding page (or pages, up to 1024)
as non present : when an access to a non present 4k page is made, a
page fault occur, SoftICE's page fault handler is called and checks
if the faulting address is in the required range.

It should be noted that since the non-present bit of the PTE is used,
this can detect accesses from any privilege level, yet SoftICE will
only trigger for accesses from ring3. This means that for some reason
SoftICE page fault handler filters accesses from ring0 (and therefore
limits this breakpoint's capabilities).
-----------------------------------------------

It seems that Softice itself detects access to a protected page from Ring0, but only reacts to Ring3 attempts to read/write to that page. Detecting Read and Write are apparently 2 different schemes, I don't know how 'eXecute' in the BPM <address> R W RW X scheme is handled differently. From what I can gather Softice uses INT 0Eh for its BPR page fault detection. This is the Hard Drive Interrupt?

The VMM Reference says in the above post that each page can be assigned specific permissions. Question is, how do you assign a permission to a page? This might be a valid way to detect an access to the page containing the IDT or the other descriptor tables. I've also heard about "touching or pre-touching" a page in memory to force it present, anybody know about this?

One interesting thing is when Softice has hooked it's 16 interrupt vectors in the system IDT it makes a backup copy of the original IDT that it "presents" to you when you type 'IDT', giving you false handler address information.

-----------------------------------------------------------
The 'IDT' command does not reveal this [hooking the interrupts], but instead shows these interrupt
descriptors pointing to their original locations (usually VMM). This is
because SoftICE saved the original IDT before setting its hooks, and when
the user types the command, it reloads IDTR to use the saved IDT, executes
a "real" 'IDT' command, and restores IDTR to the system IDT. Thanks to
this nice implementation, one can quite easily patch his winice.exe to
always see the real IDT.
-------------------------------------------------------------

On another note, using Softice's tricks itself to protect Softice:

--------------------------------------------------------------
Since SoftICE is registered as driver, winice.exe will receive all
VxD system messages (SoftICE only handles SYS_CRITICAL_INIT, DEVICE_INIT,
INIT_COMPLETE, SYS_CRITICAL_EXIT, W32_DEVICEIOCONTROL, SET_DEVICE_FOCUS,
DESTROY_VM).
--------------------------------------------------------------

I find the idea of hooking the W32_DEVICEIOCONTROL message interesting as a way of detecting communication between an app and its vxd, and vice versa. From the Windows 98 DDK:

--------------------------------
W32_DEVICEIOCONTROL

mov ebx, VMHandle
mov eax, W32_DEVICEIOCONTROL
mov esi, OFFSET32 dioparams
VMMCall System_Control

Passes a control code and related information to a virtual device driver. This message is sent to a VxD when an application specifies the name of a VxD in the CreateFile function and when an application specifies the device handle of the VxD in a call to the DeviceIoControl or CloseHandle function.
---------------------------------

From the sounds of this if you could detect this message being sent you could tell when an app is loading and talking to its vxd.

BTW, the program with source code I mentioned that hides SoftIce from detection by other programs, is called IceGhost and was written primarily by yAtEs. If I'm not mistaken you can get it in the ID-Rip archive. Would make a good project to duplicate and enhance ;-)

Kayaker


REQ: NuMega SmartCheck 5.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > REQ: NuMega SmartCheck 5.0
PDA

View Full Version : REQ: NuMega SmartCheck 5.0

_Servil_
01-09-2002, 06:35 PM
hello guys, anybody got and can ^load this for me,
thanks.
jomamameister
01-09-2002, 09:27 PM
check your pm
jomamameister
Kilby
01-10-2002, 05:28 AM
Can somebody upload a full bcracked version of Maya for me please ?

Oops wrong site, sorry about that !

FLAME ON

This is a discussion board regarding tools not a commercial warez request site.

If it's a request for a loink to a freeware or demo copy thats fine by me but no serials, registered, commercial versions please.

Please learn to read !

If you learn to read then you can read the posting rules.

FLAME OFF

If you obey the posting rules then perhaps there will be less attempts to close this site.

Kilby...:mad:


REQ: howto debug VB proggy (ZoneLog Analyzer)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > REQ: howto debug VB proggy (ZoneLog Analyzer)
PDA

View Full Version : REQ: howto debug VB proggy (ZoneLog Analyzer)

_Servil_
01-09-2002, 06:41 PM
I'd like to get finally a s/n for this useful util.. always get only hard crack while there's registration dlg ready...

also it's VB 5 or 6 proggy, after I unpack. Just have only bad experience tracing in common asm debugger. What's the workaround to debug with VB? -- I've heard something 'bout SmartCheck, can I use it 4 this purpose?

btw. loading into SC2.5RC1 invokes crash, could I found SC5 somewhere?
Viper
01-09-2002, 07:26 PM
depending on the app it might work if its not a pcode app your trying to crack :D
vbdisease
01-11-2002, 05:43 AM
hey,

go and grab sc6.03 somewhere and use following options:

Start Smartcheck and open the app to debug.

make sure that you had choosen the following settings:

error detection: all checked
\-> "Advanced" all checked, except the last three
reproting: all checked, except "perform analysis of handeld vb ..."

run the program and confirm all error messages till app pop up!

start debugging!

for more information select "show all events".
expand the branches by clicking on the +.

for pcode appz use WKTVBDE or exDEC!

hth,
vbdisease

btw. its a vb6 app :)
figugegl
01-11-2002, 06:36 AM
i have a different setting in smartcheck:

error detection: only the last one checked

this way you don't need to acknowledge hundreds of error messages, and smartcheck shows everything just fine.

figugegl
riPPadoGG
01-11-2002, 09:44 AM
Hi..

There is a patch for W32Dasm which shows the string references for VB apps(released by DREAD). Use that, disassemble find a suitable place to break and trace from there.. That's how I do it. Tracing within msvbvm*.dll might not be that fun(unless you are planning to write a decompiler...I'm talking about the practicality that is..)

regards
doGG
NikDH
01-11-2002, 09:56 AM
Originally posted by _Servil_
I'd like to get finally a s/n for this useful util.. always get only hard crack while there's registration dlg ready...

also it's VB 5 or 6 proggy, after I unpack. Just have only bad experience tracing in common asm debugger. What's the workaround to debug with VB? -- I've heard something 'bout SmartCheck, can I use it 4 this purpose?

Hi servil,
well i suggest u to use wkt debugger its really great tool
if the prog u've to dial is pcode :)

See ya
NikDH
riPPadoGG
01-11-2002, 10:08 AM
hi..
Can anyone point out some good WKT Debugger tuts...
serial fishing if possibe..

regards
doGG
vbdisease
01-11-2002, 03:05 PM
hi,

there two vbdebug tutorials on their hp:

h**p://vacarescu.addr.com/WkT/vbdebug/downloads.htm

unfortunatelly one in spanish!

amigos, it would be great if someone could translate it!!
anyone from spain, mexico...? :)

regards
vbdisease
_Servil_
01-11-2002, 03:26 PM
thnx for all infos sent, i'll look at that.

and by the way, if some1 else ffound the serial sooner it'd be nice to post it here, i'm so lazy http://board4all.web4all.cz/images/smilies/new/lol2a.gif
Kayaker
01-11-2002, 03:44 PM
Originally posted by _Servil_

and by the way, if some1 else ffound the serial sooner it'd be nice to post it here, i'm so lazy

Grrrr... Is it just me? Let's see _Servil_, there was a warez request two days ago on TOT by you that got locked and today it's a s/n request. Am I missing the joke or am I just being too hypersensitive or is this as lame as it seems to be?

There's 50 million crack request sites out there, PLEASE people, keep the Crapz requests outa here!!

trying to do what I'm (not) getting paid for,
Kayaker
_Servil_
01-11-2002, 03:55 PM
sorry if asked 4 something bad

i don't know other request here by me for ZLA,
though the original question was for howto i asked just
if possible to send the result.

if there's ths serial correct me plz, i didn't find it.
nofurs
01-12-2002, 01:05 PM
Originally posted by _Servil_
sorry if asked 4 something bad

i don't know other request here by me for ZLA,
though the original question was for howto i asked just
if possible to send the result.

if there's ths serial correct me plz, i didn't find it.
Best disguised for requesting cracks....
Ya can't find it so do we.STOP ASKING SERIAL IN THIS BOARD!!!! READ THE FAQ!!!!


iris 3.7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > iris 3.7
PDA

View Full Version : iris 3.7

jomamameister
01-10-2002, 03:25 PM
hello all,
have a couple of questions involving unpacking iris 3.7 from eeye security software.
i saw an earlier tutorial involving iris 2.0 being packed with pcguard. now, of course, this one says aspack inside. no matter, i guess. i'm too new to really know.
i loaded icedump and then frogsice, then started softice loader and loaded iris through it and got the "invalid" upon break as suspected. i did an f10 to get to first instruction. i never did get to see the pushads and popads. there seems to be a lot of redirecting of code inside of there.
what i did do though, was to do a /dump of the iris.exe from inside si before the program ever opened. i was never able to successfully dump from procdump, dumpfx, lordpe or even iczdump. i kept getting error messages.
i've also think i determined that the timekeeper is inside the eeyelic.dll which is packed with the same protection as the main prog. i need to dump this to. i've got the dzapatcher which is helpful for inline patching, but you need to know the old values first.
any help to get a proper dump on this baby and then find the correct oep for the dump file? thanks for everyone's help.
jomamameister


Text to Hex file with 00 padding
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Text to Hex file with 00 padding
PDA

View Full Version : Text to Hex file with 00 padding

jomamameister
01-10-2002, 09:55 PM
here is a little file i wrote because i got tired of looking for the hex ascii values for input, especially like i use in ultraedit. hope it is of much use to you as it is to me. enjoy.
jomamameister
6A 00 6F 00 6D 00 61 00 6D 00 61 00 6D 00 65 00 69 00 73 00 74 00 65 00 72 00


SmartCheck - FROM MICROSOFT !!! (Well...not really.)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SmartCheck - FROM MICROSOFT !!! (Well...not really.)
PDA

View Full Version : SmartCheck - FROM MICROSOFT !!! (Well...not really.)

Aimless
01-11-2002, 03:00 AM
Try taking a look at www.microsoft.com/ddk/debugging

Download the 6 MB debugger dated December 21/2001

Try the "logger.exe" utility in there. Smartcheck in the making..??

And oh yes! You can even ADD your own API's to that.

Hmmmm...are they gonna take over NuMega TOO ?? (God! can't imagine what'll happen to Softice then :) It'll prolly have a GUI interface, with downloadable skins, and you can also play media files (strictly WMA, of course) and ...)

Har! Har!

...Have Phun


Numega DevPartner Studio (Enterprise) 6.7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Numega DevPartner Studio (Enterprise) 6.7
PDA

View Full Version : Numega DevPartner Studio (Enterprise) 6.7

Snatch
01-11-2002, 02:58 PM
Ya I have 6.6 it is great. Comes with current set of Boundschecker, Truetime, Truecoverage, Smartcheck, etc... Great for cracking and Visual C++ programming. But I wonder if 6.7 is out on Numega's site it claims it is but I simply cannot find it anywhere else on the net. Or claims of existance. It is such a valuable tool that I cannot believe this. And whats more is I checked updates and could not find it but who knows maybe I am just looking in the wrong place ;). Any information at all is appreciated.

Snatch
macxicon
02-01-2002, 06:52 AM
Sorry if this sounds bit *lame* - but it's where all
starts from (no tool no trade).
Came here on my search for boundschecker - (and company :-)
You at least have any hint where to search for it - so you'r already the snatchy one ?.
(bit sick of popup's and penis extensions ..)


... a bit of asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ... a bit of asm
PDA

View Full Version : ... a bit of asm

stealthFIGHTER
01-11-2002, 05:44 PM
Hello,

I have troubles with the following opcodes:

FLD REAL10 PTR [00426D30]
FMULP ST(1),ST
FSTP REAL10 PTR [EBP-008C]

:
:
:

MOV [EBP-0090],EAX
FILD DWORD PTR [EBP-0090]
FLD REAL10 PTR [EBP-008C]
FCOMPP
FSTSW AX
SAHF
JNZ 00426AF7

Please, can somebody explain them? (I only know It is something with real numbers).

Thanks,
sF
ZaiRoN
01-11-2002, 08:00 PM
hi,
i don't know the fpu very well but:

- FLD REAL10 PTR [00426D30]: load a real pointed by [426D30] and store it in the ST(0) register
- FMULP: multiply real: ST(1) * ST(0)
- FSTP: store real in ST(0) to [ebp-8C] and then pop the value in ST(0)

the next instructions execute a comparison between floating point numbers:
-FILD DWORD PTR [EBP-0090]: similar to fld but load integer number pointed by [ebp-90]
- FLD REAL10 PTR [EBP-008C]: ...
- FCOMPP: compare real values
- FSTSW AX: store the status word in ax
- SAHF: copy the upper 8 bits of ax into the lower 8 bits of the EFLAGS register
- JNZ 00426AF: ...

this is a very little and poor explanation but if you use softice with the floating point stack window enabled (type "wf" in sice) you should be able to understand these simple passages.
btw, it's better that you download a complete fpu documentation for seeing how actually works; use google or go directly to the developer-intel site...

bye
ZaiRoN
riPPadoGG
01-12-2002, 06:56 AM
ZaiRon..
To view the floating point stack, type in wf in S-Ice..
And press Shift-F3 till the mode of display float..
regds
doGG
Snatch
01-12-2002, 10:56 AM
Um. Intel has a web site. Use it. Adobe has a web site use it. If you have acrobat reader and the current manual you should be set. h**p://developer.intel.com/design/pentium4/manuals/245471.htm

Read it. Makes the floating point instructions a little less garbage like. Oh ya the MMX instructions too. They are just plain garbage anyway though ehhe.

Snatch
GodsJiva
01-12-2002, 05:21 PM
hey, if u want to try some funky fpu code... (not *too* hard to reverse)...

...why not look at my keygenme in the mini project area ;-)

/me wants some comments :(


REQ: info on OSOLIS / SIVL protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > REQ: info on OSOLIS / SIVL protection
PDA

View Full Version : REQ: info on OSOLIS / SIVL protection

ssb
01-12-2002, 08:39 AM
Anybody knows anything about reversing osolis / SIVL protection / registration scheme ? I found nothing searching around and it looks quite strong protection method (after hours of testing it with SoftICE :) )
You can test it at h**p://www.osolis.com


Crackme #5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crackme #5
PDA

View Full Version : Crackme #5

javelin
01-12-2002, 05:47 PM
Objective is to keygen it :)

i think i fixed an bug that made serial 3 bytes long :(


Invalid PE?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Invalid PE?
PDA

View Full Version : Invalid PE?

riPPadoGG
01-13-2002, 01:33 AM
Hi All...

Why does valid PE files that run fine on Win98 get reported as "Invalid in Win2K"..

It seems that Win2K does not even run the program.
I would expect win2K to try eunning it and come up with an error and ask you to contact te vendor...:)

regards
doGG again..

Any difference to the way Win98 and 2K/ME read and load PE?
Any nice readings for that?

LOVE YA ALL!
bart
01-18-2002, 08:22 AM
Diff just like NT 4.0 and 95, NT requires correct imagesize, correct file align, no special asm instructions, no ring0, all RVAs should be DWORD aligned
4oh4
01-18-2002, 11:13 AM
Isn't there an app at protools that corrects and aligns the section infos automatically so the program will run on 2k? I tried to check, but all mirrors are now directed to 'digital-euphoria' or something like that. I want my protools back dammit!
NikDH
01-19-2002, 10:20 AM
Originally posted by riPPadoGG

Any difference to the way Win98 and 2K/ME read and load PE?
Any nice readings for that?

LOVE YA ALL!

Hi rippadog,
remember that winnt series cares about checksum value meanwhile the win9x series doesnt care about it

See ya
NikDH
riPPadoGG
01-20-2002, 10:37 AM
Hi All..
Thanks a lot..
I am giving it a try.
thanks again.
doGG
bart
01-21-2002, 02:12 AM
WindowsNT 4.0 and 2K doesnt check PE EXE checksum, just set it to 0, checksum is only required for system drivers
4oh4
01-21-2002, 08:25 AM
Sweet..... Someone in the off topic forum posted a link to a protools mirror that's still up.

(hxxp://www.woodmann.net/protools/)

That app that I mentioned is under the utilities section and it's called PE Validator by LaZaRuS.


Exe2Dpr v3.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Exe2Dpr v3.1
PDA

View Full Version : Exe2Dpr v3.1

haspix
01-13-2002, 10:42 AM
If someone has subj, I'd love to hear from you =)
Zero
01-16-2002, 05:49 AM
go to h__p://w*w.reverse-engeneering.de and search for exe2dpr.

Zero[REA]
haspix
01-17-2002, 03:15 PM
got it! :D


Revirgin bug ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Revirgin bug ?
PDA

View Full Version : Revirgin bug ?

LaptoniC
01-13-2002, 07:31 PM
Hi,
I guess, I have found a bug in Revirgin.I tried revirgin on Effective File Search v1.8(hxxp://www.sowsoft.com/search.htm).It is protected with Asprotect.I have unpacked and rebuilded it with just revirgin ,great product btw.(It crashed my computer when I clicked dump button so, I dumped with peditor but I am not sure whether it is bug or not).I have cracked usual things however after you search when you right click on result it gives an error on shell32.dll.I rebuilded dumped exe with Imprec and it did worked perfectly.
OEP
00074FF8
Cosmetic Changes
go to 76EB4h find 05 34 71 and change with 50 74 47.Then go to 77450h and write some string for registration ie Tsehp etc you can also divide string by 0dh,0ah.
+SplAj
01-14-2002, 05:18 AM
Hi Lap

I just tried EFS 'search.exe'... RV rebuilt ALL API except Line# 103 =>GetProcAddress (one of those conditional ones)....only 1 missed, not bad out of 417 API calls.
I used Win2K SP3.

This is old style aspr 1.3 with API cluster easily found.

Otherwise, dumped at OEiP 474FF8, and that was it, rebuilt fully functional in 15 mins.
The trial check is in aspr code. Once thats gone......unlimited trial !

Spl/\j


Help cracking with disabled button
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help cracking with disabled button
PDA

View Full Version : Help cracking with disabled button

dipeshrestha
01-14-2002, 03:07 AM
Hi this is dipeshrestha

nowadays i am cracking AI RoboForm. This software has one function disabled for the unreged user. now to unlock that function i had to input the registration code and press button. now the problem is that my button is disabled and i cant press it.

pls help me

dipeshrestha :(
ON'error
01-14-2002, 05:54 AM
hi dipeshrestha,
is it ok if i ask another question cauze it fits fine?
ive downloaded the ENABLER, this prog activates such buttons, which are disabled. But the source is in asm and id like to write it in delphi, but i dont know how to get access to other applicatons.
do you know?
vbdisease
01-14-2002, 06:41 AM
hi there,

you could use 'the customizer' e.g. to enable the button, but it dont make really sense to me.

if its a reg dialog, the author sure wants to let person be able to reg the software, therefore i think the app checks everytime for the right serial and, in the case its correct, enable it.

try to set a bpx on hmemcpy to enter the app.
maybe you can figure out if theres a algo which check the
current serial.

hth,
vbdisease
vbdisease
01-14-2002, 07:10 AM
hi again,

i just checked it. the mentioned way leeds to success :)
you could save some tracing if you use bpx getwindowtexta
instead of bpx hmemcpy.

remember: in such cases the app sure will check the input
everytime you enter a character, so try to break into it
by using one of the mentioned bpx.

have fun
vbdisease
Rage9
01-14-2002, 03:01 PM
one think you could do is get a program that is able to edit the dialog boxes within an exe, check over at protools.cjb.net, you should find something...

if its disabled in the exe simply undisable it and save and run...

have fun

-Rage
4oh4
01-14-2002, 04:42 PM
I don't remember for sure, but I played with roboform some months ago and I seem to remember there being a hard-coded serial. As vbdisease said the button is disabled until a valid serial is entered so it's checked every time you enter a character which is a pain in the ass tracing those types of protections. It must have been a quick crack though because I can't find any notes about it. Usually I don't waste the time to type up anything for future reference if it's a simple protection like a hard coded serial or something.

Maybe that'll help.

(just a note though.... Enabling the button in that type of protection probably isn't the right way to go. Maybe the programmer is sloppy and thought that the protection would be strong enough if to confuse the je/jne crackers by avoiding the "invalid serial message" type system and having the serial get checked before enabling the button like that. Then there's the chance that when the button IS pressed (when you enable it) there isn't any validation check at all and the program is automatically registered. I wouldn't put that past some shareware authors, but the program could check the registration on startup as well so finding the right serial is a better way to go.)
Rage9
01-15-2002, 05:39 PM
true, im just saying, doesn't hurt to try, mabe the coader is just that stupid, lol.

-Rage
4oh4
01-15-2002, 10:00 PM
:)

....wasn't trying to criticise or anything like that. Sometimes after a successful crack I look back at a lot of wasted time spent trying different things that in hindsight were pretty dumb (applies to me and not directed at anyone else). I was just trying to pass on some tips is all. :)
donMAMAvomito
01-20-2002, 12:13 AM
greetings

step-1 : try using the traditional resource technique..by editing the dialog resources.. (deprecated..since most apps nowadays have gotten better..)

step-2 : bpmb on createwindowexA - this little known API holds the key to creation of almost any window..and of course controls are windows too...:)..i get the best of 99% appz..by using this method..

step-3 : bpmb on "sendmessage"..for disabling..the control or enabling it...

step-4 : try the almighty "hmemcpy" of "getwindowtexta" and try deciphering the keygen algorithm..nasty stuff

step-5 : consider buying the software ;)

best regards
don vomito
Samneric
01-20-2002, 01:48 PM
Originally posted by 4oh4
I don't remember for sure, but I played with roboform some months ago and I seem to remember there being a hard-coded serial.

Good memory :) There's a single hard-coded serial that's visible after tracing from a bpm set from bpx hmemcpy. A keygen for this would be as complex as "Hello World".

The same thinking went into the app itself. After having run it to find the serial, my mouse was screwed up in IE. Had to reboot using the Big Red Button.

So then I really got pissed and ran the uninstall for it, but even that uses one of the dll's that it's supposed to be removing. Said it was "in use by another application"... Stooopidly lame...


Decode an MD5 string - help pls
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Decode an MD5 string - help pls
PDA

View Full Version : Decode an MD5 string - help pls

newbie2this
01-14-2002, 05:25 AM
OK - First time in this forum but I need some help. I am trying to decode an MD5 string e9fe40e4d15ce94e854e83fb82b405b8 I am trying MD5 Crack which is taking absolutely ages (2 weeks so far) with no results. The original string had 0 and X's in it with spaces, but I was told to remove these to run the program.

Does anyone have any ideas as to how I can crack this without taking ages and ages. Any ideas would be appreciated. Email me at eoddynamite@hotmail.com
Kythen
01-14-2002, 02:13 PM
Well my friend, I hate to break it to you but you're *not* going to reverse an MD5 signature. That's one of the points of using the hash of a plaintext like that... there are waaaayyy too many possible plaintexts to search through! As for that MD5Crack program, I've never heard of it and while it may have something useful, I'm very skeptical of it.

Now what exactly are you trying to do this for? Is this MD5 signature part of some registration scheme or something? Please give us more details and maybe we can help you down a different path.

Cheers!
Kythen
newbie2this
01-15-2002, 02:51 AM
thanks for the response - I kind of guessed that you were going to say that. However the MD5 program will work (brute force) but it may take over a year which is unacceptable.
Ethical or not I am trying to decode a encrypted password that is within a cable modem config file - to tweak it. I need the same password as the router so as the 2 are compared, I get authentication. If no password, no access !!
Any ideas, or am I barking up the wrong tree ???
Kythen
01-15-2002, 12:47 PM
I think you'd be very lucky to brute force it in a year, but that's kinda irrelevant. We've firmly established this is not exactly something you want to brute-force ;)

As for your objective, I'm not a hardware person. About all I can suggest is reverse engineering the software that controls the modem and seeing if the password comparison is done in hardware or the software. If it's done in the program, you're all good... if not, sorry but I couldn't tell you what to do.
Snatch
01-15-2002, 01:51 PM
newbie2this: Please explain more and more and more about how you have done this. I have 2 cable modems and I would love to do some tweaks on them but I thought that all the handshaking with the router etc was part of the hardware. How did you find that MD5 hash string? If it is part of the software you could be in luck. There might be other ways around what you are trying to do. Tell us how you have gotten the MD5 string and how the modem works please then we can give you some thoughtful answers.

Snatch
B-Boy
01-15-2002, 04:34 PM
if the md5 string is in the config file and you have access to it.. why not just put some dummy self-encoded md5 string into it?..
jomamameister
01-17-2002, 02:55 PM
using a dummy md5 hash won't work, except to generate an error. the md5 hash algorithm doesn't really recognize anything. it merely produces a hash of the input. the recognition of an error must come from your own prog through some sort of a comparison routine. simply put, if i input "jomamameister" and use the md5 hash i get "580c4ea440a04b5fef88f8087b910a7c".
so if you input anything else, you will just generate another md5 hash string. you couldn't intuitively "guess" the right input. or generate the "right" hash without the "right" input. the odds are against you if you look right below.
you can do the math yourself. each character in this string can be (26 lower case letters plus 10 numbers ) = 36 possible choices all independent of the others. so you can have 36 ^ 32 power of choices. this is quite a huge number. not only that, but you can manipulate the input before sending it to the hash algorithm or hash it again after going through a cycle. it's up to you. how complex you, as the programmer want to make this thing.
it may be better to look for another way around this prog. take care. if you think that's bad, try the sha256 or sha512.
jomamameister


Ati Radeon7500/8500 and Softice?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Ati Radeon7500/8500 and Softice?
PDA

View Full Version : Ati Radeon7500/8500 and Softice?

DGR
01-14-2002, 06:03 AM
Hi there,

I was wondering if any of you ppz have experience with using softice (in windowsxp preferably) in combination with a radeon 7500 or 8500. I'm planning on buying one but it would be nice to know if I would still be able to use SoftIce.

Tia,

D.


Newbie question SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Newbie question SI
PDA

View Full Version : Newbie question SI

cornel
01-14-2002, 02:41 PM
HI
How or where do you read your code you have typed in a shareware program, and how do you read the correct serial if there's any.I type in lke d eax and the data window display my numbers i have typed in, but when i want to see the correct serial it shows me like in the crackme program by Acid Burn ''hello dude''.C ome on guys help me here cos i'm lost.
Thanks if you can help me.
krobar
01-15-2002, 01:01 PM
Hi cornel

Sounds like you might have got that crackme from my page, coz I remember renaming it to crackme 2.

Dont want to give you the answer but just because you are asked for a serial number, doesnt always mean they got to be numbers....could be numbers, letters, or symbols, or any combination.

krobar
janeK
01-15-2002, 05:01 PM
Hi,

congrats man, you did it!

janek


Crackme / Keygen ASM source code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crackme / Keygen ASM source code
PDA

View Full Version : Crackme / Keygen ASM source code

Hoof Arted
01-14-2002, 03:11 PM
I am trying to learn more ASM coding. I learn best by example. If you have any ASM source for crackmes or keygens, please drop me an e-mail.

Thanks
vbdisease
01-14-2002, 04:16 PM
jo,

heres something.
a keygen package by rudeboy...enjoy!

fun,
vbdisease
ZaiRoN
01-14-2002, 06:50 PM
hi H.A.,
try to go to the crackme site...
you'll find tutorials with source code;)

ciao,
ZaiRoN
nev
01-15-2002, 03:31 AM
Check out TSCube's site:

http://lkubaski.free.fr/reverse/reverse.html

a few ASM keygen sources there, as well as some C
and Delphi ones.
bart
01-18-2002, 08:29 AM
checkout my packs

h**p://elektr.zsee.bytom.pl/~bart/files/misc/bartpak1.rar
h**p://elektr.zsee.bytom.pl/~bart/files/misc/bartpak2.rar
h**p://elektr.zsee.bytom.pl/~bart/files/misc/bartpak3.rar
h**p://elektr.zsee.bytom.pl/~bart/files/misc/bartpak4.rar
h**p://elektr.zsee.bytom.pl/~bart/files/misc/bartpak5.rar
h**p://elektr.zsee.bytom.pl/~bart/files/misc/bartpak6.rar


how to crack a hardlock Envelope
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to crack a hardlock Envelope
PDA

View Full Version : how to crack a hardlock Envelope

ohMyGod
01-15-2002, 03:57 AM
sorry for my bad english

in hasp Envelope i can use API FreeEnvironmentStringsa to getting start

but in hardlock Envelope what API can i use
ohMyGod
01-25-2002, 09:21 AM
hmm,who can give me some idea?
DakienDX
01-25-2002, 11:32 AM
Hello ohMyGod !

I can't tell you an API, but a BPM works fine with the Hardlock envelope.
ohMyGod
01-26-2002, 11:40 PM
oh,thanks.


How to unpack an armadillo-ed program ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to unpack an armadillo-ed program ?
PDA

View Full Version : How to unpack an armadillo-ed program ?

tester123
01-15-2002, 12:31 PM
Hi all,

I have a program protected by Armadillo v 2.2 or higher. I have tried to unpack it by Armkiller's Unarmadillo or Analyst's Deprotector, but it do not work. So can anybody tell me how to unpack it manually?

thanks
Viper
01-15-2002, 06:08 PM
first try doing a search on this forum for Armadillo then if your still stuck tell us where your stuck

people here are always willing to help those who help themselves
tester123
01-15-2002, 07:52 PM
Hi Viper,

I have read all tuts about Armadillo on this forum and other sites, I think that these tuts can work on armadilo-ed program v2.x or below.I also know the Silicon Realms Toolworks use the CopyMemII routine to encrypt the real code.The whole code is splitted in 16kBytes sections and only decrypted if there is a call to this section.So dumping the memory occupied by protected application do not work. I tried set bpx writeprocessmemory but unfortunately, there are many calls to this function.
I have chosen the virtualProtectEx as breakpoint as somebody recommended but in vain also.

How do I have to go on?

thanks for your attention.


SafeSerial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SafeSerial
PDA

View Full Version : SafeSerial

Xara
01-15-2002, 03:29 PM
Hi buddy!!
I'm working around with an obscure (for me) protection: SafeSerial from Sikander Soft. It's an ocx wich implements the usual trial/registration shit. Anyone can help me with infos, tuts etc..? Thanx


IDA signature for Activator / Unikey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IDA signature for Activator / Unikey
PDA

View Full Version : IDA signature for Activator / Unikey

MTB
01-15-2002, 08:01 PM
Hiya fellow reversers

I am looking for a signature file for Activator / Unikey. Have looked in the usual places, searched using google / Northern Light etc. Since signatures exist for Sentinel and Hasps I would assume one would exist for Activator / Unikey, or am I out to lunch ?

Thanks
MTB


Commenting - Softice 4.05 and above
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Commenting - Softice 4.05 and above
PDA

View Full Version : Commenting - Softice 4.05 and above

Aimless
01-16-2002, 12:10 AM
Hullo,

This is a common procedure I follow:

IDA -> .MAP -> IDASYM.exe -> .SYM -> Load the same in SoftICE.

This works as it gives me the full names for functions, allowing me to breakpoint on function names (subs and locs as seen in IDA).

However, I need more...

Is there any way wherin the comments that I have created for each instruction using IDA are also brought forward in the .MAP file? This would imply that I can use the IDA commenting feature to comment and produce a .MAP file, and convert that to .SYM. After loading the same, I would get, in SoftICE, comments as done in IDA.

However, I am quite unsuccessful in doing so. Any pointer in this direction would be appreciated. I tried using MapALL (from the IceDump's site), but no real use...

Would appreciate any assists or pointers.

...Have Phun


DS 2.6 produces grafical garbage
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DS 2.6 produces grafical garbage
PDA

View Full Version : DS 2.6 produces grafical garbage

Zero
01-16-2002, 05:37 AM
Hi ppl,

Anybody have problems with grafics-driver under win2k and ds 2.6 too ?
ds produces grafical garbage when it tries to pop up. the second pop up crashes 2k
i have a trident cyberblade i1, the standard vga test is ok but pop up results in grafical garbage.

Anyone any idea ?
By the way: inserting the PHYSMB to it´s correct size does not helps.

THX,
Zero[REA]
Nodens
01-18-2002, 06:37 AM
I had many many problems with ds2.6 under xp so i switch to ds2.5 under win2k and all is perfect :) I Suggest you to do the same...
Zero
01-19-2002, 10:09 AM
Even ds 2.5 does not works.
This is the same if Service Pack 2 for win2k is installed, which you maybe need for ds (or service pack 1).
Only 2 possibilities:
1.) Trident Cyberblade i1 causes the problem
2.) My current 2k is not working properly

No more ideas, changed back to 4.05... :(

By the way: ds does not works under vmware, that seems to be a problem of missing directx-support of the vmware-grafics-driver

Zero


Remove Delphi Window Form
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Remove Delphi Window Form
PDA

View Full Version : Remove Delphi Window Form

octapus
01-16-2002, 11:08 AM
I am working on a program coded in Delphi and i am trying to find a way to remove a nag window form that is shown before every other form starts loading.

I have used Dede to decompile the .exe file but found no obvious way to do the job.

Also what window api does delphi use to load a window form?

Doesn't Delphi Programs execute first the lines that are in Project File?
stealthFIGHTER
01-16-2002, 05:20 PM
Hi,

Try to use Resource hacker. With this tool you can remove particular forms (or any other resource).

Good luck,
sF
riPPadoGG
01-18-2002, 10:29 AM
Hi All,
Me too had many problems with Delphi coded apps.
Resource hacker is GOOD.

Is there any way to get the string references(Pascal) into Win32Dasm or IDA? Can Dede do it?

I am new to Dede...

doGG..


flexlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flexlm
PDA

View Full Version : flexlm

pdz
01-16-2002, 01:19 PM
Hello

I read "Zendenc FLEXLM 7.2 cracking information"

and I try to find the Seeds.

On my computer with :dd ESP, I find
006DCE10 - ptr to job structure
0080118C - ptr to vendor name
00801040 - ptr to vendorcode structure

Nolan Blenderd got these informations:
vendorcode+4 which is data[0] : DCE0A0A2
vendorcode+8 which is data[1] : FC58117B
job+8 : D3B4B0C2
job+c : 81042659
job+10 : D493C07C

With the Vendorcode 00801040+4=E0AAA4A0
00801040+4=C0121579

but for the Job; 006DCE10+8=00000000
+c=00000000
+10=00000000
Please,Could you explain me ,where is my error
My OS is Win98
CrackZ
01-16-2002, 03:14 PM
Hiya,

Theres a pretty easy to answer to this question.

Before the call to the lm_new() routine take a note of the pointer to the vendor code structure and the pointer to the job structure, then trace *directly* over the call to the lm_new() routine and get the values from the structures then, the lm_new() routine will populate the empty job structure and randomize the 2 seeds in the vendor code structure.

Plug these values into calcseed.exe and you'll be able to derive the correct seeds ;-).

For definition, lm_new() is the function in l_sg() that performs the gronking of the seeds and job structure using the system time, you can isolate it easily in IDA by looking for lots of references to _time(), all described in the Zendenc essay anyway ;-).

Regards

CrackZ.
scorpie
01-19-2002, 09:08 AM
Nice explanation CrackZ__.

This time gronking is explained in details in the "dan essay" found in the previous CrackZ__ site or Fravia.

Is there any comment about CRO CrackZ__ ? You mentioned something about CRO concerning Gauss, but no further details ?

I am learning how the "codes" concerning CRO in the FLEXlm are recovered, but have no success so far.


SecureID program!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > SecureID program!?
PDA

View Full Version : SecureID program!?

SuperCali
01-16-2002, 03:29 PM
Hello,
I was wondering if anyone here knows how these SecureID keycards (either the 60sec random gen or pin code versions) function. Well what I really want to know is if there is a posibility to get one and write a program that uses it as it's authentication means? Or is there another hardware brand/solution? I want to use something like that for ssh authentication of remote users on my OpenBSD machine. Any ideas?

P.S. My guess is that is trhat it uses some sort of PGP like ketexchange. So the sesrver software has a private and public key and the device (keygen) has the public key for the server along with it's own provate key.... and so on... I am on the right track or not!?

// SuperCali
SuperCali
01-16-2002, 03:56 PM
Apperently the standard I'm looking for is called X9.9 token card challenge response authentication mechanism. Anyone know where I can get more info on it?

// SuperCali
sludge
01-21-2002, 05:30 PM
The way SecurID works is this:

Each authorized personel is given a card. It is about the size of a credit card. On the front of the card in a little LCD window is a 5-6 digit number. This number changes repeatedly after a given period of time. The number is generated randomly and is synched up with a master server. When you to do something, such as logging into a main database for example, you log in and then it prompts you for your SecurID. The card is synched up with the main server since the moment that it comes to life.

Because of the fact that it is ever changing, SecurID is completely unfeasable to brute force. Also, due to the fact that the only way you would be able to get the algorithm for the randomness is by breaking open a SecurID card AND the fact that they are tamper proof and you would need one for exact thing you are reversing, i have to say, good fucking luck ;P

I don't really see why the software you would be reversing uses this though. The only real things that do are servers for companies, such as Intel or AOL.
SuperCali
01-21-2002, 08:59 PM
Hello,
Thanks for the info. I am not infact reversing the thing I was just interested in it's inner workings as I am implementing thta kind of login on my OpenBSD servers and have ordered CryptoCard's hardware token cards.

// SuperCali
SuperCali
01-22-2002, 08:41 AM
"As far as I know many of these beasts are supported by OpenBSD..."

Yes this is true. I have now ordered a hardware token (CryptoCard RB-1) and I already have my server setup for it. I hope to implement it on my other servers too (FreeBSD and Solaris). They are quite nifty these little contraptions.... saves one having to remeber lots of cryptic passwords.

// SuperCali


MS Access
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MS Access
PDA

View Full Version : MS Access

fiddler
01-17-2002, 04:30 AM
Hi All
Can anybody give me some direction for cracking Access.
Just some basic tut's to get me going
Cheers
fiddler
fiddler
01-17-2002, 05:51 AM
Oops
Found it by searching the site.
Bit quick on the keyboard
Cheers
fiddler


FileRestore by Winternals
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FileRestore by Winternals
PDA

View Full Version : FileRestore by Winternals

Rex
01-17-2002, 05:06 AM
Hi!

I've encountered this app that should be able to unerase deleted files (http://www.winternals.com/) Tried looking for serial/crack and found a serial. But there is no place to enter it. The docs in the proggy says that after first run the window will popup asking for license data. No such window ever appears - even after setting date few years ahead. So I ran IDA and found that the dialog is there in the program and all other usual stuff as links to registry, strings, ... But couldn't find the way to activate the dialog. Can anyone help me out? Thanx a lot.

Rex
Hoof Arted
01-17-2002, 08:48 AM
If anyone helped you, they would be just as guilty of using pirated software as you.

Get a life, then get a job, then pay for the shit you use.
Rex
01-17-2002, 10:16 AM
What I want to do is to try the software. Right now it only lists files that could be unerased. I am wondering whether the code for unerasing is actualy there or not and if so, how to activate it.

All (or almost all) actions and tutorials in this forum could be taken the way you described it - stealing software. Be that kind and don't be rude. There are other ways to share your (wrong) opinion with others.

Best regards

Rex
Samneric
01-17-2002, 11:38 AM
Rex posted:
Tried looking for serial/crack and found a serial. But there is no place to enter it. --SNIP-- So I ran IDA and found that the dialog is there in the program and all other usual stuff as links to registry, strings, ...

Interesting order of sentences...

You're asking how to use a serial you searched for and then found online so you don't have to contact the author to pay for your own. You're not looking for help in your own efforts to understand and reverse the app. How is this different from asking how to run some crack you found online?

You just want the free app - via crack or serial - not the understanding. If the dialog had popped you wouldn't have even run IDA.

All (or almost all) actions and tutorials in this forum could be taken the way you described it - stealing software.

And yet there are no links to warez sites or to help files for people who only want to search for, download and then apply cracks/serials.

Why even install IDA if you're not interested in what all other usual stuff does and how it does it?
Rex
01-17-2002, 12:00 PM
I maybe didn't describe the situation quite good.

When you install the application it only shows the interface. When you try to unerase any file it says that this is the trial version, blah, blah, blah. So I wanted to try out (and maybe buy) and do it quickly. That's why I searched for serial.

OK, I tried to use my knowledge and find the activation. I found the dialog, I found some routines but no way to activate them. Here's where I'm searching for help - where to search and for what. If you don't wanna help, do not. This is not about using other's serial, it's about analyzing the code.

I've been helping in this forum with some java protection/decryption(http://www.woodmann.net/forum/showthread.php?threadid=1692) and noone was accusing anyone of things you guys did. What was the difference???

Rex
Snatch
01-17-2002, 12:36 PM
Ok. People on the board can be narrow minded and dumb sometimes so ignore them. You are asking a reversing question. You are asking how to find out how to activate a dialog. Who cares what your end means are dont tell us about trials buying stealing whatever we dont care. Why people have responded and said that they do I dont know. Ignore them you asked a perfectly good reversing question. You did not ask for a serial you asked for a method to figure out where to enter it.

I suggest you get a resource viewer ResHack 3.3 is a great one. Then open your target and view things like the menu to see if there are other menu items hidden or what not. Check for accelerator tables to see if theres a shortcut key. Other than that you could use IDA to find where the registration dialog is loaded from and see what triggers that.

Snatch
Hoof Arted
01-17-2002, 03:03 PM
Crack request is a crack request.

To license the software for the purpose of using it, trying it, doing anything other than conforming to the shareware, evaluation license, is steeling and has nothing to do with understanding. This is exactly what was the big issue on this board a few months ago. This sort of shit will get it closed.

If people want to know how to register something, then they are not asking about understanding.
Rex
01-17-2002, 05:27 PM
for pointing me where to start. Maybe I should state it more clearly that I want to find how to activate that dialog. I found some triggers but failed to understand them.

For Hoof Arted:

... But couldn't find the way to activate the dialog. Can anyone help me out? ...

Did someone ever blame you that you want to steal something just because you're trying to find how it works?

Thanx Snatch for pointing me to the hidden menus (there don't seem to be any) and accelerator tables. I'll check it more and try to understand it better (I'm better with Java).

Rex
x_t
01-19-2002, 07:53 AM
h**p://www.winternals.com/support/detail.asp?Article=227

"Copy the license key text file that you received from Winternals..."
Rex
01-20-2002, 10:23 AM
That might be the point. I'll check it out. Thanx.

Rex
evaluator
01-20-2002, 12:29 PM
Now tell me where i can find ResHack 3.3?

This is pirated software request:)
Kayaker
01-20-2002, 02:25 PM
Originally posted by evaluator
Now tell me where i can find ResHack 3.3?

This is pirated software request:)

Really? Just so happens Reshack is freeware. Of course that doesn't mean it won't be on the chopping block too...

Kayaker


Rsa Challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Rsa Challenge
PDA

View Full Version : Rsa Challenge

int21hex
01-17-2002, 12:39 PM
Does anyone know if there is a lib to deal with 178 digit integers? Intersted in trying rsa challenge and hate to start from scratch?
mike
01-18-2002, 12:33 AM
Check out crypto++ at h**p://www.eskimo.com/~weidai/
int21hex
01-18-2002, 11:44 AM
Thank you
mike
01-18-2002, 07:05 PM
Out of curiosity, what factoring method are you going to try? Continued fraction? Quadratic sieve? Number Field Sieve?
donneo
01-18-2002, 10:34 PM
hi,
IMHO, 178 digit BIGNUM is hardly to be facted within reasonable time on your individual pc.
As i know, the most popular trial approach is NFS.
int21hex
01-19-2002, 06:43 PM
I am working on a different algorithm for finding the factors.... as you can imagine developing a new method is not going particularly well :)
mike
01-23-2002, 12:35 PM
I'd be happy to discuss it with you; I have some ideas, too. They involve factoring over prime ideals, though, and I haven't found anything that does that except PARI.
Kythen
01-23-2002, 04:18 PM
Hey guys :)

New factoring methods? Sounds interesting! If possible could you send me or point me to the info about what you have in mind?

Thanks!
Kythen
mike
01-24-2002, 01:19 PM
The convergents x/y for the continued fraction of sqrt(n) satisfy x^2 - n y^2 < 2 sqrt(n); or in other words, x^2 mod n is small. Factor these small residues to get an exponent vector for the residue. Use linear algebra to find a set of residues whose product is a square. Then you have a set of x's whose square mod n is also a square; call it z^2. Then (x-z) divides n. About half the time you get a factor of n and the other half, x=+/-z.

See HAKMEM for more info on continued fractions.

Here's a good intro to the quadratic sieve:
h**p://www.math.ksu.edu/math511/notes/925.html

Attached is a paper by lenstra, lenstra, manasse, and pollard about the number field sieve.

My ideas combine things from each of these methods.
int21hex
01-25-2002, 12:59 AM
I am trying something like this,... but i do not have the background that you do,(this is very obvious) mike :) (i look into the mirror and think you dam stupid newbie) but anyway i am tring to use trig of all things in three dimensions to factor... still doing research on angles... when i get some promising data from the calcs(they are taking forever) i will surely post it...wondering if there is any correlation between angles of composites composed of two prime factors
mike
01-29-2002, 11:07 AM
Looks like 27 people as of today have downloaded the paper. Anyone have questions?


Who have the flexlm6.1 flirt signatrues?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Who have the flexlm6.1 flirt signatrues?
PDA

View Full Version : Who have the flexlm6.1 flirt signatrues?

glopen
01-18-2002, 10:41 AM
Please help!
I need the flexlm6.1 flirt signatrues. Who can give me?

glopen@263.net
SuMaDartSon
02-08-2002, 03:57 PM
glopen, see your mail

SuMaDartSon
MTB
02-09-2002, 08:58 PM
Me to please. mtb_4_god@hotmail.com
MTB
;)
ThrawN
02-11-2002, 10:25 AM
If you could please mail them to me as well it would be apreciated :)

thrawn@fuckwindowsxp.com
Anticode
02-11-2002, 07:47 PM
Why not posting it here in the forum?
SuMaDartSon
02-18-2002, 06:12 PM
MTB, ThrawN, see your mails.

Regards,

SuMaDartSon
SuMaDartSon
02-19-2002, 02:05 PM
OK, here are the files

Regards, and have fun !

SuMaDartSon
MTB
02-20-2002, 04:20 PM
Thanks a million $$$. It's appreciated!!!

MTB:D


Mp3 Wav Converter v2.52
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Mp3 Wav Converter v2.52
PDA

View Full Version : Mp3 Wav Converter v2.52

4oh4
01-18-2002, 01:08 PM
If you want to take a look at this app, I got it from zdnet.

Basically I was planning on keygenning it for practice cause I'm not so good at that. But It's coded in vc++ and I can't see any logic flow in the way the serial is generated. The name has to be at least 2 chars long. There are two constant numbers that I kept seeing in my tracing (232347520237553 and I must not have written down the other one) which might be some sort of lookup tables or magic numbers or even seeds for some type of crypto algo. I doubt it's using any advanced crypto algo since the serials (good and bad) can be seen in plaintext in sice.

Anyways, if anyone else has some clues about how to trace through the serial algo I'd appreciate a pointer or two. Even if it's just generic hints on tracing through vc++ apps, like how to get function names for the vc++ runtimes when all you see in sice is the ordinal numbers.
LaptoniC
01-19-2002, 01:34 PM
I think it is not hard to keygen it.Here is couple of tips you may need.It gets name and check its length.Then it divides name to two parts.7 is important number btw, and append 20h if needed.Then it takes decimal values of every char and concatenate.It also uses 232347520237553 and above values for main calculation.(ie 232, 347 etc)

.text:004191BD xor ecx, ecx
.text:004191BF mov edx, 20h
.text:004191C4
.text:004191C4 loc_4191C4:
.text:004191C4 mov eax, edi
.text:004191C6 mov ebx, [esp+30h+var_20]
.text:004191CA shl eax, 4
.text:004191CD add eax, ebp
.text:004191CF sub ecx, 61C88647h
....
....

I guess it is enough to make keygen.I also suggest you to dissamble file with IDA.Hope it helps.
4oh4
01-19-2002, 04:11 PM
Thanks for the tips. I was using w32dasm, but I'll load it up in ida. Since I use masm, ida never seemed quite as useful to me to rip asm routines as someone who coded with tasm. Plus since ColdCoder released his comments patch for w32dasm, the scale tipped closer to level for me. The only thing I really like about ida is the way it shows....well like in your example it shows "loc_4191c4" instead of the un/conditional jump stuff from w32dasm. Also, the way you see "var_20" instead of some memory address. It's a bit easier to follow the flow that way. It's about time I got off my ass and familiarized myself more with ida eh?

Unfortunately I'm in win2k at the moment (without sice or any other tools installed) so I'll have to wait till I reboot before I can work on it. I suppose I could just take the dead approach and install ida but I really do prefer a mix of live tracing and dead listing, so I'll wait.
su7
01-20-2002, 01:38 PM
if you're a beginner you may take a look at "MP3 to Wave Converter" (w*w.mp3towave.com) wich is a nice program and an 'easy-to-keygen' target.


strings extractor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > strings extractor
PDA

View Full Version : strings extractor

mambox
01-19-2002, 06:19 AM
hi all,
kinda shame...but i'm looking for a simple tool who can extract all text from a binary but text as widechar like 'P l e a s e' or 'P@l$e$a^s&e' ?

were much easier to see if the attack on the exe is the good one :)

thanks!
figugegl
01-19-2002, 06:27 AM
a couple of months ago i coded a string extractor which shows also widechar strings. in the options you can choose the minimum string length and chars to include/exclude.

figugegl
figugegl
01-19-2002, 06:39 AM
i thought i attached the proggie, but this doesn't seem to work. write a email, and i'll send it to you.

figugegl_2000(at)yahoo.de

figugegl
mambox
01-19-2002, 06:45 AM
attachment worked.seem to work nice on scrambled txt but dont see anything in .exe update also crashed (hints?).
for the first try on a binary catalog it worked fine.
its a good first step for me!
thanks
LaptoniC
01-19-2002, 10:07 AM
I use Peek for this purposes.Must have tool.It cant extract either binary,text or unicodeform.Hope it helps.Unzip the file and right click on Peek.ini and select Install.
mambox
01-19-2002, 10:38 AM
YES!

totaly forgot the name of this tool who do the job!

thanks to the 2 guy who helped me!
Aimless
01-21-2002, 05:28 AM
Or better...

get strings.exe from www.sysinternals.com

Works on ascii and unicode, with ability to save AND multiple files also.

So sorry, it does NOT print offsets :(

...Have Phun
mambox
01-21-2002, 09:51 AM
fine too!

thanks,i've what i want!
figugegl
01-23-2002, 07:56 PM
i've noticed that my program crashes from time to time, especially when the file you open is running already. but most of the time it's working fine - and it was my first non-dialog based windows program :-)) i haven't paid much attention to it anyway.

if someone is interested in the sourcecode, drop an email. it's written in c and compiled with lcc-win32.

figugegl


strange program behaviour
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > strange program behaviour
PDA

View Full Version : strange program behaviour

NikDH
01-19-2002, 10:17 AM
Hi to all,
well i've a little probl with a prog
well i'd like to know where in the code that prog writes
in a runtime allocated mem a string
Think that mem is allocated via VirtualAlloc() coz its not surely
stack mem and neither heap mem (coz i bpx heapalloc()
and i dont see the prog allocating heap in that mem region,
and heapalloc() should call VirtualAlloc() if i'm right)
so bpx VirtualAlloc() i should find where the prog allocates
that mem region and when i see it has just allocated the mem i'm able to put bpm on it
The probl is that i'm not able to see when the mem is allocated !!!
Sice pops many times demostrating the prog calls various times
the VirtualAlloc() to allocate mem before the mem region i'm interested in and suddenly i found a VirtualAlloc() call
over the mem region i'm interested in and i can see
the page i'm interested in thats already been allocated and the str is already inside it
How is it possible ?

Tnx in advance
NikDH
NikDH
01-19-2002, 10:59 AM
Hi to all,
well i've just solved the probl by myself :)
There was a MMF instead of a mem allocation routine :)
The str was in a file that was opened and shared with mmf
and so the prog was able to read the str directly from the memory

See ya
NikDH


I'm looking for any stuff protected by Crypkey !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I'm looking for any stuff protected by Crypkey !
PDA

View Full Version : I'm looking for any stuff protected by Crypkey !

blackos
01-20-2002, 04:56 PM
Hi all !

I'm looking for any program protected by a recent version of crypkey ...

The kind of program is not important, but Crypkey is ;)

If anybody can post any valid (software really protected by Crypkey) url here, I'll be very happy.

:)

thanks !

bye.

blak.
scorpie
01-21-2002, 08:01 AM
Hello there,

Try h**p://www.ermapper.com (proggie: ERMAPPER 6.2).

This is a "modified" Crrypkey, and I am sure you will have a lot of fun.
jsteed
01-21-2002, 09:59 AM
I don't believe ermapper 6.2 is protected by crypkey. The company put it's own protection in that version and is pathetically weak. Version 6.1 however was protected with crypkey. Ketronics MPSIII 4.0 is protected by crypkey and is a good target because it uses both the option and level variables.
jsteed
scorpie
01-21-2002, 11:54 AM
Hello jsteed,

ERMAPPER version 6.1 is certainly protected by Crypkey, although the Site Key consists of more than 26 Hex's (pls recall that Crypkey Site Key consists of 26 Hex's). Version 6.2 is also protected by Crypkey. Have a look the Site Code and drop the first 8 Hex's, then the rest of the code is our Crypkey Site Code.

What you mean by weak ? Does it mean you have understood how the protection works ? Kindly share your knowledge if that is true.

Bye,

Scorpie
blackos
01-21-2002, 04:00 PM
thanks guys !

I need these urls not because I'm gonna try to break Crypkey protection, but because it's already done and I need more examples to find bugs in my little unpacker/unprotector for Crypkey.
It actually automatically unpack the protected executable, then, uncipher the imports and write down a new clean executable without Crypkey layer. It was done with a program protected by version 5.7 of crypkey, that's why I need to test it with other programs.

By the way, if anybody needs some infos about Crypkey, I'll be happy to take a break and try to explain what I understood about this funny protection.

thanks...

don't forget to give me more urls if you can.
:)

blak.
jsteed
01-21-2002, 05:36 PM
Hi Scorpie,
Hmmm.. maybe there are two versions of ermapper 6.2. The one I have doesn't seem to be crypkey protected. I agree some parts of the site code & site key look similar but they do not pass the crypkey checksum tests. The protection is contained in a function erm_get_license_status. The encryption function is also there, but the algo does not look like crypkey either. Enclosed is a short tutorial and the source code for a keygen. The whole process took less than a day as opposed to nearly two weeks for a complete bust of crypkey, Hence the 'pathetically weak' comment. Those two extra chars. at the end of the 6.1 version I think is the company vendor ID (just a guess). They seem to use it as a 2nd check for a good site key.
jsteed
scorpie
01-21-2002, 08:35 PM
Hello jsteed,

Thank for the response. I will come back to you later, once I finish with my "small job".

Bye,

scorpie
peterg70
01-22-2002, 06:09 AM
Blackos: Would like to get a copy of the unpacker when it ready. I have been doing some crypkey work myself.

But note not all crypkey implementations are exe wrapped. Some utilise the crypkey functions to determine permissions for operation and are usually encoded inside the exe or dll..

Another crypkey wrapped program i found was paqrat. Don't know what version of crypkey it was w*w.paqrat.c*m

Scorpie: I see your still around. Thought you had finished on the crypkey stuff??

Peterg70
blackos
01-22-2002, 06:51 AM
Hi Peterg70 !

thank you for the link, I'm gonna try...

could you give me an e-mail address to send you the stuff about Crypkey ?... it's a bit too large to join it to this forum....

(about 178 ko)....

have fun.

bye.

:)

blak.
thewd
01-22-2002, 03:23 PM
for anyone interested in the crypkey protection, i wrote a utility a while back that displays the information contained in the encrypted keys (for master keys, user keys, site codes, site keys, restriction keys & entry keys)

regards
thewd

[10 March 2002]
v1.04 uploaded
- supports confirmation codes
- when generating site key, can now enter user key, user key value or the password
- minor updates

[02 April 2002]
v1.051 uploaded
- scripting engine added for key creation
- further examples and sample scripts
- fixed a couple of issues
scorpie
01-23-2002, 11:18 AM
Hi Jsteed,

That is a nice tutorial, and more of this kind are welcomed.

My proggie is exactly the same as yours. I should agree with you that the algo is not crypkey, but the way how it transfer the license as well as the site code are certainly Crypkey, so I would guess it is derived from Crypkey. Regarding your keygen, I am not sure in the following:

1. Do you mean ermapper62.h is the one from the proggie (ermapper.h).

2. Where can I find vcl.h ? (I could give you my e-mail).

Regards,

scorpie

Hi Peterg70,

With additional information from JMI, I have solved the crypkey protected program, but ermapper 6.2 is interesting. Have a look the tutorial from Jsteed, it is informative.

Regards,

scorpie

Hi Blackos,

Do you mind to send your unpacker to me ? I am learning Crypkey protection systems.
Thank in advance.

Regards,

scorpie

Hi thewd,

What a nice utility you have.

Regards,

scorpie
jsteed
01-23-2002, 02:43 PM
Hi Scorpie,

Thanks, I'm glad you liked the tut. You won't need the header files that you mentioned. vcl.h is from borland c++ builder and is used by the compiler to determine whether debug info should be included. ermapper62.h just contains a published list of components for the IDE. You would want to make your own front end and probably clean up the code too. It was just a quick and dirty job. I have not looked at the function that produces the site code. If it is crypkey then the program must be compiled with static libraries since the crypkey dll's are not used. Also the site code does not change each time LicenseWizard is run so it must not use systime to randomize this. I guess ermapper got tired of paying crypkey for their product and thought they could code up something just as good. That shouldn't be very hard to do, but they didn't pull it off this time.
regards, jsteed
blackos
01-23-2002, 03:10 PM
Hi Scorpie !
If you want me to send you any information I've found about Crypkey and/or the unwrapper, please, let me know where (your e-mail address) to send all the stuff.
:)

I'm pleased to see people interrested in this protection scheme !... I searched during a long time and found nobody until this time !

So thanks everyone.

blak.
scorpie
01-23-2002, 08:15 PM
Hi Jsteed,

Thank you for the explanation.

I am curious about your keygen, although I have found the Auth. Key manually.

Regards,

scorpie
scorpie
01-23-2002, 08:22 PM
Hi Blackos,

I appreciate very much your cooperation.

I have sent my e-mail address, so kindly check your e-mail.

Regards,

scorpie
hasher
01-25-2002, 09:46 PM
editorsoftware.com/stylewriter/index.html

crypkey 5.6

Hope it helps

Hash
blackos
01-26-2002, 03:12 PM
Hi Hasher !

Thanks a lot for the new link !

best regards.

blak.
pReJkEr
01-28-2002, 07:20 AM
try: *******http://***.swishzone.com/[/url]
prog: SWiSH of course :)
blackos
01-29-2002, 05:21 AM
Thank you all !

I don't need new urls anymore. All I've got is enough.

once more, thanx !

blak.
:)
egads
02-02-2002, 08:33 PM
hello blackos
in case you need another to test, try brainvoyager, a brainmapping program. can send you the demo exe if you want it
brainvoyager.com

i would also like any information you have on crypkey and the unwrapper you are creating. i have just begun to figure out crypkey and would find your info helpful. thanks

egads
peterg70
02-03-2002, 05:28 AM
Egads

Might be worthwhile doing a search on this board and seeing what has already been done.

Peterg70
egads
02-03-2002, 12:57 PM
Thanks Peterg70,
I had indeed searched the board and found some useful infos. several posts ago, blackos had kindly offered to take a break and explain what he had understood about this protection, so i thought i would take up that offer.
egads
muslhead
03-10-2002, 04:50 PM
Hi Blackos:
If you are still looking for CK protected pgms you can download a nice one at .naviplan.com (get the naviplan extended).

If you have trouble, email me and I will send it to you.
Musl
thewd
03-31-2002, 11:55 PM
uploaded v1.051 of ckInfo, with includes a scripting engine for key creation. also, includes a number of samples scripts for crypkey instant, crypkey site key generator, swish, uk info disk and more...

original post above (http://www.woodmann.net/forum/showthread.php?s=&threadid=2544#post12996)

regards
thewd
glasha
04-02-2002, 11:26 PM
Hello all guys, i need help about this protection, how find level optios and pass to generate userkey via ckinfo, please send me all information and stufff

i only ar can path via get_authorization jz -jnz

thanks all for this information about of crypkey!!!!!

Best regards !
email123
04-13-2002, 06:57 PM
hi,everyboby,how can I crack this changed crypkey protected programme by mpsiiilm.exe

thank you all for any help!!!
peterg70
04-14-2002, 01:43 AM
First Rule of Requesting a crack : DON'T

Second Rule of Requesting : SEARCH (notice that little button up the top of the screen [NOT THE MICROSOFT ONE])

Thirdly and finally : DON'T ASK FOR A CRACK. Show us what you've done and we help with pointers.

Sorry for ramblings
peterg70
glasha
04-25-2002, 12:05 PM
hi thewd if you can help me how get option/level from a protected aplication i try with breapoints, but sice dont break, this function dont is called, i need search in execution of a program ?
thewd
04-25-2002, 01:25 PM
there are a number of ways to obtain the level/options, but they may not work will all applications,

- monitor (possibly through breakpoints, or by examining disassembled code) function calls to GetAuthorization, GetLevel, GetOption; and see what values are checked for:
&nbsp;&nbsp;&nbsp;int GetAuthorization(unsigned long *oplevel, int decrement);
&nbsp;&nbsp;&nbsp;unsigned long GetLevel(int numDefineOpts);
&nbsp;&nbsp;&nbsp;int GetOption(int numDefineOpts, int optnum);
&nbsp;&nbsp;&nbsp;Note: these function calls could be to a separate module, or embedded within the application, depending on whether it uses static or dynamic crypkey libraries

- examine using ckInfo, the site key contained in the ???.key file (providing the application is registered successfully, i.e. trial version with all features enabled)

- examine the function calls ReadyToTry, ReadyToTryDays, ReadyToTryRuns to see what values are passed:
&nbsp;&nbsp;&nbsp;int ReadyToTry(unsigned long oplevel, int numDays);
&nbsp;&nbsp;&nbsp;int ReadyToTryDays(unsigned long oplevel, int numDays, int version, int copies);
&nbsp;&nbsp;&nbsp;int ReadyToTryRuns(unsigned long oplevel, int numRuns, int version, int copies);
&nbsp;&nbsp;&nbsp;Note: you should be able to get these values without using a debugger - disassemble the code

regards
thewd

p.s. glasha: what application are you looking at?
glasha
04-25-2002, 06:13 PM
i have try with you information, i have dissasemble but this is packed and dont show any information about option/level, debugging only breack in get_authorization, init_crypkey and get_RTT *( ready to try) is called only when generate autorization to run 20 uses, i can try more, thanksfor you very good help 1

the aplicattion is from www.compac.com.mx any aplicattion is protected with crypkey 5.5. SDK and packed

Than very much Thewd !


Need Help...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need Help...
PDA

View Full Version : Need Help...

Darkkat
01-21-2002, 03:38 AM
Greetings all!!!

This might be an old school question but how do i apply the MSInfo cracks to my programs? When I click on them they say the file is corrupted......Am I missing something?
Do I move them to a diffrent location? Or is there some other way to open the file to apply it?

Thanx
Meow
Aimless
01-21-2002, 05:25 AM
Can we be a bit more specific here please...?

...Have Phun


Unpacking NE (packed) files...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unpacking NE (packed) files...
PDA

View Full Version : Unpacking NE (packed) files...

junkcode
01-21-2002, 06:11 AM
Hi...

i've a program (Super Mind Power v2.0) in NE format... thats packed with Shrinker... is there any unpacker available for it?

help... in this regard... is awaited...

and a big THANKS in advance.


api hooking via vxd...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > api hooking via vxd...
PDA

View Full Version : api hooking via vxd...

hex0r
01-21-2002, 07:52 AM
Hello All!

I'm trying to hook LoadLibraryA via vxd.
I created dynamic vxd which receive from my program address of loadlibraryA in kernel32.dll via deviceiocontrol. In vxd i'm saveing 5 bytes from start of loadlibrary and write there jmp to my code in vxd. In vxd in my LoadLibrary code i'm trying to restore original bytes, but windows crash while i'm trying to write to kernel32.dll. I think here the problem with memory context or something. Who can tell me what i must to do for correct writeing?:)

WBR hex0r
^DAEMON^
01-22-2002, 07:20 AM
just modify page permissions (anyway strange since vxd runs in r0, hmmm)
hex0r
01-22-2002, 11:30 AM
how?
NikDH
01-22-2002, 12:34 PM
Originally posted by hex0r
how?

Hi hex0r,
u can use the VirtualProtect() and VirtualProtectEx()
to change permission to page address

See ya
NikDH
hex0r
01-22-2002, 12:40 PM
that's vmm calls?
NikDH
01-22-2002, 07:43 PM
Originally posted by hex0r
that's vmm calls?

Hi hex0r,
they're api calls that stay in kernel
But thinking better about this thing u r at ring0 and pte
shouldnt bother u so dont care about thos api :)

Perhaps the write protection flag is set in the cr0 reg (if its used under win9x i dont really know)
Perhaps u r getting a wrong pointer
Try to trace ur vxd with sice and check ur pointer :)
Its better to single step ur vxd and check where is exaclty crashing and whats the err msg :)

See ya
NikDH
^DAEMON^
01-23-2002, 01:32 AM
hi,

maybe just one advise for you: DON'T patch the api directly, better use the export table!

maybe u wanna check out my source:
h**p://cdaemon.piranho.de/api%20hookerv0.2.txt

^DAEMON^
hex0r
01-23-2002, 01:15 PM
i found problem, the problem was that when i get control in my loadlibrary code i'm not in ring0, so i can't write to kernel. but i can call deviceiocontrol from my code to my vxd again and patch kernel directly from driver. All works fine now


My Challenge To You
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > My Challenge To You
PDA

View Full Version : My Challenge To You

KSR0x2b
01-21-2002, 10:49 AM
Maybe I cam across to strong about my opinion about this forum without giving any real help.
So here I will try: with the newbye in mind.
Ok I’ve looked through this forum quite a few times and could not find the examples that I am going to give you.
It was made by +RCG.
They are really easy but I think if you take the time and learn from them then you might be able to do some of these keygen that are here. I love to read about people looking to to increase their knowledge and I will assist every way possible to do that.
Well anyway here is a short snippet of the posting by +RCG and his examples. Download them and tell all how you were able to solve them.

By +RCG
Simple: download the first's three examples, and learn from them all you can, and then, try your own protections, use your mind, don’t ever be a zombie anymore, spend your useless TV hours developing your own protections schemes... it's fun and at the same time you will be preventing your premature cerebral deterioration (known as Alzheimer's disease) did you know that the TV-drooling zombies have a bigger probability to catch it?)
Read first the next guidelines. I know these first three examples are not the 'panacea' in programming neither in protections, but I think it's a good, and easy, framework for new byes.

Tips:
Example 1: A simple register code scheme.
Example 2: Like 1 plus a Nag Screen
(Find the trapdoor inside it)
Example 3: Just like 2 but a little Win Ice
Hostile :-( (You are able to recover the
System, use the stack to find the real
Return and restore the stack).

Well anyway there you have it:
Good Luck!
Kayaker
01-21-2002, 12:43 PM
NICE! Examples designed to teach, progressing from a basic level to a bit more involved, with full source code so the student can learn the full workings of the code they are tracing, rather than just blindly cracking it and not really knowing why or how it works.

A blast from the +HCU past designed with the newbie in mind, but offering more than just an easy protection routine. This is great, I'd like to see some of the new members become involved in this forum. You are right KSR0x2b, that the encryption routines in some of the other projects are difficult, but that's OK because we want to offer challenges at all different levels.

But at the same time I **ENCOURAGE** newbies to feel free to participate and ask questions about anything they are unsure of. Please don't feel hesitant about joining in because you think you are not at the *apparent* level of what some of these projects may appear to be. Nothing makes me happier than seeing a new face (name?) of someone who is trying to learn and making an obvious effort at it.

These 3 examples in particular, I would like to see many new people give a try at. If you've always wanted to learn how to write a keygen or are just starting out or just want to make your presence known, this is a good project to get your feet wet and your brain fired up.

As always, read the manuals first and do some background research, but this is a Newbie-friendly forum that the 'uninitiated' should not feel uncomfortable asking questions in. There is always someone willing to help those who are giving an honest effort to increase their knowledge.

Have fun all, and thanks for contributing KSR0x2b :)

Cheers,
Kayaker
Woodmann
01-21-2002, 03:42 PM
Howdy,

It's funny when I get to thinking about how to expand peoples
brains........
Next thing I know, someone has magically appeared!!
My thanks to KSROx2b.

Peace, Woodmann
UrgeOverKill
01-21-2002, 04:21 PM
Very nice KSR! btw I am in the process of writing some tuts that can help newbies see the difference between using IDA and W32Dasm. Keeping in mind of very little assm knowkedge. Hopefully they will like it and contribute.

Sometimes its too easy to get lost in our tangents and go over the heads of ppl trying to learn.
Hoof Arted
01-22-2002, 02:54 AM
Thanks for the contribution. Just would like to say that the Example 1 and 3 crash in XP. Have not checked in Win2k. Anyway, Have had a look at 2 and I think that you have a very good idea here. This learning will be much more fun for newbies.
4oh4
01-22-2002, 06:19 AM
Examples 1 and 3 crash in 2kpro and 98se as well. At first I thought it might just be a 2k problem, but it's apparently with all os's.
Viper
01-23-2002, 06:54 PM
I can run the first two but the third one crashes with a gfp

BTW: im running on Win98SE
KSR0x2b
01-24-2002, 11:13 PM
Just a few thoughts:
I have run all 3 examples on winxp winme win98 and win95. They work just fine for me.
Let me explain a little bit further on these examples.
The first one is no big deal.
Just register it.
Enter your name and then follow what it does with your name and then reverse it to get the key to enter the serial number.
The second one.
If you are running softice it will know it and crash the system if you try to debug it.
So you have to watch your stacks and follow it closely.
The third one.
This one is a beauty and is very hard to do. It is not for the beginner at all. This one is what we call modifying the code on the fly. I will post 2 very good essays on this example. Follow it closely. When they start writing programs like that it will be very hard to crack, but that is why we are here: So continue to seek that knowledge and grow in wisdom. And thus you have a birth of a mind. And they will say who was responsible for that and I will say Mea Culpa.
Good Luck All.
KSR+
4oh4
01-25-2002, 11:16 PM
First off.....great idea. I had a bit of fun with example #2.

Second, example #2 IS the only one that will properly run on 98se or 2kpro (the only 2 windows os's I've got installed right now). I've got no reason at all to lie to you brother.

Example #2 occupied a couple of hours of my time and was a bit of fun. I didn't (and still haven't) looked at the source because I was afraid it would ruin my fun. I dare say that that's not much of a serial algo though. ;) But I suppose the point was to get the rest of us to code decent newbie-type crackmes/keygenmes eh.

Anyways, I'd like to be able to run the #1 and #3 crackmes but they keep error'ing out on me. In the meantime maybe I'll finally get around to coding a decent keygenme or even a good crackme.

thanks again, and if anyone gets #1 and/or #3 working on an english version of win98se or win2k let us know.
Kayaker
01-26-2002, 12:46 AM
Hiyas,

For those of you having problems with #1 crashing on Win98SE, it must be some weird configuration error because, like some others, I have no problems with it on Win98SE (4.10.2222A). Sooo, what's the error you're getting? That's the beauty of reversing, it (should) allow us not to be enslaved by our OS or the software operating on it. Perhaps the error message or tracing in SI will give a clue to the source of the problem. I don't know what it might be though because there's nothing particularly unusual about it other than it uses an export table defining its own WndProc as an export.

As for #3 crashing, as KSR mentions this IS by design ;) . Rather interesting little implementation actually the way it uses an external file. There's probably many ways around it. I was actually thinking about implementing a loader for it to patch it in memory, or hook the interrupt it's using by modifying the IDT to redirect it to your own handler routine and return the value it's looking for, or any of the other documented ways of handling this (now old) Softice detection trick.

Other than the crashing problems, is anybody having difficulties with the rest of any of the crackmes?

Cheers,
Kayaker
KSR0x2b
01-27-2002, 10:19 AM
Ok:
I am glad to see that we have people trying to crack this.
However all the recent post about the program not working on certain OS systems has made me look more into this. And I must say I have found the problem. So in the first exercise I have the program working on all OS systems. I like what I am reading but if you want to be a good reverse engineer then you must first make a program behave the way you want it to. Cracking a program is more then just trying to get a keygen or to make the program last past the trial time. It is making the program behave the way you want it to. Programmers are good people and they are good at what they do, but do not let somebody dictate to you how something should work especially since you have a brain and can think of a way to make it work better for yourself. So this first exercise is what I would call a bit of lagniappe you get to do 2 things. First make it work then crack it.
If you do not want the first challenge then here it is zipped and ready for you. However if you want the first challenge the figure it out trust me you can make it work on your OS.
If you need help trying to figure it out just let me know I will be more than glad to help you.
Happy Cracking:
KSR+
KSR0x2b
01-27-2002, 10:05 PM
Upon playing around with example 1 some more.
I found that I did not patch it correctly.
Here it is patched right.
Download this one instead.
KSR0x2b
02-03-2002, 05:10 PM
I have been looking for a reply to Exer1. How are you coming along with it?
Well anyway I have a solution to it.
I hope you can understand it. I also wrote a keygen for it.
Just ask and I will give it to you.
Well anyway download the solution and try to follow it.
If you need help just ask.
4oh4
02-04-2002, 01:00 PM
Just wanted to apologize. I've been so busy lately with real-life/work type stuff that I haven't had a chance to play with your exercises again. I do appreciate the effort and will try to budget some time to have a go at "fixing" #1. :)
crUsAdEr
02-04-2002, 01:55 PM
I have just registered with the board recently and i would like to try the crackme but i cant download from teh link :<
vortex168
02-05-2002, 03:12 PM
Whew. Just plowed through the Import table project from a little while ago. Jumped on that bandwagon a little late, but it's all squared away now.

KSR, these look like some great projects, I haven't looked at them too in-depth yet, just popping in to let everyone know that I'm going to start working on them and I'll be back (very soon probably) with questions. One other thing, just so it doesn't get redundant, KSR, does the solutions.zip have the solution for making project one work? I don't want to look at it myself because that'd kind of spoil things.

vortex
vortex168
02-12-2002, 09:59 PM
I know I know, I'm hella slow at this. Walking through and getting it to pop up the Congrats menu was a walk in the park. Now I'm trying to work on a key gen for it but I'm having extreme difficulty with reversing the algorithm cuz I have zero exp with this and I can't tell what it's doing for the life of me.

I need some help with this 'get_code' function. I can't really figure out what on earth it's doing. Mainly this is because I don't understand the comments given at the beginning of the Includes.asm (ie. [ebp] = Ret Add).

Thanks a lot.

vortex
Kayaker
02-16-2002, 02:52 AM
Hi vortex,

You still struggling with this question? Your best friend here is Softice itself and the 'd' display command. Try using 'dd esp' to display the stack just before the call to 'get_code' is made (CALL 00401417) and see how the addresses of the 2 parameters (offset CheckValue and offset Name_Buffer) have been "pushed" onto the stack (in esp). The first thing you see when you step into the call is a 'stack frame' being set up where the esp address is moved into ebp (the old ebp value being saved first).

get_code:
push ebp
mov ebp,esp

All the parameters pushed, including the return address (which is what [ebp] = Ret Add means), as well as any variables used, can now be referenced from ebp (called the frame pointer). This is what is meant in the includes.asm file.

Use the basic Softice commands such as 'dd esp+8' and 'dd *(esp+8)' (or 'dd esp.8') to follow along with what the keygen algorithm is doing and you should be able to reverse the algo. Check the contents of the registers being used before and after each step. Consult the Art of Assembly Language or some other doc for the usage of the shl and other commands. Use the search function of this board or Google and find some basic info on 'stack or stack frame' to understand how a Call is set up so you can recognize its structure in Softice.

If you're writing your own keygen in ASM this should give you a clearer idea of how to interpret what you see in SI. Hope this helps.

Kayaker
vortex168
02-16-2002, 07:04 PM
Cool, ok, I worked out the algorithm and I understand how the whole thing works. I have a couple of questions though.

When you say that the Return Address is pushed, what does that mean? Like, does the top of the stack (i'm guessing that's what esp is pointing to) always have the address that the function is meant to return to?

And after finally understanding what the hell the code was doing, I was just wondering if that section that is labelled 'a2b' is a pretty common algo for changing from ascii to binary. Because I don't fully understand how it works. If someone could explain it to me it'd help me out a good deal.

On to #2....doesn't seem like it'll be too hard, but I know I'll hit a brick wall for #3 so you'll hear from me real soon. =)

vortex
Clandestiny
02-16-2002, 11:12 PM
Originally posted by vortex168

When you say that the Return Address is pushed, what does that mean? Like, does the top of the stack (i'm guessing that's what esp is pointing to) always have the address that the function is meant to return to?

Hiya vortex,

Well, I'll have a go at clarifying your first question...

Yup, you're right about that. When a program enters a function call (or handles an interrupt), it has to save its place in the code so it knows where to return to after the call or interrupt handler routine is done. This is accomplished by "pushing" (saving) the current address on the stack before the function is entered.

In the case of a 'near call', the prog only needs to remember the offset of the instruction it will return to. Therefore, only the instruction pointer (eip) register is pushed on the stack before entering the call. The call instruction implies a push eip.

near call == push eip ;push offset

During the course of the function's execution it may push or pop other items on the stack, but by the time the function reaches its final ret, it must have corrected the stack so that the the top element of the stack contains the original address of the instruction that the function will return to in the calling code. Interestingly, the ret instruction is no more than an implied pop eip.

ret == pop eip ;near return simply pops address from stack into eip register

In the case of a 'far call', the prog may be branching off to another code segment when it executes the function so it has to remember both the original code segment selector (cs) and the the offset of the instruction (eip). These actions are implied in the far call instruction.

far call == push eip ;push offset
push cs ;push code segment selector

A far call uses the retf to return to the original calling code. It must restore both the original code segment and the offset. Consequently, the retf is none other than an implied pop cs, pop eip (Remember that the stack is a LIFO "last in, first out" data structure. In other words, the last element pushed will be the first element popped off the top).

retf == pop cs ;restore the original code segment
pop eip ;restore the offset

Likewise, the interrupt is very similar to the far call, with an added step. When the prog looks up the interrupt service routine (function) it will execute in response to having recieved an interrupt, it too must save the offset and code segment selector so it knows where to return exectution in the code that generated the interrupt. Additionally, an interrupt routine goes through the added step of pushing the flags on the stack.

interrupt implies:
push eip ;push offset
push cs ;push code segment selector
pushfd ;push flags

The interrupt uses the iret instruction to return to the original place in the code that generated the interrupt after it has completed servicing the interrupt. The iret is consequently the implied sequence of instructions popfd, pop cs, pop eip.

iret == popfd
pop cs
pop eip

And an iret could therefore be "emulated" with this sequence of instructions. Likewise, we can see that the iret is also equivalent to a popfd, retf and could be "emulated" by also using these 2 instructions.

iret == popfd
retf

Hope this helps to clarify matters a little bit :)

Regards,
Clandestiny
vortex168
02-17-2002, 09:37 PM
Whew! Nice post Clandestiny, it helped a load!

I blew through challenge 2 with no problems, but now I'm trying challenge 3. I haven't even actually disassembled it, because I want to try to figure out this 'use the stack to find the real return and restore the stack' thing. So I fired up the program and got thrown into sice with a beautiful screen full of INVALID
INVALID
INVALID
...
So I decided to check out what the stack was pointing to. And there I couldn't figure out what to do...

I looked at the stack and even though I might suspect some things to be the 'real return', I don't know how to implement it. I tried modifying eip to be what looked like an address (the first thing the stack was pointing to), but that didn't do any good. Any advice or texts you guys would recommend? And another thing, I tried d/ling FrogsIce hoping to get around it, but I have no clue how to use FrogsIce. Can someone refer me to some kind of use-me guide? Thanks again for all the help!

Vortex
Clandestiny
02-18-2002, 11:41 AM
Hiya vortex,

You can actually prevent the prog from crashing by modifying the stack in memory inside SI, but this will not cure the underlying cause of the stack corruption which occurs deliberately in consequence to winice being detected. If you look at the stack when you reach that final ret, your stack will look something like this...

00000000 BFF8B560 00000000 817D5420 .....

Now, we know the ret instruction is equivalent to a pop eip... BUT looking at our stack, we can see the top value that will be popped into eip will be 00000000. This is obviously an invalid address and we can conclude that the stack has been corrupted. The next value, however, (BFF8B560) looks a lot more promising. I recognize the BFFXXXXX address range as belonging to a system dll and I can even disassemble it in memory to see what it is if I want (u BFF8B560 in SI). It ends up being Kernel function that is executed when control returns from the program back to the OS. ...Realizing this, we can prevent our prog from crashing if we remove (pop) the 00000000 from the stack before the ret. After removing the 0, our stack will point to the valid return address in kernel code. You can test this out using the SI 'a' (assemble) command when you get to that ret instruction.

a eip
pop eax ;remove the 00000000 from the stack
ret ;esp now points to a valid return address

//******************** Program Entry Point ********
:00401000 6A00 push 00000000
:00401002 E82D050000 call 00401534 //check for SI
:00401007 3D48434142 cmp eax, 42414348 //if SI detected, then crash
:0040100C 7431 je 0040103F //jump to exit prog
:0040100E 90 nop
:0040100F 90 nop
.
.
.
.
:0040103F C3 ret //stack corruption - crash here if SI detected

Making this change in memory just illustrates stack manipulation concepts. It does not, however, correct the real problem (which is the detection of SoftICE). BTW, forget about FrogSICE or IceDump on this one... Using these tools would definately be overkill ;) Besides, it'll be more educational to find the check yourself :). Now, I don't want to spoil the fun so I'll just give you a little hint. I'm attaching a document containing a description of several anti-SoftICE tricks (and their fixes). Read through this doc, and I guarantee you you'll come accross something familiar in your little target ;)

Good Luck,
Clandestiny
Clandestiny
02-18-2002, 01:01 PM
Originally posted by Kayaker

I was actually thinking about implementing a loader for it to patch it in memory, or hook the interrupt it's using by modifying the IDT to redirect it to your own handler routine and return the value it's looking for, or any of the other documented ways of handling this (now old) Softice detection trick.

Umm... I see where you're going with that, but don't you think that might be overkill on this particular example ;)

I didn't see anything that said patching wasn't allowed :D

Cheers,
Clandestiny
Kayaker
02-18-2002, 04:41 PM
Originally posted by Clandestiny

Umm... I see where you're going with that, but don't you think that might be overkill on this particular example ;)

I didn't see anything that said patching wasn't allowed :D

Cheers,
Clandestiny

LOL. Are you kidding? Total Overkill. I was just hoping someone might take the idea and run with it, /myself being too lazy to attempt it ;)

I didn't see anything that said overkill wasn't allowed either :D

Nice to see you back on the forum btw,

Kayaker
vortex168
02-21-2002, 07:04 PM
Hm, so I patched the program so it works. Except, I get an error when I run it. I know it works though, because when I use w32dasm's debugger and load/run it, it works fine. No idea why, I'm not quite that good at reversing to be able to figure that out...

Question though, Kayaker said something about modifying code on the fly, I didn't really see that in the anti-sice code, were you referring to something else? and did you ever get around to putting up those essays on that stuff?

thanks
Vortex
Kayaker
02-21-2002, 09:33 PM
Hi Vortex,

I guess I was just trying to remind people to look at every possible angle in attempting to patch exercise 3. Having the source to look at seems to give a bit of latitude for creativity here in particular. I see the examples were downloaded something like 114 times (Woohoo!) which is great (or 1 person d/l it something like 100 times, which isn't great), so I don't want to give too much away if it's still being worked on.

However, one of the interesting things about ex.3 is that it uses an external file to hardcode the call address to the Softice detection routine. In itself this is weak simply because it's a very simplified situation, but if the file was encrypted and the address(es) to various call functions were decrypted runtime, this would give another layer of protection. You can patch the program somewhere after the Sice detection, but you could also patch the external file to point to an address that you wanted to that would bypass the Sice detection entirely. This is one option, though not much more elegant than patching the program itself.

Another option, and one you might want to explore because this is sort of the "next step" in stupid reversing tricks, is to modify the program with an inline patch which gets around the protection. For example, right before the indirect call that contains the address from the external file which points to the Sice detection routine itself are 4 nops. This could be a starting point from which to jump to an empty area of the code section and somehow *change* the address that will be called to one you want.

In the check.asm file this call is
call [Call_Table+0] ;CheckIce
[Call_Table+0] is defined in the main exerc3.asm file as a 64 byte table, the 0 is an index into that table.
Call_Table dd 64 dup (' ') ;Store call addresses.

Another place to put an inline patch might be right after the Sice detection routine itself, leaving the original call to it alone. Again there are 4 nops immediately afterwards that you can use to begin building an inline patch. Since it's obvious that the routine is looking for AX to still contain the value 4 after the INT 3 if Softice isn't installed, then you just need to create a patch which ensures ax will always contain 4, and then replace the original code and anything else you've overwritten.

CheckIce:
push ebp
mov ebp,"BCHK"
mov ax,4
int 3
cmp ax,4
jne Ice_Installed
xor eax,eax
Check_Ret: pop ebp
ret

For example, to start the patch, immediately after the INT 3 you'd patch in a
jmp <some address in a writeable section of the program>
Then at that address you'd patch in the bytes which might look like:
mov ax, 4
jmp back

It's actually a little more involved than this because you have to take into account the number of bytes taken for a far jump (6) and emulate any missing code etc., but you get the idea. There are several tuts on the main site that use inline patching that you can read to try this out if you wish. HIEW is probably the hex editor of choice with which to create an inline patch, and you'll need to learn about finding 'empty' places in code in which to write your patch and ensure that the Code Characteristics of the section is writeable. As a start, I detail this in my TracePlus and Regmon essays, but many others have nicely described the procedure as well over the years. Check out Lord Rhesus' Pages of Code Injection for several good ones.
http://oberon.spaceports.com/~codeinj/

Anyway, just a couple of ideas for something you might want to try that's a little more fun, and ultimately more useful, than a straight JNZ patch. As for my 'overkill' ideas :-) about creating a loader or hooking the interrupt, these were just fanciful ideas which in reality if anyone wanted to do them they'd probably already be doing them on something more important than this crackme, hehe ;-)

BTW, if you have Icedump running, the app *will* crash when it steps over that INT 3 no matter what, this is sort of a 'bug' with Icedump.

Have fun,
Kayaker


timeLOCK ver 3 or higher info needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > timeLOCK ver 3 or higher info needed
PDA

View Full Version : timeLOCK ver 3 or higher info needed

buttpir8
01-21-2002, 03:34 PM
alue,'COLOR')" onmouseover="stat('color')">
<option value="0">COLOR</option><!-- you should edit this list to remove the colors you don't want -->

this is where the debug goes on all those runtime error messages i get on vbulletin boreds...

anyhoo, not sure about the request thing but here goes,
I would like INFORMATION on what to look for and how to crack stuff protected by timeLOCK ver 3 or higher if ya could point me in the right direction, would be much appreciated...

Thank You
jomamameister
01-22-2002, 08:10 AM
please check your pm.
jomamameister


IDA Pro Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA Pro Question
PDA

View Full Version : IDA Pro Question

mhb
01-21-2002, 09:56 PM
I have used IDA Pro to disassemble an exe file with the following showing in it.

If I break into this exe in SOFTIce, scroll around to lets say the 2157 area, this is not the code that I see in SOFTIce or WDAsm

How do I get to this area of the exe in SOFTIce.

Thanks,
mbh

cseg01:2157 ; ---------------------------------------------------------------------------
cseg01:2157
cseg01:2157 loc_0_2157: ; CODE XREF: sub_0_20D3+7F j
cseg01:2157 lea di, [bp+var_100]
cseg01:215B push ss
cseg01:215C push di
cseg01:215D lea di, [bp+var_204]
cseg01:2161 push ss
cseg01:2162 push di
cseg01:2163 call sub_7C1_20C7
cseg01:2168 call @CompareText$q6Stringt1 ; CompareText(String,String)
cseg01:216D or ax, ax
cseg01:216F jnz loc_0_2174
cseg01:2171 jmp locret_0_23CA
cseg01:2174 ; ---------------------------------------------------------------------------
Solomon
01-21-2002, 10:01 PM
This is 16-bit exe. I suggest inserting an "int 3" here, then "bpint 3" in softice.


MDE (Acess MDE file format) decompiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MDE (Acess MDE file format) decompiler
PDA

View Full Version : MDE (Acess MDE file format) decompiler

breezer
01-22-2002, 10:16 AM
Hei,

I'm creating a webbased interface to a program written in MS Access. The source of the application is coded in MDE files. Is there a way to reverse this files so I can determine the dbase schematics and dbase logic used?

Breezer


TimeFix, softice time tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > TimeFix, softice time tool
PDA

View Full Version : TimeFix, softice time tool

GodsJiva
01-22-2002, 11:33 AM
Bah humbug, found an extra instruction lying around for no particular reason :-P Caused a minor problem w/the cancel button. Here's the new version... (including source)

***

A useful little tool I've coded... not sure if there's others that do the same thing or not, but hey...

It resets the windows time after a softice session.

There may well be bugs, pls report any you may find.

Enjoy!
(Feel free to distribute it)
Kayaker
01-22-2002, 08:41 PM
Hiya,

Cheers Godsjiva on your little 2am app. Heh, it seems the late night coding sessions are always the most interesting ;) I had started looking into that annoying Softice problem of losing the system time some time ago ("Have I really been in SI for 3 hours?!!"), and played with reading the CMOS Real Time Clock (battery backed up) with the IN/OUT commands (Win9x only) using ports 70/71.

Scammed the idea from somewhere or other, but I never did finish it up by adjusting the system clock with the correct time. I'll up it here if anyone wants to have a look at it. Besides showing how to read the CMOS Ram, which of course can be used for more than reading the RTC, it shows how to convert the results, which are in a binary coded decimal (BCD) format, into an integer value using the AAD command.

The app simply reads the month, day, hour, minutes and seconds individually from the RTC on clicking a button and outputs the converted values to edit boxes. I think you could use the values to fill a SYSTEMTIME structure and use SetSystemTime to adjust the system clock (not too sure about the UTC time format of that structure though vs the results returned from the RTC). Godsjiva's app is a lot more elegant to be sure, but I'd be interested if anyone gets the system clock updated from the RTC data.

I haven't had a chance to study your code Godsjiva, but your use of the floating point commands looks interesting. Thanks for sharing.

Regards,
Kayaker
ThrawN
01-22-2002, 09:34 PM
I think its just a motherboard issue. My time never gets screwed by sice because the mobo seems to restore it all the time. But the mobo i had b4 this didnt ;)


figuring out new eip
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > figuring out new eip
PDA

View Full Version : figuring out new eip

jomamameister
01-22-2002, 04:54 PM
hello all,
would like to get some feedback in trying to figure out the new eip of a packed program. it's obvious you can get it if you manually trace. we also know that unpackers do this themselves. i would appreciate anyone sharing this info. where do we start? can we do this without really unpacking the prog, or can we do it after a dump that we did not manually follow while looking for the eip. obviously, the packer is following some algorithm or set of algorithms to do this whenever it reaches its time to load the new eip so the old prog can load and run. thanks for any input. packing and unpacking is a fascinating area of learning right now and as i've said before, i believe we need to become familiar with these tricks.
thanks,
jomamameister
blackos
01-23-2002, 04:55 AM
hello !

Answering your question is, of course, too long to be done here, but, in fact, there is some little tricks.

packed programs must jump to the real entry point of the application once it's totally unpacked.

There is many ways to do such thing, for example, if you need to jump to offset XXXXXXXX, you can try :

jmp XXXXXXXX

or

XOR EAX, EAX
TEST AL, AL
JZ xxxxxxxx

or

mov EBX, XXXXXXXX
JMP [EBX]

or

PUSH XXXXXXXX
RET

...

as you see, we cannot try to find an EXACT way to process this jump, so we have to trace the program until it does it.
:(

Nethertheless, many application begin like this

PUSH EBP
MOV EBP, ESP
.
.
.
CALL GETVERSION

So, if you put a breakpoint on GETVERSION API, you'll probably land in an 'interresting' area which can be the real beginning of the unpacked file.

bye.

blak.
jomamameister
01-23-2002, 08:23 AM
thanks for the assist blackos.
j


flexlm: lc_set_attr(LM_A_CHECKOUTFILTER)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flexlm: lc_set_attr(LM_A_CHECKOUTFILTER)
PDA

View Full Version : flexlm: lc_set_attr(LM_A_CHECKOUTFILTER)

sebbe_sabb
01-23-2002, 03:53 AM
Hello.

I have found the keys and all for generating licenses, but the software uses lc_set_attr to set a proprietary string in the vendor_string, which stops me from running the software. It goes something like this:

INCREMENT feature vendor 1.0 1-jan-00 1 CC4CF188435DE4BF334F \
VENDOR_STRING="some special string and numbers"\
ISSUED=22-jan-2001

I have found the part where lc_set_attr pushes 02D onto the stack for setting the LM_A_CHECKOUTFILTER.

Is it possible to set breakpoints somewhere to actually read the correct checkoutfilter, giving me the correct vendor_string?

/Sebbe_sabb
nblender
01-24-2002, 04:03 PM
Since a pointer to the function is passed into lc_set_attr for LM_A_CHECKOUTFILTER, you can see where the function is by looking at the stack during that call to lc_set_attr.

Once you know the address, you can probably find out more by gnawing on the program with IDA. This is something that I haven't done much with though, but I remember seeing some essays on it on tsehp's site.

--nb
sebbe_sabb
01-25-2002, 04:33 AM
Hello Mr Blender,

I think there is an essay about a lm_a_checkoutfilter, where the target used lm_a_user_crypt, which returns the actual license-key. I think I understand that one, but since I dont have Softice, I cannot set a breakpoint on the actual dialogbox, which points out that local checkout-filter rejected the checkout. This dialogbox appear right after a lc_perror.

My old IDA begins to read the target, but doesnt read the lmgrxxx.dll because "it cannot be accepted ax lmgrxxx.dll " so the target gets disassembled without these imports. I have never encountered this error before.

I think I have seen some signatrues for flex floating around, but I cannot seem to remember where. Perhaps those helps?

/Sebbe sabb
Kythen
01-25-2002, 11:42 AM
Just a quick note... checkout filters and crypt filters are two different beasts. Crypt filters are rather nasty things that only work with the license string. Checkout filters I think can play with pretty much anything else in the license struct. Generally they're used to verify things like your VENDOR_STRING, etc. I would suggest just grabbing a copy of OllyDbg. It's a good little debugger for when you don't have Softice handy.
For your specific case, the address of the function is probably pushed as the parameter for lc_set_attr. Use IDA to run through all the references to that function and see where the value LM_A_CHECKOUTFILTER gets pushed. Chances are the parameter pushed before that is the address of your filter.

Also, maybe it's just me, but I've never had any luck using signatures for FlexLM. The subtle changes between minor versions (like 6.1f to 6.1g) will throw them off, so you can really only use them on a target of that exact version. I've just learned to use other tip offs to identify functions. There are nice strings and other good reference points all over inside the FlexLM code :)
sebbe_sabb
01-26-2002, 03:55 AM
n w32dasm, there is a passage like this:

:005874D4 8B15B4760F02 mov eax, eax, dword ptr [020F76B4]
:005874DA 6890785800 push 00587890
:005874DF 6A2D push 0000002D
:005874E1 52 push edx

* Reference to LMGR326B.lc_set_attr, Ord_003Dh
|
:005874E2 E8FB6C2800 Call 0080E1E2

02D in hex=45.
In lm_attr.h we see that lm_a_checkoutfilter also has this value.

from the manual:
status=lm_set_attr(job,key,(LM_a_val_type)value)

I get:
value=2D
key=00587890
job=dword ptr [020F76B4]

Since I am no programmer, I would like to know If I have understood this correctly.
1. is the push 00587890 a reference to a memory location? Should I go to 00587890? When I do, It does not make any sence however.
2. I must run the program and halt it via breakpoints to be able to see any values or are they there all the time?
3. An example of vendorstring is "fv every +3243549988". I think the numbers certify the feature "fv" with the option "every".

What is my next step?

I appreciate your help.

/Sebbe_Sabb
nblender
01-26-2002, 11:43 PM
Originally posted by sebbe_sabb
n w32dasm, there is a passage like this:

:005874D4 8B15B4760F02 mov eax, eax, dword ptr [020F76B4]
:005874DA 6890785800 push 00587890
:005874DF 6A2D push 0000002D
:005874E1 52 push edx

* Reference to LMGR326B.lc_set_attr, Ord_003Dh
|
:005874E2 E8FB6C2800 Call 0080E1E2

02D in hex=45.
In lm_attr.h we see that lm_a_checkoutfilter also has this value.
/Sebbe_Sabb
Ok - the job structure is probably in EDX when it gets pushed.
2D is indeed LM_A_CHECKOUTFILTER
587890 is certainly a good place to look for the checkout filter :)
sebbe_sabb
01-28-2002, 10:59 AM
At 00587890, w32dasm says:

[0058787C] - ff3744c6 .D7.
[00587880] - c35e5f00 ._^.
[00587884] - 90909090 ....
[00587888] - 90909090 ....
[0058788C] - 90909090 ....
[00587890] - 0814ec81 ....
[00587894] - 05c60000 ....
[00587898] - 01cc92e8 ....
[0058789C] - 8b575600 .VW.
[005878A0] - 082024bc .$ .
[005878A4] - ff850000 ....

I dont understand this.
I give up. It takes a programmer to defeat this one.

The seeds were easy, just bp at lc_init in the actual programfile.

Another question for you guys:

When it comes to the daemon (in this case), there are no actual calls to the lmgrdxxx.dll any more (v6.1). Are there any other ASCII-strings to look for which points me to the vendor-key structure?

/Sebbe_Sabb
nblender
01-28-2002, 03:38 PM
You might want to try disasssembling from where the supplied
address is. . .

Perhaps you can share with us the name of the program, or where to get it too.

Thanks.

--nb.
sebbe_sabb
01-29-2002, 01:22 AM
Hello again.

The target is a post-processor for CFD called FieldView. It is however not downloadable from their website, which you guys will find through a search on the net.
The target is 9.5 Mb large, and I dont have a site to put it up on.
I think it is the target who wants the checkout-filter, since the supplied daemon starts with the seeds I found, so you wont succeed with the daemon only.

I appreciate your help, but since the software is not very exciting (I am no CFD-guy) I think I let it drop.

/Sebbe_Sabb


help!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help!!
PDA

View Full Version : help!!

gujun73
01-23-2002, 08:44 AM
Hi,
I am a student .I am going to do an experiment about combined Chemosensitivity test in vitro.
I download the software "Calcusyn(demo)" from biosoft.
But The demonstration version of the software only allow me to analyze the experiments supplied with the program, I can not analyze any of my own data.
Who can help me?Thank you !
sincerely
gujun
naides
01-23-2002, 03:16 PM
Several Suggestions:

1. Avoid giving personal information in your posts. With the data you posted, a zealous software company could trace you with relative easy. What you are asking is not "exactly" legal.

2. This is a reverse enginieering board, you appear to be asking for a ready made crack. Search the net with google, or in Astalavista and you may find what you need.

3. There are other forums in which crack requests are welcome, even some referenced in this page (EXE tools). Somebody may take pitty on you and provide you with direct help.

4. If you are planning to crack the program yourself please let everybody know what you have done and people may suggest some strategies.


Bpx on win2k ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Bpx on win2k ?
PDA

View Full Version : Bpx on win2k ?

silverstorm
01-23-2002, 09:25 AM
Hi, please i need help.. :) i install win2k and drive studio 2.6.. but what happend .. :( when i try to put bpx on hmemcpy.. doesnt work.... please what its the similar bpx on windows 2000?

thanks
Solomon
01-23-2002, 09:33 AM
forget HMEMCPY in Win2K coz it does NOT exist any more;)

No such universal breakpoints in WinNT/2K/XP:D
silverstorm
01-23-2002, 09:52 AM
thanks.
:)


I need some help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I need some help
PDA

View Full Version : I need some help

redline
01-23-2002, 12:19 PM
I am trying to run this bot made by someone and he put a lot of encryption on it. I believe it uses armadillo encryption and some other type of verification. http://beta.liquidphlux.com/files/binarychat.zip IF you can help, please post or e-mail me at unreal2600@yahoo.com. The bot is a binary Bot for Battle.net game servers.

RedLine


Asprotect question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect question
PDA

View Full Version : Asprotect question

wbe
01-23-2002, 04:36 PM
For long I was waiting for a new version of the well renowned unpacker for this "super protector" (!), but no hope.

I developed a habit of taking a look at the sections of every new executable before running it for the first time. I use Get Type for this purpose. For newbies like me, seeing the "sections" part empty had the same effect of hitting a huge concrete block at high speed. Soon afterwards, I got the same response everytime; "...Failed!...by an unknown version of ASpack/ASprotect."

I was sick and tired of getting this response after the unpacking attempt for new versions of almost every popular s/w title, and at that very time I decided to handle it MANUALLY. It took considerable reading, time and effort to completely de-asprotect an app (and, restoring imports was the most toilsome task).

Now, I am trying to find some solid references that will guide in finding the OEP. Here is the question, and I am not sure about the answers;

Q: "OEP is the last stop of -tracex after which a hit of F12 starts the program."

a) Naturally
b) No, it was just a coincidence
c) Maybe, but not everytime
d) ?

Any comments?

Thanks.
+SplAj
01-24-2002, 02:30 AM
Hi

In this world DON'T ever wait for someone to make a specific tool just for you. The CASPR series is probably finished for those afraid to roll up their sleeves and delve into the codewoods.

If you search this MB you will find a *lot* of infos about manually unpacking ASprotect.

Back to your Q
The answer is d) .......

Now your specific OEiP problem can be addressed several ways. Here are some suggestions to QED :-

1) In Win98/ME use Icedump to /tracex 401000 <last but 1 section addy> and wait upto 1 hour. You are at a point in the original exe. STOP. This MAY be the real OEiP or a pre-entry to InitializeCriticalSections. So your code does a RET into hyperspace......

2) Manually trace the Int2E after setting 'bpx getmodulefilename' and pressing 21 times with F5 and then manually trace to the POPAD / JMP EAX another 15mins.....tricky for newbies.

3) Set a BPX GetVersion. Press F5 until you are in *real* code range. Then search for 61 FF E0 (POPAD JMP EAX) in SI type S 401000 L FFFFFFFF 61 FF E0. The memory address found is the last aspr code before real exe hand over. Close target, Restart it with BPX GetVersion still enabled. When pop'd into SI, BC* <ret>
BPR <memory_address_of_61FFE0> <same+3> rw if EIP==<memory_address_of_61FFE0> <ret>
Press F5 and wait upto 5 mins. You are at POPAD. Press F8 twice until at OEiP.

4) Same as above but use a memory editor like 'WinHex' to search for the 61 FF E0 first. Saves a few minutes.

Now, as i mentioned in 1) just be aware that *sometimes* API InitializeCriticalSection has been pre-called BEFORE OEiP and you get a crash. So there is some more work to do......use a Disassembler and note all such calls.... . In this case use 1) /tracex usually finds this trick, and then 3) to manually trace the POPAD to get to real OEiP and fix your dumped exe accordingly.

Give that a go and tell us more of your adventures into the codewoods of ASPR.....

Spl/\j
wbe
01-24-2002, 08:39 AM
>>In this world DON'T ever wait for someone to make a specific tool just for you. The CASPR series is probably finished for those afraid to roll up their sleeves and delve into the codewoods.

Yes. I've already taken my lesson. And it's only after that I decided to do it manually.

>>If you search this MB you will find a *lot* of infos about manually unpacking ASprotect.

Only this MB? I've forgotten the exact number tuts and other resources that I've archived just for this purpose.

>>Give that a go and tell us more of your adventures into the codewoods of ASPR.....

For the first time in my rather short reversing life I am not frightened delving into the "codewoods" even if my attempts sometimes do "a RET into the hyperspace" . This asprotect thing was about to cause a "mental illness" and I'm strictly following my doctor's advice: 5-10 deprotections a day. That's the only medication available.

Well, the number reached 5 now (all thoroughly sterilized, perfectly running). I will give your advices a go.

Thanks a lot and happy deprotecting for all.
wbe
01-24-2002, 02:43 PM
Great news,

Method 3) works wonderfully. Killed another 3 which are
randomly picked from my pool of asprotected apps.

So far so good. My temperature is slowly returning to normal. Hope to recover in a couple of years or two!

Thanks again.
crUsAdEr
02-03-2002, 05:29 AM
Spl/\j, could u explain a bit further about the pre-loading "InitialiseCriticalSection" first before original OEP?

I have used tracex to find the jmp eax and follow it... but my asProtect dump crashes shortly it calls "InitialiseCriticalSection" and "EnterCriticalSection"????

Just a hitn on what is going on will do,
Thanx
+SplAj
02-04-2002, 01:36 AM
He he.......

You know the Yanks (ooops Americans , sorry Woodmann) have a very good rule at cocktail parties, NO DOUBLE-DIPPING your snack in the dish.......cos you dip, take a bite, dip again, spread bugs.......Euros don't care, dip whatever you like in there :D

Alexey made a *naughty* version of ASprotect that did exactly that. Double dipped into original code, set some variables/workspace (usually with InitializeCriticalSection) then returned to aspr code, did its unpacking stuff and later JMP EAX to OEiP.

The result is that you followed to JMP EAX as OEiP, BUT when code needs to work with reserved space, BOOM. cos it's not reserved. The code that does has not been called. So you have to do some head scratching. The easiest thing to do in Win98/ME is with IceDUMP. Just let it /Tracex 401000 500000 (whatever) and note down any regular code entries , follow it to the RET back to aspr. Keep doing that until you get to JMP EAX as OEiP.

In WinNT/2K/XP you have to rip yer hair out .........and get disassembling........

Now, I have *never* seen more than 1 dip before OEiP. Easy to change the code to call 'initialize' code and return to OEiP.

I'll find more example for U ?, I must have one somewhere :D I think the first time this was put on the MB was Chamelon Clock. Tsehp documented nicely the way round.

found it :-

http://www.woodmann.net/forum/showthread.php?threadid=1473&highlight=Chameleon+Clock

Thanks to Kayaker as well on that one. Thats when I learned my lesson for using WinNT4 to unpack !

Spl/\j
crUsAdEr
02-04-2002, 02:11 AM
Thanks Spl/\j for ur prompt reply..

Now i understand wat is going on, so that means i have to inject to code before OEP some where in my dumped files?

ANd i have 1 more question, when i do dumping, i realise that i can dump without the usual "jmp OEP", just simply let the prog run, fire up Procdump and and dump process.. the same process can be done with winHex... but almost all tutorial i have read does the "jmp eip" before dumping... doesit serve any purpose i am not aware of?

Thanx

P.S : By the way, i cant follow the link to Chameloen clock u gave me.. it's dead for some reason :<
+SplAj
02-04-2002, 02:31 AM
Hi

Just think about OEiP. Is there room to change code to 'call setstuff' and RET ? or just JMP to a new section, like the end of exe where new IAT is, call relevant code and JMP back.

eg Fake OEiP is 456789, real OEiP is 401000

at 401000 change code from
PUSH EBP
blah

to

CALL 456789

If there is no room do it at the end of exe......or in spare section with lots of 0000000 padding.

Dumping
======

Just think. What has occurred if you let proggy run ???? It has set it's variables and workspace etc etc already. Maybe re-settiing the OEiP and re-constructing the IAT will make target work..... BUT what if program CHECKS flags for variables already set (most do).... he uses the existing data if flag set...... and thats been 'stored' (hard coded) in ur late dump !!!

Result, the proggy won't run so good, maybe fux yer memory and cause exception, accessing memory that it's not reserved etc :(

RULE #1 :- DUMP at OEiP
==================

A simple analogy :-

You go to a restaurant (a real one with wine and real food- not MacShites) and ask the beauty waitress for the menu. You choose your meal. A fine steak, medium rare, flambed at your side with Shrimp+mushroom+whisky and brandy sauce. A fine French red wine to wash it down. That's the OEiP way.

Now go into same reataurant, sit at a table thats being used and eat whats there already. Thats the other way.....no finesse, no style :(

BTW do a search for Chameleon Clock ..... see Tsehp thread from a year ago.

Spl/\j

EDIT----Found D-D target :-

h**p://www.chemtable.com/files/regon.zip
crUsAdEr
02-04-2002, 07:37 AM
Thank you for ur reply...

You are really helpful :>... Yep my dump is running :>... when i practise with Notepad it seems to run fine anytime i dump it with Procdump.. but u r rite that I must dump most prog at OEP!!!

And yep.. found the link...
Thanx


exdec crashes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > exdec crashes
PDA

View Full Version : exdec crashes

figugegl
01-24-2002, 06:53 AM
there's this little vb-crackme, packed with upx. i manually unpacked and i've learned it's compiled to p-code. but it crashes exdec :(

i haven't found information on crashing exdec, can someone point me into the right direction?

i'm also trying the wkt-debugger to get more results.

figugegl
figugegl
01-24-2002, 06:54 AM
forgot to attach the crackme...
DakienDX
01-25-2002, 10:36 AM
Hello figugegl !

Have you already tried to unpack it with UPX itself? It works only with the UPX version used to pack the file and only after UPX version 1.00, but it will unpack the file nearly in it's originally state. If the problem is in the p-code, I can't help you, because VB isn't my favourite. (and so I don't know anything about it)


mem or running app patching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > mem or running app patching
PDA

View Full Version : mem or running app patching

jomamameister
01-24-2002, 11:09 AM
hello all,
ok, here's an interesting question in which i would apreciate some feedback. there are several progs out, like dzapatcher which can patch a primary .exe and get it to work with its loader. now what about the packed prog which calls a packed .dll where the "real" area to be patched is. the dzapatcher doesn't seem to support an extended patching scheme like that. it only works through the primary target, which isn't the prob particularly. also we must presume that the .dll won't be easily unpacked, but that it can be patched in memory and it runs just fine. so, what i'm looking for is a prog that can do primary and/or secondary pathing on the fly. i look forward to any discussion here to shed some light for me and others.
thanks
jomamameister
Aimless
01-24-2002, 11:53 PM
Not really qualified to answer but would like to share what I know...

Before we start, let me reiterate what you have mentioned below so that we both are on the right track:

1. There is a packed exe (called, say, A.EXE)

2. This exe is easily patched with a memory patcher

3. This exe also calls a packed dll (called, say, A.DLL)

4. The actual patching is to be done in memory, not in A.EXE, but in A.DLL, because that's where the protection lies.

If the above scenario is what you require, then I feel that the solution is at hand.

You will need to understand (I am sure that you do) that the dll runs in the exe's process space, because the dll was called by the exe. Therefore, the A.DLL is actually the CHILD process or DEPENDENT process of A.EXE

You can patch the A.DLL in memory by 2 ways:

[continued below...]
Aimless
01-24-2002, 11:54 PM
[cont'd from above...]

1. Find a patcher that fixes memory addresses of an executable and all related CHILD processes also (you will have to search the web. Unfortunately, programmerstools.org has shut down so you will have to wait. Good news is that it'll soon be hosted here :))

2. Find a patcher that scans the memory for processes, displays a list of the same to you, a-la task manager, and allows you to ATTACH yourself to the same. Then modify the necessary. I am afraid, I have seen only one such patcher, but forget the name.

I hope that the meagre explanations above are good enough to at least *get* you started off.

...Have Phun
+SplAj
01-25-2002, 07:41 AM
Hi jo

YES it is possible to use tools like r!sc process patcher and others. However the later protections catch such debug activity and refuse to play....

You can 'modify' these utilities to play a smarter game. By knowing the layers and the debug trick you can patch out that code too....

But just for real-time 'memory' patching HexWorks can do that easily.... You can find these tools around I am sure of that ;)

Spl/\j
DakienDX
01-25-2002, 11:07 AM
Hello jomamameister !

You should look for a tool called "Process Patcher".
It is has a special feature which allows to patch up to three DLLs loaded with the main executable, even if they are relocated to different addresses every time.
I only know two versions. One is v3.60 and includes many examples, the other one is 3.93 which I only got without any examples and a readme.

It's author is thewd, but I don't know if the author and the member registered here are the same person.
SpeKKeL
01-26-2002, 05:50 PM
Allso try :FuckFmn v0.1 (beta version) - 14.11.2001
Written by..: smola^cp +some support
Program type: new technology loader working under ring0 for w9x/w2k
IS able to patch *ANY* commercial product packed with
*ANY* exepacker (included latest asprotect)
See protools.......

Succes ,

Spek
jomamameister
01-26-2002, 10:39 PM
thanks to all who contributed their knowledge. i did get to download the ? latest process patcher from thewd 4.00. i will keep my eyes open and keep trying new things. here's a quick def for insanity:
you keep on trying the same things hoping to get different results.

thanks again everyone.
jomamameister
DakienDX
01-27-2002, 04:49 AM
Originally posted by SpeKKeL
Allso try :FuckFmn v0.1 (beta version) - 14.11.2001
Written by..: smola^cp +some support
Program type: new technology loader working under ring0 for w9x/w2k
IS able to patch *ANY* commercial product packed with
*ANY* exepacker (included latest asprotect)
See protools.......

Succes ,

Spek

"i tested his on many, many packed appz and i always get the positive effects but is the only one limitation: this loader cannot patch applications written in win32asm... hmm, one question: who write a commercial soft in win32asm? :) hehe, sado-maso? so, try it on any appz written in delphi, vc, vb or other high languages."

I already can see the high-level stub patchers floting around. Do you remember UPC, TEU and XPack -ux?


Tut site update
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tut site update
PDA

View Full Version : Tut site update

krobar
01-24-2002, 07:12 PM
Hi all

If anyone interested, I added a couple of hundred more cracking tuts to my site. The usual address: h**p://zor.org/krobar

P.S. thanks for the space yates...
Solomon
01-24-2002, 08:26 PM
awsome site. Thx for your hard work!
kugi
01-25-2002, 11:57 AM
Hi Krobar,

Went to the page. Got a ton of new tuts. Thanks for your good work.

Regards, Kugi
XICO2KX
01-26-2002, 09:42 AM
Wow, really nice!!! :D
Most of the tutorials I have were downloaded from your awsome site!!! :p
I'm going to check it now again to see if there's something new and interesting around! ;)
Great work, Krobar! :D


Help required. Hex workshop problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help required. Hex workshop problem
PDA

View Full Version : Help required. Hex workshop problem

Toto
01-24-2002, 07:41 PM
Hex workshop 3.1
I installed it then run it once then advanced the clock 2 months and run it again
It became locked
Corrected the clock
Still locked
Uninstalled it
Removed the folder and its remaining contents
Removed all registry entries
Removed win.ini section
Reinstalled it
Still locked
Regmon, Filemon
Don't know what
How does it know it was previously installed?
Tried to crack it
Not like the previous version
Failed to crack it
Help Help Help Help
Aimless
01-24-2002, 11:34 PM
Hullo,

Search for hw*.ini in the C:\windows and subdirectories!

Besides, is it really necessary, that the protection *should* exist in the registry/external files ? Not so.

A simple .dll or the .exe (for that matter HexWorkshop .exe) could be undergoing changes. Try snooping there.

Better to disassemble the .exe and *force* it to reveal its own mystries.

...Have Phun
DakienDX
01-25-2002, 11:30 AM
Hello Toto !

I'm running Hex Workshop 3.11. My version does not have the HW*.INI file anywhere and removing the three "Breakpoint" entries in the registry (after uninstalling it) does the job when reinstalling it.

Hex Workshop is quite old (Jun 3 2000) so I think you would not have to make up too much with your mind in order to keygen it. :)
Solomon
01-25-2002, 12:37 PM
yeah, Hex Workshop has not been updated for a long time. I often use it to search Unicode strings, but it seems to have a bug. If you press "Home" key in it, you will know what I say.

Are there any other hex editors which can search Unicode strings? Thx
DakienDX
01-25-2002, 12:54 PM
Hello Solomon !

I don't know a tool to search for UNICODE, but you could follow this (http://www.woodmann.net/forum/showthread.php?threadid=2542) thread to find a solution.

Where does the "Home" error happen? I can use the "Home" key in disc-view, file-view, search history and without a file opened without any problems.
Solomon
01-25-2002, 10:30 PM
thx DakienDX, I will read it.

I'm using a localized version of Hex workshop, when I press ctrl+home, somtimes it can't go to the correct location. I will get the original English ver.:)
kerix
01-26-2002, 08:11 AM
There is a powerful tool- winhex can search unicode strings!


Feature Request: Downloading threads
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Feature Request: Downloading threads
PDA

View Full Version : Feature Request: Downloading threads

Aimless
01-25-2002, 12:02 AM
Hullo,

Just a wish-list to the adminsitrators of the board..

Would it be possible, to add a [save entire thread as .zip] button to all thread beginnings? This is because some threads are REALLY good, one would like to store them, but has to keep pressing File->Save as (and of course, the attachments within them are not stored) so you have to store them seprately. And then some threads go into pages...

Just a thought.

...Have Phun
m0sk
01-25-2002, 01:34 AM
Well, not really a solution, but for threads that go into multiple pages, you could save the printable version of the thread... doesn't solve the attach problem though :(
DakienDX
01-25-2002, 10:58 AM
Hello aimless !

This is not possible at the moment and unlikely in future.

If you only want to save one specified thread, you should use a program called Teleport Pro. I don't know it myself, but I heard many times of it on this board.

There should be no problem with this. Please read also this this (http://www.woodmann.net/forum/showthread.php?threadid=2201) thread to understand why we can't add a ZIP feature.
Solomon
01-25-2002, 12:41 PM
I always use Offline Explorer Pro(w*w.metaproducts.com) to grab sites. It has a good filter feature.
Woodmann
01-25-2002, 03:42 PM
Howdy,
Saving the print version is as good as your gonna get.
You will have to get all the attachments afterwards.

There are a few site rippers out there, I dont know how
good they are. We did have that problem with tel-port that
never got resolved.(I think)

Perhaps a bot might be an option.
There are bots here that gather information.
Peace, Woodmann
JMI
01-25-2002, 07:42 PM
I was the one who raised the issue before with Teleport Pro. The problem is that there are currently approximately 2,300 threads and over 12,000 posts. Attempting to download the entire site on a 56K modem line took forever and didn't get all the material.

Filtering for just the printthread portion might be an answer, but there still remain a huge volumn of threads to acquire. As others suggested, the printable version saves a smaller version, without as many graphics for all the buttons as using "save as".

The other day I downloaded a program that creates an index of html pages and I'm going to attempt to make an index of the huge amount of materials I've down loaded. Sometimes I have trouble deciding into which category or categories to put an article or thread I've downloaded. This, of course, makes it more difficult to fine something you "know" you have on your HD.

Regards.


VBCrackMe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VBCrackMe
PDA

View Full Version : VBCrackMe

SargeG
01-25-2002, 09:02 AM
All:
Can anyone give me a quick hint where I can find the "target file" that is used in EternalBliss's VBCrackMe #10?...Its the one that uses the WKTVBDebugger. I have the CrackMe tut, but need the target. Thanks.

Sarge
josephCo
01-25-2002, 12:51 PM
What is the name of the crackme? Also where to find the tute?

joe
josephCo
01-25-2002, 12:55 PM
OOps my bad :) I should have checked my HD first :) Umm where do you want it sent?
SargeG
01-25-2002, 04:03 PM
Please send it to my hotmail address...and to repeat, I have the tut, I need the target file.

Thanks
Sarge

PS: Fancy meeting you here.


tools that logs a program address CS:EIP execution?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > tools that logs a program address CS:EIP execution?
PDA

View Full Version : tools that logs a program address CS:EIP execution?

WoZX
01-25-2002, 10:12 AM
as above, thx.

is it possible?

the reason is that, a program when works correctly (trial not expired yet) goes a certain logic path, but when it doesn't it goes to other logic path, any tools that logs that address ?

thx.
Aimless
01-25-2002, 11:10 AM
Its called instrmentation/profiling of the code. You need the profiler/instrumenter/sourcecode/debug symbols..[OR}

There is another tool...

...And its called (DEBUGGER)!!!

Surprised??

Don't be.

ALL debuggers have this capability to log the necessary.

Lets talk about the two main ones:

(a) SoftICE
(b) M$ on available on www.microsoft.com/ddk/debugging

Both are heavy-duty ones, though softice is better if you want to crack VXD's but M$ is better if you want to crack APPS.

(a) SOFTICE

1. Turn off the code window (that correct!!)
2. Keep on pressing F10 key (or F8) and see the disassembly as it progresses!!
3. Feeling bored? Try giving the command T 300 in softice (this will trace and display the 300 lines in softice starting from the address you speficified)
4. Want to do the same as point3, but for P? You can. Write a macro that says:

MACRO XXX = "P; XXX"

This actually LOOPS the macro. The last line in this macro will ALWAYS be a CALL .... (don't bother if you do not understand this. Just try it)

(b) M$ Debugger

Slightly tricky.

(1) Ensure that the command window is open
(2) Ensure that before the debugging starts you have the entry point of the exe (m$ does not give you that :()
(3) Ensure file logging is on
(4) Start and keep on pressing F10 (you! here too) and the command window and the log files get filled with the instructions. Better than softice because with each instruction you also get the REGISTER figures (good!)
(5) Bored of pressing the same? Try giving:

$<xyz.txt

where xyz.txt is a file that mentions

P
$<xyz.txt

as a LOOP in itself.

(c)
If you are looking at PROFESSIONAL levels of the same, you may want to try ETCH, the Washington.edu site (this does not even require symbols. Only an binary image will also do (!!!) But sadly, the site is currently out for repairs (I think). Try giving:

"instrument win32 binary without source"

without the quotes in Google, and you can carry on from there.

---------
Officially speaking? No tools CURRENTLY does that that I know of, except maybe hacker written routines.

Feel free to email me to let me explain how to use IDA to generate a listing that can show up in M$ debugger (with IDA comments!!!!! YEAH!!!)., tho' its a bit crude in implementation...

...Have Phun
DakienDX
01-25-2002, 11:41 AM
Hello WoZX !

The M$ debugger runs only on NT/2K/XP, SoftICE runs on all M$ platforms.

The best tool for this would be probalby Turbo Profiler from Borland (optimized for RDTSC), but they only developed a DOS version of it. And this one is ten years old.
WoZX
01-25-2002, 12:11 PM
wow, thanks.

i guess i'll have to stick to SICE (^_^)

btw, SICE installation on Win2K requires the 'memory protection something something..' to be disabled. what setting does it change, how to change it back to normal ?

thx again.
DakienDX
01-25-2002, 12:27 PM
Hello WoZX !

SoftICE setup changes the registry value of the Memory Write Protection to the rigth value and you should not need to change it back, Win2K runs also when it's turned off. (you wouldn't belive it :) ) I can't tell you the name of the registry key at the moment, because I had Win2K not installed in the last half year.
Aimless
01-28-2002, 06:33 AM
Hullo All,

Continuing from my above thread, the latest version of M$ debug ALSO has:

P <count>

where it can step, record with registers and save as file all the P commands that you would have spent otherwise.

So my second option for using $<xxx.txt is now redundant.

By the way, I generally debug using this debugger,as Softice is nowadays not good on Win2K and XP. ICE is getting too buggy and crashes the system too often to be used properly.

And you do have an inbuilt profiler/instrumentor in the debugger itself.

Turbo Profiler (??) I think that I have used that once, and it works ONLY with the source code.

A liability in our current context, would you say not?

Still, try the necessary, and wait for Ollydbg 1.06 (with AUTO trace compares and saving). That'll instrument too!!

...Have Phun, Always.
DakienDX
01-28-2002, 11:49 AM
Hello aimless !

Turbo Profiler works with Source, Code and Mixed. I can profile COMMAND.COM without any problems. I've just tested it and could set 2515 areas to profile the program. This is not good enough to see the whole running execution, but, to be honest, who would try to profile a DOS program in this days? After all the Visual this and Visual that developement tools, nobody knows profiling any more.

For the ones that do not know what I'm talking about: Profiling means to watch the execution of a program with a timer and see which parts of the program are called most often and which parts take the most time, so the specified parts could be optimized and the whole program works faster.
WARM3CH
01-28-2002, 11:59 AM
Hi all,

I guess Numega's TrueTime is the best tool for this purpose. It's available in different versions for DeviceDrivers and Applications. Give it a try ;)

Regards
WARM3CH


big dumb newb question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > big dumb newb question
PDA

View Full Version : big dumb newb question

avarice
01-26-2002, 06:08 AM
why aren't there any decompilers taht decompile directly into C or C++

i dont' know asm and i don't want to know it, if C++ can be "compiled" into asm and then into binary, i don't understand why the process can't be reversed..
naides
01-26-2002, 07:12 AM
Answer:

The process can be reversed. There exist several decompilers. Look in the Borland site. Also look these two references from a quick google search:

h**p://www.itee.uq.edu.au/~csmweb/dcc.html

h**p://home.online.no/~reopsahl/files/gij!ida.txt

To decompile an .exe file compiled with an specific compiler i.e. borland c++ 5.0 you would need a specific Borland 5.0 decompiler. For a 3.0 you may need a 3.0 decompiler and so on, as the high level instructions equivalent to a given piece of code are very much compiler specific. Dissasemblers, on the other hand, are more universal.

For the kind of tinkering necessary for RE, use of decompilers provides little advantage.
avarice
01-26-2002, 03:51 PM
1.) are there any decompilers for VC++ 6.0

2.) how do i find out what compiler was used
?ferret
01-26-2002, 05:46 PM
Hi,

I've never looked for a VC++ 6.0 decompiler, but you could check the search engines (try more than one, you'll get different results)

There are different "signatures" that each compiler leave behind for you to look for....in the case of VC++, it's easy to look for the runtime DLL unless it's appended to the exe in which case you need to check the imports. VB is the same way. Some other languages leave info in the PE header.

Hope that clears things up a bit


Windows SDK Mailslot !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Windows SDK Mailslot !
PDA

View Full Version : Windows SDK Mailslot !

eight
01-26-2002, 12:57 PM
Hi,

is there any essay on the web withe an example prog
how use windows sdk mailslot to transfer name/code
for protection ?
Armadillo use this protection transfer to.
i have a problem to find and manipulate the right variables
i study this protection many days and night´s but no succes.

@DarkienDX
have you reg succes withe the example prog ?

@to all
any help or tip´s for examles !

this protection make´s me crazy ;-)
DakienDX
01-26-2002, 04:31 PM
Hello eight !

Totally forgot about it. Sorry. :( (I was too busy ;) )
I'll take a look at it on Sunday.
I still have the target in my E-Mail client, so be patient.
eight
02-15-2002, 12:34 PM
Hello DakienDX,

is the patient dead or have it a chance to live ?
DakienDX
02-15-2002, 02:17 PM
Hello eight !

It looks quite dead to me. :(

I'm still on it, but only if I've nothing else to do. I'll have much time in July, but I think this does not help you now.

If I finally can figure out the keygen algorithm, I'll tell you about it.


new type of clever protection?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new type of clever protection?
PDA

View Full Version : new type of clever protection?

WoZX
01-26-2002, 03:16 PM
i downloaded this software from cjkware.com

"KeyTip chinese", it is a full featured free-trial no time limit for reading chinese text.

the only problem is that, it MUST connect to it's server on auth.cjkware.com port 12345 (looking on the 'DEAD LISTING')
and do some 'authentication' then it will create a file called 'KEYH2P.DLL', once successfull, the program is ready to run.

it will delete the .DLL once closed, and recreate again after the 'authentication' process.

I tried to modify to .EXE file but it terminate itself once the file CRC is changed.

can anyone help me??
DakienDX
01-26-2002, 04:46 PM
Hello WoZX !

I've three problems. The first one is that the site (cjkware.com) is not existing, the next one is that google cache can't show me the page and at last that I don't speak chinese. :)

I wouldn't call that a very tricky protection. If you can look at the dead listing, you have probably unassembled it. So it is not encrypted and you should find the CRC algorithm somewhere.
Do you know if a real .DLL is written to your harddisc? Can you save it before it's deleted?
Is the protection used in a wrapper or linked to the application? If it's a wrapper and unencrypted you could just change the OEP and IAT to there original values and the protection would be gone.
Is the application complete or are some bytes missing at the OEP?
ThrawN
01-26-2002, 05:47 PM
I dont understand the protection in this app. The DLL it creates is for keyboard hooking.
As for deadlisting? well you can enter any email you want anyway? it allows you to use any email address you want also (from what iv seen)
The program is in no way restricted is it not?

Darkie: the site does exsist as i downloaded it ;)

ThrawN
WoZX
01-26-2002, 09:42 PM
thanks, so far this is my analysis:

when program starts, it will:

1. probably checks for CRC
2. connect to internet at auth.cjkware.com:12345
3. exchange data (but dunno what data is being exchanged)
4. if authentication OK, create KEYH2P.DLL(yes, i can copy the DLL file)
5. once program closes, deletes the .DLL file.

the program is a full-featured trial, no time limit whatsoever, it is the protection that i'm interested, that is after 'authentication' then the program will run, or it will close.

there are lots of 'nop' in the program, seems like it gets data from its server and place it on to it's code and then execute, but i could be wrong.
DakienDX
01-27-2002, 04:15 AM
Hello WoZX !

Don't you want to use a debugger? You could bypass the CRC check simply (in most cases). You could set some WinSock/WinSock2 breakpoints and simply see what data is sent and see what data is returned. If you don't want to send anything, you should look for the SocketHandler and serach for the FD_READ message. There you should be able to guess the format of the data supposed to be returned.

Is the .DLL included somewhere in the program (.code, .data, .rsrc, ...) or is it created from the authentication data or decrypted with help of it?

If you are only interested in the protection's authentication, you can easy build such a thing by your self (or use one of the available systems). Just set up an internet server with a program listening for connections. If a connection is made, check if the incomming data is "MyProtection$1.0$Full$MyProtectedApp$" and if yes, then send back "Auth$OK$", else "Auth$Failed$".
WoZX
01-27-2002, 06:32 AM
nope, i have used API monitor to get socket info on 'send' and 'receive', data is encrypted.

it receive about 1 MB of data (according to the API monitor from the parameter of winsock 'receive' call), so i guess the DLL is created from the data.

i have check that the DLL is always the same size and content, so what i want to do is to bypass the authentication and jump over to loading of it's DLL.(maybe someone can help me??)

btw, if i'm not wrong, the program also communicate at certain period to tom.cjkware.com:12345, and somehow it stop working after a while.

i really need help here.

thanks.
DakienDX
01-27-2002, 09:13 AM
Hello WoZX !

Here is my advice:
Find the CRC check and remove it.
Save a copy of the .DLL somewhere.
Find the createfile function and patch it to open the file instead of create it.
Find where the .DLL is deleted after execution and patch it too.
Copy the .DLL to the directory that it is downloaded normally.
If the program still works as it should, find the authentication procedure and patch it so no data is send and it thinks that some usable data is received and written to the .DLL.
After that, have fun.BTW, I don't understand you, I think. One time you write "it is the protection that i'm interested, that is after 'authentication' then the program will run, or it will close" and the other time "so what i want to do is to bypass the authentication and jump over to loading of it's DLL". So one time you're not interested in the program but only in the protection, the other time you want to have the program cracked and are not interested in the protection.
WoZX
01-27-2002, 08:25 PM
Originally posted by DakienDX
Hello WoZX !

Here is my advice:
Find the CRC check and remove it.
Save a copy of the .DLL somewhere.
Find the createfile function and patch it to open the file instead of create it.
Find where the .DLL is deleted after execution and patch it too.
Copy the .DLL to the directory that it is downloaded normally.
If the program still works as it should, find the authentication procedure and patch it so no data is send and it thinks that some usable data is received and written to the .DLL.
After that, have fun.BTW, I don't understand you, I think. One time you write "it is the protection that i'm interested, that is after 'authentication' then the program will run, or it will close" and the other time "so what i want to do is to bypass the authentication and jump over to loading of it's DLL". So one time you're not interested in the program but only in the protection, the other time you want to have the program cracked and are not interested in the protection.

isn't this forum about software protection and teaching newbies like me to learn their protection and how to crack it?
NikDH
01-27-2002, 09:12 PM
Originally posted by WoZX

btw, if i'm not wrong, the program also communicate at certain period to tom.cjkware.com:12345, and somehow it stop working after a while.

Hi woz,
well i'vent checked the prog myself so i'm writing here just a little thought i had reading the thread:
if thrawn is right and dll contains keyboard hooking code
and u said the proc is going comunicating with the
site 4 sometimes after the auth has happened u think that it should send some of ur keyb logs to the site ?
This is a strange behaviour 4 such a prog

See ya
NikDH
Woodmann
01-27-2002, 09:34 PM
Strange........

The company appears legit (I will check further)
The tom.cjkware.com is best known as a chess server
address.

The "key" access is where the server needs to download
Chineese, japaneese and Korean fonts and other stuff so you can
do whatever you need to do in Asian.

Peace, Woodmann
WoZX
01-27-2002, 10:27 PM
Originally posted by NikDH

Hi woz,
well i'vent checked the prog myself so i'm writing here just a little thought i had reading the thread:
if thrawn is right and dll contains keyboard hooking code
and u said the proc is going comunicating with the
site 4 sometimes after the auth has happened u think that it should send some of ur keyb logs to the site ?
This is a strange behaviour 4 such a prog

See ya
NikDH

no, u got it wrong, i never said that the prog will send our keystroke log to the site, and i never even ever mentioned that the DLL is a keyboard hook (trhawn find out about it not me).

i only say it's a KEYH2P.DLL is created and after the prog running for sometimes, it will contact tom.cjware.com:12345 for something else which i have no idea of right now.
Bengaly
01-28-2002, 04:13 AM
hi all,
I think since the first post everyone got lost in what the prog should do, it all got mixed up so much that even the author of this thred mixed up ;P
but as DakienDX said,
try kicking the CRC or even reCalculate the CRC checksum after modifying the Executable file,
than just kill/avoid the deletion of the DLL file procedure so the connection to the net wont be effective, i think this sceme type is also used in acdsee (can't rememebr which version excactly)
anyway, i hope u succeed in ur mission,
over out.
DakienDX
01-28-2002, 11:39 AM
Originally posted by WoZX
isn't this forum about software protection and teaching newbies like me to learn their protection and how to crack it? Hello WoZ !

OK, I'll try to help you.
Find the CRC check and remove it.
-> The most common method is CRC-32 with PKZip-Poly (EDB88320h). So you can search for the value somewhere. This should be the CRC-Table-Generation-Routine. The other possibility is that the CRC-Table is alread pre-generated, so serach for a block starting with: 00000000h, 77073096h, EE0E612Ch. (this sould be enough) Then search for any call pointing to the function or the table and you are somewhere near the CRC-32 routine. It could also use hash-functions, so you must look for their specific values.
Save a copy of the .DLL somewhere.
-> This shouldn't be difficult, since you've alredy done it.
Find the createfile function and patch it to open the file instead of create it.
-> Look for a function which creates the .DLL. This could be CreateFileA/CreateFileW or _lcreat. Replace the parameter of CreateFile(A/W) from CREATE_NEW or CREATE_ALWAYS to OPEN_EXISTING or replace the _lcreat function with _lopen.
Find where the .DLL is deleted after execution and patch it too.
-> You should look for DeleteFileA (or DeleteFileW because it's possibly an UNICODE program)
Copy the .DLL to the directory that it is downloaded normally.
-> I think you can do this without my help.
If the program still works as it should, find the authentication procedure and patch it so no data is send and it thinks that some usable data is received and written to the .DLL.
-> A bit more tricky, but if you've succeded until here, you should also get this one. Look at some WinSock/Winsock2 exports. Most time the send/recv /TCP) or the sento/recvfrom (UDP) functions are a good hint.
After that, have fun.
-> I don't need to tell you how, do I?
WoZX
01-28-2002, 07:50 PM
Originally posted by DakienDX
Hello WoZ !

OK, I'll try to help you.
Find the CRC check and remove it.
-> The most common method is CRC-32 with PKZip-Poly (EDB88320h). So you can search for the value somewhere. This should be the CRC-Table-Generation-Routine. The other possibility is that the CRC-Table is alread pre-generated, so serach for a block starting with: 00000000h, 77073096h, EE0E612Ch. (this sould be enough) Then search for any call pointing to the function or the table and you are somewhere near the CRC-32 routine. It could also use hash-functions, so you must look for their specific values.
Save a copy of the .DLL somewhere.
-> This shouldn't be difficult, since you've alredy done it.
Find the createfile function and patch it to open the file instead of create it.
-> Look for a function which creates the .DLL. This could be CreateFileA/CreateFileW or _lcreat. Replace the parameter of CreateFile(A/W) from CREATE_NEW or CREATE_ALWAYS to OPEN_EXISTING or replace the _lcreat function with _lopen.
Find where the .DLL is deleted after execution and patch it too.
-> You should look for DeleteFileA (or DeleteFileW because it's possibly an UNICODE program)
Copy the .DLL to the directory that it is downloaded normally.
-> I think you can do this without my help.
If the program still works as it should, find the authentication procedure and patch it so no data is send and it thinks that some usable data is received and written to the .DLL.
-> A bit more tricky, but if you've succeded until here, you should also get this one. Look at some WinSock/Winsock2 exports. Most time the send/recv /TCP) or the sento/recvfrom (UDP) functions are a good hint.
After that, have fun.
-> I don't need to tell you how, do I?

hi, thanks for the info on the CRC thingy, really appreciate it.

as for the CreateFileA, i can change to OPEN_EXISTING.

backup the DLL, should be no problem.

patching the code to think that connection is successful and 'authenticated' is a tough one, still checking though.

thanks a lot.


Softice question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice question
PDA

View Full Version : Softice question

Toto
01-26-2002, 08:01 PM
What is exactly the back trace buffer in softice?
What can it do and how can we activate it?
Is it useful or does it make things easier?
Aimless
01-28-2002, 06:42 AM
Hullo,

Simply put, the backtrace buffer is just that. A backtrace.

What it means is that,

Suppose from address A to address B (they can be far apart), the code travels.

This journey consists of may different types of instructions. There could be many instructions covered between A and B and many more skipped between A and B (jnz, je...and so on)

Backtrace will show you EXACTLY the instructions that were executed! rather than simply what the file contains.

There is an essay (good one) about backtrace buffers on tsehp.cjb.net. Check it out.

However, remember that the buffer is circular. What it means is that initially when you save space for the backtrace buffer (in softice), this space can store certain number of instructions. Beyond that the first one will be replaced and so on.

So make sure that you have enough buffer space.

Also, it might help to read the essay at Tsehp's site.

...Have Phun, Always.


FileInfo 2.49 blues
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FileInfo 2.49 blues
PDA

View Full Version : FileInfo 2.49 blues

Idcrisis
01-27-2002, 05:08 PM
hello, i am a stark naked newbie...and i have been dealt a rude shock...

fi2.49a doesn't work in my country. tried changing the timezone and other lame stuff...didn't work...

i won't make any comments on the possible lack of political correctness of such an act by the author of FI, since it is such a great tool.

please give me any pointers. it seems that it is packed, full of 'call bp' kind of ugly statements as reported by turbo debugger. it is 16-bit and therefore a lot of tools don't work on it.

thanks


Plugin for Ida 4.1.5.520
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Plugin for Ida 4.1.5.520
PDA

View Full Version : Plugin for Ida 4.1.5.520

h8er
01-27-2002, 05:37 PM
Where can i find a working string reference plugin fo this version ??
Aimless
01-28-2002, 06:28 AM
Hullo,

It appears that SPATH has sent across the .plw files. And not the source files...

You will have to:

1. Find the SDK for your version
2. Download Borland Free compiler for C++
3. Find the source for this string reference
4. Compile and get the necessary

Uff, too much of trouble for such a small thing. Instead do what I do:

1. Download the latest version (trial, always) of IDA from its own datarescue site.
2. Search for strings (normal and unicode) as version 4.17 and above do the same automatically
3. Save the file as IDC (as other options are disabled)
4. Search for makename functions with a or str= (as in my personal case...)
5. You can use grep or findstr for that
6. Save that as IDC file
7. Import the same in your disassembly
8. THEN select NAMES again. And you will have ALL strings (C and UNICODE based)

...Have Phun. Always.
h8er
01-28-2002, 05:18 PM
Thanks a lot aimless but the SDK is downloadable only for registered users :(


Any way to crack this?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Any way to crack this?
PDA

View Full Version : Any way to crack this?

Toto
01-27-2002, 07:05 PM
I made a program by visual basic that requires you to select some pictures in order to enter
If you select the wrong pictures it gives you a message box which says "wrong selection"
If you succeed it does nothing but saying "seccess"
Although this is my own program, I can't crack it because I don't know what API function to break point upon
I just want to know where exactly to break point
I want to crack it using only softice or wdasm not a visual basic decompiler
The program is included with this message
Note: The right selection is 1 3 2
Any help will be appreciated
Thanks
thewd
01-27-2002, 09:17 PM
the breakpoint address you should look at 0x404CC6. this is where the conditional jump is and jumps if incorrect sequence.

to patch - nop out the 6 bytes of the jump or patch the jump location.

1)
je 0x404DC4 ==> nop, nop, nop, nop, nop, nop
2)
je 0x404DC4 ==> jmps 0x404CCC

regards
thewd
jppizhere
01-27-2002, 09:44 PM
You should be able to bpx on __vbaFreeVar or __vbaVarDup on should get you into the code before the messagebox, the other after.


FlexLM: what's difference between 7.2a and 7.2f
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM: what's difference between 7.2a and 7.2f
PDA

View Full Version : FlexLM: what's difference between 7.2a and 7.2f

netman
01-27-2002, 11:11 PM
hi,

Anybody out there knows the difference between 7.2a and 7.2f?

I only have SDK 7.2a and try to crack some 7.2f target without success.

I read NB's "Zendenc FLEXLM 7.2 cracking information" and extract seed1 & seed2. And sign length of my target is 12, so I assume that

#define LM_STRENGTH LM_STRENGTH_DEFAULT

Of course, I assigned seed3 & seed4 random numbers. Because the sign length is 12, this target should use the "default" mode (no CRO, no public/private key), right?

Any help?

-----------
netman
netman
01-28-2002, 02:54 AM
OK, I got 7.2f SDK.
The result is the same. So......
Not the version issue.

Any suggestion?

PS. I think the seed1 & seed2 are correct ones. I tried different run, got different job struct but the same result from calcseed (thanks to NB).

And, no crypt filter, no checkout filter, either.

----
netman
nblender
01-28-2002, 04:57 PM
maybe watch lc_set_attr and see if its setting something else...
Some large mechanical CAD application uses LM_A_CASE_SENSITIVE, so your app may be doing this too.
netman
01-28-2002, 09:32 PM
Thanks, NB.

I got two lc_set_attr:

LM_A_USER_CRYPT
LM_A_CRYPT_CASE_SENSITIVE

Will check it out.

Any hint?

----
netman
netman
01-28-2002, 10:22 PM
NB,

maybe CASE_SENSITIVE isn't the cause of my wrong lmcrypt.
(I tried both upper and lower sign code, all failed).

I'm not confident about my seed1/seed2 now, could you check my vendorcode/job struct for me?

My cracking platform is SUN Solaris 2.6, the following is the adb segment,

job struct (after lm_new):

0 6600 ff00 dd00 2bd f26f
a0dd f2e2 825e aeb0 0000
00 00 4447 4453 7369 6c70
7961 454c

vendorcode struct (after lm_new):

400 0 9cd8 64b0 4dd8 9789 8836 11bb
a27 2aa1 6ef6 4862 d833 1dce 0 0

So, I assume,

vendorcode+4 (data[0]) : d89cb064
vendorcode+8 (data[1]) : d84d8997

job+8 : bd026ff2
job+c : dda0e2f2
job+10 : 5e82b0ae

Thanks....
Kythen
01-28-2002, 10:55 PM
The LM_A_USER_CRYPT is your problem. That sets FlexLM to use a user-defined routine to check the encryption string. The third parameter to the lc_set_attr call that sets that attribute is the address of the routine. The routine is defined like this:
(*crypt)(job, config, sdate, vendorcode); You can check out the FlexLM manual for more details on what the routine should be like.
netman
01-28-2002, 11:49 PM
It's wiered...

The parameters to lc_set_attr for LM_A_USER_CRYPT are as follows,

(job, 0xf, 0x0)

Anyway, thanks for reply, Kythen.

----
netman
netman
01-29-2002, 04:30 AM
I give up....
No time to dig it deeper, just patched my target.
And it works well.

Thank NB, Kythen for your valuable reply.

----
netman


Alittle bit of Encryption/Decryption fun...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Alittle bit of Encryption/Decryption fun...
PDA

View Full Version : Alittle bit of Encryption/Decryption fun...

Bengaly
01-28-2002, 04:44 AM
Hi all...

i have put this thread just to wake up this little corner of the forum, cryptology has been always fun when u know it and play with it, so i wanna play with you guys today with this easy Decryption game, hope u will all succeed:

some info on the game:
-----------------------------------------------------------------------------
1. Key lenght is the same length as the original/encrypted msg.

2. algo is not hard, [involve with position i/j subtitution which will be xored together with the key],
to simplify the small algo it goes like this: loop until j->position i to encrypt = i + (j-i) xor position of the (j-i) of the key.
so i guess u need to write a backward algo :) have fun

3. write a working decryptor/encryptor
------------------------------------------------------------------------------

if u need more info, dont hasitate to msg me.
* see attached key/encrypted msg

see ya later guys :)


tE!'s RSA Tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > tE!'s RSA Tool
PDA

View Full Version : tE!'s RSA Tool

bl00dbath
01-28-2002, 12:44 PM
Hey all,

I've been lookin for tE's RSA Tool, but can't seem to find it anywhere since tE's, TMG's and DAMN's site have been down. Didn't have any luck with google or protools either. I was wondering if anyone had it and could post it here? It'd be greatly appreciated. :)

Thanks,
bl00dbath
Solomon
01-28-2002, 10:11 PM
here:D
Solomon
01-28-2002, 11:24 PM
DSS/DSA tool.
bl00dbath
01-28-2002, 11:58 PM
Thanks a lot Solomon! :D

bl00dbath


First Timer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > First Timer
PDA

View Full Version : First Timer

WannaBCracker
01-28-2002, 06:46 PM
Over the past 5 years of being on the net, all the knowledge I have gained has been through communication of some kind especially forums.

It's about time I learn some cracking.

My first program is something similar to installshield. I need to verify the serial to extract the files.
Does anyone know of a brute force program that could run a scheme to click the ok box then input another password until the serial is correct and save the correct serial number once done.

An old program like fakesurf meant for cheating pay for surf companies had the ability to remember mouse movement and ultimate zip cracker (UZC) together would work perfect.
Does such a program exist to brute force and reclick a the popup invalid serial number error until success is achieved?

Keep up the great Woodmann
DakienDX
01-29-2002, 11:53 AM
Hello WannaBCracker !

Of course there are such programs. But I really don't know why anybody would use such a thing.

Let's see it very positive and say the program can test two passwords in a second. (because we assume there is no delay or quit after three false serials) Let's assume the serial is only a ten-digit number. So it would take (9999999999-1000000000)/2 seconds to bruteforce it. This example would take 142 years to get the right serial.

And if you finally have it, how do you know that the screen after the password prompt does not show the license contract and the default button is set to "Decline"? So the next <Return> send by the bruteforcing program would exit the installer.
Samneric
01-29-2002, 12:02 PM
It's about time I learn some cracking.
My first program is something similar to installshield. I need to verify the serial to extract the files.
Does anyone know of a brute force program that could run a scheme to click the ok box then input another password until the serial is correct and save the correct serial number once done.

You're assuming that brute-forcing the password is the only way to approach this. And you haven't included the name (and url) of your target, so nobody can point you in a different (and possibly-easier) direction.

Are there already tutorials out there that discuss the protections used by this company?

Look at the code to see what the program does with your entered password. How does it cross-check the serial? That's what reversing is all about.


Tell me what all I can learn from this picture
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tell me what all I can learn from this picture
PDA

View Full Version : Tell me what all I can learn from this picture

WannaBCracker
01-28-2002, 11:37 PM
Here's a screen dump of a project I'm working on.

Am I going in the right direction? More stuff with SI is next.

Us newbies would love tutorials with screenshots for faster learning.

I'm sorry WannaBCracker, but I had to remove the picture. It was to big (1173x1770) and took to much time to download. It contained no information which could be used by anybody here anyway. So please try to describe your problem in words and please don't upload any more screen shots.

----------------
The files are now hosted on there own server way on the other side of the world in Slovakia.

http://www.webpark.sk/2352355/attachment.gif big (1173x1770)
--------------------

Also if noone knew Nutmega's programs try to access the internet so presume more and more porgrams will contain spyware.
http://www.webpark.sk/2352355/monitor.gif

236.54.63.75
dns result

01/29/02 11:20:59 IP block 236.54.63.75
Trying 236.54.63.75 at ARIN
Trying 236.54.63 at ARIN
IANA (NET-MCAST-NET)
Internet Assigned Numbers Authority
4676 Admiralty Way, Suite 330
Marina del Rey, CA 90292-6695
US

Netname: MCAST-NET
Netblock: 224.0.0.0 - 239.255.255.255


Circuit Shop
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Circuit Shop
PDA

View Full Version : Circuit Shop

Tyagi
01-29-2002, 06:00 AM
Hi
Circuit shop V 2.0 is available at cherrywoodsystems.com/cshop1.htm
I have tried cracking it myself but so far I am unable to. I am a newbeie and want your help.The software now uses anti Softice tricks(Though it can be defeated by using forgice).It also
creates a Tmp file in windows temp directory for registration validation routine which is rewritten everytime you load it.
So we cannot permanently patch it.The Program itself is packed which I am unable to unpack so far.It juggles a lot with registration code which I am unable to follow.Help me?

Hi
Well Sorry if I made it look like a cracking request.Here is what I have been doing so far Let us suppose if I take 7457356696238271 as registration code.The proggy creats a temp file in windows temp directory with name arm****.tmp.Where digits in place of astrics are changed every time you try it again.This code is stored at address 55EC84 as 7457356696238271 It is then checked for sixteen digits.Then it is stored as HEX values starting at address 55E910
as 07 04 05 07 03 05 06 09 06 02 03 08 02 07 01
Then it is stored at address AC2CC0 in Hex values as 74 57 35 66 96 23 82 71
Then it is reversed and stored at 9A927C as 7182-2396-6635-5774
Then it is reversed again and stored again at 9A927C as 7457-3566-9623-8271
Then it is stored at 55E8F8 as 66 35 57 74 71 82 23 96
After that it keep on XORing and restoring at the same place so many times that I lose track of it and unable to develop any logic out of it.

As I am very new I couldn't any more than that.Please Guide me after that.Also tell me what is iCeDump and how to use it.
thnx
Bengaly
01-29-2002, 06:06 AM
hi...

to summerize ur post in 2 words "Crack Request"
well i dont think someone will try crack it to someone,
or else u really tried to crack it...but u haven't gave us any specific info on where the serial generation rutine at, breakpoints, stuff that u tried and didn't worked, what kind of a packer, u can use iCeDump to defeat the anti-sice but that's a diff story , tell us abit more info on what is going on , on that prog within :)
thnx
DakienDX
01-29-2002, 11:41 AM
Hello Tyagi !

This looks like Armadillo to me. But as Bengaly already said, please provide us some more information. You have only told us how to convert a decimal number wrong to hexadecimal.

So I'll give you three hints:
Try the search function of the board.
The key format is ABCD-EFGH-IJKL-MNOP. Each letter represents a hexadecimal digit.
Search for some information regarding Blowfish.After that come back and show us where you're stuck, but only after you've followed steps 1,2 and 3 and used you knowledge from step 3.
Samneric
01-29-2002, 01:48 PM
Originally posted by Tyagi
It also creates a Tmp file in windows temp directory for registration validation routine which is rewritten everytime you load it. So we cannot permanently patch it.

The "disappearing dll"...

Well it's in existence during the validation, so you can put the program in a loop and exit SI while you save it elsewhere to disk. Then WDASM will be able to disassemble it and you'll have a dry-listing to refer to as you solve the registration riddle. You'll also have the actual process addresses you can use to set BPX breakpoints.

Put the program in a loop by single-stepping (in the TMP dll code) to any 2-byte instruction. Then write down the instruction ("test eax, eax" for instance) and then "a eip [ENTER] jmp eip [ENTER] [ENTER]". Restore the instruction the same way after you've copied the "secret" dll to disk.
DakienDX
01-29-2002, 03:36 PM
Hello Samneric !

The problem here is not getting the .DLL saved to harddisc, since it wil not help us much further. When searching we find out that it uses Blowfish, a good and as unbreakable known encryption algorithm.
We now have two possibilities. Unpacking the .EXE and removing the packer or generating a keygen to make unpacking obsolete.

Keygenning is a harder task as we've already seen, unpacking is one too if it's protected by the newer versions of Armadillo and impossible if the program does not run until a valid registration code is entered.
Tyagi
01-30-2002, 05:19 AM
Hi DakienDX & Samneric
Thanks for taking interest in my problem.Well as DakienDX has rightly said there is no problem storing the dll to harddisk as the Tmp file is still available after the proogy stops executing but as I told You earlier It allways uses different name for this tmp file its no use patching it.One more thing that I would like tell you is that if you have not loaded softice the proogy will run in thedemo mode after displaying a nag screen for two seconds,but if i use softice and forgice to fool it it runs but forces us to enter registration info without giving option to run in demo mode.How this change in behaviour takes place I am unable to understand.

I have tried unpacking it Un-Pack ver 2.2 but it fails.Also tell me what is blow fish
Thanks
Tyagi
riPPadoGG
02-02-2002, 06:45 AM
Hi...
Use PEIDentifier to get the version of Armadillo..
Tuts are there all over the net for unpacking older versions of Armadillo.
If it is a newer version, SEARCH THE REVERSE ENGINEERING GENERAL FORUM, you'll get the necessary info
cheers
doGG
Tyagi
02-05-2002, 05:32 AM
Hi
I have stopped trying getting a key out of it as the Key Validation routine contains a lot of annoying code.Now I am trying to unpack it.But I am unable to differentiate between wrapper code and unwrapped code.

Here are a few things I have noticed.
Now I know that it is packed with Armadillo though I know nothing of version(Perhaps higher then 1.x)

1. First of all a process with the same name as of EXE file loads in the memory.
2. It creates a Tmp file with name ARM****.tmp in windows tmp directory which is a characteristic of Armadillo protected files and which handles registration and evaluation routines
3. It displays a nag screen regarding evaluation notice.
4. Then it creates one more tmp file with the same name as EXE but with tmp extension in program directory and load it as a process as well.

Now tell me where should i must look for OEiP ? Before nag screen or after creation of program.tmp file. This file contains some information but lacks any code wihch I suppose is provided runtime by armadillo.

Please help
ThrawN
02-05-2002, 09:16 AM
One way to check version number also is by the dll name
its arm****.tmp for older versions
arm***.tmp for slightly newer version and
arm**.dll for even newer =)

Search the board
there is plenty on the subject
Tyagi
02-06-2002, 12:36 AM
Hi

In my latest findings I have tried packing some programs by armadillo ver 2.2 and then unpacking them.What I have found out is that the temp file in the program directory has everything just the code is missing.Now if you make a copy of it while the proggy is running and make a dump of program.tmp0 using like procdump(full dump).Then you can strip code section from the dumped file and paste it in the copied file .It works fine with smaller proggy like Notepad but fails for large size programs.

Why
Tyagi
DakienDX
02-06-2002, 01:39 AM
Originally posted by riPPadoGG
If it is a newer version, SEARCH THE REVERSE ENGINEERING GENERAL FORUM, you'll get the necessary info
Hello Tyagi !

I would consider 2.2 as a newer version, so look at this (http://www.woodmann.net/forum/showthread.php?threadid=2594) topic. An if someones says you should search on the forum, then do it.

The answer is CopyMemI or CopyMemII protection.
Tyagi
02-06-2002, 12:20 PM
Hi
Thanks DakinDX read your post and saw that link you gave.But tell me how to dump code which is fragmented in 16 K size moreover many portion of the code may not be unpacked as in copymemII protection the code is unpacked only when it is necessery to do so
regd.
Tyagi
slide97
02-25-2002, 07:16 AM
hi everybody

I think I have the same proble as Tyagi on a another soft (wealth-lab developper2).

But i don't know how to know the version of armadillo protection. Someone can help me ?

To ThrawN:
in the temp directory I have a arm****.tmp dll.

To riPPadoGG:
When I use PEIdentifier on the temp dll I have :
Entry Point :0xD876
File Offset : 0xd876
Linker version : 6.0
First Bytes : 055h,08bh, 0ech, 053h

I have to dump manually the exe but unsuccefully,

try all I can't found like unarm tool but don't work. And when I use PEIdentifier on the unpacked exe, PEIDentifier write : "There might be an error in Image Section Header or Entry Point is invalid.

I have try a armdep version 1.1, the dump seems to work (no more XX into the Hex file), but crash at starup, so I suppose the OEP isn't good. And PEIdentifer says :
"Nothing detected :/ Sorry mate."

No, I don't what I can do or try? Crack the SN but It's seems to be very hard (see another post on the forum).


New Member and CoffeeCup Password Applet
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New Member and CoffeeCup Password Applet
PDA

View Full Version : New Member and CoffeeCup Password Applet

indecent
01-29-2002, 06:57 AM
Don't you hate it when a new member comes to the board and posts to say hello.

So I thought I would balance it with an example of some of the stupidest security i've seen for a little while. The makers being coffeecup.

Forget about the website i'm going to mention as it's not really usefully apart from as an example. I just wanted to share something interesting I found, and please excuse me if all this is basic @#%$, but I didn't know it.

Have a look at this website. Sorry about the porn, but someone asked me if I knew how to get in. And was a little suprised at the lack of security, or really blatent stupidity in the makers of CoffeeCup products.

h**p://home.wanadoo.nl/sophiaherman/start.html

When you left click it brings up a menu, go to albums and foto's. You will be presented with a page with a java password applet, made by CoffeeCup. Now when you right click, it brings up a stupid messagebox, so hold down right click and press enter to bring up the normal menu. Because we want to look at the source code.

The important part of the source code is this.

*Edited CODE="joylock.class" WIDTH=342 HEIGHT=140>
<PARAM NAME="GENERATOR" VALUE="CREATED WITH THE APPLET PASSWORD WIZARD WWW.COFFEECUP.COM">
<PARAM NAME="GENERAL" VALUE="8|11|808040|0000FF| | |Login Complete.|Enter the Username and Password. | | |">
<PARAM NAME="0" VALUE="5|5|48|5|ibmdorgwkfvjentlyszquxchapmkmfohappqxooz://xecm.hynydee.np/rezxayxmfcyn/gyppmfq.xocp_rmpj">
<PARAM NAME="1" VALUE="3|7|48|5|afzvihebxgkwnlcruqosypjdtmbqmflovntlfyyv://fszg.lamaxss.mn/tsvfeafgpzam/janngpu.fyzn_tgnb">
<PARAM NAME="2" VALUE="7|3|48|5|cvkigzjumodrywtbeqhsnxfpalsnaxztnwhusoox://sjiq.nyuykjj.uz/tjxsdysqliyu/eyzzqlm.soiz_tqzw">
<PARAM NAME="3" VALUE="6|6|48|5|ueshwakvtijrpdclmxoqzyfgnbcsmdjfdblqfydiim://dsqb.efyfnss.yp/csmdjfdblqfy/xfppblv.diqp_cbpw">
<PARAM NAME="4" VALUE="6|6|48|5|mrzlysebntdxkupaijgwoqhfcvwgbapifuowqpwjjo://wuag.tpipkuu.id/fuowqpwgbapi/spddgbe.wjad_fgdx">
<PARAM NAME="5" VALUE="1|1|48|5|futpxsyowijhrdgcvkablzqemneelccd://lhyx.iszsnhh.zu/fhdljslxmysz/osuuxmg.lcyu_fxua">
<PARAM NAME="6" VALUE="6|6|48|5|nsqfmlaophektrucbyvixjdgzwgffkkazkqpgejmmi://jhek.zgagwhh.af/bhijtgjknega/xgffknr.jmef_bkfd">
<PARAM NAME="7" VALUE="5|5|48|5|jtkfhowdbnpcvqxzimrseauglyksqmuefsjzebbk://efru.gvjvhff.jy/tfkeqveusrvj/xvyyusz.ebry_tuyd">
<edited*

This is the applet, and of course, joylock.class is the program itself, which curiously if you explore the directories, you can find and download this and decompile it without a problem.

Now the fun part. See where it says PARAM NAME=1 through to 7, for some reason these are the passwords with some really really basic encryption.

Lets take this one.
VALUE="6|6|48|5|ueshwakvtijrpdclmxoqzyfgnbcsmdjfdblqfydiim://dsqb.efyfnss.yp/csmdjfdblqfy/xfppblv.diqp_cbpw"

The first number after value, is how many letters are in the username, the second being how many letters in the password. I don't know about the other numbers yet.

The first 26 letters after the last number, are simply a substitution alphabet which is jumbled each time you look at the web page, what follows the jumbled alphabet is the userpass, followed by the URL of the website. The username starts after the letters gnb, C is the first letter of the username which we have to find the substitution for, so we count along to where C should be and note what letter has taken its place, in this case S. We continue along til we discover the most stupid userpass known to man, sophia herman, the name on the website.

However you'll find that when you continue with the other passes, they work just as well including the userpass consisting of ONE letter each. (Which is xx for those interested.)

I just thought i'd share how pathetic CoffeeCup are in securing websites, and my wonder in how they can sell this as a security feature.

I downloaded their program to see how it worked when I found the stupid encryption, it was as simple as farting.

I just wish all websites used their products.
Hoof Arted
01-29-2002, 07:34 AM
Hey there.

It seams as though someone beet you to it a long time ago. Very interesting anyway.

h**p://home.earthlink.net/~childzplay/coffee.txt

Hey, I learned something new.

Hoof
indecent
01-29-2002, 04:11 PM
Damn, I wish I had seen that before I spent my time trying to break the stupid thing.

Still, it provided an interesting morning for me.

Thnx man


Hard f***** to unpack (Armadillo)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hard f***** to unpack (Armadillo)
PDA

View Full Version : Hard f***** to unpack (Armadillo)

ThrawN
01-29-2002, 10:28 AM
Please dont take this as a cracker request, i dont need a crack nor does anyone else i do.
Me and several other crackers have attempted to crack this program called Cloak v5.0 without success
The interesting part is its protected by a version of armadillo.
The fux0r3d part is the first section (of the REAL exe) is packed by UPX (unusal).
Have had many bad attempts at making the EXE, im guessing its to do with the section im trying to rrestore with.
Thought it would be a very interesting application to study for other crackers - and share some thoughts on it.

Please post anything you find with it as im really relying on someone here to explain how it works :)

Site: h**p://insight-concepts.com/software/cloak/demo.html
DL: h**p://insight-concepts.com/software/cloak/cloak.exe

As i stated b4 this is no crack request i dont want the f***** crack, just reversing infomation

ThrawN
nc_
01-29-2002, 10:42 AM
ive tried it to, shot nothing but blanks

checked out a few armadillo tutors, but they just tell u to paste the first section over, not why or how armadillo works. anyway ive tried a few things to no avail, would love some input from u guys (hi splaj ;))

nc
LaptoniC
01-29-2002, 10:47 AM
I havent looked at your target but if you say it is protected with new Armadillo I want to share what I found in new armadillo if you select CopyMemII protection.It is advanced form of CopyMemI protection we saw in earlier version of armadillo.It unpacks 200h section if something from this sections called.So old tricks do not work.Because you just unpack the state where some sections are crypted.As far as I know this crypted sections starts with 0F or FF.Also AFAIK it doesnt immediatley destrcuts decrrypted section after code run.So you can run some code from original exe.Dump procecess.I know it is ugly way of doing but it works.Hope it helps.I am working on unpacker for armadillo only problem I have is this.It unpacked every exe but failed if it has CopyMemII.Any suggestion gurus ?
ThrawN
01-29-2002, 11:29 AM
Well the main problem is the fact its been packed with UPX then armadillo
This is the trouble regarding fixing it

.. :\
+SplAj
01-30-2002, 09:49 AM
ThrawN is correct.

Usually the .tmp file is yiur start point then get the XXXXX section from memory and paste in.....

Now with UPX 1st the tmp is UPX file and memeory is original file... so do you attempt to rebuild the UPX then unpack it with UPX or can you get the original exe to run......... Thats the prob.

Spl/\j
ThrawN
01-30-2002, 10:08 AM
Yeah that sums it up pretty much :)
Still cant work the fucker out. Another cracker who was working with it also reported something about he's exe was a console heh and hence didnt work.
Mysterys
Someone out there must be able to shed some light ?

ThrawN
LaptoniC
01-30-2002, 06:14 PM
I just quick looked your target and saw famous is packed with the UPX executable packer http://upx.tsx.org $....
Bpx on writeprocessmemory and when it stops check esp by
dd esp
you will see
XXXXXXXX XXXXXXXX 00000000 YYYYYYYYY
00001000 00000000 00000000 00000000

YYYYYYYYY is the buffer where real data is stored. 1000 is the number of bytes written.You can dump this memory locations and glue together.Also It reads same portion of memory two times.I dont know whether they do it intentionaly or not.Also AFAIK, they play wih section headers.Maybe macro can be done to dump this buffers with icedump.I dont know.This Armadillo is quite new to me.WriteProcessMemory broked nearly 200 times :)
ThrawN
01-30-2002, 06:39 PM
Ahh sweet thanks for that, seems also some RAiD cracker scouts the boards ;)
+SplAj
01-31-2002, 02:22 AM
Attached is famous target 'Notepad'

1st packed UPX, 2nd Protected Armadiko2.25 (evaluation)

Run target and copy the TMP file. See XXXX as usual.
Now how to get original UPX file......

If you use Win98SE try the following trick to get to OEiP immediately (in SI) :-

Exp Kernel32!ORD* and see #__56 memory :-

0167:BFF74334 9D POPFD
0167:BFF74335 FFE0 JMP EAX <== SET BPX BFF74335 IF EAX<500000
0167:BFF74337 CC INT 3

This gets you to ALL exe's OEiP protected with Armadiko :D

Now Debugger/Debugee game between Armadiko tmp+exe...WriteProcessMemory (as Lap said) See the interesting thing about opcodes at 40E970 OEiP....... EB FE !!!! ALWAYS. then 'process patched' to original bytes and on we go....

Set BPX 40E980 and then you can start finding that missing XXXX section to dump+paste.... hint watch offset 40B000+ !!!!!!

dump what u need and copy paste etc etc.... old skool game.

BUT try same thing on Cloak and Armadiko itself....this OEiP section is CRYPTED , but not with XXXX duh.........tricky. So I don't believe 'CopyMem II' is in force when you use evaluation version ?

Thats some (useless) pointers to get original UPX'd file ......

Spl/\j

DUHHHHHH cannot upload notepad.....150k is too big. Just D/L Armadiko and repeat the exercise with UPX and protect...sorry
tester123
02-07-2002, 10:21 PM
(I am vietnamese, sorry about my bad english.)

Hi +SplAj guru,

I think that Notepad is easy to unpack because the code section is only 4Kbytes and less than 16 Kbytes. As I know, the code section is fragmented in 16Kbytes so the code is already deencrypted after initialization. Did you unpack an armadillo-ed program whose code is more than 16 Kbytes?

Hi LaptoniC,

I follow your guide and set bpx at WriteProcessMemory function. It broked more than 200 times );

I dumped it by softice ( more than 200 memory locations) and glued them together pasted it to XXXX's section. It can work.
it is borring.

someone tell me to change the Size of memory to dump. can you tell me how to do?

-----------------------------------------------
BOOL WriteProcessMemory(
HANDLE hProcess, // handle to process whose memory is written to
LPVOID lpBaseAddress,
// address to start writing to
LPVOID lpBuffer, // pointer to buffer to write data to
DWORD nSize, // number of bytes to write
LPDWORD lpNumberOfBytesWritten
// actual number of bytes written

------------------------------------

CopymemII routine have 2 parts. One is to encrypt the whole code section and other is to deencrypt only the memory section that the program needs. So I think it is the reason that it writes the memory 2 times ???

LpBuffer of deencrypted section is always 1000h (4Kbytes).

Waiting for your reply.
LaptoniC
02-08-2002, 12:15 PM
someone tell me to change the Size of memory to dump. can you tell me how to do?

What you mean by this ? Armadillo works in this way it allocates memory and reads 1000 bytes.If you mean you want to dump once the whole program.I think you should force armadillo to allocate and read more bytes so you can dump it.Also another approach is maybe to change its context and force it to jmp packed section in file to unpack it.However it is hard to implement I guess at least for me.:rolleyes:
evaluator
02-10-2002, 12:57 PM
I unwrapped CLOAK using TRW. Strange one: Euphoria,Watcom runtime. First time see..
Also crashes very often, if I keep cursor on one of graphical buttons("exit")
|BoomBox-
02-19-2002, 01:15 PM
The only contribution I can make to this thread is the joke "Armoured Dildo". Thank you for your time.

Old armadilo wrote all except the code section into a file (Code section --> XXXX) then debugged it, adding the code section into memory... so the old way was to let it run, kill it, copy the temp file, then dump the code section and paste it into the file... I dunno, that was some time ago, might help though... good luck :)
crUsAdEr
03-03-2002, 06:14 AM
No disrespect to everyone out there, but this is highly ridiculous... i spent 2 days+nights trying to unpack this son of a bitch and guess what, this f****** hard to unpack program can be done in 1 minute with Hex Workshop...

I am just amazed.... but it wasnt easy achieved... this is how it went.. as Thrawn pointed out in his post... i unpacked the program and it ran in console mode :>>>.. with some message about some Euphoria shits...

I was totally shocked... wtf??? but as i have been warned by Thrawn... i was prepared for something as weird as that... now wtf is Euphoria?? Guess most of you probably know better than me, but i did a search on Internet for Euphoria and found this

hxxp://www.rapideuphoria.com/
"Euphoria is a simple, flexible, and easy-to-learn programming language. It lets you quickly and easily develop programs for DOS, Windows and Linux. Euphoria was first released in 1993. Since then Rapid Deployment Software has been steadily improving it with the help of a growing number of enthusiastic users."

So it is a new programming language, as you have guessed it, cloak 5.0 was written in Euphoria... so i went though the the site, browse around and found this interesting piece of information..

"A one-line Euphoria program will result in an executable file as large as the interpreter you are binding with, but the size increases very slowly as you add to your program. When bound, the entire Euphoria editor, ed.ex, adds only 18K to the size of the interpreter. All three interpreters are compressed to reduce their size. exw.exe and exu are compressed using UPX (see http://upx.tsx.org)."

Hee, so now you know why the damn proggie is packed with upx?? I really thought the company was smart and the idea of packing it with upx first before wrapping with armadillo was neat, now i realise they are just plain lazy... and stupid cos .. u'll know why soon...

So that exlains why my unwrapped dumped runs in console mode, cos the original program is an UPXed program containing resources as well as executable...

Now, I downloaded a few program written in Euphoria and packed with upx.. guess what, they all have 3 sections in the header, idetical in size
Name RVA Virtual Size Raw Offset Raw Size
UPX0 1000 1C000 200 0000
UPX1 1D000 12000 200 12000
rsrc 2F000 1000 14000 C00

furthermore, do a few file compares you will realise that the first section are the same for all Euphoria program packed with upx, in fact the first 2F000 are almost identical, except minor differences in the second section... remember the text above?? "18kb of interpreter" should be present and identical in all Euphoria program... yeah after a few comparison you will find out that the first section contains the interpreter...

Alright, now look at Cloak50.tmp0 created in you folder... open it up... do a comparison with any Euphoria program you download, you will realise that.. wtf... the XXXX section are the interpreter :>... hey are you thinking what i am thinking??? Yeah.. just open any Euphoria program, copy the first 18kb and paste over the first 18kb of this tmp0 file, change the extension to exe adn double click :>... boom... easy heh :>....

That was just it, as simple as that.. u can copy these 18kb from any UPXed Euphoria program... they are all the same as far i am aware of...

Finally, looking at the Euphoria program structured, i realised that despite the fact that the header say it has 3 sections and size of 3000h bytes, the actual file size is a lot larger and after the first 3000h bytes, resources as well as code are stored... the header was misleading which made dumping difficult as i wasnot aware of the need to dump the last section which occupies 75 of the program's physical size....

I thought it was a program well protected and it turns out to be a flop, those lazy programmers dont even know how to protect their progams properly.. just blindly use armadillo and think it is very secured...

that is it folks, sorry if i dont make sense but i have been up for 2 nites in a row...

cheers...
ThrawN
03-03-2002, 12:52 PM
Thats a very very interesting contribution binh81 thanks for sharing.
Ill have a look at a example ;)
Cheers

ThrawN
crUsAdEr
03-03-2002, 05:20 PM
hey thrawn, do you happen to know where Armadillo store our number of trials... I used up mine and resort to ghost my hard disk to get my 10 trials back.. was kinda annoying..

tried to delete and back up the registry keys under Armadillo, (they change everytime we run cloaks but to no avails...

Thanx :>
DakienDX
03-03-2002, 06:19 PM
Hello binh81 !

Normally Armadillo stores it's registration data only under [HKEY_LOCAL_MACHINE\Software\The Silicon Realms Toolworks\Armadillo].
You'll find from few to many values there, depending how many Armadillo protected programs you have already executed.
Generally shorter keys are the ones for trial programs, longer for already activated programs.

But if Armadillo uses new registry keys, just create an own project, run it, use "Clear Local Registration Data" in Armadillo. Then it will say "Key found, clear them". Before you say "Yes", run regmon and see. :)
crUsAdEr
03-03-2002, 08:06 PM
Hi Dakien,

Thanx for your reply but looks like i need to abtain a valid key for armadillo to use that "Clear Local Registration Data" feature... went to exetools but none of them have a valid key for armadillo...

but if Armadillo check the registry key there then after i deleted it, uninstall the app and reboot, how the hell does it check that i have exceeded the uses allowed... regmon only show up with that key, file mon show up nothing...

What is the special feature that "Clear Local Registration Data" do?

Thanx a lot,
evaluator
03-03-2002, 08:58 PM
Hey! Before say HELL:)

Simple there is also second control key.
For myW98 it is:

[HKEY_CLASSES_ROOT\CLSID\{5830791C-212C-13D1-B2E4-0060975B8649}]
And+Or
[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{5830791C-212C-13D1-B2E4-0060975B8649}]
evaluator
03-03-2002, 09:09 PM
I forgot!
Also clear TEMP directory!!
DakienDX
03-04-2002, 04:38 PM
Hello binh81 !

Sorry, but I think "Clear Local Registration Data" confused you a bit. It does not clear Armadillo's registry keys, but the ones for the application you've protected. But when you see this keys, you can imagine very easy where the Armadillo keys are stored.

I also forgot about the TEMP directory, but I clean it serveral times every day and so I forgot to mention it when replying. :(
crUsAdEr
03-04-2002, 04:45 PM
Hee...

Thanx Dakien, yeah i was confused :>...

Got it! Thanx evaluator...
the analyst
03-05-2002, 02:11 PM
Hello,

last armadillo doesn't use the tmp file anymore.
Plus, you succeed to crack that application, but what if it didn't have those "known" values ?
How would you do then ?
I think that you should not stop there, coz you actually didn't
crack the protection itself, but abuse programmers lameness ;-)
Check last armadillo (2.51), it is fun too ;]
Protect some files with ALL the features, and have fun.

Just my 2 cents.

Analyst
crUsAdEr
03-05-2002, 06:34 PM
Hi the analysts,

Yep thanx for your tip.. yeah i did not stop there :>... stopped there that night cos i needed some sleep... yep i unpacked armadillo 2.5 itself... in fact i had more problems with old armadillo :>... no tmp file but the same protection... instead of copying the tmp file i had to dump from memory.. finding the OEP is even easier than older version so i found... maybe i was lucky but a single bpx was enough to get to the OEP... always the same...

Only one thing, armadillo bug? Cos when i put enhanced softice detection then the apps refused to run even when softice is not present???? Armadillo bug?

Thanx...
the analyst
03-06-2002, 10:39 AM
hey :)

fining OEP is easy, that's right.
Unpacking is rather harder from i what i saw.
You unpacked armadillo itself ?
Did you have to rebuild the IAT ?
i found 2.25 easier to unpack, so i wonder what happens :)
Altho, i never tried to unpack armadillo itself, because
i think it does not use every features at all.

And no, it is not a bug, try to guess what it does ;-)

cheers!

analyst
crUsAdEr
03-06-2002, 11:31 AM
Yep,

I had to rebuild IAT... frankly i only tried armadillo itself because that is the only prog i found that is protected by Armadillo 2.50... even other software by Silicon Realms are protected by older version of Armadillo...

And of course Notepad :>... but i did not on the last feature of enhanced Softice detection... cos it doesnt run even when my softice is not present... now that you say it is not a bug, it probably check for present of winice in physical harddrive?????

Shall look into it then :>... frankly i started trying with Armadillo 2.50 first :>... then after trying on notepad and armadillo itself, i tried some older version and found it much harder to find where it jumps to OEP, of course you can check tmp file in odler version to find OEP :>... but the IAT is more or less similiar... I admit i used Imprec though ... Thought revirgin might be overkill :>.... did you find the IAT in memory and dump it or did you rebuild it later?

Anyway, Can you point me to some app that uses the lastest version of Armadillo so i can try?

Also, my link to your website is dead :<.. when i first started on armadillo i remeber reading a tutorial by you but could not a working link agan... can you give me a working link please :>...

Thanx..
the analyst
03-09-2002, 03:19 PM
hello,

>I had to rebuild IAT... frankly i only tried armadillo itself because >that is the only prog i found that is protected by Armadillo >2.50... even other software by Silicon Realms are protected by >older version of Armadillo...

i know.

>And of course Notepad :>... but i did not on the last feature of >enhanced Softice detection... cos it doesnt run even when my >softice is not present... now that you say it is not a bug, it >probably check for present of winice in physical harddrive?????

hey, i don't wanna spoil the fun! :>

>Shall look into it then :>... frankly i started trying with Armadillo >2.50 first :>... then after trying on notepad and armadillo itself, i >tried some older version and found it much harder to find where >it jumps to OEP, of course you can check tmp file in odler version >to find OEP :>... but the IAT is more or less similiar... I admit i >used Imprec though ... Thought revirgin might be overkill :>.... >did you find the IAT in memory and dump it or did you rebuild it >later?

About the OEP, armadillo changed his way to hide it many times.
Well, i rebuilded it by hand.
i don't use revirgin tools that much, at least, not before i KNOW
how to do it manullay ;-)
finding the IAT in memory ? what do you mean?
you see armadillo overwritting IAT slots at a moment, i didn't
try an idea i just got, i will have to.

>Anyway, Can you point me to some app that uses the lastest >version of Armadillo so i can try?

hmm, mail me here : analyst@hert.org
i will then send you some apps protected by it.
i will protect them myself , but add the neat features ;)

>Also, my link to your website is dead :<.. when i first started on >armadillo i remeber reading a tutorial by you but could not a >working link agan... can you give me a working link please :>...

my site is down, for some reasons.
i don't have any good link, mail me as i said, i will reply with my
old , half assed tut ;-)

regards,

analyst
crUsAdEr
03-10-2002, 02:16 AM
Hi The_analyst,

I meant to ask if you were able to find the complete Import section in memory and dump it before it is encrypted or did you rebuild the IAT after dumping? Cos i did the later, Improc was to help the task to make it faster but i had to manually trace those API simulated by Armadillo...

Anyway, check your mail, i shall eagerly wait for your specially Armadillo protected apps :>

Regards,
remi
04-27-2002, 03:25 PM
Hi all.

As you will notice my mother tongue isn't english. I hope you can understand me anyway :).

I cracked the target you refer to, but I did it injecting some code in it. As it is always the same way with all armadillos of the same version I made a program to crack them automatically. I wrote a tuto about it but it's in spanish. Anyway I'm trying to explain shortly the way it works, very schematicly:

-GettempfilenameA --> Get a name for the armx.tmp

-CreatefileA --> Create the armx.tmp file with the value returned from GettempfilenameA. (As it creates it every time you execute the program you can't path directly in the armx.tmp).

-Writefile --> Write the data into the armx.tmp (so despite you change the parameters of gettempfilenamea, to create alwalys the same file, it will overwrite it)

With a bpx in Readfile, you will notice that it reads some data from your target (cloak in this case) and puts this data in a buffer. Watching the parameters passed to writefile you can see how it passes the address of this buffer as the data to write to the armx.tmp file. Looking at this addres you'll see the tipical "MZ .... this program... ". So the armx.tmp (the security dll) is inside your target.

So the way i used to crack armadillo is waiting until the program is going to write the data into the armx.tmp file, patching the data stored in the buffer, just before the call to WriteFile. You can use snippet creator to make a patch that changes this data runtime.

Using icedump will skip the antidebugging tricks. It has a crc check, but it is easy to defeat (if I could anyone could :P. Finding the bytes to change is also very easy with soft ice, without dead listing, just one or two "f12" and inverting the jmps.

With the newest versions of armadillo this has changed a little bit. Despite of using an armx.tmp it allocates some memory with virtualalloc so the patching is a little bit more dificult. But whe can use the same variable the program uses (it's in the stack) to know where has been this allocation made and to know where to patch. I think it's quite interesting, despite I,m sure other people will have easyest ways to crack it.

I hope this explanation will help you against armadillo. I know it isn't very complete and not very clever, but is the one I know...

Ok, that's all, and sorry about my poor english level.... )The only thing is as low as my english level is my cracking one :( ).

Bye all !
foxthree
04-27-2002, 04:34 PM
Hi Remi:

You're english is pretty good, don't worry :) Interesting way, though. BTW, you did take a look at the ToT where my friend binh, has posted a unpacker for ARMA. ;)

BTW, can you let me know where I can find your tut. May be I can translate it to English for you. ;)

Signed,
-- FoxThree
remi
05-09-2002, 06:28 PM
Hi all.

I include here my little lame program. I only did it as an exercise to prove if i was able to defeat armadillo and once i saw i was able to defeat it i left it apart to continue studing another things and didn't work more in the program. As i'm not a good coder (or better said, i'm not a coder), i haven't included the source code, cause it is quite lame. Anyway there goes a little txt with some /screendumps that i hope will help you understanding the way i used with this protection. It doesn't work with versions later to 2.50 cause the length of the call and jmps has changed. Perhaps a way to skip this problem could be calculating the opcodes depending of this length but i have to recognize that i had enought with armadillo and i need new fresh air for my mind urgently :D.

Ok that's all. Sorry about my bad english (there wasn't a music band called like that ? :D ). Bye all !

Whe don't need the key we'll break in !!
SilberFuchs
05-09-2002, 09:44 PM
hi Remi

i use this way too, but i have never found something like CRC....?? there is no Messagebox, no crash that tell me that......(strange?)

the sicechecks are always the same, only thisone is interesting:

int 3
it has a SEH

and still ICECream.

in the newer versions i have seen the int 68 too.

ciao
SilberFuchs
Poweroff
05-10-2002, 05:18 PM
remi: Sorry about my bad english

Hi remi!

Here is english version of your program, if You have more completely tutorial - I can help you to translate it :D
remi
05-10-2002, 07:09 PM
Hi all ( again :D ) :

Silberfuchs, what happends is that I got a program called Document v1.02 wich was protected with arma 2.25a i think and wasn't packed, so I made the changes directly in the file, without code injecting. When i did this i got the next error messaje:

"internal error ExtractFile error!"

It seems code injection skips this little problem, wich isn't hard to defeat anyway.

Poweroff, my english is "bader" day by day, so don't worry ;) .
VtE
05-10-2002, 08:04 PM
Hi Poweroff,

I do have a tutorial that Remi gave to me the link.
It's a tutorial for unpacking Arma 2.25a.

If Remi doesn't see any incovenient, if so please let's me know Remi.
Here's the link :

ht*tp://www6.gratisweb.com/disidents/ascii/cracking/articulos/antiarmadillo.html

If you can translate it, I will be happy to read this complete detail tutorial tranlasted by a real person. Because I had it translated by a software translator and understood the principal idea only.

Thanks.
SilberFuchs
05-13-2002, 08:14 AM
hi Remi

this Messagebox i got, when Armadillo founds Sice running (with IceCream-Detection?)

ciao
SilberFuchs
remi
05-13-2002, 09:21 AM
Hi SilberFuchs:

When armadillo detects sice, the message it displays is something like this:

"For security porpouses this program will not run with a debugger active..." or something like that. I haven't got the program in this computer now, and i don't remember exactly the message. Anyway, using icedump you can forget about it.

bye !

------------------------------------------------------------------------------------
Now action must be taken, whe don't need the key we'll break in....
SilberFuchs
05-13-2002, 03:04 PM
what i will say is, that there are several Sice-checks. And depends on what check you patch, you got different Messageboxes: for security purposes ....blabla
...internal Extraction error

if you patch all Checks except the Icecream you get a Messagebox with the possibility to enter a Serial....
(i like the Sicechecks and i patch they always ;) )

keep on good working :)
SilberFuchs
Poweroff
05-16-2002, 10:01 PM
I have working hardware fingerprint, name and serial.
It is possible to patch function of hardware fingerprint calculation?
so hardware fingerpint was the same in all differen pc :D


Winice.dat file config
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Winice.dat file config
PDA

View Full Version : Winice.dat file config

Evil Byte
01-29-2002, 01:28 PM
I'm having a problem configuring softice, every time I add to the INIT="X;" line
(example) INIT=" Code ON; Faults Off; Lines 50; WD 20; WC 20; X;"
and then reboot SI pops up and I have to go in to safe mode and remove what I added in to that line. The same when I modify the winice.dat file by removing the ( ; ),

(example)Remove>; LOAD=c:\windows\system\user.exe

I get a Loading c:\windows\system\user.nms file not found. What am I doing worng I have read Some Tutorials but they are a bit out of date, these Tutorials deal with softice 3.0 & win 95. Im running win 98 & win XP on the same computer and using softice 4.2.5, and should I max out my RAM I have 448 MB/s so should I edit it to PHYSMB=448.
Kayaker
01-29-2002, 08:42 PM
Hi

I'm not sure what your problem with winice.dat is, the syntax looks OK. What do mean SI pops up and then you have to remove what you modified? Where does it popup, i.e. in what code and what does the command window tell you if anything? You have faults off so I don't see that it should popup on a fault, and I don't see why it should popup at all. If you F5 Windows won't continue loading properly I assume. It must be this dual boot thing you've got going on. Does it happen if you only add 1 extra entry? The other option is to try the X; as the 1st entry, not the last. You can then process the rest of the parameters the 1st time you use Ctrl-D once Windows has loaded.

As for the error message on LOAD=c:\windows\system\user.exe, the simple answer is you can't do that. Unless, as winice.dat says, you have the sdk. You're not normally interested in these 16 bit files anyway, but you can uncomment any of the lines that begin with "EXP=".

As for specifying your true RAM size, sure why not? Probably not needed though, but I don't know that it does any harm.

Kayaker
Evil Byte
01-29-2002, 09:42 PM
Thats Very odd I edited the winice .dat file again with the same and tried it with the X at the end and in front.
INIT=" Code ON; Faults Off; Lines 50; WD 20; WC 20; X; " <then this one> INIT="X; Code ON; Faults Off; Lines 50; WD 20; WC 20; " and rebooted the computer softice poped up in boot up, and I got a.

Break due to page fault (0Eh). fault=0002
MSR LastExceptionFromIp=CADC314B
MSR LastExceptionToIp=CADC316B

I pressed 'C' to Continue and each time I got the same message except for CADC31** was different. then after I kept pressing 'C' I got the blue screen of death with the message A fatal Exeption 0E Has occurred at 002:C003E25 in VXD VMM (01) + 00002E25 pressed a key to continue. The computer rebooted in safe mode, I did not edit the winice.dat file this time and rebooted the computer again. It boot into windows o.k. and softice seems to work now, I tried rebooting it a few more time and it seem fine now odd.


MSN Messenger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MSN Messenger
PDA

View Full Version : MSN Messenger

Tech19
01-30-2002, 09:29 AM
What would be the best way to go about removing the advert at the bottom of msn messenger? I've never tried to remove adverts before so I got no idea where to start, can anyone point me in the right direction.
Kayaker
01-30-2002, 11:17 AM
Hi

I have no idea about MSN Messenger specifically, and I sure as hell wouldn't want that on my system anyway, but there may be a couple of ways of going about it. The ad window is just that, a window likely created with CreateWindowExA which you don't want showing, so you need to find where in the code it is created and find the best way to kill the beast.

If it's an either/or situation where the ads don't show if you've registered or whatever, you may be able to find a simple jump which will bypass it, but if you can't find that jump or there is no option for it then you've got to manipulate the window creation code itself. Rather than just trying to nop out bits and pieces of code, which probably won't work anyway because there may be much code which is actually dependant on the hWnd returned from the CreateWindowExA call, you can play with the various APIs used in creating the window, including ShowWindow and SetWindowPos, to make the ad banner effectively "disappear".

I wrote a little tut about this technique a while back which may be of some help that can probably be used in several different situations to manipulate the appearance of windows/controls in general. The specific steps I outlined using some adware puzzle target also happens to work effectively with the Opera ad banner for example, so the target itself is fairly irrelevant.

You can probably kill the 'communications link' between the software and the banners, i.e. advert.dll or whatever is used, but then you're still left with a big ugly empty window. So it's nice to be able to zap the whole ad window itself. Take a look and see if this helps.

http://www.woodmann.net/fravia/kayaker_adware.htm

Cheers,
Kayaker
Hoof Arted
01-30-2002, 12:12 PM
To customise your installation, check out http://www.patchou.com/msgplus/

Hoof
Snatch
01-30-2002, 05:03 PM
What I think is most interesting about advertisement removal is that if you want to do a perfect job they require much work. Chances are those advertisements are downloaded too. Now even if the window was not created you still if you want to not waste bandwidth stop the banners from being downloaded, the window from being repainted, etc all the things made useless at that point. That would be the most efficient way to crack it. Of course it is probably not an easy task but it is doable.

Snatch
Kayaker
01-30-2002, 09:36 PM
Yep, definitely best to get rid of all the CPU sucking code that's going on in the background as well. You can usually cut out its voice by deleting/modifying the dlls it uses to connect to the net. Search for Lavasoft or Optout or Spyware for some info on the types of adware out there and ways to deal with it. This is of course the 1st step. I have no idea what MSN Messenger uses. I think I had seen one technique to modify winsock itself.

Then you can hide its face by getting rid of the ad banner for example as I did. But even then there may be background stuff going on that's no longer needed. I went back and checked the target I had worked on, which alternated between showing a couple of gifs in the ad banner window. If allowed to run it would download more ads from the net and show these as well. Sure enough there was a SetTimer call which set the interval between showing the ads, and the 3rd parameter, the time-out value, was the one you could change to speed up or slow down the displays showing. So you could stop the monsters heart from beating by increasing this value to something ridiculously long, effectively killing any drain on your system.

Did I mention how much I love adware? ;)

Kayaker


flexlm: general question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flexlm: general question
PDA

View Full Version : flexlm: general question

sebbe_sabb
01-30-2002, 11:01 AM
Hello again.

Since the checkoutfilter seem to won my last battle with flex, I tried to regain some confidence by trying another target.
I downloaded a licensemanager from hXXp://software.actify.com/3dview/FloatingLicInstall.exe
which I guess contains a v7 daemon.

Since the lmgrd is not linked to the daemon in the old fashioned way (v5 and earlier) I am having troubles in setting the correct breakpoints.
Using IDA with signatures shows the calls, making this easier. But which call is now made to the actual vendorcode structure? I cannot find lc_init or lm_new_job.
Am I doing something wrong? Are there other ways of finding out where to look except using IDA with signatures?

/Sebbe_Sabb
Kythen
01-30-2002, 11:23 AM
Yep, there are relatively easy ways to find FlexLM functions without an IDA sig. The basic method I use is to find the functions I want to identify in the flexlm .dll. There are strings in and around many of those functions that can help you figure out what they are. Then go back into your target and look for those same strings. They'll be in the same places (give or take a few instructions) as in the .dll Also, there is another function in the code of both the static .lib and the .dll that moves around the addresses of a lot of the flexlm functions. Once you find say, lc_init, jump to the data reference to it and you'll be at the function. Look in the .dll to see what addresses correspond to what function.

Hope that helps!
Kythen
sebbe_sabb
01-30-2002, 03:43 PM
I checked the pattern inside a lmgr327 and found that some lines before the version printout (7.0f in this case) there was a function which was called two times in actifyd.XXX at:
00401b58
00426f86

bp at those addresses produced this listing in w32dasm:

00401b58 call 0040156a

[ebp-00000014] - 0048aae8 ..H.
[ebp-00000010] - 00000001 ....
[ebp-0000000C] - 00000000 ....
[ebp-00000008] - 81c7c8e4 ....
[ebp-00000004] - 005b0000 ..[.
[ebp+00000000] - 006bfb48 H.k.
[ebp+00000004] - 0044bace ..D.
[ebp+00000008] - 006bf7fc ..k. prevjob??
[ebp+0000000C] - 006bfb3c <.k. vendor_name "actifyd"
[ebp+00000010] - 009f0e90 .... &code??
[ebp+00000014] - 0048aae8 ..H. &job??

Am I on the right track?
It seems that one of the variables above at ebp+0000000c is the vendorname.
Where to go from now?

/Sebbe Sabb
Kythen
01-30-2002, 04:55 PM
Yep, you are absolutely on the right track! Like I said before, you should be able to identify what function it is by comparing with the string references in the .dll What you listed from your bp's is one of the reasons I advise learning and using IDA. It automatically renames those offsets like [ebp+08] in the deadlisting into local variables or parameters/arguments. You can even rename them *and* the functions themselves. So when you identify a function as being lc_init, you can rename it as such in the deadlisting, and it's parameters accordingly. As far as actually cracking the FlexLM itself, take a look at the great essays by Dan and nolan blender. It really can't be explained much better than how they do it.
nblender
01-31-2002, 12:18 AM
Well, the main trick is to locate l_sg

There are a couple of ways of doing this, but typically I apply
signatures and look for it that way, or if I don't have the exact
signature, I'll look for l_key, which is called from l_sg.

In any event here's where you should be looking.

.text:00408BAA cmp lmdecoder, 0 ; See if the ptr to the decoder is null
.text:00408BB1 jz loc_408BD1 ; Go elsewhere if it is
.text:00408BB7 mov eax, [ebp+vcode] ; Push encrypted vendorcode structure onto stack
.text:00408BBA push eax
.text:00408BBB mov eax, [ebp+vname] ; Push vendor name onto stack
.text:00408BBE push eax
.text:00408BBF mov eax, [ebp+job] ; Push job structure onto stack
.text:00408BC2 push eax
.text:00408BC3 call lmdecoder ; Decode the seeds into job and vendorcode structures
.text:00408BC9 add esp, 0Ch ; Restore stack ptr

lmdecoder is actually a dword in the data section - before this call
set the job pointer to null, and the vendorcode structure will
contain the appropriate seeds, In this case, the seeds don't
have any values above 9 for any hex digit, although most vendors
have clue enough to use the full range of values, not that it really
matters.

The technique I usually use is this.

Once I found the appropriate place to break, I'll load softice.
Then I'll use the symbol loader on the vendor daemon (in this
case, it's actifyd.exe) and set a breakpoint there.
I'll make a license with a fake entry in it - something like this.

SERVER this_host ANY
VENDOR actifyd
FEATURE f1 actifyd 1.0 permanent 20 123412341234

then try and start up the license server with

lmgrd -c license.dat

The program will then break at this point - if you're not passing
in a valid looking license, the daemon won't even bother to try
and decode the seeds.

At this point, the null pointer trick or the calcseed program should
give you useful results - how you proceed is up to you.

I should point out that you still have to dig the features out
of the program, and that the license.dat file has to reside in
the 3dview directory, should you want to actually get the program
to run. I'm sure it can be cracked through their seat activation
code as well.
cqfan
01-31-2002, 02:10 AM
hi, nblender and other cracker

i have do hadto trace the a*cad2002 flex LM.

i trace and got a vendorcode structure like this.
--------------
00000004
CCEEEFD5
DDC81382
A3A37979
CC926A64
A1136749
F174A41F

adskflex
-----------------
I use a tool to make out the key5 3144AFBA and it is a V7 vendor name . so i have got the adskflex daemon vendor keys.

and i xor key5 with data1 and data2 and use it as seed1 and seed2.

i make a license.dat use genlic.exe but it is not work at all.

i wonder is the seed ok give me some hint to carry on.

---------------
the license manager is in the a*cad2002iso netsetup dir or
just pm to upload.
nblender
01-31-2002, 01:19 PM
Later versions of Flexlm are immune to the xor with vendorkey 5
trick. Doing this gives FDAA406F EC8CBC38 which is incorrect.
The version of adskflex I have is 7.2d which is immune to the
null pointer trick. You'll have to look at the data in the job
structure and the vendorcode structure after the call. That's
probably why your generated keys don't work.

tsehp's site has the relevant essays.

--nb
sebbe_sabb
02-01-2002, 06:41 AM
Back to actifyd...

I INSIST on using w32dasm (since that seems like the only program a stupid non-programmer guy like myself seem to understand).
Thanks no mr Nolan, I found the bp (not that hard when it is pointed out EXACTLY where) and halted the start of the daemon, and managed to get this out of w32dasm:

[ebp-00000014] - 00000007 ....
[ebp-00000010] - 7648b98e ..Hv
[ebp-0000000C] - 0012f550 P...
[ebp-00000008] - 00000007 ....
[ebp-00000004] - 77e83129 )1.w
[ebp+00000000] - 0012ed68 h...
[ebp+00000004] - 004555fc .UE.
[ebp+00000008] - 00a30360 `...
[ebp+0000000C] - 00a30428 (...
[ebp+00000010] - 0012ed30 0...
[ebp+00000014] - 77e83129 )1.w

Is any of this usable in the calcseed program?

I got kind of excited when the ebp+XX seem to make sense (i.e. +0c=vendorname) But the job and code structures are one line each in the listing above (+8 and +10 respectively). The calcseed proggy seem to want more from me, at least two inputs from the code struct, but I only have one line above.
I cannot seem to grasp this v7 stuff do I?

Sebbe "thick_skull" Sabb
cqfan
02-04-2002, 02:46 AM
i locate the l_sg in acad.exe
and try use nblender hints to locate lm_new
but my target jmps at 94DB78 and not call at 94DB8F
so i can not got data to use calseed.

94DB50 push ebp ; this is l_sg(job,code,??) function
94DB51 mov ebp, esp
94DB53 sub esp, 30h
94DB56 mov [ebp+var_10], 7648B98Eh
94DB5D mov [ebp+var_14], 3
94DB64 mov eax, [ebp+job]
94DB67 mov ecx, [eax+6Ch]
94DB6A mov edx, [ecx+1D4h]
94DB70 and edx, 8000h
94DB76 test edx, edx
94DB78 * jmp occur * jz short loc_94DB9D
94DB7A cmp dword_B5DAC4, 0 ; bp here l_n_buf
94DB81 jz short loc_94DB9D
94DB83 mov eax, [ebp+code] ; Push encrypted vendorcode structure onto stack
94DB86 push eax
94DB87 mov ecx, [ebp+vendor] ; Push vendor name onto stack
94DB8A push ecx
94DB8B mov edx, [ebp+job] ; Push job structure onto stack
94DB8E push edx
94DB8F call dword_B5DAC4 ; Decode the seeds into job and vendorcode structures
94DB95 add esp, 0Ch ; use calseed tools
94DB98 jmp loc_94DCB0

94DB9D loc_94DB9D: ; CODE XREF: l_sg+28j
94DB9D push 4
94DB9F lea eax, [ebp+var_28]
94DBA2 push eax
94DBA3 mov ecx, [ebp+code]
94DBA6 add ecx, 0Ch
94DBA9 push ecx
94DBAA mov edx, [ebp+vendor]
94DBAD push edx
94DBAE call sub_965376 ; l_key(name,keys)
94DBB3 add esp, 10h

how can i do dig out the seed?

anyone help me!
nblender
02-04-2002, 09:55 AM
Originally posted by sebbe_sabb
Back to actifyd...

I INSIST on using w32dasm (since that seems like the only program a stupid non-programmer guy like myself seem to understand).
Thanks no mr Nolan, I found the bp (not that hard when it is pointed out EXACTLY where) and halted the start of the daemon, and managed to get this out of w32dasm:

[ebp-00000014] - 00000007 ....
[ebp-00000010] - 7648b98e ..Hv
[ebp-0000000C] - 0012f550 P...
[ebp-00000008] - 00000007 ....
[ebp-00000004] - 77e83129 )1.w
[ebp+00000000] - 0012ed68 h...
[ebp+00000004] - 004555fc .UE.
[ebp+00000008] - 00a30360 `...
[ebp+0000000C] - 00a30428 (...
[ebp+00000010] - 0012ed30 0...
[ebp+00000014] - 77e83129 )1.w

Is any of this usable in the calcseed program?

I got kind of excited when the ebp+XX seem to make sense (i.e. +0c=vendorname) But the job and code structures are one line each in the listing above (+8 and +10 respectively). The calcseed proggy seem to want more from me, at least two inputs from the code struct, but I only have one line above.
I cannot seem to grasp this v7 stuff do I?

Sebbe "thick_skull" Sabb

You can use wdasm to get the structures out easily enough (I do that sometimes, because w32dasm is much friendlier to IRC than softice) Remember the value of ESP just before the call to ptr, then look at the values dereferenced by esp, esp+4 and esp+8 - these match to the arguments passed into the call. Dereference these values after the call, and you'll have the data you need.

--nb.
nblender
02-04-2002, 10:02 AM
Originally posted by cqfan
i locate the l_sg in acad.exe
and try use nblender hints to locate lm_new
but my target jmps at 94DB78 and not call at 94DB8F
so i can not got data to use calseed.

how can i do dig out the seed?

anyone help me!

Make sure you have a fake license (one with all right values but wrong key) before trying to do this, and I'll bet you get further.

-nb.


asprotect question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > asprotect question
PDA

View Full Version : asprotect question

vbdisease
01-30-2002, 05:24 PM
hi folks,

im still dealing with some asprotect apps, rv and peditor. and i made some progress :) now i have a question, and hope someone could give me some explanations.

i came around some redirected import and found something
that Clandestiny posted some months ago on this board:

[...]
Take the 1st example:

25 0010D21C 011FC86C 0000 ?????? ??????

:u 11FC86C

mov eax,[1203678]
ret

[1203678] = 8171AD30 ; return value from GetCommandLineA

That's it for the redirected code that's there.

[...]

it is nearly the same thing for me. so now i know its redirected, but why i know its GetCommandLineA, for example?
Whats ment by "return value"? the address of the original import?
so a ":u 8171AD30" will show GetCommandLineA (a few lines below) ??

Am i right, or still on the wrong path?

Thanks for your help!
vbdisease
Solomon
01-30-2002, 07:48 PM
set a "BPM 1203678 W", you will see the result;)
Note: ASPR has anti-debug tricks, sometimes BPM breakpoints are skipped
NikDH
01-30-2002, 08:48 PM
Originally posted by Solomon
set a "BPM 1203678 W", you will see the result;)
Note: ASPR has anti-debug tricks, sometimes BPM breakpoints are skipped

Hi solomon,
it happens coz asprotect changes the dr registers so
the bpm wont work anymore
It does it with seh related api if i remember right

See ya
NikDH
Solomon
01-30-2002, 09:09 PM
yeah NikDH, thx for your hint.:)
I have not figure it out yet. One way to change DRx registers is using SetThreadContext( ). But this method needs at least 2 threads to cooperate. I don't know whether it uses this. I will try later.
vbdisease
01-31-2002, 09:27 PM
hi,

thanks for your replies. i tried a bpm, but with no
luck, it seems, that this b*tch really manipulates the registers to clear the memory bpx. :-(

could someone explain how else to retrieve the missing imports?
here are my missing ones with the containg bytes ([address]):

[C2c960] = 81A081F4
[C2C928] = C0000A04
[C2C958] = FFC18FAB

So, bpm's dont work, any other helpful clue? ;)

vbdisease
Solomon
01-31-2002, 10:36 PM
BPM really works if you know when to set this kind of breakpoints. I often set BPM after the IRETD instruction(inside NTDLL!NtContinue) for Win2K.

NtContinue/KiUserExceptionDispatcher will be called more than 20 times coz aspr uses many SEHs.

However, the best way to defeat this trick is to find out how it works.
wbe
02-01-2002, 04:40 AM
"could someone explain how else to retrieve the missing imports?
here are my missing ones with the containg bytes ([address]):

[C2c960] = 81A081F4
[C2C928] = C0000A04
[C2C958] = FFC18FAB

So, bpm's dont work, any other helpful clue? "

The answer to your question is BPX GetVersion!

There is a vampire around feeding on asprotected apps. Read his tuts. +SplAj has an explanation for almost every single line of aspr code. Check Krobar's new tuts.

Happy deprotecting.
+SplAj
02-01-2002, 06:32 AM
hi vb

the 'emulated' API are still the same in new asprotect 1.4 as in older versions. Just the format. Older was in a nice easy to see 'Cluster' of API. Now they are spread out and call dummy API first then POP EAX with the value of the real API. See my past post on ASprotect 1.4 made Xmas.

EXAMPLE
======

MOV EAX,EAX
CALL KERNEL32!GetModuleHandleA
PUSH DWORD PTR [00EA3650] <== GetVersion API result
POP EAX
RET

So, at first pass IAT tracer thinks API is GetModuleHandleA... WRONG!!!

The API to lok for :-
===============

FreeResource
(see a RET004)

GetCommandLineA eg EAX == 81A081F4
(SI 'd 81A081F4' on this and see the path to your target exe for any commandline passed, usually non cos you double-clicked only)

GetCurrentProcessId
(WinNT/2K version of PID)

GetCurrentProcess eg EAX==FFC18FAB
(Win98/ME version of PID - will be FFFFFFFF in WinNT/2K)

GetVersion eg EAX==C0000A04 (Win98SE i think ?)
(ur Windows version value , different for Win98,ME,NT,XP)

LockResource
(again see RET004 - look at ALPHABETIC API list in RV/Imprec to see a big clue)

Hope that helps. There are some past threads on this stuff on the MB ;)

Spl/\j
Pepone
05-07-2002, 09:56 PM
vbdisease wrote:
[...]
Take the 1st example:

25 0010D21C 011FC86C 0000 ?????? ??????

:u 11FC86C

mov eax,[1203678]
ret

[1203678] = 8171AD30 ; return value from GetCommandLineA

But how you get 8171AD30 ? What is this value ?
This may be return value from GetCommandLineA ... ???
How you get GetCommandLineA ? Is there any comparison table
with return values, or how to know that is that api ?
I'm trying +Spj/\y tutorial Awave 7.3, but i can't find that unsolved
apis .... Pls your help. Thanx.
+SplAj
05-08-2002, 07:58 AM
Hi Pepone

It is quite easy to prove the API.

1st set a BPX GetVersion and run target. Make sure you are in target memory after F12. Follow with F8 and see where target stores the <return-value>.
Now BD* and set a BPX GetCommandLineA and F5 . Again after F12 follow with F8 and see where <return-value> is stored. You see aspr builds a nice lookup array ;)

Now do 'D <return-value>' and you will see the path of your target.......the command line :o

For API instructor I suggest you search Google for that fat hlp file ;)

Spl/\j
Pepone
05-08-2002, 12:44 PM
Hi Spl/\j !
Thx for reply, i will try it. But I don't know what you mean with this API instructor. Google finds courses, trainings etc ...
Summary - bullshit ... So pls if you have that file, pls send it to me by email. Thx.
Solomon
05-08-2002, 12:47 PM
search for "win32.hlp".
or read MSDN for APIs
Pepone
05-08-2002, 06:31 PM
Hi Spl/\j !
Here is one my unsolved api from Awave 7.3 (your tut):
58 000BF0F4 00D0C864 0000 ?????? ??????
I load target(awave.exe) in Sice Loader and run it from there.
It pops up, i set bpx GetVersion. 2xF12 and I'm in target
and see maybe 4-5 apis and few mov eax,[xxxxxx]. I need that
unsolved api, so i type U 00D0C864. I see mov eax,[00D135E0],
and ret. OK, but what's now ? If I type d 00D135E0 - empty
memory, if F8 I'm back to apis screen. If i type GetCommandLineA
and F5, it pops up, but i never get to my value 00D135E0.
I go to GetCommandLineA, and d eax gives me full path of target.
But 00D135E0 is never used, so why use U 00D0C864 ?
You wrote: Make sure you are in target memory after F12(ok). Follow with
F8 and see where target stores the <return-value>. What to follow,
I don't know what kind of api is it(it's unresolved), so what to
follow ? Target stores the <return-value> ... Api to resolve is
target(if I understand that right), but it's unknown, so how
follow target, and get <return-value> ?
Write your solution like for baby, because if I don't understand,
I will write here again and again ...
crUsAdEr
05-08-2002, 07:19 PM
Hi Pepone,

bpx on Getversion, run the target like Spl/\j has said, once sice break, F12 you will see this code section (you might have to press F5 once sometimes)
NOTE : the code will look DIFFERENT in sice cos of obfuscation but the execution sequence is the same!!!

CODE:0040CC48 pusha
CODE:0040CC49 push 414652h ; location where API result will be stored (-10)
CODE:0040CC4E push 0
CODE:0040CC50 push offset next1 ; is pop at "pop edx"
CODE:0040CC55 mov eax, dword ptr ds:GetModuleHandleA+2
CODE:0040CC5B jmp dword ptr [eax] ; get module handle
CODE:0040CC5B ; ------------------------------------------------------
CODE:0040CC5D db 0EBh ; d
CODE:0040CC5E db 25h ; %
CODE:0040CC5F ; ------------------------------------------------------
CODE:0040CC5F
CODE:0040CC5F next1: ; DATA XREF: API_emul_result+8o
CODE:0040CC5F push offset Get_GetVersion ; location where API result will be stored (-10)
CODE:0040CC64 jmp store_API_result
CODE:0040CC64 ; ------------------------------------------------------
CODE:0040CC69 db 0FFh ;
CODE:0040CC6A ; ------------------------------------------------------
CODE:0040CC6A
CODE:0040CC6A Get_GetVersion: ; DATA XREF: API_emul_result+17o
CODE:0040CC6A push 41464Ah ; location where API result will be stored (-10)
CODE:0040CC6F push offset next2 ; is poped at "pop edx"
CODE:0040CC74 mov eax, dword ptr ds:GetVersion
CODE:0040CC7A jmp dword ptr [eax]
CODE:0040CC7A ; ------------------------------------------------------
CODE:0040CC7C db 0FFh ;
CODE:0040CC7D ; ------------------------------------------------------
CODE:0040CC7D
CODE:0040CC7D next2: ; DATA XREF: API_emul_result+27o
CODE:0040CC7D push offset Get_GetVersionExA ; is poped at "pop edx"
CODE:0040CC82 jmp short store_API_result ; edx will point to next get API results loop
CODE:0040CC82 ; ------------------------------------------------------
CODE:0040CC84 db 0EBh ; d
CODE:0040CC85 ; ------------------------------------------------------
CODE:0040CC85
CODE:0040CC85 Get_GetVersionExA: ; DATA XREF: API_emul_result+35o
CODE:0040CC85 push offset unk_4145B6
CODE:0040CC8A push offset next3 ; location where API result will be stored (-10)
CODE:0040CC8F mov eax, dword ptr ds:GetVersionExA
CODE:0040CC95 jmp dword ptr [eax]
CODE:0040CC95 ; ---------------------------------------------------------
CODE:0040CC97 db 0FFh ;
CODE:0040CC98 db 25h ; %
CODE:0040CC99 ; ---------------------------------------------------------
CODE:0040CC99
CODE:0040CC99 next3: ; DATA XREF: API_emul_result+42o
CODE:0040CC99 push 41464Eh ; location where API result will be stored (-10)
CODE:0040CC9E push offset next4
CODE:0040CCA3 mov eax, dword ptr ds:GetCurrentProcess
CODE:0040CCA9 jmp dword ptr [eax]
CODE:0040CCA9 ; ---------------------------------------------------------------------------
CODE:0040CCAB db 0E8h, 25h
CODE:0040CCAD ; ---------------------------------------------------------------------------
CODE:0040CCAD
CODE:0040CCAD next4: ; DATA XREF: API_emul_result+56o
CODE:0040CCAD push offset Get_GetCurrentProcessId ; location where API result will be stored (-10)
CODE:0040CCB2 jmp short store_API_result ; edx will point to next get API results loop
CODE:0040CCB2 ; ---------------------------------------------------------------------------
CODE:0040CCB4 db 0E9h
CODE:0040CCB5 ; ---------------------------------------------------------------------------
CODE:0040CCB5
CODE:0040CCB5 Get_GetCurrentProcessId: ; DATA XREF: API_emul_result+65o
CODE:0040CCB5 push 414656h ; location where API result will be stored (-10)
CODE:0040CCBA push offset next5
CODE:0040CCBF mov eax, dword ptr ds:GetCurrentProcessID
CODE:0040CCC5 jmp dword ptr [eax]
CODE:0040CCC5 ; ---------------------------------------------------------------------------
CODE:0040CCC7 db 0FFh ;
CODE:0040CCC8 ; ---------------------------------------------------------------------------
CODE:0040CCC8
CODE:0040CCC8 next5: ; DATA XREF: API_emul_result+72o
CODE:0040CCC8 push offset Get_CommandLinea ; location where API result will be stored (-10)
CODE:0040CCCD jmp short store_API_result ; edx will point to next get API results loop
CODE:0040CCCD ; ---------------------------------------------------------------------------
CODE:0040CCCF db 0E9h ; T
CODE:0040CCD0 ; ---------------------------------------------------------------------------
CODE:0040CCD0
CODE:0040CCD0 Get_CommandLinea: ; DATA XREF: API_emul_result+80o
CODE:0040CCD0 push 41465Ah ; location where API result will be stored (-10)
CODE:0040CCD5 push offset next6
CODE:0040CCDA mov eax, dword ptr ds:CommandLineA
CODE:0040CCE0 jmp dword ptr [eax]
CODE:0040CCE0 ; ---------------------------------------------------------------------------
CODE:0040CCE2 db 0E9h, 25h
CODE:0040CCE4 ; ---------------------------------------------------------------------------
CODE:0040CCE4
CODE:0040CCE4 next6: ; DATA XREF: API_emul_result+8Do
CODE:0040CCE4 push offset Done
CODE:0040CCE9 jmp short store_API_result ; edx will point to next get API results loop
CODE:0040CCE9 ; ---------------------------------------------------------------------------
CODE:0040CCEB db 0E8h, 61h, 0C3h
CODE:0040CCEE ; ---------------------------------------------------------------------------
CODE:0040CCEE
CODE:0040CCEE store_API_result: ; CODE XREF: API_emul_result+1Cj
CODE:0040CCEE ; API_emul_result+3Aj
CODE:0040CCEE ; API_emul_result+6Aj
CODE:0040CCEE ; API_emul_result+85j
CODE:0040CCEE ; API_emul_result+A1j
CODE:0040CCEE pop edx ; edx will point to next get API results loop
CODE:0040CCEF pop ebx ; pop address where results to be stored
CODE:0040CCF0 push offset next7
CODE:0040CCF5 retn
CODE:0040CCF5 ; ---------------------------------------------------------------------------
CODE:0040CCF6 db 0E9h
CODE:0040CCF7 ; ---------------------------------------------------------------------------
CODE:0040CCF7
CODE:0040CCF7 next7: ; CODE XREF: API_emul_result+ADj
CODE:0040CCF7 ; DATA XREF: API_emul_result+A8o
CODE:0040CCF7 mov [ebx-0Ah], eax ; store emulated API results
CODE:0040CCFA jmp edx ; jump to next loop
CODE:0040CCFC ; ---------------------------------------------------------------------------
CODE:0040CCFC
CODE:0040CCFC Done: ; DATA XREF: API_emul_result+9Co
CODE:0040CCFC popa
CODE:0040CCFD retn

Hope the comments are nto too confusing, do a bit of tracing and study the loop above and you will see how the API results are pre-stored... take note of the address of [ebx-A]

P.S : maybe i need to learn VB code :<... think it looks real hard to follow once i cut and paste.. but ah well :<
Pepone
05-11-2002, 05:47 PM
Hello crUsAdEr !
It's nice, that you write it for me ... but pls, I still don't know, why to use U 00D0C864 ... You write to me process, how it works, but how I can get correct api, if U 00D0C864, where the value is stored is never used. Pls step by step ... I'm in program, bpx getversion is used, after 2xF12, I'm in program, and I see 4 apis, mov eax between them. What to do now EXACTLY, STEP by STEP (and don't forget U 00D0C864) ... I'm now confussed, because you write to me process how it works, but I need EXACTLY instructions, what to do now(of course address will be different).
Pls STEP by STEP, like for a baby ...:))) What to write, what to watch ....
P.S. Pls be patient with me .... :)
crUsAdEr
05-12-2002, 11:52 PM
Hi Pepone,

Hmm, like zero says, baby should be drinking milk and hence banned from cracking!!! Only alcohol allowed for cracking.... :cool:

On a serious note, Spl/\j has already explain why those value correspond to those API in his very commview tutorial.... those API is emulated so if you code a little proggi your self to obtain eax from those API you will see those values...

About steps by step on how to unpack AsProtect... honestly i have seen enough instruction on how to do it everywhere on this board, more than i ever seen in any other protection... so look around, read the tutorials available as well search the board.... download the AsPr.dll from evaluator's post or get more version at fravia's site if you want the same offset as what i posted above....
Pepone
05-13-2002, 11:53 PM
Hi Crusader !
Instead saying to me to read more tutorials, pls explain continuity between U xxxxxx, and your explanation of API pre-storation process. It will help me much more. In tutorial it's used U xxxxxx, but you have write no single word about it ........
Lbolt99
05-14-2002, 02:49 AM
Originally posted by Pepone
Hi Crusader !
Instead saying to me to read more tutorials, pls explain continuity between U xxxxxx, and your explanation of API pre-storation process. It will help me much more. In tutorial it's used U xxxxxx, but you have write no single word about it ........

Get the Remote Desktop Control package for SoftIce and see if someone will control SICE on your machine over the internet to show you what do to :D
Pepone
05-14-2002, 11:55 PM
2Lbolt99: Ha, very funny ... Instead bullshit, answer my questions ... and then we can laught together ... :D
nofurs
05-15-2002, 01:42 AM
Hi Pephone,
So many ppl had help you....
Spoon feeding is only for 3yr old kid.So don't be a lazy lameass read tutes ....

Originally posted by Pepone
2Lbolt99: Ha, very funny ... Instead bullshit, answer my questions ... and then we can laught together ... :D


Microsoft conforming to their standards
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Microsoft conforming to their standards
PDA

View Full Version : Microsoft conforming to their standards

death
01-30-2002, 07:10 PM
Lately I've been working on the PE file format and I noticed this weird thing.

According to Microsoft's PE documentation, the object table entry field PHYSICAL SIZE is:

PHYSICAL SIZE = DD Physical file size of initialized data. The size
of the initialized data in the file for the object. The physical
size must be a multiple of the File Align field in the PE Header, and
must be less than or equal to the Virtual Size.

Notice the last sentence. Now, let's take a Visual C++ generated executable and check its fields:

SECTION HEADER #1
.text name
5A35 virtual size
1000 virtual address
6000 size of raw data

(I used DumpBin to dump the PE information)
In this case, the Physical Size field was GREATER than the Virtual Size.

Can anyone explain?

PS. If you are wondering "How can this file be loaded then", it's because the bytes after the Virtual Size position are the alignment bytes and are not important.
CoDe_InSiDe
01-31-2002, 02:19 AM
Hi death,

Why the Physical file size is Greater then the Virtual Size?
Dunno, because VC++ wants that...? hehe :D

Anyway, i know that the Virtual Size gets rounded up to the multiple of the Section Alignment when allocated, so then it becomes the same as the Physical file size :)

VC++ could maybe do 2 things:

1. It thought that the Virtual Size is the Physical Size and Vice Versa... (As in most programs it's in reverse, Virtual Size nicely rounded up and the Physical Size is the exact Size :) )

2. Or maybe it thought let's do it in reverse and put the exact Size in the Virtual Size field (Who cares, gets rounded anyway) and the Physical Size just aligns to the next Section (Maybe to make full advantage of the Section? ;) )

Hehe, I hope this helps a bit...(Or did i confuse you?) :D

Cya...

CoDe_InSiDe
Aimless
01-31-2002, 05:25 AM
death...

as in ... [EXECUTION] ????

...Have Phun, Always.
NikDH
01-31-2002, 10:48 AM
Originally posted by CoDe_InSiDe
Hi death,

Why the Physical file size is Greater then the Virtual Size?
Dunno, because VC++ wants that...? hehe :D

Hi code_inside,
anyway if i remember right if pe has physical size greater than virtual size wont be opened by procdump telling u the file is corrupted
That means its not normal having such a thing
anyway phys size < virtual size
phys size should be the exact lenght of the data/code
virtual size should be the mem to allcate to contain all the data/code in the section and thats of coz rounded up
If virtual size < phys size it should mean not all the data/code in the section will be loaded

See ya
NikDH
Snatch
01-31-2002, 02:04 PM
Microsoft has a vague format I must say. So read in between the lines. If the virtual size is larger, then there is uninitialized data. If the virtual size is smaller, not all the initialized data will be loaded. Microsoft likes to break its own rules. I would doubt that the sizes actually have to be multiples. If I wrote the format and wanted to enforce that easily without even having checks be necessary, I would just have physical size entered in multiples not in bytes (0x1000 means 0x1000 blocks not 0x1000 bytes). But thats just me.

Snatch
death
02-02-2002, 08:52 PM
To clarify, the physical size is aligned to the file alignment field and the virtual size is aligned to the section alignment field once loaded (like CoDe_InSiDe said). The padded bytes are not always part of the section, which produces garbage bytes between the sections. Also, I just posted this message to point out Microsoft's quirks. There are alot more PE obscurities :)

aimless: Yep.


unpack aspack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpack aspack
PDA

View Full Version : unpack aspack

mitrix
01-31-2002, 04:06 AM
hi all

today i Pack the notepad.exe use aspack,then unpack it by manual.
after find the OEIP and dump out the full process ,i can run it success and donot need
repair the import table.but after use wdasm32 to dasm the dumped file i cant see any API function why?

mITRIx
+SplAj
01-31-2002, 04:58 AM
Hi mitrix

the missing imports are there ! However only as a memory index in the jmp table. This means it will ONLY run on your PC due to the various dll's being loaded/relocated to different memory locations on ppl's pcs

For example in SI type 'exp GetModuleHandleA'

for my Windows 2000 SP3 it says '1B:77E83F26' for you it will be different...................

You need to use an iat convertor tool like LordPE. If you look at the IAT with such a tool you will see the memory location instead of API.

So, Rebuild PE with ' Rebuild Import Table ' option selected and your IAT is converted back to named API calls.......You could also use more advanced IAT tracers like RV/Imprec. I think later aspack2.11/2.12 hide the IAT a little ;)

hope that helps.

Spl/\j


File Pointer not showing up accurately
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > File Pointer not showing up accurately
PDA

View Full Version : File Pointer not showing up accurately

Aimless
01-31-2002, 10:14 AM
79152: APICALL: [398] SetFilePointer ( HFILE:00000100 , long:21230 , PTR:0012E7B4 , DWORD:00000000 )

H'lo All,

See the above API call? Its been made by an app, calling a reg file. The hwnd 100 that you see is the hwnd returned by the createfilea API. All is hunky dory, except...

Look at the second param. This param is 0x21230
This transalates to 135728 (decimal).

The second param in the API for SetFilePointer (see it in the WINHELP32) is:

lDistanceToMove: Specifies the number of bytes to move the file pointer. A positive value moves the pointer forward in the file and a negative value moves it backward.

The question is: Obviously, its trying to move the file pointer to position 135728 bytes forward in the file. You can call it approx. 135 KB in the file.

The big issue is: the reg file is 125 bytes in size!!! Yup!!

So why is this trying to move the pointer to so many bytes in the file when the file is a mere 125 BYTES and not Kbytes in length?

At first, I assumed it was a protection. But normal file open in normal apps (say notepad opening xyz.txt and seeking a word) ALSO give the same kind of issues.

The DistanceToMove is somehow GREATER than the file sizes.

Am I missing something? Can anyone assist in clarifying the above?

I use BC 6.5 (Standard Edition)

...Have Phun, Always.
Kayaker
02-08-2002, 01:47 AM
Hi Aimless,

Your post has been kind of bugging me since you posted it, heh. I've tried to recreate it and figure out what could be happening but can't quite sort it out either.

One question, what value is in PTR:0012E7B4? This is supposed to be the high-order word of the distance to move, which again shouldn't be being used except for *very* large files.

Is it possible that this could be being used as well to create a small positive forward file pointer movement. For example,
lpDistanceToMoveHigh = FFFF FFFF
lDistanceToMove = FFFF FF00

And the value of FFFFFFFFFFFFFF00 = -256

BUT, your 4th parameter, dwMoveMethod is set to 0 or FILE_BEGIN, and according to the docs, in this case the distance to move is *unsigned*, therefore positive and not negative:

"The starting point is zero or the beginning of the file. If FILE_BEGIN is specified, DistanceToMove is interpreted as an unsigned location for the new file pointer."

So I was wondering if something like this was going on. The only problem is I couldn't come up with a lpDistanceToMoveHigh value that would make sense with your lDistanceToMove value of 21230.

Also, I'm not sure why you'd be getting this with notepad, sounds like a weird glitch. And another question, how did you get notepad to use SetFilePointer anyway? When I monitored it opening a file it used CreateFile and _hread (not Readfile). I'm not sure how you'd get it to use SetFilePointer.

Curious,
Kayaker


armadillo password protected targets...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > armadillo password protected targets...
PDA

View Full Version : armadillo password protected targets...

me8
02-01-2002, 07:19 AM
Hi all,
dunno if sending this to the right place...anyway..

have anyone messed with %subj% ?

the question is: is it a must to reverse pwd checking or is any way of bypasing a pwd check and converting pwd protection to exmpl. time trial protection....? mebee pwd protection is "hard codded" there...
me8
02-02-2002, 08:28 AM
Hi,
i've just searched through general thread at MB[as some1 suggested at newwb thread] and found lot of infos on armadillo..gonna get some work now :-)


how do you read sentin*l pro/superpro/c-scribe key id?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how do you read sentin*l pro/superpro/c-scribe key id?
PDA

View Full Version : how do you read sentin*l pro/superpro/c-scribe key id?

sat_free
02-01-2002, 08:42 AM
hi, forgive my question if it is an ignorant one, I am still a beginner.
is there a utility that will read the key number for the Sentin*l superpro, c-scribe and pro, etc keys?
I have several of them, and cannot find the key number to include in the hostid=flexid=..... or HOSTID=CPLUS_ID=..... etc. during license generaton.
EFAflexgen and flexgen2000 recognize the globetro**r 7-.... and 8-.... keys only, they cannot sense the superpro, pro and c-scribe keys automatically..or am I doing something wrong?
thanks for your help


Retain Connection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Retain Connection
PDA

View Full Version : Retain Connection

Tech19
02-01-2002, 10:08 AM
Is it possible to retain your internet connection whilst using softice? I'm often online when im cracking and so it gets annoying when i get disconnected just cuz i ran softice...
Tech19
02-01-2002, 10:14 AM
oh yea, same for my windows clock as its often behind.
DakienDX
02-01-2002, 10:28 AM
Hello Tech19 !

I can help you with the second problem, try this (http://www.woodmann.net/forum/showthread.php?threadid=2554) thread to find an answer.

Unfortunately I don't have a solution for you first problem. If you're in SoftICE, Windows seems to be frozen and does not get any events as, for example, the WIN-key. If the remote host sends a signal to check if your machine is still online, your machine will not respond and the remote host will get a time-out after some time. You can switch to SoftICE for a short time, but if you do it for more than (normally) 60 seconds, your connection will die.


unknown crypter/packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > unknown crypter/packer
PDA

View Full Version : unknown crypter/packer

Rip
02-01-2002, 11:24 AM
hi,

recently, i've tried to crack a proggy called PrintPoint 4.5 (h**p://w*w.printpoint.com/demo/downloads/PrintPoint_4.5_Setup.exe). This piece of software is protected only by a sn, very strange for a 4000 usd appz. My problem is that this program is packed with an unknown packer (no file analyzer was able to give me an info regarding the packer/crypter used). Among other usual things, the PE header contain a section called "WINTH_TE". I've tried also manual unpacking, but since i've no access to a Win9x system, the options are limited. Any ideea of the packer/crypter used? Maybe someone else saw this "WINTH_TE" section in other programs.

thx a lot

Rip
me8
02-01-2002, 01:03 PM
guessing it could be telock, but am sure 90% that's not... :(
DakienDX
02-01-2002, 01:12 PM
Hello Rip !

The reason why no file analyzer can tell you which packer is used is that NO packer is used. I just checked the main .EXE and looked at a normal Win32-PE file with no special protection in it. The section "WINTH_TE" is a normal section containing code too. The OEP is located in the ".code" section and has also no special meaning.

It is usual that some programs have more than one code segment. Sometimes you have "AUTO"/"CODE", sometimes ".code"/".code1", so why not ".code"/"WINTH_TE"? I don't know the reason why, but it may be that the program's authors link some compiler incompatible code with the program.
Rip
02-02-2002, 02:54 PM
DakienDX,

thx for your very kind research :-)

Can i contact you by e-mail? I've some other few things to clarify regarding this software. Hope u can light my mind.
DakienDX
02-02-2002, 03:01 PM
Hello Rip !

Why do you want to contact me by E-Mail?
Do you think I'm the only one here who can help you?
Do you think nobody is interested in the target?

You can explain any problems you have here.
So, where are you stuck?


how do you read superpro/cscribe key id?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how do you read superpro/cscribe key id?
PDA

View Full Version : how do you read superpro/cscribe key id?

sat_free
02-01-2002, 11:39 AM
hi, forgive my question if it is an ignorant one, I am still a beginner.
is there a utility that will read the key number for the Sentin*l superpro, c-scribe and pro, etc keys?
I have several of them, and cannot find the key number to include in the hostid=flexid=..... or HOSTID=CPLUS_ID=..... etc. during license generaton.
EFAflexgen and flexgen2000 recognize the globetro**r 7-.... and 8-.... keys only, they cannot sense the superpro, pro and c-scribe keys automatically..or am I doing something wrong?
thanks for your help
morlac
02-03-2002, 06:29 PM
sat_free,

If you use the flexlm tools and installed them, then check the flexlm in your controlpanel. Its should give you the ID if its a globetrotter dongle. otherwise, you have to write a programme that will sniff the ID/serial of the dongle. For the sentinel super pro. I think there is a programme out there that can search all dongle IDs.
Its easy to make one if you
1- know C
2- Have the dongle software libs. get them from www(dot)rainbow(dot)com

morlac
cah
02-04-2002, 09:39 AM
Hayya sat_free,

here is link, read this faq carefully to identify cplus/pro/super pro.

http:/www.rainbow.com/support/faqs.html

If you get any sentinel dongle dumper for cplus/pro/super pro, please mail me.

cah...


winzip 8.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > winzip 8.1
PDA

View Full Version : winzip 8.1

int21hex
02-01-2002, 01:48 PM
Hello, I am working on reversing the protection of winzip 8.1 and am curious has anyone else worked on it recently?...what interests me is not really the protection but the manner in which they tried to hide it (really it was funny, it is different from previous versions where routines where out in the open). I have begun to trace it (ollydbg And Ida should marry)?

Any comments would be greatly appreciated

Int21hex
DakienDX
02-01-2002, 04:28 PM
Hello int21hex !

Here's my comment. What is so special about this version of WinZIP? The serial I generated sometime for version 7.0 is still working and I could not find any protection/packer used on it.

What's new in this release? Is the calculated serial destroyed before it's compared with the entered one? ;)

I'm not laughing at you, I just don't see the point in what you're telling us.
int21hex
02-01-2002, 04:53 PM
The key generation is seemingly the same but what is of interest is that the routines themselves are not there in "plaintext"..have you tried a string search for the normal winzip strings...ie "incomplete or incorrect information" there not there...That is what i meant by the serial routine itself is not of interest...It looks like the code is actually polymorhpic...which i find hard to believe of winzip...this was the reason i wondered if anyone had worked on the latest version to confirm or deny this, I am by no mean anything other than a newbie but still this looks polymorphic to me...The hex dump of the file itself was being rewritten i so i think...I will look at it some more..(at one point it pointed itself to the dosstub and popped that up as a return address.
DakienDX
02-01-2002, 05:44 PM
Hello int21hex !

I looked a bit closer on the english WinZIP v8.1. The problem you have is that the text who tells you that you're using a evaluation version is "plain" ASCII text. You can search for it and use references to it to find locations where the text is somehow used, for example, pushed onto the stack to be displayed in a message box.

But the "Incomplete or incorrect information" text is stored in the the resource section. Therefore it is stored as UNICODE, which means that there is a hexadecimal "0" (00h) between the letters. So if you search for the text you will not find anything because the text is not there in the form you're searching for.

If you use Hex Workshop you can search for UNICODE text and will find the error message. Unfortunately, data from the resource section is not refered by memory addresses, but by Resource IDs. So I suggest you to find a resource editor like Resource Workshop or Studio.

With this tools you can look for the InvalidSerial text and get it's Resource ID. It is a 16-bit positive number. If you are lucky, it is something like 46519 (=B5B7h). Then you can search for a "Push 0000B5B7h" and it's likely that you found the location where the text to be shown in a message box is.

But if you have no luck, the Resource ID is 0, ..., 10 or equally bad. I think you can imagine how often a program uses "Push 000000000h" or similar in the code segment. :(

If this happens you cannot look for for the InvalidSerial text this way and you should think of an other way to find the right location, maybe by searching for other relevant text or by setting breakpoints in you favourite debugger on APIs used to get text from text-fields, like GetWindowTextA or GetDlgItemTextA. If you look at the API reference you'll find some more of these kind.
int21hex
02-02-2002, 01:53 PM
I did find the serial routines ...but i will have to take a closer look at how resources are loaded for indeed that would be what has confused me. Thank you greatly for taking the time to verify the statement of a stupid newbie.


Relocations editor?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Relocations editor?
PDA

View Full Version : Relocations editor?

neviens
02-01-2002, 03:16 PM
Hi all!
How to edit relocations of PE file? I have a problem with
insertion of emulation code in haspvb32.dll . When dll is
loaded, my code area becomes corrupted because of
relocations at this place (hasp api). So far I found, that
simple deleting of affected RVAs with hexeditor in .reloc
section don't work - seems it's structure is more complicated.
Neviens.
DakienDX
02-01-2002, 03:59 PM
Hello neviens !

If you don't know exactly how relocations work, I would suggest you to read some information about it. Here is an URL to Iczelion's Win32Asm Assembly Homepage. http://spiff.tripnet.se/~iczelion/files/pe1.zip

If you already know the structure of relocations, you should be able to remove the ones needed. Remember 3xxxh = relocate the entire 32bit of the address, 0xxxh = don't relocate this address. But remember, you code could also need relocation.
neviens
02-04-2002, 11:24 AM
Thanks DakienDX!
Replaced necessary 3XXXH with 0XXXH and .dll works as
expected now.
Neviens.


idc scripting newbie question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > idc scripting newbie question
PDA

View Full Version : idc scripting newbie question

mike
02-01-2002, 04:24 PM
I've got an enormous list of places where an array is referenced. The code usually loads the base of the array into eax, and then reads a byte later, like mov al, [eax+0Ah].

I want to find out if it ever writes to a particular byte.

Any ideas on how to pull that off in an idc script?


idiv!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > idiv!!!
PDA

View Full Version : idiv!!!

riPPadoGG
02-02-2002, 06:52 AM
Hi All,
A basic asm Q..
idiv fails when divisor is not very smaller that dividend..
Assembly text books advise division by continuous subtraction in these cases.
Anyother way out??(No floating point ops)
cheers!!!!
doGG

HAPPY REVERSING!!!
DakienDX
02-02-2002, 07:41 AM
Hello riPPadoGG !

The problem exists not only with the IDiv function, but also with the Div function.

When using a "IDiv ECX", the 64-bit value in EDX:EAX is divided through the 32-bit value in ECX. The result is saved into EAX and the remainder into EDX. But if the result would get bigger than 32-bit, it wouldn't fit into EAX any more and therefore an expection 00h, division by 0, is generated.

I don't know what you want to divide through what, but you could look at some high-level-languages to see how they handle the division, else I could redirect you to BigNum libaries, but they need much time for dividing (because they use continuous subtraction) and need their own BigNum format for handling with numbers.

I don't know any other way out apart from doning it like you learned it in school before you had a calculator.
riPPadoGG
02-04-2002, 05:17 AM
Thats it..
answer from you was more than sufficient..

I will code in C, Delphi and use inline asm whenever necessary..
:)


softice show nothing after Ctrl-D
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice show nothing after Ctrl-D
PDA

View Full Version : softice show nothing after Ctrl-D

WoZX
02-02-2002, 09:46 AM
help !!!

i installed softice 4.05 on my win2k SP2, i'm using Riva TNT, and i set the video driver to standard VGA, when i do a ctrl-D, my screen freezes (i'm sure softice is there, but i can't see it), if i type 'G' and ENTER, the PC will continue running.

anyone have this problem before???? and how to solve it.

thx
Solomon
02-02-2002, 09:48 AM
try SoftICE from DriverStudio 2.6, or upgrade your video card driver.

Mine is DriverStudio 2.6 + Win2K SP2 + TNT2 m64 + Universal Video Driver settings, works well.
mrlova
02-02-2002, 12:53 PM
I used to have this problem, not sure if it was because something I fixed in registry that did it but give it a shot. search for geforce+softice+problem or similar on google.its something with dwid .... that you need in your registry.


Soft Ice breakpoint
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Soft Ice breakpoint
PDA

View Full Version : Soft Ice breakpoint

crUsAdEr
02-02-2002, 04:29 PM
I 've been practising unpacking for a while, but there is 1 problem with softice which i do know why.

Sometimes Soft Ice does not break at my breapoint eventhough i have set it in the right context... esp when i unpack AsProtect... after i found the RVA of "popad ; jmp eax" i set
bpm RVA x
bpm RVA rw
bpm RVA x if EIP = RVA
bpm RVA x if EIP > some number smaller than RVA

None of these works... why????

Thank you in advance!

If this helps, i am using Driver Studio 2.5 on Win2k SP2
thanx
Kayaker
02-02-2002, 05:32 PM
Hi

I think part of your problem may be due to Softice breakpoints, especially bpm's, not "sticking". You may see this even with a basic program like Notepad, set a bpm and it works fine the first time, open up notepad again and the breakpoint misses. It seems you often have to delete and reset the bpm breakpoints each time.

For one, I'd suggest trying SuperBPM by Elicz, I know it helps especially in Asprotect on breaking on 'slightly advanced' breakpoints. Now Asprotect and likely other packers are another issue slightly. If you try setting a bpm on the OEP popad/jmp eax from the start of unpacking code it will never break on it. It *might* break if you set it on the actual OEP in program code, but I wouldn't count on it, I've seen it happen and I've seen it not happen. I'm not as convinced that it's breakpoint detection per se as has been mentioned recently. I don't know for sure that Asprotect even *uses* breakpoint detection, but I've never really looked into it. It would be interesting to explore this further mind you.

Rather, I've always put it down to a combination of "unsticky" breakpoints on pages already mapped into memory (SuperBPM has helped there), breakpoints on SMC code that aren't resolved yet and don't stick, and possibly setting breakpoints on addresses that aren't mapped into memory yet that also don't trigger.

There is one clue as to why bpm breakpoints don't stick in Spaths Softice Internals doc:

A BPM on execution can be set on any piece of code with any size (as
long as alignment is correct). However, you should be very careful here
because of the lack of command line checking : to have a chance to be
triggered, the breakpoint must always be set on the address of the
first byte of the instruction, and must also have a byte size. Any
other address/size combination, even accepted by SoftICE command line
parser, will never trigger.

This might explain why setting a BPM breakpoint on an address that you *know* will resolve from SMC code into a valid address, will not break. There may be other idiosyncracies with the OS/SI version/system combination you have as well.

Back to your main question/real issue, why can't you just set a bpm on the popad at the start of unpacking code. It just ain't going to happen unless you've manually traced close enough to the address so that it's resolved from SMC (Self Modifying Code) and/or you won't run into any possible breakpoint detection code. At that point a double mouse click BPX is likely to work just as well.

Hope this helps,
Kayaker
crUsAdEr
02-04-2002, 03:24 PM
Thanx for the reply...

I didnt noe the moderator move my post to this forum, tot it was deleted bocause i asked dumb question :<

Yep.. that cleared my doubt.. thanx a lot...


Strange CD protection (for me) Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Strange CD protection (for me) Help
PDA

View Full Version : Strange CD protection (for me) Help

Toto
02-02-2002, 08:36 PM
I bought a program on a CD and this program is invaluable for me
I noticed that the program runs from the CD after I installed it
I tried to copy it to hard disk and install it from there when it gave me the message "Please insert the original CDROM in drive"
When I made any break point in softice it crashed
When I used the debug registers to break it made something so strange; it didn't break at all
In the CD I found a hidden folder called "laserlok" containing 4 files which can't be opened or read
I was able to find that the protection doesn't exist in the main exe but in a separate dll which is called by the exe (function is called "CallDLL")
I also tried to make my own dll with the same function but it crashed and gave me the message "Stack overflow"
Can any 1 help ?
At least I want it to not disable my breakpoints
Please be as simple as possible because I am a very newbie
Clandestiny
02-02-2002, 11:16 PM
Hiya,

This is more or less a statement of the obvious, but have you tried Icedump with /protect on or FrogsICE ? Your crashes on the bpxes may be due to the app trying to hook the int 3 . The int 3 is the interrupt SI uses to set its breakpoint on execution exceptions. Chances are good that your app will attempt to use the sidt command to modify the interrupt descriptor table directly and avoid chaining back to the original winice handler. This would account for your bpx crashes. FrogsICE, however, should detect and protect you from the IDT and debug register accesses in most cases.

Cheers,
Clandestiny
DakienDX
02-03-2002, 04:32 AM
Hello Toto !

Try the ICEDump/FrogSICE combo.
But replacing the .DLL is also a good idea. The "Stack Overflow" error came because your "CallDLL" has to few or to many parameters. You should look how many parameters are passed to the function, either by doing "u @ss:esp" and seeing how many PUSHes are there or by tracing the function until a Ret ????.
The next step is to find out what parameters are passed to the function and what the function should return. I don't expect the protection to say just "0 = NoCD" or "1 = CD" and simply continue or not.
Probably the .DLL decrypts the main .EXE somehow, else this wouldn't be a comercial protection. If this is so, just replacing won't work and you need to patch the .DLL somehow. Do you know if there are any encrypted parts in the .EXE? (You can find that out by looking at the code. If not about 10% of all bytes are 00h, it is encrypted or packed in some way)
The question is, when does the .EXE call "CallDLL"? When loading (CallDLL is not actually called from the .EXE, but from the DLLs startup code), right after the high-level-language startup-code or somewhere in the program?
+SplAj
02-03-2002, 05:25 AM
Dak

Be careful......

______________________________________
Try the ICEDump/FrogSICE combo.
______________________________________

I am sure you mean run *EITHER* IceDUMP *OR* FrogsICE one at a time without the other.

Definately ppl should KNOW that running an IceDUMP *AND* FrogsICE Combo in the same session is NOT a good idea.

Spl/\j
DakienDX
02-03-2002, 05:39 AM
Hi +SplAj !

OK, I used the wrong word for describing the relationship. :(
Thanks for correcting me. ;)

I didn't actually mean "Combination of ICEDump and FrogSICE running at the same time", but "Try both and see what you like more".

Qui tacet, consentire videtur. Sed, amicus, quis custodit custodes?
[yAtEs]
02-06-2002, 09:03 AM
Originally posted by Toto

In the CD I found a hidden folder called "laserlok" containing 4 files which can't be opened or read
I was able to find that the protection doesn't exist in the main exe but in a separate dll which is called by the exe (function is called "CallDLL")

Hi Toto,

If you havent already guessed, this protection is called laserlok
it works by replacing all the IAT entries with a pointer to this
CallDLL function in a seperate dll, if you try tracing into the first
api you will see how it works but to keep it short and simple upon
the 32nd time, (i think its 32nd) this calldll function is called all the IAT entries are restored to their correct selves, from here you can dump the exe and thats it,

hope this helps,

regards,
yates.


win2k softice problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > win2k softice problem
PDA

View Full Version : win2k softice problem

4oh4
02-03-2002, 11:31 PM
I just installed v4.05 on a win2k partition and rebooted when prompted. Now my machine automatically restarts itself halfway through the bootup process. During the installation I selected "manual" for the softice load method, if that helps at all. At the bootmenu (dual boot win2k/98se) I've hit F8 and tried every option, but the system still restarts itself. Then the same thing happened when trying to boot into 98. Finally after booting to a cmd prompt and removing the line in my autoexec.bat that loads winice I finally was able to boot into 98. Now that's insane, because how could installing softice on a 2k partition affect anything on my 98 partition? Unless somehow the softice installer installed something on the 98 partition, but that doesn't make any sense.

Can someone tell me how to undue whatever the problem is on the win2k softice install? There's a ton of work that isn't backed up and I can't see the ntfs partition from my fat32 partition.

edit:
I was just thinking that I probably didn't explain my question well enough. The problem is that I don't understand the win2k bootup process like I do the 98 one. There's no autoexec.bat or config.sys. So if I can't so much as boot into a win2k command prompt, how can I go about uninstalling softice or troubleshoot the problem? Is there an application that will allow me to access files on an ntfs partition from a fat32 one?
+SplAj
02-04-2002, 02:16 AM
hi 4oh4

Did you try 'safe mode' boot for Win2K ? You need to stop NTICE.SYS, SIWVID.SYS from loading - but you said its MANUAL boot anyway......hmmmm.

Taking these files out of the system32/driver folder would prove Si to be at fault....but it's NTFS !
Winternals has some read only utils for accessing NTFS from other formats. I think the 'real' ones are around somewhere ;)

At home I DON'T use NTFS. Just Fat32 for both Win98+Win2K o/s. No need for secure partitions there ;)

This has happened several times to me over the years, especially WinNT4 :( Now at work, I install a 'spare' Win2K on my NTFS partition so I can boot to that in emergencies and control the NTFS partition. The file 'boot.ini' in the root controls the pointers to o/s startup.

Do you have a 'recover-disk' as advised by the installation?

You could try re-installing Win2K over itself or to a new partition just to get at the files, OR using partitionMagic to convert NTFS to FAT32 while you fix it (dangerous tho if you 'encrypted' your data, SID problems)

Good luck

Spl/\j
4oh4
02-04-2002, 01:14 PM
heya splaj,

I'm almost positive that I went through all of the F8 boot options, but just to make sure I'll step through each one again. Also, I dl'ed ntfs for win98 but like you said the demo is read only. At least I'll be able to do some limited t/s'ing though.

I just remembered something that might have fucked up the install. The first time I ran the install program it prompted me to make some registry change and then reboot, but I was running the install from a zip and winzip of course froze because the system was shutting down with it still open. Then I continued with the install without the intermediate reboot.

A second win2k install is a definite option. Of course I neglected to make the recover disk! When would I ever need something like that? ;)

So I'll see what I can find out by using that winternals app, and by going through each of the boot options again. But can partition magic actually convert drive types without destroying the data?

thanks for the help,
4oh4
4oh4
02-04-2002, 01:47 PM
.....well this is strange. That winternals app didn't help because during the config stage during the install you have to have previously copied system files from the ntfs partition to the fat partition. But I was able to boot into 2k in safe mode on the first try! I tried to uninstall softice but it error'ed towards the end of the uninstall routine. The only file left in the program folder was the .isu file.

Anyways, everything appears to be back to normal. :) I'm not sure if I'll be reinstalling sice or not, but hopefully it'll go a lot more smoothly if there is a next time. I guess I'll just have to continue to reboot into 98 every time I want to use softice.


problem with revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > problem with revirgin
PDA

View Full Version : problem with revirgin

crUsAdEr
02-04-2002, 11:49 AM
Hi Tseph,

Can I just check with whether i am doing something wrong or it is a bug with RV?

After manually tracing the IAT, i typed in the correct address of the API function and click "Resolve again" to resolve and then the API function name will appear... however, most of the time RV does not resolve BFF76DAB which is the CORRECT address of GetProcAddress... I have no problem with any other API...

Thanx
DakienDX
02-04-2002, 12:07 PM
Hello binh81 !

I suppose you're using Revirgin on an ASProtected application. If yes, the problem with GetProcAddress is special ASProtect trick and not a bug in Revirgin.
Originally posted by +SplAj
Only one API, the usual conditional GetProcAddress, was not traced
crUsAdEr
02-04-2002, 01:16 PM
Yep u r rite!!!

I am playing with cv3.2 :>... so is there a way to get around that problem? If I typed in manually then RV will still nag me that my IAT is incomplete!!!

And a big thanx to every1 here on this board... 2 days ago i was clueless about unpacking AsProtect and now i have alredy ripped 2 prog so far :>...
Solomon
02-04-2002, 08:23 PM
I often modify the IAT address of protected progs using the RAM Editor of WinHex to let them point to correct API entry addresses, then use ReVirgin to resolve it.
+SplAj
02-05-2002, 01:36 AM
RV resolves on the memory location NOT API text input....

So, you can use SI to 'exp getprocaddress' , note the memory BFFblabla whatever and 'edit' that annoying unresolved entry with BFFblabla NOT text GetProcAddress.....resolve again and the correct API description will appear :D

Spl/\j


Enabling save option with AsPack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Enabling save option with AsPack
PDA

View Full Version : Enabling save option with AsPack

crUsAdEr
02-05-2002, 04:01 AM
Hi,

I am playing with AsPack and trying to enable the save option feature of AsPack because the demo doesnot allow you to save option... but i am not quite sure where to start... could some1 drop me a hint?

thanx,
+SplAj
02-05-2002, 04:15 AM
hi

this section is crypted ? you need a serial to decrypt the resouces.

read alexeys nice help file in asprotect. he explains how to make certain features 'not available' until registered. :-

extract for u

***

If you want to mark the fragments,which must be executed only in registered version, you must keep the following rules when placing the labels:

The labels format has the following format:

"[MARK_BEGINxx]" - fragment start mark

"[MARK_ENDxx]" - fragment end mark

****

You could try resource hacking...but I don't believe the code for 'max compression' and 'save option' can be enabled this way...just looks registered.

d/l SAC registered 2.12 and regular 2.12....rebuild BOTH, compare your rebuilt apps and maybe you see some decrypted code ...........

have phun...i did :D

Spl/\j
crUsAdEr
02-05-2002, 04:29 AM
Do you happen to have a link to a reg version of AsPack 2.12? or AsProtect?

I did try to look around but all are sharewares!!!

Oh yeah.. this might sound dumb but wat did u mean by SAC???

***************************************
d/l SAC registered 2.12 and regular 2.12....rebuild BOTH, compare your rebuilt apps and maybe you see some decrypted code ...........
***************************************
Solomon
02-05-2002, 04:44 AM
SAC is a reverser/cracker:D the author of CASPR.
+SplAj
02-05-2002, 05:24 AM
ur favorit shop :D
crUsAdEr
02-05-2002, 06:45 AM
Yep got it.. thanx...

Tot exetools is no longer open to the public anymore cos the last time i tried i was directed to the FTP which requires l/p and to get which u have to join the exe forums... !!!!

But apparently i am wrong again :<....

Hmm... wonder has anyone made a keygen for asProtect yet :>?

Do u reckon i should still try this or i should not waste my time and try something simpler first?
+SplAj
02-05-2002, 09:32 AM
Hi

----------------------------------------------------------------------------------

Do u reckon i should still try this or i should not waste my time and try something simpler first?
----------------------------------------------------------------------------------

What do you mean, try this ? to 'enable' the 'max compression' etc ? or just rebuild app free of its aspr shell ? It;s up to you. Just gives a nice glow to know you unpacked asprotect ? who cares for 'max'
I mean packing exe's is useless anyway these days of huge RAM/HD etc. U could use UPX it's FREEE!

A keygen ?? no need SAC made a new Aspack 2.12 and old Asprotect 1.2 fit his own key :D .... ask Alexey for a discount.

Just have phun, unpack the targets, get a resource editor and have a play with those Delphi strings . 'ENABLE' those things u want :D

Spl/\j
crUsAdEr
02-05-2002, 10:15 AM
Yep Spl/\j,

I have unpacked it from its AsProtect shell... was disappointed to find the no of days left hardcoded on the dump :<<<.. so there wasnt anything left to do... so i tried to enable the save option but got stuck.. not much experience with win32asm yet .. so asked u guys for hints but looks like it's pretty hard.. yep i unpack CAS's version.. yeah i realise it's not a keygen he made for himself :>....

so i was asking whether i should try to enable the save option, enable max compression etc (make it a proper reg asprotect :>) still.. but guess i better start with something else first...

Anyway... i would like to try those projects on the newbie project forums but all the links seem dead.. anyway i can get them and try, better late than never :>...

Thanx,
evaluator
02-05-2002, 11:05 AM
Did you check crocko for aspack!?
crUsAdEr
02-05-2002, 11:17 AM
crocko????

crc u mean???
nah.. it has a "few" (infact 9 or 10) calls into AsProtect memory that requires little patch.. tt's abt it...


How can I make a valid PE ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How can I make a valid PE ?
PDA

View Full Version : How can I make a valid PE ?

The SharK
02-05-2002, 08:42 AM
How can I make it a valid PE, so I can disassemble it.
I have been looking at some "solutions" on the
subject, but it didn't work.;)
ZaiRoN
02-05-2002, 09:43 AM
try looking for the size of optional headers :)

bye,
ZaiRoN
The SharK
02-05-2002, 10:02 AM
Originally posted by ZaiRoN
try looking for the size of optional headers :)

bye,
ZaiRoN

I have been looking/modifying them, but I still can't make
the file to disassemable.

I thought that I understood how the PE headers worked, but...
In one solution by Code Inside they wrote that you have to
REMOVE 0x40 bytes from the IMAGE FILE, but then there will
be a problem with the ALIGNMENT, so they wrote that you should
remove another 0x40 bytes to make it work, and it's HERE I GOT
STUCK...
DakienDX
02-05-2002, 11:24 AM
Hello The SharK !

It is very simple. The ".code" section overlaps the ".rdata" section. ".code" has a virtual and physical size of 1000h, but after 0D00h the ".rdata" section starts already.

Try setting ".code" virtual and physical size to 0D00h.
CoDe_InSiDe
02-05-2002, 01:39 PM
Hi The SharK,

Try to look a little closer at the suggestion ZaiRoN gave you (You already did but appearantly not good enough ;) )

Cya...

CoDe_InSiDe
blackos
02-05-2002, 04:44 PM
Hi The Shark ...

Maybe could you use a pretty cool tool called 'LordPE' from Y0da and use "rebuild PE" option ?

bye.

blak.
The SharK
02-05-2002, 05:49 PM
Originally posted by CoDe_InSiDe
Hi The SharK,

Try to look a little closer at the suggestion ZaiRoN gave you (You already did but appearantly not good enough ;) )

Cya...

CoDe_InSiDe

Hello CoDe_InSiDe !!!

I feel real lame about the PE Header, that I obviously can't
get to disassemble ???
I have used PROCDUMP to look through the sections, and I have
modified them for several days now, without any luck......
I really feel like a lamer.........newbee......???
Can it really be THAT difficult. You say no, but....
CoDe_InSiDe
02-06-2002, 05:59 AM
Hi The SharK,

Here read the attached solution (Or have you already read this one? ;) )

Cya...

CoDe_InSiDe
The SharK
02-06-2002, 07:30 AM
Originally posted by CoDe_InSiDe
Hi The SharK,

Here read the attached solution (Or have you already read this one? ;) )

Cya...

CoDe_InSiDe

I have read it:
1) I go to offset 0x94 and change 0x2001 to 0xE0
2) I go to offset 0x160 and REMOVE 0x40 bytes.
3) I "try to" correct the FILEALIGNMENT, so I place the cursor AFTER THE SECTION HEADERS, i think it's offset 0x1F0 - but i'm not sure.... so here I get stuck...;)
CoDe_InSiDe
02-06-2002, 01:42 PM
Hi The SharK,

Well, it seems you did it correct, you removed those 40h bytes, but have you also placed those 40h bytes back after the Section Table? (I think you mean that with FILEALIGNMENT hehe :) )
If you haven't done that then that's your problem ;)
IF you placed those bytes back after the Section Table then the CrackMe can be disassembled (Btw the CrackMe is a little Encrypted so maybe better unpack first? :D )

Cya...

CoDe_InSiDe
vr62001
02-09-2002, 10:58 PM
I looked over the crackme, and it is written wrong I believe. The crackme states that you should remove 64 bytes before the section headers, then remove 64 bytes after it too. I believe what he was trying to say was, remove the 64 bytes before it, and then add those 64 bytes after it.

I got it to disassemble just fine, but the program still says it's not a valid win32 exe. The part where it all feel apart for me when it asked me to run serializer.exe and procdump. Since serializer could not run correctly, procdump wouldn't see it.

Lateron it asked me to look at the 16h code at FF0, and it was there. However, the following line was not to be found:

:00401062 EB8C jmp 00400FF0

I don't know if I did something wrong, or the crack is written wrong again. Nonetheless, I'd be glad to see my err if someone could point it out. Thanks :)

vr62001
CoDe_InSiDe
02-10-2002, 08:03 AM
Hi vr62001,

"I looked over the crackme, and it is written wrong I believe. The crackme states that you should remove 64 bytes before the section headers, then remove 64 bytes after it too. I believe what he was trying to say was, remove the 64 bytes before it, and then add those 64 bytes after it."

You mean the Tutorial? and yes indeed you're right, hehe i never noticed that ;)

"I got it to disassemble just fine, but the program still says it's not a valid win32 exe."

On what OS did you try to run the file? :)
Most of my CrackMe's only run on Win98SE :D

Cya...

CoDe_InSiDe
The SharK
02-14-2002, 03:51 PM
Thanks all for you replies, it sure helps alot to have you guys
around !:D


int 20 (hinte's crackme #6)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > int 20 (hinte's crackme #6)
PDA

View Full Version : int 20 (hinte's crackme #6)

ZaiRoN
02-05-2002, 12:22 PM
hi to all,
it's possible detect sice using this piece of code:

int 20 vxdcall vxdldr_getdevicelist
xor ebp, ebp
mov ebx, [eax+5]
cmp ebx, 0xC0000000
pushfd
and dword ptr [esp], 01

maybe i'm wrong but think that the last three instructions are potentially dangerous. any hint? :confused:

thanks in advance,
ZaiRoN
Kayaker
02-05-2002, 04:32 PM
Hi ZaiRoN

In what way do you mean dangerous? This is one pretty slick code snippet.

I think I'm going to leave this one up to the user to explore, but basically what is returned in [EAX+05] is the VxD_Desc_Block structure (DDB or Device Description Block) for the most recent VxD in the list of devices maintained by VXDLDR.

The CMP EBX,C0000000 statement is the amazing one in that it returns the Device_ID for Softice in esp-4. [WRONG, DUMMY!!, see later comment on how Numega may have chosen their Device_ID...] The pushfd statement is simply accessing that stack parameter. I assume there's a conditional jump statement somewhere later on.

Are you at liberty to say where you found this code? Like some nasty virus or cryptor we may want to defend ourselves against? Some might consider this code potentially dangerous...

Kayaker
ZaiRoN
02-05-2002, 05:46 PM
Hi Kayaker,

first of all i'd like to thank u for the reply :)

I assume there's a conditional jump statement somewhere later on.
perfect! you have hit the centre of the target;)
the problem is that jump (absolute, non conditional!).

you can found this code snippets in the hinte's crackme#6 (download it from the crackme site).

ZaiRoN

ps. maybe it would be possible to move the discussion to the mini project area...
Kayaker
02-06-2002, 02:34 AM
OK ZaiRoN, this is one hell of a crackme, it might make one hell of a project. I'll up the target file here as well.

To start with, I have to ask if you managed to break into the crackme to start tracing. Loader32 and Icedump failed to break at WinMain. I was able to start the crackme with Frogsice, which reported there were various Code 00 attempts being made to detect Softice. If I tried to use hmemcpy to monitor the s/n being inputted I got some lovely BSOD's. Needless to say I haven't progressed on the keygen routine or even found the SI detection code you listed.

I did find a few interesting things out though because I was able to break at WinMain and start tracing in a traditional way by cheating and using my own loader, part of the Softice backtrace disassembler proggy Clandestiny and I are working on. It uses a dll injection technique that allows you to *jump* into the program OEP. No way to detect it since it's non-traditional, so no way to prevent it ;-)

I was able to put together a few SI backtraces of the actual code sequence the program starts up with. There was much zeroing of code bytes every so often, so I had to break up the backtraces and nop out the actual REPZ STOSB lines so the disassembler could disassemble the results properly. Anyway, here is some of the output I got from our tool (TraceDump). The numbers on the left are the trace output line numbers and will vary depending on where I broke up the backtracing and snipped the code. It doesn't progress towards the keygen at all, but it does show some interesting protection code. Not sure exactly what all the code is doing, but there's some interesting snippets nonetheless ;)

Remember this is the *actual* sequence of code executed, resolved from any SMC, because this is what the Softice backtrace is actually recording, our tool just disassembles those addresses which are stored in the backtrace buffer, while the program is loaded in memory. It starts at the OEP of 403E8F and there is much playing with the stack to produce valid jump addresses, here's a small snippet:

01 403E8F 688DE7F6C681 PUSH DWORD C6F6E78D ;OEP
02 403E94 8104241657493983 ADD DWORD [ESP], 39495716
03 403E9B 83C404FF ADD ESP, BYTE +4
04 403E9E FF6424FCEA JMP NEAR [ESP-4] ; jmp 403EA3
05 403EA3 BB1D2216B881 MOV EBX, B816221D
06 403EA8 81C32AF6294868 ADD EBX, 4829F62A
07 403EAE 689CE7F6C681 PUSH DWORD C6F6E79C
08 403EB3 8104242657493983 ADD DWORD [ESP], 39495726
09 403EBA 83C404FF ADD ESP, BYTE +4
0A 403EBD FF6424FCEA JMP NEAR [ESP-4] ; jmp 403EC2
0B 403EC2 5150 PUSH ECX
0C 403EC3 5033 PUSH EAX
0D 403EC4 33C0B9 XOR EAX, EAX
0E 403EC6 B942000000BF MOV ECX, 42
0F 403ECB BFC5E5675981 MOV EDI, 5967E5C5
10 403ED0 81EF36A7275990 SUB EDI, 5927A736
11 403ED7 9058 NOP
12 403ED8 5859 POP EAX
13 403ED9 59FF POP ECX
14 403EDA FFD368 CALL EBX ; call 401847
15 401847 5B68 POP EBX
etc.

Notice the NOP at 403ED7 (should actually be 2 nops). This is the first REPZ STOSB statement which normally would have zeroed out the previous code. I nopped it out to continue producing a usable trace for outputting. Eventually we'd like to do *real-time* dumping of the code so this wouldn't be necessary. So far nothing too interesting, I just wanted to show the general way the code works with all the stack jumps produced from adding a value to another value on the stack to produce a valid address.

...continued
Kayaker
02-06-2002, 02:45 AM
The code continues on in this fashion for a while. There is a Structured Exception Handler (SEH) set up and an invalid opcode produced, but I wasn't able to break on the handler routine so I won't bore you with the code. The next interesting thing occurs here:

3C 4018EB 83C40483 ADD ESP, BYTE +4
3D 4018EE 83C404FF ADD ESP, BYTE +4
3E 4018F1 FF6424FCEA JMP NEAR [ESP-4]

Notice the two ADD ESP, BYTE +4 lines. If you allow both of them to execute you jump to Kernel32 code at address BFF8B560, which leads directly into an ExitThread call and the app never opens. It doesn't actually terminate, it's still listed as a 'task', but it never opens up. However, if you nop out one of the ADD lines, then the jump is instead back into valid program code. I'm not sure exactly what is happening here, whether the invalid opcode (F1) is being detected or what. The IDT hasn't been changed at this point so it's not a standard INT 6 invalid opcode hook or anything.

Anyhow, the code goes on to access the starting address of the GDT and pops it into EBX:

2F 4026CC 0F014424FE5B SGDT [ESP-2]
30 4026D1 5B33 POP EBX

Then it finds the LDT from the GDT address:

36 4026E8 0F00C024 SLDT AX
37 4026EB 24F803 AND AL, F8
; al = D0h
38 4026ED 03D868 ADD EBX, EAX
; add to GDT address
39 4026EF 685CCD16B981 PUSH DWORD B916CD5C
3A 4026F4 810424A759294783 ADD DWORD [ESP], 472959A7
3B 4026FB 83C404FF ADD ESP, BYTE +4
3C 4026FE FF6424FCEA JMP NEAR [ESP-4]
3D 402703 8A6B078A MOV CH, [EBX+7]
; ch = 80
3E 402706 8A4B04C1 MOV CL, [EBX+4]
; cl = 0
3F 402709 C1E11068 SHL ECX, 10
; ecx = 80000000

ECX is now 80000000, close to the LDT address...

40 40270C 68AE5748C881 PUSH DWORD C84857AE
41 402711 81042472CFF73783 ADD DWORD [ESP], 37F7CF72
42 402718 83C404FF ADD ESP, BYTE +4
43 40271B FF6424FCEA JMP NEAR [ESP-4]
44 402720 668B4B028D MOV CX, [EBX+2]
; cx = 3000

ECX is now 80003000, the start of the LDT (at least on my system, type 'ldt' in SI)

Then it writes into the LDT a valid call address. Note that an entry in the LDT, like the IDT, takes up two dwords (64-bits), and is laid out in a 'table' format like this:

-------------------------------------------
016F:80003008 34C7 0028 EC00 0040
; Icedump screendump of my LDT after the crackme code writes to it

34C7h are bits 31...16 of the address
0028h is the Target Segment Selector
EC00 is a bunch of flags we don't care about
0040h are bits 15...0 of the address

So the real address coded here is 28:004034C7
-------------------------------------------

...continued
Kayaker
02-06-2002, 02:45 AM
And the LDT writing routine in the code:

Stores the Least Significant Word of the call address (34C7h):

45 402724 8D7908FC LEA EDI, [ECX+8]
46 402727 FC8B CLD
47 402728 8BC666 MOV EAX, ESI
48 40272A 66AB68 STOSW

Stores the Segment Selector and the bullshit flags we don't care about:

4D 402740 B8280000ECAB MOV EAX, EC000028
4E 402745 AB0F STOSD

Stores the Most Significant Word of the call address (0040h):

4F 402746 0FA4F01068 SHLD EAX, ESI, 10
...
54 40275E 66AB61 STOSW

And finally this address, which the proggy cleverly
inserted into the LDT is called:

8C 40284C 9A000000000F0051 CALL F:00000000

which is to 28:004034C7. Since this uses the segment selector normally reserved for vxds, I couldn't use TraceDump to output trace from it because the SI backtrace BPR doesn't allow it, and Icedump /screendump similarly failed. So you'll have to take my word for it that the code is:

28:4034C7 PUSH 6B3CAE82
28:4034CC SUB DWORD PTR [ESP], 6AFC8B9E
28:4034D3 ADD ESP, 4
28:4034D6 CALL [ESP-4]
28:4034DA RETF

After returning to the regular segment selector the code continues on (seemingly forever, sigh):

8D 402853 5150 PUSH ECX
...
96 40286B C3EA RET

Actually, you don't have to take my word for it. There is no breakpoint detection at least in this part of the code, so if you set a BPM on any of the addresses I gave above (using your own normal CS selector) you *should* break freely. i.e.
BPM 167:4026CC X
should get you at where the GDT is read:
4026CC 0F014424FE5B SGDT [ESP-2]

Anyway, I'll hope you'll forgive me for going off on a tangent, I just enjoy ferreting out sneaky little code snippets like this. If we're to protect ourselves from questionable code practices (viral perhaps), then we need to start by being aware of them.

Cheers,
Kayaker
+SplAj
02-06-2002, 05:45 AM
Hi Kayaker

thanx for the indepth analysis. :D those SEH redirections are the 'vogue' thing right now ;)

I d/l said target and of course it won'r run on WinNT/2K platform. Interesting point is no IAT or IT in header ?

Is it packed or just re-aligned very aggressively to 0x200 ?

I don't have Win98 here to analyze further...........

Spl/\j
ZaiRoN
02-06-2002, 07:43 AM
HI Kayaker

i agree with +SplAj, your analysis sounds good:)

my initial goal is to study how the program detect the sice. no keygen for the moment...maybe another mini project:D

the serious thing:
fundamentally i have found 3 kinds of protection against sice: seh, ldt and the int20.

1) seh:
here is how it installed the seh:

401876: push 49975D87
40187B: sub dword ptr [esp], 49572959
401882: xor eax, fs:[ebx]
401885: push eax
401886: mov fs:[ebx], esp

after the sub, [esp]=40342E. 40342E is the handler u are looking for:)
so, when you found the invalid opcode (at 4018BE) redirect the flow to the routine handler.

for the ldt i think you have just said everything..but i have a question for u:
8C 40284C 9A000000000F0051 CALL F:00000000
Since this uses the segment selector normally reserved for vxds

it's necessary to use this segment?
when u are in the call above try to redirect the flow to the 4034C7 of the original segment. some lines and you'll find the int20 code...

for +SplAj:
Is it packed or just re-aligned very aggressively to 0x200 ?
i don't know...i think it's certainly re-aligned.

all for the moment, i think that there will be very much to learn from this crackme:)

ZaiRoN
ZaiRoN
02-06-2002, 02:32 PM
hi Kayaker

8C 40284C 9A000000000F0051 CALL F:00000000

maybe i'm wrong but i think that hinte wants to bring us in the wrong way forcing the flow in the segment reserved for the vxd.
if you try to jump to 4034C7 (in the original segment) and step a little you'll found a very interesting decryption routine (4022F8/402354).
after that routine the bytes from 403DD5 to 403E8E turn out very intersting. i've found things like user32.dll, Getmodulehandle, MessageBox etcetc...
maybe it's a good thing :D

ZaiRoN
ZaiRoN
02-08-2002, 07:00 AM
hi,
someone is working to the project?

i have a little question for u:
The CMP EBX,C0000000 statement is the amazing one in that it returns the Device_ID for Softice in esp-4.
if Softice is not in the device list which it's the value of ebx?

ZaiRoN
Kayaker
02-08-2002, 02:44 PM
Hi ZaiRoN

I'm definitely still working on this as I get the chance. Your last posts were very helpful! Redirect the LDT call using a regular code segment and sure enough lots of interesting things appear. Now we know where the IT went to ;)

Strange how the jump after the Int 20 call goes to address 000282. Actually I got the exact same address if I tried to trace into the jump that was in the 0028 segment LDT Call F:00000000 . You can F10 step over this call, but just don't try tracing into it without redirecting it into a regular code segment.

BTW, this funny looking call can be understood by typing 'LDT' in Softice before and after you've run the crackme for the first time and you see how it's created a Ring3 gated call:

LDTbase=80003000 Limit=3FFF
0004 Reserved 00000000 00000000 0 NP
000F CallG32 0028:004034C7 3 P
0014 Reserved 00000000 00000000 0 NP

As for what's happening on that VXDLDR_GetDeviceList Int 20 call:

I don't think the value of EBX itself changes if SI isn't loaded, it still seems to be the DDB of the most recent VxD. The reason I say this is that I had inserted the code you initially posted into my own vxd code, and the value in mov ebx, [eax+5] was the DDB of my own vxd, which was easy to recognize from the DDB_Name field in the DDB structure.

Here's the output and structure just for reference. Note that there seems to be more than one define of the VxD_Desc_Block (DDB) structure around, this one is from vmm.inc and seems to be comparable to what you see in Softice.

EBX=D56A78F0
0030: D56A78F0 C01677D8 0000040A 80020001 43415254 .w..........TRAC
0030: D56A7900 504D5544 80000000 CAA05730 00000000 DUMP....0W......
0030: D56A7910 00000000 00000000 00000000 00000000 ................
0030: D56A7920 00000000 00000000 00000000 D56EBD00 ..............n.
0030: D56A7930 00000050 52737631 52737632 52737633 P...1vsR2vsR3vsR

VxD_Desc_Block STRUC
DDB_Next DD ?
DDB_SDK_Version DW DDK_VERSION
DDB_Req_Device_Number DW UNDEFINED_DEVICE_ID
DDB_Dev_Major_Version DB 0
DDB_Dev_Minor_Version DB 0
DDB_Flags DW 0
DDB_Name DB " "
DDB_Init_Order DD UNDEFINED_INIT_ORDER
DDB_Control_Proc DD ?
DDB_V86_API_Proc DD 0
DDB_PM_API_Proc DD 0
DDB_V86_API_CSIP DD 0
DDB_PM_API_CSIP DD 0
DDB_Reference_Data DD ?
DDB_Service_Table_Ptr DD 0
DDB_Service_Table_Size DD 0
DDB_Win32_Service_Table DD 0
DDB_Prev DD 'Prev'
DDB_Size DD SIZE(VxD_Desc_Block)
DDB_Reserved1 DD 'Rsv1'
DDB_Reserved2 DD 'Rsv2'
DDB_Reserved3 DD 'Rsv3'
VxD_Desc_Block ENDS

------------------------------------------------

I had said that the CMP EBX,C0000000 statement returns the Device_ID for Softice in esp-4 because, well because it seemed to, id 202 kept appearing there. But I've just been noticing sometimes a slightly different return value as well under different conditions. I wouldn't mind if someone could confirm this.

The real question is what Device_ID is returned if SI isn't loaded, which I'm sure is what you really meant Zairon. I'm going to try to test this later tonight by passing that value in esp-4 via DeviceIOControl and outputting it to a MessageBox.

BTW, for those wanting to mess with this, an easy way to get into the code is to use Icedump with /PROTECT on. This will break when the GDT gets accessed for the 1st time. Turn protect off and you can start tracing. Not to worry, any BSOD's aren't harmful and don't reboot, just refresh with F5. You can change the LDT segment selector in memory to redirect jumps simply by changing the 0028 to your own CS.

Kayaker
ZaiRoN
02-09-2002, 05:15 AM
Hi Kayaker,

your last post has made me think a little bit. in particular a single phrase:
I don't think the value of EBX itself changes if SI isn't loaded
that's the point! i asked in another forum if it's possible detect softice using this method (int20blablabla); this is the (translate badly from italian to english...sorry) explanation given by Kill3xx (thanks a lot):

"the services of the VxD loader are to appanage of the dynamics (loadable) vxd.. and consequently the device_info list (and the ddb) not includes vxd loaded statically or "dynamically" by the vmm at the boot..."

so, the question is: why use this function??? which it is the sense??? is this only a trick to gain the r0 mode ?!?!!

another thing: i've given a look to the code that follows the damned jump. there's a little routine that slides entire the ddb. it will be another trick to bring us on the wrong way or ...something else:confused:

bha...

that's all friend,

ZaiRoN
Kayaker
02-09-2002, 07:18 PM
OK, I see what you mean Zairon, VxDCall VXDLDR_GetDeviceList is only used for dynamically loaded vxds, and I found that VMMCall VMM_GetVxDLocationList is used for statically loaded vxds:

VMMCall VMM_GetVxDLocationList
jz ErrorHandler
mov [TableAddress], eax
mov [VxDCount], edx
mov [TableSize], ecx

Returns the address of the VxD location list in EAX,
returns the count of VxDs in EDX, and
returns the list size (in bytes) in ECX.
Uses EAX, ECX, and EDX.

Returns the address of the VxD if the function
succeeds; otherwise, sets the zero flag.
The VxD location list is a packed array of variable
length Device_Location_List structures.

The Device_Location_List structure will similarly give you a linked DDB list for statically loaded vxds:

Device_Location_List STRUC
DLL_DDB DD ?
DLL_NumObjects DB ?
DLL_ObjLocation DB SIZE ObjectLocation * 1 DUP (?)

I threw this in some code and by following the DDB_Prev field of the VxD_Desc_Block confirmed the static vxds I had loaded - VMM, CSHOOK, SHELL, VFBACKUP,... Eventually I assume I would have hit SIWVID and WINICE but I didn't want to scroll through my 56 vxd entries to find it.

So, with these 2 calls, VMMCall VMM_GetVxDLocationList and VxDCall VXDLDR_GetDeviceList, you can get a list of all the static and dynamically loaded vxds on your system.

In fact, this is how Softice generates the list you see when you type 'vxd'. You can find these addresses in winice.exe here:

C005E004 mov esi, offset aVxdNameAddress
; "VxD Name Address Length Seg ID "...
C005E009 call sub_C0018A8A
...
C0082FD2 VxDcall VXDLDR_GetDeviceList
...
C008E6F7 VMMcall VMM_GetVxDLocationList

As a sideline, you ever used IceClimber by Trapflag? It allows you to set breakpoints within Softice itself. Makes for some interesting bedtime tracing ;) I haven't tried it with this crackme, but it *may* allow you to set bp's within those 0028: code segments as well, just a thought.

So you're right about the use of VXDLDR_GetDeviceList, why use this function if all it returns is the most recent dynamically loaded vxd in EBX? But tell me, if you type 'd ebx' in SI what vxd name do you see? If you've got Icedump loaded, what name do you see?...;) If you follow the DDB_Prev field back 2 or 3 links does this not look like the (dynamic) list you get with 'vxd' in SI?

I still don't know how this relates to what happens after the VXDLDR_GetDeviceList call or what is happening on the stack though, and I haven't been able to get past that jmp esp-4 statement yet.

Back to the drawing board...

Kayaker
Kayaker
02-10-2002, 06:46 AM
Hi

Just a quick note to set the record straight. I see I was *way* off base thinking that this code had anything to do with the Device_ID for Softice. It was just (bad) luck that I first saw the value of 0202h appearing on the stack. This *is* actually the ID for winice, which is what threw me at first, but has nothing to do with that.

Instead this is simply the value of the Flags register, and changes on any command that changes the flags. Check the Art of Assembly Language Chapter 6 or the Intel Developers Manual 1 under EFLAGS for a detailed explanation. The latter states that "When a call is made to an interrupt or exception handler procedure, the processor automatically saves the state of the EFLAGS registers on the procedure stack", explaining its presence there.

The flags you see in the Softice Register window and the hex value you see on the stack can be understood by changing the value to binary and following the bit pattern.

Bit 0 - C (Carry flag)
Bit 1 - Reserved, set to 1
Bit 2 - P (Parity flag)
Bit 3 - Reserved, set to 0
Bit 4 - A (Auxiliary carry flag)
Bit 5 - Reserved, set to 0
Bit 6 - Z (Zero flag)
Bit 7 - S (Sign flag)
Bit 8 - Trace (Trap) flag, not shown by Softice
Bit 9 - I (Interrupt flag)
Bit 10 - D (Direction flag)
Bit 11 - O (Overflow flag)
Bits 12-31 not shown by Softice

So the value of 202h I just happened to see (binary 001000000010) corresponded to the flags being set like this (remember Bit 1 is set to 1 by default):
o d I s z a p c

If it was 206h (001000000110) the flags would be:
o d I s z a P c

You can actually test this in the crackme code (or your own vxd verion) by changing the flags with 'R FL <flag>' and seeing how the value on the stack changes.

Knowing this we can start to look at what the rest of the code is doing.

int 20 vxdcall vxdldr_getdevicelist
xor ebp, ebp
mov ebx, [eax+5]
cmp ebx, 0xC0000000
pushfd
and dword ptr [esp], 01

- mov ebx, [eax+5]
we know moves the VxD_Desc_Block structure (DDB or Device Description Block) for the most recent dynamically loaded VxD into ebx.

- cmp ebx, 0xC0000000
is something I have seen documented in some viral code, followed by a jc @@next_vxd (Jump if Carry, follow DDB_Next to next VxD_Desc_Block, repeat loop).

- pushfd
- and dword ptr [esp], 01
pushes the EFLAGS register onto the stack and ANDS the value with 01, checking the Carry flag.

Now the CMP statement modifies the Carry flag in the following way:

cmp ax, bx
C: The carry flag is set after a cmp operation if subtracting bx from ax requires a borrow. This occurs only when ax is less than bx where ax and bx are both unsigned values.

So I would hazard this code may be checking for what vxds are loaded. If it's using the DDB_Next field as in the viral example, then you can trace this yourself from the initial DDB obtained and see that you can get into the *statically* loaded vxds as well.

There is further code going on after this, including a CDQ division, but I haven't looked at it yet in this new light. All the viral coders are probably snickering behind their hands right now, but that's OK, either snicker or help.

Cheers,
Kayaker
ZaiRoN
02-10-2002, 10:43 AM
hi,

as always your posts were very interesting:)
sorry me but i can't understand the role of the flags. maybe i'm wrong but your are saying that this code:

cmp ebx, 0xC0000000
pushfd
and dword ptr [esp], 01

is used for sliding all the vxds (stat. or dyn.)?

for the rest:
If it's using the DDB_Next field as in the viral example...

i think we have read the same article:D
perhaps it is this:
call vxd ;VXDLDR GetDeviceList
@@next:
mov ebx, [eax+5] ;VxD_Desc_Block *DI_DDB
sub ebx, 0C0000000h
jc @@next_vxd
lea ecx, [ebx+0C000000Ch] ;Name_0
cmp [ecx], 'DIPS' ;'SPIDER '
je @@patch
cmp [ecx], '9PVA' ;'AVP95 '
jne @@next_vxd

here is what the crackme is doing! i have take a look to the code beyond the "and dword ptr [esp], 01" and i have found something like that:

cmp [ecx], 'FILE'

try lo load filemon and run the crackme. you'll see what i'm saying:D

maybe something more tonight...

ZaiRoN
Kayaker
02-10-2002, 01:53 PM
Hi Zairon,

Yep, we've been reading the same document ;)

cmp ebx, 0xC0000000
pushfd
and dword ptr [esp], 01

is used to check the state of the Carry flag after the cmp. If ebx is less than C0000000, meaning you've gotten below Ring0 code where a DDB address is no longer valid, then the Carry flag is set. Pushfd pushes the EFLAGS value, or the state of all the flags, onto the stack and the AND statement tests the Carry Bit 0. If the Carry flag is set (esp=1), then esp becomes 1, if unset, 0.

You see this used later on as well several times for testing the Zero flag:

cmp [ecx], something
pushfd
shr [esp], 06 ; shift the Zero flag to the bit 0 position
and [esp], 01 ; test if it's set

You could also use the Bit Test (BT) commands to do the same thing, except that they modify the Carry flag themselves.

I didn't get any meaningful results from Filemon btw.
This whole sequence of code is looking for a particular vxd loaded, and it's pretty apparent what that vxd is. Try changing the name of 'FILE' in memory ([ecx])
cmp [ecx], 'FILE'
and see if the crackme doesn't open ;)

As an aside, if the Device_ID of Softice is 202 and corresponds to the Interrupt flag being set:
202h (binary 001000000010)
o d I s z a p c
I wonder if some Numega programmer was having fun when they chose that as a Device_ID for sice?

Cya,
Kayaker
ZaiRoN
02-10-2002, 03:41 PM
hi Kayaker,

OK! i have understood!

This whole sequence of code is looking for a particular vxd loaded...and see if the crackme doesn't open

i have found the list of vxd but...the crackme doesn't open:confused:
what i have mistaken?

ZaiRoN
ZaiRoN
02-10-2002, 06:18 PM
hi,

i answer myself: Kayaker, you're using icedump!

you're a lazy man:p the rule is: only softice! no other tools:D
i think i'll continue to study the rest of the program; maybe i'll find other interesting thing:)

bye,
ZaiRoN
Kayaker
02-10-2002, 08:17 PM
LOL

- you must write a keygen
- no patching

I don't see any other rules :D
CoDe_InSiDe
02-11-2002, 01:52 AM
Hi everyone,

Just a little side note, trace from the OEP of the program, then you'll see that he uses that "pushfd - and [esp], 01 etc...", or something similiar, very often for jump statements ;)
Also (Like Kayaker mentioned) a lot in the rest of the program :)
It's actually the same as a "jz" for example :D

Ok, enough of my mumbling maybe i'll come back to this CrackMe ;)

Cya...

CoDe_InSiDe
ZaiRoN
02-11-2002, 04:56 PM
hi Kayaker,

doh! you're right...sigh...

btw, from your first post i've seen that you had tried to make a keygen. are u able to put bpx?
i think that the study of the rest of the code is "necessary":p

see you soon,
ZaiRoN
Kayaker
02-12-2002, 12:40 AM
Hi Zairon,

I've had a *little* bit of success on scoping out the s/n routine. What I did was to open the crackme with Icedump, but as we discussed above the crackme won't open unless you patch in memory the DDB entry for that vxd. I'm actually working on a protection against that 'vulnerability'. This affects not only the ICEDUMP driver but also SICE and SIWVID in a similar manner. This is sort of an extension of the Code 09 VMMCall Get_DDB method of detection discussed in the Frogsice doc, just a different way of using the DDB. I've got the basic protection completed and will probably release it in a few days after I polish it up and have some fun with it ;) In the meantime you need the "fix" that manually.

There may be other ways around this or you can get the crackme open with Frogsice itself I think. Anyway, I was able to break on inputting a Name using hmemcpy. At 402D9D is a CALL [ESP-4] which is the hmemcpy call itself which monitors what you enter as a name character by character. At 402DB5 there is a CMP EAX, 4 ; the minimum length of name allowed, and it tests the result of the cmp with that famous routine
pushfd
and dword ptr [esp], 01
You're right CodeInside, this is used everywhere!

Then it takes the last 2 characters of your name (in ESI) and goes into this routine, the output I generated from a backtrace:

18 402E08 66031E66 ADD BX, [ESI] ; start of loop
19 402E0B 6603CBC1 ADD CX, BX
1A 402E0E C1C10B68 ROL ECX, B
1B 402E11 68B993CC7481 PUSH DWORD 74CC93B9
1C 402E16 8104246C9A738B83 ADD DWORD [ESP], 8B739A6C
1D 402E1D 83C404FF ADD ESP, BYTE +4
1E 402E20 FF6424FCEA JMP NEAR [ESP-4] ; 402E25
1F 402E25 2BCB81 SUB ECX, EBX
20 402E27 81F14513000068 XOR ECX, 1345
21 402E2D 68D340DD7581 PUSH DWORD 75DD40D3
22 402E32 8104246EED628A83 ADD DWORD [ESP], 8A62ED6E
23 402E39 83C404FF ADD ESP, BYTE +4
24 402E3C FF6424FCEA JMP NEAR [ESP-4] ; 402E41
25 402E41 C1C90348 ROR ECX, 3
26 402E44 489C DEC EAX
27 402E45 9CF7 PUSHF
28 402E46 F71424C1 NOT DWORD [ESP]
29 402E49 C12C240683 SHR DWORD [ESP], 6
2A 402E4D 8324240150 AND DWORD [ESP], BYTE +1
2B 402E51 5052 PUSH EAX
2C 402E52 5299 PUSH EDX
2D 402E53 99B8 CDQ
2E 402E54 B8EE25E8CF35 MOV EAX, CFE825EE
2F 402E59 3561DA1730F7 XOR EAX, 3017DA61
30 402E5E F764240805 MUL DWORD [ESP+8]
31 402E62 05DA0858302D ADD EAX, 305808DA
32 402E67 2D61DA173089 SUB EAX, 3017DA61
33 402E6C 894424085A MOV [ESP+8], EAX
34 402E70 5A58 POP EDX
35 402E71 5883 POP EAX
36 402E72 83C404FF ADD ESP, BYTE +4
37 402E75 FF6424FCC3 JMP NEAR [ESP-4] ; 402E08
Loops to above 4 times
38 402E08 66031E66 ADD BX, [ESI]
39 402E0B 6603CBC1 ADD CX, BX
etc...

When it's done with this loop, JMP NEAR [ESP-4] points to 402E7E instead of back to 402E08, and the loop is finished:

96 402E72 83C404FF ADD ESP, BYTE +4
97 402E75 FF6424FCC3 JMP NEAR [ESP-4]
98 402E7E 05CAA7F62968 ADD EAX, 29F6A7CA
...

From here the code seemed to go into GetDlgItemTextA, but as a direct jump not an API call, so I don't think you can set a break on it. Not sure how that's used. There's lot's of other code in there, the loop I listed above seems to get called again, perhaps in response to GetDlgItemTextA.

You can enter a s/n and follow its course in a similar manner, but this seems to get into some crypto/hashing stuff, which I know little about. I've got a shitload of trace output (like about 4000 lines) so I don't know wtf it's doing to be perfectly honest :rolleyes: Maybe I could just dump it all into a keygen and see if it works, heh.

That's it for now, I think I'll go back to coding. If you can at least break on that Hmemcpy 402D9D CALL [ESP-4] line, or the start of the loop I listed (with your name in ESI), then you should be at a good stage to start tracing.

Good Luck,
Kayaker
ZaiRoN
02-12-2002, 08:39 AM
hi,

From here the code seemed to go into GetDlgItemTextA, but as a direct jump not an API call, so I don't think you can set a break on it. Not sure how that's used
this is right. the s/n isretrieve using GetDlgItemTextA in this way:
402EE8: call [esp-04]
enter the call and after few lines:
401164: jmp [ebx+10] ; jump to the code of GetDlgItemTextA

where ebx points to the references to the used apis.
the s/n must be 8 chrs.
much of code to explore....

cya..
ZaiRoN
the analyst
02-18-2002, 03:50 PM
hello,

Originally posted by Kayaker
The code continues on in this fashion for a while. There is a Structured Exception Handler (SEH) set up and an invalid opcode produced
then the jump is instead back into valid program code. I'm not sure exactly what is happening here, whether the invalid opcode (F1) is being detected or what. The IDT hasn't been changed at this point so it's not a standard INT 6 invalid opcode hook or anything.

just to let you know, this is not an invalid opcode.
In fact F1h is the undocumented opcode for int 1.
this is a not so known trick to detect tracing.

start:

xor eax,eax

push offset ExceptionHandlingFunction
push dword ptr fs:[eax]
mov fs:[eax], esp

db 0f1h ; undocumented INT 1

push 0 ; Exception not catched, beeing debugged
push offset traced ; Gotcha!
push offset traced
push 0
call MessageBoxA

; some nasty code couble be here ;)
; or some fake routines eventually.

push 0 ; Exit to win
CALL ExitProcess

ExceptionHandlingFunction:

push 0
push offset exception ; im not being traced :)
push offset exception
push 0
call MessageBoxA

push 0 ; Exit to win
CALL ExitProcess

this detect revirgin tracer, wdasm tracer and many other.
I know this trick for some times already ;-)

just my two cents, hope it helps.

the analyst / HERT
Kayaker
02-19-2002, 10:54 PM
Hi

Thanks for the info analyst ;-) I've since found out this is indeed an old largely undocumented form of the INT1 Single Step Trace Exception known as ICEBP. (Largely undocumented by Intel at least, but a search for 'ICEBP' yields a lot of info, i.e. h*tp://x86.ddj.com/secrets/opcodes/icebp.htm)

I *think* I see what's going on here, but anyone please clarify if I'm wrong, I'm still absorbing CPU architecture and Intel docs to get a better understanding. Normally if you are single step tracing (or using the SI backtrace feature), Softice clears the trace (T) flag in the EFLAGS register, so that the regular INT01 handler is not called. If this trace bit is clear, the instructions are executed without interruption.

So when this errant undocumented INT1 is stepped over (traced), it continues into the "bad boy" code. However, if you weren't single step tracing (and the Trace flag was set), then the SEH (the "good boy" code) that was previously set up would be called and you would continue on unmolested.

I'm still a little confused in how Softice behaves versus "other" debuggers in terms of this trace flag. According to http://www.woodmann.net/fravia/civetta.htm one way to detect SI is:

-----------------------------------------------------------------
4. by using the TRAP flag, one can use the single stepping feature to
call a protection routine (e.g. a decryptor). The problem is, that
during single stepping SOFT-ICE clears the TRAP flag for the V86 task
and will neither execute nor step into the INT01 handler of the
V86 task. Many schemes use this trick.
-----------------------------------------------------------------

OK, so this is where I got that the Trace (Trap) flag is cleared during single step tracing, and this is what this undocumented INT1 trick is taking advantage of. However, according to Art of Assembly Language Ch.6 (or the Intel docs):

----------------------------------------------------------------
The trace flag enables or disables the 80x86 trace mode. Debuggers (such as CodeView)
use this bit to enable or disable the single step/trace operation. When set, the CPU interrupts
each instruction and passes control to the debugger software, allowing the debugger
to single step through the application. If the trace bit is clear, then the 80x86 executes
instructions without the interruption.
----------------------------------------------------------------

In this case it seems to indicate that when the Trace flag is *set*, control is passed to the debugger "allowing the debugger to single step through the application". It just seems to indicate that there is an inherent difference in how Softice operates versus "other" debuggers, unless I'm misinterpreting all this.

Nothing I can't live with of course, it's just a question that came to my mind while trying to understand exactly what's going on. In any case you can certainly *see* the effect of this trick. If you set a bpm breakpoint on the address of the exception handler (good boy routine), which as Zairon said was at 40342E, Softice will break on it if you just execute the program. However if you try tracing over that INT1 (Trace flag cleared?) or use a Backtrace (based on BPR), then it won't break and you'll end up continuing on into the bad boy code.

The output from our Backtrace disassembler actually shows this bad boy sequence (pretty much as you see it in the Softice window anyway), but the difference is that the disassembler (based on the NASM disassembler) records the F1 opcode properly as an INT1, but Softice itself (as you'd see with SHOW) records the backtrace disassembly of 0xF1 as INVALID. Seems Numega never added support for some undocumented opcodes...

SEH:
23 401876 68875D9749 PUSH DWORD 49975D87
24 40187B 812C2459295749 SUB DWORD [ESP], 49572959
25 401882 643303 XOR EAX, [FS:EBX]
26 401885 50 PUSH EAX
27 401886 648923 MOV [FS:EBX], ESP
; handler routine now at 40342E (49975D87 - 49572959)
...

UNDOCUMENTED OPCODE + BAD BOY ROUTINE:
33 4018BE F1 INT1
34 4018BF 58 POP EAX
35 4018C0 680D620858 PUSH DWORD 5808620D
36 4018C5 810424C7B637A8 ADD DWORD [ESP], A837B6C7
37 4018CC 83C404 ADD ESP, BYTE +4
38 4018CF FF6424FC JMP NEAR [ESP-4]
39 4018D4 648903 MOV [FS:EBX], EAX
3A 4018D7 68382669F2 PUSH DWORD F2692638
3B 4018DC 810424B3F2D60D ADD DWORD [ESP], DD6F2B3
3C 4018E3 83C404 ADD ESP, BYTE +4
3D 4018E6 FF6424FC JMP NEAR [ESP-4]
3E 4018EB 83C404 ADD ESP, BYTE +4
3F 4018EE 83C404 ADD ESP, BYTE +4
40 4018F1 FF6424FC JMP NEAR [ESP-4]
; to Kernel ExitThread

Anyway, thanks again for the interesting tip ;)

Regards,
Kayaker
the analyst
02-20-2002, 05:42 AM
heya :)

Originally posted by Kayaker
Hi

Thanks for the info analyst ;-) I've since found out this is indeed an old largely undocumented form of the INT1 Single Step Trace Exception known as ICEBP. (Largely undocumented by Intel at least, but a search for 'ICEBP' yields a lot of info, i.e. h*tp://x86.ddj.com/secrets/opcodes/icebp.htm)
set a bpm breakpoint on the address of the exception handler (good boy routine), which as Zairon said was at 40342E, Softice will break on it if you just execute the program. However if you try tracing over that INT1 (Trace flag cleared?) or use a Backtrace (based on BPR), then it won't break and you'll end up continuing on into the bad boy code.
Anyway, thanks again for the interesting tip ;)
Regards,
Kayaker

This piece of code is actually an anti tracing code.
If you run the software without stepping in, it won't call
the bad boy code.
It is usefull to detect debuggers that single step thru the code
such as Wdasm's debugger etc..
Try my code and see how wdasm get owned :)
You can do the same with the trap flag.
But some better tracer, such as Revirgin don't get owned by
the trap flag, while they are bumfucked by that int 1 trick ;)
Note that , you could use a standard int 1 instead of the F1h one.
It is too obvious then tho ;)

Here comes the trap flag code :

start:

xor eax,eax

push offset ExceptionHandlingFunction ; exception handler
push dword ptr fs:[eax]
mov fs:[eax], esp

pushf
pushf
pop eax ; get the flag register
or eax, 100h ; and put the TF Trap Flag (Single Step)
push eax ; And then
popf ; Put it in the register flag
nop

push 0 ; Exception not catched! we are beeing debugged!
push offset trace ; Gotcha!
push offset trace
push 0
call MessageBoxA

; we should put some nasty code in here ;)
; or go to some fake routines eventually.

push 0 ; Exit to win
CALL ExitProcess

ExceptionHandlingFunction:

push 0
push offset exception ; All is fine, im not being traced :)
push offset exception
push 0
call MessageBoxA

push 0 ; Exit to win
CALL ExitProcess

end start

It behaves like the F1's one, but don't fool all the debuggers..
If you step in with F10, you will go in bad boy code, else
you will get back in the good boy place :)
It is good to put such code in a name / serial scheme :)
Newbies, just keep tracing, don't even know wtf is the trap flag
and get fooled black and blue ;-)

My other 2 cents ;-)

regards,

The Analyst / HERT
evaluator
03-07-2002, 03:40 PM
Hello, Kayaker!

I found, why SICE (&+ ICEDUMP) can't load
EXE.
Because in header 1st section's Virtual Offset is 00001057
Abnormal!
Correct it to 00001000 & all will OK.


Finding OEP manually on win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Finding OEP manually on win2k
PDA

View Full Version : Finding OEP manually on win2k

crUsAdEr
02-05-2002, 11:02 PM
Spl/\j,

u 've been mentioning about ur method of setting interrupt breakpoint to find OEP of Asp prog.. could u enlighten me please cos BPM [address of pushad, jmp eax] does not stick at all....

Yeah Tsep's tracer works great... even faster than icedump :>.. thanx Tsep.... but somehow i feel the nag to noe how to do it manually...
Solomon
02-06-2002, 12:59 AM
I often use "BPX ntdll!NtContinue" to find the OEP of ASProtected progs. Quite fast:D Alex uses SEH to hide OEP, then we can use SEH to locate the OEP;)

Once this breakpoint is hit, just press F8 to trace into INT 2Eh. Try to find the IRETD instruction inside NtContinue(). Clear all breakpoints and set a BPX at this instruction.

001B:80464BE5 MOV FS:[00000000],EDX
001B:80464BEC MOV ECX,[ESP+48]
001B:80464BF0 MOV ESI,FS:[00000124]
001B:80464BF7 MOV [ESI+00000134],CL
001B:80464BFD TEST EBX,0000000F
001B:80464C03 JNZ 80464C52
001B:80464C05 TEST DWORD PTR [ESP+70],00020000
001B:80464C0D JNZ 80464CBA
001B:80464C13 TEST WORD PTR [ESP+6C],FFF8
001B:80464C1A JZ 80464CC5
001B:80464C20 MOV EAX,[ESP+44]
001B:80464C24 MOV EDX,[EBP+3C]
001B:80464C27 MOV ECX,[EBP+40]
001B:80464C2A CMP WORD PTR [EBP+6C],08
001B:80464C2F JZ 80464C3D
001B:80464C31 LEA ESP,[EBP+30]
001B:80464C34 POP GS
001B:80464C36 POP ES
001B:80464C37 POP DS
001B:80464C38 LEA ESP,[EBP+50]
001B:80464C3B POP FS
001B:80464C3D LEA ESP,[EBP+54]
001B:80464C40 POP EDI
001B:80464C41 POP ESI
001B:80464C42 POP EBX
001B:80464C43 POP EBP
001B:80464C44 CMP WORD PTR [ESP+08],0080
001B:80464C4B JA 80464C96
001B:80464C4D ADD ESP,04
001B:80464C50 IRETD <-------------set a BPX here

Then keep pressing F5(20 times or so, you konw Alex uses many SEHs:D). Every time when softice pops up at this instruction, just press F8 to return to ASPR. If you see a JMP [EBP-14] below, you are close to OEP(sure you have to bypass several self-decrypt loops to reach OEP after this).

001B:00E400E1 XOR [EAX],EAX <------- famous for raising exception
001B:00E400E3 POP DWORD PTR FS:[00000000] <-------we land here right after IRETD(NtContinue)
001B:00E400EA POP EAX
001B:00E400EB CMP DWORD PTR [00E439DC],00
001B:00E400F2 JZ 00E40108
001B:00E400F4 PUSH 0C
001B:00E400F6 MOV ECX,00E439DC
001B:00E400FB LEA EAX,[EBP-08]
001B:00E400FE MOV EDX,00000004
001B:00E40103 CALL 00E3C49C
001B:00E40108 PUSH DWORD PTR [EBP-04]
001B:00E4010B PUSH DWORD PTR [EBP-08]
001B:00E4010E MOV EAX,[EBP-0C]
001B:00E40111 CMP DWORD PTR [EAX],00
001B:00E40114 JZ 00E40118
001B:00E40116 PUSH DWORD PTR [EAX]
001B:00E40118 PUSH DWORD PTR [EBP-10]
001B:00E4011B JMP [EBP-14] <--------- see this?
001B:00E4011E POP EDI
001B:00E4011F POP ESI
001B:00E40120 POP EBX
001B:00E40121 MOV ESP,EBP
001B:00E40123 POP EBP
001B:00E40124 RET

I think the good breakpoints to defeat SEH are KiUserExceptionDispatcher/NtContinue/NtRaiseException.

Alex may change it to give us more fun if he reads this:D
crUsAdEr
02-06-2002, 03:57 AM
Thanx Solomon.. shall try that ASAP :>

Yep.. it works like wonder....

i could even bpx and bpm on the "popad" instruction and watch it decrypt itself :>... thanx a lot


Tinity xsi how to....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Tinity xsi how to....
PDA

View Full Version : Tinity xsi how to....

2000hoschi
02-06-2002, 05:07 AM
will there be a tutorial how to cr... xsi 2.x ?
I've seen (read the asm listing) what trinity have done,
but in some cases I don't understand it ;-)
Maybe some help ? ;-))
???
Look@Me
02-13-2002, 08:19 AM
hey! :) you lucky! I was looking for anything that could help me bypassing that SPM protection. And you say you've read some nice ASM source code from t,r.i,n.i,t.y. Could you feel free to share it with the whole board ?

Regards,

Look@Me


stuck on Cakewalk cracking TRial versions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > stuck on Cakewalk cracking TRial versions
PDA

View Full Version : stuck on Cakewalk cracking TRial versions

chuk
02-06-2002, 05:14 AM
HI Friends!

Could anybody give an advice?
I have been trying to crack Cakewalk Guitar Tracks Demo Version.
I have seen that when the program starts, a new file in /windows/tmp/
is created and this is the file with the nag screen and the protection, then is deleted, But I can not find the way to deal with this..how the main exe is loading from the tmp file , how to stop this..???

Any help wouldbe appreciated!

C
:D
CoDe_InSiDe
02-06-2002, 05:51 AM
Hi chuk,

Read here first ;)

http://www.woodmann.net/forum/showthread.php?threadid=2592

Cya...

CoDe_InSiDe
chuk
02-11-2002, 05:27 AM
Hi guys,

Many thanks for hte help!, it is good to see that the forum works.

I have got it!. It was bit-arts Softlockx protection, it took me awhile but..

thanks again


SentinelLM FLIRT SIG's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SentinelLM FLIRT SIG's
PDA

View Full Version : SentinelLM FLIRT SIG's

adg
02-06-2002, 08:41 AM
Does anyone know where to get the Sentinel "sspro.sig" FLIRT Signature file for IDA PRo? I have looked all over the web with no success. I managed to find the SentinelLM FLIRT sig's (static and dll) but the same source drew a blank on sspro.sig

Thanks in advance
Polaris
02-06-2002, 04:40 PM
Here is the sig...
adg
02-11-2002, 04:10 AM
Thanks for that!


alfpas2idc.pl
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > alfpas2idc.pl
PDA

View Full Version : alfpas2idc.pl

george
02-07-2002, 06:53 PM
There is a perl script called alfpas2idc.pl used to transform *.alf files made with w32dasm and files *.pas made with Dede Delphi decompiler to *.idc files for IDA pro disassembler so the *.alf and *.pas files will give extra information like string reference in the IDA disassembled file. http://www.search0.com/perlscripts/cgi.html

You may want to use also a file splitter like http://www.spadixbd.com/freetools/ for *.idc files bigger that 64KB


keyfile generation in RaidenFTPD v2.2 build 688?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > keyfile generation in RaidenFTPD v2.2 build 688?
PDA

View Full Version : keyfile generation in RaidenFTPD v2.2 build 688?

pReJkEr
02-08-2002, 05:38 PM
fetch the prog at: raidenftpd.com/en/

here is what i've found out:
1. the prog needs raidenftpd.key (32 bytes) and raidenftpd.sig (256 bytes)
2. it creates a md5 hash from raidenftpd.key and compares it with
a build-in hash table - here it knows if the keyfile has expired or if
it's valid
3. if it's not valid the prog jumps to the next keyfile check
4. if valid then it decrypts raidenftpd.key with raidenftpd.sig witch is a sha-256 hash i think
- here it gets name, email from keyfile and checks if it's a one computer keyfile (if so it compares
the computer network name with retrieved name from keyfile and if they are not equal - msgbox & quit)
5. set window caption to registered
6. jump to next keyfile check
7. when the prog is starting it checks the keyfile 4 times (i guess so - don't remember)

here are some interesting RVA's: 476E6B, 4666AC, 4637C0, 4638A6, 4757CC - few instructions bellow is a call, this is the first keyfile check,
477ED3, 468387, 4685B1, 46868A, 462AB2, 476256,
477656 here it checks crc - 472D9D, i don't need it because i've made a loader

i've patched those RVA's but 2 hours later it checks something again and it switches to unregistered mode again.. :( i can't find this check

i dont have a clue on cryptography so i'm asking here for help... :)
if someone could help me out here with this last check or with generating a valid keyfile it would be great :-)

sorry for my bad english :)


Whoohoo... Anyone wants to get a go at a KeyGen?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Whoohoo... Anyone wants to get a go at a KeyGen?
PDA

View Full Version : Whoohoo... Anyone wants to get a go at a KeyGen?

JimmyClif
02-09-2002, 01:41 AM
Heya to my second Mini project ;) (for those who remember the first)

Well, this time it's quite different... Coding a keygen sounds quite tough but it all depends on the algo implemented by the author.

In this example it won't be more difficult... *g*

[b] But Before:
I haven't checked it out completely yet - but it looks like a pretty amazing proggy... It simulates another Desktop (just like the themes we know) - You can choose between Standard, MAC, A hot blonde and more... It looks really neat ;)

So please do NOT release any keygens to the wide masses out there, mmkay ?

The Protection:
Hehehe...

The URL
hp:\\w*w.lighttek.com/talisman.htm (2.8MB argh)

Just check it out... it's an easy enough challenge...

JimmyClif
ThrawN
02-09-2002, 06:32 AM
Heh nice program yes :)
Did a tut for it a while ago. check out

h**p://www.geocities.com/thrawnc/tuts/Talisman2.zip

Comes with keygens in a viarity of languages to try and suite everyone.

ThrawN
DiGiTAL DYNASTY
ThrawN
02-09-2002, 06:33 AM
ermm sources that is *g* ;)
crUsAdEr
02-09-2002, 12:26 PM
Yep, Jimmy

i tried it.. a pretty simple algorithm but i think it's a good example for newbies...

Just a note... why multiply with 777 ???
maybe 666 is copyrighted by MicroSoft :>
JimmyClif
02-09-2002, 01:00 PM
LOL... oh well... I just love it when I come around an way too easy project...

Just thought it would make a perfect mini project...
crUsAdEr
02-09-2002, 01:19 PM
This one might be easy but make the next one a bit harder...

so we all can learn from u guys :>>>

Mean while, I shall wait patiently and try on my own :>
JimmyClif
02-09-2002, 05:38 PM
why multiply with 777 ???
maybe 666 is copyrighted by MicroSoft :>

Check out the Razor 1911 History... Explains why someone would choose 777 :)


WICE vers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WICE vers
PDA

View Full Version : WICE vers

evaluator
02-09-2002, 03:48 PM
In what package I can found latest WICE ver?
BoundsChuchu?
And what version is best for W98SE?

Additional Q:
How are you, MOJO?

-------------------------
i asked only GREAT questions!
evaluator
02-09-2002, 04:56 PM
just dld BoundChuchu.
Found NO WINICE!

Thanx for replays!
JMI
02-09-2002, 05:25 PM
The latest version of Driver Studio generally has the latest WICE version. Check were you are "just_evaluator".

Regards.
evaluator
02-09-2002, 06:02 PM
UH!
DriverStudio is TOOOO BIIIG file for my 2kb connection.
If it includes standalone installer for WICE,
will be good if you help me and then i help u,

----------------
Your answers are always gREAT!
evaluator
02-09-2002, 07:00 PM
Now I'm downloading 42mb shit, but already
extracted winice file:
size=1290692 crc32=9B508BC2
Will enaf, if I only replace old exe!?
Or must continue 3hour dld?
JMI
02-09-2002, 08:27 PM
I have version 2.5 and 2.6 from the same source as you but haven't actually installed either yet. I'm still running ver 4.05 on Win98SE. I am not sure which files exactly are necessary, but most of the files are there to permit debugging of programs or things other than Window$. I am also on a 56k modem and have spent days downloading some files.

Maybe tomorrow I'll have time to try to install ver 2.6 and then I can give you a better answer of which files are needed just for Windows and might be able to help get some of them to you.

Regards.
B-Boy
02-09-2002, 08:45 PM
yeah, and also no icedump yet for DS 2.5/2.6 (at least those builts i have [of course!] aren't supported :( )

bye
B-Boy
evaluator
02-10-2002, 04:50 AM
OPS!
I stopped DLDing "aviable" DrvStudio v2.5,
because WICE version is 4.25b240.
AND ICEDUMP plugin is aviable for these WICE verss:
4.05.334
4.05.526
4.21.53
4.25.824
4.26.922

JMI! So we need WICE for these verss! What vers you have!?

-----------------------
i pozt only GREAT info!
JMI
02-10-2002, 06:08 AM
Evaluator:

Don't be fooled by the version number. Back in December +Splaj did a post about hiding DriverStudio 2.5 on NT machines and reported there was some confusion about the proper number for the version. Part of that thread (you will find it if you do a search for "IceDump") included this comment:

and anyway what fuxin build is it ? SI :- DS2.5.0 ( b240 ) or properties :- 4.2.5 (Build 824) duh ???

I believe this means that the DriverStudio 2.5 WICE actually is 4.2.5.824 and that IceDump 6.024 will work. I believe that the 6.025 will work with the releases of DriverStudio 2.6 and that the version in there will identify as "922" in the "properties" window. Still haven't had time to install it yet. It's 3:00a.m. where I am and I need some sleep. Check back later, but I recomment that you install what you have and try IceDump 6.024. It should work.

regards.
evaluator
02-10-2002, 06:35 AM
WICE 4.25.240 successfully runs with 4.05.334 LOADER32.
But I failed for load any ICEDUMP..

------------
I try only CRAZY things!
JMI
02-10-2002, 11:11 PM
Evaluator:

After playing with both DriverStudio 2.5 and 2.6 and not getting IceDump to load either I noticed something that I hadn't noticed before. When the DOS window loads and starts to run IceDump it appears to be identifying with the version of the "Loader," not the version of SICE. I'm not sure this is true, but it is what is written at the top of the DOS window. Having said that I still don't know why the version numbers don't match.

For example the Loader32 for DriverStudion 2.6 which I have says that it's version number is "336," which is a hell of a long way from "922." However, the "siremote" loader says its version is "922." I don't know if this means that at some point they updated the Loader32 for 2.6 or what.

Maybe someone else out there can answer this question and why is the version of the "FINAL" DriverStudio 2.5 Loader32 "240" when IceDump says its looking for "824"??? And does the Loader, itself, have to be running, or just SICE???

I didn't have these problems with SICE 4.05. I booted SICE from a menu at start-up and ran the IceDump version and it worked.

Regards.
evaluator
02-11-2002, 02:58 AM
So, JMI, what version WICE is included in your DS 2.6?
JMI
02-11-2002, 03:05 AM
As I said in my previous post, Ver 2.6 WICE and Loader32 are 2.6.0.336 and the "siremote loader" is version 2.6.0.922. I still don't know why.

Regards.
evaluator
02-11-2002, 05:03 PM
Run 2.6 WICE, in DBG window tape:
ver
and tell me what sad WICE
JMI
02-11-2002, 09:41 PM
Typing "VER" in WICE from DriverStudio 2.6 gives the listing as Softice 2.6.0 (build 336) as I said. The loader is also version "336" and the "siremote" is version "922".

Regards.


RV "little" bug
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RV "little" bug
PDA

View Full Version : RV "little" bug

evaluator
02-10-2002, 05:49 AM
Hello, RV userz32!

In this thread I will try help newbies how correct RV "little" bug.
Problem is here:
Sometimes (& very often) compilers in IT puts 2 or more entries for
same DLL. For example here in DS_IT we have 3 KERNEL, 2 USER entries.
And in this case RV has not problem, because between same DLL entries
are another DLL entries.
So bug appears, when there is no another DLL between same DLL-entries.
Lets explore DS_IT:

...
516 001559F0 SHELL32.dll DragAcceptFiles

><here at RVA 1559F4 is 00000000. This means END of SHELL32 IT_thunks block.
> But then again starts second SHELL32 IT_thunks block

517 001559F8 SHELL32.dll SHGetSpecialFolderLocation
...

525 00155A1C comdlg32.dll GetOpenFileNameA

><here at RVA 155A20 is 00000000. This means END of COMDLG32 IT_thunks block.
> But then again starts second COMDLG32 IT_thunks block

526 00155A24 comdlg32.dll GetSaveFileNameA

If you will look in original-packed DS_IT at 85588hex, you can find:
2 "shell32.dll" and 2 "comdlg32.dll"!

So what does wrong RV? RV wipes this 00000000 and joins 2 in 1. So we have wrong IT!

What we can DO?
1. wait for RV update :(
2. or use my easy method.
MY METHOD:
I simple duplicate previous entry, but of course change RVA!
516 001559F0 SHELL32.dll DragAcceptFiles
516 001559F4 SHELL32.dll DragAcceptFiles <inserted-duplicated
___________^ RVA for 00000000

ASLO, when I fetch IAT, size is -10h. Enlarge guys...
evaluator
02-10-2002, 06:09 AM
compare
crUsAdEr
02-10-2002, 02:40 PM
I see now, thanx a lot evaluator :>

Hmm, does that mean we have to manually look through each of our IAT entry to make sure that they are continuous? Ah well, it's better than manually putting in every single entry anyway :>....
tsehp
02-11-2002, 07:17 PM
I remember adding this test to avoid such gaps into the listing.

I don't understand what kind of problems does this makes because those 0 entries are unused ? Is there some tests in the code to check if they are present ? Or a check to see if thunk still contains two modules because of this 0 between the same collection of dll.

Anyway, if you want I can correct this fast, someone mails me this app's url and I'll correct the bug.

regards,

tsehp
LaptoniC
02-11-2002, 11:29 PM
I have said this bug earlier in TOT forum with example program.Revirgin bug (http://www.woodmann.net/forum/showthread.php?s=&threadid=2508)
evaluator
02-12-2002, 02:30 AM
Tsehp, you can easy solve this problem in this
lamer way:
RV will check distance between previous and
next thunk (in RESOLVED.TXT) and IF > 4h,
then will create new entry for same DLL in IT.

-----------
From series:
~EASY-PEASY SUGGESTIONS~
crUsAdEr
02-12-2002, 04:15 AM
Hi Tseph,

may I also suggest that you allow user to load resolved without the protected program running so I dont have to run the program everytime i load my saved resolved imports...

Thanx
tsehp
02-12-2002, 04:18 AM
rv needs the program to run to scan/trace it's own process memory and resolve the iat ;) so it can't work without the target being launched.

laptonic:thanks but this is not the target evaluator talked about.

evaluator : I can't resolve this in a lamer way, this method could maybe make appear more serious problems with apps, I must stick to the legal/normal way to rebuild an it,
so give me the url of ds please, I don't know what this prog is.

At the first version, rv was making two different modules, but this was causing bugs for isolated modules with only one iat without separation with a 0, cause there are two ways to code it_thunks , the m$ way and borland way.

Anyway this is a small bug pretty easy to resolve, but I have to work on the program that eveluator talked about, so URL please !
crUsAdEr
02-12-2002, 06:01 AM
Here is the url to Digi Secret 1.1

hxxp://www.tamofiles.com/ds1.zip

Yep, hope this will do... anyway, thanx for a great tool :>
evaluator
02-12-2002, 10:09 AM
Tsehp!

Problem happens because RV _WIPES_ this 00000000 and puts
HERE next thunk, so all next thunks are moved from their
original locations and we have incorrect IAT. Is now clear?
So RV must NOT wipe this 00000000 &-SO add new descriptor
in IT for same DLL.
LaptoniC
02-13-2002, 08:45 AM
laptonic:thanks but this is not the target evaluator talked about.

if you try to rebuild iat in win98 with revirgin you will see one shell32.dll entry with one null entry like evaluator said.If you try to rebuild with Imprec you will see two shell32.dll which is correct.But anyway
tsehp
02-13-2002, 04:37 PM
got it, it's sad to get older don't you think.

I downloaded the target and made a correction to the bug.
Evaluator , please do as we actually act to make the rv pre test and report me on this new version using your test targets, report on the usual place.

Everyone else will soon have the new version at the main page.

thanks,

tsehp


softice with windows xp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice with windows xp
PDA

View Full Version : softice with windows xp

skyman
02-10-2002, 11:01 AM
can some on help me to get softice working with windows xp pro.
is there a patch or any other way
cheers skyman
Morin
02-10-2002, 01:15 PM
If you look around you can probably find a number of other threads with this very same question. Unfortunatly for the most part it seems that in many cases there really is no answer. Some get it working no problem, others seem to have trouble.

DriverStudio 2.6 is supposed to be supported under XP and there have been a number of people who have gotten it to work. Whats the problem your having? Video issues, mouse, bpx's, etc...

In my case I have it up and running but for some reason it cant find certain symbols, for instance I can set a breakpoint on MessageBox or GetDlgItemText but not CreateDialog or DialogBox. The symbol loader tells me that SoftICE is not running, when in fact it is. I have yet to see an answer to this problems.

Describe your problem a bit, maybe we can help out...
Zero
02-14-2002, 02:56 AM
There is a patch for 4.05 at
h**p://www.anticrack.de/download.php?op=viewdownloaddetails&lid=3527

I have not tryed it and I don´t know if it works, but maybe it helps...

Zero
moogman
02-17-2002, 08:13 PM
I've tried the patches and they dont work properly. SoftIce does work, but it randomly reboots both my main computer and my laptop, so no sucess :(
DriverStudio 2.6 and DriverSuite 2.6 (I think thats the name) both work with XP according to numega, but at $1300 theres no hope of me getting it. Heh, and i've tried *acquiring* one of them also, but to no avail at present.

Hope this helps
-moog
Roy
02-24-2002, 08:48 AM
that patch at www.anticrack.de is driverstudio 2.5 so dont work on xp
DakienDX
02-26-2002, 11:08 AM
Hello everybody !

I had to delete the last five posts of this thread, because they where all links to warez.

One more time, and maybe the last time before taking radical action, this is NO board to ASK FOR or PUBLISH WAREZ.

This is dedicated to the people who posted this stuff here (they know they're meant) and all others thinking the same way: READ THE FAQ (http://www.woodmann.net/fravia/rce-faq.htm).
BeHereNow
04-14-2002, 09:59 PM
The patch is for si from studio V.2.5 which is also ntsi4.05 as a stand alone s.ware
The patch contains 2 files that replace 2 files in c:\windo...\system32\drivers.
It works fine but if you follow a direct tut based an older version of si you'll find out that they don't work(because the command needed is different for that version)
look the manual up for the commands that works in your version.
ex: BPR will give you an error message but BPM [address]>[address+(L)] will work instead of BPR.
Hope this helps.
my first post here :)
you guys are amazing how you help out others(newbies). Thanks to all.


DS 2.5 and XP probs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DS 2.5 and XP probs
PDA

View Full Version : DS 2.5 and XP probs

CirKutz
02-12-2002, 01:08 AM
I downloaded DS2.5 and installed it on WinXP Pro. I have it setup to manually start Softice. Problem is as it goes through the boot, SI seems to crash as it pops up its window. It normally does it around after activating the USB controllers. I have a USB keyboard connected through a PS/2 Convertor and a plain USB mouse.

I had the patch for 4.05 and it managed to start SI but pressing CTL-D wouldnot work straight away and it would not set any BPs.

Anyone have any idea whats going on and how to fix it.


SentinelLM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SentinelLM
PDA

View Full Version : SentinelLM

adg
02-12-2002, 03:41 AM
I am currently working thro' SentinelLM and have reached the point where I have to set break-points in WlscGen.exe. The version of SentinelLM I have is 7.1.1, the tutorials I am referring to is 7.1.0. Following the logic and applying the relevant sig in IDA and then preparing and converting a MAP file for S/ICE I have come up against a wall.

Firstly the SYM file does not seem to work (I know I have the correct technique since I have done this for my target to get the vendor code) when I try to set BPX _gengetvendorcode the address is not recognised. When the relevant sigs are applied in IDA they do appear and they seem reasonable when I refer back to the tutorials.

Secondly, trying to set the breakpoint on an address instead of the name doesn't work either, so I have wasted quite a few licences on the dongle!!

Checking filemon output during a run of wlscgen shows that Sentinel.vxd is accessed all the time which makes me wonder :-|

Does anyone know if there was a BIG security upgrade between 7.1.0 and 7.1.1 that would stop IDA/Softice partnership from working?

If so do you have any insight into how this could be beaten yet?

Thanks in advance

ADG
nblender
02-12-2002, 06:19 PM
I think there may have been some rudimentary anti-debug stuff in some versions of the program- you shouldn't even need the
dongle to do cracking on it, but it may help.

Try BPM instead.
adg
02-13-2002, 03:51 AM
Thanks nblender,

I have done a little more digging and it seems that _gengetNBVendorcode is not openly referenced.

The MAP file I created did work, I checked on sprodecrement, to avoid losing any more licenses, and Softice broke in as required :-)

I'm not sure if this is right but I tried, instead of breaking on _gengetNBVendorcode, patching mov edi, (vendorcode) into the end of _gengetNBVendorcode but this didn't cause any changes to the license generated. I did a run before and after and the licenses are identical. HMMM

While I was tracing things through the other night I noticed that WlscGen spent most of its time referencing into acpi.sys and vmm32.sys (I think) during the generation stage rather than in the _genxxx routines as I expected, maybe this is the anti debug stuff?

I'm going to follow up a thought I just had about lscgen.exe. Maybe this will have less baggage and outside references since it is all command line stuff!

I solved the dongle decrement problem (temporarily) while I try to find the right place to insert the new vendor code..... bpx on sprodecrement and whip the dongle out! The generation routine continues but then fails right at the end when, I presume, the final dongle access is made to seal the deal.

Maybe I can turn sprodecrement into an increment ho ho!

regards

ADG
adg
02-14-2002, 05:12 AM
Tried out lscgen.exe idea and this does generally the same as WlscGen.exe :-(

I'm beginning to think that _gengetNBVendorcode is not actually used in 7.1.1.

Tried bpx on _computevendorcode and changing the result in EAX to the vendorcode I'm looking at but no joy again.

I must look at cracking the dongle requirement or stopping sprodecrement, the dongle is beginning to look a bit short on licenses! Any ideas on this front? Would it be a case of patching the "dongle writing" routine so that it doesn't write to the cell but returns LS_Success?

I tried running the target, with MY generated license, and breaking out on _computevendorcode and changing the EAX result to MY vendorcode and got a different error message! Perhaps a dirty fix would be to patch the target at _computevendorcode and replace EAX with my vendorcode! but that accepts defeat in the eyes of the Sentinel!!

nblender.... I tried "bpm _gengetNBVendorcode" but it broke only in WINICE and nowhere else, did i do something wrong?

If anyone wants to look at this version of WlscGen.exe call out and I will upload!

Cheers

ADG
adg
02-14-2002, 07:21 AM
Thought I'd let you know my little success with WlscGen.exe

Managed to stop the sprodecrement function from working!

I put a little patch right at the start of the function which simply put LS_SUCCESS into EAX and returned the function (retn 0Ch)

No more Decrements!

This means that you should be able to generate a totally unlocked license because sprodecrement only decrements by one license per hit (unlocked license costs 250 licences!!! :-0) but the dongle cell is checked along the way so if it doesn't hit 0 then it will keep going until the cows come home!!

Now for some real cracking!

Cheers

ADG
kade
02-21-2002, 02:21 PM
I had the same problem with Wlscgen.exe yesterday. It is some kind of anti-debugging technique. I don't have time at the moment to discover how they did it (ida shows a lot of nop's and a lot of int 3's - also there is a sti call which I believe is used when you protect the software with a dongle), but I found out how to defeat it. This is what you need to do :

Step 1 : Before loading Wlscgen.exe you have to set up a breakpoint to Getversion. Softice will certainly popup when you load Wlscgen.exe.

Step 2 : When softice pops up you do "bc *" and "bpx #0041f0c0". We use "bc *" here because Getversion is called alot in Wlscgen.exe and softice would thereby pop up too many times.

Step 3 : press F5 and generate the license, softice will pop up at the desired breakpoint.

I hope this also works for you. Let me know if you know what technique they used.

Good luck
adg
02-22-2002, 04:05 AM
kade,

Thanks for that pointer! I shall give it a go tonight and let you know the results!

cheers

ADG
adg
02-26-2002, 08:35 AM
Well, I tried the above test but with no success, even substituting the right address (kade's address I think is for 7.1.0) and doing the necessary.

I did some more thinking and surfing over the past few days and decided to try to find out what scheme Rainbow are using for anti-Softice. I used FrogsIce to try to intercept the hook and it appears that the int03's are a read herring and the real detection is by a call to VMM's 'Test_Debug_Installed'.

SO..... the obvious question here is how do I defeat this detection method? Does FrogsIce cope with this method or does it just flag it up in the log?

I tried hooking the call using "Hook DrX" but I seem to be having problems with Win98 crashing on me! I wil continue to work on this but any suggestions would be gratefully received!

BTW.... I seem to be having a few problems with IDA not decompiling correctly, it seems to decompile most of the WLSCGEN.exe but not all of it and some FLIRT sigs don't attach. I know it has worked on WlscGen.exe before but now it's playing up. Has anyone else seen this, or is my system getting frazzled causing IDA grief in the process?

Cheer

ADG
MTB
02-26-2002, 09:14 AM
Hiya

I had a similar problem with a target. Believe it or not try W32dasm, it worked on my stuff. Now the other thing to try is the LATEST version of IDA Pro 4.17 vs the older 4.04, the 17 version got by the anti IDA stuff with ease. Still had to run overnight, and it applied the correct signatures.

MTB:D
adg
03-01-2002, 02:12 PM
Beginning to get a little cheesed off here!

I have run Wlscgen.exe to death but I still can't isolate (bpx or bpm ) _gengetnbvendorcode.

I installed and used FrogsICE to try to find where the anti-softice was embedded in the app but until now it hasn't trapped anything. I have tried trapping the debug register check but it hasn't found this type of protection! I have tried the Int03 trap with no luck either! I'm beginning to think that there is no protection and that _gengetNBVendorcode is not used at all in 7.1.1 (can't be !!)

Beginning to think it might be easier to strip SentinelLM references out of the target! :-0

Any Ideas how I might break on the call to a dll?

I have looked at an essay written about VxD protection where CreateFileA and something else (I can't quite remember right now) were used to detect the call to the VxD in question! would the same idea apply? or do I need to use something more elaborate?

I know the name of the dll that does all the SentinelLM calls but this is NOT referenced in the imports table in my IDA listing of the target. Hmm is this a relocation? or is the call being asked indirectly of another dll like Kernel or VMM?

Any pointers would help break the gloom lying over my head at present!!

cheers

ADG
moZfet
04-17-2002, 07:09 PM
Heya ADG,

I invite u to read your personnal messages :)

Regards, moZ


Softice crashes Computer before os can start
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice crashes Computer before os can start
PDA

View Full Version : Softice crashes Computer before os can start

Falcor
02-12-2002, 06:17 PM
hi!!!!

info:
os: win98se
softice version:4.05

I have installed Softice and restarted my pc
softice was loaded but then I saw the message

"Beim Initialisieren des Gerätes Sice
(hier stehen so komische zeichen)
Weiter mit beliebiger Taste "

I try to translate it

"During initialisation of the toll Sice
(here you can see some bizarr chars)
Continue with any button "

5 seconds after this message the computer crashes
(before windows is loaded)
...

when I remove softice in the "autoexec.bat" windows loads normally (but softice not ;-) )

I have installed softice several times
and I have checked that the downloaded file > it isnt corrupt

so thats not the problem

PLZ help me Ive no idea what to do

I have tried another programm that hasnt to be started at the same time like the os >>>h**p://www.crackthis.here.de/
but when I start the trw2000.exe the system crashes down, too!

HELP
me8
02-15-2002, 05:19 AM
you've got some evil software, protecting you from launching debugies... :-) hell, you are controled by software muhahaha :-))
Falcor
02-15-2002, 03:12 PM
Thx for ya great help...

h**p://www.deathclock.com :D
Woodmann
02-15-2002, 05:38 PM
Howdy,
Have you tried our nifty search function?

Peace, Woodmann
Falcor
02-15-2002, 09:26 PM
yes I m sure I did

so?

I know there are several reasons why it could crash but...

I ve RTFM

so...
me8
02-17-2002, 11:04 AM
once i had %subj% app....it have been loading some "display1.vxd" ? and my w98se crashed just perfect :-) have no solution for this :-(


VBOX 4.30 Probz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VBOX 4.30 Probz
PDA

View Full Version : VBOX 4.30 Probz

DGR
02-13-2002, 06:20 AM
Hi,

I'm trying to unpack a vbox4.30 wrapped prog (NTI CD Maker v5.1.9) but I am totally not succesful. The tutorials don't correspond... THe GetProcAddress is called from within shell32 and I never return to regions even coming near to the ones in the tuts. In the end I suddenly return to the program/preview code (416E08) and another F12 completely fires up the program. The only code I see in the meanwhile is from shell32. Even the standard tools (ByeVbox and The UCF unpacker) are unsuccesful. Does ne1 have a clue what might be wrong? I have neither found any sign of anti softice code... it runs just fine with softice loaded and all. Totally blank here :/

Tia.
DakienDX
02-13-2002, 12:33 PM
Hello DGR !

The problem with this application is that it the debugger check was disabled during protection. So there is never an INT 03h executed to check if a debugger is present and therefore the tutorials and the automatic unpackers don't work.

I'll take a look at it this evening. It shouldn't be too hard to find an other breakpoint to set.
DakienDX
02-13-2002, 01:13 PM
Hello DGR !

It seems the program is not protected by VBox itself. It uses a VBox-like encryption like the one found in VBoxBuilder.exe (4.3). It only encrypts, but does not limit the execution or display nag screens.

This application uses the VBox API. (I don't know if such a thing exists, but I would call it this way) It imports some functions from VBOXS430.DLL. You should first unpack the program. It isn't difficult, here's a clue: OEP=0047D300h

It says "Could not verify license file" and quits when unpacked, but it should be easier to analyse it this way.
DakienDX
02-13-2002, 01:58 PM
Hello DGR !

The whole thing ends up in a single Call xxx; Test EAX, EAX; Je BadBoy. So you need only to NOP out the procedure called before the check and patch the conditional jump.
DGR
02-14-2002, 06:44 PM
Hi there Dakien, first of all thanks for your help... I tried unpacking the proggie aswell before I posted here but it didn't seem to work (even tho the OEP u mention looks hella familiar). Perhaps I made a few stupid and simple booboo's (not totally impossible with me hehe), I did find the check in softice and indeed... passing it is simple as hell. It was just the vbox part (or appearantly the lack of the real vbox) which made me stumble.

I will be looking at it tomorrow again, now is sleepy time ;)

Thanks again and take care,

D.


icedump question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump question
PDA

View Full Version : icedump question

^DAEMON^
02-13-2002, 06:29 AM
hi ho,

iam currently busy with icedump improvements, maybe one of you could help me... i need a way to let sice pop up!

but i don't know if i should do that via int0e (like bpr works),
maybe someone of you could show me another way how to do that!
(please NO int1 or int3!)

^DAEMON^ :D

thx in advance!
death
02-13-2002, 07:15 AM
I might be wrong but I think you can use the BoundsChecker interface.
^DAEMON^
02-14-2002, 01:18 AM
hmmmm sorry, but how does Boundschecker let Sice popup???

via DevIOWLDRBreak ???

^DAEMON^
Kayaker
02-14-2002, 02:55 AM
Hi

The problem with the Boundschecker BCHK interface is that it uses INT 3. I suppose you could use it with the AL=15h service - Set BPM breakpoint, if you can figure out how to fill the breakpoint table with the right info. I've used it with the AL=0Eh service - Execute a SoftICE command, successfully except that with Icedump this trick crashes on the INT 3.

nmtrans.dll DevIO_SetWLDRBreak, as demonstrated in IceLoad (and is how Softice "tells" its vxd you want to break at the program start) will get you to break at WinMain (or DllMain as IceLoad also does), but there's other ways to do this if this is what you want. And that's the question ^DAEMON^, what is it you're trying to do? You're trying to improve Icedump. OK, let's say you want to popup SI on access to - something - say a VMMCall that isn't supported or a read/write to some memory area. Icedump already does that pretty well with detecting accesses to the IDT, LDT and GDT by as you said, hooking INT 0E page faults.

That's probably the way to go I guess. Hook what it is you're trying to hook, create a page fault and let SI handle it. Use VMMCall _Trace_Out_Service as Icedump does to pass info about the access attempt to the user. This doc on Softice Fault Trapping might help if you haven't seen it:
http://www.spiralspace.com/programming/UsingSoftICE/si_page_fault.asp

Just an idea anyway. Don't discount creating an INT 1 in your own code, or in a targets address space though. This is how I popup SI in my loader with I1HERE ON, or break at WinMain, and it works quite well.

Kayaker
^DAEMON^
02-14-2002, 06:19 AM
hi kaya

i've added an command to it called:

/HOOK [DLLname] [APIname] [g|i] (global or via import table)

the problems is just that i want to pop up softice when the hook
is getting reached! i don't want to use int1 or int3 as those may mess up any data (for example k.kryptor)
so i need a clean way to let it pop up!

i also took a look @ cmd_trace and cmd_breakr3 yesterday but they also use so like int3

thx for the link, i'll take a look @ this stuff
^DAEMON^
Kilby
02-14-2002, 06:46 AM
Off the top of my head, the page fault indeed looks like a natural candidate.

Though so far int 3 mostly serves my needs, and my page faults are seldom deliberate :)

At the mention of icedump updates, I see the /pedump command needs updated as the current version of securom causes it to lockup (well 1 115 Meg data section is a little large I suppose).

Regards,

Kilby...


Cool Edit Pro Demo?? or Cool Edit???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cool Edit Pro Demo?? or Cool Edit???
PDA

View Full Version : Cool Edit Pro Demo?? or Cool Edit???

crUsAdEr
02-13-2002, 09:25 AM
Hi,

I am starting on trying to enable menu function as the next step :>.. read af ew tutorials and tried Cool Edit Pro as my target... I have found a few things interesting...

The website stated that the full version has to be ordered from CD but looking at the source code, I have found numerous string "Registered to :", "You have the full license etc.."

Also, I tried to patch the nag, there were a CRC nag... i tested various patch in memory with SoftIce and guess what, Suddenly Cool Edit (not Pro) pops up ask me to select which function i wish to enable for my trial :>... however, i couldnt find where i patched it to make it become a normal version again :<.. results of messy patching...

I looked closer into the source code and suspect that all 3 version, Cool Edit, Pro Demo and Pro Reg are in there.. i found this function
Export : _regForm with lots of NOPs
RegisterMsgProc : which has full source code seems to display the registration form and get the registration key etc.. but there is no reference for it...

This looks like a nice target for trying i guess, but could some1 drops me a hint on how to continue as I am kinda stuck there... the menu function that i enabled somehow is not there anymore which makes me uncertain... has any1 tried reversing it yet?

Thanx
crUsAdEr
02-13-2002, 10:17 PM
ARGHHHH...

I am still unable to find the stupid CRC check... bpm on the changed byte doesnt break... tracing brings me to DialogBoxParam and the Dialog close automatically if the file is patched :<... tracing the handle proc of that dialog gave the same route with both patched and unpatched proggies..

Is there any other way of finding the crc? I read Predator's essay he used "bpx _lopen" but din explain how it works... I tried with no luck... could some1 throw me some light?

Thanx,

P.S : Clandestiny, i understand that u did this prog some times ago, have u bypassed the crc check yet? If yes, could u drop a hint ?
Samneric
02-14-2002, 01:54 PM
Originally posted by binh81
Is there any other way of finding the crc? I read Predator's essay he used "bpx _lopen" but din explain how it works... I tried with no luck... could some1 throw me some light?

The program opens it's executable file via _lopen. It then generates its checksum via _lread's of the file within a checksum loop, followed by _lclose when it's done.

The relevant _lopen in CoolEdit is after a call to GetModuleFileNameA.
crUsAdEr
02-14-2002, 03:57 PM
Yeah.. found it alredi.. but thanx anyway :>


Softice Break Points
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Break Points
PDA

View Full Version : Softice Break Points

adg
02-14-2002, 08:17 AM
I'm trying to set a breakpoint in Softice and I'm not sure if it is possible. What I am trying to do is break when the register EAX receives a specific value. ie BPM (when) EAX=xyz

Having looked through the documentation I can see that you can set a watch on EAX so show its contents but the BPM breakpoint description doesn't lead me to believe that I can do it.

Is is possible to string BPM and WATCH together in a single command? Or is there a really obvious way to do this that I have missed? ;-{

Thanks in advance

ADG
death
02-14-2002, 08:23 AM
Maybe you mean BPX CS:EIP IF EAX==<value>
DakienDX
02-14-2002, 11:12 AM
Hello adg !

If you really searched the SoftICE manual, you should have found this.

BPM[size] address [verb] [debug-reg] [IF expression] [DO "command1;command2;..."]

It will show you what expression and command are, too.
adg
02-15-2002, 02:58 PM
Thanks for the pointers!

ADG


WinSniffer 1.3 [ASPACK???]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > WinSniffer 1.3 [ASPACK???]
PDA

View Full Version : WinSniffer 1.3 [ASPACK???]

foxthree
02-14-2002, 02:33 PM
Hello:

I'm pretty new to the cracking scene and here is some of my analysis on a product called WinSniffer (winsniffer.com). Current Version is 1.3

I *think* it is ASPACKed (though no clue as to the version and such) [ How: Run WinHEX and search the memory for ASPACK String and lo there it is]

I'm trying to unpack this and am 95% successful (almost !)

Here is what I've done:

1. Loaded the target under revirgin (thanks, tsehp) and traced and found the OEP: [004104FF, am i right btw?]

2. Dumped the target at this location using procdump [is this correct way of doing things or should i use icedump]

3. Using Revirgin complete rebuilt the IAT. <--- ROCKS!!!

4. 2-3 IAT entries were not finding so I did trace and found them all.

5. Created a section and patched the generated IT.bin into this. So now I have a completely IAT re-built WSMDI.exe

6. Reset the OEP using the PEditor tool.

:(

However, when I run this app, it crashes stating that 0x77fc97a0 referenced memory at 03f3df08 (inside ntdll.dll) I'm stumped as to why this has to happen. I followed Predator's tutorials to the word and I think I'm almost close to completely unpacking this program.

Any clues/insights as to what is happening will greatly help me. I'm attaching the revirgin generated IAT.txt file for analysis

Thanks to all the good "gurus" here in advance,
SpeKKeL
02-15-2002, 05:14 AM
Hajo,

Yep aspr-protected..( not protected with latest aspr !)
Okee your oep=correct ,4104ff

First look at eax around 415240 after getmodulefilename , hardcode the number in your dumped.exe in someway or bypass.
Again on the call at 4105b6.

Didn't compare whole your resolved.txt file but the 2 api-calls on
0003B348 and 0003B34C aren't correcti think.Just replace by:

0003B348 017FC968 002F KERNEL32.dll
0003B34C 017FC960 002F KERNEL32.dll

After this all should work...

:D

SpeKK
sv
02-15-2002, 06:13 AM
Hi

I have rebuild IT and found:

0003B348 KERNEL32.dll LockResource
0003B34C KERNEL32.dll GetCommandLineA

Include IT

Regards
SpeKKeL
02-15-2002, 07:17 AM
Yep that's better !!

overlooked >>0003B34C KERNEL32.dll GetCommandLineA !
Now you don't have to correct the addresses i mentioned

Set bpx getversion when prog is loaded in si and see the api's are stored in memory (1803640 for getcommandlinea)

SpeKK:cool:
foxthree
02-16-2002, 12:31 PM
Hi SV/Spek:

Thanks for all your tip. Yep, I got it right this time and every thing seemed so cozy. Until I ran the executable. Just nothing! Absolutely nothing. I tried to debug it into softice but it wouldn't even execute 1 single instruction.

What's happening here? Any ideas. I tried to put INT 3 in the OEiP, still nothing, just hourglass and nothing!

Any ideas would greatly help clear my ignorance.

BTW, my unpacked executable is around 2.3 Megs. Is that what you guys have got too?

(My IAT is not EXACTLY same as you guys, if it helps)

Thanks
SpeKKeL
02-16-2002, 01:12 PM
TRy find out why your iat is different...,
Try s.v's resolved iat in your dumped.exe (should work)
Yep dumping will give 2.3 mb but realigning the file will reduce it
to 500k.

SpeKK
foxthree
02-18-2002, 02:00 PM
Hi Spek:

Thanks for all your help. But I'm still not able to make this work. However, I aplogize for a small mistake that i'd made in my previous post. Actually, my IAT rebuilt is exactly the same (I typed as NOT). Sorry!

I'm attaching my IAT (rebuilt) .txt file. Just see if everything is fine. I'm rebuilding on Windows 2000 BTW. Is this a problem? Also, when I try to run this application, (after final rebuilding the 2MB one), it just fails to load NTDLL.dll by giving some page fault error. That is why my app is not running I guess.

Also, what version of ASProtect is used to secure this application? How do i find this? Is there any tool?

Thanks once again for all your help and time. I really appreciate it.

Regards
FoxThree
SpeKKeL
02-18-2002, 03:26 PM
Strange ,

Yep just a little difference in iat at 3B178 (check out) , but i don't
think here lies your problem.(i paste you resolved.txt in my dumped and it ran without probs)

Try make a new dump.
(make sure you don't have any breakpoint set at dumping)

You can make them in several ways try this:
Icedump from the oep /pedump 400000 104ff dumped.exe
And now use r.v. to rebuild.
or
Trace till the oep> put a jmp eip at the oep >use pe- editor/procdump to make a full dump.
Use hiew to correct the location 4104ff (jmp 4104ff )into push ebp :mov ebp,esp and now rebuild.
I use w98 but w 2000 should be no problem ??

Well don't know what version this is of aspr you can use some
file inspectors/analysers ....lot's to find on the web.

SpeKK

;)
foxthree
02-19-2002, 03:34 AM
Hi SpeK:

Thanks for your patience with me. I'll try whatever you've said and I'll get back to you.

Once again,
Thanks, man

Signed,
FoxThree
foxthree
02-19-2002, 07:53 AM
Hi SpeK:

I tried whatever you said. It still did not work. I'm jus' getting lost. When it seems to work fine for why wouldn't it for me. Infact, like you said the IAT differs in only one place. In fact, this time I chose your IAT.txt and rebuilt. Still the same problem. When I try to debug the re-built application using W32DASM I get this:

The first thing it tries to do is to load up NTDLL.DLL at 77F80000. Then imme. it throws up this error in a dialog:

The thread tried to read from or write to a virtual address for which it does not have access at EIP 77e878c1.

Any clues. Also, if you don't mind can you upload your rebuilt WSMDI.exe so that I can try to run that here and see if that works?

Also I think the dump I get is just fine. I tried the same approach with a couple of other apps that are ASPROTECTED like CoolMouse without any problems:

The method I try is:

(1) Load Process into RV Tracer
(2) Wait till it breaks on OEiP (in our case RVA-104FF right?)
(3) Just switch to Pdump and dump the process (remove all the unnecessary options in PDump before doing this, right?)

Is this method ok? or is this a bug in RV?

Any other ideas/ suggestions? Is my Win2K a problem (it is without SP). What else? Man, I'm at the end of my wits here...

Thanks for all your patience,

FoxThree
crUsAdEr
02-19-2002, 07:26 PM
Yeah, i do think it's a bug with RV because i have both won 98 and win 2k running, RV gave me slightly different IAT for the same program and sometimes RV does not export IT.bin properly and automatically gave IT an adress of 2ABCFEAA or womething weird like that when i select auto fixed section...

I just keep trying and it works sometimes... maybe i am doing something wrong but i do find RV behaving weirdly sometimes... or maybe it's anti-RV trick by AsProtect, Alexey frequent crackers'boards often i heard....

The only full proof method i tried so far is use ImpRec to get the normal IAT without auto trace (because RV doesnt provide that option or else i would prefer RV personally) and then manually replace the rest of the IAT input, normally about 40ish of them.. it's a sure work way!!!

AsProtect is really a bitch really...
crUsAdEr
02-19-2002, 11:31 PM
Hi foxthree,

OK, i am not sure this help but try anyway... i was checking evaluator's post on deadlisting of IAT, i found that mine are quite different, evaluator : i am using win98se... but i notice the order are the same, as in the order of the offset and the Import...

There is one entry in winsniffer like this :
207 0003B348 017FC968 0000 ?????? ??????

try u 17fc968 will show u a proc with ret4 and below it another proc with ret4, compare the 2 proc they are slightly different... I tried putting this entry 207 as Free Resource and the prog quits silently... try with Lock Resource it runs...
Looking at the deadlisting by evaluator i found out that lock resource will normally come before Free Resource but i am not sure... digisecret and commview has the same pattern... maybe this is the problem for you?

Tseph, i found the bug in RV now, when i load saved resolved with RV, RV will not read the last import if it is the only import from another dll, like this case of winsniffer :
426 0003B6D8 7FF482A8 00D7 ole32.dll OleUninitialize
427 0003B6DC 7FF4F578 00C0 ole32.dll OleInitialize
428 0003B6E4 7FE54D20 0008 oledlg.dll OleUIBusyA
eof
RV will not load the last import from oledlg.dll unless i make it look like this
426 0003B6D8 7FF482A8 00D7 ole32.dll OleUninitialize
427 0003B6DC 7FF4F578 00C0 ole32.dll OleInitialize
428 0003B6E4 7FE54D20 0008 oledlg.dll OleUIBusyA
428 0003B6E4 7FE54D20 0008 oledlg.dll OleUIBusyA
Maybe that is why i get eratic results cos i tend to save then load stuff!!!

That is all for now, please correct me if i am wrong...
Thanx
Al Solodovnikov
02-20-2002, 02:58 AM
Originally posted by binh81
AsProtect is really a bitch really...

And it's just a biginning :) You'll forget about RV and ImpRec soon.

---
Alex VeryLongRussianSurname
foxthree
02-20-2002, 04:15 AM
Hi binh81:

Thanks for your tips. I tried every one of them. I concur with you: There are few bugs (like the weird RVA problem when pasting IAT) when I run on Win2K. I do not have a Win98SE at present where I can test whether my earlier built IAT would work.

I've tried whatever you've told but still no luck. Same old NTDLL.DLL problem. Ugh!

Also, I noticed a few things:

(*) In my rebuilt IAT there were 2 references to LockResource. Why? (ASprotect trick or RV bug)
(*) Why are the hint values in RV off by 1 i.e if in the hint value for an exported API in KERNEL32.dLL is say c5, in RV it comes as c6. Why? Is it OK? Any explanations (Tsehp?)

All I can say at the moment is that, by mistake, I chose a wrong ASPROTECTed target. I should've chosen something in the tuts tried and then came back to this. What really frustates me is that I still do not know what I've done wrong. Spek says it works fine for him in Win98 (with *my* rebuilt IAT)? So what gives in Win2K?

May be like Alexey has written above: Is it time to upgrade Revirgin?

With many more such questions in mind:

Signed,
-- FoxThree

PS: BTW, binh81 the bug about OLEDLG.DLL is very correct! I'm also able to reproduct it here!
me8
02-20-2002, 05:18 AM
hhh, i believe reversing gods are able to reverse anything in the world....ones protect, others deprotect, who wins :-))
Kilby
02-20-2002, 05:57 AM
Misrible Kilby says nobody wins !

However we have fun, and Alexy earns money.

So things arn't too bad.

Is it me or is everything wrapped by Asprotect written in Delphi ?

Kilby...
SpeKKeL
02-20-2002, 06:19 AM
Originally posted by Al Solodovnikov

And it's just a biginning :) You'll forget about RV and ImpRec soon.

---
Alex VeryLongRussianSurname

Haha, sweet dreams, you must be knowing..............!!

Btw foxtree check you pm.

SpeKK:D
crUsAdEr
02-20-2002, 04:35 PM
Foxthree, maybe you do something wrong when you paste IT into the dumped file, some how i can not download your IT.bin to compare so here is my win2k executable version...

Hope this help.. yeah u should try comview with Spl/\j's excellent tutorial... that throw my AsProtect fear away :>

damn.. teh file is too big...
foxthree
02-21-2002, 02:44 AM
Hi binh81:

Great news man! I don't know may be i'm doing something wrong. BTW, did u try zipping the file and then uploading that might help. I really dont' know where I'm missing I did exactly everyting by the book. Yes, I've gone through +Spl/\j's tut on CommView 3.1. However, where I get stumped is the place where he says "S EIP L FFFFFFFF 61,FF,E0". When I do this, I'm always getting Pattern not found. In many of his tuts he is followig this approach but no where has he mentioned from where should we issue this search command. That is pretty confusing and frustrating.

If poss, try upping the executable. I'll diff it and see where I'm wrong. Thanks a bunch, man

Signed,
FoxThree

PS: I've tried the same on Win2K SP2 with still the same results :-(
foxthree
02-21-2002, 06:31 AM
Hi Guys:

Finally I got it working on Win2K and it was neither RV bug, neither Alexey's coolness of ASProtect. It was DUMB bug in HexWorkshop 3.1. (As binh81 correctly pointed out, thank binh81).

See RV correctly resolved the IAT. But when I pasted the rebuilt IAT on the app, Hex Workshop would show as pasted but wouldn't really do it! DoH! All the while I was thinking that the IAT was correctly pasted.

So taking binh81's lead I tried another app, UltraEdit. lo! it works.

Pretty dumb of me heh! But finally, what matters is that I fixed it.

Take care fellow newbies: DO NOT USE HEX WORKSHOP for APPS MORE THAN 2 MB. [ you can test this by urself ]

My sincere thanks to SpeK, binh81, tsehp (U ROCK!!!) ...

My not so thanks to Alexey (for gloating and making it sound like some ASPROTECT trick! Alexey: IT IS NOT!!! RV ROCKS ;-))

Signed,
--FoxThree

PS: One good thing in this whole exercise was I learnt so much about ASProtect through so many quality tuts (hi +spl/\j) Alexey watch out <grin>
crUsAdEr
02-21-2002, 06:39 AM
U can run the app first, then use winhex to open its memory while it's running, then do a search for "61 ff e0' then you will find the occurence of it...

also you should read soloman's tip for finding OEP manually on win 2k, work great :>


Cryptography challenge ;)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Cryptography challenge ;)
PDA

View Full Version : Cryptography challenge ;)

stealthFIGHTER
02-14-2002, 08:58 PM
Little crypto. challenge [for kids]; follow the link:

http://www.olympics.com/sloc/beyond_sport/for_kids/cryptogram.html

... blah ;)

sF
Bengaly
02-15-2002, 07:01 PM
hi SF,

sulotion included in the attached file.
if something is wrong just let me noticed,
cya.
Bengaly
02-15-2002, 07:33 PM
hehe
damm edit button ;)
here is the file,
cya


Softice and IceDump Help Needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice and IceDump Help Needed
PDA

View Full Version : Softice and IceDump Help Needed

JMI
02-14-2002, 09:25 PM
In an attempt to help evaluator with IceDump problems I have noticed something strange and hope that someone out there can help with the confusion. The problem relates to attempting to get IceDump to work with DriverStudio 2.5 and/or 2.6.

IceDump version 6024 was released to be compatable with DriverStudio 2.5 but has VDX's for "version 4.25.824." However the version of DriverStudio 2.5 I have, which says that it is the "final" version, has Softice version 4.2.5 (Build 240) and IceDump does not recognize it.

When I installed DriverStudio 2.6 it tells me that it is version 4.2.6 (build 336) while IceDump release 6025 claims to be looking for version 4.2.6."922". Both these build numbers are way way off the versions that IceDump claims it is looking for, and none of them load.

I also noticed in the DOS window when IceDump is started that it actually says that it is looking for a particular version of the Softice "Loader." Does this mean that the Loader is the important "version" that determines whether it works or not?

I also noticed that in DriverStudio 2.6, both Softice and the Loader32 are version 4.2.6.336, while the "siremote" loader is actually 4. 2.6.922, the version number IceDump claims to be keyed to recognize.

Some time back +Splaj discussed D.S.2.5 hiding and reported some confusion between the "version" number and the "properties" identification of the Softice for NT that he was using, but apparently he got it to work with the NT version. I've noticed several threads in the TOT forum which describe problems with getting Icedump to work with D.S. 2.5 and 2.6. Has anyone gotten it to work on Win98SE? If so how???

Can anyone explain whether IceDump is actually looking at the version of Softice or the version of the Loader32 and why the "final" version of D.S. 2.5 would be nearly 500 versions less than what IceDump seems to be looking for. If I can't get it to work I can always go back to version 4.05, where these problems didn't exist, but I would like to understand what the hell is going on with these version numbers. Anybody with some information would be appreciated.

Regards.
B-Boy
02-18-2002, 04:47 PM
same here.. couldn't get icedump 6.025 working with DS 4.2.5 and 4.2.6 :(

bye
B-Boy


SMARTCHECK help is needed!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SMARTCHECK help is needed!
PDA

View Full Version : SMARTCHECK help is needed!

Polaris
02-16-2002, 01:24 PM
I am interested in loading SMARTCHECK's results of a running into IDA for enhancing the disassembly.
The problem is that I can't get directly on these results for convenient parsing and use. Smartcheck saves its result into .SCE files,whose format is unknown to me.
The sce_dump utility (which comes along with smartcheck) extracts only a part of the infos retrieved by the program, while the most interesting ones from a RCE point of view (address and module of the event) are not displayed.
I can reverse the sce_dump utility,but I prefer understand if there is an easy way out...


help with XOR
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help with XOR
PDA

View Full Version : help with XOR

The Keeper
02-17-2002, 03:58 AM
hello,

i've got a crackme in which the serial length is 16, the algo is as follow :

suppose i enter 1111222233334444 as serial, the program does :

31313131 ^ 32323232 = 3030303
33333333 ^ 3030303 = 30303030
34343434 ^ 30303030 = 4040404

^ = xor

then it compares 4040404h with 21730F1Eh
if differente serial is wrong else its right.

so i guess i need to "reverse" the xor ? how would i do that ?

any help is appreciated.
death
02-17-2002, 04:41 AM
ascii values of 1111 = a
ascii values of 2222 = b
ascii values of 3333 = c
ascii values of 4444 = d

e = a ^ b
f = c ^ e
y = d ^ f

y must be 21730F1Eh so:

d ^ (c ^ (a ^ b)) = 21730F1E

this is the same as:
a ^ b ^ c ^ d = 21730F1E

now you just generate printable ascii values for a/b/c/d so that when xored they produce 21730F1E
The Keeper
02-17-2002, 12:08 PM
Hello,

thanks for the reply but is it possible to do that without bruteforcing ? he said bruteforce isnt allowed.

thanks.
ZaiRoN
02-17-2002, 12:56 PM
hi,
you can do this fixing (opportunely) some values :)

bye,
ZaiRoN
The Keeper
02-17-2002, 07:15 PM
yo all

tried all day long with no luck :-/

would anyone mind helping me a little more ? i cant find a way, i tried factoring 21730F1E but the result can't fit XXXX YYYY ZZZZ WWWW

any help is appreciated :-/

if anyone find a way please post how.
JimmyClif
02-17-2002, 11:32 PM
31313131 ^ 32323232 = 3030303
33333333 ^ 3030303 = 30303030
34343434 ^ 30303030 = 4040404

Let's define this into redable unknowns:

a xor b == R1
c xor R1 == R2
d xor R2 == 21730F1Eh

As (theory ahead):

a xor b == c

and :

c xor b == a

We can assume that if we take:

a xor b == 21730F1Eh
c xor R1 == R2
c xor R2 == 21730F1Eh

Now our key has only 8 unknowns left:

???? ???? 0000 0000
(in Hex)
???? ???? 30303030 30303030

(It doesn't matter what number we choose for the last 8 digits as long as the last 4 are the same as the 4 before them.)

Ergo.. all we have to do is:
Find two numbers which if we xor them give exactly 21730F1Eh in readable ascii letters

a xor b == 21730F1Eh
21730F1Eh xor a == b

All you have to do is (imo) code a little bruteforce toy to unlock it.

Like :

.WHILE 1
mov eax, 21730F1Eh
inc ebx
xor eax,ebx
.IF eax==readable ascii && ebx == readable ascii
;Show me the money erm the values
.ENDIF
.ENDW

Hope this helps a bit. (and hope I didn't fsck up somewhere *g*)

JimmyClif
JimmyClif
02-18-2002, 12:14 AM
I couldn't resist and coded it quick and dirty

push ebx
xor ebx,ebx
.WHILE TRUE
inc ebx
mov eax,021730F1Eh
xor eax,ebx
mov LP1,eax
mov LP2,ebx
xor edx,edx
mov dx,ax
shr eax,16
.IF ((al>="0" && al<="9") || (al>="a" && al<="z") || (al>="A" && al<="Z")) && ((dl>="0" && dl<="9") || (dl>="a" && dl<="z") || (dl>="A" && dl<="Z"))
.IF ((ah>="0" && ah<="9") || (ah>="a" && ah<="z") || (ah>="A" && ah<="Z")) && ((dh>="0" && dh<="9") || (dh>="a" && dh<="z") || (dh>="A" && dh<="Z"))
;LP1 ==readable ascii
mov eax,LP2
xor edx,edx
mov dx,ax
shr eax,16
.IF ((al>="0" && al<="9") || (al>="a" && al<="z") || (al>="A" && al<="Z")) && ((dl>="0" && dl<="9") || (dl>="a" && dl<="z") || (dl>="A" && dl<="Z"))
.IF ((ah>="0" && ah<="9") || (ah>="a" && ah<="z") || (ah>="A" && ah<="Z")) && ((dh>="0" && dh<="9") || (dh>="a" && dh<="z") || (dh>="A" && dh<="Z"))
;LP2==readable ascii
PrintHex LP1
PrintHex LP2
nop
.break
.ENDIF
.ENDIF
.ENDIF
.ENDIF
.IF ebx==0FFFFFFFFh
PrintText "Nada"
.break
.ENDIF
.ENDW
pop ebx

PrintHex and PrintText are Debug Macros..
Gives me for:
LP1 : c C 9 Z
LP2 : B 0 6 D

(it's a 0 (zero) not an O (letter) )

I guess the code could be : cC9Z-B06D-7777-7777

If not... bah... throw the CrackMe into the Recycle Bin.. (I would do it :P )
The Keeper
02-18-2002, 12:40 AM
Hi jimmy, thanks for the help, still not valid and i still loking at it, if you wanna have a go check

www.geocities.com/boozeplace/serialme.zip

resitance is futile :D we gonna win
JimmyClif
02-18-2002, 12:57 AM
I did a little error switching the DWORDs around...

With my old code I gave you result was Invalid Serial.
cC9Z-B06D-7777-7777

Switching the values around.. to:
Z9Cc D60B 7777 7777

gives me a weird MessageBox...
JimmyClif
02-18-2002, 12:59 AM
Here's the Box:
JimmyClif
02-18-2002, 01:10 AM
Hey alright... My answer is correct! It takes the good jump. But to make it go to the right OFFSET try to figure out what this line means in your little proggy:

.text:004010D1 sub eax, 292D2D36h

I'm outta here ;)

; ----------------------- UPDATE --------------------------

Actually the sub eax,Nonsense is nonsense

He checks if the serial is correct doing a
xor edx,21tralalanumber
jnz @BadBoy
jmp [401031+edx]

Well, this will always be 401031 as edx is 0 after a succesfull xor

My opinion... There's a bug :(

; ----------------------- ENDOF UPDATE ------------------
The Keeper
02-19-2002, 10:29 PM
i've mailed the author after u posted the last msg and asked him to post here something but no answer from him until now.

well maybe he'll appear
mrcrackbrain
02-20-2002, 05:44 AM
It's no bug that it shows the "odd looking" msgbox.
It's just that there are several possible serials so that the "checksum" ends up to 21730F1Eh.

The rules said, no bruteforcing, if you bruteforce, you will get an odd looking msgbox. You could always of course bruteforce bit more far and get a good msgbox. But you should be able to manage without.

The thing is, read the readme once more. You can't reverse, if you don't know what the destination value should be. Read the readme file, and you'll know the destination value :)

I hope i didn't help too much, and i'm actually quite happy that this small serialme put up a nice discussion like this ;)
LaptoniC
02-20-2002, 09:30 AM
What we want is "serial accepted!" message if we write this message as series of dwords we will get
Set1
69726573 61206C61 70656363 21646574

program subs 292D2D36h from entered serial and xors with [edi-10h] if you look at this memory are you will see invalid serial.. if we represent as dwords we will get
Set2
61766E69 2064696Ch 69726573h 2E2E6C61h

What we shoould do is simple.Xor each element from set1 and set2 and add 292D2D36 to this result.lest calculate first 4 char of serial

69726573 ^ 61766E69 = 8040B1A
8040B1A+292D2D36=31313850 which is 118P as ascibut remember it is as dword correct order is P811

calculate in this way you will get

P811C2qjF3DBK6w8 as final serial :)
JimmyClif
02-20-2002, 11:46 AM
Sorry for misleading here...

I just like BruteForcing too much... :D
mrcrackbrain
02-20-2002, 12:12 PM
You got it Laptonic! :D
I hope this one teached someone something about reversing something ;)


For newbies: Import-Deadlisting for current ASsPR version.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > For newbies: Import-Deadlisting for current ASsPR version.
PDA

View Full Version : For newbies: Import-Deadlisting for current ASsPR version.

evaluator
02-18-2002, 03:27 AM
For newbies: Import-Deadlisting for current ASsPR version.

xxxxC574 GetProcAddress
xxxxC9B8 GetModuleHandleA
xxxxCA18 GetCommandLineA
xxxxCA28 LockResource
xxxxC9D4 GetVersion
xxxxCA0C GetCurrentProcessId
xxxxCA04 GetCurrentProcess
xxxxCA38 FreeResource

P.S.
It's time for update ASsPR..
VooDoo
02-18-2002, 06:02 AM
oh..thx :)

its time to update aspr ? I am even not able to unpack the current versions :(

c ya
VooDoo


W32DASM Max path length
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32DASM Max path length
PDA

View Full Version : W32DASM Max path length

redblkjck
02-18-2002, 03:50 PM
I was just wonrdering if anyone else has/had this problem.
I had several files that W32Dasm would not even try to decompile. Which was no big deal since there are other programs to use. But it did bother me why W32Dasm would not work. There was nothing wrong the exe. What I found out was that W32Dasm has a 80 chr$ max length value for the file you want to decompile. Since I am on Win2k box and the default path for some of my apps is 54 chr$ just to the dir. C:\Documents and Settings\Administrator\My Documents\ Not much room left for another folder and exe name before going over 80 chr$.

Jack
JimmyClif
02-18-2002, 04:24 PM
Well, you could reverse wdasm and enlarge the Buffer for the MaxPath....

Here's a little hint to get you started:

When you open a File it's been done with an:
GetOpenFileName API which needs the OPENFILENAME Structure.
Inside this structure there's the ofn.lpstrFile whichs needs a pointer to the Buffer which will hold the exact location of the exe which will get disassembled.

All you have to do is find this little bugger and make it point to a Buffer of your choice having at least 256 or 512 bytes space.

Make sure that you get every location of the ofn.lpstrFile reference and change it accordingly to your new Buffer and that would do it ;)

And - I almost forgot : There's also the ofn.nMaxFile which needs a number of the Max Chars for the FilePath, so if you find out that the Buffer is big enough to hold more all you need to change is the ofn.nMaxFile to a higher number.

If you decide to make ofn.lpstrFile point to a new Buffer don't forget to change the ofn.nMaxFile to a higher number too.

This is actually the most interesting part of reversing...

Have fun,
JimmyClif


bit commitment blues ;)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > bit commitment blues ;)
PDA

View Full Version : bit commitment blues ;)

mike
02-18-2002, 04:10 PM
You think I got zero knowledge,
But I know you done me wrong.
Just commit to me baby,
So's I can sing a happier song!
One bit of commitment,
That's all I really need,
So send me your hashed answer
And the random seed.

I got the bit commitment, bit commitment blues.
I got the (thump thump hmmm...) bit commitment blues.

I ain't oblivious, darlin',
And honey, I ain't blind.
Don't need sublim'nal channels
To read your cheatin' mind.
I'll share a secret with you:
I know you hand out a public key.
But why's it to the apartment
That you're sharin' with me?

I got the bit commitment, bit commitment blues.
I got the (thump thump hmmm...) bit commitment blues.

You say you love me, baby,
But you flirt with other guys.
You say you want me, honey,
But I see you wink your eye.
You say you need me, Alice,
Now forgive me if I sob;
You know my name is Charlie,
So quit hangin' out with Bob!

I got the bit commitment, bit commitment blues.
I got the (thump thump hmmm...) bit commitment blues.
goatass
02-19-2002, 09:20 AM
oohhh you didn't have to, thanks for the beautiful poem mike :)

j/k

very nice

goatass


PcGuard Unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PcGuard Unpacking
PDA

View Full Version : PcGuard Unpacking

h8er
02-18-2002, 05:38 PM
I need help to unpack this kind of protection... I think i found the OEP but the IAT is a problem.. (Target: Cpuc**l latest version (17/02/2002)
crUsAdEr
02-21-2002, 06:52 AM
You need to find IAT manually then use ImpRec, IAT is not even mangled with...

Funny, my dump is even smaller than the original, Podien really write a great piece of code!

Bt the way, which program did you use to identify the packer as PcGuard??
h8er
02-24-2002, 01:10 PM
Thx i have found where the packer decrypt the IAT and i have fixed the IT manually. Now the dump work perfectly. I've tried Imprec and Revirgin but seems don't work with this kind of protection... I'll do all manually. I 've found that Cpucool is Pc-Guard protected on this forum (search Cpucool) ;)


Stupid 9x/DOS question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Stupid 9x/DOS question
PDA

View Full Version : Stupid 9x/DOS question

?ferret
02-18-2002, 08:10 PM
Hi all,

As the heading implies, I have a really dumb 9x question. Actually an MS-DOS question I guess.

Is there a way under the 9x version of MS-DOS to allow user access control using net use? NT/2000 have /user param, but it isn't supported in 9x version of net use. Any other way that I'm missing, or maybe a small (little less than a floppy) 3rd party prog that allows user/pass combo to be passed while mapping a drive?

This one has me stumped, I can't believe there isn't a way to use user level access instead of share level in 9x.

(btw, if anyone cares, I'm trying to save about 10 minutes or so per install of a proggie at work that I have to install a few dozen times by automating most of it with a batch file & pulling the install from a server. If I can make this work, I only have to reboot once. Originally I had to reboot 4 times before it was over....good ol' 9x)

-------Wierd, I coulda sworn I was in Off Topic forum when I posted this...oh well...I guess MS-DOS is a tool ;-)----------------
Woodmann
02-18-2002, 09:24 PM
Howdy,
I dont completely understand the question but,
C:\>net use p: \\network drive here?\ipc$

Thats my guess.

Peace, Woodmann
DakienDX
02-19-2002, 01:35 AM
Hello ?ferret !

I think you can find the answer here.

NET USE [drive: | *] [\\computer\directory [password | ?]]
[/SAVEPW:NO] [/YES] [/NO]
NET USE [port:] [\\computer\printer [password | ?]]
[/SAVEPW:NO] [/YES] [/NO]

NET USE drive: | \\computer\directory /DELETE [/YES]
NET USE port: | \\computer\printer /DELETE [/YES]
NET USE * /DELETE [/YES]

NET USE drive: | * /HOME

drive Specifies the drive letter you assign to a
shared directory.
* Specifies the next available drive letter.
If used with /DELETE, specifies to
disconnect all of your connections.
port Specifies the parallel (LPT) port name you
assign to a shared printer.
computer Specifies the name of the computer sharing
the resource.
directory Specifies the name of the shared directory.
printer Specifies the name of the shared printer.
password Specifies the password for the shared
resource, if any.
? Specifies that you want to be prompted for the
password of the shared resource. You don't
need to use this option unless the password is
optional.
/SAVEPW:NO Specifies that the password you type
should not be saved in your password-list
file. You need to retype the password the
next time you connect to this resource.
/YES Carries out the NET USE command without
first prompting you to provide information or
confirm actions.
/DELETE Breaks the specified connection to a shared
resource.
/NO Carries out the NET USE command, responding
with NO automatically when you are prompted
to confirm actions.
/HOME Makes a connection to your HOME directory if
one is specified in your LAN Manager or
Windows NT user account.

To list all of your connections, type NET USE without
options.
?ferret
02-19-2002, 11:41 PM
Dakiendx:

No offense but I know how to list param options for DOS commands.....as you can see in your listing, there is no /user param or equivelant

Woodmann:

What I mean is say my domain name, logon & pass are:

domain
qferret
password

I could go to a 2000 machine that isn't logged on to that domain and type:

net use f: \\server\sharepath /user domain/qferret password

and it would map the drive.

Under 9x I can only map it if there is a password for the share itself, regardless of user...at least AFAIK....hence the question

Is there a way to pass a username param to 9x ver of net use.....or a small 3rd party util that allows this?

(I've never really understood what IPC$ does, but I can try it to see if it works ;-) )
DakienDX
02-20-2002, 01:44 AM
Hello ?ferret !

Sorry, but I didn't understand your question in the right way. ;)

As far as I know, you can only access a share on a NT-domain if you've already logged into it.

Under "Control Panel"->"Network" you have a checkbox which enables you to log into a NT-domain at startup. If you don't like it simply press ESC. You can ask your admin to put a "NET USE ..." in your login script. So you only get connected to a drive if you are logged into the domain.

I'll try IPC$ at work, maybe it works. On my computer it says that it can only used on the server. (I also never understood what IPC$ should be used for.)

A few minutes with Google told me that there is no workaround in Win9x/ME. But if you need to access two domains form Win9x/ME, you should make sure that your Username/Password are the same on both domains.
?ferret
02-20-2002, 10:46 AM
Thanks for the try Woodmann, but IPC$ justs asks me for another password that I don't know hehe.

However, could I trouble you for a short explanation as to what IPC$ does/how it works? I have run into it before mapping to an AS/400 w/ certain versions of Client Access and would like to find out what/why/how ;-)
?ferret
02-20-2002, 08:04 PM
Maybe a different approach?

Is it possible to run a batch file from a server OTHER than at logon time that would map the drive etc.? I'm really just trying to automate an installation that requires a mapped drive at all times & network policies tend to get in the way, so I have to change a few registry keys before hand to allow me to map the drive for the first time etc. Then I map the drive, and run the install.

Example that works on W2K (names changed to protect the innocent):

regedit /s a:\regfix.reg
net use f: \\server\sharepath /user domain/qferret password
\\server2\installshare\setup.exe -s setup.iss

The batch file runs great on 2000, but fails miserably on 9x.

It takes about 20 seconds to pop in the floppy, and run setup.bat, while it takes about 10-15 minutes to run regedit/poledit, map the drive by hand, and run the install. I have already shaved most of that off by using the .reg file and creating the silent install package, but I could do better if I only had to go Start->run->a:\setup.bat (or \\servername\sharename\setup.bat)

Anyway, I've rambled on more than enough & if you read past the 1st 2 sentences, I'll forgive you for not answering until you wake up from the boredom induced nap I've sent you on ;-)
Woodmann
02-20-2002, 08:38 PM
Howdy,
IPC$=interprocess communication.
You should be able to set a null session.
I have not done much "NET USE" so I am just guessing here.
A lot of the stuff I have seen concerning 98/net use has been
with Samba.
There has to be something to make the whole process easier.
Perhaps Fyodor can help?

Peace, Woodmann
Kayaker
02-21-2002, 12:01 PM
Originally posted by ?ferret

Anyway, I've rambled on more than enough & if you read past the 1st 2 sentences, I'll forgive you for not answering until you wake up from the boredom induced nap I've sent you on ;-)

....ZZzzzssnort, huhh, whazzat?

Heh, just kidding. If I knew anything at all about the subject I'd do my best to confuse the issue in whatever way I could ;-)

Luck to you,
Kayaker
DakienDX
02-21-2002, 12:44 PM
Hello ?ferret !

I had no luck at work mapping a drive to a different domain's share under Win98, but I found out something else interesting. Maybe it helps you.

If you're not logged into a domain, you can still access it's shares from DOS.

We have Win2000 Server running and when not being logged in, the command "Dir \\SERVER\SHARE" shows me all files viewable for all users. A "Subst X: \\SERVER\SHARE" fails, the same as trying to connect a drive via "NET USE", but "Dir", "Copy" and similar commands work fine.
?ferret
02-21-2002, 04:19 PM
Thanks for the info DX, it doesn't help in this situation, but I know it WILL come in handy for installing programs that don't need the drive letter specific map.

LOL....Kayaker? confuse an issue? can't see it ;-)


.net
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > .net
PDA

View Full Version : .net

CTRL-D
02-19-2002, 06:15 AM
great board, but knowledge on it has alway some levels to high for me, so i never registered. But as i havent got any ideas anymore, mabe i can get some help in here ....

I coded a small proggie in VC#, compiled and ran it. Was really happy that it worked. As all others on the board here i was intrested in what it looks like disassembled.
WDasm didnt even try to disassemble it. IDA (version 4.20 demo) gave some code, but the interesting part of it looked typically like a packed program. So i fired up sice to check what it does. Its even worse than VB. It very much looks like an interpreted language. Searching the net i found IDA 4.2 full version will decompile this all.

http://www.datarescue.com/idabase/gallery/dotnet.htm

Unbelieveable for me how Ilfak does this all.

Anyone got some information on how to proceed with this ? reverse .NET-code without having IDA 4.2 full ?

Or any ideas what i could try ?

thx in advance

CTRL-D

PS: if any1 wants me to i can upload the small prog, but be warned, you need .NET-Framework installed to run it
death
02-19-2002, 08:09 AM
Hi CTRL-D ;)
Microsoft provides a disassembler, called ILDASM.
CTRL-D
02-19-2002, 09:39 AM
short answer to a long question ;)
btw: your name seems very common to me ;)

thx a lot, cannot await to be back on my PC for testing ... *g*

CTRL-D
CTRL-D
02-19-2002, 11:45 AM
JUST GREAT !!!

i wrote a simple c#:

using System;
class Hello {
static void Main() {
String s;
Console.WriteLine("Type your Password");
s=Console.ReadLine();
if (s=="mypass")
Console.WriteLine("Yeahhhh !!!");
s=Console.ReadLine();
}
}

and thats the results of the disassembly:

.method private hidebysig static void Main() cil managed
{
.entrypoint
// Code size 46 (0x2e)
.maxstack 2
.locals init (string V_0)
IL_0000: ldstr "Type your Password"
IL_0005: call void [mscorlib]System.Console::WriteLine(string)
IL_000a: call string [mscorlib]System.Console::ReadLine()
IL_000f: stloc.0
IL_0010: ldloc.0
IL_0011: ldstr "mypass"
IL_0016: call bool [mscorlib]System.String::op_Equality(string,
string)
IL_001b: brfalse.s IL_0027
IL_001d: ldstr "Yeahhhh !!!"
IL_0022: call void [mscorlib]System.Console::WriteLine(string)
IL_0027: call string [mscorlib]System.Console::ReadLine()
IL_002c: stloc.0
IL_002d: ret
} // end of method Hello::Main

lateron i´ll see what happens with my visualc#-progs :)

but for the´m interested in all this:
.NET-framework can be downloaded at m$oft
the csc.exe is the c#-compiler. This file is even in the redistributable abvailable (~20MB).
the disasm for this all can be found @
f**://ftp.dei.uc.pt/.raid1/MSVisualStudio.NET/program%20files/microsoft%20visual%20studio%20.net/frameworksdk/bin/ildasm.exe

fun with disassemling hells out of your files ;)

CTRL-D
garph0
02-23-2002, 07:44 AM
Have a look at

Anakrino (http://www.saurik.com/net/exemplar/)

it's really nice and (to some extent) it can show the inner code of the .NET framework :)

regards,

g

PS
ah, and it comes with full source :D
CTRL-D
02-25-2002, 12:57 PM
thats a good one, too.
perfect for finding fast information.
I still use the other one, because you can save it as *.IL-file and recompile it again after changing

sometimes the compiler errored, because it couldn t find the resourcefiles. I just remarked the lines (class) of error and it worked like a charm. The resources are just like the original ones.

but thanks for telling
CTRL-D


What does this code (ARM)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What does this code (ARM)
PDA

View Full Version : What does this code (ARM)

steve b
02-19-2002, 02:38 PM
Hello,

I have problems to interpret this code:

.text:0001BA8C loc_0_1BA8C ; CODE XREF: sub_0_1B97C+6Cj
.text:0001BA8C MOV R3, #0x10C00
.text:0001BA90 ORR R3, R3, #0x1C ; --- 2 ---
.text:0001BA94 MOV R7, R5
.text:0001BA98 LDR R0, [R7,R3]!
.text:0001BA9C MOV R2, #5
.text:0001BAA0 MOV R1, #0x72
.text:0001BAA4 BL FindResourceW
.text:0001BAA8 MOV R1, R0
.text:0001BAAC LDR R0, [R7]
.text:0001BAB0 BL LoadResource
.text:0001BAB4 MOV R4, #0x10C00
.text:0001BAB8 LDR R3, =loc_0_40244
.text:0001BABC ORR R4, R4, #0x20
.text:0001BAC0 STR R5, [SP]
.text:0001BAC4 MOV R1, R0
.text:0001BAC8 LDR R2, [R5,R4]
.text:0001BACC LDR R0, [R7]
.text:0001BAD0 BL DialogBoxIndirectParamW
.text:0001BAD4 CMP R0, #1
.text:0001BAD8 BEQ loc_0_1BB38

Can anybody help me ?

steve
DakienDX
02-19-2002, 03:45 PM
Hello steve b !

Try the two links below:

http://www.microsoft.com/mobile/developer/technicalarticles/debugapps.asp

http://www.pocketpcdn.com/index.html


Newbee question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Newbee question
PDA

View Full Version : Newbee question

ON'error
02-19-2002, 05:58 PM
hi folks,
ive got a 16bit app and with w32dasm i can see the "badboy", but i cant see the "goodboy" in string references or just as ascii text. ive worked with a 16bit application never before. how to go on? do you got some tips (also english language) for me?
would bee nice.
CTRL-D
02-21-2002, 04:48 AM
if you see badboy jump then have a look why it jumps and how your code can get to this point (just like in 32bit).
if you revert all the jumps to not go to the jump to badjump, then either you come to an program error or ro goodjump ;)

But using a debugger helps things a lot (at least for me)
Argoth
02-24-2002, 07:09 PM
How about: The app will never give you the 'Goodboy, you paid too much' messagebox. Maybe it will just continue registered when you manage to crack it.

The opposite does happen too, it always tells you the 'Goodboy, thank you so much' box. And after that, the app closes. It only checked the serial when it was run.

Guess you figured that part out :)

Grtz

Argoth


Section Atributes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Section Atributes
PDA

View Full Version : Section Atributes

Kilby
02-20-2002, 05:51 AM
Gentlemen, Ladies & those of you who are unsure,

I have been playing about with injecting a dll code into executables.

As usual everything is fune under 98 SE unfortunitely things take a turn for the worse under 2K (& above).

I need to modify the section charactistics from 60000020 to E0000020 to get write access.

I thiought that if I wrote a loader and used writeprocessmemory to modify these before resuming the thread would do the trick.

However this dosn't seem to be the case, I still get an access violation

Am I barking up the wrong tree ?

One possible solution would be to use writeprocessmemory from the dll which I am injecting, but I am unsure how to get the process handle for the processs I have unjected the .dll into.

Any suggestions ?

Kilby...

Why don't we all go back to DOS instead of all this windows crap :)
Kilby
02-20-2002, 06:43 AM
OOPS I appear to have discovered getcurrentprocess.

However any hints & tips on the best method to use would be appreciated.

Kilby...
LaptoniC
02-20-2002, 09:37 AM
I am using ApiHooks (http://elicz.cjb.net) library of EliCZ and it works pretty good on every windows version.
Kilby
02-20-2002, 10:09 AM
Hehe,

Either great minds think alike or fools seldom differ.

I'm using apihooks too, the problem that I have is that I cannot atch several bytes in memoru because the section attribute is 60000020 and under 2K I get an exception.

What I need to do is get write access to that section.

I have tried various methods of writing to that secton without success.

So I am forced to using Peedit to set the attributes by hand then injecting my dll.

Kilby...
LaptoniC
02-20-2002, 06:37 PM
I am using Masm, and AH library automatically set section attribute of ApiHooks to E0000020.I use /MERGE:ApiHooks=.text /SECTION:.text,EWR switches also to put ApiHooks section in first section.It worked quite well.If you are usign other languages I dont have any idea :)
stealthFIGHTER
02-20-2002, 06:59 PM
I need to modify the section charactistics from 60000020 to E0000020 to get write access.

Hello Kilby,

I don't know if I understand your q. well but ... I've seen an example that changes the section characteristics from xxxxxxxx to E0000020:

MOV [Section.Characteristics],0E0000020h

or

MOV [EDX].Characteristics,0E0000020h

(nearly same, heh)
And it works under Win98/Win2000.

Btw. nice example on Latigo's site (hello) - Nag injection (section char. changing included).

sF
Kilby
02-21-2002, 05:39 AM
Heheh, possibly I was being a little obtuse.

I have put together a .dll which intercepts an redirected api call.

However I need to modify the code which this redirected API passes through and this section has section an attribute of 60000020.

Under 98 this is fine but under 2K & XP I get an access error.

I hope this clarifys the problem that I have.

Kilby...
[NtSC]
02-21-2002, 10:58 AM
VirtualProtectEx should handle your Problem....


Easy RSA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Easy RSA
PDA

View Full Version : Easy RSA

mrcrackbrain
02-20-2002, 03:01 PM
I'm just trying to learn all this cryptography stuff and wondered if you great cryptogurus here could give me url's for few easy crypto-protected programs what i could crack. Hope there are some ;)
RSA would be maybe the easiest for cryptonewbie like me, as i havent got a grip of other's yet :)

Thanks!
DakienDX
02-20-2002, 04:30 PM
Hello mrcrackbrain !

Of course there are many RSA targets available, but is it so interesting doing such stuff?

Let's say you've a 128-bit RSA key. What do you do with it? Well, you bruteforce it. It take less than a second. Learning effect? None. Go to bed.
Let's say you've a 256-bit RSA key. What do you do with it? Well, you bruteforce it. It takes 10 hours in which you can do nothing with your computer. Learning effect? None. Many useless hours in front of your TV.
Let's say you've a 512-bit RSA key. What do you do with it? Well, you bruteforce it. You write a letter which should be delivered to your affinity in 1000 years saying they should insert the RSA key into a keygen. Learning effect? None. Your affinity is happy to have a keygen for a 1000 year old program.Did you ever think that most RSA programs in the last year were protected by RSA-1024? And that there where no programs using RSA before 9/20/00, when the RSA patent from 9/20/83 expired?

RSA was a cool thing to play with when it was new, but now it's impossible to crack it in a reasonable time if the author knows how to use it.
Kythen
02-20-2002, 05:05 PM
Ummm.... I would have to disagree with you there DaikenDX, on both accounts. Learning to do cryptography isn't just about bruteforcing some RSA key. You have to learn how to reverse engineer large integer packages and you learn a lot of very worthwhile mathematics. Also, breaking large key size RSA is by no means impossible, unless as you said the author knows what he/she is doing. You just have to take different approaches to solving the problem :)

Now in answer to your question mrcrackbrain, I don't know of any commercial targets you could play with offhand that have small key RSA. You may want to try newer versions of targets used in past crypto essays. If you look in the Mini-Project section there was a 5 level crackme that a number of people were working on. Level 4 of that crackme is RSA-128.

Here's the link to the crackme thread I referred to:
http://www.woodmann.net/forum/showthread.php?s=&threadid=2438

Good luck and if you have any questions/problems let us know!
Kythen
mike
02-20-2002, 06:22 PM
There are a few things you can do with rsa. One is decrypt the serial to a known string. You can either change the known string or the key used to decrypt it, but keygenning is out unless the key is very small. Checksumming is a popular defense against changing either of those.

Another is decrypt code or flags or internal variables or so forth with a user-provided key. Once a key is known, however, it can be shared, so it doesn't do much to prevent piracy.

If the random number generator used to pick the keys is bad (a la C's rand() function) then you can sometimes bruteforce the RNG instead of the key. rand() has at most 31 bits, but usually has around 20 because of the popular srand(time(NULL)) initialization.
stealthFIGHTER
02-20-2002, 07:09 PM
If you look in the Mini-Project section there was a 5 level crackme that a number of people were working on. Level 4 of that crackme is RSA-128.

/me lame - can't find it :(
AdamA
02-21-2002, 09:39 AM
Hi,

try h**p://www.geeworks.com/trialmaster/download.shtml
Geeworks TrialMaster 2.5 Standard Edition: RSA-77

happy reversing:D
AdamA
mrcrackbrain
02-23-2002, 05:32 AM
Thank you very much all of you for your help and advices :)
I hope i'll keygen my first RSA soon ;)
stealthFIGHTER
02-23-2002, 09:45 AM
Originally posted by AdamA
Hi,

try h**p://www.geeworks.com/trialmaster/download.shtml
Geeworks TrialMaster 2.5 Standard Edition: RSA-77

Hello,

I have a q.: How do you know it uses RSA-77?

Thank you,
sF
ThrawN
02-23-2002, 09:56 AM
Its non standard i believe
requires some altering of the library right??
Im no expert on non standard crap tho so im most likly wrong hehe
AdamA
02-23-2002, 12:43 PM
Originally posted by stealthFIGHTER

Hello,

I have a q.: How do you know it uses RSA-77?

Thank you,
sF

Hi,

after ~2 hours of reversing I found the following scheme:

md5=MD5(name+email+2nd part of Prod. ID)
chksum(md5)=md5[0]+...+md5[15]
serial=chksum^d mod n (serial is Base36)

E,N (RSA Parameter) are also stored in Base36.
Im sure you will find it.

happy reversing,
AdamA


Password genaration
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Password genaration
PDA

View Full Version : Password genaration

javelin
02-20-2002, 09:20 PM
is 383,270 passwords an second an good result
for an password genarator lib?

the computer is an 500mhz computer
DakienDX
02-21-2002, 01:51 AM
Hello javelin !

You can't say it's good or bad. It's depending on the way the passwords are calculated. If the password has only numbers, this can be done very quick. If it uses the ASCII letters 20h-7Fh it takes longer, if it has it's own tables for generating, it takes much longer because it has to lookup the password char from a given seed.

Then there is a question about the seed. If you take the time for example, this goes very quick. If you take much more values like ProcessID, hWnd, keyboard buffer or such things it takes longer, if you want to have it cryptographically secure and hash it 100 times and use strong random number generators, it takes very long.

Why do you want to know the speed of the library? Usually you want one secure password and not millions of them. Or are you refering to a random number generator instead of a password generator?
Fake51
02-21-2002, 01:59 PM
He's probably asking about a password bruteforcer, and what is the optimal speed of such a program.

Whether the number of generated passwords is good depends entirely upon the routine - As Dakien noted, there can be a lot of variables to one such thing, making the process more tiresome, and therefore slower.

If you want something to compare with (which is kinda pointless, since what you really wanna do is compare implementation of password generating routine, and not output) you can try l0phtcrack or Advanced NT Security Explorer.

Blue skies
Fake


Advanced Registry Tracer 1.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Advanced Registry Tracer 1.5
PDA

View Full Version : Advanced Registry Tracer 1.5

Tech19
02-21-2002, 11:10 AM
Im having trouble crackin Art 1.5 which can be found at http://www.elcomsoft.com/art.html

The app is protected with Asprotect v0.95 however im still relatively new to cracking and havnt unpacked any programs successfully yet without tutorials so thats kinda out of the question at the moment. The program requires a 16 character serial and performs this check and some others starting at 0049943E. The conditional jump at 0049946E jumps to the bad boy code, however if you reverse it the program is registered. This is all fine and dandy but the program rechecks the serial every time it starts OEP: 00498784 and reversing the jump at 004987F1 cause the program to think its registered again.

Now i would patch this conditional jump but the program is packed and my unpacking skills are rather poor ar the moment. After you have entered your 16 character serial, the program takes it and turns it into a 32 character serial before comparing it with a serial from a long list of serials inside the program(i think). It changes your entered serial into the 32 character serial at 0048F7F2 in a loop as it goes through each letter. For example i enter 1212121212121212 as my serial and it generates 6A716591C8E7CA561708631510579345 from it. It then subtracts my generated serial from another program generated serial at 00408D7F. The problem is I am unsure as to how the program generates the 32 character serial from my 16 character serial, so i cannot get them to match...

Any help in how the serial is generated would be greatly appreciated.
crUsAdEr
02-21-2002, 11:41 AM
Hmm... i din try to key gen it but i unpacked it, and patch it :> din seem fun to trace through the long long key gen routine...

Yeah few wks ago i was a newbie at unpacking but i learnt a lot since i joined this board, do a search for AsProtect on this board and you will get more than enough info to rip out most AsProtect prog... try and ppl will help you along the way...

Have fun
Tech19
02-21-2002, 11:56 AM
ok, ill give it a shot then
AdamA
02-22-2002, 05:48 AM
Hi,

md5(1212121212121212)=6A716591C8E7CA561708631510579345

md5->Crypto Hash

AdamA
foxthree
03-10-2002, 05:26 PM
Hello:

Just out of curiosity I took a look at this.

App is ASProtected (erm) 1.08 :->

Took the easy way to unpack, (sorry +splaj guru <wink>) CASPR..

Run the app. Surely, the app must store the code in the registry somewhere ... DoH! HKCU\Software\Elcom\ART\Registration\Code

Okey, let's enter a 16 byte string. Right! it checks the length as 0x10. We passed that one eh!

Put a bpx on RegQueryValueEx. We land at the reg. checker code at 0049886F! Rest all analysis of Tech19 is perfect!

Adam is also right md5(1234567890123456) = ABEAC07D3C28C1BEF9E730002c753eD4

Okey apps has a list of bad serial nos. (hacked previously and floating on the net I guess). We don't need those nah!

Finally, the app seems to crush this 32 byte into a 8byte sig of some sort with some unique properties and compares this (good crypto functions! Worth learning !!)

However, we just do this at raw offset 0x97c91 90 90

Gosh! Did we just register it ;-)

Enjoy!

Signed,
-- FoxThree

PS: This app just showed how good serial checking routines are taken by just two bytes :-<. Beware protectionists!


unpacking APDFPRP 1.61 (Elcomsoft) ASPROTECTED!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking APDFPRP 1.61 (Elcomsoft) ASPROTECTED!
PDA

View Full Version : unpacking APDFPRP 1.61 (Elcomsoft) ASPROTECTED!

foxthree
02-22-2002, 04:04 AM
Hi guys:

After unpacking 2 asprotected apps (Hi Alexey), I was trying a go at Advanced PDF Password Recovery Pro 1.61. My analysis is not yet complete but there seems to be a new variant of ASPROTECT on the scene.

(1) Revirgin tracer does not work completely but get stuck in some local loop which goes on and on for about 1/2 hour
(2) I haven't tried /tracex as I don't have access to Win98 machines but like +Spl/\j wrote in one of his tuts, Alexey knows about this and might've coded asm loops to frustrate us ;-)
(3) All the old tricks of +spl/\j (bpx GetVersion, S EIP L FFFFFFFF 61,FF,E0) is gone. Now bpx in GetVersion get called a whooping 100+ times or more (again in a local loop)
(4) Same is the case with bpx GetProcAddress

So finding OEiP itself is now much harder. Anyways, I 'm yet to try Solomon's suggestion on BPX IRETD and a couple of other my own tricks <grin>

But just thought +Spl/\j, +tsehp and other gurus might be interested.

Signed,
-- FoxThree
SpeKKeL
02-22-2002, 06:27 AM
H'm you're steaming up in asprotect ?!

Okee this new aspr is threaded on the general forum>>search
asprotect1.4 by splaj..!

btw oep:4152b4
iat :404a0
length :3d0

Fully rebuilded. (like evaluator said:It's time for a new update):D

Ciao SpeKK
foxthree
02-22-2002, 09:00 AM
Hi Spek:

Thanks for your information. Yes, I got the link. Also, thanks for providing me reference values ;-)

BTW, how did you find OEiP. I seem to be stuck there itself DuH? (/tracex?)

Signed,
-- FoxThree
crUsAdEr
02-22-2002, 09:49 AM
Yep, got the full dump working....

foxthree, Revirgin tracer works no problem on mine, spl/|j's trick of finding "61 FF E0" with bpx ntcontinue by Solomon works as well... i actually manuallly trace it :>>>... spent like 3 hrs, actually the prog wont crash if u set a series of breakpoint and then trace slowly....

This version of AsProtect has one user32.dll that ReVirgin can not solve, and i've seen all the AsProtect trick summed up in this version... perhaps there are more but so far all that i have known or not known are inside this prog :>..
foxthree
02-22-2002, 12:56 PM
Hi Spek/binh81:

Thanks for helping me out guys. I've almost rebuilt the IAT based on your advice. (That tip by +spl/\j == ROCKS!)

But like binh81 correctly pointed, my final IAT does indeed miss one USER32.dll call.

How can I find this one out? I tried setting bpx on GetVersion and then doing a :U 007FCA58 but still couldn't figure out what is there at that location (just a PUSH EBX is there?)

How to figure this one out? I'm attaching my rebuilt IAT.txt with this post for your reference. I'm rebuilding on Win2K btw.

Thanks for all your help and advice.

Signed,
-- FoxThree
crUsAdEr
02-22-2002, 05:31 PM
an easy way is the alphabetical order :>>>

This is nice if u see all the import are in alphabetical order :>... so the missing one must be something between DestroyWindow and .. cant remmeber the other one but u get the idea :>...

then look at the substitute procedure itself, it has a "ret 14" at the end... very few has this.."ret 14"...

then it calls 3 function from kernel32.dll

u can disassemble user32.dll to look into it.. it should be obvious from there :>>>

*******************************
KEEP TRYING, YOU WILL LEARN SOMETHING NEW
LEARN, LEARN MORE, LEARN FOREVER!!!!!
foxthree
02-25-2002, 01:58 AM
Hi Spek/binh81:

I've followed ur advice. However, I have a few questions. Firstly, I've followed all your steps and [hopefully] reconstructed the IAT. BTW, binh81, thanks for your tip. I think the missing API is DialogBoxIndirectParamA right?

After final rebuilding, my app crashes at 0x0041CD4D which accesses some himem area and there you find intstruction ADD EAX,AL (which looks like some unpacked region).

Why this is happening?

Also, SpeK: you've written the OEiP is 4152B4: However when we run under Revirgin (thanks again binh81), it does break there but the instructions there are:

004152AF pop edi
004152B0 pop esi
004152B1 pop ecx
004152B2 ret
004152B3 add cl,ch
004152B5 add cl,ch
004152B5 add cl,ch
004152B5 add cl,ch
004152B5 add cl,ch
004152B5 add cl,ch
004152B5 add cl,ch
004152B5 add cl,ch

Firstly: This is strange; there is no such address called 4152B4(which most probably means the unpacker is still working)
Secondly: Most Entry Points have the following sequence right

push ebp
mov ebp, esp

Why the above piece of code does not have this but still is referred to as OEiP?

Forgive my ignorance.

Thanks in advance,
Signed,
FoxThree
crUsAdEr
02-25-2002, 03:50 AM
The OEP is slightly different for this one, MOST prog has the OEP as "push ebp, mov ebp, esp" but NOT all....

Secondly, i think the API for user32.dll is DialogBoxParamA, cant remeber now that i have uninstalled it alredi...

Try to use spl/\j' s "61 FF E0" to find OEP. it's difinitely more accurate.. i use RV tracer to check if AsProtect does something else funny before handing over at OEP...

Yeah, that's all for now... keep trying :>
SpeKKeL
02-25-2002, 04:52 AM
Yep,

Maybe oep is different (traced by tracex).
The user api is DialogBoxParamA (like bin said)check it out Looks
much at the code aspr is calling..... .(in SI: u DialogBoxParamA)
Crashing your prog could be done by (i thought there were 2)
the api's calling for exmpl: getversion + ret 004 !! in aspr no problem but in your rebuilded When you use getversion it leads to crashing..So instead use kernel ord 002f.
Try search some info on the board about this...

Succes

SpeKK:cool:
foxthree
02-28-2002, 01:55 PM
Hi Spek/binh81/others:

Atlast, I've succeeded in unpacking APDFPRP. I owe it a lot to you guys. I'm really learning a lot I think. Yes, it was DialogBoxParamA. I think it is internally calling DialogBoxIndirectParamA, so I got confused :-(

My big thanks to you guys and mainly to +spl/\j and evaluator without whom the great ASPROTECT 1.4! hint wouldn't have been made!

Thanks once again guys. I'm humbled.

Signed,
-- FoxThree


OT: Porting VB ole automation to asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > OT: Porting VB ole automation to asm
PDA

View Full Version : OT: Porting VB ole automation to asm

acab
02-23-2002, 07:07 AM
I was given a pretty stupid vb proggie that reads data from a file and sends them to a printing application via ole automation. What I was meant to do is to write a completely new interface to achieve the same result.
Now I've almost completed the gui in win32asm but i really don't know how to handle ole automation.
Does anyone knows where to find documentation about coding ole autom. in c++ if not in asm?
Thanks,
acab


eeyelic.dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > eeyelic.dll
PDA

View Full Version : eeyelic.dll

crUsAdEr
02-23-2002, 08:11 AM
Hi guys,

Now that i am trying my hand on iris (3.70 is the current version)... i have unpacked iris.exe but i am having problem with eeyelic.dll...

as i understand it is packed with tELock and tracing is not possible... i kinda guess the OEP of the dll, i found a copy of IAT while eeyelic.dll decrypting itself and dump it but it doesnt seem to be very accurate... it kind of look weird...

all in all, i have something but i do not know whther any of my resylts are accurate.. so i am like sitting on lots of stuff and dont know which one is right...

I need some help, evaluator i know u have unpacked it (*hint :>*)

first question is why does dll have an OEP at the first place, when is this OEP called? when OS load the dll or when an import function is called? I tried to look around for info on this dll thing works but to no avail so far...

second, is there anyway i can verify my dll dump format, whether it si correct? as in for exe file when u disassemble it w32dasm will tell me that something si wrong etc... but not dll....

that's all for now,
thanx folks....

i am really confused now about the whole thing, maybe i should look into tELock itself first...
DakienDX
02-23-2002, 08:27 AM
Hello binh81 !

A DLL's OEP is called when a DLL is loaded and when it is unloaded, both in a process or in a thread. This makes four different call situations in total. The reason why it is called is given to the DLL by the Reason parameter. Here are the values:
0 = DLL_PROCESS_DETACH
1 = DLL_PROCESS_ATTACH
2 = DLL_THREAD_ATTACH
3 = DLL_THREAD_DETACH

When attaching, the DLL can return "0" or "1". "1" means DLL load OK, "0" means DLL load failed.

Normally W32DASM tells you if your DLL is OK or not. One way would be by loading the DLL, but for this you should have replaced the OEP with it's original value, else the DLL will try to decrypt itself again and crash. But if this works, your DLL dump is OK most time, only some missing/messed up imports could keep you from a fully working DLL.
crUsAdEr
02-23-2002, 03:48 PM
Yep, thanx, Dakien... i see the picture now

Think i have a working IAT for the dll, but when i disassemble eeyelic.dll w32dasm doesnot recognise any export functions, however if i use PEditor to check, it display 12 export function alright... what do I have to change to make it work properly.

I still get the massage : 'Application fails to initialise properly" .. does that mean my Import is still wrong???
or my dll PE header... could it be an export problem??

Thanx....

evaluator... u around?
DakienDX
02-23-2002, 04:46 PM
Hello binh81 !

Import Table and Export Table have nothing to do with each other. Their structure is completely different and missing exports don't crash a program, only the application using the DLL says an export is missing.

Since the export table is not messed up in any way, it shouldn't make a dump working or not.

A .DLL's import table works the same way as a .EXE's import table. But in DLLs you have also to take care about relocations. If the .DLL was relocated, you must change the .DLL's image base to the new value, else the .DLL will not work the next time it's loaded. Or you'll need to create a new relocation table, which is a hard task.
crUsAdEr
02-23-2002, 08:40 PM
Wonder why it is so hard to find a tutorial on unpacking dll, so far I have only found ONE!!!!!!!

I tried packing another iris's dll with telock to unpack it but no matter what option i choose, iris just refuse to run and stating that it can not initialise properly! I removed the packed dll and put back the orginal then it runs again!!! is this a teLock bug or something???

think i will put this aside for a moment and get some rest... shall come back to iris another time.. gonna get some sleep...

Thanx anyway, Dakien for your prompt reply :>
ThrawN
02-23-2002, 09:52 PM
Maybe it has a mutex check :)
crUsAdEr
02-24-2002, 04:23 AM
Yeppie....

Thanx, Dakien :>>>.... you are the man!!!!!! :>

I must be too shagged not to figured it out... re-read bit of Pe.txt and read your post again :>... then I realise that what you meant was just to change the base location :>..

Got it to load alright, had a few glitches here and there but as long as it loads, it can be fixed :>>>>>

Yep, thanx a lot :>...
crUsAdEr
02-24-2002, 06:56 AM
Final Question

Since the relocation section has become useless, i have removed it from the dll, does that mean that the prog will crash if it runs on some other computer that relocation is required?

Thanx,
evaluator
02-24-2002, 08:17 AM
Hello, binh81!

1. As I understand, DLL_base location was problem.
This means, you dumped DLL in runtime or after RELOCATIONs was done by telock.
So try again dump it when all sections will unpacked, but before RELOCATIONs will done.
So you can keep DLL_base as 10000000.
Also then you MUST set in PE-HEADER original values for relocation!

2. IRIS.EXE & EEYELIC.DLL are two times protected. First time by telock, then PCGUARD.

3. For DLL_unpacking I use this easy trick(exsept if CRCcheck presents):
In PE-HEADER change DLL characteristic to EXE(use LORDPE),
rename DLL to EXE & unpack as EXE...
crUsAdEr
02-24-2002, 11:30 AM
Hi, evaluator...

Thanx for the tip... it's all done alredi... but i will remmeber that neat trick of changing dll into exe :>>>... neva tot of that myself....

Maybe i shall try it again tomorrow... probably faster than fixing everything manually :<...
thE Cur!ouZ
02-26-2002, 01:23 PM
Hello binh81!

After all, sorry for my poor english, it's not my first language ;) .

There is some days i have to try of unpacking iris 3.7 but without success, he is antidump, antisoftice, antiTRW ..
it seem a good protection.

With PeEdit i have find Aspack sections, I have to try with Aspackdie 1.2 ( yoda), I obtained a unpacked file, but he don't run correctly, he crash in kernel API :confused: .

I read that you have succeeded to obtain a functional dump, I tightened thankful if you can give me some information how the unpack it.

Thank's.
crUsAdEr
02-26-2002, 05:15 PM
Hi the curious :>...

yeah as you have read evaluator's post, it is not Aspack but PcGuard and tELock... you have to try to fin the OEP, finding the OEP is tricky but it can be done, i do not want to give it away bofre you try a bit first then it's more fun :>... try to search the board for more information about manual unpackign as well as read a few tutorials.. try something simpler first, aftwer u succeed you will feel more confident to try this one... it has anti-tracer protection but the IAT can be found raw in memory...

Hmm, that probably sounds confusing right now, but I dont really know how to hint you without giving the answer away and kill the fun, well manual unpacking is about finding OEP, dumping IAt and rebuild so you should approach it systematically in that manner..

Try first and then tell me exactly where your problem is then i can help :>

Cheers...
thE Cur!ouZ
02-27-2002, 01:04 PM
Hi binh81!

Thank you for your answer, I am going to try to work more.

I have to try to trace the soft with icdump for finfing the OEP, but without success iris shows me an "error 00000000", it is anti-trace also as you said it.

I am going to read of other one of the tut's and manual unpacking.

Be right it is necessary work more and more, better to have solution..

Thank you for the answer my friends :cool: .
thE Cur!ouZ
02-27-2002, 01:18 PM
Hi binh81!

Thank you for your answer, I am going to try to work more.

I have to try to trace the soft with icdump for finfing the OEP, but without success iris shows me an "error 00000000", it is anti-trace also as you said it.

I am going to read of other one of the tut's and manual unpacking.

Be right it is necessary work more and more, better to have solution..

Thank you for the answer my friends :cool: .
evaluator
02-27-2002, 02:42 PM
Lets try this first step:
Load IRIS.EXE in WINICE+ICEDUMP, then
bpx 587000

and dump program. Now you have un_PCGUARDED but tELocked IRIS.EXE
Rebuild dump and set tELock-EIP 587000, try set correct IT for telock yourself:)
then we will continue..
thE Cur!ouZ
02-27-2002, 06:24 PM
Hi, evaluator ..

Thank's for this information.
I appreciate your replay.
I have to try ...but the soft not break at this address 587000.
don't accept "bpm"as u know it ,(it force u to restar PC)...

it's not the same version... !!?:confused:

I have version 3.7.0.1.

If you can tell me how to make to find OEP?
tools to use?

I have trying to trace the soft with Revergin but, he don't give me a good result.

any idea.
thankx
evaluator
02-28-2002, 01:49 AM
Why BMP??

I sad BPX 587000
thE Cur!ouZ
03-01-2002, 10:47 AM
Hi evaluator !

I know u said BPX..it's not work also..!!
the soft don't break at 58700 with bpx ...

I said bpm, because i have try with it, that's all... :>

Thanks..
evaluator
03-01-2002, 11:10 AM
Do you use ICEDUMP?
thE Cur!ouZ
03-01-2002, 11:18 AM
yeah , ICEDUMP is loaded..
i have the last version 6.025
evaluator
03-01-2002, 01:25 PM
You do something wrong.
Write here IRIS.EXE size,data, crc32
thE Cur!ouZ
03-01-2002, 04:43 PM
IRIS.EXE V 3.7.0.1

Size: 815 Ko (835 072 octets)

CRC32: ?? i don't know with which tool to detect
crUsAdEr
03-01-2002, 04:50 PM
bpm works fine on my win2k with DS2.5.. no icedump loaded....

you have to set the breakpoint in the right context maybe, or else it will not break...
evaluator
03-01-2002, 07:24 PM
for CRC32
http://www.damn.to/files/dm_hc151.zip
DakienDX
03-01-2002, 08:08 PM
Hello evaluator !

Very interesting...
The HTMLs are down, but the ZIPs are still available. :)

If it should not work anyway, please try here (http://www.woodmann.net/forum/showthread.php?threadid=2126). I already attached it to a post some time ago.
evaluator
03-01-2002, 08:27 PM
Entries are closed!
But I remembered!!!!!!!!!
www.damn.to/news.html
DakienDX
03-01-2002, 08:40 PM
Hello evaluator !

Good you remembered the link. :)
I never tried to access any files on the page, since I thought the DAMN page was down and the current index page was the only file on their server.

Then I noticed your link was working, but I didn't remember their page's structure and ended up in their current index page.

I noticed their page is rarely slow, so it might be better to download the file as thread attachement from here instead of bringing them high traffic. :(
thE Cur!ouZ
03-01-2002, 09:14 PM
Hi, evaluator..

thankx for the tools link of DAMN.
CRC-32 : 67A9CF50 of IRIS.EXE V 3.7.0.1

I have exceed the 15 days of evalutions, Now he show me the message box "Demonstration period has exceeded".
I think that for this cause the BPX 587000 does not work !!

Hi binh81...
I have WIN98SE.
Softice 4.05 build 334.

possibly the soft don't detect the new version of softice in DS2.5.

Thankx.
evaluator
03-01-2002, 10:06 PM
Hehe!
Of course, BPX587000 will not work if you see
that MessageBox.
PCGUARD uses "license file + registry key" for
time ckeck. Use RegMon for detect regKey.
license file = vmm32b1.dll

You forget to write IRIS.EXE time stamp.
(Or when you dld-ed)
thE Cur!ouZ
03-02-2002, 06:10 PM
Hi, evaluator!!

TimeDateStamp: 3C05426D

What do u mean :
"Of course, BPX587000 will not work if you see that MessageBox. "

After the end of the period of evaluation, will be impossible to make a BPX under the soft or unpack PcGuard protection. ?!!! it's that !!?

for the registry, I have trying to delete the key of the base of registre, IRIS show me with message box "licence file error"

I have dld the soft 01-11-02.

thankx for ur patience.
evaluator
03-02-2002, 09:15 PM
I sad:
"Use program REGMON for locate needed registry key in [HKEY_CLASSES_ROOT]"
thE Cur!ouZ
03-02-2002, 09:38 PM
I said, i have locate the key in :
[HKEY_CLASSES_ROOT] is {029005E5-1AB953A0-4BCE90FD},

after what i can make with it ?

I have deleted it !
The soft regenerate it after runing ..!! :confused:
evaluator
03-03-2002, 08:15 AM
So if you delete this key & vmm32b1.dll,
IRIS again not runs?

Do something, do anything MUTTLEY!

Don't more post here before you will BPX587000


unpacking a game tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking a game tutorial
PDA

View Full Version : unpacking a game tutorial

mambox
02-23-2002, 11:54 AM
hello,
subject seem lame but i'm looking for tutorials who explain how to unpack a huge single file...lets take motoracer3 iso its a big datafile and in the rip version there is all used (sizeless) stuff extracted from this big file...how to do that is my target.

thanks for possible reply :)
DakienDX
02-23-2002, 04:07 PM
Hello mambox !

I don't know motoracer3 myself, but it depends on the game how the big file is structured. Most time you can guess how the file works by simply looking at it.

The file extensions below are extensions which I've found in some games and do not necessary work on all games.
.PAK files are unpacked. They have a signature, an address where the file table starts and how long it is. After that the file data starts. If you jump to the file table, you can see path, address in file and size of every single file in the big one.
.PCK files work similar to .PAK files, but the file table is at the beginning instead of the end.
.PK3 files are ZIP files. I don't need to tell you how to work with ZIP files, do I?
.REZ files are also uncompressed, but have a more complicated header than .PAK and .PCK files.But I've also seen files where the files header is encrypted, but the data still unencrypted. Since there are no general rules, there is not general way of handling such files.

I hope you need this information to insert your own textures into your favourite game and not to make your warez downloads smaller.
ThrawN
02-23-2002, 09:50 PM
Those large files weither they are in their own format or someone elses like Darkie gave examples of, most likly contain things like the games textures (uncompressed maybe) and even possible wav files (this is where size comes into play). Basicly you could make your own tool that searches the file for wav headers and thus extracts them to files when it finds them. Make a note also the offset you have extracted them from and how much you extracted(because you would need it to inject them backinto the large file). Once extracted you can convert em to mp3 via lame or some other tool.
As for textures im not too clued on on those formats uless its bmp :P if so then the new winrar3 does a nice job at specialy compressing graphic files now

ThrawN
mambox
02-24-2002, 06:06 AM
thanks for reply....create my own tool...thats what i cant do and looking to learn how..bit too complicated at this time :)
secondly,yes its more to check texture internal,dont care about to do a release smaller,enough wrz floating who do it.
actually the file do 397.569.850
00000000: (offset)
42 46 56 30-12 5F 00 00-1B 00 18 01-FC 0E A8 17 (hex)
BFV0_  n¿ (ascii)
00000010:
3E 60 0A 00-78 01 EC DD-E5 EF F5 D6-D1 EE F1 3E
>` x_¦___+-_±>
00000020:
E7 D5 F9 07-CA 90 32 33-33 33 33 33-33 33 33 33
_+•-É2333333333
00000030:
33 33 73 53-66 66 4A 99-99 99 9B F8-F4 63 E9 1B
33sSffJÖÖÖ¢°_c_

i know its nothing to understand,just to watch you.
as the usual garbage,seem huge packed

can easily locate where the bit work:

56 push esi
E8BD0A0600 call .0005EE249 -----
83C410 add esp,010 ;""
83F801 cmp eax,001 ;""
0F8501010000 jne .00058D899 -----
813E42465630 cmp d,[esi],030564642 ;"0VFB"
0F85F5000000 jne .00058D899 -----
8A4E08 mov cl,[esi][00008]
33C0 xor eax,eax
F6C104 test cl,004 ;""
668B460A mov ax,[esi][0000A]
89442418 mov [esp][00018],eax
7409 je .00058D7BF -----
etc...

probably begin with too much complicated stuff..


Killing drivers... Deepfreeze
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Killing drivers... Deepfreeze
PDA

View Full Version : Killing drivers... Deepfreeze

matthew
02-23-2002, 10:40 PM
There is a program called Deepfreeze that monitors what you do to the computer and then undoes them when you reboot. That's to stop people from monitoring public and school computers. (I'm not actually sure how it works exactly).

It loads two drivers into windows...
DepFrzHi.sys and DepFrzLow.sys..

That way you cannot close down the programs. And if the computer is properly setup you can't boot to dos and delete them either.

So, does anybody know of a way to unload drivers while windows is running? If thats possible...

I've also thought that the program doesn't monitor the master boot record, so i could write something into the MBR, and then have it delete the drivers before they load...

Any thoughts?
Kayaker
02-23-2002, 11:46 PM
Hi Matthew

I'm assuming this is a totally academic question, asked only in the pursuit of knowledge with no hacking intent ;)

I guess the problem here is that these would be statically loaded vxd's, else you could probably use a vxd call such as VXDLDR_UnloadDevice to unload the drivers.

From the Win98DDK:

A dynamically loadable VxD can be loaded and unloaded at any time. (By contrast, static VxDs can be loaded only when the system is initialized and cannot be unloaded.)

(For statically loaded drivers)
The VMM32 loader loads VxDs in three distinct steps:

1. Base drivers specified in the registry
2. Static VxDs for devices enumerated by other VxDs
3. Static VxDs specified in SYSTEM.INI

Have you found how/where the drivers are loaded yet? I haven't looked at the program, but I'd guess DeepFreeze was using methods 1 or 2. Number 2 sounds like how Softice loads (via autoexec.bat). There may be no way to unload the drivers per se, but if #1 is being used you may be able to modify the registry so they aren't loaded on reboot. The drivers to be loaded from the registry are in

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD

Of course, it's possible the program checks the integrity of its driver loading as you shutdown, in which case any changes you've made might be detected. Also check C:/Windows/wininit.ini for any changes. Your MBR trick might work, though I have no idea about that, and there may be other ways the drivers are loaded as TSR's.

Cheers,
Kayaker
matthew
02-24-2002, 01:49 AM
I'll have to wait untill Monday to try this out.. I've got deepfreeze 2000, but the target computer has deepfreeze 98...

target being my testbed computer for completely legal testing applications.:o
curious_lurker
03-03-2002, 01:32 AM
This is an interesting program... and one that ive sort of thought about taking a look at for a while... but have always said "after i finish this project" and this one runs into another one etc...

lol

oh well i finally have some free time... and think i could have some fun with this one.. gonna try installing it on my old machine and see what i can find... if i find anything you might find useful i will let you know

i remember one time reading that it ~supposedly~ still works even if you try to fdisk... dont know whether it was true or just marketing propaganda... if it is though maybe it might do wierd things with the filesystem itself?
play with the fat or something?
DakienDX
03-03-2002, 10:26 AM
Originally posted by curious_lurker
i remember one time reading that it ~supposedly~ still works even if you try to fdisk... dont know whether it was true or just marketing propaganda... if it is though maybe it might do wierd things with the filesystem itself?
play with the fat or something?
Hello curious_lurker !

What do you mean by trying FDISK? If you delete a partition with FDISK or even only format it, the FAT will be erased. What should the program hide in it anyway? You've just 2 bits of the file attribute and 16 bits reserved for NT left in a directory for setting any security restrictions.
matthew
03-06-2002, 05:36 AM
Well, when we had the computer lab all to ourselves we
popped the case and cleared the bios. Then gave the
BIOS a new password and made floppy disks bootable. :D

I saw something in the autoexec.bat about deepfreeze
and I removed it, but the drivers are still loading from
somewhere. I've taken a look into the registry but couldn't
see anything.

And I STILL don't know the name of the drivers so I cannot
just kill them. Windows 2000 deepfreeze is easy enough to
disable, except Windows 2000 has nice new protection which
offsets the easy kill and makes it really difficult. (NTFS)

As soon as I can be bothered to put Win98 on my own
computer and monitor the files it installs I'll be done, but
as we've ALL said...... "i'll do it later" :D

I doubt deepfreeze does anything with the MBR as it's so
easy to repair it with deepfreeze, i'm guessing it starts from
the registry... just need the driver file name.
curious_lurker
03-06-2002, 11:32 PM
Deep freeze can be sort of an erm... persistent program can't it?

i guess it might help to persist

of course i havent looked at the nt version... so i dont know if this makes any sense for it or not
curious_lurker
03-06-2002, 11:38 PM
also forgot to mention.... (again this might not be the case with the nt version) that the registry entries ive found were under hkeylocalmachine/software/hypertechnology

altho the keys werent really necessary for what i did


Armadillo Tutorial ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Tutorial ?
PDA

View Full Version : Armadillo Tutorial ?

slide97
02-24-2002, 10:43 AM
hi,

I'm trying to crack a protection by armadillo on wealth-lab developper 2. I suppose it's a new version a armadillo. I research somes tutorial about unpaked with armadillo, but with no success. anyone have a good url, please?
Tech19
02-24-2002, 12:08 PM
wat version of armadillo is it packed with? try http://krobar.yates2k.net/other1.html#pac as they have some specific armadillo tuts, mite be the wrong versions tho...
slide97
02-24-2002, 05:57 PM
Thanks, it's a very good url!!

I don't know the exact version of Armadillo. But I have try a tool : Armdep11. It seems to work, but I have to find the OEP !!
If you want to try you too :
h**p://www.silicmdr.com/downloads/WealthLabSetup.exe

best regards

I have try to use the PEIdentifier V0.7 beta tool on the ArmXXXX.tmp (the dll) , and The Entry point is 0xD876, file Offset 0xD876 and first byte 55,8b,ec,53 .

I don't know if it's enough to know the version of armadillo ?


+SPLAJ! New ASPR version comes for you!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > +SPLAJ! New ASPR version comes for you!
PDA

View Full Version : +SPLAJ! New ASPR version comes for you!

evaluator
02-24-2002, 03:54 PM
+SPLAJ! New ASPR version comes for you!

Encyption added for avoid my converters??
www.wnsoft.com
Here I uploaded ASPR.DLL for analize.
Base 10000000.

It's time for update ASPR:)))
SpeKKeL
02-26-2002, 03:28 PM
H'm tried the prog winnav......
Should this be the newest aspr ????
Took about 2 cups of cafe au noir

Greetsssssssz

Spekk:o


Just a nother querry abt AsProtect :>
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Just a nother querry abt AsProtect :>
PDA

View Full Version : Just a nother querry abt AsProtect :>

crUsAdEr
02-24-2002, 06:40 PM
Hi guys,

I remember eading Tseph's post sometime ago about AsProtect initialise some data by jumping into the original code segment before handing over at OEP... Been trying to find where those post were but cant find that specific post..

Can someone point me to the thread or shed some light on this problem again?

Thanx,
DakienDX
02-25-2002, 11:08 AM
Hello binh81 !

I think I've found it (http://www.woodmann.net/forum/showthread.php?threadid=1473).
crUsAdEr
02-25-2002, 01:34 PM
Hey thanx Dakien.. REALLY appreciate that... :>
Did you find it through memory or did you actually plough through all those threads for me :>... any way thanx a lot..

OK.. so now is the question again.. ok how should i phrase this?? I am not very clear after reading and rereading the posts by Tseph and Kayaker still... s what are those codes? generated by AsProtect or extracted from the protected prog by AsProtect?

Has anyone been able to find out exactly what those codes do ?

Thanx


No String Reference
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > No String Reference
PDA

View Full Version : No String Reference

Argoth
02-24-2002, 07:22 PM
Ok, haven't been posting for a while (I have been reading though ;) ), but I needed help again.

I have unpacked a program which was packed with PEcompact. unPEcompact by y0da did a nice job unpacking it for me. I still have one problem, I don't see a String References list when I disassemble it in W32Dasm. I need it to patch this file, because I can't really set BPX's on API's with this one. It is a quake2 addon, so it doesn't give any messages through messageboxes and stuff. Just through the Quake2 console. It is an executable EXE file though. It is compiled in VC++ 5.0 and the file isn't crypted, because when I look in the file with my HEXeditor, I can find the messages I am looking for. Is there maybe something I can do, so that W32Dasm knows where the Strings are?

Grtz,

Argoth
crUsAdEr
02-24-2002, 08:08 PM
Try changing the section characteristics... it should work..

or else use UltrEdit to search for string :>

hope that helps
Argoth
02-25-2002, 01:44 PM
Try changing the section characteristics... it should work..

Ok...and how would I do that? :) I'm not really into this 'section changing' and stuff.

Grtz

Argoth
crUsAdEr
02-25-2002, 02:22 PM
Yep... get PEditor or Lord PE (registered version) then open up the file, edit section characteristics and change the section to "contain initialised and uninitialised data"

then you string reference should come up nicely... check out some unpacking tutorials as FEW of them do explain section characteristics here and there... if you are really interested read the famous "PE.txt" (search krobar site) but it really has lots of stuff... think 45 pages on my printer :>

cheers
Argoth
02-25-2002, 05:52 PM
Ok thanks man, let's just hope I'll find these tools on the usual sites :)

K, found them and they worked perfectly, tnx.
Lemme see if I can find some unpacking tuts :)

Grtz

Argoth


Unusual setup program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unusual setup program
PDA

View Full Version : Unusual setup program

john whitt
02-24-2002, 09:53 PM
I have a program that uses a setup program that starts up, creates a temporary file called c:\temp\nlsxx.tmp, then loads the nlsxx.temp file as a process. The process in the installer program which will then prompt the user for the password. Once the next button is pressed the program will install.

I am using wdasm to attach to the process space of the nlsxx.tmp process but the code is tool complex for me to figure out.

The setup program presents the user with a dialog box with one entry field a cancel button and a next button. Once the password is entered into the entry field and the next button is pressed the program will install.

I own the program and know the serial number but cannot crack the algorithm.

Any suggestions?

Here is a code snippet.
* Reference To: user32.PeekMessageA, Ord:0000h
|
:0042201A E83D35FEFF Call 0040555C
:0042201F 85C0 test eax, eax
:00422021 0F8485000000 je 004220AC
:00422027 B301 mov bl, 01
:00422029 837C240812 cmp dword ptr [esp+08], 00000012
:0042202E 7478 je 004220A8
:00422030 C6042400 mov byte ptr [esp], 00
:00422034 6683BE9600000000 cmp word ptr [esi+00000096], 0000
:0042203C 7412 je 00422050
:0042203E 8BCC mov ecx, esp
:00422040 8D542404 lea edx, dword ptr [esp+04]
:00422044 8B8698000000 mov eax, dword ptr [esi+00000098]
:0042204A FF9694000000 call dword ptr [esi+00000094]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042203C(C)
|
:00422050 8D542404 lea edx, dword ptr [esp+04]
:00422054 8BC6 mov eax, esi
:00422056 E879FFFFFF call 00421FD4
:0042205B 84C0 test al, al
:0042205D 754D jne 004220AC
:0042205F 803C2400 cmp byte ptr [esp], 00
:00422063 7547 jne 004220AC
:00422065 8D542404 lea edx, dword ptr [esp+04]
:00422069 8BC6 mov eax, esi
:0042206B E8B0FEFFFF call 00421F20
:00422070 84C0 test al, al
:00422072 7538 jne 004220AC
:00422074 8D542404 lea edx, dword ptr [esp+04]
:00422078 8BC6 mov eax, esi
:0042207A E8F1FEFFFF call 00421F70
:0042207F 84C0 test al, al
:00422081 7529 jne 004220AC
:00422083 8D542404 lea edx, dword ptr [esp+04]
:00422087 8BC6 mov eax, esi
:00422089 E86EFEFFFF call 00421EFC
:0042208E 84C0 test al, al
:00422090 751A jne 004220AC
:00422092 8D442404 lea eax, dword ptr [esp+04]
:00422096 50 push eax

* Reference To: user32.TranslateMessage, Ord:0000h
|
:00422097 E8E835FEFF Call 00405684
:0042209C 8D442404 lea eax, dword ptr [esp+04]
:004220A0 50 push eax
goatass
02-25-2002, 07:12 AM
Hey john whitt, the code you posted is inside a message loop and really doesn't tell us anything without what variables are coming into this routine. I suggest you run the setup program and when it asks for a password enter anything and break on GetWindowTextA or DlgItemTextA and start tracing. It's most likely that the length of the password will be checked, and then some other calculations will be done to it. If you can find that piece of code it would be a good start, locate it then in W32DAsm and start labeling the code for easier reading. Then if you still don't understand post the code snippet and we will try to help.

This line does look like it's checking the length of the password but it could be anything for all I know.
:00422029 837C240812 cmp dword ptr [esp+08], 00000012

goatass
thewd
02-25-2002, 09:08 AM
it might be worth you telling us what the program is, so at least we know the target; a dump of disassembled code isn't very useful.

thewd
Magnum Johnson
02-25-2002, 10:58 PM
I am having problems using Softcie or Wdasm on this program since the main program starts the setup program as a seperate process. I cannot cannot catch the program as it is starting up.

If I use Wdasm and hit the pause button is stop in the midst of a peekmessage
translate message loop and it has already run the startup code.

When the correct password is entered it is still running in the same area.

The program does not use GetWindowTexta. of GetDlgItemTexta so SoftIce does not help.

The program is using peekmessage to look in the event stream for keyboard events then writes * to the text field of the dialog box each time a character is entered.

I cannot find out where the valid code is being checked.

I will starting labelling the code and get back in touch.

The program is a not so popular compiler program.
Magnum Johnson
02-25-2002, 11:09 PM
Can Wdasm of Softice be set to break on a specific event in specific program.

For instance if the program is doing the serial number checking after the operator hits the Next button on a dialog box it would be useful to trap the event the pressing of the Next button triggered.
DakienDX
02-26-2002, 11:50 AM
Hello Magnum Johnson !

Yes, SoftICE can be set to break on specified events.

BMSG window-handle [L] [begin-msg [end-msg ]] [IF expression [DO "command1;command2;..."]]

(SoftICE command reference will help you with the parameters)

The message you need is probably WM_COMMAND, then you can trace the program until it checks for the "Next" button. (You have to use a resource editor to find the Resource-ID for the next button.) Then you should come along the routine verifying the password.

It might be usefull if you could somehow make the DLL (nlsxx.tmp) available for download. So other people could take a look at it and help you further. You can (should) still keep your passsword private.
Magnum Johnson
02-26-2002, 10:45 PM
When the main program runs it will create a file called c:\temp\insx.tmp. This file in an executable that is later loaded as a process. The program calls the CreateProcessa with the following command line.

c:\temp\insx.tmp /SL3 $b60410 D:\programname.exe

I can send the insx.tmp file but it is too big to send back as an attachment.
The file is 180375 bytes.
thewd
02-27-2002, 02:38 AM
now we are getting somewhere, the setup installer appears to be inno setup (hxxp://www.jrsoftware.org) - it's open source so you can look at the algorithm in its original form.

1) search for the hex string - 68 EE 02 00 00 (~Sleep function)
2) about 50 bytes before, there will be code similar to...
call AA
cmp eax, [BB]
sete bl
test bl, bl
je CC
mov [DD], 00

AA - function call to password algorithm
BB - compare correct crc value with crc value of the entered password
CC - jmp if incorrect
DD - otherwise, set password dialog flag, to ignore dialog in the future

3) solution...
- remove incorrect jump, je XX => je 00 (will accept any password), or
- alter password dialog flag before password is requested, so that the dialog is never displayed

regards
thewd
DakienDX
02-27-2002, 12:05 PM
Hello Magnum Johnson !

I looked at the source code and found out that the password CRC is calculated as a standard CRC32 (Poly: EDB88320h) which became famous in PKZip. There are many implementation for most (If not for all ) programming languages available.

You can't recover the password originally used by the author, but bruteforcing should give you many valid passwords in a very short time. Just take a number, convert it to a string, use CRC32 on it and if the CRC doesn't match with the ones used in the setup program, simply increment the number and start at the beginning.

I'm not sure about this, but you should find a valid serial in less than an hour on a Pentium-200.

You may also use a custom password, use CRC32 on it and save the value in the Setup program so your password is always valid.
Magnum Johnson
02-27-2002, 08:23 PM
Your a genius! That did it.
Magnum Johnson
02-27-2002, 09:03 PM
I patched the code with Wdasm and got it to install but I cannot patch the original exe. It must be compressed.
DakienDX
02-28-2002, 11:12 AM
Hello Magnum Johnson !

You can decompress the program or bruteforce the password.
I wouldn't prefer the first method in this case, since we know that it would be easier to bruteforce in this way.

Source code of CRC-32 implementations is as common as sand at the sea. ;)
And if you're not sure if you've implemented it right, simply check with any ZIP program. Just compress your string and see if the CRC-32 in the ZIP is equal to your calculated value.
Magnum Johnson
02-28-2002, 09:44 PM
How on earth does one unzip a file contained within another exe?

I trying looking through the exe with a hex editor and found some inno stuff but I am not sure what to do from their. Gues I could get the inno source code and figure it out.
DakienDX
03-01-2002, 01:10 AM
Hello Magnunm Johnson !

You need to use an implementation of CRC32 in a program you write, else (with an external .EXE) there will be a big speed loss.

To test your program, think of a text string, use your CRC32 on it, keep the return value in mind, put the string with notepad and no final return key into a text file, compress it with ZIP and open the ZIP file. Then you'll see a CRC somewhere. If this one matches your calculated CRC, you're done and can start bruteforcing. :)


how to unpack Dll file for Aspack 2.12 ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to unpack Dll file for Aspack 2.12 ?
PDA

View Full Version : how to unpack Dll file for Aspack 2.12 ?

kernel5
02-25-2002, 02:52 AM
at title

can you help me~~

thanks~~

h**p://202.105.90.205/wsock32.zip
DakienDX
02-25-2002, 10:56 AM
Hello kernel5 !

Do you think this is a hotline?

This board is used to help people who're stuck somewhere and solve problems together.

If you just say "can you help me", you can't await any help from anybody.

Please specify your problems:

Do you know what a DLL is?
Do you know what a packer is?
Do you know what assembler is?
Do you know what a dump is?
Do you know what an IAT is?
Do you know what an OEP is?
Do you know what SoftICE is?

If you don't tell us how far you are, nobody can give you a specified answer.

You could also use the search function, both here on the board and Google. You will find answers here if you plan to learn how to unpack files or automatic unpackers with Google if you just want to have a file unpacked.

So, first learn to search, then learn to ask.
evaluator
02-27-2002, 06:46 AM
1. Why this thread is NOT moved to NEWBIES FORUM?

2. CRC32 error, can't extract file.
Unknow CHINESE zip compression!?
kernel5
02-27-2002, 07:21 AM
Oh , Sorry~

I Post here First time . I don't know the rules~

I can't search unpack Aspack 2.12 for Dll File in Web, then ask in here.

Btw: Excuse for my poor English~ ;)
crUsAdEr
02-27-2002, 09:21 AM
hi kernel5,

I understand like you said your english is poor, well i am no English speaker either.. but you must know baisc communication... you want help, sure... but read Dakien Post... do you understand what he is saying???

He says that you need to tell us more on what you are doing? Where you are stuck then we will surely help.
You can NOT simply post a link there and go, "hey dudes, unpack this damn thing for me"...

If your English is poor, use a dictionary to translate what people are saying.. like i used to do long time ago...

anyway, isnt winsock some kind of freeware by microsoft? why is this packed with asPack?

all the best...
DakienDX
02-27-2002, 11:02 AM
Hello evaluator !

I forgot to move the thread, I don't know why, maybe I overlooked it.

I also get a CRC error. The file seems to be 155 bytes too short, the export table is completely missing, the import table is damaged and the code at the DLL's entry point is somehow corrupted. I can't tell if it's packed by ASPack 2.12, because I'm unsure if the code at the entry point belongs to the file.
crUsAdEr
02-27-2002, 12:13 PM
DaKien, I think the evaluator means CRC error in unzipping the file, i also couldnt unzip the file... unknown zip compression..

You manage to unzip it? what program did you use?
DakienDX
02-27-2002, 12:16 PM
Hello binh81 !

I got the CRC error when unzipping it, but I was able to catch the output file before it was deleted because of the CRC error.
No unknown ZIP compression, just a CRC error.
evaluator
02-27-2002, 02:46 PM
original file name- JyWorker.DLL
packed with Aspack2.12

Normal wsock32.dll is 40kb (not packed).
This "wsock32.dll" very can by virus!

//202.105.90.205
is chinese page. Who can read?
kernel5
03-07-2002, 11:30 AM
Hello DakienDX, evaluator , binh81!

This Wsock32.dll is One Online game Plugins Cheat Tool.
It Hook old Wsock32.dll , not virus~~

Maybe Upload Web Server, Zip File is Bad.

So Sorry,

tomorrow , I upload this Dll File to New Web. Please Wait~~~

Thx~~
kernel5
03-07-2002, 11:46 AM
Now, i Upload New file to

h**p://member.netease.com/~ck/wsock32.dll

Thx~~
evaluator
03-07-2002, 08:04 PM
Bad server!
Try another..
DakienDX
03-07-2002, 08:30 PM
Hi evaluator !

It's no bad server for me. It works fine right now. :)

Hello kernel5 !

Unpacking the DLL is not very hard. Just .text, .data and .reloc are packed.
Load the DLL, trace it some bytes and set a BPX to the jump address of the first JNE you find. Run it and trace some more bytes until the Push OEP; Ret and dump the process. Take the .rdata from the packed file and insert it into the dump. Fix the OEP (you've seen it), the IAT (find the structure) and the Fixups (set it to first byte of .reloc).

Then you've a fully working unpacked copy. :)
evaluator
03-07-2002, 08:37 PM
0,70 kb/sec
yet not dlded!
DakienDX
03-07-2002, 08:57 PM
Hello evaluator !

I've 15kb/s. No, I'm not living in China. ;)
Do you want to have it as E-Mail attachment?
evaluator
03-09-2002, 08:03 PM
Finally i DLDed (&unp).
What then?
kernel5, want you , i give you unpacked:)))))
kernel5
03-10-2002, 04:37 PM
Hi, evaluator

Can you Mail to me ??

kernels@yeah.net Or kernel5@msn.com

I Want to study Unpack to DLL Files~

You can write Tutorials ?

Thx~
evaluator
03-10-2002, 07:38 PM
What debugger you have?
kernel5
03-11-2002, 02:08 AM
TRW 1.23 or S-ICE ~ .. Maybe Ollydbg

Let you Try~~ :)
evaluator
03-11-2002, 07:29 AM
What version of SICE?
kernel5
03-12-2002, 01:43 AM
NuMega SoftICE Driver Suite V.2.6 For Win98

Ollydbg 1.06

Have problem?
evaluator
03-12-2002, 06:36 AM
What is exact version of WINICE?

For this open debugger window & tape: ver
kernel5
03-12-2002, 08:15 AM
I Use Softice (R) - Driverstudio (tm) 2.6.0 (Build 336)

Softice 4.2.5 (For Win95/Win98)
evaluator
03-12-2002, 03:07 PM
Last 2 questions:

1. So you can't use ICEDUMP with your WINICE?
2. You ask about DLL unpacking. This mean you can unpack EXE?
kernel5
03-12-2002, 05:00 PM
I can Unpack Exe , Use Aspackdie12. But aspackdie12 Can't Unpack Dll File~

What Version S-ice can Use ICEDUMP ?? I can find any version S-ice..

Thx~
DakienDX
03-12-2002, 05:16 PM
Hello kernel5 !

I think evaluator wanted to know if you can unpack ASPack files manually.
The main thing is not how to get any SoftICE version, but how to work with SoftICE. ICEDump is for dumping the unpacked DLL, but you can also use any other dumper, like ProcDump.

I've already written a short explanation of how to unpack ASPacked DLLs earlier in this thread.
If you've not understand it then your main problem is not how to unpack a DLL, but how to unpack generally.

You can solve this by reading some tutorials on ASM and learning how to use a debugger.
evaluator
03-12-2002, 06:37 PM
So, before I write for you tutorial in DLLunpacking,
do this:
Change in HEXeditor byte at addres FF:
21 -> 01
then rename DLL to EXE & then use YOUR aspackdie12!

Then I mail you...
kernel5
03-13-2002, 08:25 AM
First, Thanks to DakienDX and evaluator.

To: evaluator

Why Change Dll File addres FF: 21 -> 01 ???

I See Exe File Addres FF is 01 .

To: DakienDX

You explanation i See , But I Can't BPX Dll File in S-ICE~

Thank to your .
evaluator
03-13-2002, 10:25 AM
kernel5!

Your english is very small!
I sent to you mail

------------------
TerminateThread
esther
03-14-2002, 04:23 PM
Originally posted by evaluator
kernel5!

Your english is very small!
I sent to you mail

------------------
TerminateThread

Your english is too big!
cya :D
exit call process :p


VB4 Pcode
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB4 Pcode
PDA

View Full Version : VB4 Pcode

bart
02-25-2002, 04:11 AM
Is there any working VB4 decompiler for PCODE EXEs?
Dodi's one doesnt work :(
?ferret
02-25-2002, 07:36 PM
Not what you want to hear, but VB4 seems to be the one that fell through the crackz, so to speak. Dodi's for VB3 & ExDec by JosephCo (disassembler) for 5 & 6 Pcode.....but none that I know of for 4.
howie
11-15-2002, 04:12 PM
hi there,

hmmpf, this still holds?? no debugger/disassembler for vb4 pcode?

wkt and exdec both surrender...wkt says, my proggie dont import a vb runtime dll, but it does! *strange*

maybe theres a new wkt out?

just asking if i missed something in the development process? :)


The mistery of the self repairing program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > The mistery of the self repairing program
PDA

View Full Version : The mistery of the self repairing program

naides
02-25-2002, 11:40 AM
Hi everybody.

I have been working on certain program (I am not going to publish the name of the program in the public forum but if anybody wants to take a look just message me and I will tell you the name and the URL).
Defeating its protection is rather trivial, a simple change on a "registered or demo" flag, and it is not of interest here. After editing the program code with HIEW, it runs like a charm, several times, but the next day, it appears protected again!

I look at the code I edited the day before and the bytes have reverted to their original text.

Questions: Has anybody seen a protection like this?

How does the protection device detect and repair the changes I made?

I cannot find a file big enough to keep a copy of the code.
goatass
02-25-2002, 01:49 PM
hey naides, this protection is common in many shareware applications and in some others as well. Anyways, it's usually very simple to detect and fix.

The way I always seen it done is: the program opens itself using CreateFileA and reads a chunk of code,usually the protection related code sometimes the entire code section. It then runs through a loop checking the code against a "static" block of original code bytes, the minute it detects a change it will overwrite the entire block of code with the original one therefore doing away with you patch.

The other way this could be done is by calculating a checksum of the code section and comparing it against a predetermined checksum and if it fails the code section is overwritten by the original code stored somewhere else in the EXE or in some other file.

The way to crack this is to find this checking loop and NOP out the jump that gets executed when a bad byte is found, this way it will never jump out of the checking loop if something was not the same as the original and will pass the checks and will never reverse itself.
Or in the case of the checksum, find the CMP and replace the static checsum value that is there with the one that was calculated for your patched code section.
BPX CreateFileA do "d *(esp+4)" and check that it opens your program's EXE, 99% of the time you will find the checking routine with ease.

goatass
ZaiRoN
02-25-2002, 02:00 PM
hi,
you can also put your byte(s) in the checking loop:D

byebye,
ZaiRoN
naides
02-25-2002, 04:26 PM
Thank you for your reply Goatass, you are definitely a smart goat :p.

What I have not been able to figure out is the timing of the self repair device:

If I close the program and then open it a few minutes or hours later it remains patched, but after a day or a weekend it repairs itself, so I thought the self repair routine appears to be activated by some sort of timebomb. I have played with the system date by moving the current day a few days or months, but this maneuver does not, apparently, trigger the repair event. Only leaving the computer alone for some 24 hours appears to do the trick.
What sent me off balance was the fact that what appeared to be a straightforward crack, has some hidden surprises.
foxthree
02-26-2002, 10:23 AM
Hi there:

Just thought I'd share some of my thoughts, too. See if I were a protectionist, I'd foresee that you'd foresee (<grin>) that some time-bomb mechanism is involved. So to possibly get you thinking, I might for instance not use time at all but use some random number trick. Check this one out:

- Program initializes
- Program calls rand()
- If rand() > some pre-determined value
call check_if_correct
- else
continue execution

This way, the way the code gets patched back to normal one is totally random (even to me: the protector!)

BTW, I've seen something of this kind of protection in a famous graphix software and was clueless until I debugged it instruction by instruction in SoftICE!!!

Signed,
-- FoxThree
naides
02-26-2002, 11:30 AM
Thanks, foxthree. That is a very useful suggestion and I am going to explore it a bit.
The program I am talking about is not from graphix, but appears to be a related company.
Having a protection system that does not activate in a consistent or predictable fashion is a little more challenging for the cracker.

The nice thing about the board is that what is somewhat perplexing to me may have been seen before by someone else.
|BoomBox-
02-26-2002, 11:46 AM
Hmm. Wonder if it could also randomly patch itself in-memory? :D
MTB
02-26-2002, 06:25 PM
Hiya Naides,

Your other option would be a trace after your fix using softice save how it processes the stuff. Then do a trace a couple of days later when it will fail. Dump the traces to file. Compare files old vs new. Where the differences start is where to start looking!

This is the brute force newbie approach. Also works well for the xx day limit then program stops. Not very intelligent but it will get the job done!

The only trick is to have softice start up and running the moment the program starts. IE backtrace, save history (this may take a few MB's of memory). Some fellow newbie cracker wrote a tut on this,called time limit cracking just can't remember her name.

Good Luck
MTB
MTB
02-26-2002, 08:22 PM
OK my memory is coming back to me! The author was Mushy, the title of tut is "Crack 99% of All Time Trials", the krobar collection has it, but I down loaded it from another site.
MTB


Softice 3.25 Under windows2000 professional
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice 3.25 Under windows2000 professional
PDA

View Full Version : Softice 3.25 Under windows2000 professional

l00natica
02-25-2002, 03:34 PM
Hello there
I installed softice 3.25 for winnt on my win2000 pro. I chose to load it manually everytime I need it. But after I load it when I press CTRL+D a weird screen appeared, like if my VGA was not compatible or smthg.

I had win98 installed and softice used to work fine.
I used to choose the standard vga and it worked. But with win2000 pro it didn't work.
I have S3 virge which is supported by softice.
I mean it is in the list, I tried it but it didn't work.
thank you for your help
Solomon
02-25-2002, 07:56 PM
try "Universal Video Driver"
CTRL-D
02-27-2002, 07:44 AM
if nothing helps, why not use a newewr sice-version ?

CTRL-D


parameters passed to a call
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > parameters passed to a call
PDA

View Full Version : parameters passed to a call

The Keeper
02-26-2002, 01:08 AM
Hello,

suppose i have

push ecx
push eax
call 404444

then ecx and eax are parameters passed to this call right ?

in this example :

lea eax, [ebp-24h]
push eax
lea ecx, [ebp-0Ch]
lea edx, [ebp-6Dh]
lea eax, [ebp-14h]
call 404444

what are the params passed to the call ?

is there a way to easily recognize how many and which are the parameters passed to a call ?

Regards
The Keeper
shadz
02-26-2002, 08:11 PM
Originally posted by ArthaXerXes
Microsoft Specific

-snip-

The following calling conventions are supported by the Visual C/C++ compiler.

Keyword Stack cleanup Parameter passing
__cdecl Caller Pushes parameters on the stack, in reverse order (right to left)
__stdcall Callee Pushes parameters on the stack, in reverse order (right to left)
__fastcall Callee Stored in registers, then pushed on stack
thiscall
(not a keyword) Callee Pushed on stack; this pointer stored in ECX

I thought I'd just clarify this -
__cdecl : caller pushes args _and_ caller cleans up stack after call.

__stdcall : caller pushes args, but callee cleans up stack

its the way in which the stack is cleaned up that is the fundemental difference between the two.

-shadz
CTRL-D
02-27-2002, 06:53 AM
Hi there !

i´m not that much into pushing and popping.
Isnt it a good idea to have a look in the call itself to find out if it has been a fastcall (parameters moved to registers) or a standardcall (only eax has been pushed in his example).
Tell me if i´m totally wrong :]

CTRL-D
shadz
02-28-2002, 08:03 AM
If u really want to know which are the args to the function, u could
check which regs get used whinin the call...

This would be a definitive way of telling which regs hold arguments and
which hold temp values not destined to be used by the caller.

-shadz
grosse
03-07-2002, 11:22 AM
only the eax seems to be the param... it is being pushed on to stack before the call - that's a pointer to whatever's at ebp-24h... the others r just lea's into regs... unless the params r passed through registers... virtually unknown except old dos interrupts.
btw... the ebp-24 will be the address passed not ebp-14


Hows it get there?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hows it get there?
PDA

View Full Version : Hows it get there?

Tech19
02-26-2002, 03:16 PM
I have a program that checks the previous registration info at startup, i can find this check easy enough however i cant find the call or jump that leads to this check. The check starts at 0042B770 but when i disassemble the exe and go to this address, it does not have any referenced jumps or calls, also the few lines of code above this are all nops and then a ret... could anyone tell me how i could find the address that jumps/calls 0042B770. Thanks.
DakienDX
02-26-2002, 03:46 PM
Hello Tech19 !

Since I don't think there is much encryption in it, I can only think of two ways:

Proc1:
...
Mov EAX, [????????]
Cmp EAX, ????????
Ja BadFunction
Jmp DWord Ptr [4*EAX+????????]

Proc2:
...
Mov E?X, [????????]
Call DWord Ptr [E?X+??]

Here we have a jump-table. It is at address ????????. The 4*EAX denotes the function called, since every address has 4 bytes. The Cmp checks if the call would not call a memory address where no pointer to a valid procedure is stored. So you should go to the jump-table start, find the procedure with the keycheck, find the value for EAX which needs to be passed to Proc1 and set a breakpoint with condition if EAX==????????. Then you can see from where the call came.
A bit more complicated, since you don't know the address of the jump-table. So you have to use a debugger and check it at runtime.


What is this??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What is this??
PDA

View Full Version : What is this??

crUsAdEr
02-26-2002, 08:20 PM
Alright, i find it very weird, could someone explain to me what is going on...

OK, i was cracking this program, then at the end of the key checking routine here is what happen

test eax, eax
jz Error_MessageBox ; Invalid key etc...
push 04
push FFFFFFFF
call GetProcAddress ; what is this doing here????
-snippet- then here is the funny bit
push 10
push edi ; edi points to half of the serial I entered
call EAX ; the proc address of the address ealier??

Of course eax was a nice '00000000' so i get lots of error message, nopping the instruction let the program run but features are disabled still.

i am just wondering what Procedure is this trying to call
here? and what procedure that can make appropriate changes to the program?? to make it fully registered?

Thanx a lot
Solomon
02-26-2002, 09:32 PM
Let me guess::rolleyes:
The shareware author has 2 different versions of the same DLL. One is full version, which has a specific function. The other is trial version, which has no such function, so GetProcAddress returns 0.

I saw such protection in Microangelo(w*w.impactsoftware.com). A DLL is missing in the the crippled demo version, so LoadLibraryA returns 0, then it shows the NAG.

Hope I'm not wrong:D
crUsAdEr
02-26-2002, 09:54 PM
Well, techinically the program say that it can be fully registered with a serial number!!!

but maybe i will look into that... sounds liek a good idea to check out the dll :>...

thanx for the help

Hmm... no luck... it uses normal windows dll, filemon din turn up with anything special either... maybe CRC...
CTRL-D
02-27-2002, 07:17 AM
very weird code.

__snip____
push 04
push FFFFFFFF
call GetProcAddress ; what is this doing here????
___snap

normally you call Getprocaddress this way:
Getprocaddress(dll_handle,"exported function");

neither of the pushes is a handle nor a pointer to a string, so eax has to be 0.

or is there another function for getprocaddress but getting an address for en dll-export ?

CTRL-D
sv
02-27-2002, 08:06 AM
Hi

this code :

push 04
push FFFFFFFF
call 'ASprotect' GetProcAddress
(GetProcAddress entry is redirected)

is used in proggy to get Asprotect Uncrypt Address !

After this code you could found something like

push 'key lenght'
push 'key offset'
call 'Asprotect Uncrypt Address '

If it return 1 an al, decrypt code is well done !!!

Of course, when your exe is rebuilded, you can't found this address ;)

Regards SV
crUsAdEr
02-27-2002, 08:30 AM
Yup, you are right....

just found that it really call a routine in AsProtect itself... so 'FFFFFFFF' refers to itself as teh module?

Hmm, loks like patching aint gonan work, and keygen this is hell difficult... guess it must be.. after all it's Elcomsoft:>

Thanx a lot sv for the tip...

shall have to do homework in the next month :>... beofre i come back to attempt a bruteforcer on this...
Solomon
02-27-2002, 09:03 AM
oh yeah, I didn't notice the FFFFFFFF :p


DriverSuite2.6 with XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DriverSuite2.6 with XP
PDA

View Full Version : DriverSuite2.6 with XP

Kaz
02-27-2002, 12:40 AM
I recently Installed Windows XP with the new Driver Suite 2.6. It seems that If I set break-points, they won't break at all. I set breakpoints on MessageBoxA, GetTickCount, ect.. ect.. ect.., but rarely does Sice break, if at all. I have even gone to the point of setting int 03 points inside of files and doing bpint 03 in Sice to break on it, but unfortunatly that also rarely ever works.

Any information/suggestions/comments are welcome.

Kaz
DakienDX
02-27-2002, 11:00 AM
Hello Kaz !

If you had searched and read articles on this board before asking your question, you wouldn't have asked it.

You would have found out that there are many possibilities why or why not SoftICE from Driver Studio 2.6 is working on Windows XP and no one can tell you why your version is not working on your Windows XP.

So, BUY Windows XP and Driver Studio 2.6 from their legitinate copyright holders and ask your questions there.

We don't need more than fifty people asking the same questions again and again.


VB cracking on W2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB cracking on W2000
PDA

View Full Version : VB cracking on W2000

IcyDee
02-27-2002, 04:12 AM
Please correct me if I am wrong (need I ask? :) )

I want to crack a serial number type protection on a VB program running on W2000. I think I understand the general technique for VB cracking 16 bit programs using hmemcpy but I think that W2000 does not have hmemcpy (i.e. it does not need it)

Is there an equivalent API that can be used in a similar manner to hmemcpy on W2000 to crack serial type protections?
Solomon
02-27-2002, 05:28 AM
NO. :cool:

Originally posted by IcyDee
Is there an equivalent API that can be used in a similar manner to hmemcpy on W2000 to crack serial type protections? [/B]

There are tons of VB cracking essays on the net. They cover from 16-bit VB progs(VB3, VB4) to 32-bit ones(VB4/5/6), from p-code to native VB progs:D Try to collect as many tutorials as you can, read them. Do some research by yourself:)
CTRL-D
02-27-2002, 07:01 AM
if its 16-bit it has to be VB3 or VB4 as Solomon pointed
out. Most of them can be decompiled.

for 32 bit. find ou which version it is (means if it uses MSVBVM50.DLL or MSVBVM60.DLL).
Always a good idea to disassemble these dlls to see on what you can break. There´s lots of intresting stuff:
__vbastrcmp (VisualBasicforApplicationsSTRingCoMPare)
__vbavartsteq (VariableTeSTEQual)
__vbavartstne .....

to be able to break on these you got to load the exports of the dll with numegas symbol-loader. (or specify them in winice.dat)

CTRL-D
riPPadoGG
02-27-2002, 08:15 AM
Hi....

I do not usually reverse on 2k machine, but...

Hmemcpy is useful is getting an opening, ie breaking into the code somewhere before the good/bad boy jmp/s.

For VB apps in Win2k, a better approach would be, use SmartCheck and get necessary info.. SmartCheck(if not crashed) will surely give you an opening... and much more info..

Learn about the protection with SmartCheck... it will also give you the RVAs... Then break at those points using S-Ice...

SmartCheck S-Ice combo IS SUPERB!!!

-spl thanks to Viper
foxthree
02-27-2002, 09:32 AM
Hi:

I've cracked couple of really tough (oxymoron ;-)) VB Apps using SmartCheck. Look for it!

Signed,
-- FoxThree
IcyDee
02-27-2002, 05:48 PM
SmartCheck seems pretty hard to find. All the download links are broken. I tried downloading a version from the numega site by creating my own licence number but that did not work, I think they have tightened up that loop-hole. :(

I made some progress however. An IDA listing shows me the call to rtaMsgBox when I enter a wrong serial number. There is however no obvious good boy-bad boy code anywhere near it

I am also having some problems with setting break points at the moment in SoftIce so things are not going too well :(

I have also tried breakpoints on __vbaLenBstr to no avail, but this may be because of the problems with SoftIce.

If anyone is interested in looking at this program it can be downloaded at h**p://63.211.21.181/download.html

Typical, five minutes after saying I can't find SmartCheck I find it :) I will have a play.

IcyDee
zacdac
03-01-2002, 01:29 PM
It takes less than 2 mins to find a serial for this on in Smartcheck.

For me the codes were

2083394396

5025895835546111

Just Look for __vbaStrCmp call at FileFinder.exe 00113355
(note smartcheck offsets are usually off by 1 byte)

ZD
IcyDee
03-01-2002, 04:08 PM
For some reason SmartCheck does not show me any events at all when I run it. I have it set for 'all events' I have turned off 'suppress system API calls' but still no joy.

Your help allowed me to register the program, thanks. The main problem I seem to have however is that on my PC (W2000 SP2, SoftIce 4.0) breakpoints just don't break! I can set INT3 in my code and break in the MS VisualStudio but that is the only way I can debug at the moment. It is doing my head in!

I wonder if the Softice and SmartCheck problems are related?


Crackme #6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crackme #6
PDA

View Full Version : Crackme #6

javelin
02-27-2002, 04:54 AM
another crackme


RSA cracker machine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > RSA cracker machine
PDA

View Full Version : RSA cracker machine

mike
02-27-2002, 11:04 AM
Dan Bernstein just posted a paper to the cryptography mailing list that showed how to build machines that can crack RSA keys three times as long for the same cost as previous ones. All RSA keys less than 2k bits are now insecure. I wonder how this changes the RSA factoring competition?
DakienDX
02-27-2002, 11:25 AM
Hello mike !

This is an interesting message. Now it will become interesting again to look at 1024 bit keys.

But how much will such things cost? Who would buy a $100.000 machine to factorize a number which brings $10.000 when done, with the risk that someone else has also bought the same machine and has already factored the number?

How fast is such a machine? If RSA-1024 still takes a half year it's not so interesting to most people. If it takes half an hour, it becomes more interesting.

This means program authors using RSA a registration protection will now have to use a DVD to give the registration key to the user, because it doesn't fit any more on a CD. :D
crw
02-28-2002, 04:28 AM
where can i find this cryptography mailinglist?
AdamA
02-28-2002, 08:01 AM
Originally posted by crw
where can i find this cryptography mailinglist?

h**p://www.mail-archive.com/cryptography%40wasabisystems.com/msg01830.html

AdamA
mike
02-28-2002, 11:29 AM
The bit about 2k-bit keys being insecure was someone else's extrapolation. What Bernstein showed was that *asymptotically* his machine factors numbers 3 times as long, but there's a (possibly very large) multiplier that he doesn't know. It may not apply to numbers that would ever be used in RSA. His paper is a proposal to NSF to get funding to figure that out.
Fake51
03-13-2002, 05:53 PM
h**p://www.theregister.co.uk/content/55/24414.html

An update on the story.

Fake
mike
03-26-2002, 03:20 PM
According to Lucky Green (I've met the guy; he's got his head on straight) and a panel of hardware experts at a recent conference, the machine Bernstein proposes is actually feasible and could be built for $1B (= $10^12).

http://www.securityfocus.com/archive/1/263924
Kilby
03-27-2002, 09:35 AM
It may be worth having a look at this before guying one :)

hppt://www.counterpane.com/crypto-gram-0203.html#6

I think I will stick with Mr Steiners views rather than the staff of the register, and members of slashdot.

Kilby...
mike
03-27-2002, 06:00 PM
It may be worth having a look at this before guying one

hppt://www.counterpane.com/crypto-gram-0203.html#6

I think I will stick with Mr Steiners views rather than the staff of the register, and members of slashdot.

Kilby...

Yes, I've read it. I've written papers with Bruce (by the way, it's Schneier, not Steiner). This cryptogram article was written before that conference I mentioned. Bruce is not a specialist in factoring methods or in hardware. His forte is block ciphers and saying things really well.

The panel at the conference was composed of people who know what they're talking about.
Kilby
03-29-2002, 05:45 PM
Mike,
I bow to your superior knowledge.

I hust had a problem with sites like the register and slashdot, as their sites are almost as inaccurate as the conventional press :)

I should know as I work with so called journalists every day :(

Kilby...


Softice not breaking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice not breaking
PDA

View Full Version : Softice not breaking

IcyDee
02-27-2002, 05:21 PM
I have not played with Softice for some months and have just got back to it in order to crack my first VB5 program.

I am running Softice V4.0 on W2000 with service pack 2.

When I try to run a program using the Loader (any program) the program does not break at the entry point. ISTR that this used to be an intermittent problem for me but I can't get it to work at all now. :mad:

IcyDee
ThrawN
03-02-2002, 05:28 AM
The only thing i can think of is section flags.
In order for loader to break on the entrypoint the section that the OEP is in needs to be executable as code.
In most peoples understanding this means a simple changing the section flags from C******* to E*******
You can do this via LordPE by Peedit -> Sections -> Rightclick on section -> Edit section header -> Flags: you will see something like C0000040
CHange it to E0000020
Canging 40 to 20 simple is like declaring the C to E
etc..
probely confused the fuck outa ya :P
IcyDee
03-02-2002, 10:33 AM
I am aware of that thanks, but this is the same for all programs including notepad.exe :(
Kayaker
03-02-2002, 07:20 PM
Hi IcyDee

Here's a thought just to see if the info that you want to break at WinMain is getting across to Softice properly.

The nmtrans.dll function DevIO_SetWLDRBreak is used to communicate to the winice vxd via a DeviceIOControl call that the user wants to break at the program start. The DevIO_ConnectToSoftICE function opens the vxd in the usual way with CreateFileA and returns a valid handle. Then DeviceIOControl is called, pushing the dwIoControlCode (9C40601C) for the proper function within the winice vxd to set the "Stop at WinMain" flag.

I thought you could start to scope out the problem by checking these 2 calls and see if they are returning proper values. Load nmtrans.dll as a module in winice.dat (EXP=C:\SOFTICE\NMTRANS.DLL) and set a BPX on DevIO_SetWLDRBreak. Then trace through and check the return values. Note that you may not be able to step *over* the DeviceIOControl call without the rest of the program executing, but you can set a bp on the MOV [EBP-20],EAX immediately afterwards.

DevIO_ConnectToSoftICE should return a valid handle to the winice vxd
DeviceIOControl should return 1 in EAX if the flag to break at WinMain was successfully set in winice.

nmtrans!DevIO_SetWLDRBreak
:10019A40 55 PUSH EBP
...
:10019A84 744B JZ 10019AD1
:10019A86 E855F9FFFF CALL nmtrans!DevIO_ConnectToSoftICE
; returns valid handle
...
:10019ABC 52 PUSH EDX
:10019ABD 681C60409C PUSH 9C40601C
:10019AC2 56 PUSH ESI
:10019AC3 FF158C100510 CALL [KERNEL32!DeviceIoControl]
:10019AC9 8945E0 MOV [EBP-20],EAX ; set bpx here

If this checks out OK then I guess you've got some weird Win2000 thing going on. You can always try editing in a CC at the OEP and then replace the opcodes. Hope this helps.

Regards,
Kayaker
crw
03-03-2002, 01:08 AM
i had this same problem w/ win2k. the only way i could get cracking properly was too, install win98 also.
DGR
03-07-2002, 05:02 PM
Wasn't there a special ntice.sys update for win2k sp2, else try installing DS2.5 or sumtin (or check on the numega site which one should be working). Anywayz, I'd say check the numega site for an update for win2kSP2.
chenl
03-07-2002, 10:06 PM
I'm using ds2.6 under winxp. Same problem appears. So reboot into win98...
Is this problem because of softice ,order due to winxp(2k)'s limit?
Woodmann
03-08-2002, 12:43 AM
Howdy,

We are not quite sure why certain BP's dont work
after adding 2.6 with XP.
Very few people are having sucess making this work.

The best thing to do is not use the XP.

Peace, Woodmann
reflily
09-10-2002, 08:19 AM
Now I installed driverstudio 2.7 and got the same result as 2.6:
cant break at winmain(). :(
i'm using windows xp.
powerful
09-14-2002, 03:22 PM
yeah.I met the same problem when I use the new softice4.27 just.I used win2k.but I used the 4.00version,there was no problem.Why?Is anyone ask the CompuSoft?
Snatch
09-15-2002, 02:30 AM
I think this is an underaddressed but very important issue. Why are breakpoints on entry point not working in 2k/xp? Clearly an in depth investigation of the loader and debugger itself is the only way to answer this question. If anyone does so I would love to know the results.

Snatch
ATY
09-15-2002, 07:19 PM
hi :)
installed 2.7 under XP - the breakpoints are fixed (no problem to trace in and out win APIs as well as VB/MFC calls) but still, it doesn't break at WinMain().

2.6 runs smooth under Win2k SP2 (just as under Win98) - havn't try 2.7 yet under win2K

Sice config: 2048 kb for screen, Universal Driver, original Sice dlls (nmtrans etc...), usuall exports...

AY.


I'm stuck with flexlm 6.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I'm stuck with flexlm 6.1
PDA

View Full Version : I'm stuck with flexlm 6.1

kade
02-27-2002, 06:27 PM
Hi,

My target uses flexlm 6.1f. I identified lc_init, lc_checkout and I got the vendor keys and the seeds, at least I thought I did. After xoring the seeds with key 5 my flexlm sdk 6.1 did not generate a valid license.

The target does not use the dll's of flexlm, it uses the lib's. It does not uses it's own cryptroutine because there are no calls to lc_set_attr with the parameter 0Fh.

I don't know how to proceed from here. Maybe I extracted my seeds wrong but I don't think so.

I read something about lc_new_job and lc_sg but I cannot find those functions in the flexlm sdk 6.1. Does anyone know where they are located?
kade
02-27-2002, 07:53 PM
Ok,

I just found the l_sg and l_key functions, they were defined by Dan's paper, they are not defined by flexlm itself.

I'll try this way.
cqfan
02-28-2002, 01:51 AM
such as _l_sg and _l_key
is called and the lib information id strip out from the exe.

so use IDA and flex .sig to locate a function
kade
02-28-2002, 06:22 AM
How does it come that I cannot find the names l_sg and l_key in the flexlm sdk 6.1 for windows? Are they also stripped out by flexlm?

I also tried making a sig file with the flair tools but I could not get the sigs to work, I have to try again. It seems that only the main functions are identified by the sig and not the ones I named by myself in IDA.
roli_bark
05-05-2002, 08:44 PM
Look for MANY subsequent calls to "_time". The start of that routine - is "_l_sg". Then follow Dan essay....
Kythen
05-06-2002, 06:18 AM
No, the function that contains all those calls to _time is actually l_n36_buff. In an app that uses lc_new_job, that is where you will find your seeds. l_sg is the function called from lc_init just before the check to see if the seeds are the default ones given in a demo sdk (87654321 & 12345678). l_n36_buff and l_key are called inside l_sg. Read Dan's essay and especially nolan blender's essay for how to work with lc_new_job targets.

l_key, l_sg, and a number of other functions are internal to flexlm, hence you won't find them in the docs or source at all, only the libs.

And I have found sigs rarely work on flexlm. There are always a number of builds for any given version, and functions may change just enough that IDA can't detect them with whatever sig you may have. There are better methods to identify functions that will always work without much effort. Look into the data reference to lc_init and you'll see what I mean.
nblender
05-07-2002, 04:43 AM
Originally posted by Kythen
l_key, l_sg, and a number of other functions are internal to flexlm, hence you won't find them in the docs or source at all, only the libs.

And I have found sigs rarely work on flexlm. There are always a number of builds for any given version, and functions may change just enough that IDA can't detect them with whatever sig you may have. There are better methods to identify functions that will always work without much effort. Look into the data reference to lc_init and you'll see what I mean. [/B]

Yes, you've got a good point - I've had pretty good luck with signatures for some routines, but others seem to change much more from version to version.

For the original poster, you can make DIY signatures if you have the flair381 kit for IDA - run pcf then sigmake on lmgr.lib, you may have to fix some exeptions though.

--nb
allex02
06-09-2002, 02:55 PM
Hello NB:

Can you give me a copy of flair381 kit for IDA?
Thanks first.

allex02@163.com
rack
06-09-2002, 06:11 PM
In hxxp://www.anticrack.de - Downloasd/Tools section (you must register for downloads)
allex02
06-11-2002, 09:29 AM
Thanks,I got it.
password
06-14-2002, 06:01 PM
I have the .sig and .nms files if you still need them
allex02
07-07-2002, 06:15 PM
Thanks for all above.
Also I have not found version 6.1f flexlm SDK. I try to search it using GOOGLE, but nothing I got.

What's the difference between 6.1f and 6.1g?

Thanks first.
allex


modules loaded into memory - dumps/disasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > modules loaded into memory - dumps/disasm
PDA

View Full Version : modules loaded into memory - dumps/disasm

Aimless
02-28-2002, 05:48 AM
Hullo all,

Here's something which I have been trying but repeatdly getting unsuccessful attempts at. Maybe someone could post a nice suggestion...

There is an application (say a.exe) which loads modules as required (say b.mod and c.mod) much the same manner as IDA does.

Now, using softice (or memory mappers), I can dump and view the loaded modules (not the main exe). However, I cannot get to disassemble the dump in IDA due to the following reasons:

1. I cannot seem to get the entry point of the DUMPED module (again, the module, not the exe)

2. How to load hex dumps into IDA ? (Sure, I know but somehow hex dumps of these modules, DO NOT disassemble!)

The reason is, if I open any one of the modules AS THEY EXIST ON THE DISK, NOT MEMORY, in a hex editor, I get the usual familiar signatures like PE/MZ/.text/.data and so on! But disassembly from dumped memory OR disk, does not occur. And yes, its DEFINITELY not packed/encrypted.

So what COULD possibly be the answer?

A little assistance would go a long way on this.

BTW, are there any topics of interest on how to dump LOADED modules (AND NOT THE EXE THAT LOADS THEM) and disassembling them?

Have Phun.
crUsAdEr
02-28-2002, 08:50 AM
Yeah i take it that you are talking about dumping dll file???

Well that have been a few thread recently, try evaluator's trick to convert it to exe bofre dumping :>.... finding OEP is similiar to finding OEP in normal executables, i think because IDA dissemble following th execution flow so if you have invalid OEP it will not disassemble properly, try W32dasm cos it will disassemble the prog anyway...

Hope that helps...
Aimless
02-28-2002, 09:13 AM
Not really.

The modules (sorry, the word is ~misleading~), are nothing but HEX dumps. Not dlls, not dlls-renamed-into-modules, not some executable stuff.

To put it clearly, they are not DLLs, its just too easy to dump dlls, and they show up in Procdump anyway. These are MEMORY MAPPED files (yup! the hex dumps are memory mapped after the main exe is loaded).

Still, thanks for the proposed hint. I will try the necessary.

Have Phun
DakienDX
02-28-2002, 11:27 AM
Hello aimless !

Maybe I don't understand your problem, but I'll try to help you.

If the *.MOD files are just pure code...
If they are not encrypted...
If they are used as memory mapped files...
If the memory page is set to executable...
If the program jumps to code in this memory...

Then why don't you create a dummy .EXE file with a .code segment as large as a .MOD file, take the original (non-dumped files) and insert it into the dummy .EXE? Then you can disassemble the file with no problems.

Since memory mapped files are always mapped to different memory regions, there can't be any direct calls to imported functions or direct references to the code in memory, unless it uses some kind of relocation, which I would say is impausible in this case.

I hope this helps, else may you explain why you want to use the dumped modules instead of the original ones?
notbob
02-28-2002, 04:25 PM
DakienDX wrote:
Since memory mapped files are always mapped to different memory regions, there can't be any direct calls to imported functions or direct references to the code in memory, unless it uses some kind of relocation, which I would say is impausible in this case.

This isn't necessarily true. If the memory mapping is done with the Win32 function MapViewOfFileEx(), then the caller has the option of specifying a base mapping address. If the author of the application has control over all the modules as well as the main app, then it's a relatively safe bet that a desired virtual address will always be available.

It seems to me that this is the only practical way to do this. Because these 'modules' aren't in a standard Win32 .exe format, the system-level loader functions won't work. This means that either the creator of these modules implemented a relocation scheme or he's assuming that the required address will be available.

A third possibility might be that absolutely all data access and code branching in the module is done with relative calls, but this seems like it's more trouble than its worth.

I am in agreement with you that there is likely an access layer between the module and the main app. Assuming the location of module functions would be a very bad thing. If I had to take a guess at it, I'd say that module offset 0x00000000 was some sort of GetInterface() function.

Good luck!
-notbob
DakienDX
02-28-2002, 05:28 PM
Hello notbob !

Yes, you're right, MapViewOfFileEx has the option to specify a mapping address, but only a desired one.
If it's occupied by some other program (maybe a mouse driver DLL mapped into all processes), the function will fail and make it impossible to load the module.

Since modules make the program expandable, the author will probably not define a unique load address for each module he might create in future.

Relocations will also be impausible, since aimless said the modules are hex dumps. Therefore I think they have no header with information about relocations or exported functions.

Maybe there is a value at a fixed offset which is set to the module's base address when being loaded from the main program, so the module can use this value instead of doing everything with relative offsets.

Maybe the module relocates itself when it's entry function is called with the base address as a paramter.

Who knows? But this possibilities will all make it more complicated than it needs to be.


Change Main Formular
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Change Main Formular
PDA

View Full Version : Change Main Formular

ON'error
02-28-2002, 07:13 AM
hi,

i tried to change the size of the main form to avoid seeing(bad english) ads. but with reshack or exescope you cant do that in my opinion. can someone tell me how i can get the properties of the main form and how to change them. thanks
crUsAdEr
02-28-2002, 08:46 AM
I think you can use ExeScope to change it...

I have been using it to hack resources here and there....
DakienDX
02-28-2002, 10:50 AM
Hello ON'error !

I don't know ExeScope, but ResHacker works very good with any Win32-PE files.
You need to find the place where the ad is shown and "handle it".
This can be delete it, change it's ResourceID or find references to it in the .EXE file. The first two ways may cause some error because the program can't load the resource, but modifying the program to not show the ad is the best possibility. (aside from keygenning and registering, of course)
Kayaker
02-28-2002, 10:54 AM
Hi

Since it sounds like you're talking about Adware, this thread might help:

http://www.woodmann.net/forum/showthread.php?threadid=2596&highlight=msn+messenger

Kayaker


Major Revirgin Bug ? :-( Tsehp help!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Major Revirgin Bug ? :-( Tsehp help!!!
PDA

View Full Version : Major Revirgin Bug ? :-( Tsehp help!!!

foxthree
02-28-2002, 12:39 PM
Hello there:

To test some unpacking theory, I was trying my hand at unpacking RegOrganizer by ChemTable Software (http://www.chemtable.com). I found one reference to this software by _spl/\j and wanted to test his theory.

However, the version number has been bumped up and I guess this is a new version. I've found out the "double-dipping" that asprotect does just like +spl/\j mentions:

once at 0041B068

and then jumps back into unpacking code and finally the OEiP itself is at 00419DF8

I ran Revirgin (latest beta) on this target and it shows only re-directed/emulated api. I press on resolve again but now it shows imports only from KERNEL32.dll and no other DLLs!

This seems to be a major bug in RV as if I use this import table and rebuild as +spl/\j mentions, the application GPFs due to a wrong import!

Also few other observations:

(1) Whenever I try to trace or api emulate the system just freezes or reboots. The RefCount is not zero or is not listed (blank).

(2) Why always references only to KERNEL32.dll? What about other DLLs?

BTW, I'm running on Win98SE.

Is there something that I'm missing here or is it a RV bug?

Thanks.

Signed,
-- FoxThree
sv
02-28-2002, 01:39 PM
Seems not to be a RV's bug !!
I just have downloaded & rebuilded last beta version 1.3 b2.
There is a call (412d34) to do before OEP (401000).
IT is located at 5d0134 -> 5d1110 with a lot of null bytes.
IT rebuilded is attached.

Regards SV
foxthree
03-01-2002, 04:21 PM
Hi SV:

Okay, in my first post I was referring to the 1.25 Version.

But today, I tried as you'd done on the 1.3 Beta 2! Still same result! This time on Windows 2000. BTW, I didn't put much of effort on this, which I'm planning to do by today evening.

What I did on the 1.3Beta2 was to put in 0x00401000 as the OEiP in Revirgin and did a IAT resolve! It shows only imports from KERNEL32.dll (just like before). Now I did put the CALL address you'd mentioned and did a Rebuild! EXACTLY IDENTICAL RESULT!

Now it seems that like +spl/\j wrote in his tutorial this aspr does some double-dipping so we need to dump at the earlier and all... but why is revirgin still building an IAT consisting of only KERNEL32.dll imports?

From your IDATA, I see that every thing is rebuilt correctly? So, obviously I'm missing something... which is ......?

Signed,
-- FoxThree
+SplAj
03-03-2002, 08:24 AM
Hi

The prob is that using 'auto' to find the IAT + length with your public release of RV is not working correct with this target due to the 'un-natural' nature of the IAT. There are a LOT of 000000 padding between each API as SV mentioned. Plus the IAT 1st DLL is NOT Kernel32.dll..............so 2 probs.

I suggest you manually change the start of the IAT address to a rounded thousand and set the length to 1200 or so. Then all DLL/API links will be found.

Use SI to examine the IAT memory range and you will see what I mean.

Spl/\j
foxthree
03-03-2002, 09:46 AM
Hi +spl/\j:

Thanks for your tip. I'll definitely give it a shot. Now I see things much clearly... ;-)

Signed,
-- FoxThree
tsehp
03-03-2002, 10:09 AM
splaj ! I hope you're feeling well with your leg and will recover pretty soon.

I'll post today on index page the rv update.

regards,

tsehp


GetModuleHandleA???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > GetModuleHandleA???
PDA

View Full Version : GetModuleHandleA???

crUsAdEr
02-28-2002, 02:17 PM
Hi I am back for one more question,

I am trying my hand on armadillo right now, downloaded the demo version and wrapped notepad with it, I have unwrapped it and rebuilded everything... however there is one little bug.. like this

---snippet----
push eax ; eax = 0 here
call ds:GetModuleHandleA_0
mov ebx, eax ; output eax = 01000000?
xor esi, esi
cmp ebx, esi
jz toNormalExecution
---snippet-----

And here is the extraction from win32.hlp
"If the parameter is NULL, GetModuleHandle returns a handle of the file used to create the calling process."

When i run the normal notepad the output eax value is 0 but when i run the unwrapped version output eax=01000000 which is the module handle of the armadillo wrapper??? Why is this so when i have already remove it? If this is the handle of armadillo wrapper then where does it leave its signature behind?

I have compare the unwrapped version and the original notepad, the code sections are identical so it is not the dump problem... if i patch it to make output eax=0 then the unwrapped version run without any problem...

However, i do not want to patch it simply because the code is the same as the original code... but i am not sure what is wrong???

Thanx guys for your help,


SoftIce causes me the blue screen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce causes me the blue screen
PDA

View Full Version : SoftIce causes me the blue screen

Neutrino
02-28-2002, 04:47 PM
on my new machine, a tyan tiger MP with dual athlon, starting SoftIce causes the blue screen. I'm using w2000 pro with service pack2 installed...
is SoftIce not compatibile with my mobo?


LoadLibrary Emulation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > LoadLibrary Emulation
PDA

View Full Version : LoadLibrary Emulation

r00t
02-28-2002, 09:18 PM
Hi all.

The other day someone ask me why the regsvr32.exe cannot register some .dll (say "a.dll").
I've realize that those "a.dll" uses some others dll's (i mean in the import table of "a.dll" there's "c.dll" and "d.dll" and some other dll's).
The point is: regsvr32 fails bcoz i dont have c.dll and d.dll, so i start to program my own regsvr, and i discover that i must make a LoadLibrary, then GetProcAddress of function DllRegisterServer and then execute those function. That's easy.
The proble is LoadLibrary fails if some dll in the import table is missing. So i try to make my own LoadLibrary function.

First OpenFile, then CreateFileMappin, MapViewOfFileEx, the search for the EP and execute the code there, and then i've programmed my GetProcAddress and the execute DllRegisterServer.

All those goes fine, until i've discovered that those shitty DllRegisterServer uses static addresses. (i mean that the MApViewOfFileEx maps from address 82xxxxxx or something like that and the code into the dll expects addresses 10xxxxxx or something).

So, anyone have some ideas to make a successfull LoadLibrary emulation?. i think it could be possible.

Greets and thanks.
DakienDX
03-01-2002, 01:32 AM
Hello r00t !

Try to look at this document http://spiff.tripnet.se/~iczelion/files/pe1.zip. It describes the format of PE files. The point you're interested in (because that's your problem ;) ) is Relocation.
But you'll need Imports too, so take a look at the Import section. Then you'll find out that you'll probably need the DLLs you don't have in order to have your DLL working correctly. I don't think they're in the import table just for fun.
Don't hesitate to look at the rest too. ;)
r00t
03-02-2002, 12:42 AM
Thanks for the tip.

I've managed to make all the relocations.

But i've the problem of unresolved imports.
More or lees i've managed to resolve some imports, i've tested in some code locations that uses those imports that was resolved, but the imports relocation fails bcoz the difference between the raw offsets and virtual offsets.

It seems that i must make a MapViewOfFile for each section in the exe.

Hey Dakien, any other tip?.
DakienDX
03-02-2002, 09:17 AM
Hello r00t !

You must change your DLL so that raw and virtual offset are the same.
MapViewOfFile for each section might also work, but it is very complicated.

But as I already said, if you don't have the missing DLLs, all imports from these DLLs will be unresolved and any call to an imported function from this DLLs will crash the main DLL.
r00t
03-02-2002, 01:22 PM
The main point is emulate the function DllRegisterServer.

Remember i wanna make my own regsvr32.

The problem with regsvr32 is that depends on each dll that u wanna register, bcoz regsvr32 only calls the function DllRegisterServer that lies in the dll u want to register.

Greets and thanks.
death
03-03-2002, 03:14 AM
Why not scan and LoadLibrary() for each DLL in the import directory, then do your thing?


Winzip 8
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Winzip 8
PDA

View Full Version : Winzip 8

shak
03-01-2002, 05:20 PM
Hi, i've been trying to crack winzip 8 for a while now and i got it half cracked i guess cause i was able to make it accept anything i enter in the registration screen. i nop'ed a couple of jumps so now it accepts anything i enter. however the next time i start winzip, it still asks me to register it. and again, i can enter anything and it accepts it. i dont know how to make it not to display that "thanks for using winzip" screen. im just a newbie and im having a hard time figuring it out. can someone please push me into the right direction? any help would be greatly appriciated. thanks in advance.
Fake51
03-01-2002, 06:06 PM
Try keygenning it instead, it has a very easy routine, so it's not hard to rip it out and do your keygen. Plus, you'll be able to find loads of tuts on it, since it's a classic.

Blue Skies
Fake
4oh4
03-01-2002, 09:04 PM
Originally posted by Fake51
Try keygenning it instead, it has a very easy routine, so it's not hard to rip it out and do your keygen. Plus, you'll be able to find loads of tuts on it, since it's a classic.

Blue Skies
Fake

...not to mention that the serial algo is the same since around v6 or so. So you'll be able to follow along quite easily even with the older tuts.
?ferret
03-02-2002, 02:37 AM
try h**P://qferret.cjb.net if you get stuck too bad......4 different options to choose from....probably a few more I didn't bother to write about......
crw
03-02-2002, 02:41 AM
another way besides actually making a keygen is to take advantage or winzip's built in keygen. insert a few lines of code and you can have winzip register itself w/ the correct key for any name entered.


Stuck with MosASCII
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Stuck with MosASCII
PDA

View Full Version : Stuck with MosASCII

RenHoek
03-01-2002, 09:59 PM
Hi there, I'm pretty much a newbie, but I'm trying my best :)

I'm currently trying to crack MosASCII Beta 6R2, since it does not allow various options that I want to try in the shareware version.

Here's in info on the target:

MosASCII 1.0.216 (Jan 8 2002)
//www.mosascii.com/
EXE filesize: 1,347,584

The program is a VB6 application, and can be registered with a name and serial.

First hurdle was the fact that the 'Register' button is grayed out as long as a non-valid serial is entered. Using softice and IDA I was able to find the location of that check.

0048DCD2 is a jz that I turned into a jmp

Then if you push the now clickable 'register' button it will pop up an 'invalid registration key' box, which I was able to find by putting a breakpoint on every damn rtcmsgbox I could find. (Any tips on better techniques appreciated, I could not F11 after a bpx on rtcmsgbox, it only returned me deep in MSVB60.dll)

Now I got that fixed by nopping out a jz on 0048ce07

The third hurdle is where I am stuck. It now comes up with a notice that my serial has expired. The text is in the binary but in an area in IDA that is marked unexplored. I have no idea what function is used to create that text window, so I'm totally lost on what to bpx.

Anybody have any pointers on my current problem or any advice on better techniques for the first 2 points?

Thanks :)
Tech19
03-01-2002, 10:30 PM
you might wanna try using Numega Smartcheck for cracking VB apps.
RenHoek
03-01-2002, 11:34 PM
I tried, it's not pretty. He does a loop of 100 StrCmp's and god knows what else.

I did find the beginning of the procedure I think where the text message is displayed. It's at 004FBED0, which
is called from location 0048CF5D.

But I still cannot find how this thing works. When I try to enter some of the codes of the StrCmp's in the unmodified program the register button does not even light up.

So I'm still stuck :(
foxthree
03-02-2002, 08:25 AM
Okey: Here is what you do:

--> Run Spy ++ (VC Tools)
--> Locate the handle to the Button that says "Register"
--> Leave the window as is
--> Open VC++
--> Write code to call EnableWindow passing this hard-coded handle (to make it neater do a FindWindow but that's me ;-))

Voila! Your Register button is now enabled. Now monitor in SmartCheck what the serial protection code does once you click on Register button.

Signed,
-- FoxThree
RenHoek
03-02-2002, 09:50 AM
Well as I mentioned in my first post, I was able to hack the register button, so that is not the problem. The problem is, that I get a serial expired notice, but I am unable to find the badboy compare if that is how it works.

Also there are more then a 100 StrCmp's being done with all different numbers, so I think there is something sneaky being done here. So it's just kinda hard to type in a 100 different codes, and I think it wouldn't work in the end anyway...
wbe
03-03-2002, 11:04 PM
Very well done. Smart program, lots of junk loops, tricks, etc.

Don't bother. No need to register. Just make it think it is registered. If you had worked well on the compare routine which is run just before you receive the "... disabled in this trial version" message, you simply cannot miss it.

Instead of checking a registered-or-not flag, the app calls a routine each time it needs to check your registration status. The routine where your regname (RKName) and regnum (RKNum) is checked is called from 89 addresses. On return, it tests ax register and then you have the classical good/bad boy jumps. Now, give MosASCII what it wants: Right at the beginning of the call xor eax, then inc eax and return with the flag 1;

(33C0
40
C3)

That's all. It now runs as if it was registered, no "...disabled", "You cannot...", etc. messages, even no "register" submenu item. You are left only with a few cosmetic changes.
Hope the above hints are explanatory enough.

Good luck.


ins****.tmp softlocx protection?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ins****.tmp softlocx protection?!
PDA

View Full Version : ins****.tmp softlocx protection?!

vollie
03-02-2002, 05:18 PM
Hi,
i am stuck cracking a program protected with bitarts protection. After starting the program a insXXXX.tmp File is created and started (the serial NagScreen). This Thread starts the main prog i think...

It is Softice protected, but with frogice its partly possible to set breakpoints.

I found a tutorial by lazarus, cracking bitarts fusion, it locked like fusion has the same protection as the program i want to crack...

I got 2 problems:
- The insXXXX.tmp Thread crashes every time i set breakpoints near the serial generation routine, so that it is impossible to sniff the serial out of memory :( What to do, instead of using Frogice?!

- i think there have to be plenty of tuts regarding this bitarts protection, i browsed the board and the net, but could not find the right tutorial right yet. Could anybody say what protection this is?! I did not find softlocx*.* files in any directory, the only hint i got is, that the temp File is named insXXXX.tmp (X - HexDigit i think) and in softice the Thread is named 'BitArts....'

It would be nice, if anybody could help me, what to do next...

Thanks
crUsAdEr
03-03-2002, 11:26 AM
what is the url of the program??

I have no experience with bitarts but i would like to try :>?

Thanx,
+SplAj
03-03-2002, 11:57 AM
Hi

Forget the .tmp file. This is just the 'mutant'. The real exe can be rebuilt after bpx terminatethread.

Can you see the 'registration' screen with 8 or 16 digit serial input - softlocx 4/5 ? or just an e-commerce 'flash'
style registration- titty 2

tell us your target, if it's not from bi-tarts ? - I'll show you how to slay a mutant :)

Spl/\j
vollie
03-03-2002, 01:22 PM
The target is 'WeatherMaster' from Milieu Simulations [worldwideweb.milieusim.com]

The serial screen is with 8 digit unlock code.

I read a thread from you (Spl/\j), where you told how to 'reinitialize' the Evaluation Peroid (delete in Netdet.ini the String "[Routing.extent{CRITICAL ENTRY}] with the 0/1s. And delete within the registry a folder with the name 'weathermaster v. xxxx' with a lot of 0/1s).
It worked. The program created a new serial number in the registration screen and the evaluation was reseted.

I think that a all information i got so far. It is possible to sniff 4 digit of the registration code with softice, but the other 4 digits are calculated elsewhere, everytime i set a breakpoint there the registration screen crashes, so that i can not get them :(

Do 8 digits mean softlocx 4?! How can i rebuild the exe? Set bpx on 'terminatethread' and then?! :confused:

It would be nice, if you can show how to slay the mutants!!!

Thanks!

P.S. Oh i allthough tried to get the serial number from offset 452244 (another post from you :)) but there is only a 12 digit number that does not work.
+SplAj
03-03-2002, 02:22 PM
ok i'm disappointed :(

forget I said 'forget the tmp' as the hash code IS IN the tmp file of this old protection.

this is softlox4. The 'hash key' is found at the raw offset you mentioned 52244:- 'w8er45983dhd'

you need a SL4 installation OR my old keymaker and use the above hash and make a valid key.... but don't do that. Lets kill a mutant instead.

This uses 'terminateprocess' to carry on once you click 'continue' at the registration screen. Have a go. see if you can find the 61 5D 8B 83 .......... FF E0 JMP EAX to OEiP 408??? and also the nice 'destroyed IAT'

Spl/\j
crassy
02-12-2003, 07:36 PM
Hi all!

I've now been fighting this protection for some time...
I've attached a small crackme that I made to simplify the problem.

As you can see it shows my encryption key right in the beginning. In the non-shareware version it doesn't do that (duh). The key is then used with the serial to generate an unlock code.

My question is how to get that key without that first message box.. It doesn't create any .tmp file for me and I haven't succeeded to find the key with sice. Any ideas where to look?

Softlocx 6 SDK can be found at Tucows
Link removed <-- Can't I link to shareware???
Its needed for the crackme to run...

Sorry for a very generic question....
hobferret
02-14-2003, 04:27 PM
Does anyone rember Liutaotao - well that works fine on this program;)

/hobferret


fun proof
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > fun proof
PDA

View Full Version : fun proof

mike
03-02-2002, 05:24 PM
OK, this doesn't have to do with crypto per se, but it does relate to factoring and it's fun if you haven't seen it before.

Prove that if n is composite (i.e. not prime) then (2^n)-1 is also composite.

I'll give hints if they're needed, but I doubt this crowd will have much trouble.
tony b.
03-04-2002, 07:03 AM
spoiler (?)

Let n = pq, p>1, q>1.
Then 2^pq - 1 = (2^q - 1)(2^q[p-1] + 2^q[p-2] + ... + 2^q + 1).
(This is obtained by long division.)

regards,

tony


How can I bpx the WINSOCK apis (with SoftIce)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How can I bpx the WINSOCK apis (with SoftIce)?
PDA

View Full Version : How can I bpx the WINSOCK apis (with SoftIce)?

bood
03-03-2002, 07:01 AM
How can I bpx the WINSOCK apis with SoftIce(such as 'connect' 'send' ...)?
I try loading the dlls such as wsock32.dll and ws2_32.dll, but it doesn't work still! But it does work when using TRW2000.
Kayaker
03-03-2002, 07:19 AM
Hi

Try setting a breakpoint directly on the address of the function instead of its name? Type EXP in Softice and get the address for the name of the function you want to break on and set a bpx directly. If wsock32.dll or whatever isn't listed with EXP, then Softice didn't load the exports and you should check winice.dat to make sure it's included properly.

Kayaker
bood
03-04-2002, 01:08 PM
I'd like to thank you first, Kayaker.
I find that if I load the wsock32.dll using the "load32.exe", then everything's OK ( the "load exports" button ). But I don't know the reason! If anyone knows, please tell me!


How to manually locate IAT start?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to manually locate IAT start?
PDA

View Full Version : How to manually locate IAT start?

foxthree
03-03-2002, 09:54 AM
Hi:

Can somebody just point me some good tuts on how to manually locate the start and end of IAT entries? I do use RV regularly and everything is fine but just curious to know how to find IAT entries manually.

BTW, I've tried searching the board and couldn't find anything useful.

Would be grateful for some tips,

Signed,
-- FoxThree
tsehp
03-03-2002, 10:07 AM
rv does this :

find the first call to an api , if yes fetches the pointer , then look at the pointer's table. that's the iat entries.
crUsAdEr
03-03-2002, 06:19 PM
Ther are many ways....

1. Run the real program and set a breakpoint on some API that you know it will break... F12 to locate the call and then follow the call the jump table...

2. Open the hex dump and search for some common API address n reversed order... you will find the IAT..

3. Open the search dump with Hex Work Shop, search for "FF 25" and when you see lots of founds that are 6 bytes apart.. that is the jump table...

4. disassemble the dump file with W32dasm and keep pressing PageDown until you see a straight column aligned to the left whizzing by your eyes... that is probably teh jump table :>>>

Hope that helps...
foxthree
03-04-2002, 02:39 PM
Hi binh81:

Thanks a lot for your post. I'm gonna archive this one ;-)

Signed,
-- FoxThree


Patching APDFPR Pro 1.61 ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Patching APDFPR Pro 1.61 ?
PDA

View Full Version : Patching APDFPR Pro 1.61 ?

foxthree
03-03-2002, 01:36 PM
Hi there:

After successfully unpacking APDFPR Pro 1.61, I'm trying to patch it. There seems to be some trick involved here and I'm sure somebody mentioned it before I'm unable to recall it. So, forgive me if this is a repost.

See what happens is that, the app calls GetDlgItemTextA to get the serial. Then it does a _lstrlen call and does some computations out of the length itself. I'm able to bypass all this casually. However, it finally comes to a place which looks like this

Push 00000004
push FFFFFFFF
GetProcAddress

Now this call returns (presumably) address of a function with ordinal 4 in the EAX. [Here I get 00000000 in EAX, because (again presumably) the function is missing/based on the serial no.)]

This function seems to be decrypting something (If I proceed further I get API is missing and Decryption failure and stuff like that)

Finally if successful it does a

mov 0044E8F8, 00000001
mov EAX,00000001
ret

which btw, seems to be the successful reg. sequence

If I forcefully try this, it works only that APDFPRP crashes as we've simulated the decryption routine and not actually decrypted the content (whatever that may be [Can it be code?])

Could any gurus here throw some light on whether I'm on the right track or is it the 2AM blues ;-)

Signed,
-- FoxThree
crUsAdEr
03-03-2002, 05:34 PM
Here is the link
http://www.woodmann.net/forum/showthread.php?s=&threadid=2716
foxthree
03-03-2002, 06:32 PM
Hi there binh81 ;-)

Thanks for the link. Yes, exactly what i'm facing. Now, like it has been said by SV, this app is using ASPROTECT itself to register itself so when we remove this shell, app no longer returns correct function address in EAX? So, we're doomed .... or are we ;-)

Well, now we have dumped we can debug further. So, I've debugged till the call to GetProcAddress and obtained the Entry point address to the decryption code which takes the Serial Number as argument.

I haven't have time to dig into this decrypt code further but will give it a shot:

BTW, the EiP to the function that GetProcAddress returns in (win98) is: 0063C6C8

U can easily check this for urself ;-)

BTW, thanks for all the tip and help.

So, I'm learning yet.... <grin>

Signed,
-- FoxThree

PS: I'm attaching the function call gate via a sice screendump ...
crUsAdEr
03-03-2002, 07:17 PM
Yeah i foudn out about that decryption routine but feel that i ma not ready for it yet... I'll be reading about encryption and all that first before attacking the fortress...

Good luck, my friend :>... if u do defeat it then u can always teach me :>

cheers
LaptoniC
03-03-2002, 09:15 PM
I dont know you guys know this trick but there is
ASProtect(tm) API-Emulator Dll (c) by VAG //VSL '2000 ARR

This dll emulates asprotect apis.Usage is very simple.Change the options in dll compile it.Add new dll import to our emulator lets say asprapi.dll.Then change GetProcAddress import to AsProt1 function.It works quite well.Beware that some programs need regname entries which two lines I mean like
_regName equ 'LaptoniC',13,10,'Site License'

Hope it helps :)
foxthree
03-04-2002, 06:42 AM
Hi Laptonic:

Thanks for your post. I'll definitely give it a shot!

Signed,
-- FoxThree


Offset ans Size of sections
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Offset ans Size of sections
PDA

View Full Version : Offset ans Size of sections

slide97
03-03-2002, 03:06 PM
hi,

I try to manually unarmadillo a app and I don't understand one think :

I have the X.tmp0 file and a dump file of X application and when I see the section (code segment) I have theses differents offset and size :

Voff Vssize Roff RSize
.tmp0 : 1000 286CA8 400 286E00
dumped : 1000 286CA8 1000 286CA8

I don't understand why the the Roff is differnt and the Rsize ?

So What I have to Do? take in the dumped file from 400 (size 286CA8) and paste into the tmp0 file start a 1000 ?

thanks in advance
crUsAdEr
03-03-2002, 05:31 PM
I dont know... sometimes Proc dump adjust the section alignment by automatically i think, just try partial dump section by section if ur full dump is messed up... Use Lord PE... nice program except lots of feratures are stripped off...
DakienDX
03-03-2002, 05:56 PM
Hello slide97 !

ProcDump has two options which are turned on by default.
"Recompute Object Size" and "Optimze PE structure".
So if ProcDump cuts the real Size, it means that there is nothing important in it.
The real Offset is different because from 00400000 to 00401000 there are 1000h bytes, and if you do a full dump, the additional bytes are also dumped.
(And there is some more space to insert the nice "Unpacked with ProcDump32..." message into the header :) )
slide97
03-04-2002, 03:38 PM
Thanks a lot binh81 and DakienDx!

Now It works and I have successfully unarmadillo my application. I think I will write a new thread to explain how to do.

bye
Js
03-04-2002, 04:05 PM
hiya,
"Use Lord PE... nice program except lots of feratures are stripped off...". Well worth the $10.00 for the full version.
regards
crUsAdEr
03-04-2002, 04:28 PM
Hi ya,

I think it is 25 dollars, well worth it if I am working and earning money... I dont even have a credit card :<.. how do I buy it?

Most of features are available in some other freewares...

I dont know if it is possible but at least I do not attempt to disassemble or crack the program :>.. with all my respect to Yoda :>

cheers,


files protected with pcguard 4.xx ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > files protected with pcguard 4.xx ?
PDA

View Full Version : files protected with pcguard 4.xx ?

B-Boy
03-03-2002, 10:15 PM
Hi.

Has anyone links to files protected with pcguard 4 (apart from cpucool..)?

Thanx,
B-Boy
evaluator
03-09-2002, 07:57 AM
IRIS THE NETWORK TRAFFIC ANALYZER
B-Boy
03-15-2002, 08:34 PM
thx


revirgin!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > revirgin!!!!
PDA

View Full Version : revirgin!!!!

arieri
03-04-2002, 09:37 AM
hi,

I have a question about revirgin and imprec

I have dumped (with icedump) and resolved (with revirgin) a couple of programs protected with VBOX 4.6.2

When my exe is finished using revirgin and pe editor, my new
rebuilded exe craches

When I do the same with imprec it runs like a baby.

Using revirgin it resolves almost everything, had to fix 2 api
manually. This could not be done with imprec so revirgin works
great here. So my question is why it dont run when using
revirgin to fix my dumped.exe

Maybe this is a stupied question but I am new to this stuff.

regards

arieri
Solomon
03-04-2002, 10:54 AM
please show us the URL. I'd like to try it.
arieri
03-04-2002, 12:14 PM
adobe illustrator v10 tryout

regards
tsehp
03-05-2002, 06:39 AM
there were some bugs that are fixed in v1.3 please try again with the new version.

regards,

tsehp
arieri
03-05-2002, 08:00 AM
tsehp;

I am sorry to tell you but I used your new version of Revirgin 1.3

I tried yesterday to do it manually, generate the .bin file, paste it
at the end of the dumped .exe and change to the right values with pe editor, but the .exe still craches. hmm......................

regards

arieri
Solomon
03-05-2002, 09:23 AM
I also tried it with latest ReVirgin. The unpacked exe suddenly exits after its main window appears. No exception dialog box pops up. Maybe some API entries are not resolved correctly? Here is my resolved API names.

BTW: I need a tool to compare my resolved API entries with that from others. Have to write one by myself?
arieri
03-05-2002, 10:24 AM
Solomon;

I looked at you resolved .txt and if I remeber right this line
is wrong:

538 005748A0 77E86659 01CC KERNEL32.dll InterlockedIncrement

I think it should be:

USER32.dll GetMessageA

regards

arieri
Solomon
03-05-2002, 11:26 AM
yes, GetMessageA & PeekMessageA(I forgot this old trick :))

RV resolves GetMessageA as InterLockedIncrement coz Vbox calls InterLockedIncrement just before it calls GetMessageA.

After correcting this error, the unpacked exe(fixed with RV) runs well. Thx

my data:
OEP = 9292EE,
IAT start RVA = 574000, Length = B58
generated IT RVA = 0079F000
arieri
03-05-2002, 12:37 PM
Solomon;

Yes thats extaly the same data for me:

OEP = 9292EE,
IAT start RVA = 574000, Length = B58
generated IT RVA = 0079F000

When I let Revirgin autofix my dumped .exe with the above data
fully resolved it crashes.

If I do this with imprec it runs,,,,,, mystic

regards

arieri
arieri
03-05-2002, 12:56 PM
Solomon;

Could you upload your .bin file so I could have a look at it?

regards

arieri
foxthree
03-05-2002, 01:29 PM
Hi:

There seems to be a bug in Autofix of RV. Just try it yourself. After doing auto-fix, *sometimes*, RV does not paste at the right point. You can see this by the size of the pasted EXE becoming around 2K-12K!!!

My solution is : Try pasting it by hand. Ultraedit, Hexworkshop... and then it should work!

Signed,
-- FoxThree
arieri
03-05-2002, 09:39 PM
hi,

I tried to do it manually but the .exe wont execute 0ne byte
before it crash.

Here is what I do (please correct me if I`m wrong)

Oep 009292EE
RVA 00574000
Lenght B58

I resolve it with vith revirgin v1.3 (2 api`s have to be fixed manually)

Enter IT RVA 0079F000
Lenght 1A8 (genarated by Revirgin)
Generate the .bin file,

Enter the Oep in my dumped .exe: 005292EE
Add a new section starting at 0079F000 size 4000, increase the
size of image to 007A3000, change the import table to 0079F000 size 1A8 , Paste the generated .bin file at the end of my .exe 0079F000

As I said in my earlier posting it runs great doing the same with
Imprec , but Imprec resolve only about 70% of the api`s.

I attached my files if someone are interested.

regards

arieri
crUsAdEr
03-05-2002, 11:22 PM
Hi arieri,

Hmm, what did you mean by your dump does not run a byte? Does it initialise and then crash at some instruction or does it not even initialise properly??

Try disassembling the dump and see if your imports are OK... sometimes Hex Workshop does not work properly for large file, so try Uktra Edit...

Hope that helps, I wanted to try unpacking it but 82MB plus registration with Adobe is just not worth the effort :>....

See ya,
Solomon
03-06-2002, 01:03 AM
Here is my .BIN file
foxthree
03-06-2002, 04:14 AM
Hi there:

binh81 is right!

I see the problem you're facing. I faced the same problem some time back with a similar software (see my post on WinSniffer).... and it was all because of HexWorkshop.

Hexworkshop does not work well on file sizes more then 2MB. Try UltraEdit and everything must be fine! BTW, after pasting your IAT, just try to open your file back. You will not see your IAT, but rather tons of 00s. That means your paste wasn't well.

Try again with UltraEdit.

Signed,
-- FoxThree
arieri
03-06-2002, 08:38 AM
hi

The .exe don`t initialise, I`ll tried to load the .exe with Iceload,but
it crash before it loads.

Thank you all!!

I`ll try again tonight with ultra-edit

regards

arieri
crUsAdEr
03-06-2002, 12:21 PM
Hmm....

Found the try out from a friends' harddisk... how did you guys get Revirgin to resolve almost everything? It gave me 82 unresolved IAT entries :<????

Thanx...
phop007
03-06-2002, 01:06 PM
I am still thinking how to use revirgin to find OEP, I also use icedump tracex and +splaj BPX GetVersion + S EIP L FFFFFFFF 61,FF,E0 + BPR XXXXXX XXXXXX+1 R IF (EIP==XXXXXX) and also try getprocaddress + map32 + tracex but no luck to find OEP. Any expert there help me to find the OEP please, the program name Advanced Administrative tools version 5.0

Many thank in advance.
arieri
03-06-2002, 01:15 PM
hi: binh81

You must use the new version of Revirgin v1.3
After resolving ones, trace the unresolved one by one.
If you choose trace all it might crash.
Resolve again
Now almost everthing is resolved (2 api`s I think you must use
your debugger to locate )

That should be all

regards

arieri
Solomon
03-06-2002, 01:42 PM
try this thread
http://www.woodmann.net/forum/showthread.php?s=&threadid=2635

Originally posted by phop007
I am still thinking how to use revirgin to find OEP, I also use icedump tracex and +splaj BPX GetVersion + S EIP L FFFFFFFF 61,FF,E0 + BPR XXXXXX XXXXXX+1 R IF (EIP==XXXXXX) and also try getprocaddress + map32 + tracex but no luck to find OEP. Any expert there help me to find the OEP please, the program name Advanced Administrative tools version 5.0
Js
03-06-2002, 02:25 PM
hi phop007,

AATools 5.0 oep 002953A8 (006953A8). So now you where it is, name of the game is find out how it gets there.
regards
crUsAdEr
03-06-2002, 04:29 PM
got it,

thanx arieri
phop007
03-07-2002, 03:42 AM
To: Js

Thank you very much. I will try to dump it.
phop007
03-07-2002, 01:25 PM
Hi JS:

I try to do this: BPM 006953A8 X, but aatools doesn't stop at that point so how can I dump this Prog:

And again how do you get there at 006953A8, I even try BPX NTContinue but I can't find any IRETD to set BPX. Any help I appreciate it
Solomon
03-07-2002, 01:43 PM
Are u using Win2K or WinXP?
Win2K uses INT 2E/IRETD to call sys service, WinXP may use SYSENTER/SYSEXIT
h**p://www.anticracking.sk/EliCZ/infos/FastNTCALL.txt
h**p://msdn.microsoft.com/msdnmag/issues/01/12/XPKernel/XPKernel.asp

Originally posted by phop007
I even try BPX NTContinue but I can't find any IRETD to set BPX.
phop007
03-07-2002, 04:50 PM
Hi! Solomon

I use Win XP, I found SYSENTER so maybe I can set BPX on this address. Any suggest?
phop007
03-07-2002, 05:35 PM
Hi : Solomon,

At first I do this:

bpx ntcontinue

Brake here:

001B:77F7E5B3 B820000000 MOV EAX,00000020 PRESS F8
001B:77F7E5B8 BA0003FE7F MOV EDX,7FFE0300 PRESS F8
001B:77F7E5BD FFD2 CALL EDX PRESS F8
001B:77F7E5BF C20800 RET 0008

After press F8 jump here:

001B:7FFE0300 8BD4 MOV EDX,ESP PRESS F8
001B:7FFE0302 0F34 OF34 SYSENTER PRESS F8

After press F8 program start, I not even see any SYSEXIT, How can I find the OEP of this aatools:
Solomon
03-08-2002, 01:53 AM
hi

sorry I deleted my WinXP long time ago. Maybe I need to install a new one to try it:) According to tsehp, SYSENTER may disable all interrupts( I have not refer to Intel manuals yet). That's why we get lost when pressing F8 at SYSENTER.

Setting BPX at IRETD is to find the addr where it will continue the execution after SEH. So it may be a good idea to check the parameters/context of NtContinue/KiUserExceptionDispatcher to find this address. There may be other good ways to bypass SEHs.


Pep?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Pep?
PDA

View Full Version : Pep?

irongecko
03-04-2002, 05:00 PM
Ok this is going to soung retarded but i really dont know, and can't find anywhere what a PEP is, or how to find it. I did a bit of research into it and found what it could possibly be OEP (Original Entry Point), found a tool to find this, but i did not work

(if you are wondering, i am VERY new to all this and am still learning the jargon, and am following the guide at krobar (http://krobar.yates2k.net/other/com40.htm) )
DakienDX
03-04-2002, 05:07 PM
Hello irongecko !

I suppose PEP stands for ProgramEntryPoint. I've also never heard of this abbreviation, but it should fit. It's the place where the program's code starts to execute when loaded by Windows.

But usually the OEP (as you found) is more interesting, since it's the address the program used to start at before a protection was applied on it.
irongecko
03-04-2002, 05:26 PM
Locate the PEP in the disassembly of the original.locked.exe and note down some bytes. Search for this pattern with your hex editor. Mark as many bytes in the locked file as you have in your clipboard. Replace and save

Thats what the guide said, if it helps - but it's got me confused :confused: (the PEP thing not the hex bit)
ZaiRoN
03-04-2002, 06:03 PM
hi irongecko,
i've never heard it, too!
sorry me but from what you have written i can't give a sense to the word "pep".
can you show the url of this guide. maybe this could help us.

ZaiRoN
ZaiRoN
03-04-2002, 06:43 PM
hi,
i hadn't seen that you had linked the page in your first post...sorry!
as said by DakienDX "pep" stands for program entry point.
but it's got me confused
i think your problem is: how can i find the oep (or pep :) )?
you can do it with your preferred disassembler. for example using windasm.
i don't have windasm but if i remember well there's a menuitem "jump to entry point" that brings you directly to the pep.

ZaiRoN
irongecko
03-05-2002, 12:15 AM
K - thanx, that cleared it up


rv1.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > rv1.3
PDA

View Full Version : rv1.3

britedream
03-04-2002, 07:40 PM
Hello to every one!,
warmest appreciation goes to the admiral for his wonderfull effort.
The rv 1.3 did a remarkable job in resolving the it entries for
the system cleaner v 4.6 which I blieve is well protected, the
rv 1.2 couldn't do it, but I noticed when you try to resolve again,
rv keeps gonig, so I had stop it manually, it well could be the
effects of the anti trace by the system cleaner.

britedream


help me Vbox 4.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help me Vbox 4.3
PDA

View Full Version : help me Vbox 4.3

Neutrino
03-04-2002, 10:32 PM
hi all,
i'm trying to crack a vboxed program following the essay posted by tsehp, i am a newbie with a very little experience with softice.
i don't understand how to change the instruction in memory

"This is done by changing the JZ instruction at 700BB52 to a JMP 0700BB89."

please help me
thanks in advance.
Solomon
03-05-2002, 01:48 AM
In SoftICE, type "A 700BB52" and press Enter, then type "JMP 700BB89", then press Enter twice.

Originally posted by Neutrino
"This is done by changing the JZ instruction at 700BB52 to a JMP 0700BB89."
[/B]


newbie stuck with tabledit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbie stuck with tabledit
PDA

View Full Version : newbie stuck with tabledit

Cyberdyne
03-05-2002, 02:46 AM
Hi, I`m a newbie at reversing protections. Have succesfully managed to reverse winzip and a few other simple protections.

But I am stuck with a program called Tabledit from h*tp://www.tabledit.com/

There are no error messages for a wrong serial. I`ve been able to set a breakpoint on MY serial (using hmemcpy and then PAGE it and set a break range on 30:location 30:loc+7) that i enter and still cannot find how it compares it to the correct serial.

Its taking my entry one byte at a time into the variable BL and moving it to EAX once complete, but then EAX is empty and there are no compares. Whats going on?

I`ve seen once before a patch for this program by Laxity and its supposed to be difficult, but I just want to know what would be the best way to attack this program. I don`t think its packed. String references are available in wdasm. Also theres lots of XOR`ing going on.

I`m NOT looking for the answer, just a point in the right direction.

I`ve looked in every register going and cannot find anything.
Thanks.
Sorry if my explanation isn`t very clear, I`m still learning.

P.S.
What is the location in User called Bozo`s live here?
Kayaker
03-05-2002, 03:20 AM
Hi Cyberdyne,

Just to let you know, I'm almost 100% sure this is a crippled demo with a lot of anti-cracker code to fool you into thinking it can be registered. There was a patch around for one version of it, but this would be major work to fully enable it, including the watermarking and "missing bits" of printouts, not to discourage you from trying it mind you.

This sucker is actually the app that got me into learning to reverse quite some time ago when I actually cared about cracking shareware, and was my "pet project" for many months. I was later told the real registerable version was on a protected server somewhere that you got the URL for after registering.

The author Kronos is no dummy and chose what's probably the best combination of protection - fool the cracker, cripple the app by completely ripping out code, and update versions often. The "serial" routine just dead ends and goes nowhere, which leaves you searching for footprints over rock. Believe me, I became very "intimate" with the code ;-)

Have fun with it, learn what you can, but don't beat your head against a brick wall forever like I did, LOL. That said, I think this is a good enough guitar tab program worthy of forking over the bucks for if you want to use it.

Cheers,
Kayaker
Cyberdyne
03-05-2002, 03:52 AM
Thanks Kayaker for the reply, I`ve already been banging my head off a wall for months trying to beat this sucker!

I`ve been able to get by the few limitations, e.g, only 16 bars or so can be imported/exported etc. , and have been able to remove the watermark on the printouts quite easily.

The reason I`ve been tackling this is that I already bought an older version 1.41 some time ago, and was sent a serial by mail that fully registered my demo, however, I`ve been unable to get upgraded to the new versions without paying for it again! The older version I bought was 16 bit, and the new 32bit version isn`t under the same licence or something like that they said. I can only upgrade to the newer 16bit version.

This sucks.

anyway, thanks for your info, I did read in the help that you had to download the new version again, after you were given the serial to register. No wonder I couldn`t find a compare to the correct serial.

It is a worthy purchase though, especially if your into flamenco.
(I`ll teach anyone how to play flamenco/classical if they teach me how to reverse engineer), hehe...
Kayaker
03-05-2002, 06:28 AM
Originally posted by Cyberdyne

It is a worthy purchase though, especially if your into flamenco.
(I`ll teach anyone how to play flamenco/classical if they teach me how to reverse engineer), hehe...

I agree, especially when you don't have a recording you can still input a transcription and get it played back so you know what it's supposed to sound like. I never found a tab proggy that did bends very well though.

Be warned, you start in on RE you may not get the time for other interests. Sounds like a fair trade though, riffs for code snippets, heh.

Kayaker
Clandestiny
03-05-2002, 07:00 PM
Originally posted by Kayaker
Be warned, you start in on RE you may not get the time for other interests. Sounds like a fair trade though, riffs for code snippets, heh.

Kayaker

LOL!!! Warning people against the dangers of RCE now, eh? I'm afraid the warning's coming a little too late for some of us :p Hehe, it won't be long before we'll be taking membership applications for "Reverser's Anonymous"... What is Splaj's motto...? "There is a fine line between hobby and mental illness." Yeah, that rings a little to close to home sometimes ;)

BTW, did you ever try Cakewalk? Don't know about its ability for guitar, but its great for keyboard / MIDI stuff :)

Cheers,
Clandestiny
Cyberdyne
03-08-2002, 04:02 AM
Hello again, I`ve been busy with tabledit.

I`ve managed to make it say that i`m the licenced user, no more nags at startup, have fixed the midi import export limit.

One thing has got me stumped, the 16 bar save limit for tablature.

I`ve tried breaking and tracing from WritefileA, _lwrite, and even hmemcpy. Still I cannot find a compare to 10h (the 16bar limit). Well I did find a few compares but none that worked after patching the jump if, after the compares.

I would have thought that it wouldn`t be much different from the midi import/export, but it must be.

At the moment, it looks fully registered except for the save limit. Because the program doesn`t check for a valid serial, just nopping the call to the string 'UNREGISTERED' that gets drawn on the dialog box fixed it. Now says Licenced User: [name], it still takes your name from registraion dialog box.

Have also tried following a tutorial for Guitar Pro 2.2 Demo from zor.org/krobar/ . This has similar limits also. but theres obviously something different in regards of protection for this version of Tabledit.

I managed to disable the save limit on version 2.33 though. But 2.60b7 is different.

Help....I`m wasting away....:confused:


decrypting an unknown file type
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > decrypting an unknown file type
PDA

View Full Version : decrypting an unknown file type

Dionysus
03-05-2002, 10:52 AM
This looked like a forum made just for this question :) I want to be able to take a file that is "encrypted" and convert it to readable format. Then "reencrypt" it. I am working on a game by NovaLogic that encodes files using cbin format, that is the first 4 letters in the files are cbin. I have a not encrypted template (its just a text file) that I can edit and the game will accept it and use it unencrypted. But i would like to be able to decrypt the files to read them and even more important i would like to reencrypt them. any way thats the background. I need to know where I can find information on breaking new file formats.
mike
03-05-2002, 03:33 PM
Stream ciphers usually work by XORing the plaintext with a pseudo-random byte stream. This means that if you XOR the ciphertext with some byte, the decrypted plaintext will be XORed with the same byte.

How do the ciphertexts corresponding to similar plaintexts compare?

Unless you have to type in a password, the file could be called "obscured" or "obfuscated", since there's no secret information other than the algorithm.

Except for VERY simple ciphers, it's almost impossible to figure out the encryption just by looking at the plaintext and ciphertext. Set breakpoints on function calls and/or API's that access the file. Then watch what happens to the buffer.
Dionysus
03-05-2002, 11:23 PM
actualy thrte is little corospondence in the template and the other file, im thinking that it may be some sort of compresion\encryption the ecnrypted file is 7k the text is 12k also there is part where the encoded files are similar at the beginning of the file.
here are 2 sample headers

43 42 49 4E 30 0C 00 00 E6 07 00 00 A2 00 00 00
CE 77 E1 01 1A 78 2E 7C 71 07 C2 77 EE 80 3C 17
BC 38 03 E1 BA F3 C0 1E 08 DF 9C 01 F7 5D F9 E0
0B 85 EF CE 02 78 2E 7C 75 07 C2 77 E2 80 3C 17
B8 38 03 E1 BA F3 C0 1E 0C DF 9C 01 F7 5D F9 EO

43 42 49 4E 70 13 00 00 43 09 00 00 BB 00 00 00
CE 77 E1 01 29 78 2E 7C 71 07 C2 77 EE 80 3C 17
BC 38 03 E1 BA F3 C0 1E 08 DF 9C 01 FC 5D F9 E0
0B 85 EF CE 02 78 2E 7C 75 07 C2 77 E2 80 3C 17
B8 38 03 E1 BA F3 C0 1E 0C DF 9C 01 F7 5D F9 EO

Manny other places in the program, they use "]" (5D) to seperate things so i was thinking that the part before that could be some sort of "key" or important in some way.

also no password, the game decrypts the files on its own when it needs them.

ill try useing SI on it but I am not good with that program. I can use it to make trainers and junk, but I never could get BPX to work right.

thanks for the idea.

also, any sites/tutorial on the subject would be good.
goatass
03-08-2002, 01:41 PM
Hey Dionysus, if you look at the two heads you can see that there are similar patterns which make me believe that the structure and layout of these files are similar. You said the program uses ] to seperate things, could it be that it uses [ ] which will be used in INI files to identify sections and keys. Does it use the INI APIs for anything ?
Try also bpx CreateFileA do "d *(esp+4)" and check to see when it open these encoded files and trace on from there. Also try ReadFile, etc.

Once you find where the game opens the file and starts reading from it you should be able to locate how it decodes it pretty easily since games normaly don't hide these sort of routines.

goatass


Is there any universal breakpoint like "hmemcpy" in win2k or xp?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Is there any universal breakpoint like "hmemcpy" in win2k or xp?
PDA

View Full Version : Is there any universal breakpoint like "hmemcpy" in win2k or xp?

chenl
03-05-2002, 05:18 PM
I am using winxp and driver studio 2.6. I have cracked some software in win98,but I can't crack them again in winxp,because I can't determine what breakpoint i can use. I have tried "messageboxa,getwindowtexta,getdlgitemtexta......" and softice does not break. Please help me! Thank you!
DakienDX
03-05-2002, 05:34 PM
Hello chenl !

Why haven't you searched this forum before posting?

There are more than five threads explaining precisely that there is no hmemcpy in NT, 2K and XP and nothing which get's close to it.

Then there is the question if you can set any breakpoints. Try breaking on some API in Win98 and then try it again on XP. If it fails, it's a "SoftICE on XP" problem and you've a reason why it is not breaking.

Finding a solution for your problem is more difficult. Please do not start a new thread here since it has already been discussed by many people with the result that there is not result.

No general way is known to make SoftICE work on WinXP if it doesn't happen to work.

Just try to find an answer in the older posts. If you don't get it working after that, there is probably no solution.


ASProtect API Emulator DLL (LapTonic Help!)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect API Emulator DLL (LapTonic Help!)
PDA

View Full Version : ASProtect API Emulator DLL (LapTonic Help!)

foxthree
03-05-2002, 05:56 PM
Hi:

Recently I've been investigating patching the APDFPRP 1.61. In this regard, LapTonic gave an excellent link for ASProtect API emulation ( to overcome the Push 04, Push ffffffff, GetProcAddress problem )

However hard I tried to follow LapTonic's 2-3 line hints <grin> and apply my mind, I'm still not successful.

Any tutorial/hints/tips from LapTonic/+spl/\j guru/ others is greatly appreciated and gratefully analyzed ;-)

Thanks wizards,

Signed,
-- FoxThree
crUsAdEr
03-05-2002, 08:56 PM
Hi Foxthree,

I might be wrong but the impression i gathered is that section of the registered program in encrypted and will be decrypted through this routine so the API emulator is not going to help much...

You still have to reverse the decryption routine and bruteforce it to make it decrypt the code fragments...

But then i am not sure... working on some simple cryptography right now to get the hang of it before i come back to this program :>

All the best, :>
LaptoniC
03-05-2002, 11:39 PM
binh81 is right, this emulator returns just 1 after function 4(decrypt code).I have tried this dll on your program but whenever I add my dll import it just crashes after quit.However, if you want to learn how to use this dll here is my quick tutorial

1) I have added some 00 s at the end of dumped file.I guess add import function of peditor is little buggy.You should have enough room to add new import.Before adding new import add some nulls at the end of file lets say 100 or 200.
2) Click on imports tab andright click on one of the imports and choose "add import".eneter asprapi.dll as dll name and ASProt1 as function.Dont forget that dll must be at programs directory.Run this file.If program runs without error you did it.If it gives error.That means Peditor's damaged import table.So go back to 1 and add more nulls.
If it is succesfull you will find one text file which is like DUMPED_.exe_IData.In these text file you will find something like
ASProt1 - call dword ptr [004860F2]
which is as hex FF15 F2604800

3) What we want is to change getprocaddress pointer.First of all we find the address of getprocaddres function.I have opened my dumpedfile with peditor and searched getprocaddress function I have found these

RVA Offset Hint
84C5C 84C5C 01A3

I opened my dumped file and go to my import table address which is 00084000.I have searched

5C4C08 we are searching in reverse order to find its pointer.

I have found that at 40768H which is 440768 as virtual address.
So getprocaddress function is refered as

call dword ptr [00440768]
which is as hex FF15 68074400

So search for FF15 68074400 and replace with FF15 F2604800

If you want to try this approach I can suggest you to look

Advanced Administrative Tools
hxxp://www.glocksoft.com
I have cracked v4.5 with this approach and it worked perfectly.
foxthree
03-06-2002, 04:20 AM
Hi LapTonic:

Thanks for your post. I'll give it a try.

Signed,
-- FoxThree


Monitoring software ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Monitoring software ??
PDA

View Full Version : Monitoring software ??

TrixMan
03-06-2002, 10:43 AM
Hi all !

Wha't kind of software do i use if i wan't to monitor
all changes to my system that's a new program creates ??
I want too se if it's hiding som files in strange places and
maybe in the boot section on my HD.

Regards
TrixMan :)
neviens
03-06-2002, 02:41 PM
Try InCtrl5 !
Neviens.
DakienDX
03-06-2002, 04:04 PM
Hello TrixMan !

Go to http://www.systeminternals.com. There you'll find anything you might need. And it's all Freeware. :)
TrixMan
03-07-2002, 07:58 AM
I think i found what i was looking for .

Thank,s

TrixMan


RegOrganizer 1.3B4: Questions and More Questions (sv / +spl/\j guru!)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RegOrganizer 1.3B4: Questions and More Questions (sv / +spl/\j guru!)
PDA

View Full Version : RegOrganizer 1.3B4: Questions and More Questions (sv / +spl/\j guru!)

foxthree
03-06-2002, 06:52 PM
Hi Folks:

I'm literally at my wits end with Reg. Organizer. It all started with me reading +spl/\j guru's post of ASProtect 1.4!!! ;-). I wanted to try out Reg. Organizer which has two weirdo Asprotect functionality.

(1) As +spl/\j mentions, we no longer have our GetWhatWeWantAPIs in one convenient place. The IAT is full of holes (Thanks to sv and +spl/\j for an earlier post for clearing my doubts about this)

(2) Asprotect does double dipping! (Still not clear about this one)

See I've managed to work out part 1 perfectly. But whenever I attempt to understand Part 2 of the trick, I hit a empty wall.

Moreover the problem is compounded by the fact that this particular target is updated weekly (the week before last was Beta 2, last week Beta 3 and now Beta 4) hence I'm unable to get reference values for understanding Part 2.

So, with all my frustration growing inside me, I finally dled 1.3 B4.

I've managed to find the following:

1. ASPR dips into code at 00412A7C
2. Back to OEiP at 00401000

Now the problem I'm having is: Where to dump? Should I do it at 00412A7C or at OEiP (like we do always). +spl/\j mentions to dump earlier and patch the jmp 00401000. But my question is How this is done? In my disassembly (after dumping at 00412A7C) such an instruction is not present.

SV mentions the same thing about RegOrg 1.2Beta 3 ("There is a call (412d34) to do before OEP (401000). "). I also have a similar situation (412A7C before 00401000).

Again, how is this done? Should I dump it at 412A7C? After that what, because again after doing some init at 412A7C, we go back to aspr. So if we dump here, we still have some unpacked code, right?

To add to all this, there is a good tut by nchantA where in he explains how to unpack EBook Processor 2.2. I'm having the exactly similar code layout when I break at 00401000: I have a jmp 00401012. Now in this tut, he says that to look down until the first jmp occurs. In our case it occurs at 00526C88. So according to his tut, OEiP RVA = 126C88 and he does a /pedump in icedump.

I did the exact same thing but when I run my rebuilded app, it crashes at 00526C94 (Invalid Page Fault :-<)

What am I doing? Please please please clear my doubt. I'm going crazy with this!

Signed,
-- FoxThree

PS: Sorry for this lengthy post but I needed to get this one off my chest ;-). Thanks once again to sv and +spl/\j for helping me out with the earlier "IAT hole theory"
foxthree
03-06-2002, 07:00 PM
Hi:

Sorry me again <grin>. I'm attaching my rebuilt IAT.txt file for reference.

Pls. pls. throw some light on this one....

Driving me kwazy.... :-(

Signed,
-- FoxThree
crUsAdEr
03-06-2002, 09:09 PM
Hi Foxthree,

Think Spl/\j has been busy, he hasnt posted anything for weeks... my post redarding this initialisation wasnot answered either... guess noone has yet to find out what AsProtect really does in those "dip in"..

I tried to see what AsProtect does when it dips into original code, but i did not gather much... anyway, as Tseph and Spl/\j has pointed sometimes ago... if you skip those two initialisation and then dump at OEP = 401000 as usual then it works no problem...

Yeah, i did that and have a working dump now...

Hope that helps.
+SplAj
03-07-2002, 07:19 AM
Hi fellow RCE's. It makes me happy to see 2 new guys here (bin81 & fox3). I have seen all your posts and you are making some good contributions. Thanks and welcome.

hmmm D-D....

I thought It was made it clear that in *most* cases the reason for D-D is to Initialize some memory and/or set some variables BEFORE OEiP as an anti-dump measure.

There are a couple of things to do (after learning a LITTLE ASM) :-

1) At 1st dip manually RET back to ASPR WITHOUT calling the code
and DUMP at OEiP. ie SKIP this call.

2) Let the code run to OEiP and then DUMP... and manually CLEAR the .data area that has been flagged with 'initialized ok' and/or variables set with hex editor.

Ok.

Rebuild IAT etc etc.

Now EXAMINE the code at OEiP. Is there enough space to CALL 1stDIp code and let it RET as is ? For me with RO v123bulit on 19th January I did the following. :-

OEiP 401000
1stDip 419A2C

So at OEiP re-coded to CALL 419A2C and then immediately after JMP 401012 to skip some unwanted bits ? and continue. This worked for me. However what i would recommend is to find a spare block of 000000000000000000 to code some changes.

ie change OEiP to your new location and then CALL 1stDip and then JMP OEiP

hmmm is that enough ?

Ok i'll d/l the latest RO and maybe I can help you exactly- if we all get the same build !!!

Also use LordPE to Dump/hex edit. It's the best way so far.

Spl/\j

PS. I was busy...... then had an accident, so I spent a few weeks with the men in white coats :) but i'm back now, not full time tho.
sv
03-07-2002, 09:36 AM
Hi foxthree

As +SplAj said, i have done exacltly same process :

Dump at 401000 without call 419A2C execution.
Rebuild and paste IT.
Recode a small code at free space : call 419A2C & jmp 401000.
Change EOP to this piece of code.

I don't remember if there is an indirect call, sometime used in ASprotect :(

Regards
SV
+SplAj
03-07-2002, 06:05 PM
Hello again
and special greets to sv ...BIG hello m8 :)

now I can confirm the following regarding RegOrganizer v1.3b4

OEiP 401000 duh !
1stdip 412A7C

Break at 412A7C and make EIP to the RET. Or clear the area around offset 0x1CA980 to reset flag/variables with 00 for about 50 bytes or so ;)

ImportTable has 505 entries from 1D1134 TO 1D212C

Tricky API :-
Line 35 1D13F0 == FreeResource
Line 38 1D13FC == GetCommandLineA
Line 40 1D1404 == GetCurrentProcessId
Line 59 1D13FC == GetModuleHandleA
Line 62 1D145C == GetProcAddress
Line 76 1D1494 == GetVersion
Line 104 1D13F0 == LockResource

make new IAT/IT to fit 0x2C1000 save as IAT.bin and use LordPE to add section from disk. Fix up header etc etc....

replace ASPR high call at RVA/raw 0x199398 == 8C 2D 41 (call 412D8C)

D-D fix :- make bytes at RVA/raw 0x1000 == E8 77 1A 01 00 EB 0B

401000 CALL 412A7C
JMP 401012

That's ASPR 1.4 gone :)

Spl/\j
crUsAdEr
03-07-2002, 07:15 PM
Hi SplAj, *the arrogant bastard* :>

Yep, thanx for the welcome thought, I have never received so much help and guidance before and I should be grateful to the board and the people here ... Yep, Thank you all...

OK, back to business... :>... so far my finding for Reg Organizer is that the dip at 412A7C allocate heap memory and set up initialisation flag like you said... also i think it check for the key file "regon.bin" with the hash table to check our registration status...

I skipped this dip and dumped at OEP 401000 as you said, rebuilt IAT and the dump runs fine without calling 412A7C... thus I reckon 412A7C is some kind of addon by AsProtect when the programmers select key file protection feature in AsProtect... hence there is no need to call it at OEP.... i am not sure though...

However, the OEP at 401000 does look weird...

That is all folks, :>

PS : Hope you have recovered from the accident, SplAj :>... Take care when you drive around next time...
foxthree
03-07-2002, 07:48 PM
Hi there:

Firstly my humble thanks to +spl/\j guru for his posting on this topic. Hope you're feeling better!

Now, I clearly understand the double dipping concept. Yes, ASPR uses this to initialize some memory flags to prevent dumping... but just ret at the PUSH EBP instruction and we can dump all we want ;-) (Once again, my thanks to +spl/\j/SV... )

Still I have two small questions for SV: <grin>

1. Since we've bypassed the original call, why do we need to change the OEiP and CALL 412A7C and then jmp to 00401000. If you disassemble the dump, what you see at CALL 412A7C is a simple ret (which we'd coded earlier for dumping).

So, I think this step is not needed. Correct me if i'm wrong but this step is only needed if you adopt +spl/\j's 2nd method of allowing ASPR to do the initialization and then dump at OEiP and then resetting all the unncessary variables (that cause Page faults btw :-<) to NOPs heh !

2. What is meant by indirect calls? R u referring to redirected calls?

Once again, I learnt a valuable lesson in unpacking today. RegOrganizer is no more (not patched yet but unpacked... yes!)

Like +spl/\j writes in his tutorials, "Patch and play" <grin>

Signed,
-- FoxThree
crUsAdEr
03-07-2002, 09:10 PM
Fox3,

u got it wrong, both Splaj and sv meant said that you use "r eip" to skip the call 412A7C, not patch the byte there with a "ret"... which might be bad sometimes if the actual ret is "ret 4" or something like that, u might cause a stack fault...

Hence, they both still called for 412A7C at OEP again...

I think so at least :>

Regards,
sv
03-08-2002, 08:56 AM
Hi foxthree, binh81, (yo +SplAj ;) )

"1. Since we've bypassed the original call, why do we need to change the OEiP and CALL 412A7C and then jmp to 00401000. If you disassemble the dump, what you see at CALL 412A7C is a simple ret (which we'd coded earlier for dumping). "

As binh81 said, when landing in at 412a7c, i just change manually eip to only do a ret (no patching) and continue tracing until 401000. Perhaps this call is no needed to run unpacked exe (humm), i haven't tested !

"2. What is meant by indirect calls? R u referring to redirected calls? "

Sometime in Asprotected exe, when tracing , you land in some code like mov [5cafa4],eax with eax = e2c9a0, and at this location (asprotect code) there is code like call [xxxxxx] where xxxxx contain 5c55a0.
You just have to change at 5cafa4 right value : 5c55a0.
This exemple is about last Tag&Rename ;)

Redirected call is more explicit !!! :)

Regards

SV
foxthree
03-08-2002, 09:04 AM
Hi Folks:

Firstly thanx to +spl/\j (u're da man ;-)), SV, my buddy binh81 (hi there) and others who have actively posted their solutions to overcome ASPR D-D.

I personally think D-D is finished !!! <grin>

Thanks again for your analysis, folks.

Signed,
-- FoxThree
+SplAj
03-08-2002, 04:36 PM
Hi again

the 412A7C call can be missed out - Evaluator and I discussed this point about previous versions of RO. However I am highly suspicious that if this call is NOT made then using it on ur registry could cause a major fuckup on ur PC :(

The redirected call is the one at offset RVA/raw 0x199398 == 8C 2D 41 (call 412D8C) . U can see this cos at startup massagebox comes up about cannot read memory blah blah. Just trce this call in original target and you will see the code call is 412D8C. Again the unpacked target appears to run anyway after the mesagebox....but do you trust this program with ur regitry ....

BTW I can't walk, never mind drive yet........poor me sob sob.

cya

Spl/\j
foxthree
03-08-2002, 05:45 PM
Hi +spl/\j:

As they say in Star Wars: "The training is now complete!" <grin>. Yes. I got what you said. I'll try again later today.

Thanks once again for your gracious contributions.

Wish you a very speedy recovery.

Take care,

Signed,
-- FoxThree
foxthree
03-08-2002, 07:31 PM
Hi +spl/\j:

The "learning" is complete now. Thanks for all your gracious help!

BTW, can you up the discompress.com. I believe newbies like me can do a lot of learning by reading your tuts. Does it have a mirror?

Thanks for sharing ur wisdom,

Signed,
-- FoxThree
+SplAj
03-08-2002, 10:02 PM
hmmmm....

I have been asked several times for 'discompress' site'. I thought I had a god angle when I started 2 years or so ago on it. But actually, if you get all the packers/protectors from exetools or wherever and pack Notepad.exe...you can soon gain good experience from unpacking it cos you know the header already.

....and thats my point....learning the basics of PE format especially IAT/IT gives a good grounding for unpacking.

I must say the new tools like RV/Imprec/LordPE/Icedump with tracer make the task a lot easier these days so I don't think there is any real need for a disco comeback......just yet.

Spl/\j
crUsAdEr
03-09-2002, 12:11 AM
Hi Spl/\j,

Yep it is me again :>... worry not i am not chasing your arse for the unpaxor king post... not YET :>>>>>>>>>

Hmm... okie, there were a few call into original code section by AsProtect in the decrypting process, the first one was a simple ret, nothing else, the second one was the one that change the memory location [599398] (originally store 412D8C) to a redirected call in AsProtect memory, the third one is the long dip which access file "regon.bin" and check it with the hash table....

I skipped all these dip back and dumped at OEP 401000, the dumped runs fine without any further patching, no error message box at start up, i did a test with registry cleaning and as well as tried to delete some registry entries... it works fine no problem... I used the 1.3 beta 4 version....

I have tried with other AsProtected apps that have dipped in

Advanced Link Catalog : dip in check serial in registry... i skipped this dip in and dumped at OEP, no patching needed to call the skipped procedure....

Website Watcher 3.4 : dip in check keyfile... no patching needed either....

Chameleon Clock 2.51 : dip in initialise options saved by users... check if registered user then allow initialisation if not set back to default start up options... This call has to be made for the program to run properly....

I have yet to find any other AsProtect apps that have dipped in to conduct further research.. maybe u guys can put up some links to AsProtect Apps with dip in....

So far, only Chameleon Clock requires to patch OEP to call the skipped procedure... i think more work has to be done on this to confirm it....

That is all i have for now....

Cheers....
Kayaker
03-09-2002, 05:39 AM
Hi guys,

I don't know if you're interested in what's happening in those
double-dip regions, but here's something you can play with.
Softice Backtrace outputs of the complete double-dips at
412A7C and 412D8C for RegOrganizer 1.3b4.

It's not quite as informative as manual tracing and having the
register and variable values on hand, but it might be handy to
make it easier to follow the action, scribble notes, home in on
certain areas, or whatever. Consider them Cole's notes ;)
These are the exact sequence of code lines executed in each
double dip in *program* code, not including any jumps to
packed code. But, you should be able to source those out from
your IAT dumps or from within SI.

Here's the idea. As an example, from the 412D8C D-D is this line,
which you could find by manual tracing:

592526 FF254C145D00 JMP NEAR [5D144C]

Now you've all done this before in searching for redirected IAT
entries.
5D144C contains a redirected address in packed code:

:dd 5d144c
016F:005D144C 013B5FA0

:u13b5fa0
; Emulated API code
0167:013B5FA0 2BD2 SUB EDX,EDX
0167:013B5FA2 681A1DFABF PUSH BFFA1D1A
0167:013B5FA7 64FF32 PUSH DWORD PTR FS:[EDX]
0167:013B5FAA 648922 MOV FS:[EDX],ESP
0167:013B5FAD E95217BCBE JMP BFF77704

:ubff77704
KERNEL32!GetModuleFileNameA
0167:BFF776F7 2BD2 SUB EDX,EDX
0167:BFF776F9 681A1DFABF PUSH BFFA1D1A
0167:BFF776FE 64FF32 PUSH DWORD PTR FS:[EDX]
0167:BFF77701 648922 MOV FS:[EDX],ESP
; jumps into the API here, previous 4 lines were already emulated
0167:BFF77704 8B4C2410 MOV ECX,[ESP+10]
...

So
JMP NEAR [5D144C]
is a redirected call to GetModuleFileNameA. In the trace outputs,
all the "JMP NEAR [xxxxxx]" will be redirected API's. In the
412D8C D-D many are to EnterCriticalSection and
LeaveCriticalSection, but a few are to GetDC and similar User
API's, including DrawTextA. I don't know what that is exactly,
but perhaps it's how the registration info is drawn into the
About box. Just a guess there, but quite possible if this is the
code called for that, and is normally missing if you skip that D-D
before dumping, but doesn't affect the program operation.

Anyway, just something to look at, it may make no sense to you,
but if you want to explore these DD regions closer then you can
have these on hand as disassembly outputs. They won't give
you all the answers since we haven't implemented a tracer
function yet that traces the redirected addresses, but go ahead
and make what use you can of them. They're big, 17000 and
30000 lines of code in the two DD areas. Probably blow you
away and is of no use if all you want to do is unpack the proggy,
but if you're curious, go for it ;-)

You can do a text search for "JMP NEAR [" (note there's a
double space between jmp and near) and this will quickly get
you to each redirected API call.

It was interesting what binh81 mentioned about the DD areas
doing slightly different things on different apps. Asprotect must
use the DD implementation to do different things depending on
how the user set up the options during packing.

btw, I had to break them into 2 files. One of them I RARed then
zipped, the other is just zipped. I kept having CRC errors on the
d/l's so hopefully these will now be OK after several attempts.
Around 100K for the first, 70K for the second.

Have fun,
Kayaker
Kayaker
03-09-2002, 05:43 AM
And here's the 2nd one


rv 1.3 bug
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > rv 1.3 bug
PDA

View Full Version : rv 1.3 bug

jsteed
03-06-2002, 08:07 PM
tsehp,
I tried using rv 1.3 to rebuild the IT for Table.exe from w*w.chemtable.com. OEP 57F7D4, RVA 19649C, Length AE4. Yes, they are the same guys that make RegOrganizer. I found that the first thunk overwrites the first few bytes of the names. This problem does not occur with rv12b9. I've attached the bin files from both versions. This problem does not show up when rebuilding RegOrganizer. The problem may be that kernel32 is divided into several pieces in the IT. That is not the case with RegOrganizer. The other possibility may be that this IT is quite large. In any case, great tool!
JSteed
+SplAj
03-09-2002, 11:39 AM
ah well shit happens :(

I tried to rebuild CV3.3 and the same prob occured. KERNEL32 text was overwritten......bin file fuxed.

I sent a message to tsehp just now and I am sure he cn fix it ASAP... this has happened before. Just a buffer size prob I think ?

Spl/\j
tsehp
03-17-2002, 01:15 PM
fixed now, the 0000 entry bug wasn't fixed everywhere in the program.

thanks to rv debug team for help.

tsehp


Unpacking Kazaa - unvisiable for the boss :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Kazaa - unvisiable for the boss :)
PDA

View Full Version : Unpacking Kazaa - unvisiable for the boss :)

the snake
03-07-2002, 09:27 AM
Hi evryone
Its been lon time since my last post or from doing any reversing/cracking, nice to come back here, even if not evrything go smooth.. :(

With the graet speed i have at work, i like to download large movies using Kazaa, but i hate the Icon in the system tray, i guess my boss knows what it is. I think that to replace this icon with a plane gray icon can do it :) Hard to imagine that the software is running.

Using Procdump, i could unpack it, PEPack, but then, the program still can't run or modiffied by Exescope. Maybe something needed to re-build or whatever ?

Hope someone can help with this...
www.kazaa.com (i don't think anyone don't know about it :) )

the snake

Sorry, my homepage was "jailed" by Fortunecity 2 days ago, hope to re-upload it soon, somewhere..
sv
03-07-2002, 10:44 AM
Hi Snake !!

I have unpacked this one !
You have to dump at EOP 4c3a8e and rebuild an IT 513000 -> 5138FC.
I have tested it and it seems to work.

Include Import Table.
sv
03-07-2002, 11:00 AM
Hi

I haven't checked res :( and you have some error with exescope on rebuild exe .. but .. i have coded a resource rebuilder ;)

It haven't be used still .. today !!!!

My rebuilded exe have IT rebuilded section at 353000 3000 size
and Rsrc section at 356000 12c000.

If you want resource section at another location, tell me.

With Size limitation, i can't attach this file (168Ko zipped)
mail me : sv_reverser@yahoo.com

(Icon seems to be ID 128 or 283)

Regards
SV
ijsman
03-13-2002, 08:23 AM
can't you try to just hide the icon, with a program like wonderful icon? the whole program is running but invisible!
the snake
03-18-2002, 12:11 PM
Hi ijsman
This thread will become OT, but just to say thanks....
When kazaa run, even when with full screen, there is still an icon in the system tray.
Wonderful icon can handle the main window OR the icon in the system tray but not both... Thats as far as i could learn about it with the limited time i had.
(if i'm wrong, please e-mail me)

thanks again
the snake
ijsman
03-18-2002, 12:17 PM
oops, yes you're right, i tried it also, it seems to only work well for programs that are not in the tray, there should be a way to hide it though.


Problem to use WriteProcessMemory
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problem to use WriteProcessMemory
PDA

View Full Version : Problem to use WriteProcessMemory

RatDeLabo
03-07-2002, 09:39 PM
i'm working on a certain dll. i've written a little proggy that patches, loads, uses, unloads then unpatch this dll (i want it to stay "bugged").
this solution is not very elegant, and i want to use WriteProcessMemory;
i've read several essays, but didn't succeeded to use it correctly.
in the examples i've seen, the executable is loaded with CreateProcess, but i use LoadLibrary, so i don't have the right handler.
does anybody have a solution for this ?

thanks
Solomon
03-08-2002, 02:23 AM
DLL resides in the same process space as your loader. So u can use GetCurrentProcess( ) to retrieve a pseudo handle. Also you can directly assign a value to a certain address if it's not write-protected.

HMODULE hModule = LoadLibrary();
char *p = (char *)hModule;
*(p + RVA_to_patch) = Patched_Value; //patch it
RatDeLabo
03-08-2002, 09:46 AM
thanks !
i'll try this this week-end
RatDeLabo
03-14-2002, 04:01 PM
the process is write-protected... so i don't know how to make it.

but someone gave me libs & objs / headers from this dll...hehe


Challenge to all you so brilliant people...with motivation ;)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Challenge to all you so brilliant people...with motivation ;)
PDA

View Full Version : Challenge to all you so brilliant people...with motivation ;)

Snatch
03-07-2002, 10:05 PM
Well there are some who think they are the world and can crack everything so here is my challenge to you. You want $100,000. Rhetorical question. Yes, you do.

http://www.bodacion.com/bodacionChallenge.html

Interesting to see if anyone ever does break it ;).

Snatch
Woodmann
03-08-2002, 01:08 AM
Howdy,
How the hell can you figure an encryption scheme
from a text file?
I think their 100,000 is safe unless they allow cheating,
which they dont ;)

Peace, Woodmann
Kythen
03-08-2002, 06:15 AM
Eh, don't waste your time. Think about it a second. You can fit an infinite number of functions to a given set of numbers. I could do some statistical stuff on the 999 numbers and come up with some function that passes through all of them. Doesn't mean squat as the company could have chosen an algorithm that works out to being an entirely different function that also passes through those points. Unless they give the algo, they're not accomplishing anything with this lameness.

Just my sqrt(2) cents worth

Kythen
Snatch
03-08-2002, 11:26 AM
Hehe I guess you guys are right in some ways. Though I think their reason for doing this contest is that they dont want to try to break their code they want everyone else to it is free security testing in essense. But I guess some challenges are better than others and a sequence of 999 could fit infinite possibilities though its unlikely that you could find many and if you did find one it probably would be submitable but wrong I guess. Alas maybe not so great a challenge but if you get lucky or what not you will still rake in some cash ;).

Snatch
koyaan
03-08-2002, 03:51 PM
did someone sign up for the challenge?

i'd like to see the "bodacions" but i dont have a usable
e-mail adress atm

i gonna be so rich MUAHHAAA
:D

cheers
koyaan :)

PS:

did you notice their HYDRA webserver project?
pfft :) sounds funny

HYDRA is a revolutionary Internet server built without an operating system from the ground up to be totally secure. Based on a hard real-time embedded architecture
HYDRA is unhackable, virus-proof, and features on-board strong SSL encryption
mike
03-08-2002, 04:28 PM
The only description they give of the series is

x_n = p(x_(n-1) + i)

They don't say what p or i are, although p has to be nonlinear to match their description of the orbit.

I've written for more info on p & i and will post in RCE Cryptographics if I get any response.
Woodmann
03-08-2002, 09:27 PM
I have the 999 bloWdacions.
I just need to find away to automate the answer process
so I can start guessing :D

Peace, Woodmann
mike
03-08-2002, 09:32 PM
From the webpage:

<quote>
This is a "Show Your Work" Problem
To make sure that you did not just guess an arbitrary bodacion, you must be able to demonstrate that you have cracked the code by presenting all your work, and by being able to crack any series of bodacions.
</quote>
Woodmann
03-09-2002, 01:59 AM
errrrrrrr,
I'm gonna guess anyway.......
I dont see any other way to arrive at the answer
in my lifetime.
(I'm old) :D

Peace, Woodmann
mike
03-10-2002, 02:49 AM
If you have the actual equation, you can do lots of things to get the answer. That's what cryptanalysis is all about. Of course, you may end up needing 2^20 or 2^32 to break it, but that's still small enough to be a reasonable attack. It won't get you the $100K, though, and that's why this challenge is bogus.

--Mike
mike
03-11-2002, 06:17 PM
h**p://www.bodacion.com/challengeFaq.html

"You use the formula x(n) = p(x(n-1)+1)to describe your bodacion formula. What do the variables mean and can you provide some more information on this formula?

This is a simple progression formula that illustrates a mathematic relationship between the bodacion x(n) and the position n in the Raki series, with a multiplier p. The method of selecting the values for the parameters p and n is patent-pending. "

Apparently it's a 1, not an i. This looks like it'll break easily.
mike
03-12-2002, 04:52 PM
OK, since the additive constant is 1, they have to be using numbers smaller than 1 to get chaos; otherwise they would increase in size. That fits with the claim that they use floating point. A cryptographic hash function could completely obscure even a counter; I doubt they're using something that sophisticated, but it makes the analysis almost impossible.

There's some fudgy words about the form of the bodacions in the faq; it sounds like they don't use this hash in the product.

More and more bogus.

Hi Mike,

To answer your question about Bodacions, they use floating point arithmetic.
Regarding the hash function, no, we are not able to disclose that at this time.

Good luck!

Bodacion Technologies

>Thank you for your last response! It was very helpful.
>I have two more questions:
>Do the bodacions use integer arithmetic or floating point?
>Are you willing to disclose the hash function?
Woodmann
03-12-2002, 08:44 PM
Hi Mike,
So they dont use THIS hash function in the product.

I still think this is all bullshit.
If they wont give out any more information to back up their claims then this IS nothing more then a guessing game.

Your correct.... this is bogus.

Peace, Woodmann
foxthree
03-13-2002, 12:22 PM
All the same, folks, it is interesting stuff (though crypto challenges are not entirely a new idea :D).

I entirely agree with Mike's postings. This is what cryptanalysis is all about. You'll have to guess the algo as will as its insides :( Hard work eh! and I don't mean this because of the prize money as we all know this is surely a bogus...

As +ORC used to say "Reverse for Knowledge" :cool:

Signed,
-- FoxThree

PS: Mike, may be we can PM and discuss some specifics..
mike
03-14-2002, 10:51 PM
Hi Mike,

Yes, this hash is used internally by the HYDRA server.

Bodacion Technologies

Anyone have a copy?
YoungMann
03-19-2002, 11:27 AM
The bodacions are of the form xxx-xx-xxx

After observing closely the 999 bodacions,

i found one digit in 2nd place

x8x-xx-xxx

I am not getting any clue to find other digits.

Any clues for further analysis ?

YoungMann


Unpacked exe and dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacked exe and dll
PDA

View Full Version : Unpacked exe and dll

KillingJoke
03-07-2002, 11:59 PM
Hello all!

I have unpacked some exe and dll in win98 and they have no problem for running.
I have some problem running the same files in nt and xp.

Which information should I check (other than controlling the iat table for correct imports)?

Is there any tutorial or info on this topic?

Thanks a lot

KJ
foxthree
03-08-2002, 05:53 PM
Hi there:

There are a couple of reasons why this wouldn't happen. Like you said, one of them is the IT table. Another is incompatibility in PE Headers.

Just attempt to correct the PE Header to make it WinNT/2K compatible. It should work under XP also.

Signed,
-- FoxThree
Kilby
03-08-2002, 07:07 PM
Check the section attibutes too, as that can cause real problems under 2K & XP.

Kilby...


My softice doesn't work in windowsXP!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > My softice doesn't work in windowsXP!!!
PDA

View Full Version : My softice doesn't work in windowsXP!!!

AllenGnr
03-08-2002, 03:43 AM
After update my system to windowsXP,softice doesn't work anymore,but I very need it,so who can tell me,if there is a new version of softice which can work under windowsXP??
where I can get it?
After all,I still have a little request--if you know softice's newest version's SN,please tell me!Thank you !
JimmyClif
03-08-2002, 03:49 AM
AllenGnr,

http://www.woodmann.net/forum/images/top_search.gif (http://www.woodmann.net/forum/search.php?)
and ya shall find ;)
AllenGnr
03-08-2002, 04:09 AM
Thank you any more.Now I know what I want,and I will try to get it!


W32Dasm 8.94
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32Dasm 8.94
PDA

View Full Version : W32Dasm 8.94

Pyrae
03-08-2002, 08:53 AM
Does anyone know about the changes made from the widely spread W32Dasm 8.93 to v8.94?
Zero
03-14-2002, 07:33 AM
I think it is a fake.
I found only 2 wanna-be-software-download-sites talking about 8.94
As I know is 8.93 the last version.

My win32Dasm 8.93 is dated: 26-July-1998 ! And I am working with it a little longer ;)

It is copyrighted 1998...
Do you really think after over 4-5 years URSoftware (if they still exist) will make a version-jump from 8.93 to 8.94 ?

Maybe somebody made a typo, or calls 8.93 with all the VB-patches "8.94"
Look at the homepage of them:
h**p://members.cox.net/w32dasm/
since years the same... nothing new, latest they talk about is 8.80
I don´t even know if URSoftware is still existing :confused:

So use 8.93 with the patches or change better to IDA

Zero
CirKutz
03-14-2002, 11:01 AM
Well, Zero if you had a look the site claims there is a 8.94 but as you say it has been a fair while with 8.93. So as you suggested it probably is just a VB patched 8.93. And also on the page, it says that it hasn't been tested with Me and 2K so I would guess that URSoftware is on a long break.
Zero
03-14-2002, 11:55 AM
I think it is strange, that some have HEARD about 8.94 (as you can see at w32dasm-page), but there is really nobody HAVING this version. (Strange for a community like us)

However:
Maybe 8.94 was a last release, but not published... Who knows.

Zero
Snatch
03-14-2002, 09:43 PM
8.94 was the last official release but 8.93 is the one that ended up everywhere noone got their hands on 8.94. Now there are lots of fake copies too saying they are 8.94 or 9.00 but they are just patched 8.93s. Here is URSoftware's current web page:
h**p://members.cox.net/w32dasm/

Snatch
Zero
03-15-2002, 08:50 AM
Yes Snatch,
I agree, that there are many faked copied out there.
The site you mentioned is the same I did (see above).

This starts to be interesting:
Will finding the "lost" 8.94 be a challenge like the search for the "lost" tuts of +ORC ?

Hehe,
I can imagine what will happens:
Everybody discusses a topic, where nobody will ever have a solution :D
Wasted time ?

Zero
Pyrae
03-20-2002, 12:45 PM
Just to mystify things a bit ;) :
My guess is that URSoftware might have notified legal buyers of immediately discontinueing W32Dasm's development if there will be as many wrz copies again...(but this is really just my hallu).

On the other hand v8.94 is mentioned on several quite official software sites.

P.S. If IDA had a nice Win-GUI, I'd immediately switch, but I simply can't stand those SAA-UIs anymore (perhaps M$ made me a bit lazy)...


new protector: PE-PROTECTOR
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new protector: PE-PROTECTOR
PDA

View Full Version : new protector: PE-PROTECTOR

Ni2
03-08-2002, 09:53 AM
Hi Fellas,

I have released my protector and I'd love if you all start cracking it ;)

You can find it at http://softsecurity.cjb.net

Hope to hear how you get on! ;)

Ni2
+SplAj
03-08-2002, 04:44 PM
....and that would be the one that ONLY runs r0 tricks on Win98/ME...waste of time m8. Real programs run on WinNT4/2K and XP as well. So whats the point....only to prove you know all about r0 and all those other nice exploits that Win98 allows.

Please make a universal protector f- yes u have to make a *.sys ;) and we would be glad to help u out.

thats my bitchin finished.

Spl/\j
Ni2
03-08-2002, 05:27 PM
Thanks for your comments!

I really want to make PE-PROTECTOR compatible with NT/2000/XP. I didnt do it cos it was a project for the university and didn't want to spend my life at uni testing in all the Windows systems ;)

It's true that I have to make a .SYS to make compatible with NT/2000/XP cos lots of exploits to go to Ring0 in NT have been closed for 2000. Anyway I just need to make a little driver that unprotect the IDT and almost all the protections used in PE-PROTECTOR should work fine, plus an extra work to convert some incompatible protections into NT/2000. I just need some holidays to do it ;)

Anyway, the objetive of PE-PROTECTOR was to prove that a packer/protector can be something very good to protect software. I didnt want to make a commercial application. If I achieved that then I'll be a happy bunny :p

Cheers,
Ni2
+SplAj
03-08-2002, 09:51 PM
hi, im glad you did not take offence, ur win98 effort is quit nice. I liked it but was disappointed with it's W98 restriction...

....and when you do have that 'commercial protector' i offer my services as an offshore tax advisor and set you up with tax free company :)

Spl/\j
tony b.
03-08-2002, 09:51 PM
Just some suggestions on this...
_
Doing r0 under NT2kXP may not be such a great idea... For example,
if you have two different protectors messing with the IDT/GDT/LDT,
the system might bluescreen or get unstable. Also, admin privs
are necessary to install/run drivers. That's like requiring
r00t under U*ix to run any protected program, though the
NT2kXP culture is different and tolerates this, at least
today. This might change in the future, especially with the
recent security pushes.
_
Anyway, just my 2cents, inspired by the SafeDisc anti-SoftICE
driver that needs admin to run my games... it just silently
exits under a non-admin account.

_
Regards,
_
tony
evaluator
03-09-2002, 12:30 PM
Ni2!
1. You sad:"new protector"
But time stamp on "PeProtector.exe" is 14.12.2000.
??

2. protect itself "PeProtector.exe" and
I show to you DEprotected...
It is match NOT interesting deprotecting myNOTEPAD!

-----------
NOTEPAD IS GREAT!
bart
03-10-2002, 08:33 PM
just put

mov eax,dword ptr fs:[30h]
test eax,eax
jns _fuckin_nt_clon

in your code & forget about all those nice things in r0 :))
foxthree
05-13-2002, 08:18 PM
Hello:

I'm trying to unpax PEProtector but it seems to be modifing IDT to do anti-debug. How do i bypass that? Any tips/pointers...

Eval, can i have ur email? PM it to me. I need to ask u something?

Thanks,

Signed,
-- FoxThree
Ni2
05-13-2002, 08:43 PM
foxthree,

Thanks mate! I thought no one was interested in unpacking my little pe-protector ;) You have made me very happy tonight :D

Hope to have some good news from you soon ;) Do you plan to make an universal packer or dumper/rebuilder for it? ;)

Well, I'm a bit sad cos daemon wrote in one article that ASProtect was more difficult to trace than my pe-protector :(

These were his results:

Daemon said:

Name Description Debugging-level (Difficulty)
==============================================

Pecompact Packer *.........
Pklite Packer *.........
PeProt Protector ****...... Coder: Chris's Protector :)
PeLockNt Protector *******...
Aspack Packer/*Prot* ***.......
Asprotect acker/Protector **********
tElock Packer/Protector ******....
SoftSentry Protector *.........
Zcode Protector ******....
PeProtector Protector ********.. Coder: Ni2
BitArts Prod. Packer/Prot *****..... Das neue Titanium... Armadillo Packer/Protector ******.... Das neue soll ganz....
Petite Packer **........
Peshield Protector ??????????
Upx Packer ??????????
Peninja Protector ***.......
NoodleCrypt Protector ****......
Vbox Protector *******...
PcGuard Protector ****......

ASProtect has 2 more asterisks than me :p

Thanks daemon for than comparative in protectors, i think that no one has done that before ;) (At least, i can't read that in computers magazines, TV.... ;))

Regards,
Ni2
Ni2
05-13-2002, 09:06 PM
Sorry evaluator, I didnt see your post and the question that you asked me (until now that I have seen foxthree's post about pe-protector ;)

[QUOTE]Originally posted by evaluator
[B]Ni2!
1. You sad:"new protector"
But time stamp on "PeProtector.exe" is 14.12.2000.
??

Ohhh, yes. It's not new at all. I said "NEW" because it was released for the first time to the public. Pe-protector was sleeping in my computer for one year :p I was waiting for my uni to publish it...but they didnt do that and I decided to do it by myself ;)

2. protect itself "PeProtector.exe" and
I show to you DEprotected...
It is match NOT interesting deprotecting myNOTEPAD!

Uppps, sorry. I didnt know that you prefer to deprotect my protector instead of your Notepad ;) I'll think about that next time ;) . But believe me, if i release my protector protected by itself, I'm sure that some people are going to complain because they want to smell how pe-protector is coded internally....It's so difficult to keep everybody happy :p

Kind regards,
Ni2
^DAEMON^
05-14-2002, 02:10 PM
the table should be corrected... your
protector is much much more difficult to trace/defeat than asprotect is! (i did several mistakes in that list)

(btw: iam currently working on sys driver and other things)

but better email me... to exchange knowledge
^DAEMON^
Ni2
05-14-2002, 02:27 PM
Thanks daemon,

Coming from you (an expert in unpacking) means a lot to me ;)

What do you mean with "working on sys drivers"? (for a company?....or another of your nightmare's protection ;) )

Talk to you soon,
Ni2
crUsAdEr
05-14-2002, 11:46 PM
Hey fox3,

The best way to bypass IDT detection is debugging it with a ring3 debugger with and without softice, compare the value of registers and you will see what is change.. if i remember correctly there was a tutorial by Killby or maybe not him about some bit-art products that access IDT for sice check.. the value of esi has to be something like 6 and not 10h... cant remmebr but the tut is on krobar site.. crunch i think :>... ot maybe softlocx...

Of course, go to Daemon's page :>>... play with bit-art products might help but i dont know... Guess i 'll have to wait for SVK release to play with a win2k compatible version...

Good luck,
crUsAdEr
foxthree
05-15-2002, 07:47 AM
Yo Crus:

Thanks for the heads up on this one. I'll take a look and see what I can find.

Signed,
-- FoxThree
Kilby
05-15-2002, 12:22 PM
I did a bi-tarts tute but it was only for Crunch 2.

I suspect that Splaj or horndog (as I remember) may have been the one who took offence at the other bi-tarts products.

Kilby...
evaluator
05-18-2002, 05:21 PM
Hello, Unpackerz!

Just want share some intresting info.

1. Yep, when Pe-Protector kils INT1 & INT3 then
WINICE 4.05 crashes.
BUT WINICE from DS2.6 dramatically STABLE!
So you can successfully use BPR-wEapoN:)

2. Yep, it anyway detects WINICE 4.05,
BUT not detects WINICE from DS2.6.

RESUME:
Upgrade WINICE: & enjoE with EasY unPUCKing PE-PROTTECTOR:)
Ni2
05-22-2002, 10:08 PM
Hi evaluator!

I think you are the man! :) Only with that you unpacked my pe-protector? Ummm...strange...didnt work for me, i have to learn how to crack ;)

I have released a new version of my mini pe-protector (and this time i packed it with pe-protector itself, as evaluator suggested me ;) So, I hope that this time you all have a bit more of fun than the last time ;)

You can find it at h**p://www.softsecurity.cjb.net

NOTE: still Win9x/Me compatible :p

All da best,
Ni2
evaluator
05-23-2002, 05:25 PM
Hello, Ni2!

Unfortunately, I give my PC to my frends(for help), and I'm currently not aviable for UNPACKING:(

Btw, I checked your PEP with LordPE and it dumps only 00h!
Thats Great:)
evaluator
05-25-2002, 05:58 AM
Hey, Ni2!

I failed for install WINICE on WinME:(
So unpacked you PEP with out DBGER!
& when unpacked exe crushed, I found: because main code jumps in protector's section I just removed.

Question!!!
What option I must choose for protect NOTEPAD
with same trick?!
crUsAdEr
05-26-2002, 10:56 AM
Hi folks,

Talk about adiction :/... i was just bored last nite... and since i has some win98 handy, i digged into No2's protector for a while...

Ni2, you are cruel :D ... if Alexey uses seh more than 30 times, you access IDT about 29 times :D .... doing absolutely nothing meaningful.... i made a few patches and "clean" it up a bit.... still havent unpacked it yet... was interested in how the protection works... however i have a few queries about IDT, maybe some guru can help me answer???

Ni2, i hope you find this familiar :>
sidt qword ptr [esp-2]
pop eax
add eax, 0C
mov ecx, [eax] ; getting int1 handle???
and ecx, 1FFF
cmp ecx, 0E00
jnz sice_not_found??

jmp sice_found???

sice_not_found:
add eax, 1C
mov ecx, [eax] ; getting int 3 handle???
mov loc_1, ecx
mov ecx, [eax+4]
mov loc_1+4, ecx

I was just wondering about the initial sice check??? my thinking is that, since sice hooks int 1, the first proggie checks for int1 handler, compare it with default int1 hadler by sice?? if equal then sice detected???

The later bit is slightly more confusing... after you add, "C" to eax, eax points to int1 entry in IDT, you add another "1C"???? This will bring you rite in the middle of int 4 entry in IDT??? why int 4.. i was thinking it was more like int 3 that he should want to check...

That si all for now, i only have time 2 weeks later, but i do have a feeling once i am done with PE Protect, i will know a lot about IDT just like the way I learnt from AsProtect about seh ....

Hopefully someone can explains my question above.
Thanx,
crUsAdEr
ZaiRoN
05-26-2002, 12:55 PM
hi...
i don't have tried this program so if i'm wrong...forget my words.
int1: your analysys should be right.
int4: this is a strange int...i don't know if it's your case but sometimes it's used to go into ring0:

pushfd
pop eax
or ah,80h
push eax
popfd ; if overflow flag is set
into ; then: ring0!!!

if the overflow flag is not set the into instruction is only a nop.

ZaiRoN
Ni2
05-27-2002, 05:45 PM
First, I'm glad to hear that some of you are trying to crack my old pe-protector. Almost two years have passed since I finished it and I released some progs protected with pe-protector for you to play, so I'm glad it's still "alive" ;)

Well, Evaluator, now do you want that I pack notepad with pe-protector? I released the whole protector without packing it and you said that you were bored of packing/unpacking your notepad and you wanted my protector packed with itself....Oh dear, I dont understand you :p Well, when you enable and use *ALL* the features of pe-protector, some extra "magic" code is inserted. There are several ways that the target program references pe-protector code. I dont know exactly what your case is :( Anyway, good work unpacking pe-protector...where can i find the top secret "undocumented procdump"? (Hi Stone! ;))

crUsAdEr, I'm glad your are trying with pe-protector. I dont want you to lose your motivation but you are a bit stuck in the very beginning of pe-protector. I dont want that the trees dont allow you to see the forest :p (Make your maths again..you know 1C.....0C....do you got it now?...and 0E00...is not so difficult, believe me ;))

ZaiRoN, you are right. You should go to Ring0 with that ;)

Keep the good work fellas! and hope to hear from you again soon

Ni2
foxthree
05-27-2002, 06:29 PM
Yo Ni2:

You presume that you've covered all the bases in your PEProtector. Alas, I hate to disappoint you :D... [wink, Crus...]

I've successfully bypassed *all* your anti-debug tricks on Win98. So, it is only a matter of time :)

Hang on :)

Signed,
-- FoxThree

PS: Good Analysis, Crus...
Ni2
05-27-2002, 06:50 PM
Hi foxtree!

Of course I dont presume that i have covered all the bases in pe-protector.

When I did pe-protector, there werent so many good cracker's tools as nowadays. I did my best in 6 months that i had to design and implement pe-protector.

I know that pe-protector is far from the perfect protector....but I still think that +Orc theories about that everything is crackeable can be put in doubts by someone....and that someone will be the chosen one, eheheh

Anyway, congrats for bypassing pe-protector anti-debug tricks and hope you are using the latest pe-protector version ;)

Regards,
Ni2
crUsAdEr
05-28-2002, 01:52 AM
Hi Ni2,

Just a quick report on my progress to make you happy :>

Here is my finding so far
sidt qword ptr [esp-2]
pop eax
add eax, 0C
mov ecx, [eax] ; getting int1 handle???
and ecx, 1FFF
cmp ecx, 0E00
jnz sice_not_found??
jmp sice_found???

sice_not_found:
add eax, 1C
mov ecx, [eax] ; getting int 3 handle???
mov loc_1, ecx
mov ecx, [eax+4]
mov loc_2, ecx
jmp continue_normal

sice_found:
mov ecx, [eax]
mov loc_1, ecx
mov cx, [eax-4]
mov loc_1, cx
mov [eax+1Ch], ecx
add eax, 10h
mov ecx, [eax]
mov loc_2, ecx
mov cx, [eax-4]
mov loc_2, cx
mov [eax+10h], ecx

continue_normal here....

2. ANTI /protect on tricks
CLEAR bpm?????
sidt qword ptr [esp-2]
pop ebx
add ebx, C
mov [ebx], 12345678h
mov ebx, [ebx]
call $5
pop ecx ; points to current eip
add ecx 12h ; point ecx to a few bytes below
xor [ecx], ebx ; Decrypt the instruction

3. Hook int3 to decrypt code... use int3 handler to decrypt code with dr values... hence foil any bpm used!!!

4. bpx checking
cmp [eax], CC ; eax is API address
jne no_bpx
add eax, 100h
no_bpx:
jmp eax

I have bypassed all these, with a little dumper of mine, all of these plus usual obfuscation are cleared... however.. as i have indicated, the first one still baffled me cos i dont see much point of it... is this just your "bad" coding practise of anyhow patching IDT to cause system crash??? or is there something i am missing...

Just a suggestion... you might make dumping harder if you re-encrypt your code after they are executed... or just clear them... cos rite now, i just need to dump once and i have everything to disassemble and play with... but hell, once you do that i wont bother play with the protection anymore.. my aim is to learn anti-debugging and stuff only... however, you ought to help me out here and there :>> ok??:D

Also, dont you think using the same trick all over again is kind aeasy to defeat with a small proggy that parse the dump and clean it up???

that's all for now...

P.S : the thing is that this is the first time i work on win98, and ring 0 stuff... been living in the luxury of a real OS called win2k :>>.. hence i have little idea of how all these stuff work... i realise that i do need more background knowledge on IDT and stuff.. but alas, Windows Programming secret is not on my book shelf :<... and searching gives little details.... anyway... i'll work on this once in a while when i have free time :>>.. great learning experience....
Ni2
05-28-2002, 10:48 AM
HI crUsAdEr!

I'll answer/comment your last post.

I know that you are a bit confused with all those things that pe-protector does. Well, from your point of view it's normal that you are lost. If you dig much more inside of pe-protector, I'm sure that you will understant what that first chunk of code is for (the one you call anti-sice.....the magic 0C + 1Ch ;) )

About the part that I decrypt-encrypt again...I'm totally sure that after entering in the middle of the first hardware decryptor, you will understand why i do that ;) And...are you sure you can make a dump at that point and study the disassembly code in your IDA? Well, I think that the code after that point is more than encrypted (remember the 300 encryptacion layers of pe-protector? ;)

You say that the same trick is done over and over again and you can do a small proggy to defeat that....Ummm, i KNOW that there is no way to make a small proggy that makes that in this case (and if you believe that It MUST be possible...i'm completely sure that after digging in pe-protector you'll realise that i'm totally right in what i'm saying now)

About the:

cmp [eax], CC ; eax is API address
jne no_bpx
add eax, 100h
no_bpx:
jmp eax

Oh dear, that's embarrassing...did i do that lame anti-bpx trick? hehehe...what a lamer I am :p

And well, I see how interested you are in learning new antisice tricks and learning in general, believe me, i'm happy to hear that. The only thing that i can tell you (also to motivate you in learning even more) is that you have only seen a 1% of the anti-tricks that pe-protector has inside. Hope that you can share with us all the new anti-tricks that you are discovering ;)

Grettings to evaluator, foxthree and crusader....the only 3 brave guys that i know that are still trying to crack pe-protector ;) You will succeed mates if you keep like that!

All the best,
Ni2
crUsAdEr
05-28-2002, 06:45 PM
hi Ni2,

Thanx to Clandestiny for the info... I just need checking if my understanding is rite...

sidt qword ptr [esp-2]
pop eax
add eax, 0C
mov ecx, [eax] ; get high dword of int1 entry
and ecx, 1FFF ; get the low word of this
cmp ecx, 0E00
jnz sice_not_found??
jmp sice_found???

sice_not_found:
add eax, 1C
mov ecx, [eax] ; getting int 5 entry (lower dword)
mov loc_1, ecx
mov ecx, [eax+4] ; high dword of int5 entry in IDT
mov loc_2, ecx
jmp continue_normal

sice_found:
mov ecx, [eax] ; get top words of offset to int1 handler
mov loc_1, ecx ;
mov cx, [eax-4] ; get lower words of offset handlers??
mov loc_1, cx
mov [eax+1Ch], ecx ;write to lower dword of int5 entry
add eax, 10h
mov ecx, [eax]
mov loc_2, ecx ; store int3 handler to loc2
mov cx, [eax-4]
mov loc_2, cx
mov [eax+10h], ecx ; write to upper dword of int5 entry

continue_normal here....

OKie, so i was wrong about the int1 handler, this piece of code actually check whether int1 entry on IDT is a "interrupt gate" or a "trap gate"???

The result on ecx should be either 0E00 (interrupt gate) or 0F00 (trap gate)??? I presume that the value at loc1 and loc2 will be used later, but i need to find out more about the way you write to int5 entry like that...

I guess if i dig deeper into the code i will out more... but please comment if i am write about the code above???

Thanx,
crUsAdEr

P.S : 2 nites = 1% ==> PE-Protect reversed in 200 nites = 6 months = coding time :>>:D

P.P.S : wat do u mean by "hardware decryptor"??? i understand hardware breakpoint is bpm using Drx... but hardware decryptor? decryptiong using Drx??
evaluator
05-28-2002, 09:24 PM
Thanks, Ni2 for replay!

As gift, take from me unpacked PE-PROTECTOR.

Write me, if I did something wrong.
Sorry, because of later response. I already wrote,reason. See you after to days!
Ni2
05-29-2002, 01:42 PM
Hi fellas!

Evaluator, i think you did a good work. I havent tried your unpacked pe-protector cos i only have W2K in this computer. Anyway, looking at the entry point and if you have posted it, it's cos you solved all ur internal call [pe-protector] ;) I've been thinking 4 a minutes and i think u have a nice R0 dumper or something like that ;) You must have done an artisan work copying-pasting code, am i right? :p Next time, I'll go for anti-Ring0 dumpers techniques that it seems that is the way that packers can be defeated nowadays (cos they are too complex to study'em line by line....though there are still a few of us that like to smell the code from the OEP to the OEP-Target-Program ;)) (special grettings now to Daemon)...Anyway evaluator, good work and felicitations for that.

About crusader post... well my friend, as you can see i check for the Int 5 (and not 4 :p) in the very beggining of pe-protector code. SICE does NOTHING with the INT-5 so, i wouldnt have a chance to detect SICE (or another debugger...cos i have no idea if another debugger uses INT5 for something ;)). So, do you still think that that is a anti-sice trick? if you goes further in pe-protector code, you should see why i do that (i'd like to tell you but i think that we, crackers, like to discover things by ourselves cos that's the way that we start feeling good in the cracking scene and start being recognised as a "good" cracker ;)) I'm glad cos you have gone to the "trap-gate, interrupt-gate" levels of knowledge in the x386 architecture ;) I'm sure that you will learn a lot soon if you keep always like that ;)

Ahhhh, about hardware decryptors, you are right, i meant hardware breakpoints decryptors (and you already know a lot about them ;))

All the best,
Ni2
crUsAdEr
05-29-2002, 01:57 PM
Hi Ni2,

Thanx... that pretty much clears things up... even though i am not sure aboutt the difference between "interrupt gate" and "trap gate" still... but at least i am on the right track :D

Okie, about the hardware decryptor... i made a dump at the right moment, most code in .Ni2 sections are already decrypted, NOP the int3 instruction and fix the starting offset of kernel32.dll.. that is it.. i have full .Ni2 section disassembled.. though i have not gone through them all... that is why i thought you could have done like cacheX IE, decrypt a small block, execute it, then zero them out before going on to the next block... that way i had to manually dump each code section and fit them it again.. more painful to reverse.... but ah well.. there might be more things that i have missed out... but i did jump when i first see the ring 0 code :>>.. first time i see code playing with Drx :>>>... guess it is not that complex after all...

Thanx for the tip... shall dig into it again once exams are over :>>... soon.. btw, dont you know there are a few ring-0 dumper around :cool: ...

Regards,
crUsAdEr
Ni2
05-29-2002, 03:42 PM
Hi crusader!

I have never seen one of those ring0 dumpers that you say (except icedump or those extension for a kernel debugger). Is there any program like Elicz dumper but for Windows? I heard that there is a version of procdump with a Ring0 dumper (but that version was only internal for the procdump group)

Good luck with your exams! ;)
Ni2
evaluator
05-29-2002, 03:47 PM
Hello, Ni2!

1. I have NOT R0 dumper
2. I NOT traced inside PEPr code
e.g. OEP I guessed (BTW, is it right!?)
Ni2
05-31-2002, 01:17 PM
Hi evaluator!

You guessed the entry point...you are a magician :) I think that you always do that in all the latest protectors (Daemon's protector, SVK-P...) you have good instinct to guess OEP :p Have you ever traced over a current packer? Believe me, it's pretty cool in Daemon's one and SVK-P ;)

So, did u use a process patcher or a modification of that? ;) I dont want to think in how many copy-paste you did to fix the original executable :p

Anyway, a crack is a crack and I congratulate you for that.

Regards,
Ni2
evaluator
06-01-2002, 09:11 PM
Thanks for replay!

I can sey about you:
you are better then DAEMON! Simple because hi not confirmed my guessed OEP!!!

You are SPANISH MAN!

_DAEMON_ is not spanish w_man...

How about comparing protectors? Maybe if you manage same terrible thingz on ntXP your will
coolest:)
Bengaly
06-01-2002, 09:28 PM
lol.
that was a very weird reply evaluator ;D
next time "think before u act", not "act before u think" ;D
but that just a suggestion ;D
crUsAdEr
06-01-2002, 09:40 PM
+++++++++++++++++++++++++++++++++++
Believe me, it's pretty cool in Daemon's one and SVK-P
+++++++++++++++++++++++++++++++++++

LOL, Ni2... I must disagree... patching IDT without proper chaining isnt very "cool" :>... when ever the apps exit on one of those seh.. sometimes IDT are not restored... though you did install some kind of global seh... thus if it exits accidentally, that is it.. my computer cant help but gives a BSOD or just plain reboot/crash... something good better come out of this... cos i dun want my Hardware to screw up...

Till then.. hopefully in 2 weeks you will hear more news :>

Regards,
crUsAdEr

P.S : if my understanding is rite, then "interrupt gate" is the orginal hardware interrupt while "trap gate" is installed by software??? So if Windows itself install a handler over the interrupt, does it set the trap flag?
evaluator
06-01-2002, 09:44 PM
hello, cencey Bengaly!

Many time I not see your posts!
How are you?

Did I wrote something wrong!?
Is phrase:
"_DAEMON_ is not spanish w_man"
logically wrong?
Bengaly
06-01-2002, 10:08 PM
heya Master evaluator ;D
i dont paste much here heh ;D well ur right. ;)
so far i'v been working on some useless pe viewer/packer identifier [win32], probably for fun and knowledge.
and how u'v been doing so far? ;)
thnx in advance [gba hihi ;D]
ben :D
crUsAdEr
06-11-2002, 03:08 AM
Hi Ni2,

Hope you are still well and waiting for my update :>??? Here i am, after a long break... this thread is almost forgotten...

Looks like eval has done a great job of removing your protection, though how he does it is still unknown to me...

Here is my progress updates but i do have a few pointers that need to be clarified, so would you guys please help me out...

More sice check :>>???
5. MeltIce
CreateFileA : sice, ntice, TRW
funny cos you should check for SIWVID instead of NTICE...

6. ring-0 example:
.Ni2:00474A57 E8 00 00 00 00 call $+5
.Ni2:00474A5C 59 pop ecx
.Ni2:00474A5D C6 41 05 CD mov byte ptr [ecx+5], 0CDh
.Ni2:00474A61 90 nop
.Ni2:00474A62 20 C1 and cl, al
.Ni2:00474A64 00 01 add [ecx], al
.Ni2:00474A66 00 EB add bl, ch
.Ni2:00474A68 00 F9 add cl, bh

Self modifying code :>>??? after the move CD, the instruction looks like this
.Ni2:00474A61 CD 20 C1 00 01 00 VMMCall Test_Debug_Installed

7. Another ring-0 but i am clueless about this one, prolly miss out some code before this?
Right at the beginnning of int3 handler
add eax, 20C
mov ecx, [eax]
mov cx, word [eax-4]
cmp word [ecx+3], FFFF
jne debugger_found

8. check fs:[20]
mov ecx, large fs:20h
jecxz short fishy
stc
jmp short continue

fishy:
clc

continue:
jb debugger_found
nop
jmp debugger_not_found

9.Hic hic.. so that was you anti ring-3 dumper trick :>??? Hooking ReadProcessMemory and install it in the PE Header of kernel32 :>>>?? nice idea, though now that i know it, a small patch will do the job just fine... the question is the way you use kernel32.ORD_01???
push 20060000
push 0
push 1
push edi ; edi = 400
; then edi = kernel base /1000
push 1000D
call kernel32.ORD_01

Is this just similiar to VirtualProtect API???

10. finally i am totally clueless about this one
11. check fs:30
mov eax, large fs:30h
test eax, eax
jns something?
jmp else

something:
mov eax, [eax+C]
mov eax, [eax+C]
mov [eax+20h], 1000h
jmp positive_cont

else:
push 0
Call GetModuleHandleA
test edx, edx
jns positive_cont
cmp [edx+8], -1
jnz positive_cont
mov edx, [edx+4]
mov [edx+20], 1000h

positive_cont: here onwards.........

I guess i need "Win 98 Secret" to find out more abt what is stored at fs:[30] but some pointer would definitely help....

Well... well, I responded to your request for some ppl to crack your protector :>>... and i am still learning so i hope you, Ni2, will respond to my request and help me understand certain part...

The quest shall go on i hope :>>... see u then

crUsAdEr
^DAEMON^
06-11-2002, 04:12 PM
well i didn't check the loader code... but it's maybe a check to see "WHO" created this process (anti - unpacking stuff)

^DAEMON^
crUsAdEr
06-13-2002, 07:55 PM
Lo Daemon,

Thanx for the info... i shall have to research further into that...

Anyway, Ni2, where have you gone? You almost tricked me there... when i saw :
mov edi, Image_base
lea eax, [edi+1E47]
jmp eax

Damn, so i know what eval means by it jumps back to Ni2 section... but alas, there isnt anymore antidebugging tricks hence a quick dump and disassembly and scroll will reveal the return to code section :>>... neat trick though cos i was wondering wat the hell is going on for a while :>>...

Guess you are not the one who defy +ORC's saying yet... wat ever runs still can be cracked, but eval has already proven that to you, though how he did it without knowing how the protection work is still a mystery... my guess is that he has a patched version of TRW and hence goes undetected by your createfileA check... Or maybe he uses DS2.6 which of course you fail to detect cos u check for ntice instead fo SIWVID... ah well... maybe he uses some special skill....

++++++++++++++++++++++++++++++++++++++++++++
About the:

cmp [eax], CC ; eax is API address
jne no_bpx
add eax, 100h
no_bpx:
jmp eax

Oh dear, that's embarrassing...did i do that lame anti-bpx trick? hehehe...what a lamer I am
++++++++++++++++++++++++++++++++++++++++++++

You are worse than a lamer :D .. look at your IAT redirection, even worse than wat i posted above... maybe if your product ever go commercialise, i'll do a 1kb PE-Protector.dll plugin for revirgin...

Ah well, wat else??? I cant remember what i have been doing so far anymore, btw, i still dont get wat you were trying to do, patching int5 like that.. cos even ur ExitProcess seh handler only recover int1/int3 handler... unless you were fooling me and it is indeed a sice check trick, if sice detected then mess it up???

Anyway, time to reinstall win98, or maybe remove the damn OS altogether... it cant even detect my modem and printer anymore, thanx to your PE-Protector :>>

That is all...
See ya around, me off for holiday :>>
Dr.Golova
06-15-2002, 12:23 AM
10. finally i am totally clueless about this one
11. check fs:30
mov eax, large fs:30h
test eax, eax
jns something?
jmp else

something:
mov eax, [eax+C]
mov eax, [eax+C]
mov [eax+20h], 1000h
jmp positive_cont

else:
push 0
Call GetModuleHandleA
test edx, edx
jns positive_cont
cmp [edx+8], -1
jnz positive_cont
mov edx, [edx+4]
mov [edx+20], 1000h

Hmm, mov eax, large fs:30h / test eax, eax is OS check (something for NT, else for 9x). mov [eax+20h], 1000h will change on WinNT process internal ImageSize so some dumpers (like ProcDump32) will fail (dump only first 0x1000 bytes or just crash). Yo! It's code for WinNT so it's useless here :) Second part with GetModuleHandleA must do this dumper-phucking in Win9x but AFAIK it dont work (go to positive_cont - I test it on WInME and Win98 :)


Writing an OpCode Generator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Writing an OpCode Generator
PDA

View Full Version : Writing an OpCode Generator

foxthree
03-08-2002, 01:19 PM
Hi:

I was just wondering about OpCodes and stuff and I thought it would be a cool idea to write an OpCode generator for Intel Pentiums. Not that there aren't tools out there already but I downloaded a couple of them and they didn't look that impressive to me (bad UI and bad bad bugs :-<)

So what would it take to write a OpCode Generator? Any good pointers to information is gratefully accepted. (if the site has source code even better ;-))

Thanks,

--Signed
FoxThree
ZaiRoN
03-08-2002, 07:03 PM
hi foxthree,
if i remember well there's an opcode generator written by Neural Noise with the source code. you could try it...

bye
ZaiRoN
DakienDX
03-08-2002, 08:03 PM
Hello foxthree !

What do you exactly mean by a OpCode Generator?

A program which generates opcodes from text? (Why not try TASM/MASM?)

A program which checks if given binary data is valid code?

A program which creates code to make debugging harder?
foxthree
03-09-2002, 07:30 AM
Hi DakienDX:

I was more referring to the one like Zairon... you input some assembly instructions and it generats OPcodes for that. However, the problem with some of the Opcode generators are that they're buggy and generate wrong opcodes at times.

Yes, I came to know that it would something similar to writing an assembler. I wouldn't want to write a full-fledged assembler... not yet ;-). Just one that generates OpCodes.

It was just for my learning...

Signed,
-- FoxThree
Kayaker
03-09-2002, 07:55 AM
Hi foxthree

You could take a look at LDE32 (Length Disassembly Engine) by Z0mbie. It's an ASM module you can incorporate into your code. Would require a loader for the target file, then you give it an address to partially disassemble and it returns the proper opcodes from the sequence of bytes starting at that address.

To actually get the disassembled text you'd need to pass the opcodes to a disassembler. I found LDE32 lacked support for some recent P6 opcodes, but it's fine for the basics.

But if you're going for the full disassembler route, it'd be best to look into something like the NASM source or Borg or some other sourced disassembler.

Just out of curiousity, what other Opcode generators have you found other than Neurals OpGen? I can't think of any others per se.

Actually, I just noticed Z0mbie has a couple of updates and there's 2 interesting opcode programs (using his LDE32) used here:

http://z0mbie.host.sk/opcodes.html

Kayaker
foxthree
03-09-2002, 11:05 AM
Hi Kayaker:

I found this too at protools.cjb.net. However link is broken and a Google search revealed nothing :-<

oPcodeR by Cool McCool. 16.IV.2001.
oPcodeR 1.1 (297K).

News:
- added support for ADC, ADD, ARPL, BSWAP, IDIV, LDS, LES, LFS, LGS, LSL, LSS, SBB, SFENCE, SUB

oPcodeR is another opcode generator. But it doesn't simply generate opcodes from values given in comboboxes. It occupies some sort of built-in parser, which generates byte series from typed instructions.

Signed,
-- FoxThree


AWAVE STUDIO 8.0 Almost done. Final question!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AWAVE STUDIO 8.0 Almost done. Final question!!
PDA

View Full Version : AWAVE STUDIO 8.0 Almost done. Final question!!

chuk
03-08-2002, 02:57 PM
Hi Guys,

First of all, thanks for the help in advance and keep this beatiful forums.

I am trying to crack Awave Studio 8.0 (get as registered user).
I hav gotten to eliminate the nag window, pass the registration,etc.. The file can be obtained at:
zdnetindia.com/downloads...nloadid=7790697

However, when trying to register. I found that there are 3
TEST AL, AL that needs to be ´r fl z´. And you get the window
that you are registered user, however trying to do anything with the program it STILL tells you that you are a unregistered user!.

CAn anybody help, I have 2 weeks with this, and run out of ideas.

The procedure I have followed is:
Load ICedump, run softice, when SICE break, 'bpm 0047E059 x',
F5, and then when the nag window appears try to register and you will break in 0047E059. trace with F10, and ´r fl z´ the following 'test al, al' at the following addresses:

0047E0E0 (make it NOT JUMP!!)
0047E0EE ( " DO NOT JUMP!!)
0047E115 (make it JUMP!!)

Then the program will say you are registered user..but it is not true!

ANy help would be apreciated!!

Thanks in advance!

The^
goatass
03-08-2002, 03:57 PM
Hey chuk, what you did is forced the "Registered" message box to pop up but you didn't register the application at all.
You need to open the dialog that asks for the serial, enter something fake and start tracing from there, don't just try to force the "Registered" message box but try to figure out once the program thinks it's registered what does it do, does it set a flag in memory, does it write the serial to the registry and checks it again next time you load the program.

All the places where you patched the jumps to either jump or not jump you should go back and figure out what would cause these jump to jump or not jump. Instead of patching them figure out what you need to change in the serial number itself that would cause the effect you want on the compare and jump routines.
This will put you closer to making a correct serial number that will register the program like a real serial number would.

goatass
chuk
03-08-2002, 04:16 PM
Hi,
thanks for the Reply. I went thorugh all the previous call and
I see how the calls to Kerenl.SetREgValue with the fake username
and RegcloseKey,etc.. are done, this is done within the 3 jumps i skip. So I supossed that registry was already added..

Any idea?
goatass
03-08-2002, 07:08 PM
Well my point earlier was that you should make the least amount of patches to the code and this way you would have a generic crack. Now that you saw how the serial is inserted into the registry you need to close the program, set some BPXs on registry APIs and start the program up again and trace it as it reads the serial number and username from the registry and see what it does.

I'll download the program and check it out and let you know what I find.

goatass
chuk
03-11-2002, 08:58 AM
Hi,

Hey Goatass, thanks for the help.
I went further into the program and there is string that the program checks everytime you want to do something..guess what the string is "Cracked" ;-).

So I suposse that if the program detects that the evaluation period is over and it is running, it warns itself with that scary string...

Bypassing a few jumps, after a bpm in the address of "Cracked",
you can keep on working.

Still two thing I have not been able to (Help would be appreciated!):

-Complete register.
-Find the OEP.

Thanks in advance in anybody could help!

regards!!
Js
03-11-2002, 01:15 PM
hiya,
in aw studio oep is of little interest to you anyway, check out doubledip (or similar "dessert" sounding threads) and refer to +splaj's essay on previous version for how to dump working
version. It has changed slighly, not much. version I did was 8.1 so can't help with 8.0.
regards
Js
03-11-2002, 01:42 PM
hiya,
tried to edit that last post quick before anyone seen it, as usual I have login problems on this board. can't believe I said "oep is of little interest to you anyway", of course it is. oh well that post will remind (haunt) me to "switch on brain" before post.

you should get your answers from the essay and dd threads though.
SpeKKeL
03-12-2002, 03:54 PM
Yep,

This is allso very nice target Awave 8.2......
Man this makes your day sunny !

Especially the longggggggg call back to aspr after
the prog is unpacked !!(new ???)

Try for yourself,

Signed sealed and delivered,

SpeKK
:cool:


Which OS to learn on?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Which OS to learn on?
PDA

View Full Version : Which OS to learn on?

ptsdmaker
03-09-2002, 04:28 AM
I'm just starting out on my quest to understand what it is that most of you already know. I've been through one tutorial and I learned so much as I went through it that I want to get in even deeper.

The tutorial that I did go through did not use SoftIce although it mentioned it. After downloading v4.05 from several places, I finally realized (after visiting this board) that I wasn't going to be able to make it work on XP.

I have a spare computer, and I have no problems blowing it out and putting any OS on it. My question is, "which OS would be best to put on it?" I've seen a few messages posted on here that leads me to believe that 98/ME/2000/NT/etc... use different methods to accomplish different tasks at times. I have copies of every OS (I believe). But, I don't want to cause myself too much frustration by putting one on that isn't the best.

Anyway, I'm rambling. For tonight I'm going to put ME on the system, but if any of you have any recommendations, I'd highly appreciate the feedback!

Thanks!
crUsAdEr
03-09-2002, 05:02 AM
Windows 98... the easyiest choice i would say, lots of tutorials are written on win 98....

Win Me is bad, either win 98se or 2K Pro SP2 but i definitely go for win98...

Regards,
foxthree
03-09-2002, 07:24 AM
Hi there:

Like binh81 said Win98 is the way to go if you really want to learn stuff. Of course, if you're experienced (like some wizards here) you could try Win2K. It is more stable.

Win98 is much more open (in terms of memory accesses and stuff like that) but less forgiving. Be prepared to reboot "n" no. of times during a unpacking session ;-)

Win2K is more forgiving but harder to place breakpoints etc.

Esp. SuperBPM is the *WAY* to go on Win98. There is no such equiv. on Win2K, unless u write one <grin>

Signed,
-- FoxThree
ptsdmaker
03-09-2002, 07:34 AM
I'll take your words for it. I'm about to start loading it as soon as this thing finishes formatting.

Any good solutions to speeding up old computers.... :) j/k

Thanks again! You just saved me from a wasted ME install......


Anti Sice causes rebooting.....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anti Sice causes rebooting.....
PDA

View Full Version : Anti Sice causes rebooting.....

crUsAdEr
03-09-2002, 05:08 AM
Hi folks,

Recently i have encountered a few progs that causes reboot when sice is detected... i reckon to find out where is the anti sice code, i have to trace the code but the thing is that each time i pass the anti sice code while tracing, i get a reboot and it is really annoying as well as unhealthy for my system.. is there a way to stop the program from rebooting my comp?

I have found System Mechanics which causes reboot but it uses simple melt ice trick so not that much of a problem, but softlocx has many layer of anti sice code, using IDT etc..., also Flash XP (tELock???) also reboot my system...

So could someone tell me what to do with those underhanded tricks??? I would rather spend my time studying the real codes than bypassing these annoying tricks....

Thanx guys,
foxthree
03-09-2002, 07:20 AM
Hi binh81:

I'm sure you know this already but just in case,

If you're running on Win98, try +Frog's Ice. (protools.cjb.net). It masks SICE from *most* tricks.

Otherwise, +spl/\j guru has written a message somewhere here (answering Solomon, I think) about patching SoftICE to make it invisible. He has also attached a detect.zip or something like that that would automate the patching process for SICE.

Just search with those keywords in the forum...

Still if SoftICE is detected, then we'll see ;-)

Signed,
-- FoxThree
foxthree
03-09-2002, 07:21 AM
Sorry I forgot to mention, you could also try ICEDump with /protect on....

Signed,
-- FoxThree
Kayaker
03-09-2002, 07:40 AM
Hi binh81

This brings up some interesting possibilities. While there are many ways to detect SI, there's probably only a handful of ways to reboot your system. To continue tracing in such an app I guess you'd have to deal with each situation individually, but it would be nice to have a general protection that would hook the reboot attempt and at least allow you kill the app before it had the chance to execute the full reboot sequence.

One way an app can reboot your system is by sending the Softice HBOOT command via the BCHK interface with the AL=0Eh - Execute a SoftICE command service. I've rebooted my own computer several times while testing this one out, lol :p But since this uses the INT 3 BCHK trick, we've already got protections against that (or patch winice).

I seem to remember System Mechanic used FindCloseChangeNotification after the Meltice detection to reboot. I'm not sure of the exact sequence of events, but in theory this, or some other API could be hooked and give the user the option of killing the app if this led to a reboot.

Rather than hooking it one could also do like Harlequin did with patching Kernel32.dll to intercept calls to TerminateProcess, checking the ProcessId to see if the call came from a target app he was trying to protect against.

It would take a bit of research to come up with a list of API's or other system calls that might be good candidates for hooking into if they are used during a reboot sequence, but it might be an interesting exercise. What about when you choose a normal Shutdown or Restart, does anyone know the exact sequence that occurs when you do this? I believe ExitWindowsEx is probably used in this case.

Cheers,
Kayaker
foxthree
03-09-2002, 11:21 AM
Hi binh81/Kayaker:

Kayaker: Your post makes interesting reading.

Here is my contribution.

Look up API -> InitiateSystemShutdown.

However, if I'm a protector, I'd pissed to see SoftICE running. So instead of calling any API to gracefully shutdown the system, all I need to do is to create a BSOD sequence. This can be done in "n" ways and it would be impossible - I think - to track each and every way of BSODing. (May be easier to track in Win98 but in NT/2K keep guesssing ;-) )

Sorry, I'm not making things better but just thinking out aloud. However, IMHO, a better way to tackle this would be *really fix* SICE detection routines. We already have a list of such detection routines -- what we need to do is to enhance the list with each find (such as int20's crackme :-<)

Signed,
-- FoxThree
crUsAdEr
03-09-2002, 11:52 AM
Hi guys, thanx for your replies,

Yeah i am running on win2K SP2 with GeForce 2 gfx card, so no frogsice or icedump for me :<... i have applied Spl/\j trick to hide DS2.5 but i dont think it is that effective, there are other ways of detecting sice still, so far softlocx has been the most annoying ones...

Yeah like kayaker said, i was looking for somethings to hook the reboot APIs and kill the apps before it reboots my computer.... but alas, dont think my level of asm is that proficient to attempt to patch kernel32.dll yet :>.. i probably cause more reboots and BSOD that way :>... guess i will have to live with it for now....

Thanx guys,


Profiling ->PURE<- Binary without source!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Profiling ->PURE<- Binary without source!!
PDA

View Full Version : Profiling ->PURE<- Binary without source!!

Aimless
03-09-2002, 09:59 AM
Hullo,

Profilers (I saw a thread somwhere, I even replied to it :)) generally take SOURCE files to handle coverage.

OllyDbg 1.06 is released, that profiles and traces instructions (on ALL Win9X/NT/2K/(prolly XP too) platforms). And you can save the instructions to a file.

Could be useful. Just thought that fellow~profilers would be interested.

...Have Phun


BIG-dipper :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > BIG-dipper :)
PDA

View Full Version : BIG-dipper :)

+SplAj
03-09-2002, 11:29 AM
ok u asked for D-D targets !!!

here is a nice aspr MULTI dipper as a newbie challenge :-

[http://***.timeutilites.com/downloads/atc.exe]

thanks to SpeKKel for that one....have phun we did :)

Spl/\j

BTW I have big trouble with RV1.3 destroying its own iat.bin after loading from disk and building. I think I saw someone else with this prob on the 'tools' pages ? Did anyone else come across this prob ?

The target is CV3.3 :) from Tamos...somethin new from Alexey ? RI have to speak to the Admiral and fire a shot across his bows ;)

later
evaluator
03-09-2002, 05:41 PM
eh, SPLAJ..
Can't understand your love to ASsPR!
What you found interesting???

Paste my IT.BIN in dump at 22C000h.
Values for PEditor:
OEP=21CFA4
IT =22C000 SIZE=0000026C

I think, will better if you make dump at OEP.
Old size-check exists:)
+SplAj
03-09-2002, 09:10 PM
Hi eval

I tink u misunderstand. I have rebuilt that time thingy a month or so ago. It's just a trget for those interested in D-Dip. Also rebult CV3.3 with RV1.2beta. Just sayin that RV1.3 destroyed IT/IAT bin file in both Win98SE & Win2Ksp3.......hmmmm

I just mentioned that aspr code is different now. The 61 ff e0 (Jmp EAX) is gotten to in a very 'decrypted' way.

Somethin different for sure in CV3.3 aspr ;)

hmmm

Spl/\j
crUsAdEr
03-09-2002, 11:47 PM
Thanx Spl/\j for the prog :>...

Finally get it to work :>... "wow" I must say, 10 dips in before OEP and only 2 should be missed... but the address of the dip in can give quite a hint though...

A few booby traps to check for AsProtect... this is really one program that integrates with AsProtects, luckily it is quite a simple program so i was able to find (hopefully) all the AsProtect checks...

Thanx splaj.. this one gives me some further insight of those dip before OEP... fox3, you should definitely try this one.... :>...
evaluator
03-10-2002, 09:30 AM
SPLAJ!

Maybe because of my poor english I didn't understand you..
But for me RV1.3 works fine! Nothing bad happens.
Here again I upladed resoleved&finished.txt and IT.BIN.
Now "autofix" option choosed.
evaluator
03-10-2002, 09:39 AM
OOPS, SPLAJ!
I look in your "resolved". All is same as my except IT length!
Your IT size is wrong. After "resolve again" RV1.3 displays 3B0.
This value can be used:)
foxthree
03-10-2002, 11:56 AM
Hi +splaj guru / binh81:

Thanks for this wonderful exercise. Whoops is what I can say.

In brief, I'm not able to unpack this one but I present below my analysis. Can you/binh81 verify this? I'm still trying and almost there :->

Okey: First like binh81 said there are 10 dips at 4504F8, 489A30, 450498, 4504A8, 489660, 450538, 4504B8, 450474, 450498 (2nd time), 4504A8 (2nd time)

Most of the dips it is:

PUSH EBP
4 lines of code
RET 4 (except in 2 cases where it is RET 8)

except for the "BIG" dip at 489660.

Now here is what I did. I bypassed 489660 (r EIP) and then search for the 61,FF,E0 (thanks +splaj). I find it at cs:11A3424. Note the value in EAX: 00489DB8.

----------> Marked this as OEiP (cs:00489DB8). Dumped here!

Now run RV 1.3. I Find the following values:

RVA: 0008D168
Lenth: 00000708

However, the resolved values look mighty strange to me 'cos KERNEL32.DLL is interleaved and same import call is made in 2-3 places (why?) I checked in SICE IAT Table and everything is fine! That is the way IAT is this for this prog. Ok, generated IAT.bin and pasted.

Did the usual change EiP CALL 489660/JMP 489DB8.

Run it. Just after click on Evaluate, proggy quits! So let's debug...

One redirected call I found at 00489E86!

So find it , traced and found that it calls 004898C4.

Patch it! at 489E86: CALL 4898C4.

Now run it!

Weird! Proggy said "Encrypt and Decrypt. Please run ASprotect on this app. API is incorrect" but runs. However each click on the top tabs is giving "Access violation at 45076E while writing to BFF77716 (addr of GetProcAddress)"

Questions:

(1) Is my EiP correct?
(2) Is my IAT correct ? ( I doubt this much!)
(3) binh81 says 2 dips neesd to be skipped, where as I found only one!

Can you guide me? I need only tips :-)

Signed,
-- FoxThree
LaptoniC
03-10-2002, 12:49 PM
I dont know what is wrong with my system but I have always problem with finding OEP of new aspr in Win98 SE.Searching popad freezes my system.I can only find by tracex and it gives wrong OEP sometimes like in this example.I have found OEP by Dafixer's tips.

Anyway I got same error like foxt3 here is the proc which gives error message when you change tab

seg000:0045075C dummy1 proc near

var_4 = dword ptr -4

push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword ptr ds:GetModuleHandleA_1+2 ;here is the problem.
mov ebx, [eax]
push dword ptr [ebx]
mov [ebp+var_4], ebx
pop dword ptr [ebx] ;crashes here because it tries to write address in k32.dll
mov eax, [ebp+var_4]
pop ebx
pop ecx
pop ebp
retn
dummy1 endp

I guess we should fix the pointer where it currently points to IAT.I am not familiar with new aspr :)

ps:If someone could explain how to find OEP and this "dips in win98 in a way that newbie can understand I will be quite happy
foxthree
03-10-2002, 01:01 PM
Hi Laptonic:

I've also got the exact GetProcAddress with the same asm code (I traced just now with SICE) write error like you've mentioned. We've both done something horribly wrong 'cos binh81 reports everything as fine. Anyways, waiting for inputs from +splaj guru/binh81.

Cool now about your questions:

Finding OEiP:

Like yoda, says in Star Wars, "Tricky this one can be !" :->>

Okey, two things, one what i've observed is most ASPR code after going into ASPR shell once comes back to break at 00401014. Now in between this if you run /tracex, you'll have to wait for like 10-15 mins. Instead do this, dl SuperBPM. Run it. Now load app into ICELoad. Breaks at 0x40001000. Now do a bpmb cs:00401014 x. Let it run. Voila! It breaks at 00401014 almost instantly ;-) Now trace back to ASPR Code. Now give a /tracex. It will speed your finding of OEiP by 40-50% atleast.

The Second thing is I've also had my PC crash when I search for signature bytes. I wanted to ask +splaj guru himself why this is so? But if you follow my earlier trick, you'll find POPAD. Now load SUPERBPM and bpmp at that mem location. F5 and voila you break at POPAD. Trace and find JMP EAX <grin>!

Hope this helps,

Signed,
-- FoxThree

PS: For Double Dips, there is nothing better than the big "writing" by +splaj on RegOrganizer 1.3Beta4. See it!
crUsAdEr
03-10-2002, 01:22 PM
Hi Fox3,

Yep, look at you dip listing.. most are 450xxx which sets up AsProtect Flag and can not be skipped... 2 dips at 489xxx should be skipped, if you look at the 489A30, it will move 4898C4 into [489E86] but since you have patched it, it should be fine...

The messagebox of invalid AsProtect API is called when the program check for its API at 48AB00 if i am not wrong.. just change this dword to 00000000 will do the trick...

Yep, your crashing is caused by the code pointed out by Laptonic, basically [ebx] is one of your IAT entry, so if ATC.exe is AsProtected then [ebx] is redirect to AsProtect memory which is writable, however when we unpack it, [ebx] now points to Window API address and is protected so you can not write data there anymore, but look at the code,

push [ebx]
mov [ebp+4], ebx
pop [ebx]

the push and pop operation does nothing but indirectly checking AsProtect redirected API... so i just nop both these push and pop or use the "48 40" trick.. then the prog should not crash anymore...

I found another check when u click the Adjust button.. yep... so watch out...

Again, i did not find the need to patch OEP to call the big dip at 489660 at all... :>.. it checks keyfile atc.bin...

Hi Laptonic : here is how i find OEP with AsProtect in 3 second :>
run the prog, use WinHex to open the prog memory and search "61 FF E0"... yeah u will find it and then bpm there with super bpm... boom you are there... the OEP is always the saem with jmp eax... the dip ia another problem which i have a zen for it but i dont know why and how :>... guess i have done 7 prog with dip already :> so ah well... my softice crash occasionally when i do search in memory with it so i use winhex all the tiem nowadays.. nice prog :>

that is all for now..

Cheers
evaluator
03-10-2002, 07:05 PM
binh8!

That last check is very fun, you will laugh!
I'm interesting if you find it!

I will upload soon if..
foxthree
03-10-2002, 07:14 PM
Hi +splaj/bin81/LapTonic:

Finally, I have cracked this one... :D and what a fun it was...

Okey lemme explain:

First of all we have two problem with the dumped executble:

(1) On running and clicking on evaulate, we get the horrible "Encrypt/Decrypt... Please repack this with ASPR and blah blah"..

(2) On click of each tab, we get GetProcAddress write error!

Solutions:

(1) This is complex. This is all because of indirect calls to ASPR code. The author must love calling into ASPR ;-)

There were (atleast) 3 re-directed calls.

a. at 00489E86: CALL [48AFA8] <-- replace with CALL 4898C4
b. at 004473A5: CALL [EBX+..] <-- replace with CALL 48460C
and the *final* one that completes the trick...
c. at 004843EA:

Here you'll find

at 004843EA: LEA EAX, EBP-0C
: CALL 004504E4 (Ugly function that causes the SEH to be trigged :( )

If you, see this call is in a SEH, and when the SEH get triggered, you get our friend the ASPR MsgBox !

So we should make the SEH not to trigger. Just see the line below the CALL...

CMP DWORD PTR [EBP-0C], 00

:p So this is the trick, normally the code does not come here and even if it does EBP-0C will not be 00 with ASPR Ugh!

So as +splaj guru would say ;) , "patch"

at 004843EA: MOV DWORD PTR [EBP-0C], 00

(Opcodes: C7 45 F4 00 00 00 00
90 <--- NOP to make it 8 bytes :rolleyes: )

Press F5 Yayyyyyyy.... No more ASPR boxes... Phew!!!

For (2)

it is very very simple and binh81 nopping will not work :(

So my little trick: Look at the address 004507EA or something.... bpx there. See up there is a PUSH EBP (function prologue heh!!)
Put a simple RET there ... So no longer memory write checks will be done.

[Note fellow RCEs: we're successful in this because the function itself is returning RET and PUSH is called within the function. If the function returned anyting other than a simple RET such as RET 4 or RET 8, we will have a corrupted stack if we replace with simple RET]

Boom.. Boom... No more GetProcAddress Errors!!!!

Phew... was it a debuggin' session or what!!!!

Anyways, my most humble thanks to +splaj (for introducing me to the art of D-D ;) , binh81 for being there :) )

One small question though:

What does the attached piece of code do and why does it generate a SEH?

Answers are gratefully accepted.

Signed,
-- FoxThree

PS: Still have 9 runs to go... close.. but still running...
crUsAdEr
03-10-2002, 07:14 PM
Hi eval,

yeah i did find it... :>...
foxthree
03-10-2002, 07:20 PM
Hi Eval:

Is my explanation above enough?

Signed,
-- FoxThree ;)
crUsAdEr
03-10-2002, 08:47 PM
Hi fox3,

Not sure about the differences between my dump and urs... but i did not patch that many bytes... think must be all the dipping... nopping out push[ebx] and pop [ebx] works fine on my machine... no problem... how can there be problem when u already nop it out? must be error somewhere else...

think even for "Invalid AsProtect API" massage, i only change one dword value...

okie.. just confirmed, i made 3 patches only... the prog seems to run fine, updating my time well... think i am gonna keep this :>... cos sice keep stopping my clock when it pops up...

Ah well... i'll see how :>...

regards
LaptoniC
03-10-2002, 09:12 PM
Thanks guys for the tips :)
evaluator
03-10-2002, 11:33 PM
Hi, FOX3!

Too many ENgLiSh!

Here I upladed ATC.ex without code!
Paste code yourself and be fun!!
+SplAj
03-11-2002, 06:20 AM
well I see you all liked that one :)

I could re-live my experience from reading your posts... the misssing aspr dll message...the GetModuleHandle POP error etc etc... great reading.

It's good to make your own journey into the codewoods without holding hands....now you can fix anything ;)

BTW SpeKKel discovered this target the day after I posted that I have ever only seen a 2 x dipper....wtf do I know !

BTW2 Thanks 'Eval the Terminator' for being around as usual...... Alexey must phear him ;)

Spl/\j
crUsAdEr
03-11-2002, 09:30 AM
Hee,

I agree with SplAj... eval, you should learn English well and write some neat tutorials for us :>... i teach u english, you teach me cracking :>??? How about that...

Just a random mroning blue thought...

Take care guys,
sv
03-11-2002, 09:40 AM
Hi all

Nice target +SplAj ;)

I'm surprise that nobody have problem with 'Select' Time server button.
There is a little check:
0177:00450727 8B35D8C44800 MOV ESI,[0048C4D8]
0177:0045072D 8B463C MOV EAX,[ESI+3C]
0177:00450730 8B440628 MOV EAX,[EAX+ESI+28]
0177:00450734 663D0010 CMP AX,1000
0177:00450738 7404 JZ 0045073E
Is EOP 1000 ? :) :) :) :)

Regards SV
crUsAdEr
03-11-2002, 11:10 AM
Yeah sv,

Did not test that button :>... wonder if there is anymore checks :>...
kinda effective way of protecting heh.. put a lot of small checks everywhere....

Thanx,
Lbolt99
03-17-2002, 03:46 AM
Hello,

If you guys are interested in this I posted a msg in RSE general about removing ASPR from a .dll file. It's a pretty weird implementation. I've found out so far that it dips twice before (what I think) is the OEP, but it accessing Aspr API functions (GetRegistrationInfo, etc) in the target dll. I've been working on it for several days now, and getting a crash course in how DLLs work in the process.


best Exe identifier??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > best Exe identifier??
PDA

View Full Version : best Exe identifier??

crUsAdEr
03-09-2002, 01:56 PM
Hi folks,

Just wondering what is the most reliable tool to identify the compiler type of an exe... i am using Get Type, PEIdentifier, Language 2000 and File Inspector, they each gave a different results about the compiler type of the same exe... i am kinda confused now... so just wonder if there is an updated tool out there? What are you guys using anyway?

Thanx for your replies,

Cheers,
DakienDX
03-09-2002, 03:44 PM
Hello binh81 !

The best thing for identifying compilers or protectors is your brain. :)

I've never used any of these tools myself, since a hex-editor and your brain are the best file identifiers.
crUsAdEr
03-09-2002, 04:59 PM
hee... typically Dakien :>

Thanx for the advice, guess i better learn various signatures from different compilers then... erm... any tutorials available on the web ? Yeah i will do a search myself but please do help me if u have some of them handy...

Thanx..
DakienDX
03-09-2002, 06:58 PM
Hello binh81 !

Sorry, I've no tutorials available. It's all in my brain. ;)

There is no need learn all signatures from compilers.

Just look at the secition names, at the segments, at the imported DLLs, at the exports, at the imported/exported function names, at the resource section, at copyright strings, ...

The list is unending. You'll find clues all over the file.

May I ask why you want to identify all compilers?
crUsAdEr
03-09-2002, 08:43 PM
Hi dakien,

yeah... well i figure that it is always nice to know what compiler is used so cracking it with the right technique is always easier... Recently i have found that those AsProtected apps with D-D in newbies forums are all compiled with Delphi, just needed to confirm the suspicion... but i think i am right about it...

Shall look into compiler when i have more times in the future :>... one thing at a time.... :>

Cheers,
Thanx for your help anyway :>... always appreciated!!!!
+SplAj
03-09-2002, 09:31 PM
Delphi language is always used by the Russians and protected with ASPR ;)

ya don't need any lame IDentifyers.... they just confuse u...well they did me.

Spl/\j
unreg
03-10-2002, 05:57 AM
grin on russians+delphi+aspr) and an updated identifier tool worth to use for your pleasure of self-cofusing is FS by SMT http://tools2k.chat.ru .. since *chat.ru should be not availiable outside of .. i don't know and does't matter) latest version mirrored at exetools


VB6 app de-asprotected
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VB6 app de-asprotected
PDA

View Full Version : VB6 app de-asprotected

wbe
03-09-2002, 10:06 PM
POW! Another one bites the dust.

This is the first time I see a VB6 app (VoptXP v7, http://***.vopt.com) protected with Asprotect. I thought it would be a challenge to try deprotecting it and immediately started unpacking. I found OEiP, dumped, fixed and rebuilt (OEP: 00007A54, IATRVA: 00001000, IATSize: 00000290). However, all finished in 3 minutes time. The invalid module (MSVBVM60.dll) had all its 163 functions properly seated in place after an Autotrace, leaving me nothing but pushing the fix dump button. No fun! Deprotected app runs as usual now, except complaining about an "unexpected error" which requires a little tracing, later.

The question is, how could this happen? Why didn't aspr played its usual API, DD tricks, etc., on this one? There was an aspacked asprotect.dll residing in the app's folder. However, the app runs well without it.

Did anyone have a similar experience?

Thanks.
+SplAj
03-09-2002, 10:16 PM
hi , i think if you read your post again ....

...you will get the answer by ur self :) ...

msvbvm6.dll is NOT part of aspr repertoire like kernel32 or user32 so cannot redirect api calls ;)...and no D-D cos ThunkMain does everything so aspr can only 'pack' it ?

Spl/\j
wbe
03-09-2002, 10:30 PM
OK.

So, it was a wrong choice for the author to resort to aspr. This app had a very good anti-SmartCheck trick in its previous versions, but not this time. Maybe aspr gives a sort confidence?
+SplAj
03-10-2002, 06:53 AM
Yes, maybe the author should ask for a rebate and use UPX :eek:

Actually he could still use the nice registration scheme of aspr and 'block' out certain functions/features unless registered ;)

Spl/\j


hooking a process's keyboard input
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > hooking a process's keyboard input
PDA

View Full Version : hooking a process's keyboard input

2_a_day
03-10-2002, 06:37 AM
I hook a process like so…

hhk = SetWindowsHookEx (WH_KEYBOARD, KeyboardProc, NULL, ThreadId);

Works well, but there is one problem: calls to WriteProcessMemory, when writing memory of the hooked process, fail when called from inside the KeyboardProc callback function. I am able to write the memory A. before the process is hooked and B. when the process is hooked and I am not calling WriteProcessMemory within KeybordProc .

Any ideas? (BTW, my “target” for now is windows calculator)

Maybe someone can suggest an alternate method. My goal is to modify a part of memory on a WM_KEYDOWN, then restore it on the corresponding WM_KEYUP.

Thanks.


Does anyone know the name of this protection ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Does anyone know the name of this protection ?
PDA

View Full Version : Does anyone know the name of this protection ?

Asassin
03-10-2002, 07:51 PM
Hi,

as time goes by, I recognize more and more programs which seem to use a new (??) protection system. The protected program creates a file called arm***.tmp, where *** are some random numbers. This file is called different everytime the program gets executed.

Does anyone the name of this protector ?

Byes

Asassin
DakienDX
03-10-2002, 07:56 PM
Hello Asassin !

The protector is called Armadillo. There are many threads on this forum dealing with it.

If you'd used the search function looking for arm*.tmp you'd have found two recent threads dealing with it, searching for Armadillo will give you more than 20 results.


possible bug in icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > possible bug in icedump
PDA

View Full Version : possible bug in icedump

B-Boy
03-11-2002, 12:33 AM
i'm using win98se, softice 4.26 + icedump 6.025.
icedump worked very well with sice 4.05. then i got sice 4.26, and i also downloaded the debug symbols from m$ for win98se and of course i added those new nms files to my winice.dat's "LOAD=" lines.
then everything went fine - except icedump, which refused to load with the well known "VXDLDR failed to load icedump" message.
but why the hell..? i've loaded the kernel32 exports so it should work.. then i gave up because i thought i've got a different built of sice than icedump would support..
but then i remembered that icedump relies on kernel32 export stuff.. so i started up softice, ran the symbol loader and removed all the debug symbols (among them: kernel32.nms)
then i double-clicked icedump.exe once again and: it worked :))
so it seems that icedump doesnt like the kernel32 debug symbols to be loaded when you start it.

hope anyone finds this interesting :)


THKX for the help with Awave 8.0!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > THKX for the help with Awave 8.0!
PDA

View Full Version : THKX for the help with Awave 8.0!

chuk
03-11-2002, 09:09 AM
Hi,

Hey, thanks for the help!! this forum is really great!

I went further into the program and there is string that the program checks everytime you want to do something..guess what the string is: "Cracked" ;-).

So I suposse that if the program detects that the evaluation period is over and it is running, it warns itself with that scary string...

Bypassing a few jumps, after a bpm in the address of "Cracked",
you can keep on working. So, it is easy to patch now.

regards!!


WinHack 1.1, missing finishing touch
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > WinHack 1.1, missing finishing touch
PDA

View Full Version : WinHack 1.1, missing finishing touch

Argoth
03-11-2002, 12:41 PM
Hi all,

I have downloaded this program called WinHack 1.1. I uploaded it here:

[ http://home.wanadoo.nl/argoth/wh110.exe ] (542 K)

It is protected with a serial protection. It's actually a quite fun protection to crack. When you click the register button in the menu, it runs a file called trg.wlb. So we might as well rename it to trg.exe and work from here.

As a name I used Argoth

With a bpx hmemcpy I came on 0042D8AB, which I thought was a good starting point. Now if you trace into the call at 0042D8CF and you reach 0042D4D7, you'll see that the first character of our serial should be a 'G'. And if you take a look at the piece of code directly after this, you will see that two '-' characters are needed in our serial.

At 0042D619, our serial will be checked a little more specific. In my case, the characters after the G should be 54. And at 0042D62A there is another check for the last couple of characters, in my case they had to be 9576. So as a serial I now gave: G54-666-9576. But it didn't work. My guess is that there is another check for the characters in the middle of the serial (where I put 666). But I can't seem to find this check, or any other piece of code which would lead me to a working serial.

I already have it registered, because I reversed the jump at 0042D8D6. It worked, but I just want to know how to get to the correct serial. As you can see, I did most of the work myself, but I could really use some help.

Thanks in advance,

Argoth
SilberFuchs
03-11-2002, 08:54 PM
look better on 0042d601

ciao
SilberFuchs
RenHoek
03-11-2002, 11:36 PM
Isn't Winhack that cheat finding program? I remember cracking 2.0 I believe. It was funny, first unpacked and then patched the program. Turned out it just killed itself after a second or two.

Turned out it does a ReadProcess on itself and CRC's.. don't know if it does the same in version 1.1, so if it does, be sure to keep an eye out..

Oh btw, if you are looking into cheat finding program, google for Tsearch. Not only does it do what Winhack does, but it's free and it includes a debugger :) Instead of 'freezing' a memory location you can now actually kill the instruction that it changing it.

It's also a nice exotic tool when reversing :)


CommView 3.3 Unpacked but have question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CommView 3.3 Unpacked but have question
PDA

View Full Version : CommView 3.3 Unpacked but have question

foxthree
03-11-2002, 07:22 PM
Hi Evaluator:

I wanted to learn the size protection trick in CommView. You said that it is present in CV 3.3. So I dled CV 3.3 and attempted to unpack.

I got the OEiP: 0061CFA4.

Like +splaj said this version of ASPR seems to be different! Anyways, I managed to build the IAT. However, my IAT and your IAT length is different.

Evaulator => 26C
Mine=> 3B0

However, I pasted mine in the CV dump and
:cool: it starts perfectly! No size checks and no anti-patching code in this one. Am I correct?

I'm attaching my rebuilt IAT.txt for your reference.

Signed,
-- FoxThree

PS: BTW, this version of ASPR is surely :eek: different in some way! I'm not able to pin point how...
evaluator
03-11-2002, 08:20 PM
on W9x after ~90sec it displays error message
and exits.
Find it MAN!
Solomon
03-17-2002, 08:31 AM
yeah, there is a err msg box.:D


Bad news for RV from ARMADILLO 2.51
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Bad news for RV from ARMADILLO 2.51
PDA

View Full Version : Bad news for RV from ARMADILLO 2.51

evaluator
03-11-2002, 08:12 PM
Bad news for RV from ARMADILLO 2.51

I found in ARMADILLO2.51 bad anti-resolver trick:(
It PUSHs export address and then jumps in some code KERNEL32.DLL!
After this code ends, RET returns to export (-was pashed).

So FINITO LA COMEDIA of RV resolving???

As VENDETA action:
Here I uploaded unpacked ARMA without resources. Attach resourse from original...

binh8!

You asked, if original IT exists in memory for dump.
No, it is stripped. I put this stripped export names in zip(from mem FC4000h).
crUsAdEr
03-12-2002, 12:56 AM
Hi eval,

Yeah but ImpRec works great for me :>...had to resolve a couple manually only... or some dirty inline patching can do the job as well :>...

regards...

P.S : Do you know any other program packed with new Armadillo? I want to if it has any other special features?
VtE
04-10-2002, 05:57 AM
P.S : Do you know any other program packed with new Armadillo? I want to if it has any other special features?

If you still need a program protected with Armadillo, please let's me know. My email is vt0008@hotmail.com

I have this sofware that I tried to unprotect it but I cannot, so I need some help.

Thanks
evaluator
04-10-2002, 07:35 AM
Hello!
I made mistake, RV can resolve most IT:

I Resolved imports in ARMADILLO with RV in this way:
1. find in dump IAT memory range
2. select in RV FIRST(!) armadillo-process,
press "resolve", then "resolve again", then trace EXEPT some redirected
in lower address (DLL).
RV-tracer can resolave all those redirected.
SpeKKeL
04-10-2002, 02:25 PM
Hajo,

Been bizzy with armadillo the last week(s).
Found out that r.v and imprec couldn't resolve in the normal way
(i didn't try it your way eval) so tried writing a plugin for it..
Thanks to bin81 (works great man !) my plugin can resolve "all"
except 2 calls ( which i think you don't need them.)
I must do some more testing on other apps but my hole puter
crashed and had to install a new fresh system (shit):mad:

Keep you informed,

SpeKK
crUsAdEr
04-10-2002, 02:33 PM
Hi SpeKKel...

I alwasy ghost my system after CloneCD f**** up my comp sometimes ago :>.... hopefully ur newly installed system will run faster :>...

Yeah, keep us informed....

cheers,
SpeKKeL
04-28-2002, 07:39 PM
Hajo,

Finished imprec/r.v plugin for armadillo.
Tested om w98 with imprec on arm 2.51 and 2.52 and resolves
99 %.It seems that the plugin doesn't work on w2k ??
Don't know why.I compiled with tasm,.. should i gave up some extra parameters for other systems ??
Just used the buildddll.bat file (maker.exe) included by imprec's source.

TIA

Spekk
evaluator
04-28-2002, 09:30 PM
Where is it!?
We will test:)
SpeKKeL
04-29-2002, 10:17 AM
okee here it is .

Spekk
SpeKKeL
04-30-2002, 09:40 AM
somebody tried the plugin W98/w2k ........
Wants to know if it works on both systems..

TIA

Spekk
evaluator
04-30-2002, 10:39 AM
Test failed!
System W98se
RV 1.3 and 1.4
Arma 2.51, 2.52b, 2.52

Prints "error"

Or you can explane, how exactly use?
SpeKKeL
04-30-2002, 10:49 AM
On r.v all plugins give error on a w98 system.this because r.v doesn't support w98...

Try on imprec and read pm please..

Spekk
evaluator
04-30-2002, 11:02 AM
Spek!

Sorry, but I not support IMPREC:)
SpeKKeL
04-30-2002, 11:16 AM
OK.:rolleyes:

Spekk
evaluator
04-30-2002, 12:08 PM
OK, Spekk!

I tried also IR. (tsss)
But also failed!
Write step by step, how to..

(For example I do:
(1. put power plug in AC
(2. press Power button on PC
(3. ~:

Also write IR's config I must choose.
crUsAdEr
04-30-2002, 12:37 PM
Hahahahaha,

Eval.. did you forget to install the driver for the plug-in :>>

SpeKKel said it was a plug-in, not a plug-n-play :>>
SpeKKeL
04-30-2002, 12:40 PM
PLUG and PRAY:D
evaluator
04-30-2002, 06:28 PM
When I wrote "test failed", oPh c0urse I already done this:

'1 put the arma plugin in the plugin directory from imprec.
'2 run armadillo
- 2.52b
'3 give iat lenght/oep and press get imports
- IAT 00026000; Size 2C0; OEP 0001F0C0;
'4 press show invalid
'5 do a right click on the invalid entry
'6 press plugin arma-beta2.5
'7 should resolve...

N0pe! Not resolves!
"Return value:205 Failed!"

Spekk, I asked:
"Also write IR's config I must choose."
You think, it is not IMPoRtantEC? OK!

So finally, you want 'N8 & N9'?
SpeKKeL
04-30-2002, 06:57 PM
config ??
You mean the options of imprec?? think this isn't important, please do this set bpx readfile ,1 time F5 and 2 times f12 now you
land in plugin >> trace and watch value esi,ebx and see where
it goes wrong.

spekk
crUsAdEr
04-30-2002, 07:28 PM
hey eval,

I was just joking... hope you are not angry

Binh
evaluator
04-30-2002, 08:16 PM
binh81!
I very like jokEr! Don't warry!

Tommorow, Spekk, maybe I db
evaluator
05-02-2002, 06:18 PM
OK, dbg your DLL.
Attemp trace thunk 00026094:A85FD2
Error occurs in KERNEL32:IsBadHugeReadPtr
BFF7BA0B: mov CL,[edx+eax-01] < A85FD5 - here is no page.
So this Function returns 01, JE at 401117 (for HIEW) not jumps..goes to ExitThread

That's all folks:(
SpeKKeL
05-02-2002, 09:58 PM
H'mm i made this plug-in from the original source from telock.asm
there was an error while compiling which seems to be this
badhudgereadptr.
I thought i had solved this prob by adding the line extrn badhuggereadptr:proc to the source...Well this worked for me ..
I'll look again why this goes wrong on other systems.
My earlier plugin (visuel protect) was made in hiew., where i took
an allready compiled dll which worked on all sys.

But eval big thanks, now i know where to surch..

Spekk


Aargh! Can we PM some of these RV/Asprotect threads?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aargh! Can we PM some of these RV/Asprotect threads?
PDA

View Full Version : Aargh! Can we PM some of these RV/Asprotect threads?

Kayaker
03-11-2002, 09:07 PM
Hi guys,

This whole RV/Asprotect Double Dipper feature discussion is all fun and games and stuff, but do you think we could minimize some of the "Hey I found the OEP on the latest AdvancedCommviewOrgasmizer v.1.3betaadnauseum from ElcomTamoWtfSoft.com and here's my IAT.bin" threads?

If there's really only a handful of people who care about the niggling details of each and every new version/implementation of Asprotect out there, maybe they can keep all but the most interesting, new and innovative ideas to PM (Personal Messages) or private email.

Don't get the wrong idea, but I'd just hate to see other interesting topics getting buried in the onslaught of de-asprotecting every variation out there, and people losing interest in the forum as a result.

Thanks,
Kayaker
Woodmann
03-11-2002, 09:46 PM
Howdy,
Methinks perhaps we need a chatroom?(I hate that word)
Ummmmmm interactive meeting room?

Peace, Woodmann
crUsAdEr
03-12-2002, 12:59 AM
Yeah, kayaker

We have been slightly obssesive with AsProtect :>... maybe you could start a nice new project in the Project Forum :>.. that would be really interesting... i missed your messing with Import Table project and would love to see some other project soming up :>

Thanx,
evaluator
03-12-2002, 06:56 AM
Hi,Kayaker!

I want say few things:
1. "this" happens in "Newbies Forum". Here happens (& will..) meny other terrible things..
2. ASsPrack main lover is SPLAJ! Ask him: ) "Why you trash time on thiz packer?"

~:0
3. Hey, moderator(!), move this thread to OFF TOPIC
Kayaker
03-12-2002, 09:00 AM
It's nothing to do with being obsessive binh81, it's not a big deal and I enjoy watching people having fun with something. I'd like to do another project, but I'll actually be away until mid-April and won't have any time until then.

Evaluator, I'm not trashing on Asprotect discussions. I find the protection as interesting as anyone and have spent many, many, many hours exploring the code and rebuilding dumped apps.

To be honest, my main concern isn't that there's too much Asprotect talk, I don't really care and I don't consider it 'polluting' the board. I'm a little more concerned with certain specific details about specific apps. Providing OEP's and copy 'n paste IAT dumps makes it too easy for someone to come up with an easy crack for a shareware target. Just hang around the board and get the latest updates on the latest versions kind of thing if you know what I mean, without actually having to learn how to do it entirely yourself.

If we're discussing techniques, analysis of a protection routine, weaknesses of said protection, that's one thing. The reason I posted was because I was concerned that we might be starting to give too much away about specific shareware targets without realizing it. If this place starts to smell too much like a crack site then I'm going to speak up, off topic or not.

I'm happy to hear other peoples opinions.

Regards,
Kayaker
Kilby
03-12-2002, 10:38 AM
I have to agree about things getting too specific, not regarding ASProtect, but particular things wrapped with ASPR.

I should know as this time last year I was spending way too much of my life taking ASPR apart, and SV was the person who set me on the right track.

Rather than discussing particular implementations, why don't we have a look at how the double (triple & quad) dipping is set up in aspr in the 1st place.

Does it carry out any of this behavour naturally or is it all set up by the developer, if so how as I don't remember seeing it mentioned in the aspr documentation.

How about an analysis of the registration features, this would be more useful than unwrapping, and give Alexy a change of scene too ;)

Regards,

Kilby...

And yes I am gonna head back to aspr soon as I have had a few ideas to make unwrapping aspr a little less tedious :)
foxthree
03-12-2002, 01:57 PM
Yes Kayaker:

You're right. Probably just newbie enthu ;-). Sorry but will keep such postings to minimum.

Thanks for putting things in the right perspective.

Signed,
-- FoxThree
[NtSC]
03-12-2002, 04:57 PM
Instead of writing Tons of Stuff here,you Guys could invest some Time and write Tutorials about the Asprotected Stuff you did.
Just some short Notes...So Beginners would have a Reference to look at, Tseph´s Whats new Page would be supported a bit more and finally those Asprotect Questions here wouldnt reach the usual Ammount anymore.

Just an...mmhh.. Idea ;-)
DakienDX
03-12-2002, 05:48 PM
Hello everybody !

It's just time to add my own comment to this and unstick the thread.

I agree with Kayaker's main wish. Not many people are interested in ASProtect, still fewer on the Newbies Forum. If you've found a new trick in ASProtect, you might discuss it private by E-Mail or by private messages.
Nearly everybody can make dumps of the .code and .data section, but only few can rebuild working import tables, so this information can be used very easy by "commercial" crackers just comming around to download working IAT's for the latest software.

Woodmann's idea with a "interactive meeting room" will not work here. We come from all over the world and why should it be impossible for American and Russian people to discuss over protections together? Therefore we've a message board where people from all time-zones can learn.

Kilby is also right. We should learn how to defeat a protection in general, not target specified defeating using bad implementations of the protection. How long would we, for example, have continued dumping and rebuilding SafeDisc applications, if nobody found out and made public how the encryption and the imports are handled.

[NtSC] said also some wise words. Write tutorials. Spread knowledge.

Do it, write tutorial, but with one limitation: No target specified tutorials, only general attacks on a protector.
Who wants to follow a tutorial for XYZ.EXE, 123456 Bytes, 01/01/02, v1.2.3.4 beta 6c, CRC32: 12345678h ?
me8
04-22-2002, 02:56 PM
4chat: don't dorget logging/archiving ... :-)
SpeKKeL
04-23-2002, 11:05 PM
And i,.......... don't agree with anyone !

SPeKK !

agree or not to be agree, that's the question..........:D
CrackZ
04-23-2002, 11:29 PM
Hiya,

1. About 6 months ago I posted a thread about ditching the target specific nature of tutorials, board discussions etc, etc. in general. Lets face it most morons can find an OEP and given Revirgin and UltraEdit and an it.bin to download they can probably do the required cut and paste finger movements.

This entire process teaches erm, not a lot ;-), the guy producing the it.bin can engage in his pissing contest with Alexey for the next version and the guy downloading it can use his newly unpacked/cracked shareware in peace.....cue ad nauseam process.

2. There is an *unhealthy* level of interest / fascination with ASProtect and Alexey's protections in general, 90% of board topics are dominated by the next change he made since you all kindly pointed out to him what you did to beat his last change, its a waste of time, a cat and mouse game, no tutorials are written, no-one learns anything.....on we go.....why do we all feel the need to do all of his work for him?, his revisions are rarely innovative since he has to ultimately confine within the limits of the system, I don't call tweaking your layers of obfuscation protection.

So erm, I've ranted a bit, I guess what I'm saying, if the threads regarding specific targets and Alexey's programs in general could dominate our lives just a little bit less then the whole messageboard might be a little happier and interesting place ;-).

Either that or someone write their general advices on how to find iat starting address / OEP etc, etc and then maybe the constant flow of questions might slow a little, better yet someone write a general guide to pre-requisites to unpacking, like reading some fucking PE dox or I think Predators guide for a start ;-).

Regards

CrackZ.
Pyrae
04-24-2002, 02:46 AM
How about a moderated sticky that covers all recent aspr stuff? This would be kind of an up-to-date tutorial everybody can add the most recent discoveries to and no app specific details have to be posted. Whenever someone creates a new thread asking for something already covered, someone just can point him to the right passage and his thread can be closed. So only 'hot' topics stay on top and can be discussed...

P.S. Yes, I'm guilty of a useless aspr thread. But I really think aspr is worth a sticky...;)
crUsAdEr
04-24-2002, 02:58 AM
Geez... time to move this thread to "Off Topic"

hi CrackZ,

Yeah we all agreed that too much have been said about AsProtect, kinda repetitive... some kind of agreement has been made here
http://www.woodmann.net/forum/showthread.php?s=&threadid=2988

Hey fox3, me real busy now, since u have some time why dont you write a nice tutorial and post it here or Tsehp site (that is if he approves of it :>).. if not i will write one in 5 wks time when my exams are over....

cheers
foxthree
04-27-2002, 11:40 AM
Kinda funny to see this thread still alive and kicking :p

Anyways, Kayaker was right, so is CrackZ and a multitude of others. That is why off late you don't see a lot of ASPR related but a lot of dongle related stuff LOL...

Greetz binh. I don't mind writing a tut, but what the hell has been new in ASPR for the past couple of months. Alexey (hi there) hasn't released a new version (except for some betas to registered users ermmm... I guess LOL) and most of ASPR is ripped out all over this board.

If I find anything new in any version of ASPR, I'm sure I will ;)

Signed,
-- FoxThree

PS: I hope we didn't anger Alexey to release another ASPR version, sub version, sub sub version ... LOL... (Just for fun)
crUsAdEr
04-27-2002, 12:06 PM
LOL...

geez... i was bored while studying for exams so i open up RegetDx.exe 3.0 beta build 117, and play with Asprotect..

yeah, so i gonna have tutorial coming up soon, about AsProtect.dll that hopefully explains most stuff about AsProtect... think it is gonna be long...

Guess you dont have to write one any more if you dont have time, fox3... but hey the more the merrier...

So how do I submit tutorial? Do i just send email to Tsehp with the tutorial?

Thanx
Binh
foxthree
04-27-2002, 04:27 PM
Hi binh:

ASProtect.dll??? Umm... sounds interesting. Go for it. And yes, I guess that is the procedure. Just mail to +Tsehp. He usually responds within a day... :)

Signed,
-- FoxThree


How to calculate which jump I want to use...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to calculate which jump I want to use...
PDA

View Full Version : How to calculate which jump I want to use...

Six Black Roses
03-12-2002, 05:07 AM
Ok, let's say I know the physical offset in an exe. And I know of another. Those two are A and B of the whole jump. In other words, I want to jump from A to B.

So, for the question, how do I know what jump I use... short, long, medium?

Is there some detail guide out there that'll assist me in correctly using the right jump.

BTW, this is for NetZero, and I've already patched the RasHangUpA but it gives me an illegal operation box when it exists... so, I don't consider the crack flawless.

And another thing, I proudly can say that I've managed to find a way around the 10 hour limit. :D Ooops, I've already said too much.
JimmyClif
03-12-2002, 06:09 AM
Well - as a short jump only consists of 2 bytes..

The opcode for the jump EB -> jmp or 74 -> jne etc
the other byte is the distance... 0-FF is 255d but half of it jump backward and half of it forward... (i'm to lazy to calculate that manually) So your short jumps are limited.

If it exceeds 255/2 forward or backward then you need a long
jump... I used to just write it inside HIEW and get surprised if I
need a long or short - In case it is a long jump then verify it with
SoftIce.. Hiew calculates the long jumps (most of the time) wrong

Congrats on solving the little 10 hours limit puzzle :)
DakienDX
03-12-2002, 06:28 PM
Hello Six Black Roses !

There are several types of jumps, both in 16bit and 32bit. Let's try to explain.
All jumps are counted from the end of the jump instruction. All values after the instruction can be positive or negative, which means jump further or jump back.

16 bit
EBh
A short jump. Followed by one byte. Can jump from -128 to +127 bytes.
5000:0100 Jmp 120 (EB1E)

E9h
A near jump. Followed by two bytes. Can jump to all places in the same code segment.
5000:0100 Jmp 220 (EB1D01)

EAh
A far jump. Followed by four bytes. Can jump to any location in memory (by changing the code segment), but uses absolute addresses instead of relative ones.
5000:0100 Jmp 6000:0100 (EA00010060)

7?h
A short conditional jump. Followed by one byte. ? denotes the reason why to jump. Can jump from -128 to +127 bytes.
5000:0100 Ja 120 (771E)

0F8?h
A near conditional jump. Followed by two bytes. ? denotes the reason why to jump. Can jump from -32768 to +32767 bytes.
5000:0100 Ja 220 (0F871B01)

32 bit
EBh
A short jump. Followed by one byte. Can jump from -128 to +127 bytes.
0177:00401000 Jmp 00401020 (EB1E)

E9h
A near jump. Followed by four bytes. Can jump to all places in the same code segment.
0177:00401000 Jmp 00401120 (E91B010000)

EAh
A far jump. Followed by six bytes. Can jump to any location in memory (by changing the code segment), but uses absolute addresses instead of relative ones. It is also quite unusual.
0177:00401000 Jmp 0028:C0001000 (EA001000C02800)

7?h
A short conditional jump. Followed by one byte. ? denotes the reason why to jump. Can jump from -128 to +127 bytes.
0177:00401000 Ja 00401020 (771E)

0F8?h
A near conditional jump. Followed by four bytes. ? denotes the reason why to jump. Can jump from -2147483648 to +2147483647 bytes.
0177:00401000 Ja 00401120 (0F871A010000)

I hope this helps you more than it confuses you. ;)
(I've calculated all jumps with my brain, so I hope there is no error in it. :) )
There are also many jumps to values of memory addresses (Jmp Word Ptr [BX] or Jmp DWord Ptr [EAX+4*EDX] or similar), but it would be too complicated to explain them here.


windows hook help...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > windows hook help...
PDA

View Full Version : windows hook help...

grosse
03-12-2002, 01:15 PM
this is similar to that hook post earlier...
suppose i create a keyboard hook

hhk = SetWindowsHookEx (WH_KEYBOARD, KeyboardProc, NULL, ThreadId);

how do i post a message to the pogram which created this hook from the KeyboardProc ... eg. to show a window or to send the WM_QUIT msg?

KeyboardProc is a pointer to a func. which handles the hook processing. Now i tried out a PostThreadMessage() to post a msg to the thread from which i set the hook by setting a global variable to contain the thread id i reqd. but within KeyBoardProc this variable appears to contain 0. I tried out static keyword before the global variable ( type DWORD ) but no go
DakienDX
03-12-2002, 06:59 PM
Hello grosse !

If you set a hook in a different thread, you need to use a DLL. But the DLL has usually two data segments. One thread specified and one shared. So if you access a variable from your main program, it can have a value, but if it's accessed from the DLL in a different thread, it uses a different data segment for this thread and the variable is probably not set. Try to define the variable you need in the shared data segment, so it's accessible from all threads using the DLL.
grosse
03-15-2002, 02:03 PM
oh thanx.. will try out... MSDN is somewhat confusing!
tsehp
03-17-2002, 01:05 PM
to share data, you can also use file mappings, I use them a lot between processes, even if it's not the case here


Cops Copylock II !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cops Copylock II !
PDA

View Full Version : Cops Copylock II !

dream-weaver
03-12-2002, 02:39 PM
Hey,

Some of u may be familiar with this old DOS disk-check routine. In order to activate a protected exe, u need to supply the right disket.
This protection is quite hard to beat (for me , including encryption and packing.
Someone by the name j@ker released what he calls "Universal cops deprotector". This may be a great util, yet it doesn't work at all with my file, probably a newer version.
Therefore, I would appreciate help on this subject- how to correctly deproterct a cops copylock II protected exe. Any help would be highly appreciated.

thanx in advance,
dw.
DakienDX
03-12-2002, 04:39 PM
Hello dream-weaver !

First of all, don't post the same thing in more than one forum.

Second, I don't know this protection, but I'm familiar with DOS programs. Just from the information you posted I can't tell you anything to do.

You should give us some more information about the target.
Does it include Anti-Debugging tricks?
Any one-way encryption?
Do you have the needed disc?
What have you tried so far? (DiskCopy, Debugger, Disassembler, Automatic unpacker?)
Do you need the disk to run the .EXE or to decrypt it?
Can you move the protection from the disc to other media?
Are you familiar with ASM?
Anything else which might be interesting?
dream-weaver
03-13-2002, 09:25 AM
First of all, thanx for the response DakienDX!

I've posted in the newbie forum, thus u may understand that I'm a little new to this subject. So sorry I didn't post enough info, I'll write here all I think is relevant:

As mentioned, this is a disk-check routine. Therefore, It needs a specific disket with, probably some specific corrupted bytes. If the protection finds this bytes, the program works. I didn't try disk- copy as I don't have the original disk.
I had it once and tried to copy it, and since then it doesn't work :)!
I don't know about anti-debugging tricks, I suppose it does have some from the info on the official web-site:

ww.linkdata.com/newhome/index.htm#copylock

This should give you enough info about this protection. As far as I know, this is one of the most advanced disk- check protections for DOS. The page mentions anti-debugging, anti-copying, and other tricks.

I tried using all the generic unpackers for DOS I could find in exetools, protools, etc. As i said nothing worked. I got the same result from j@ker's cops copylock deprotector.

Again, I'm not sure, but from what I could find out, the protection unpacks exe only partially, then waits for the correct disk, and then unpacks the rest of the program in order to run.

I tried using Softice and I landed in an endless INT13 (DOS IO interrupt, reading a sector in disket for instance) loop. That's about it. I also tried disassembling, with IDA and W32DSM, yet it is obvious I didn't get anything useful as the program is encrypted. I also didn't find any INT13 calls inside the code from the same reason.

I know the basics of ASM. I can understand some Windows codes, yet I found it much harder to reverse DOS programs. Thus I posted this thread in hope to get some help

Finally, if this is necesary, u can take a look at the protected exe at:
ww.geocities.com/virtual_pool_2/LINGO.ZIP

I hope this info is enough because I'm quite lost and don't know where to start.
So, again, any help would be highly appreciated.

dw.
DakienDX
03-13-2002, 06:15 PM
Hello dream-weaver !

Thank you for the information. I looked at their homepage and found some interesting phrases.
"No source changes necessary" -> a wrapper is used
"No special diskettes" -> can be copied somehow
"Includes Machine Installation ... hard disk can be low-level formatted or even replaced with another hard disk type without affecting protected files" -> probaly uses CMOS to store some data

I'll download the program and see what I can find out.
dream-weaver
03-14-2002, 04:26 PM
hey,

Thanx a lot for your help again, I really appreciate it.

I see that they made good protections in the old days as well :)

If anyone can suggest anything else I would be greatful.

dw
DakienDX
03-15-2002, 04:24 PM
Hello dream-weaver !

Yes, they made good protections in the old days as well.

But this is none of the good ones. ;)

The program uses a wrapper. You can bypass it by reversing about 10-15 conditional jumps. There is no need to make a fake disc. It does not ready any valueable data from the disc.
It stores some version information in the boot record, using some fileds which makes the discs completely incompatible with any OS. ;)

The program is even packed (LINK /EXEPACK) under the wrapper, so we don't need to care about relocations. :)

I get a "File not found in module LINGO-L" at startup, but the program works fine.
dream-weaver
03-16-2002, 10:16 AM
Hey again,

Well thanx for your reply, but now u are forgetting that I am a newbie, and this time u didn't post enough info.

How do I unpack the file (If I need to )?

What jumps do u mean? (That I need to change)
The disassembler returned no code, so I'm a little lost about it.

I realized it too that there is no need really for the key-disk, it's there for security purposes only.

Furthermore, I think I already tried some unpackers which should recognize exepack /link, yet all of them failed. Can u please direct me and explain what I am doing wrong. I would appreciate it.

thanx again,
dw.
DakienDX
03-16-2002, 10:51 AM
Hello dream-weaver !

You can unpack the file with any DOS unpacker, since LINK /EXEPACK does not really pack the file, only the relocations. You don't need to do this, I only did it to see if the file is working.

What jumps do I mean? A bit diffucult to explain. I single stepped through the file.
You'll come to a loop checking for the key disc after some time (2 minutes ;) ), there you've to reverse the jump checking if the disc is OK. Then you come to a serial check and after some version information is shown on screen (of course junk, since it's read from the floppy's boot record, which we don't have) you come around a lot other conditional jumps which must be reversed nearly all.

Then there should be a relocation routine which is skipped since there are no relocations and after that the usual packer cleanup procedure. (I hope you can identify it. ;) clearing all registers and setting up SS:SP and jumping to CS:IP)

Then you are at the entry point of the LINK /EXEPACK code. You could not see it before since the Cops Copylock II layer was around it.

You can dump the code then. Try writing about 150KB (filesize) to a file and write down SS:SP and CS:IP.

Create a .EXE from the dump and change SS:SP and CS:IP to it's right values. (If you like, you can unpack the relocations now)

Now you can run the file without a valid disc. :)
dream-weaver
03-16-2002, 03:07 PM
hey,

Well I must admit it does sound simple from u, but sorry, I still don't get it ;(

You said I can unpack this one with every DOS exe unpacker, yet I tried many of them and the result was the same: Nothing unpacked.

Then there's the jumps issue. You said that the only packer used is exepack /link (which I couldn't unpack with unp either). So why can't I see the disk- check routine and all those conditional jumps with a disassembler like IDA?

I already told u I tried a bpm int 13 in SICE and ended up in an endless loop of int13 which I couldn't get out of. So I have no idea how to trace this one (Another bpm maybe?).

Maybe I'm hopeless, Maybe I didn't do my tuts reading I don't know. If u can send me the de-protected exe maybe I will be able to understand what u explained a bit better.

I don't really know. Again, write anything u think is relevant and might be able to help.

thanx again,
dw.
DakienDX
03-16-2002, 03:28 PM
Hello dream-weaver !

Sorry if I'm too fast, but it was easy for me.

You can use UNP or any DOS unpacker to unpack the LINK /EXEPACK wrapper. But if you've not removed the Cops Copylock II wrapper yet, you can't unpack it this way of course. First you've to remove the outher layer before going on with the inner layer.

You can forget about a disassembler since the code is encrypted and a disassebler will just produce junk code. Some parts of the decryptor are also encrypted.

Maybe the endless loop of INT 13 you found in SoftICE was the disc check. It should be some Calls, one JNB and one JB in a loop. The first step is to reverse the JB by changing the Carry flag when being there in SoftICE. This can be done by entering R FL C. Now you should be out of the loop and be able to follow my other instructions.

Sorry, but I won't send you the unpacked file. This is no crack request board. It a board to ask for help when being stuck on unpacking a program.

But it wouldn't help you either. You would just notice that by replacing 150KB in a 152KB program and truncating the other 2KB the program is unpacked. Remember, the program is encrypted. Comparing the packed and unpacked file would give only differences, since there are no similarities.

I hope you understand me better now.


any simple beginners projects?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > any simple beginners projects?
PDA

View Full Version : any simple beginners projects?

ijsman
03-12-2002, 03:52 PM
i saw some reverse me progs, but they have all kinds of rules that i can't handle. Are there any simple ones? ore maybe a couple of good tutorials?
crUsAdEr
03-12-2002, 04:10 PM
Hi,

Check out zor.org/krobar for all the tutorials you need as a newbie :>

Cheers,
ijsman
03-13-2002, 08:21 AM
thanx for the link, but it's dead!
DakienDX
03-13-2002, 06:03 PM
Hello ijsman !

The link is not dead, it takes only much time to load. I can take more than 60 seconds, so stand by. ;)
Argoth
03-13-2002, 09:21 PM
Hi ijsman,

When I just started, I just went to http://www.download.com and download some apps. They were of no use but some were so easy, that even I could do them:

Find Serial with SoftICE for:

AceFTP any version (all versions I tried were too easy)
WinHacker 95 v2.0
Font Creator Program 3.0
TruView version 1.83
WinAmp SkinMaker v.0.41
Internet Tweak 2002 Standard Edition

Make a patch using W32Dasm:

GifMovieGear any version (serial is slightly harder to find)

Btw, are u Dutch too? ijsman sounds very Dutch to me :)

Grtz

Argoth


Accelerator Keys
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Accelerator Keys
PDA

View Full Version : Accelerator Keys

Tech19
03-12-2002, 09:18 PM
How can i attach an accelerator key to a menu function. For example i want to make it so that when i press Ctrl+A in notepad it Selects all. I have modified the Edit menu to say the Select All can be accessed by pressing Ctrl+A, now all i need to do is make it do that :) Any help appreciated...
DakienDX
03-13-2002, 05:50 AM
Hello Tech19 !

Open Notepad in a Resource Editor, choose Accelerators\1\YourLanguage and Accelerators\2\YourLanguage and insert "^A", 7" (On my Notepad it's 7, maybe your's is different, check it in the menu where you've already edited to insert \tCtrl+A)

Then save the file and enjoy.
Kayaker
03-13-2002, 06:16 AM
Hi

Unfortunately with notepad most of your work is already done. You've redefined the Select All menu string to display an accelerator string, now you just need to define it under the Accelerators resource using your favorite resource editor. Just mimic the syntax for an already existing accelerator since they're all defined slightly differently if you use Reshack, Exescope, Borland Resource Editor, etc.

(Actually it's exactly as DakienDX said, heh)

This should be all you need to do and the code should now accept your Ctrl-A. The question is, *why* is this all you need to do in notepad? When you select a menu item the WM_COMMAND message is sent to the menu window. If you've added the accelerator as above and set a bmsg breakpoint on the hWnd of the menu bar and select Ctrl-A you'll get this info from Softice:

:bmsg 2ec wm_command
Break due to BMSG 02EC WM_COMMAND (ET=1.35 seconds)
hWnd=02EC wParam=0007 lParam=00010000 msg=0111 WM_COMMAND

The high-order word of wParam is the resource ID of Select All (007) and the low-order word indicates the message came from an accelerator (0001). This is clarified in the Win32 Programmers Reference:

------------------------------------------------------------
WM_COMMAND
wNotifyCode = HIWORD(wParam); // notification code
wID = LOWORD(wParam); // item, control, or accelerator identifier
hwndCtl = (HWND) lParam; // handle of control

wNotifyCode
Value of the high-order word of wParam. Specifies the notification code if the message is from a control. If the message is from an accelerator, this parameter is 1. If the message is from a menu, this parameter is 0.

wID
Value of the low-order word of wParam. Specifies the identifier of the menu item, control, or accelerator.

hwndCtl
Value of lParam. Identifies the control sending the message if the message is from a control. Otherwise, this parameter is NULL.
----------------------------------------------------------------

Now you need to find where in code the WM_COMMAND message is processed. If you look at the code line you broke at on the BMSG breakpoint you'll see:

141F:07DE 6668741C4000 PUSH 00401C74
141F:07E4 666800000300 PUSH 00030000
141F:07EA EA16764F01 JMP 014F:7616

That very first address (401C74) is actually the start of the programs main message processing loop. So if you set a bpx breakpoint on it, specifying your regular CS value, i.e.
bpx 167:401C74
you'll be able to continue the tracing with the Select All message parameters as they are being processed.

Find where the WM_COMMAND message (111) is compared and you'll continue on to where the Resource ID's begin to be compared. You can actually find this easily in Wdasm by searching for the other menu commands such as Save and Copy.

You should find this snippet of code:

:0040125A 0FB7750C movzx esi, word ptr [ebp+0C]
:0040125E 83FE20 cmp esi, 00000020

This first line passes the stack parameter [ebp+0C] to esi. This is your Resource ID (0007 for Select All, 0301 for Copy, etc.). It then goes through a series of compares to find the proper routine for the proper menu item selected.

Now, the point of this whole explanation isn't to confuse the issue, but to point out something you'd need to know if you want to add accelerator keys to *other* applications that may handle this a bit differently, or if you want to patch in a new menu item/accelerator to handle some of your own code.

Notice the stack parameter [ebp+0C] is handled as a WORD PTR. With this syntax this effectively masks out the low-order word of wParam, which would indicate if it was from an accelerator (0001) or not (0000). If you were to check [ebp+0C] as a DWORD you'd see it was actually 00010007 if the accelerator was used. OK, so what you say?

Well, for notepad you don't need to do anything else, the code is taking care of all situations whether an accelerator is used or not. Look at how this is handled in a different app, Regmon:

------------------------------------------------
:00405BBD 25FFFF0000 and eax, 0000FFFF
; this line masks out the LOWORD(wParam)=0001 Accelerator key modifier
.
.
* Possible Ref to Menu: LISTMENU, Item: "Save Ctrl+S"
|
:00405BE4 3D479C0000 cmp eax, 00009C47 ;MenuItemID of "Save"
:00405BE9 7F69 jg 00405C54
--------------------------------------------------

Now if you were to patch in a new menu item somewhere, it would *have* to be after the accelerator key is handled, by essentially masking it out and ignoring it for the rest of the code, or you'd have to handle it yourself.

All I'm really trying to get across here is showing how to identify what the messaging loop is doing and how it handles accelerator keys, and point out that the *placement* of an inline patch to handle a new routine from a menu item is critical. If you ignored the accelerator key (if you used one), then you might find your code didn't work when you used the key and might wonder why.

Enough ramblings, hope this helped or something ;)

Cheers,
Kayaker


IDA Pro 4.17 and Windows CE apps (for MIPS processor)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA Pro 4.17 and Windows CE apps (for MIPS processor)
PDA

View Full Version : IDA Pro 4.17 and Windows CE apps (for MIPS processor)

novichok
03-12-2002, 10:03 PM
Hi,

Does anybody know hot to make IDA Pro 4.17 or 4.15 disassemble WinCE apps (for MIPS processor - I am using Casio e125)?
I tried to use Tsehp's essay about Slovoed but I could not disassemble exe file. May be Windows XP I am using makes my life so hard :(. I hate Micro$oft. I had enough troble with them.

I was wondering if somebody could help me!!!!

Novichok :confused:
Aimless
03-13-2002, 07:30 AM
May be Windows XP I am using makes my life so hard . I hate Micro$oft. I had enough troble with them.

So stop using it already and quit whining like a old lady. Get Linux and do what you want...

But seriously, You'll need:

1. IDA Pro 4.17 (regged!!)
2. The processor module compilation kit (again, from Datarescue, available to ~regged~ users ONLY, hence the above requirement)
3. Borland C++ 4.5 (Nope, above this version of Borland, it does not seem to work
4. Source code for MAKING the processor module (assuming you are smart enough to do that).

You need source, because a module compiled for one version of IDA does NOT run for other version of IDA. Making a module for 4.15 and trying to run on 4.17, IDA will kick you back to the OS you hate so much : XP :(

So...

Get going and start searching. ALL the above mentioned is available for free on the net (yup, regged too!). Only thing is you gotta know how to search...(you could try www.searchlores.org) to polish your searching skills...And remember while searching, that ALL search engines you are using report file only using the HTTP protocol, and most of THESE above required files are, or could be in FTP, you get the idea...

Have fun. And oh yes, don't forget to install linux (*barf*) so that you do not have to make do with ~shitty~ systems like XP. HUH!!

...Have Phun (on linux :))
novichok
03-13-2002, 06:41 PM
Thanks aimless!

I thought IDA Pro 4.17 already had module for MIPS. At least I can choose MIPS into processor list but I got a message: IDA kernel and IDP module mips.w32 are not compatible.

Any ideas why?

Novichok
DakienDX
03-13-2002, 07:14 PM
Hello novichok !

From your way you use 4.15 and 4.17 I know what's your problem.
IDA 4.17 Pro was never made available as warez, only 4.15. Some people wanted to make it look Pro by copying files from 4.15 to 4.17 Std.
Of course this did not work. As aimless already said "because a module compiled for one version of IDA does NOT run for other version of IDA".
novichok
03-13-2002, 07:51 PM
Thanks DakienDX !
Does it mean that I can copy this module to 4.15 version and it should work there? (I"ll try)

Novichok
DakienDX
03-15-2002, 04:06 PM
Hello novichok !

Why don't you try yourself?

How should I know for which version the module you have was compiled?

Buy IDA and you will be able to receive excellent support for all your question. And you'll get IDA 4.20. :)
Paqz
03-16-2002, 12:17 PM
Just use IDA 4.04 for WinCe apps
tsehp
03-17-2002, 01:11 PM
on ida's plugin I wrote there's an identifier near the dll_main that identifies the ida sdk version. you can try to modify it to enable the mod to work with upper versions.

but I'll always encourage you to BUY ida and support datarescue, this tool is too important for rce world.


Packers Signatures! (Or another lame thought?)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Packers Signatures! (Or another lame thought?)
PDA

View Full Version : Packers Signatures! (Or another lame thought?)

foxthree
03-13-2002, 09:48 AM
Hi fellow RCEs:

Out of sheer curiosity (or boredom ;) ), I thought I'd start up a collection of various packers and their OEiP Sigs. That way we can have a comprehensive way of dumping at OEiP (instead of debugging the polymorphic engine itself!).

What I wanted to know from your experience is that:

1. Has this already been attempted (i'm sure FileScanners already implement some form of this)
2. What has been the success rates (sigs have to be fairly invariant for this project to be successful... note: I use the term "fairly")
3. Any other thoughts (...including calling this one a lame idea :p)

Thanks for sharing your wisdom,

Signed,
-- FoxThree

PS: Kayayker: If one can compile such information and write an app that can identify OEiP given the executable, is it worth a mini-project in RCE? Thanks!
crUsAdEr
03-13-2002, 12:37 PM
Hi fox3,

SplAj did started some sort of packer signature bytes some time ago, i dont know when but before i came to join this board... you might wanan check with him if he is still compliling them... think he'll be glad to let you try and carry the job...

Search the board, ya will find his signature bytes list :>, not so updated though...

Regards,
foxthree
03-13-2002, 12:57 PM
Hi binh81:

Thanks once again for your insightful tip!

Keep up the good work!

Signed,
-- FoxThree
Kayaker
03-14-2002, 07:41 AM
Originally posted by foxthree

PS: Kayayker: If one can compile such information and write an app that can identify OEiP given the executable, is it worth a mini-project in RCE? Thanks!

Hi FoxThree

Could be interesting... What are you thinking of, an app which loads the target program, allows it to run to decrypt the signature bytes, then searches for and retrieves the address of the signature bytes pointing to the OEP? I don't usually do the signature byte thing myself, but I assume they're not identifiable in a hex dump of the packed file, so you might have to implement some sort of dll injection so that your program runs in the same address space as the target program so that it can search its memory in a valid context.

One problem with the dll injection idea though is that the addresses of the high memory unpacking code (and the 'jmp eax' or whatever signature bytes) will be different if you *don't* have an injected dll. This is one thing I've noticed with at least Asprotect, so you'd be giving the user false information if you give them that address, unless they also used your loader to run/unpack the program.

Binh81 is right, you might want to build on the work of Splaj (if that was cool), because he definitely had the definitive list of sigs at one time. You might want to consider allowing the user to edit the list to add new ones as well as they are discovered, rather than hardcoding them all and having to worry about updating it yourself.

There may be easier ways to do what it is you want to do, but then that's what the project discussions would be about wouldn't they? ;) I had said that I'd be happy to see people using the mini project forum to develop and get feedback on their own reversing tools, seems a perfect venue for that, so I can't see any problem in using it to start discussing your project ideas if you want.

I or one of the other mods can move this thread there, or you can start a new one when you're ready if you like. I'll help however I can.

Regards,
Kayaker
foxthree
03-14-2002, 04:05 PM
Hi Kayaker:

Thanks for your informative words of wisdom. Now, I'm even more motivated. I have a *slightly* better idea than injecting a dll. I'll have a beta soon (atleast for ASPR). I'll start the thread then.

Thanks again,

Signed,
-- FoxThree


why not decrypt in exe ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > why not decrypt in exe ?
PDA

View Full Version : why not decrypt in exe ?

glx2k
03-13-2002, 11:40 AM
hi guys

I have been reading some anti crack texts, and one of the things I read was that you should never include the decrypt algorithm in the program or making a keygenerator would be "easy". Why not? my registration scheme is something like this and don't see any obvious fault.

I generate on my pc
encrypt(username, key) => scrambled

on end-pc
registered = decrypt(scrambled, key) == username

To make a key generator I think the username should be part of what's processed on the end-pc, like

encrypt(username, key) => scrambled
registered = encrypt(username, key) == scrambled

but such a registration scheme doesn't make much sense to me.

well please enlighten me ;)
foxthree
03-13-2002, 12:12 PM
Hi there:

Well, the answer to your question is and cannot be direct. For years, s/w authors have been doing what you're saying... Okey, let's get to some details....

Typically, users must register the program, so you need two values (A) a name or something (B) a function that generates a deterministic value out of this. This is your registration function, right?

So,

Keycode = RegFn(name) /* substitute name with anything */

To do verification, you need the inverse of this function

purported name = RegFn-1(KeyCode) /* treat -1 as inverse */

Now, this is what is shipped with the software right?

As a cracker, it is fairly *easy* to step through your code/do a dead-listing and obtain the algorithm for Part 2. So given a keycode what it decrypts to and there by compute part 1 (the keygen). Hope I'm making sense....

Now, s/w authors are fast learning all the tricks and do not do key checks in one place. Now there are tricks ranging from validating the key on opening of the application (and not during keying in the reigstration information itself) to having the keyverification happen on the server (C***Ftp style ;-)).

But again as history proves, every single scheme is broken, except the latest ones that involves strong crypto algos (like PK)...

So, my suggestion would be:

(1) Implement a strong algorithm in the first place
(2) Expect your algorithm to be reversed
(4) Have a plan "b" always ;)

Hope all this rambling makes sense....

Signed,
-- FoxThree
glx2k
03-13-2002, 12:38 PM
Originally posted by foxthree
As a cracker, it is fairly *easy* to step through your code/do a dead-listing and obtain the algorithm for Part 2. So given a keycode what it decrypts to and there by compute part 1 (the keygen). Hope I'm making sense....

:confused: not to me ;)

If I get you right you give my decrypt a random string (S1) and then sees what that decrypts to. (S2)
Then you look at S1, S2 and the decryption algo. from that you figure out the encryption which you use in the key-generator. The decryption algorithm is not used in the key-generator at all (just to be sure of it)
mike
03-13-2002, 03:16 PM
It depends on what kind of cipher you're using. If it's symmetric, like DES, then the encryption alg is the same as the decryption alg in reverse. In order to check the encryption, the key has to be embedded in the code, so you make it possible for others to reverse out the key and use it in a keygen.

If you use public-key algorithms, then your method works just fine. You encrypt some data with your private key (i.e. you sign the data) and the public key in the program verifies it. This is how digital certificates in Netscape & Internet Explorer work.

The problem is, the person running the program isn't concerned about the actual validity of the certificate; in fact, he wants the program to run on a fake one. So he could put a different public key in for which he knows the private key, or NOP the check against the valid string, or change the valid string, or any number of other things.

Checksumming helps a lot in this case--you initialize variables in your program with data from the decryption key and the valid string, etc., so if they change anything, the program quits working.


Analysis of ASProtect Keygeneration scheme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Analysis of ASProtect Keygeneration scheme
PDA

View Full Version : Analysis of ASProtect Keygeneration scheme

foxthree
03-13-2002, 12:54 PM
Hi Folks:

I present below some of my analysis of the ASProtect's keygeneration scheme. I may be entirely off but like I said it is just my analysis that I wanted to share with fellow RCEs...

Okey. I recently acquired a ASProtect Key ;)

Just by looking at it one can see that it is Base64 encoded. So, let's decode...

Decoding gives us 129 bytes of data..

hmmm.... this reminds me of ....... yes "PK Signatures"

In PK cryptography, you can sign arbitrary amounts of data and some algorithms generate 128 bytes of output signature.... (sometimes it is 128-bits also....)

So, my analysis is this is what probably Alexey does in his labs :p

(A) Get the userinformation (like name, email)
(B) Frame a string and end it will null (explains the last 129th byte)
(C) Uses his "Private key" to sign the data and
(D) Base 64 encode this

Distribute this as key...

On the application side, each app has the public key! So decrypt, check few bytes in the header to see if decryption is sucessful. If yes, say registered else run as unregistered app.

What do you guys think?

Signed,
-- FoxThree
mike
03-13-2002, 03:08 PM
I haven't looked at it, so I can't say. MD5 has 128-bit output, so he may hash the information before signing it. Most PK stuff will use at least 512 bits, because 128-bit numbers are almost trivial to factor.

Modular exponentiation happens in a loop over the exponent bits where you'll have a squaring and a conditional multiply (if the exponent bit is one) followed by a modular reduction. Chances are he'll use some kind of bignum code if he's doing PK stuff. Have you seen any code similar to that?
LaptoniC
03-13-2002, 04:59 PM
According to Asprotect v1.1 keygen info,
Protection =RipeMD 160 , MD5, RSA-1024 and offcourse base64 encoding
mike
03-13-2002, 05:33 PM
RSA-1024

Yeah, that makes sense: 128 bytes = 1024 bits

Is the decryption key checksummed? If not, then you can replace it with your own.


Tutorial: finding encryption code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Tutorial: finding encryption code
PDA

View Full Version : Tutorial: finding encryption code

mike
03-13-2002, 03:36 PM
Here's a short tutorial on finding encryption code within a program.

First, you have to know what you're looking for. Is it hashing a password? Is it encrypting a file? Is it doing a digital signature?

Read any docs on the security of the product; often they'll name specific algorithms, which will narrow your search by a lot.

Hash functions

There are a few standardized hashes that are used all the time. MD5 and SHA are two of them. A hash function takes a block of data and mixes it into some state registers. The final state of the registers is output as the hash. The initial state, though, is always the same. You can search the exe for these constants to find the hashing code.

Hashing code is also full of small nonlinear functions; lots of and's, or's, and xor's, very densely packed. Hashing code doesn't have jumps--it's pages and pages of bit operations.

A hash will nearly always have three calls associated with it: the init function, the update function, and the finalize function. Finalize pads the end of the data out to a certain size and appends the length in bits to form the last block. This prevents certain attacks.

Stream ciphers

Encrypting a file is often done with a stream cipher like RC4. RC4 has an initialization loop where it fills a 256-byte block with the values 0-255.

Also, stream ciphers are going to XOR the plaintext with the random output bytes. I found the encryption code for WordPro by dumping the exe in WDASM. I wrote a small program to search for XORs where the first and second parameters weren't the same. I only had to glance at the code surrounding about 20 of them before I found it.

Block ciphers

There are also a few popular block ciphers that get used a lot. DES used to be popular; Blowfish, IDEA, are some others, and now that AES is in place, Rijndael will become much more popular. In order to make these run fast, there are optimizations that usually occur as precomputed tables (especially Blowfish). You can search on these popular implementations.

Block ciphers generally work on 64-bit or 128-bit chunks of data in a big loop.

Public Key

Public Key crypto is only done well with bignum code. Operations nearly always include modular exponentiation. Modular exponentiation is done in a loop over the bits of the exponent, where the number is squared, conditionally multiplied, and then reduced.

Good luck, and happy cracking!
crUsAdEr
03-13-2002, 09:19 PM
Thanx Mike,

Was looking for something like this myself :>...

Keep up the great work :>

Cheers
crUsAdEr
03-28-2002, 10:09 PM
The Advanced Archive Password Recovery (2.0) story

As requested by Mike, here is my little contribution to the community, how i cracked Archpr 2.0... as this is only about crypto, i will not discuss any other aspect beside the Encryption routine..

The app is AsProtected so we have to unpack it first... After unpacking, trying to make the app register you will hit the registration check routine at 40A071... I patch it so that it always return eax=1, the app looks registered but trying bruteforce a 6 characters Zip password will cause a crash....

Looking into the registration routine again, you will see this
.text:0041A0A0 lea ebx, [eax-2]
.text:0041A0A3 lea eax, [ebp+var_6C]
.text:0041A0A6 call Call1
.text:0041A0AB lea edi, [esi+4]
.text:0041A0AE mov edx, edi
.text:0041A0B0 lea eax, [ebp+var_6C]
.text:0041A0B3 call Call2
.text:0041A0B8 lea edx, [ebp+var_6C]
.text:0041A0BB lea eax, [ebp+var_10]
.text:0041A0BE call Call3
.text:0041A0C3 mov ebx, 10h
.text:0041A0C8 mov edx, offset unk_43A160
.text:0041A0CD lea eax, [ebp+var_10]
.text:0041A0D0 call Compare10bytes
.text:0041A0D5 test eax, eax
.text:0041A0D7 jnz short bad
.text:0041A0D9 lea eax, [ebp+var_6C]
.text:0041A0DC call Call1
.text:0041A0E1 mov ebx, ecx
.text:0041A0E3 mov edx, esi
.text:0041A0E5 lea eax, [ebp+var_6C]
.text:0041A0E8 call Call2
.text:0041A0ED lea edx, [ebp+var_6C]
.text:0041A0F0 lea eax, [ebp+var_10]
.text:0041A0F3 call Call3
.text:0041A0F8 lea eax, [ebp+var_10]
.text:0041A0FB call FindEqualHash
.text:0041A100 test eax, eax
.text:0041A102 jz exit

Look into Call1 we'll see this
.text:0041A58B mov dword ptr [eax], 67452301h
.text:0041A591 mov dword ptr [eax+4], 0EFCDAB89h
.text:0041A598 mov dword ptr [eax+8], 98BADCFEh
.text:0041A59F mov dword ptr [eax+0Ch], 10325476h
.text:0041A5A6 mov dword ptr [eax+10h], 0
.text:0041A5AD mov dword ptr [eax+14h], 0
.text:0041A5B4 mov dword ptr [eax+58h], 0
.text:0041A5BB retn

yep, looks like some kind of hashing... refer to Mike's note
*******************************************
A hash will nearly always have three calls associated with it: the init function, the update function, and the finalize function.
*******************************************
Look into Call2 we will see that it is "also full of small nonlinear functions; lots of and's, or's, and xor's, very densely packed. Hashing code doesn't have jumps--it's pages and pages of bit operations."... it only make a few call to the same routine
call sub_41A9E2

look into this call we will see more bits operation and see lots of constant
2895b588
173848AA
242070DB
3E423112
0A83F051
4787C62A
etc...

To quote Dakien
*****************************************
You'll notice that NEG(2895B588h)=D76A4A78h. (The same goes for the other values you've given us)
The hash uses Sub EDI,2895B588 instead of Add EDI,D76A4A78. The only thing which has changed is the sign, not the result.
*****************************************

Yep, so this definitely help us identify that it is MD5, no more doubt about it....

So now we can safely replace Call1, Call2, Call3 by M5Ini, MD5Main and MD5Finalise...

now change that with IDA and we'll see what the registration routine is doing, first it check the middle part of our serial with a fixed hardcoded hash, then it find the MD5 Hash of the whole serial and compare with a look up table containing something like 1000 hardcoded hash... if either check fails error message pops up.. if both are passed then AsProtect API is called to decrypt code...

---------------------------------------------
to be cont.
crUsAdEr
03-28-2002, 10:27 PM
Okie, now after we find the AsProtect API routine, step into it we'll see
heap:00B8C64C push ebp
heap:00B8C64D mov ebp, esp
heap:00B8C64F push ebx
heap:00B8C650 push esi
heap:00B8C651 mov esi, [ebp+0Ch]
heap:00B8C654 mov ebx, [ebp+8]
heap:00B8C657 push esi
heap:00B8C658 mov ecx, ebx
heap:00B8C65A mov edx, ds:length ; edx := 9C
heap:00B8C660 mov eax, ds:offset
heap:00B8C665 call sub_B8C470 ;STOP here
heap:00B8C66A push esi
heap:00B8C66B push ebx
heap:00B8C66C call sub_B8C678
heap:00B8C671 pop esi
heap:00B8C672 pop ebx
heap:00B8C673 pop ebp
heap:00B8C674 retn 8

Okie, trace until line B8C665... look at data stored in edx we'll see edx = 9Ch, look at data pointed by eax we'll see some garboge, look at ecx we'll see part of pur serial.... Okie, trace over the call and you will notice data pointed by eax have changed.... Name the call sub_BBC470 as Call Something

Continue tracing, try tracing over the second call and the prog will crash... so restart again... trace into the second call this time, you will see this
heap:00B8C678 push ebp
heap:00B8C679 mov ebp, esp
heap:00B8C67B push ebx
heap:00B8C67C push esi
heap:00B8C67D push edi
heap:00B8C67E mov edi, offset off_B93554
heap:00B8C683 mov ebx, ds:offset
heap:00B8C689 mov eax, ds:length
heap:00B8C68E mov ecx, 0Ch
heap:00B8C693 cdq
heap:00B8C694 idiv ecx
heap:00B8C696 mov esi, eax ; esi := Dh
heap:00B8C696 ; Number of segment of original code to be decrypted
heap:00B8C698 test esi, esi
heap:00B8C69A jle short decryptDONE
heap:00B8C69C
heap:00B8C69C loc_B8C69C: ; CODE XREF: sub_B8C678+69j
heap:00B8C69C mov eax, [edi]
heap:00B8C69E mov eax, [eax]
heap:00B8C6A0 add eax, [ebx]
heap:00B8C6A2 inc eax
heap:00B8C6A3 mov dword ptr [eax], 1
heap:00B8C6A9 mov eax, [edi]
heap:00B8C6AB mov eax, [eax]
heap:00B8C6AD add eax, [ebx+4]
heap:00B8C6B0 mov edx, [ebx+8]
heap:00B8C6B3 call sub_B8C63C
heap:00B8C6B8 mov eax, [ebp+arg_4]
heap:00B8C6BB push eax
heap:00B8C6BC mov eax, [edi]
heap:00B8C6BE mov eax, [eax]
heap:00B8C6C0 add eax, [ebx+4]
heap:00B8C6C3 mov ecx, [ebp+arg_0]
heap:00B8C6C6 mov edx, [ebx+8]
heap:00B8C6C9 call Something
heap:00B8C6CE mov eax, [edi]
heap:00B8C6D0 mov eax, [eax]
heap:00B8C6D2 add eax, [ebx+4]
heap:00B8C6D5 mov edx, [ebx+8]
heap:00B8C6D8 call sub_B8C644
heap:00B8C6DD add ebx, 0Ch
heap:00B8C6E0 dec esi
heap:00B8C6E1 jnz short loc_B8C69C
heap:00B8C6E3
heap:00B8C6E3 decryptDONE: ; CODE XREF: sub_B8C678+22j
heap:00B8C6E3 mov al, 1
heap:00B8C6E5 pop edi
heap:00B8C6E6 pop esi
heap:00B8C6E7 pop ebx
heap:00B8C6E8 pop ebp
heap:00B8C6E9 retn 8

Hmm, that Call Something is called again, try tracing down, you will see that the value 9Ch (remeber this?) is divided by Ch, equals to Dh and is stored in esi...

Okie, trace down a bit more, we'll see that ebx is pointing to the garbage that eax was pointing to just now, the first dword is added to eax, eax was originally 400000 (image base), then a value of 1 will be move into data pointed to eax, most likely ur prog will crash here when u execute this command ... so again, restart the app and trace, skip that instruction at B8C6A3, trace untill you reach that Call Something again, we can see that again the second and third dword from the garbage we saw earlier is passed on as parameter... stop here... so now we can decide that Call Something is a decrypt call that decrypt data pointed to by eax... length stored in ecx and key stored in edx....

Okie, rename Call Something to Call Decrypt and start tracing into it again....

-----------------------------------------------------
to be cont.
crUsAdEr
03-28-2002, 10:47 PM
Phew, okie almost there... this is more stressful than cracking, i just dont know whether i should post more code, or write more explanation.. ah well....

Trace into Call Decrypt we'll see something like this in the middle
heap:00B8C49B mov ebx, eax
heap:00B8C49D mov eax, ebx ; Working Area Offset
heap:00B8C49F mov edx, [eax]
heap:00B8C4A1 call dword ptr [edx] ; MD5 Initialise??
heap:00B8C4A3 mov edx, edi ; serial
heap:00B8C4A5 mov ecx, [ebp+arg_0] ; ecx = 10
heap:00B8C4A8 mov eax, ebx ; Working Area Offset
heap:00B8C4AA mov edi, [eax]
heap:00B8C4AC call dword ptr [edi+4] ; call B84E90
heap:00B8C4AF mov eax, ebx
heap:00B8C4B1 mov edx, [eax]
heap:00B8C4B3 call dword ptr [edx+8] ; call B84E08
heap:00B8C4B6 push 0
heap:00B8C4B8 mov eax, ebx
heap:00B8C4BA mov edx, [eax]
heap:00B8C4BC call dword ptr [edx+0Ch] ; add eax. 48
heap:00B8C4BF push eax
heap:00B8C4C0 mov eax, [ebx]
heap:00B8C4C2 call dword ptr [eax+10h] ; mov eax, 10
heap:00B8C4C5 mov ecx, eax ; ecx = 10
heap:00B8C4C7 mov eax, esi ; eax : offset of some procedure
heap:00B8C4C9 pop edx ; edx = hashstring
heap:00B8C4CA mov edi, [eax]
heap:00B8C4CC call dword ptr [edi+14h] ; call B89418
heap:00B8C4CF mov edx, [ebp+var_8]
heap:00B8C4D2 push edx ; length to be decrypted
heap:00B8C4D3 mov eax, [ebp+var_4]
heap:00B8C4D6 mov ecx, eax ; area to be decrypted
heap:00B8C4D8 mov edx, eax
heap:00B8C4DA mov eax, esi

All the call [edx]. [edx+4].. etc .. [edi+14] looks suspicious, so i traced into each of them... looking at the first 3 call we'll see familiar MD5 routines again.. so it is MD5?

The next 2 calls dont do anythiing important.. i am not sure what the last call do sp forget it first...

After that, a few instruction down, you should see this,
heap:00B8C4D6 mov ecx, eax ; area to be decrypted
heap:00B8C4D8 mov edx, eax
heap:00B8C4DA mov eax, esi
heap:00B8C4DC call sub_B89050

yeah, step over this call and you will our data in the area to be decrypted change, so trace again and step into it... keep pressing F8 and watch out for "non-linear operation", then you will see how teh decrytion is done.... fairly simple, the algo is posted in the other thread... figuring out the algo, we can identify that it is TEA.... Chained Block Cipher with 2 keys... again refer to the thread "stream cipher??" for details on the algo...

Okie, i hope you have read the other thread, now we need to identify how the Dynamic Key is initialise... do a bpm on the key and re run the app, it will break and after a bit of tracing you will realise that you are in the call [edi+14] (mentioned above)... so now we can identify this last call as DynamicKeyGeneration...

Tracing through the routine on DynamicKeygen, you will realise that it is similiar to the TEA decryption routine with some small changes, work out the algo we can see that it is the reverse of the MAIN TEA decryption, so this is the TEA encryption routine...
So now we know that dynamic key is generated by encrypting "FFFFFFFFFFFFFFFF" with out Static key... so all we need to find is the static key and everything is solved... note this static key is an MD5 hash of part of our serial...

So now, the task lay out to you, FIND the TEA key... with this key we can decrypt the code, and dump our decrypted code to obtain a fully functional version...

You have 2 choices, bruteforce it... the key pattern for version 1.0 is ARCHPR-xxxxxxxxxxxx-xxxxxxxxxxxxxx :>>> I tried bruteforcing 6 digits and it took me 14 mins, imagine 12 or 16 digits :>... OR... the second solution is to find the TEA key that the forgetful programmer "FORGOT" to remove from the exe file :>>>

That is it... i dont know if any one actually bother read all this crap... think i dont know how to explain myself well... but HEY, i try :>... so keep cracking... :>

Cheers,

P.S : Off for a beer, i neva typed so much before, i am doing all this because i am grateful to all teh dudes here who have helped me so much in the last 1.5 months since i joined this forum... all i can tell u, RCE Forums rocks... no where else ppl are friendlier and more helpful... ok, enuff.... see ya around
Woodmann
03-28-2002, 11:12 PM
Howdy Binh81,

Now you can re-write it and have it published
for a tutorial :D

Peace, Woodmann
radiant
04-18-2002, 11:31 PM
Hi binh81,

I've been following all this very closely, printed both threads (stream cipher) and read over them more times than I care to admit. There is one thing that still doesn't make sense to me.

You said:
****************************************************
"The app is AsProtected so we have to unpack it first... After unpacking, trying to make the app register..."
****************************************************

When I "unpack" ASProtected programs, I normally remove the ASPR code completely. The "heap:00??????" code you posted really has me wondering if ASProtect has really been removed?

The documentation for ASProtect states it has features to create encrypted portions of code that are only decrypted in "Registered User" mode. The real question is if the encrypted portions of the program are being decrypted by ASProtect or being decrypted by custom code written by the application programmers?

As fox3 pointed out in the RSA thread, the typical key for an ASProtected program is a Base64 encoded string that yeilds 129 bytes (decimal) when it's decoded. A portion of the 129 bytes must be used to store text information like user name, email or whatever.
Unless there is a way to actually generate the "text" from a PK signature, then I doubt it's a signature like he suggests. On the other hand, if the code snippet you posted is actually ASProtect doing the work, then another portion of the ASProtect key should be used to generate the MD5 hash creating the "static" TEA key.

In other words, I'm betting the "Registration Code" (a.k.a "serial") box in the program is actually expecting an ASProtect key.

For some strange reason I want to remember you stating that only a portion of the "serial" was used in the MD5 to create the TEA key but I can't find the exact statement... -Maybe it's just wishful thinking.

If I wasn't dreaming and you really did say only a portion of the "serial" is used in the MD5 hash to generate the TEA key, could you tell me what part of it was used and whether or not it was Base64 decoded first?

Anyhow, if you look at the project file created by ASProtect when it's used to protect programs, you'll see a set of keys:

[Keys]
A=xKjEkcBL7nU1LRb8wP5yyQ==
E=d7D30I9tXwsrvS <snip> 5Qnoyzs=
D=B4/7wm5aaC6rx <snip> ERsbK8=
N=tXM5G3gsRSyp4 <snip>noaLp64xMrrA=

All of them are Base64 encoded and the latter three are long (probably 129 bytes but I haven't checked) like the registration keys. The "A" key is short and yields 16 bytes on decode... possilbly used for the hash genereating 128-bit TEA key?

Thanks to everyone for the great threads.

radiant
crUsAdEr
04-19-2002, 02:32 AM
Hi radiant,

the Heap was memory dump i dump and inserted into the end of my dumped file so that i can idsassemble and annalyse the decryptiong routine... of course this is only for analysing, the final dump will be free of AsProtect... I use LordPE "partial dump" to dump these code section from AsProtect high memory... i advise u to do so as well cos IDA definitely helps a lot... (Heap was the name of the new section i appended to the dumped file :>)

+++++++++++++++++++++++++++++++++++++++++
As fox3 pointed out in the RSA thread, the typical key for an ASProtected program is a Base64 encoded string that yeilds 129 bytes (decimal) when it's decoded. A portion of the 129 bytes must be used to store text information like user name, email or whatever.
Unless there is a way to actually generate the "text" from a PK signature, then I doubt it's a signature like he suggests. On the other hand, if the code snippet you posted is actually ASProtect doing the work, then another portion of the ASProtect key should be used to generate the MD5 hash creating the "static" TEA key.
+++++++++++++++++++++++++++++++++++

I am not quite sure what you mean here... I have seen this implementation MD5-TEA in a reget deluxe, so i think this is one of the option AsProtect provide... it might provide another scheme for RSA maybe?

++++++++++++++++++++++++++++++++++++
For some strange reason I want to remember you stating that only a portion of the "serial" was used in the MD5 to create the TEA key but I can't find the exact statement... -Maybe it's just wishful thinking.

If I wasn't dreaming and you really did say only a portion of the "serial" is used in the MD5 hash to generate the TEA key, could you tell me what part of it was used and whether or not it was Base64 decoded first?
+++++++++++++++++++++++++++++++++++

LOL :>
Yeah if my memory doesnt play trick on me, you are right... very early in the serial checkign routine, (in program code section, not my Heap :>) you will see that the serial length must be even, then a substring starting from the 3rd byte, length if half of full serial length - 2 (or was it 4)... some thing like that...

The serial format is something like
ARCHPR-xxxxxxxxxxxxx-xxxxxxxxxxxxxxxx
i think the part CHPR-xxxxxxxxxxxx- is used to calculate the TEA key but i might be worng, cant recall at the moment...

Nope, i doubt there was any Base64 involved in this, not that i can remember.... cos i did not manage to find the original serial :<<... tried bruteforcing MD5 with 7 digits and it took me like half a day or something... i only found the TEA key and use it to decrypt the code section, then patch the registration routine and that is it... a full working version to be uninstalled :>>

Hope this clarify some doubt, :>
Regards
nikolatesla20
04-19-2002, 05:18 AM
Dang this stuff is above my head yet......

WOw binh81, you actually were able to unencrypt some code..I could use that in my latest dumps of **protect and **pack :) :)

Running fine, just a few encrypted code fragments still in there tho...

Always the option of adding the missing functionality myself too. Code snippet creator works wonders.

-nt20
radiant
04-19-2002, 06:02 AM
As for your appended heap, I was pretty sure it was ASProtect code but I just wanted to make sure before I go leaping to incorrect conclusions. I've got some good news for you. Last weekend a new feature was added to WinHex (v10.45) that allows filling unallocated memory with "?" (0x3F)... As you can guess, this is very helpful for dealing with polymophic code, protectors and what ever other forms of nonsense you might come accross because by keeping the addressing correct with the padding, it allows you to disassemble a "complete" dump including heap, stack and all. If you've got the disk space you can dump the entire VM to a file. With ASProtect and others, just toss the program into an endless loop with sice, pull the whole thing from memory and disassemble in IDA without dealing with trying to find and dump then properly load every allocated chunk of memory used back into IDA. It's a real time saver.

I'm not after learning how to crack programs, instead I'm learning to do security audits on them. Unfortunately, ASProtect doesn't leave any choice but to remove the protection, so in spite of not being a cracker, I'm still learning how to crack. -I should have taken up a hobby like knitting rather than security.

"! 1, perl 2..."
-Ooops, that's supposed to be "knot one, pearl two..." :-)

Anyhow, I'm auditing a program very similar to yours. It uses ASProtect and it's typical "Disabled-And-Encrypt-Function" feature. In your case you have a "serial" entry box created by the programs authors. If you look at the ASProtect API you'll see they are probably calling the SetDecryptionKey function someplace in their code. More details on this function (and code snippets) are in the help file for ASProtect.

In my case there is no place to enter a serial, so the protection is done entirely through ASProtect features and ASProtect registration keys. In other words, it's a major pain. The typical ASProtect registration keys take the form of a *.reg or *.key file (an associtation is made to regedit for the *.key extension) but there are acutally four acceptable ways to format them (see ASProtect help file) and a couple places in the registry where they can be stuffed (HKCU, HKLM...).

These ASProtect keys, when Base64 decoded, yield 129 bytes of data. Some of the bytes are user info like name, email and whatever so they are obviously variable. But some portion of these bytes must be "fixed" so they can be used to create the 128 bit TEA key for decrypting the encrypted portions of the program. I had hopes you had figured out what bytes in the ASProtect keys are the "fixed" portion and only now realized I had my apples and oranges confused.

Yep, I tried making multiple keys, decoding them and using bin compare but as expected, it was a fruitless effort.

It's obvious there is a flaw someplace in ASProtect. There is no way that SAC of the UnpackingGods group could have performed the cryptanlysis necessary to actually break TEA and register the ASProtect program. The bytes necessary for creading the MD5-TEA key are probably stored someplace in the program, just like they are in your situation. All the same, it still doesn't make sense why the creator of ASProtect would do such a thing but who knows...

radiant
radiant
04-22-2002, 10:23 AM
Hi binh81,

Is there any chance you'd post the disassembly of the modified TEA encrypt and decrypt routines? I've managed to find all the Base64 and MD5 code but I'm not sure what I'm looking for with this modified TEA algorithm (assuming this is using the same algorithm).

Thanks,
radiant
crUsAdEr
04-22-2002, 11:18 AM
Hi radiant,

Well... i dont think it is modified TEA... it thought it was cos i was learning and i did not know how TEA looks like... so some of the earlier statement were rather inaccurate... It is just usual TEA i think... like i said somewhere in my post (if i remmeber correctly), when u are done with the MD5 algo, do a bpm on the MD5 hash output then u should be in the middle of the TEA routine....

Hope this helps, if not you should try to trace with F8 into the first call after the routine i posted in the in the third post of my long "explanantion" in this thread... the first "normal" call after all the MD5 call [edx], call [edi+4], call [edx+8],.. call [edi+14]

Cheers,
Binh

P.S : i will post the offset here if u still cannot find it, right now i am not at home....


time for a new mini project?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > time for a new mini project?
PDA

View Full Version : time for a new mini project?

figugegl
03-13-2002, 08:15 PM
i've found a very nice newbie miniproject at

h**p://www.planet-repro.net/rms.php

zack's reverseme #1 and #2. Unfortunately all is in german, but you will see what's going on.

reverseme #1: add code to display a messagebox, msgbox api already in imports (level: easy)

reverseme #2: the same, but there's no import for the messagebox (level: middle). i've written a (german) tutorial for the second one, it's available for download at the same site.

i think this makes for a very interesting mini project.

figugegl
Kayaker
03-14-2002, 03:57 AM
Hi

This sounds like a good one figugegl. Unfortunately I'll have absolutely no time to join in or be of much help for a few weeks, but this sounds like a nice extension to the recent Import Table project. I might suggest trying to use IID King by SantMat to add whatever import(s) might be necessary (should be available at Protools), and then carefully examining the changes that were made and try to duplicate that manually.

While automagic tools are without doubt useful, it's always more fun, satisfying and instructional to be able to make changes to the PE file manually. Refer back to the Import Table project and the docs and information there for an understanding of the structure of the import table. Adding an import manually should give you a *solid* background for general modifications of the PE format.

Good luck and have fun,

Kayaker


Error running Revirgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Error running Revirgin
PDA

View Full Version : Error running Revirgin

caraveiro
03-13-2002, 11:23 PM
Hi There!!!!

I'd installed Revirgin 1.3.0.0 on a PIII 850/256RAM NT Wks 4.0 Sp6a...

And when I run Revirgin it popup a message box that says:

Revirgin.exe - Entry Point no found

Procedure's Entry Point CreateToolHelp32Snapshot was no found in the Dinamic Link Library KERNEL32.DLL

So, I think I was about' NT WorkStation SP6a imcompatibility with the Revirgin version 1.3 so I'd Downgrade to version 1.1.0.9 witch was working fine.....

But the Same message still poping....

Does anybody knows what's going on????

Does this trouble is relative with the MSI installer???

Thank in Advance!

http://www.logicbit.com/Voodoo/voodoohd1.gif
Solomon
03-14-2002, 02:01 AM
quote from tsehp

Should work on win98, me and win2k , not win nt. (soon on xp)
tsehp
03-17-2002, 01:14 PM
to scan the processes, I'm forced to use psapi.dll on nt4, I don't want to maintain compatibility with nt4, meant to disappear.

regards,

tsehp
CrackZ
03-17-2002, 04:03 PM
Hiya,

Sorry I'm just going to force Tsehp to clarify this one ;-).

As far as I recall, CreateToolhelp32Snapshot() was part of Toolhelp API (and not part of NT) as Tsehp says, PSAPI is used (should I say can be used) under NT, (was how ProcDump operated anyway).

I'm just curious why that specific error message appears, did you forget to detect the OS version RV users are using Tsehp? ;-) and perhaps a second point, why the abandonment of NT support?, it surely must have been useful at some point, and thus if the code is already there but a bit flaky, I'm of the school of thought to leave it in there with a disclaimer and see if end-users can make some use of it (you are welcome to disagree with me there).

Then again as I'm not privy to RV's internal informations maybe there was a good reason no longer to support NT, so just tell me to shut up if I'm making a worthless point here ;-).

Regards

CrackZ.


need ideas on how to attack an Authentication and Encryption model I thought of
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > need ideas on how to attack an Authentication and Encryption model I thought of
PDA

View Full Version : need ideas on how to attack an Authentication and Encryption model I thought of

Lord_Soth
03-14-2002, 01:37 AM
hi guys,

First let me start by saying that I am by far not a crypto guru. I just
happened to get caught up in the need to secure a TCP session
using both authentication and encryption, and I'm slowly studying
the matter.
The situation is as follows:

There are two programs, one the client and the second is the server.
These two tiers communicate using some protocol over TCP.
The goal is to provide an authentication mechanism based on a
password/passphrase, and then have the traffic between the two
encrypted so that anyone sniffing it will not be able to figure it out.
The idea is to not only secure the traffic, but making sure only the
appropriate user can use the server (it is designed to be used by
only one person at a time).
So far, that is the problem, now to my idea, which I have no way
of judging if is even secure.

Let's take the assumption that the server knows the correct
password. For the sake of argument, it is encrypted using MD5
and stored locally on the server in some file.
We'll also assume that when the TCP connection is established,
the first command to the server should be of the following format:

PASS <encrypted authentication string>

Now, what I thought to do was that when the password is entered
by a user, it is automatically hashed using MD5 (and thus, the
entered password is not kept), and then sent to be the auth
string, BUT, after having been encrypted ITSELF, so that no1
can sniff it and try to brute force it.
How to encrypt the pass ? Well, the first obvious thought I had
was to use the hash itself to encrypt itself again, using XOR.
When my brain switched on, I realized that anything XORed
with itself becomes zeroes, so, no point there.
The solution is to add another string to it, so that the password
hash doesnt XOR with itself and give 0.
A good string to add is for example a UTC time, which is just
the seconds elapsed from epoch (in Unix).
However, if any1 were to sniff this, he would know that the first
octets are numbers, and have a pretty good estimate on the
time (since he sniffs traffic that passes right after the time was
taken from the OS). So if the padd time is for example 1000000,
it would likely be 1000001 or something of the sorts when the
traffic passes through the network. Knowing a few characters
that you can XOR the traffic with will let you find a part of the
hash, and that means reducing the number of possiblities left
by a LOT :)
So, after I realized THAT won't work as well, I tried to think of
a way to padd the beginning of the hash with something that
is NOT guessable.
The idea is to take the password, add the time string to it, and
use MD5 on that. What we get is a different hash, which we
cannot guess in advance (we dont know the pword).
We use say half of the chars from this new hash, we concatenate
to that our password hash, and send that over the network,
XOR encrypred with the password hash.

so for example:

password hash: e4uerhgergh1
time+password hash: th894ht4er38

we would send: th894h e4uerhgergh1 (without the space)

XORed with e4uerhgergh1 (since the XORing hash is smaller in
length, we will tile the XORing..).

The server receives this, and knows that the first 6 chars should
be dumped (we used 6 pads) and takes the rest and decrypts
them using his stored password (but making sure to start from
the 7th char of the hash).

This is just the auth part, and the hash can be used for encryption
later on.

Now the attack ideas. Since the only way to check if a correct
password has been entered is to initiate a connection, I see
little possibility that any bruteforce can be done on this model.
After all, if you cant try at least a few thousands of attempts per
second, you really can't bruteforce...

The big question is, are there any ways of cryptoanalysis that
can somehow work on the encrypted info passed to the server?
I mean, if the password is good, MD5 will give a good hash,
and using the time+pass, you really do get a padding which cannot
be guessed (or so I think hehe).

Any guru here wanna comment on this model ? sugget ways
to attack it ?
It might not be THE way I choose to do this, since I'm hoping on
using SSL or TLS, but still...

Thanks in advance, and my apologies for the long message,
Lord Soth
Sab`
03-14-2002, 06:22 AM
Hi Lord Soth,

hopefully I did not misread your post but here are some attacks that come to mind right away.

#1. Even though the time is hashed and concanted lets say
strcat (*timehash, *passwordhash) . Given the person is sniffing he can still find a relation that the first 6 chars are just pseudo because the password hash will always be the same anyways.

Suggestion: Take the time hash and scramble it using some maths with the second hash. Then have the time hash concatenated with that scrambled version. when the server recieves it have the server code take the first 6 chars and do the reverse scramble (Decryption) with those chars and get a resulting password hash.

#2. Given they can sniff out this information in the first place means it will be insecure. Reason for this is the person can simply do a replay attack. Log what was sent to the server (the hash sent) and simply send that exact hash to the server and mimic your sends. Hence, pointless ruitine.

Suggestion: Use public key setup and exchange block cipher keys which will then be used as the tunnel to exchange the password hash.

Hopefully I did not misread what you wrote , good luck on your authentication system. -Sab
mike
03-14-2002, 03:42 PM
Suggestion: Use public key setup and exchange block cipher keys which will then be used as the tunnel to exchange the password hash.

This is what I'd suggest as well. Assuming the attacker can't do a man-in-the-middle attack, do a Diffie-Hellman key exchange. You could use a block cipher at this point to transmit the hash; another possibility is to send a MAC of the password. A MAC is a keyed hash; that is, you can't verify the hash unless you know the key. See Schneier for details or drop me a note.
Lord_Soth
03-14-2002, 06:31 PM
Schneier is definately on my next book list :)

In fact, now I'm reading Scott Oaks' Java security (the client was
written in java, by yours truly..).
The other part is a linux daemon written in C, so, at the minimum
I will have to read a book such as "Applied Cryptography".
Anyways, if I run into more trouble, I'll be sure to drop you guys a
note.

Thanks in the meantime...

LS
mike
03-14-2002, 07:10 PM
You can find a pirated online copy here:

h**p://www.geocities.com/condor60ro/document/0471128457/ewtoc.html

According to section 18.4 on MACs, this construction using a hash function H and a key K is secure (comma means concatenate):

H (K, H (K,M))

You have to have some kind of random nonce to prevent replay attacks; I suggest generating a random key during the key exchange.


Who can tell me...?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Who can tell me...?
PDA

View Full Version : Who can tell me...?

AlpHakK
03-14-2002, 04:43 AM
Yesterday my friend told me that Asprotect had released Version 1.5,but the latest version I know is 1.4,I am puzzled,who can tell me which the latest version is????
foxthree
03-14-2002, 05:47 AM
Hi:

The latest "official" version (www.aspack.com) is 1.2. But Alexey is famous for releasing multiple protection schemes under the same version no. to fool unpackers ;-)

However, if you can provide any apps protected with this "1.5", I'll be glad to inspect it.

Signed,
-- FoxThree

PS: The 1.3 and 1.4 versions are RCEs' catalogue of ASPR, btw!


Procdump scripting...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Procdump scripting...
PDA

View Full Version : Procdump scripting...

crUsAdEr
03-14-2002, 03:58 PM
Hi folks,

This time it is really a newbie and dumb post but maybe my brain is really damaged, been trying to write some Procdump scripts but they just dont work... the Procdump helpfile (what help file?? skimpy notes by GRom I mean) was really minimal... I have looked at demo scripts and try to figure out what is going but i am not sure about certain things.. so guess i'll post a question here...

Okie, here is a sample script
[Aspack108.3]
L1=OBJR : set eip (aka OEP) as base??
L2=LOOK 6A,00,50 ;does it search for this pattern from
the base set above forwards only? is
the result the first found?
L3=JZ 5
L4=QUIT
L5=BP
L6=OBJR
L7=LOOK 50,C3
L8=ADD 1
L9=BP
LA=WALK ;Is it equivalent to F8 in sice??? Or F10?
LB=OBJR
LC=LOOK 50,C3
LD=ADD 1
LE=BP
LF=STEP

Also command like
BPX 123 ;set breakpoint at 123h bytes from the
current base? or is it eip???

Thanx a lot,

P.S : Also is there anyway of "debugging" the script to know what wgoes wrong? Thanx
esther
03-15-2002, 12:27 PM
Heya binh81,

Eternal Bliss wrote a tute on unpacking pecompact using softice and procdump which shows you how to write the script .
See the attachement ;)
crUsAdEr
03-15-2002, 01:44 PM
Thanx esther,

A nice tutorial :>, though it doesnt answer my exact questions, it does show some insight of Procdump scripting... shall work further on it..

thanx
4oh4
03-15-2002, 07:31 PM
I'm not sure if you already read this and it didn't help either but there's a procdump for dummies text which you can find on protools (right by the procdump dl link).
foxthree
03-15-2002, 08:18 PM
Hi there binh81/others:

It is interesting to note that somebody else has also come up with the idea of studying the scripting technique of ProcDump. I believe ProcDump is one of the finest pieces of software ever written (apart from IceDUMP and RV of course ;) ). A brief look at the various options and scripting functionality is enough to conclude that this tool is way out of its times....

However, pls correct me if i'm wrong: ProcDumps tracer is easily detected by most packers anti-tracing code and the app simply crashes or produces an invalid dump.

In such a case, what good is a scripting tool apart from, of course, learning purposes. Now, if icedump had such a scripting tool, that would be something :cool:

Signed,
-- FoxThree
esther
03-16-2002, 04:39 PM
heya binh81,
>L1=OBJR : set eip (aka OEP) as base??

5) OBJR function.
This set the base memory to start to scan. Affect LOOK command.

>L2=LOOK 6A,00,50 ;does it search for this pattern from
the base set above forwards only? is
the result the first found?

1) Look function.
the Look function scan for an HEX string in the loader object. The Address,
where this block is found, is stored so that u can set a breakpoint at this
location. Wildcard usage is allowed for BYTE. Search result is handled
internally and u may use the conditional jmp to handle yourself result.
Example:
- Look 0F,85 will search for a JNE long jump. You may want to set a
Breakpoint via the BP command.
- Look EB,? will seacrh for a short jump.

>LA=WALK ;Is it equivalent to F8 in sice??? Or F10?

4) WALK
Execute the next instruction and return control to ProcDump32

>Also command like
>BPX 123 ;set breakpoint at 123h bytes from the
>current base? or is it eip???

>3) BP function.
Set a breakpoint at current memory location.

EB's explaination is quite clear bout the commands in the script.

>[QUOTE]Originally posted by foxthree
>[B]Hi there binh81/others:

>It is interesting to note that somebody else has also come up >with the idea of studying the scripting technique of ProcDump. I >believe ProcDump is one of the finest pieces of software ever >written (apart from IceDUMP and RV of course ;) ). A brief look at >the various options and scripting functionality is enough to >conclude that this tool is way out of its times....

Yeah maybe its out if time as you said but its convient to those who are non programmers which want to write a script for "generic unpackers"...

>However, pls correct me if i'm wrong: ProcDumps tracer is easily >detected by most packers anti-tracing code and the app simply >crashes or produces an invalid dump.

>In such a case, what good is a scripting tool apart from, of >course, learning purposes. Now, if icedump had such a scripting >tool, that would be something :cool:

Anti-debugging and tracer is a very "generic" to packers nowadays even "anti"-icedump ;).

>Now, if icedump had such a scripting >tool, that would be >something :cool:
of coz it is :cool: ;)


RepoInfo- I need help cracking !!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RepoInfo- I need help cracking !!!!!
PDA

View Full Version : RepoInfo- I need help cracking !!!!!

Crackin_Newbie
03-14-2002, 08:05 PM
I am trying to crack this but am lost on where to start. I have set bpx on tegettext and break on getting license key but am lost trying to follow. The programs first password is: demo
after that login, goto admin... on menu and youll find registering info there. It asks for license key, then states "license file not found". Will someone work with me, sort of step by step on this. I really need to crack this. Any assistance is GREATLY appreciated.
Please Help!!

The program is here:
repoinfo.com/Single_Inst_RepoInfo_v308.exe]RepoInfo Program is here
evaluator
03-14-2002, 09:07 PM
TERMINATE_THREAD
Js
03-14-2002, 10:30 PM
Shouldn't that be "tow this thread to off topic".
Woodmann
03-15-2002, 01:06 AM
I thought so, I just wanted to see what a few others had to say.


Is this not the right place to ask for help on this?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is this not the right place to ask for help on this?
PDA

View Full Version : Is this not the right place to ask for help on this?

Crackin_Newbie
03-15-2002, 01:56 AM
Is this not the right place to ask for help on this
Woodmann
03-15-2002, 02:22 AM
Hi,
It might be the right place to ask.
You need to re-think what you are asking.

It appears that you are asking for someone
to hold your hand yet, what you have posted
is not even close.
I know you want help but, without some
basic knowledge of what you are doing, it
just appears as a crack request.
I have no idea of what you know or if you
have ever done this stuff.
Many have posted something similar to what
you have posted. You need to do some more
research on your target and try a different approach.

Peace, Woodmann
evaluator
03-15-2002, 08:57 AM
Crackin_Newbie!

"Any assistance is GREATLY appreciated.
Please Help!!"
-STANDART WORDS FROM CRACK REQUESTS

I point you right place for crack request:)

http://pluto.beseen.com/boardroom/h/19390
nofurs
03-15-2002, 10:35 AM
>I point you right place for crack request:)

>http://pluto.beseen.com/boardroom/h/19390 [/B][/QUOTE]

Heya,
You are trying to say icezlion's forum is a place for crack request?
I don't think is right to do that

:eek:
evaluator
03-15-2002, 09:54 PM
you kill my joke.
BTW, not first time!

TerribleJoker
nofurs
03-16-2002, 10:15 AM
Originally posted by evaluator
you kill my joke.
BTW, not first time!

TerribleJoker

HAHAHAHA ,Don't you know I'm *evil* >)

evil_clue


more asprotect...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > more asprotect...
PDA

View Full Version : more asprotect...

figugegl
03-15-2002, 02:34 AM
you might be fed up with this already - but i finally decided to unpack an asprotected target. as i usually only reverse crackme's this is new to me. the target is:

art icons pro 3.16 (***.aha-soft.com).

i managed to unpack the exe, dump it and rebuild the imports with imprec. (OEP: 1241B4, IAT: 12D1B4, IATSize: 81C)

the dumped exe didn't start. i had to fix a call at address 5241c4, which jumped to aspr code and another check at address 403F60.

afterwards, the prog started, but showed plenty of memory access errors. i fixed the first two, but this caused other, more serious mem violations: suddenly strange messageboxes appear, the windows font changes...

i have read the past 30 or so asprotect-related threads (there's even one regarding the same app, but a previous version). i've learned that asprotected targets do strange things sometimes, but unfortunately i haven't found a solution to this one :(

maybe some of the more experienced people here could give me some hints. i've attached my resolved iat.txt

figugegl
evaluator
03-15-2002, 09:30 AM
They are very tricky guys!

I found 4 total jmp and changed to EB
But in previous version
Kilby
03-15-2002, 09:32 AM
Articons is a target name I remember from last year.

If I remember properly there are several calls which jump into the aspr code, and then jump straight to an address back in the target.

No processing or anything just

call aspr_address
....
....

aspr_address: jmp real call_address

These are no the same as the api checks which turn up in the elcom products.

It's probably no help, but I only ever saw it in a couple of targets.

Kilby...
figugegl
03-15-2002, 12:43 PM
i found two jumps to aspr code at startup (address 51a4e9 and 51a52e). when i patch these two, my windows messes up in a strange way: the font changes and messageboxes appear in german! (my win is german, but articons is english).

there are four more jumps to aspr code when exiting the prog (52380c, 523845, 5238a4, 52395d).

what sort of problem could that be?

evaluator:
is my resolved iat correct? does it run on your computer when you patched those two calls?

figugegl
evaluator
03-15-2002, 09:19 PM
YEAH!

I don't know so good IMPREC's format.
Resolve with latest REVIRGIN and maybe I can analyze RV.TXT:)
SpeKKeL
03-22-2002, 08:49 AM
Had some time to spend so picked up last (??) version
3.17 B(eta).
Had some months earlier a fight with this one, Thanks to Splaj

:p
Just when you think you're there......Even on exit they are
checking.
But after some tracing all rebuilded/Patched .

So nice prog to rebuild/trace and patch.:D

See you,

SpeKK
figugegl
03-22-2002, 12:11 PM
spekkel: could you please be more specific

i haven't tried more since my last post, but i will download the latest version and see... i couldn't figure out what was wrong. and every time i started the dump it messed up my windows :((

figugegl
SpeKKeL
03-22-2002, 12:38 PM
Fisrt off all you can dump the prog on several places,

I usually dump the prog a soon i see the data is stored. so that will be after xx breaks on getprocaddress.
((iF you dump later you have to correct a Lot of indirect calls..))
Now you don't have to deal (in this case) with the dubble/triple...dips!

First crash (except iat api's,Sure you have the correct ones) will be at the first call back to aspr.
Lool in the original prog where is lands back, BUT if your prog is already expired it jumps to an other location (looks the same ticky,tricky )
so first remove some (2) key's in registry or reverse 2 flags after
regqueryvalueexa .
After this i patched 3 locations in the dumped.exe H'mm i traced/
compared with the original.If you have the same version i give you
those addresses.
Messing up your window isn't the fault of your api's but it's all about Checking the integrity of the file (i think..)
:confused:

Ciao, SpeKK :p


Its been awhile
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Its been awhile
PDA

View Full Version : Its been awhile

Crackin_Newbie
03-15-2002, 07:03 AM
Hey i am :confused:

I want to crack this prog (RepoInfo) and I have only hunted down serials before. This prog has a license key it wants , then it wants a "license file" in its directory. I havent patched before, so I would like some help understanding how to patch. Any suggestions made in good standing are appreciated.

I dont want my hand held, I have found most of the calls I need to jump over or however you want to say it. I just am not sure on patching with out original source code. I have SoftIce, IDA, and WDasm32.... Can it be done permantely using one of these?

Hope this works better.

Program location is in other thread.
Zero
03-15-2002, 09:00 AM
I really need to crack this

Good. This is the first step to learn RCE.

As evaluator said in the last thread:

TERMINATE_THREAD
evaluator
03-15-2002, 09:17 AM
Go here & they will help you:

http://pluto.beseen.com/boardroom/h/19390
?ferret
03-19-2002, 12:41 AM
to make permanent changes to a program you will need to obtain and learn to use a hexeditor


Solaris executable identifier
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Solaris executable identifier
PDA

View Full Version : Solaris executable identifier

foxthree
03-15-2002, 08:13 PM
Hi there:

I have a program in Solaris (binary of course! ;) ). I need to be able to find out if it was written using C++ or written using pure C. How do I find this just by inspecting the binary? I can do a couple of tricks on Windows to find this (like import table for name mangling etc) but how to do this for Solaris?

Any help is greatly appreciated.

Thanks,

Signed,
-- FoxThree
me8
03-16-2002, 01:36 PM
failed to procceed program with ida 4.17 :-)


Removing ASProtect from a DLL file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Removing ASProtect from a DLL file
PDA

View Full Version : Removing ASProtect from a DLL file

Lbolt99
03-15-2002, 10:12 PM
Hello, I'm playing around with trying to remove ASPR 1.3 from a .dll Below I've documented what I've done so far. I'm looking to see if I'm on the right track and any tips or tricks on .dll dumping and rebuilding.

Target: WebsnatcherIE v2.1
Files: webbnd32.dll in program dir, bdsutils.dll in windows\system
Protection: ASProtect 1.3 (?) on webbnd32.dll
Tools Used So Far: Sice 4.05/334, Icedump 6.025, Peditor 1.7

Basically, this is an Internet Explorer plug-in which displays all the
files a web page uses in a window like the history or favorites.
It allows point-and-click downloading of any of the files the page uses.

There is a stand-alone version also, Websnatcher 2.4. I have successfully removed ASP 1.3 from that. FWIW, the .idata needed rebuilding, as usual, but so far as I can tell there are no other ASPR tricks in there. Once ASPR was removed, the nag went away automatically ( I believe it was part of the ASPR wrapper itself).

I *think* I've found the OEP of the webbnd32.dll. After the break in softice at the getversion (the GetWhatWeWant API cluster is there) , I do a /tracex 022D1000 02314000, in reference to the loader info below:

Loader info on the .dll:
WINICE: Load32 Obj=0001 Add=0167:022D1000 Len=0000F200 Mod=WEBBND32
WINICE: Load32 Obj=0002 Add=0167:022F9000 Len=00004000 Mod=WEBBND32
WINICE: Load32 Obj=0003 Add=0167:022FD000 Len=00000E00 Mod=WEBBND32
WINICE: Load32 Obj=0004 Add=0167:02302000 Len=00010600 Mod=WEBBND32
WINICE: Load32 Obj=0005 Add=0167:02314000 Len=00001A00 Mod=WEBBND32
WINICE: Load32 Obj=0006 Add=0167:02317000 Len=0000C800 Mod=WEBBND32
WINICE: Load32 Obj=0007 Add=0167:02324000 Len=00000000 Mod=WEBBND32

This seems to break three times in the WebBnd32.dll code before
actually getting to the OEP. First, it breaks at a RET at 22D1014.
, which returns to the ASPR code. Tracex again and it breaks at
WEBBND32.DLL!?GetRunApplicationFunction

WebBnd32!?GetRunApplicationFunction@@YGXP6AXXZ@Z
015F:022E77FE PUSH EBP
015F:022E77FF MOV EBP,ESP
015F:022E7801 MOV EAX, [EBP+08]
015F:022E7804 MOV [WebBnd32!?ExecuteTrial@@YAXXZ],EAX
015F:022E7809 POP EBP
015F:022E780A RET 0004
015F:022E780D PUSH EBP
015F:022E780E MOV EBP,ESP
015F:022E7810 CALL [WebBnd32!?ExecuteTrial@@YAXXZ]
015F:022E7816 CMP DWORD PTR [EBP+0C],01
015F:022E781A JNZ 022E7840
015F:022E781C PUSH 022F9560
015F:022E7821 MOV EAX, [EBP+08]
015F:022E7824 PUSH EAX
015F:022E7825 PUSH 022FDAD8

Tracex again. (At this point, the nag appears and waits for click.)

Breaks again at WEBBND32.DLL!?GetRegistrationInfo:

WebBnd32!?GetRegistrationInformation@@YGXPAD@Z
015F:022D1070 PUSH EBP
015F:022D1071 MOV EBP,ESP
015F:022D1073 MOV EAX,[EBP+08]
015F:022D1076 MOV [022FD120],EAX
015F:022D107B POP EBP
015F:022D107C RET 0004

Tracex again. Finally, breaks at what appears to be the OEP.
At 22F0FDD. (offset 0x1FFDD from the load addr of the 1st
section) It's the usual PUSH EBP stuff. But, it's in WebBnd32!DllUnregisterServer. Is this is OEP, or am I on the wrong track?

Also, the exports may be screwed with. I downloaded ASPR 1.2 just to take a look at it, and this was in the online help:

"The main idea is the following: ASProtect looks through exports section of the module and searches some predefined function names. If it finds this name, the address of the function is remembered and the reference in the export table is deleted. When the module is loaded, the address of the necessary function is determined on different conditions and this function is invoked. "

This seems to occur at runtime (in Peditor, there are the usual
four entries in the exports section, along with five API calls
for ASPR). In the GetRunApplicationFunction routine included
above, the instr @ 7804 replaces the call statement @ 7810 with
one in brackets that looks suspiciously like the redirected
imports in an ASPRotected .EXE file.
I think that's whats going on..

My next step would be to dump the image with icedump, and then figure out from there what to do, as far as fixing the import table, export table, relocations, and anything else (?) I'm not sure how relevant those API calls before the (supposed) OEP are - maybe that part can just be trashed (?) It looks like they
just have to do with deciding whether to let the program run or not, and other useless junk (GetRegINfo?)

Has anyone else removed ASPR 1.3+ from a .dll? Any tips are
appreciated :)
foxthree
03-17-2002, 10:56 AM
Hi there:

I'll take a look at this today or tomm. May be you can search the board to get some tips ;-)

Signed,
-- FoxThree
foxthree
03-17-2002, 01:20 PM
Hi there:

After reading ur post, I thought it really has some interesting tricks. But alas, I think we've got aspr fully covered :)

Okey, let's see.

You've mentioned OEiP as 22F0FDD! Cross check this. It must be 20FDD (10020FDD). It is relative to image base and not the section addresses themselves. Dump here. Forget about the original dips. It is just setting up ASPR flags.

As usual, IAT is corrupted. Rebuild with RV/ImpREC. You'll find the usual twist but if you find the GetWhatWeWant API cluster you can by pass this one.

Whoa! RS=VS,RO=VO, past iat.bin blah blah...

Attempt to run! Whoops IE crashes and brings up MS Debug report!

This is again another trick that has been extensively analyzed in this board: +splaj/SV's "INDIRECTED function calls"

"Find it, Patch it, Play it" ;-)

Success! ASPR is totally removed! No Nag nothin

Let me know if you have any further problems...

Signed,
-- FoxThree
Lbolt99
03-18-2002, 10:07 PM
Thanks for taking a look at this. I'm still running into a bit of problems tho. I think I've done everything right, but the dump is screwed up when I try to run it. I'm not sure what I'm doing wrong.. at the point where I generated the IAT.BIN with RV, I've always just had RV do all the work then.. but it didn't work on the dll file for some reason. So I had to fix everything w/Peditor (which I thought I did) Any ideas what went wrong? Thanks!!

Here's the procedure of what I did:

Loaded SICE, Loaded Icedump. Started WSIE with BPX Getversion, /tracex until OEP reached (RVA 20FDD). Locked process e eip EB FE.
Ran Peditor 1.7, selected process IE, selected module webbnd32.dll . Right click, selected Dump Full

Ran program, Ran RV 1.3, resolved imports, fixed 6 of them,
saved import table. Nothing here I haven't seen before.

Fixed:
8C818 - GetModuleHandleA
8C468 - GetProcAddress
8C834 - GetVersion
8C86C - GetCommandLineA
8C85C - GetCurrentProcess
8C898 - DialogBoxParamA

Reran PEditor 1.7, changed OEP to 20FDD, saved. Noted 55000 as first available position to paste in new imports.

Reran RV1.3, set IAT RVA to 55000, generated IAT.BIN

Reran PEditor 1.7, added IAT.BIN section to end. Fixed
Size of image, Import table RVA and size in Directory.

Tried to run it, some of the code is there but for some
reason starting at 1000 it all goes to crap :(

015F:021D0FDD PUSH EBP
015F:021D0FDE MOV EBP,ESP
015F:021D0FE0 PUSH EBX
015F:021D0FE1 MOV EBX,[EBP+08]
015F:021D0FE4 PUSH ESI
015F:021D0FE5 MOV ESI,[EBP+0C]
015F:021D0FE8 PUSH EDI
015F:021D0FE9 MOV EDI,[EBP+10]
015F:021D0FEC TEST ESI,ESI
015F:021D0FEE JNZ 021D0FF9
015F:021D0FF0 CMP DWORD PTR [021E1238],00
015F:021D0FF7 JMP 021D101F
015F:021D0FF9 CMP ESI,01
015F:021D0FFC JZ 021D1003
015F:021D0FFE CMP ESI,-01
015F:021D1001 INVALID
015F:021D1003 INVALID
etc etc etc
crUsAdEr
03-18-2002, 10:19 PM
Hi Lbolt99,

Try using LordPE and dump, i neva dump with PEditor myself but as the experts here says, i think LordPE is the most reliable...

Also, as fox3 said, there is a redirected call so patch it!

You did not mention chaging OEP from eb fe back to 55 8b but i hope u did :>..

Also, if you use /tracex, read Tsehp's comment and use revirgin tracer, it is at least 10 times if not more faster!!!!

Also, if your dll was relocated at run time, you have to change the image base of the dump for it to work properly...

Just a few thoughts, :>
foxthree
03-19-2002, 06:54 AM
Hi there:

It looks like your DLL has reloced... you need to copy the .reloc section from the packed DLL and paste it in the new DLL and set the .reloc to the first byte of this. Search for some post by DakienDX on this (also by the "ultimate guru" the Owl).

You can use map32 to identify the .reloc table, i guess.

Signed,
-- FoxThree
Lbolt99
03-19-2002, 06:46 PM
Hi, thanks for the responses.. I'm going NUTS over this..
I went ahead and did a clean bootup so that WEBBND32.DLL
would definantely load at 10000000, without relocating. That
worked fine - it came up there, and didn't relocate.

I tried dumping with Peditor, LordPE, Icedump.. the problem with
the INVALID's is still there :( It's like the whole memory area
below 21000 is toasted at runtime..

The bytes are there if I look at it with a hex editor, and other really STRANGE thing is that, after the Page fault, if I go back and
unassemble it (u 10020FDD) THE CODE IS THERE!!! Its like it all
just magically reappeared!

I don't know what to do at this point. 15+ hours so far :( Any comments on whats going on?
Thanks!!
foxthree
03-19-2002, 06:54 PM
Hiya there:

Doesn't it make you crazy :D , Not to worry 'coz been thro' that road many times and still survived ...;)

Okey, I believe your dump is wrong. So let's take the easy way out. Use ICEDump. No JMP EIP stuff for us. Not yet ;)

So at OEiP do a

: bc * in softice to clear all breakpoints (sometimes this can be such a pain :p)

: /dump 10000000 <sizeofimage> c:\temp\dumped_dll.dll

Cool? Look at the above base address. Did you get this right?

Lemme know what the problem is (if it is still there ;) )

Signed,
-- FoxThree
crUsAdEr
03-19-2002, 08:39 PM
Try WinHex,

work great as well

cheers,
Lbolt99
03-20-2002, 04:36 AM
thanx for the suggestions, I'll give it all a try tomorrow :)
Taking a break for now..
I think what I'm going to try 1st is putting ASPR onto a
dll and then try unpacking it.. maybe it'll shed some light
on whats going wrong :D
Lbolt99
03-21-2002, 05:09 AM
Got it, finally :) Thanks fox3 and bin for the help. It was something dumb that I wasn't doing. Once i put aspr onto a regular dll and compared the two, I realized that I wasn't setting the .reloc entry in the section table to the correct value. I've only dumped exe's up until now so I forgot about the reloc


How to dump a project under tElock 0.90's protection?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to dump a project under tElock 0.90's protection?
PDA

View Full Version : How to dump a project under tElock 0.90's protection?

AlpHakK
03-16-2002, 06:56 AM
As title.
DakienDX
03-16-2002, 08:52 AM
Hello AlpHakK !

Try WKT_tElock_Dumper at Programmer's Tools. :)
foxthree
03-16-2002, 08:57 AM
Hello:

Can you please explain your problem further? If you're unable to dump telock with ICEDump and similar tools, it may be because you haven't bypassed teclock's "section trick". For further reference, please search the board for +splaj guru's posts.

Signed,
-- FoxThree

PS: It would help if you can be more clearer in articulating ur problem ;-)
thE Cur!ouZ
03-16-2002, 06:01 PM
hi AlpHakK..!

go to krobar web page, you will find a good tut by ThrawN.
for the url search in the borard

have phun.
AlpHakK
03-17-2002, 05:55 AM
Thanx 4 everybody's help:),I will try,bless me .^_^.
Happy everyday£¡


NT Doubts.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > NT Doubts.
PDA

View Full Version : NT Doubts.

nyx
03-16-2002, 07:57 AM
Hello Everyone,

I had this doubt about NT(workstation) proccess,does NT have process sysmon,sysman running and can a user with least options access these processes,or are these only accessable to the admin.And a program like prcview.exe can't kill it.

???

Thanks - nyx
DakienDX
03-16-2002, 08:46 AM
Hello nyx !

Why don't you try it out? Just create a Guest user and test it. And if you don't have NT, I'm sure you know someone on whose computer you don't have Admin privileges.

Normally a Guest isn't able to do such things. Have you ever wondered what the CreateProcessAsUser function is used for?
nyx
03-21-2002, 06:02 AM
DakienDX thanks of the reply,well I'm just a newbie in many areas just learning things in programming,Well Ilooked into the API,and I tried killing those process but it did'nt work so I assume that a user ca'nt access it. Any idea where to read more about these

Thanks -nyx
Solomon
03-21-2002, 06:21 AM
Please read "Inside Windows NT" or "Inside Windows 2000" or MSDN Security API docs.:cool:


Makin Revirgin Work in Win95
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Makin Revirgin Work in Win95
PDA

View Full Version : Makin Revirgin Work in Win95

r00t
03-16-2002, 08:48 AM
Hi, as almost anyone knows, i want to run revirgin (and imprec) in windows 95.
I've discovered that revirgin dont works on win95 even with a NON-packed file, so i start trying to "rebuild" a common and non-packed exe.
Revirgin (and imprec) have problems in rebuilding imports from kernel32.dll, so i make the next trick:

1- copy the original kernel32.dll into kernel33.dll (keep kernel32.dll of course).
2- then go to the exe's import table and substitute kernel32.dll to kernel33.dll. Now the exe imports functions from kernel33.dll. But there is a problem: when the OS try to 'LoadLibrary' kernel33.dll it says that isn't relocatable so those dont works), so
3- change the imagebase of kernel33.dll from BFF70000 to 1ff70000.

Well the good news is: Revirgin works perfectly in win95. and resolve all kernel32.dll (yes from kernel32.dll, not kernel33.dll), i've rebuild the import table and the exe works perfectly.

Maybe tshep knows why this is happening and maybe there is some other trick to make it work well. I want to help to make a win 95 revirgin/imprec.

Greets.
tsehp
03-17-2002, 01:00 PM
it's just amazing how people managed to make things work ...

I have to choose between making rv evolve or go back tot his backward compatibility, why do you want it to work on w95 ? It's too old and most of w95 apps works on w95. mail me to explain.

regards,

tsehp
r2r2
03-22-2002, 05:00 PM
'most of w95 apps works on w95'

that still has to be proven!


Grille Me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Grille Me
PDA

View Full Version : Grille Me

Bengaly
03-16-2002, 06:04 PM
Below is a turning grille (6x6 matrix) transposition cipher, Rotations are clockwise. What is the sentence hidden in it?
*this require a good cryptoanalyze, so have fun
hint: use digraphs

S E I T I R
H T E I N E
C L E S T E
A C I E I W
H T V E E A
E D V E K R

cya :)
me8
03-16-2002, 10:00 PM
hm, orc? :-)
Bengaly
03-16-2002, 10:13 PM
hehe, why would that related to ORC? :D
i gave here a real cryptoanalyze problem,
this days ppl do MD5/RSA without even know how it works (thats a shame).
real crypto analayzer not only reverse it, they also learn, cryptoanalze it and find a better ways to attack/improve it.
anyway, no ORC has nothing to do with grille hehe :DD
cya :)
DakienDX
03-17-2002, 12:18 AM
Hello Bengaly !

Do you know the answer to the question or have you forgotten what you learned in the class demonstration to solve your homework (http://www.wisdom.weizmann.ac.il/home/albi/public_html/cryptanalysis/home1.htm)? :D

It seems to be a real challange, but one which can be solved. :)
When I manage to find some time I'll try it tomorrow.
peterg70
03-17-2002, 12:49 AM
Its very simple to solve the above crypto

the answer is

"IT IS A WEEK SINCE I HAVE RECEIVED THE LETTER"

How did i do this? Zen (and internet searches)

:p ;) :D
DakienDX
03-17-2002, 08:30 AM
Hello peterg70 !

You forgot to quote my link. ;)
Next time I won't publish a link any more. Be honest, you didn't serach, you just cut of home1.html from the link and had the solution.
I was awake half of the night in bed thinking how to bruteforce this. :(
There are only 2^18 possibilities and I wanted to have a way to explain the answer ready before publishing the it.

Base URL
http://www.wisdom.weizmann.ac.il/home/albi/public_html/cryptanalysis/homeworks.htm

Homework URL
http://www.wisdom.weizmann.ac.il/home/albi/public_html/cryptanalysis/home1.htm

Solutions URL
http://www.wisdom.weizmann.ac.il/home/albi/public_html/cryptanalysis/Homework1/solution1.htm
Bengaly
03-17-2002, 09:03 AM
i saw the grille over weizmann and though that i would participate
this crypto challange here too,
i was thinking of joinning weizmann after i will finish my corrent uni ;-) of course i dont know how far i can get :D
techniun has same course too, but only wizzkids apply there hehe :-) also a bit far from me :) ( 1 hour drive) :)
anyway, i just though it will be nice to get this section a bit up on its feet ;) with some crypto problems ;p

How did i do this? Zen (and internet searches)
hehe i think everyone can do that :-)
hehe btwm Zen is away of thinking not a way of searching :-)
cya :D
peterg70
03-17-2002, 11:40 AM
DakienDX:

Sorry could resist. :D Did a simple search for the technique and lo and behold it poped up. After I had posted I saw your link (hard to see that homework was a link rather than underlined).

Bengaly:
Zen is the art of applying ones mind in a manner that offers enlightment and provokes a sense of accomplishment.

Zen lead me to use the search engines to discover the pages.:rolleyes:
DakienDX
03-17-2002, 12:29 PM
Hello peterg70 !

Excuse accepted, but only by thorttling both eyes. ;)
But I'll try to bruteforce it anyway.


Guidance Required
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Guidance Required
PDA

View Full Version : Guidance Required

peterg70
03-16-2002, 11:14 PM
Okay guys I'm stuck

I have a little proggie which has a dialog box that is a combo box. This is a real pain to use. I want to be able to change this combo box to a list type box and change the size of the dialog box etc so that it is a big screen.

So first i thought great use exescope or reshacker to do this but proggie was UPX packed. Not a prob Load up Procdump and dump the proggie.

Check dumped version and it runs okay but exescope/reshacker still thinks it packed.

Looking at Sections I have UPX0 UPX1 .rsrc and .idata

The .rsrc had the wrong section flags so i fixed them up but exescope still won't look at it

It still thinks the proggie is compressed and tells me so

TIA
peterg70
crUsAdEr
03-16-2002, 11:18 PM
Try use PEditor to look at the resource section see if you can see it?

You can also try Pe Explorer 1.60 at Heavenstool, very nice program...

regards
ZaiRoN
03-16-2002, 11:21 PM
Hi peterg70,
try to unpack using "upx -d <filename>"

bye,
ZaiRoN
peterg70
03-16-2002, 11:52 PM
Binh81

Downloaded the PE Explorer (Nice Program)

It actually unpacked the proggie for me and showed me the resources but wouldn't let me edit the resources. Must find out why i can't type in the resources????

So i saved it out and exescope had no problems editing it.

Although still haven't been able to change the combo box to a list box yet. Any thoughts.

ZaiRon : I had tried that but refused to unpack.
fALC0N
03-17-2002, 01:47 AM
Get eXescope version 4.21 or 4.1 from the web and try :cool:
Clandestiny
03-17-2002, 03:42 AM
Hiya peterg70,

I'll just throw out my 2 cents here...

First, what type of combo box are you dealing with here? Generally speaking, a combo box is made up of an edit control AND a list box. Depending on the window style, however, it may only have the edit box or the list box component.

------------------------------------------------------------------------------------------------------------------------------------------------
The following list shows the three combo box types and indicates whether each includes a drop-down list and an edit control:

Combo box type: Drop-down combo box
Drop-down list = Yes
Edit control = Yes

Combo box type: Drop-down list box
Drop-down list = Yes
Edit control = No

Combo box type: Simple combo box
Drop-down list = No
Edit control = Yes
------------------------------------------------------------------------------------------------------------------------------------------------

So, I guess what I'm asking is... Are you trying to modify the *type* of combo box from say a Drop-down combo box to a Drop-down list combo box or are you trying to change the Combo Box to an entirely new "List Box" control.

The first modification would be a simple change of window style (CBS_DROPDOWNLIST specifying a Drop-down list for example). Although it's probably the most straight forward to make the changes in a resource editor as you've been attemping, changing the window style run-time is another option.

The SetWindowLong function changes an attribute of the specified window. The function also sets a 32-bit (long) value at the specified offset into the extra window memory of a window.

------------------------------------------------------------------------------------------------------------------------------------------------
LONG SetWindowLong(

HWND hWnd, // handle of window
int nIndex, // offset of value to set
LONG dwNewLong // new value
);

Parameters

hWnd

Identifies the window and, indirectly, the class to which the window belongs.

nIndex

Specifies the zero-based offset to the value to be set. Valid values are in the range zero through the number of bytes of extra window memory, minus 4; for example, if you specified 12 or more bytes of extra memory, a value of 8 would be an index to the third 32-bit integer. To set any other value, specify one of the following values:

Value Action
GWL_EXSTYLE Sets a new extended window style.
GWL_STYLE Sets a new window style.
GWL_WNDPROC Sets a new address for the window procedure.
GWL_HINSTANCE Sets a new application instance handle.
GWL_ID Sets a new identifier of the window.
GWL_USERDATA Sets the 32-bit value associated with the window. Each window has a corresponding 32-bit value intended for use by the application that created the window.
------------------------------------------------------------------------------------------------------------------------------------------------

If, however, you're trying to change the control to an *entirely* new control type (ie. from a "Combo Box" to a "List Box"), then you're dealing with a whole different animal. Changing the control in the resource editor will not be enough. Functionality will have to be modified to account for the differences in message handling between Combo Boxes and the List Boxes. For example, if your combo box is initialized with strings it may be using the CB_ADDSTRING message to add those strings. If you changed this to a List Box you'd have to hunt down this CB_ADDSTRING and change it to its equivalent LB_ADDSTRING message.

I didn't see a reference to your target... So to be honest, I proably don't have a clear grasp of what you're trying to accomplish. I'm just throwing out a couple of ideas that may / may not be related to your problem at hand ;)

Cheers,
Clandestiny
peterg70
03-17-2002, 07:41 AM
Thanks for the Info Clandestiny (your 2 cents worth goes a long way)

I didn't name my target because it wasn't really relevant to the task.

To clarify my situation I have attached a picture of what i have.

The combo box is populated by a text file by the program.
But this only displays one item unless i click and scroll in the combo box.

I want to have a list which can also scroll but displays more items in the default display.

If this doesn't make it any clearer I let you know the name of the proggie (its not commercial). I just want to improve the interface to make it easier to use.
Kayaker
03-17-2002, 09:44 AM
Aha! So a picture really is worth a thousand words ;-)

I think what the problem here is Peterg70 is that the programmer didn't make the height of the combo box large enough to include the space of the items within it. There are 2 ways to create a combo box, either as a control in a resource file, or runtime with CreateWindowExA and the COMBOBOX class.

In an .rc file a combobox would be created like this:

COMBOBOX IDC_COMBOBOX1, Left, Top, Width, Height, CBS_DROPDOWNLIST | WS_VSCROLL | WS_TABSTOP
CY of combobox must be big enough to hold all items

Check to see if the combobox is in a resource file (you can probably dump the resources as an .rc file with Reshack or Exescope) and try increasing the Height value. If you want to change it to an editable combo box or list box then you could probably do that too, but there's the caveat that Clandestiny warned about.

If created runtime with CreateWindowExA, you could again reverse the call by changing the appropriate values. Take a look at the ComboBox proc in the MASM32 package for how it would be called:

-------------------------------------------------------
ComboBox proc a:DWORD,b:DWORD,wd:DWORD,ht:DWORD,hParent:DWORD,ID:DWORD

; ComboBox PROTO :DWORD,:DWORD,:DWORD,:DWORD,:DWORD,:DWORD
; invoke ComboBox,200,10,150,250,hWnd,700

szText cmbBox,"COMBOBOX"

invoke CreateWindowEx,WS_EX_CLIENTEDGE,ADDR cmbBox,0,
WS_CHILD or WS_BORDER or WS_VISIBLE or \
CBS_HASSTRINGS or CBS_DROPDOWNLIST or WS_VSCROLL,
a,b,wd,ht,hParent,ID,hInstance,NULL

ret

ComboBox endp
---------------------------------------------------------

Hope this helps,
Kayaker
peterg70
03-17-2002, 11:43 AM
thanks guys Will have another hack at it.

Have tried this
From Exescope
object ComboBox1: TComboBox
Left = 8
Top = 24
Width = 561
Height = 421 *INCREASED by 400
ItemHeight = 213 *INCREASED by 200
TabOrder = 1
end

No difference in the display.
Changing the actual form and moving buttons worked but the combo box stayed the same.
Also the PE Explorer proggie is a very nice program. It has a built in plugin for unpacking UXP files. If more plugins appear I think this program has alot of potential.

peterg70

Late Breaking News:
I added "Style=csSimple" and the combo box changed to what i needed. Bugger of a thing


Win2K problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2K problem
PDA

View Full Version : Win2K problem

crUsAdEr
03-17-2002, 12:34 AM
Argh...

I am getting tired of this, on my win 2k box, i do not have icedump, everytime i want to dump i have to do the "jmp eip" trick to freeze the prog then load procdump to dump it... the thing is that while on win 98 last time, I did not have significance deprovement of the system speed... however on win2k, my box almost freezes, becomes extremely slow, i usually use Task Manager to set thread priority to low, most of the time it owrks but sometimes the freezed prog still hogs up CPU cycles and it can take like 10 min to load up procdump... such a pain...

For those who are using win2k out there, is ther any other trick to stop the freezed prog from hogging my CPU cycles???

Thanx a lot,
DakienDX
03-17-2002, 12:40 AM
Hello binh81 !

I don't know how it is called in english, but there is an option called "Acceleration Of Foreground Applications" or similar. You should find it by pressing WIN+BREAK (properties of system). Set it to 0% and it should be fine.
crUsAdEr
03-17-2002, 03:56 AM
Hi Dakien,

I have nto been able to find that "Acceleration Of Foreground Applications" options to set it to 0%... i have only found

Optimize performance option for
[X ]Application [ ]Background Service

i try changing these 2 values but they dont help much... in fact if i change to Background services, it seems even slower when i freeze prog with jmp eip..

can you tell me more specifically how to access that option you are refering to...

Windows is such a pain, the help system is crap... all these features are not documented, or documented in a way that it is impossible to find where it is????

Thanx,
DakienDX
03-17-2002, 07:54 AM
Hello binh81 !

Actually the option exists on WinNT, I've never tried to find it on Win2K.
But since all world claims Win2K is the successor of WinNT, I thought there might be a similar option.
And at least the option works in WinNT. ;)
foxthree
03-17-2002, 10:34 AM
Hi binh:

Like the subject line goes:(

However, I *do not* think this is possible on Win2K. Esp. because, the thread quanta alloc scheme in the scheduler has been re-designed from NT and 2K (explaining the missing Foreground Accel option). Actually, it is supposed to happen "automagically" under 2K. Anyway, JMP EIP puts the app in a tight loop which "automagically" consumer 100% CPU cycles.

You can try that with a small Win32 Proggie which does while(1) and see the CPU spike!

However, (and I'm just talking off my head here), there was a article in MSJ which talked about limiting CPU utilization of a process to say max 30% (I'd implemented this in one of my proggies actually and it worked). You might want to run this before dumping your process.

Try it and see if it helps (I think the prog name was CPUHog)!

Signed,
-- FoxThree
tsehp
03-17-2002, 01:08 PM
and now for a little adv...

download rv and use it's tracer, you can locate eip with it, it will then freeze the app without taking any cpu resources.
you just dump it with procdump and your done.
crUsAdEr
03-17-2002, 07:44 PM
Hi Tseph,

Thanx for the "little advice" :>... yeah, RV is great i sometimes wanna learn what is going on inside the program, not just the crack... Also, RV cant substitute softice yet to unpack stuff till it has breakpoint features, memory access to allow patching, it cant unpack Armadillo yet :>...

Just a random thought :>....

Fox3, shall check out the prog :>

Thanx guys,
Stone()
03-18-2002, 09:00 AM
I tried the tracer with some Asprotect programs using the same addresses I normally use for the tracex, but the tracer stops nearly immediately (at the asprotect entry?) and the PE-Dump button remains always greyed out.

I'm doing something wrong?
crUsAdEr
03-18-2002, 11:06 AM
Hi Stone,

read revirgin manual on how to use trace again :>

Cheers,
Stone()
03-18-2002, 11:52 AM
Well, well you got me here. Bad habit from me. From time to time I should read some manuals :)

Thanks.
Stone()
03-20-2002, 09:00 AM
at the end it was not the none reading of the manual but RV's tracer does not work on my W2K box, it works however with my ME installation.

Furthermore when fixing a dumped file it works on W2K, but on ME it scrambles the file.

Having all resolved I create it.bin on W2K and get a size of
9,362 and on Me 9,330, loading the same resolved text.

?
Solomon
03-20-2002, 09:39 AM
Here is another way to "freeze" your applications besides "jmp eip". I posted it in this forum long time ago:D

replace JMP EIP with the following:

push 7FFFFFFF
call kernel32!sleep

Then your target will sleep forever and cost no CPU usage:cool:
foxthree
03-20-2002, 11:14 AM
Doh! Yes ;)

Sleep(INFINITE) puts the thread into a non-schedulable state so that it is not taken into consideration for scheduling and hence the effect... Pretty cool, Solomon ;)

Signed,
-- FoxThree


How to remove the very good trick of ReGet Deluxe?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to remove the very good trick of ReGet Deluxe?
PDA

View Full Version : How to remove the very good trick of ReGet Deluxe?

Solomon
03-17-2002, 06:37 AM
v2.2 beta build 113
hxxp://download.reget.com/dl/dx/regetdx_113.exe

I unpacked it with RV and patched it to a regged version. It never displays Nag at start-up again and now shows "Registered to: xxx" in the about box. But actually this is fake. It will randomly replace your downloaded zip files with some garbage readme.txt which contains only one word "This file is donwloaded with cracked ReGet". Hi Alex, is this part of your nice "encryption mechanism"? ;)

With a HexEditor I can see that it overwrites the ZIP header at the begin of downloaded file or at the end of it with its own data block(this block is decrypted each time you start a new d/l task). It may also destroy the other bytes of file(not sure).

Setting a BPX SetFilePointer if *(esp+8)==0 do "db *(ebp+c)",
I found when it will overwrite file header and patched it. But I can not figrue out when it overwrites file tail and where the garbage data block comes from yet. So I need some help to find the tricky cracked-or-not check. Thx

BTW:
1. Some secret strings in ReGet are encoded(base64 or other). It's easy to locate the base64-decoding routine and find those strings.
2. It's easy to reset 30-day trial period:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExtW
Software\Microsoft\Internet Explorer\TempCLSID
%systemRoot%\win.ini:s1 (NTFS stream?)
3. ReGet uses Thread Local Storage(TlsSetVale/TlsGetValue) to set/get some suspicious flags.
phop007
03-17-2002, 07:54 AM
Hi Solomon.

After I set bpx Getversion to find 61,FF,E0 and then bpx IRETD, run AAtools and keep press F5 almost 43 times and then F8 I found this:

015605CE POP DWORD PTR FS[00000000]
015605D5 POP EAX
015605D6 CMP DWORD PTR[015649DC],00
015605DD JZ 015605F3
015605DF PUSH OC
015605E1 MOV ECX,015649DC
015605E6 LEA EAX,[EBP-080]
015605E9 MOV EDX,00000004
015605EE CALL 0155C8FC
015605F3 PUSH DWORD PTR[EBP-04]
015605F6 PUSH DWORD PTR[EBP-08]
015605F9 MOV EAX,[EBP-OC]
015605FC CMP DWORD PTR[EAX],00
015605FF JZ 01560603
01560601 PUSH DWORD PTR[EAX]
01560603 PUSH DWORD PTR[EBP-10]
01560606 PUSH DWORD PTR[EBP-14]
01560609 RET

So I set bpm on OEP(BPM 6953A8 X) I guess, set EBFE and dump program, run RV&Aatools and set RVA 002A0258 &Length 00000B04, add It.bin to Dumped.exe with LoardPE, set Import table to 3AC000, RebuildPE (Only Validate PE and Status Windows on), run Hexeditor change EBFE to 558B and run dumped.exe....... It does't nothing. What wrong??? any suggest I appreciate. Thankz

Here My it.txt from RV
phop007
03-17-2002, 08:00 AM
I also set OEM to 2953A8 but I don't know Alex does something with this ASproctect or I do something wrong?????????????
Stone()
03-17-2002, 10:09 AM
RegetDeluxe starting from Build 106:

You're are missing a size check.

Try to repack the file exactly to it's original size, then see if it still scrambles your zip files.

Mine does not.
foxthree
03-17-2002, 10:28 AM
Hi Phoop:

You're missing a indirected call to ASProtect. Now that've you've unpacked the proggie without ASPR, the indirected call just would crash or worse yet run in an infinite loop without showing any screen. Just BPX at the OEiP in the repacked exe and F8 down a couple of lines... you must see it !

Signed,
-- FoxThree
Solomon
03-17-2002, 10:59 AM
Thx Stone() for your hint! Here is the size check. I replaced GetFileSize call with "Mov eax, Original_Size", or change 195A00(original size) at DS:[5055E8] to unpacked size.

001B:00479711 PUSH EBP
001B:00479712 MOV EBP,ESP
001B:00479714 SUB ESP,14
001B:00479717 PUSH EDI
001B:00479718 XOR EDI,EDI
001B:0047971A CMP [00514840],EDI
001B:00479720 JNZ 004797E4
001B:00479726 MOV EAX,[004F7F88]
001B:0047972B PUSH EBX
001B:0047972C PUSH ESI
001B:0047972D MOV ESI,00000800
001B:00479732 PUSH ESI
001B:00479733 LEA ECX,[EBP-04]
001B:00479736 MOV [EBP-04],EAX
001B:00479739 CALL 00402403
001B:0047973E PUSH ESI
001B:0047973F PUSH EAX
001B:00479740 MOV EAX,[005166E4]
001B:00479745 PUSH DWORD PTR [EAX+04]
001B:00479748 CALL [KERNEL32!GetModuleFileNameA]
001B:0047974E PUSH FF
001B:00479750 LEA ECX,[EBP-04]
001B:00479753 CALL 0040246A
001B:00479758 PUSH EDI
001B:00479759 PUSH 20
001B:0047975B PUSH 03
001B:0047975D PUSH EDI
001B:0047975E PUSH 01
001B:00479760 PUSH EDI
001B:00479761 PUSH DWORD PTR [EBP-04]
001B:00479764 CALL [KERNEL32!CreateFileA]
001B:0047976A MOV EBX,EAX
001B:0047976C CMP EBX,-01
001B:0047976F JZ 004797AA
001B:00479771 PUSH EDI
001B:00479772 PUSH EBX
001B:00479773 CALL [KERNEL32!GetFileSize]
001B:00479779 MOV ESI,EAX
001B:0047977B CMP ESI,EDI
001B:0047977D JZ 004797A3
001B:0047977F PUSH 14
001B:00479781 CDQ
001B:00479782 POP ECX
001B:00479783 IDIV ECX
001B:00479785 MOV ECX,[005055E8]
001B:0047978B MOV EDX,ECX
001B:0047978D SUB EDX,EAX
001B:0047978F CMP ESI,EDX
001B:00479791 JL 00479799
001B:00479793 ADD EAX,ECX
001B:00479795 CMP ESI,EAX
001B:00479797 JLE 004797A3
001B:00479799 MOV DWORD PTR [0051483C],00000001
001B:004797A3 PUSH EBX
001B:004797A4 CALL [KERNEL32!CloseHandle]
001B:004797AA LEA EAX,[EBP-14]
001B:004797AD PUSH EAX
001B:004797AE CALL [KERNEL32!GetSystemTime]
001B:004797B4 CMP [0051483C],EDI
001B:004797BA POP ESI
001B:004797BB POP EBX
001B:004797BC JZ 004797D2
001B:004797BE CMP WORD PTR [EBP-10],06
001B:004797C3 JZ 004797D2
001B:004797C5 CMP WORD PTR [EBP-10],04
001B:004797CA JZ 004797D2
001B:004797CC MOV [0051483C],EDI
001B:004797D2 LEA ECX,[EBP-04]
001B:004797D5 MOV DWORD PTR [00514840],00000001
001B:004797DF CALL 00401F30
001B:004797E4 POP EDI
001B:004797E5 LEAVE
001B:004797E6 RET

001B:004797E7 XOR EAX,EAX
001B:004797E9 CMP [0051483C],EAX
001B:004797EF JZ 004797FE
001B:004797F1 CALL [KERNEL32!GetTickCount]
001B:004797F7 AND AL,03
001B:004797F9 NEG AL
001B:004797FB SBB EAX,EAX
001B:004797FD INC EAX
001B:004797FE RET
Stone()
03-17-2002, 12:13 PM
Yes good Job.

You said you unpacked it with RV alone?

I can't get the tracer to work without having reboots.

Can you pls. tell me a bit more about that.

I just finished unpacking Buil 112, if I can save some time with 113 I would be happy.

Thanks.
Solomon
03-17-2002, 12:39 PM
yeah, RV works well with it. I'm using Win2K. The latest RV seldom causes BSOD.

Here is some data:
OEP = 4CA5FE

CS:47A383 read registration info from registry. We can patch this routine to let it return 1, then get a regged version.

The attachment is resolved API names.
Stone()
03-17-2002, 05:03 PM
Thanks for the resolved.

I have another question about the Dump. Is there any other way to get a dump you can fix than with RV without using SI?

I'm working with XP & W2K and ME, but SI gives me a lot of exceptions, so my hardes time is spent in getting it working instead of debugging.

Thanks.
Solomon
03-18-2002, 01:16 AM
Due to the trick used by ASPR to fool API tracer, I always have to manually examine some suspicious API entries with SI(+SplAj played a joke with my button-pressing reversing some time ago;)). For ReGet, there are 9 unresolved entries(IAT RVA: ED194, ED288, ED2E0, ED2E4, ED2E8, ED30C, ED384, ED3DC, ED61C). SI from DriverStudio 2.6 works well with my Win2K, the only exception is that it will randomly cause BSOD when I press F12. And do you put "faults off" in its init command line?

Though RV/ImpREC can save us a lot of time, we have to do some manual tracing, which is the ultimate way and is the fun of reversing.:D
phop007
03-18-2002, 02:45 AM
Thank!! foxthree
I will try to trace it...
Solomon
03-18-2002, 07:35 AM
hi phop007,

please check your resolved API names. Here is what I got:
2A02C0 GetCommandLineA
2A0430 LockResource
2A048C GetVersion
2A0514 GetCurrentProcessId

Please examine the code there with SI manually! This is the button-click reversing called by +SplAj:D. You press the button, then let the tool do everything for you, whithout knowing what actually happens......

There is a redirected call at CS:6953C4.
call [69C4F0] ======> call 694928
And it still crashes after fixing this redirected call. Maybe there is d-dip?
Stone()
03-18-2002, 08:51 AM
I tried with Faults On and Off, but I even get BSOD under W2K right after starting, so I don't know what works better.

I presume you're using Icedump, I have a hard time to get it going under W2K.

I got only everything to work perfectly after a fresh install of W2k without adding anything.

In the meantime with all the security fixes there must be something which makes SI unstable.
Solomon
03-18-2002, 09:44 AM
yes I have integrated IceDump into SI(from DriverStudio 2.6). Both versions(with and without IceDump) work well. My OS: Win2K Adv Server SP2 build 2195. The older versions of RV often cause BSOD, but the latest does not.
Stone()
03-18-2002, 11:48 AM
I downloaded Driver Studio 2.6 and will give it another try on my W2k Server box.

Would you mind to give me some hints about how to integrate Icedump into it?

Thanks in advance.
Solomon
03-18-2002, 01:16 PM
I don't know whether IceDump will enhance the stability of SI.:)

1. put 3 files named "ntid.exe", "IceDump\wnt\4.26.922\icedump" and "ntice.sys" in the same directory.
2. run "ntid.exe" to get a new "ntice.sys".
3. use LordPE to fix the checksum of the new "ntice.sys"
4. replace the old "ntice.sys" in %SystemRoot%\system32\drivers with the new one.

That's OK. Hope this helps.
Stone()
03-19-2002, 08:11 AM
Thanks for the info.

Regretfully I can't get SI get to work on this box.

W2K BSOD at startup. Due to the long boot times of W2K I decided to install it on ME.

Load app, push translate and SI does not break.

So I'm afraid no SI on this box.
Solomon
03-27-2002, 01:32 AM
DAMN IT! Today ReGet Deluxe still destroied my zip files! :mad:
Actually I have already patched the size check. There seems to be more hidden checks:(
Stone()
03-27-2002, 10:51 AM
There must be, as my with ASprotect 1.2 repacked version (to it's original size) until now did not destroy my zip files.
Solomon
03-27-2002, 12:28 PM
successfully located the other 2 size checks. File size is hard-coded in the instructions:eek:

Stone, how did you pack it to original size? Just fill it with some bytes?:confused:
crUsAdEr
03-27-2002, 12:59 PM
Hi Solomon.

I downloaded the exact version as yours, same opcodes and everything... patched it to make it register... did not touch the size check at all.. but my downloads seems fine.... no funny message liek yours :>

How did you trigger it?

Thanx,
Solomon
03-27-2002, 01:18 PM
hi binh81,

It's random. Just check the ASM list. I think GetTickCount( ) does the random trick. Try to change the return value in EAX to see what will happen(I have not test this)

001B:004797E7 XOR EAX,EAX
001B:004797E9 CMP [0051483C],EAX
001B:004797EF JZ 004797FE
001B:004797F1 CALL [KERNEL32!GetTickCount]
001B:004797F7 AND AL,03
001B:004797F9 NEG AL
001B:004797FB SBB EAX,EAX
001B:004797FD INC EAX
001B:004797FE RET
In order to test my crack, I manually downloaded one zip file more than 100 times. Crazy? In the past few days it worked fine, but it begins to destroy files again this morning.

So Stone's way is the best to pass the size check.:)
MarcElBichon
03-28-2002, 08:53 AM
look at http://rev.fannet.ru/cgi-bin/ceilidh.cgi/ceilidh/?C3d53bf6ebEUy-4469-1355+07.htm

Mike
Solomon
03-28-2002, 10:09 AM
thx Mike.:) I got it
Stone()
03-28-2002, 11:20 AM
This certainly will be blacklisted within next version, so cracking it is still the way to go.

To repack it to exactly the same size just try to add as many 00 bytes you need using UPX or whatever packer works.

I could not repack it with Asprotect 1.2 as it said that the file is already protected.
Stone()
03-28-2002, 06:34 PM
Hey try to look at the new protection scheme from Reget Build 114.

Registration with on-line server check.

I'm half thru with the un-protection. Completely changed compared to build 113.

Have fun.


memohasp 1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > memohasp 1
PDA

View Full Version : memohasp 1

jswift
03-17-2002, 01:18 PM
First, I've never cracked a dongle before. I did some research on how the HASP works, but I still havent figured nothing but basic things. I wont tell on what app Im workin, due to respect of the author. I also dont have the dongle. This is what, so far, I have figured out:

It exports these functions:

?HCleanLogin@@YGHXZ
?HTestAppRights@@YGHPAD@Z
?HTestCodes@@YGHHPAH000@Z
?HTestDate@@YGPADXZ
?HTestProtection@@YGHPAH000@Z
?HTestUserNum@@YGPADXZ

I guess its obvious what these do.

I've been able to find main hasp code, from what i understand, by simple searching for cmp bh, 32 .

:00402C5A 035D10 add ebx, dword ptr [ebp+10]
:00402C5D 8B450C mov eax, dword ptr [ebp+0C]
:00402C60 8B4D14 mov ecx, dword ptr [ebp+14]
:00402C63 8B5518 mov edx, dword ptr [ebp+18]
:00402C66 80FF32 cmp bh, 32
:00402C69 7205 jb 00402C70
:00402C6B 8B7528 mov esi, dword ptr [ebp+28]
:00402C6E 8B06 mov eax, dword ptr [esi]

There are 59 references to this piece of code above.

Haspman v3 would be great help. Couldnt find nothing but v4 manual.
What is the next step? I just need you to point me a direction. Any help is appreciated.

Thanks
goatass
03-18-2002, 04:15 AM
What I would do here is set a BPX FreeEnvironmentStringsA and when it breaks you do one F12 and you should see:
push ebp
call [esi]
pop ebp <-- you will be here
press F12 one more time and BPX on the call you just came from, that is the hasp() call that will be used in every access to the dongle. Now re-run the program and write down the services and all of their parameters and make your emulator.

EAX= seed
BH = service number
ECX=password 1
EDX=password 2

These are the basic parameters so by knowing which service is called you can look up the rest of the parameters.

Check out CrackZ archive (the link is at the buttom of this page).

goatass


Finding EXE Size in Memory WinHex Style
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Finding EXE Size in Memory WinHex Style
PDA

View Full Version : Finding EXE Size in Memory WinHex Style

foxthree
03-17-2002, 01:31 PM
Hi All:

I'm writing a tool similar to WinHex and I have a need to implement something similar to RamEditor function. Basically, I need to be able to select a process and scan for certain opcodes within the memory range.

Starting address will be the Image Base address; No problem here?

The problem I have is how to locate the ending address? VirutalQuery* functions? If so, how? For example for calc.exe, WinHex displays the primary memory as beginnging at 00400000 (Module base) and ending at 1016FFFh. How does it calculate this?

Thanks for all your help,

Signed,
-- FoxThree
Kayaker
03-19-2002, 03:12 AM
Hi foxthree

You may have already tried this, but run APISpy32 on WinHex with the Kernel32.fnl library and pause it until just before you select a process to RamEdit and select OK.

You'll get a nice output of exactly how it's done. To get the ProcessId you use the CreateToolhelp32Snapshot series of API's (Module32First / Module32Next) and parse the PROCESSENTRY32 structure. Then OpenProcess and VirtualQueryEx to map the regions. Break on OpenProcess and carefully examine the VirtualQueryEx loop and the APISpy32 output to see how it's used. Note how the RegionSize returned in the MEMORY_BASIC_INFORMATION structure of one VirtualQueryEx is used to increment the lpAddress value of the next VirtualQueryEx to scan over the entire per process address space from 4MB up to 2GB (400000 - 7FFFFFFF).

Asprotect (since we know what we're really talking about here ;-) uses VirtualAlloc with the MEM_COMMIT and PAGE_READWRITE attribute flags to allocate memory for its High Mem unpacking code. You could probably use these flags (which are returned in the MEMORY_BASIC_INFORMATION structure) to narrow down your search region to the proper page(s) for those 'certain opcodes'.

Hope this helps,
Kayaker
foxthree
03-19-2002, 06:45 AM
Hi Kayaker:

I've just two words: YOU ROCK!!!!

Thanks for your "very" insightful post ;-)... It was worth the wait!

Thanks again,

Signed,
-- FoxThree
[NtSC]
03-19-2002, 03:43 PM
YOu should check what OS you are on,because Toolhelp32 Functions are not available on NT. On NT based Systems you should go for APis like EnumProcessModules + .. .. .. ..........
foxthree
03-19-2002, 06:29 PM
yep, PSAPI is the way to go on NT ;)


MPR.DLL trouble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MPR.DLL trouble
PDA

View Full Version : MPR.DLL trouble

CccT
03-18-2002, 05:43 PM
Under DOS I deleted Mpr.dll because of safety reasons/CPU economy and most apps are still fine if not much better without it.
However, I have one network-enabled app (not by MS) that does require Mpr.dll and I put this .dll in the same folder as the app requiring it.
The app now runs fine but when I close the app, Windoze crashes and I need to reboot because the Mpr.dll that is not in C:\Windows\System is making a superfuluous api call to a relative path.
Is there a patched / reversed version available of MPR.dll that does not make this Api call ?
mike
03-27-2002, 06:15 PM
Just go in and change the path or eliminate the call yourself. NOP out the call and the stuff that gets pushed onto the stack, and push the result you want onto the stack.
CccT
03-27-2002, 08:14 PM
I once saw a nifty tool at :
http://protools.cjb.net/
that could do that but I forgot which one of all the tools they have.

CccT


PatchEngine 4.5 English
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PatchEngine 4.5 English
PDA

View Full Version : PatchEngine 4.5 English

thurl
03-18-2002, 06:12 PM
I can only find V4.5 PatchEngine in Chinese language. Can anybody tell me where I can find the English version please?
DakienDX
03-18-2002, 06:33 PM
Hello thurl !

Could you be a bit more specified? There are more than twenty programs calling themself PatchEngine, and some of them may be version 4.5.

The only one I know of is PatchEngine 4.4 by ArthaXerXes, which can't be chinese since he's from France. ;)
As far as I know it hasn't been released as 4.5 yet.
thurl
03-18-2002, 06:50 PM
Yes, PatchEngine 4.5 by ArthaXerXes is the one I want and he said himself it has been released on his webpage, but i cannot reach it. The Chinese version may have been a hack.
DakienDX
03-18-2002, 07:14 PM
Hello thurl !

I didn't know it was released. Now I know. ;)
I've found only one page with Google containing and link to 4.4 and telling 4.5 is available at his homepage.
I can't reach it either at the moment.
mike
03-19-2002, 01:32 AM
In some other posts he mentioned that he was having trouble with his server and that the only way to reach him is via private messages on the board. You could contact him directly & ask for it.
UCEC
04-21-2002, 04:56 PM
Originally posted by thurl
I can only find V4.5 PatchEngine in Chinese language. Can anybody tell me where I can find the English version please?

PE4 FAQ by ArthaXerXes

13:16 12/11/2001

Version 4.5 :

- improved memory management.
- improved speed.
- added "disable unpatching" feature. Smaller patches, but you need a backup to revert changes...
- added "Analyze" function used to determine if it is worth or not to create a patch.
rack
04-22-2002, 05:21 PM
Sorry for my english.

With the"Search button" it is possible to find

http://www.woodmann.net/forum/showthread.php?threadid=2884

with attached the Patch Engine 4.5


Need help with HistoryKill
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help with HistoryKill
PDA

View Full Version : Need help with HistoryKill

Argoth
03-18-2002, 06:42 PM
Hi all!

Ok, I'm working on a program called HistoryKill 2001 build 2001.3.9. I downloaded it from //download.cnet.com/downloads/0-3356727-100-5657559.html?tag=st.dl.10001-103-1.lst-7-1.5657559 Now I know that there is a registry key, which it checks, on:

HKEY_USERS\.DEFAULT\Software\Key

Bpx RegQueryValueExA should bring you to the correct point. (It's right there when SI pops up for the first time.) When you get to 01222662, I think there's an interesting compare there. It compares ESI (which holds the value we filled out in the regkey) to EDI, which is 01241FAC. Why I'm already stuck here is: No matter what I try, the jump after the compare is always jumping. Ofcourse I could just reverse this jump by reversing the s flag, but that's not my idea :) I want to find the correct key.

I could use some hints,

Thanks in advance,

Argoth


how do i set a dongle breakpoint?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how do i set a dongle breakpoint?
PDA

View Full Version : how do i set a dongle breakpoint?

TrixMan
03-19-2002, 08:12 AM
Hi!

I have a program protected with a sentinel dongle and i have made a dump with spro dump.

I can see the serial and the dev id but how do i set a breakpoint when the program is calling a specific cell in my dongle??

TrixMan......
me8
03-19-2002, 07:32 PM
bpio ? ?
goatass
03-19-2002, 10:22 PM
What you can do is set a BPX CreateFileA do "d *(esp+4)"
and watch to see when the application trys to open the sentinel.vxd when it does that disable the BPX and F12 a few times until you are back into the application and can see the dongle related parameters pushed in to that call. Once you think you are there write down the RVA, load the file into IDA, load the sentinel signatures and jump to the RVA you wrote down and you will know exactly what is going on.

Check out CrackZ archive, there are tons of great papers that will help you. Also check out my paper on FlexiSign it will show you how to locate these dongle functions without knowing where to BPX.

goatass
UrgeOverKill
03-20-2002, 10:32 PM
Hiya,
what you may want to do is read the manual on setting breakpoints on the I/O ports.
TrixMan
03-21-2002, 08:50 AM
Hi all!

What I'm was looking for was something like"BPX cell 0x24"or something like that, but I know it´s not so essay it must bee a bitt more complicated maybe "bpio 'something'" I don´t know.

I want to thank goatass for his CreateFileA I will try it.

When I'm using DeviceIoControl I find a loop where I can see some off the cell being pushed to the stack but not all (I think).
The reason is that when I'm trying to manipulate the words (I'm using a dump from another dongle, same program) and the program fails, that's the reason I belive it must be another loop somewere.

Regards

TrixMan
goatass
03-21-2002, 12:15 PM
Sentinel uses the DeviceIOControl API to talk to the VXD which will than talk to the dongle. Using the BPIO -h 378 trick might work but many times it won't.
You can not BPX on specific cell readings like you think, you need to find the sproRead function and BPX there, find the sproQuery function and BPX there, etc.

If you want to find out why it's failing, find where it reads some byte from the dongle and then set a BPM on the buffer holding these bytes and continue tracing and see where that buffer is being manipulated. The program will most likely not read everything in the dongle memory so don't expect to see each and every cell being accessed.

goatass


How to detect double-dip of ASPR and locate them?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to detect double-dip of ASPR and locate them?
PDA

View Full Version : How to detect double-dip of ASPR and locate them?

Solomon
03-19-2002, 08:58 AM
another how to:D

I just want to find a general way to locate the double-dip of ASPR. There is no /tracex in Win2K. so did you use the tracer of RV? please share your discovery:)

sometimes I find the double-dip is right after RegQueryValueExA("Key").
+SplAj
03-19-2002, 11:14 AM
...and after that you saw the call address for dip is a reference address stored a lookup table......and so lookup the lookup table in SI and see how many other addresses are around there ;) .......note them down or 'print screen' and maybe bpx them now to check ?

Spl/\j
Solomon
03-19-2002, 01:12 PM
thx SplAj. I will try it:)

How about your legs now?
crUsAdEr
03-19-2002, 01:42 PM
Hi Solomon.

As fox3 pointed out in some other thread, AsProtect stop at 401014 before dipping, so you can use your usual trick of bpx at iret and then set bpm 401014 x, sice should breaks there and u will find the dipping area after a weeny bit of tracing :>

Also, you can use revirgin to note down all dip VA and set breakpoint on them when u break at 401014... that will aid tracing a bit :>...

regards,


reversing msn messenger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > reversing msn messenger
PDA

View Full Version : reversing msn messenger

l00natica
03-19-2002, 09:40 PM
hello there
I was trying to force msn to show me the contacts that are blocking me. I know there must be a flag somewhere that msn uses to know who is blocking me, I couldn't find it.
If anyone has an idea or knows about a tutorial on doing that please tell me. I'm not interrested in a ready made patch!
thank you
Tech19
03-19-2002, 09:48 PM
Umm I think msn stores your contacts on a server sumwhere so it might prove difficult. Although I might be wrong. However even if you do manage to reverse msn so that it shows all the people blocking you as online they still wouldn't be able to recieve your messages and you wouldn't know if they're blocking you either as they would just appear as online.
Kaz
03-21-2002, 01:07 AM
Microsoft made public docs of the MSN Messenger protocol.

http://www.atlantageek.com/msn-protocol.html

Hope that helps.


Icedump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Icedump
PDA

View Full Version : Icedump

rowdy
03-20-2002, 04:03 AM
Having trouble loading icedump.
I have edited winice.dat to load symbols from kernal32.dll.
I understand that icedump looks for symbol base in winice, but when I type "sym" in softice, it says "no symbol table".
Is this why icedump won't load?
I am using icedump v6.0.2.3 and winice v4.05 build 334.

Also, what is an .NMS file.
When I try to translate a module in symbol loader, it says no debug info. Is there anywhere I can get these files?

All help appreciated,
B-Boy
03-20-2002, 09:09 PM
look at this: http://www.woodmann.net/forum/showthread.php?s=&threadid=2806

if you load kernel32.dll _symbols_, icedump loader will fail. however, you have to load kernel32.dll _exports_ for icedump to succeed.
rowdy
03-21-2002, 03:46 AM
Thanks for response.

I am not loading any symbol files in winice.dat and I am loading kernal32.dll exports, but still does not load.
Loader32 tells me I don't have a symbol table so I guess I don't have any symbols loaded.

Frustrated!


softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice
PDA

View Full Version : softice

skyman
03-20-2002, 04:12 PM
Hi ,
i have just installed softice 4.05 on my pc ,
i am runing windows xp pro.
when i start softice the black screen comes up then dissapers.
has any one got the solutation.
baffffffled.
cheers skyman
JMI
03-20-2002, 06:49 PM
Softice 4.05 does not appear to work with WinXP. Do a search for Softice and WinXP here and you will find several threads reporting problems with Softice and WinXP. At the moment, the only version that works for many people is the one from DriverStudio 2.6.

Regards.
Kaz
03-21-2002, 12:52 AM
DriverStudio 2.6 also has major problems with XP also. My recommendation to you is to make a dualboot type thing with Win2K and use softice with that OS instead of XP.


parameters
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > parameters
PDA

View Full Version : parameters

death
03-20-2002, 05:20 PM
if it was written in C++ most likely it uses classes..
when you call a class member function (that is not static), the first parameter pushed is the pointer to the class object (this).. if you notice this somewhere in the executable, it's C++..

[er. this was supposed to be a reply to foxthree's solaris executable question, wrong button pressed]
notbob
03-20-2002, 06:12 PM
Originally posted by death
if it was written in C++ most likely it uses classes..
when you call a class member function (that is not static), the first parameter pushed is the pointer to the class object (this).. if you notice this somewhere in the executable, it's C++..

This isn't entirely true. Generally speaking, non-static class member functions have their this pointer passed as an implicit argument 0, but it isn't necessarily passed on the stack.

MSVC6 for example passes this in the ECX register. It's a pretty solid hint that that's what is happening when a function uses ECX extensively without first preserving it somewhere.

I know the original post was in reference to Solaris (and presumably a SPARC processor), but my point is to be aware of parameter-passing in registers.

cheers,
-notbob


Strange DRx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Strange DRx
PDA

View Full Version : Strange DRx

evaluator
03-20-2002, 06:12 PM
Hello, Kayaker!
Hello, guys!

I read in INTEL-manual's "instruction set" about "MOV DRx,r32":
"The instructions must be executed
"at privilege level 0 or in real-address mode.

So why I can execute these instructions in "normal" Ring3 program???

Or I have magic PC!?
JimmyClif
03-20-2002, 06:22 PM
I post you japheth's answer on the same question:

in Win9X these ops (mov eax,crx) are "emulated", AFAIK. "Emulated" here means you don't get a GPF, but you also don't get the "real" values of that registers. And of course you cannot set them.
On the contratry opcode "Halt" may be emulated correctly.

No magic in your PC ;)
evaluator
03-20-2002, 06:57 PM
But I can move values into DR0-3 and then
read that values.

you wrote:
"And of course you cannot set them"
??
JimmyClif
03-20-2002, 07:27 PM
I never tried to execute ring0 instructions in my everyday code...
So here's the thread I was taking that quote from:

here (http://board.win32asmcommunity.net/showthread.php?s=&threadid=3825&highlight=ring3+drx)

Did you check it with a debugger ?
Kayaker
03-21-2002, 03:30 AM
Hi

You're right Evaluator, I can read and write to the debug registers in Ring3 code as well as in Ring0. Weird huh? At least apparently. The reason I say "apparently" is a question I've had about the debug registers, to paraphrase Splaj - "Still searching for my +DRx" ,lol.

Let me explain (with some good old creative copy 'n pasting). There are 8 debug registers, 6 of which interest us.

DR7 is the CPU debug control register, whose bits define which (BPM) breakpoints are active, the breakpoint type (CODE or DATA), and the access size for DATA breakpoints. The breakpoint type is stored in the breakpoint structure, and is translated into the R/Wn fields of DR7 :
code execution = 00
data write only = 01
data read/write = 11
data read only = 11 (read and write sorted in the handler)
There are also some undocumented bits (isn't there always? See UNDOCUMENTED BITS IN DR7 Dr. Dobb's Journal). DR7 can also be used as a method of SICE detection...

DR6 is the debug status register which is used to identify the condition that caused the debug exception. Each time a task encounters a debug exception, the CPU encodes the source of the exception into bits of the DR6 debug status register (i.e. breakpoint 0, 1, 2, 3 or trace mode single step).

DR0-DR3 are the Debug Address Registers. Each of these registers contains the linear address associated with one of four breakpoint conditions. Each breakpoint condition is further defined by bits in DR7.
The debug address registers are effective whether or not paging is enabled. The addresses in these registers are linear addresses. If paging is enabled, the linear addresses are translated into physical addresses by the processor's paging mechanism. If paging is not enabled, these linear addresses are the same as physical addresses.

If you type 'CPU' in Softice you get a listing of all the current registers and selectors, including the control (CR) and debug (DR) registers. Now, my interest was to "find" the debug registers in memory so I could actually see and feel them rather than just accessing them through code. So I used this code in Ring0, which fills the 1st debug register DR0 with a searchable value:

mov eax, 'kcuf'
mov dr0, eax ; write to dr0
xor eax, eax
mov eax, dr0 ; read dr0

Doing a search for 'kcuf' I found where all the registers listed with 'CPU' actually are (C392xxxx on my system). You can actually see the register values changing as you trace or execute commands. OK, cool so far.

Now my question is, the docs say that DR0-DR3 contain the linear address associated with one of four breakpoint conditions (i.e you've got maximum 4 BPM breakpoints you can set). So if I set a BPM breakpoint or two, I was *expecting* to see those addresses listed in the debug registers (as shown by 'CPU'), but I don't!! Or, if I set a BPM breakpoint that is registered in say DR3 (as shown by 'BL'), and use "mov eax, dr3", I *still* don't get the breakpoint address returned to me.

Spath's Softice Internals document contains a good discussion of how Softice sets up breakpoints (BPX, BPM, BPR,..), how an internal table is used to store the addresses, and how the DRx registers are apparently secondary to this table and aren't immediately used. I'd like a better understanding of exactly *how* you can access breakpoint addresses (of any kind). If not directly through DR0-DR3 for BPM breakpoints, then *where* are the internal breakpoint tables used by Softice?? There are only 4 BPM breakpoints available *globally*, are the DRx addresses readable in a task's _CONTEXT structure? (see Spaths doc and the Softice ADDR command for wtf this means).

My interest (other than general curiousity) is to see if it's possible to set a breakpoint directly through code by modifying either the debug registers, or the breakpoint table, and to have Softice pop up. Specifically a break at the OEP. Or, to examine exactly how winice does it. I know a 'CC' is set at the first byte of the target address and when the INT3 is executed, SoftICE's INT 3 handler is called, and the original byte is restored. Somewhere in there Softice pops up.

It's the *implementation* of this code I'm interested in. Using a dll injection technique (which runs *before* the real OEP executes), I'm wondering if it's possible to set a breakpoint *on* the OEP so Softice pops up just as it normally would using Loader32.exe.

Or, to extend the idea further, let's say there's a redirected thunk address which is accessed during a registration routine. Could you set a BPM breakpoint on a READ of that address (or an eXection of the address pointed to by that thunk) THROUGH CODE?

Again, this would require accessing either the DR0-DR3 debug registers and inserting the proper linear address, and/or Softice's internal breakpoint table. Back to my question - Anybody have any ideas *where* the internal BP table(s) is(are), or how (if) the debug registers should be correctly used?

This make any sense?

Kayaker
DakienDX
03-21-2002, 06:34 AM
Originally posted by Kayaker
DR6 is the debug status register which is used to identify the condition that caused the debug exception. Each time a task encounters a debug exception, the CPU encodes the source of the exception into bits of the DR6 debug status register (i.e. breakpoint 0, 1, 2, 3 or trace mode single step).Hi Kayaker !

But you have also to clear DR6 after each breakpoint or you won't know why the next breakpoint has occured. ;)
evaluator
03-21-2002, 06:58 PM
Hello, Kayaker!
Hello, JimmyClif!

JimmyClif!
"DON'T TRUST OUTSIDE, DON'T TRUST CODEINSIDE:)"

So lets resume our research!

Under [my]W98SE wE can in Ring3:
1. successfully write & read to-from DR0-DR3
>For this I wrote in HIEW super-little prog "DR0-3.EXE"
See in attachment. It run under "plain" W98SE & with WICE or TRW.

2. NOT_successfully write & read DR6-DR7 (& CR0,CR2-4)!
This means: I allowed try to move in this registers,
but when I read, "they" always returns 00000000.
Because of this I can't say: 'my values are written there'

Anyway we have NO fault.

Experimental:
I try also 0F24 & 0F26 opcodes.
HIEW shows them as TR0-TR8 (shows uppercase e.g theoretical?). Test registers???
Finally I get fault!
DakienDX
03-21-2002, 07:51 PM
Hi evaluator !

The TR? regsiters where only present on the 486. So any access from CPU lower or higher than a 486 will generate an expection.
evaluator
03-21-2002, 08:52 PM
Kayaker!

1. If I try search upper C3000000, wice become frozen...

2. you wrote:
>>My interest is to see if it's possible to set a breakpoint
>>directly through code by modifying either the debug registers...

here I can't help you with my knolidge, but have you read
INTEL's manual 3, chapter 15?
Probably you havn't read, because you write:
>>how the debug registers should be correctly used?

My eNgLiSh is too small for this, but as I understand,
BPM are NOT set only by MOV DRx, also there are lot of other registers..

DakienDX!

WE WILL...
JimmyClif
03-21-2002, 09:10 PM
I wish I could test this ;) but I'm stuck on real Operating
Systems.. such as WinME and WinXP (harharharharhar)

LOL,
JimmyClif
Kayaker
03-22-2002, 06:16 AM
Thanks for the feedback guys!

I'll be gone for a couple of weeks, drinking beer and kayaking someplace warm ;-)

Will have another look at it when I get back. Probably check in from some cybercafe somewhere...

Cheers all,
Kayaker
DakienDX
03-22-2002, 03:02 PM
Hi Kayaker !

I wish you all the best for your holidays. :)

You're going to "someplace warm", Florida perhaps? (Spring Break? ;) )
evaluator
03-23-2002, 09:42 PM
Kayaker!
I did it!

I set DR0 and then handle it in own code!!

Or you are no more here?
Kayaker
03-29-2002, 07:53 PM
Originally posted by evaluator
Kayaker!

Or you are no more here?

LOL, nope, no more here. A continent or two away actually. Just wanted to check in from the jungle to make sure this place is still rocking. And it is, cool.

Adios,

Kayaker
crUsAdEr
05-02-2002, 03:11 PM
Since kayaker is back :>.. how about research on this still?

I found this thread rather interesting, though din understand everything
NT internals questions ( started by arthaxerxes)
http://www.woodmann.net/forum/showthread.php?s=&threadid=1146

I still dont get it... AsProtect seems to do everythign without a problem? clearing debug registers from 0 to 7 everywhere be it 98, NT, 2K or XP... guess i have lots of stuff to be read.. if only the damn exams could end earlier.. the Intel manual prolly takes a few years to finish reading..lol...

When you guys use
mov eax, 'kcuf'
mov dr0, eax ; write to dr0
xor eax, eax
mov eax, dr0 ; read dr0
is this in the seh handler or in your normal asm code? if in the normal code then isnt the case solved completely by using seh?

Gosh i am lost!!!!!

thanx,
crUsAdEr
evaluator
05-02-2002, 04:19 PM
Hello, binh81!

1.
>mov eax, 'kcuf'
>mov dr0, eax ; write to dr0
>xor eax, eax
>mov eax, dr0 ; read dr0

Of course, its ASM code.

2.
>how about research on this still?

Define exactly, what you want.
Setting DRx and handling?
On me W98se I did it very easy, but You are on W2k, Ok!?
Seems, here you must write your own NTICE~:0
fORgET iT! Or use NTICE:)

(In XP's NTOSKRNL there are banch of "MOV in-out DRX", so our poor DRx will cry in 90%)

3.
Why ASPR kills DRx?
R!SC's answer is enauf. Or no??
But ASPR (& any) can't kill BPR. Eh, there are no BPR on NT\W2k\XP.
Don't warry, be Happy, use BPX-Api.

4.
> the Intel manual prolly takes a few..
Nope, I read & very enjoE. You need for read:
Volume 3 CHAPTER 15
DEBUGGING AND PERFORMANCE MONITORING (24 page)
+ CHAPTER 5
crUsAdEr
05-03-2002, 09:43 AM
Thanx eval,

Shall read that Intel manual when i have time....

I was just wondering what is the fuss now about debug register? Since anytime we need to access it, we can just use a simple seh and everything is yours to play with?


Serial check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Serial check
PDA

View Full Version : Serial check

Thickit
03-20-2002, 09:23 PM
I have a app that checks to see if the correct drive is installed in the pc before starting up. I would like to remove this part of the program or trick it in to thinking the drive is there. Compleatly new to this I know its a pretty advanced thing I'm wanting to do. So what do I do first or where are there some real good information pages to start reading up on.

Thanx all
Woodmann
03-20-2002, 10:15 PM
Howdy,
Whats the name of the app?

Peace, Woodmann
DakienDX
03-21-2002, 08:03 PM
Hello thickit !

You should try to search for the vendor string of the drive you don't have in the program.
Since you probably don't know the exact string you should start with the manufracturer.
So if the software says "I will only run with a NEC DVD-ROM 13xx" for example, you should search for "NEC" or "DVD-ROM" or similar.
When you've found the string you can look for references to it to find possible compares.
Patch them and your software should work with the drive you have. (if it doesn't use some vendor specified functions)
Thickit
03-21-2002, 09:14 PM
Thanx DakienDX I have now found out that it's been written in MS Visual c++ I have a copy of that on its way but my next question is can I open with this program and search / edit it or has it got to be Unpacked? Whats the best appz to poke around the program and alter it?
Clandestiny
03-21-2002, 10:49 PM
Hiya Thicket,

My first suggestion would be to try to disassemble it using either IDA or Wdasm (protools.cjb.net for these tools) Once disassembled, you'll be able to search the string references and imported functions. This could give you some clues as Dakien suggested. As for knowing if it's packed... Well, attempting to disassemble it should clue you in since if it's packed you probably won't be able to get much of a meaningful disassembly.

Alternately, you could search through a raw hex dump of the file using a hex editor. At any rate, eventually you WILL need a hex editor to physically alter the code when you've found the patch point. Hiew (Hacker's View) is my hex editor of choice for patching, although you could also use UltraEdit, HexWorkshop, or the like...

Hope this gets you started...

Feel free to post your questions here if you get stuck on something.

Cheers,
Clandestiny
Thickit
03-22-2002, 12:24 AM
dissasembled using w32dsam the window shows nothing I can read its just squiggles but the refs menu does show me some infomation but even then I cant find any mention of the program checking for the drive. This is going to be a lot harder than I thought I'm not one to give up any pointers now.
Thanx Clandestiny nice site that m8..

Got my squiggles sorted out helps to choose a font DOH..
Thickit
03-22-2002, 12:47 AM
Wow much better can see quite a few refrences to the drive can somebody point me to the basic commands whats a push and a call??
Clandestiny
03-22-2002, 01:03 AM
Originally posted by Thickit
Wow much better can see quite a few refrences to the drive can somebody point me to the basic commands whats a push and a call??

You're gonna need to spend some quality time with the AOA (Art of Assembly), my friend...

ht*p://courses.ece.uiuc.edu/ece291/books/artofasm/artofasm.html
ht*p://webster.cs.ucr.edu/Page_AoAWin/0_AoAHLA.html

Good Luck,
Clandestiny
Thickit
03-22-2002, 01:17 AM
Good luck...... gonna need it Thanx again m8
Thickit
03-28-2002, 09:15 PM
Been trying my best to understand using the links from Clandestiny thanx again m8 but it's no good I need a DUMBO version any more links?


PE and Imports and more questions....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PE and Imports and more questions....
PDA

View Full Version : PE and Imports and more questions....

nyx
03-21-2002, 06:19 AM
Well this is my second post,

Was fooling around with notepad of window 2000 on windows98se though I knew it would not run,I put the notepad through some PE editors and modifiers and deleted some of its import functions to the (I recall) printer driver normally some priting API funtions.Well then validated it,well it never ran but some questions I got were is this possible.Any body have any programs or ideas

Another thing is what is meant by attaching a program to a live process ?

Then about the VBOX(till ver 4.3(?) protection system well if you properly clean out the register keys using the AMOK VBOX cleaner etc,you can reintall the program and it works,then I wonder what more is left in the protection.

Thank

nyx
DakienDX
03-21-2002, 06:31 AM
Hello nyx !

There is a big problem using programs which come with different windows version on each other.
Normally these program's imports are bound.
You can be sure most time that these programs use some undocumented functions.
Also the memory structures can differ from version to version.

And if there is a call to an import and you simply delete this import, what will happen?
Either there will be a 00000000h in the import table which marks it's end and skips all other imports following (=crash) or all import entrys will be moved one entry back and all following calls to imports will point to the wrong import. (=crash)

Why do you want to use Win2000's notepad on Win98? Just because of "New Search", "Mark All" or "Replace"? You can find ways how to implement this functions on Win98 on this board and on Fravia's Mirror
nyx
03-21-2002, 07:01 AM
Well I'm learning VC++ just time before I break into Windows.....
death
03-23-2002, 02:20 PM
Bound imports are only used if the addresses are right. If not, the loader uses the original imports.

As for Notepad, under Win2000 it imports some Wide char APIs. 98SE doesn't support Wide char APIs, therefore it will not work.
notbob
03-26-2002, 03:49 PM
Originally posted by death
Bound imports are only used if the addresses are right. If not, the loader uses the original imports.

As for Notepad, under Win2000 it imports some Wide char APIs. 98SE doesn't support Wide char APIs, therefore it will not work.

Normal executables have their import addresses resolved at load-time. When a PE file is loaded, it requests to be loaded into a certain base address (indicated in the PE file headers). If that address isn't available, then it has to go somewhere else and the loader has to fix up all the addresses that changed.

A Bound PE file forgoes the ability to have it's DLLs relocate in order to speed up load times. Essentially, it assumes that all the base addresses for its imports will be available. This is a reasonable assumption for a system tool like Notepad because Win32 runs each process in its own address space, and all the import DLLs are written and controlled by Microsoft.

When you load a PE file and it's import DLLs, the IAT is filled in with all the addresses it needs. The IAT then becomes something of a jump table for import functions. When the PE file is bound, this process takes place once and is permanently stored.

The fundamental reasons why you can't run Win2000 Notepad on Win98 is because the EXE is bound, and the underlying DLLs have different base addresses.

cheers,
-Notbob

PS - This was all from memory and it's been a little while since I've forked with PE internals, so if I'm a little off, please let me know.
ancev
03-26-2002, 04:12 PM
notbot,

you're right in your explanation, but i guess the problem is another. to check the vality of the BOUNDed imports, the loader check the dll time stamp against the bound import descriptor time field.

if they dont match, normal imports is used. and i bet they dont match between w9x kernel32.dll and w2k notepad.exe

ancev


problems with revirgin 1.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > problems with revirgin 1.3
PDA

View Full Version : problems with revirgin 1.3

Spawn
03-21-2002, 08:36 PM
I've tried to get orig iat of the asprotected notepad .
i have got some unresolved api functions, as in note_resolved.txt
but when i try to use "Tracer" or "Api Emu" on those funcs, notepad_asp terminates and function names remains unresolved.

It is a bug or rv doesn't work under winxp?
crUsAdEr
03-21-2002, 11:09 PM
AsProtect YET again :>

Hi Spawn,

please do search the board and read SplAj's excellent commview tutorial... I think the board have EXCESS info on AsProtect as Kayaker complains :> (rite kayaker :>???)

Yeah, RV is not magic tool that you click one button and it generates everything nicely for you... u have to do something manually as well...

so yeah, as the saying go, "search and learn"

Regards.
Spawn
03-22-2002, 05:37 PM
of course i can use softice to determine this or that import function and its module but this is not that i want.
i'm only asking about the functionality of this tool. and under winxp it doesn't work correctly.

what about XP support?? even 1.31 doesn't work under it.
crUsAdEr
03-22-2002, 07:37 PM
Hee...

Sorry for the misunderstanding, but your post was not very clear :>.... really sorry about that!!

yeah i dont htink Tsehp has indicated that Rv support XP yet, so hang on tight... he did say he is working on it though...

cheers.


Filemon/Regmon Programs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Filemon/Regmon Programs
PDA

View Full Version : Filemon/Regmon Programs

nyx
03-22-2002, 12:20 PM
There are come programs like those from Elecomsoft that when installed(Advanced eBook Processor.etc) if filemon/regmon is running shuts it down.Well is there any advanced program other than that provided by sysinternals.Any idea how they shut these programs down ?

Thankz -nyx
Solomon
03-22-2002, 02:03 PM
1. detect the GUI with FindWindow(Ex)
2. detect the driver with CreateFileA
foxthree
03-22-2002, 07:07 PM
To add to Solomon, they mostly check the Window Class. This makes it trickier to hide the window. For instance, even if you code a small proggie that can find the Window Handle of RegMon and change it's title (a.k.a. SetWindowText), you'll be surprised to see the Window closes ;)

Fear Not! If you look into FindWindow, it also takes the class name. So just patch the class name in the proggie and voila! RegMon is alive and well :D

Signed,
-- FoxThree
nyx
03-26-2002, 07:03 AM
So just patch the class name in the proggie and voila! [/B]

How ?
ancev
03-26-2002, 04:07 PM
hi

you also can patch the APIs it use to detect, and hide some results.

i attached a code i did to hide explorer.exe from process viewers. but as is only work in w98.

ancev
foxthree
03-26-2002, 04:31 PM
Hi:

Just hexedit it. :)

Signed,
-- FoxThree
KurtzHz
04-03-2002, 07:38 AM
Yo also might try the n00b-friendly Api Monitor. Even your proggie detects it, you'll still get a nice list of all (almost) API's the prog called before detection.

:phxxp://www.rohitab.com/apimonitor/:p
nyx
04-09-2002, 05:58 AM
Thanks for that link there.That was a good monitoring program I missed out.

nyx
Aimless
04-09-2002, 07:50 AM
Note:

Regmon now automatically "RANDOMIZES", its own class name (check out what Mark has to say about that).

If you want to try your own thing:

1. Download SOURCES of FileMon and RegMon.
2. Note that a class name can be numbers as well as names
3. Note that the windownames can be numbers as well as names
4. Search the area where class/windows names are declared in the source
5. Add a variable and a line of code:
int random_class = date_to_number(getsystemdate())
class name = random_class
6. Compile the same
7. Henceforth, everytime you run FileMon/RegMon you should get the class name changed to getsystemdate.
8. For more complicated randomizing, try getting getsystemtime(). This changes by the nanosecond
9. Alternatively, simply look up Regmon's source to see how the class randomizer is implemented, and do the same.

...Have Phun
foxthree
04-09-2002, 08:29 AM
Now you guys can forget my Hex Patching trick. Alas, guess I was too lazy to modify RegMon Sources :D

I'd say tis abt time somebody added stealth to *Mon proggies...

Signed,
-- FoxThree


Flexlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm
PDA

View Full Version : Flexlm

pdz
03-22-2002, 06:12 PM
Bonjour

To make my own License, I would like find these parameters: SN and SIGN
How I can get it ?
Thank you


stream cipher???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > stream cipher???
PDA

View Full Version : stream cipher???

crUsAdEr
03-23-2002, 03:41 AM
Hi folks, i am kinda stuck when trying my hand on crypto stuff, just wanan clarify a few things...

Should this be strean cipher? or is this block cipher?

mov eax, DecryptedArea
mov ecx, key ; taken from serial
mov edx, length
Call Decrypt

This Call Decrypt has somethings to do with MD5 as i see the whole sets of MD5 sine tables in there... has anyone seen this type of cipher before? using MD5 hash?... i am a bit lost here, also cos of lack of sleep, thus the incoherent typing.... just wonder if this is some kind of standard cipher that i have missed out when reading about general cryptography?

Thanx a lot,

DaKien : i read ur post sometimes ago that you were willing to share ur collection of crypto source code :>... are you still extending that offer :>>>...??
Sab`
03-23-2002, 07:52 AM
hrm... would be nice to see the code that "decrypt" function contains. Chances are it is a block cipher, havent seen to many stream ciphers in programs. Its possible a md5 is used to generate the block cipher keys or anything similiar. To spot if it is a block cipher look for some sort of loop until the length of the data has been encrypted, then look for the corresponding encrypted data. Honestly, dont see any reason why there would be a stream cipher in there although who knows what ppl may program. (: More data is needed to tell you what it actually is or what is going on. -Sab
DakienDX
03-23-2002, 08:17 AM
Hello binh81 !

(After four computer crashes while trying to post in the last hour I hope this one works finally. :( )

First I noticed that there is no EncryptedArea passed to the call. This might mean that it is a stream cipher, since it is not so common in block ciphers. If the length is not a multiple of 08h or 10h, it is probably a stream cipher, unless it's a block cipher using CFB. You wrote Decrypt, but stream ciphers have only a Crypt, since encryption and decryption are the same.

The MD5 function looks a bit strange to me. I would guess it's some code like this
SerialHash = MD5(Serial)
@1:
SerialHash = MD5(SerialHash)
DecryptedArea[Counter] = DecryptedArea[Counter] XOR SerialHash[Counter And 0Fh]
Inc(Counter)
Dec(Length)
If (Length != 0) Goto @1
But if the DecryptedArea is not initialized and there is no EncryptedArea, I would say it's a normal MD5 function with all three functions (Init, Update, Final) in one, maybe modified.

I still have my cryptographic collection, but I don't know an algorithm working like this. I don't think a algorithm using a 32-bit password is considered as secure.
crUsAdEr
03-23-2002, 12:04 PM
HI guys, thanx for the response :>

Yeah i think it is block cipher as you all said, i thought it would be stream cipher as the length varies... but yep i found the loop, it takes block of 32-bits at a time and perform the decrypt routine...

Sorry Dakien for the being unclear, i would liek to clarify

mov eax, DecryptedArea ; this is where the data are stored,
original encrypted but decrypted
after the call ( hope this is clearer)
mov ecx, key ; taken from serial
mov edx, length
Call Decrypt

Alright, here are my finding so far
Call Decrypt :

Call1; Initialise (see later)
Call2;
Call3; This one has the whole MD5 sets of numbers
it also generate the STATIC key (see later)
Call4; Generate Initial Dynamic key (not sure how yet)
end; :>

Okie, here is Call1 :
mov dword ptr [ebx+48h], 67452301h
mov dword ptr [ebx+4Ch], 0EFCDAB89h
mov dword ptr [ebx+50h], 98BADCFEh
mov dword ptr [ebx+54h], 10325476h
mov dword ptr [ebx+58h], 0C3D2E1F0h
mov dword ptr [ebx+5Ch], 76543210h
mov dword ptr [ebx+60h], 0FEDCBA98h
mov dword ptr [ebx+64h], 89ABCDEFh
mov dword ptr [ebx+68h], 1234567h
mov dword ptr [ebx+6Ch], 3C2D1E0Fh
weird, it generates the table of "0123456789ABCDEF..." twice??

I have yet to figured out what Call2 and $ do escatly but they seem to do mainly copying blocks of memory around....

Then the deciphering process is as follow
STATIC key : 10 words long, does not change throughout the whole process

Dynamic key : 8 words long i am not sure how this is generated yet, but it changes...

It takes block of 8 words, xor with dynamic keys, store it as the new dynamic key for the next block (data still unchanged yet, only new dynamic key generated)... perform some encryption with STATIC key (here data is changed)... (am i working on the algo here but i presume it is symmetric??)... then finally the encrypted data is XOR with the original dynamic key and stored back into dataarea...

The process goes on until the whole data area is ciphered...

Yeah, this is all for now... any suggestion on what this cipher might be are welcome :>?? and attackign methods?

Dakien : yeah, i am just working on crypto in general and i do have pascal cource code for some of the stuff but i do need some asm source code for common crypto algo.. sicne you have it... if you dont mind i will drop u an email :>... thanx...

P.S : Dakien, the password length is unknown :>.. might be 32 bits but i think should be more.. can be anything!!!

P.P.S : sorry for the terminology, i might use the wrong term here and there!!
DakienDX
03-23-2002, 01:38 PM
Hello binh81 !

I thought the Mov ECX, key was the actual key, but now I know you meant Mov ECX, Offset key. Of course this key can have more than 32 bits.

From what you've described so far, I think it's a block cipher in CBC mode.

The problem with block ciphers is that a same input block produces the same output block. So if you've for example a cipher with 64-bit blocks and 100h times 00h (at the end of a section for example), you can see that the 20h blocks of 08h bytes each look the same. This can be used to bruteforce a key, since we've encrypted and decrypted data.

CBC works the following way to prevent this:
An IV (InitializingVector) is created. It is a random number as big as the block size (64-bit or 128-bit for example).
This vector is stored. (It is needed to decrypt the data later)
Take a block of the data and Xor it with the IV.
Encrypt this block.
Save this block and use it as new IV.Repeat steps 3. to 5. for each block.

The decryption works similar:
Take IV used for encryption.
Take a block of data.
Save this block as TempIV
Decrypt this block of data.
Xor this block with IV.
Use TempIV as new IV.Repeat steps 2. to 6. for each block.

If one block has errors, not only this block but also the following block will be decrypted wrong.

Now you only need to find out what encryption algorithm is used.
crUsAdEr
03-23-2002, 04:27 PM
Hi Dakien,

Thanx for the info... yeah it is definitely Chained Block Cipher, did search the net a bit of info on ways to attack this but could not find anything real useful...

Yeah, in the mean time i have located the following.. here is the encryption algo

STATIC key : 4 qwords : K1, K2, K3, K4
Input Data block : 2 qwords : D1, D2

Loop 16 times (decimal :>)
begin
x := D1 * 16 + K3
x := x XOR D1
y := D1 : 32 + K4
y := y XOR x
D2 := D2 - y
x := D2 * 16 + K1
x := x XOR D2
y := D2 : 32 + K2
y := y XOR x
D1 := D1 - y
end;

The dynamic key is generated in a similiar way from the static key so i will just need to find the dynamic key... However, i am just looking at the decrypting algo above and trying to reverse it to find the encrypting algo at the moment, bruteforcing 64 bits doesnt seem very fun....

What are the usual way of attacking CBC??

Dakien : so can I email you :>?? Dont worry, you can say no i finconvenient for you... i'll look around :>

thanx for the info guys,
crUsAdEr
03-23-2002, 06:20 PM
Hmm okie...

Think i have an idea on how to attack this :>... no hint yet please :>

Thanx....
DakienDX
03-23-2002, 07:19 PM
Hello binh81 !

OK, I don't give you a hint with attacking CBC, but I'll give you an other. ;)

The algorithm used is TEA, a very short encryption algorithm. It uses normally 32 rounds, but it works also with 16.

I think you don't mean the static key consists of QWords, but of DWords, the same for the input data.

The dynamic key you're talking about is probably the Delta used in TEA. Delta is (sqrt(5)-1)*2^31.

When encrypting, the Delta is added each round to a counter, when decryption it's subtracted each round from the counter. The counter has the InitValue 0 when encrypting and the InitValue Delta*Rounds when decrypting.

So in this example it should be E3779B90.

The MD5 function is used to hash the password, so that the key passed to the decryption has a length of 128 bit.

You haven't implemented the dynamic key in the pseudo-code you wrote, but you can find sources of TEA everywhere on the net and maybe here too. (SafeDisc+CodeLok)
crUsAdEr
03-23-2002, 10:09 PM
Hi Dakien...

Thanx for the info but i am pretty sure the static key is 4 Qwords.. double that size....

The dynamic key is 2 qwords or 4 dwords....

Shall try on it for a while first :>....

Thanx a lot ....

P.S : Yep.. it is TEA alright... hmm okie.. looks hard to break really... chained and uncrippled... ah well.. i'll see how...

Okie, Dakien... any hint are VERY welcome now :>...
DakienDX
03-23-2002, 11:04 PM
Hello binh81 !

If it uses really QWords, then it's probably a modified TEA version with a block size of 10h bytes instead of 08h. This could explain the 16 rounds instead of 32.

Then it would use (sqrt(5)-1)*2^63 as Delta. (9E3779B97F4A7C15h is case you're to lazy to calculate it ;) )

The block size is then 10h bytes and everything must be calculated with 64-bit registers (or 2x32-bit ;) ).

The MD5 table is generated twice because a 128bit hash value is not enough any more, 256bit must be used now (4 QWords) and the author doesn't know how to generate it. ;) So he hashes two times with two equal tables. ;)

So here's my suggestion: Read something about TEA and understand it. It can be easily transfered to a block size of 10h bytes. But remember, it's real cryptography. This makes it very hard to bruteforce it. :(

BTW., what are you trying to do? If I could check out the target too, I could give more specified answers. :)
crUsAdEr
03-23-2002, 11:32 PM
Hi Dakien,

Yeah.. the target is Advanced Archives Password Recovery 2.0...
unpacking was discussed earlier...

I have located the output format... know that certain places have to be 00 but don think it is gonna help much here...

Yeah and i am reading about TEA now... gonna be darn hard i think.. but ah well.. worth a try, i have learnt a lot since i started reversing this... :>

Thanx a lot...
mike
03-24-2002, 12:18 AM
TEA will be virtually impossible to break; however, the system in which it is used may not be. What is being decrypted?
crUsAdEr
03-24-2002, 08:37 AM
Hi Mike,

Its main purpose is to decrypt code i suspect but here is how it works, it decrypts a table of 9C size with the following format

Flag VA, Code to be decrypted offset, length (3 qwords)
(repeat D times)

Then it use the same routine above to decrypt each section of the code in similiar fashion...

That means that the first byte of each qword is always 00, also the length should not be too big so first dword of length should be also 0000... however this doesnt help much yet as i dont have the exact decrypted table... i am looking for encrypted area in the code to kind of guess the teh decrypted table but again, not sure if it helps at all cos we still need to bruteforce to find the key...

That is all for now
crUsAdEr
03-24-2002, 07:02 PM
Hi guys, can you help me identify if this is some known hashing?

It uses a different set of constant,
2895b588
173848AA
242070DB
3E423112
0A83F051
4787C62A

yeah , just to name a few.. a search on these numbers yields nothing.. it has 3 procedure, the first one initialise an array of 128 bits "0123456789ABCDEFFEDCBA9876543210" as usual... the result is 128 bits.... i thought it was MD5 but it doesnt seem so... if it is not some known algorithm then maybe i will try to break this... change of tactic :> (TEA seem really secured)

Dakien, have you looked at the program yet? Think i might just attempt to patch and put in some code myself... bruteforcing doesnt seem a feasible options... what a pity when i have had the whole algo laid out on the table.. ah well...

Thanx guys.. do post here if you guys find anythign interesting that would help :>...

Ciao,
DakienDX
03-24-2002, 07:38 PM
Hello binh81 !

The hash is MD5. Not a modified form, just a different form.
It takes every number bigger than 2^31 as negative, and therefore subtracts the positive value instead of adding the negative value.

You'll notice that NEG(2895B588h)=D76A4A78h. (The same goes for the other values you've given us)

The hash uses Sub EDI,2895B588 instead of Add EDI,D76A4A78. The only thing which has changed is the sign, not the result.

You can't break MD5 in mathematics, only by bruteforcing, which will take many years. The same goes for TEA.
Cryptography is no copy-protection, cryptography is nothing else than cryptography. And this means it can't be broken by IAT rebuilders, tracers or debuggers.
If you've encrypted data you can only decrypt it with the password, not with a patch.
LaptoniC
03-24-2002, 08:57 PM
I was working on AudioSphere(tut on tsehp's site) and coded one MD5 bruteforcer.Its MD5 function is well optimized for pentium cpus.If you knw some bytes from what it except maybe you can find.
You can download md5bruteforcer source code from
hxxp//mrstop.host.sk/files/md5brute.zip

My source code is very messy and it contains more than one MD5 mplementation to test their speed.Anyway hope it helps.
crUsAdEr
03-24-2002, 09:08 PM
Hi Dakien,

Hee.. think we have the greatest communication skill.. (ok enuff sarcasm) .. just kidding.... nah ah well.. just that i probably neva make efforts to make myself clear... I meant make patches to reinstall the program functionalities, not patching the TEA bits :>

Yep.. THANK YOU for your insight... I was probably too scared of MD5 reputation to poke aroudn with it... but i think i have decrypted everything.. the decrypted results looks fairly promising as it is almost identical with my conjectured resutls (aka : flag, offset, size).
i actually spent 1 hr going through IDA disassemly and locate the invalid code section :>

Cheers...
Shall test the decrypted program now... :>
crUsAdEr
03-25-2002, 12:20 AM
Thanx Laptonic, downloaded your source code and took a look at it, man you really should at least put some comments in there :>.. guess i am really a newbie at coding in asm... well i'll try to put the comment in myself :>...

Just wanna check with you how fast is this algorithm? can it really break MD5? (I thought it is unbreakable?) guess i will have to try Audio Sphere to figure this one out... i cant make sense of the text file as it is in some unknown language...

Dakien : yeah, thanx for pointing me to the right direction... i have got it all done now.. thanx for your prompt response, fly down to UK and i will buy u a beer :>... (or even TWO if you wish :>)

Regards,
LaptoniC
03-25-2002, 01:14 AM
I have added some comments to code and updated zip file.I am not good commenter but it is better than nothing :)
mike
03-26-2002, 02:09 AM
Hi Mike,

Its main purpose is to decrypt code i suspect but here is how it works, it decrypts a table of 9C size with the following format

Flag VA, Code to be decrypted offset, length (3 qwords)
(repeat D times)

Then it use the same routine above to decrypt each section of the code in similiar fashion...

That means that the first byte of each qword is always 00, also the length should not be too big so first dword of length should be also 0000... however this doesnt help much yet as i dont have the exact decrypted table... i am looking for encrypted area in the code to kind of guess the teh decrypted table but again, not sure if it helps at all cos we still need to bruteforce to find the key...

That is all for now

Lemme see if I've got this straight:

The program takes a password, MD5 hashes it to get a key, uses TEA to decrypt some code which is later executed. 'zat right?

Do you have a working password? If you do, then it's the same as unpacking, essentially.

If not, then there's probably a password check in there somewhere that you can use with a dictionary. What does the program do when you type in a wrong password?

MD5 is used sometimes on unix & linux I think, so there is probably md5 hashing built into the better cracking programs, but it won't help you much: if you knew the hash, you'd know the key to use! So I only mention it because you could get one w/ source and use that as a basis for coding your own attack. Laptonic's code works just as well for this, I bet.

The password check is either going to be some kind of checksum of the hash or it'll try to use that key to decrypt known plaintext. Follow the code to the pointe where it branches to pop up the error box & you'll have everything you need for a dictionary attack.

You can't bruteforce MD5, but if you know something about the passwords (like, are they single english words? a big honkin' serial string? what?) you might be able to brute force the space from which the passwords were selected.

Good luck. I'm glad the quality of the threads in this group has improved so much lately!

--mike
crUsAdEr
03-26-2002, 03:27 PM
***************************************
Lemme see if I've got this straight:

The program takes a password, MD5 hashes it to get a key, uses TEA to decrypt some code which is later executed. 'zat right?
****************************************

Yep :>

****************************************
Do you have a working password? If you do, then it's the same as unpacking, essentially.
****************************************
Erm no... :>.. i dont have any stolen credit card :>

****************************************
If not, then there's probably a password check in there somewhere that you can use with a dictionary. What does the program do when you type in a wrong password?
****************************************

The program crashed with a nice crashed log and a messagebox saying that i should automatically send a message to Elcomsoft :>...

*****************************************
Good luck. I'm glad the quality of the threads in this group has improved so much lately!
*****************************************

Thanx for your replay, albeit a bit late, as Dakien has pointed me to the right direction to find the TEA key hardcoded!!!!!... Hee, you will see more questions from me soon now that i am touching my hand on all this crypto stuff.... kinda exciting...

Regards,
mike
03-26-2002, 04:00 PM
Yeah, I kind of expected that. Most often, crypto is used for obscuring data in copy protection schemes, and doesn't actually depend on data that the user enters. So it's more like unpacking than anything else.

Would you be willing to tell how you figured out that the stuff was MD5 and TEA as a postscript to the "finding encryption code" essay I posted?
DakienDX
03-26-2002, 05:44 PM
Hello binh81 !

What a great use of cryptography. ;)

Ouput("Enter password");
Input(PW);
Hash=MD5(PW);
If (Hash = EC5C65FE1C9DCF80EABAA7516BCC79Ah) then
Decrypt(Offset Data, "HardCodedPW")
Else
Output("Wrong password");
I wouldn't call this cryptography. ;)
foxthree
03-26-2002, 07:42 PM
Hi DakienDX/binh81:

First off, I'm following this thread with avid interest. There is a lot of good posting here.

One small question here:

Isn't the method of serial check rather lame? 'cos I've to store the the correct hash values (for later comparison) for all possible "correct" serial nos. (I'm referring to this line here
"If (Hash = EC5C65FE1C9DCF80EABAA7516BCC79Ah) then")

Note that no two serial nos can hash to the same MD5 as MD5 byitself is collision-resistant.

How can this be a practically implementable approach?

Signed,
-- FoxThree

PS: BTW, If you were talking w.r.t. traditinal correct-password-decrypting-file-else-error kind of proggie, then just ignore my post ;)
mike
03-26-2002, 07:51 PM
Isn't the method of serial check rather lame?
Yes. The right way to do it is to take the hash, use it as a key, and decrypt some known plaintext. If you want it to be hard to break, use salt to prevent building dictionaries of hashes, and have the hash function repeat like 64000 times so it takes forever to brute force.

Of course, none of this prevents someone from getting a valid serial number, decrypting it, and patching the app. That's where stuff like checksumming comes in handy.

No two serial nos can hash to the same
If the serial numbers are long enough, then they can. Finding two that do, however, will take about 2^64 work!
DakienDX
03-26-2002, 08:13 PM
Hello foxthree !

It might be a bit difficult to detect, but EC5C65FE1C9DCF80EABAA7516BCC79Ah is the MD5 hash value of the string "HardCodedPW".
I wanted to use this example to show that even with strong cryptographic algorithms you can protect nothing if you don't know how to use them. ;)
crUsAdEr
03-26-2002, 08:19 PM
Hi Mike,

Well.... sure if you want me to write about it :>.... actually i only identified one MD5 algorithm... i worked out the rest of the crypto algo and our dear trustful Dakien just sat there, shakes his leg and tell me what algorithm was used :>....

As Dakien pointed out in his post, though it used cryptography, the method it ised is overly paranoid thus make it unsecure... However it was not that easy for me, as i was disturbed by the slightly different style of MD5 used in the first serial check, and when i compared the first MD5 hash of my second-half serial with the second MD5 hash of my second hash serial ( there are 3 MD5 hash, but forget about the middle hash which take the whole serials)... so i was not thinking that the first correct hash could be used to decrypt TEA... ah well... was really a worthwhile lesson...

Hi Dakien :>.... well not really cryptography make it interesting dont you think, i personnally believe in finding back door rather than bruteforcing, which is real cryptography :>... somehow i find it monotonous and unrewarding, the main objective becomes optimising ur bruteforcer :>... but yeah, i will try to figure out the serial format for this one and attempt a bruteforcer :>..

Thanx guys for the help, Mike, do tell me if u still want me to post my findings of the encryption algo, or u might want an input from Dakien instead since he might have a more developed approach...

Cheers,
mike
03-27-2002, 06:02 PM
Well, if you want to, go post on that thread. I'm just trying to create resources by having people contribute information as they get it.
crUsAdEr
03-27-2002, 10:20 PM
Ok, Mike...

Give me sometimes cos i am still working on the bruteforcer... when i am done i shall append my notes on this at the end of your thread..

Cheers,


how to copy bad mared floppy?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to copy bad mared floppy?
PDA

View Full Version : how to copy bad mared floppy?

nirali
03-23-2002, 11:08 AM
I have one software software came with key disk(floppy).
In floppy there is some bad mark. how to copy track to track.
Any softwere.

Nilrali
crUsAdEr
03-23-2002, 12:12 PM
Hi Nirali,

Erm.. i am not sure if this is the right place to ask about this, i think the people here will tell you to hexedit the file and patch the check for diskete :>...

If you need the software to do this, then check out zor's board...

Regards,


coupla questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > coupla questions
PDA

View Full Version : coupla questions

?ferret
03-25-2002, 03:06 AM
Just looking for a little info...

I have a file that uses wcmdpa26.dll....I can't find much info on the dll other than where to d/l it if I need it. Is this a runtime lib for Watcom C?

Now for an even dumber q.....say I know the controlID for a string and want to break when it gets overwritten....how can find the correct memory addy to break on based on the resource info given by exescope & w32dasm?

dunno if it's relevant, but I'm looking at WinIde by SoftTools if anyone cares to look. I haven't successfully cracked it yet, but I'm looking at about 6 different approaches. Runtime libs always cause me trouble though ;-)
?ferret
04-27-2002, 04:36 AM
I downloaded Language2000 and yes, it's WatcomC.

Now I just need to find more than 10 minutes to look at the target LOL.....I gotta winn the lotto so I have time for this crap again ;-)


Installshield Password Protected Self Extracting EXE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Installshield Password Protected Self Extracting EXE
PDA

View Full Version : Installshield Password Protected Self Extracting EXE

j_hallows
03-25-2002, 05:20 AM
I need a little help finding a password for Installshield Password Protected EXE. Any Hints on what to look for when tracing with softice. Thanks.
Solomon
03-25-2002, 06:06 AM
It may be unable to break this version of PackageForTheWeb

001B:004037E9 PUSH 00000404
001B:004037EE PUSH DWORD PTR [ESP+08]
001B:004037F2 CALL [USER32!GetDlgItem]
001B:004037F8 TEST EAX,EAX
001B:004037FA JZ 00403828
001B:004037FC PUSH 00000080
001B:00403801 PUSH DWORD PTR [00416178]
001B:00403807 PUSH EAX
001B:00403808 CALL [USER32!GetWindowTextA] <-----our breakpoint
001B:0040380E PUSH DWORD PTR [00416178]
001B:00403814 CALL 004038A7 <-----hash algorithm inside
001B:00403819 POP ECX
001B:0040381A XOR ECX,ECX
001B:0040381C CMP EAX,[00416118] <------good guy or bad guy
001B:00403822 SETZ CL
001B:00403825 MOV EAX,ECX
001B:00403827 RET
thewd
03-25-2002, 09:28 AM
included password recovery utility for packagefortheweb installations....

regards
thewd

[02 April 2002]
- uploaded new version (fixed a couple of issues)
Solomon
03-25-2002, 09:45 AM
hi thewd,

Your tool works perfectly!:D Nice work.

j_hallows, the installation still needs a serial:)
foxthree
03-25-2002, 10:51 AM
Time for ISDCC ;)

Signed,
-- FoxThree
Solomon
03-25-2002, 03:53 PM
Phase - II finished too:D
DakienDX
03-25-2002, 04:56 PM
Hello thewd !

Does your program work the way I know (http://www.woodmann.net/forum/showthread.php?threadid=2044) or is there an other way?

I noticed your program crashes on files I generated with PFTW 4.00, but 2.03 to 3.00 works fine. ;)
But files from InstallShield (which use probably 4.00 too) are still working.
j_hallows
03-25-2002, 05:31 PM
Originally posted by Solomon
hi thewd,

Your tool works perfectly!:D Nice work.

j_hallows, the installation still needs a serial:)

Ya I know but at least I am one step of the way. Not only a serial but CrypKey 5.6 Keygen.

It kind of funny but right after I posted the message I found a Util similar to the one thewd posted that gave the password for Installshield Package for the Web.

(See Attachment)

Thanks Solomon for the insight of where I was getting lost. I was trying to figure out how the password was being compared and didn't realize it was hash first then compared.

You don't know how much time I spent trying to understand figure out what is going on. BTW: Solomon what did you break on in Softice?
Solomon
03-26-2002, 02:30 AM
well I mean directly breaking/bruteforcing the hash algorithm to get a valid password. However I have not check it thoroughly:p DakienDX's stream cipher bruteforcing method is great:)

Phase II is quite simple. The 13-char serial is divided into 3 parts like XXXYYYYYZZZZZ.
XXX standands for product/license type.
ZZZZZ is calculated out from XXX and YYYYY by calling ispid._dllentryproc( ).
I wrote a keygen for it. Here is the partial source.

#define MAX_PRODUCT_TYPE 17

AnsiString TypeString[] =
{
"PPR",//Paradigm C++ PRO (x86 tool suites)
"PSS",//Paradigm C++ SuperTAP
"PSF",//Paradigm C++ for FS2
"PEF",//Paradigm C++ for FS2 (16/24-bit)
"PER",//Paradigm C++ for VAutomation
"PSR",//PSR(unknown)
"PRK",//Paradigm RTOS16 License
"PRS",//Paradigm RTOS16 License & Source
"PPK",//Paradigm RTOS32 License
"PPS",//Paradigm RTOS32 License & Source
"RTP",//Paradigm RTIP
"BTR",//Paradigm C++ (16-bit tool suite)
"BTE",//Paradigm C++ (24-bit tool suites)
"BTF",//Paradigm C++ PRO (x86 tool suites)
"PDF",//Paradigm Embedded File System

"PPM",//Paradigm C++ PRO with JTAG
"AMD" //Paradigm C++ - AMD Edition
};

long ProductCode[] =
{
0x8ead3f,
0x89cddf,
0x5f13cd,
0x62dbfe,
0x11e7e1,
0x0fe41e,
0x398a22,
0x6f51b5,
0x4b4c8d,
0x5a72bd,
0x29df9d,
0x4ca011,
0x72aad6,
0x5b4127,
0x5ec5af,

0x98967f,
0x98967f
};

//---------------------------------------------------------------------------
void __fastcall TForm1::GenerateKeyButtonClick(TObject *Sender)
{
if ((ListBox->ItemIndex < 0) || (ListBox->ItemIndex >= MAX_PRODUCT_TYPE))
{
Application->MessageBox("You must specify license type!", "Error", MB_ICONWARNING | MB_OK);
return;
}

long Temp = GetTickCount( ) % 100000L;
long Code = ProductCode[ListBox->ItemIndex];
long Final;

//ripped from ispid._dllentryproc( )
__asm
{
pushad

MOV ECX,0x3B9ACA00
MOV EAX,[Code]
IMUL DWORD PTR [Temp]
INC EAX
XOR EDX,EDX
DIV ECX
MOV ECX,EDX
MOV EAX,ECX
MOV ECX,0x00002710
CDQ
IDIV ECX
MOV EDX,EAX
MOV ECX,0x00002710
LEA EAX,[EAX*4+EDX]
SHL EAX,3
SUB EAX,EDX
SHL EAX,4
ADD EAX,EDX
SHL EAX,4
SUB EAX,EDX
CDQ
IDIV ECX
mov dword ptr[Final], eax

popad
}

AnsiString s;
s = s.sprintf("%05lu%05lu", Temp, Final);

SerialEdit->Text = TypeString[ListBox->ItemIndex] + s;
}
peterg70
03-26-2002, 09:02 AM
Originally posted by j_hallows

Ya I know but at least I am one step of the way. Not only a serial but CrypKey 5.6 Keygen.

Why do you need a crypkey 5.6 keygen when they give it away with their SDK pack.

the crypkey generator is able to select all the options and generate valid keys ( i have v 5.7 downloaded and ready)

Search for some previous crypkey discussions in the forum for more info

catch ya
peterg70
j_hallows
03-27-2002, 04:32 AM
Damn that was fast Solomon. Let's us newbies take a stab at it first. But anyways thanks for the keygen.

Peterg70 I don't quite get what you are saying. I know CRYPKEY SDK generates valid keys but you need the sitecode to do this first. Are you suggesting I patch the sdk to accept any site code? I did search previous messages but I don't see any that relates to my problem.
foxthree
03-27-2002, 09:23 AM
Hi Peter:

I believe the SDK is available only for registered users! If you did get hold of the 5.7 SDK from somewhere else, could u post the URL (if u don't mind)? I searched high and low in google and got only an 5.5 SDK from a very slow site.

Signed,
-- FoxThree
peterg70
03-27-2002, 10:10 AM
j_hallows said

I don't quite get what you are saying. I know CRYPKEY SDK generates valid keys but you need the sitecode to do this first. Are you suggesting I patch the sdk to accept any site code? I did search previous messages but I don't see any that relates to my problem.

May be i am missing something in what you said about a 5.6 keygen. I assumed that by saying "keygen" you meant something that generates a valid Authorisation code for the Match Site Code. (this is what the SDK keygen will do for you)

After a little patching the SDK is able to accept any sitecode and generate a valid authorisation code which can have any restrictions you wish. You are then able to use the CrapKey software to protect your own software if you want.

After reading the above statement perhaps your trying to determine how a sitecode is actually generated. This again is explained in the SDK and the method of decoding the SDK is fully coded in the keygen which is nicely structured for complete understanding. I.e. no tricks, no funny coding just a simple C++ proggie :-) . Also there is a nice tute on the Crapkey wrapper and how it protects the exe.

Then again I may have assumed wrong again. Maybe a few more words regarding what your doing. I have some interest in the Crapkey system. Just waiting for the next version.

foxthree:
Search with google and look for my lost friends hyubwoo or dasomcvg. They were my korean friends
foxthree
03-27-2002, 12:36 PM
Hi peterg:

Thanks for your pointer. Interestingly, I was dling the 5.5 from dascomvg's site only. I'm able to find 5.7 in hyubwoo site :D Now for some serious research ;)

Signed,
-- FoxThree
peterg70
03-30-2002, 12:24 AM
Foxthree:

Good luck in your tasks

If you need some help, pointers or further info let me know

peterg70
lammer
04-01-2002, 06:51 AM
Hi peterg:

Thanks for your pointer.
Solomon
04-12-2002, 03:45 AM
j_hallows,

why did you delete your posts in this thread? I can understand why you removed the software URL in you post.:)
j_hallows
04-12-2002, 06:36 AM
Originally posted by Solomon
j_hallows,

why did you delete your posts in this thread? I can understand why you removed the software URL in you post.:)

Huh? I guess the moderator deleted my posts. I don't know why though.
Solomon
06-27-2002, 04:37 AM
it's time for the authors to update the above 2 attached InstallShield password recovery tools. I got a exe with a long password. Both tools can't recover the password. They only give partial results. If you authors are interested, pls send me a private message for URL.


Visual Protect i need Help :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Visual Protect i need Help :)
PDA

View Full Version : Visual Protect i need Help :)

silverstorm
03-25-2002, 05:40 PM
hello, please i have problems to umpack this applicatiosn

http://www.visagesoft.com/downloads/vp.exe

its packet whit visual protect.. (the program its visual protect too :))

please i whant to learn how unpack this protection.. thanks.

SiLvEr StOrM
Solomon
03-26-2002, 03:19 AM
+SplAj made a license for it long time ago. Please search.:)
silverstorm
03-26-2002, 12:28 PM
thanks for answer.. frien.. but i want to know how unpack a application packed whit that program.. please can you teachme...

thanks..
crispeater
03-26-2002, 12:30 PM
which version of VP is it?
silverstorm
03-26-2002, 12:34 PM
version 3.1.6
crispeater
03-26-2002, 12:37 PM
It's been a long time since I looked at VP, so I'll take a look tonight and let ya know.

In the mean time do some searching for tutorials on older versions as they might give you a clue as to how to proceed
crUsAdEr
03-26-2002, 01:40 PM
Hi Silver Storm,

Where are you having problem with? It is fairly simple to unpack.. here are some hint

find IT table, bpm it
then bpx getprocaddress
watch the IAT deciphered, yeah interestingly, the IAT AsCII are ciphered :> (gosh, or am i reading gtoo much crypto :>?/)
after you exit the IAT updating loop, F12 once or twice then trace with F10, you will see soon enough a jump [ebp-4], or something liek that :>

Good luck...

Hmm, really obscure protector, i have yet to find any app protected with it yet... the license file doesnot seem a problem when i wrap my notepad...?? Do you know any app protected with it?
Solomon
03-26-2002, 02:55 PM
All the products from the same company of VP are protected with VP:)hyyp://www.visagesoft.com

Originally posted by binh81
Do you know any app protected with it? [/B]
DakienDX
03-26-2002, 05:35 PM
Hello binh81 !

If the license file doesn't seem to be a problem, try the applications from Visage.
Start with VisualProtect, then try Easy PDF. They will work fine. :)
But now try Windows Help Designer, both WinHelp and HTMLHelp edition. A wrong license file will say "Invalid License", a correct license file will crash the program. ;)
And I don't think they make nonworking copies of their software availbable for download.
crUsAdEr
03-26-2002, 08:25 PM
HI Dakien, solomon...

Just curious... the website is f****** slow... i have been downloading for an hour, 0.50kb/s???? nah but that is beside the point...

Correct me if i am wrong, but it seems that this protection is useless as a general protection as if we use VP to wrap another exe file, not developed by Visage, then once unwrapped, the license file and VP.dll aint gonna matter anymore? They only matter for Visage product itself because these features are integrated into the exe...

Maybe this why it is not used by any other software developing company? :>

Cheers, i will post here again should i encounter any difficulties... man, 1:5:49 more... this company CAN NOT MAKE IT... even slower than M$ website...
DakienDX
03-26-2002, 08:53 PM
Hello binh81 !

You're right, but this happens not only with Visual Protect, but with any protector using just a wrapper and no callback functions the program could call or environment variables which could be checked.

I don't think they've implemented anything special in their help designer programs, but when I've tried to generate a license for them, they crashed.
I tried all options available, but I couldn't get them to accept my registered license file. They accepted my license file with a 500 day trial with no problems, but crashed when trying to use my registered license file.

I had no problem with registering Visual Protect itself and Easy PDF.
crUsAdEr
03-26-2002, 09:07 PM
Hee Dakien...

You are too fast for me... i am still figuring out how to generate the license file... i have been living with patchign alone... cos i was hoping that it will be more generic to remove the need for license file and VP.dll altogether....
foxthree
03-27-2002, 07:13 PM
Hi binh/Dakien:

Okay, glad to join the party of VisualProtect :).

Yes, binh81, this one is doing the decryption via VP.DLL. Somewhere in the code woods it loads the VP.DLL and GetProcAddresses the exports 1, 2, 3, 5 and then checks for valid address values. I also managed to find the OEiP (just by tracing manually this time ;)).

Found the "magic bytes" - FF,65,FC JMP [EBP-4] :) 00*92304

But what baffles me is that when I run the the dumped file, it gives me "License File Error. Could not locate license file, please reinstall the software" (whereas the .vpl file is very much present)

So, I debugged ... ;)

I found that the VP.DLL is being called and there are a lot of code snippets that do this:

CMP EAX, [EDX]
JZ/JNZ etc

I bypassed all this successfully and reach the point where the original app puts the Nag box. Ofcourse, we wouldn't have it in the unpacked proggie right? So i bypassed this and noted that on clicking Try in the original app, it puts EAX = 1 in the original app. So I patched this place to

MOV EAX, 1

But when I run this, VP crashes on me :mad:

Any tips/pointers on how you guys avoided the license not found dialog and other tricks? Just tips will do

Signed,
-- FoxThree

PS: I don't find the IAT redirected or encrypted. Do we need to run RV on this. I don't think so but just in case :(
crUsAdEr
03-27-2002, 10:15 PM
Hi Fox3,

welcome on board, have not much time and inspiration to look into this yet, but well..

IAT ASCII was encrypted.... decrypted in memory and loaded, revirgin wont work... the redirected scheme is simple
mov eax, xxxxxxxx
jmp eax

Yet revirgin fails to trace... think Tsehp not working on this cos VP isnt a popular protector....

Regarding license file, i have yet to manage to make a full license like SplAj said in his post last year, was Feb 2001 :>.... dig out the forum archives :>... yeah i patched as you said, and continue patching :>.. i trace witht he orginal exe and my dumped exe, find the different jumps and patched accordingly, think i made 3 or 4 patches for it to work.. not very neat though... (hint : dump VP.dll and use IDA, you will see a lot clearer... with lots of nitty check made in VP.dll)

I tried unpack VP.dll itself but somehow unsuccessful... dont know why... maybe someone can shed some light???

Regards,

P.S : fox3, do check your IT cos i am pretty sure that IAT ASCII are encrypted.... have fun
+SplAj
03-28-2002, 09:02 AM
VP, licence & unpacking

Ok, I found the target from my archive. I 'did' v 3.1.5 . First of the licence scheme is easy to fool. My RCE licence trick still works. :)

Unpacking was a bit trickier. I remember that KERNEL32 API calls were decrytped to a lookup table. RV did not manage to trace them.......but now with 'plugins' ;)

Ok, I dumped the exe at oeip, dumped the best part of IAT with 'save resolved'. Then dumped the whole KERNEL32 API calls from memory to disk and used UltraEdit to get them in a usable linear format , Pasted this into RV resolved.txt output , reloaded RV and target, loaded rv resolved.txt , Resolve again and rebuilt complete IAT.

It was a coupla hours to do that. :(

Hope that helps.

Spl/\j
foxthree
03-28-2002, 09:12 AM
Hi +SplAj guru:

Welcome back. Hope you're feeling fine. As usual, your "succint" remarks on unpacking VP :D

Glad to have your post on the VP problem. Give me confidence you know ;)

Okey, Lots of Copy+Paste work looming ahead of me :D

Hang around, man...

Signed,
-- FoxThree
+SplAj
03-28-2002, 09:23 AM
ppl

......don't do it the hard way.....it takes a few hours not 10 mins as i erm originally boasted :( ...and the target is crap anyway. I see the v3.1.6 is still there from October last year so they did not learn from us !

The best/future proof way is to 'auto' resolve that api lookuptable....HOW !...well SpeKKel has discussed using a plugin for RV......it makes sense. This is what plugins are for :)

Spl/\j
crUsAdEr
03-28-2002, 10:20 AM
Hi SplAj, Fox3,

Hopefully this helps you save a couple of hours :>... this is not exactly how i did it but an improve idea..

sicne the redirected scheme is like
B8xxxxxx mov eax, xxxxxxxx
FFE0 jmp eax

this is repeated a few times until finally eax points to the correct API address...

SO here is the idea, at jmp [ebp-4], before the OEP do
a eip
mov ebx, IATstart_offset
(1) cmp ebx, IATend_offset + 4
je itself ; eb fe
mov eax, [ebx]
test eax, eax
je (3)
cmp eax, 70000000 ;is IAT redirected
jge (3)
(2) mov eax, [eax+1]
cmp eax, 70000000 ; is original IAT found
jl (2)
mov [ebx], eax ; update IAT
(3) add ebx, 4
jmp (1)

I cant remeber my code exactly, but the idea is there... now after a few millisecond Revirgin should do the job :>

Cheers,

P.S : hey what happenned to my indentation ??? ah well... i spent sometimes indeting the code to make it look neat but.. sorry not my fault :>....
crUsAdEr
03-28-2002, 10:24 AM
Hey SplAj,

Hmm, so where is that plug-in for RV? or is this underdevelopment?
Solomon
03-28-2002, 10:26 AM
hi binh81,

u have to use VBB CODE to keep the indent:)
+SplAj
03-28-2002, 11:25 AM
you guys kill me.....

i luv this place...gimme gimme gimme

this shitty protection has been hangin around unused for months and now we need the plugin this afternoon !

hahaha.....necessity is the mother of all inventions :)

I cannot steal the thunder of my friend SpeKKel. He did a lot of work on this plugin and I leave it to him to make the world bow down at his feet and say 'oh master, please let us destroy this visual protection......... give us yer plugin mate'

BTW heer is rebuilt (Win98SE) IAT from VP 3.1.5 for examination...
I think it is the right one ????

CYA

Spl/\j
SpeKKeL
03-29-2002, 03:59 PM
Hhahaha who said he was sad ???lol

Well about the plugin:

I just took an original plugin, made some litlle modifications, and
yes it worked,,,,,, BUt only used it on vp.exe and don't know it will
work on other targets (you have to try )
H'mm no credits to me but all to the auther who made the original source...:rolleyes:
So try and tell me if it works.
BTW on w98 the plugin(s) aren't working on R.V; you have to try it
with imprec.
Still one or two api's aren't resolved but here you've to trace
yourself..

Happy Eastern,

Spekk
foxthree
03-30-2002, 08:36 PM
Hi +SplAj/SpeKKel/binh81:

+SplAj: Guess what, the IAT hasn't even been "touched" between the version you unpacked and the current one I did. It is "ditto" :D

SpeKKel: Thanks for the great plugin. It rocks!!! However around 30 APIs had to resolve manually as you said. Nevertheless we can defeat VP in 1/2 the time +SplAj guru took (No offense to you +SplAj guru ;) ). Awesome !!! (Psst. mind sharing the source ...)

binh81: Yet another commerical protector defeated, my friend.

Good work guys and most of all, thanks a lot for giving a heads up on this one.

Eventhough, this was quite a "dead target", it still has a couple of significant trick for newbies.

See ya all until the next packer :cool:

Signed,
-- FoxThree

PS: I must try to unpack GenerateLicense.exe ... Yawn ! :D
clxia
05-09-2002, 07:44 AM
Originally posted by crUsAdEr
Hi Silver Storm,

Hmm, really obscure protector, i have yet to find any app protected with it yet... the license file doesnot seem a problem when i wrap my notepad...?? Do you know any app protected with it?

h*tp://www.doculex.com/

Another instances. All softwares are protected by the Visual Protected v3.?.?.
Hwoarang
05-09-2002, 11:50 AM
or just use unpacker...try google:
"de-visual protect 3.1.6"


How to debug a Windows service program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to debug a Windows service program
PDA

View Full Version : How to debug a Windows service program

BjT
03-26-2002, 03:22 AM
Anyone can give me some hints about how to debug
a windows service program.
I can't set breakpoint on it.:confused:

thx very much.
foxthree
03-26-2002, 08:00 AM
Hi there:

This can be ranging from difficult to outright tough... depending on the kinda stuff you do within ur service.

Okey, my fav. way is to use OutputDebugString and DbgView (sysinternals) to see what happens when my service is executing. This can be quite a powerful debugging method.

Let me know if this helps.

Signed,
-- FoxThree
Solomon
03-26-2002, 11:03 AM
what do you mean by "can't set BP"?:cool:

You can use the "attach to process" feature of your debuggers such as VC++/BCB. it works well. Sure SoftICE also works.:D
BjT
03-28-2002, 06:54 AM
I have successfully set bp on it through other way. :D

First set bp on loadlibrarya. Then start service. It will
stop at bp. Now I can set bp any where in the service program.

Thanks for u help.

But I still don't know how to attach to a process
in SoftICE.:confused:
Solomon
03-28-2002, 07:43 AM
sorry I have not express it clearly. SoftICE is kernel mode debugger, it can't attach to a process. The debuggers of VC++ & C++ Builder can be attached to a process and debug it.


What use is selfmodifying code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What use is selfmodifying code
PDA

View Full Version : What use is selfmodifying code

glx2k
03-26-2002, 09:10 AM
Hi
I have been reading a bit about selfmodifying code (I know how to code it), but I can't see what good selfmodifying code is ?
How can it be used to make a crack more difficult.

Under Win32 you would have to call the VirtualProtect API function at some point, and that will make it pretty obvious where you intend to do some modifying.

And yes if you wonder I'm a software programmer, the enemy if you will :D
naides
03-26-2002, 10:03 AM
Glx2k:

When you as a protectionist introduce one or several strategies, like sel-modif code, packing etc, you are increasing the time and effort necessary to crack your application and reducing the range of would-be crackers that have the expertise to attack and solve your protection. In other words, you are buying time. But, sooner or later, if a CPU can run your code, a reverse engineer will successfully crack it.

Self modifying code(SMC) provides a stretch of code that is not obvious in "dead listing" disassembly of the app, making the analysis of the program somewhat more complicated. If the SMC is copied or decoded into memory during limited intervals, it can be difficult to detect, isolate and modify its code during live tracing of the program.

As you rightly point, SMC has some weaknesses that make its implementation conspicuous to an experienced cracker and can be exploited to locate and neutralize it.
Clandestiny
03-26-2002, 03:40 PM
Originally posted by glx2k
Under Win32 you would have to call the VirtualProtect API function at some point, and that will make it pretty obvious where you intend to do some modifying.

Yeah, if you were coding the SMC in C, you would have to use the Virtual Protect API... But this is not true in assembly. In ASM, coding simple self-modifying code is as easy as moving raw hex opcodes into the contents of a specified offset in your code section.

A *simple* example:

mov edi,offset smc2 ;address of code we want to replace
mov [edi],dword ptr 04E8C166h ;replace code
smc2: cmp ax,03330h
xor ebx,ebx
mov esi, offset serial
.
.

Here we replace a 4 byte instruction cmp ax,03330h with another 4 byte instruction shr al,04

I found hand coding more than a small number of SMC lines to be very tedious and difficult. Some commerical protectors / encryptors have "polymorphic engines" that generate SMC. An intriguing topic, IMO that I've always wanted to investigate further.

Anyway, you might want to check out the discussion on SMC in ASM that Kayaker and I had on the Mini Project Forum a while back.

http://www.woodmann.net/forum/showthread.php?s=&threadid=156&perpage=15&highlight=SMC&pagenumber=2

Cheers,
Clandestiny
ancev
03-26-2002, 04:14 PM
glx2k,

get a program that use a polymorphic loop to decrypt its real code, and you will see the advantages of self-modifiyng code.

instruction patching and PIQ trick can be very annoying to reverse.

ancev
DakienDX
03-26-2002, 05:15 PM
Hello ancev !

Polymorphic code and self-modifying code are two completely different things.

Polymorphic means that the code looks always different and it's really hard to guess what the code does, because there is very much junk code between the important instructions. But this code never get never modified in memory.

Self-modifying means that that the code gets modified in memory during runtime. This leads to prefetch problems on CPUs up to 486 and causes massive pipeline stalls on all CPUs from Pentium upwards. The first means that the code will run different on different CPUs and the second slows down the execution time, since the CPU needs to fill the prefetch queue again each time. This only applies if you're modifying code in the range of the prefetch queue. Of course you need write access to the code segment as some people already said.
ancev
03-26-2002, 06:50 PM
dakiendx,

your vision of polymorphism is limited.

i found a url that show a virus using this technic, to illustrate. i know that there's antidebug tricks using this, used in several tools, since the DOS days.

http://www.avp.ch/avpve/file/d/darkpara.stm

the non-poly implementation where called 'running line' or something, dunno exactly.

ancev

ps: i have a good experience with poly engines ;)
DakienDX
03-26-2002, 08:38 PM
Hello ancev !

Yes, I know what the "running line" is. It was a method which executed an INT 01 after each command (via trap flag) to encrypt the last instruction and to decrypt the next instruction (or similar), to make code analysis nearly impossible, since only one instruction was present decrypted at a time. And you couldn't trace this code so easy with a debugger. ;)

A polymorphic engine was used is viruses, to prevent anti-virus programs from detecting viruses simply by scanning for their signatures. It was used to write random decryptors, which produce different code every time, so there was no hardcoded signature. Better polymorphic engines could execute INT 01 and INT 03, but they did not use them for themselves, only for confusing debuggers.

The self-modifying code was maybe used when the polymorphic layer had decrypted the code, but this was an other layer, not polymorphic any more.

Great! The whole last three paragraphs I wrote are nearly the same on the page you link points to. :(

OK, then there was one virus in DOS days which used a polymorphic "running line". But DOS is nearly dead and I'm sure Windows wouldn't like it if some virus/protector is tracing through it's kernel code just for fun. ;)
glx2k
03-27-2002, 01:38 PM
Originally posted by Clandestiny

Yeah, if you were coding the SMC in C, you would have to use the Virtual Protect API... But this is not true in assembly.

I don't think you are allowed to write directly to the memory of my process under NT. I tried something similar and got an access error.
Correct me if I'm wrong.
pReJkEr
03-27-2002, 04:03 PM
i think you must change your section's attributes to write if you want to write something to it


WinZip cipher
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > WinZip cipher
PDA

View Full Version : WinZip cipher

naides
03-26-2002, 10:15 AM
This message is mostly for mike:
I post it in the public forum because it may be of interest to others in here.

In one of the papers you posted in your web site you talk about strategies to decipher protected zip files with very few known plain-text bytes. From the text I am led to believe that you implemeted the code for the algo.

Is that code available or did you write a more detailed description of the code?

I tried to implement it myself based and your paper, but, not surprisingly, I have not been very successful.

Thanks
mike
03-26-2002, 03:27 PM
Well, technically the code belongs to AccessData, but the algorithm has been implemented by at least two other competitors, ElcomSoft and LostPassword. If you just want to break a file, I suggest using one of the three tools; if you're more interested in the algorithm, I'd be happy to answer any questions you have about the paper and/or coding issues. I don't think I'm allowed to just hand over my code, though.

By the way, the stuff I've got is the crufty development code, the "first draft" if you will. It works, but it's not at all pretty.

I am planning on writing a much less "academic" paper for tsehp's site that's targeted more toward the cracker audience, but I'm not making any promises about when I'll get it out.

--mike
mike
03-26-2002, 03:53 PM
You know, now that I think about it, doing an interactive discussion here might be better in some ways, because people can ask about points where I'm not clear. Perhaps then it would be easier for me (or someone else that implements it from this discussion) to write the tut.

So here goes:

First off, you NEED to read appnote.txt. Find an HTML version here:

h**p://www.pkware.com/support/appnote.html

Get really familiar with the Local File Header and Decryption sections. Decrypt a few small files by hand for which you know the password.

In the paper, I make some assumptions about the way the archive was created. The specification allows each archived file to have its own password; it also allows archived files to be deleted from the archive leaving the rest in place. But I assume that all the files were added at once to the archive using the same password and that none have been deleted. Also, I assume that there are at least five files. I'll show why all that's important a little later.

The important things to notice in the LFH are the encryption flag and the CRC. The encryption flag lets you know whether this particular archived file is encrypted, while the CRC is used in the password check. We won't use it in the attack, but it's a sanity check to make sure we did it all right after the attack is over.

When a file is encrypted in WinZip, the first 10 bytes of "file data" are generated by rand(). rand is a truncated linear congruential generator. A TLCG has a static seed value, i.e.

static int32 seed;

At each call to rand, seed is updated to be

seed = (M*seed+B) & 0x7FFFFFFF;

Then the top 16 bits are returned.

return (seed >> 16);

WinZip throws away the bottom seven bits:

rand() >> 7 == seed>>23

The first part of the attack tries to determine what the seed value is. It turns out that the first byte of each encryption header is direct ouput from rand(). I'll explain why later.

WinZip only initializes the seed once per session, so we assume that after generating ten bytes for the first encrypted file, it goes on to generate ten bytes without updating the seed for the second encrypted file, and so on. We take the first byte of five encryption headers and assume they all come from the same seed.

So we start trying every possible seed and check every ten outputs, starting with the first, to see if it gives the right bytes.

Let me know if you get this part working, and we'll go on from there.
mike
03-28-2002, 11:50 PM
Once you have the seed, then you can generate all the "random" bytes that get encrypted.

Now we need to look more closely at the encryption.

I wrote in the last part that the first ten bytes of "file data" plaintext are generated by rand; this isn't exactly true. They're generated by rand and then encrypted using the password. Then the low word of the CRC is added to the end as password check bytes. This makes 12 bytes total. You'll notice that the difference in size between an encrypted file and a plaintext file is always tewlve bytes.

Zip encryption works by beginning in an initial state, generating a byte, updating the state with the plaintext character, and XORing the plaintext with the ouptut byte to produce a cyphertext byte.

Some pseudocode:

struct Zipcontext c;

initstate(&c);

for n=0 to len-1
b = genbyte(c);
ciphertext[n] = plaintext[n] XOR b;
updatestate(&c, plaintext[n]);
end

The way this cipher uses passwords is by encrypting them first and throwing away the corresponding ciphertext; that way the password mixes up the state in a deterministic way.

So the process goes like this:

1 initstate
2 encrypt password; throw away ciphertext
3 encrypt 10-byte output from rand
4 attach low two bytes of CRC to the end
5 attach compressed file
6 initstate
7 encrypt password; throw away ciphertext
8 encrypt 10-byte ciphertext again
9 encrypt two-byte CRC
10 encrypt compressed file

If you look at steps 8, 9, and 10 you see why the encrypted file is 12 bytes bigger.

But look at steps 1, 2, 3 and 6, 7, 8. The output of rand is encrypted twice using the same key!

Since A XOR B XOR B == A, the first byte of output gets decrypted. The rest of the bytes don't, since the cipher gets updated with the stuff it's encrypting. The second time around, it got updated with the once-encrypted output.

Next time: more about the encryption and the beginnings of the second part of the attack.
Kilby
03-29-2002, 05:56 PM
May I ask a question as the only real crypto stuff I have done is learning to decrypt older cyphers such as playfair etc (by han.

I tend to spend my time in the PE file structure insetad.

Could the fact that files found in zip files usually have a predictable header of some sort be used to speed up the brute forcing of the password ?

Kilby...
mike
03-30-2002, 09:36 PM
Could the fact that files found in zip files usually have a predictable header of some sort be used to speed up the brute forcing of the password ?

Kilby...
Only if they're stored. The compression mangles them otherwise. Huffman coding translates common bytes to short bit strings and uncommon ones to longer bit strings. In PKZip, it applies to the first 32K of the file. (I'm oversimplifying here, but the point still holds.) So unless you know the first 32K, predicting the starting bytes is very hard.

If they're stored, of course, you can decrypt the 12 "random" bytes, check the crc, and then check the header bytes you know. If you have enough of them (11 or 12) you can use the kocher-biham attack.
Snatch
03-31-2002, 09:08 AM
Ah thanks for that Kilby and Mike. You just answered a question that has been on my mind for quite sometime. Considering almost all executables now have the same stub for the first hundred bytes then the PE\0\0. Why not use that informatino to your advantage when breaking zip =]. Guess that explains why you cant.

Snatch
Kilby
04-01-2002, 12:31 PM
Hmmm, this sounds like a good time for me to go back to homophones (nope it dosn't involve sex), and playfair cypers and their old fashoned friends.

Thanks for the explination (even if it would have been obvious if I had actually thought about it)

Kilby...
mike
04-02-2002, 04:27 PM
If it's an executable that's archived, chances are you can find another copy of that exe on the web. Then you compress it using the same zipper and compression setting to get the compressed plaintext for use in the biham-kocher attack.

If people aren't implementing this or having questions or anything, then I'm not going to spend time on it right now. Post to this thread when you'd like me to pick it up again.

If you'd like a walk thru of the biham-kocher attack, I can do that, too.
naides
04-04-2002, 12:37 AM
Hi Mike. The thread IS interesting and, at least I am following it.
For my particular cipher problem, though I need to implement the kocher-biham attack in a modified form.

Let me explain my specific problem so you can tell me if it is feasible:

I have a series of ZIP files. Each one contains a RAR file in a huge series of 7 RAR from .RAR to .R05.

Only the first ZIP is password protected, but contains the first RAR, which is necessary to unRAR the rest of the files.

If I look at the plaintext of the other RAR files, which are ZIPed but not protected, the first 50 bytes of the sequence are not perfectly conserved.

However there is a stretch of ~20 bytes that is present in the same position in each of the other RAR files, and I can more of less safely assume is present in the plain text of the ZIP protected file. Those bytes contain info about the names of the files in the RAR directory.

The comercial applications available on the web do not crack the password.
I think my best chance is to manually implement a kocher-biham attack using the 20 known plain text bytes and the correspondent 20 cipher bytes, until I learn the internal state of the keys up to that point. then work backwards and forward to decypher the rest of the file, which should produce a viable RAR file.

Several people in this board may guess which files I am talking about.
An alternative approach would be to ask CrackZ for the password to the files, but that would spoil half the fun.

Crypto is not my strong point, that is why I asked you for help.
crUsAdEr
04-04-2002, 01:43 AM
Hi naides,

What do u mean by the commercial protection do not crack password? I thought Advanced Zip password Recovery or something liek that do this kind of thing? crack winzip password :>??

Cheers,

P.S : sorry for the off topic question, but i am just curious over the fact you stated...
naides
04-04-2002, 09:32 AM
Binh81

I tried several commercial Zip password crackers and they just did not work.
Notice that those apps require at least 12 bytes of known plain text, but I I think they pretend the partial known plain text was located at the begining of the cipher text. I cannot guess the first 50 bytes of the plain text, only the next 20 bytes.
jsteed
04-04-2002, 03:00 PM
naides,
Try this. Use the plaintext attack in AZPR. The first file is the encrypted one and the plaintext file is the next one. Use data offset 6, size of plaintext 18. This should generate the 3 keys in a few hours.
jsteed
DakienDX
04-04-2002, 03:08 PM
Hello naides !

I've two ideas which might help you with your problem. :)
Take a look at the TECHNOTE.TXT included with RAR. It will describe the RAR structure very well. There are many static bytes in the header, you can calculate even 12 bytes if you need them.
The program AZPR has an option where you can enter up to four plain text bytes if the file was archived with no compression. And since I don't really think a ZIP program can compress RAR data, the RAR is probably only stored in the ZIP and the first four bytes are "Rar!"I hope this helps you.
mike
04-04-2002, 03:22 PM
When you say "plaintext", do you mean compressed plaintext or uncompressed plaintext? Or are they stored? (DakienDX--often Zip can compress even very random-looking files by a few bytes. I hope in this case it couldn't.)

If it's compressed and you know 12 bytes of compressed data or if it's stored and you know 12 bytes of stored data then you can break it, no matter what the offset. You just need to tell AZPR the offset and tell it what bytes to expect.
naides
04-04-2002, 05:00 PM
[i]

Take a look at the TECHNOTE.TXT included with RAR. It will describe the RAR structure very well. There are many static bytes in the header, you can calculate even 12 bytes if you need them.

Tried that. The RAR static bytes are not contiguous. Interspaced with them are dwords containing CRC checks of the stored stream, which are unique to each RAR file structure.

[i]
The program AZPR has an option where you can enter up to four plain text bytes if the file was archived with no compression. And since I don't really think a ZIP program can compress RAR data, the RAR is probably only stored in the ZIP and the first four bytes are "Rar!"I hope this helps you. [/B]

Tried that, did not work
DakienDX
04-04-2002, 05:54 PM
Hello naides !

If you've a multi-volume RAR file, the first 20 bytes in each RAR are (at least should be) the same.
Since you said that only one file is password protected and the others are not, take the first twenty bytes from them as plaintext.

What files are you talking about? You said you could ask CrackZ for the password. Perhaps I've the files too and can help you with them, even if I might know the password. ;)
naides
04-04-2002, 08:41 PM
I did put the first 20 bytes of the other RAR files as plain text but the AZPR did not find the keys based on it. That is when I took a closer look at the plain text of the other RAR files after being compressed by ZIP (by the way, ZIP does compress them a little bit) and found some conserved bytes and some mutant bytes. ( I am referring to computer files as DNA sequences, because the resemblance is more than superficial).

I have AZPR version 3.52, which I think is the last version available. Mike suggests

" You just need to tell AZPR the offset and tell it what bytes to expect"

The problem is I have not found an option in the program which allows me to instruct AZPR to do just that.

The files in question are the SentinelLM 7.2 SDK published by Crack Z a few months back. He had reasons to restrict its access and password protected the first RAR.

It is not that I will die if I don't get those files, I am more for the challenge of it
mike
04-04-2002, 08:49 PM
I've never actually used AZPR. I've always used Conrad's implementation:

http://www.unix-ag.uni-kl.de/~conrad/krypto/pkcrack.html

Full source to make it do whatever you want. The original b-k paper is included.
DakienDX
04-04-2002, 08:58 PM
Hello naides !

I've the files (and the password ;) ), but I'll give it a try.
I'm using the plaintext attack with 20 bytes of known data (first 20 bytes of .R00)
It says it will take 6 hours with background priority. So I'll see what has come out in a few hours. (or a few more, I'll need some sleep ;) )

"You just need to tell AZPR the offset and tell it what bytes to expect" - You can select this option if you coose a binary plain-text file and AZPR asks you if you just want to use a part of the file as plain-text. Then you can enter at which offset to start and how much data to use.
DakienDX
04-05-2002, 06:34 AM
Hello naides !

4h 38m 16s - No Password Found

I'm going to look what plain-text is really encrypted, maybe the data was somehow compressed and I used the wrong plaintext for the attack. :(
naides
04-05-2002, 02:28 PM
Yup, I have had the same problem over and over again.
I wrote to CrackZ some time ago and asked if he had done any thing special to the files previewing this seemingly simple attack and he told me he did not.

The plain text in all not encrypted RAR files from R00 to R05 is conserved, either you look at the unpacked RAR files or the ZIP files, so I found it unlikely that there was anything unique to the encrypted RAR file.

However, I think I may have a clue what is going on: AZPR indeed finds the 3 keys, but when it makes some comparisons with CRCs or other goodies containded in the R00 plain texts, things do not add up and it just simply toss them and report that no keys were found. That is why, I think, if I had a biham-kocher implementation I could have more control over the attack. BUT I AM USUALLY WRONG.
AirW0lf
04-05-2002, 02:30 PM
Ok... here is my contribution to this thread. Ive added 5 files to 2 zips. One with a 4 letter pass, and the other with no pass. Ive added 3 .txt files, one .exe and one .htm

wnopass.zip 34.447 bytes
wpass.zip 34.507 bytes

Now using WinHex I had a look at LFH. It is at least 30 bytes.

wnopass.zip
504B0304 1400 0200 0800 E78C 7427 56191BD2 FC020000 000A0000 0700 0000

wpass.zip
504B0304 1400 0300 0800 E78C 7427 56191BD2 08030000 000A0000 0700 0000

There are 2 differences between the files. The general purpose bit flag (GPBF) and the compressed size. The compressed size is explained in the decryption section of APPNOTE.TXT
Each encrypted file has an extra 12 bytes stored at the start of the data area defining the encryption header for that file.
So, 5*12=60 and 507-447=60 :)

Then I had a look at GPBF. Converting the values to binaries we have 00000010 (2), 00000011 (3). Bit 0 is the one on the right.

Bit 0: If set, indicates that the file is encrypted. cool =]

Another important info is the CRC, D21B1956

DECRYPT...

Each encrypted file has an extra 12 bytes stored at the start of the data area

I guessed the data area was just after the name of the file. As the bytes changed from wpass to wnopass... So I copied the 12 first bytes.

win.exe
FB2C0BC08E09ACBBB25BA643
t138.txt
82B60700981FB93565B8E3D4
t141.txt
BEC82314CC928320A1665624
winzip crack.txt
BE8B41ED52EA1987B4CF2A04
PKZIP Application Note.htm
80A085ACC314EE770660C61D

So we start trying every possible seed and check every ten outputs, starting with the first, to see if it gives the right bytes.

And how we do that? We must code a bruteforce using this code?

unsigned long seed;

void srand( unsigned long s ) { seed = s; }

unsigned short rand()

{
seed = 0x343FD * seed + 0x269EC3;

return ( seed >> 23 );
}

btw Ive added both files so everyone can check it out =]
mike
04-05-2002, 05:10 PM
Hi AirWolf! Thx for posting.

WinZip throws away the low seven bits of the 16-bit output of rand. The first ten bytes in each 12-byte encryption header are the high-order bits of rand output encrypted twice under the same password.

And how we do that? We must code a bruteforce using this code?

Yes.

There's a few tricks you can use to make it go faster:

1. When the first password-protected file is added to the archive, it calls srand(time(NULL) ^ getpid()). Knowing what year it was created restricts your search a lot.

2. Each byte of rand's output reveals some bits of the internal state, so you can use (say) the first output byte to restrict your search, too.

3. Since the generator is linear, we can find new constants to use that automatically skip ten bytes, so there's only one function call, multiply, and add instead of ten.

Brute forcing 31 bits, though, will only take a few minutes.
DakienDX
04-05-2002, 05:15 PM
Hello naides !

With 60kb of plain-text the attack takes only 1 minute. ;)
AZPR can't find the password, but it shows the keys and decrypts the ZIP file.

Here are the first 256 bytes of plain-text. Using them it should take about 15 minutes to decrypt the file. ;)

8Ch, BCh, 65h, 50h, 9Dh, 3Fh, FCh, F6h, 79h, 0Eh, 72h, B0h, 83h, 94h, 16h, 39h, B8h, 16h, 29h, 72h, 70h, A7h, 68h, D1h, E2h, 56h, DCh, DDh, DDh, 39h, B8h, BBh, 14h, 8Ah, BBh, 6Bh, 71h, 29h, EEh, 4Eh, 71h, 77h, 28h, EEh, 2Eh, FBh, FBh, EFh, CEh, BEh, D8h, 7Dh, F6h, 99h, D9h, BCh, C8h, 24h, 33h, D7h, 9Dh, 4Ch, 26h, C9h, F7h, FEh, 5Ch, C9h, 4Ch, 94h, 0Ch, 1Ch, C9h, 09h, 90h, 00h, 97h, CFh, 4Eh, 40h, 00h, 3Ah, E0h, FFh, 4Ah, F4h, 5Ah, CEh, 9Bh, 30h, 5Ah, C0h, FFh, 9Dh, E0h, FEh, 27h, CBh, 77h, 8Ch, A5h, FFh, C4h, 86h, 0Ch, C0h, FAh, AFh, ECh, 64h, E2h, ECh, 62h, 6Fh, 6Ch, E1h, 28h, 29h, F8h, 9Fh, 8Eh, F1h, FFh, 4Bh, 87h, FEh, FFh, D0h, 69h, 43h, B9h, A1h, ECh, 5Eh, F0h, FFh, 7Fh, C5h, ECh, 50h, A3h, 20h, BEh, FFh, 55h, 5Ch, F0h, BFh, 11h, B3h, 53h, 72h, FEh, FFh, 15h, 43h, A1h, 06h, C7h, 7Eh, FFh, ABh, B8h, F0h, 7Fh, 23h, E6h, C1h, 80h, 38h, C3h, 60h, 5Ch, 00h, F7h, 70h, 38h, C0h, AAh, 25h, 02h, 00h, CEh, E1h, 0Bh, 85h, BEh, 10h, CFh, 25h, EDh, 27h, 36h, 3Ch, 00h, 10h, F0h, FFh, 1Ah, A0h, F6h, FFh, 59h, 63h, 32h, B4h, B1h, C7h, 82h, A8h, AAh, 7Eh, 00h, 8Fh, ABh, A0h, A7h, 3Ch, 7Fh, D8h, D8h, 30h, EAh, CCh, 7Ah, 6Bh, D9h, 94h, C6h, FEh, 47h, 1Bh, A2h, D1h, A8h, BAh, F6h, 77h, 89h, 4Dh, E9h, E8h, 67h, C7h, B9h, F7h, B8h, CAh, DFh, F5h, 7Bh, ADh, FEh, 48h, 77h, E0h

As you'll notice, it's not the same as in the other RAR files. :(
mike
04-05-2002, 05:19 PM
AirWolf--I'm posting this from someone else's computer; I haven't looked at your zip file to make sure you got the right headers, although I think you did.

Remember that you're only checking every tenth byte!

win.exe
FB2C0BC08E09ACBBB25BA643
t138.txt
82B60700981FB93565B8E3D4
t141.txt
BEC82314CC928320A1665624
winzip crack.txt
BE8B41ED52EA1987B4CF2A04
PKZIP Application Note.htm
80A085ACC314EE770660C61D

In this case, your bytes for filtering are FB, 82, BE, BE, and 80.

Do something like this

unsigned char filter[5]={0xFB, 0x82, 0xBE, 0xBE, 0x80};

for (i=0; i<(1L<<31); i++)
{
srand(i);
for (j=0; j<5; j++)
{
if ( (rand() >> 7) != filter[j] ) break;
for(k=0; k<9; k++) rand();
}
if (j==5) printf("Found it: %08X\n",i);
}
AirW0lf
04-09-2002, 09:25 PM
Hey mike =] Thanks for all the info...

I tried to use your bruteforcer and I got nothing :/ I even tried to change the bytes to filter... Can u check it for me?

1. When the first password-protected file is added to the archive, it calls srand(time(NULL)). Knowing what year it was created restricts your search a lot.

From lcc-win32.hlp -- The time function returns the number of seconds elapsed since midnight (00:00:00), January 1, 1970

So if I set my clock to 1/1/2002, call time(NULL). Then set my clock back to 9/4/02, today :), call time(NULL) again, I can for sure garantee that my seed is between this two values ?

2. Each byte of rand's output reveals some bits of the internal state, so you can use (say) the first output byte to restrict your search, too.

Can you give some examples?

Now about the code..

for(k=0; k<9; k++) rand(); // Why you do that? Trick #3 maybe?
mike
04-10-2002, 12:43 AM
So if I set my clock to 1/1/2002, call time(NULL). Then set my clock back to 9/4/02, today , call time(NULL) again, I can for sure garantee that my seed is between this two values ?
It should be srand(time(NULL) ^ getpid()).
The high byte of the process ID on win9x is 0xFF. I think that process ID's don't go much above 255 on NT.
for(k=0; k<9; k++) rand(); // Why you do that? Trick #3 maybe?
No. Winzip calls rand 10 times for each file and then encrypts them twice under the same password. Encrypting twice *decrypts* the first byte. So we check the first byte of the ten for each file and throw away the other nine.
2. Each byte of rand's output reveals some bits of the internal state, so you can use (say) the first output byte to restrict your search, too.Can you give some examples?
Yeah. See the next post.
mike
04-10-2002, 02:44 AM
Here are the twelve-byte headers again (you missed one byte on the first one):
9DFB2C0BC08E09ACBBB25BA6
82B60700981FB93565B8E3D4
BEC82314CC928320A1665624
BE8B41ED52EA1987B4CF2A04
80A085ACC314EE770660C61D

I ran my brute-forcer and after about 1/2 second it came up with this sequence for the seeds. Notice that I knew the high 8 bits to start guessing since

0x9D<<23 = 0x4E800000.

I've shown them below with every tenth seed shifted down 23 bits:

4E92F010 9D
EC620E93
72987F0A
A739C9A5
C0F815D4
E486AD47
206E72EE
4E2C7DF9
610248D8
5301243B
C173DE12 82
1CFDCC8D
7929AD1C
ADF9076F
32820476
FF31E961
00B1A6A0
22342AE3
F5976A1A
95DD4875
DF2CD964 BE
D88AA297
317BD2FE
C8B89DC9
89412968
2F9AC28B
D4A44322
ED74DD5D
DAABBAAC
3DBD1EBF
DF56FE86 BE
794F3B31
5184F130
2F388B33
190F892A
70E52B45
0EC470F4
54B61BE7
B522A70E
0A486199
40051DF8 80
mike
04-29-2002, 01:46 AM
Is anyone still interested in this thread?
npanic
05-09-2002, 06:03 AM
Maybe i don't get it, anyway i don't understand all this crypto talk, just 2 "advanced" for me.

Why not just bruteforce it 2 unzip the contents without entering the right password? i once wrote a little tool in Delphi that let u unzip/unrar without entering a password it also handled RARselfextracting files.
If remember it right it could handle WinRAR 2.8/2.9 2.9Selfextract
and WinZip 8.0/8.1beta, thats as far as i got before i found me some new stuff to play with.

BTW, it was a simple memory patcher modyfied a bit. With the Zip's and RAR's it played with WinZip memory, and with RAR's...
I don't remember abt the selfextracting RAR(probaly something with the caption title of the file).
mike
05-16-2002, 05:04 PM
The keyspace is 12 bytes or 8*12=96 bits. That's 4 billion times harder to brute force than the distributed.net rc5 challenge.
npanic
05-18-2002, 08:23 PM
...again i have learned, do not involve urself into stuff u absolutely not have a clue about. :-)

- who do not ask do not learn -
or something like that....
mike
05-20-2002, 03:24 PM
do not involve urself into stuff u absolutely not have a clue about
wrong
- who do not ask do not learn - or something like that....
right! :D


How to crack ansys6.0 for windowsNT/2000?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to crack ansys6.0 for windowsNT/2000?
PDA

View Full Version : How to crack ansys6.0 for windowsNT/2000?

glopen
03-26-2002, 12:52 PM
When cracking the ansys6.0 protected by Flexlm 7.2f,
I met a strange thing. After reading Nolan Blender's essay"Zendenc FLEXlm 7.2 cracking information", I succeeded in founding the right seed1 and seed2. I still can not generat the right license.dat for ansys6.0. WHY? I found that lc_set_attr was
called with the parameter: 38,4a,2d,4c. Here is the partial disassembling result:

_text:004081CD sbb eax, eax
_text:004081CF sbb eax, 0FFFFFFFFh
_text:004081D2
_text:004081D2 loc_0_4081D2: ; CODE XREF: sub_0_407B20+6ABj
_text:004081D2 test eax, eax
_text:004081D4 jz short loc_0_4081F0
_text:004081D6 lea eax, [ebp+var_1668]
_text:004081DC push eax
_text:004081DD push 38h
_text:004081DF mov ecx, [ebp+var_168C]
_text:004081E5 push ecx
_text:004081E6 call _lc_set_attr
_text:004081EB add esp, 0Ch
_text:004081EE jmp short loc_0_4081F6
_text:004081F0 ; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ?
_text:004081F0
_text:004081F0 loc_0_4081F0: ; CODE XREF: sub_0_407B20+6B4j
_text:004081F0 mov eax, [ebp+var_17CC]
_text:004081F6
_text:004081F6 loc_0_4081F6: ; CODE XREF: sub_0_407B20+6CEj
_text:004081F6 test eax, eax
_text:004081F8 jnz loc_0_408349
_text:004081FE push offset loc_0_411F50
_text:00408203 push 4Ah
_text:00408205 mov edx, [ebp+var_168C]
_text:0040820B push edx
_text:0040820C call _lc_set_attr
_text:00408211 push offset sub_0_407890
_text:00408216 push 2Dh
_text:00408218 mov eax, [ebp+var_168C]
_text:0040821E push eax
_text:0040821F call _lc_set_attr
_text:00408224 push 0
_text:00408226 push 4Ch
_text:00408228 mov ecx, [ebp+var_168C]
_text:0040822E push ecx
_text:0040822F call _lc_set_attr
_text:00408234 add esp, 24h
_text:00408237 mov [ebp+var_4], 0
_text:0040823E mov eax, dword_0_4731D0
_text:00408243 test eax, eax
_text:00408245 mov esi, [ebp+arg_0]
_text:00408248 jz short loc_0_408261
_text:0040824A mov edx, dword_0_4680C4[esi*4]
_text:00408251 push edx
_text:00408252 lea eax, [ebp+var_174C]
_text:00408258 push eax
_text:00408259 call sub_0_407720
_text:0040825E add esp, 8
_text:00408261
_text:00408261 loc_0_408261: ; CODE XREF: sub_0_407B20+728j
After I got the seeds and keys, I generated
the license.dat. But the key is wrong. Could you give me some hints?
MTB
03-29-2002, 12:20 AM
Hiya glopen

Why not attack the dongle interface? It is a lot easier in my newbie opinion.

MTB
glopen
03-29-2002, 12:57 AM
I'm interesting the cracking of FLEXLM!
nblender
03-29-2002, 08:44 PM
0x38 = LM_A_LICENSE_DEFAULT
0x4A = LM_A_USER_CRYPT_FILTER
0x2D = LM_A_CHECKOUTFILTER
0x4C = LM_A_CKOUT_INSTALL_LIC

Clearly there's more stuff than just the seeds you need to find
here - try and reverse the crypt filter, and also look at the
checkout filter and see what it's doing.
r00t
04-04-2002, 04:28 AM
Where can i find those Nolan's Essay?.

Thanks.
DakienDX
04-04-2002, 03:23 PM
Hello r00t !

You can find Nolan Blender's essay in CrackZ's archive.

Did you notice the difference between "Nolan Blender" and "nblender"? Yes, none. ;)
Actlon
04-08-2002, 10:55 PM
One thing to try is rather than try to crack the installed target, try cracking the installer - usually the FlexLM license files aren't made until they are actually installed onto the user's machine.

I had some success using this approach with MatLab R12 - I don't know if this is true for Ansys, but in MatLab there is a flag mechanism that determines if a dongle is required, if it is an educational version & if it is a demo version. It is possible to turn all these flags off in the installer & the installed version of MatLab will run without a dongle or being cracked. Generally with FlexLM the install program makes the license file with a whole load of FEATURE or INCREMENT lines & fills in the checksum as 0, then [I think] the FlexLM library opens the file & fills in the checksums for the installer [given appropriate seeds & data, which should be in the installer anyhow]. Personally I find this a neater & easier way to go if it's possible.


LordPE goes freeware :>!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > LordPE goes freeware :>!!!!
PDA

View Full Version : LordPE goes freeware :>!!!!

crUsAdEr
03-26-2002, 10:31 PM
HI guys,

Just in case you have not notice, this NICE tools have gone freeware... all features are enabled!!! :>...

Cheers,

Time for a beer :>
Solomon
03-27-2002, 01:23 AM
well where did you see the exciting news?
I can't see it in h**p://mitglied.lycos.de/yoda2k/LordPE/info.htm.
However there is no "please register" now in this page. Thx yoda

LordPE has different versions. What's the difference?:D
crUsAdEr
03-27-2002, 02:21 AM
Hi Solomon,

Yeah, i got the RoyalTS version from Protools... read the readme.txt for the info... Yeah, been waiting for this full featured tool for sometimes....

Rejoice,

Thanx to y0da for such a great tool!!!
foxthree
03-27-2002, 12:52 PM
Hi binh/others:

Yes, Protools it is :)

Great news for us RCE's eh!

Signed,
-- FoxThree
+SplAj
03-28-2002, 01:22 PM
As one of the 'few' that actually donated some beer money to y0da for LordPE a year ago , He religously sent me the updates and gave good service to his customers. Thanks.

Now the LordPE RTS version is fully featured and free for all I would like to thank y0da for his efforts. - but hell we have more plugins to learn :)

Spl/\j
evaluator
04-01-2002, 09:33 AM
But, shit!:)
What about guys, who buyed...~:0
+SplAj
04-01-2002, 10:56 AM
Hi eval

But I did buy it, $15 cash ! Thats what I meant when I said I donated some beer money !!!

I have the e-mail header from y0da to all REGISTERED LordPE users.........I did not see ur name there ;)

hahahappy easter.
evaluator
04-01-2002, 03:27 PM
Wow! SPLAJ!
This is why I asked my question!

Looks little shit, when you buy SOMEthing,
and soon it became FREEware!
Can you tell us history:
Why y0da did sell LP, AND-OR why it now became free??

So YOU are buyer..
What you feel...
+SplAj
04-02-2002, 07:01 AM
hi eval

At the time I heard y0da PC had expired....and he is young student ? no problem, he made it free+full version 1 year after I bought it.......and I had a LOT of use of LordPE for my bucks....... I fuxed a lot of targets ;)

Now my notebook cost me $2,000 for xmas....just a few months later I can buy the new model with 2x more RAM/HD space etc for $1200 :(

wasting $800 .......That I am pissed off with.

Spl/\j


xLoK Commercial Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > xLoK Commercial Protection
PDA

View Full Version : xLoK Commercial Protection

tCr
03-27-2002, 03:07 PM
Hi all.

Have not been around a long time - nice to see the board still is active :).

Well now that I'm back to cracking...
Does anybody have information about how XtreamLok works, or any programs that are using this protection?
General info on w*w.xtreamlok.com is just like everywhere:
"Our protection is unbeatable and the best and blabla... BUY IT"...
But no detailed technical information given and (so sad) no possibility to check if its really that hard :x

Unfortunately the only program I saw yet using xlok was one also protected by softwrap, so i just kicked softwrap - well to be honest i kicked the program, too after cracking it and forgot its name without checking the xtreamlok part ;).

If anybody has information about this protection scheme I'd be glad to hear :)

Have a nice day,

tCr
thE Cur!ouZ
03-28-2002, 03:48 PM
hi, tCr..

you ca test the last version of SoftWrap v4.

"Softwrap version 4.0 has several distinctive added functionalities, including:
· Significantly enhanced security with the addition of full Xlok integration
· Facility to wrap from any machine that is connected to the Internet, using an ActiveX wrapper as opposed to the application; this ensures that the publisher is always wrapping the latest offering from Softwrap".

It use the full Xlok integration.

Good Luck.
Red Plait
03-29-2002, 12:00 PM
Well, we successfuly trying to crack example of latest XLock/SoftWrap protector. Only interesting thing IMHO is fully changed import mechanism - their wrapper changes code in protected module so now all refs to import processed over two or three functions which do dynamic API function resolving - protected module even haven`t valid IAT at all. It seems like

was:
mov ecx, ds:[IAT entry]
now:
call ecx, dynamic_resolver

But code for decrypting function is very simple (differs by three constant from module to module) so you can rip it in SI for half hour. May be there is sence to do emulator for such import mechanism ?
evaluator
03-30-2002, 08:43 AM
can you share direct link for downlad?
Dr.Golova
03-30-2002, 09:47 AM
Originally posted by evaluator
can you share direct link for downlad?

Download wrapper:
softwrap.com/download/Wrapper.exe

Wrap any program and you get at least softwrap.dll encrypted by xLock (we unwrap them without problems too ;-)
evaluator
03-30-2002, 08:49 PM
This is joke??

I wrapped NOTEPAD. It produces 2 files:
1. New big "NOTEPAD.EXE" 344kb
2. "Notepad.locked"

But this "Notepad.locked" is normal 98% NOTEPAD! Only little peace of code
is crypted. & decrypted code I can dump from memory.

So, is IT STUPID or I did something wrong??
ThrawN
03-31-2002, 01:00 PM
Internaly (with the protection) almost nothing has changed with softwrap 4 :/
Few small changes i will list very shortly.
I had to make a few changes with my 3.x unpacker and hopefully once i resolve some key prob on NT ill have it out for all to see within this month.
Time is very precious at this moment as work is so demanding.

ThrawN
^DAEMON^
04-02-2002, 10:30 AM
hehehehe u finally did the unpacker ? (didn't heard of you)
but still dunno why u did one, cause softwrap really suxors :D

^DAEMON^
evaluator
04-02-2002, 08:14 PM
So nobody agree with me, when I sad:
"this is stupid protection"???
Strange. Who want unpacked "LAUNCHER.exe"?
:)Or who can?

OOO!
DAEMON!

How is your BETA protector?
Did you enhance it?
Would you like I unpack?:)
^DAEMON^
04-03-2002, 05:29 AM
lol, yeah i've improved it a little bit but stopped the project...

i've started a commercial protector with a friend...
but anyway i've tested revirgin's tracer yesterday on my old protection and it failed (on NT! not 9x) (after 20minutes i stopped the job! hangs in an endless loop)

^DAEMON^
evaluator
04-03-2002, 07:09 AM
Tsehp, as I know, not made RV for NT.
For W2K.

Ah, commecial protector!
So I can help you in UNPACKING also THE commecial protector:)

Also, IF your money_lover_Protector is NONtraceble by RV, I think, Tsehp will interested
for this...

OK, point me, what program is protected...
or no one yet?
^DAEMON^
04-03-2002, 10:40 AM
;) isn't 2k based on NT ? (it was 2k i tested it on)

yep sure u can help me... currently i've started the import wrapper... this is maybe one of the most difficult parts...
@ least it gets more interesting than my last wrapper...
:D

anyway u can try to unpack an "old" protected file...

i'll email u the private link...

^DAEMON^
evaluator
04-03-2002, 11:36 AM
Firstly, lets finish with XLOC!

Here I uplaoded in splitted 2 parts xLOC's "LAUNCHER.exe".
So this launcher is very interestly wrapped, but not programs it must protect!!
STUPIDO ONE!

This LAUNCHER is a resource in WRAPPER.EXE.
I restored 678 mangled exported FAR CALLs!!!!!!!!

But there are also >164 direct calls into "xloc" section.
This calls simulates inatructions like:
mov esi, [export]
mov edi, [export]
mov esp, [export]

Because I'm too lazy for restore them, I leave XLOC section
and added my little startup code.

Who can?? WHo can't?

Hey, DAEMON!
Can you explain reason, why you not publish your_protected file here?
Why you will send private link? What if you make little-pusy-viri for mee!?
^DAEMON^
04-04-2002, 06:18 AM
evaluator, why the hell should i infect you ? u don't trust me :/

gimme only 1 reason why i should release a "BETA" of it?

(i don't want to be rude - but think about it)

^DAEMON^
evaluator
04-04-2002, 07:01 AM
Why you want infect mee?
possible answers:
1. JfF
2. VENDETTA!

OK, FORGET IT! I joke..

But now you tell me, why you not "publish" beta-protected EXE?
So not only I will enjoy unprotect it, but many other newbiez?
^DAEMON^
04-04-2002, 10:34 AM
it's a security reason, when u grow up with a protection u know how it's working etc... that's my reason for not releasing a public beta... nothin more (an example would be risc -> unsafedisc... he can update "pretty fast", it would take a long time for me to do an unpacker)

^DAEMON^
crUsAdEr
04-04-2002, 11:24 AM
Well, i have one reason why you should release your beta :> (beside the fact that i would love to try it :>)

well well, the best OS so far has been open source one, the best encryption algorithm is always open source, well tested by the public.. if you put ur beta version here, we can play with it, provide u with idea how we can defeat it and you can improve it... we cna always work together to learn and improve... hmm except i dont dig that idea of a commercial protector!!!

Just my 2 cents :>

Cheers,
evaluator
04-04-2002, 05:30 PM
DEATH OF SARDANAPAL

Yep, now I fully remove wrapper...

You can use "RESOURCE HACKER" for optimise resource size..

WHO CAN? WHO CAN'T???
^DAEMON^
04-05-2002, 07:21 AM
hi binh81

iam sorry,better go and try yourself @ rea...

when u reach the last crackme u can show me your knowledge... (it's protected by my protector)

h**p://www.reverser-course.de

^DAEMON^
evaluator
04-05-2002, 11:07 AM
you mean, I also must try your CRcme, or
it only for binh8?
ThrawN
04-11-2002, 10:42 AM
Heya DAEMON good to see ya again :)
Yeah iv been off da net almost totaly so you wouldnt hear anything from me :)
I solved problems by not trying the hook method and use the attualy protectors method (code rip)
Just something iv missed somewhere so its not working 100%.
bleh anyhow i havnt worked on it recently theres just no time to and the only reason i did it was out of interest :) not for anyone elses benifit.

ThrawN

P.S nchanta you browse these boards? email me pls :)
tCr
04-16-2002, 03:39 PM
Thx for the info guys :) - wasnt able to reply faster got sick.

Happy Reversing,

tCr


Stuck on aspr
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Stuck on aspr
PDA

View Full Version : Stuck on aspr

fALC0N
03-28-2002, 12:29 AM
After reading a lot of threads about aspr, I gave a shot to unpack Available Domains Pro at h**p://w*w.alphacomsoft.com and as you might have guessed stuck at runtime.

Found the OEP at 391F5 (correct?)

Fixed (?!) the IAT thru Imprec, tried RV too but it crashes.
IAT RVA=77000 Size=7C4
After resolving entries it refused to run...

I wish to know if there are any D-D code in this. If anyone can shed some light in finding
D-D code in apps in general is very much appreciated.

Maybe some of the gurus here could give me some hints where have I done wrong.

I've attached my resolved iat

fALC0N
foxthree
03-28-2002, 04:54 PM
Hi there:

No D-D tricks in this one. [Even if it did, it doesn't matter :) ]

A cursory glance of your rebuilt IAT, also shows that everything is fine, too! I'm attaching my rebuilt IAT thru' RV so that you can analyze this one more!

OEiP == 391F5 <--- Correct!

By, not running, do you mean the FAULT 0Eh after running the unpacked ADomains? That is easily fixed. There is a redirected call to ASPR code! NOP it and everything is fun :D

For further reference, search the forum. You'll find enough references for redirected code fixing.

Signed,
-- FoxThree
fALC0N
03-28-2002, 08:58 PM
Thanks for replying foxthree but it still gives me an error at 016f:0043715c and NOP'ing just doesn't resolve it.

Is there something i'm missing?

Is it a redirected call?

Thanks,

fALC0N
foxthree
03-29-2002, 08:24 AM
Hi Falcon:

No. NOPing 016f:0043715c will not work. You've to NOP the caller itself. It will be at 0040f5d or something like that. Look in the call stack. If you NOP the caller, everything is nice ;)

BTW, the instruction 016f:0043715c is not the problem. It is the instruction above it that refers to "ASPR" memory that causes the page fault. I think, it is something like MOV EAX, ECX or something where ECX == EXXXX (ASPR mem area).

Find it man and have fun :D

Signed,
-- FoxThree
fALC0N
03-31-2002, 11:48 PM
Hi foxthree,

No matter what I've tried, it just doesn't work... I even tried with your iat, I tried, I tried, I don't like to give up!

Is it something else ?? I must be missing something pretty badly!

fALC0N
foxthree
04-01-2002, 04:28 AM
Hi there:

What Hex Editor are you using to paste the IAT? DO NOT USE HexWorkshop as it is broken for > 2MB file sizes. Use UltraEdit.

Signed,
-- FoxThree
fALC0N
04-02-2002, 02:03 AM
Hi foxthree,

I never used hexworkshop (and I didn't know it couldn't handle >2Mb files).

I used imprec's fixdump and rv's fixdump at all times.
fALC0N
+SplAj
04-02-2002, 06:51 AM
hi

Did you get the aspr memory 'check' sorted at ~437150 ? It is NOT a rediirected call.

For me the aspr mem was E73431....of course this is gone. But this is only a simple sub eax,ecx check. (E73431 - E73431 == 0)

So, find offset in dumped exe for 31 34 E7.....found at raw offset 0x9F9D8 so change the bytes to D8 F9 49.

Now target runs because 49F9D8-49F9D8==0 ;)

Spl/\j
fALC0N
04-03-2002, 04:03 AM
Hi Splaj :)

Thanks for looking at this aspr problem !! :)
And you are right! when i do that it passes that point, but now it gets stuck at 016f:0044bbe8.
Also is this thing running on anyone's comp?? or am I the only one :(

I appreciate your help
fALC0N
fALC0N
04-06-2002, 12:53 AM
I guess I'm stuck dead on this :(
foxthree
04-06-2002, 11:36 AM
Hi FalCon:

Here is once again a step by step things to do:

(1) Find OEP. You already did this. Dump using /dump command of ICEDump. Specify the image size and image base correctly.

(2) Run RV and rebuild the IAT. Again, you've done this correct using ImpREC

(3) Thirdly, when you run, you'll find app crashes.

Single step in SICE and find that a call at 407F50 makes a call to ASPR as +SplAj mentions (sub ECX, EAX or something like that).

What I've done is to NOP out this entire call. (Yes, it is not required). [You can also do a "cleaner" patch by what +SplAj guru said.]

NOP the call to ASPR code at 00407F50 (5 NOPs) [Flag check code]

Try this step by step.

Signed,
-- FoxThree


Patching dll at runtime
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Patching dll at runtime
PDA

View Full Version : Patching dll at runtime

SaNGa
03-28-2002, 07:56 AM
I'm trying to patch a function imported from a dll (not a system dll) by another process at runtime. I write a small loader that load the main process and the dll is loaded by this process. How can I obtain the handle of the loaded dll? I have used LoadLibrary but if I use WriteProcessMemory with this handle, the function fails (the page protection is PAGE_EXECUTE_READWRITE, modifyed with VirtualProtectEx). Any suggestions?
mike
03-28-2002, 06:16 PM
What OS? I know under win98, I just cast the handle returned from loadlibrary as a pointer & modified memory that way.
IcyDee
04-01-2002, 12:15 PM
why not patch the DLL section that you are trying to modify to make it read\execute\write? that always worked for me no matter what the operating system. Then cast the handle as a pointer as mentioned above.
hailua
04-07-2002, 12:09 AM
Hi IcyDee,

Patch the DLL section?but Dll packer ,how do patch .I try it but
it crash


Diassembler-Sources ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Diassembler-Sources ?
PDA

View Full Version : Diassembler-Sources ?

Zero
03-28-2002, 11:36 AM
Does anyone know GOOD sources (maybe C) of disassemblers for x86 ?

At the moment I am targeting at BIEW, borg (cronos) and diasm (olldbg).

Any other ideas ?

thx,
Zero
Kayaker
03-29-2002, 07:58 PM
The Disasm component of NASM. Check it out and I can give you some more info in a couple of weeks when I get back to my computer.

Kayaker
Zero
03-30-2002, 09:50 AM
thx, i check it out :)


some asm querries
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > some asm querries
PDA

View Full Version : some asm querries

crUsAdEr
03-28-2002, 03:20 PM
Hi folks,

here i am asking some newbie question on asm... having little experience in asm...

My masm can not compile Laptonic's MD5 Pentium optimised code with this error
"Instruction or register not accepted in this CPU mode"

I am using Athlon ThunderBird... so could this be a problem or am i doing somethign wrong??

Thanx
LaptoniC
03-28-2002, 04:18 PM
In what line it gaved this error ? Did you commented out some MMX functions in the source like mem6 ?
If it so then add
.586
.MMX
to top of your source code
crUsAdEr
03-28-2002, 09:25 PM
Yep, thanx Laptonic...

Well it is done.. my lame bruteforcer... not sure if it can be improved... yeah it bruteforce 6 digits (alphanumerics) in 13 min 57 sec... a simple calculation that if i wanna brute the whole serial of 12 digits will with my 1.2GHz Athlon, it will take about 125 years... grinz....

Ah well... i guess project over :>... guess i will stop here until there is some kind of breakthough to break MD5...

thanx Laptonic :>, for the source code... for the efforts to put comments just for me, and for replying promptly for my silly querry..

Cheers,
crUsAdEr
03-29-2002, 08:48 AM
Bruteforcing 7 digits on my computer took 8h: 22m : 12 sec :>... hmm... maybe i should just try 8 digits in the server here, hopefully i get the result in a week :>...

Cheers,


Where should I start?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where should I start?
PDA

View Full Version : Where should I start?

Chuddva
03-28-2002, 10:30 PM
As a newbie, I have been reading the lessons and essays on the +ORC site. And it seems as most of those lessons are old technology. While I understand the lessons may be important from a fundamental point of view, I don't think they will help me with reversing new technology, and frankly I don't know where to begin. And correct me if I'm wrong about the lessons please. So my question is, what would be a good project, for a newbie like myself to embark on, that involves up to date software for reversing, so I can learne to use the tools, and understand how to tell what protection schemes are used in the software. Any assistance would be greatly appreciated. Thank you.
crUsAdEr
03-28-2002, 10:51 PM
Geez,

Where did you find +ORC site :>??? hee... would be nice to see his foto :>...

Okie, here is the place for you...
zor.org/krobar

read and learn, friend :>

P.S : Moderators, how about putting a link on this site on top of the newbie forum so ppl dont have to ask for it again? Jusy a random thought....
Woodmann
03-28-2002, 11:01 PM
Howdy,
A few questions for you.

Do you know any "code"?
Have you gathered your "tools"?
Dont forget the manuals !!

If you are starting out "fresh" ,with no understanding
of windows assy lang and no understanding of hex
values, you need to find the easiest tuts on Krobar.

When you get a tut, get your manuals ready so you
can follow and understand what each thing means.
The manuals will be your reference guides, without them,
dont even bother.

Peace, Woodmann
MTB
03-29-2002, 12:16 AM
Chuddva

Here is my two cents worth, since I am still a newbie. First the old stuff is still very important, because unlike windoze, the dos stuff relates directly with your machine (ie bios, video and disk). There are several areas to specialize in, broken into two groups, hardware (dongles and disk (floppy, hard and CD)) and software (keys, encrypted keys, FLEXM, and other stuff). The Gods can correct me if I am wrong.

I specialize in dongles since that is what most of my engineering software is protected with. If you can NOT program go and learn C or ASM.

To start, see fravia's archived site, fravia has a group called cracking for dummies.

For tools I would start with W32dasm89 with a very nice easy to use interface, and a hex editor.

Once you have mastered the basics take a look at Krobar site, Crackz's archived site, and others.

Good Luck

MTB:D
JMI
03-29-2002, 04:40 PM
Chuddva:

"A Good Place to Start" is with the search button on the top of the forum. Using that feature you will find a thread from 12-19-2001 with this title where your question was asked and responded to by several members with suggestions on getting started. Among the useful suggestions was a reference to Krobar's and +Sandman. You might want to give it a look and practice using the search function, as it will often lead you to questions you are considering that have been asked one or more times in the recent past.

regards.


Menu resource ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Menu resource ??
PDA

View Full Version : Menu resource ??

crUsAdEr
03-29-2002, 03:15 AM
Hi,

Yep it is me burning my nite off again, been struggling with menu resources.. does anyone have good reference on structures of each type of resources in the resource section? I know the IMAGE_RESOURCE_DATA_DIRECTORY struc but i need to know about the struc of IMAGE_RESOURCE_DATA_ENTRY....

Okie, just one qucik question, for my menu resource Data entry,
Right at the beginning, the are 3 words like this
000000009000
followed by Menu Item ID, Unicode string of Menu Items etc

I have checked a few file and find the 3rd words to be either 9000 or 1000.. any one have any idea what they mean?

thanx,
CoDe_InSiDe
03-29-2002, 06:21 AM
Hi binh81,

9000 means that it's the last (Or only ;) ) menu item + sub menu items (If any, but probably atleast one :D ).
The last Sub Menu Item will have a flag of 8000.
Now if you would see 1000 for the Menu Item then that means that there's another Menu Item ;)
Hope this helps a bit.

Cya...

CoDe_InSiDe
crUsAdEr
03-29-2002, 09:15 AM
To quote +SplAj .... "I love this board" :>..........

Thanx a bunch, CodeInside... got it now :>...

See ya around


SVK-Protector
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SVK-Protector
PDA

View Full Version : SVK-Protector

Jaimex
03-29-2002, 05:05 AM
Im a newbie, just found this page
h t t p://www.anticracking.sk/svkp.html

Anybody knows:
What products use this protection?
Any tutorial?

Thanks in advance
Jaimex
foxthree
03-29-2002, 08:33 AM
Hi there:

For all its bragging, it seems to me like an "ASPR" clone :p

I can take a look at it with the other "gurus" here.... but hey, wait it seems the author is too scared to give us an eval copy :D

Signed,
-- FoxThree
Kilby
03-29-2002, 10:54 PM
I must admit that I would like to have a look at it.

If for no other reason than to see what Elicz's host can code like.

If he works along with Elicz it could be very interesting thogh it may ne a little untidy ;)

Kilby...


Help on HASP ID
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help on HASP ID
PDA

View Full Version : Help on HASP ID

cah
03-29-2002, 06:45 AM
Is it possible to edit/change the ID of MemoHASP1 Dongle? If yes,
any tools/utilities are available? Help on this subject is highly appreciated.

Thanks in advance

Cah...
cah
04-13-2002, 05:15 AM
To,
HASP REVERSE ENGINEERS

Is any knowledge base available on above subject to edit/change ID of memoHasp1?

Cah...


IDA new processor module
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IDA new processor module
PDA

View Full Version : IDA new processor module

Rainor
03-29-2002, 04:17 PM
I want to add a new processor module to IDA. What kind of SDK i need for this task??. My current IDA version is 4.15 , but i had also version 4.04.
The processor that i want to add is TSM370, there is a lot of freeware disasm over the net for this CPU but all sux big time.

regards

R
DakienDX
03-29-2002, 05:53 PM
Hello Rainor !

The IDA SDK is only available to registered users of IDA. Since you're talking about 4.04 and 4.15, the only warez pro versions, I don't expect you've registered IDA. :(

To take the words from aimless some time ago you'll need (modified):
IDA Pro registered version
The processor module compilation kit (again, from Datarescue, available to ~regged~ users ONLY, hence the above requirement)
Borland C++ 4.5 (Nope, above this version of Borland, it does not seem to work)
Source code for MAKING the processor module (assuming you are smart enough to do that).
disavowed
04-01-2002, 10:38 PM
Originally posted by DakienDX
The IDA SDK is only available to registered users of IDA. Since you're talking about 4.04 and 4.15, the only warez pro versions, I don't expect you've registered IDA. :(

Correction: IDA 4.17 Pro was also warezed :)
DakienDX
04-02-2002, 05:27 AM
Hello disavowed !

Correction again: IDA 4.17 Std was warezed.

Two so called "Pro" versions are also available. One with the Pro modules from 4.15, one with the Pro modules from 4.04.
Since you know the IDA modules won't work with versions they weren't compiled for you can guess how Pro these versions are. :(
disavowed
04-02-2002, 07:55 PM
... nevermind ...

:)


SI 4.05 + W2k: 'p ret' troubles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI 4.05 + W2k: 'p ret' troubles
PDA

View Full Version : SI 4.05 + W2k: 'p ret' troubles

KurtzHz
03-30-2002, 07:46 AM
Hi y'all!
Maybe someone can help me. I'm struggling through my first softice tutorial. I set a breakpoint on GetDlgItemTextA and SI pops up into USER32.dll. When I try to 'p ret' out, the SI window closes and the program continues execution. I then have to press ctrl-d TWICE to pop-up the SI window. It feels like a bug but i'm probably doing something wrong. All I found in the manual is:
If you are stepping and the statement or instruction is a function call, control is not returned until the fuction call is complete.
Any ideas?

PS: When my modem is connected, 100s of messages starting with WinAcNt are logged to SI's command window, each one making an annoying beep on my pc speaker:mad:. Can these be turned off?
example:
WinAcNtPutChar putting 'x' e9 in typeahead at 0xff49f404

ty
KurtzHz
03-30-2002, 07:40 PM
Upgraded to Driverstudio 2.5 and the 'p ret' stepping now works fine. I still get these damn "WinAcNt..." messages tho.
foxthree
03-30-2002, 08:43 PM
Hi there:

Firstly, I too had the same problem as the GetDlgItemTextA. I thought it was the programmer who did some "tricks" with SEH and left it at that. Thanks for the update that it was a SICE bug :(

Okey as for the second one, it is your modem driver/app writing debug logs (remember SICE the kernel debugger can catch and display all outputdebugstring, dbgprint and other messages) Programmers use such apis to print strings during driver run time so that they can monitor the driver functioning. Actually, at final *release* build, they're supposed to recompile the driver code removing the DbgPrint messages, but I guess they were too lazy :p

So, I guess you'll have to live with it.... (hey, you can patch those calls, oh well here i am rambling again ;) )

Signed,
-- FoxThree
KurtzHz
03-31-2002, 01:58 AM
Thanks foxthree, I was getting the same impression from combing through MSKB articles, that my modem drivers are compiled with debug information.
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314743 tells how to enable and disable verbose debug tracing in drivers and subsystems. It states:
To enable debug tracing, locate your component ID either from the ntddk.h file or from the debugger. To do this, use the following code:
x NT!Kd_*_Mask
Then, set the value to the maximum for verbose output (0xffffffff). Currently, only a few classes of drivers (described in the "More Information" section of this article) use this new function.

Would it be possible to set this type of variable in SoftICE? Where can i find the Kd_xxxxxx_Masks the page is talking about? Below is a sample of what I get in SI when I am connected OR check the Serial Port status in Computer Management:
WinAcNtDispatchIoControl IOCTL_SERIAL_SET_DTR
RShellNt_SetDTR old MCR 0x3, new MCR 0x3
WinAcNtDispatchIoControl done with status 0x00 information 0x00

WinAcNtDispatchIoControl IOCTL_SERIAL_SET_LINE_CONTROL wrd8 par0 stp0
WinAcNtDispatchIoControl IOCTL_SERIAL_SET_LINE_CONTROL wrd3 par0 stp0
WinAcNtDispatchIoControl done with status 0x00 information 0x00

WinAcNtDispatchIoControl IOCTL_SERIAL_SET_CHARS eof0 err0 brk0 evt0 xon11 xof13
WinAcNtSynchSetChars Eof 0, Error 0 Break 0 Event 0 Xon 11 Xoff 13
WinAcNtDispatchIoControl done with status 0x00 information 0x00

I'm assuming that my winacpci.sys is the culprit here. There should be a way to set debugging off by typing the SoftICE equvalent of ed WINACPCI!WinacpciDebugMask 0x00000000, right? The above link also mentions a Global Mask, Kd_Win2000_Mask, that filters debug output. I'm not clear whether this is a WinXP-only feature or not, maybe someone who has ntddk.h could help? phew!

:confused:Kurtz:confused:
KurtzHz
04-02-2002, 06:20 PM
Replaced winacpci.sys with the original winacpci on the W2k CD and DbgPrint messages have disappeared.:cool: The solution was so simple, yet i spent days trying to solve it by installing Kernel Debugger extensions in SoftICE and playing with passing "DebugLevel" parameters to winacpci.:mad: Oh well, live and learn i guess :D :D


CD-Cops Generic Unpacker v1.1 Open source
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CD-Cops Generic Unpacker v1.1 Open source
PDA

View Full Version : CD-Cops Generic Unpacker v1.1 Open source

LaptoniC
03-30-2002, 02:25 PM
I am tired of working on this unpacker.If anyone cares, I present you my latest unpacker.It can fully emulates main.exe's behaviour, load qz_ file hook some apis and dump the process.It has currently two bugs in IAT building.Hope it give some ideas to you about ApiHooking.
blackcheck
04-16-2002, 05:28 AM
hi

is it true that cdcops checks the physical angle between
the first and the last sector ?
LaptoniC
04-16-2002, 12:47 PM
I guess yes.Because sometimes copied CD's may run without any error if the layout is the same.Main weakness about this protection scheme is below

CheckSerialFromReg
if CheckDiskLayout OK then
run qz_file with Cmdline which is derived from gettickcount+productnumber+productname
1 possibilty to crack this protection sniff product number,name and run qz_ file.Everyting will be ok
Second method can be,
When qz_ file runs, it debugs w_x file which crypted original exe.At first waitfordebugevent api program is decrypted but imports are wrong.Decrypt the imports and you are done.All versions I have from v1.72 to v2.04 are exactly the same.They change only code and data sections decrypt algo in every version.
Emulation of main exe file is the simpliest and easy method.Total emulation code is 3.5 kb.Can you belive it :)
IcyDee
04-16-2002, 05:34 PM
blackcheck

Yes it does check the angle beween sectors. It does this by timing the response of the drive to read sector commands. This suggests an alternative method of simulating the original CD which is to hook the relevent API, keep a record of the time and then 'play back' this time on a copy of the CD. This worked for me on an earlier version of this protection since when it reads the sector it only uses the response time and is not bothered with the actual sector content.
blackcheck
04-16-2002, 07:11 PM
hehe i don't want to crack it, i want to implement this into
my own protection ;)
getting a cdcops target here is not that simple.

I guess yes.Because sometimes copied CD's may run without any error if the layout is the same.

that is *usually* a clonecd copy does not work,right? i also
heard that it calculates the angle with 8 bit precision. so
you have a 1:256 chance for the copy to work i guess.

It does this by timing the response of the drive to read sector commands

sounds like you reversed the proc that does this...
can this be done trough aspi ?
does this piece of code get decrypted witout the cd ,too?.

if so i would be glad if someone could send me a cdcops exe ;)

i don't understand how you can compute this by timing, could
you explain ?
should be easy to calculate the length of one 'ring' with timing,but the angle ?

yeah, well i guess it's my lack of knowledge about cds...
how is a single sector arranged on the cd (physically) ?
IcyDee
04-20-2002, 06:09 PM
Originally posted by blackcheck

i don't understand how you can compute this by timing, could
you explain ?
should be easy to calculate the length of one 'ring' with timing,but the angle ?

yeah, well i guess it's my lack of knowledge about cds...
how is a single sector arranged on the cd (physically) ?
[/B]

Sectors are arranged in a continuous groove (rather like a record) but instead of a constant angular speed (45 rpm) it is a constant linear speed. This means that there are more sectors in an outer loop of the spiral than on an inner spiral.

I worked out once that each sector takes a linear distance of about 14mm (this is not exactly true since adjacent sectors are combined to improve the error correction.

Imagine two sectors, sector 1 on the inner loop of the spiral and a sector on an outer loop (say sector 200000). If the disk drive is told to read sector 1 and then sector 200000 then there will be a delay between the data being returned for each sector. This delay will be made up of several components.

1. The operating system overhead.
2. The time for the drive to seek from the inner to the outer sector.
3. The time for the sector 200000 to rotate under the read head.

Now (1) can be ruled out since it will be fairly constant for each read (and very short anyway) and will cancel out if we are looking for timing differences.

(2) will be fairly constant and will depend upon the drive.

(3) will depend upon a few factors, one being the angular distance between the start and end sector. The other being the rotational speed of the drive. We can assume that the rotational speed is constant and will cancel out.

By making several measurements between sector 1-200000, 1-200001, 1-200002 etc. it is possible to work out which outer sector has the smallest angular distance to sector 1. This is what I believe CD-Cops measures.

One flaw with CD-Cops was that it always measured between the same sectors. If you measure these timings and then 'play them back' on another copied disk then you could fool the protection into believing that the disk was an original.
blackcheck
04-20-2002, 09:19 PM
thanks a lot for your exlanation.
i tried it and it really works.
i can detect a perfect clonecd copy.
the only hard thing is to make it work
reliably.


Win2K Pro and SoftIce (Not Repost)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2K Pro and SoftIce (Not Repost)
PDA

View Full Version : Win2K Pro and SoftIce (Not Repost)

Cenobitez
03-30-2002, 05:15 PM
I had a look through the last 100 days posts and looked at all the ones mentioning win2k and sice and 4oh4 had the Exact Same problem i did, only my problem continues now...

My Only usual thing about my PC Spec its a Duel Pentium 3 running at 1.26ghz each, that seems to be the root od most my problems....

When i installed Sice it gave me a message saying something to the effect that i need to turn write protection off on real memory, so and would i like to reboot so i click ok...

My machine rebooted and softice began to install, i chose default display adaptor and all i got for the flash of a black screen, then i got a blue screen saying "if this is the first time just reboot and carry on if the problem persists etc etc" so i reboot and then i get a blue screen with a message saying "Feed_Pool_Error" i think and windows froze, i tried all the options off my Boot Menu and nothing helped..

I put in the recovery disk and got into safe mode, i removed softice, but it errored on removing reg entries, and did an auto reboot.....after rebooting there was on file the .ISU file so i deleted that and the folder and moved on..

I now keep getting MSDTC.exe popping up all the time, and General Read Errors and Write Errors, like unable to read memory and unable to write memory, and everything is randomly Illegal Opping on me...

My Questions are:

How do i undo this Write Protection on Real Memory thing that Sice asked me todo ?

What the hell is this MSDTC thing, when it comes up its just a Dos box with loads of what looks like Hex Values, and no way to close it or anything... when i his ctrl+alt+del it freezes....

Any help would be appreciated, at this point my Win2k Pro is about as stable as Windows ME and that hurts it really does, i have to reboot at least twice a day now, i used to reboot once a week with ME and once every 2 or 3 weeks or so with 2k unless i was programming then its every few days heh *cries*

______
steve
Woodmann
03-30-2002, 09:12 PM
Howdy,
It's been a while but I shall try.......

The memory problem is something that you can fix in the BIOS.
You just need to turn "write" back on.
You may need the motherboard manual to do this.

The MSDTC is a sever function I believe.
You can go to the MS site to get it and re-install or you
can edit the registry so it doesnt run.
Do some research on these things. Just to double check
my advice.

Peace, Woodmann
Cenobitez
03-31-2002, 05:02 AM
I did a lil research into, this problem, but most of the stuff i found was advising me to use various other tools, and i figured wisely or unwisely not to not to use more 'tools' at least untill i setup a win98/ME partition....

Thanks for the info, im goingt to reboot in a few to look through my BIOS, but its your standard Dell affair with everything ultra simple....

The MSDTC is annoying, its for ever illegal opping and stuff...

I have a starting place,

Thank You :)
Snatch
03-31-2002, 09:04 AM
Actually I do not have a contribution but yet another question. I also have a Dell and I am fed up with the fact that the BIOS exposes absolutely nothing. Where are all my interesting settings? My old 486 gave me about 500 times more settings to change. Is there a way to change them? I know someone wrote a BIOS tweaker but what would Dell's official method be?

Snatch
DakienDX
03-31-2002, 10:29 AM
Hello everybody !

And I thought Woodmann and I were the only ones having a nice DELL with many very good features and no way to configure them. ;)
I haven't yet figuered out how the nice but absolutely useless E-Support key can be programmed. (to a RESET button for example)
I wrote two E-Mails to DELL, but I didn't get an answer. :(
Does anybody of you know how to get it's pressed/unpressed state?

Sorry , but I don't know how to tweak the BIOS, because I had no need for it all the time.

But I think the Write Protection is somehow controled over a registry entry. I'm not running on NT at the moment, but I think the entry is the following:
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\EnforceWriteProtection.

I don't know if it's the right one, I only extracted it from the setup .MSI file.
foxthree
03-31-2002, 10:47 AM
Hi there:

There was an App called GlobalFlags or something like that in NT ResKit. That can be used to turn on and off flags like the "Memory Copy Flag" that SICE just overwrote with. Try to see if you can find such an util for 2K from MS Site.

Also, SICE pops up that msg box only if you have an older build of 2K. Try upgrading to the latest build of 2K ;)

Also, MSDTC = Microsoft Distributed Transaction Coordinator. It is installed when you installed IIS and that kind of stuff. Uninstall those and reinstall. BTW, me thinks that you have 2K server. Try with 2K Wkstn....

Hmmm what else. BTW, if GFlags app is not there for 2K, I think the only way would be do an reinstall of the OS ....

What else.....????

Signed,
-- FoxThree
Cenobitez
03-31-2002, 01:20 PM
I had Win2k Server but my Connection to the net wouldnt work with it, u may all boo and jeer me now, I have the sunk to the bottom, i have a Dell Machine with AOL as my ISP :(

I'm running Win2k Pro but i do have IIS installed, Im learning to do soem asp, and i couldnt find a crack for Chilliasp heh...

My Contact is up with them soon.... At the time i signed up, they was one of the first ISP in the UK to offer Unlimited Acess for a set price, and they dont cut me off every few hours, every 150+ hours yeah, but not every 4 heh...

I'll look for this global flags things, as for the reset thing, Dell do not give any tech info at all, they dont want "Script Kids" as they call them playing with there stuff...

The Dell Engineer told me this, when he comes into work again, il ask him about that RESET thing, see if he will tell me.....

Could u not use a API Hook and look for the WM_Shutdown call ? when i press my lil button on my pretty lil black dell box windows pops up the shut down dialog, if i press it again it resets, so it must send a call to windows....

Imma go hunt now for Gflags....

_________
Steve
Cenobitez
03-31-2002, 01:30 PM
Application popup: WebReaper.exe - Application Error : The instruction at "0x0040f1c5" referenced memory at "0x00000004". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

This is a typical Message, I get these every time i try and close a program or compile a program, or open folders, just every few mins
KurtzHz
03-31-2002, 07:03 PM
From Compuware Knowledgebase Article (http://nashua.compuware.com/support/knowledgebase/docs/1238.htm)

Q: SoftICE disables read-only memory protection on my Windows 2000 machine. How can I enable it again?
A: The DriverStudio installation disables the kernel write-protection functionality added to Windows 2000. To re-enable Windows 2000, kernel write protection functionality, set the following DWORD registry value:
HKLM\System\CurrentControlSet\Control\Session Manager\Memory Managment\EnforceWriteProtection = 1
SoftICE does not load when you set this value.
Thats all you need, hopefully ;) You can find gflags.exe on the W2K Support Tools CD, and in other places too. If you really need it, pm me, its only 23k:p
Woodmann
03-31-2002, 09:17 PM
Hi,
Webreaper is a retrieval program, if you still get
the error after you fix the memory, you can delete and re-install
if you want.
Dell offers an f2 key into "system setup" useless.
They also have a diagnostics program on the cd that came
with the system, I'm too lazy to run it and see what it does.
I guess they just dont want me to change anything on "my"
computer.
So, I'm still stuck with this uesless button with no function......

Peace, Woodmann
Snatch
04-01-2002, 01:14 AM
Originally posted by Cenobitez
Application popup: WebReaper.exe - Application Error : The instruction at "0x0040f1c5" referenced memory at "0x00000004". The memory could not be "read".

Click on OK to terminate the program
Click on CANCEL to debug the program

This is a typical Message, I get these every time i try and close a program or compile a program, or open folders, just every few mins

ummm how come your post is wider than all the rest that is very weird!

Snatch
DakienDX
04-01-2002, 08:23 AM
Hello Snatch !

If you format some text with the [ code ] tags, it is all put in courier, no spaces are stripped and no line break is inserted where the user hasn't made one.

I could look at Cenobitez's post normally (1600x1200), but your quote of the post put it out of my screen. ;)
Cenobitez
04-01-2002, 12:33 PM
Ugh now Internet Explorer is telling me, that the memory cannot be written and illopping everytime, when i do get it to run i cant access the net.... Its really odd coz the inet control used in AOL (Client) is working fine but IE is not...

Grrrrrrrrrrrr so i have nothing outside of AOL that works at the mo, no email no nothing....

Anyone know how to reset Internet Exlorer to its default values ?

Also anyone know where the options file for Add/Remove Programs lives ? i mean the one where it shows whats on ans whats not the list like

HIDE Invis Entry
Visi Entry
Visi Entry
HIDE Invis Entry

There used to be a file on Windows ME that was similer to that, does this exist on Win2k ? I need to be able to make Explorer Visible on the Add/Remove list so i can try and use the Repair option.... ummmm

i think i need to start buring all my stuff to CD and formatting again..... Oh what i fun easter i have had heh....

On the Useless Keys, have u tried Using the Hot Key mapping API ? Wil (4oh4) has written a small program in ASM that remaps some keys, could u not remap it ? with a small app that runs on start up ?

I have a VB Example somewhere, as far as im awear u can re-map any key, as will did, he unintentionally remapped the V key heh, he wasnt impressed with the number of times u use the V key that was doing something else heh..

________
Steve
Cenobitez
04-01-2002, 12:47 PM
Option Explicit

'********************************************************
' DECLARATIONS NEEDED TO INTERCEPT WINDOW MESSAGES *
'********************************************************

Public Declare Function SetWindowLong Lib "USER32" Alias "SetWindowLongA" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Public Declare Function CallWindowProc Lib "USER32" Alias "CallWindowProcA" (ByVal OldwndProc As Long, ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long

Public Const GWL_WNDPROC = -4
Public OldwndProc As Long

'********************************************************
' DECLARATIONS NEEDED TO CREATE THE HOTKEY *
'********************************************************

Public Declare Function RegisterHotKey Lib "USER32" (ByVal hWnd As Long, ByVal HotKeyID As Long, ByVal fsModifiers As Long, ByVal vKey As Long) As Long
Public Declare Function UnregisterHotKey Lib "USER32" (ByVal hWnd As Long, ByVal HotKeyID As Long) As Long

Public Const WM_HOTKEY = &H312
Public Const WM_NCDESTROY = &H82

Public HotKeyID(12) As Long

Public Function WindowProc(ByVal hWnd As Long, ByVal WindowMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long

'This is where all the messages for this form as directed to
'We will need to check for the WindowMessage WM_HOTKEY
'to see if a hotkey is pressed and then we need
'To check the wParam to see which HotKey (1-12) has been pressed

Select Case WindowMsg
Case WM_HOTKEY
Select Case wParam
Case HotKeyID(12)
'Put form on top, and slide up/down
MsgBox "Slinding, and ontop"
End Select
End Select

'No matter what happens we *always* end with the normal
'window procedure to finish/handle the message by
'calling the CallWindowProc.
WindowProc = CallWindowProc(OldwndProc, hWnd, WindowMsg, wParam, lParam)

End Function

--------------------------------------------------------------------------------

This is my main form (frmMain)

code:--------------------------------------------------------------------------------
public Sub SetHotKey()
HotKey = 12
Call DeleteHotkey
End If

End Sub
Public Sub Cleanup()

HotKey = 12
Call DeleteHotkey

End Sub
Public Sub CreateHotkey()

Dim ReturnValue As Long
HotKeyID(HotKey) = HotKey

HotKey = HotKey + 111
ReturnValue = RegisterHotKey(hWnd, HotKeyID(HotKey - 111), 0, HotKey)

End Sub

Public Sub DeleteHotkey()

Dim ReturnValue As Long
ReturnValue = UnregisterHotKey(hWnd, HotKeyID(HotKey))

End Sub

How do you format to VB Code ? is it like [ VBCODE] and [ /VBCODE] ?
peterg70
04-01-2002, 12:48 PM
sorry no answer to your problem but

There used to be a file on Windows ME that was similer to that, does this exist on Win2k ? I need to be able to make Explorer Visible on the Add/Remove list so i can try and use the Repair option.... ummmm

Whats the file under Windows ME (I thought it was in the registry and this listed what was install etc)

peterg70


it's me again with more question :>
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > it's me again with more question :>
PDA

View Full Version : it's me again with more question :>

crUsAdEr
03-30-2002, 11:29 PM
Hi folks,

yap it's me again.. asking more question than ever....

I am reversing this app, and i want to inject some code into this routine that is shared by a few buttons... I need to know which button was clicked so that i can patch appropriately... how should i go about finding the handle for the sender of this routine... it is a Delphi app!!!

Thanx.
foxthree
03-31-2002, 09:04 AM
Hi binh:

You can do this by running Spy ++ and noting down the handle of those buttons. Then in SICE, do a bmsg (ie breakpoint on messages) and set a WM_COMMAND with BN_CLICKED. You can look up the definitions of these in MSDN.

But as for code injecting, you'll have to trap the WM_COMMAND itself (i.e. subclass the window containing these buttons) such that button click notifications arrive to your function and you can then play "master".

Hope this helps,

Signed,
-- FoxThree
LaptoniC
03-31-2002, 09:47 AM
Delphi apps are little bit different.Ifyou dissamble with dede you can see the events when buttons are clicked like Button1Click etc.You can change this functions.Also in Dafixer's site there is a tutorial by him about adding functionality existing delphi apps.
hxxp://www.balbaro.com/dafixer/D1.html
foxthree
03-31-2002, 10:15 AM
Man, I must be getting old. Ofcourse, try to disassemble the program using DeDe. You'll get a few laughs ;)

Signed,
-- FoxThree

... er, unless ofcourse it is obfuscated by one of the delphi manglers :(
crUsAdEr
03-31-2002, 02:38 PM
Thanx, guys

Yep, Delphi apps are more different... yeah i have read Dafixer's tutorial before and Dede is such a lovely tool... but i am still having problem... ah well since when we dont get problems :>... but hopefully someone can tell me where i did wrong...

Okie.... I wanted to add OnClick event on one of the label, so i go to the resource section (DFM), add in OnClick : Label1Click...

Then i go to the declration section in data section, increase the number of procedure declared in form 1 from 8 to 9 (1 more)... then i inserted a new procedure, with the same format as other procedure, aka : Hint, VA, ProcName
0000 0050 4000 0BLabel1Click
(of course Label1Click was in Hex :>>>)

Yeah then i adjustted the caption etc so that the offset of others are same, ( i got lots of stream read error befoer getting this right)... so now Dede decompile it fine... it recognise my added procedure but when i run the prog, i get this error, Label.OnClick : invalid operand.....

When i change Label1OnClick to button1Click (an proc from the original program), it runs fine and when i clicked on label1, itperform button1click procedure.. but if i change this button1click to label1 click it reports the error...

So my question is do I have to declare my new added proc somewhere else as well before i can call it? (make sense but a search in the exe file for name of the original proc did not yield any other info :<.... Hope i made myself clear... somehow i feel that you would not understand what i am writing about :<<<.

Ah well... that is all... hopefully soemone can tell me what is wrong?

P.S : DaFixer tutorial only includes modifying event handler of existign procedure, not adding new one....
nikolatesla20
04-08-2002, 04:57 AM
The only thing I can think of is that you have not accounted for the appropriate parameters that are to be passed to the OnClick function, and hence the "invalid parameter" message ?

-nt20


IID King problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IID King problem
PDA

View Full Version : IID King problem

crUsAdEr
03-31-2002, 03:12 PM
Yep, i am having problem with IDD King... does it work on win2k, the readme did not say anything so i assume it works fine...

However, when i try to add any import to any prog, the prog wont run with a Initialisation error (the same one as when out unoacked prog has wrong IAT)... i checked it with LordPE, the imports are there all fine.... compare the 2 files to see the changes, it all seems fine... except that it wont f******* run....

Argh.. this delphi reversing project has gone horriblly wrong... nothign seems to work... guess i am just lousy.. should stick to cracking only ....

Cheers mate... i am really fed up with 2 days gone and no progress, gonna chill out with some cavari and vodka..
foxthree
03-31-2002, 05:26 PM
Hi there:

There may be problems in IIDKing. Ran into one of the similar ones myself. Did u try with PEditor? It seems to work fine for me.

Signed,
-- FoxThree
me8
04-01-2002, 01:17 PM
had same problem some time, modified prog refused to work on w2k..
+SplAj
04-02-2002, 07:06 AM
hi bin81....

why r u using IIDK to add imports ?????

In another thread you told of LordPE RTS version......so why don't you use it to make manual imports ;)

Spl/\j
crUsAdEr
04-02-2002, 08:46 AM
Yeah thanx for the replay :>....

I just wanted to test out new tools here and there... totally forgot about PEditor and LordPE like fox3 and u said :>>>.... thanx guys

But i guess i must agree with Dakien... use your brain... i tried manually adding import... took less than 5 mins and it runs smooth :>... brain and brain is all i need.. if only i have a better one.. lol :>>>

Thanx guys...


Reenabling trial for CrypKey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reenabling trial for CrypKey
PDA

View Full Version : Reenabling trial for CrypKey

foxthree
04-01-2002, 08:49 AM
Greetings:

I have an CrypKey Protected App in my hands. Unfortunately, that is *7* day trial and in my over curiosity, I burnt all 7 :(.

Is there any way I can re-enable the trial without HD format. I'm sure there is. I searched the board but was unable to find a solution.

My findings are thus far:

- The "esnecil.ind" that marigold writes in his/her tut is no longer used. Deleting it has no effect.

- The app creates a XXXXXXX._rq files (where XXXXXXXX is varying each time the app is run).

- This file is read by the CrypKey Service (crypserv.exe) and analyzed I guess for valid trial.

- If I stop this service and attempt to run the app, I get exception in ntdll!memmove function (himem area).

I will be grateful for any help.

Signed,
-- FoxThree

peterg70: I did try to reverse the SiteKeyGen for CrypKey but alas the program seems to be well written :( . There are multiple checks for CRC-validity of the site code, validity of the site code itself etc. So, what I did was to brute-force enable the generate button and nop all unnecessary instructions and attempt to generate the license key. But, alas nothing shows up in the "Generate" Edit Box (The Copy button next to it is enabled, though :mad: )

Where am I wrong? Pls. advise...
peterg70
04-01-2002, 09:01 AM
Activating the Generate Button is of no use for the crypkey skw.exe file. (I assume you mean this file)

What you need to do is firstly patch so that the program doesn't tell you that the site code is from another company.

Then you need to add an entry into the license config section.

You will need the following from your target
FILENAME :
USERKEY :
PRODID :
COMPANY NUM :
Enter the above info into the config area.
(company num needs to be put into the skw.ini manually)

If you use thewd ckinfo program (nice util) you will be able to determine most of the required information from the MASTER KEY and the USERKEY in your target.

When you enter the sitecode the skw.exe does the following
1) Checks if the sitecode is valid and is the demo company num (patch this)
2) Checks the filename against whats in the config.
3) IF filename found then checks PRODID
4) IF PRODID is correct Checks Company NUM

When generating an AUTHOCODE you will need the password for the program (From the USERKEY via CKINFO)
Check the level and options you need (trap get_level and get_options calls in cryp95X.dll)
and Generate a working authocode code.

If you need more info than this PM me and I will help out as much as I can

peterg70
foxthree
04-01-2002, 09:24 AM
Hi PeterG:

Thanks for your post. It is very informative. I saw this in bits-and-pieces in your earlier posts. Thanks for consolidating everything in this post. I'll surely give this one a try and get back to you, if I need further help.

Thanks,

Signed,
-- FoxThree
foxthree
04-01-2002, 09:39 AM
Hi Guys:

Within 2 mins I find all the necessary inforamation. I just need to patch the invalid Site Code call. And I guess we're done.

Thanks a lot PeterG (couldn't done without you) and Thewd (for the great ckInfo!!!! <--- rocks ;))

BTW, can you explain in detail how the CrypKey protection works for us guys sakes. Even pointers is sufficient.

Signed,
-- FoxThree
peterg70
04-01-2002, 10:12 AM
May be redundant to explain how current system works if the following news from the crapkey website is something to go by

The Calgary based CrypKey team has developed new version 6.0 patent pending technology with upcoming global market launch scheduled April,2002.

Can't wait for the link to download it

and then for a program using it

peterg70
thewd
04-02-2002, 02:22 AM
i'm also looking forward to v6, although the protection shouldn't really change much. Appears to support key generation based on the hard disk serial number, and an EasyLicense option (not sure what this does - couldn't get it to work in the beta version)

ckInfo v1.03+ hopefully should already support this version, providing no major changes have been introduced since the beta.

recent versions of the site key generator application appear to contain the code (and gui support) for generating keys for v6, although it doesn't work because the supporting dlls are based on v5
(to enable gui changes (v5.6.133) - change version byte from 0x38 (v5.6) to 0x3C (v6.0) within skw.exe at address 0x41747B)

regards
thewd
peterg70
04-02-2002, 10:39 AM
thewd

I had noticed those changes being incorporated into the skw.exe for version 6.0 but my thoughts are that the dll required for authorisation etc will be totally new due to the statement about the patent pending.

I have a feeling that the dll will incorporate new hashing etc but then again they can suprise me and release exactly the same dll.

peterg70
glasha
04-02-2002, 10:27 PM
Please send me unpacker of crypkey and all stuff (Blackos)
and thewd you ckinfo is very interesting you can explain me about this ????

i have unprotect all crypkey software loading as export module in Sice cryp95xx.dll and bpx get_authorization, is easily change jg - jnz, but with new version this routine is packed and only permit patch memory

thanks alll !!!

and please send me all stuff about this !!!
lammer
04-04-2002, 05:05 AM
Hi Peterg70:

Thanks a lot for your very informative explanation. Could you send me unpacker of skw.exe.
But what about removing CrypKey protection? Please send me all information and all stuff about this.

Thanks a lot, again.

Best regards,
lammer
peterg70
04-04-2002, 07:20 AM
Firstly

This is not a crack request form. So go and find one if you want answers to the above questions.

Secondly

NO
Work it out for yourself. I never received any file or stuff from anyone. I worked it out myself. Although when I got stuck I asked an intelligent question (NOT give me all info).

Thirdly

I am willing to offer guidance and pointers but I don't do the cracking.
Learn and you shall reap the rewards

Excuse the ramblings
peterg70
lammer
04-04-2002, 02:05 PM
Hi Peterg70!

I understand you. I'm sorry for my not correct question and request.

Best regards,
lammer

PS. Sorry for my english.
thewd
04-05-2002, 05:12 PM
v6 - May 11, 2002
countdown started - hxxp://www.crypkey.com/news/news.html

regards
thewd


Referencing the stack in SI expressions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Referencing the stack in SI expressions
PDA

View Full Version : Referencing the stack in SI expressions

Pyrae
04-02-2002, 10:25 AM
Hi there,
I've got a question concerning conditional breakpoints in softice:
As you know, there are quite some useful API functions that get called very often in a programs initialization phase(RegQueryValueExA, GetPrivateProfileStringA etc.).
Instead of using the bpcount trigger with a guessed value just below the right call, I'd like to make the bp depend on the value of a function parameter (i.e. ValueName to be read, Key to be opened etc.). Of course I know the the order of parameters (from the Win32 API docs) and read the whole SoftICE user guide, but that didn't make me any smarter yet. :(
I always guessed referring to the stack must be something like

bpx RegQueryValueExa if esp-14=='Info' (where "Info" is the value name),

but I didn't succeed so far...

Any info would be very much appreciated.

P.S.
Your forum rocks, Woodmann. Never seen a board with so many advanced reverser's on...
LaptoniC
04-02-2002, 11:51 AM
bpx regqueryvalueexa if*(esp->8)=='Info'
Better search for Rhayader's softice tutorial.It is quite useful
Pyrae
04-02-2002, 12:48 PM
Thanks very much, about as simple as i tought. I'll give that one a try.
Do you refer to Rhayader's part in Torn@do's Cracker's Notes?
I already read that one, but he doesn't give any specific examples inthere.
Aimless
04-03-2002, 11:13 AM
There you go.

I have attached the same.

...Have Phun
Pyrae
04-04-2002, 03:38 AM
Well, that's a different and useful looking one.

Thanks.


I need to trace thru a prog
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I need to trace thru a prog
PDA

View Full Version : I need to trace thru a prog

Crackin_Newbie
04-02-2002, 01:37 PM
this program (repo info) is very difficult for me to follow. I have found that the program registration key is the name of the file that contains registration info (minus the .txt extension). The program runs tat but then it has scripting errors (i think thats right) because of what it expects isnt there, and I am not sure to figure out what it wants. Here's a question for yall: If I break into the program and find the correct flow to register, should I change the program or make a correct registration file ( if the later, does anyone know how I can figure out what the program is looking for in the registration file?)

Anyways, Thanks yall!!!!
Crackin_Newbie
Pyrae
04-02-2002, 01:55 PM
Well, any debugger will do that.

NuMega's SoftICE is the reference tool, but there are quite some other nice ones around, i.e. TRW2000 or OllyDbg.

Looking at your question, I think you're having some reading about this topic ahead. ;)

"/TraceX" is a command in ICEDump, which is a useful addon for SoftICE.
Crackin_Newbie
04-02-2002, 02:09 PM
I have icedump, but dont know how to properly install and use. Any suggestions?

How do u use tracex?
Pyrae
04-02-2002, 02:21 PM
Hmm, I won't write RTFM, but how about reading README.TXT?

I think you're trying to get results too fast - reversing is a time-consuming business...;)

Btw, please continue posting to the first thread.

Pyrae
DakienDX
04-02-2002, 04:28 PM
Hello Crackin_Newbie !

I just merged the two threads to keep it more clear.

As Pyrae said, please RTFM. (Read The FAQ and the Manual ;) )

You can ask questions here after you've tried anything you can imagine.
To learn new things always search, then read, then try to understand and ask only if you've done all you should have done before asking.
Crackin_Newbie
04-04-2002, 08:35 AM
The ice dump i got doesnt have a file that explains installation and usage. Is there a website yall can suggest where I can figure it out?

Thanks and Laterzzzzz
Pyrae
04-04-2002, 10:09 AM
Try h**p://icedump.cjb.net ! As you will see, there are no official docs yet, but the readmes contain enough info to get you started...
DakienDX
04-04-2002, 03:36 PM
Hello Crackin_Newbie !

Where is the big problem? ;)
Just look what SoftICE version you have, go to the directory with the right OS and version number and execute ICEDUMP.EXE.
You'll find anything you need to know in the [OS]\DOC directory. :)

Or do you think ICEDump is a stand-alone application? No, it is not, it is an addon for SoftICE. You can't use ICEDump without SoftICE.
But you would better start to learn how to work with SoftICE before starting with the ICEDump commands.
Crackin_Newbie
04-07-2002, 07:51 AM
That got Ice Dump working, I read files but dont comprehend trace and tracex usage, any suggestions?
Aimless
04-07-2002, 11:42 AM
* Download Ollydbg 1.06

* Load your program

* Select Debug->RunTraceOver (or INTO) as you'd prefer

* As soon as you select, the proggy runs

* Wait till its over, or you reach the point that you want to monitor

* Switch back to OllyDbg, select View->Run Trace

* A window opens with traced instructions AND registers that have changed with each instruction

* Right Click anywhere on that window to save the ENTIRE history to a log file

* WARNING!! Saving the run trace INTO of a commercial app can cause your log file to swell upto 99MBs!!! And that's only for displaying of the main window!!!

* So be careful of what you log

* You can optionally turn off and on the logging

...Have Phun
Crackin_Newbie
04-07-2002, 08:22 PM
I appreciate your help aimless!! I hope it works out how I think it will. May u b blessed !!!!! LOL

More postings to Follow.

Crackin_Newbie 4 Now
Crackin_Newbie
05-05-2002, 09:31 PM
is there a way i can make it just log jmp, je, etc... ?
crUsAdEr
05-05-2002, 09:56 PM
Hi cracking newbie,

I is quite simple to code a jump logger... grab Iczellion's debug API tutorial and you will be acle to write jump logger in asm :>.... It is not that hard....

There is such a prog out there but it is slow cos of single stepping and the file will be big anyway... it is fun to play with it but use it to crack isnt really good, you learn nothing from the protection if you just compare the 2 log files to find the jump...

regards,
crUsAdEr
Crackin_Newbie
05-05-2002, 11:27 PM
I know this is lame way of cracking but this program means alot!! I am so frustrated trying to figure it out. Everytime I think of a way to get what I want, I find I cant do that. LOL
Clandestiny
05-06-2002, 01:41 AM
Originally posted by Crackin_Newbie
I know this is lame way of cracking but this program means alot!! I am so frustrated trying to figure it out.

Quite to the contrary, using a backtrace tool to *analyze* code flow is not a lame approach... A pure jump logger, however, might be pushing the definition of lameness since it takes little intelligent analysis to brute-force-patch every jump you see till you get the right one ;)

Alternately to /tracex and Ollydbg, SoftICE itself posseses the capability to log program execution in a backtrace buffer. A trace is set using the range style breakpoint, bprw.

syntax: bprw "module name" T

I believe Sandman even has a fairly detailed tut on the usage of the SI bactrace buffer if you need more info than is provided in the SoftICE docs. Do a search for "Sandman + Softice Resource Center"

The whole key to *effectively* using the execution backtrace, is your choice of trace range and judicious placement of breakpoint traps. You probably don't want to trace from the OEP of an app, through all of its initialization code, nag screens, ect until you get to the reg dialog or whatever. This can get VERY big (+++Megs), will be unweildly to examine, and provide little meaninful insight into the behavior of your target due to the high level of background noise. You want to use an API monitor or some other tool to select breakpoints that narrow down your range as much as possible. Only then will you get meaninful results. The backtrace is essentially useless unless used intelligently. Unfortunately, SoftICE does not natively have the functionality to log your traces to a file (as it logs only addresses, not opcodes, and disassembles them on the fly via the "show" and "trace" commands). Kayaker and myself are working on an application that will extend the functionality of the winice backtrace buffer to provide this much needed logging feature, but it is not yet publicly available. First, read the manual and then ask if you have further questions not answered in the documentation.

Cheers,
Clandestiny
Aimless
05-07-2002, 09:53 AM
Either that, or:

1. ALL windows program have an application called FIND.EXE
2. Run that on your 1 GB file and get all words starting with J* and CALL

If you are using ICE, you can set a BPR on the entire application with the condition that the first byte of each instruction corresponds to a jump/jnz/jz/etc.. or a CALL. (warning: this may become a BIG breakpoint. Better to put it as a macro). Also put a action to ^G after the condition so that you do not pop into softice every time a j*/call is encountered, and yet all the same are logged into your command windows.

And hey, keep that video buffer high !!

...Have Phun
Crackin_Newbie
05-21-2002, 07:11 PM
this program (repo info) is very difficult for me to follow. I have found that the program registration key is the name of the file that contains registration info (minus the .txt extension). The program runs tat but then it has scripting errors (i think thats right) because of what it expects isnt there, and I am not sure to figure out what it wants. Here's a question for yall: If I break into the program and find the correct flow to register, should I change the program or make a correct registration file ( if the later, does anyone know how I can figure out what the program is looking for in the registration file?)

ps/ what search engine yall recomend when searching for sandmans tuts and other good cracking resources?

pss/ Truthfully I appreciate everything !!! Yall have been a damn good help!!

Anyways, Thanks yall!!!!
Crackin_Newbie
Crackin_Newbie
05-25-2002, 04:05 AM
I am seeking out how to find out what is needed in a registration type file. Repo Info wants somethings in the file but I am not sure what that is, is there a tut or anything to help me figure it out, if there is, please tell me where i might find it or a name of file and search enging to use to find it. Also I get lost real quick trying to follow the program code. I know it should be too hard to find the jmp that causes it to expire when the time runs out. I am getting stressed on this. I got tuts out the @ss and have tried there approaches and to no avail yet. I ve tried logging but I get so much logged that i dont have the HD space . Any more helpful suggestions? Thanks again. Pe@ce!


Protexis commercial protection (DivX5)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Protexis commercial protection (DivX5)
PDA

View Full Version : Protexis commercial protection (DivX5)

Pyrae
04-02-2002, 02:39 PM
Hi guys,
I need help with some strange looking unpacker/decryptor code (see snipet below), maybe somebody already took a look at it as it's used in both versions of the recent DivX 5.0 Pro Codec (ad-supported & retail versions).
The protector has been developed by Protexis (http://www.protexis.com).
The main DLL is crypted and a lib named psikey.dll (some anti-dasm stuff, no encryption), which performs key setup and validation routines, is copied to your SysDir.
The protected DIVX.DLL contains 8 sections of which the 7th (.data) obviously contains the decryptor code.
So I replaced the first opcode (pushad) by CCh to break on INT3 and adjusted things in SoftICE accordingly - but this messed up the whole thing and a nonsense-msgbox was displayed.
How is this possible when it is the first instruction of the whole protected module that is executed? And how can the further code be executed following the snippet below?

Here is the mentioned code snippet:

divx.dll (5.0 PRO GAIN):

.1015F000 90 nop (start of .data section)
.1015F001 60 pushad (code entry point)
.1015F002 E803000000 call .1015F00A (see code snippet below)
.1015F007 E9EB045D45 jmp 0456434F7 (invalid?)
.1015F00C 55 push ebp
.1015F00D C3 ret

called from .1015F002:

.1015F00A 5D pop ebp
.1015F00B 45 inc ebp
.1015F00C 55 push ebp
.1015F00D C3 ret

Thanks a lot, Pyrae
DakienDX
04-02-2002, 04:17 PM
Hello Pyrae !

I'm sorry, but I've to correct your post a bit. :(

Only the full version of DivX Pro 5.0 comes with the PSIKEY.DLL file. The add-supported version hasn't this file because it can't be registered.
If you look at the retail and ad-supported version you'll find out very soon that they use the same protector to prevent reversing. And this is not the one by Protexis. The Protexis system is only used to register the full version, it is called from the DIVX.DLL.
The fact that the protection is located in an external .DLL doesn't make it look very secure.
The nice message box you get when you change a bit in DIVX.DLL has nothing to do with Protexis.

So if you just want to register DivX Pro, get the ad-supported version and remove the "ad-supported".
If you're interested in reversing the protection go on and find a way to bypass the little messagebox.
After that start reversing the Protexis part.
Pyrae
04-02-2002, 05:53 PM
Hi Dakien, thanks for your fast reply and sorry for being imprecise. Of course you're right and psikey.dll is only required for the retail version.
Concerning the PE cryptor, well, I just guessed that it is part of the Protexis system, but it may be a self-made one as well.
The first thing I did (as you wrote: unencrypted external dlls do not seem very secure) was patching functions in the psikey.dll, but even if all relevant exports give back correct results (I used the DAMN keymaker to compare the results each function delivers) the codec produced crappy results, so chances are that there's some key calculation (from serial and activation key) involved at a very low level (i.e. some flags or vars are set, which I'm not yet aware of).
As my primary goal was to unwrap the main dll completely and patch it in some way to have a codec that doesn't require any license info or the ad-ware registry entries, I decided to tamper with the PE cryptor to unpack the ad-supported version, so I can patch it to not require those gator entries. But that's were my problems arise: Looking at the decryptor start code (see above), I simply don't see how this routine can escape out of this snippet to check it's validity (probably by using in-memory checksums?).
DakienDX
04-02-2002, 07:43 PM
Hello Pyrae !

But it may be a well-known one as well. ;)

No reversing work is needed for this target. Just use your brain. ;)

Else you might want to trace the startup code and find out how it works yourself. It's really easy. It will escape. (Yes, there are also in-memory checksums)
Pyrae
04-03-2002, 05:52 AM
Uhoh right, please don't beat me. ;)
Guess I just didn't tamper enough with ASPack/ASProtect yet...

Nevertheless, thanks for your kind replies, Dakien.

so long, Pyrae


Quick One
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Quick One
PDA

View Full Version : Quick One

peterg70
04-03-2002, 12:02 PM
I have file which a VB file but it has a database of people names address inside it.

I want to extract the data. The data is in unicode (64 00 65 00) and its visible.

Any Ideas thoughts

peterg70
+SplAj
04-03-2002, 02:20 PM
Ultraedit 9 can convert all sorts ;)


Hooking serialport
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hooking serialport
PDA

View Full Version : Hooking serialport

Rattle
04-03-2002, 01:38 PM
Hi,
I'm trying to monitor/change data sent/receiver to a serialport by hooking kernel32.dll. I have created a hook for CreateFileA and ReadFile/WriteFile and it's working great on my own VC++ written software. But when trying to hook CreateFileA in software written in VB or Delphi it doesn't work. Looking at the imports with W32Dasm I can see that it uses CreateFileA. Any Tip?

I use the code found at http://www.codeguru.com/dll/apihijack.shtml

/Rattle - a newbie ;)


How to get section to load right?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to get section to load right?
PDA

View Full Version : How to get section to load right?

Lbolt99
04-03-2002, 04:49 PM
Hello,

I'm trying to add a section to the end of a EXE file. It's a dump of some internally decrypted code and what I'm trying to do it replace the decryption routine with a mem copy routine to just grab the decryped data out of memory and copy it to the correct place. Unfortunately the routine is too big to place somewhere in the regular code section.. or attach to the end of the code section. So I tried to add a section. Used PEditor, added it, changed image size, that seemed to work fine, but Softice doesn't seem to want to "see" it. I just get INVALIDs when trying to view that memory, Sice says "Page not loaded"?? Not sure what to do here? It does label the section as PROGRAM.newsection, but the data area is filled with '??'

Any help is appreciated :)
crUsAdEr
04-03-2002, 07:26 PM
Hi,

I think you just have to wait until that new section code is executed, then sice will display it... it happens to me all the time too, when i trace into that area, sice will automatically page in the memory section.. or you can try the pagein command but i am not sure if it works :>

Hope this helps,

Cheers
foxthree
04-04-2002, 05:48 PM
Just a thought. Did you fix the PEHeader which contains the sections count? I'm sure PEditor would've done this for you already byt just in case, verify this :)

Signed,
-- FoxThree
nikolatesla20
04-08-2002, 04:52 AM
I just got thru seeing the same thing on my system, the solution was to use the pagein command. Apparently the OS doesn't bother loading a disk page into memory until it is used. You can force it to load by using pagein with the memory address of your new section.

ALso, rest assured that even if you cannot see it in SoftIce right away, if you have code that is to be executed it will work.

-nt20


what bpx to set for wise install password ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > what bpx to set for wise install password ?
PDA

View Full Version : what bpx to set for wise install password ?

Nemesis]
04-03-2002, 06:51 PM
hi all please help newibe here my english not good.
what bpx to set for wise install password ? or any hint tip !

thank you
Nemesis]
me8
04-04-2002, 10:07 AM
unpack instaler exe with wise unpacker or smth like that, check out protools.cjb.net
LaptoniC
04-04-2002, 01:55 PM
I dont know you guys already know this but here is quick way to unpack wise setup.
run setup with X parameter like
setup /X
it will show you nice unpack dialog.

For the password thing,you need wise unpacker.Unpack setup and hex edit script.bin or wise.002 .Go to 25h offset and xor every byte with 255 you will get the password.
CTRL-D
04-08-2002, 10:55 AM
Laptonic:

very, very good info !!!!!

cheers for that

k4
dipeshrestha
04-09-2002, 09:34 AM
Nice idea, laptonic

i didnt know that.

thanx a lot ;)


IVT format?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IVT format?
PDA

View Full Version : IVT format?

crUsAdEr
04-03-2002, 10:20 PM
Hi folks,

Can someone provide me some links discussing the Interrupt Vector Table structure (aka the format layout) and perhaps some reading about interrupt handling and setting etc... I am getting annoyed by all this anti tracing trick :<<... guess i have to pick it up anyway....

Thanx
Clandestiny
04-04-2002, 12:59 AM
Originally posted by binh81
Can someone provide me some links discussing the Interrupt Vector Table structure (aka the format layout) and perhaps some reading about interrupt handling and setting etc... I am getting annoyed by all this anti tracing trick :<<... guess i have to pick it up anyway....

Hiya,

I'll have a go at answering your question due to the fact, I've had the need to hook interrupts in the project I've been working on with Kayaker. With this said, I'm really a complete newbie on these topics so I'll appreciate it if anyone with a good grasp of systems level programming sees fit to patch up any holes in my current understanding of these matters.

There are actually 2 internal structures used by the processor for interrupt handling. The first is the Interrupt Vector Table (IVT) which is used in Real Mode. It consists of 4 byte entries containing far pointers to the interrupt handler procedures. The second table, called the Interrupt Descriptor Table, is used for handling interrupts in Protected Mode. In contrast the the IVT, the IDT consists of 8 byte descriptors which contain the segment and offset address of the interrupt service routine. Interestingly, the IDT is relocatable.

The ASM instructions for dealing with the IDT are the LIDT and SIDT commands. The SIDT (store interrupt descriptor table) command loads the size and location of the interrupt descriptor into an fword (6 byte) variable. If hooking an interrupt, you will use this command to get the base location of the interrupt descriptor table. The descriptors for each interrupt are indexed as offsets from this address.

For example, the INT 3 descriptor would be located at:
Base_IDT_Address (obtained from SIDT command) +[ 8 (size of each descriptor) * 3 (interrupt number)]

For the actual strucure of the descriptors, I'll refer you to an excellent doc which I'm attaching to this post... A picture really is worth a thousand words here ;)

Similarly, one might use the LIDT (load interrupt descriptor table) to relocate the interrupt descriptor table or to change it's size. When I was reasearching this, I found it intriguing that one might actually enlarge the interrupt descriptor table to create their own "user defined" interrupts above and beyond the normal 256.

It is also important to note that ones interrupt service routine (ISR) needs to reside in non-pagable memory, in a locked code segment inside a VxD. Heh, hooking the IDT so it calls your handler is the easy part ;) ...It's *inside* the ISR that the real fun begins... LOL, I've been finding this out the hard way recently. First, you have the issue of reentrancy. This can be partially solved by disabling interrupts around critical code sections using the cli instruction and by using dynamcially allocated variables. Beyond reentrancy, synchronization issues rear their ugly heads... For example, its impossible to do file I/O or memory allocation in the context of an interrupt handler. In such cases, it may be necessary to schedule an "event callback" to do this type of processing for you. In a real-time situation this synchronization is a *nightmare*. As far as I can tell, you're not guaranteed the VMM will even execute your event callbacks sequentially and the usage of synchronization structures like Sempahores and Mutexes appear to be questionable in context of an ISR. Indeed, the only safe functions to call are those labled as "asynchronous" in the documentation. Beyond these restrictions, it is desirable to keep your ISR as short and optomized as possilbe. Did I mention how much "fun" debugging an ISR with asynchronous callbacks can be ;) Sorry, if I got of on a tangent here... Maybe this last stuff is not related to "cracking" per se, but I'm just discovering these "fun" synchronization problems so I thought I'd note them while they're fresh in my mind.

Anyway, here's part of my VxD's ISR routine which you can use as an example to see how an interrupt is hooked.

;================================Begin Hook_INT Proc==================================
BeginProc Hook_INT

;-------------------------------------------------------------------------
; Assume ebx contains the # of the interrupt you want to hook and edx
; contains a pointer to the new interrupt handler procedure you want to
; install.
;-------------------------------------------------------------------------
;INT 1

pushad ; save registers

;--------------------------------------------------
; SIDT stores the Interrupt Descriptor Table (IDT)
; Register into the specified operand
;--------------------------------------------------
sidt IDTR ; IDTR is variable to hold base address of IDT

;------------------------------------------------
; Get index into IDT for the int we want to hook
;------------------------------------------------
push edx ;save handler address
mov eax, 08h ; mov 08 multiplier in eax
mul dword ptr ebx ; mul with interrupt number in ebx
add eax, dword ptr [IDTR+2] ; add to base address of IDT + 2 bytes
; offset of INT x handler in eax

;------------------------------------------------
; Save the original INT handler
;------------------------------------------------
push ebx
mov ebx, Index
pop IntNumber[ebx] ; save interrupt # for lookup of handler later
mov cx,[eax+06h] ; get the low word part of the offset from the IDT
shl ecx,010h ; shift into high word position in register
mov cx,[eax] ; get the high word part of the offset from the IDT
push ecx
pop SaveOldInt[ebx] ; save old INT handler
add Index,4 ;increment index to point to next location in arrays

;-------------------------------------------------
; Replace original INT handler with our new one
;-------------------------------------------------
pop edx
cli ; ignore maskable external interrupts
mov [eax],dx ; modify the high word part of the offset
shr edx,010h ; shift into low word position in register
mov [eax+6],dx ; modify the low word part of the offset
sti ; resume responding to interrupts

clc
popad
mov eax, 1 ; if got here return TRUE
ret
EndProc Hook_INT
;==================================End Hook_INT Proc==================================

Hope this answers part of your question...

Cheers,
Clandestiny

PS. If you email me, I'll be happy to send you my "research" on the IDT, ISR's, reentrancy, and synchronization issues.
crUsAdEr
04-04-2002, 01:14 AM
Thanx a lot Clandestiny,

This is far more than i expect... thanx a lot for the stuff.. it's great :>... slightly over my knowledge at teh moment, digesting the intel manual here andthere first... thanx for the pointer... shall do a bit of research myself before troublign u to spoonfeed me but i shall email u if i need further info...

Thanx a LOT!!!!!
evaluator
04-04-2002, 08:04 AM
You shoud look at Y0DA's CreateINT!
Grab it from Y0DA's site.

(W98 only)
crUsAdEr
04-04-2002, 05:25 PM
hi,

thanx for the input, shall look into y0da's code, thanx eval...

Just another question, how do i debug my implementation? cos when i trace the prog with sice, interrupt seems to be suspended.. guess basically this is how program tricks newbie who trace and trace and gets nowhere...

Like i have tried an int1 for div by 0, but the handler is not called,.. sice trace on :<....

Tried int6 by putting garbage opcode... sice goes on :<... or crashed???

Thanx... what must i do to trigger this when i am debugging it?
evaluator
04-04-2002, 05:38 PM
If you will change INT1 you must not trace with
SICE! It is Debugger's default handler.
So I recomend you make tests on INT5
Clandestiny
04-05-2002, 12:03 AM
Hiya binh81,

As evaluator says, you cannot hook the int 1 AND be able to trace it in SoftICE. The int 1 is the processor's "single step" exception fault. SoftICE hooks the int 1 itself to provide the functionality for tracing your code. If you hook this interrupt, you short-circuit your ability to trace your own code ;)

Also,in my previous post, I think I neglected to mention the issue of chaining your ISR back to the previous handler. When you hook, you're replacing the default handler with your own... BUT what happens to the old handler??? At this point you have the choice to chain or not to chain. Basically, chaining involves calling the old handler either before or after execution of your own handler. Calling it before is termed "pre-execution" chaining and calling it afterward is termed "post-execution" chaining.

The post execution chaining technique is as simple as executing a
pushfd and far call. Remember, when the interrupt handler is called, 3 things are pushed on the stack...

1) the flags register
2) the code segment selector
3) the offset address

Similarly, the iretd instruction pops all three of these values off the stack. When chaining, you are in essence "emulating" an iretd instruction by manually pushing the flags and far calling the old interrupt handler.

It is not always necessary to chain... But its probably good programming practice. Consider... What if the VMM default handler (or even another driver) needs to execute some default code in response to that interrupt you just hooked... Well, if you don't chain, you've just short-circuited that functionality which may / may not result in a crash depending on how critical that code was that you bypassed.

BTW, the int 6 invalid opcode should work. It's what I've been using. I have inserted an int 1 into the ISR code and set "i1here on" in SoftICE for debugging. If your handler is doing anything much, you should also consider the problem of reentrancy. If your ISR isn't too long, disabling interrupts while your handler runs might solve the problem.

Cheers,
Clandestiny
crUsAdEr
04-05-2002, 11:49 AM
Thanx Clandestiny,

Hee... it was my fault... my coding is crap :>... i hooked the wrong interrupt.... now that i re-read 386intel.txt i realise that i have been doing it all wrong :>... virtually messed up my IDT.. no wonder my system crashed :>... was swearing and cursing Clandestiny for sabotaging me by giving me the wrong info :>.. (just KIDDING)... thanx a lot... you are really helpful...

Yeah, it kinda works now... i am not coding anything at the moment, no where near that level of competency yet:<.. i just wanted to play with it and understand how all these anti tracing works by interrupt hooking...

Guess i have a rough idea now, but is there anyway i can trigger int1 in sice still? So that i can bypass anti tracing code?

Thanx,
Clandestiny
04-08-2002, 03:09 AM
Originally posted by binh81
Thanx Clandestiny,

Hee... it was my fault... my coding is crap :>... i hooked the wrong interrupt.... now that i re-read 386intel.txt i realise that i have been doing it all wrong :>... virtually messed up my IDT.. no wonder my

system crashed :>... was swearing and cursing Clandestiny for sabotaging me by giving me the wrong info :>.. (just KIDDING)... thanx a lot... you are really helpful...

Glad the info was helpful :) I'm really just now learning most of this myself for the project Kayaker and I have been working on... As they say, necessity is the mother of invention ;)

Guess i have a rough idea now, but is there anyway i can trigger int1 in sice still? So that i can bypass anti tracing code?

Hmm, this isn't really my area of expertise... At this point, I've played more with coding interrupt based stuff than cracking it, but I have read a couple of interesting articles and speculated a little bit. Here's one that poses some interesting possiblites...

http://www.humancapitall.com/arunkoshy/art_tunnel.htm

It talks about a technique called "recursive tunneling" This is a technique some virus scanners apparently use to trace chained ISRS and redirect the interrupt around the virus handler code back to the original system handler.

Here's the official definition:
“Tunneling collectively refers to the techniques, algorithms, and ways of tracing code attached to a particular interrupt, and then finding the original DOS/BIOS code. This in turn can be used to bypass all memory-resident programs including viruses, which have trapped the interrupt. Mostly it’s INT 21h and INT 13h which are modified.”

When I read this article, I wondered if these types of techniques could be also applied to protection / deprotection schemes... Say, for example a prog hooks one of SI's interrupts to do some nasties. Would it be possible to trace the interrupt handlers back to original segment of winice code similarily to the way the article speaks of locating the original DOS / BIOS code and then redirect the interrupt back to winice where it belongs?

Conversely, could a protection use this technique to short-circuit the interrupts SI hooks (ie. trace the ISR's back to the original default handlers and redirect the interrupts around SoftICE back to the original handlers)?

Anyway, this is all hypothetical here since I'm still pretty new to the interrupt stuff myself ;) They're just a few interesting concepts and ideas I'd like to look into eventually.

Here's another thread from the mini project forum that might prove interesting to you. I guess it would blow the above mentioned tunneling technique out of the water though since the tunneling technique relies on the trap flag ;) This anti-trace example involves the use of the undocumented int 1 opcode and a structured execption handler to catch tracing and redirect code to the bad-boy routine.

http://www.woodmann.net/forum/showthread.php?threadid=2634&perpage=15&pagenumber=2

Cheers :)
Clandestiny
crUsAdEr
04-08-2002, 11:41 AM
Hi,

Thanx Clandestiny... Yeah i am aware of the thread you were talking about... great reading by ZaiRon and Kayaker...

I DID email the_analyst to ask him about how to trigger the int1 and bypass the anti-tracing, he did replied but i wasnt very clear what he meant :<...

Yeah, the recursive tunnelling articale is a great read, really easy to understand... i guess it is possible to do that if you can incorporate Tseph's tracer... and provided that the virus/programmer did chain the original interrupt handler...

but, just a thought... isnt the interrupt handler routine always fixed depending on the version of windows? I always assume that each OS version will have all this info at a fixed address.. so maybe the search for the original int handler routine is used so that it works on all version on Windoze??

And also, we might run into troubles if there are a few hooking... not quite sure how possible it is... but if a few service is hooking the same interrupt, chaining itself one after another then we might run into trouble doing this "recursive tunnelling"...

Just a few thoughts...

Off to read more... :>..

cheers,


Mow???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Mow???
PDA

View Full Version : Mow???

crUsAdEr
04-03-2002, 10:25 PM
I have heard of usage of this nice and handy tools... soem od the old thread talked about its usage, sound really good... is it the same as Imhotep by Arthaxerxes?

Does anyone have a working link for it?

Thanx
fALC0N
04-06-2002, 12:57 AM
I had searched for it too..

Have fun
crUsAdEr
04-06-2002, 11:10 AM
Thanx man...

i searched high and low...

crUsAdEr


Miracode
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Miracode
PDA

View Full Version : Miracode

Eternal Bliss
04-04-2002, 02:51 PM
Interesting... with links to us...
h**p://miracode.com/index.htm

But doesn't actually tells us how it works...
DakienDX
04-04-2002, 04:11 PM
Hello Eternal Bliss !

Interesting... with links to Astalavista...

I don't feel we've anything in common with Astalavista, expect maybe the "research" aspect.
If there wouldn't be any new protections claiming to be unbreakable we would been unemployed. ;)
And if they're not public they'll stay "unbreakable" a bit longer. :(
IcyDee
04-05-2002, 09:13 PM
They seem to emphasise the ability to program into the program the ability to degrade operation (by for example corrupting output files or graphic images) if the main time limit check is bypassed. They don't however say anything about preventing regmon or filemon from finding all of the checks and without patching turning the clock back to regain the trial period.

The method they use to put the code into the program is by modification to the source code. There is no mention of anti-reverse-engineering code, anti-softice or self CRC checks. On the whole I think this is a pretty lame protection. A nice concept but unworkable since very few people are going to want to compile in their protection.
cyberheg
04-07-2002, 10:11 AM
I also think the idea is good but I doubt it's unbreakable. They give examples about a plaint prog which might start to work strangely, give bad results etc. All one would need is time to get the full hang of the protection.

However downloading the demo sdk I found a few interesting things:

First thing is that the protection prog is fully made in asm. It's even listed what compiler settings was used to build it. I noticed there was alot of 4 nop instruction sequences but if it's not selfmade it must be alignment which is overkill then since many places those 4 nop's are placed in the middle of the code.

I was able to kill the trial use (100 runs /10 days) in just 15 min finding that the prog stores them in HKLM\SOFTWARE\Miracode in the key DAVID.1.0.PE1. Atleast on my machine it got reset after deleting this key.

Alot strings inside david.exe are "encrypted". A quick idc script solved this problem for me. Most of the places are encrypted using a hardcoded byte for xor'ing until the current byte will become 0:

#include "idc.idc"

static main()
{

auto b, ea;

ea = 0x427979;

while(Byte(ea) != 0)
{
b = Byte(ea) ^ 0x4b;
PatchByte(ea, b);

Message("Current addr: 0x%x Content: 0x%x\n", ea, Byte(ea));
ea++;

}

}
---------------

As for obfuscation the technique isn't anything outstanding. Alot api's are not visible in ida because their addresses are calculated at runtime. The following show this:

.text:0040E8FC mov dword_427999, (offset CloseHandle+1)
.text:0040E906 sub dword_427999, 49h
.text:0040E90D push offset aGGEfnfJfdyFY ; "~`g'`g`\tefnf$jfdy\tf|}y|}\t"
.text:0040E912 push 4
.text:0040E914 push offset word_4279A3
.text:0040E919 push (offset aGGEfnfJfdyFY+12h)
.text:0040E91E push (offset aGGEfnfJfdyFY+8)
.text:0040E923 call dword_427999
.text:0040E929 cmp eax, 0
.text:0040E92C jnz short loc_40E942
.text:0040E92E nop
.text:0040E92F nop
.text:0040E930 nop
.text:0040E931 nop

It first puts a address into dword_427999 and then subtracts it with a hardcoded value and later calls it. It's mostlikely made with a simple macro in the original code since it's the same type of "redirection" used plenty of places there.

I also noticed it used registry strings from HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed but I didn't bother find out for what use.

Many things makes me think it's not as unbreakable as it seems.
I think many of us would like to see a target using it though.
DakienDX
04-07-2002, 04:18 PM
Hello cyberheg !

Thank you for the nice review of the protection. :)
So we know what to look for when the first targets come out. ;)
cyberheg
04-07-2002, 07:42 PM
After the first post I was tempted to protect one of my own progs. I never succeded though.

First thing the documentation was not too clear on how to intergrate the stuff in the source code. Then after making use of those mira tags I had to use those "helper" progs inside visual studio to paste the rest of the needed tags into the source code.
I never got them to paste anything into the editor like the manual stated they should.

So after placing some tags manually I went back to David and tried to inject the stuff into the code. This changed the clean variables into variables with values set like daysremaining was set to 100.

Other then that I couldn't find out how to go on. From what I could see only the prototypes are there but rest of the code (a library or something else) I think only is in the full version and not the demo of the sdk.

If anyone actually manages to protect a prog using this please post here :)

I think the manual needs some examples and there could be example projects included too. This would help alot on making it easier to start with.


New Securom - sintf*.dll files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New Securom - sintf*.dll files
PDA

View Full Version : New Securom - sintf*.dll files

ramon
04-04-2002, 03:38 PM
Hi all,

Anyone had played with new version of Securom tha uses sintfnt.dll, sintf16.dll and sintf32.dll

I'm in war with it, any suggestions? or tutorials available?

Bye
Ramon
DakienDX
04-04-2002, 03:58 PM
Hello ramon !

By entering "Securom" in the search function you would have found some threads dealing with it.

If you've a working CD it's really no problem dealing with it. You need just a dump of the game's ".code" section. The program uses one call for all imports, so you've to program some code by your own which "gets" (I won't tell how, else there wouldn't be any fun ;) ) the imported function's addresses out of the call and replaces the addresses in the dumped ".code" section with the right calls.
Kilby
04-05-2002, 10:27 AM
The following changes where made to securom.

The offset to the oep moved (along with the jmp eax)

Some of the code moved around in the api decryptor moved.

They screwed with the vsize of a section so as some of the dumps are huge (Monsters Inc Swedish Version came out at 115 meg).

They changed the .dll name

Nothing major has changed at all.

Thats about it really, .

R!scs tut still holds true for ALL the important parts.

Now all you have to do is work out how spme bits of the api decryptor works :)

Regards,

Kilby...
ramon
04-07-2002, 07:36 PM
Yeap, almost all trics from r!sk's tuts continue valid, but my target gets me crazy about fixing the IAT table. When you make a

call DWORD PTR[securom] you get one valid pointer

if you do like r!sk

jmp DWORD PTR[securom] you got diferent address (invalid) and very FF 15 ?? ?? ?? patterns do AV errors in securom functions

I can't figure out whats going on!!! maybe securom do checks over stack, routing our jmp. But if I change the the small asm code to call DWORD PTR[securom] in some cases the function never returns.

I know the real OEP :)), but IAT arrrrrgggggggggg

Suggestions??

Thankz
Ramon
DakienDX
04-07-2002, 07:37 PM
Hello ramon !

I don't know how r!sc did it, but I'm sure he didn't do it with just a "Jmp DWord Ptr [Securom]". He must have placed a "Push ???" right in front of it, where "???" holds the address from which the (fake) call is made.
If you do a "Call", the return address in placed on the stack, if you do a "Jmp", no address is placed on the stack. Therefore you must take care that this address is placed there before the "Jmp".

Remember that you must also patch the "[Securom]" function so that it will return to your code with the API address in EAX instead of returning to the address in EAX, the API.
ramon
04-07-2002, 10:54 PM
Hi

Yes I'm paching securom function in runtime, then I can do a loop over all .text section to find desired pattern of bytes, when found jmp to securom_funtion, but before I fake it with a push on stack of the address where I found the pattern. At that time I change the end of securom_function where it jumps to the right address
changing from "jmp eax" to "jmp ebx", why? This function doesn't use ebx, then before making the jump to securom_function I make ebx equal to the address in our little asm code just after the jump to securom_function.

Then we can think that all should work as we expected, but NO :((
The greater part of patterns founded create errors in the securom_function, weird!?!

As I refer before, I beleave that securom_function verifies if was by call or by jmp, is that possible?

Sorry if my english is complicated.

Ramon
blackcheck
04-08-2002, 07:13 AM
sometimes the jump eax inside the call dword ptr returns
securom address instead of the real api,that's all.
Kilby
04-08-2002, 09:28 AM
Ok regarding the resolving of the api functions.

This is fairly easy, but it's obvious that r!sc was only out to make a working dump of outcast and not to document securom.

Some api calls pass through the resolver up to three times, some may pass through more times than that but I got the idea after a while :)

What happens in those cases is that the jmp eax at the end of the resolver ends up pointing into a table containing the address of the resolver.

Another part mentioned by r!sc is that for some reason the resolver seems to give errors on some api addresses.

This is indeed the case, this is because the resolver counts the number of apis being called, and seems to screw itself up if too many consecuitive calls are made to the routine

To fix this 2 instructions (4 bytes) need to be patched, and they are obvious in an ida listing.

The route you are taking for the register value you are using is almost correct.

I'm not saying too much otherwise my dumper will suddenly need rewritten.

To completely own the resolver, you must pass 2 appropiate values and patch 5 bytes.

Regards,

Kilby...
DakienDX
04-08-2002, 04:05 PM
Hello ramon !

I see r!sc did it the same way as I did it.

At the end of the "[Securom]" function there is a "Jmp EAX", where EAX holds the pointer to the API to jump to. So the function would just execute the API and we wouldn't know the API address. Because of this you need to patch the function call to give you the API.

You can't use a "Call DWord Ptr [Securom]", since the procedure would try to find the correct API for your call address, not for the right call address.

It's impossible for the "[Securom]" function to handle a "Jmp DWord Ptr [Securom]", since it wouldn't know from which address it was called and where it should return after the API is executed.

(I'd planned to anwer different, but I don't want to harm Kilby's dumper. :) )
ramon
04-08-2002, 11:24 PM
Hi Kilby and DakienDX

Kilby's tips make my hard work a little more easy :)
I found it!!! the last things I need to do is find the rigth IAT table
because the unpacked app only run in the system were I unpacked it, ie, if unpacked in Win200 doesn't run in 9X and vice versa. You know why! :).

But I know how to do that. This step seems easy, tomorrow I will tell you if i beat that bitch

Thankz guys
Ramon
ramon
04-09-2002, 09:52 AM
Be Cool
Ramon
Kilby
04-09-2002, 10:10 AM
Hehe, glad to see that my hints where of some help.

Theres almost always two import tables in a securom .exe.

If you want to look at two wierd securom examples I suggest :-

Fortress Europe which is written in VB

Sub Command (from EA), which always ends up with me having to adjust the imports by hand and it has some wierd sections attached to it.

The funny thing is that I can only get the tables to work properly from 98 (the 98 dumps run inder 2K & XP), but if I dump from 2K then they only work on 2K systems.

As I don't have (or even wish to have) a 2K system at home, I don't have time in work to explore the problem.

Anyway good luck with any further securom exploration.

Kilby...
Gadix
04-12-2002, 09:31 AM
Hi SecuCRACKERS

r!sc tutorial is 80-90% valid... r!sc talks about "bad calls", this is due Securom do
a randoms CRC-checks in API-WRAPPER routine and he doesn't patch CRC comparison. The
comparison has the following form: (scroll in Securom API routine)

MOV ECX,[EDX]
CMP ECX,[EAX]
JZ GOOD_CRC

If you change JZ to JMP you can patch peacefully the JMP EAX to your fixer-routine. You can
get more info in my securom tutorial(in spanish) at h**t://gamescrk.cjb.net

New versions also have a time comparision (with WINMM_TimeGetTime) to check the number of
times that securom routine is called in certain time to a
void IAT-APIrebuilders (& my UnSecurom :d )

Gadix
[NtSC]
04-12-2002, 04:14 PM
that Time compare Routine is just defeated with 3 Nops and you can go on without any Problems :-)

For some Games u could..
Breakpoint on EnterCriticalSection

if next Instruction is an mov..
and next instruction to the mov is an add e??,01
just erase that and you can decrypt the whole bunch of collected adresses.

<just kindly figured on Zax - The Alien Hunter...>

Cheers Gadix,long time no see :>
acoder
11-23-2003, 10:13 AM
(heya NtSC ;))

About the time thing, I think its this:
MOV DWORD PTR SS:[EBP-2C],0
CMP DWORD PTR DS:[580EDC],0 <-- check for some flag?
JNZ SHORT 004C2079
CALL DWORD PTR DS:[596BBC] ; WINMM.timeGetTime
MOV DWORD PTR DS:[580EDC],EAX
JMP 004C2198
CALL DWORD PTR DS:[596BBC] ; WINMM.timeGetTime
MOV DWORD PTR SS:[EBP-30],EAX
MOV EAX,DWORD PTR SS:[EBP-30]
SUB EAX,DWORD PTR DS:[580EDC]
CMP EAX,0EA60
JBE 004C2198 <-- good boy

maybe someone knows whats the big numbers (?) used
after a check...like this:
CMP DWORD PTR DS:[50B1A0],0 <-- another flag
JE SHORT 004C20AE
push offset "72311C5AEBA713BD58..."

cya
naides
11-23-2003, 10:42 AM
(heya NtSC ;))

About the time thing, I think its this:
MOV DWORD PTR SS:[EBP-2C],0
CMP DWORD PTR DS:[580EDC],0 <-- check for some flag?
JNZ SHORT 004C2079
CALL DWORD PTR DS:[596BBC] ; WINMM.timeGetTime
MOV DWORD PTR DS:[580EDC],EAX
JMP 004C2198
CALL DWORD PTR DS:[596BBC] ; WINMM.timeGetTime
MOV DWORD PTR SS:[EBP-30],EAX
MOV EAX,DWORD PTR SS:[EBP-30]
SUB EAX,DWORD PTR DS:[580EDC]
CMP EAX,0EA60
JBE 004C2198 <-- good boy

maybe someone knows whats the big numbers (?) used
after a check...like this:
CMP DWORD PTR DS:[50B1A0],0 <-- another flag
JE SHORT 004C20AE
push offset "72311C5AEBA713BD58..."

cya

Typically,
DWORD PTR DS:[580EDC] Refers to a 'global' variable, which is located in the data segment ( DS: ) and is 'visible' by every call (Function). It is a good place to put global variables as you observed.
That is in contrast with DWORD PTR SS:[EBP-30] like variables, which are located in the stack ( SS: ), and have scope within the local call (Function).

You should remeber your C 101 global versus local concept.
There are more complications and wrinkles to this story, but that is the general idea.

Oh Shit. I missed the point, completely.
Sorry.
doug
11-23-2003, 03:27 PM
Typically,
DWORD PTR DS:[580EDC] Refers to a 'global' variable, which is located in the data segment ( DS: ) and is 'visible' by every call (Function). It is a good place to put global variables as you observed.
That is in contrast with DWORD PTR SS:[EBP-30] like variables, which are located in the stack ( SS: ), and have scope within the local call (Function).

You should remeber your C 101 global versus local concept.
There are more complications and wrinkles to this story, but that is the general idea.
I was thinking that he was refering more to
push offset "72311C5AEBA713BD58..."
than what u mentionned.

run a securom exe with cmdline: "/SecuExp", u'll see where this is going ;)

btw, this thread was 1.5 yr old, im quite sure ntsc knows where the timer is by now:)
[NtSC]
11-23-2003, 04:20 PM
I was thinking that he was refering more to
push offset "72311C5AEBA713BD58..."
than what u mentionned.

run a securom exe with cmdline: "/SecuExp", u'll see where this is going ;)

btw, this thread was 1.5 yr old, im quite sure ntsc knows where the timer is by now:)

Haha ;-)
Did I ever say i dont know where those Timers are ? :D
acoder
11-24-2003, 01:52 PM
']Haha ;-)
Did I ever say i dont know where those Timers are ? :D

The timer code I posted wasn't destinated to "answer"
NtSC, I also assumed NtSC already knew about it...

true the thread is 1.5 yr old, I just got my first securom
protected thing :(

however many stuff seems to stay the same...
dumped, got oep, now I need to fix special redirected apis..i'll
search a bit on the forum...

cya


new winzip attack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > new winzip attack
PDA

View Full Version : new winzip attack

mike
04-04-2002, 04:08 PM
I haven't fleshed this out yet, but it could make cracking winzip files easier when you have less than 5 files. It's just one more check for filtering passwords; I don't know if you can extend it to deriving relations between key bits.

The idea is that when you decrypt the "random" bytes twice using the same password, you should get ten bytes that are output from a specific TLCG.

I'm not sure how fast this is; I imagine it would be faster than trial decompression.

I'm pretty sure five bytes are enough to uniquely identify the seed to the generator. So the idea is this: We store 2^40 bits = 512Mb. Each bit has a five-byte index. The bit stores whether that 5-byte pattern is a possible output of the TLCG. Since there are only 2^31 states, we expect that only one out of 512 patterns is possible.

When we decrypt the 10 random bytes, we check each consecutive group of five to see whether it's possible. That's five groups total = 5*9bits filtering = 45 bits filtering. So if we say that a wrong password generates random bytes, there's a 1 in 2^45 chance ~= 1 in 3*10^13 chance that it will pass the filter.

How fast can one do a lookup in 512 Megs?


Softice symbol help.. please help if u can
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice symbol help.. please help if u can
PDA

View Full Version : Softice symbol help.. please help if u can

R I Z E N
04-04-2002, 06:53 PM
hello. :confused: since getting Softice 4.05 i have managed to get it going on my WinME Operating system. But unfortunatly thats all ive got it to actually do. I started following a tutorial and when it came to entering a command "bpx getwindownamea" Softice replies with "symbol not defined (getwindowname)

i then found that i needed to remove the comments before ";EXP" in kernal32.dll etc.. which i did do. then i tried again. Same thing happened. Then i went to symbol loader looking for a solution, II used the Edit feature to enter the symbols that way and then rebooted expecting this to solve my problem. Bah no such luck. Finaly i came to this forum to look for people who had the same problem. I found a post by "Goat" about how he had this problem, the solution someone offered which fixed his was to put the loader from "wmldr.zip" to C:/Windows/SYSTEM/.. whatver it was. This then loaded softice before windows ME started up. Im guessing this was instead of using the "io.sys" method that i used to get Softice running on my computer. BUT even ater doing all this stuff i still get the same old errorr "Symbol not defined (******) for whatever i enter.

PLEASE PLEASE help if u have any clue as to what is wrong.. ive run out of ideas and getting sick of messing about probably harming ym computer. ty in advance

im on msn messanger = maxmadx@hotmail.com
Aim = crexasation :confused:
DakienDX
04-04-2002, 07:09 PM
Hello R I Z E N !

The reason why SoftICE does not find GetWindowNameA is that there isn't any function with that name.
You might be searching for GetWindowModuleFileNameA or GetWindowTextA, but this functions are exported from USER32.DLL and not from KERNEL32.DLL.
R I Z E N
04-05-2002, 02:55 AM
ok thanks, BUT. i meant to say getwindowtexta :/ and also, im working from a very good tutorial by Prophet which i guess should be right :( here, i followed all the steps from this
http://www.woodmann.net/fravia/prophe_1.htm please have a look, midway down where we start to break point is where i get the error. has the writer of this handy tut missed something that the average newbie would overlook or is it just my stupidity :(
R I Z E N
04-05-2002, 02:59 AM
ps.

does the fact that kernel written at the bottom right of softice hold any relevance? (just a thought when u said that getwindownamea is from user not kernel
DakienDX
04-05-2002, 06:34 AM
Hello R I Z E N !

I've looked over (not deep) the tutorial and could not find any special errors which might be overlooked by newbies.

I don't know where you've see the word "kernel", since there is usually nothing on the bottom right, just in the middle. This shows to which process the code in the code window is belonging to.
And there is no library called "KERNEL", only "KERNEL32" would be possible. This would mean that you're in some KERNEL32 code.
R I Z E N
04-05-2002, 07:05 PM
ok, it sais at the bottom right kernel32, i suppose this is what u meant but if getwindowtexta isnt for kernel, why softice say that the register part of the program (target) is? or do i have to physicaly change it to read user32 ?? i dont know :/
do u think that the version 4.05 requires the user to do something that 3.0 didnt have? (the person who made the tutorial used SI 3.0)
i dont understand why it wouldnt pick up that its a user32 automaticaly ..

ps sorry for not having much clue what im talking about
and thanks for having the patience
R I Z E N
04-05-2002, 11:35 PM
ok, my original problem was all about loading symbols, but since then i have realised that this wasnt the problem. I can breakpoint with commands that are associated with kernel32. The thing u said about there not being a kernel32 at the bottom right, well there is when im jsut sitting on desktop, but if i go into retail, bigger programs like Rainbow 6, the kernel32 is replaced with the name Rainbow. so this is just the name of the program that softice is analysing? if this is so, why doesnt "teleport pro" name come up there, because where i follow in that tutorial im told to use a command that is for user32, and thats why i get "symbol not defined" because the name kernel32 is at the bottom right :/
sorry im not that great at explaining things. hope u can decrypt what i jsut said.
DakienDX
04-06-2002, 12:44 AM
Hello R I Z E N !

Just some general things:
If you just activate SoftICE with it's hotkey, you'll break somewhere in memory in some process. If to program is bigger and needs much computing, it's more likely that you'll break in the process, if it's just small and does nearly no computing, it'll be very difficult to break in this process and you'll end up most time in some system kernel code like KERNEL32.DLL.
Setting a BPX on a KERNEL32 or USER32 export has nothing to do with what's written at the bottom of the SoftICE window. It will work always if it's exports are loaded.
There shouldn't be any difference in handling exports in version 3.0 and 4.05 expect that 3.0 might not work with WinME.
R I Z E N
04-06-2002, 02:19 AM
hehe ok, if ive de-commented everything in winice.DAT, why do u think that its not recognising getwindowtexta when it is such a common symbol. also when kernel32 is writen at the bottom of softice, it recognises all the commands specific to kernel32 :/

this is the part of the tutorial i am up to:

Okey then, let's enter a name in the Name box, eg Prophecy, and a bogus code,
eg 666777888. Now we need to set a breakpoint in SoftIce so that we pop into
SoftIce at a point close to where the target is going to generate the code and
compare it to our bogus code. Okay, let's pop into SoftIce (Ctrl-D or whatever)
and set a breakpoint: BPX getwindowtexta. This means SoftIce will pop up
on execution of the getwindowtexta command, which is a common command a target
uses to read info supplied by a user (eg name and (bogus) serial number). Okey,
hit < F5 > to go back to the target and click OK. Bang! we're in SoftIce.
Press < F11 > to trace the call back to the target.

so, why would BPX getwindowtexta get recognised by his and not by mine :(

let me know when ure fed up of me and ill give up btw. and again thanks
DakienDX
04-06-2002, 10:58 AM
Hello R I Z E N !

You can't go on with the tutorial unless you can set breakpoints on exported functions.

So if you've removed all comments from WINICE.DAT and the path to the files is correct, you may try to add the DLLs with the Symbol Loader, else I don't know where the problem could be. :(

If I've understood you right, you can break on KERNEL32 exports but not on USER32 exports, right?
esther
04-07-2002, 05:32 AM
Originally posted by R I Z E N
hehe ok, if ive de-commented everything in winice.DAT, why do u think that its not recognising getwindowtexta when it is such a common symbol. also when kernel32 is writen at the bottom of softice, it recognises all the commands specific to kernel32 :/

this is the part of the tutorial i am up to:

Okey then, let's enter a name in the Name box, eg Prophecy, and a bogus code,
eg 666777888. Now we need to set a breakpoint in SoftIce so that we pop into
SoftIce at a point close to where the target is going to generate the code and
compare it to our bogus code. Okay, let's pop into SoftIce (Ctrl-D or whatever)
and set a breakpoint: BPX getwindowtexta. This means SoftIce will pop up
on execution of the getwindowtexta command, which is a common command a target
uses to read info supplied by a user (eg name and (bogus) serial number). Okey,
hit < F5 > to go back to the target and click OK. Bang! we're in SoftIce.
Press < F11 > to trace the call back to the target.

so, why would BPX getwindowtexta get recognised by his and not by mine :(

let me know when ure fed up of me and ill give up btw. and again thanks

Hi,
check your winice.dat just uncomment these only

EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
EXP=c:\windows\system\shell232.dll
EXP=C:\windows\system\advapi32.dll

btw hi DakienDX ;)
R I Z E N
04-07-2002, 07:14 AM
i already did that :///

ok its ok it works with getwindowtext, so thats cool. try for ure help all :D
R I Z E N
04-07-2002, 07:23 AM
hi, when i call Softiceup (ctrl-D) and im connected to the internet, my connection is suddenly lost. I use pay dial-up connection and am hoping that there is something i can do to stop this from happening. thanks :D

i read somewhere u can fix this by the '/AWAY asuidsodj' command?? dunno. thoughts welcome
R I Z E N
04-07-2002, 10:19 AM
hi again ^^.

ok i dont know why getwindowtexta doesnt work when getwindowtext does. I think im runnign a different softice to everyone else lol. Anyway... seen as getwindowtext does the same job i aint worying.

the new problem(s)

are in the next part of that tutorial.

once ive broken into the program at the call where it asks me to enter name/password - i press F11 to trace back to the tartget.
the tut then tells me to enter "s 0 1 ffffffff "Prophecy" but unlike the guy in the tutorial , i get a sysntax error. . . so, what u think is up. seen as i typed in exactly what it sais to type in. u can look at the tut again for reference if u need to. http://www.woodmann.net/fravia/prophe_1.htm

are u sure the commands havent changed with the new versions of Sice?:confused:

ps.#
i get disconected from the internet when i call SoftICE up ... any ideas?
foxthree
04-07-2002, 10:26 AM
Hi RIZEN:

Here is what SoftICE Command Reference manual says:

<QUOTE>

S : Search Memory for Data
S [-cu][address L length data-list]
address Starting address for search.
length Length in bytes.
data-list List of bytes or quoted strings separated by commas or spaces. A
quoted string can be enclosed with single or double quotes.
-c Make search case-insensitive.
-u Search for Unicode string.

</QUOTE>

BTW, can I suggest you to read the FINE manual as all your questions might already have been answered there! ;)

Signed,
-- FoxThree

PS: If you still didn't get it, the command you must type in is
"s 0 L ffffffff "Prophecy" (Note the "L" instead of "1") :cool:
R I Z E N
04-07-2002, 12:41 PM
thanks man!, i realise looking after newbies is alittle boring haha, but i appreciate it soo much .TY ;D

also, can anyone answer my question about disconeting :((
DakienDX
04-07-2002, 04:03 PM
Hello R I Z E N !

This is a quite common problem with no solution so far.
Please read this (http://www.woodmann.net/forum/showthread.php?threadid=2610) thread or this (http://www.woodmann.net/forum/showthread.php?threadid=819) thread.
DakienDX
04-07-2002, 04:10 PM
Hello R I Z E N !

Yes, I can answer your question about disconnecting, I already did it in the other thread you've started. Please never use more than one thread for the same problem. Because of this I merged the three threads.

You said you can break on GETWINDOWTEXT but not on GetWindowTextA?
It seems like you've the same problem like before. :(
GETWINDOWTEXT isn't exported by USER32.DLL, but by USER.EXE. You don't need to load it's exports, since SoftICE loads them automatic, even if they're commented out in WINICE.DAT.
R I Z E N
04-09-2002, 04:46 AM
oh.. so how do i load its exports for user32.dll then?
DakienDX
04-09-2002, 03:53 PM
Hello R I Z E N !

It should be done exacly like the KERNEL32.DLL exports. Use the Symbol Loader and use the add exports from DLL function.

If this doesn't work, buy SoftICE and ask NuMega for support. ;)


One thing need to solved
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > One thing need to solved
PDA

View Full Version : One thing need to solved

phop007
04-06-2002, 08:04 AM
I almost finish reverse AAtools.exe 5.10 build 867 but one thing left is I can't save, like proxy save when i click on it the massage show "Sorry... only registered version only..." and I know this somewhere at 62E01A but when I make it jump above before it will show the message still doesn't work and it does nothing. Any idia how to fix this. Thank.

OEP=6A8AA8

Address 6A8AC4 and 6A6024 need to be fix.
phop007
04-06-2002, 08:05 AM
This my it fix
foxthree
04-06-2002, 12:00 PM
Hi phoop:

Just unpacking will not register the app for you as you've just only removed the ASPR wrapper. To enable the protected features you'll have to *pretend* to have registered. This can be as simple as debugging and fixing the 74 to 75 or can be as complex as decrypting some code manually. (Some ASPR targets encrypt certain code segments so tha only when you enter a valid key it will decyrpt the code segments. We can try to brute force this. Search for binh81's posts on this).

So, a simple unpack will not help, i'm afraid :(

Signed,
-- FoxThree
phop007
04-07-2002, 06:37 AM
Hi fooxthree

Actually 100 Email+Proxy+link limited not hard to make it jump but maybe this save will do something decyrpt. Thank for solution. I will do some research on it.


Problems with revirgin?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems with revirgin?
PDA

View Full Version : Problems with revirgin?

The_Philosopher
04-06-2002, 08:11 AM
Hi

I install revirgin, run it and then i get msg box saying that i have to update dll's in winroot dir. I check readme and see this info too (with copying sys file in system32\drivers). I did this, but i still have the same msg...you have to update...What am i doing wrong?
HELP!!!!!!
:)

Thank you

The_Philosopher
Solomon
04-06-2002, 10:35 AM
also copy thread.dll and tracer.dll to %SystemRoot%.

Pls make sure the date/time of the exe/dll/sys files are the same. If not, just type "touch" in DOS command.:) It works for the older version of RV.
The_Philosopher
04-06-2002, 10:03 PM
Originally posted by Solomon
also copy thread.dll and tracer.dll to %SystemRoot%.

Pls make sure the date/time of the exe/dll/sys files are the same. If not, just type "touch" in DOS command.:) It works for the older version of RV.
Hi

I did everything you say, but there is no changes.

The_Philosopher
esther
04-07-2002, 05:35 AM
Originally posted by The_Philosopher

Hi

I did everything you say, but there is no changes.

The_Philosopher

hi.
it doesn't works in not win nt


How to load *.TDS files into SoftICE?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to load *.TDS files into SoftICE?
PDA

View Full Version : How to load *.TDS files into SoftICE?

Solomon
04-06-2002, 10:39 AM
I just want to debug some C++ Builder EXEs with SoftICE. But symbol loader doesn't accept it.:(
DakienDX
04-06-2002, 11:09 AM
Hello Solomon !

Here's a quote from the SoftICE release notes:
C++ Builder stores the Borland debug information in .TDS files separate from the executable. TDS files are also produced by the TDSTRP32 utility. To load symbols and source into SoftICE, simply use the Symbol Loader to load the .TDS file. If you want to load the executable from the Symbol Loader that must be done afterward as a separate step. Alternatively, you could set the desired breakpoints and then load the executable normally.So you must strip the debug information with TDSTRP32.EXE from the .EXE into a seperate .TDS file.
If you did this you need to load the .TDS first and the .EXE after that.

What version are you using? Maybe C++ Builder 6 uses a different .TDS format and the Symbol Loader does not know how to handle it. :(
Solomon
04-06-2002, 12:23 PM
I'm using C++ Builder 5.0 and DriverStudio 2.6.

The compiler already produced a TDS file(I choose the "debug" compiling option, not "release"), but SoftICE symbol loader refused to load it.
DakienDX
04-06-2002, 12:53 PM
Hello Solomon !

I think DriverStudio 2.6 should know C++ Builder's .TDS format.
Sorry, but I've nearly nothing to do with C++ Builder and .TDS files, so I don't know any other possibility. :(
Solomon
04-06-2002, 01:22 PM
problem solved. Now it works:)
Just open *.tds, and press "load" or "translate", symbol loader will translate it to NMS.:)


windows xp debugger problems, rv's tracer on windows xp.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > windows xp debugger problems, rv's tracer on windows xp.
PDA

View Full Version : windows xp debugger problems, rv's tracer on windows xp.

tsehp
04-06-2002, 11:11 AM
hi,
to continue a past thread.
I'm actually finishing to make the rv tracer work on windows xp, this tracer is ring0, and doesn't rely on windows 2000/xp usual expception handling, so we have to deal here with windows xp kernel code.

We have the same problem here with softice, for you to see this :
start notepad on windows xp and break at the oep, then bpx [GetSystemMetrics], step in this function and F10 on the first call :
notepad runs and softice doesn't break after the call.

what did happen ? By stepping on this first call, a dedicated instruction that appeared on pentium 2 and latest amd's, "SYSENTER", replaced win2k int2e , look at elic'z site infos that have some interesting docs about the two ways to switch from ring3 to ring0.

It appeard that the windows xp sysenter handler crushes the eflags trp flag, that surely allows softice to break after this call and also allows my tracer to work.

This flag is crushed inside this handler, without any apparent chances to be restored.

While waiting for a future softice version after 2.6, I'm actually
trying to find the best solutions to fix this problem, without touching the handler.

regards,

tsehp


Anti-trace/Anti-debug techniques
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Anti-trace/Anti-debug techniques
PDA

View Full Version : Anti-trace/Anti-debug techniques

foxthree
04-06-2002, 12:15 PM
Hi All:

I'm very much interested in this part of the protection (as I'm sure you all are ;)). This is because if a protection does this well enough, it might as well make our life miserable, as we rely on tracing/debugging to analyze the inner workings of the program.

Recently, I find that INT 1 is the debugger exception and that when the TR flag in EFLAGS is setup, the processor executes exactly one instruction and generates INT 1 so that the debugger can gain control.

Also, if GD (Global Debug) flag is turned off in the DR7 register, you cannot write anything to the DRx registers. It is like essentially locking all DRx registers.

My questions are as follows:

(1) Does Kernel-level debuggers (like SICE) also use INT 1?
(2) Why doesn't any protection software switch temporarily to ring 0, turn of TR flags, hook INT 1 (the new interrupt handler does nothing actually), set the GD flags in the DR7: thereby essentially *finishing* all debuggers ? (Or do some of them already do this?)
(3) Is my above postings correct or am I just having an ASM fit ;)

Thanks for sharing your thoughts on this.

Signed,
-- FoxThree

PS: I'm planning to open an archive of all known anti-debug and anti-trace techniques (similar to CrackZ). I already have quite a few material. If you find any site/url that has such information, I'd be glad if you could share it with me so that I, in turn, can share it with the world ;)
DakienDX
04-06-2002, 12:50 PM
Hello foxthree !

If GD in DR7 is turned on, any read/write to the DR? registeres will execute an INT 1.

SoftICE uses INT 1, but not all the time. For example a BPX does use INT 3 to break, a BPM uses INT 1. BPR/BPX use INT 1 to re-enable the BPR/BPX after it has tiggered once.
You can find very usefull information about this in +Spath's "SoftICE Internals".

Some protections switch to Ring-0 to change/clear the DR? registers, but the problem is always how to do it on different operating systems. Turning off the Trap Flag wouldn't help anything if the program is running, since it isn't traced and TR is not set on anyway. Hooking INT 1 and setting GD on is a bit unsafe, since an INT 3 or the debugger's hotkey will be able to set INT 1 back and clear the GD flag again, since it executes it's own INT 1 on DR? access. And if you're tracing the code, the protector can't hook INT 1 and enable GD in one instruction (didn't you think that the debugger could also have set GD on?) and if you're stepping over a call, INT 3 comes in again and can set everything back.

No, your above posting with "GD off=DR? locked" is not correct. ;)
foxthree
04-06-2002, 07:33 PM
THIS MSG IS QUOTED BY TSEHP...VBULLETIN BUG...

Hi DakienDX:

Thanks for your insightful post. However, my question is that if I (as the protector) hook the INT 1 handler (which the debugger would've hooked) and prevent "chaining" of the INT 1 interrupt vector, what gives?

>>it will give the following thing :
Daemon already coded an app that selftraces, hooking the int1 to decode instructions and executes them later.
But my tracer is installed here before, so it can fool the target that tries to hook this interrupt and chain it's own interrupt vector after... he he, it was there at first ;)

Another coincidence is that of tsehps' post in the same forum about SICE behavior in WinXP. In that he writes, WinXPs' SYSENTER interrupt handler trashes the TR flag and there seems to be no way to reset it back. What if I do this + hook the INT 1 handler and prevent the Debugger's INT 1 from being called.

>>it's done at ring0 level, but again a ring0 tracer that detect this and re-enable the tf flag after this crime is done ;-)

Am I making sense or just yapping? :D

>>to finish : if the tracer/debugger is loaded at first, it will always have the opportunity to emulate and lie to the traced target, and all the work coding such apps is there.

regards,

tsehp
DakienDX
04-06-2002, 08:11 PM
Hello foxthree !

I don't think I understand your question. I was assuming that you are the only one who handles INT 1 and that there is no chaining. You must always remember that INT 1 is not the only way to access SoftICE. How would you try to hook INT 1 anyway? (remember, different operating systems)

I think you haven't understood Tsehp's post right. Tsehp means the TR flag is switched off by WinXP, so his tracer will not continue after the system call because there is no INT 1 executed after that call. Of course you can set the flag back by hand, but it isn't done automatically. This is nothing which a protector could use, only a WinXP specific "bug".
foxthree
04-07-2002, 10:19 AM
Hi Tsehp/DakienDX:

Thanks for all your wise posts. I really appreciate you sharing your knowledge with me.

Signed,
-- FoxThree
^DAEMON^
04-09-2002, 09:17 AM
Hi :)

sorry but the above isn't correct... i DON'T hook interrupt 1! it's a good old trap flagger nothing else using seh (that turns on trap flag in eflags!)

and if u are interested in anti-stuff visit my homepage

h**p://www.anticrack.de/daemon

best regards,
^DAEMON^
foxthree
04-09-2002, 09:41 AM
Hi there Daemon:

Up to your usual tricks is it? :D I took a look at your site and all I can say is WOW!!!

I can see a new ALERT coming up:

ALERT!!! HEAVY DUTY READING COMING UP ALERT!!!! :D

Signed,
-- FoxThree
tsehp
04-09-2002, 02:15 PM
yep, you're right daemon, sorry for the mistake.

you also used a lea eax, eax to do the dirty calls ;-)

two kinds of tracers actually exists :

1-the ring 3 tracer : my first versions and actual imprec 1.4.2
they must be the first seh, so always reside at the top of fs:[0] chain. they are pretty easy to defeat because they only rely on ring3 mem accesses, they can't fool the idt and you can play tricks on them to remove them from fs:[0] , they always have to emulate/avoid the instructions that can uninstall them.

2-the ring0 tracer : icedump (installed with sice) and revirgin's actual tracer; TMHK. Those tracers have the highest "power", meaning that they can access everything in mem, can modify the idt and can also produces great (bsod's) for my part ;-)
Those are more difficult to defeat, because they only rely on windows internal kernel code to work.

regards,

tsehp
^DAEMON^
04-09-2002, 02:32 PM
btw your tracer gets stuck in my latest version of child - protector u can download now a public version on http://www.anticrack.de/daemon :)))

(win 2k!!!)

^DAEMON^
^DAEMON^
04-09-2002, 02:47 PM
(hihi i love my job :))
DakienDX
04-09-2002, 04:28 PM
Originally posted by ^DAEMON^
Hi :)

sorry but the above isn't correct... i DON'T hook interrupt 1! it's a good old trap flagger nothing else using seh (that turns on trap flag in eflags!)

and if u are interested in anti-stuff visit my homepage

h**p://www.anticrack.de/daemon

best regards,
^DAEMON^ Hello ^DAEMON^ !

The thread here was started by foxthree as general question and I answered him in a general way. We were only talking about anti-debugging tricks and WinXP bugs.
Then you came thinking we're all talking about you and your protector and started to tell that everything is false just because your protector doesn't use it.

We weren't talking about you, didn't you notice that?
evaluator
04-09-2002, 10:08 PM
Yep, I downloaded "protect_last_beta.zip" at 10.04.2002 00:11.
Finished unpacking at 01:55.
!!!!!!!!!!!!!DO YOU KNOW!!!!!!!!!!!!!!!!
******I unpacked it WITHOUT debugger!*******

OEP I guessed. So daemon, be so kiddy & tell me, am I RIGHT?

BTW!!! BUG REPORT!
I tried but failed protect this programs:
NOTEPAD.EXE
REVIRGIN.EXE
2 exe's from ICLEZION's tuts & all others!
Here I crash my PC..
^DAEMON^
04-10-2002, 06:23 AM
Sorry Dakien, i noticed that of course

again sorry, if i got u angry, didn't want that :(

evaluator: i wrote that u should only try it @ tasm files (otherwise play with the ini file set all values to 0)
but it will fail in 90% - download a few of my unpackers and protect them... and u'll see it works (tasm ://)

^DAEMON^
evaluator
04-10-2002, 07:37 AM
OK, but you not answered on Q:
My OEP is right or no?
^DAEMON^
04-10-2002, 07:44 AM
dunno sorry iam @ work can't check for it :)

but stop uploading such files here please, if u want then email me them, k ?

would be nice if u delete the post thx in advance

^DAEMON^
evaluator
04-10-2002, 01:36 PM
Maybe I will delete it after you sad:
"OEP is wrong or RIGHT"

>>but stop uploading such files here please..
>>would be nice if u delete the post thx in advance

BTW:) Never forget word "PLEASE" 2 or 3 times
Dr.Golova
04-12-2002, 02:08 PM
Originally posted by ^DAEMON^
(hihi i love my job :))

This "protector" is buggy - don't run on my win2k sp1/2 (go to infinite loop in SEH handler in first polymorph(?) layer). May be this the "real cool protector" written as frase "If in don't runs it can't be defeated" ? ;-)
evaluator
04-12-2002, 05:00 PM
But it run under XP!
Ni2
04-15-2002, 09:57 PM
Hi evaluator,

How did you manage to unpack daemon protector without a debugger? If you did that, you are the man :) Tell me please, cos I'm very curious ;)

I traced the whole protection from the beginning to the end. Yep, I'm crazy but i wanted to smell each opcode one by one :p (a few hours of pleasure...Nahhh, it was not a pleasure at all to trace that devil code :p)

About the Original Entry Point....well, there is an easy way to get it. As you can see the BPM are not working, at least that you patch the DR7 writing inside of each SEH that modifies that. The protection checks for 10h bytes in each API used by itselft or by the target program. Ok, lets put a BPX in LoadLibraryExW+XX (XX >10h). After the breakpoint, we have to make a search for the protector epilogue (where the last instruction is before passing the control to the target program). The last instructions that are executed in the protector are:

lea eax, eax ; this is cool ;) where did u get the opcode 4 this? :p
pop fs:[0]
add esp, 4
ret ; intergalactic jump to the target program (OEP after this)

So, after the breakpoint from LoadLibraryExW search for 83 C4 04 C3 (that's ADD ESP, 4; RET)

put a bpx in that RET and run the protector till softice pops up in that RET. You'll have the OEP in [ESP] ;)

Regards,
Ni2
crUsAdEr
04-15-2002, 11:37 PM
Hi ni2,

I have encountered the same code snippet before, but was unable to explain its behaviour...

isnt "lea eax, eax" and invalid instruction? When i attempt to trace over this instruction... the exception handler is always called and then i am lost... guess it is anti tracing code... if i put a bpx over on the next instruction then it runs fine and break at the next instruction... however i miss the fun of understanding what happen in between..

Would you care to explain how this works to me?

Thanx,
nikolatesla20
04-16-2002, 01:39 AM
Perhaps the exception handler that is set up, gets the address of the next instruction as pushed into it.

For example,

push <address of code AFTER lea eax,eax>
mov fs:[0], esp

like so.

This would make the "except" of the "try" be the very next instruction after the fault, heh heh, and would be somewhat tricky. And I think with any SEH if you enter it you end up tracing thru some kernel code for a little while before you get to the "except" statement of the program, hence it's a bitch to trace..

In fact, you can't get the code "lea eax,eax" to even compile, so it must have been something that had to be entered manually in my opinion.

-nt20
Ni2
04-16-2002, 09:50 AM
Yes, the 'lea eax, eax' produces an excepcion and the installed excepcion handler (SEH, by daemon) takes the control of the processor.

Inside of the excepcion handler you can see what was the reason of the exception. If it is 'invalid opcode', daemon knows that it is because of that instruction (LEA EAX, EAX = 8D C0) and he will add 2 to the EIP register in the context register to avoid a new exception in the same instruction after leaving the SEH. Well, daemon makes this a few things in his code, the reason is nothing else than invoke his SEH handler and decrypt a block of code or just with the intention of disable the hardware breakpoints (BPM), writing in the DRx registers.

About the compilation of the instruction LEA EAX, EAX....yes, you have to do it manually or at least i havent found any illegal assembler that can assemble that :p

take care,
Ni2
^DAEMON^
04-16-2002, 11:16 AM
i enjoy reading the posts! keep on guys... good work!

^DAEMON^
brainspin
04-17-2002, 04:09 AM
iceugedition.ace gives me a CRC error...
is it just me?
^DAEMON^
04-17-2002, 07:38 AM
tried to redownload it ?

other guys told me that they also had, but disappeared as they redownloaded it :)

^DAEMON^
evaluator
04-17-2002, 08:40 AM
Hello, Ni2!

>"How did you manage.."
Secret:)

Soon after I did it on my W98SE, I installed XP.
On XP thiz "powerfull tasm-files-protector" can't does 98% of anti-tricks..

Daemn wrote:
>"i enjoy reading the posts! keep on guys... good work!"

I "manage" this phrase as LAUGH about newbies..
OK! Vendetta:)

Here I again uploaded my workz:) Now restored also mangled code..
So when you protect this file with itself (or with original one),
except last section, all will 100% identical with original one.
("cr.ini" as from package)

Questions for DAEMON:
1. Did you manage OEP for us!? (or again you are @ work:)
2. How we can manage other your phrase:
>"hi binh81
"iam sorry,better go and try yourself @ rea..."
^DAEMON^
04-17-2002, 11:55 AM
eval, i don't laugh @ newbies... :(

ni2 did a great work! that's all... what does it take when u miss the best parts of the protector ? when i started development there were no such rebuilders... as there are today!

and iam bored of this shit i coded! i won't check the files as iam not interested in it...

eval, even better: go and develop your own protection!
iam busy with coding unpackers! and other stuff

^DAEMON^
brainspin
04-18-2002, 01:25 AM
nope...
tried redownloading with flashget, ie, mozilla, getright...
only that file get's a CRC error...
oh well :)
foxthree
04-21-2002, 07:31 AM
Hey Daemon:

You forgot a neato feature in ICEDump that will help in bypassing your anti-debug tricks. Can you figure out what I'm talking abt. here? ;)

Anyways, neato packet with tons of anti-debug code :D

Signed,
-- FoxThree
evaluator
04-26-2002, 07:29 PM
About INT1 based dbg-detecting & XP

Daemon!
On XP I checked your INT1 dbg-detector.
RESULTS:
1. On plain XP this method not works!
program lives in memory and not responds.
then I tested also POXYLOC (it uses F1 opcode). Same result!

2. If debugger loaded, yes, it detects, if not trace wuth F8!
If trace step-by-step with F8, not detected.

RESUME:
Brocken scheme!
evaluator
09-04-2002, 11:15 AM
I find this old thread for correct my(?) mistake.

When I reinstalled XP, INT1 exception now handled very good.
I don't know why that error happens..
So SORRY Daemon from M$.
Your INT01 detector works good on XP.

Also want tell you:
I found SuperEasy way for kill INT01 detection forever.
Regards:)


ASProtected?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtected?
PDA

View Full Version : ASProtected?

Fedev
04-07-2002, 10:02 PM
Hi,
I'm having a problem with PowerStrip 3.15, and maybe someone out there could help me out. The thing is that PS3.15 seems to be packed with ASProtect. I'm not quite sure, since is the first time I face this protection scheme, but based in what I've read it seems to be ASProtected. It has CRC check and an anti-loader routine (which can be fixed with a .dll I found on the net).
At the moment I can only patch it on the fly using any process patcher. But I would like to learn how to unpack this for good.
The other problem I have is that I'm running Windows XP, and some programs like Revirgin I read don't work under XP. But I could install a 9x in one of my HDDs if necessary.
I've tried to unpack it with procdump (crashes) and guw32 (didn't work either).
If there's a tutorial someone could point me to, I'll read it. Or if someone wants to help me somehow, even better.
TIA

Fede
crUsAdEr
04-07-2002, 10:29 PM
hi fedev,

click the search button and type AsProtect, you will have AsProtect at your feet :>>>

cheers,
Fedev
04-08-2002, 06:33 PM
Thanks, I'll do that!.

Fede :)
Fedev
04-09-2002, 12:02 AM
I installed Windows 98 and put a copy of softice, RV, and LordPE on it (I read Spl/\j's ASProtect tutorial). The problem is that Softice doesn't stop automatically when PowerStrip loads (yes, I'm using the loader, and yes I have that option active). There must be some kind of protection I'm not aware of. Could some one help me?.
TIA

Fede

Originally posted by binh81
hi fedev,

click the search button and type AsProtect, you will have AsProtect at your feet :>>>

cheers,
crUsAdEr
04-09-2002, 12:20 AM
erm...

why do you need sice to break automatically anyway?? do a bpx getversion and then runs the app...

sice will breaks where u need to :>>

cheers,
Fedev
04-09-2002, 01:55 AM
But after that, and after you get the the API cluster address, you must run a search "S EIP L FFFFFFFF 61,FF,E0" and later restart the program and set a BPR or a BPM. Well, I can't set this BP from the start since the Symbol Loader doesn't break when the program loads. Am I right?. Or should I break to GetVersion and then continue from there?. Plus, I have the strange feeling there's another protection going around and I'm missing it.

Fede

Originally posted by binh81
erm...

why do you need sice to break automatically anyway?? do a bpx getversion and then runs the app...

sice will breaks where u need to :>>

cheers,
nikolatesla20
04-09-2002, 02:42 AM
It should be ok to bpx on getversion first, in SI when you press F12 to return to the code, look at the little line across the bottom that usually shows you the name of the process you are in. If the line lists no name, then you are probably inside the asprotect code. You may also see several API functions right near where you broke in if it is asprotect.

Now you can set your bpm's etc. This API is called very early in asprotect.

-nt20
Fedev
04-09-2002, 04:51 AM
IceDump solved my previous problem, it seems it wasn't loading automatically as I thought.
The API cluster has some differences when compared to the structure I read on the Tuts., maybe it's a newer version(?). Of course it could be all my fault :( .

015F:00D6CE6A MOV EAX,EAX
015F:00D6CE6C CALL Kernel32!Getversion
015F:00D6CE71 MOV EAX,[00D7464C]
015F:00D6CE76 RET (should this be here?)
015F:00D6CE77 NOP
015F:00D6CE78 PUSH 00
015F:00D6CE7A CALL Kernel32!GetModuleHandleA
015F:00D6CE7F PUSH DWORD PTR[00D74650]
015F:00D6CE85 PUSH EAX
015F:00D6CE86 RET (should this be here?)
015f:XXXXXXXX And it goes on and on...

I ran the search for POPAD and JMP EAX, and now, I got to the BPR part. It should be (or that's what I think) "BPR D840FD D840FD+1 R IF (EIP==D840FD)". When I press F5 everything hangs, so I'm still working around this.
Any thoughts?

Fede

Originally posted by Fedev
But after that, and after you get the the API cluster address, you must run a search "S EIP L FFFFFFFF 61,FF,E0" and later restart the program and set a BPR or a BPM. Well, I can't set this BP from the start since the Symbol Loader doesn't break when the program loads. Am I right?. Or should I break to GetVersion and then continue from there?. Plus, I have the strange feeling there's another protection going around and I'm missing it.

Fede

:( :( :( :) :( :(
foxthree
04-09-2002, 06:54 AM
Hi Fedev:

Here is a tip. Search the board on using WinHex for finding 61,FF,E0 or if you can wait for a couple of days, I'm working on a tool that does just that .... ;)

Also, the above API table is correct! There is nothing new about it. This protection is there to fool RV's trace. Again, search previous forum postings on this one.

Signed,
-- FoxThree
Fedev
04-09-2002, 12:02 PM
I'll wait for that tool, thanks FoxThree, but I'll keep on trying. Don't know why Softice is hanging everything.

Fede

Originally posted by foxthree
Hi Fedev:

Here is a tip. Search the board on using WinHex for finding 61,FF,E0 or if you can wait for a couple of days, I'm working on a tool that does just that .... ;)

Also, the above API table is correct! There is nothing new about it. This protection is there to fool RV's trace. Again, search previous forum postings on this one.

Signed,
-- FoxThree
Fedev
04-11-2002, 01:28 PM
I think I know what's wrong. I don't know exactly why, but it seems that Softice crashes whenever I set a BPR. I tried BPM, but it doesn't work. I know these breakpoints were working before (since is not the firt time I use softice). I hate Windows 98!!!!.

Fedev
foxthree
04-11-2002, 01:59 PM
Hi Fedev:

I can feel your frustration :( . Relax however, help is on its way ;)

Let me take a wild guess, you have set a BPR based on +SplAj tutorial of finding 61,FF,E0? Under Win98, *sometimes* this BPR crashes. I've been down that road my friend. *SOMETIMES* it does work. I don't know why though! May be binh or +SplAj itself might answer but binh switched to Win2K :cool: and +SplAj is now allergic to ASPR :D

That is why I pointed you to WinHex technique which works - UNCONDITIONALLY !!!

Did you try it? Forget the BPR technique. There is a better one ;)

Search the board for WinHex technique else PM me.

Signed,
-- FoxThree
crUsAdEr
04-11-2002, 02:17 PM
grinz...

yeah.. have nothing to say actually... fox, when is ur tools coming out? betta finish it up fast b4 Alexey comes out iwth new version and make ur tool obsolete...

I remeber when i first started on AsProtect with you, i told you "AsProtect is a bitch really" and Alexey replied
*******************************************
hehe.. It's just the beginning... soon you will forget RV and Imprec...
*******************************************

hic hic.. just a reminder for u to speed up frd :>...

Meanwhile, i shall wait for alexey to come up with new stuff and start mugging for exams... sux i hate exams...

till then,
binh
Fedev
04-13-2002, 04:06 PM
Where can I get the latest version of winhex?

Fedev

Originally posted by foxthree
Hi Fedev:

I can feel your frustration :( . Relax however, help is on its way ;)

Let me take a wild guess, you have set a BPR based on +SplAj tutorial of finding 61,FF,E0? Under Win98, *sometimes* this BPR crashes. I've been down that road my friend. *SOMETIMES* it does work. I don't know why though! May be binh or +SplAj itself might answer but binh switched to Win2K :cool: and +SplAj is now allergic to ASPR :D

That is why I pointed you to WinHex technique which works - UNCONDITIONALLY !!!

Did you try it? Forget the BPR technique. There is a better one ;)

Search the board for WinHex technique else PM me.

Signed,
-- FoxThree
crUsAdEr
04-13-2002, 04:36 PM
Hi Fedev,

NO request here!!!!!.. search, learn and use
Fedev
04-15-2002, 12:49 PM
I didn't ask for a crack, nor a cracked program, I asked for the location of the original WinHex (it comes in a demo version, you know). You could just point me to the developer's website. Anyway, I got it now.

Fedev

Originally posted by binh81
Hi Fedev,

NO request here!!!!!.. search, learn and use


tsehp : small "anti-trace" in asprotect..?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > tsehp : small "anti-trace" in asprotect..?
PDA

View Full Version : tsehp : small "anti-trace" in asprotect..?

nikolatesla20
04-08-2002, 12:56 PM
Hey tsehp, RV kicks butt, especially on Win2k, the program tracer OWNS ! -

<Just a quick note to some beginners out there, if you trace a program and it doesn't seem to land on the OEP as the first instruction, remember asprotect has an API, and it calls into the target before executing it, you are on one of those API's. WRITE IT DOWN! You can use it to your advantage :) >

I ran into a problem over the last 2 weeks tho, RV would not resolve all the entries for Bullet Proof FTP Server. When I wrote down the RVA's to the functions, and went in manually with softice, this is what I saw:

At the RVA called from the IAT address:

mov eax, [012054A]
ret

NOtice that this does not call ANY api whatsoever, it just moves a value into eax as tho it DID call an api, and then returns. So where does this value come from you ask? Well fortunately if you scroll up in the code window in SoftIce you could find the answer (heh heh ! :D )

Scroll up some from the code you see listed above, and you would find:

call Kernel32!GetCurrentProcessId
mov [012054A],eax

WOw great fun eh? ASProtect basically takes over calling the conventional startup code in the app, and stores the values away for later. Not a big deal, but it pretty much screws any tracer completely. OH well.

Yes you can still fix it up by hand, I was just bringing out I don't know if any tracer could ever find this. It is a good technique I think. I also think this must be a newer version of asprotect because I haven't seen it before (Note on asprotect website it says new update for registered users - HEY a new one just came out again TODAY! - :D but I can't download it of course ?)

By the way I still can't get this damn BPFTP server fixed out of asprotect, oh well, more practice is needed. (I had no such troubles with BPFTP client). Apparently I still have some calls into ASprotect. (The thing to note is of yet asprotect has not API which gets called INTO. However, it does pass a pointer to the registration information when it calls GetRegistrationInformation. The app accesses this pointer, which is what screws you I think.)

-nt20
Kilby
04-08-2002, 02:11 PM
That code has been in asprotect for over a year now, and indeed was one of the ways of slowing down unpacking.

If you do a bpx getversion before running the packed app you will eventually break on where aprotect captures this value, along with 4 others such as getcurrentprocess.

These stored values are the easy bit of asprotect to deal with these days.

BTW I havn't touched asprotect since November, so I assume that more captured values exist these days.

Kilby...
tsehp
04-08-2002, 05:54 PM
ok,
did you tried the api emulator feature ?
it guesses the api's used by the return value.

regards,

tsehp
nikolatesla20
04-08-2002, 05:55 PM
Yes actually I did try clicking on API emulator, but it also did not resolve them :( I could only do it manually, but it is not such a big deal :)

But I want to thank you for the wonderful tool of Revirgin it is very good ! :)

-nt20
DrFred
04-08-2002, 09:29 PM
For nikolatesla20

Yes sometimes api emulator did no resolve them ..

And another thing new asprotect use a new way to redirect some import ...

old one as you said :

mov eax, [012054A]
ret

New one :

Call Kernel32!GetVersion
push [012054A]
pop eax
ret 004

This make some rebuilder like Imprec to detect wrong import.
In this case it will detect Getversion but import is not that !!!
And i noticed import not resolved are always :

GetCurrentProcessId
GetCommandLineA
GetProcAddress
GetVersion

Bye
P.S if you want to deal with this new aspro try CloneCD 4 beta !
foxthree
04-11-2002, 12:29 PM
Hello Guys:

This one is also not new. Search for posting by +SplAj guru and Evaluator.

Signed,
-- FoxThree
tsehp
04-11-2002, 12:33 PM
Originally posted by nikolatesla20
Yes actually I did try clicking on API emulator, but it also did not resolve them :( I could only do it manually, but it is not such a big deal :)

But I want to thank you for the wonderful tool of Revirgin it is very good ! :)

-nt20

thanks.
Did you tried the new plugins ? They should be working.

I'm actually only working on the tracer.

regards,

tsehp
nikolatesla20
04-12-2002, 06:42 PM
Hey tseph, started using the asprotect1.2xx plugin, it works great thanks.

Sorry to hear about the flame war on the other board. Personally I dont use ImpRec much because it doesn't seem to trace everything as well as revirgin, but of course I haven't tried out the plugins in it yet tho. It is more "stable" but hey its ring3. The one feature I do like from ImpRec is it gives you a good range to find the IAT, if it can't find it on its own. Right now rv just kinda gives up but that's what SI is for, you have to use your brain too. Once you got the numbers the tool works excellent. Especially under Win2K the program tracer rules and its like 50 times faster than Icedump /tracex .

-nt20


good InstallShield 6.x decompiler but how to use its debug info?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > good InstallShield 6.x decompiler but how to use its debug info?
PDA

View Full Version : good InstallShield 6.x decompiler but how to use its debug info?

Solomon
04-08-2002, 03:51 PM
ISD(h**p://nekosuki.virtualave.net) is a good InstalllShield 6.x decompiler. But I don't know how to use the debug symbol files(*.dbg) produced by it, coz the manual is in Japanese:(

Any one has the experience? thanks!


API hooking - new article
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > API hooking - new article
PDA

View Full Version : API hooking - new article

Kayaker
04-08-2002, 04:54 PM
Hi All,

Here's an excellent new full coverage article with source code, demo project and references on this popular subject...

API hooking revealed by Ivo Ivanov

http://www.codeproject.com/system/HookSys.asp

Cheers,
Kayaker
goatass
04-08-2002, 09:35 PM
Kayaker, awesome article....good eyes (for finding it) :)

goatass
Kayaker
04-08-2002, 10:20 PM
Thanks goatass, just happened to trip over it with my morning coffee, which I subsequently spilled ;)

Pisses me off though when a website doesn't consider what an article might look like when it's printed, so here's an edited version of just the html frame without all the banner crap. Maybe it's just me, but I couldn't get a good print copy without the right side being cut off, so I fixed the problem. This is just the html article, no graphics, so you'd need to save the full article then replace the html page with this one.

Kayaker


SoftICE on XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE on XP
PDA

View Full Version : SoftICE on XP

FlatDot
04-08-2002, 10:24 PM
Hey!
I've got SoftICE (DriverStudio 2.5) and running it on XP. It runs for the first time if I disable the first "X;" command, but it makes trouble getting out if it, it freezes the mouse, the keyboard, I cannot get back into it. Pleaze if ya got any info on what's the problem here, reply! :confused:

FlatDot
Woodmann
04-08-2002, 10:32 PM
Howdy,

The information you desire has been discussed many times.

Search for it on this place.

Peace, Woodmann


LaserLock 5 - Help !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > LaserLock 5 - Help !
PDA

View Full Version : LaserLock 5 - Help !

Actlon
04-08-2002, 11:14 PM
Hi - I've recently been playing with the LaserLock v5.00 protection scheme & have come up against a question;

Given a dumped version of a running target I've been able to get the translated API calls. I've also got the LaserLock dll (with the CallDLL export) for the target, have located the info block followed by a list of RVA's with encrypted data indicating the correct api import.

Based on this I've discovered the encrypted data should be xor'ed with the key in the in info block and then there is a secondary key. Given the 'answers' & the original data I have been able to determine the values, which seem to be applied in circular fashion - ie:

long secondary_key[9] = { 0x8C01, 0x1A46, 0x978F,
0xF7AB, 0xA4C0, 0x7BF8,
0xAF42, 0x60B5, 0xAB2E };

long primary_key = /*what ever it is*/;

for(i = 0; i < numCalls; i++) {
long x = ( encrypt_data[i] ^ primary_key ) ^ secondary_key[i%9];
data[ rva[i] - 4 ] = x;
}

These values have come from Worm World Party - the question is; are the secondary keys fixed for the version of LaserLock or is it either tabulated somewhere (& specific to WWP) or algorithmically determined ? can anyone help me - thanks !
crUsAdEr
04-08-2002, 11:52 PM
Hi,

Why dont you just get another Laser Lock product and look into it.. you should be able to decide whether the secondary key is fixed or not...

Cheers,
[NtSC]
04-09-2002, 05:16 PM
Worms World Party was some not standard Laserlock...
Parts of the Exe have been crypted..
To resolve your Exe just collect all [Call Laserlock] Adresses
in the Code.Section and code some rebuilder for it..
but aware of the mofo checksum..

a way not to temper with that ( is what i used in my dumper )

append a call fixer to the file,redirect the OEP to your call_fixer
and fix the Calls to the Laserlock.dll....
Afterwards you dump the code section to Disc + Replace it with the Original One.
There was finally also some Pointer wich had to be recognized,
to know if the Instruction_Opcode of the Original Caller has to be fixed.

And finally.. There was 1 Byte wich had to be set to
remove the Ability to need a CD..
Or more, overriding his Api-Counter.

Mentioned first time by my nice Friend r!sc,cheers ;-)

But yes,it works that way until the first Spenc Version of Laserlock appear...

Another good tutorial on Laserlock is written by Gadix about
Messiah...Very Informative,i appreciate it ;>

Until then,[NtSC]

:)
Actlon
04-11-2002, 01:39 AM
Thanks for the help :)

I was interested in trying to do this in a generic fashion without requiring a CD. I had a look at that spanish tut - I don't speak spanish, but to me it looked as if the guy was trying to collect the references by hacking & needing a CD initially.

Is there any other info out there on the web ? I currently can't find any more apps using LaserLock 5....but currently I'm not at home. Does anyone have any ideas of apps/games etc. using LL that I can get hold of easilly...even just the LL dll & main exe ?

thanks!
ThrawN
04-11-2002, 10:36 AM
This kind of thing really interests me. Using the CD to understand and remove a comercial protection such as cdilla2 and laserlok.
Most of understanding how it works comes from this but when someone writes a tutorial nowadays they seem to write it based on having the origenal cd (thus the attual program is doing half the work for you, you only need to alter, dump and do some small things here and there)
Noone seems to have a care to attual explaining the protection 100% without a cd (which is what we all want to to anyhow yeah?)

Just some stupid food for thought..


Could someone else have a look ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Could someone else have a look ?
PDA

View Full Version : Could someone else have a look ?

nikolatesla20
04-09-2002, 05:01 AM
BulletProof FTP Server.

I've been working on this prog for almost 2 weeks ACK! and I think I am stuck.

Anyway, it's a delphi app, decompiled it with dede, pretty sure OEP is 00503EE4. I got that number memorized by now. Run a /tracex on it, it breaks at 004C894C first. You can actually skip this routine completely ("r eip 00503EE4 <enter>") and the app runs just fine. Except now it shows you have -1 days left :P (Program author used the Asprotect API examples almost directly *sic* ha ha ). Just for your information, I compiled a test Delphi app with all of the asprotect 1.2 functions exported in it, and looked in asprotect to see where it stores these addresses - and in BPFTP Server it is as follows on my win98 machine:

asprotect
pointer
location: exported function in target:
----------- ------------------------
01203580 - SetRegistrationKey
01203578 - GetRegistrationInformation
0120358C - GetTrialDays
01203594 - CheckTrial

Those are the only ones I see this proggie using. I found out that asprotect stores these addresses at ****3580, ****3578, etc. In other words, if you put a bpx on GetModuleFilenameA, and get into asprotect code, and see the high word of where asprotect resides, add the low word from above and that address has the address of the function listed. For example, if some asprotect code was at 003C0530 then GetTrialDays would be at 003C358C. Neato huh? It's kinda fun to mess with that GetTrialDays function, I made the program say I had negative 200 days left :P Another interesting note is that if you make the program expire, you can simply run it by breaking in and setting the eip register to the OEP and it runs fine.

So I "r eip 00503EE4" and then lock the proggie up and dump it, and pasted in my new import table. Mind you DO NOT put the import table in a new section on the end. It seems the proggie wants to access memory there for some reason? So I put the table in its original place, even fixed the firstthunks :).

Right now it starts up , and then instantly crashes, because of numerous calls to addresses in the 0130**** range, which I suspect are from asprotect crap somewhere, this is driving me insane slowly! Anyway, I found a lot of the references to this mem location but you can't patch them all, I tried to trace back to the original call into these routines but it seems it needs to do some of it, if you "ret" it or skip it it will crash too. Basically I looked in that memory range in SI and it looks like it is sticking Delphi resources in there ?? I have no idea what is going on, perhaps I am on the wrong track altogether....

I know there is some D-D going on of course, but I can actually kill all the exported functions listed for asprotect (by modding them while in SI to simply do a ret) and the program will run fine. There seems to be something else going on.

Oh and also if someone does look at this, and manages to get it to *run*, just to warn you ahead of time there is a system.GetFileSize() delphi call at 00503F26 that may need to be bypassed if the size if too much different ...ie unpacked...the good eax result is 00071200 but my unpacked app never even makes it that far.

If someone else has any comments I'd appreciate it. I know asprotect is overdone on these messageboards, but hey it's the one that is the hardest is it not ? *perhaps?*

I've attached my resolved.txt file.

P.S. I can't believe some of you have unpacked CV versions. I could never do that program yet. grr. Still learning :)

-nt20
nikolatesla20
04-10-2002, 02:55 PM
More than one way to skin a cat, as they say.

I created a loader for it instead using Predator's loader generator. Works great. Kills the nag, redirects it to the entry point (NOte to program author, thank you for giving me a messagebox to hook into :D, maybe you should have left it as asprotect's default msgbox.) , and cleans up the title bar from "unecessary" info heh heh.

-nt20
foxthree
04-10-2002, 06:46 PM
Hi Tesla:

Mind sharing how you wrote a loader. AFAIK, ASPR has a run-time memory checksum. How did u defeat that one?

Thanks.

Signed,
-- FoxThree
nikolatesla20
04-10-2002, 07:35 PM
Well the beauty of it is the shareware author chose to use his own custom messagebox when the program expired. So asprotect unpacks his app first, then it looks at the time left, and if it's up, it calls his "CheckTrial" routine. The CheckTrial routine in BPFTP server simply calls up a messagebox, and then after the messagebox is closed, it opens up IE with a call to ShellExec or something like that, and then ret's to ExitProcess.

The process patcher uses the time up messagebox to hook unto the process to know it is ready. I noticed that in SI even when time was up, I could get the program to run if I simply set the eip to the OEP. ( I put a bpx on GetModuleFilenameA and waited until I was in the first D-D call and then redirected the eip register) :D LOL The program itself doesn't even check the time at all, it only relies on asprotect. So I watch for the "Evaluation period over" title with the loader, and when it comes up, it knows the program is unpacked, it patches mem right after the messagbox code - fixes it up to a "push 00503EE4, ret". Then the loader automagically kills the messagebox. Now the program ret's back to the OEP and it runs. I tested it on win98/2K/XP so far and it works great. For BPFTP 2.15. The messagebox is killed so fast you don't even see it come up. The memory patches also remove the "UNREGISTERED" string from the app title bar, and also mods the resources in the about box. All done in memory, and since this is all after asprotect is done completely, it works fine - asprotect never sees the changes (and the program doesn't check for any either).

I used Predator's Extreme Loader Generator from protools. Good tool. I think the real reason this works is because the program author chose to show his own dialog. Hence the patcher is modding BPFTP code and not asprotect code. Couldn't put the loader into its own section tho like I could in BPFTP client. asprotect would notice that grr...

-nt20

Uploaded for educational purposes only ....! Note that the target has to be expired before the loader will work.

*** ATTACHMENT DELETED BY NIKOLATESLA20***
foxthree
04-10-2002, 08:38 PM
Hi Tesla:

Nice analysis. May be this can be done for all targets that use "custom" messageboxes instead of ASPR provided one ;). And talk about programmer laziness ... :D

Cool one, though...

Signed,
-- FoxThree
+SplAj
04-12-2002, 02:05 PM
hmmm,

as my wife always shouts 'can someone put away this computer crap of the dining table, or no dinner'

So I always jump when I hear the word 'someone' ....cos it's me :(

Nico, please see the attached FYI.

This was 'old skool' aspr ;)

Spl/\j

NOTE
====

NOBODY IS ALLOWED TO USE MY INFOS TO RELEASE ANY CR*CKED APPS. ESPECIALLY IF U LISTEN TO PINK FLOYD
nikolatesla20
04-12-2002, 02:34 PM
+SplAj, you ARE a coding god :)

That whole thing prolly only took you ten minutes didn't it?
So I am wondering, was the call at 004C894C creating the heap at the high 130** range? <oops> didn't think of that !

Thanks for the info. Looks like I was kinda close but not quite there.

-nt20


application packed with something called ficken
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > application packed with something called ficken
PDA

View Full Version : application packed with something called ficken

npcracker
04-09-2002, 09:40 AM
Hi all,

i came across the application coded in VB6. :) But the problem is that is had been packed with new (i think) packer something called ficken. Does someone have idea how to unpack that stuff.

npcracker
foxthree
04-09-2002, 10:36 AM
Would help if you can post the URL of this app?

Signed,
-- FoxThree
wbe
04-09-2002, 12:22 PM
That's Pecrypt. Check Protools.
npcracker
04-11-2002, 01:07 PM
Thanx,

its packed with pe-pack and i was able to unpack it. but the problem is that i cant really crack the vb programs. i need help how to get hooked inside the program. when i do hmemcpy then i landed inside msvbvm60.dll. and i cant get into the real program. what to do.

npcracker. :confused:


Disabled Menus In Acrobat Reader
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Disabled Menus In Acrobat Reader
PDA

View Full Version : Disabled Menus In Acrobat Reader

nsumer
04-09-2002, 10:07 AM
I HAVE A PDF FILE WITH PRINT OPTION DISABLED?
I WANT TO LEARN HOW TO REVERSE THIS.
PLEASE HELP ME.
THANX IN ADVANCE
Kilby
04-09-2002, 10:12 AM
Don't shout have a hangover.

Kilby...
foxthree
04-09-2002, 10:25 AM
All Adobe PDF files are protected using "weak" RC4 40-bit keys (except the latest ones which are 128 bit).

Seek and ye shall find ;)

Signed,
-- FoxThree
DakienDX
04-09-2002, 04:05 PM
Hello foxthree !

All PDF files are protected? No, only PDF files which have a password set. And when disabling printing you don't need to set a password.

This is just plain "Disabled Menu Item" Reversing. :)
mike
04-10-2002, 09:49 PM
It's not such a bad approach, DakienDX. The digital rights management stuff is in a tag in the file and you can rewrite it. I guess you could hack your PDF reader so it never disables the printing, but you could also change the file.

There's a default password you can apply that makes the file unreadable unless you implement your own parser. But the file format is fully documented; either get it from adobe or wotsit.org.
DakienDX
04-11-2002, 06:37 AM
Hello mike !

You could of course change every .PDF file you're opening. But I find it more comfortable to enable the menu item in general, since it will also work with files protected by a password. Of course this is just cracking and finding the password is reversing, but reversing must be done for every password (default or user) and every file must be patched. So you have to think how you will need it. If you want to print documents, cracking is good, if other people should be able to print them, it would be better to change the .PDF files.

I did this in 4.05 (Acrobat Reader, not SoftICE) with no problems. I think it works even with 5.0, since if the file can be shown on screen, it can be also printed.


Date changing of computer files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Date changing of computer files
PDA

View Full Version : Date changing of computer files

MTB
04-09-2002, 07:50 PM
Hiya girls/guys/whatever

Here is my problem, I need to reset the date of ALL the files on my computer to January 1, 2002. Does anyone have a utility or know of a program to do this? FYI I am running windows 98SE, soon to be windows XP. This program somehow checks the date of EVERY file, if beyond a certain date it doesn't run.

Yes I do know the trick of setting the bios clock back, installing the operating system, and programs, then backing it up with DriveImage. In three months reformat the hard drive, reinstall good for another 3 months. The solution works but YUCK it's not eligant.

BTW I assume this post belongs under General not Newbies.

Thanks for all your help.

MTB
foxthree
04-09-2002, 08:19 PM
Hi there:

Use TouchFileTimes to code a small proggie that can recursively traverse all dirs and "touch" the times. You can set the time in the SYSTEMTIME structure. Look up in MSDN under IMAGEHELP.DLL section. But this is only supported in Win2K (may be XP also).

"This program somehow checks the date of EVERY file, if beyond a certain date it doesn't run. "

By, "EVERY" do you mean *ALL* the files on your drive or only select files. Because if it is the former, then it is certainly amusing form of protection :D

Signed,
-- FoxThree
DakienDX
04-09-2002, 09:24 PM
Hello MTB !

Are you planning to run under a wrong date all the time? If you set all file's date to 1. January, the next write to USER.DAT, SYSTEM.DAT or SYSTEM.INI will set their date's to the system date. I don't think the program you're talking about checks all file dates, only some specific, like the ones above and maybe some other files too which aren't written at every reboot. The program could also check directory dates. It is very difficult to set a directory's date, so beware of that.

I always use the program FD.EXE, a DOS application from Norton Utilities. It can set any file's date of last modification in all subdirectories. With an one byte patch it can also set file creation time and file access time to what you like.
naides
04-09-2002, 09:54 PM
Two observations:

I think when you say EVERY file you mean any files or files at random. It would take an awful ammount of time to comb through all the files in your HD and check the date in each one of them.

Changing all the file dates is neither an elegant solution. Sooner or later time will pass and some files are going to be updated to the current date, unless you plan to freeze the time in your computer to 1/1/02 just to run an application.

I would try to taget the mechanism that the app uses to read the the dates of some files and disarm it.
MTB
04-10-2002, 01:59 AM
Fellow reversers

Here are some more details.

Got a demo lic for a piece of software (FEM). The usual string stuff with a start and stop date.

It didn't run on my machine. So after going round and round with tech support (California), I finally get hooked up to the security manager. He has me scan my hard drive for files greater than the experiation date of the lic. There were 10 files. Deleted some of them, copied others in command prompt, etc.

It worked! Of course when the 15 day trial arrived the software stopped.

The software normally has a sentinnel dongle attached to it.

After some more digging into the mess of directories it has I found the dreaded flexm stuff. Oh well I attack the dongle end it should be a lot easier.

BTW thanks for Norton Utilities lead DakienDX.

Thanks
MTB


Softice VB export question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice VB export question
PDA

View Full Version : Softice VB export question

madmaN
04-09-2002, 09:02 PM
Im using Windows XP pro and I have Driverstudio 2.5 final
Softice works fine but Im having problems with exporting MSVBVM60.DLL to softice
I put it in my winice.dat file and when i first start softice it loads it fine along with the other dlls. The problem is when I load a VB6 program and try to set a vb6 breakpoint(bpx __vbastrcmp) it sets it but when I do BL it shows it as something like 0136:0065432 instead of msvbvm60!__vbastrcmp and it wont break on vbastrcmp needless to say.
Any help would be welcome...

Thanks,

madmaN
madmaN
04-10-2002, 09:36 PM
Softice wont break on VB proggys at all :(
AirW0lf
04-10-2002, 09:54 PM
Try bpx msvbvm60!__vbaStrCmp

it will work :)
madmaN
04-10-2002, 11:01 PM
Ive tried that too :( But i loaded the symbol file for msvbvm60.dll
with symbol loader and now when i try bpx msvbvm60!__vbastrcmp and type BL
it shows __vbastrcmp only and wont break damnit
foxthree
04-11-2002, 11:51 AM
People... don't do this the hardway. BPM'g VB apps in SICE can be such a pain. Instead, use SmartCheck.

You'll see what I mean ;)

Signed,
-- FoxThree


Sentinel (Appeal for target information)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel (Appeal for target information)
PDA

View Full Version : Sentinel (Appeal for target information)

CrackZ
04-10-2002, 12:43 AM
Greetings,

A brief request for help / information if you will.

I have recently completed full replacement drivers for the Rainbow range of Sentinel keys, (yes they will be available for beta testing, playing, general use, in due course); during the course of this process I have used about 20 targets just to verify that the functions and various Sentinel objects perform similarly, however their remain *gaps* in my driver, specifically for the other (older) keys that the legacy driver supports.

I wouldn't ordinarily ask this, but I'd really rather not leave INT 3's in my code to catch the old keys, if any of you can point me in the direction of old Sentinel Pro / Sentinel Scribe / Netinel or CPlus targets (I only need one function for completion of the CPlus) then I'd be eternally grateful, else I'll settle for decompiling the objects and making some assumptions that the returns work as the other keys (in fact I've no real reason to think they don't just I'd rather verify they do ;-) ). There is also some legacy support for MPHAR keys, I've never run into one of these so if anyone has had the misfortune to remember something protected by them, drop me a line.

For now my Sentinel SuperPro emulation is complete so I don't really need any more of those targets (although I'll happily take them if you have any).

I'm sorry to request targets in this manner, I realise perhaps it isn't immensely appropriate, but I really would like to get this done ;-) and I do need at least a few examples of those older keys to feel confident shipping my driver out the door.

Regards

CrackZ.
scorpie
04-10-2002, 02:22 PM
Hello CrackZ,

Let me know your e-mail, I have something interesting for you concerning SentinelPro (size ca. 5 MB).

Regards,
scorpie
CrackZ
04-10-2002, 10:59 PM
Hiya,

CrackZ__@hotmail.com ;-).

Thats 2 underscores ;p.

Regards.
scorpie
04-12-2002, 07:01 AM
Hello CrackZ__,

Kindly check your e-mail.

Regards,

Scorpie


Cracking w97 files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Cracking w97 files
PDA

View Full Version : Cracking w97 files

dipeshrestha
04-09-2002, 07:04 AM
Dear friends,

I am facing problem while cracking the password protected word document. i generally use bpx hmemcpy in softice to have a break in software. but it does not seems to work with Word or excel. Can anyone help me with that

thanx in advance

dipeshrestha
Aimless
04-09-2002, 07:42 AM
Hullo,

If you are trying the "MEMORY-ECHO" trick to find the password in W97, then forget it. You will NOT get it, because it is not stored and not compared.

As far a bpx hmemcpy is concerned, if you are using the Win NT and above, this no longer exists.

A better way would be:

1. Enter your password
2. Ctrl-D into SoftICE
3. addr winword
4. bpx getwindowtexta
5. Press OK once you are out of SoftICE

If that does not work:

1. Enter your password
2. Ctrl-D into SoftICE
3. addr winword
4. hwnd winword
5. Check for the EDIT class topmost
6. bmsg xxxxx wm_gettext
7. Press OK once you are out of SoftICE

Remember, password protection means that the file gets encrypted. You might try to ask this question on the Encryption Board here on RCE.

...Have Phun
dipeshrestha
04-09-2002, 09:30 AM
Hi aimless,

actually i'm using win 98. now i will try what u have said. thank you a lot. if problem persist i will again contact u.

dipeshrestha
foxthree
04-09-2002, 10:39 AM
erm... I suppose, both methods wouldn't work in this case. I tried with Word 2000. No WM_GETTEXT there. My suggestion would be to break on the WM_LBUTTONDOWN:

i.e. bmsg <handle of OK button> WM_LBUTTONDOWN

Signed,
-- FoxThree

PS: Word 97 MD5-RC4 :D
DakienDX
04-09-2002, 04:02 PM
Hello foxthree !

Word 97 uses RC4?

In 1997 the US government hadn't yet legalized to export cryptography with more than 40 bit from the USA.
MD5 has a 128bit output, so what bits should be passed to the RC4 function? Only the first 40 bit?

Shall we accuse M$ because of weapon-export-violation? ;)
naides
04-09-2002, 04:07 PM
I may have misunderstood your request, but there are word and excel pasword recovery utils floating on the web. give it a search.
foxthree
04-09-2002, 07:44 PM
Hi DakienDX:

I'd refer you to:
http://www.password-crackers.com/crack1.html#office97

I also post a snippet of Pavel Semjanov's PC FAQ on Office 97 Password Cracking:

"But because of US export regulations Office 97 uses 40-bit key. So encrypted files can be decrypted without password knowledge in a few days by searching for this key. Some companies ..."

If you take a look it is MD5 and RC4 with 40-bit keys. Though, I don't *really* know if 40-bits out of 128 are used for RC4, I do know that the crypto is RC4 [this one is for sure ;)] Also, I do know about ITAR Act and that it was relaxed only recently.

Thanks,

Signed,
-- FoxThree

PS: Dakien, don't get me wrong, but I *DO* tend to do my research before posting ;) Cheers!!!
DakienDX
04-09-2002, 09:28 PM
Hello foxthree !

The link is dead. :(
At least I get an "Error 403 Permission Denied".

I haven't read anything describing how M$ Word encrypts file, but it was just logical that it wasn't able to use 128 bit in 1997 outside of the USA.

Maybe I've asked in a wrong way, but I didn't doubt that Word uses RC4, only that it uses 128 bit as key.
foxthree
04-10-2002, 07:07 AM
Hi Dakien:

Thanks for being cool :cool:

Yes, the link gives 403, but I used Google "cache".

Thanks,

Signed,
-- FoxThree
mike
04-10-2002, 03:41 PM
Hi DakienDX, foxthree!

As far as I know, I was the first one to disassemble the thing. This was way back before I'd heard of Fravia or SoftIce or IDA. So I disassembled the thing via MSVC 5's code watch. The addresses kept changing because sometimes the DLL would get loaded into a different part of memory. I had pages of code taped to my wall that I had copied & pasted into word pad.

Anyway, the password test algorithm goes like this:

a=Lo40(MD5(pw in unicode, no terminating NULL))
b=concat(a,first)
c=Lo40(MD5(concat(16 b's)))
RC4Init(c);
RC4Decrypt(second);
RC4Decrypt(third);
d=MD5(second);
if d==third, password is correct.

Lo40 are the first five bytes of the input.
first, second, third are three 16-byte values found in the word file right after the string 00 01 00 01
concat("now","here")=="nowhere"

To decrypt a file, you just have to brute force the 40 bits of c.

To decrypt all files w/ the same password, you just have to brute force the 40 bits of a.

Every file can be decrypted with a nine-character single-case alpha password, since 26^9 ~=2^42.
mike
04-10-2002, 03:46 PM
If anyone cares, DakienDX's been asking about cracking MS Word 97 files in the Newbies forum and I posted the pw test algorithm over there.
DakienDX
04-10-2002, 04:14 PM
Hi mike !

I've put the two threads together so that they stay as one unit. It's OK to discuss this in the RCE Cryptographics.

Thank you for sharing your knowledge about the topic. I wasn't really interested in the Word 97 password protection, but if anybody feels he needs some more information, I'll help to keep the topic up to date.
mike
04-10-2002, 05:11 PM
MS *did* violate crypto export laws with their PWL file. The password is hashed 9x using md5 to derive a 128-bit key which is fed to RC4 to encrypt the contents of the PWL file. Pick a new user name, a long password, store a resource in the PWL file (which can be up to 32 K) and log off. The PWL file is secure storage.

(This only applies to the update of the update that ended up in win98. There are a LOT of problems with early versions of PWL files.)
foxthree
04-10-2002, 08:45 PM
Hi Mike:

Thanks for your post. However, I have one small question. Supposing, say we manage to brute force c (2^40 computations is not that big) but using 'c' how do we get back the clear-text password.

Since:
c=Lo40(MD5(concat(16 b's)))
to get b's from c we need to do Inv(MD5) which is 128-bits! :(

Are you referring to just decrypt the document based on 'c' or getting back the plain-text password? If it is the former, I understand (since you've got 'c', u just do the RC4 decrypt), but how to get the plain-text password :confused:

Signed,
-- FoxThree
mike
04-10-2002, 09:09 PM
Are you referring to just decrypt the document based on 'c' or getting back the plain-text password? If it is the former, I understand (since you've got 'c', u just do the RC4 decrypt), but how to get the plain-text password ???
It is the former, and you understand ;D

You have to do a second brute-force to get 'a' and a third brute-force to get a working password. The second and third brute-forces go very vast compared to the first one, since there's no rc4 setup.

All of this can be optimized out the wazoo with MMX instructions.


Hackman
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hackman
PDA

View Full Version : Hackman

Templar
04-11-2002, 06:15 AM
any opinions on this free program?
Templar
04-12-2002, 06:17 AM
hmm i guess no one has used it or it sucks...

well the url is

h**p://www.technologismiki.com/hackman/

in case someone more experienced whats to check it out and tell me if it's decent or just plain crap


bpr in asprotect...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > bpr in asprotect...
PDA

View Full Version : bpr in asprotect...

Sempai
04-11-2002, 08:17 AM
i've got a question concerning asprotect, as so many have..:-)

after retrieving the location of the popad, jmp eax using the
getversion/61,ff,e0 trick aswell as conferming it with winhex, i need to break on that location. using the breakpoint that is in the tuts all over such as: BPR xxx xxx+3 R IF EIP==xxx

problem is that sice wont break on it. i tried several targets, but i cannot get it to break. if anyone out there could give me a push in the right direction i'd be very thankfull.
foxthree
04-11-2002, 11:48 AM
Use ElicZ's SuperBPM... However, it works on Win98 only. Also, put a BPM on the JMP EAX instruction and not on POPAD. *Sometimes* POPAD BPM does not work but JMP EAX works ;)

Signed,
-- FoxThree
Sempai
04-11-2002, 02:10 PM
thanx for the help, it's highly appreciated!

Nevertherless, it was not successfull.. i tried superbmp already (i use win98 2nd ed.) and also setting the breakpoint on the JMP EAX did not give the disired result. I have no clue what else i can come up with next...
Solomon
04-11-2002, 03:29 PM
Hi

Just try to find the following "call [ebp+18]" in Win9x(not tested in WinME). Probably this is where KERNEL32 calls the SEH handler of ring 3 applications.
Set a *conditional* breakpoint there, then you can watch how the exception handlers of ASPR are called. Right after the *last* SEH structure of ASPR, there is a "JMP [EBP-14]" or "PUSH [EBP-14]; RET". When you are at this JMP, you can set a BPM/BPR on "JMP EAX" to stop at OEP.
I always use this method to find the OEP of ASPRed progs in Win9x(but I formated Win9x long time ago). Please refer to my previous post on IRETD/NtContinue in Win2K.:) good luck

015F:BFF768A0 MOV EDX,BFF768FA
015F:BFF768A5 PUSH EBP
015F:BFF768A6 MOV EBP,ESP
015F:BFF768A8 PUSH DWORD PTR [EBP+0C]
015F:BFF768AB PUSH EDX
015F:BFF768AC PUSH DWORD PTR FS:[00000000]
015F:BFF768B3 MOV FS:[00000000],ESP
015F:BFF768BA PUSH DWORD PTR [EBP+14]
015F:BFF768BD PUSH DWORD PTR [EBP+10]
015F:BFF768C0 PUSH DWORD PTR [EBP+0C]
015F:BFF768C3 PUSH DWORD PTR [EBP+08]
015F:BFF768C6 CALL [EBP+18] <----------KERNEL calls the exception handler of your applications
015F:BFF768C9 ADD ESP,10
015F:BFF768CC POP DWORD PTR FS:[00000000]
015F:BFF768D3 LEAVE
015F:BFF768D4 RET

001B:00B005CC XOR [EAX],EAX <--------- the last SEH of ASPR
001B:00B005CE POP DWORD PTR FS:[00000000]
001B:00B005D5 POP EAX
001B:00B005D6 CMP DWORD PTR [00B049DC],00
001B:00B005DD JZ 00B005F3
001B:00B005DF PUSH 0C
001B:00B005E1 MOV ECX,00B049DC
001B:00B005E6 LEA EAX,[EBP-08]
001B:00B005E9 MOV EDX,00000004
001B:00B005EE CALL 00AFC8FC
001B:00B005F3 PUSH DWORD PTR [EBP-04]
001B:00B005F6 PUSH DWORD PTR [EBP-08]
001B:00B005F9 MOV EAX,[EBP-0C]
001B:00B005FC CMP DWORD PTR [EAX],00
001B:00B005FF JZ 00B00603
001B:00B00601 PUSH DWORD PTR [EAX]
001B:00B00603 PUSH DWORD PTR [EBP-10]
001B:00B00606 PUSH DWORD PTR [EBP-14] <------signature of the last SEH structure
001B:00B00609 RET
Sempai
04-11-2002, 04:45 PM
hello solomon..

many thanx for your effort in helping me out. but i'm afraid i must
be a little bit of a dissapointment to you. i simply cannot get
myself to find that CALL [EBP+18)] you mentioned. Shame on me,
i know.. :-)

so once again i would like to cry out for help, if it's not too
much trouble. thanx!
Solomon
04-12-2002, 03:26 AM
I don't think it's a shame coz everyone starts from newbie.:)

Here is how I find the *LAST* SEH of ASPR:
1. find ANY of the SEH structures in ASPR. In most cases, it contains a "XOR [EAX], EAX" instruction.
2. press F8 to step over "XOR [EAX], EAX" where EAX is 0. In Win2K, this will lead you into KiUserExceptionDispatcher(), but in Win9x, you will land in the ASPR exception handlers. Just trace till the exception handler returns, then you will see the "call [ebp+18]". This is the case in Win98. I don't know what it looks like in Win98SE/WinME.
3. put a BPX on "call [ebp+18]", e.g "BPX XXXXXXXX if *(ebp+18)< 1000000" and keep pressing F5.
Each time when this breakpoint is hit, type "u *(ebp+18)" to see whether it's the last SEH structure.
Sempai
04-12-2002, 07:07 PM
hi solomon...

many thanx for your help once again.

All went fine and i was able to reach the JMP [EBP-14]. But from there i dont seem to be able to find the popad,jmp eax anymore!

most likely i'm doing something not quite right, but perhaps you could shine your light over it once more...?! thanx in advance.
nikolatesla20
04-13-2002, 03:13 AM
What I have found is that Win98 is kinda "stupid" with SoftICE.

For example, if you just CNTRL+D into SI, and then switch address contexts to see the memory of a program you want to spy on (use the "addr" command) , try telling SI to unassemble an address and it won't. In Win98 it will say "invalid address". You have to type the SELECTOR in the address to make it work right.

For example:

Instead of u 00456432

I have to put:

u 0167:00456432

Note that I only need to do this when I get into the program's space with the context switch command. But I noticed you also seem to need it when trying to set BPM's sometimes in Win98.

In Win98 you have to "force" SI to the right address space in this way. In Win2K you don't, everything works correct.

So Run your packed app, and then CNTRL+D into SI, switch into its address space ( "addr <process name>"), and do the search for the popad, jmp eax.

s 30 L FFFFFFFF 61 FF E0

When the address pops up, put in your break range but don't forget the address selector.

bpr 0167:<address of popad> 0167:<address of popad +3> R IF eip==<address of popad>

Now, the 0167 is arbitrary. It might be different for you, just do a bpx GetVersion, and when you land in your app, write down the selector of where the code is. That is the selector you want to use later for this BPR.

This should work then. I just did this last night to break into commview 3.3. I use WIndows 98 at home.

Just as a side note, Yes Win98 is 32 bits and so memory is flat, but for some reason SI doesn't see it correct like I said, you have to make sure it sets the bpm's correct by using the selector if you have to , to force it. Win2K doesn't have this weirdo operation - for example I can unassemble even if I just switch contexts in Win2K.

-nt20
Solomon
04-13-2002, 06:28 AM
There are ONLY several decrypt loops(many more in latest ver of ASPR) between "JMP [EBP-14]" and "POPAD/JMP EAX". So I often manualy bypass these loops by setting a breakpoint at the end of each loop and press F5. Sure we can also search for the address of "61 FF E0 " first(assume it's xxxxxxxx), then type "g xxxxxxxx" at JMP [EBP-14].
:)
Sempai
04-14-2002, 02:40 PM
thanx nikolatesla20: i tried your trick, but was not successfull with it. i suspect something not to be quite ok with the location of the popad, even if i verified it with winhex.
thanx anyway, i'll keep trying.

Solomon: thanx once again, but the problem is that when i am at the jmp [ebp-14], the popad cannot be found anymore. searching for 61,ff,e0 gives not the desired result. seems strange to me, or am i mistaken..?

thanx anyway, to all that is out there giving me a hand in this
problem.
Solomon
04-14-2002, 03:14 PM
sorry I have not express it clearly. I mean using WinHEX or any other tools to search 61,FF,E0 in the process memory first.:)

Originally posted by Sempai
the problem is that when i am at the jmp [ebp-14], the popad cannot be found anymore. searching for 61,ff,e0 gives not the desired result. seems strange to me, or am i mistaken..?


ASPR API ? (ReGet Deluxe 3.0 beta 117
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR API ? (ReGet Deluxe 3.0 beta 117
PDA

View Full Version : ASPR API ? (ReGet Deluxe 3.0 beta 117

Solomon
04-11-2002, 03:09 PM
h**p://www.reget.com/redir/redir.asp?lang=default&product=dx&link=betanew

There are 3 redirected calls that I can't understand in this target.
Here is what I do:
1. make a full dump at OEP (4CEDE0)
2. rebuild the IT (IAT start RVA = F1000, IAT length = 6A0)
3. fix the dumped exe.
But when I run it, I get access violations at the following 3 places. Here it is:

001B:0047914B MOV EAX,[ESP+04]
001B:0047914F MOV [0051CA4C],EAX //first
001B:00479154 RET
001B:00479155 MOV EAX,[ESP+04]
001B:00479159 MOV [0051CA50],EAX //second
001B:0047915E RET
001B:0047915F MOV EAX,[ESP+04]
001B:00479163 MOV [0051CA54],EAX //third
001B:00479168 RET
001B:00479169 PUSH EBP
001B:0047916A MOV EBP,ESP
001B:0047916C PUSH ECX
001B:0047916D MOV EAX,[0051CA54]
001B:00479172 MOV DWORD PTR [EBP-04],0000008C
001B:00479179 TEST EAX,EAX
001B:0047917B JZ 00479187
001B:0047917D LEA ECX,[EBP-04]
001B:00479180 PUSH 04
001B:00479182 PUSH ECX
001B:00479183 CALL EAX //call ASPR code
001B:00479185 LEAVE
001B:00479186 RET
001B:00479187 PUSH 10
001B:00479189 PUSH 00
001B:0047918B PUSH 005096D8
001B:00479190 PUSH 00
001B:00479192 CALL [004F14EC]
001B:00479198 PUSH 00
001B:0047919A CALL 004CDE79
001B:0047919F CMP DWORD PTR [0051CA58],00
001B:004791A6 JNZ 004791BD
001B:004791A8 MOV EAX,[0051CA4C]
001B:004791AD TEST EAX,EAX
001B:004791AF JZ 004791BE
001B:004791B1 CALL EAX //call ASPR code
001B:004791B3 MOV DWORD PTR [0051CA58],00000001
001B:004791BD RET

I don't know what's the purpose of the above calls. Any one has the idea?:confused: I can be sure that rebuilt IT is correct.

I have tried the following way to fix the above problems, but still fails.
1. dump the whole ASPR code(RVA:6F0000-----70B000) at OEP.
2. add a new section to the rebuilt exe to hold ASPR code, and rebuild EXE header.
But it still crashes after I press the "Evaluate" button in the NAG.
crUsAdEr
04-11-2002, 03:34 PM
Hi solomon,

I am not very sure... but the 3 calls look exactly like the usual D-D in AsProtect... if you skip those dips before dumping, usually AsProtect API is not set up and hence wont be called... i dont know what they do exactly..

Normally, i skipped the dips and targets run fine, that 's what i did with buld 114... did not lok at this new target.. shall try if i am free tonite..

You are still playing with reget :>...?
Solomon
04-11-2002, 04:15 PM
yeah, ReGet is my favorite download manager:)
I want to examine its new online-activation protection.
Thx for your guidance.:)
crUsAdEr
04-11-2002, 06:55 PM
Howdy Solomon :>,

Time to move this thread to Mike's forum :>... if you have read the thread about Advanced Archive Password Recovery... then you will find this familiar :>...

Yep... essentially this 2 calls decrypt section of the code... using a similiar algorithm to what i have found out in ARCHPR 2.0... MD5 HAsh with TEA :>... this time there is no need to find the key though cos the key is alreayd present :>....

The code section at 4060E3 is encrypted with the length E8 bytes.. these 2 calls decrypt it.. i am not sure what else do these 2 calls do.. if u skip these dip while unapcking it.. the code will not be decrypted and thus ur program will crash... (only after 30 second i think :>)...

Regarding why you program wont even run when u click evaluate.. that is because the 2 calls you listed are performed.. hence 2 patches to bypass these calls and you program will run fine....

I have it up and running... however, it cant seem to connect to anywhere :<<... i suspect it is the size check etc but have not looked into it yet...

If you are interested in what those calls do, read the thread by me, Dakien and Mike... if you just wanna unpack... i suggest skip those d-d when dumping, then run the original program again, dump the decrypted code section i mentioned above and paste them in your dump... (i suggest this because i dont know if these 2 calls also set up other AsProtect flags so it's safer to skip them)... but it's up to you...

I am still looking at this target... but that is some pointers so we both can work together...

Hope this helps,
nikolatesla20
04-11-2002, 07:26 PM
I knew that it was prolly decrypting some of the code too, so I tested it like so:

1. put a bpx on 00479169
2. when it got there, I locked it up.
3. Save Dump01.exe

4. leave bpx on 00479169
5. restore old locked up instructions...
6. F10 throught the asprotect call
7. lock up on the ret
8. Save Dump02.exe

9. Compare them in Hex Editor (Hex Workshop).

Strangely, the only differences it found were where I had modified the code ! grr. I thought it would show up where the decryption took place, so then of course I could do what you suggest above, know what area had changed, and dump that particular part out of the working asprotected app, and paste it into the dumped app so it was decrypted, and then skip the calls.

Why the heck didn't the hex editor show up any more differences...grrrrrr What the hell???

Also, it only ran thru the first asprotect call - you didn't want to land on the other two code sections as far as I could tell - they both will put up an error msgbox (Error 900 and Error 901)

Maybe I've been staring at SI too much the last few weeks working to get better.

:)

-nt20
crUsAdEr
04-11-2002, 08:12 PM
Hi Nikolatesla,

The first call is used to decrypt a table at AsProtect memory which contains the info abt sections of code to be decrypted....

The second call will decrypt that code section :>...

If you trace into the first call and look at eax, edx being pushed on stack of each call... you will see what i mean ... hope this help... if not u can refer to the thread in Crypto forum...

cheers,
nikolatesla20
04-11-2002, 09:45 PM
OK I wasn't sure that it went into that second call, so I put a bpr on the range, and sure enough it did end up there (duh). SO I did the double dump trick from there, and sure enough just like you said binh81, got the decrypted section.

In Hex Workshop the decrypted data starts at 004060E4 and is length EC. Here is that data off my Win98 machine :) NOte it's a binary file, don't be opening it up in notepad unless you can read Japanese ! Open it in your hex editor...

Oh and also that asprotect call sets a flag at 0051CA58 to 1 so you might want to do that in the dump too, in case other things check it......

One of these days I'll get better at this..ho hum..

-nt20
nikolatesla20
04-11-2002, 10:31 PM
Ok I got it unpacked and it worx just fine for me, tested the downloading , seems to function just fine :)

Dumped it at the OEP, pasted in the decrypted data, fixed and added the new imports section, set the flag at 0051CA58 to 00000001, and then cut out the asprotect calls:

changed 004791A6 from 7515 to EB15 (jump always)
changed 00479183 from FFD0 to 9090 (nop the call)

Doesn't look like there is any exe size check but I haven't decompiled it yet, just saying it seems to download stuff fine..

Cool. I think I am going to learn a lot on this messageboard.

-nt20
Solomon
04-12-2002, 02:33 AM
yeah, I learned a lot from your discussions:D
I will try to find Mike's thread and read it:) Thx!
JMI
04-12-2002, 03:38 AM
I believe he's refering to the one in the crypto forum, part of which was turned into his tut on the Fravia Board. There are three together and I believe it is the bottom one, titled "Tutorial: finding encryption code". Good discussion of the issue by bin81 included, which Woodmann has suggested he also turn into a tut.

Wish I had more time to actually play with this stuff, instead of just reading about it, but hay, someone has to pay the bills.

Regards.
Solomon
04-12-2002, 09:29 AM
nothing special with the Activation Code. I patched the beta to never expire.

[HKEY_LOCAL_MACHINE\SOFTWARE\ReGet Software\Registration]
"ReGetName"="Beta User"
"ReGetCode"="XXXXX-XXXXX-XXXXX-XXXXX-XXXXX"
"ReGetActCode"="YYYYY-YYYYY-YYYYY-YYYYY-YYYYY"
Stone()
04-13-2002, 10:25 AM
nikolatesla20 are you sure you got all right?

414 000F1688 77E16F8E 01FB USER32.dll RegisterClipboardFormatA

check this again, didn't look at the others but this one came to my eyes.

Will have a look at 117 later, I always love if Reget adds some new tricks to defeat us.
Solomon
04-13-2002, 02:51 PM
I got the same result as his

Originally posted by Stone()
nikolatesla20 are you sure you got all right?
Stone()
04-13-2002, 03:48 PM
manually looking into imports I corrected this to:
RegisterWindowsMessageA whilst the following one is:
RegisterClipboardFormatA

I works fine, but maybe I'm wrong.

Result: Dumped Reget at it's OEP, pasted decrypted code,
fixed Asp calls, fixed size checks (2), patched expiration,
eliminated server checking for updates, elimated Debug Report.

Missed something?

Yes, to set the flag at 0051CA58 to 00000001, I'm ashamed, but being a newbie I don't know where to find this. I know that I need to put the code like mov dword ptr [0051CA58], 00000001,
but where?
crUsAdEr
04-13-2002, 05:55 PM
Hi Stone,

You can hardcode the value 00000001 into ur dump :>....

Cheers,


Finding RSA Constants for keygenning...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Finding RSA Constants for keygenning...
PDA

View Full Version : Finding RSA Constants for keygenning...

foxthree
04-11-2002, 08:33 PM
Hi All:

I just unpacked a "famous" packer :o and analyzed its keygen scheme. It is using RSA. I'm pretty sure of this as it is using constants like A, E, D, N etc. in its keygen code.

My question here is that, if an application packed with this packer is shipped and uses the keygen mechanism provided by this packer for registering the software, then:

(1) What constants must be encoded into the binary so that I can fish it out for a keygen?
(2) What constants must be factored by me to complete the keygen?

BTW, i thought I knew RSA by heart, alas, that thought is short-lived after I reversed this code. I'm off to study RSA again ;) but wanted your opinions on this one.

Signed,
-- Foxthree
Kythen
04-11-2002, 11:08 PM
The constants E and N will be in the target in some form. You must factor N to get it's two prime factors P and Q. The decryption exponent D is calculated from P and Q using D = E^-1 % (P-1)(Q-1).

Hope that helps!
Kythen
mike
04-12-2002, 01:36 AM
If you're not sure it's RSA, can you post what he's calculating?
foxthree
04-12-2002, 09:45 AM
Hi Kythen:

Thanks for your post.

Mike: Yes, I will. Let me first complete my analysis.;)

Signed,
-- FoxThree


CommView 3.3 :) Small issues..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CommView 3.3 :) Small issues..
PDA

View Full Version : CommView 3.3 :) Small issues..

nikolatesla20
04-12-2002, 05:08 AM
Well thanx all for your help I did a search of the MB for commview and I finally got it unpacked and working, but still some probs!

The program runs just fine on its own, it doesn't "appear" to have any size checks or the like. It comes up and functions normal. But as soon as you try to patch ANY of its bytes on disk it crashes like a mother, spitting out delphi exceptions..I beleive this is written in delphi isn't it? DeDe won't decompile it at all.

It almost seems like there is another layer of protection or something. I can't even use a memory loader like I did for BPFTP Server. It still creates exceptions. What it almost looks like is that when it detects a change in its code, (or "critical" sections of code, like that jmp the fixes the half the packets bug :) ), that it then tries to call asprotect or something.

I kinda know when asprotect gets called because on my win98 machine it comes up as a 084:00000000 address where the crash happened. Yep obscure as hell. ANyway I've got to get some sleep tonite so gotta wait until tomm. to try fixing the bugs.

Thanks though for your knowledge all out there, I've never been able to dump this program before. :)

OH WELL OOPS and another thing, yep it crashes after a min or so with an error 212. I beleive that is a delphi memory access error. Looks like there are some good trix in this build. No wonder they don't need a size check. Time to find that damn timer....and possibly some weird crc check of some sort. Well at least it runs :P for like 40 seconds. lol.

-nt20
Solomon
04-12-2002, 05:18 AM
CommView uses the hash of its partial memory image to decrypt some resource data. There is a long hash-and-decrypt loop in its startup code. So if you press Ctrl+D before its main window appears, you may see this loop in SoftICE. It's a reasonable way to kick it away: After the decryption, copy & paste the decrypted data to dumped exe and skip the decrypt loop(+SplAj told me about this long time ago. we can also use Self-Modified Code to patch it). Now the question is: what's the begin and end of the decryption?:)
foxthree
04-12-2002, 07:08 AM
Hi People:

I've played around with CommView 3.3 (as you might've probably noticed) and was able to successfully unpack and patch the proggie.

Tesla: If you patch the file, you'll get into CRC/Hash check loops. Do this. Write a small loader. ;) However, this loader is not trivial :D It seems if you CreateProcess suspended and patch the memory and then ResumeProcess, blah hash check again wtf? :mad:

So, we do this, CreateProcess normal, Sleep for like 10 secs. (this was on my machine) and then patch. Bingo!!! Works like clock-work. What is happening here is what Solomon said, there is a "lengthy" hash check loop. So, we'll have to wait for it to end.

Hey, folks btw, even after patching this, I don't think CV runs fine. I mean, it seems to be dropping packets on my machine :( and this happens only arbitrarily. If this is really a *trick*, it is a pretty tough one to crack, I think. You can imagine this: you can never predict what kind of packets are being dropped if the proggie detects if it is unpacked :(. So, now there is a question of reliability of the network monitor itself after unpacking.

Oops I think I'm saying too much. If CV guys hear this, they might incorporate this in the next version :eek:

Signed,
-- FoxThree

PS: If you guys need the code for the loader, PM me. It's nothing great, though !
Solomon
04-12-2002, 07:14 AM
hehe, brilliant idea:DReGet's author can also destroy some random bytes of the downloaded files if it thinks it's cracked. But if he does so, ppl may never use it again:D

Originally posted by foxthree
Oops I think I'm saying too much. If CV guys hear this, they might incorporate this in the next version :eek:
nikolatesla20
04-12-2002, 09:14 AM
Thanx guys, I'll try some of those suggestions.

Still two questions rolling around in my head - number one, I tried to set a BPM on the code I changed, but I never seemed to land there, to access it - hmm wonder why. I thought I would land in the crap hash loop just like in Spl/\g's tutes. But no break. nothing. If MUST read it tho, or it wouldn't know it changed. Maybe I need another type of bpx (like bpr or something)

And also, why doesn't it work if I do an in memory patch with SI? ok, the first thing I am trying to kill of course is the "half the packets" bug. Am I killing this correct? Setting the je at 0060FADD to jmp always? It's the only reference I saw so far to the string, although of course there could be another that is encrypted. SO I open up SI, and edit the bytes right there in mem where I want, after CV has started. If a loader worx, how come I dont lol :>

It doesn't appear to change it. wth? Looks like I still need to learn a few things.

-nt20
nikolatesla20
04-12-2002, 09:39 AM
Well solomon, did like you said and sure enough huge ugly loop taking place. I wonder if this is why commview loads so damn slow? That slow loading really irritates the crap out of me. That's the annoying part about protections, like import table mucking. It slows the app to a damn crawl. You should see how much faster FlashMX is now after I unwrapped it from the crapware Vbox 4.6.

But anyway, I digress. Here is part of the code where this crap happens:

015F:0061DE9F 8BD7 MOV EDX,EDI
015F:0061DEA1 8D4314 LEA EAX,[EBX+14]
015F:0061DEA4 E8BF000000 CALL 0061DF68
015F:0061DEA9 83C740 ADD EDI,40
015F:0061DEAC 83EE40 SUB ESI,40
015F:0061DEAF 83FE40 CMP ESI,40
015F:0061DEB2 73EB JAE 0061DE9F

This little loop loops for a while it seems....

And here is what happens inside of that CALL 0061DF68 :

015F:0061DF68 53 PUSH EBX
015F:0061DF69 56 PUSH ESI
015F:0061DF6A 57 PUSH EDI
015F:0061DF6B 55 PUSH EBP
015F:0061DF6C 8BEA MOV EBP,EDX
015F:0061DF6E 50 PUSH EAX
015F:0061DF6F 8B500C MOV EDX,[EAX+0C]
015F:0061DF72 8B4808 MOV ECX,[EAX+08]
015F:0061DF75 8B5804 MOV EBX,[EAX+04]
015F:0061DF78 8B00 MOV EAX,[EAX]
015F:0061DF7A 034500 ADD EAX,[EBP+00]
015F:0061DF7D 0578A46AD7 ADD EAX,D76AA478
015F:0061DF82 8BF3 MOV ESI,EBX
015F:0061DF84 F7D6 NOT ESI
015F:0061DF86 23F2 AND ESI,EDX
015F:0061DF88 8BF9 MOV EDI,ECX
015F:0061DF8A 23FB AND EDI,EBX
015F:0061DF8C 0BF7 OR ESI,EDI
015F:0061DF8E 03C6 ADD EAX,ESI
015F:0061DF90 C1C007 ROL EAX,07
015F:0061DF93 03C3 ADD EAX,EBX
015F:0061DF95 035504 ADD EDX,[EBP+04]
015F:0061DF98 81C256B7C7E8 ADD EDX,E8C7B756
015F:0061DF9E 8BF0 MOV ESI,EAX
015F:0061DFA0 F7D6 NOT ESI

Just a bunch of bitwise operations just like mike describes for crypto :) You can see the constants there, this goes on for a while.

This little loop takes 40 byte chunks. But I haven't found where the data goes that is modified blah blah. Its 3 in the morn, I just got up for a small snack and figured I'd check in.

-nt20
foxthree
04-12-2002, 10:00 AM
Hi Tesla/crew:

This is getting to you right ? As +SplAj had once on his posting
"There is a very fine difference between a hobby and mental illness" he he I guess this applies a lot to reversing :p

And Solomon, don't say that out too loud, 'cos Reget's Author might implement such a thing if the proggie is unpacked... :D

Signed,
-- FoxThree
Solomon
04-12-2002, 04:16 PM
played a while with this baby. Here is what I got(v3.3 build 205):

001B:0061EB99 MOV ESI,EDX
001B:0061EB9B MOV EBX,00000020 <-----loop counter
001B:0061EBA0 LEA ECX,[EBP-1C]
001B:0061EBA3 MOV EDX,ESI
001B:0061EBA5 MOV EAX,[EBP-04]
001B:0061EBA8 CALL [EBP+0C] <----MD5 hash algo
001B:0061EBAB PUSH 10
001B:0061EBAD LEA ECX,[EBP-1C]
001B:0061EBB0 MOV EDX,[EBP+14]
001B:0061EBB3 MOV EAX,[EBP-08]
001B:0061EBB6 CALL [EBP+10] <-----?????
001B:0061EBB9 CMP BYTE PTR [EBP+08],00
001B:0061EBBD JZ 0061EBC4
001B:0061EBBF ADD ESI,[EBP-0C]
001B:0061EBC2 JMP 0061EBC7
001B:0061EBC4 SUB ESI,[EBP-0C]
001B:0061EBC7 DEC EBX
001B:0061EBC8 JNZ 0061EBA0 <-----loop again

61DE00 MD5Init
61DE30 MD5Update
61DF68 MD5Transform(0x40 bytes per block)
61DED0 MD5Final

Just setting a breakpoint at MD5Update(context, input, inputLen), I got the base address and length of input data. Base address is always 401000, and the max length is 21F800, so if we directly modify the data between RVA 01000~220800 before the above loop, it will crash. Have to use SMC to do this.:)
nikolatesla20
04-12-2002, 04:23 PM
Also just to let you know this MD5 function is called even during runtime, for example, if you've done some mem patching, just try and open the packet log.

*BOOM*

Of course it won't crash the app, the exception handler catches it at least.

-nt20
Solomon
04-15-2002, 03:33 AM
It also puts file size into 62E570, but ddon't know whether it's checked. There are also some interesting names like "IsDebuggerpresent", "ZwSetInformationThread" etc.

:0061D1E6 A370E56200 mov dword ptr [0062E570], eax
:0061D1EB E8F4F5FFFF call 0061C7E4

* Possible StringData Ref from Data Obj ->"KERNEL32.DLL"
|
:0061D1F0 68F4D26100 push 0061D2F4

* Reference To: kernel32.LoadLibraryA, Ord:01E0h
|
:0061D1F5 E892A3DEFF Call 0040758C
:0061D1FA A378E56200 mov dword ptr [0062E578], eax

* Possible StringData Ref from Data Obj ->"NTDLL.DLL"
|
:0061D1FF 6804D36100 push 0061D304

* Reference To: kernel32.LoadLibraryA, Ord:01E0h
|
:0061D204 E883A3DEFF Call 0040758C
:0061D209 A37CE56200 mov dword ptr [0062E57C], eax
:0061D20E 833D78E5620000 cmp dword ptr [0062E578], 00000000
:0061D215 7472 je 0061D289

* Possible StringData Ref from Data Obj ->"IsDebuggerPresent"
|
:0061D217 6810D36100 push 0061D310
:0061D21C A178E56200 mov eax, dword ptr [0062E578]
nikolatesla20
04-15-2002, 03:49 AM
Yeah that IsDebuggerPresent call is very popular...I even saw it in a screensaver once! And they always load it dynamically.

I don't know if I am up to resolving this encrypted crap yet. If I could just find where it stores the calculated hash value, I'd be home free, like in Spl/\j's tutorial for 3.1. But I have this feeling the author changed things a bit since then..but if not I could just redirect the created hash value to someplace else and then just hard code the correct value like in the tute. I like Spl/\j's way of thinking. You just feed the program what it wants. In fact I think that is better than heavily forcing the program, it's a cleaner patch that way. And you can never tell what other parts of the program might use that data.

Oh and I suppose you could see if the filesize is ever used by simply putting a BPM on it. It might be used, because after like 90 seconds I get an error message (error 212, this is a Delphi memory access error (invalid memory)). BTW have you ever used DeDe for delphi decompilation? It works very well on a dump. Keeps you in the HLL code so you don't get lost in Delphi library code that has nothing to do with the operation.

I am still working to get better at reading assembly in SI. I know asm, but reading thru an active routine requires a lot of concentration and sometimes my brain is just tired and I get distracted easy I guess :) . Maybe I should turn off the tv lol :)

I will say I have gotten a lot better even in the last few days even thanx to all you guys THANKS to Spl/\j, foxthree, binh81, and Solomon !

-nt20
Solomon
04-15-2002, 04:07 AM
yes I set a BPM but even after several minutes it's not triggered. Maybe it clears debug registers before check or maybe it checks file size at a certain time. I even search all references to this addr in the deadlist but no luck.

I have patched the CRC check and keyfile check, got a registered ver. There is no err msg box even after 15 minutes:) According to someone, the keyfile uses ECC.
nikolatesla20
04-15-2002, 02:30 PM
Solomon, would you care to share with me how you worked around the hash valued crc check stuff? I really need some direction..

In other words, to get around the program checking its own code, which keeps me from changing anything.

-nt20
Solomon
04-15-2002, 02:46 PM
actually nothing new. :D

I just hard-coded the 512-byte MD5 hash into the unpacked exe to bypass the CRC check . Now each time it will fetch 16 bytes from this hash table, instead of calculating it out. This will also increase its launching speed:)
foxthree
04-15-2002, 03:02 PM
Er... excuse me Solomon, but 512-byte MD5 hash? I thought MD5 always produced 128-bit hash values (128bits == 16 bytes)? Is it a custom Hash Algorithm or MD5?

Signed,
-- FoxThree
nikolatesla20
04-15-2002, 03:12 PM
Ok solomon, that is what I was going to do too, like in Spl/\j's tutorial, but what I am wondering is if you could tell me (ha ha lol I am lazy today) where did you find the hash value being stored? I tryed tracing thru the code but I got bored and kinda lost. *sigh*

So was it still using the same 16 byte trick as in the 3.1 tutorial?

Please excuse my slackness, my brain is kinda fried today, I did like 4 different programs over the last week lol.

Thank you :)

-nt20
Solomon
04-15-2002, 04:13 PM
Hi

FoxThree: sure u are correct. :) The loop counter is 0x20, so total = 16 * 0x20 = 512 bytes:D

Just set a "BPM X" exactly after MD5Final( ), you will see 4 MOVSD instructions. That's it.:)

BTW: I did not read +SplAj's tut about the old versions coz I can remember that it was full of unreadable characters to me when I opened it. Actually he already told me about it in private message(thx for this and much more:) )
nikolatesla20
04-15-2002, 04:32 PM
Thanks solomon, I will try that.

Previously I had stepped through 3 different locations of movsd's. The problem was they all seemed to be called a lot, like if I put a bpx on it, it kept doing it as tho it was looping and not done yet. But Now I realize it could be that it was just calculating for each resource it was loading, so that might have been why. I DID try and watch the movsd's before, and I did write down where they went, but it never looked like it was actually done to me (cause it kept looping again).

Maybe I will look at this target again. (I already have a *working* version from somewhere else)

-nt20
nikolatesla20
04-16-2002, 01:36 AM
Ok solomon I think I need more help please.

I do recognize now that yes the loop goes thru 20 times, hence the 512 bytes. But I still can't for the life of me see where these bytes go ! I mean, I put a bpx after md5 finalize, and ok, yes, there are 16 bytes getting transferred, but they are way up in the 01D*** range of mem. No where in the program that I could see yet (in the file). Of course there could be a pointer somewhere, I haven't looked for that yet, but I am thinking that the whole 512 bytes must be built into a table somewhere ? becaue the checking goes all the way up thru 00620800 if I calculated it correct, so this would include the code we are trying to step thru. Just stepping thru it corrupts it (because there is a bpx set).

So maybe if you could give me just a little more detail, like a super tiny mini walkthru..this is the toughest target I've ever done yet. I actually already downloaded Tamosoft's other program, the data protection one, and unpacked and patched it just fine. But it doesn't have this hella md5 check.

Im sure if I stare at the code long enuf I'll get it, but I think I may need a few more clues yet :p

Thanks for any help I really appreciate it. :)

-nt20
Solomon
04-16-2002, 02:35 AM
well this prog often uses __fastcall calling convention, please see the the following comments. At CS:0061EBA0 the value of ECX is always the same, so there is no consecutive 512-byte table, only 16-byte sequence. I suggest grabbing MD5 C source from google and comparing it with the corresponding ASM code.:)

001B:0061EB99 MOV ESI,EDX
001B:0061EB9B MOV EBX,00000020
001B:0061EBA0 LEA ECX,[EBP-1C] <----this is where 16-byte hash will be stored each time
001B:0061EBA3 MOV EDX,ESI <---- length of input data
001B:0061EBA5 MOV EAX,[EBP-04] <---- base address is always 401000
001B:0061EBA8 CALL [EBP+0C] <----MD5 hash algo
001B:0061EBAB PUSH 10
001B:0061EBAD LEA ECX,[EBP-1C]
001B:0061EBB0 MOV EDX,[EBP+14]
001B:0061EBB3 MOV EAX,[EBP-08]
001B:0061EBB6 CALL [EBP+10]
001B:0061EBB9 CMP BYTE PTR [EBP+08],00
001B:0061EBBD JZ 0061EBC4
001B:0061EBBF ADD ESI,[EBP-0C]
001B:0061EBC2 JMP 0061EBC7
001B:0061EBC4 SUB ESI,[EBP-0C]
001B:0061EBC7 DEC EBX
001B:0061EBC8 JNZ 0061EBA0
Solomon
04-16-2002, 03:56 AM
Can anyone read the tut by +SplAj? URL is
h**p://www.woodmann.net/forum/attachment.php?s=&postid=10171

I'm using IE 6.0. It shows nothing when I open this html file, and full of unreadable chars when I select "view source" for this file.:(
nikolatesla20
04-16-2002, 04:01 AM
That's because the source is JAVASCRIPT, the most powerful EVIL known to MANKIND.

Spl/\j, I was starting to like you, but now I don't know anymore...unless this got converted to script some other way :)

JAVASCRIPT IS EVIL

Here is the clean version.

In this version of CV is appears there is only one Hash calculated....unlike the 20 times loop in the new CV. Plus it puts it someplace easy to edit in the dump later..

-nt20
nikolatesla20
04-16-2002, 05:00 AM
I'll look thru that C code , already looked thru some of it, it does look like what the prog is doing.

SO basically what i need to do then is get all 20 hash values, good ones, paste them in my dump somewhere, and then modify the md5 finalize routine to return these values one at a time instead of calc. it.

So I will need to modify the called routine at 61EBA8 to walk thru my table in 16 byte steps and just stick the value into the location the ecx got in with [esp-1C].

Sound about right?

The trouble then for me is getting good 16 byte hashes, I mean in you have a bpx set then the hash is screwed...

An alternate method would be to just write down the start and len each time and then use an external prog to calc the md5's (like hex workshop 3.1..) Or am I making this harder than it has to be ? (wouldn't be surprised :p)

-nt20
Solomon
04-26-2002, 08:23 AM
Just before the hash loop, we can set any BPX(coz CV clears debug registers).
But we just set "BPM X" during this loop, not "BPX" :)

Originally posted by nikolatesla20
The trouble then for me is getting good 16 byte hashes, I mean in you have a bpx set then the hash is screwed...
JMI
04-26-2002, 04:38 PM
Not terribly pertainent to the overall topic but I had no problem with the link to +Spl/\j's tut. With IE 5.5 it immediately opened a save box and downloaded without problem. I've been playing with my 98se system files, attempting to get ready to make a dual boot box with 98se and Win2K and when I attempted to open the zip file it told me that I needed to download vector graphic rendering (again) to properly view the tut. Solomon you might see if you have updated this subfeature with IE6, as that might be the problem.

Just to get further "off topic", don't believe them when they say you can "uninstall" IE 6. I installed it and it interferred with several of my programs and I had to go through the process of removing all of its elements and going back to IE 5.5. Managed to keep the one truely good "new" feature which is the new cookie control "privacy" tab in the internet options control panel which allows you to block all cookies of a specific site and save a listing of these excluded site. The old method, in IE 5+, required you to constantly keep pressing the "no" button when the "privacy alert" box appeared. With the correct dll's from IE6 you can now mark all cookies from a site or url as excluded once and forget having to deal with them again.

Regards,
Solomon
04-27-2002, 03:07 AM
well JMI, when I open the html in that zip file, IE 6.0 reports in its status line that there is error in that html file, so it displays nothing.:)

And what do you mean by "vector graphic rendering subfeature"? I never heard this before:(
JMI
04-27-2002, 06:43 PM
Solomon -

If you go to the windows update page, listed under the "Tools" menu, and then click on product update, one of the choices should be "vector graphics rendering" which has something to do with graphics and movement on web pages afaik. When I rebuild my IE to 5.5 this element was missing and when I attempted to open the tut it advised me that I needed "vector graphics rendering" to properly view the tut. Just thought it might be your problem with it because my older copy had worked until I messed with the IE6 update and then removed most of it. Hope this helps. It could also be one of the security settings in IE6.

Regards.


How does ms generate XP activation codes?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How does ms generate XP activation codes?
PDA

View Full Version : How does ms generate XP activation codes?

spodletela
04-12-2002, 03:00 PM
Anyone reversed how system checks activation code of windows XP? As cds are locked on regions, i am unable to unlock my copy with any code i have found and so i want to make crack for my region (Slovenia). Can anyone help or point me to some nfo?
nikolatesla20
04-12-2002, 03:07 PM
h**p://ciberia.ya.com/agustind2000/winxp/ultimate_windowsxp_crack.htm

do not ask me anything more about it
Kayaker
04-12-2002, 03:54 PM
This help?

http://www.woodmann.net/forum/showthread.php?threadid=2142

Kayaker
spodletela
04-13-2002, 02:11 PM
nikolatesla20: thank you for reply, but i didnt search for crack, i want to make one ;) and the one on page you pointed me on, is not *really* elegant solution. I had more in mind something like keygen!

Kayaker: that is exactly what i have seached for! Thank you!
Pyrae
04-13-2002, 07:33 PM
Afaik, M$ activation codes for XP products are usually not specific to a certain region and a working non-fake keygen for most products has already been coded (WinXP Home/Pro/Corp,Office (all editions),Visio) by a group called TheBlueList.
Although there has obviously no effort been made to generate those all-in-wonder-no-activation-needed keys yet.
If it's only the winxp activation you're trying to defeat, there's a much easier solution: It's WINLOGON.EXE which contains the following byte pattern: 8B D1 57 33 C0 89 02 89 42 08. Turn this to C7 06 01 00 00 00 83 EE 04 C3, correct the PE checksum and you're done.

Btw, here is another link to a thread dealing with the WPA:

http://www.woodmann.net/forum/showthread.php?s=&threadid=1753


RSA Tool 2 v1.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > RSA Tool 2 v1.2
PDA

View Full Version : RSA Tool 2 v1.2

foxthree
04-12-2002, 03:46 PM
Hi there:

Can somebody upload this tool by tE!. I tried searching high and low and get fed up. ---> RSA Tool 2 v1.2 by tE! Originally available at egoiste.cjb.net

Thanks!

Signed,
-- FoxThree
fALC0N
04-14-2002, 12:50 PM
I don't know why you wanted especially 1.2 but I found 1.5

See if this does the job

Take Care
foxthree
04-14-2002, 04:19 PM
Hi Falcon:

Thanks a lot, buddy. No reason for 1.2 it is just that it is mentioned in one of the RSA keygen tuts. ;)

Damn I wish I knew more of ASM. :mad: I'm getting lost in this huge pile of cryptographic ASM. Back to learn more I guess....:(

Signed,
-- FoxThree


nightmare protection on cache explorer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > nightmare protection on cache explorer
PDA

View Full Version : nightmare protection on cache explorer

Lbolt99
04-12-2002, 04:18 PM
I've been messing around with CacheX 4.51 for a week or so now and have a couple of questions. First of all, the author is paranoid and the protection is pretty heavy. A brief synopsis on the executable file: it is not "wrapped" with anything traditional like ASpr or whatever.. the author uses his own protection mechanism.

By debugging and trial and error, it looks like the program checks its file on disk as well as the image in memory. It does a couple of crc checks on the code and data in memory, placing various result codes in memory that are later used as decryption keys for sections of the program that are later decrypted. This decryption seems to occur throughout the program.

The one weak point I've found in the CRC check on disk -- the author placed the 32 bit "key" in the EXE file's data section, so one can replace the key in the EXE with the result of the calculation when debugging the CRC routine.

The memory is CRC'd at two spots, and I *think* I might be able to add code to the mem check routine to have it "fool" the checker if any patches are made.

The program has a nag on startup, as usual. If you bypass this, with the program expired (30 day trial), anything you try to do in the program will pop up the nag. I've found a way around the initial nag, but am having no luck figuring out the internal "check" that it does. It seems to use the same windows calls to pop up the nag that it does to do "normal program functions". I've debugged the program both normally and expired, at this point, nothing seems obvious.

Patching the memory it checks to see whether it should skip the startup nag, well, that seems to be detected by the mem check somehow. The decryption routines are screwed up at that point, and it page faults.

Registry keys: I found something in CLSID\blah\blah\CustomType which I deleted, and it reset it to 30 days. But it still detected this somehow. I installed the program on another machine, took the key it installed, placed it in. It *still* detected the tampering, and I can't find anywhere else on the system it might be comparing it with (ran filemon and regmon). The logical thing I can think of is that the key is stored somewhere else, and it's comparing it. Can't find anything though.

I originally wanted to take the keygen approach: the code is so complicated that I abandoned that idea and thought a hard patch would be better...

Any advice? :)
wbe
04-12-2002, 10:15 PM
Long time ago, I dealt with it and had this daemon reversed (It was v4.0 or something).

Unfortunately, I don't remember what I did exactly. For me, the most difficult part was removing the antidebugging and tampering tricks. If I'm not mistaken, the app was messing with the .dat file of the temp cache for date check. That may help if it's still there. I don't remember any encryption either.

My advice: Install it afresh on a new machine and use a good monitoring app (Winalysis) for snapshots, if you're targeting a hard patch.

CacheX is a rare example of how a s/w can be protected without the aid of a ready made tool.

Good luck.
Solomon
05-09-2002, 07:04 AM
yes its protection is quite good.:D
I tried it several years ago but failed. Will retry it later
Lbolt99
05-11-2002, 04:34 AM
I think I've got this one figured out, finally, after working on it on and off for a couple of weeks (aspr stuff is too distracting :)

Basically, the crc check on disk is no problem, but the memory image checks are pretty complicated. I've come up with a way to inline patch them, sort of. It's pretty convoluted. My plan is to add a little code to "fool" the memory image checks.

I'm writing a tut as I work, to document what I did.. hopefully will be done next week.
crUsAdEr
05-11-2002, 07:04 PM
Wow... what a hell of a protection... i do miss frogsice now.... the sice detection trick works real well with its crc and hash check... annoyed me to death!!!

But it was fun figuring out those sice check and overcome them without patching the file... time to dig up the owl's old tutorial :>...

A hell of a protection i would say... the hash table is as big as 1000h bytes so emulating it is out of question... some of the codes are decrypted in memory, executed and then deleted right after that... real neat!!... How are you getting on with your patching Lbolt99? I trie dpatching but found it real hard cos of excessive hash checking as well as the header is real well protected so we cant touch it at all!!!...

My approach for this one is find the decryption routine, wait for it to decrypt the code in memory, before relocation is performed, dump it, paste it over the encrypted code and disassmble, patch it to skip the whole decryption routine all together... debugging the decryption routine i have found that the same/similiar routine is used throughout the protection to decrypt code into memory, most of the code deleted right after that are not that important, though i dumped them and pasted them in anyway... there is one large chunk of encrypted code at the end where the DialogBoxParamA display the nags and the serial checking routine is stored, i dumped it... paste this one over and patch accordingly....

I have the prog running, but everytime i exit it crash :<... it works fine as long as i dont exit :>>... so i guess i patch it wrong somewhere and stack corruption occurs... or maybe there is still more check???

Really wonder how are you going to cause self deleting code to bypass those hashes:>???

regards,
crUsAdEr
crUsAdEr
05-11-2002, 07:32 PM
On a second thought, since the proggie created its own jmp to DialogBoxParamA we can simply write a loader that hook this value and simply clear stack, return eax of 1 to emulate users clicking OK then the nag will never show up again :>>>... but ah well.. it was a good dumping the damn thing anyway....

Still wondering how you are going to bypass the hash check, then intercept the decryption routine to patch the DialogBoxParam? This inline patch has to be right in between the decryption routine and yet it has to pass the hash check??? you reversed it? (actually it might be possible... since serial checking routine is exactly same algorithm.... but rather time consuming) ... if not then how do you do it??
foxthree
05-12-2002, 03:16 PM
Yo Crus:

May be it is time for you to join with Mike on the RCE Cryptographics forum. :D I'm sure your dreams must be full of bits xoring with other bits ;) ...

Anyways, cool analysis. Both this and the arma stuff.... BTW, did u get my email on the ARM Dumper on Win98SE?

Signed,
-- FoxThree
crUsAdEr
05-14-2002, 08:51 AM
Hey Lbolt99,

still working on this one? could you tell me how to patch it please ::>.. i am really curious abt your method... to all the lazy idling folks out there, get your butts moving cos this is a protectiion worth looking at :>>...

cheers,
crUsAdEr
Lbolt99
05-14-2002, 04:19 PM
I've been working on it a bit today but haven't gotten too far. I have an idea of how to inline patch it but it won't work too well unless I can miminize the # of patches necessary to get the program up and running..

IF I can figure out how to get to the CALL EBX routine that jumps to the high mem location (has the dialogbox, etc) and do whatever patching is required, to "reg" the program, without requiring the internal "main loop" patch, or any further patches in the code segment, I think I can do it.. but I haven't been able to figure out how to NOT have to patch the "main loop" routine that constantly runs once the prog is up and running, awaiting user action, etc.

The patch around the nag inside the CALL EBX is easy, this one's got me:

portion of main loop code:
015F:0043F543 CMP [0044A048],EBP
015F:0043F549 JG 0043F562
015F:0043F54B CMP [0044A7F0],EBP
015F:0043F551 JNZ 0043F562
015F:0043F553 CALL 0043FE85
015F:0043F558 TEST EAX,EAX
015F:0043F55A JNZ 0043F562
015F:0043F55C INC DWORD PTR [0044A048]
015F:0043F562 CMP [ESI+000000C4],EBP
015F:0043F568 JBE 0043F5DB

I have to patch the 43f55a to a JMP 43f562 in order to prevent the program from popping up the nag whenever you try to do something in the program! I've tried "fooling" the routine with various memory values, it always seems to detect and/or overwrite anything I try to do.

It just requires too many patches to too many mem check routines if I have to keep the JMP 43F562 in there :(

I'm trying to see where it does the regqueryvalue.. I'm thinking that may give a few hints.
Lbolt99
05-15-2002, 04:25 AM
Looks like Eclipse keygenned CacheX for Opera!! This may be the breakthrough I've been looking for. The keygen for v1.50 works for v1.51. I'm going to reverse the keygen and see what they did, etc..

Chances are the algo is just tweaked a little bit so codes for one product won't work for the other!!

They DID mention Blowfish and SHA-1, however. Not sure if they're talking about the keygen algo itself or the hashes all throughout CacheX.

So this is what I will likely focus on in the next few days. It was my original approach anyway, so I hope to learn a bit from what Eclipse did. So far, debugging the opera version, looks exactly similar to the IE version :)

Will post results as I work..
Lbolt99
05-28-2002, 04:57 PM
OK, I have finally reverse engineered
a) eclipse keygen
b) cachex opera registration scheme
c) cachex ie registration scheme (similar)

This is one HELL OF a key registration scheme. It bites too because I *think* you need at least one valid key to find out a certain constant.. I believe eclipse might have have one which allowed them to keygen Cachex Opera. Because it wouldn't be too hard to do the IE and netscape versions to: the (obscured) constant changes.

*** GO TO THE CRYPTO area for a complete analysis and see if you agree *** :)
Lbolt99
06-04-2002, 02:36 PM
Thanks for your input concerning your work on CacheX, and for sharing the registry entry info.. I had known about the registry entry, but didn't know the formula you came up with for how it works. BTW, the trick doesn't work on 4.51, which I believe was the author's response to this problem (no changes from 4.50 that I could tell EXCEPT the reg entry trick not working any more)

Originally posted by Artifex

In Softice :
g 43f7e6
just rewrite the 3 first bytes in dd18cc with : c2 0c 00 (=ret)
and the program will work at any date !
It works because the CRC is made only on part of program from 43e4da to 4415c4.

Artifex

It kicks you out if you try to do anything though :( There's an internal check that's parts of the routine or whatever you call it that loops around, awaiting kb/mouse input. If the internal check fails, it actually proceeds to a different section of this loop, which doesn't normally run, and cause the nag to appear on anything you do. The way around the internal check (in softice) : portion of main loop code:

015F:0043F543 CMP [0044A048],EBP
015F:0043F549 JG 0043F562
015F:0043F54B CMP [0044A7F0],EBP
015F:0043F551 JNZ 0043F562
015F:0043F553 CALL 0043FE85
015F:0043F558 TEST EAX,EAX
015F:0043F55A JNZ 0043F562
015F:0043F55C INC DWORD PTR [0044A048]
015F:0043F562 CMP [ESI+000000C4],EBP
015F:0043F568 JBE 0043F5DB

You have to patch the 43f55a to a JMP 43f562
Lbolt99
06-20-2002, 05:32 PM
CacheX continues to torment...

Been working on the dump method for the past three days.

Dumped and pasted in the code for the CALL EDI, the CALL EBX (the real long one with the messagebox stuff) and also one later on in the program before the startup where part of the import table is encrypted..

Fixed all 3 of those - basically I added a section with a few memory copy routines, patched the prog to jump to these routines instead of doing the blowfish executable code decryption.

Tried to maintain the integrity of the stack, etc, so I just crippled the final writes in the blowfish algo so it doesn't write anything.

The big problem I am having at this point is that the program comes up to the main screen, loads the cache, etc, but immediantly exits. I have tracked this down to a loop routine where it runs thru peekmessage etc, and specifically tracked it to a getmessage call. Basically, it just calls getmessagea, and exits! This happens after several iterations. The paramaters it pushes doesn't indicate anything wrong..

Crusader, if you are reading this, did you have this same problem? Maybe it has to do with the way I bypass the nag and the trial date check.

Artifex: have you made any progress?

Matthais: I think you'd make more money off this protection than CacheX itself ;)

Thanks for any help anyone can provide.

BTW, checking the Win32 API for GetmessageA, there is nothing that would indicate it being capable of just exiting the proggy when called
foxthree
06-20-2002, 07:21 PM
Yo LBolt:

Is it "the" message loop? Getmessage(), Translatemessage, DispatchMessage. I very recently "bug-fixed" an application that had a timer routine to check the licensed version apart from the initial check. That had to be on a WM_TIMER so on a WM_TIMER the app checked and just exited. Does your process also set a timer? Check it out. Also, you could try bpmb exitprocess and see what IP last executed before ExitProcess and then back and so on...

Signed,
-- FoxThree
crUsAdEr
06-21-2002, 06:33 PM
Howdy guys,

Sorry cant contribute anything much anymore... I am on holiday now and i shant be touching sice for the next 3 months... hmm, actually my dumps work fine ( at least i think so, but i din fully test it), however, the program still crashes when i exit it... it might crash somewhere else as well but i din really test it so i cant be sure...

However, i think the loader approach might be most elegant, did you see how it calls the nag?... it dynamically create a call nag routine liek this
mov eax, offset CreateDlgBoxParamA
jmp eax

Since this part is not used by hashing code, if we can use a loader to wait till this routine is built, patch it to emulate a ret of eax=1 (continue click) then the nag will never appear again, i tot of this but that time i did not know how to write a loader, process patcher yet... now i can but i am not at home, then again it might not work... but process patcher is prolly a sure work way, except it might be slow sometimes... i use Process patcher on Pe Protect so i guess this cant be that hard...

Just some thought, have fun .. and see ya
crUsAdEr
Lbolt99
06-23-2002, 08:21 PM
Originally posted by Artifex
CacheX v.4.51

I arrived safely at :
:0043EFDF E8682FFCFF call 00401F4C
That routine should display program window, but it crashes.
It is not a surprise for me :-)
It calls pieces of code in 69e000..., dd0000... and ed0000... I load them but surely not the right ones neither at right time, so it crashes.

Next steps would be :
43f00d : loads cache
43f05d : displays tips
43ed0d : expecting orders

Artifex.

Hi, that part where the call 401F4C contains a decryption routine for part of the import table. Actually, I don't really think its part of the import table. Just placed there to confuse. It's about 128 bytes in the .rdata section are encrypted, and decrypted sometime inside the call 401F4C using similar decryption technique that the CALL EDI and the CALL EBX used. (BTW, good technique on skipping over those).

I think at this point if you dumped and pasted in the 128 bytes in the .rdata section, and nop'ed out the decryption, it might work. You'll need a memory copy routine too.. since the decryption scheme writes the decrypted data out to high memory.. I had to emulate this with my own copy routine, after dumping and pasting.

You'll see references to things like CALL [EAX+70], with EAX+70 referencing a high memory address that contains bytes decrypted previously..

Unfortunately I'm not home right now else I'd help out and send the clip of the dumped .rdata segment off my system.. I might be able to get to it a little later today.

After startup, there is decryption at the Options, Search, and (if i remeber correctly) the import cache features of the program... found all these by putting a bpmb cs:43xxxx rw and seeing where it ran the hash on memory for the decryption keys..

Crusader: thanks for the input.. I don't think the loader approach would work however.. there is an additional check once it loads up, and will kick you out if you bypass the nag and the 30 days is up :( Also, I bet the search, options and import cache features don't work in the dump u did :(
Lbolt99
06-23-2002, 09:46 PM
Ok, as promised, here is the dump of the decrypted segment of the .rdata section. I've also went ahead and included dumps of the code at the CALL EDI and CALL EBX sections.

filename:

dump1: code inside the CALL EDI

dump2: code inside the CALL EBX

dump3: decrypted .rdata section

Paste dump3 in at offset hex 43878 in CXIE 4.51. You'll see that part is garbled compared to the rest of the import table :D

copy1: memcopy routines for dump1

copy2: memcopy """" dump2

copy3: etc

In the program's decryption mechanism, I disabled the memory-write instructions which wrote the decrypted bytes to high memory. Basically the program's decryption scheme would read data from low memory (the encryped bytes), decrypt and write to himem. I emulated this with my own memory copy routine, which copied the (dumped) data out of low memory and placed it in high memory at the right time.
Lbolt99
06-24-2002, 02:17 AM
I think I missed this post! Didn't see it before. I tried this, and indeed, the same thing happened on an un-modified version of CacheX. So you are probably correct, the dumped version is not causing this, and that's also the reason Crusader's dump worked right.

Will work on it a bit more tomorrow.. still have to dump search, options and import archive, and Quit I think (as crusader has found, there is additional decryption when you quit the program
:mad:

Originally posted by Artifex
LBolt99 wrote :
"The big problem I am having at this point is that the program comes up to the main screen, loads the cache, etc, but immediantly exits."

Responsability for that may not be the dumping you made. One would have the same problem with the demo program if he refreshed the register entry date : program works but if one didn't empty the Temporary Internet Files it exits inmediatly. After cache loading it checks files dates, and exits if dates are greater than register entry date.
Lbolt99
06-27-2002, 04:31 AM
AWesome, glad to hear you've had success in getting it to load up and run properly.. I'm looking forward to working on it, dead in the water right now cause I'm on vacation and away all the stuff I'm working on..

Reading back on older msgs in the thread, it looks like v4.0 was relatively easy to crack compared to v4.5+. Sounds to me like the encrypted code fragments very introduced in 4.5+?

Anyway, good luck on completeing the crack, sounds like you'll have it done before I even get started on it again :)
Lbolt99
07-03-2002, 04:04 PM
congrats on the completion of the crack :) Just got back from vac recently, so I've yet to get started on it again. But sounds like it can be wrapped up in about a half hour or so.

As far as the keygenning goes, I pretty much gave up on that aspect.. the bottom line is there is an obscured 64 bit number that is impossible to get (unless brute forced) without a valid name and serial. I have searched, searched and searched again and have come up with NOTHING as far as reg info. The only thing I've been able to find is stuff for v2.0, v2.03, etc :(

The 64 bit code it used for the DEFAULT user didn't work when I tried it in the registration algorithm. I haven't yet dug down deep enough to know why that's the case though. It might just be a simple additional check on the 30h bytes used as the decryption key.

I do remember the registration algo would to the 32 bit compare right at the end:

MOV EAX, [ESI]
NOT EAX
CMP EAX, [ESI+4]

single step after that part, and you'll come up to something like a:
CMP [EBP+58], 0

That checks for a zero in part of the generated decryption key! Might be the difference between the shareware key and the registered key.

Take care,


Hard to unpack ?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hard to unpack ?!
PDA

View Full Version : Hard to unpack ?!

grasii
04-13-2002, 04:12 PM
Hi there
Here is the problem:
Program: Advanced MP3 Catalog Pro 2.0 *ww.wizetech.com
Packed: unknown ->there are several sections with no names.
CRC check.
Brackes just under TRW. Tried to unpack but reached at 12B0C0C. From there next ret jumps me in kernel. Traced on untill reached BFF88059 CALL BFF76702 traced untill here 03EE INT 30 From here program launches beeing unable to trace no more.
Thanks to anyone that can help with some hints.
foxthree
04-13-2002, 07:16 PM
Hi there:

It is protected by ASProtect, my friend. Wow, Alexey must be making lotz of money. Mind sharing some with us Alexey :D Search the board Grasii and you'll see how the author of this software wasted a good 99$. :p

Signed,
-- FoxThree

PS: btw, folks my new "tool" found the OEiP for this proggie within seconds... Await its release *SHORTLY* :)
nikolatesla20
04-13-2002, 08:21 PM
heh heh foxthree , sounds interesting !

But I already found the OEP, it's at 0055BDA8 :) Sure are a lot of Delphi apps floating around out there...seems Delphi and asprotect go together well.

First DIP:
0055B5F4

Second DIP:
004FB310

Still workin on it, be done soon methinks...

-nt20
crUsAdEr
04-13-2002, 08:40 PM
Hi folks,

just a reminder for the enthusiastics :>... let's try to refrain from posting too often on AsProtect if there is nothing new as Kayaker has said... to Tesla if you read the archive you will realise that me and fox3 are guilty for the last month's flood of posts on AsProtect that wipes out other interesting topics on RE...

just some thoughts,
binh

P.S : Tesla, i tried PM you but did not activate ur PM... well i am learning abt writing loader, would u ind sharing ur BPFTP loader source with me? Thanx...
foxthree
04-13-2002, 09:41 PM
Hi there:

he he what can i say? "Guilty as charged" :D

However, on a more serious note, yes Tesla, I think binh has a point and so did Kayaker. If we started posting OEP and rebuilt RV.txt's, it might become easier for some body to just blindly follow a thread and have a unpacked app.

On a more lighter note, you're now an ASPR master ... :cool:

Signed,
-- FoxThree
nikolatesla20
04-13-2002, 10:42 PM
OK I agree that yep we spend too much time on asprotect.

Just to let you know, I now have it unpacked and running.

Just a little side trick for you all, if you've ever unpacked a delphi app before, you can probably get away with filling in the blanks on the unresolved import table by just looking at another one that you've done before. Delphi uses pretty much the same imports all the time, and in the same order. That's how I did this one, I used RV and then just looked at another project's imports the fill in the missing functions and it works...But I'm sure you guys have thought of that already :)

Yes I am not going to post my resolved here this time either :) You have to do some work you know to get better ! But I will let you on a little secret - I followed the same style pattern as Spl/\j helped me with for BPFTP server. (YOu need to create a new entry point and have it call one of the first DIPS before going to the OEP) I thought I would use that technique on this proggie and it seemed to work.

Take a look at my other post for more clues:

h**p://www.woodmann.net/forum/showthread.php?s=&threadid=2964

Have Fun!

-nt20
+SplAj
04-14-2002, 08:48 AM
Ok,

Kayaker made a very good point about disclosing 'lame' infos about specific targets...i.e. we are making easy cracks for the lamers.

However there are always newbies arriving here and need to get up to speed with aspr unpacking. Foxy, Bin81, and now Niko are a few of the current eager ones ;) I helped because you showed a lot of enthusiasm and posted some details that proved you were truly interested in reversing not just cracking a particular target.

So, maybe we can agree some 'rules of engagement' as from today ?

1) whenever a 'new-person' asks about unpacking aspr or any packer we refer them to the excellent MB 'search' engine here.
There are a lot of infos available.........

2) If they show NO workings we ignore them ?

3) If they 'integrate' well by showing some points and approach they made and just need some 'fine tuning' we help as much we can.

However,
We refrain from attaching files that would help to make an easy crack. We do NOT attach anymore rebuilt IAT. Only refer to specific API that maybe under dispute. We only get to the stage of 'removing' the packer, no extra crack detail, but we can discuss the method, Like BPX FindFirstFileA for filesize check for example ;)

BTW I deleted my 'attachment' to BP FTP Server thread by Niko.

Spl/\j
nikolatesla20
04-15-2002, 02:08 AM
Well I killed the nag screen no prob.

The other limitations are you can't print a report or save export. One of the options in the program is you can export a CSV file (comma seperated file) to use in Excel and stuff, but if you are unregistered you cant do it. How many times will I need that anyway ? Prolly not much..

Now you can see then the problem with this is the code to save the exported data is encrypted unless you are registered. At least that is what it looks like to me, when I look at it in SI and in WinDASM. Right in the "Finish" event handler, the code checks for a valid string in the save box, and then it simply jumps over a bunch of mishmash ugly instructions. This is typical of encrypted Asprotected code. Asprotect inserts a jump before the encrypted fragment so it won't run.

Oh well guess I will need to get better at crypto before I think I can undo this. Of course there is another solution. Get a handle to the data buffer myself and save it out, by tacking on my own assembler routine into the program. Not super hard, just gotta make sure you can get to the buffer (which you can, it's just finding it that could take a while, and its structure).

Just thought I'd leave an update on progress.
Basically I think I might be finished with this target for now, I get bored easily :p
-nt20
Solomon
04-15-2002, 02:33 AM
I totally agree with +SplAj:D
grasii
04-15-2002, 11:23 PM
Thanks to everybody.
The problem wasn't how to crack that prog but the packer. I'v already cracked it and used an loader to make it work.
To nikolatesla20 there is another limitation: no more then 3 albums in a catalog. Cracked it too.
Thanks again. I'll study the asprotect and make it cry :)
+SplAj
04-16-2002, 07:15 AM
Grasii

If you thought that I meant beginner==lamer then I am sorry for that. You may be a newb but please just show some willingness to learn and the infos/education will be delivered ;)

Welcome :)

Spl/\j


nugget under Win98?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > nugget under Win98?
PDA

View Full Version : nugget under Win98?

nikolatesla20
04-13-2002, 04:29 PM
Anyone ever see this? I did a bpx on Hmemcpy and after two F12's this is what I saw. Seriously, I DID NOT edit this ! LOL looks like some engineer at MS left a nugget behind ?

EAX=02710008 EBX=0002010A ECX=00000000 EDX=05950008 ESI=00020080
EDI=00020029 EBP=00008286 ESP=00008272 EIP=000028E1 o d I s z A p C
CS=179F DS=138F SS=359F ES=2CAF FS=1167 GS=359F
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄbyteÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
0030:00000000 00 00 00 00 65 04 70 00-16 00 37 CF 65 04 70 00 ....e.p...7.e.p.
0030:00000010 65 04 70 00 54 FF 00 F0-CC 93 00 F0 D0 9B 00 F0 e.p.T...........
0030:00000020 00 00 6C 0B 28 00 37 CF-D0 9B 00 F0 D0 9B 00 F0 ..l.(.7.........
0030:00000030 D0 9B 00 F0 D0 9B 00 F0-9A 00 37 CF 65 04 70 00 ..........7.e.p.
0030:00000040 0B 00 EB 0B 4D F8 00 F0-41 F8 00 F0 37 24 6E FD ....M...A...7$n.
0030:00000050 39 E7 00 F0 3A 05 99 02-2D 04 70 00 28 0A 5E CD 9...:...-.p.(.^.
0030:00000060 D3 25 00 F0 2F 00 E8 06-6E FE 00 F0 04 06 5E CD .%../...n.....^.
0030:00000070 1D 00 6C 0B A4 F0 00 F0-22 05 00 00 E0 41 00 C0 ..l....."....A..
0030:00000080 A8 0F C9 00 45 04 85 0A-F7 2F B2 FC F7 22 82 FD ....E..../..."..
0030:00000090 01 00 D2 0B BC 0F C9 00-C6 0F C9 00 D0 0F C9 00 ................
0030:000000A0 6C 10 C9 00 66 04 70 00-B4 05 5E CD 6C 10 C9 00 l...f.p...^.l...
0030:000000B0 6C 10 C9 00 6C 10 C9 00-00 00 ED 06 F6 03 85 0A l...l...........
0030:000000C0 EA E4 0F C9 00 9B 00 F0-6C 10 C9 00 01 00 66 0B ........l.....f.
0030:000000D0 6C 10 C9 00 6C 10 C9 00-6C 10 C9 00 6C 10 C9 00 l...l...l...l...
0030:000000E0 6C 10 C9 00 6C 10 C9 00-6C 10 C9 00 6C 10 C9 00 l...l...l...l...
0030:000000F0 6C 10 C9 00 6C 10 C9 00-6C 10 C9 00 6C 10 C9 00 l...l...l...l...
0030:00000100 22 B7 00 F0 01 E4 00 F0-65 F0 00 F0 E0 45 00 C0 ".......e....E..
0030:00000110 D0 9B 00 F0 D0 9B 00 F0-01 E4 00 F0 D0 9B 00 F0 ................
0030:00000120 D0 9B 00 F0 D0 9B 00 F0-D0 9B 00 F0 37 26 4E FD ............7&N.
0030:00000130 D0 9B 00 F0 D0 9B 00 F0-D0 9B 00 F0 FC 04 70 00 ..............p.
ÄÄÄÄÄUSER!BOZOSLIVEHERE+1C1EÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT16Ä
179F:28DE E8E9E2 CALL 0BCA
179F:28E1 2BD2 SUB DX,DX
179F:28E3 E92D03 JMP 2C13
179F:28E6 8B5EFE MOV BX,[BP-02]
179F:28E9 8B470A MOV AX,[BX+0A]
179F:28EC EBF3 JMP 28E1
179F:28EE FF76FE PUSH WORD PTR [BP-02]
179F:28F1 57 PUSH DI
179F:28F2 FF7606 PUSH WORD PTR [BP+06]
179F:28F5 9A64089F17 CALL 179F:0864
179F:28FA E922FE JMP 271F
179F:28FD 8B5EFE MOV BX,[BP-02]
179F:2900 8B4750 MOV AX,[BX+50]
179F:2903 EBDC JMP 28E1
179F:2905 837EFE00 CMP WORD PTR [BP-02],00
179F:2909 0F8412FE JZ 271F
179F:290D 8B5EFE MOV BX,[BP-02]
179F:2910 837F7B00 CMP WORD PTR [BX+7B],00
179F:2914 7410 JZ 2926
179F:2916 66FF7606 PUSH DWORD PTR [BP+06]
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄUSER(0A)ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
WINICE: Free16 Sel=11DF
WINICE: Free16 Sel=1227
WINICE: Free16 Sel=11CF
WINICE: Free16 Sel=126F
WINICE: Free16 Sel=13AF
WINICE: Free16 Sel=391F
WINICE: Free16 Sel=127F
WINICE: Free16 Sel=13EF
WINICE: Free16 Sel=13DF
WINICE: Free16 Sel=13D7
WINICE: Free16 Sel=1397
WINICE: Free16 Sel=13B7
WINICE: Free16 Sel=2437
WINICE: Free16 Sel=2E57
WINICE: Free16 Sel=13C7
WINICE: Free16 Sel=1327
WINICE: Free16 Sel=136F
WINICE: Free16 Sel=1377
WINICE: Free16 Sel=12D7
WINICE: Free16 Sel=133F
:bpx hmemcpy
:x
Break due to BPX KERNEL!HMEMCPY (ET=1.92 seconds)
:/screendump bozos.txt

Notice what Section of USER32 SI says I am in. I could not believe it !

-nt20
mike
04-13-2002, 04:48 PM
Yep. It's been there since w95. I'm surprised you hadn't heard of it before: what cracker would use SoftIce without reading the canonical "Mammon's Tales to his Grandson"?

http://home.swipnet.se/~w-90765/cracking/ice.htm


grocker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > grocker
PDA

View Full Version : grocker

mike
04-13-2002, 04:53 PM
http://www.ohelp.com/samples/askfirst/wabidiag/diaggrok.html

How does this compare to API hooking?


Announcement: OEPFinder
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Announcement: OEPFinder
PDA

View Full Version : Announcement: OEPFinder

foxthree
04-13-2002, 09:49 PM
Hi fellow RCEs:

After taking so much from this board, the time has come for me to give something back to it. I hereby present before you a small app - OEPFinder. Using this tool, you can find the Original Entry Point of packed apps with ease and "without any debugger". With this and SuperBPM, you can bid most packers bye bye. It can bed dled from http://foxthree.cjb.net

However, let me warn you - the tool is nothing great. It was just my attempt at coding something that *could* be useful. Read the "readme.txt" for more details. Comments/+ve Criticisms always gratefully accepted and analyzed ;)

I would like to thank +SplAj guru, Kayaker, binh81, Evaluator and others at the FraviaMB for making this happen.

In short, "U ROCK GUYS!"

Signed,
-- FoxThree
nikolatesla20
04-13-2002, 10:02 PM
Hey pretty cool stuff foxthree, is it written in Delphi? I got Delphi 6 finally and wow it is pretty powerful.

Now if only there was some way to locate the actual OEP from this signature byte without a tracer - like where that jump jumps to..there MUST be a technique we can use. Maybe some sort of program that can "watch" the asprotected app start up or something. Yeah it's pretty tough without "tracing" but even ImpREC doesn't need to run ring0 it seems to be able to work from ring3, although I don't think its as accurate as revirgin.

Well Ill keep thinking. Nice clean simple app I like it !

-nt20
h8er
04-14-2002, 12:31 AM
The download link seems don't work...
crUsAdEr
04-14-2002, 02:19 AM
Nice job, fox3 :>

I like your layout... though i did not thoroughly test it... maybe you should allow user to add signature bytes themself for future usage? :>>.. just another suggestion...

Keep up the good work!,
Binh

P.S : check your PM.. i have more works for you to do .. lol...

P.P.S : on the hindsight...
[ERROR!] An error occurred during ReadProcessMemory. Error Code = 299.
[ERROR!] Scanning Failed! Strange ...
I get this error for attempting to scan anything... so looks like it doesnt support win2k yet :<... mine is win2k SP2 build 2195....
foxthree
04-14-2002, 09:50 AM
Hi All:

Tesla: Thanks for your feedback. The App was coded in VC++ 6.0. I've not written programs in Delphi tho' im itching to do so offlate ;) Keep your thoughts on and let me know if you come up with something.

Binh: Up to ur usual tricks eh friend. Keep it up!!!!! You've already given me work for the next 3 days :) BTW, error code 299 = "Only part of a Read/WriteProcessMemory request was completed." says VC++ :( Let me test the proggie on Win2K and do a little debugging ;)

Yeah, I'll definitely think about how to automate finding the "real" OEP. Actually, my work isn't something new. ProcDump had a ring3 tracer which can scan for sig bytes. However, mine *does not* use any tracer (yet ;)).

Thanks and keep the feedback coming.

Signed,
-- FoxThree
foxthree
04-14-2002, 04:53 PM
Hello folks:

Just thought I'd keep you guys updated. I've unpacked UPX (latest) 1.20w and ASPack 2.12. I'll add support for them in the upcoming OEPFinder Release.

Signed,
-- FoxThree


Who can help me about one unchanged crypkey protected programme??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Who can help me about one unchanged crypkey protected programme??
PDA

View Full Version : Who can help me about one unchanged crypkey protected programme??

email123
04-14-2002, 06:25 AM
hi, everybody! I have a programme protected by modified crypkey software of mpsiii.exe ,this progamme can be used 15 days in demo version,when activiated,it will randomisedly produce many 8 or 4 byes files in different directory in driver c:,thereafter this programme can not be used in demo version whatever you delete the 8 bye files or not ,and I think it must have other marks ,but I can't find it .

I have searched all cracking website ,and there isn't one essay or tutorial about cracking progamme protected by modified crypkey of mpsiii.exe.

THank you for any help!!!
peterg70
04-14-2002, 09:27 AM
Sounds like standard Crypkey program

Crypkey can be set for any trial period length
Crypkey creates those bloody 4k files all over the harddisk

Easiest way is to register the program via the SITECODE/AUTHORISATION CODE system.

Of course this isn't a crack request :(
email123
04-14-2002, 10:07 AM
Thank you for peterg70's reply,but this programm is protected by a changed crypkey mpsiii.exe ,although I can register the program via the SITECODE/AUTHORISATION CODE system such as cr-ck50a.exe,and also show "successfull registered',but the programm can't work .who can expain the why and solution?
peterg70
04-15-2002, 02:03 AM
This is a crack request. Go somewhere else for crack requests.

I will answer you anyway but you will need to do some work anyway.

Odds are that the level/options are incorrect for the authocode you generated.

If you want more questions answer you will need to show you have done some homework and not just used a off the shelf key generator.

End of conversation

peterg70
email123
04-20-2002, 01:55 PM
Thank you for your informative poster,Dear Mr peterg70,I have got the application's Masterkey userkey,using ckinfo.exe I got the password,but after adding neccessary information in the configration and also in the skw.ini mannually,and adding sitecode and click check,the skw.exe says"the sitecode you entered is from another company.you can only generate unlock keys for you company's applications." would you please tell me how I deal with this ? you also said in order to get the right license key ,level and option must be gotten, what should I do in order to get them? when I set command "bpx get_level" in the trw2000,it said "sytax error or undefined symbols" . I am a very very newbie ,hope you counld give me more help.

Thank you for any help !!!
mike
04-20-2002, 07:04 PM
bpx is a softice command. It is a debugger that lets you step through code to watch what it is telling the computer to do.

Before you answer this, go read the FAQ.
glasha
04-25-2002, 11:58 AM
to accept get_option, get_authorization, get_RTT, get_Sitecode, etc you need export dll, cryp95xx.dll into your debugger, i have try to get option and level from sice but this dont is called, then your metod is bad, need check algoritm of crypkey functions to get option level

Glasha

P.D. dont question to peterg hes is a bad boy a never help to the people
peterg70
04-26-2002, 03:38 PM
Glasha

I am offended by this statement

P.D. dont question to peterg hes is a bad boy a never help to the people

I don't see any smiley faces or anything so I assume you mean it.

My defence your honor.

Firstly : Conduct a search on this board and see what I have contributed to the discussions on the subject.

Secondly : If you examine my previous answer above you will see it is inline with this boards policy regarding "DON'T ask for cracks" and "Show us you have tried to do something" Correct me if I am wrong

Thirdly : I don't remember you asking for anything although I could be mistaken. You could have been one of the many who asked "send everything you have on crypkey" or "send me unpacked and patched skw.exe". You are then correct that I don't help those people.

I rest my case

The verdict

UP YOURS MATE
;)

Yours faithfully
peterg70
Kythen
04-26-2002, 04:10 PM
To set breakpoints on get_option, etc. you may have to break at the thunk function in cryp95e.dll. Step into it until you get into the 16-bit crypkey dll, then scroll around and set breakpoints on the functions you want. You'll have to make note of the addresses from your disassembly of the 16-bit dll.

From there it's much like cracking a dongle. Trace and examine dead listings to see what the app wants for the various options and the level.
JMI
04-26-2002, 05:07 PM
glasha - You are, of course, entitled to whatever personal opinion of other members and guests that you chose to hold, but it is a violation of the spirit, and the policy, of this forum to make personal attacks upon others here. We hope to keep this as a place where people can discuss RCE issues without giving in to the need to puff one's self up by belittling others. Unfortunately this is a practice which seems to be the preferred method on some other forums. Simple civility is not hard to manage when one remembers that the battle is supposed to be with the code, not each other.

No one here is obligated to help anyone else, they do it because it is their wish to do so. Many come here, and to other forums, seeking a packaged solution, rather than guidance or a point in the right direction. Those with the skills to share are not here to do the learning and the work for us, but to help us learn how to do it ourselves.

Peterg70 was following forum policy is asking email123 to show that he was seeking more than a crack request. This is usually done by showing what one has already done with the project and explaining where one is stuck. Often the "search" button can be of great help in learning about one's target of choice. As peterg70 stated, use of this button on "cryptkey" issues would have disclosed that he has been very helpful and a contributor to the discussion and analysis of this protection system.

We will all learn more if the discussion avoids personal attack which provokes defensive replies and/or counter-attacks, and we focus on the code and methods of attacking and understanding it.

As Woodmann would say: Peace!

Regards.


WKT Debugger and commandline arguments?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WKT Debugger and commandline arguments?
PDA

View Full Version : WKT Debugger and commandline arguments?

thenite
04-14-2002, 11:15 AM
Hi,

I've got a question regarding the P-Code Debgger by WKT:
I want to debug a VB-Program which requires command-line
arguments. How is it possible to load the program with its
paramteres via the wkt-loader? Or isn't this possible at all?
Thanks in advance,
nitehawk


about LM_A_CRYPT_CASE_SENSITIVE ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > about LM_A_CRYPT_CASE_SENSITIVE ??
PDA

View Full Version : about LM_A_CRYPT_CASE_SENSITIVE ??

mark_nctu
04-14-2002, 11:42 AM
My target is used flexlm 7.2e .

I see NB's "Zendenc FLEXlm 7.2 cracking information" and

learn to find the keys code. But the lmcrypt.exe which I make

can't make correct license for my target. So I check lc_set_att and

find it use lc_set_att (*job,LM_A_CRYPT_CASE_SENSITIVE,0x000019e).

I see NB say must be careful to some CAD use LM_A_CRYPT_CASE_SENSITIVE .

Nolan Blender, could you help me ?

my e-mail: mark_nctu@yahoo.com


How to approach a 'dead' target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to approach a 'dead' target
PDA

View Full Version : How to approach a 'dead' target

Pyrae
04-14-2002, 04:19 PM
Well, 'dead' means that no live approach (debugging) is possible and disassemblers give messy results, though the target is obviously neither packed nor encrypted.
In this particular case it's the timebomb routine in WINLOGON.EXE/LICDLL.DLL of WinXP Embedded Eval (which btw is a build-it-yourself WinXP Pro and therefore the most useful version of WinXP), but I only need some basic ideas on OS level cracking.
Here is what I've tried so far:

-disassembling LICDLL.DLL, which contains the 'expired' nag's text using IDA, W32Dasm, PEDasm
(all give nonsense listings with lots of unresolved jumps etc., see attached snippet)

-getting Softice to run on XP Embedded Eval
('EXP=\%SystemRoot%\system32\kernel32.dll Error Opening file. Status=C0000225' (same for all other libs, no working solution found) -> no useful breakpoints possible)

-looking for string refs/refs to string offsets with hiew (nothing useful found)

-looking for infinite jumps/inline calls which might confuse disassemblers (nothing found)

So I'm running out of useful ideas on this one, perhaps someone can help me out with any alternative approaches...

Thanks very much, Pyrae
MTB
04-14-2002, 07:20 PM
Pyrae, have you tried the IDA 4.17 version, it can get around fair number of anti disassembler tricks etc.

Good Luck
MTB
Pyrae
04-14-2002, 11:18 PM
Thanks for your reply, MTB. Of course, I'm using 4.17, but it failed just like all the others. Or do you think of any options I might have forgotten to check in this particular case? This one's giving me one helluva time....:mad:
peterg70
04-15-2002, 02:17 AM
Have you tried to debug the program WinLOGON etc with OlyDBG.

Attach to it when its running and you can then trace through it.

Could be self modifying code? (I'm no expert though) If you trap the code in memory then you will see the true form of the code.

peterg70
Pyrae
04-15-2002, 03:21 PM
Well, first of all, thanks for your reply, peterg70. I certainly would have done this if it was possible. The problem is that I just can't run any other prgramm BEFORE logging on. And if I'm logged on I just can't make the 'expired' nag appear.


Softice itstallation problems on W98
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice itstallation problems on W98
PDA

View Full Version : Softice itstallation problems on W98

IcyDee
04-14-2002, 10:30 PM
Has anyone had this problem (and solved it)?

When I install V4.0.5 on W98 I get to the screen where I choose the VDU and there are no options to select from, not one. Test reports that the test is successful but when I hit Next I get an error stating that I need to select a video mode.

I can't get past this, any help would be appreciated.

I have a Voodoo 3 card installed on this machine if that is relevent.
Aimless
04-15-2002, 04:55 AM
Where did you download the ICE 4.05 for 98 from??

Check the size to ensure that it has got ALL the files for running the same.

It generally comes to 5,639(KB) that's about 5MB plus.

If you are less then you may have gotten a file where IMPORTANT stuff is retained by others are removed.

The name of the zip file is

si9x405.zip

(from where I downloaded it. It works just right).

I hope you are NOT running the installation from the temporary files produced by Installshield! Rather, you are simply running the default setup proggy.

...Have Phun


SuperBPM on Win2K???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SuperBPM on Win2K???
PDA

View Full Version : SuperBPM on Win2K???

foxthree
04-15-2002, 01:25 PM
Hi there:

I was much impressed with SuperBPM under Win9x with the way it prevents most anti-DRx tricks. It would help immensely if such a tool were to be available for Win2K and WinXP. In that I'm trying to understand how SuperBPM works. My understanding is that most packers generate an exception and resets the DRx registers in the exception handler code? Is this correct? Also, how can I "port" SuperBPM's functionality to Win2K. I'm willing to put my "full" efforts on this problem (even if it requires writing a KMD) as it immensely help a lot of us who are reversing under Win2K. Ofcourse, another way would be to go to ring0 and reset the DRx registers. However, I presume this would be platform dependent (the ring0 transition I mean).

Mostly, I find SoftICE does not break on BPMs at all. So, I am willing to code up a SuperBPM variant, provided I have enough understanding. Any pointers/tips to the right direction is highly appreciated.

Thanks,

Signed,
-- FoxThree
Ni2
04-15-2002, 08:08 PM
foxthree,

I havent studied SuperBPM, only 80386 protected mode books :p

There is a bit in the DR7 register (GD (general detect enable) flag (bit 13)) that protects the debug registers (even from Ring0 apps)

Now, you have the idea ;)

Cheers,
Ni2
foxthree
04-15-2002, 08:34 PM
Hi Ni2:

Thanks for your post. I too know about it. However, my understanding is that if GD in DR7 is enabled any r/w access to DRx is prevented and an INT 1 is generated. Right? But if I enable GD I'll no longer be able to set any breakpoints in the DRx register, right?

Thanks for clarifying,

Signed,
-- FoxThree
Ni2
04-15-2002, 09:13 PM
Hi Foxthree,

When you protect the debug registers, any read/write to them will enter in your debug exception handler as you already know. The processor clears the GD flag inside of your debug excepcion handler, so you can play again with the debug registers and set the GD flag back again if you want before leaving your exception handler.

Let me know if this answer your question.

Cheers,
Ni2
foxthree
04-16-2002, 06:35 AM
Hi Ni2:

Thanks for your post. Yes, now I understand ... atleast theoretically. Time to code some stuff ;) and test the theory ;)

Signed,
-- FoxThree
Ni2
04-16-2002, 09:57 AM
Hi foxthree,

Good luck coding your new little devil :) I can't wait to see it in action ;) Keep us in touch with you progress

cheers,
Ni2
crUsAdEr
04-17-2002, 01:33 AM
Hey fox3,

Are u done with the super BPM on win2k yet? .. LOL...

Anyway, stumbled upon this while searching for info on writing loader in the board... the board is a maze... but the search feature is REAL good... U might have seen this, you might have not so ah well...
http://www.woodmann.net/forum/showthread.php?s=&threadid=1112&highlight=loader

It has some info by R!sc on how old AsProtect clear DRx, not sure if it is still relevant but it might helps...

cheers,
foxthree
04-17-2002, 07:29 AM
binh:

Howz it going? No I'm not done yet... I'm afraid I might crash my HD by writing a KMD :D However, I'm learning KMB basics. Have a hello world driver running ;)

Thanks for your link man, I think it would take 2 days for me to understand what is written in that post LOL .... Okey back to my books Ugh :p

Thanks once again....

Signed,
-- FoxThree
Solomon
04-26-2002, 10:15 AM
I also want to know how to write a SuperBPM for win2k:)

Currently I have such an idea:
1. write a KMD
2. The KMD hooks INT 1, INT 3 and sets GD bit in DR7.
3. When INT1 occurs, its INT1 handler checks the BD bit of DR6.
If BD is set, it checks the current thread ID or current process name to ensure that this INT1 is triggered by desired ring-3 apps(if we don't do this, we may not set any BPM breakpoint in SoftICE).

If so, it saves all the debug registers and inserts an INT3 instruction right after the instruction which accesses the debug register. When INT3 is triggered, it restores the patched bytes of the ring 3 apps and restores all the debug registers, then sets GD bit of DR7.

Instead of inserting INT 3, we may also use single-step flag to let the ring 3 apps access the debug registers, then we restore them.

I don't know whether the above is correct or not. gurus pls show your comments.:)
IcyDee
04-26-2002, 12:21 PM
I don't know if I follow all of your reasoning but have you considered the following points?

... inserts an INT3 instruction right after the instruction which accesses the debug register...

This presumably requires you to know the length of every instruction, you will need to include some disassembler code. I think tsehp, or was it ArthaXerXes, or both :) used code like this in their programs.

Also, what do you do in the event of conditional jumps where the next instruction to execute could be one of two locations? What do you do with calls or returns? Sounds to me that you need to use the Int 1 not the Int 3.
foxthree
04-26-2002, 08:33 PM
Hi Solomon:

Welcome aboard! Thanks for sharing my idea. I haven't made *ANY* progress on this (stuck in LOTZZZZZ of questions about SEH and things like that). I have a few questions for you:

90% of our ideas are ideally the same. I sent a PM to Ni2 almost along the same lines as what you've written but I think the latest MB fiasco wiped out his PMs and he did not respond (yet).

My questions are:

(1) How will you check the current thread ID and process ID from your driver to compare with the target PID/thread ID?
(2) Why the INT3 tricks? When the INT 1 interrupt is triggered and after you've verified it is for you, (remember at this point GD is cleared), why not simply reset the GD and continue? Any problems with this approach. If yes, can you please outline it.

Also, I came to know from some friends that INT1 will not only be generated for this and it will be generated for a *VARIETY* of reasons. How do we handle this?

Gurus, please help us by posting your thoughts / comments on this problem. Solomon, I'd glad to be of any help in this work.

Thanks again for your interest. [IMHO, such a tool is *STRONGLY* needed for Win2K. It is such a pain to notice your BPM's wiped out by the packer code. Grrrrr....]

Signed,
-- FoxThree

PS: Solomon, I've the source code for Elicz's SuperBPM for Win9x. I went through it and understood 90% of it but there are still a lot of questions unanswered. If you're interested, we can combinedly take a look at it. It looks to me that he is playing around with SetThreadContext in R0. May be we can get off by just doing this...


Random Number Analysis
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Random Number Analysis
PDA

View Full Version : Random Number Analysis

akimp3
04-15-2002, 07:15 PM
Hi
My company works on a debit card project.
They have generated 10000 test passwords and
my boss have asked me to test if the numbers are really random.
The passwords are composed of 14 numbers and each number(0-9)is generated by the random function of delphi, so for generating one password.
The random function is called 14 times subsequently for each password. They have given me 100 passwords to do the test. I have seen (by eye) that some numbers like 8 and 7 are present in all the passwords exept 12 passwords.
So I wish to find a way to test that, these passwords are really assigned randomly. How can I generate by a statistical analysis, 10000 passwords that contain, some of the passwords that they have generated. Could you please advise me on how to do this?
Is there any program to do this? Or I have to write one myself? Is there any documents, explaining technics for this type of analysys?
Some documents or links or tutorials are very appreciated.
Thanks in advance
Kythen
04-15-2002, 10:24 PM
Quick question for you on your password generation method...

Did you reseed the RNG before each digit was produced in the password? If not, that greatly reduces the effectiveness. For C++ at least, and I assume Delphi, Pascal, and most other languages... the built-in RNG is quite weak. Generally it only takes a 32-bit seed that can easily be brute-forced. Once you have the seed figured out, then you can run the RNG however many times you need to get all the digits you used in the password (provided you didn't reseed it between digits). Not a very random result, as you can see. I would advise using a better RNG like the FIPS standard.

As for your analysis problem, are you trying to analyze the randomness of the passwords you were given? Or are you trying to produce more passwords using the given set? It's a bit confusing from what you posted. I'm not up on my stats, so I don't really know what techniques there are. I'd just look at digit frequencies in relation to position and other things like that.

Hope that helps!
Kythen
mike
04-15-2002, 11:08 PM
Actually, it's probably only 31 bits. Given one 14-digit password, you have 14*log_2 10 = 46 bits. With 10 or eleven digits (=33 to 36 bits) you can find the seed and predict *all* the other passwords, like Kythen said. See the WinZip thread for a similar situation using C's rand() function. I think the two random number generators are identical.
foxthree
04-16-2002, 06:43 AM
Hi:

Why don't you use really "strong" PRNG implementations like Yarrow. From what I see, it is pretty straightforward to use in C++ and you can avoid the "seeding" attack as Mike mentions very easily.

Signed,
-- FoxThree
Solomon
04-16-2002, 07:26 AM
CryptGenRandom() from MS Crypto API may also work.:)
akimp3
04-16-2002, 11:11 AM
Hi
thanks for your help as kythen and mike said ,i want to be able
to genereate all(near all) the password from the 100 password that i have.I am not the person who have to chose the random algo,
i know better way likr RSA,.... but somoene else has chosed this
way i have to prove to my boss that this algo is weak and the number could be generated by someone else.
Mike a Kythen could you please give me more details on how i have to brute force the seed?
I have to be able to cra*k this random generation algo .
thanks in advance
akimp3
04-16-2002, 06:12 PM
Hi
I have tried the attack described in the Zip thread(with some modifications like j=14,...)but it did'nt find the cipher.I have attached the 100 password that I have to this message please take a look and guide me.
thank you very much.
i am waiting for your help
mike
04-16-2002, 09:26 PM
I'll help if you'll answer some questions.

1. What was the exact delphi code that generated the numbers? There are a bunch of different random functions in delphi. (Once I get the brute forcer working you can use it on any set of passwords, BTW.) The TLCG is: seed = 0x8088405*seed+1

2. Are these the first four passwords? They all run together in the file.

630 112 7612 8278
831 208 1648 1787
472 682 3216 7536
814 370 7032 2202
akimp3
04-17-2002, 11:26 AM
Hi
thank you very much for your help.
the 4 passwords are not the firsts.
They have generated a sets of 10000 password and give
me 100 subsequent password from the middle.
I have not seen the code that generate the numbers,because
i have to act like a hac*er that did'nt know anything about
the code generation. But i know(social engenering)that she
has used the random function and that she had called it 14
times for each passwords.If you need anymore info please tell
me and i will try to gather them.
thanks
Snatch
04-17-2002, 02:38 PM
Ever hear of LCG? Linear Congruent Generator...seek and ye shall find. There is a lot of information about them out there but not too much useful. I learned after a lot of research how to reverse the random number generator. So if you have a LCG such as seed = a*seed+b you can choose other values of a and b such that the series goes in the exact opposite order. Dont ask me why I needed to do this it was for a game called Worms2 but thats a seperate story ;). Just research LCGs there is a lot of higher math involved but if you can brute force a seed(4 billion possibilities shouldnt be too hard) that fits the 100 numbers you have well then there you have it.

Snatch
Dimedrol
04-17-2002, 02:52 PM
Hi

>But i know(social engenering)that she has used the
>random function and that she had called it 14
>times for each passwords

The key word here is "she" :)

I've tried several approaches to get numbers from your post using Delphi's RandInt(10) function.
But finally I found what there is no single "9" digit in 100 14-th chars numbers.
So RandInt(9) has solved the problem

/////////////////////////////////////////////////////////////
#include <ostream.h>
#include <memory.h>

unsigned long seed = 1;

void srand(unsigned long newseed)
{
seed = newseed;
}

int rand(void) // the same as RandInt(9) in Delphi ( should have probably been 10 ! :)
{
_asm
{
mov eax, 9
imul edx, seed, 0x8088405
inc edx
mov seed, edx
mul edx
mov eax, edx
}
}

int main(int argc, char* argv[])
{
for(unsigned long a = 2; a < 0xFFFFFFFF; a++)
{
if( rand() == 6 )
if( rand() == 3 )
if( rand() == 0 )
if( rand() == 1 )
if( rand() == 1 )
if( rand() == 2 )
if( rand() == 7 )
if( rand() == 6 )
if( rand() == 1 )
if( rand() == 2 )
if( rand() == 8 )
if( rand() == 2 )
if( rand() == 7 )
if( rand() == 8 )
{
cout << "Seed: " << a - 1 << endl;
}
srand(a);
}
cout << "finished" << endl;
return 0;
}
/////////////////////////////////////////////////////////////

For the first 6 numbers from your list I got:

630 112 7612 8278 seed = 66918095 (3FD16CF) - looks like Delphi's time
831 208 1648 1787 seed = 66918195
472 682 3216 7536 seed = 66918245
814 370 7032 2202 seed = 66918325
807 474 0308 0117 seed = 66918355
457 077 2866 6866 seed = 66918405

so original code probably is:
for( i = 0; i < 10000; i++ )
{
Randomize()
for(j = 0; j < 14; j++)
{
cout << RandInt(9);
}
cout << endl;
}

There are very good chances to reconstruct the whole sequence of numbers.

Regards, Dimedrol.
akimp3
04-18-2002, 11:18 AM
Hi
first I want to thanks everyone that is helping me on this
problem.
1)
I want to know how did you figured out that the TLGC is
TLCG is: seed = 0x8088405*seed+1 ?
2)
how did you figured out that she has changed the seed after
each 14 number and not after each number?
3)
Is it possible to fint more than one seed for a sequence of
numbers?
4)
now that we know the seed has changed for each password
how should we know the value of the seed for the others
passwords?
5)
is there anyway to find the other passwords or a percent of
them?
6)
why did you rewrite the random function in asm,could'nt you
use the random function of C instead?
I will be very happy if you answer this questions
I have learned a lot about this but these question are
still emberassing me.
thanks in advance

akimp3
Dimedrol
04-18-2002, 12:07 PM
Hi akimp3

>1) I want to know how did you figured out that the TLGC is TLCG is: seed = 0x8088405*seed+1 ?

You told Delphi was used. This is a Delphi's random function.

>2) how did you figured out that she has changed the seed after
each 14 number and not after each number?

Just tried the simplest way. It worked.

>3) Is it possible to fint more than one seed for a sequence of
numbers?

Theoretically this is possible. But in practice I did not get any collisions.

>4) now that we know the seed has changed for each password
how should we know the value of the seed for the others
passwords?
>5) is there anyway to find the other passwords or a percent of
them?

After several experiments one can see what sequential seeds deffers from each other by at least 10 and at most 100

Let's say we've found the seed for

106 220 7344 7877 ( from your list of passwords )
seed = 66920498

Remember what the next password is
088 324 1611 5783

Using rand() and srand() functions from that C sources we can generate a sequence of passwords for

66920498 + 10 < seed < 66920498 + 100

/////////////////////////////////////////
for(unsigned long k = 66920498 + 10; k < 66920498 + 100; k++)
{
srand(k);
for(int l = 0; l < 14; l++)
{
cout << rand();
}
cout << " seed = " << k << endl;
}
/////////////////////////////////////////

We'll get
43182424006850 seed =66920508
.....
08832416115783 seed =66920528 Gotcha! 21 - th variant is right

Actually it's possible to optimize this algo even more.
Don't know why but the differences between sequential seeds are divisible by 10;

Let's try to use this:
Password = 837 767 6775 4118
seed = 66921289

/////////////////////////////////////////
for(unsigned long k = 66921289+ 10; k < 66921289 + 100; k+=10)
{
srand(k);
for(int l = 0; l < 14; l++)
{
cout << rand();
}
cout << " seed = " << k << endl;
}
/////////////////////////////////////////

25256318313171 seed =66921299
58626750762053 seed =66921309
82086201322024 seed =66921319 !! 3-d variant is right

So it's possible to say what if one knows 1 password - he can find the next sequental password in at most 10 hops with a very good probability.

> 6) why did you rewrite the random function in asm,could'nt you
use the random function of C instead?

It's a disassembled and a bit modified RandInt function of Delphi.
It's in asm just to speed up the process of finding seeds.

Hope I answered all your questions.

Regards, Dimedrol.
akimp3
04-18-2002, 06:43 PM
HI
Dimedrol thank you very much for answering my questions.
I was trying two find a relation between the sedds and I found
that: the differences between sequential seeds are
not ALWAYS divisible by 10.
630 112 7612 8278 66918095
831 208 1648 1787 66918195
472 682 3216 7536 66918245
814 370 7032 2202 66918325
807 474 0308 0117 66918355
457 077 2866 6866 66918405
664 766 8370 3744 66918445
657 861 2536 1650 66918475
540 054 4803 8565 66918505
532 158 7250 6371 66918535
758 857 5673 4258 66918575
641 042 7030 2164 66918605
633 145 1386 0070 66918635
610 376 2750 1467 66918635
826 175 0272 8245 66918706

As you see the difference between 66918706 and 66918635 is
71 that is not divisble by 10.With this do you think that
it is a good idea to use the optimized program you wrote or not?
s you know in later passwords there is many that follow your rules(divisibale by 10).

my second question is :
what is a Blum-Blum-Shub generator?
as you know i am a newbie in crypto world and all i do
in this board is learning a lot from experienst crypto guys.
could you please tell me more about Blum-Blum-Shub generator.
to what kind of problem it is applicable?,...

I want to say thanks to all of you especially Dimedrol and Mike
who teach me a lot of hings.

akimp3
mike
04-18-2002, 07:12 PM
BBS is a random number generator based on the same problem as RSA, namely factoring. Predicting the output will be as hard as breaking RSA.

There are a lot of pitfalls in using crypto however! I broke a system that used DES encryption because of improper key management. I was able to write a program that recovered the password faster than you can blink.

What exactly are you trying to accomplish?
akimp3
04-18-2002, 08:09 PM
Hi Mike
thank you for replying to my questions.
Finally something that i know appear in this
thread.I know RSA very well(to my knowledge),i have used
it a lot of time.As i told you my first project is to prove to my
boss that these random numbers are week.I think afer all your
(Dimdrol,you and others) help i am very close to it.
The secont project is to give him(my boos) a good random
generator.I have thinked to use the RSA method described
in chapter 5 of applied cryptography handbook.
But before this i have to prove to my boss that the current
algo used by his sister is really bad.
The divisability rules found by dimdrol was very good
because i could use it to show to my boss that I can find the
next password with 10 hope in the worst case,but as you have seen I have found a contradiction to it.
So i have to use another rule.
If you know anything that could help me please help me.
I have another question from you how did you find the LGC of
Delphi?

thank you very much for your help

akimp3
radiant
04-18-2002, 08:13 PM
Handbook of Applied Cryptography
h**p://www.cacr.math.uwaterloo.ca/hac/

See Chapter 5 for BlumBlumShub

And a C implementation is here:
h**p://www.mindspring.com/~pate/crypto/chap05/blumblum.c

radiant
mike
04-18-2002, 08:46 PM
the differences between sequential seeds are
not ALWAYS divisible by 10.

So what? If you know one of them, then skip 9, generate four passwords, and test them. You expect to get it on the tenth, but sometimes it'll be a little different. Once you find which of the four work, skip 9 from that one and try again. Even in the worst case where you don't know the original seed, you only have to test 2 billion passwords (2^31). Depending on how long the test takes, it could be as little as an hour to try all possible passwords.

Even if you didn't know how the passwords were generated, their length is too short: trying 10^14 different numbers= 2^46 is very doable.

I looked up delphi random on google and poked around. 0x8088405+1 has a period of about 2^32 and is used all over the place, especially in Zip encryption.

Again, you aren't going to get a secure system by accident. There are lots of ways to attack systems that most people don't even think of. What are you trying to protect with these passwords? Are you going to store them somewhere? How is that database protected?
akimp3
04-19-2002, 08:01 AM
Hi
thanks for your reply .
about the project:
the project is for the Telephone company.They will sel phone card
with this passwords.Each person after picking up a public telephone will here a message that asks for the password
then he have to dial the password ,if he dial a valid password
he can dial any number he want.As you see if this password
are regenerable my boss will dye because our company has
investigated on this project.
For the bruteforce that you sayed ,it is impossible because
10 password is resonable to try on the phone but 40(4*10)
is impossible.I have to give them a solution that is resonable.
the seed is changed between 10 and 100 so if I add 9 and generate 4 password i have to do this 10 time in the worst case
that gives me 4*10 password(not resonable).Correct me if I
have not understand what you mean by adding 9 and generating 4 passwords.
About the storage the passwords will be encrypted and stored
in an oracle database.No one will have access to them,and the encryption is done by the encryption library of oracle 9i.

thank you very much for your help,you teach me a lot of
great things i really apreciate you.

thanks

akimp3
Dimedrol
04-19-2002, 08:38 AM
Hi akimp3

Yes I knew what those differences between sequential seeds are not _always_ divisible by 10 ( it's seen from my example with seeds 66921289 and 66920498 ).
That's why I said:
"So it's possible to say what if one knows 1 password - he can find the next sequental password in at most 10 hops _with_a_very_good_probability."

Let's make a statistical analysis of differences between sequental seeds.

For the example ( these are not a real numbers, just for the illustration ):
differences
30, 70, 50, 100, 31, 50, 30, 70, 62, 40, 80, ....

It's seen what there are much more neighbour differences which are divisible by 10 than others.

To calculate exact probability of getting the next difference divisible by 10 we need to know the full set of differences, but even without knowing that, from the statistical analysis we can see what this probability is higher than 1/2 which is _very_ good ( in casino for example chances to win are much less :) ).

And besides, you can find the next password not only in direct order, but in a reverce order also.

I mean if you've found the seed say 66923456 - you can do 2 passes - in a direct order
66923456 + 10, 66923456 + 20, 66923456 + 30, .. 66923456 + 100
and in a reverse order
66923456 - 10, 66923456 - 20, 66923456 - 30, ... 66923456 -100

BTW: I think range 10 - 100 between seeds is too strict. I think it's possible to reduce it ( but you need to gather more statistics ).

So you see - max. 20 hops (can be reduced I think) ( 10 in direct order and 10 in reverse order ) and you get a password _with_a_very_good_probability ( again :) )

Regards, Dimedrol.
akimp3
04-19-2002, 06:03 PM
Hi
Dimedrol thank you very much for your help.
here are more statisticd. I have find something in them
but i am not sure if it usable.
Download the attached text file.the file has all the passwords
and their seeds in front of them.
As you have told me the seeds are divisble by 10 in most case.But after a number of password the (difference-1) is
divisible by 10.And after that the other passwords seeds are
divisible by 10 since we arrive to another KEY password that
the seed difference is not divisible by 10 and (difference-1)
is ivisible by 10.I have tried to find the number of ordinary password between two KEY password.We can not count
the first transition because we dont know maybe there is other
passwords before it that have 5 as their last digit.
but after that there is:
15 number with 6 at their end
17 number with 7 at their end
15 number with 8 at their end
19 number with 9 at their end
18 number with 0 at their end
Do you think that a rule exist between this numbers?

thanks in advance

akimp3
mike
04-20-2002, 06:58 PM
How do you think telemarketers call people? By hand? If you know one seed that generates a number, you can set up a war dialer to try every seed after that until it finds one. According to the list below, you'd have to try at most 100.
akimp3
04-20-2002, 07:56 PM
Hi
thank to all of you that helped me on this project
specially Mike and Dimedrol.
I have shown the program to my boss and he has
accepted that the algo is week.He asked me to write
him a random number generator.Without your help
i will never arrive to this point.
This board,its moderator and all of its members are greats.
if I had asked for help on other boards they would
not have helped me and they would have treated me as person
who ask for cr*ck. But here you have teach me a lot
of thinks you have answered to all my stupids questions
and you solved my problem.

Thank to all of you
I will never forget your help

akimp3


Subexponential attack on AES
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Subexponential attack on AES
PDA

View Full Version : Subexponential attack on AES

mike
04-15-2002, 11:32 PM
Here's an attack on Rijndael and Serpent. It's polynomial in number of rounds with a huge multiplicative constant (double-exponential in the size of the S-box).

by Nicolas Courtois and Josef Pieprzyk
http://eprint.iacr.org/2002/044/

Abstract. Several recently proposed ciphers are built with layers of small S-boxes, interconnected by linear key-dependent layers. Their security relies on the fact, that the classical methods of cryptanalysis (e.g. linear or differential attacks) are based on probabilistic characteristics, which makes their security grow exponentially with the number of rounds Nr.

In this paper we study the security of such ciphers under an additional hypothesis: the S-box can be described by an overdefined system of algebraic equations (true with probability 1). We show that this hypothesis is true for both Serpent (due to a small size of S-boxes) and Rijndael (due to unexpected algebraic properties).

We study general methods known for solving overdefined systems of equations, such as XL from Eurocrypt'00, and show their inefficiency. Then we introduce a new method called XSL that uses the sparsity of the equations and their specific structure.

The XSL attack has a parameter P, and in theory we show that P should be a constant. The XSL attack would then be polynomial in Nr, with a huge constant that is double-exponential in the size of the S-box. In this case we are able to break Rijndael 256 bits and Serpent for key lengths 192 and 256 bits.

We demonstrated by computer simulations that the XSL attack works. Unfortunately they show that P will not be constant but increases very slowly with Nr. If only P is increased by 2 (respectively 4), our attack on Rijndael (respectively Serpent) will become slower than the exhaustive search. Even so, we claim that the security of these ciphers does not grow exponentially with the number of rounds.


need vb3 decompiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > need vb3 decompiler
PDA

View Full Version : need vb3 decompiler

Xybyre
04-16-2002, 04:18 AM
I need a decompiler for a Self Test cbt-type certification software. The program was written in VB3. The protection seems to be a simple time trial + registration key, but since vb3 is interpreted, a debugger doesn't do me any good... :(

The demo version of vbdis3 has a size limit, so it refuses to decompile the program. I've gone through pages and pages of cached material on Google, with no luck on finding a working link to a version of vbdis that can decompile the program.

Anybody have any suggestions?

thanks,
Xybyre
foxthree
04-16-2002, 06:39 AM
... protools.cjb.net? I remember they have a VB3 decompiler?

Signed,
-- FoxThree
Xybyre
04-16-2002, 02:53 PM
They have a vb3 deprotector that removes some anti-decompiler tricks so that you can decompile "protected" vb3 programs, but they don't have the vb3 decompiler itself. They also have tools for vb5 and vb6, but none for vb3.
JanDebug
04-26-2002, 01:15 AM
Hi,

Visual Basic v3.0 Decompiler - from DoDi

hxxp://archive.yates2k.net/crackznew/Tools.htm

Regards

Jan
Xybyre
04-26-2002, 01:40 AM
Many thanks, Jan! :)


Debugging and tracer.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Debugging and tracer.
PDA

View Full Version : Debugging and tracer.

nikolatesla20
04-16-2002, 10:13 AM
Just a couple quick questions here.

Okie, I've been reading some of the threads about Revirgin, and about ImpREC. What I am wondering is I read Revirgin uses Ring0 tracer I believe. SO first my question is how? I mean doesn't a ring 0 need to be a system driver? Or is the program (perhaps in a dll) somehow making a transition to ring 0 ?

If this is so, how is something like that done, and how safe is it.

Going further, I notice that programs like OllyDbg say they use only Win32 APIS for debugging - and it has a tracer built in. From what I know of the API for debugging, couldn't the app just check IsDebuggerPresent() and kick you in the *nuts* :)

The reason I am interested is because of the new OEPFinder tool, I thought perhaps we could add a basic tracer to it, that can start the target and simply watch the EIP register and when it hits the OEP jump point, it can log the eax register (or maybe even script it what to log for example), so now you have the real oep.

What I want to know for sure is, is it only possible to get to the register values of a process thru debugging it?

And how does a ring0 tracer like Revirgin actually work - I only see two dll's..is there something else fancy going on (I'm not a driver programmer, I think I will ask the driver guys a work some questions today :) )

I see on Win32 you can get a handle to a current thread with OpenThread() and then you can get the registers I think with GetThreadContext() but of course you have to call SuspendThread first and it says these functions supposedly work even when not debugging a process...hmmmm.

Thanks for hearing my rant !

-nt20
foxthree
04-16-2002, 11:00 AM
Hi Tesla:

Glad to note that you're thinking along my lines. Actually, this thought stuck me a while ago. Before I begin, I'll attempt to answer your questions first:

(Q) Does RV use a Ring-0 tracer?
(A) Yes. The Trace in RV is an implementation of /tracex from TheOwl's ICEDump (albeit without integrating with SoftICE).

(Q) Does Ring-0 needs to be system driver?
(A) Yes and No. Yes, if you need to perform a "lot" of low-level stuff. No if you only need to peek at a thread' register set and set the DRx and stuff link that. (I mean GetThreadContext and SetThreadContext). RV uses a system driver called "rvtracer.sys". You must see this in the same directory as RV.

(Q) IsDebuggerPresent trick...
(A) OllyDbg and a lot of others feature a "ring-3" tracer. i.e. a Tracer that runs in user mode. Tracers' like this can be easily screwed with a "lot" of standard anti-tracing techniques (like IsDebuggerPresent and so many others). Look at my post on Anti-Tracing/Anti-Debug techniques. However, a ring-0 tracer - if coded well - can easily by pass all anti-trace techniques.

Contd...

Signed,
-- FoxThree
foxthree
04-16-2002, 11:06 AM
In continuation with my previous post, for OEPFinder I actually thought of writing a tracer however it can be easily fooled unless it is a ring-0 tracer and I'm still not at that level of coding :( Writing a ring-0 tracer is quite a difficult task (unless you know your asm/Intel basics extremely well) as is evident by looking at the ICEDump source code.

Notice, that writing a tracer is in *NO WAY* a new idea as I've always admired the way it was done in ProcDump. An "automatic" unpacker with scripting capabilities... What more could ask for at that time? However, notice how that is kicked in the balls now-a-days by many packers... :mad:

As for debugging support, there is a lot of information to be done in the MSDN. Look for DebugActiveProcess and WaitForDebugEvent APIs and they'll show you how deep the rabbit hole goes ;)

All in all, I've summarized my entire Protected Mode Intel knowledge in this two posts. (which reminds me, i hold just a drop of water from a vast ocean).

Maybe my posts wouldn't have helped your questions, but these are just my research findings and I thought I'd share it with fellow RCEs.

Which reminds me, Hey +Tsehp, why don't we integrate OEPFinder's Signature tactics to RV to make OEP finding a bit more "automagic". Just my thoughts...:)

Signed,
-- FoxThree

PS: Folks, if I've made any mistakes, feel free to correct it. That's how I learn. Thanks :)
crUsAdEr
04-16-2002, 12:34 PM
All roads lead to Rome?

Hmm, somehow that is what i've been researching... somekind of tracer to unpack packed program... just planning to write a simple unpacker as practise... and a ring-3 tracer is such a good idea...

Yeah I know that the program can detect tracer and hence kick our butts, but if we know how our tracer is detected, then we can code our tracer in such a way that it will detect the trick and then patch the program appripriately? I have been wondering along this line, and i find it highly feasible... of course presuming that the target if on ring3 as well..

Maybe some of the resident guru can shine some light?

Thanx,
nikolatesla20
04-16-2002, 01:06 PM
Yes, I was going thru the MSDN stuff at 4 this morning. (couldn't sleep, too hot up here now all of a sudden)

Yep, noticed all the basic debugging functions and stuff.

The thing is yes you can trick tracers supposedly, but we are not tracing for what revirgin is, I mean RV has a tracer.dll for resolving imports, this can be fooled - we would simply be looking for the signature byte to be executed.

Of course, maybe you could add this to RV as some sort of plugin ? :) I mean Tseph already has an actual prog tracer in it now too. I did try using it in this manner before, by putting in the range, I don't remember if it worked or not tho. And even so, it won't land you on the OEP, just right before it. If it reported the EAX register you would see it. (In this signature byte case that is).

So RV would need two more things: A "search for signature" button, and then a result window for registers you want to watch such as EAX.

Actually, I mean the tracer in RV is so fast on Win2K tho, (but I had it crashing yesterday !!!!!!) that you can usually find all the dips and end up on the OEP pretty quick. But using the sig byte you will know FOR SURE that this is the OEP and not a DIP. Sometimes it can be tough to know for sure, for newbies anyway.

But in either case it is good coding practice anyway, I think. Good learning. The guys that wrote icedump had to start somewhere...and Tseph had to start somewhere. Methinks Tseph is perhaps a device driver coder at some company out there ?? :) (Or in the upper levels of Soft Eng. department..)

-nt20
nikolatesla20
04-16-2002, 02:22 PM
Actually, that call to IsDebuggerPresent() - we could probably hook that and return our own value to fake it out.

For example, we could hook any call to GetProcAddress() (obviously we first would need to find the call in the import table, even when it's messed up).

The only real problem with this is our hooked code has to be in the process's memory space, so it must be a DLL on its own, it would need to be injected into the process's space, but the MSDN has some articles on how to do this.

So we watch GetProcAddress() for the name "IsDebuggerPresent" and chain the call (We pass back the result as the address of OUR function :) ). Well, actually, hook and take over the call ;) Just return a zero :) That wrapper software Asprotect does stuff like this, and so can WE !

I'm sure someone has tried this before? Maybe this is a small utility I could write :) IsDebuggerPresent killer...

-nt20
crUsAdEr
04-17-2002, 02:28 PM
Yo,

Just tested out the tracer idea last nite... a lame tracer that single steps is REALLY slow.. guess it aint gonna work.... then it dawns upon me... /tracex and revirgin can take like 30 mins to trace to OEP of some program... just it really defeat the purpose of OEP Finder to wait for 30 mins to find out what OEP is...

Just my thoughts for now!
yoda
04-17-2002, 03:13 PM
Hey plp...

Just a small note...
I don't really need to hook IsDebuggerPresent+GetProcessAddress to avoid proggies detecting that they are a debuggee.
I think (but haven't tested) that you can modify the windows internal variables which describe whether a process is under debug control or not...

NT: PEB.dwFlags (at PEB[0]) & 00010000
9x: PROCESS_DATABASE.dwFlags (at PROCESS_DATABASE[20])
& 1 (fDebugSingle)

y


Taskbar
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Taskbar
PDA

View Full Version : Taskbar

Tech19
04-16-2002, 05:11 PM
Hey I was wondering how I could go about hiding a programs name/icon in the windows taskbar. I've never done anything like this before so any help would be appreciated, thanks.
ZaiRoN
04-16-2002, 05:21 PM
hi Tech19,

try to use CreateWindowEx.
setting dwExStyle as WS_EX_TOOLWINDOW should work.

bye
ZaiRoN
notbob
04-16-2002, 06:34 PM
Originally posted by Tech19
Hey I was wondering how I could go about hiding a programs name/icon in the windows taskbar. I've never done anything like this before so any help would be appreciated, thanks.

The taskbar only lists top-level windows that are currently being shown. That is, it displays windows that have both a NULL hWndParent handle and haven't been hidden with a call to ShowWindow(hWnd, SW_HIDE).

A very simple way to keep a window off the taskbar is to create a hidden top-level window and only use it as a parent proxy for your real top-level window.

Below is a code snip modified from the standard MSVC6 Windows Application AppWizard

Good luck,
-notbob

BOOL InitInstance(HINSTANCE hInstance, int nCmdShow)
{
HWND hWnd, hParentWnd;

/* Create our hidden top-level window */
hParentWnd = CreateWindow(szProxyWindowClass, szTitle, WS_OVERLAPPEDWINDOW,
CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, NULL, NULL, hInstance, NULL);

/* Create our visible window as a child of the hidden top-level window */
hWnd = CreateWindow(szWindowClass, szTitle, WS_OVERLAPPEDWINDOW,
CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, hParentWnd, NULL, hInstance, NULL);

/* Display the child window, but NOT the top-level one */
ShowWindow(hWnd, nCmdShow);
UpdateWindow(hWnd);

return TRUE;
}


Need program to read input
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Need program to read input
PDA

View Full Version : Need program to read input

vgb
04-16-2002, 07:45 PM
Couldn't think of a sort title for what I need to do - I need to intercept the data returned from an IRC server before it's processed by the client. I'm trying to determine the way they code changing fonts, etc. Some of it is detailed in their docs but I would like to see the specific way they do it. So I need a program that will scan all the data coming back from the server so I can view it.

Anyone know of any such (free)utilities out there?

Thanx,

vgb
nikolatesla20
04-16-2002, 07:49 PM
Maybe what you want is called a packet sniffer. If you want to watch the data come in from an internet connection

AnalogX has a nice free small packet sniffer that might work, if this is what you need, it's called PacketMon.

www.analogx.com

-nt20
Snatch
04-17-2002, 01:59 AM
You dont need a packet sniffer thats over kill because it gives you more than the information you want including the network, IP and TCP headers. You just want a winsock spy. You only care about the socket data and only that bound for your IP. hxxp://www.sstinc.com has some good programs to do just that.

Snatch
vgb
04-17-2002, 02:43 AM
Thanx! I can use both approaches for two different things.

Take care,

vgb


Process patching yet again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Process patching yet again
PDA

View Full Version : Process patching yet again

crUsAdEr
04-17-2002, 03:02 AM
Yep, i know i know.. a search for loader / process patch gives mt like 250 threads to browse through... but i just have one more question at the moment...

I have been staring at R!sc 's process patcher's source code... as well as disassmble the loader created with RPP... there is one thing i am not sure...

R!sc create the process (suspended), then start checking the VA to be patched for the same bytes pattern as the original bytes given, once found patch will be performed... the question is what is the duration between each read process memory, i do not see any kind of timer... does R!sc just let the child process runs and then continuously read and read the process memory?

Thanx,
Kayaker
04-17-2002, 07:17 AM
Hi binh81,

It looks like R!sc uses a counter, as opposed to a timer per se. This is the "T" value in the script, or if you use Nchanta's GUI, the number of times to try to patch before giving up.

From the source code this appears to be the p_timeout value, which is encoded at address 406000 in the rppdata section:

mov esi, 406000h
mov eax,[esi] ; get process timer from rppdata section
mov [p_timeout],eax

A counter (Ptimer) is used to compare the number of times the ReadProcessMemory loop has run, and since the whole process takes a certain amount of time, this is where the 'effective' timer comes from I gather.

waitagain:
add dword ptr [Ptimer],01
push eax
mov eax, dword ptr [p_timeout]
cmp dword ptr [Ptimer],eax
pop eax
jz VersionERR ; whoops, xxxx checks failed, quitting
pushad
Check_Data:
push 0 ; BytesRead
push ebx ; Length
push offset CSiR_RPBuffer ; Destination (to read them to)
push ecx ; Source
push dword ptr [CSiR_ProcessInfo] ; Process whose memory we are to read
call ReadProcessMemory
...
mov ecx, ebx
rep cmpsb ; compare read bytes against check bytes
popad
jnz waitagain ; jump if not equal to check again
; (cause a few milliseconds have passed, and they may? be there)

Personally I didn't have much luck with the process patcher, though it is the first time I've tried it. ReadProcessMemory returned *nothing*, so there were no patch bytes to compare. The process (notepad or packed notepad) seemed to be created OK, but ReadProcessMemory couldn't read anything from it (though it didn't return an error).

Plus, unless I specifically forced ResumeThread to be called by changing the following jump, the whole process just hung in memory.

cmp dword ptr [esi-4],0
jz resumethefucker ; check see if process will be resumed now or later

startpatch:
...

Running it on Win98SE. Kinda surprised it gave me problems actually.

Kayaker
crUsAdEr
04-17-2002, 12:07 PM
Hi Kayaker,

Thanx for the detailed analysis... so that means R!sc just keep checking the running process while the other process is running? I suppose it is based on the time slice of each process for the CPU cycle? That is where the few milli seconds come from?

R!sc's Process Patcher seems to do OK on my win2k SP2 but i only tested it once... kayaker, if u tested it with AsProtect then i think it has some anti loader feature hence it wont work...

Thanx a lot, kayaker,
Binh

P.S : Lord Rhesus's VBLoader use the exact same algorithm....
crUsAdEr
04-18-2002, 08:08 PM
Hi folks, me yet again!!

Yep, i am having a slight problem... i want to load my own dll into the space of a child process.. what i want to do is replace a API call to a call to my own dll... so i need to change that value at IAT thunk.. i use CreatProcess with _CREATE_SUSPENDED... try to write to the overwrite the IAT entry.. but the problem is that i realise IAT is NOT initialised yet.. so IAT is not pointing to API address but instead the API ascii in the child process... so i cant patch it yet cos if i do the process wont run...

So what i need to do is patch IAT antry after it has been initialised but before the process start executing... So how should I do that? I dont want to patch my kernel API yet just in case my code is crap and it mess up my windoze....

So could someone please tell me how i should go about doing this?

Thanx
Kayaker
04-18-2002, 11:58 PM
Hi binh81

As you said, you need to intercept the process a little later on, after the PE loader has done its business and the First Thunk has been initialized with the real addresses of the APIs and the PE file is ready to run.

The method I'm familiar with for injecting a dll into another process' address space is from Iczelion's IczDump. After mapping the file into memory you parse the PE header and get the OEP, then you create the process suspended and "save" a certain number of bytes from the start of the process (at the OEP) with ReadProcessMemory. These will be overwritten by your injection code, which is allowed to run, then replaced.

Then you prepare your injection code, which is a standard LoadLibrary routine to load a (your own) dll. Since the target process may not import LoadLibraryA you'll need to get its address first and hardcode the value into your injection snippet. WriteProcessMemory writes your injection code over the original and is allowed to run with a CreateEvent object. I think you can also use SetThreadContext and ResumeThread to do this.

Once your dll is loaded it replaces the original bytes and jumps to the OEP directly. It's at this point in your dll, just before returning control to the program, that I thought you could manipulate the IAT. You can get the start of the IAT from the PE header, then maybe "walk" the export directory for each thunk address until you find the API name you're trying to hook, then change that address to your own. I've got a WalkExportDirectory ASM module written up that will return the API Name and DLL Name for any thunk address inputted if that helps the cause...

See if you can suss out how Iczdump does it, it should be fairly straightforward careful reversing of the loader procedure. The 'injected' code he uses looks like just random bytes until you actually see it disassembled in operation.

Also, I figure you've already seen the new 'API hooking revealed' article I posted a link to recently. You may find some ideas in there. It seems to favor using CreateRemoteThread for dll injection in NT and Win2K.

Cheers,
Kayaker
crUsAdEr
04-19-2002, 10:27 AM
Yep, should have thought of that..

Thanx kayaker... simply freeze the process at Entry point instead.. then IAT is already loaded...

thanx a lot..
Fake51
04-19-2002, 05:34 PM
I had to patch a program inline a wee while ago, and the patch had to work across different windows platforms. I started out hoping that I could inject my own dll by just changing the iat, but as you found out, it was no good. I then tried some of the older essays on the fortress and found one by Stone on runtime patching. The two first approaches mentioned I was already familiar with, and didn't bother trying to implement in this case (as it would have been a problem trying to figure out when to patch - program is wrapped). The third approach was on windows hooks, but wasn't explained. It wasn't too much bother to figure out though, and it gave some nice possibilities.
The nice thing was that the code I wanted to patch was run AFTER the program created it's first window. So it was possible to install a hook into the windows message chain. The beauty of the thing is, that if you place your hook in a dll, and either let it be thread specific or global, it will be notified when the window is created .... and the thread will be located in memory ready for patching. Furthermore, your dll will have the rights of the program, thus you can go right ahead and use virtualprotectex, then writeprocessmemory (or use a mov dword ptr [xxxxx],exx, since you have the same rights as the program). After the patching is done, it's just a matter of unhooking.
The beauty of hooking the message chain is that it's easy, and there are some nice possibilities: you can hook both win-proc messages and debug messages. Plus, it works the same on win98, win2k, winxp ... no need to figure out what os before you start running.

Just thought I'd chip in.
Fake
evaluator
04-20-2002, 09:32 AM
Hello, binh81!

Want say one TERRIBLE newz:)

Using DZA-patcher's [GREAT] loader engine, is possible patch any (and aspr also)
protection scheme.
Simple in aspr error happens because after aspr checks CRC.

So I found TERRIBLE easy way {trick}, and loader patches code after CRC check!
Without any timer & etc............

So last ASPR's "legend" defeated.

WE WILL,
Kayaker
04-20-2002, 07:25 PM
Hi

I dug up the Message hook doc and source by Stone that Fake51 talked about. The explanation in the original tut in the old Fravia database (stone1.htm in the Academy300 section) is missing, but Stone did include it at his website before it closed down. I have a copy of the entire Stone's website, which is very interesting reading, and actually uploaded the 1.2Mb file to the REKML site a long time ago. You can probably get it there (REKML still active??), or it might have been included in the RCE CD (don't know).

In any case, for posterity here it is.

Kayaker

---------------------------------------------------------------------------
In Memory Patching - The MessageHook Approach
by Stone

I'll skip relatively lightly over the in-depth technical issues of this method.
It is simply far beyond this text to go into it. Maybe someday I'll write a
book or something :) sorry..

The above method has it's advantages - and disadvantages. It's cumbersome.
Indeed in many instances access to foreign addressing spaces can be gained
easier. I will now examine one such method. The method was first described
in MSJ 1994. I first noticed the potency of this method examing Grudge's crack
for SubSpace. My sourcecodes and approach as such bares many resemblances with
Grudge's initial work.

Most likely you've all encountered Windows Messageing system at one point or
another. Breakpoints on "BMSG", HWND command in Winice is indeed breakpoints
on messages and list possible recievers of messages. The whole idea behind
messages goes back to the fact that we have a multitasking operating system.
Several tasks needs to share equipment that can only be used by one at the time.
The obvious example is the mouse - the user will have only ONE mouse total, not
one for each thread. Another is the keyboard, keyboard input is often ment for
only one of the running threads. A total breakdown of the windows messageing
and windowing system is far far beyound the scope of this small text. It'll
suffice to say that any window made by any thread in any process is controlled
thru messages from the Windows operating system.

Again we'll exploit that Windows is an overbloated operating system - or well
as I would rather put it - a very potent equipped OS. The feature we'll be
exploiting here is that of a Hook in the message system. For many reasons
Microsoft decieded that even at ring 3 people should be able to intercept
messages send to windows. Because they wanted this hook to be usuable for
Computer Based Training they decieded that a hook would be no good if it did
not have direct access to the addressing space of the process belonging to the
thread it captured a message for. So they decieded that a MessageHookHandling
procedure should be loaded into any process in which it captured a message.
Further developers must've felt generous the day they designed this. They
allowed a hook not just to one process - but to all!

Let's get a bit more technical on this. The API that installs the hook is:
User32!SetWindowsHookExA

The first problem about using this API to hook windows messages globally is
the way it gain access to the address space of the thread which it intercepted
a message to. To get real deep on this issue is again far beyound the scope
of this text, but it has to do with how modules is mapped in pages thru out
the various memory contexts (Process addressing spaces).
The result is that you cannot have the hook within the EXE file that installs
the hook - rather you need to have it in a DLL.

In other words we start out by loading the DLL in which we have our hook, then
find the address of our hook procedure in it and feed this to SetWindowsHookExA.

The next problem we encounter is that of designing a messagehandling system.
Since a LOT of messages is send out to windows system wide all the time it's
important that we design our hook to be relatively fast or we'll be slowing the
system. The easist way of doing this is only acting upon messages of a specific
type. Choosing type depends on how you wish to time your patch. You can in
this way time it to hit on keyboard activity in a window, mouse activity,
windows being put to background and so on and so forth.

I've choosen the real simple hook type intended for ComputerBasedTraining. This
hooks a large number of messages related to windows giving us plenty of things
to act on without intercepting everything. Further in the hook procedure I
test weather the message send was one that is supposed to create a window.
This allows me to patch right after the "main" window of the program is created.
Without intercepting too much and even when intercepting I only run a few bytes
of my code unless ofcause it happens that the program is creating a window.
Obviously I might end up patching more than since this message type can be
send many times. Other strategies could be hooking the keyboard, all messages
etc. I very much believe that which type of hook and the exact design of your
hook-handler is an issue that should be solved in relation to the specific
problem you're dealing with. For instance in training hooking the keyboard
and only acting on specific keys would be a good idea instead of acting on
the window.

Mammon/HCU suggest a boolean variable to see if you already applied a patch.
This can be a very good idea. Even better would be if you shut down your
hook-installing process (program) and the hook along with it after you've
patched. You should however be aware that this method has a caveat if your user
deciedes to run multiple versions of the program you patched or if you're
patching kernel32.dll in memory since this DLL might need to be patched more
than once because an unpatched version might later on be mapped into your
target's addressing space. Thanks to Mammon/HCU for a beneficial suggestion.

The next problem is that we need to hinder that we patch all processes. Again
I abuse the concept of modules. By getting the current module filename and
compareing it to the filename of the file we desire to patch I can identify
weather this message was send to the target or to another program windows.

And the last problem is ofcause that we cannot keep messages from the target's
windows and expect it to perform like it's supposed to. What we do is that we
chain other possible hooks using the neatly provided API:
user32!CallNextHookEx

One final things is worth noting Exiting the process who "owns" the hook will
destroy it - in other words we cannot shut down until we're sure we've patched
the program and we cannot shut down if need multiple patches (as patching
e.g. kernel32.dll (which is a bad idea anyway) would require. The good thing
about it is that we can simply call ExitProcess when we're done and windows
will take down the hook for us with no further adue... Pretty clever MS!

Since we in the hook-procedure have direct access to the addressing space
of the target process we wouldn't need to use WriteProcessMemory, however
it's a very good idea to do so. First and foremost WPM as described earlier
overrides pageprotection. Second and also important - there is a difference
in how pages in a process is handled between Windows 95 and Windows NT. If
you patch a program's pages in Win NT (if it's not shared) it'll be copied
and then the copy will be patched - thus the patch will not affect other
processes utillizing the same module. In windows 95 this is not so. However
WriteProcessMemory in Windows 95 has build in this mechanism ensuring that
if you use WriteProcessMemory you'll not suffer differences between NT and
95. (This is not true if you patch above the 2g limit - which I btw cannot
see why you'd do)

Here at the end I'll shortly describe the caveats of this method. It requires
a window. Without a window in the target process you can't do didly with this
method. However you can use this method to inject a DLL into the address space
after the window has disappeared and then patch the IAT to make a API-hook of
it like in the Debug-approach section.

Sourcecode - stnmsgh.zip
-------------------------------------------------------------------------
crUsAdEr
04-21-2002, 02:21 PM
Hmm...

Thanx Kayaker... Nice reading....

It also brought back to my intention that I was looking for the RCE CD sometimes ago when i found a long thread about it... Cant find it anywhere though... If there a way for newbie/latecomer like me to obtain it somewhere?

Hope this is not classified as warez request :>???

Thanx
Fake51
04-23-2002, 03:40 PM
Nice, Kayaker. Don't think my (old) copy holds that info, or maybe I'm just going blind ....
For info on how to go about implementing hooks, look to iczelion. As always, one can find info and code there.

Blue skies
Fake
crUsAdEr
04-23-2002, 05:32 PM
Yep.. thanx Fake51,

me reading over there now :>

cheers,

P.S : doesnt seem as hard as it sound :>... but maybe cos i have not really implement it yet....


icedump question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump question
PDA

View Full Version : icedump question

mambox
04-17-2002, 05:07 PM
ive installed since time sice 4.05 334 and launch in startup folder the icedump for my version but still receive the famous:

icedump v6.0.2.5 for winice v4.05 build 334 loader
icedump was not loaded yet
VXDLDR failed to load icedump

whats wrong??
doesnt load kernel32.nms.

any help

thx
Aimless
04-17-2002, 05:54 PM
More info required:

1. Your OS
2. Your type of chip (Pentium/Pro/MMX/Celeron/AMD)
3. Your SICE type (9x/NT)

...etc.

...Have Phun
mambox
04-17-2002, 06:32 PM
OS:w98
proc:athlon 900
sice 4.0.5 b334 for win9x duh!

cant resolve my prob..
B-Boy
04-17-2002, 10:20 PM
try by _not_ loading the kernel32 symbols (kernel32.nms) but loading kernel32 exports (kernel32.dll) and then run icedump.
mambox
04-18-2002, 07:47 AM
yep i've reading post about kernel32.nms but i dont load it just the kernel32.dll as usual but still occur with the famous msg.


Try This !!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Try This !!!
PDA

View Full Version : Try This !!!

Aimless
04-17-2002, 05:57 PM
Go to www.searchlores

Find "Flange of Myth"

Leads to www.waybackmachine.com

Give url: www.fravia.org

ENJOY !!

(Yup! Including the now prohibited Microsoft Bashing Project)

...Have Phun
peterg70
04-18-2002, 12:39 PM
When you enter internet address or email address check the bloody spelling.

Links don't work.

I know what they are but it peeves me off that someone is able to check what they type.

peterg70
mike
04-18-2002, 04:10 PM
www.searchlores.org/flange.htm

Wayback machine is at
http://www.archive.org/index.html

Then type www.fravia.org
Aimless
04-19-2002, 07:40 AM
Indeed.

Apologies for the inconvenience caused due to my mis-spellings. The correct sites are the ones which MIKE has described.

Mike: Thanks for the same.

Jimmy: Thanks for the same too.

...Have Phun


M$ going cracker ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > M$ going cracker ??
PDA

View Full Version : M$ going cracker ??

Aimless
04-17-2002, 05:58 PM
Go to research.microsoft.com

Try "DETOURS"

Download the 600 KB package

ENJOY!!

...Have Phun


SoftICE Boot Probs on Windows ME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE Boot Probs on Windows ME
PDA

View Full Version : SoftICE Boot Probs on Windows ME

bpbenda
04-17-2002, 08:57 PM
I am running Windows ME and attempting to install SoftICE v.4.05, which is not totally a breeze. Anyway, I run through the SoftICE installer and tell it NOT to modify "autoexec.bat". Before restart, I move "winice.exe", "winice.dat", and "siwvid.386" to "c:\windows". I obtain the most recent SoftICE "debugger.exe" from the NuMega website:

ftp://ftp.compuware.com/pub/numega/drivers/outgoing/utility/debugger.exe

... and move it to "c:\windows". Also get the Microsoft Windows ME DDK from their website:

http://www.microsoft.com/ddk/debugging/download/winmeddk.exe

... rename "winboot.sys" to "io.sys" and move it "c:\". Upon reboot, the debug version of io.sys takes over and initializes. Then SoftICE begins to load. It is during the loading of SoftICE on boot that I am having problems. Basically, my computer screen blanks and all I have is a blinking cursor in the top left-hand corner. When this happens and I press any key on my keyboard, a SoftICE messages flashes on my screen for a fraction of a second (not long enough to read), and my computer is auto-rebooted. I have attempted to use the Pause/Break button on my keyboard to read what SoftICE is telling me, but pressing it does not pause anything. Instead, my computer just reboots as described above. Now, unless I swap the debug version of "io.sys" with the original (non-debug) version, this is an endless loop of SoftICE error to reboot and back again.

From what I can read of the SoftICE error, it goes something like this:

---------------WINICE(01)+F0F7---------------
Macro: initialized 32 Macro entries.
INT0E FAULT CODE=BC03BBCC

... Of course, there is more to it, but this is a rough guess as to what it is saying. Does this make any sense? What is an "INT0E Fault"? If it is of any help, my "winice.dat" reads:

PENTIUM=OFF
NMI=ON
ECHOKEYS=OFF
NOLEDS=OFF
NOPAGE=OFF
SIWVIDRANGE=ON
THREADP=ON
LOWERCASE=OFF
WDMEXPORTS=OFF
MONITOR=0

PHYSMB=512
SYM=1024
HST=256
TRA=8
MACROS=32
DRAWSIZE=2048

INIT="X;"

F1="h;"
F2="^wr;"
F3="^src;"
F4="^rs;"
F5="^x;"
F6="^ec;"
F7="^here;"
F8="^t;"
F9="^bpx;"
F10="^p;"
F11="^G @SS:ESP;"
F12="^p ret;"
SF3="^format;"
CF8="^XT;"
CF9="TRACE OFF;"
CF10="^XP;"
CF11="SHOW B;"
CF12="TRACE B;"
AF1="^wr;"
AF2="^wd;"
AF3="^wc;"
AF4="^ww;"
AF5="CLS;"
AF8="^XT R;"
AF11="^dd dataaddr->0;"
AF12="^dd dataaddr->4;"
CF1="altscr off; lines 60; wc 32; wd 8;"
CF2="^wr;^wd;^wc;"

I am running an AMD K6-3 450 with 512MB RAM. Any and all help is much appreciated. TIA.
bpbenda
04-17-2002, 09:34 PM
Was finally able to transcribe the error message, and it looks like this:

---------------WINICE(01)+F0F7---------------

MACRO: MEMORY ALLOCATED FOR 32 MACRO ENTRIES
INT0E FAULT IN SOFTICE AT ADDRESS C0032A6C OFFSET 00002538
FAULT CODE=BC03BBCC
DS=0030 ES=0030 FS=0078 GS=0030 ESI=C003CA98 EDI=C036FBCC ESP=C003CA58
EAX=00000400 EBX=0000001A ECX=00000000 EDX=C036F0EC EBP=C003CB78

C003CB78 C0008CAC WINICE(01)+E108
EAX=D0000400 EBX=0000001A ECX=0000C003CAFD=C036F0E000025C903CB783CB78
DS=0030 ES=0030 FS=0078 GS=0000 ESI=00000010 EDI=C036FBCD ESP=C000C9A8
EAX=C00157EC EBX=C036FB50 ECX=00000014 EDX=C036FCEC EBP=C000C9E0

C000C9E0 0000000D WINICE(01)+E259
foxthree
04-17-2002, 11:34 PM
Hi:

INT 0E is a pagefault interrupt. It happens when a page fault occurs in a program. I'm sorry but this is as much I can help :(

Signed,
-- FoxThree
bpbenda
04-18-2002, 12:05 AM
foxthree, thanks for the insight. I am a newb to all this, but trying to learn.

A page fault is an interrupt that occurs when a program (in this case, SoftICE) requests data that is not currently in real memory. I read that this usually happens when the virtual memory area, or the table that maps virtual memory addresses, becomes corrupt.

I am wondering what data is being requested. ?? What purpose is served by the "drawsize" line in "winice.dat"? I notice in the error generated (see above) that it processes the macro line, and the error occurs immediately thereafter. Since the "drawsize" line follows the "macro" line, could it be something with that setting?

Like I said, I am newb to all this. My suggestions probably give me away though, but I cannot learn SoftICE if it's inoperable.

Seriously, all thoughts and suggestions are welcome. TIA.
esther
04-18-2002, 03:00 PM
hi there,
check out your winice.dat
INIT="X;wl;code on; altscr off; lines 25; wc 36; wd 4; wr; faults off;"
Hopes this helps ;)
bpbenda
04-18-2002, 04:10 PM
esther, thanks for the help. Unfortunately, I still get the same error. Obviously, with your recommended changes to my "winice.dat" file, SoftICE takes longer to initialize. As a result, it appears to fully process "winice.dat". So, I am not sure that is my problem anymore.

I guess I will just have to install what I got on my other machine running Windows ME and see if I get the same error. Maybe it is a particular setting in my CMOS that is the source of my troubles. Maybe not.

I sincerely appreciate your help, though. Again, any and all thoughts or suggestions are welcome. TIA.
esther
04-19-2002, 01:56 AM
Originally posted by bpbenda
esther, thanks for the help. Unfortunately, I still get the same error. Obviously, with your recommended changes to my "winice.dat" file, SoftICE takes longer to initialize. As a result, it appears to fully process "winice.dat". So, I am not sure that is my problem anymore.

I guess I will just have to install what I got on my other machine running Windows ME and see if I get the same error. Maybe it is a particular setting in my CMOS that is the source of my troubles. Maybe not.

I sincerely appreciate your help, though. Again, any and all thoughts or suggestions are welcome. TIA.

Another thought...
download the patched which the faq suggest and try it out
http://icedump.tsx.org

best regards
bpbenda
04-19-2002, 08:22 PM
esther, thanks again for your help. I had previously read the FAQ and have tried the loader. I receive the same error regardless of whether I use it or the debug version of "io.sys". I have also tried different memory settings configurable through the BIOS, but no luck there either. I have another computer. Though it boasts a slightly different hardware configuration, both software and BIOS configurations are identical. That is, both machines are running Windows ME and tweaked the same. Odd thing is that SoftICE is functional on my alternate PC. It loads SoftICE and boots into the OS without issue. So, I feel like I'm all out of options. Though I can do my work on the second box, it would be convenient to get the other working with SoftICE. Oh well.


Bug??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Bug??
PDA

View Full Version : Bug??

AlpHakK
04-18-2002, 05:11 AM
I downloaded a programm called Application Warp 3.1,the software's help says it can be used for 30 free days unless you register it,so....I made a keygen for it:)
During crashing the software I found that it had Anti-softice code,but the code didn't stand in my way.I used a registration code I got to register it,it seemed that I was lucky,a message from Application Warp 3.1 told me that I was registered and let me restart it,I followed the message....the problem appeared:(.

When I restarted this software,the about window in it showed
"UNREGISTERD",is that my fault? Who can tell me why??

PS:When I changed the system time,the software tells me I still had 30 days left:(, is it a BUG??:(

keygen below:
Lbolt99
04-18-2002, 06:16 AM
Maybe additional checks on keyfile when program starts up? ;)
AlpHakK
04-18-2002, 06:43 AM
Hello,Lbolt99:

I have installed it to a computer with no ice and anyother debugers,but the problem remained,so I think it's a bug...:(
Kayaker
04-18-2002, 04:00 PM
Hi

Someone brought to my attention that there was a shareware target here with an uploaded keygen for it. (Thank you for that, I must be slipping ;-)

We just cannot have that here or all hell will break loose again with the Crackware watchdogs and we'll be in danger of losing this precious site. Sooo, I deleted the keygen. Keygens, cracks or serials for shareware or commercial applications are not allowed AT ALL, no exceptions.

You'll need to find another way to describe your reversing problem. If there are any other threads that someone finds with questionable material of this sort (let's use some common sense here), then by all means report it to a moderator.

Regards,
Kayaker
AlpHakK
04-19-2002, 03:54 AM
Hello Kayaker:

I am so sorry that I have uploaded a shareware's keygen,but I just only want anyone to help me on the problem I have found...,
to decrease their works,I made a keygen...
Just believe in me...:(

And...can you help me?

Regards,
AlpHakK
Kayaker
04-19-2002, 04:10 AM
Not a problem AlpHakK, just the rules we gotta follow to try to keep this site from being closed down.

Re your problem, it *does* sound like there's another check somewhere. Filemon or Regmon should give some indication if something else is being read. Run an API monitor on it and see what calls are being made that might indicate a secondary check. The initial reg routine you found might be bogus. Or it might be real but it's actually a crippled demo you have and the "real" registration never occurs. Follow what happens *after* what you think is the successful reg routine, there may be another check on something that's necessary. Dunno.

Kayaker


Together v6.0 -- FlexLM protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Together v6.0 -- FlexLM protection
PDA

View Full Version : Together v6.0 -- FlexLM protection

bad2
04-18-2002, 06:30 AM
just like the together V5.0, I decompile the zaq.class and find:

public static int ag = 0x17deeaab;
public static int ah = 0xb4c8d384;
public static int ai = 0xa2a1a978;
public static int aj = 0x1080480;
public static int ak = 0x5d5e5687;
public static int al = 0xfc9841d8;
public static int am = 0xc07286a2;
public static int an = 0xa0424122;
public static String ao = "uphfuifs";

ak = ~ak;
al++;
am ^= ai;
an |= aj;

then i get the keys.

but when i use the keys that i got to gen a license, it does not work. :confused:

Can anyone help.
Actlon
04-19-2002, 08:48 PM
If Together 6.0 is anything like 5.0, the easiest solution is to take the licence class (zah.class in 5.0) & make all the functions return 0 (the 'good' value)...it has several advantages...together starts faster for one. If you're lucky there's a Jar or Zip called misclib that contains the original FlexLM files...which have meaningful names in them.
bad2
04-23-2002, 09:07 AM
Thanks, but after i patched the checkout funtion it still does not work.
It seems that the program ever not run to the flexlm checkout point before it fails check license.:confused:
Actlon
04-23-2002, 06:21 PM
Having checked the code I wrote, I've found there are some 'cavets':

btw. did you find the original FlexLM classes in the together package somewhere ? you'll probably need these to figure out the functions in the obsfuticated classes.

In license.class (=zah.class for v5) there is a function named 'ok' returning a boolean...evidentally thats got to return 'true'...in my copy the fn 'ok' got obsfuticated to 'b' returning boolean & had no parameters.

There are also some methods returning Strings...you can probably figure out appropritate strings from the disassemblies

Good Luck

PS Could you ZIP & attach a copy of the original FlexLM files for Together 6.0 ? cheers !

PPS I think probably what happens when the class is inited is something like this:

licence lic = new license(1,2,...,n);
if( ! lic.ok() ) {
// license didn't init properly, so do some kind of error exit here
}
bad2
04-24-2002, 05:31 AM
I also patched the ok function, but it still not work. does anything I do wrong? :confused:

The original class file and the one I patched is here.
Actlon
04-24-2002, 08:00 PM
Okay, I probably wasn't very clear in what I said :(

The stuff in misclib does nothing as far as I know (I'm not even sure why they supply it).

I didn't mean that you need to patch the license.class file in misclib. What you need to do is locate the equivelent class file in the main package (still 'together.jar' I assume). The easiest way to do this is to unpack the jar file & then search for various strings.

The FlexLM files are actual in the main package but renamed & their members are also renamed. Fortunatelly the literal strings in the files don't change from the FlexLM files supplied in misclib. Looking through the license.class file you attached I can find the strings "JavaDisplay", "JavaUser" and "JavaHost".

With the unpacked files search through them for the strings...with any luck they will be present in only one file. If they are more than 1 files, you will need to decompile them. The correct class will be the one that has exactly the same numbers of variables with the same types AND the same numbers of methods with the same prototypes.

The correct FlexLM files shouldn't reference any of the com.togethersoft.* packages.

You should be able to figure out which methods in the class you find correspond to the mehods in the license.class file by the prototypes and because with most decompilers they will decompile into the same positions in the decompiled source files.

Basically all you need to do is gut the code of the class & fix the return values to suitable okay values (in terms of FlexLM, 0 usually indicates success, anything else is an error value. As I noted before 'ok' should return true & some of the functions should return a String [eg getUserName, getHostName] + some of the String returning fuctions should return null [eg warning].

Recompile the relevent files & replace the class files, then jar everything back up into a new version of together.jar and [with luck] bob's your uncle!

Hope that clears things up a bit & helps :)
bad2
04-25-2002, 04:20 PM
I searched the upacked together.jar files, and can't find the file that you mentioned. but I saw the zad.class that contain's the error message. so i decompiled it and find something like

filename endsWith(".tg")
and exists:
license.edition
license.id
license.expiration
license.hostid
license.numofinstances

so it may not direct use flexlm licensing system.
Actlon
04-26-2002, 12:53 AM
Looks like they've changed the system slightly...I've eventually d'l ed the installation...only I'm having trouble b/c it won't install properly b/c it can't find jvm.dll - presumably the MS Java VM ? don't really want to download the version with VM b/c I've only got a 56k modem & it's slow...

However back to the story, I've been able to extract the archives & so I've had a quick look:

About five classes import flexlm.license, of which 2 are sub-classes of another one.

zaq.class contains references to flexlm.class and in places it checks stuff out and checks it back in at other places. It's interesting that they are now referencing the FlexLM classes directly rather than copies. The next thing we need to do is establish if it's using the FlexLM files in MiscLib

Oh yeah - another thing - I just remembered that Together 5.0 does it's own check to establish if a license file is on the system in the correct place before letting FlexLM have a look - the file can be blank, it doesn't matter. It may be that the file is called *.tg ? usually FlexLM schemes have files with names like license.dat or *.lic. I think that perhaps the license file name is specified in a config file somewhere ?

I'll have a better look tomorrow when I'm less tired
Actlon
04-26-2002, 07:05 PM
Okay - I figured how to hack the installer so that it found Java & installed.

Hunted arround a bit in the code & eventually figured out a solution...which is suprisingly easy.

Here's how I found it - edited some what to remove many of the false steps I took !

Had a look at zad.class b/c of many licensing error messages being there. I found a method that examined a property called "license.edition" - sounded interesting. Discovered that the class that set it (zaf.class) set it to a default value of "whiteboard"...& the querying method checked the string several times for "whiteboard" and at times was making bad decisions based on this. So I hex hacked the zaf.class so that it returned "blackboard" instead. This - when put into together.jar - allowed Together to run past the splash screen - but there were a lot of errors - things didn't turn up, several exceptions (that were handled) projects didn't load properly and there were 'feature not present' errors. So I cast arround a bit & then noticed an array of strings in zaq.class that had a seemingly random string then a comprehendable string in a repeated patern - of which "whiteboard" was one. I then tried changing "whiteboard" in zaf.class to "enterprise" because they were the same length - same results as "blackboard" - strange. Cast around a bit more and I found that there was a class referenced in zad.class called zdg6.class that contained strings including the various levels of installation - but not including "enterprise" - and it seemed to identify the privalages of each installation level. Out of these levels I selected "controlcenter" and put it into the zaf.class file. When I ran Together it ran perfectly - and suprisingly it doesn't seem to do any other licensing checks - which I can't explaing, but it does seem a bit lame. Oh, and everything seems to work.

To hex patch java strings in zaf.class you need to find the string in the file (it's very short ~500bytes). The byte before it gives the length of the string (for whiteboard, length = 0xA) followed by the ascii chars in the string. To patch it to "controlcenter" (length 0xD), you need to change this byte to 0xD and _insert_ an extra 3 bytes into the file at the point of the string, set the whole string to read "controlcenter", put it back into the together.jar file. Together should run perfectly now as a "ControlCenter" version which seems to be the most powerful version avalible commersially. As you will see if you look, there are several versions avalible - including a version that is not sold.

Hope that helps a bit.


Selftest for Crackers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Selftest for Crackers
PDA

View Full Version : Selftest for Crackers

Kayaker
04-18-2002, 07:32 AM
Hi All,

Man, it's so quiet in here lately you can hear the crickets! This is not cool...

Until something better comes up to cause a bit of discussion, I found this old crackme with 8 levels of challenge - and NO solutions. The harder levels should satisfy those who think they're pretty leeto, and I'm *hoping* the easier levels will actually generate some cries for help from the complete wet-behind-the-ears newbies who are taking their first steps in reversing.

Newcomers are always welcome, and this is the place to work on projects together, to learn and to ask questions without embarrassment or fear of ridicule, there are always plenty of people willing to help others here.

The crackme (168Kb) was written in Delphi, so experience can be gained in using DaFixer's DeDe Delphi disassembler (http://www.balbaro.com).

Also, another most favorite Delphi reversing tool of mine that might prove useful is D-Peeper, which will give you class information on the controls, which you can cross reference to the information from DeDe (http://batry.hypermart.net/D_Peeper.htm).
(Link seems slow, search for alternate d/l site)

Hopefully we can come up with 8 descriptive solutions to each challenge level (well, 7 really, the 8th is deemed impossible to solve), and finally lay this old crackme to rest ;)

Good Luck.

Cheers,
Kayaker
CoDe_InSiDe
04-18-2002, 08:09 AM
Hi Kayaker,

Hehe, it's indeed *very* quiet here ;)

Maybe i should finally finish my CrackMe "Re-Move 2 - The Sequel" and then post it here as a project? :D
Just an idea.
First let's see how this project goes... ;)

Cya...

CoDe_InSiDe
crUsAdEr
04-18-2002, 02:37 PM
Hi,

Did not see this at first cos of Ryan's post.. i tot there wasnt anything new in this forum and did not feel like reading more abt CodeLock crap... so yeah just drop a note to say i am working on this... and bring this thread on top so everyone can notice and join in...

Yep... me on Easy level, wondering if there is a way beside bruteforcing which aint fun....

cheers,
Hoof Arted
04-19-2002, 08:42 PM
It has been a while since I have posted messages here. I think that the RCE Academy is really taking off. There are many members and the challenges are very good.

I am not the experienced and the nice thing about the academy is that your progress is measured on some sort of chart. In this case, by score. Anyway, I am always keen to look at new crackmes.

Thanks

Hoof
crUsAdEr
04-24-2002, 02:50 AM
Arghh....

Is anyone trying this crackme? with Dede finding the serial routine is nothing... this one is really abt crypto and such...

I am still stuck at easy level! Just wondering if the Hash can be reveresed? Or do i really have to bruteforce this?

Thanx for some helps and pointers...
Kayaker
04-25-2002, 05:01 AM
Ouch! This one is hurting my brain...

The routine is apparent enough (crackme #3), but I'm not sure how you'd reverse it to find a valid s/n. The way I see it there are 2 loops. The outer one is called 10h times and doesn't do anything other than repeating the inner loop 10h times. The inner one is called the same number of times as there are characters in the s/n.

The inner one has 2 routines (and 2 checks), the 1st takes each character of your s/n and adds to it the position of the character, then summates them all and stores them in ESI. This is called 10h times. The final value of ESI is compared in
43B3FA CMP ESI,00003810

So if your s/n is '123' you get:
(Sigma [char + position]) * 10h
31h + 1 = 32h
32h + 2 = 34h
33h + 3 = 36h
-------------
ESI = 9C0h

I actually fluked into getting the right value for ESI (3810h) by using the password 'kayakeru'. The problem is this doesn't match the proper value of EBX in
43B402 CMP EBX,402A4FE7

You can see in the code below that the cumulative value of EBX is dependant on the current summation of ESI, an IDIV statement with the current position of the character being processed (in EDI), and the value of the remainder, if any, in EDX. This is the tricky part!

Plus, the EBX register can overflow in the line
43B3E3 ADD EBX,EBX
and actually reduce in value, making it even harder to follow the summation.

LOOP 1: ; n = 10h

LOOP 2: ; get s/n - called n = number of characters in s/n times

43B3CF CALL 0041AED4
43B3D4 MOV EAX,[EBP-10] ; s/n
43B3D7 MOVZX EAX,BYTE PTR [EDI+EAX-01] ; eax = character
43B3DC LEA EDX,[ESI+EDI] ; edi = position of character
43B3DF ADD EAX,EDX ; edx = previous summation
43B3E1 MOV ESI,EAX

; Above part of the loop takes each character in hex
; and adds to it its position in the s/n, summates
; with previous value and stores in ESI.

43B3E3 ADD EBX,EBX
43B3E5 XOR EBX,ESI
43B3E7 MOV EAX,ESI
43B3E9 CDQ
43B3EA IDIV EDI
43B3EC INC EDX
43B3ED ADD EBX,EDX
43B3EF INC EDI
43B3F0 DEC DWORD PTR [EBP-0C]
43B3F3 JNZ 0043B3C3 ; repeat # characters times
; JUMP TO LOOP 2

43B3F5 DEC DWORD PTR [EBP-08]
43B3F8 JNZ 0043B39E ; repeat 10h times
; JUMP TO LOOP 1

43B3FA CMP ESI,00003810 ; first check
43B400 JNZ 0043B40A
43B402 CMP EBX,402A4FE7 ; second check
43B408 JZ 0043B424

No solutions beyond this, just an analysis and a hope someone will see the light!

Cryptoconfused,

Kayaker
crUsAdEr
04-25-2002, 01:19 PM
Yep Kayaker,

I am stuck at the same exact position!!!!

We need some crypto experienced reverser here!! :<
crUsAdEr
05-07-2002, 02:04 PM
No crypto guru wanna help on this ???

At first glance it seems reversible but the more i went into this, the more ominous it looks!!! Maybe it is not really reversible... ???
Clandestiny
05-07-2002, 10:48 PM
Originally posted by crUsAdEr
No crypto guru wanna help on this ???

At first glance it seems reversible but the more i went into this, the more ominous it looks!!! Maybe it is not really reversible... ???
Hello mate :)

Ominous, heh, heh, I know what you mean ;) I had a look at it too and have yet to devise a solution. It does *appear* reversible... I don't know much about crypto, but I think most "irreversible" algorithms use some kind of randomization functions. There is no randomization here and the arithmetic is simple addition, logical xor, and division. Surely it must be reversible (I can hope ;)) One thing that makes this difficult is the fact that its more of a "set theory" problem. I'm almost certain you'll never retrieve a *specific* key from that hash value... Rather there will be a set of keys that satisfies the 2 conditions / compares. I've tried a couple of approaches, but my math background does not include any set theory / crypto, so I'm pretty lost ;)

Would love for the input of a guru... I'm very curious if this is as reversible as my instinct tells me :D

Cheers,
Clandestiny
GoZ
05-10-2002, 11:37 PM
I knew I've seen it somewhere so i did some research...

http://archive.yates2k.net/E_bliss/sols/selftest-lu48.zip

Hope I didn't spoil your fun.

/GoZ
Clandestiny
05-11-2002, 12:30 AM
Originally posted by GoZ
I knew I've seen it somewhere so i did some research...

http://archive.yates2k.net/E_bliss/sols/selftest-lu48.zip

Hope I didn't spoil your fun.

/GoZ

GoZ:
Nope, you didn't spoil my fun. I've played for a while with that algorithm for part 3 and finally concluded that it is irreversible... "Easy" my a**! LOL. Patching it is a joke, but actually trying to reverse that sucker is not a joy ;) Thanks for putting my mind to rest on this one... I guess brute force is the only way after all.

Kayaker:
LOL, I got a little distracted on this one in case you're wondering where that updated vxd is ;) Putting up exception handlers and error checking is booring me to death ;) Now that GoZ has put my mind to rest from this little distraction, I've got no excuse but to get back to work :D

Cheers,
Clandestiny
crUsAdEr
05-13-2002, 10:36 AM
Yo,

Geez, i guess bruteforcing is the only way out... :<... boring crypto stuff if it is just bruteforcing.... Kayaker, guess this project is over and done with heh :>...

Yeah, i had this nagging feeling that it is reversible somehow still but then i am way too inexperienced to tell and i shant provide Clandestiny an excuse to stop him from moving his lazy bum and get some vxd done :>>...

Thanx Goz, for sharing... maybe i should start trying bruteforcing approach instead of trying to avoid it all the time....

regards,
crUsAdEr
Sphinx
05-20-2002, 03:02 PM
hi all,

yes i`ve not been here for a while but i`m back had to register again, dunno why.

i started the self test and did the first two crackmes, not to hard.
but the easy one with the password and hash algo is little bit tricky. I don`t see a way to reverse it yet.
Kayaker posted the algo. but finding that wasn`t hard program has nice structure :). understanding what is happening is not hard either but to reverse start with esi 3810h and ebx.. and then go back to password is.

making esi 3810 is not so hard cuz you can take hex value of char *10h+10h. this is value of char in algo but for each extra char in password you have to add another 10h.

getting a lot of combo`s to get 3810h but the problem is the math that produces the ebx value, don`t have a short cut yet.
so brute forcing it

l8er Sphinx
mike
05-21-2002, 07:36 PM
Hi, all! I was gone for a week and missed the request for crypto folks to look at this. I went to download the program, but the site is down.

Anyway, from what I got out of the code snippet Kayaker posted, getting the ESI value is easy.

Does anyone remember the story about Gauss as a kid? His teacher wanted to give the class some busy work and told them to add up all the numbers from 1 to 100. Gauss noticed that 1 + 100 = 2 + 99 = 3 + 98 = ... = 101, and that paired up like this, there would be 50 terms, so the answer was 50*101 = 5050. His teacher was annoyed that he solved the problem so quickly.

Anyway, here, we're also adding up the numbers from 1 to n, the length of the serial. So we have n*(n+1)/2.

We're also adding up the ASCII values of the characters in the serial. Printable characters (excluding space) are in the range 33-126, so we have another term 33*n.

Now we have n numbers between 0 and 93 to deal with. The minimum value for this term is 0 and the max is 93*n.

All in all, we have n*(n+1)/2 + 33*n + (a number between 0 and 93*n).

We can solve for the longest and shortest serial number possible. The sum is repeated 0x10 times and is checked against 0x3810, so we have to have the serial number sum once to 0x381.

0x381 = 897 = n*(n+1)/2 + 33*n
n=20.5, round down to 20

897 = n*(n+1)/2 + 33*n + 93*n
n=6.9, round up to 7

Ideally, we'd like a large range of passwords with a single length to sum to 897. Remember that we can get new passwords that sum up the same if we can increment some character and decrement another. The easiest way to do that is to have half of the word filled with 93's and the other half filled with 0's. So we want to find n such that

n/2*93 + n/2*0 = 897 - n*(n+1)/2 - 33*n.

Turns out that the solution to that is n=10.52, so let's pick n=11.

897 - 11*12/2 - 33*11 = 468
468 = 93*5 + 3

which means we have 5 93's, a 3, and the rest zeros. Very close to what we wanted. We add our base value of 33 to get the ascii codes and get our base password:

~~~~~$!!!!!

Here's the part that makes this elegant: we interpret the characters ! through ~ as "digits" in base 94. Now we can try every number between 0 and 94^5 - 1, express it in base 94, add the respective digits to the ! chacters, and subtract them from the ~ characters.

For example, the next few passwords look like this:

~~~~}$!!!!"
~~~~|$!!!!#
~~~~{$!!!!$
~~~~z$!!!!%
~~~~y$!!!!&
~~~~x$!!!!'

An example in base 10 would look something like this:
99999300000
99998300001
99997300002
99996300003

Since 94^5 is about 1.7 * 2^32, we expect that we can find an 11-digit serial whose EBX value is correct. Trying all 94^5 ought to take less than an hour on a decent PC.
Sphinx
05-28-2002, 08:32 AM
he mike that is a nice way to approch this problem, haven`t thought of it.

This is how i started to generate the value for esi, (put them somewhere and later calc ebx for them).

i coded the same loop that Kayaker posted, with some textfields
for password, esi value and ebx value.

I started with 1 char and looked @ esi, after a few tries you see how you get this value, just the char value * 10h, for the first char you have to add another 10h, for a password with 2 length
you cal char(value) *10h for each char in the password. but you have to add now 30h( 10h for first char and 20h for second)
ect. for longer passwords.

if you have this you can now easy calc. how long password must be with a sertain character set. i use 20h to 7eh but you can take only the numbers or letters or both.

maybe this helps
Lord8Bit
07-29-2002, 01:06 AM
Hello everybody.

I am the dude that originally released the "crackme" this thread focuses on. I am happy to see at least someone(s) had fun
attacking it. Great work everybody !

Its now so old that its no longer "fun" to withhold information.

Ask your questions .. if any :)

All source (delphi) and all passwords can now be considered public. Just ask for it ..

Passwords :

Very Very Easy : button
Very easy : LordByte in 1998, 51652596
Easy : firmware
Not Entirely Easy : shortwave
Somewhat Harder : 86257479

Hard :

1 2 3 4 5 6 7 8 9 10 11 12 13
A X X X X X
B X X X X X X
C X X X X X

Very Hard : The eagle has landed
Very Very Hard : Told you, unable to do a key for myself :-)

Anyone interested in a new 8 level crackme ?
If so, I do have some wicked ideas :)

Best regards
LordByte
Lord8Bit
07-29-2002, 01:09 AM
Sorry about the "Hard" one in previous message ..

It got formatted out of shape :-)

Real Solution is :

1 2 3 4 5 6 7 8 9 10 11 12 13
A X X X X X
B X X X X X X
C X X X X X

Best regards
LordByte
Lord8Bit
07-29-2002, 01:11 AM
Ok, it seems its the board formatting the "Hard" one,
as it was submitted correctly.

And as that level is allready solved .. who cares ? :)

LordByte
Woodmann
07-29-2002, 01:27 AM
Hi Lord 8,

Please, by all means, start a new thread with your new crackme :)

Peace, Woodmann
user14
08-02-2002, 10:02 PM
About a year ago, I cooked up an idea about a radical new registration scheme involving a locked/limited/castrated program, which would be unlocked by means of a front-end in the program to a back-end CGI script hosted on a secure server.

Originally, the program was to have protected/locked functions which could be unlocked by a seperate "unlocking program", provided that correct information was provided to the CGI registration script, through the front-end in the program. Those "protected sections" of the program would be stored as an RSA-encrypted text string in the program. If the registration info was correct, then the CGI script would then send a packet back to the program, the contents of which would be the decryption key for the protected sections of the program. The unlocking program would then go to work decrypting the text resource and patching the program.

All was going well until I realized that I was too lame a programmer to make such a scheme work.

Maybe this is too elaborate an idea for level 8 of the crackme, but I think it's an idea worth considering.


prime number properties
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > prime number properties
PDA

View Full Version : prime number properties

dion
04-18-2002, 08:27 AM
i'm interested in rsa algo which is heavily based on prime number. i don't remember when, that long ago in my school, i'm teached about calculating list of prime with aritmetic only. of course that is small number. but i'm forget that thing. do anyone know that? what i mean from this is...
is it possible to find next prime if i know the prime number N in large order, without having to test it's primality ?
Kythen
04-18-2002, 03:47 PM
Nope, so far no one has been able to find a solid pattern by which you can pick/find prime numbers. Hence the contests to find the largets prime number. You can calculate the primes less than a given number N by using an algorithm called the Sieve of Eratosthanes. Of course, that's rather impractical for numbers of the size which are used in RSA.
mike
04-18-2002, 04:02 PM
Ther are also probabalistic primality checks, i.e. after passing k checks there's a 2^(-k) probability that the number isn't prime.
dion
04-19-2002, 09:50 AM
i don't know what is called. but it looks like :
(a+b), (c+d), ...
and these numbers is primes. i think with addition only could faster rsa process. and, i'm got another idea. have anyone heard about calculator man ? how he can do that ? is it can be applied to faster rsa process ?
Kythen
04-19-2002, 04:20 PM
Ummm.... *all* numbers can be written in the form (a + b). Some primes may be of a specific form, like the Mersienne primes that are 1 less than a power of 2. I don't believe extra additions will be of much help with RSA. There are already good algorithms for fast exponentiation.

I haven't heard of calculator man, but I'm guessing it's some guy that can do basic arithmetic with large numbers in his head. All he does is use a different algorithm for the various arithmetic operators from the one everyone learns in elementary school. It's basically the same, except that you work from the most significant digit on down. Take 123 + 456 for example. First tak 100 + 400 = 500. Then 20 + 50 = 70 -> 70 + 500 = 570. Last 3 + 6 = 9 -> 570 + 9 =579. It works pretty well when you don't have nice round numbers to work with. I don't believe this would help if it's not already being done in bignum libraries, though Mike feel free to correct me on any of this :)
dion
04-20-2002, 03:54 AM
Helo Kythen & Mike
may be i must search more about this calculator man. and accidentally, still related to calculator, my genious friend ask me a little interesting question. anyone must be know about fraction. well, i almost forgot that now, i remember that when i reading elementary number theory.
might be it looks like this:

A = B / (1 + 1/C)

he ask me to show some a real number (i mean when u use calculator, u type A/B and enter and that's what i mean with, and he warn me to choose A and B so that both are odd.

and i do that, and give him the result without he know what the A and B are. what he do is he trying to find A and B with fraction method (i know that after reading the book).

after that, he ask me like this :
given any large number, say bignum type, is it can
be represented with A/B with this method ?
if can, prove it, if not, prove it too!

i can't answer that until now. and after i know little about crypto, i wonder if it can, it might be can reduce or faster bignum process.

how about that guys ?
Kythen
04-20-2002, 07:56 AM
Ahhh... what you have there are things called continued fractions. Yes they can be used to represent any real number. Finite continued fractions represent rational numbers. Infinite continued fractions converge to irrational numbers. If an infinite continued fraction is periodic, like say [2 1 2 1 2 1 ...] then it is the root of a quadratic polynomal Ax^2 + Bx + C.
You can do the basic arithmetic operations on them as well. However, the algorithms you use when working with numbers in this representation are actually matrix operations. Because of this, they work out to be a fair amount slower than arithmetic in our normal decimal/binary representation. You can get much more accurate results with continued fractions though.
They are useful in crypto to a certain extent. There is a factoring algorithm that uses continued fractions, but it is limited to numbers of about 50 digits max.

Hope that clears things up a bit!
mike
04-20-2002, 06:49 PM
Continued fractions actually mimic the GCD algorithm. In GCD, you take two numbers, one modulo the other. GCD throws away the number of multiples and only keeps the remainder; those multiples are the terms in the continued fraction.

For example, GCD(6,9) is calculated like this:

6 = 6 + 9*0
swap 6,9
9 = 3 + 6*1
swap 3,6
6 = 0 + 3*2
^ ^ GCD

So GCD(6,9)=3

We can take the last column and get the continued fraction
[ 0 1 2 ] = 0 + 1/( 1 + 1/2) = 0 + 1/ (3/2) = 2/3 = 6/9

That should give you a hint as to why a terminating CF is rational. If you can't figure it out, check out the mathworld page on CF's.
dion
04-22-2002, 03:28 AM
yep! u both right!
looks like i've lot of wrong things here. about the fraction, after revisited it again, i found that thing referenced in Knuth(81). it's named finite continued fraction. that's exactly what i want to ask. but after do some calc, i found prime is not practical to be represented in fraction form :(. and that's all what i wanna do. wondering if it practical...

but, i'm still seeking how to speed rsa process more. yep! i see something in CryptoBytes January 2002 from RSA. there's a proposed 3 formulas. among them which interested me is named Multi-Factor RSA with form N = pqr or N = (p^2)q. i remember there's one who ask how it can be if N = pqr in this forum. but no answer regarding to this. may be the topic at the time is different. and to repeat it, could anyone tell me how this form can be implemented ? it's not i'm lazy to read that, but just can't understand it. could it be explained in rather simple so me newb can eat it ?

oh, about calculator man. after searching, i found it named mental arithmatica. do u guys know more about it ? it somehow related to abacus.
mike
04-22-2002, 02:13 PM
Works the same way as RSA but n=pqr, phi(n)=(p-1)(q-1)(r-1), d=e^-1 mod phi(n).
dion
04-23-2002, 09:54 AM
ho yeah...
seems simple, thanks Mike and Kythen. this thread is somehow roaming and i'm feel really very stupid here. but, anyway thanks guys, i think i'd learn more and more like ur ban Kythen.
Cya


protectionist idea
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > protectionist idea
PDA

View Full Version : protectionist idea

mike
04-18-2002, 06:13 PM
http://b.webring.com/navcgi?ring=esolang;list

Use an interpreter and one of these languages. Consider unlambda--only three core intructions, and two for I/O. This, for example, is an Unlambda program that calculates and prints the Fibonacci numbers (as lines of asterisks)

```s``s``sii`ki`k.*``s``s`ks``s`k`s`ks``s``s`ks``s`k`s`kr``s`k`sikk`k``s`ksk

Minimalist languages (obviously) are extraordinarily difficult to understand. Feel free to remove all debugging tricks, etc., because no one will *ever* understand this code enough to patch it. Use it for routines that are necessary but that don't have to execute quickly. Use huffmann coding to compress it tremendously and reduce readability even more.

Writing programs in Unlambda is very easy; function and variable definition is done via macros. Your source can look a lot like scheme or lisp. But when it's "compiled"... abandon all hope ye who enter here!
nikolatesla20
04-18-2002, 07:08 PM
The interpreter will still execute asm..

Actually, I do worry about this somewhat because with the speed of today's computers, you could do things such as this without too much penalty.

-nt20
mike
04-18-2002, 07:25 PM
The interpreter will still execute asm..
Of course. But what are you going to do? Patch the interpreter? This is most useful when you don't want someone to reverse engineer something rather than prevent them from copying.

It would make it next to impossible to keygen, for instance. (RSA can do that, too)

It would protect something like a proprietary neural net whose weights you don't want revealed.

You could implement your symmetric decryption code here and not worry about revealing the key. (I'm not sure why you'd need to do this, since the whole point of public key crypto is that you don't have to worry about revealing the key.)

I wonder if you can prove anything about the difficulty of writing an unlambda decompiler...
Maldoror
04-19-2002, 09:59 AM
Hi Mike

Your idea for using minimalist languages to obfuscate programs is very interesting.
You can find similar idea here:
http://www.woodmann.net/fravia/new_anor.htm
I believe that obfuscation is one of the most powerfull ways of software protection.
Somebody else? ;)

Greetings!
Maldoror
nikolatesla20
04-19-2002, 10:10 AM
While on some levels I agree with you, eventually the whole thing kinda has that rotting smell to it.

This is the old syndrome of what I have heard deemed "security through obscurity". In fact, if you think about it, almost all "security" features nowadays consist of this technique, especially in the software market. For example, when AsProtect first started making its rounds, one of it's "strengths" no doubt was how it mucks the import table on you. SO now here you have a program that is "protecting" your software, thru the glorious method of hoping no one knows what it is doing. In fact in my opinion this is a very lame technique. Of course along came some people that knew how to use a debugger and understood the PE file format, and figured out what it was doing in that area, and took it down for the count.

:the weakness is in the outside world:

Unless you come up with your own propietary interpreter, there will always exist documentation on how the interpreter works, and therefore the *racker is 60 to 75% closer to his goal. That is why commercial protection in my opinion becomes easier, you have a trial to follow at least.

I was running a web server at one time and I didn't have a firewall, etc. A guy once asked me why not and I told him that no one knew the IP address, and even if they did, they wouldn't know what the server was, or what the password was to get in. So he mentioned to me "security through obscurity, eh?". Of course yes that was what I was hoping to do. But as you think about it, is that really "security" ? NO, it's just a matter of time. The only reason you can get away with it for a while is because the information is not public. I don't consider a security system simply based on witholding information as very secure. (although there are many today). For example, having a voice or fingerprint scanner at a bank to allow you into the vault would be more TRUE security than having a code key pad with a password.

The best protection you CAN have in my opinion is the encrypted code fragment, such as ASProtect now allows you to do. This is still a method of "obscurity", in that you would need to know the correct "key" to decrypt the code, but it is not some lame attempt to simply mess with the O.S. and basically pretend that you know more about file formats than anyone. This is actually REAL security. However, no matter what you write, once it gets on the machine, it will be executing intel opcode, and thus can be reversed, since that opcode is well documented. I do not believe that it would be long for someone to watch what the interpreter is doing and pretty much figure out its operation. The whole history of compilers and interpreters is very commonplace and most new ones no doubt use the same techniques (for instance, LEXX and YACC). Once you know the syntax, the code is at your feet.

But I do agree that initially it would make things more difficult, and basically your true defense lies in teh *racker's boredom !
:p :) :p

PS: Geez, Ulambda, Mouse, reMouse; who has time to write all this swill?....a program you can't read after you've written it isn't worth much..

-nt20
mike
04-19-2002, 07:38 PM
I know that obscuring code usually gets you nowhere. I've reversed enough obscured code to know how futile it is (I wrote almost all of AccessData's password crackers). It's just that in this case, the instruction set is particularly suited to obfuscation in a way I've never seen before.

I'd advertise that it's written in ulambda. I know that you can trace the execution, it's just that it's so mindbogglingly dense that trying to 'grok' the code (often referred to a zen around here) is virtually impossible. It might be possible to 'decompile' it by some kind of pattern matching, but I don't know how hard that is; thus the comment about proving some measure of difficulty. Writing decompilers is hard in a nice readable language like C. This could be a nightmare. Remember, there are no numbers, variables, data structures, labels, or functions with more than one variable built in to ulambda, so they'd all have to be pattern-matched from the code.

You wouldn't actually code in ulambda; you'd have a macro language that 'compiles' to ulambda. I don't think it would be very hard to write a program that translates from scheme to ulambda, for instance. The code you maintain is in scheme, much friendlier.

If the interpreted language is very high level, like VB or java, we all know how easy it is to crack. This is akin to cracking a program that has been converted to a big net of nand gates.
Kythen
04-19-2002, 08:58 PM
If you want an example, take a look at the Solar crackme in the Hall of Fame part of the crackmes.de site. It looks like it's been around for a few years now, and no solutions have been posted.

Cheers!
Kythen


Announcement: OEPFinder v0.2 Hybrid Build
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Announcement: OEPFinder v0.2 Hybrid Build
PDA

View Full Version : Announcement: OEPFinder v0.2 Hybrid Build

foxthree
04-19-2002, 09:01 PM
Hi folks:

I've released a 0.2 version of OEPFinder. I've added support for a couple of new packers (thanx to binh for contributions) and added a new Tip feature ! Check it out!!!

h**p://foxthree.cjb.net

I need to add support for Win2K and for packed DLLs. This would by my next goal.

+ve Comments/Criticisms welcome...

Signed,
-- FoxThree
crispeater
04-24-2002, 11:03 AM
That's a great little tool matey. Saves a lot of messing about with Winhex etc.

Any joy with other signatures? Or are other packer/protectors more random?
foxthree
04-24-2002, 11:16 AM
Hey:

I've collected about another 5 packers that I can add to the next release. But my *main* feature for the next release will be support for Win2K. I know a lot of people moved to Win2K.... ;)

As long as the packer's loader doesn't destroy itself after load (as I've seen one packer do) everything should be okay :)

Signed,
-- FoxThree
crispeater
04-24-2002, 12:59 PM
keep up the good work, mate ;)
Lbolt99
05-01-2002, 09:31 PM
Thanks for the good utility. I've added it to my list of "must-have" favorite utilities:

1) IceDump (the ring 0 code tracer. the best thing since sliced bread ;)

2) ReVirgin

3) LordPE

4) SuperBPM

FWIW, it worked fine in a Win98 environment, on a recent build of ASProtect. Beta of Helpjotter released Apr 4th...

Doesn't have the GetWhatWeWants, in the cluster like normal.. they're not scattered either (aspr 1.4). Not sure. SuperBPM'd the unresolved addresses that RV gave and was able to see the code used instead of the API call
Kayaker
05-02-2002, 09:30 AM
Cool Tool FoxThree, nice implementation. Editable signature plugin in the works? :)

Thanks too for providing the anti-antibpm cpp source ;-) I've been trying to compile the HookSTCDLL.cpp source with Borland C++ Builder and I'm having a weird linker problem. It compiles without error and I can load the dll from ASM, but it seems to give an incorrect ExportAddressTable RVA for the _ApiHookChain exported function. When I GetProcAddress on this function it doesn't give me a valid address for the function start, pointing to the .data section instead of a proc in the .text section.

This is the first time I've tried to compile APIHooks and I may have a linker setting wrong. There's an example that matches the external declaration you used, in Ah56\Examples\C-ApiWorks\C\CapConsole. You're supposed to use __EXPORT and deffile in order to export ApiHookChain, GetApiHookChain and other functions instead of __declspec(dllexport).

Basically I'm just compiling your code with the default dll linker options. There's probably something I'm missing because my C experience is limited, but I just can't figure out what it is. I haven't tried the command line BCC compiler, just hoping to get it working from C++ Builder. Just wondering if you had an idea on how to compile it properly. I'd like to add the code to an existing C++ module as breakpoint protection (and maybe as a skeleton for other API hooking ;-)

Cheers,
Kayaker
foxthree
05-02-2002, 09:46 AM
Hi Kayaker:

Thanks for your comments. Indeed, many times I've seen you post answers to my questions as though you'd read what I was having in my mind. (Both for the ReadProcessMemory and some other question that I'd posted a while back... I forget ;)). For this, I'm thankful to you.

As for the BCC compilation, hmmm my experience in BCC is extremely small (if not none :(). I've compiled and tested under Win98SE with VC++ 6.0 with ApiHooks 5.6 from elicz.cjb.net.

If you don't mind, can you try with these settings? I think ApiHooks has a separate set of libs for BCC compiler. I'm sure you're using this correctly already but just wondering...

Thanks,

Signed,
-- FoxThree
Kayaker
05-02-2002, 10:10 AM
Hi FoxThree

I think it's really cool that you and some others are creating new tools and developing and offering them here. It allows us all to study them and have new ideas to think and learn about. Keep it up man! ;-)

Just my luck I don't have VC++. I did include the recommended bApiHooks.lib for Borland compilers, but obviously still got something wrong. Guess it's back to the drawing board. Maybe someone with Borland C++ Builder might give it a try. I suppose RTFM wouldn't hurt either ;p

Kayaker
crUsAdEr
05-02-2002, 11:21 AM
Hi Kayaker,

I think Laptonic has used APIHook by ElicZ in his CD-Cops unpacker (written in win32asm)... he did upload the source here... maybe you can consult his source code and if Laptonic is still around, he can probably comment on how he did it.

:o Fox3, me still waiting to a y2k compatible version of your OEP finder :>>
LaptoniC
05-02-2002, 01:14 PM
Hi, I havent tried AH library on languages other than MASM.However new AH libray wants hookname structures to be ApiHookChain.There are a lot of examples in AH38 pacakge I guess.However I dont remember any example written in BC.Hope you can make it work.It works very great.
foxthree
05-02-2002, 03:18 PM
Hi crUsAdEr:

Bah, my win2K install died on me.... and I was close to getting things fixed. Guess, you'll have to wait until this week end.... ;)

Signed,
-- FoxThree
kugi
05-02-2002, 04:50 PM
Hi foxthree,

Great tool! Just give it your target and wait for the OEP. Now that is a cool way to go.

Regards, Kugi
crUsAdEr
05-02-2002, 05:14 PM
Fox3,

bugs reported by sPeKKel.. for armadillo itself you should scan the memory space outside its original meory area at image base.. or else the signature bytes will not be unique... (damn armadillo cant even bother to encrypt its own code :<...)

Of course this is a small problem because it only concerns unpacking Armadillo itself but just another bug report :>
foxthree
05-02-2002, 06:14 PM
Hi crUsAdEr (or is it a friend I know of ;))

Thanks for the report. Probably, I should've put it in the release notes but I did *NOT* test Arma <guilty face>. Yes, lame of me but I have a valid excuse: I did not have any latest arma protected apps... Hmmm... which reminds me can some of you PM me some ARMA (latest) targets. I'll try to unpack it manually without the help of somebody's dumper... which does not work on 98 LOL ;) (which btw, kicks ass other wise :) )

Thanks folks,

Signed,
-- FoxThree


New Tool: First_Thunk_Rebuilder 1.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New Tool: First_Thunk_Rebuilder 1.2
PDA

View Full Version : New Tool: First_Thunk_Rebuilder 1.2

nikolatesla20
04-19-2002, 09:32 PM
Ok, ok, maybe YOU won't need this tool, but *I* do, so there :)
Plus it is good learning for me anyway :) Especially how to use pointers on Memory Mapped files in Delphi ...what a pain 'til I figured it out...

Anyway the purpose of this tool is to fix your dumped file, once you have it up and running. No, it's not some magical dumpfixer. Remember, this is AFTER you have the program running :). The whole point of the utility is to make sure that BOTH your import thunk tables point to the same imported function names. ( For those of you not in the know, an EXE file has TWO arrays pointing to the import functions, well, at least it's supposed to)

The main reason I made this tool is because I like to have the option to add code to a program. To do this I use Izcelion's Code Snippet Creator. Problem is, Code Snippet Creator has a bug. When it looks for imported functions, it only sees the ones in the FirstThunk table. (Which makes sense, because it needs to know THOSE in order to hook any api's you use to the correct call).

Anyway, when you dump a file from memory and rebuilt the IAT, you usually paste it into a new section, or whatever. Meanwhile, your FirstThunk table, which got dumped from memory with it, is full of B.S. addresses from **Protect or whatever packer messed with it. Luckily for us the PE loader looks for the OriginalFirstThunk table FIRST, which is the one we rebuild, and patches the addresses in the FirstThunk table based off of it, so the program will RUN just fine.

But Code Snippet Creator won't work with only the OriginalFirstThunk table, it needs to know the correct address to call for any api's you use in your code snippet, and it can only get that from the FirstThunk table. And plus hey, don't you want your dump to be as virgin as possible?

Fire up the First_Thunk_Rebuilder and fix that FirstThunk table back to pristine OEM condition :)

Coded in 2 days with Borland Delphi 6.0.

Check it out at :

THIS LINK WAS BROKEN
PLEASE SEE BELOW FOR THE CORRECT LINK !

-nt20

ATTENTION Shareware Authors:
********* I RESERVE THE LEGAL RIGHT TO REMOVE YOUR "PROTECTION" VIRUS FROM MY COMPUTER *******
:D
nikolatesla20
04-20-2002, 06:14 AM
I'll have to reupload it on Monday.

-nt20
The_Philosopher
04-23-2002, 08:30 AM
Hi nikolatesla20

Did you reupload it?
Link is still broken.
:(

The_Philosopher
nikolatesla20
04-23-2002, 02:38 PM
For some reason my Charter account corrupts any files I upload..grrr.

So I put it on my angelfire site instead for now. Don't worry, I killed the popups for you. Here is the new link:

h**p://www.angelfire.com/nt/teklord/FirstThunk.htm

Hope someone finds it useful.

-nt20
foxthree
04-23-2002, 03:02 PM
Hi Tesla:

Seems u r obsessed with ASPR User Interface. May be looking at it far too long, my friend :D Anyway, nice work! Delphi is really cool. May be I'll rewrite one of my tools using Delphi ... someday ;)

Signed,
-- FoxThree
nikolatesla20
04-23-2002, 04:02 PM
Heh heh

I was wondering if anyone would notice the similarity :)

I thought it would be a good joke for Alexey, a tool to help against his software, that looks just like his software.

BWA hahahahahahah

-nt20
bedrock
01-08-2003, 03:20 PM
I just loaded a working dump i have made of an AsPacked target into the FirstThunk rebuilder, but it says Original First Thunks MISSING, cannot repair.

My dump runs okay, i rebuilded the IAT with ImpRec and put this in a new section. How can i get the FirstThunk table back?
nikolatesla20
01-09-2003, 02:56 PM
If its says "Original First Thunks missing" the tool cannot work, since it depends on the "Original first thunks" to do anything.

I just ran it on my dumped armadillo and it looks like there might be a problem using it on files with an IAT rebuilt with ImpREC. I'll have to look into it some more...

I can also upload the source to this program here if anyone wants it. It's Delphi 6.0.

-nt20
nikolatesla20
01-09-2003, 03:35 PM
Well, here's the reason.

On files rebuilt with ImpREC you don't need to rebuild the FirstThunk table, it appears the ImpREC does it for you already. Yay :) I checked out the FirstThunk table in my dumped armadillo, which was created with ImpREC, and the first thunks are already ok.

Revirgin does not repair the first thunks, it simply creates a new "Original First Thunk" table, which the loader uses first if it sees it.

I can add a check for this perhaps ? It would be quite complex as of my thinking right now, because I am only patching tables to match. To test for an already valid First Thunk table would be difficult. Basically, if the tool says "Original First Thunks missing" it means that your First Thunks are already probably in good order, especially if the file runs. Guess I should change the "error" message then huh :) hehe.

I also then loaded this file into Code Snippet Creator and it works just fine already, which means the FirstThunks are already good.

So I guess pretty much you only need my tool if you use Revirgin...

-nt20


Protected Flash Movie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Protected Flash Movie
PDA

View Full Version : Protected Flash Movie

Argoth
04-19-2002, 10:27 PM
Hello all.

I recently bumped in some cool PowerPuff Girls snowboard game. It was a Flash game, so I decided to look at the source of the webpage and download the .SWF file. So I thought: Ha! Now I can play this game all day long, in an offline state, like a real addict. But there seemed to be a problem, when I started the movie, all it showed was the Cartoon Network logo.

I tried to put it into a html file, with the parameters and correct ID, which can also be found in the source code of the original website. It says:

classid=clsid:D27CDB6E-AE6D-11cf-96B8-444553540000 PARAM NAME="movie" VALUE="game.swf?orbitEnhanced=0"
PARAM NAME="quality" VALUE="high"

So I added the game.swf in dreamweaver and I added the parameters and their values and I also filled out the classID.
I saved the html file and opened it. Nothing happened. It just stood blank.

But here's something strange: When I pressed the 'Play' button in DreamWeaver, the game starts, I can select my character and board, but it doesn't load any levels.

I also tried to open it in Flash, but it can't handle protected movies. Hmmm, as I am writing this, I thought: Maybe I can patch this away. I'll try this, but if you have any hints or ideas, please tell me :)

Grtz,

Argoth

PS. the game url for download is:

http://www.cartoonnetwork.com/games/ppg_snowboard/game.swf

and the game online can be found at:

http://www.cartoonnetwork.com/games/ppg_snowboard/
Woodmann
04-21-2002, 09:30 PM
Howdy,
Are you certain you really saved it?

Maybe your browser is just using a cached
version that it saved when you were at the site.
Saving the .SWF file is nothing more then saving
a link to your cache.

Because it's server side dominant, the code is executed
without fully loading it on the webpage.

I hope this makes some kind of sense.

Peace, Woodmann
mambox
04-22-2002, 05:04 PM
just load the game..when ok,look for .swf in your windows.teporary files with a name like game[1].swf
size is:695.764,copy it to your devoted dir and create a game.html contain:

<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=4,0,2,0" width="550" height="400">
<param name=movie value="game.swf">
<param name=quality value=high>
<embed src="movie.swf" quality=high pluginspage="http://www.macromedia.com/shockwave/download/index.cgi?P1_Prod_Version=ShockwaveFlash" type="application/x-shockwave-flash" width="550" height="400">
</embed>

noting amazing,a generic page who launch swf..nothing protected..enjoy as long you want :)
Woodmann
04-22-2002, 10:13 PM
Howdy,
I shouldnt shoot my mouth off without doing my research:eek:

The swf file is protected and can be made to be fully functional.
You will need to mess around with a hex editor to change some settings. Don't ask me because I don't remember which ones.
(really, I don't)

I still am not 100% sure that when you save a protected swf it is in fact the complete file. Most people make a downloadable package if they want you to have the complete game.
I just can't see how the game.swf can have all the info crammed
into such a small file.

And don't bother with any deflash type util.
They don't work very well.

Peace, Woodmann
evaluator
04-24-2002, 06:49 PM
this flash needs to be online.
At each start of game it connects with server
for "configuration" file. Below is capture from
network card. Tool: "IRIS The NuTWORK Traffuk annihilator!"

GET /games/ppg_snowboard/maps/bunnySlope/bunnySlope_3.txt HTTP/1.0

HTTP/1.1 200 OK
Server: Netscape-Enterprise/4.1
Content-type: text/plain
Content-length: 1250

length=19100&width=170&objectNum=48&o1t=1&o1x=-23&o1y=-61&o2t=1&o2x=144&o2y=-17&o3t=3&o3x=83&o3y=645&o4t=3&o4x=109&o4y=1249&o5t=5&o5x=116&o5y=1505&o6t=3&o6x=77&o6y=2039&o7t=4&o7x=56&o7y=2764&o8t=3&o8x=139&o8y=2918&o9t=3&o9x=134&o9y=3238&o10t=5&o10x=63&o10y=3489&o11t=3&o11x=113&o11y=3921&o12t=4&o12x=111&o12y=4189&o13t=5&o13x=101&o13y=4605&o14t=3&o14x=68&o14y=4847&o15t=3&o15x=34&o15y=5748&o16t=3&o16x=119&o16y=6136&o17t=3&o17x=47&o17y=6558&o18t=5&o18x=67&o18y=7156&o19t=4&o19x=117&o19y=7582&o20t=3&o20x=66&o20y=7958&o21t=4&o21x=35&o21y=8551&o22t=3&o22x=126&o22y=8898&o23t=3&o23x=38&o23y=9428&o24t=3&o24x=116&o24y=9469&o25t=5&o25x=87&o25y=9981&o26t=3&o26x=73&o26y=10670&o27t=4&o27x=108&o27y=11283&o28t=4&o28x=55&o28y=11671&o29t=3&o29x=118&o29y=12029&o30t=5&o30x=118&o30y=12790&o31t=3&o31x=78&o31y=13422&o32t=3&o32x=34&o32y=14096&o33t=3&o33x=125&o33y=14602&o34t=4&o34x=23&o34y=15357&o35t=4&o35x=144&o35y=15416&o36t=3&o36x=85&o36y=15655&o37t=3&o37x=72&o37y=16473&o38t=5&o38x=77&o38y=16625&o39t=3&o39x=86&o39y=17286&o40t=3&o40x=4&o40y=17549&o41t=5&o41x=75&o41y=18238&o42t=1&o42x=-8&o42y=18613&o43t=1&o43x=141&o43y=18653&o44t=1&o44x=-1&o44y=18712&o45t=1&o45x=152&o45y=18745&o46t=1&o46x=10&o46y=18812&o47t=1&o47x=156&o47y=18840&o48t=1&o48x=99&o48y=18903
kevin
04-28-2002, 05:44 PM
Hey,

This isn't meant as protection at all.

As evaluator said it's just looking for a config file from the server.

If you want to choose

Take a look at this:
http://www.cartoonnetwork.com/games/ppg_snowboard/maps/blackDiamond/

What you need to do is download all the various maps and then replicate their directory structure on your computer.

There may be more than just maps it checks for, best thing to do is simply pop game.swf on a webserver and look at the error_log for files requested.

Good luck,

- Kevin
npanic
05-06-2002, 08:11 PM
I don't know if it's useful to u now, but i will attach an UnProtector anyway.

(i just have 2 mention that i only have tested it with movies created with Flash 4/5)
www.npanic2.subnet.dk


CrypKey sig for Ida ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > CrypKey sig for Ida ?
PDA

View Full Version : CrypKey sig for Ida ?

thurl
04-20-2002, 02:41 PM
Does anybody have a Ida Sig for CrypKey please?

Thurl


How to bypass Firewall?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to bypass Firewall?
PDA

View Full Version : How to bypass Firewall?

cah
04-20-2002, 04:06 PM
To,
All Reverse Engineers

I am unable open http://zor.org/krobar for krobar tutes, while launching this URL my ISP firewall interrupting. How to bypass firewall banner of ISP? Is any tools/utilities available to bypass firewall?

Thanks in advance.
Cah…
foxthree
04-20-2002, 04:24 PM
Hi cah:

Did you try one of those open proxies to bypass your ISP firewall? Yes, that should do the trick :)

Signed,
-- FoxThree
Woodmann
04-21-2002, 12:11 AM
Hi,
I dont know what you are using for a browser.

In IE go to tools then internet options.
use a proxy like 195.171.209.195
set the port to 8080

Another way is to input a proxy directly into
your browser address bar, or you could go to
anonymizer first then zor.org

You may have to try a few proxy's to get it to work.
Why would they have zor.org blocked anyway?

Peace, Woodmann
mike
04-21-2002, 02:57 AM
Why would they have zor.org blocked anyway?

<!-- Simple redirect provided by freeporn.at -->
peterg70
04-21-2002, 10:34 AM
If the firewall is scanning for offensive words (ie. like porn) this is probably the reason.

Just go direct to the sites
h**p://krobar.yates2k.net
or
http://203.33.134.13/indexx.html

Hope this helps
cah
04-21-2002, 02:24 PM
Thank you all for your replies.
I fixed this problem by using proxy

Cah...


icedump building
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump building
PDA

View Full Version : icedump building

LaptoniC
04-21-2002, 12:16 PM
I have tried to build icedump but it doesnt works.I read Owl's post and downloaded djgpp' make but it gives error.
What is the magic settings to build icedump again?
Here is the error messages

Command line too long.
make.exe: *** [icedump.lnk] Error -1
If I remove icedump.lnk line it gives below error

make.exe[1]: Entering directory `e:/icedump/w9x/3.22'
nasm -M -dMAKEDEP -w+orphan-labels -dWINICE_VERSION_MAJOR=3 -dWINICE_VERSION_MIN
OR=22 -i../src/inc/ -i../mp3/inc/ -i../pd/inc/ -i../../common/inc/ ../src/wiat.a
sm | sed 's/\(.*wiat:\)/wiat.o :/g' > wiat.dep
Command line too long.
make.exe[1]: *** [wiat.dep] Error -1
make.exe[1]: Leaving directory `/e:/icedump/w9x/3.22'
make.exe: *** [3.22] Error 2


Bdasmdll.dll ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Bdasmdll.dll ?
PDA

View Full Version : Bdasmdll.dll ?

_Servil_
04-21-2002, 01:36 PM
could any1 help me get the respective lib, is required by wkt debugger, unfortunatelly can't locate it anywhere, probably it's a part of some assembler distrib. but doesn't seem to have luck finding it. Kicking the right direction or a mail attachment appreciated,
TIA.
The_Philosopher
04-23-2002, 08:27 AM
Hi

Did you d/l the package from here: h**p://www.vbdebug.cjb.net/. If you do, there is no problem then, because bdasm.dll come with the installation (if i remember well).
You can mail me and i will send you 2 dll's that this debugger need.

The_Philosopher
_Servil_
04-23-2002, 07:53 PM
was there, thx
seems still something wrong with it I get the error msg on loading:

------------------------------
Compiled with VB6
Address of table 1: 4013b8
Can NOT locate the VB DLL inside this computer.

Can NOT find a ENGINE section for the DLL.
------------------------------

MSVBVM60 is present
The_Philosopher
04-23-2002, 08:48 PM
Hi

Exit or quit or disable or...any VB program that is running.

The_Philosopher
_Servil_
05-10-2002, 07:14 PM
help appreciated, that was it - god will bless you :D :D


SoftICE BackTrace Dissassembly Tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE BackTrace Dissassembly Tool
PDA

View Full Version : SoftICE BackTrace Dissassembly Tool

foxthree
04-21-2002, 04:29 PM
Hi Kayaker/Clandestiny/Others:

I came across a reference to this tool and I wanted to take a look at it. Could you please tell me where I can dl a copy of it? I search the board and found "two announcements" (one in the Newbies and other in ToT by Kayaker) but unfortunately both does not have either an URL or a dl link.

If my reading is correct, and if the tool does what I *think* it does: bye bye nags and bye bye time-trials *lol*. :D

/me have an idea, i guess ;)

Thanks,

Signed,
-- FoxThree
Kayaker
04-21-2002, 07:18 PM
Patience my friend :p

LOL, actually we've been having discussions about the future of the backtrace disassembler in recent days. I've been neglectingly lax about it since I got back from holidays and fighting waning enthusiasm, while Clandestiny has been going great guns, school work be damned, and is doing some groundbreaking work on patching interrupts within the winice backtrace routine and using asyncronously linked lists for file I/O within an ISR to allow for potentially unlimited backtrace sizes.

Needless to say, the monster has grown, evolved and mutated, and still needs a bit of taming. Despite the fact this should be a vast improvement in the usefullness of using the Softice backtrace in Win9x, Numega has *still* not been forthcoming in providing us with funding, assistance or source code! Damn them all to hell anyway ;-)

"bye bye nags and bye bye time-trials"?

Quite likely with correct usage, since it should allow the user to conveniently compare codeflow of traced regions under the conditions of expired/not expired. The hope is it will be used as much as a research tool for documenting program execution, within the limitations of the BPR function, but that will be up to the end user of course.

Guess this means my ass has been kicked to get back to work Clandestiny :), and you're now officially on the beta testing team Foxthree ;)

Cheers,
Kayaker
crUsAdEr
04-21-2002, 07:56 PM
LOL...

Hmm.. does it work on win2k, kayaker? My computer is itching for some BSOD as well :>...
Clandestiny
04-22-2002, 12:45 AM
Originally posted by Kayaker

Guess this means my ass has been kicked to get back to work Clandestiny , and you're now officially on the beta testing team Foxthree

Cheers mate :) ...Nice to have you back on the team Kayaker.

Originally posted by binh81
LOL...

Hmm.. does it work on win2k, kayaker? My computer is itching for some BSOD as well :>...

Sorry, binh81 but I have to report that win2k is not supported *yet*. If Kayaker and I still have enthusiasm and the first version is well recieved, we have plans to eventually offer win2k support. Being as the current implementation is a VxD and exploits ring 0 privlages, it would take a considerable reorganization of code to make this work on Win2k. As Kayaker mentioned, the code is actually in a state of flux right now.

If you're interested in a few of the gory implementation details that Kayaker alluded to, the winice backtrace buffer is circular and as such when the buffer becomes full, it "wraps around" back to the beginning. This can result in a loss of recorded trace information if you don't have a large enough allocated buffer size. What's more, the winice backtrace buffer is contiguous memory and the "requested" buffer size (in winice.dat) may not be able to be allocated, leaving winice to give you what it can based on the available contiguous memory on the system. I'm using interrupt hooks in winice code to intercept this "wrap around" condition and rescue the buffer "on the fly" by saving it out to disk.. (trace execution is suspended while in the ISR). Unfortunately, writing to disk is not allowed in an ISR so it becomes necessary to save the buffer in memory and request a callback event for the actual disk write. Unfortunately, winice is no longer suspended as soon as we leave the ISR and the actual disk write may not occur until some time later. To combat this, we're trying synchronize the callback with a queue of dynamically allocated linked lists that holds the saved buffer information. The callback works on writing the queue of saved buffer info out to disk and the fact that we're using linked lists (small memory chunks chained together) means we don't need a giant block of contiguous memory to save the buffer in which gives more latitude before the user runs out of memory. Even so, there is always the caveat... It is unknown weather writing to disk is slower than the execution time of the backtrace AND the time it takes to save the buffer into the linked list in the ISR. Since only a single callback can be running at a time writing the queue to disk (for synchronization reasons), it remains possible that we could allocate memory at a rate faster than we can write to disk and free it...

If this scheme works, it will actaully extend the winice bactrace buffer functionality because the user would be able to theoretically use an arbitrarily small buffer to dump unlimited size traces. Another interesting possiblity we've discussed is the potential for "real-time" buffer dumping using our int hook scheme. You see, it's possible we could rescue the buffer instruction by instruction and disassemble it on the fly rather than waiting until the trace is complete. This could potentially be useful in the cases of packed or SMCed targets where the prog overwrites some of its own address space. In these situations, not all of the addresses in the backtrace necessarily point to valid instructions because we are disassembling the dump after the trace is over and some of those aaddresses may have already been overwritten.

OK, I'm probably rambling here... It's gets very convoluted to try to explain ;) BTW, this scheme is entirely experimental right now. Preliminary results are promising, but it will take much more testing and debugging to verify any kind of stability. Likewise, this is the first VxD either myself or Kayaker have ever written, so this whole project continues to be a "learn as we go"/ "learn from our mistakes" kinda thing ;) You guys will be on our beta test list :), but it may be a few weeks since I've got final exams next week and limited time to play RCE. School work can only be damned for so long ;)

Cheers to all,
Clandestiny
foxthree
04-22-2002, 08:15 AM
Hi Kayaker/Clandestiny:

Thanks for sharing your thoughts on this and giving a "inside look" :D Ofcourse, glad to be a part of the beta test team always ... And Kayaker, you got me there when you mentioned about comparing code flows :p

Binh:

Greetz, friend.

Signed,
-- FoxThree


gcd problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > gcd problem
PDA

View Full Version : gcd problem

dion
04-22-2002, 03:37 AM
do anyone have trying SClock Plus v1.62 ?
after exploring the target, i found her steps below :
- read the keyfile in %08LX format
- do some gcd() function
- do somet'in with the remainder
- store as decoded user name
- while do some checksum
- and there's little hidden check

i arrange the gcd() function and stuck with it. is this known as a kind of crypto function ? it do 13 iteration to get the final remainder and have an initial value (that's from keyfile). i think this function must be somehow reversible, coz it used to produce the username that'll be appear in about box. if not, how do the author make the keyfile ?


Encrypted Magic Folders
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Encrypted Magic Folders
PDA

View Full Version : Encrypted Magic Folders

mike
04-22-2002, 09:18 PM
Here's a cryptanalysis of EMF for anyone that cares; you need one known plaintext to break the system:
http://home.datawest.net/staym/emf.html
radiant
04-23-2002, 12:33 AM
Nice job on EMF

But the more important question is; Since giving your wife that bracelet, (http://home.datawest.net/staym/ring.jpg) do you ever hear her mumbling "my precious" ?

radiant
mike
04-23-2002, 05:48 PM
It was for my sister. I wrote on the card "This present is broken (or rather, it never worked to begin with), which is probably a good thing..."


Need some hints for a wkcrypt target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need some hints for a wkcrypt target
PDA

View Full Version : Need some hints for a wkcrypt target

mueller5321
04-23-2002, 12:07 AM
I try to decrypt a target which is protected with wkcrypt.
WKCRYPT is a product from wibu and the target can only be
decrypted if the specific dongle is available.

It seams that the original code is not encrypted. Only on the beginn of the start the dongle is checked and the procadresses are decrypted by the cipher of the dongle.

Is there a easy way with procdump or revirgin?
I found a tutorial from snakebyte but there are to much api-calls to repair. So i hope there is a better and faster way.

Can anybody give me an hint? Or a tutorial?
Woodmann
04-23-2002, 01:10 AM
Hi,

So i hope there is a better and faster way.

There isn't. I think the thing you might be looking for is called
a "kR/-\c". It is for people who don't have the desire to learn.

Needless to say,look for a link below to crackz archive.
It is a good place to start if you want to learn.

Peace, Woodmann
mueller5321
04-23-2002, 08:50 AM
I think the thing you might be looking for is called
a "kR/-\c".

Your are wrong. I already handled Flexlm to the beginning time when NB start doning his famous work. And i need no tool like "FlExGeN".

Also i know crackZ archiv. The only listed tutorial there give some hinds about the wkopen and wkcrypt which only checks the presents of the dongle, what is really simple to patch.
(Ther is a better one from snakebyte in the net, which gives much mor information about my problem. But do not want to resolve about 100 apicalls by my own)

I have already patched a lot of different targets which use other dongle like rainbow or also hardlocks and hasps.

The thing i looking for are more deep information about.
Or do you know the detailed algorithm inside the dongle?

WKcrypt used to beginning after checking the dongle presents (Simple to patch and step offer) the wkcypt api-function to decrypt a jumptable. So without the dongle it is really difficult to find the entry.
With dongle it is no problem to get the real eip.

The problem i have at the moment is to handle the resolving of the api call adresses.
Maybe i should try to get deeper inside of the usage of your (sorry not yours tsehp's) tool (revirgin).
Woodmann
04-23-2002, 08:05 PM
Hi,
You have my apologies. Your request appeared sort of lame.

The only way I have seen this done is via the hardway,
look at all the api's and work from there.

Perhaps if you find an easier way you would write a tutorial?

Peace, Woodmann
CrackZ
04-23-2002, 11:09 PM
Hrm,

1. I don't think your description of the problem is really very clear, or at least from what I gather of it. Tools like Procdump and Revirgin really aren't going to help you if your program uses WKBCrypt2() or its variants to decrypt a jump table, I really don't know what sort of information you were expecting them to be able to collect to resolve essentially unknown references to either codeblocks or API's, it just doesn't make any sense.

Your best bet might be building a list of unreferenced areas in IDA, I've had similar situations with other implementations where the dongle data decrypts the address of an address to be jumped too (trust me, if you've got lots of these you might need a LOT of luck, but then again.....).

2. You give no details of the parameters to WKBCrypt2() either, it has as I recall a selection of algorithms to use internally, some of these encryptions (transformed internally) have been broken, whilst others remain secure, again, you need to provide more information.....

I'm not going to provide you with the information I do know about Wibu internally, but I'll suggest to you now to analyse wkwin32.dll if you are really serious about this.

Regards (awaiting further clarification, code, info's).

CrackZ.
mueller5321
04-24-2002, 11:02 AM
@woodmann. I understand. Maybe i should write my questitions more detailed and like a lamer crack request.

@crackz: The master of dongle at it self :-)
You must differ between wbkcrypt2() and wkcrypt.

wbkcrypt2 is the api-call, which is used to decrypt a area of code or data.

wkcrypt is a tool like sentinel which can be used to protect the whole program without the need to implement the api-calls at it self. It is like aspack but the api-addresses and some tables are encrypted. The decrypt algorithm is only placed inside the dongle.
Which something like AES(Snakebyte mentioned, but i can't believe) and the firm and user code is used to parameter this algorithm.
AES i can't belive because the algorithm seams to be symetric.
And additional you can use different parameter in sequence:
Para Set 1 Para Set 2
(org -------------> encrypt1 --------------> encrypt2)

Para Set 2 Para Set 1
(org -------------> encrypt1 --------------> encrypt2)

give the same result for encrypt2 but encrypt 1 is different.

the wkcrypt in the form i have seen is very simple with dongle but very hard (or simple impossible) without.

wkcrypt remove the original api-call list (this is the reason i want use revirgin).
First they checks the apperance of the dongle with the correct firm and user code like the super pros from rainbow. Till here no problem.
After this wkcrypt use wbkcrypt2() to decrypt a area of data where pointers to the original programm entry point and some other subfunctions are placed.
The the api-calls are resolved by decrypting a table.
After this the programm goes back to the code on the Program entry point and
jump indirect via the decrypted table to some more programm parts or the original programm.
It seams to be very simple because the orginal code is not crypted at all. Only the original programm entry point is encrypted.

But now there come the biggest problem.
Additional the wkcrypt code decrypt tables with the api-addresses. The Names are still present (not encrypted but the addressed are encrypted.
So it looks like a typical job of procdump.

Snakebyte use a standard assembler code module which gives back the correct addresses to the procstartadress request.
The addresses and names must be fetched via debugging (not a big thing). But there a a lot of calls which have to be resolved and so i asked if there is now easier way to do the job.

I used procdump till yet only with original scripts and write not my own. It seams i have to write one for the dump job.

The i should use revirgin to resolve the procstartadresses of the original program together with the dongle.
So i have only to jump to the original entry point and replace the procaddress table with the decrypted and the job must be done.

Can somebody give me a link to well documented tutorial for the use of procdump and revirgin? Best in german. (You see i will do the job by my own :-)

Also i nice thing would be the algorithm inside the dongle ;-)
The a general decrypter could be made.

P.S. Wibu-key write very nice information about really difficult implementations of dongle checks. Seach the web. THe are really nice to read:-)
Sab`
04-24-2002, 11:20 PM
algorithm = fealN, knuth20, permutation (in this case feal)
see wkwin32.dll like crackz said all information needed is available. .exe = decryptable without dongle. Have fun.

-Sab
mueller5321
04-26-2002, 09:59 PM
Next step reached :-)

I found a very simple and fast way to get offer the wkcrypt layer.
It is really simple.
I start the program with dongle. Then i maid a dump with procdump (you can also used an other dumper).
The dumped File isn't working. Ok but that is no problem.
I export the segment with the now decrypted table infos and import it in the original version instead of the encrypted ones (in my case 2 Segments).
Instead of the donglecheck with decrypt function i call direct the resolv-function of the api-calls and vola im inside the layer and all api-calls are resolved. Also the crypted indirect EIP is correct and i haven't to change the EIP.

Now i have to fight with the expected dongle query entries and other things but the crypted layer is beated :-))
The only bad thing is that the call are all done indirect via memory entries and so i dead code listing is not very nice to read.

Have anybody a better way than my?
Maybe i writte a procdump script which is done this automatic.
mueller5321
05-09-2002, 07:11 PM
I want to verify my methode.
Have anybody a url of the development kit for wkcrypt.

Or

A small target (maybe notepad), which can i have in 3 versions.
(original unprotected, protected with wkcrypt and a procdumped protected version)?

Thanks a lot

Max


BigNum Calculator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > BigNum Calculator
PDA

View Full Version : BigNum Calculator

radiant
04-23-2002, 11:25 AM
I found a calculator that's using the Shamus MIRCL (BigNum) library which may be useful for some folks.

Look for "MIRACL Calc" here:

h**p://www.engineering.com/community/freeapps/freeapps_calculators1.htm

radiant


Need help w/ FlexLM 8.0...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help w/ FlexLM 8.0...
PDA

View Full Version : Need help w/ FlexLM 8.0...

c0rps3
04-23-2002, 03:14 PM
Just tried to reverse the software protected with FlexLm 8.0 (as i know 8.0f or 8.0c)....

I sadly found the old tutors regarding FlexLm 7.2f reversing are not usable in my situation... I need any detailed help with comments, samples and tools.... Any help is appreciated.

Thnx in advance,
Alex AKA sm@ll c0rpse
LOUZEW
04-23-2002, 06:09 PM
Hi, Corps3

Take a look HERE (http://archive.yates2k.net/crackznew/Flexlm.htm) maybe can you find any usefull info or tools
c0rps3
04-23-2002, 06:12 PM
It won't help me because all of tuts i already tried are from these "CrackZ Reversing 4 Milennium" site.... There are no tutorials explaining how to reverse FlexLm 8.0
c0rps3
04-24-2002, 06:06 AM
Is there anybody familiar with FlexLm 8.0 protection and with ways if it's removal. I need your help and advice.... Please!
c0rps3
04-24-2002, 10:42 PM
Please.... i need ur help!!!!!!!!!
Woodmann
04-25-2002, 12:18 AM
Howdy,

Quit begging, it's painful.

Peace, Woodmann
CrackZ
04-25-2002, 01:29 AM
I presume you are referring to finding ways to recover the new ECC seeds used in the latest 7.2x and 8.0/8.1+ versions.

1. The 'connoisseurs of FLEXlm' have decided they will not publish information on these later versions since GlobeTrotter have gained far too much information from just such work in the past, we don't want to make their work too easy now do we ;-). This is also the excuse since they are probably too lazy ;-).

2. Depending a lot on your target, an older v8.0 target might still be exploitable due to the weak random number generator used in the aforementioned versions, this exploit is how some licenses have shown up in the scene fairly recently, read some of the threads on the crypto msgboard if you can't immediately think where you'll be going to look next.

3. I'll probably get flamed for revealing this flaw, but the v8.1 incarnations have definitely closed it, and now <relaying information somewhat blindly> I've been told the best hope is about 2^96, and testing the keys on x86 processors is very SLOW, so, you can probably forget it for a while ;p.

Regards

CrackZ.
CrackZ
04-25-2002, 01:31 AM
Doh,

I also forgot to add, that with the SDK's still around on the web, patching FLEXlm remains a blindingly dull and boring affair requiring no discernable skills above basic level.
Woodmann
04-25-2002, 01:37 AM
3. I'll probably get flamed for revealing this flaw, but the v8.1 incarnations have definitely closed it, and now <relaying information somewhat blindly> I've been told the best hope is about 2^96, and testing the keys on x86 processors is very SLOW, so, you can probably forget it for a while ;p.

I cant believe you gave up that information!!!!!!

Oh for the sake of humanity :P

Peace, Woodmann


Armadillo 2.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Armadillo 2.5
PDA

View Full Version : Armadillo 2.5

crUsAdEr
04-23-2002, 07:18 PM
Hi folks,

I attempted to write an unpacker for Armadillo 2.5x.. needless to say this is my first attempt at unpacker (lame way) but i wanted some practise...

Yeah, however this little project is nowhere near done and i dont have the time at the moment...

Well... i cant get the IAT rebuilding to work properly (or even to work at all)... the dumper should work on win2k.. dont know about any other OS... So here i attach my Armadillo 2.5x dumper (with asm source code), it can dump the un-encrypted text section, hopefully help you overcome the 16kb encryption tactic used by Silicon Realm... removes the four section added by Armadillo, adjust OEP to the right one.... I have tested it with a few programs but i dont have access to many programs protected by new armadillo so it might not work...

You have to do rebuild IAt with Revirgin or Imprec...

Yeah, and PLEASE comments on any errors i made as i am new in asm... curse if you want to if it crash your computer, i am sorry but i know my codes arent good yet... I will be happy to answer any question about the little prog....

cheers
Binh
crUsAdEr
04-23-2002, 07:22 PM
Damn.. I cant post attachment?
foxthree
04-23-2002, 07:30 PM
Hey Binh:

Where is the code ;) ? Just do a new post and attach it. I think it should work, provided it is not like an 80 MB exe ;)

Great work, friend. Keep it up :)

Signed,
-- FoxThree
crUsAdEr
04-23-2002, 08:16 PM
Hmm.. testing....
me8
04-23-2002, 11:12 PM
you know lenin :-)
^DAEMON^
04-24-2002, 10:29 AM
hi binh,

iam working on an unpacker too :)))

but i don't dump... i full decrypt it...
unpacker is finished about 60%

^DAEMON^
crUsAdEr
04-24-2002, 10:39 AM
Yo Daemon,

Thanx for your tE-Unlock source code, helped me quite a bit! I was thinking of decrypting as well... the algo can be more or less ripped from armadillo itself as there is no poly layer... but i wanted to learn a bit about loader and process patching.. and i realise that i dont know how to decrypt IAT yet... that is why dumping and hence i can rebuild it...

Are you working on Armadillo or something else?
Binh
^DAEMON^
04-24-2002, 10:49 AM
yeah iam working on armadillo (currently v2.51)
... the encryption is DAMN mad

the current beta has around 3400 lines of code...
but maybe i'll never release the unpacker to the public...
dunno yet

anyway good luck ;)

^DAEMON^
crUsAdEr
04-24-2002, 11:08 AM
LOL, Daemon, if you remove your anti debugging and anti tracing code maybe the code wont be 3000 lines :>>..

hee lucky i did not attempt to decrypt :>... probably way over my head...

You dont need good luck cos you are good enough i guess, so all the best for you unpacker :> (dont release the program, only your source code :>>>)

cheers,
binh
VtE
04-28-2002, 07:34 AM
Thanks a lot for your unpacker Armadillo 2.5x.

Unfortunately, I don't have any success to unpack my software. I have tested to unpack Notepad that I protected with Armadillo 2.51, but the unpacker keep running for a while, and slowing down my computer.

I have tested under Win98 and WinXP without success. Do you have any idea ?

Thanks again for your GREAT job.
crUsAdEr
04-29-2002, 11:09 AM
Hi vte,

I just checked with win98, somehow CreateProcess doesnt seem to work right there... not sure if i have the time to fix it..

I fixed the other bug so it should work on XP now...

Anyway, here is how you should manually unpack armadillo 2.5x

to find OEP, bpx on SetProcessWorkingSetSize, when armadillo breaks in sice, F12 once then trace with F10 about 1 page down..
you will see this
mov ecx, [eax+1C] ; get from "data1" section
xor ecx, [eax+18] ; calculate OEP

xor ecx, [eax+8]
add edi, ecx ; edi contains image base
call edi; ; here you will find OEP

Dont step in to the call, at call edi do a bpx writeprocessmemory, wait for sice to brake and press F12 twice, you should be at the main decrypting call... there you have a few options to force armadillo to decrypt the whole code section... the routine looks like this
push 0 ; 0 for decrypt, 1 for encrypt i think
mov ecx, [ebp+8]
push ecx ; ecx points to section to be decrypted
call Decrypt

Hope this helps.. if i ever fix the win98 bug i will upload the dumper again

Regards
VtE
04-29-2002, 10:38 PM
Thanks a lot for your GREAT informations.
Will do a testing now, and will post my result back.
CarlF
07-12-2002, 01:49 PM
I fixed the other bug so it should work on XP now...

...but where?
CarlF
07-14-2002, 02:26 PM
BTW - a thing I've been wondering about:
Where does Armadillo get it's usage info (expiry info / Fixclock info) from? I can't seem to find any reference to Registry keys by way of Regmon. The 'HKLM\Software\The Silicon Realms Toolworks\Armadillo\{...}' keys seem not to have anything really to do with this...
SilberFuchs
07-16-2002, 11:39 AM
hi

armadillo saves something in the registry and a file in the -temp-directory, where this kind of data are stored.

ciao
SilberFuchs


Wise script
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Wise script
PDA

View Full Version : Wise script

_Servil_
04-23-2002, 07:57 PM
well, I've got a WISE stub package and wise decompiler (e_wise) I got unpacked content from stub expanded to some dll's and something looking like pseudo-sript what's point of interest. What I need is to change the 'script' and inject modified back to the stub (knowing it's a stripped ZIP didn't found the zipped pattern in the stub). Can any1 help me to do this (maybe would be enough to know how2 interpret the 'script' file to be radable -- is there a tool to make easier playing with these 'scripts'?),
helpful link or something, thx in advance.
LaptoniC
04-23-2002, 10:21 PM
I dont know how to put script.bin back to orignal setup.exe.However at this site you can found information about wise script file.It is very helpfull document.
hxxp://www.tardis.ed.ac.uk/~adq


Configuring Softice for the first time
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Configuring Softice for the first time
PDA

View Full Version : Configuring Softice for the first time

wolfdogg
04-23-2002, 09:13 PM
I know there has to be a forum where the winice.dat file is explained. I just loaded si 4.05 on w/2000 and i've never used it. I have tried following many tuts, but despite uncommenting everything in my winice.dat file and trying to run the simplest of commands, I have no success. If i run Bpx Hmemcpy, I get 'Symbol not defined.' If i run TASK, i get No LDT. If i run any Breakpoint (Bpx), it's not defined. Isn't there a good tut/forum for using si the first time?
Much thanks,
jeff
:confused:
Fake51
04-24-2002, 11:50 AM
Look to Mammon's tale for some good info on configuring and using s-ice. It should be readily available at many spots (you can also just search for "Mammon tale softice" on google, that should do the trick).
Anyway, the problem you're having usually relates to the ;'s in the winice.dat, as you rightly point out. Make sure that you've uncommented the right lines (uncommenting all lines may not be the right way to do it). Specifically, the lines you want uncommented for use with bpx are the "exp=" ones. Make sure the path is right.
However, I've never come across the "No ldt" problem, and I suspect that that might point in another direction, suggesting that your copy either doesn't work under win2k or the setup may have been screwed.

Fake
foxthree
04-25-2002, 07:35 AM
Hmmm...

Also there is *NO* hmemcpy on WinNT based oses (which mean Win2K also). There is memcpy but this is not equivalent to hmemcpy. So bpx on hmemcpy will *NOT* work!! This is reserved only for 16-bit subsystem apps under WinNT based OSes I think

Signed,
-- FoxThree


how to remove cdilla completely?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to remove cdilla completely?
PDA

View Full Version : how to remove cdilla completely?

duda
04-24-2002, 03:51 AM
Have cleared Sector 32, registry entries and the cdilla vxd´s... but still can´t reinstall 3DS Max trial without prompting for authorization previous installation detected....

please don´t send me the crack....

any clues how to solve this?

TIA
Duda

Yes, Uninstalled cdilla and cleared the remaining hidden *.dat file and hidden folder, too. Have followed the tutorial of tsehp as far as i could understand it. So is it always Sector 32 of your bootdrive that has to be cleared->00 to enable a re-install?
Pyrae
04-24-2002, 05:44 AM
Did you delete *.DAT from the hidden "C_DILLA" dir in C: root, too?
crispeater
04-24-2002, 11:00 AM
Have you tried the LMS rewinder?

here :

http://gamefix.free.fr/c-dilla_lms.htm

Also wise to use an installwatcher like InCtrl, or InstallWatch. Much easier to watch the registry changes and hidden folders/files.
ThrawN
04-24-2002, 02:28 PM
Doesnt 3dmax use safecast? ignore this post if im incorrect tho.
Safecast stores information in some hd sectors that are not normaly accessable or some shit? i believe theres a tutorial on it on this very site......

ThrawN


Visual Foxpro + NetHASP anyone?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Visual Foxpro + NetHASP anyone?
PDA

View Full Version : Visual Foxpro + NetHASP anyone?

WoZX
04-24-2002, 07:48 AM
hi, i have a target built using visual foxpro, and it's protected using NetHASP with a red dongle (no access to the dongle).

i use refox to get the source code and the protection is very simple, but i'm unable to debug the foxpro 'virtual' code as it's VB like with all the DLLs.

i've tried HASP emulator and succeed on login to NetHASP but failed when calling ReadBlock, saying 'incorrect security key'.

i've tried many times changing here and there thru' the registry setting by the HASP Emu but to no avail.

debug using SoftICE didn't give much help as it's Foxpro not VB (lots of essay on VB for my reference, but not Foxpro).

can anyone help me?? comments.... reference sites.....?????

thx in advance.
CrackZ
04-24-2002, 06:47 PM
Hiya,

As far as I can remember the old HASP SDK's (and I'm pretty certain this is an old HASP because I suspect your using one of the many UCL HASP Emulator replacements) all shipped a very convenient dll for use by the developer, (haspfp32.dll), there probably isn't a need for you to be debugging the intracies of VFP (although I might be wrong about this).

Playing with the parameters in the registry isn't going to help you much, since readblock() (doh) reads blocks of memory from the dongle, and with NetHASP your looking at possibly 496 bytes worth so unless your kinda lucky or they filled it all with 0xFFFF or 0x0 you can forget it ;-).

I propose 3 options / solutions:

1. Find the API level interface (I'm almost certain it'll be a dll) and code your emulator at that level (also debug at that level). Should be easy with conventional breakpoints, if the HASP drivers work, go for bpx deviceiocontrol.

2. Pop some breakpoints in the pertinent parts of the HASP emulators your using, haspdl95.vxd for 9x, haspdos.sys for NT and trace the API parameters back from there, this may help you since you can place bpm/bpr on readblock() returns.

3. Drop me an e-mail with the target info, anything else you feel might be pertinent, I can almost certainly help you some more.

Regards

CrackZ.
WoZX
04-25-2002, 02:16 AM
Originally posted by CrackZ
Hiya,

As far as I can remember the old HASP SDK's (and I'm pretty certain this is an old HASP because I suspect your using one of the many UCL HASP Emulator replacements) all shipped a very convenient dll for use by the developer, (haspfp32.dll), there probably isn't a need for you to be debugging the intracies of VFP (although I might be wrong about this).

yes u're right, it is haspfp32.dll

Playing with the parameters in the registry isn't going to help you much, since readblock() (doh) reads blocks of memory from the dongle, and with NetHASP your looking at possibly 496 bytes worth so unless your kinda lucky or they filled it all with 0xFFFF or 0x0 you can forget it ;-).

from the source the checking is very simple, it goes something like this:
- chk if hasp is installed (func. 1), if fail shutdown proggie (i pass this)
- login to nethasp (func. 2) (i think), if fail shutdown proggie (i pass this too)
- readblock (pass this one too)
- check if return string starting from position x for length y is = '556712 JMC7621' and etc etc...
if it's the same, go on, else print "incorrect security key"

I propose 3 options / solutions:

1. Find the API level interface (I'm almost certain it'll be a dll) and code your emulator at that level (also debug at that level). Should be easy with conventional breakpoints, if the HASP drivers work, go for bpx deviceiocontrol.

i'm not good at assembler. i'm actually trying to patch the process that does the checking above, but it's foxpro and i have no idea on the opcodes generated by the compiler.

2. Pop some breakpoints in the pertinent parts of the HASP emulators your using, haspdl95.vxd for 9x, haspdos.sys for NT and trace the API parameters back from there, this may help you since you can place bpm/bpr on readblock() returns.

i'll do that, thx

3. Drop me an e-mail with the target info, anything else you feel might be pertinent, I can almost certainly help you some more.

Regards

CrackZ.
will certainly do.
btw, the target is a proprietary proggie so no way to download from the web. ZIPped size is abt 20 or 30MB.

thx a lot CrackZ.

regards,
WoZX
CrackZ
04-25-2002, 10:20 PM
As an addendum.

Since we've established it uses haspfp32.dll I can pretty much guarantee (regardless of your ASM competence) thats going to be the best place to put some emulation code. I just disassembled several copies of the DLL I have on the various HASP CD's and they are all pretty much the same, standard call _haspreg()'s.

I didn't check my e-mail before posting this, but hopefully I can still help you some more here, actually I'm just interested in the target (let the fires of hell burn my soul for that ;-) ).

Regards

CrackZ.
WoZX
04-26-2002, 09:09 AM
Originally posted by CrackZ
As an addendum.

Since we've established it uses haspfp32.dll I can pretty much guarantee (regardless of your ASM competence) thats going to be the best place to put some emulation code. I just disassembled several copies of the DLL I have on the various HASP CD's and they are all pretty much the same, standard call _haspreg()'s.

I didn't check my e-mail before posting this, but hopefully I can still help you some more here, actually I'm just interested in the target (let the fires of hell burn my soul for that ;-) ).

Regards

CrackZ.

ok, my progress so far.

1. i patched haspfp32.dll on 'hasp' call and let it return 00h on return value [ebp+1C] (the 6th parameter, just after the pass1 and pass2), which is the return status for HASP is installed and if login to netHASP is OK.

2. bpx on haspreadblock(@storage, 30) will return result to memory location @storage for 30 bytes. Patched the memory location to values/string of what the program is expecting, and it run flawlessly (^_^)

you are right CrackZ, i need emulation code or a new DLL (with the same file name and only need 2 imports 'hasp' and 'haspreadblock') that did just the above, but i'm a rookie in assembly, can you please help me with this CrackZ?

thank you very much for your guidance.

regards,
blurred


GetWindowText problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > GetWindowText problem
PDA

View Full Version : GetWindowText problem

mancini
04-25-2002, 12:21 AM
hello guys
i have used softice since some old versions and i remember getting it to work nicely wit breakpoints on GetWindowText and GetWindowTextA
however recently i had to get back to what i once abaondoned and do some work with softice again so i found (with dificulties) a version to download since i lost the cd with the old one
i found Si405w9x version
now in this one every time i try to set up a brakpoint on GetWindowText GetWindowTextA GetDlgItemteText etc it wont make the BP and it give some error code that i think it was" propriety not suported nor defined"

what could be the problem ?
me8
04-25-2002, 12:34 AM
have you modified winice.dat to mess with user32.dll ? :-)
Paul333
04-28-2002, 01:57 PM
Heres \\\2fixed\\2 winice dat..just copy&paste into yours ->

PENTIUM=ON
NMI=ON
ECHOKEYS=OFF
NOLEDS=OFF
NOPAGE=OFF
SIWVIDRANGE=ON
THREADP=ON
LOWERCASE=OFF
WDMEXPORTS=OFF
MONITOR=0

PHYSMB=32
SYM=1024
HST=256
TRA=8
MACROS=32
DRAWSIZE=2048

INIT="lines 28;set font 3;wd 6;wc 12;code on;altscr off;faults off;X;"

F1="h;"
F2="^wr;"
F3="^src;"
F4="^rs;"
F5="^x;"
F6="^ec;"
F7="^here;"
F8="^t;"
F9="^bpx;"
F10="^p;"
F11="^G @SS:ESP;"
F12="^p ret;"
SF3="^format;"
CF8="^XT;"
CF9="TRACE OFF;"
CF10="^XP;"
CF11="SHOW B;"
CF12="TRACE B;"
AF1="^wr;"
AF2="^wd;"
AF3="^wc;"
AF4="^ww;"
AF5="CLS;"
AF8="^XT R;"
AF11="^dd dataaddr->0;"
AF12="^dd dataaddr->4;"
CF1="altscr off; lines 60; wc 32; wd 8;"
CF2="^wr;^wd;^wc;"

; WINICE.DAT
; (SIW95\WINICE.DAT)
; for use with SoftICE Versions greater than 3.0 (Windows 95)
;

; *************************************************************************
; If your have MORE than 32MB of physical memory installed, change
; the PHYSMB line to the correct # of Megabytes.
; If you have LESS than 32MB you can save a bit of memory by
; specifying the correct # of Megabytes
; Example: PHYSMB=32
; *************************************************************************
; ***** Examples of sym files that can be included if you have the SDK *****
; Change the path to the appropriate drive and directory
;LOAD=c:\windows\system\user.exe
;LOAD=c:\windows\system\gdi.exe
;LOAD=c:\windows\system\krnl386.exe
;LOAD=c:\windows\system\mmsystem.dll
;LOAD=c:\windows\system\win386.exe
; ***** Examples of export symbols that can be included *****
; Change the path to the appropriate drive and directory
;EXP=c:\windows\system\vga.drv
;EXP=c:\windows\system\vga.3gr
;EXP=c:\windows\system\sound.drv
;EXP=c:\windows\system\mouse.drv
;EXP=c:\windows\system\netware.drv
;EXP=c:\windows\system\system.drv
;EXP=c:\windows\system\keyboard.drv
;EXP=c:\windows\system\toolhelp.dll
;EXP=c:\windows\system\shell.dll
;EXP=c:\windows\system\commdlg.dll
;EXP=c:\windows\system\olesvr.dll
;EXP=c:\windows\system\olecli.dll
;EXP=c:\windows\system\mmsystem.dll
;EXP=c:\windows\system\winoldap.mod
;EXP=c:\windows\progman.exe
;EXP=c:\windows\drwatson.exe
; ***** Examples of export symbols that can be included for Windows 95 *****
; Change the path to the appropriate drive and directory
EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=c:\windows\system\MSVBVM60.DLL
;EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
EXP=c:\windows\system\advapi32.dll
;EXP=c:\windows\system\shell232.dll
;EXP=c:\windows\system\comctl32.dll
;EXP=c:\windows\system\crtdll.dll
;EXP=c:\windows\system\version.dll
;EXP=c:\windows\system\netlib32.dll
;EXP=c:\windows\system\msshrui.dll
;EXP=c:\windows\system\msnet32.dll
;EXP=c:\windows\system\mspwl32.dll
;EXP=c:\windows\system\mpr.dll

<-

hope this helps:)

paul333


CRypkey Studie for Newbies Peoples
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > CRypkey Studie for Newbies Peoples
PDA

View Full Version : CRypkey Studie for Newbies Peoples

glasha
04-25-2002, 12:12 PM
This is a new thread to help a newbies people , but dont with crack request, need learn about this to understand:D
glasha
04-25-2002, 12:22 PM
Contribuit with this project ...... ea

Crypkey is a protection from kenonic software, calagary canada, is easy change a byte to make who function any aplicattion but is more correcltly learn how function, first part of my study

push dword ptr [ebx]
call kernel32!GetProcAddress
call eax Llama a la API GetVersion
test eax, 80000000 Prueba la version de Windows
jz 004E68EB win9x no salta
pop ebx
push ebx
sub ebx, 00000BC9
push ebx puntero al nombre de cryp95d.dll
add ebx, 00000B8D
call [ebx] llama a la api LoadLibrary para cargar
cryp95d.dll
//////////////////////////////////////////////////
jz 004E69C4
pop ebx
push ebx
sub ebx, 56
push ebx Puntero al nombre de cki32f.dll
add ebx, 1A
call [ebx] llamada a la API LoadLibrary para cargar cki32f.dll

/////////////////////////////////////////////////////////////////

push ebx
mov edx, ebx
sub ebx, 0000283E
mov ecx, [ebx]
sub edx, ecx
push edx
sub ebx, FFFFD890
push dword ptr [ebx]
sub ebx, 00002770
push ebx
add ebx, 000027CF
push dword ptr [ebx]
call eax ( generally Get_authorization)

/////////////////////////////////////////////////////////////////

call ecx ; llamar dentro del cki32f.dll para desencriptar el exe
pop ebx ; delta offset
mov eax, ebx
sub ebx, 0000283E ; ebx = offset en el loader con un Valor Mágico
mov ecx, [ebx] ; ecx = Valor Mágico
sub eax, ecx ; delta offset - Valor Mágico= Punto de Entrada Original
jmp eax (OEP)

//////////////////////////////////////////////////////////

push ebp
mov ebp, esp
add esp, -0C
xor eax, eax
mov [ebp-04], eax [ebp-04] = SubSubMagic = al principio 0
mov edx, [ebp+08] [ebp+08] = inicio del buffer (ve la foto abajo)
xor ecx, ecx
mov cl, [edx] cl = 1er byte del buffer (ex. En la gráfica D6)
add [ebp-04], ecx SubSubMagic = SubSubMagic + 1er byte
inc dword ptr [ebp+08] inc puntero en el buffer para el siguiente byte
shl dword ptr [ebp-04],08 cambia los 4 bytes de SubSubMagic en la izquierda de 1 byte
mov eax, [ebp+08] eax = puntero en el buffer
xor edx, edx
mov dl, [eax] dl = 2do byte del buffer
add [ebp-04], edx SubSubMagic = SubSubMagic + 2do byte
inc dword ptr [ebp+08] inc puntero en el buffer para el siguiente byte
shl dword ptr [ebp-04],08 cambia los 4 byte de SubSubMagic en la izquierda de 1 byte
mov ecx, [ebp+08] ecx = puntero en el buffer
xor eax, eax
mov al, [ecx] al = 3er byte del buffer
add [ebp-04], eax SubSubMagic = SubSubMagic + 3er byte
inc dword ptr [ebp+08] inc puntero en el buffer para el siguiente byte
shl dword ptr [ebp-04],08 cambia los 4 bytes de SubSubMagic en la izquierda de 1 byte
mov edx, [ebp+08] edx = puntero en el buffer
xor ecx, ecx
mov cl, [edx] al = 4to byte del buffer
add [ebp-04], ecx SubSubMagic = SubSubMagic + 4to byte
inc dword ptr [ebp+08] inc puntero en el buffer para el siguiente byte
mov eax, [ebp+0C] eax = 202h (# de bytes lee + 2 bytes SubMagic)
add eax, -2 eax = 200h # de bytes leídos
mov [ebp-0C], eax [ebp-0C] = contador = 200h bytes para procesar
cmp dword ptr [ebp-0C],00 contador = 0 ?? todos los bytes en el buffer procesados ?
jz 00D679E9 sí saltar
xor edx, edx
mov [ebp-08], edx [ebp-08] = contador2 = 0 en el inicio
test byte ptr [ebp-01],80
jz 00D679C1
shl dword ptr [ebp-04],1 cambia 1 SubSubMagic
xor dword ptr [ebp-8],80050000
jmp 00d679C4
shl dword ptr [ebp-04],1
inc dword ptr [ebp-08] inc contador2
cmp dword ptr [ebp-08],7 procesado el SubMagicMagic 7 veces??
jbe 00D679AF aún no, salta
cmp dword ptr [ebp-0C],02 procesados los 200h bytes en buffer ??
jbe 00D679E0 sí, salta
mov ecx, [ebp+08] ecx = puntero en el buffer
xor eax, eax
mov al, [ecx] al = n bytes en el buffer
add [ebp-04], eax SubSubMagic = SubSubMagic + n bytes
inc dword ptr [ebp+08] inc puntero en el buffer para los siguientes n bytes
dec dword ptr [ebp-0C] dec contador # bytes en buffer a procesar
cmp dword ptr [ebp-0C],00 contador = 0 ?? todos los bytes en buffer procesados??
jnz 00D679AA aún no, salta
mov eax, [ebp-04] eax = SubSubMagic = SubMagic
shr eax, 10
mov esp, ebp
pop ebp
ret

La primera parte de esta función define el valor SubSubMagic (4 bytes). Es simplemente tomar los primeros 4 bytes en el buffer y copiarlos en [ebp-04]…la instrucción shl…permite concatenar los 4 bytes…No olvides que los primeros 2 bytes del buffer son el SubMagic del call previo….de cualquier forma, aquí está como queda el SubSubMagic después de esta primera parte

im wait to all people contribuit to study Crypkey Sdk

Glasha
peterg70
04-27-2002, 02:39 PM
glasha

this isn't a personal attack on you BUT

Typically most stuff is posted in english also we don't tend to put sections of code.

Rather a simple explaination of what you believe are the steps is sufficient.

Crapkey is not a hard protection to bypass although looking at their method of encryption is something to laugh at. (the amount of collision in their keys)

Anyway hope you have luck with your future.

I'm just waiting for the new version "6.0" of the crapkey (notice I only changed one letter in their brand to get my version :rolleyes: )

PS their is a real nice discussion document done by maverick regarding crapkey encryption

Peterg70


Wlscgen.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Wlscgen.exe
PDA

View Full Version : Wlscgen.exe

titof
04-25-2002, 01:35 PM
Hello,

I'm trying cracking Sentinel LM 7.1 with Cyberheg tutorial, but I'm too newbie. Does anyone have wlscgen.exe in order to look at the method ?
Thanks in advance
Titof
CrackZ
04-25-2002, 10:27 PM
*shock*, *horror* - I trust you aren't requesting a pre-cracked wlscgen.exe now are you ;-) since that would result in me having to flame you out of existence ;p.

To be honest with you, and please don't take this the wrong way, if you can't 'modify' the pretty appalling Sentinel for wlscgen.exe you probably aren't ready for this. I'm sorry for sounding so harsh (well damnit I'm not really) but thats just how I feel from your initial post.

Maybe, just maybe, if you post some details of exactly where you are stuck, yes the sproQuery() patches can be erm. well 'a little harder than WinZip', then I might and others might, be able & prepared to help you a little more.

Regards

CrackZ.
amois
04-29-2002, 03:43 AM
According to CyberHeg's essay, 1st patch will be for "sproFindFirstUnit". But, this breakpoint does'nt work. I think, 1st patch must be "sproFindNextUnit"

0042347F push esi
00423480 call sproFindNextUnit ; _RNBOsproInitialize@4 <-- my 1st patch
00423485 test ax, ax
00423488 mov eax, 0FFFFFFFFh
0042348D jnz short loc_4234A6 <-- Bad Guy (I think)
0042348F push 0A870h
00423494 push esi
00423495 call sproFindFirstUnit ; _RNBOsproFindFirstUnit@8 <-- CyberHeg's 1st patch

00435920 sub esp, 4
00435923 push esi
00435924 push edi
00435925 mov edi, [esp+0Ch+arg_0]
00435929 or edi, edi
0043592B xor eax, eax <-- I did like that
0043592D nop
0043592E nop
0043592F nop
00435930 nop
00435931 pop edi
00435932 pop esi
00435933 add esp, 4
00435936 retn 4

After "sproFindNextUnit" patching, "sproFindFirstUnit" breakpoint is working.

Am I right ?

Regards


onGuard protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > onGuard protection
PDA

View Full Version : onGuard protection

peter_j
04-25-2002, 10:50 PM
HI!

Im trying to remove or bypass a protection called onGuard.
My fist thought was to create a keygen or a generic crack for any program that was protected using onGuard.
But that was WAY to hard for me.

Have anyone seen this type of protection before, or even cracked a program that used onGuard?

onGuard's homepage:
turbopower.com/products/onguard/
this is one program that uses onGuard.
pcpoll.com/DEMO/samsung_full.exe
peter_j
04-25-2002, 11:45 PM
Never mind...
I got it...

It was to obvius! I missed it!

stupid stupid stupid! *pats self on back*
JanDebug
04-26-2002, 01:33 AM
Hi Peter,

"Hermes Professional für Windows", german astrology-prog is protected with OnGuard AND CopyControl (MicroCosm) 2.01.
With the tool from I.C.A. (Iranian Cracking Association) i can change the CopyControl-SN, but the fucking guard.exe checks a file, named "usnr.aut" for the original-SN. Guard.exe is also protected with the CopyControl-shell, but the ICA-tool can not unpack this file.

Regards

Jan


Sentinel Lm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel Lm
PDA

View Full Version : Sentinel Lm

titof
04-26-2002, 08:11 AM
PLEASE,

In order to crack sentinel LM 7.1, I need the crack file "wlscgen.exe", I couldn't crack it with the tutorial. There's too many things I don't understand.

Thanks a lot.

tof01@hotmail.fr
cyberheg
04-26-2002, 08:48 AM
If you can't "crack" it with a ready made guide what makes you think you should be using it in the first place?

All this crack requesting and whining about "I am weak so help me" makes not only me annoyed but I think alot others on this board are just as tired of it.

If you lack of skills then go learn them. It's just foolish to think you acomplish anything by beeing lazy and begging.
titof
04-26-2002, 10:26 AM
I agree with your opinion, It's just that I don't understand all the informations in the tutorial, and my english is poor so I can't explain my problem. And perharps should I train with more simple progs but I don't have enough time. I want to crack the prog (surfcam 2001) alone, but now I have a big problem with wlscgen.exe, and your tutorial is not enough for me. So if you don't want to send me the file, could you give me more informations concerning the method, but I'm not sure that I will understand.

Regards.
nofurs
04-26-2002, 11:50 AM
>I agree with your opinion, It's just that I don't understand all the >informations in the tutorial, and my english is poor so I can't >explain my problem. And perharps should I train with more >simple progs but I don't have enough time
You don't have time give up cracking coz cracking is time consuming

>I want to crack the prog (surfcam 2001) alone, but now I have a >big problem with wlscgen.exe, and your tutorial is not enough >for me. So if you don't want to send me the file, could you give >me more informations concerning the method, but I'm not sure >that I will understand.

Why should cyberheg send you the file????whinning here doesn't help so either you crack it yourself,buy it or just say "goodbye" to cracking hahahha

ps:To Woodmannn or others....
please delete this post... ;)
nblender
04-26-2002, 02:06 PM
Originally posted by titof
I agree with your opinion, It's just that I don't understand all the informations in the tutorial, and my english is poor so I can't explain my problem. And perharps should I train with more simple progs but I don't have enough time. I want to crack the prog (surfcam 2001) alone, but now I have a big problem with wlscgen.exe, and your tutorial is not enough for me. So if you don't want to send me the file, could you give me more informations concerning the method, but I'm not sure that I will understand.

Regards.

Try using bpm instead of bpx. Look at the calls to the dongle API.
CyberHeg's essay is pretty good, but when it comes right down to it, some work will need to be done before you have a working wlscgen - it's a good essay, but doesn't have absolutely every last tiny detail in it, there's an expectation that there's a bit of understanding and somewhat of a clue.
scorpie
04-26-2002, 03:20 PM
Hello there,

I think the problem is not cracking the dongle, because Cyberheg essay is very good and clear, although we must have some background about what is going on (as Nolan Blender mentioned). The problem is more to generate the "installation Key" for the respective vendor (in this case Nolan Blender's essay and Crackz's essay might be helpful). I try to Brute Force the key, but still stuck somewhere.

Regards,

scorpie


help!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help!!!
PDA

View Full Version : help!!!

dududu
04-27-2002, 11:03 AM
I can't find how to cracking the IPsniper2.0
anyone can help me?

(url deleted)

looking forward!!!!
Js
04-27-2002, 12:58 PM
Hiya,
either read the telock threads or wkt dumper.
Woodmann
04-27-2002, 11:33 PM
You might try reading the FAQ also.

Peace, Woodmann


Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Protection
PDA

View Full Version : Protection

ThrawN
04-27-2002, 12:37 PM
Just wondering if anyone has seen or looked at sonys new audio/dvd protection as yet? ;)
Give me some thoughts and suggestions on improvment pls

.....

ThrawN
ThrawN
04-30-2002, 12:03 PM
Hmm... No responce?

;)

Honeslty i would apreciate any feedback regarding them, they are only in their early stages, seems allready the audio demos have failed... acording to the fucken media

ThrawN
MTB
05-01-2002, 01:25 AM
ThrawN, all of these protections can be cracked EASYLY! The problem is most people are not thinking. First start with a CD/Stereo setup. Take the output and divert it to your sound card. Hit play on the CD, and record on your sound card playing software. Presto, you have a copy on your hard disk. Yes it is only at 1X speed but compromises need to be made in life.

Now I know most of you will say, it isn't a perfect copy. Guess what it doesn't matter! MP3 compression algo spreads the noise uniformly across the spectrum so it doesn't matter to 99% of the human population. Those who have a perfect ear will just have to live with it.

Now the question, is there any software out there that will automatically detect the dead space inbetween songs and start a new file there?

MTB
crUsAdEr
05-01-2002, 08:45 AM
Hi MTB,

I think Feurio might be able to do something like that, I cant remmeber exactly but it will fix that for you when you burn mp3 into audio CD again!
CTRL-D
05-05-2002, 02:25 PM
>>Now the question, is there any software out there that will automatically detect the dead space inbetween songs and start a new file there?

wavelab can do this easily: start recording at signal and set markers where silence is

CTRL-D
MTB
05-05-2002, 08:28 PM
Thanks CTRL-D, I knew the problem had to be solved by someone. Thanks to all.

MTB

PS it's time for everyone to get outside in this great spring we are having!!
LOUZEW
05-06-2002, 05:55 PM
It seems that the new CCD can copy these disks !
ThrawN
05-11-2002, 12:15 PM
Well there has only been 4 cds released with this new protection im aware of.... all of which have been ripped successfully. I have been told by a certain source from the group (same group did all 4) that they were ripped without much problem but however wavlab was used for something they didnt want to speculate on.

Do you know how much buffer a standard cd player has? its a critical part of the protection but alais never worked quite how was planned....
Also fucken super audio cd market has started some places and brings a new problem to the market... will audio cds finaly be phased out?.. saudio+ requires a totaly new hardware player which in order to defeat the protection would require a modchip (which do exsist - sony themselves have them, which is stupid cause they are basicly saying people can make them and do whatever the fuck they want)......

But with standard audiocd i dont believe there will be a 100% protection method.. but saudio+ i think might be revolutionary.

ThrawN
warior_jal
05-13-2002, 10:11 AM
hi
i couldn't find any cd protected with this protection, but I have been able to copy all cd's with fantom cd till date.

try it with different settings. Check the cd image in emulator before burning.


i need help on patching softice´s frame color
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > i need help on patching softice´s frame color
PDA

View Full Version : i need help on patching softice´s frame color

jhck
04-27-2002, 06:39 PM
hi,

maybe somebody can help me solving a problem.

i want to change the frame color in softice´s screen. (version 4.05.334) softice offers customizing options for text etc. but not for it´s frame.

what do i know:

softice screen is like a console or a dos screen, in memory it has a format like: char. code/color char. code/color ... color is hex 03 (background = black, foreground = cyan, char. code upperleft corner = hex DA, hex C4 an so on)

softice keeps "03" (color attribute) in a constant or a variable, if i knew the location of this constant or variable a patch would be easy, or if i knew, where in winice.exe softice draws its frame ...

scanning winice.exe for a pattern like mov al, 03 or similar brings up nothing really interesting.

looking for a screen buffer by searching memory with softice
(S 30:0 L ffffffff C403C403 or simlar) fails. softice indeed uses a buffer for it´s screen, unfortunately this buffer doesn´t include the frame but all text inside the frame. softice uses direct draw to flip this buffer onto the screen, but how does softice draw it´s frame ?

if someone knows, how and where softice draws it´s frame,
or if someone has an idea how to track this problem down,
please let me know

thanks

jhck


How to unpack FlashFXP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to unpack FlashFXP
PDA

View Full Version : How to unpack FlashFXP

TheDutchJewel
04-27-2002, 09:01 PM
Anybody knows how to unpack FlashFXP?

As far as i can see is it compiled with Borland Delphi 3.0.

I tried Protools and exetools for some unpackers. I can't find any prog that does the job.

When i try to unpack it with ProcDump, i get this error:

Tracer Code Failure!
Access violation occured at EIP 0x00597A41 - Terminating.

How can i unpack this proggy?

tia, TheDutchJewel
crUsAdEr
04-27-2002, 10:51 PM
Hi TheDutchJewel,

It is packed with tElock as far as i can remember! Search for tElock tutorials, there is one good tutorial at krobar site and there are lots of unpacking information on this board. Use the search button!

Cheers,
foxthree
04-28-2002, 08:55 AM
Hi Binh:

FlashFXP previous versions was packed with tE! However, this version does not seem to be tE! (atleast not 0.90 ;) I didn't spend much time to look at but it sure looks a lot different) There is no section trick which is the significant signature of tE!.

Anyways, this warrants a closer look. I'll see what I can find.

Signed,
-- FoxThree
Stone()
04-28-2002, 09:15 AM
It is packed with a private version of tElock. Seemed that there has been some sort of agreement between Charles and tE.

Unpacking is done in same way as with other apps, just find OEP and then dump from there.

I cant use RV however to trace imports, it does not find anything on my box, so I have to use Imprec and fix the saved tree manually as many of them are not resolved. It's an Delphie app so Imports are quite standard and it takes you only a lot of time editing the saved tree.
Solomon
04-28-2002, 10:28 AM
Easy. Just dump the full IT/IAT from memory before TELock destroying it and paste it to the dumped exe:D

IT is located at the beginning of .idata section. IT Length = 1CC, dump length = 30B0
TheDutchJewel
04-29-2002, 12:18 AM
Originally posted by Solomon
Easy. Just dump the full IT/IAT from memory before TELock destroying it and paste it to the dumped exe:D

IT is located at the beginning of .idata section. IT Length = 1CC, dump length = 30B0

Thanks for all the help posted here. But because I'm new with dumping files from memory, I've a few more questions:

1. IT=Import Table(?), but what's IAT=?

2. How to dump the full IT/IAT from memory and which prog should I use?
Solomon
04-29-2002, 02:25 AM
1. IT=Import Table(?), but what's IAT=?
IAT = Import Address Table

2. How to dump the full IT/IAT from memory and which prog should I use?

when you find that the IT/IAT of FlashFXP is fully decrypted(but not destroied yet), suspend it with a JMP EIP or equivalent, use LordPE to make a partial dump.

Grab LordPE RoyalTS here:
http://mitglied.lycos.de/yoda2k/LordPE/info.htm

I suggest your reading some manual unpacking tuts first:)
TheDutchJewel
04-29-2002, 07:57 AM
Thanks Solomon. You've right with reading unpacking tutors. I'll begin next friday when i'm back from holiday. Till then... ;)
foxthree
05-04-2002, 09:20 PM
Hi folks:

I'm dropping some findings here so that it may get eventually archived.

Unpaxed FlashFXP in question and did some analysis.

Earlier I commented that it was not the standard version of tE!. Stone() also posted the same thing. Yes, indeed it is not the standard version of tE! There is a couple of anti-bpm techniques different than the original tE!.

Also, the section tricks of FFFF is not present. In this build, it is FE1C. (Not that it matters but certain signature finders based on this value of "FFFF" may fail). Fix it and your dump is sweet ;)

Note to Stone() and other trying to rebuild IAT of tE!.

Most Optimal way: Use IMPRect/Tracer Level 3 and save yourself some boring typing time :D

And yes before I forget, the OEiP sigs for this build of tE! is:

61 POPAD
FF6424D0 JMP [ESP-30]

I've added this to the next version of OEPFinder and marked it as tE! Private FFXP build ;)

BTW, the above sigs don't help as even if you put BPMB on POPAD, tE! finds it and says "CRC Error ...."

I think this is where Clandestiny/Kayaker SICE BTrace Buffer disassembler will come handy. Yo guys! Wassup with the status. I'm itching to get some bsod ;)

Until next time,

Signed,
-- FoxThree
TheDutchJewel
05-08-2002, 07:22 PM
Anyone knows a good tutor about unpacking? Used the search without succes.


Need help---------mix-fx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help---------mix-fx
PDA

View Full Version : Need help---------mix-fx

winday
04-28-2002, 06:26 AM
mix-fx 1.04

I lost the way to find the serial:(, somebody help?
Kayaker
04-28-2002, 07:26 AM
Give us a break. Show that you've done some work on reversing the protection on your own, or that you are interested in learning the techniques in general, else this is a crack request pure and simple and will be ignored or deleted.

You'll get the benefit of the doubt and have a chance to try again. The apparent lame crack requests are getting a little too numerous lately. Nobody learns anything from them and they add nothing of substance to the board.

Please, let's go for quality posts people, not quantity!

Kayaker
winday
04-28-2002, 08:02 AM
:00405CD1 55 push ebp
:00405CD2 8BEC mov ebp, esp
:00405CD4 68935C4000 push 00405C93

* Possible Reference to Dialog: DialogID_0C82<-------**1**
|
:00405CD9 68820C0000 push 00000C82
:00405CDE E83DBCFFFF call 00401920 <-------**2**
:00405CE3 83C408 add esp, 00000008
:00405CE6 5D pop ebp
:00405CE7 C3 ret

**1** ref

Name: DialogID_0C82, # of Controls=003, Caption:"Invalid Key", ClassName:""
001 - ControlID:0001, Control Class:"BUTTON" Control Text:"OK"
002 - ControlID:FFFF, Control Class:"STATIC" Control Text:"This is not a valid MIX-FX key. Please make sure you are copying the entire k"
003 - ControlID:0006, Control Class:"BUTTON" Control Text:"Buy Now!"

**2**

when I pass this call, it shows the message "invalid key"

notes:
the register is in your C:\WINDOWS\MIX-FX.ini, but if your key is invalid, the register will be deleted next time you run the program.

questions:

how can i trace the proc the serial be
Kayaker
04-28-2002, 08:22 AM
A little better ;)

If the key is in an ini file, as I understand it, try breaking on GetPrivateProfileStringA. Look up this API in the Win32 Programmers Reference and display in Softice the parameters to monitor what is being read and where it is stored, i.e "dd esp.C" will show the 4th parameter
lpReturnedString, // points to destination buffer

When you find where your key string is stored then you can set a "read" BPR on that address range and Softice should break when the key string is first manipulated. Begin your tracing from there.

Try running an API monitor on the program, if the 'key' section of the ini file is being removed after it detects the bad key, this may show up how it's being done, perhaps with a WritePrivateProfileSection call. This will further help isolate the code you're looking for.

Hope this helps,
Kayaker
winday
04-28-2002, 09:16 AM
thanks kayaker:)


need help with resource tuner 1.7(PLEASE)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > need help with resource tuner 1.7(PLEASE)
PDA

View Full Version : need help with resource tuner 1.7(PLEASE)

Jon
04-28-2002, 07:38 AM
Hey

i got this program i have been trying to crack for a long time but with no luck... its a 30 days trial and i cracked the 30 days trial and the licence stuff i can also open files now but after i do open them i cant save them so can be because of my shitty crack (changed to many bytes i think... and one of them probably has a connection to the save function...) i really dont know what to do from where i am i attached the crack to this post and here is the link where u guys can get the program:

(url deleted)

one big mistake i did isnt writing why i patched in those places... u can also not use my crack and try to crack it from the original file...

all those who have problems with packed files this one isnt packed with any packer or crypter i know so thats not a problem... and its programmed in Delphi...

10x in advanced Jon (Please i really desperait with this one dont know what to do from here... and i really like using it dont want to lose it thebest resource editor i know better the borland resouce workshop and all those...)

PS. since the crack size is larger than 104857 bytes all do it in segements so no need to check the next reply(ies)

im really sorry i dont have a place to upload the file but any1 who wants to see it just reply and ill email u until ill find a place to upload it too 10x jon
Kayaker
04-28-2002, 08:40 AM
Sigh...

I don't know what to do with this one, other than I removed the direct URL links...

Jon, whatever you do, DON'T post your crack here or it's gone.

I think if you're good enough to make a time trial and license crack, then you're good enough to improve on your own crack and you don't need somebody else to do it for you.

If you've got a problem with Save disabled try a search on this board for "disabled menu", you may be surprised with what you find.

Kayaker
Jon
04-28-2002, 10:56 AM
what i meant is that the save option isnt disabled u can click it but nothing happens like i was the one who nopped or something and i really dont know what to do from here and i heard u guys are the best so i really hope u can help me:(
Actlon
04-28-2002, 03:08 PM
Try using softice to track the messages. You want to intercept the WM_COMMAND messages & if you look thrrough the program resources you should find the menu's & their ID's - get softice to check the params to see if it's the save (or save as) ID & only to break if it is...then debug it.
Jon
04-28-2002, 03:51 PM
well i looked through the program resources but nothing there i know what u mean but it doesnt work that was with Delphi only in VC and VB(not sure about VB) i tried looking in which form the command is loacted but no luck there either :( ill try using what u told me to do in softice i hope it will work 10x
Aimless
04-29-2002, 12:02 PM
Try getting DeDe from:

www.programmerstools.org

It will show you the procedure attached to the save button.

1. As soon as you pinpoint via DeDe, check the addresses in the file. Did you include any of these in your patch?

2. If no, then you can very well carry on disassembling (w32dasm or IDA, you choose). Either way, make sure you create the MAP files.

3. If you have indeed modified the area, unmodify it and run. Chances are, if it does not run or 30 day nag snaps again, the save routine is mixed with the nag routine (check out some tuts about code mingling - from the red must-reads)

4. You may, unfortunately, have to reverse engineer the routine enough to determine what works and what doesn't

A better way is to use your debugger as a profiler. This is because if it is indeed written in Delphi, then you will have innumerable subs_ and locs_ in IDA (say). And you would not want to waste time on looking at useless code. You may try traceover/traceinto features of Ollydbg 1.0.6,. They're nice. Or use whatever debugger you fancy.

...Have Phun. Always.
Jon
04-29-2002, 04:50 PM
well i used DeDe, IDA and softice and i found 3 addresses and apprantly crackers programmed this software and it damn too hard it has Patching check, CRC checking and it rebuilds it self every time on the memory... i dont think ill ever made a full crack of that but at least i found a temp way to keep it running after the 30 days i finished just chaning few files in windows dir deleteing few keys from the registry and back to 30 days...

10x anyway guys i really appreciate your help :)


im stucked
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > im stucked
PDA

View Full Version : im stucked

Hwoarang
04-28-2002, 10:36 AM
uhm sorry about this, but I must ask something about tcetorpsa
I try to unpack an app like this:
bpx GetVolumeInformationA, then tracex 400000 500000...here I get some procedures
(only fake entrypoints??) like this one:

0177:00497C2A 8BC0 MOV EAX,EAX
0177:00497C2C 55 PUSH EBP
0177:00497C2D 8BEC MOV EBP,ESP
0177:00497C2F A1F40F4B00 MOV EAX,[004B0FF4] ; eax contains pointer to an assspr loader procedure

0177:00497C34 A3F00F4B00 MOV [004B0FF0],EAX ; overwrite another procedure?
0177:00497C39 8B4508 MOV EAX, [ EBP+08]
0177:00497C3C A3F40F4B00 MOV [004B0FF4],EAX
0177:00497C41 5D POP EBP
0177:00497C42 C20400 RET 0004

It's really weird because there are about 10-12 such procedures in this app and if I bypass
every such procedure (using for example R EIP 497c41 at 497c2d or by jumping..) the app
still runs normaly..even tho I rebuilded the import table with tool(s) u know and found oep
the app is corrupted
and F8ing into it didnt work too well because there are alot of bad portions of code and even
corrupted stack:((
I read previous posts about this protection and those didnt cleared me too much=/ maybe im
just dumb?
pls anyone so kind to tell me what could i do wrong and what r the odd procedures actually doing????
foxthree
04-28-2002, 01:51 PM
tcetorpsa , huh? :D Nice one :)

Looks like good ol' DD in action again. Try using the "search" facility Hwoarang, and you'll see DD is just a "myth" :)

Signed,
-- FoxThree
+SplAj
04-29-2002, 08:08 AM
hi

I'm a complete newboid at this protection scheme ;)

However, it looks very similar to me, to Yexela trick with LockResource and FreeResource API. Just look at the alphabetic list of resolved API and you will see which Lock/FreeResource api fits

Spl/\j
foxthree
04-29-2002, 08:15 AM
Hi +SplAj guru:

This is way 2 much... hee haw :D ...

How's it going? Long time, no post!!! Anything new cooking in ur labs ;)

Signed,
-- FoxThree
Hwoarang
04-29-2002, 09:17 AM
splaj do u mean that trick with

Call dummy_api (eg GetModuleHandleA)
Call real api (FreeResource or whatever/?)

thanks, might be, il check it out:) probably thats why the stack is corrupted:) anyway, the target was memory patched by this time, but still I want to try to unpack it:))
+SplAj
04-29-2002, 10:48 AM
Foxthree

Ur PM is full :mad: ......(grrr tsehp) .....

Hwoarang... tegrat fo LRU eht em dnes

Spl/\j
foxthree
04-29-2002, 10:55 AM
Hello +SplAj guru:

I've cleared my PM and await your msg eagerly. Yep, I think +Tsehp set the limit to too small a value :( Cool, anyways...

BTW, +SplAj, do I have to write a small _strrev program to read your posts ... :D

Signed,
-- FoxThree
Hwoarang
04-29-2002, 01:34 PM
Splaj,
rehe si hte RUL:
6d 6f 63 2e 73 69 78 65 6c 65 68

(its the second prog in there;) have fun
methinks contains some latest yelxa tricks;)
evaluator
04-29-2002, 02:06 PM
You about:
Version 3.1 (build 352) 15-Apr-2002
foxthree
04-29-2002, 02:10 PM
Hmmm time to move this thread to the RCE Cryptographics forum :D

BTW, is it just me or is it that all tcetorpsa'ed apps web sites look a lot-like tcetorpsa website itself? yexelA is rubbing off his influence on everyone eh? ;)

Signed,
-- FoxThree
evaluator
04-29-2002, 03:36 PM
Congratz, SPLAJ!

seems thiz guy found newest (c)aspr!
As gift for you and othErz, I present thiz DLL:)
Kayaker
04-29-2002, 03:50 PM
Ahhh, you guys aren't gniloof anyone!

:p
crUsAdEr
04-29-2002, 04:07 PM
LOL...

I guess from now on, i must also learn to search the board for desrever gnireenigne :>>... no wonder there never seem to be enough information :>.. must be more creative when i search next time...

Anyway, eval... that dll looks different, is this a new version of AsProtect? <--- this is to help ppl searching the board in the future :>>> (hope you dont mind kayaker...)

regards
foxthree
04-29-2002, 04:17 PM
Eval:

A DLL with no exports :( :confused: :eek: What gives?

Signed,
-- FoxThree
crUsAdEr
04-29-2002, 04:20 PM
LOL...

looks like AsProtect discussion is back into full business now that Kayaker has approved of it :>>

hey fox3, search and thou shall find :>>... (hint : fravia site)...
evaluator
04-29-2002, 06:11 PM
Hwoarang!

OEP is 4AF2D8
When you use "/tracex", ICEDUMP (with default settings) prints previous address!
So each time, when tracer stops, tape:
u (previous address)
If then you will see instruction
JMP EAX
and POPAD before this, then you are on OEP.
Else no.

There is nothing new in protection scheme.
You must look at 2nd section. On OEP set this breakpoint:
BPR 4B0FE0 4B1008 R

and you can catch tricky code. Then simulate it in dump..

binh1881!

I'm sure, "thiz was" newest cASPR dll, at least for mE:)
1. every new cASPR.dll become bigger.
2. poor ASS seems upgraded his "Burland Delphinarium Outprise"!
Hwoarang
04-29-2002, 06:40 PM
I also finally managed to unalexey the target=)
foxthree
04-29-2002, 06:52 PM
Hmmm... unpaxed it in 7+ mins... So whatz new about this protection guys?

At first I thought new version of ASPR with improved DD tricks. Ummm, i'm disappointed :D There are not even "ASPR" checks...

Found 3000 icons in 2 mins.... seriously, u guys must buy this one... it is good :o

Binh:

What can I say? WOW!!!! U ROCK!!!! Now the DLL without .exports makes sense ;)

Eval:

Cool "bloated" ASPR.dll. But I guess, binh beat you to it this time, eh ;)

And one more thing, does ASPR mutate the SEH generation code or is it just the xor [eax], eax only???

Until next version of "RPSA" ...

Signed,
-- FoxThree

PS: Publicity time :)

People, you can do what eval says or use OEPFinder (the W**H**) clone to find the OEP in 2 secs... Look for it in the ToT section ;)
crUsAdEr
04-29-2002, 07:01 PM
Hey fox3,

This one is only $10!!!! I never tried using it but it looks really cheap... wonder why they bother buying AsProtect to protect it??? I bet the programmer must be affiliated with Alexey.... considering the similiarity of the website...

+++++++++++++++++++++++++++++++++++
Cool "bloated" ASPR.dll. But I guess, binh beat you to it this time, eh
+++++++++++++++++++++++++++++++++++

Nah.. i bet Eval has been keeping those gory details of us newbies :>>>...
/me slaps eval with a large trout....


Blum-Blum-Shub questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Blum-Blum-Shub questions
PDA

View Full Version : Blum-Blum-Shub questions

akimp3
04-28-2002, 03:30 PM
Hi
i have read the blum blum shub algo in applied cryptography(Bruce Schiner).
As i have understand the program should be like this:
//p=7 q=19 n=133
#include<iostream.h>
main(){
int n=133;
int s=11;
int x[14];
int b[14];
x[0]=((s*s)%n); //x0=s^2 mod n
for (int i=0;i<14;i++)
{
x[i]=((x[i-1]*x[i-1])% n);
b[i]=x[i]&1;
cout<< b[i];
}
}
This program give me a 14 digit random that i can use for the
Password.My question is if I want to produce 10000 random passwords I have to give p and q 10000 different number that
produce n witch is a blum integer.The problem is that this
number should be produced randomly i mean i have to produce
a big quantity of prime number p and q each congruent to 3 modulo 4 and different from the latest produced number.
As my program should produce n batch of card and each batch
contain 10000 different password I don't know how to produce
p and q.
Please give me some hints.
Thank in advance

akimp3
mike
04-29-2002, 01:37 AM
No, you only need one n ever.

n=p*q

p and q should be really big (like 512 bits)

You will need a bignum library to implement this code in such a way that it can't be broken. I suggest using Wei Dai's crypto++ library:

http://www.eskimo.com/~weidai

BBS will generate one bit per modular squaring. You need 14 log_2 10 bits = 47 bits for a 14-digit decimal number.

So for every 47 output bits, convert the bits from a 47-digit binary number into a 14-digit decimal number. Anyone who can predict your numbers can make a lot more money breaking into banks & other such stuff.

An even better way of getting your numbers is a true rng, not a pseudo-rng, based on thermal noise or something similar.
akimp3
04-29-2002, 03:53 PM
Hi
thank you very much for your help.
I have understand completly my mistakes.
thanks
bye
akimp3
05-02-2002, 03:45 PM
Hi
thank Mike for your help.
I have downloaded the crypto++ but i had some problem with
it.I have used Miracl library(the one used by tE in RSA tools).
I think that my program is correct but I don't have any test data
that i can check it,do you have any sample data for the
Blum-Blum-Shub algo?

I have attached my source code and my exe file
to this post if anyone could tell me if everythings is correct.
@Mike:
about the 202 bit that you told me i have a little question
i want a 14 digit password each digit is beetween 0-9 so
i think that 46 bit is nedded could you please tell me if I
am wrong?

Thanks in advance

akimp3
mike
05-02-2002, 07:30 PM
I don't have test vectors, sorry. And 47 bits is right. I can't remember how I got 202. It's obviously way off.


CKI32H.DLL and it's tricks...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CKI32H.DLL and it's tricks...
PDA

View Full Version : CKI32H.DLL and it's tricks...

foxthree
04-28-2002, 07:37 PM
Hello Fellow RCEs:

I'm playing around with CrypKey protection. I've patched the Site Key Gen and it is cool :cool: (hi peterg :)). However, I wish to understand more... ;)

I installed a new CrypKey protected soft (I think CK 5.4) on Win2K and it gave me a strange error about the "License Server not available" or some thing like that. I knew (from prev. exp.) that "CrypKey License Server" Service must be running for this app to avoid this error. But then I think, wth, let's fix this bug ;) and I find that all I need to do is to patch a few bytes (precisely 5) in CKI32H.dll (SecurityProc exported function btw) to avoid that error and the apps runs and runs and runs .... :D

There is not even an authorization check!!! :eek:

My question is: Does anybody know what the CKI32H.dll does or is meant for?

BTW, just a line of thought:

Why don't we just hook all the exported calls in CRYPXXE.DLL and redirect it to our own proc and wreak havoc from there? (I haven't tried this but I will shortly) This way we can return any valid value for any API by passing CrypKey *UNIVERSALLY* :p

Of course the ckChallenge must be patched manually though?

Has anybody had any experience with this?

Thanks.

Signed,
-- FoxThree


SICE and XP...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SICE and XP...
PDA

View Full Version : SICE and XP...

daffydos
04-29-2002, 09:45 AM
Hi all,
I just wonder how people can use SICE (from Driverstudio 2.6) with XP. It seems to be unusable....I know that few (!) people here already said that, but is there any *real* developpers who are working with Sice ?!!
Daffydo
foxthree
04-29-2002, 09:49 AM
"Real"... what is real? If you talk about something that you can feel or touch, "reality" is nothing but signals interpreted by your brain...

-- Morpheus, The Matrix

LOL, Daffydos, this is something too good to pass up. Sorry ;)

Okay, there has been a lot of disc. about SoftICE and XP incompatibility ( i think 2-3 every week :eek: ) So you might benefit from searching the board "better"..

BTW, I believe all developers here are *real* developers and not virutal ;)

Signed,
-- FoxThree
daffydos
04-29-2002, 01:27 PM
Hi foxthree,
Dont be sorry, following the white rabbit is not so easy.... :)

In fact, even if it is my first message here, i am a "veteran" using SICE (since the early DOS version). I know that a lot of discussion occured few weeks/month ago and far from me believe that most Fravia users are only bots :D

I t seems that there's a lot of trouble with XP (problems that i don't encounter with win2K) (breakpoint disapear, etc..)

Maybe there's also a misunderstanding about *developer*...im just talking about people who are using the Numga Driversuite for writing kernal drivers....

That's all folks
Daffy
UrgeOverKill
04-29-2002, 03:34 PM
Hi DaffyDod !!

Actually I have been using DriverStudio w/XP - build 2600, since it came out and so far (knock on wood), I have experenced no problems..... and I use it quite a bit.

UoK
UrgeOverKill
04-29-2002, 03:35 PM
woops!!, sorry about that, Daffydos, kinda fatfingered your name.....
crUsAdEr
04-29-2002, 07:17 PM
Hi guys,

Apparently there are some problems (aka. driver conflicts with certain hardwares) on windows XP that is why DS 2.6 doesnot work on some machine!

However, i have heard from a few people that it is more stable to install sice 4.05 on XP and then apply the XP patch provide on numega site... I am not sure though cos I dont use XP...

Hope this helps somehow,
Binh


sice on 2k (again...)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > sice on 2k (again...)
PDA

View Full Version : sice on 2k (again...)

drcmda
04-29-2002, 11:34 AM
i'm running a win-200 pro box and i installed softice
the first time on a nt system like this... i encountered
a couple of problems but the worst of all is that i don't
see ANY api-names, just plain calls to jump-tables...
the EXP entries in my winice.dat
(c:\winnt\system32\drivers\winice.dat --- huh???) seem
to be correct, i included even ntdll.dll and ntoskrnl.exe
coz kernel api's are forwarded in 2k i think but NOTHING
works... on numega's site i read something about nt
debug symbols but where can i download them... can
somebody please zip up a working (NT!!!) s-ice package for
me (including winice.dat and maybe some symbol files).
that would be very very nice... thank you for reading...
robber804
04-30-2002, 01:47 AM
You can download the symbol files from

h**p://www.microsoft.com/ddk/debugging/symbols.asp#Windows%202000%20Symbols

Make sure to get the original and the one for whatever service pack you are running.
drcmda
04-30-2002, 09:42 AM
nearly 200mb just for a couple of simple debug symbols???
no way... i mean i already exported almost all the the
important dll's successfully and softice acknoiwledges on
them too but it seems that the bases are wrong or
something like this... if i enter "d ExitProcess l 20" this is what
i get: "symbol has not been instantiated"... ok but why the
hell can i enter "u ExitProcess" for example... i get no error
message but it's definitively not the right adress... another
strange thing is that i have no problems with the hal api's
i can dissassemble them, dump them and finaly set break-
points on them... what's going wrong here? please, if anybody
knows a way without downloading a 200mb package i would
be more than lucky :)


Numega...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Numega...
PDA

View Full Version : Numega...

Snatch
04-29-2002, 06:03 PM
I dont care really why DS 2.5/2.6 do not work with Windows XP. My question is when not why. And I know enough people here have connections to the stuff hidden behind the gates over at Numega and might have some insightful information on DS 2.61/2.7 and if they acknowledge the bugs. Just curious on this point.

Snatch


how i can define: can i unlock HASP protection or can't (without key)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how i can define: can i unlock HASP protection or can't (without key)?
PDA

View Full Version : how i can define: can i unlock HASP protection or can't (without key)?

bombe
04-30-2002, 05:56 AM
i try to unlock EasyTrace from

<URL deleted - it's really not hard to use Google>

It's really to unlock this soft or not? i can't decide...
What's the way to decide this?

& what's the strategy to unlock this soft if it's really?

thanks!
naides
04-30-2002, 11:36 AM
1. Avoid placing direct links to the target software in your post. You are essentially waving your hand to the software manufacturers to this site.

2. Read the CrackZ archive site about HASP targets.

3. Search in google the words "EasyTrace" and "crack". You will find out that somebody already made it. I AM NOT ADVOCATING that you download a ready made crack, but it will answer your question:

-It's really to unlock this soft or not? i can't decide...
What's the way to decide this? -

Search and you'll find

4. Try to fight your way through the software, follow some tutorials on HASP protections and come back when you have a more specific question
MTB
05-01-2002, 01:34 AM
bombe, try the following:
1. Read frog's print tutorial on dongles (try fravia's site) yes it is old but still relavent.
2. Try the stuff on crackz's site.
3. I hope you have lot's of patience, this could take you a couple of months. You will need at a minimum W32dasm and a hex editor for tools. I prefer IDA but it isn't easy to use. Softice is powerfull but user hostile. Read ALL the tutorials you can find on Hasps. Emphasis on ALL the tutorials. Most reversers here will not help you until you can show that you are trying and you are making progress, else forget it.

Good Luck
MTB
bombe
05-01-2002, 02:47 AM
i have IDA latest v & SoftICE 4.05
i'm red tutor's but have not experience on this way...

and crakz site's have no this protection remover
naides
05-01-2002, 03:10 AM
CrackZ will not have a protector remover. His site will illustrate the general techniques in analyzing this sort of protection. It is up to you to understand them and apply the knowledge to your specifc target, or even better, to find out that your target protection departs from what other people have found in other HASP protected programs (It should !!!)

Again, if what you need is a quick crack for the software, it is easy enough to find it.Try google, or Astalavista.
Contrary to other people in this forum, I do not think it is a mortal sin to use ready made cracks, I just think it ruins the fun of reverse engineering.
Sort of, when you go out fishing, instead of waving then rod yourself and having fun catching fishies, you go to a supermarket and buy them already gutted, and frozen. . .
bombe
05-01-2002, 03:15 AM
how i can explain the protection method of this program?
it's encrypt on the fly.
you need see that, it so hard to explain.
crUsAdEr
05-01-2002, 08:49 AM
Hi bombe,

Ignore me if i am wrong, but if the encryption/decryption is done at run-time, you can try to dump those codes from memory and disassemble them with IDA or something, that would make analysing lots easier...
bombe
05-02-2002, 01:28 AM
this prog decrypt and put ouptut code and string into environment.
i can't BPM this case - becouse i don't know...

and THANKS for ALL!!!
(but you didn't saw some interests at this time ... , i'am not a new newbie - i have some works, but this method protection i don't understand, please don't send primitive advice :) - try to disasm this soft if you have time, after this learn me...

thanks
crUsAdEr
05-02-2002, 01:52 AM
Hi Bombe,

The thing is that you cant explain your problem, cos i think not many ppl will be willing to download a new program for nothing...

So yeah, your best bet is try to explain your problem and then ppl will try to help... yeah a RE your problem in English sometimes not easy... but do try cos that is the only way i fear...

Just a personal thought,
crUsAdEr
bombe
05-02-2002, 02:43 AM
tak mozhet na russkii pereidem?
crUsAdEr
05-02-2002, 03:32 AM
Ya ne uveren, chto forum eto pozvolyaet. No davay popitaemsya, posmotrim, kto ponimaet. Poshli syuda svoi vopros, posmotrim, kto poymet.

Davay!

Krestonosec (crUsAdEr)
bombe
05-02-2002, 03:52 AM
Ð´Ð° ÐºÐ°ÐºÐ¾Ð¹ Ð²Ð¾Ð¿Ñ€Ð¾Ñ? :)
Ð¿Ñ€Ð¾Ñ?Ñ‚Ð¾ Ð½ÐµÐ¼Ð¾Ð³Ñƒ Ð·Ð°Ñ‰Ð¸Ñ‚Ñƒ Ñ?Ð½Ñ?Ñ‚ÑŒ Ð¿Ð¾ Ñ‚Ð¸Ð¿Ñƒ EasyTrace - Ð½Ðµ Ð¿Ð¾Ð¹Ð¼Ñƒ Ñ‡Ðµ Ð´ÐµÐ»Ð°Ñ‚ÑŒ Ð½Ð°Ð´Ð¾.
Ð¸ Ð²ÐµÐ·Ð´Ðµ Ð¾Ð´Ð½Ð¾Ñ‚Ð¸Ð¿Ð½Ð°Ñ? Ð¿Ð¾Ð¿Ð°Ð´Ð°ÐµÑ‚Ñ?Ñ? Ð²ÐºÐ»ÑŽÑ‡Ð°ÐµÑ‚ Ð² Ñ?ÐµÐ±Ñ? Ð¸ HASP,
Ð° Ñ‚Ð°Ðº Ð¿Ñ€Ð¾Ð³Ð¸ Ñ€Ð°Ð±Ð¾Ñ‚Ð°ÑŽÑ‚ ÐºÐ°Ðº Ð´ÐµÐ¼ÐºÐ¸.
Ð²Ð¾Ñ‚ Ð¸ Ð¿Ð¾Ð´ÑƒÐ¼Ð°Ð» Ð¼Ð¾Ð¶ÐµÑ‚ ÐºÑ‚Ð¾ Ñ‡Ðµ Ñ?ÐºÐ°Ð¶ÐµÑ‚...
crUsAdEr
05-02-2002, 11:49 AM
LOL..

Bombe... like what i said... you need to post more specifcally... not i cant crack this, can someone helps me?

If you are not familiar with HASP, browse and read crackZ's site... i have been reading.. I have 2 impression about cracking dongle.. wonder which one is more accurate... either cracking dongle is simply about getting correct output for each dongle check (which doesnt sound that difficult)... or cracking dongle is difficult that will take you a few weeks for each dongle?

Ah well.. guess i will only know when i actually touch my hands on dongle itself...

Bombe, post your question in Russian and i can translate for you if i can, but not as above... "i dont understand the protection, can someone help :<?"

cheers
crUsAdEr
bombe
05-03-2002, 12:45 AM
ladno, krome pustyx razgovorov ya zdes nihrena ne uslishal.
Woodmann
05-03-2002, 01:30 AM
Howdy,
I will be so impressed if this works out.
I have never seen such an effort to overcome a
language barrier!!!!!

Peace, Woodmann
bombe
05-03-2002, 01:33 AM
sorry!
bye!
CrackZ
05-03-2002, 07:57 PM
Hiya,

This may or may not help you.

I ran into EasyTrace v7.05 (not entirely sure on that version but thats what my notes say) a few years back.

It was as you say a HASP dongle, and called only basic HASP services, 1, 5 & 6, maybe some reads too, either way there was nothing complex about it and I returned appropriate values, the real problem was that I just couldn't get the version I had to do anything meaningful, all the restrictions were still in place regardless of passing/failing the HASP checks, certainly none of them appeared to end up to relate too the restrictions.

I didn't invest much time on it, I'll look a bit later tonight or tomorrow, I think I still have it here, but note, I remember the author was Russian, so it might be either very clever or very crippled or none of the above.

Regards

CrackZ.


Revirgin 1.4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Revirgin 1.4
PDA

View Full Version : Revirgin 1.4

robber804
04-30-2002, 07:08 AM
Anyone besides me getting the "Please update tracer.dll to its latest version into your %systemroot% directory" from Revirgin 1.4. When I check the file properties in the systemroot and in revirgins directory the tracer.dll is version 1.31. Though I don't know if it matters I am running Win2k.

Tshep great program, I have just started to use it and learn what it can do.

-robber804
Stone()
04-30-2002, 01:09 PM
Had same problem too. It seems that the exe does not look for the version info, but for a date-time stamp of the tracer dll.

So I changed mine to 27/04/2002 10:55 (that's European format -
dd/mm/yyyy). Now RV does work.
foxthree
05-01-2002, 07:23 PM
Hi +Tsehp:

Are you planning a fix for this ;)

Signed,
-- FoxThree
foxthree
05-01-2002, 07:49 PM
Hi Fellow RCEs:

What Stone() has remarked is correct! I did the same and it worked. So, I thought many guys would benefit with a simple code snippet to do this (until +Tsehp fixes this ;)) Attached below is the snippet to change the timestamp of tracer.dll. Modify it to reflect the tracer.dll's location in your system.

SYSTEMTIME sys ;

sys.wYear = 2002 ;
sys.wMonth = 4 ;
sys.wDay = 27 ;
sys.wDayOfWeek = 6 ;
sys.wHour = 15 ;
sys.wMinute = 36;
sys.wSecond = 0 ;
sys.wMilliseconds = 0 ;

HANDLE hFile = CreateFile ("D:\\Program Files\\revirgin\\tracer.dll",
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL) ;

if (TouchFileTimes (hFile, &sys) == FALSE)
{
printf ("GetLastError= %d\n", GetLastError()) ;
}

That's all folks ...

Signed,
-- FoxThree

PS: Note the actual time does not matter; only the date... Also, include imagehlp.h and link against imagehlp.lib (only on Win2K)
Stone()
05-05-2002, 08:29 AM
Nice idea foxthree, but problem is still not solved as RV gets updated without change of version number and problem is still there, thus I found it easier to patch the exe.

I also now have the feelings that RV now a stranger behaviour. I can't follow if this depends on my particular config and progs installed, but when using latest RV I always get a cold reboot on XP when trying to trace some asp apps. That does not happen with 1.3.

Also on ME I always get a protection fault of the traced app.

I wonder if I'm the only one having such problems.
foxthree
05-05-2002, 01:16 PM
Hiya Stone():

Mmmmm....

/me thinks some bug in 1.4 Beta...

See, when I first started unpacking ASPR targets, I started with a standard soft that has no "tricks"... plain simple ASPR. With 1.3, I run the tracer and whoa, get the OEP in seconds.

But with 1.4 beta, I run trace with the exact same params on the same OS (Win2K) and whoa it jums to some 0x7XXXXXXX address and the apps just shows up. It looks as though the tracer lost control along the way.

I've raised the bug by email to +Tsehp along with the target details but yet to hear from him. +Tsehp, did you receive my earlier email or do I need to resend it?

This may *not* be related to what you face Stone(), but there is some similarity here. Hmmm, just wanted to say 1.4 Beta *may* be buggy. So, use it with care ;)

Signed,
-- FoxThree
Stone()
05-05-2002, 07:16 PM
Regretfully have to agree, had to go back to 1.3.

With tracer I mean the tracer to resolve the imports.

I just can get some on W2K to resolve (always the same are missing RegisterWindowMessageA, GetVersion, etc.) thus it's fairly easy to manually edit them.

On some asp apps I even don't get nothing when inserting the OEP (like CustomizerXP, VoptXP, Reg Organizer, etc.).

Version 1.3 resolving Reget 118 ok, 9 or 10 not resolved, tracer
get's some more, after that RV has to be killed as it doesn't close

Version 1.4 resolving Reget 118, run the tracer on the 1st not resolved import: Cold Reboot!

So let's wait for +Tsehp, until then Olly does the trick :)
foxthree
05-05-2002, 07:36 PM
Hi Stone():

RV needs to be killed is pretty common. I mean this was there. The way to avoid this is to uncheck the show IAT referres while resolving. This way RV does not find the Refs counts of each API. If this option is checked, after resolving RV takes sometime (CPU 100%) to find the API Ref count to point out bogus APIs to the user! [Something like show suspect in ImpRec].

So, uncheck it and everything is fine. Others may be "genuine" bugs ;)

Signed,
-- FoxThree


anti-gravage
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > anti-gravage
PDA

View Full Version : anti-gravage

The_Snake
05-01-2002, 11:11 AM
hi all i search any ant-graving for protection my Cd-Rom:)
crispeater
05-01-2002, 05:14 PM
Man speak with forked tongue..... :D


New Article: Detecting Windows NT/2K process execution
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New Article: Detecting Windows NT/2K process execution
PDA

View Full Version : New Article: Detecting Windows NT/2K process execution

Kayaker
05-01-2002, 10:19 PM
Hello Folks,

Check it out ;-)

Detecting Windows NT/2K process execution
By Ivo Ivanov

http://www.codeproject.com/threads/ProcMon.asp

Abstract

Intercepting and tracing process execution is a very useful mechanism for implementing NT Task Manager-like applications and systems that require manipulations of external processes. Notifying interested parties upon starting of a new processes is a classic problem of developing process monitoring systems and system-wide hooks. Win32 API provides set of great libraries (PSAPI and ToolHelp [1]) that allow you to enumerate processes currently running in the system. Although these APIs are extremely powerful they don't permit you to get notifications when a new process starts or ends up. This article provides an efficient and robust technique based on a documented interface for achieving this goal.

and don't forget:

API hooking revealed by Ivo Ivanov

http://www.codeproject.com/system/HookSys.asp

Cheers,
Kayaker
foxthree
05-02-2002, 08:39 AM
Hello Kayaker:

Great article!!! I'd also like to point out a great proggie by ElicZ which does the same thing (I think) WatchImageLoad ... However, this uses undoc PSAPI set I think...

Signed,
-- FoxThree

Revised post:
Hmmm... on second glance WatchImageLoad does *exactly* the same... :D


Question about copy & paste
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Question about copy & paste
PDA

View Full Version : Question about copy & paste

Nemesis]
05-02-2002, 09:17 AM
hi all

i would like to know how to copy data from softice to desktop is it possible to do this and how ?

Best Regard
Nemesis]
Kayaker
05-02-2002, 09:37 AM
Hi Nemesis]

IceDump is your best solution (and your best friend ;)

You can use the /screendump option to dump the screen as a text file, or the /dump option to dump raw data. This is only the beginning of the options available, check it out.

Kayaker
Nemesis]
05-02-2002, 02:46 PM
Thank you so much Kayaker

its works fine.

Regard
Nemesis]
Js
05-02-2002, 09:41 PM
hiya,
you may want to look up icedump's /clip features also.
regards


AsProtect but it's not about unpacking it :>
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AsProtect but it's not about unpacking it :>
PDA

View Full Version : AsProtect but it's not about unpacking it :>

crUsAdEr
05-02-2002, 11:28 AM
Hi folks,

I was wanted to ask about this... since AsProtect use so many seh in his dll... and i he uses various tricks to prevent single stepping... i was thinking of writing a loader that debug AsProtected program.. since seh is handled first by the debugger (hope i understand this right), our loader will be called when seh is called and can wreak havoc from there... handle the seh, and thus have access to the AsProtect prog and hence wait for the right moment, do an inline patch or dump the program where apropriate?

Me still research on debugging API but just wondering about this possibility.. is there any problem that i have not thought of?

Thanx,
crUsAdEr
foxthree
05-02-2002, 03:14 PM
Hi crUsAdEr:

/me thinks it is not so easy ;) I attempted to do some thing like this with no success.

What you're saying is called a "tracer" and one that runs in user land, hence a ring 3 tracer. There are I think many levels of understanding that one must do before suceeding in this, I think. Especially relating to SEH.

Let's say your handler get contol when ASPR causes exception. So, what do you do. You must try to locate the original ASPR EH for this exception and pass this to it so that ASPR still thinks it is not traced. Also, all EH will get with TR flag cleared. So, you need to re-enable this in you EH (this can be quite simple as you get the CONTEXT structure passed to your EH). However, what about anti-trace tricks like INT3.

Disclaimer: I AM NOT AN EXPERT HERE AND WHAT I SAID ABOVE MAY BE BULLSHIT!!! So ignore and correct me if I'm wrong... rather than flaming me :(

Essentially, all ring-3 tracers must patch the Windows SEH so that it can get control and do the "right" thing in case of an application generated exception.

However the problem that I faced is that:

(1) None of the experienced people like +Tsehp and others answered to what exactly is the "right" thing and how to go about this! Probably they're just very busy. ;)

Tracer "Gurus", please help us as I think there are several others who are itching on getting this right!

Thanks,

Signed,
-- FoxThree

PS: Just search for the word "tracer" on this messageboard and travel back in time to see the various peoples posts and ideas on this and how tough this can be ;)

Tips/pointers to "old" ring3 tracer code will be of immense help :)
crUsAdEr
05-02-2002, 03:22 PM
Hey fox3,

The thing abt this idea is this it is not a single stepping tracer... it is a debugger... our loader will just let the target AsProtect runs, and is only called when debug_exception occurs (like the way armadillo does it)... hence we 'll handl AsProtect seh outselves...

As about triggereing AsProtect se Handler, i doubt we need to do this cos as you have known... the original seh only clears debug registers and nothing else.. so can just happily skip them all together and correct eip, that is all...

Things like int3 is probably slightly harder to handle but i din seem to find any in AsProtect.dll yet... think Alexey plays a fair game and doesnt detect sice... which is real nice of him :>... no reboot ever occur when playing with asProtect....

Regards,
crUsAdEr

PS : wait till i get sometime.. then i will try... most likely wont work but ah well :>... worth a try
foxthree
05-02-2002, 03:27 PM
Hi crUsAdEr:

Sounds nice but...

hence wait for the right moment, do an inline patch or dump the program where apropriate?

...then how are you going to freeze the proggie at the "right moment" (say the OEiP) without single stepping. B'cos from what I understand you're going to rely on exceptions to get event notifications.

Am i right?

Signed,
-- FoxThree
crUsAdEr
05-02-2002, 03:34 PM
Yeah when debug_exception occurs, the debugee would freeze rite?

There we can access its memory and patch all we want? That is how armadillo does it exactly... it debugs the program, then when the debugee reaches an encrypted code section, seh occur and Armadillo debugger decrypt the next area of code section, encrypt back the old code section that has already been executed!!

Hee.. i wasnt intending to frreze AsProtect at "popad, jmp eax".. i was intending to wait till AsProtect fully decrypt the prog and then dump it from there...

OEP can be found with other tools :>>... nah, i mean Soft ice and cuper bpm :>... not something that cant work on win2k yet... lol

cheers,
evaluator
05-02-2002, 07:15 PM
Hello!

>>i was intending to wait till AsProtect fully decrypt the prog and then dump it from there...

For this you need hook VirtualFree and make dump each time.

For memory patching, youWe must define point, when ASPR finishes CRCcheck of CODE section.
Nothing is impassible, lets do more cruel with cASPR! Lets make REPACK-STUDIO:)
Want YOU!?

WE WILL, WE WILL...
SilberFuchs
05-02-2002, 08:53 PM
It's still possible to make a classic inlinepatch for asprotect. (more simple than a loader?? boh)

ciao
SilberFuchs
Pyrae
05-03-2002, 01:00 AM
Yes, inliners are always possible and I prefer to do them instead of using loaders, but it's getting pretty time-consuming though (just did one on the latest DivX.dll, 5.0.1 GAIN).
Another point is that almost any inliner might suffer from being executed in different environments, so I think clean unpacking is still the way to go...

Just my thoughts, Pyrae
crUsAdEr
05-03-2002, 03:43 AM
ARgh,

Can someone helps me please....

I spent the whole nite trying to figure this damn thing out to no avail... this loader works fine for win2k... but the instruction
CreateProcess doesnt seem to work, win 98 refuse to creat a new process for me... everythign runs smooth on win2k...
http://galileo.spaceports.com/~sydx/files/test.zip
(i cant seem to upload :<)

This loader i have tested on win2k, should be able to dump the exe decrypted with most of IAT intact, except a few "special" API which prolly needs manual fixing... need to build a new Import Directory and that is it... I just want to make it works on win 98 first...

Helps will be greatly appreciated... UnAsProtect doesnt seem to be that hard...
crUsAdEr
05-03-2002, 09:48 AM
SilberFuch, May I ask how do you inline patch it?

Seems like OEP is no longer hardcoded anymore, that would mean repacking AsProtected target program?
LaptoniC
05-03-2002, 10:04 AM
invoke UnmapViewOfFile, pMapping
invoke CloseHandle,hMapping ;here it is :)
nvoke CloseHandle, hFile

You should close the handle of mapping object.It didnt gaved error box this time but after 10 sec in my p3 600 it gaved nothing they were still in my program task list.

Also maybe you should add DEBUG_ONLY_THIS_PROCESS flag so you wont deal with other process exceptions events etc.
SilberFuchs
05-03-2002, 04:45 PM
"Seems like OEP is no longer hardcoded anymore, that would mean repacking AsProtected target program?"

No, it's a classic inlinepatch.

change some byte in the file, and later in the memory...and find where and why Asprotect crashes. this is the point you must beginning. the cryptet things at beginning you can re-calculate.

find where are made the CRC's and try to get around them.

ciao
SilberFuchs
evaluator
05-03-2002, 06:06 PM
Binh18!

I little tested your "test.exe"
CreateProcessA can work, if I jump over
CreateFileA, CreateFileMappingA..
e.g. I patched in HIEW:
;from 40105B jump 401114
and CreateProcessA works very well:)
Seems problem is because CloseHandle not closes??

So patched "test.exe" starts process, then WIN386.SWP became 330mb.
I wait 2 min and kill process.
[maybe my patch is too lamE? or I must wait 20min?:-0]

Then I also run test.exe on XP. Much funny! Exactly after start,
youR progg sad to me:
"Dumping is completed successfully! Enjoy!"
Wow! I look at Dump.EXE... 0 Byte:(
evaluator
05-03-2002, 07:36 PM
Wow!
Congratz!
I managed your BUG:)

So you need insert before 00401109
another CloseHandle for CreateFileMappingA
e.g. before

invoke CloseHandle, hFile

you need:
invoke CloseHandle, hMapping

Now it works on XP!

Q: it only dumps file? (without import etc..)

On W98se happens, what previously I wrote.
crUsAdEr
05-03-2002, 11:41 PM
Thanx Laptonic and eval, :>

No wonder none of my dumper ever work on win98, micro$oft should learn to program better to accomodate bad programmer like me :>>... funny they all works fine on my win2k box....

Here is a more stable version with more error checking, tested on win2k and win98...

It dumps the file no problem, fix section header, IAT can be almost fully rebuilt on old version of AsProtect, not the lastest one... It doesnt support older version of AsProtect, found in DigiSecret .. that is the only that i have tested and it cant dump... cos the code changed a bit.. but me has no plan of supporting it anyway...

Hope this works better... thanx a lot folks..
crUsAdEr

looks like my Opera is having prob with the board, cant upload anything... just download from the link i posted above... it is updated
evaluator
05-04-2002, 12:09 AM
Eh!
Only now I read LaptoniC's response:(
He already guessed bug. Sorrrry!

OK, redownloaded youR proG.
Now it dumps also on W98se;
Sections are fixed.
OEP & IT not exists.
XP & W98se same result.
Tested ASPACK current ver.

Can you tell me, what program exactly you tested?
crUsAdEr
05-04-2002, 12:35 AM
Hi eval,

yeah... as i stated.. for new version of AsProtect liek icon catcher, AATools, Commview 3.3 etc.. IAT is not rebuilt...
that is because first thunk is now deleted all together and hence rebuilding it would need to create a new section at the end of the exe... too much work to bother...

For older version of Asprotect, like curretn RegetDx, Reg Organiazer, Advanced Archives Passssword recovery, Advanced PDF password recovery, it can rebuild IAt except those emulated API... dont plan to support them cos that would make it a readily available dumper that any lamer can use which is not the purpose of this exercise...

You have the source code, i have done half of it :>, since you said we should do this project together, you should do the other half :>... fix up the rest, eval :>>>
Also tell me those prog i tested works on ur machine?

cheers,
crUsAdEr
GlObAl
05-05-2002, 06:59 PM
Hello to everyone,
i post here first time and first at all i think this is an good working board so i will thanks the admins.
And yes it is possible to inlinepatch newest ASPR and it based near to every time the same...
for examples you can look at Laptonic´s group site most of the FlawLeSS patches are ASPR.
For some days i talk with BlackCode and he say to me that there was an tool on anti*rack.de with the name KanXue Studio (unpacking ASProtect protected executables)
after downloading i was suprised its work realy great maybe its interesting for others too.

PS.:Silberfuchs ich dachte schon Du bist verschollen :)
foxthree
05-05-2002, 07:28 PM
Yes this was one of the questions that I'm currently researching on: How does the "loader.exe" from KanXue studio find the OEiP of ASPR apps absolutely (not the sigs but the OEiP). It doesn't look to me like a tracer as it works pretty fast.

I tried to disasseble the Loader.exe but it says Linker v 7.0 (.NET compiler) and has only one .text section???

Any tips?

Signed,
-- FoxThree
LaptoniC
05-05-2002, 08:04 PM
It use virtualprotectex api which is the same api used by olydebug to put bpm.
Lbolt99
05-07-2002, 08:06 PM
Hi,
Sorry if this seems like a newbie question.. I'm a bit late coming into the RCE scene and ASPR 1.3 was already out.

Anyway I'm a little confused on how you all are referring to older and newer versions of ASPR.

From what Crusader says, I'm getting the impression that as of right now, for the absolute latest version (v1.4x? 1.5? ) of ASPR, the only thing feasible right now is the inline patch (which is awesome, checked it out on Tag & Rename beta.. worked great). Am I right by saying ASPR author has taken things a step further and made it impossible to RV because 1st thunk is "deleted"? ie now more difficult than ever to rebuild IT?

I understand 1.3 had the Getwhatwewant api cluster (all the emulated API's done in one spot). The "supposed" v1.4 has the little trick:
call getversion
push [blah]
pop eax

to trick to think it is calling getversion when it's really something else..

is there a 1.4x or 1.5 now that goes beyond this?

The most recent ASProtected I've dealt with is HelpJotter. It has 11 unresolved entries, many of them with the above emulation trick, a couple redirects, etc..

Thanks
+SplAj
05-08-2002, 07:44 AM
Hi Lbolt99

You are mistaken that RV cannot resolve aspr now. The only extra problem for unpacking lately is getting the target to stop at OEiP. Alexey put a LOT of decrypt code and heavy looping around the final POPAD, JMP EAX instruction to make it boring.

The trick you mention with

call getversion
push [blah]
pop eax

is correct. In my experience the 11 unresolved API are usually :-

GetProcAddress
GetModuleHandleA
GetCommandLineA
GetModuleHandleA
LockResource
GetVersion
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
GetCurrentProcess
FreeResource

I unpacked few targets over the last evenings, all MAY 2002 compiled exe's , so should be using latest aspr release.

Alexey is playing a very good game with NOT releasing any shareware aspr anymore. It stops specific unpackers for specific versions. He changes subtle things all the time. Now he even taunts us by saying on his web site :
'07.04.2002 New ASprotect beta (for registered users only)'
LOL

Spl/\j
crUsAdEr
05-08-2002, 08:53 AM
Yo Spl/\j,

How have you been?? Still recuperating from the car accident?? Or is your wife banning you from RCE board now :>>>

Hi Lbolt99, sorry i confused you... i was talking about newest AsProtect stripping the "virgin" first thunk from the protected target now, so my dumper cant find where to put import ASCII anymore... and creating a new section require more work to do... that is why the dumper can not rebuild import on newest AsP proggies.. THat only concerns my dumper.. revirgin use the tracer to tracer the redirected import and hence will always work!!!!

regards,
crUsAdEr
foxthree
05-08-2002, 09:28 AM
Yo Crusader:

Did you check out Tesla's First Thunk Rebuilder (has a ASPR-like user interface too. :) ) A perfect remedy for your dumper! May be Tesla would share his source code with you...

Greetings +Splaj "guru":

Howz it going? Long time no post :) Your advices to me are proving to be immensely helpful. Thanks for the same! Did you happen to have a go at SEPP (Virus) :D?

Signed,
-- FoxThree


CrypKey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CrypKey
PDA

View Full Version : CrypKey

jonas18
05-02-2002, 08:09 PM
I read Marigold's article on a previous version of CrypKey. Anyone out there done any reasearch on the newer version of CrypKey and the Site Key Generator?

Newbie Jonas18......
Js
05-02-2002, 09:38 PM
hiya,
you may want to search for threads by peterg, seems to be our
resident CrypKey expert.
regards
Kaz
05-03-2002, 04:16 AM
Anyone notice how the crypkey ppl keep delaying the release of v6?

wtf is up with that :confused:
peterg70
05-03-2002, 11:13 AM
Jonas18

Do a scan on this board for past discussions. Its been done to death.

@JS
Me!! An expert. Maybe someone who is willing to help others learn so he doesn't have to keep answering the same questions
;)

@Kaz
Yeah Now its may 9th. I think their internal clock is stuffed or something. Maybe they have been reading this forum and are having to patch it quite a bit :p

Just a few more days then I have to start looking for the first app using it :mad:

Sigh
peterg70
peterg70
05-05-2002, 05:11 AM
Crypkey Has ammended their countdown again

Date of release : May 22, 2002

Hmmm This is a bit ridiculous

peterg70


Lilttle Help and Info!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Lilttle Help and Info!
PDA

View Full Version : Lilttle Help and Info!

RedStorm
05-03-2002, 12:56 AM
Well Hi there guys this is bit long but heck..., as you can notice am new here and in this world of RE :), but I find it very amusing and interesting...

TBH i started all this just couple of weeks ago...and I got a prob...

I have one dll which has been packed with a packer (what elese :p) I have managed to identify it to UPX...Of course using the plain - D desn't work (reports File has been hacked/protected/modified take care!)...So I found out about ProcDump and try that but when DLL is dumped exe that uses it reports error in certain module...(this was all at the start)...

Ok now I found out that PE needs to be rebuilt (in some cases) when it has been dumped to a HD from memory...BUT I am long way from there...

I am willing to learn but does anyone knows a tutorial which coveres UPX...There are loads on Petite and other packers but I didn't managed to find any tuts on UPX...

I have also used UPXFIX on the file but than I recieve from UPX checksum error?? I did used proggy called FS to set correct checksum so am bit??

I also used ProcDump Editor to change Sections from "bogus" one to UPX corresponding hoping that would fix the issue so I could use - D on the file but no luck still get the: File has been hacked/protected/modified take care!

Any help on this issue will be appreciated...THNX!
Pyrae
05-03-2002, 01:19 AM
Try Krobar's collection (http://zor.org/krobar) - I'm quite sure there are some tuts on UPX.

so long, Pyrae


Honeynet Challenge (With Prizes)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Honeynet Challenge (With Prizes)
PDA

View Full Version : Honeynet Challenge (With Prizes)

radiant
05-03-2002, 02:36 AM
I figure this may interest a few folks around here. It's a project that comes with prizes.

h**p://project.honeynet.org/reverse/

radiant
Kayaker
05-04-2002, 12:37 AM
Wow, this is like the ultimate strainer! You can bet the winners of the contest are going to get high paying jobs from the prize sponsor IDA / DataRescue. Either that or they'll be marked by the police ;->

We've got 3 days to wait to download the binary - Mon May 6. Top 20 submissions get published!

Nice,
Kayaker
ashbhai
05-05-2002, 02:28 PM
and what a contest its going to be... ;)
ashbhai
05-08-2002, 06:20 PM
and the binary is now available for download.... ;)
anyone from here having a go at it??
Kayaker
10-23-2002, 04:13 PM
Resurrecting this old thread...

And the results are in... (actually they were in months ago)

Those interested in Linux reversing may enjoy reading the submissions.

http://www.honeynet.org/reverse/results/

Kayaker
ZaiRoN
10-23-2002, 05:15 PM
good *resurrecting* job! there are many interesting tutorials :)

maybe, sooner or later we'll see a linux based project in this area :eek:

regards,
ZaiRoN


Some Armadilloed Targets for testing....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Some Armadilloed Targets for testing....
PDA

View Full Version : Some Armadilloed Targets for testing....

foxthree
05-03-2002, 07:28 PM
Hi binh/Crusader/the Analyst/others:

The good news is that OEPFinder now supports Win2K perfectly ....errr not so perfectly. It has some problems with Armadilloed exes. Unfortunately, I don't have any arma targets (2.51, 2.52) with me (except with VtE sent me. VtE see below!). Can you guys mail me some arma targets to foxthree@asm.net so that I can see what goes wrong? I could release without ARMA support but I guess may people may not like it :D

Pls. help me to help you ;)

VtE: Damn that 40-digit protection, can you pm/mail me how to remove it. I can analyze only if I can run. What kind of people give eval which can't be run? Grrrrr..... Help, please ;)

binh/the analyst: I know that you guys are the resident ARMA experts. URLs please ?:)

Thanks a lot guyz,

Signed,
-- FoxThree
VtE
05-03-2002, 09:31 PM
Hi FoxThree,

You got mail.

I know that is very embarrassing the 40 digit protection. And it's locked to your computer. You cannot move it to an another computer without a new key. It's encrypted with Twofish Algorithm.
The author of this software said that the chance to success to unprotect it is NULL.
fALC0N
05-06-2002, 06:23 PM
maybe you can on try this...

*w*.!he!hink!anksof!ware.com
foxthree
05-06-2002, 07:48 PM
Hi Falc0n:

Thanks for the tip off! I'll take a look... (Ummm 10.13 MB :)...)

Signed,
-- FoxThree
crUsAdEr
05-06-2002, 11:02 PM
ULTIMATE!!!!!!!!

Not like VB program are not bloated enough... this VB target is doubly bloated with Armadillo... a joy to dumper this....

Good practise on armadillo as no IAT mangling at all :>>
fALC0N
05-29-2002, 06:03 PM
Anyone successful at this yet?
foxthree
05-29-2002, 06:49 PM
Hi falC0n:

If you mean "unpaxing" Armaed targets, yes. There has been a wealth of information posted by Crus and others on Arma.

If you're talking about OEPFinder, it will be released in a few days (or weeks ;))

Signed,
-- FoxThree
fALC0N
05-29-2002, 11:52 PM
Hi foxthree,

Yes the above one still remains paxed for me :( It simply refuses to run.
Have you unpaxed that one?

Cheers,
f.
foxthree
05-30-2002, 07:11 PM
Hi Falc0n:

No. I just used it to test my OEPFinder whether it finds the OEP correctly. However, I'll try unpaxing it and let you know. Look for Crusader's post on how to unpax Arma'ed targets. You'll get a lot of help ;)

Signed,
-- FoxThree
Stone()
06-01-2002, 10:00 AM
If you want to test some nice arm apps in their latest versions look at the proggies at hxxp://www.collectorz.com
JMI
06-01-2002, 11:32 AM
Stone():

No direct posts please. Change the http to hxxp or some such and/or turn off the "Automatically parse URLs" flag in the Options.

Regards.


ReVirgin 1.31 problem with large IAT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ReVirgin 1.31 problem with large IAT
PDA

View Full Version : ReVirgin 1.31 problem with large IAT

Lbolt99
05-03-2002, 09:30 PM
Hi, I've been using RV fine on many things but it seems to be hiccuping on creating the IT binary for a large program I'm working on. The target is Helpjotter 6.0.19.201.

Its protected with ASPR 1.4+ but that doesn't seem to have anything to do with the problem. I used RV successfully to get the IAT except for the unresolved entries, which I fixed.

BTW I'm not sure if this would be fixed in 1.4 -- I couldn't get it to run, even after changing the date/time stamp.

Anyway, it seems to want to generate a 8.9MB .bin from the IAT list. I've attached the IAT list for review, if anyone else wants to try it. The IAT RVA is 3F41F4 and the length A9C. After dumping, it should be pasted at offset 00588000.

Please note that every other IT I've generated with RV has worked fine. The only differences are that this one is significantly larger than other's I've worked with.

I tried both auto-pasting it with RV (created 14mb file from 5mb dump :( Also tried simply creating the .bin. Neither method worked.

Thanks for helping
Lbolt99
05-06-2002, 04:39 PM
Follow-up:

This morning I downloaded IMPRec 1.3 from Programmers Tools. It is a convoluted mess and I had to fix lots of things to get the IAT to match the Revirgin one I had.

There does appear, unfortunately, to be a bug in RV, at least v1.31. IMPrec successfully created the binary IT to paste onto the end of the dumped file.

As said before, the IAT processed with Revirgin creates a 9 meg .bin file. I think something in the IAT is throwing off RV and causing an endless loop somewhere in the program.

Anyway, I have informed .tsehp and hopefully it'll be fixed in RV 1.41 :)
Lbolt99
05-06-2002, 07:48 PM
Another quick update:
I looked further into the 9mb IAT file that RV created. It turned out that it just appended 8.x mb of 0s to the end of the file. I truncated it all. Basically if you run into this problem with RV and do this just make sure you leave two bytes (zeros) after the text string of the final thunk: example:

GetOpenFileNameA..

The two dots would be your 0x00h 0x00h, and then the file ends.

RV 1.4 had same problem. I got RV to run by doing this:
bpx messageboxa
ret until u see exitprocess in code below
change ip to xxxxxxb5 (will be a dec instruction a few instructions away)
it'll run then

Helpjotter runs after pasting it!! No Dips found so far..


Loader Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Loader Question
PDA

View Full Version : Loader Question

Cyber
05-03-2002, 11:47 PM
I always seem to get a problem with loaders / process patchers
i have a program which is packed with armadillo and i could only get one loader to work with it and it works 100% but if i distibute the loader it doesnt work on some other ppl's machines especially if its a different operating system
i have had this problem with a few programs i have cracked especially if the loader is being used on XP / NT or Win2k and it was done on Windows ME

Can anyone tell me why this is and more importantly how can i fix it or suggest a loader that will work no matter what machine or operating system it is being used on?

I presume that different operating systems are somehow allocating memory diffently and so the memory offsets are different, can anyone suggest a loader that doesnt use a virtual offset but instead will work out the offset off the oep or does a memory search and replace (is this possible with a loader)

TIA
Hwoarang
05-05-2002, 08:33 AM
I use DZA Patcher, it can PATCH latest armadillo targets, but it can also do loader and it worx fine;)
Cyber
05-05-2002, 06:06 PM
Thanx for your help
i do have that so i will try that and post my results here :)
Cyber
05-06-2002, 01:17 PM
Thanx for your help, it now works 100% on all operating systems
i had tried it but had one of the settings wrong :):):)
Aimless
05-07-2002, 09:56 AM
You could also try:

http://www.programmerstools.org/

They have a lot of patchers there.

...Have Phun


CRC Checkup...Need some info!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CRC Checkup...Need some info!
PDA

View Full Version : CRC Checkup...Need some info!

RedStorm
05-04-2002, 12:01 AM
Is there a way (any tools) to change checksum of the file so when CRC is performed it "believes" nothing has been changed??

I used LordPE (something similar to ProcDump) but it doesnt do the job...Unless CRC is bit more than just plain Checksum...

I did test....

Test 1. I do not touch any info iside of the exe with any HexEditor but use LordPE to change to some custom Checksum it reports invalid exe...

Test 2. Than I use HexEditor to chage single byte inside (ofcourse checksum changes) REPORT: Invalid Exe

Test 3. Than in edited exe I change the Checksum to match the Checksum of the UNTOUCHED file but still REPORT: Invalid exe....

Any ideas??
mike
05-04-2002, 01:35 AM
You have to know what checksum they're performing. Is it CRC32? MD5? Something they made up themselves? If it's CRC32, then finding the correct bytes is almost trivial. If it's MD5, you've got about the same probability of finding the correct byte as the probability that all the quarks in your underwear will jump six feet to the left and reassemble themselves as a can of mandarin oranges.
Pyrae
05-04-2002, 04:42 PM
Hi mike and others,
some more info on the 'trivial' finding of the correct bytes in a CRC32 style checksum would be much appreciated as many protections still use a CRC32 sum over the whole file.

@RedStorm
The CRC value LordPE can correct is only a checksum of the PE header - therefore it's absolutely irrelevant for any validation checks over the whole file.
Jon
05-04-2002, 07:20 PM
well dont know how to answer your qestions but u have troubles patching a file with CRC check just make a loader...
ancev
05-05-2002, 11:01 PM
hi,

if is crc16, 32 or 48, you can use that tool.

ancev

ps: sources(in asm, of course) included.
whyIII
04-09-2004, 04:19 AM
let me try it first
dELTA
04-09-2004, 07:39 AM
The suggestions so far in this thread seem to be about creating a patch that preserves the original checksum, or in other ways unnecessarily complicated. The common way would be just to make any patch you want, then see what checksum this results in, and then patch in this checksum as the "correct" one in the application, simple as that.

PS1.
Of course, when finding the location where the "correct" checksum i stored, you have most likely already located the checksum compare code, and might as well patch a jump in that one instead.

PS2.
The only time this will not work is when something in the application will be decrypted at runtime, having the checksum as the key. In this case, patch the crc function to always return the original "correct" checksum instead.


SI install problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI install problem
PDA

View Full Version : SI install problem

grasii
05-04-2002, 08:59 PM
After instaling the SI 3.25 and restarting the win i got this message: "While initializing device CONFIGMG
Windows protection error. You need to restart"

I've changed the version from SI 3.24 to 3.25 and nothing. I've changed the driver in SI Display adapter to standard VGA and nothing. I've used befor this install the 3.25 version and had no problems.
Thanks in advance!
crUsAdEr
05-04-2002, 09:49 PM
gosh,

Why dont you get sice 4.05 or something? Are you on win95 or win3.1? :D


Loader
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Loader
PDA

View Full Version : Loader

npanic
05-05-2002, 12:30 AM
I wrote a loader in Delphi, and it works just fine on all versions of ASProtect. The file size is big, but it works.

I can send the source to you if u like, i don't have it on the computer i am using now.

(don't laugh at my source, i'm newbie in programming)

ADD ON: I would like 2 rent a hacker and the maybe he or her would be so kind to kill this thread...:D
carfranca
05-05-2002, 03:23 AM
Do you send me?
carfranca@zipmail.com.br

thanks


Hall of Shame
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hall of Shame
PDA

View Full Version : Hall of Shame

Woodmann
05-05-2002, 12:58 AM
Howdy,
For those who decide to not read the FAQ, I will delete your post but save the text for all to see the lameness.

I have CASPR version 1.100 b9, but lastest software protected by Asprotect can't be unpacked with this util (unknown version). Have anyone newer version of this progie, or link, where to get lastest version of this cool util ?
Or maybe have you other soft, that can unpack lastest version of Asprotect ?

Is there a problem with the search feature on this message board?
Is Google broken?

Peace, Woodmann
crUsAdEr
05-05-2002, 01:33 AM
Hi Woodmann,

Not being busy-body here i hope, but personally i feel that for a newbie whose skill is initially limited to patching and disassembling... playing with a packed prog is not possible hence an unpacker is required in initial state... like when I first play with packer, i needed every single tool like revirgin, procdump, /tracex to aid my initial step.. as i go on i learn to use less of them and manually do stuff... but it all takes time and some initial confidence...

This guy might or might not be a lamer... as the way i see it.. is it a bit too harsh on him if he was just a newbie trying to learn? I thought that putting him right up to Hall Of Shame might be a bit too harsh, rather some advices might be more appropriate? At least it is not "I cant crack this product, will someone look into it for me?"

Just my 3 cent :>
(actually it's worth at least a pound :> with all the brain cell wasted in how to phrase this :>)
crUsAdEr
Woodmann
05-05-2002, 02:24 AM
Howdy,
Your input is welcome at all times, dont be afraid to "take me to task" when posting.

What I dont like is the fact that the poster has maybe used CASPR and is now depending on someone to provide the information needed to aid in unpacking Asprotect when he/she should have searched.

It has already been stated that "the way you phrase your question" will be what determines the response.
As far as I can tell this person did nothing more than make one attempt at Aspro and then decided to ask for help instead of searching the approx 189 post concerning Asprotect.

The bottom line is he/she asked for a "progie or software".
It goes against the FAQ, which nobody seems to read.

If a newbie knows the target is protected by Aspro, then they should know enough to search that protection.
It was also posted in the wrong forum, another thing one would have noticed by reading the FAQ. Newbies post in the newbie forum if he/she was a newbie. Asking for tools is a most heinous crime, it doesnt matter what forum it is posted in.

Now, since about 8 people saw the original post, I dont think anyone will remember who wrote it. The original poster may re-phrase his/her question and try again.

This is like school, show your work and you will get a response regarding your problem.

Peace, Woodmann
(CrUsADer, you owe me 2 pounds change :P )
Kayaker
05-05-2002, 03:13 AM
I like the blinding new Read the FAQ heading.

(No brain cells needed ;>

Kayaker
JimmyClif
05-05-2002, 05:28 AM
No need for " IITYWTMWYBMAD " by that one :-D

(kinda hurts my eyes tho ;) )
crUsAdEr
05-05-2002, 10:03 PM
LOL...

I see your dark plan now Woodmann, so this is your ultimate goal? Tricking innocent newbies like me and extorting money!!! :D

Nah, i have learnt.. never give your money to woodmann... now if you dont send a cheque over to my account in 48 hrs time, i will report this case to police and you are in big trouble!!!! :cool:

Signed,
Anonymous :D :D :D

P.S : yeah i love that big nice read the FAQ on top.. should have done that earlier :>
nofurs
05-06-2002, 11:54 AM
Hi All,
Let them have the chance to post 3 times if they still
ignore bashed them hahahaha

Peace? NAH ;ppp

!shitlist cluesurf


Loader problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Loader problem
PDA

View Full Version : Loader problem

carfranca
05-05-2002, 03:29 AM
Where i find tutorials about loaders?
Thanks.
Kayaker
05-05-2002, 04:42 AM
Hi

There may be a few scattered around. Check the I.D. and Crackz archives and the main essay site. Look for things like loaders, game trainers, memory dumpers, these should give you coding examples to be used in building a loader.

The PE format is also critical, you could check out source for accessing all the important PE structures from something like PE Labz 1.0 by Latigo.

The best way to learn is reverse a simple existing loader to see how it is set up and which calls are used.

Have fun,
Kayaker
npanic
05-07-2002, 11:54 AM
I tried 2 send u the loader source(delphi), but i keep getting the mails back!!!

i send it 2 this address -

carfranca@zipmail.com.br


SoftIce Prob...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftIce Prob...
PDA

View Full Version : SoftIce Prob...

RedStorm
05-05-2002, 05:29 AM
I installed SoftIce on meh machine and its ok...When I need it ctrl+D works fine...But funny thing is When I play games (RTCW Q2 etc.) SoftIce pops up in debug screen and in 9:10 times I need to Reboot...

Is there a way to turn this thing off so that SI is put to use when I really need it?

Thnx!
JimmyClif
05-05-2002, 05:46 AM
Only load SoftIce when needed (Rule #1)
Use faults off (Rule #2)
Don't eat the yellow snow (Rule #3)
Aimless
05-07-2002, 09:58 AM
Or,

the game may be detecting the ice.

Why don't you disable the ICE whenever you want to play a game?

...HAve Phun


Q on UPX packed files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Q on UPX packed files
PDA

View Full Version : Q on UPX packed files

RedStorm
05-05-2002, 06:07 AM
Ok I got few nice toots on UPX but mainly they cover *.exe files and how to remove nag and tag, tht sort of stuff...and thnx for that...I got it covered

But does some1 know any tuts how to restore dumped files which are not *.exe but *.dll...

I mean complete tute how to restore dumped file so its functionable again when loaded...(excuse my n00b vocabulary :p)
npanic
05-09-2002, 11:20 AM
I'm not sure, but krobar's tut section is very good, there is a link 2 it further down on this site. It's worth a try, but prepare for downloading tons of tuts, couse u simple cant stop finding stuff u want.
esther
05-09-2002, 12:44 PM
Hi RedStorm ,
Search the forum there are some discussion on this
And again....
Rad the faq first search it before you post anything here and don't cross post too much.........................................................

Originally posted by RedStorm
Ok I got few nice toots on UPX but mainly they cover *.exe files and how to remove nag and tag, tht sort of stuff...and thnx for that...I got it covered

But does some1 know any tuts how to restore dumped files which are not *.exe but *.dll...

I mean complete tute how to restore dumped file so its functionable again when loaded...(excuse my n00b vocabulary :p)
+SplAj
05-09-2002, 12:48 PM
Hi

May i take the liberty of asking if u r fully aware of all command line entries for UPX ....including -d to decompress the target automatically ???

Spl/\j
npanic
05-09-2002, 12:53 PM
ain't there a "goldversion" or something that can't be Decompressed by the compressor?

I actually dont know it, but i think i red it somewhere....

Sorry for the word goldversion, i couldnt find a proper one...
npanic
05-09-2002, 12:54 PM
BTW, why don't we just inline it.... :-)
Kilby
05-10-2002, 02:38 PM
Theres several manglers to mess with the file and prevent the -d command from working, UHARCX 0.4 is an example of a file packed in theis fashion.

You could always dumped .exe by hand, as with the aid of icedump it took about 2 minutes to get a working version of an uncompressed uharcx.

Considering that I had never dumped a upx shows that it's an easy task.

Look for the (as I remember) jmp eax for the oep.

Theres no excuse even for a very new newbie not to try a manual unpack on upx.

Kilby...
RedStorm
05-10-2002, 08:04 PM
Originally posted by +SplAj
Hi

May i take the liberty of asking if u r fully aware of all command line entries for UPX ....including -d to decompress the target automatically ???

Spl/\j

Hmm me not trying to sound cocky but I don't think I would ask that Q here if I haven't tried that, I ask Q when I have to, and since I am new I need pointers. If you kind enough to help I will appreciate that, and I'm not that hold my hand while I am done guy...

Nuge me in the right direction and I will find solution...after all if you always get the solutions on the plate how you gona learn anything

:D

Am I right or I am right :D
+SplAj
05-10-2002, 10:26 PM
Hi RedStorm

As UPX is a compressor and NOT designed to be a protector per se I just offered the option of -d !
However if you are interested in unpacking manually thats great :

Do you still want some help ? R U running Win98/ME with icedump ? ......if so it will take seconds to show you ;)

As Kilby mentioned there are some UPX fuxors around , does ur target dll have any trick UPX ?

Spl/\j
Lbolt99
05-11-2002, 04:46 AM
the trick is to get the dll to load at 10000000

I've only cracked one.. websnatcher IE protected with ASProtect 1.3.

Basically, it's the same as removing ASPR from and EXE file.

What I did was use a "clean" bootup so that nothing else was taking up the memory space where I wanted the dll to load (10000000). So that it wouldn't relocate upon loading.

Dumped memory at OEP as usual.. ran RV, fixed unresolved, pasted new IAT. Same process as an EXE (assuming your DLL loaded at 10000000)

There was an indirected call that had to be patched. Changed it to a direct call, but also had to alter the relocation table. It was easy to figure out with LordPe and a good PE document. Had to do this because the indirect call needed to be offset if the dll relocated. But with a direct call, no relocaion is needed.

in summary, if you unpack it the same as you would an EXE, assuming load addr = 1000000, it should work fine. Additional work might need to be done if you have to patch an area of the file there relocations are calculated.
+SplAj
05-11-2002, 09:49 AM
break at 10000000 image base etc etc :-

To break into ANY exe/dll at the entry point for easy tracing just
examine the header with LordPE.

Eg mydll.dll = imagebase 10000000 entry point A910 so 1000A910 == packed eip.

now in SI (Win98SE) type 'BPX ORD_0056+94 if eax==1000A910'
and when you run your target exe whenever it loads the dll SI will pop :) and you have full control of your dll.

If you just type BPX ORD_0056+94 you will pop at EVERY exe/dll load point....

Spl/\j


Hero IV
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hero IV
PDA

View Full Version : Hero IV

iHqq
05-05-2002, 12:07 PM
help !!
i want to write a progame that can modify hero's data in hero IV.but the first problem is to find hero's base address.
in softice i make breakpoint
bpx 52ece3
so when game break on here!
the value of eax -c+74+10 is the address where hero's base address store.

the value is changged when you restart game!
how can i get the hero's base address.
npanic
05-09-2002, 05:37 AM
Is it a trainer u wanna create?


New SEPP protector from aNti-Crucking...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New SEPP protector from aNti-Crucking...
PDA

View Full Version : New SEPP protector from aNti-Crucking...

evaluator
05-05-2002, 06:30 PM
Seems finally aNti-Crucking released their newest-cruel
EXE-password-protector:) with ANTIdbgDRIVER!

Hey, SPLAJ!
Look at this, they finally did driver!?

I included in package both: Driver(NT/XP) & VXD (W9x)
This VXD seems a tracer?

Little help, please:
Who knows, how is possible reversing of DRIVER or VXD!?
evaluator
05-05-2002, 06:38 PM
tried upload
foxthree
05-05-2002, 06:53 PM
I smell a heavy polymorph in this as NAV flags this one as W95.Fono. Anyways, happy reversing ;)

Signed,
-- FoxThree
Tola
05-06-2002, 01:09 AM
evaluator, ida can handle vxd and sys files.
btw, the nt driver looks like a 90% copy/paste from a sample driver written in asm by someone called 'MadPrgmr'.
ancev
05-06-2002, 11:57 PM
hey,

and if its detected as w95/fono, he stole my poly engine, coz i am the author of that virus ;)

hehe... lucky he didnt found about others ones from me, also published with source, that have a very better poly engine to him ripe

code ripping isnt a shame... shame is ripe 1997 code :p

ancev
Aimless
05-07-2002, 09:48 AM
For crying out loud....
separator
05-10-2002, 11:47 AM
Hello all,
yes SEPP was protected with polymorph code too, but it isn't why NAV detects it as virus Win95.Fono.

There is very normal procedure:

call delta
delta:
pop ebp
sub ebp, (delta-start)

Maybe it is at special file pointer or I don't know. If I removed this code, or add instruction(s) to this code NAV doesn't detect it as virus. I tried other antivirus programs like NOD and they didn't detect SEPP as virus. I think it is problem NAV virus database.

ancev: Bad news SEPP doesn't use your simple polymorph engine from Win95.Fono. Yes it uses poly engine, but more complex than uses Win95.Fono.

evaluator: Can you send me your e-mail ? I want to ask you to one question. Thanks.
Hwoarang
05-11-2002, 09:49 PM
that getdelta to ebp routine is found in most viruses why would nav flag it to be infected exactly by that virus?? nav sux, anyway thats the general idea: av programs sux (give fake alarms, crash computer, corrupt files..etc.)
hey best anti-virus is softice;) u should try it
bart
05-12-2002, 10:05 PM
SEPP -> recompiled -> rebuilded -> patched

h**p://www.ctrl-d.prv.pl/crack/sepp10.zip

but still doesnt work on 2K :(
Dr.Golova
05-12-2002, 11:16 PM
Originally posted by bart
but still doesnt work on 2K :( [/B]

Corrupted menu entry in dialog template. Fix it to 102 and all works fine.
+SplAj
05-13-2002, 01:10 PM
Bart,

thanks for cheering me up today. That 'Special_protector_help.rtf' file is definately on my base-level ;)

Spl/\j
Ni2
05-13-2002, 03:36 PM
+SplAj, Bart,

I think i missed the joke, the link http://www.ctrl-d.prv.pl/crack/sepp10.zip doesnt work :(

What was so funny then? ;)

Regards,
Ni2
wbe
05-14-2002, 09:28 AM
The link works. Try the first hours of a day, CET.

It was funny indeed.
bart
05-14-2002, 10:14 AM
now its fixed & works fine in 2k, thnx dr. golova (andrew golota?)

h**p://www.ctrl-d.prv.pl/crack/sepp10.zip


super-tiny PRNG
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > super-tiny PRNG
PDA

View Full Version : super-tiny PRNG

mike
05-06-2002, 01:31 AM
Adi Shamir proposed this three-op PRNG:

x+=(x*x) | 5;

x is a k-bit integer, so there's an implicit mod 2**k. For example, if k==16, then in C you'd have

unsigned short x;

or if k==64, you'd have to use

unsigned __int64 x;

Anyway, the high-order bit is all you get from each iteration. Assuming x is too big to brute-force, how do you find the current seed? A three-op PRNG has to have some kind of weakness...
cyberheg
05-06-2002, 06:24 PM
Without beeing an expert like many others here I'd like to ask a few questions to get this down to human level :)

Why OR with 5? I can understand that this would give noise on the lowest bits to make it harder to find the initial seed but why OR instead of like XOR and why 5 instead of another small number like 7?

I remember a some time ago program using a multiplication like above:

result (128 bit) = var1 (64 bit) * var2 (64 bit).
The upper 64 bit of the result would be cut off so the end result would also be 64 bits. The task was then to find a var2 where var1 could not be changed and to make the valid result (which should be 0x0000000000000001 (the upper 64 bits are cut off and not visible).
The method to solve it was to do trial multiplications (not simple bruteforcing) to find which bits were best to set for a given result.

Comparing these two things makes me think it's similar (please correct me if I am wrong). Var1 and Var2 is the same in the PRNG case and assuming we start with x beeing 0 (at the start) then it should also be possible to find the number which would give this, no? Ofcourse the OR would give some noise which would make more possible cases since OR will make us miss those original bits which were originally there (just by the multiplication).
5 in binary is 101 so only very few bits are damaged which shouldn't make too much extra work to test for each of those cases where the bits are set/not set.

I also assume this works best with a ODD initial seed so the lowest bits are also set.

Thanks in advance.
mike
05-07-2002, 04:40 PM
When you OR with 5 (or any other number congruent to 5 mod 8) you get a single long cycle. If you OR with an odd number, you get a permutation, but not necessarily one cycle.

Try splitting it up into cases according to what the "noisy" bits are, i.e.

x=8y+c

and look at what happens to c and y when it gets updated.
ancev
05-17-2002, 01:17 AM
hi,

i converted the c random generator to assembler.

;x+=(x*x) | 5;
rnd:
mov eax,12345678h
seed equ $-4
imul eax
or al, 5
add [seed],eax
ret

when i use XOR instead of OR, i get a output sequence that 'looks' more random.

How i can test this routine for patterns and like? There's a standard for testing random generators?

ancev
tE!
05-24-2002, 09:10 AM
There's no standard for testing prng's, but there're a lot of different algorithms/ways to test randomness of the output of your prng. One application that makes use of some of them(Entropy, Optimum compression test, Chi square distribution, Arithmetic mean value, Monte Carlo value, and Serial correlation) is 'ENT' - available here: http://www.fourmilab.ch/random/

I used it in the past to 'test' 10MB sequences of pseudo random data - the output of some of my selfmade generators. I'd say that such statistical tests, as used in ENT, don't say everything about a sequence's randomness, but I guess they're a good point to start with.
cyberheg
05-31-2002, 07:04 AM
I now implemented this as a 32 bit RNG and ran a test on it on a 20 mb file:

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <time.h>

int main()
{
FILE *fp;
int i;
DWORD dwRandom;

if ((fp = fopen("random.txt", "wb")) == NULL)
{
printf("File could not be opened\n");
return 1;
}

dwRandom = 0x87654321;

for (i = 0; i < 0x500000; i++)
{
dwRandom += (dwRandom * dwRandom) | 5;
fwrite(&dwRandom, 1, sizeof(DWORD), fp);
}

fclose(fp);

return 0;
}

This gave the following results:

Entropy = 7.999997 bits per byte.

Optimum compression would reduce the size
of this 20971520 byte file by 0 percent.

Chi square distribution for 20971520 samples is 99.31, and randomly
would exceed this value 99.99 percent of the times.

Arithmetic mean value of data bytes is 127.4840 (127.5 = random).
Monte Carlo value for Pi is 3.140386118 (error 0.04 percent).
Serial correlation coefficient is 0.000080 (totally uncorrelated = 0.0).

The only test which really stands out is the Chi square test.

Additionally I took a 10 mb file from www.random.org and ran it through the same program which gave the following results:

Entropy = 7.999983 bits per byte.

Optimum compression would reduce the size
of this 10485760 byte file by 0 percent.

Chi square distribution for 10485760 samples is 239.88, and randomly
would exceed this value 50.00 percent of the times.

Arithmetic mean value of data bytes is 127.4760 (127.5 = random).
Monte Carlo value for Pi is 3.141733987 (error 0.00 percent).
Serial correlation coefficient is -0.000196 (totally uncorrelated = 0.0).

Here you see the Chi square test give totally different numbers. Now the question is whats good and whats not. From what I understood reading the discription less then 1% or higher then 99% would be nonrandom data. They give a example of from a radio active source which gives the value 75.00% but I can't really determine which is better between the random file from random.org and this radio active source.

I concluded that the 3 op PRNG is much better then rand() in VC++ which I also ran through the same test. Rand16 from flexlm 7.1x is only half as good as the rand() and unix rand() is better then any of those two but still weaker then the 3 op PRNG.

Maybe someone can comment on this Chi square test.
mike
05-31-2002, 03:32 PM
You got it almost right. Don't write out the whole word, or it's trivial to predict the next one. (x'=(x*x)|5, of course.) In fact, it's easy to break if you output any of the bits other than just the top one. Only write out the top bit, i.e. instead of

for (i = 0; i < 0x500000; i++)
{
dwRandom += (dwRandom * dwRandom) | 5;
fwrite(&dwRandom, 1, sizeof(DWORD), fp);
}

do this

unsigned char j,k;

for (i = 0,j=0; i < 0x500000; i++,j=(j+1)&7)
{
dwRandom += (dwRandom * dwRandom) | 5;
k=(k<<1)|(dwRandom>>31);
if (j==7) fwrite(k, 1, sizeof(char), fp);
}

I'm not sure why your randomness test didn't detect this, but the low bits repeat every 2^n iterations.
cyberheg
06-01-2002, 09:11 AM
Now I realize I didn't read your initial post fully which is also why the first post I made doesn't make sense if one understands that it's only the highest order bit which should be saved.

Anyway I fixed the code and come with new test results:

#include <stdio.h>
#include <windows.h>

int main()
{
FILE *fp;
int i;
unsigned char j, k;
DWORD dwRandom;

if ((fp = fopen("random.txt", "wb")) == NULL)
{
printf("File could not be opened\n");
return 1;
}

dwRandom = 0x87654321;

k = 0;
for (i = 0, j = 0; i < 0x5000000; i++, j = (j+1) & 7)
{
dwRandom += (dwRandom * dwRandom) | 5;
k = (k << 1) | (unsigned char) (dwRandom >> 31);
if (j == 7)
fwrite(&k, 1, sizeof(unsigned char), fp);
}

fclose(fp);

return 0;
}

The new results are:

Entropy = 7.999981 bits per byte.

Optimum compression would reduce the size
of this 10485760 byte file by 0 percent.

Chi square distribution for 10485760 samples is 280.64, and randomly
would exceed this value 25.00 percent of the times.

Arithmetic mean value of data bytes is 127.4376 (127.5 = random).
Monte Carlo value for Pi is 3.143244607 (error 0.05 percent).
Serial correlation coefficient is 0.000299 (totally uncorrelated = 0.0).

Now it seems the Monte Carlo Pi test is a bit worse while the Chi square test is much better. I still wonder those which value is best for the Chi square test. Now I've seen 3 "possible good value" 25%, 50% and 75%.

Thanks for giving me the tip for fixing the code Mike.


pcode vb help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > pcode vb help
PDA

View Full Version : pcode vb help

mambox
05-06-2002, 01:45 PM
hi

i'm trying some rev on forester,a pcode visualbasic.

where can i find nfo about the pcode opcode value?

i used josephco exdec to decompile but dont understand how the branch work..here:

496869: 1c BranchF: 496895 ****(here)
49686C: 27 LitVar_Missing
49686F: 27 LitVar_Missing
496872: 27 LitVar_Missing
496875: f5 LitI4: 0x0 0 (....)
49687A: 3a LitVarStr: ( local_00C8 ) License Key Not Valid!
49687F: 4e FStVarCopyObj local_00B0
496882: 04 FLdRfVar local_00B0
496885: 0a ImpAdCallFPR4: _rtcMsgBox
49688A: 36 FFreeVar
496895: 1b LitStr: UNREGISTERED
496898: 54 FMemStStrCopy
49689D: 1b LitStr:
4968A0: 54 FMemStStrCopy
4968A5: 1b LitStr:
4968A8: 54 FMemStStrCopy
4968AD: f4 LitI2_Byte: 0x0 0 (.)

*** how is the 496869 offset calculated to reach 496895?
main code dumped from the exe give

00496869: 1C09 sbb al,009 ;" "
0049686B: 0327 add esp,[edi]
0049686D: E8FE2708FF call 0FF118470
00496872: 27 daa
00496873: 28FF sub bh,bh
00496875: F5 cmc
00496876: 0000 add [eax],al
00496878: 0000 add [eax],al
0049687A: 3A38 cmp bh,[eax]
0049687C: FFDB call ebx
0049687E: 004E50 add [esi][00050],cl
00496881: FF0450 inc d,[eax][edx]*2
00496884: FF0A dec d,[edx]
00496886: 36001400 add ss:[eax][eax],dl
0049688A: 360800 or ss:[eax],al

so the 1c is branch opcode and 0903 give access to 496895,thats what i dont understand and secondly where to find whats opcode pcode mean?
like 1c=branch or 0a=impadrcall etc..

thanks for any help..i'm lost
figugegl
05-06-2002, 02:41 PM
when i downloaded exdex there were a couple of tuts included in the zip-file. they explain the basics, i.e. opcodes for jumps and how to calculate the offsets. they're included in the attached zip-file.

to learn more about the opcodes, have a look at the wkt vb-debugger.

figugegl
mambox
05-06-2002, 05:16 PM
thanks,i jump to unzip :D
wbe
05-06-2002, 10:09 PM
It seems you shouldn't have arrived at that point (496869). Scroll a bit up and find a previous Branch which jumps past or before that address and possibly onto a "LargeBos".

Quick Hint:
1c: jump if false
1d: jump if true
1e: unconditional jump

Now for the disassembled text. It is completely useless. Discard it. To calculate the address to jump (destination), you have to find the start address (base)of the Procedure (not the proc number!). It is your starting point regardless of the destination you go. Example: your proc starts at 496000, you'd like to jump to 496005 you need 0500 bytes, to jump to 497005 you need 0510 bytes. So, at ANY address in between these block of bytes inside the proc, you can put 1E0500 to unconditionally jump.

You may want to try Muad'Dib & noptical's p-code jump generator attached.
mambox
05-07-2002, 09:46 AM
thanks!!

it was the mystery! :)

solved thanks to you 2!

xxx


Break point on memory not work?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Break point on memory not work?
PDA

View Full Version : Break point on memory not work?

neshannel
05-07-2002, 12:47 AM
Hi,

I find string in memory (s 300 l ffffffff 'Some string') change that string, then put break bpm or bpr point on that adress, exit from softice ctrl-d, programs get that changed string but softice not popup!

Anybody can help why softice not popup on memory break point?
JMI
05-07-2002, 01:25 AM
First, it would be helpful if you would read the FAQ because then you would know that you shouldn't be posting essentially the same question on two forums. You are having a problem with Softice. Learn to use the search button on the top of each of the forums and you will find a great deal of information about why and on which operating systems breakpoints work and on which ones they don't.

Second, how is anyone going to help you if you give no information necessary to help you. For example: Which operating system are you using? It makes a difference to which features of Softice work and which ones don't work. Which version of Softice are you using? What, if anything do you know about Softice? For example have you read any of the fine tutorials on using Softice? Do you understand the difference between BPM, BPR and BPX?

You will find more help here if you are willing to do work on your own and show that you have done some work in the way you form your question. Show what you've done to help yourself and then ask for someone to help you learn more.

Regards.
neshannel
05-07-2002, 01:37 AM
I know to use SoftIce, and know diference what is bpm or bpr or bpx.

I use SoftIce 4.05 on Win98SE. I first find that string in memory and change string then I put break point on adress where is that string bpm 0030:c51809d2 program get that changed string but softice not popup??
crUsAdEr
05-07-2002, 01:42 AM
hi neschannel.

What program are you playing with?

Your bpm might be cleared off by the program... does your bpm usually works on other program? If so then that is prolly the case...

You might want to delete the thread on the TOT forum... save the admin some work... and read the FAQ, it is really big on top, consider yourself lucky that noone bashes you yet :>>

Regards,
crUsAdEr
neshannel
05-07-2002, 01:48 AM
Sorry for posting message on two forums it will not happen yet.

About that program.
Program use protection from softice but I run frogsice and programs then run. Program generate string in run time and string change location in memory every time when programs start.
neshannel
05-07-2002, 01:57 AM
I try to delete from TOT forum but I have no permission
Clandestiny
05-07-2002, 03:20 AM
Hiya,

SoftICE uses the debug registers for bpm style breakpoints. If your app doesn't respond to memory breakpoints, I'd suspect some Anti-SICE tricks. Some apps, clear or modify the debug registers to disable these breakpoints.

Excerpted from Spath's excellent winice internals essay:
**************************************************
BPM is used to set a breakpoint on memory access or code execution,
based on debug registers. The breakpoint type is stored in the breakpoint
structure, and is translated into the R/Wn fields of DR7 :
code execution = 00
data write only = 01
data read/write = 11
data read only = 11 (read and write sorted in the handler)

A BPM for data access can be set on byte, word or dword ; when setting
such breakpoint, SoftICE checks for correct address alignment, according to the chosen size (which actually is not necessary, since the processor performs automatic alignment). Following debug registers' behaviour,
the breakpoint is triggered if any of the bytes accessed is in the
range defined for the breakpoint.

A BPM on execution can be set on any piece of code with any size (as
long as alignment is correct). However, you should be very careful here
because of the lack of command line checking : to have a chance to be
triggered, the breakpoint must always be set on the address of the
first byte of the instruction, and must also have a byte size. Any
other address/size combination, even accepted by SoftICE command line
parser, will never trigger.

**************************************************

1) Read up on debug registers in your intel docs

2) Read more of Spath's excellent winice internals essay to gain an overview of how SoftICE implements the various style breakpoints...
ht*p://mail.sarai.net/pipermail/2600/2001-July/000023.html

3) Read some tuts on anti-debug tricks

4) Check into available tools (ie. Super BPM for win 9x)

Cheers,
Clandestiny
Kythen
05-07-2002, 05:31 AM
There's a very simple reason you're not getting it to break. You're setting a bpm on the buffer softice uses for commands! 0030:c51809d2 is in SoftIce's data, not your program's. The string must not appear in your program's memory at all. SoftIce's search feature scans all of memory, including it's own. So it will always find your search string, but that false positive will be the command buffer if the string isn't found.
Aimless
05-07-2002, 09:41 AM
Do this to clear out the white noise in the memory:

1. Write down your string (say: AIMLESSREADSTHEBOARD)
2. Search in softice, the partial string
(say: s 30:0 L FFFFFFFF 'AIMLESSREADSTHE')
3. When searches hit, you will find strings in the data window which show you the COMPLETE strings and the string you have entered in the new search command)
4. The complete strings are your actual strings in memory
5. The incomplete strings are fragments or pieces of your strings left from previous searches/softice buffers/memory manipulation clearences, etc.

...Have Phun
neshannel
05-07-2002, 10:57 AM
Thanks for answer but this is a fact:

1. Program detected softice and won't run
1.1 I run FrogsIce and program then start.

2. I search in W32Dasm and HEXWorkShop for that string ref. and can't find. So that string is generated in runtime.

3. Then I start program, go in SoftIce search for that string with >>s 300 l ffffffff 'MARKO'<< then after few >>s<< (again search) I found that string on 0300:c51349d2 (every time when I start program string change location always somewhere c5xxx9d2). How I know is it that string from program, because after that string appears second name and address of this guy e.g.. MARKO PERTIC WWW.*O.COM and that additional information I'm not input in search string and that additional data is what appear in program in runtime only in runtime.!!

4. Then I change that string from MARKO to JOHNY put >>bpm 030:c51349d2<< and return in program. Then I press button in program, program get this changed string from that adress and display JOHN PERTIC WWW.*O.COM but SoftIce not popup.

Thanks!
naides
05-07-2002, 11:51 AM
Similar Questions have been asked before. Look these Refs inside the board:

http://www.woodmann.net/forum/showthread.php?s=&threadid=2096&highlight=softice+break+point

http://www.woodmann.net/forum/showthread.php?s=&threadid=2621&highlight=softice+break+point

Setting a bpm is context specific. The bp will not "stick" if the ds changed from the time you set it, to the time the location in memory got red.

Search aorund info about superbpm, or other tricks that may work in your particular situation.

I also noticed the addresses in which you find your string: 0030:C5. . .

They seem way too high to belong to an application. This is the area where the OS dll and functions keep their data.
I am not saying that the string you see was not generated by your app at some point, but what you are seeing may be the shadow of some string manipulation or memory transfer executed by windows and not the data that your app is using.
Just a suggestion
Clandestiny
05-07-2002, 06:43 PM
Hiya neshannel,

BTW, what is the target in question? I've developed something of an interest in anti-SICE code :D

Cheers,
Clandestiny
Woodmann
05-07-2002, 07:17 PM
Howdy,

I had moved this thread to TOT, it was posted in general RCE.

This was against my better judgment, next time I will
listen to me :D
I shall restrain from bashing this person.
But, this is another example of people who dont read the FAQ.
Even when its posted in RED letters and the first thing you see when you look at it is:

Do not ask for cracks. Do not post in the wrong forum. Do not use direct links.
Do not ask where to find the "tools". Do not ask anything that can be found in a
manual IE: Why cant I set a breakpoint blah,blah,blah?. Do not ask for help without showing you made an effort. This includes asking *lameass* questions in the Newbies
Forum. Do not cross post. I can assure you that your question has already been answered
and the answer can be found on this site or on some of the links included on this site.
*Lameass*=Definition:
Hi I have downloaded this program 12345.exe and I cant (insert your best word here IE:crack)
it. Can someone tell me how?
crUsAdEr
05-07-2002, 07:59 PM
Hi Clandestiny,

Long time no see :>>... take a look at Daemon's site and bit-art Titanium.. real heavy anti sice protection....


ASProtect again...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect again...
PDA

View Full Version : ASProtect again...

npanic
05-07-2002, 12:18 PM
ASProtects CRC check

Anybody have a suggestion on how to deal with the CRC check in version 1.2+
crUsAdEr
05-07-2002, 01:56 PM
Hi npanic...

Please read the FAQ on top... if you have done so, please use the SEARCH button on the board...

And please read this:
http://www.woodmann.net/forum/showthread.php?s=&threadid=2813

Regards,
crUsAdEr
npanic
05-09-2002, 12:05 AM
I get the feeling that u r very tired of the ASProt disc, and i respect that. From now on i will leave that topic alone, and just watching on distance.

BTW, i got a reply from SilberFuchs, that cover my prob just fine.
npanic
05-09-2002, 12:07 AM
ups...
crUsAdEr
05-09-2002, 02:16 AM
Yo npanic,

Dont get the wrong impression... me pretty much a newbie like you... my point was just that AsProtect has been descussed in pretty details here... so do a search and post the question if you dont understand... i will be more than happy to help out, after i was helped lots by gurus here...

Just that i tot you would do a little research before posting a question to prevent repeating the same questions... that is all....

I PM you but your box was full

Regards,
crUsAdEr
nofurs
05-09-2002, 04:17 AM
Yo crUsAdEr,
You have point the right way keep up the good work ;)

Originally posted by crUsAdEr
Hi npanic...

Please read the FAQ on top... if you have done so, please use the SEARCH button on the board...

And please read this:
http://www.woodmann.net/forum/showthread.php?s=&threadid=2813

Regards,
crUsAdEr
npanic
05-09-2002, 04:30 AM
Howdy cluesurf...

As i PM'ed 2 Crusader, i 100% agreeing with him, and i learned my lesson, nothing comes easy, have 2 do some hard work myself before asking for help <---- REPLACED WORD

NPANIC JUMPS RIGHT IN HERE AND TAKEAWAY THAT NASTY WORD(solutions).
npanic
05-09-2002, 11:15 PM
I think this is an code injecter 2 make inliners for aspr, but i can't try, cause i'm on a netcafe. Amazing win2000 let me download and now upload it, wonder why i have permission to do that!.

If someone have time to try it, then please reply here with ur meaning of the tool.
npanic
05-09-2002, 11:19 PM
This tool should be able to patch ASPacked & ASProtected progs, i don't know anything about supported versions.

Also here try & reply.


"OutLine-Patch Studio" for ASSp.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > "OutLine-Patch Studio" for ASSp.
PDA

View Full Version : "OutLine-Patch Studio" for ASSp.

evaluator
05-07-2002, 01:20 PM
Hello!
I in 98% finished "OutLine-Patch Studio" for ASSp!

PreReview:
1. I patched ASS.DLL and repacked, so uSer must replace original with thisOne;
2. This SEXASS.DLL will unpack UNPACKEBLE and decrypt IAT.
AFTER this it reterns execution to specified place, WHERE uSer puts his
Own Code (:Don't crack, plEasE:) and jumps to OEP.

Before full finish & rEleasE, I need some info from you:

A. Is something like this released from someone?

B. If some of you done inline patch for latest vers off ASSp,
can you give it to me (not tut, but real working), so I will see, is it easy then my studio???

binh81, Spekk,..., want You test+upgrade?
crUsAdEr
05-07-2002, 01:54 PM
LOL... okie.. looks like interest in AsProtect will never die...

Okie... how do i get the beta version from you?? But isnt it troublesome for user to replace the dll? Not quite sure what you mean, email me the thing with a clear documentation on how to install driver, where to plug the cable etc... in English of course, not french :>...

Get the inline patch from the Desperate Website, cracks by FlawLess.... kickme.to/Desperate...

I am not sure if anyone has release anything like this?... Doesnt matter... this is learning only....

Check your PM for my email :>

cheers,
crUsAdEr
SilberFuchs
05-07-2002, 04:55 PM
the patchs of FlawLess are made with AIPH ??(AsprotectinlinepatchHelper; work of Global)
..i don't know if AIPH is avaiable for public!??

@Global: ich bin nicht verschwunden! aber du hast auf meine Mails seit einiger Zeit nicht mehr geantwortet

ciao
SilberFuchs :)
evaluator
05-07-2002, 05:21 PM
OK, but can you point to prog with inline...
SilberFuchs
05-07-2002, 06:51 PM
email??
i don't upload a patch here...
GlObAl
05-07-2002, 08:17 PM
Hello,
Evaluator my goal was it to make an small sulotion for ASPR protected programs so i think an inlinepatch was the best sulotion in my eyes!
Silberfuchs is right all the patches from FlawLeSS are made with AIPH and it was not public yet it will support ASPR versions 1.21 and higher... Silberfuchs your version is too buggy so plz don´t make it public.
I think the best way to learn how its work is to download the patch from FlawLeSS for Tag&Rename because there are not much regged patch in it... debug it completly and try to understood and if you have questions ask me or maybe Silberfuchs will help you too.
Don´t try the one from CommView its to much patched and it will maybe confused you too much for the begining.

P.S.: Silberfuchs habe dir mal ne Testmail geschickt hoffe das sie angekommen ist...
evaluator
05-07-2002, 08:27 PM
CommWiev?
What version patch you mean?
GlObAl
05-07-2002, 08:45 PM
Hello again,
evalator i mean maybe you don´t start to analays ip with the CommView patch it was for the v3.3 build 205 but every time the patch come out some days later they rls an new build :)
Start with Tag & Rename, DX Atlas,IE Security Pro,Online monitor and so on... because CV need much patch to make it regged and so they was much more bytes in the exe and so it was harder to understood only the ASPR ip ...

Regards
SilberFuchs
05-07-2002, 09:36 PM
no problem Global :)

hab dir auch vorhin ne Testmail geschickt

ciao
SilberFuchs
figugegl
05-08-2002, 01:58 AM
@sifu:

--- snip ---
Das hältst du ja im Kopf nicht aus! ...This hold you yes in the head not out!
--- snip ---

* LOL * - i like the english version - * LOL *

figugegl
crUsAdEr
05-09-2002, 08:30 PM
Hi GLOBAL...

Mighty impressive... you do know AsProtect inside out dont you :>>... looks like you have done lots of work on that AsProtect... do share ur knowledge with us sometimes...

Regards,
crUsAdEr

eval... you cruel one... my Hex Workshop died comparing the file you sent me... :mad:
GlObAl
05-10-2002, 11:30 AM
Hello,

sure i will help if i can if you have questions i will try to explain... and iam sure Silberfuchs will help too :) he has started for me to ip aspr and for him it was Onekelis or so ... and the first ever on never versions was ViperZX with CloneCD i think ... hehe but iam not sure, so don´t care of it...

i get an email from this board and i will answer here.

Q:In a reply u say that many patches r inliners, so it must be possible for a newbie as me to do it.?

A:Yes its possible if you have not much knowlenge in IP and so you will need a tool like AIPH or the other interesting tool that was postet in a nother thread it was in french maybe it do the same but i havent check it atm because i can no french :/
The other way is you trace one of the patches from FlawLeSS and try to learn from it as i say it was near to everytime the same on new ASPR versions. And if you have questions ask here.

Q:is the patching code taking care of the crc checks, or injected/written in certain areas of the file so crc check don't find'em, or maybe crc on the file on disc is avoided only, and then hides the rest of the code in certain mem locations

A:Yes you inject the ip in the aspr code and you can than fully control it this mean you can patch with one byte the CRC it was an simple 74 -> EB you will find it after tracing a bit from createfilemappinga. But if you patch the file and aspr in it the OEP will fail and this is the mainprotection from the Author but after thinking a bit over it i find an realy easy way to defeat it... yes the main working for the ip was this:

1 first you have to solve the 4-5 layers at the begining, you can recalculate or you try like me too brute 1 byte to breack out form the layers.
2 take the imagebase from ASPR and store it to build your whole ip on it
3 patch CRC 1 byte to get not the errormsg
4 patch if it was there 30 Daytrial
5 let ASPR do the whole unpacking ;)
6 so now he as unpack the app and the boríng i CRC for OEP calculation beguns but how care ? :) i know the OEP so i jump by my IP to the OEP... with
mov eax, OEP
jmp OEP

i think thats all for now...

P.S.: Silberfuchs habe keine Mail bekommen :( darauf hin habe ich jetzt ne neue Mailaddy glo_bal@reallyfast.info teste mal bitte...
npanic
05-18-2002, 06:10 PM
Thanks GlObAl for useful info.

Now i think i have some stuff to work with for a while.

BTW, me unpacking = cow stepdancing ;-)


Some Information on NTDLL!NTContinue...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Some Information on NTDLL!NTContinue...
PDA

View Full Version : Some Information on NTDLL!NTContinue...

foxthree
05-07-2002, 02:21 PM
Hello RCEs:

Where can I find some "internal" information on the usage of NTDLL!NTContinue function. This is in the context of SEH. I know that somewhere along the SEH line, NTContinue is called. Where exactly is it called, what is its function is what I'm interested in.

I could trace it in SICE but I'm wondering if anybody has already does this work :)

Any pointers to information would suffice.

Thanks,

Signed,
-- FoxThree
Actlon
05-07-2002, 11:48 PM
Found this reference on the MSDN website (dated Jan 97) but it may help

http://www.microsoft.com/msj/defaultframe.asp?page=/msj/0197/exception/exception.htm&nav=/msj/0197/newnav.htm

This is the only interesting part:

"The heart of KiUserExceptionDispatcher is its call to RtlDispatchException. This kicks off the search for any registered exception handlers. If a handler handles the exception and continues execution, the call to RtlDispatchException never returns. If RtlDispatchException returns, there are two possible paths: either NtContinue is called, which lets the process continues, or another exception is raised. This time, the exception isn't continuable, and the process must terminate."

You might get lucky on sysinternals perhaps ?
foxthree
05-08-2002, 08:05 PM
Hi Actlon:

Thanks a lot for your posting. Mmm.. interestingly I'd gone only 1/3rd of the article before posting this question. I'm sure what you've written is from the other 2/3rd :) I must be getting lazy :(

Thanks again,

Signed,
-- FoxThree


SoftIce question tracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce question tracking
PDA

View Full Version : SoftIce question tracking

jomamameister
05-08-2002, 09:07 PM
i want to be able to track an eip on a packed prog. can i use softice to give me a listing of, say, the last 20, or even 50 instructions and their offsets so i can track this baby. otherwise, some of these progs tend to give error messages when single stepping, and then shut down the prog, even using frogsice.
thanks for any help from you more experienced people.
jomamameister
crUsAdEr
05-08-2002, 09:22 PM
Hi jomamameister

You can switch off use the little trick of switching off code screen at the start of where you need to log, and then keep pressing F8/F10 till the end of the area you want to log... then use sice symbol loader to save log....

Note : teh log has a limited buffer so i cant log for more than a certain number of instructions...

Hope this helps,
crUsAdEr


need sentinel dongle cracking advice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > need sentinel dongle cracking advice
PDA

View Full Version : need sentinel dongle cracking advice

warior_jal
05-09-2002, 06:14 AM
Dear Sirs,
I am newbe to cracking. My first target is a sentinel Superpro dongle whose dump is attached. Please guide me how to proceed
nofurs
05-09-2002, 06:35 AM
Dear Mr warior_jal
If you are newbie in cracking learn assembly language first before you go forward.I give you a link http://webster.cs.ucr.edu/
download everything from there and read.Btw read the faq before you post anything...

Originally posted by warior_jal
Dear Sirs,
I am newbe to cracking. My first target is a sentinel Superpro dongle whose dump is attached. Please guide me how to proceed
npanic
05-09-2002, 06:36 AM
I think this thread should be in the Newbies Forum, also try 2 search on dongle, maybe u find something useful.

If not, then maybe u should start with an easy target and then read some tuts about Dongle cracking(not easy at all).

BTW, i'm new here 2, but i have learned this: do some work on ur own, then show it and explaine where ur stucked. I don't think anybody here will guide u from start 2 end.

Stay cool, says npanic.
MTB
05-10-2002, 01:16 AM
warior_jal, how to proceed. Simple start with a lot of patience, read all of "Dongle bashing" by frog's print (see +fravia's site), read all of crackz's dongle tutorials. Download IDA, W32DASM, and a hex editor, you may also want to download softice however I haven't used it for my projects. Then start reading, and experimenting. You must keep really good notes on what you change and if it works!

Good Luck
MTB
warior_jal
05-10-2002, 03:21 AM
I am sorry to have posted it in the wrong forum. I know a bit of assembly and have read the papers. My problem is that i do not know how to code the emulator as a seperate exe file. I need a the code in which i can put the words retrieved from the dongle and then proceed with softice to find out the what the proggy expects from the unreadable cells. Also what I need is any utility that could effectively dump sentinel dongles and other dongles.
Regarding the crackz tutorial about emulator inside the sx32w.dll file, I tried it but the program crashes (general protection fault) when i use the delta offset. I tried to fix the stack but it still craches. The option that seems best is to code a seperate exe to emulate the dongle. Please help me with the code and dumper utilities.
Once done I'll publish the entire results as a tutorial here.

regards

warior


Problem in regged program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problem in regged program
PDA

View Full Version : Problem in regged program

dipeshrestha
05-09-2002, 10:29 AM
Hi all friends,

i have recently download a program called 8085 Simulator. When i run that program it wont ask for reg code until it had been runned for 10 times. after that it will ask for the reg code. Well i manage to find one reg code (quite easy) and able to run that program . but still it said it is only shareware. how can i remove that scrolling label at the bottom of the program.

pls help.

dipeshrestha.

program url : <URL deleted>
npanic
05-09-2002, 10:41 AM
I think that u better find another place for such kinda threads, if i'm right, they don't belong here.

If i'm wrong, i owe u an appologize...
esther
05-09-2002, 10:55 AM
Hi,
I think this thread belongs to here either.do your homework guys

http://www.woodmann.net/forum/showthread.php?postid=16361#post16361
Originally posted by npanic
I think that u better find another place for such kinda threads, if i'm right, they don't belong here.

If i'm wrong, i owe u an appologize...
npanic
05-09-2002, 11:12 AM
Cool down esther, it was not my intention to piss u off like that.

U have my by now dipeshrestha,
and also do u esther.

Really hope it's accepted.

BTW, i think i missunderstood esther's reply, sorry for that.


F*L*E*X*L*M* SDK v8.0c (Help)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > F*L*E*X*L*M* SDK v8.0c (Help)
PDA

View Full Version : F*L*E*X*L*M* SDK v8.0c (Help)

redsk_y
05-09-2002, 01:15 PM
Hello,

I need your help and patiente.

I have installed this SDK (download from CrackZ site) and when I launch evalicgen.exe I see
FLEXLM Error: -44,49 (invalid FlexLM Key Supplied).

I have changed the lm_code.h in this way

#ifndef LM_CODE_H
#define LM_CODE_H
#include "lm_cro.h"

#define VENDOR_KEY1 0x00120012
#define VENDOR_KEY2 0x00212133
#define VENDOR_KEY3 0x003243e4
#define VENDOR_KEY4 0x00435531
#define VENDOR_KEY5 0x00235742

#define VENDOR_NAME "demo_pio"
#define ENCRYPTION_SEED1 0x87004321
#define ENCRYPTION_SEED2 0x12005678
#define ENCRYPTION_SEED3 0x11003344
#define ENCRYPTION_SEED4 0x55007788

#define LM_STRENGTH LM_STRENGTH_LICENSE_KEY

#define CRO_KEY1 0x0
#define CRO_KEY2 0x0

#define LM_BORROW_OK 1
#define LM_VER_BEHAVIOR LM_BEHAVIOR_V8

Coulb be someone so kind to help me?

Tnx a lot!
nblender
05-10-2002, 03:56 AM
I think you need to have valid vendor keys there, or all is in vain.
--nb
redsk_y
05-11-2002, 12:07 PM
Tnx Nolan Blender, now it is clear.

I have studied your essay on zend and I have extracted the

ENCSEED1/2 for vendor name gsi
KEYs 1/4

then using the tool lmvkey I got KEY5.

Finally it is working!

Just another question, is it possible to extract the key 5 from
the target?

I will be very grateful if you could be so kind to answer.

Tnx again
nblender
05-14-2002, 08:21 PM
Yes, it's possible to dig out vendorkey 5 from the target, however there's not much point, it's just extra work.

--nb
SeanC
06-20-2002, 11:18 AM
Hi,

After I find vendorcodes from vendorcode structure of SDK 8.0c. Use calseed to obtain seed1&2 and key v+0c, +10, ...for key[1~4]. Also got
FLEXLM Error: -44,49 (invalid FlexLM Key Supplied).
Then check key[1~4] by using lmvkey of NB. The result is validation 1 error.
It means wrong key[1~4] are supplied. Does lmvkey need update for v8? It works fine in previous version.

Please help me.

Tnx a lot.
nblender
06-21-2002, 03:21 AM
Yeah, it probably needs an update, but I wouldn't hold my breath waiting for it :)

"LMVKEY5 is no longer a publicly supported product"
redsk_y
06-25-2002, 02:27 PM
SeanC,

In this new SDK the global seed has
been changed.

So this is the reason why
lmvkey doesn't understand these keys.

.Bye


public-key based Delphi components protection: SLockPK
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > public-key based Delphi components protection: SLockPK
PDA

View Full Version : public-key based Delphi components protection: SLockPK

Solomon
05-10-2002, 04:57 AM
here is the component:
h**p://www.crypto-central.com/slock/slock_pk.html

and it is used by this baby(Beyond Compare 2.0):
h**p://www.scootersoftware.com/bc20beta.exe

I have not figure out how to patch it.:(
Lbolt99
05-11-2002, 05:05 AM
I saw someone talking about this in one of the usenet groups.. basically the general consensus there is that ASPR and SlockPK are the best protectors..

Found them by doing a search for ASprotect on google groups (dejanews for the old-schoolers :) , just for kicks when I was bored, just to see what people were talking about..

found lots of bragging about asprotect and all cracks etc stopping after the authors switched. Downloaded most of them (helpjotter, system cleaner, handy productions stuff, etc), no problem cracking :)

Is ASPR really that hard? that it stops most crackers in their tracks?

Found SlockPK discussion too. several people were praising it.

Going to take a look at it this weekend. BTW where are you stuck at? were you able to get it unpacked? (Not sure if it's even a "packer" like ASPR")

BTW one funny thread I found was one titled "Playing dirty" in the alt.comp.shareware.authors newsgroup. Aparantly Alexey has been promoting asprotect by emailing ppl recommending other protections (armadillo, etc) and sending them the crack ;)
Solomon
05-11-2002, 05:39 AM
hehe, interesting about Alex:)

I have read the documents of SLockPK and the header file "slock.hpp" in its SDK. This header file reveals most of the secrets. The EXE hash calculation is done in GetHashSelf( ) and it may be defeated just like what I did with CommView 3.0. The certificate check is in CheckProtectionCore( ). I will try to patch this with a disassembling of slock.obj.

If the shareware author puts a key in the certificate, then use this key to decrypt some code/data in their software(just as what Alex does), it may be hard to defeat without a valid certificate.
:)
goatass
05-13-2002, 01:57 PM
I took a quick look at this program and it doesn't look too bad. It uses RSA for the certificates. The values you see in the license file are encoded in some lame coder. The best thing is that the certificate builder is written in Delphi so with DeDe you can decompile it and figure out everything they do pretty easily.

I'm gonna look at it some more today when I get the chance.

goatass
goatass
05-15-2002, 12:54 AM
OK, after looking more into it it's not as lame as I initially thought. The entries in the file are encrypted with RC4, some with a static password and some with the hash of the username as the password. It uses RSA 384 I think for the certificates. I have to do some more work to figure out how it generates the public key and understand the RNG it uses.

Solomon, how did you get the SDK? can I get a copy of it from you?

goatass
Solomon
05-15-2002, 12:53 PM
thx goatass for your help.

It is RSA-1024 mentioned in their web page. The trial version of this component can be d/l from their web for free. But the certificate builder itself in this trial will not work without a valid certificate.

There is sth wrong with my ISP, so I will lose connection to this forum for a few weeks.
goatass
05-15-2002, 11:09 PM
ok I knew it was the stronger RSA, I can never figure out how many bits it is. When I get some more time I'll continue working on it. If anyone else with more crypto knowledge would like to help us out that would be great.

goatass
Solomon
08-05-2002, 02:08 PM
Now Beyond Compare v2.0 is successfully patched. No need to reverse the algo, just patch the 30-day time check:D
Lbolt99
08-05-2002, 08:20 PM
I just downloaded it, this looks pretty interesting. As goatass said, it loads into Dede (!!)


How to rebuild import table?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to rebuild import table?
PDA

View Full Version : How to rebuild import table?

testing999
05-10-2002, 12:51 PM
Hi all,

i'm kind of new in unpacking and certainly need help.

I have unpacked PortTunnel using ProcDump v1.6.2.

FYI, PortTunnel is packed using exe32pack v1.38,

Questions:

1) why are the exe files unpacked (full dump) using ProcDump (and even LordPE for this matter) in Win98 would not work on Win2k and vice versa? How do I get them to work on all Win OSes?

2) how do I rebuild the import tables? i've read essays (on ASProtect, ASPack, etc) but still don't seem to get it.

3) If i manage to rebuild the import tables, will the String References also be resolved when disassembled using w32dasm?

I have attached the following files for those who can help:

1) Original PortTunnel.exe => PortTunnel1.exe
2) PortTunnel that is modified to go into indefinite loop (for dumping purposes) => PortTunnel2.exe

All needed to dump the file is to run PortTunnel2.exe, run ProcDump/LordPE, dump the file and set OEP = E960.

I would really appreciate help on how to

a) get the unpacked exe to work on all OSes
b) make the unpacked exe disassembleable with Import Function and String Reference in w32dasm

tq in advance.


tutorial for ici crackme 1.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > tutorial for ici crackme 1.0
PDA

View Full Version : tutorial for ici crackme 1.0

The_Snake
05-10-2002, 03:56 PM
hi all
i serch any tutorials for this crackme
get it here:
Download the crackme (http://www.koolpages.com/the-snake/crackme/ici-me.zip)
Poweroff
05-10-2002, 04:45 PM
Link not work :(
The_Snake
05-10-2002, 04:58 PM
oh pardon,pardon
get it here:

[URL=http://www.koolpages.com/the-snake/crackme/icime1.zip Crack me ici 1.0[/URL]
The_Snake
05-10-2002, 05:01 PM
get it on:

Download Here (http://www.koolpages.com/the-snake/crackme/icime1.zip)
:o
will work fine
Poweroff
05-10-2002, 05:20 PM
Sorry I understand - my opera browser can't download it but IE did it!
The_Snake
05-10-2002, 05:40 PM
no d'ont using opera or internet using any application ex: flashget,
mass downloader:p :mad:
esther
05-10-2002, 05:44 PM
>i serch any tutorials for this crackme
sorry this is a place is for ppl learn to crack explain where you are stuck
If you want ppl searching for you you better leave this place...

wxw.google.com search for it....


Shrink34
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Shrink34
PDA

View Full Version : Shrink34

get2
05-10-2002, 07:57 PM
Hello all First I would like to say you all have a very nice place here I have learned alot in a short time :)

Now my problem I was wonderin if you could help me with. I have a program i'm workin on it is packed with Shrink34. When I try DeShrink 1.6 a msg box pops up and says E/A Fehler 87 ( no clue what this means) In the help file with DeShrink it says there are some trick to fake out DeShrink example - changed Shrinker header signatures (usually SHR3 in the
last file sections named .shrinkX) caused deshrink to reject
files as "Non Shrinker files"
this is what i belive to the case with this program. I tryed to change the header signature but that didnt work (not sure if i even did it right changed it to match the other signatures in shrink 0 - 2 ). I did i search here found very little on Shrink packers also search the web Krobar also. I then tryed SI with loader got it to break ( had to change it to E0000020 to get to break) Thought i found the entry point then tryed to dump with procdump gave me an error would not dump. So Im guessin i didnt find the right entry point of the program Im lame sorry.

If anyone could give me some advice as to what to try or do that would be great mybe some tuts I have not found on Shrink, maybe the error I'm gettin with deshrink or how to fix the trick they are usin the help file says it is easy if you know what your doin and i need all the help I can get :) Thank you so much for takin the time to read all of this and any help you sould possible give

Thank you :)
foxthree
05-11-2002, 03:29 PM
Hi get2:

Nice one, this :)

As +SplAj guru always says, "Brain is the best unpacker" :D

I found out OEP signature for this one! It is CALL [EBP-20] :)

However, if I try to dump with LordPE/ProcDump, I am unable to....

Below is my guess; correct me if I'm wrong!

This "shrinker" is making heavy use of VirtualProtectEx to make pages with NOACCESS. Hence readProcessMemory fails/Dumper fails :(

If what I think is right, icedump must be able to dump this one clean right ? I'll try this on Win98...

To get2: May be this is the reason why DeShrink fails! BTW, 87 (if it is the GetLastError() code means "The parameter is incorrect" Hmmm talk about descriptive error messages :)

Signed,
-- FoxThree

PS: Hmmm, RV 1.3 [Public] says IT is "mangled" but IT looks good to me. Also, if I give OEP in RV and try to get IT, it says "Found nothing". To me, IT looks correct. Why is RV then saying "IT is corrupt. Enter OEP?" :(
foxthree
05-12-2002, 11:57 AM
A small update on this "Shrinker". Yep, /dump is working and I am able to get the right dump. Imports are all correct. So, must be some bug in RV ;). However, when I attempt to run the dumped file, it gives access violation. After tracing, I managed to narrow down the culprit to some corrupted resource. How come the dump's icon is not getting restored after RS=VS/RO=VO operation? I think Shrinker compresses and messes up the resources so that after unpacking, an attempt to load the first resouce is crashing.

Any ideas on how to over come this?

Thanks,

Signed,
-- FoxThree

PS: Target was Calc.exe on Win2K Shrinker 3.4 from BlinkInc.
SpeKKeL
05-12-2002, 12:46 PM
Hajo Fox,

Well protected notepad and calc with latest shrinker.
Notepad was easily done with pedump function (icedump)
Icedump did fail on calc.exe (why,,..maybe because of it's entrypoint 1000xxxx ??)
Soo did an ordinary dump from the entrypoint, and all went okee.....No need of reconstruct the import- table all was clean.
And all resources and icons are there.(sys w98 se.)

Spekk.:p
+SplAj
05-12-2002, 01:13 PM
Hi get2

Shrink is easy as Spekk said :) You can't 'dump it' hmmmm

R U REALLY sure it's a 'Shrink' packed file ? Ya know our old friend TE! with tE!Lock can 'fake' itself as many known packers, including Shrinker ;)

Look at the sections with LordPE...real shrinker leaves most sections untouched (like .BSS, .rdata etc) If you can see a lot of other section other than .shrink0,1,2,3 then it probably IS a shrink packed file. If there are just a few with Shrink then I would say tE!lock !!!

Spl/\j
foxthree
05-12-2002, 03:07 PM
Yo SpeKKel/+Splaj guru:

Yes, Spek I realized I must've tried the PEDUMP function in SICE without using the "dump at oep" later :(. But u say that worked on CALC. I did the same with CALC. But after section aligning, I was unable to see the icon :( But it was 4AM in the morning... who knows may be I was dreaming that I was unpaxing "Shrinker" :D

+SplAj guru: Yes, I knew about the neato tE! trick (the one disguising as a "random" packer) from your previous Iris posts :) Nice reading that one. I'll check again. BTW, did you happen to look at elicz's new proggie in the newest AH release. That one rocks!!!

Will give a "real" try again ... this time within a "normal" human time ;)

Signed,
-- FoxThree
foxthree
05-13-2002, 08:00 PM
Folks:

Here is the tip to unpack "Shrinker"...

The best platform is Win98.

1. Locate OeIP by putting bpx GetVersion. Scroll up and you'll see the OEiP. (Alter. locate the OEiP using my earlier sig.)

2. Do JMP EIP (or PUSH 7FFFFFFF, Call SleepEx)

3. Exit SICE and in LordPE Full dump ;)

4. Reset the OeiP and reset the bytes ;)

Problems:

1. Sometimes /dump 'ed exes do not run (onWin98SE). The resources are corrupt.

2. The above method does not work on Win2K though. I still think "Shrinker" is using VPEx to create pages with no access...

However, on Win98 no probz ...

See ya until next packer ;)

Signed,
-- FoxThree

Greetz to +SplAj, SpeK, Crusader :)
get2
05-13-2002, 08:16 PM
Hi foxthree,Spekk and +Splaj
Thank you all for the replies :) sorry for not getting back before this was out of town

Foxthree:
I thought the oep was at ebp-24 but I could be wrong Looked real quick last night after symbol loader broke traced the code but I could not find a ebp-20 at least not in the program I am working on (I probley missed it) I am going to try and pack notepad tonight with Shrink34 to see what I’m doin wrong.

Splaj:
I think it is Shrink34 I can see in the section Shrink 0, BSS, Shrink 1, tls, rdata, Shrnk 2, Shrink 3, rdata, data, idata, load, reloc and rsrc But thank you for pointing that out I didnt know that ( I read the post on that, after you mensioned that, what a great post)

Now when I trace thru I get to call ebp-24 F8 into it goes to invalid F10 one time like all the code is there seems to be a lot of places it does this.

Maybe I could PM you the link to the s/w or post it here didn’t want to post didn’t want to break any rules. I am more interested in the protection than the s/w :) Thought it was going to be easy hehe yea right at least not for me.
Thank you all for the help on this. This just might make for a very nice tut on this :)
foxthree
05-13-2002, 08:27 PM
Get2:

You can either PM me the link or post it here with the URL obscured like hxxp or something like that so that nobody can trace the visit to this web site ;)

Signed,
-- FoxThree
get2
05-13-2002, 08:44 PM
Sorry we both kind of posted at the same time didnt read before i posted last replied.

The link to the s/w is h**p://www.execpc.com/~datasol/lotpro32.exe

Again thanks
crUsAdEr
05-13-2002, 09:11 PM
Hi all,

I am lost here... it seems that you guys are not talking about the same proggram? Or just discussion on general Shrink? weird though, another copy mem protection :>??

Get2, can I have the name of the program as well? Actually i think you are allowed to put the name of the proggy here, no need for a link, everyone knows how to search for it anyway...

cheers,
crUsAdER

LOL.. same time again :>>... this is getting like a real time board :>... cool :cool:
get2
05-13-2002, 11:58 PM
Hi Foxthree

You are 100 % right on this i just dumped notepad packed with shrink34 Woooooooo Hooooooo

Now I'M going to try the target program will post the results

again thank you all for getting me this far
crUsAdEr
05-14-2002, 12:43 AM
Erm,

Is there something wrong? My Shrinker.exe is not "shrinked" or packed in anyway??? Downloaded from blinkinc.com ... wrapped my notepad and all i did was, run it, full dump! then change OEP and Import RVA.. then it runs sweet :>... all on win 2k???

Anyway... i looked at the LOtto proggy and it really has some mem protection... use IDA.. how i love it now... look at this offset of the lotto proggie
.load:007D6E18 push ebp
.load:007D6E19 mov eax, [esp+arg_4]
.load:007D6E1D mov ebp, esp
.load:007D6E1F sub esp, 4Ch
.load:007D6E22 mov ecx, [eax]
.load:007D6E24 push ebx
.load:007D6E25 cmp [ebp+Exception_Record], 0C0000005h ; Read_WriteViolation??
.load:007D6E2C push esi
.load:007D6E2D push edi
.load:007D6E2E mov edi, [ecx+18h] ; exception address
.load:007D6E31 jnz invalid_exception_address
.load:007D6E37 cmp edi, Image_base
.load:007D6E3D jb invalid_exception_address
.load:007D6E43 mov ecx, Image_base
.load:007D6E49 mov eax, Size
.load:007D6E4E add eax, ecx
.load:007D6E50 cmp eax, edi
.load:007D6E52 jbe invalid_exception_address
.load:007D6E58 mov eax, edi
.load:007D6E5A sub eax, ecx
.load:007D6E5C push eax ; RVA of access violation

You see something fishy :>>??... yeah look at the value of edi, there will be lots of ???? there... but press F12, what do you see... sweet hex again :>>.... if you put a bpx there, sice break once, look at edi and then F12 you will see sweet virgin IAT.. dump it!!!... F5 again sice will break again... dump edi, lots of ?? but can you guess what should edi be now?... press F12, then disassemble the code at that address, looks like OEP :>>... so i guess you are right fox... if you look down below the code section you will see this :>
.load:007D6F35 push 1Ch ; dwLength
.load:007D6F37 lea eax, [ebp+Buffer]
.load:007D6F3A push eax ; lpBuffer
.load:007D6F3B push esi ; lpAddress
.load:007D6F3C call ds:__imp_VirtualQuery
.load:007D6F42 cmp [ebp+Buffer.Protect], 1 ; jump if no access :>
.load:007D6F46 jz short NO_access_GOOD!!!
.load:007D6F48 jmp invalid_exception_address

and then soon....
.load:007D6F5D lea eax, [ebp+flNewProtect]
.load:007D6F60 push eax ; lpflOldProtect
.load:007D6F61 push 4 ; flNewProtect
.load:007D6F63 push [ebp+dwSize] ; dwSize
.load:007D6F66 push esi ; lpAddress
.load:007D6F67 call ds:__imp_VirtualProtect ; PAGE_READWRITE
.load:007D6F6D test eax, eax
.load:007D6F6F jnz short virtual_protect_ok
....

lol... do you see what is coming... trace down a bit more you will see everything suddenly filled up nicely... :>>...
finally,
.load:007D72C1 push ecx ; lpflOldProtect
.load:007D72C2 push eax ; flNewProtect
.load:007D72C3 push [ebp+dwSize] ; dwSize
.load:007D72C6 push esi ; lpAddress
.load:007D72C7 call ds:__imp_VirtualProtect ; PAGE_EXECUTEREAD

That is all :>>>.... i guess the point here is like Kayaker says, dont just dump it.. reverse it ....
SpeKKeL
05-14-2002, 08:21 AM
I think me have super system........

1 run prog.
2 dump from oep >> somewhere in 6xxxxx
3 adjust entry-point in dump
4 runs like a virgin..
5 start winning with those balls..

Do i have a super system ???

:D

Greetz,

Spekk
crUsAdEr
05-14-2002, 08:48 AM
LOL..

like fox3 said, you must be running win98, speKKel.. looks like copymem doesnt work on win98... but if you dont fix IAT your dump will not run on another system... this shrinker doeshave weird behaviours though.... and stop gambling speK... better send me your money to fund my education :>.. i bet the return will be more rewarding :D

see ya
crUsAdEr
get2
05-14-2002, 02:23 PM
Sorry I have a lame system It's called my brain hehe

I thought I found the oep at ebp-24, eax was at 63xxxx I put a jmp eip exited sice started procdump tryed a full dump got this process cant be dumped. :(

Just one question If you would be good enough to answer for me ( I know I look pretty lame right now but tryin to learn ) Did you dump with sice ?? and if not could you tell with what??

Many thanks to you all :)
SpeKKeL
05-14-2002, 02:47 PM
Dumped with "lordPe" option > dump full

"I thought I found the oep at ebp-24, eax was at 63xxxx " >> yep that's okey.

Spekk
+SplAj
05-14-2002, 09:30 PM
Interesting stuff ;)

The IAT is NOT at 0x3D5000.. it's at 0x336000 with 1st thunk 0x3361B8. I dumped IAT before api's were mapped in and copy+paste to a dump that worked in Win98.
Changed PE header and it runs in Win98SE +Win2K.

Now dumping in Win2K is a bitch cos you have to 'pagein' the memory. Look at the image with LordPE and try 'DUMP Region'
you will immediately see the 'no access' sections. Just pagein each one ....refresh, repeat blah blah. Then you can dump.

Spl/\j
get2
05-15-2002, 05:42 PM
Hi All

Thank you for takin the time with me. Found my problem it was the pc I'm using it's a win 98se 1200mhz with 768 meg memory, the problem is that it was running out of memory thats why it would not dump (now i have to see why this is happeing there is no way it should be )

What I did was set everything up on another pc and dumped like a dream fixed entry point and runs like new well almost have to finish fixin it called it a night at 3am heheeh.

Again I'm sorry for lookin so lame I was workin on doin this for 3 weeks before I posted it here and was at the end of my rope didnt know what i was doin wrong.

Again thank you all :)


Litestep & SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Litestep & SI
PDA

View Full Version : Litestep & SI

kroc
05-11-2002, 07:34 AM
Hi!

Does anyone managed to run softice with litestep ? :confused:
Everytime the shell boots I get a bluescreen :eek:
Anyone experienced the same ? ... and maybe got it to work

my cfg: OS : 98SE
LS : 0.24.6
SI : 4.05.334
kroc
05-13-2002, 12:34 PM
well, no one answered...

i try it again:
if someone uses litestep (the shell replacement) instead of explorer.exe
and is able to boot with softice (no bsod)
then please,please post a simple "yes it works" or if someone tried and failed "nope, doesn't work"...
any feedback would be great, cause i've
searched nearly all searchengines and found nothing, asked on irc -> nothing...
does no one use litestep ?

thanks in advance

a newbie who wants to use litestep->kroc
[yAtEs]
05-15-2002, 11:35 AM
works fine for me. win98se.

yates.
kroc
05-15-2002, 11:57 AM
I got it to work fine now , too :)
The problem was not litestep directly but the modules, some of them
crashed my pc, but after a lot of testing now everything is as it should have been... :D


'calcseed' fails making correct seeds on a FLEXlm 7.1c daemon
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 'calcseed' fails making correct seeds on a FLEXlm 7.1c daemon
PDA

View Full Version : 'calcseed' fails making correct seeds on a FLEXlm 7.1c daemon

roli_bark
05-11-2002, 07:46 AM
Reading 'nblender' "Zendec" FLEXlm 7.2 info essay, I've concluded that it is relevant to 7.1 versions too (unless somebody proves me wrong - it is implied in the essay).

Some dis-assembled code:

.text:004171EA and edx, 8000h
.text:004171F0 test edx, edx
.text:004171F2 jz short loc_417217
.text:004171F4 cmp _user_l_sg, 0
.text:004171FB jz short loc_417217
.text:004171FD mov eax, [ebp+arg_8]
.text:00417200 push eax
.text:00417201 mov ecx, [ebp+arg_4]
.text:00417204 push ecx
.text:00417205 mov edx, [ebp+arg_0]
.text:00417208 push edx
.text:00417209 call _user_l_sg
.text:0041720F add esp, 0Ch

So here I was, noting relevant Args Ptr:
'eax' (@ 00417200) for a 'vendorcode' structure ptr,
'ecx' (@ 00417204) for a 'vendorname' ptr, and
'edx' (@ 00417208) for a 'job' structure ptr.

Here are the captured results:
"vendorcode ptr +4" - vendorcode.data[0] =.....some Hex value....
"vendorcode ptr +8" - vendorcode.data[1] - .....some Hex value....
"vendorname ptr" = ...some correct vendor name....

"job + 0" = 0x6600
.....= all '0's !!!!!!!!
"job + 8" = 0x0000
"job + C" = 0x0000
"job + 10" = 0x0000

Obviously, "job" structure filled with all '0's is NOT one would expect for FLEXlm Revisions greater than 7.0.

Feeding the above info into nblender's "calcs**d" - didn't result in correct s**ds (luckily enough I had the correct s**ds - this was just a test case).

Can somebody explain this phenomenon ?
TIA
CrackZ
05-11-2002, 03:16 PM
Hiya,

Its no phenomenon.

Note down your 2 pointers, job and vendor code structure and trace over the call to populate them, then feed the values to calcseed.exe.

Regards

CrackZ.
roli_bark
05-11-2002, 05:16 PM
From the essay, I understand that the 2 structures info is captured just BEFORE the "_user_l_sg" is called. However, I have captured it immediately after a 'step-over' - and still got the wrong keys.

After stepping over "_user_l_sg" - I get:

vendorcode:
0070F1F8 00000004
0070F1FC AB4F9720
0070F200 F04C9826
0070F204 458E21E7
0070F208 8C34FC32
0070F20C 4E83138C
0070F210 88C470CA

vendor name:
c***** (only the true 1st letter is given - relevant in ecryption/decryption)

job structure:
00A40240 66 00 00 00 12 00 05 00 83 A3 C2 DC 8D 59 ED 60
00A40250 87 C4 58 A5 00 00 00 00 00 00 00 00 00 00 00 00

calcs**d results:
69a214e4
32a11be2

These are definitely the wrong s**ds....(as I said - I have gotten the correct working ones some time ago) - Any clues ?
redsk_y
05-12-2002, 09:54 PM
Hi All,

May be that the vendor name starts with "g"?

I have found an error in calcseed.exe

See my post on this topic.

Bye
nblender
05-13-2002, 06:50 AM
I looked at the essay again, and its not made clear that you have to be past that "call to ptr" in l_sg before entering the values into
calcseed. I have addressed the problem with vendor names starting with 'g' however I suppose that I should test all possibilities before releasing a new version :p

"Step past the call to ptr before entering the values into calcseed"

--nb
roli_bark
05-13-2002, 11:50 AM
I have tried both methods - "stepping-over"...and not.
In both cases I've captured "job" structure AND "vendor" structure SIMULATENUOUSLY (at the same clock tic) - to no avail...
E.g. - In both methods 'calcs**d' yielded WRONG s**ds !!!

There must be some cases where nblender's method fails, or that I've missed something !
redsk_y
05-13-2002, 04:30 PM
Hi Roli,

If you have a daemon why don't you post it or PM ?

So we can try ....

Bye
nblender
05-13-2002, 06:21 PM
I tried it with this daemon, and it worked fine.
417209 might be an interesting place to break.

Daemon is too big to attach - look for T*ming Des*gner
nblender
05-14-2002, 04:30 AM
Hmm - I get significantly different results than you do.

1) I recorded the values on the stack (esp and esp+8) before the call.
2) after the call, I dereferenced these pointers and got this.
3) I used w32dasm to do this, but of course you can use softice if it
makes you feel leeter.

[008923D0] - 00000066 f...
[008923D4] - 00050012 ....
[008923D8] - bba5c4e4 ....
[008923DC] - 078a3eea .>..
[008923E0] - c23fa3e0 ..?.
[008923E4] - 00000000 ....

[0012EA48] - 00000004 ....
[0012EA4C] - cd5afc56 V.Z.
[0012EA50] - 9659f350 P.Y.
[0012EA54] - 2240477c |G@"
[0012EA58] - ea8896b8 ....
[0012EA5C] - 46571d1a ..WF
[0012EA60] - ef0a1d56 V...
[0012EA64] - 00000000 ....
[0012EA68] - 00000000 ....

data[0] = cd5afc56
data[1] = 9659f350

vendorname = chrond

job+0x08 = bba5c4e4
job+0x0c = 078a3eea
job+0x10 = c23fa3e0

Please note that I'm dereferencing the values as 32 bit values, **not**
char - on little endian machines such as the x86 machines, this is
important to note.

encseed0 = 09644769
encseed1 = 5267486f

With the values that you show, I can't dig out vendorkey5 either, which
to me implies that there is some sort of problem with that set of values.
I tried switching the byte order, but still no go.

If you have an alternate method of digging the seeds out perhaps
you should stick with that if this program does not work for you.

If you can provide greater detail on
how you extracted the seeds, it could help isolate the source
of difficulty.

--nb
redsk_y
05-14-2002, 07:55 AM
Hi All,

I have obtained the some results of nb, I mean the rigth seeds.

I have worked with two different methods, nb and my personal one, and both gave the some results. I have tested these methods also with Fl*xlm v8.1 and they worked well.

May be you are not giving the right vendor struct?

Bye
redsk_y
05-14-2002, 08:10 AM
Sorry,

Just some another things:

I have extracted the KEY_5 using the tool lmvkey,
than I have generated a license with SDK v8.0c and these structures:

2240477c
ea8896b8
46571d1a
ef0a1d56
==please try==> 3f....ca

ESeed_1=09644769
Eseed_2=5267486f

Please note that, generating the license, you have to check the box "add compatible license key" in evallicgen.exe
In fact it is this key that is checked, not the SIGN value.

Bye
nblender
05-14-2002, 03:34 PM
Originally posted by roli_bark
It may be the FLOW of things.

I invoke the debugger by "chrond" - no args ! (with out fake lic...), bpx on 1st "_l_sg" call, set 'Z' flag=0 (at 004171F2 above), & capture the relevant job/vendor data ...

Otherwise (pbx'ing on the "_l_sg" from within 'lc_checkout'), the daemon terminates with the message:

(chrond) FLEXlm version 7.1c
(chrond) Vendor daemons must be run by lmgrd

There's your problem right there - the fake license/correct
arguments to the vendor daemon are required in order for the
program to correctly execute. If you interfere with the flow of
the program to make it call the lm_new routines with incorrectly
initialized data, you are bound to get incorrect results.

I rule out the "endian" thing, because my alternative method works with the same byte ordering capturing....

The alternative approach - must be disciussed in private (PMs...)

Well, there are several alternative approaches, which is part of
the reason the defects with calcseed weren't caught by me or
other users until recently :)

If there are people using flexlm reading this, here's some helpful hints:

1) use the crypt filters if you can (this needs the full API). This helps some, and at least keeps people from fishing serials easily, or simply generating a keymaker for your product by fishing the seeds out. This provides a fair amount of added security for about an extra hour of coding work, so spend that time.

2) If you're worried about people making keys for your program put RSA encrypted data in the vendor string, and check that as well. You can purchase the CRO option if you have deep pockets, and current versions of flexlm are very secure from a cryptographic viewpoint. It's like having the best Medeco locks on your screen door.

3) Remember that software protection is only a small part of the equation.

--nb
nblender
05-15-2002, 03:45 PM
I haven't used the method you describe, I haven't fully traced it
out, being the lazy person that I am. If I can do stuff without
having to patch anything, so much the better.

Anyway, try this as your arguments:

chrond -T 6.1 3 -c license.dat

Of course the daemon will fail, since it can't communicate with
lmgrd, but you'll get it to trigger that call.

Also, you could set a breakpoint with the symbol loader first, then

lmgrd -c license.dat

and that would work as well.

--nb.
roli_bark
05-15-2002, 04:04 PM
The above invocation method works with Unix based daemons (the exact Args list may vary, and is taken directly by grepping the daemon name with 'ps -auxww' command). However - does this method work with Windows ?

BTW - the above mentioned alternative method DOES NOT require any patch to the target - it just needs the extraction of some constants from the code - in addition with the already extracted 'vendorcode' & 'vendorname' data....
nblender
05-15-2002, 11:57 PM
Yeah, I see - you just change the flags while tracing rather than patching.

Ahh well, - I guess everyone uses what works for them :)
CPCP
05-22-2002, 05:08 PM
** I use similar method ( roli )

--> i find rapidly txt : mov ebp, esp

--> i found at 40D6BD key unique : 0F 44 2D BF

--> after at 40 DA 19 : order for 2 3 0 1 ( shl .. )

--> i break at l_sg and pass the first jz

--> i run step by step and after the call i look the values

--> i use a licgen for retrieve the good seeds

** note : the seed & keys are similar to old flexgen T. DESIG.

CPCP


Sentinel superpro dongle cracking help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel superpro dongle cracking help
PDA

View Full Version : Sentinel superpro dongle cracking help

warior_jal
05-11-2002, 11:55 AM
I am a newbie to cracking with my first target as sentinel superpro protected program. I have taken a dump of the dongle but the active algorith cells cannot be read by my utility(spath's utility v 0.02). If desired i can send the dumped dongle contents to anybody willing to study it. I have read the papers by crack'z. My problem is that i do not know how to code the emulator as a seperate exe file. I need a the code in which i can put the words retrieved from the dongle and then proceed with softice to find out the what the proggy expects from the unreadable cells. Also what I need is any utility that could effectively dump sentinel dongles and other dongles. If possible i need the sentinel manuals which have been removed from sentinel's site.
Regarding the crackz tutorial about emulator inside the sx32w.dll file, I tried it but the program crashes (general protection fault) when i use the delta offset. I tried to fix the stack but it still craches. The option that seems best is to code a seperate exe to emulate the dongle. Please help me with the code and dumper utilities.
Once done I'll publish the entire results as a tutorial here.

regards

warior
Lbolt99
05-13-2002, 02:59 AM
So you are saying you've never cracked before? :confused:

What is the target you're working on? Someone here might already have and can offer tips on how hard it might be.

Depending on the implementation.. the complexity of cracking could range from just NOPing out checks to see if the dongle is plugged in, all the way to encrypted fragments of code that are decrypted with keys in the dongle. Or code itself hidden in the dongle. Depends on how well they tied the program into the dongle. I'd recommend finding and reading the docs or whatever info you can find on the dongle to see what implementations are available to use to protect the product.

Sort of like ASprotect in a way.. the weaker implementations just wrap the EXE, use the ASPR nag.. ranging to encrypted code only easily decryptable with a valid reg key.
warior_jal
05-13-2002, 03:53 AM
hi
nobody's worked on the target yet. The target seems to use sproquery and decrement functions too.


sentinel dongle cracking help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > sentinel dongle cracking help
PDA

View Full Version : sentinel dongle cracking help

warior_jal
05-11-2002, 12:06 PM
I am a newbie to cracking with my first target as sentinel superpro protected program. I have taken a dump of the dongle but the active algorith cells cannot be read by my utility(spath's utility v 0.02). If desired i can send the dumped dongle contents to anybody willing to study it. I have read the papers by crack'z. My problem is that i do not know how to code the emulator as a seperate exe file. I need a the code in which i can put the words retrieved from the dongle and then proceed with softice to find out the what the proggy expects from the unreadable cells. Also what I need is any utility that could effectively dump sentinel dongles and other dongles. If possible i need the sentinel manuals which have been removed from sentinel's site.
Regarding the crackz tutorial about emulator inside the sx32w.dll file, I tried it but the program crashes (general protection fault) when i use the delta offset. I tried to fix the stack but it still craches. The option that seems best is to code a seperate exe to emulate the dongle. Please help me with the code and dumper utilities.
Once done I'll publish the entire results as a tutorial here.

regards

warior
CrackZ
05-11-2002, 03:29 PM
Hiya,

I think you attached the dongle dump to one of your other posts, it escapes me right now, but I recall downloading it.

1. I hope your download of dongle contents has been removed, it looks as if some of the data read from your dongle might be personally compromising. Since I couldn't find it, I assume it has.

2. I'm really not sure what you mean by putting the code in a 'separate file', maybe its a language thing and you do mean patching the original, writing some sort of replacement?, god I don't even want to contemplate that ;-).

3. You need to identify whether its using sproRead() or sproExtendedRead(), I suspect also theres a few sproQuery()'s and sproDecrements() possibly writes in there too. The sx32w.dll code is for Sentinel Pro, generally the format of any emulator for reading is as follows :

cmp word ptr [someregister], 7242h
jz start_here (OK we'll change this to 74 00)
push ebp
mov eax, [esp+xxh] ; where the word to read is on the stack
shl eax, 1 ; x 2
call $+5
pop ebp
lea edi, [ebp+xx] ; displacement (normally its 17h or 18h or so)
mov edi, [esp+xxh] ; where word is to be placed (off stack and +4h of word to read)
movzx eax, word ptr [eax.edi] ; read from fake memory
mov [edi], ax
xor eax, eax
pop ebp
USUAL function exit here (important you use the one in your target or your stack will be out)
db 128 dup(0) <-- fake dongle memory

4. Contact me with your target details, if you can send me it ;-), I can send you Sentinel manuals and other information regarding dumpers.

Regards

CrackZ.
i.r.o.n.m.a.n
05-11-2002, 09:17 PM
CrackZ,

I too am very interested in learning about emulating Sentinel SuperPro. I've not found a working dumper for my app yet :( . Perhaps when you have some time you can help? If so, I'll provide any requested info/files.

Much abliged ;)

___________________
I.r.o.n.M.a.n
cah
05-13-2002, 12:18 PM
I am also interested in learning HASP & Sentinel Emulation.
Please help me, if you find some time & post me manuals,if possible
Cah...
warior_jal
05-13-2002, 05:27 PM
Hi!
Could somebody please guide me (with example) how to add dongle data to the sentinel dll.

best regards

warior
goatass
05-13-2002, 10:54 PM
Easy, find an empty space in the DLL, a place where there are a lot of zeros and put your data in there. Put some kind of tag at the beginning of the data so you could do a search in memory for this tag and you will know where in memory your data is. Now when you calculate your delta offset you could add this offset to where your dongle data is and boom.

goatass
warior_jal
05-14-2002, 12:31 PM
Dear Mr. CrackZ,
I have sent you the details of the target, please check your mailbox.

best regards

warior
warior_jal
05-14-2002, 12:44 PM
thanks Dear Goatass for your advice. This would surely aid me in removing this dongle. As I am a newbie, I would like to study a file which has a working emulator inside (this would make me clear about the concepts). I would be gratefull to you if you could mail me any cracked sx32w.dll file, preferably a file with maximum functions emulated.

best regards

warior


rebuilding iat
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > rebuilding iat
PDA

View Full Version : rebuilding iat

Sempai
05-11-2002, 03:05 PM
first off all i'd like to thank all who were so kind to help me out before. but i have stumbled into another problem yet again, and i hope some of you out there are willing to help me...

problem is... after using revirgin, a few missing api's remain. trying to find them manually i ran into this..

at c6e944:

PUSH 00
CALL KERNEL32!GetModuleHandleA
PUSH DWORD PTR [00C76714]
POP EAX
RET

at c6e8e4:

PUSH EBP
MOV EBP,ESP
MOV EAX,[EBP+08]
TEST EAX,EAX
JNZ 00C6E8F5
MOV EAX,[00C76624]
JMP 00C6E8FB
PUSH EAX
CALL KERNEL32!GetModuleHandleA
POP EBP
RET 0004

at c6e900:

PUSH 00
CALL KERNEL32!GetModuleHandleA
PUSH DWORD PTR [00C76704]
POP EAX
RET

is this all correct!? as they all seem to give the same api.
im a newbie at asprotect, and have struggeled with it for a long
time already, but whithout some help i dont seems to get it all
done.

thanx in advance.
Solomon
05-11-2002, 03:28 PM
Please read the post by +SplAj first
http://www.woodmann.net/forum/showthread.php?s=&threadid=2603

at c6e944:

PUSH 00
CALL KERNEL32!GetModuleHandleA
PUSH DWORD PTR [00C76714]
POP EAX
RET
The above is NOT GetModuleHandleA.
Try typing "dd 00C76714" to get the return value of redirected API

at c6e8e4:

PUSH EBP
MOV EBP,ESP
MOV EAX,[EBP+08]
TEST EAX,EAX
JNZ 00C6E8F5
MOV EAX,[00C76624]
JMP 00C6E8FB
PUSH EAX
CALL KERNEL32!GetModuleHandleA
POP EBP
RET 0004

yes, the above is GetModuleHandleA

at c6e900:

PUSH 00
CALL KERNEL32!GetModuleHandleA
PUSH DWORD PTR [00C76704]
POP EAX
RET

The above is NOT GetModuleHandleA.
Try typing "dd 00C76704" to get the return value of redirected API
Sempai
05-11-2002, 04:07 PM
thanx Solomon for your help once again.

i did read the splaj post, but it didnt quite give me what i searched for. i managed to get the return values.

for example PUSH DWORD PTR [00C76714] give the
return value of 819545D8.
but i cant get myself to link them to the correct api.

probably it's my ignorance, but i truly am willing to learn. i just
hope there are some willing to teach...
Sempai
05-12-2002, 03:39 PM
i still keep on trying but no luck.

please can someone give me some pointers.. i'm plane stuck right now. i tried all possible ways i can think of using the return values, but still no succes.


Making a asm rip keygen???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Making a asm rip keygen???
PDA

View Full Version : Making a asm rip keygen???

bik78
05-11-2002, 03:21 PM
Hello all!

Im trying to understand how to make a ASM rip keygen.

I've coded a little console app (attached) that initializes a variable to 2, calls a function to double it and outputs the result.

IDA translates my int Dbl(int x) function to:

.text:00401194 sub_0_401194 proc near ; CODE XREF: _main+Ep
.text:00401194
.text:00401194 arg_0 = dword ptr 8
.text:00401194
.text:00401194 push ebp
.text:00401195 mov ebp, esp
.text:00401197 mov eax, [ebp+arg_0]
.text:0040119A add eax, eax
.text:0040119C pop ebp
.text:0040119D retn
.text:0040119D sub_0_401194 endp

Now, lets pretend that this function is actually some complicated key-generation algorithm, and I want to rip it for my keygen...

So I create a function and put the above code in a __asm { } block:

int Genkey(int x)
{
__asm
{
push ebp
mov ebp, esp
mov eax, [ebp+x]
add eax, eax
pop ebp
retn
}
}

But it doesnt work, the keygen crashes.
I've never tried this before, so can someone please tell me what I'm doing wrong and what's the right way to do it?

Also another question: if a key-generation function includes calls to other functions, whats the proper way to rip it?

Thanx!
LaptoniC
05-11-2002, 05:38 PM
this function just takes argument and adds to itself so it is multiplying by two.I guess you can write this simple calculation yourself.
However, your C translation is wrong.You can't reference passed variables like this.

mov eax, [ebp+x] change this to
mov eax, [ebp+8]
bik78
05-11-2002, 08:46 PM
Hmmm... Yeah, I did that but it still wouldnt work.... Then I added

__declspec(naked)

to the function and now it works....

Why 8? Length of an integer??? Isnt that 4???
stealthFIGHTER
05-12-2002, 01:42 AM
Originally posted by bik78

Why 8? Length of an integer??? Isnt that 4???

Hello,

because :00401194 arg_0 = dword ptr 8. So if arg_0 = dword ptr 8 you can do this:

mov eax, [ebp+arg_0] >>> mov eax, [ebp+8]

Ok?

sF
bik78
05-12-2002, 09:57 AM
Right, thanks!
oyang2002
05-14-2002, 03:13 PM
Hi!

I don't think it is a good idea to rip codes from the target.
(by the way,there is a tool named TMG Ripper Studio which can do it,maybe its current version is 0.03).

most of time the codes are too much and the codes ripped
are very complecated! And many data referenced may need
to be initialized.

I wrote a tool to export functions from a DLL.At this time it does
nothing to DLLs which have no export directory.I will modify it
to add export table for that Dlls and even EXEs! So we can
exported any functions as we like.

Maybe it is better to call the functions than rip it:-)


How to find entry point for SPARC ELF binary?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to find entry point for SPARC ELF binary?
PDA

View Full Version : How to find entry point for SPARC ELF binary?

SuperCali
05-11-2002, 04:43 PM
Hello,
How do I find an entry point for a SPARC ELF binary so I can disassemble it in IDA? Is it possible to disassemble it properly in IDA btw!? The reason I ask is because I have recently cracked a windows app that was quite interesting for me (learnt a lot) and now would like to look at the same app but for Solaris and see if the protection or implementation differs much. I am aware that I can use dis for Solaris but I would like to try IDA if it's possible. Also whilst on the subject of unix cracking anyone here know of any good disassemblers for Solaris 7-8 SPARC? Thanks for any help.
roli_bark
05-12-2002, 08:14 AM
I presume that only 'IDA Advanced' version is capable of disassembling a code targeted to Sparc processors.


SoftICE 4.05 & Win2K (problems)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE 4.05 & Win2K (problems)
PDA

View Full Version : SoftICE 4.05 & Win2K (problems)

redsk_y
05-12-2002, 11:57 AM
Hi All,

I am using SoftICe in Windows 2K and I am not more able
to stop any program when it starts.
I have resolved the problem putting CC on the program and
bpint 3 on softice. Then I replace CC with the right code and
I can set the any bpxs in the target.

The problem is that when the target exits I loose all the bpxs and
I have the restart with bpint3 ....

There someone that could explain to me why this happens?

Tnx
Actlon
05-12-2002, 11:16 PM
AFAIK it's a bug in SoftIce 4.05 for win 2000 - I had this to.

The solution is to use an updated version - I'm using driverstudio 2.6 which contains a version of SoftIce that works fine.
redsk_y
05-13-2002, 04:14 PM
Thanks for this hint.

I will try it and ... I hope to have no more problems!!

Bye


HASP protected program(HELP !)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HASP protected program(HELP !)
PDA

View Full Version : HASP protected program(HELP !)

hack3r2k
05-12-2002, 01:52 PM
HI !

Some day ago i downloaded some program that seems to be protected with HASP.

Can somebody teach me how can i remove this protection/tell me more about it (the program popups a message like 'HASP ERROR - key not available ') ?:confused:

Well i hope i'm not asking too much ...

best regards,
hacker2k
foxthree
05-12-2002, 03:12 PM
Yes Indeed you're asking for too much. :eek:

1. Did you read the FAQ?:rolleyes:
2. What analysis did you do?
3. Do you know that there is a "search" button on this site that does magical things :D?
4. Do you know of a great guy called "CrackZ" who literally "ownz" dongles?

Do the above in the same order and if you're still confused....:o

Signed,
-- FoxThree
CrackZ
05-12-2002, 10:58 PM
Hiya,

1. Ah foxthree you are far too kind ;-), or I've spent far too long tracing HASP's (heh, I think its that actually), but thank you for your gracious words.

2. hacker2k, heed what foxthree has advised you, if you can provide me with more details I can probably help you more, but I'm afraid 'popping up an error : NO HASP key found' tells me only that it failed to run without a HASP (erm, not surprising eh).

3. As a rule of thumb, I know I've written in the past about specifying targets, but its generally advisable that you paste some code from your target, for example, paste which part you think is _haspreg(), tell us what you've uncovered whilst tracing, in fact as I'll write soon for a document on Tsehp's site there are now some devastatingly effective breakpoints for HASP's.

Regards

CrackZ.
ngoksun
05-16-2002, 08:16 AM
CrackZ,
I hear your HASP/Sentinel Kill v0.01 have finished long time ago. Could your please share it.
Regards!
HypnoticZ/TNT
05-18-2002, 01:45 PM
Well hacker2k i take a chance to make a reply to help u about this program...
i don't know if u have tried to crack this app but i tell u with single step how u can find the hasp() btw take on hand the hasp manual will help's u alot trust me well now u need softice/icedump, hiew and the hasp manual on hand...
i told u how i work usually first i open the file to see if exist .protect section, protect section is the hasp envelope,about hasp envelope u will find infos on hasp manual :)
now i set a bpx FreeEnvironmentStringA and run the prog
softice pop up F12 until u see this code snippet :push ebp
call [esi]
pop ebp <-- you will be here
another F12 and will land at hasp()
at
EAX=seed
BH =service number
ECX = pass1
EDX = pass2

This is the basics steps now u must read all CrackZ tutorials about emulator and other technics.... and finally if u can't do nothing drop me a PM with the url for your program and i will try to write a short essay to help u

Regards HypnoticZ
cyberheg
05-22-2002, 12:14 PM
Since I think some of the above comments aren't really useful I'd like to give some tips on how one should continue on Hasp and comercial protections in general.

One thing I don't understand is why people go search after endless amounts of tutorials instead of reading manuals.
After people read alot of tutorials they end up a little smarter but still won't know how the dongle works.

Basicly you should ask yourself: "Do I understand hasp good enough to be able to protect my own program?" If the answer is yes then tutorials might be of some help since they can usually give hints on how to get to the central place of the hasp protection: the api. If the answer is no then thats the real problem and you should read the manual. The manual is availble and it's just a shame and lazyness that people doesn't start by reading this.

I read in another thread where someone complained about a hasp memory dumper didn't work as it should. Again this is the same problem over again. I state that any experienced programmer should be able to code a dumper within 1 day (even without knowing in advance how hasp works). It's really not that hard but again if you don't know how hasp works you won't get far. 1 day is probably more then enough as a experienced guy should be able to make a dumper in a few hours. You don't believe me? Feel free to prove me wrong. (Atleast your attempt to make one will make you learn something about that dongle).

As for hasp envelopes it was made clear above how to identify them. They are ofcourse more work and takes time to figure out like any other pe encryption (eg. Asprotect) but I am sure you won't be able to handle those as long as you don't got the basic knowledge about the dongles in your head.

// CyberHeg
MTB
05-24-2002, 01:47 AM
Stop the presses, there is another way. Yes the old newbie way of brute forcing it! Find the hasp signatures for IDA. Run IDA on your program (may take an overnight run). Then look for the hasp signature subroutines and where they are called, in pseudo code it will look like this

Is dongle attached
No > bugger off, crash, exit
Yes > continue
Is dongle the correct version
No > bugger off
Yes > continue
etc.

Now the program may call the hasp only a couple of times, at start, before writing a file or printing, or doing some intensive calculation. This is easy to defeat.

If it calls the routines a lot you will need to reg the hasp routines to return the correct value no matter what.

MTB
r00t
05-28-2002, 08:28 AM
Look at h**p://w*w.brstudio.com/HardKeys.htm.
The guy there is claiming that he can emulate HASP4.
(U can download the emulator).
Try it, and post here the results.

Greets.
CrackZ
05-29-2002, 07:10 PM
Hiya,

It go's something like this ;-).

1. Identify HASP protection strategy, envelope (.protect section?), HASP API (HASPDOSDRV string), HASPPVCS (HASPPVCS signature).

2. Breakpoint pertinent HASP API level, envelope and API bpx FreeEnvironmentStringsA, PVCS use low level breakpoints I mentioned in other posts (inside drivers), service code can be found in HASP structure +16h (I'll write an essay on this SOON I promise).

3. Understand HASP service codes, return correct or recoverable responses.

4. Recover dongle memory contents if you can work it out.

5. Patch stupid application. Write replacement drivers. Figure that Aladdin are just a bunch of stupid morons and that your time is better spent tracing or coding something else ;-).

Regards

CrackZ.
Mefeus
05-30-2002, 09:21 AM
Maybe the HASP-Programmers Guide will help you all.
Find it here for download:

hxxp://212.14.34.87/~fkiepski/down/helpy/haspman.zip

The link was followed from:

hxxp://crackpltools.prv.pl/

...a nice site at all!

Mefeus :D
bluesee
06-01-2002, 02:25 AM
This site has not been maintained for a long time.
FoxB
04-16-2003, 01:17 AM
Try it hxxp://212.14.34.87/~devon/down/helpy/haspman.zip

FoxB


SoftICE HMEMCPY problem!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE HMEMCPY problem!!!
PDA

View Full Version : SoftICE HMEMCPY problem!!!

ZasiuZ
05-12-2002, 05:46 PM
I'm using SoftICE on Windows ME, but I have a problem. I can't make a breakpoin on hmemcpy (bpx hmemcpy). What is wrong? :confused:

******************Please HELP me*********************
Pyrae
05-12-2002, 05:53 PM
Did you load the KERNEL32.DLL exports?
ZasiuZ
05-12-2002, 06:33 PM
Yes, I modified my winice.dat
remi
05-20-2002, 11:35 AM
Hi ZasiuZ:

What happends is that hememcpy doesn't exist in win ME. Instead try using memcpy, without the "h". You can also try with RtlMoveMemory. Anyway I don't think you'll have much luck using these functions, but you can try.


I have found a mistake in CALCSEED for FLEXLM.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I have found a mistake in CALCSEED for FLEXLM.
PDA

View Full Version : I have found a mistake in CALCSEED for FLEXLM.

redsk_y
05-12-2002, 09:49 PM
Hi All,

I have found a mistake in the table that calcseed.exe uses to
generate the encryption seeds 1 and 2.
The decode table, taken from Nolan Blender essay
"Information Hiding Methods used by FLEXlm Targets
An Explanation of the FLEXlm Seed Hiding System."
is:
decode_table_t decode_table[] = {

{3, 5, 4, 11}, /* index 0 */

{9, 8, 3, 1}, /* index 1 */

{8, 1, 2, 5}, /* index 2 */

{2, 1, 10, 5}, /* index 3 */

{3, 0, 1, 7}, /* index 4 */

{1, 10, 3, 7}, /* index 5 */

{7, 3, 5, 11}, /* index 6 */

{0, 1, 9, 4}, /* index 7 */

{0, 4, 1, 10}, /* index 8 */

{11, 8, 1, 3}, /* index 9 */

{8, 4, 2, 5}, /* index 10 */

{6, 1, 0, 9}, /* index 11 */

{4, 3, 8, 9}, /* index 12 */

{0, 4, 2, 10}, /* index 13 */

{3, 10, 8, 7}, /* index 14 */

{1, 11, 0, 3}, /* index 15 */

{6, 5, 1, 0}, /* index 16 */

{0, 2, 4, 8}, /* index 17 */

{5, 0, 1, 4}, /* index 18 */

{10, 3, 5, 1} /* index 19 */

};

The line {2, 1, 10, 5}, /* index 3 */ has one error,
the right line is {2, 11, 10, 5}.

This error affects vendor name that start with g.

So, because I don't have the source code to solve the problem
you need to change 01 to 0B at offset 4055.

I hope this helps.

Bye
:rolleyes:
nblender
05-13-2002, 05:55 AM
Thanks for finding this. It will be fixed in a later version of calcseed.

Regards,

--nb
nblender
05-13-2002, 07:25 AM
I check the structures again, and there's another problem.
{3, 0, 0, 7}, /* index 4 */

should be correct.

--nb
FoxB
05-16-2002, 01:09 PM
Mr. Nolan Blender

You It will be fixed in a later version of calcseed?
What get new calcseed?

Regards
FoxB
nblender
05-16-2002, 02:50 PM
Or use this - I think this addresses the issues with bad values
in the decode code.
allex02
06-02-2002, 02:38 PM
Hi nblender:
I have a question and I need your help.
Is it a good place to retrieve seeds where flexlm compare with demo seed(12345678 and 87654321)?
I read some pages but I seldom read about that.

Thanks.
allex


Blowfish Init<>set_key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Blowfish Init<>set_key
PDA

View Full Version : Blowfish Init<>set_key

dion
05-13-2002, 04:02 AM
i had got Hagen Reddmann's free TCipher package,which has Blowfish class with Init func :

procedure TCipher_Blowfish.Init(const Key; Size: Integer; IVector: Pointer);
var
I,J: Integer;
B: array[0..7] of Byte;
K: PByteArray;
P: PIntArray;
S: PBlowfish;
begin
InitBegin(Size);
K := @Key;
S := User;
P := Pointer(PChar(User) + SizeOf(Blowfish_Data));
Move(Blowfish_Data, S^, SizeOf(Blowfish_Data));
Move(Blowfish_Key, P^, Sizeof(Blowfish_Key));
J := 0;
for I := 0 to 17 do
begin
P[I] := P[I] xor (K[(J + 0) mod Size] shl 24 +
K[(J + 1) mod Size] shl 16 +
K[(J + 2) mod Size] shl 8 +
K[(J + 3) mod Size]);
J := (J + 4) mod Size;
end;
FillChar(B, SizeOf(B), 0);
for I := 0 to 8 do
begin
Encode(@B);
P[I * 2] := SwapInteger(PCipherRec(@B).A);
P[I * 2 + 1] := SwapInteger(PCipherRec(@B).B);
end;
for I := 0 to 3 do
for J := 0 to 127 do
begin
Encode(@B);
S[I, J * 2] := SwapInteger(PCipherRec(@B).A);
S[I, J * 2 +1] := SwapInteger(PCipherRec(@B).B);
end;

FillChar(B, SizeOf(B), 0);
InitEnd(IVector);
end;

i had question here, is BF_set_key in bf section of OpenSSL package is same like Init procedure here ? do the *IVector same like *Key in BF_set_key ? and then, blowfish is symetric cipher, right ? say that i'm gonna establish a connection with blowfish only. what i'm gonna do are pass our pwd to Init/BF_set_key, then i encode msg and send it to my pal in another side. now, my pal has to do the same, pass pwd to Init/set_key and then decode it. is this works ? coz i'm still not understand what Init/set_key do under the hood. i had read the counterpane tut. it said there's P & Sbox array. from Init func i see that P & Sbox array updated at the end. what i think is it's gonna be diff P & Sbox every time encode/decode gets called. and with this then i think such connection is can't be, coz the my pal's P & Sbox are diff from me since i've encode something while he do nothing yet. can anyone tell what's wrong with this ?
mike
05-16-2002, 05:10 PM
If you both know the password, then you have no need of SSL. SSL is for establishing connections between computers with no prior relationship and involves asymmetric (public-key) crypto.

Blowfish is a 64-bit symmetric cipher. Use a hash function to convert your passphrase into a 64-bit key. Then you encrypt using that key, and he decrypts using that key.
dion
05-18-2002, 03:26 AM
hi Mike, i don't understand how the connection is establihed, i mean how the protocol works out. is it true when i encrypt msg with a key [init blowfish] then the s-box and p array is get updated ? if then how the other computer can decrypt it without knowing the updated s-box and p array ?
mike
05-18-2002, 07:15 PM
If you both put the same key (or passphrase) into blowfish, it will synchronize itself. As your friend begins to decrypt the message, his cipher's internal state will change in the same way as yours did and everything will work fine.

The S and P boxes are initialized before encrypting, when you supply the key. They don't change after that.

I said to use a hash function on your passphrase to get 64 bits of key. You can do that, or you can just put the key in directly to blowfish, since the key length is variable.

Is Delphi your language of choice? There are other easy-to-use implementations in other languages, too.
dion
05-20-2002, 03:32 AM
Quote:
"The S and P boxes are initialized before encrypting, when you supply the key. They don't change after that. "

why is that? what's in my mind is s-box and p box are both got updated each time i encrypt/decrypt something, is that true? coz u say it in the beginning that internal's state'll changed. well, i agree with that. but after both put the key to init, and then i put my msg to encrypt and send it to him. and in this point, i think the s-box and p-box got updated again, right? what i think again is...is it true that the only one who can decrypt it is me, coz the my 1st internal state has changed and the other is not yet ?

to be clear say like this:
s1,p1 -----[init with my key]----> s1',p1'
s2,p2------[init with his key,same]-----> s2',p2'
s1',p1'-----[encrypt my msg]------>s1'',p1''
s2',p2'-----[decrypt my msg]------>?

yep, in this point i don't understand.
mike
05-20-2002, 03:16 PM
"The S and P boxes are initialized before encrypting, when you supply the key. They don't change after that. "

why is that? what's in my mind is s-box and p box are both got updated each time i encrypt/decrypt something, is that true?
No, the S and P box don't change when you encrypt something. You set them up once when you provide the key and they don't change until you want a new key.

Quoting from Applied Crypto:

Blowfish is a Feistel network consisting of 16 rounds. The input is a 64-bit data element x. To encrypt:

Divide x into two 32-bit halves, xl and xr
for i=1 to 16
xl=xl XOR Pi
xr=F(xl) XOR xr
swap xl and xr
end for
swap xl and xr (undo the last swap)
xr=xr XOR P17
xl=xl XOR P18
recombine xl and xr

That's the code for encrypting one block. If you do that to every block, you get ECB mode encryption. Note that the S and P tables are only referenced, not modified.
dion
05-21-2002, 12:08 PM
? encrypt/decrypt not change s/p box, or i'm wrong reading that s-box are session dependent ?
um.. about Feistel network. i see that encrypt/decrypt just involve reverse subkey for input to F(). if encrypt/decrypt is not changing s/p box, is it possible to make the s/p box to earlier state, with reverse the subkey for F()?

i see one using blowfish like this :
s,p ----[key]---> s',p' for init
s',p'----[xored key]--->ciphertext for encrypt

is it a secure way ? is it known as one of four mode operation ?
mike
05-21-2002, 05:43 PM
Look, it's not that hard. For a given key, you set up the S and P boxes ONCE and then they never change again. Encrypt, decrypt, it doesn't matter. They don't change as long as the key is the same.

For decryption, you're right, you use them in reverse order, but they DON'T CHANGE.
dion
05-22-2002, 03:32 AM
if it really doesn't change, then am i wrong if i say the blowfish strength is at difficulty in reverse the s/pbox to earlier [phi] state ?
mike
05-22-2002, 04:22 AM
if it really doesn't change, then am i wrong if i say the blowfish strength is at difficulty in reverse the s/pbox to earlier [phi] state ?
The hard problem is deriving the S and P boxes when you don't know the password. There'd be no point in reversing the S & P boxes to the phi state. If you knew the S & P boxes, you wouldn't need to know the key, since only the S & P boxes are used for encryption.

If all you get to see is a bunch of plaintexts and the corresponding ciphertexts, then it's very hard to figure out the S & P boxes.
dion
05-23-2002, 03:09 AM
ok, i got that. and thanks for all of your replies, Mike, since i see noone replying me anymore, maybe coz i'm very new-b.
dion
05-24-2002, 03:38 AM
oh! Hi, Mike, you said that there are other easy-to-use implementations in other languages. i want to know that, please tell me.

thanks
mike
05-24-2002, 07:44 PM
Try Wei Dai's Crypto++ library

www.eskimo.com/~weidai

(if that doesn't work, remove the tilde)
dion
05-27-2002, 03:22 AM
thanks Mike :)


SoftICE/Install/Windows ME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE/Install/Windows ME
PDA

View Full Version : SoftICE/Install/Windows ME

ZasiuZ
05-13-2002, 09:21 AM
Hi,

I'm using WinME and I want to install SICE in it, but who knows how to install SICE in WinME???????

HELP?????????
phop007
05-13-2002, 11:38 AM
So easy:>

Millennium support for SoftICE
02/26/02 13:03

Q: Millennium Support
A: SoftIce 4.05 or higher supports Windows Millennium. Follow these steps to install SoftICE on Millennium:

1. Download the 'Microsoft Debugging tools for Windows Millennium' available here:
http://www.microsoft.com/ddk/debugging/

You need the debug version of io.sys out of this debugging kit in order to run SoftICE on Millennium. So, find the file winboot.sys in the directory where the tools were installed. Rename it io.sys, and copy it into your root directory. (C:\) We strongly recommend that you back up the old version of io.sys.

2. If you are running SoftICE 4.05, copy the following files into your Windows directory (C:\Windows)
winice.exe
siwvid.386
winice.dat

Also copy debugger.exe, available here, to the Windows directory:
http://Nashua.Compuware.com/drivercentral/utilfiles/debugger.exe
The_Snake
05-13-2002, 11:58 AM
if you are search for soft ice in Windows ME

Get this File & read the read me file
Download HeRe: (http://ghiribizzo.virtualave.net/icedump/wmldr05.zip)
ZasiuZ
05-14-2002, 07:17 PM
Thank you The_Snake, everything works perfectly.
It is very useful stuff


Help on Hasp4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help on Hasp4
PDA

View Full Version : Help on Hasp4

cah
05-13-2002, 02:13 PM
To,
All Dongle Reverser Engineers

I am unable to dump HASP4-M1 memory with HASPGrab 1.00.2. Is any working snippet/ utility to dump Hasp4 available? If not, Is it possible to get hasp data/memory from application? & How to do this?
I am a newbie to hasp reversing & I have read articles on hasp reversing by CrackZ Archives. How to code/emulate, to run application, if I have Hasp dump?

Help on above subject is highly appreciated.

Cah…
CrackZ
05-13-2002, 09:36 PM
Hiya,

The author of this tool, (might have been someone else), told me you have to plug in live the correct passwords (since it uses 0:0 I recall) to get a working HASP 4 dump, well, I debugged it a very long time back and put in the correct passwords and it didn't dump, unless anyone knows any better, forget this one ;-). I do have another HASP 4 dumper with source, e-mail me if you want to try it, again, I'm really not convinced it works.

In the end I settled for using Haspedit from any of the HASP CD's or the Haspdemo program (also from the CD), this assumes you can dig out the HASP passwords of the dongle you are trying to read ;-).

If you can't/ you are going to have to start tracing through the later H4 drivers to see how HASP works, i.e. unlocking sequences, I should hurry up and write my findings on this really, Tip: v4.0x drivers are FAR more friendly for this than any of the latest ones, trust me on this, I've traced a LOT of them.

Regards

CrackZ.
cah
05-14-2002, 08:52 AM
Please check your email

Cah...
helloman
05-24-2002, 09:23 AM
please mail me the tools ,thank u ,i have the same problem,
my mail is CRACKDOG@21cn.com.
r00t
05-28-2002, 08:29 AM
Look at h**p://w*w.brstudio.com/HardKeys.htm.
The guy there is claiming that he can emulate HASP4.
(U can download the emulator).
Try it, and post here the results.

Greets.
helloman
05-29-2002, 01:44 AM
I went to the Web and download the pro VER ,after install i run the installed program ,i run the program which protected with hasp4 m1 but it can not work ,i can see the PAS1 pAS2 but it didn't return the right code ,what can i do now??
CrackZ
05-29-2002, 07:02 PM
Hiya,

The 'Glasha' HASP replacement drivers are pure HASP 3 replacements, and cannot (or do not) support the HASP 4 services (unknowns are currently 3Ch/3Dh block encode and decode functions). Aladdin actually believe these functions to be secure from what I've heard, unfortunately, I know you can actually *buy* the algorithm from someone who has recovered it.

As an aside I had a brief look in IDA at these drivers, its one of a few thats a pretty custom piece of code from what I can tell, all of the others I have looked at (I'm thinking UCL/Safesoft (blatently stolen (or licensed?) from UCL) are just rewrites of the HASP int 6/int E core plus emulation routines), strip out the decryption and the registry routines and theres your HASP emulator, these drivers also locked my system too, sorry, see below why I'm not going to debug them ;-).

If anyone wants my own HASP drivers, (tested 9x/NT/XP/2K written in ASM I'm afraid) contact me by e-mail and I'll send them, in later versions of the HASP driver the core communication routines were all incorporated into hardlock.* (vxd/sys), this is HEAVILY encrypted, v4.01 drivers were the last (i.e. hasp95dl.vxd/haspnt.sys which still have the actual IN/OUT routines inside the HASP side driver), v4.65/v4.70 which I based my code on merely pass a structure into hardlock, under 9x this is via VMMCall Directed_Sys_Control and under NT IofCallDriver (from memory).

To answer the original post, which HASP service did the drivers fail on?, check BH's value. Oh and I'll write something sooner or later about all of this, just need a few days off or 3, since I don't like Aladdin too much right now ;-).

Regards

CrackZ.
cah
06-09-2002, 06:31 AM
Please check your Inbox & send me your hasp drivers

Cah...
scorpie
06-09-2002, 04:19 PM
Hello CrackZ__,

How about letting me "testing drive" your driver ?
cah
07-15-2002, 05:48 AM
Still, no reply from you. Please share with us your hasp & sentinel reversing knowledge

Cah...
scorpie
07-15-2002, 06:26 AM
Hi,

Mr. CrackZ__ is an "elite" Reverser, so do not expect to much from him. I have sent a proggy of ca. 6MB to him to test the driver. Do you think he let us test his driver ? He does not even thank for that. Nice person ?

Scorpie
CrackZ
07-15-2002, 11:05 PM
Actually, some would say I usually am a 'Nice person', it just boils down to my not having enough time / interest or motivation, I got out of this game many months ago.

And now.....

With the greatest of respect, I don't owe ANYONE here any sort of explanation as to what I do (or don't do), or why I behave the way I do, I'm sorry you feel let down, but frankly you(?) could have found your answers by now doing your own work instead of expecting me to do it for you (now I sound like G-RoM ;-) ).

Of course if you are offering $100/hr it might be a wholly different story .....

Regards

CrackZ

- genuine "Nice person" *honestly* ;-) -


Why my system crashed?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Why my system crashed?
PDA

View Full Version : Why my system crashed?

oyang2002
05-13-2002, 02:47 PM
Hello!(I am a newbie and English is not my native language:-)

I have a problem about softice. I installed softice in my
PC(I haved installed the driver of my motherboard),and each
time after I started it(I set the load mode to be by manual),when I
shutdown or reboot my PC,it will bring a blue screen error
and the mesage show that something was wrong about
hal.dll.

What can I do?

(I have tested DS2.6,DS2.5 and NTIce4.05,all of them had
this problem).

My operation system is win2000 server.


export any functions from a DLL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > export any functions from a DLL
PDA

View Full Version : export any functions from a DLL

oyang2002
05-13-2002, 02:57 PM
I wrote a progarm several months ago which can add a
section to a DLL,my purpose is to move the export directory
into this section and add as much entries as you like in
it.so you can any interesting functions from the DLL.
(Maybe I will modify it to work on EXE file too...)

Although I am a newbie and my tool is very simple,I think
it is useful indeed and I haven't notice any tool like that.
I have cracked some programs using it.

IMOP it is useful to write a serial number or license
generator.

Anybody interested?
amois
05-15-2002, 05:00 AM
Firstly, I have to say, "I am not good programmer". I could'nt understand exactly.

push x
push y
call z
cmp eax, ????

You mean, we can call "call z" which is not exported function from DLL file. I am trying to call "z" from DLL with little ASM code. Result is different from original DLL. But, this DLL is working under 3dmax (I mean it's plugin), therefor maybe I could'nt get result.

Anyway, I want to know details about your utility. If you can reply some examples, it will be nice.

regards
amois
oyang2002
05-15-2002, 02:19 PM
I have modified my program to make it operate on other
PE file such as EXE etc.

The point is to add a section and build a new export
directory where you can add entries into it. The original
function entries were kept there to make the program
run correctly. (By now the size of new section is 32KB
maybe it is enough:-)

Of course it is not always safe to call those functions
because maybe there are some variables need to be
initialized or some function need to be called first.
You know what you are doing.

I wrote a lilttle EXE and export a function from it,
the result is OK. BUT when I call a function from
a commercial software it crashed!

If you are interested we can talk about it;-)

Good luck! (To run it you need MFC42.dll)


A newbie ? re/serial fishing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A newbie ? re/serial fishing
PDA

View Full Version : A newbie ? re/serial fishing

BeHereNow
05-13-2002, 05:57 PM
Hello to all and thank you in advance.
I've been working on UltraEdit v 9.00a and to simply bypass the protection is done with a little tutorial help and a lot of hours in front of SI. My question is can serial fishing be done when it's being encrypted(I think it's being encrypted) and checked against parts of the fake serial/fake name given?
It seems the protection checks the value of a register(eax) against itself and if it is Zero then you're registered and if not then bad jump. I traced through calls and it seems that a Dword ptr is checked against some registers and in SI neither the D(dump) nor the "?" returned anything good from the Dwords mentioned in the call.
any help or suggestions, or if it's possible at all to do serial fishing in this particular version. BTW I checked various cracks for it and none had a key generator, only patches which goes around the protection but not generate any serials. Sorry for the long message and I hope you be able to understand my message. Thank you again.

Reversing is like solving one puzzle made up of many smaller puzzles, one puzzle at a time, to achieve a well deserved, and desired, Eurika.
crUsAdEr
05-13-2002, 06:17 PM
Hi Beherenow,

I am pretty sure the algo is reversible... though how hard is this i dont know! I cracked it long time ago using patching but the serial has to be generated from the name given somehow!

good luck,
crUsAdEr
BeHereNow
05-13-2002, 06:33 PM
I was browsing and I read in "self test by Kayaker" about the hash algo in level three. I think that's what UltraEdit is doing eventhough it's a different algo because I noticed certain calls are called frequently. Thanks for the reply and the assurance.


asprotect phase two!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > asprotect phase two!
PDA

View Full Version : asprotect phase two!

vbdisease
05-13-2002, 08:54 PM
hi all,

this may not be a typical "how to find the oep" thread.
i ve got some questions beyond the first hurdle.

i really got through the whole process and now iam really
happy because my first unpacked app does SOMETHING!
(not what i expected, but its alive...somehow :/ )

i used fox's great oep-finder, superbpm, si and imprec to hunt down all the imports an fix my dump.

but now, as +splaj mentioned in his cv-tut, NOTHING happend at all when i start the dumped.exe. i searched for a filecheck or a crc but with no luck. :(

i never went that far. iam really exicted. hehe. even DeDe shows fine content and w32dasm (after setting right section characteristics) disassembled everything well.

but the damn little proggie rejects to pop up :(

so, my question, is there someone who could have a look with me at this "phase 2" ??? what did i overlooked??

this is NOT a crackreq...i dont wanted to post to much infos from "phase one"...but if theres someone whos ask for it (pm?) i will be glad to discuss it with him. if the "missing thing" is not "asprotect related", then plz tell me.

thank you all....

regards
vbdisease

h**p://w*w.howcares.i.unpacked.it
crUsAdEr
05-13-2002, 09:02 PM
Hi Vbdisese,

nice work on Asp... well there are various reason why the damn proggie wont run, i have never looked at this particular target but my suggestion is get down to trace it... i mean the dumped exe... use a ring 3 debugger liekk w32dasm or Olly debugger or something, trace to see where it exits... and then see condition jumps before that... and of course use IDA to disassemble it, and Dede :>>...

it depends on where you dump the program, if you dump before dippings, the Get Date Trial Asp API is not initialised and hence the variable value in you dump will most likely be -1, for both length of trial and date left, hence the dumped exit itself.. but then that is just another guess... get tracing and you'lll find it.. of course, compare the code flow with the packed program itself....

Hope this help somehow, good luck!
crUsAdEr
vbdisease
05-13-2002, 09:47 PM
hi crusader,

man, after reading your post (and another beer)...i tried it again.

what can i tell...am i to dumb to see whats obviously?? it was right infront of my "drunken" eyes..hehe...

right after oeip there is this "backstep" to aspr:

...
015F:005818FE FF157C425800 CALL [0058427C]
....

from "original" app i got this:
...
015F:0128E8CC CMP DWORD PTR [0129666C],00
015F:0128E8D3 JZ 0128E8DB
015F:0128E8D5 CALL [0129666C]
015F:0128E8DB RET
....

guess what i found at 0129666C?

-> DS:0129666C=00580CBC

hehe...its so simple...all i have to do is change the CALL [0058427C] in dumped.exe to CALL 580CBC....

UNPACKED!!! *JUMP* *jump* *CHEERS*

ok..there may be some further "backsteps"..but they cant kill my happiness right now! :)

hehe..now my last question:

is beer good for cracking? :o) some may overlook the obvious!

i'll stay tuned....up to the next aspr!!!!!!! :))

regards
vb


Intel manuals
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Intel manuals
PDA

View Full Version : Intel manuals

kalisto
05-14-2002, 10:39 AM
Hi all
I am looking for two Intel manual:
• The Intel Architecture Software Developer’s Manual, Volume 1: Basic Architecture (Order
Number 243190).
• The Intel Architecture Software Developer’s Manual, Volume 3: System Programing Guide
(Order Number 243192).

I tried on Intel site but no luck. If sombody knows where I can dl this stuff please let me inform.
Thanks
shadz
05-14-2002, 12:07 PM
Trying google might be a good start.
redsk_y
05-14-2002, 08:44 PM
Goole is the right choice....,
anyway try this link:

developer.intel.com

Bye
kalisto
05-15-2002, 06:58 AM
Thanks I 'll try google first.
kalisto
05-15-2002, 07:29 AM
I found all on google. Good advice. Thanks again ;)


knlsoft.com down (forever)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > knlsoft.com down (forever)?
PDA

View Full Version : knlsoft.com down (forever)?

foxthree
05-14-2002, 11:43 AM
Hello:

Is knlsoft.com (home of the TRW debugger) down forever?

Signed,
-- FoxThree
esther
05-14-2002, 12:09 PM
Hi,
What are you looking for? the debugger or the site? ;)
foxthree
05-14-2002, 12:27 PM
Both ;) The Debugger (I believe 1.23 is out and I wanted to see if there is some technical material available on their site).

Signed,
-- FoxThree
esther
05-14-2002, 12:45 PM
PM ;D


WDasm32 & W2Server
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WDasm32 & W2Server
PDA

View Full Version : WDasm32 & W2Server

Nightflyer
05-14-2002, 01:45 PM
Hey all,

i have problem with wDasm32 V8.93 and Windows 2000 (Server).

Allways when i Start the Debugger in WDAsm32, and step a few
lines, WDasm32 closes completly.

Thanks for your help

Nightflyer
crUsAdEr
05-14-2002, 01:55 PM
I used to have that problem... i was able to solve that by installing service pack 2 on my win2k box... mine is win2k Pro though


DOS cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > DOS cracking
PDA

View Full Version : DOS cracking

Argoth
05-14-2002, 09:29 PM
I am currently working on a DOS program, but I have this one question:

What interupt does a program use to get the info from an input?

Hmm, actually, I have two questions :)

What interupt does a program use to read information from a file?

Grtz,

Argoth
naides
05-14-2002, 10:39 PM
h**p://www.cs.umbc.edu/courses/undergraduate/CMSC211/spring02/burt/tech_help/BIOSandDOS_Interrupts.html#int21h

I actually remember dealing with that shit. I am getting too old for this.


anti-crack tut from the developer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > anti-crack tut from the developer
PDA

View Full Version : anti-crack tut from the developer

wbe
05-14-2002, 09:51 PM
Might be an interesting reading for newbies.

hxxp://inner-smile.com/nocrack.phtml


Newbies4Newbies Crackme Discussions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Newbies4Newbies Crackme Discussions
PDA

View Full Version : Newbies4Newbies Crackme Discussions

Nightflyer
05-15-2002, 04:48 AM
Hey all,

i wanna start a miniproject for Newbies(like me).

My Idea:

We take for Example 10 Level 1 Crackme from the crackmes webside, but without the solution.
Everyone solve it alone. After one Crackme is solved, everybody post a tut how he made it, and what tools and information source he used. After all from that course solved the crackmes with or without help from the other members we go to Level 2 Crackmes and so on. Everybody from that course can ask everyone from the course to help. So each one learns from the other one.

Pls post here when u are interested.

Pls only people who are realy interested in learning.

Nightflyer
raven58
05-15-2002, 01:36 PM
Who is the author of the proposed level one crackme that you wish to work on?

Raven58
Eustace
05-15-2002, 03:38 PM
I think it's a good idea, i know little about cracking but i want to develop my skills in it :D
Maybe some of the advanced crackers can come with some good 'start-with-me'-crackme's
Nightflyer
05-15-2002, 05:03 PM
Hi,

later today i will post a few crackmes for download with level 1.
i have now 12 different kinds of crackmes, which should be very easy to solve.

I took the crackmes from Kobras, and crackmes webside from different authors.

I think in level 1 our aim should be to learn how to use the tools.
To write Keygens, and Patching the crackme file.
And of course understand the Algo. of the crackme and how it works. So dont take only a look on how to find the Serial, take a look how the whole crackme.exe is working.

Everybody feel free to post also crackmes with level 1 for download here.

This is a open course, so everybody can join, there is no chief or leader here, and everybody can post his opinion and proposals.

But pls dont use the solutions for the crackmes.

It wont help us learning.
Only experience will bring us knowledge.

Sorry for my English!!!!!!!!!!!!!!!!!!!!!!

So happy cracking

Nightflyer
Nightflyer
05-15-2002, 07:28 PM
Hi,

I realesed the first crackme in a new thread

Have fun

Nightflyer
Nightflyer
05-18-2002, 11:02 PM
Hey,

After 3 very easy crackmes i think its now time to make it a little bit difficulter, but we will stay still in Level 1.

It would be nice if there would be more tutorials uploaded by the people, and some crackmes.

GRETTINGZ TO ALL

NIGHTFLYER
Nightflyer
05-21-2002, 01:15 AM
Hi,

wow, crackme4 is quit hard to crack i didnt solved it till now.
(but still working on it).

So far i know that its packed wit upx, and the routine for the calculation is from 004298c8 to 00429b06

When u diassemble it with ida the strings are in hex format in the code area.

I used Language 2000 to find out the compression, and the language which its written with. (Delphi)

NIGHTFLYER


Crackme based on algorithm I found
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crackme based on algorithm I found
PDA

View Full Version : Crackme based on algorithm I found

nblender
05-15-2002, 06:07 AM
I found this algorithm somewhat time consuming to keygen. I found a solution, but I'm not altogether happy with it. Perhaps someone here would like to have a shot at it and see if they can find a better solution. This is a "keygenme" since the goal is to
figure out what the algorithm does, and cracking is a trivial exercise.

Name: Nolan Blender
Serial: 3495392095564672418

Some more stuff:

.text:0040165A call sub_4016B0
.text:0040165F add esp, 8
.text:00401662 cmp eax, 1
.text:00401665 jnz short loc_401680
.text:00401667 test edx, edx
.text:00401669 jnz short loc_401680
.text:0040166B push edx
.text:0040166C push edx
.text:0040166D push offset aValidSerialNam ; "Valid serial/name combination"
.text:00401672 mov ecx, ebx
.text:00401674 call ?MessageBoxA@CWnd@@QAEHPBD0I@Z ; CWnd::MessageBoxA(char const *,char const *,uint)

Hopefully someone can find a better answer to this than I did.

--nb.


For asprotect lovers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > For asprotect lovers
PDA

View Full Version : For asprotect lovers

LaptoniC
05-15-2002, 04:01 PM
I have tried to write unpacker for aspr.I guess %40 is done.I have documented IAT loader.I wont work on this unpacker for a long time.I need to concentrate on my finals.
Play with it.Hope you like it.
Ni2
05-16-2002, 02:51 PM
Hi LaptoniC!

Whassup mate? I cant believe you are gonna stop your secret project ;) Like with girls, you shouldnt stop things in the middle :p (bad for your brain after a long while)

I just want to give you some strength to continue with your project, cos you have done a very good work till now ;)

Regards,
Ni2
crUsAdEr
05-16-2002, 07:37 PM
Damn.. :>>>...

Lapto, you beat me to it :>... decided to code a decryptor instead so that i can learn some crypto along the way... does your dump or decrypt the target? And did you find out what the last emu API is? I never seen it being used though...

Anyway, i hope Alex doesnt take it too hard, cos now that AsProtected is really useless, with your unpacker and GLOBAL's inline patcher, it is rendered useless... hopefully he will come up with a brand new AsProtect 2.0 for us to play with, it is nice to reverse clean code... though obfuscated... wonder when he will release THE version that kills both Revirgin and ImPrec as he promises...

tiil then, good luck for ur exams Lapto... /me need lots of luck too :>>
crUsAdEr
LaptoniC
05-16-2002, 11:33 PM
If you dump at first getprocaddress of IAT loader you will have clean.exe which wont have any aspr dips without iat ofcourse.Because I hook gpa you can build the import table I guess.
Yes I found the emulated apis.Last one is DllFunctionCall from vb.Everything else in source code and notes.txt.
crUsAdEr
05-17-2002, 12:17 AM
Yeah that is what i did initially in my dumper... patch the IAt mangling routine to build it instead of mangling it :>... then dump from there...

but guess my coding skill is too crap... as you have seen, the loader doesnt seem very stable... hence i decide to do a safer one which decrypt the file without running it... thus learn the algo along the way...

nice, who could have guessed that DllFunctionCall :>... thanx for the info...
Hwoarang
05-17-2002, 06:07 AM
very good idea LaptoniC..congrats
DllFunctionCall? hum, I never saw VB applications protected by aspr=/
tsehp
05-17-2002, 08:09 PM
Originally posted by crUsAdEr
Damn.. :>>>...
inline patcher, it is rendered useless... hopefully he will come up with a brand new AsProtect 2.0 for us to play with, it is nice to reverse clean code... though obfuscated... wonder when he will release THE version that kills both Revirgin and ImPrec as he promises...

crUsAdEr

>>at least ! there is about 1 year and half I wait for this moment ;)

always remember those words : if it runs it can be defeated...

+orc memories.

tsehp
amois
05-18-2002, 04:49 AM
I think, PcGuard 4.04d, 4.05d already killed Revirgin & Imprec.
Hwoarang
05-18-2002, 02:26 PM
amois:
I really doubt that it's true...as far as I know pcguard can't even trick icedumps it rebuilder.
r00t
05-18-2002, 05:05 PM
Hi, anyone can tell me what's
GLOBAL inline patcher?, if it makes asprotect useless, i want it.

(i cannot find it in google).

Greets.
SilberFuchs
05-18-2002, 09:02 PM
look at:

Tools of our Trade (AIPH)

....Asprotect is not useless, is a good prog. But it seems, that the shareware-programmer aren't able to use the good features of Asprotect...

ciao :)
SilberFuchs


Newbies4Newbies Crackme Solutions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Newbies4Newbies Crackme Solutions
PDA

View Full Version : Newbies4Newbies Crackme Solutions

Nightflyer
05-15-2002, 09:21 PM
Hi,

here is my first tutorial for Crackme1

pls dont read it before u tried to solve crackme1 alone.

Nightflyer
Eustace
05-16-2002, 01:39 PM
Hi All,

Here is my solution for this crackme :)
Please feel free to comment

Greetingz
Nightflyer
05-16-2002, 07:16 PM
Hi Eustace,

Nice tutorial u made

ty

Nightflyer
Eustace
05-17-2002, 03:50 PM
Thanx Nightflyer,

Here is my solution for it...hope u like it

CrackMe #2

Greetingz
Nightflyer
05-18-2002, 10:30 PM
Hi,

here is my solution for crackme2

have fun

and Greetingz to all out there

Nightflyer
Nightflyer
05-18-2002, 10:55 PM
Hi,

here is the solution for Crackme 3

have fun with it ;)

GRETTINGZ to all out there

KEEP CRACKING

Nightflyer
Nightflyer
05-21-2002, 01:46 AM
Hi,

here is the solution for crackme1 which has been posted by
Rage

Nightflyer
get2
05-22-2002, 06:12 PM
Wanted to say nice work your doin here :)

Worked on your gncrk7 crackme, not sure what way you wanted it done the about said find serial or unpack. I took the unpack and patch trip. After it nailed me with the "you didn't think it was going to be that easy " I took the unpackin way cause i wanted to get it done hehe. But anyways if you would like a tut on the unpackin way i'll write one for ya. Ill work on the serial part in a few days.

Thanks for all your hard work on gettin this goin :)


SoftIce Crashes abruptly!@!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce Crashes abruptly!@!
PDA

View Full Version : SoftIce Crashes abruptly!@!

Ajnabi
05-15-2002, 11:39 PM
Hiya

i am having a problem with Softice 4.05 and whenever i bring up the SI Window by "CTRl+D", My OS crashes and i can see where it does that.

Softice gets hold of CONFIGMG_SET_BUS_INFO.

SO i tried to look for configmg.vxd and when i went to Windows Systems, i looked under the System Boards Drivers and found out that configmg.vxd which is a part of VMM32.vxd. Is missing!!!

I know that this is an old problem with Windows98 SE, as along with configmg.vxd other files too get deleted or corrupted.
e.g. ntkern.vxd,vcomm.vxd,vdd.vxd etc.

i did install the required files again from Windows CAB files. But when i CTRL+D again, the same problem arose.
I did unistall Windows and install it back again. But the problem is still there.

Futhermore, i am using SI for about 1 month and there have been no problem with that but recently i installed Windows XP and Driver Studio 2.6. And i had both the OS on the same HardDisk but different Drives.

Does anyone know how to fix this problem.
Do i have to format both my drives.?

Thanx
JMI
05-16-2002, 03:00 AM
It appears from your description that your original OS is either a version of NT or Win2000. It would be easier to attempt to help if you were more specific about what OS you are running before you installed XP. I have seen some discussion indicating that when one is running a dual boot system that the Win2K system should be installed last, to avoid some of the essential files from being replaced by the other OS.

I've recently started a switch to Win2K from Win98se and have the "old" OS installed on a separate hard drive and I do remember reading some material from the M$ site discussing which OS systems can be loaded on a dual boot system. Since I don't run XP, I didn't pay too much attention to the discussion of whether they recommend such a combination, but there are definately articles in the M$ Knowledge Base dealing with the compatability of various OS systems on the same machine. I'd recommend you start there first and I''ll also check the articles I downloaded and see if they address this issue.

If you search this board you will also find a great deal of discussion about the perils of attempting to run Sice with WinXP. Some people are having no serious problems with DS 2.6 and many can't get it to work at all, which suggests hardware/driver related problems. We know that Numega hasn't gotten their act together fully with integrating Sice with XP yet.

Regards.
Ajnabi
05-16-2002, 07:34 AM
HIya JMI

i had written that i m Using Windows 98 SE and then laterz i installed Win XP.

The problem is that i have been using Softice for anout 1 month and there hasnt been a single problem.First i was using SI 4.05 and then laterz changed to DS 2.5 and than at last i came to DS 2.6. Every version i installed was working perfectly on Windows 98 SE, but i tried it with WInXP and i went ahead and installed DS 2.6. Though it didnt work as it had problems with my VGA Card as i hadnt installed it in XP, though i was just checking it out in XP as i dont use XP much. It was only for Oracle as it doesnt work in WIn 98SE.

If the problem was to be with Dual OS, then i have removed WIn XP though manually.

Thanx for ur reply
crUsAdEr
05-16-2002, 10:11 AM
Howdy,

I am not sure what your problem is... I am dual booting as well, only have win2k and winXP though so both of them are NTFS... my win2k has sice and XP doesnt.. one thing i am sure of, XP isnt very well supported by sice yet...

It might be some problem with your partition file format, NTFS and FAT32 on the same drive, how you set them up to boot... as in if you have win98 + sice... then you install win XP to boot from the same primary partition again, even though your winNT folder is on another partition... this might mess it up...

If this is the case, before you install winXP, go to BIOS and change the primary partition to the blank partition where you wish to install winXP, so that the installation will not touch your win98 partition at all... then get some boot manager to organise your boot up process... just asuggestion.. i am not sure how you actually dual boot....

Regards,
crUsAdEr
Ajnabi
05-16-2002, 10:17 AM
Hiya

i have already posted that i have removed WINXP and im using Windows 98 SE ONLY!!!.

But the problem with SI still remains, it craches at CONFIGMG_SET_BUS_INFO

and when i restart my comp, my configmg.vxd gets deleted along with other vxd's, so i have to copy the vxd's from WIN98 SE CAB files.

Thanx
crUsAdEr
05-16-2002, 11:06 AM
Hmm,

so you did boot XP on the same partition... guess clean install will have to do then...

You might want to try to "upgrade" your win98, as in install win98 again on top of the current win98 version right now, hopefully it fixes up the system files and everything, but sometimes it doesnt (or most of the time actually:<)... if it doesnt work guess you will have to clean install everything cos my guess is that remnant of winXP sys file still lie ard in ur HD...
Ajnabi
05-16-2002, 06:40 PM
Hiya Crusader

At first when the procedure of installing WIn XP, my Motherboard gave me a warning signal that a program is trying to "WRITE TO BOOT" and that file was of WIN XP and was named as WINNT somethin like that but sure did contain NT part.
And i granted the permission as without it it would let WIN XP install.

And when the problem arose, i did install Win98 SE over my previous one but that didnt help either. Then i went and removed Win XP manually. And that didnt also help. So furthermore i went and FORMATTE both my drives which contained WIN 98SE and the one which use to contain Win XP.

And reinstalled WIN 98 SE from scratch. BUt then when that didnt help either. I think the file which was written to the BOOT sector is causing the problem.

When the last time i Brought up SI, it crashed at this address.

CONFIG_SET_BUS_INFO
0028:FF02E37A MOV EAX,[FF033628]
0028:FF02E37F CMP EAX,[FF033088]
0028:FF02E380 JBE FF02E38F

and the line that gets highlighted is the CMP eax,[bla bla] one.

And i know that

CONFIGMG.VXD (configuration manager for the motherboard)

Thanx
JMI
05-16-2002, 11:57 PM
Ajnabi:

I still recommend that you check out the M$ Knowledge Base for articles on a dual boot system.

You will find several articles at:

hxxp://search.microsoft.com/default.asp?IntCat=0&Boolean=ALL&Nq=new&qu=dual+boot&ig=1&siteid=us/products/windows/windows2000.

There you will find articles such as:

How to Multiple Boot Windows XP, Windows 2000, Windows NT, Windows 95, Windows 98, Windows Me, and MS-DOS (Q217210)

and

HOW TO: Create a Multiple-Boot System in Windows XP (Q306559)

The second discusses a dual boot with Win98se and WinXP and explains, as you found, how WinXP overwrites the boot sector and has to be installed last to function properly. This article does suggest that when you reinstalled Win98se you should have fixed the boot sector problem, but you also stated that you did not "uninstall" WinXP, but "removed it." This could also be contributing to your problem. Win2K has an automatic repair function added which will restore damaged files without letting you know about the activity. Since WinXP is based upon the same kernel, perhaps it is "repairing" itself at boot and replacing files otherwise needed for your Win98se boot. Just a thought.
Did you install a NTFS partion for the WinXP partition, and if so, did you also re-format the Win98se partition for NTFS?

Also, I was not able to find a version of DS 2.6 for which I could get a working Icedump on Win98se, so I went back to 4.05, where it works fine. Unless you are a developer, it should work fine for most of what we do in RCE.

You may, in deed, need to reformat your hard disk and reinstall everything to get your motherboard to work again with Win98se and SI. Although you mentioned that you did format, you may have not done a complete format from a DOS boot disk and you might try reinstalling the system files to your boot sector on the start-up disk from your Win98se start-up disk.

Regards.
crUsAdEr
05-17-2002, 12:03 AM
You could also try copying back mbr with
fdisk /mbr

Or best, use WinHex to see what ur boot sector looks like :>>....
Woodmann
05-17-2002, 12:15 AM
Howdy,

If your running fat32 you need to delete the partitions
first, then format, then re-partition.
Dont ask me why, I dont feel like explaining it.

You can easily do this with fdisk.

Peace, Woodmann
Ajnabi
05-17-2002, 12:56 AM
HIya thanx ya all for replyin

Though i tried out copyin the Batch Files in this Manner. And it sure did help. As when i Press CTRL+D, my computer doesnt crash anymore but though in place of SI Window i just see plain BLACK Screen. I havent tweaked the settings of SI. And ill let u on when im done with it.
Here's the trick which works and i hope this will help other too.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Some of the steps only tell you what needs to be done and not how to do it. If you don't know how to do it, then I suggest that you should re-consider attempting this procedure. In this archive are samples of what the 2 batch files you are going to create should look like. As written they may not be appropriate for you system, so please follow the steps below to create batch files for your system, and use the samples only as a guide to what your completed batch files should look like. The entire procedure can be run from within the Win9X GUI, there is no need to start in Real Mode DOS as is the case with the earlier version of this procedure. Note that in my examples in some of the steps, I only show 3 entries for file lists that will be much larger (probably 40 or more lines). Also for these batch files you will be creating case does not matter.

1.First you must know what files are in your current vmm32.vxd file. You can get a list from the registry at HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Control \ VMM32Files. Since the list is rather long, and because this procedure involves creating a batch file using this list of file names, the easiest thing to do is export this key to VMM32.REG

2.Open VMM32.REG in any editor that you want. An editor with Search and Replace (abbreviated as S&R in this procedure) capability is best (thus NotePad will not do, but WordPad will). The steps in this procedure are written to take advantage of S&R. The editor you use must allow you to save the results to an ascii text file.

3.Delete the first few lines so that you are left with a list that looks something like the following:

"biosxlat.vxd"=hex:00

"combuff.vxd"=hex:00

"configmg.vxd"=hex:00

4.Save what you have so far as WININIT.INI which we use later in this procedure.

5.Now continuing editing VMM32.REG and using S&R enter "=hex:00 (Note the leading quote mark in this text) as the search string and leave the replace text blank and then do a Replace All. You should now have a list that looks something like:

"biosxlat.vxd

"combuff.vxd

"configmg.vxd

6.Now replace all occurrences of " (a single quote mark) with one of the following text strings:

extract /a /y H:\win95\win95_02.cab (for Win95 users)

or

extract /a /y H:\win98\base4.cab (for Win98 users)

Note: In the above commands you have to change H:\win95 or H:\win98 to the actual path that your Win9X cab files can be found at whether it be a CD directory or some HD directory. Also note that there needs to be a SPACE at the end of the replace string. When you have completed this step your file needs to look similar to:

extract /a /y H:\win98\base4.cab biosxlat.vxd

extract /a /y H:\win98\ base4.cab combuff.vxd

extract /a /y H:\win98\ base4.cab configmg.vxd

7.Now ADD the following 5 lines to the TOP of the file:

@echo off c:

cd \windows\system

extract /a /y H:\win98\ base4.cab vmm32.vxd

cd \windows\system\vmm32

The C: in the second line must be changed if you have Win9X installed on a different drive. Also if \Windows in not your base Win9X directory, you need to change the two CD commands accordingly. These commands are necessary to ensure that the files get extracted from the cab files to the appropriate locations on your HD.

8.Now ADD lines similar to what's below to the END of the file. The purpose of these lines is just to give you some sort of an on-screen message when GETVXD.BAT finishes so that you will know it, and also know that it is OK to close the Dos Window that will be left open:

cls

echo extraction of files is complete, it's ok to close the dos window now.

9.Now compare your list of file of files to be extracted to those files that currently exist in your \Windows\system\vmm32 directory. If any files in your list already exist in this directory chances are that they are newer versions than what is on your CD. It is up to you to determine this. If you determine that the version of a file in your \Windows\system\vmm32 directory is newer than what is in your cab files, then Delete that entry from the list because we don't want to overwrite a newer version already existing in the directory with an older one that will be extracted from your cab files.

10.Save your work as GETVXD.BAT

11.Load the WININIT.INI saved in step 4 into your editor.

12.Using S&R enter "=hex:00 (Note the leading quote mark in this text) as the search text and for the replacement text enter =c:\windows\system\vmm32.vxd (adjust the drive\path if necessary) and then perform a Replace All. You should now have a list that looks something like:

"biosxlat.vxd=c:\windows\system\vmm32.vxd

"combuff.vxd=c:\windows\system\vmm32.vxd

"configmg.vxd=c:\windows\system\vmm32.vxd

13.Using S&R enter " (a single quote mark) as the search text and c:\windows\system\vmm32\[/B](Adjust drive\path if necessary) as the replacement text and perform a Replace All. You should now have a list that looks something like:

c:\windows\system\vmm32\biosxlat.vxd=c:\windows\system\vmm32.vxd

c:\windows\system\vmm32\combuff.vxd=c:\windows\system\vmm32.vxd

c:\windows\system\vmm32\configmg.vxd=c:\windows\system\vmm32.vxd

14.At the TOP of the file add a section header of [SetupOptions] and under it Combine=1, Under this add another section header of [CombineVxDs]. Your file should now be similar to:

[SetupOptions]

Combine=1

[CombineVxDs]

c:\windows\system\vmm32\biosxlat.vxd=c:\windows\system\vmm32.vxd

c:\windows\system\vmm32\combuff.vxd=c:\windows\system\vmm32.vxd

c:\windows\system\vmm32\configmg.vxd=c:\windows\system\vmm32.vxd

15.Once you have your file looking like the above example save it keeping the name WININIT.INI

16.Move WININIT.INI and GETVXD.BAT from wherever you saved them with your editor to your \Windows directory

17.Although not required for the rest of the procedure to work, I strongly suggest that you backup any files that already exist in your \Windows\system\vmm32 directory as well as your current vmm32.vxd file and your current registry. How you backup these files is up to you.

18.In the Start > Run dialog enter GETVXD and click on OK to start the batch file which should log you on to the HD that contains Win9X, change to the appropriate directories and extract all file to these directories, automatically overwriting any files that exist with the same filename. Depending on your system speed this batch file may take a while to execute due to the simple way it was written which caused only one file to be extracted from the cabs at a time. I don't think you will be using this batch file often enough to worry about combining filenames on an extract command line to save a little time by extracting multiple files at a time.

19.Restart Win9X and during the startup process, WININIT.INI will be processed. While wininit.ini is being processed you will get a Please wait while Setup updates... message on your screen, as the new vmm32.vxd file is created from the individual files in the \Windows\system\vmm32 directory. During the process, all files combined into vmm32.vxd will be deleted from the \Windows\system\vmm32 directory leaving only those that do not belong in vmm32.vxd (were not listed in your wininit.ini file) which should have been there before starting this procedure.

That's it, you should have re-built your vmm32.vxd file. If everything is working, BACKUP your new vmm32.vxd file now, so if anything happens to it you don't have to repeat this procedure.

I hope this helps others which have problems relating to VXD's
Ajnabi
05-17-2002, 01:04 AM
Hiya WoodMann

I wanted to give a last try before reformatting my Partitions and drives.

And i guess it worked but then ill still have to see.
And if everythin works out well then ill let u guys know.

And for the part, i have FAT32 on WIn98SE and it was the same for WinXP too untill i "removed" it.

Though what im tryin to state here is that every other program in my Comp just works fine with no Glitches whatsoever, but my comp only crashes when SI is Invoked.
But now it doesnt but i have to get rid of the Black Screen and im very tired with all the formatting and copying. I had to make a Backup of all my files in orde to format.
Ajnabi
05-17-2002, 11:19 AM
HIya

i had posted a way to copy all the needed VXD's by the OS. And it really did work.
Now my SI does not crash or hang. Its work perfectly.

Though i havent tried DS 2.6, not for atleast.

Guess i didnt need had to reformat and repartition my drive afterall.

Anywaz i think if anyone comes across this sort of Problem with SI, my previous post might be of help.

WoodMann can u make this post a Sticky one.

Thanx
Ajnabi
05-28-2002, 02:53 PM
HIya

i have found out the problem which causes the hangups when using DS 2.6.

Its with Microsoft's Wireless Intellimouse aas im using it.
When i just plugged it out, Si didnt crash as it used to .
JMI
05-28-2002, 04:07 PM
Ajnabi:

I believe that there is a wireless mouse setting in the setup for D.S. 2.6 for using a cordless mouse and I seem to remember that it specifically has a setting for the M$ cordless intellimouse.. Works fine with my logitech cordless. Check the set-up features and you may be able to activate this feature without reinstalling D.S. 2.6. Or you have it working and could just leave it alone.

Regards.
Ajnabi
05-28-2002, 09:01 PM
JMI

i did actually choose the option for PS/2 or USB and i also checked on Enhanced Mouse.

It does detect it, theres no doubt coz when i disabled it at first, it gave a Message that theres a mouse detected with Enchanced features.

But when i keep the settings, SI crashes. Though if i disable the mouse in Settings.
Everythin Works.


Crackme Newbie Classics 2-4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crackme Newbie Classics 2-4
PDA

View Full Version : Crackme Newbie Classics 2-4

Rage9
05-16-2002, 05:04 AM
Ok i guess I'll jump in on this, its time to re-crack and re-reverse my 3 previous crackmes, they have been disscussed on this board so if you search you will find the solutions, but good learning material!!! Classic!

http://www16.brinkster.com/realcool23/download/rcrackme1.zip

http://www16.brinkster.com/realcool23/download/rage2.zip

http://www16.brinkster.com/realcool23/download/RIII.zip

In order from easyest to hardest, enjoy!

-Brad
Nightflyer
05-16-2002, 06:10 AM
Hi,

i tried to download your crackmes, but the link is not working, even not when iam on the main side and click on Download

Nightflyer
CoDe_InSiDe
05-16-2002, 06:24 AM
Hi Nightflyer,

Just go to here:

h**p://www16.brinkster.com/realcool23/main.htm

And from there go to "downloads" ;)

Cya...

CoDe_InSiDe

*Edited*
Pff... Lame CoDe_ must be sleeping :D
I see what you mean now hehe... ;)
Nightflyer
05-16-2002, 07:19 PM
Hi,

Sorry its still not working!!!!!:(

Nightflyer
Rage9
05-18-2002, 04:48 PM
It works for me I just drag and drop the link into my address bar (MSIE) and it works fine....

-Brad
Nightflyer
05-21-2002, 01:48 AM
Hi,

sorry the link is working.

I posted the my tut for crackme1 in the solution area

ty for the Crackmes

GREETINGZ TO ALL

NIGHTFLYER
Sphinx
05-23-2002, 01:40 PM
i posted the solution to these crackmes a while ago but i could find them any more with the search maybe i re post them if anyone would like that

Sphinx
Adri_Magnon
06-19-2002, 05:53 PM
Hi,

I am new and need some help on the first one (rcrackme1). What I did was open up the prog in Wdasm and since it was only 6 pages, printed it. Then I figured I'd use Hiew to make any changes. The thing is, I really don't understand the setup. I got a few FAQs on ASM and read through them but I still can't figure this one out. I tried some editing and got a lot of crashes and got the compare and exit buttons to not work but couldn't get the two boxes to be equal no matter what.

I was hoping I could just change thebox displayed when the numbers were compared to the same box and then for the optional 'exit' box, use the one that wouldn't be needed (the numbers are not equal). I was thinking maybe three lines of code at most. So, anyway, I give up :( and was wondering if you can post the solution to this crackme.

I searched the forum under Rage9 and Sphinx and also solution(s) and rage and crack. I got some weird results. Under some searches I got only up to the begining of May and under just display threads from begining I got them all. I also tried Google and Copernicus and the student papers at Woodmann.

Thanks,

Adri_Magnon
Adri_Magnon
06-19-2002, 07:08 PM
Hello,

Alright. I found NightFlyer's solution text. I feel kinda stupid. I realized my problem was how I was reading my Wdasm print out. I had all those "* reference" and basically just a lot of unnecessary lines so when I got to the part that NightFlyer used I passed over it. I got a ASM text and started trying to translate the code to thngs I would understand better.
I had really wanted to complete it without help. I figured I might as well share how I appraoched the problem and how I thought I was gona solve it.

I figured that the simplest way to do it would be to convert the information in box one to Hex and then save it at some register. Do the same with box two and then compare them with some "if, else" code. My quick writing was

1 -> hex = A
2 -> hex = B

CMP A, B
IF A,B = 0 goto "Equal"
Else goto "Not equal"

I thought one possible way to solve this would be to add the two values together and create and compare resulting value.

A+B=C
B+A=C

CMP C,C

Then I thought maybe the jump that "Not equal" used could be changed to the same one that "Equal" used.
I figured that if the "Not Equal" msg box was gonna be available, to use the exit button to open that up and the "OK" button on that box could be used to close the program for good.

I figured that would be around three lines of changed code.

Anyway, I read through the code and couldn't pinpoint where the decision of box displayed was shown. I also couldn't find where the two values where saved. I though that some code was being used where the values where changed by some math deal. If some one could suggest for me a tutorial that covers these ideas and actions more in depth I would REALLY appreciate it.

Thanks,

Adri_Magnon
P.S. I have a quick question, what does "Jmp dword ptr" mean?
Rage9
06-20-2002, 04:23 AM
Here are some links to help u out bud:

Full, in depth discussion for Crackme #1:

http://www.woodmann.net/forum/showthread.php?s=&threadid=159

Full, in depth discussion for Crackme #2:

http://www.woodmann.net/forum/showthread.php?s=&threadid=161

Full, in depth discussion for Crackme #3:

http://www.woodmann.net/forum/showthread.php?s=&threadid=166

maybe ill start work on another, i have not been on the scene much lately so yeah

-Rage
ZaiRoN
06-20-2002, 09:46 AM
hi Adri_Magnon,
what does "Jmp dword ptr" mean?
this is an *indirect* jump:
jmp dword ptr [404040]
the execution of this instruction brings you not in the instruction at address 404040 but in the instruction at address pointed by the double word (4 bytes) at 404040.
maybe a little example could help you:

... <useless code>
00407030: jmp dword ptr [404040] <-- you are here
... <useless code>
00408005: ret

if you want to know where the jump will bring you, you have to search what's the double word pointed by 404040 is.
suppose that 404040 points to this byte's sequence:
404040: 05 80 40 00 90 90 90 90...
we are interested in the first 4 bytes. so the jump instruction will bring us at 00408005, the 'ret' instruction (remember the intel notation!)

you can use this method with other instructions ('mov dword ptr...', 'cmp dword ptr..')...the concepts are the same.

ok, this is only a little (quickly) explanation; now you can deepen the argument looking for some nice asm tutorials (iczelion's site is a good reference point;))

bye
ZaiRoN


I need some help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I need some help
PDA

View Full Version : I need some help

kalisto
05-16-2002, 10:17 AM
Hi all
I have small prog. which is packed and I am not sure is it asprotect or else. I tried with PE identifier and response is 'asprotect 1.2 - 1.3 , but with PE-scan response is 'unknown packer'.
Fox3 OEP finder find signiture bytes 61 FF EO for asprotect 1.12 but also found sig. bytes for ASPack 2.12 but probably not part of protection ( I think).
Next I tried bpx getversion and search for 61 FF EO as Splaj wrote in tuts but no luck.
Any suggestion?
foxthree
05-16-2002, 10:38 AM
Use the address provided by OEPFinder and put a bpmb on that (bpx is also okay). ASPR uses SEH to clear DRx; so use SuperBPM or something like that to break on that bpmb.

Signed.
-- FoxThree
kalisto
05-17-2002, 02:13 PM
Hi foxtree, finally I found OEP with your tool. It's ASProtect 1.12
Nothing work either BPX, super BPM, or BPMB address X only BPR 1243BBO 1243BB0+1 R (IF EIP==1243BB0) work. After 10 min finally break at signiture bytes, and it is really OEP (push EBP...). Thanks foxtree and improve OEP finder.


flexcv - convert hex or integer value into lm_attr define
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > flexcv - convert hex or integer value into lm_attr define
PDA

View Full Version : flexcv - convert hex or integer value into lm_attr define

nblender
05-16-2002, 03:07 PM
This converts the hex or integer values passed into set/get_attr
into a useful text string.


Anyone can give insights on InterLok 3.0.7 ActiveX API?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anyone can give insights on InterLok 3.0.7 ActiveX API?
PDA

View Full Version : Anyone can give insights on InterLok 3.0.7 ActiveX API?

machun
05-16-2002, 04:29 PM
Used in all recent InstallShield programs, namely Developer 7.03 - full released is sent as update and there goes activation screen... The .exe is not wrapped in any way, but the whole activation stuff is in an activex, and I'm not that good at cracking this stuff. Ran IDA over the .exe and quickly located one suspicious point where the ax is invoked - patched a jump around this call - this got rid of activation prompt, but resulted in page fault when ISD was fully loaded.
Not that I'm abandoning at the first sight of trouble, but if anyone already played with InterLok activation through their AX API, then any insights would be really appreciated. :)

Thanks in advance.
Iwarez
05-16-2002, 08:06 PM
I also got this target but after 4 hours hard work I got finally around it. I did not crack the InterLok protection but did circumvent it. You should also try that for a quick patch. Offcourse some InterLok insights would be welcome. It seems the InterLok stuff is located in a resource called PACE0000 (I don't remember it exactly but this should be it) inside IsAppServices.dll. Any help for the InterLok would help me too to make a real patch.


AIPH first public version!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > AIPH first public version!
PDA

View Full Version : AIPH first public version!

GlObAl
05-16-2002, 06:26 PM
Hello to everyone,
here is my ugly patcher AIPH (ASProtect Inline Patch Helper), it will support version 1.21 and higher.
Atm there was only 2 tuts for it but i will write more if there was any interestet in it or maybe other can write too.

USE IT AT YOUR OWN RISK!!
I AM NOT RESPONSABLE FOR ANY DAMAGES!!

I stole the last lines lines from mEtAl ´s ASPIP info :)
LOUZEW
05-16-2002, 07:35 PM
Wow very good Work !

For sure, you can write tutorials, will be very interesting !
Jon
05-16-2002, 09:03 PM
gr8 work m8 GR8 WORK!!!!

10x Alot
npanic
05-18-2002, 07:27 PM
Let them tuts coming.

BTW, very nice tool.
Solomon
05-24-2002, 10:11 AM
great!

I tried it with ReGet Deluxe 3.0.121. It always crashes at address 0x77XXXXXX, which is in the kernel addr space, no matter what combinations of the options.

hxxp://deluxe.reget.com/dl/regetdx.exe
GlObAl
05-24-2002, 08:19 PM
Hello Solomon,
you on the right way its realy interesting this crashing at address 0x77XXXXXX its the same thing on the newest CloneCD.
Put a bpint 3 in softice and try the exe again and you will see something interesting :)

I wrote an tut for it... and yes i know my english is really bad :x

regards...
Solomon
05-25-2002, 07:13 AM
sorry GlObal, it's the crash of AIPH.exe, not the target's crash. The addr on my machine is 0x77DFFA1C, which belongs to user32.dll. Error msg box says "The instruction at 0x77DFFA1C tries to access memory 0x0000042B, which is not readable". The target has not been patched yet. My OS is Win2K Adv Server SP2 build 2195.
BTW: There is no default options set when I run AIPH.exe. That is, no checkbox is checked in the GUI when I launch it.

Thx for your tool and nice tuts:)

I have manually unpacked it and fully cracked it;)
GlObAl
05-25-2002, 11:48 PM
Hello Solomon,
you are right AIPH crashed under w2k, because i tested it only under win98 and XP.
Here is a never version that will run under w2k i hope :)
In this version the headpatch was 10 bytes smaller, because CrUsAdEr showed me something that i din´t saw, thank you ! :)
But with this changes the Offsets in the tuts won´t match anymore you have to -10 bytes :)

regards
Solomon
05-26-2002, 06:55 AM
Thx GlObal.

I d/l the new version. This time AIPH.exe crashes at 0x00401464, right after it says "no enough space to patch...". Please fix it. Thx.
GlObAl
05-26-2002, 10:17 AM
Hello Solomon,
i am sorry for that all, W2k showed me really how bad i code !
I hope this one will do the job...

regards...
Solomon
05-26-2002, 10:40 AM
this works. :D Thx
Solomon
08-23-2002, 01:53 PM
hi Global,

I tried all the methods(1~6) with ReGet Deluxe v3.1 build 118. The patched file always crashes at addr 6AD8XX. And I set a BPINT3 before I launch the patched exe, but it's not hit. Would u please check it? Thx
hxxp://deluxe.reget.com/dl/regetdx.exe

BTW: I manualy unpacked it and it runs well except that it will crash on exit. Don't know why. Maybe the author uses new trick.
Stone()
08-23-2002, 02:29 PM
I belive we can forget about it with latest ASPR versions.

They won't run when patched with Aiph.

Reget 3.1 Build 137 build still was patchable, but final Build 138 is not.

So had to go back to unpack it and crack it in the usual way.

A new build of Aiph is needed.

BTW I have no crash on exit. Maybe some fault when adding the import section? It happened to me when doing it on ME, but not on XP.
GlObAl
08-23-2002, 03:02 PM
Hello Solomon and Stone,
first i want to tell a little story about beliving and things like that.
for long time i read a good tut about manually unpacking aspr and the cracker wrote in his tut that is not possible to inlinepatch aspr anymore and i belive him.
This mean i havent tried to inlinepatch it because i belive him.
Some time later my boss tell me that i was an good one and he will give me more money next time and i belive him.
I belive lot of pll and what they say...

Look authors of armadillo say:
There are three Armadillo-attack programs listed there: "Armadillo Killer", "UnArmadillo", and "Armadillo Deprotector". The latter two are unpackers, the first one is a stripper; all three can only work on specific (very old) versions of Armadillo. Even on the versions they did work on, a custom build would break them; they have no chance with newer versions, even public builds of them. Does that answer your question?

Thats also not true because they cant be sure how can i say anything when iam not sure ? :~)
Now iam an old man :~) and i dint belive anyone no more before i dont tried it by my own...
This is my little story :)

@Solomon
ReGEetDX use not the newest version of aspr but AIPH 1 can´t handle it with one of the 6 method´s so choice 'Layer breaking method' manually and patch it with CRC and end jump.
Than close AIPH 1 and open the patched exe with hiew and go to .6AD831 and replace the orginal 3A byte to 5A and save.
Now put bpint 3 in sice and start the exe and you will see its still working.

best regards...
Solomon
08-23-2002, 05:04 PM
Global,

Your AIPH is a proof of using own brains:)

I tried as what you said and it works. But just wonder why change 3A to 5A? what's the meaning behind this change? I checked it with both SICE and W32dasm, can't figure it out. Can u explain it a little. Thank you for your great tool!:D
Stone()
08-23-2002, 05:40 PM
GlObAl that proofs you're knowing more than all of us about
Aiph and Asprotect :)

Agree with Solomon: You're story is nice, but a new tale about the meaning of this 3A > 5A change? How can a poor soul like me figure out something like this.

I aleady found out that the manually patch was the way to go, and I can only presume that the change has something to do with the Asprotect CRC check, as it said: File is corrupt.

Well at least now I've done both, unpacked and fixed, and in-line patched. Works fine now.

Please go on with the 2nd part of your story.
nofurs
08-23-2002, 06:32 PM
Hi Stone(),
You can't rely everything on tools.Tools only help ya making
life more easier.Many things ya have to find out yourself.
GlObAl
08-23-2002, 10:52 PM
Hello everyone,
first you have to find the right place... open regetdx.exe with hiew and press f7 to search for the word 'kernel'.
the first one is wrong, go on searching.
_.006AD930: 5E D9 2A 00-71 D9 2A 00-00 00 00 00-00 00 00 00 ^+* q+*
_.006AD940: 6B 65 72 6E-65 6C 33 32-2E 64 6C 6C-00 00 00 47 kernel32.dll G
_.006AD950: 65 74 50 72-6F 63 41 64-64 72 65 73-73 00 00 00 etProcAddress
_.006AD960: 47 65 74 4D-6F 64 75 6C-65 48 61 6E-64 6C 65 41 GetModuleHandleA
_.006AD970: 00 00 00 4C-6F 61 64 4C-69 62 72 61-72 79 41 00 LoadLibraryA
this place is right and in every version the same...
so scroll up and it will look like this:
_.006AD830: 1A 3A 53 DE-04 80 9D F1-8D 87 DC 7E-55 D1 47 75 :SÌÇØ±ìç_~UÐGu
_.006AD840: A9 9E A8 E6-C3 9F 29 6C-8F 19 AA 4C-C3 BD B8 10 ®×¿µ+ƒ)lÅ¬L+¢©
_.006AD850: 00 00 00 00-00 00 00 00-00 00 00 00-00 00 00 00
so write the address 6AD830 or 6AD840 down to a paper and close hiew.
Now use LordPE to break and enter at the start from the exe.
Put a bpx virtualfree and sice will popup after f12 you see the virtualaddress where aspr code start.
Press u 6AD830 in Sice and you will see what i do at this place...

yes i know its hard to understood but for me is harder to tell it good... :~)

in newer versions of aspr there was an easyer way to inlinepatch it.

best regards...
Stone()
08-24-2002, 08:38 AM
Thanks GlObAl.

Yes it's hard to understand and eventually I will :)

At least I can do something with your reply.

Yes, I've seen now what you did and why the 3A > 5A change;
not with SI, as doing as you said u 6AD830 I got 'invalid address'.


SD2 - Why God ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SD2 - Why God ?
PDA

View Full Version : SD2 - Why God ?

blackos
05-16-2002, 10:39 PM
Hi all...
I know great people are all around this forum, so, I ask my question.
Why is there so few information about Safedisc2 all around the web ???
especially concerning version 2.51.xx or better 2.60.xx ???

I'm actually dealing with version 2.60.xx and I got stuck...

I'll hugely appreciate any kind of information about this !!!

thanx to all of you.

:)

blak.
KeopS
05-20-2002, 11:27 AM
> I'll hugely appreciate any kind of information about this !!!

hmm ... be more specific please :D
Pyrae
05-23-2002, 10:46 AM
I think, a kinda little list about the Anti-*.* stuff and crypto routines currently used would come in handy for people not deprotecting games very often. The ways to bypass them should then be obvious most of the time, I guess (surely no need for a 'then-press-F12-65535-times' type of text here).

So, if someone lately dealt with an up to date SD2 version, I'd appreciate some rough info, too...

Pyrae
ThrawN
05-23-2002, 12:53 PM
What sort of information you looking for? additional anti-debug changes?
blackos
05-24-2002, 09:06 AM
Hi all, and thank you for your time
:)

So, I need to be more precise, of course, then I'll do :

I'm actually dealing with version 2.60.52 of SD2.
You have to know that I'm neither a system guru nor a little newbie lost in Softice's world.
I first tried to use a classical approach to reverse SD2, that is exe dumping... then I tried to rebuild IT by myself.
By the way, I succeded easily in bypassing the anti-SI trick which quits when a BPM x is set. So, it's not a big deal for me to break when I want now....
But bad news for me because one vector in the table can lead to many different APIs. Ooops... it appears that the offset of the 'caller' is important for SD2. That means that after compilation, the code of the main program has been modified to create this strange Import Table stuff. Am I wrong ? Please, tell me....

Well, it's tricky for me. There could be a simpler solution than coding a sort of 'scanner' which will rebuild every call in the code ??? Have you got any Idea ?

It's not all... apparently, some internal calls of SD protected application are made in one of 2 new sections which are SD2 sections.... so some procedures are replaced by SD ones, Am I wrong ?

Now, I think I used a bad approach to reverse SD2... I'm actually trying to understand how all this stuff is made and how to code a 'generic' dumper or loader or unprotector.

It's really interresting, but I feel it a bit hard for me, so any kind of help will be wonderful ! (informations, sourcecode, or advices for a GOOD and WORKING approach).
I would like to succeed in dumping a working EXE in a first time, then *try* to make a generic tool in a second time.

Thank you all guys.

blak.
:)
[yAtEs]
05-24-2002, 03:02 PM
>But bad news for me because one vector in the table can lead >to many different APIs.

indeed, if you're taking the classical approach then you'll need to
build an array of the calls and catch the api then create a new thunk and place the values here and patch the code to use this.

>Ooops... it appears that the offset of the 'caller' is important for >SD2.

however,..if you want to take the reverser approach then here is a good start. you've identified the offset of the caller is important, so try BPM RW this and spend a while following it (:

>That means that after compilation, the code of the main >program has been modified to create this strange Import Table >stuff. Am I wrong ? Please, tell me....
your not wrong, a new strange import table is indeed in place (:
hmm so wheres the real one? looks like you need to take the above approach to find out more.

>Well, it's tricky for me. There could be a simpler solution than >coding a sort of 'scanner' which will rebuild every call in the >code ??? Have you got any Idea ?
it can be done, but there is many different types of ways of calling
apis, and it and be a big task. and even at the end theres
other things that need repairing.

>It's not all... apparently, some internal calls of SD protected >application are made in one of 2 new sections which are SD2 >sections.... so some procedures are replaced by SD ones, Am I >wrong ?
ah, what was i just saying about others that need repairing, ..oh yes now i remember (; yup code is replaced with code in from the
2 stxt sections, you can investigate it quite easily.

>Now, I think I used a bad approach to reverse SD2... I'm >actually trying to understand how all this stuff is made and how >to code a 'generic' dumper or loader or unprotector.
to understand how everything works is never a bad approach to reversing q:

>It's really interresting, but I feel it a bit hard for me, so any kind >of help will be wonderful !
jah, interesting init (:

>I would like to succeed in dumping a working EXE in a first time, >then *try* to make a generic tool in a second time.
good idea.

hope this helps,

yates.
disavowed
05-24-2002, 03:48 PM
as for your generic sd2 unwrapper, it looks like it's already been done:

http://www30.brinkster.com/cirkutz/sd/

i haven't tried the program yet, but found this with google. hope it helps.
blackos
05-24-2002, 05:25 PM
Hi all... this answer is for you,

First, a big thank to you [yAtEs], your funny answer give me a little piece of hope on how to reverse this tasty protection scheme. I'm just going to "help myself" to go further into this nice stuff. But if I get stuck another time, maybe can I hope you'll help me a little bit more ?
;)

Well.... thank you "disavowed" for your URL, but my goal is not really to unprotect the software with another one's tool...
I prefer trying to understand what is behind SD2 and trying to reverse it by myself. It's so MUCH funny.

By the way, you URL is for SD2 v2.51.xx and I'm actually dealing with a SD2 v2.60.xx, so.... sorry, but it will not work. Yeah, 'C*Dilla - Safe*disc' guys are working a lot and do pretty good things for us !!!.....

Nethertheless, thanks a lot !

By the way... how could you explain there is so few informations about this stuff all around the web ???

:)
seeya.

blak.
[yAtEs]
05-24-2002, 06:21 PM
>First, a big thank to you [yAtEs], your funny answer give me a >little piece of hope on how to reverse this tasty protection >scheme.

(; inspiration was the idea, i'll glady help you more if need be if you have more questions, i was just giving you basic information. once you got your focus set we can discuss perticular bits of code.
q:
ThrawN
05-25-2002, 02:52 AM
Could you give me a few game titles using this *new* safedisk2?
I'll go buy one and check out ;)

ThrawN
blackos
05-25-2002, 10:51 AM
Hi all !

for [yAtEs] :
Well .... I'm a bit further into SD2 and I've found the routine which unciphers program's bytes in a 4096 bytes buffer. It's pretty complicated (obfuscating stuff is not the problem) and long, so I'll try to understand something... I feel like I'm loosing my time with these routines, but in fact I know that's important to understand. Maybe I need a bigger brain ?
:)

for ThrawN :
My target is actually 'Dra*gon' : a Chinese title available to download on Aaron's forum (exe-tools, see link below...) (few executables + a .iso image to burn (around 20 Mbytes)). He said he can provide a personal access to his FTP if someone can crack that.
Of course, this title is not complete, but enough to try to reverse it...
I'm not a Chinese guy and this title doesn't interrest me by itself (who can read that stuff ?), but the protection scheme is pretty cool !!!!
I was also (and I still being) *not* interrested by special access to Aaron's FTP, but I thought that if he asked others to 'crack' this title for him, it was because nothing can actually do it automatically, so it appears to be interresting to me, you know.
Well, in fact it's a new version of SD2 and I find it hard to reverse.
Maybe could you have great fun with it ? For me, it's actually a kind of headache.... woww....

Have fun !
bye !...

blak.
[yAtEs]
05-25-2002, 03:20 PM
>I feel like I'm loosing my time with these routines, but in fact I >know that's important to understand. Maybe I need a bigger >brain ?

ok heres some help then :)

************************************
morph_proc proc

var_10 = dword ptr -10h
new_byte = byte ptr -0Ch
size_of_block2 = dword ptr -8
size_of_block1 = dword ptr -4
data_block1 = byte ptr 8
data_block2 = byte ptr 10h

mov ecx, [ebp+size_of_block1]
push ecx
lea ecx, [ebp+data_block1]
call read_byte

mov [ebp+new_byte], al
mov edx, [ebp+size_of_block2]
push edx
lea ecx, [ebp+data_block2]
call read_byte

mov cl, [ebp+new_byte]
xor cl, al ;*
mov [ebp+new_byte],cl

mov dl, [ebp+new_byte]
push edx ; new_byte
mov eax, [ebp+size_of_block2]
push eax ; counter
lea ecx, [ebp+data_block2]
call write_byte
************************************

so you can see a 4kb data being written into,
things to do are,.. find

what the 4kb data block is
where does it come from
what does it end up as
what is its final outcome used for? (BPM IT, do it now! (; heh

thrawn:

SuperPower
Myth 3
StrongHold update
SOAF
Kohan

yates.
blackos
05-25-2002, 03:37 PM
Thanks Yates ... I'm looking into this (IDA has already helped me to understand a little bit....).

:)))

By the way, I think 'KOHAN' is protected by SD2 v2.51.xx instead of 2.60.xx (I've checked the original CD (provided with my new computer)).

thanx.

blak.
[yAtEs]
05-25-2002, 03:45 PM
>By the way, I think 'KOHAN' is protected by SD2 v2.51.xx instead >of 2.60.xx

ah, kohan 1.34 patch then
blackos
05-26-2002, 12:57 AM
Hi Yates !

A tiny little victory for me this time .... better than nothing....
I've finally succeded in getting a good I.T. thanks to SD2 itself (good guy !)... but it still not working at all, because of the replacements in sourcecode's CALLs...
I've got tears in my eyes because I've traced and traced this code during hours... I put so much BPM between original ciphered data leading to temporary buffers .... it was horrible... but so good in fact.
:)

Well, I still can't understand when and how the sourcecode is modified so that different CALLs use only one I.T. vector.... was it before ciphering or is it done 'on the fly' by SD2 ??? Please, help !, I'm dying !...

you can see below my litlle victory to get a good (but not working) I.T.

017F:1009545C 8B45EC MOV EAX,[EBP-14]
017F:1009545F 8D8C10FF020000 LEA ECX,[EDX+EAX+000002FF]
017F:10095466 8B55E8 MOV EDX,[EBP-18]
017F:10095469 8B4518 MOV EAX,[EBP+18]
017F:1009546C 890C90 MOV [EDX*4+EAX],ECX <<< HERE ... I.T. vectors are created in temp buffer
017F:1009546F 7809 JS 1009547A
017F:10095471 90 NOP
017F:10095472 87FF XCHG EDI,EDI
017F:10095474 7F09 JG 1009547F
017F:10095476 87F6 XCHG ESI,ESI
017F:10095478 7E05 JLE 1009547F
017F:1009547A 7400 JZ 1009547C
017F:1009547C 78F3 JS 10095471
017F:1009547E 038B4DE88B55 ADD ECX,[EBX+558BE84D]
017F:10095484 248D AND AL,8D
017F:10095486 048A ADD AL,8A
017F:10095488 8B4DE8 MOV ECX,[EBP-18]
017F:1009548B 69C94B030000 IMUL ECX,ECX,0000034B
017F:10095491 8B55EC MOV EDX,[EBP-14]
017F:10095494 89840A32030000 MOV [ECX+EDX+00000332],EAX
017F:1009549B E91FFFFFFF JMP 100953BF
017F:100954A0 8B4D14 MOV ECX,[EBP+14]
017F:100954A3 C1E102 SHL ECX,02
017F:100954A6 33C0 XOR EAX,EAX
017F:100954A8 8B7DD4 MOV EDI,[EBP-2C]
017F:100954AB 8BD1 MOV EDX,ECX
017F:100954AD C1E902 SHR ECX,02
017F:100954B0 F3AB REPZ STOSD
017F:100954B2 8BCA MOV ECX,EDX
017F:100954B4 83E103 AND ECX,03
017F:100954B7 F3AA REPZ STOSB
017F:100954B9 8B45D4 MOV EAX,[EBP-2C]
017F:100954BC 50 PUSH EAX
017F:100954BD 6A00 PUSH 00
017F:100954BF 8B0D84850B10 MOV ECX,[100B8584]
017F:100954C5 51 PUSH ECX
017F:100954C6 FF1590700910 CALL [KERNEL32!HeapFree]
017F:100954CC C745F400000000 MOV DWORD PTR [EBP-0C],00000000
017F:100954D3 EB09 JMP 100954DE
017F:100954D5 8B55F4 MOV EDX,[EBP-0C]
017F:100954D8 83C201 ADD EDX,01
017F:100954DB 8955F4 MOV [EBP-0C],EDX
017F:100954DE 8B45F4 MOV EAX,[EBP-0C]
017F:100954E1 3B4514 CMP EAX,[EBP+14]
017F:100954E4 735A JAE 10095540
017F:100954E6 8B4DF4 MOV ECX,[EBP-0C]
017F:100954E9 C1E903 SHR ECX,03
017F:100954EC 8B55F8 MOV EDX,[EBP-08]
017F:100954EF A110460C10 MOV EAX,[100C4610]
017F:100954F4 8B1490 MOV EDX,[EDX*4+EAX]
017F:100954F7 33C0 XOR EAX,EAX
017F:100954F9 8A040A MOV AL,[ECX+EDX]
017F:100954FC 8B4DF4 MOV ECX,[EBP-0C]
017F:100954FF 83E107 AND ECX,07
017F:10095502 BA01000000 MOV EDX,00000001
017F:10095507 D3E2 SHL EDX,CL
017F:10095509 23C2 AND EAX,EDX
017F:1009550B 85C0 TEST EAX,EAX
017F:1009550D 752F JNZ 1009553E << NOP this call, you get original I.T.
017F:1009550F 8B45F8 MOV EAX,[EBP-08]
017F:10095512 69C08D000000 IMUL EAX,EAX,0000008D
017F:10095518 8B0D14460C10 MOV ECX,[100C4614]
017F:1009551E 8B54014C MOV EDX,[EAX+ECX+4C]
017F:10095522 8B45F4 MOV EAX,[EBP-0C]
017F:10095525 8B0C82 MOV ECX,[EAX*4+EDX]
017F:10095528 51 PUSH ECX
017F:10095529 8B55F8 MOV EDX,[EBP-08]
017F:1009552C 52 PUSH EDX
017F:1009552D E8FE000000 CALL 10095630
017F:10095532 83C408 ADD ESP,08
017F:10095535 8B4DF4 MOV ECX,[EBP-0C]
017F:10095538 8B5518 MOV EDX,[EBP+18]
017F:1009553B 89048A MOV [ECX*4+EDX],EAX <<< here, SD2 overwrite datas in temp buffer by original ones.
==> 1009553E EB95 JMP 100954D5
017F:10095540 EB07 JMP 10095549

thanx.
:)))

blak.
[yAtEs]
05-27-2002, 10:54 AM
>A tiny little victory for me this time .... better than nothing....
>I've finally succeded in getting a good I.T. thanks to SD2 itself (good guy !)...

super (:

>I put so much BPM between original ciphered data
BPMTASTIC! (;

>Well, I still can't understand when and how the sourcecode is >modified so that different CALLs use only one I.T. vector.... was >it before ciphering or is it done 'on the fly' by SD2 ??? Please, >help !, I'm dying !...

hmm ahh (:, have you looked at that proc below any more?
look at some of the dword data refs, maybe theres a kinda
funky lookup table q:

>you can see below my litlle victory to get a good (but not >working) I.T.

yup yup, thats it!

yates.
ThrawN
05-27-2002, 12:30 PM
Is anything interesting changed from 2.5 to 2.6?
iv only got 2.5 as the newest and thats only on loan ;)

I work on 2.5 in olly in 2k mostly and thats very exciting :) but attualy suprisingly satsifying and rather easy to reverse.
Unciphering isnt the hardbit. For me IT fixing is a pain :)
TEA isnt very complicated or long for that matter.

ThrawN
[yAtEs]
05-27-2002, 12:43 PM
>Is anything interesting changed from 2.5 to 2.6?
>iv only got 2.5 as the newest and thats only on loan ;)

yup, in 2.6 theres a range(3 or 4) new types of code protecting
using at the first glance a complex rva hashing system.
you wouldnt notice it until you fixed all the I.T thou (:

yates.
blackos
05-28-2002, 11:57 AM
Hi [yATEs] !....

This time, I'm so close to give up...
:(

I've read all your advices and try to understand ... but in vain...
No results anymore, I'm pretty scared...
I know that SD2 manipulates target's compilated code before creating its new I.T., so, it replaces some calls by its own vectors. But I can't find WHERE .... I put of course many BPM RW all around ... of course on interresting offsets and it's lead me nowhere. There's so much compilcated manipulations.
I suppose (I said *SUPPOSE*, I'm not sure) that SD2 creates a third buffer containing datas that will be XORed with "sensible" specific data in the 4096 temporary buffer, so that for specific offsets, 'on the fly' modifying will be done during unciphering time (I've noticed that 'sensible' offsets are accessed only *1 time* in the 4096 bytes temp. buffer, so replacements are probably made in '1 time' instead of '1 time + later modifications'.
BUT .... there's such a huge amount of data to try to understand that I think I'll need a "E.T. maxi-ultra-special brain" and amphetamines to understand.
You surely know that "E.T. maxi-ultra-special brain" are pretty hard to find nowadays and very expensive. So, will you be kind enough to give me help one more time ? (I don't have enough money to buy this new terrible brain....)
:)

Yeah, hope to seeya soon !...

thanx
blak.
[yAtEs]
05-29-2002, 10:20 PM
dont panic, u dont need a maxi-ultra-special brain, just have a rethink.

I know that SD2 manipulates target's compilated code before creating its new I.T., so, it replaces some calls by its own vectors. But I can't find WHERE

hmm well that doesnt sound right, searching for where it changes the calls? thats done when the sdk is applied, all you need do is
decrypt the whole I.T and change the calls to point to the correct functions, and as you know the calling address effects what api is called, so with a few ripped functions, a decrypted i.t and a list of va's you can fix it all up. (:

yates.
blackos
05-30-2002, 12:19 AM
Hello yATEs !....
yep, yep ... no need of an overboosted E.T. brain ? What a pity, it could be pretty fun to walk down the streets with a huge green head on our shoulders
:p

So ... I searched for a non-existing routine... bad move....
But, in fact, with the good IT and the offset of the caller, one could probably rebuild a working stuff.
*BUT*
To do so, one absolutely need to hook the SD2 routine which calculates the real API call. That is not a big deal, but the program MUST RUN entirely in order to 'rebuild' our self-made hooked routines by using APIs.

Am I right ?
What about this : my application can't execute properly because of missing files. These files are important to run. The only thing my target do is a messagebox with 'xxxxx file cannot be found, so I'm gonna quit'. This isn't enough to fix every call because these calls will never be executed.
Am I absolutely stuck ? :(

But Even If I succeed in forcing the program to run (in fact, it will not work without any sound or graphic files...), I suppose you'll agree with me if I say there's a bunch of different ways to call a function.

For example,

CALL [offset]

or

MOV EDX, dword ptr [offset]
CALL EDX

will not result in the same compiled code, of course. Then, to fix back these calls with the good value of 'offset' could be a bit tricky ? isn't it ?

Well, I'm gonna code this little stuff and I'll see. But the whole thing isn't done yet, because it stays one funny part to reverse (redirected functions to last 2 sections).... let's get a closer look ...

: ))

By the way, thanks once again [yAtEs], you'll the only guy to have taken few minutes to help me on this funny subject.

seeya.

blaK.
[yAtEs]
05-30-2002, 01:42 AM
>So ... I searched for a non-existing routine... bad move....
hah, /me chuckles (:

>But, in fact, with the good IT and the offset of the caller, one >could probably rebuild a working stuff.
yup yup

>To do so, one absolutely need to hook the SD2 routine which >calculates the real API call.
>Am I right ?

yup if u wanna do it the hard way i guess so, no need to make
things so complex, perhapes its a small routine you can rip from ida, perhapes you could rewrite it ur self if you really knew how it all worked (; heh im such a tease eh?

>What about this : my application can't execute properly because >of missing files. These files are important to run. The only thing >my target do is a messagebox with 'xxxxx file cannot be found, >so I'm gonna quit'. This isn't enough to fix every call because >these calls will never be executed.

if you can run up to the entrypoint, then just R EIP <type of call offset> and debug from there

>Am I absolutely stuck ? :(

nope

>I suppose you'll agree with me if I say there's a bunch of >different ways to call a function.

indeed, this is just one slice of the big tasty safedisc pie, heh.
dont eat it all at once!

>will not result in the same compiled code, of course. Then, to fix >back these calls with the good value of 'offset' could be a bit >tricky ? isn't it ?

nah, concentrate on one thing at a time and it'll come easy [:

>By the way, thanks once again [yAtEs], you'll the only guy to >have taken few minutes to help me on this funny subject.

ur welcome.

yates.
blackos
05-31-2002, 10:20 PM
Eh eh ... Yates, stay tuned, I work on it, but I actually have less time to try to defeat it ... some news in a few days.

:))

blak.


winice.dat
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > winice.dat
PDA

View Full Version : winice.dat

mambox
05-17-2002, 03:42 PM
i get to launch shame on me but i'm interested whats a 'reference' winice.dat,common good cr*ckers use?

can anyone post his winice.dat here?
hope not to watch total loosy but that can bring me some usefull things.

thanks!

:eek:
JMI
05-17-2002, 04:47 PM
Even a little searching with google would reveal many sources for basic formats for winice.dat and discussions in almost any language you could care to use. Here is a source from the cRACKER's nOTEs:

hxxp://archive.yates2k.net/Library/Tornado's%20crack%20notes/p02_2.html

Seem to recall someone posted one here not too long ago. Did you by any chance try the "search" botton before posting? There is another good basic article titled "Mammon_'s Tales to his Grandson, Mankind comes into the Ice Age" "Configuring the Environment " that you should look at. It's contained in the articles on the Fravia Board.

Regards.
mambox
05-17-2002, 05:12 PM
yep i know and do search but my interest was to check how's winice.dat from famous rev engineer here.

if it seem realy dumb delete the topic

xya


PEViewer V1.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PEViewer V1.0
PDA

View Full Version : PEViewer V1.0

KomsBomb
05-18-2002, 04:17 AM
http://cn.geocities.com/komsbomb/

PE Viewer V1.0:
PE Viewer is a tool that you can use to view a PE executable file.Beside this main function,it also provides you some utility for your convenience.

;)
Ajnabi
05-18-2002, 10:21 AM
Hiya KomsBomb

i suppose u have also posted link in exetoolZ forums.

And i checked out ur prog. Its of somewhat usefull.
Nice work


Newbies4Newbies Crackme Targets
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Newbies4Newbies Crackme Targets
PDA

View Full Version : Newbies4Newbies Crackme Targets

Nightflyer
05-15-2002, 07:26 PM
Hi all,

ok here is the first Crackme Level 1

level: very easy

Crackme: abexcm5.exe

Pls post your tuts and comments, question in this thread here

for that crackme.

Have a lot of fun

Nightflyer
Nightflyer
05-16-2002, 07:28 PM
Hi all,

here is the second crackme to solve.

Its about getting rid of Nagscreens

Have a lot of fun

Nightflyer
Nightflyer
05-18-2002, 05:59 AM
Hi all,

here comes number 3!!!!!!!!!

Special Greets to Eustace

Nice tut for crackme 2

Later today is will post my tuts for crackme 2 and 3,
had no time to write them earlier, beause working on anther project too.

Have fun !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!1

NIghtflyer
Kayaker
05-18-2002, 07:41 AM
Nice tutorial series Nightflyer. I thought it would be better to combine the threads and have all the crackme targets in one thread, and all the solutions in another, while a third could be for discussion.

If you have several of these crackmes the forum will get messy real quick and a month or two down the road people will have to search all over the forum for them again. It will be more useful if we can sort of 'package' the information for posterity.

Keep up the good work.

Kayaker
Nightflyer
05-18-2002, 05:31 PM
hi,

yeah i will do so

Nightflyer
Nightflyer
05-19-2002, 12:53 AM
Hi,

here is the 4 th crackme, this one is a little bit more difficult to solve.

I hope u will like it

GRETTINGZ TO ALL

Nightflyer


Import table size.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Import table size.
PDA

View Full Version : Import table size.

remi
05-18-2002, 11:27 AM
Hi all:

I'm making a program to dump the import table of the PE files, but i have found a problem. At offset PE + 80 there is the addres of the import table and in the next DWORD i thought there was the size of the import table. This is only true for the programs compiled with borland products, in the microsoft ones there only appeares the size of the array of Image import decriptors. I've searched in internet without luck (someone will be thinking in sending me to the searching lores page :D). Hope there's someone that can give me an idea of how to get this size (the idata section isn't always called like this :( ).

Sorry about my low english level, and thanks :).
crUsAdEr
05-18-2002, 12:00 PM
Hi Remi,

Why dont you just parse the Import_Directory Table itself, until the end of it... it should be ended with 10h 00 bytes if i am not wrong...

I guess it is the most foolproof way, though slightly more works to do ...

regards,
crUsAdEr
ZaiRoN
05-18-2002, 02:06 PM
it should be ended with 10h 00 bytes
14h 00 bytes :p

bye
ZaiRoN
remi
05-18-2002, 03:41 PM
Hi crUsAdEr:

I will have to do something like this at the end. The problem is that i want't to show the import tables raw hex dump but trying to difference between the diferent sections in it. If there isn't any diferent way to do it, i will take the offset pointed by the last pimage_thunk_data field of the import directory table (wich points to the last array of imported functions), and once found where does this array finish, sub this offset to the offset where the import table starts to get it's size.

I'll have to go back in the work i've already done anyway, also calculating the size of the import directory, cause i have used a more direct aproach than searching for zeros at the dll's name field. So i will keep trying if that is what Lenin said, I would't like to become a Stalin.... :D

Thanks !


Seeking Mamaich's Goodies?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Seeking Mamaich's Goodies?
PDA

View Full Version : Seeking Mamaich's Goodies?

gadget
05-19-2002, 04:17 PM
Hey,

I know that Mamaich has had a presence on cr*cking.net in Russia, but without knowledge of russian - is there anybody out there who knows where his site is now and more importantly where to find his ice and xp pdb symbol processing proggies?

The links on ElicZ's site are old but I could really do with borwsing these and MORE!

FROM ELICZ SITE...
"SSI_XP_2462 - subsymbolic information from XP build system modules
SSI_2K_SP2 - subsymbolic information from XP build system modules
PDB2SSI - subsymbolic information extractor
BlindStudio - mamaich's debugger (for NT) "

Can anybody help with infos and more importantly filez if you've got a back up of em.

Thanks G^
gadget@hotmail.com
esther
05-22-2002, 03:37 PM
Hi,
Don't think you can find his site anymore try your luck mail
him
btw you shlould post this in off topic ;)
regards


IT rebuilding
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IT rebuilding
PDA

View Full Version : IT rebuilding

kalisto
05-19-2002, 04:18 PM
If anybody has small asprotected target then PM to me (if he/she solved all imports).
Thanks
nofurs
05-19-2002, 04:35 PM
Hi,
You can download Revirgin.The notepad is packed with aspr and a unpacked one which you can get it in hXXp://tsehp.cjb.net ;)
kalisto
05-20-2002, 06:10 PM
Hi cluesurf, yes you are right I have revirgin and I know for notepad asprotected but it's version 1.1 and I don't know signiture bytes for that version. I just want to unpack asprotected target from begining. Do you know signiture bytes for that version?
tsehp
05-21-2002, 06:11 AM
tamosoft uses aspr to protect all their app.

h**p://www.tamosoft.com
dion
05-21-2002, 12:15 PM
hehe.. anyone has try at

h**p://***.binary-soft.com

there's 3 one you need.
nofurs
05-21-2002, 03:27 PM
Originally posted by kalisto
Hi cluesurf, yes you are right I have revirgin and I know for notepad asprotected but it's version 1.1 and I don't know signiture bytes for that version. I just want to unpack asprotected target from begining. Do you know signiture bytes for that version?

Hi,
I suggest you search the board first there are threads which discussed about aspr.Secondly read tutes written from r!sc
hxxp://xxx.dreamimpression.co.uk/r!sc/stuff.htm
If you are new in unpacking try some "easier" ones like upx...

well below a tute which descrbies the basic idea of aspr
h**p://203.33.134.13/other/up43.txt

Post more your findings and where you are stuck ;)

good luck

giving too much to a newbie or a l33to turns them a lamer :p
kalisto
05-22-2002, 06:08 PM
Thanks all, when I try to unack asprotect I will be more specific;)


SoftICE vs. Detonator 29.40
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE vs. Detonator 29.40
PDA

View Full Version : SoftICE vs. Detonator 29.40

B-Boy
05-20-2002, 03:35 AM
Just curious about this one..

I had my Win98SE system set up with NVidia's Detonator 21.85 drivers, and when starting up SoftICE, everything went fine.
Now I saw the new Detonator Drivers and thought "Hey, why not update my system?", and installed the 29.40 drivers. Of course this was a bad idea because of the "Never touch a running system" rule. Yet, at first everything seemed fine again. *But* when I tried to start SoftICE with the new drivers installed, i got a nice black screen showing a "Error in IOS..blabla.. Real mode memory allocation" message (sorry for my bad translation).
Well, I then removed the 29.40 and reinstalled the 21.85 Detonators, and, oh holy sh*t, it works again.

Has anyone experienced the same problem or has a solution so SoftICE and the new Detonators will work together again?

Ah, I forgot:
I tried fiddling around here and there a bit to find the error. And I actually managed to get SoftICE working with the 29.40 drivers, by removing/renaming "c:\windows\system\viagart.vxd". *But* (oh no, not again) this resulted in a rather high loss of performance, so thats why I think this can't be *the* solution.
Kilby
05-24-2002, 10:17 AM
To say that there have been some problems with drivers for the VIA chipset is a little bit of an understatement.

I spent a very unhappy time with one of the first VIA chipset motherboards, that supported 133 SDRAM.

These problems revolved around the AGP drivers, and it is always worth checking the VIA site for new drivers.

Kilby..
B-Boy
05-26-2002, 10:35 PM
I have tried it with the VIA 4in1 4.28 and 4.39(beta) drivers. And concerning the SoftICE vs. Detonator issue, they seem to behave the same: 21.85 = ok, later versions = crash :(
robber804
06-29-2002, 12:09 AM
The problem could be from Nview, I think nview was introduced sometime in the 27.x series, but I could be mistaken. Did you try to disable it in the 29.x drivers?
SilSaLaMaTa
06-29-2002, 08:10 AM
I'm using TNT2 and I tried to upgrade my drivers , I have the same problem (on XP) .


SoftIce BPR crahes comp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce BPR crahes comp
PDA

View Full Version : SoftIce BPR crahes comp

Laeros
05-20-2002, 10:09 AM
Whenever i set a BPR in softice my comp crashes.
The softice window stays on the screen, the cursor stops flashing and the scroll bars on the right side disappear.
Caps lock still turns on\off and ctrl+alt+del still reboots but other then that nothing works.

My tracebuffer is set at the default 8kb.

The BPR command itself doesen't crash but as soon as i press F8,F5 or even type t + enter it crashs with the exception that typing t + enter scrolls down one to a new black empty line.

With " BPR t " it allways crashs with "BPR r " it ussaly crashs or just doesen't work anyway and never breaks.

I tried this several times while breaking in several different programs and it still allways crashs.
Using win95b 2.1

Anyone have any idea what's the problem or how to fix it?

I tried searching google.com for 'softice bpr freeze'
also with replacing 'softice' with 'sice' and replacing 'freeze' with 'stuck' finding nothing related to my problem.
the only thing i saw was someone mentioning having the problem with "ASPROTECT" but i allways have the problem even without running any programs.

Other then this i dont seem to have any other problems with softice.
Hwoarang
05-20-2002, 11:09 AM
Softice's BPR is quite buggy (if u read some good docs u will also find out why)
your problem might be win95b 2.1..I used Win95 osr2 and BPR worked quite well, but never your version
Laeros
05-20-2002, 12:52 PM
The problem woulden't be between ver 2.0 and 2.1.
to get 2.1 you just download a simple patch from ms that only updates only a few things and adds some usb support.

I don't know what docs your referring to about BPR being buggy in
"SoftICE Internals" it doesen't mention it.
Thought still buggy still means it works sometimes.
It never works for me:(
Hwoarang
05-20-2002, 02:38 PM
well if the update to 2.1 is just that probably out of question=/
what cpu do u have? and how much amount of ram?
Laeros
05-20-2002, 04:32 PM
Yes, i fixed the problem:)
It was the memory.
I dont know why but when i setup softice before and set "PHYSMB" to the correct value of my memory it didnt work for some reason so i set it to a lower value.
Now i tried setting "PHYSMB" to the correct value of my memory and softice worked and BPR now works.
hmm dont know why it doesen't mention somewhere that if PHYSMB isen't configured correctly bpr wont work..
Hwoarang
05-20-2002, 08:22 PM
methinks this happens exclusively in windows 95, with 98 and ME works ok with "wrong" amount of ram in winice.dat


Hmmm, possible new toy ProCrypt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hmmm, possible new toy ProCrypt
PDA

View Full Version : Hmmm, possible new toy ProCrypt

Kilby
05-20-2002, 10:20 AM
In amongst the expanding amount of spam I receive eveyday (hmmm I do loce contacting their IPS and complaining about unsolicited mail) I received this :

____________________________________

As a software developer, are you tired of people stealing your work?

Would you like to maintain control over who uses your products without greatly inconveniencing your customers?

Would you like to license your products the way Microsoft does?

Copy protection and 'dongles' are seldom used anymore because most software buyers won't tolerate them. Shareware is a nice concept, but in practice, it clearly doesn't work very well.

A better method is to license software products using encryption techniques and the Internet in a flexible, efficient manner.

We have developed a low-cost programmer's toolkit called ProCrypt that will allow you to quickly and easily setup your web site and make your products 'license-able'.

We want to give the 'little' guy the same ability to do this that the 'big' guys have.
_____________________________________________

Anyway I have never heard of ProCrypt before so the url is:

hppt://w*w.prosentia.com/procrypt.asp

So lets help them out , as anybody who offers software protection just like microsofts needs all the help that they can get.

Kilby...
Kilby
05-20-2002, 10:24 AM
Ohhhh it must be good no, demo version !

Kilby...
Actlon
05-20-2002, 10:26 PM
Hmmm...wonder if it can be got around by writing a replacement ActiveX control...it's gotta leave a pretty large swath of the program unencrypted for it to be able to init the ActiveX controls etc...leaving the question, is it even encrypted ?

Hmmm, time to go target hunting :)...and then umm...revise for exams (god I hate geology!)


Hard Keygennin Program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hard Keygennin Program
PDA

View Full Version : Hard Keygennin Program

r00t
05-20-2002, 09:02 PM
Hi all, last day i've downloaded the program
STATGraphics 5.1.
(f*p.manu.com/outgoing/SGDemoV51SM.exe), and i try to keygen it.
I was a lot of hours but this proggie seems to run different threads to check the serial. Also i think it uses some sort of hash.

Anyone can help the understand the algo that makes the keys?.

Greets and thanks.


Help on finding a "Creating a No-CD" tutorial?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help on finding a "Creating a No-CD" tutorial?
PDA

View Full Version : Help on finding a "Creating a No-CD" tutorial?

Adri_Magnon
05-21-2002, 03:41 AM
Hi,

Can someone please point me to the tutorial on creating a no-cd patch or something similar? I have an annoying proggie that, even with the serials and a place on my hard drive, demands the CD each and everytime I want to use the program. I have Wdasm and HexEdit. I can get SoftIce and I dual boot with Linux - So i have compilers and such on that side. I also have MSVStudio on the Win side. I am new to programming but have always wanted to learn. Currently I'm doing those "Teach Yourself C++ and Visual C++ in 21 days" deals. I know Fravia has some tutorials on basic reversing. I might have missed one on Cds, and so I'll ook again a little later.
I did a light search on Astalavista and Google for a patch but returned empty handed. I figure since I don't need the program right away, and the no-cd thing is just a REAL BIG annoyance I can make that my first attempt.

On a side note, I remember about three years ago or so I downloaded SoftIce and tried a tutorial on cracking WinAmp 1.8 I believe. I didn't do anything other than have to refomat my hard drive -- which was a whopping 1 GB on my 100 MHz PPro!!! : )

Thanks for any help,

Adri_Magnon
crUsAdEr
05-21-2002, 04:16 AM
Hi Adri_Magnon,

It depends on what kind of Cd-check is employed.. if the exe is not packed/protected then you can simply find the CD checks and patch it (it still happens nowadays)... if the CD actually read some data from your CD then it is going to be harder... if the CD is protected with safedisc then you are going to have some fun...

May I suggest these 2 sites for some readings :>
krobar.cjb.net
www.yates2k.net
krobar has a nice collection of EVERYTHING, and yates site has lots of CD-check cracking tutorials as well as information...

regards,
Adri_Magnon
05-21-2002, 05:03 AM
Hi,

Thanks for the reply!

I don't think it's a secure-cd type of deal. The program says "Please insert Cd in drive. Otherwise program will be run as Demo and files can not be saved."
I was looking in the registry for the program to see if some reference is made to checking for the CD. Since the program is so small I could happily pull it from the Cd as an ISO and do a virtual Cd but that seems like kind of a hassle too. I was hoping to just add a line to the registry that told the proggie the "CD" was in such and such place. I think i saw a smiliar deal used on Star Craft once. Hmmmm... maybe I should see how that crack/patch was written.
I was using Wdasm and then I got an error about not enough memory available. The proggie (exe only part) is 4.8 MB on my hardrive.

I appreciate your help and I will keep trying.

Thanks,

Adri_Magnon
Aimless
05-21-2002, 06:46 AM
Are you sure?

"Please insert CD...yiddayadda" are generally found only for games.

If it is indeed a software/application protections, could you let us know the name of the software?

If it is a game, you need not feel akward to ask for the same. After all, cracking is cracking. And games are sometimes "overprotected" (where have I heard that now:)??)

You are most likely facing one of the two:

1. A user made CD copy protection
2. A commercial CD protection

You could alternatively go to your "software" site and find out if there is anything mentioned about the CD check.

...Have Phun
Adri_Magnon
05-21-2002, 08:06 AM
Hi,

I apologize for not mentioning the proggie earlier. I read the FAQ but was unsure if it was in bad taste to say what it was outright.

The proggie is Final Draft 5. I got the ISO off a newsgroup. It sounded interesting. It allows the user to write a script or what not in a page already formatted for the type (movie. etc.) I burnt the ISO and it installed fine. The size of the image was only 63MB.
So I used the serial and it was all good. About a month later, today, I decided just to fool around with it. It said "Please insert CD or Program wille be run in Demo mode and files will not be saved." So I put the CD in and started it again. I re-entered the serial and it worked but then it asked for the CD again after I closed it, took out the Cd, and reopened the it. I figured this is annoying and looked for a crack or patch. All I found was one for an earlier 4.0 version. I decided I'd give it a try.
The folder is 9MB on my hd. In Wdasm, which doesn't open all the exe 'cause I don't have enough free memory (which bugs me cause I have 256MB) I searched for "GetDriveTypeA" and found several references.
However, when I looked up "cmp eax, 00000005" I found tons of references.
I was hoping I could crack it with the tutorials I got off the net. The one I am using primarily is Zoltan on cracking Dune 2000 for no-cd.
I printed out several others though.
On a hnch I opened a DLL in Wdasm and found the same GetA command above in it. There are 6 DLLs in the folder on the HD.
So far, with what little experience I have (some minor stuff on Unreal Tournament and a "21 days to C++" book), I am guessing that all the references in the main exe are to the Cd and what might be best is just to change/patch/edit all the calls to the harddrive and do the same to the dlls.
By the way, if I am way oof, please say so. I'd appreciate the help. : )

Thanks,

Adri_Magnon

P.S. The reason I think it's not protected with a CD-Copy sceme like SecureLock or whatever is because I got an ISO copy. I might be wrong though.
Aimless
05-21-2002, 08:52 AM
Try doing these:

1. You have several references to GetDriveTypeA.
2. Breakpoint on all of these using softice (if you have it) or try it in Ollydbg, which you can download it for free. Just search for "Ollydbg" without the quotes in Google.
3. I assume that only a couple of if you are really lucky, only a single GetDriveTypeA would be activated. Notice the locations in your program where this is called from. Write them down on a piece of paper.
4. Hex edit your file and put a bunch of nops (90 - in binary formats) where the GetDriveTypeA is called. Eg:

text.401000: E8 45 56 43 76 CALL GETDRIVETYPEA
here, change the bytes E8,45,56,43,76 to 90,90,90,90,90 and run the proggie.

5. If you crash or any error pops up, you are mos likely looking at some kind of a CRC/checksum inbuilt into the program. In that case, try modifying the same in memory rather than in the physical file
6. If it still does not run, then you are most likely facing a commercial protection. You have made an ISO image. Most likely, the original CD was replicated perfectly, which was re-burnt by you again perfectly. Alongwith the commercial protection. Therefore, it allows you to run the image and without the CD it does not.

Try this and let us see what happens...

...Have Phun
Adri_Magnon
05-21-2002, 09:16 AM
Hi,

I downloaded Olldbg (I thought it was Oily Dog at first) and when I open the exe it says "Entry Point Alert: Module MSVCRT 20 has enrty point outside the code." It then suggests the file maybe self-extracting or self-modifying and to keep that in mind when setting breakpoints. Does that change the advice you offered earlier?

I appreciate this.

Adri_Magnon
Aimless
05-21-2002, 10:01 AM
Just carry on straight ahead.

...Have Phun
Aimless
05-21-2002, 10:08 AM
Yup,

Final Draft is COPY PROTECTED (based on your hard-disk details). However, after serialization, it SHOULD NOT, repeat N-O-T ask you for the CD. If it still is then, as documented on their website, it is a BUG.

You can download the small COPY PROTECTION UPDATE from their own web site. In their own words:

"This file solves issues regarding authorization on Windows 2000 and Windows XP. If you are experiencing 16-bit .dll messages when launching Final Draft or are receiving a request for the CD when double clicking on a Final Draft file after your hard drive has already been authorized, please download this application to your desktop and install it by double clicking on the file. This will replace the necessary files in the Final Draft directory (Please note: This file will not install on Win 95, 98 or ME)."

You can find the update on:

http://www.finaldraft.com/downloads/fd5win.html

Once you reach this site, let it load. Once complete, go to the bottom of the page and click the link:

"Final Draft Copy Protection Update"

OR

You can directly update from:

http://www.finaldraft.com/assets/files/cp_update.exe

...Have Phun
Adri_Magnon
05-21-2002, 11:31 AM
Hi,

I'm running Windows 98 so I can't use the update - I tried. So, what do you think I should do? If it can be cracked like you mentioned earlier I'm all for it and will keep trying. Or, if I need to change the type of attempts I'm doing to a CD-Copy Protection (like SecureRom, etc.) then I'll find different tutes.

Thanks so much for the help,

Adri_Magnon


Will SoftIce be okay on my dual-boot computer?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Will SoftIce be okay on my dual-boot computer?
PDA

View Full Version : Will SoftIce be okay on my dual-boot computer?

Adri_Magnon
05-21-2002, 06:40 AM
Hi,

I wanna install SoftIce but am concerned about it. I dual boot Win98 and Linux with the LILO. I read once that SoftIce sits behind the OS and that in a way the OS runs is it.
So my question is, will I experience any problems running it on my computer? I would like it only to affect Win98 and not interfere with Linux. I apologize for the "newbiness" of this question, but I am, well, a newbie. : )

Thanks,

Adrian
Ajnabi
05-22-2002, 12:57 AM
Hiya

For what i think that it shouldnt give u any trouble as long as ur using a Program for Dual Boot like System Commander.

And if still you get problems with it, try referring to this thread
http://www.woodmann.net/forum/showthread.php?s=&threadid=3154

Hope this helps


Lamecrypt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Lamecrypt
PDA

View Full Version : Lamecrypt

ThrawN
05-21-2002, 11:48 AM
Just some small tutorial on writing a decryptor for newbies...
Based on a old protector called lamecrypt
Very basic.. hope someone finds it usefull ;)

Sorry for pasting here, if you dont aprove then simply remove :)

ThrawN
Sphinx
05-21-2002, 01:44 PM
thx ThrawN

i am going to try it.
This is a usefull skill :)

c ya
ThrawN
05-23-2002, 12:51 PM
You'll probely notice some things in the PE i change which isnt needed, i only did it in a attempt to make some things work on NT,
not to worry. If anyone is interested i do have a CD i constructed which contains all my sources on it including softwraps unpacker and various other things.
However i will only mail it to trusted friends iv known for a while... someone contact me for some arangments perhaps..

If you need any help with this either post here or email me ;)

ThrawN
egg
08-23-2002, 09:35 AM
Thrawn, VERY useful tutorial! (the simplest things in life are often the best)

However, it left me with one question ...

After reading in an entire executable file, getting its image header and optional header, etc etc, how can you find out the real entrypoint of the program and it's consequent file offset?

For example, when you open the lamecrypted showbmp.exe in win32dasm, on the very second line of the disassembly, it says:
Code Offset = 00002C00, Code Size = 0000001F
And sure enough, pressing F10 in win32dasm to go to the entrypoint takes me to RVA 00406000 (00002C00 in the file). So how does win32dasm determine that 00002C00 is the entrypoint?

Any help from anyone would be very much appreciated
NervGaz
08-23-2002, 01:25 PM
it's in the PE optional header

IMAGE_OPTIONAL_HEADER32 STRUCT
Magic WORD ?
MajorLinkerVersion BYTE ?
MinorLinkerVersion BYTE ?
SizeOfCode DWORD ?
SizeOfInitializedData DWORD ?
SizeOfUninitializedData DWORD ?
AddressOfEntryPoint DWORD ? ;<--------- here you go
BaseOfCode DWORD ?
BaseOfData DWORD ?
ImageBase DWORD ?
SectionAlignment DWORD ?
FileAlignment DWORD ?
MajorOperatingSystemVersion WORD ?
MinorOperatingSystemVersion WORD ?
MajorImageVersion WORD ?
MinorImageVersion WORD ?
MajorSubsystemVersion WORD ?
MinorSubsystemVersion WORD ?
Win32VersionValue DWORD ?
SizeOfImage DWORD ?
SizeOfHeaders DWORD ?
CheckSum DWORD ?
Subsystem WORD ?
DllCharacteristics WORD ?
SizeOfStackReserve DWORD ?
SizeOfStackCommit DWORD ?
SizeOfHeapReserve DWORD ?
SizeOfHeapCommit DWORD ?
LoaderFlags DWORD ?
NumberOfRvaAndSizes DWORD ?
DataDirectory IMAGE_DATA_DIRECTORY IMAGE_NUMBEROF_DIRECTORY_ENTRIES dup(<>)
IMAGE_OPTIONAL_HEADER32 ENDS

hope that was fairly clear.. (i'm tired)
egg
08-23-2002, 02:49 PM
NervGaz thankyou very much for your help -- I would've thought AddressOfEntrypoint was the answer here, but it doesn't seem to be...
I'm looking at showbmp.exe from this LameDecrypt demo (seems like the best place to start), the AddressOfEntryPoint is &h100000 (1048576), but the offset in the file is 11265, which is the value I need to get to, not the RVA ... :)
NervGaz
08-23-2002, 02:57 PM
actually if you take a peek at it in a PE-edit/viewer it will tell you that AddressOfEntryPoint in 0x00006000 wich translates to 0x2C00 as the file offset...
egg
08-23-2002, 03:01 PM
Ah but how do you get 2C00 from 6000 ?!? This would be the final answer to my problem :) :)
Thanks very much for all of your help, it is very much appreciated
ZaiRoN
08-23-2002, 04:51 PM
hi egg!
6000 is the relative virtual address (rva)
2C00 is the offset
there are many tools that translate offset to rva and viceversa.
they are called 'file location calculator' (FLC).
i.e. you can use lordpe. click on flc and put the right value in the box...

regards,
ZaiRoN
egg
08-23-2002, 05:35 PM
Thankyou very much Zairon :)
but how do these programs calculate the file offset given an RVA? this is basically what I need to do
ZaiRoN
08-23-2002, 06:08 PM
suppose you want to pass from rva = 6000 to offset = 2C00.

the formula is: Offset = RVA - (VOffset + ROffset)
where VOffset and ROffset are respective the virtual offset and the real offset of the section 'lamecryp'.

hmmm...why exactly this section?
you have to choose the section that contains the rva you want to convert. in general:
VOffset =< rva < (VOffset + VSize)

in this specific case:
6000 =< 6000 < (6000 + 1F)

so, in conclusion:
offset = 6000 - (6000 + 2C00) = 2C00

ciao,
ZaiRoN
egg
08-26-2002, 05:09 AM
Got it, thanks! :)


SHA-1 combined with RSA?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > SHA-1 combined with RSA?
PDA

View Full Version : SHA-1 combined with RSA?

rhythm
05-21-2002, 02:36 PM
Hello readers,

Lately i came across a piece of software that had an interesting piece of build in cryptography. My intention is to understand how it works and to know if it relies on a 'standard' crypto algorithm or that it is something more fancy.

First an introduction (coded in Java, i left most pieces out):

-----

Secure Hash Algorithm (SHA-1) hashes the data of three files thus creating the following constant values:
* serenv1 (1024 bit) - prime number
* serenv2 (128 bit) - prime number
* serenv3 (1024 bit)
* serkey (1024 bit)
* array - with 2^14 128-bit positive numbers

After some playing around the input message is encrypted (in a reversible way) to a 144 bit number. The last 14 bit form the index into the array (bi2). Furthermore the most significant bit is removed resulting in bi4 (129 bits number).

Note: modInverse: (x xor -1) % y
modPow: (x ^ z) % y (where ^ stands for power, not XOR)

BigInteger bi2 = index;
BigInteger bi4 = 129bit_number;
BigInteger bi5 = array[index_array];

BigInteger bi6 = bi4.modInverse(serenv2);
BigInteger bi7 = bi2.multiply(bi6).mod(serenv2);
BigInteger bi8 = bi5.multiply(bi6).mod(serenv2);
BigInteger bi9 = serenv3.modPow(bi7, serenv1).multiply(serkey.modPow(bi8, serenv1)).mod(serenv1).mod(serenv2);

if(bi5.equals(bi9))
//Bingo! Free beers if the index is between 0 and 16000

-----

my first thoughts were a combination between SHA-1 and RSA. the extensive use of modPow and the use of modInverse gave me that idea, but since the modInverse operation in RSA is only used when calculating the private exponent i'm slightly confused. i think the multiply operations have something to do with the input message being bigger then 128 bits so it had to be 'hacked to pieces'.

if there anyone that can explain to me what is happening here (in crypto language, i can see what happens to the values :) ). every scrap of information would be helpfull!

regards & thanks in advance!
rhythm
mike
05-21-2002, 05:24 PM
OK, first thing I notice is that modInverse is horribly misnamed if it really is (x xor -1) % y. Looks like some clueless newbie took the notation for exponentiation to mean xor.

Second:
Secure Hash Algorithm (SHA-1) hashes the data of three files thus creating the following constant values:
* serenv1 (1024 bit) - prime number
* serenv2 (128 bit) - prime number
* serenv3 (1024 bit)
* serkey (1024 bit)
* array - with 2^14 128-bit positive numbers
SHA doesn't just spit out prime numbers; were the first two run through a primality test or something?

Third: the notation is kind of obtuse. Does

bi4.modInverse(serenv2)

mean

(bi4 XOR -1) % serenv2

or

(serenv2 XOR -1) % bi4

Also,

serenv3.modPow(bi7, serenv1).multiply(serkey.modPow(bi8, serenv1)).mod(serenv1).mod(serenv2);

looks like it's a bunch of operations in a row. Can you rewrite the code so there's only one operation on a line. If you could use more common notation (like x % y), that would help, too.

Fourth: as I recall, BigIntegers don't have a specific bit length. This isn't usually an issue, but here you're XORing with -1, which is a kluge. -1 is implicitly cast to an unsigned something, usually one less than a power of two. Which power of two? It matters because you're doing things modulo some other number.
rhythm
05-21-2002, 06:06 PM
1. thanks for your reply, i'm the clueless newbie. modInverse (as you already mentions) does x.pow(-1) % y and has nothing to do with XOR. forgive me my mistake. i hope that clears things up.

2. to simplify things i left out all the code that deals with reading in the files, handing them over to the messagedigest algoritm and creating the message digests. point is that the output is the constants i mentioned. of which the first two are primes with a probability of (1 - 1/1.000.000).
a previous version of this program used the same algorithm with different source files and serenv2 was a prime number too. so i don't think it's coincedence. serenv1 on the other hand, wasn't a prime in the previous version.

i can post the implementation of the algorithm if that would be of any help, just let me know.

3. example:
bi4.modInverse(serenv2) does (bi4.pow(-1)) % serenv2
(just like it's used creating the private exponent in RSA)

rewritten code:
BigInteger bi2 = index;
BigInteger bi4 = 129bit_number;
BigInteger bi5 = array[index_array];

BigInteger bi6 = bi4.modInverse(serenv2);
BigInteger bi7 = bi2.multiply(bi6).mod(serenv2);
BigInteger bi8 = bi5.multiply(bi6).mod(serenv2);

BigInteger bi9 = serenv3.modPow(bi7, serenv1);
BigInteger bi10 = serkey.modPow(bi8, serenv1);
BigInteger bi11 = b9.multiply.b10;
BigInteger bi12 = bi11.mod(serenv1).mod(serenv2);

4. again sorry for the confusion ;-)
mike
05-21-2002, 10:17 PM
OK. It makes a lot more sense now.

The only hard stuff I see going on is perhaps discrete log. The whole system isn't anything I've seen before. The modular inverse is used in such a way that it has no real bearing on the problem (unless serenv2 divides serenv1 - 1; then there might be something to it).

Discrete log is the following problem: It's easy to compute y where y=a ^ x mod n given a,x,n. It's hard to compute x given a,y,n.

What information are you allowed to alter in this system? You mentioned an "input message". What is that? Also, what are the three files being hashed?
rhythm
05-22-2002, 03:47 PM
Details about the SHA-1 procedure, "serial.dat" is 262,144 bytes, "serial.env" 545 bytes, "serial.key" 329 bytes. The author changes his codemechanism every version by replacing the files with other files of the same size.

MessageDigest messagedigest = MessageDigest.getInstance("SHA-1");
ab ab1 = instanceof_d.a("serial.env"); //ab1.j() = InputStream for "serial.env"
objectinputstream = new ObjectInputStream(new DigestInputStream(ab1.j(), messagedigest));
serialenv1 = (BigInteger)objectinputstream.readObject(); serialenv2 = (BigInteger)objectinputstream.readObject();
serialenv3 = (BigInteger)objectinputstream.readObject();
ab1 = instanceof_d.a("serial.key");
objectinputstream1 = new ObjectInputStream(new DigestInputStream(ab1.j(), messagedigest));
serialkey = (BigInteger)objectinputstream1.readObject();
ab1 = instanceof_d.a("serial.dat");
digestinputstream = new DigestInputStream(ab1.j(), messagedigest);

the array is created this way:

array = new byte[0x40000];
int i1;
for(int k = 0; k < 0x40000; k += i1)
{
int j1 = array.length - k >= 16384 ? 16384 : array.length - k;
i1 = digestinputstream.read(array, k, j1); //read(byte[] b, int off, int len).
//Reads into a byte array, and updates the message digest (if the digest function is on).
if(i1 == -1)
break;
}

bi2 & bi4 can be choosen freely (they are derived from the serial you entered). it's easy when given bi2 and bi4 to reconstruct the serial entered by you.

furthermore there's a line of text in the readme that says something like 'contains code licensed by rsa laboratories' and i think he aint talking about SHA-1.

hope things are more clear now!
mike
05-22-2002, 04:25 PM
I don't understand what the ObjectInputStream and DigestInputStream functions are doing.

I'm assuming that DigestInputStream generates a string of random numbers based on the hash of a file, and that ObjectInputStream allows you to read in data from the random stream and cast it to whatever type you want.

I'm curious, because I don't see any primality testing. If the numbers just happen to be prime as they come out of the random number generator, then we're in luck.

That means the creator of the files must have chosen the files carefully so that the random numbers came out to be primes. That's not particularly hard to do, so it wouldn't be a lot of work on his part. If so, it means that if we change the files, the numbers won't be prime anymore and we can break the crypto.

But, like I said, I don't understand what they do, so I could be completely wrong.
rhythm
05-22-2002, 08:08 PM
MessageDigest (http://java.sun.com/j2se/1.4/docs/api/java/security/MessageDigest.html) for some more information about SHA-1, from there you can click to the DigestInputStream method.

i'm confident that the author chose his files in such a way that the 128 bit number is a prime, i'm not sure about the 1024 bit number though ... could be by accident, but since he seems like a clever guy i doubt it.

replacing the files is a possibility, just don't use the files of any previous versions of the software because checks are made if you do. patching this scheme shouldn't be too hard, but that's not my point of interest. i want to understand every single bit of this piece of crypto :-)

/me still wonders about the link with RSA ...

maybe it's usefull to note that i do have valid keys in combination with other files. didn't help though; and believe me, i had some sleepless nights over this one ;)
mike
05-22-2002, 08:34 PM
I was wrong about what DigestInputStream does, but things still might work out OK. DigestInputStream computes the hash of data passing through the stream and passes the data out the other side. So it's not the hash that's a prime number; the prime number is stored in the file.

The hash is probably used in a checksum somewhere; it's not referenced in the code you posted (to retreive the hash you call getMessageDigest() ). If that's true, that will be a virtually impossible problem to keygen. If the hashes of the files aren't checked anywhere, then calculating the hashes was a waste.

Ignoring that problem, if we can change the moduli to any number we want (by editing the files), then we can pick numbers for which calculating discrete log is much easier.

Do you know if getMessageDigest is referenced anywhere?
rhythm
05-22-2002, 08:54 PM
*does some codedigging* (i HATE obfuscators)

bytedigest = messagedigest.digest();

for(int x = 0; x < bytedigest.length; x++)
if(badbytes[x] != bytedigest[x])
//have you been messin' with files boy?

badbytes is a predefined array ... so are you saying that the only reason for SHA-1 here is to calculate a hash to check for the right files?

Maybe it has something to do with: RSAES-OAEP (RSA Encryption Scheme - Optimal Asymmetric Encryption Padding) or RSASSA-PSS (RSA Signature Scheme with Appendix - Probabilistic Signature Scheme). I don't have a clue what they are, diving into it while you're reading this.

Thanks for the help so far, although i'm still puzzled i have the feeling that i'll get a good understanding of this one.
mike
05-23-2002, 12:43 AM
badbytes is a predefined array ... so are you saying that the only reason for SHA-1 here is to calculate a hash to check for the right files?
Well, perhaps not the only reason, but at least one of them.

Looks like you're out of luck as far as keygenning this one. If you could change the primes, there'd be some hope in solving the discrete log problem, but with the hash check in there, you're pretty much stuck.

Patching it or using a valid serial number are your only options as far as I can tell.

Whatever they're using right there, it's not RSA. RSA does stuff modulo composite numbers, not primes.


OllyDbg, usage hints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > OllyDbg, usage hints
PDA

View Full Version : OllyDbg, usage hints

IcyDee
05-21-2002, 05:15 PM
OllyDbg looks to be a very useful tool, with some excellent features that SoftIce does not have. However, I am having great difficulty doing the simplest of things. For example, how can I set a breakpoint on an API, for example MessageBoxA. All I can find in the help file is to use F2, but this only works if I am displaying the code in the disassembler window. It is all so counter intuitive!
snaker
05-21-2002, 05:35 PM
Right click on the debugger text
Search For/Name(label)
find wat you want

:)
The_Philosopher
05-22-2002, 06:44 AM
Hi

Go to Olly's homepage and there you will find help page with all shortcuts program have. Print it and you will know how.

The_Philosopher
Lord_Soth
05-23-2002, 01:01 AM
WOW!!! :)

I wanted to ask just THAT!!
Who's reading my mind ??
The Svin
05-25-2002, 11:06 PM
For example, how can I set a breakpoint on an API, for example MessageBoxA
If you mean breakpoint on execution MessageBoxA in the programm you are loaded into Ollydbg - you have to find all calls to it and set breakpoints in found places (or on some of them)
OllyDbg can not do what you can do in SoftIce - I mean to write just once bpx MessageBoxA and be sure that all calls to the API func will be intercepted.
If you mean to set system wide bp on MessageBoxA - that is not possible at all with OllyDbg.
peterg70
05-25-2002, 11:57 PM
With Ollydbg you can put a Break point on MessageBoxA that is reference from a program quite easily.

Instead of finding all the reference in the program just bring up the modules loaded (i.e. all the DLL etc that are referenced) then choose names on that DLL and it will list all referenced procedures. Then you can put a break point or a conditional break point on it.

I.e. Break if EAX="Hello World".

Note if the DLL is not loaded when you start ollydbg. it will appear once the program is running. I.e. If a loadlibrary is called it will then appear in the listing.

You can also get ollydbg to break on DLL load and Unload. More and more options

peterg


????? in softice data window
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ????? in softice data window
PDA

View Full Version : ????? in softice data window

bossrocky
05-21-2002, 07:59 PM
i've been trying to get music library 1.8.682 to yield to my investigations...one problem i've had is that when i do map32 and find its .data and .adata sections in memory, they have only ?????? (in softice 4.05's data window). what does this mean and how can i get rid of them (i.e. access this data)?

-bossrocky
crUsAdEr
05-21-2002, 08:20 PM
Hi bossrocky,

Try this page, might answer your question :>
c4nfaq.cjb.net

regards,
crUsAdEr


installshield
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > installshield
PDA

View Full Version : installshield

silverstorm
05-21-2002, 08:09 PM
Hello all
i have many programs created whit installshield and when the install process start ask for a serial number to install full version..
i try to trace by hours to find the real serials but its very complicate.. evry time entry in a loop whit peekmessage or something.. please somebody can explainme how i do to trace or to find the rutin where verifi the real serial.
example on http://downloads.cuseeme.com/cuseeme.exe
i try to find whit hmemcpy...
and whit getdlgitem
apis.
the instalation programs generate a tmp file.. on a windows\temp\ and from there start the instalation-

thanks

SiLvEr StOrM
Solomon
05-22-2002, 02:09 AM
Have you tried InstallShield script decompilers?:)
silverstorm
05-22-2002, 07:38 PM
i try.. thanks :)


Some question about AsPr.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Some question about AsPr.
PDA

View Full Version : Some question about AsPr.

Risotto
05-21-2002, 10:38 PM
1.
This part concerns import table:

018F:0112F757 AD LODSD
018F:0112F758 09C0 OR EAX,EAX
018F:0112F75A 744A JZ 0112F7A6
018F:0112F75C 89C7 MOV EDI,EAX
018F:0112F75E 033D60351301 ADD EDI,[01133560]
018F:0112F764 897DF8 MOV [EBP-08],EDI
018F:0112F767 89F3 MOV EBX,ESI
018F:0112F769 31C9 XOR ECX,ECX
018F:0112F76B 49 DEC ECX
018F:0112F76C 87FE XCHG EDI,ESI
018F:0112F76E 30C0 XOR AL,AL
018F:0112F770 F2AE REPNZ SCASB
018F:0112F772 87FE XCHG EDI,ESI
018F:0112F774 AC LODSB
018F:0112F775 80F800 CMP AL,00
018F:0112F778 74DD JZ 0112F757
018F:0112F77A 80F806 CMP AL,06
018F:0112F77D 7506 JNZ 0112F785
018F:0112F77F 8345F804 ADD DWORD PTR [EBP-08],04
018F:0112F783 EBEF JMP 0112F774
018F:0112F785 53 PUSH EBX
018F:0112F786 56 PUSH ESI
018F:0112F787 53 PUSH EBX
018F:0112F788 8D5DF8 LEA EBX,[EBP-08]
018F:0112F78B 53 PUSH EBX
018F:0112F78C 80F802 CMP AL,02
018F:0112F78F 7406 JZ 0112F797
018F:0112F791 0FB60E MOVZX ECX,BYTE PTR [ESI]
018F:0112F794 41 INC ECX
018F:0112F795 EB05 JMP 0112F79C
018F:0112F797 B904000000 MOV ECX,00000004
018F:0112F79C 01CE ADD ESI,ECX
018F:0112F79E E8B1FCFFFF CALL 0112F454
018F:0112F7A3 5B POP EBX
018F:0112F7A4 EBCE JMP 0112F774

As far as i understood, there are APIs that are called directly (jumps inside the IAT), but also there are encrypted ones which begin by push xxxxxx, call this address. How can i correctle reverse it? I've just redirected 018F:0112F79E CALL 0112F454 to 018F:0112F79E JMP 0049CB60. There i called 0112F454 and saved registers. Then making a dump <moduleName>0<procName/ordinal_number>0<corresponding target's address to copy the API address>, like Thesp wrote in his essay. But i failed to do this with crypted APIs. How to find decrypting call (address)? Moreover the program goes down without initializing all APIs (even not all APIs from KERNEL32.DLL). How to do it correctly? And if someone knows how ImpREC and Revirgin get imoprt table, describe me, please, in general terms? Or in details, who aren't lazy, of course.
PS: for ex., it was implemented on ASProtect 1.2

2.
I've got a little question about AsProtect: i want to extend Size of Image to put the code of my own function, 'cause it's not enough space. On enlarging the actual size (from 0x0001D000 to 0x0001E000), messagebox pops up saying that the file is corrupted, blah, blah, check it with Anti-Vitus. How to reverse it? I've already tried to search for byte which could point the size, but it was pointless.
PS: As an example i took NotePad.exe.
PPS: Sorry for my English.

R!50770
crUsAdEr
05-21-2002, 11:16 PM
hi Risotto,

The IAT redirection routine can by bypassed by a few NOPs, you are almost there already... kill it before it is born, so IAT is never mangled and hence no need to rebuild :>>... you will only need to fix emulated API later...

I STRONGLY suggest you read the FAQ, then press the search button to find a plethora of AsProtect thread discussion... thus avoid being bashed alive... search and ya will find where CRC check is done :>>...

Regards,
crUsAdEr


vbov 6.4 (Flash mx)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vbov 6.4 (Flash mx)
PDA

View Full Version : vbov 6.4 (Flash mx)

bytexus
05-21-2002, 10:43 PM
If any one could help me with this new vbox version please tell me how to rip this vbox 4.6 protection. I've found oep and IAT address and i tried to rebuild the iat with imprec but i dont know what to do with the imports found from vboxa.dll.
An interesting thing i've discovered with this new version. If you put a breakpoint on registerhotkey You will get an hot key witch activates a window where you can reset the trial. My combination was Ctrl+a.
crUsAdEr
05-21-2002, 11:09 PM
hi bytexus,

have you tried API emulator from revirgin, personally i neva really tried it but i heard it works...

You can also do it manually, read r2's tutorial on some quad metal on fravia site... the IAT can be built very similiarly...

The hot key sounds like interesting stuff :>>... maybe we need to dig into that sometimes....

regards,
crUsAdEr
Solomon
05-22-2002, 02:08 AM
yes please try ReVirgin. It works well with VBOX:D
bytexus
05-23-2002, 10:58 PM
I,ve downloaded revirgin v1.3 because i have used 1.4 on my Win98 system and i found some bugs(tracer always blocked the program) and i'll try to rebuild the iat. If i'll succed you will find out.
tsehp
05-25-2002, 09:29 AM
if you have problems with 1.3, please write me a msg with the app's url, I'll make some parallel test with new 1.5 version and 1.3 on w98.

I want to be sure it's only a w98 issue, otherwise I'll update the tracer.

later,

tsehp
bytexus
05-26-2002, 12:30 AM
Rv 1.3 works fine, and the tracer also works O.K. on my WIN98 SE. I've discovered that with this program the real address of the IAT and length were wrong althoug i,ve used the REAL OEP. I have managed to rebuild all the imports (3 of them i've manualy traced them because the tracer could not resolve those [crash!!!] peekmessagea-getmessagea-getinputstate) but when i run the new dumped target with all the imports restored i receive a message could not fiind sheet.dll. I've seerched this file on my HDD but there was no sign of it.What should i do?
The web site where you can fiind Flash mx http://www.macromedia.com/software/trial_download/
ThrawN
05-27-2002, 12:34 PM
I've used imprec on this exact target( gday necrotoad ;)) with limited success in win2k but 100% no probs in 98se ;)

ThrawN
bytexus
05-28-2002, 10:29 AM
I've tried Imprec but he doesn't resolve a lot of functions (he finds a lot of references to VBOXTA.dll that remains the same after i've traced them so i dont know what to do with them):confused:
haec_est
07-05-2002, 06:46 PM
:bpx getstartupinfoa+xx

ctrl+up ... and trace back

Oep : 828864

Break due to BPMB #001B:00828864 X DR2 (ET=4.18 seconds)
MSR LastBranchFromIp=02BE099D
MSR LastBranchToIp=00828864

001b:02be099d ffe3 jmp ebx

it's obfuscated inside an INT 20 VXDCall instruction

:map32 flash
Owner Obj Name Obj# Address Size Type
Flash .text 0001 001B:00401000 006B5905 CODE RW
Flash .rdata 0002 0023:00AB7000 000FADC5 IDATA RO
Flash .data 0003 0023:00BB2000 00133BEA IDATA RW
Flash .idata 0004 0023:00CE6000 00005F92 IDATA RW
Flash .rsrc 0005 0023:00CEC000 0031CFCC IDATA RO
Flash .reloc 0006 0023:01009000 00069A65 IDATA RO
Flash PREVIEW 0007 001B:01073000 00016264 CODE RW

:dd ce6000

...look down

Iat rva : 8e73a8
Iat len : ce85a4 - ce73a8 = 11FC

809 imported functions

...after dumping and fixing the iat it still crash :( why ??? may be a vbox presence check ???

regards,

haec_est

NB: rv 1.5 hang up after the first trace, but rv 1.4 work fine...
nikolatesla20
07-05-2002, 07:41 PM
I rebuilt Flash MX a long time ago, when it first came out, and the biggest problem I had was bad imports.

Let me tell you, you cannot beat SI for making sure your imports are correct !!!

Some problems I encountered with FlashMX were incorrect imports such as Unicode functions, like LoadStringW, etc. YOU MUST GET THESE CORRECT. This is why I use BOTH win 98 AND win2K machines. Although my original dump / IAT was on win98, it wouldn't run on Win2K - because the unicode functions have no mapping in win98, so revirgin didn't know what to put in there. So I had to rebuild the IAT on win2K over again - AND EVEN THEN some imports were wrong.

Remember, a good tool still cannot replace your brain! Look thru your IAT that you've got so far and examine the unicode functions. FlashMX has several (GetEnvironmentStringsW is a biggie). If it looks suspicious, trace into it with SI.

-nt20
haec_est
07-06-2002, 05:11 PM
...yes, there was a (only one !) bad import, rv resolved
it as Kernel32!InterlockedIncrement instead of
...
500 008E7E80 77E193FE 012E USER32.dll GetMessageA
...

no vbox presence check, just an error ;-)

NB: the same problem also in Dreamweaver MX and Fireworks MX, the fake address is the same for Drmwr Flash and Frwks... may be Rv don't like vbox ;-)

thanks,

haec_est


problem with ems mysql manager 1.75
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > problem with ems mysql manager 1.75
PDA

View Full Version : problem with ems mysql manager 1.75

cicakijo
05-22-2002, 03:08 AM
i have problem cracking ems mysql manager 1.75 which I downloaded from tucows. I have been able to eliminate the reminder window but only from softice. I am unable to change the exe file to make it permanent. The step I do so far:
1. bpx regopenkey to stop the program before the reminder window show up.
2. after the breakpoint showup, then i press F12 until softice come back to mymanager process.
3. i use F10 until i found the procedure which if i press F10 then the window comes up.
4. i trace into this procedure, got another procedure, trace into it, and then i found a test and jz which decide whether to show the reminder or to start the program.
5. i wrote down the test and jz code with their surrounding codes and search for it in the exe file using hedit. not found. :confused:

thank you.
Clandestiny
05-22-2002, 03:27 AM
Hiya,

Please do some basic research about hex editing. Try searching for tutorials at Krobar's site. I use Hacker's View for a hex editor... should be available at protools.cjb.net.

Clandestiny
cicakijo
05-22-2002, 05:48 AM
thank you for your reply

usually i use this method: for example softice display

A1382402FF MOV EAX,[FF022438]
3B05981E02FF CMP EAX,[FF021E98]
7608 JBE FF01D46F

then i want to change the jbe. usually i search with hedit using the code A1382402FF 3B05981E02FF 7608. so i use the surrounding codes to confirm that it is what i am looking for. it usually works. i suspect that the program was encrypted but i don't know how. i already try using procdump, file analyzer, and file info but still i don't find the solution.

thank you
vbdisease
05-22-2002, 01:57 PM
hi there,

run PE iDentifier by snaker & Qwerton (protools) on target exe and see what you got...let us know :o)

regards
vb
cicakijo
05-24-2002, 04:30 AM
Thank you very much for your help. I have use PE Identifier and found that the program use ASProtect 1.2. I use caspr to unpacked the program, then successfully change the result. Again, thank you for your help...


Paching UPX Exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Paching UPX Exe
PDA

View Full Version : Paching UPX Exe

ramon
05-22-2002, 09:02 AM
I people

I've break the last version of LogoManager 1.2.6
This app seems to be packed with UPX

But I saw patcher for older version that patch the file over UPX, it's that possible, or the patch process "unpack-patch-repack"?

Thankz
Ramon
Kilby
05-22-2002, 10:12 AM
It's easy to persuaide UPX to unpack (look at the command line options)

Though if it's the Nokia Logo Manager, it's much more likely to be TeLock, pretending to UPX.

It's more than possible to process patch the item in question.

but the best option is to unpack it then patch.

Kilby...
Hwoarang
05-22-2002, 01:00 PM
or use DZA Patcher (get it from protools.cjb.net) to do such a patch over upx.
_Servil_
05-22-2002, 11:18 PM
Originally posted by ramon
But I saw patcher for older version that patch the file over UPX, it's that possible, or the patch process "unpack-patch-repack"?

unpack-change-pack on same level-patch with std. patcher of your pref. ?
(the patch is some bigger but still not so as the target)
...there's just two pssible levels of compression - 7 for default or best...
Stone()
05-23-2002, 08:02 AM
Use the patcher Hwoarang said. Process patching is the way I prefer if there're not too many bytes to patch (too much typing),
otherwise unpack, patch and repack.


What kind of encryption is this?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > What kind of encryption is this?
PDA

View Full Version : What kind of encryption is this?

cazper
05-22-2002, 07:15 PM
I'm trying to figure out what kind of encryption this is:
NoVey60hEa05-1022077858107-44473
RFkgVhcAW1l2-1022077126028-43453

I suspect that both lines are the number 98616018 encrypted somehow.
The encryption is run by a webserver so it can be to advanced either.

Anyone got any idea?

Caz
mike
05-23-2002, 03:55 PM
It's not encryption. Those are serial numbers used for registering software.
cazper
05-23-2002, 07:25 PM
No, it is the encrypted(?) ID that is returned by a netscape webserver when I log in on it. And the ID is reversable to this number: 98616018 so it has to be some kind of encryption/encoding.
mike
05-23-2002, 07:38 PM
No, it is the encrypted(?) ID that is returned by a netscape webserver when I log in on it.
Do you mean you found that string in a cookie? Or as part of a URL? Or what?
And the ID is reversable to this number: 98616018
What do you mean by reversible?


Three questions...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Three questions...
PDA

View Full Version : Three questions...

Risotto
05-23-2002, 10:22 PM
1.ReGet:
I've found OEP by 'bpx GetModuleHandleA if(*(esp+4)==0)' and every time Sice breaks, i check what esp contains; when it's 0x008FCE3B, i press F12 twice and here it is:

018F:004CF550 55 PUSH EBP ;here is OEP
018F:004CF551 8BEC MOV EBP,ESP
018F:004CF553 6AFF PUSH FF
018F:004CF555 6820614F00 PUSH 004F6120
018F:004CF55A 6854E94C00 PUSH 004CE954
018F:004CF55F 64A100000000 MOV EAX,FS:[00000000]
018F:004CF565 50 PUSH EAX
018F:004CF566 64892500000000 MOV FS:[00000000],ESP
018F:004CF56D 83EC58 SUB ESP,58
018F:004CF570 53 PUSH EBX
018F:004CF571 56 PUSH ESI
018F:004CF572 57 PUSH EDI
018F:004CF573 8965E8 MOV [EBP-18],ESP
018F:004CF576 FF1588124F00 CALL [004F1288] ;we came back from this routin 018F:004CF57C 33D2 XOR EDX,EDX
018F:004CF57E 8AD4 MOV DL,AH
018F:004CF580 891538FB5100 MOV [0051FB38],EDX
018F:004CF586 8BC8 MOV ECX,EAX

Okie, now i've got OEP. Then rebuilding IAT: some API have to be emulated:

-GetCommandLineA
-GetVersion
-LockResource
-GetCurrentProcessId
-FreeResource
-GetModuleHandleA
-GetCurrentProcess
-SetWindowLongA
-FindResourceA
-GetDlgItemTextA

So, i've done it. But in any way ReGet crashes. Let's have a look: idecided to trace just from the begining and to see what can cause that crash:

018F:004CF5D1 E84B4F0000 CALL 004D4521
018F:004CF5D6 FF15A0114F00 CALL [KERNEL32!GetCommandLineA]
018F:004CF5DC A3A4395200 MOV [005239A4],EAX
018F:004CF5E1 E8094E0000 CALL 004D43EF
018F:004CF5E6 A36CFB5100 MOV [0051FB6C],EAX
018F:004CF5EB E8B24B0000 CALL 004D41A2
018F:004CF5F0 E8F44A0000 CALL 004D40E9
018F:004CF5F5 E8D1EDFFFF CALL 004CE3CB ;here is our crash resides - F8
.............
018F:004CE3CB A1F86C5100 MOV EAX,[00516CF8]
018F:004CE3D0 85C0 TEST EAX,EAX
018F:004CE3D2 7402 JZ 004CE3D6
018F:004CE3D4 FFD0 CALL EAX
018F:004CE3D6 6810BC4F00 PUSH 004FBC10
018F:004CE3DB 68FCBB4F00 PUSH 004FBBFC
018F:004CE3E0 E8EC000000 CALL 004CE4D1
018F:004CE3E5 68F8BB4F00 PUSH 004FBBF8
018F:004CE3EA 6800A04F00 PUSH 004FA000
018F:004CE3EF E8DD000000 CALL 004CE4D1 ;let's look into this call
018F:004CE3F4 83C410 ADD ESP,10
018F:004CE3F7 C3 RET
.............
018F:004CE4D1 56 PUSH ESI
018F:004CE4D2 8B742408 MOV ESI,[ESP+08]
018F:004CE4D6 3B74240C CMP ESI,[ESP+0C]
018F:004CE4DA 730D JAE 004CE4E9
018F:004CE4DC 8B06 MOV EAX,[ESI]
018F:004CE4DE 85C0 TEST EAX,EAX
018F:004CE4E0 7402 JZ 004CE4E4
018F:004CE4E2 FFD0 CALL EAX
018F:004CE4E4 83C604 ADD ESI,04
018F:004CE4E7 EBED JMP 004CE4D6 ;here is a loop
018F:004CE4E9 5E POP ESI
018F:004CE4EA C3 RET

Here we'll spin a little in the loop and with this we'll find what realy cause the error. Tracing a while in this loop i've found next:

push 004xxxxx
call [004xxxyy] ;in the address 004xxxyy resides 009xyxyx!!!

Thus our dump won't work! Such a call won't work correctly, if to make more precise, it won't work at all. That's why let's see what APIs are called and redirect them:

calls (in reverse order):
0x004F168C 98 57 91 00 -> BF F4 56 BF - RegisterClipboarFormatA
0x004F1588 8C 57 91 00 -> F0 14 F4 BF - RegisterWindowMessageA
0x004F1624 68 56 91 00 -> B5 56 F4 BF - wsprintfA

Once we've done this, our dump will be located in the memory without errors, but actually it does nothing. I can just kill the process thru the process viewer in PEditor. While finding OEP, i came across three addresses that should be emulated too(??):

seg000:00479787 ; ---------------------------------------------------------------------------
seg000:00479787 mov eax, [esp+4]
seg000:0047978B mov ds:dword_0_51CB08, eax
seg000:00479790 retn
seg000:00479791 ; ---------------------------------------------------------------------------
seg000:00479791 mov eax, [esp+4]
seg000:00479795 mov ds:dword_0_51CB0C, eax
seg000:0047979A retn
seg000:0047979B ; ---------------------------------------------------------------------------
seg000:0047979B mov eax, [esp+4]
seg000:0047979F mov ds:dword_0_51CB10, eax
seg000:004797A4 retn
seg000:004797A5

Strange, but this addresses aren't used at all! Or amybe i'm mistaken! Okie. Let's keep on looking: in dword_0_51CB08 - 8FCD58h. It's a function, but what func?:

018F:008FCD58 833D6046900000 CMP DWORD PTR [00904660],00
018F:008FCD5F 750D JNZ 008FCD6E
018F:008FCD61 A170459000 MOV EAX,[00904570]
018F:008FCD66 8B1574459000 MOV EDX,[00904574]
018F:008FCD6C EB0B JMP 008FCD79
018F:008FCD6E A160469000 MOV EAX,[00904660]
018F:008FCD73 8B1564469000 MOV EDX,[00904664]
018F:008FCD79 52 PUSH EDX
018F:008FCD7A 50 PUSH EAX
018F:008FCD7B E8D4FDFFFF CALL 008FCB54
018F:008FCD80 C3 RET

In dword_0_51CB0C - 8FCD84h:

018F:008FCD84 833D6046900000 CMP DWORD PTR [00904660],00
018F:008FCD8B 750D JNZ 008FCD9A
018F:008FCD8D A170459000 MOV EAX,[00904570]
018F:008FCD92 8B1574459000 MOV EDX,[00904574]
018F:008FCD98 EB0B JMP 008FCDA5
018F:008FCD9A A160469000 MOV EAX,[00904660]
018F:008FCD9F 8B1564469000 MOV EDX,[00904664]
018F:008FCDA5 E81EFEFFFF CALL 008FCBC8
018F:008FCDAA C3 RET

And in dword_0_51CB10 - 8FCDACh:

to be cont...
Risotto
05-23-2002, 10:24 PM
018F:008FCDAC 55 PUSH EBP
018F:008FCDAD 8BEC MOV EBP,ESP
018F:008FCDAF 53 PUSH EBX
018F:008FCDB0 56 PUSH ESI
018F:008FCDB1 8B5D0C MOV EBX,[EBP+0C]
018F:008FCDB4 8B7508 MOV ESI,[EBP+08]
018F:008FCDB7 8BC3 MOV EAX,EBX
018F:008FCDB9 E8D657FFFF CALL 008F2594
018F:008FCDBE A360469000 MOV [00904660],EAX
018F:008FCDC3 8B1560469000 MOV EDX,[00904660]
018F:008FCDC9 8BC6 MOV EAX,ESI
018F:008FCDCB 8BCB MOV ECX,EBX
018F:008FCDCD E8B258FFFF CALL 008F2684
018F:008FCDD2 891D64469000 MOV [00904664],EBX
018F:008FCDD8 53 PUSH EBX
018F:008FCDD9 8BCE MOV ECX,ESI
018F:008FCDDB 8B155C469000 MOV EDX,[0090465C]
018F:008FCDE1 A158469000 MOV EAX,[00904658]
018F:008FCDE6 E811FBFFFF CALL 008FC8FC
018F:008FCDEB 833D8445900000 CMP DWORD PTR [00904584],00
018F:008FCDF2 7505 JNZ 008FCDF9
018F:008FCDF4 E85FFFFFFF CALL 008FCD58
018F:008FCDF9 5E POP ESI
018F:008FCDFA 5B POP EBX
018F:008FCDFB 5D POP EBP
018F:008FCDFC C20800 RET 0008

Frankly i don't know what to do with them. Does someone know? And thru Õrefs i've found next:

seg000:004797DB sub_0_4797DB proc near ; CODE XREF: sub_0_404A32+F8p
seg000:004797DB cmp ds:dword_0_51CB14, 0
seg000:004797E2 jnz short locret_0_4797F9
seg000:004797E4 mov eax, ds:dword_0_51CB08
seg000:004797E9 test eax, eax
seg000:004797EB jz short loc_0_4797FA
seg000:004797ED call eax
seg000:004797EF mov ds:dword_0_51CB14, 1
...............
seg000:004797A5 push ebp
seg000:004797A6 mov ebp, esp
seg000:004797A8 push ecx
seg000:004797A9 mov eax, ds:dword_0_51CB10
seg000:004797AE mov [ebp+var_4], 8Ch
seg000:004797B5 test eax, eax
seg000:004797B7 jz short loc_0_4797C3
seg000:004797B9 lea ecx, [ebp+var_4]
seg000:004797BC push 4
seg000:004797BE push ecx
seg000:004797BF call eax
seg000:004797C1 leave
seg000:004797C2 retn

That's all what i menaged to find. Can someone help me to unpack it? Or just to say what is wrong?

2.One more question about CRC check in AsProtect: i've tried to find it thru CreateFile, but i failed because of SEH used in AsPr. I've read crUsAdEr's tutorial where he suggested to trigger by 'r eip=eip+2':

018F:00B9ED44 01E9 ADD ECX,EBP
018F:00B9ED46 648920 MOV FS:[EAX],ESP
018F:00B9ED49 3100 XOR [EAX],EAX ;once we're here do 'r eip=eip+2'
018F:00B9ED4B EB01 JMP 00B9ED4E
018F:00B9ED4D 68648F0500 PUSH 00058F64

But, unfortunately, i've found myself somewhere very-very far. What's wrong?

3.Armadillo:
As crUsAdEr advised to set a bpx on SetProcessWorkingSetSize. That's a good idea. Okie, i've made it and found OEP, but setting bpx on WriteProcessMemory was pointless - Sice didn't break and i couldn't find decrypting routin (in Sice). I tried to look into 'call edi', but it's the place where the program begins (->jmp OEP) and thus there is no decrypting routin. I decided to dump the process and to search the deadlisting. I found an appropriate code:

.text1:0041B8AE ; ---------------------------------------------------------------------------
.text1:0041B8AE
.text1:0041B8AE loc_0_41B8AE: ; CODE XREF: sub_0_41B77D+17j
.text1:0041B8AE push 0
.text1:0041B8B0 mov ecx, [ebp+arg_0]
.text1:0041B8B3 push ecx
.text1:0041B8B4 call loc_0_41B967
.text1:0041B8B9 add esp, 8
.text1:0041B8BC and eax, 0FFh
.text1:0041B8C1 test eax, eax
.text1:0041B8C3 jnz short loc_0_41B8CC
.text1:0041B8C5 xor al, al
.text1:0041B8C7 jmp loc_0_41B963

Here it is. But it's not used while program loading. What's the prob? Should it be executed or no? And why breakpoint on WriteProcessMemory doesn't work? And who knows how to rip a prog from Armadillo, or to take of the f*cking protection?
PS: taken proggie was protected with Armadillo 2.53
crUsAdEr
05-23-2002, 11:05 PM
hi Risotto,

To know what the routine does, the best way is to dump the AsP.dll and disassemble it... i cant recall on top of my head rite now...

My guess about the loop is that ReGet is initialised before that and hence your dump crash, try to dump it rigth after or before IAT mangling...

By the way, the sice command is " r eip eip+2" without the equal sign i think...

About armadillo, you dont even need to dump, just disassemble the protected exe directly you will find the routine above... it should work, my method have only been tested on 2.52 and below... i know they make some changes in 2.53, my dumper fails on it... but no time to look into it at the moment... Have you tried to change the push 1 to be come push 0???

The copymem routine will have to be caledd to decrypt the code section for the target to run, but if your debugger is detected then it will just quit silently... also if the program is not protected by copy mem then of course the routine is not called.. i am just guessing though... are you playing with notepad or what??

That is all for now,
regards,
crUsAdEr

P.S : on the second thought, do look at a thread about reget started by Solomon recently.. i think the 2 routines you posted are the decrypting routine that is used to decrypt certains area of the code section...
Lbolt99
05-24-2002, 02:44 PM
What ver of reget are you looking at? v2.1a is not too difficult but as you progress thru the various betas of 3.0, it gets progressively difficult as they keep adding various protections and using more features of Aspr.

Lots of ppl here have reversed various betas of 3.0 who may help, not sure about 2.1a but there's a ready made crack for 2.1a if you look... I initally got stuck at what looks like where you are but reversed the crack to see what they did, you can learn a lot from another's crack if you can find it.
Risotto
05-25-2002, 04:14 AM
Hi!
to crUsAdEr:
Firstly, can you make more precise what is SEH for AsPr? I mean whether it's a constant feat. or it is implemented when debuger is detected? And what is the main aim og this SEH tricks? "To_show_me_that_i_am_on_the_wrong_way"? While looking CRC check i couldn't overcome this tricks. Can you help me pointing out what should i do to defeat SEH tricks in AsPr? Here it is a snippet code:

018F:00B9ED44 01E9 ADD ECX,EBP
018F:00B9ED46 648920 MOV FS:[EAX],ESP
018F:00B9ED49 3100 XOR [EAX],EAX ;once we're here do 'r eip=eip+2'
018F:00B9ED4B EB01 JMP 00B9ED4E
018F:00B9ED4D 68648F0500 PUSH 00058F64

Are my coments wright? It's like in you essay, but nothing happens and i get into kernel debris. And one more question: as far as i know SmartCheck can be used not only for VB applications and that's why i decided to use it, to find where is CRC check, but where i have configered it in the wrong way(???) or whatever, but i cannot intercept APIs just from the begining! Actually, i've marked the check box "Start event reporting when starting this prog", but i cannot see needed API like ReadFile, CreateFileA, etc, etc.

To Lbolt99:
No, it's not 2.*, it's 3.0.118 (the last version, as far as i found). Reversing 2.* ver. is very easy, but what 3.0 is concerns, i wasn't able to do it. I even cannot unpack it correctly!

BTW, crUsAdEr, i've already tried to bup a break point on changed byte (i need to change Size of Image) and Sice didn't break! Why?
And what you mean saying to IAT mangling? When AsPr creates redirected APIs? Or whatelse? And what can be accomplished by preventing (as you've said NOPing) this mangling?

PS: Sorry for so many question, i just try to clerify some things:).
Thanks
crUsAdEr
05-25-2002, 12:38 PM
Howdy,

What seh is for??? ask Alexey :>>... well seh is used to clear your bpm as well as make tracing harder.

Like i said in the earlier post, there is no equal sign in the command if I am not wrong, or else someone please correct me. The syntax is "r eip eip+2".. do read your sice manual or at least some tutorial on sice. Basically the idea is that we increase eip by 2 so that the faulty instruction is not executed and hence seh is not triggered.

Again, i think my essay did cover CRC of AsProtect, you can look at the dll again to get the idea... for unpacking this is not very important, if you really want to patch it, debugging some inline patched AsProtected proggy you will know where AIPH patch the CRC checks... Like Lbolt99 has said, reversed some inline patched proggy at Desperate site by Flawless will help as well... I have not use SmartCheck for that purpose yet so I am sorry i wouldnt know...

Yep, API mangling is API redirection... well, if you trace the API mangling routine above, just follow the loop around it a few times, you will see that API address is first obtained, then passed through the redirection routine as i partially explained in my essay... hence you will need to NOP the redirecting routine, NOP at the right place and you will only need to NOP a few bytes... If you choose to do it this way, rebuild IAT without help of tools like revirgin, then DO read some old unpacking tutorial, those written before the likes of Revirgin and Imprec were born... check out R!sc's site as well as some old unpacking tutorial on krobar site.. also i fi remember correctly, there are a few tutorials on Tsehp site about defeating VBox by patching the IAT redirection routine... this is a real neat method once you get used to it...

Enjoy,
crUsAdEr
Risotto
05-26-2002, 10:36 PM
G'day, crUsAdEr!
Just one question more: can you post links of what you've mentioned above? Espacialy R!sc's, 'cause i'd like to read his tuts. And one thing more: i'm interested not in crack but in defeating, so i'd like to know the way the protection goes...
Thanks for help.
crUsAdEr
05-27-2002, 02:50 PM
Hi Risotto,

Remeber, always try to search around... check out the the off topic or tools of trade forum, i cant remember exactly, i did posted the link some where ago... i dont know where i got Jeremy Gordon text from, just try it with google... you best friend...

The best way to know how the protection works is devote like a few hours to dump the dll from AsProtect, once you have the dll disassembled in IDA... everything is there for you to see....

Regards,
crUsAdEr
Risotto
05-27-2002, 10:27 PM
Hey!

In your tut you wrote how to obtain aspr.dll, but can you give me some details: how to find the Vaddress of the above mentioned DLL in order to dump it? Because i've spent 2 hours tracing those loops about which you wrote and it's really amazing.

PS: CRC Check in AsProtected is defeated:). Actually, it wasn't the first time i dealt with CRC Check - i was stoped by SEH, but now everything is clear.
PSS: BTW, i know that search engines are very useful. I had to make more precise asking you about links: i'd have liked you to give me R!sc's one, but not Jeremy Gordon's SEH article - i've found it in 2 min.

!yeH
crUsAdEr
05-28-2002, 02:02 AM
Hey hey,

To dump the dll, you have to get to the OS loader part, which is when AsProtect just jump into high memory, decrypt the dll, dump it before relocation... the offset will be different for diff version of AsProtect, also diff OS also will give diff ofset...

bpx on VirtualFree, break once or twice, till you reach end of the decrypting loop in AsProtect data section, and start jumping to some high memory area....
trace there, you will see how OS loaders actually loads a dll :>>> pretty cool...

try typing r!sc in Off topic or search for last thread started by cluesurf, you will find the site address, i am too lazy to find it now...

If you need help with the dll, i will post more details, but u can also look at my dll... most of the stuff are the saem anyway....

Good luck :>>
crUsAdEr
JMI
05-28-2002, 02:32 AM
Here's a BIG hint. The post title in Off Topics is "Risc Site." Good clue and by cluesurf. Pun intended. Try that search button.

Regards.
Solomon
05-28-2002, 03:01 AM
I have successfully unpacked and cracked ReGet 3.0 Final build 121. ImpREC v1.42+ can't correctly fix the dumped files(The fixed exe will crash just as what you got. sorry I don't mean to blame ImpREC or MackT, actually it's a great tool), ReVirgin does well.

Are u sure the following 3 APIs are emulated?I don't think so. And you may have missed one emulated API DialogBoxParamA(emulated with FindResource + LoadResource + DialogBoxIndirectParamA).

-SetWindowLongA
-FindResourceA
-GetDlgItemTextA

there is already a release "/0524/Reget.Deluxe.v3.0.121.WinAll.Cracked-EAT"(no, it's not made by me. I'm not a member of any group). I have checked how EAT cracked it. They just cleared several obvious size checks and repacked it to the same size as the original exe.

Please also refer to the following threads:
http://www.woodmann.net/forum/showthread.php?s=&threadid=2977
http://www.woodmann.net/forum/showthread.php?s=&threadid=2855
SpeKKeL
05-28-2002, 10:12 AM
Yep,

Nice target, it was some time ago i played with aspr. so took latest build 121.
Api's where easy and rebuild with R.V (h,m must i install w2k or xp
now r.v stops supporting w98 ??)
The most fun was reversing the prog.
Saw there was some counter which triggered the size/integrity (do i spell correct ?) check. Simply passed this and no need to re-pack now.
The quiting part had a little trouble (seems quiting on some aspr progs cause errors) but easilly solved.
And registering.......just 1 bit.

Our thanks to:
Encryption mechanism:
A....y S................v

SpeKK:p
foxthree
05-28-2002, 05:18 PM
Yo!

Just out of curiosity and b'cos SpeK mentioned the Encryption Mechanism in ASPR....

Has anyone successfully reversed ASPR KeyGen/Encryption mechanism. The KeyGen is 100% RSA. I'm sure of it. I did some study long back and it is again one of those 20% done projects in my shelf :( And it seems to be implemented pretty good too. No default parameters for 'e' etc...

The other part is enabling the software to decrypt encrypted code and dump it to patch the proggie for good. Examples of this kind incl. Elcomsoft's products. Some code section is encrypted with a key and only upon getting correct key would it decrypt. I know Crusader did some work on AZPR sutff, but I'm unable to locate this in this maze of knowledge :)

Pointers?

Signed,
-- FoxThree
Lbolt99
05-28-2002, 05:21 PM
I found his azpr discussion in the thread in crypto "tutorial: finding encryption code in a target".

Originally posted by foxthree
I know Crusader did some work on AZPR sutff, but I'm unable to locate this in this maze of knowledge :)

Pointers?

Signed,
-- FoxThree
Stone()
05-28-2002, 06:35 PM
Well I had no problems fixing Reget Build 121 either with Imprec nor RV. No crashing or whatsoever. I use however W2K & XP.

I prefer RV as it re-writes a better Import table, but Imprec resolves better.

The size checks (1st Eat rls) were just too obvious, as they worked in previous rls's of Reget.

More important was the random counter which was only triggered when some CRC checks were not ok. If the flag then was 0 or 1 (don't remember) Reget overwrote on some downloads the first bytes of the zip file with the famous readme.txt file.

Important lessons, never trust your old cracks, authors are not sleeping and mightr have added some new surprises.

Infact the fix from Eat have resolved above and repacking to same size is not an issue anymore.

In any case more interesting would be to patch the RSA routine and then write a Keygen for it.
Risotto
05-28-2002, 10:30 PM
I've found at least 4 loops and that place which you was talking about APIs (AsProtect searchs some APIs in kernel), but speacking frankly i didn't grasp the idea how it's done. Can you explain it a little (5)? And where is the aspr.dll copied to high memory as you wrote in you tut?

************** 1

.data:0067B088 add esi, 7C2h ; esi = 0x0067B836
.data:0067B08E push esi
.data:0067B08F mov ah, dl
.data:0067B091 pop ebx ; ebx = esi
.data:0067B092 push 1B5h
.data:0067B097 pop ecx ; ecx = 0x01B5
.data:0067B098
.data:0067B098 loop_1: ; CODE XREF: .data:0067B154j
.data:0067B098 push dword ptr [esi] ; [esi] = 0x4CB532AB
.data:0067B09A mov ax, 7F8Bh ; eax = 0x00677F8B
.data:0067B09E pop edx ; edx = [esi]
.data:0067B09F jns decrypting_routine_1
.data:0067B0A5 ja decrypting_routine_1
.data:0067B0AB jl $+6
.data:0067B0B1
.data:0067B0B1 decrypting_routine_1: ; CODE XREF: .data:0067B09Fj
.data:0067B0B1 ; .data:0067B0A5j
.data:0067B0B1 add edx, 429CCF51h
.data:0067B0B7 mov di, 50Ah
.data:0067B0BB xor edx, 0D9523B6h
.data:0067B0C1 or bl, 2Dh
.data:0067B0C4 sub edx, 0E25D8B7h
.data:0067B0CA push 60A1D5B0h
.data:0067B0CF call adjusting_next_addr_1
.data:0067B0D4 fsubr st(5), st
.data:0067B0D6 mov edx, 8661C86Bh
.data:0067B0DB inc edi
.data:0067B0DC jz short loc_0_67B07B
.data:0067B0DE adc ah, bl
.data:0067B0E0 loopne loc_0_67B07B
.data:0067B0E2 pop esi
.data:0067B0E3 aas
.data:0067B0E4 or al, 55h
.data:0067B0E6 push 5Bh
.data:0067B0E8
.data:0067B0E8 adjusting_next_addr_1: ; CODE XREF: .data:0067B0CFp
.data:0067B0E8 mov di, 0D9A4h
.data:0067B0EC pop eax
.data:0067B0ED pop edi ; edi = 0x60A1D5B0
.data:0067B0EE mov [esi], edx ; [esi] = edx
.data:0067B0F0 xor bh, 27h
.data:0067B0F3 sub esi, 4FCB997Dh
.data:0067B0F9 mov bx, cx
.data:0067B0FC add esi, 4FCB9979h
.data:0067B102 mov ax, 7B35h
.data:0067B106 dec ecx
.data:0067B107 jnz go_on_1
.data:0067B10D jp the_end_1
.data:0067B113 add ebx, 74E8910Fh
.data:0067B119
.data:0067B119 the_end_1: ; CODE XREF: .data:0067B10Dj
.data:0067B119 jmp exit_loop_1
.data:0067B119 ; ---------------------------------------------------------------------------
[skipped]
.data:0067B12F ; ---------------------------------------------------------------------------
.data:0067B12F
.data:0067B12F go_on_1: ; CODE XREF: .data:0067B107j
.data:0067B12F ; .data:0067B14Fj
.data:0067B12F call near ptr loc_0_67B140+1
.data:0067B134 xchg eax, ecx
.data:0067B135 div bh
.data:0067B137 db 64h
.data:0067B137 int 82h ; reserved for BASIC
.data:0067B13A xchg eax, ebx
.data:0067B13B ror cl, 1
.data:0067B13D into
.data:0067B13E out dx, eax
.data:0067B13F cld
.data:0067B140
.data:0067B140 loc_0_67B140: ; CODE XREF: .data:0067B12Fp
.data:0067B140 test ecx, ebp
.data:0067B142 or eax, 1000000h
.data:0067B147 cmpsb
.data:0067B148 out 94h, eax
.data:0067B14A
.data:0067B14A loc_0_67B14A: ; CODE XREF: .data:0067B1B4j
.data:0067B14A cmp eax, 39008332h
.data:0067B14F jle short near ptr go_on_1+1
.data:0067B151 sub al, 0F5h
.data:0067B153 pop edi
.data:0067B154 jmp loop_1

************** 2

.data:0067B189 push eax
.data:0067B18A add esi, 66062BAAh
.data:0067B190 pop edi
.data:0067B191 mov ecx, 187h ; ecx = 0x0187
.data:0067B196 or dl, 4Dh
.data:0067B199
.data:0067B199 loop_2: ; CODE XREF: .data:0067B215j
.data:0067B199 mov eax, [ebx] ; get what should be decrypted
.data:0067B19B xor eax, 7579A9CBh ; some manipulations
.data:0067B1A1 push ecx
.data:0067B1A2 push ebx
.data:0067B1A3 mov dl, ah
.data:0067B1A5 pop edi
.data:0067B1A6 pop edx
.data:0067B1A7 sub eax, 748B55A8h ; some manipulations
.data:0067B1AD call continue_2
.data:0067B1B2 jnz short near ptr loc_0_67B1BA+4
.data:0067B1B4 jnp short near ptr loc_0_67B14A+4
.data:0067B1B6 icebp
.data:0067B1B7 setalc
.data:0067B1B8 push edi
.data:0067B1B9 inc esp
.data:0067B1BA
.data:0067B1BA loc_0_67B1BA: ; CODE XREF: .data:0067B1B2j
.data:0067B1BA sub eax, 29B0F362h
.data:0067B1BF scasb
.data:0067B1C0 dec edi
.data:0067B1C1 fsubr st(5), st
.data:0067B1C3
.data:0067B1C3 continue_2: ; CODE XREF: .data:0067B1ADp
.data:0067B1C3 mov edx, 2A04D486h
.data:0067B1C8 pop edx
.data:0067B1C9 add eax, 7B5CD8C1h ; some manipulations
.data:0067B1CF push eax ; save it
.data:0067B1D0 push esi
.data:0067B1D1 jmp loc_0_67B1E6
.data:0067B1D1 ; ---------------------------------------------------------------------------
[skipped]
.data:0067B1E6 ; ---------------------------------------------------------------------------
.data:0067B1E6
.data:0067B1E6 loc_0_67B1E6: ; CODE XREF: .data:0067B1D1j
.data:0067B1E6 pop edx
.data:0067B1E7 pop dword ptr [ebx] ; restore it
.data:0067B1E9 movzx esi, di
.data:0067B1EC
.data:0067B1EC adjusting_next_addr_2:
.data:0067B1EC sub ebx, 2B8ECB40h
.data:0067B1F2 movsx edi, si
.data:0067B1F5 add ebx, 2B8ECB3Ch
.data:0067B1FB push 3D2C258h
.data:0067B200 jmp loc_0_67B211
.data:0067B200 ; ---------------------------------------------------------------------------
[skipped]
.data:0067B211 ; ---------------------------------------------------------------------------
.data:0067B211
.data:0067B211 loc_0_67B211: ; CODE XREF: .data:0067B200j
.data:0067B211 pop esi
.data:0067B212 sub ecx, 1
.data:0067B215 jnz loop_2
.data:0067B21B
.data:0067B21B the_end_2:
Risotto
05-28-2002, 10:32 PM
************** 3

.data:0067B262 go_on_3: ; CODE XREF: .data:0067B2D9j
.data:0067B262 mov ebx, [ecx] ; get what should be decrypted
.data:0067B264 jnz decrypting_routine_3
.data:0067B26A jns decrypting_routine_3
.data:0067B270 mov di, 0E3FCh
.data:0067B274
.data:0067B274 decrypting_routine_3: ; CODE XREF: .data:0067B264j
.data:0067B274 ; .data:0067B26Aj
.data:0067B274 xor ebx, 53B8B161h ; some manipulations
.data:0067B27A xor ebx, 3DB54486h ; some manipulations
.data:0067B280 push 61CA80A6h
.data:0067B285
.data:0067B285 loc_0_67B285: ; CODE XREF: .data:0067B25Bj
.data:0067B285 jnz loc_0_67B28E
.data:0067B28B movzx esi, dx
.data:0067B28E
.data:0067B28E loc_0_67B28E: ; CODE XREF: .data:0067B285j
.data:0067B28E pop edx ; edx = 0x61CA80A6
.data:0067B28F xor ebx, 6B33147h ; some manipulations
.data:0067B295 mov dx, cx
.data:0067B298 mov [ecx], ebx ; save it back
.data:0067B29A adc di, 7E73h
.data:0067B29F sub ecx, 4 ; adjusting_next_addr_3
.data:0067B2A2 mov edx, ebx
.data:0067B2A4 sub eax, 1
.data:0067B2A7 jnz loop_3
.data:0067B2AD jmp the_end_3
.data:0067B2AD ; ---------------------------------------------------------------------------
[skipped]
.data:0067B2BD ; ---------------------------------------------------------------------------
.data:0067B2BD
.data:0067B2BD the_end_3: ; CODE XREF: .data:0067B2ADj
.data:0067B2BD jmp loc_0_67B2E5
.data:0067B2BD ; ---------------------------------------------------------------------------
[skipped]
.data:0067B2D1 ; ---------------------------------------------------------------------------
.data:0067B2D1
.data:0067B2D1 loop_3: ; CODE XREF: .data:0067B2A7j
.data:0067B2D1 push 9D118A8h
.data:0067B2D6 mov esi, edi
.data:0067B2D8 pop edx
.data:0067B2D9 jmp go_on_3

************** 4

.data:0067B317 loop_4: ; CODE XREF: .data:0067B365j
.data:0067B317 mov ecx, [ebx] ; get what should be decrypted
.data:0067B319 xor ecx, 474240AFh ; some manipulations
.data:0067B31F adc si, 0ADE4h
.data:0067B324 xor ecx, 7D450CBCh ; some manipulations
.data:0067B32A mov edi, 4B1EC450h
.data:0067B32F add ecx, 75AFE445h ; some manipulations
.data:0067B335 mov edx, 10B3D57Ch
.data:0067B33A push ecx ; save it
.data:0067B33B jmp go_on_4
.data:0067B33B ; ---------------------------------------------------------------------------
[skipped]
.data:0067B34D ; ---------------------------------------------------------------------------
.data:0067B34D
.data:0067B34D go_on_4: ; CODE XREF: .data:0067B33Bj
.data:0067B34D pop dword ptr [ebx] ; restore it
.data:0067B34F and esi, 402EE44h
.data:0067B355 sub ebx, 3 ; adjusting_next_addr_4_1
.data:0067B358 movsx edx, si
.data:0067B35B dec ebx ; adjusting_next_addr_4_2
.data:0067B35C sub esi, 47946F86h
.data:0067B362 sub eax, 1
.data:0067B365 jnz loop_4

************** 5

.data:0067B533 finding_APIs: ; CODE XREF: .data:0067B547j
.data:0067B533 mov esi, [ebx]
.data:0067B535 mov [ebp+1ECh], esi
.data:0067B53B call search
.data:0067B540 stosd
.data:0067B541 add ebx, 4
.data:0067B544 cmp dword ptr [ebx], 0
.data:0067B547 jnz short finding_APIs
.data:0067B549 popa
.data:0067B54A retn
.data:0067B54B ; ---------------------------------------------------------------------------
.data:0067B54B
.data:0067B54B search: ; CODE XREF: .data:0067B53Bp
.data:0067B54B pusha
.data:0067B54C mov ebx, [ebp+17Dh]
.data:0067B552 mov ecx, [ebx+20h]
.data:0067B555 add ecx, edx
.data:0067B557
.data:0067B557 loc_0_67B557: ; CODE XREF: .data:0067B56Cj
.data:0067B557 mov esi, [ecx]
.data:0067B559 add esi, edx
.data:0067B55B call loc_0_67B58F
.data:0067B560 mov edi, 49CD75CEh
.data:0067B565 cmp eax, edi
.data:0067B567 jz short loc_0_67B56E
.data:0067B569 add ecx, 4
.data:0067B56C jmp short loc_0_67B557
crUsAdEr
05-29-2002, 12:51 PM
Hi there,

You got to do better with IDA :>... i mean if you wanna post some code here, gotto remove all the junk codes so that at least it looks clearer than this...

I think you are still at the beginning of AsPr heh :>... these looks like a few loops of decrypting the code in the last section of AsProtected program still, basically, it looks like this

mov eax, counter
call $5
pop edx
add edx, size
Decrypt_loop
mov ecx, [edx]
xor ecx, some_crap
add ecx, more_crap
sub ecx, arghh_crap
mov [edx], ecx
sub edx, 4
dec eax; decrease counter
jnz Decrypt_loop

The rest are just garbage code inserted in between to confuse you... this loop will be repeated about 4/5 times.

I cant remember where exactly it search for API address in kernel32.dll.. but basically, it start from beginning of file, check for "MZ" signature, the get offset of PE header, then get offset of Export Table, parse the Export ASCII list of kernel 32 till the Import wanted is found... not at home rite now to help you check out the stuff....

You have got to tell IDA not to show too much rubbish, if it's garbage, dont disassemble it... so it looks clearer...

Good luck
crUsAdEr
Risotto
05-29-2002, 10:12 PM
Hi, Crusader!

One more ques: how did you find or calculated the size of dll?

Thx
crUsAdEr
05-29-2002, 10:36 PM
Hi,

You can check VirtualAlloc size :>>... or just use winhex to see.. sice work as well... just scroll down till you see the ???.. that should be the end of the dll...

Keep up the good work :>.. if you still need, i can post the dll loading code here...

Regards,
crUsAdEr
Risotto
05-30-2002, 10:17 PM
Hello, Crusader!

Heh, i did it before i'd read you post and i did it by searching ???. In any why, thanks for help. I've dumped that dll, but one question more: why did you decide that it's DLL? As DLL is a mass of function, EXPORTED function, it should contain smth in export table while this dumped file doesn't have epxorts. What's the hell? Or what is this dll for then?

I've got a prob with unpacking ReGetDx. No, actually i've done everything all right, but when i run it, it goed to infinite loop and no nag screen or whatever is seen. I've already read some threads on this board, but i found nothing appropriate. What can it be?

PS: don't mock at me:), i just try to understand and that's it and thanks for help once more

Good luck, R!50770
crUsAdEr
05-30-2002, 10:40 PM
Hi :>

Nice job dumping the dll.. well after i dump it and rebuild the PE header with imports, IDA says LIBRARY START or something like that at OEP... so i reckon it is a dll :>>.. but it's not that important i guess....

Yeah, trace the dll once and for all, you'll have a full understanding on how AsProtect works... pretty same as other packers and you will learn how to bypass IAT mangling etc... very nice to reversed cos the code is fairly clean... and tidy, only obfuscation compare to some otehr packers which has lots of compiler generated junk codes...

Have fun
crUsAdEr

P.S : i dont laugh at ppl :>, only smile and grinz as you see (at least i hope i dont :>)... and it's nothing to make mistake and get laughed off, you learn from your mistake :D .. so no worry, being a newbie is nothing to be ashame about... stop learning is somethign to be... okie enuff philosophical crap.. back to integration :D


A Classic LaZaRuS / +Sandman Cracking-Challenge Forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A Classic LaZaRuS / +Sandman Cracking-Challenge Forum
PDA

View Full Version : A Classic LaZaRuS / +Sandman Cracking-Challenge Forum

Kayaker
05-23-2002, 10:58 PM
Greetings all,

I dusted off an old .chm file of what it used to be like in the old days. This is an example of an excellent project that defines the cooperation and contribution that could be expended into creating a good project. Forum Project #7, a history lesson for the Newbies. There is much to be learned in the HUNDREDS of threads of discussion and DOZENS of different people contributing all to one project.

Pretty well unheard of in these parts in the last 2 years, this dying breed, Projectlactosaurus exempathicus, seems destined never to make a comeback. Suffering instead from greenhouse emissions or el Nina effects on this board which has affected people in such a way that this kind of interest and dedication is just not generated any more. Evolution plays cruel tricks.

In the hopes of a marginal recovery of the species, I present this rare fossil find for your enjoyment and edification. I take liberty of the boards data capacity and up the 534Kb file here.

Enjoy.

Kayaker
Eustace
05-23-2002, 11:22 PM
Thanx for posting Kayaker :)
Some interresting reading
The Svin
05-27-2002, 11:37 AM
I'm not able to download files referred in the chm
Kayaker
05-27-2002, 05:01 PM
Originally posted by The Svin
I'm not able to download files referred in the chm

It's 2 years old, so no, probably not ;-) This was more for reading entertainment than anything else...

Kayaker
The Svin
05-27-2002, 09:24 PM
It would entertain more if I could see what what pragramm they all were talking about. ;)
Otherwise the only thing you can get from it is how to change font in WDASM and such :)


hypercomplex numbers and RSA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > hypercomplex numbers and RSA
PDA

View Full Version : hypercomplex numbers and RSA

mike
05-24-2002, 12:32 AM
Thought some of you might enjoy this. It's a comparison of the hypercomplex numbers (a 4-dimensional generalization of complex numbers that isn't quaternions) and Z_n, the ring of integers modulo n, where n = pq, p,q distinct primes. Since Z_n is where RSA does its magic, I deemed it appropriate for this forum. Besides, what's the point of being the moderator if you can't plug your own stuff? :D

http://home.datawest.net/staym/hypercomplex-rsa.html


activx ocx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > activx ocx
PDA

View Full Version : activx ocx

slash
05-25-2002, 09:17 AM
Hi,

I'm pretty new at this stuff, but then again, this is for newbiez. I think I have all necessary tools, I know a good deal about programming asm included, but still. BTW : I was sent here with the compliments of "The Blackbird".

OK, to the problem :

I'm trying to reverse an activx (ocx) that is preparing all of it's parameters (including the serial) using javascript (it's building up some kind of a class). Is there a way I can find out how and where the OCX gets and stores these parameters, so that I can set some kind of breakpoint in softice when it tries to reach for the serial-parameter ? I have already tried to disassemble it with w32 disassembler, but that does not seems to be correct...

In the evaluation serial, a time limit is inserted as well, but when I set a breakpoint to the api "getsystemtime or getlocaltime", it breaks about a million times. Perhaps there is an api I can watch for, that parses the hostname ?

Well, this is a long shot, but BlackB said that I'm at the right place, so...
Solomon
05-25-2002, 09:45 AM
Use ExeScope or similar tools to examine the COM interface of your ActiveX DLL. They will give readable description of the interface.

Please also refer to this:
http://www.woodmann.net/forum/showthread.php?s=&threadid=1430
zacdac
05-25-2002, 02:00 PM
G'day..

In my experience, it is easier to reverse ocx controls in a development tool.

Use an api/ole tracer such as smartcheck on the development tool that supports the ocx (such as the visual basic ide).

Ocx controls make an IClassFactory::CreateInstance call (OLE call)when they are initialised for the first time (note subsequent calls are cached so it is wise to restart the tracing each time you wish to test something) within the development environment. 90% of ocx controls place their license testing within that call.

Smartcheck will show you the api calls used within that call and the memory locations they were called from within the ocx control.
It also shows you the parameters values passed to the api calls.

With this knowledge you can then set a breakpoint on these api calls, a breakpoint within the ocx or you may also set a breakpoint on the development tool (in this case VB6.exe) at the point it calls the IClassFactory::CreateInstance call. (This is the same spot each time within the vb6 executable)

I have also found it is often easier to use OllyDbg rather than SoftIce (note again 90% of ocx controls are poorly protected) to trace the code.

Note the above is for OCX controls, not COM components.
COM components are initialised a slightly different way.

Hope that helps.

ZD
slash
06-02-2002, 06:20 PM
Thx for the replies,

what have tried this far :

I have tried to start IEXPLORE.EXE withing smartcheck. It launches, I go to the page with the activeX and smartcheck does show some events. I see that it does some stuff using instr, mid, left, right functions, etc with the serial (contains hostname + a bunch of numbers). Further I can't see that much. The Activx doesn't seem to completely load as well when I launch it in smartcheck, It stops on a CallWindowProcA. When I try to break, using softice on CallWindowProcA (what I had tried before), it breaks about every 1 ms.

Do I have to try to debug with smartcheck withing VB6 ? The ActiveX gives a nagscreen, maybe I can do st with that ? Or is softIce not to be used with activeX ?

thx
slash
06-02-2002, 07:49 PM
Hi there again,

I have played a bit more with smartcheck, and it helped toggling on/off a few times with "view reporting". Suddenly the Activx stopped pushing my CPU to 100% and proceeded to showing the nag-screen. After browsing through the events, I saw what appeared as checking the serial. I could suddenly see a variable containing a bunch of numbers what looked as a serial. I thought, what the hell, let's give it a try...

And whoohoo, I have cracked my first ActiveX !

Thanx to zacdac !


Newbie's Q. about Winsock detail
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Newbie's Q. about Winsock detail
PDA

View Full Version : Newbie's Q. about Winsock detail

O. Visidor
05-25-2002, 03:55 PM
Hi Reversers !

Well, trying to learn a bit about socket programming here.
Could a Win32/Winsock/Wininet guru could give me a hint ?

- Is zero (0) ever assigned as a (per process) socket handle ?
-Wwhat are the specified/practical effects of a call to recv ( resp. send ) using a number which is not (or not yet) an assigned socket handle number for this process ? Is the call supposed to return an error, or does it try to send ( receive) blindly, to a non existent socket ?
- If the answer to either question dependent on the Win32 / Winsock/ Wsock2/ implementations ? How ?

Another question : are the Wininet.dll functions documented and where can I find that doc ?

TIA
--
O.V.
foxthree
05-25-2002, 07:41 PM
First, let me answer your questions:

(1) I don't think so. Sockets are always non-zero numbers as far as I've seen
(2) If you attempt to send data via a socket that is not recognized by the system, you're sure to get the error ("Attempting to perform an operation on something that is not a socket" or something similar)

Windows Sockets has always been a "schizophrenic" implementation of the Sockets specification. Microsoft has never really implemented the *complete*sockect specficiation until Win2K or later. So, if the above questions are what I guess, "true" raw socket support is available only on systems >= Win2K (not even NT). [Yes, Winsock 2.0 provides raw sockets by only for ICMP]

There are a couple of libraries that allow you to do "raw" sockets under other Win* platforms.

Also, WinINET APIs are completely documented in MSDN. Look for it :)

If you need any further information, drop a line.

Signed,
-- FoxThree
O. Visidor
05-27-2002, 11:28 AM
Thanks for the cool answer, FoxThree !

Nope, I was not investigating in "raw sockets". The rationale behind my questions was, trying to find out why the "tini.exe" miniserver app (who said: trojan ?;) by A. Vidstrom works well on my win 98 B but crashes the Win 95 B box (with winsock 2 and other updates) .

A quick look at a disassembly showed it is a simple 3-threaded server that unfortunately takes zero step to check for winsock ( or other ) errors ( and also does not care to clean behind itself ...) Well maybe the real wonder is it DOES seem to work under Win 98 ( and NT + ? ) but under Win 95 it fails, and I thought it might be because it starts its sending/receiving threads without waiting for a connection established or confirmed, thus using that invalid socket "zero". Just a guess from dead listing however.
I wondered if the Winsock2 for 95 could behave different from its 98 counterpart.

thanks again, I'll do a search for that Wininet material some other day too.

--
O. V.


Different of int 2Eh int 2Fh between W2k and Nt 4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Different of int 2Eh int 2Fh between W2k and Nt 4
PDA

View Full Version : Different of int 2Eh int 2Fh between W2k and Nt 4

The Svin
05-25-2002, 08:58 PM
Have anybody knowlege if there is some subj?
I mean not realization but meaning (purpose) of corresponding numbers of the functions in the two ints?
Can be compared manually but maybe if somebody already has partial info it could save some time for me.


Where is the application code in XP ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where is the application code in XP ?
PDA

View Full Version : Where is the application code in XP ?

The SharK
05-25-2002, 10:46 PM
I just wonder....

When you debug in Windows 98 it's easy to get into the program you want to debug, but when I want to debug in Windows XP I can't seem to find the applications code ?
Is it because there is a lot more features in Windows XP ? :)
_Servil_
05-25-2002, 11:08 PM
mayB it's due to apps under XP don't use code ;))
The Svin
05-25-2002, 11:15 PM
I can't seem to find the applications code ?
Find where?
The SharK
05-25-2002, 11:38 PM
I mean, I can't seem to follow the code from the beginning to the end, as with Windows 98.
_Servil_
05-26-2002, 12:19 AM
you ever traced program from start to end?
congratz ;) ;)

what du you call 'follow the code'?
The SharK
05-26-2002, 12:32 AM
Off cause, all the time....:D

For small programs it's a good thing to see things from
the start !
But for BIG programs it's of course not worth the effort.
Nevertheless I think I have found a way to get around the
problem. It has something to do with how you break
into the program !!!:D
The Svin
05-26-2002, 08:19 PM
I mean, I can't seem to follow the code from the beginning to the end

Do you mean tracing in a debugger?
If yes - what debugger do you use?
The SharK
05-27-2002, 08:06 AM
I use SoftIce. And yes it's when I trace through the program.
But as I mentioned, I have found a way to work around this
problem, it's just that in windows 98 you can breake on
GetWindowTextA, and from here you can easily get to the
programs code (the one you wan't to debug).
But in windows XP when you trace through the program and
you use F10 to step over some calls, the program you debug
suddenly runs !

I guess one have to trace into "all" the calls to get to the code...:p
[yAtEs]
05-27-2002, 10:41 AM
Originally posted by The SharK
in windows XP when you trace through the program and
you use F10 to step over some calls, the program you debug
suddenly runs !

I guess one have to trace into "all" the calls to get to the code...:p

An explanation for this can be found here:
http://www.woodmann.net/forum/showthread.php?s=&threadid=2948&highlight=SYSENTER


Little VC/PE help ;P
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Little VC/PE help ;P
PDA

View Full Version : Little VC/PE help ;P

Bengaly
05-26-2002, 08:41 PM
heya all,
recently i started coded alittle PE viewer (mini project) - probably for fun and knowledge in Visual-C++ (v6). / PE
i am now dealing with the Section header, so i want to read
the Section's names and nfo.
though i dont really know how to read the section nfo..
i have started this code so far:

for(i=0;i<file_header.NumberOfSections;i++)
{
// reading section's name/nfo and put into list box
SendDlgItemMessage(hWnd,IDC_SEC,LB_ADDSTRING, 0,(LPARAM));
}

i have deal with the other headers already, only this little prob
hope any1 knows how too,
if not np ;)
cya all
foxthree
05-26-2002, 09:14 PM
Hi Bengaly:

Look into Pietreks' PEDump source... It has whatever you need and more. Can be found in MSDN.

Signed,
-- FoxThree
ZaiRoN
05-26-2002, 09:15 PM
hi Bengaly,
there is a tutorial on Iczelion site that could help you.
here is the link:
http://spiff.tripnet.se/~iczelion/pe-tut5.html

hope this helps...

ZaiRoN
Bengaly
05-26-2002, 09:54 PM
thnx for info fox3 / zairon,
i shall keep looking for more stuff..(examples)

i uploaded the "so far" pe viewer just to see if u think i shall add/remove stuff, or any bad/good commets.
greets
Ben
ZaiRoN
05-26-2002, 10:57 PM
hi Bengaly...
your proggie is really nice! :)

>just to see if u think i shall add...
what else? there are all the informations about a file.
just a little thing: disable buttons if no file is loaded.
now, you have to complete the proggie with the section's info, good work!

bye
ZaiRoN

ps. what 'play' and 'stop' stands for?
Bengaly
05-26-2002, 11:08 PM
thnx zairon.
i will look at icezelion's pe examples hopefully to convet to C
and um..Play/Stop buttons hehe are for playing / stoping the music stored in the app ;)
it just stuck there from previous stuff ;P
now u have pe viewer and a jokebox ;D
cya all ;) :p
ZaiRoN
05-27-2002, 02:23 PM
a jukebox...lol :D
>...hopefully to convet to C..
no need to translate; you can do it in asm using __asm directive.
if you have problems...make a whistle.

bye
ZaiRoN


New Matt Pietrek PE File Format Article
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New Matt Pietrek PE File Format Article
PDA

View Full Version : New Matt Pietrek PE File Format Article

JMI
05-26-2002, 09:51 PM
In my wanderings around the Reversing Community I came across a new Matt Pietrek article titled "An In-Depth Look into the Win32 Portable Executable File Format" with code samples. Anyone interested will find it at :

hxxp://msdn.microsoft.com/msdnmag/issues/02/02/PE/PE.asp

Printer friendly version can be found here:

hxxp://msdn.microsoft.com/msdnmag/issues/02/02/PE/print.asp

Download for the Code from the article is found at the top of either form of the article.

Part II of the article can be found here:

hxxp://www.msdn.microsoft.com/msdnmag/issues/02/03/PE2/PE2.asp

Recommended reading for those interested in unpacking and the PE file format issues this may raise.

Regards.


8 bit CPU cipher
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > 8 bit CPU cipher
PDA

View Full Version : 8 bit CPU cipher

dion
05-27-2002, 03:26 AM
i want to make a dongle like protection with 8 bit CPU (which also known as smart card CPUs), with 8K ROM and 256 bytes RAM.

it gonna encrypt a file with a key. the cipher kind come to my mind is block cipher. i've read the new AES candidate paper. and those who suitable with that spec are:

Crypton, DEAL, DFC, Magenta, Mars, RC6, Rijndael, SAFER+, Serpent, and Twofish.

could anyone tell me which one of these is the best to implement and for security ?
mike
05-28-2002, 08:59 PM
Those were the ones submitted as candidates; Serpent, Twofish, Rijndael, RC6, and MARS amde it to the final round. Some pretty hefty attacks were levied against RC6 and MARS. Rijndael won, and since it's byte-based, it works well on 8-bit processors. It's very easy to understand; I'd suggest you use that one.

You should be aware of attacks against smartcard chips, like power analysis, and fault analysis. How is the system going to be used?
dion
05-29-2002, 04:25 AM
the system is dongle like, it transfer an encrypted file purchased, and there's timestamp too, if needed. about power/some else analysis, i'm not look at those thing yet.

yeah, after search and read some, the winner is Rijndael, and i read from somewhere that it has 8051 implementation, which is an 8 bit cheap microprosesor. but i couldn't find it. Could u tell me where's the good resource for this thing, Mike ?
mike
05-29-2002, 04:18 PM
You can write the author at vincent.rijmen@esat.kuleuven.ac.be or post on sci.crypt.
dion
05-30-2002, 10:01 AM
thanks... i waiting for reply now.
and how about the security problem, Mike ?
there's several cryptanalysis out there about rijndael. do i have to take care of it ?
mike
05-30-2002, 02:02 PM
Right now (as far as I know) the paper I co-wrote as part of the extended Twofish team is still the best attack against rijndael. It does not come close to breaking it.
dion
06-01-2002, 03:24 AM
now on reading rijndael algo...
the preliminary math is finite field GF(2^8). but, sadly, i don't know much about it. could you tell me where's the good resource to learn this thing ?

and meanwhile, i'll be off for a week, just for a moment, while still reading rijndael aes proposal.
mike
06-01-2002, 06:17 PM
GF(2^8) is a field; that is, you can do addition & multiplication, and every element except zero has a multiplicative inverse. That is, for every element x except zero, there's an element y such that x*y=1.

GF(p^n) behaves like polynomials of order (n-1) with integer coefficients mod p. So in this case, addition acts like XOR. The polynomials are also taken mod a "primitive polynomial". I won't give the defenition here; if you're interested, I'm sure you can find it somewhere on the web.

So for example, say our primitive polynomial is x^4-x-1.

Starting with 1 and multiplying by x, we get

1 = 1
x = 2
x^2 = 4
x^3 = 8

and then we get to x^4. We take x^4 modulo x^4-x-1 and get x+1. Then we multiply by x again until we get an x^4 term:

x^4 = x+1 = 3
x^5 = x^2+x = 6
x^6 = x^3+x^2 = 12

and then we get to x^4+x^3. We take x^4 modulo x^4-x-1 and get x+1. Then we multiply by x again until we get an x^4 term:

x^7 = x^3+x+1 = 11

and then we get to x^4+x^2+x. We take x^4 modulo x^4-x-1 and get x+1. Then we multiply by x again until we get an x^4 term:

x^8 = x^2+2x+1 = x^2+1 mod 2 = 5
x^9 = x^3+x = 10

and then we get to x^4+x^2. We take x^4 modulo x^4-x-1 and get x+1. Then we multiply by x again until we get an x^4 term:

x^10 = x^2+x+1 = 7
x^11 = x^3+x^2+x = 14

and then we get to x^4+x^3+x^2. We take x^4 modulo x^4-x-1 and get x+1. Then we multiply by x again until we get an x^4 term:

x^12 = x^3+x^2+x+1 = 15

and then we get to x^4+x^3+x^2+x. We take x^4 modulo x^4-x-1 and get x+1. Then we multiply by x again until we get an x^4 term:

x^13 = x^3+x^2+2x+1 = x^3+x^2+1 mod 2 = 13

and then we get to x^4+x^3+x. We take x^4 modulo x^4-x-1 and get x+1. Then we multiply by x again until we get an x^4 term:

x^14 = x^3+2x+1 = x^3+1 mod 2 = 9

and then we get to x^4+x. We take x^4 modulo x^4-x-1 and get x+1. Then we multiply by x again until we get an x^4 term:

x^15 = 2x+1 = 1

which is where we started.

We can do this whole thing easier by shifting left one bit and if the carry bit (bit 4 in this case) is set, XOR with 3. Notice that we got every number between 1 and 15 and that x^15 = 1.

So, for example, x^13*x^2 = 1 = 13*4. So 13 and 4 are inverses in GF(16).

Hope that quick review helps.
dion
06-15-2002, 08:23 AM
welcome back again.
Hi, Mike, thanks for that review, if i'm not wrong, you're trying to figure out how primitive polynomial in GF(2^8) works. that's good, but i had it mine now. hmm... is that true that multiplicative inverses can be calculated with bit shift in 4 bit form ? is it not in 8 bit form ?

i've read whole proposal, but can't take it at once. and well, the real source code for 8 bit processor is in C language, and implemented by C51 software simulator. but, i think it won't help me to learn the algo more than assembly language in 8051. is there anyone has implement it in assembly 51?
mike
06-16-2002, 12:38 AM
I was illustrating gf(16) modulo x^4-x-1. You would be using gf(2^8) modulo something else (doesn't really matter what, since they're all related by linear transformations).

Rijndael goes like this

key xor
sbox
shift
mix

repeated 16x and one more key xor.

Sbox replaces every byte x by s(x). Shift moves bytes around on a row. Mix is a matrix multiplication in GF(2^8).
dion
06-17-2002, 03:45 AM
author said that he choose a polynom such that it has inverse form. umm... how can one determine such polynom has an inverse, and how to do the calculation ?
mike
06-17-2002, 04:55 PM
The polynomial has to be primitive in the field. For example, with 5 bits, taking the polynomials modulo x+1 doesn't give rise to a field--2 isn't a generator. There's no number y such that 7=2^y, for example.

I don't know offhand what the algorithm is to find primitive polynomials, but there are tables of them for small integers.

As far as I know, they just chose the first one they found for 8 bits out of a table that used some standard ordering.

All of this is irrelevant for implementation issues. It's only useful if you're going to be cryptanalyzing it. (By all means, do!)

The C reference implementation is very readable. I recommend that you look it over.

Did you know about aes.nist.gov that has everything anyone has ever written about AES?
dion
06-18-2002, 03:48 AM
i've read the C source code, and i've download all paper about rijndael from nist. alas, as far as i know, the C51 code is little diff from conventional C code, but i don't see that in their C source code.

hmm.. so there's a table. and yep! i am willing to cryptanalyze it! but i'm lake understanding in this field, so that i'm asking in this forum.

honestly, i still don't fully understood your exp about primitive polynom, Mike. but, the means of all is there's an inverse form. by now i'm trying to explore this. is the heart of this polynom is somekind of modulo ?
mike
06-18-2002, 03:05 PM
First go find a good intro to number theory that talks about finite fields. These are also known as Galois (pronounced "gal-wah")fields, thus the GF(.) notation.

A field has commutatitive multiplication and addition defined, and every element except zero has a multiplicative inverse. I think that's what they were talking about when they mentioned inverses. The s-box is written concisely as inv(x) XOR 99h, where inv(0)=0.

The key XOR step is just addition in GF(256)
The sbox is inverse followed by addition
the shift is just moving bytes around
the mix is matrix multiplication

You already know all these concepts except how they work in gf(256), so go find a tutorial on it.

If things look a little different in different implementations, it's because they've implemented different optimizations. There's a whole section on them in the NIST proposal.
dion
06-19-2002, 03:15 AM
umm... could you recommend me one of them, i mean good intro to finite field.
mike
06-19-2002, 04:57 PM
If you're really serious about understanding it, I'd recommend a book:

Neil Koblitz, A Course in Number Theory and Cryptography, Graduate Texts in Math. No. 114, Springer-Verlag, New York, 1987. Second edition, 1994.

If you're just trying to implement it, all you need to know is how to multiply and add.

Since something like 13*a can be written

(8 + 4 + 1)*a = 8*a + 4*a + 1*a,

you only need to know how to multiply by powers of two and how to add. Adding is just xor. a+b -> a XOR b

Multiplying by two is left shift followed by an xor if the carry bit is set. In the case of Rijndael, they use the primitive polynomial

x^8+x^4+x^3+x+1, or 11Bh

So if you left shift your number and it's bigger than 255, you xor 0x11B with it. For example (all numbers in hex):

2 * 49 = (49<<1) = 92

2 * C3 = (C3<<1) = 186 -- bigger than 255, so xor with 11B
186 XOR 11B = 9D, so 2*C3 = 9D

3 * C3 = 2*C3 XOR 1*C3 = 9D XOR C3 = 5E

Some reference code I've seen uses log tables and power tables. These work exactly the way you'd expect them to.

a*b = 2^( log_2(a) + log_2(b) )

Since each number in GF(2^n) is also a power of 2, you can calculate a table of logs and powers to speed things up.

Good luck!
dion
06-20-2002, 03:24 AM
Thanks, Mike. Trying to seek that book now, and i think i've to end this useless question right now and begin to dive into deeper part.


file system error 31
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > file system error 31
PDA

View Full Version : file system error 31

kalisto
05-27-2002, 09:17 AM
Hi everybody
I tried to unpack one program packed with asprotect 1.12, and I think everything is unpacked properly (OEP, rebuilding all imports) but after trying to execute program I received
file system error 31. I tried find on google what is that error but nothing relevant so if somebody knows what is going on please inform me. If anybody interesting in that problem I can mail file (about 1 MB).
Thanks
I am running Win ME, and interesting is OllyDbg report on packed file "bad or unknown format of 32 bit executable"
Kilby
05-27-2002, 09:34 AM
The first thing to do is to look in your dumped .exe and check to see if that string appears ?

It may be doing an elcomsoft style protection check, basically an error is flagged if the asprotect protectionis missing.

Kilby...
foxthree
05-27-2002, 09:42 AM
Share with us the target, please :)

Signed,
-- FoxThree
kalisto
05-28-2002, 06:48 AM
Hi all
This is URL of target. My version is 3.0 but newest version is 3.01.
h**p://***.crystaloffice.com/clbplus.zip
Enjoy
foxthree
05-28-2002, 06:17 PM
I tried 3.01 and it is pretty ordinary. Unpacked and seems to run fine. However, there is a small point to be noted. If you use RV/ImpRec default size for IAT, you'll get only Kernel32.dll exports. This is a "strain" of ASPR that puts lots of 00 into the IAT fooling reconstructors. Try a length of multiple of 1000.

If you just put Kernel32.dll exports, that may lead to the error you've seen.

Look into the IAT using SoftICE and you'll see what I mean ;).

Signed,
-- FoxThree
The Svin
05-28-2002, 07:55 PM
I tried find on google what is that
Some years ago I coded a simple utility to get error code description. It's actually clone of Jeffry app but 12 times shorter in size.
You can type error code inside the dlg, or run it with error code as command line argument.
App is one instance app, if you run new instance it passes command line arg (if any) to previous instance and unload itself.
Nothing special, just a little tool for quick error codes description look up.
kalisto
05-29-2002, 07:32 AM
Hi foxtree, I notice that default options in RV is short and I enlarge it. This i my resolved imports. Check it and compare with your. Maybe there is a difference.
Thanks Svin for utility.
foxthree
05-29-2002, 06:59 PM
Your imports are wrong. Your IAT seems to have been fooled by the standard ASPR tricks.

Looking at your addresses, you've resolved either on Win2K/WinMe. Try RV's ASPR Plugin. That would help you. Otherwise, go into SoftICE and bpmb 001E043C etc.. and you'll see what I mean.

Signed,
-- FoxThree
kalisto
05-30-2002, 10:43 AM
Hi foxthree, I realy don't know what is wrong. This is unresolved imports after RV run.
38 001E0430 0142E964 0000 ?????? (my solution is getversion)
41 001E043C 0142E944 0000 ?????? getmodulehandlea
43 001E0444 0142E938 0000 ?????? getversion
62 001E0490 0142E8E4 0000 ?????? getmodulehandlea
65 001E049C 0142E494 0000 ?????? getprocaddress
78 001E04D0 0142E900 0000 ?????? getmodulehandlea
106 001E0540 0142E954 0000 ?????? getcurrentprocess
So this is what I think is good.
example: u 142E964
DS:005E0430=0142E964

018F:0142E964 55 PUSH EBP
018F:0142E965 8BEC MOV EBP,ESP
018F:0142E967 E86467FFFF CALL KERNEL32 GetVersion
018F:0142E96C 5D POP EBP
018F:0142E96D C20400 RET 0004
I did other unresolved same way ,generate .bin file and paste at the end of last section, and then error 31...
Can you upload your IAT for compare with my IAT. Please explain me what is wrong.
BTW is OEP = 401000 ??
crUsAdEr
05-30-2002, 01:18 PM
I think the last one is FreeResource
kalisto
05-30-2002, 02:47 PM
Hey crUsAdEr how you figure out the last one is FreeResource. This one ?
106 001E0540 0142E954 0000 ?????? :confused:
nikolatesla20
05-30-2002, 08:45 PM
Well the funny nice trick Revirigin does for you is alphabetize the imports. Almost all a program's imports will be in alphabetical order, it isn't very often that they are not, in a real program. A protected program will have some that are out of order of course just to throw you.

Anyway, you can guess it is FreeResource in two ways:

1. It's in the right spot for the alphabetic order

2. The routine does nothing. This is exactly what FreeResource now does in Win32. Nothing. It doesn't even need to be called. Notice that RET 0004? This removes the unused GetVersion return value from the stack.

Also, after you have unpacked enough apps, you will become familiar with the functions that are commonly not resolved. Try using a program you have already unpacked and compare their IAT tables to see if you can fill in the blanks.

Also, you have quite a few GetModuleHandleA resolves, which is very fishy. I think you are being tricked. You might want to walk through each of them in SI just to be sure where they REALLY go ! I ran into major problems with a certain app once when I used SI under Win98 and then tried running the program in Win2K, a LOT of the Unicode functions did not get resolved properly. I had to walk through about 10 of them manually to make sure of what they were.

Remember the best tool to use is your brain and some creativity !

-nt20
kalisto
05-31-2002, 05:20 PM
Hi all, with help of nikolatesla20 (API alphabetical order) I fill this:
38 001E0430 0142E964 0000 ?????? FreeResource
41 001E043C 0142E944 0000 ?????? getcommandlinea
43 001E0444 0142E938 0000 ?????? getcurrentprocess
62 001E0490 0142E8E4 0000 ?????? getmodulehandlea
65 001E049C 0142E494 0000 ?????? getprocaddress
78 001E04D0 0142E900 0000 ?????? getversion
106 001E0540 0142E954 0000 ?????? I dont know what is here
Now I dont receive error 31 but program still cannot run. What is wrong now?
crUsAdEr
05-31-2002, 05:36 PM
try LockResource for the last one???

You should read SplAj's commview and Awave tutorial.. also, try to see wat the emulated API is doing... see what is passed to eax as the results...

Also, disassemble the system dll and look at those API code... will help greatly to understand why they are so...
foxthree
05-31-2002, 06:04 PM
And it is not GetCurrentProcess but GetCurrentProcessID ;)

Signed,
-- FoxThree
kalisto
06-01-2002, 09:01 AM
Hi all, I fill everything what you guys said but damn clipplus won't work. This is really frustrating so please upload working resolved.txt or I will kill computer or better watch football. Maybe it is easy.:D :confused: :rolleyes:


help on HASP PCS
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help on HASP PCS
PDA

View Full Version : help on HASP PCS

haec_est
05-27-2002, 10:27 AM
Hi, i have a little problem with a proggy that use a hasp4 m1 key; is turned out
that it use PCS, so in the image i found where the PCS_Masterlist is located :

:s 400000 L ffffffff "SCP@PSAH"
Pattern found at 001B:0088627B (0048627B)

0023:0088627A 40 53 43 50 40 50 53 41-48 40 00 00 00 00 00 00 @SCP@PSAH@......
0023:0088628A 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0023:0088629A 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0023:008862AA 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0023:008862BA 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0023:008862CA 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0023:008862DA 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0023:008862EA 0A 00 23 00 66 83 BD FF-01 00 00 28 75 01 C3 66 ..#.f......(u..f
0023:008862FA FF B5 FF 01 00 00 66 FF-B5 D1 01 00 00 66 FF B5 ......f......f..
0023:0088630A 60 02 00 00 66 FF B5 62-02 00 00 66 FF B5 9B 02 `...f..b...f....
0023:0088631A 00 00 66 FF B5 FA 01 00-00 FF B5 22 0D 00 00 1E ..f........"....
0023:0088632A 06 57 56 52 51 53 50 66-8B 85 01 0D 00 00 66 89 .WVRQSPf......f.
...

but when i searched for the PCS structures i found no _PCSPattern on the image,
nor in the loaded PE :

:s 400000 L ffffffff "$HASP$PCS$"
Pattern found at 001B:8162A583 (8122A583) <-- mirror of search string

then i bpmw on word following PCS_Masterlist signature (num of pcs struct.)
to see if it was filled at runtime but it was always 0x0000.

So i compiled a PCS demo that was available at hasp site (some month ago), and i
searched for the pattern "$HASP$PCS$", it was there, nothing strange.

Next i compared 0x500 bytes from the proggy and the demo, starting at PCS
masterlist signature, and winhex said:

"Search for differences

1. pcs.dat: 1,280 bytes
2. pcs_demo.dat: 1,280 bytes

AB: 22 1C
...
868 difference(s) found."

thus the first 0xAA bytes are the same, and the others looks very similar,
(kindly a newer version of PCS).

Now i'm a little bit confused... can anyone tellme what's going on ???

May be programmers forgot to put PCS structures in the file or
it is a PCS upgrade ? And so, where i soulhd look to find PCS structures ?

thanks in advance,

ps: sorry for my bad english
haec_est
05-29-2002, 07:04 AM
...the problem was simple, the PCS structures there are, but was encrypted
with a mundane xor algo.

they encrypt a portion of data where they put PCS structures and
a second copy of _haspreg, then at runtime, decrypt the PCS sctuctures and
directly call the second copy of _haspreg (the one unencrypted was only a
service 1 ckech) and re-encrypted after the call has gone...

not so hard :)

i found it when i forgot to disable a bpm !!! sometime the mayor problem
is that i don't think :)

i'm sorry for my stupid previous post :)

regards,


I need you help ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I need you help ;-)
PDA

View Full Version : I need you help ;-)

Tsunami
05-27-2002, 07:25 PM
I am looking for a tool to unpack a dll which is obviously packed with aspack 2.12 (maybe asprotect too?) or someone who can give me a step by step guidance to unpack it manually.

Greetings
Tsunami
Risotto
05-27-2002, 10:37 PM
Salute!

In general a DLL-file can be unpacked this way: you should run the very prog which cares about this DLL and thus it'll be loaded into memory. Then open the process you've just initialized with PEditor/LordPE/ProcDump/etc. and look at the list box named "Module Name" - there you'll see the DLL. What should be done now? Just dump it and make some amendments. It's in general terms.
Woodmann
05-27-2002, 10:58 PM
If this shit keeps up I am going to just delete every request
that can be answered in the FAQ or through searching the message board.

1) This was posted in the wrong forum.

2) Someone didnt read the FAQ. Had they read it they would
would have seen that this whole thing could have been avoided.

3) I am losing my patience for these people who have made NO attempt to find some information on their own.

This is it. From now on I will just delete the thread. No exceptions.
Tsunami
05-27-2002, 11:53 PM
@ Risotto :
thanks for your help, I will try this

@ Woodman :
FAQ ? What FAQ ? The Board-FAQ ?
I don't want to know anything about cookies and the other (zensored) things.
Wrong Forum ? Why ?
REVERSE ENGINEERING is (IS) the right Forum !
Where should I post it ?
Please tell me, because I don't know.

> Had they read it they would

they ? she ? it ? I'M a man, come on !

> I am losing my patience for these people who have made NO attempt to find some information on their own.

NO ATTEMPT ?
I spend several hours to get informations in many forums and, websites etc. but the tools and tips doesn't work, so I just postet a question in your board (I think that's what boards are for).

Please be patient with some newbies (me, no not really).
Also I have some experiences I have much to learn, I think everybody has, too.

nevertheless, thank you
Tsunami

P.S. 1 : I think that Woodman is a Pro, but that doesn't mean that everyone is a Pro, too and that 'lame' questions aren't allowed.
If there is an 'easy' way to unpack, than tell me.
Why fail the generic unpackers if it is such an easy task ?

P.S. 2 : I am a moderator of another forum and I feel with you (newbies are stressful). Maybe I broke some rules, but it is your job to straighten this out and not to blame anyone (it's hard, I know that from experience).

P.S. 3 : don't delete anything, because it doesn't solve the problem itself

Edit 1 :
I have done a search and found this :
http://www.woodmann.net/forum/showthread.php?s=&threadid=2707&highlight=aspack

The Quest goes on ;-)
I am really willing to learn, but I am lazy, too

If you know what to do it is really simple, but if you don't it seems like an impossible mission.
esther
05-28-2002, 01:56 AM
@ Woodman :
FAQ ? What FAQ ? The Board-FAQ ?
I don't want to know anything about cookies and the other (zensored) things.
Wrong Forum ? Why ?
REVERSE ENGINEERING is (IS) the right Forum !
Where should I post it ?
Please tell me, because I don't know.

>>yeah wrong forum

> Had they read it they would

they ? she ? it ? I'M a man, come on !

>>buzz off!!!

> I am losing my patience for these people who have made NO attempt to find some information on their own.

NO ATTEMPT ?
I spend several hours to get informations in many forums and, websites etc. but the tools and tips doesn't work, so I just postet a question in your board (I think that's what boards are for).
>>post all info you have tried and where you stuck!!!!!!!!!!!!!!

Please be patient with some newbies (me, no not really).
Also I have some experiences I have much to learn, I think everybody has, too.

>>We are patience too those really do their homework before posting it here !!!

P.S. 1 : I think that Woodman is a Pro, but that doesn't mean that everyone is a Pro, too and that 'lame' questions aren't allowed.
If there is an 'easy' way to unpack, than tell me.
Why fail the generic unpackers if it is such an easy task ?

>>well its not easy give up and buzz off!!!

P.S. 2 : I am a moderator of another forum and I feel with you (newbies are stressful). Maybe I broke some rules, but it is your job to straighten this out and not to blame anyone (it's hard, I know that from experience).

P.S. 3 : don't delete anything, because it doesn't solve the problem itself
>>SO what !

Edit 1 :
I have done a search and found this :
http://www.woodmann.net/forum/showthread.php?s=&threadid=2707&highlight=aspack

The Quest goes on ;-)
I am really willing to learn, but I am lazy, too

If you know what to do it is really simple, but if you don't it seems like an impossible mission.

>>lazy===lamers!!!


AntiCrack.de Site - Search Here (link now posted below, bye bye sticky)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AntiCrack.de Site - Search Here (link now posted below, bye bye sticky)
PDA

View Full Version : AntiCrack.de Site - Search Here (link now posted below, bye bye sticky)

Kayaker
05-27-2002, 11:48 PM
Greetings all,

This is a website which should be on the top of everybodys daily RE reading list. It has everything there,

- the best of the tutorials over the years, a good many collected from here, and all nicely categorized under Topics. No need to go searching for tutorials any more

- all the latest tools, including the most recent ones announced on this board

- headlines and weblinks to RE and programming news

- and a search engine!

This is the site you should refer to first to search for a solution to a problem that you don't already find on this boards Search engine. It has quite likely already been answered, and the effort to search for the answer will only gain you more knowledge than if you simply asked the question outright without trying to do some background research.

I highly recommend this site just in general, if you don't already frequent it. And if someone can't get help here, then they can try on an another forum such as the one hosted there.

http://www.anticrack.de/

http://board.anticrack.de/

Kayaker
CrackZ
05-29-2002, 07:29 PM
Nice link that Kayaker.

Kind of makes me want to get back into this stuff, or running a news site or who knows, ah, maybe one day ;-).

The trouble is, lack of editorial control, for example, I don't really call a document discussing MeltICE (gotta be about 7 years old now ;-) and defeated a gazillion times, newsworthy), but then thats me ;P and I'm a right miserable bastard and erm I should probably sit in a box in a dark corner somewhere.

The general point though, search SOMEWHERE for an answer before posting your retarded question is a good one ;-).

Regards

CrackZ.
Kayaker
05-30-2002, 02:11 AM
The only problem is, right after I posted it they went and changed a link. The direct link to the categorized "Topics" is gone. Also the Search engine seems to be very efficiently doing nothing now.

To go to the nicely laid out list of subject matter follow this link:

http://www.anticrack.de/modules.php?op=modload&name=Topics&file=index

Hey Administrator (ac), you're doing a great job over there, but what's with the missing link and search engine problem? Or am I just losing it? ;p

Hi CrackZ, I hope this does urge you to get back into it again ;-) What I liked about the site was it brought together a variety of ideas in a way that could be accessed easily and get people thinking along new lines instead of always stagnating with just the same old reversing "tricks". A news site would be nice, maybe an RCE radio station if anyone had the bucks ;)

btw, I like your approach to retirement - come into work occasionally - answer a few questions - go home and think about dinner... I'm taking notes, lol ;->

Cheers,
Kayaker
scooterk
05-30-2002, 06:18 AM
Hi CrackZ
I visited your site quite a bit and really enjoyed all the reading material and layout.It probably cut into your personal time quite a bit I know I spent many a night consumed with reading the material.
It would be nice to see you come out of retirement and have a site..
Thanks for all the info provided :)
scooterk


Remove Anti-Disassembling-Tricks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Remove Anti-Disassembling-Tricks
PDA

View Full Version : Remove Anti-Disassembling-Tricks

Mefeus
05-28-2002, 03:10 PM
Well I was walking around over all the posts here (and of corse used the "search"-Button) to get all infos about this.

My problem was:
Some *.exe was able to crush my W32dasm893, when tryed to open them.

Questions:
Is Imhotep the right (and only) tool to remove all the known anti-disassembling tricks?
What is the last version? (mine is 1.7.0.8)
Where to get a newer one, if exists?

Does Imhotep remove all the known anti-debugging-tricks from a file which is protected like SD2?

Thanx for any help!:)
CoDe_InSiDe
05-28-2002, 03:36 PM
Hi Mefeus,

Does Imhotep remove Anti-stuff ? :)
I thought it only removed Obfuscation code hmm... ;)

Cya...

CoDe_InSiDe
Mefeus
05-28-2002, 03:55 PM
This is the problem with all kind's of Boards:
Don't search for the topics - even find the good ones.

But yes, I have seen posts, where they talked about anti-disassembling and promised on Imhotep - it isn't only some kinda cosmetics for your lovely PE-File. :D

Cirkutz told me:
400000 JMP 401000

401000 JMP 400000
Such infinite jumps r one of the bastards.

What else?
crUsAdEr
05-28-2002, 05:25 PM
Hi mefeus,

Have you tried using IDA??? it should work...

Also, to make W32dasm disassemble correctly, you have to patch those jumps i guess... usually, each prog uses the same method of obfuscation, hence you can try to code a simple file scanner to nop out those jmp... but IDA is THE tool to use man :>>

good luck
crUsAdEr
foxthree
05-28-2002, 06:20 PM
Alternatively, you can also use MOW. It is supposed to be a superb obfuscator remover! Alas, I don't have a copy that I can upload it here :(

Signed,
-- FoxThree
MTB
05-30-2002, 03:07 AM
The latest version of IDA version 4.17 will get rid of most of the crap put in. W32dasm will not work on most of this stuff, unless you patch all those jumps, I always miss one or two which screws stuff up. FYI IDA is very powerfull in this regard however, it is so SLOW, start it overnight on any good size exe (>10Mb). I had one example that took +24 hours on a 800 Mhz AMD machine running 98SE.

MTB
Mefeus
05-30-2002, 09:13 AM
Well I have seen IDA once upon a time and it does not looks embrasing to me, that's why I'm still using W32dasm as first (and from the beginning of corse) - maybe I have to give IDA a second chance :)
MOW is digged in my archive here, don't need a link to this, I will try it on the weekend, maybe it's surprising.

Thanx all, hope it worx!
JMI
06-02-2002, 05:02 PM
Mefeus:

If you review this thread you will find some directions to information on anti-dissambler tricks contained in the AntiCrack Archive.

http://www.woodmann.net/forum/showthread.php?threadid=3239

Regards.
Mefeus
06-03-2002, 12:19 PM
Thanx JMI, why the hell I didn't found it???

Maybe there IS something wrong with this mysteric "Search"-Button?

:)
JMI
06-03-2002, 05:46 PM
Mefeus:

The reason that a search would not have "discovered" my post with the references to the anti-disassembler materials is that it was posted after you asked the question here. The search button is good, but has not yet developed the capability to predict what will be posted in the future. :D

Regards.
Mefeus
06-05-2002, 09:33 AM
ANTI-WDASM trick
mov eax, edx
jmp loc_1
db 0F
loc_1: inc eax
jmp loc_2
db 85
loc_2: call sub_1

But I guess, this will only give shit out in the disassembled output, may not even strike Wdasm to crush suddenly when open a file!
There must be a coruption in the PE-Header (some kinda killing-flag-combination or impossible segment-size).

Is it possible to insert a section with an negative size?
:confused:


sentinel monitor :-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sentinel monitor :-)
PDA

View Full Version : sentinel monitor :-)

me8
05-28-2002, 03:24 PM
hi,
dunno if posting into the right place but anyway:
is there a prog which would report dongle status||error codes, smth like dongle status 15, 16 ......
CrackZ
05-29-2002, 07:16 PM
Hiya,

Your query isn't terribly lucid.

Sentinel's API returns status codes in AX, you can look up their meaning in the headers. The Sentinel drivers are actually pretty useless and the order of events via CreateFileA/DeviceIOControl is something like so.

DEVICEIOCONTROL msg

allocate_memory()
decrypt_Sentinel_API_parameters()
switch(Sentinel_Dongle_Type) - driver supports about 10 variants
switch(Sentinel_API) - select Sentinel function

** TIP ** Sentinel API side copies function numbers to '7242' signature + 30h. All on API side.

call_dongle()
re_encrypt_Sentinel_API()
deallocate_memory()

Trace out service.

Of course you can easily write replacements (again I have some source codes if you want), or breakpoint and watch the tedium unfold infront of your eyes.

Regards

CrackZ.


Blowfish and SHA-1 analysis on cacheX
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Blowfish and SHA-1 analysis on cacheX
PDA

View Full Version : Blowfish and SHA-1 analysis on cacheX

Lbolt99
05-28-2002, 05:18 PM
CacheX program and keygen analysis.
Disassembled keygen (eclipse) and also registration routine in CacheX opera version.

Crypto used: SHA-1, blowfish

Blowfish: Subkey tables stored in file and copied (0x1048 bytes)

Seems to deviate from blowfish spec: subkey table is continuously modified by CacheX

“Null” represents 64 bits of zeros in this document (ie hex 00 00 00 00 00 00 00 00)

Serial # format: hex digits, 64 bits (ie 5E43-347E-5223-7A43)

The name and serial # are stored in the registry. These are pulled from the registry when the program starts, a simple XOR operation is done on the S/N to get it to the same code that is entered at the dialog box when registering program. The reverse operation is done when registering the prog; the code entered is XOR’ed with a constant and stored in the registry. Either way, it proceeds to the below procedure:

Procedure (initially, the keygen and the internal cachex routine do the same thing):

Part I
1) SHA-1 the name (after it’s converted to uppercase)

2) XOR the hash of the name with the blowfish P-table (0x48 bytes)

3) Blowfish (64 bit data: null). Iterates 0x12 times, churning thru subkey table, updating all 0x48 bytes of P table

4) Blowfish (64 bit data: end result of last iteration of #3). Iterates 0x200 times, churning thru 0x1000 size table

5) NOTE: As of this point, the Eclipse keygen and the program’s internal routine have done the same thing.

5a) the KEYGEN at this point calls blowfish again, with data that is preinitalized at the start of the keygen: 85 09 1E 93 91 9D FD 74. After blowfish is done, it results in the correct S/N to enter into CacheX opera. The keygen is finished.

5b) only CacheX after this point. (keygen doesn’t do any of this)

6) Swap P1 thru P18 of blowfish subkey table

7) Single blowfish call: data is the Serial number: After blowfish is done, it results in the same preinitialized data that was in the keygen: 85 09 1E 93 91 9D FD 74

Part II
8) OK. Whew. This part seems to be a large constant operation, in general. I’ve commented it in one of the attached documents, but all in all I believe it generates the same info every time regardless of name/Serial#.

9) SHA-1 the memory image of the program

10) Blowfish: see steps 2-4 in part 1. (Xor with hash of memory image this time tho)

11) Blowfish: decrypts executable code (executed at the CALL ESI routine cs:443b02)

Part III
12) Now we’re looking inside the CALL ESI

13) SHA-1 on 9D 91 93 1E 00 80 74 FD (see step 7)

14) Blowfish: see steps 2-4 in part 1. Xor is with hash of hex digits in step 13

15) The following iterates twice:
a. Read 30h data (constant) from low memory, copy

b. Blowfish crap all over again (xor subkey table w/30h data read in), 0x12 iteration , 0x200 iteration, p1 thru p18 swap).

c. Iterates 0x1F4 times:
blowfish 30h byes of data copied (w/modified subkey table)

d. read and copy different 30h data from low ram

e. Final Check: 1st 8 bytes of the 30h data. Read bytes 5-8, NOT them, compare with bytes 1-4. if same, exit. They will be the same on the 2nd iteration of Step #15, if your code is correct.

e. iterate back to step a (once only,assuming correct code)

OK, now that it’s all in a nutshell, I have a bad feeling that there is no way to keygen CacheX unless you have a valid code, in order to find out the CONSTANT: 85 09 1E 93 91 9D FD 74. This constant is different between the different cachex’s: IE/netscape and Opera. The subkey tables in the three version are the same, for what it’s worth. Since the constant is unknown, and there doesn’t seem to be any way to figure it out from working backwards in part 3. Is my analysis correct?

So eclipse must have had a valid serial in order to figure out the obscured constant?
mike
05-28-2002, 09:11 PM
e. Final Check: 1st 8 bytes of the 30h data. Read bytes 5-8, NOT them, compare with bytes 1-4. if same, exit. They will be the same on the 2nd iteration of Step #15, if your code is correct.

In the end, then, the check is against a 32-bit number? It looks as though you could bruteforce the whole process, though you'd probably need to distribute it. How long does it take to run through a single check of the name/SN?
Lbolt99
05-28-2002, 09:42 PM
Originally posted by mike

In the end, then, the check is against a 32-bit number? It looks as though you could bruteforce the whole process, though you'd probably need to distribute it. How long does it take to run through a single check of the name/SN?

Hi, thanks for the quick response. It does look like the final check is done on a 32 bit #. It just compares it with another 32 bit number, inversed. Looks like this:
MOV EAX, [EDX+4]
NOT EAX
MOV EBX, [EDX]
CMP EAX, EBX
if equal, registered, else loops back up, increments to the next 0x30 bytes of data to read in (see step 15a) until a certain value
is reached, then it kicks out and sets the unregistered flag.

I don't know if this is an accurate assessment of speed, but I set a BP before the serial check, a BP afterwards once everything checked out, got an ET=54 milliseconds, on a pentium 266 (i'm at work)

Part II could be cut out and pre-set, which would probably save a few ms

Anyway, thanks for the help
mike
05-28-2002, 09:59 PM
What debugger did you use? SI doesn't give very good timing for very short bits of code. Perhaps you could go in and alter the code in memory so it tries a test 100000 times and then check the time between breakpoints.

Assuming it takes 50 ms = 1/20 s per test, then it will take ~6 P266-years to "force brutally" :(

I bet it runs much faster than that, though.
Lbolt99
05-29-2002, 02:38 AM
Used SICE 4.05 on a w98 platform.. figured that wasn't too accurate of a time capture :)

I've thought about this whole problem for awhile, and I think I've simplified it to the point that two-thirds of it can be cut out. So it's down to two years now :D

Basically, regardless of what name/serial number is entered, if it is a correct combination, it ALWAYS results in the same "constant" discussed before.

Since we only need to find out this constant, Part I can be canned, as well as Part II. All part II really does is decrypt Part III (the code that runs at the CALL ESI).

Part III runs the hash on the constant, XOR's hash w/P-table, does all the blowfish crap, etc.

I'll give your suggestion a shot tomorrow and see how long it takes on just part 3 @ several hundred thousand iterations.. in fact, might even replicate the process in C++, but that'd have to wait until the weekend.. no time now..

This got me wondering how the author managed to get two 32 bit numbers next to each other, one the inverse of the other, after all this blowfishing and everything.. could there possibly be several different constants, other than those the author "picked" which would somehow result in it passing the final check? I guess I'll have to take a closer look at the data passed in Step 15-c.. maybe that holds a clue.

Once the constant is figured out, you can replace the one in the eclipse keygen (opera) with the brute forced one and it should generate the code for the IE version :)
mike
05-29-2002, 03:20 AM
could there possibly be several different constants, other than those the author "picked" which would somehow result in it passing the final check?
Yes, absolutely. The constant is 8 bytes, while the check is only 4 bytes, so there are 2^32 constants that would work. It would take about 4 billion times longer to try to find a S/N that matches the original 8-byte constant.

BTW, the check might seem to be 8 bytes, but for *any* first four bytes, there's a valid last four bytes. So the check is really only 32 bits. The "NOT" op is irrelevant.
Lbolt99
05-29-2002, 09:51 PM
Thanks for the ideas. I've done a little more analysis on exactly what is going on in the CALL ESI routine. As stated before, regardless of name/code, it will always arrive at the same (unknown) constant.

My speculation at this point is that the author has picked 8 random hex bytes. Then he:
1) hashes it with sha-1
2) xors with 0x48 byte p-table
3) churns thru blowfish table, updating continuously

So now the hash is "meshed" into the blowfish table.

Now he's got his highly modified blowfish 0x1048 byte long table set up.

He picks out 0x30 bytes of random data, ensuring that the 2nd set of 4 bytes are the inverse of the 1st set of 4 bytes.

Then he parses thru the 30 bytes, 8 at a time, with blowfish. Does the same thing about 200 or so times

Stores it in the exe file.

Now, when the program is run, with a correct serial, it will arrive at the correct 8 byte constant, do steps 1-3, in addition to a P1 thru p18 reverse..

Pulls the data from the exe (30 bytes), and after all the looping, arrives "back at" the original 30 bytes of random data he picked out.

I have found out, unfortunately, that in addition to the 32 bit check, there are other checks on these 30 bytes throughout the program.. it stores the final 30 bytes produced and checks throughout program :(

So all 30 bytes have to pass internal checks in cachex, as well as the initial 4 bytes = NOT 4 bytes check...

I would have to brute-force 48 bits and "emulate" all these checks.. (I originall thought it was a 64 bit constant, but the program discards the first 16 bits for whatever reason). I verified this by overwriting them after the registeration number was blowfished into the constant.

Anyway hope all this makes sense :) How realistic is it to Bruteforce 48 bits?

If not, I'm going to dump the encrypted code and just hard patch it. Problem is it happens thruout the program, pain in the neck. It's not wrapped with anything like aspr or anything

thanks for the help
crUsAdEr
05-29-2002, 10:05 PM
Hi Lbolt,

Actually, most of the encrypted are used to decrypt other code as well as generating SHA key... I only found the main message loop call important.. i actually nop the first few call to Decrypt and execute code... only dump one long section right at the end which contains the Nags call as well as Messageloop... hard patch it and it runs fine now... the rest are not important.. though i did dump them to study the decryption routine.. just a suggestion if you find bruteforcing infeasible...

Regards,
crUsAdEr
Lbolt99
05-31-2002, 02:03 AM
thanks for the suggestions as far as going the route of dumping the encrypted parts.. plan to play around with that tomorrow. Sounds like it's the easiest approach to this. Really wish I could have done something as far as keygenning it. Is this a general trend of shareware authors towards "impossible" to keygen programs? Seems strange, seeing things like CloneCD and Elcomsoft advanced disk catalog keygenned, that something like this would stand out. Even code decryption with AZPR is possible, as you demonstrated :)

Maybe it's something I'm missing, or I just don't know enough about the mathematics of cryptanalysis to go about this.. fwiw, didn't even know what a "hash" or "block cipher" was two weeks ago, so this is all new stuff :)

Interesting.. looking into how hard a 48 bit brute force would be.. I've streamlined the process, and could parallel process across several 1ghz machines I guess. Wish I had a few 450mhz ultrasparc 2i's at my disposal, lol
seir
06-02-2002, 09:13 AM
Hey Lbolt99,

unfortunately you won't have a chance to bruteforce the
48bits. The problem is that the blowfish loop that you
need to execute 6x500 times slows down the whole process
too much.

I just digged in my sources ... I've written a bruteforcer
for it that tries to find a value which satisfies the
32 bit comparsion. After I found a value it wasn't of too much
help though. As you already found out the whole table is
used to decrypt memory for later usage. So with the value
I found the app simply crashed.

My keygen was only possible as you already supposed with a
valid license. That's actually the weakness of this protection
system. BTW, I think this is a modified/custom compliled
Armadillo. Some time ago I reversed an Armadillo protected app.
It was using crc32 and blowfish, but the whole registration
process was exactly the same as in cachex. And I figured out
that you can break it in a reasonnable time with a bruteforcing
approach. If you are interested in the target just leave a Private
Message and I may also give you my bruteforcer source.

Greetz,

- seir
Lbolt99
06-13-2002, 08:27 PM
Hi, thanks for the info. I reset CacheX into trial mode, and took a look at what happens. I took the constant produced but unfortunately it doesn't look like it works with the "registered-mode" decryption routine. The routines look the same but are different and in different locations of the program.

They must use a different algo and key for decrypting the data between the unreg and reg versions. I think that's why the constant arrived at when running in trial mode doesn't work. Basically, I took the constant and planted it into the Eclipse CXOE keygen. Didn't work.

Two options I see at this point:

1) pay for it ;)

The upside is that it would reveal the CONSTANT, allowing the keygen to be complete.

2) reduce the keyspace that needs to be searched for brute forcing the 48 bits. Mike would know more about this than me. Maybe there's a way to detect a "pattern" of values that allow
the 32 bit comparison to check out. Search thru ONLY those values, looking for a 48 bit number that will generate the CORRECT 0x30 bytes for the decryption..
Artifex
07-05-2002, 06:32 AM
Hi, Lbolt99 and all fellows.
As we don't know the proper 64-bit constant for Cxie, couldn't we try to use the Opera constant and get our Cxie decrypting process to think that we are using Opera.

1. Would we have to modify many things in Cxie decrypting routine ? It seems that a lot is shared between versions. First step could be to get correct decrypting in live, as we can't patch the prog without altering the process.

2. Could you explain what would we have to dump and paste to restore the decrypting process if we patch the prog ?

(As far as cryptology is concern I am still in the Enigma times).

Artifex
Lbolt99
07-08-2002, 05:00 PM
Originally posted by Artifex
Hi, Lbolt99 and all fellows.
As we don't know the proper 64-bit constant for Cxie, couldn't we try to use the Opera constant and get our Cxie decrypting process to think that we are using Opera.

1. Would we have to modify many things in Cxie decrypting routine ? It seems that a lot is shared between versions. First step could be to get correct decrypting in live, as we can't patch the prog without altering the process.

Unfort. the 1000+ byte blowfish subkey table is heavily modified by itself with the sha-1 of the 64 bit constant :( So despite the fact that the routines are similar, the key table is completely different. (By the way, this violates the official blowfish specification: the subkey table is not supposed to be modified after it is generated)

2. Could you explain what would we have to dump and paste to restore the decrypting process if we patch the prog ?

The 1040 byte subkey table (it is copied from low ram to the himem area when the decryption takes place) AFTER it finishes modifiying itself zillions of times :rolleyes:

(As far as cryptology is concern I am still in the Enigma times).

Artifex

I was too, these helped out as far as understanding the crypto used in cx:

SHA-1 specification:
hxxp://www.itl.nist.gov/fipspubs/fip180-1.htm

Blowfish spec:
hxxp://www.counterpane.com/bfsverlag.html
hxxp://www.codeproject.com/cpp/blowfish.asp
Lbolt99
07-08-2002, 05:49 PM
Originally posted by Artifex
I will enter in "Unlock" name "DEFAULT" and SN = 3482-bc11-c786-e749, and will watch why first check is false and second is true.

Still thinking about this one.. I ran it, and successfully duplicated your results... at first glance it seems like it is never able to pass the final comparison check:
-----------------------------------------------------------------
Final check (Two 32bit#s next to each other, NOTs one, compares, same=registered). On 1st iteration, fails, loops back, reads another chunk of 30h bytes, 2nd time, correct, if you’ve entered the right registration info. The checked bytes are @ 69f9d0)
--------------------------------------------------------------------
Note that it continues iterating, about 5 or so more times, reading in different chunks of 30h bytes to "decrypt" into the decryption key used to decrypt the stuff in other parts of the program.

It somehow comes up with a different (default) 64 bit number for the second call into 69FAF5, which allows it to pass the "final check".

In retrospect, it might be a quicker crack to paste in the blowfish subkey table, and let it do it's work, instead of dumping/pasting each section.. I'm going to give that a shot to see if it'll work..
Artifex
07-08-2002, 09:45 PM
quote :
------------------------
Lbolt99 wrote :
"In retrospect, it might be a quicker crack to paste in the blowfish subkey table, and let it do it's work, instead of dumping/pasting each section.. I'm going to give that a shot to see if it'll work.."
-------------------------

I also feel that it is worthwhile.

Artifex
Lbolt99
07-09-2002, 03:02 PM
Originally posted by Artifex
quote :
------------------------
Lbolt99 wrote :
"In retrospect, it might be a quicker crack to paste in the blowfish subkey table, and let it do it's work, instead of dumping/pasting each section.. I'm going to give that a shot to see if it'll work.."
-------------------------

I also feel that it is worthwhile.

Artifex

I'm going to give this a shot sometime today or tomorrow -- hopefully this will be much quicker, with dumping each part it got more and more to the point of not being worth it.. if dumping and pasting the blowfish table instead is better, I'll document the method and everything..
UrgeOverKill
07-09-2002, 05:19 PM
wow, what a great thread, I learned quite a bit by watching!

nice work guys!
Artifex
07-12-2002, 03:16 PM
Hi, Lbolt99, UrgeOverKill and all fellows.

P and S-box tables dumping and patching seems to works.

First with a few patches to evit anti-patch, anti-softice and useless nag screen display, I arrived safely at
:0043ec81 call 0043eed8 (startup window display).

In there prog crashes (at :0043efdf call 00401f4c) because it calls an address in edxxxx that had not been correctly decrypted.
Decryption of that piece of code is at :
:0040bb44 call 00440bf4
We need correct P and S-box tables. So I dumped the correct bytes in the demo version :
/dump dd1050 1048 dumptables.bin
and I loaded them just before the call to 00440bf4.

Startup window popped up, and prog exited without crashing.

To stay in the prog :
bpx 418c3c
:00418c3c call 00440bf4
Again we have to load the correct tables at the right place. Tables
are different
/dump dd4c04 1048 dumptables1.bin
/load dd4bd8 1048 dumptables1.bin
Address to dump or paste is the last push before the call 440bf4.

Each function requires to load different tables.
So this method is worse than the other.

Artifex
senso
05-05-2004, 09:18 PM
Is it possible that CacheX is using a method similar to "Shamir's secret sharing" scheme?


Great Links on ASM language!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Great Links on ASM language!
PDA

View Full Version : Great Links on ASM language!

Ajnabi
05-28-2002, 09:23 PM
HIya

wanted to post a site which has got some important links on ASM programming.

ASM (http://www.members.kconline.com/strycker/IBAMP/page4.html)
The Svin
05-28-2002, 10:14 PM
I wouldn't call it great.


how to unpacking manual?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to unpacking manual?
PDA

View Full Version : how to unpacking manual?

tHE SnaKe
05-29-2002, 03:17 PM
please how to unpacking manual?:confused:
nofurs
05-29-2002, 03:24 PM
YOUR POST WILL BE DELETE!!!!!!!!!
Aimless
05-30-2002, 08:15 AM
Here's the unpacking method that works best:

1. Find a table

2. Put the packed box on it

3. Analyze what its packed with: PAPER? THREAD? RIBBON?

4. Decide on using appropriate tools: HANDS? KNIFE? SISSCORS?

5. Note down each step so that you do not have to RETRACE the whole process again.

6. After initial round of UNPACKING is done, you can RIP THE WRAPPER apart, Cut it or simply slice through it.

7. Open box, enjoy goodies.

Dear LORD!!!!

But seriously Snake, but seriously!!

Do the following:

1. Read the FAQ.
2. Find a site that TEACHES about unpacking
3. FInd a packer
4. Pack notepad
5. Get tools from net to unpack
6. Try unpacking the packed notepad with that tool (so many tuts also support the same method)
7. You're done (In case you have problems, ask here)
8. But before asksing, make sure you TELL us the following:

(a) The tools you have used
(b) the application you are using
(c) The method/approach to the problem
(d) The locations where YOU think the protections are, or the unpacking code is
(e) Some patching (raw/inmem) that you have tried

After all this, if you have any questions ask us. This may seem a little too much to ask for, but compare this with going to a doctor.

Snake: Cure me! Cure me! Cure me!
Doc: Sure, but what's the problem?
Snake: Cure me! Cure me! Cure me!
Doc: Yeah! But tell me the symptoms, the areas of pain, your feelings..
Snake: Cure me! Cure me! Cure me! Cure me! Cure me! Cure me!

...you get the idea.

If you do not do the above, more enthusiastic volunteers like CLUESURF will reply the way they did, and you will get discouraged pretty soon.

MADE EFFORT, WILL ASSIST!!

...Have Phun
Ni2
05-30-2002, 10:23 AM
Hi Aimless,

Very funny your post and the analogy with the doctor ;) I think you are right 100% in what you say.

My little advice to the Snake to learn manual unpacking is the following: "Just take something that is packed and trace it from the beginning and you'll see all the "magic" inside "the unpacking" and all your questions about unpacking will be answered by yourself ;)" Believe me, no needed for an unpacking course, etc...just you and the debugger.

Regards,
Ni2
tHE SnaKe
05-30-2002, 12:44 PM
i search any tutorials for the unpacking manual?
give any web page for the tutorials
thanks
Risotto
05-30-2002, 10:26 PM
Hey!

At least look at the bottom or try to use search engine, etc.

Go on.
JMI
05-31-2002, 01:29 AM
We know English is not your first language, but if you want to participate in English language forums you need to understand certain basic information in English. One of the things you need to understand is the rules of the forum. One of the rules here is that you are supposed to use your brain and eyes and do some work on your own before you post a request

If you had done any looking and any thinking about unpacking you would have discovered that there are several links at the bottom of the forums which will take you to sites with many many tutorials on many many subjects for you to study. I would suggest that you try Krobar's site and read up as much as you can on unpacking. It is a subject you will need much background reading on before you are ready for manual unpacking. This is not the place to ask someone to take your hand and teach you every thing from step one on any subject.

Those here will help you when you show you have made an effort on your own, what you have done, and where you are having trouble after trying it on your own. Study, try, and then come back and ask question about specific issure.

Regards.
Mefeus
06-04-2002, 08:45 AM
Well, i also laughed a lot about the "unpacking"-Tutorial, that u give to Snake, but please don't forget:
This is a Newbie-Forum, so you have to assume even Newbie-questions.

Don't leave anybody alone in this magic world. Give him a headbang and a handshake and at least a good help on his way!

So, if the originator of this thread r looking for tutorials in different languages then english, look here:

hxxp://www.crackstore.com/

Ok, ok - it's well known, but for me it was a good point to start from.

Peace, Mefeus
ReaL|sTy
06-12-2002, 04:34 PM
that's right newbies need help insted of critical answers,, when someone is beggining is really hard to learn hard enought if you don't know anything about programing stuff......

this could help you.....;)
dipeshrestha
06-16-2002, 10:27 AM
ReaL|sTy that's right newbies need help insted of critical answers,, when someone is beggining is really hard to learn hard enought if you don't know anything about programing stuff......

I too agree with ReaL|sTy. newbies can also send their queries in this section. The veteran cracker should not harass by saying that YOUR POST WILL BE DELETED.

dipeshrestha
nofurs
06-16-2002, 11:29 AM
well he doesn't respect the board WHY SHOULD I REPECT HIM!!!!!!!!!!
critical anwsers yeah I always give critical answers to those never READ THE POSTING GUIDLINES AND POST GARBAGE IN HERE :rolleyes: This is not the first time he had done that!
BTW DON'T UPLOAD FILES CAN BE FOUND IN THE WEB coz the limits of space in here!

>>The veteran cracker
I'm not that old hahahaha

Giving too much to a newbie or l33to turns them a lamer :p


Best way to hook PrintScreen under Windows NT/2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Best way to hook PrintScreen under Windows NT/2K
PDA

View Full Version : Best way to hook PrintScreen under Windows NT/2K

foxthree
05-29-2002, 03:49 PM
Hello Fellow RCEs:

I need to hook PrintScreen key under Windows NT/2000 and prvent the user from printing the contents of the screen either to clipboard or printer.

What is the best way to do this?

I know I can set a Windows Message Hook and look at WM_KEY* messages and do appropriately. Will this work on all Win* platforms (incl. Win98. I may need this later ;))

Grateful to any suggestions,tips,pointers...

Thanks.

Signed,
-- FoxThree
mike
05-29-2002, 07:57 PM
You'll need to hook it for the whole system because you can capture the whole screen with alt-prtscn. In order to do that, you need admin privileges I think on NT/2k. It's easier to do on W98.

I know adobe printshop demo captures it at an app level but not a system level.

One place suggested registering prtscn as a hotkey and looking for wm_hotkey messages:
h**p://www.mvps.org/vbnet/index.html?code/subclass/registerhotkey.htm

There are some plugins for browsers that claim to prevent it; artistscope's copysafe is one:
h**p://www.artistscope.net/techniques.htm

You'll want to look for the VK_SNAPSHOT message, I think. You can install just a keyboard hook instead of the all-message hook and it won't slow down your system as much.
Clandestiny
05-29-2002, 09:51 PM
Hiya foxthree,

Alternately you could try to hook the INT 5 which is the 'Print Screen' interrupt. This would work on win98, not sure about win2k. No doubt you would have to have admin privaleges to hook interrupts on win2k.

Persuing this line of inquiry in google with 'print screen and INT 5' turns up some good information:

"The BIOS uses INT 5 for this. Fortunately, you don't need to mess withthat interrupt handler. The standard handler, in BIOS versions dated December 1982 or later, uses a byte at 0040:0100 (= 0000:0500) to determine whether a print screen is currently in progress. If it is, pressing PrintScreen again is ignored. So to disable the screen snapshot, all you have to do is write a 1 to that byte. When the user presses PrintScreen, the BIOS will think that a print screen is already in progress and will ignore the user's keypress. You can re-enable PrintScreen by zeroing the same byte."

http://www.faqs.org/faqs/msdos-programmer-faq/part2/section-17.html

Sorry if this doesn't help with the problem in Win2k. Hehe, I'm getting antiquated, but Win98 is still my reversing OS ;)

Cheers,
Clandestiny
The Svin
05-29-2002, 10:33 PM
read about SetWindowsHookEx and KeyboardProc
foxthree
05-31-2002, 07:03 AM
Fellow RCEs:

Thanks for your inputs. Yes, I've fixed the problem. However, I have one question with hooks:

Suppose say I a program has already hooked the keyboard using KeyBoardProc (system-wide) and then I install my hook also, if the previous proggie fails to call CallNextWindowsHook then I'm left to hang around forever right?

I mean, is there a way where we can specify where in the hookchain we want to hang (either the first or the last)?

Thanks again for all your knowledgeable posts.

Signed,
-- FoxThree
mike
05-31-2002, 03:23 PM
As far as I know, it's a stack, so the last one to register the hook gets the messages first.
foxthree
05-31-2002, 08:03 PM
Hi Mike:

Thanks once again. I appreciate it :)

Signed,
-- FoxThree


unArmadilling
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unArmadilling
PDA

View Full Version : unArmadilling

Risotto
05-29-2002, 10:26 PM
Salutionz!

I've got a prob while unprotecting proggie protected with Armadillo 2.5*. Actualy i unprotected it, but Armadillo's code is still in the very prog. I've done it this way:
1. bpx GetProcessWorkingSetSize
2. tracing awhile:

018F:0089FE49 50 PUSH EAX
018F:0089FE4A FFD7 CALL EDI ;jump to OEP
018F:0089FE4C 8BF8 MOV EDI,EAX
018F:0089FE4E 8BC7 MOV EAX,EDI
018F:0089FE50 5F POP EDI
018F:0089FE51 5E POP ESI
018F:0089FE52 C3 RET

3. trace into call edi and dump the file.
4. rebuilding PE header and IAT and OEP.
5. and it works.

But i'd like to remove Armadillo. How to do it? I failed to find decrypting routine. BTW break point at WriteProcessMemory doesn't work at all.

Agur.


new progyy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > new progyy
PDA

View Full Version : new progyy

yoda
05-30-2002, 04:48 PM
Hey...

Maybe someone is interested in my new CLR MetaData Viewer (executables of the .NET framework)...
shows CLR header, all classes, interfaces, variables,...

yoda


Another newbie's struggle against ASProtect...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Another newbie's struggle against ASProtect...
PDA

View Full Version : Another newbie's struggle against ASProtect...

triz-
05-31-2002, 05:26 AM
First off, I just want to say that without Fravia's site and this messageboard, I'd still be wandering around muttering "Why does the disassembler crash!?!" and giggling to myself. You guys are a tremendous source of information and without the site, I wouldn't know half of what I do

That said, I throw myself before the mercy of the court seeking some pointers for ASProtect. I've been tinkering with it on and off for a little while now, and I think I've gotten the hang of getting to OEP and dumping (one step at a time ;) ).

My setup: Win 98 SE, SoftIce 4.00

Target: h**p://www.sapphiregames.com/15pack/15pack.zip (500k)

Downloaded, unzipped, installed and checked with PEId..."Asprotect." Drat, my arch-nemesis once again.

Loaded Icedump and Iceload, and ran. Broke on INVALID's, traced a few steps and ran a /tracex 400000 470000 (half lazy and half ignorant as to when to set a breakpoint without ASPR clearing it - I'm trying ;) ). Broke on the usual 4010xx RET - F10, traced again. Here's where it gets interesting (to me, anyways)

PUSH EBP
MOV EBP, ESP
MOV EAX, [ESP+0C]
MOV [004XXXXX], EAX
POP EBP
RET

Tracex breaks on this chunk of code 3 times I believe (I typed this from memory, and my short-term memory is a bit hazy sometimes, so bear with me if I goofed up a register in there somewhere). I believe the [004XXXXX] address changes each time, although I'm not positive. After tracing out of the third and /tracexing again, it travels on to 4457A8 which appears to be OEP.

/option p i0
/dump 400000 457A8 c:\dump.exe

Allrighty, close SoftICE and load Revirgin. Pick 15pack.exe from the menu, "Table corrupt, enter OEP blah blah" :) Enter 004457A8 for OEP and click Fetch IAT.

"Nothing found." :confused: Ummm...
I don't recall why, but I entered 401000 eventually, and got RVA of 4912C and Length of 5D0. IAT Resolver -> Resolve again....hm, there it is??

Here's where I falter. For example:

19 00049178 00C11270 0000 ?????? ??????

???? doesn't sound too useful :). Close 15Pack, bpx GetVersion, run again. When SI pops, D C11270 to find a lot of ???'s. F5 - oh, there's something there now. U C11270 to get

PUSH 00
CALL Kernel32!GetModuleHandleA
PUSH DWORD PTR [00C16CF0]
POP EAX
RET

D C16CF0...lots of 000's. F5 again - now there's something there. "81B7A260" (this address seems to change everytime I run it). D 81B7A260 - "C:\Program Files\15-Pack 1.28\15pack.exe" :confused: Why thank you kind program, if you hadn't told me where the EXE was I might have lost it :mad:

Something else that seems...different (wrong? ;) ) In Revirgin, using 00401000 as OEP, there's a number of KERNEL32 functions, followed by 3 USER32, 3 ADVAPI32, some OLEAUT32 functions, 4 more KERNEL32's, some other assorted functions, then even more KERNEL32s...I was under the impression they were generally in one group together?

I realize ASProtect has been discussed quite frequently in the past (I've read some of it over and over again trying to find something I might have missed), but it was starting to drive me a bit crazy, so I decided to take a new small target, do what I can, document my steps and present it here hoping to maybe learn something else from the masters
Another thing:

15PACK.EXE 252,416 bytes
15DUMP.EXE 284,587 bytes
15DUMP2.EXE 252,928 bytes (I forget why I made 2 dumps :( This one looks to close to be a good dump - if anyone gets a good dump of this, could you tell me how big your dumped EXE is?)
StARaY
05-31-2002, 05:59 AM
hi,triz-
your oep:4457a8 is right
i have dumped it by lordpe and fixed it by imprec1.42

and it can run
but the file was still unregister

my file size is 593520byte
Lbolt99
05-31-2002, 08:02 AM
Originally posted by triz-
Downloaded, unzipped, installed and checked with PEId..."Asprotect." Drat, my arch-nemesis once again.

PUSH EBP
MOV EBP, ESP
MOV EAX, [ESP+0C]
MOV [004XXXXX], EAX
POP EBP
RET

ASPR's been beaten to death here, literally and figuratively, there's really nothing new going on with it for awhile.. but since you are making an effort, will point u in the right direction :)

Looks like it's doing those pre-dips into the code before the OEP is actually reached; look for +Splaj's posts on this, very well done. It sets variables which are later accessed by the program itself

Tracex breaks on this chunk of code 3 times I believe (I typed this from memory, and my short-term memory is a bit hazy sometimes, so bear with me if I goofed up a register in there somewhere). I believe the [004XXXXX] address changes each time, although I'm not positive. After tracing out of the third and /tracexing again, it travels on to 4457A8 which appears to be OEP.

It dips 3 times then, before OEP

"Nothing found." :confused: Ummm...
I don't recall why, but I entered 401000 eventually, and got RVA of 4912C and Length of 5D0. IAT Resolver -> Resolve again....hm, there it is??

RV works sometimes to get the IAT RVA but if it doesn't get it the first time, the quickest I've been able to is by Kayacker's method involving stopping the ASPR wrapper process right before it decrypts the IAT, search for his posts on this. It works every time and is the only way I've figured out to get it if RV doesn't work

Here's where I falter. For example:

19 00049178 00C11270 0000 ?????? ??????

???? doesn't sound too useful :). Close 15Pack, bpx GetVersion, run again. When SI pops, D C11270 to find a lot of ???'s. F5 - oh, there's something there now. U C11270 to get

PUSH 00
CALL Kernel32!GetModuleHandleA
PUSH DWORD PTR [00C16CF0]
POP EAX
RET

It's the new way that ASPR obscures the emulated imports; see +splaj's post on "asprotect 1.4"

Something else that seems...different (wrong? ;) ) In Revirgin, using 00401000 as OEP, there's a number of KERNEL32 functions, followed by 3 USER32, 3 ADVAPI32, some OLEAUT32 functions, 4 more KERNEL32's, some other assorted functions, then even more KERNEL32s...I was under the impression they were generally in one group together?

Seen it before, it's normal, just watch out for the GetDialogBoxParamA problem (search thru Aspr postings for more info. It'll be a strange kernel function right smack-dab in the middle of a bunch of user calls, usually, but I've only seen that trick in one ASPR'd program I've done out of 15 or so

I realize ASProtect has been discussed quite frequently in the past (I've read some of it over and over again trying to find something I might have missed), but it was starting to drive me a bit crazy, so I decided to take a new small target, do what I can, document my steps and present it here hoping to maybe learn something else from the masters
Another thing:

if anyone gets a good dump of this, could you tell me how big your dumped EXE is?)
Will look tomorrow, looks like some fairly decent games mind-puzzle etc on that site.. crack all 11 of 'em :p
[/B]
Risotto
05-31-2002, 10:55 PM
Hola!

To use /tracex while unpacking AsProtected prog is no good nowadays. As you may have seen AsProtect tries to cheat you:

PUSH EBP
MOV EBP, ESP
MOV EAX, [ESP+0C]
MOV [004XXXXX], EAX
POP EBP
RET

Yep, this is it. Not to get to such a trap try to use other ways to find OEiP. One of the usable methods is to put a break point at GetModuleHandleA if(*(esp+4)==0) so the result will be passed to the main code. While Sice breaking, check esp and is there is something interesting for us, press F12 and several lines upper you'll see the very OEiP. In some realizations of AsProtect this approach can var, just try to look around.

To be cont...
Lbolt99
06-01-2002, 08:56 AM
Originally posted by Risotto
Hola!

To use /tracex while unpacking AsProtected prog is no good nowadays. As you may have seen AsProtect tries to cheat you:

Actually I've found /tracex to be INVALUABLE as far as finding the pre-oep dips that Asprotect does before the OEP is reached.

If it was Alexy's intent to screw with people using /tracex, by using the dips, he failed miserably: quite the contracy, it's what's allowed me to find EVERY pre-oep dip in all ASprotected targets I've looked at.

Just set thru the dip code, until it RETs back into the ASPR code, and /tracex again.. the oep code is usually pretty recognizable if you're experienced enuf :p
Risotto
06-01-2002, 10:19 PM
Originally posted by Lbolt99

If it was Alexy's intent to screw with people using /tracex, by using the dips, he failed miserably: quite the contracy, it's what's allowed me to find EVERY pre-oep dip in all ASprotected targets I've looked at.

G'day!

BTW, Alex likes reading such stuff and i do believe he'll take some measures. But in any way, you are absofuckinglutely right: one can /tracex till the very OEiP.

Best regards to Alexy! Êîãäà áóäåò íîâûé AsProtect, Àëåêñåé?

Agur, R!50770.
triz-
06-05-2002, 02:40 AM
Blargh. After screwing around with 15-Pack for a couple days off and on with no success (page faults aplenty :mad: ), I decided to follow an old tutorial of Splaj's to the letter as best I could. After a few minutes of searching (thank God for Google), I managed to find an old copy of Commview 3.1 and set upon it. Found OEP, dumped, rebuilt IAT, inserted into end of dumped.exe, changed entrypoint/IAT pointer, and ran.

"...has encountered an invalid page fault..." :confused:

I am totally stumped. The process in the tut works for Splaj but crashes every time I try it. Does ASProtect have something against Win 98 SE?

I have another question that comes from searching for "ASProtect page fault" (Yes, I actually searched before posting this :) ):

I noticed that Commview 3.1 has one break during a /tracex before the OEP (the usual 401014 RET junk), but 15-pack has several between that and the OEP. I was under the impression that these dips were only used by ASProtect and that when the EXE is dumped, these can be forgotten. From reading another post, I got the idea that this isn't true. With newer version of ASProtect, do you have to reinsert these chunks of code from the dips into the dumped EXE somewhere near the beginning, or can they actually be discarded?

I'm off to bang my head against the wall for a while now, so don't call the cops about that knocking sound....
Lbolt99
06-05-2002, 03:02 AM
Originally posted by triz-
Blargh. After screwing around with 15-Pack for a couple days off and on with no success (page faults aplenty :mad: ), I decided to follow an old tutorial of Splaj's to the letter as best I could. After a few minutes of searching (thank God for Google), I managed to find an old copy of Commview 3.1 and set upon it. Found OEP, dumped, rebuilt IAT, inserted into end of dumped.exe, changed entrypoint/IAT pointer, and ran.

Funny, I was just looking at 15 pack today, got sidetracked though. Will finish up hopefully tomorrow. Sounds like you might have put in the "actual" OEP instead of the RVA. A common mistake and I've done it before, if you accidently put in something like 4AEBB3 instead of just AEBB3 (the RVA) it's a sure page fault. So that's the first thing I would check.

BTW what you are dumping with? Try LordPE, when you're at the OEP, change the memory to an EB FE, so the instruction jumps to itself, locking the process, go to Lordpe, select 15 pack and Dump Full. LordPE will automatically realign the sections. LordPE is the easiest to use as far as dumping in general.

I noticed that Commview 3.1 has one break during a /tracex before the OEP (the usual 401014 RET junk), but 15-pack has several between that and the OEP. I was under the impression that these dips were only used by ASProtect and that when the EXE is dumped, these can be forgotten. From reading another post, I got the idea that this isn't true. With newer version of ASProtect, do you have to reinsert these chunks of code from the dips into the dumped EXE somewhere near the beginning, or can they actually be discarded?

The 401014 ret can be ignored, but all other dips have to be dealt with on a case by case basis. Here are some examples:

a) program initalization (chamemeon clock)

b) simple RET back to program code

c) set variables and RET

d) code decryption

e) other junk like HD hashes not frequently encountered

15 pack has 3 of the type c dips. write down the values in EAX that it writes into RAM. You'll see when to use them later on when running the program (indirect calls I think) It'll generally page fault but just restart and debug to where the fault happens and you'll see an access to the mem location that the dip wrote to, patch accordingly :)

FWIW I'm working on a compilation tutorial that will cover all aspects of the various recent versions of aspr as far as dumping, iat rebuild, dips, indir calls, etc. It'll be a good comprehensive reference, everything all in one place which will be good because alot of the good aspr messages are aging on here
foxthree
06-05-2002, 02:46 PM
People:

Yet another "2 min cooking guide to ASPR". :D

Latest ASPR targets OEiP Sig: 61, FF, E0 (POPAD/JMP EAX)

If Win98SE:

1. Run Process
2. Use OEPFinder Hybrid build to locate the OEiP Sig Bytes
3. Use ICELoad to load the process. Set BPMB X on 61 (POPAD) instr.
4. F5
5. SoftICE breaks. F8. You're at JMP EAX. Look at EAX == OEiP
6. bc *
7. /dump <IMAG BASE> <IMG SIZE> <FILE>

Now the best tool to build IAT? RV ? ImpRec? RV Plugin ? ImpRec Plugin? lol

If it is "traditional ASPR" [i mean not a special buld :p], my best bet would be ImpRec Plugin (ofcourse 1.42+) :D

IAT Rebuilding:

1. Locate Process in ImpRec
2. Enter OEiP/Get Imports
3. Show Invalid, Choose Level -1 (Disassembler) Whoa! 90% of IT is rebuilt :D
4. Show Invalid, Choose ASPR Plugin 1.2xx
5. "Congratulations. Will it works" he eh
6. Fix Dump. lol

ASPR is gone :( :cool:

BTW, I'm yet to notice any target that effectively utilizes the pre-dips. I mean, even if you bypass the pre-dips and dump at OEiP it shouldn't matter 99.9% of cases.

And btw, look out for the indirect calls ;)

Signed,
-- FoxThree

Pssst... triz- did you try caspr on this target ;) ...
+SplAj
06-05-2002, 10:17 PM
Triz-

I wanted to send you some infos but u have no e-mail available :(

FYA

ASPR made the following calls and stored them :-

[C16CE0] == GetVersion
[C16CE4] == GetCurrentProcess
[C16CE8] == GetCurrentProcessId
[C16CF0] == GetCommandLineA

You can understand that for trick API calls ???

Next the IAT :-
Line 67 C11280 is LockResource and
Line 95 C11290 is FreeResource

Your OEiP is correct. Always dump with LordPE (forget Icedump)

Patch in FF FF FF FF at offset 0x46AD4 and any size grid is available ;)

If you need more help e-mail me cos Kayaker is putting his steel toe cap boots on and ready to kick some butts .....and i'm gone

Spl/\j
Kayaker
06-06-2002, 06:57 AM
Originally posted by +SplAj

If you need more help e-mail me cos Kayaker is putting his steel toe cap boots on and ready to kick some butts .....and i'm gone

Spl/\j

Are you kidding? I don't even pay attention to these anymore. There's enough steel toed boots poised elsewhere, lol. Knock yourselves out :D

K.
Lbolt99
07-02-2002, 09:00 PM
Thanks for the tip but I'm having no luck getting it to start up after the 15 day trial :( Looked @ it with DeDe but can't make heads or tails of any of the form procedures with pertinance to any kind of comparison the program would be doing to "decide" whether or not to start up in trial or reg mode..

Unfortunately I'm finding removing asprotect to be the easy part of these cracks If someone could point me into the right direction on this one, I'd really appreciate it. It uses the Aspr internal reg method using a keyfile.. So I think the "decision" whether to run reg or trial is made in the ASprotect code if I'm right.. but I'm not sure what approach to use in this instance.

Originally posted by +SplAj

Patch in FF FF FF FF at offset 0x46AD4 and any size grid is available ;)
Lbolt99
07-11-2002, 08:17 PM
I figured it out.. I was dumping several of them AFTER expiration!! I installed 15 pack on another PC, dumped during eval period, it's working fine now.. got to remember to dump before expiration. My mind is cloudy right now, trying to focus on too many cracking projects at once..

I'm going to take a look at dumped expired vs dumped trial period and see if I can figure out what the discrepancy is.. recall it uses the aspr internal reg key scheme..


Something about Flexlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Something about Flexlm
PDA

View Full Version : Something about Flexlm

oyang2002
05-31-2002, 05:56 AM
I was studying a target protected by Flexlm7.2 some time ago,here is something interesting:)

1. In _l_ckout_string_key,you can sniffer the real license keys
(just as indicated by a new posted paper on woodmann's
website). And you can sniffer real encryption seed1 and seed2
here too,so vendor key5 can be got too.

2.There is a pointer at the offset of 6C of a job structure,
and *pointer[1D8] holds a dword standing for the type of
license key:
289BEB8A: long key including start date(20 digits)
66D8B337:short key(12 digits)
The document of Flexlm said there was key which is 16 digits
long,I haven't seen that:-(

3. For a long key,No 2,4,6,8 digits standing for the start date,
I don't konw how it was caculated:-(

4.Flexlm will complain if you set back your system clock.How can
it? It checks the time stamp of some files in specified directories
such as windows system dir,the installation dir of you target,
the root dir of the drive where your target resided.
I forgot the detail,so just trace _l_bad_date everything will be
clear! you can write a program to correct it.

5.When your license is bound to a dongle,eg
HOSTID=FlexID=6-12345678

'6' above stands for dongle vendor(Rainbow) IMOP;-) What is
that '12345678'? For SentinelSuperPro,it is a combination of
DeveloperID(Cell 1) and Dongle SerialNumber(Cell 0),the Flexlm
guys didn't use the dongle's advanced function at all!
:p

Here are my questions:

1.When I read the lmcodes.h of SDK,I found encryption seed3
and seed4. What's that? I can't find where they are used in
the document?

2.I downloaded FlexLM 8.0C from CrackZ's archive,but I have no
something protected with that,so I have no vendor keys.
Who can give me some clues?

:confused:


Sheriff acudata
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sheriff acudata
PDA

View Full Version : Sheriff acudata

Kilby
05-31-2002, 10:38 AM
OK folks heres an interesting perspective on an Sheriff acudata protected target.

Inksaver from hxxp://w0w.strydent.com/

Using the sheriff api I harvested the 4 secret codes as discussed last year, these are listed below.

Product ID: 9758-3050-1918-9292-6466

Secret Code 1: 0763-1985-3207-6621
Secret Code 2: 1854-2076-4198-7532
Secret Code 3: 2482-1593-2604-4927
Secret Code 4: 3739-0628-9517-9618

However it is still not possible to register because the app dosn't present you with an unique user code (as Sheriff call it).

I am assuming that the function SLS_GetMachineSignature in SlSapi.dll is the appropiate item to use to generate the appropiate user code.

As it would be a bit crap to use the whole acudata package to release a keygen, has anybody out there figured created a keygen for acudata protected apps ?

Perhaps this is not a good target to choose with the lack of the user code being made available, and another target should be chosen ?

Anyway this protection is so crap I would like to do a bit of work on destroying it, so any REAL info on it's internal workings would be apprectaied

By destroying I mean an essay with the thing laid bare, would be my preferred choice.

Regards,

Kilby...
+SplAj
05-31-2002, 02:18 PM
Hi Kilby,

I remember that laughable protection from the eEye Iris thread a while back, LOL some uber l337 rce god made a nice report :)
he chooses the swimming pool and sun bathing these days ;)

So, I have a solution to try. DAMN (Ivanopolo ?) made 'real' keygens for eEye targets. So get them, unpack and study them. Then all should be easy ?

Back to the match...Senegal 1 France 0 right now oh um :)

CYA

Spl/\j
Kilby
06-01-2002, 02:40 PM
K will look at those, as I I don't thin it would be too hard to remove the 4 (so called) hidden keys from the .exe :)

Acudata is actually worse than the bitarts stuff it's just so laughable.

BTW have you tried installing the latest version of crunce from Bi-Tarts, it won't install unless you create the install directory before running the installer Hehehehe.

Anyway I have just downloaded Frotz CE, so I'm off to play some infocom adventures in the park :)

Atleast Ireland managed a draw.

Kilby...
foxthree
06-01-2002, 03:40 PM
Hi Kilby/+SplAj guru:

He he nice one on Sheriff's protection scheme.

BTW, I tried this on I*i* 3.80 (latest) by eI ;) Man is tE! tough. But not tough enough :D... BTW, Laurentino has not implemented the CreateMutex stuff here. One less thing to worry abt :D

Some things that I found are:

There is no need to bpx any APIs for getting the secret codes. Use any decent RAM Viewer (such as WinHex) and you'll see all the four secret codes right next to the Product ID. What shit!!! They don't even decrypt/destroy it on-demand.

I managed to generate a key for I*i* vis SLSAPI.

Kilby, all you'll have to do to avoid shipping the entire SDK is to download the static libraries (thanks Sheriff ;)) and link it with your VC++ application to generate the keys. Nobody would even know that you're using SLSAPI's internally ;). Infact, there will not even be a need to "ship" the SLSAPI.dll as the calls are statically linked in your keygen App. lol ;)

Crypkey was far tougher than this ;)

BTW, I wouldn't be doing justice if I didn't say this: Thanks +SplAj guru for your "funny" write up... or should I say "RCE God" :)

Signed,
-- FoxThree

PS: I borrowed your subject for this post. Hope you don't mind ;)
foxthree
06-02-2002, 02:50 PM
Hello:

On another interesting side note:

The first two xxxx-xxxx of the Secret key codes for the I*i* and the InkSaver product are "identical"

For InkSaver:

Secret Code 1: 0763-1985-3207-6621
Secret Code 2: 1854-2076-4198-7532
Secret Code 3: 2482-1593-2604-4927
Secret Code 4: 3739-0628-9517-9618

For I*i*:

Secret Code 1: 0763-1985-xxxx-xxxx
Secret Code 2: 1854-2076-xxxx-xxxx
Secret Code 3: 2482-1593-xxxx-xxxx
Secret Code 4: 3739-0628-xxxx-xxxx

Does this mean the first two parts of all SLS keys are the same? What gives :D?

Signed,
-- FoxThree
Kilby
06-03-2002, 12:00 PM
The keys also start the same for the demo app supplied with the accudata sdk too :)

Kilby...
evaluator
06-03-2002, 05:15 PM
Hello, foxtree!

You missed in Iris one THING!

If you have DEMO downloaded from ...
so it is DEMO, e.g. you can find & calculate any
correct SLS-key, but Demo not become registered:)

***********
Don't use search,
Don't read FUQ
:):):):):):):):):):):):):)
foxthree
06-03-2002, 06:49 PM
Hi Eval:

Yes, indeed. I did notice that. No graphs, no stats :(. Laurentiu I think gives a "demo" only version always with no code. Or am I wrong?

Anyways, my interest was in Sheriff Protection Scheme which alas, not seem a match for us :D

Signed,
-- FoxThree


reversing "system tools" under w98
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > reversing "system tools" under w98
PDA

View Full Version : reversing "system tools" under w98

mike
05-31-2002, 08:16 PM
Under system tools in win98 there's a program that lets you see all the vxds that are running, look at startup registry items, and see what hooks are installed by which programs. This has the makings of a great privacy tool: record the info and if any of it changes, alert the user.

I haven't ever found any code that reliably traverses the vxd chain under w98; there's some that kluges its way thru under w95.

Is anyone interested in working on that?
Kayaker
06-01-2002, 07:38 PM
Hi

There's some interesting possibilities there Mike for a system device driver monitor hook utility. You could hook relevant VXDLDR services to monitor a host of system actions. You can hook pretty well any system call with VMMCall Hook_Device_Service.

;---------------
GetVxDServiceOrdinal eax, Service ; Virtual device or VMM service to hook.
mov esi, OFFSET32 HookProc ; points to the hook procedure to install
VMMCall Hook_Device_Service
jc not_installed ; carry flag set if error

Allows one virtual device to monitor or replace the services of another virtual device, or of the VMM itself. ESI contains the address of the specified service.
;---------------

For example, you can monitor system level drivers being loaded and unloaded with the following code:

GetVxDServiceOrdinal eax, VMM_Add_DDB
mov esi, offset32 BeginHook
VMMCall Hook_Device_Service
jc initfail1

GetVxDServiceOrdinal eax, VMM_Remove_DDB
mov esi, offset32 BeginHook
VMMCall Hook_Device_Service
jc initfail2

Here's an example to install a hook to watch for MS-DOS apps starting:

mov esi, offset32 MyHook
GetVxDServiceOrdinal eax, DOSMGR_Begin_V86_App
VMMCall Hook_Device_Service
jc Error

Icedump uses this technique for several hooks in cmd_trace.asm, including Get/Set_Thread_Context.

What is interesting is that you may be able to _implicitly_ hook Win32 functions as well. There are dozens of registry and memory services you could hook that Win32 APIs may eventually call down to at the system level.

I was poking around in msisys.vxd, which is the driver Msinfo.exe uses, to see what service it hooked (this is the monitoring program Mike is talking about). Here's another example of MS being mysterious, the service being hooked is coded directly as a hex value and isn't retrieved with GetDeviceServiceOrdinal.

ICOD:C0001000 mov esi, offset loc_0_C000214E
ICOD:C0001005 mov eax, 10190h
ICOD:C000100A VMMCall Hook_Device_Service

It wouldn't be that difficult to design something, people would just need to learn how to write a vxd. The MS Device Driver Kit file Other.chm and Iczelion's vxd writing tutorials are all that is needed. I could supply a vxd skeleton interfaced to a basic GUI written in MASM as a starting point if anyone showed any interest. It is no different from coding in Win32, just done with different API calls within a vxd framework. Getting a listing of the Kernel and DOS drivers loaded on your system is coded using VMM_GetVxDLocationList for the static and VXDLDR_GetDeviceList for the dynamically loaded vxds.

In the interest of generating interest, here's a little code which traverses the linked Device Descriptor Block (DDB) chain, which is added to when a driver is loaded, and searches if Icedump is present. If it is, the ascii text defining it is patched so it can't be recognized by some lame attempts at Icedump detection. See the mini-project "int 20 (hinte's crackme #6)" for more on this and some descriptions of the calls and structures used in the code. This is the Icedump protection I wrote against the crackmes detection attempt.

VxDCall VXDLDR_GetDeviceList

@@next1:
mov ebx, [eax+5] ; VxD_Desc_Block *DI_DDB
cmp ebx, 0C0000000h
jc @@next_vxd1

lea ecx, dword ptr [ebx+0Ch] ; DDB_Name
cmp dword ptr [ecx], 'DECI' ; "ICED"
jnz @@next_vxd1
cmp dword ptr [ecx+4], ' PMU' ; "UMP "
jnz @@next_vxd1

PROTECT1:
;patch name
mov byte ptr [ecx], 0
jmp Exit_OK1 ; clean exit, patch successful
ENDPROTECT1:

@@next_vxd1:
mov eax, [eax]
or eax, eax
jnz @@next1
jmp Exit_Notfound1

There is an example with source at Iczelion's which shows how to get a listing output of the system drivers as well as the IDT/LDT/GDT descriptor tables and a dump function.

http://win32assembly.online.fr/files/sysview.zip

Any takers?

Kayaker
Clandestiny
06-03-2002, 01:30 AM
Interesting project idea... Was going to reply to this one and post some info about the traversing the DDB chain, but damn! Kayaker, you're just too thorough! ;) Unfortunately, I don't have time to get involved in another project, but if anyone decides to learn how to write a VxD, either Kayaker or myself will be glad to lend assistance. He's right... Its not that much harder than writing regular ASM, just a different format, a different set of APIS, and many more opportunites to play with fire and get burned ;)

Clandestiny
Woodmann
06-03-2002, 01:44 AM
Howdy,

Ya'all kick it hard !!!!!
It scares me sometimes :-)

Peace, Woodmann
mike
06-03-2002, 03:46 PM
What tools do I need to start? An assembler, obviously. Anything else?
ZaiRoN
06-03-2002, 06:39 PM
hi,
something to learn? i'll join the cause! :D
i don't know not much about vxd but (exams allowing) i'll be of yours.

i think we can begin the project but i have a little question: what exactly the project will be? just traversing the DDB chain?

bye,
ZaiRoN
foxthree
06-03-2002, 07:43 PM
Hey Kayaker:

Hmm if there is space for one more, I'd like to hop in too. I too don't know much about VxD but I could learn :)

Signed,
-- FoxThree
ZaiRoN
06-03-2002, 08:13 PM
hi foxthree,
welcome on board!
more we are and better it is :)

ciao,
ZaiRoN
Kayaker
06-03-2002, 08:36 PM
Cool, let's kick some ass hard, lol. Long live Ring0 exploits, heh heh. There's plenty of potential here for reversing fun 'n games, as well as building better protections. To get some idea of the how and whys of system driver hooking, try a Google search for Hook_Device_Service and check out what's been done before. Here are a few examples:

-Some general explanations of vxd hooking and how a keyboard hook can be implemented. Written by some dude named +Fravia, never heard of him but he looks to become a promising reverser :D
http://www.woodmann.net/fravia/filemon5.htm

-More important generalities in coding a hook. Take note of the BeginProc macro style required to unhook the hook (this is explained further in the DDK docs):
http://www.searchlores.org/protec/rcg_vxd2.htm

-Some discussion of Registry Services which can be trapped to monitor opening, closing, creating, and deleting Registry keys and values. Also, using IFSMgr_InstallFileSystemAPIHook to monitor file access. As used by the install monitor InCtrl4:
http://www.ntu.edu.sg/cits/software/download/inctrl4.htm

-An example of capturing dialup passwords by hooking services exported by VCOMM.VXD:
http://www.phreedom.org/article.php?id=30

...post continued...
Kayaker
06-03-2002, 08:38 PM
As for what's required, you need to d/l one of the Microsoft Windows Driver Development Kits at
http://www.microsoft.com/ddk/

I guess you can accomplish this with an NT/XP/2000 driver as well, but for Win98 you can get the necessary DDK components at
http://www.microsoft.com/ddk/install98ddk.asp#Segments

The full install is 25.8Mb, but I think you can get away with just the following two. What is needed are the Include files and the file Other.chm:
http://www.microsoft.com/ddk/download/98/98SETUP.EXE
3.4Mb
http://www.microsoft.com/ddk/download/98/OTHER.EXE
3.7Mb

As for what you want to write it in, I use MASM v.7, but there is a tool called VxDWriter which you can use to write it in C/C++. Other docs include

Iczelion's vxd writing tutorials
http://spiff.tripnet.se/~iczelion/tutorials.html

[Yates] - a set of 3 vxd tutorials, I won't insult anyone by not assuming they can't search for these ;)

Also, d/l the Virtual Machine Manager Services (VMM) Help file that I uploaded in a previous vxd mini-project. This isn't a replacement for the DDK file other.chm, but it does contain some of the same info:
http://www.woodmann.net/forum/showthread.php?threadid=1915

Heh, that mini-project may not have gone anywhere, but the hard-to-find VMM help file was downloaded 298 times, lol! I wonder sometimes if people hoard everything they can get their hands on just for the sake of it...

One more thing, about what I said about the disassembly of msisys.vxd not showing which service was hooked, in retrospect "duh, of course not!"
This is because
GetVxDServiceOrdinal eax, Service
is a macro, defined in vmm.inc. So if you code in the name of the Service to be hooked, it is compiled as a ServiceOrdinal value, any name information disappears. The high word of the ServiceOrdinal is the VxD ID and the low word is the service number.
For the record, the call that was hooked by msisys.vxd was VMMcall Log_Fault_Call_Out. Check out the VMMCall list compiled by Daemon for a quick way to find out unknown VMM service numbers:
http://www.anticrack.de/daemon/VMMCalls.txt

That's about it for now I guess. I don't think there's really any "project" here yet, just throwing out some ideas along the lines of a system monitoring tool of some kind, or general vxd coding or whatever. It's pretty well open to suggestions or whatever direction people might take it. I'm working on a very basic implementation of a hook right now which will trigger when a dynamically loaded driver is loaded (hooking VMM_Add_DDB). If I get it working I'll up the source as a template, the hook can be replaced with any other.

What's important I guess is what you do *with* the hook. Other than making the actual hook and/or informing the user, I haven't really thought that far ahead yet, lol.

Kayaker
Kayaker
06-06-2002, 04:35 AM
Hi All,

OK, here's a little something, an example showing how to set a system hook using VMMCall Hook_Device_Service from within a VxD. The example hooks VMM_Add_DDB, which can be used to detect application system drivers being loaded. When a hook occurs, a system modal error box is displayed showing information gathered about the driver being loaded and allows for user input. Further action can be taken or the information can be sent back to Win32.

The example can be used as a vxd skeleton or the hook VMM_Add_DDB can be replaced with any other to try out different hooks. Commented source is included, though you'll still need the appropriate include files from the Win98 DDK to compile it. The hook routine could in theory be placed in a static vxd as well that loaded on system startup.

Setting a Kernel or application driver hook has interesting reversing potential. I haven't yet tested creating a hook after accessing Ring0 in 'non-traditional' ways, i.e. without using a vxd. It may be possible, but there can be reentrancy issues with calling certain system level functions in a self-generated interrupt, let alone creating a further hook from within an ISR. Clandestiny has tried certain VxDCall IFSMgr_Ring0_FileIO calls from within a Ring0 interrupt routine, and there were several issues with this. These may be confined to file I/O calls though where timing may become a problem.

In any case, I hope someone learns something from this, and maybe we could get some feedback from anyone trying a different hook, or maybe has further ideas as to a type of tool we could develop with this knowledge.

Have fun,
Kayaker
ZaiRoN
06-06-2002, 06:17 PM
hi Kayaker!
this source is added to the readings that carry me in this new vxd_world :)
thx..

ZaiRoN


Wdasm Crasher
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Wdasm Crasher
PDA

View Full Version : Wdasm Crasher

naides
06-01-2002, 04:36 AM
I apologize in advance if this topic has been addressed before. I DID search back in this board as well as with google before posting the question, and, perhaps due to poor choice of search keys, I came empty handed.

I am trying to dissasemble some exe files from an app called Radmin.
When I try to load it into W32dasm 8.93, the Dassmblr crashes. It crashes immediately, before it has even tried to preprocess or process the jumps. I vaguely recall either a tut or a posting in this board describing an anti Ddasm trick based on the size or characteristics of the segments in the PE header.
May anybody be so kind as to point me to the right posting or document or give me some light about this anti Wdasm trick?

Note: IDA does disassemble the proggie without protest, but I am in the lower part of the learning curve using that tool.

Thanks in advance
Pyrae
06-01-2002, 05:07 AM
There are (sadly) quite a lot of 'tricks' to make W32Dasm crash. :(

The section characterisics one is actually rather simple. I don't recall the exact meaning of each bit flag atm, but changing the section characteristics for the code section (the one your OEP is located in) to something like E0000020 or E0000060 should help you to overcome this one...(but I don't think this trick is used in your app either, as it usually doesn't make W32Dasm crash, instead of making it refuse to disasm anything at all).

Here are some other quite common ones (taken from Bengaly):

1. Infinite Jumps (EBFE) <= make w32dasm to crash
2. Big Resource size <= make W32dasm to stop respond
3. Inline Calls: Call [Call xxx] makes W32dasm to loose data
4. Unreachable Jumps.

As for IDA, I'm suffering a lack of experience on it, too. :(
But as you might have noticed, IDA is the way to go for pros...
JMI
06-01-2002, 11:29 AM
If you check out the AntiCrack sticky from Kayaker in the Newbie Forum you will find a section in the articles on anti-disassembly and anti-debugging with answers to your questions.

For example, here's a post from ?ferret:

most use a couple of jumps at the beginning that are never actually executed in the proggy...a loop solely intended to f**k up w32dasm.

400000 JMP 401000
401000 JMP 400000

or somehin like that...

this keeps the disassembler busy processing jump references til it run out of RAM and locks.....

pretty smart thinkin, but ez to defeat after u figure it out.....if u run across a proggy that does this, open it up in a hexeditor and nop those jumps (they aren't executed anyway)

?ferret

There are others. Try also "anti-disassembler" in google. I got 27 references in several languages.

Regards.
esther
06-01-2002, 04:19 PM
Hi naides,

Try a clean w32dasm.which is not patched.just my tw0 c3nts ;)
naides
06-04-2002, 09:11 PM
Thanks to your sugestions I made real progress with this app.

As I said before Wdasm crashes quite early in the process, so infinite jump loops, unreachable jumps or calls did not seem to be the problem. The bulk of the code is not packed.
The size of the segments was not unreasonable.
The key to the trick appears to be unconventional names in the .rsc section, which ckrashed Wdasm when it tried to locate them. Simply deleting the .rsc section allows Wdasm to work.

Kayaker had described a similar problem in a posting around sept 2000, which is available in the www.anticrack.de site

Actually, the protection is quite interesting, I needed a solid dead listing to be able to follow the license key validation. Doing it by Sice tracing is a sure way to a nut house.


try this crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > try this crackme
PDA

View Full Version : try this crackme

SaNGa
06-01-2002, 05:53 PM
I wrote this simple crackme, tell me about my work!

http://space.tin.it/clubnet/esangale/clubnet/esangale/tutorials.htm
ZaiRoN
06-01-2002, 06:45 PM
hi SaNGa,
i have tried and done it. :D

i don't think it's the right place to put this thread.
maybe "mini project area" is the right place; it's an easy level and could be a little mini project for newbies.

ciao,
ZaiRoN
[NtSC]
06-02-2002, 02:51 PM
-------------------------------------
Fishing a Serial for Sangas CrackMe1
-------------------------------------
Tricks: - Bpx-Check (CC)
- MeltIce

- MeltIce-Check is executed after startup..

Bpx CreateFileA +1 -> e eax 00

Name : [NtSC]
Serial: 123456

017F:004031D4 5B 4E 74 53 43 5D 00 00-00 00 00 00 00 00 00 00 [NtSC]..........
017F:004031E4 00 00 00 00 54 45 56 42-46 56 00 00 00 00 00 00 ....TEVBFV......
017F:004031F4 00 00 00 00 00 00 00 00-31 32 33 34 35 36 00 00 ........123456..

Correct Serial: TEVBFV
:D
SaNGa
06-02-2002, 07:50 PM
Originally posted by [NtSC]
-------------------------------------
Fishing a Serial for Sangas CrackMe1
-------------------------------------
Tricks: - Bpx-Check (CC)
- MeltIce

- MeltIce-Check is executed after startup..

Bpx CreateFileA +1 -> e eax 00

Name : [NtSC]
Serial: 123456

017F:004031D4 5B 4E 74 53 43 5D 00 00-00 00 00 00 00 00 00 00 [NtSC]..........
017F:004031E4 00 00 00 00 54 45 56 42-46 56 00 00 00 00 00 00 ....TEVBFV......
017F:004031F4 00 00 00 00 00 00 00 00-31 32 33 34 35 36 00 00 ........123456..

Correct Serial: TEVBFV
:D

Good job [NtSC]!:D

Have your tried to patch the executable?
[NtSC]
06-03-2002, 05:49 PM
Hi Sanga!
Nope,i didnt try patching it,why?
CRC over previous Code ?;)

A good hint to walk with on your CrackMe is to let it run + dump it.
So its easy to obtain your decrypted Strings.. MeltIce:D

But finally ... Patch?..
What kinda patch do u want ? tell me ;>
SaNGa
06-04-2002, 08:50 AM
If I tell you, it will easier!:D

...try yourself! ;) good luck
[NtSC]
06-04-2002, 06:06 PM
Patch-Adress: 40109c - New Bytes: e9 85 00 00 00 - Result: Kill MeltIce-Check
Patch-Adress: 4014e0 - New Bytes: 90 90 - Result: Any Serial Valid

I dont see any Tricks that stop me to exchange my Patch-Bytes with your original Ones.

So i dont see the Patching Challenge really at the Moment..
ZaiRoN
06-04-2002, 06:47 PM
hi [NtSC],
you are right!
two bytes-patch and the crackme will accept all name/reg combo.
i want to add a little thing about the proggie. i don't know if it's a bug or is a feature of the crackme but it accept only 1 valid name/reg combo. if you try a second time the proggie will crash. this because the call in 401470 receive GetDlgItemTextA and not the encrypted string....

bye,
ZaiRoN
SaNGa
06-04-2002, 07:01 PM
Originally posted by [NtSC]
Patch-Adress: 40109c - New Bytes: e9 85 00 00 00 - Result: Kill MeltIce-Check
Patch-Adress: 4014e0 - New Bytes: 90 90 - Result: Any Serial Valid

I dont see any Tricks that stop me to exchange my Patch-Bytes with your original Ones.

So i dont see the Patching Challenge really at the Moment..

I've done a bullshit! :D
...the crackme code should be self-modify its critical sections...but I forgot the jne at 4014E0h :p
Sorry to everybody for this bullshit crackme :rolleyes:
I think that I have more and more experience to done!
I've attached the crackme suorce code...
SaNGa
06-04-2002, 07:06 PM
Originally posted by ZaiRoN
hi [NtSC],
you are right!
two bytes-patch and the crackme will accept all name/reg combo.
i want to add a little thing about the proggie. i don't know if it's a bug or is a feature of the crackme but it accept only 1 valid name/reg combo. if you try a second time the proggie will crash. this because the call in 401470 receive GetDlgItemTextA and not the encrypted string....

bye,
ZaiRoN

This is another my bullshit :rolleyes:
Thank you for reporting ZaiRoN

ciao
ZaiRoN
06-04-2002, 07:10 PM
hi SaNGa,
don't discourage yourself! "mistaking it is learned"
i hope to see your next crackme and thx for the source :)

ciao,
ZaiRoN
[NtSC]
06-04-2002, 08:13 PM
Yes. I also noticed the Crash..
But anyway.. I would say it wasnt bad for your first CrackMe.

Nice Ideas that latly would keep some Newbies in Trouble :>
Looking forward for the next Challenge

Cheers,[NtSC]


i search Rsa-tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > i search Rsa-tools
PDA

View Full Version : i search Rsa-tools

tHE SnaKe
06-01-2002, 06:30 PM
please help me!
i search rsa-tools by tHe EGoîsT
foxthree
06-01-2002, 07:56 PM
I have it. PM me with your email address.

Signed,
-- FoxThree
Bengaly
06-01-2002, 09:25 PM
take
tHE SnaKe
06-02-2002, 12:29 AM
thanks for your attachment
good night


Help determining cypher...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Help determining cypher...
PDA

View Full Version : Help determining cypher...

FEARHQ
06-01-2002, 08:56 PM
I'd like to start off by saying that I don't know a great deal about cryptography, but I'm willing to learn whatever I need to attain my goal.

My thing is that there is this custom client that uses the IRC protocol to communicate, with minor adjustments, and I'd like to reverse the protocol.. I can do that, BUT... The session starts by requesting some key then encrypting itself... Here are the details

Seems like flavor of DES since it sais so in one of the lines... but... Here are 2 full decoded sessions (IRC protocol - 2 sessions)

http://balder.prohosting.com/~fearfxf/txt1.txt
http://balder.prohosting.com/~fearfxf/txt2.txt

In adition, there are some keys that I have found in the .data section of the PE. Are these jibberish?
http://balder.prohosting.com/~fearfxf/keys.txt

Does anyone recognise any of this? Or can you tell me where I can start?
mike
06-02-2002, 03:07 AM
My thing is that there is this custom client that uses the IRC protocol to communicate
What's the target? Do you have a copy?
The session starts by requesting some key then encrypting itself
Requesting keys from whom?
Seems like flavor of DES since it sais so in one of the lines
Lines of what?

BTW, reading a dumped transcript of a protocol is like reading code. It needs to be formatted and commented if anyone is going to look at it for you.
FEARHQ
06-02-2002, 04:38 AM
Cool, a reply!

The target: Gamespy Arcade. Newest version. www.gamespyarcade.com.

The key is requested from the server. On line 2, client sais "CRYPT des 1 gslive" ending with 0D 0A ASCII characters. 0A usually ends an IRC command if I'm not mistaken right? I'm takind it that CRYPT des means crypt using the DES algorythim, or a variation of it... mabe... Then :s 705 -> being a custom reply from the server as I've never seen the 705 reply nor can I read about it anywhere. Probably means key from what I can understand. It is followed by a 16 ASCII character key or something, than a space, probably seperating from another key that is also 16 characters. So I see that there are 2 keys involved from the server (at least I think). The statement still isn't crpyted as it ends with 0A, a terminator, and starts with a perfectly legal IRC server reply... Now from then on, all statements are encrypted. And it shows!

So this crypting algorythim has at LEAST 2 keys, might use some of the things I fished out of the PE... If anyone needs the essential files necessary, please tell me in this thread :) I'm glad I got some attention
mike
06-03-2002, 12:32 AM
Yeah, "crypt des" sure sounds like DES. The key will be 56 bits long. I guess there'd be two ways of doing it. The first would be to send the client a DES key from the server, which would be trivial to break--just pick the key out of the transcript. That's the dumb way, and I doubt they'd use it.

Second, and more likely, is some kind of public key system. They might use the diffie hellman key agreement protocol or perhaps RSA. If it's RSA, the request would be for the server's public key; the client would respond by choosing a random session key, encrypting it with the public key and sending it back. Then all further communication would be encrypted with that key.

I think RSA is more likely than D-H because with D-H, each client would need its own private key. Do you know if any key-generation happened at any point?

The upside of all of this is that you'll certainly be able to find out what's being sent (received) because your client has to encrypt (decrypt) it. Once you find the encryption code, you can just stick a breakpoint on it and be able to look at the cleartext before it gets sent (and after the stuff from the server gets decrypted).
FEARHQ
06-03-2002, 03:48 AM
You know a great deal mike! Thanks for helping me out here. I posted similar things on many boards, and no one was able to even reply. I'll read up a little on RSA. The public key changes though, if you check the logs. Does that seem right? I read that DES needs a 56 bit key, dunno about RSA... Aparently 2 public keys are sent, 16 characters each (128 bits), seperated by a space. Normally, what are the standards of RSA? what is the public key length (s)? and I don't really understand how this system is more secure.... I will need to read up more on this :) Back to google. The trivial session key would be encrypted by the public key and then what? I mean the encryption/decryption key HAS to figgure in the transcript, or all (most) of the elements to recreate it. Is it possible? What are your thoughts on this subject?
mike
06-03-2002, 03:44 PM
The typical key length for RSA is on the order of 512-1024 bits. RSA works like this:

Bob wants to be able to receive encrypted messages. He chooses two large primes p and q of equal bitlength and calculates n=pq and phi(n)=(p-1)(q-1).

"phi(n) is the order of the multiplicative group in the ring of integers mod n." That means that for any number b coprime to n,

b^phi(n) = 1 mod n

and also that for any integer exponent x

b^x mod n = b^(x mod phi(n)) mod n.

Bob then chooses an encryption exponent e; usually e has a small hamming weight.

e=2^16 + 1

is a popular choice. He then calculates d=e^-1 mod phi(n). He publishes (n,e) as his public key and keeps (n,d) secret. He erases p and q.

If Alice wants to send him a message M, she computes

C=M^e mod n

and sends it to Bob. Bob computes

C^d = M^ed = M^1 = M mod n.

In the second model I described, Alice is the client and Bob is the server. Alice asks Bob for (n,e). She chooses a random 56-bit number r, computes

C=r^e mod n,

and sends it to Bob. Bob computes

r^ed mod n = r mod n

and then encrypts the rest of his traffic with r using DES.

If the server did the stupid method, it would send the key in the clear. I have no idea what two 128-bit numbers would be used for with DES or RSA or D-H. They're too small for RSA and D-H and too big for DES.
FEARHQ
06-03-2002, 11:51 PM
So aparently it looks like some custom encryption... I suppose that means deeply studying the assembly code :)

Thank you for your help, very well explained. I'll have to put this on hold for now. Mabe in a couple of months...


Sas
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sas
PDA

View Full Version : Sas

r00t
06-01-2002, 09:16 PM
Anyone ever tryed to reverse the protection system in SAS?.
(It's an statistics tool, version 6.12, isnt the latest).

The entire system is distributed in about 300 dll's.
Its really hard coz i guess it decrypts each one of the dll's with the license file.

Any info appreciated. Greets.
nud
06-02-2002, 07:24 AM
I looked at Sas very briefly when I ran across a copy with an expired license a couple of months ago. I found plain-text license files for it on the web, but they didn't help. The license-verification system appears to be pretty complicated. Filemon indicated that, as you say, lots of files seem to be involved.

I was told that there is no valid license file for Sas versions that are expired. People whose copies expire have to buy a whole new version of the program, not just a new license file. I don't know for sure if that's true (the Sas web site probably says something about it), but if it is, then you'd probably have to patch it to get it to run.

I gave up because it looked like too much work, and the big prize if you succeed is that you get to write ugly old Sas programs.
r00t
06-02-2002, 08:23 AM
After a very detailed investigation, it seems that the dll involved in all the license check is SASXINI.DLL.
I was able to make it run, but very forced. (some options dont works).
Cps530
06-09-2002, 02:41 PM
The current SAS version is 8.2 (after 7.0, 8.0, 8.1). 6.12 is an old release but the protection is quite similar. The protection is based on several information the user must give: the site number (given by SAS Instititue), the modules you bought (there is a lot of them; the 'base' is required), and the expiration date (internally, SAS uses the number of days between the date and jan/01/1960). All the information is used to calculate the 'setinit', a number. When all the information (including the correct setinit) is submitted to the SAS system, the licence is updated and one can use SAS till the expiration date. After the expiration date, it's posible to use SAs during the next 90 days and after that... bye, bye! The protection does not reside on only one DLL as said.
r00t
06-09-2002, 11:30 PM
I was able to reverse all the protection, (i guess).
It was all in Sabxinit.dll. (U can patch it and it run flawlessly).
I have version 6.12. Which version u investigated?.
Im planning to get v 8.1 to reverse.

Greets.
Cps530
06-10-2002, 12:39 AM
You can patch the DLL, but the options (the modules permitted to be used - about 20) are set in another location. I think you will not be able to make them work (all of them!). SAS works with DLL's and 'catalogs' (in version 6.12, they had the extension *.sc2). The current version is 8.2.


How to rip out ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to rip out ...
PDA

View Full Version : How to rip out ...

Risotto
06-01-2002, 10:31 PM
Hello!

Who knows how to rip out some prog protected wth the last Armadillo? As it doesn't create temp files, where can be got a virgin proggie, like it was before?

Bye!
JMI
06-02-2002, 12:38 AM
Risotto:

There is a search button on the forums. You apparently still haven't used it. There is a great deal of information about your favorite protector in that search form and several members, including me, have referred you to places to get more knowledge. Have you taken the time to do that or do you just want someone to hold your hand through the latest release of Armadillo and GIVE you the answer. You have already had a long post under the title of "three questions" which suggests that either your understanding of the concepts still needs work or you aren't understanding the help you are getting from the guys who play with this stuff alot. Read some more, study some more and try things yourself and then ask focused questions.

Regards.


old encrypted cd
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > old encrypted cd
PDA

View Full Version : old encrypted cd

kqt
06-02-2002, 12:38 AM
hello all
I recently bought a used prog for $2 with a bunch of fonts on it.
Its a multi-os cd that will work with win, mac, or 2 different kinds of unix. Its old 16-bit. It works this way..you browse the cd for fonts you want to buy, call the manufacturer, give them your customer key and credit card, and they give you unlock key to the fonts you bought. I thought "interesting". So I install in win 98. Installation takes a 23 digit password and your name, after install, I find in c:\windows a xxx.ini file with my name and a 20 digit "serial number". I run the prog and choose a font. Dialog informs me of my 22 digit "customer key" which is very similar but not the same as "serial number" in xxx.ini. Dialog then asks for 15 digit "unlock key"-box only accept numbers and auto-arranges into groups like:xxx xxxx xxxx xxxx. So I type fake unlock key and bpx getdlgitemtext.Previous dissasembly provided no clues to strings in error message about "wrong key", so I trace slow to find the offending call. I find the call, and inside are 20+ other calls. Watching registers as close as I can I find in memory my name, the original install pass,the 20 digit "serial number" from xxx.ini and my fake "unlock key".Also there is a 10 digit mystery number that is read from and written to several times, and my unlock key gets converted to other numbers than I originally entered. The check is not obvious, every time I think I see a check moving through ax 1 byte at a time, it is really one the other strings being read. Also there are pointers to a thing that looks like : 0 # 0 # 0 # 0 # 0 # 0 #.....And in the install directory and the cd is wierd hidden file "cdr0m.des" with no obvious entry point to dissasemble from. What should I be looking for here??? I can manage to reverse all conditional jumps leading to error message, forcing prog to spit out a font, but its still encrypted the way its stored on the cd, so......proper "unlock key"=decrypt key.....Right?? Are there ways to identify encryption algo similar to ways of identifying commercial protections like dongles and packers? Could "unlock key" be bruteforced by attaching to the process of the dialog box? I actually own 1 font that is on the cd in non-crypt form, could it be compared to the crypt one to find key like "known plain-text"?? Some searching revealed that the cd was supposedly made from a number of different masters to prevent a generic crack from being made, encryption algorythm different on each master, and that each time you install, new "serial number" is generated. Also, unamed graphics software giant no longer makes or supports this product, couldnt buy the fonts anymore if you wanted to, which makes it even more interesting to me. A last note, prog traces in softice with no apparent problem, but out of curiosity I loaded frogsice and crash! error 10 debug registers..something about call dos3call...jn zxxx.... int 21...is this just a fice bug or real antidebug???
Any input appreciated
thanks
kqt
Woodmann
06-02-2002, 01:12 AM
Howdy,

Old school encryption......

Your trying to hard methinks. XOR'ing and 16 bit encryption should turn up what you desire.
I believe you can find that somewhere on this place.

The lazy one can try DECRYPT.

Peace, Woodmann
kqt
06-04-2002, 01:24 AM
Thanks for the reply, Woodman
I havent found my answers yet, but I'll keep trying....
I was searching on 16-bit crypt and xor crypt and ran
into this...maybe people here have read this stuff
already, but it's new to me and seems written in a
very concise and informative way.....
h**p://polywog.navpoint.com/reveng


sentinel lm sdk (lsdecode)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sentinel lm sdk (lsdecode)
PDA

View Full Version : sentinel lm sdk (lsdecode)

javelin
06-02-2002, 05:33 AM
just wondering if anyone knows how to make lsdecode output all of the license infromation form an license?


call [eax+xx]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > call [eax+xx]
PDA

View Full Version : call [eax+xx]

The Keeper
06-02-2002, 06:28 AM
Hi,

i have a program which uses a dll to generate the code, but to call the functions inside the dll it does call [eax+xx] where xx is a number..how would a program do that ? shouldnt it loadlibrary the dll then getprocaddress and call the function ? weird..if someone can explain.

thanks in advance.
Dr.Golova
06-02-2002, 02:43 PM
Looks like it's call to some virtual function (class method), so eax must contain instance of some class (may be point to it's vtbl, but i'm not sure).
The Svin
06-02-2002, 03:03 PM
shouldnt it loadlibrary the dll then getprocaddress and call the function

If the dll in import table the is no need to call LoadLibrary.
Here is example from my code where I call three
Win32 API but you can not say what API:

mov esi,Procs[edi*4]
@nextcall:

Scall dword ptr [esi],0,ebx ;here is API dll call
test eax,eax
je @nextid
push eax
invoke udw2str,ebx,offset number
invoke SendMessage,hListBoxes[edi*4],LB_ADDSTRING,0,offset number
pop ecx
invoke SendMessage,hListBoxes[edi*4],LB_SETITEMDATA,eax,ecx

@nextid:
cmp ebx,32999
inc ebx
jc @nextcall
inc edi
jnp @B

It's code from very simple programming utility, nothing about hacking or antidebug, just my way optimized working with external calls.
Actually it calls LoadBitmap, LoadIcon, LoadCursor.
I don't use in the proc usual jmp API table, but if I
had, the external calls of the above code could be addressed as
call [edi*4+Procs]
very simular to your code example.

BTW to the mode:
I used code / code tags but some strings yet wrapped, what I've done wrong?


Greetings,
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Greetings,
PDA

View Full Version : Greetings,

hobgoblin
06-02-2002, 09:45 AM
I found it. Sorry for troubling the board...
regards,
hobgoblin

Greetings to all of you.
I have been studying Asprotect lately (yes, I know: Be careful with posting questions about this soon to be "worned out" protections system- And it is with a certain fear of being flamed that I post one question. I have been reading most of teh stuff posted on this board, and I have learned a lot. But there is one thing that eludes me.
I have just read Splaj's splendid work on the subject. But therre is one thing I quite can't figure out. Take a look at this:

(Written originally by Splaj..):

0167:00E2CA17 90 NOP
0167:00E2CA18 6A00 PUSH 00
0167:00E2CA1A E8597AFFFF CALL KERNEL32!GetModuleHandleA <==DUMMY API for IAT rebuilders !
0167:00E2CA1F FF355036E300 PUSH DWORD PTR [00E33650] <==GetCommandLineA API
0167:00E2CA25 58 POP EAX <==POP'd into EAX !!!
0167:00E2CA26 C3 RET <==in aspr OK, but STACK WRONG for us

See the GetModuleHandleA in EAX is discarded, EAX is pop'd with GetCommandLineA ptr !!!

I understand what's going on, but exactly how do you guys know that it is the CetCommandlineA API that eax is pop'ed with? When I do a d eax or u eax, I don't see something I understand, or something that gives me a hint. When I do a u 00E33650, I come up with this:
016F:01154648 0000 ADD [EAX],AL
016F:0115464A 40 INC EAX
016F:0115464B 0041A4 ADD [ECX-5C],AL
016F:0115464E E4FF IN AL,FF
016F:01154650 FC CLD
016F:01154651 86F4 XCHG DH,AH
016F:01154653 810000000000 ADD DWORD PTR [EAX],00000000
016F:01154659 0000 ADD [EAX],AL

(the address is different than Splaj's listings; I'm on WinME right now...)

I can't see where to find a pointer to what kind of api that is the "valid one", and not the dummy one.

Is this something you just know from experience or what?

Some input on this would be very much appreciated. And if you want, email me your input.
+SplAj
06-02-2002, 08:39 PM
Hob,

I've reviewed ur history here, seems u r struggling a bit.....we can help U anytime ;)

Please keep trying. U will get there eventually, then u can buy me a Guinness :)

Spl/\j
hobgoblin
06-02-2002, 09:09 PM
Yes, your da....... right I'm struggling a bit.:-) I'm bit by bit learning the bits and tits of asprotect. I did know how to unpack the earliest version, but then I decided to do some other things for almost a couple of years. And when I came back to the reversing scene everything had changed. I managed yesterday to unpack Commview, following your tut step by step. Today I've been diving into this new scheme set up, with the apis spread all over the place.:-)
As far as I can see, I'm going to be busy for a while learning the secrets....
But I have plenty of time, and there is a lot to read. I will eventually get the hang of it.:-)
BTW, thanks for all the information you have supplied over the years. Nice to see someone willing to pass on their knowledge. And that goes for most of the people on this board.

I'll post my questions as they arise, be sure of that.

regards,
hobgoblin
nikolatesla20
06-03-2002, 06:20 AM
Well for one thing, the call is such:

0167:00E2CA1F FF355036E300 PUSH DWORD PTR [00E33650]

This is a indirect address pointer operation. Disassembling the 00E33650 address will give you nothing that makes sense. What you want is to disassemble the address that is found AT 00E33650.

In SI after you U the address if it's in an API the name of the API will be shown in the module window. I'm sure you already know that of course tho, just a reminder :)

Anyway, if you are totally unsure about which call it really is, there is a simple technique. YOu know that ASPR can only "fake" these calls in this way at the beginning of the program's startup, and no after. For example, GetCommandLineA is only called once in most programs, at startup time. So you know what the value is going to be, right ! ?! After the ASPR redirected call, just walk thru it and see what the return is, and compare it with what it should be. Piece of cake.

There are several other emulated API's that ASPR uses like this too, such as GetCurrentProcess, or GetCurrentProcessID. Some of these you can simply find by doing the "PROC" command in SI. It will show you all the values. If the ASPR emulated return value is one of these, then SHazAM! You've found which API is supposed to be there. Don't trip up over GetCurrentProcess by the way. The return value of this function in windows is not the REAL value, it is a "psuedo-handle", the value is usually something like 7FFFFFFFF. If you see that value, you got yourself a GetCurrentProcess call on your hands.

Remember, use your brain, your MSDN, and SI and you can do almost anything.

-nt20
hobgoblin
06-03-2002, 07:49 AM
Thanks a lot.:-)
I'm grateful for the input. I was somehow on the track of it already, and you filled out a gap there..
I'm just started going through Crusaders tutorial on Reget, and I guess I will be busy for a while...

regards,
hobgoblin
th_snake
06-03-2002, 03:12 PM
Hi
I know it can be off topic here, but i've came back after a loooong
time and i'm happy to see some old friends here.
hobgoblin, how are you my friend ? How's life and the family ?
I'm ok and so is the family, busy in real life, but nice to jump here from time to time :)
I see you are still in this unpacking stuff, nice work, keep up the great work of yours.

Regards
the snake
(the original one. i saw that there are now 2 new "the snake" around here)
nofurs
06-03-2002, 03:26 PM
Hi Th_snake,
Don't worry you won't get flame ;D
hobgoblin
06-03-2002, 03:55 PM
Hi snake..
Nice to see you here. I was beginning to wonder if you had withdrawn from the whole scene..-)
As you can understand, I've been busy with other things myself (school, carriere, wife...), but somehow I can't stay away from the reversing scene in general, and this board in particalur. Wonder why...:-)
Now I have some time on my hand, and thought I wanted to dive into the whole asprotect thing. As you may remember the packing; and therefore unpacking, contains a lot of challenges. It sure helps developing my understanding of assembly dealing with this kind of protectons. And you know what? I unpacked my first Asprotect proggie today. And it worked after some tracing and patching. I must say, Asprotect surely has been developed since we first dealt with its earliest version(s).
Well, I have to stop before I get seriously flamed here.
Take care out there, snake.
I'll be seeing you here later on.....

hobgoblin
th_snake
06-03-2002, 08:58 PM
Hi hob
2 years ago, on May 2000 you wrote a tutorial about "How to unpack, crack and patch a packed copy of AZPR 3.01", protected by one of the first versions of this packer... It is on my site, at the guests section, a good leason for anyone intend to learn basics of unpacking.

One thing that stops me to go deeper in this packers is the changes they make from "day to day" (other one is language and more)...

C U around


Symbol Loader doesn't breaks under Win2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Symbol Loader doesn't breaks under Win2K
PDA

View Full Version : Symbol Loader doesn't breaks under Win2K

Plasma
06-02-2002, 12:00 PM
hi guys,

i got some strange problem with symbol loader in Win2K. every time i want to load an executable in it, it doesn't breaks in.
although i changed the characteristics of the appropriate section to E0000020.
as far as i can remember it worked for me in win98...

what am i doing wrong?
Aimless
06-02-2002, 05:45 PM
Are you using the SICE from the Driver Studio?

If so, you have to go to settings menu on the top and go to the loader everytime.

...Have Phun
Plasma
06-03-2002, 12:28 AM
i did install DriverStudio v2.6 with SICE and Symbol Loader.
now when i want to load an executable in, it loads it and then the program doesnt even start and the errormessage also doesnt appears like it does normally..
with SICE 4.05 the programs didnt break in, but at least they started :confused:

output:

----- Loading symbols for 'D:\Shareware\*.exe' -----
D:\Shareware\*.exe opened successfully
Translating file: D:\Shareware\WinISO\WinISO.exe...
Error: No debug info..
----- 'D:\Shareware\*.exe' symbols not loaded -----
Solomon
06-03-2002, 06:47 AM
a little trick to stop at the entry point in Win2k:

1. use LordPE to get the entry point of your target, assume it's XXXXXXXX.
2. BPX LoadLibraryA
3. then use Symbol Loader to load your target. Each time when SICE pops up, just press F12, then check whether we are in the context of RPCRT4.DLL. If so, just clear the breakpoint and type "g XXXXXXXX" to get to the entry point.

It always works.:)
roocoon
06-03-2002, 12:17 PM
In my system it works with a simpler way.
Open up the debugee program with the Softice Loader.
Go to the Loader's Module/Settings/Debugging.
The Load Executable and Stop at WinMain should be checked of course.
If they already are, check the Load Symbols Only, then right after check again Load Executable and click OK.
Back on the main screen click the Load button.
No idea why it works like that. It seems that the Loader doesn't initialize its control structure properly with the Load Executable setting and needs a reminder.
crUsAdEr
06-03-2002, 10:34 PM
erm...

I just use LordPE or PEditor "Break 'n Enter".. works all the time....
Lbolt99
06-04-2002, 01:01 AM
Originally posted by crUsAdEr
erm...

I just use LordPE or PEditor "Break 'n Enter".. works all the time....

And there I was doing EB FE @ OEP or bpx getversion all the time.. lol.

Thanks for the tip, works great :)
Plasma
06-04-2002, 08:19 PM
thanks for your posts dudes,

i tried the solution from roocoon, and it worked!!!
seems like there's a little bug in SL...

good work!


Searching RSA Protected Programs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Searching RSA Protected Programs
PDA

View Full Version : Searching RSA Protected Programs

€clips€
06-02-2002, 05:42 PM
I'm trying to learn how to keygen a program with RSA keygeneration routines but I need some programs to start with.
Please let me know if you find any protected program.

I also have another question, I've been taking a look on DAMN's site and on Crypto list section I saw that a lot of programs that used RSA-1024 were solved because of the weak RNG, and here comes my lame question, what does "weak RNG" means?

That's all for now, thank you in advace and excuse me for my terrible english.
foxthree
06-02-2002, 06:14 PM
Hi Eclipse:

A lot of apps now-a-days feature strong crypto (Blowfish, Twofish, RSA, ECC) to make keygenning impossible. Hmm makes me sad :(

For targets, you can try almost any ASPR*** apps. They all use RIPEMD-160, MD5, and RSA-1024. Living hell trying to keygen these :mad: But hey, that's me... give it a shot and see what you can come up with...

Also, "weak RNG" == Weak Random Number Generators. Many crypto were broken based on weak RNGs. Ask Mike about it and he'll give you stories ;)...

Signed,
-- FoxThree
mike
06-03-2002, 12:19 AM
Hi foxthree! I'll bite :D

Eclipse, see the winzip thread from a little while ago for an example of how I broke winzip thru the weak RNG. David Wagner broke Netscape's SSL implementation because they used the same weak RNG.
AdamA
06-03-2002, 12:28 PM
Hi,

Stock Price Monitor v1.1(h**p://www.tongsoft.com/down.htm):
Prot: RSA-192

GetDataBack for FAT v2.00(h**p://www.runtime.org):
Prot: RSA-65

happy factoring:D
AdamA
€clips€
06-04-2002, 06:35 PM
Many thanks to all of you who have answered my lame questions, I'll give a try to the programs that AdamA have said,
I hope I'll be able to do my first approach, even if dont find P and Q, it will help me analizing the diferent parts af the algorithm.
Again, Thanks.
Lbolt99
07-30-2002, 02:23 AM
Originally posted by foxthree
For targets, you can try almost any ASPR*** apps. They all use RIPEMD-160, MD5, and RSA-1024. Living hell trying to keygen these :mad: But hey, that's me... give it a shot and see what you can come up with...

I have yet to see any Asprotect 1.2+ things keygenned :( At least not since the Weak RNG leak was fixed. I think the keyspace is too big and now that it's properly implemented in Asprotect, keygenning is pretty much out of luck for that..

Of course, one can always hope that the author will choose to continue using their own scheme instead of the aspr internal one.

Maybe some one with the RSA cracker machine will target aspr stuff for fun one day :)
foxthree
07-30-2002, 07:19 AM
Hi LBolt:

I too was working on approaching the ASPR keygenning stuff and do have a couple of ideas of my own. But, I'm still yet to get this ideas vetted from "Master Crackers" -- guess they're all busy. Anyways, if you're interested in keygenning ASPR targets, we can discuss via PM and once we're fairly sure that the idea is okay, we can involve some heavy weights too :D

Signed,
-- FoxThree
Lbolt99
08-03-2002, 06:32 AM
Hi, I'd be interesting in discussing ASPR keygenning. Probably not for a couple of weeks though. Real life is cropping up, not much time for reversing right now :( Plus I want to get a little better versed at RSA which I'm working on studying in the meantime. In an effort to help understand, I'm going to try and duplicate DAMN's efforts on GetDataBack, which based on what I've read, is an easy factoring problem (RSA-65). Also need to read up on that RipeMD-160 thing. Never really looked at that.

I also have plans to look at the Armadillo keygen scheme but that might be put on the backburner. I downloaded the eval of 2.6 from their site. I see that they've added a feature for signed keys. Don't know what they're using though, haven't had a chance to examine it. The part where they ask the user to make a "security certificate" is interesting. Basically you're supposed to come up with a p/w, whatever you want, and Armadillo uses that to sign the key. Just based on speculation I think it hashes your input to get it to a certain size, then does something else from that point.

BTW legacy arm. uses a 64 bit hex reg key, the same as in CacheX which we tore apart on the "SHA-1 and BF examination on CacheX thread" In fact, CacheX uses a totally custom version of armadillo, integrated into the program.

New armadillo has options for signed keys, 14 bytes thru 40 bytes IIRC. Designed cause the old version was keygennable too easily with a valid license (secret blowfish key)

take care


New tool of our trade: windbg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New tool of our trade: windbg
PDA

View Full Version : New tool of our trade: windbg

Snatch
06-02-2002, 08:34 PM
Yes folks. First of all lets not flame this thread with a bunch of "MICRO$OFT $UX AND SO DO ALL BLAH BLAH". Ya I think we are grown up enough to be rational and not a little emotional because we hate big companies or whatever our personal issues are. Anyway I have been using Windbg (get the latest from hxxp://www.microsoft.com/ddk/debugging) and I have been very impressed. Doesnt crash the OS and it has a very powerful command interface. Download the symbol pack too and your talking about an easy to use multitasking good solid debugger. Maybe others havent had my luck but I would say it has good functionality and features. It is a great softice substitute unless you are debugging very low level code. For most applications it will work fine and be less obtrusive than softice. I havent used OllyDbg but I dont see how they could do any better than this.

Snatch
Aimless
06-03-2002, 03:50 AM
Ditto.

With or without the debug symbols.

BTW, did you know that you can use WinDBG as a profiler (crude) that does not need any code except an IDA MAP file (formatted, o course:))?

It records all functions (as present in the IDA MAP file) that get executed during an apps running. Great, if your app is in Delphi/VB or for that matter, even in ASM, to see which function(s) are called, in what order and more important, which functions to ignore for target's protection, as uncalled ones cannot have protection in them...

...Have Phun
foxthree
06-03-2002, 07:23 AM
Err... clear me if I'm wrong but doesn't WinDbg require 2 machines one the target debugee and other the development system and both connected either via Network or Serial port.

Signed,
-- FoxThree
Aimless
06-03-2002, 01:59 PM
ONLY and only if you are debugging SYSTEM components (read that as KERNEL level) and not applications.

...Have Phun
Snatch
06-09-2002, 08:10 AM
Did not know that but I cant wait to try it out :).

Snatch
fjrp2
06-12-2002, 07:58 PM
Hi, this is my first post ;)

If been used windbg also, I found a reference to it in one of +reverser´s tuts for newbies (cracking for dummies, I think or filemon... anyway they are ALL great)

I have seen a thread about CodeView also, and i would like to say that, in my opinion, WinDBG is a port to WIMP IDE of CV
They all feel the same.
Or that´s what I think.

Anyway, great messageboard

This is THE messageboard.
(I feel like a reversert ;) )
IcyDee
06-15-2002, 10:20 AM
(I feel like a reverser(t) ;) )

So do I, but how are we going to find one of them at this time of day around here! :D
golden_123
06-17-2002, 12:11 AM
Is there a tut on cracking with winddbg somewhere
thx
fjrp2
06-18-2002, 03:07 PM
Yes, If told tou: both lesson of Cracking for dummies use them.
Search in fravias' Ancient Castle.
You have the link down here
(And also from tsehp ;) )

You can also have a look at the databese at:
h**p://w*w.msdn.com
(they are a little bit old, anyway ;) )
Alvin777
06-18-2002, 03:30 PM
Originally posted by Aimless
Ditto.

With or without the debug symbols.

BTW, did you know that you can use WinDBG as a profiler (crude) that does not need any code except an IDA MAP file (formatted, o course:))?

...Have Phun

How to attach .map file to debug session?
xxxxx
06-25-2002, 10:29 AM
I din't try it but he can't do that ccc...........
Alvin777
06-26-2002, 06:22 AM
Originally posted by xxxxx
I din't try it but he can't do that ccc...........

You should read my question as "How to convert .dbg file to something understandable by WinDBG"


Finding code in a VC6 dll ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Finding code in a VC6 dll ?
PDA

View Full Version : Finding code in a VC6 dll ?

bik78
06-03-2002, 01:21 AM
Hi all!

A little question: I have a dll compiled with VC6. I know that it contains a class named Cls and that it has a method named Meth1. So I can do:

Cls *c = new Cls();
*c->Meth1(1, 2);

Now, how do I find the implementation of this Meth1 in a IDA listing? All the functions are named sub_0_1000A50A and the like... Can I somehow find out the offset of this method???
Solomon
06-03-2002, 02:11 AM
Why don't you try tracing into that method in your VC6 debugger?:)

Just open the "assembly window" in your VC6 IDE when debugging your sample prog, and trace into that function by pressing F11.
bik78
06-03-2002, 05:51 PM
Hmm... Actually I have no idea how to get a class from a DLL...

The usual LoadLibrary / GetProcAddress stuff? Then what do I write in GetProcAddress???

I attach the DLL...

Thanks!


CodeView
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > CodeView
PDA

View Full Version : CodeView

FEARHQ
06-03-2002, 04:17 AM
I am using this rather old but sound book on DOS assembly programming, but I have encountered a problem... The book refers to CV or microsoft's CodeView that the book assumes comes with the system. Thing is, this doesn't exist for WinXP (or I am unaware). Anyone know if it is possible to get this from MS or a ripped version? If not, what version do I have to run? I would apreciate any help :) MS's site isn't much help... CVW is acceptable too
WARM3CH
06-03-2002, 01:27 PM
Hello,

Try getting Microsoft C v6.0/7.0 which I think is quite easy to find on the net.... CodeView is the debugger that comes with it.

One other solution may be to use the debugger of the watcom C++ (which is now open source). It can read the debug information in CodeView format and has much more functionality.

Turbo Debugger from borland is another option. It comes with Borland C++ or Borland Pascal products (for example, try finding Borland C++ 3.1; quite old but a very nice for 16 bit DOS developements)

Anyway for DOS, personally I'd go for the 32 bits and Watcom...

Regards
WARM3CH
FEARHQ
06-03-2002, 11:53 PM
Thanks :) planning on setting up VC++ 6 anywhays
WARM3CH
06-04-2002, 05:13 PM
No No No!

I said Microsoft C not Visual C++! These are different. Microsoft C is the "old" C/C++ compiler form microsoft and is a command line based tool that only supports 16 bit windows and DOS.

You can't write DOS programs with Visual C++ as it can only target win32 (and 64 bit...) and as far as I know, it's debugger can't debug DOS programs too...

the moral of the story: for DOS, you DOS based tools and for windows, windows ;)
FEARHQ
06-04-2002, 06:44 PM
Hmmmm... I'll get searching, but after 30 mins I found nothing... I doubt it's as easy as you say, but I'll look. thanks for pointing out my misinterpretation
WARM3CH
06-05-2002, 04:58 PM
Well, I'm sure you can find it on the net....

And if you're interested, here is a link to Borland C++ 3.1 which includes that nice Turbo Debugger for DOS. (it can read codeview symbols too)

hxxp://www.infopub.co.kr/jungbo/pds/open/download.asp?rec_no=9&sub_no=0&dsp=2&lcnt=9&flg=detail&pdsid=1
FEARHQ
06-05-2002, 06:46 PM
Great! Thanks for the link, but I still need to search for CodeView... They use specific and detailed commands... Dunno if Turbo does the same...
JMI
06-05-2002, 08:52 PM
Try here:

hxxp://www.filesearching.com/cgi-bin/s?q=CodeView&t=f&d=&l=en&x=15&y=15

which has many of them. I'm attempting to attach a copy. Ups. too big. Anyway can download copies of different flavors from this ftp.

Help files and instructions are everywhere on google.

Regards.
FEARHQ
06-06-2002, 04:39 AM
thank you for your help JMI, but it seems that these aren't microsoft's debugger called CodeView. None of them is :) What I'll probably do is try to rip it from win95 that I'll run in a Virtual PC. Thanks anywhays :)
Snatch
06-09-2002, 08:13 AM
Believe it or not but Microsoft got CodeView licensed from Numega. Kinda funny. I remember seeing that when I was playing around in good old C700 back in the day. Im like holy cow same guys make softice make codeview surprise surprise.

Snatch
FEARHQ
06-09-2002, 06:04 PM
Well, I sucessfully ripped it from Visual Studio 1.52! Works like a charm. Thanks all for the help
Bengaly
06-11-2002, 06:15 PM
rather old m$ debugger,
still used in my uni though (did't they ever heard about SoftIce ??)

i can't attach CodeView since its kinda big, sorry,
if anyone want to know how it looks like (does anyone cares?) see attached pic.
ttl ben
CrackZ
06-11-2002, 11:17 PM
Once upon a time a very wise person told me that if you aren't directly helping someone or aren't answering directly their question you probably shouldn't bother ;-).

This brings me nicely onto ..... The point of a CodeView screenshot is?, can you see what I'm getting at here.

Also, perhaps it is worth thinking just a little before posting your reply, I'm very sure universities have heard of SoftICE, however, since most universities when they buy in software desire multi-users access can you even begin to imagine how much $ SoftICE might just cost them and how economically unviable it might be for NuMega to offer big discounts (bearing in mind the relative size of the market here).

Sorry, I felt like whinging again ;-).

Regards

CrackZ.
FEARHQ
06-12-2002, 04:59 AM
settle down guys :D I "extracted" CodeView 4.10 from Visual C 1.45 so it's allright. I might even use Visual C to code dos appz in C someday... aparently it's a nice environment :) CodeView works fine with a custom batch ran first :) I'm on my way to education!


How to analyze the seeds3,4 of f*lm 7.x?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to analyze the seeds3,4 of f*lm 7.x?
PDA

View Full Version : How to analyze the seeds3,4 of f*lm 7.x?

steven_sim
06-04-2002, 10:04 AM
NB's seed1-2 crack is only for those not purchasing the CRO settings vendor!

Anyone have the way to ge this seeds3,4?

Brute force is only way?


Note about opcode short jmp translation in Hiew,OllyDbg and SI.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Note about opcode short jmp translation in Hiew,OllyDbg and SI.
PDA

View Full Version : Note about opcode short jmp translation in Hiew,OllyDbg and SI.

The Svin
06-04-2002, 04:25 PM
Once I wrote a macro to generate opcode of short jump to asolute
address (Win32, protect mode, for masm).
I'm not going either to bother you with details of difficulty to do it
conserning relocation problems,
or alternative methods to code absolute addr jmps.
Let's abstruct from it, I want to generate right opcode for
short jmp to abs address that's it.
Some additional info for those who not familiar with
((short) jmp address) opcode.
While first byte of those opcode is easy to use - it's 0E9h (sign of short jmp)
next dword of opcode is address, but it's relative address not absolute.
It = address you need to jmp minus of next opcode
for example 0E9 00000000h - means to jmp to the next instruction.
Keeping in mind that I knew base address and section alignment I worked out macro
that way
1. In the first occurence of .code statement(wich is address of code section)
I put
sectaddr equ $
2. And the macro was:
absjmp MACRO address
LOCAL opend
db 0E9h
dd address - opend
opend = $+401000h-sectaddr
endm
401000h here is base + section alignment and actually it's equal to sectaddr.
But I couldn't write just opend = $ 'cause it would rise error about relocation :)

I test it with different values - macro worked all right generating right opcode each time.
Then I wandered if different debuggers and disassemblers could show it right way.
Here is the end of introduction, now the notes this post is about.
Here is code tested:

.code
sectaddr equ $ ;at first occurence of .code set the constant
start:
absjmp 810000h
xor eax,eax
absjmp 401000h
mov eax,eax
absjmp 400000h
@@:
cmp al,1
adc al,al
and al,3
jmp @B

OllyDbg behavior was most strange:
'Cause it "understood" jmps very well but failed to disassm
very simple following jmps code:

00401000 <Mo> $-E9 FBEF4000 JMP 00810000
00401005 . 33C0 XOR EAX,EAX
00401007 .^E9 F4FFFFFF JMP testinst.<ModuleEntryPoint>
0040100C . 8BC0 MOV EAX,EAX
0040100E .-E9 EDEFFFFF JMP testinst.00400000
;here OllyDbg failed:
00401013 3C DB 3C
00401014 01 DB 01
00401015 12 DB 12
00401016 C0 DB C0
00401017 24 DB 24
00401018 . 03EB ADD EBP,EBX
0040101A . F8 CLC

Olly should have treated
db 3c, 01 as cmp al,1
db 12, c0 as adc al,al
db 24, 03 as and al,03
db eb, 08 as jmp to 40101B-8 (to 401013)

But your can see how it took the opcode
Without preceding short jmps OllyDbg disassm the opcode well.
Why did it not do it after the jmps - is a mystery to me :)

Next try was with Hiew.
It understood everything ok exept for jmp lower that base address:

.00401000: E9FBEF4000 jmp 00040F400
.00401005: 33C0 xor eax,eax
.00401007: E9F4FFFFFF jmp .000401000
.0040100C: 8BC0 mov eax,eax
;here:
.0040100E: E9EDEFFFFF jmp 0FFFFF400
.00401013: 3C01 cmp al,001 ;""
.00401015: 12C0 adc al,al
.00401017: 2403 and al,003 ;""
.00401019: EBF8 jmps .000401013

Now Soft Ice.
That was the only one who got everything right :)

00401000: E9FBEF4000 jmp 00040F400
00401005: 33C0 xor eax,eax
00401007: E9F4FFFFFF jmp .000401000
0040100C: 8BC0 mov eax,eax
0040100E: E9EDEFFFFF jmp .000400000
00401013: 3C01 cmp al,001
00401015: 12C0 adc al,al
00401017: 2403 and al,003
00401019: EBF8 jmps .000401013

That's it.
Aimless
06-06-2002, 06:29 PM
...And therefore, is there any implication whilst using these tools?

...Have Phun


New Moderator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > New Moderator
PDA

View Full Version : New Moderator

Kayaker
06-04-2002, 04:37 PM
Hi All,

Zairon has kindly agreed to help out moderating the Mini Project forum. I thank him for this and the chance for me to make a change. Welcome Zairon ;)

Regards,
Kayaker
crUsAdEr
06-04-2002, 04:42 PM
Wow... very nice indeed...

Glad to have you organising stuff ZaiRon... me having exams.. then long trip but when i come back count me in for any project :D

hang around kayaker... dont go yet okie :>

Regards,
crUsAdEr
ZaiRoN
06-04-2002, 06:55 PM
thx for your support crUsAdEr ;)

ciao,
ZaiRoN
Clandestiny
06-04-2002, 07:36 PM
Hiya Zairon, Kayaker, Crusader... :)

Zairon: Welcome :) Congrats on the new job!

Kayaker: You've done a great job with the forum and will be missed. Not that I think you're going too far away... Once a reverser, always a reverser :D

Cheers,
Clandestiny
Bengaly
06-06-2002, 07:13 AM
congratz zairon :-)
and thnx to kayaker for moderating this part of the forum, cya mate and so long.
ben :D


OpenSSL Bignumber FLIRTs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > OpenSSL Bignumber FLIRTs
PDA

View Full Version : OpenSSL Bignumber FLIRTs

halvar
06-04-2002, 07:59 PM
Hey all,

with all them crypto protections all over the place, I think
it would be sensible to start collecting FLIRTS of various
OpenSSL/SSLeay bignumber lib versions - or is that work
already done ?

If anyone has signatures for old/recent OpenSSL/SSLeay versions,
I'd appreciate if they'd reply to this post, we can then arrange
to put them on a webserver somewhere.

Cheers,
Halvar


Stupid toys
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Stupid toys
PDA

View Full Version : Stupid toys

halvar
06-04-2002, 08:02 PM
A few stupid toys I've written, complete with source.
(IDA Plugins)

http://www.blackhat.com/html/bh-consulting/bh-consulting-tools.html

Cheers,
Halvar
gadget
06-04-2002, 10:15 PM
Thanks

Ill givem a try, BTW know of any more lying around on other sites (ie for X86)?

gadget


SSleay BIGNUM FLIRT sigs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > SSleay BIGNUM FLIRT sigs
PDA

View Full Version : SSleay BIGNUM FLIRT sigs

halvar
06-04-2002, 08:19 PM
With all these crypto toys around, why has noone started
collecting FLIRT signatures for the big number libraries in
OpenSSL/SSLeay ?

Everybody who has access to a COFF/OMF/ELF compiled
library of OpenSSL please generate signatures and tell me
about it, I'll put them up on a webpage then :-)

Cheers,
Halvar
dion
06-17-2002, 03:50 AM
i've tried it in the past and have collision in the signature for SSLeay. you should also notice that different compiler generate different signature.


Quest for Information
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Quest for Information
PDA

View Full Version : Quest for Information

peterg70
06-05-2002, 04:19 AM
I am almost fearing asking this but I will ask even If flamed all the way to hell.

I have a product which is currently protected with a security system called everlock. I can easily remove the checking routine from the program if required but this isn't what I want to do.

the protection software stores the number of licenses for each product in a .sys file. What I wish to do is to add more licenses and more products to file.

A few notes.
there is a move software (to move the license)
There is a reset software to reset the licenses.

I believe I have found the section of code relating to adding licenses back to existing products but am looking for other product names.

I have a feeling they are encoded inside the .sys file.

So what i am looking for is information on the protection system (tutes or docs) (NOT a crack)
Or possibly the format of the .sys file or a decoder for the .sys files

If needed please flame and I will ammend as required.

PS. I have read the posting rules

peterg70
(fingers crossed)
foxthree
06-05-2002, 02:06 PM
Hi PeterG:

Hmmm ... you're being too cautious I think. But anyways, only the paranoid survive :D. Cool, now IDA should disassemble .sys files - I think. Atleast 4.15 does. However, you better be sure that the .sys is really a .sys. Some time back, I saw this pathetic protection in which a binary file was named as .sys to "pretend" to be a driver. Alas, I was taken for a while until I opened it in Ultra-Edit ;)

Check it out and if it is really .sys try IDA.

Hope this helps.

Signed,
-- FoxThree
peterg70
06-05-2002, 11:58 PM
Foxthree

Old chinese saying
"Its better to be cautious than flamed"

Sorry to mislead you but the .sys file is a key license file rather than a program .sys file.

Its is typically only 1 to 2k long but is encrypted. Was hoping to find information on how the whole everlock system works.

If there isn't any I'll have to start doing some long nights ;-)

peterg70
ZenLoren
06-06-2002, 05:24 AM
Hi

http://www.woodmann.net/fravia/everlock.htm

If u already know about it pls skip.
regards
Loren
peterg70
06-06-2002, 10:36 AM
ZenLoren thanks for the link

but have already seen Tomboys Part I. Am wondering if Part II exists somewhere (its not on fravia mirror)

That tute is able to read the disk information to make it a master disk again.

I am trying to attack the E*.sys file by decoding it and adding more products to this sys file.

peterg70
Syrus
06-08-2002, 10:14 PM
Heya!

If i remember well i saw some articles about everlock at
hxxp://www.anticrack.de

hope that helps =)
peterg70
06-09-2002, 03:02 AM
Syrus

Thanks for the info but same articles as the ones here.

Okay status report. I have found the decoding routine and am currently deciphering what each byte means and does.

What I am gonna need is a simple front end that will allow me to add new items to the .sys file and update the checksums and other bits as appropriate.

What do you guys recommend??

peterg


adding functionality project...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > adding functionality project...
PDA

View Full Version : adding functionality project...

ZaiRoN
06-06-2002, 07:03 PM
hi!
maybe not a lot of people are interested to the vxd's thread so i would like to present a new (little) project for this area.
this time we have to add some functionality to a proggie. the proggie is a simple screen_capture (thx to manowar), nothing special but the program only serves for giving a reason to the steps to carry out :)
you can't minimize the proggie and so it's not really good see the dialog in the captured image.
after this preamble, here is the tasks!

1. in the "file" menu there's a menuitem called "Tray...".
when this item is clicked the proggie has to go in the system tray.
you can put the windows's icon or use your preferred icon; no problem, it's not the purpose of this level ;P.

2. once in the system tray, you have to give to the icon the possibility to respond to the mouse events. in particular:
left_double_click_mouse cause the restoring of the proggie and the removing of the icon from the system tray
right_click_mouse cause the opening of a popup menu with this item(s):
- "Exit" close the proggie removing the icon from the system tray
- "Capture" capture the screen
- "reversed by" put here what you want (your name or something else...). a simple messagebox would suffice!

you can use *all* tools of the world.

ok, that's all!
if i was not clear or if you have question on this project or something else, let me know!

bye
ZaiRoN
ZaiRoN
06-06-2002, 07:22 PM
...here is the file.
Clandestiny
06-11-2002, 04:46 AM
Hiya,

I really don't have time to get involved in another project between school, the SEH tut I'm writing, and the long-standing backtrace dumper project Kayaker and I have been working on (release date planned for 20002 AD, lol ;) )

Nevertheless, I think Zairon has a good idea for a project here with the possiblity of teaching a lot of RCE fundamentals. Functionality adding is always fun :D And while not a cracking exercise, per se, the general concepts are easily extended to re-enabling the functionality of many "crippled" targets. Unfortunately, this is also the kinda project that will simultaneouly bore experienced reversers and confuse the hell outta newbies... Anyway 32 people have d/l the proggie and there have been 0 replies, so I figured I'd post some general "get started" references in case there is anyone who wants to learn, but doesn't know where to start...

General Win32 ASM coding --- study the first 5-6 of Iczelions excellent tuts to get a basic understanding of win32 architecture
http://www.win32asm.cjb.net

Tutorial 23: Tray Icon --- Example ASM code for an app that places and icon in the taskbar and responds to its mouse messages
http://vx.netlux.org/texts/html/books/icz/tut23.html

Jazzing up Regmon: Adding a DLL to reopen logs with Drag and Drop support by Kayaker --- If you enjoy writing giant inline patches in a hex editor as much as I do, you might want to consider extending the functionality via a dll ;)
http://www.woodmann.net/fravia/kayaker_RegmonPlus.htm

Cheers,
Clandestiny
nikolatesla20
06-11-2002, 09:19 PM
Here is my entry, works very well if I say so myself.

Released by [Lunar_Dust] a.k.a. nikolatesla20

Time: About 10 hours.

Tools Used:

WinDasm
Code Snippet Creator (The greatest tool EVER !)
First_Thunk_Rebuilder (My own creation)
Hex Workshop 2.54
ProcDump (I prefer working on memory aligned files, easier )
Calculator
MSDN
Pencil, paper
BRAIN !

Imports Added:

CreatePopupMenu
TrackPopupMenu
GetCursorPos
AppendMenu
Shell_NotifyIcon
GetLastError
lstrcpy
LoadIcon

Notes:

Instead of entering my *name* in the menu, I just used a tooltip over the systray icon :)

Comments:

Well, walking thru and chaining into a precoded windows event handler is not always easy of course, but oh well I did it :) . Actually, it's super fun to change the entire behavior.... There are about four redirections from code, which go into my own code. I was naughty and decided not to add a section. I just enlarged the virtual and raw size of the first section, which already physically had PLENTY of room for more code, and then stuck my own code in there. Oh, and the really naughty part is I made the section writable. Hey, you gotta if you're gonna throw in some variables!

I must say also that for those that have never used Code Snippet Creator, you are missing out! It is the most powerful tool for this kind of work, and it has an excellent help file for a change, unlike most tools out there. TRY IT! Once I had my redirections, it was simple to test and recompile each code snippet, and paste it into the file. If it didn't work, I could recompile and test very quickly again. CSC does all the hard work for you, it even links to the program's API functions FOR YOU !. You just have to tell it where you snippet will reside in memory in the program, and I always choose "export..." and paste the snippet myself with a hex editor.

Well, I guess that's all, thanx for the practice !:)

-nt20
ZaiRoN
06-12-2002, 12:18 PM
hi nikolatesla20,
great job! you have done lot of work in more :)

i like the fact that you have pointed attention on a particular tool: code snippet creator. i like it very much too.
in these days i was thinking about a mini-project based on this tool. could be a little reme or maybe another "adding functionality project", for example using CSC for adding functionality to CSC...funny :p
please, leave this thread only for this project's comments and if you like the idea (even if you don't) post your comment(s) or suggestion(s) on a new thread.

bye
ZaiRoN


n00b need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > n00b need help
PDA

View Full Version : n00b need help

-=Death2001=-
06-06-2002, 09:09 PM
ok, am complete n00b lol, i know bits an peices of a few programing languages, so i thought i would try this,

in the tutorial im followin, it says : Type s 0 l ffffffff 'your_serial' in Softice , when i do it, it says symbol not defined (o) , i had same prob with getdlgitemtexta but i fixed that in the winice.dat. any help to fix this prob is much apreciated!
crUsAdEr
06-06-2002, 09:15 PM
I think it is 0, as in number 0 not the letter "o"...

Read the soft ice manual for more information!
-=Death2001=-
06-06-2002, 09:22 PM
na i tried a zero , but u just get syntax error, lookin thru manual, not much help!

***** EDIT ******

ok all sorted now :D
Aimless
06-07-2002, 05:34 AM
You got me confused with "another" Death :).....

Anyways, there is no reason why this command should not work.

The command really is:

S 0 L FFFFFFFF "12121212"

Here, 0 = the number 0 and not the letter O...... and I am assuming you entered "12121212" as your serial...

If you do get an error, try this:

S 0:0 L FFFFFFFF "12121212"

If that also does not work, try this:

S 30:0 L FFFFFFFF "12121212"

and

S 28:0 L FFFFFFFF "12121212"

If that also does not work, they you have a problem in the version of softice. You need to tell:

1. Which version of ICE
2. Which Windows platform

Note: If you have got the ICE from warez sources (most likely, you would!!), then some far-off warez servers are not good for that as they contain corrupted ICE. For all you know, it could cause these problems, or worse, install a backdoor in your machine.

...Have Phun
-=Death2001=-
06-07-2002, 09:39 AM
thx m8, works a treat!!


qeustion please read
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > qeustion please read
PDA

View Full Version : qeustion please read

Nemesis]
06-06-2002, 11:02 PM
its about entering serial and the software ask you to restart the program to see if its register, now my qeustion is what bpx do i set or any tip or hints any help please?

Regard
Nemesis]
stealthFIGHTER
06-06-2002, 11:44 PM
Hello,

it's good to start FileMon or RegMon before entering the serial to see where the serial is stored (registry or some file).

Before starting the app you can set RegQueryValueExA breakpoint to access registry or ReadFile or CreateFileA breakpoint to access files (or start FileMon/RegMon to see which keys in registry or which files are accessed).

Regards,
sF
Pyrae
06-06-2002, 11:45 PM
First of all you'll have to determine where the data you entered is stored. This will be most likely somewhere in the registry or in a separate keyfile, so the APIs to break are probably the CreateFile, GetPrivateProfileString (plaintext ini files) or RegQueryValue ones...

/edit: hey, beaten by one minute...;)

regards, Pyrae
naides
06-06-2002, 11:48 PM
The programs that make you quit before they make themselves registered are trying to avoid your BPX.

Perhaps the program only validates the serial at start up, so it is up to you to find where the serial is stored to be able to attack the validation routine(s).

As first approach I would use regmon and Filemon during the program startup and compare what happens before and after you enter a serial.

If you have a win98 system try using hmemcpy to find out the place and how your serial is stored. Does your program store the raw serial or a hash of the serial?

Does the program give you a nag screen telling you you are not registered? The serial evaluation may take place before the nag is shown but after the program starts.

A software called ultraedit used this technique to validate registration. There is a good tut in the fravia site about it. you may find some inspiration there.h**p://fravia.kilrathi.pl/reziedi1.htm

good luck
Nemesis]
06-07-2002, 09:58 AM
Thanks guys its realy help a lot.

best regard
Nemesis]


blendingclock fails oepfinder
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > blendingclock fails oepfinder
PDA

View Full Version : blendingclock fails oepfinder

britedream
06-07-2002, 05:29 AM
Hi Foxthree

To my surprise, the oepfinder failed to find the oep of a software

called blendingclock, it is packed by asprotect 1.2, according

pescan. I believe the signature byte is at 167:01187b3c,

homepage is at xxx.blendingclock.nard.ru.

regards!
foxthree
06-07-2002, 11:32 AM
Hi BriteDream:

Thanks for the report. I'll take a look.

Signed,
-- FoxThree
NopREtf
06-07-2002, 04:44 PM
Hi
I found the 61FFE0 signature at 01187BA8 (winhex method).

ciao
foxthree
06-07-2002, 05:33 PM
Hi BriteDream:

Why does the URL not work for me? A google search reveals nothing! :eek: Perhaps a mirror or mail me the target at foxthree@asm.net.

Thanks.

Signed,
-- FoxThree
NopREtf
06-07-2002, 05:39 PM
Hi Foxthree !
try h**p://blendclock.narod.ru/Index.html

some mistake in previous url :D
ciao
foxthree
06-07-2002, 05:43 PM
Thanks NopRetf... but interestingly, how did you managet to locate the original URL? Google search revealed nothing on "blendingclock" :(

Signed,
-- FoxThree
NopREtf
06-07-2002, 05:53 PM
Yes it’s true nothing with Google
Me too tried it :D
But..I know the narod.ru domain, then I searched there for “blending clock” :p

regards!
britedream
06-07-2002, 07:21 PM
Sorry Faxthree for the incorrect url, it was a mistake on my part,

this is what happen when you get old. the url posted by Nopretf

is the correct one, if you ever have a need for the file , I will be

more than happy to E-mail it to you. Thanks

my regards !
foxthree
06-07-2002, 08:12 PM
Yo BriteDream!

No Problem :) Downloaded and Analyzed the proggie. Yep, bug in OEPFinder. Alas, certain assumptions that I'd made for the structure of an ASPR exe does not seem to hold good for this proggie.... which means I'll have to undo that assumption and do it the right way.... but wth, i'll fix it. :)

Thanks again for the proggie...

Signed,
-- FoxThree

PS: The OEP is at 00*82318 :D
foxthree
06-08-2002, 02:56 PM
It was a silly bug really. Damn! Anyways, thx to BriteDream for the target and NopRetf for the correct URL! Look out for my upcoming announcement in the ToT section ;)

Signed,
-- FoxThree
Lbolt99
06-09-2002, 07:53 PM
Chamelon clock had problems too ,strange :)

Will check with newer OEPFinder


Typelibrary calculating function offset
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Typelibrary calculating function offset
PDA

View Full Version : Typelibrary calculating function offset

Iwarez
06-07-2002, 06:53 PM
Hi dear reversers,

I'am trying to debug a application that uses an external dll that uses a COM interface. I found a program called tlbdbg.exe from ms that generates a map file for me containing all the functions with their offsets. It works with a dll I made myself to test it but it crashes on the one I want to debug. Is there any other program that generates a map file (with all the function offsets of the exported functions) like tlbdbg does? Or is there an easy way to do it myself?

Thank you for your time.

I-W


Floppy Disk Format Specification
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Floppy Disk Format Specification
PDA

View Full Version : Floppy Disk Format Specification

Clandestiny
06-07-2002, 11:52 PM
Hiya,

I apologize in advance if this is a little "off topic"...I need the reference for the floppy disk format specification (ie. location of boot sectors, FAT, ect). I have searched exhaustively on google, but don't seem to be able to find any really "low level" information about the underlying geometry of the data organization on the disk. I have tried various queries to the effect of:

"floppy disk" + format
"floppy disk" + geometry
"floppy disk" + specifiction
MS-DOS + disk format
.
.
.
ect...

Possibly, I am not asking the right question? My searches turn up plenty of info on "how to format a floppy", but nothing on the "floppy format" ;)

Any pointers in the right direction will be greatly appreciated.

Thanks in advance,
Clandestiny
ZaiRoN
06-08-2002, 12:04 AM
Hi Clandestiny,
i don't know if it's what you are looking for but take a look at:
http://board.win32asmcommunity.net/showthread.php?threadid=3462&highlight=floppy
if i remember well in the forum there are lot of threads about floppy geometry, try using the search feature...

good luck!
ciao,
ZaiRoN
remi
06-10-2002, 08:41 AM
Hi:

Perhaps you can also try with more specific search. Searching in google with "floppy sector FAT" (without the " ") gave same urls which may be of your interest... Despite searching all information in one search it could be a good idea serching what you are looking for in diferent pieces but more directly.

Good luck :) .
Clandestiny
06-10-2002, 10:30 PM
Thanks for the suggestions :)

ZaiRon: As usual, the win32 ASM board was full of useful info ;) Thanks for the suggestion. Unfortuanately, the win32 ASM board is just that: "win32", and this is supposed to be a linux floppy dumper sort of tool... The win32 stuff was still informative though.

remi: Good advice. Yeah, that was the trick... A more specific search about FAT and floppy boot sector.

Anyway, I found what I needed :D

Cheers,
Clandestiny


SEH Internals - Info Requested
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SEH Internals - Info Requested
PDA

View Full Version : SEH Internals - Info Requested

Clandestiny
06-08-2002, 03:39 AM
Hiya,

I am currently writing an tutorial on SEH as it relates to reversing and was curious about methods of circumventing SEH based protection tricks. I realize that protectors often deliberately invoke a SEH handler in response to tracing or sometimes by injecting an invalid opcode into the instruction stream. Hooking the SetThreadContext / GetThreadContext APIs might suffice in some cases to prevent manipulation of the machine state via the CONTEXT structure, but many protectors are smart enough to build and manipulate the SEH frame directly on the stack, rendering them impervious to these type of hooks. Being that SEH is intrinsically an OS provided service, it would seem that the way to defeat these types of tricks might be to hook into the Kernel's internal exception handler functions. "A Crash Course on the Depths of Structured Exception Handling" by Matt Pietrek provides some intersting information on the OS's SEH internals as it relates to WinNT:

************************************************
KiUserExceptionDispatcher is in NTDLL.DLL and is where execution begins after an exception occurs. To be 100 percent accurate, what I just said isn't exactly true. For instance, in the Intel architecture an exception causes control to vector to a ring 0 (kernel mode) handler. The handler is defined by the interrupt descriptor table entry that corresponds to an exception. I'm going to skip all that kernel mode code and pretend that the CPU goes straight to KiUserExceptionDispatcher upon an exception
The heart of KiUserExceptionDispatcher is its call to RtlDispatchException. This kicks off the search for any registered exception handlers. If a handler handles the exception and continues execution, the call to RtlDispatchException never returns. If RtlDispatchException returns, there are two possible paths: either NtContinue is called, which lets the process continues, or another exception is raised. This time, the exception isn't continuable, and the process must terminate.
Moving on to the RtlDispatchExceptionCode, this is where you'll find the exception frame walking code that I've referred to throughout this article. The function grabs a pointer to the linked list of EXCEPTION_REGISTRATIONs and iterates over every node, looking for a handler. Because of the possibility of stack corruption, the routine is very paranoid. Before calling the handler specified in each EXCEPTION_REGISTRATION, the code ensures that the EXCEPTION_REGISTRATION is DWORD-aligned, within the thread's stack, and higher on the stack than the previous EXCEPTION_REGISTRATION.
RtlDispatchException doesn't directly call the address specified in the EXCEPTION_REGISTRATION structure. Instead, it calls RtlpExecuteHandlerForException to do the dirty work. Depending on what happens inside RtlpExecuteHandlerForException, RtlDispatchException either continues walking the exception frames or raises another exception. This secondary exception indicates that something went wrong inside the exception callback and that execution can't continue.
The code for RtlpExecuteHandlerForException is closely related to another function, RtlpExecutehandlerForUnwind. You may recall that I mentioned this function earlier when I described unwinding. Both of these "functions" simply load the EDX register with different values before sending control to the ExecuteHandler function. Put another way, RtlpExecuteHandlerForException and RtlpExecutehandlerForUnwind are separate front ends to a common function, ExecuteHandler.
ExecuteHandler is where the handler field from the EXCEPTION_REGISTRATION is extracted and called. Strange as it may seem, the call to the exception callback is itself wrapped by a structured exception handler. Using SEH within itself seems a bit funky but it makes sense if you ponder it for a moment. If an exception callback causes another exception, the operating system needs to know about it. Depending on whether the exception occurred during the initial callback or during the unwind callback, ExecuteHandler returns either DISPOSITION_NESTED_ EXCEPTION or DISPOSITION_COLLIDED_UNWIND. Both are basically "Red Alert! Shut everything down now!" kind of codes.
**************************************************

From this it seems as though it might be possible to hook into the KiUserExceptionDispatcher to intercept exceptions for the process you are interested and retrieve the current CONTEXT structure before the app gets a chance to play dirty with the debug registers and such. I have done several searches regarding the possiblity of hooking into the Kernel Exception Handler and came back with mere breadcrumbs and little definitive information about the feasiblity / validity of this type of approach. I am likewise, interested in the internal implementation of the SEH mechanism in Win9X as the above doc by Pietrek seems only to apply to WinNT. So far, I have found next to nothing regarding SEH internals for Win9X. The Win9X NTDLL.dll appears not to export many of the Ki / Rtl Exception functions mentioned above.

Though I know it is possible for an app to replace the "default" handler, it would only be invoked if no other handlers in the chain agree to handle the exception. I guess I'm curious if it is possible be notified immediately after an exception occurs, *before* any of the registered handlers have a chance at it.

Is hooking into the Kernel SEH functions a valid approach to this type of problem? Or is there a better approach to generically protecting against these type of SEH tricks (ie both ring 3 and ring 0)? Indeed, I'm pretty much a newbie to SEH so I will be grateful for any insight.

Thanks,
Clandestiny
crUsAdEr
06-08-2002, 11:45 AM
Hi Clandestiny,

I dont know much about internal working of seh except what you probably have known... fox3 might know somestuff...

I was just thinking of protection against such seh clearing bpm stuff... hooking API is one options, but you can always do it the way icedump protect IDT, by making fs:0 read only and hence notify us if any program is attempting to install its seh for this purpose...

Also, have you tried logging the instruction flow inside seh, that might help i guess... can start /tracex once seh occurs until it reaches the handler, and study the log file... you might be able to get some info out of it...

Just a thought :>... back to my revision... just a tiny weeny bit more then i am done :D

crUsAdEr
foxthree
06-08-2002, 12:14 PM
Hi Clandestiny:

Interesting reading -- your post. You've echoed the exact thoughts I've been having these days after a few weeks of research myself. It all started with the SuperBPM for Win2K thread.

I did research a "permanent" solution to the SEH DRx clearing tricks. In fact, my research concluded in what you just summarized:

Hook KiUserExceptionDispatcher and NtContinue and you've all the control over SEH :) This method will work in both Win9x and WinNT/2K!

In fact, before I could even attempt to write an app to test this out our friend EliCZ has - as usual - beaten us. Check out his XcptLog application in the latest APIHooks package. Awesome ... and with full source code you can do whatever you want :D

In fact, the XcptLog exactly does the same by hooking the above two calls using APIHooks and prints out the thread context when entering KiUserExcpetionDispatcher and before NtContinue is called ;) and all this at USER MODE :eek: ... Yes, you heard me right from USER MODE. No need for any more ring-0 stuff ;)

As some "guru" mentioned, EliCZ is way ahead ... :)

Signed,
-- FoxThree

PS: There may be some pitfalls in hooking it the EliCZ way in ring-3. I believe writing a KMD to do the stuff would be the right way to go. However, there were some people that mentioned that this may not be the 100% solutions and we need to take care of stuff like KiSwapContext and things like that. I'm still not sure about this 'coz my home-brewn variant of XcptLog cures everything :D
Clandestiny
06-10-2002, 10:38 PM
Wow! So I was on the right track... And hooking the kernel exception handler like that is possible (even though EliCZ beat me to it ;) Thanks for the info! No doubt I will have a few more questions for the gurus when my exams are over and I get a chance to look at EliCZ's code in more detail :D

Cheers,
Clandestiny
Kayaker
06-11-2002, 06:48 AM
Hiyas,

Interesting topic indeed. I was looking at Eliczs' code to see how he could have emulated hooking KiUserExceptionDispatcher in Win9x when this isn't exported by that version of ntdll.dll. In NT, he hooks the API directly with:

;------------------------
__EXPORT API_HOOK ApiHookChain[NHOOKS] = {
{"ntdll.dll", "KiUserExceptionDispatcher", HOOK_OVERWRITE, &OldKiUserExceptionDispatcher, &UnhookKiUserExceptionDispatcher, NewKiUserExceptionDispatcher}
;-------------------------

While in Win9x it uses:

;-------------------------
__EXPORT API_HOOK ApiHookChain[NHOOKS] = {
{NULL, 0, HOOK_RAW | HOOK_HARD, &OldKiUserExceptionDispatcher, &UnhookKiUserExceptionDispatcher, NewKiUserExceptionDispatcher}
;-------------------------

From the AH56 source it looks like in the case of NT, the ApiNameOrOrd field in the ApiHookChain API_HOOK structure will contain the string "KiUserExceptionDispatcher" (or "NtContinue"), and the hook is established as such.

But in Win9x it's a HOOK_RAW | HOOK_HARD call, which according to the docs, if HOOK_RAW is set, ApiNameOrOrd must contain a 32bit virtual address (valid in Target).

I'm still working on digesting Eliczs' code, but this seems to say you need to know the RVA of the SEH you want to hook before you can even hook it in Win9x.

I'm trying to interpret the DllMain code in order to understand how the ApiNameOrOrd value is used in
\Ah56\Examples\F-Advanced\C\XcptLog\XcptLogW9X.cpp
My "C-interpretation" skills aren't too polished (meaning I suck at C ;-), does anyone familiar with Eliczs' code have a handle on what the BOOL APIENTRY DllMain code is doing during DLL_PROCESS_ATTACH?

[code]
BOOL APIENTRY DllMain(HINSTANCE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
if(ul_reason_for_call == DLL_PROCESS_ATTACH) {
if(!Inited) {
++Inited;
if((hDLL = hModule) < (HINSTANCE)0x80000000)
return(FALSE);
PBYTE pb = (PBYTE)GetModuleHandle(_T("KERNEL32.DLL"));
if((DWORD)pb < 0xBFF60000)
return(FALSE);
DWORD i;
__try {
for(i = 0x15000; i < 0x20000; i++)
if((*(pb+i) == 0xC7) && (*(pb+i+1) == 0x46) && (*(pb+i+2) == 0x24)
&& (*(PDWORD)(pb+i+3) > (DWORD)pb))
break;
}
__except(EXCEPTION_EXECUTE_HANDLER) {
return(FALSE);
}
if(i < 0x20000) {
ApiHookChain[0].ApiNameOrOrd = (*(LPCSTR*)(pb+i+3));
}
else
return(FALSE);

__try {
for(i = 0x6500; i < 0x9000; i++)
if( (*(pb+i+6) == 0x53) && (*(pb+i+7) == 0x6A) && (*(pb+i+8) == 0x00)
&& (*(pb+i+9) == 0x68) && (*(pb+i+11) == 0x00) && (*(pb+i+12) == 0x2A)
&& (*(pb+i+13) == 0x00) && (*(pb+i+14) == 0xE8))// && (*(pb+i+19) == 0x55))
break;
}
__except(EXCEPTION_EXECUTE_HANDLER) {
return(FALSE);
}
if(i < 0x9000) {
ApiHookChain[1].ApiNameOrOrd = (LPCSTR)(pb+i);
}
else
return(FALSE);

}
else
return(FALSE);
}
return(TRUE);
}
/[code]

There still may be some other low level function call which is used early by the system in processing an exception which can be hooked in time to protect the current CONTEXT structure in Win9x, the trick is to find it. KiUserExceptionDispatcher seems to be the exception handler switching point in NT, but this hookable function is missing in Win9x. Making fs:0 read only and handling the page fault just might be the easiest direct approach after all.

btw, I found a good doc on the Native API ntdll.dll:
http://www.sysinternals.com/ntw2k/info/ntdll.shtml

Cheers,
Kayaker
Kayaker
06-11-2002, 07:25 AM
Hmm, OK I see in Eliczs' forum that DL had problems running XcptLog on Win98, then got it working...

So what was the fix? ;-)
foxthree
06-11-2002, 08:07 AM
Hello Kayaker:

The "fix" was to study the "Test.bat" that is in the same directory as the XcptLog source. Obviously, "DL" made a mistake in giving correct params to XcptLog ;D.

Signed,
-- FoxThree

PS: I'd like to write up a interpretation of EliCZ's C source code but alas I don't have the time right now :(. May be I'll post the dissection later today :)
Ni2
06-11-2002, 04:58 PM
Hi fellas,

Interesting topic indeed. I'm a bit confused about how the following piece of code that kayaker copied from AH56 works and the code that it generates:

*************
While in Win9x it uses:

;-------------------------
__EXPORT API_HOOK ApiHookChain[NHOOKS] = {
{NULL, 0, HOOK_RAW | HOOK_HARD, &OldKiUserExceptionDispatcher, &UnhookKiUserExceptionDispatcher, NewKiUserExceptionDispatcher}
;-------------------------

****************

What is it hooked in this case for 9x? (no dll, no api...)

Regards,
Ni2
foxthree
06-11-2002, 08:29 PM
Hi Ni2:

As Kayaker's posting above says, if there is no API and HOOK_RAW is present, the ApiNameOrOrd must contain a virtual address. In this case, EliCZ's seems to be hooking the addresses 0xBFF87ED3 and 0xBFF76702 for KiUserExceptionDispatcher and NtContinue equivalents! (The Corresponding i values in hex are 0x18320 and 0x6702)

Now the question is to find out why? :)

Signed,
-- FoxThree
Ni2
06-11-2002, 09:16 PM
Hi foxtree!

It's true that 0xBFF87ED3 is called just before the SEH is invoked and 0xBFF76702 is called just after the SEH returns.

Whatda hell are those addresses? SICE says that 0xBFF87ED3 = Kernel32!VirtualQueryEx+2C30 and 0xBFF76702 = FindClose+242 (!!!)

How can he know that? :confused: ElicZ...you are COOL! :cool:

We have to find out that

Ni2
Kayaker
06-12-2002, 06:23 AM
Very cool app. The code checks for the OS then calls the appropriate dll identified by its extension, i.e. XcptLog.w9x, then calls the functions in ApiHooks.dll and PrcWorks.dll to establish the hook.

In the DllMain loading code of XcptLog.w9x is a scan routine of Kernel32.dll for the signature bytes C7 46 24, which is where the first 'magic' address is retrieved:
:BFF88320 C74624D37EF8BF mov [esi+24], BFF87ED3

This address is a function which contains a pointer to an ExceptionInfo structure and must be the kernel code which emulates the functionality of KiUserExceptionDispatcher, or at least is where control returns to from the VMM after an exception.
:BFF87ED3 sub_0_BFF87ED3 proc near
...
:BFF87ED3 ExceptionInfo = _EXCEPTION_POINTERS ptr -1Ch

I decided to trace backwards from this address to see where it came from by setting a
BPM BFF87ED3 X
on it, then setting another BPM on the FromIP address which is returned in the command window of Softice, and so on in reverse until I hit a recognizable system call. About 4 or 5 breaks later I hit the RET in Cancel_Priority_VM_Event:

;---------------
Cancel_Priority_VM_Event+031F
...
0028:C000383E FF15B81001C0 CALL [Adjust_Thread_Exec_Priority]
0028:C0003844 FA CLI
0028:C0003845 C3 RET
;--------------
This is part of VMM code and eventually returns directly to the Kernel32.dll address BFF87ED3.

I wanted to see if instead of creating a HOOK_RAW | HOOK_HARD hook of this address in order to trap SEH exceptions as Eliczs' code does, I could do it from Ring0 by hooking the earlier VMM call first, and then have control over the CONTEXT registers. I've succeeded in hooking Cancel_Priority_VM_Event, and I'm trying to figure out the best way to use the parameters that are on the stack when the hook occurs.

I'm using the SystemHook example code I wrote for the 'Reversing "system tools" under w98' thread on the mini-project forum. I just changed the hook used to Cancel_Priority_VM_Event. The hook is established in a vxd with:
GetVxDServiceOrdinal eax, Cancel_Priority_VM_Event ; Service to hook - CHANGE THIS TO ANY OTHER
mov esi, OFFSET32 HookProc ; pointer to our hook procedure
VMMCall Hook_Device_Service ; address of the specified service returned in ESI
jc hookfailed

In the hook procedure which gets called for the hooked Service, I'm trying to use _VWIN32_Get_Thread_Context to get the debug registers and the rest of the CONTEXT structure.

;============= Begin HookProc =================
BeginProc HookProc, HOOK_PROC, OldServiceAddress, LOCKED

;----------------------------------------------------------------------
; Create a stack frame so we can access stack parameters at time of hook,
; parameters will vary with Service hooked.
;----------------------------------------------------------------------
push ebp
mov ebp, esp

From analyzing the stack at this point I am able to make out 4 parameters
which are passed in response to the Cancel_Priority_VM_Event hook:

; [ebp+04h] == Return address, points to immediately after the Cancel_Priority_VM_Event call
; [ebp+08h] == The Cancel_Priority_VM_Event call itself (it seems)
; [ebp+0Ch] == DDB Vxd_Desc_Block structure
; [ebp+10h] == Thread Block Control structure THCB (tcb_s)

The question now is how to best use this information? It looks like you have complete access to the DDB, from which you can access information on other system drivers, or detect for Softice for example. The Thread Block information I need to explore to see how it can be used. And you _should_ be able to get CONTEXT information with a few system calls as well.

It's this last part that's still giving me some troubles. There's some info on Eliczs' forum about getting the proper context for a _VWIN32_Get_Thread_Context call, but I'm still not sure exactly how it should be done. This is the description for it:

------------------------------------------
_VWIN32_Get_Thread_Context
Copies the registers for the specified thread to the pcontext buffer. Uses C calling conventions.

Returns non-zero value if successful; zero otherwise.
ptcb - Ring 0 thread handle. Indicates the thread to get the context for.
pcontext - Address of a CONTEXT structure that receives the appropriate context of the specified thread. The value of the ContextFlags member of this structure specifies which portions of a thread's context are retrieved
;------------------------------------------

The question is which thread handle is the proper one to get the CONTEXT_DEBUG_REGISTERS values returned after the call? I need the proper thread for the program which installed the SEH and generated the hook. Get_Sys_Thread_Handle gives the system thread handle and Get_Cur_Thread_Handle gets the "currently executing" thread, but I'm not sure if either of these are valid. This is without loading the target program at the moment.

The Owl suggested you have to access R0TCB and TDBX to get the context of a thread other than your own. I don't have enough information on the TCB structure to be able to interpret this suggestion, or even know what TDBX is as part of the tcb_s structure described in vmm.h. Documentation always sucks ;-)

The code seems stable, after handling the hook you chain to the previous hook with jmp [OldServiceAddress]. The only test app I've used so far is XcptLog itself, I figured between it and Etricks.exe setting up SEHs, there would be plenty of opportunity for Cancel_Priority_VM_Event to be called. The hook broke about 12 times, then the app would execute as normal. I don't know if all of them were because of being used in response to an SEH, or whether the system used Cancel_Priority_VM_Event in other cases as well.

But I could use a good test app, Foxthree, I'm not sure if you wrote a little test app which produces SEH code for your testing, but if you think it could be a good test target, could you send it to me or up your test app? I need something simple to try to sort out what I'm seeing here and would like to try it "blind" to see if this technique will hook any app using SEH. If not no problem. Thx..

Kayaker


Swapz button ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Swapz button ?
PDA

View Full Version : Swapz button ?

phop007
06-08-2002, 01:33 PM
Hi!

I am able to shit CustomXP 1.82 but I still wonder where is the code that Change Buy Now Button to Password Button (When you are registered the Buy Now button will become Password Button) and What breakpoint I should make. Any trick there

Thankz
hack3r2k
06-11-2002, 10:35 PM
Well the caption of the button changes after a simple check, so if the program is registered doesn't show 'Buy now' text...

U can set a breakpoint on WM_COMMAND message (u must know button id)
phop007
06-12-2002, 03:53 AM
Sorry I am newbie.
What is "button id" and how can i find it or use it???


Announcement: OEPFinder v0.3 Tensor Build
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Announcement: OEPFinder v0.3 Tensor Build
PDA

View Full Version : Announcement: OEPFinder v0.3 Tensor Build

foxthree
06-08-2002, 04:08 PM
Hello Fellow RCEs:

After a looooong gap, I'm glad to announce the OEPFinder Tensor Build - a brand new release of OEPFinder. This release adds support for Windows 2000 and fixs a lot of nasty bugs on the 2K platform. And thanks to BriteDream, a bug in ASPR apps has been fixed.

You can download the same from hxxp://foxthree.cjb.net.

Please let me know your thoughts and comments.

Hang on for a bunch of new packer sigs to be added shortly ;)

Signed,
-- Foxthree

PS: Thanks to +SplAj guru, CrusAder (hope your exams are going fine ;)) and Kayaker (We'll miss u, great one!)
cyberheg
06-08-2002, 08:48 PM
A suggestion could be to make config file or plugin support. I don't say it's useless as it is but if a new version of a existing packer (or just a new one which isn't added) is released people are forced to wait for you to update it.

Just a thought...

// CyberHeg
snaker
06-09-2002, 05:51 AM
Hi foxthree,

The program is very nice on WIN98...however since you fixed bugs for WIN2K maybe it should work on WINXP as well...however...I couldn't get it to get me a single OEP on WINXP

Always says bad lower base address or scans from [0] to [0]
foxthree
06-09-2002, 09:23 AM
Howdy!

Cyberheg:

Yep. Nice point. Actually, Kayaker too pointed it out to me earlier. About having an external signature file so that people can update it. I'll do it but may be in the next few releases down the line. Thanks for your tip.

Snaker: Reg. WinXP support. I don't have WinXP installed on any of my machines here so that I can test it out. So, guys using WinXP must either find a Win98/2K box or use other techniques or wait.... ;)

Knowing that the third option is a really bad one :D, try the first or second options....

Signed,
-- FoxThree

PS: RV's tracer is now supporting WinXP maybe you could trace using RV tracer... You can also post the result here reg. the tracer's performance on WinXP ;)
snaker
06-09-2002, 10:43 AM
Hmm...

Well foxthree...I hope you can get WINXP soon and find the problems...

Anyways...I don't use REVirgin (sadly...I sure hope tshep isn't reading) coz I'm a firm believer of ImpREC :-)

Anyways...I have made a Generic OEP Finding tool myself...which works on different principles...I will be releasing it with the next release of PEiD...which will perhaps be very soon...

:)

More laters

snaker
foxthree
06-09-2002, 06:17 PM
As the subject goes :D

Signed,
--FoxThree

PS: Will you also be explaining you underlying technique? 'coz I think there are a couple of techniques to find OEiP and OEPFinder uses just one of them ;)
Lbolt99
06-09-2002, 07:57 PM
Thanks for the update. Works great.

How about an IATStartFinder? :)
_Servil_
06-09-2002, 09:19 PM
IATEndFinder plz ;)
foxthree
06-10-2002, 08:54 AM
LBolt/_Servil_:

Nice :) However, I guess that's what RV/ImpREC is there for. You find the OEiP and RV/ImpREC finds the IATStart/End :D. I could write one IAT Start Finder but then I'd be treading on +Tsehp/Mackt's toes ;)

However, newer plugins for RV/ImpREC ... ah, that's another story altogether ;)

Signed,
-- FoxThree
Lbolt99
06-10-2002, 10:02 PM
Hi Fox3,

I know about the IAT finder in RV, although it doesn't seem to work well for some reason. Now this is nothing against RV, quite frankly it blows Imprec to pieces based on my experience, and Tseph has done a great job on it. But for some reason even with the correct OEP I can only get the correct IAT start from RV about 1/3 of the time. Most of the time this is the method I use for ASPR protected stuff:

load app in sice
bpx virtualalloc, with data window view at ds:04001000
hit f5 several times until code changes in window
clear bpx, then bpx getprocessadress, only break once, clear bpx
step thru, ret several times until u get to the IAT decrypt loop :)

This method works perfectly every time. Courtesy of Kayacker.
It's neat to see how ASPR decrypts the IAT and everything but after 4-5 times it gets kinda old :)

[QUOTE]Originally posted by foxthree

Nice :) However, I guess that's what RV/ImpREC is there for. You find the OEiP and RV/ImpREC finds the IATStart/End :D. I could write one IAT Start Finder but then I'd be treading on +Tsehp/Mackt's toes ;)

[/QUOTE
Lbolt99
07-08-2002, 03:57 PM
The tensor build fails to find OEP on Three leaves from Sapphire Games :( Also, seems to lock up on BattleJeep from same company (note this game changes screen resolution to 640x480 when running, went to run OEPFinder, started searching for bytes but stopped responding.

FYI the company seems to be gradually "phasing in" ASprotect: some prods are ASprotected (15pack, 3 leaves, bjeep, etc), some ASpacked and one even has UPX! lol
Lbolt99
07-11-2002, 08:20 PM
My bad, another error :rolleyes:

3leaves is asprotect 1.1 protected, so oepfinder didn't get it b/c it only supports 1.2+.. duh

getprocaddress is the only unresolved import.

Still have the problem with the lockup on battlejeep, though. /tracex will get you to the OEP however, watch for three pre-oep dipz
haec_est
07-17-2002, 08:38 PM
Hi,

it seems that OEPFinder 0.3 [Tensor build] search for signature bytes starting
at image base, but for some programs it may be not the case... expecially if
the packer map that signature at a lower address than image base !!!

example :

Macromedia Director 8.5.1 Trial (Vbox 4.6.2 but signature is the same)

image base : 0x20000000

OEiP : 0x200072F8
iat start : 0x2026F000
iat len : 0x00001158

redirected api : 0x02

:dd 2026fe80 l 10
001B:2026FE80 0700EB50 0700EBBF 77E3594C 77E359D6 P.......LY.w.Y.w

:u 700eb50 l 1c
001b:0700eb50 e819000000 call 0700eb6e
001b:0700eb55 ff742410 push dword ptr [esp+10]
001b:0700eb59 ff742410 push dword ptr [esp+10]
001b:0700eb5d ff742410 push dword ptr [esp+10]
001b:0700eb61 ff742410 push dword ptr [esp+10]
001b:0700eb65 ff158cc30407 call [USER32!GetMessageA]
001b:0700eb6b c21000 ret 0010

:u 700ebbf l 20
001b:0700ebbf 55 push ebp
001b:0700ebc0 8bec mov ebp,esp
001b:0700ebc2 e8a7ffffff call 0700eb6e
001b:0700ebc7 ff7518 push dword ptr [ebp+18]
001b:0700ebca ff7514 push dword ptr [ebp+14]
001b:0700ebcd ff7510 push dword ptr [ebp+10]
001b:0700ebd0 ff750c push dword ptr [ebp+0c]
001b:0700ebd3 ff7508 push dword ptr [ebp+08]
001b:0700ebd6 ff15d4c30407 call [USER32!PeekMessageA]
001b:0700ebdc 5d pop ebp
001b:0700ebdd c21400 ret 0014

... same as Dreamweaver MX !

OEPFinder says :

Identified Platform: Microsoft Windows 2000 Professional (Build 2195)
Enumerating Processes...
Ready...
Refreshed Process List...
Scanning Process Director.exe [PID = 2EC] for "VBox 4.6.5"...
Scanning memory range : [20000000] to [6F03C000] for OEP Bytes
iMemMap = 166
----> FAILED!: Unable to find OEP byte pattern :(. Are you sure you chose the right packer?
Scanning Complete...Have a nice day!

while SoftICE says :

:u e709af l 7
001b:00e709af ffe3 jmp ebx -> jump to OEP
001b:00e709b1 eb01 jmp 00e709b4

obfuscated as :

001b:00e709ad cd20 int 20 VXDJmp 01EB,63FF

:db e709ab l 10
0010:00E709AB EB 02 CD 20 FF E3 EB 01-EB 8B 55 F8 EB 02 CD 20 ... ......U....

...signature bytes are still there but at a lower adress than image base, so better
search in entire memory :)

regards,

haec_est
jefflee
12-06-2004, 11:40 AM
foxthree, kick u.
Ur site foxthree.cjb.net prompts me to install a plugin, and I installed,
found it spawned two processes(Oh no, three). It's a virus! Damn.
dELTA
12-06-2004, 12:19 PM
The cjb.net redirector service is pushing spyware and has always done so, yes. It does most likely not have anything to do with foxthree's website though. And as a general tip, don't answer yes on strange dialog boxes that pop up on arbitrary websites... :rolleyes:
JMI
12-07-2004, 06:15 AM
Let's see, nearly two years after the last post in this thread he tries to log on and doesnt' have the good sense not to click "yes" when asked to install a plug-in from someone he doesn't know anything about. Duh! You can fool some of the people all of the time. :thinking:

Regards,
jefflee
12-08-2004, 01:50 AM
The cjb.net redirector service is pushing spyware and has always done so, yes. It does most likely not have anything to do with foxthree's website though. And as a general tip, don't answer yes on strange dialog boxes that pop up on arbitrary websites... :rolleyes:

Thanks for ur advise. Is cjb.net just a redirector? I dont know. I was prompted that and I can't see anything in the page but a sentence saying only if I installed the plugin can I view the page, and I just didn't expect an address published here will contain malicious software. So I chose yes. I guessed it might be some plugin to view some kind of animation or something else.
jefflee
12-08-2004, 01:56 AM
Let's see, nearly two years after the last post in this thread he tries to log on and doesnt' have the good sense not to click "yes" when asked to install a plug-in from someone he doesn't know anything about. Duh! You can fool some of the people all of the time. :thinking:

Regards,

Duh. Could u be less cynical? I'm just an ordinary user. I didn't suspect a publisher here so I click "yes". Though it shows to be a misjudgement.
Does two years make much sense? I see many homepages existing several years.


E-License vtcpak33d.dll and Deep Paint 1.1b
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > E-License vtcpak33d.dll and Deep Paint 1.1b
PDA

View Full Version : E-License vtcpak33d.dll and Deep Paint 1.1b

Artifex
06-09-2002, 07:25 PM
Deep Paint v.1.1b

h**p://w*w.righthemisphere.com/products/dpaint/downloads/_dpdldemo.php3

Wrapped with ViaTech e-License (vtcpak33d.dll)

With Softice :
bpx bff6430d if (ax==9001)
F5
bff6430d jmp eax
f10
xxxx9001 (02319001 or 021f9001)

g 0222ffad or g 0210ffad (xxxx - 000f)

if your 30-day trial period is not over :
at xxxxffad nag screen (TRY, BYE, QUIT)
f10
xxxxffad
xxxxffb2
g 02483bff (or xxxx + 0022)
02483bff jmp [024a2024] = jump to 52ac00 (OEP)
a
jmp eip
/dump 400000 3e7000 dpdump1.exe
------------------------------------------

if your 30 day trial period is over :
r eip xxxxffb2
g 0223145c : don't jump to 022388e
g 0223388e : jump to 022333dc
g 0223464b : wrapper does unpacking
g 0223465d : wrapper works upon PEHeader (changes it, moves it (?) and zeroes part of it (4000xx to 4002xx)
g 02483bff jmp [024a2024] = jump to 52ac00 (OEP)
a
jmp eip
/dump 400000 3e7000 dpdump1.exe

-------------------------------------------

Dump crashes (is has a zeroed PEHeader) and I can't do more !

Artifex
foxthree
06-09-2002, 07:39 PM
Hi Artifex:

Try fixing the PEHeader in the dump from the one in the file on disk. If that doesn't work, try bpx VirtualProtect. Surely the packer must call this (or VirtualProtectEx) to write into PE Header area!

A whooping 18MB download is too much for my dial-up :D. I'll try this target later.

Success!

Signed,
-- FoxThree
LaptoniC
06-09-2002, 09:32 PM
Open program when dialog box appears go to softice and put bpx on freelibrary
F11 and step it you will see the OEP.Dump with pedump and it will be ok.

Whatever method you try it works with this protection scheme.Secret key is rename unpacked program to back to its orignal.So it will work :) Hehe sometimes answer i so simple.
Artifex
06-10-2002, 05:32 AM
to Foxthree : I dug into this peheader zeroing call at 0223465d and dumped 400000 400 before it does its job, and I pasted it in dumped file, but it keeps crashing.

to LapTonic : I read your answers in another thread in 2001 about earlier version of e-License. I know you use pedump from TRW, and I remember about not renaming dumped file. I project to try with TRW but haven't done yet.
ProcDump refuses to dump this file. Only icedump accepts.

Many thanks for the help.

Artifex
+SplAj
06-10-2002, 07:48 AM
Just an encryptor?

From my experience with e-licence it is just an encryptor , not packed at all and the OEiP == OEiP already so you just open up the target with SI and set BPX OEiP, then F5 and the bloody thing decrypts itself :)

Then you just dump and rebuilt IAT with LordPE ? (or catch it in memory and dump .idata section) rename the exe as the original filename and it is busted.

Simple as that ! maybe they did something more these days , but I doubt it.

I think there was a question about DeepPaint3D on the G-rom bored .....but there was a bit of *censorship* going on.

Spl/\j
+SplAj
06-10-2002, 08:03 AM
Artifex

It is now version 2.0 ???? +25 megs

zzz.righthemisphere.com/products/dp3d/downloads/dp3d20.exe

Spl/\j
+SplAj
06-10-2002, 10:27 AM
noop,

nothing has changed...............just busted it under Win2K in 15 mins.

OEiP, IT & IAT stay the same. Just look at the PE header with LordPE, use RV or imprec to remap IT in it's existing place and rename dumped_exe to Deep3D.exe and it's done.

Thats an interesting RCE point about the name of the exe...if it's any other name than 'Deep3d.exe' the dll FileIO.dll fails to load and exe exits......FileIO.dll is NOT part of regular Imports in IAT at all but is dynamically loaded.

BTW a $995 product deserves a better protection than e-licence, if it's really worth $995 ??? I use MS Paint ;)

Spl/\j
Artifex
06-10-2002, 10:37 AM
Hi, SplAj, and many thanks for helping.

Deep Paint 1.10b is not an older version of Deep Paint3d 2.0.
They are two different softwares.

The question is about Deep Paint 1.10b.

eLicense dll is now vtcpak33d.dll and no longer vtcpak24.dll

Artifex
+SplAj
06-10-2002, 10:48 AM
Silly me

Deep Paint v. Deep paint 3D.... now I get it :)

Spl/\j
Artifex
06-10-2002, 12:15 PM
+SplAj wrote :
>OEiP, IT & IAT stay the same. Just look at the PE header with >LordPE, use RV or imprec to remap IT in it's existing place and >rename dumped_exe to Deep3D.exe and it's done.

I will let you know if I can apply this method to Deep1.10b.

My next project was Deep3D !

>BTW a $995 product deserves a better protection than e->licence, if it's really worth $995 ??? I use MS Paint ;)

I can't say because I don't paint :-)

Many thanks again, +SplAj

Artifex
+SplAj
06-10-2002, 12:39 PM
Well....

It appears that since vtcpak32.dll in DP3D v2.02 and vtcpak33.dll in DP1.1 the IAT is encrypted and decrypted one API at a time ;)

Something to play with later :)

Makes a change from ASPR LOL.

Spl/\j

on further look it must be an option in the v3 toolkit cos the dll are really same. On DP3D they did not protect IAT and on DP1.1 they did.

I am d/l some more targets from the 'news' section of e-licence site........nice of them to give us target practice :)
Artifex
06-10-2002, 06:42 PM
Hello, +SplAj

I tried to dump Deep Paint 3D v.2.0 Demo :

bpx FreeLibrary
f12
g 2483acf (OEP 5cfaec)
a
jmp eip
f5

LordPE.exe
full dump
(options :
-paste header from disk
-fix header)

Header and Import Table seem OK

IAT : RVA 00000000 Size 00000000 (I don't know that yet, I will read about it)

renamed dumped.exe Deep3D.exe
ran it and got "invalid data"

If the problem is in IAT, what OEP, RVA and Size have I to feed Revirgin with ?

Artifex
+SplAj
06-10-2002, 09:19 PM
Hello

I attach some notes about DeepPaint 1.1b cos this had a very interesting IAT redirerector with a XOR to establish API value.

See the attachmenet....

Read the notes and see what I did with e-licence while the wife was doing her hair.... jeez women take tooooo long on their quifs :)

Real simple for DP3Dv2.... just get a BPMB OEiP X somehow ;)
and wait......then when SI pops just EB FE and then use LordPE to DUMP and RV to re-resolve the IAT and it's done......all infos are in the PE header already :)

Spl/\j

i'm off to the pub....
Artifex
06-11-2002, 06:27 AM
Congratulations +SplAj, and many thanks for the tutorial. It is one more step in this art.
I will study it and learn.

I couldn't get a running dump of Deep3D yet :-( but I am trying hard !
Then I will try with DeepPaint 1.10b.

Artifex
SpeKKeL
06-11-2002, 04:16 PM
Sjit spla/\ your're to fast for me....hehehe

JUst when to reply you made a whole tut..Think my wife has a shorter hair cut.

;)
Yes seems they upgraded the vtc-pack, must think back about 2 or 3 years when i asked you to look at their encryption system.

Made a few modifications on an existing plugin (some simple xoring with 10 bytes further) and all is resolved.

See you all,

SpekK
Artifex
06-11-2002, 06:45 PM
After tens of attempts, I finally got a running dump of Deep3D.

First step was to get sections fixed.
I failed with ProcDump and IceDump, and only get them fixed using LordPro.

Then I used Revirgin 1.3 (my OS is Windows ME). It found RVA and Length, added a section, filled it with IT and fixed the import table entry point and size. But when I ran the dumped file, I got a message about a "SIN.dll" missing.

So I used Import Reconstructor, got the dump running OK at first attempt..., and uninstalled Deep3d !

----------------------

Now I will follow +SplAj's tutorial and try with Deep Paint 1.1b

Artifex
Artifex
06-11-2002, 08:25 PM
Hello, +SplAj !

With your tutorial, I got a running OK dump of Deep Paint 1.1b.
I used LordPE and Import Recuperator.

Address xxxx:029F63b0 in your PC, is xxx:022063b0 in mine.
I found it using :
s 0 l ffffffff 8b 95 ac fd ff ff 89 11

Deep Paint 1.1b is now uninstalled and I will rest a bit until next project :-)

CacheX 4.51 is also an interesting target.

Artifex
+SplAj
06-12-2002, 11:38 AM
Hi Spekk

I knew the mention of PLUGIN would get you going :)

Can I suggest you make some notes available for the rest of us on patching some new redirector-emulation code into an existing plugin dll ???? Like you said it was a simple xor with 0x10bytes along plus the decrypt-code was a consistent formula so an automatic approach was possible.

Artifex, congrats :)

BTW ALWAYS use LordPE for dumping etc etc... I keep repeating that ;)

Amen

Spl/\j
SpeKKeL
06-12-2002, 12:12 PM
Well just some simple notes:

I use the "standerd" plugin telock.dll delivered by imprec/r.v.
First look at the source code(included) and you will see it is not a tracer but an opcode checker: so after tracing the address, the plugin checks
for an opcode: cmp byte ptr[ebx], 0FFh < ebx is the address to where was called. FFh the opcode.
At this point you can paste your own code like in vtcpak you can
check if cmp byte ptr[ebx], 050h if so then

mov eax,[ebx+2]
mov eax,[eax]
mov ebx,[ebx+8] < total 10 bytes from ebx
xor eax,[ebx]
jmp back ( api= found in eax )

So for this target it was a verry simple solution.

Changes and pasting i did with Hiew.Better is to rewrite the
(T)asm-source but i still can't copile the original gives some errors...
Try using the telock.dll plugin on a target , set bpx readfile give 1 time F5 and 1 time F12 and see what,where is stored.

Okee so far this reversing note and like i said earlier: All the credits go to the author of the original dll !!

SpeKK.
+SplAj
06-12-2002, 08:51 PM
Hajo

I attach the source code (with comments) and ready built vtcpak33.dll plugin for RV/Imprec plugin folder.....compliments of Spl/\j and SpeKK :)

hav phun

... I attach updated zip with makefile for dll + resource now :)
SpeKKeL
06-12-2002, 09:06 PM
Okeeeee !!!!!!!

Seems familair to me..

Let's pLug It In...

((H'm wonder how long she did this time about her hair......))

mov ebx!, dword ptr[ebx+2]

hehehe LOL ebx,ebx,ebx ...!!!

:D :rolleyes: :p

See you,

Spekk.
FilipeMB
01-25-2005, 09:44 AM
Sorry but i'm a newba.
What is BPMB OEiP X ?
dELTA
01-25-2005, 01:26 PM
Ok folks, I think we have a new record... :rolleyes:
FilipeMB
01-25-2005, 01:54 PM
Ok folks, I think we have a new record... :rolleyes:
And i promise that i went to search and look at FAQ ok? :D
Kayaker
01-25-2005, 02:50 PM
I'm surprised that dELTA is surprised (he loves it when people resurrect 3 year old threads :devil: )

Damn, BPMB OEiP X is not in the FAQ?? We've got to fix that.

While it probably makes no sense when you first see it, you *could* have done a more effective search and come closer to the answer.

BPMB is easily searchable to identify it as a Softice command of the form:
bpmb <address> x
The Softice docs explain it further and what the x stands for.

The OEiP is more of a subculture term methinks, but again it turns up in something like 91 threads on this board. Read a few of these posts and by osmosis if nothing else, you should be able to learn what OEP stands for.

I'm not trying to not answer your question, but instead give you a strategy for answering it for yourself.
FilipeMB
01-25-2005, 03:03 PM
Guy, i love the mode of you answer the question. You make me understand this.
Another thing: I try to use SoftIce at WindowsXP and SoftIce doesn't load (message from SoftIce Symbols Loader).
And in Windows98SE, SoftIce load but i can't make anything at SoftIce symbols loader (i read the FAQ but i didn't find anything about how make it works for what all of you are telling at this forum).
I really want to know how unpack e-licence system. It's a hard system to unpack but i want.
dELTA
01-25-2005, 05:06 PM
Yeah, sure, we really believe that you read all the threads about softice problems on this board, and tried all the suggestions in them, especially after the demonstration of your amazing searching skills in the first post... Nice way to follow up an undeservingly helpful answer (not to mention the final touch "I really want to know how unpack e-licence system")... :rolleyes:
JMI
01-25-2005, 05:12 PM
In "other words" your "excuses" are not selling very well. :idea:

Regards,
FilipeMB
01-25-2005, 05:34 PM
Lol lol.
Now i see how much you love me. :devil:
hobferret
01-26-2005, 05:45 AM
Bloody Hell ;)

Not another, there is enough info on this board to give you all you need to unpack elic in <5mins :yay:

/hobferret


KaZaA 1.71: packed with pex variant?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > KaZaA 1.71: packed with pex variant?
PDA

View Full Version : KaZaA 1.71: packed with pex variant?

roulic
06-10-2002, 02:43 AM
Hello,

I'm very new to this sort of thing, so please excuse my ineptitude.

I've been trying unsuccessfully for a little while to unpack the latest KaZaA version. One of the file ID programs claims that kazaa.exe is packed with pex 0.99, but this is not the case according to DeX. I have poked around the pex sources, however, and noticed that its code is virtually identical to that in KaZaA. Also, a previous version of KaZaA /was/ encrypted with pex 0.99 and could be unpacked with DeX. This leads me to think that the KaZaA team has altered pex in order to provide slightly better protection.

So anyway, my question is: How in God's name does one unpack this mutha? I've traced through it a ton of times with SoftICE and my favourite debugger and I simply cannot do it. I've read the unpacking tutorials, and still no go.

If anybody could provide some helpful tips, I would be forever greatful.

Sorry about the tone of this message; I'm just a little frustrated.

Thanks again!
CoDe_InSiDe
06-10-2002, 06:04 AM
Hi roulic,

Yes, it's still protected with PeX, but i think the KaZaA people manually removed the label (+ beginning jmp) of PeX v0.99 .
Anyway, PeX isn't difficult to remove you could try a Tutorial from me which can be found at:

lunarpages.com/codeinside

I hope it can be usefull, if not search for more Unpack Tutorials :D

Cya...

CoDe_InSiDe
roulic
06-10-2002, 08:33 AM
Hi,

First, let me thank you for your awesome tutorial on unpacking PeX programs. The only thing I can't understand is the part where you say to do this:

d fs:00
d cs:(offset in data window)+4
bpx (offset in data window)

What's the 'offset in data window'? Like, when I do 'd fs:00', and it spurts out '12 FC 44 00', am I supposed to piece that together and use it as the offset?

Thanks in advance!
Fake51
06-10-2002, 11:44 AM
Hi,

First, let me thank you for your awesome tutorial on unpacking PeX programs. The only thing I can't understand is the part where you say to do this:

d fs:00
d csoffset in data window)+4
bpx (offset in data window)

What's the 'offset in data window'? Like, when I do 'd fs:00', and it spurts out '12 FC 44 00', am I supposed to piece that together and use it as the offset?

If you haven't noticed, 44fc12h lies in a range that would suggest your normal win32 exe. Consider using dd sometimes instead of db (in softice, ofcourse) to see things clearer.

Fake
roulic
06-10-2002, 08:15 PM
Ah, got it. Excellent.

Thanks a lot!
SpeKKeL
06-20-2002, 09:06 PM
Hajo,

I had a chat with our aspro-guru splaj, about writing a plugin for pex0.99.
This is nice packer and it misleads imprec and r.v in resolving..
I wrote a plugin for imprec/r.v (not tested on r.v but should work)
so they recognise the called (jumped) api's.
It's just a re-calculation:[ jumped api ] sub the[ pre-api-codes] that are made.
I tested on pex 0.99 itself and it resolves all.
This should make resolving a piece of cake.

attached pex 0.99.dll and pex 0.99.asm
SOLDIER8514
08-24-2002, 09:12 PM
I ve unpack kazaa thanks to MUP_PeX_v0.99 under softice

http://www1.lunarpages.com/codeinside/MUP_PeX_v0.99.zip

then dump it under procdump and change the EP and Raw offsets

but the dump.exe of it idoesn t work

Someone can help me ?


crc's of executable
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > crc's of executable
PDA

View Full Version : crc's of executable

lowrunner
06-10-2002, 03:51 AM
Hey, I'm on the other side of things... I'm wondering how to calculate a CRC of my own code during execution in order to thwart hackers.. (Yes I know it won't really, but indulge me if you will)

Anybody have any tips? Any docs I should look at?

Thanks.

Platform win32 (windows2000)

p.s. I have discovered the windows API to ReadProcessMemory and WriteProcessMemory, but it is not obvious to me how to find how large the process is- which parts are executable and which parts are memory- at what address they actually reside (if I don't trust they are at 0x400....0).. etc.

---Also---

Does anyone know if the win32 api IsDebuggerPresent actually detects SoftIce?
IcyDee
06-10-2002, 09:51 AM
lowrunner

Several points really.

1. You can calulate a CRC on the file. This will tell you if the file has been modified. I assume you have a CRC routine already. It will not however tell you that the contents of memory have been modified (by patches, breakpoints etc.)

2. Calculating the CRC of memory is more involved. You cannot calulate the CRC of the data section (for obvious reasons) and must content yourself in calculating the CRC of read only sections.

3. Even read only code can be different to that on disc. Look at relocation items for instance. Most (all) of the time an exe file will not be relocated but a DLL may be. Safest approach is to only CRC between relocation items.

4. Don't, don't, don't check the CRC by comparing it with the 'correct' value and then jump to good-boy, bad-boy code. This is easily patched by a cracker. Instead use the CRC value, for example as the decryption key for some later calculation. If the cracker patches the code, the CRC value is altered, the decryption key is corrupted and the program fails later!

5. You may ask how do you know what the correct CRC should be when you are writing your code? You don't. You will need a post compile process which takes your exe file and works out the CRC of the sections you are interested in. It can then 'inject' the value into the appropriate parts of the program where it is used. Similarly if you encrypt your program you will need a post compile process.

This is only a brief note on these points, we could get into more detail but in the same way as crackers do not put all of their detail on message boards so as not to give the game away to protectors, it also works the other way around too :D

p.s.
When you get a handle for a process, as in LoadLibrary, you will see that the handle is simply the address of the start of memory for that process. The memory also holds the files PE header so as long as you know the PE format (essential for what you are doing) then you have everything you need including the size of the memory section. I can't remember off hand how to get the address of your own process but I am sure I can look it up for you.

It is hardly worth while trying to detect SoftIce, there are many-many ways of doing so and an (almost) equal number of ways to hide SoftIce from such checks.
lowrunner
06-10-2002, 06:47 PM
Thanks.. i will especially take the SoftIce comment to heart.

I only need to calculate the crc the program as it runs, not check for its correctness.

So, I have downloaded the PE format specification from MS. What a monster it is. Do you know of simple demonstrations of interpretting PEs that *aren't* in assembly?

(I admit it, I'm spoiled)

-- Also --

Most of the hacks I have been reading about involve modifying a few parts of the exe so that a check is not made.. Or waiting until after unpacking, and then dumping the program to disk...

Would there be any significant increase in difficulty if the hacker were forced to insert entirely new sets of code (rather than modify or nullify existing)?

---

Thanks again.
cyberheg
06-10-2002, 09:00 PM
Originally posted by lowrunner
Thanks.. i will especially take the SoftIce comment to heart.

I only need to calculate the crc the program as it runs, not check for its correctness.

So, I have downloaded the PE format specification from MS. What a monster it is. Do you know of simple demonstrations of interpretting PEs that *aren't* in assembly?

(I admit it, I'm spoiled)

There is one from a guy called Luevelsmeyer. I am not sure where to obtain this but it contains some examples in C and ofcourse some in assembly aswell. I don't think you will get rid of the assembly part fully since PE is really lowlevel stuff and some parts is not really possible to do/show in a highlevel language.
One thing is theory though and another practice. If you understand the theory there's alot stuff you can do with you favorate language.

Originally posted by lowrunner
Most of the hacks I have been reading about involve modifying a few parts of the exe so that a check is not made.. Or waiting until after unpacking, and then dumping the program to disk...

Would there be any significant increase in difficulty if the hacker were forced to insert entirely new sets of code (rather than modify or nullify existing)?
[/B]

Tell me what you mean about new set of codes and I'll tell you about difficulty. If you have a license check which you can isolate from the rest of the program and it won't depend on your code and your code won't depend on the check in a significant way, then it will be possible to remove entirely or nullify as you call it. Imagine the following two cases:

You do a simple license check during compare:
The value 12345678 comes from a license file of any kind.

Compare(hardcoded value, 12345678)
if equal proceed else show error

You do a calculation using the value from the license:

... <your super duper secret algorithm> ...
add(constant, 12345678)
... <continue calculations>...

Hopefully you see the difference here and can understand the change in dificulty. First one you can isolate and force it to become correct every time. Even if you don't know the original value (in this case 12345678) because your code doesn't rely on the checking after it's completed.

In the 2nd case you need to find out whats the real value. Mainly because if you don't do that then your super algorithm will give bad results and your code could crash if it's not behaving correctly.

When you write a new set of codes I think of emulation similar to dongles. Imagine a dongle which supports saving maybe 64 values like the one above. Either of them can be used like above. Additionally it contains some secret hashing/encryption algorithm so a input I will give a output O. If used correctly you can make your program depend on the dongle and you need to write a emulation for it to make the program think there is a dongle connected. If used wrongly you don't need a emulation because the method of checking could be like the first example which is defeated easily for anyone who knows just a bit of cracking.

As for your checksum idea I say it's good if used wisely. Again you could use it in the above two ways (use or misuse) but it's a good thing to include.

Ok thats it for now :)

// CyberHeg
cyberheg
06-10-2002, 09:11 PM
Here you go:

http://personal5.iddeo.es/ret007ow/PE.TXT
lowrunner
06-10-2002, 11:30 PM
Thanks again

I'll post again with more specifics in the future.
Kayaker
06-10-2002, 11:31 PM
Hi lowrunner,

There's a few good places you can check for information. One very handy reference when you finally get down to coding something to parse the PE header is an article in the ID_RIP archive available on this site, "Exe file format with offsets rather than explanations" exe_hdr.html by FatboyJoe. Looking at the PE header as a structure you can recognize in a hex editor rather than trying to piece it together from descriptions in a multipage document may make it easier to interpret. The file can be upped here if you can't find it.

A utility such as PEBrowsePro will help immensely as well if you run it on a few PE files and view the output. As for examples of some code which will "walk" the PE header so you can find the section addresses and sizes or however you want to use it in a protection, there are likely some examples in C/C++ out there, but you may have to interpret an ASM source example such as PELabs by Latigo or some other "PE" utility with source that has been offered up. Check out the Protools site at the bottom of the page, or Iczelion's ASM site for examples.

You're probably already familiar with general protection resources, but also check out Fravia's "How to Protect Better" labs on his searchlores site. I think DelphiBox has some good information for programmers as well. Good Luck.

Kayaker
lowrunner
06-11-2002, 12:51 AM
After reading the last post I did a quick google search for "Exe file format with offsets rather than explanations" (just out of curiousity) and ran into this article: (strange isn't it, from MS)

You probably have already seen it. But if you haven't, it contains compilable C code that will traverse a PE.

h t t p : //www.anticracking.sk/EliCZ/import/msdn_pefile.htm

....

Thanks again everybody. I'm sure I'll post another question soon enough. I have plenty of docs to read through now!


aspack inline patching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > aspack inline patching
PDA

View Full Version : aspack inline patching

salsa
06-10-2002, 08:54 AM
Read a couple of tuts about inline patching Aspack 2.12 lately. Successfully patched all less one stubborn app.

This is what I do:

Search for the signature bytes with an hex editor. Set bpx GetProcAddress, break and trace down to the push before the ret. See the OEiP at the push, dump and fix the app. All OK. Find the place to patch, on unpacked one put a jump after popad and inject my patch bytes (eg., mov byte ptr [0053A805], 75 or mov al, 01 and ret) at the jumped location then push oep (eg., B819654200FFEO).

This method worked fine for a couple of apps, however one single Aspack 2.12 app refuses to work. I get an invalid page fault everytime. Tried many places, correctly inserted some required number of extra bytes at the end but no avail. Got the fault at the very beginning of the jumped location each and every time. What am I missing?

Thx
nikolatesla20
06-10-2002, 02:26 PM
I would say there could be two things to look for:

1. First off, this code mov byte ptr [0053A805] - make sure this is a global variable !!! or you are screwed. If it's a dynamic pointer you will hose yourself with a GPF for sure. If you saw this value in the dump, run the original program in SI a couple of times and make sure the value stays the same ( the 0053A805). Just to be on the safe side :)

2. The code you inject, where is it? Pay attention to the PE header information about sections and section size. You might be ending up in BETWEEN sections for all you know if you haven't made sure. Or in a section that is not even loaded. But my bigger bet is you aren't even in a valid section, hence the GPF. Just a guess.

The other trick the seems to work better sometimes is not using a jump. Rather, your "jump" code you should just put a PUSH <address of your code> and then a RET. This ensures you don't get any screwy jump range limits or anything. It will be more reliable. You would need more room in your target at its start of course to do something like that.

Well anyway just a few ideas for you to check out.

-nt20
mEtAl
06-10-2002, 09:54 PM
Hi!

You mean you put a jump after popad and inject my patch bytes in the PACKED exe?

You said Unpacked....and that's no meaning with as then you don't need an inlinepatch for the unpacked exe ;)

Which was the program that refused to work ?

Regards

mEtAl
salsa
06-10-2002, 10:38 PM
I mistyped. It is the "packed" one of course.

h**p://kazakov.info/medical.htm

It requires a total of 3 bytes patch. One for SICE, one for NTICE and one for registration. All are clear so, no need for posting offsets here.

Thx
mEtAl
06-11-2002, 07:58 PM
Hi!

Ok Salsa, i cracked the proggie now.
I can tell u how to do if you want, if you want me to explain just send me a PM.

mEtAl
salsa
06-11-2002, 10:26 PM
Thanks for your time and effort but I am rather interested in the inline patching part of it. If "cracked" means "inline patched" go tell us, otherwise don't coz, I've already have an unpacked, patched and discarded exe.

If you have found a remedy (patching after the unpacking routine and before pushing the OEP without getting an invalid page fault) which is different from the methods posted by me and nikolatesla20 please share it, and if you do prefer keeping the details private, OK I can PM you.

Thanks again.
salsa
06-12-2002, 11:32 AM
Used foxthree's OEPfinder. It found the signature bytes of Aspack in memory. On the unpacked and dumped executable they are there but I can't see them on the packed one when I go to the offset given. On some packed executables sig bytes can be found with a hex editor, on some you cannot. All the tuts I read rely on this method (ie. find sig bytes on the packed one -> jump and inject your code -> return). In fact, there aren't much aspack inline patching tuts, all focus on unpacking only. Searched threads in this forum and Krobar's site and I think I had all the available.

Now the story. Failed IP on an aspacked app. Found a crack (inline patch) for another app from the same company. I studied the difference between the original and the inline patched one. Cracked one takes a long jump from .aspack section (E9xxxxxx - only xxxxxx is patched) to .rdata section, injects patch code (plain) and does not push or call OEiP but jumps back. I am puzzled. On the packed one, if the code in .aspack section is packed or encrypted how can one find a plain jump code, if not why the sig bytes are not visible?

Thx
mEtAl
06-12-2002, 12:53 PM
Hi!

Yes i meant inlinepatched it :)

The program you have is packed with ASPack v2.11, this version is abit different then 2.12, but acually not...

And you won't find the signature bytes in version 2.11

Signature bytes:

Push 00000000 ; will push the OEP
Ret ; Will go to the OEP

I think you patch this to a JMP or so for version 2.12 and then you insert your inlinepatch where the JMP jumps to in the exe right?

ok, these bytes you won't find in the exe code of aspack 2.11.

I could write you a little tut, or else I could send you a program i coded togheter with a friend which is able to inlinepatch programs packed with ASPack.

PM me please

mEtAl
ThunderPwr
07-21-2004, 04:25 PM
Hy mEtAl, I'm newbie and actually to study manual unpacking I to work around DVR-Studio 0.99g. With PE_Stud I have the information about the packer wich is
ASProtect 1.2x [new strain].

I need some little help from you through the OEP finding process, caould you please help me with this?

I've the major tool necessary to do it, but this is my first unpacking crack.

Thanks a lot... in advance

Byez
ThunderPwr
dELTA
07-21-2004, 05:09 PM
For the love of god...

ThunderPwr:

* Don't crosspost.

* Don't reply to messages in "unrelated" threads with stupid unrelated tut/crack requests (the definition of "related threads" is not every thread that matches your search for "Aspack OEP", even though I do have to give you at least some credit for doing some searching, contrary to so many other :)).

* Don't reply to threads that are two years old, addressing users that are no longer members.

* Don't post the name of your app, espcecially not when asking questions that could lead to target related information.

* Read the FAQ, now.
ThunderPwr
07-21-2004, 06:03 PM
Byez
ThunderPwr
cRk
07-21-2004, 09:14 PM
I could write you a little tut, or else I could send you a program i coded togheter with a friend which is able to inlinepatch programs packed with ASPack.

is this tool available for public or just for the persons who ask you to share?? in that case i would love to try it if possible... :)

btw does someone knows if there's such tool for inline patching Neolite 2.x packed apps..i've hear there's a tool but never couldn't find anything about it.

Regards
Kayaker
07-21-2004, 09:30 PM
Ahem? :D

06-12-2002, 01:53 PM
mEtAl
Guest
I could write you a little tut, ...
JMI
07-21-2004, 09:38 PM
And cRk:

Not only is your request 2 years late, it also violates our Rules against asking for the Tools of the Trade. :whoops:
You remember, where it states:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

This Rule still applies, even after a couple of years delay, and even if it is hard to find. :thinking:

Regards,
cRk
07-23-2004, 05:13 AM
Not only is your request 2 years late, it also violates our Rules against asking for the Tools of the Trade.

i know you're always trying to the right thing and work for us :D but i DID search .. i was concerned this tool is private and only maybe available for the one who ask for it.even i did a huge search all around in fact there isn't any information related to such tool available
06-12-2002, 01:53 PM

i know for sure mEtal is still around .. maybe that was the reason of my reply for this OLD topic and maybeee he still be glad to share his mistery private tool

anyway i'll stop from been lazy sometimes and do my own inline patch .. manual has been always the best method! :yay:


safedisc lt info request
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > safedisc lt info request
PDA

View Full Version : safedisc lt info request

sadsack
06-11-2002, 01:05 AM
hi guyz, well this is my first ever posting, so FLAME ON...

well ive been everywhere else, but alas i havent managed to find the kind of info i need...

i would like to find out if someone knows anything about safedisc lt, safedisc alt, safedisc lite, or whatever peeps will be calling it tomorrow.....

i know about the files that are placed on the discs but i just wanted to know if it can be removed or reversed ?

i have tried numerous progs, such as c dilla, laxity, daemon tools, insektors, unsafedisc (various versions) safedisc 3.1, also other unpackers, but all to no avail, i can guess that there all ment 4 safedisc v`s 1 & 2, so its not surprising that they dont work.

as a newbie it would be gr8 if sumone could point me in the rite direction.

many thanx in advance
hack3r2k
06-11-2002, 10:31 PM
Yeah !

Support up to Safedisc v2.51.xx !

http://gamefix.free.fr/safedisc.htm
sadsack
06-16-2002, 03:16 PM
well i tried it m8, but all i got was "bad PE structure" delete it

if anyone can give me a clue as to what to try next it would be much appreciated.....

p.s. the prob in question is :- ms train sim.
[NtSC]
06-16-2002, 05:03 PM
Hello..
Indeed there is some ´SafeDisc Light´ Protection wich is only based on some Dll.. Get a few Games that use it,and compare the Dll´s..That Direction will bring you to a Point were you can write a generic Cracker for em.. The latest 6 Dlls I got, were still supported by the Program i wrote about an Year ago,so i guess they did not change it *yet*


softice - breakpoint on export beginning with @
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice - breakpoint on export beginning with @
PDA

View Full Version : softice - breakpoint on export beginning with @

uiop8000
06-11-2002, 09:05 AM
Hi all,

Does anyone know how to set a breakpoint in softice on a symbol beginning with @??
I get an error when I try in softice driverstudio 2.6:

:bpx @doSomething
Symbol not defined (DOSOMETHING)

I have searched hi & lo for an answer and all I came up with was the rather old numega kb article

http://frontline.compuware.com/nashua/kb/doc/13.asp

Their recommendation is to not use the symbol name, but the address instead. But how can I use the address if my module isn't yet loaded? ie:

:exp @doSomething
00FE:338380 @doSomething

:bpx 00FE:338380
Invalid selector

Thanks in advance, kind regards ,
Alex
nofurs
06-11-2002, 02:02 PM
[QUOTE]Originally posted by uiop8000
[B]Hi all,

>Does anyone know how to set a breakpoint in softice on a >symbol beginning with @??
>I get an error when I try in softice driverstudio 2.6:

>:bpx @doSomething

api==win32api
eg:
bpx getprocaddress
getprocaddress ==win32api

>I have searched hi & lo for an answer and all I came up with >was the rather old numega kb article
Nope you didn't search.....

http://frontline.compuware.com/nashua/kb/doc/13.asp

>Their recommendation is to not use the symbol name, but the >address instead. But how can I use the address if my module >isn't yet loaded? ie:

>:exp @doSomething
>00FE:338380 @doSomething

>:bpx 00FE:338380

bpx 338380

http://archive.yates2k.net/%2BSandman/SoftPage.html

EVERYTHING YOU WANNA KNOW IS IN THERE!!!!!!!!
NEXT TIME SEARCH MORE AND BEFORE YOU POST ANYTHING READ THE POSTING GUIDELINES

http://www.woodmann.net/fravia/rce-faq.htm
uiop8000
06-13-2002, 10:45 AM
cluesurf, what are you talking about? i'm talking about using symbols with special characters in a breakpoint expression. it doesn't work and i can't find in info about it either. maybe there is an escape character, or maybe the @ can be replaced with another character, I don't know. As I said before you can always use the actual hex value of the symbol but only once the module is loaded. Its kinda nice being able to put on breakpoint's using the symbol name even when the module isn't loaded.
uiop8000
06-14-2002, 11:56 PM
a ha!
after an upgrade to softice 4.2.5 (driverstudio 2.6)
- I was using softice 4.05 win9x, it appears this problem has
gone, as long as you prefix the export symbol with its module name

eg:
bpx modulename!@doSomething

thus allowing you to set virtual breakpoints and enjoy all the joys they offer!


For CrackZ/HypnoticZ/TNT the hasp prot prog
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > For CrackZ/HypnoticZ/TNT the hasp prot prog
PDA

View Full Version : For CrackZ/HypnoticZ/TNT the hasp prot prog

hack3r2k
06-11-2002, 10:10 AM
Hey !

Things that i found till now :

pass1 - 2b83 (can i do anything with it ?)
pass2 - 618f (idem)
seed - 0 ??? kinda impossible
port - 0 ??? this one too

It uses hasp api cause i found HASPDOSDRV string inside the program.
Seems to be a TimeHasp or Hasp - Time because it uses function 47.

Offcourse that i tried to crack it !

All i did it was to reverse some jumps after some checkings before the dialogbox to show(MessagePopup api), but why i reopened this subject is because the program seems not to work how it should.

So all i'm asking is to help me crack it right.

Best regards,
.:hack3r2k:.

file (2.55MB)

://sagemboard.web1000.com/telech.zip

best regards,
hack3r2k
goatass
06-11-2002, 03:47 PM
Just changing jumps as to avoid a message box will not correctly crack the program. Many times the program reads stuff from the dongle and uses it for something, if the correct bytes are not read then the program doesn't run right.

Try to find the Hasp APIs and emulate them so they will return the correct values.

goatass
hack3r2k
06-11-2002, 10:09 PM
Hey !

I started to write an emulation routine for the prog above(it uses services 1, 5 and 71).

;GetTime -=function 71=- emulation :)
sub esp, sizeof(SYSTEMTIME)
push esp
call GetLocalTime
xor eax, eax
xor ebx, ebx
xor edx, edx
mov ax, word ptr [esp+SYSTEMTIME.wSecond] ;second
mov bx, word ptr [esp+SYSTEMTIME.wMinute] ;minute
mov dx, word ptr [esp+SYSTEMTIME.wHour] ;hour
xor ecx, ecx ;all things went ok !
add esp, sizeof(SYSTEMTIME)

Is this ok for 71 ?

1 and 5 code i will not post because it easy to emulate ...

The problem is tha i dont know for sure if i must redirect all 'call _hasp' to 'call _emurutine' ...

And its another problem... if i put this code is some dll will work ?

I mean instead of call _hasp to do a call to the emulation routine from the dll.
CrackZ
06-11-2002, 11:06 PM
Hiya,

My findings seem to disagree (a little) with yours.

I found it calls IsHasp(), HaspStatus() and then HaspID(), services 1, 5 & 4Eh respectively. Actually you may be right that it calls other TimeHASP related services after this or 47h if you change the HaspStatus() return to TimeHASP-4 (didn't actually experiment with that), since I got some annoying message box about missing files when my drivers emulated the first 3 services.

PWD1 = 2B83
PWD2 = 618F (we agree).

Remember, the seed is only relevant to a handful of HASP() functions.

The HASP() routine is inside telechtest.exe (4065A0) & telechomm.dll (1000322C).

Your emulation routine looks OK to me, I don't know why you don't use the shorter movzx overrides though when accessing the SYSTEMTIME structure, rather than zero'ing EAX/EBX/EDX and then moving ;-).

This program uses basic HASP API so patching an emulation routine in the aforementioned places should be sufficient.

Regards

CrackZ.
hack3r2k
06-12-2002, 10:49 AM
I forgot to tell you that telechtest.exe must be executed from command line.

ex. telechtest some_file.bis ? ? and other 2 params that seems not to work respectively com port nr and baud rate.

Anyway you didnt told me if i must redirect all call _hasp to my emulated routine ...

I'll post here my full emulation it's ready...

Do you have a email where i can contact you (hotmail ?/if so maybe we can meet on msn messenger to talk more)

best regards,
.:hack3r2k:.
goatass
06-12-2002, 03:45 PM
it is recommended that you redirect all call_hasp routines to your emulation routine, this way you can manipulate the return values of any of the services. Say you run the program and find out that after an hour it calls a service that was not emulated. It would be easier to go directly to your code and emulate this service. Just as a good measure you want to be able to say that you covered all your bases.

goatass
hack3r2k
06-12-2002, 11:22 PM
Yo !

Thank you for helping me CrackZ and goatass !

This is my full emulated routine but it's something wrong with it !!!

;92 bytes emulation rutine

cmp bh, 1h ;IsHasp()
jnz next_1 ;ummm nope
xor eax, eax ;make it 00000000h
ret ;return after call hasp
next_1: ;Let's try something else
cmp bh, 5h ;HaspStatus()
jnz next_2 ;ummm nope
mov eax, 0h ;Other hasp ...
mov ebx, 3h ;I think ... TimeHasp
mov ecx, 1h ;Port number
ret
next_2:
cmp bh, 47h ;GetTime()
jnz next_3
sub esp, 10h
push esp
db 255, 15h, 1Ch, 70h, 44h, 00h
;alias call dword ptr [0044701Ch] section
;.import from telechtest.exe/GetLocalTime api
;:)it's fu**in' hard to fit the code to your
;needs but not impossible :)
movzx eax, word ptr [esp+0Ch] ;second
movzx ebx, word ptr [esp+0Ah] ;minute
movzx edx, word ptr [esp+08h] ;hour
xor ecx, ecx ;all things went ok !
add esp, 10h
ret
next_3:
cmp bh, 4Eh ;HaspID()
jnz next_0
mov eax, 0h
mov ebx, 0h
xor ecx, ecx ;Yeah we have hasp v0.0 !!!
ret
next_0:
xor eax, eax
xor ebx, ebx
xor ecx, ecx
xor edx, edx
ret

I added this routine in the .hasp (section added) section of the telechtest.exe and it uses the GetLocalTime api added in .import section of the .exe.

After i redirected all 11 calls to my emulated routine i discovered when i executed the exe the same fucking, stupid message box !!!

Ummm...i said to me, i think that i forgot to emulate somethin', so i did a break in my emu routine and i discovered that 'bh' had value 20H but i didn't find any info in my haspman about how can i emulate it...

Maybe somethin in my emu routine is WRONG emulated ???

The emu routine is OK ???

I attached here the pathed exe and the binary form of my hasp routine !

All i can say now is ... HELP !!!!!!!!
new section added to telechtest.exe

.imports -> GetLocalTime api added
.hasp -> The emulation routine

best regards,
.:hack3r2k:.

http://sagemboard.web1000.com/Telech+hasp_emu.zip (click on the bottom link) -> Contains the patched exe and hasp emu in binary form
ZenLoren
06-13-2002, 05:24 AM
Hi

cmp bh, 1h ;IsHasp()
jnz next_1 ;ummm nope
xor eax, eax ;make it 00000000h
ret ;return after call hasp

IsHasp () should return 1 not 0
try rectify it & check.

Regards
zenloren
hack3r2k
06-13-2002, 10:08 AM
Hi ! (thanx ZenLoren)

I repatched the program so it could return 1 at IsHasp() call but it still doesn't work !

http://sagemboard.web1000.com/Telech+hasp_emu.zip (click on the bottom link) -> Contains the patched exe and hasp emu in binary form

CrackZ don't let me down know !!!
HypnoticZ/TNT
06-13-2002, 02:36 PM
see your PM :)

regards HypnoticZ
CrackZ
06-14-2002, 12:47 AM
Bah!.

I got screwed by the msgboard here and logged out automatically, reply lost ;-).

Anyway, the gist of what I said, was something like make sure you redirect the call haspreg() to your new code (address 4065D6), it sounded to me like you were redirecting at the xref level and hence BH wasn't getting the service code loaded.

The emulation routine was fine, IsHasp() does clear EBX/ECX/EDX and ECX's return for HaspStatus() should be 66h (EDX=driver version), but 1 shouldn't make much difference. Also, general point, avoid sending back 0:0 for HaspID if you can, some programs do not like it ;-).

Regards and contact me if you want any further assistance.

CrackZ.
hack3r2k
06-14-2002, 09:53 PM
Hi there HypnoticZ/TNT/CrackZ !

I wrote a function called HaspServicesSpy that called instead of haspreg() its able to display in a message box what service tried the program to execute.

so i discovered that the program executes the following services:

1h
5h
47h
4eh
49h
4dh
4ch

I inserted the emu routine all funtions work ok, less WriteBlock/ReadBlock that i don't know for sure how to emulate so it gives "locked key" and that because i dont know how much mem (bytes) requires !!!

BTW the dongle used by this prog is fuckin' strange cause it uses services from TimeHasp and MemoHasp can someone explain me how it's possible ??

best regards,
.:hack3r2k:.

thanx CrackZ, HypnoticZ/TNT (Yep ! that was my problem ! now works)
goatass
06-14-2002, 11:19 PM
The dongle is a TimeHasp dongle, this dongle has both time and memo hasp routines in it just like the NetHasp has net and memo routines in it.
To emulate the read and write calls you need to do something like this:

push ebp
call eip+5
pop ebp ;get delta offset into ebp
add ebp, 20h ;puts you at the start of your dongle data(number varies)
mov ecx, esi ;puts length of block in ecx
lea esi, [ebp+eax] ;address to your dongle data, eax=cell#
repz movsw ;edi is the return buffer
pop ebp
db 0000 1111 2222 3333 4444

something along these lines, you have to play with it a bit to get it to work for you correctly
To emulate the write routine just to switch the read and write buffers.

p.s. TimeHasp has 512bytes of memory

hope that helps.

goatass
hack3r2k
06-16-2002, 10:29 PM
Now i need some more info about ReadBlock !!!

Let's supose that hasp emu mem is like this :

00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
---------------------------------------------------------------
BH -> 77
DI -> 7;start address ?? what does this mean regarding hasp mem above ??
SI ->2;block length ?? this means that it want to read 2 bytes ??
AX ->F918;buffer offset ?? what this ??? like start reading position ??? isn't too big for a timehasp with 512 bytes of mem ???

btw , edi it's an pointer to a buffer that contains the values readed or it contains the values (like 00000000h after reading 2 bytes ??)

Can u explain how does this function works ???

Hey CrackZ/goatass please explain me !!! (i can't code if i don't understand how it works ....)

best regards,
.:hack3r2k:.
hack3r2k
06-18-2002, 10:47 PM
Can anyone answer to my question above ?(the one abou ReadBlock stuff)

Anyone knows what service 68 does ?? I didn't found any info in hasp manuals !

best regards,
.:hack3r2k:.:mad:
goatass
06-19-2002, 01:01 AM
First of all take your memory map above and look at it in WORD format: That is how HASP reads, it reads WORDs not bytes, this should make it easier to understand.
Each WORD in this memory map is a cell, starting at cell #0

0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000
0000 0000 0000 0000 0000 0000 0000 0000

Service 77: ReadBlock
ECX, EDX = Pass1,2
EAX = Buffer to put read words into
DI = Block length
SI = Start address (cell)

When it returns, the buffer in EAX will hold the 7 WORDs starting from cell #2 and ECX will be 0 since it's the error code.

Does this answer your question? now with the code I posted earlier you should be able to modify it a bit to make it work for the ReadBlock service.

I'm not really sure what service 68 is, can you tell me what parameters are pushed to this service?

goatass
CrackZ
06-19-2002, 10:57 PM
Hiya,

The previous post isn't quite correct.

At haspreg():

EAX -> buffer to receive data.
ECX/EDX = pass1 / pass2.
ESI = block length.
EDI = address to start read from.

On return:

EAX = EDI.
EBX = block length.
ECX = status (0).
EDX = EAX.

At least this is the case for the latest drivers.

Service 68h or 68d?, the only one that exists is 68d i.e. 0x44 which is NetHASP ReadWord().

Regards

CrackZ.
hack3r2k
06-19-2002, 11:03 PM
CrackZ i have a question ...

If i can't find the services enumerated in the last hasp manual(haspman4) then where i can find them !??

best regards,
.:hack3r2k:.
goatass
06-20-2002, 02:06 AM
Thanks CrackZ, I tend to get SI and DI switched especially when I haven't worked on HASP protected apps lately.

goatass
hack3r2k
06-21-2002, 01:27 PM
Hey goatass/CrackZ/ anyone !

Here is my emu routine for ReadBlock :

cmp bh, 4Dh ;ReadBlock()
;EAX -> buffer to receive data.
;ECX/EDX = pass1 / pass2.
;ESI = block length.
;EDI = address to start read from.
pushad
imul edi, 2 ;a cell contains 2bytes and we multiply it with edi
;that represent the cell from where we want to
;start the reading
imul esi, 2 ;no of bytes to read
mov ecx, esi ;counter
lea esi, [HaspMemory + edi]
lea edi, byte ptr [eax]
rep movsb
popad
xor ecx, ecx
ret

HaspMemory is a pointer to memory block (512 bytes) allocated with the help of GlobalAlloc and GlobalLock apis (all mem it's initialy zero)

MY EMULATION ROUTINE FOR THIS SERVICE IT CORECT(i guess so cause at return eax ->has the values readed inside and ecx = 0 )

best regards,
.:hack3r2k:.:p
hack3r2k
06-21-2002, 07:52 PM
Hi !

I just want to know if the routine above is ok ......

BTW for WriteBlock i just have to change :

lea esi, byte ptr [eax]
lea edi, [HaspMemory + edi]

this all.

bye (i know that shoul be ok but the prog still shows loked key)

I have to emulate the mem contents also ???

bye, bye
haec_est
06-25-2002, 06:16 PM
Originally posted by hack3r2k
...
I have to emulate the mem contents also ???
...

Hi !

..yes, you MUST emulate the mem contents; better if you can dump the memory :)

for the read/write block routine... i use a snippet of code from CrackZ's site, (coded by cyberheg for
sentinel spro key), slightly edited for hasp keys :

.hasp:00442097
.hasp:00442097 r_w_block: ; CODE XREF: .hasp:00442021j
.hasp:00442097 ; .hasp:00442026j
.hasp:00442097 mov ecx, esi
.hasp:00442099 shl ecx, 1 ; bytes to read
.hasp:0044209B
.hasp:0044209B call $+5
.hasp:004420A0 pop esi ; get eip
.hasp:004420A1 add esi, 1Ch ; setup delta
.hasp:004420A1 ;
.hasp:004420A4 shl edi, 1 ; start addr ---> offset (bytes)
.hasp:004420A4 ;
.hasp:004420A6 add esi, edi ;
.hasp:004420A6 ;
.hasp:004420A8 lea edi, [eax] ; get buffer
.hasp:004420A8 ;
.hasp:004420AA cmp bh, 32h ; check read/write operation
.hasp:004420AD jz short not_switch
.hasp:004420AF xchg esi, edi ; for write operation source is buffer
.hasp:004420B1
.hasp:004420B1 not_switch: ; CODE XREF: .hasp:004420ADj
.hasp:004420B1 repe movsb ; read/write
.hasp:004420B1 ;
.hasp:004420B3 mov edx, eax ; reset par4 = lp_buffer
.hasp:004420B3 ;
.hasp:004420B5 xor eax, eax ; not used
.hasp:004420B7 xor ebx, ebx ; not used
.hasp:004420B7 ;
.hasp:004420B9 xor ecx, ecx ; status ok
.hasp:004420B9 ;
.hasp:004420BB retn
.hasp:004420BB ; ---------------------------------------------------------------------------
.hasp:004420BC hasp_mem dw 0, 0, 0, 0, 0, 0, 0, 0
.hasp:004420BC dw 0, 0, 0, 0, 0, 0, 0, 0
.hasp:004420BC dw 0, 0, 0, 0, 0, 0, 0, 0
.hasp:004420BC dw 0, 0, 0, 0, 0, 0, 0, 0
.hasp:004420BC dw 0, 0, 0, 0, 0, 0, 0, 0
.hasp:004420BC dw 0, 0, 0, ... and so on ...

remind that TIME4 key (hasp type = 5) work also with service 32h/33h of MEMO hasp :) (see the manual)

regards,
tgodd
06-28-2002, 08:06 AM
try readblock starting at -8 and increment your range by 8.
This will give you the entire memory range including the haspid.


Who knows ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Who knows ??
PDA

View Full Version : Who knows ??

daffydos
06-11-2002, 04:41 PM
Im trying to find any information about the protection scheme used in Civilization 3 FRENCH. The exe seems to be packed with a soft called SPeEnc ??? Any clues about that ?
Thanks
hack3r2k
06-11-2002, 10:37 PM
+160 protectors
daffydos
06-12-2002, 08:59 AM
Thanks but this app cannot recognize the encryptor used !!
hack3r2k
06-12-2002, 10:52 AM
the fucking app it's surely protected with Safedisk (it asks for cd even if u entered the corect cd inside - i'm reffering at the clone of it)

ANYWAY post the exe here ...
daffydos
06-12-2002, 01:06 PM
It seems effectively to be safedisc protected. When I run it, some files are created in TEMP (NIL32.DLL, NOMOUSE.PIF, etc). There's an email in the EXE header, referring to someone at Laserlok...
As the file is too big to be uploaded, you can dl the patch at URL f**://ftp.download-center.com/pub/download/fr_infogrames_com/patches/fichiers/civ3/civ3v121ff.exe

This patch can be installed *WITHOUT* the CD (or thegame already installed)
ReaL|sTy
06-12-2002, 03:57 PM
use daemon tools to fool that game!

h**p://www.daemon-tools.com

good luck! :)
daffydos
06-12-2002, 04:01 PM
Thanks, but i don't have any pb to make it run (i have the cloned CD) but i want to remove the CD checks in order to use it in "no-cd" mode...and it is also for my personnal knowledge ;)
ReaL|sTy
06-12-2002, 04:15 PM
do you need good CD checks Tutorials??? i can make some of them for you :p
daffydos
06-12-2002, 04:31 PM
Great !!!.... just kidding ;) ...i just want to know what is the protection scheme used with the French version of Civilization 3 !!!

:D
ReaL|sTy
06-12-2002, 04:36 PM
ok! ;) we are here to help us each other don't be afraid to ask!

:D
hack3r2k
06-12-2002, 11:28 PM
Can you mail me just the .exe file (cause i dont need all 7MB patch)
preferably zipped to my email ??

danielciocarlan@hotmail.com
hack3r2k
06-13-2002, 11:45 PM
It's packed with SPEEncV2 !

The problem is that i couldn't find any info about it on net...(nada)

U should arm softice and start unpacking it...
hack3r2k
06-15-2002, 02:07 PM
hey !

CoDe_InSiDe told me that it's some new protection from www.laserlock.com (seems to be unknown even to him ...)

bye


Greetings
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Greetings
PDA

View Full Version : Greetings

hobgoblin
06-11-2002, 06:30 PM
Greetings on the board,
Is there someone who could mail me a copy of RegOrganizer 1.3 beta 4? I'm going over (reading) the thread on unpacking this program and would like to have it at hand just to check out the D-D details. (I have searched the net several times, but without finding it). And the newest version doesn't have the same addresses.
Another question;: When finding the socalled 1stdip, do you guys use the tracex command in icedump? If not, how?
I have unpacked several proggies packed with Asprotect lately, and are currently looking into the dips, and what they really does or mean.
Thanks for putting a lot of useful information oin the threads on this forum.:-)

Okey, my mail is: hobgoblin@chello.no

TIA,
regards,
hobgoblin
hobgoblin
06-12-2002, 12:27 PM
Never mind.

After some thinking and tracing I figured it out. I managed to unpack and get the 1.38 beta 2 version up and running.:-)
I must say: what a learning curve you get when you really indulge yourself in the manually unpacking business.....

Nice to learn something new...

Thanks again to the regulars on the board.

hobgoblin
esther
06-12-2002, 01:10 PM
Hi Hobgoblin,
Long time no see.yeah new protections pops up everyday ;)
Welcome Back :cool:


bsod
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > bsod
PDA

View Full Version : bsod

The Svin
06-11-2002, 07:44 PM
Bsod on NT family OS 'caused by usermode ring3 app
Source, exe and readme inside file.
No special harm, but be carefull though - crash is always crash.


Crackme 3 crashes under win2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crackme 3 crashes under win2000
PDA

View Full Version : Crackme 3 crashes under win2000

BobRock
06-11-2002, 10:42 PM
It seems that crackme 3 crashes under windows2000.

Regards,
Bob Rock
BobRock
06-11-2002, 10:44 PM
Opppss, this had to be a reply to rage9's post .... sorry for starting a new thread.

Regards,
Bob Rock
Rage9
06-20-2002, 04:14 AM
hehehehehe, as well it is supose to, it is ment to crash, did you read the readme file? hint *cough*import table chalange*cough*

:]


DOS cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > DOS cracking
PDA

View Full Version : DOS cracking

Risotto
06-11-2002, 10:46 PM
DOS's times have already passed but i'd like to understand how RE can be applied to this kind og programming. Who can advise a good resource of tuts or whatever?
Thanks
PS: I'd like to admit that i used the search engine on this bulletin but unfortunately i didn't succeded, and noone engine didn't help me.
Fake51
06-12-2002, 03:20 AM
Something musta gone terribly wrong when you searched, coz what some people consider "the holy tuts" are hosted on tsehp's site - orc's tuts. They're mostly on dos cracking.

Also try some Buckaroo Banzai, he once did a huge mother on dos cracking.

Fake


a little program protect with HASP m1 and sn,somebody help me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > a little program protect with HASP m1 and sn,somebody help me
PDA

View Full Version : a little program protect with HASP m1 and sn,somebody help me

helloman
06-12-2002, 10:19 AM
this program when you enter the SN number it can judge it was right or wrong and if sn is right it will judge the install mode (reader or editer),on the same time it access the hasp ,if the hasp key is right with the right sn number it will go on,otherwise it display the hasp code and message "wrong hasp plug".
it seems that crack this program is very difficult .first ,u must have the right SN number to chose the mode u want to install the software;second ,u have to know the hasp key 's content to rewrite the program with.
so ,somebody have interest ,pm me post the program and do it .
helloman
06-13-2002, 02:07 AM
ftp://ftp.web1000.com/key.exe
hack3r2k
06-13-2002, 10:15 AM
U dont have to post your username and the password from the server !!!(****:\\username.web1000.com\name_of_file.zip is sufficient) :)

I'll take a a look at the file but i must warn you that i'm a newbie in hasp reversing ...

Try ask CrackZ !
helloman
06-14-2002, 01:37 AM
u r very kind .now i have the hasp4m1's pas1 pas2 and the return value ,i don't know how to simulate it ,so can u help me to simulate it ,thank u very much.
goatass
06-14-2002, 02:00 PM
Do you know which services are being called by the application?
If you figure them out then we could help you with emulating them. Some of them might be more difficult then others. Also you will need to trace the application especially after it reads from the key to see if it compares the values in clear text or not.

goatass
hack3r2k
06-14-2002, 07:53 PM
Hi there !

I had the same proble to find hasp services so i started to wrote a simple funtion (HaspServicesSpy) that called instead of haspreg() will tell you what function tried to execute and displays in a messagebox the current service executed by exe...

it's pretty useful but i need to do some tests with it to be sure that works ok...

I think that in the next days il post here the public version so that every newbie can save lot of time in finding services.

About the prog / in what languadge it is cause it display some text with unregonizble form for european charset...

best regards,
.:hack3r2k:.
goatass
06-14-2002, 08:09 PM
hack3r2k, that's a cool idea I have something similar to it but I like tracing better, this way I right away follow return values.
HASP is actully easier in that matter because all you have to do is BPX FreeEnvironmentStringsA and it lands you at the main haspreg() routine, F12 a couple times and it will take you to the upper level function where you can see the service number, passwords, and seed being pushed.

goatass
hack3r2k
06-14-2002, 10:09 PM
Hi there !

Helloman i attached to your program my HaspServicesSpy routine and works perfect on it ! U should get lots of message boxes that will tell you what service programs want to execute ...

Tell me if this helped you !!

Put key.exe and haspDongle.dll in the same directory ...

key.exe (pass1 = 42A9 pass2 = 6A1A)

If u have problems with emulation read my post from 'For CrackZ/H....'

BTW upload somewhere the full version of the program ...

goatass what u say about my routine ??? (usefull ??)

best regards,
.:hack3r2k:. (fuck all protections !!! :mad: )

Attached file (with haspServicesSpy added)

http://sagemboard.web1000.com/Key&HaspSPY.zip .
helloman
06-15-2002, 07:34 AM
can u post it to the other place,thank u
hack3r2k
06-15-2002, 01:56 PM
the url is:

hxxp://sagemboard.web1000.com/Key&HaspSPY.zip (where xx is tt)

On the page tha it will appear click on the bottom link that says 'Click here to get the file you were trying to download.' and after that tha download will start.

If this doesn't work send me you mail addr and i will send u the file ...

Please upload some where the full program if u can ...
hack3r2k
06-16-2002, 10:33 PM
Hey !

How's going with hasp reversing ???

Did my prog helped you/have problems with emulation ???

Can u upload the full program some where ???

see ya !
helloman
06-17-2002, 02:11 AM
i can't download your zip file,so please email it to me , thank u.
crackdog@21cn.com
JMI
06-17-2002, 04:36 AM
Helloman:

Go to the page hack3r2k gave you and go to the very bottom of the page and you will see a link to the file that says:

Click here to get the file you were trying to download.

That should get it for you. If it doesn't work, post again and I try to attach it for you.

Regards.
hack3r2k
06-17-2002, 12:11 PM
Was usefull ??

bye;)
helloman
06-18-2002, 09:56 AM
i receive your mail and test the prog your give me ,but it just display the funtion the hasp call ,so what else it do,i can use sofeice to trace the funtion .but thank u very much ,can u tell me how to simulate the hasp outside the prog(don't edit the prom and use some tools)?
if it is impossible so please tell me how to simulat it use edit the prom(KEY.exe,i know the pas and the value it return).thank u very much.
hack3r2k
06-18-2002, 10:12 PM
It's not impossible !

U can write an asm procedure that emulates hasp and include it in some dll.

After that all u have to do is to divert the call haspreg() to a new created section that calls our emulation routine from dll.

If u don't know how to do that read 'HaspServicesSpy Program Release'. There u can find all the info.

The problem with u'r program is that it uses some unknown services (like 68 - anyone knows what it does ??).

best regards,
.:hack3r2k:.:D
helloman
06-19-2002, 03:20 AM
but wher is 'HaspServicesSpy Program Release' u talk about
hack3r2k
06-19-2002, 09:04 AM
The program is attached to that post !

Look for 'Attachment' ! after this u'll find a link for download ~


Packers: theory and coding???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Packers: theory and coding???
PDA

View Full Version : Packers: theory and coding???

BobRock
06-12-2002, 12:13 PM
Hello,

is there any good essay around on how packers work and example code to show how to code a basic one?? Thx.

Regards,
Bob Rock
Fake51
06-12-2002, 01:57 PM
Look on Tsehp's mirror for Joa's papers on packing, far as I know they're rather nice.

Fake


Unpacking Dlls with Relocations
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unpacking Dlls with Relocations
PDA

View Full Version : Unpacking Dlls with Relocations

zacdac
06-12-2002, 03:28 PM
G'day..

I’m seeking some help with unpacking dll’s and restoring their relocations.

I have no problem unpacking an exe/dll at a fixed image base.
However I have never seen any tutorials/information on how to dump/reconstruct the relocations.

I have put together a very simple project. It consists of an executable and a dll. The exe loads the dll at runtime and calls one of the dlls exported functions, which displays a messagebox.
The dll is packed with upx to keep things simple.

Both the exe and dll have an imagebase of 00400000 so that the dll will be forced to use an alternative imagebase when it is loaded, and therefore use the relocations table.

I read one post that suggested you do the following:

1) dump the dll using is default imagebase.
2) dump the dll after the sections are unpacked but before the relocations are performed.
3) fix the PE header to restore the relocations table.

Task 1) can be done by converting the dll to exe (note: you have to modify the first jnz in the upx unpacking runtime in order for it to unpack.) and then dump the dll as normal.

Task 2) I have tracked the code and think I have found where the code is unpacked before the relocations are performed. In the upx unpacking runtime, about half way is a “pop esi” which is jumped to after the code is unpacked.

The next half of the routine reconstructs the linked address in the dll (the imports first and then the relocations).

I assume UPX has to do this because the packed dll has no relocations, so the runtime needs to uncompress the .rloc section and then perform the task that the OS loader would normally perform.

Task 3) Well this is where I am struggling.

Can somebody let me know if it is possible to unpack a dll with the relocations ? If yes then I am hoping that by putting together some simple files, that somebody can demonstrate the technique. Then I can put together a nice little tutorial to fill the void.

Thanks,

Zac
nikolatesla20
06-12-2002, 03:56 PM
Maybe I will look at this sometimes, but I thought :

Most packers dont waste time with the relocation that I've seen. It's packed, yes, but once the DLL is in mem you should be able to just dump it, and usually the reloc's wont be mucked with, like IAT tables usually are in EXE's with most packers. I don't think I've seen many packers actually mess with the relocation section.

Mainly the only thing you will have to be sure of is the DLL header has the correct relocation info, like for example where the relocations are.

-nt20
Lbolt99
06-12-2002, 09:11 PM
Hi,

I got my first try at unpacking a DLL with WebsnatcherIE, a simply IE plug-in. The DLL is protected with ASprotect 1.2.

It was almost the same as unpacking an EXE file. There are a couple of key exceptions, concerning loading the .DLL file and also if patches need to be made.

What you want to try to do is make sure the DLL loads are image base 0x10000000. I did it by doing a clean bootup with nothing running in the background. That way, the WEBBND32.DLL wouldn't relocate when I loaded it, so the relocation table is un-modified by windows when loading the dll.

Proceed as normal as if you are unpacking an ASPR .exe file...

dump at OEP, fix iat, paste, etc..

It should work at this point. But beware that if you have to patch any location in the dll file that corresponds to a relocation entry in the reloc section, you have to modify the relocation table to accomodate. Example:

[Indirect call] - courtesy of ASprotect

The values for this indirect call are processed in the reloc table.

When you patch it to the direct call, it no longer needs to be relocated! So you have to modify the relocation table to fix that.
cyberheg
06-12-2002, 09:53 PM
I've unpacked alot dll's and the follow is what I do and hopefully it will give you some hints on how to continue. I apologize that because of lack of time I didn't look at your target but as you pointed out I also write a loader for my target dll's.

First you need to make sure it loads at the prefered imagebase. That is essential to a good file dump because else the data will be relocated at another imagebase.

At the buttom of this text is pasted the code I use for this kinda tasks. The code is rather simple and stupid however it works.

Ok so here goes:

1. Load the dll using this or your own code at the prefered imagebase.

2. Dump it just as you do with a exe file. You need to get inside the dll ofcourse and there are ways in every packer to easily get inside them by using breakpoints. Assuming you got the code, data section etc. dump them like usually and fix the import table.
Nothing new here.

3. I usually use IDA to see what kinda errors it gives on the halfdone file. This is good for showing what kinda problems are left. At this point you need the relocation information.
This is usually stored in a section called .reloc like you pointed out yourself. So you need to dump this section from the memory. In the targets I've looked at the reloc section was remapped so it overlapped the loader (of the packer) section which made a big mess out of it so for me it was easier to just dump it again and paste it into it's place.

Now you must fix the data directory entry called Base relocation. The address of it is RVA of the section which contains the reloc information and the size I dig out with a hexeditor in the following way:
Count the bytes from the very start to the very end of the dump you made. Sometimes the relocation doesn't work in win2k properly while it works in win98. I never found out why but in these cases I solved it by making the size of the relocation data which should be stored into the base relocation directory to 2 bytes bigger then the original count of the bytes.

Now you are ready for testing it.
First I load the stuff into IDA to make sure there are no obvious bugs of my part. Then I load the dumped dll with the code below and see if LoadLibrary returns a valid pointer.
After this you should test if the relocation works. The easiest way to do this is to make a copy of the dumped dll (which you just tested) and load it as a 2nd instance. This will for sure force relocation and thereby you test if everything works. If you set the address and size correctly in the data directory of the PE everything should work out fine.
If not I allready gave suggestion what could be done.
For these tasks I allways start with win98 since it's less picky on errors and if it works I continue to test it on Win2k.

Hopefully this is helpful to you. If you got more questions just ask.

// CyberHeg

#include <windows.h>
#include <stdio.h>
#include <stdlib.h>

int ((__cdecl *myfunctptr)(void));
int main()
{
HANDLE hInstance, hInstance2;
FARPROC procptr;
int retnum = 0;
int i;
hInstance = LoadLibrary("file1");
if (hInstance == NULL)
{
printf("Could not load dll: %d\n", GetLastError());
exit(1);
}
// system("pause");
hInstance2 = LoadLibrary("file2");
if (hInstance2 == NULL)
{
printf("Could not load dll: %d\n", GetLastError());
exit(1);
}
/*
procptr = GetProcAddress(hInstance, "test");
if (procptr == NULL)
{
printf("Could not get entrypoint\n");
exit(1);
}

myfunctptr = (int (__cdecl *)(void)) procptr;

retnum = (*myfunctptr) ();
*/
system("pause");

FreeLibrary(hInstance);
FreeLibrary(hInstance2);

return (0);
}
zacdac
06-13-2002, 06:05 AM
Thanks for the Replys..

Some observations, and please correct me if have got it wrong.

Looking at UPX...

>> Messing with the relocations section

Logicaly packers could handle relocations two ways.

Remember that by the time the packer's loader is executed, the dll is already loaded in memory and as such the OS can not perform the relocations. Hence the packer's loader must perform this task itself.

1) The packer can uncompress the relocation table to memory intact, and then use the table as the basis for applying the relocations

2) The packer when compressing the relocations table can convert it to it's own format (different from the PE format for relocations) and then when the uncompressing the dll at runtime, it uses it's own format as the basis for applying the relocations.
A packer may choose this option because it is more efficient

This explains why some packers do not do dlls. A dll is more complex than an exe because it has to deal with the relocations issue.

After tracing through the UPX loader code it is seems that UPX performs option 2 above. As such the relocations table is never loaded into memory in it's original format. This means you can not dump it (because it doesn't exist) and hence you can not restore it.

I imagine that the only way to restore the original relocation table would be to convert the UPX relocation table to a PE relocation table.

I have dumped the UPX relocation table, however it is nothing like the PE relocation table. I haven't looked at other packers yet, but some may perform option 1 above but I suspect that most use option 2. Maybe not. From the discussion it would appear that ASprotect restores the relocations table.

Interestingly with UPX, the section table is completely restored in memory.

Zac
zacdac
06-13-2002, 06:24 AM
G'day

Attached and below are the views of the relocations table from file and from memory of the packed and non packed files.

Zac

Upx relocations table in Memory
======================
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F

00406300 37 3D 3D 53 3D 3D 34 37 F0 A1 01 0A 0F 0F 14 32 7==S==47ð¡.2
00406310 0A 0F 0F 14 2E 08 24 19 20 0E 0B 2F 19 06 0E 46 ..$  /F
00406320 58 62 CF AD 10 07 2B 2E 3F 12 61 1A 29 26 06 0B XbÏ_+.?a)&
00406330 06 0B 07 A1 35 0B 06 B6 12 0D 16 18 14 00 50 45  ¡5 ¶..PE
00406340 00 00 4C 01 04 00 39 30 00 00 00 00 00 00 00 00 ..L.90........
00406350 00 00 E0 00 0E 23 0B 01 02 34 7A 12 00 00 00 02 ..à.# 4z...
00406360 00 00 58 01 00 00 10 19 00 00 00 10 00 00 00 30 ..X........0
00406370 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 ....@........
00406380 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 ..............`
00406390 00 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 ..............
004063A0 10 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 .. ..........
004063B0 00 00 10 00 00 00 70 45 00 00 56 00 00 00 00 40 .....pE..V....@

Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F

Relocations table in unpacked file
========================
00002000 00 10 00 00 98 00 00 00 6C 30 72 30 7E 30 B3 30 ....˜...l0r0~0³0
00002010 10 31 64 31 B8 31 0C 32 4B 33 91 33 C9 33 1D 34 .1d1¸1.2K3‘3É3.4
00002020 71 34 B5 34 EC 34 29 35 66 35 B9 35 F6 35 33 36 q4µ4ì4)5f5¹5ö536
00002030 67 36 9E 36 3F 38 49 38 58 38 67 38 7B 38 AD 38 g6ž6?8I8X8g8{8_8
00002040 B7 38 C6 38 D5 38 E9 38 43 39 5C 39 7C 39 8A 39 ·8Æ8Õ8é8C9\9|9Š9
00002050 95 39 C4 39 DD 39 E3 39 F1 39 37 3A 8F 3A C0 3B •9Ä9Ý9ã9ñ97:?:À;
00002060 6D 3C 84 3C DD 3C 1C 3D 2E 3D D2 3D FE 3D 0F 3E m<„<Ý<.=.=Ò=þ=.>
00002070 17 39 F1 3A 7D 3C AF 3C A9 3D F8 3D 09 3E 1A 3E .9ñ:}<¯<©=ø=.>.>
00002080 21 3E 1F 39 8F 3D C2 3E F7 3E 02 3F 08 3F BE 3F !>.9?=Â>÷>.?.?¾?
00002090 F3 3F D0 3F DD 3F 00 00 00 20 00 00 0C 00 00 00 ó?Ð?Ý?... ......
000020A0 0B 30 1F 30 00 00 00 00 00 00 00 00 00 00 00 00 .0.0............

Relocations table in memory of unpacked file
===============================
00405000 00 10 00 00 98 00 00 00 6C 30 72 30 7E 30 B3 30 ...˜...l0r0~0³0
00405010 10 31 64 31 B8 31 0C 32 4B 33 91 33 C9 33 1D 34 1d1¸1.2K3‘3É34
00405020 71 34 B5 34 EC 34 29 35 66 35 B9 35 F6 35 33 36 q4µ4ì4)5f5¹5ö536
00405030 67 36 9E 36 3F 38 49 38 58 38 67 38 7B 38 AD 38 g6ž6?8I8X8g8{8_8
00405040 B7 38 C6 38 D5 38 E9 38 43 39 5C 39 7C 39 8A 39 ·8Æ8Õ8é8C9\9|9Š9
00405050 95 39 C4 39 DD 39 E3 39 F1 39 37 3A 8F 3A C0 3B •9Ä9Ý9ã9ñ97:?:À;
00405060 6D 3C 84 3C DD 3C 1C 3D 2E 3D D2 3D FE 3D 0F 3E m<„<Ý<=.=Ò=þ=>
00405070 17 39 F1 3A 7D 3C AF 3C A9 3D F8 3D 09 3E 1A 3E 9ñ:}<¯<©=ø=.>>
00405080 21 3E 1F 39 8F 3D C2 3E F7 3E 02 3F 08 3F BE 3F !>9?=Â>÷>??¾?
00405090 F3 3F D0 3F DD 3F 00 00 00 20 00 00 0C 00 00 00 ó?Ð?Ý?... ......
004050A0 0B 30 1F 30 00 00 00 00 00 00 00 00 00 00 00 00 00............
Dr.Golova
06-13-2002, 04:21 PM
A generic metod is simple - load dll two times with different addresses (make host exe's image base as in dll and dll load to other address). Next simply compare them, find differences and create relocations table. Not too hard.
evaluator
06-13-2002, 11:30 PM
also good tools relised for upx-packed files:
UPXFIX

Download it from www.exetools.com
It can unpack files with damaged upx-header,
so it restores reloc-table. (code section use from dump)

Hemm, is not it newbies quistion???
zacdac
06-14-2002, 07:13 AM
Thanks again for the replies...

@evaluator - Sorry but you may have not understood my request.
I was after some information about manually restoring relocations section. I was only using upx as an example because it does not restore the orginal relocation table into memory when unpacking. Sorry if manually restoring relocations is a newbies topic ?

@Dr.Golova - Thanks. I think I will have to create a tool that could compare two dump images and then recreate a relocation table. Funny, I imagined it would be a more common problem and that a tool may have already existed.

Zac
evaluator
06-15-2002, 05:18 PM
Hello again!

I know only UPX, that mangles RELOC-section.
So self UPX (& UPX-FIX) is good choice for restore RELOC.
(or write your TOOL! Forward thanks:)

Other packers not mangles RELOC. (aspack-prot)

Also is possible stripping RELOC(mainly in EXEs).
Here is no suggestion.
nikolatesla20
06-17-2002, 06:17 AM
evaluator:

Exes in win32 never use relocation, any information in an exe in the reloc can be stripped. ( On an unpacked exe). Maybe a good place to put mod code ? :)

All the theory points to the possibility of relocation for exe's but in win32 all processes get their own mem space so they never will use it as far as my research has shown.

Also, even with UPX, would not the RELOC be clean after running the program (loading the DLL) and dumping? I think it would have to be. RELOC's do not get modified during a base shift. The addresses they reference get modified. I would think the RELOC section could just be dumped to disk. After all it would need unpacking to memory by the unpacker loader wrapper on the DLL to allow the DLL work at all in the first place.

What do you think?

-nt20
evaluator
06-17-2002, 06:54 PM
OK, I agree with you about EXE.

About UPX. When I wrote "UPX mangles RELOC",
I mean: it changes original RELOC with his own formatted RELOC table, so it is useless.
nikolatesla20
06-19-2002, 09:26 PM
OK I did a little research on the relocation table, I wasn't all that familiar with it before.

Yep, evaluator, you are right, they are prolly using their own "format" of reloc table with UPX.

Actually, the relocation table is not very complicated to read in a PE file. It should be simple to rebuild it from scratch.

So I agree with Dr. Golova, the best technique would be to load a DLL at two different addresses and compare the differences. Here are my thoughts:

1. Create a program that can somehow load the same DLL twice. You could perhaps have the DLL just be copied and then renamed, and loaded again. Since it has been loaded once already, it will not be able to load a preferred image base, and will have to relocate from the first one.

2. The Handle you get back from LoadLibrary is the ImageBase address of the module. That's right. That's what it is. Last time I checked anyway.

3. Get both imagebases of the two loaded modules and subtract them to find the difference. This is what you will be looking for.

4. NOw, simply scan the memory of both modules for any DWORD values that are different BY THE DIFFERENCE IN IMAGEBASE. These will be your relocated RVA values. :) When you find a value that differs, log the address you found the difference (MINUS THE IMAGEBASE OF COURSE !). This is the address that needs to be relocated in the table. It should be that simple.

5. Rebuild your own RELOC table with these values, spit out a binary file you can paste in the file to fix it. Note that you can even just make a new section in the dumped PE file for this. Just make sure to change the header data directory to point to the right reloc table.

6. Done.

I might look into making this tool...but I don't know if there will ever be much use for it, how many DLLS have a missing reloc section when packed? Asprotect and Aspack don't seem to do it. Not much demand for a tool, eh.. :)

-nt20
evaluator
06-19-2002, 10:37 PM
Hey!

>>Exes in win32 never use relocation

Now I remember ONE:)

How about NTOSKRNL.EXE!!!!!!!!!!!

It coded for 00400000 base, but because it loads >80000000, so it uses RELOCs.
nikolatesla20
06-20-2002, 03:18 AM
Yes you are right evaluator.

EXE image bases can differ between NT and O.S's like Win98. For example, a program must be above a certain base in Win98 in order to run. If you don't have reloc's and you haven't made it above the lower limit base, you are screwed. It won't run.

You are right, I forgot :)

-nt20


Softice Help Plz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Help Plz
PDA

View Full Version : Softice Help Plz

golden_123
06-12-2002, 04:11 PM
Hi finally get 2 post here:D Well i have read threw every post on this board since the beginning twice while waiting 2 post so heres my question. Two days ago i downloaded driver studio 2.6 to use softice with windows xp pro. I completely installed it and configured my winice.dat file 10 differnt ways and i will post it. So i was reading a newbie tutorial on starting with softice,and first step was to type bpx getlocatime to see how softice breakspt. Well upon typing this then hitting my clock softice didnt pop up. So i typed in bh to check if the breakpt was active and it was there so i did it again,and it said dublicate breakpt and clicked clock again and nothing. Next i tried bpx memcopy loaded up spades bubby 3.0 to see if it popped up with a type in bogus serial # and nothing. So since i could not post here and i was getting frustrated i called nutmeg and was going 2 play dumb about serial # ,and it worked enough for him 2 tell me to type on "table" and once i typed that in it said "no symbol tables are loaded." So he said u need 2 load your symbol tables and that fix your problem then he finally asked for my serial so i hung up lol
So could someone help me load symbol tables. And here is my winice file if u can provide me with your copy to download would be greatly appreciated also :D
NMI=ON
LOWERCASE=OFF
VERBOSE=ON

HST=256
DRAWSIZE=2048
INIT="X;"

SYM=1024

EXP=C:\WINDOWS\System32\hal.dll
EXP=C:\WINDOWS\System32\ntoskrnl.exe
EXP=C:\WINDOWS\System32\ntdll.dll
EXP=C:\WINDOWS\System32\kernel32.dll
EXP=C:\WINDOWS\System32\user32.dll
EXP=C:\WINDOWS\System32\csrsrv.dll
EXP=C:\WINDOWS\System32\basesrv.dll
EXP=C:\WINDOWS\System32\winsrv.dll
EXP=c:\windows\system\msvbvm50.dll
EXP=c:\windows\system\msvbvm60.dll

AUTOCONNECT=OFF

NETSUPPORT=OFF
HOSTNAME=ME-ZY08FAOSCRO7

F1="h;"
F2="^wr;"
F3="^src;"
F4="^rs;"
F5="^x;"
F6="^ec;"
F7="^here;"
F8="^t;"
F9="^bpx;"
F10="^p;"
F11="^G @SS:ESP;"
F12="^p ret;"
SF3="^format;"
AF1="^wr;"
AF2="^wd;"
AF3="^wc;"
AF4="^ww;"
AF5="CLS;"
AF11="^dd dataaddr->0;"
AF12="^dd dataaddr->4;"
CF1="altscr off; lines 60; wc 32; wd 8;"
CF2="^wr;^wd;^wc;"

MACROS=32

MOUSE=ON
ECHOKEYS=OFF
NOLEDS=OFF
NOPAGE=OFF
PENTIUM=OFF
THREADP=ON

SIWVIDRANGE=ON
MENU=Copy , NMPD_COPY , 0
MENU=Paste , NMPD_PASTE , 0
MENU=Copy&Paste , NMPD_COPYANDPASTE , 0
MENU=Display , NMPD_DISPLAY , 0
MENU=Un-Assemble , NMPD_UNASSEMBLE , 0
MENU=What , NMPD_WHAT , 0
MENU=Prev , NMPD_PREV , 0
MENU=Reip , r eip %cp% , 0
MENU=Add Watch , watch %cp% , 0
MENU=Break On Text , bpx %cp% , 0
; WINICE.DAT
; (C:\WINDOWS\system32\drivers\WINICE.DAT)
; for use with SoftICE for Windows NT (versions 3.0 and greater)
;
; ***** Examples of export symbols that can be included *****
; Change the path to the appropriate drive and directory


Encryption used in CRT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Encryption used in CRT
PDA

View Full Version : Encryption used in CRT

Kilby
06-12-2002, 04:28 PM
Gentlemen & others,

In the absence of damn website to ask questions on, I thought this would be the most appropiate pace to ask this question in.

I use CRT from Van Dyke Technologies , and even have a site licence for it, however I am interested in how their keys work.

I understand from Ivanopulos .nfo files that they use 64bit ElGamal & modified RIPEMD-160.

Has anybody here done any research on how these are use together within CRT (and their other products).

As I know next to nothing about crypto (except a lot of what NOT to do when implementing it) if anybody could give me a helping hand up the learning curve it would be greatly appreciated :)

Regards,

Kilby...
Lbolt99
06-12-2002, 09:26 PM
Do a search on here for 'securecrt', some good messages from goatass will come up.

I went through the same crash course in crypto about three weeks ago, analyzing the scheme used in CacheX and comparing it to the Keygen by Eclipse for the Opera version.

I learned a great deal from the documents I found on the web for SHA-1 and Blowfish. I recommend seaching the web for the specifications on the encryption you are reseaching. Makes things easier.

After I read and understood the documents, it was easy to see what the routines in CacheX were doing. Also how the keygen worked.

Still no go on CacheX, by the way. Artifex - any luck with that "fake S/N" you came by when running in trial mode? Have been meaning to look at this, but haven't had time.
mike
06-13-2002, 12:27 AM
I understand from Ivanopulos .nfo files that they use 64bit ElGamal & modified RIPEMD-160.
64 bit ElGamal? More likely 64-byte, or 512-bit.
Kilby
06-13-2002, 11:25 AM
Mike,

I thought the same thing, but thats a cut & paste from the damn.nfo file, and I don't know enough about crypto systems to disagree with Ivanopulo.

Thanks for the tip on securecrt, as I did a search on van dyke and nothing turned up, and I could have sworn that Ivanopulo had posted somthing a while back (but that didn't turn up either).

I had a quick look in a damn keygen for absoluteftp and found what look like large numbers embedded in the code.

Though the relationship between the license key and the serial number is interesting enough to watch in the damn keygen.

Looking at CRT the protection appears to be in License30.dll.

It looks like an relatively easy patch job to remove the license requirement, this is not the object of the exercise.

I actually want to learn something about crypto systems, though a simpler target may have been a better choice.

Regards,

Kilby...
Artifex
06-13-2002, 12:29 PM
Hi, Lbolt99.

>Artifex - any luck with that "fake S/N" you came by when >running in trial mode? Have been meaning to look at this, but >haven't had time.

No result for now. I think that when you have time you will use this clue much better than I can do.

Artifex
MarcElBichon
06-13-2002, 12:40 PM
Some parts of DAMN site still work. Look at http://www.damn.to/crypto_list.html and you probably found an answer

Mike
Kilby
06-13-2002, 04:12 PM
Yeah I have had a look aroud the remanants of damns site previously, but not much information on the bits I require.

I confirmed that all the serial number stuff is in the Licensexx.dll.
It's a pity that tey seem to use an interesting key routine, yet their .exe files are easily patched (4 bytes).

I think the best thing I can do is try and find if anybody has a backup of !tEs site, as he had some securecrt information there.

Infact if anybody has an archive of the site, I may be able to get it hosted <HINT HINT>, as it was always a great resource.

I noticed some values which look like keys in the unpacked Damn keygen for AbsoluteFTP, so if I can get an earlier damn keygen for the same product, I should be able to see which keys change between versions of Vandyke Products.

BTW AbsoluteFTP2.0 uses License31.dll, but still requires the same minimal patching to remove nags and time limits.

Kilby...
goatass
06-16-2002, 10:05 PM
Killby, I just finished keygening tE!'s Keygenme #3 which uses Elgamal and RipeMD, I'm writing up the tutorial as I write this. I'll be including all my sources so you could use them as refrences if you like.
they are to solve the DLP and have the Elgamal implementation (in C++).

goatass
Kilby
06-17-2002, 09:43 AM
Goatass,

That would be greatly appreciated.

Hmmm, this is the 1st time I have called anybody goatass, without being displeased with them :)

Regards,

Kilby...
Kilby
06-25-2002, 03:23 PM
I had a short chat with a couple of guys (I assume) from tmg, and they where saying that the keygen method has changed in recent vandyke targets.

I think ECC 1024 (or 512 I can't remember) & blowfish are the current method used.

I will check this out in the next few days for accuracy, once I clear my current project up a bit and then report back.

Regards,

Kilby...
Lbolt99
06-26-2002, 01:48 AM
Sounds interesting, wonder if their stuff is still able to be keygenned.. beginning to see more and more stuff impossible to keygen, unfortunately. Of course the hard patch on Van Dyke's stuff easy enough.. can't beat keygenning :)

Wonder what's up with the guys in DAMN.. the website is still "working", it's not "down".. kinda strange
Originally posted by Kilby
I had a short chat with a couple of guys (I assume) from tmg, and they where saying that the keygen method has changed in recent vandyke targets.

I think ECC 1024 (or 512 I can't remember) & blowfish are the current method used.

I will check this out in the next few days for accuracy, once I clear my current project up a bit and then report back.

Regards,

Kilby...
Lbolt99
07-25-2002, 04:38 PM
I took a look at SecureCRT 4.0 beta 2, it looks like they send you a different license key, so you're probably right as far as the crypto
changing. Have you had a chance to take a look at it yet?

Just tried the DAMN 3.4.1 keygen, doesn't work on 4.0 :(
Kilby
07-25-2002, 05:17 PM
I ain't had a chance to look at CRT & friends for a while, as real life has once again hit me with a vengance.

However this is what I know.

Every time they go up a full version (rather than a point release), they always changed their keygen, this appears to have been done via the seed values NOT the algo.

I had a look at the internals of the registration .dll (I think it was) and found what I believe to be the seed values.

I then had a look at the values within !tE's and Damns keygens and found their values.

Damn Securecrt 3.3
9E9350F141FFAC5
95CC918618D6ED4
12982884101B67F
7E61ED4B9ACFD2E

Damn Secure CRT 3.3.3
9E9350F141FFAC5
95CC918618D6ED4
12982884101B67F
7E61ED4B9ACFD2E

Damn SecureCRT 3.2.1
9E9350F141FFAC5
95CC918618D6ED4
12982884101B67F
7E61ED4B9ACFD2E

As you can see the values used did not change, therefore this seems to back up only a full version change causes a change in the registration data.

!te/TMG only apperaed to use 3 large numbers in their keygen

I believe up to last month that the keygen algo had not changed, but but can't speak for 4.0 ATM

Hope this helps a bit,

Kilby...
Kilby
07-25-2002, 05:21 PM
BTW from what I heard, Damns website supplier landed himself in a coma through drinking some kind of bootleg alcohol.

I dunno how true it is but thats what I was told.

If anybody can correct me then please enlighten us as it was one of the best sites for useful info.

Kilby...


Here is the usual idiot
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Here is the usual idiot
PDA

View Full Version : Here is the usual idiot

edolis
06-12-2002, 07:27 PM
Well, hello to everyone.

I'm sorry to bore you all, but please be patient and if disgusted, just throw away this post. :(
I started trying reversing 3 days ago since i need a certain BIG app to work (well, not just for that, the fact is that now i have a precise reason to start)
I've just installed Softice to speedup debugging but now i'm stuck (Driverstudio 2.5 to be >precise - the only version which hasn't crashed my W2000 and works with my video board). The fact is that i can't understand how i should work with it - i don't mean debugging but the most trivial part: starting! Tutorials focus on using it but not starting..
How should i load the app? using the symbol loader? What message should i get? i just get a message saying that the exe is loaded, no debug information found (of course) AND Symbols not loaded. Is that normal or not?
When i pass to softice (ctrl+d) i expect to get the app stopped at the first instruction, but the current instruction is somewhat in a HAL place (and i don't know: what is it?) Should i use some command to start my app?
If i try to get EXP i see just one line concerning my app, nothing about its 3 dll... is it normal?
And if i want to restart and stop at the first instr. what should i do?

Moreover: is there any way to load in softice the european keyboard layout or i should keep guessing the positions of keys of the USA keyboard?

Something definitively is not working - maybe it's me - but I was used to Visual C++ debugger...
and, definitively, i feel an useless idiot.

Thanks
Emanuele
?ferret
06-13-2002, 01:08 AM
In Symbol Loader:

File -> Open Module

Module -> Load

Ignore the error message box

hit F10 once after Softice pops up

Without Symbol Loader:
Set a breakpoint on an API or memory address
Run your program

Once your in the "basic" operation is the same as VC++ debugger, with the exceptions that Softice is system wide (all running processes) and you can trace into system .dll's. There are also WAY more bells & whistles, but worry about them after you get the basics down pat.
edolis
06-13-2002, 08:04 AM
After loading the Module SIce doesn't pop up. - is it right?
so I've decided to set up a bpx MessageBoxA then i've launched the prog and it pops up at the licence msg box - too late to follow the flow.
AARGH! I need to start debugging at the first line! so i query STACK and here it is my app (xxxx!.text+1322). - by the way what is "text"?
Now i'd like at least to go to that line to set a breakpoint, better to say to go back to the beginning of the module and set a breakpoint over there, but i haven't got a clue how to do that.
SO: Is there any way to understand what is the address of the first instruction of a module i have loaded with the symbol loader? can i set a breakpoint there before launching the app? how can i do it?
Moreover the keybord keeps to be USAlike..

Thanks god i'm appreciating the power of softice - even if it seems a bit cumberstome...

Maybe could you redirect me to a tutorial which covers these startup phases with driverstudio-so that i can check what i working and what not?

Thank a lot for your help

Ema
foxthree
06-13-2002, 10:21 AM
Use LordPE's Break-and-Enter and dont' forget to change the EIP bytes ;D

Signed,
-- FoxThree
Mefeus
06-13-2002, 10:29 AM
U can find tut's over tut's, when following the links at the bottom of this site (and in different languages at hxxp://crackstore.com).

You have to look the following way:

You have a Messagebox.
You can set a breakpoint at a Messagebox.
Your SICE pops off and you find yourself inside some API-call.
You return to the caller (?was it F12?).
You find yourself inside the code of the file you want to hurt (if not, return to caller again).
You see, at which point (RVA=relative virtual address) the Messagebox finally is called.

Now there r two ways:
Trace the code in your SICE-Window back to find something interesting or return (again) to all caller-positions, hoping to find something like "je -> bad boy"...

Disassemble the file with a Disassembler (best for newbies is always Wdasm V8.93 - look around).
Look at the adress, you found with SICE and "trace" trough the jumps, leading to this positions, hoping find something like a final compare with differnt jumps.

If you r not successfull, you tryed something to hardly for the beginning of reversing.

And by the way: text is the name of one section of the PE-structure of your file - so you see, u have to read something basically about the PE (portable executable) - Format too.

Good luck!
NervGaz
06-13-2002, 12:29 PM
Originally posted by edolis
xxxx!.text+1322
would be <current cs>!<.code section in file>+<offset from beginning of .code segtion> if i'm not mistaken
naides
06-13-2002, 02:35 PM
Originally posted by edolis
After loading the Module SIce doesn't pop up. - is it right?

Right

so I've decided to set up a bpx MessageBoxA
then i've launched the prog and it pops up at the licence msg box - too late to follow the flow.
AARGH! I need to start debu
ging at the first line!

[/B]

Dissasemble the module with Windasm or IDA and find the entry point of your app. Note the Address.

You need to place a BPX to that address in order to start tracing from the first instruction, if you seem so determined to debug from the very begining.
QUOTE]
so i query STACK and here it is my app (xxxx!.text+1322). - by the way what is "text"?
Now i'd like at least to go to that line to set a breakpoint, better to say to go back to the beginning of the module and set a breakpoint over there, but i haven't got a clue how to do that.

[/B][/QUOTE]

Several tricks: Dissasemble the program. find an API call very close to the program entry point. BPX GetVersion is my favorite. now when Sice breaks, browse upwards and soon you will find the initial instructions of your module. If you double click on the instruction you want, it will be BPX for you

Or manually change the first byte of the entry point instruction to 'CC' which is the code for int 3. now in Sice type BPint 3. it will break aas soon as your module first instruction 'CC' is executed.

SO: Is there any way to understand what is the address of the first instruction of a module i have loaded with the symbol loader? can i set a breakpoint there before launching the app? how can i do it?

The first instruction of the module, meaning, the one at the lowest address in memory , and the first instruction executed by the module, meaning, the module entry point, are two different things. The first instruction executed by a program rarely is placed at the begining of the module.

You can set a Break Point before starting the execution of a module, but there is a chance, given the relocation intricacies of windows, the address you pointed your bpx is not the address of the intended instruction. You need to Konw which Selector ie [COLOR=blue]017F : 004523412

Moreover the keybord keeps to be USAlike..

RTFM

Thanks god i'm appreciating the power of softice - even if it seems a bit cumberstome...

Maybe could you redirect me to a tutorial which covers these startup phases with driverstudio-so that i can check what i working and what not?

Thank a lot for your help

Ema [/B][/QUOTE]
edolis
06-13-2002, 03:38 PM
Well, you have given me looot of good advices - i've already installed the two apps, now i'll go around to get some manual 'cause i haven't got a frame where to place all these utilities under a functional point of view - yet - but these two tools give me VERY good help. Thanks again :D

At least I won't bother you more before having read their tutorials

The silly prob i have now (pfff!) is that when LordPE breaks my app, Visual studio debugger comes up to take control (instead of SoftIce) but this should be a RTFM
(Foxtree yet i haven't understood what you mean about EIP register.. but i have realized it goes in access violation - i'll try to understand how to face)
Maybe I'll throw away my dear VisualStudio (sobh) and reinstall everything - anyway... hopin' that SoftIce predefines itself as the default debugger...

As for the keyboard, i'll check it out the documentation (sorry for the RTFM, naides :( ) once again...

Thanks to everyone and please remember - if someone is writing a tutorial, please add a paragraph binding concepts together without going directly to mnemonics.. that is how/why unpack [I mean how do you realize you need unpacking?], disassemble, load and start debugging - let's start with questions like Hey what are the information we must have on the desk before starting reversing? what are them useful for? After - what are the tool which provide them..
These are just advices, 'cause who is in touch with reversing often forgets the zero based position of a newbie^(newbie) [who maybe has concepts and a bit knowledge, but he can't relate them in a howto stepbystep guide]
It would be plainly useful even for those who have written down some lines of code before...
:p
and idiots (like me) always go around, mates :D
But (I hope) is just a step of a Pokemon-like evolution (i hope!)

Thanks
Ema
nikolatesla20
06-13-2002, 04:06 PM
Two things you must do to use the break and enter feature

1. CNTRL+D into softice, and make sure you tell it to break on interrupt 3. "bpint 3" <enter> This enables the break and enter to work right.

2. TO get rid of the "default" debugger go into your registry with regedit:

Hive: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\Windows NT\CurrentVersion\AeDebug
Name: Debugger
Data Type: REG_SZ
Value: <whatever is here, for example msdev.exe>

Hive: HKEY_LOCAL_MACHINE
Key: Software\Microsoft\Windows NT\CurrentVersion\AeDebug
Name: Auto
Data Type: REG_SZ
Value: 1

The "Debugger" key is the path to your default debugger. The "Auto" key determines whether the debugger comes up on its own, or asks you first. I suggest that it ask you first. (set to zero)

You need to edit the bytes at the EIP after a break and enter because a break and enter is an interrupt 3 call. This is easy, when softice comes up after the break and enter, you can usually scroll up SHIFT+up arrow in the command window in softice and you will see it tells you something like "you need to replace with <blah><blah> code before continuing!". So then you need to do an "a eip" and change the bytes to what they should be, then just press <enter>......

Arrgh sorry you need to read some more tuts if you can't get all that. And if you don't like reading, well you are in the wrong hobby :)

-nt20
Mefeus
06-13-2002, 04:27 PM
The best tutorial for the beginning:

hxxp://members.shaw.ca/yeslogon/spaia20020530_2.pdf
(change the xx to tt after copy and paste)

It comes from:
hxxp://alfredkmlo.cjb.net/

Trust me, it's worth the download - the best starting tutorial, which is available this time. :D

Greatz Mefeus
edolis
06-13-2002, 04:33 PM
Nay, nikolatesla, i like reading...;)
your explanation is quite clear... now i have elements enough to solve the two probs...

great, great!
I'm smiling - this nite i'll sleep few hours as usual... :)
let me download some more tuts, print all these directions, and go home and have the usual spaghetti in front of the debugger...

WOW cool nite...

Bye
ema
JMI
06-13-2002, 05:15 PM
edolis:

The Alfred Lo article mentioned by Mefeus is actually available on the Fravia portion of Woodmann's server under the "What's new" section of new tutorials. There is a link to that portion of the server at the bottom of this forum.

There's a link to that article from there: http://www.woodmann.net/fravia/spaia20020530_2.pdf

Regards.
edolis
06-13-2002, 05:27 PM
yes, certainly i've got it - i downloaded it some days ago can't remember where - together a plentiful of manuals/examples/assembly-knowledge-refresher and the technical/universitarian point of view makes it quite appreciable (maybe only for engineers, but i'm) - now i just need time to read... :p
Unluckly the only Softice tut i found looks like a old copy of the manual <si-ug-chapterxx> (now i'm reading the newest copy-the one of driverstudio 2.5), which is written for a developer point of view, not reverser's (that's why you're getting fed up with me :cool: !!)
Lots of things to learn... does it mean i'm still young?? :confused: ;)

Bye Ema
JMI
06-13-2002, 05:50 PM
edolis:

If you haven't been there already, go to Krobar's site at hxxp://www.krobar.cjb.net/. He has collections of tuts on many sybject, although many are already at the Fravia site here. More specific to your learning curve there are articles from the "Cracking 4 Newbies" site which address Softice issues. There are a lot of articles there and on Fravia. Use the search functions of the boards to locate articles specific to Softice.

The CrackZ Archive, also at the bottom of the forum, has an article titled "SoftICE - the very 'basics'" which has good information on getting started with Softice. You can also find the single article by doing a search on the net for that title. It has these connected articles:
Installing SoftICE
Configuring SoftICE
Greythorne's Guide to Breakpoints
Rhayader's Guide to SoftICE conditional breakpoints and macros

and identification of various API to use for cracking. Check them out. The CrackZ article would be a very good place to start to learn Softice use.

Regards.
edolis
06-14-2002, 07:27 AM
I've found (at last - i've tried to access www.cracking4nebies thrice these days and no way :confused: ) but i've found another site with plentiful of tuts, like the one you advice me (and it is, really, cool!)
the url is hxxp://home.online.no/~reopsahl/files/assem.htm
(from the Ground Group)
have a nice day (i'll have a nice read...)
Ema
Mostek
06-16-2002, 11:21 PM
Here is answer to keyboard isue.

wXw.compuware.com/products/driverstudio/faq/softice/
index.htm

Peace
Mostek
ReaL|sTy
06-26-2002, 06:08 PM
seems you're just starting... :) usually hmemcpy bpx is used to fish serials... in your program window where you're supposed to enter the name and serial or just serial. open it.. leave opened don't enter anything yet if you have any bpx activated cleanit (bc * +enter) just in case.. we don't want softice to break yet :)

then enter your serial and name Ctrl+D will Pop up softice write bpx hmemcpy then enter now ctrl+d again to exit softice now press ok in the registration window softice will pop up .. usually starts at some windows API's..keep pressing F12 you have to make sure you're in the program code instructions if your program needs only a serial then youwill only have to stop when you see the program Code.... or skip until next instructions where the serial is calculated. with F12.... trace with F10.............

i'm too lazy right now to keep telling you,..anyway you need to read tutorials.....

good luck!
edolis
06-27-2002, 04:46 PM
Mostek, your directions are quite interesting - yet, i can't access the directory where that damnd keymap.zip is placed - no permission to enter the dir where the file is placed.
Is there anyone who can tell me where i can get a copy??

Thanks
Emanuele


hi all!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hi all!
PDA

View Full Version : hi all!

tHE SnaKe
06-12-2002, 08:09 PM
hia all

can help for creating a keygen with Visual dialogscript 4.50 eng
please help
to create my our keygen


winice.dat
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > winice.dat
PDA

View Full Version : winice.dat

golden_123
06-12-2002, 10:22 PM
Can someone plz post of copy of there winice.dat file for driver studio 2.6 so i can copy it for windows xp professional
ty
tHE SnaKe
06-13-2002, 03:16 PM
get winice.dat file
golden_123
06-13-2002, 09:28 PM
thx alot for your help i greatly appreciate it. I try to configure that file for windows xp now ty
bobbadoll
10-17-2003, 06:53 AM
get winice.dat file

I cant download it ! it wont let me.....this sucks.
If someone could please e mail me the winice.dat file i would be happy.
I am using XP pro sp1
Michael
CuTedEvil
10-18-2003, 08:05 AM
The same as tHE SnaKe!
NMI=ON
SIWVIDRANGE=ON
LOWERCASE=OFF
MOUSE=ON
NOLEDS=OFF
NOPAGE=OFF
PENTIUM=ON
THREADP=ON
VERBOSE=ON

PHYSMB=32
SYM=1024
HST=256
DRAWSIZE=2048
TRA=8

INIT="X;code on;altscr off;lines 60;wc 32;wd 8;faults off;"

F1="h;"
F2="^wr;"
F3="^src;"
F4="^rs;"
F5="^x;"
F6="^ec;"
F7="^here;"
F8="^t;"
F9="^bpx;"
F10="^p;"
F11="^G @SS:ESP;"
F12="^p ret;"
SF3="^format;"
CF8="^XT;"
CF9="TRACE OFF;"
CF10="^XP;"
CF11="SHOW B;"
CF12="TRACE B;"
AF1="^wr;"
AF2="^wd;"
AF3="^wc;"
AF4="^ww;"
AF5="CLS;"
AF8="^XT R;"
AF11="^dd dataaddr->0;"
AF12="^dd dataaddr->4;"
CF1="altscr off; lines 60; wc 32; wd 8;"
CF2="^wr;^wd;^wc;"

EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
EXP=c:\windows\system\advapi32.dll
EXP=c:\windows\system\shell232.dll
EXP=c:\windows\system\comctl32.dll
EXP=c:\windows\system\crtdll.dll
EXP=c:\windows\system\version.dll
EXP=c:\windows\system\netlib32.dll
EXP=c:\windows\system\msshrui.dll
EXP=c:\windows\system\msnet32.dll
EXP=c:\windows\system\mspwl32.dll
EXP=c:\windows\system\mpr.dll
EXP=C:\windows\system\vb40032.dll ;VB4 Runtime support file
EXP=C:\WINDOWS\SYSTEM\MSVBVM60.DLL

;F5="^x;"
;EXP=C:\windows\system\msvbvm50.dll ;VB5 Runtime support file
SET MAXIMIZE ON
WDMEXPORTS=OFF
MONITOR=0

CuTedEvil
bobbadoll
10-19-2003, 06:01 AM
The same as tHE SnaKe!

CuTedEvil

Thanks a lot for that !!!

Michael


Sentinel spro dongle protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel spro dongle protection
PDA

View Full Version : Sentinel spro dongle protection

ComanderKeen
06-13-2002, 09:14 AM
There is local software named KardiLab that is protected by sentinel spro dongle. It has two versions, KardiLab 8 and 10. I dumped both dongles memories with sprodump and found that contents of the memories of two dongles exactly same except the serials (Cell 00). But its not possible to run one of them with the others dongle. Anybody knows any protection API uses the serial of a sentinel dongle or it’s some kind of new trick. Anyway I’ll appreciate if someone shares his opinions with me about this subject.

Greetings to CrackZ, Goatass and CyberHeg ( I learned everything from you)…and reversers all around the world.

P.S: Sorry for my un-advanced EnglishJ
:confused:
cyberheg
06-13-2002, 04:29 PM
You can do lots of tricks with the serial. If you read the manual I am sure it says somewhere that if a developer orders a series of dongles the serial number will be incremented one by one for each dongle. In past I bought a developer SDK where the dongle had the serial number 0x0001. The dongle then broke after some time and the serial of the new dongle became 0x0002. Knowing this fact is useful because it can allow developers to "mark" dongles for a specific program or version. Lets say the developers of your target ordered 1000 dongles for the first version and then later again 1000 new ones for the 2nd version. It's easy then to do a check if your dongle is in the first or the 2nd range.

Of other types of checks it's possible ofcourse to tie the serial to a real serial number which must be inputted by the user.

Also you can use it as a dongle specific encryption. I only saw that once though (it was with a Hasp dongle though) where the program used the dongle serial as a decryption key for the dongle memory.

A specific dongle can ofcourse also be blacklisted easily because if it's serial aswell.

Regarding your target I can't say more unless you post more details.
CrackZ
06-14-2002, 12:53 AM
Hiya,

Check if both dumps have the same Developer ID (cell 1), if they do then you should safely be able to unplug 1 of them (might save you some confusion).

The only way a developer can read the dongle s/n (if that is the basis of the protection) is via one of the spro(Read) API's (2 of them), find those, and breakpoint them, then just follow back the s/n and see how its used.

I have to confess I think it really unlikely any developer would just distinguish by just dongle s/n, however, if they have Cyberheg's theory sounds pretty likely, probably just a range of s/n's per version.

Regards (let me know if you can make available the target and/or dumps) and I'll probably be able to help more.

CrackZ.
VoxQuietis
06-20-2002, 09:12 AM
Hi Crackz,

I think you never saw an actual Superpro based hostid implemenation of Flexlm. They are doing exactly that: they have a DevId (or a small range of it, dont know) and they use the DevId and the dongles serial as Flexid=7-xxxxxxxx.

I even think, that this is quite OK, since Flexlm's biggest advantage is its flexibility and not the security. I.e. You never would start patching the Flexlm-stuff to overcome the dongle based hostid (You'd rather go ahead with Hostid=Any :).

On the other hand, I saw an (expensive) VHDL-synthesis tool, which uses Flexlm and incorporates a small query table into its licensing mechanism. While the standard Flexlm implementation had been successfully attacked by a group called SLT, the dongle based portion of the protections doesn't seem to be compromised for the public (leeching) audience. (but be shure, that it's hacked, anyway :-P )

Regards,
- Vox.
ComanderKeen
06-20-2002, 09:26 AM
Since the time I sent about the post to the forum I had the chance to check the contents of two new dongles, which belongs two other versions (version 9 and 12). I checked the Dev. ID’s (Cell 01) and they are exactly same with preceding dongles. And serials of dongles seem from the same serie.(4004 /4B04 /4A04/3504). I opened the .exe file with IDA and applied Killer_3K’s flirt signature. Dev. ID isn’t pushed directly (which something new for me) and check the calls for sproRead and sproQuerry APIs, found something interesting. Is it something I thought? A call for the Cell 00 (serial number of the dongle)?

00C6AFD0 sub esp, 4
00C6AFD3 test byte ptr ds:dword_C6891C, 70h
00C6AFDA mov [esp+4+var_2], 0
00C6AFE1 jz short loc_C6B017
00C6AFE3 lea eax, [esp+4+var_2]
00C6AFE7 push eax ; store address?
00C6AFE8 push 0 : cell to read?
00C6AFEA push 0C5FCC8h :packet record?
00C6AFEF call sproRead
00C6AFF4 test ax, ax
00C6AFF7 jnz loc_C6B0E7
00C6AFFD mov cx, ds:word_C600D0
00C6B004 cmp [esp+4+var_2], cx
00C6B009 jz loc_C6B0E7
00C6B00F mov ax, 3
00C6B013 add esp, 4
00C6B016 retn

00C6B0A7 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
00C6B0A7
00C6B0A7 loc_C6B0A7: ; CODE XREF: sub_C6AFD0+69 j
00C6B0A7 push 4
00C6B0A9 mov ds:dword_C5FC60, eax
00C6B0AE mov ds:dword_C5FC64, 0
00C6B0B8 push 0
00C6B0BA push 0C5FC64h
00C6B0BF push 0C5FC60h
00C6B0C4 push 0 ; Algorithm starting point?
00C6B0C6 push 0C5FCC8h : packet record?
00C6B0CB call sproQuery
00C6B0D0 test ax, ax
00C6B0D3 jnz short loc_C6B0E7
00C6B0D5 mov ecx, ds:dword_C5FC64
00C6B0DB cmp ecx, ds:dword_C6891C
00C6B0E1 jz short loc_C6B0E7
00C6B0E3 mov ax, 3
00C6B0E7
00C6B0E7 loc_C6B0E7: ; CODE XREF: sub_C6AFD0+27 j
00C6B0E7 ; sub_C6AFD0+39 j ...
00C6B0E7 add esp, 4
00C6B0EA retn
00C6B0EA sub_C6AFD0 endp
00C6B0EA

and I have another question about sproRead, you can see that the cell to read is pushed in eax at line 00C6B962, two lines before the byte from offset 00C5E00C moved (movzx) to eax. If the content of offset 00C5E00C is;

00C5E00C byte_C5E00C db 0A2h ; DATA XREF: _

which byte does it move into the eax? Is eax 0002 or 000A? Same trick is used in pushing the Dev ID before sproFindFirstUnit.

00C6B94C cmp ds:byte_C5E00C, 0FFh
00C6B953 jz short loc_C6B982
00C6B955 movzx ax, ds:byte_C5E00C
00C6B95D push 0C600CCh
00C6B962 push eax ;Cell to read?
00C6B963 push 0C5FCC8h
00C6B968 call sproRead
00C6B96D test ax, ax
00C6B970 jnz loc_C6BA39
00C6B976 xor eax, eax
00C6B978 mov ax, ds:word_C600CC
00C6B97E mov [esp+24h], eax

I thank everybody for being patient while reading my post. Special thanks to CrackZ and CyberHeg for useful advices.
cyberheg
06-20-2002, 10:53 AM
About your movzx query I see a problem here.
The line you specified:

movzx ax, ds:byte_C5E00C

is actually the same as:

mov ax, 0 ; clear only 16 lower bits of eax
mov al, 0a2h

So from what you wrote eax will contain: ????00a2

Now the problem is that the cell to read is out of range but maybe thats how it should be? Maybe it's intended to be a fake check to make the dongle return values other then "good". This would actually be a simple but effective way to clear away non thinking crackers who allways believe dongles should be working in one way.

Another thing is your query. You notice that the cell to query on is 0. This is another fake check where you need to use the manual. From the manual it says that only userwritable cells can be used for queries. These start from +8 so 0 is ofcourse a restricted cell. I can't remember if the following was specified in the manual or it was because of my own tests but in sentinel shell (automatic protector) I wrote in a essay once about the same thing since it also uses this kind of check.
A query algorithm is 2 cells hence a DWORD long. These cells will in this case be 0 (serial) and 1 (developer id). If you do a query on these you get the same response back as you sent to the dongle as your query string. Now it should be easy to emulate since you just need to copy the query string to the response position.

Are you sure this is not sentinel shell btw? Both checks read on cell 0 and query on shell 0 were/are used by this protector.

Hopefully this helps.
goatass
06-20-2002, 02:26 PM
After the sproRead call you see this:

00C6AFFD mov cx, ds:word_C600D0
00C6B004 cmp [esp+4+var_2], cx
00C6B009 jz loc_C6B0E7

what is it comparing the return value to?

Similarly with the sproQuery:

00C6B0D5 mov ecx, ds:dword_C5FC64
00C6B0DB cmp ecx, ds:dword_C6891C
00C6B0E1 jz short loc_C6B0E7

maybe can give you a better idea as to what you should expect in the return value.

goatass


aspack or asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > aspack or asprotect
PDA

View Full Version : aspack or asprotect

tHE SnaKe
06-13-2002, 10:32 AM
help me! for this program AltDestop
download here:
AltDestop (http://mirror1.astonshell.com/files/altdesk.zip)

his packed with aspack or asprotect
i try dumped with procdump
dump full
not work
please help me for unpack this program
Fake51
06-13-2002, 11:46 AM
Was it too hard to search protools for a pe identifier, then downloading the appropriate unpacker?

Fake
tHE SnaKe
06-13-2002, 02:58 PM
what is this program?
fake speak me please!
foxthree
06-14-2002, 05:17 PM
As the saying goes here, "show us what you did, and we'll show what needs to be done" ;) So what did you do ... steps not just some generic terms like dumped with procdump etc.

BTW, it is ASProtect :)

Signed,
-- FoxThree


EtherPeek 4.5.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > EtherPeek 4.5.0
PDA

View Full Version : EtherPeek 4.5.0

foxthree
06-13-2002, 11:51 AM
Fellow RCEs:

I'm trying to figure out this program. This is a "crippled" demo and I'm trying to fix the "bugs" :D. Anyways, I've succeeded in enabling everything except that for the "Print" and "Save"( this can't be done 'coz I think the code itself is missing) and the 250 packet limit.

This 250 packet limit is interesting. I've bypassed the place where the check is made but still the application stops displaying packets when more than 250. Any tips / ideas on how to go about this?

Signed,
-- FoxThree
hobgoblin
06-13-2002, 03:38 PM
Hi there,

I guess you found this snippet:

016F:0040A008 8B8634A90000 MOV EAX,[ESI+0000A934]
016F:0040A00E 817820FA000000 CMP DWORD PTR [EAX+20],000000FA
016F:0040A015 730E JAE 0040A025
016F:0040A017 FF1564925300 CALL [KERNEL32!GetTickCount]
016F:0040A01D 3B8688A90000 CMP EAX,[ESI+0000A988]
016F:0040A023 7215 JB 0040A03A
016F:0040A025 8BCE MOV ECX,ESI
016F:0040A027 E8D4040000 CALL 0040A500
016F:0040A02C 6A00 PUSH 00
016F:0040A02E 6A40 PUSH 40
016F:0040A030 6868085800 PUSH 00580868
016F:0040A035 E85A2D0E00 CALL 004ECD94
016F:0040A03A 8A442417 MOV AL,[ESP+17]

The call made from 40A035 leads to the 250 and 30 seconds messagebox. I also assume you
found out that changing the two jmps at 40A015 and at 40A023 took care of the 250 limitation and teh 30-seconds limitation. But I also found out that the program stops writing out (display) information even though it seems to continue capturing packets.
I dumped the memory of [eax+20] at 0040A00E, only to find out that the displayed memory
address changed every time I ran the program. So I put a read/write bpm on the address displayed, and found out that the proram only once writes some information to this address, but it reads out some information at least seven times.I did this to found out what the program did to write/store hwo many packets that had been read and displayed. I just checked the code everytime Sice broke, and quickly found this code:

016F:00491220 53 PUSH EBX
016F:00491221 8BD9 MOV EBX,ECX
016F:00491223 55 PUSH EBP
016F:00491224 56 PUSH ESI
016F:00491225 8B4320 MOV EAX,[EBX+20]
016F:00491228 57 PUSH EDI
016F:00491229 3DFA000000 CMP EAX,000000FA
016F:0049122E 7209 JB 00491239
016F:00491230 5F POP EDI
016F:00491231 5E POP ESI
016F:00491232 5D POP EBP
016F:00491233 32C0 XOR AL,AL
016F:00491235 5B POP EBX
016F:00491236 C21000 RET 0010

The code at 00491229 looked familiar, and when I changed the jump instruction to always jump, the program continued to write down (display) information beyond the 250 limit.

hobgoblin
foxthree
06-13-2002, 04:47 PM
Hobgoblin:

Nice work :D. Yes, exactly. However, I'm not getting the same results as yours.

This is what I did:

016F:0040A015 730E JAE 0040A025
016F:0040A023 90 NOP
016F:0040A023 90 NOP (Noped out the JAE call)

016F:0040A023 7215 JB 0040A03A
016F:0040A023 EB15 JMP 0040A03A (JMP Always)

After this patch, yep, timer is working fine, but after the 250 packet limit neither is the counter incremented in the bottom status bar and neither the Packt Recvd/Packt Filtered is increasing and neither is the Pckt Buffer (If the packet is captured but not displayed the buffer usage should atleast increase, right?)

Infact the address pointed out by you (0049122E) is not getting called at all!!! Strange !

I patched the code as told by you at

016F:0049122E 7209 JB 00491239 to
016F:0040122E EB09 JMP 00491239

Still doesn't break? Any clues.

Anyhow, I'll look into the BPR technique outlined by you to figure out what went wrong. Thanks a lot :)

Signed,
-- FoxThree
hobgoblin
06-13-2002, 05:24 PM
Hi foxthree.
That is strange. I double-checked on my computer, and it works for me.
One thing I noticed while I was looking at this program is that the changes I made in the program during runtime (while I was using Sice) stayed resident in memory until I changed it back or rebootet. I got a couple of surprises there.:-)
Maybe this happened to you too....

hobgoblin
foxthree
06-14-2002, 07:25 AM
He he hobgoblin:

"Patch and Play" as the +SplAj guru says :D. Just as I suspected... I'm patching the app under Win2K and the address I found that needs to be patched is @ 4918A5. I think the EtherPeek guys have written some platform specific code where in it calls your address if Win9X and mine if Win2K. BTW, you did the patch on Win9x right?

Also interestingly the behavior you've outlined is a day-to-day-fact under Win2K. Some knowledgable persons tell me that it is because of NTICE which patches CR0.WS and in effect disables Copy-on-Write for good. Clearing the swap file might help (if on Win2K). Else check out this small app I've written to fix this problem.

This app allocates around 60% of your Physical Memory size and then accesses each 4K page in that block. There by forcing Windows to reload its memory cache. This works like a charm on Win2K but haven't really tested it in Win9x.

After modifying the code and getting out of SoftICE, just run this app and then reload the app in SoftICE. Everything should be okay.

BTW, the above operation takes around ~13 secs. on a 551MHz Pentium III m/c. It sure beats a reboot... isn't it :D

Signed,
-- FoxThree
hobgoblin
06-14-2002, 09:59 AM
Hi foxthree,
Seems to be a nice tools.:-)
I'll try it out. Nice to see that you found out what was wrong.

Hobgoblin
XeNoSiS
06-15-2002, 06:13 PM
Have you taken a look at Etherpeek NX 1.0? Does it use the same methods discussed here?
JMI
06-15-2002, 07:10 PM
FoxThree:

this cache memory problem was discussed by the Owl on the Reverce Engineering Forum a couple of days ago. His comments are at:

hxxp://disc.server.com/discussion.cgi?id=37&article=3792

He also suggested a google search of 'unified page and buffer cache' which has some interesting articles.

Looks like you have written a useful program for solving the problem. Did you use GlobalMemoryStatus API (haven't taken your utility apart yet) similar to what DebugLord mentions there?

Keep the good work and the good discussions coming.

Regards.

Or are you just using DebugLord 's machine??? :D
foxthree
06-15-2002, 09:41 PM
Occasionally, yes! I do :D

Funny, JMI...

XeNoSiS: No I haven't seen EtherPeek NX ... but the product description looks interesting may be I'll take a look....

Signed,
-- FoxThree
hobgoblin
06-16-2002, 10:32 AM
I did check out the NX version of Etherpeek. The protection is identical.

hobgoblin


getting the AL of an int
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > getting the AL of an int
PDA

View Full Version : getting the AL of an int

The Keeper
06-13-2002, 12:05 PM
My problem is, i have:

int i=(x-(z*0x64))/0x0A;

and i need just the AL of i,
i debugged and saw

eax = result of int i=(x-(z*0x64))/0x0A;

mov [ebp-300], eax

so i simply added to my code

__asm mov [ebp-0x300], al;

I wonder if there is a way to get only the al part of i, without having to use inline asm, there must be but i dunno :) if someone knows please tell me (c\c++)

thanks in advance.
naides
06-13-2002, 02:48 PM
What about a bitwise and operation?

int j = i & 0xFF;
cyberheg
06-13-2002, 02:56 PM
Either the bitwise AND which was posted above or use a pointer:

unsigned char *p;

p = (unsigned char *) &i;
store_var = *p;


Softice Crashing...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Crashing...
PDA

View Full Version : Softice Crashing...

theeta
06-13-2002, 01:47 PM
hi there......i'm having this trouble with my softice.....
on bootup my softice is crashing...it gives a fault and system reboots....
the command windows shows that module "acpi" is being loaded ...mebbe beause of that this is happening....has anyone encountered such thing before??
any suggestions ??
thnx in advance..

theeta.
theeta
06-14-2002, 12:11 PM
more information..

i'm running windows 98..
i've tried both the versions 4.05 and 3.7 and they both are crashing at the same point during bootup....
i have recently formatted my HD and installed Win98...

bye
theeta.
NervGaz
06-14-2002, 05:42 PM
ummm acpi controls the interupts in win (among other things) it could have something to do with that... if thats the problem a reinstall of of win98 using win the /IP (ithink it was it's on microsofts site somewhere)is the solution (hehe only way to get rid of acpi on win9x as far as i know) but since this ould be a rather common problem numega probably has a ptch for it... but the again i could be completley wrong and it's something else... check numegas faq or something


RSA-Tool2 v1.7 Request
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > RSA-Tool2 v1.7 Request
PDA

View Full Version : RSA-Tool2 v1.7 Request

GULDFANG
06-13-2002, 07:51 PM
i m looking form the lastest RSA-Tool2 (v1.7?) from tE!
tE!
06-28-2002, 02:04 AM
Greets,
tE!~TMG
goatass
06-28-2002, 01:21 PM
tE! is your site gonna be back up anytime in the near future? or is it gone forever? You had a lot of great stuff there, kind of a shame that it's gone.

anyways thanks for everything.

goatass
foxthree
06-29-2002, 06:42 PM
Hi tE!

Thanks for making e a bignum. It was kinda ...ummmm limiting. Thanks for a great tool!! :)

Signed,
-- FoxThree
GULDFANG
07-06-2002, 10:06 PM
merci ego ;)


Just another idiot
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Just another idiot
PDA

View Full Version : Just another idiot

miltantof
06-13-2002, 10:34 PM
Hi guys, great forum!

my status : not quite a newbie yet
my problem : asprotect
the exe : hide folders 2.2.1.171 (www.fspro.net)
--------------------------------------------------

The unpacking and IAT rebuilding of the 2.0 version of this program posed no problem and the unpacked program works without a flaw.

2.2 is different.

Here's what I did:
- I found the oep and dumped at 004749c4
- realigned the sections with procdump
- reconstructed the IAT with ImpRec 1.4.2+
- changed the ep with procdump
- at 00474A22 I nopped out the call to the "internal error" message box
- and at 004037E6 I changed the je to jne (which caused another error message)

Now this is what happens:
If the original exe is loaded into memory my unpacked exe apparently works, but if the original
exe is not loaded my exe crashes with the following message :
"Access violation at address 00000009. Write of address 7074613d"
W32Dasm tells me that this coded address is not in a loaded module.

I'm totally lost. I'm hoping for a kind soul willing to shed some light and help me find my way home.
foxthree
06-14-2002, 06:59 AM
Hajo:

I've downloaded and unpacked HideFoldersXP version. Runs like a charm. However, I believe you have the Windows 9x version --- which I don't have at the moment. I'll try it later today and let you know the results.

Signed,
-- FoxThree
miltantof
06-15-2002, 10:50 PM
Hellooooo FoxThree

thanks for your reply.
Yes I have version 2.2 which is the windows 98 version.
I appreciate your help and will be waiting for any suggestion that will get me out of the woods.
foxthree
06-16-2002, 08:21 PM
Hello:

Unpacked the above version of HideFolders and analyzed. At raw offset 7869B there is a indirect call to ASPR code @ C4E870. Naturally, by pass this call. Now, if you run it you'll get some Page Fault in BFF7XXXX address which belongs to IsBadStringW :(. So, Trace... soon enough we see at 0x403784 a routine which checks some SEH addresses to see if EAX == ECX?. With ASPR EAX always equals ECX. So, JNZ never is executed. But without ASPR, EAX != ECX. But alas, ECX value is never used. So, patch JNZ at raw offset 3791 :D What really matters is that the value at EAX should be correct some 6FXXXX, I think.

So, no more page faults and all is well :) Hope this helps.

I didn't find any Access Violation at adress 0000009 errors? May be 'coz different version.

Signed,
-- FoxThree
miltantof
06-17-2002, 01:42 AM
thank you foxthree,
i'll get to work on it in the next few days
(I'll have to understand SEH's first).
miltantof
06-19-2002, 09:35 PM
Hello all! and hello FoxThree,

first off thank you for the credits although undeserved.
I just knew this was a tough one, and I assure you it has grown
on me, I just can't shake it off. Alas I'm way over my head in
this and I would hope that you could be a little more unassuming.
I've tried, as per Splaj, to dump after Call Eax followed by the
suggestion by hobgoblin to copy and paste the sections, but no luck!
I need a little hand.
thanks guys!


problem while Unpacking under XP (using RV and SICE)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > problem while Unpacking under XP (using RV and SICE)
PDA

View Full Version : problem while Unpacking under XP (using RV and SICE)

SilSaLaMaTa
06-14-2002, 04:35 PM
hi ,
I have problems while unpacking asprotect under WinXP Pro.
While using RV ,
1- I choose the tracer and Select the prog , 0x400000 as low eip and 0x500000 as high eip , then clicked on Start , RV didn't start to trace the prog , 0 as Last eip and nothing happens .
2- my computer suddenly restarts and I try to find OEP with soft ice .

I put a break point on NtContinue (solomons trick) and traced the prog , after SYSENTER the prog contiues .
I searched for 61,ff,e0 , and put a break point (after second break on NtContinue) . I tried BPM and BPX . but the prog ignores the break points .

I put a bpx on Getversion , and searched for 61,ff,e0 (found at AD3924) . then
I put a break point on NtContinue again and restart the prog , after second break I searched for "Jmp [ebp-14]" , found at ABFB73 , then BPX on AB7b73 , BPM AD3924 W, I traced the prog until "POPAD , JMP EAX" . EAX is 52A488 , I think it's not the OEP .
cause imgae base is 0x400000 .

the prog is Essential NetTools v.3.0 (build 86 , i think) at http://www.tamos.com .

sorry for my English .
Uranus
06-14-2002, 10:34 PM
you got a working softice with winXP? Can you do me a favor? gimme your softice settings... whatever info you can find... on the driverstudio control panel, whatever info cause I really need softice with winXP


FlexLM feature finding problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FlexLM feature finding problem
PDA

View Full Version : FlexLM feature finding problem

password
06-14-2002, 05:44 PM
I'm new here, so I hope I do this right.

1)What is the problem.... I can only get one feature for application
2)What is the protection..... FlexLM v6.1a intigrated dlls
3)What tools are you using.... IDA; SoftIce
4)What tutorials have you read.... http://www.woodmann.net/crackz/Flexlm.htm all the essays
5)Show your output listing WITH comments.... NA
6)NOW ask your question.... OK, it's like this...

#########################################
I have been working on creating a license for Mirai 1.0 for a couple of weeks now. I have all the correct vendor keys and the vendor name. I was only able to get one feature name (mirai-runtime-1-0) by turning on diagnostics in the registry, setting up and running a FlexLM server, and including a USE_SERVER line in the license. I found this earlier but it doesn't seem to help much:

Q2. How can I find more features in the program which was encrypted by FLEXlm? Such as Cadence Specctra, I have looked through all .exe .dll files, but I can't
find similar features. Other programs which were integrated with lmgrxxx.dll, I also can't find more features. I can only find one feature prior to lc_checkout, where
were the other features placed?.

A2. You can often find the features by doing a search of the executable for the feature you know - often the other features are very close to it in the binary. One
thing you can do is start up the cdslmd server and see if the program is trying to check out any specific features - attempts to check out unsupported features will
show up in the log file. I've found that there's usually an attempt to check out a license before it bombs; A few programs call lc_get_config and then check the
returned list for features.

Either way, you find out what it is trying to do. Try searching everything for _ALL to see if you can find anything. Tell me the version of FLEXlm that cdslmd uses,
plus the first two bytes of ENCRYPTION_SEED1 and I may be able to help you more.
#########################################

The vendor daemon never reaches lc_checkout; so, I have no idea where the actual checkout is occurring. The target also uses AllegroCL, so some of the call may be hidden in the .dxl file. After the log file checks out the first feature it say Unsuported: "Internal", but I can't use Internal as a feature. I did a string search in SoftIce for the feature I have, and found what looked like the the the second feature line, except encrypted somehow.

#########################################
41 82FFFFFF 6E114779
FEATU ... n?›Gy
#########################################

I know there's more features; but where are they?

P.S. Damn, that's a long post.
huangcd
06-10-2004, 01:53 AM
i encounted the same question as you.

the daemon does not break at lc_checkout or l_checkout function and i searched all through the total daemon program and found nothing.

Unfortunately i have got any true features at all and at least you have one.


New/Latest ASProtect Strain
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New/Latest ASProtect Strain
PDA

View Full Version : New/Latest ASProtect Strain

foxthree
06-14-2002, 09:34 PM
Hello Fellow RCEs:

I'm excited as I type this 'coz I *think* this may be a long awaited new ASPR strain. Look at this app.

Hide Folders v.2.3.5
hxxp://yyy.fspro.net

Hmmm okay It is ASProtect all right. :rolleyes: Find OEiP. Piece o' cake. Now run ImpREC. WTF? IAT Size == 24??? :confused: Hmmm something is wrong. Okie! Run RV. "IAT is corrupt..." Enter OeiP and press "Find IAT". What!?? "Found Nothing" :eek:

Hmm... Open in SoftICE and find the IAT Decryption loop .. Everything is "normal"...

Okay let's see where we land at the JMP Table and lo! a whole lot of stuff has changed in the way ASPR redirects IAT! WTH??? No wonder RV/ImpREC is blown away...

For eg. Look at the following piece of code that redirects to GetModuleFileNameA:

[CODE]
017F:00C6493C 2BD2 SUB EDX,EDX
017F:00C6493E 681A1DFABF PUSH BFFA1D1A
017F:00C64943 64FF32 PUSH DWORD PTR FS:[EDX]
017F:00C64946 648922 MOV FS:[EDX],ESP
017F:00C64949 E9B62D31BF JMP BFF77704 (JUMP)

BFF77704 == GetModuleFileNameA+000D which is the bytes that are executed by ASPR! Hmmm.

Also, another funny thing is that ASPR now pushes values on stack and then RETs. Which again I belive RV can't find (as found by Eval on Armadillo) [So Alexey steal code from ARMA?]...

Anyways, it is 4.a.m here and I gotta go to sleep. :(

If this is not what it claims to be, moderators, just delete this post and let me lie in peace or else you'd better give this strain my name :D

Signed,
-- FoxThree
arieri
06-14-2002, 10:31 PM
hi,

Try this

RVA= 8313C
Size=69C

regards

arieri
Stone()
06-15-2002, 08:28 AM
Mmh, are you sure it's a new version of Asprotect?

I have one of the latest ASprotect 1.23 Betas and I can protect an app I've written in a way that Imprec & RV do not find anything at the OEP. This is however the way I've written my app, same happens when I use Asprotect 1.2 (the ufficial one).
foxthree
06-15-2002, 10:04 AM
Yo guys:

Yes, I did find the right IAT RVA under Win9x. But that's besides the point. The point is while ImpREC fixes the IAT in a snap and RV in less than a snap :D, why both of them throw up in this particular ASPR version :eek:? Any reasons would be highly appreciated. :confused:

Another thing that is interesting in this version of ASPR is that the IAT redirection style has changed, AFAIK. Pls. do feel to correct me if I'm wrong though :D

Signed,
-- FoxThree
hobgoblin
06-15-2002, 11:19 AM
Well, I managed to unpack it without trouble using RV.
I don't have an answer to you, foxthree, but I noticed something else strange with this program. When I put a bpmb on the address 46F920 in the original file, it breaks, and from tracing down that call you can easily see how this program can be patched to act as regisered. But when I do the same thing in the dumped file, it doesn't break. If I open the register box and fill in name and serial, and then put a bpx hmemcpy and so on, and then put a bpmb on the mentioned address after coming to the program code, it will break, and patching can be made. The call starting from 46F920 is a vital one. In the original file this call is checked during start up (checked it in Sice via breakpoints). But again, if I try it in the dumped file, it doesn' break, even though the program runs.
Anyone interested in investigate this further?

hobgoblin
foxthree
06-15-2002, 01:42 PM
Hobgoblin:

What was the version of RV that you used? I used v1.5 on Win9x. Though I know that it may not work correctly always, for all ASPR apps till now it used to work correctly. Wonder what is the problem? So is the case with ImpREC.

I'll try later today again with RV 1.3 for Win9x and see what I'm missing.

Signed,
-- FoxThree
hobgoblin
06-15-2002, 02:36 PM
I used RV version 1.2 on this program (I'm on WinME). I tried 1.3 also, but it couldn't read the RVA ot size of the IAT.....

hobgoblin
Lbolt99
06-15-2002, 09:07 PM
The IAT only seem to be acurately fetched on about 50% of the ASprotected apps I've looked at, that's why I recommended Fox3 write "IATStartFinder :)

Originally posted by hobgoblin
I used RV version 1.2 on this program (I'm on WinME). I tried 1.3 also, but it couldn't read the RVA ot size of the IAT.....

hobgoblin
hobgoblin
06-15-2002, 11:40 PM
And exactly where did you find that one? Did a quick Goggle search, but no luck...

Got a pointer to it?:-)

hobgoblin
JMI
06-16-2002, 12:00 AM
hobgoblin:

Searching on google is always good, but don't forget the "search" button HERE. Part of the problem is that Lbolt99 gave it a generic name, instead of what FoxThree named it. You will find it in the TOT Forum and it is called OEPFinder. Simply open the TOT Forum and it will bite you. "Announcement: OEPFinder v0.3 Tensor Build" with FoxThree as a thread starter is a pretty subtle hint. :D :D

Regards.

p.s. a google search of "OEPFinder" leads to a site at hxxt://rrn.mine.nu//data/2002/may/01/11_00/Fravia.html that seems to be a redirector to threads posted here. Just why they are doing it that way I don't know.
esther
06-16-2002, 05:02 PM
Heya all,

I have tested RV 1.3 on my machine and it works fine My os is win98.Rv 1.5 only works on winxp and win2k.
change the oep to 401000 on rv just fetch iat it will resolved fined ;)

Best regards
foxthree
06-16-2002, 07:09 PM
Hi Esther:

How're ya doing? BTW, putting OEiP as 00401000 works fine in both RV 1.3, RV 1.5 and ImpREC 1.4.2+ :D.

Now the question is why? when the OEiP is x7863C?

... which raises another interesting question, how does RV/ImpREC trace the IAT once the OEP is known. Do they disassemble memory from the OEP to land at the JMP table?

But on a more serious note:

Stone(): ASPR is famous for what is called as "special" builds that do not come as Betas. This goes directly to registered users on a demand-basis. [Alexey if you're reading this, may be you can vouch for this]. Is it possible that this is one of them?

+SplAj guru, Eval, Crus... and others: Yoohoo, where are you??

Signed,
-- FoxThree
+SplAj
06-19-2002, 09:49 AM
This looks like a job for me, so everybody just follow me.....

Decrypted Sections for the nooooobs
===================================

Fox3 has found a very nice target to play with in hiddenfolders.exe but for Win98 etc only :(

I found no suprise at all with the IAT redirector. Same ol'shit. However
I did find a very nice feature made by the programmer that uses a key to decrypt
some code AFTER the OEiP of 47863C is called. So if you rebuild at the OEiP your actually
fucked cos features are still encrypted ... but it is made in such a way that you don't really notice !!!!

Lets reverse :)

//******************** Program Entry Point ********
:0047863C 55 push ebp
:0047863D 8BEC mov ebp, esp
:0047863F B906000000 mov ecx, 00000006

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00478649(C)
|
:00478644 6A00 push 00000000
:00478646 6A00 push 00000000
:00478648 49 dec ecx
:00478649 75F9 jne 00478644
:0047864B 51 push ecx
:0047864C 53 push ebx
:0047864D 56 push esi
:0047864E 57 push edi
:0047864F B824844700 mov eax, 00478424
:00478654 E8CFDBF8FF call 00406228
:00478659 33C0 xor eax, eax

BLAH BLAH BLAH UNTIL :-

:00478694 A124BF4700 mov eax, dword ptr [0047BF24]
:00478699 8B00 mov eax, dword ptr [eax]
:0047869B FFD0 call eax <-- Here aspr code decrypts 7 sections of code.

Start code called VA C4E870

This 'call eax' decrypts the following parts of code :-

Raw Offset :-
0x6F1F5
0x6F510
0x6F93A
0x71B0C
0x76DFA
0x787F9
0x78963

Using the key at offset 0x7BBF5 => 'gw4kjbjhgekljkrt'.

So, Hobgoblin made a point about the code around VA 46F920, lets compare our
real aspr hf.exe with our dumped.exe :-

Decrypted hf.exe code :-

:0046F920 55 push ebp
:0046F921 8BEC mov ebp, esp
:0046F923 83C4F8 add esp, FFFFFFF8
:0046F926 53 push ebx
:0046F927 33C0 xor eax, eax
:0046F929 8945F8 mov dword ptr [ebp-08], eax
:0046F92C 33C0 xor eax, eax
:0046F92E 55 push ebp
:0046F92F 6823FA4600 push 0046FA23
:0046F934 64FF30 push dword ptr fs:[eax]
:0046F937 648920 mov dword ptr fs:[eax], esp
:0046F93A E901000000 jmp 0046F940 <--Code has been decrypted so JMP 46F940 and on..
:0046F93F A6 cmpsb
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0046F93A(U)
|
:0046F940 33C0 xor eax, eax
:0046F942 55 push ebp
:0046F943 6806FA4600 push 0046FA06
:0046F948 64FF30 push dword ptr fs:[eax]
:0046F94B 648920 mov dword ptr fs:[eax], esp
:0046F94E C745FC6F000000 mov [ebp-04], 0000006F
:0046F955 B201 mov dl, 01
:0046F957 A1587F4500 mov eax, dword ptr [00457F58]
:0046F95C E8F786FEFF call 00458058
:0046F961 8BD8 mov ebx, eax
:0046F963 BA02000080 mov edx, 80000002
:0046F968 8BC3 mov eax, ebx
:0046F96A E88987FEFF call 004580F8

* Possible StringData Ref from Code Obj ->"Software\FSPro Labs\Hide Folders"
|
:0046F96F BA3CFA4600 mov edx, 0046FA3C
:0046F974 8BC3 mov eax, ebx
:0046F976 E8ED8DFEFF call 00458768
:0046F97B 84C0 test al, al
:0046F97D 7510 jne 0046F98F

* Possible StringData Ref from Code Obj ->"Software\FSPro Labs\Hide Folders"
|
:0046F97F BA3CFA4600 mov edx, 0046FA3C
:0046F984 B101 mov cl, 01
:0046F986 8BC3 mov eax, ebx
:0046F988 E8D387FEFF call 00458160
:0046F98D EB55 jmp 0046F9E4

*******************************************************

Now the same code from Dumped.exe :-

:0046F920 55 push ebp
:0046F921 8BEC mov ebp, esp
:0046F923 83C4F8 add esp, FFFFFFF8
:0046F926 53 push ebx
:0046F927 33C0 xor eax, eax
:0046F929 8945F8 mov dword ptr [ebp-08], eax
:0046F92C 33C0 xor eax, eax
:0046F92E 55 push ebp
:0046F92F 6823FA4600 push 0046FA23
:0046F934 64FF30 push dword ptr fs:[eax]
:0046F937 648920 mov dword ptr fs:[eax], esp
:0046F93A E9C6000000 jmp 0046FA05 <==Here is JMP over Encrypted Code
:0046F93F 3261CB xor ah, byte ptr [ecx-35] <-- SHIT, oh dear, WTF to do now ? !!!
:0046F942 F7DE neg esi
:0046F944 DA BYTE 0dah
:0046F945 F1 BYTE 0f1h
:0046F946 ED in ax, dx
:0046F947 DAC7 fcmovb st(0), st(7)
:0046F949 0933 or dword ptr [ebx], esi
:0046F94B 8B1F mov ebx, dword ptr [edi]
:0046F94D 29AFE3161C30 sub dword ptr [edi+301C16E3], ebp
:0046F953 E45D in al, 5D
:0046F955 CAAB8A retf 8AAB
etc etc

So lets dump at the point AFTER :0047869B call eax and rebuild....is that good hmmmm lots of memory errors now. Well it appears this call did more than decrypt some code
sections it set up InitialiseCriticalSection etc etc.
So we MUST copy+paste these decrypted sections from our dumpafter.exe to dumped.exe. Pretty easy with HWorks32.

Yes thats it :)

Nice target Fox3, shame I am so laaaazy to try :(

BTW Alexey also sent us the latest ASPR 1.23beta to play with.. but alas nothing to report.

Spl/\j
hobgoblin
06-19-2002, 10:01 AM
Yes, it was a nice twist.:-)
I worked on it for quite a while, and found the same decryption call as +Splaj did. I made a dump after the decryption call, and also ran into errors trying to run it. What I did was to copy the first section (spanning from offset 0x01000 to 0x79000) into the dump made at the OEP. That fixed the whole thing. All the decrypted sections was within that section.

Nice program to work with.:-)

regards,
hobgoblin
foxthree
06-19-2002, 10:07 AM
Yoohoo +SplAj guru and others:

What a dumbass I am :(! I saw the "Call EAX" and saw the InitializeCriticalSection and stuff but alas failed to get a grasp of what was happening. Too lazy to trace through the ASPR code eh? Sorry!

Nice one, +SplAj guru. But, again a question raises in my puny brain: Why doesn't RV/ImpREC find the IT? Also, I haven't seen ASPR code PUSH <API Address> and RET. This was more of ARMA style. Am I correct?

Signed,
-- FoxThree
+SplAj
06-19-2002, 11:00 AM
The IT tracer engine was allegedly coded by G-Rom

I have discussed this point with him and MackT over on the /37.html MB. He has some ideas to improve the success rate but I think this project was never implemented for the public.

I was trying to point out that the user should NOT rely 100% on these tools and use the brain+SI to examine the JMP table or IT for exact location and length.

Unfortunately they were so overjoyed at my visit, and we got bizzy exhanging pleasant comments , that they forgot the task in hand.

There are several 'features' of each compiler, being either Borland C++, Delphi or M$ VC++ etc etc that produce working IT in different ways. The early version of RV used to re-create the it.bin and IAT.bin in the Borland way. Now the standard is M$. Thats why U only get one it.bin to attach to the end of the target dumped.exe.

Suffice to say after various protectors have mangled the imports for their own use, coding an accurate IAT tracer requires lots of experience of all compiler + protector combo quirks to get a high success rate.

Usually I just type 401000 as entry point.... fetch IAT.....and check with SI ;)

Using 'advanced trial+error' techniques ( there is a technical name for this.... M....err sumthin, like AV code does, but I am just a dumbass cracker) you could surely find the spot.

As far as your code regarding GetModuleFileNameA.... I think maybe u got lost in the codewoods a bit ???? I cannot remember that this API is redirected , ever ! I did not have any problems with resolving at all. So I will check it out tonight on old Win98 PC and revert......

Spl/\j

BTW I just de-aspr'd that HFXP Beta version...no such decrypt here.
foxthree
06-19-2002, 01:56 PM
+SplAj guru:

Thanks a lot for your rather detailed comments. Yes, I too unpaxed HFXP without any problems and no such tricks there :D. Actually, the credits for this proggie should go to miltantof (just another idiot thread). His posting got my attention and led me on this pursuit.

Yes, please do check this one out. I've also posted the redirected code in the first post. If you can just verify and let me know where I'm wrong, I'd be very grateful.

Thanks once again,

Signed,
-- FoxThree
Lbolt99
06-19-2002, 05:53 PM
+Splaj: Thanks for the info/suggestions, searching from 401000 seems to work sometimes too. I always check with SI, but lately have been having to just navigate my way to Asprotects IAT decryption loop and see where it is.

Maybe some form of pattern search would reveal the general location of the IAT: seems most reference Kernel, and it's usually the first one... a wildcard search thru ram starting @ 401000 for ** ** ** BF ** ** ** BF ** ** ** ** etc..
arieri
06-19-2002, 07:22 PM
hello all,

I thougt I had unpacked the proggy to , but
I also discovered that the call eax to asprotect codes did decrypts
some codes at the place where you can easly patch the program to pro version, I also tryed to dump the program after this call was made but was kind of lost from there.
So thanks for the information Splaj guru.

regards
arieri
evaluator
06-19-2002, 09:21 PM
Hello, FOXThREE!

you asked:
>But why 00401000 OEP works for fetcher?

401000 is not OEP value, but is start of CODE section.
RV needs it for analyze CODE section & find references to IAT. (FarJMPs FarCalls)

Putting another value causes RV to crash.
So always[ladyes?] but 00401000 before fetching...
foxthree
06-20-2002, 06:51 AM
Hello "Musician Member":

Thanks for your reply. Hmmm, interersting enough. I try some research too :D.

Signed,
-- FoxThree
+SplAj
06-20-2002, 07:23 AM
Lbolt99

....searching for 'BF' (in win98/me) or '77' (WinNT/2K) should yield zilch in a protected app cos the IT have been redirected !!!

eg Tag&Rename2.1beta :-

0030:005D6210 98 05 36 01 B0 05 36 01-BC 05 36 01 70 12 35 01 ..6...6...6.p.5.

from the table the table the API is redirected to 01360598.....

0167:01360598 2BD2 SUB EDX,EDX 
0167:0136059A 681A1DFABF PUSH BFFA1D1A
0167:0136059F 64FF32 PUSH DWORD PTR FS:[EDX]
0167:013605A2 648922 MOV FS:[EDX],ESP
0167:013605A5 680477F7BF PUSH BFF77704
0167:013605AA C3 RET

hmmm....now u follow the maze ;)

Fox3

I tested a few recent targets like Reget3, T&R2.1 15pack etc etc
and they all give similar JMP table redirected API. The interesting thing is that most JMP to API memory location, however T&R does a PUSH API value and a RET.

Otherwise this is the way ASPR has been redirecting for a while ? ........and RV resolving them proves that.

I also played with the so called latest aspr 1.23beta last night and this gave nothing new as far as regular redirection goes.
foxthree
06-20-2002, 07:28 AM
Hajo +SplAj guru:

Thanks for your post. Hmmm, wonder how I missed it. Time and again, I tell myself not to debug ASPR apps at 4.a.m. :D Wow, 4.a.m. does have magical charms of itz own. Alas, I thought I'd get my name by identifying a new ASPR "strain". It seems I'm not the "chosen one" :( :D.

Thanks again for everyone for making this interesting.

Signed,
-- Foxthree
foxthree
06-20-2002, 08:22 PM
Hello +SplAj guru/others:

Heh, nice one this. Yes, I'm guity of just patching the code without delving into it :D. But I rectified and found the decrypted sections. Dumped, pasted, and all is well. But tell me, shouldn't the CALL EAX and the other one still be patched for the dumped proggie to run?

From: http://www.woodmann.net/forum/showthread.php?s=&threadid=3315

Hello:

Unpacked the above version of HideFolders and analyzed. At raw offset 7869B there is a indirect call to ASPR code @ C4E870. Naturally, by pass this call. Now, if you run it you'll get some Page Fault in BFF7XXXX address which belongs to IsBadStringW . So, Trace... soon enough we see at 0x403784 a routine which checks some SEH addresses to see if EAX == ECX?. With ASPR EAX always equals ECX. So, JNZ never is executed. But without ASPR, EAX != ECX. But alas, ECX value is never used. So, patch JNZ at raw offset 3791 What really matters is that the value at EAX should be correct some 6FXXXX, I think.

So, no more page faults and all is well Hope this helps.

I didn't find any Access Violation at adress 0000009 errors? May be 'coz different version.

Signed,
-- FoxThree

Now that the mysterious C4E870 is a decryption routine, doesn't the above anyhow hold good? 'coz this is what happenz to my dump after pasting the "good" .text section!

Signed,
-- FoxThree


DriverStudio 2.6 & IceDump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > DriverStudio 2.6 & IceDump
PDA

View Full Version : DriverStudio 2.6 & IceDump

Risotto
06-14-2002, 10:40 PM
Howdy!

Finaly i decided to change the OS for the beter, at least i guess so. With this i've got a ltl prob: what IceDump could be applied for SIce from DriverStudio 2.6? If it can of course. I've already tried the latest releases form ver. 6.025 but there is nothing good. And BTW what's the ver of SIce in DS 2.6? By typing ver in SI, it says that it's just SoftIce from DriverStudio 2.6 and that's it.

Bye.
JMI
06-15-2002, 02:12 AM
Risotto:

After several posts here and other places about trying to get IceDump to work with D.S. 2.6, someone named "username" clued me in to something I hadn't tried in all my years of using windows. I was also looking for "version 922" of Sice for Win2K as the "correct" version to use with IceDump 6.025, but every time that I tried to use it and installed D.S. 2.6 and typed "ver" in Softice, I got "ver 336" and couldn't understand how they got from 336 to 922 in the build numbers.

What "username" enlightened me on was to go to the ntsice.sys file and select "properties" from the menu given with a right click. That was standard, been there, done that many many times. What I had never done, however, was to then click on one of the other choices in the "item list" on the "version" tab of the properties dialog. I had just stupidly assumed that the version number listed at the top, in this case "file version 4.0.1381.1" was all it showed. WRONG!. Clicking on the "Product Version" line, or any other, gives different information. In this case, clicking on the "Product Version" line showed that I had Product version "4.2.6 (Build 922)."

That stupidity confessed, I must admit I am still no closer getting IceDump to work with this build, despite the statements of the IceDump team that it is supposed to work with this build. So far, no matter what I do in selecting the IceDump from the 922 build folder and attempting to install it, it tells me I have a mismatch or incorrect version. But at least I learned something about "Version" numbering.

If anyone else could shed light on how to get IceDump to work with Build 922 on Win2K, I would be greatful to learn where I am going wrong still.

Regards.
robber804
06-16-2002, 06:13 AM
I got them working by recompiling Icedump then patching ntice. Same for getting it to work on Win2k SP3.
JMI
06-16-2002, 05:44 PM
robber804:

Could you explain more about the steps you took to get IceDump working with Softice. What did you use to recompile IceDump, what did you patch and what is the SP3 you mention. I'm only aware of a SP2 for Win2K Pro, is that for a server version or something else or just a typo?

I'm aware of patches to make to NTice to hide it from searchers, thanks to imput from +Spl/\j and Solomon, but have not seen anything on "patching" to make Icedump work, unless you are referring to putting icedump, NTice, and NTid.exe in the same folder and running NTid.exe. After I attempted to do that and substituted the new NTice for the original, Softice didn't work.

Any further information on exactly how to get it working would be appreciated.

Regards.
foxthree
06-16-2002, 07:24 PM
Hi JMI:

May be I'm totally off track, but system components check-sum is strictly verified under NT/2K. So, after patching NTICE.sys, did you re-calc. the checksum and set it correctly. Also, make sure SFP is turned off in Win2K, as it silently brings back a cached copy of system32 files from dllcache directory. This may *not* apply for NTICE.sys but still give it a try...

Signed,
-- FoxThree
JMI
06-16-2002, 08:00 PM
FoxThree:

Thanks for the suggestions. I believe I reset the checksum with LordPE, but I'll recheck that I did it correctly. It was the first time I'd used the new version when I tried it. I also tried rebuilding the NTice.sys, IceDump, and NTid.exe process in a temp file, rather than in the system32/drivers directory and perhaps that had some effect on the process.

Still adapting to the Win2K OS. Sure like it generally better than Win98se, which crashed on as average of a couple of times per day, but still having to learn different techniques for debugging and haven't had enough time to play with all the new stuff necessary to learn it very well yet.

Not sure what the SFP is or where to find it. Time for more searching.

Regards.

p.s. O.K. I now know what SFP is, although Micro$oft can't seem to decide whether to call it "System File Protection" or "Windows File Protection (WPF), and how to turn it off. If I understand it correctly, it can only bring back a copy of the file from the system32/dllcache directory (or ask for the file back) and, at least in my dllcache directory, there appears to be no copies of NTice or other Softice files. Seems more likely I screwed up the checksum rebuilding and/or need to run NTid.exe in the system32/drivers directory. Will try that next.
JMI
06-16-2002, 09:05 PM
FoxThree:

Seems when I first attempted to correct the checksum in the NTice.sys with LordPE I truely didn't understand what I was doing. That's what happens when one doesn't RTFM and assumes they know what they are doing. What it appears that I did was run NTid.exe and then LordPE. I then clicked the "?" next to checksum and then decided that it was logical to hit the "Rebuild PE" button. Duh! Wrong. All I had to do was hit the "save" button and close the file.

Now that I have Icedump with my D.S. 2.6, I wonder why I wanted it in the first place? The only things that are available currently for that version are the memory dumper and the Bhrama activator and it does not hide Softice from any of +Spl/\j's Detect program, as his patches do, so I'm wondering what it's really useful for on Win2K at this time. I was sure I read reports here of people using TRACEX on Win2K, so I'll have to re-search that issue. Either I misread those threads or misunderstood what they said.

Anyway, thanks for the suggestion. Often the most obvious, and therefore most overlooked, is the answer.

Regards.
robber804
06-16-2002, 10:25 PM
I just used NASM & the nticedump.bat (in the wnt directory) to recompile the icedump source, whenever I tried to patch NTice without doing this it would cause my computer to lockup. I'm not sure why this works but it does for me. Service pack 3 is in the RC stage right now, but is very stable, I am using Service Pack 3 Release Canidate for Windows 2000 Professional (not server). Hope this helps and hope it works for you!
Solomon
06-17-2002, 03:18 AM
NT IceDump for DriverStudio v2.6 often causes a BSOD when I type "PAGEIN D" to do a partial dump.:(


keygen masm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > keygen masm
PDA

View Full Version : keygen masm

tHE SnaKe
06-15-2002, 10:36 PM
i created my keygen with masm
please help me to include a *.mod or *.xm
file,please
_Servil_
06-15-2002, 10:54 PM
duh, anpther playing keygen ;) could I have it when done?

btw. there's a thing called resources, use borland rsrc editor or make text file something like

xxxxx.rc:

101 DATA DISCARDABLE "snd.mod"

compile with ms resource compiler and link together, probably MSRC shold be part of most MS's devkits, not too sure, but it might be so

ps anybody knows a static library for MSVC playing (embedded) mods?
TBD
06-17-2002, 10:06 AM
http://www.student.oulu.fi/~loorni/software/bme.zip
- Graphics/Sound/Input library for win32 programs in
true oldskool spirit
- Full source code for library & utilities included
- By default, supports Borland's 32bit
C compiler, LCC and MINGW

hope it helps
TBD
NervGaz
06-17-2002, 10:48 AM
xm player i found while looking around for some other stuff
hxxp://pluto.spaceports.com/~titiasm/files/xmplayer.zip haven't tried it though


InstallShield / MSI Installer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > InstallShield / MSI Installer
PDA

View Full Version : InstallShield / MSI Installer

XeNoSiS
06-15-2002, 11:08 PM
First off, if anyone can point me in the direction of a tut for MSI install serial cracking I would appriciate it.

Now for my problems:

Description: The application asks for Name, Company, and Serial. The serial is all that matters. The rest of the information can be random. Here is a sample key that is expired:
BXVW5XRRZP 203 30 1
After hitting "Next" I get the Messagebox that displays the notification of an invalid/expired serial.

Tools:
SoftIce 4.05
OS:
Windows 2000

Methods tried:
1. BPX on Messagebox's and all DlgBox's and I never got the break when the notification comes up.
2. BPX on GetWindowText and GetDlgText and I never got the break.
3. BMSG <hwnd> wm_gettext of the Edit Field for MSIEXEC and of course no break.
4. I feel like I got close with bpx lstrcmpia, but there was just to many instances and code to drudge though.

Any recommendations would be appriciated. I AM VERY MUCH A N00B, so please talk down to me. :p
hack3r2k
06-16-2002, 10:47 PM
Hi there !!!

The breakpoint it's not reached not that the api it's call but more that SoftIce don't want to..

I had same experiences with lot's of programs on win2k ... I don't know for sure what's the problem.

For ex. i had a program that i wanted to crack so i've putted a bpx on MessageBoxA, after that executed program ... no break.

Ummm...

After that i tried with w32dasm and guess what ? same location /same api the breakpoint worked ...:D

It's not the best solution but it's working...

best regards,
.:hack3r2k:.
XeNoSiS
06-17-2002, 02:43 AM
I guess that should bother me somewhat considering the amount of time I have spent on this. Actually I had someone I know generate me a valid key. So I am going to walk through the debugs on seperate machines and look for what is different between a valid key jump and a non-valid key jump. If this isn't the best way to learn that what is? :)

Wish me luck.


Problem with QuickSnooker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problem with QuickSnooker
PDA

View Full Version : Problem with QuickSnooker

dipeshrestha
06-16-2002, 10:01 AM
Dear Friends,

Posting after long time. By the way, i am entangling with the serial fishing in the game called QuickSnooker downloaded from :

http://www.quicksnooker.co.uk

When i first saw the window that will ask for the serial, i immediately open my Wdasm and search for the string "Invalid Serial". First i think they were lame programmers and the program can be cracked with a change of je to jne.

It works as i guessed and i start the program. After some time it pop out message saying that the program has been tampered with. I have never seen such protection. Please help me.

dipeshrestha
jsteed
06-17-2002, 06:31 PM
The program contains a crc check. To find out where it is located, run the program till the tamper message appears then enter SI and do "hwnd snooker" to find the handle of the dialog box. I think it is the 1st or 2nd item listed. Note the handle and then do "wmsg handle# wm_destroy". This tell SI to break when the message box is destroyed. Now go back to the program and press the OK button and SI will break. Press F12 numerous times till you get back to the main program. You are now in the crc checking routine. I'm sure you will see what to do. ;)
Cheers, jsteed


Reversing win16 applications???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Reversing win16 applications???
PDA

View Full Version : Reversing win16 applications???

BobRock
06-16-2002, 06:02 PM
Hello,

what tools (debuggers, disassemblers, etc) can be used to reverse a win16 application?
Thx.

Regards,
Bob Rock
foxthree
06-16-2002, 07:28 PM
Hi there:

16-bit windows applications come in what is called as NE-file format... a format that is not particularly appealing.. if you know what I mean ;) However, I think W32DAsm can handle NE Files. I remember working with it a long time back. For Debugging, what better than SoftICE for Win3.x! Take a look at exetools.com/debuggers.

Signed,
-- FoxThree
cah
06-20-2002, 05:39 AM
How to find free space & lengthen the code segment of NE file format? Any tools/utilities/knowledge available on this subject.

Thanks in advance
Cah....
Kayaker
06-20-2002, 06:52 AM
Hi Cah,

Interesting problem. It'd be best to study the NE file structure and figure out how to add a new segment, or increase the length of the last one. There are NE docs at wotsit.org, d/l them all there and examine them.

Taking a look at the New EXE ("NE") Header file NEWEXE.H, I'd be playing with the values in certain fields you can find as offsets to the ascii "NE" (same as in a PE file), such as:

NE + 1Ch - Specifies the number of entries in the segment table.

NE + 22h - Specifies a relative offset from the beginning of the Windows header to the beginning of the segment table.

Then I'd try to figure out how to add a new segment to the segment table, or maybe easier, lengthen the last segment.

;-----------------------------------------------
struct new_seg /* New .EXE segment table entry */
{
unsigned short ns_sector; /* File sector of start of segment */
unsigned short ns_cbseg; /* Number of bytes in file */
unsigned short ns_flags; /* Attribute flags */
unsigned short ns_minalloc; /* Minimum allocation in bytes */
;-----------------------------------------------

Segment Table
ßßßßßßßßßßßßß
The segment table contains information that describes each segment in an
executable file. This information includes the segment length, segment type,
and segment-relocation data. The following list summarizes the values found
in the segment table (the locations are relative to the beginning of each
entry):

Location ³ Description
ÍÍÍÍÍÍÍÍÍØÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍÍ
00h ³ Specifies the offset, in sectors, to the segment data (relative
³ to the beginning of the file). A value of zero means no data
³ exists.

02h ³ Specifies the length, in bytes, of the segment, in the file. A
³ value of zero indicates that the segment length is 64K, unless
³ the selector offset is also zero.

04h ³ Specifies flags that describe the contents of the executable
³ file. This value can be one or more of the following:

06h ³ Specifies the minimum allocation size of the segment, in bytes.
³ A value of zero indicates that the minimum allocation size is
³ 64K.
;---------------------------------------------------------------

There may other things you'd have to change also and I don't know how well this would work, but it seems to be the starting idea. Your 16 bit app will probably crash and burn the first few times, but it'd be interesting to hear a report of your attempts.

Cheers,
Kayaker
cah
06-22-2002, 05:19 AM
thanks for your reply. I will play & dig more about this NE code segment lengthening.

Cah...


How to map dead listing offsets to sice addresses???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to map dead listing offsets to sice addresses???
PDA

View Full Version : How to map dead listing offsets to sice addresses???

yaa
06-16-2002, 08:34 PM
Hello all,

working on the same target application with sice and w32dasm how is the mapping between w32dasm's disassembled code offsets and softice's instruction addresses done??? I know this must be a really idiot question but I'm just starting out and haven't been able to find a tutorial that uses both of tools explaining how to jump from one to the other.

Yet_Another_Apprentice

----

Do or do not. There is no try.
- Yoda -
NervGaz
06-16-2002, 09:38 PM
as far as i know they should be pretty much the same unless it relocates and that should only happen with .dll's
remi
06-23-2002, 03:19 PM
Perhaps what happends is that the file is packed. Anyway, if it is a dll and it is been relocated you can use ida instead of w32dasm. In the load options select "manual load" and it is going to ask you the image base of the file. So you only have to enter the correct one and select the sections of the file you want to load. It's quite simple. But first look that the file isn't packed or that the code you are watching in the sice is in the same module you are dissasembling.


Solomon's trick
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Solomon's trick
PDA

View Full Version : Solomon's trick

Risotto
06-16-2002, 10:32 PM
Hello!

While readind some posts, i came across Solomon's trick - it prevents registers' clearing by putting break point on NTContinue. Actually i didn't understand what it's done for. Can someone explain me?

Thanks.
Solomon
06-17-2002, 02:16 AM
Hello,

NTContinue is used by the kernel of WinNT/2K/XP to process SEHs. If the SEH handler of appz(especially packers/protectors) returns EXCEPTION_CONTINUE_EXECUTION, it will be called. ASProtect uses many SEHs(about 30) to do anti-tracing trick.

NTContinue can not prevent debug registers from being cleared.:D It's just a quick way to bypass anti-tracing tricks implemented with SEH.
Dr.Golova
06-17-2002, 05:29 AM
Hello,

NTContinue can not prevent debug registers from being cleared.:D It's just a quick way to bypass anti-tracing tricks implemented with SEH.

Yeah, NtContinue used for context switchin, it's recive one parameter - context pointer. And you can protect debug registers ;) Create patch (e.g. in sofice) in start of NtContinue (use jump to some free place e.g. in dll header) add this code here:

mov eax, [esp+4]
btr byte ptr [eax], 04
mov eax, original_proc_n ; get it from original code
jmp back_to_ntcontinue

Wow, now protector can't clear drx registers by SEH coz here is no CONTEXT_DEBUG_REGISTERS in CONTEXT.Flags structure.

PS. Suxx, tomorrow a make mistake in this code (forget add byte ptr [] to btr command). Sorry.
Risotto
06-17-2002, 11:20 PM
Yep, it's clear now, thanks.
To Dr.Golova: ìîãáû ïî-ðóñ., ÿ áû ïîíÿë:))
Risotto
06-17-2002, 11:32 PM
G'day,

And one more question: with the help of what API can SEH intructions be sniffed out just to fasten the search and not to do it manually? And what technic does SuperBMP apply?

Agur.


Has anyone got Stone's many source code samples???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Has anyone got Stone's many source code samples???
PDA

View Full Version : Has anyone got Stone's many source code samples???

BobRock
06-16-2002, 11:04 PM
Hello,

I have visited Stone's old site (h**p://http://www.users.one.se/~stone) and have seen that all the links to the source code samples are broken. Has anyone got all those samples somewhere? Thx.

Regards,
Bob Rock
JMI
06-17-2002, 12:01 AM
BobRock:

Did you try searching before you posted your request? It appears that the entire Stone's Webnotes is available on the Krobar site. it is a 1.27 mg download and appears to have the sources you are looking for.

Regards.
BobRock
06-17-2002, 07:25 PM
Sorry JMI. No, I did not look around simply because I did not expect anyone to have a published ZIP of Stone's entire site.
Sorry again.

Regards,
Bob Rock


issues with export symbols 016f 0167
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > issues with export symbols 016f 0167
PDA

View Full Version : issues with export symbols 016f 0167

uiop8000
06-17-2002, 04:10 AM
hi all,

please help! my export symbols appear to based at a
different address from the code executing them.
let me explain.

my app loads up and i break in on the first instruction.
I have the following message:

WINICE load32 obj=007 add=16f:40001000 Mod = VCL50

which is the module VCL50.BPL I have loaded exports for.

exp vcl50! shows

016f:4000a314 @System@Initialization$qqrv
016f...........................

cs = 0167
ds/ss/es = 016f

map32 appname shows all sections loaded at offsets from 016F

now, most of the time the export symbols resolve and I can
see the names in the code listing. but sometimes I can only see
the names of the symbols when they are being accessed through
ds. So the all the CALL commands don't have symbol names.
but after a couple of steps into the app the code window refreshes and the CALL commands suddenly end up with symbol names instead of numbers.
(it depends how I break into the start of the app as to whether the above happens, eg: LordPE, or on api call etc.)

More frustrating than that, is that I can't bpx on the symbol name.
A Breakpoint on @System@Initialization$qqrv for example
places a breakpoint at 016f:4000a314, while the call goes
to 0167:4000a314 and my breakpoint isn't hit.
I can get around it with

bpx 0167:dword(&vcl50!@System@Initialization$qqrv)

but i would like to know what is happening. I read something
in the softice user guide p130 about when a .DLL is mapped into two processes at different base virual addresses, the export table uses the base address of the first process to open the .DLL. But I don't think anything else is using the DLL.

background:
the app was unpacked with aspackdie
driverstudio 2.6 on windows 98

any help would be very much appreciated
kind regards
oyang2002
06-17-2002, 03:06 PM
I have the same problem.Maybe the mangled name
is too long?!

Sometimes I use this trick I wish it can help you.
In IDA pro,display the demangled name as name
(the default is coment) and create a NMS file using
a plugin,then you can load it into softice,now set
a breakpoint like this:

:bpmb functionname x

It can work most of time.

Goog luck!
uiop8000
06-18-2002, 09:33 AM
i've haven't heard of that, what plugin is that?
foxthree
06-18-2002, 11:44 AM
It is the IDA2SICE Plugin written by Mostek. Look in tsehp.cjb.net/what_new

Signed,
-- FoxThree
uiop8000
06-21-2002, 06:38 AM
thanks for the link foxthree

bpmb functionname x does the trick oyang2002! still would like to know why this happens and how you can get the export symbols working with the other selector
oyang2002
06-21-2002, 03:10 PM
I don't know why it can work either,I just found it.:(

Most of the time I use bpmb instead of bpx because
the prior use debug register which is some stronger
than int 3. In Win9x the break point set by debug
register can be cleared using the trick of entering
ring 0,I don't know how to do that in NT/2000/XP,
I am a newbie;-)

Sometimes the trick of "bpmb functionname x" can't
work! Again I don't know why:( But if that occur
I could use another trick,I export a symbol where
I want to set break point and export it using SoftIce.
You can found the tool from the thread "Export
any functions from a Dll" in "Tools of Our Trade"
which was posted by me some time ago.

By the way,
there is somthing else to say if you want to use
that tool to export a function(that is why I wrote it;)

1.You must set the working directory to be the
original location where the Dll reside,some Dll
can't be loaded if they were copied into a separate
location.

2.Always export them using ordinal.Ofen they can't
be exported by name.

Here is some snippet:

SetCurrentDirectory("C:\\Progarm Files\\Dummy");
hInstance=LoadLibrary("C:\\Progarm Files\\Dummy\\Object.dll");
FARPROC test=GetProcAddress(hInstance,MAKEINTRESOURCE
(0x1));

Now you can call it use asm code or C code if you know
exactly the prototype of that function.

Let us say it is a function with void test(int),
We can call it by ASM like this:

_asm
{
push 0x5
call test
}

Attention to use the same call convention to keep the stack
balance,you can found that use SoftIce.

We can call it this way too:

int i=5;
test(i);

Good Luck!
uiop8000
06-24-2002, 10:47 AM
very interesting oyang very interesting


Code Injection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Code Injection
PDA

View Full Version : Code Injection

Hoof Arted
06-17-2002, 05:00 PM
Hi, I am trying to get to grips with injecting code / functions into an application and I have a few questions for those who know...

The code below is basically the same executable but the first lot of code does not have the MessageBoxA function at 00401070, in the second

disassembly. Now with the scene set, Please go below for my questions.

00401000 >/$ 6A 00 PUSH 0 ; /pModule = NULL
00401002 |. E8 85000000 CALL <JMP.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 80304000 MOV DWORD PTR DS:[403080],EAX
0040100C |. E8 93000000 CALL <JMP.&COMCTL32.#17> ; [InitCommonControls
00401011 |. 6A 00 PUSH 0 ; /lParam = NULL
00401013 |. 68 2E104000 PUSH testreme.0040102E ; |DlgProc = testreme.0040102E
00401018 |. 6A 00 PUSH 0 ; |hOwner = NULL
0040101A |. 6A 65 PUSH 65 ; |pTemplate = 65
0040101C |. FF35 80304000 PUSH DWORD PTR DS:[403080] ; |hInst = NULL
00401022 |. E8 6B000000 CALL <JMP.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401027 |. 6A 00 PUSH 0 ; /ExitCode = 0
00401029 |. E8 58000000 CALL <JMP.&KERNEL32.ExitProcess> ; \ExitProcess
0040102E |. 55 PUSH EBP
0040102F |. 8BEC MOV EBP,ESP
00401031 |. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
00401034 |. 3D 10010000 CMP EAX,110
00401039 |. 75 02 JNZ SHORT testreme.0040103D
0040103B |. EB 40 JMP SHORT testreme.0040107D
0040103D |> 3D 11010000 CMP EAX,111
00401042 |. 75 1F JNZ SHORT testreme.00401063
00401044 |. 817D 10 EA0300>CMP DWORD PTR SS:[EBP+10],3EA
0040104B |. 75 30 JNZ SHORT testreme.0040107D
0040104D |. 6A 20 PUSH 20 ; /Count = 20 (32.)
0040104F |. 68 00304000 PUSH testreme.00403000 ; |Buffer = testreme.00403000
00401054 |. 68 E9030000 PUSH 3E9 ; |ControlID = 3E9 (1001.)
00401059 |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
0040105C |. E8 3D000000 CALL <JMP.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
00401061 |. EB 1A JMP SHORT testreme.0040107D
00401063 |> 83F8 10 CMP EAX,10
00401066 |. 75 0C JNZ SHORT testreme.00401074
00401068 |. 6A 00 PUSH 0 ; /Result = 0
0040106A |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
0040106D |. E8 26000000 CALL <JMP.&USER32.EndDialog> ; \EndDialog
00401072 |. EB 09 JMP SHORT testreme.0040107D
00401074 |> B8 00000000 MOV EAX,0
00401079 |. C9 LEAVE
0040107A |. C2 1000 RETN 10
0040107D |> B8 01000000 MOV EAX,1
00401082 |. C9 LEAVE
00401083 \. C2 1000 RETN 10
00401086 $-FF25 08204000 JMP DWORD PTR DS:[<&KERNEL32.ExitProcess>; KERNEL32.ExitProcess
0040108C $-FF25 0C204000 JMP DWORD PTR DS:[<&KERNEL32.GetModuleHa>; KERNEL32.GetModuleHandleA
00401092 $-FF25 18204000 JMP DWORD PTR DS:[<&USER32.DialogBoxPara>; USER32.DialogBoxParamA
00401098 $-FF25 1C204000 JMP DWORD PTR DS:[<&USER32.EndDialog>] ; USER32.EndDialog
0040109E $-FF25 14204000 JMP DWORD PTR DS:[<&USER32.GetDlgItemTex>; USER32.GetDlgItemTextA
004010A4 $-FF25 00204000 JMP DWORD PTR DS:[<&COMCTL32.#17>] ; COMCTL32.InitCommonControls
004010AA 00 DB 00
004010AB 00 DB 00
004010AC 00 DB 00

00401000 >/$ 6A 00 PUSH 0 ; /pModule = NULL
00401002 |. E8 99000000 CALL <JMP.&KERNEL32.GetModuleHandleA> ; \GetModuleHandleA
00401007 |. A3 80304000 MOV DWORD PTR DS:[403080],EAX
0040100C |. E8 AD000000 CALL <JMP.&COMCTL32.#17> ; [InitCommonControls
00401011 |. 6A 00 PUSH 0 ; /lParam = NULL
00401013 |. 68 2E104000 PUSH testreme.0040102E ; |DlgProc = testreme.0040102E
00401018 |. 6A 00 PUSH 0 ; |hOwner = NULL
0040101A |. 6A 65 PUSH 65 ; |pTemplate = 65
0040101C |. FF35 80304000 PUSH DWORD PTR DS:[403080] ; |hInst = NULL
00401022 |. E8 7F000000 CALL <JMP.&USER32.DialogBoxParamA> ; \DialogBoxParamA
00401027 |. 6A 00 PUSH 0 ; /ExitCode = 0
00401029 |. E8 6C000000 CALL <JMP.&KERNEL32.ExitProcess> ; \ExitProcess
0040102E |. 55 PUSH EBP
0040102F |. 8BEC MOV EBP,ESP
00401031 |. 8B45 0C MOV EAX,DWORD PTR SS:[EBP+C]
00401034 |. 3D 10010000 CMP EAX,110
00401039 |. 75 02 JNZ SHORT testreme.0040103D
0040103B |. EB 54 JMP SHORT testreme.00401091
0040103D |> 3D 11010000 CMP EAX,111
00401042 |. 75 33 JNZ SHORT testreme.00401077
00401044 |. 817D 10 EA0300>CMP DWORD PTR SS:[EBP+10],3EA
0040104B |. 75 44 JNZ SHORT testreme.00401091
0040104D |. 6A 20 PUSH 20 ; /Count = 20 (32.)
0040104F |. 68 00304000 PUSH testreme.00403000 ; |Buffer = testreme.00403000
00401054 |. 68 E9030000 PUSH 3E9 ; |ControlID = 3E9 (1001.)
00401059 |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
0040105C |. E8 51000000 CALL <JMP.&USER32.GetDlgItemTextA> ; \GetDlgItemTextA
00401061 |. 6A 00 PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
00401063 |. 68 00304000 PUSH testreme.00403000 ; |Title = ""
00401068 |. 68 00304000 PUSH testreme.00403000 ; |Text = ""
0040106D |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hOwner
00401070 |. E8 43000000 CALL <JMP.&USER32.MessageBoxA> ; \MessageBoxA
00401075 |. EB 1A JMP SHORT testreme.00401091
00401077 |> 83F8 10 CMP EAX,10
0040107A |. 75 0C JNZ SHORT testreme.00401088
0040107C |. 6A 00 PUSH 0 ; /Result = 0
0040107E |. FF75 08 PUSH DWORD PTR SS:[EBP+8] ; |hWnd
00401081 |. E8 26000000 CALL <JMP.&USER32.EndDialog> ; \EndDialog
00401086 |. EB 09 JMP SHORT testreme.00401091
00401088 |> B8 00000000 MOV EAX,0
0040108D |. C9 LEAVE
0040108E |. C2 1000 RETN 10
00401091 |> B8 01000000 MOV EAX,1
00401096 |. C9 LEAVE
00401097 \. C2 1000 RETN 10
0040109A $-FF25 08204000 JMP DWORD PTR DS:[<&KERNEL32.ExitProcess>; KERNEL32.ExitProcess
004010A0 $-FF25 0C204000 JMP DWORD PTR DS:[<&KERNEL32.GetModuleHa>; KERNEL32.GetModuleHandleA
004010A6 $-FF25 18204000 JMP DWORD PTR DS:[<&USER32.DialogBoxPara>; USER32.DialogBoxParamA
004010AC $-FF25 1C204000 JMP DWORD PTR DS:[<&USER32.EndDialog>] ; USER32.EndDialog
004010B2 $-FF25 20204000 JMP DWORD PTR DS:[<&USER32.GetDlgItemTex>; USER32.GetDlgItemTextA
004010B8 $-FF25 14204000 JMP DWORD PTR DS:[<&USER32.MessageBoxA>] ; USER32.MessageBoxA
004010BE $-FF25 00204000 JMP DWORD PTR DS:[<&COMCTL32.#17>] ; COMCTL32.InitCommonControls
004010C4 00 DB 00

1) If I add the USER32.dll.MessageBoxA import with LordPE, it does not appear in the list as shown above ? i.e."004010B8 $-FF25 14204000 JMP

DWORD PTR DS:[<&USER32.MessageBoxA>] ; USER32.MessageBoxA" Can I still make calls to this or do I need to somehow make this jump available? If

so, how do I make this jump available like the others?

2) Is it possible to move the code down and insert the code directly into the step by step execution of the code or do I need to jump to

another location and execute my code before I continue with the origional code?

3) If I want to enter my code after the location 004010C4, I can do this but when I try making my jump to the code, it requires more bytes than

for a short jump? How is this overcome?

4) If I need to jump to another location, as described, and the JMP instruction takes more bytes than available, I would presume that I must

recreate the instructions that have been overwritten to perform the jump? Is there any way around this?

5) Is it possible to move the "0040109A $-FF25 08204000 JMP DWORD PTR DS:[<&KERNEL32.ExitProcess>; KERNEL32.ExitProcess" line and all the

others down so that I can continue coding in the SHORT code area ?

I am just trying to establish a few rules about what can and cannot be done with regards to injecting code. Has anyone written a tutorial,

based on the generics of code injection?

Thanks

Hoof
_Servil_
06-17-2002, 07:15 PM
hi hoof,
im sorry for OT question, but, how didya enjoy the (RE)tirement? :D :D
nikolatesla20
06-17-2002, 08:37 PM
As a self-proclaimed code injection "experienced one" of sorts, I can answer at least a few of your questions.

Answers:

#1. The jump does not show up in the normal jump table because that jump table is already coded in the binary executable. When you use LordPE to add an import, it simply tells you how to code the jump. In other words, what address you need to jump to to make the API call. This is actually the address of the first thunk of the API import from the import table, which LordPE modifies. As a side note, if you use Code Snippet Creator for code injection, it actually will make this jump call for you, it inserts it right after your own code that you write in the CSC editor. Otherwise it is up to you to code the "jump" yourself.

#2. It's usually best to redirect the execution to another area, where your own code resides, and then come back to the original code from there. This gives you plenty of room to put your own code, even in a new section if you want.

#3. This is always the problem with trying to "jump" to your code. It is very rare your code will be within range. You need to rethink it :) Instead of jumping the best way to do it is with a PUSH <address of my code> and then a RET. This will get you anywhere you want to be, and it works just like a jump. I think it is about 10 instructions or so. 68 <address - 8bytes > C3.
You can use the same technique to come back to the original code.

#4. Remember, you do not want to JMP. In my opinion, you are ALWAYS better off with a PUSH, RET. It is more flexible, and it is very rare that your new code will be within range of a short jump anyway. If the PUSH RET combo takes too many bytes, then you simply need to find a better more logical place to insert it into the "chain" of instructions, for example, do not put it in the jump table! However, if you feel you must, and you want to edit the jump table, you could always change the jmp [dword ptr] to go to your own "API" which then does something, and then goes to the real API call afterward. Don't forget to return to the original code as well tho !

#5. Whatever you do, DO NOT move those lines. They are referenced from the actual code. The import table exists in memory, and the jump table jumps to it. The code CALLS the JUMP TABLE, not the imports directly. If you move anything in the jump table you are screwed.

As far as tuts, I can't think of any right now off the top of my head.

-nt20
Hoof Arted
06-17-2002, 10:10 PM
This is the stuff I like to read. Good honest answers to some quite stupid questions.

Anyway.... Thanks for the input I will be looking into the things you have said... and hopefully, I or someone else could write a GENERAL tutorial on what you can and cannot do with Code Injection.

As far as retirement goes, you all know what it is like..... :D :D :D

I just cannot stay away..... One day when I have no money and all hell breaks loose, I will need to give up RCE cause they will repo my PC & Laptop :)

Hoof
JMI
06-17-2002, 10:41 PM
Hoof:

Took a quick glance at Kobar's site and he has three tuts on code injection, although two describe themselves as "code insertion." They are by Harlequin, MaV3Rick, and BlackB, so they have the potential of very useful information for your quest. I seem to recall that the Harlequin tut is on the Fravia site, but didn't check.

Google mught be a good choice also. A quick entry of "code injection" got a reference to Lord Rhesus' "Pages of Code Injection", along with 330,999 other entries to check through for ones of interest.

Regards.
CoDe_InSiDe
06-18-2002, 06:15 AM
Hi Hoof Arted,

I just want to add this little page, maybe it comes in handy ;)

codeinjection.cjb.etc...

Cya...

CoDe_InSiDe

*edited* i think i shouldn't post early anymore, because i see now that JMI already spoken about this page :D
argh.... ah well...
JMI
06-18-2002, 06:35 AM
Don't be discouraged CoDe_InSiDe. There are still 330,999 more files that I didn't mention by name. :D :D Besides, you were trying to help, and that's what counts.

Regards.


Hmemcpy with SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hmemcpy with SoftICE
PDA

View Full Version : Hmemcpy with SoftICE

Overflow
06-17-2002, 10:44 PM
Hi!

I use SoftICE with Win XP and it works pretty good. Well... almost: I can set a Breakpoint on every API function, but if I try to set a BPX on Hmemcpy, SoftICE says: "Symbol not defined".
What's my mistake?

Please help me!!!

Overflow
JMI
06-17-2002, 11:09 PM
Overflow:

Your mistake is that you didn't read the posting guidelines which are highlighted on the first page of the forum. It states "Please read the Posting Guidelines before posting." Had you done so, you would have known to use the "search" button and entered questions such as "Hmemcpy" and, perhaps "Hmemcpy + Softice" and you would have easily found your answer.

Hmemcpy was a workaround which the M$ programmers placed on top of DOS when they started writing Win 3.whatever. It is not a valid API and was never a part of Win NT, which is the basis for the development of Win2K and WinXP. Therefore, Hmemcpy does not exist in WinXP and you can't get Softice to break on something which doesn't exist. With WinXP you have to use API's to break on when fishing for a serial or such.

Please learn how to help yourself before you ask someone else to do your work for you. If you show your effort and where you are stuck, you will find lots of help here.

Now try it with "the other foot" and see if you can get off to a better start. Go back and read the Posting Guidelines and you'll know what to do next time you have a question.

Regards.
Risotto
06-17-2002, 11:15 PM
THERE IS NO HMEMCPY IN WIN2K/XP
Try smth else


Cryptic Formula Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Cryptic Formula Help
PDA

View Full Version : Cryptic Formula Help

Opti
06-18-2002, 01:15 AM
Hi All,

I Was Hoping To Get Some Help Understanding This Formula More

x = a ^ b MOD c

Whereas :-

a = Variable
b = Variable
c = Constant
x = Constant

All Integers (Of Course)

After Further Analysis I Found

a = Product Of 2 Primes
b = Product Of 2 Primes
c = NOT A Product Of 2 Primes

So

x = p1*p2 ^ p3*p4 MOD c

So I Gather From This, The Method Is Not RSA Encryption As c Cannot Be
Broken Into 2 Primes. I Have Searched Around The Net For Information
But Im At A Loss To Understand It More, I Was Hoping Someone Here
Maybe Knows The Method So I Could Search For Some Info / Source On
The Web Or Could Explain How To Calculate a & b Or Maybe If Possible
To Change Sides Of The Equation

With My Basic Algebra Skills I Can See

a ^ b Must Be x Plus A Multiple Of c

Any Help Would Be Great :)

On My Travels Looking For Information I Found An Interesting Site About
Number Theory And RSA with Examples For MathLab, Hope The Link Helps
Someone Else

h**p://w*w.ma.umist.ac.uk/rb/teaching/117/
mike
06-18-2002, 03:20 PM
Do you mean c is a prime?

It doesn't look like somethiing I've seen before. The two systems I know of that use prime moduli are ElGamal and Diffie-Hellman. You may want to look into those.

In the meantime, how is this system used? what's secret? what are you trying to predict?
mike
06-18-2002, 06:17 PM
If you want to calculate b given a and x, that's discrete log and is hard unless phi(c) is smooth. If you want to calculate a given b and x, that's taking roots and is easy if c is a prime or if you know the factorization of c. Assuming c is a product of large primes, the problem is difficult.

BUT if you just need to find any a,b such that a^b mod c = x, you're in luck. Just pick a=x^-b = inv(x)^b where inv(x) is the inverse of x mod c. Pick anything you want for b.

Are there any other constraints on a? Like it has to be all ascii or something?
Opti
06-18-2002, 08:44 PM
Oh Man I Feel A Fool Now!!

I Was Using A Tool For Factoring And Seems There Is A
Problem With Its Hex To Decimal Conversion And Was Giving Me
False Results

I Entered (c) Again As A Decimal Number And Like U Mentioned
Above (c) Is In Fact A PRIME And (a) & (b) Are Not Products
Of Primes, God Iv Been Scratching My Head On This For
2 Days :(( Now It Seems To Fit The Pattern Of ElGamal With (c)
being a Prime

The Only Constraints I See At The Moment Are (a) & (b) Are 48 Bits

What U Say Above Confuses Me Somewhat As I've Only Really Looked Into
Number Theory In The Last 2 Days When I Came Across This Problem

Think Im Gonna Read Up Some More On ElGamal And How Its Implemented
In This Occasion And Work Out What Values I Have Now From That Method
And How To Reverse It In Code

Opti
mike
06-18-2002, 10:50 PM
OK, c is prime. That can be good or bad, depending on how we attack it.

Good news is that taking roots (like square root) is easy mod a prime. So if you have b,x,c, finding a is easy.

Bad news is that discrete log is hard unless phi(c) is smooth. Since c is prime, phi(c)=c-1. If c-1 has lots of small factors, then you can do it, but it probably won't. So if you have a,x,c, finding b is hard.

Either way, you still haven't said what constraints there are on a,b. Can you put in whatever values you want? If so, then it's easy to find a,b such that a^b=x mod c. Just choose any nonzero value for b and calculate a=inv(x)^b mod c.
Opti
06-19-2002, 02:40 AM
(a) & (b) Are Positive Integer Values No Longer Than 48Bits And (b)
Cant Be 1 For Obvious Reasons, But I Do Need To Examines This Section
Of The Code More And I Know Its Upto 1 or 2 Things Before The ExpMod
Function, But Yes They Can Be Pretty Much Any Value

Yeah c-1 Has Only 2 Factors So I Take It That Discrete Log Method
Is Out Of The Window

The Other 2 Methods U Mention Do Sound As Though They Would Work
In This Instance

Is It Possible U Could Explain Them A Little Bit More Or Paste An
Example, I Will Look On The Web Also, I Do Understand Square Root,
Would I Have To Repeat This In A Loop ?

The Other Method Does Seem Alot Clearer To Me The Only Thing I Have
Trouble With Is The inv(x) Bit, I Tried To Figure It Out In Mathematica
But I Dont Understand How U Inverse (x) , I Thought x^-1 Was The Inverse, I Guess Id Better Read Some More On Basic Number Theory
And How All This Stuff Fits Together

Thanx For The Info So Far
mike
06-19-2002, 04:34 PM
(a) & (b) Are Positive Integer Values No Longer Than 48Bits And (b) Cant Be 1 For Obvious ReasonsSorry, they're not obvious to me. I can't recall any reason why you can't pick any value you want for b. By the way, how long is c?
Trouble With Is The inv(x) Bit, I Tried To Figure It Out In Mathematica But I Dont Understand How U Inverse (x) , I Thought x^-1 Was The Inverseinv(x) is x^-1, but you have to do it modulo c, so in Mathematica you'd use

PowerMod[x, -1, c]

Square root is also built in to Mathematica. Just say

SqrtMod[a, c]

Only half of the numbers have square roots mod c; these are called quadratic residues. You can tell if a number is a QR mod c by checking if a^((c-1)/2)==1. If it's 1, it's a QR; if it's c-1, it's not, so it doesn't have a square root mod c.

I'm fairly sure one can extend this to higher roots, but I don't have algorithms on hand.
Opti
06-19-2002, 09:58 PM
Well c Uses 6 Bytes So 48 Bits, Infact a b c x All Use A Max Of 48 Bits
Im Pretty Sure b Cant Be 1 As That Would Be Easy To Solve As You Would Only Have To Make

a = c+x Raising That To A Power Of 1 And MOD c Would Return x

I Have Found A Couple Of Nice Pages I Need To Study More

h**p://sicp.ai.mit.edu/Fall-1999/psets/ps2web/ps2-public/ps2-public.html
h**p://w*w.farcaster.com/papers/crypto-field/field.html

Covering Elgamal And Discrete Logarithms And I Noticed MIRACL Contains 2 Sources
For Solving Discrete Log For Small Primes So That Should Be Useful

Im Thinking Now If I Gather More Variables And The Algo Is Truely Elgamal
I *Might* Be Able To Produce The Secret Key (x) Then With The Info From Above
Make a And b To Fit That And Totally Reverse It

Anyways All Interesting Stuff
mike
06-19-2002, 11:28 PM
Well c Uses 6 Bytes So 48 BitsHahaha! (Tears roling down cheeks)

If they're ALL 48 bits, then the programmer had no idea what he was doing. At 48 bits your pc could crack it in a few seconds even if the rest of it was designed well. I bet he had so little idea what was going on that if you choose a=x, b=1 then it will work.


unpacking protected cab files??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking protected cab files??
PDA

View Full Version : unpacking protected cab files??

sadsack
06-18-2002, 02:52 AM
hi guyz,

does anyone know of a prog that will unpack protected cab files,

i have tried various progs such as winace, winzip, winrar, cabinet manager, but all to no avail, all of the programs say that they are of an unknown format, i would just like to know if its actually possible to unpack one of these cabs,

its from the second disk of ms train sim,

any clues would be great..
Acid_Cool_178
06-18-2002, 05:19 AM
Hi!

Have you ever tried WinRAR ??

WinZip might also help ya..

but check out www.rarsoft.com and pherhaps that will help ya...

Acid
sadsack
06-18-2002, 06:35 PM
hhmmmmm,

tell me if im wrong, but didnt i already say ive tried em, or have u got a braille keyboard....

only joe king m8,

i need to know if its poss to reverse safedisc alt from a cd, cos me thinks thats why the cabs wont unpak....


Asprotect 1.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect 1.2
PDA

View Full Version : Asprotect 1.2

SilSaLaMaTa
06-18-2002, 10:22 AM
hi
I tried to unpack Commview 3.1 (build 161) , I read the splaj tut on unpacking cv .
I'm using winxp pro . I found the OEP st 5b28a8. started rv and click on "Fetch IAT" . IT RVA = 1C9258 and len = 968 .
IAT resolver and then Resolve again . there were 10 unresolved modules . I choose one by one , right click on them and
choosed "Asprotect 1.2x emul" . then I press resolve again . after resolving threre were 3 unresolved .
at 5B1FAC : in sice -> U 5b1fac -> ...-> SizeOfResource
at 5B202C : in sice -> U 5b202c -> push ebp , .... -> a cmp and then a jump and ret
at 5B2060 : same as 5B202C .
so I tried Api Emulator . when I click on that RV stops responding and I have to close revirgin (and restart my comp :p) .
I entred GetVersion for 5B202C and FreeResource for the next . then resolved again . I entred
IT rva = 230000 (my dumped file size = 2293760 and
last section = 22f000 , size = 1000) . then I clicked on generate and saved it.bin . in lord pe , add a section with .test
and load it.bin from the disk . then entry point to 1B28a8 and Import Table RVA = 230000 (size = 34EE) . then rebuild PE
with Validate PE only . I fixed the Size check in the file . I didn't find CRC checkin as splaj said .
when I tried to run cv , I get "Not Enough memory to run the program ...." .
Size of image is 234000 and file size = 2334EE . so what is the problem ?
(sorry for my english !)
Solomon
06-18-2002, 10:40 AM
why don't try the latest v3.3 build 205? There are several threads about this version. Please search.:)
SilSaLaMaTa
06-18-2002, 11:55 AM
hi
I will try that later . Now I started to crack this . I also have this problem on Essential Net tools 3.0.86 .


HaspServicesSpy Program Release !!! :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HaspServicesSpy Program Release !!! :)
PDA

View Full Version : HaspServicesSpy Program Release !!! :)

hack3r2k
06-18-2002, 12:18 PM
HaspServicesSpy © 2002, .:hack3r2k:.

Description:

HaspServicesSpy is routine included in HaspDongle.dll shipped along with this
document, and its target is to spy services called by the main program with the
help of haspreg().

To use this function you have to add to the target exe/dll a new import (HaspDongle.HaspServicesSpy). You need also to add to the PE file a new
section (with attributes 60000020) that will contain a call to spy procedure
from the dll.

Ex: call dword ptr [HaspDongle!HaspServicesSpy]
ret

Attention !!!

HaspDongle!HaspServicesSpy represents a 32bit number that corresponds to the address of the import)

In the end you must locate haspreg() call and divert it to our new section that calls the spy routine.

If you followed the steps above after the execution of the hasp protected program a window will popup eachtime when the program tries to execute a hasp service (full support for all kind of hasps).

Report any bugs at : danielciocarlan@hotmail.com

Questions/Help : danielciocarlan@hotmail.com

Features:

- full dump for all regs used by hasp
- the ability to display the type of the dongle and the name of the service called
- all the information is displayed in a window
- the tracing of the calls is now made in minutes without the need of any debugger/disassembler
- can be also used by hasp newbies that often have problems with tracing/hasp type/..(LOL ! I had the same problems some time ago)
- minimum memory requirements
- small size/very fast (is written in 32bit assembly)

To be done:

- regs editing/saving ;will be a very useful feature

F.A.Q :

Q: .:hack3r2k:. how the fuck can I find that damn haspreg() call.
A : Easy ! Disassemble the program (IDA/W32DASM) locate the hasp mark (cmp bh, 32h) and under this look for something similar to push ebp/call 00XXXXXX/pop ebp, call XX000000 represent the call to hasp regs and u must divert it to our new section created in order to be able to call spy routine.

Q: What about all the modif to the PE ??!
A: Use LordPE – RoyalTS (try to get it from www.exetools.com or http://y0da.cjb.net)

Greets fly out to:

CrackZ (thanx for telling me hasp reversing secrets), HypnoticZ/TNT (thanx to you too), goatass (help with reversing)
hack3r2k
06-18-2002, 10:16 PM
Hey there hasp reversers !

Any opinions about program ??? (like : it sux, wow cool !, etc.)

You can also post here question and bugs.

AND YES !!! In the non-beta version i will include an installer ...

best regards,
.:hack3r2k:.:o
goatass
06-19-2002, 01:08 AM
Just a suggestion, but in order to use the tool you have to add an import and add a section to your target. That will not work when you reverse applications. The less you mess with them the better. You need to create some kind of driver, application wide hook, or a loader that attaches to the process and monitors it's activity. A tool of this kind should be standalone and portable. Something like FrogsIce, you start it and it does it's job, you don't have to modify the target for it to work, it just does. Follow me?

good work tho....keep it up.

goatass
cyberheg
06-19-2002, 07:31 PM
I don't want to use the word "it sucks" like you suggested yourself but maybe one rather near by.

My reasons for this is the following:

I see the program highly useless because you need to implement some code yourself to make it work. If people are able to do the needed work and able to find the haspreg() function themselves the last problem is just to set a breakpoint and follow which services are sent.

Like Goatass wrote it would be much better to make a generic solution. Another idea could be to do the job you want the user to make themselves. Simply add another section to the file, remap the imports and add your own and then do a search and replace patch and do the needed patching (after all if the user can find the "hasp mark" what stops you from making a generic program to do that).
For now I think the program is more a waste of time then useful since you need to do alot more stuff then just set a breakpoint and follow it in your debugger.

This is not intented to be a flame but rather critisisem which you can hopefully use to improve it.
hack3r2k
06-19-2002, 10:28 PM
Hey cyberheg !

I started an *install* program before the release but i didn't had time to finish it at time ...

I will be available in the non-beta version like regs editor too (i feature that will let u to modify regs content and save them).

other opinions now ??

best regards,
.:hack3r2k:.

ps: the program is intented to save time and help newbies and not only to gather the info quickly...
cah
06-20-2002, 05:30 AM
Thanks to your research & hardwork.
Patching target file looks very odd. Try to find method to make/modify device driver files.

Cah...


crypkey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > crypkey
PDA

View Full Version : crypkey

projrev2
06-18-2002, 12:24 PM
Hi,

I am seeking where software crypkey keeps the site code in a dll.

I have a software that uses crypkey and I try to open the safety.

Any tips on crypkey is well coming.

Thanks
Kythen
06-18-2002, 01:19 PM
The site code is generated from the master key, user key, and some other info from your system. The master and user keys are usually found as plaintext in the exe or dll.
peterg70
06-19-2002, 09:58 AM
You want a tip about crapkey

Then search the board first and you'll get heaps

peterg70


SIce and Windows XP (No, is not the same old question)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SIce and Windows XP (No, is not the same old question)
PDA

View Full Version : SIce and Windows XP (No, is not the same old question)

naides
06-18-2002, 01:45 PM
I recently started using WinXP when I updated my computer. The OS was pre-installed in the new box. Consequently I moved all my toys and tools to the new invironment, including an update to Dstdio 2.6.

Now the problem: There was a piece of software I had previously worked on on my old Win98 box. I had used the nag screen " No can do unless you have the dongle" to break near the protection with the old trick of using HWND command to find out the handle of the nag screen and then BMSG .......wm_destroy.

When I tried the same trick on the XP machine, the behavoir was quite different:

1. The handle of the "OK" button does not belong to the app module, but to one of the kernel dlls, USER32.dll which used to be the case with win98.

2. When I Bmsg to the handle of the dlg window, sice breaks on the application module code instead of the user32.dll as it was typical on W98. Needless to say, the code is not even near the place the nag was generated, (which I know from the Win98 debuging sesion) and is not useful, as it is, to isolate the protection checks.

I realize that the new OS has a different scheme to handle the flow of msgs. However, it seems to spoil and very useful RCE attack point.

Questions: Has anybody observed this behavoir and found a way to work around it So one may still take advantage of message-driven breakpoints??

Thanks in advance
naides
06-26-2002, 09:40 PM
Sorry guys, but I am still stock in the same place.
Perhaps the way I formulated my question is confusing, or its content is so elemental that I don't even deserve a scolding by more experienced members?

This is what I have found so far:

When I break in to a message in WIN98, an address of my application is present in the call STACK, so by patiently tracing back from deep into the USER, USER32 and KERNEL dll, I will eventually return to my app code, within the same call that generated the nag screen.

In WinXP, the USER32.dll has its own call STACK. I have no simple way to determine where, within my code, was the nag screen call generated.
I do not understand how the flow of the program returns to the application once the nag screen is destroyed: If I keep tracing, softIce just disapears, and the program continues its excecution. Is there a way to examine the STACK of the STACKS?


Problems with SoftIce (symbol not defined) I did Dat stuff.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems with SoftIce (symbol not defined) I did Dat stuff.
PDA

View Full Version : Problems with SoftIce (symbol not defined) I did Dat stuff.

Adri_Magnon
06-18-2002, 04:11 PM
Hi,

I installed SoftIce (4.05) and followed a configuration tutorial from Woodmann.com (newbies). He said to modify the winice.dat file after installation by removing the semicolons from the files that I have in my c:\windows\system\ folder. For example, I have user.dll so I changed this...

;EXP c:\windows\system\user.dll

to...

EXP c:\windows\system\user.dll

I did this to all the files I had in the system folder and if I didn't have it, I didn't change it. I also do not have the SDK so I left that portion alone.

I rebooted and opened the first tutorial program. It used bpx hmemcpy so I was okay and did it. Then I opened the second program and typed bpx GetDlgTextItemA and I got that it was "symbol not defined." I tried some others ("Get" commands that is) but the tutorial wasn't working so I opened up the target program in Wdasm and found that it did use the GetDlgTextItemA line so I closed Wdasm and looked at my Winice dat. I double checked that all files on my hard drive were un-semi-coloned and rebooted. I tried again and still got the symbol not defined error.

Can someone please tell me what I need to do? I reached an impasse since the rest of my tutorials use that command line a lot.

Also, I tried a tutorial that used bpx msvbm60!rtcmsgbox and I got the same error. I don't know if that helps. I am running Win 98 and have 256Mb RAM. I have installed some free developers and compilers as well as MSVS6 with the processor pack and that 100+ MB service pack for it.

Thanks for any help you can give. It felt good to have finished the first tutorial and saw it worked.

Adri_Magnon
Adri_Magnon
06-18-2002, 04:43 PM
Hi,

Ignore my previous post. I was reading some of the posts on the search of this forum for "softice bpx" and I read some things that helped. I decided to post my dat file and a detailed description of exactly how I installed SoftIce and such. I opened up my dat file and only half of my .dlls were un semicoloned.

See, I couldn't get SoftIce to display when I hit cntrl-D. The screen would go blank so I reinstalled. Then I cut and past my old dat file into the new one and I missed the lower third of it.

Sorry about the post. I had posted on another forum and searched around but had no luck. I forgot about this fourm until I was browsing my bookmarks. Since I had no luck on the other one I posted here.

I figured since I read the installation guide then my question was valid since I did the ";" removals. I have the c4nfaq open and the RCE Messageboard FAQ. I should be fine now.

However, if anyone wants to answer this question I'd appreciate it....

After I installed SoftIce, Adobe Acrobat no longer opens. It shows the splash screen and the loading of the files and then it just quits. It was working before the installation. Any ideas on how to fix this?

Thanks and I apologize for the "useless" question on SoftIce.

Adri_Magnon
Kayaker
06-18-2002, 05:03 PM
Hi,

Looks like you got it figured out, so I'll just merge your threads and delete my explanation. Careful with the "32" in your dll names, it's user32.dll of course, not user.dll.

Type EXP in Softice and you'll get a listing of all the exports loaded by SI on your system, the 16 bit ones first. If your function isn't listed there then the dll exports weren't properly loaded by SI.

KERNEL, USER and GDI (the 16 bit variants) are loaded by default and represent the functions exported by Krnl386.exe, User.exe and Gdi.exe. Hmemcpy is a Krnl386.exe function and that's why it worked for you.

To be able to break on functions in any other dll you need to add the full path in an EXP= statement. This includes the VB dlls or any other application dll with exports you want to set a breakpoint on. To start with you really only need the 3 main 32 bit system dlls, and maybe the VB ones.

Correct me if I'm wrong since I don't use it much, but I think the syntax you'd need for a VB breakpoint is
bpx __rtcmsgbox
note the double underscore...

As for the Adobe problem, yep, this is some kind of stupid Softice detection, do a board Search here for Adobe Acrobat and you'll find some answers.

Good Luck,
Kayaker
Clandestiny
06-18-2002, 10:53 PM
Hiya,

Yeah, Adobe Acrobat has SI detection and will hang on something called DocBox API. If you run IceDump with /protect on, you will see where it tries to access the IDT. A couple of lines down is a simple cmp / jmp that you can modify in memory to enable Acrobat to finish loading. There have been a couple of threads discussing this in the past. Patching it to bypass the SI detection should be quite easy. Don't know why Adobe even bothered ;)

Cheers,
Clandestiny
foxthree
06-19-2002, 07:53 AM
Hi Clandestiny:

A small correction: Yes, it is a Adobe plugin. But it is not written by Adobe. It is a third-party plugin for enabling higher security in PDF document written by a company called InterTrust. They put in this "small" SoftICE check :D

Signed,
-- FoxThree


Problem at Linux crack development...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problem at Linux crack development...
PDA

View Full Version : Problem at Linux crack development...

zak72gr
06-18-2002, 08:25 PM
Hi!
i am working on a crack for a Linux application. (plugin)
This plugin is released as well at for Windows and uses flexlm 7,2 protecting system.

I have a working license for loading this plugin but the problem is that except license it needs some extra patching.

The windows ver crack contains a license, an "alternate deamon" and a utility that patches some files.

As i have the working license is a way to make an alternate deamon for linux with referrence to windows crack as well as a patcher for linux?

Please help me, because i dont know much things at linux..

thx in advance!


FLEXlm 8.0d
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXlm 8.0d
PDA

View Full Version : FLEXlm 8.0d

h880015
06-19-2002, 03:15 AM
My target is ****, which using FLEXlm 8.0d. I have read Nolan Blender's Zendenc essay, and got data from vendorcode, job structure. Fed them into calcseed I got the encryption seed. But when I fed the encryption seed and key0-4 (got from vendorcode+0x0C...) into lmvkey5.exe (downloaded from CrackZ), I can't pass the checksum test. Examine the lmrecode.c, I guess I need the glseed for version 8 to get the correct key 5. Do we have new version of lmvkey5 for FLEXlm 8.0 or can anyone show me how to get the glseed for version 8?

I also try macilaci's method. I have located the position of computing seed and license compare code. But these code never be executed. A call which pass in SIGN as argument failed and ended the _l_ckout_string_key procedure. Does anyone know anything about the SIGN= check?
redsk_y
06-26-2002, 08:29 AM
Hi,

If your target uses ECC, Elliptic Curves Cryptography, the compare, pointed out by Macilaci's, will never be reached.

The verification is made in _l_pubkey_verify!

Bye
padspcb
08-08-2002, 05:20 PM
Hi
For those of you who need, i've upped here a recode for up to 8.1
but only change in this particular is the glseed
case(8): /* version 8.0 */
glseed = 0x3CDE3EBF;
break;
and on nbl_svk
/* PATCH for version 8 - uses different value here. */
if (glseed == 0x3CDE3EBF)
{
seedval = 0x6F7330B8;
}

If anyone have success on 8.1 plese give me a call

Best

PadsPCB
esther
08-08-2002, 05:49 PM
Hi padspcb,
Sorry I have delete your attachment.I will send it to Woodmann and see if its relevant

Regards
padspcb
08-09-2002, 02:39 AM
Well it may be relevant to those that dont have it
but for the previous version that can be found on
old crackz mirrors, just add the info missing.
If anyone realy needs this stuff, please send pm.
But as it was just a fix, seemed not so relevant to post

But trouble on 8.1 are the seeds, i've reduced freedom to 3 dw
but this is still a lot of computing 32*32*32.

Best
Pads
bondwiththebest
03-01-2005, 11:41 AM
hi this is sandy
i am new to flexlm. Actually i am able to run my application which is using flexlm 8.0d licence manager. But the problem is its not supporting the all my packages.and its give error when i run build my project.....
Main problem is....
I have complete dump of flexlm 8.0d files from a computer which is running a floating licence...
can you some how convert that floating licence to node locked licence ....or help me in converting to do that.... and create a licence.dat file..
Your help will be greatly appreciated.......

sandy
Kayaker
03-01-2005, 12:12 PM
Aw gimme a break sandy, what in +Orc's name possessed you to dredge up 4 ancient flexlm threads and post the exact same thing in each? In any other context this is known as spam, and like all spam is...

I deleted the redundant crossposts, will leave this one, the ones you want to bond with will read this one just fine :rolleyes:

Kayaker
bondwiththebest
03-01-2005, 12:51 PM
common i am not a spammer..well the reason of leaving on all thread was because i need to get flexlm licence.dat file done asap ..i am not a top end guy....and working on my thesis...
telecom guy who works on layer 3 and need some help on flexlm 8.0d to to make a node locked licence.dat file.
well can u help .....
lets see
CrackZ
03-01-2005, 03:00 PM
With respect.

A read of the FLEXlm manuals would tell you the syntax difference between a node locked and floating license.

A read of the various FLEXlm tutorials would tell you what you need to do to recover enough information to generate a license and also what kind of information you need to tell ppl for even rudimentary assistance.

I think you are just looking for someone to fix you a license. Not many here subscribe to that philosophy, I wish you luck.

Regards

CrackZ.
monguz
03-02-2005, 11:39 PM
Hi at all..
at first sorry for my 'englitch', in the hope that someone can understand it, i will try to wite my 'findinds' on flex and licenses (old style)...I have played with a Flexlm 8.2 protected App. After reading tutorials and trying out them, i have asked me how the hell checks Flexlm the SIGN validity...Take a look

x4340B0 call _l_isdigit ; search this call
x4340B5 add esp, 4
x4340B8 test eax, eax
x4340BA jz short loc_4340D6

>snip<

x434121 mov edx, [ebp+var_1D0]
x434127 and edx, 0FFh
x43412D mov eax, [ebp+var_188]
x434133 xor ecx, ecx
x434135 mov cl, byte_4DB258[eax] ; in [4DB258] Calculated SIGN
x43413B cmp edx, ecx ; final compare
x43413D jz short loc_434143
x43413F xor eax, eax
x434141 jmp short loc_434169 ; bad jmp (exits the loop)

You can see after the second "_l_isdigit" call the "final compare" as part of the check loop. Just let your favorite debugger display the variable above the compare... I dont know if it works with other versions of Flex or newer license types.
Regards.
ssx
03-05-2005, 06:40 AM
monguz,

yes, it works with other flexlm versions - i've checked with 7.2 & 8.4
jb1968
03-07-2005, 08:19 AM
Hi,

If your target uses ECC, Elliptic Curves Cryptography, the compare, pointed out by Macilaci's, will never be reached.

The verification is made in _l_pubkey_verify!

Bye

_l_pubkey_verify, how to patch it , set it to 0?
tom324
03-07-2005, 02:08 PM
Yes. Patcher for _l_pubkey_verify is available at

h**p://www.woodmann.com/crackz/Flexlm.htm

Tom


Disassembling a .DLL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Disassembling a .DLL
PDA

View Full Version : Disassembling a .DLL

SideSwipe
06-20-2002, 07:18 AM
I wrote a small assembly language program that makes a few calls to a .DLL This DLL is a commercial utility. It is Time restricted to one month. When I disassemble my program with W32dasm and "LOAD PROCESS", the DLL shows up in the Active DLL's box, and can be freely disassembled and traced. If I move the date ahead 1 month and LOAD PROCESS, a windows message box appears "Cant Load DLL". How can the DLL know I changed the date before it gets run? Does windows check DLL's for date stamps before it can load it? Is it some file attribute.? What the hell is going on?

SideSwipe
foxthree
06-20-2002, 07:31 AM
Hi SideSwipe:

Just a shot: Actually, more information is needed on whether the DLL is a regular Win32DLL, MFC DLL or MFC Extension DLL or COM DLL Ugh!...

Assuming that that world is simple :D, I assume a simple Win32DLL. Then it must have a function called DllMain which gets a DWORD fdwReason. If it is DLL_PROCESS_ATTACH, then the app checks "whatever". If "whatever" is true, DllMain returns TRUE and DLL init succeeds (Note Addtionally, the DLL may keep some global variables) else DllMain returns false and app gets Can't load DLL msg?

Does any of this makes sense?

Signed,
-- FoxThree
SideSwipe
06-20-2002, 08:30 AM
FoxThree:

Thanks for the reply. There is about 15 function calls, none are called DllMain. How can I tell what kind of DLL it is? Is it possible that the code at the Program Entry Point is being fired when W32Dasm loads it into memory?

Tks SideSwipe
Fake51
06-20-2002, 12:16 PM
A Dll has some init code (well, doesn't necessarily, but they usually do) that gets executed when it's loaded. Thus, what you're experiencing is that the dll's init function is checking the date, and then returns from it's init function with a false return. This tells the system that the dll couldn't be loaded.

What you need to do is find the init function. Do some PE checking to find the init function entry. Then see whatever it uses to check the date.

Regards
Fake
Dr.Golova
06-20-2002, 12:31 PM
Originally posted by Fake51

What you need to do is find the init function. Do some PE checking to find the init function entry. Then see whatever it uses to check the date.

DllMain is entry point of PE module - just insert here int 3 and launch SoftIce :)
hack3r2k
06-20-2002, 02:00 PM
bpx GetSystemTime
bpx GetLocalTime

(problem is that sice will break many times if u put those breakpoints in it)

try to put the breakpoints in w32dasm (all call references to the apis above)

hope that helped u ...

bye !
SideSwipe
06-20-2002, 04:53 PM
Ok, with a PE editor, how can I find the DLL entry point? Is it the same as the W32Dasm Program Entry Point? I cant make Sice 4.05 work on my computer :(
Aimless
06-20-2002, 05:36 PM
MYDLL.CPP source code...

Perform all #includes here...
Perform all init functions here...

check_date(){...}

export some_func_1(){check_date(); ...}

export some_func_2(){check_date(); ...}

export some_func_3(){check_date(); ...}

Get it...?

The idea is, if ALL exports after being disassembled in, show call to a single location, specially in their initial 10-15 lines of code, check that call. Might as well be the protection.

No softice? No problem. Download the Microsft debugger from

http://www.microsoft.com/ddk/debugging

or download Ollydbg version 1.06.

...Have Phun
hack3r2k
06-20-2002, 07:49 PM
Well it's the same entry point !

If u have problems with sice then u have a NT based system, no ??

Anyway if want to put a breakpoint with sice at the dll entry point u can use 'LordPE - RoyalTS' from www.y0da.cjb.net (very util + lots of features and will work with sice perfectly but u must put first in sice a 'bpint3' and after that run the stupid/fucking prog).

Anyway if u want someone to help u crack that shit upload the file somewhere (with the calling exe preferably). U can post also the www from where u got it

Anyway this how it looks in 32bit asm:

LibMain proc hInstDLL:DWORD, reason:DWORD, unused:DWORD
.if reason == DLL_PROCESS_ATTACH
mov eax, hInstDLL
mov hDllInstance, eax
xor eax, eax
inc eax ;return true if all things went ok (that means that the dll didn't expired)
.elseif reason == DLL_PROCESS_DETACH
;if we do somethin' before exit like a stupid messagebox that tells us that the dll expired :)

.endif
xor eax, eax
inc eax
ret
LibMain Endp

When dll is loaded/debugged LibMain is called by windows loader :)

best regards,
.:hack3r2k:.:D


SHA-1 protected program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > SHA-1 protected program
PDA

View Full Version : SHA-1 protected program

LaptoniC
06-20-2002, 01:36 PM
I am working on program which has interesting reg check.
It gets name and removes spaces and make uppercase ie Mister Stop -> MISTERSTOP
Then it takes SHA-1 of it 2014A31489DEB684260C49792266DB575E69E5A4
then it gets what serial you entered and send MakeAscii procincluded in zip
Then it takes SHA-1 of this number (E400AA622758FF3B29D0E14546EA48DE31DB8A4E)

Then it gets first char of SHA-1(Name) divide to 80h and get SHA-1 hash which is in the program.(80h precalculated SHA-1) compare to SHA-1 of mangled serial.

In order to reverse this one should find 16 chars serial whose SHA-1 is in the program.I think bruteforcing takes a lot time.It is compiled with visual C.If they used any C random algo maybe we can attack here.Also I think they didnt calculated 16 chars at once instead they calculated 4 by 4 or 8 by 8.Any tips are appreciated.I attached predefined 80h SHA-1 hashes,MakeAscii proc
Lbolt99
06-24-2002, 03:22 AM
I think I've followed what you're saying in the 2nd paragraph:

So in a nutshell, what it's doing is running SHA-1 on the name, running SHA-1 on the 16 byte serial you entered. Then it reads in the first byte of the SHA-1 code done on the name, divides it by something so that it's a number in the range of 1-80, which would correspond to one of the 80 available SHA-1 codes stored in the program. Then it compares this with the SHA-1 code calculated on the serial?

Just want to make sure i understand this before thinking on it more
LaptoniC
06-24-2002, 12:17 PM
yes what you say is mostly correct but there are 80h=128 predefined SHA-1 hash.Thanks for yor response
Lbolt99
07-29-2002, 10:32 PM
Sorry for the delay in getting back. I've thought it through, I'm thinking there's no real easy way to keygen this... the main problem is finding out what the 128 different serial numbers are, whos hashes would match up to the hardcoded hashes. The authors probably just made up a bunch of numbers, or maybe generated them, but that's external of the program so there's no real way to find that out. No way I know of to get from here to there :(

One thing of interest, in fact I want to look into this myself, is Advanced Disk Cataloger v1.47, which uses MD5 hashes as protection. It was keygenned by DAMN (surprise) and Ivanopolus somehow bruteforced numbers out of it. I want to figure out how that works and how he did that.

In the NFO file, it states that there are hardcoded hashes in the program, so somehow he got from point A to point B as far as keygenning it. Should be interesting
LaptoniC
07-30-2002, 05:28 PM
Thanks for the info.You are right I guess.Thanks again for your interest.


Delphi obfuscation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Delphi obfuscation
PDA

View Full Version : Delphi obfuscation

Lbolt99
06-20-2002, 05:51 PM
Hello,

I've been working on an app called Quick to-do pro v3.7 (this is the latest version, all prev versions aren't asprotected) on and off for several days. I found out about it from chameleon clock, both of these programs can work together.

The app is protected with Asprotect 1.2, recent build. Removing ASprotect was the easy part :)

Basically the only thing wrong is a startup nag,

I looked at it with Dede, it processed fine. Tracked the issue to the "about" procedure, which uses the "TAboutBox" form.

In the form script, I see clearly the " 'This copy of Quick To-Do PRO is licensed to:'" string.

The FormCreate procedure, however, when disassembled, reveals nothing.

Looks like this:

004C4C8C 55 push ebp
004C4C8D 8BEC mov ebp, esp
004C4C8F 6A00 push $00
004C4C91 53 push ebx
004C4C92 56 push esi
004C4C93 8BF0 mov esi, eax
004C4C95 33C0 xor eax, eax
004C4C97 55 push ebp

* Possible String Reference to: 'é½êóÿëð^[Y]Ã‹ÀU‹ì3ÀUhAML'
|
004C4C98 680E4D4C00 push $004C4D0E

***** TRY
|
004C4C9D 64FF30 push dword ptr fs:[eax]
004C4CA0 648920 mov fs:[eax], esp
004C4CA3 EB53 jmp 004C4CF8
004C4CA5 EB05 jmp 004C4CAC

here is just a bunch of garbage code. The strange thing is, these jumps skip by everything, basically down to the "FINALLY" code section.

Stepping thru it with Sice reveals nothing. I figured the actual routine might be somewhere else, like after or before this section, and figured that maybe the author confused Dede so that it displays the wrong stuff. But couldn't find anything. I have a feeling the garbage code is possibly encrypted EXE code, but it doesn't seem to ever "run" it.

Any help is appreciated :)

I tried looking at the whole prog with W32dasm, no luck there either. I have my doubts it does anything with the garbage code.. it doesn't seem to ever decrypt or run it, and the "unregistered copy" string is nowhere to be found either, so I deduced that somehow it has to be displaying that :p
hack3r2k
06-20-2002, 08:09 PM
?

Anyway i'm not sure but i think that the program contains strings in some crypted form (probably XORed). The thing that made me think at that was thas push xxxxxxx that address that strange data...

best regards,
.:hack3r2k:.
Lbolt99
06-20-2002, 08:25 PM
Thanks for the reply.. yeah, that's what I'm beginning to think.. there's something encrypted somewhere, I'm still trying to track it down.

I pasted in the whole thing, not just the start this time, if this sheds any more light.

The PUSH 4C4D0E seems to reference a jmp statement.. not sure what that means. I'm not too great at dede yet. Suspicious ref to lstnclr too at the end.

004C4C8C 55 push ebp
004C4C8D 8BEC mov ebp, esp
004C4C8F 6A00 push $00
004C4C91 53 push ebx
004C4C92 56 push esi
004C4C93 8BF0 mov esi, eax
004C4C95 33C0 xor eax, eax
004C4C97 55 push ebp

* Possible String Reference to: 'é½êóÿëð^[Y]Ã‹ÀU‹ì3ÀUhAML'
|
004C4C98 680E4D4C00 push $004C4D0E

***** TRY
|
004C4C9D 64FF30 push dword ptr fs:[eax]
004C4CA0 648920 mov fs:[eax], esp
004C4CA3 EB53 jmp 004C4CF8
004C4CA5 EB05 jmp 004C4CAC
004C4CA7 8989E9440000 mov [ecx+$44E9], ecx
004C4CAD 006A70 add [edx+$70], ch

[ clipped encrypted / obfuscated crap]

004C4CF1 5F pop edi
004C4CF2 EB04 jmp 004C4CF8
004C4CF4 EB05 jmp 004C4CFB
004C4CF6 99 cdq
004C4CF7 99 cdq
004C4CF8 33C0 xor eax, eax
004C4CFA 5A pop edx
004C4CFB 59 pop ecx
004C4CFC 59 pop ecx
004C4CFD 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '^[Y]Ã‹ÀU‹ì3ÀUhAML'
|
004C4D00 68154D4C00 push $004C4D15
004C4D05 8D45FC lea eax, [ebp-$04]

* Reference to: system.@LStrClr(String);
|
004C4D08 E8AFF0F3FF call 00403DBC
004C4D0D C3 ret

004C4D0E E9BDEAF3FF jmp 004037D0
004C4D13 EBF0 jmp 004C4D05

****** END
|
004C4D15 5E pop esi
004C4D16 5B pop ebx
004C4D17 59 pop ecx
004C4D18 5D pop ebp
004C4D19 C3 ret
hack3r2k
06-20-2002, 08:35 PM
Convert Double to Quad
Converts signed DWORD in EAX to a signed quad word in EDX:EAX by extending the high order bit of EAX throughout EDX

You should check first what those jumps do and also what params are pushed/what happens to them ...

hope this helps you
nikolatesla20
06-20-2002, 10:04 PM
Someone stole my graphic I think. That is not polite !

Anyway, those references in WinDASM will happen a lot with Delphi apps, they look like junk in a disassembler always. Remember, it say's "Possible" reference. Most likely it is no reference, WinDASM is just being stupid again. That's why we have DeDe in the first place. Try to find the comparison code to *rack in DeDe before even trying to go anywhere else.

Also, you might not be finding the string because is is probably UNICODE. have you tried searching for the string in unicode mode in your hex editor? You might find it then. If DeDe found it, it's in there somewhere for sure.

Well either way it does look like you MIGHT have an encrypted string situtation. Keep working on it ! (note: it helps too if you are used to seeing exception handlers in assembly, delphi uses a LOT of them. YOu need to be able to walk the exception chain in the correct execution order to get to the right spot of where good code is actually executing. So pay attention to those mov and push [fs] 's !)

-nt20
Lbolt99
06-21-2002, 06:37 PM
Hi, thanks for the input. I did find the string of "This program is licensed to: " in the form script of the About Box. So it seems to be in there unencrypted.

I dug a little deeper and found out that the startup nag is actually separate form from the about fox. I looked at it but the asm code appears to be just a routine to randomize the placement of the buttons to click on the nag :(

I got delphi 6, so i might try playing around with writing my own prog and try debugging it with sice to see what's going on.. I'm not too familiar with what you're talking about as far as exception chain, etc..
Lbolt99
07-12-2002, 07:03 PM
Revisited this problem today. Solved it! I'm going to write a tutorial. This was a little complicated and different from cracking other delphi things I've seen.

There are encrypted strings! They are decrypted near the program start and copied to himem. The mangled bytes in the code I posted in messages above, does nothing.

The startup nag is easy to bypass.

There are limitations: Cannot add more than 12 tasks. I managed to track down the comparison, and fixed it.

The About fix I changed with Resource Hacker. Just deleted a label and changed another.

DeDe and W32Dasm/IDA did not help AT ALL with this cracking. Basically, there are no references to the "unregistered" strings in any of the procedures. The forms don't show anything either, except for the about box part. I had to find the decrypted strings in ram while the program was running.

Anyway it was a good challenge, and interesting obfuscation to throw off Dede (and me!)


Help with Quick ASM Translation.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with Quick ASM Translation.
PDA

View Full Version : Help with Quick ASM Translation.

Adri_Magnon
06-20-2002, 10:22 PM
Hi,

Can someone please tell me what the follwoing means...

push ebp
mov ebp, esp
push [ebp+10]
push [ebp+OC]
push [ebp+08]
call 0043B5F0
add esp, 0000000C
pop ebp
ret

I think it means, 1) Get the information at register EBP 2) Move the information from register ESP to EBP 3-5)?? add "10/0C/08" to EBP?? 6) Call the command at offset 0043B5F0 7) Add 0000000C to ESP 8) Restore the info at EBP 9) Return the call that started that bit of code.

Is that close?

Thanks,

Adri_Magnon
nikolatesla20
06-20-2002, 10:45 PM
The first two instructions are setting up what is known as a "stack frame" this enables you to reference local variables, and variables that were passed to you, using the ebp register. It is not fun to use the esp register for that because anytime you push or pop something your offsets change. This is why we store the original value of esp into ebp when we enter the function. The value of ebp will now be constant (unless you muck with it) and we can reference locals by [ebp - xx] and parameters passed to us by [ebp + xx ]. Now, one thing to note for parameters passed in, is that the first parameter will be [ebp + 08] . Why? Well, because our parameters were pushed in right to left when they were sent to us. (tradition C call) Now, esp points to the first parameter which is on top of the stack. BUT when a call is made, the Intel chip automagically pushes the RETURN aDDRESS on top of the stack AND we did a PUSH EBP BEFORE we loaded ESP into EBP. So there is two more values on top of the stack, and we need to skip them. Two more DWORDS. Adds up to 8. :) It can be easy to forget about the return address being pushed on the stack when you read ASM. Don't forget about that!

Ok, the push [ebp+10] , etc calls are pushing arguments unto the stack for the CALL afterwards. Traditional C code and most ASM routines use the stack for function arguments. The ebp+10 was an argument which was passed INTO this routine. Remember, ebp was based off of esp. And esp points to the stack. The stack where the arguments were passed in to us. Now we are also pushing it again to pass it to another routine. One thing to notice too is see how once again the arguments are being pushed from right to left, in the same order as we received them. Hope that makes sense to you.

The add, esp 0000000C is removing the arguments off of the stack that were passed to us. In C code it is the callee's responsiblity to remove the parameters from the stack before returning. This could have been done by also using a "leave" statement, or by simply doing a mov esp, ebp, but to each his own. Leave is slow and isn't used much I guess. A "leave" is basically a "mov esp, ebp - pop ebp".

And the last of course is pop ebp, which just pops the original ebp back off of the stack again, and then the RET which goes back to the caller.

-nt20
hack3r2k
06-20-2002, 10:46 PM
I love ASM !!!!!!!!!!!!!!!!!! :D

push ebp ; preserve base pointer
mov ebp, esp ; stack pointer into ebp
push [ebp+10] ; push C param
push [ebp+OC] ;push B param
push [ebp+08] ;push A param
call 0043B5F0 ; call a procedure (ex.SomeProc proc A:SomeType, B:SomeType, C:Sometype l where SomeType can be Byte, Word, Dword, Qword)

add esp, 0000000C ;restore stack pointer
pop ebp ;restore base pointer
ret ;return from the procedure cause the code u pasted coresponds to a procedure

TIP:
EBP in this context is actually a memory operand and the displacement in either direction is the address of either a parameter or a LOCAL variable.

WIN32ASM strikes back (u can't call yourself a cracker if u don't know asm :):)))

best regards,
.:hack3r2k:. :o

-=i'm fuckin' tired right now (2 am)=-
NervGaz
06-21-2002, 12:08 AM
judging by the values... 08h, 0Ch ,10h it's dwords... and you seem to have two unused arg to the routine... otherwise it would be 00h, 04h, 08h... unless the stackframe was manually created and for some reason made to start att 08h
nikolatesla20
06-21-2002, 04:39 AM
Originally posted by NervGaz
judging by the values... 08h, 0Ch ,10h it's dwords... and you seem to have two unused arg to the routine... otherwise it would be 00h, 04h, 08h... unless the stackframe was manually created and for some reason made to start att 08h

NervGaz - Remember, when a procedure is called (we can tell this is a called routine BECAUSE it has [ebp+xx] values in it, and it creates a stack frame), the return address gets pushed unto the stack. And we also pushed EBP as the first operation of our routine. SO we have two DWORDS that we pushed on the stack on top of the parameters BEFORE we do anything with them. We have modified the stack pointer (ESP) before we stored it into EBP itself. This is why the parameters always start at [ebp + 08] in most functions. We need to skip the return address, and skip the EBP we pushed.

:)

-nt20
NervGaz
06-21-2002, 11:43 AM
umm your right... forgot about that stuff... but it oonly applies in some cases... depends on what caling convention and stuff too... could be a long discussion... anyway it's safe to assume what said is correct in most cases... i was a bit tired when i wrote that...
fjrp2
06-21-2002, 07:38 PM
Very interesting nikolatesla20,
but:

if the parameters where already IN the stack, why do you push them again?

I guess the compilar does that for you, is it?
hack3r2k
06-21-2002, 07:45 PM
The assembler doesn't do this for you while the compiler does that ...

bye, bye
nikolatesla20
06-21-2002, 07:51 PM
Well, the parameters ARE in the stack yet, but they wouldn't be in the correct place to just CALL another routine, because we have that return address and the EBP register on the stack above them. So we really don't have any choice but to push them again.

This is really the only "clean" way to do it, otherwise each function would depend on the other functions not to mess up the stack. Just by CALLING we are pushing the return address on the stack and we already shift anything out of place anyway. Plus the function usually has the SUB ESP, XX at the end to restore the stack frame. If that was still there when we called the second routine, we would crash because the stack wouldn't be going to its original place as where it was when we entered our top function. (For example, say we don't push the params to the second called routine. But the second call still does a SUB. Well the SUB removes the params off the stack. Now we come back to our routine, which also does a SUB. Whoops. don't need to do that anymore. You are screwed ! It is better to have the convention of each function taking care of its own parameters. This is also why function calls have so much "overhead" compared to inline code.)

Yes, it is not necessary to create a stack frame if you want to "optimize". You could hand code ASM routines that don't use it, just be careful how you use the stack and the registers ! In fact, Delphi apps usually don't use stack frames in their procedures (parameters are passed in other registers, yuck.) This is why delphi is harder to read in asm :) There is an option in Delphi to make it use stack frames. It's kinda up to each compiler's settings. But most C and C++ and ASM compilers use stack frames.

So to sum it up, the program compiler does most of this behind the scenes for you. You can code it in raw asm if you want, but for example MASM you can use the PROC directive to tell the compiler this is a procedure, etc. It is more readable then.

-nt20
hack3r2k
06-21-2002, 07:57 PM
Hey !

Hey nikolatesla20 there no such thing as an assembler compiler !!!

Or is compiler or is assembler ...

Do you want me to explain you what's a compiler and what's an assembler, and what's the difference between them ???

I hope this to be just a silly mistake of yours...

bye !! :D
fjrp2
06-21-2002, 08:11 PM
Thanx nicolatesla.
Then how can you access LOCAL variables?
nikolatesla20
06-21-2002, 09:07 PM
Accessing local variables:

I used to wonder about this too when I first started asm. But it's really actually very easy.

When we first enter our function remember we are doing a MOV EBP,ESP. Then we push EBP to keep it for later so we can pop it and restore it before we leave the function. Now just remember that. We are storing ESP INTO EBP. Now we can use EBP to reference parameters, which would be [EBP + XX], since we pushed some crap on top of the parameters, they are further "down" the stack, hence we need to ADD an offset to get to them.

So how do you "create" local variables? WEll remember local variables go out of scope when you leave a function. So it really doesn't matter if we would use the stack to create them ! Because we are going to restore the ESP register value back to its original value before we leave the function anyway. So to create local variables we can just subtract a value from ESP itself - say we wanted a single DWORD local variable. We would subtract 4 from ESP like so: SUB ESP, 04.

Now, ESP is 4 less than it was. And remember that EBP holds the original value of ESP. So to access this local variable, we would have to subtract 4 from EBP as well. This is how it would be done : MOV EAX, [ EBP - 04] for example. This moves our local variable into EAX.

One thing you may wonder though is well that is fine and dandy, but why are we subtracting from ESP? I mean EBP knows where it is, we can always just subtract from EBP to get local variables - how in the heck does ESP affect EBP in this whole thing?

Well the reason is that other stack operations might be going on inside your function, and you don't know for sure what is going to happen. So say you didn't subtract 4 from ESP. But you are going to go ahead anyway and use a local variable by doing a [EBP - 04]. This might seem to work just fine. But now you do a PUSH EAX or something. Look what you just did. Since ESP is still in its original place, when you did the PUSH, you just overwrote the data location that you were using by doing a [EBP - 04]. If you would have subtracted 4 from ESP in the first place like you should have, any PUSH or POP operations would not affect EBP-04, because a PUSH would now occur at EBP - 08. (Or in other words, you subtract 4 from ESP to "make room" so ESP doesn't overwrite the data when other stack operations are performed. The first PUSH now ends up "above" your data.)

Hope that makes sense for u.

-nt20
fjrp2
06-26-2002, 05:40 PM
It has take me long to understand it.

push [second parameter]
push [first parameter]
call Main

Main:
push ebp
mov ebp, esp

push,[ebp+0C] ;second parameter
push,[ebp+08] ;first parameter
call Second

mov esp,ebp
pop ebp
ret

Second:
sub esp,04 ;reserve 1 local
mov [ebp-04],first_local
.
.
.
ret ;No need to restore SP, I think

What do you think of it?
NervGaz
06-26-2002, 06:36 PM
you should pretty much always save and restore (E)SP when doing functions... even if it's not needed it's better to do it all the time so you don't end up with something going straight to hell after adding a shitload of code in memory or someting...
fjrp2
06-26-2002, 06:39 PM
Okay, thanks
nikolatesla20
06-27-2002, 03:54 AM
In your example, you would have to restore ESP at the end of "Second", because it gets two parameters pushed to it. It's usually the responsiblity of the routine that is called to POP those back off of the stack. (Since the called routine usually knows how many arguments it takes in to begin with, it's easier for it to clear them off)

So at the end of Second, you would have a :

SUB ESP, 08 ; 8 because of 2 DWORD parameters.

Since you are not creating a normal stack frame in "Second" you would only need to do this. Be aware that stack offset errors are the largest causes of crashes, next to wild pointers. You need to make sure your stack remains the same IN to OUT of a function, whatever you do to the stack on the way IN, make sure you undo it before you come OUT.

The disadvantage to "Second" is you are not creating a stack frame, using EBP, so you will have a harder time accessing those parameters passed to it. For example, if you don't do any stack operations at all, the first parameter will be at [ESP + 08] (Because you have the return address pushed by the CALL (4 bytes), and you have the SUB ESP, 04 another 4 bytes). ANyway, the problem arises if you do any PUSH or POPS in this function. You never set up EBP as a base reference, so your only way to access parameters is with ESP - meanwhile if you are PUSHING and POPPING then ESP is changing all the time, which means your offsets to the parameters change. What a pain ! This is why it's best to set up the conventional stack frame, for your own sanity :) Then all parameters and locals are offsets from EBP and stack operations do not affect you.

-nt20
fjrp2
06-28-2002, 07:10 PM
Then, should a stack-frame be coded for EVERY called routine?

Would Second have to be like this:

Second: ;Enters with two arguments
push ebp
mov ebp,esp ;To access parqameters using BP

sub esp,04 ;reserve 1 local
mov [ebp-04],0 ;use local
.
.
.
push eax
pop eax
.
.
.
mov esp, ebp
pop ebp ;restore stack
sub esp,08 ;restore 2 arguments passed
ret

Do you think it´d work?
nikolatesla20
06-28-2002, 07:41 PM
Your routine coded above is perfect.

That is exactly how you should do it ! :)

-nt20
fjrp2
06-28-2002, 07:51 PM
Thanx, but ALL the credits have to go to you.


problem with softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > problem with softice
PDA

View Full Version : problem with softice

The Keeper
06-21-2002, 03:06 AM
hello all,

this wasnt happening, but after installing a few programs it started happening, i'll remove all the progs i installed if noone knows the reason this might be happening, well in softice window in the place i type the commands, every time im going to pass a call with F10 this appears

OldTcpipReceiveHandler ==>
OurTcpipTransferDataCompleteHandler ==>
OurTcpipReceiveHandler ==>
==>OurTcpipReceiveHandler.ProtocolBindingContext:C17847D0
OurTcpipReceiveHandler- HeaderBufferSize:E- LookAheadBufferSize:DC- PacketSize:D
C
LookAheadBufferSize:220 >= PacketSize:220
Calling OurTcpipTransferDataCompleteHandler ==>
==>OurTcpipTransferDataCompleteHandler -ProtocolBindingContext:C17847D0- BytesTr
ansfered:220
Call OldReceiveHandler- HeaderSize:14- DataSize:234
==> OldTcpipReceiveHandler. ProtocolBindingContext: C17847D0
OldTcpipReceiveHandler ==>
OurTcpipTransferDataCompleteHandler ==>
OurTcpipReceiveHandler ==>
==>OurTcpipReceiveHandler.ProtocolBindingContext:C17847D0
OurTcpipReceiveHandler- HeaderBufferSize:E- LookAheadBufferSize:2E- PacketSize:2
E
LookAheadBufferSize:46 >= PacketSize:46
Calling OurTcpipTransferDataCompleteHandler ==>
==>OurTcpipTransferDataCompleteHandler -ProtocolBindingContext:C17847D0- BytesTr
ansfered:46
Call OldReceiveHandler- HeaderSize:14- DataSize:60
==> OldTcpipReceiveHandler. ProtocolBindingContext: C17847D0
OldTcpipReceiveHandler ==>
OurTcpipTransferDataCompleteHandler ==>
OurTcpipReceiveHandler ==>
==> OurTcpipReceiveCompleteHandler
OurTcpipReceiveCompleteHandler ==>
==>OurTcpipReceiveHandler.ProtocolBindingContext:C17847D0
OurTcpipReceiveHandler- HeaderBufferSize:E- LookAheadBufferSize:13D- PacketSize:
13D
LookAheadBufferSize:317 >= PacketSize:317
Calling OurTcpipTransferDataCompleteHandler ==>
==>OurTcpipTransferDataCompleteHandler -ProtocolBindingContext:C17847D0- BytesTr
ansfered:317
Call OldReceiveHandler- HeaderSize:14- DataSize:331
==> OldTcpipReceiveHandler. ProtocolBindingContext: C17847D0
==> OurTcpipSendHandler- NdisBindingHandle:C179D540
Call OurTcpipSendPacketHandler- NdisBindingHandle:C179D540 - HeaderSize:E- DataS
ize:36
==> OurTcpipSendPacketHandler
OurTcpipSendPacketHandler ==>
OurTcpipSendHandler ==>
OldTcpipReceiveHandler ==>
OurTcpipTransferDataCompleteHandler ==>
OurTcpipReceiveHandler ==>
==>OurTcpipReceiveHandler.ProtocolBindingContext:C17847D0
OurTcpipReceiveHandler- HeaderBufferSize:E- LookAheadBufferSize:2E- PacketSize:2
E
LookAheadBufferSize:46 >= PacketSize:46
Calling OurTcpipTransferDataCompleteHandler ==>
==>OurTcpipTransferDataCompleteHandler -ProtocolBindingContext:C17847D0- BytesTr
ansfered:46
Call OldReceiveHandler- HeaderSize:14- DataSize:60
==> OldTcpipReceiveHandler. ProtocolBindingContext: C17847D0
OldTcpipReceiveHandler ==>
OurTcpipTransferDataCompleteHandler ==>
OurTcpipReceiveHandler ==>
==>OurTcpipReceiveHandler.ProtocolBindingContext:C17847D0
OurTcpipReceiveHandler- HeaderBufferSize:E- LookAheadBufferSize:2E- PacketSize:2
E
LookAheadBufferSize:46 >= PacketSize:46
Calling OurTcpipTransferDataCompleteHandler ==>
==>OurTcpipTransferDataCompleteHandler -ProtocolBindingContext:C17847D0- BytesTr
ansfered:46
Call OldReceiveHandler- HeaderSize:14- DataSize:60
==> OldTcpipReceiveHandler. ProtocolBindingContext: C17847D0
OldTcpipReceiveHandler ==>
OurTcpipTransferDataCompleteHandler ==>
OurTcpipReceiveHandler ==>
==> OurTcpipReceiveCompleteHandler
OurTcpipReceiveCompleteHandler ==>
==> OurTcpipSendCompleteHandler
OurTcpipSendCompleteHandler ==>
==> OurTcpipSendCompleteHandler

and much more, i have to wait from 30 to 60 seconds til it finish and pass the call, whats it ? where is it from ? anyone got an idea ? im totally lost, it looks like some prog is doing Outputdebugstring but i dont think so, i have only the programs i used to run before when it worked fine *g* im start to get confused, any help is really appreciated,

thanks in advance
The Keeper
NopREtf
06-21-2002, 05:37 PM
Maybe in the TOT forum was better ;)

Seems the “ProtocolReceive” function (driver function in NDIS protocols, miniport drivers) .
Do u have some net_proggies which work up ?
Also there are problems related to Realtek-based (e.g., SMC) adapters on the Windows 2000 platform..
Try to remove the network drivers and reinstall them.

ciao
NopREtf

...Sorry my bad english
The Keeper
06-22-2002, 02:50 AM
Hello,

thanks, i found it was a program i had installed other day, it wasnt running but it modified something, when i removed it things came back to normal

Keeper.


CRC check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CRC check
PDA

View Full Version : CRC check

SilSaLaMaTa
06-21-2002, 08:11 PM
hi ,
I have unpacked a prog (Essentian Net tools 3.0) ,it was packed with aspr . After patching the prog , it crashes . I know that there is a CRC check , but I can't find it . I saw some tuts , but they didn't say how to find the CRC check .they were just for a specified prog . I can't debug the prog with ollydbg or w32dasm , cause it cause a exception and I don't know how to fix it . What should i do ? help plz !
Kayaker
06-23-2002, 04:19 AM
Originally posted by SilSaLaMaTa
What should i do ? help plz !

A board search for CRC Check should pretty well answer your question. Anything anyone could tell you right now about the basics of finding CRC checks has already been documented and can easily be found with a search here.

Once you've read several posts and tried a few basic api's you'll have a better idea of what to do and what to look for. Specifying a target is pointless and you'll get more help when you've got more detail of the algorithm involved and if your interest isn't just to crack it.

Kayaker
SilSaLaMaTa
06-23-2002, 02:13 PM
hi ,
I have searched for "CRC check" and I read all the threads ,
but still having problem :(
I have tested CreateFileA and _lopen , but the prog is not using them for opening itself.
I changed one byte in file and put a BPM on the byte that I have changed befor . But sice didn't break . the prog craches with a message : Exception EReadError ...
I tried another way , I put a break point on entry point .
then changed one byte in memory with sice , prog crashes with the same message :(

I found 2 threads that was realted to my prob :
1 - http://www.woodmann.net/forum/showthread.php?s=&threadid=1610
-> Splaj : Opinions on the 'CRC' check system
I didn't understand this part :
...only that it's possible to dick it in
5 minutes once you trace the algo to it's
end and see what the real CRC code is REPZ'd.
Then just emulate it in the disprotected exe

2 - http://www.woodmann.net/forum/showthread.php?s=&threadid=1876
-> SuperCali : First of all I'd like to say that the version ...

Didn't help me , I noped 2 SetErrorMode calls , but get a "Exception EAccessViolation..." message .

help plz !
SilSaLaMaTa
06-23-2002, 05:30 PM
hi
the prog runs normaly if I don't try to patch it . So I have resolved the apis correctly .
I can't trace the prog until the crash , cause I think it has anti debugging codes too :( when I try to debug it , I got a lot of more exception (first exception happens when it calls ZwSetInformation Thread) .
Risotto
06-23-2002, 10:39 PM
Hey!

Do you know what you should try while searching CRC check in AsProtect? There are a lot of SEHs, so you must evoid them. Read some tuts about that (as far as i remember, you may find really good one by Crusader at www.anticrack.de). One more hint: try CreateFileA as a break point, it can help you much.
+SplAj
06-24-2002, 08:50 AM
SilsAl,

you are up against a nice team of programmers as well as Alexey in EssentialNetToolz 3

The Tamos CRC checking is MUCH more comprehensive since CV3.2 and quite fun to defeat :)
There are several methods to try. You could actually dump all the TFORM resources after a decrypt and poke them back to rebuilt.exe. Or as Solomon did. Log ALL the CRC results in an array at the end of the exe and poke them back...!!!

However I prefer the patented 'SV-Black-Box' filter :)

I played with ENT v3.1 b102 . They use the same complex crc check and I also notice that even ASPR is new...check out the dynamic 61,FF,E0.....;) LOL

FOXTHREE WHERE R U :)

So I can only say just start the target and pres CTL-D you are probably in the crc loop. It is so massive and slooooow these days it's pretty much impossible to NOT to find it.......

I can give you some pointers regarding the latest ENT 3.1 build :-

CRC range check is from 401000 to 555000.The essential part - for us ;) of the CRC code is at 553FB2. Here EBP holds the current memory range check. It increases with 0x40 bytes at a time. Now here we should log all the CRC results that are relevant for us. For example we need to patch out the bytes at 553FB2 and take us somewhere clean so we can do something about this shit.

:00553FA7 0106 add dword ptr [esi], eax <-here is stored 16 byte CRC/hash result
:00553FA9 015E04 add dword ptr [esi+04], ebx
:00553FAC 014E08 add dword ptr [esi+08], ecx
:00553FAF 01560C add dword ptr [esi+0C], edx
:00553FB2 5D pop ebp <- we patch here to JMP 55C000
:00553FB3 5F pop edi <- and filter the hash/crc results
:00553FB4 5E pop esi
:00553FB5 5B pop ebx
:00553FB6 C3 ret

So here follows the system logic for filtering the CRC checks :-

Find a good area of code outside of the CRC range to patch some code in. I found area 0x15C000 (RVA 55C000)
So at RVA 553FB2 we will change the POP's to JMP 55C000 (E9 49 80 00 00]

Also set a 'BPMB 553FB2 if EBP==553F80' and write down the GOOD 16 byte result - for me it is :-
F0 7C FC 44 51 47 03 8C-D5 1A 36 B6 C3 D7 D5 A7

This is the value we have to poke back into the system.
Hex this into offset 0x15C100

We also need to save the checked bytes value - 00553F80 as well because our changes are in range 553FB2->
The next 0x40 bytes will be 00553FC0.
Hex this value - 80 3F 55 00 - into offset 0x15C060

We also need a counter for dword REPNZ . lets use offset 0x15C0A0.
Add 1 to the number of patches we have eg, 1 patch here so value is 2 ;)

Now enter the following code into RVA 55C000 (0x15C000)

0167:0055C000 60 PUSHAD <- save all registers
0167:0055C001 8BC5 MOV EAX,EBP <- mov eax our current check address
0167:0055C003 BF60C05500 MOV EDI,0055C060 <- mov edi our patched address
0167:0055C008 8B0DA0C05500 MOV ECX,[0055C0A0] <- mov ecx our counter
0167:0055C00E F2AF REPNZ SCASD <- match eax value in our patch array ?
0167:0055C010 85C9 TEST ECX,ECX <- 0 == no match 1 == found
0167:0055C012 7418 JZ 0055C02C <- jump if not found
0167:0055C014 A1A0C05500 MOV EAX,[0055C0A0] <- we found a match, now which bytes !!!!
0167:0055C019 2BC1 SUB EAX,ECX <- calculate the correct bytes
0167:0055C01B 48 DEC EAX <- just some trickery
0167:0055C01C C1E004 SHL EAX,04 <- to fix the array
0167:0055C01F 8BFE MOV EDI,ESI <- find current CRC check
0167:0055C021 BE00C15500 MOV ESI,0055C100 <- get our good 16 bytes to poke back
0167:0055C026 2BF0 SUB ESI,EAX <- match the CRC result to our patch bytes
0167:0055C028 A5 MOVSD
0167:0055C029 A5 MOVSD
0167:0055C02A A5 MOVSD
0167:0055C02B A5 MOVSD <- overwrite the CRC check with CORRECT value
0167:0055C02C 61 POPAD <- return state and ret back to codewoods
0167:0055C02D 5D POP EBP
0167:0055C02E 5F POP EDI
0167:0055C02F 5E POP ESI
0167:0055C030 5B POP EBX
0167:0055C031 C3 RET

Now to add more patches, as u surely need to erm 'Evaluation' !!!!, then add the relevant datas to the next offsets
i.e increment the 'counter' add the CRC result and add the patch byte value to the black-box and CRC is history.
I am sure you can work it out.

Spl/\j
SilSaLaMaTa
06-24-2002, 02:34 PM
hi
I have downloaded the last version of ent (3.1.102) .
I understood what happens and do all the things that splaj said ,
but prog crashes :(
I put "bpx 553fb2 if(ebp==553f80)" , then "d esi" and wrote down the crc :
6C 80 02 B0 - 1A 29 9F A0 - 56 1D E5 8F - 3B F4 A0 A1

I put the code on 55C000 and other things , but the prog still crashes ,
there should be something else ...

I restarted my computer and I checked the CRC , I got another CRC !
55 4A A6 AB - 3A E6 46 D4 - F7 C6 16 68 - 46 61 B5 3C
I tried more restarts , but the CRC didn't changed anymore :)

How can CRC changes ? Why my CRC is diffrent from spalj's ?

i'm using XP pro , I don't know if there is something wrong with this os :)
(splaj : if i'm wrong , Can u send me your fixed file ? my email : SilSaLaMaTa@Yahoo.com)
+SplAj
06-25-2002, 07:08 AM
SilsAl

Read VERY CAREFULLY my words.... where did I say BPX !!!! do ya know what a BPX does to the code !!!!!!!

Spl/\j

CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
SilSaLaMaTa
06-25-2002, 08:04 AM
hi ,
I tried bpmb first but sice didn't break . now beter go and test under win98 ;)
+SplAj
06-25-2002, 08:33 AM
SiSal

To properly reverse current targets under W2K or XP you have to have the RIGHT tools available, hide bloody SI and know a LOT about PE, Anti-debug etc etc

I'll bet you don't have SI patched and NTdump to protect BPM from Context tricks ?

Then u r fuxed before you start. You can NEVER set a BPX when such CRC checks as these are running through the proggy and decrypting as they go. A BPX sets a CC (Int3) in your target and that changes EVERYTHING !!!!

Spl/\j
SilSaLaMaTa
06-25-2002, 11:37 AM
Everything works :D thanks alot , I learnt many things .

I have patched sice myself (I read http://www.woodmann.net/forum/showthread.php?s=&threadid=1806) . But i'm not using NTDump , i'll get that and I'll read about PE :)

now I have 2 questions :
1- Is there anyway to disable CRC check ?
2- maybe it's funny ! I can't crack it !
it seems that strings r moving to somewhere else after running ent .
I can't find it with IDA ...
I found something with sice (00443E84 , 004684CC)
but I don't know what to do .
can anyone help me with this ?
+SplAj
06-25-2002, 12:39 PM
SisLA

It may have slipped your attention....but the bloody CRC is DECRYPTING the TFORMS...... how can you find 'Evaluation' when it's encrypted ?

Examine the dumped.exe with a Resource editor and you'll see wot I mean...........

The only way is to do option 1) Open ALL forms one at a time and dump them. Paste back into dumped.exe and disable the decrypt for that form. This takes a LOT of time and patience and maybe ONE DAY will be the ONLY way to make it work :(

Now actually Tamos boyz have been lazy with this target.... I can see lots of clues with Wdasm - after changing section headers to E00000020 ;)

eg File Size check, did you use Numega Loader check , new licence type .ENL from old ule.dta check blah blah

So ....... get buzy in da codewoods SislA we helped enough already :)))

Spl/\j
foxthree
06-25-2002, 08:26 PM
Hola +SplAj, the unpaxor "king" :)

Nice target eh!!! Atlast, Alexey phhears OEPFinder :D. Guys, try to find the re-based OEP JMP just using SICE. It is lot of fun :)

Now to do some "CRC-checking" :D

Signed,
-- FoxThree
SilSaLaMaTa
06-26-2002, 09:42 AM
hi ,
I should read some tuts about keyfile cracking .
I have to work on it , and I'll crack it ;)

thanx alot for helping me :)
foxthree
06-29-2002, 11:54 AM
Hi SilSA:

The reason why BPMBs are not breaking is that there are two more DRx clearing being done at 554030 and 5540A0. Bypass them and all is well. BTW, the call at 553880 is where the "interesting" stuff is. Trace it and you'll see what +SplAj guru meant. :)

Signed,
-- FoxThree
SilSaLaMaTa
06-30-2002, 11:30 AM
hi foxthree :
how did u find 5540A0 and 554030 ?? searching for the string (31,00,64,...) or tracing or ... ?
for 553880 , the check sum , I put a bpx 553fb2 , sice breaks and ebp=401000 , I cleard the bpx and put a bpmb on
553fb2 if(ebp==553f80) , sice breaks this time :) without trying to bypass the SEHs , bypassed automaticly :) . I searched for a Exception handling and I found a tut , I should read to understand SEHs clearly ...
cRk
03-04-2004, 11:58 PM
i know this thread is really old but i would really like to know how to exactly DUMP this delphi Encrypted FORMS .....

i'm trying Bookmark Converter 3.1 and i think uses same CRC protection as Tamos' soft .... crashing....... always crash.... my Asprotect DUMPED working and running but since i modify a byte on this...... crash ;)

please help!
nikolatesla20
03-05-2004, 01:07 AM
Heh, it's usually just easier to get the crc values and patch the EXE to grab them instead of calculating them. Easier to do that than to try and dump all the decrypted stuff in my opinion, all though you do have to know how to add code to an EXE, but it's not that hard if you've graduated unpacking school :)

-nt20
cRk
03-05-2004, 01:01 PM
i'm not an expert guru but i have done some unpacking success ... i think the deal with this is the matter of encryption and not unpacking at all .. but since i saw the comment about Dumping this encrypted FORMS/disable the protection and write them back with a resource editor like EXescope.. i was curious about "how to do this?" how to dump this.....

exactly what kind of code injection we're talking nikolatesla20 ? :p

have you tried this target?? maybe it is harder than Essential Net tools... not sure ... i would like some guru to check it and write some info. or tuto about reversing this. i haven't seen any tut about reversing this kind of protection, just some comments and is not enought for newbies.


C++ patch code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > C++ patch code
PDA

View Full Version : C++ patch code

loanshark666
06-21-2002, 10:28 PM
ok,, can someone give me some simple c/c++ code to get me started,,, i've already patched some program in a hex editor, now i'd like to make an .exe that would automatically make the same patch for others,, any help? thanks.
naides
06-22-2002, 09:48 AM
If you look in protools or exetools, you will find a collection of patcher generators, from the very simple to the very sophisticated. I have not examined each one of them, but I vaguely remember some came with source code.

If what you want is a coding excercise, you may also find inspiration in their methodologies: Open the unpathched file, open the patched file, compare byte by byte, list the offset and the position of the changed bytes. Then, generate a stub of code that will open an unpatched file, write the bytes at the right offsets, plus add checks, bells and ribbons.
peterg70
06-22-2002, 11:29 AM
Actually I could use something like this so if someone wants to program please go ahead.

Also Don't forget you want a small window for some text file which has to be incorporated into the exe and also a Patch/Unpatch Button to return the original file back to the correct format

This could become a mini project for all.
jsteed
06-22-2002, 03:06 PM
Try PatchEngine 4.5 by ArthaXerXes. I've used it quite a bit and find that it works very well.
Risotto
06-23-2002, 10:49 PM
If you want to make a patcher, you can go the ways described above (by comparing every byte), but also if you know what bytes should be patched, an you must know it, you may make a patcher without checking every byte but checking only that bytes you want to alter, and maybe check some other values. If the check isn't completed successfully, the patch routine won't be applied.
peterg70
06-24-2002, 10:05 AM
Risotto

I think that the byte by byte comparison is at the start when generating the actual patch exe.

When actually applying the patch I would agree with your above comments

peterg
loanshark666
06-27-2002, 04:16 PM
thanks for all the replies,, i think i'll get something working soon, and post it back on here for anyone interested,, thanks again.
Zero
07-01-2002, 11:38 AM
You can find a small hex-dump-tool in C-Source here:
(This may help if you want to code an own patcher. Don´t use ready made ones... you will not learn ;) )

www.anticrack.de/modules.php?op=modload&name=News&file=article&sid=2441&mode=&order=0&thold=0


Protector vagaries
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Protector vagaries
PDA

View Full Version : Protector vagaries

foxthree
06-22-2002, 09:04 PM
Hello:

I'm trying to unpaxor this eleeto packer ;). It claims to have anti-debug stuff which I found works :D 'coz when softice is present the packer just quits. The funny thing is that without SoftICE (or any other debugger for that matter) the packer just crashes...

Has any of you had similar experiences with any other packer?

Thanks in advance,

Signed,
-- FoxThree
Pyrae
06-23-2002, 02:32 AM
If you're playing with "PE-Protector 1.01" on 2k/XP, your OS might be the problem...;)
foxthree
06-24-2002, 03:24 PM
Hi Pyrae:

Nope, it is not PE-Protector but another similar 3l330 packer :D Anyways, I installed this on Win2K and everything seems fine. Damn :) Now to do some debuggin' ...

Thanks Pyrae :)

Signed,
-- FoxThree
CoDe_InSiDe
06-25-2002, 06:21 AM
Hi foxthree,

Could you attach the file or send it to my email or upload it, i want to take a look at it (And probably others too ... ), if possible ;)

Cya...

CoDe_InSiDe
[NtSC]
06-25-2002, 06:43 AM
Atleast the Name of the Packer would help a bit...
Otherwise we would *still* wouldnt know what ur playing with Foxthree:confused:
[NtSC]
06-25-2002, 06:45 AM
Excuse my bad english.. Its early and i had no Coffee yet :p


Microsoft's Really Hidden Files!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Microsoft's Really Hidden Files!!
PDA

View Full Version : Microsoft's Really Hidden Files!!

JMI
06-25-2002, 05:23 AM
Perhaps this belongs in Off Topic, (and can be moved if more appropriate there) but it seemed an important topic to "General Reverse Engineering." It is actually somewhat of an update of the information contained in the article "What's behind the mm256.dat and mm2048.dat files? in the "reverser's hidden software" section of the fravia board.

This article discusses the lengths M$ has gone to maintain hidden files on your computer that record every URL you've visited (which is why when you start to type a URL in your browser you are offered choices from sites you've previously visited) and indexes every text containing file on your hard drives and maintains many/most of those files even after you thought you erased them, and even though you deleted those file and your history files, cache, and cookies from your "visible" listings..

It discusses how to make those "hidden" files visible, at least to dos, and how to get rid of them. There is also a listing of some shareware tools to accomplish these task for you, which could provide some practice for those so inclined. The article can be found at:

hxxp://fuckmicrosoft.com/content/ms-hidden-files.shtml

I would highly recommend it to those with a more paranoid bent. I know that there are forensic software packages that use these files to reconstruct your activities from what you've been doing on your computer and on the net and thought you had covered up.
(+Spl/\j, I promise not to bring this to the attention of your Misses, you're already in enough trouble over the life ambition issue.)

Food for thought and a warning to the unwary.

Regards


Private Keys and Seeds 3/4 in FlexLM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Private Keys and Seeds 3/4 in FlexLM
PDA

View Full Version : Private Keys and Seeds 3/4 in FlexLM

redsk_y
06-25-2002, 08:50 AM
Hi all,

There is someone here that have some ideas or knowledge about the way in which Private and Public Keys are related
to Seeds 3 and 4.

I can discuss this topic also in private way.

Tnx


Crapkey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Crapkey
PDA

View Full Version : Crapkey

peterg70
06-25-2002, 02:05 PM
With 1 Hour to go for the v6.0 Launch of Crapkey I would have thought the SDK would have been available somewhere.

Note to all : If you see the SDK or find something protected with V6.0 of crapkey let me know via PM. Would be interested to see what they have actually done with the new system.

Note to self : go to sleep

peterg
Kaz
06-25-2002, 04:20 PM
You're dreaming... After those 15 hours are up they'll add on another 30 Days. Typically retard software releasing practices by our friends at Crypkey.
cyberheg
06-26-2002, 08:00 AM
I read on their site now that one of the new features were their "patent pending clonebuster" technology. Essentially it's using the harddrive serial, model number and firmware data instead of relying on the partition serial which many others do. I just wonder if it's a great enough invention to patent it?

I assume it's lowlevel stuff which could require a device driver which again would force users to run as administrator to run their programs. Maybe someone could give a clue on this but I seriously doubt that their method of getting the real HD serial is anything big.


Ladies and gentlemen, I invite you.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Ladies and gentlemen, I invite you.
PDA

View Full Version : Ladies and gentlemen, I invite you.

nikolatesla20
06-25-2002, 07:51 PM
To look at the newest Milkshape 3d build. (1.6.0)

Found at:
h**p://www.swissquake.ch/chumbalum-soft/ms3d/download.html

OK The BASICS:

Make sure you have the newest regmon or a regmon that has the window class name patched. Otherwise milkshape will close it on you if you try using it.

REGMON gives us:

The date check is easy to defeat - there are 3 registry keys under HKCR\xxxxxxxxxx where the "x's" are a encrypted string, which is different on different systems (my theory is they are based off of OS product ID) this is so you can't build a generic loader unless you knew their algorithm of course. Easy to build a single loader per machine basis tho to kill them to start your 30 days over.
But this is besides the point here. Let's look at the file itself. MS3D.exe.

There appear to be a few interesting items. Now go easy on me it's been a little while since I've looked at packed apps (a few months).

Ok Ok today I have a headache and I haven't tried too hard but I was just looking at it anyway.

To begin with there is a filename check being done. Change the filename and it won't run anymore. Going on:

Also, it "appears" to be protected by ASprotect (possible new strain) , because if you run Revirgin on it all of the conventional KERNEL32.dll calls, etc are using the "mov eax, [xxxxxxxx]" technique. But since other things are going on too, I am not 100% sure yet. Maybe it is UPX or something like that.

The biggest item to encounter is a SOftICE debugger detection. I have to tell you that of all the programs out there that supposedly have detection, I have rarely encountered one that actually seems to work, especially in Win98. This is one of them. The other would be The Sims game. NOw, we all know of the conventional detection methods of course. It doesn't look like IceDUMP or FrogsICE protects softICE this time. I remember reading once that an idea for Win98 would be to simply check the autoexec.bat file for the Softice run command. Well guess what, this programmer must be reading the RCE messageboards because I found on my 98 machine that this is what it does. Boot up your computer with SI on it, and then simply delete the line referring to softice in autoexec.bat, and you are off to the races, goodbye detection. Nice try :) I'm still not sure how to get around in it in Win2k yet though, I haven't tried it yet.

Just for your entertainment, the "30 day check" is simply after the unregistered messagebox. And I mean RIGHT after.

0044758F cmp ESI, 1E

If this compare is less than 30, it clears AL (xor al, al)

If this compare comes out greater, it moves 1 into AL here:

0044776A mov AL, 01

So all you need to do really is mem patch this to move a zero (xor al,al). You could have a loader watch for the days left box and then patch. I tried using PELG (the best loader ever!) but it doesn't work since it renames the file, and there is a filename check. LOL.

Some resources look to be encrypted until the program starts. For example, when the messagebox comes up to say how many days remain, you cannot dump from there and examine the resources. But if you dump after the program runs, at least the bitmap resources come out fine. So you would have to paste these in manually later of course. THIS ALSO points to ASProtect because the messagebox telling you the time left is most likely a callback from asprotect into the program, after which the whole program is actually decompressed and run normally.

Anyway the biggest thing that actually throws me on this one is the file size. The program is only 500Kb. If you use ProcDump on it, it comes out to 50 MB ! Open this baby up in LordPE or in PEditor and you will see a strange thing, which I haven't seen before - The last few sections are at VA 33F0000 and higher. OK let me explain. There are six sections to this file. The third section is the queer one. It has a raw size of only 1C600 but the virtual size if set up to be 335D000. Why the heck is that so big? I have no idea. That is a lot of padding. And then the fourth section then starts at 33F0000. It's almost as though the program is going to be unpacked in this huge space? I've never seen this type of thing yet so feel free to give me your input. I "almost" seems like a trick to fool ProcDUMP. maybe. In either case your dump ends up huge.

Anyway, if you guys need something to do maybe you can join me in examining this target.

-nt20
Lbolt99
06-26-2002, 02:00 AM
Sounds interesting, will check it out soon, unforuntately am on vacation so can't do much till next monday..

One idea might be to try just the simple /dump command in Icedump.. that way you can specify the size.. not sure if that would work but it gives more control over /pedump.procdump :)

Very interesting on the softice check.. almost to the point of lame, but it did throw you off for awhile.. there is another program I know of with an "interesting" softice trick.. CacheX by MSOW software - it's easily defeated with icedump, BUT without using icedump - if you simply start the program, run until you get to the check, skip over it.. proggy crashes :) It ties something having to do with the softice check into the decryption it does on segments of the code.. pretty neat
Woodmann
06-26-2002, 03:00 AM
nikola,

I hope we can see a "paper" written about this by you :-)

Peace, Woodmann
nikolatesla20
06-26-2002, 04:30 AM
Ok I have a few more updates.

OEP is 0047C745

I couldn't use my ProcDUMP on my win98, the file seems to take forever to load (it's like 52 megs) so I just used IceDUMP.

Base: 00400000 - size: 0341E000

After dumping don't forget to realign the file (In PEditor, use the dumpfixer, VO = RO and VS = RS). Now your icon will show up properly.

I fired up Revirgin and got almost all of the imports, the conventional ASProtect ones, I did it manually in SI to be safe. Revirgin likes to crash my Win98 sometimes, and you can't trace mov eax, [xxxxxxxx] instructions anyway, you look at their return value and see what it should be.

So far I ran into one API that looks funny. It calls to 049DCEB8. If you U the code there, this is what you will see. This is in ASProtect memory area.

015F:049DCEB8 55 PUSH EBP
015F:049DCEB9 8BEC MOV EBP,ESP
015F:049DCEBB 53 PUSH EBX
015F:049DCEBC 8B5D08 MOV EBX,[EBP+08]
015F:049DCEBF 8B4518 MOV EAX,[EBP+18]
015F:049DCEC2 50 PUSH EAX
015F:049DCEC3 8B4514 MOV EAX,[EBP+14]
015F:049DCEC6 50 PUSH EAX
015F:049DCEC7 8B4510 MOV EAX,[EBP+10]
015F:049DCECA 50 PUSH EAX
015F:049DCECB 6A05 PUSH 05
015F:049DCECD 8B450C MOV EAX,[EBP+0C]
015F:049DCED0 50 PUSH EAX
015F:049DCED1 53 PUSH EBX
015F:049DCED2 E86175FFFF CALL KERNEL32!FindResourceA
015F:049DCED7 50 PUSH EAX
015F:049DCED8 53 PUSH EBX
015F:049DCED9 E8CA75FFFF CALL KERNEL32!LoadResource
015F:049DCEDE 50 PUSH EAX
015F:049DCEDF E8CC75FFFF CALL KERNEL32!LockResource
015F:049DCEE4 50 PUSH EAX
015F:049DCEE5 53 PUSH EBX
015F:049DCEE6 E8DD75FFFF CALL USER32!DialogBoxIndirectParamA
015F:049DCEEB 5B POP EBX
015F:049DCEEC 5D POP EBP
015F:049DCEED C21400 RET 0014

This almost looks like a new API that ASprotect offers, the ability to display a Dialog Box with DialogBoxParamA. Actually, I set up a BPMB (using SuperBPM) on this call, and it only executes when you click the "About" menu. The "About" and Registration entry dialogs are created through this call. This would be simple to paste this code into your EXE after dumping and redirect it to the correct location so it works. But the about box has bitmap resources on it too so make sure they are unencrypted. (I say don't click on about :) )

There are "other" API's on the end of my IAT yet, but my theory is they might just be junk that I have to trim off. I have to look at the real size of the IAT in SI yet.

That's the progress so far. At least I got the OEP for sure :)

BTW : This program WILL detect SI if you aren't using IceDUMP in Win98. But now if you fire up IceDUMP, Milkshape 3d won't give you the messagebox anymore, but it will just exit. This is because it sees the reference to winice.exe in your autoexec.bat file. That's right, it checks autoexec.bat.

The solution I came up with was to simply create another batch file (I called it RUNDEBUG.BAT) with the call to winice.exe in it, and then just CALL this batch file from autoexec.bat (at the end of autoexec.bat, put CALL RUNDEBUG.BAT). That way autoexec.bat has no winice.exe references in it. A simple redirection. Problem solved for good. They aren't the only ones who can redirect ! :)

-nt20
Kilby
06-26-2002, 11:48 AM
The 52 meg image size in ram may be an attempt to prevent dumping.

In some recent securom wrapped games the damn things had a 115 meg footprint in RAM.

icedump, procdump lord pe et al totally failed on my machine, and I had to use my own dumper to do the job.

After optimising the dump it came down to a more manageable 950 KB

Regards

Kilby...

Far from home and sitting infront of a mac (Yeuch !!!!!!)
nikolatesla20
06-26-2002, 03:01 PM
OK I got it unpacked and running without a problem it seems, pretty much nothing new I guess, just same old *SProtect unpacking job. :) , just a larger file than normal that's all.

I like having Win98 for dumping and tracing, and I use Win2K for import rebuilding because it's more stable. If i have a question about an import I use the 98 machine to trace look at it in SI first.

The benefit is in Win98 SI is more easily hidden from most detections.

Yeah the file is still 52 megs I'll see if I can optimize it now without breaking it. Looks like it runs now tho.

-nt20
nikolatesla20
06-26-2002, 07:24 PM
Fixed the file size / name check. Turns out to be actually in one of the DLLS the the file loads, "msModelLib.dll".

There is some checking going on, who knows, but who cares, we just don't want it to kill the app. Here is the code I found that does so:

0167:03991362 7414 JZ 03991378 ﷓
0167:03991364 6A00 PUSH 00
0167:03991366 6A00 PUSH 00
0167:03991368 6A12 PUSH 12
0167:0399136A 56 PUSH ESI
0167:0399136B FF1504A19903 CALL [USER32!SendMessageA]
0167:03991371 56 PUSH ESI
0167:03991372 FF1500A19903 CALL [USER32!DestroyWindow]
0167:03991378 6A00 PUSH 00
0167:0399137A FF15FCA09903 CALL [USER32!PostQuitMessage]
0167:03991380 6A00 PUSH 00
0167:03991382 E80E1E0000 CALL 03993195
0167:03991387 8B8C242C010000 MOV ECX,[ESP+0000012C]
0167:0399138E B801000000 MOV EAX,00000001
0167:03991393 5E POP ESI
0167:03991394 64890D00000000 MOV FS:[00000000],ECX
0167:0399139B 81C434010000 ADD ESP,00000134
0167:039913A1 C20C00 RET 000C
0167:039913A4 90 NOP
0167:039913A5 90 NOP
0167:039913A6 90 NOP
0167:039913A7 90 NOP
0167:039913A8 90 NOP
0167:039913A9 90 NOP
0167:039913AA 90 NOP
0167:039913AB 90 NOP

The PostQuitMessage we DO NOT want to do. So we want to just skip it. AND the code right after it we don't want either (the CALL after it) because that does a GetCurrentProcess and TerminateProcess. We want to just skip all of this and jump to that 03991387 address.

Edit the bytes at 03991378 to be EB 0D instead of 6A 00. (a nice little jump). By the way, this would be file offset 1378.

Now the proggie will run no matter what its name is, or what its size is. yay !

Another nice effort by the shareware programmer. A cross-referenced check.

-nt20
Tola
06-26-2002, 09:36 PM
here's what i remember from v1.5.x (which was not packed at all, iirc).
one of the date check keys was dependent on the system's hard disk (probably used the volume serial number, there's a call to GetVolumeInformation somewhere). moreover, it created a file containing the same information in your win/system dir.
date check/registration specific messages were initialised in a temp. buffer before displaying them so there are no string refs.
there were 3 crc checks, one in the executable, one in a dll checking the executable and another one in another dll checking the first dll ;)
btw, try this:
create a textfile and rename it to 'w32dasm.txt'. use notepad to open it and try to run milkshape ;)

i didn't yet check out the new version, though.
nikolatesla20
06-27-2002, 03:42 AM
There is only one "CRC" check in this version that I've seen so far. It's in the msModelLib.dll and it checks the filename/ size of the executable, and exits if it's not right. I simply patched the DLL to not ExitProcess. Now it works fine.

No CRC's in the actual executable at all. I've patched almost all of the "bugs", I removed the Windasm check. I haven't removed SoftICE checks at all, nor the date check yet, but I suspect that won't be too hard.

I have the file naked and realigned with LordPE on my hard disk now, it's only about 1.1 Megs after realinging, and it runs fine.

There's a string "decryption" routine at 00447780 that gets called from everywhere - if you see any of the strings in the resources be warned: they are not used. The strings are actually hardcoded in the EXe with mov instructions, such as mov [esp+123], 54. The "54" of course is not the REAL ascii hex 54, it is "encrypted", it goes to the routine above and then you get your real message. All the messageboxes use this technique or their messages, so not really that hard now to track them down, just look for a bunch of mov byte ptr instructions. :)

I have to say this author actually seems to know what he is doing, he checks for almost every tool RCE's use. I found references in his program (In encrypted code strings) to SoftICE, NTICE, FROGSICE, WinDASM,FileMon, and RegMon so far.

Quite well done. *But not well enough yet :) * I'm almost done correcting all the flaws..

*ONE SMALL NOTE **

I looks as though most of the import / export DLLS are loaded dynamically, and they appear to be based off of a template, which does the CRC check. All of the dlls can kill the process it looks like. SO that means you would have to patch all of the dlls. Maybe it's worth the 20 $ LOL :)

-nt20
Lbolt99
06-27-2002, 04:25 AM
Awesome work so far, sounds like a really interesting protection.. will definantely have to take a took at it when I'm back from vacation. Sounds kinda similar to the problem I've ran into with Quick To-Do Pro v3.7, concerning possibly encrypted strings.. although I don't think that's the case cause I changed one of them w/resource hacker and it changed in the program.. that was for the about box.. still haven't been able to do anything about the startup nag.. which displays proper code, but it only appears to be a routine to randomize the button placement in the nag window :(

I am almost certain that the author of Q T-D pro has somehow mucked the resources to throw off dede when looking at the form create code for the about box (and also possibly the startup nag) . is it possible that he could have done something to make Dede start disassembling the form create process 'after' the interesting code, making it look like there's nothing important at the routine? Not sure what else they can do, the code has to execute somewhere :confused:

Originally posted by nikolatesla20

There's a string "decryption" routine at 00447780 that gets called from everywhere - if you see any of the strings in the resources be warned: they are not used. The strings are actually hardcoded in the EXe with mov instructions, such as mov [esp+123], 54. The "54" of course is not the REAL ascii hex 54, it is "encrypted", it goes to the routine above and then you get your real message. All the messageboxes use this technique or their messages, so not really that hard now to track them down, just look for a bunch of mov byte ptr instructions. :)

I have to say this author actually seems to know what he is doing, he checks for almost every tool RCE's use. I found references in his program (In encrypted code strings) to SoftICE, NTICE, FROGSICE, WinDASM,FileMon, and RegMon so far.

Quite well done. *But not well enough yet :) * I'm almost done correcting all the flaws..

*ONE SMALL NOTE **

I looks as though most of the import / export DLLS are loaded dynamically, and they appear to be based off of a template, which does the CRC check. All of the dlls can kill the process it looks like. SO that means you would have to patch all of the dlls. Maybe it's worth the 20 $ LOL :)

-nt20
nikolatesla20
06-28-2002, 07:01 PM
Well, it's finished :)

msModelLib.dll has TWO CRC checks in it, one gets called when you first start the program, and the other gets called whenever you try to use some of the plugins. Not all of the plugins caused it to trigger, but most of them. I removed that check as well and now everything works just fine. Well, didn't actually Remove it, I just jump over the routine that tells it to exitprocess. :D

Speaking of the encrypted strings, as I mentioned before they are all hardcoded into the actual eXE as code (mov byte ptr instructions). I personally can't believe someone went to that much work, but hey to each his own. By the way, the "decryption" routine is nothing more than a simple add eax,1B. It just takes the "encrypted" byte and adds 1B hex to it to get the actual byte. Not complicated, but it would keep spying eyes from just finding it in the file, as would having it hardcoded as well anyway.

I put a breakpoint after the string decryption routine to see the strings that came thru and yes right before the program starts you get string references to \\.\SICE, \\.\NTICE, and \\.\FROGSICE. I took a look at the stack ("d esp") to see where the call came from that called the decryption. The caller had the bytes right before the call obviously, which I could right down their RVA and then I just went in and edited one of the bytes to a different value to change the driver it tries to make. Goodbye SI detection for good.

I also looked at other strings that came through, such as the "<UNREGISTERED> string that gets shown on the title bar. It comes from the hardcoded bytes as well. I just found that and changed the first character to a hex 00 (NULL). Basically it's an empty string. Did the same for "EXPIRED>". No more title bar ugliness now.

The program also detects WinDasm if it's running, I patched that detection to never exit as well. ( it still detects it, but I jump over the exit routine)

There is a date check which, when you set the clock forward, run the program, and then set the date back, and run it again, comes up with a messagebox that says "Somebody set back the date blah blah blah This program is expired". Well , in the code right after this messagebox it moves a 1 into al (mov AL, 01). If you change that to move a zero it doesn't care and continues on. In fact, it seemed that by patching this one boolean it fixes that date check altogether forever.

All done and it seems to work just fine, I can import / export just fine, tested it with Half Life, Sims, Serious Sam, Rogue Spear, 3DS, OBJ, model formats and it works ok.

This program had a lot of checks in it, and he checks for all the tools we use. I must say I enjoyed working on it.

-nt20
cyberheg
06-29-2002, 10:54 AM
You mentioned the mov byte ptr stuff and also noted that it would be insane to do it manually.
Without having looked at the actual program I can't say if I am correct but I am pretty sure from what it sounds that it's just local data.

Often data specified within a function becomes reinitialized every time the function is run. Then it will be put on stack and used from there. This could look like the following:

push ebp
mov ebp, esp
sub esp, <amount of bytes needed for local data>
mov byte ptr [ebp+<displacement>], 'T'
mov byte ptr [ebp+<displacement> +1], 'e'
mov byte ptr [ebp+<displacement> +2], 's'
mov byte ptr [ebp+<displacement> +3], 't'

<rest of the function>

leave
ret

So it might not even be intentionally done.
nikolatesla20
06-29-2002, 07:08 PM
Good point cyberheg, I didn't even think of that. I think you are probably correct. He is probably allocating a local character array, and this is how the compiler builds it in the program.

Obviously he wouldn't be handcoding the asm instructions ! Thanks for your input :)

-nt20
jsteed
07-03-2002, 04:28 AM
Take a look at the serial number registration routine (00448DA0). It is a model of obsfucation. It is really a very simple substitution cipher with a modular division after that. Only the first 5 characters of the reg. number are checked. All the hash table calculations that are carried out in this routine are unnecessary!:D
jsteed
nikolatesla20
07-03-2002, 01:59 PM
Thanks for the information, jsteed.

Unfortunately, keygenning is not really one of my stronger suits :( Sometimes I just get lost in the ASM.

Also, can you tell me, if the program is keygenned, does it still check for precense of SI and WinDasm, etc?

That's a good reason to unpack it, to remove these stupid checks. Hands off my system !!!

-nt20

Attn Shareware authors:

*I reserve the right to remove your virus "protection" from my system*
jsteed
07-03-2002, 03:24 PM
Giving the program the correct registration number does not disable all the debugger/disassembler/monitor checks. It simply gets rid of the 31 day limit. IMHO removing aspr and the security checks takes much more effort than the keygen reversal, so I'm sure you can do it easily. Here are a few hints. If the name you type into the registration box is less than 20 characters then the program makes a string with the name repeated over and over again until there are at least 20 characters present. This is the loop at 00448E3B. The next loop at 00448EFC is the simple substitution cipher based on the new name string. The outer loop at 00449001 is where the modular division takes place. The inner loop is where the unecessary hash table is filled and can be ignored. The final registration number is created in the call at 00449142. This call is also full of unimportant hash table filling and other useless calculations. In fact if you look closely at the results of the modular division and the output of that call I think you will easily see the pattern. You won't even have to look around in the call at all.
The programmer took incredible pains to protect his program, but made one incredible error. After the registration number is calculated in the routine at 00448DA0, It is compared with the registration number that was entered with a simple cmp instruction. What an amazing blunder!;)
Try keygenning this one, it's very good practice.
jsteed
jsteed
07-03-2002, 03:35 PM
I almost forgot to ask, dose this program phone home? Looking at the RegMon output, it appears as if it trying to communicate with someone. By the way, the RegMon ooutput shows where the secret entries are for this program. They are not removed when the program is uninstalled and contain encrypted information about whether the program is correctly registered and when it was first installed.
jsteed
foxthree
07-03-2002, 03:57 PM
The best way to detect whether the app calls home would be to run the program in the presence of firewalls like ZoneAlarm/ BlackICE ;). They'd immediately indicate whether the application is accessing your network ... which you can conveniently deny (if you intend to).

Another way would be to see if the application has imported WinSock Calls. However the clever programmer might use GetProcAddress ... (dynamic linking).

Yet another way would be to hook WinSock calls in the target and see if they're triggered anywhere. Obviously, a graphic program like MilkShape shouldn't make any network connections... but who knows :(

Signed,
-- FoxThree
jsteed
07-03-2002, 04:13 PM
Thanks Foxthree.
Yes indeed, it does try to phone home to: 64.136.8.130: pop3 The protective layers in this program just know no end.
jsteed
foxthree
07-03-2002, 04:48 PM
POP3 is the old "insecure" mail protocol for downloading mails. Interesting... Why does the application intend to talk POP3. What does a traffic grab say? It might have some interesting data... like "u-know-what" :D

Signed,
-- FoxThree
nikolatesla20
07-03-2002, 07:30 PM
I reverse queried that IP and yes it says it's a pop server.

I have no idea why the program would do that - um, when does it do it, when you click "register", or when the program starts up?

Like I said, protections are a virus...

-nt20

*ahem* it's repackaged already *ahem* so its a little late..

;)
jsteed
07-03-2002, 10:52 PM
The program automatically tries to phone home. It will only do so if it is or thinks it's registered. No user actions are necessary. I think it sends the file info.txt. It contains encrypted info. I will decrypt it and let you know what sort of data is sent.
jsteed
jsteed
07-04-2002, 01:25 AM
The info.txt file contains the version number of the program(?), the date the file was created X2 and the registration name and registration number. The encryption routine is diiferent from that used to calculate the registration number. It can be found at 0040E530. ;)
NT20, did you find the delayed SI check? It occurs at random times after the program has been open for about 30 sec.
jsteed
nikolatesla20
07-04-2002, 01:33 AM
It shouldn't matter how often it tries to detect SI..., in my unpacked file I removed most of the detection methods. For example, I recoded the NTICE and WINICE strings to XTICE and XINICE. Therefore, meltice checks will not work, for example. Plus I patched all of the exitprocess calls that the program tries to make when it detects a debugger.

However, I did neglect to recode the FROGSICE string, but I never use FROGSICE, it sux. Crashs my win98 computer, and it doesn't work on win2k when I tried to use it before either.

I've used the unpacked version on my machine with SI naked (without using ICEDump), and it doesn't detect it, last I checked anyway....

That whole pop3 thing is a bunch of crap if you ask me. Bastards, doing stuff behind your back. That's called spyware, and they deserve to be *racked then.

-nt20
nikolatesla20
07-04-2002, 01:46 AM
LOL

Oops I just thought of something - I patched the strings with an X - and if I remember Spl/\j's little guide to patching SI in win2K to not be detected he used ascii x's.

haha so if anyone followed his directions and is running SI, my version of MilkShape might still detect it...:P

oh well, little details :)

-nt20
disavowed
07-04-2002, 06:29 PM
Originally posted by nikolatesla20

I remember reading once that an idea for Win98 would be to simply check the autoexec.bat file for the Softice run command.

i'll take the credit for posting that ;)
(2 or 3 years ago, probably)
ftw
08-13-2002, 03:57 PM
Originally posted by jsteed
Take a look at the serial number registration routine (00448DA0). It is a model of obsfucation. It is really a very simple substitution cipher with a modular division after that. Only the first 5 characters of the reg. number are checked. All the hash table calculations that are carried out in this routine are unnecessary!:D
jsteed

hmmm...
Are you sure you accomplished what you think you did?
Did you set your date ahead by 31 days? And did the
proggie still act like it was registered when you started it?

I 'fixed' Milkshape3d ver 1.5.7 quite awhile ago,
nopping 2 bytes makes it think/act like it's registered.

But after reading this thread on ms3d v1.6.0, I decided to go back and
try some other 'fixes' on my v1.5.7

I first set about making the 30 day countdown restart
without patching the proggie itself.
Accomplished that fix, found the registry values that needed to
be deleted.And found a file in the WINDOWS\SYSTEM dir, that needed
to be deleted.

Then I set out fishing for the serial.I didn't follow the code
that created the serial key, the asm was hurting my little mind.
But I could see the simple code that was comparing the 'real' serial with
my made up serial.And it did only check the first 5 characters of the serial.
Although it does also check that the length of 2nd part of serial# is 6,
and the 3rd part of the serial# is length 7.

So I input the correct code(the 5 characters created by the proggie and the rest
I made up) and the proggie acted like I registered it and thanked me.
But when I move ahead the date on my computer by 30 or more days and I
restart ms3d it comes up with a dialogbox that says something like "You seem to have registered after this proggie expired!Please run ms3d for 2 minutes...blah blah"

And I had found this on Milkshape's Bugs forum, written by the author
of the proggie(some people were complaining about getting the above dlgbox message).
QUOTE START
"Hi,

it doesn't matter, if you register before or after the trial period. The 2 minutes thing is only to confuse hackers and it seems to work, since there is no working keygen out there ;-) "
QUOTE END

So I'm thinking that the rest of the real serial# is needed and is created and
checked somewhere else in the proggie,
probably when the app starts up, I've been looking but can't find it.

So when you followed the serial# generation code did you see it create the other
parts of the serial# besides the 1st 5 characters ?

Please let me know if you did in fact get a valid serial#,
if it worked for you then I'll look more into the serial# generation code,
otherwise I'll keep looking elsewhere.

Thanks,
ftw
stealthFIGHTER
08-14-2002, 09:59 PM
Milkshape 3D v1.6.3:

I've registered Milkshape (not unpacked) with fake (as author said) serial (format: xxxxx-xxxxxx-xxxxxxx). Then I've set my date month ahead and when I run the prog. bla bla message (as ftw said).

I used CreateFile breakpoint to break once the prog. reads the info.txt and came here:

0167:0044992C 8A0D52F64E00 MOV CL,[004EF652]
0167:00449932 50 PUSH EAX
0167:00449933 33C0 XOR EAX,EAX
0167:00449935 52 PUSH EDX
0167:00449936 A053F64E00 MOV AL,[004EF653]
0167:0044993B 33D2 XOR EDX,EDX
0167:0044993D 8A154DF64E00 MOV DL,[004EF64D]

You can see registers CL, AL and DL being filled with some values.
This value is '0' or '1' (probably True/False).
So I've changed values in these registers (at programs startup) to '1'.
And once I restared the program ... huh ... program is fully registered, no silly messages. I also tried to set the date ahead and it is still registered.

The last 4 values in info.txt were also been changed (by the prog.).

Regards,
sF
jsteed
08-15-2002, 04:02 PM
Yes, the keygen I made worked whether I set the clock 30 days or 5 years ahead. Perhaps 1.57 is slightly different in how it uses the serial number.
SilberFuchs
09-26-2002, 05:55 PM
on this prog:

i made a "CC" at normal Entrypoint, switch to Sice: bpint 3,starting the prog, but Sice is not breaking!
okay, i found the CRC in the MSMODELLIB.dll (this dll kills the execution of the .exe)

i made a "CC" on EP of MSMODELLIB.dll and when i start the exe, first Breakpoint reached is the CC in the DLL. Ok, bypass the CRC and Sice breaks the nexttime on "CC" (EP) of the EXE.

Question:
How it is possible, that the MSMODELLIB.dll is executed before the .exe??????....
in other words: when i start the exe, i expect to break with sice on Entrypoint of the EXE, not on the Entrypoint of DLL.

any idea?

ciao
SilberFuchs :)
foxthree
09-27-2002, 03:25 AM
Hiya:

You need to look at Dll Initialization by the Windoze OS ... specifically DllInit(...)

Signed,
-- FoxThree
figugegl
09-27-2002, 01:57 PM
Originally posted by jsteed
Yes, the keygen I made worked whether I set the clock 30 days or 5 years ahead. Perhaps 1.57 is slightly different in how it uses the serial number.

are you sure of that?

i keygened the latest version of milkshape (1.6.4) and it checks ALL THREE PARTS of the serial. the first check is only there to let us think it's fully registered :). after the success message it tells you to restart the program. then there is a startup nag telling us to run the proggie for at least 2 minutes. and it's within these two minutes that the serial-checking is done.

it took me so long to reverse the app that in the end i decided to ripp the entire algo, including all the unnecessary code. i've never seen anything similar before in a 20$ app. the programmer must have spent days on this protection. unbelievable! it's a pretty successful protection, as there are many nonworking cracks available for this proggie :)

unfortunately i didn't search this forum, it would have saved me a couple of hours. i already wrote a (german) paper on how to make a working dump and i'm thinking of writing another one to explain all the different anti-xxyy tricks.
jsteed
09-27-2002, 04:47 PM
figugegl,
Yes, I'm sure. Setting the clock ahead had no adverse effect. Also, I never saw the nag message that says wait 2 minutes. I removed the program from my computer long ago, but the version I looked at was 1.60. I agree that the efforts the programmer took to protect his software were incredible. He must be a very paranoid individual. It sounds as if his protection scheme is very much a work in progress. If I have time this weekend, I will take a look at version 1.64. I assume I can download a trial version. From your investigations, can you determine if the only added protection is the additional serial check?
By the way what happens after the 2 minutes expire?

jsteed
figugegl
09-27-2002, 08:57 PM
jsteed:
i haven't cracked other versions than 1.6.4. i found a tut from an older version (1.5.x if i remember correctly) and it was a simple three-byte patch. must have been one of those non-working releases :)

some of the nice tricks the app uses (as already mentioned in this thread):

* meltice
* checks "winice.exe" in autoexec.bat
* checks uninstall string in registry
* fake strings in exe
* crypted strings (lame algo though)
* frogsice, w32dasm detection
* regmon, filemon detection - but i didn't find the strings in the exe, only in memory. i've patched my filemon/regmon anyway, so i don't care :)

to detect the crypted strings, i wrote a little proggie that scanned the entire exe.

when registering, the app reads the serial and checks the first part. if ok it encrypts name, serial, installdate and some more infos and stores a string in the registry (3 times), in a txt-file and appended at the end of a dll. for unregistering the app you have to delete all of them.

after restarting the programm there's this nag telling us to run the program for at least 2 minutes. after maybe 20 seconds the first part of the serial is checked, 20 seconds later the second part, then the third part and finally the format of our name.

the main problem is to find these checks. the algo for the two remaining parts is trivial. the first part is very long, i haven't reversed it properly. but it might as well be similar to the other two in the end. i was too tired to do more reversing, and i ripped the entire code.

if all is ok you are allowed to save and export you work. otherwise the proggie complains, but only after the trial period has ended. when starting the program, it always asks for the two minutes. when properly registered, this is not the case anymore.

i haven't seen any crc-check, my dump (size = 1164 kb) runs fine. the only thing i did was to patch the annoying sice-checks. but that's not even necessary when icedump is running! a messagebox appears ("there's a problem with your system debugger, please read the faq! closing..."), we simply ignore that and DON'T close the messagebox. the program works fine anyway :)
jsteed
09-27-2002, 11:06 PM
figugegl,
Yes, those checks are all in version 1.60. However, I'm surprised you were able to patch the program and run it. The CRC check is in a dll named MsModLib.dll. A bpx PostQuitMessage allows you to find the routine that needs to be patched to bypass this check. If you are patching the program in memory, I guess you will never have to bother with this check.
I'll download the program this weekend and have a look at the new serial checks.

jsteed
jsteed
10-02-2002, 04:42 AM
I took a look at version 1.64. The blunder of having the 1st part of the serial in plain view is repeated for the other two! Nothing like consistancy.

Here's how to find the serial and make a key gen. First I found the piece of code that makes the first part of the serial. It is at 0044CFA0.
* Referenced by a CALL at Addresses:
|:004040CA , :0040CC55
|
:0044CFA0 6AFF push FFFFFFFF
:0044CFA2 64A100000000 mov eax, dword ptr fs:[00000000]
:0044CFA8 680B0A4900 push 00490A0B
:0044CFAD 50 push eax
:0044CFAE B818100000 mov eax, 00001018

Notice that there are 2 calls to this function. The first is to check the serial you enter via the About box. The comparison between the 1st 5 characters of the real serial and the one we enter is done at:
:004040E0 8A17 mov dl, byte ptr [edi] ;real serial
:004040E2 8ACA mov cl, dl
:004040E4 3A10 cmp dl, byte ptr [eax] ;our serial
:004040E6 751C jne 00404104
:004040E8 84C9 test cl, cl
:004040EA 7414 je 00404100
:004040EC 8A5701 mov dl, byte ptr [edi+01]
:004040EF 8ACA mov cl, dl
:004040F1 3A5001 cmp dl, byte ptr [eax+01]
:004040F4 750E jne 00404104
:004040F6 83C702 add edi, 00000002
:004040F9 83C002 add eax, 00000002
:004040FC 84C9 test cl, cl
:004040FE 75E0 jne 004040E0

The second call at 0040CC55 is used to check the serial after 30 days. Enter a serial with the 1st 5 real characters. Set the clock ahead by one month and start the program again. We see the "wait two minutes.." message. Set a bpx on 0040CC55. After about 20 sec, SI breaks so we know we are in the delayed checking routine. The actual check is done at 0040CC94. Now we need to find where the other two pieces of the serial are checked.
Looking at the disassembly of the code around 0040CC94, we find that at the same serial checking code at 0040CD86, (2nd part), and at 0040CE38, (3rd part). The code to create these parts are in the calls just above the checks. They use nearly the algorithm as the 1st part but do not contain the obsfucation code.
There is a delay of about 20 sec between each check.

A note for all the Asprotect afficienados, (version 1.2). I could not use Imprec or Revirgin to rebuild the IAT. I had to do it manually. Imprec gave me an error saying that there was not enough space to add a new section. The dump is 53 meg. Is this a limitation of Imprec, or am I doing something wrong here? I had no problem using Imprec with version 1.60, (52 meg). Revirgin would add a new section but it was corrupted and did not properly point to the correct addresses. Once again, is this a size limitation or another dumb mistake on my part?

All in all, this is a fun target. The author has really gone the extra mile to protect his program, but even so, his mistakes make it fairly easy to reverse. In addition to the serial in plain view, there is also a simple 2 byte patch to bypass the serial check.

Cheers, jsteed
Stone()
10-02-2002, 10:49 AM
No no error of Imprec or RV, add with a Hexeditor 1000h bytes of zero's to the last section and Imprec will write the Import table.

Don't forget to adjust then the gneral Image size afterwards with LordPe.

Dump 53 Mb? Yes, but I would save each section to disk then cut all the 0's from the 3rd section, then it will shrink to 368 Kbs, glue everything together, realign, add the 1000h bytes to last section, uncheck 'add to last section' enter the RVA (VOffset of last section) for the Import table and it should work.
jsteed
10-02-2002, 05:02 PM
Thanks Stone().
The 0 bytes are just what was needed. First I realigned the file with LordPE. That reduced the size to a respectable 1.1 meg. Then I added 2k of 0 bytes -- it's a large IAT. Now Imprec has no problem adding the IAT. :)

jsteed


destroying a Symbol table
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > destroying a Symbol table
PDA

View Full Version : destroying a Symbol table

lowrunner
06-25-2002, 11:18 PM
Has anyone come across a utility that can destroy/strip/remove a symbol table under win32?

besides cygwin/strip

thanks
NervGaz
06-26-2002, 02:03 AM
borland tdstrip... but it's for td so i'm not sure if it works for other symboltables


W32Dasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32Dasm
PDA

View Full Version : W32Dasm

salsa
06-26-2002, 11:16 PM
w32dasm cuts off part of the disassembly when working on some of the unpacked progies. Ollydebug, on the other hand, works successfully and I can get the missing parts together with the strings complete. I don't think I am doing sth wrong while unpacking because, the program runs fine after rebuilding (and setting the characteristics of the first section as executable).

Working with w32dasm is more comfortable for me because, I can follow calls, search for pushes and blocks of bytes, etc.

What may be the remedy for it?

Thx
wbe
06-27-2002, 06:58 PM
May be you're running short on memory. Give your w32dasm some more memory. That may help.
Kayaker
06-29-2002, 07:40 AM
Hi,

Unfortunately you didn't give quite enough information to be able to use to help answer the question. What do you mean exactly by - cuts off part of the disassembly? Does it cut off addresses that are within the executable .text section, or addresses in higher memory that are part of another section? Or do you mean that some strings are missing in Wdasm that Ollydebug picks up? An example of what you mean would help.

If this is a standard re-fried smoked and cured Asprotect Delphi app we're talking about, then Wdasm never gets all the Delphi strings anyway, but DeDe should if it can open up the rebuild.

Wdasm normally disassembles any section with the Code characteristics set to Executable, so you could in theory disassemble every section this way. But I'm not sure if that's what you mean. If the StringRefs from Wdasm are missing, there may be an error in a pointer to the resources in the rebuilt file, but Ollydebug recognizes the resources in a different way.

Wdasm has a known bug with Named resources as it is. "Named" resources are ones specified by the programmer, and differ from the pre-defined types such as Menus, Dialogs, Accelerators, Strings, Icons, ... Undefined resource types can be put in RCDATA, but can also be specified separately as well. You should check that the .rsrc section is intact after the rebuild, open it with a resource editor such as Exescope and see if all the names make sense and you can actually access all the resources.

Don't know if this answered your question.

Kayaker
salsa
06-30-2002, 09:17 PM
Here is the detailed explanation:

w32dasm cuts off part of the disassembly (.text or .CODE) always towards the end (eg., I can't see the part after 00544afd to 551000).

However, this happens only after fixing the dump with ImpRec. I dump memory, replace "EBFE" with the original instruction, correct the OEP and disassemble with w32dasm. The disassembly is OK, strings are in place (if non Delphi), only imports are missing. Then I fix the imports with ImpRec and disassemble again. This time imports are there but the disassembly is incomplete (last 200 to 400 lines are missing). These symptoms are same for VB, Visual C and Delphi apps. And yes, they are all cured aspr apps and all work fine.

Kayaker, thanks for your descriptive reply and I'd like to thank every member of this board too. This place is a great informational resource.


APIHooking and ConsoleMode applications
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > APIHooking and ConsoleMode applications
PDA

View Full Version : APIHooking and ConsoleMode applications

foxthree
06-27-2002, 01:20 PM
Hello:

I have a small console application that I'm trying to reverse. I wanted to spy on what APIs that is is making at some "critical" point in code. So, I run APISpy on it but alas, APISpy Log shows nothing :(. Somebody tells me that APISpy kind of programs (which use Windows Message based hooks) will not work with Console mode applications. I understand the reason why.

But my question is is there any utility that can spy on Console mode applications' API calls also?

Signed,
-- FoxThree

* Edited by FoxThree *
Google search gave me a nice application called APIMonitor @ hxxp://xxx.rohitab.com :D Wonder why this one didn't turn up before I posted :confused:
oyang2002
06-28-2002, 02:55 PM
Why not use Numega's SmartCheck?
nikolatesla20
07-01-2002, 08:34 PM
According to some documentation I was reading, some API hooks install their DLL by injecting it using a registry key - that only works with console apps if they import USER32.DLL

So if the app isn't packed, maybe try just adding an import from USER32.dll (like messageboxa)- just throw it in the IAT table even tho it won't be used, this imports the DLL into your mem space - and then try running your APIspy again to see what happens?

Just a thought.

-nt20


Announcement: New software protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Announcement: New software protection
PDA

View Full Version : Announcement: New software protection

ramon
06-28-2002, 10:38 AM
Software guards could help fight piracy :)
--------------------------------------------------------------------------------
posted 8:49am EST Thu Jun 27 2002 - submitted by Matthew
NEWS
Researchers at Purdue University have created a new piracy deterrent in the form of software guards. These guards are very small programs that run within a piece of software, performing a number of different tasks to help maintain the integrity and security of the software in which they are embedded. The amount of guards a piece of software has can range from a handful to hundreds, all performing different tasks and placed in different areas of the software.

Pirates usually bypass software security and then produce key generators or patches that allow other copies of the software to be cracked as well. If software guards were used then the pirate would have to bypass each one before the software was accessible. This is made even more difficult because guards can be set to look at certain areas of code, and if the code has changed from what the guards know it should be they can change it back, creating a form of self healing software. This means a pirate could bypass a single guard, continue to the next guard, and return to find that the guard has fixed his earlier work. If there are hundreds of guards implemented in a piece of software it would be an uphill struggle for even the most determined pirate.

The guards are being programmed to undertake tasks that include obfuscation, encryption, check summing, anti-debugging, and anti-emulation, allowing a piece of software to be resilient against a whole range of attacks, but with the added security of a distributed defense. Each guard is very small in terms of program size, and their use of resources is minimal.

The technology has created an offshoot company called Arxan Technologies, which is currently in the testing stages with the system on the Windows platform. The end product will be marketed for software vendors, games publishers, and governments initially.

PS: UUoooooOuuhhhhhhhh another good challenge !!!!
Ramon
banshee
07-13-2002, 01:56 PM
Remember when Star-Force CD Protection was firstly implemented it was "unbreackable". What we see now?
There is more advertisements but who can predict what happen to such protection. Let's wait...;)
Hwoarang
07-13-2002, 10:38 PM
nothin' really concrete there...they talk about software guards like they were some kind of creatures who protect the castle...it sounds really crappy and imho those software guards are some stupid threads doing crcs and overwriting code..nothing really new there

bleh..just my 2 cents


Ring
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Ring
PDA

View Full Version : Ring

SilSaLaMaTa
06-28-2002, 12:56 PM
hi,
can anyone tell me what is rings ?? and what is the diffrent between ring0 and ring3 or ... ?
tgodd
06-29-2002, 05:34 AM
Rings are Privilege levels.
Thes levels are ring 0 - being of the highest privilege (typically the kernel, but in some cases in embedded systems only the Hardware abstraction layer), ring 1 - for system services, ring 2 - for custom extensions, ring 3 - Application level.

Rings of lower value can access any memory defined by a descriptor of higher value, but not the other way around.
There are some instructions which are/or can be flagged to be privileged instructions ie. halt, clts, lgdt, etc.

Memory descriptors which are in fact very different from segments, have 2 bits which defines the DPL (Descriptor Privilege Level).

Truthfully you should get a-hold of some intel manuals which define descriptor tables, and task state segment, etc.

Regards,
Clandestiny
07-03-2002, 03:05 AM
Hiya,

Here's a couple of articles about the GDT / callgates that may answer a few of your questions about ring privalege levels.

(General info & terminology about privlege levels)
http://ivs.cs.uni-magdeburg.de/bs/lehre/wise9798/bs2/seminare/privilegien-eng.shtml

(Protected mode & GDT stuff dealing with rings)
http://www.ganssle.com/articles/aprot2.htm

(Using callgates to execute privaleged code for NT)
http://www.windowsitlibrary.com/Content/356/10/1.html

Cheers,
Clandestiny
SilSaLaMaTa
07-03-2002, 09:09 AM
thanx , that was very intresting for me :)


new crackme challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > new crackme challenge
PDA

View Full Version : new crackme challenge

ZaiRoN
06-29-2002, 07:32 PM
hi all!
the mini project area is very poor in this last days; i think many of us are working hard wih exams or maybe ... are always at the beach :)

btw, for those who are here and want to throw in a new little crackme-challenge, here is the link from which you can download the proggie: hzzp://www.lockless.com/products/L01_CM2.zip

the crackme is serial-based and you have to reverse a little algo.
the crackme has some anti-sice, anti-bpx, anti-disassemble trick, very easy indeed but a newbie (that had never seen it before) could have problems. this is the right place for learn something new so if you have problems don't hesitate to ask.

you can solve the crackme using only sice but i would like to suggest you another task.
you can't disassemble correctly the file using windasm. that's because Bishop has done some changes on the pe header.
your task is to make the file viewable correctly with windasm (you have to view correctly: references, imported functions, etccte).
it's not very difficult but you have to do some adjustments with pe header...expecially with sections!

if you don't know nothing about pe format, here is two refs that could help you:
- Iczelion's pe format tutorial
hzzp://win32asm.cjb.net/
- pe file formats offsets
hzzp://insel.heim.at/madeira/340943/Tuts/tut_pe.htm

ok, that's all.
good luck!

ZaiRoN
SilSaLaMaTa
06-29-2002, 07:57 PM
hi
I can't run the crackme !
Error message says that its not a valid win32 application , is it a part of cracking ??
_Servil_
06-29-2002, 11:27 PM
HI
what about the solution, does serve for my purpose only?
maybe we could compete for some tour to beach
ZaiRoN
06-29-2002, 11:51 PM
SilSaLaMaTa: the crackme has an anti-sice trick so if you run the crackme with sice runnig it will crash. try to trace from entry point and see what happen:)

_Servil_: you have just done it? if so, i think you can give to other people some time to work on it and try to help who has problem.
anyway, this is only my opinion...you are free to post your solution whenever you want:)

bye
ZaiRoN
SilSaLaMaTa
06-30-2002, 11:02 AM
But it's not crashing , I tried ollydbg too , but sais "unable to start" . I put a CC on PE OEP , and then bpint 3 in sice , but sice didn't break . I think windows didn't jump to OEP . (i'm using XP , did u test the crack me under XP/2K ?)
ZaiRoN
06-30-2002, 11:14 AM
hi SilSaLaMaTa,
sorry but i can't help you because i'm only using w98 with this type of things and i can't try it on win2k or xp.
as i said before, Bishop as done some manipulations on the section header; could it be that :confused:
try to repair it...

ZaiRoN
Acid_Cool_178
06-30-2002, 03:28 PM
I'm running on windows XP and it crashes... Havent ran any PE utilities on it and the structure on the crackmes from BiSHoP have been abit weird...

The crackme is coded in asm so it will be pure right on target, but how to get the crackme running is the first approach right now...

Any ideas ?

Does it run udner, Win95,98/WinNT 4/2000/XP ??

Acid
Bengaly
06-30-2002, 11:44 PM
hi all, zairon/acid_cool..etc

the crackme runz fine under Win98SE.
about the imports not showen in w32dasm,
just load up LordPE and view them there, or just look in ur fav hex editor.
well win32dasm dissasemble from 00000C00 which is the variable's data pointed from the ".data" section.
i dont think we should dissasemble that.
apperantly it seems that the code it selfs starts at offset 00000400 (WinHex) till 0000067C.
mostly the code is pointed by the ".text" section, try play with it abit, (but prepare for massive currupts ;P )
trying to poiting to this from the section will make w32dasm dissasemble the place, but hey it doesn't run..weee ;), i think its either a metter of redirecting and size fixing of section or u should debug from there. [ no sice installed hee]...
cya all
NervGaz
07-01-2002, 01:59 AM
here it is for your viewing pleasure... fixed up the sections and stuff so it should run on any windows system... but it will crash... just change the entry point to 1020 and it will run flawlessly... no tutorial on what is done 'cause it's pretty obvious stuff...
SilSaLaMaTa
07-01-2002, 11:40 AM
hi ,
I dumped the file and set the section flags , prog runs , but I don't know what to do in this level ,
w32dasm doesn't show string refs . I compared the PE with fixed one (NervGaz file), the PEs was same except Virtual
and Raw Offsets ... How to fix it ?
ZaiRoN
07-01-2002, 12:07 PM
hi SilSaLaMaTa,
there's no need to dump the file...
why you have made it? (i'm just curious :))
the only thing you have to change in each section is the characteristics_flag.
have you put *correctly* the section in the right order???

ZaiRoN
SilSaLaMaTa
07-01-2002, 12:55 PM
I dumped the prog and then fixed the sections order but u r right , no need to dump ! I thought that whole of file is crypted :P
and I didn't know that section names r important for w32dasm !
Learnt some thing , thanx .

but why w32dasm can't show the dumped file ? I renamed the sections , and fixed the order . but no resault ...
ZaiRoN
07-01-2002, 01:36 PM
i don't know SilSa...i'm not in front of my pc and i can't try to dump the file.

there's only one more thing to do now: find the serial!
someone has tried!?!

ciao,
ZaiRoN
SilSaLaMaTa
07-01-2002, 02:56 PM
here I attached the dumped and fixed file . w32dasm can't show the string refs...
tgodd
07-01-2002, 02:59 PM
you could set a bpx at text + 010f

:p
tgodd
07-01-2002, 03:04 PM
I rarely if ever try to set a Break on the first instruction of a sub or Program. A coder can be tricky, but a reverser even more so.
:D
NervGaz
07-01-2002, 04:11 PM
as far as the serial goes the only way i can figure out how to get it is bruteforcing it... but a patch would be really easy to do...
NervGaz
07-01-2002, 05:26 PM
I didn't feel like reversing the algo completley when i just as well could write a simple app to generate the correct serial when i had figured the lgo out... anyways i uck at writing tutorials and stuff so here is the serial generator (not really a keygen but anyway) with source... i moight write something later on... btw the anti SICE stuff in the beginning crashes under win2k
ZaiRoN
07-01-2002, 06:03 PM
hi NervGaz,
good work! i think (like you) that the only way to find the serial is the brute-way...
btw, your solution is incomplete :p
try to put those two serials and see what happen:
23876228, 2003587716
how could it be possible? :D :p :D

ciao,
ZaiRoN

ps. there are manymany valid serials...
NervGaz
07-01-2002, 06:15 PM
i know ... my program just genrates the first valid... if you want all of them just comment the "invoke ExitProcess,NULL" inside the while loop and change the push pop saving ov eax to a register save instead kinda like save = mov edi,eax restore = mov eax,edi or whatever....i'll rewrite it to calculate all the valid serials nd display them when i get some time over
ZaiRoN
07-01-2002, 06:21 PM
oh yeah, you are right but...there is an easy way to solve the problem.
try to take a deeper look at the algo. (hint: 401217)

ciao!
_Servil_
07-01-2002, 06:41 PM
HI

the serie has an evenness
any valid sn should look like this
SN = 0x6C5284 + Cntr * 0x1000000;
and cntr is any integer to 256

think about the only way to get this is analyze the serie 'coz it's over my possibilities to parametrize the snchecking func :o)
NervGaz
07-01-2002, 07:04 PM
Zairon, didn't quite figure out what you ment by your last post but in any case i've rewritten the generator so now it generates every valid serial ranging from 1 to -1 and writes them in a textfile... haven't bothered to check them all but they should work except fro the negative ones... and it takes about 4 minutes to calculate them all.. i wont post this one since it's pretty pointless... it's an easy rewrite to do your self... ignore that negative thing.... just me messing wspintf up...:)
ZaiRoN
07-01-2002, 08:09 PM
the serial checking routine takes the serial in hex format and works only with the part of it.
an example may help you...(i hope:))

004011FE MOV EBX,EAX <-- ebx = hex value of your serial
...
00401217 SHL EBX,8 <-- 8 bits shift on the left

the point is in the shl instruction.
look at this:
if you have ebx=00123456, after shl_8 you'll have ebx=12345600
if you have ebx=00FEDCBA, after shl_8 you'll have ebx=FEDCBA00
if you have ebx=00001234, after shl_8 you'll have ebx=00123400
everything is shifted by 2 position.
in our case, the first valid serial (in hex) is 0x006C5284. after the shift operation, ebx=6C528400.
so, if you have a serial like 0xZZ6C5284 (where ZZ is in 0-FF range) you'll have always ebx=0x6C528400 after the shift operation.
finally, ebx (after the last "xor, bl, sh" operation) is used in the loop but it's NEVER modified!
that's the point ;)

ciao!!!
NervGaz
07-01-2002, 10:51 PM
damn completly missed that.... heh... oh well


ASPR G-Lock Software
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR G-Lock Software
PDA

View Full Version : ASPR G-Lock Software

LaBBa
06-30-2002, 09:05 AM
hi all
the target i try to unpack is :

mirror1.glocksoft.com/aatools.zip
AA Tools 5.12

OEP : 6c5cdb
Image Size : 3e6000

well i have unpack it and rebuild it With ImpREC and what i got was a working file !! but when i try to run the prog i got first a msgbox (i gess they used a GetLastError shit) that there is and Access violation in address : 404eDF so i set a BPX there and i saw a loop of
cmp CL, [EDX]
jz
...
..
the loops start at : 404ed8

when it get to edx= 1ccb120 the prog Crash (msgbox) and after that the prog continue .. but that is not all in the About menu if choosen there is also a Crash (msgbox) ...
:/ .. i tried Patching the loop that didn't help ..

so plz any1 that could help about how to fix that ...
tnx ...
BTW : sorry that i didn't used Revirgin.. i'm used to ImpREC ...
foxthree
06-30-2002, 06:41 PM
LaBBa:

I'm not too sure but I think, that mem area contains the Hardware ID calculation/decryption routines/data. That is why it happens in both startup and on click on About. Now that you've removed ASPR, the code is not present and hence the above message. ASPR uses SetUnhandledException Filter (and not GetLastError()!!!).

Okey, patching the loop is the wrong way to go. If you set a BPMB on 1A93861 Rw and 1ABABC4 RW you'll see how many times it breaks. To me, I think it all has to do with the CALL at 409823.

See if this helps.

Signed,
-- FoxThree

PS:
I have a small question of my own though:

This I belive is the loop code:

<CODE>
017F:00404EDA 85D2 TEST EDX,EDX
017F:00404EDC 7421 JZ 00404EFF 
017F:00404EDE 52 PUSH EDX
==> 00404EDF 3A0A CMP CL,[EDX]
017F:00404EE1 7417 JZ 00404EFA
017F:00404EE3 3A4A01 CMP CL,[EDX+01]
017F:00404EE6 7411 JZ 00404EF9
017F:00404EE8 3A4A02 CMP CL,[EDX+02]
017F:00404EEB 740B JZ 00404EF8
017F:00404EED 3A4A03 CMP CL,[EDX+03]
017F:00404EF0 7405 JZ 00404EF7
017F:00404EF2 83C204 ADD EDX,04
017F:00404EF5 EBE8 JMP 00404EDF (JUMP )
017F:00404EF7 42 INC EDX
017F:00404EF8 42 INC EDX
017F:00404EF9 42 INC EDX
017F:00404EFA 89D1 MOV ECX,EDX
017F:00404EFC 5A POP EDX
017F:00404EFD 29D1 SUB ECX,EDX
017F:00404EFF E9D4FEFFFF JMP 00404DD8
017F:00404F04 C3 RET
</CODE>

At PUSH EDX, the EDX has values like:

"Microsoft wsock32.dll, ver2.2, 32bit of Apr 22 1999, at 20:29:32", the logon username, machinename, prog ver 5.12 and prog ver and build no. 5.12.0.950. What the above loop do with these values? It seems to construct strings like
"Moto21e22 A29 29.raTNCIWeo" (which is every 4th char in the first string). Hmm, where does all this go? To calc. Hardware iD?
Solomon
07-01-2002, 02:19 AM
I ever successfully unpacked AATools(maybe not the latest build). This prog just gets registration user name and hardware ID from ASPR with ASPR API. If the name is empty, you will get a unregistered version, otherwise it's a registered ver. So, just as what foxthree said, if you unpack ASPR, it will crash when it tries to get the necessary strings from ASPR. Just patch this and hard-code your name to the unpacked EXE, you will get a fake registered version. I think some functions can be enabled only when you have a real key, please check the context menu "copy to clipboard" in its proxy analyzer.

There is a working release xxxxxxxxx. I believe they unpacked this baby with a real key. Correct me if I'm wrong.:)
Lord_Soth
07-02-2002, 02:22 PM
Hey sol,

Wanna elaborate ? :-)

I haven't played with ASPR, what's this about an API ?

And how is the different keys "different" in your opinion ?

LS
MrMiniMe
07-03-2002, 10:36 AM
well i havn't saw before an ASPR HW ID .. Nice!!

but i didn't saw any answer about how to fix it ...

Does any1 know how to fix that kind of thing ??
phop007
07-05-2002, 05:10 PM
:D I also successfully unpacked aatools 5.0 (old build) but not the last version. Fortunately I found the unpacked+cracked version on the net (xxxx) and It fully working. Never busy with it again.


Win 9x --> WinNT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win 9x --> WinNT
PDA

View Full Version : Win 9x --> WinNT

Acid_Cool_178
06-30-2002, 03:31 PM
In the "Mini Project" there is a new project on BiSHoP's seccond Lochless crackme.. I guess that it only will run under win9x.. Is there any tools for getting it to run under winNT..

Or the better choice, anyone got any references on hot to convert it manually from win9x into winnt..

Acid
NervGaz
07-01-2002, 02:06 AM
compare it to the fixed one i've posted in that thread... it's pretty easy stuff, just fix up the sections... characteristics and some other things are messed up...


armadillo 2.60
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > armadillo 2.60
PDA

View Full Version : armadillo 2.60

kalisto
06-30-2002, 03:53 PM
Do anyone knows something about armadillo 2.60 beta-1 public build 1285.
How to get OEP? (signiture byte). This version is quite new.
Foxthree put it in OEP finder + suport for win ME.
Splay do you now something about this version.
;)
foxthree
07-01-2002, 09:23 AM
What's new in this version (apart from cosmetics, I mean). The entrypoint bytes are absolutely the same as in 2.5x. May be I just add new entry in Packer list :D.

Signed,
-- FoxThree
kalisto
07-01-2002, 11:23 AM
Well foxthree I play today with armadillo-notepad and find small difference in signiture bytes:
03F9 ADD EDI,ECX
E8 41EFFFFF CALL 008CF21B
50 PUSH EAX
FFD7 CALL EDI==OEP
armadillo 2.51(2.52):
03 F9 E8 A9(2D) EE FF FF 50
OEP finder won`t find OEP with old 2.51 - 2.52 signiture byte.
enjoy

:D
kalisto
07-02-2002, 12:38 PM
Ok I try to unpack notepad-armadillo but I don't know when to dump. I read something about writeprocessmemory, resume thread but still no idea where to set breakpoint. I know I must break after decryption routine when whole text section is decrypted and then dump file.
So I need some hint.
Cunegonde
08-08-2002, 03:33 AM
Hello!

What is this tool please ? I planed to write a similar tool, it seems that someone already did it ;)
foxthree
08-08-2002, 10:30 AM
... foxthree.cjb.net :)

Signed,
-- FoxThree


String Ref
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > String Ref
PDA

View Full Version : String Ref

golden_123
06-30-2002, 07:58 PM
HI

IF U DISASSEMBLE A EXE IN W32DSM89 AND ONLY A FEW LINES SHOW UP AND THERES NO STRING REFERENCES TO VIEW,WHERE CAN U GO IN THE PROGRAM TO VIEW COMPLETE DISASSEMBLE WITH STRING REF.
TY
SilSaLaMaTa
06-30-2002, 08:54 PM
try IDA :)
golden_123
07-01-2002, 04:20 AM
IDA WHAT? LOL SORRY NEWBIE
chdid
07-01-2002, 04:05 PM
Perharps this is a packed exe.

SO read tut on this. You will understand...
LOUZEW
07-02-2002, 06:48 PM
Right chdid !
but there is an other thing too :

Sections caracteristics are set to C0000040 or something like. You have to open the app with procdump or PE editor or LordPE etc and edit sections to set them to E0000020 (redable executable)

Maybe you can learn on PE files (search for Matt PietrekBook !)


vbox 4.5, trace X 6.025 & DreamWeaver 6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > vbox 4.5, trace X 6.025 & DreamWeaver 6
PDA

View Full Version : vbox 4.5, trace X 6.025 & DreamWeaver 6

chdid
07-01-2002, 04:02 PM
I have a pb with the last version of Dreamweaver 6.0 (downloaded on macromedia site).

I want to find the Oep.
So I use softIce 4.0, ICeDump 6.025 on win98.

I load Dreamweaver in softice loader and launch the program.
When softice break, I put tracex command as
/tracex <low eip> <high eip>

low eip is the base adress of the first section
high eip is the top adress of the first section

I wait for...

And softice crash (page default).

Anyone has a solution ?
nikolatesla20
07-01-2002, 04:08 PM
My suggestion is not to trace.

Put a bpx on GetVersion, and then when SI pops up , scroll up a little bit in the code window. If you see a normal stack frame being created (PUSH EBP, MOV EBP,ESP) followed by exception handler setup (PUSH FS:[0]) etc, you are most likely at the OEP.

THe OEP would be at the PUSH EBP instruction. This works for FlashMX. Now you can just put a bp on the OEP and then dump.

-nt20
chdid
07-02-2002, 10:29 AM
Ok fine,

my OEP is AF0E48

so, i pose a bpm AF0E48 X
dump the file as
/dump 400000 987000 c:\dump.exe

Now, i must rebuilt the IAT

I use revirgin 1.3 (fine tools, thanx Tshep!).

I launch original dreamweaver
I launch revirgin
I select the dreamweaver process

I put AF0E48 in OEP
I fetch the iat
push Resolve IAT
push resolve again

in unresolved, there is one link : in fact it is peekmessageA
I edit the link, replace 0700EDDF by BFF55801
Resolve again => ok, all is resolved

Push generated, give the path to my dump file.

revirgin, add a section with new IAT, and resolve the link to iat in directory.

But when i launch the dump exe, it crash, what's wrong ?:confused:

And a question perharps for tshep =>
when I push 'generate' in revirgin, the program asks me the dump exe, the path to it.bin and after it continues and show a message box "out of memory", windaube crashs ! what is the good way ?
:eek:
esther
07-02-2002, 11:24 AM
Hi chdid,
>Ok fine,

>my OEP is AF0E48

>so, i pose a bpm AF0E48 X
>dump the file as
>/dump 400000 987000 c:\dump.exe
>I put AF0E48 in OEP
>I fetch the iat
>push Resolve IAT
>push resolve again

>in unresolved, there is one link : in fact it is peekmessageA
>I edit the link, replace 0700EDDF by BFF55801
>Resolve again => ok, all is resolved

>Push generated, give the path to my dump file.

>revirgin, add a section with new IAT, and resolve the link to iat in directory.

>But when i launch the dump exe, it crash, what's wrong ?

Seems you didn't search the thread in the forum...theres lots of infos in the forum
I'm lazy to write ;D
http://www.woodmann.net/forum/showthread.php?threadid=3320

Did you remember to check with the pe-editor see if the oep is correct after
pasting the dump.exe file?

I have only problem when trying to push the "generate" the third time and it crashed windows otherwise it should be fine.

regards
Anticode
07-02-2002, 06:51 PM
i.e RawSize=VirtualSize and RawOffset=VirtualOffset for all sections?
chdid
07-03-2002, 03:19 PM
Thanx !

I don't fixed my dump....
haec_est
07-06-2002, 05:55 PM
... no that isn't the OEP, the right one is : 0x97f750

if you put a bpm on 0xaf0e48 you get

Break due to BPMB #0010:00AF0E48 X DR3 (ET=5.45 seconds)
MSR LastBranchFromIp=0097F763
MSR LastBranchToIp=00AF0E48

so look at 0x97F763 :

001b:0097f750 6a02 push 02 (this is OEP)
001b:0097f752 ff1508b2b900 call [KERNEL32!SetErrorMode]
001b:0097f758 68d0f69700 push 0097f6d0
001b:0097f75d ff150cb2b900 call [KERNEL32!SetUnhandledExceptionFilt
001b:0097f763 e9e0161700 jmp 00af0e48

:map32 400000
Owner Obj Name Obj# Address Size Type
Dreamwea .text 0001 001B:00401000 0079946A CODE RW
Dreamwea .rdata 0002 0023:00B9B000 0013436E IDATA RW
Dreamwea .data 0003 0023:00CD0000 0007E038 IDATA RW
Dreamwea .rsrc 0004 0023:00D4F000 00020D40 IDATA RO
Dreamwea PREVIEW 0005 001B:00D70000 00016414 CODE RW

iat rva : b9b000
len : b9cdf8-b9b000 = 1DF8

for the iat there are only 2 redirected call :

peekmessagea and getmessagea

next don't use the automatic Rv paste function because sometimes (v. 1.4 and 1.5) don't work, and set the rva to something strange as 24A50000, instead make the it.bin file and paste it manually :-)

regards,

haec_est


unpacking windows 16bit dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > unpacking windows 16bit dll
PDA

View Full Version : unpacking windows 16bit dll

[yAtEs]
07-01-2002, 04:10 PM
anyone know how to dump windows 16bit dlls from memory with softice? with an OEP @ CS:0 im not sure where the NE header goes, i know its hidding somewhere but cant find it inorder to dump a working dll, and no i dont fancy a cut/paste job or manual header rebuild (;

yates.


Flat button in Delphi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Flat button in Delphi
PDA

View Full Version : Flat button in Delphi

CccT
07-02-2002, 04:05 PM
Xplorex is a simple program that is essentially an additional start button in the top left corner. It's gray, without icon yet.

What and where must be added so that the button will stay flat on mousedown and mouseclick without a 3D border ?

object Form1: TForm1
Left = 0
Top = 0
BorderStyle = bsNone
Width = 32
Height = 32
OnCreate = FormCreate
Visible = False
object dirtree1: Tdirtree
Visible = False
end
object SecretPanel1: TSecretPanel
Left = 0
Top = 0
BorderStyle = bsNone
Width = 32
Height = 32
object RxSpeedButton1: TRxSpeedButton
Left = 0
Top = 0
Width = 32
Height = 32
Flat = True
OnClick = RxSpeedButton1Click
end
end
object FormStorage1: TFormStorage
end
end

XploreX :
http://www.exetools.com/forum/attachment.php?s=&postid=3248
Kayaker
07-03-2002, 02:43 AM
Hi,

That looks like it will be a handy little Delphi program when you get it finished, I see you've got your question answered on the other forum, looking forward to the final result.

I've looked and looked and can't see much project potential here, except for one important thing - this is a very small Delphi app - which makes it great for looking at the structural aspects of Delphi and how they are built into the PE file. It is difficult to reverse a Delphi app because the creation and look of most controls are handled on the fly in code. Access to the variables isn't as free in Delphi I find, it's difficult to patch in a few bytes or modify a variable without affecting something further on in the Delphi bloat (this simple 1 button app of 314Kb will attest to the bloat!

But you can make certain resource modifications if you're very careful. Even something like making an invisible control appear by modifying the PE file takes a little bit of study to see what bytes need to be changed. Making a more major change like making a control INvisible can cause problems because in theory you are supposed to ADD a line to the PE file - (Visible = False), but you can't do this without affecting the rest of the RCDATA form structure. You can use ResHack to recompile modified resource data, but a manual understanding of the Delphi structure can be useful.

You can sometimes sacrifice other components by using their space to add or change new features, for example, bitmaps are coded into the PE file as Glyph.Data and immediately follow the rest of the forms' Property values. They can be resized (smaller) so you could in theory use this space for adding any possible modifications and perhaps as a "cave" for patch code.

Other than that, I can't see much going on here unless someone has anything to say. The moderator can handle the post at his discretion ;->>

Cheers,
Kayaker
CccT
07-03-2002, 11:52 AM
I started with Delphi about six month ago, so switching to C++ wouldn't be a good idea for the time being. Maybe in the future.
This proggy is just a part of a suite of desktop gadgets.
I'll post another C proggy later today.

CccT
ZaiRoN
07-03-2002, 01:51 PM
hey Kayaker!
you have read my thoughts ;p
indeed, delphi programs are not easy to reverse...
sorry but i can't see nothing more to do with this proggie :(

if i remember well, i haven't seen a delphi pe/resource project in this area and could be an interesting idea!
at first, i prefer something like basically stuff for understand how the resource are stored and how you can modify them; after that we can try to do some hard projects...
i don't code in delphi but if someone do it (crusader, where are you? :p) and want to make a little program, here we are!

i would like to suggest an interesting reference:
http://www.woodmann.net/fravia/dafix_t1.htm
it's a must...read it with much attention!

just my 2c...
ciao,
ZaiRoN
tHE SnaKe
07-04-2002, 12:36 PM
look this:
use speed button in delphi i'ts easy
after using speed button
goto speedbutton & search flat u find False change to
true
delphiCooool!!


Time trial & encryption woes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Time trial & encryption woes
PDA

View Full Version : Time trial & encryption woes

johnnyfiasko
07-03-2002, 03:00 AM
Greetings,

I'm very new to this (started two days ago) but willing to learn.. Maybe you can help me out here: The first target I picked is the time limited trial version of the usenet binaries downloader Ne*sbin 4.0 (NeoLite 2.0 packed) [1]. After 10 days of trial use the program throttles the datarate and starts popping up nag screens all the time. I decided to try and make it never expire instead of going the other route and break into the registration.. that's because the program doesn't validate entered keys locally but checks them against a database.. sounded like more work to me.

So what I did first is I tried to analyze its behaviour.. seems that it somehow remembers the date of its first installation, no matter what you do. When you uninstall it, remove manually any trace from the registry, reboot and then reinstall.. It still knows the number of days you've been using the trial version.

So I had a look at the imported functions and ended up BPXing GetSystemTime.. assuming that at startup the program would determine whether or not the user has trial time left by checking how many days have passed since the installation date. I think I was right.. But as hard as I try I can't find out what data the results of GetSystemTime are compared against, and where?

Part of the problem is that the program seems to encrypt most of its registry entries (CRYPT32.DLL?) and data, making my job not exactly easier. Is there any way to get around this?

I'd be more than glad if you could help me out here. I'm just starting out and I've already spent countless hours on this.. :( But at least I've already learned a thing or two. :)

[1] h**p://www.newsbin.com/cgi-bin/fcount.cgi?nb40Pre6.exe
Woodmann
07-03-2002, 04:58 AM
Howdy,

You seem like you want to learn.
What you have described is sort of vague.

You need to concentrate on 1 strategy at a time, you have tried a shotgun approach.

Since you have stated that you have learned a thing or two, go back and rethink what you want to do. Pick one thing that you think will do what you want and see it to the end.

You can patch it but you will still need to focus on 1 thing at a time.

Be eager, find focus, then you will see it.

Peace, Woodmann
Acid_Cool_178
07-03-2002, 09:23 AM
Have you ever tried krobar.cjb.net and then the "Begin" section.. You will find allot of information in there and if u really want to learn. Then read those tutorials and read so many as you can, you'll never read loo little tutorials on cracking...

Acid


KeyFile Cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > KeyFile Cracking
PDA

View Full Version : KeyFile Cracking

SilSaLaMaTa
07-03-2002, 09:05 AM
Hi
I need some tuts and crackmes about keyfile cracking , is there any good resource ?
(Does anyone know how to create Winrar > 2.8 rarreg.key file ?)
foxthree
07-03-2002, 09:15 AM
zor.org/krobar for general keygen tutorials. For Winrar...I'm not sure...

Signed,
-- FoxThree
AdamA
07-03-2002, 11:46 AM
Bad News about Winrar >2.8

they use some sort of Elliptic Curve Cryptography with 241 bit(base point order), short at this time it seems to be impossible to keygen it :mad:

happy reversing,
AdamA
robber804
07-03-2002, 01:55 PM
Mike Rosing's book 'Implementing Elliptic Curve Cryptography' my be of some help (or not) in your quest to reverse WinRAR. At one time tE! had some example source code on his site I believe.


Regshot (registry snapshotter) menu separators
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Regshot (registry snapshotter) menu separators
PDA

View Full Version : Regshot (registry snapshotter) menu separators

CccT
07-03-2002, 12:19 PM
Regshot is a small and simple program that takes snapshots of the registry, compares them and writes the changes to a txt file.
Basically the same as what Advanced Registry Tracer, Active Registry Monitor, Regsnap and a few others do but this one is freeware.

On clicking "Shot 1" or "Shot 2" in the popup menu are a useless vertical and a useless horizontal separator line between the "Shot" and "Load" menuitems. This is a beauty mistake.

How can these useless line separators be deleted with a hex editor ? Where exactly must be filled by "0" so that these separators become invisible.

CccT
ZaiRoN
07-03-2002, 01:54 PM
hi CccT,
i have take a quickly look at the proggie and i don't think you can do the work with only putting some 00 byte in the file.
the menu(s) you are referring to are loaded at runtime using the API(s): CreateMenu and AppendMenu

HMENU CreateMenu(void); // creates an empty menu and returns an handle of the menu created

BOOL AppendMenu( // appends an item to the end of the menu
HMENU hMenu, // handle returned from CreateMenu function
UINT uFlags, // flags to control the appearance of the new menu item
UINT uIDNewItem, // specifies the identifier of the new menu item
LPCTSTR lpNewItem // long pointer to the content of the new menu item
);

for a deepen explaination of those two calls take a look at msdn...

back to your problem!
try to disassemble the file and look for those two functions.
you'll find something interesting; in particular, you'll find that one of the AppendMenu's function is responsible of the horrible visualization of the two line...
i don't want to say you the answer because other peoples could be interested in this little project. anyway, you have all the info that needs to perform the task....but if you have problems, here we are!

good luck!!!
ciao,
ZaiRoN
CccT
07-03-2002, 04:56 PM
I opened it with Olly debug and at that breakpoint there is something like :

push eax
eax *eax
jmp 0x005478
ret

By experience I know I could try to nop a few lines and jmp over it.

I've seen this type of code quite often but don't know its name.
Is this called assembler code ?
ZaiRoN
07-03-2002, 06:33 PM
hi CccT,
i'm a little bit confused.I opened it with Olly debug and at that breakpoint...
did i miss something? where's the breakpoint?

i am not able to find the code_lines you have posted...
CccT
07-03-2002, 07:14 PM
Which debugger did you use ? SIce ? Wdasm ? IDA ?
I spent a couple of hours over this sloppily coded menu, but no dice so please post your solution or, what's even better, send it right over as a zipped attachment :

It doesn't matter, it's open source anyway.

CccT

PS Would you like my clock on your desktop ?
ZaiRoN
07-03-2002, 07:43 PM
send it right over as a zipped attachment...
ahha...a lazy request!!!
do it yourself! this is the place for LEARNING something new!!!
i think this thread will be stopped here.

ZaiRoN
nikolatesla20
07-03-2002, 08:02 PM
I will make this short but sweet. AND still so other can look at it ..

The only way to get a seperator bar in a menu is to pass the appropriate uFlags parameter to AppendMenu(). So look thru the code to find a uFlags that isn't 0. ANything other than 0 is something other than a string, like a seperator bar, etc.

Let's look at two places in this proggie where it uses this:

* Reference To: USER32.AppendMenuA, Ord:0004h
|
:004048FD 8B3574B34000 mov esi, dword ptr [0040B374]
:00404903 51 push ecx
:00404904 A35CAA4000 mov dword ptr [0040AA5C], eax
:00404909 6818040000 push 00000418
:0040490E 6A00 push 00000000
:00404910 50 push eax
:00404911 FFD6 call esi
:00404913 8B0D18A94000 mov ecx, dword ptr [0040A918]
:00404919 A15CAA4000 mov eax, dword ptr [0040AA5C]
:0040491E 51 push ecx
:0040491F 6819040000 push 00000419
:00404924 6A00 push 00000000
:00404926 50 push eax
:00404927 FFD6 call esi
:00404929 6A00 push 00000000
:0040492B 8B0D5CAA4000 mov ecx, dword ptr [0040AA5C]
:00404931 681B040000 push 0000041B
:00404936 6A20 push 00000020 ; NAUGHTY seperator line
:00404938 51 push ecx
:00404939 FFD6 call esi
:0040493B 8B0D38A84000 mov ecx, dword ptr [0040A838]
:00404941 8B155CAA4000 mov edx, dword ptr [0040AA5C]

You will notice at 00404936 you are pushing a 20 instead of a 0. This is the uFlags parameter being pushed before we call AppendMenu (which is in esi register). 20 is the constant for the uFlag of MF_MENUBARBREAK, and this gives you your break line which you dont like. If you look thru this code you can see AppendMenu is called four times, we only need three times, we will jump over this break line call. Notice the PUSH 00 at 00404929? We will change it to a JMP, since it takes the same amount of bytes. WE need to jump down to 0040493B. So this would be 0040493B - 0040492B (it's 2B because JMP's are from relative to the NEXT instruction) - this gives us 10 hex. JMP is "EB" Change the code from 6A00 to EB10.

The second occurence is at :

* Reference To: USER32.AppendMenuA, Ord:0004h
|
:00405127 8B3574B34000 mov esi, dword ptr [0040B374]
:0040512D 6A00 push 00000000
:0040512F 51 push ecx
:00405130 FFD6 call esi
:00405132 6A00 push 00000000
:00405134 8B0D04AA4000 mov ecx, dword ptr [0040AA04]
:0040513A 681B040000 push 0000041B
:0040513F 6A20 push 00000020 ; UGLY seperator line
:00405141 51 push ecx
:00405142 FFD6 call esi
:00405144 A1A4AA4000 mov eax, dword ptr [0040AAA4]
:00405149 8B0D04AA4000 mov ecx, dword ptr [0040AA04]

You can use the same technique here. Jump over the evil call, Change PUSH 00000000 at 00405132 to a JMP to 00405144. I'll leave the calculations to you !

Don't forget the position in the file in the hex editor will NOT be the same as these virtual addresses , you need to use a File location calculator, I prefer to use PEditor or LordPE's FLC :)

I'll leave those little details for you to figure out, it's good to learn SOME things !

-nt20
ZaiRoN
07-03-2002, 08:59 PM
hey nikolatesla20,
you are a good boy :)

Zai
CccT
07-03-2002, 10:02 PM
Thanks now it's easy to figure out:

In HexWorkshop : GOTO 3D29 and fill EB 10
In Hiew : 2 Unwrap > 4 Mode and only then go to the address

CccT
Will
07-05-2002, 09:41 PM
Just a couple tips.... You can just hit enter a couple of times in hiew rather then using the F4 key to select mode. Also, you can put a shortcut to hiew in your 'send to' folder and then just right click on the file and send it to hiew that way. It's a lot quicker then using hiew's navigator, and even quicker then dragging a file on a hiew shortcut.


CoXoC's API Hooker or haspfind.com needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > CoXoC's API Hooker or haspfind.com needed
PDA

View Full Version : CoXoC's API Hooker or haspfind.com needed

mancini
07-03-2002, 01:30 PM
CoXoC's API Hooker is quite old a plugin for IDA
also if you know of any more good plugins for it plese let me know

the second one is a really old com executable for finding old hasp protected software
know of wheraabouts of this one or have it please let me know

thank you

serched them both on google ..on webpages and ftp's but had no luck
mIG
07-13-2002, 01:11 AM
You can get it at www.smola.pac.pl/tools/apihooker211.ace But it's not a plugin for IDA. :-)


dictionary pattern searching project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > dictionary pattern searching project
PDA

View Full Version : dictionary pattern searching project

mancini
07-03-2002, 01:39 PM
hello guys
i would like to share with you and ask help on this asm disasembly created with win32dasm
at the end you will see how far i got with it
but sadly i got stuck
i would apreciate it if someone would make some sugestions or corect my errors if you see any im my judgement
(if you want a word .doc format of the code so the asm code is not mixed toghether with the adress so you can red it better download wordweb_asm.doc.zip wich i atached)

if you fell i mst explain more about it just say so and i will try

* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:40077747(C)
:400777BC 53 push ebx
:400777BD 56 push esi
:400777BE 8BF0 mov esi, eax
:400777C0 B301 mov bl, 01
:400777C2 8B866C030000 mov eax, dword ptr [esi+0000036C]
:400777C8 E827C6F8FF call 40003DF4
:400777CD 48 dec eax
:400777CE 7E0B jle 400777DB--------------------------first jump
:400777D0 8B866C030000 mov eax, dword ptr [esi+0000036C]
:400777D6 803821 cmp byte ptr [eax], 21
:400777D9 7455 je 40077830--------------------------second jump

* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:400777CE(C)
:400777DB 8B966C030000 mov edx, dword ptr [esi+0000036C]
:400777E1 B02A mov al, 2A
:400777E3 E86CE2F9FF call 40015A54
:400777E8 85C0 test eax, eax
:400777EA 7544 jne 40077830--------------------------third jump
:400777EC 8B966C030000 mov edx, dword ptr [esi+0000036C]
:400777F2 B03F mov al, 3F
:400777F4 E85BE2F9FF call 40015A54
:400777F9 85C0 test eax, eax
:400777FB 7533 jne 40077830--------------------------forth jump
:400777FD 8B966C030000 mov edx, dword ptr [esi+0000036C]
:40077803 B023 mov al, 23
:40077805 E84AE2F9FF call 40015A54
:4007780A 85C0 test eax, eax
:4007780C 7522 jne 40077830--------------------------fiveth jump
:4007780E 8B966C030000 mov edx, dword ptr [esi+0000036C]
:40077814 B040 mov al, 40
:40077816 E839E2F9FF call 40015A54
:4007781B 85C0 test eax, eax
:4007781D 7511 jne 40077830--------------------------sixth jump
:4007781F 8B966C030000 mov edx, dword ptr [esi+0000036C]
:40077825 B05B mov al, 5B
:40077827 E828E2F9FF call 40015A54
:4007782C 85C0 test eax, eax
:4007782E 747D je 400778AD--------------------------big jump

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:|:400777D9(C),
:400777EA(C), :400777FB(C), :4007780C(C), :4007781D(C)
:40077830 C6864804000001 mov byte ptr [esi+00000448], 01
:40077837 8BC6 mov eax, esi
:40077839 E83216FFFF call 40068E70
:4007783E 8B86F8020000 mov eax, dword ptr [esi+000002F8]
:40077844 8B8010020000 mov eax, dword ptr [eax+00000210]
:4007784A 8B10 mov edx, dword ptr [eax]
:4007784C FF5240 call [edx+40]
:4007784F 8B86FC020000 mov eax, dword ptr [esi+000002FC]
:40077855 E89A26FBFF call 40029EF4
:4007785A 33D2 xor edx, edx
:4007785C 8BC6 mov eax, esi
:4007785E E89D17FFFF call 40069000
:40077863 33D2 xor edx, edx
:40077865 8B8610030000 mov eax, dword ptr [esi+00000310]
:4007786B 8B08 mov ecx, dword ptr [eax]
:4007786D FF515C call [ecx+5C]
:40077870 33D2 xor edx, edx
:40077872 8B86EC020000 mov eax, dword ptr [esi+000002EC]
:40077878 8B08 mov ecx, dword ptr [eax]
:4007787A FF515C call [ecx+5C]
:4007787D 33C0 xor eax, eax
:4007787F 898674030000 mov dword ptr [esi+00000374], eax
:40077885 33C0 xor eax, eax
:40077887 898678030000 mov dword ptr [esi+00000378], eax
:4007788D 8B8618030000 mov eax, dword ptr [esi+00000318]
:40077893 E8A00BFBFF call 40028438
:40077898 8BC6 mov eax, esi
:4007789A E8591DFFFF call 400695F8

* Possible StringData Ref from Code Obj ->"No pattern matching in this free "
->"version"

:4007789F BACC780740 mov edx, 400778CC
:400778A4 8BC6 mov eax, esi
:400778A6 E8D126FFFF call 40069F7C
:400778AB EB10 jmp 400778BD--------------------------small jump

* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:4007782E(C)
:400778AD C6864804000000 mov byte ptr [esi+00000448], 00
:400778B4 8BC6 mov eax, esi
:400778B6 E81DC8FFFF call 400740D8
:400778BB 8BD8 mov ebx, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:400778AB(U)
:400778BD 8BC3 mov eax, ebx
:400778BF 5E pop esi
:400778C0 5B pop ebx
:400778C1 C3 ret

Anexes :

:40015A54 B901000000 mov ecx, 00000001
:40015A59 E802000000 call 40015A60
:40015A5E C3 ret

:40015A60 53 push ebx

* Possible StringData Ref from Code Obj ->"Word not found: "
:4006A0FE BA3CA10640 mov edx, 4006A13C
:4006A103 E8389DF9FF call 40003E40
:4006A108 8B55FC mov edx, dword ptr [ebp-04]
:4006A10B 8BC3 mov eax, ebx
:4006A10D E86AFEFFFF call 40069F7C
:4006A112 33C0 xor eax, eax
:4006A114 5A pop edx
:4006A115 59 pop ecx
:4006A116 59 pop ecx
:4006A117 648910 mov dword ptr fs:[eax], edx

BIG JUMP
Address : 76C2Eh Orriginal value : je
big jump tries
jmp = something ( makes all searches give the nag)
jg = something ( makes all searches give the nag)
jl = something ( makes all searches give the nag)
jnz = something ( makes all searches give the nag)
jn = something ( makes all searches give the nag)

SMALL JUMP
Address : 76CABh Orriginal value : jmp
small jump tries
jne = nothing
je = something (it disabled the nag mesage and proceded but broke the searching process)
nop = error
jbe = error

JE + JA = (it disabled the nag mesage and proceded but broke the searching process)
JE + JN = (it disabled the nag mesage and proceded but broke the searching process)

conclusion 1 : if big jump does not happen prog will allways give the nag
conclusion 2 : turning the small jump from a direct one to a if equal one removes the nag


Doing it without softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Doing it without softice
PDA

View Full Version : Doing it without softice

blink4me
07-03-2002, 10:53 PM
Hi,

I have searched and found nothing about this topic in particular. I have a prog that seems to be an exe created by installshield. The extractor is InstallShield Self-Extractor. Normaly, you would just run it and then take the ins/inx and that was extracted to a temp dir. But this installshield, does not extrac its stuff, it asks for a pw before extracting. I tried dissambling it with w32dasm and ida and found myself completly lost in the code. I looked at a few jumps before the call to MessageBoxA (the pw is invalid...) but cant figure it out. Could somebody explain to how I could possibly reverse this without softice. There was one topic that kind of was about this stuff but they used softice. Appreciate your help.

J
blink4me
07-04-2002, 07:27 PM
If it can help, I could post the code. I cannot seem to find a section wich looks like something I have seen before, like a test, cmp and jne.

J
foxthree
07-04-2002, 07:40 PM
Hmmm... based on the information given, we can't even pretty much lift our little finger :D

Moral: Post the Target URL and I'll take a look...

Signed,
-- FoxThree
blink4me
07-04-2002, 11:41 PM
Ok, I will post the "link" where you can get the package and the decompiled code.

You can get Train Dispatcher 3 and Track Builder 3 Installs.
http://www.signalcc.com/train3/downloads.html

If you like the games you sould buy them, very interesting games.
J

*I only posted the W32DASM Code cause with IDA the file is too big.
NervGaz
07-05-2002, 12:57 AM
take a peek at 004014c1... or possibly even more interesting the call at 004023FD... not sure about that one though
foxthree
07-05-2002, 03:06 PM
This is some dumb password protection, no doubt. Took less than 2 secs. under SICE. Look at 0040C7B0 to get the actual "unencrypted" password. [4xx5x2] :D

Signed,
-- FoxThree
blink4me
07-05-2002, 04:48 PM
I know this is so simple in sice but I am on XP here and I cant run softice so I can only do it by dead listing. Thanks for the hint anyway.
deuce
07-05-2002, 09:05 PM
there are other debuggers than SoftIce... check out WinDbg, it works fine on XP :)
blink4me
07-05-2002, 11:32 PM
I have windbg I find it hard to work with but you say that you can actually break on APIs in windbg? I had no idea of that. Cool, will look into that, thanks man.


Help compiling lmcrypt with Borland
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help compiling lmcrypt with Borland
PDA

View Full Version : Help compiling lmcrypt with Borland

LostAtC
07-04-2002, 02:03 AM
Any instructions on how to compile lmcrypt and other FlexLM utilities using Borland v4.5x or v5.x would be appreciated. I'd rather not install MS VC++ just for FlexLM.

TIA
LostAtC
07-06-2002, 09:55 PM
I think I answered my own question - in short the answer is NO. It seems that the libraries are in COFF format while Borland expects OMF format. I tried a number of conversion programs but to no avail.

The bottom line is I loaded MS VC++.


Sentinel Shell encription
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel Shell encription
PDA

View Full Version : Sentinel Shell encription

ComanderKeen
07-04-2002, 10:00 AM
HElooo to all,

Anybody knows where can i find tutors about Sentinel shell API encription structure?

thanks for your patience..
JMI
07-04-2002, 12:24 PM
ComanderKeen:

You will find some good information on Sentinel in the CrackZ Archive. There is a link to it on the very bottom of this page. I didn't recheck to see if the specific information you seek is included, but there is a lot of information there. You could also to a search on google with "sentinel+API."

Regards.
ComanderKeen
07-04-2002, 12:55 PM
Dear JMI,

Thank you for your suggestion...but i did it long time ago...i know CrackZ page and checked it out in detail. I have all tutors of CrackZ in my archive. I dont remember any specific tutor about sentinel SHELL API...But i will apreciate if you could let me know the exeact name or link of SENTINEL SHELL related tutors.

Kind regards,

ComanderKeen
cyberheg
07-04-2002, 12:56 PM
I wrote one in past which could be of some help. The information in it is maybe a little outdated since it's a while ago but I am sure it could be of some use.
I remember it got published on CrackZ site so eventually you'll find it.
JMI
07-04-2002, 04:22 PM
ComanderKeen:

Again I suggest you try a little SEARCHING. Sentinel+ API will get you more entries than you might want, but includes, as the first thread one that leads to a page entitled API's/interfaces with what might be helpful information. You will find it at:

hxxp://www.pericosecurity.com/downloads/api.htm

"sentinel + API+encryption" will find 459 entries with more useful possibilities. "Sentinel +API +tutorials" will find 271 more.

There are even two possible leads by using the "search" button here with sentinel + encryption. Did you review those?

"sentinel shell + tutorial" produced 1,010 entries.

Can you do some work on your own or do we need to hold your hand all the way through the dark codewoods??:p :p

Regards.
ComanderKeen
07-05-2002, 11:07 AM
Dear CyberHeg,

Thank you for reminding me your tutorial on sentinel shell. I have it in my archive...i am gonna check it out again.

Kind regards,

ComanderKeen
ComanderKeen
07-05-2002, 11:37 AM
Dear JMI,

Thank you very much for your suggestion about LITTLE SEARCH. But do you really belive that u can find 1.010 entries for "sentinel shell encription" on the web. Is it easy like this? which search engine you are using? Something new?

I have been searching for the sentinel dongle related tutorials more than 2 years and all i can find is the tutors of CrackZ, CyberHeg and Goatass (please respect their efforts). If you know any serious source please refer it clearly.

regards,

ComanderKeen
JMI
07-05-2002, 12:12 PM
ComanderKeen:

Please carefully re-read my post and notice the spelling and the words used. I did not say there were 1,010 entries for "sentinel shell encription ". This is a mispelling of "encryption" and the 1.010 number was in reference to using "sentinel shell + tutorial."

The search engine I use is google. Put that in your search engine and you will find it. I was not suggesting that each of the entries has what you want, only that they are possibilities you should check. You blew off my suggestion that you check the CrackZ archive with the assurance that you had reviewed it, when you now confess that you had "forgotten" the CyberHeg tutorial included there.

I just did a quick google search with "sentinel +dongle+encryption" producing 161 entries to review. You could also try "Rainbow" and/or "SentinelLM" as one of the search terms.

The "key" to successfull searching is the use of qualifying terms with your search. The more "+" signs you use the narrower your search will become. There are also several articles on Sentinel LM on the "What's New" section of the Fravia mirror link you will find at the bottom of this page.

Regards.


ASPR wierd API
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR wierd API
PDA

View Full Version : ASPR wierd API

MrMiniMe
07-05-2002, 12:22 AM
hi all ...
yes it's agian ASPR and now...

Change Folder Icons v 4.6
http://www.nesoft.org

OEP : 46E3A4
Image Size :E3000

well after dumping come the fixing..
i used ImpREC and after doing the API emu
it fixed all but one!!!
ptr :11813B4

well i checked what is it in the Pack file and got this:

PUSH EBP
MOV EBP,ESP
MOV EAX,[01186CF4] <-- if do "d eax" u get the path of the prog probly a GetCommandLineA
MOV EAX,[EBP+08] <-- if do "d eax" return : TPF0.TForm1.Form ??? what is it ??
POP EBP
RET 0004
after the "ret" it takes the val of eax and use it..
what is the API that return : TPF0.TForm1.Form ???
it look like an Resouce thing.. so i tried mnual changing it to :

LockResource <--- no good still CRASH
FreeResouce <-- no good still CRASH
LoadResouce <-- no good still CRASH but in a wierd way...

well i don't know what else to do so i came to you guys..
hope to get answer soon.. tnx all...
nikolatesla20
07-05-2002, 04:44 AM
Maybe try LoadString

Another hint you can do is to see where the call comes from, so you can see how many arguments get passed. This can help lead you to the correct API call as well.

So to "walk the stack", once you are in this ASPR function, then do "dd esp" and try to find an appropriate address on the stack that might be where the call came from (some people might use the WS to see the stack window, but I prefer to look at ESP manually)

Then you can "U" the address to see where the call came from. Right above the call you will see the arguments that get pushed.

LoadString takes 4 arguments, in case it might be that one.

-nt20
SpeKKeL
07-05-2002, 10:36 AM
HaJo,

well your wanted api is lockresource...Why still crashing i don't know ??
I found another possible reason why the prog could crash:
( well it did by me )
somewhere in the dumped prog there is made a call [4b31b8]
which first calls getmodulehandlea after that there is a push dword getversion and after that (pffff) get commandlinea is loaded in eax...Imprec's plugin tarcer (emul 1.2) will trace for you the getversion....!

Try debugging by comparing (tracing) the original and your rebuilded exe .

Greetz,

Spekk
MrMiniMe
07-05-2002, 11:52 AM
hi SpeKKeL
well if i change it to LockResource when u run the prog it send a msgbox : Access violation at address 0040284C in module 'dupd.exe' read of address C0000A04

and then another and if u do a event the prog will continue doing so ..
SpeKKeL
07-05-2002, 11:55 AM
Just like i said in my earlier post>>> Check the call !!!!!!!!!
Make that getversion a commandlinea OR skip the whole call and you'll see NO PROBLEM !

:p
SpeKK
MrMiniMe
07-05-2002, 01:26 PM
the message box was in 40284c and i trace up to see the start of the loop that checks ... and in 40283c is starts i just puted a RET and thats all..
_Servil_
07-11-2002, 10:24 PM
hi spekkel,

Could i know how didyou figure the 1st 'API' is just LockResource?

PUSH EBP
MOV EBP,ESP
MOV EAX,[XXXXXXXX]
MOV EAX,[EBP+08]
POP EBP
RET 0004

It probabl is but it's located in unnamed module :confused: and calls no api at all, I've found this sub in another .aspr program later ...
SpeKKeL
07-12-2002, 08:24 AM
First of all,

In this prog imprec's aspr emul.dll plugin can't discover which api it is.Allso a getversion is somewhere traced but must be a getcommandlinea !
I have been bizzy making a new aspr-plugin which traces all okee..but isn't ready for publish.

The lockresource: well lot of threads have dealed with this (just like freeresource ) I always putted a ret 02f which does nothing more then a ret 004, so this must work allso.
H'mm who exactly dicovered it was a free and lockresource i don't
know but it's obvious (spelled correct ??) that it must be originally these api's just look to the alfabetic list.:rolleyes:

greetz,

spekk
nikolatesla20
07-12-2002, 01:43 PM
The reason, my fellow RCE'rs, is that LockResource and FreeResource do absolutely nothing.

If you "U LockResource" in SI on windows 98 you will get a function that does nothing (except for simply moving the argument you passed in, into your return value).

mov eax,[esp+04]
ret 0004 ; HMMM that was kinda pointless...

Similarily, if you "U FreeResource" the assembly is:

xor eax,eax
ret 0004 ; EVEN more pointless.....

So these routines do nothing, and no doubt Alexey knew about that, so he added functions himself that do nothing.

According to MSDN, you don't need to call FreeResource anyway, the OS cleans up after you without it.

These two functions are only there for 16 bit compatiblity. I have no idea why people still use them.

-nt20
Snatch
07-17-2002, 08:21 AM
DANGEROUS.....You are making dangerous windows assumptions that if windows doesnt change it wont work and every version of the dll has the same lockresource and freeresource code. If Microsoft decided to change this.....it will cripple your app. So they are not obsolete. They are the correct way of doing things. Though at this point they do seem useless eheh.

Snatch


C Source Code Generator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > C Source Code Generator
PDA

View Full Version : C Source Code Generator

silent
07-05-2002, 02:21 AM
Ok...i was wondering if anyone has this C source code generator...it was brought up at http://www.woodmann.net/fravia/pna3.htm...it said to contact the author for the srcgen.exe...
SrcGen.exe, the C source code generator for your own DLLs (contact me)
well i did that and the email address on the website (pna@starwarsfan.com) is not a known address.....it would be most appreciated if someone posts this for me or tells me where to find it.....thanks
Woodmann
07-05-2002, 02:35 AM
Howdy,

Search......... no one will tell you.
(unless you offer money in a secure account)
I found it with no effort.

Peace, Woodmann
silent
07-05-2002, 02:38 AM
hmmmm....ive been doing that for the last two hours....:(
Woodmann
07-05-2002, 02:41 AM
It is obvious.....

You need to refine or expand your search.
try re-wording it

Peace, Woodmann
silent
07-05-2002, 03:31 AM
well ive tried everything..... ive search for "srcgen, ""srcgen.exe,"src gen," c src gen,""c source generator""PNA c source generator,""c source generator kernel32.dll," and about every other variant of those words....ive also tried almost every search engine and ive tried kazaa and morpheas p2p....i cant get anything...pls post it or help me more on my search:)
fjrp2
07-05-2002, 03:05 PM
How do you search, man?
Are you sure you tryed google?

-----------------------------------------------------------------------------------

Se buscó c Source generaTOR en la Web. Resultados 1 - 10 de aproximadamente 783,000. La búsqueda tardó 0.29 segundos.

generator.c Source File - [ Traduzca esta página ]
Main Page Alphabetical List Data Structures File List Data Fields Globals
Related Pages generator.c. Go to the documentation of this file. ...
samba.anu.edu.au/rsync/doxygen/ head/generator_8c-source.html - 50k - En caché - Páginas similares

Hypersignal C Code Generator - [ Traduzca esta página ]
... The C Source Code Generator software development tool automatically creates ANSI
C source code which represents the algorithm designed visually with Block ...
***-d.connect.ti.com/dsp/tpcat/tpcodec.nsf/SoftwareForExternal/ 79792C958A7F20848625670F005C71F7 - 26k - En caché - Páginas similares

Hypersignal Block Diagram Enterprise Edition - [ Traduzca esta página ]
... The ANSI C Source Code Generator then produces the source code implementation
of the graphical block diagram based design. This ...
***-d.connect.ti.com/dsp/tpcat/tpcodec.nsf/SoftwareForExternal/ 7B3AA3FD0DBBB60A862568F900688492 - 29k - En caché - Páginas similares

C->Haskell, Yet Another Another Interface Generator for Haskell - [ Traduzca esta página ]
... To get an idea of how to use the interface generator -- after the build -- go ... is Structs.chs
as well as Pointer.chs as well as the corresponding C source and ...
***.cse.unsw.edu.au/~chak/haskell/c2hs/ - 15k - En caché - Páginas similares

javah - C Header and Stub File Generator - [ Traduzca esta página ]
javah - C Header and Stub File Generator. javah produces C header
files and C source files from a Java class. These files provide ...
java.sun.com/j2se/1.3/docs/tooldocs/win32/javah.html - 6k - En caché - Páginas similares

generator.c Source File - [ Traduzca esta página ]
Main Page Alphabetical List Data Structures File List
Data Fields Globals Related Pages generator.c. ...
samba.org/rsync/doxygen/head/generator_8c-source.html - 50k - 3 Jul 2002 - En caché

FIST: Emphatic Message Generator - [ Traduzca esta página ]
... NAME. fist - emphatic message generator SYNOPSIS. fist [ -c -fpat -l -mtext -n -sfactor
-u ] DESCRIPTION. ... SEE ALSO. ascii(7) Evil Empires Download. fist C source ...
***.fourmilab.ch/fist/ - 9k - En caché - Páginas similares

Advanced search for asteroid c source code - [ Traduzca esta página ]
... a brief description of how to use the Ephemeris Generator ... ***.paratiisiweb.com Astronomical
computations and mathematical functions source programs in C ...
***.jamesmadisonmuseum.org/ high-yield-managed-currency-trading.htm - 14k - En caché - Páginas similares

The JavaScript Source: Equivalents: Area/Volume Generator - [ Traduzca esta página ]
... JavaScript Source: Equivalents: Area/Volume Generator Simply click inside the window
below, use your cursor to highlight the script, and copy (type Control-c ...
javascript.internet.com/equivalents/ area-volume-generator.html - 22k - En caché - Páginas similares

Color Palette Generator - [ Traduzca esta página ]
Color Palette Generator Freeware for creating palettes. ... Hex (HTML, C style, separate
channels...) and decimal ... you are a curious programmer, look at the source ...
***.gdargaud.net/Hack/GenPalette.html - 31k - En caché - Páginas similares

and 782.990 more...


CyberCafePro - Bitarts protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CyberCafePro - Bitarts protection
PDA

View Full Version : CyberCafePro - Bitarts protection

prt
07-05-2002, 01:35 PM
CyberCafePro Server v3.8
http://www.cybercafepro.com/downloads.htm

Crypted EXE use Bitarts protection.
Dumping and IAT fixed
used Cool memory dumper and ImpREC.

VB6 program how to crack?
can't working WKT VBDebugger
crash SmartCheck, ExDec:mad:
esther
07-05-2002, 02:16 PM
Hi,
what about softice?


Softice DS 2.6 ans WinXp Sp1 (beta)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice DS 2.6 ans WinXp Sp1 (beta)
PDA

View Full Version : Softice DS 2.6 ans WinXp Sp1 (beta)

chaoslord
07-05-2002, 04:22 PM
Hey all

just a simple question I as wondering

Will Ds2.6 work fine with Xp sp1 beta?
i dont want to ruin my nice-freshly-intalled XP :)

PAX
Chaos
nikolatesla20
07-05-2002, 07:46 PM
I loaded DS 2.6 at work on an Xp machine and it worked just great....but I didn't have SP1 on it, although that shouldn't matter too much.

-nt20
_Servil_
07-05-2002, 09:54 PM
hi
quite interesting for me since ice never worked on my xp's
and, as |'ve seen a thread at exetools about issue from numega - ice is working without any service packs/hot fixes

what did ya mean 'ruining' the installation? ice quite easy uninstall ;)
chaoslord
07-05-2002, 10:01 PM
That's what u think
last time sice completly messed up my registry
result : i was "forced" to re-install XP
_Servil_
07-05-2002, 10:09 PM
sorry but i don't have any bad with uninstalling ice, that's why i wrote.
if you suspect ice from screwing system, then do a snapshot of the system partn... or system restore snapshot... or...
tht will revert system to state exactly as B4
chaoslord
07-05-2002, 10:59 PM
Too lazy to do it now :)
the snapshot sould take like 15-19 Gb COMPRESSED...
i have so much software installed already
nikolatesla20
07-05-2002, 11:03 PM
Yes, but you don't need to snap ALL your software, you only need the important system stuff.

XP has a system restore feature in it that should work just fine - it's like the system recover that winME had, and that worked pretty good.

To bring a system back all you need is the system files intact and a good registry. So if those two items are backed up you should be just fine in being able to recover from any problems.

-nt20
chaoslord
07-06-2002, 08:32 AM
Yeah, but installing AL my programs after all is the other part of the problem...
most of them are picky (with licenses like ç and Fl@x-lm) so i dont think i want to ruin this installation

each two months i have to reinstall everything so when i am close to it i'l try softice with SP1 ;)


floating point
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > floating point
PDA

View Full Version : floating point

The Keeper
07-05-2002, 05:08 PM
hi,

i've debugged a prog in softice and when i arrive this line
fadd real4 ptr [4014E4]
i do a dl 4014e4 but i get the wrong value
when debugging with ollydbg i get the correct one, i tried to reproduce it by doing something like

xx dq 32.123

fadd real4 ptr [xx] ; when im on this line i do a dl xx and i get ???? then i press f10 and the xx becomes the number i assigned to it
why i can see the real value with olly and not with sice? and why with sice on my prog it works..looks weird, maybe the format of real4 or something?

i just want that when i see fadd real4 ptr [xx] in softice i can see the value of xx

thanks in advance
nofurs
07-05-2002, 05:52 PM
Hi The Keeper,
what about this
? 4014E4
The Keeper
07-05-2002, 06:25 PM
hi cluesurf,

that doesnt work, the value is a floating point one. ie: 42.24
nikolatesla20
07-05-2002, 07:52 PM
Yes, the way a float is stored in memory is not how you would expect to see it !

The instructions you refer to was an indirect address

fadd blahblah,[address]

looking at <address> won't tell you crap. YOu have to look at *address, where the actual data would be. You have to dereference the pointer. This is an indirect address operation. That might be why SI doesn't show you the right value.

-nt20
The Keeper
07-05-2002, 10:49 PM
well, i tried dl *address and ? *address but still nothing
amois
07-06-2002, 05:43 AM
Did you try to watch Floating Window [WF] ?

regards
The Keeper
07-07-2002, 06:00 PM
yes amois i did

take this program as example

.data

xx dq 32.14

.code

fld1
fadd real4 ptr [xx] ; in this line i do dl xxan nothing shows but when i pass this line i get the xx value, weird or ?
nikolatesla20
07-07-2002, 07:11 PM
Well, you mentioned in your first post that when you did a dl xx, that SI just showed ????

In windows programs the pages are not loaded until they are referenced - maybe this is why your small test didnt work? because you are the program does not attempt to access the data segment until after the floating point add operation.

The OS will not load the data segment until it needs to use it, such as if an instruction attempts to reference data in it.

I've seen this type of thing before too in PE files where I've added a section manually with some data - in SI is still would just show a ???? until some instruction actually used some data from the segment.

Maybe this is why you got the ????

You can use the PAGEIN command to force SI to load the memory page so you can see it. Just do a PAGEIN <address> where address is an address in the section you are interested in, such as that [xx] you talk about....

-nt20
The Svin
07-07-2002, 08:48 PM
real4 means 4 bytes real format(32 bits)
dq = qword = 8 byte(64bits)


find somethimes source text in exe or dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > find somethimes source text in exe or dll
PDA

View Full Version : find somethimes source text in exe or dll

Hugo
07-05-2002, 05:35 PM
Hello,
when i explore a dll or exe with an editor (ultraedit) then i find in the near of the file end C source code as text.

why that?
- is this trash from the compiler?
- is this for the debugger?
- is this interpreted at startup or runtime?

THX Hugo
naides
07-09-2002, 06:36 PM
I took a look at several files in the windows folder. notepad.exe, ping.exe etc, as well as several dll I have compiled myself and found no c source code.
May you provide some examples of COMMON files in which you have observed this peculiar thing?
[yAtEs]
07-10-2002, 03:49 PM
Its probably debug symbols if it was compiled for a debug state
also if it mentions PDB around there then its debug stuff. Try loading it into symbol loader.

yates.
Hugo
07-10-2002, 05:41 PM
very sorry about this:
1. in one file there are a lot of format strings in normal data section -> normal.

2. i have lost a VXD file, created with software from VIREO.
In a newer version there are no such parts look like C source.

THX for your comment
Hugo


SI4.05 with winMe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI4.05 with winMe
PDA

View Full Version : SI4.05 with winMe

Rio Nishida
07-06-2002, 01:37 PM
my pc runs windows Me, and i installed softice9x 4.05 on it, along with the windows debugging kit(which M$ said was required to run softice on winMe). SI still wont work. It always freezes when i run winice.exe and gives the error 'enhanced windows 386 is already running'
why is it doing this?
also, on compuware's site, they mentioned something about a patch for winMe, but i couldnt find it. is it required? also, where can i get it?
JMI
07-06-2002, 05:43 PM
Rio Nishida:

What you need to do FIRST is to go back to the very first page of this Forum and READ THE POSTING GUIDLINES. Had you done so you would have discovered that you should have done a search on your question BEFORE you posted. What that would have caused you to discover is that your question has been asked, and answered, before. There are even at least three other posts with the same title as yours and several more with the same title without the "4.05" reference to Softice. In the search box enter "softice + WinME"and you will find the information you need.

The files you need to find are "sice4me.zip" and the MS DDK for WinME. You need to do your own search on the net to find these files, although some locations are given on these threads which may still be available.

Reagrds.
Rio Nishida
07-08-2002, 03:52 AM
sorry! i read the guidelines as soon as i joined, but i must've skipped over that....i'll do a search now....(boy this is a bad way to start out X.x)
JMI
07-08-2002, 09:55 PM
Rio Nishida:

The object is not to punish for doing it the wrong way, but to teach how to do it the right way. If the lesson is learned, that is a good thing. You will notice that it didn't just say read the rules, it advised you how to find the answer. Usually giving one the answer teaches little. Teaching how to find the answer makes one who learns the lesson a better reverse engineer because now you can help yourself as well.

Regards.
Woodmann
07-09-2002, 12:24 AM
Well said....

Peace, Woodmann
tHE SnaKe
07-09-2002, 12:49 AM
download this:
http://ghiribizzo.virtualave.net/icedump/wmldr05.zip

& read readme file!!
Rio Nishida
07-09-2002, 12:49 AM
I got it to work! finally.....Man i am a total n00b....go figure, i got it to run under winMe, but the program i need to crack is on my windows xp computer (ie, stylexp1.01), and si dont work under xp. *shrugs* im sure i can find something to crack under Me :D
Rio Nishida
07-09-2002, 12:53 AM
neh, i used the converted io.sys thing....but, when i reboot, it says something along the lines of 'user.nms not found'...im not sure if that's a problem, because SI works fine in windows....if it becomes a major problem i'll consult the ever-powerful search. ;)
Cyber
07-12-2002, 12:51 AM
i have a modified version of the wmldr05.zip loader for windows ME if anyone wants it so it defaults not to load softice and you need to press escape to load softice cos i found the original way to be a pain :)
Cyber
07-12-2002, 01:00 AM
Sorry, forgot to attach the file :)
Woodmann
07-12-2002, 02:34 PM
Howdy,

The owner of the attachment asked for it
to be removed. It violated his distribution policy.

Peace, Woodmann
Cyber
07-12-2002, 07:32 PM
Sorry, i should have read the read.me
"Distribution of modified versions is strictly prohibited."

:)
Woodmann
07-12-2002, 11:58 PM
And that was exactly what he wrote to me :)

Peace, Woodmann
evaluator
07-19-2002, 09:19 PM
WMann!

I see, this is very FUNNY thread!
I recomend, move it to OFF-Topic & then there can be very interesting discussion about:

1. READ or NOT TO READ faq (Shakespire)
2. GOD'S distribution policy

~:0


Strange things with debug registers and SEHs?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Strange things with debug registers and SEHs?
PDA

View Full Version : Strange things with debug registers and SEHs?

cyberheg
07-06-2002, 08:44 PM
More and more protections these days are using SEH's to do various things amoung cleaning debug registers. One of these is Asprotect but I am not limiting myself to this.

I thought I'd try to write a little program which generates a exception and reads out the values of the registers.

The code at the buttom of this post shows the code I used (you can compile it with masm32).
What it does is basicly put the content of the registers dr7, dr1 and dr2 into edx which can be read out with softice if you single step through it.
Now the problem is that it the values it reads out of the registers are not the one softice reports me nor they are correct.
Bpm type of breakpoints should directly be using these registers so I did the following tests under both win98 and win2k.
With both having a bpm breakpoint set in dr1 and also without I got the followin results:
dr7 = 0 under both OS's
dr1 = 0 under win98 and 0xbe7cbd94 under win2k
dr2 = 0 under win98 and 0x7ffd0010 under win2k

So whats the deal with this? At the same time I also used the "CPU" command in softice which also showed different results from the real ones and also different results from mine.
I am thinking it has something to do with Ring0/3 but would it help to get access to the registers under ring0?
I know cdilla uses a sys driver under winNT/2k/XP and in past I read that it uses DR7 to do checking with but I am not sure if thats the reason why a driver was provided.
For these tests I used Softice v4.05 under both OS's.

// CyberHeg
---------------------------------------
Content of seh.asm:
.386
.model flat, stdcall
option casemap:none

include p:\progs\masm32\include\windows.inc
include p:\progs\masm32\include\kernel32.inc

.data

.code
main:

int 3

push Int3Handler
ASSUME FS:nothing
push fs:[0]
mov fs:[0], esp
int 3
nop
pop fs:[0]
add esp, 4

invoke ExitProcess, 0

Int3Handler:
mov eax, [esp+4]
cmp [eax.EXCEPTION_RECORD.ExceptionCode], EXCEPTION_BREAKPOINT
je HandleException
xor eax, eax
inc eax
ret
HandleException:
mov eax, [esp+12]
add [eax.CONTEXT.regEip], 1
mov edx, [eax.CONTEXT.iDr7]
mov edx, [eax.CONTEXT.iDr1]
mov edx, [eax.CONTEXT.iDr2]
xor eax, eax
ret

end main
end
nikolatesla20
07-07-2002, 05:33 AM
COol idea to look at, gives you more insight into how the system operates.

I'm confused on one small aspect tho. I'm looking at the "structured exception handling in win32asm" tutorial on Izcelion's site, and then looking at your code, I wonder about the CONTEXT structure you are trying to reference.

This is what you have:

At this point, we have a ret address pushed on the stack, add 4 to all stack ops to jump over it.....

Int3Handler:
mov eax, [esp+4] ; <--------- This is OK
cmp [eax.EXCEPTION_RECORD.ExceptionCode], EXCEPTION_BREAKPOINT
je HandleException
xor eax, eax
inc eax
ret

HandleException:

mov eax, [esp+12] ; <----------------------R U sure?

add [eax.CONTEXT.regEip], 1 ; <-------Using CONTEXT structure.
mov edx, [eax.CONTEXT.iDr7]
mov edx, [eax.CONTEXT.iDr1]
mov edx, [eax.CONTEXT.iDr2]
xor eax, eax
ret

What I don't understand is that [esp+12] - um that doesn't seem right ?? The documentation says the exception handler gets one parameter, the pointer to the EXCEPTION POINTERS structure, ok, and that EXCEPTION_POINTERS + 0 is the EXCEPTION_RECORD. You have [esp+4], that is fine, because this is a function call and we have the RET address above us, so we add 4 to get to EXCEPTION_POINTERS+0. BUT ! Now you are trying to use [esp+12] to get to CONTEXT, where the docs say CONTEXT is at EXCEPTION_POINTERS + 4, and so this would be [esp+8] wouldn't it (jump 4 over ret address, another 4 for the exception_record entry, you get context at esp+8). It looks like you are trying to get [esp+12] as the CONTEXT structure in eax, and then using traditional win32asm structure calls on it, correct?

Could you pleaseexplain that [esp+12] for me? I mean that seems like a really high number out on the stack, it just doesn't seem right.

-nt20
cyberheg
07-07-2002, 07:49 AM
In Jeremy Gordons essay about the subject availble at http://www.jorgon.freeserve.co.uk/ExceptFrame.htm it says the following:

The information sent to the per-thread handlers

At the time of the call to the per-thread handler, ESP points to three structures as follows:
ESP+4 Pointer to structure: EXCEPTION_RECORD
ESP+8 Pointer to own ERR structure
ESP+C Pointer to structure: CONTEXT record

Hopefully this answers your question.

In the meantime I found this example which I yet have to try written in C++: http://www.morearty.com/code/breakpoint/

This uses Get/Set context api though so it doesn't use the method I use however if thats what needed to get it to work I'd go for it.

// CyberHeg
+SplAj
07-07-2002, 08:03 AM
nt20

I am completely baffled by your number of 'ret' explanation for adding esp+??. These are the DWORD pointerers to the structure, not counters.

Here is a snippet of code form our well known T**** boyz for their lame attempt to clear BPM etc....

:00553FF0 55 push ebp
:00553FF1 8BEC mov ebp, esp
:00553FF3 83C4E4 add esp, FFFFFFE4
:00553FF6 53 push ebx
:00553FF7 56 push esi
:00553FF8 894DF8 mov dword ptr [ebp-08], ecx
:00553FFB 8945FC mov dword ptr [ebp-04], eax
:00553FFE E825000000 call 00554028 <-set SEH get all infos/offsets of stack frame
:00554003 8B44240C mov eax, dword ptr [esp+0C]
:00554007 8380B800000002 add dword ptr [eax+000000B8], 00000002 <- change ret to a safe step over exception
:0055400E 51 push ecx
:0055400F 31C9 xor ecx, ecx
:00554011 894804 mov dword ptr [eax+04], ecx <-clear pointers for DR0-3
:00554014 894808 mov dword ptr [eax+08], ecx
:00554017 89480C mov dword ptr [eax+0C], ecx
:0055401A 894810 mov dword ptr [eax+10], ecx
:0055401D C7401855010000 mov [eax+18], 00000155 <-also set DR7 register to stop BPM
:00554024 59 pop ecx
(hex 155 = binary 101010101)
:00554025 31C0 xor eax, eax
:00554027 C3 ret <- ret into safe exception ;)

* Referenced by a CALL at Address:
|:00553FFE
|
:00554028 31C0 xor eax, eax
:0055402A 64FF30 push dword ptr fs:[eax]
:0055402D 648920 mov dword ptr fs:[eax], esp <-set new SEH
:00554030 3100 xor dword ptr [eax], eax
:00554032 648F0500000000 pop dword ptr fs:[00000000]

So they say the structure starts at
:00554003 8B44240C mov eax, dword ptr [esp+0C]

Spl/\j
nikolatesla20
07-07-2002, 02:52 PM
LOL Cyberheg, I read the same article - but I didn't scroll down far enough :D oops ...

Spl/\j, Nah, that's just my way of looking at things - when you go into a function call the processor pushes the return address on the stack, so you have to add a DWORD to all stack ops to get over it. That's what I was talking about. Um guess its just how I have learned to understand it :)

P.S.
Finally tried *IDA Pro* this weekend. WOW. Nice program. I like that you can rename stuff on the fly, etc. Really helpful. (and FLIRT!!)

-nt20
SiNTAX
10-08-2002, 08:36 AM
Originally posted by cyberheg

I know cdilla uses a sys driver under winNT/2k/XP and in past I read that it uses DR7 to do checking with but I am not sure if thats the reason why a driver was provided.

The device driver is needed because a normal program can't access Ring-0. The secdrv.sys driver does indeed read out DR7.

to nikolatesla20: hence the name 'Interactive DisAssembler' :)
evaluator
10-10-2002, 08:20 PM
cyberheg!

I think, I know why you have strange garbage in SEH:)

Because you use INT3 for exception!

So you should try anouther kind exception.

OK!?
^DAEMON^
10-11-2002, 02:34 PM
heh... what a shame :)))

debug vwin32_set/getthreadcontext to understand why it is 0
@ startup
+ go to w95 and debug it there too...

^DAEMON^
evaluator
10-11-2002, 03:53 PM
OK, I here uploaded puzzy-prog for checking DRx_context.

So what is required for resolving DRx's in context ON W98se.

1. Firstly must "activated" DR7_context!

This means, when we first time make exception, DRx_context WILL clear anyway if DRx are full.
So on first SEH we will put in DR7_context value 00000155h (this means "activation")

2. Now we need 2nd exception & in 2nd SEH we will have full DRx_context.

**

Heh! But when we first time "activated" DR7_context, inside kernel it causes to clear DRx,
because we already had clear DR0-3_context.
So for testing purposes we need to set DRx's in SICE after 1st SEH & before 2nd.
Or another suggestion: make BPX between SEH's & on break SICE again activates DRx's.

(manual)

Load my prog in SICE & when it breaks on progs start, set four BPM's & one BPX:

BPM 401022 x
BPM 401024 x
BPM 401029 x
BPM 401048 x

BPX 401016

First time SICE breaks on BPM 401048 x inside SEH. Tape "d EBP" & you see context (& it is clear!).
Now handler will put in DR7_context value 00000155h.
Press F5 & SICE breaks on BPX 401016 before 2nd UD2. On break SICE restores DRx.
Now again F5 & second time SICE breaks on BPM 401048 x inside SEH.
But now DRx_context is full with OUR BPMx's:)
Congratz!

For XP bud news!
On clear system DRx_context is clear, with loaded NTice ALWAYS dirty!
My prog reported this fact:(
cyberheg! So I made mistrake about INT3

SINTAX! This is Job for you:). Find & patch NTice(or NToSKRNL?) for avoid this fact. Then report here!
cyberheg
10-12-2002, 07:41 AM
Thanks for the information (even though this thread is a bit old).

So basicly if you need to read/write the debug registers you need to do it in 2 steps... interesting.

I know with Get/SetThreadContext it is possible to do, but it's not very efficient.

Evaluator, are you saying this method for reading out the registers isn't working on WinXP?
I tried your program on win2k which seems to have read out the values fine.
As for overwriting as you do on address 4010b0 softice still breaks on the last 3 bpm's:
BPM 401022 x
BPM 401024 x
BPM 401029 x

I don't think that was the purpose?

// CyberHeg
SiNTAX
10-12-2002, 12:30 PM
Originally posted by evaluator

SINTAX! This is Job for you:). Find & patch NTice(or NToSKRNL?) for avoid this fact. Then report here!

Aha.. I love a good challenge :-) I will have a look at it.
SiNTAX
10-12-2002, 12:58 PM
Originally posted by evaluator
For XP bud news!
On clear system DRx_context is clear, with loaded NTice ALWAYS dirty!
My prog reported this fact:(
cyberheg! So I made mistrake about INT3

SINTAX! This is Job for you:). Find & patch NTice(or NToSKRNL?) for avoid this fact. Then report here!

Hmm eval.. I just tried it on my XP.. if I start it without settings any breakpoints I get the message that the DRx_context is clear. (even with NTice loaded).

If I set the breakpoints, then it does indeed detect this.

If I load SuperBPM, then the DR7 is always clear so it skips the EIP 2x, so I only get the finished dialog.

Without NTice loaded it produces random data.. sometimes it gives dirty, sometime clear. so this

'
For XP bud news!
On clear system DRx_context is clear,
'

Is not correct :)

Neither is this:

'
with loaded NTice ALWAYS dirty!
'

(this is only true, if you have active BPM's)

Oh.. and the clear of the BPMs has no effect either (NOTE: am using DS2.7 here)
evaluator
10-12-2002, 02:19 PM
Hi, ciberheg!

For _setting DRx via SEH you NOT need 2 attemp. For read you need..

Hi, SiNTAX!

BE more trickiE!
(you remember, I not did easy help for you:)

OK, special edition for you uploaded here.
It only will look if DRx_context is clear.
On my clear XP I many time run it & always reported "clear",
then I start NTice(2.6) & it always reports "DIRTY".

BTW, test it on many other nt-OS'es you have:)

why you load SUPERbpm?????? somewhere I wrote about!?
evaluator
10-12-2002, 03:45 PM
yep!

I also catch case on clear XP, when prog reports DIRTY!
(2 from ~100)

OK, so "BAD news" correctly killed by SiNTAX:)

"Enemies" will not able use this fact!?

But this happens (1 from ~100).
& DIRTY is 98 form 100 :(

???
SiNTAX
10-12-2002, 03:55 PM
Originally posted by evaluator
yep!

I also catch case on clear XP, when prog reports DIRTY!
(2 from ~100)

OK, so "BAD news" correctly killed by SiNTAX:)

"Enemies" will not able use this fact!?

But this happens (1 from ~100).
& DIRTY is 98 form 100 :(

???

The memory is probably uninitialized.. so that's why it sometimes works and sometimes not.. anyway like you said.. the enemy won't be able to use it :-)

But there's enough other ways left to detect SI :)

Just found another one: scanning the first byte of exported functions of KERNEL32.. when SI is loaded, you will find some INT3's there (saw it being done in SD) -- this one can be done from Ring-3.. so no device driver needed.
nikolatesla20
10-28-2002, 03:32 PM
Concerning "CC" byte at API (int 3).

This is why "mature" SI user knows to

"bpmb GetVersion X" rather than "bpx", and also then use SuperBPM or DS 2.7

-nt20
SiNTAX
10-28-2002, 03:53 PM
Originally posted by nikolatesla20
Concerning "CC" byte at API (int 3).

This is why "mature" SI user knows to

"bpmb GetVersion X" rather than "bpx", and also then use SuperBPM or DS 2.7

-nt20

Ok I'll bite :)

I always use BPM's, but still SD was able to find a CC on a KERNEL import. So it seems that DS 2.7 sets some INT3's all by itself.

It had me puzzled a bit when playing with SD.. as I set a 'BPM xx X' on the code path right after the CC-found check and when it went into SI there was no CC at all.. so SI already replaced it with the original byte.

All this was without any BPX's set, only BPM's.

This was on WinXP + DS2.7
tgodd
10-28-2002, 06:44 PM
One of the things that I always do, is to have a dummy Driver which allocates plenty of space.

If I need to write some code on the side I do it in the space provided by the bummy device driver.
I go into softice record my EIP.
Set my EIP to the code I just created, and single step my code to get the result I want.
Then I set EIP back to what it was when I first went into Softice.

I have created many patches and decrypted many code sections using just this technique.

Why write Utils which are so simple it hurts.

It's like writing a reboot program.
A waste of time.

Regards,

TGODD
evaluator
10-28-2002, 08:09 PM
I can confirm:

DS2.6 + XP
After loading NTice in Kernel32.dll found one CC.
Export Name: UnhandledExceptionFilter

EnljoE
nikolatesla20
10-28-2002, 08:16 PM
This is no doubt the reason for the patch of "Unhandled Exception Filter" string in ntice.exe to be performed according to +Splaj's walkthru.

If you change the name, SI cant put the CC there, hence no more detect.

-nt20


FlexLM Help in Ansoft Ensemble v7.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FlexLM Help in Ansoft Ensemble v7.0
PDA

View Full Version : FlexLM Help in Ansoft Ensemble v7.0

LostAtC
07-06-2002, 10:46 PM
I know that this is an older version of Ensemble but I have a reason. I managed to extact all the vendor keys 1 thru 4 and 5, and the seeds:

#define ENCRYPTION_SEED1 0x40055887
#define ENCRYPTION_SEED2 0x01D8DCAB

#define VENDOR_KEY1 0x5C2B8450
#define VENDOR_KEY2 0x9B6B6BCF
#define VENDOR_KEY3 0x6BBB6C07
#define VENDOR_KEY4 0xD7412735
#define VENDOR_KEY5 0xE9E97475

#define VENDOR_NAME "ansoft"

I created a one feature license file for the first feature that lc_checkout looks for:

FEATURE ens_gui ansoft 7.0 permanent uncounted \ E4720BAB8BCF HOSTID=ANY

There were only three breaks on lc_set_attr with codes 0x41, 0x38, and 0x06, so I don't think that there are any crypt filters used.

The call to lc_checkout fails with the famous -8. I can patch lc_checkout to always return zero and this works, but I would rather create a valid license file and learn something in the process.

TIA
LostAtC
07-11-2002, 09:55 PM
Problem Solved!

NB's article "Zendenc FlexLM..." was the key. I simply had to locate l_new and then run the data through Calcseed.exe, to get the real seeds.

Thanks NB for a great article!


SI DS2.6 and Win98, the oddest thing ever
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI DS2.6 and Win98, the oddest thing ever
PDA

View Full Version : SI DS2.6 and Win98, the oddest thing ever

Lord_Soth
07-07-2002, 07:51 PM
I've installed the SI that comes with DriverStudio 2.6 on my Win98.
I've got a TNT2 card (nothing fancy :).

Apparently when I boot with SI enabled, either my computer
reboots or hangs when it's time to enter windows. No error is
displayed. nada...

Any1 have any ideas ?? this annoys the hell out of me...

LS
Mefeus
07-08-2002, 08:58 AM
...u don't look here first???

http://www.woodmann.net/forum/showthread.php?s=&threadid=3176

It's the same forum.
stryder
07-16-2002, 03:59 AM
I had the same thing happen. What I did was reinstall but only the core not the networking parts. After that it looked like it was going to hang after rebooting but started up and launched win98.
Works great... :)

stryder


yet another aspr (and delphi) lamer, part II
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > yet another aspr (and delphi) lamer, part II
PDA

View Full Version : yet another aspr (and delphi) lamer, part II

puzzled
07-04-2002, 03:35 PM
usual unpacking, rv-recovered, manually fixed unresolved apis
(maybe badly, i don't know anymore)
all assembled and it wouldn't work
as far as i know there is no post oep dips (except for
emulated/redirected apis)
i'm completely and utterly stuck here

if there is an aspr expert with some spare time ...
you can find (exe only + my revirgin "resolved" text file) here
oep is 5D04B0, just to speed things up

hxxy://downloads.come2store.com/puzzled/ht.zip

thank you :(

edit
****
exe is ~ 1 mb
nofurs
07-04-2002, 04:38 PM
Hi Puzzled,

I'm puzzled too! could you post more about your findings...
Another thing please read the posting guidelines ;)
puzzled
07-04-2002, 04:57 PM
Originally posted by cluesurf
Another thing please read the posting guidelines ;)

what about them ? where did i go wrong ? :o
this is unpacking isn't it ?
i gave you oep and resolved "input" for revirgin
(if you'd like to try that is)

what do you want me to say ? i've used softice (what else)
started rv then started proggy then ...blahblah ... then pasted inputs into exe then ...
i'm not that new :p

forgot to say just on thing - when runninng my lame unpacked exe everthing gets stalled somewhere in the resource parsing - no blue screens, no crash - and i finally have to kill process
nofurs
07-04-2002, 05:31 PM
Hi puzzled,

>i'm not that new

Whether you are new or not is not important.
Your description is very very vague.Ihe more you post the more we know whats the problem.Since you are not new you should write more on how you work on this and ppl will learn also
puzzled
07-04-2002, 05:51 PM
ah shoot what a debut :(

i've read quite a few threads here. two things are obvious
- aspr topic is beaten to death
there is nothing spectacular in this proggy, everything i used
or encountered is already described elsewhere,
- there is some general discomfort about discussing this particular protection all over again

and there is no use of code snippets, mem addresses etc
unless you actually try ...
nothing vague in my description
cookbook unpacking, cookbok fixing - it does not work
target available offboard (saving some bandwidh)
two (initial) time consuming tasks included
oep and it
puzzled
07-05-2002, 12:27 PM
:o :o :o

the ones who actually tried might have found
that a call at 006B83FC (aka 002B83FC aka 014DCE98)
is actually FreeResource, not freakin GetVersion
silly me :o
well i've said i'm a lamer :p
puzzled
07-08-2002, 04:14 AM
ok, asprotect removed, works well on 9x/2k/xp
fixed properly, one crc check, activated ...

dede, however, does not take it at all (though it identifies
proggy as delphi 6 when dumped from memory) !
2.5 nor 3.0b nor 3.02

and forms looking really strange in exescope/resource hacker

wtf ? would someone enlighten me please ?

asprotected
pqrs://downloads.come2store.com/puzzled/ht.zip

unpacked
abcd://downloads.come2store.com/puzzled/ht_unpacked.rar

thanks :o
puzzled
07-09-2002, 08:56 PM
brothers, sisters, romans ?
anyone ?
just take a look at the bloody thing, please :p
(forms that is, in a resource viewer such as exescope)
or process with dede
esther
07-10-2002, 12:09 PM
Hi,
The reason there's no reponese cuz you didn't show your effort here.We will treat it as a crack request and would delete in 2 days...
puzzled
07-10-2002, 03:18 PM
for christ sake, I DID ALL THE JOB ALREADY :p
which was the reason i posted this in a separate thread.
it is unpacked, fixed and cracked. done. finito.
isn't that bloody obvious ?

all i need is that someone with bettter knowledge
about delphi forms give a second opinion ...
cripted (not likely), protected, stripped, new format, what ?
:rolleyes:
Kayaker
07-10-2002, 05:37 PM
Probably be better if you confirmed your download files were OK before you start spouting off too much.

WinRAR gives me the following error messages on multiple d/l attempts on your unpacked file:
1 ht_unpacked2.rar: Unknown method in ht_unpacked.exe
2 ht_unpacked2.rar: No files to extract

To start with, the fact you are supplying a link to a fully unpacked app makes it a crack, justification enough for deleting the whole thread outright.

But since your request is a little bit different I'll try to help. I've noticed DeDe sometimes doesn't handle unpacked apps, hardly surprising considering the .rsrc section was likely asp packed as well except for the original icon and version information. You may need to rebuild some pointers in the PE header to the RCDATA resources or you've got some other corruption going on. Try PEBrowse and see if the pointers and pointers to the pointers in the various resource section entries are valid.

">forms looking really strange in exescope/resource hacker"

'Really strange' means what?

Forget about posting your unpacked file, how about a more descriptive approach to the problem and you might find you'll get a more positive response from people.

Kayaker
puzzled
07-10-2002, 06:00 PM
Originally posted by Kayaker
Probably be better if you confirmed your download files were OK before you start spouting off too much.]

of course i did

WinRAR gives me the following error messages on multiple d/l attempts on your unpacked file:
1 ht_unpacked2.rar: Unknown method in ht_unpacked.exe
2 ht_unpacked2.rar: No files to extract.]

it was packed with winrar 3.0. i've just redownload the file
and it unpacks ok.
caveat: no download managers

To start with, the fact you are supplying a link to a fully unpacked app makes it a crack, justification enough for deleting the whole thread outright..

i just saw the import table attachment deleted here for the same reason.
where is the line ? and if i post all the relevent information in a text form here then it's kosher ?
a crack ? for what ? nobody even knows the apps name.

:confused:
Kayaker
07-10-2002, 07:47 PM
Hi

I'm not trying to get into a debate over this. I've got winrar 2.71, maybe this has something to do with the corrupt file, which is why I suggested you describe the problem in case nobody else could view it either.

Where is the line between what's OK to post as an attachment and what's not? That's a good question. It's a balance between supplying what's honestly needed to get help on a valid problem, versus what may be a pure crack request, versus what we can get away with without giving the TPA and others ammunition with which to launch yet another lame attempt at closing this place down.

There's a history here that may not be apparent to the newbie or casual viewer, or even to the regulars, as to the continuing attempts of certain individuals/groups to get the hosting ISP to close this site. After several unsuccessful attempts (the latest not that many weeks ago), their final arguments have withered to the occasional accusation that this site supplies cracks or serial numbers. Their unfounded accusations of "warez" have disappeared at least from their latest libelous statements.

So, it falls on the admins to try to keep these dogs at bay. My theory is if we can keep the discussions under the realm of "intellectual property", and don't give 'em anything smelling like a crack or s/n, then they've got no case and we'll be left alone. Am I being anal (or delusional) about this? Probably, but that's what I'm getting paid for ;-> This is however a community MB, and all decisions are at least open for discussion.

This is *partly* why I try to stress describing the problem rather than posting some file or other. Another reason, and probably more important, is that I've always found that the process of having to describe a problem in an understandable manner to someone else goes a long way towards actually solving that problem yourself. Too often posts are vague 'help me' requests with little to go on, after the person has finally given up.

I hope people better understand my actions of deleting certain attachments, and maybe someone has a better idea of guidelines we can follow.

Kayaker
puzzled
07-11-2002, 04:28 AM
my god, i really look like an ueber prick, heh ?
first esther accused me of asking a cracking service,
then you accused me of crack distribution !
in the same thread, lmfao :D :p

anyway, here is what i've found.
TPF0 identifiers are missing from all forms.

00 00 00 00 10 TCodeGenerate.frm

instead of

TPF0 10 TCodeGenerate.frm

when i entered the strings manually resources became visible in all res viewers.
file does not run (invalid data stream) until the same identifier is
entered in the .data section, offset 1D021C ( virtual 5D161C)
dede can (sort off) process modified file from memory.

also, complete PackageInfo (RcData) is stripped down.
is there any way to recreate this one ?
Kayaker
07-11-2002, 06:58 AM
Heh, heh, it's nothing personal I hope you understand. I'm probably the one who looks like a ueber prick, but I figure it's the price I have to pay for trying to protect the board. I've been hanging around here a long time and I've seen the board disappear a couple of times, and it's only because of the hard work of Woodmann and Tsehp that it was able to be back up on another server within a few days. I've also seen us close to being off the air again more than once as well since, so this more than anything has probably made me an overprotective mother hen ;p But we've got a good thing here, so I figure it's worth it.

That aside, now that it's described, that's actually an interesting problem. It's odd that the file would be dumped without the TPF0 identifiers already present in memory. Can you confirm that they are in the original file just before dumping?

It's *possible* that once a Delphi forms are created, the resources themselves are no longer required unless they need to be recreated. If the forms were created during unpacking then the TPF0 Ids might theoretically be erased afterwards, which would fup the dump. There would be overhead doing it this way because forms like the About box would have to created hidden until called, but once created or copied elsewhere in memory, the original resource template itself might not be needed. Just a theory.

If the resource section is identifiable at all in Reshack, can you 'fix' the problems and recompile the script to get it recognized by DeDe?

Kayaker
puzzled
07-12-2002, 10:34 PM
to the best of my knowledge, everything that is missing
wasn't there in the first place ( based on unpacking/decrypting
aspr routine observation)
which indicates that it's not needed at all !
and is stripped down just to confuse decompilers.
dede, reshack etc are obviously heavily relying on
before mentioned info.
maybe future versions ...

now, is this a built-in delphi compiler "security" measure
(delphi 6 client/server enterprise)
or some lucid programmers moments ? :p

it would be helpfull if someone actually take a look
at both packed and unpacked exes
;)

sidenote: you cannot actually try the proggy, databases are missing but take it on my word - unpacked thingy works
perfectly
Kayaker
07-13-2002, 06:05 AM
Hi

I had a good look at the original file, the problems may be associated with some changes introduced in Delphi 6, or possibly that it's a language-specific compiler option, the program is definitely non-english in origin. There's nothing obviously tricky going on, everything is standard Asp, all form creation calls and such are in regular code. ResHack recognizes the resource structure fully, except for the usual Icon and Version info. DeDe recognizes nothing, neither does Exescope.

The only thing unusual is the 1st dword of most of the Rcdata resources, and as you mentioned PackageInfo, which simply seems to be a list of form and control names and such, is empty. It may be something compiler specific with the language used. Rather than TPF0 identifying the start of each resource, there's a zero dword, then the length of the string that follows.

With some of the resources you could guess that they have a new identifier and the "TPF0" becomes unnecessary. There are several "T" forms that look to be changed to "TQR" forms for example.

---------------------------
This Delphi 6 foreign-language app:
00 00 00 00 0B 54 51 52 41 62 6F 75 74 42 6F 78 .....TQRAboutBox
0A 51 52 41 62 6F 75 74 42 6F 78 04 4C 65 66 74 .QRAboutBox.Left

Regular Delphi 5 English app:
54 50 46 30 09 54 41 62 6F 75 74 42 6F 78 08 41 TPF0.TAboutBox.A
62 6F 75 74 42 6F 78 04 4C 65 66 74 03 24 01 03 boutBox.Left.$..
----------------------------

But then with others it's obvious there must be a pointer list somewhere:
00 00 00 00 0B 54 53 70 6C 61 73 68 46 6F 72 6D .....TSplashForm

Probably a manual rebuild as you are doing is all you can do, unless you want to give a shot at trying to reverse DeDe itself and get it to recognize the unusual structure.

Good Luck,
Kayaker
puzzled
07-13-2002, 08:20 AM
well i could change a thing or two in dede
but only if i face at least one more example of
this childish obfuscation ;)

that's it then, thank you guys and girls for not banning
my sore ass for vague descriptions, lame explanations
and sneaky attempts of crack trafficking :p :D
Kayaker
07-16-2002, 12:32 AM
I don't like mysteries (or maybe I do and that's the point ;) , but I was wondering if it was *possible* that the programmer made some changes manually to this Delphi app to prevent DeDe and other reversing utilities from fully recognizing it, or whether it was just some compiler accident or something. Wouldn't actually be a bad trick, Asprotect is efficient enough as a packer to reduce executable size for distribution, but it's really not as secure as it once was (we all know that story ;p

*If* the app is laid naked from Asprotect then it falls on any further protection the programmer may have implemented, and DeDe is arguably the disassembler of choice for Delphi apps. So I did a little checking and found that the "TPF0" identifier at the start of every Rcdata resource form can actually be replaced by any other string combination, including zeroes, as long as another location is changed to reflect the new "identifier of the form identifier".

For example, an Rcdata resource normally begins with "TPF0"

0004E3E8 54 50 46 30 06 54 46 6F 72 6D 31 05 46 6F 72 6D TPF0.TForm1.Form

and there seems to be another single location that tells Delphi to look for this:

00042AB7 00 00 40 1C 46 54 50 46 30 ..@.FTPF0

But these can be replaced with *anything* and the app will still run, but DeDe won't recognize it. i.e., here I replaced TPF0 with "1234":

0004E3E8 31 32 33 34 06 54 46 6F 72 6D 31 05 46 6F 72 6D 1234.TForm1.Form

00042AB7 00 00 40 1C 46 31 32 33 34 ..@.F1234

I don't know what this single location (@ 0042AB7) that defines the identifier actually represents, but it seems common to all Delphi apps I checked. I also tried replacing the PackageInfo structure (which DeDe also uses to get its Unit List) with zeroes, and again the app ran OK.

So I don't know if this solves a mystery or creates one, but there it is for what it's worth ;-)

Later,
Kayaker
Lbolt99
07-16-2002, 01:24 AM
Interesting that one can change those first few bytes to totally throw off the decompiler like that, and still have the app run perfectly.. thanks for the analysis, will keep in mind :)

I ran into something similar (see thread "Delphi Obfuscation"). Dede could still recognize and disassemble most of it, except that the procedure code for the "About" dialog thing was totally garbage... Knowing that's where someone might go looking first, I think the author did it intentionally somehow.. didn't really look into how it was done, haven't had time, but it involved some encrypted strings that are all decrypted at a certain point..

Basically, the limitation in shareware version was that you couldn't enter more than 12 tasks at once. My approach was to find the spot right where the decryption occured, bpmb ds:xxxxxx rw the text in ram that it prints when you try to enter >12 tasks, a couple minutes later I found the comparison.

Interesting and weird protection.

Seems that Chameleon Clock and Chameleon Desktop have similar issues.. I'm looking into those as soon as I have time.


Hiew...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hiew...
PDA

View Full Version : Hiew...

acoolcat
07-08-2002, 07:49 AM
hello i am pretty new to all this and i have a question about hiew
whenever i try to edit something in hiew it tells me that it is in read-only mode
either there is a way to get it out of read-only mode that i dont know of or u have to buy the whole thing to do it
im guessing its one of the two...
if u know of a version of hiew that will let me edit files then please tell me where i can get it
Thank you
Fake51
07-08-2002, 12:13 PM
Close the file you're working on before you try to edit it. In the case of system files, shut down the system first ;)

Fake
nofurs
07-08-2002, 12:14 PM
Hi,
Check the file if its a readonly.You have to change the atrributes of the file or save it another name.

PS:Please don't ask WAREZ in here!
nikolatesla20
07-08-2002, 01:40 PM
Hey, I don't see warez being asked for in his post.

Give the guy a break, he's new to things, and didn't know if his version of hview wouldn't let him edit files or something. He just wanted to know if there was a different version that would. I never saw a request for warez copies.

-nt20
Js
07-08-2002, 02:42 PM
Hiya,
Haven't used hiew in a long time but from what I remember you could not edit a file if it was already opened by another program, wdasm for example.
SpeKKeL
07-08-2002, 02:58 PM
Allso close all the prog's which are using the file you want to edit!!
Like you w32dasm-disassembler !!
;)
SpeKK
acoolcat
07-08-2002, 06:09 PM
thanks that worked i had it open in wdasm at the time...
no i was not asking for an illegal copy of it
just seeking help
help that i got and im sure i will be back to these boards again
lots of helpful people
Thank you
nofurs
07-08-2002, 06:14 PM
Hi acoolcat,
Glad I didn't pissed you off hahhahaha.Happy cracking :p

best regards

cluesurf


Hardlock Envelope: Hl-Crypt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hardlock Envelope: Hl-Crypt
PDA

View Full Version : Hardlock Envelope: Hl-Crypt

votan
07-08-2002, 10:03 AM
first of all, hi all forum members..
i have dealt with a win32 program protected by hardlock envelope.. this program is a vb one, at the start it behaves as p-code,then turns native code.. anyway.. i read M4V3RiCk HL-API hardlock essay.. it is really helpful tut. then I tried to de-envelope the program.. in envelope I found Hl-login,Hl-Avail and Hl,version services.. i emulated these services.. envelope decrypted encrypted sections and filled some imports from kernel...then the program crashed in .protect section when it called some imports from kernel: getmodulefilenamea,virtualqueryex etc... the error message is related to page error (virtualqueryex) instead of a envelope error..
I have some Qs about that: maybe some of among u had some experiences.. is my decryption without right dongle successful ? maybe envelope read some decryption key from dongle... another Q is that Crackz wrote at the beginning of Maverick's tut about envelope mechanisms. He said that after decryption there is also import trashing.. is this the reason for the crash???
tnx everyone right now...
mueller5321
07-10-2002, 10:01 AM
Maybe i can give you a little help.
When you have emulate the login , avail and version.
you get to the part where first the importtable is decrypted hl_crypt and afterwarts the importtable is rebuild .
These can (in my opinion) only be done with the real dongle.

But if you have for short time the original one,
i have the following solution depending on the envelop version.
For me the following work very well :-)

When you have start the original Programm dump it with Procdump.
Then replace the segments in the orignial version which hold the crypted importtables with the one of the dumped version.

Now you have only to change the call in the near of the OEP which call the envelop routine to the address of the call which du the importtable rebuild. It can be found in the near of the ret from envelop.
The best thing is that the jmp to eax is the also be corrected and you need only to change some values in the importtables which were double decrypted to the original value back.
But these are very obvios You can detect them by the value very simple.

Now the program should work without the dongle.
But only if there is no futher checkinside the main program.

By my target they use hl_crypt also inside the main program and so it is very hard to go on. Also the api-Calls are done always via jump tables which make it not really good to disamble and to understand what happen inside the program.

Maybe there is a better solution with a emulated hl_crypt routine.
but for this you need some more information about the dongle.
votan
07-10-2002, 02:00 PM
tnx for your interest..
unfortunately, i havent the original dongle but your reply still helped me.. if you didnt reply probably i would spend more hours on making the program run :)
yes, dump methode is the best solution against dongle envelopes.. I think without using dongle's high level apis, Hl crypt mechanism does some checks while program runs, not only at the start of the program... so after dumping we still must deal with hlcrypt:)))
though I dont support dongles, I should accept that Hl crypt is a good protection unless we have the original dongle:) some programs run as demo mode if no dongle is present,so we can have a chance because program is decrypted :)) my program doesnt have a demo mode..
tnx again...
mueller5321
07-10-2002, 09:45 PM
Maybe i should tell it to you more exactly.

Normally if the producer of the target use only the Envelope, the protection can be beated very easy with my methode.
Because after you have used it, no dongle is needed anymore. :-)

Only if the target is protected more well, then the coder use also inside the target before he crypt it with the envelope dongle calls.
But there are also good and bad solutions.
If he only check the presents it is no bit deal to use mov eax, 1;ret :-)
But if also some parts are decrypted dynamic it is much more difficult.

There is a very easy methode to find the correct oep on some versions of the HL_crypt envelope.
Together with some zen you can check if there is hl_crypt used inside the decrypted target.
You must just use the information what the target give to you :-)

Have something forgotten :-)
The envelope starts normal a continues check of the dongle. So if you only emulated the first 3 HL-API calls. you get later problems with the timetriggert HL-api calls. But with my methode.
The check is canceled before the begin to use it :-)
The mainpart of the envelop is not executed anymore. also not the init routine which start the timetriggert check :-)

Maybe there are more parts of your target.
for example my target have a very great main program eveloped and some small utilities also enveloped as additional tools.
These are very small but use the same technic. so you can try to learn with the small ones before handle the big one.


cxbx needs "xbox.dll" ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > cxbx needs "xbox.dll" ;-)
PDA

View Full Version : cxbx needs "xbox.dll" ;-)

emma
07-08-2002, 11:33 AM
Hi guys

from - http://www.caustik.com/cxbx/:

cxbx is a program that converts a raw xbox game into an executable PE (.exe) file, so that eventually it can be played on your PC. It is unsure what the system requirements will be to play these translations, but almost definately your CPU will need to be a P3, and you will most likely need a GeForce card comparible to the xbox's.

Tried it on some of the .xbe of the tools available, and it seems both IDA and w32dasm disassemble the sections of the PE.

Now all we need is an "xbox.dll" with all the library calls in right? :D

Would such a thing doable (lets assume "in theory"), or is the concept way off?

€-penny for your thoughts
Lbolt99
07-08-2002, 05:59 PM
Interesting.. wonder how long before M$ tries to shut the site down. Anyway I figured it wouldn't be too long before x-box emulators come into development. It should definantly be possible to develop an xbox emulator - probably easier in fact than the PS/PS2 emulators: it's Intel based code right off the bat.


SentinelLM 7.1.1 - 7.2.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SentinelLM 7.1.1 - 7.2.0
PDA

View Full Version : SentinelLM 7.1.1 - 7.2.0

moZfet
07-08-2002, 01:59 PM
Hey there,

after a short review around latest sentinellm sdks, I can tell than nothing seem new at all

Except that most of function name are randomized ( 7.2.0 )

Locating the GetVendorCode function, is still easy as stated in an essay ( "%s error: Illegal vendor identification." )

Here I didn't notice any antidebug trick around what I looked at

also, either installer serial scheme and watermark scheme are still same...
even the compromised serial published in an essay isn't blacklisted

The best for the end, a 7.1.0 sdk can still generate valid 7.2.0 licenses

then nothing new around what do we need to know!

PS: 7.1.1, 7.2.0 sigs, and also lsapiw32.dll nms files are available on request, have fun!

Sorry for my frenglish , cya for now


plz help!!! Advanced MP3 Catalog Pro - asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > plz help!!! Advanced MP3 Catalog Pro - asprotect
PDA

View Full Version : plz help!!! Advanced MP3 Catalog Pro - asprotect

memento7
07-08-2002, 10:10 PM
Hi all

i've been struggling with this asprotected piece of crap for some days but by now i'm stuck absolutely.

it can be downloaded from here:
http://www.wizetech.com/download/amcpro.zip
(ver : 2.00h )

- i found the oep : 15cba8
- fixed the import table (by the help of revirgin/win98): attached
(iat: 1651b8 len:818)
- fixed the pe header

when i run the dump it crashs : access violation at 102256

i examined the code
(registers' values are the same)

the prog wanders to a memory location that exists only in the original version

thereafter it moves/decrypts/unpacks lots of data to 13dxxxx

i think it's an asprotect trick
but i'm yet too few :) to solve this problem

i hope anyone could help me

byez
Kayaker
07-08-2002, 11:14 PM
Hi

I deleted your attached IAT file. We can't have copy 'n paste crack attachments that give it away here, and it doesn't really help anyway.

The first question you need to answer is what is in the memory address the code wanders off to, a variable, an address, or more code? Whichever it is, the tricks to handling the Asp redirections have been discussed before, a little reading and understanding will go a long way.

Try doing some reading of past Asp threads and rethink the problem with them in mind. Spend more time in the code and you just might be able to figure it out on your own.

I'm not suggesting you can't get help here, just encouraging you to do a bit more work and come back with more detail. One more app specific answer doesn't add much to what's already here to learn from.

Regards,
Kayaker
memento7
07-09-2002, 03:20 PM
hi

first of all thanx for your advices
i'll follow them

but i think my problem havent been discussed yet
(i'd collected all the info about asprotect that i could,
i'd also read the asprotect stuffs in this forum before i wrote here)

hitherto i haven't read about a thing like this - its not an api redirection, the problem emerges after the original program starts

i wrote because i run out of ideas....
but i have to keep on tryin' :) - you are right

thx and byez
Kayaker
07-10-2002, 03:45 AM
Well, I didn't mean specifically an API redirection. From what you said the code in your unpacked file goes to a high mem address which is no longer there. What I was trying to get at, and what was unclear from your first post is what's at that address in the original version? You said thereafter it moves/decrypts/unpacks lots of data to 13dxxxx, but I wasn't clear how that's directly tied to the high mem jump. Does this all occur during the high mem code or do you jump back to program code first? This could be important because maybe a variable is being checked and the decryption code could be avoided.

What is the decrypted code doing? Can you make any sense of what is being handled in it? Does it access the registry? Check a keyfile?

If what's at the high mem address is just a variable (may have been placed there during unpacking and is the return result from an API call which is used later let's say), then you may be able to duplicate the value in a spare section of your dumped file or replace it with a RET.

If it's an address that points to unpacked code, then you may be able to duplicate the address or emulate the missing code. If it points to high mem code, then keep tracing.

If it's a short code section which seems to jump to kernel code then this is an API redirection that maybe your IAT resolving didn't pick up, or you have one of them wrong.

It could be caused by one of the 'Double dips', in which case there are special ways to handle that during dumping, and better people to explain it than me.

The point was I didn't feel you gave enough explanation as to what the problem was without someone having to crack the program themselves, then tell you how to fix it, *if* they could duplicate it. Some kind soul might do this, might not. Or you might have to wait a long time for no answer. But with a bit more detail someone might be able to help just from your description. Try to analyze exactly what's going on and you may pick up clues on how to fix it.

Kayaker
+SplAj
07-10-2002, 07:24 PM
Mem7

There is nothing new here (except the 'rebased] aspr code to get to OEiP)

You need to examine your rebuilt.exe at offset 0x161000 length 1k...if there is anything otherthan zeros you got caught by a DD
and InitializeCriticalSection already flagged.

My dumped exe runs fine.

Spl/\j
memento7
07-11-2002, 02:09 PM
thanx SplAj

ok, i'll do so...
(but it seems i still need to study the forum...)

byez
memento7
07-13-2002, 08:34 AM
hi

finally... it runs :D

im so happy - - -

yesterday i fixed it. i just had to dig in the prior posts and now
i know wtf is DD - thanx to +SplAj for the hint

but one thing is not clear yet

i found 3 dips before oep:
- 401014 - not really interesting
- 55C3F4 - yeah its a "big" dip
- 4FB6A4 - sets some variables

so i skipped (just NOPed the CALL itself) the second one and dumped at oep,
fixed it and "who knows maybe it runs" and run!!!

but i hadn't called the skipped dip yet. thereafter i made the call and the jump to oep - but it still runs... - dunno why (the posts i read said that the dip have to be called before oep to make the target run - in this case it seems to be unnecessary)

one more question : are there any methods to find pre-dips outside /tracex?

peace&love (dont be a hippie :)

byez

ps. sorry 4 poor english


C source code for an assembler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > C source code for an assembler
PDA

View Full Version : C source code for an assembler

IcyDee
07-09-2002, 12:28 PM
I have an idea for a protection system but I need to include an assembler in my program. Ideally I would like the C source code for an assembler for the 386 family which I could then chop and change to fit it into my program.

It must generate machine code directly from the assembly language text input, not use external files (dlls etc.) and not require a linker (since all code will be in one file).

I have previously found a Linux version but this was not suitable since it has to run on Windows.

Regards
IcyDee
TBD
07-09-2002, 01:32 PM
you can try Olly sources from OllyDbg at
http://home.t-online.de/home/Ollydbg/srcdescr.htm

hope it helps
TBD
Clandestiny
07-10-2002, 02:14 AM
Have you checked into NASM source code (netwide assembler project). Its written in C. There is also source for a disassembler.

http://sourceforge.net/projects/nasm

Cheers,
Clandestiny


Need help with foxpro please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Need help with foxpro please
PDA

View Full Version : Need help with foxpro please

get2
07-09-2002, 08:22 PM
Hello Everyone

Need a little help with some math, I suc$ at math.

Workin on a VFP program got it decompiled found the password check looks easy but I dont understand the math and was hopin someone here would be good enough to explain it to a stupid person ( me ) . Dont know if its the math or VFP killin me :). Here is the code

FUNCTION checkpassword
LOCAL nrAndom1, nrAndom2, npAss, nrEsult
nrAndom1 = INT((MOD(RAND(INT(SECONDS()*100)), 1000000))*1000000)
nrAndom2 = INT((MOD(RAND(INT(SECONDS()*200)), 1000000))*1000000)
thIs.doForm('\Shared\PassWord.SCX',nrAndom1,nrAndom2)
npAss = VAL(maInapp.foRmreturnvalues(1))
ntEmp1 = (INT((MOD(nrAndom1, (100)))/10)*(100000))+((MOD(nrAndom1, 10))* ;
(10000))+(INT((MOD(nrAndom1, (1000000)))/(100000))*(1000))+ ;
(INT((MOD(nrAndom1, (10000)))/(1000))*(100))+(INT((MOD(nrAndom1, ;
(100000)))/(10000))*10)+INT((MOD(nrAndom1, (1000)))/(100))
ntEmp2 = (INT((MOD(nrAndom2, (100)))/10)*(100000))+((MOD(nrAndom2, 10))* ;
(10000))+(INT((MOD(nrAndom2, (1000000)))/(100000))*(1000))+ ;
(INT((MOD(nrAndom2, (10000)))/(1000))*(100))+(INT((MOD(nrAndom2, ;
(100000)))/(10000))*10)+INT((MOD(nrAndom2, (1000)))/(100))
nrEsult = nrAndom1+nrAndom2+ntEmp1+ntEmp2
RETURN nrEsult-npAss
ENDFUNC

Any help would be great Thank you all so much!
dion
07-10-2002, 03:41 AM
looks like a timestamp mechanism there, or if it uses random val (such return val from main app), then u should be aware if it is a fake. anyway i think the key can be seen after function.
get2
07-10-2002, 02:57 PM
Thank you for the reply and takin the time to read this :)

What this program does I think is when you open the password screen it generates 2 random values then you put password in
Example

random1 xxxxxx
random2 xxxxxx
password ---------

I thought what it is doin is takin the sec and doin the math to get the 2 random values?? Then using the random1 to make the temp1 and random2 to make temp2 then adding them all up to get the result???

I tryed softice and disassemblin the exe with no results. In softice it will only break in the dll so I went this route with refox. Also I think the exe is encoded cause when you look at the files in refox most you cant make out but when you decompile and save it all makes sence. I hope this did :) Any help would be great !!

Thank you all so much
Strejda
07-10-2002, 04:55 PM
Notepad is your friend :)
After formating and converting "C"

ntEmp1 = (((nrAndom1 % 100 ) / 10 ) * 100000 ) +
(((nrAndom1 % 10 ) / 1 ) * 10000 ) +
(((nrAndom1 % 1000000 ) / 100000 ) * 1000 ) +
(((nrAndom1 % 10000 ) / 1000 ) * 100 ) +
(((nrAndom1 % 100000 ) / 10000 ) * 10 ) +
(((nrAndom1 % 1000 ) / 100 ) * 1 )

ntEmp2 = (((nrAndom2 % 100 ) / 10 ) * 100000 ) +
(((nrAndom2 % 10 ) / 1 ) * 10000 ) +
(((nrAndom2 % 1000000 ) / 100000 ) * 1000 ) +
(((nrAndom2 % 10000 ) / 1000 ) * 100 ) +
(((nrAndom2 % 100000 ) / 10000 ) * 10 ) +
(((nrAndom2 % 1000 ) / 100 ) * 1 )

nrEsult = nrAndom1 + nrAndom2 + ntEmp1 + ntEmp2

and nrEsult is your password
--------------------------------------------------------------

so, if nrAndom1 is
[(x5)(x4)(x3)(x2)(x1)(x0)]
and nrAndom2 is
[(y5)(y4)(y3)(y2)(y1)(y0)]

then password is
[(x5)(x4)(x3)(x2)(x1)(x0)] + [(x1)(x0)(x5)(x3)(x4)(x2)] +
[(y5)(y4)(y3)(y2)(y1)(y0)] + [(y1)(y0)(y5)(y3)(y4)(y2)]

for example if
random1 543210
random2 109876
then password is
543210 + 105342 +
109876 + 761908 = 1520336

Strejda
get2
07-10-2002, 10:23 PM
Strejda:

Thank you for your reply you are the greatest figured it out but not by the math I'm still a little lost. If you would be so kind as to see where I'm going wrong. I like to learn. I guess what I dont understand is the "%" I'll take the first line for and example

(((nrAndom1 % 100 ) / 10 ) * 100000 ) +

random1=543210

so

(((543210 % 100 ) / 10 ) * 100000 )

now is that 100 percent of 543210, divided by 10, times 100000

100% of 543210 is 543210/10=54321*100000=5432100000 ??

I know this is wrong the numbers end up too big sorry for being so stupid. I figured out from your example how temp1 is gotin but i did it by moving the numbers in random1 and it worked :) but i would really like to know the math how you got it. I know your probley very busy and I really thank you for takin the time in the first place to post, if I could have just a few more minutes of your time I would really appreciate it. There is no rush. just want to learn.
I have been working on this program on and off for 6 months, this is the 2nd happiest day of my life finally beat this sucker :P with your help ofcourse :)
btw the happiest day was finding this place and all the great people here

Again thank you
puzzled
07-10-2002, 10:31 PM
% is mod operation = remainder by integer division

103 % 100 = 3 etc ;)
get2
07-11-2002, 05:12 PM
Thank you puzzled :)

I was so excited I completly missed that, boy I feel really stupit right about now! Anyways Thank you dion, puzzled and a big

THANK YOU Strejda :) :)

Have a great day !!!!!!!!!!!!!
get2
07-13-2002, 04:25 PM
Well it seems the password was the easy part, found another problem!

This program is able to be updated with CD's, it updates pricing, now the problem is it looks at the age of the CD if it is to old the program will not run. There is a ID file on the CD, what I tryed to do is copy the whole CD to the hd change the date on the ID file burn it all to CD, that didnt solve the problem. There are a lot of files on the CD with dates close to the CD date.

Any advise on this kind of protection ????

It is a VFP program seems to be encoded, I cant even find the message with the error in the program. I set break points in SI but always end up in the dll. Also if i back date the pc it runs fine the problem is, when it prints and invoice it would be the wrong date.

My next step is to change the dates of all the files on the CD but there is alot of them. Any ideas on how to do this easy???

Any help on this would be great thank you all


Announcement: ProView 0.5 Test Build
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Announcement: ProView 0.5 Test Build
PDA

View Full Version : Announcement: ProView 0.5 Test Build

Bengaly
07-10-2002, 01:16 AM
Heya Fella RCE's

I want to release my so Far app i'v been working on (mainly for personal knowledge),
this time its a:
PE Viewer
Disassmbler
Packer Identifer

i want to hear any commets (bad/good),
its still in development so give me a slack ;)
i hope ppl somehow find it useble cuz i dont because all of those tools around ;)

attached, 41kb
Tested Under win98SE (2K/XP/NT unknown, should work though)
thnx to all who have been working along the way ;)
ttl
Bengaly
evaluator
07-19-2002, 09:38 PM
YEP!

Hey guys! How you can live without replies
Sensei-Bengaly's thread???

Ok, I download this cake and tested on itself!
(closer)

So nothing displayed in "Export/Imports" for UPX-ed EXE??

***********
more, more bugs, plEasE:)
evaluator
07-19-2002, 11:35 PM
HQ Bug report...

0002) OK, now I de-UPX-ed Proview.exe and try again "Import/Export".
Nothing again:(

0003) I open FMEMPRO.EXE (delfi).
No more response...

0004) ORDINALs looks very funny in "Import/Export"...
You shoud "disassemble" them into decimal...

*******
continued...continued...continued...continued...
Athlon
07-20-2002, 03:23 AM
it just wont work at all on my 2000 it will load the file but if you try any options it will just freeze
Bengaly
07-20-2002, 10:49 PM
err thats an old built ;P
kinda crappy ;)

i have no idea about winCrappy2000 sorry ;)
Kayaker
07-21-2002, 07:43 PM
Hi Bengaly,

Kudos on your ProView app, looks to be handy. From your readme file I see you developed your own disassembler engine, nice work. If you want to pursue this there are a few things you might want to check out.

You say you've picked up 50 or so opcodes that you can parse into correct disassembly so far, out of easily 100,000 in a medium sized app. Still, that's a good start on being able to map out the entire Intel 1 and 2-byte opcode map. Developing code from scratch would be a lot of work, just take a look at the source of Borg or the NASM disassembler. Really, your best best would be to incorporate an existing disassembler into your code.

But if you want to continue with it, check out a couple of things by Z0mbie. There's a PE_STAT program, which calculates frequencies of the PE EXE/DLL opcode usage (Opcode Frequency Statistics). On a 2.5Mb file I got 107478 distinct opcodes being used, the first 2 being 8B and 89 (mov modr/m) at 19% and 9%, then E8 (Call) at 5%. You may be able to develop a strategy based on this.

Another thing you could use is his Length Disassembly Engine, LDE32.bin. It tries to recognize sections of bytes as discrete instructions, defined by the base 1/2 byte opcode. This you still have to parse into a disassembled instruction. It actually works pretty well incorporated into your own code, but it's written as a byte patch and not easily modified (or understandable) unless disassembled itself. As it stands I've found it isn't able to recognize a number of newer opcodes and had errors because of it.

I ended up using the NASM disassembler as a module, I would think it's probably the most updated around. While the main disassember engine disasm.c isn't being worked on any more, some of the associated opcode files still are, with new versions out often.

Cheers,
Kayaker
Bengaly
07-21-2002, 08:11 PM
Hi Kayaker,
thank you for your reply (the only kindly one here..),
i know its allot of work to make an disassembly engine,
and i know there are some diasm.c sources out there, but i still wanna do it my own and from scrach, this way u control all around enviorment.
the beta proview above is really old by now..and have a very bad diss view and also limited size, which doesn't in the current built,
the real problem on decoding opcodes come when some are used for multiple instruction (i.e: 0x80 opcode - big one..).
as for those apps you have mentioned above, i will check them out (thnx)...
i have seen borg/nasm & others, they got some cool coding which can make ur life much esier, but the point remains when u need to make a uni project..i am on my own this time..
and i think i will cover usefull list of opcodes in 2 years..
also need to concern about packer identifier (any good byte signatures list arround?) and such..

Greets
Ben


Help please about FLAIR.Enter please.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help please about FLAIR.Enter please.
PDA

View Full Version : Help please about FLAIR.Enter please.

allex02
07-10-2002, 01:31 PM
I'd like to make signature for FLEXLM 70e SDK.
I type following command but I got a message which is
"lmgr.lib is not object file press enter to exit."

plb -c lmgr.lib f70e

I'd like to what's the problem of usage of PLB.Thanks.
jsteed
07-10-2002, 03:02 PM
Use: pcf lmgr.lib lmgr.pat
That should take care of your problem.
jsteed
allex02
07-11-2002, 02:10 AM
Thanks. I can make signature.
But what is the difference between pcf and plb?

Best

allex02
allex02
07-17-2002, 03:43 AM
It is OK on window but I got failure when I try to make
sigunature for UNIX version of FLEXLM SDK.

How can I go?
allex


aspr 'randomizer II' f*xed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > aspr 'randomizer II' f*xed
PDA

View Full Version : aspr 'randomizer II' f*xed

+SplAj
07-10-2002, 07:35 PM
ppl

Some infos about latest ASPR code that 'rebases' the code that decrypts to POPAD JMP EAX (61 FF E0)

Some of you may remember the earlier aspr that used GetTickCount to constantly rebase itself on each run....VERY fuckin annoying. Well Alexey stopped it cos it was found out and a soloution posted. Well, here we go again ;)

Now with GetSystemTime.........

Here is AdvancedMP3Crapalot Pro:-

0167:00DA2658 55 PUSH EBP 
0167:00DA2659 8BEC MOV EBP,ESP
0167:00DA265B 83C4E8 ADD ESP,-18
0167:00DA265E 8D45E8 LEA EAX,[EBP-18]
0167:00DA2661 50 PUSH EAX
0167:00DA2662 E811EAFFFF CALL KERNEL32!GetSystemTime <-used as 'randomizer'
0167:00DA2667 0FB745F0 MOVZX EAX,WORD PTR [EBP-10]
0167:00DA266B 6BC03C IMUL EAX,EAX,3C
0167:00DA266E 660345F2 ADD AX,[EBP-0E]
0167:00DA2672 6BC03C IMUL EAX,EAX,3C
0167:00DA2675 31D2 XOR EDX,EDX
0167:00DA2677 668B55F4 MOV DX,[EBP-0C]
0167:00DA267B 01D0 ADD EAX,EDX
0167:00DA267D 69C0E8030000 IMUL EAX,EAX,000003E8
0167:00DA2683 668B55F6 MOV DX,[EBP-0A]
0167:00DA2687 01D0 ADD EAX,EDX
0167:00DA2689 89053C50DB00 MOV [00DB503C],EAX <-store variable for later
0167:00DA268F 8BE5 MOV ESP,EBP
0167:00DA2691 5D POP EBP
0167:00DA2692 C3 RET

So (using SuperBPM or NticeSET to stop BPM ThreadContext shit)
POKE back into EAX a known value and location of the 61 FF E0
and then you can BPMB CS:<ASPR61FFE0> X

It was same code in ENT3.1 from Tamos.

Game over for now :)

Have phun.

Spl/\j
nikolatesla20
07-10-2002, 08:15 PM
And just when he's ready with the release candidate...

-nt20
Lbolt99
07-12-2002, 03:33 PM
Thanks for the description, was interesting.. so in a nutshell, if I understand it right, he's just making it move the POPAD and JMP EAX around each time the program runs? Pretty neat.. I'm wondering why he hasn't revised the protection in any other way, however. Seems it's just been obfuscating the OEP lately.

take care


3com firewall VPN enabling
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 3com firewall VPN enabling
PDA

View Full Version : 3com firewall VPN enabling

Lbolt99
07-10-2002, 09:49 PM
Hello,

This is kind of a different twist on "normal" cracking. Have a 3com Officeconnect firewall, hardware based. There is VPN functionality in the firmware, but it can only be enabled if you enter a reg number into the unit.

I got the firmware from 3com's site, the same version which is in the firewall. The CPU is a motorola 68360, 33mhz. Looking at the image (a .BIN file), seems to be executable code and then a list of filenames, mainly .html and .gif, concatenated onto the end of the bootstrap (I assume the executable code is boot-up code).

Need to get a 68xxx disasm to see the boot code, that's a whole another issue. The unit has a web interface, you enter the IP, comes to login screen utilizing cgi-bin.

When entering the reg number, it submits a form to a cgi-bin script. What I need to do is somehow "capture" this cgi-bin file from the unit, and was wondering if anyone has knowledge of how to do this. It won't just "download", says file not found when that's attempted, so it may be dynamically generated or something.

Another option would be to rip the cgi-bin out of the firmware image, but I cannot locate this in the image (no readable text), etc.. despite the face I successfully "ripped" one of the gif's by copying and pasting the hex bytes into a new file....

Any opinions?
Kilby
07-11-2002, 09:58 AM
The .bin file os probably a series of files packed probably using the zlib package.

Several router firewall appliances appear to run some form of cut down unix style os (Alcatel Speedtouch family for example).

Cisco routers are quite similar

The .bin file is decompressed from the flash memory, then executed.

If you can read italian this may help
hxxp://www.s0ftpj.org/bfi/online/bfi10/BFi10-14.html

If you find an english version please let me know as most of the translation sites on the web either cut off at the good bits ot format the damn thing into a single line of text.

This may also help you in the right direction for how alcatel anyway deal with the .bin files.
hxxp://security.sdsc.edu/self-help/alcatel/

Go to the patches and tools link.

Hope this is a pointer in the right direction.

Kilby...
Lbolt99
07-11-2002, 08:12 PM
Hi, thanks for the response and the information. I'll see what I can do about that Italian thing. Sounds interesting. Will post progess as it is made :)


How is this really done?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How is this really done?
PDA

View Full Version : How is this really done?

nikolatesla20
07-10-2002, 10:26 PM
Over the last few days I've been reading up on the Intel manuals, and some other O.S. programming tutes to get a better feel for pmode and such. My Question is:

I've read lately that some "protections" use a trick to enter ring0 so they can do whatever they want. Supposedly they take over the divide by zero handler or whatever and then do a divide by zero.

How do they exactly "take over" the handler. I mean most windoze programs you can install an exceptions handler, but I thought I was reading that a handler will execute in the priviledge leve of the current task, so if that task is ring3 the handler would be ring3. The only thing I can think of is changing the RPL of the interrupt call? Because hardware interrupts and CPU interrupts (such as divide by zero) ignore the RPL.

They couldn't modify IDT directly as far as I have seen with ring3 code- it's in a protected data segment I would think. Am I right? So how are they "hooking" or taking over the handler?

I still can't figure out what they are really doing...

-nt20
Fake51
07-10-2002, 10:46 PM
They couldn't modify IDT directly as far as I have seen with ring3 code- it's in a protected data segment I would think. Am I right? So how are they "hooking" or taking over the handler?

You can under win98 ... it's only on nt-based systems that the idt resides in protected memory.

Fake


p-code tut
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > p-code tut
PDA

View Full Version : p-code tut

gimmee
07-11-2002, 10:05 AM
Hi all

I have just finished a tutorial on key generating a VB5 p-code program. Wondering if anyone would be interested in giving feedback on it and if someone would want to host it somewhere. Might be crap but who knows.

thanks
How2Crack
07-13-2002, 05:41 PM
Hi gimmee ,

Great Work .. we all interesting
we are waiting ..

Regards
krobar
07-14-2002, 03:24 AM
hi gimmee

I would like the tut. About to have an update at: h**p://zor.org/krobar/
so if you can send it to krobar@anonymous.to, that would be good...

best regards

krobar
How2Crack
07-14-2002, 07:21 AM
Hi,

If you decide to send it by email .. then please don't forget me ;) : vb2002@hotmail.com

Regards
SilberFuchs
07-16-2002, 11:32 AM
i'm very interested in this tut, it's possible to sent me thisone?

ciao
SilberFuchs :)
r00t
07-19-2002, 11:41 AM
I want the essay too.

Thanks.

bandit@adinet.com.uy
The_Philosopher
08-19-2002, 06:00 PM
Send it to me too please.
The_Philosopher@zor.org
R@dier
08-23-2002, 05:58 PM
I would like to give it a read
Pls send to

Radier@graffiti.net

Thnx
SOLDIER8514
08-23-2002, 11:41 PM
another for me please ;) soldier.8514@caramail.com
evaluator
08-24-2002, 05:10 AM
:)

Hey!
Don't send me that tut!
Kornan B.bear
08-29-2002, 10:32 PM
could you please give me the essay?

just send it to bbbsl@sina.com

Thx lot!^_^
serkul
08-29-2002, 10:43 PM
here too: gudexxx@hotmail.com
pLayAr
09-01-2002, 06:13 PM
and me 2

pLayAr@eTang.Com

Thx lot!
mambox
09-05-2002, 10:51 AM
would be interesting.

i've done some studs on pcode months ago on few shareware.

haribo2000@yahoo.com

thanks!
LOUZEW
09-05-2002, 08:07 PM
would be interesting too.

louzew@libertysurf.fr

Thank's


How would I deal with java/html imbedded?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How would I deal with java/html imbedded?
PDA

View Full Version : How would I deal with java/html imbedded?

Gorr
07-11-2002, 04:31 PM
HI,
I have a programm which has a window which has activex web browsing component on it. if I left click the serface of it and press ctrl + f the mircrosoft explorer search window is shown.
I have also checked that msjava module gets loaded.

This all makes me believe that behind there is an html/java or other scripting language is used in place of key check routine.

If this is a java I heared the dump java class and decompile with jed approach could be employed. However I do not have any ideas on how to determing start and end addresses of the class to dump.

How to find the addresses or may there be other methods?

Any links to guides are much appreciated.

Thanks
Clandestiny
07-12-2002, 02:18 AM
Hiya Gorr,

Well, as it turns out dumping Java classes is surprisingly easy. If you look at the exports in your msjava.dll, you should see a java_lang_ClassLoader_defineClass0. This is the API the Java virtual machine calls to dynamcially load class files and the one you will probably want to place a bpx on.

The defineClass function's parameters are as follows:

defineClass
protected final Class defineClass(byte data[], int offset, int length)

Converts an array of bytes to an instance of class Class. Before the Class can be used it must be resolved.

Parameters:
data - the bytes that make up the Class
offset - the start offset of the Class data
length - the length of the Class data

Returns:
the Class object which was created from the data

From this API, you have the starting offset of the class in memory as well as the length of the entire class file (everything you need to do a decompilable dump of the class).

I used this technique on a rather unique 'packed' Java app at one time that dynamically loaded its classes from a crypted .bin file. I also noted that the start offset of the class data appeared offset by 8 bytes so the start address of my dump was the offset parameter + 8 of the defineClass API. You can actually determine the beginning of the class by visual inspection as all java class files begin with the signature byte sequence CA FE BA BE. If dumped correctly, you should have no trouble running your class files through a decompiler like JAD.

Ooh, gotta love Java's OOP... They make it sooo easy for us ;)

Hope this helps,
Clandestiny
chitech
09-07-2002, 01:21 PM
alo Clandestiny

I have try to dump a java class file from memory, but softice don't break. :(

I set a bpx on java_lang_classloader_defineclass0 (msjava.dll), -> Softice don't break But when I set bpx on _java_java_lang_classloader_defineclass0@28 (java.dll)-> softice breaks :)

The problem is that it don't looks like

push xxxxxxxxx
push xxxxxxxxx
push xxxxxxxxx
call xxxxxxxxx

I have attached the file I want to dump from

Please guide me...Thx

Chitech
Clandestiny
09-08-2002, 02:05 AM
Hiya,

I don't think your attachment made it onto your post... Can you try to attach it again or mail it to me so I can have a look at the target.

Thanks,
Clandestiny
chitech
09-08-2002, 05:42 PM
Here is the file....
esther
09-08-2002, 05:50 PM
Didn't you read the main Rce messageboards Regroupment.
No uploads.You should send by mail
chitech
09-08-2002, 08:39 PM
alo Clandestiny

I have solved the problem. It's because I use JVM from SUN, so I have to use java.dll instead of msjava.dll from microsoft.

I set a breakpoint on _java_java_lang_classloader_defineclass0@28

ebp+14 -> size
ebp+18 -> offset
ebp+2c -> image

When I dump from memmory I use this statement:

/dump image+12byte size c:\test.class

And it works :)

It looks like there are a little different between Microsoft & Sun JVM

Chitech


Just a small question.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Just a small question.
PDA

View Full Version : Just a small question.

nikolatesla20
07-12-2002, 04:08 PM
I know this probably doesn't belong on this board, but it is related to RCE in my opinion.

What I'm wondering is if anyone out there has read about Windows Internals.

The question I have is this: The Intel chip allows tasks to be seperated using TSS's (Task State Segments). OK, first off, does MS Windows (for example, Win2k) use the processor's ability to do this, or do they manage it somehow themselves? And further, the documentation states that TSS segment descriptors must be in the GDT. And the GDT only allow 8192 entries or so. If Windoze does use TSS's does this mean you really could only have around 8000 tasks or so open at once? (If you had enough memory?)

I know, basic questions but I haven't found anything on the web yet referring to particular OS's and how they work and I'm too cheap to buy a book about windows :p

If anyone knows of any good links about windows internal operation, I'd appreciate it. I DID manage to find some links on how Windows NT boots up. Great reading !

-nt20
Ni2
07-12-2002, 06:06 PM
hi nikolatesla20!

About Windows and the TSS....I was digging inside of Windows when i was doing my DOS-multitasker (ufff, long time ago :)) and you can see that Windows doesnt take advantage of the TSS to make task switching. Instead, it just changes the page directory (pointed by CR3) to "map" the new task in the processor.

I think i read that a task switch using TSS takes lots of cpu cycles. I dont know if that's the reason that windows prefers to use direct access to the CR3 register or it is because of the problem of the 8192 GDT descriptors.

Hope this helps you a bit

Regards,
Ni2


Netware 5.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Netware 5.1
PDA

View Full Version : Netware 5.1

Lbolt99
07-12-2002, 07:22 PM
Anyone ever look at Novell Netware stuff? I've got Netware 5.1 here, comes default with a 2 user license. There is hardly *anything* on the web about reversing netware. I did find a little discussion on Netware 4, however.

Brief synopis:

Netware systems use a small (10MB) DOS partition and the rest of the drive uses it's own Netware-propietary partition. System boots to DOS and runs a ~2.5mb SERVER.EXE file to bootstrap into the OS. Netware uses NLM's or "Netware Loadable Modules" comparable to DOS TSR's and Windows VxD's

Netware includes a debugger; you can debug whatever you want, unless it's flagged as a "hidden" NLM. There are two options for the flag: Normal, and Hidden. The only hidden NLM is license.nlm but changing it to normal is a one byte change :)

Ok that said, the SERVER.EXE file is the bootstrap, as I already mentioned, and then there are several system related NLM's concatenated onto the back (including license.nlm ;) These are appended in a Linked List method.

Up to this point, things are similar between the SERVER.EXE files in Netware 4 and Netware 5 / 5.1

Starting in Netware 5, they compressed the license.nlm file with the Pkware Data Compression Library API. Basically, you can license the compression technology from Pkware and use it in whatever OS/platform you want to.

Analysis completed. My approach will be to decompress the license.nlm (I have several ideas on how to do this), paste back in, reindex the linked list.... and hope that the OS doesn't do direct hex offset access to the SERVER.EXE file.

As far as actually modifying the license.nlm, that's a whole nother story, and will leave to Part II. In the meantime, I'll report progess if I have any luck with this.
Lbolt99
07-16-2002, 01:09 AM
Actually I meant to post this in the RSE General.. sorry for the mistake :rolleyes:

I cannot move it,

Looks like no one is interested anyway, lol
Woodmann
07-16-2002, 01:25 AM
Howdy,

I dont know about the others but I am
waiting for your follow up.

Are you stuck somewhere?

Peace, Woodmann
Lbolt99
07-16-2002, 01:53 AM
Hi,

Haven't gotton stuck, just haven't had time :( It always seems that I'm juggling 5 or so different projects, each one getting just a little timeslice, lol.

I'm still researching the header format of the NLM files and the best way to decompress the license.nlm file, and save it.

I'm hoping that the license.nlm decompresses in a DOS environment, then I can just rip the asm code, make a few minor changes, and use Dumpexe to dump the exe code.. then rip off the dos exe header that dumpexe creates and replace with a fixed nlm header..

If it decompresses in the netware environment, I can probably still use the same general decompression asm code but probably have to make a few more changes so it'll run in a dos environment..

Or just write a netware dumper :p

But I doubt that's necessary. Old school crackers will remember Pklite, it was a very lame compressor, no anti-debug or other tricks.

Pklite is to UPX as Protect! EXE/COM is to ASprotect (well, not quite, ASprotect is much more advanced than and DOS encrypter ever was)


Lost in the code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Lost in the code
PDA

View Full Version : Lost in the code

Coersum
07-16-2002, 02:44 AM
HI all,

First so u know as u will discover it I'm newbie...

About the target:
It is an investing neural simulation program. There is different sub-version in the same v2.4 depending on the numbers of Neurons allowed by your license (from $70 to $16,200).

About the protection:
The program doesn't use any serial but instead when you register, they send you a key (install prog that install a key).
As the fact that how many $$ you pay gives you more or less functions (functions not paid for are disabled) I tried to enable the disabled menu items.

My appraoch:
I first tried to find out if it was reading the key from the registry by setting some breakpoint but nothing came up. Then I tried to find out where the menu items where disabled (enabled at first then disabled at run-time), I was able to enable one of them but as soon as the function was done and before it gives me the result it seems to check AGAIN and gives me a msgbox saying blahblah blah this function not availlable etc.....

I'd like to be able to crack at the source and find out how to simulate the higher level of the key installed ($16.200 :) but it seems to do test on it all the way through execution... :(
Like I said I'm a newbie, I read MANY tutorial, exemples about reversing but nothing comparable to this kind of protection.
I've been using HVIEW, SI, and W32dsm

ANY IDEAS ? Any input are more than welcome. I can send the (registered but without key version if u wanna look at it (coersum@netcourrier.com)

Thank you
Coersum
PS: sorry for bad english.. french :p
naides
07-16-2002, 04:27 PM
It MAY be easier to understand how the functions are enabled and the number of neural cells are determined if you invested the $70 in the low end version of the licensing program, and then reverse engineer the license generation process.
On the other hand, this may be the most secure element of the potection scheme.
get2
07-16-2002, 05:21 PM
Some questions for ya
In W32dsm can you find the message that it gives ya "gives me a msgbox saying blahblah blah this function not availlable etc....."?
Maybe try IDA might find something there

Is the program packed or protected somehow?

Have you tryed setting a break on the message box or what have you tried in SI.

If you provide a little more info I'll bet there would be a lot more here able to help ya. the people here are the BEST at this :)
Coersum
07-16-2002, 07:09 PM
naides>
I actually did bough the $70 licence, this is how I know about it (wasn't going to crack it but the $16,200 license looks so good :) This is just a tiny setup prog that install a "key" and then gives u a "Install successfull" msgbox. I tried setting breakpoint at the regqueryvalue, regcreatevalue etc.... SI breaks on it but I could not figure out where and what it was writting.

get2>
W32dsm did find the string of the msgbox but after that I tried to reverse this part of the check to and wasn't able.. (making the prog bugs at startup). I'm a newbie and am not sure how to test if the program is packet or protected.. I guess there is tools for that...do u have some names ? thanks
Like I said to naides, I tried to break on the msgbox but wasn't able to reverse it. I'm lost in the code, it seems to make check a little everywhere. I'm trying hard lol...

Thanks both for your help,
If anybody wants to look at the program I can mail it.
Coersum
Coersum@netcourrier.com
Aimless
07-17-2002, 08:51 AM
Hullo,

I think you need to modify your approach a bit. Start first by understanding more about the "type" of key. There are 3 possible options:

1) The key generates a file/(s) that act as licenses.

2) The key generates a normal/encrypted key/subkey/value in the registry

3) The key "MODIFIES" the already existing files. Exe/DLL/Ocx/etc.

4) All of the above.

To find out where it does what, do the following:

1) Use FILEMON to figure out if it CREATES any new files.

2) Use REGMON to figure out if it CREATES/MODIFIES/DELETES any new keys/subkeys/values. If so, are they normal/encrypted?

3) "Before" installing the license, go on the internet, search on google for MD5 program (a simple command prompt based exe that takes a file as an input and outputs its MD5 signature). Run that program on your "directory" and store the output (MD5 hashes of ALL files in directory and sub-directory). Install the licensing and "After" doing the installation of the license, run the same procedure again, to find out the MD5 hashes of files AFTER the installation. If there seems to be NO change, repeat the same procedure to the C:\WINNT\SYSTEM32 directory (I use Winnt, you could point to the windows path) and get the MD5 for ALL its dll files. A *moronic* protection could change (very very rare) the system dlls too. You never know enough to be careful.

4) If ALL of the above show something, then I would suggest you try something simpler at first.

AFTER all the above processes are done, find out whether the associated key/(s) is:

1. NORMAL
2. COMPRESSED
3. ENCRYPTED
4. Both 2 and 3

In either case, to Unpack/Decrypt the key files (if at all applicable) check out the various tutorials to do so. You need to do this ONLY and ONLY if you are trying to generate VALID licenses. If you simply want to bypass then:

1. Understand where in the exe/dll/both the ROUTINE for validating the same is. Remember, most time the INSTALLATION routine and the VALIDATION routine will be the same.

2. Understand whether in that VALIDATION routine, OTHER registers are changed or values submitted to the memory, is used in any OTHER part of the program apart from the main VALIDATION routine.

3. If so, chase the branches of that tree and see what the program expects. If necessary, dig deeper into the codewoods. (I did not say that cracking was a "pleasant" and "happy" experience :) )

4. Disable ALL checks (in a good protectionists' sense, more that you can really handle).

5. If you find that disabling checks is TOO convulted and complex, I'd suggest you stick to generation of a license key. And this is all the more simple as you do not reverse engineer the whole application but the installation file for the license to see how it works (assuming that the Installation Creates the keys, rather than simply Pasting them).

6. If none of the above work, try a simpler target.

Have Phun
Coersum
07-17-2002, 09:21 AM
Hi Aimless!

Wow.. that's some help thanks...

After passing the key installation program through SmartCheck here is what I found out, the Key installation program install a file in the target's directory and a key in the registry (both the same thing and I think encrypted, here it is:
–_¿Ãã•ÖÊÃ?ú¾ç–Ì¡ò©?„Ì×Ò_ÞšÇ»Ð–åÜô£™›—žÃ„Í?±?Ä“áËßñ_õŽº‰§Ü×àÖšÝÅ†Ö¦„ÝÞæ ( inone line and minus some chars :D)

If the registry key is removed the target finds the key in the file and rewrite the registry key and inverse if the file is deleted.

I don't know much about encryption, I found a "Tutorial: finding encryption code " in the messageboard and am at trying to find the decryption routine.... already passed the last 4 hours on it without luck (like it would be that easy lol)

Mike from the "finding encryption code" msgs should try at this target as everytime you click on a menu, it checks the registry (not sure if this is to verify the key or not neither if it also checks they file with the key).

Also, is there any program that could "find" a decrypt method if you know what 70% of the encrypted string is decrypted ?

Anymore advice are welcome.
Again thanks for your help,
Coersum
naides
07-17-2002, 09:30 PM
As above


SCREENDUMP feature in NTicedump needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SCREENDUMP feature in NTicedump needed
PDA

View Full Version : SCREENDUMP feature in NTicedump needed

medardus
07-16-2002, 08:54 AM
Hello all,

I badly need the old /screendump feature from Icedump in the NTicedump (running under W2k).
I already had some discussion about this with The Owl (coder of Icedump). The best idea would be to bring the original sourcecode from <icedump-dir>/w9x/src/cmd_screendump.asm to the nticedump source.
But you definitely need a deep knowledge of driver development under W2k which I don't have. I would really like to code this by myself but unfortunately I don't have that much time to first learn the whole driver development stuff.
That's why I call for help. There are so many people out there who have the needed knowlege. Is there anybody who would do this task? Does anyone know someone who is willing to try this?

Please help me!

medardus
Bengaly
07-16-2002, 08:59 AM
tried ollydbg??
medardus
07-16-2002, 09:21 AM
No I didn't try Ollydbg.
The reason why I need the screendump feature is that I have once written a SI beginners tut under W98 using the screendump feature of icedump for illustrating the running SI window. Now I want to rewrite this tut to match the latest OS (W2k), the latest SI (DriverStudio 2.6). In my old tut I used a hmemcpy breakpoint and this is not valid anymore under W2k, that's the main reason why I want to rewrite the tut.

When bringing this feature to nticedump I don't need such things as write a postscript file. I even don't need to write a html file. A simple dump of the graphic display memory into a raw picture file would be sufficient for me.

medardus
naides
07-16-2002, 09:17 PM
If you just need the screen dump for a single shot deal,

Look at this site

h**p://www.technologismiki.com/fotis/books/re.pdf

In the Sice section of the document, the author outlines a method to obtain Sice screen shots:

Quoted without permission:

6.2.4 SoftIce Window
Since everything freezes, it?s not that easy to take a snapshot of SoftIce?s
window. There is a way though, freeze something in the background, pop up SoftIce
and close it. SoftIce will remain on the frozen window, since painting is unavailable for
frozen applications. Then, you can probably take a snapshot of your screen (or maybe
not, since SoftIce uses a different display driver)
medardus
07-17-2002, 07:23 AM
Hello naides,

thank you very much for this hint! I will try this as soon as possible.
Let's hope Numega will someday implement a screendump feature into SI...

medardus
username
10-20-2002, 06:07 PM
Originally posted by medardus
Hello naides,

thank you very much for this hint! I will try this as soon as possible.
Let's hope Numega will someday implement a screendump feature into SI...

medardus
Check out http://stenri.pisem.net for IceExt, it seems to have !dumpscreen.


Latest aspr tricks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Latest aspr tricks
PDA

View Full Version : Latest aspr tricks

wbe
07-16-2002, 09:42 PM
Latest aspr tricks

Looking for an asprotected app to see what was new with it after some time. I found a fresh one from AHAsoft. Knowing they were a dedicated customer of aspr, I downloaded it immediately.

Well, as +SplAj posted a few days ago (GetSystemTime-randomizer thread), aspr has a "hopping POPAD" this time, LOL. This reminded me the frequency hopping trick used on military radios to restrain channel tapping. Then I checked what was new with the ReqQueryValueExA trick. This time, it writes the date used/# of times used values (binary) under HKCU\Software\Asprotect\Data. Deleting them does not fool aspr. If it can't see them there it checks hundreds of (may be a thousand) CLSID values. Lol, this is absolutely better than killing Regmon alone. The two inline patchers fail on this version of aspr either. Good work, Alexey's raising his standards.

Anyway, I thought this may draw some attention. And, yes, it works fine.

wbe
+SplAj
07-17-2002, 07:28 AM
Yes wbe

Alexey has changed the rulez for regmon/filemon monitoring. ASPR now has a much better 'registration/trial validation' scheme.

HKCU\Software\Asprotect\Data

appears to be a red herrring.

The scheme needs closer attention ...... for those that don't unpack in 30 days ;)

Spl/\j
Kayaker
07-17-2002, 07:49 AM
I like the new talking avatar Spl/\j, but isn't that a lot of hair for an OBC?

:D

ONBC :p
+SplAj
07-17-2002, 08:19 AM
Hi Kayaker

did you 'negative' my new wig..... is it blonde or black ;)

BTW did you d/l latest ASPR freeebie from Aaron ....... if you unpack it you can see new option to add 'Delphi form protection' to aspr projects....maybe thats what 'puzzled' has found out ????

and it's a bit late in the morning for U ... go to bed

Spl/\j
foxthree
07-17-2002, 09:38 AM
Hiya +SplAj:

How're ya? The Delphi Form Protection is a tool rumored to be released along with the 1.2 beta itself. It is supposed to remove a lot of stuff from Delphi form resources making it difficult to reverse with DeDe. I believe, LBolt (who was struggling with Quick-to-Do or something like that) also found it in the wild ;)...

Nice work on the rebased OEiP stuff, +SplAj guru. The HKCU\Software\ASProtect\Data stuff was somewhat old I guess. I found it much earlier in some ASProtected apps like AATools, I think. But didn't attach much significance to that ... 'coz still deleting one key gives back your 30 days... lol :D

Rumor also has it that future ASPro* version might change its reg. key format from a base64 encoded one to fixed set of hex digits. YMMV :)

Signed,
-- FoxThree
nikolatesla20
07-17-2002, 02:05 PM
They say that most people arrive at their decisions while taking a number #2 on the toilet....:p

ALexey must be doing a lot of thinking nowadays lol

-nt20
Athlon
07-17-2002, 02:23 PM
What is the new aspr packed with the one from Aaron?
+SplAj
07-17-2002, 04:03 PM
an 'unknown' aspack......

a) manually unpack it...

or

b) just change the 2 bytes at aspack code start to match some that aspackdie expected and it unpacks ok, but without filling in oeip + it detail in peheader. That is easy to find if you do a)

Spl/\j
snaker
07-17-2002, 05:52 PM
The ASProtect.exe is plain simple ASPack 2.12, just OEP is shifted 1 byte backwards to fool detectors and unpackers maybe.

New ASPR even seems same as the 1.2x Betas, just that varied OEP jump thingy.
Athlon
07-18-2002, 04:26 AM
Ok I ahve no idea what you mean by shifted 1 byte and I dont know how to manually unpack (newbie) but I aint even gonna ask I seen how you responded to the others that asked similar ;)
snaker
07-18-2002, 06:47 AM
Athlon, Uhm, buddy, me replied? I just posted 4 messages here, dont even remember them and I surely dont remember anyone asking me to help them unpack anything here :)

Anyways about the ASProtect executable itself,

004D3001 > 90 NOP
004D3002 60 PUSHAD
004D3003 E8 03000000 CALL ASPROTEC.004D300B
004D3008 -E9 EB045D45 JMP 45AA34F8
004D300D 55 PUSH EBP
004D300E C3 RETN
004D300F E8 01000000 CALL ASPROTEC.004D3015
004D3014 EB 5D JMP SHORT ASPROTEC.004D3073
004D3016 BB ECFFFFFF MOV EBX,-14
004D301B 03DD ADD EBX,EBP

This is the disassembly from the current EntryPoint. By shifted 1 byte I meant, that if you look at previous ASPack versions you'll see that the EntryPoint byte is generally 60h -> PUSHAD and the byte before the EntryPoint is 90h -> NOP

So basically all Alexey has done is probably to trick the detection engines, pushed the EntryPoint 1 byte back.

Maybe some internal things have changed. My CASPR couldn't unpack it even if I *corrected* this EntryPoint thingy.

But unpacking it remains just as easy as unpakcing previous ASPacks ( 2.12 is closest to this ASPack )

Simply put a BPX at 004D33B0 and run it. When your debugger breaks you should ( will ) see something like this

004D33B0 61 POPAD
004D33B1 75 08 JNZ SHORT ASPROTEC.004D33BB
004D33B3 B8 01000000 MOV EAX,1
004D33B8 C2 0C00 RETN 0C
004D33BB 68 D0DF4800 PUSH ASPROTEC.0048DFD0
004D33C0 C3 RETN

The OEP is thus 0048DFD0 so you can dump it and rebuild your imports using ImpREC or REVirgin or whatever you use :)

If all this is too bad a reply for you, you can use a simple little ASPack script for ProcDump I did sometime back, it should unpack some ASPacked files you have.

[ASPack 2.12]
L1=OBJR
L2=LOOK 61,75,08
L3=BP
L4=WALK
L5=WALK
L6=EIP
L7=STEP
OPTL1=00000000
OPTL2=01010001
OPTL3=01010001
OPTL4=00030000
OPTL5=00000000

Read a document on how to add scripts to ProcDump if you don't know it already and enjoy. It works on the exact same principle I discussed above :)

This script works on most ASPacks since 2.000 or even a bit before I think. It wont work on the ASPack 2.11x series as they use poly.

Anyways, Enjoy and I *hope* this helps you :)

Greeting to FoxThree [ I await a mail ;) ] and to +SplaJ
Athlon
07-18-2002, 07:25 AM
Thanks ALOT Man this will be the first thing I unpacked and I'm sure it will be fun and learning and what I ment wasnt directed towards you. I just seen people ask about similar things and people here tore them a new head. I thank you as generous as you are I will tell you how it goes :)
+SplAj
07-18-2002, 07:33 AM
naaa, we just rip new ass holes.....it gets to the point quicker :)
Athlon
07-18-2002, 11:21 AM
Maybe I'm doing something wrong snaker but it wont break at all

BTW I'm on 2k
+SplAj
07-18-2002, 02:24 PM
Athlon

Just change the 90 90 60 at aspack section to 90 60 90 and run aspackdie1.3x

change entrypoint to 8DFD0 and ImportTabel to 9E000 with LordPE and your done.

Now run 'dede' on it and find ZILCH cos Alexey removed TPF0 from forms and also the RCdata 'packageinfo' voided.

His tricks are very effective as Kayaker discussed with puzzled.

Spl/\j
Athlon
07-18-2002, 03:11 PM
Thanks +SplAj it worked was hoping to learn a lil about unpacking :( but thanks anyway :)
+SplAj
07-18-2002, 03:40 PM
Athlon....

well in this thread we were discussing wtf Alexey added in aspr1.23beta and RC1 for us.

Well now we know a few...

1) OEiP Hopper ..... (I like that description)
2) New Trial check scheme
3) Delphi exe 'dede' fuxor (kisses to 'puzzled' for jerking our chain)
4) ?????

BUT, Athlon

If you want to unpack starting Win2K without beloved Icedump/W98 weaning... then thats a little tough :(

have you patched out NTice.sys etc ? have you NTicedump to protect BPM ? Have you studied Win32 PE header structure ?
hmmmm.......

Send me large box of chocolates to unpack and i'll teach you to manually exe unpack ;)

Spl/\j
Athlon
07-18-2002, 04:28 PM
I started cracking on 2k cuz since there aint gonna be no more of the 9x line figured I might as well get used to it that way :) and yea I patched ntice.sys I'm studing the PE-Format Now. As for the choclates whats your addy :D Thanks Hope I'm not a bother

P.S Alexy didnt add no destructive code did he? My computer is acting really really weird since I unpacked that ?
puzzled
07-18-2002, 04:42 PM
heeeeeeeeeee
it was alexey after all :p
oh my oh my
Lbolt99
07-18-2002, 06:52 PM
Originally posted by foxthree
Hiya +SplAj:

How're ya? The Delphi Form Protection is a tool rumored to be released along with the 1.2 beta itself. It is supposed to remove a lot of stuff from Delphi form resources making it difficult to reverse with DeDe. I believe, LBolt (who was struggling with Quick-to-Do or something like that) also found it in the wild ;)...
-- FoxThree

Hi, hows it going, yeah I did run into a really strange situation with Quick-to-Do pro. I'm not sure it was the form protection tool provided with ASprotect, though, not sure. I'll have to check it against the "fixes" posted in this thread to see if it all adds up. The main problem was the procedure code for the about box, it was just garbage. But that was no big deal. The big problem was the task scheduler wouldn't accept more than 12 tasks.

bpx on createwindow before trying to put in a 13th, ret a few times and there was a comparison code a little bit above. Worth a look at this prog if you ever get bored :) There are encrypted strings too, none of the "good" stuff was found with DeDe or Win32Dasm. If fact those didn't help at all with this prog :(

Also fox3, you might want to take a look at some of Sapphire's games with regard to OEPfinder. I found that OEPfinder stops responding when trying to run on a program that changes the screen res at startup (goes to 640x480), specifically BattleJeep game was a problem. I'm not sure if anyone else has duplicated the problem but I figured I'd mention it cause it might have something to do with the Screen resolution change. Anyway /tracex found it, but Oepfinder is a little more convenient :)

Other than that, OEPFinder has worked great, saved much time over /tracex.

Take care
antman
07-22-2002, 03:26 AM
Originally posted by wbe
Latest aspr tricks

Looking for an asprotected app to see what was new with it after some time. I found a fresh one from AHAsoft. Knowing they were a dedicated customer of aspr, I downloaded it immediately.

Looking for new aspr? Dont forget codecharge studio(www.codecharge.com can register with fake email for the download).

Uses Asprotect 1.23a (no reg key at HKCU) and only the dlls are encrypted (ccproject.dll has the check near 1b:100115da after unpacking) . Looks like they thought that the decryption of the main exe was slow...
_Servil_
07-24-2002, 10:01 PM
I would say DeDe, the latest bld, with implemented dumper disassembles .aspr-ed apps quite well, regardless if forms/packageinfo ripped or not...


Armadillo Killer 2.5 beta 1 (14-Jul-2002)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Killer 2.5 beta 1 (14-Jul-2002)
PDA

View Full Version : Armadillo Killer 2.5 beta 1 (14-Jul-2002)

Armkiller
07-17-2002, 06:48 AM
Armadillo Killer 2.5 beta 1 (14-Jul-2002)

SIC 2002 Edition

=----------------------------------------=
by ArmKiller (armkiller@mail.com)
=----------------------------------------=

Hi, it's me again and my small dumper.

It's the first beta for Armadillo > 2.5x (ever for
custom builds ).

My app dumps the application, finds the OEP,
and prepares protected application for ImpRec
or Revigin session. I'm going to add my import rebuilder
later but now you have to do it yourself.

http://unpacker.narod.ru/armkiller25.zip
esther
07-17-2002, 03:06 PM
Hello,
Think its not a good idea to upload it here.Sorry I had to delete it.

Regards
Armkiller
07-17-2002, 06:19 PM
Originally posted by esther
Hello,
Think its not a good idea to upload it here.Sorry I had to delete it.

Regards

No prob, bro. I see. Others attachments are good only this is wrong. Yep, you're right.
Woodmann
07-17-2002, 08:45 PM
It's in the wrong fucking forum and
you cross posted it yesterday.

Your right, no prob.

OBC
albert
07-23-2002, 06:08 AM
any new versions of this armadillo killer?


$$$ for crypto weakness in a cool simple algorithm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > $$$ for crypto weakness in a cool simple algorithm
PDA

View Full Version : $$$ for crypto weakness in a cool simple algorithm

Snatch
07-17-2002, 08:07 AM
http://www.rkeene.org/projects/crack-me/prize.html

Check the algorithm out. Nice and simple. But looks tricky to reverse. You guys see any weaknesses?

Snatch
Kilby
07-17-2002, 12:34 PM
It's nice to see that Roy Keene has been busy since being dropped by the Irish national team ;)

Kilby...
mike
07-18-2002, 10:04 PM
The first thing to try is attacking the RNG. He's using time(NULL), which limits the number of bits tremendously. Of course, he could have used dev/random, but it's worth a try.

Say he made the challenge this year; then the time has to be between 3C4899DD and 3D372B06, or 25 bits. We should obviously start at the near date & work backwards.

The encryption looks straightforward:

int cipher_sub_encrypt(const unsigned char *inblk, unsigned char *
outblk, int blksize, unsigned char *key) {
int i,mod;
static int keyoffset=0;

mod=(int) key[0];
for (i=0;i<blksize;i++) {
if (!(i%mod)) {
keyoffset=((keyoffset+1)&0xff);
}
outblk[i]=key[((((int) inblk[i])+keyoffset)&0xff)+1];
}
return(blksize);
}

key is a structure: 1 byte that controls how often keyoffset updates (call it u), followed by a static 256-byte permutation. That means that it's a simple substitutuin cipher (like the cryptograms in the newspaper) except that every u bytes, the cipher will change slightly-- if a,b,c -> q,r,z in the first u bytes, then b,c,d -> q,r,z in the second u bytes.

We can loop through the values for u and look at the statistics of the bytes in chunks of size u. We also have some known plaintext.
Kythen
07-19-2002, 04:08 AM
Actually, attacking the srand()/rand() in this case is useless. If you look at the command sequence he gives you'll see:
"Key file: file003.key"

When the user enters the name of a key file, it just uses the file as the key rather than generating a random key. The code below does this.

fname=dact_ui_getuserinput("Key file: ",128,0);
fd=open(fname, O_RDONLY);
if (fd>=0) {
x=read(fd, &keybuf, sizeof(keybuf));
if (x==257) {
memcpy(key,keybuf,257); /* For backward compatability with DACT 0.8.1*/
}
else {
memcpy(key,ptrbuf=demime64(keybuf),257);
free(ptrbuf);
}
close(fd);
return(257);
}

I'm not sure where you'd find known plaintext, because the file is compressed before being encrypted. We also don't know which algorithm was used to compress the file. The algorithm byte is about all I can see at this time as being known (or easily guessed) plaintext. I'm going to check into it more though of course, so no hints yet please! :)
mike
07-19-2002, 04:35 AM
OK, but where did the key come from? All I meant was that the key file may have been generated using rand. You're right, the file is compressed first; I haven't looked at the format enough to know what kind of headers, if any, are involved. I just guessed there would be.


SoftSentry
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftSentry
PDA

View Full Version : SoftSentry

Antipodean
07-17-2002, 12:37 PM
I am endeavouring to find the place in the Softsentry DLL where the password is checked. The builders of the app appear to have gone out of business so I have no problem with endeavouring to crack it.

The app is known as Route Tracker, the executable is RouteT.exe, and it has a DLL called RouteT.DLL. All the SS code appears to be in the DLL, giving the option of a 30 day trial, or registering it.

I does not seem to have the registration window as a resource however. This has me wondering how a window can be set up and displayed. If I have the window on screen then Softice says there is no window to report an HWND value under NT4.

I am just wondering how this window gets built and displayed, and the button events detected. Otherwise I am still stepping through the code to endeavour to find out. It has a lot of code which appears to be reading itself, I suspect from memory, to see if the dll has been patched.
dinsum
07-18-2002, 01:29 PM
I am not an experienced reverser but if the window in not a resource, it is probably created in the program using RegisterClass and CreateWindow.

Can't you find the window handle using Micro$ofts Spy++ or Borland's WinSight?
Aimless
07-19-2002, 08:27 AM
Hullo,

Softice on NT4/2000 has a nasty habit...

Whenever you want to poinpoint a window, from you app (say SOFTSEN.EXE0 then:

1) Ensure that the window is active

2) type in command: ADDR SOFTAPP

3) THEN, type in command: HWND

And you should see all of them in their glory...

AND,

if that still DOES not work (it does not, sometimes), then you can always (as dinsum says):

BPX CreateWindowA
BPX CreateWindowExA
BPX CreateWindowExW

Have Phun Forever,
Antipodean
07-19-2002, 10:57 AM
Great thanks guys. I haven't tried Spy++ or the Borland one.

The BPX list gives me what look like some good pointers though. Will try that and see.

Let you know what happens, might even get a TUT out of it yet on the "how to" for some of our other beginners. :)


Bios
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Bios
PDA

View Full Version : Bios

dinsum
07-18-2002, 09:02 AM
Does anyone around here have experience with Compaq BIOS?
I want to change the big red compaq logo that appears during the POST.
I have read some things about Award BIOS and EPA images but none of it seems to apply to Compaq. As a matter of fact I don't even know what make BIOS it is(probably Compaq's own)...
My questions are:
Is it possible to change that logo trough bios-flash or is it burnt onto some other ROM on the mobo?
I downloaded a network-flash softpaq which contained a 512kB rom image. The image only contains english frases but the setup offers more languages. Is it possible that my Compaq(deskpro EX) has some bios info on disk? (I formatted my hdd several times without losing BIOS functionality so i think not)
Hope some looked into this before otherwise gonna find it out myself. In a few weeks my vacation starts so time is on my side....
Aimless
07-18-2002, 09:27 AM
Hullo,

As the BIOS is executed FIRST, there is no effective way to disassemble it (its not an EXE or something)

Therefore do this:

1) Understand what BIOS it is (including the type and version number)

2) Search on GOOLE for BIOS dumping/backup utilities (Compaq may offer one, on their CDs)

3) Open the dump file in IDA (no disassembler comes close to disassembling BIOS dumps)

4) If not, you have to search GOOGLE for BIOS-dump Disassemblers or Simulators (that will read in your bios settings and carry on forward)

However, a before reversing BIOS, you need to have a Strong FUNDAMENTAL understanding of HOW a BIOS works, what the BIOS provides and how it is coded.

To do so (for a ready made BIOS, with SOURCE CODE), try downloading: BOCHS software (similar to simulator like VMWare, but Opensource, free and soft.) I forget the exact site, but lkely you'll get it on Sourceforge. Or simply search Google. NOTE: DO NOT SEARCH FOR "BOCSH". SEARCH FOR "BOCHS". Else you will get a lot of Drilling hardware :)

Understand from the source as to HOW a BIOS is made. This will help you in disassembling the BIOS dumps.

And if nothing works, you have to get D-I-R-T-Y!!! Yup, HEXEDIT the dump. Sorry, when its BIOSes, there is no EASY way.

Have Phun Forever,
NervGaz
07-18-2002, 12:21 PM
I'm not sureabout newer version of the Compaq BIOS but I know for a fact that they used to have a hidden partition in the beginning of the harddrive that was used in th BIOS setup... check if they're still doing it in partition magic or fdisk or something
nikolatesla20
07-18-2002, 01:51 PM
I'm pretty sure this is definitely BIOS info. I used to work on Compaqs everyday, and in the BIOS you could actually turn off that *boring* screen..so no doubt its part of the BIOS's nice fancy boot up routine, spitting some data out to the video card.

I'd go with the first option, trying to dump it. The the only real thing you'd have to find is a utility to burn it back in once you've modded it.

-nt20
dinsum
07-18-2002, 02:33 PM
Thnx for the hints.
I'll try to dump the f*cker and dissasemble it.
Will post if any result.
dinsum
07-19-2002, 08:41 AM
Ok, I used a Rompaq to create a bootable floppy containing the flash image and program.

Using Compaq's NET-flash tools i managed to extract the true image out of the disk (flshlite /D parrot00.204 image.bin)
And am I lucky... Browsing the image and ... At offset 0x10000 there is something that looks like a windows .bmp file!

Extracted it, signature was not "BM" but "B?" -> changed and it ... opens OK with mspaint! It's that freaking compaq logo!
Now I changed it a bit, changed the signature back, pasted it in the image and recreated the 'Parrot' - file.

Then looked a bit for a checksum(anyone knows how this is generally calculated? I did some adding of all bytes, and hoped for the checkum to be the last 2 bytes of image but no luck.)
Didn't find much and decided just to flash it as it is now.(gotta live on the edge U know)

Flashing went ok, and ... it boots!

Switch the logo on and what do I see... still the original logo!

Sh*t! Don't know what went wrong, maybe the logo is read-only(like the BootBlock), maybe the flasher did some checksumming (altough it reported no errors), maybe I must 'up' the version number on the image 2.04>2.05 maybe who knows...

Another strange thing: the flashdisk reports all OK, it even reports that a backup of the original rom is made to floppy, but there is NO backup on the floppy and the backup-ing takes less than a 0.5 second. (Bit short for 512kB to be written)

Pls send any comments for I really want to get rid of that freaking logo. Not by switching it off of but making it my own!

Later,
Brt
NervGaz
07-19-2002, 10:40 AM
ummm you probably did this and i'm stating the obvious but did you change the 'M' in 'BM' back to '?' actually don't vene know if it would work... might be worth a try..
dinsum
07-19-2002, 12:43 PM
Sure did change the Bitmap Signature back to what it was.
btw. I said B? but actually the second byte is some non-ascii byte.

Thanx anyhows; The obvious things are what you forget first:)
gavad
10-25-2002, 03:24 AM
I have a compaq bios , it is rom image. 256K

the processor is wrongly recognized, amd gives instructions as to what needs to be done for correct recognition and L2 cache enablement,

but compaq is not doing it , is there anyway like a editor which can edit this ROM file to put in the correct values.

Award has modbin , but this is a phoenix notebios.

or should it be done in asm.

thanks
Azathioprine
11-06-2002, 04:12 PM
Originally posted by Aimless
try downloading: BOCHS software (similar to simulator like VMWare, but Opensource, free and soft.) I forget the exact site, but lkely you'll get it on Sourceforge.

Hi guyz,

I happen to have the URL in my bookmark, here it is
http://bochs.sourceforge.net/getcurrent.html

(Talking about emulators, does anyone know what happened to www.plex86.org? I just can't seem to open the site....)

Cheers,

Azathioprine.


Shrinker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Shrinker
PDA

View Full Version : Shrinker

SilSaLaMaTa
07-18-2002, 09:09 PM
hi ,
I found a prog that is crypted with Shrinker 3.4 , I tried to unpack it
I read some tuts , I found 'call [ebp-24]' , then I changed it to
'jmp eip' . I tried Procdump , LordPe ,and nticedump , but didn't get any resault.
It seems that it is protected . I put a bpx on VirtualProtectEx, but some areas
like 0x00500000 never unprotected (image base : 0x00400000 , len = 0x376fd3)(d 500000 , i saw just '??????') ,
so I cound't dump it with nticedump , I got "Error in memory range".
I read a thread that says it is possible to dump it under 98 , is there anyway to do it under NT/XP ?
DeShrink can unpack this prog ...
+SplAj
07-18-2002, 09:52 PM
http://www.woodmann.net/forum/showthread.php?threadid=3118&highlight=shrinker

'pagein' is the problem............

Spl/\j
SilSaLaMaTa
07-19-2002, 11:51 AM
Hi,
I read that thread .
In LordPE there is a region (499000 - 18000) . It has NOACCESS protection ...
I put a breakpoint on VirtualProtectEx and VirtualQueryEx do "esp+8" . The address was never 499000 ,
so this section was never unprotected , am I right ? if I'm right how can I dump it when it has protection ?

Splaj : in that thread you said "Just pagein each one ....refresh, repeat blah blah. Then you can dump." , I
didn't understand what u mean , especially what to do with "blah blah" :) How can I dump the section with pagein ?
I type "pagein d 499000 18000 d:\dump" , I got "Failed to dump requested ...Posible reason : invalid mem range".
crUsAdEr
07-19-2002, 05:25 PM
Hi SiSaLamanta,

read the thread again then, it is some kind of copymem protection, code only decrypted on request only and encrypted back again so you will have find the decryption routine and force it decrypt the whole exe! That region is never decrypted because you prolly have not tried all function of the target program yet, just click around for a while maybe?

Good luck... i work on this the same way i work on Armadillo... you can try other methods recommended on the board too.

Regards,
crUsAdEr
nikolatesla20
07-19-2002, 06:01 PM
In the WIndows O.S., memory is paged, not all the code/data for a process may be actually "in memory" at once.

Use SoftIce's pagein command (Not icedump or anything like that) to bring the page into logical memory. You can enter any address that resides in the page and it should work. for ex:

pagein 499000

memory is in 4K pages you would have to do this every 4K for entire range you want to bring in, one page at a time. I'm not sure if you can use a range on pagein.

SoftIce warns you tho that pagein isn't always a good idea :)

-nt20
SilSaLaMaTa
07-20-2002, 08:12 AM
hi ,
I worked with the prog and all of the prog was unpacked when necessary ...
I found the unpacking routin and I forced that to unpack the whole of file (Thank u crUsAdEr) :)
and I dumped it . Then I try to fix the IT . I tried RV , when I choose the process I got
"Fixex raw count must be less than row count." so , I tried impRec ...
After all the prog didn't run , I look at the PE and compare my file with the file that I had unpaked with
deShrink . It seems that deshrink is rebuilding Section , my dumped file has 14 sections and Deshrink file has 8 sections.
It has changed RawOffsets and Raw sizes ... How can I do it manually ?
crUsAdEr
07-20-2002, 02:24 PM
Hey SiSa,

If you debug the decrypting routine a bit more, watch how it is being decrypted... if i remember correctly, original IAT is decrypted first, so once it is decrypted, dump it before it is redirected and manipulated...

then the code starting from OEP will de decrypted i think, something like that... just debug the decrypting routine a bit... regarding sections raw and virtual offset, if you understand the structure of PE file, doesnt matter how many section there are, just play around with it for a while, the file will run with 14 section or 8 section, or even 1 section for that matter i think.

Regards,
crUsAdEr
SilSaLaMaTa
07-20-2002, 08:00 PM
hi ,
u r right , IT is decrypting first and after that OEP , I don't need to dump the IT , impRec do the work for me ( I know how to do it manualy) ...

I don't know alot about PE , but I want to know !
In a thread splaj said "...and copy+paste to a dump that worked in Win98. Changed PE header and it runs in Win98SE +Win2K."
It's intersting for me to know how , because I unpacked the prog under XP and it doesn't run under 98 . I read about PE a little , is there a good resource that explains everything (not everything , just some to make me understand clearly , as I said , I know a little , I want to learn advanced things about PE ...) or I should work and find it miself ?

---
Crusader : my dumed file resource section is diffrent from the deshrineked one and I can't edit the resoures ...
crUsAdEr
07-22-2002, 06:07 PM
hi Sisa,

to learn abt resources, read tutorial i guess... n try all the reme on REA... i learnt a great deal there!!!!!!

have fun :>
SilSaLaMaTa
07-28-2002, 09:15 AM
hi ,
thanx alot ! finally unpakced , there were no need to fix the resources ...


Finding the OEP (ASProtect)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Finding the OEP (ASProtect)
PDA

View Full Version : Finding the OEP (ASProtect)

Shopping_Guide
07-19-2002, 08:10 PM
Hi,
Somebody please help me on finding the correct OEP from ASProtected software.

Here's the program:
<deleted> K.

I only need tut on how you find the correct OEP. I will configure myself on how to rebuild the IT later.

2ng program :
<deleted> K.

TIA,
Shopping_Guide
naides
07-19-2002, 08:49 PM
as above
evaluator
07-19-2002, 08:53 PM
Not bad(=very good) idea for finding OEP is:

1. Determine compiler type
2. Search for OEP according to same compiler-compiled-executeble.
_Servil_
07-19-2002, 10:55 PM
Greetings,

I'm interested about it too, had read some postings about OEPfinder, which finds it but too late seems to me when the app is loaded i can;t figure out how were the registers set before jumping, thanks rebased OEP the address is discarded on next launch ;(, anyhow I'd be glad to hear some advice if I can somehow misuse ;-) the address since the oepfinder is the far fastest way to find it ;)

Another solution I know use /tracex in icedump but is very slow, or, Tracer in RV, but it crashes on my system.
npanic
07-22-2002, 08:25 AM
With ReGet deluxe 3.0 (124)

i did this:

BPX GetVolumeInformationA
F11 1 time
F12 4 times
BC*
/TraceX 400000 61,ff,e0
Wait about 8 secs, and then CTRL+D
F10 1 time
BPX on the instruction right under the jnz
/TraceX 400000 eip-8
/TraceX 400000 eip-8

Now you are at the OEP.

BTW i just finished a tut on "inlining" Reget Deluxe 3.0 (124), so if anybody are interested then let me know.
Lbolt99
07-22-2002, 02:41 PM
Thanks for the tips for finding the OEP on reget,

definantly interesting in seeing your tut on inline patching it :)
npanic
07-23-2002, 07:54 AM
Okay here is the tut, but i have to warn you, it's not a real inlining, because i still got no luck with the aspr crc checks.

BTW my way it's NOT a clean way to do it.
Solomon
07-24-2002, 04:01 PM
not difficult to find OEP of ASPR(or other packers) if u know how to by-pass their anti-tracing SEH structures. Latest ASPR uses about 30 SEHs.:)
nikolatesla20
07-24-2002, 04:34 PM
If you use Win2k, revirgin can trace that puppy right down. Use the "tracer" feature, it is fast and awesome.

-nt20
GlObAl
08-02-2002, 10:19 AM
Hello everyone,
imo is the loader.exe from the anti*racksite the best soulution for newer ASPRotect. It will show you all things in few secounds also the OEP :)

Dear Alexy,
you have fix the free space after the layers in your new ASPR versions. It was an nice idea but you have open a nother big door 5 bytes :~)
So my new AIPH version has only 3 Buttons, Open, Patch and Exit.
Maybe you can fix it before i make it public :>

Best regards...
figugegl
08-02-2002, 02:54 PM
hahaha - alexey will love you!

figugegl
Stone()
08-03-2002, 09:31 AM
Good to hear that a new version is in the works, now that I managed to in-line patch my beloved Asprotect apps.

Works like a charm for apps like Reget 133, but indeed the move to fix the free space was somehow limiting at first sight, but there's now enough new one to jump to.


vbox & dead lock jmps...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vbox & dead lock jmps...
PDA

View Full Version : vbox & dead lock jmps...

haec_est
07-20-2002, 07:33 PM
hi there,

i have a problem (erhm... many problems) with a vboxed proggy, Adobe GoLive 6, found
OEP and dumped, easy...

OEP : 0x0088b07a

iat start : 0x0090a000
iat len : 00002A28

but iat has something strange, there are a lot of "dead lock" jmps,
let me to do an example:

inside iat...

:dd 90a150 l 30
001B:0090A150 003633F0 00000000 0089A604 0089A4FC .36.............
001B:0090A160 0089A502 0089A514 0089A50E 0089A226 ............&...
001B:0090A170 0089A22C 0089A232 0089A238 0089A23E ,...2...8...>...

at 001B:0090A158 start all strange things

001B:0090A158 0089A604 ...

at address 89A604 we get :

:u 89a604 l 12
0008:0089a604 ff2558a19000 jmp [0090a158]
0008:0089a60a ff25aca29000 jmp [0090a2ac]
...

but [0090a158] = 0089A604 so it is same of 'jmp eip'...

The vbox version is 4.6.2 but i never see this shit in other vboxed programs; may be
a trick to defeat automatic iat rebuilding ??? so when u trace over the call the tracer lock,
no way other than terminate process ... useless since one can just skip all that shit !!!

...what i did was just to skip all that imports, but the dumped exe won't run, peraphs
has something to do whit the export table rebuilding... because GoLive import itself
as module ! and many other dll import it too...

i don't know !!!

any ideas ?

thanks,
NederMan
07-21-2002, 10:11 PM
Wow! I've been sitting here all weekend looking at GoLive 6 trying to make heads or tails. Did a search and it looks like you've had the same issues.

(Anyone know why TRW2000 v1.22 causes a GPF in Windows ME when entering 'bpx kernel32!getprocaddress'?)

I also found OEP to be 88B07A, length 2A24. My dump failed, too. Tho, I'm doubfull about it using vBox 4.6.2. I'm not knowledgable enough about the files, but my vboxa.dll is 4.5.0.0 while the others in c:\progra~1\common\ claim to be 4.6.1.32. ('Course this could be what is commonly called 4.6.2... dunno.)

Funny thing is, I've tried bpx'ing on GetProcAddress, then 'p ret'ing 'til I see a CALL EDI (like +tsehp's vbox 4.5 essay described) and I can find this only on every other run.

Weird.

I'd like to hear if you or anyone else have learned anything new since your post. I'm stumped.

-NederMan
ramon
07-22-2002, 01:40 AM
Hello haec_est

I already done this one, with easy

the trick used by me was something very wierd :)

DLL injection, then the DLL made the funny part of replace
IAT redirection

I was unable to create a good IAT table with RV, but maybe it's possible... but with the DLL trick was very easy, because you can call the vbox function (API emulation - I thing it's the name) that redirect the program to the really API function. Just Stack manipulation :)

I notice that some IAT entries was dummies, but you can bypass
it in your DLL code

Just try it, for more info you can read tutorials for vbox
You should use ApiHooks from Elicz's for DLL injection

Good luck
Ramon
NederMan
07-23-2002, 06:25 AM
...though it was me that brought it up.

An answer to to myself about TRW2000 v1.22 causing a GPF on WinME doing a bpx on GetProcAddress. (I'm only publicly answering this 'cause I've seen others ask the same question.)

A: I don't know. However, v1.23 did the trick. No bsod's.

FYI.

-NederMan
ramon
07-23-2002, 10:04 PM
Can't help about TRW2000, I only used it one time, but got no problems.

About G*LIVE my first approach was based on +tsehp's vbox 4.5 essay, and most of the tricks works, incluiding the bpx GetProcAddress, for this target (G*LIVE 6 Trial) i need about 18 F12 to get the CALL EDI

Dumping throw no problems, for me at least!

The problem on this target is the IAT redirection. You can try RV or ImpREC but for both tools you got to many unresolved APIs

So you may consider to fallow my DLL trick:

ALGORITHM:

STEP 1:
Start VisualC++ and Build a simple console application with ApiHooks libs to be capable to create a remotethread and force some process to load specified DLL. This is called DLL Injection.

STEP 2:
Build a DLL that during DLL_PROCESS_ATTACH in DllMain
scan all .idata section (not sure what is the section, you could find easy)
of target process, in this case G*OLIVE app, then:

Push on stack RVA DWORD that points to vbox API emulator, ex:

IAT sample: viewing in SICE by typing DD (data window as DWORDs)

VBOXAPIS is the address of vbox API emulator

...:00BAAA80: VBOXAPIS 77E36547 VBOXAPIS VBOXAPIS 77B36141
...:00BAAA90: 77E36542 VBOXAPIS VBOXAPIS VBOXAPIS .... etc

Note that you cannot call VBOXAPIS function for APIs that are not redirected
as you see above there are some APIs that vbox don't redirect because performance and by default are resolved

Assuming 00BAAA80 as start of IAT

for ( DWORD Ptr = 00BAAA80; Ptr < 00BAAA80 + sizeof(.iData Section); Ptr+= sizeof(DWORD) )
{
if ( *Ptr == VBOXAPIS )
{
__asm
{
push Ptr
call VBOXAPIS
mov ebx, Ptr
mov [ebx], eax // EAX now contains real API address, replace bad IAT entry
}
}
}

Before the above *FOR* you should write assembler code to force VBOXAPIS function to return and not JMP EAX
it's very easy, just use some part of code not used and make a jump there, then type LEAVE and RET, use WriteProcessMemory for that. If you have troubles whith that I can post the code, but I need to search for
that on my computer(s)

The last part of DLL code is :):

MessageBox(0, "IAT FIX completed. Now use Import REConstructor v1.3 to create new IAT table and paste it over target.", 0, 0);

Good luck
Ramon
NederMan
07-24-2002, 06:18 PM
Ramon, thanks for the pointers. I'll try 'em out! I've been basing my attempts on what 4.3-4.5 tut's were available. Glad to hear I wasn't far off!

Regarding my earlier critique of whether this is protected by vbox 4.6.2 or 4.6.1.32, I was wrong: Clicking the vbox logo on the Try/Buy screen shows the version to be 4.6.2.

Which leads me to wonder: Has anyone fully investigated/documented 4.6.2's workings? Clearly it works a bit differently than 4.5.

-NederMan
haec_est
07-29-2002, 05:20 PM
thanks ramon for interesting into this stuff,

i've tried to rebuild the iat like in tseph tutorial, (patching from sice) and than
locking the app with a "jmp eip" and rebuilt iat with revirgin (not too different
from what u suggest)...

start iat mangled entrys :

0010:0090A410 77E9AB59 77E8668C 77EA1270 77E930B0 Y..w.f.wp..w.0.w
0010:0090A420 024D0000 77E9098B 77E871E2 77E863F6 ..M....w.q.w.c.w
0010:0090A430 77E8745B 77E8FD48 77E8A84A 77E964A5 [t.wH..wJ..w.d.w
...

at 0x024d0000

0008:024d0000 e8c7e5b304 call 0700e5cc
0008:024d0005 1a21 sbb ah,[ecx]

so look at 0x0700e5cc (VBOXAPIS) :

0008:0700e5cc 55 push ebp
0008:0700e5cd 8bec mov ebp,esp
0008:0700e5cf 83ec10 sub esp,10
0008:0700e5d2 53 push ebx
0008:0700e5d3 8945fc mov [ebp-04],eax
0008:0700e5d6 895df8 mov [ebp-08],ebx
0008:0700e5d9 894df4 mov [ebp-0c],ecx
0008:0700e5dc 8955f0 mov [ebp-10],edx
0008:0700e5df 8d45f0 lea eax,[ebp-10]
0008:0700e5e2 50 push eax
0008:0700e5e3 8d45f4 lea eax,[ebp-0c]
0008:0700e5e6 50 push eax
0008:0700e5e7 8d45f8 lea eax,[ebp-08]
0008:0700e5ea 50 push eax
0008:0700e5eb 8d45fc lea eax,[ebp-04]
0008:0700e5ee 50 push eax
0008:0700e5ef e812000000 call 0700e606
0008:0700e5f4 83c410 add esp,10
0008:0700e5f7 8b45fc mov eax,[ebp-04]
0008:0700e5fa 8b5df8 mov ebx,[ebp-08]
0008:0700e5fd 8b4df4 mov ecx,[ebp-0c]
0008:0700e600 8b55f0 mov edx,[ebp-10]
0008:0700e603 5b pop ebx
0008:0700e604 c9 leave
0008:0700e605 c3 ret

at 0x700e5f4 eax contain correct api address, and with a simple "what eax"
we get the api resolved :

The value 77E9BF24 is (a) KERNEL32!GetTempPathA

so i patched that call to resolve all entrys (thanks tseph...)

001b:0700e57a 8b4504 mov eax,[ebp+04]
001b:0700e57d 90 nop
001b:0700e57e 8903 mov [ebx],eax
001b:0700e580 83c304 add ebx,04
001b:0700e583 8b03 mov eax,[ebx]
001b:0700e585 90 nop
001b:0700e586 663d0000 cmp ax,0000
001b:0700e58a 7524 jnz 0700e5b0
001b:0700e58c 81fb28ca9000 cmp ebx,0090ca28
001b:0700e592 742c jz 0700e5c0
001b:0700e594 3d00000000 cmp eax,00000000
001b:0700e599 7415 jz 0700e5b0
001b:0700e59b 90 nop
001b:0700e59c 0505000000 add eax,00000005
001b:0700e5a1 894504 mov [ebp+04],eax
001b:0700e5a4 eb2c jmp 0700e5d2
001b:0700e5a6 90 nop
...
001b:0700e5af 90 nop
001b:0700e5b0 894504 mov [ebp+04],eax
001b:0700e5b3 eb15 jmp 0700e5ca
001b:0700e5b5 90 nop
...
001b:0700e5bf 90 nop
001b:0700e5c0 ebfe jmp 0700e5c0 (JUMP )
001b:0700e5c2 90 nop
...
001b:0700e5c9 90 nop
001b:0700e5ca ebae jmp 0700e57a
001b:0700e5cc 90 nop
...
001b:0700e5d1 90 nop
001b:0700e5d2 53 push ebx
001b:0700e5d3 8945fc mov [ebp-04],eax
...
001b:0700e603 5b pop ebx
001b:0700e604 ebc4 jmp 0700e5ca

the bad notice was it still crash, and the tricky api can't be GetMessageA
nor PeekMessageA because G***ve don't import user32.dll at all... :(

still thinking about...

NederMan : to get oep u can also bpx GetVersion and trace back...
ramon
07-29-2002, 05:57 PM
Hi haec_est

I see that you are on the good way :)

Try doing this, run original G***VE and try "WHAT eax" where you rebuided EXE call crach, this can always help, then manually resolve API!

Good luck
Ramon
hobferret
08-05-2002, 01:39 PM
HiYa I am a newbie but have been looking at golive5 which has some similar tricks! The IAT in ver5 from 40c000 to 40c1fc do exactly the same a reverse jump- but - it's looking for golive!_ordXXX at these addresses. Every time it crashed!!

It had me confused for a time but then I realised it it was really looking for golive? I would have to rename my dump to the original name, having renamed the exe the proggie ran perfectly!

Hope this may be of use to some of you guys:cool:
haec_est
08-05-2002, 06:27 PM
...renaming the file as the original filename was the first
attempt after rebuilding, but it don't work (thanks
anyway hobferret :) )

it seems a MFC class related problem, like as a method
of the classes exported from 'module manager.module'
is not resolved.

the problem born into the "call SCL_1266", this should
return a valid class (?) pointer but in the unpacked proggy
it return 0x00 :(

.text:10003DA0 crash proc near ; DATA XREF: .rdata:1000B25Co
.text:10003DA0
.text:10003DA0 push esi
.text:10003DA1 mov esi, ecx
.text:10003DA3 call SCL_1250
.text:10003DA8 push eax
.text:10003DA9 call SCL_1266
.text:10003DAE mov ecx, [esi+30h]
.text:10003DB1 add esp, 4
.text:10003DB4 mov eax, [ecx]
.text:10003DB6 call dword ptr [eax+314h] ; -> 10005CA0 (CRASH eax=0x000000)
.text:10003DBC mov edx, [esi]
.text:10003DBE mov ecx, esi
.text:10003DC0 call dword ptr [edx+2B0h] ; -> 10003920
.text:10003DC6 mov eax, [esi]
.text:10003DC8 mov ecx, esi
.text:10003DCA call dword ptr [eax+2D0h] ; -> 10004CB0
.text:10003DD0 mov edx, [esi]
.text:10003DD2 mov ecx, esi
.text:10003DD4 call dword ptr [edx+2ACh] ; -> 10003E00
.text:10003DDA mov eax, [esi+34h]
.text:10003DDD push 'MMDH'
.text:10003DE2 push eax
.text:10003DE3 push esi
.text:10003DE4 call SCL_1173
.text:10003DE9 add esp, 0Ch
.text:10003DEC call SCL_1267
.text:10003DF1 pop esi
.text:10003DF2 retn
.text:10003DF2
.text:10003DF2 crash endp

so i tryed to run the vb*xed proggy and looked for
eax values at addr 10003DB6, 10003DC0... (the ones
noted aside the dead listing) than tryed to force the
eax value, (obviously taking care of rebasing) but
it still crash inside that call :(

i'll try to understand where the problem is generated ...


Window positions in Asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Window positions in Asm
PDA

View Full Version : Window positions in Asm

CccT
07-20-2002, 11:03 PM
Do you know how window positions are
defined ?
I need to know the 2 pushes (X and Y)
for window positions. (inverted notation or not ?)

From my course book : on window dimensions :

... The two decimal numbers that define the DIMENSIONS
of our window 64 & 472 translate into 0x40 and Ox1D8
in hexadecimal. These two parameter (40 & 1d8
dimensions) values are pushed on the stack. In
Assembly, no matter which 'higher' language is used,
no matter which compiler is used, a 'long' push is
68xxxxxxxx (with inverted notation for the xxxxxxxx
address) whilst a 'short' push is 6Axx, and therefore
we get : 68D8010000 = push 000001D8 (note the inverted
notation D801!) and 6A40 = push 00000040 ...

But there is nothing on window positions in it.

CccT
Fake51
07-21-2002, 01:53 AM
Assuming you're looking for a createwindowexa struc (the most likely api to be used), here's some info:

HWND CreateWindowEx(

DWORD dwExStyle, // extended window style
LPCTSTR lpClassName, // address of registered class name
LPCTSTR lpWindowName, // address of window name
DWORD dwStyle, // window style
int x, // horizontal position of window
int y, // vertical position of window
int nWidth, // window width
int nHeight, // window height
HWND hWndParent, // handle of parent or owner window
HMENU hMenu, // handle of menu, or child-window identifier
HINSTANCE hInstance, // handle of application instance
LPVOID lpParam // address of window-creation data
);

Given that the pushing order is reversed, you're looking for push # 7 and 8.

Fake
CccT
07-21-2002, 03:49 PM
Thanks , now I only need to know the X and Y pushes in Hex for window positions.

For window dimensions they are :
Short push (vertical) : 6A
Long push (horizontal): 68 (followed by inverted notation)

CccT
dinsum
07-22-2002, 11:38 AM
Don't really understand what u're looking for but I guess if the position<256 then short push is used, if position=>256 then long push is used.

Never had anything to do with short/long pushes but as U describe it it's just a way to save some bytes if the value of the pushed dword can be stored in one byte.
CccT
07-22-2002, 06:28 PM
I just want to customize a child window's position with a Hex editor as is decribed in this tutorial for window dimensions :
http://www.searchlores.org/paris/paris6.htm

In case a want to move (and not resize) a window of an existing application.

CccT
dinsum
07-22-2002, 08:49 PM
If you want to do a search in a hex-editor:
Assume an x-position of 0x0215. This is a 2-byte number so it can't fit in one byte. This shall probably be a Long Push so search for 0x6815020000
Assume an x-position of 0x0020 This is a 1-byte number so it fits in one byte. This may be a short push so search fo 0x6A20

:) Brt
CccT
07-23-2002, 06:11 AM
Yes ! That works. Thanks, you're a nice guy.
In fact, my target is the Opera browser that is available for free :
http://www.geocities.com/ccctournament/Opera.zip

It has an ugly black horizontal bevel line, about half the window in length, in the top right corner, next to the toolbar buttons.
Width 472 Height 4
Left 328 Top 43 (standard display settings)
But I can't find it with my Hex editor.
Please have a look at the downloadable target.

Click right on the toolbar, "Off" is disabled.
You can of course do this in the menu >History>Register and then >File>Preferences>Browser Layout.
But it would be wonderful if the whole toolbar were deleted as default. You can do all navigation with the menus and that would save much space.

CccT


Fusion v3 cracked, Titanium v3 defeated, Bit Arts fooled!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Fusion v3 cracked, Titanium v3 defeated, Bit Arts fooled!
PDA

View Full Version : Fusion v3 cracked, Titanium v3 defeated, Bit Arts fooled!

Heathcliff
07-21-2002, 03:09 AM
Fusion v3 build 2.0.1.0 by Bit Arts cracked

First a little introduction.

I, Heathcliff, am an application-programmer and do not have any cracking-background. I am not a member of any cracking-crew either. Until a little while ago I just downloaded cracks for the programs I use at home. I recently downloaded Fusion v3 from Bit Arts. Unfortunately I couldn't find a crack for this neat program. I noticed the program was protected with Titanium v3 which is protection software from Bit Arts. So I tried to find cracks for Titanium v3. But I couldn't find them eiter.

When I came to read messages on forum's I understood that this protection system is not easy. So I thought this to be a challenge. I mean, I never cracked a program before, but I wanted to use the software, I didn't want to pay $199 for it and there are no cracks yet.

In about a month time I read many cracking-tutorials, learned assembly, downloaded and tested many tools like: SoftIce, Icedump, PE editors, Revirgin and IDA Pro. I made 23 pages of notes while wandering through the code.

I finally managed to defeat all of the Titanium protections, but I am not planning on doing more cracks, because I am dreaming in hexadecimal now and my girlfriend is complaining that I am behind the computers all night, instead of enjoying her or getting
some sleep. I will write a tutorial on how to crack Fusion v3 manually and post it on this messageboard in a few days.

Here's a summary of the target file. There are limitations on the demo version:

Nag screen.
Time limit.
Your saved work will be renamed.

There are quite a few protections:

There is a Titanium shield with time limit and nag-screen, which encapulates the target executable. This shield has also anti-softice and anti-frogsice routines. The targed executable is packed and encoded. On entering the target executable the IT is destroyed. The target executable is mutated by titanium. The original code needs to be restored and the mutation code must be disabled. The mutation code contains anti-disassembling and anti-trace protection through insertion of corrupt code and data, runtime decoding and encoding of critical code and messing with the stack. The mutation code also contains anti-patch and anti-relocation code by doing header-checks, using instruction-pointers for decription-keys and calling memory-messing routines. In the target executable are registration-checks that need to be fooled.

I made a cracked executable that fully works! But since I have no further cracking experiences at all, I don't know where to upload my crack. I wanted to attach it to this message, but the filesize exceeds the limit. So please give me a few location where I can upload!

Greetz and respect to the cracking community!

Heathcliff
Woodmann
07-21-2002, 04:10 AM
Howdy,

I would love to see you write a tutorial about your works.
I would ask that you post no cracks/patches/keygens to this site.

We are far more interested in the "workings" of protection, encryption and packing/unpacking.

Congratulations on the rewards of your hard work.

Peace, Woodmann
Heathcliff
07-21-2002, 10:33 AM
Hi woodmann,

I will start writing tonight, after I've seen Formula1 on TV. But as I told you, I made 23 pages of notes. And I have to sort that out and write it down in a sensible way. So I don't think I will be able to finish it today.

Nevertheless, I would like you people to give me some locations where I can upload the cracked exe (other sites or ftp-sites) so that other people can enjoy Fusion v3 too (and show that I was the first to crack it :D )

Bye!!

Heathcliff :cool:
Athlon
07-21-2002, 12:38 PM
May I ask where you learned assembly in a month?
esther
07-21-2002, 03:30 PM
>I made a cracked executable that fully works! But since I have >no further cracking experiences at all, I don't know where to >upload my crack. I wanted to attach it to this message, but the >filesize exceeds the limit. So please give me a few location >where I can upload!

>Greetz and respect to the cracking community!

YOU DON'T SEEM TO RESPECT THE BOARD!!!!
YOU WILL NOT GET ANY HELP FOR UPLOADING YOUR CRACKS!!!
Heathcliff
07-21-2002, 03:48 PM
Originally posted by Athlon
May I ask where you learned assembly in a month?

Hi Athlon,

I've had a lot of assembly experience on the good old Commodore 64. Assembly on the PC has the same basic elements like registers, stacks, hexadecimal and binary operations, immediate and relative addressing, etc. Only on a PC there a alot more registers and other features. But with a good assembly reference by hand it is easy to understand. Remember, I haven't done alot of coding myself to crack this program, I only had to be able to read and understand the code to do some modifications.

Greetz,

Heathcliff
Heathcliff
07-21-2002, 03:54 PM
Originally posted by esther
YOU DON'T SEEM TO RESPECT THE BOARD!!!!
YOU WILL NOT GET ANY HELP FOR UPLOADING YOUR CRACKS!!!

Hi Esther,

Please don't get angry so quick. I should have better read the rules of this board to know that I shouldn't attach cracks to the messages. And I'm sincerely sorry for that. But when I asked for locations to upload the crack before, I meant other sites or ftp-sites. I know only locations where I can download cracks, but I don't know where I can upload them. I will read the rules of this board again and I did not and I do not mean to disrespect someone.

Greetz,

Heathcliff
esther
07-21-2002, 04:01 PM
>But when I asked for locations to upload the crack before, I >meant other sites or ftp-sites. I know only locations where I can >download cracks, but I don't know where I can upload them
NO Asking in here remember that!!!Go elsewhere and ask and don't ask me where!
If you write a tute you are welcome in sending to Woomann
Heathcliff
07-21-2002, 04:27 PM
Originally posted by esther
[BNO Asking in here remember that!!!Go elsewhere and ask and don't ask me where!
If you write a tute you are welcome in sending to Woomann [/B]

Alright Esther,

You made your point. I won't come back here until I finished my tutorial and I'll find out where to upload myself. But why the hostality? You don't make it very enjoying for newbies to get around here and share experiences :(. Cool off a little, woman :cool:.

I'll start writing the tutorial this evening and hope to finish it as soon as possible.

Greetz and still respect,

Heathcliff (see you again when I'll post my tut)
esther
07-21-2002, 04:51 PM
The reason is simple read this from one of the admins Kayaker explains coz I don'twanna repeat the same old question

>There's a history here that may not be apparent to the newbie >or casual viewer, or even to the regulars, as to the continuing >attempts of certain individuals/groups to get the hosting ISP to >close this site. After several unsuccessful attempts (the latest >not that many weeks ago), their final arguments have withered >to the occasional accusation that this site supplies cracks or >serial numbers. Their unfounded accusations of "warez" have> >disappeared at least from their latest libelous statements.

>So, it falls on the admins to try to keep these dogs at bay. My >theory is if we can keep the discussions under the realm >of "intellectual property", and don't give 'em anything smelling >like a crack or s/n, then they've got no case and we'll be left >alone. Am I being anal (or delusional) about this? Probably, but >that's what I'm getting paid for ;-> This is however a community >MB, and all decisions are at least open for discussion.

>>Cool off a little, woman
You d** is :p
LaptoniC
07-21-2002, 06:58 PM
Esther why you treat people in this way.I didnt want to get involve in this, but I saw same kind of messages by you a lot.You respond every message with anger.Woodman replied kindly and you reply again with BIG WORDS c'mon grow up.
Woodmann
07-21-2002, 08:40 PM
Howdy,

Everybody calm down......

Heathcliff was dealt a fair hand. Normally his type of post would have been removed.
It's one thing to read the guidelines, it's another to understand them. The only reason I left the thread was because it sounded like he may have actually done something usefull. Unfortunatly, he got caught up in his happiness and wants to "claim his fame".
He can claim his fame but, he should have known from the guidelines that we dont tolerate such posts. They only draw attention from those who seek to shut us down.

He paid his respects, let's wait for his tute.

Peace, Woodmann

(esther is not a woman)
Heathcliff
07-22-2002, 02:25 AM
Edited by Woodmann
Heathcliff
07-22-2002, 02:28 AM
ditto
Heathcliff
07-22-2002, 02:29 AM
You can get the tutorial here:

http://www.woodmann.net/fravia/fusion_v31.txt
Heathcliff
07-22-2002, 08:09 AM
After the last ajustment you have to validate the checksum of the executable again with a PE Editor.

Greetz,

Heathcliff
esther
07-22-2002, 10:47 AM
Originally posted by LaptoniC
Esther why you treat people in this way.I didnt want to get involve in this, but I saw same kind of messages by you a lot.You respond every message with anger.Woodman replied kindly and you reply again with BIG WORDS c'mon grow up.

Hi Laptonic,
I don't have to tell you why I acted this way.About big words I have only post a few,I can delete the post without answering any post if I felt the post is threatening the forum .Prevention is better than cure if you understand what I meant.

regards
nofurs
07-22-2002, 10:53 AM
Originally posted by LaptoniC
Esther why you treat people in this way.I didnt want to get involve in this, but I saw same kind of messages by you a lot.You respond every message with anger.Woodman replied kindly and you reply again with BIG WORDS c'mon grow up.

Y0 Laptonic,

I think you have made a mistake,I'm the one who wrote caps and colors not esther.
Heathcliff
07-22-2002, 12:03 PM
More thread cleaning, Woodmann
Athlon
07-22-2002, 02:32 PM
is it ok if I make this html and post it on my site?
Heathcliff
07-22-2002, 03:01 PM
Originally posted by Athlon
is it ok if I make this html and post it on my site?

No problem, but use the attached text file, not the messages I posted here.

Greetz,

Heathcliff
sandworm
07-22-2002, 10:13 PM
I've tested u're tut with fusion and it worked
but when push the run button the prog crash with
an mem pag error. I tried to find what got wrong but get
stuck :mad: after reading again u're tut i've seen that u only gave 27 locations to patch on the 31 an I think there's some mutation routines left in my exe, am T right and have u done it on purpose to prevent people using u're tut to crack fusion instead of understanding it ?;)
Heathcliff
07-22-2002, 11:20 PM
Hi everyone, I have to appologise! I made an error in writing the tutorial! Sandman told that he tried it, but he still got a page fault. That's because the tutorial misses one patch! I compared the tut with my notes very thoroughly. And I found a mistake I made in the tutorial. The missing patch was in my notes, but I didn't write it in the tutorial. The missing patch is in mem @ 412895h or @ raw-offset 11C95h in the dumped file. These values should be written there: 89 5E 58 8B C6. After this patch it should really work!

Sandman suggested that I forgot more patches, because I told there were 31 calls to protection-routines and he counted only 27 patches. Maybe he should count again, because there are 26 patches in the original tutorial ;) and there should be 27 (like in the revised version of the tutorial, attached to this message). The reason that there are only 27 paches is that 4 of those patches are longer than all the others, because they patch two calls at once, including the code that was scrambled between the two calls. As I told already in the tutorial, some calls are called in pairs to decrypt and encrypt the code between.

If you allready published the tutorial, pleaz replace it with this version! Thanks.

Greetz,

Heathcliff
cah
07-23-2002, 07:58 AM
It is good work done by you on manually unpacking a target file & it is like exercise work for newbies who choses their career in RE.

Give us tips, basics & advice on how to learn fast of assembly language.

Cah...
esther
07-23-2002, 10:08 AM
http://archive.yates2k.net/%2BSandman/Main.html

Zen, The Art Of...
'Learning...'
A reversing student went to his teacher and said earnestly, "I am devoted to studying your teachings. How long will it take me to become a reverser like you?"

The teacher's reply was casual, "10 years."

Impatiently, the student answered, "But I want to learn it faster than that. I will work very hard. I will practice everyday, ten or more hours a day if I have to. How long will it take then?"

The teacher thought for a moment, "20 years."
sandworm
07-23-2002, 10:18 AM
yeah this time it works flawlessly, great work!!!
I can now concentrate upon the proctection and try
to understand everything. :D

one last question, is it possible to search for patterns with jokers like e8 ? ? 09 in sice or hex workshop (caus i don't know how) or have you made a little proggy to scan the exe ?

One more time congratulations and thanks for sharing this tute

ps: I said 27 patchs cause i counted the patch at 44cb77 aswell
Heathcliff
07-23-2002, 11:21 AM
Originally posted by cah
It is good work done by you on manually unpacking a target file & it is like exercise work for newbies who choses their career in RE.

Give us tips, basics & advice on how to learn fast of assembly language.

Cah...

Hi Cah,

As I told in an earlier message, learnig assembly on a PC was probably easier for me than for other people. The reason is that I've programmed assembly on the good old Commodore 64 and Commodore Amiga. The basics of the languages are the same so it was easier to understand. I also have a high degree in software engineering, which is also my daily work. So with alot of other programming experience it is easier to master the assembly language. I just needed an assembly-reference to look up some commands now and then. I really don't want to discourage you, but I just want to say that it might take you longer than a month. You don't need to know all in's and out's of the assembly-language to be able to crack programs. You just need to understand what is going on in some routines instead of understanding every command. The basics you need to know about assembly are:

- How values are moved between registers, memory and stack.
- What exactly happens to the stack when pushing and popping values and calling routines.
- How to parse arguments on the stack for a routine being called.

There are some good websites discussing these topics. For example do a Google-search on: argument stack routine assembly.

It might even be easier to buy a book on assembly. I recommend you don't buy a very thick book with all in's and out's but a book that explains everything short and clear.

If you understand the basics of assembly you could use cracking manuals, like the one I wrote, to understand protection routines more detailed. This is also what I did myself. Before I started with Fusion and Titanium I read dozens of tutorials.

If you have more specific questions about assembly I'll be happy to answer the for you, but maybe you should start a new thread for that.

Keep up the good worx! Greetz,

Heathcliff.
Heathcliff
07-23-2002, 11:29 AM
Originally posted by sandworm
yeah this time it works flawlessly, great work!!!
I can now concentrate upon the proctection and try
to understand everything. :D

one last question, is it possible to search for patterns with jokers like e8 ? ? 09 in sice or hex workshop (caus i don't know how) or have you made a little proggy to scan the exe ?

One more time congratulations and thanks for sharing this tute

ps: I said 27 patchs cause i counted the patch at 44cb77 aswell

Hi Sandworm,

Sorry that I called you Sandman before. I meant Sandworm ofcourse. I'm really glad you could reproduce all my findings. I did the pattern-search with IDA. I couldn't find something like that in SoftIce or IceDump. I think most Hex Editors are able to do the job, but I'm not sure and I don't know how it works. In IDA Pro 4 you search for a byte-array and type e8 ? ? 09. Sorry again for the missing patch, I did not mean to make you sweat ;)

Greetz,

Heathcliff.
sandworm
07-23-2002, 12:05 PM
that not a problem for me to be called sandman cause he is a great reverser but I think he won't be glad to see his name usurpated by a newbie ;)

still no problem for the patch, you did all the hard job and it's normal for the other to swear a little to reproduce and understand.

In fact now that you gave me the solution, I'm a little ashamed cause with just a little work I could have given you the culprid call and avoided you one more night reading your notes and abandoning your girlfriend :(

But I'm still a newbie and wasn't sure of the cause, first tought I hadn't rebuilded it the right way.

As a conclusion I would say that the development of this protection will be interesting to follow cause no doubt bit art response will be to increase the number of such calls
to make manual unpacking very painfull.

(in fact this may result in an app slowdown but do they really care? did you see the difference of runtime between protected and unpacked app? it's a shame!).

So it may become another challenge for our coding gurus, write a tool to automate the patching of these calls!! Moreover this scheme could provide ideas to other protection writers, reading this thread alexey? :)

ps: ok silly me didn't see you've added the 44cb77 call to the patch list
Heathcliff
07-23-2002, 07:00 PM
Originally posted by sandworm
As a conclusion I would say that the development of this protection will be interesting to follow cause no doubt bit art response will be to increase the number of such calls
to make manual unpacking very painfull.

So it may become another challenge for our coding gurus, write a tool to automate the patching of these calls!! Moreover this scheme could provide ideas to other protection writers, reading this thread alexey? :)

It's funny you say that. I've been thinking about that too. You know, when a reverser has a job to do and he's got 100 hours to do it, he'd rather uses 99 hours to write a tool which does the job in a few seconds :D

Anyway, if you look at all the mutation code in the reloc section you see that non of all routines is the same, yet they all have similarities. The routines use different registers, there are three different header-checks in the routines, some use relative addressing and others use absolute addressing. It shouldn't be too hard to make a little program which performs a very specific pattern-search to identify the protection routines. In my daily work I program algorithms a lot. After the routines are identified, the relative calls to the protection-routines can be found by performing another pattern-search which searches very specificly for the assembler CALL command and the exact relative offset between the search position and the protection-routines. The most difficult part will be to get the encoded code from the mid-section of the routine. This can only be done by identifying very specific parts in the routines which are responsible for loading the registers before calling the decode-routine at the end. Then you have to simulate it and call the routine. The replacemt-code should also not be difficult to identify, because it's allways just after four PUSH-commands from which two are allways PUSHFD. This code that is responsible for loading the registers is never the same, but there are only a few variation, so it is possible. The last thing you have to identify and patch is the routine where registration level is read from the environment variable STATUS. But if all Titanium v3 targets are as easy as Fusion, it should really not be hard. The unpacker just gives a registration level between 0 and 9999 which will be the value moved into EAX in the patch.

I don't think I will code a whole unpacker, because this also involves coding a unpackers for the Titanium shield, the IT and the packed targed executable. Maybe I will write a piece of code, which makes all the patches for you in a way I just described. If someone else wants to do it I'll be happy to assist. Also if someone wants to code the unpackers, I'll be happy to assist. It wouldn't surprise me if the Titanium shield itself has the same type of protection routines.

Greetz,
Heathcliff.
Pyrae
07-24-2002, 05:53 AM
Great job, Heathcliff, thanks very much for your extraordinarily well elaborated essay (pretty rare nowadays)!
Indeed the routines you described seem to be the Titanium3 default ones (currently taking a look @ Crunch4). I have to admit that the general idea behind them seems pretty neat - though the bi tarts take 598 bucks too much for TT3 and the massive use causing severe performance degradation to the "protected" apps.
Time to put their Photoshop aside and do some coding...;)

Please keep on using your RCE talent, Pyrae
cah
07-24-2002, 08:16 AM
Give me your email id. I will mail you. I have couple of interesting queries & doubts in assembly language.

Waiting for your reply. Thanks in advance for your reply
Cah...
Heathcliff
07-24-2002, 03:51 PM
Hi cah and others,

I'd rather not give my email-address to anyone. You can send me private mail or email through this site. The reason I don't give my email is that I think I've made some enemies at Bit Arts by realeasing the tutorial. Titanium and Fusion are their products and I probably damaged their good name. I don't want them to bug me.

If you have usefull info, why don't share it with everyone, like I did. Just post it on this forum!

See y'all around,
Heathcliff
NeO'X'QuiCk
07-25-2002, 01:52 AM
First of all i would like to congratulated on Heathcliff tuts .!!its very good..

but i would like to add some info also for other unpackers so they will not have to play with it soo much..!!after dumping it..i used imprec..with 401000 add that to dumped file..and fix eop which was the same !!so i run exe got error on

JJ_ caused an invalid page fault in
module JJ_.EXE at 017f:004e36b3.

so if you trace until there or you put a break on it ..its the same..
soo look at the code now..

017F:004E3655 E800000000 CALL 004E365A
017F:004E365A 5D POP EBP
017F:004E365B 81ED08000000 SUB EBP,00000008
017F:004E3661 60 PUSHAD
017F:004E3662 8D95AE000000 LEA EDX,[EBP+000000AE]
017F:004E3668 8D9D24000000 LEA EBX,[EBP+00000024]
017F:004E366E 8DB5AA000000 LEA ESI,[EBP+000000AA]
017F:004E3674 FFD2 CALL EDX /**here is a decrypting rutin**/
017F:004E3676 EB27 JMP 004E369F
017F:004E3678 35463C3783 XOR EAX,83373C46
017F:004E367D F730 DIV DWORD PTR [EAX]
017F:004E367F 37 AAA
017F:004E3680 3D163D3739 CMP EAX,39373D16
017F:004E3685 262137 AND ES:[EDI],ESI
017F:004E3688 AE SCASB
017F:004E3689 CB RETF
017F:004E368A 098A8B362E37 OR [EDX+372E368B],ECX
017F:004E3690 A4 MOVSB
017F:004E3691 8B8C3729369DF0 MOV ECX[ESI+EDI+F09D3629]
017F:004E3698 45 INC EBP
017F:004E3699 35520B14B6 XOR EAX,B6140B52
017F:004E369E 1E PUSH DS
017F:004E369F 37 AAA
017F:004E36A0 1DBD1A1C5C SBB EAX,5C1C1ABD
017F:004E36A5 1C5F SBB AL,5F
017F:004E36A7 43 INC EBX /**error**/
017F:004E36A8 09BDF5BC7C04 OR [EBP+047CBCF5],EDI
017F:004E36AE 0DCF867B24 OR EAX,247B86CF
017F:004E36B3 C4AD57FD6351 LES EBP,[EBP+5163FD57]
017F:004E36B9 3AFB CMP BH,BL
017F:004E36BB A2D0367E37 MOV [377E36D0],AL
017F:004E36C0 F6625E MUL BYTE PTR [EDX+5E]
017F:004E36C3 33F0 XOR ESI,EAX

as you can see its crypted..
so look at that 017F:004E3674 FFD2 CALL EDX

017F:004E3700 B95B000000 MOV ECX,0000005B
017F:004E3705 8A4601 MOV AL,[ESI+01]
017F:004E3708 32C1 XOR AL,CL
017F:004E370A 300419 XOR [EBX+ECX],AL
017F:004E370D 300C19 XOR [EBX+ECX],CL
017F:004E3710 49 DEC ECX
017F:004E3711 75F5 JNZ 004E3708
017F:004E3713 C3 RET

as you can see it uncrypts 5b bytes..and with XOR command so its easy..actually lame :P

so decrypting our code looks like this:
017F:004E3674 FFD2 CALL EDX
017F:004E3676 EB10 JMP 004E3688 (JUMP )
017F:004E3678 00700E ADD [EAX+0E],DH
017F:004E367B 00B2C10E0000 ADD [EDX+00000EC1],DH
017F:004E3681 2007 AND [EDI],AL
017F:004E3683 0000 ADD [EAX],AL
017F:004E3685 1007 ADC [EDI],AL
017F:004E3687 008BFD2BBDAA ADD [EBX+AABD2BFD],CL
017F:004E368D 0000 ADD [EAX],AL
017F:004E368F 0089BDA60000 ADD [ECX+0000A6BD],CL
017F:004E3695 008BC7500340 ADD [EBX+400350C7],CL
017F:004E369B 3C05 CMP AL,05
017F:004E369D 800000 ADD BYTE PTR [EAX],00
017F:004E36A0 008B002B452A ADD [EBX+2A452B00],CL
017F:004E36A6 59 POP ECX
017F:004E36A7 740C JZ 004E36B5 /**important**/
017F:004E36A9 8BF7 MOV ESI,EDI
017F:004E36AB 8B7D32 MOV EDI,[EBP+32]
017F:004E36AE 03F8 ADD EDI,EAX
017F:004E36B0 8B4D2E MOV ECX,[EBP+2E]
017F:004E36B3 F3A4 REPZ MOVSB /**here error come**/
017F:004E36B5 61 POPAD

and above that error you can see jz ..if you change that to jnz..the app runs well..use hiew ...go to offset 4e36a7..and change 43 crypted hex to 42..and apps runs fine ...hope this helped a little ..

app unpacked now crack it :P

NeO'X'QuiCk
NeO'X'QuiCk
07-25-2002, 03:13 AM
ok i forgot to add one thing..when i did this..i opened about box i got error again..

module JJ_1.EXE at 017f:004e3011.so i trace until i got to..

017F:00448603 894650 MOV [ESI+50],EAX
017F:00448606 8B44240C MOV EAX,[ESP+0C]
017F:0044860A E802AA0900 CALL 004E3011 /*here makes second error*/
017F:0044860F 894E40 MOV [ESI+40],ECX
017F:00448612 8BC6 MOV EAX,ESI

this is also the decrypto rutin..but its empty this time if you trace it,,
so i didnt wanted to lose time.. so i change it to..

017F:0044860A 8BC8 MOV ECX,EAX
017F:0044860C 90 NOP
017F:0044860D 90 NOP
017F:0044860E 90 NOP
017F:0044860F 894E40 MOV [ESI+40],ECX

ok..this is all done i think all futures are working,..didnt tested all yet..but its all good so fare,,,so crack it now,,,

i wrote this because i am too lazy and most ppl are to make so many patchs..but tut is great would be nice if he used more asm code so ppl get to see what is really going ok...

And also i would like to add one thing it should be more ppl like Heathcliff prepared to share info..its really rare this days..

Keep a good work Heathcliff...you are on the right path !!

NeO'X'QuiCk
Heathcliff
07-25-2002, 11:38 AM
Hi NeO'X'QuiCk,

I'm sorry to disappoint you, but the way you avoid the protections is NOT sufficient! I did not make about 30 patches just for the fun. They're all nessesary! You only patched a few and sooner or later you will get more page-faults when you use code where one of the other protection routines is called. The patch you made in the first message is alright, but it is not a general one. The way I described it in the tut is the way it always worx. You decoded the mid-section, patched the JZ to avoid the fuck-up code when the header check fails and then dumped it, right? But you would have to do it with all the routines in the reloc section and at the end of the text section. That's why I did the pattern search to find all the calls. The way you patched this routine worx for this one but not for all the routines. There are also routines that decrypt and encrypt parts of code in the text section and the decription-key is calculated from some header values and can never be patched by just changing the JZ. You would have to run the original to see what values are used to decode the parts in the text section.

The patch you describe in the seconde message is not valid either. All of the 31 protection routines contain some code that is executed in the context of the caller. Actually this is the original code in the text section which is replaced by the call to the Titanium protection. There's allways an piece of code with length of 5 bytes. These are replaced by the relative call to the reloc section and then executed there in de encoded mid-section of the routine. To make this work all registers, flags and stack are restored to the state they were in, BEFORE calling the protection routine. You would have to execute all routines manually to determine what command were replaced by the call. These commands can allways be identified, because they are just after the second PODFD in the decoded mid-section of the protection-routine. That's what I did and those are all the patches. You can't just NOP them. You're program will get really unstable because it just misses some commands here and there.

I am still convinced that the way I described in the tut is the only way to successfully patch a Titanium-protected executable.

Keep up the worx!!

Heathcliff.
Pyrae
07-25-2002, 01:04 PM
Another - probably quicker - way is to redirect the entry point to a small routine that restores the original header data (a very small inliner, the rest is "copy&paste"). As all those anti-dumping tricks rely on it, this is also a very safe way to circumvene the checks (just did it on Crunch4)...

Did anyone take a look at the filename check (bitarts_evaluation.exe) for files protected with demo versions of bi tarts stuff? They seem pretty strange cause they appearantly don't use any file api (CreateFile, _lopen etc.) and some (random) filename characters may be changed without any influence - time for me to do some research...

so long, Pyrae
sandworm
07-25-2002, 01:35 PM
pretty well tought zen cracking!!

By the way bit art response will be to do some checks elsewhere or on the file size etc...
Sooner or later we will be obliged to do it the patching way

So I hope some goog +hcukers will help him to write his tool to automate the patching process!!!
Heathcliff
07-25-2002, 01:36 PM
Hi Pyrae,

I already tried that, exactly the way you describe it, but the header is in protected memory. If you write the original header you'll get a page-fault. I don't know how to get passed by that. If there is a way to do that you've got around all the protection-routines and just need the last patch to make it registered. Maybe you could tell me how to do that, if that's possible anyway (remember I'm a newbie!)

Greetz,
Heathcliff
sandworm
07-25-2002, 02:24 PM
heathcliff,

I think it can be done with lordPe just choose your section , click edit section header and change the flag (on some lordpe versions it is only possible to registered users so download the last lordpe version which is freeware at www.protools.cjb.net)

is it what u've done pyrea ?
Heathcliff
07-25-2002, 02:40 PM
Originally posted by sandworm
heathcliff,

I think it can be done with lordPe just choose your section , click edit section header and change the flag (on some lordpe versions it is only possible to registered users so download the last lordpe version which is freeware at www.protools.cjb.net)

is it what u've done pyrea ?

Thanx for the tip, but it won't work. I've got LordPE latest version, but the header is not a section! You can't set flags for the header.

Greetz,
Heathcliff
Pyrae
07-25-2002, 05:07 PM
I actually did the inliner on some other header checking protector a while ago and only tested the
Crunch stuff in Softice. IIRC, using (and importing) "VirtualProtectEx - WriteProcessMemory - VirtualProtectEx" has been sufficient to overwrite the header data. But I'll check...
+SplAj
07-27-2002, 07:37 PM
CrunchV4 ..another 'all fur coat and no knickers' release from the Transvestites
================================================================================

Dump at OEiP (VA 428E3E)
Leave Entry Point as 0x148000 (VA 548000)
Set IT to E2000 and the delete the remnants of tity3 code at 0x148000 (yes ALL 0xFE000 bytes).

Insert 0x100 bytes for our use...we'll add VirtualProtect call and set page 400000 to write-access to fix all lame checks by Bi-Tarts Transvestite Perverts. No need to patch
all those XOR checks :)

Now rip the REAL PE Header for 0x1000 bytes and paste it to offset 0x148100 (VA 548100)

Now add the following code :-
and type word 'VirtualProtect' into offset 0x148080

0167:00548000 55 PUSH EBP
0167:00548001 8BEC MOV EBP,ESP
0167:00548003 6874954B00 PUSH 004B9574 <-text 'KERNEL32'
0167:00548008 FF15D42E4E00 CALL [KERNEL32!GetModuleHandleA]
0167:0054800E 85C0 TEST EAX,EAX <-found Kernel32.dll?
0167:00548010 7443 JZ 00548055
0167:00548012 6880805400 PUSH 00548080 <-text 'VirtualProtect'
0167:00548017 50 PUSH EAX
0167:00548018 FF15E02E4E00 CALL [KERNEL32!GetProcAddress]
0167:0054801E 85C0 TEST EAX,EAX <- EAX holds address of VP
0167:00548020 7433 JZ 00548055
0167:00548022 A370805400 MOV [00548070],EAX <- store it
0167:00548027 90 NOP
0167:00548028 90 NOP <- A MISTAKE ;)
0167:00548029 90 NOP
0167:0054802A 90 NOP
0167:0054802B 90 NOP
0167:0054802C 6A00 PUSH 00 <-now set write access page 400000
0167:0054802E 54 PUSH ESP
0167:0054802F 6A04 PUSH 04
0167:00548031 6800100000 PUSH 00001000
0167:00548036 6800004000 PUSH 00400000
0167:0054803B FFD0 CALL EAX <- Call VirtualProtect
0167:0054803D 85C0 TEST EAX,EAX <- 1/2 == Success :)
0167:0054803F 83C404 ADD ESP,04 <- reset Stack
0167:00548042 7411 JZ 00548055
0167:00548044 BE00815400 MOV ESI,00548100 <- now patch back original
0167:00548049 BF00004000 MOV EDI,00400000 <- header stored at 548100
0167:0054804E B900040000 MOV ECX,00000400
0167:00548053 F3A5 REPZ MOVSD
0167:00548055 E9E70DEEFF JMP 00428E41 <- lets jmp to oeip after 55 8B EC...

Now DONT change offset 0x3594 from 8BC6 TO 4090...AS THAT IS CRACKING ;)

Have a nice summer...see ya'all in winter time.

Spl/\j
(c)2002
Exocist
08-05-2002, 10:36 AM
it's been a pleasure reading this thread, Splaj... you rock dude, I applied your method today and learnt plenty! again you have taught me plenty :D

This routine will find it's way into several of my projects:p

@Heathcliff

thanks for starting this thread dude, very enlightening :)

-Ex ;)


CSE HTML Validator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CSE HTML Validator
PDA

View Full Version : CSE HTML Validator

digitalblade
07-21-2002, 03:16 PM
hi guy,

i've some trouble with app on subject ! after a succesfull (i think !)
dump, i can't run unpacked app... i've find the oep with a bpx on getcommandlinea, after two g and some f8 i've find somethings like jmp xxxxxxx at this jump i've found eax=00400000 so i've dumped all, next i've use revirgin to recreate the iat but at oep previously found i've found nothing !! so, anyone can help me? ho can i find the right oep or iat... the only import that i find on the dumped exe is a partial (i think) import from vcl50.bpl (a delphi library)
the app url:
http://www.htmlvalidator.com/

unpacked size is someting like 2,7 mb (i'm not shure because this is not my home pc) and as last help someone know the packer used on this app ?

TIA

bye

P.s. sorry for my poor english....
Athlon
07-21-2002, 03:22 PM
here
bytexus
08-14-2002, 11:48 PM
are you sure it is packed with something.i,ve looked at the target and i didn't see something strange. modify the sections caracteristics whit a pe editor to 0xC0000020 and then disasamble with ida


Did I JMP far enough ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Did I JMP far enough ?
PDA

View Full Version : Did I JMP far enough ?

CccT
07-22-2002, 08:47 PM
Shredder 4 is an old version of the the Shredder 6 chess program but a good protection to have a try at.

I (partly) debugged the program but did I JMP far enough ?

When you run the program, you will still see:
Please insert CD > OK > Thank you > OK
It would be better if it did not have these 2 popups at all.

It then creates two files Shredder.pr1 and Shredder.pr2 and you will be all set for 30 days until you need to "refuel" it again
>File Menu >Refuel but it would be better if it did not need to refuel at all.

www.geocities.com/ccctournament/S4.zip 380 Kb

The dead listing is attached

Greetz


Driver Studio 2.6 anti detect patches.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driver Studio 2.6 anti detect patches.
PDA

View Full Version : Driver Studio 2.6 anti detect patches.

nikolatesla20
07-24-2002, 09:26 PM
Here is my little contribution, these patches are based from +Splaj's little walk-thru.

These were created with DS 2.6 build , NTICE.SYS version 4.2.6, build 922

They hide SI from all but Int 1 detection. I'm not sure yet how to hide it from that. I need to do more reading hah.

Works ok.

UPDATE WARNING: Use these at your own risk. I tested them only breifly. Feel free to try them if you wish however. I created them on a computer with Win2K service pack 2.

-nt20
_Servil_
07-24-2002, 09:52 PM
Hola

Could I know difference between apllying this patch and patching nticedump, otherwise, would these two patches play together? (sorry - newbie ;) )

thanx
nikolatesla20
07-24-2002, 10:32 PM
Well, as far as I knew, there was no icedump patch yet for DS 2.6, please correct me if I am wrong.

I would go ahead and use the nticedump patch - it should take care of everything methinks. But I'm not sure because I've never gotten it to work !!!

I wouldn't combine these patches, it might not be a good idea. I just use procdump for dumping mainly anyway - and revirgin for tracing. Basically on NT you need a whole different toolset, but it is nice to be able to dump from SI.

Personally I've never gotten nticedump patch to work. Let me know if you do, and if there is a version for 4.2.6 build 922..I need to check on that.

-nt20
Solomon
07-25-2002, 02:21 AM
NTIceDump is not stable with DS 2.6. I often get a BSOD when I dump with NTIceDump.:(


Getting the right serial......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Getting the right serial......
PDA

View Full Version : Getting the right serial......

dipeshrestha
07-25-2002, 01:16 PM
Hi all,

this is dipeshrestha again. i am messing up with one game named Super Collapse that can be downloaded from h***://gamehouse(dot)com. The program is compressed and it doesnt allow filemon and regmon to be running when we start that game. I have read lots about anti sice routing but not about anti filemon and regmon.
The program sum the ascii value of the capitalized reg name and it will pair up two reg code using SHL CL, 04H. but i get lost after that, the program tends to end nowhere.

please help me with that.

dipeshrestha.
Fake51
07-25-2002, 05:03 PM
A quick tip:

The normal way for programs to look for regmon and filemon is one of two (or perhaps both ;) )

1. Same as good old sice trick: look for regmon.vxd with a createfilea call. Circumvent by renaming regmon.vxd, and changing a few bytes in the exe file.
2. Check all windows to see if there's a regmon window created somewhere. If there is, either shut down, or shut it down. Circumvent by finding the window name and/or class in the exe file, and renaming them.

The checks for the two apps. can be done in other ways, but normally one of these is used.

Fake
foxthree
07-26-2002, 05:02 PM
Hallo!!! what do we have here.... our fav. ASPR :)

Seek and ye shall find ....

Signed,
-- FoxThree


Blowfish Bruteforce 48 bits
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Blowfish Bruteforce 48 bits
PDA

View Full Version : Blowfish Bruteforce 48 bits

Lbolt99
07-25-2002, 04:59 PM
I have come back around to working on the CacheX project (out of 5-10 different things I am working on, lol). I am going to give it a go at brute forcing the 64 bit constant.

I found a strange weakness, or at least what I think is a weakness, in the implementation: seems the 64 bits are reduced to 48 bits. So that reduces the complexity by two orders of magnitude.

Problem: Find XX XX XX XX YY YY XX XX so that Z1 set of 30h bytes "blowfishes" into Z2 set of 30h bytes.

XX = random 8 bits
YY = constant data
Z1= preset data
Z2= "target" data

The algorithm DISCARDS 16 of the bits in the 64 bit constant! Example from [already solved] CacheX for Opera:

64 bits used for final decrypting:

9D 91 93 1E 00 80 74 FD

Original 64 bit constant:

85 09 1E 93 91 9D FD 74

The 85 09 are discarded, and the program writes in a 00 80 in its place. If the proper value is obtained by brute forcing (48 bits), one still has to work backwards to arrive at the values that the 00 80 overwrote. I think that's just a 16 bit brute force, tho.
cyberheg
07-25-2002, 06:57 PM
Once you will implement this you will find out soon after that with a single computer you won't be able to solve it without having a great bit of luck (the needle in a haystack problem) because the keyspace is still too big. For full 64 bit you might aswell leave it alone since you won't be able to find a key and for 48 bits you should think about how many computers your friends got that they will want to use on your project.
Without knowing the exact computing time it could take several months even if you have like 100 modern pc's.

This ofcourse raises the problem about multitasking across network and key distribution since I am sure your friends wouldn't want to type in keys manually to test.
A key test client and server is ofcourse the best solution to this (like rc5 contest or seti@home).

All in all you should try to find out how many machines you could get hold of for this. Personally I wouldn't even bother start on it if I couldn't get 50 p3's atleast.
Lbolt99
07-26-2002, 02:33 PM
Well, thanks for the reply, I guess it's pretty much unfeasible unless distributed, which really isn't worth it for a $20 program.

Thanks to everyone who contributed/participated in the Blowfish/SHA-1 analysis on CacheX project. In conclusion, the best approach is a hard patch, with the P box and S box (1040 bits of the subkey table) pasted into the program, after it is finished modifying itself 100s of times, instead of dumping and pasting all the different encrypted segments. Basically let the program do all the hard work instead.

It all boiled down to an obscured 64 bit constant, making the keygen impossible unless one has a valid license (as of yet, still unable to find).

My next analysis project will be on GetDataBack for NTFS: see new thread "RSA-65 analysis on GDB-NTFS" in a similar fashion as the CacheX project was done.


Dede probs with directdraw graphical stuff
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Dede probs with directdraw graphical stuff
PDA

View Full Version : Dede probs with directdraw graphical stuff

Lbolt99
07-25-2002, 05:32 PM
Anyone else had problems with DeDe 3.02 and processing Delphi stuff that utilizes only graphics screens (ie no "regular" forms, windows, etc). It uses DirectDraw for screen generation (ddraw.dll). Basically I'm working thru this set of games, all of which are protected with varying degrees (some UPX'd, some aspack, some various versions of ASPR), and these couple of games, DeDe won't load, they are the only two that use the directdraw screen generation method. I believe as they update games, they use the latest ASPR version.

I was able to use CASPR to remove ASpr 1.2 on these two ( no sense unpacking manual if caspr will do it in 1 second ;) but I don't believe that's the reason for DeDe's failure. There's another I had to unpack manually (later ver of ASPR), same problem, so it wasn't something CASPR.

It comes up in W32DASM fine, btw. I'll update later on. It's not easy because there are no string resources, it's all graphical stuff :(
Lbolt99
07-25-2002, 08:10 PM
Update: I was able to debug with Sice and found the comparison code! Delphi usually throws a curve when I try debugging - I've honestly had better luck with DeDe and W32DASM on delphi stuff.

I still couldn't get it to load into DeDe, at all, BUT I noticed that at the top of the subroutine call, there seemed to be some sort of obfuscation ie JMPS to invalid IPs which turn out to be really there with normal code :) So it did that stupid jmp thing, then a few lines down was the beloved MOV BYTE PTR [blah], 01 :cool:

Interesting.


icecump problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icecump problems
PDA

View Full Version : icecump problems

JAS
07-26-2002, 12:18 AM
Hi everyone.
I am using softice 4.0 on a windows 98se system.
Here's my question.
I loaded the correct version of icedump.
( dos box pops up that says it's loaded )
However in sice, i get invalid command when i try typing
in /protect on with the forward slash.
I did find out that i need to have kernel32, and user32 dll files
enable in softice.dat and I do.
Even though the message says it loaded, obviously it didn't.
I coppied the icedump.exe to the numega directory, and the
windows/system32/drivers directory.
I read that you didn't need to do this, but i tried it anyway
just in case.
Any suggestions would be greatly appreciated.
Thanks In Advance.
JAS
nofurs
07-26-2002, 11:09 AM
Originally posted by JAS
Hi everyone.
I am using softice 4.0 on a windows 98se system.
Here's my question.
I loaded the correct version of icedump.
( dos box pops up that says it's loaded )
However in sice, i get invalid command when i try typing
in /protect on with the forward slash.
I did find out that i need to have kernel32, and user32 dll files
enable in softice.dat and I do.
Even though the message says it loaded, obviously it didn't.
I coppied the icedump.exe to the numega directory, and the
windows/system32/drivers directory.
I read that you didn't need to do this, but i tried it anyway
just in case.
Any suggestions would be greatly appreciated.
Thanks In Advance.
JAS

Hiya JAS,
theres nothing wrong coz its a external command just press "enter" after typing theabove command.
there are two ways to check if icedump is loaded
just type '/' without qutoes and "enter" and you can see icedump commands.
the second is try /screendump yourpath:\any.txt and later check your root directory if theres the txt

regards
JAS
07-27-2002, 08:26 PM
Hi Cluesurf.

Yep you are right.
I guess i didn't think too much before posting that one. hehehe
I have never used icedump b4 and it's been awhile since the
last time i reversed anything.
The deal was, I was trying to unpack a file that has anti-debug tricks.
It knows when sice loaded... icedump took care of most of that. ( /protect on )
However, the program can still see it when you set breakpoints.
I thought that icedump would cover those traces as well, but in this case it didn't.
Take Care.
JAS
crispeater
07-29-2002, 11:10 PM
Maybe an obvious point, but are you using SuperBPM (bpmb xxxxxxxx) in Win98SE?


trw2000 plugins needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > trw2000 plugins needed
PDA

View Full Version : trw2000 plugins needed

dion
07-26-2002, 06:17 AM
i'm stuck in building trw2000 plugs sample. i want to code a proprietary plugs for hardware stuff. the trw2000 homepage isn't exist anymore. anyone can help me to get another plugs sample? i've trdump[yoda] and fpu plugs. and before any other thing, i need the graphic driver sample. any help would be gratefull.
dion
07-27-2002, 04:04 AM
i've trying several times to build the trw2000 sample plugs. and the dos shell sometimes crash before link/compiling [for 1st time only]. and the log shows following msg:

BUILD: e:\progra~1\micros~1\vc98\include\exdisp.odl(31): e:\progra~1\micros~1\vc98\include\exdisp.odl - invalid include statement: importlib(STDOLE_TLB)
BUILD: e:\progra~1\micros~1\vc98\include\vidsvr.odl(16): e:\progra~1\micros~1\vc98\include\vidsvr.odl - invalid include statement: importlib(STDOLE_TLB)
BUILD: Unable to save the dependency database: \nt\build.dat

anyone can help me what this mean and how to resolve this?
dion
07-29-2002, 04:47 AM
ok, the 2 build err msg has been resolved. but the last one is not yet. anyone know why it's happen ?

just another q, anyone know how to add a new window in trw2000 screen [outside debug screen]? i'm writing log3 plugs right now, its logs unassembly to file [modified log2]. hope i finished it soon. anyhelp'd be appreciated.
Anticode
07-29-2002, 04:24 PM
here is the graphics plugin.

for the error, just create a 'nt' directory at the root. its a bug.
dion
07-30-2002, 03:14 AM
wow! thanks Anticode. i'm release my plugs in new thread, coz i can't edit the title's thread.


Basic unpacking/revirgin question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Basic unpacking/revirgin question
PDA

View Full Version : Basic unpacking/revirgin question

MrSmith
07-26-2002, 11:05 AM
Hi,

I'm working on a packed target (apdfprp from elmsoft), which I couldn't unpack with aspackdie. So I thought I try to find the correct key, then I don't have to unpack it. But to make life easier I tried to get some kind of disassembled code. I therefore run the packed target normally and then used PEditor to dump it and disassemble it with IDA. Of course I have no OEP and no imports but it's better than nothing.
Then I thought I might use revirgin 1.5 to get some imports. So I selected my running target used the OEP shown by revirgin (which is wrong) and pressed Fetch IAT. To my surprise I got some values for RVA and Length and after I pressed IAT-Resolver and Resolve-again I basically got all function calls !!

So, how can revirgin get the imports without me providing the correct OEP ??

Anyway, I thought who cares and pressed "Generate". This created a new section (tsehp) in my dumped file and also wrote the import table to a separate file (it.bin). I used IDA and actually got exactly what I wanted.

This is great, but how does revirgin find the IAT without a correct OEP ? Actually, how does revirgin find the IAT with a correct OEP ?

Maybe somebody can de-confuse me :-)

Many thanks,

MrSmith
foxthree
07-26-2002, 04:50 PM
This behaviour was discussed earlier on HideFolders I think. One of the explanations is that RV sometimes finds the correct OEiP just by giving the code section start 00401000 (which in some cases of ASPRed apps happen to the OEiP after packing). So, sometimes RV just works with 00401000 as OEiP ;)

This helps?

Signed,
-- FoxThree
MrSmith
07-29-2002, 09:15 AM
Hi FoxThree,

>This behaviour was discussed earlier on HideFolders I think.

Hm, I think I will have a look at this discussion. What is HideFolders, a forum ? Do you have a link ?

Many thanks,

MrSmith
foxthree
07-29-2002, 09:47 AM
You need to use the search forum to get the link. Bah, I'm too lazy to do that for you :D sorry!

Signed,
-- FoxThree


New project: RSA-65 analysis on GetDataBack for NTFS
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > New project: RSA-65 analysis on GetDataBack for NTFS
PDA

View Full Version : New project: RSA-65 analysis on GetDataBack for NTFS

Lbolt99
07-26-2002, 02:43 PM
This next project, I will be doing in a similar style as the CacheX project: Basically, there is already a keygen (by Ivanopolus of DAMN) for GetDataBack for FAT, but none for the NTFS version. They are both at the 2.x revision releases.

So I will be ripping apart GetDataBack for FAT, and the keygen, to understand the cryptography involved and see how it was done, then look at the NTFS version and try to keygen based on the knowledge obtained from the FAT version and keygen analysis.

There's no other info in the NFO file as to how it was cracked. I picked this target because a) want to learn a different crypto system b) small bit-count (any relevence?) c) keygen exists for "sister" software, like with CacheX.

Based on other info, I think a weak prime number generator might have been involved, but we'll see.
foxthree
07-26-2002, 04:44 PM
Just a tip: I believe AdamA posted somewhere here about GetDataBack. It is RSA-65, if I recall correctly (too lazy to search :D)

All the best and hoping to see your work :)

Signed,
-- FoxThree

<Edited>

Shit Lbolt! Sorry! Forgot to pay attention to your subject line. [To Self: Hmm... I'm really getting old]. Sorry once again. :(
GodsJiva
07-29-2002, 12:51 AM
DAMN released a keygen for NTFS GetDataBack 2.0 in May, at the same time as the FAT version. And it works :-)
AdamA
07-29-2002, 11:35 AM
Hi,

I looked at the version 1.05, they did not change the registration keys in 2.0.
GetDataBack uses RSA like the most RSA based schemes.
The Decryption-Result is a checksum of your name and some constant bytes, so nothing special at all.

happy analysing,
AdamA
foxthree
07-29-2002, 02:03 PM
It is quite simple to crack and patch tho'.. packed with ASPack and nothing great :)

Signed,
-- FoxThree
Lbolt99
07-29-2002, 07:30 PM
Yeah I figured DAMN probably had a keygen out for it. Hoping they didn't though, oh well. But that's irrelevant, since the object of this project is to learn RSA-65 and determine how it was keygenned, and try to reproduce their results.

Unless anyone knows of any other RSA-65 protections that haven't been keygenned by DAMN, CORE or TMG yet ;)

It'll probably be a week or so before I'll be able to start on it though, real lifes cropped up again
mambox
08-01-2002, 02:48 PM
yep would be interesting to understand!


Stream Cipher with Key to decrypt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Stream Cipher with Key to decrypt
PDA

View Full Version : Stream Cipher with Key to decrypt

Coersum
07-28-2002, 08:16 AM
Hi,

I wasn't sure to post this in Crypto or in newbie so.......

ok, I found out that the program I'm trying to crack has it's serialS (diff serials for more or less functions enabled) hardcoded in the exe.

At the source, it reads your serial from registry and/or from a file in it's directory, decrypt the key and compare diff parts of it.

Now, if I'm not mistaking, it is encrypted/decrypted using a stream cypher (because it seems to loop XORing diff value etc.. (I'm just starting to TRY to understand it so mind me pls).

One of the value hardcoded I thought was a serial isn't but look like another kind of key, now could it be the cipher key ?
Here it is:
s89h234uiwefy7hui234ui3ervn34275v875u34uhweuihwer78ywerhu2q3hu4h

Also, I can find those Calls in between RegQueryValue and when the Serials are tested with (I found out my decrypted serial as first push to lstrcmp was from registry/decryption result and second from hardcoded (pointer) LSTRCMP:
@fstreambase@open$qpci
@istream@read$qpci
@dehonogen$qpcii
@fstreambase@close$qpci
Later on, I breaked before it save the data in the registry again and I have the same except "read" replaced now by:
@istream@Set$qpci
They are all calls many times. I'd think dehonogen would be the decryption routine call...not sure at all tho.

Also:
Knowing most of the plein text of the encrypted key contained in my registry (hardcoded serial + first+lastname), is there a way to decrypt it or try at least (magical proggy).

Any input is off course welcome....
I tried to find info in crypto threads but couldn't find anything like that except "Tutorial: finding encryption code" where "mike" describe a stream cypher.

Thanks!
Coersum:(
Lbolt99
07-30-2002, 07:13 PM
Well, without more information or actually looking at it myself, there's not much to go on.. I wouldn't mind looking at it myself, sounds interesting. It sounds like you're correctly identified it as a stream cipher, probably want to pin down what the exact algo is so you can read & understand the spec.. RC4 is a pretty popular stream cipher, it XORs the output of a PRNG with the data stream. It is a symmetic cipher, meaning the same key is used to encrypt and decrypt. Anyway that might very well be the key hardcoded in there.

Then you'd use the key to reverse it, but I would definantely find out exactly what algo it is, get the spec, get an API for the crypto routine for whatever language you program in. and go from there. You can probably just write a short utility to call the API using the key and the encrypted data.
Coersum
07-30-2002, 10:49 PM
Hi,

Thank for the reply....
If you want to look at it, u can find the target at:
**tp://neurostock.com/updates/ns.zip

I'm at work right now so I don't have my notes, but I'll PM you the offset where I think it decrypt/encrypt in a few hours.

It seems to repeat a # of commands, inc a reg then cmp it:
Like:
EAX := 5
line of code 1
line of code 2
line of code 3
INC EDX
cmp eax, EDX
JNZ Back to line one....
INC ECX
CMP ECX, ESI
JNZ Back to line one
XOR registerA, RegisterB

It's Some thing like that I think (from memory) The reg are wrong but that's around what it does with some mov dword ptr etc..

Coersum


VirtualProtect blah blah......
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VirtualProtect blah blah......
PDA

View Full Version : VirtualProtect blah blah......

+SplAj
07-28-2002, 01:37 PM
anybody....

After spending a few minutes (LOL) fuxin Bi-Tarts latest crap 'Cruchv4' with VirtualProtect and poking back the original header....... I thought hmmm, maybe someone needs to see VirtualProtect and VirtualProtectEx in action ???

So I knocked up a quick Tasm asm shit that utilizes a SEH handler to catch an access_violation attempt and then use VP or VPEx to set PAGE_READWRITE and poke some bytes in PE header of my own process.

Use VirtualProtect when it's your OWN process your changing.
Use VirtualProtectEx when you are fuxin another process.....or ur own.

Maybe it helps some get up to my speed :)

Spl/\j
the fastest 'cracker' in the world (hehe) and the most arrogant
'patch+play'
nikolatesla20
07-28-2002, 02:03 PM
Thank you great guru ! :)

-nt20
foxthree
07-29-2002, 09:48 AM
Hola +SplAj guru:

Nice one!!! Fellow n00bs' archive this :)

Signed,
-- FoxThree


How to customize menus ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > How to customize menus ?
PDA

View Full Version : How to customize menus ?

DeepShredder
07-28-2002, 05:09 PM
A good object for learning to customize menus is the link I found in this forum to a custom version of Opera :

It's better than the original version, but still, I would like to customize the drop down menus, namely, in the "Bookmarks" menu is an empty string that should be deleted but it's better to delete the "Bookmarks" menu altogether since you can do everything in the Bookmarks side panel on the left.

To delete the "Bookmarks" drop down menu, I made a dead listing of Opera.exe with WDasm32.
What should I search ?
Menuitem / Bookmarks / Popup Menu / push ???? / .... ?

Greetz ,
DeepShredder
Kayaker
08-02-2002, 06:28 AM
Modifying a menu item is always a fun exercise, do a board search for Enable Menu, MenuItem, etc. and you should find plenty of information on it. Look for a big previous project on Enabling menu items, following the techniques used in there you should have no problem. Even better, find Clandestiny's complete fine coverage on the subject of menu reversal on the main tutorial site.

You just need to find the right menu item APIs being used to draw and handle the menu bar and modify them to your liking - EnableMenuItem, GetMenuItemID, CreateMenu and other functions. They don't get created, they don't get shown...

Good Luck,
Kayaker


Ida
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Ida
PDA

View Full Version : Ida

golden_123
07-28-2002, 10:10 PM
HI i have ida verson 4.1, and was going threw Ghric3 tut on cracking ghost.exe. When i search for text in core i never find what i suppose to. Is it possible my version is diffent then his or is alt-b not the shortcut for that search like he said in his tut. I did a search in ida for that feature and came across this:

long FindBinary (long ea,long flag,char str);
// str - a string as a user enters it for Search Text
in Core
// example: "41 42" - find 2 bytes 41h,42h

I honestly dont know what that is talking about or how to do it. Any help will be greatly appreciated.
Aimless
07-29-2002, 07:28 AM
Simple...

SEARCH in BINARY
=============
This will search the "binary" file. It actually looks for the "bytes" of data rather than "HOW" they are represented in the disassembly screen. So a search-in-binary for "AIMLESS" will actually CONVERT A=35, I=4C, M=22 (just examples) and so on, and search for these "BYTES".

SEARCH in TEXT
===========
Same as in wordprocessor searches. It will search based on what you "SEE" in the disassembly. Therefore, you can also search for instructions like "PUSH" or "CALL".

Have Phun, Forever.


Um few crypto newbie questions.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Um few crypto newbie questions.
PDA

View Full Version : Um few crypto newbie questions.

nikolatesla20
07-29-2002, 03:51 AM
Well, I never thought I would find myself in this forum, but I realize that more and more protections use cryptography, so I need to learn as least some of it. Please don't flame me, I have some basic questions just to know if I'm on the right track of thinking at least. For some reason I love programming and computer code but math usually bores the hell out of me, why is that ? LOL Encryption uses math theories, so that's why it takes me a little longer to absorb it.

SO without further ado, some basic questions:

1. Ok. Bruteforcing. How do you go about this in a practical way? In a real target, say you have the following info:

a. Encryption method
b. Ciphertext (of course)

Now, wouldn't you either have to also at least find part of the key or some plaintext to attack it?

2. I've noticed in some crypto systems, like the crypto used in Ryan's Code-Lock, which I am looking at for fun, use random numbers (well , actually psuedo random). How exactly does this random number tie in with the whole crypto process ? for example, I've seen keygens that produce a different key each time you press the button, but every key will work the same i.e, they allow you to register. So there must be some sort of constant relationship going on.

Well I guess that's all for now. I'm sorry if these questions are so basic you want to slap me :) I have yet to find a "Crypto for dummies"

-nt20
Coersum
07-29-2002, 07:08 AM
Hi there nikola

I'm starting in crypto too (same thing with the math), ended up on a target with encrypted keys and was wondering the same thing about bruteforcing.

I have the encoded string (duh...)
The encrypted string contains a first name, last name and a serial which I have too (about box for names and Hardcoded "decrypted" keys).

What do you do next ?
Else, if(how?) you find the encrypt/decrypt routines, how do you use it to create other encrypted keys ?

Coersum
nikolatesla20
07-29-2002, 07:29 AM
OK for code-lock:

you get code-lock create.exe, used to encrypt your full version program. it takes:

1. "Program code". This is a code you make up as a "password"
2. The program itself.

It then compresses the program and encrypts it.

you also get code-lock keygen.exe. Used to generate a key for a particular user. it takes:

1. User ID. "Unique" for each machine you are on.
2. User Name.
3. Program Code.

It generates a registration key from these.

Now finally you have the protected app. The reg box on this takes:

1. User ID. It's given to you automatically.
2. User Name
3. Reg key

So my thoughts are, the encrypted program uses the "program code" as its private key? .. ah too late tonight to think clear..

-nt20
mike
08-01-2002, 08:25 PM
1. Ok. Bruteforcing. How do you go about this in a practical way? In a real target, say you have the following info:

a. Encryption method
b. Ciphertext (of course)

Now, wouldn't you either have to also at least find part of the key or some plaintext to attack it? Some statistical property of the plaintext is usually enough; for example, in text, the high bits are all zero. If you decrypt something wrong (and the encryption algorithm isn't a toy) then you'll get pure random noise, which is very easy to distinguish from structured data.

The simplest thing you can do is a chi-squared test: you expect all the bytes to occur with about the same frequency if the key is wrong. So for each character c, let N(c) be the number of times c occurs in the decrypted message you're testing and L be the length of the message. Find

(N(c)- L/256)^2

and sum them all up. Anything with a distribution other than random will stick out like a sore thumb.

You have to have a lot of text for chi squared to work, though, like 2K or so.
Kythen
08-01-2002, 11:36 PM
I've been wondering, what do you do when the plaintext is compressed? ie. how would you go about attacking a file that has been encrypted after it was zipped/rarred/aced/etc ? Are there any other statistical methods you would use in this case?
mike
08-02-2002, 08:13 PM
If you know the format of the compressed file, then you have some known plaintext to check for. Often a simple thing to do is to get the source to the decompressor and run whatever you decrypt though it. If the decompressor returns an error, your password is wrong.

If the decompressor is the kind that can decompress even random garbage, then you do the statistical test on the output.


PEiD v0.8
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PEiD v0.8
PDA

View Full Version : PEiD v0.8

snaker
07-29-2002, 08:49 AM
Hi all,

Well after a long 9 month wait, Qwerton and me manage to make a new PEiD with lots of new features!

Check it out at http://www.mesa-sys.com/~snaker/peid

Hope all of you like it :)
peti
07-29-2002, 04:37 PM
Snaker! PEiD is cool :)
crispeater
07-29-2002, 11:15 PM
Another fine update matey ;)

A suggestion for the next update would be a % age indicator for the probable accuracy of the OEP found with your module. e.g. lame packers 100%, asprotect 10% etc
Just my tuppence worth!
snaker
07-30-2002, 02:09 PM
Hi crispeater,

Actually the OEP found is not dependant on the packer used at all!
SO if for a target you actually get an OEP, you suld keep getting it with whatever target it is packed with!

OEP accuracy is dependant on the language of the coded file.
For MASM/TASM files the accuracy is low, for most other common compilers its quite high
crispeater
08-03-2002, 11:35 PM
Aaahh! I see.

ta for the reply, matey.

And keep up the good work. ;)
Gorr
08-06-2002, 09:05 AM
Hi,

Will it run on NT?

Thanks
snaker
08-06-2002, 10:23 AM
Gorr,

It works on all Windows platforms...
Tested on Win9X, WinME, WIN2K and WinXP

So you shouldn't have any problems on NT :o
user14
08-09-2002, 07:33 PM
Heh, I kept going to the unpacking gods website (linked from the about box in v0.7). No wonder I couldnt find it!
dion
08-12-2002, 12:42 PM
heres the url :

hxxp://sac.mainpage.net/

lots new releases and check the msgboard too... ;)
ReBirth
08-14-2002, 01:54 PM
i just come...

downloaded the tool....
try it...

and... cool man (Both S & Q)

Good work

keep on :)
Polaris
09-03-2002, 06:20 PM
If your 0.7 version was really useful (and FAST) this is even better!!!

I am waiting for next updates!

:)

Polaris

"Above The Mountain Side And Into The Cryptic WinterStorms...Forever."
squidge
09-09-2002, 12:50 PM
Is it possible to place the PEiD engine into a DLL so that it can be called from other apps?
snaker
09-10-2002, 05:14 AM
Hi squidge,

Well, it's certainly possible and it has been on our mind for some time now, but we really havent got any requests or perhaps its a bit too much worl to indulge in?

We'd rather improve PEiD some more before making it into a DLL engine for use with other softwares :)


trw2000 plugs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > trw2000 plugs
PDA

View Full Version : trw2000 plugs

dion
07-30-2002, 03:27 AM
here's my own plugs.
dion
07-30-2002, 03:31 AM
and another one.
dion
07-30-2002, 03:39 AM
anyone know how to add a new window outside trw2000 debug area ? may be icedump gurus can help me out, please...
Anticode
07-30-2002, 09:43 PM
Can u explain what these plugins do?
dion
07-31-2002, 03:26 AM
just a little note : the plugs tested in trw2000 v1.23. and the explanation can be seen when u type the command.

hi, Anticode, do u know how to fix kbd bug in trw ? i've tried to code kbd's reset routine after hh_OnLeaveKernel and the bug still there :(
dion
08-01-2002, 03:35 AM
a bug in log3 plugs catched, fixing is in progress. hope i fixed it soon.

NOTE : is there anyone can reproduce the kbd bug ? i'm get stuck, coz it only happened sometimes. please email me, if anyone knows. thx
Anticode
08-01-2002, 10:09 PM
Please explain the bug in details.
I never had problems in trw2000 (at lease not with v1.23)
please explain what your plugins do because of most of us hardly use trw2000 anymore because of moving to windows 2k/xp.
In those days i got a registered version for free from the author itself as a prise for writing the video plugin.. (surprise! :D)
dion
08-02-2002, 10:47 AM
here's LOG3 v1.1 bug fixed.

hi, Anticode, the keyboard bug was complaint by lots of users as u can see in another thread. and... what? great, could i have your video plugs source code copy ?
LaBBa
08-03-2002, 09:49 PM
hi all ...
i saw that i have wroted an TRW2000 Plugs well done!!
well if it's not too much i want to ask u to try and build a plug
like that SoftIce got (IceDump) not all the features just the :

/tracex

well the command the Icedump got : /tracex START END
it just tracing the process and if the EIP is in the range u enter

i found that TRW2000 got a feature like that but it doesn't work
if we will take for example ASPR .. it doesn't breaks .. and the prog continue to run...

well then i done : bp if(eip>400000&&eip<[The_End_Of_Range])
that does the same like /tracex ..

but.... for the first few sec it did trace but then it break the trace and then the Prog that was protected with ASPR continue to run..

so as u can see that plug is needed !!!!

plz if u know how to do it then plz do....
labbala@email.com
dion
08-05-2002, 03:21 AM
wow! great idea...
could i see the source code of the half complete tracex plugs, LaBBa ? might be i could try to finish it :)
Anticode
08-05-2002, 12:42 PM
dion: sources for the video plugin are included in the plugin and i have already posted it here..
dion
08-06-2002, 03:22 AM
i saw the plugs author is opcode?... i don't remember... and u'r nick is Anticode, that's different things, right?

anyway, have u see the keyb bug thread, what u'r comment, Anticode ?
dion
08-10-2002, 03:51 AM
i'm seeing a strange code in the trw kbd routine like:

out 1E,al [i really don't know what the hell is this :(]

and...

in 64,al
test al,20 [which supposed to be 02]

could u see that things, Anticode? what ur comment?
Anticode
08-11-2002, 01:25 AM
Yes, its me, i changed my nick.
As for the keyboard bug, i dont use trw2000 anymore.
I remeber when i used trw2000, sometimes shift keys was stuck in pressed mode.
i solved this by pressing and releaseing all the shift/ctrl/alt keys.
Maybe this will solve your problem too.
dion
08-11-2002, 01:31 PM
thx for ur reply and ur job in that video driver, Anticode. but, i've another q, and i think i should make new thread here.
dion
08-15-2002, 03:31 AM
heres new released LOG3 v1.2

enjoy
DaFixer
08-19-2002, 03:21 PM
btw dion what about the dsf plugin? is it clear what to do with dsf files ?
dion
08-20-2002, 03:36 AM
hmm... yeah! better understanding now. i just know recently that i can get more info from classes.pas and typeinfo.pas and CPU spying [bvery good!!!]. and hope i'll take sometime to do it. now, i'm struggle with using symbol table in trw.
dion
09-10-2002, 07:30 AM
hi all, i decide to release my trw plugin source code. so, have a nice time in coding...

Cheers
dion
10-15-2002, 11:48 AM
hi all, this is symbol table plugin for TRWv1.22/1.23. feature :
- make/edit symbol table
- support for packed app
just FYI that softice cant do this features :p

ps. hi Kayaker, after digging to si deep enough, maybe you want to code a plug like this for si ;)
dion
10-17-2002, 11:25 AM
hi all, this is the fully working and better release of SymTbl plugin for TRW. happy sym tabling :D
dion
10-28-2002, 11:42 AM
hi all, my new plugin finished. check below url.
new added cmd : COLOR, FONTSICE.

and from now, i'll upload all my releases to :
hxxp://daner.go.cc/trw.htm
please check if theres something new ;)
bye


icedump assembly
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump assembly
PDA

View Full Version : icedump assembly

hobferret
07-30-2002, 06:34 PM
Hi there I must admit I am new to this but it just gets more interesting!!

Can anybody put me in the right direction?
Im trying to assemble icedump and have put the following in the wiat.inc file:
%ifndef WINICE_VERSION_MAJOR = 04
I then get this error message
wiat.inc(5) error: '%ifndef' expects macro identies
I thought that ifndef was for undefined macros!

There are other error meaasges that follow about VERSION_MAJOR and VERSION_MINOR but I think they are all to do with the way I am trying to do it!

Anybody give me some info on this subject please??:)
Lbolt99
07-30-2002, 06:48 PM
Shouldn't this be in tools of the trade since it concerns a tool of the trade. Also, your poll leaves a bit to be desired (one might be expected to produce better options than "Nasm rulez" and "how" for a legitamate poll.

Just a little suggestion :)
hobferret
07-30-2002, 08:37 PM
Hiya Lbolt99

Like I said this is all new to me, including this site. A little patience please as I am just feeling my way round! As for the poll I must have checked the WRONG box somewhere I did not intend it to be a poll but being NEW I could not work out how to get rid of it!

I just thought that being a "newbie" myself that this is where I should post it.

Regards Hob :)


Interesting site
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Interesting site
PDA

View Full Version : Interesting site

Lbolt99
07-30-2002, 07:15 PM
hxxp://www.ssh.com/tech/crypto/algorithms.html

Not sure if it's been posted before or not.. worth checking out
Kayaker
08-01-2002, 10:14 AM
Nice site. Bookmarked. One of these days I may actually seriously get around to learning cryptography, lol.

Cheers,
Kayaker


Sice says "Symbol not defined"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Sice says "Symbol not defined"
PDA

View Full Version : Sice says "Symbol not defined"

spuTniK
07-31-2002, 12:03 AM
Hi there,
I`m a bloody Newbie and got a little problem about the function
"MessageBox" which should be included in the kernel.dll
( I`m using win2k ).
I try to do an crackme which breaks on hmemcpy, but as this is not working with the NT Version of Softice I tried to get all the needed functions by using SoftSnoop :
...
API: GetProcAddress(KERNEL32.DLL), 77E00000h, 00436170h="MessageBox"
API: GetProcAddress returned: 77E275D5h

But if I try to set a breakpoint on MessageBox Sice tells me "Symbol not defined"

:confused:

Thx for any help
spuTniK
ramon
07-31-2002, 12:27 AM
You must load exports for SoftICE, use Symbol Loader for that or the best thing, edit "SoftICE initialization Settings..." under Symbol Loader and add all *must have* DLLs to exports tab:

User32.DLL
Kernel32.DLL
Shell32.DLL
Advapi32.DLL
...
...
and all DLLs you want!
And your are wrong about the DLL name that export "MessageBox", for sure is "User32.DLL"

bye
Ramon
Aimless
07-31-2002, 07:22 AM
Could also be because there is no such thing as MessageBox. Only:

MessageBoxA
MessageBoxW
MessageBoxExA
MessageBoxExW

Have Phun, Always.
spuTniK
07-31-2002, 12:03 PM
>You must load exports for SoftICE, use Symbol Loader for that >or the best thing, edit "SoftICE initialization Settings..." under >Symbol Loader and add all *must have* DLLs to exports tab:

Thx for the tip - till now I loaded the exports by editing the winice.dat. Think the next thing I`ll do is reading the "Using Softice" tut.

>Could also be because there is no such thing as MessageBox. >Only:

>MessageBoxA
>MessageBoxW
>MessageBoxExA
>MessageBoxExW

U are right - they are all existing - but no one breaks

:(

thx for your help - cya
Aimless
07-31-2002, 02:03 PM
A couple of things:

1. What version of Softice are you using ?

2. Are you using the standalone or SoftIce Driversuite one ?

3. Is your OS Win 95/98/ME/NT/2000 ?

4. Are you sure what you are seeing is indeed a MESSAGEBOX ? Just because it is a box that appears during an error, just because it has a title bar, just because it has 2 buttons, OK and CANCEL, does not make it a MESSAGEBOX.

5. Suggest you get an API Monitor at www.programmerstools.org and see whether its really a MESSAGEBOX or a DIALOG BOX or a DIALOG BOX FROM TEMPLATE or DIALOG BOX from RESOURCE or a Window drawn using DirectX (yup!!!) or, in rare cases, HAND WRITTEN CODE that creates a window with the same.

6. Instead of breakpoint on MESSAGEBOXA, try breaking on CreateWindowExA or CreateWindowExW. This will tell you if the programmer has used hand-written routines, or he is simply calling the APIs.

7. Use a tool like SPY (found on same site above) to find whether your window is really a MESSAGEBOX or DIALOGBOX disguised as one.

8. Make sure that if you see you app in softice as "myapp" by giving the PROC or TASK commands, then you *must* do a

ADDR MYAPP

and SUBSEQUENTLY put in a BPX MESSAGEBOX<whatever>

9. Of course, I assume you have already found out ANTI-SOFTICE code, if any.

Try these out and see what happens. If not, we may just have to get dirty...

Have Phun, Forever.


delete awave file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > delete awave file
PDA

View Full Version : delete awave file

mark1234
07-31-2002, 04:30 AM
:( hello every one out there:
This is my first post,So please take it easy with me.I got this progam called otsjuke 1.00.151 I have crack the timetrial all the nags in the begging and end of the program but every 8 to 19 mins.It says "otsjuke please register your coppy today",that's throw the speakers,It used to pop out with a window that stop every thing but this is already beaten but this wave I don't find out how to deleted it;s driving me crazy,please help I;m a newbie and with this program i pop my cherry and have'n find a tut how to do this.
thanks Mark1234
Aimless
07-31-2002, 07:15 AM
Hullo,

You are probably looking at embedded .wav file. The best thing to do under this circumstances is:

1) Ensure that the program is not packed or encrypted. If it is, you will have to COMPLETELY unpack/decrypt the same.

2) Use GOOGLE and search for a description of the .wav file format. Obtain a description of its header. You should know when the header starts and music starts.

3) Select ANY randome wave file on your computer (Windows comes with so many of them). Do a pattern matching of the header of that wave file, with the binary representation of your program.

4) If a match is found, most likely the .wav header will also contain the length (does it? that is why step 2 is necessary). Find out the length, rip it off (replace by nops or sequence of add/sub)

5) Ensure that it does not cause a PAGE FAULT or trigger off ANOTHER check if the wav file is not present.

6) If all OK, then enjoy.

Have Phun, forever.
mark1234
07-31-2002, 02:46 PM
Thanks Aimless:
I'm happy i got a reply ever thing looks OK but as I sad I'm a newbie Exacly what is the wave file format, in the inports I got Ssound ssound api and I got waveinopen wavein(this) wavein(that),waveout(this),waveout(that) is it this what you talking about ,how do I do a discription of it's header ,sorry I know this sound like a whole new tut, but I'm sure you now what your talking about and i'm sure you break this steps for me I'M GOING TO CRACK MY FIRST PROGRAM,and maybe you could make it as a tut becouse believe me I've have search the web for 2 weeks and haven't found a tut that can closely help me and I mean 4 hours daily saerch
As a said before thanks Aimless
Mark1234
naides
07-31-2002, 04:33 PM
This a different approach to what aimless suggested. Try to isolate the piece of code that play the wave thing and deactivate it.

1) with the SoftIce symbol loader, load the exports of the file C:\WINDOWS\SYSTEM\WINMM.DLL.
This dll contains most of the sound api.

2) Run the program while softIce is in the background, place a BPX on 'sndPlaySound' and on 'sndPlaySoundA', which is the most common API used to play a wav string through the sound card.

3) Wait.

4)When the NAG sound is about to come, Sice should break. Push F11 and you are going to be in the area of the application code that plays the NAG sound. Do what you need to avoid this piece of code to ever call "sndPlaySoundA". Also, the address of the WAV string was pushed into the stack just before the function was called.
mark1234
07-31-2002, 09:15 PM
tHANKS Naides:
but i got a littel problem, that is, i don't got softice i'm runing on win.xp and haven't found a copy that works with xp i'm trying to work with ollydbg but thiers no tut on how to crack with this program so basickly don't know how to use it all, all the work up to now is with w32dasm using the dead list
Woodmann
07-31-2002, 09:20 PM
Howdy mark,

No one is going to tell you "exactly" how to do this for you.
You have to learn it yourself.

If you search the tips that the people give you, you should be able to do this on your own. It is not that difficult of a task to do.

Peace, Woodmann
mark1234
07-31-2002, 09:53 PM
woodmann:
I realy know that i'm not going to get the exact solution but if i get ideas at less for now to make it not to tecnical becouse i've had read alot of tuts but new to some computer words,i have never taken a computer class i think that for the month I've been reading i'm not so bad.I decided to crack this program becouse it had a littel of lots of protections.What ever reply i get i'm going to study it and try to do the best but as a newbie i can't be afraid of asking becouse the person who hears is the one who gains wisdom and mayby latter i'll be answering the questions in bad inglish but still.
thanks alot
Mark1234
Fake51
08-01-2002, 01:06 AM
Olly is very easy to use.

Load up prog. Set whatever breakpoints you want and let the prog run, or start to trace straightaway. Simple as that. No need for tuts on how to crack with it, it's just a debugger, like sice.

Idea: use wdasm to search for calls to interesting api's, then use olly to test if they as interesting as you thought. Simple.

Fake
naides
08-01-2002, 01:47 AM
Mark:

Do not be intimidated. It is finding problems and working solutions that one learns the art of Cracking.

1. Consider installing the program in an older computer which is runing Win98, where Sice does work, and do the cracking there. once you crack an app in win98 the crack will work in winXP almost certainly.
Or:

in widasm, look for calls to sound API like sndPlaySoundA and breakpoint around it with ollydbg or windbg.

I wiould personally go for sln 1. an old box runing a pentium 200 Mhz and win98 can be very easily found, and most tuts assume you have access to a functional SoftIce. Learning to crack in a winxp box without Sice is an unnecessary act of masochism
Fake51
08-01-2002, 02:15 AM
Originally posted by naides

Learning to crack in a winxp box without Sice is an unnecessary act of masochism

Lol. Mind you, Softice is a tool, not a sacred alter at which one should bring gifts of food and incense. Cracking can easily be done without s-ice, if one knows how. And as for the tuts out there ... their single-minded use of soft-ice typically shows their lack of interest in reversing.

The point: Soft-ice is overrated, compared to the brain. From what has been noted so far about this target, there should be quite a few ways to open it, without using s-ice.

Regards.
Fake
naides
08-01-2002, 05:06 AM
Fake

What I meant was that most tuts assume Sice use.
Cracking without Sice is possible if one knows how, but until one learns to know how, Sice is just the best documented tool in tuts and other sources so one does not have to invent the wheel more than a few times.

No offense intended,
no major point of discussion,

I think
Fake51
08-01-2002, 10:33 AM
You are right, s-ice is the most used tool in tuts. But, the way I see it, learning to use other tools as well, and preferably when one starts to learn bout cracking, opens many more possibilities.

The problem with most tuts are that they really don't show anything new: it's just a five-step guide to cracking this or that target, using the approaches of millions of other tuts. To me, the most valuable tut on s-ice, and perhaps the only one really worth reading, is Mammon's tale. Anything else comes from hands on practice.

There's another thing too: relying on s-ice limits your options, and at times presents itself as a weakness. Every programmer knows, that sice is a crackers dreamtool, so they use that in their protections. There were protections gainst s-ice before they came gainst regmon and filemon, for instance.

Besides, it's quite fun to explore the different ways to open a target, wouldn't you agree? ;)

Anyway, guess I overreacted. Just seemed to me that a lot of different ways had been presented, quite a few that doesn't need s-ice. And newbie or no newbie, running a target in olly and setting a breakpoint should take no longer to figure out than a min or two.

Fake


Sice problem! Can't bpx __vbastrcomp!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Sice problem! Can't bpx __vbastrcomp!?
PDA

View Full Version : Sice problem! Can't bpx __vbastrcomp!?

Manko
07-31-2002, 10:10 AM
Newbie taking a crack at a lame 6.0 proggy...

I'm on a w2k using sice 4.05 for nt/2000.
I've got msvbvm60.dll in the exportstab.

When I do bpx __vbaStrComp i get some
adress (when I BL) instead of
Msvbvm60!__vbaStrComp, and it won't break!? :(

Nothing helps... ...even tried reinstalling...

PLEESE help! :]

//Manko
h8er
08-02-2002, 10:50 PM
Try to type in softice bpx msvbvm60!__vbaStrComp, it should work
Manko
08-03-2002, 03:53 PM
Originally posted by h8er
Try to type in softice bpx msvbvm60!__vbaStrComp, it should work

Thanks for the reply! :)

Tried that, didn't work. I think there was some problem with that version because when I changed to the driver studio 2.5 version it worked on the first try...

Thanks again though!

//Manko


how are adresses calucated ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how are adresses calucated ?
PDA

View Full Version : how are adresses calucated ?

spuTniK
07-31-2002, 12:17 PM
Hi I`m just wondering how adresses are calculated :

004013CE 8B4760 mov eax, dword ptr [edi+60]
// Adress of Username is pushed in eax, edi = 0012FE8C
// After doing this line eax=002F38E8 ??
// This is not 0012FE8C+60 ? How is this calculated ?

004013D1 8D7760 lea esi, dword ptr [edi+60]
// After doing this line esi=0012FEEC, this is 0012FE8C+60 !

004013D4 8B40F8 mov eax, dword ptr [eax-08]
// The result of this line is eax=00000003 which is the length
// of the Username.
// But I don`t know how this has been calculated ...

Thanx for any help,
bye spuTniK
Fake51
07-31-2002, 01:05 PM
Here's the idea:

mov eax, dword ptr [edi+60]

Will move whatever's stored at loc. edi+60h. Thus, result will be something quite different than the address itself (usually, one never knows what's hidden in memory)

lea esi, dword ptr [edi+60]

Lea = Load Effective Address. Loads the destination register, with the address in the source register. Hence the result equals edi+60h

mov eax, dword ptr [eax-08]

Same as first case. Check the prog you're debugging for a previous calculation of the name length. You missed it somewhere.

Fake

Hint: learn some more asm, it will aid you alot when trying to understand programs.
[yAtEs]
07-31-2002, 02:28 PM
Originally posted by Fake51
usually, one never knows what's hidden in memory

unless they use softice of course, thats what you meant
wasn't it fake51 (;

>004013CE 8B4760 mov eax, dword ptr [edi+60]
>// Adress of Username is pushed in eax, edi = 0012FE8C
>// After doing this line eax=002F38E8 ??

trace up to this line, now lets deal with the first part
EDI+60h so 0012FE8C+60 = 0012FEEC, this is what your
suspecting eh?, well take note of the [ ], this a pointer, so infact
its not move edi+60 into eax it is move what is at edi+60
also notice the term DWORD PTR, i.e. a move a dword which is
pointed to at edi+60h, argh whats at edi+60 (0012FEEC) i hear
you scream ok so perhapes its not that dramatic but anyway type
DD EDI+60 or DD 0012FEEC in softice, as you know D is to
dump data, DD will dump in dwords, so its in the format we want
and is easy to read. DB will go back to byte, DW is words, etc,
anyway you should see 002F38E8 in the data window, your
magic number.

please excuse my excessive rambling but ive nothing better to
do right now. hope that helps.

yates.
ud49
07-31-2002, 03:09 PM
Originally posted by spuTniK

004013CE 8B4760 mov eax, dword ptr [edi+60]

"d edi+60"
and ya'll see e8 38 2f 00
spuTniK
07-31-2002, 05:00 PM
[QUOTE]Originally posted by [yAtEs]
[B]

unless they softice of course, whats what you meant
was isnt fake51 (;

>>004013CE 8B4760 mov eax, dword ptr [edi+60]
>>// Adress of Username is pushed in eax, edi = 0012FE8C
>>// After doing this line eax=002F38E8 ??

>trace up to this line, now lets deal with the first part
>EDI+60h so 0012FE8C+60 = 0012FEEC, this is what your
>suspecting eh?,
rigth ;)
>well take note of the [ ], this a pointer, so infact
>its not move edi+60 into eax it is move what is at edi+60
So what is at EDI+60 is moved into eax an then placed at
another place in the memory which is 002F38E8 ?
Because after this line eax=002F38E8...
>also notice the term DWORD PTR, i.e. a move a dword which is
>pointed to at edi+60h, argh whats at edi+60 (0012FEEC) i hear
>you scream ok so perhapes its not that dramatic
don`t care - I`m still alive :D - I know a little about pointers as
I learned C one year ago .
>but anyway type
> DD EDI+60 ..... you should see 002F38E8 in the data window, >your magic number.
Nope - I`m at 0012FEEC :confused:

>please excuse my excessive rambling but ive nothing better to
>do right now. hope that helps.

No problem - Thanks alot for your help,
cya spuTniK
[yAtEs]
07-31-2002, 06:11 PM
>So what is at EDI+60 is moved into eax an then placed at
>another place in the memory which is 002F38E8 ?
>Because after this line eax=002F38E8...

nope, "So what is at EDI+60 is moved into eax" thats it period.

> Nope - I`m at 0012FEEC :confused:
heh, read ur first post back, i was refering to the first
edi+60, your at the second one.

yates.
Fake51
07-31-2002, 06:25 PM
Originally posted by [yAtEs]

unless they softice of course, whats what you meant
was isnt fake51 (;
yates.

You got me. Point is ofcourse, that you seldom know beforehand what will be at a specific place in mem unless you're either the programmer, or a nifty zen cracker.

Blue skies
Fake
[yAtEs]
07-31-2002, 06:44 PM
haha omg i must of been half a sleep when i wrote that,
every word is incorrect nearly heh, /me gives fake51 $10
to edit the post (-;
Fake51
07-31-2002, 07:06 PM
Lol, must admit I had a hard time interpreting the actual meaning of the sentence. Starting point was your smiley, which I guess says a lot ;)

Fake
spuTniK
08-01-2002, 03:56 PM
>[QUOTE]Originally posted by [yAtEs]
>[B]>So what is at EDI+60 is moved into eax an then placed at
>>another place in the memory which is 002F38E8 ?
>>Because after this line eax=002F38E8...

>nope, "So what is at EDI+60 is moved into eax" thats it period.
Hmm I think I got U - but I entered "abc" ( very inventive I know )
and 002F38E8 is not the Ascii-Code for this.

Thx for your patience,
spuTniK
Fake51
08-01-2002, 04:48 PM
Okay, here's the idea:

Edi+60 is an address, it holds the value 002F38E8h

That, in turn, is another address. It should be the buffer that holds your input, the ABC. It is widely used among programmers to store the length of the input just before the buffer.

So:

Eax holds a pointer to the input, and eax-8 is a pointer to the input length.

Fake


what packer :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > what packer :(
PDA

View Full Version : what packer :(

silverstorm
07-31-2002, 04:07 PM
wen i run this appl.. the program create a tmp file whit any name.. xxxxxxx.dll.. or xxxxx.bmp.. or xxxxx.xxx every time its diferent..
please .. what packer itis..?... and how i do to umpack...
thanks for your help..

SiLvEr StOrM
silver.storm@ebolaviruscrew.net

the program is: http://www.dw-soft.com/ifsetup.exe
esther
07-31-2002, 04:27 PM
Yo,
did you read faq guidelines !?!
try some exe scanners in protools
silverstorm
07-31-2002, 07:10 PM
i try whith something but dont have locky :(
the nearly..
armadillo 2.53x :: 88.46%
armadillo 2.50 :: 85.19%
armadillo 2.50b1a :: 85.19%
armadillo 2.50b3 :: 85.19%
..----
heheh,, the same question.. somebody know how unpack armadillo new version manually..:)
how i found the oep..
and if i need use import reconstruct and revirg..?
thanks
again
Woodmann
07-31-2002, 09:26 PM
Hi,

Why dont you search for some instructions about how to identify different packers.

Peace, Woodmann
Lord8Bit
08-01-2002, 07:06 PM
You may wish to check out PEiD 0.8.

Will identify mostly any packer/wrapper you will meet in the "wild".

There is a thread about it on this board.

hxxp://www.woodmann.net/forum/showthread.php?threadid=3511

Best Regards
LordByte
Gorr
08-05-2002, 01:58 PM
hi,

When I try running peid on NT it appears to exit immediately.

Is it that I do something wrong :)
?


Curious question about reg storage addresses
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Curious question about reg storage addresses
PDA

View Full Version : Curious question about reg storage addresses

Coersum
07-31-2002, 10:51 PM
ok,

I was wondering, ok data, progs etcc are stored at memory addresses, but what about the registers.

When we do a mov eax, 00000010 it changes eac to 10, but where is eax stored at ? Is it in memory somewhere or directly in the CPU ?

Why I wonder: To try some stuff on SI, I edit eax to put a diff value and the target bugs afterward..... by changing this value, did I change eax address to what it contains or the data to the address the value eax is stored at ?

Hope u follow. Might be dumb question but I was curious. :D
Coersum
nikolatesla20
08-01-2002, 12:59 AM
EAX is a hardware register, wired hard right into the CPU, as well as all the other registers.

-nt20


Hash algorithm identification
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Hash algorithm identification
PDA

View Full Version : Hash algorithm identification

GodsJiva
07-31-2002, 10:57 PM
Hi there,

I'm quite new to the cryptographic side of keygenning; I keygenned a nice program yesterday called Dogma ( h**p://www2.getafile.com/cgi-bin/merlot/get/pulse/Dogma.exe ) which seems to hash a hell of a lot of constants in.

The main interesting proc is at 427200; the procs which do the work (offshoots from that), which are also the ones with the constants, are at 425630 (done once), 425f20 (done 10h times with two dwords varied each time, but same basic constants), and 425810 (done once). These offshoot procedures have the same type of layout, ill let you see for yourself.

427200 is called once for each 8 letters of the Name, producing 2 dwords each time. If the name is <= 8 chars, skip to the ascii conversion using the 2 dwords for those 8 (or less) chars. If >8 chars, the dwords have some xoring and shifting done to them starting at 4273e1 to result in a final 2 dwords, which are then converted to ascii "%lx%lx" (but with starting 0s if less than 8 chars each). This is then the correct serial for that name.

Anyway, my question is, is this a standard hashing algorithm, or just a stupidly long (for its purpose) custom made algorithm?
Lbolt99
08-01-2002, 03:16 AM
Sounds like just a lame-ass custom algo. A real hash function like SHA-1 would be much harder to reverse. If implemented properly, they are almost impossible to deal with. Hashes are really simple but can be really effective in keygen prevention :(
GodsJiva
08-01-2002, 11:13 AM
Ah, but thats the thing you see, I didn't need to reverse it, just rip a whole load of code out of it. It did all this weird stuff just to the name, then compared the result to the serial. I wouldn't want to even think about reversing all this crap...

There's just soooo many constants in it, I find it slightly hard to believe it was done just for this program.
[yAtEs]
08-01-2002, 11:41 AM
latest safedisc uses a hugh proc(about 6kb .asm file) to
hash/create 128bit keys i'd be interested to know if this is
a well know hash or not since macrovision have and still do
use the freeware TEA encryption heavily.

Does anyone know of any sites where i can get asm/c asm preferred sources of some well know hash systems.

/me does a little wave to godsjiva

yates.
GodsJiva
08-01-2002, 11:50 AM
/me waves back to yates ;-)

Go reverse some keygens :D

The keygen for dogma ended up being about 1300 masm lines, about 80 of which is GUI...

I should really go look at Safedisc again.
serkul
08-08-2002, 12:03 PM
hmm
i spent my last weekend in reversing the protection scheme of
advanced email extractor v2.60.
this is a shareware app which has some parts (e.g. save file) disabled.

it takes a registration code as input which looks like that:
AEE-nnnnnnn-xxxxxxxxxxxx (n=numbers, x=letters or numbers)

then there's a 128-bit hash generated from the entered serial, which
is compared to each member of a hardcoded array of 5844 valid hashs.

i didn't get any further by now, but i guess after a hash matched with
a hardcoded one, the key to decrypt the code of the full-version-features
is extracted from the entered registration code.

here's the crc routine:
http://www25.brinkster.com/nukezore/rev/crc.txt

does this look like a secure crc algorithm?
well i think at least i wont be able to recreate the inputs.
cyberheg
08-08-2002, 02:11 PM
Yes it is a secure algorithm. I've seen the exact same code in past but I never found out which algorithm it was.

You should notice it uses a round function like many other secure hashes because the same blocks of code is repeated again and again.

Take a look at this code and notice alot similarities:
http://www.freesoft.org/CIE/RFC/1321/md5c.c

However the constants doesn't match so it can't be MD5.

Either way I think you chances to recreate the hash values are very very low.
LaptoniC
08-08-2002, 03:31 PM
in the
htxx://www25.brinkster.com/nukezore/rev/crc.txt

look at the first constant
seg000:00420061 lea ecx, [edx+eax-28955B88h]

NOT 28955B88h = D76AA477

first constant in MD functions is D76AA478

Do you feel it :)

It is same function but different implemantation.In asprotect I guess it was RipeMD160.
[yAtEs]
08-09-2002, 02:16 AM
[QUOTE]
http://www.freesoft.org/CIE/RFC/1321/md5c.c

[QUOTE]

context->state[0] = 0x67452301;
context->state[1] = 0xefcdab89;
context->state[2] = 0x98badcfe;
context->state[3] = 0x10325476;

hey! thats it! :-) those are the initial values used in safedisc
along with a few other rva related dwords which are ran through
the hash, and compared with hardcoded ones in certain data structures, i'll look more at the constants when i got access to my notes. looks very simular thou.

thanks for that post cyberheg (;
cyberheg
08-09-2002, 09:35 AM
This is a common way to initialize hashes. Other hashes which also use the same initialization for context's are RipeMD160 (160 bit) and SHA-1 (also 160 bit).

Take a look here http://libtomcrypt.sunsite.dk
There is a list of hashes implemented and you can watch the source code online.


Bob and Alice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Bob and Alice
PDA

View Full Version : Bob and Alice

nikolatesla20
08-01-2002, 12:55 AM
OK after reading lots and lots of RSA information, all I can say is

Geez GET A ROOM BOB AND ALICE and you wont have to use so much encryption.

:p

-nt20
foxthree
08-01-2002, 07:32 AM
Join the club, tesla :). BTW, nice work on the CodeLock Protection, man. Keep it up :D

Signed,
-- FoxThree

Psst, try to get some dough from Ryan for all the fantastic work u've done ;)
Ryan
08-01-2002, 08:44 AM
Originally posted by foxthree
Join the club, tesla :). BTW, nice work on the CodeLock Protection, man. Keep it up :D

Signed,
-- FoxThree

Psst, try to get some dough from Ryan for all the fantastic work u've done ;)

Psst, try to get some dough from Ryan for all the fantastic work u've done ;) [/B][/QUOTE]

I am reading this, man. ;)

Dough it shall be when I get a Code-Lock customer. Shan't pollute this thread with anymore of Code-Lock.

Regards
Ryan
foxthree
08-01-2002, 12:13 PM
Tesla:

On a lighter note: RSA is one of the most simplest, elegant algorithms to provide "iron-clad" security. If you implement RSA correctly, NOBODY (apart from probably NSA) can touch it. Again, the catch here is - IF you implement it correctly. It has a interesting story - the RSA algorithm. Mail me when you find some time on your hand and I'll tell you the story ;)

Signed,
-- FoxThree
fjrp2
08-06-2002, 04:08 PM
Hi, foxthree
I´m also interested about the story.
I do also think it´s a neat piece of algo, the RSA.
And why do you say NSA might "touch" it, because they have strong mainframes?
mike
08-06-2002, 08:52 PM
You think I got zero knowledge,
But I know you done me wrong.
Just commit to me baby,
So's I can sing a happier song!
One bit of commitment,
That's all I really need,
So send me your hashed answer
And the random seed.

I got the bit commitment, bit commitment blues.
I got the (thump thump hmmm...) bit commitment blues.

I ain't oblivious, darlin',
And honey, I ain't blind.
Don't need sublim'nal channels
To read your cheatin' mind.
I'll share a secret with you:
I know you hand out a public key.
But why's it to the apartment
That you're sharin' with me?

I got the bit commitment, bit commitment blues.
I got the (thump thump hmmm...) bit commitment blues.

You say you love me, baby,
But you flirt with other guys.
You say you want me, honey,
But I see you wink your eye.
You say you need me, Alice,
Now forgive me if I sob;
You know my name is Charlie,
So quit hangin' out with Bob!

I got the bit commitment, bit commitment blues.
I got the (thump thump hmmm...) bit commitment blues.
fjrp2
08-09-2002, 06:48 PM
Mike, the best explanation I've ever received of RSA, honest!


how use w32dsm to crack flexlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how use w32dsm to crack flexlm
PDA

View Full Version : how use w32dsm to crack flexlm

wildnet
08-01-2002, 02:48 AM
I want to use w32dsm to get seed for flexlm.
I did it . (1)w32dsm ->open file to disassembel ->"demo.exe"
(2)w32dsm->Debug-> Load Process-> command line-> "lmgrd -c demo.dat"
but it cannot do l_sg.Why?
Woodmann
08-01-2002, 03:13 AM
Howdy,

You have violated the number one rule in all reverse engineering forums............

You have failed to:

1) read the posting guidelines.

1a)had you read them you would have known to search.

1b)your question has already been answered. (but you did not read and search)

1c) I do not want you to reply to this. Read the posting guidelines, do your research and then come back and show you have made some effort.

I will delete this thread tomorrow.

Peace, Woodmann
wildnet
08-01-2002, 03:23 AM
Hi,woodmann
I had read some post article,and set bp l_sg,
I trace into,but it cannot do lm_new,and
error message"vendor daemon can't talk to
lmgrd(cannot connect to license server -15,10:10061
(Winsock:connection refused)".Why?
Can you help me?


help with a multi(?) packed .dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help with a multi(?) packed .dll
PDA

View Full Version : help with a multi(?) packed .dll

Exocist
08-01-2002, 03:10 AM
hi chaps,

first off, I confess to being a lurker around these parts since Splaj helped me a long time ago on BeatCreator 1.4

anyway, since then I been unpacking the odd thing but this one has me puzzled. The packed .dll is called SynSonos.dll and it part of the Cubase SX protection created by SynchroSoft. Natively, this .dll doesn't come packed.

The packing of the .dll has been introduced by the group that cracked it, in this case ZONE Team. As part of their crack they have used SetWindowTextA and LoadBitmapA to replace the splash screen and it's caption. I like to NOP these out and ADD ESP,08 to compenstate. This works fine to keep the original splash intact.

I have already done this with this .dll, I dumped the .dll with IceDump at the OEiP = 0x0000C604, fixed the API calls above and it works fine. BUT... I want to unpack this .dll a different way without dumping. This is what I'm really interested in as the .dll appears to be packed with UPX and ASPack 2.xx

The header sigiture in the .dll would indicate it is UPX, esp at offset 0x000003E0 where there would normally be a "UPX!", the section names have been removed.

However, after LoadLibraryA is called the first jump into the .dll is address offset 0x00028200 and this appears to me to be ASPack, it get's to the end of this routine, pushes the address to the UPX de-packer;

PUSH 02FE2F00 <--- depending where it loaded in memory; base addy + 52F000
RET

the UPX process runs and pushes a return address back to another ASPack de-packer;

PUSH 02FDE000 <--- or base address + 4E000
RET

this then does it's thing and FINALLY it jumps into the REAL OEiP of the unpacked library;

PUSH 02F9C604
RET

long-winded I know. I need some advice on how to unpack this, it seems to me that only certain sections of the .dll are being unpacked. I basically want to end up with an unpacked .dll exactly as it was before any packer was applied.

I've tried the obvious like using ASPackDie (which complains about not knowing the exact compressor version) but 'appears' to successfully unpack part of the .dll, it updates the EIP with the offset pointing to the UPX routine. Then I thought... OK lets replace the UPX0 , UPX1 etc... in the section names and try to uncompress the next bit with UPX -d... no joy.

I would love someone to take a look at it and point out what I'm missing. I would have thouht that if a file was packed like this;

1) ASPack <file>
2) UPX -f <file>
3) ASPack <file>

then the process could be reversed, unless... only certain sections have been packed.

if anyway is interested, for curiousity sake, then please email me;

exosys(at)yahoo.com

and I'll send you the .dll in question. thanks guys...

-Ex ;)

PS: I have also dumped this .dll with lordpe and rebuilt the IAT using revirgin (IAT=0x0002015C) also.. that work too.
Lbolt99
08-03-2002, 06:42 AM
They might have packed with a modified version of UPX. I have seen it floating around. It confuses UPX so that the -d option doesn't work. I think they just change some of the starting code to screw it up. Not sure if that's the problem you're running into though.

Update:
Just ran into something called UPXFIX on exetools, you might want to take a look at that, might fix your upx -d prob.. also ASpackDie 1.4 is out
Exocist
08-03-2002, 10:03 PM
thanks for the reply man,

I've been working on this for a few days now and it's pretty much done.

1) I did the first ASPack with ASPackDie, this got rid of two sections in the .dll, I had to patch two bytes in the UPX unpack routines after doing this, these bytes were the addy being loaded into LEA ESI at the start of the UPX routines.

2) I then let the UPX routines do their thing and set a breakpoint on the start of the second ASPack routine

3) I nursed the ASPack routine thru, it unpacked about 8 sections of the .dll, at each time I took the starting address in EDI, and the length from EAX and dumped each section as it was unpacked, this also allowed me to get the original IAT before it was destroyed.

4) I put the .dll back together section by section, modifed the pointers to the IAT , modied pointers to the .RSRC section and the .EDATA sections. (the pointer modifying was a bitch but I learnt heaps)

Now I have a unpacked .dll that is clean of unpacker code and it works... a good learning curve for me.

I have a question tho, does ASPack keep the original file header to get offsets from? I found that during the unpacking stage it was delving into 0xBFF70000 which contained this header...

00000000 4D5A 9000 0300 0000 0400 0000 FFFF 0000 B800 0000 0000 0000 4000 0000 0000 0000 MZ......................@.......
00000020 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 8000 0000 ................................
00000040 0E1F BA0E 00B4 09CD 21B8 014C CD21 5468 6973 2070 726F 6772 616D 2063 616E 6E6F ........!..L.!This program canno
00000060 7420 6265 2072 756E 2069 6E20 444F 5320 6D6F 6465 2E0D 0D0A 2400 0000 0000 0000 t be run in DOS mode....$.......
00000080 5045 0000 4C01 0500 B3C2 1F37 0000 0000 0000 0000 E000 0F21 0B01 030A 0060 0500 PE..L......7...........!.....`..
000000A0 008A 0100 0000 0000 6F4B 0100 0010 0000 0090 0500 0000 F7BF 0010 0000 0010 0000 ........oK......................
000000C0 0400 0000 0100 0900 0400 0000 0000 0000 0030 0700 0004 0000 692E 0800 0200 0000 .................0......i.......
000000E0 0000 1000 0010 0000 0080 0000 0010 0000 0000 0000 1000 0000 5009 0500 B54F 0000 ........................P....O..
00000100 0000 0000 0000 0000 00D0 0500 4057 0100 0000 0000 0000 0000 0000 0000 0000 0000 ............@W..................
00000120 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 ................................
00000140 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 ................................
00000160 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 0000 5F46 5245 5141 534D ........................_FREQASM
00000180 0470 0000 0010 0000 0080 0000 0010 0000 0000 0000 0000 0000 0000 0000 2000 0060 .p.......................... ..`
000001A0 2E74 6578 7400 0000 05C9 0400 0090 0000 00D0 0400 0090 0000 0000 0000 0000 0000 .text...........................
000001C0 0000 0000 2000 0060 5F49 4E49 5400 0000 4123 0000 0060 0500 0030 0000 0060 0500 .... ..`_INIT...A#...`...0...`..
000001E0 0000 0000 0000 0000 0000 0000 2000 00D0 2E64 6174 6100 0000 9A30 0000 0090 0500 ............ ....data....0......
00000200 0040 0000 0090 0500 0000 0000 0000 0000 0000 0000 4000 00D0 2E72 7372 6300 0000 .@..................@....rsrc...
00000220 4057 0100 00D0 0500 0060 0100 00D0 0500 0000 0000 0000 0000 0000 0000 4000 0040 @W.......`.....

thanks for your help again LBolt :D

-Ex ;)


How to install icedump?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to install icedump?
PDA

View Full Version : How to install icedump?

pincolino
08-01-2002, 08:29 PM
Can someone explain to me how to exactly (i.e. step by step) install and properly launch icedump (OS=Win98)?
TIA
Pinco
albert
08-02-2002, 06:46 AM
i just recently installed icedump... i think what i did is just put the icedump.exe to my softice directory..

if u installed softice already... then after that try running icedump. if u press ctrl-d when the softice appears. try using "/h" then u will know icedump is working...

hope this helps.
hobferret
08-02-2002, 05:23 PM
HiYa make sure you got somthing like this in winice.dat file - the one you really need is kernel32 but if you load the others it's a great help to setting bpx's in various proggies!

EXP=c:\windows\system\vb00032.dll
EXP=c:\windows\system\vb300.dll
EXP=c:\windows\system\vb40032.dll
EXP=c:\windows\system\msvbvm50.dll
EXP=c:\windows\system\msvbvm60.dll
EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
EXP=c:\windows\system\advapi32.dll
EXP=c:\windows\system\shell232.dll
EXP=c:\windows\system\comctl32.dll
EXP=c:\windows\system\crtdll.dll
EXP=c:\windows\system\version.dll
EXP=c:\windows\system\netlib32.dll
EXP=c:\windows\system\msshrui.dll
EXP=c:\windows\system\msnet32.dll
EXP=c:\windows\system\mspwl32.dll
EXP=c:\windows\system\mpr.dll

Maybe you already done it but if it's useful use it.:)
pincolino
08-02-2002, 05:48 PM
I've done.
i just put icedump.exe (related to my sice version) in sice dir and launch it directly (obviously after sice loading) from a link (DOS) I've put on desktop.
When I'm typing an icedump command, below appears "Invalid command": this confused me, but how cluesurf wrote in previous post: "there's nothing wrong coz it's an external command: just press "enter" after typing a command.
To check if icedump is loaded just type '/' without quotes and "enter" and you can see icedump commands.

Thanks to all friends!


converting string to offset
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > converting string to offset
PDA

View Full Version : converting string to offset

ud49
08-02-2002, 12:22 AM
hi there guys
those of you who code keygens are familiar with the thingy:

push eax
push offset format
push offset temp
Call _wsprintfA

in which the offset of eax is converted to string and stored at temp

ex: eax is F123AB42, using the above code memory at temp will hold F123AB42

my question is, how can I reverse that.
I mean how can I transform the string entered in a keygen to eax's offset?

ex: user entered C12345AE and i want eax to have address C12345AE

is there a special use of an api - a keypoint or do i have to write a function?

hope i could expressmyself :p
thx
Kayaker
08-02-2002, 06:25 AM
Hi

You may need to come up with your own routine for this. Retrieve it with GetDlgItemText and parse the string into dwords. Then convert ascii dwords to hex with a conversion routine. Take a look at the MASMv7 source for the 'htodw' conversion routine. Or use wsprintf again to convert to a hex dword. Then you can handle the extended string.

Or you could be tricky and put each dword back into the edit box control (SetDlgItemText), and retrieve it again with GetDlgItemInt. It will be converted for you ;)

Kayaker
ZaiRoN
08-02-2002, 10:18 AM
hi!
hope this helps (is written with masm):

.386
.MODEL FLAT, STDCALL
option casemap :none

include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib

; ZZZZZZZZZZ
.data
number db "C23F98A0",0 ; the string u want to convert

; ZZZZZZZZZZ
.code
main:
invoke GetModuleHandle, 0

xor eax, eax
xor ecx, ecx
lea esi, number
lodsb

@cycle:
cmp al, 3Ah
jb @number
sub al, 37h
jmp @do
@number:
sub al, 30h

@do:
xor ecx, eax

lodsb
test al, al
jz @end
rol ecx, 4

jmp @cycle

@end: ; here: eax = C23F98A0

end main ; game over!!!

ciao,
ZaiRoN
ud49
08-02-2002, 11:58 PM
oh thx a lot
i have come up with about the same thing on tasm before asking the question
but always came up eax bein 0C02030F etc
i guess xoring was the point


JBuilder 7 and DSA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > JBuilder 7 and DSA
PDA

View Full Version : JBuilder 7 and DSA

gordon freeman
08-02-2002, 08:27 AM
Hello,
While I'm trying to make a keyGenerator (a slip file generator) for JBuilder 7, I found that borland has introduced a digital signature to protect their prog.

Is it possible to reverse the verification process ?

(My question may sound strange, but as I am a newbie..!).

#included the Java class responsible for the verification (Verifier.java).

Thank You.
AdamA
08-02-2002, 07:51 PM
Hi,

it looks like a normal(not seeing any Elliptic Curve Params) DSA-Verification. Without the private key, no chance at all:(
Maybe you have to patch the public key in a[]; (Create your own one with the DSA-Params from a[])
If you dont understand what i mean, please read some good Crypto-Book about DSA! (try this: h**p://www.cacr.math.uwaterloo.ca/hac/)

happy reversing,
AdamA
Artifex
08-04-2002, 04:47 AM
Hi, gordon freeman, and all fellows.

I like to play with Java and, as I never need to build big applications, I am glad with JBuilder (free) Personal Edition. You probably know that JBuilder 6 Enterprise Edition has been cracked and a crack is avaliable. JBuilder 7 has been cracked too, but the crack has disappeared. So your work should be appreciated and I was expecting more replies in this thread.

As they didn't come, could you explain to me what is the function of this verify.class in JBuilder 7 protection process, and what is the relation with the serial number.

What happens if one replaces the verify class with :
flag = true
and recompiles it ?

Artifex
mike
08-05-2002, 08:19 PM
Originally posted by AdamA
Hi,

it looks like a normal(not seeing any Elliptic Curve Params) DSA-Verification. Without the private key, no chance at all:(
Of course, that only applies to keygens. You can always patch code...
gordon freeman
08-06-2002, 11:00 AM
Hi,
I don't know if this is the best thread to post this reply as is not 100% Cryptographics related. If not, please can anyone move it to another thread.

Borland use a file called "slip" to identify its products. The Slip file is made of 2 distincts parts : the enveloppe and the product info. The enveloppe main purpose is to identify the owner of the product and verify the integrity of the slip file. The productInfo hold all information about the product (version of Jbuilder, serial, ...). Here is the structure of such file :
********** Enveloppe Features ************
slip.isSilentImport : 1
slip.isImportable : 1
slip.isNodeLocked : 0
slip.isSessionLocked : 0
slip.PackageTitle : JBuilder 7 Package
slip.Protocol : 6
slip.Signature : 00000000000000000.......
slip.getOwnerLastName : Gordon
slip.getOwnerFirstName : Freeman
slip.getLicensedCompany : None
licensed.serialno : 0
********** Enveloppe Features *************

Number of ProductInfo : 1

****** ProductInfo Features **********

Platform : Cross Platform
SKU : Enterprise
Non-Commercial use only : No
Term : Unlimited
Product Label : JBuilder 7
Product ID : 1007
Serial Number :o
Key : 0 Platform Name : Cross Platform
Platform ID : 0
Product SKU Label : Enterprise
Product SKU : 2
Non Commercial Label : No
Non Commercial ID : 0
Term Label : Unlimited
Term ID : 0
Term : 0
Internal : 1
Upgrade : 0
Beta : 0
Host Bits : 585
****** ProductInfo Features **********

The following parameters depend on the serial Number : Key, Platform ID (and Name), Commercial propertie, Term ID (Trial or retail), Internal, Upgrade and Host Bits.
So as you can see, the same Serial Number can be used in the All JBuilder versions (Personal, Professional, Sybase or Enterprise Edition).
The class Verifier is used when verifying the integrity of the Slip File. This is a new propertie in JBuilder 7 that didn't exist with JBuilder 6 (making a keygenerator for JBuilder 6 was an easy work). Before verifying the Signature, the properties "e.Signature" is reset to 0, then the content of the file (class SignedSlip) is given to the method "verify" and the real Signature is compared with the expected signature :

public static boolean verify(SignedSlip signedslip, String s, int i)
where :
SignedSlip : Class Holder of the slip file.
s : This is e.Signature.
i : This is e.Protocol // Must be 0 for JBuilder 7.

My purpose was to make a keygenerator for JBuilder 7 not a crack. It's easy to make a crack by rewriting the class Verifier as follows :

package com.borland.sanctuary.lm.mgr;

public class Verifier {
public static boolean verify(SignedSlip signedslip, String s, int i) {
return true;
}
public Verifier() { }
}

and use the slip that i included. But it seems impossible to make such KeyMaker.

Thank you for your help.
Artifex
08-06-2002, 12:19 PM
Hi, gordon freeman, and many thanks for the informations.

Artifex
gordon freeman
08-06-2002, 12:37 PM
Hello again,
It seems that I forgot to put the enclosed Slip.

So here is the file.
Artifex
08-06-2002, 01:08 PM
Hi,gordon freeman !

That is too kind of you !
Delete it before I download it, otherwise you will be hit on the finger tips, even if it is your first slip :)

Artifex
esther
08-06-2002, 03:33 PM
Originally posted by gordon freeman
Hello again,
It seems that I forgot to put the enclosed Slip.

So here is the file.

Hi gordon freeman,
You uploaded file is a crack.This is a second time you upload this file.
fjrp2
08-06-2002, 04:02 PM
C´mon esther, give the guy a break...
I liked his doenload anyway.
And what´s a crack and what´s not, anyway?
(What you doing next weekend?)
esther
08-06-2002, 04:25 PM
Originally posted by fjrp2
C´mon esther, give the guy a break...
I liked his doenload anyway.
And what´s a crack and what´s not, anyway?
(What you doing next weekend?)

Hi fjrp2,
>So as you can see, the same Serial Number can be used in the >All JBuilder versions (Personal, Professional, Sybase or >Enterprise Edition).
>slip.getOwnerLastName : Gordon
>slip.getOwnerFirstName : Freeman
>slip.getLicensedCompany : None
>licensed.serialno :blah

The license serial no is this is not allowed posting in here.The zip file is quite similar to keygens...
I hope newcomers should read the posting guidelines before posting or uploading anything in here.

You wrote:(What you doing next weekend?)
worked :p
fjrp2
08-06-2002, 04:59 PM
Okay, your right.
But don´t work that hard... it´s summer, enjoy life a little, and that ;)
mike
08-06-2002, 08:50 PM
Thanks for swatting that crack, esther.

fjrp2: The reason the rule is so strict is because we've had legal troubles before: ISP got threatened by lawyers and dumped the site. We don't want any trouble, so we keep the board clear of cracks.

Also, this is a board for learning *how* to crack, and using someone else's crack works against the purpose of the board.
esther
08-07-2002, 11:51 AM
No problem Mike.Hope ya don't mind ;)

regards
fjrp2
08-09-2002, 06:46 PM
Okay Mike,
The reason the rule is so strict is because we've had legal troubles before: ISP got threatened by lawyers and dumped the site. We don't want any trouble, so we keep the board clear of cracks.

but imho, I think, probably lawyers would be more prone to be "examined" by justice than us, imho.
mike
08-11-2002, 12:40 AM
It's not the lawyers who seek us out, it's the shareware authors who read the board and then sick their lawyers on us.
fjrp2
08-12-2002, 05:40 PM
That's true.

But think of this: aren´t lawyers intelligent enough to know when a client is rick and when he's "sick" (to use your same tarms)?

Imho lawyers are more to blame, because shareware programers are just coders, mathematics-related dudes, or so.
But they, the lawyers, thy know (or shoulkd) justice, so they are more to blame, imhp.

Don´t know if i've made my point clear.
[Maybe a good conclusion: some shareware programmers think like lawyers, but I've never seen a lawyer as clever as a coder ;) Of course, imho.
mike
08-14-2002, 03:02 PM
Well, talk to +splaj and woodmann for details; I'm sure they'd be happy to show you their scars.
fjrp2
08-14-2002, 05:04 PM
I wish I had that familiarity with them to treat that.

This is how I see it:
don´t let those guys scare you; most of the time the balance is on your side. I mean: justice is not such a thing that you can play with (or play with word with it, if tou know what I mean) like they do.

As fravia said once, I wish I could met a reverser-like lawyer, to know how to deal with them using their same tools (or 'words' if you prefer)
RaX
09-04-2002, 05:52 PM
I wish I had that familiarity with them to treat that.

This is how I see it:
don´t let those guys scare you; most of the time the balance is on your side. I mean: justice is not such a thing that you can play with (or play with word with it, if tou know what I mean) like they do.

With the way the media blows up us people to be evil terrorists I dont think we have much chance. Listen to mike he knows, otherwise he wouldnt be the mod ;)
Woodmann
09-05-2002, 06:59 AM
Howdy,

The only people who complain are the trialw*re people.
In the past when some has complained we have complied and everyone was happy. And, some of the bigger software companies have complained and I have respected their wishes.

There just cant be any uploads of any patches, keygens or anything that can circumvent a protection by just doing cut and paste or "run the .exe in you folder named iamatheif". (you know what I mean)

Peace, Woodmann

And it is not the lawyers, companies have people who spend there full time job searching for this stuff.
fjrp2
09-05-2002, 01:22 PM
Nice job:
all day with a computer!
dx50azlm
09-11-2002, 06:56 AM
I remember cracking JBuilder v3.0, v3.5, v4.0 and v5.0 when they came out. v6.0 looked like it was going to be a headache because Borland used some sort of cut-and-paste e-mail message method for their registration. You got an e-mail and just cut/pasted it into a window to register. I thought all hope was lost because the format of the message was unknown, but you could register the program in a different way, using the "old style" serial numbers, like xxx-x?#2-xxae (not a real serial of course). Borland changed the format of the code to something like xxxx-xxx-x?@xx and thus previous keygen code had to be rewritten.. but it was still possible to see how the serials were validated.

Since then, I haven't looked at JBuilder v7.0 because I can't stand the thing anymore; but look for other ways to get around the DSA scheme instead. Try looking for a way to enter in one of these "old style" serials (it won't be in the main program, but in a separate program, like a license manager). All of the old JBuilder key verification routines were found in the 'PrimeTime' directory when you unzipped the main JAR file. Run JAD on that directory and just have a look at the sources there. You might find another way in.


Dede source code available now
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Dede source code available now
PDA

View Full Version : Dede source code available now

Lbolt99
08-03-2002, 07:10 AM
Check out DaFixer's site.. source code is available now. Maybe someone can modify it so it'll work on the "Obfuscated" delphi apps :)

It would also be cool to be able to decompile a currently running delphi process. So one wouldn't have to remove ASPR etc. before running Dede. That would be a bit of work though, if even possible.
nikolatesla20
08-07-2002, 03:25 AM
Wait a minute - DeDe CAN decompile a running process.....

-nt20
dion
08-07-2002, 07:29 AM
sadly, there's no general readme for the source itself, no concept documentation and no project files :( so, it's might be hard to understand all the stuff and to modify/improve it.
Lbolt99
08-07-2002, 04:50 PM
Originally posted by nikolatesla20
Wait a minute - DeDe CAN decompile a running process.....

-nt20

Really? Didn't know that. I guess I always assumed one had to strip off ASPR or whatever and then run the executable thru.. I'll have to take a look at this feature, could definantly use it. Thanks for the info.
DaFixer
08-12-2002, 05:28 PM
The sources are now full and complete. Have no idea what you call delphi obfuscation. Give me url to such application and tell me what you think is obfuscated. Obfuscation as a term that means giving fake names to controls, procedures etc is generally possible and if someone has done this then nothing can be made because there is a loss of information (the names what have some meaning for the humans) and there is NO way to restore this information. Its the same with compiling process by the way :) Hopefully i haven't seen such thing implemented. May be the shareware authors are too lazy or just too lame ;)

Anyways give me url to program you believe it is obfuscated and i will take a look ...
_Servil_
08-12-2002, 10:15 PM
HI Dafixer ;)

not sure if i'm thinking about the right thing but suppose it has something to do with the new asprtoect 'protect delphi forms' feature. I've found several delphi apps crushing dede on load, however they were able to load via dumper. After looking to resources I found the package info blank and forms signature missing.

It's better described at http://www.woodmann.net/forum/showthread.php?s=&threadid=3476
DaFixer
08-12-2002, 11:39 PM
Originally posted by _Servil_
HI Dafixer ;)

not sure if i'm thinking about the right thing but suppose it has something to do with the new asprtoect 'protect delphi forms' feature. I've found several delphi apps crushing dede on load, however they were able to load via dumper. After looking to resources I found the package info blank and forms signature missing.

Hello,

Well havent seen this but if the memory dump succeed then all is fine. Well acctually its hard not to succeed ;) The RCDATA resources are application defined resources which are used after application initialization. So if you just crypt everything there and put right after the program is started a routine to decrypt the RCDATA then all will be invisible for the VCL which create the forms etc. So this is probably some kind of recourse encryption. If you give me url to application that uses this asprotect feature it will be nice and i will be able to see it in details.

Anyway just dont forget that before you go to analize a target you first need to have it decrypted :) This also means decrypted recources. So i could say that this asprotect feature has nothing to do with DeDe. I wont go to add native deprotection for every last protector and his dog :D


Revirgin & ImpREC fucked by this ASPR
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Revirgin & ImpREC fucked by this ASPR
PDA

View Full Version : Revirgin & ImpREC fucked by this ASPR

LaBBa
08-03-2002, 10:11 PM
hi all

well this prog i found wasn't at first seems to be like ASPR
but then i know that it was ASPR...

Examine32 v4.00
http://www.examine32.com/

the OEP seems to be AT : 401000

ok then i dumped it and now tried to rebuild it with ImpREC i puted OEP=1000 and then get imports and goted only 1 invalid
section!
ok we know that trick .. the size is wrong so i changed it to 3000
and clear all and re - get imports =) seems ok now..

but... when i try to do trace level 1 it FAILS !!!!
so i try to use revirgin and got the same !!!

what the hell is going on ???

hope to get an answer soon tnx...
nikolatesla20
08-04-2002, 02:55 AM
I am not trying to sound mean, but the next step is to use your BRAIN !!!

Are you familiar with the PE file format? You can't depend on a tool to do all the work for you. These are very advanced tools. You need to still know what they are really doing to use them effectively. No tool can replace clear thinking !

Most likely you simply ran into one of **Protect's tricks, such as getting GetVersion on its own and storing it in a memory variable. The program later gets it from this memory variable instead of calling ANY api. This will fool any tracer.

One way around problems is to use Windows 2000, and use the Revirgin emulator plug-ins. The **Protect plug in does a good job of detecting (thru the use of opcodes) these "common" anti trace features.

Finding an OEP is never really all that difficult, although it can be confusing for newbs (it was for me for a while). Most programs use a similar structure. You can use this to your advantage.

Here is a trick I like to use:

1. Run the app. Dump it from memory. yes, you cannot use it yet but go ahead and get a decrypted unpacked dump.

2. Rebuild the import table as best you can. YOu may not know all the imports but try to get some of them.

3. Dead list it with WinDasm, look for common routines to see if they may be the OEP. For example, A call to getversion just below the stack frame setup (push ebp, mov ebp,esp), or if the app if MFC look for a __set_app_type call. This is done after the OEP. If the program appears to be written in Delphi you can simply use DeDe on it while the program is running to find the OEP. If it's VB, you can simply dump the running program and open it up in WinDasm and look for the only string reference "VB5!". Where you see this string reference being PUSHED is the OEP.

PLUS dumping like this and deadlisting will show you the jump table, a DIRECT LINK to the import table. All the jumps jump to an address in the IAT. So you can write down one of these "jmp dword ptr [xxxxxxxx]" addresses (the xxxxxxxx part) and this is where your IAT will be. NOw go into SI and look at It !!!! See where it starts. Go back out and fire up revirgin. DONT EVEN BOTHER setting the OEP in revirigin, it does not need it. Just set the IAT start and throw in a number for the end. Press "resolve" If you don't seem to get enough functions, just make the IAT end larger until you start to get blank resolves. YOu have the whole table now and can work from there.

Windows 2000 is the best OS I've found to use Revirgin. ALso DO A SEARCH SEARCH SEARCH this protection has been done to death so do a search and READ ! You will find there have been several posts even lately. READ THEM !!!

-nt20
h8er
08-04-2002, 01:05 PM
The program is protected with Aspack and not with Aspr

dump the file oep is 1000

load examine with symbol loader

bpr 442000 442000+948 rw

0187:0045017D C1F902 SAR ECX,02
0187:00450180 F3A5 REPZ MOVSD <- you pop here
0187:00450182 8BC8 MOV ECX,EAX
0187:00450184 83E103 AND ECX,03
0187:00450187 F3A4 REPZ MOVSB
0187:00450189 5E POP ESI
0187:0045018A 6800800000 PUSH 00008000
0187:0045018F 6A00 PUSH 00
0187:00450191 FFB552010000 PUSH DWORD PTR [EBP+00000152]
0187:00450197 FF9551050000 CALL [EBP+00000551]
0187:0045019D 83C608 ADD ESI,08
0187:004501A0 833E00 CMP DWORD PTR [ESI],00
0187:004501A3 0F851EFFFFFF JNZ 004500C7
0187:004501A9 6800800000 PUSH 00008000
0187:004501AE 6A00 PUSH 00
0187:004501B0 FFB556010000 PUSH DWORD PTR [EBP+00000156]
0187:004501B6 FF9551050000 CALL [EBP+00000551]
0187:004501BC 8B9D31050000 MOV EBX,[EBP+00000531]
0187:004501C2 0BDB OR EBX,EBX
0187:004501C4 7408 JZ 004501CE
0187:004501C6 8B03 MOV EAX,[EBX]
0187:004501C8 878535050000 XCHG EAX,[EBP+00000535]
0187:004501CE 8B9522040000 MOV EDX,[EBP+00000422]
0187:004501D4 8B852D050000 MOV EAX,[EBP+0000052D]
0187:004501DA 2BD0 SUB EDX,EAX
0187:004501DC 7479 JZ 00450257
0187:004501DE 8BC2 MOV EAX,EDX
0187:004501E0 C1E810 SHR EAX,10
0187:004501E3 33DB XOR EBX,EBX
0187:004501E5 8BB539050000 MOV ESI,[EBP+00000539]
0187:004501EB 03B522040000 ADD ESI,[EBP+00000422]
0187:004501F1 833E00 CMP DWORD PTR [ESI],00

at 450182 d 442000 this is your it an down there's the complete iat so here dump 442000 948

IT Rva 42000 size f0
IAT Rva 420f0 size 948

fix the dump

to bypass the crc check:

bpx readfile
f5 x 11
f11
bd *
bpx 424aa7

0187:00424AA7 84DB TEST BL,BL
0187:00424AA9 750C JNZ 00424AB7 nop here
0187:00424AAB 807DFF00 CMP BYTE PTR [EBP-01],00
0187:00424AAF 7506 JNZ 00424AB7 nop here
0187:00424AB1 807DFE00 CMP BYTE PTR [EBP-02],00
0187:00424AB5 7440 JZ 00424AF7 jmp here
0187:00424AB7 BE288F4300 MOV ESI,00438F28
0187:00424ABC 8D7DE0 LEA EDI,[EBP-20]
0187:00424ABF B905000000 MOV ECX,00000005
0187:00424AC4 F3A5 REPZ MOVSD
0187:00424AC6 66A5 MOVSW
0187:00424AC8 8D85DCDEFFFF LEA EAX,[EBP+FFFFDEDC]
0187:00424ACE 50 PUSH EAX
0187:00424ACF 8D55E0 LEA EDX,[EBP-20]
0187:00424AD2 52 PUSH EDX
0187:00424AD3 8D8DD8DDFFFF LEA ECX,[EBP+FFFFDDD8]
0187:00424AD9 51 PUSH ECX
0187:00424ADA E8CB040100 CALL USER32!wsprintfA
0187:00424ADF 83C40C ADD ESP,0C
0187:00424AE2 6A30 PUSH 30
0187:00424AE4 683E8F4300 PUSH 00438F3E
0187:00424AE9 8D85D8DDFFFF LEA EAX,[EBP+FFFFDDD8]
0187:00424AEF 50 PUSH EAX
0187:00424AF0 6A00 PUSH 00
0187:00424AF2 E8C3030100 CALL USER32!MessageBoxA
0187:00424AF7 33D2 XOR EDX,EDX
0187:00424AF9 8AD3 MOV DL,BL
0187:00424AFB 33C9 XOR ECX,ECX
0187:00424AFD 8A4DFF MOV CL,[EBP-01]
0187:00424B00 03D1 ADD EDX,ECX
0187:00424B02 33C0 XOR EAX,EAX
0187:00424B04 8A45FE MOV AL,[EBP-02]
0187:00424B07 03D0 ADD EDX,EAX
0187:00424B09 85D2 TEST EDX,EDX
0187:00424B0B 0F95C0 SETNZ AL xor eax,eax here
0187:00424B0E 83E001 AND EAX,01
0187:00424B11 5F POP EDI
0187:00424B12 5E POP ESI
0187:00424B13 5B POP EBX
0187:00424B14 8BE5 MOV ESP,EBP
0187:00424B16 5D POP EBP

so

00424AA9 750C -> 9090
00424AAF 7506 -> 9090
00424AB5 7440 -> EB40
00424B0B 0F95C0 -> 33C090

Now the program runs normally

Bye
Woodmann
08-04-2002, 08:32 PM
Howdy,

I know people are trying to be helpful but...............

Stop doing the work for them. They will learn nothing.

Peace, Woodmann
h8er
08-04-2002, 10:17 PM
Sorry Woodmann next time i will be less helpful :)


Zmud 6.32 Beta w/Elicense vtcpak33.dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Zmud 6.32 Beta w/Elicense vtcpak33.dll
PDA

View Full Version : Zmud 6.32 Beta w/Elicense vtcpak33.dll

Vermithrax
08-04-2002, 05:24 AM
Hey people. :)
I've been working on unpacking/unwrapping Z-mud v6.32 Beta. Available at: h t t p : / / w w w.z u g g s o f t.c o m / r e d i r e c t . a s p ? t a r g e t = z m u d b e t a

I'm pretty new (in fact, this is my first "real" try at unwrapping/crakin' anything!) It's using Elicense protection with vtcpack33.dll, and I'm having probs getting a dump that works. It appears to be doing an xor after unpacking, and I'm not sure where the actual unpacked (and un-xored?) jump is that I can step into. I'm using TRW2000 1.23 and I tried to pedump where I *thought* the jump was... F8'd into it, it looked reasonable, and it didn't work afterwards. I couldn't use makepe, which is only in the regged ver of TRW2k, which says that it fixes headers or something... And when I tried to run the resulting executable (I renamed it to Zmud.exe just in case, saving the old one as a backup). It just gives some kind of protection fault and zaps out, so it's obviously not a good dump... Maybe these headers that are being talked about being corrupted there?

So anyhoo, I loaded zmud.exe in trw2k, and F5'd until I was at the Elicense try/buy/license (I tried the damn proxy, but it didn't work, even though I told it to use the proxy. *mumble*) I then CTRL-N'd and set a breakpoint at freelibrary, which is where I've seen most elicense posts talk about. So I F5'd back out after setting the breakpoint and clicked on the TRY button (I've only got 5 days left haw), and immediately trw2k popped up with the breakpoint. Anyhoo, I continued tracing with F10 (which doesn't step into function calls), and looked for the first JMP after that, which I presumed (like I say, this is my first time, but I've done a lot of research!!, and I don't REALLY know yet!) would lead me to the unwrapped executable. After I followed the jump (not sure whether I should follow a CALL or a JMP after??) I saw what appeared to be a little bit of a loop with an xor after it. I figured it was just unpacking the file then un-xoring it, so I set a breakpoint at the xor. I'm not sure where the file was being unpacked to, what address or whatever (the OEP?? What does that mean? I know entry point, but... ?). After setting a breakpoint at the xor, I again hit f5, which after the loop was finished, stopped at the xor... So I let it do that, and it returned from the (jump?/call?)... I figured I'd see if the next JMP was the correct one, but it went through the same loop with the xor... Anyhoo, I didn't know where to go from here, so I used pedump and of course it didn't work.

I got revirgin 1.3, I'm using Windows ME, which prevents me from running softice or revirgin 1.4 (tried it on another machine, worked fine, but it was registered there... Mayhaps I can dump that one somehow? I tried Procdump, but it crashed. :() Anyhoo, I can't figure out how to use revirgin if the executable just crashes, what process can I attach to?? So I said, "Can't do that..." :D

Anyhoo, I've tried like a sonofabitch to get this to dump correctly, and just can't figure it out. :) Anyone care to give me a hand with my first crackorama ever? :)

WoOooOOO!
Artifex
08-04-2002, 06:32 AM
Hi, Vermithrax.

You will get informations searching for "E-License" or "Deep Paint" on these messageboards.

Regards.
Artifex
Vermithrax
08-04-2002, 06:38 AM
That's what I've been looking at and working with, but I can't use SoftIce because I'm running Windows ME, I'm using TRW2000 instead. :P I'm also new to this (like, very new), and not 100% sure of all the tools to use. Like I say, I've tried softice 4.05, but it wouldn't work under Windows ME, it told me that it's an expired version, etc. And I'm embarassed because I really don't know COMPLETELY what I'm doing, but I figure that if I dive into it headfirst, I'd figure it out as I went. :D I've read every elicense-related message on the board, including the deep paint one.
I've also read Muad'dib's elicense unprotecting faq that I found somewhere, but the elicense faq by Muad'dib referred to an older version that didn't do the xor thing... This later version does, and I'm still having problems with it... :) I've read through Splag's whole tutorial, and I couldn't find the right place to change the xor's to push edx's, nop, etc. I *am* trying, though, but I'm still struggling with some of the concepts. :p
Artifex
08-04-2002, 07:13 AM
Vermithrax wrote :

"but I can't use SoftIce because I'm running Windows ME"
..."I've tried softice 4.05, but it wouldn't work under Windows ME, it told me that it's an expired version, etc."

It is not very difficult to get Softice 4.05 working with Windows Me. There are a lot of Web pages about it.

And about E-license, there is nothing to append to +SplAj's tutorial.

Artifex
Vermithrax
08-04-2002, 08:20 AM
I did a little searching, and I got SoftIce working for me. :) Now to go through that tutorial in depth. :)


Stud_PE 1.5b preview
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Stud_PE 1.5b preview
PDA

View Full Version : Stud_PE 1.5b preview

unknownone
08-04-2002, 06:30 PM
..greatz

Since i don't know when i'll finish this proggie...

http://christig.virtualave.net/ITimer/zipp/Stud_PE1.5b.zip

homepage:
www.itimer.home.ro
ZaiRoN
08-04-2002, 06:39 PM
hi!
it seems a good tool!!!
i like the 'advanced tree view in hexeditor', very original :)

ciao,
ZaiRoN
Hoof Arted
08-04-2002, 09:47 PM
I am impressed..... Very nice!!!! Thanks for sharing it with us and I would like the finished version when you get there.

Hoof
wbe
08-04-2002, 11:44 PM
Nice tool.

A good visualization aid for those who'd like to study the PE Header in detail.

Congratulations.

wbe
Exocist
08-05-2002, 12:57 AM
have to agree, nice tool.. well done :D

-Ex ;)
snaker
08-07-2002, 12:08 PM
unknownone,

Your tools sure is good.
Most ideas are genuine and nicely implemented!
But your signature scanner *IS* *SURELY* ripped from PEiD

Why you do that without permission?
You dont even have a Greeting/Thanks to point that out! :(

This is bad you know
Bengaly
08-07-2002, 06:48 PM
yay! :(
no fun when it comes to stealing info =/

i'll contact u snaker if i'll need one for my detector ;) just to make u feel u did great job over PeId :)
ah well...
cyberheg
08-07-2002, 07:20 PM
Both Peid and this other program are both freeware and both used in most cases by crackers to produce cracks and help them to ease their work in their effort to pirate comercial software. I bet either of you can't deny that it didn't cross your mind when you made it.
As for credits ofcourse he could have given you some but does it matter? I mean I would be happy enough to implement a feature good enough that people would actually use it in their own programs. This just means you made something innovative which not only you find good.

BTW. I tried this Stud_PE with a prog I wrote in Visual C++ 6.0 MFC in debug mode and it detected it as Visual C++ 5.0 while 6.0 is also on the list. I assume that is a bug.
unknownone
08-07-2002, 08:08 PM
it was only a preview...
anyway...it's your work making that database (GREAT JOB)
...in the releas a'll show it...
maby we'll colaborate in the future.. visit us #rcf@undernet ;)

sorry reversing your peid :rolleyes:

greatz
snaker
08-08-2002, 04:01 AM
cybergh: I dont agree with you that PEiD is build to help ease pirating jobs. I mean come on man, being on this forum you should know that cracking isnt all that is done by us.

Heh, yeah I'm not too much into greets, but when you use other people's code, the least you can do is mention that. You see, Qwerton might have spent some time developinf the scanning methods, and all people have to do is rip it.

About the Visual C++ 6.0/5.0 detection. I dont think there is a surefire signature byte way of detecting/distinguishing either. Most other identifiers try to do it with the linker version stored in the file.

Bengaly: Qwerton and me I think would be happy to let out some of the sources of PEiD for other people to use. Its coded in ASM, so if and when you need it, maybe write us a mail and we'll send :)
Bengaly
08-09-2002, 12:46 AM
thnx Snaker! ;)

as soon as i finish my disasm engine (bah..mabye next year heheh..too much opcodes)
i will contact for some signatures bytes ;)
keep up the good work.
Ben
unknownone
12-04-2002, 10:13 PM
:)

download (http://itimer.home.ro/studpe.html)

greatz
unknownone
Snatch
12-05-2002, 02:49 AM
I have written a disassembly engine if you make a good opcode class it really is not to hard. In fact on the web you can even find some if you need ;).

Snatch


Java questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Java questions
PDA

View Full Version : Java questions

Gorr
08-05-2002, 06:24 AM
I need general outlook on organization of java applications.

1. I need to know the basic structure of such an app.
2. Are java apps like vb runtime interpreted and thus do work slower?
3. Why java exe needs to export lots of funtions with names including word java in them?
4. To me java app is a regular exe calling java routines. Am I correct?
5. What is the purpose of jre named directory at the root of a tipical application tree?

I need this in order to know where to look and what to expect.

Maybe some knows where I could read more about this?

Thanks
theCaller
08-05-2002, 09:45 AM
1. I need to know the basic structure of such an app.

there's a class that acts as a main entry point to the application, and that is the primary consumer of other application's classes.

2. Are java apps like vb runtime interpreted and thus do work slower?

Java apps are not compiled to machine code but to a 'bytecode' that is interpreted by the Java VM (Virtual Machine) and by it translated into machine and host system code. Obviously as any interpreted language it results into slower code, even if with the recent Hot Spot lets code running faster because of an optimization.

3. Why java exe needs to export lots of funtions with names including word java in them?

That is not really clear man, what u mean with "java exe"?

4. To me java app is a regular exe calling java routines. Am I correct?

Definitely not, a java app is a collection of (bytecode) classes loaded up into a process that is the Java VM and by it executed.

5. What is the purpose of jre named directory at the root of a tipical application tree?

the JRE (Java Runtime Environment) is the (Java) Environment in which a java app is executed, we have in it all the wrapper DLLs, the VM itself and the base classes of the language, to let java applications interfacing with the underlying system .... Obviously every OS on any Platform has its own JRE.
The javac tool and the other tools under the bin directory are only wrapper of java classes, they do nothing except calling particular java classes to perform such operations like compiling and so on .....
Gorr
08-05-2002, 01:46 PM
Thank you theCaller you are very helpful.

3. Why java exe needs to export lots of funtions with names including word java in them?

That is not really clear man, what u mean with "java exe"?

here goes short abstract from the exe export function list :

00000008 0040A510 _Java_mws_edit_Editor_fixPCR@12
00000009 0040A290 _Java_mws_edit_Editor_generate@16
0000000A 0040A0F0 _Java_mws_edit_Editor_native_1destroy@8
0000000B 0040A040 _Java_mws_edit_Editor_native_1init@12
0000000C 0040A140 _Java_mws_edit_Editor_setParams@32
0000000D 0040A220 _Java_mws_edit_Editor_setTransParams@28

Every entry contains Java word in the name. That way there are over 100 entries in total.

Is this normal or a maze of a particular application?

Thanks
theCaller
08-05-2002, 04:40 PM
that means that there's native code intarfaced by java. Using the JNI (Java Native Inteface) you can invoke methods not implemented in java but in native code that is funcions hosted in DLLs and so one. This can be obtained declaring some class methods as "native" so you inform the compiler that the implementation of that/those method/s is hosted in some native code libraries (read DLLs and so on on Win32 Platform) ......

When you finish coding your class with methods declared as native, you use a particular JDK tool called "javah" to create a ".h" prototype C/C++ file for the native language imlpementation of the methods you declared native.
In the JDK include directory you'll find the ".h" prototype files that wrap the Host System data Structures.

Obviously there's a standard naming convention for the methods you implement in your library, that is the Java_<package_listing>_<classname>_<methodname>.

You actually implement that/those methods in a C/C++ file, create a library (read DLL on Win32 OSes) and then put the resulting dynalib in the system path.

Though the Java call System.loadLibrary("<your library>"); in a static block of your java (main) code you let the VM load your library and link it at runtime to invoke the methods you declared as native.

Of course, you can call even Java code from you libraries, in a kinda reverse process. that is VM->DLL but you can even do DLL->VM through the VM environment pointer. Consider then that this approach can be really slow.

regards.
theCaller.
Clandestiny
08-10-2002, 04:19 PM
Hiya,

Originally posted by theCaller
4. To me java app is a regular exe calling java routines. Am I correct?

Definitely not, a java app is a collection of (bytecode) classes loaded up into a process that is the Java VM and by it executed.

As theCaller said, a java app is NOT a regular .exe as it is controlled and executed by the java virtual machine. Nevertheless, it might be worth mentioning from a reversing perspective that one can potentially attack the native implementation of java on a specific platform. I mean, on the x86 architecture, everything must eventually resolve down to the good ol' ASM that we know and love, eh? In the case of win32, this is the msjava.dll, fully disassemblable, patchable, and attackable in softICE ;) Msjava.dll, for example, is responsible for loading classes into the Java virtual machine and some of the security checks verifying the integrity of class files. At one point, I "unpacked" a Java app by using SoftICE and patching the class loader API in MsJava.dll to dump all of the decrypted class files to disk. It was pretty interesting to disassmble msjava.dll, look at its exported functions, and realize java can be just as vulnerable to SoftICE on a low level as the next protection... ;) At that point, I couldn't write a line of Java code to save my life... Just putting my 2 cents in that there may be creative alternatives if you know ASM, but don't know Java programming very well. :D

Cheers,
Clandestiny
theCaller
08-17-2002, 09:28 PM
:D eheheheh


Deskey api guide ????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Deskey api guide ????
PDA

View Full Version : Deskey api guide ????

hack3r2k
08-05-2002, 07:53 AM
Hey !

I have problems finding an updated deskey api guide ... can somebody help me ???

On CrackZ site i found some api guides but they don't contain anything about 'DK2SendAndReceive' . Anyway will be enough if someone could explain me how that api is working....

best regards,
.:hack3r2k:.


Armadillo protected target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Armadillo protected target
PDA

View Full Version : Armadillo protected target

Artifex
08-06-2002, 09:23 AM
Target (version 4.02) is at :
h**p://www.iopus.com/password_recovery.htm

There is no problem to register it with Softice (or with the keygenerator available on the Web).

My problem is to disable the Armadillo two anti-Softice protections. With Icedump on there is no problem, but I would like to run the prog without having to mask Softice's presence.

The two Softice detections are:
int 3 at cs:00a1e7fe
int 68 at cs:00a1eb7d

One way is to dump the target. i tried (OEP is at 410a5e) but I failed restoring the IAT eventhough I read pertinent messages.

Second way could be to patch the Armadillo, but adresses a1e7fe and a1eb7d seem to be in a crypted or packed part, and I could not access to them (except live in Softice).

TIA for informations.
Artifex
Armkiller
08-07-2002, 07:33 PM
1. Download ArmKiller
http://www.woodmann.net/protools/files/unpackers/armkiller.zip

2. Run it and wait for the second messagebox.

3. Don't close that messagebox, run imprec and restore the IT:
Import Table RVA - 2c000 Size - 594 OEP - 10a5e
Write the IT to dump.exe

4. Fix the dump.exe to Full version
RVA 7e34 : sete al -> mov al,1 + nop

5. Compress the final EXE by ASPack (UPX can't compress it)
if it doesn't work.

That's all.
Artifex
08-07-2002, 08:33 PM
Hi, Armkiller, and many thanks for the informations.

Artifex
al3x
08-22-2002, 05:28 AM
Hi ArmKiller,

Tried your techique on BearShare 4.0.2 (all PE scanners identified as Armadillo 2+) - no luck. last ArmKiller doesn't do no dumps to disk (win2000) -seems like EIP guessed wrong in that case cause Imprec in auto mode can't resolve 4 pointers - against 17 with ofered OEP - could you please check how it works with bearshare?
armkiller2002
08-23-2002, 07:38 AM
Originally posted by al3x
Hi ArmKiller,

Tried your techique on BearShare 4.0.2 (all PE scanners identified as Armadillo 2+) - no luck. last ArmKiller doesn't do no dumps to disk (win2000) -seems like EIP guessed wrong in that case cause Imprec in auto mode can't resolve 4 pointers - against 17 with ofered OEP - could you please check how it works with bearshare?

OK. I'll check it soon.
armkiller2002
08-23-2002, 07:16 PM
Originally posted by al3x
Hi ArmKiller,

Tried your techique on BearShare 4.0.2 (all PE scanners identified as Armadillo 2+) - no luck. last ArmKiller doesn't do no dumps to disk (win2000) -seems like EIP guessed wrong in that case cause Imprec in auto mode can't resolve 4 pointers - against 17 with ofered OEP - could you please check how it works with bearshare?

Use the latests build 4, it works fine:

hxxp://unpacker.narod.ru

Parameters for BearShare 4.0.2 Import Table.
RVA 00183000 Size 00000928


another asprotect newbie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > another asprotect newbie
PDA

View Full Version : another asprotect newbie

prejker
08-06-2002, 03:54 PM
the program can be downloaded here:
h**p://www.vknoware.com

i have done everything like in splaj's tuts but i can't get to the OEP. :( the last ret addr in the API cluster is 1211219. i've found the popad and jmp eax instructions at addr 12262e9
i did a bpr 12262e9 12262e9+1 (+3 also) r if eip == 12262e9
and SI doesn't popup :(

peid says it is aspr 1.2 [new strain]

and in the API cluster...there is no code like the one bellow:

[...]
0187:00F1C802 E8DD7BFFFF CALL KERNEL32!GetCurrentProcessId
0187:00F1C807 A3E035F200 MOV [00F235E0],EAX
0187:00F1C80C E8C37BFFFF CALL KERNEL32!GetCommandLineA
0187:00F1C811 A37836F200 MOV [00F23678],EAX
0187:00F1C816 C3 RET

instead there is some SMC and it jumps to those APIs with jmp

can someone give me some tips on unpackin it?
prejker
08-06-2002, 03:59 PM
here is a screendump...maybe i'm in the wrong place :)
prejker
08-06-2002, 05:18 PM
ehhh sorry my mistake... this proggie is named Advanced Log Analyzer v1.2
nikolatesla20
08-06-2002, 05:52 PM
Hello,

This program appears to be written in Delphi 5, DeDe (Delphi disassembler ) can get the OEP for you.

For me it says its 0051A8A4. In SI this appears correct.

If you have Windows 98, use SuperBPM to protect your bpm's , and do a bpm X on that address and run again, lock it up (a eip <enter>, jmp eip <enter><enter again>) and then get out of SI and dump the puppy with ProcDump. Dont forget to change back the bytes you just modified in the dumped file before continuing.

In Win2K or XP you can use Revirgin's tracer to get to the OEP and then dump it. YOu won't need to lock it up if you do it that way.

-nt20
prejker
08-06-2002, 09:40 PM
ok tnx for the tips.. i've dumped the exe with lordpe but now i can't fix the IAT.. :(

in RV:
oep: 00401000
rva: 001201A4
length: 000007EC

20 001201F4 00B10EE8 0000 ?????? to_Resolve
when i do "u b10ee8" i see only INVALID in SI

i have attached my resolved.txt file

anybody knows what to do?
tnx
foxthree
08-07-2002, 01:20 PM
There is nothing new in this AsPR. Just look for Kayakers' fantastic writeup on BPFTP Server (I think or G6 FTP Server) ...

Signed,
-- FoxThree
hobferret
08-13-2002, 01:00 PM
come on prejker - it's only 5am here and im awake enuf to see wot yr doin wrong!!

Get into the proggie do a dd 5201f4 and you will see 01210ee8 - just u 01210ee8 and open "sus ojos" you will see what you need there!

In goin back to sleep you try to wake up and you will get yr answer:cool:
magistral
08-21-2002, 02:04 PM
I was able to resolve *ALL* api's combining rv/imprec both vers 1.3.
My problem is that the exe don't run (just exit clean, not a windows error). The OEP for me is 519a30.
I guess is some aspr tricks coz the app looks for some value in and check for 0.
Look:

015F:00519A30 55 PUSH EBP 
015F:00519A31 8BEC MOV EBP,ESP
015F:00519A33 83C4F4 ADD ESP,-0C
015F:00519A36 53 PUSH EBX
015F:00519A37 56 PUSH ESI
015F:00519A38 8945FC MOV [EBP-04],EAX
015F:00519A3B 8B45FC MOV EAX,[EBP-04]
015F:00519A3E 80B89C07000000 CMP BYTE PTR [EAX+0000079C],00
015F:00519A45 0F85DB010000 JNZ 00519C26

the last JNZ exits the app.

if i force the JNZ to no jump, the app hangs up in just those mov eax:
015F:004F9917 8B4304 MOV EAX,[EBX+04]

any tips?, thanks and greets.
Stone()
08-21-2002, 05:43 PM
Working OEP is 0051A8A4. change it with LordPE, if it still not runs, then you've got some Imports wrong.

I gave it a quick look and could make it working, also crack is easy: 90 90 twice at the right address and you're all set up.
magistral
08-21-2002, 11:16 PM
yes, i'm having problems in finding the right OEP.

i cannot find the signature 61,ff,e0 with softice (s 30:0 l ffffffff 61,ff,e0).

the aspr version im dealing with is aspr 1.2[New Strain] (that says peid 0.8).

so, i've try to find the OEP with foxthree's OEPfinder. i set a bpx on getversion, the second time sice pops up i make a "jmp eip" and then i run OEPfinder, and i fin the signature 61,ff,e0. (all runs give a different address). Then i set a bpm <address> and of course i use SuperBPM, but i cannot breakpoint on it.

so, i try the OEP resolver from peid 0.8, and gave me 519a30, but sice doesnt popup when i bpm it.
magistral
08-21-2002, 11:20 PM
btw, those OEP wont run either.
Can u post the rebuilded IAT u make?.

thanks.
hobgoblin
08-22-2002, 02:12 PM
Hi magistral,
This may seem like a funny question, but did you try a breakpoint like this: bpmb <address> x

This works for me everytime taken that I have Superbpm running. I was on WinME when I unpacked it, and I found the OEP to be=51A8A4
IT address=5201A1
IT size=7EC

I unpacked it yesterday, and it runs like a dream after resolving the redirected import api's. I found 10 unresolved api's, and they are (after resolving them):
20 Getprocaddress
21 Getmodulehandlea
25 Getcommandlinea
62 Getmodulehandlea
90 Lockresource
105 Getversion
112 Getprocaddress
113 Getmodulehandlea
126 GetcurrentprocessId
128 Freeresource

Hope this helps,
hobgoblin


Still wondering...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Still wondering...
PDA

View Full Version : Still wondering...

fjrp2
08-06-2002, 03:55 PM
Can you tell me of any REAL reason to use Numega´s SoftIce instead of an easier debugger?
esther
08-06-2002, 04:40 PM
Hi fjrp2,

I have no reason.Use what is handly to you :p

edited:
I use softice coz a couple years ago there are only cracking tutes
uses softice.I am use to it and lazy to change :D
You guys are funny :D :D
fjrp2
08-06-2002, 04:56 PM
Okay, thanks for being so quick, the thing is that I've never used SoftIce, but after giving a look to The Owl´s icedump, I'm seriously considering it.
Now I need Sice as a "booter" or starter for icedump, will I still have to register with NuMega (I wish I could pay the $ instead to the icedump team)?

So, that´s my question.

I know I´ve been a little too much nasty these last weeks, but it's because I wanted to see how you react.

Now, I give my apologies to all those that I insulted. and my sincere 'chapeu' to The Owl for his grate icedump, and big thanx to DakienDX for letting me use his avatar.
cyberheg
08-06-2002, 05:52 PM
With complexity comes power. If your "easy" debugger can do what you need then thats fine for you. I've experienced that many application level debuggers reach their limits in number of features far before Softice would.
And ofcourse if you know how to handle this you can solve your problems much faster.
Unlike most here I've actually enjoyed using Softice when doing my own programming. I've tracked down plenty of pointer errors much faster then I would have been able to with the MS VC++ debugger.
fjrp2
08-06-2002, 06:48 PM
Thanx. I´m very familiar with many debuggers, not SoftIce yet.
I think one of this days (if esther explains me...)
naides
08-06-2002, 08:37 PM
Originally posted by fjrp2
Now I need Sice as a "booter" or starter for icedump, will I still have to register with NuMega (I wish I could pay the $ instead to the icedump team)?

I am sure you can find some version of Sice and use it as an extended demo app.
Lbolt99
08-07-2002, 03:06 AM
Originally posted by fjrp2
Can you tell me of any REAL reason to use Numega´s SoftIce instead of an easier debugger?

/tracex :D
Kayaker
08-07-2002, 03:52 AM
lol, /TETRIS ?
nikolatesla20
08-07-2002, 05:45 PM
hahah last time I tried /tetris, when I went to exit it blue screened me and rebooted my machine....

:D
fjrp2
08-09-2002, 06:43 PM
Well, I like the MP3 stuff (with sources... :) )


can't find out the key validation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > can't find out the key validation
PDA

View Full Version : can't find out the key validation

hambam
08-06-2002, 04:51 PM
Hi!

First of all, I'm a newbie. And english is not really a strength of mine. So I hope, you spend a little patience.

I'm trying to crack a little proggy called tcsync.exe (w*w.tcsync.com). Really not a big one. I thought this could be a good start for me.

For the normal registration procedure,
I have to enter the registration number, which is tested and then written to the registry.
On every start, the program reads this registry-entry and shows unregistered or even not.

I've used w32dasm and found the place where the entered key is evaluated. (search for 'sorry ...')
I've nop'd the je-jump and now the program says 'thanks for registering' at all entries.
But I can't find the registration check at the program start.

Could you give me a hint, how I could find where the registration-key is read and checked from the registry?

Thanks in advance,

hambam
hambam
08-08-2002, 08:17 PM
perhaps, my question was a little bit difficult to understand what i want to?

I enter a serial number (what ever i want: 1234 or what ever)
and the program says 'thanks for registering' .
After that the 'Press to register' button disappears and the program heavy looks regged now.
So far, as i quit and restart the program, anything like before.

The entered serial code (1234) is written to the registry.
I believe, on every start, the program checks the serial from the registry again, but i can't find the location.

Could ever somewhere give me a hint, how to find it out, or where the code is located?

Thx in advance!
serkul
08-08-2002, 08:43 PM
try setting breakpoints on registry api functions like
RegQueryValueExA or RegCreateKeyExa
GodsJiva
08-09-2002, 05:15 AM
This is quite a nice little target, and actually links in with ZaiRoN's floating point crackme/keygenme.

From a patching point of view, i suggest you scroll up slightly ;)

The actual serial verification is done in a separate call, which then returns success/not in eax. A rather large hint is call [ecx+34]. This is rather annoying, as you cant simply trace through to see where it is in the deadlisting, but as youre simply cracking it, why not try looking at other occurances of "call [ecx+34]" and see where u get from there.

That's probably too much help, but hey.

Keygenning it is *much* more fun. And I'm saying that at 5:15am, so don't argue. Ok, its not actually that hard, but as with ZaiRoN's crackme its unusual simply because it uses (exclusively in fact) floating point commands. An excellent debugger to use for this (I found out, cos I couldnt be bothered to reboot to get softice working) is OllyDbg. If you've done ZaiRoN's crackme, and want a real-life routine with fp commands in, take a look at this. A little bit of maths needed too ;)

After that, of course, look at my keygenme (hopefully still on the board, otherwise at h**p://www.crackmes.de under GodsJiva). It uses quite a lot of fp mixed in with some other fun stuff (and no, you *dont* need to bruteforce md5). Still noone has done it, so this is my plug ;)
hambam
08-09-2002, 04:47 PM
hmm, it isn't going one step further.

I didn't understand why the call [ecx+34] could be the sub for testing the serial.
But I believe in you. ;)
I found 8 occurences and tried to understand what has been done before this call, but ... looks like it's a little bit too difficult for a very first try?

My very first and easy try was to nop
:00430D80 0F8407010000 je 00430E8D

and the result was turning the prog regged, just as long as it runs.

So my conclusion was, that the prog turns to be regged _after_ the 'succesful'-message. When it is a sub, it must be called 2 times, or not?
If it isn't a sub, the code must be found twice. Am i right?

I wasn't able to find your keygenme nor ZaiRoN's floating point crackme/keygenme. So no support from this direction. :(
ZaiRoN
08-09-2002, 05:56 PM
hi hambam,
I wasn't able to find your keygenme nor ZaiRoN's floating point crackme/keygenme
look at this threads in the mini project area:
h**p://www.woodmann.net/forum/showthread.php?threadid=2475
h**p://www.woodmann.net/forum/showthread.php?threadid=3555

regards,
ZaiRoN
GodsJiva
08-09-2002, 06:33 PM
Well I suck at teaching ppl, and dropping hints will prolly do no good if you can't even find ZaiRoN's crackme.

Go to the main page, go to Mini Project Area, top thread (at the mo, may be a lower one by time u read this). Or just follow his links ;)

So I'll do it pretty much for you, but explain it along the way.

Load up OllyDbg (from protools.cjb.net , its free!). Load tcsync.exe. Goto debugging options and disable breaking on exceptions (loads of fp exceptions in this). That's whats stopping you debugging it in w32dasm if you'd tried.

This is my spectacularly lazy way of doing it (if I were going to crack it and not keygen it). But its prolly the easiest to follow.

You've already seen the bad boy jump at 430d80. Look at what its comparing. Get the dump to look at that mem location. Scroll up quite a way, till u think it doesnt look like registration relevant bits. Place a breakpoint (f2). Go to register and put in anything, click ok. When it breaks, stick something random in that memory location using the edit function (select the bytes by click/dragging, then right click and choose edit). Trace using f8. See where it gets turned to zero.

You will (hopefully) find that the last time it gets put to zero happens when you f8 over 430d44, that call [ecx+34] command. So, lets trace *into* it. Place a breakpoint, redo the registration thing, when it breaks, trace in by pressing f7. You will end up at 442470. Look at 4425dc (or around there). The result that gets put in there comes from another memory location. So lets bpx the start of this proc (442470), do the registration again, and start tracing (at this point you may want to try restarting the program with this bp set, you will notice it doesnt break so chances are the main check is another subcall (or the proc is repeated somewhere else, but its not, so forget that for this app)).

[note: from now on, exact offsets hidden so as not to be a simple crack]

If you trace through, you will find the right call is at 4*****. Trace into this, as before, and you end up at 4*****. Breakpoint this and restart the program, and bang, it breaks. So looks like this is the main check. Forget the actual routine, we're (well, you) aren't interested in that. Look at 4*****, near the end of the proc. Its the final check :) but just patching that won't do (probably), because the subsequent bit relies on eax. So lets patch the bit at 4*****.

5E POP ESI
66:8901 MOV WORD PTR DS:[ECX],AX

...is the code there at the moment. 4***** loads the mem address of the bit we dont want to be 0, else regged=false. So we need to change something so that before that command at 4*****, eax (or ax) is not 0. I leave that to you, with some final hints: xor eax,eax makes eax 0 (in case u didnt know). eax can be anything other than 0 (probably), but you cant rely on it not being 0 before this (or can you? I didn't by nature, but try seeing yourself). the easiest (shortest) way to change a register is the command inc (for increase). and finally, the command 8901 is the same as 668901. (that 66 can be replaced by a 1 byte op in other words).

You can take a horse to water and stuff its head in it, but...

"If it isn't a sub, the code must be found twice. Am i right?"
There are very few hard and fast rules in cracking, because different coders and compilers do things in different ways, and do basically what the hell they like. The best way to crack imho is to *understand* and work out (by testing or whatever) what is going on, and reason what needs to be done.

Have fun,
hambam
08-12-2002, 06:56 AM
Oh yes, it's really an easy way with this fine proggy OllyDbg.

So I've found the subcall at 443520 which breaks at program start too.

And '40 inc eax' is the easiest way to patch 44366C.

But to be honest, without your aid ....
(not only because of OllyDbg :) )

Thx
GodsJiva
08-12-2002, 07:33 PM
No problem.

Hopefully by following the method youve started to understand what happens in programs, rather than just looking for jumps near string refs ;)

Glad you like OllyDbg, I do too. Not great for everything, but still useful :D

Happy reversing!


Photobrush
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Photobrush
PDA

View Full Version : Photobrush

DiMX
08-06-2002, 07:41 PM
I started RCE a few weeks ago, I cracked Winzip and am now trying to do the same for Photobrush..

The version has a 30 day limit and this was passed. I use W32Dasm and searched for *days left*.. after some searching I found an JLE on offset 00065871, when I changed it to EB, JMP

this is how it looks now:

:00465867 81BE54010000000F0000 cmp dword ptr [esi+00000154], 00000F00
:00465871 EB0A jmp 0046587D
:00465873 6A00 push 00000000
:00465875 8D4E5C lea ecx, dword ptr [esi+5C]
:00465878 E8067F0700 call 004DD783

the continue button to start the program was available again but when I click it nothing happens.. I tried searching for the system timer but I thats how i ended up beeing over my trial period.

Does any1 have some tips ?
nikolatesla20
08-06-2002, 07:52 PM
Well, the program is exiting when you don't want it to - there are a couple of things to look at.

One way is to use SoftIce and put a bpx on ExitProcess and then try to find the call that caused the ExitProcess. This technique works pretty well because you can trace it back to the offending instruction (usually), but you have to be familiar with how to walk the stack to use it - there is no F12 (ret) ability with ExitProcess *grin*

Another way is to try and find out if that memory variable that is being compared in the code you show, is being compared anywhere else. Maybe there is more than one check , for example.

If you have SoftIce, let the program run but put a bpx on that compare line. When you get to it, stick the value that's it's comparing it with (put in a value that would change the bad jump to a good jump) into the mem location the CMP refers to, and then let the program continue to see if it keeps running. If it does, then that mem location is being referenced again. If you find that to be true, you can create a jump or call to an inline patch that just does a MOV instruction to move a good value into [esi + whatever], and then comes back.

That's all I can think of for now I guess.

-nt20
DiMX
08-06-2002, 08:17 PM
I havent got softice but if its neccasery to have it, ill get it.

I tried to find other of that variables that could be compared, what i get now is that when I press the continue button it exits just like u said... guess Ill have to search some more than.

thx
foxthree
08-07-2002, 07:49 AM
Fellow RCEs:

There has been a recent interest in apps that quit all of a sudden when 30 days are over or what ever *without any nags*

I present below a generic attack technique.. Many of you may know all this, but for n00bs... :)

1. Most apps exit using ExitProcess or FatalExit or something like that.
2. If you put a bpx on that API it would be of no help as Tesla said as there is no F12 (p RET) on ExitProcess or FatalExit
3. So, instead of bpx do a BPMB. That way you get in SoftICE the address which caused this break.
4. Now bpmb on that and so on until you see the familiar CMP blah1, blah2 and all is well :)

Hope this helps a bit.

Signed,
-- FoxThree


Primality testing *is* in P - Proof
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Primality testing *is* in P - Proof
PDA

View Full Version : Primality testing *is* in P - Proof

GodsJiva
08-06-2002, 11:10 PM
For those who understand the topic:

h**p://www.cse.iitk.ac.in/primality.pdf
Thigo
08-12-2002, 12:39 PM
Interesting... the algo is really simple.
But unfortunately this is not of great use for us crypto freaks since randomized algos are faster on the number we use but this will help a lot the guys who are looking for the biggest primes :)
cyberheg
08-17-2002, 02:15 PM
I wonder why you say that Thigo?

From my understanding it should give a higher probability of determining if a number is a prime so you can allways start with using the allready existing algorithms and then end it off with this one. I think it's useful for any use to give more accurate results but maybe you can give a reason why you think otherwise?

I'm allready waiting to see first pratical implementations but maybe thats too soon yet.

// CyberHeg
dx50azlm
09-11-2002, 07:07 AM
I still like probablistic algorithms because if you run them for 20 or so iterations (assuming CPU cycles are cheap these days), an error of 1/(2^1000000) is so close to zero, it might as well be zero :) The ECPP test is one such test that works like this, but I'm very interested in the new polytime algorithm by Agrawal, Kayal and Saxena (the authors of the paper from the first post).

Their result lies on using Fermat's Little Theorem. A quick rundown of the proof is at

h**p://w*w.utm.edu/research/primes/prove/prove4_3.ht*l


how to cr@ck a pocket pc application?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to cr@ck a pocket pc application?
PDA

View Full Version : how to cr@ck a pocket pc application?

hambam
08-07-2002, 09:30 AM
Hi,

does anyone knows how to cr@ck an app for a pocket pc?

Perhaps a proggy like w32dasm?

I wanna remove the trial limitatons for some apps like gsm manager, ia style phone manager or games like lemonade inc.

thx
TBD
08-07-2002, 09:52 AM
da one and only IDA Pro (regged of course) ...
very easy ... 99% use jnz bad_guy, 80% of them
are 1 byte crack

or you can use disassembler from eVT (downloadable
from Micro$oft) ... there is an essay on tsehp pages
on how to do it

have phun,
TBD
hambam
08-07-2002, 01:16 PM
Thx for your answer, but shit, I can't find any demo version, the official site refuses a download because of the updating process for all registred owners.

Does anyone knows a location for the demo/trial/free or what ever version?

(I've tried searching this forum, google, and of course searchlores.org, too)

thx in advance
hambam
08-07-2002, 04:22 PM
Hello again,

finally i found an older version (4.15) (regged) but i can't open any of my exe files.

the dialogbox shows me
'load as portable executable for ARM(PE) [pe.ldw]' and Processor type: metapc

But after clicking the ok button a message box appears: 'can not set target processor type 'arm' and the program quits.

The loaded exe file is for a Ipaq StrongARM.

Where is my fault? Perhaps the program version of IDA Pro isn't regged correctly?

:confused:
TBD
08-08-2002, 06:36 AM
there is somewhere a 4.04 regged version (Colton),
your 4.15 it's only patched to look like regged
(it doesnt have ARM code inside)

for start you can look on fravia+ ipaq page for some
good information (mostly all you need) and use my
IDA script for MFCCE300.DLL based programs :)

http://www.searchlores.org/fravia/personalia/ipaq.htm

hope it helps,
TBD
Athlon
08-08-2002, 06:54 AM
hambam PM Me
hambam
08-08-2002, 08:57 AM
thx, for your answer,
as i thought, the proggy is regged but there are a couple of files missing.

I've found your given url very interesting.
If I ever be able to open a file with IDA ;)

would it be a prob if you would tell me a source for the missing files?


Unpacked Asprotect filed doesn't run on other machine..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacked Asprotect filed doesn't run on other machine..
PDA

View Full Version : Unpacked Asprotect filed doesn't run on other machine..

laxw
08-07-2002, 03:32 PM
The packed file is identified by PEID 0.8 as:
[ASProtect 1.2x / ASProtect 1.3 -> Alexey Solodovnikov]

I unpacked it with ImpREC and runs fine on my machine. But it just doesn't run on anyone else's system.

I dug in several tutorials for days and fixed the redirected-API shit. But in one tutorial by NchantA mentions that ASPR also bypasses the IAT by jumping directly to APIs' addresses. I am supposed to find out the IAT and fill it in in impREC, which can be done by pressing F8 until I see a jmp table.

well.. I pressed F8 for liked 2 hours and didn't see any thing like that.

Can anyone please give me a hint on this?
Lbolt99
08-07-2002, 04:54 PM
Originally posted by laxw
The packed file is identified by PEID 0.8 as:
[ASProtect 1.2x / ASProtect 1.3 -> Alexey Solodovnikov]

I unpacked it with ImpREC and runs fine on my machine. But it just doesn't run on anyone else's system.

I dug in several tutorials for days and fixed the redirected-API shit. But in one tutorial by NchantA mentions that ASPR also bypasses the IAT by jumping directly to APIs' addresses. I am supposed to find out the IAT and fill it in in impREC, which can be done by pressing F8 until I see a jmp table.

well.. I pressed F8 for liked 2 hours and didn't see any thing like that.

Can anyone please give me a hint on this?

You should check out Revirgin. I haven't had much luck with Imprec. RV is much easier to use, understand, and have used it to rebuild numerous ASPR and vbox apps with no problems, W2k and everything.

You probably want to use RV to rebuild the import table and LordPE to dump the executable.
peti
08-08-2002, 09:50 AM
If ya rebuilded your exe under xp/2k that is the problem try to
rebuild under 98 with renormalize importz option and this will work on all win.

ImpRec ownz
laxw
08-08-2002, 03:35 PM
hey thanks you all.

I got it solved as peti suggested. Plus I also need to check [Create New IAT] in the Options of impREC. Unpacked exe generated under XP just doesn't run on 98.

well.. guess it's all MS needs to blame. ;p
Stone()
09-14-2002, 02:38 PM
Must revitalize this matter:

I unpacked an Asprotected app written in Borland C
the OEP therefore is 401000 usual EB 10 as entry point.

Unpacked under XP and dumped with LordPE. Imports resolved after having increased IAT size, fixed all Imports. App runs fine.

Boot with W2K does not run. Boot with ME, crashes.

Ok, save import table and make 3 dumps for each OS, then fix it.
Runs only on the OS I dumped it. It depends clearly of the dump as I can take a dump made on ME and fix it on XP. It will only run on ME.

Dump was made as usual, found OEP 401000, locked app and dumped it. Someone can illuminate me with some hints? I'm really puzzled.
evaluator
09-14-2002, 08:27 PM
MAINLY you have truble because of NOT-renormalized Imports.

OK?

So if you will check each import-name when it decrypted,
you will find difference with resolved.

So if you NEED MULTI-OS runable dump, you should be sure about
each Import-name. (be proffy unpakcer:)
Stone()
09-15-2002, 09:55 AM
Sorry, I double checked all Import names and I'm sure that they're correct. I also used both RV & Imprec to fix the dumps.

However when I've a running fixed app on my OS, then when I put it on another machine with the same OS it crashes.

This however could be fixed by nopping a call which seemed to me an asp call. So maybe I've to find some other calls to fix for make it run on all OS's.
evaluator
09-15-2002, 11:01 AM
mm..
Now last step can be: you tell me what app, url etc.
Stone()
09-15-2002, 05:46 PM
Go to the following and get notepro or/and clipplus

www.crystaloffice.com

I'm really goin' insane on this question.

I've unpacked and fixed dozens and dozens of Asprotected apps, but this is the fist time I've seen something like this happening.

:mad:
evaluator
09-15-2002, 08:03 PM
I think, you miss at address 64D0A8 direct aspr-module check in memory.

Debug it. (notepro)
Stone()
09-16-2002, 10:12 AM
I know about this call and noped it

0041430B . A1 A8D06400 MOV EAX,DWORD PTR DS:[64D0A8]
00414310 . E8 17CC1E00 CALL dump_OEP.00600F2C

but then the dumped file runs on another system, but only with the same 0S, it still does not run on W2K or ME.

Debugged it, but didn't find any other asp call.
evaluator
09-16-2002, 01:08 PM
Simulate it
Stone()
09-16-2002, 06:06 PM
Resolved. Was a relocation problem. Now it runs everywhere.

Thanks for your help in any case.


floating point crackme challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > floating point crackme challenge
PDA

View Full Version : floating point crackme challenge

ZaiRoN
08-07-2002, 07:17 PM
hi all!

what about a floating point crackme?
i think this could be an interesting project and someone could learn something new :)

some info about the crackme:
the crackme is definitly easy and works with simple instructions in order to make you familiarize with this new *world*.
you should reverse the algo and find a valid name/serial combination; a keygen is gladly accepted ;)
this is my first fpu based proggie so if you'll find bug(s) or something else let me know!

how to deal with floating point crackme?
basically there's no difference from other crackme...you have to step throught the code :)
it's important to take a look at the floating point stack.
for softice users:
enable the floating point stack window using the command 'wf' and switch the data window representation using shift-F3 for long real numbers.
for olly users:
the floating point stack is just in front of you, you only need to change the data representation (float - 64 bit double)

hmmm...fpu !?! what is this?
i'm not the right person in order to explain these things, so for those that had never seen (or heard) 'floating-point-unit' words before, i would like to suggest some nice readings:
- chapther 14 from 'art of assembly':
cs.smith.edu/~thiebaut/ArtOfAssembly/artofasm.html
- from intel:
intel.com/design/intarch/techinfo/Pentium/fpu.htm
- a couple of basic tutorials:
redbrick.dcu.ie/~eoin/fpu1.htm
redbrick.dcu.ie/~eoin/fpu2.htm

ok, that's all! i'm here for any question(s).

good luck,
ZaiRoN
GodsJiva
08-09-2002, 05:19 AM
How bizarre, a program in the Newbies forum also uses fp in its routine. The guy's (gal?) trying to patch it, but take a look if you want a real-life routine (of similar complexity really, maybe even less, to ZaiRoN's crackme) using fp.

h**p://www.woodmann.net/forum/showthread.php?postid=19092 is the thread.

Then try my keygenme! Using floating point commands ages ago ;)
nikolatesla20
08-09-2002, 04:50 PM
GodsJiva, I was working on your keygenme for a while, ugh I got sick of it :p

I was able to rip your code and reproduce your routines using it, I tried to bruteforce some but it ( at least the first 8 serial chars) was taking forever so I forgot about it for now.

I do know this:

Serial is ALWAYS 16 chars, no matter what. This is because of one of the checks described below.

Copy name string
Scan name string, subtract 20h from each character in place.
Do calculations on every two characters, store results in ecx word ptrs.
Do floating point calculation, multiplying all three name calc blox together.

Once that is done, do similar with Serial text.

ONE BIG CHECK is : Calculated code serial block 6 ( last 3 chars of serial) must match calculated code name block 1 (first 3 chars of name). Piece of cake on that one. I even made a bruteforcer for 3 chars for it, it gets it right away, even tho the equation is:

4096x + 64y + z

for serial block 6. x, y, z are last three chars ascii code

name block 1 equation is

1024x + 16y + (z / 4)

This leaves you with 13 chars. There is some calcs being done on the first eight values of the calc serial.

After that I got bored and sick of it :p

----------------
Zairon, I have started to look at yours too but vacation is coming up soon for me and I am starting to get very annoyed at looking at code. Hmmm me feels sick now. Code is getting to me....
---------------

-nt20
GodsJiva
08-09-2002, 05:32 PM
Hehe, you did the easy bit. You dun need to express it all as equations, if you think about what the equations actually do, you can express that bit in a sentence or two. Look at the bits ;)

You didn't even see the md5 hash :D

Anyway, you shouldn't need to bruteforce it at all. It's not that type of keygenme (well it wasn't meant to be)...

Have another look, write things down, its simple once you understand whats going on.

Thanks for looking, its more than almost anyone else has :)

Maybe I made it too hard... or too long... I tried to make the code easy to follow :P Maybe time for a kgme number 2...
ZaiRoN
08-09-2002, 05:48 PM
hi!
i'm happy to see that someone is working on GodsJiva's keygenme but this is not the right thread...
if anyone wants to continue the discussion can post message(s) in this thread:
http://www.woodmann.net/forum/showthread.php?threadid=2475

thx & good luck!!!
regards,
ZaiRoN
GodsJiva
08-09-2002, 06:38 PM
Sorry ZaiRoN, kinda distracted the thread like u said :)

I think my thread is doomed, noone else ever posted there :P That's my excuse anyway ;)

Bet you'd make a good manager/teacher, hehe.

Anyway, I've had a quick look at yr crackme, if I get the time over the next few days I'll report back, sir!

Btw to all, the IA-32 Intel® Architecture Software Developer’s Manual Volume 2: Instruction Set Reference contains a lot of good info on all Intel opcodes, including fp ones. A very valuable pdf ;) 24547104.pdf is its name, its on the web somewhere (legally, its free).
ZaiRoN
08-09-2002, 07:05 PM
hi GodsJiva,
no problem! you don't have to excuse yourself :)

ciao,
ZaiRoN


armadillo 2.60(a)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > armadillo 2.60(a)?
PDA

View Full Version : armadillo 2.60(a)?

_Servil_
08-07-2002, 09:04 PM
greetings,

plz some points to unwrap the protection, as the target the
a-dillo self since is guaranted be packed with this.
The info I've found all deal with version 1.80 or older
what seems be quite obsolete for my purpose, the .tmp image is not created anymore.

What I succeed was to dump at OEP and partially restore the IT.
They must be changing import obscuring very quickly 'cause where
my imprec plugin restored whole IT on v2.60 it failed
on some in 2.60a, at least getprocaddress seems to me fully emulated
now can be true(?)

The worst is the image at oep isn't fully decrypted yet.
I've found some info the code is unpacked part by part but not
how to restore original code..

please some input to this..?.
Cyber
08-08-2002, 12:45 PM
sounds like the copymem option is on
to get round this you either need to dump each decrypted part of memory and put it all together or alter the size of the decryption routone to do it all in one go
there is plenty of info on here about it so i suggest you search :)
_Servil_
08-08-2002, 05:40 PM
hi,

as i noticed the code is continuously decrypted and encrypted back if not needed ;(, what makes the whole code is never decrypted as whole.

triggerrng the writeprocessmemory was hit on various user actions - mostly dlg. boxes. Is this the only way to get the decrypted section? How I figure out the current break is for decrypting.. and is there an easier way to know all the chunks were decrypted already than drawing a memory map manually.?

thanx
Cyber
08-08-2002, 06:05 PM
it decrypts in 200k (i think) chunks, all u have to do is fool it into decrypting thewhole process in one go

as i said, search this forum and all the info required is there

start by looking at this thread http://www.woodmann.net/forum/showthread.php?s=&threadid=3041&highlight=armadillo
crUsAdEr posted a nice piece on how to unpack 2.5x and 2.60 is the same apart from a few cosmetics :)
_Servil_
08-09-2002, 05:40 PM
cyber, got it!
thankya and yes, i should search better 1st.. supply to crussader the param to decrypt is 1 not zero.

i've written a tiny plugin that but doesn't work on NT kernel since it's tuned on win98 and can't use si on wxp.
And still not certain about getprocaddress which seems be fully substituted by dillo (?).

rgrds

_Servil_
nofurs
08-09-2002, 06:37 PM
Hi _Servil_,

I don't mean to pour cold water on you but it would be nice if you upload is source code rather than dll.Coz ppl learn nothing from
your dll.
_Servil_
08-09-2002, 07:06 PM
um no problem, but sorry, at the moment source is bit non-working after making it more clear it's screwed up ;-)

what it does is nothing more than looking fwd to call [address] or far JZ ...
following the call and searching known PUSH [api_addr] / JMP ...

as-is it could at least restore the imports, and it might detect the getprocaddr even, but maybe i've failed, tested only on few apps.

when i'll get source to working state again i will u/l
Armkiller
08-13-2002, 10:39 PM
Post the link for an application, please. I can try to explain.
_Servil_
08-14-2002, 05:23 PM
hiya, armkiller

what app did you need? the initial question was about armadillo sps self.
in fact no more i need to explain in this case, following the topic cyber spoke about, all is solved for me.
anyhow thanx -- there's never enuf knowledge...


Tutorials search
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Tutorials search
PDA

View Full Version : Tutorials search

Nigma
08-07-2002, 09:25 PM
Hi ,

Can someone tell me where can I find Spl/\j and r!sc tutorial
that mentioned in the great crUsAdEr tutorial about Asprotect ?

thanks .
nofurs
08-08-2002, 01:53 AM
hi,
http://www.dreamimpression.co.uk/r!sc/
Spl/\j's tut you an search the web ;)
Nigma
08-13-2002, 10:00 PM
Hi there ,

I am looking for splaj tut on asprotect which mentioned
in crusader's asprotect tut or other aspr tut's , do you know
some links ?

thank you very much !

(Threads Merged)
esther
08-14-2002, 01:32 AM
Hi,
Your answer is in newbies forum.Please do not cross post.

regards


Error when unpacking .exe-file ( UPX )
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Error when unpacking .exe-file ( UPX )
PDA

View Full Version : Error when unpacking .exe-file ( UPX )

spuTniK
08-08-2002, 10:50 AM
Holà, I got a problem when I tried to unpack a crackme which has been packed with UPX ( told me Language ).
I`ve tried to unpack it with UPX and ProcDump but there is always coming up SoftIce when I started the unpacked file
and tells me : "... Unhandled Exception NTSTATUS_VIOLATION ".

Thx for any help,
spuTniK
Cyber
08-08-2002, 12:39 PM
it sounds to me like it isnt a upx packed program
upx is one of the easiest to unpack but there are packers like telock which PRETEND to be other packers like upx
spuTniK
08-08-2002, 12:51 PM
[QUOTE]Originally posted by Cyber
>it sounds to me like it isnt a upx packed program
I don`t think so - I`ve had a look with hiew in it and founded:
"... This file is packed with the UPX executable packer http://upx.tsx.org...." and it is a very easy crackme ( Level 1 ;) )
so I don`t expect hard traps.
Is it possible the files ProcDump and UPX creates are not made for WinNT/2000 ?
I`m working with the Procdump Verison offered by protools
( ProcDump by G-RoM, Lorian and Stone. 18.I.2000. ).
"News:
- Updated Task/Mod init code to run correctly under NT2K.
- Fixed up an obvious bug that avoided to snapshot modules
correctly ! Thanx to Elicz for spotting this.
- Added Aspack 2000 support.
- Updated ProcDump user manual, Unpack.txt, history.txt.
... "
I`m not shure what the first point means.
Can you tell me the name of an Unpacker which is working seriously with NT ?

Thx for answering so fast,
spuTniK
Cyber
08-08-2002, 01:03 PM
To make sure 100% that its a UPX packed app just search for bytes 61 E9 in the file
the last instance should be 61 E9 xx xx xx followed by a load of 00's
if you have these then it is a UPX packed app
im not sure what works with NT but just about everything will unpack UPX
i use guw but im running Windows ME
you can unpack it manually if you stop on the jump to entry point
which is the bytes i have listed above if you are familiar with manually dumping
foxthree
08-08-2002, 01:06 PM
UPX unpaxing is damn trivial. Search for tuts on Krobar's site. As the author's put it UPX is only a compressor and not a protector. So, don't worry. It is very, very straightforward. Again, look for some tuts on Krobar's site.

Signed,
-- FoxThree

PS: You can also try PeID (hi Snaker :)) or OepFinder, if the packer UPX version is one of the latest releases....
spuTniK
08-08-2002, 07:33 PM
>Originally posted by Cyber
>To make sure 100% that its a UPX packed app just search for >bytes 61 E9 in the file
>the last instance should be 61 E9 xx xx xx followed by a load of >00's
I got U right ? :
The last lines of the disassembled code are :
61 E9 .... and serveral lines 0s ?
coz my last line code is :
:0042357F E97CDAFDFF jmp 00401000 n
followed by ~ 20 lines :
:00423584 00000000000000000000 BYTE 10 DUP(0)

you can unpack it manually if you stop on the jump to entry point
which is the bytes i have listed above if you are familiar with manually dumping
Certly not :(

Thx for your help,
spuTniK
nofurs
08-08-2002, 07:46 PM
Hiya,
>>:0042357F E97CDAFDFF jmp 00401000
bpx on this above address
type without quotes
'a eip'
<---enter
'jmp eip'
<---enter
<---enter
the program will suspend in the memory now you can dump it with
peeditor or Lord pe ;)
padspcb
08-09-2002, 02:45 AM
Trouble is that some upx compacted on win9x will not go on win nt/2k/xp
So if you have one of these, there are some fixes on the links provided by the board
Other solution is run proc dump on a win9x, if you got such a machine aviable.
best
Pads


Numega DriverStudio 2.7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Numega DriverStudio 2.7
PDA

View Full Version : Numega DriverStudio 2.7

Snatch
08-09-2002, 08:08 AM
Yes I had to be the person to raise the issue hehe. Since it has been released for a couple of weeks now. Anyway I am curious what changes people have noticed in general and for XP. And if it is worth getting, etc. Any info is appreciated.

Snatch
Snatch
09-10-2002, 08:01 AM
Resurecting old threads is fun. But anyway I just want to confirm one thing: Win XP with or without SP1 breakpoints work flawlessly. It now resolves things fine. This is one quality release from Numega. Get Softice Driversuite 2.7 you will not regret it. In fact all platforms should get it. My only question now: when will we have a new Icedump ;).

Snatch
Snatch
09-10-2002, 08:04 AM
Oy silly me.

2002.09.09 released icedump 6.026 and nticedump 1.14. added support for SoftICE 4.27 build 562, PBPM (courtesy of ^DAEMON^). this is the last public release in the foreseeable future.

known bugs:
icedump: BPINT 3 ends up in a system crash since 6.019 when an int3 with EBP='KHCB' is executed

Too bad it could be the last public release. Wonder if that means Numega isnt going to be releasing anything for a while? Anyway its ready :).

Snatch
Athlon
09-11-2002, 03:07 AM
Snatch Please Check Your PM
Woodmann
09-11-2002, 04:06 AM
This thread was edited by ME.

You got a problem with that :)

Peace, Woodmann
Athlon
09-11-2002, 04:26 AM
Naw :) just wish they would stop dissappearing :(

lol in the email notification it said JMI replied not you :confused:
JMI
09-11-2002, 05:02 AM
Athlon:

Sometimes I'm Dr. Jeckle, sometimes I'm Mr. Hyde. Why, I'm getting so good at anonymous surfing, I can even send fake email on this forum.

"Who knows what evil lurkes in the minds of men,
the Shadow do."

Regards.
Athlon
09-11-2002, 05:13 AM
*scary music* lol
SiNTAX
09-11-2002, 01:08 PM
I just installed DS2.7, but got a BSOD at startup (on WinXP).

I had installed it on an NTFS drive. Uninstalled it, then reinstalled it to a FAT32 drive (same as the one where WinXP was installed on) and then it worked.

Anyway.. it's been a loooong time since I did anything with SI, so forgot most of it (and never really did that much with it.. just used it a few times to get the feel of PC cracking.. being an old Amiga scener :) U know the kind)

So now I have this really stupid problem (almost ashamed to ask), but how do I start an .EXE again under SI control?! LOADER32 doesn't seem to break to SI, so I probably missed something (shame shame)
loman
09-11-2002, 11:03 PM
I've your same problem sintax .... dunno how to resolve it :/
SiNTAX
09-11-2002, 11:31 PM
Are we both morons? or are we missing something :D

Anyway I get around it by BPM'ing an API function.. or patching the .EXE -- but there are better ways for sure.. and I'm pretty sure it used to work in W95 with loader32.
Snatch
09-12-2002, 01:28 AM
Heh export breakpoints work at least :). Breakpoint on entry point? Who wants that? I never do hehe. I guess this function is still broken or being used improperly? We should investigate this further by disassembling loader32 and see if the breakpoint in Softice is being set properly.

Snatch
disavowed
09-13-2002, 03:35 AM
Originally posted by SiNTAX
I just installed DS2.7, but got a BSOD at startup (on WinXP).
Make sure you're allocating enough video memory in the settings. (This can definitely cause a BSOD)
Snatch
09-13-2002, 07:32 AM
disavowed: how much is enough though? I have a Quadro4 900XGL 128MB DDR and I have 1.5GB of RDRAM800 but where does that place the amount of video RAM I need for softice. Right now it is set to 2048MB. I got reboot bluescreens with 2.6 that went away with 2.7 the IRQL_NOT_LESS_OR_EQUAL only on a restart not shutdown oddly enough. Thank god its fixed ;).

Snatch
SiNTAX
09-13-2002, 08:18 AM
Originally posted by disavowed
Make sure you're allocating enough video memory in the settings. (This can definitely cause a BSOD)

Read the entire message :) The solution was in the same message.
disavowed
09-13-2002, 05:42 PM
Originally posted by SiNTAX
Read the entire message :) The solution was in the same message.

His solution was to change his file system. If other people read this thread, I'd hate for them to think that was their only option if they were getting BSOD's.

Snatch: I have a Geforce2 with 32 MB RAM. Setting the memory to 32768 KB still gave me a BSOD from SICE_VID.SYS (or whatever the KMD is that hooks into the video chain (I'm not on my home computer now, so I can't lookup the exact filename)). I bumped up the memory to 40000 KB in the Softice config, and no more BSOD
Snatch
09-14-2002, 04:07 AM
Thats interesting disavowed that you need so much when I get away with 2048kb. Guess it is very hardware dependent.

One interesting problem I have is when debugging certain games and what not since the screen mode is being changed the debugger either is invisible or shows up with messed up colors. Is there any good solution to this?
disavowed
09-14-2002, 11:53 PM
are you using the universal video driver for softice, or a video-card specific one? (i use the universal, which may be why our memory requirements are different)
Snatch
09-15-2002, 02:31 AM
I use universal too. Softice has very limited nVidia card support hehe.

Snatch
BlahK
09-15-2002, 10:29 PM
Breakpoints seem to work flawlessly for me, but skipping through back to a call(F12/P RET) doesn't seem to work at all, it just kicks me out and continue.. Anyone ideas?
I'm using XP.. :\
Snatch
09-16-2002, 08:46 AM
F12 can cause continue and rightfully so in certain instances. This happens a lot in system code. But if you are debugging an application unless you F12 out of a messagebox routine or the likes it should return properly.

Snatch
roocoon
09-18-2002, 06:04 PM
It seems it's back to the drawing board for Numega as far as it concerns NVidia chips under XP.
The 2.7 release works fine in Win2K with an NVidia GeForce2.
Under an XP system with a GeForce4 TI-4600, it's back to the dark screen.
In this case, it takes 5 seconds to do that. The monitor displays a countdown timer while it switches modes and it shouldn't do that.
A Ctrl-D takes you back to the desktop.
Softice has been set to use the Universal Driver and it passes its test. Nevertheless it doesn't seem to detect this NVidia card (it's stuck on Standard VGA) and probably that's why it tries to switch modes.
Any ideas for getting around it or do I wait for 2.8?
Thanks in advance.
Snatch
09-18-2002, 06:49 PM
Universal video mode doesnt select a manufacturer or model. Full screen mode you choose that and they only support one nVidia model there so its basically useless to try fullscreen without going standard VGA which should work. Maybe your memory setting is not enough that is most likely the problem. I have a Quadro4 900XGL(equivalent to Geforce4 but for workstations) and it works flawlessly.

Snatch
roocoon
09-18-2002, 08:40 PM
No luck yet.
If I select full screen mode, I get some distorted patterned background.
Raising the memory to 131072 (the card is 128MB) didn't make a difference either.
I suspect what the problem might be but if I'm right, I don't like the solution.
Since it works on other NVidia models, it might be dependent on reference drivers from NVidia.
The non-working system is the only one I have that uses manufacturer-modified drivers (Asus). I keep them because they have some extra 3D-glasses functionality.
I'll try the reference drivers tomorrow out of curiosity and post the results then.
Snatch
09-18-2002, 08:44 PM
I am running the Detonator 40 drivers that work very well. They are the latest and greatest just released.

Snatch
roocoon
09-20-2002, 12:27 PM
I tried with a different set of drivers.
v2.7 works under XP with the NVidia Detonators 40.41.
It seems they work fine as long as the drivers are reference ones and not manufacturer-specific.
Also, maybe somebody can verify this, v2.7 might have a small bug concerning the allocated video memory.
My card has 128MB on it and I run it at 1600x1200x32.
I set up Softice's video memory at 16MB (I tried 128MB too) and Ctrl-D into it.
I tried to save my sight and set the font=3. I also increased the number of lines to 60.
Softice refused to do that, claiming that I need to allocate around 3MB of video memory. I had 16MB.
I dropped the allocation to 8MB, tried again, and it worked.
It looks like it has some sort of upper limit on this and defaults to 2MB (maybe 1MB) if the specified value is over that upper limit.
Snatch
09-20-2002, 03:14 PM
Yes I have noticed that video memory and Softice have never been to consistant or explainable. I am at 2048kb of memory when I am at 1280x1024x32 and I can use 60 lines fine. I have no idea whats making all that happen. nVidia will release new Detonator 40 drivers soon so look out apparently 40.41 has some issues that cause games like UT2003 to not work to top performance ;).

Snatch


Windows XP driver internals...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Windows XP driver internals...
PDA

View Full Version : Windows XP driver internals...

Snatch
08-09-2002, 08:16 AM
Recently I had an old generic text printer that would work fine on 98 and not XP. After doing lots of internal checking I found that the printer is at fault and its returning offline/busy/no errors instead of online/busy/no errors. I will resolder the board later. But there does seem to be a mysterious flag thats tested that also fixes the problem. Inside parport.sys, there is reference to:
mov eax, 1;
cmp eax, DS:0FFDF02C0;
Now this is in the _SppWrite routine I found that out through symbols but help! What is this value it is always compared with 1. Why is it an absolute address that is not in the VA space of the sys itself. How can I figure out what it is. I made Softice System debugger and had it bpmd for writes to that address in the init string. Well no dice still. And theres a good chance it may be hardware setting. But its at an absolute address. I dont understand how a sys file can reference something like that. Its also referenced in HAL.DLL and NTOSKRNL.EXE. You guys are the experts so I was wondering if you could guide me in the right direction here or perhaps you know what this value means. Any help would be much appreciated even though it might not be the right fix...it has sure sparked my curiousity.

Snatch
VoxQuietis
08-16-2002, 05:30 PM
Hi Snatch,

I think You found a reference to either a static variable within the kernel mode driver of that printer, or to a hardware register, which is mapped by the driver into the virtual address room of NT/2k/XP.

For reference I'd advise You to read the book 'NT device driver development' by Viscarola and Mason. It explains quite in detail how the mapping of the different address ranges is implemented in NT.

The functions related to the mapping of IO buffers is described in chapter 1.4.4 Address Mappings and MDLs into the Win2k DDK, the same should apply to XP. W.r.t. the hardware resources one might start from the description of the PnP manager.

Concerning the fact, that there is an absolute reference to the register/memory address (whichever it is :-) I am not very surprised. Isn't there something very similar to relocation off DLLs when device drivers are started. I.d. I would expect the OS to replace all the relative addresses to the correct absolute ones when the driver is loaded.

I am shure, that this board isn't the optimum place to ask this question. There are usenet news groups, which are specialised in NT/2k/XP driver development, and I guess there You would receive more concise explanation.

Best regards,
- Vox.
Snatch
08-17-2002, 04:37 AM
Well I figured it out. Thanks to ordering the Windows DDK from Microsoft. The file ntddk.h contains:

#define KI_USER_SHARED_DATA 0xffdf0000
#define SharedUserData ((KUSER_SHARED_DATA * const) KI_USER_SHARED_DATA)

It actually is an absolute memory address suprisingly. KUSER_SHARED_DATA is a structure in memory at that address. Thus problem solved thanks much tough.

Snatch
Snatch
08-17-2002, 05:52 AM
It specifically points to this enum in the structure:

//
// Alternative system architecture. Example: NEC PC98xx on x86
//

ALTERNATIVE_ARCHITECTURE_TYPE AlternativeArchitecture;

typedef enum _ALTERNATIVE_ARCHITECTURE_TYPE {
StandardDesign, // None == 0 == standard design
NEC98x86, // NEC PC98xx series on X86
EndAlternatives // past end of known alternatives
} ALTERNATIVE_ARCHITECTURE_TYPE;

So somehow making the processor think it was an NEC PC98xx series made my printer work. Anyway I have taken the printer apart desoldered the chip and rejumpered it the problem was the printer was designed wrong and returned busy instead of busy and online like most printers (0x8 instead of 0x18). This caused the printer to try to recapture the port hence 1 character per second printer. Thanks for the help. Good old Win DDK can solve miracles sometimes.

Snatch


manual unpacking.. and i mean manual :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > manual unpacking.. and i mean manual :)
PDA

View Full Version : manual unpacking.. and i mean manual :)

Kr0n0
08-09-2002, 11:29 PM
hello fellow reversers
i was trying to reverse a prog, but it showed me that i was not good enought to reverse it, so i learnt about PE file structure, still it kicked me, so i decided to learn about unpacking and decrypting.
my first victim was good old UPX 1.20w, i packed notepad and decided to unpack it WITHOUT generic unpackers neither "upx -d" switch neither in Procdump,
i searched the web(blah blah blah fire up procdump dump it and fix EOP) and the forum(use procdump or -d)

my idea of manual unpacking, is with softice(debugger :), icedump(dump sections), hexeditor(assemble all stuff). because this is how one learns!
IMO i think a reverser should dump/decrypt manually a protection at least once. and hexassemble it at least once in a lifetime :)

i'll paste here my walktrough (i wrote this stuff like a tutorial, personal notes... so don't pay attention :), please correct me if something is incorrect

ps: i got all the packers+cryptors on protools, and i wanted to know IYO what packers(cryptors go last :) should i go for next, i'm doing a progression that's why i started with UPX (the easiest :)

ps2: about import rebuild.. for the ".import_section" work does it have to be exacly like the original, or can the order of the imported functions be another(being a correct one, corresponding to true values)

ps3: i read a thread about UPX+NT, that i don't remember exactly, but does UPX fux0res the ".relocations_section". if not htf do i restore the old .reloc

ps4: how can i merge resources from the packed .EXE with the .resources it unpacked. i tried to grab the resources from packed.exe(icon+version_info), but it said "i'm too stupid i can't recognised the reloc section, even thought it is there"

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
UPX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

tools needed: softice, icedump, frogice, ultraedit32(or other nice hexeditor), PE knowledge, lots of girls (i'm hopping you don't need a tutorial on what to do with them :)
compact notepad.exe using default options with UPX 1.20w

size optional header - 0xE0
size of code - 0x4000
size of data - 0x1000
base of code - 0xb000
base of data - 0xf000
section alignment - 0x1000
file alignment - 0x200
EP(entry point) - RVA 0xe8f0
IMAGE_DIRECTORY_ENTRY_IMPORT: - RVA 0xfc14 ; - size 0x170. file offset - 0x4a14

upx0
{
virtual size - 0xa000
virtual address - 0x1000
size raw data - 0x0
pointer raw data - 0x200
}
upx1
{
virtual size - 0x4000
virtual address - 0xb000
size raw data - 0x3c00
pointer raw data - 0x200
}
.rsrc
{
virtual size - 0x1000
virtual address - 0xf000
size raw data - 0xe00
pointer raw data - 0x3e00
}

018F:0040E9C2 5E POP ESI <- finished unpacking itself... or so it seems :)
018F:0040E9C3 89F7 MOV EDI,ESI
018F:0040E9C5 B9DE000000 MOV ECX,000000DE
018F:0040E9CA 8A07 MOV AL,[EDI]
018F:0040E9CC 47 INC EDI
018F:0040E9CD 2CE8 SUB AL,E8
018F:0040E9CF 3C01 CMP AL,01 <- but if you look carefully, you notice the LOOP at :0040E9F4, it's playing with the .text
018F:0040E9D1 77F7 JA 0040E9CA
018F:0040E9D3 803F05 CMP BYTE PTR [EDI],05
018F:0040E9D6 75F2 JNZ 0040E9CA
018F:0040E9D8 8B07 MOV EAX,[EDI]
018F:0040E9DA 8A5F04 MOV BL,[EDI+04]
018F:0040E9DD 66C1E808 SHR AX,08
018F:0040E9E1 C1C010 ROL EAX,10
018F:0040E9E4 86C4 XCHG AL,AH
018F:0040E9E6 29F8 SUB EAX,EDI
018F:0040E9E8 80EBE8 SUB BL,E8
018F:0040E9EB 01F0 ADD EAX,ESI
018F:0040E9ED 8907 MOV [EDI],EAX
018F:0040E9EF 83C705 ADD EDI,05
018F:0040E9F2 89D8 MOV EAX,EBX
018F:0040E9F4 E2D9 LOOP 0040E9CF <- don't know HTF this LOOP worked!? but it's used to do some rearrangements on the .text
018F:0040E9F6 8DBE00C00000 LEA EDI,[ESI+0000C000]
018F:0040E9FC 8B07 MOV EAX,[EDI] <- :d edi, to check out imported functions, and just below the PE header
018F:0040E9FE 09C0 OR EAX,EAX this is the right place to dump
018F:0040EA00 743C JZ 0040EA3E <- as it finished all imported functions from all DLLs ???
018F:0040EA02 8B5F04 MOV EBX,[EDI+04]
018F:0040EA05 8D843014EC0000 LEA EAX,[ESI+EAX+0000EC14]
018F:0040EA0C 01F3 ADD EBX,ESI
018F:0040EA0E 50 PUSH EAX
018F:0040EA0F 83C708 ADD EDI,08
018F:0040EA12 FF96A0EC0000 CALL [ESI+0000ECA0] <- LoadLibraryA
018F:0040EA18 95 XCHG EAX,EBP
018F:0040EA19 8A07 MOV AL,[EDI]
018F:0040EA1B 47 INC EDI
018F:0040EA1C 08C0 OR AL,AL
018F:0040EA1E 74DC JZ 0040E9FC <- if AL == 0, pass to next DLL
018F:0040EA20 89F9 MOV ECX,EDI
018F:0040EA22 57 PUSH EDI
018F:0040EA23 48 DEC EAX
018F:0040EA24 F2AE REPNZ SCASB <- advances EDI pointer to next imported function
018F:0040EA26 55 PUSH EBP
018F:0040EA27 FF96A4EC0000 CALL [ESI+0000ECA4] <- GetProcAddress
018F:0040EA2D 09C0 OR EAX,EAX
018F:0040EA2F 7407 JZ 0040EA38 <- if ZERO... error
018F:0040EA31 8903 MOV [EBX],EAX
018F:0040EA33 83C304 ADD EBX,04
018F:0040EA36 EBE1 JMP 0040EA19
018F:0040EA38 FF96A8EC0000 CALL [ESI+0000ECA8] <- ExitProcess
018F:0040EA3E 61 POPAD
018F:0040EA3F E98826FFFF JMP 004010CC <- EntryPoint of unpacked EXE
(look at memory contexts... we're at 0040EA3F and JMP to 004010CC; besides remember when we dumped the .text :)

:/dump 401000 3e9c c:\_text.PE <- OK!
:/dump 405000 084c c:\_data.PE <- OK!
:/dump 406000 0de8 c:\_idata.PE <- NOT OK! we have to rebuild this!!! it's the import data [**]
:/dump 407000 4fb8 c:\_rscr.PE <- NOT OK! this one is messed up! [***]
:/dump 40c000 0a9c c:\_reloc.PE <- NOT OK! it was only 0x0!! how do we rebuild this? [****]
:/dump 40d000 7e0 c:\_import.PE <- NOT OK! imported functions names [**]
:/dump 40d7e4 1260 c:\_header.PE <- OK!
:/dump 40f000 1000 c:\_UPXrscr.PE <- .rscr that UPX didn't unpack [***]
:/dump 4062e0 240 c:\_IAT.PE <- IAT, Import Address Table [**]

-> get yourself a good hex editor, i use UltraEdit32
make a copy of packedpad.exe
paste the _pehead.PE over packedpad.exe
since file aligment is 0x1000, you have to fill it with 0x0 to file offset 0xfff
now it's time to paste the sections, the first one it's .text, check it's 'PointerToRawData', it points to 0x1000, so we paste the _text.PE at 0x1000 (remember 'PointerToRawData' is at 'start_of_section_header' + 0x14)
after that we have to do file padding, filling it with 0x0, until file offset 0x4fff
looking at PE header again we see .data, and 'PointerToRawData' is 0x5000... what a surprise :), paste _data.PE at 0x5000
fill it up with 0x0 to file offset 0x5fff
paste the rebuilt .idata at 0x6000 and do file alignment
fixed _rscr.PE is to be pasted at 0x7000, file align it
last one is fixed _reloc.PE at 0xc000
Kr0n0
08-09-2002, 11:29 PM
[**] rebuilding the .idata
(for now i just copied it from good old notepad.exe)
so we will have 7 IMAGE_IMPORT_DESCRIPTORs, one for each .DLL and one more that is NULL -> KERNEL32.DLL ADVAPI32.dll comdlg32.dll GDI32.dll SHELL32.dll USER32.dll
IMAGE_IMPORT_DESCRIPTOR
{
OriginalFirstThunk - (32bit) a RVA pointing to a 0-terminated array of RVAs to IMAGE_THUNK_DATAs, each describing one imported function. The array will never change.
TimeDateStamp - (32bit) for bound imports(0 if not used), DLL version checking. If binarie TimeDateStamp != DLL TimeDateStamp, it has to calculate and patch FirstThunk [read until c) to understand better]
ForwarderChain - (32bit) index of the first forwarder in the list of imported functions. Forwarders are also advanced stuff; set all bits to 1 for beginners.
Name - (32bit) RVA to the name of the DLL (0 terminated ASCII string)
FirstThunk - (32bit) RVA to a 0-terminated array of RVAs to IMAGE_THUNK_DATAs, each describing one imported function. The array is part of the import address table and will change.
}
IMAGE_THUNK_DATA is a RVA to a IMAGE_IMPORT_BY_NAME which describes the imported function.
IMAGE_IMPORT_BY_NAME: a 16bit-number(a hint) followed by an unspecified amount of bytes, being the 0-terminated ASCII name of the imported symbol.
the HINT is an index into the exporting DLL's name table(making search faster); but in reality most compilers screw it, so don't rely on it.
open your hexeditor and create a new file, and remember when writing RVAs, remember the offset they should be in unpackpad.exe. the .idata start at file offset 0x6000. let's begin...
for now write 4 bogus bytes (OriginalFirstThunk), leave 4 bytes 0x0 (TimeDateStamp), write the 'FF' byte 4 times (ForwarderChain), write 4 bogus bytes (Name) and finally another 4 bogus bytes (FirstThunk).
then do this 5 more times(since we have 6 DLL files), and leave 4*5 = 20d bytes 0x0(NULL IMAGE_IMPORT_DESCRIPTOR), and some more to pad them at 8byte boundarie, you should be at offset 0x6090 (remember what i said about the 0x6000).
replace the 1st OriginalFirstThunk, at offset 0x0, to 90,60,00,00(0x00006090), and FirstThunk to that value also. we'll leave the 'Name' for latter.
remember our first DLL is KERNEL32.DLL (see _UPXrscr.PE1) and it has 37d imports (see _import.PE), so we'll have to do 37 RVA + 1 NULL RVA (RVA is 32bits sized), each RVA points to one IMAGE_THUNK_DATA,
and an IMAGE_THUNK_DATA is a RVA to a IMAGE_IMPORT_BY_NAME (2 bytes 0x0 and a 0x0 terminated string of the imported function).
after doing all the 37 RVAs and corresponding IMAGE_THUNK_DATAs and IMAGE_IMPORT_BY_NAMEs, we insert the name of the .DLL (in this case KERNEL32.DLL), and make the 'Name' point to where it is.
you can see how much work this gives us... so we must definetly code an auxiliary tool.

[***] fixing the .rscr section
so we have "_rscr.PE" and "_UPXrscr.PE", open then in your hexeditor
so in "_rscr.PE" we have it 0x0 from offset 0x0 to 0x8af (0x8af and not 0x8b4 because we are working in 8byte boundaries)
look at "_UPXrscr.PE", it as some data from 0x0 to 0x8af, apply the sacred and mighty rule of copy-paste :) (i did this on a guess feeling and it worked... almost :)
i don't know how to fix this :( the .rscr is fuxored in 2 ways: the icon and the Version (right click on unpackpad.exe, properties, should also show a 'Version' tab)
maybe with a resource editor we could fix up things... we have to copy the resources from packpad.exe and paste them in unpackpad.exe, if only i knew how :(
(i tried with a couple of resource editors but with no success)
in packpad.exe:
size raw data - 0xe00
pointer raw data - 0x3e00
IMAGE_DIRECTORY_ENTRY_RESOURCE - 0xf000 ; 0x0c14
in unpackpad.exe
size raw data - 0x5000
pointer raw data - 0x7000
IMAGE_DIRECTORY_ENTRY_RESOURCE - 0x7000 ; 0x4fb8

[****]
no idea on how to solve this problem, without a .reloc our unpackpad.exe will only run on OS like ours (if you have NT only runs on NT, if XP only on XP...etc)

CONCLUSION: the prog works, but i lost the .resources from the packed.exe, and lost the .reloc section :(
nikolatesla20
08-10-2002, 12:34 AM
Don't worry about losing the reloc section, most likely any info in there was only put there by the packer itself. Very very few linkers put a reloc in an EXE by default. You usually have to explicity tell it to do so. It's a very rare thing if you would ever need a reloc in an EXE. A DLL on the other hand, is different. For those you MUST have it...

-nt20
esther
08-19-2002, 06:27 PM
Hi Kr0n0,
Do some string searching ;) youwill able to find it
DakienDX
08-19-2002, 09:35 PM
Hello Kr0n0 !

You got something wrong. Not the .reloc section locks the unpacked .EXE to one OS, but the import table does.
Since you used the default option of UPX on a .EXE file, the relocations are stripped automatically and you can't rebuild them since they're not present in the packed file.

Your unpacked file will not run on an other OS since you may not have rebuilt the import table correctly. In UPX you have never a uncompressed "original" import table in memory, since UPX already compresses it a bit before the real compression takes place. So the unpacked import table is not "normal" import table, which you could insert into the dump later, but one just UPX can use to set up the imported functions. So you'll need a import rebuilder for it. (one is included in ProcDump, you'll find many other doing this if the imports are not redirected, which is not the case here)

For the resources I suggest Resource Hacker. Save the unpacked resources from the original (packed) file. In the unpacked file delete this entries first and import your saved data again. This should work most of the time.
evaluator
08-20-2002, 02:40 PM
So MAIN reason, why unpacked prog not runs on other OS is:

many Imports from one DLL has same address for one OS & not same for other OS.
So if you do resolving, your results will different for each OS.

However Icedump(& Imprec) has built in future, called Export-Renormalization.
But I suggest, you should trust to your eyes.

So to be sure, you have right ImprotName, you must debug program & catch moment,
when unpacker-engine builts IAT. So you will see right ImortNames.


Win2k -> DS 2.6 BSOD (hal.dll) HELP!?!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Win2k -> DS 2.6 BSOD (hal.dll) HELP!?!?
PDA

View Full Version : Win2k -> DS 2.6 BSOD (hal.dll) HELP!?!?

Clandestiny
08-10-2002, 01:42 AM
Hiya,

I just installed SoftICE Driver Studio 2.6 on my Win2K PC and it works great excepting one mysterious problem... I seem to be getting a fatal BSOD whenever I attempt to restart my PC from within Win2k. It reports the following error:

***STOP: 0x0000000A(0x00000020, 0x000000FF, 0x00000001, 0x80069128) IRQL_NOT_LESS_OR_EQUAL
*** Address 80069128 base at 80062000, Date Stamp 3C989E09 - hal.dll

Interestingly, the error is only generated on a "restart", NOT on a "shut down". I can shut down windows with no problems whatsoever. Likewise, an "hboot" command issued from within winice restarts my PC without any problems either. Having previously run Win98 as my reversing OS, I lack familiarity with Win2k but I have done some preliminary research with the limited information provided to me... Apparently, the error I am recieving generally corresponds to an invalid memory access and a description of the error follows below:

_______________________________________________
One of the more frequent trap codes generated by Windows NT is STOP
0x0000000A. This STOP message can be caused by both hardware and software
problems. To determine the specific cause, you must debug the STOP.
However, some general information can be learned by examining the
parameters of the STOP message and the STOP screen information.

MORE INFORMATION
================

STOP 0x0000000A indicates a kernel mode process or driver attempted to
access a memory address that it did not have permission to access. The most
common cause of this error is a bad or corrupt pointer that references an
incorrect location in memory. A pointer is a variable used by a program to
refer to a block of memory. If the variable has a bad value in it, then the
program tries to access memory that it should not. When this occurs in a
user mode application, it generates an access violation. When it occurs in
kernel mode, it generates a STOP 0x0000000A message.

To determine what process or driver tried to access memory it should not,
look at the parameters displayed on the STOP screen information. For
example, in the following STOP message

STOP 0x0000000A(0xWWWWWWWW, 0xXXXXXXXX, 0xYYYYYYYY, 0xZZZZZZZZ)
IRQL_NOT_LESS_OR_EQUAL
** Address 0xZZZZZZZZ has base at <address>- <driver>

The four parameters inside the parenthesis have the following meaning:

0xWWWWWWWW Address that was referenced improperly
0xXXXXXXXX IRQL that was required to access the memory
0xYYYYYYYY Type of access, 0=Read, 1=Write
0xZZZZZZZZ Address of instruction which attempted to reference
the memory at 0xWWWWWWWW

If the last parameter (0xZZZZZZZZ) falls within the address range of
one of the device drivers loaded on the system, you will know which
device driver was running when the memory access occurred. This driver is
often identified in the third line of the STOP screen:

**Address 0xZZZZZZZZ has base at <address>- <driver name>

_______________________________________________

From this description I can conclude...

Improperly referenced address: 0x00000020
Access Type: write
Instruction that atttempted memory reference: 80069128... A disassembly of this address in winice informs me that the fault occured in the HalSetTimeIncrement function.

Research into the apparently undocumented HalSetTimeIncrement function reveals the following:
_______________________________________________

"In hal.dll there is a Funktion named "ULONG HalSetTimeIncrement( IN
ULONG Increment);". It accepts the requested resolution whith a base
of 100 ns. (It is undockumented) And it returns the real resolution.
But try it... It is not dangerous, but you will not get the expected
results."
_______________________________________________

I attempted to set a breakpoint on the faulting address in SI, but it locks my *entire* system up, even beyond BSOD lockup and I must cut the power to recover. I currently have SI set to load in "automatic" mode. Maybe I need to set it to "boot" mode to trace this type of error??? I have also researched the problem on google, microsoft knowledge base, and numega's site without success. I did find one reference to the error here on the mb(http://www.woodmann.net/forum/showthread.php?s=&threadid=3135&highlight=hal.dll), but it lacked response.

Has anyone else experienced this error??? I would be immensely grateful if someone could point me in the right direction on this one. Hehe, I'm not too confident in my ability to single handedly debug the Win2K kernel ;)

Here are my system specs if required:

SoftICE version: Driver Studio 2.6
OS: Windoze 2000 Professional
Processor: AMD Athlon XP 2200
Memory: 512 MB
Video Card: GForce 4
Audio: Sound Blaster Live 5.1
Chipset: VIA KT333

Thanks In Advance,
Clandestiny
nikolatesla20
08-10-2002, 02:58 AM
YES! I saw that error too on Win2K, the exact same thing.

But sorry, I never tried or cared to find out what was happening. BUT I do know that I have service pack 2 installed and I don't get the error, and I have seen that error on win2k before.

So maybe it is the service pack that fixed it?

-nt20
Snatch
08-10-2002, 03:46 AM
OMG I was just about to post the same exact thing. I am on WinXP and I get the same message on restarts. I am hoping DS 2.7 will fix this or WinXP SP1.

Snatch
Athlon
08-10-2002, 07:12 AM
Woodmann did you delete my posts or did they disappear again :(
Kayaker
08-10-2002, 08:38 AM
Athlon, I deleted the whole series of 4 or 5 off-topic replies your post generated before it degenerated into a flame war. "When are we going to get our hands on DS 2.7", or something to that effect, obviously created a few retorts which you seemed surprised about. Since it didn't contribute anything to solving the original question and is probably better asked on other forums, I deleted them all. I don't really see any surprise here.

Regards,
Kayaker
Athlon
08-10-2002, 08:50 AM
Ok just checkin sorry but I am used to exetools forum which any thing can be dicussed ;)
oyang2002
08-11-2002, 02:02 PM
Hi Clandestiny:

I had the same problem on Win2K & WinXP,and I had post
some message on some forum but none of the answer can
work it out.
:p

Some days ago I changed some jumpers on my motherband
because I thought my CPU wasn't been idntified correctly.
(BTW I have a AthlonXP 1700+ and KT266A chipset).

I modified some parameters about freqecne and my CPU was
identified as 1700+.I found DS2.6 worked fine on W2K now!
:D

But,It still can't work on WinXP Pro:mad:


Why my dumped apps won't run??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Why my dumped apps won't run??
PDA

View Full Version : Why my dumped apps won't run??

loman
08-10-2002, 11:21 PM
Hello to everybody.
I tryied to unprotect Powerstrip 3.21 (protected with Asprotect 1.23) and after having rebuiled with imprec the IT, when I launch the dumped&fixed file I recive a windows arror at address 00401000.

00401000 add eax,dword ptr [edi]
00401002 inc edx
00401003 outs dx,dword ptr [esi]
00401004 outs dx,dword ptr [esi]
00401005 ins byte ptr [edi],dx
00401006 popad

dword ptr [edi] is 00 00 00 00.

What have I to do after having fixed the IT with Imprec??? have I to change something else??? Thanks in advice
nikolatesla20
08-11-2002, 12:04 AM
It looks like you have forgotten to redirect the OEP. The Original Program Entry point. You are still using the OEP of the protected application.

Search the board for unpacking tutorials, (notice the search button on the top of the page ;) You will find plenty of info on how to do unpacking properly. Read several before trying, some tutorials omit important information others include. If you read several of them you can put together all the info you need to get started.

-nt20
arieri
08-11-2002, 08:21 PM
hei

Be aware that imprec resolve one api incorrect + one api that it does not resolve. Be shure you have the correct oep.
Analyse the redirected api with your debugger and look at their
returnvalues
F.eks. Getversion = returnvalue C0000A04

My dumped .exe runs fine.

regards

arieri


adding code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > adding code
PDA

View Full Version : adding code

The Keeper
08-11-2002, 03:49 AM
Hello,

i've been trying to add some code to a program, i could make it show the serial in a msgbox, now i want it to set the serial serial in the edit box, i got spy++ and looked at the window,

i see

000488 Register #32770 Dialog
A04 Edit
904 Edit

i put a int 3 where i want to add the code and assembled from there

push 488
push a04 (guessin its the serial edit)
call getdlgitem

but it returned 0, i tried reversed then and stil lreturning , am i doing something wrong ?

ps: the program doesnt export getdlgitem, but from sice i can assemble it, i guess im calling it directly, could anyone point me out if im doing something wrong ? this seems to be easy but its getting me

thanks in advance
the keeper
ZaiRoN
08-11-2002, 11:21 AM
hi The Keeper,
if you want to set the serial you have to use the function

SetDlgItemText:
BOOL_SetDlgItemText(
HWND_hDlg, <-------- handle of the dialog box
int_nIDDlgItem, <----- the id of the control (you can retrieve the id using a resource editor)
LPCTSTR_lpString <--- a pointer to the serial
);

you don't need to use GetDlgItem in this case because the function GetDlgItem is used to retrieve the handle of a specific control in the dialog box.

if the proggie doesn't import the function you can add using a specific tool (lordpe or something else) or adding it manually :)

ciao,
ZaiRoN
The Keeper
08-11-2002, 07:53 PM
Hello, i got the id and the pointer but doesnt the handle always change ? how do i get the handle to the dialogbox ?

thanks in advance
?ferret
08-12-2002, 01:26 AM
Hint: How does the proggy know where it is?

Check the original params for the dialog box for the address to push ;-)
The Keeper
08-12-2002, 04:01 PM
GetModuleHandle
The GetModuleHandle function retrieves a module handle for the specified module if the file has been mapped into the address space of the calling process.

To avoid the race conditions described in the Remarks section, use the GetModuleHandleEx function.

HMODULE GetModuleHandle(
LPCTSTR lpModuleName // module name
);

is that what u mean ?


TRW2000 internal
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > TRW2000 internal
PDA

View Full Version : TRW2000 internal

dion
08-11-2002, 01:38 PM
have anyone could explain to me trw2000 internals, about bpx concept, idt/gdt/ldt thingy, vxdcallhook, blah-blah... to me? or is there any trw2000 internal tut out there?

from now, i just understand the apiplugs mechanism only. i get stuck understanding how trw2000 break in to kernel and popup itself. maybe icedump gurus could help me out, please...;)
dion
08-12-2002, 03:11 AM
here's my lame readme about plugsapi [i've posted that lame plugs here]. and execuse me if any mistakes written here, any correction needed ;). trw2000 consists a loader and a master plugs. i call it master plugs coz :

- it's a plugs indeed, but a master/main plugs
- it loaded first before other plugs, so it can provide api services
for other/slave plugs loaded later [what i called plugsapi].

in the plugs init routine of trw2000.sys, it first registering every local function that will be exported as plugsapi. these exported api were placed in one struct. the plugsapi struct declaration can be read at plugapi.h file. the struct itself not comprises plugsapi only, but some trw internal variable are there too.

what the plugsapi plugs coded by me doing is just dumping this struct with address related to each struct members. so u can see directly to those addresses and recognize these function's names ;). then u can busy to rename all the function in ur disasembled list of trw2000.sys file. from here u have had little knowledge to reverse the master plugs.

now, after registering each struct members, the master plugs enumerates slave plugs and load it. i don't know yet what the rule used to load the slaves here. i bother with rule coz ordinary vxds are using it. its called InitOrder. but the case here is, the first loaded plugs is always master plugs, and there's no plan from author to let slave plugs providing another plugsapi service set to enhance the plugs functionality.

when a plugs loaded, execution gets in to plugs init proc, where u can see the param passed to this proc is a ptr named [PLUGS_API* plugsapi]. i don't know who is passing this ptr, but i guest the master plugs is the one who did it when loading plugs, bcoz the only one who knows his own locals functions address is master plugs, right? that's why every plugsapi called in plugs src code have form like: api->???. if u see it in assembly form, its looks like this:
call dword ptr [e?x+??h]
where the e?x contain ptr passed by master plugs.
after initialization proc, slave plugs are ready to receive cmds or do something else.

so, the point is... this plugsapi method is rather diff with vxdservices method, in which the master plugs don't have to 'snaps' the slaves apicall for the 1st time.

hmm... is there anyone imagine the add_api like implementations here ;). if there is, then here's i tell what come to my mind when thinking about it:
- the export table must have one method, that is add api entry.
- if there's unload scenario here, the plugsapi service provider
responsible to handle dead entry and to redirect that dead
entry to return false/true to the caller. huh... that's hard,
isn't it?
- make plugsapi set proto in a separate header file
- make a rule in loading, or load order. the provider must have
top priority before users, right? here maybe we can use an INI
file instead of... argh, i don't know how WDM's DDB looks like.
- ok, say the new plugs provider loaded by master plugs, and he
had an export table. then who'll load the users of that new
provider? if its master who load it, then master plug have to
somehow registering new plugsapi set and snaps the users link,
right? how complicated it is... :p
- anyone wants to do this...
dion
08-12-2002, 03:14 AM
hmm... i just knows a little about breakpoints. again, its a big chance i do mistakes here. the one used for LOG3 plugs is software bp. its hooking int1, looks like softice using this method too. u can see it barely in LOG2 source code. and maybe there's one internal variable involved, named pfSoft_1Step. it's a member of PLUGS_API struct.

when u break in to trw, trw freezes VMs and the registers show up in upwindow is register value from current VM, maybe. the register value can be ripped from a struct called CLIENT_STRUCT. refer to vmm.h to see his members. from here, i just filter the eip value to satisfy what i need, like LOG3 did. its lame easy to code LOG3, right? that's why i felt no need to release the source ;p.

the only info about this bp i got is from BPINT and LOG2 source code.
may there's gurus figures this all out. could anyone add what missed here, please... :(.
dion
08-12-2002, 11:19 AM
man, no one helps me...
i've take all i know about trw internal here, and no respon...:(
midibox
08-12-2002, 11:44 AM
Maybe no one in this forum has experience in developing debuggers for windows. (just guess... I am new comer too :-)

Thx for your efforts...
dion
08-13-2002, 03:43 AM
i need to know the process of debugger break, and what happens when it break? i know thats relate to modify idt of current thread (maybe), but anyone can tell me more detail about this ?
Hwoarang
08-14-2002, 01:35 AM
most of the guys who still use Win9x (like me) don't use TRW because it's kinda buggy and unreliable (crashes very often, it's unstable and so on...)
Anyway you can debug TRW with Softice..eg. to see how it does bp, use in Softice BPR on the api you will breakpoint with TRW...it worx fine (I also was a year ago interested in how it's breakpoints work)..hmmz, maybe that doesn't answer to your question..i dont know anything else about that debugger, sorry
DaFixer
08-14-2002, 02:44 AM
Well i dont know specially how trw works but the ways a debugger can be implemented are very limited :D There are software and hardware breakpoints.

Hardware breakpoints are set using SetThreadContext() api. There is a _CONTEXT structure and depending on the ContextFlags of this structure it can be used for setting different type of information. Among them are reading and modifying the FPU registers, the debug registers, and the control structures. With the last you can change the current EIP of the thread and more. The _CONTEXT structure is defined for all different processors and it is hardware dependant. The best resource about this for intel processos is the intel documentation. The 3 pdf files about 5Mb each. I guess you can find them on the net. There should be a section about debugging and hardware exceptions. There is very detailed documentation about how to use the debug registers to debug a process. The bmps are only possible to be made with debug registers btw.

The software way is with a simply using int 3 for a break point and int 1 for step by step tracing. You can use WriteProcessMemory to change the next instruction that is going to be executed and this way generate debug event for the debugger. You can attach to active process by DebugActiveProcess() and with WaitForDebugEvent() wait until a debug event is generated. May be you would like to check the _DEBUG_EVENT structure returned by the last function for more details. I'm not quite sure but as far as i can remember there is a fully functional ring 3 software debugger in the examples of the Matt Pietrek's book for win 95. I even may be have it somewhere :)

Cheerz
dion
08-14-2002, 09:11 AM
Originally posted by Hwoarang
most of the guys who still use Win9x (like me) don't use TRW because it's kinda buggy and unreliable (crashes very often, it's unstable and so on...)
Anyway you can debug TRW with Softice..eg. to see how it does bp, use in Softice BPR on the api you will breakpoint with TRW...it worx fine (I also was a year ago interested in how it's breakpoints work)..hmmz, maybe that doesn't answer to your question..i dont know anything else about that debugger, sorry

thanks Hwoarang. but please tell me whatever u know about breakpoints, trw not so diff with softice and im not talk specific to trw about this breakpoint context.
dion
08-14-2002, 09:14 AM
emm... ok, say i code a dynamic load WDM driver. i put in a ring0 kbd handler and an universal miniport graphics driver. when loaded, i hook the kbd for hotkey access. and then i hook int3 and int1 and... how do i set bp in kernel/current thread? coz we need to break in, right?

i'm not sure debugger such softice using attach method. i ever seen a log instruction application written using debug api, and it act very badly, not like softice/trw do. btw, debug api are designed for ring3 debug application, i thought.
DaFixer
08-14-2002, 11:37 AM
First of all i dont know ring 0 stuff and never coded something. Only have called the ring 3 function for calling ring 0 stuff. The first export from kernel32.dll

Originally posted by dion
how do i set bp in kernel/current thread? coz we need to break in, right?

whats the problem to write in kernel32.dll memory and put an int 3 where you want? Ofcourse after calling VirtualProtect to deprotect the page. And this will only work on 9x as well.

Originally posted by dion

i'm not sure debugger such softice using attach method. i ever seen a log instruction application written using debug api, and it act very badly, not like softice/trw do. btw, debug api are designed for ring3 debug application, i thought.

SoftIce is ring 0 debugger and it defenitely dont use debug api:) I was just talking about debuggers :) You can use hardware breakpoints from ring 0 or write int 3s in the process memory.
dion
08-15-2002, 11:49 AM
reading softice internal by +Spath...
seeing winice.exe unasm...
it said that winice.exe are a vxd [LE format], so theres 16 and 32 bit in one file. pasted from tut:

-------------------------------------------
winice.exe performs the following steps :
1. change video mode to mode 3 (80x25, text mode, 16 colors) and display SoftICE intro message (SoftICE version, OS, ...).
-------------------------------------------

what i saw in start is:
public start
RCOD:0000 start proc near
RCOD:0000 xor ax, ax
RCOD:0002 xor si, si
RCOD:0004 xor bx, bx
RCOD:0006 retn
RCOD:0006 start endp

how can this code perform video mode switching???
dion
08-18-2002, 08:23 AM
it ripped off roughly from master plugs disasm. these cmd related to VER cmd. they are:

:VER TST8 ; just crash my comp :(
:VER INFO ; disp debugger environment infos?
:VER MEM ; disp trw path and dibeng infos
:VER SAY ; disp windows properties?
:VER TEST ; n/a? (no action)
:VER TST1 ; n/a?
:VER ERRO ; n/a?
:VER BLUE ; n/a?
:VER KEEP ; keep the debug screen ;)

from here, we know that trw2000 using dibeng somehow. infos from 98DDK says:
"To help you create more efficient display drivers, Microsoft supplies the DIB engine, which is a DLL that contains most of the functions needed to translate GDI commands. A display driver that uses the DIB engine is called a display minidriver. The minidriver only contains hardware-specific code for your display adapter and redirects the non-device specific calls from GDI to the DIB engine."

so, if i'm not wrong here, the master plugs include the display minidriver that handle h/w specific code. but, somehow i felt the display minidriver discussed in 98DDK are loaded as static vxd drivers. meanwhile, the trw loaded dynamically. therefore, my first bet is trw intercept the minidriver link to dibeng (DIB engine). i'm seeing codes that related to video buffer at &A0000 and &B8000, but dont know what its really do.

if anyone knows this stuff in depth, please add what missed here ;)

thanks
dion
08-20-2002, 03:30 AM
ok, after read 98ddk help a while, accidentally ;p, i saw the DIBENGINE struct which the first member match with one value pointed by ver mem command. here below i include my source code ;).

and, remember the two lines after Dibeng value in ver mem command...
yeah! thats value is the same like what would display in the member listing. maybe u wonder why just these two value get displayed, wheres the others? is the rest is not important?
honestly... i dont know the answer. but i see those two value gets involved in screen operations. i thought i'm closer to it, but...

now, trying to get deeper understanding... btw, its hard, guys... none of u could give me a clue :(
dion
09-09-2002, 03:40 AM
feeling lame thinking about this subject, meanwhile i dont have much access to my 'home' computer anymore right now, i just want to tell my idea here with assume that SI would be the best debugger among the other and so used as reference.

the points of debugger design would be:
- free/open source/copyrighted/whatever [but no commerce, please ;)]
- plugin based architecture
- very... i mean very... customizable debugger
- support multi OSes [w9x,wnt,w2k,wxp,etc]
- full documentation

about plugin stuff, it should:
- support script language [ie calling VMM services from script, can make a 'real' driver as plugin, etc]
- have controlled plugin environment [ie can debug plugin easily]
- dynamically loaded

the plugin includes the kernel itself, cpu info, disasm routine, display driver, windowing routine, skin switching [actually, this is my favorite part if applicable], etc...

about customizable stuff. it should be the mindset from beginning of design. such as debugger can easily perform counterattack from antidebug stuff with small changes, or in some situation that need special breakpoint [that not supported by SI, of course] users can easily perform it with little effort.

about multi OSes. it applied to every debugger component, even the kernel itself. i think it can be compiled in separated package or using OS auto detect. in this stuff, there mostly problem will faced [ie display/mouse problem].

documentation was a thing that everyone should have an eye on it, so that will be more ppl can use the debugger.

well, its just a bluffing and incomplete idea from me.
thanks for reading.


Zip Protection Question?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Zip Protection Question?
PDA

View Full Version : Zip Protection Question?

foxthree
08-11-2002, 06:51 PM
Hiya Mike and others:

I know that there was a detailed thread on ZIP Password protection and stuff and Mike, I read through your paper. However, one question intrigues me:

Say I have a zip file and I know a part of the password. I just don't know the length of the password and whether this "crib" occurs in that password. Can I exploit this information somehow?

To be clear:

Say I have a zip: ultrasecret.zip and I know that the contents of the zip file have been protected with a password that contains the word: "hallow". I don't know the exact length of the password and neither where the word occurs in the password. For instance, the password may be "shallow" or "hallowed" Get it?

Can I exploit this information some how and reduce my search space?

The first idea I can think of is to write some fuzzifier that would create all possible strings at a specified length which contains the words "hallow" and attempt a dictionary attack. But anything else other than this?

Thanks for your time and research folks,

Signed,
-- FoxThree

Ummm and one more thing:

Mike: Pls refer to:
http://www.woodmann.net/forum/showthread.php?s=&threadid=1965&highlight=accessdata

In which you've mentioned about an essay posted on Fraiva in March. Do you still have it and can you upload it if you have it? I hope this is different from the one that I found on your website? Also, I'm currently going through Biham/Kochers' paper on ZIP Plaintext attack. Pretty interesting :)
foxthree
08-13-2002, 07:08 AM
Mike:

Any responses ???

Signed,
-- FoxThree
mike
08-14-2002, 03:20 PM
Sorry, didn't read the board yesterday.

http://www.woodmann.net/fravia/mike_zipattacks.htm

is the paper; it's almost identical to the one on my site. There are three ways to attack a zip file: dictionary, my attack for winzip-like zippers, and Kocher's attack for all zippers.

You know how a dictionary attack works.

Both my attack and kocher's attack try to figure out what the internal state of the cipher is *AFTER* the password has been mixed in. Basically, mine uses the broken PRNG to get known plaintext, and Kocher uses known plaintext that you give it.

So our attacks don't care what password you use, and can't do anything with information about it. I think some of the commercial zip crackers have custom settings where you can configure the words that it generates--your "fuzzifier."

My attack can tell you within a few seconds whether it will work or not: it looks to see if you have five or six files in the archive that were all added at once.
foxthree
08-15-2002, 08:38 AM
Hi Mike:

I just now decrypted an encrypted archive using Guaranteed Zip Recovery algorithm (ARCHPRs' after unpaxing and regging it :D). However, the funny thing was that my test archive gave me the actual password itself. But the actual archive only got me the three 32-bit keys. It said it couldn't find the actual password used to encrypt the files.

Anywayz, the archive is decrypted and that's what matters. But just curious? Any ideas why it couldn't find the acutal password?

BTW, this board OwnZ elc****** :D...

Signed,
-- FoxThree
mike
08-15-2002, 10:21 PM
For a detailed explanation, look at biham & kocher's paper. In a nutshell, it's that there are three checksums of the password involved (thus three 'keys') and all three have to match to decrypt right. If you can figure out the checksums instead of the password, you can decrypt. The problem is finding the password given the initial states and final states of the checksums. It's basically brute-force, but you get 4 characters free.


unpacking pklite 2.1 NE target???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > unpacking pklite 2.1 NE target???
PDA

View Full Version : unpacking pklite 2.1 NE target???

Rainor
08-12-2002, 03:59 AM
ppl, i'm working in a target tah use hasp dongle , however the main executable is NE (16bits Win 3.x) packed with pklite 2.1 , I search the net for a pklite NE unpacker or a generic NE unpacker without luck. Any idea?? Any tutorial about manual NE unpack????

R


Waiting for DeDe Comment, Ideas, Questions etc.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Waiting for DeDe Comment, Ideas, Questions etc.
PDA

View Full Version : Waiting for DeDe Comment, Ideas, Questions etc.

DaFixer
08-12-2002, 03:35 PM
Hello everyboddy. Long time i havent been active on the scene, im still not :rolleyes: , and didnt know the Fravia board is still living.

Thanks to dion for pointing me here.

I would like to start this thread to hear your comments, ideas and questions about DeDe and the sources, i made public.
It will be also nice if there is someone that have the wish and the potential to eventually continue further development or make improvements or bug reports or bug fixing etc. This doesnt mean i will stop the codding myself. Its for sure that i will add the Delphi 7 support when Borland relese it. Its now sure that there will be Delphi 7.

And now to dion's question

what i'm gonna do is trying to accomplish an idea from Lbolt99 saying that it would be nice if dede could do recog on the fly.

before asking something else, is it possible?
and if it possible, can it implemented in a debugger such trw?

I dont understand very well what you exactly ask. What should DeDe recognize on the fly? And what you mean by "on the fly"
Thigo
08-12-2002, 04:15 PM
fix !! nice to see you alive ;D
DaFixer
08-12-2002, 04:22 PM
Wazzup Thigo, nice to see good friends around :p
LaptoniC
08-12-2002, 10:42 PM
I dont know I am the only one but very often Dede locks my PC when loading delphi apps.Therefore I run the application and dump from memory.
DaFixer
08-12-2002, 11:26 PM
Originally posted by LaptoniC
I dont know I am the only one but very often Dede locks my PC when loading delphi apps.Therefore I run the application and dump from memory.

Well this never happened to me. Realy. May be the problem is a conflict with some of the other programs you are running. Btw dumping from memory give less references than normal processing. And you always have the option to switch off running the target on processing if you dont want this.
DaFixer
08-13-2002, 03:11 AM
Well strange but after making my sources public i got some strength and wish to finish the new version of DeDe. Here is part of the what's new:

1) Little change in the DSF symbols. The current version is now 2.2. Automatic convertion from v2.1 to v2.2 is included when opening ver 2.1 files.
2) Added option for advanced edit, insert and delete DSF symbol entries in a DSF file.
3) Added option for calculating a DSF ident for a procedure of a running process if you know its RVA. Added option to make DSF symbol ident for the currently disassembled procedure.
4) Added a few shortcuts for the disassembly window. F5 for disassemble again, Ctrl+A for select all, Ctrl+C for copy, Ctrl+F for find.
5) The class information form is now made visible on double click of item from the classes list.

Will be nice to read what you think is good for you to see in the next version 3.20 :)
dion
08-13-2002, 03:18 AM
the case example on the fly is like after aspr-ed prog running and unpck itself, we can do unasm and apply the signatures directly from memory. can we do that?
dion
08-13-2002, 09:33 AM
if u don't mind, heres my comments. i think u should take a users point of view. u should think like them, asking why should i use dede instead idapro, example. asking to me, i'll answers:
- dede shows a better lib/class name, although sometime messed
- dede have sig for latest version of delphi, meanwhile idapro has
up to d5vcl only (as far as i know)
- dede lists class name, which useful to find an interesting one
- dede shows event/ctrl related procedure, which helps much in
tracking messages/program flow

some lacks i felt in dede are:
- the only attracting one in classes info tab is the name, i don't
have any idea what DFM offset and Unit name used for. it seems
lots of 'em sets to 0 and empty. also units info tab shows nothing
- something that has been planed by u, its better to visualize the
delphi form instead listing their properties. as addition, u can
integrate procedures tab to be part of delphi form shows. so,
when users click a button, dede'll shows its procedure directly ;)
- no search class name string dialogbox
- there's no hint for DOI builder
- somehow pe editor is not necessary, excpt theres special feature
- ... i thought ur todo is good enough to make dede roxx ;)
DaFixer
08-13-2002, 11:39 AM
Hi dion and thanks for your comments. Here are my notes on them

Originally posted by dion

some lacks i felt in dede are:
- the only attracting one in classes info tab is the name, i don't
have any idea what DFM offset and Unit name used for. it seems
lots of 'em sets to 0 and empty. also units info tab shows nothing

Well unit name is good if you for example try to handle some protection and know that TUncleFaka is the main class used in the protection and you see it is from unit called SouthUnit. Well now it will be good to know which other classes are defined in this unit :D
DFM offset is the physical offset where starts the RCDATA for this class. By the way now (in 3.20) if you double click a class it is shown more information with all VMT entries, method list and field list. This can be good to explore some classes which dont have dfm resources and which methods can not be accessed via procedures tab.

- something that has been planed by u, its better to visualize the
delphi form instead listing their properties. as addition, u can
integrate procedures tab to be part of delphi form shows. so,
when users click a button, dede'll shows its procedure directly ;)

Well im working on this :) May be it will be kind of a DFM editor which will show the form, type-of an objct inspector, and resource script. When i finish it (it is not that easy to make this :rolleyes: ) i will think for adding procedures disassembly to show on clicking the controls.

- no search class name string dialogbox

I will add filtering and sorting by class name and unit name for the classes for 3.20

- there's no hint for DOI builder

Yes because my intensions were that it will be used mostly by me. By the way i dont use it. Except when i create a DOI file for a new VCL version. There is also builder for doi files from pas files which you can find in DeDe. Run it with "more" parameter (not -more only more: "dede.exe more"), then open the doi builder, hold ctrl+alt+shift and click 2 milimeters uper-right from the uper-right corner of the "New" button :cool:. So this is how you can activate the thingie. It is also used may be only by me for creating doi files.
So i plan to write description about DSF and DOI technologies, i believe i have done this in essays long ago but then noone cared for this, so i will describe how the things function and will explain how to use the DSF and DOI builders. There is already DSF editor in 3.20 implemented. I will also put something for easier managing of DOI stuff.

- somehow pe editor is not necessary, excpt theres special feature

Well for me its very usefull because if you want to change a single flag or directory entry you dont need to run another program but can do it with DeDe. Dont know if you have seen the first version of DeDe but it had pe editor and a list with event handler names and their rva offsets only. So this has letf from the beginning.

- ... i thought ur todo is good enough to make dede roxx ;)

Hmm ... dont have personal opinion about my todo :D but i think that DeDe roxxorz ;) and for me it is clear it is better than IDA for delphi apps. The arguments for this are much more than the ones you have mentioned. The peoples just dont use it at 100%. And if you prefer IDA, Win32DASM or SoftIce you can just export everything there and enjoy. Dont know have you tried it but the win32dasm export is realy awesome! And it doesnt take too much time. May be i have to check is it a way to load symbols in trw. May be you can tell me ? <g> Oh ... and what about your other question for trw? i didnt catched it so ask again.

Cheerz
DaFixer
08-13-2002, 11:52 AM
Originally posted by dion
the case example on the fly is like after aspr-ed prog running and unpck itself, we can do unasm and apply the signatures directly from memory. can we do that?

Well you can do this if you dump this process from DeDe. If your question is refered to is it possible to write a plugin for trw which will apply DeDe sigantures and show the symbol names then this is another cup of tea. Generaly it is possible but wont be fast. As i mentioned i think for another way to export DeDe references in trw. Because i use SoftIce i dont know how eventually this import in trw can be done. If the best option is writing a plugin then i can tell you everything you need to use DeDe's DSF files. But again it will be veeeeeery slow. The problem is you dont know which parts from the .CODE section are acctually executable code and which are VCL class info. So you will not be able to disassemble all the code, find call instructions and apply DSF identification for that RVA. So ti will not be fast to make idents for the whole code. The same case is with win32dasm export when you ask for all references. Probably i can speed this identifing for example with only looking for E8 byte followed by 32bit address which is in code section and only then to look does the proc at this offset have known dsf ident. But the speed will be known after we test it. Btw what language you code the plugins in ?
dion
08-14-2002, 09:30 AM
quote:
DFM offset is the physical offset where starts the RCDATA for this class. By the way now (in 3.20) if you double click a class it is shown more information with all VMT entries, method list and field list. This can be good to explore some classes which dont have dfm resources and which methods can not be accessed via procedures tab.

1. how could u enum every class name? are u scanning through all file for a string which begin with Twhatever?
2. could u tell me what u mean with 'some classes which dont have dfm resources and which methods can not be accessed via procedures tab'? if it doesn't have resource, then how it gets work?

quote:
Dont know if you have seen the first version of DeDe but it had pe editor and a list with event handler names and their rva offsets only.

sorry, but i don't see any event handler names list in pe editor, or am i forgot something?

quote:
If your question is refered to is it possible to write a plugin for trw which will apply DeDe sigantures and show the symbol names then this is another cup of tea.

yup! thats exactly my q.

quote:
As i mentioned i think for another way to export DeDe references in trw. Because i use SoftIce i dont know how eventually this import in trw can be done.

well, actually its available already, since trw can load .sym symbol file, and theres a tool to make symfile. and basically, but maybe i'm wrong, trw was built based on softice. lots of trw internal are ripped from softice. but, its add features, like dynamic load, auto disp imports, and blah-blah. i think if the author don't stop coding it, it'll be one of softice capable competitor. btw, lots of ppl complaint it buggy and weird behaviour, and then why u ppl dont try to fix and upgrade it? are u guys not smart enough to do so, or just happy being a goodboy users of powerful softice? maybe theres many guys become lame softice users right now, without knowing softice internal. ah... never mind that, maybe im just a lamer who trying to...

quote:
But again it will be veeeeeery slow. The problem is you dont know which parts from the .CODE section are acctually executable code and which are VCL class info. So you will not be able to disassemble all the code, find call instructions and apply DSF identification for that RVA.

hope im not wrong read this. but, gee... i dont have to take care all of that, coz we are in debugger, not anywhere. so the current opcode must be an executable code, right? one thing that might be have to do is check mempage availability and peek the byte, and do sign recog. btw, softice maybe slow to if it applied to her. and one again, we in debugger just see one instruction per se, so i dont plan to applying to whole prog, besides it could hang the computer if something bad happened ;)

the language used for plugs is microsoft visual C++ v6.0. so, it can be c++ or asm, very flexible and could anything u want =)
least
08-14-2002, 10:31 AM
First of all, I'd like to thank you for this tool, I've tried it last week and it is really great. I've been trying for two days to find something
and 5 minutes in Dede gave me the answer!
But there are two things; first, some of langres files seems to be invalid - I found that some lines aren't ended by 0x0d 0x0a but by only one of those bytes,
so its easy to fix; second, when I start processing some apps Dede says it is not Delphi App, but then it is processed right. The only app that was said to be Delphi 2 crashes Dede after some processing (Wincommander after manual unpacking).
But nevermind, this tool really deserves to be in reversers Hall of Fame.
Regards,
least
DaFixer
08-14-2002, 11:24 AM
>1. how could u enum every class name? are u scanning through all file for a string which begin with Twhatever?

Classes are found by their self pointer not by searching a string :) To enumerate classes you should read dwords from the beginning of the file and if the dword value is equal to the RVA where this dword will be loaded in memory then this is a self pointer to a class. Then depending on a delphi version there is a structure of the VMT around this self pointer you can read and get all the additional information about the class you can find when you double click on it in the new DeDe.

>2. could u tell me what u mean with 'some classes which dont have dfm resources and which methods can not be accessed via procedures tab'? if it doesn't have resource, then how it gets work?

dfm resources have basicly only the forms. So the TStringList class for example for have dfm resources because its not a form. It will be the same with class called TDESCrypter for example ;)

>sorry, but i don't see any event handler names list in pe editor, or am i forgot something?

I said that the first version of DeDe had only both pe editor and one list view with event handlers :) Btw during the times there was also API spy intergrated in DeDe :D but i removed it.

>well, actually its available already, since trw can load .sym symbol file, and theres a tool to make symfile.

Well then i should install trw and see how to directly compile and load the .sym file in trw as i do for SoftIce.

>hope im not wrong read this. but, gee... i dont have to take care all of that, coz we are in debugger, not anywhere. so the current opcode must be an executable code, right? one thing that might be have to do is check mempage availability and peek the byte, and do sign recog.

I thought about recognizing calls the already passed ones and the future ones some bytes ahead from the current EIP but on the same level. May be you have other ideas. Can you explain? And im realy not sure its good to implement dfs recognition plugin.

Oh some of the features i work on for the new DeDe are: As i said DFM editor, a good one ;), and i plan to put a debugger in DeDe. But a special one. My idea is to be able to put breakpoints on VCL classes methods directly. I.e. to put for example bpx ShowMessage or bpx TApplication.CreateForm or bpx TEdit.GetText etc which will break when this method is called.
DaFixer
08-14-2002, 11:48 AM
Hi least and thanks for the comment

Originally posted by least
first, some of langres files seems to be invalid - I found that some lines aren't ended by 0x0d 0x0a but by only one of those bytes, so its easy to fix;

Probably you have old version. This problem is fixed from a month. Just dont upload text files in ascii mode like me because some idiot linux on the route may deicde it doesnt like the #13 and remove it :mad:

Originally posted by least
second, when I start processing some apps Dede says it is not Delphi App, but then it is processed right.

Yes you can process winhex with DeDe. It tells you its not delphi but if you chose ignore it will find some similar sturctures. But its not delphi for sure :) If you have found an application for which DeDe sais its not delphi app and then finds classes, units or foms i will be curious to look at it ;)

Originally posted by least
The only app that was said to be Delphi 2 crashes Dede after some processing

Yes i know Delphi 2 applications crash DeDe. Delphi 2 executables structure is different from D3 and above and i have never had time to analize it more detaily. And the delphi 2 applications ratio to latest versions delphi applications used nowadays shoul be less than 0.1% i think.
Rex
08-14-2002, 12:01 PM
If you manage to create these, well this will be so nice to have :D I keep my fingers crossed for you.

Rex

Oh some of the features i work on for the new DeDe are: As i said DFM editor, a good one , and i plan to put a debugger in DeDe. But a special one. My idea is to be able to put breakpoints on VCL classes methods directly. I.e. to put for example bpx ShowMessage or bpx TApplication.CreateForm or bpx TEdit.GetText etc which will break when this method is called.
least
08-15-2002, 10:03 AM
The app that Dede doesn't identified but processed right was one of tKC's cracking tutorial compilations (tuts 1-100),
I can't remember the name; it showed nag with text like Cracking Commander v1.0 ...
The app was packed so maybee the signature you use was somewhat damaged. Hope it helps.
Regards
least
dion
08-15-2002, 11:42 AM
quote:
To enumerate classes you should read dwords from the beginning of the file and if the dword value is equal to the RVA where this dword will be loaded in memory then this is a self pointer to a class.

got it in TClassDumper.Dump. but why that dword val must be RVA while loaded in memory? i dont understand what is FbClassFlag? what for?

hmm... could u describe how these class selfptr get load and processed? and why delphi not static linked/hardcoded every class's calls instead?

quote:
I thought about recognizing calls the already passed ones and the future ones some bytes ahead from the current EIP but on the same level. May be you have other ideas. Can you explain? And im realy not sure its good to implement dfs recognition plugin.

sorry, but i dont get ur point. i thought an already past calls are still in current page and can be applied to dsf. and the upcoming calls might be still in another memory pages, although its possible to pagein that page, i dont see it need to do so, besides pagein command should be used carefully, if not it'll hang the os.

a special debugger... gr8! cant wait ur new release now ;)
PS. are u using debug api for that?
DaFixer
08-15-2002, 01:01 PM
quote:
got it in TClassDumper.Dump. but why that dword val must be RVA while loaded in memory?

because its self pointer to itself :) its memory location equals its value

quote:
i dont understand what is FbClassFlag? what for?

acctually these structures are type information, not class definitions. So they can be class, record, enumeration etc. This flag shows what kind of structure is that. All with flag 7 are classes.

quote:
hmm... could u describe how these class selfptr get load and processed? and why delphi not static linked/hardcoded every class's calls instead?

the classes can not be called in this meaning. Their methods can be called. Borland created this typeinfo struture to store information about the classes. The virtual and dinamic metods are called using the virtual method and dinamic metod's tables in this class info. The methods which are not virtual and not dinamic are called using hardcoded offsets set by the compiler/linker. The static methods (called "class methods" in delphi) are also called with E8. Btw the typeinfo structure Borland developed is realy smart thing :)

About DSFs. As i said the problem is that the CODE section of delphi executable contains not only code but both code and data. Thats why win32dasm sometimes cant disassemble the code corectly. So if you scan the whole CODE section in memory for DSF references this will take lots of time. Its much better to try to identify a procedure at certain rva when you are sure that this rva is called as procedure.

Now about the DSF file format and identification engine. Well its not very well developed because the idents are not in a tree structure like the ida signatures for example. DSF file contains list of idents followed by a list of names. Of course this is not a problem becasue you can create the tree structure in the memory while you load the dsf file and this will speed up the recognition. DeDe keeps the list of dfs idents in the memory and also a list with the first byte of each ident and a list with the names. When a procedure should be recognized DeDe reads it's first 50 bytes into a buffer. Then loops among all dsf idents and check is the first byte of the ident (or signature, i call it ident) the same as the first byte of the buffer. If not then continue with the next ident. If the bytes are identical then the buffer and the ident are compared. Before doing the match loop the buffer is processed to remove all not relative data in it. Like absolute offsets. This is done by disassembling the buffer, analize the instructions and remove all unwanted bytes. This way from the buffer is calculated the dsf ident for this buffer. The function that does this i called UnlickCalls() and is implemented in DeDeDisAsm if i remember well. The reults shows that this matching works fast enough when the calles from only one procedures should be processed by the dsf engine. But when this should be done for the whole CODE section this is rather slow. A better method will be if the DSF idents in memory are stored in a sorted tree structure. Then the matching with all dsf idents can be done much faster. May be i will implement this in next version as well :)

quote:
a special debugger... gr8! cant wait ur new release now ;)
PS. are u using debug api for that?

yes i plan to use debug api because it will be ring 3 debugger ;) Its still on a very early stage. Just read your post about trw and remembered i wanted to add debugger in DeDe :D
dion
08-15-2002, 05:14 PM
i would to ask something, what method used by dede in displaying string reference? r u check every opcode byte or parse for xxxxxxxx char? looks like u forgot to filter every char, after i see it in disasm window.

sorry to quote again:
The problem is you dont know which parts from the .CODE section are acctually executable code and which are VCL class info.

mm... do i have to get VCL class info [by scanning for selfptr soFromBeginning] before applying dsf? i thought theres already a label in dsfs.

looking dsf a bit... i conclude that u match pattern per byte, and skipping 0 byte value. if found than index used for read the label. am i wrong?

looking dsf referencing proc... i think u were right, it can be slow. but i've another idea and reasons. the slowest/longest time taken to apply dsf could be measured from (sorry) ur dede, right? as plugin, i could do an ontime processing, ie after typing cmd, i do the process required to apply dsf [maybe using a virtual xport table]. after finished then users can countinue to dbug. so, the next process in unasm proc, i just do a lookup to that virtual table to alter the current call label.

looking at IDAs sig... looks like it using a tree structure, but i dont get the detailed field yet. just wonder, might be u know this in detail, plz let me know.

thking a bit... dont know why IDA take longer time to apply sig than dede. oh... b4 forgot, r u dsf-ing at load or at disasm proc?
DaFixer
08-16-2002, 01:02 AM
quote:
i would to ask something, what method used by dede in displaying string reference? r u check every opcode byte or parse for xxxxxxxx char? looks like u forgot to filter every char, after i see it in disasm window.

For all push imm_data and mov imm_data instructions i check does the pointer points to a pascal ascii string

quote:
mm... do i have to get VCL class info [by scanning for selfptr soFromBeginning] before applying dsf? i thought theres already a label in dsfs.

VCL class info can be usefull because if you know all classes used in the program you can remove the references to the rest of them.

quote:
looking dsf a bit... i conclude that u match pattern per byte, and skipping 0 byte value. if found than index used for read the label. am i wrong?

dont realy understand what you meant

quote:
looking at IDAs sig... looks like it using a tree structure, but i dont get the detailed field yet. just wonder, might be u know this in detail, plz let me know.

yes ida uses tree structure and im also implementing tree structure for dede dsf recognition. You also should implement one :) because the data in the file are in a list. For dede i will read them and put them in a tree on the dsf loading. So later they will be easier to be used.

quote:
b4 forgot, r u dsf-ing at load or at disasm proc?

at disasm proc :)

And some good news ;) The dfm editor development goes very well. I will put a very beta to hear comments on it. It can re create forms, show a tool window with tree structure of all controls and properties and can follow the focus of the mouse while you move over the recreated form. It still doesnt look very good but will be improved.
dion
08-16-2002, 10:49 AM
quote:
When a procedure should be recognized DeDe reads it's first 50 bytes into a buffer.

i cant find the _PatternSize definition anywhere. r u using a fix 50 bytes dsf sig? so, i just have to break each stream after "VCL2 dcu" to 50byte and then do unlinkcall() and match the pattern?

quote:
Before doing the match loop the buffer is processed to remove all not relative data in it. Like absolute offsets. This is done by disassembling the buffer, analize the instructions and remove all unwanted bytes.

case example [1st ident]:
53 push ebx
8BD8 mov ebx,eax
8BC3 mov eax,ebx
E800000000 call ????????
53 push ebx
6800000000 push ????????
B900000000 mov ecx,????????

what i mean with skip 0 byte is like call above, but looks like u do it opposite, thats in unlinkcall. r u sure that only relative data gets omitted or the other too like mov ecx,???????? above?

i just have to deal with .CODE section to get vcl infos, havent i? or the .DATA too?

i cant find the VMT struct. could u tell me wheres it?

quote:
VCL class info can be usefull because if you know all classes used in the program you can remove the references to the rest of them.

remove whose reference? i dont understand it.

so, u dsfing at disasm proc. he-he... thats cheats a bit. btw, how long would it take if u do that with whole CODE section? several minutes? or several hours? ;p

a little about pascal str. i see in disasm example and seeing in hexeditor, that most str refered is C style. how do u manage to disp both pascal and C style work together?

PS. r u coding whole day? anyway, gr8 progress!
DaFixer
08-16-2002, 12:01 PM
quote:
i cant find the _PatternSize definition anywhere. r u using a fix 50 bytes dsf sig?

_PatternSize is defined in DeDeConstants and it has been different than 50 for the earlier dsf versions. For last one 2.1 and 2.2 it is 50.

quote:
so, i just have to break each stream after "VCL2 dcu" to 50 byte and then do unlinkcall() and match the pattern?

Man look at my code :D

quote:
r u sure that only relative data gets omitted or the other too like mov ecx,???????? above?

I remove all data which is relative and also fixed pointers to class instanced and other hardcoded pointers which VCL internaly use. Like mov eax, dword_value. Thats why dsf is much better than ida sig. I made dsf specially for VCL after long analisis of delphi compiler. So the unlinkcalls() procedure does it all.

quote:
i cant find the VMT struct. could u tell me wheres it?

it is not of great importance for coding dsf parrern compare :)

quote:
VCL class info can be usefull because if you know all classes used in the program you can remove the references to the rest of them.

remove whose reference? i dont understand it.

if the target application dont use the unit BlaUnit then you can remove all dsf idents for procs from this unit at the dsf file loading to make the database smaller i.e. faster matching.

quote:
so, u dsfing at disasm proc. he-he... thats cheats a bit. btw, how long would it take if u do that with whole CODE section? several minutes? or several hours? ;p

a lot ;p can be about hour for big executables. It will be surely optimized with the tree tructure and the E8 trick i mentioned. May be will be more than 10 times faster i believe.

quote:
PS. r u coding whole day? anyway, gr8 progress!

Look at my next started thread :)
stealthFIGHTER
08-18-2002, 01:33 PM
Hello DaFixer,

maybe DeDe could accept drag & drop .exes? (for some lazy people :)).

Regards,
sF
DaFixer
08-18-2002, 06:52 PM
Originally posted by stealthFIGHTER
Hello DaFixer,

maybe DeDe could accept drag & drop .exes? (for some lazy people :)).

Regards,
sF

Done :D
dion
08-21-2002, 03:13 AM
if u dont mind, i have a basic question. i've read ur tut D1.htm about delphi preliminary. quote from the tut:

"Have you ever asked the question why Delphi executables are so big in size? The answer is that in them is stored also the code of all classes from the VLC (Visual Component Library) that is needed for your program to run."

i've trying to compile with different "uses" directive results same exe size. at this point, i thought that this VCL package classes function offset would be same for all exes. when i trying to add some codes, the results is rather different classes function offset, but with same DELTA offset. i just focus to classes that have VMT struct, the rest is ignored. from particular ptr in VMT struct, i check it to module window [Ctrl+Alt+M in delphi]. from here, i conclude that i could use this delta offset to unmangle classes member methods, of course limited to the rule above. or, in more simple word, it seems every vcl classes has a standardized class methods lists. the question is, do u feel this can be useful to reduce dsf sig requirement?

P.S. the symtable is ready to used now ;)

thanks
DaFixer
08-21-2002, 12:37 PM
Man have no idea what you call "classes function offset" and "DELTA offset"

quote:
or, in more simple word, it seems every vcl classes has a standardized class methods lists. the question is, do u feel this can be useful to reduce dsf sig requirement?

I dont understand what you call that is "standardized" in class method list. Also what you mean by "reducing dsf sig requirement" do you mean less bytes per pattern?

Note that the methods in a method list from VTM are the published methods and they are defenitely nothing to do with DSFs. Published methods contain only the last classes in hierarchy which are defined by the programmer and there are no dsfs for them. i.e. TMainForm is your main form and it has published methods. The TForm class have zero published methods. From VMT you also can take pointers to the list of virtual and dinamic methods of a class. Low level classes has lots of them. They are also not included in the DSF files because they are not called by E8xxxxxxxx (call offset) but are called by "call [reg+offs]" and this can not be matched from a dead listing. The virtual and dinamic methods are identified by the DOI engine and their references in DeDe are shown like this:

* Reference to control TBPL.LogMemo : TMemo
|
00539144 8B803C030000 mov eax, [eax+$033C]
0053914A 8B10 mov edx, [eax]

* Reference to method TMemo.Clear()
|
0053914C FF92DC000000 call dword ptr [edx+$00DC]

To be able to find them DeDe have to make a pseudo emulation of the code. It acctually only takes care about pointers to classes instances and their fields and methods access.

The methods you can find in the DSF file are not virtual, nor dinamic nor published. The definition, if such exists, is that they are methods called by "call offset".

quote:
P.S. the symtable is ready to used now ;)

Im also almost ready with my tree structure of dsf idents in the memory. Soon will know how long it takes to identify *all* methods in the vcl classes in DeDe itself using the new tree structure. I hope this time will be reduced to less than 30 sec. Currently it will take more than ten minutes i guess.
SilSaLaMaTa
09-06-2002, 03:34 PM
Hi
I have an idea for DeDe .

for example : (435408 == GetText)
* Reference to: controls.TControl.GetText(TControl):System.String;
0050CB5D E8A688F2FF call 00435408

When Dede creates map file for IDA or SICE it looks like this :
.0050CB5D ; > controls.TControl.GetText(TControl):System.String;

I think it would be better if Dede marks 435408 as GetText instead of adding a comment on 50CB5D .
Because Dede only decodes the parts of the prog that r related to the Forms and not all the file .
Sometimes it happens like this :

435408 : xxxx Data refs : 50cb5d , 430598

When u r at 50cb5d you can see the comment and u will know that it is GetText ,
but when u r at 430598 u can't find out that .

It would be better if dede generate the map file this way , and save the time for not marking them manually :D

Sorry for the bad English .
squidge
09-06-2002, 06:23 PM
Noticed the latest version seems to crash when I'm viewing a lot of different forms in the decompiled delphi unit to try and associate the formname with the form I get when I try to reg a program. It's find on a few forms, but when I go mad and start viewing all the forms in turn, it throws up an access violation a few times, and eventually dies. I'll try and get more info on this.

Also, could the disassembled output include jump references like w32dasm normally does (Location referenced by jump at address xxxxxxxx), or would this add too much processing to the otherwise turbo-charged dumping algo?

Ta for a great prog!
asd
05-08-2003, 08:55 PM
First of all thanx for the great app.
Some programs (eg atlast! file notes organiser) kill dede.
and also disable its "FILE" menu.
Is there a way to circumvent this from dede itself like anti antsice

the first one could be overcome by launching multiple instances of dede - so as to feed the hungry app with few ones !!!


LiMan - Yet another "copy protection"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > LiMan - Yet another "copy protection"
PDA

View Full Version : LiMan - Yet another "copy protection"

cyberheg
08-12-2002, 05:19 PM
http://intsoftsol.tripod.com

Yet another license manager has hit the surface. I must say this one looks like honest work though. It is made as a FlexLM clone and although the website looks crappy the product doesn't. Comparing the user interface and documentation to other "single person solutions" this looks professional.

... Too bad the protection part of it is shit though.
All the files are written in MFC compiled in debug mode(!). If this wasn't enough then it doesn't take more then 20 min for a average cracker to break this thing completely.
I can't remember last time I broke a program without using a debugger with only a disassembler.
If any of you bother to look at it you will soon see there are many ways to break it completely. The registration scheme is easy and you can easily write your own keygen for it.
Or if you are lazy you can allways use itself to register itself. It sounds stupid but it works. Inside the keygen you will see the master key which is used for checking itself so you can generate a 30 day trial license for itself using that master key and once you registered itself first time you can allways make a long lasting key.

Another aproach could be to rewrite the dll so you could make a empty dll returning the needed values. It probably doesn't take more then 10 min to make such a dll and should work fine although I havn't bothered to do it myself.

Another aproach would be keygenning and a pattern scanner. From what it looks like the master key must be 20 decimal digits so you could allways write a simple scanner for that and extract strings from any executable which matches these specifications.

// CyberHeg


arm tut
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > arm tut
PDA

View Full Version : arm tut

BenJ
08-12-2002, 11:11 PM
Hi all,

just spent 2 hours reading all posts about armadillo... found plenty of infos (especially Crusader's ideas !), but I'm a little confused now...

AT least one question : how can I recognize wether a target is copymem protected or not ?

Would be great if a specialist could issue a step_by-step tutorial on latest armadillo protection (2.6 ?)... for unpacking newbies (as I am).

I've got a target i'm working on... I can mail the link it if you want.

Thx

Ben

:)
Armkiller
08-13-2002, 10:36 PM
Yep! Post the link, please. I'm sure that I can help you :)
BenJ
08-13-2002, 11:03 PM
Hi Killer, glad to hear from you. In fact I mailed you the target smetimes ago, cause I had tried your armkiller 2.5beta, but didn't work (in fact did not cretae any unpaked exe).

the target is there

Uses new arm sine build 24. former builds I could unpack by myself.

i'm pretty sure a lot of us would be glad to see a detailed tut !

Regards
Armkiller
08-14-2002, 08:45 PM
Quick tutorial:

1. Download ArmKiller http://unpacker.narod.ru/armkiller25.zip
2. Run it. Choose WealthLab.exe (10-Aug-2002).
3. Wait for the first MessageBox. Don't close it.
4. Run LordPE (http://www.woodmann.net/protools/files/utilities/lordpe.zip)
Dump 2 process with name WealthLab.exe.
Check the content of the first section. Erase a dump with zero filled section.
I think that the second process is valid.
5. Run ImpRec (http://www.woodmann.net/protools/files/utilities/imprec.zip)
Choose the right process. Enter this info:
EIP = 2C68D0h IT RVA = 2D01F4h IT Size = A40h
Get Import -> Fix Dump for dump.exe.
6. Run it :)
BenJ
08-14-2002, 09:25 PM
hehehe, not really a tutorial !! ;) ;) ;)

at least I had the right eop....

But the first link doesn't seem to work... is you source code availabe ? I'd like to learn !

Thx
Armkiller
08-14-2002, 09:30 PM
Originally posted by BenJ
hehehe, not really a tutorial !! ;) ;) ;)

at least I had the right eop....

But the first link doesn't seem to work... is you source code availabe ? I'd like to learn !

Thx

Sorry, the right link is:

http://unpacker.narod.ru/armkiller25.zip
BenJ
08-14-2002, 10:05 PM
i'm going to check this out.

Regards
BenJ
08-15-2002, 01:51 AM
Well, I've got some very strange results...

First of all, i'm unable to get any valid process... both have sections filled with zeroes, and executable section is no valid at all.

The only way I can get smthing usable is to answer 'no' to the first msgbox, and let the program load completely. There I can get a dump from the second process which looks valid. But is armkiller still working at this point ? i'm not sure... I had nearly the same results without armkiller. That's the reason why I wonder wether this target is really crypted or not ?

The point is that I'm unable to rebuild IAT... There is always some pointers left unresolved... Did it really work by you ? I've tried under win98 (very bad results) and XP(much better). tomorrow i'll try to install a fresh win2k... and perhaps look for a way to build it manually (looking for tutz... again hehehe).

All comments are welcome
:)
BenJ
08-15-2002, 06:42 PM
well, I really can't get anything from armkiller... In fact, result seems better without : good oep and finally got a complete import table. It's pretty easy cos the IT from the dump is only partially cleared.

But my proggee keeps crashing !

I've noticed that imprec builds some imported fonction, since the original target calls their aliases (for ex. imprec builds lstrcpy but original prog uses lstrcpyA). Is it a problem ? I don't think so...

in fact the real pb is that I don't know wether the dump from which I work is good or not !
_Servil_
08-15-2002, 08:11 PM
hi, I dun the same ver. recently -- the tracer on Win98 didn't work at all, on XP it restore all, but these imps were faked:

GetProcAddressA
LoadLibraryA
WinExec

The ~A suffix I had too -- it signs a non-unicode (ANSI?) version is called thus the changes shouldn't matter unless you run a far-east OS locale. Try inspecting above calls (set breakpoints) and see what really called. Have ya the same results?
Armkiller
08-15-2002, 09:32 PM
Originally posted by BenJ
well, I really can't get anything from armkiller... In fact, result seems better without : good oep and finally got a complete import table. It's pretty easy cos the IT from the dump is only partially cleared.

But my proggee keeps crashing !

I've noticed that imprec builds some imported fonction, since the original target calls their aliases (for ex. imprec builds lstrcpy but original prog uses lstrcpyA). Is it a problem ? I don't think so...

in fact the real pb is that I don't know wether the dump from which I work is good or not !

Strange. I have a dump that works under Win2K. You can download it here:

But I can't run WealthLab under Win98SE. It shows just an exception :(

You can try to dump it with my new version ArmKiller 2.6 :)
(http://armkiller.cjb.net).
kalisto
08-16-2002, 07:42 AM
Hi armkiller link is wrong. NOT FOUND Sorry:mad:
esther
08-16-2002, 09:15 AM
Hi Armkiller,

Please don't post anything like this in here.This is a crack links which is not allowed in here.


Marx Cryptobox
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Marx Cryptobox
PDA

View Full Version : Marx Cryptobox

Sab
08-13-2002, 12:32 AM
Hello, Just curious if anyone has attempted to emulate the processor on this dongle. It appears as though the hardware has been updated since dr fuhrbals essay (I believe it was marx he dumped the pic of). Anyways , would be curious to find out if any attempts were made on this? Uses idea, rijndael and i believe has rsa support. Thanks, Sab.
tgodd
09-03-2002, 07:52 PM
It is the only commercial lock that uses a PIC.
You can glitch the code out of the pic.

At one point in time they did not set the Protect fuse, allowing
anybody to read out the code from the PIC.

But now with the fuse set the only option to get the code is to set-up a circuit which drops the voltage substantially on the power after X number of clock cycles.

You need to determine what voltage to drop too, as well as the number of clock cycles to glitch at. You will also need to figure out the click duration.

This is all I can help you with on this one.
Sab
09-04-2002, 03:15 AM
Thx tgodd for the response, very informative. Thats about all I needed to know about it (: 4 dongles down, 4 to go (:

-Sab


Cloning Sentinel Dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Cloning Sentinel Dongle
PDA

View Full Version : Cloning Sentinel Dongle

cah
08-13-2002, 01:13 PM
To,
All Dongle Reverse Engineers

Is it possible to clone sentinel dongle?

How to read/edit a sentinel dongle?
knowledge base on this subject is highly appreciated.

Regards
Cah....
Morlac
08-13-2002, 02:51 PM
Apparently, you can, to a certain extent that is.
Some cells are not readable. Like counters, passwords, and algorithm cells.
Counters are no issue.
The problem is getting the 2 overwrite passwords and the algorithm cells.

Those where the only cells I couldnt reveal in a sentinel dongle.

Morlac.

PS - I dont know about hardware cloning though.
cyberheg
08-13-2002, 06:16 PM
Same problems arises with the SproQuery function which seems to be tied to the developer id and a 32 bit value (2 cells) in the memory.

// CyberHeg
cah
08-14-2002, 09:48 AM
Thanx for your reply.
How to edit/read sentinel dongle? Any tools/utilities available?
How to find queries form dongle? If I have sentinel dongle.

cah...
cyberheg
08-14-2002, 11:57 AM
There are plenty of tools availble, look at CrackZ mirror website.

// CyberHeg
scorpie
08-14-2002, 03:30 PM
Yes, in general it would be difficult to read "Active Query Cell", although in some program there is a "leak" with this Cells as well (Overwrite function needs write and overwrites passwords). So, if there is an upgrade facility, there is a chance for "leaking".

My question with cloning is: "is there any possibility to program the SuperPro with any Id if let say we can have access to the dongle programmer or to the IC programmer in general ?"

Bye,
Scorpie
warior_jal
08-14-2002, 03:39 PM
Hiya Cah!

contact me on my other mail ID, I am working on the same but with a different approach.
VoxQuietis
08-15-2002, 07:20 PM
Hi there Dongle reversers,

Some comments on the (Super)Pro:

- first of all get the SDK and (if possible) a dongle to play with
- then as a little exercise, write a program to read out all the
readable dongle cells. This is nice to gain some overview on
the dongle.
- then launch a brute force attack on the write password (but be
careful and use an empty cell for doing that). The attack on
the write password will take no longer than a couple of minutes.
- a brute force attack on the overwrite password is feasible,
but it will take a couple of month ( 2..12 depending on the
amount of luck ;-) to go.
I had to do this on a specific dongle some time ago, and there
is nothing special about it.
- reprogramming the D/I or the S/N should not be possible (at least
if You access the dongle through the standard API/driver).
Most likely there is a backdoor, which allows to reprogram the
dongle. But a possible exploit would require a dump of the
PIC device, which would require to remove the coating around
the chip plus access to a PIC programmer with a wafer prober.
(no need to stress the importance of a dump of the PICs
memory. I guess any Sentinel guru would love to put the
dump into IDA...)
- logging the query-calls is possible, and therefore it is
obviously possible to program an emulator around the logged
data.
- the buffer used for the I/O to the dongle is encrypted. The
encryption/decryption routines can easily ripped out of the
driver or a client application. The encryption towards the
dongle is slightly different than the one towards the
client.
- if You want to change the behaviour of the dongle driver
towards a more convenient operation (why to plug a dongle
to the backside of the box, if the results are clear in
advance? ;-) You should write a filter driver, which
attaches to the dongle driver. This is - by the way - a
fundamental approach, which should be applicable to all
dongles.
- it is possible to direct a query to a readable data cell.
Maybe this could help in reversing the query function,
which I presume to be a tedious task anyway.

So for the time being, the Superpro is not compromised, even
though it is most likely a cassical example for "security by
obscurity".

best regards
- Vox.

PS: Although I promote the idea of free information for all
(and I freely admit that I hate dongles for practial reasons...)
I would not like to see dongle cracks based on the mentioned
principles spreading over the warez sites to all the lamers
of the internet. I will therefore be very careful in discussing
the details of the above mentioned topics. I expressively don't
want that the Sentinel stuff gets a victim of something like
the Blastsoft release with about a hundred of Flexlm seeds.
I hope that the readers of the forum do understand and respect
this point of view.
cah
08-17-2002, 05:10 AM
Give me your mail ID
Cah...
Antipodean
08-20-2002, 01:05 PM
>- reprogramming the D/I or the S/N should not be possible (at least
>if You access the dongle through the standard API/driver).
>Most likely there is a backdoor, which allows to reprogram the
>dongle. But a possible exploit would require a dump of the
>PIC device, which would require to remove the coating around
>the chip plus access to a PIC programmer with a wafer prober.
>(no need to stress the importance of a dump of the PICs
memory. I guess any Sentinel guru would love to put the
dump into IDA...)

Are you sure they use a PIC micro in them?

If they do, then the programming function is by a serial protocol through a pair of data pins which change their function by putting 13 volts on the MCLR pin. I doubt they will have set the chip to low voltage programming mode, but they will surely have turned on the code protect, which will stop reading out the code.

The MCLR pin and the data pins would all be accessable through the normal dongle pins, so there would be no special pads needed to program the device from a blank chip.

In short, if it is a PIC device, your chances of reading it out are very slim.

You will not need IDA to dump the code if you ever get it out. Just load the hex into the Microchip MPLAB, and it will provide a complete opcode listing :))
scooterk
08-21-2002, 02:48 PM
I thought there is something on the web showing a clone using an Atmel ASIC 93C46 using an external power source and assembled onto a pc board which is housed into a 25 pin connector resembling a dongle key.
My question is how is the actual chip on the key read and then copied?
via software or via watching the output from multi-trace scope patterns (when the key is accessed), or can one clip to the chip using a hardware emulator?
scooterk
Antipodean
08-22-2002, 05:13 PM
>I thought there is something on the web showing a
>clone using an Atmel ASIC 93C46 using an external
>power source and assembled onto a pc board which is
>housed into a 25 pin connector resembling a dongle key.
>My question is how is the actual chip on the key read
>and then copied? via software or via watching the
>output from multi-trace scope patterns (when the key is
>accessed), or can one clip to the chip using a hardware emulator?
>scooterk

I believe some of the very early dongles had exactly this chip in them, but done as a "chip on Board" where the bare chip is mounted on the PCB, and then covered with a dob of epoxy. The later dongles which can protect locations and do encryption have a micro in them, a bit like a smart card.

The 934x family of chips are serial interface eeproms, so the host PC clocks out the data under software control. New chips are easily programmed using a similar write sequence.
VoxQuietis
08-23-2002, 04:43 PM
Hi there reversers,

to my knowlegde there are only two dongle diagrams published so far. First the C-Plus dongle, which is the one with the EEPROM device mentioned above. I saw it first on the famous essay of Dr Fuhrball. The protocoll is known as 2-wire protocol. All the information is available, at it is both easy to dump the dongle and to clone it.
The second one is the Pro. It is build around a Catalyst CAT-702 chip (I'd be glad if someone could point me to a data sheet of that device). Here the diagram itself is of little interest, since the security is relying on the CAT device.
Wrt to Superpro I am far from shure, whether it is based on the PIC. Nevertheless Dr. Fuhrball made a comment pointing into that direction. On the other hand it seems perfectly matching, that one uses a PIC, since the development of a program is by far cheaper than the development of an ASIC - the ASIC results in NRE cost of at least 30.000 $, and I doubt, that there are that much dongles around, for the ASIC solution becoming cheaper than the PIC approach.

Bye
- Vox.
scooterk
08-23-2002, 05:20 PM
Thanks for the response on this.. I find the hardware/software aspect of making a clone to be an interesting project.
I found an interesting setup form Christian Scheurer using an Atmel AT90S8515 ( 8 bit RISC microcontroller) , however the board is quite large considering it uses a 40 pin layout .. but the article proved interesting. ( The original article is in German ).
scooterk
scorpie
08-24-2002, 04:21 PM
Hello there,

Nice explanation VoxQuietis, Antipodean, Scooterk, etc.

Just to add concerning Superpro:

It uses only pins 6, 7, 11, and 18 (ground) on the male connector (which is connected to the Parallel port), and the old dongle use CAT 701. During programming, the female connector is fed by some signals from the programmer.

Although my German is not good (Deutsh ist schwer), kindly let me have the article (Scooterk ?).

Bye,
Scorpie
cah
08-25-2002, 04:22 AM
Hayya Scooterk, VoxQuietis, Antipodean & others,

Please attach or give url path for these articles/knowledge base.

Cah...
tgodd
08-25-2002, 06:44 AM
As far as the PIC issue, it is not a PIC.
It is an ASIC, simular to an FPGA but a totally custom chip.

As far as the SproQuery it is not tied to the LockId at all.
It is in fact tied to the Write Password.

Have a close look at the Patterns it generates.
You can see the shifting that goes on.

hint, hint

It a big shift register and toggle.

That's about all I can tell you.

chao!!!
toteu
08-25-2002, 06:05 PM
Also related to SSPRO shell (SPRO also)
We know that the values(responses from sproQuery) used to decrypt code and data sections are in range (0 -> 2^32).
If we have the dongle these are easy to get/log, if not we can bruteforce them in some cases.
What is interesting is that there are always 3 values(in 0->2^32 range) that decrypt the sections in the same way.
In other words beside sproQuery response, there are other two values that decrypt the section identically.

TOTEU
scooterk
08-26-2002, 02:35 PM
Hi scorpie,
This is a sample of the documentation I have on the hasp project using the ATMEL chip. The documentation is written in German.
There are 80 pages to the article and due to size limitations of uploads I've attached the first 9 pages.
If you are interested in the rest of the atricle I can email it to you, (approx 691K in size)
scooterk
VoxQuietis
08-26-2002, 03:29 PM
Hi Scorpie (and all RSEG readers)

The mentioned article ist here:

http://www.mountpoint.ch/unique/project/usph/index.html

Just out of curiosity I scaned over it, and I think, it
might be helpful, if I summarized it up: This guy acquired
a "Gesellenbrief" (i.e. a grade after a three year education
in a craftmanship) by doing a practical work, which was the
design of a dongle.

He started by a small assessment of possible attacks and
came to the conclusion, that a device using a microcontroller
running the dongle S/W with some crypto-stuff inside would
be a nice solution. He developed the uC program in assembler
(due to the lack of a C cross compiler, which was found to be
too expensive) plus a PC console application runing on all
versions of DOS from 3.0 to Win95 ;-) Getting it to work
on WinNT was found to be "possible in principle" (which is
a mere alternation of "not possible for me" :-P

Anyway the Atmel listings are there, and if someone
replaces the crystal by a crystal oscillator, then
one could use it as a platform for a dongle emulator -
whereas the problem of triggering the emulator needs
to be redesigned for each class of dongles.

On the other hand I need to stress, that the crucial
point of an emulator remains unsolved: the complete
reversing of the target dongles internal operation.
This is solved for the C-Plus and for (at least the older)
Hasp dongles, but not for the Pro and Superpro.

Moreover the H/W emulator suffers from the same shortcomings
than the H/W lock itself: it is far more effective to implement
the copy protection in S/W than in H/W: as a cracker I'd
rather program the emulator to run on the PC-CPU directly
than to reengineer the communication S/W plus the dongle core.

"You should not copy a faked hardware protection" (this shall
be my first commandment ;-)

Finally some stuff for the German speaking readers of
the board:

> Vergleicht man aber USP!H mit Software – only
> Kopierschutzsystemen, so bringt die Hardware
> doch einen erheblichen Sicherheitsgewinn, da
> diese schwer nachbaubar ist und vorhanden sein
> muss, wenn das Programm gestartet werden will.
> Dongle – Cracks gelten nach wie vor als die
> Herausforderung für Cracker. Denn sie verlangen
> eine eingehende Kenntnis des Computersystems sowie
> eine gewisse Erfahrung mit Hardware.

This could be ripped straight out of a Rainbow-ad.
And now the best goodie:

> Und das schaffen von den bekannten Crackern beispielsweise
> in der Schweiz wohl nur eine Handvoll.
(From the known crackers in Switzerland only a few are
capable to do that)

ROTFL - and within that spirit the usual dongle protection
is written. As Christian Scheuer mentioned he searched the
net for dongle stuff, I expect him to have crossed Crackz
site. But he clearly proved not to have unstood the message.

Best regards,
- Vox.

PS: I have an open Sentinel Pro here on my desk. It features
a CAT-702. If someone minds, I'll upload a picture of it.
scooterk
08-26-2002, 06:52 PM
Hi,
I'm glad you posted the info. I wasn't sure if I should post the Url, but a quick search in Google would have given the website.
I would like to see the pix of the 702 though .. if you could be so kind ;)
I still have an interest in the hardware side of this.. hopefully some more tid bits of info will happen by.
It is like a forum that I visited on reprogramming the prom chip for my GM automobile. A little hardware info, and some software implementation... allows to to tweak the chip for better performance.
scooterk
tgodd
08-26-2002, 08:46 PM
The remarks given were not necissarily true.
As for the hardware in the pro & superpro not being
already reversed. The Pro was done back in the 80's.
As for the super pro there are 2 generations of superpro.

The first gen. was cracked in 93'.
And since then Rainbow has enhanced the superpro by adding
an enhanced algo circuit. They did this to remove the linearity
of the original algo unit.

The super pro algo was really an alteratrion on the pro.
the pro was a straight data in data out algo unit.
The super pro enhanced on this to accomodate memory cells
which could alter the effects of the algo unit.

The new gen of superpro enhanced algo has not thus far been cracked.
scorpie
08-27-2002, 01:50 PM
Hello VoxQuietis,

Thank you for the info about the article(s), and it seems to me that it is a good article(s).

To Scooterk,

Thank for a partial info on the subject.

To Tgodd,

Where can I find the article(s) about the SentinelPro/SuperPro have been "reversed engineer".

I believe the old Pro (with CAT 702) just deploys a PROM, so it is unlikely that it can be reprogrammed, while SuperPro should contain a kind of EEPROM (I agree with VoxQuietis that it is unlikely that Rainbow uses ASIC).

Bye,
scorpie
tgodd
08-27-2002, 01:57 PM
Actually the pro is only about 7 or 8 flipflops, depending on the model.

The Cat is a Catalyst number.
Catalyst make Custom Asics.

It is most likely that in manufacturing the ID, Write Password and overwrite passwords are fused. This means that once programed for an OEM they can not be reprogrammed.

Keep in mind that this is not a processor which can be
'glitched' into submition, such as a PIC.

And as far as Tutorials; there are non on the pro and spro
internals.

A company called safekey (formerly SafeSoft) cracked those back in the 80's and early 90's, and sell emulators for these lock devices.
scorpie
08-27-2002, 02:39 PM
Hello Tgodd,

What kind of Flip Flop can "store" information without power ? There is no Id, Write Password, etc. on the SentinelPro. There is only Family Code and "algorithm" (programmed by Rainbow or their distributors).

Bye,
Scorpie
tgodd
08-27-2002, 03:18 PM
The sentinel pro has no memory only flipflops.
connections between the flipflops are fuses which are
blown or not blown which define the algo.
What distinguishes one Pro from another are the clock, data, and
turn on bits on the parrallel port.

The sentinel superpro on the other hand does have memory.
eeprom. When the encrypt command is sent to the lock device the latches are preloaded with data from the memory cells.

Believe me I know what it is I speek of.

I was coding lock emulators 14 years ago.

Just a note.

The earliest Sentinel Pro locks were about four to five inches in length.

Used to use discreet logic.
scooterk
08-27-2002, 03:39 PM
Hi
I'm curious about this.. If a custom ASIC is used then, when you
program a hardlock for instance.. the keys are not preprogrammed, but rather programmed from the board plugged into the computer. My question is .. are the keys blank ASIC's or are they EEproms? (because they can be reprogrammed?)
And if so could you make you own keys.. (hardware) or are the chips proprietary?
scooterk
tgodd
08-27-2002, 09:35 PM
When you design a custom asic you can have it design with
eeprom memory included on the die.

You can also design it so that certain memory cells are fused
so that once written they can no longer be reprogrammed.
(this was done with the super pro)

So Rainbow when they receive the manufactured lock devices,
will program in the First eight bytes of memory which contains
the Lock ID, Write Password, and the 2 Overwrite Passwords, Etc.
and these cells once preprogrammed by Rainbow can no longer
be reprogrammed.

And As for getting blanks of these IC's, It's a no, as Catalyst
will only make these Dies for Rainbow.

The SuperPro has (not including the memory) approx. 10000+
logic gates.

Not an easy device to emulated in hardware.
Unless you are skilled at designing State-Machines.
tgodd
08-27-2002, 09:42 PM
Oh yes.

And as for the Hardlock The Algo unit there is 2 16bit selectors and 6 2bit selectors and about 8 or 12 flip flops.

The Hardlock die does not include the memory on the die.
However the die does include eeprom memory cells which program at a high voltage which are for the purposes of containing the encryption seeds.

The device can be programmed with the programming board, if you know how to manipulated the board to use diffent developers codes.
scorpie
08-28-2002, 07:58 AM
Hello tgodd,

I am afraid you are mistaken again.

The SuperPro can be blanked again provided you can access to the programmer. You can assign a new ID, Password, and Overwrite Passwords to the blanked Superpro (of course with the Essence file you have). Once, I bought these dongles, and by mistake I got a couple of dongles with different ID. The distributor just reprogrammed them with my ID. This contradict with your statement that the SuperPro can not be reprogrammed.

Bye,
scorpie
tgodd
08-28-2002, 04:02 PM
Are you sure it was a SuperPro lock device and not a Hardlock.

I continually see people posting about alladin hardlock.
Alladin only bought Hardlock.
Harlock was developed in germany by F.A.S.T

Also the activator was originally developed by a company called
Sofware Security Inc. and was later purchased by rainbow.

Most of you newbies haven't even seen a lock 4-5 inches in length, which is how big the original sentinel pro was.

If the SuperPro can be reprogrammed, then why isn't anybody doing it. Proffesionally as a lock replacement service.

Are you also going to dispute the fact that CAT on the rainbow chip is not a catalyst number?

Might I suggest getting a-hold of the largest magnifying glass you could find and have a look at the chip.

And not discounting the possibility that the superpro's first eight words of memory may not in fact be fused, as far as I know Rainbow is the only company which can reprogram the Lock ID.
They do not release (as far as I know) any devioces which allow a superpro's first eight bytes to be reprogrammed.

And do not kid yourselves people, the lock device industry is a muli-million dollar business. The development cost to develop some of these locks is in the millions of dollars.
The only reason I state this is because I have read someplace refered by many posts that the lock device industry can not possibly be that large.... It's HUGE.

I've been doing this far too long to know otherwise.
VoxQuietis
08-28-2002, 06:56 PM
Dear tgodd,

please calm down. Newbies might generate a lot of obsfucation just by the lack of experience. I learned quite a little bit on the Pro/SPro during this thread.

W.r.t. the mixing of all those different dongles You are right,
that one should better be exact, since exactness is one of the
most important things to practise in S/W rev-eng.

I got in touch with the SPro about three or four years ago, i.e. I never saw the old-style Spro. The S/W protected by this little beast was in the order of 100k $. Nevertheless the implementation was poor (Flexlm plus some own onraments :-) Anyway I had the dongle free for a brute force attack on the overwrite password, which did succeed after little more than two month. Moreover I developed a filter driver (WinNT, it is a great OS) to emulate the dongle plus a logger consisting of a kernel mode driver and a Perl script. It allows me to run a log with the dongle and then compile the emulator with the data extracted by the Perl script :-)

It lacks of course a model for the query answer. Up to now this proved to be nothing more than a little bit unconvenient. Anyway I would be a huge step to have a generic solution. I will have a look on the stuff when being back from holydays.

Do You think it would be feasible, to separate a model of the query processing in a data shifting operation plus a (a priori unkown) boolean function. Then it might be feasible to run a set of (carefully selected) queries on an actual dongle to derive a table with sufficient information to synthesize the function by the means of a VHDL synthesis tool. While this procedure needed to be applied to each algorithm it nevertheless would be a major step towards the generic emulator.

W.r.t. the Pro CAT-701/2: Our sysadmin gave me an old Pro device as a gift, since he knows about my addiction. The first thing I did was cracking it up, and it contains a CAT-702 labeled chip. I'll put a photograph on the net in the next few days (despite the fact, that there is not much special on it).

Actually I am trying to extend my logger to the iButton parallel port dongle, but this thing is a mean beast. It floods You with hundreds of driver calls to derive a simple serial number. Gladly enough the driver is small (only 7 k), thus complete revering of the driver is feasible (and the approach I selected). They do sinful stuff: the store information on I/O processing into the device extension. I wonder, whether this is a safe approach for multi dongle / multi CPU machines. Anyway I don't have results up to now.

Best regards
- Vox.
tgodd
08-28-2002, 08:38 PM
There is currently a company that sells a generic emulator for the superpro. Unfortunately that emulator does not currently work for the enhanced algo.

SPRO points to remember:
Algocells are two memory cells starting on an even address.
The data in the second cell is masked with 03fffh.
to activate an algo cell the data in the odd cell is masked with
08000h and to for the algo into enhanced mode the data in the odd cell is masked with 04000h.

And all new Overwrite2 passwords have the 04000h masked on.

This renders SafeKeys reader useless on any of the Newer SPros.

From my own analysis of the algo unit, it's response is based on the write password and the cell pair data. And through statistical analysis a table can be constructed to evaluate the cell contents. Once one has the cell contents one can determine the write password through an emulation of the algo unit.

I beleive that the enhanced mode throws in another variable (not sure which variable that is as yet), as well as another stage of flipflops of which the responses can not be seen they only have an effect on the Original stage. This throws the statistical analysis out the window.

Even with a super computer I calculate that it would take approx. 5 years of calculation to generically determine the Cell data on an enhanced mode algo cell pair.

I doubt that the cell pairs will be readable or read reversable.
tgodd
08-28-2002, 08:45 PM
Problem with the iButton is it is sooooo timing sensitive.
VoxQuietis
08-28-2002, 11:10 PM
Dear tgodd,

You say, the algo response is dependent from the write password. OK. Do You think of the dongles 16 bit write password, which resides in cell #3?

I think, this can be bruteforced within 2 minutes. Or do I miss the understanding a conceptually important point within Your explanation of how the query algorithm works?

Best regards,
- Vox.

PS: I got the best optimism, that my iButton emulator will be _extremely_ timing independent ;-)
tgodd
08-29-2002, 12:42 AM
Using brute force yes.

You can in fact get the write password.
But it is a destructive method, as you have to attempt to write memory to do it.

What happens when you have a SPRO which has ALL of it's cells written as hidden or Algo.

You can Query cell 4 (Overwrite passwords) and determine
the Overwrites as well as the write password from a Query.

But in order to do this you need a working knowledge of the inner workings of the SuperPro and it only works on the older versions of the SPRO.
scorpie
08-30-2002, 08:36 AM
Dear VoxQuietis,

I am curious about the Overwrite passwords "retrieval", so I have a question for you. To read the Overwrite passwords, do you treat them as 32-bits ? Write Password has been solved by the one who has the "base-ball" web-site for obsfucation (I think you know who he is) without destroying the overwrite password at all (you are absolutely right again that on the average it takes two minutes to read it).

Do you mind if I send you a sort of "personal e-mail", as I do not like to expose some "sensitive information" ?

Regards,
scorpie.

To tgodd,

I have found a biggggggg magnifier as recommended, namely a smallllll round window on the Hardlock Cover (as well as Hardlock TWIN). I can not find the magifier on the SuperPro which is reprogrammable by Rainbow Distributor who have access to the programmer.

Regards,
scorpie

Regards,
scorpie
VoxQuietis
08-30-2002, 11:37 AM
Hi scorpie, (and tgodd)

bruteforcing requires the dongle to have an unused cell,
which had been the case for all the Superpro's I have
seen up to now (about five). I expect this to be the
general rule rather than the exception.

Anyway, You just run a write within a loop, until You
caught it. (if You drop me an email address -> voxquietis
@gmx.de. I'll send You the full source. there is nothing
special about it, it is just to boring to be posted in
full length)

: writeData = 0;
: cellAddress = 0x8;
: accessCode = 0;
:
: for (id = 0x0; guess < 0xffff; guess++) {
:
: writePassword = (unsigned short int)guess;
: spStatus = RNBOsproWrite(ApiPacket, writePassword, cellAddress,
: writeData, accessCode );
: if (spStatus == 0) goto FoundWP;
:
: }
: printf( " Brute force WP failed \n");
:
: FoundWP: ... display the result

Bruteforcing the overwrite password(s) works similar, but is
_very_ time consuming. With a proper amount of bad luck
You might run the dongle for little less than a year.
So You better catch an old PC and place it in the garage
(or in the lab, as I did ;-) and let it run, just looking
once a day, how the scanning goes on...

To extend the stuff for a fully programmed dongle would
be a major project, yet under the assumption that the
simple query mechanism is known it should be feasible:
One would direct queries to all the cells until finding
one, which returns such a return value. This should be
possible after directing a set of queries to that cell.
I'll have a look when being back from holidays.
Then according to the statements of tgodd both the content
of the cell and the write password can be recovered, and
the brute force attack on the OP can start.

This seems to be everything, which is possible today.
But maybe some unkown genius takes a deeper look on the device
and solves the riddle.

Bye,
- Vox.
tgodd
08-30-2002, 04:02 PM
AnyBody here have a SPRO manufactured from 91-95??
Let me know...
tgodd
08-30-2002, 06:13 PM
Keep in mind that the Overwrite cells can be queried to acquire not only the password, but the Overwrite passwords as well.
cah
08-31-2002, 04:50 AM
How to find SPRO is manufactured from 91-95?
I have one old sentinel dongle.
Explain me, how to find.

Cah...
tgodd
08-31-2002, 05:06 AM
Sentinel makes several different types of locks (dongles).

Here is a list:
- C
- Scribe
- Scout
- Pro
- SuperPro

Keep in mind that these are all based on completely different
technologies.

The SuperPro however, (this is not a well known fact) has 2 flavours and it is not possible really to tell them apart, as far
as I know, whithout attempting a query on cell 2.
The newer SuperPros will not allow a query on cell 2.
There was a hole in the original design which allowed one to query cell 2 (Overwrite passwords).

And with a working knowledge of the lock internals one can
determine the write and overwrite passwords from the older
SuperPros.

Do not confuse the PRO with the SuperPro (SPRO), they are
distinctly different.
tgodd
08-31-2002, 02:42 PM
Just a note because I forgot to mention.
Rainbow also bought MicroPahr, a lock which originates in france,
and Activator which was manufactured by a company called
Software Securities Inc.

MicroPhar = only memory.
Activator = 3 Counters and memory.
Morlac
09-02-2002, 09:36 AM
Hi everyone,

Have anyone noticed that cell 5 is actually readable and not hidden like the rest of cells from 2 to 7?
The driver does not allow reading cells 2 to 7 with a simple check.
If you remove that check you can read them. Cells 2 to 7 apart from 5 will return invalid data. If I remember correctly, 0xffff are return for them while cell 5 returns 0x0000.

Could somebody check if a dongle has anything stored there?
Mine contains 0x0000 only. Its a SuperPro Sentinel from Globetrotter FlexLM application.

Morlac.
tgodd
09-02-2002, 02:30 PM
I am affraid you have yet over-looked something.

If you read the SPRO through I/O to the parrallel port
you will notice the following facts:

cell/attribute
00/1
01/1
02/3
03/3
04/3
05/1
06/1
07/1

And I have no problems reading any of the cells defined with
attribute 1.
One thing as true that cell 5 is allways 0.

As I've been saying all along, is that if you query cell 2 and get an invalid response (you can only tell by the returned data), then you have a newer SPRO. If you get what appears to be proper encrypted info then you have an older style SPRO.
mueller5321
09-03-2002, 10:40 AM
@tgodd
Do you have some information about how to change the costumer
code of the hardlock dongle?.
You are right with the comment about the reprogramming of the hardlock. it work without any trouble.

I have a CPC (programmer card of hardlock) in front of me.
The magnifier you mentioned seams to be the booster circuit
ICL7662.
But is also obvious, that the dongle chip at it self is a asic.
It have the old FAST label printed on it is produced by Philips.
So it can't be a Microchip PIC :-) so you there also right.

Additional on CPC a 93C46 is present, which seams to hold the costumer id.

Are there any more detailed information about the hardlock?

Some seams to know which algorithm are used inside some dongle, but there are no implementations of this knowledge.
(knuth, feal e.g.)
tgodd
09-03-2002, 01:05 PM
I can assure you that there are only about 4-6 people world wide that know how the fast algo works.

And when I say, know how it works, I mean can also calculate the 3 seed values. There are also some people who make claims to know how the fast algo works, but are unable to calculate the seeds, and this is because the only thing they know about the Fast is what they have seen in somebody elses code.

I have to appologize first that I can not give you any more info than what I am about to give you.
In order to program a fast you need a fast.
You will notice that there is a fast asic on the programmer board.
The fast on the board has to be re-programmed.

I am unable to tell you anything more than this.
tgodd
09-03-2002, 02:46 PM
CaH

Sorry I can not give you more.
I hope that gives you enough to play with.
neemous
09-04-2002, 02:58 AM
I mean no disrespect and will probably look like an
idiot for asking....
Why? Why wont people say what they know about dongles?
When bajunny fixit meteo blew hasp3, the whole world
knew about it....or were those guys just disgruntled
aladdin workers? Or does aladdin/rainbow have hired
thugs that would find and harm loud mouths? When new
aspr, vbox or some super packer come out with a new
version everybody is all over it...and speak openly
about it...what is the difference?
tgodd
09-04-2002, 05:19 AM
All of what they figured out about the Hasp was first figured out in 91 - 92, and not by them I might add.

Most of what they have documented would appear to me to have been reversed from one of these emulators from the past. After all, they did not have anything on the hasp until 94 - 95.

Now do not mistake me, I am not saying that they didn't figure it out on their own, but if the wheel exists why reinvent it.

If you look at their code it does in fact look alot like the code from the earlier emulators.

Reversing is what we all do, so no disrespect to them, no matter what they did. At least this is my view.

You also have to realize that some people have to worry about feeding family, so you can not disrespect the fact that time spent, accounts for quite an investment.

So you see why some people can not be totally forth-right with information.

Believe me, I wish I had the Hints when I first started.
JMI
09-04-2002, 05:20 AM
neemous:

Perhaps you noticed that tgodd stated he was "unable" to provide the information, not that he was "unwilling." You might give some thought to the possibility that he is under some "legal" constraint from disclosing certain information. This is just a guess on my part, but that is what it sounds like.

Regards.
tgodd
09-04-2002, 05:21 AM
Yes you are right JMI.

I do have some legal obligations not to be overly forth-right.
tgodd
09-04-2002, 05:26 AM
Alot can be said for the FUN of the chase, so to speek.

It is alot more fun to figure it out on your own, rather than
have the answer presented to you on a proverbial platter.
cah
09-19-2002, 08:40 AM
To,
All Dongle RE,s

How to find & analyse of Sentinel dump, their algo/queries & their responses and seed codes.

If any one, publish an article on sentinel emulation, It will be very useful for newbies.

Cah...
melinelmago
09-23-2002, 06:47 PM
For read the sentinel superpro dongle I used sprodump.exe from +spath, and I known that the program search the write password but I don't know how.

Anybody know how to search the Write Password?

Thanks,
Melin:D
paulofutre10
02-14-2004, 09:27 AM
Can you give me the email , of VoxQuietis

I need to do a brute force attack to the overwrite password , of sentinel superpro

Thanks
Paulo Futre
paulofutre10
02-14-2004, 09:49 AM
I went to www.safe-key.com and download sentread.exe ( for read the sentinel superpro) , its generate a file . I open that file with a hex-editor .

in the 03C0h is (exemple) 0001 E08B 0000 0000 3254 0000 0000 0000
1º - Is the number of dongle ( i´m not sure)
2º - ID is 8BE0
5º- The Wirte password is 5432

I think that the 3º and 4º is the overwrite password , but the reader can´t read .

CAn you help me find the overwrite password ?
I read in this forum , that is a way with brute force attacak , Can you teach me how to do ?
tgodd
02-21-2004, 01:46 PM
I beleive that in an earlier post, I had mentioned that the SuperPro Algo on the new generation Superpros had not yet been cracked.

I lied.
:)

tgodd
Cata
03-05-2004, 01:57 AM
Hi everyone,

Is it possible to recover overwrite passwords without brutte force for
superpro new generation?
I read all post about it but I don't have a clear answer.

Thanks for replaying!!!!!

PS After digging in sentinel driver seems the final check is in dongle.
(exists a check in driver but is eassy to bypass and it's not enought).
tgodd
03-05-2004, 08:19 PM
Hi everyone,

Is it possible to recover overwrite passwords without brutte force for
superpro new generation?
I read all post about it but I don't have a clear answer.

Thanks for replaying!!!!!

PS After digging in sentinel driver seems the final check is in dongle.
(exists a check in driver but is eassy to bypass and it's not enought).

NO
Cata
03-10-2004, 01:42 AM
How is it possible to disable an alghorithm? (opposite of Activate function)

Thanks!
nikita@work
03-26-2004, 05:34 PM
How is it possible to disable an alghorithm? (opposite of Activate function)

Thanks!

It can be done only if you know algo descriptor and know overwrite passwords... both can be bruteforced in several days if there is a working dongle!
korvak
04-13-2004, 09:19 AM
nikita is there a source for the program that will brute force the "Over-Write" password for the Sentinel SuperPro. i found the one by spath+ that will brute the "write" password, but i have not found one that will brute the "Over-Write" password. any help in pointing me in the write direction here has my many thanks.

korvak
nikita@work
04-13-2004, 11:58 AM
nikita is there a source for the program that will brute force the "Over-Write" password for the Sentinel SuperPro. i found the one by spath+ that will brute the "write" password, but i have not found one that will brute the "Over-Write" password. any help in pointing me in the write direction here has my many thanks.
korvak

as far as i know there are no freeware tools, but you can reverse sspro driver and rip all you need... if strip all checks it will increase speed in several times...
sapu
05-13-2004, 01:13 PM
Edited by Woodmann


"CloneCD" for floppies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > "CloneCD" for floppies
PDA

View Full Version : "CloneCD" for floppies

foxthree
08-13-2002, 02:51 PM
Hiya folks:

What would you guys recommend for a bit-by-bit copy of a floppy disk. I think I have some funny protection with me which can be bypassed if I have something like a CloneCD for floppy disks. What do you guys recommend/use?

Signed,
-- FoxThree
Athlon
08-13-2002, 03:02 PM
WinImage?
salsa
08-13-2002, 03:05 PM
Hiya,

BadCopyPro by jufsoft might do.

Regards
naides
08-13-2002, 03:11 PM
h**p://www.dtidata.com/products_media_tools.asp

1-I have used it and works reasonably well.
2- Weird floppy access protection used to be the rule in prediluvian times. And perhaps some newbie protector might have rediscovered it.

breakpoint on int 10h may help isolate the disk check routine.
foxthree
08-13-2002, 03:31 PM
Hiya folks:

This is not some newbie protection but the ol' and infamous StopCopy - Touted to uncrackable by someone on this board (I forget the link I found when I searched this board). This is one tutorial by snotty2 on StopCopy protection but I wonder if the protection is *still* so lame. I think it would've evolved a bit, don't u think.

Anyways, I'm going to have a few laughs :D

Signed,
-- FoxThree
mueller5321
08-13-2002, 05:52 PM
Forget the expensiv solutions :-)
The really best tool i know, is freeware and very old (about the 80's).
it is called anadisk.
You can found all over the net.
It is a mddos program, which is nomal used for analysing of disks but it can used as copyprogram.
I have used it for a lot of different diskprotection types with really good results :-)
It also show you which track is used for the protection.

You have to start it under MSdos not in the dos box !!
h8er
08-13-2002, 11:05 PM
Another good program is Grduw if you want it contact me in pm..
dion
08-14-2002, 03:32 AM
try powerful winhex ;)
foxthree
08-14-2002, 02:33 PM
Gee folks:

Thanks a bunch. h8er, I'll try the program suggested by mueller before giving u a holler :)

Signed,
-- FoxThree


Asprotect trick?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect trick?
PDA

View Full Version : Asprotect trick?

banshee
08-13-2002, 07:43 PM
I tried to unpack JavaSMS
h**p://www.vd-soft.com/downloads/JSMS124.zip
It is ASprotected, don't know the version. I've found OEP, dumped and rebuilt imports using ImpRec. Everything is fine but there are errors: "Access violation. Memory cannot be written (or read)". I traced that places, there is something like "mov [eax], edx" and eax is not valid address. In original program everything works fine. Is it asprotect trick? Or I have a problem with hands?
:(
banshee
08-13-2002, 10:08 PM
Tried to unpack another program. The same problem: execution fails in function System::SysGetMem(int). Think this is some trick with resources. Any ideas?
Here the program:
h**p://www.vd-soft.com/downloads/HID4JSMS.zip
evaluator
08-15-2002, 02:34 PM
nothing new..
at 5006AC is pointer[address of mem] to your hardware ID in asspr module.
Look in that address & copy that bytes into EXE,
then rewrite that address at 5006AC to your.

PS.
you must read tutorials about asspr unpacking. For example, about AAtools.
banshee
08-17-2002, 05:10 PM
Thanx
It was lazy way, I'm sorry. I should go now to learn, learn, learn :) Anyway thanx.


Mouse problem with SoftIce 405
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Mouse problem with SoftIce 405
PDA

View Full Version : Mouse problem with SoftIce 405

Flack
08-13-2002, 09:07 PM
Hey guys,
I installed softice 405 on my win 98 machine and everything is running fine except that my mouse doesnt work with softice. I tried all of the mouse setup options and when in softice the mouse is set on, however it doesnt move. Im using a microsoft optical intellimouse. Eventhough its not a big deal if i can use the mouse or not, it would still be nice if i can :D

Any help is greatly appreciated.

Thanx
-Flack
robber804
08-14-2002, 02:11 AM
I had problems with my MS Optical mouse also, do you have it plugged into the USB port or the ps/2 port. On my Win2k machine SI would lock if I plugged the mouse into the USB port, even though SI docs say it supports USB mice. Try the ps/2 port if you are currently using the USB port it may fix the problem.


Breakpointing IO
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Breakpointing IO
PDA

View Full Version : Breakpointing IO

r00t
08-14-2002, 07:01 AM
Hi all,
Last night i was trying to reverse a simple dongle. It's an EXEKey, maybe no one knows it bcoz it's an Argentinian Dongle.
I was able to manage old versions of that dongle, but in a newest version SoftIce dont pops up when i set a bpio.
In past versions of that dongle, i set a bpio 378, and i was able to trap the program access to the dongle. The proggie is a DOS application, but i use SoftIce 4.05 for Win9x.

Which kind of trick they can do to bypass the breakpoints on IO?.
Any ideas?.

Greets and thanks.
naides
08-14-2002, 01:10 PM
http://fravia.kilrathi.pl/zaferdon.htm

The answer is in the rings . . .


Need help with this very small app please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help with this very small app please
PDA

View Full Version : Need help with this very small app please

Flack
08-15-2002, 06:59 PM
Hey guys,
Recently I d/l'ed a maphack for Warcraft 3. Now, before I got this one I made one myself using some info I found on the web. The thing is, with mine, you cant disable the maphack, only enbale it, but with the one I have d/l'ed, you can enable and disable.
Now, I wanted to try to see if I can figure out what values in memory are poked when the maphack is disabled. So to do this I set a breakpoint on the window handle of the program:
BMSG 0BD0 (or whatever it was) WM_COMMAND
and softice pops up when I hit the disable button. However, once Im in softice Im not exactly sure what I am looking at :(
I trace thru the program and eventually the maphack gets disabled, but I cant pinpoint what memory values are changed to do this.

I know this is just a cheap app for a game but if anyone has any suggestions, hints, ideas, anything, I would greatly appreciate it.

Thanx for the help,
-Flack

P.S. I have attached the app eventhough you need the game to
run it, just in case anyone wants to see it.
NervGaz
08-15-2002, 08:48 PM
I'm just guessing right now... but the most logical thing would be that at just restores the original values at the same place the they get changed when you disable the maphack... if you understand me.... woke up like 20 minutes ago.. hehe
Flack
08-16-2002, 02:59 AM
I tried that but it didnt work. It doesnt matter anymore anyway, the game was patched and this maphack doesnt work anymore. Oh well, back to the drawing board.


CommView 3.4?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CommView 3.4?
PDA

View Full Version : CommView 3.4?

foxthree
08-15-2002, 08:51 PM
Hello Folks:

Sorry for posting yet another ASsPr/Tamoz combo, but this one seems to be quite nasty:mad: After all, only these two guys seems to be doing something interesting :p and hey they finally added a TCP session joiner in this, so I thought it is worth a while.

After the usual, dump, IT fix, blah blah... I get this weird RunTime Error 202 at 40717D and shit is this a loop? Anywayz, I'll keep working on this one this week and post the progress. But I thought I'd throw some "wake-up call" in this otherwise "getting duller and duller by the day" forum :D

Signed,
-- FoxThree
SilSaLaMaTa
08-16-2002, 09:18 AM
hi
I had the same prob , I don't know why it happen after unpacking , but I debug the prog and found where exceptions happens and nop that ! after all , commview runs but there was one more error , I tried to right click on the packet list and I got another runtime error . there was a check "cmp [xxx],4","jb xxx",I changed the "cmp [xxx],4" to "cmp [xxx],7" and everything works :)
But I don't know why runtime errors happens after unpacking ...
foxthree
08-16-2002, 09:21 AM
Hey SilSA:

How did you bypass the nasty CRC check? +SplAj gurus technique?

Signed,
-- FoxThree
evaluator
08-16-2002, 01:20 PM
CV had filesize check since probably 2.6 versions.
This check happens after some time when you start prog.
Without searching reason, you can repack unpacked prog to its original size
& not warn more about it. (for current cv I not looked)
Solomon
08-16-2002, 01:23 PM
hi foxthree,

This Error 202 message is encrypted. This is tamos's trick to detect unpacked/cracked version. The following is the decryption routine(such routine is also used in FlashFXP, only the constants are different). Many other secret strings are decrypted with this routine. Just locate them in IDA by cross-references to this routine. The CRC check can be defeated by hard-coding the 512-byte MD5 hash into unpacked exe. Please refer to v3.0 build 205 thread in the newbies forum. I have successfully unpacked and cracked it. There is also an inline patch from DISTINCT group.

seg000:00655718 sub_655718 proc near ; CODE XREF: seg000:0063ED3Fp
seg000:00655718 ; seg000:00644393p ...
seg000:00655718 push ebx
seg000:00655719 push esi
seg000:0065571A push edi
seg000:0065571B push ebp
seg000:0065571C push ecx
seg000:0065571D mov [esp+0], ecx
seg000:00655720 mov esi, edx <-------key for decryption
seg000:00655722 mov edi, eax
seg000:00655724 mov eax, edi
seg000:00655726 call sub_404DB8
seg000:0065572B mov edx, eax
seg000:0065572D mov eax, [esp+0]
seg000:00655730 call sub_40513C
seg000:00655735 mov eax, edi
seg000:00655737 call sub_404DB8
seg000:0065573C mov ebp, eax
seg000:0065573E test ebp, ebp
seg000:00655740 jle short loc_655777
seg000:00655742 mov ebx, 1
seg000:00655747
seg000:00655747 loc_655747: ; CODE XREF: sub_655718+5Dj
seg000:00655747 mov eax, [esp+0]
seg000:0065574A call sub_405008
seg000:0065574F mov dl, [edi+ebx-1]
seg000:00655753 movzx ecx, si
seg000:00655756 shr ecx, 8
seg000:00655759 xor dl, cl
seg000:0065575B mov [eax+ebx-1], dl
seg000:0065575F xor eax, eax
seg000:00655761 mov al, [edi+ebx-1]
seg000:00655765 add si, ax
seg000:00655768 imul ax, si, 3039h <----constant 1
seg000:0065576D add ax, 2C9h <---------constant 2
seg000:00655771 mov esi, eax
seg000:00655773 inc ebx
seg000:00655774 dec ebp
seg000:00655775 jnz short loc_655747
seg000:00655777
seg000:00655777 loc_655777: ; CODE XREF: sub_655718+28j
seg000:00655777 pop edx
seg000:00655778 pop ebp
seg000:00655779 pop edi
seg000:0065577A pop esi
seg000:0065577B pop ebx
seg000:0065577C retn
seg000:0065577C sub_655718 endp

seg000:00656C68 push ebp
seg000:00656C69 mov ebp, esp
seg000:00656C6B push 0
seg000:00656C6D xor eax, eax
seg000:00656C6F push ebp
seg000:00656C70 push offset unk_656CD9
seg000:00656C75 push dword ptr fs:[eax]
seg000:00656C78 mov fs:[eax], esp
seg000:00656C7B mov eax, ds:dword_669C58
seg000:00656C80 mov eax, [eax]
seg000:00656C82 mov edx, eax
seg000:00656C84 shl eax, 3
seg000:00656C87 sub eax, edx
seg000:00656C89 cmp eax, 6E4E00h
seg000:00656C8E jz short loc_656CC3 <-----------just change this jump
seg000:00656C90 push 0
seg000:00656C92 lea ecx, [ebp+var_4]
seg000:00656C95 mov dx, 64h <---------------decryption key
seg000:00656C99 mov eax, offset unk_656CEC //"Runtime error 212"
seg000:00656C9E call sub_655718 <--------decrypt it
seg000:00656CA3 mov eax, [ebp+var_4]
seg000:00656CA6 call sub_404FB0
seg000:00656CAB mov edx, eax
seg000:00656CAD mov ecx, offset aError_6 ; "Error"
seg000:00656CB2 mov eax, ds:dword_669D30
seg000:00656CB7 mov eax, [eax]
seg000:00656CB9 call sub_46FD6C
evaluator
08-16-2002, 02:18 PM
Hey, foxtree, I was running unpacked CV3.4.0.241 during 30min on W98se
& nothing happens!

When happens error & on what system?
hobgoblin
08-16-2002, 03:58 PM
Hi SilSaLaMaTa
I did unpack this one without problems, but when I try to work with the packet list (left or rightclick), I get the same problem as you describe. My copy also exits totally so I have to restart the program. I have tried several things to find the jmp instructions you describe, but no luck. Exactly how did you find it? All kind of input is welcomed.:-)

Another thing: After I unpacked it, it ran okey without changing anything further. (Not like the previous version with the CRC check desribed by +Splaj). I unpacked it on WinME.

regards,
hobgoblin
evaluator
08-16-2002, 04:40 PM
Common guys!!

What "packet list", where????

Maybe you will upload SCREEN-SHOT for me, so I will click there with Right-Pen-Click?
hobgoblin
08-16-2002, 04:58 PM
Hi Evaluator,
Open the program, push the start capturing button. Then after surfing on the net for a few seconds, click on the banner in the front of the main GUI called "Packets". Then try to click on one of the listed packets.

Hope this helps,
hobgoblin
foxthree
08-16-2002, 05:40 PM
Hey guys:

Aren't you getting the Runtime errors??? Bleh... Win98SE is the platform. I first get one RT error which I fixed.... actually "is-ASsPR-present" check .... the second one is what I'd written about. Shitty!!!

Don't tell me Tamoz removed its fav. CRC decryption loopz. May be they Ph3rrr +SplAj... Yoo hoo r u there?

Signed,
-- FoxTHree
hobgoblin
08-16-2002, 06:10 PM
I also unpacked it on WinXP. Something must have changed. After unpacking it, fixing the Import table (using revirgin), and so on, it actually runs okey. AND no errors when working with packets occur. Must check to see what happens if I start patching the file....

hobgoblin

BTW, something occured to me: Maybe we have a slightly different Import table after rebuilding it. And maybe that can cause some of the differences we experience.
I found out when tracing the runtime error that pop'ed up when I tried to work with packets on WinME, that I actually ended up in one of the .dll's (fcd.dll), and the error was triggered when the program called the Heapalloc api there...
evaluator
08-16-2002, 07:43 PM
NOT crashes! ~:0

Now look here carefuly:

CV.exe
size=1032704
crc32=0FDFE149

now make dump on OEP (not runtime)

OEP=0065C800
IT=002AF000 SIZE=0280

paste my IT at 002AF000 in fixed-dump and tell me if crashes.
SilSaLaMaTa
08-16-2002, 08:23 PM
hi
Fox3:
I passed the CRC check with +SplAj techniques :D

Solomon :
I changed the jump , but still run time error :(

hobgoblin :
As Solomon said there is a call to decryption routin , check the xrefs , for CV 3.4 build 238 routin is at 656B9C and the call is on 64618A . look at 646185 , there is the cmp .

evaluator:
what do u mean by "now make dump on OEP (not runtime)" , how to make dump - not runtime ?
evaluator
08-16-2002, 09:49 PM
I mean not after OEP

BTW, what is SPLAJ's tecknique? rsrc unpacking?
hobgoblin
08-16-2002, 09:54 PM
I'm a little confused by the CRC check cracking described by +Splaj myself. After changing one byte in the code I put a bpm <adress that had changed> rw, but it didn't lead me anywhere in CV.exe. I ended up in fcd.dll. I then tried bpr rw on the same address, but didn't find any code similar to what +Splaj described in his Commview tut.
SilSaLaMaTa, how did you find it?
I'm wrestling with build 242, so the addreses you give me isn't the same...:-)

regards,
hobgoblin

Actually, I found where the MD5 algo routine is, so I think I will do some reading of older posts before doing anything else.
Thanks for previous posts about the subject..:-)
foxthree
08-17-2002, 08:11 AM
Hajo Fellow RCEs:

I think we have quite a few different results here. Let me summarize my findings so that we're on the same plane.

The proggie is CommView 3.4.0.242
Size: 1,032,704 bytes (original packed size)

Difference #1:
~~~~~~~~~
My Original EntryPoint Found: 0065C8E0
Eval Says: OEP=0065C800 Why?

Finding #2:
~~~~~~~
After doing ususal ImpREC/RV two APIs remain. I find them to be LockResource and FreeResource. Is this correct?

Finding #3:
~~~~~~~
After usual unpack, first error occur in 0x403xxx. This is a simpe AsSPR check. Did you guys also get this?

Finding #4
~~~~~~~
After fixing that, another 202 RT error at 40717D. Why AREN'T you guys getting this? :D

Anyways, can somebody comment? I agree with Solomon that there is decryption going on. Based on his tip I found LoadString following by decryption.

Eval <---- Either you have "magic pc" :) or some advanced dumper ;) ???

BTW, the platform is Win98SE. I'll try on Win2K later today

Signed,
-- FoxThree
evaluator
08-17-2002, 08:56 AM
OK,I dld today
for CV3.4.0.242 IT is same & you can use my...
CV.exe size=1032704 crc32=C42AF322
OEP=65C8E0
IT=2AF000 SIZE=280

Hey, maybe we shoud exchange our unpacked EXEs & check differences??
hobgoblin
08-17-2002, 09:18 AM
I have build 242.
OEP=0065C8E0
In addition to Lockresource and Freeresource, I also found Sizeofresource. I used a loader to find the OEp and to halt the program before dumping it with Lordpe.
IT address=2AF280
size=9F8
I'm using Revirgin, and after ripping the import table I trace all the unresolved calls using Softice.
After unpacking it, it ran okey on XP and WinME. But I do get the runtime error as described before when I rightclick on packets. But I understand that it can be fixed by patching the program as described by Solomon. I do not get another runtime error before patching the program.(I haven't tried to run it for an extended period of time though).
What I'm wondering about is how Solomon actually is managing to hardcode the 512 byte hash into the unpacked exe.
Question: doesn't the program compare the original hash value with the one calculated? If so, what about looking at this location?
(I'm new to this kind og check, so bare with me...:-))

regards,
hobgoblin
GlObAl
08-17-2002, 10:57 AM
Hello,
another way to defeat the CRC is to jump to an free space before he run the crc code.
There you set all changed places back to the orginalvalues like.
mov byte ptr [adress],074
also the place were you jump out than the code looks like untouched in the memory.
than call the crc code call´s from you free place after that patch all back regoffset and jump to this place.

Mh hard to explain but its an easy way... :~)
evaluator
08-17-2002, 11:22 AM
hobgoblin!

Be sure, I many time click left-right-back-oral mouseButton, but nothing..
Did you use my IT?
Ok, do this:
pack your unpacked file with winace>zip , upload somewhere & send me address in PM

Hello, GlObAl!

that method, you wrote, is my gift to SPLAJ :)
maybe you see it in others cr_ck, but they see..
foxthree
08-17-2002, 12:02 PM
Guys:

Stop playing :D .... and notice what is happening at 403CAE location. This is where some kind of decryption happens. And this is where the first Access Violation should occur pointing to some address 13b1c78 (AsSPR address). If you by pass this you'll get another exception which is ofcourse a hard coded string which says something like 402a22 accessed address at 893005 or some shit like that.

Now tell me did you guys get this or what???? :confused:

Signed,
-- FoxThree
evaluator
08-17-2002, 12:20 PM
pack your unpacked file with winace>zip , upload somewhere & send me address in PM
evaluator
08-17-2002, 02:57 PM
OK!
I dlded hobgoblin's unpacked cv.
There is simple error in IT>fcd.dll's thunks.

I paste my IT.BIN & all workXS!

So AGAIN!
Download my previouslly attached IT.zip, paste in CV-dump at 2AF000,
then in LordPE set values I written
(IT=002AF000 SIZE=0280)

And see if crashes.

FINITA ALLA COMEDIA:)

hobgoblin! what version of RV you use?
Redownload latest RV's(1.3 & 1.5)
hobgoblin
08-17-2002, 04:43 PM
You were right. After rebuilding the exe as you did with your IT section, the packet problem was solved.
I used the latest Revirgin (1.5) when I'm using XP, and version 1.2 Public version when I worked on WinME. In fact, when I rebuild the exe on XP, I didn't get the packet error. Maybe the problem comes from using an earlier version of Revirgin.
Another thing: I build the IT section into the exe as the last section.

Exactly what do you think was the problem?
Anyway, as this is solved, I'm looking deeper into the CRC problem. Interesting stuff....

Thanks a lot for the help.:-)

hobgoblin

Late comment: I just went over the whole process once more, but this time with Revirgin 1.3 Public version. NO problems...:-)
evaluator
08-17-2002, 05:21 PM
Yah!

This happens because of you use old RV.
Some time ago I notified Tsehp about this problem & he solved it.

So you must renew RV. Download RV1.3 & all will OK.

BTW, you also can use RV1.5 on W9x. Only tracer not works, but import resolver works normal. (don't trace unresolved)

Thats All Folls!

Hey, foxtree, so how are you? Also use old RV?
foxthree
08-17-2002, 09:33 PM
Hey, EVAL ---> it's all RV's fault :D ...

Step1:
~~~~
Anyways, after initial scan of CV using RV I get the following unresolved:

1DF0EE8, 1DF133C, 1DF139C, 0065B6C4, 0065B744, 1DF1358, 1DF1390, 1DF1388, 0065B778. Right???

Step2:
~~~~
Now use my brain ( no RV/ImpREC Only SOFTICE )

1DF0EE8 == GetProcAddress
1DF133C == GetModuleHandleA
1DF139C == GetCommandLineA
0065B6C4 == SizeOfResource
0065B744 == GetCommandLineA
1DF1358 == GetVersion
1DF1390 == GetCurrentProcessId
1DF1388 == GetCurrentProcess
0065B778 == (Dummy) FreeResource

Correct??

Step3
~~~~
Add new section to dumped CV and paste the IAT (len = 280 as you said) at offset 0x338000.

Still Crashes???

Enclosed is IAT.txt file for your scrutiny... Maybe I did something wrong?

Signed,
-- FoxThree
evaluator
08-18-2002, 07:25 AM
Now here is YOUR mistake!!
you have 2nd GetCommandLineA at

103 002AF434 BFF8C5DA 0149 KERNEL32.dll GetCommandLineA
??????

but this most be

103 002AF434 00000000 0000 KERNEL32.dll LockResource
evaluator
08-18-2002, 07:37 AM
Now KEEP in MIND!

DUMP & RESOLVING unpacker MUST MAKE
_NOT_ after OEP!

Clear?

This is why you have tricky thunks with adresses
0065B6C4
0065B744

Because Tumos playng with thunks from main code.
I detected this trick long time ago...I'm lazy for search in forum,
but you can found it.
foxthree
08-18-2002, 08:53 AM
Hey Eval:

In the uploaded version of IT.txt, I make mistake. You're right! But my original resolve was FreeResource. You can find that in my earlier post. However, the IT.bin created by RV 1.3 seems faulty. I enter these values in RV 1.3 under W9x. IT RVA = 338000 and len = 280 but bin was wrong.

I dl RV 1.5 and hacked to get it installed in W9x. Then I give same IT RVA but this time as 00338000 and len 280. Bingo! it works!!!!

Thanks for all your help.

Hob:

Thanks for your mail. Alas, you're under WinME I suppose which explains the SetProcessWorkingSetSize and all... which aren't there under Win9x. So is the last 2 ADVADPI calls OpenSCManagerA isn't ther under Win9x :) But thanks anyways....

3 Questions:

[To Eval]
DUMP & RESOLVING unpacker MUST MAKE
_NOT_ after OEP!

What exactly you mean. I resolve IT as 0040142C. But you're right I was surprised so use SoftICE and find no 0065xxxx but 1DFxxxx. If you could explain a little bit more clearly it would help?

[To +Tsehp and other RV coders]

Can you make RV 1.5 install under Win9x. Now it just quits. I had to hack it to get it installed under my system. You can put a warning saying Tracer/Plugins will not work and then install the rest of the package. Just a suggestion!!!

[To +SplAj guru]

Yoohoo where r u? we miss u ...

Signed,
-- FoxThree
Solomon
08-18-2002, 09:50 AM
well, I think he means we have to suspend CV.EXE at the OEP before we use RV/ImpREC to resolve IATs, coz some appz will modify the contents of IAT after it enters OEP, which was discussed before. :)

And please don't blame the tools for wrong resolved APIs. :D I always manually examine every "suspicious/unresolved" API in ImpREC/RV and it saves me a lot of time to avoid debugging unknown runtime errors.:D

Originally posted by foxthree
[To Eval]
DUMP & RESOLVING unpacker MUST MAKE
_NOT_ after OEP!

What exactly you mean. I resolve IT as 0040142C. But you're right I was surprised so use SoftICE and find no 0065xxxx but 1DFxxxx. If you could explain a little bit more clearly it would help?
Solomon
08-18-2002, 10:15 AM
In CV.exe, this is the ONLY runtime error (error 212) concerning with anti-unpacking tricks. Other runtime errors are due to incorrect unpacking.

BTW: ReGet Deluxe also uses some "Runtime error #xxx" to detect unpacking/cracking attempts.

Originally posted by SilSaLaMaTa
I changed the jump , but still run time error :(
evaluator
08-18-2002, 01:46 PM
foxtree!

Solomon's explanation is right.

Yes, I mean, you must stop program at OEP & do resolving+dump here.
(Of course, also is good to make control dump right after unpacking.)
This will resolving for home use:)
For HQ unpacking Unpacker must find where ImportNames are decrypted & check each resolved name!!!

Now back to RV.
Be sure, I use RV1.3 & nothing happens wrong.
I now uploaded another IT.bin for pasting at 338000.

Values for RV was

OEP 00401000
IAT RVA 002AF280
IAT SIZE 00000A00
IT RVA 00338000
IT SIZE 00000280

Values for LordPe>Directories are:
ImportTable RVA=338000 SIZE=280

Values for LordPe>Sections>added idata section:
VA=00338000 VSise=4000 RO=00338000 RSize=4000

Check with you values. Somewhere must error. Finally you can (as Hobgoblin)
compress your unpacked exe, upload somewhere & send me URL in PM.
foxthree
08-18-2002, 02:02 PM
Hey Solomon/Eval:

Sorry if I'd sounded like I blamed RV. RV rockz!!! Absolutely... No doubt. What I wanted to say was more like a bug report: IT's are correctly resolved (both via RV and manully fixed unresolved ones correctly) but RV 1.3 did not do the .bin generation correctly. That's was what I intended to say. My sincere apologies if it was conceived in any other way.

Eval: You're right. I dled RV 1.3 latest today from tsehp.cjb.net and the IT.bin problz is solved. I might've used the older version of 1.3... who knowz. Now RV 1.3 and RV 1.5 both are working on my machine. Special batch file to swtich tracer.dll and thread.dll ;)

Eval, many thanks for ur patience with this target and helping me out. Alas, I was too jumpy which is against every known *zen* philosophy .... and I apologize.

Two things though:

1. Can we make RV 1.5 install in W9x
2. Can we code specific versions correctly in the about box (For instance the RV 1.3 version says RV 1.3 Public release in Title bar but 1.2 in about box :confused:

Once again many thanks to +Tsehp and RV Team for all their help and patience :)

Signed,
-- FoxThree

PS: Hmmm, still no sign of +Splaj ???
nofurs
08-18-2002, 02:03 PM
Hi evaluator,

Are you uploading a crack :p :D

oops dissapeard :p

FoxThree did you tried winrar?
evaluator
08-18-2002, 04:06 PM
cluesurf, explain what you want to say..

my attachments are deleted?

Explanations will good, Mod!
nofurs
08-18-2002, 04:13 PM
Hi evaluator,
>For all your unpacking questions. No uploads of patches and >such will be allowed.
Could be this man it just suddenly dissapeared

FoxThree, I mean this ;P
>1. Can we make RV 1.5 install in W9x

Try the latest winrar and extract it in win9x ;)
You still need to msi installed
foxthree
08-18-2002, 04:17 PM
Hi Cluesurf:

Winrar? u mean for unzipping what Eval uled? Ofcourse, and it works. Didn't it work for u?

Signed,
-- FoxThree
evaluator
08-18-2002, 05:03 PM
>No uploads of patches and >such will be allowed.

Sorry! My eNgLiSh is so littEl! Can you explain, since what time IT.BIN is "patches"?

I wait for Mod's explanation, because I just want to know, what TO DO tommorow!

Or just point me to new FAQ page!?
evaluator
08-18-2002, 07:26 PM
esther, thanks for explanations!

Just I can say to you, I, SPLAJ & many others lot of times uploaded such IT.BINs...
So if now rules are changed, Rules must be clearly defined for override mistakes.

Also I can (I think) discuss about educational purpose of such files, but will not do it right now.
Maybe in OFF topic I will do..

So for clear thing, last time Q:

No more uploading for IT.bin & IAT.txt?
hobgoblin
08-19-2002, 10:13 AM
Hi there,
I'm still working on this target, and therefore I need a copy of Commview 3.4 build 239. I need the evaluation version, so this is not a crack request. I've been searching the net for quite a long time, but the only version I get hold of is 242. I need 239 to make some comparisons.
So if someone could point me in the right direction, or simply mail it to me, I would be grateful.

regards,
hobgoblin
Solomon
08-19-2002, 11:38 AM
I have it. About 1MB.
solomon2000(at)gmx.net
SilSaLaMaTa
08-22-2002, 12:17 PM
Hi ,
I did all that u said but still some thing wrong, I can't fix it :(
I put a "push 7fffffff" and "sleep" at the oep (65c734) (CV 3.4 build 238) .Then IT rva 2af280 and len A00 . RV reslved the imports
and then fix asprotect imports and a LockResource at 2af434 . IAT rva : 338000 and len : 5C0 (<-- I think ) . RV generated it.bin
After that I dumped the prog and fix the bytes (the push and call)
to the original .
In lordPe : Sections->Load Section -> It.Bin -> Section loaded :)
Directories -> Imports : 338000 , Len : 5C0 -> save ...
I tried to run the prog but I got RunTime Error 216 at 403CAE :(

I'm using the lastes RV 1.5 on XP (With a lot of problems :().
I aslo tried ImpRec ...
I attached my IT .
evaluator
08-22-2002, 12:30 PM
SilSaLaMaTa

your OEP looks strange. Check, what we wrote about OEP.

& you values are terrible different with my!
See up 12 post, what I wrote!
SilSaLaMaTa
08-22-2002, 12:56 PM
I have CV build 238 , It is the correct oep , cause it's working if I patch CV .
I forgot to upload my IT ...
evaluator
08-22-2002, 09:41 PM
you have 1 MISTAKE entry

correct is
002AF2E0 > KERNEL32.dll GetCommandLineA

you have
>GetVersion
Seems you did it with plugin??

OUR thanks to SOLOMON for ITcompare:))
SilSaLaMaTa
08-23-2002, 10:52 AM
Hi ,
Everything is ok now :)
I didn't know that the plugin may do the work wrong !
I checked some of the imports and there were ok , so I didn't check all of them .
Thanx .
esther
09-07-2002, 07:28 AM
Hi evaluator,
I delete it coz it acts as a patch.copy and paste to the dumped file and it willl show all the strings and references even iat.txt are deleted.It shows no purpose teaching ,helping ppl to learn.

Btw you can send it Foxthree if you want to help him understand
the problems.Uploading in here sure to cause problems to the forum...

Hopes its explains everything.

Regards
foxthree
09-15-2002, 08:58 PM
Fellowz:

Did you see the CV 3.4.243. Unpax it under Win2K...Have Tamoz guys been reading this board ??? :D

Signed,
-- FoxThree
Nebob
12-08-2002, 03:30 PM
Here is the IT for build 248. I only get runtime error 212, so I assume it is correct?
diz
12-29-2002, 12:14 AM
Originally posted by Solomon
Please refer to v3.0 build 205 thread in the newbies forum. I have successfully unpacked and cracked it. There is also an inline patch from DISTINCT group.

sorry for upping such old topic, but I just discovered that there is some another thing which all crackers seems to miss. When you start program with "mirror" parameter (look in help for what it does) programs allow only capturing packets for 5 minutes.
ReaL|sTy
01-02-2003, 06:59 PM
i'll hope this help ... there's a working unpacker that can easily do the job and works for many aspr latest version packet programs.... check protools! but this is not matter of aspr Tamos program use some internal crc check . that makes program crash like hell ,even if you use a loader will crash if you modify some bytes, actually the ones you need to patch :P. because at the end is all matter of that so you or anyone else won't pay for the program and use it for free. i think is time limited only but you can easily remove time limit from the registry without modifing the .exe, maybe this information will help. i'm not sure if this is really a crc check or some internal extra protection to prevent the exe from been crac........ good luck!
diz
01-03-2003, 04:04 PM
Originally posted by ReaL|sTy
i'm not sure if this is really a crc check or some internal extra protection to prevent the exe from been crac........ good luck!

there was a good discussion about that crc check some time ago (you'll find it with search function).
This program also displays only half of the packets so it's not true what you'r saying that it has only time limit.
And, btw. you'r saying that time limit can be removed by modifing registry key? You mean that 'five minutes only capturing' limit?

diz
ReaL|sTy
01-03-2003, 05:51 PM
i said i think i din't say i'm sure. but if you want the program full registered you will have to study the algo and look where to patch to simule is been registered. you see dosen't have any registration option is because needs a key file that it should be in the program's dir. about time limit ,is for the trial days the info. i gave
Solomon
01-15-2003, 06:03 AM
Did u mean "Fatal error #43" ? :D

Originally posted by foxthree
Fellowz:

Did you see the CV 3.4.243. Unpax it under Win2K...Have Tamoz guys been reading this board ??? :D

Signed,
-- FoxThree
Solomon
01-15-2003, 06:09 AM
yes you are right.

Originally posted by diz
sorry for upping such old topic, but I just discovered that there is some another thing which all crackers seems to miss. When you start program with "mirror" parameter (look in help for what it does) programs allow only capturing packets for 5 minutes.
ReaL|sTy
01-15-2003, 07:23 AM
:D that program has many limitations as i see. i found discussions about it thanks for telling me diz. yes Solomon many crap on those fatal errors looks like an ascci stuff. the only way to remove all those limitation is making/simulate been registered


Armadillo Killer 2.6 ready!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Killer 2.6 ready!
PDA

View Full Version : Armadillo Killer 2.6 ready!

Armkiller
08-15-2002, 09:34 PM
http://armkiller.cjb.net
evaluator
08-15-2002, 10:19 PM
yah, NOT-long time ago, when I was clear lamer,
I anjoy with cool unpackers.

But now when I learn debugger & etc,
IF I will need unpack prog, I will trust only to my hands.
e.g. I never will use any unpacker(except UPX).

Pls, I am very interested, what are your reasons, when you create this unpacker.

Write in order.

PS
I respect your job!
evaluator
08-16-2002, 01:28 AM
just checked "SetupBuilder"(file time 30.03.2002) from armad-authors.

armkiller can't resolve OEP.
evaluator
08-16-2002, 01:13 PM
today I checked Arma260a & found following news:
It no more uses IAT redirection for all of kernel&userDLL APIS:(
it continues to use redirection for few APIs, so resolving goes quite fast.
Thanks for this??

Heh! I like that SetupBuilder! I will use it:)
In help is written:
"you may not distribute files created by it until you purchase it"
but I assume, this is not about me..
Am I wrong, guys!?
armkiller2002
08-16-2002, 06:54 PM
It seems SiliconRealms doesn't like my small dumper - it has killed all my page :) You can download it here.

http://unpacker.narod.ru
evaluator
08-16-2002, 07:29 PM
not your dumper but cracked ARM!

So dont put cracked ARM on your new page..
BenJ
08-16-2002, 07:34 PM
Originally posted by evaluator
today I checked Arma260a & found following news:
It no more uses IAT redirection for all of kernel&userDLL APIS:(
it continues to use redirection for few APIs, so resolving goes quite fast.
Thanks for this??

Heh! I like that SetupBuilder! I will use it:)
In help is written:
"you may not distribute files created by it until you purchase it"
but I assume, this is not about me..
Am I wrong, guys!?

Ahhhh ! got it ! I had a mess in IAT rebuilding under winXP for a app which seems to ben packed by arm 2.5x.. mess was only in some kernel32 and user32 api calls... thnaks for the info !
Nemizis
08-17-2002, 05:16 PM
1. I have setup a page with screengrabs of how I followed the
instructions for a specific target your dumper supports and yet
it all failed

URL : h**p://www.icon.co.za/~nemizis

2. I have also placed there 2 executable files from another target

This however puzzles me, they simply bytepatched the file
to "remove" the restrictions, a major flaw in Armadillo it seems
can you look at the original file and the patched file, compare
them and please try to explain if a GENERIC way for this type
of "attack" can be worked on?

Thanks in advaned and thanks for the nice dumper
BenJ
08-17-2002, 09:24 PM
Nemizis,

before iat rebuilding, searh for a file called eip.bin... hexedit it and you will find the real oep of the target (reverse the bytes).

Before clicking IAT autosearch in imprec, replace oep with the one you've found, then get imports. it should work.

Armkiller : any chance to get a tutorial on manual unpacking ? your "small dumper" is too smart ! Regards:)
Nemizis
08-17-2002, 10:54 PM
Sure BenJ

but where to find this .BIN file since neither ArmKiller nor Import Reconstructor creates it?
BenJ
08-17-2002, 11:19 PM
armkiller creates one if able to find oep.

One trick : put armkiller and arm.dll in the same dir than the target. It seems it won't run else.
Nemizis
08-18-2002, 12:21 AM
OK

so u mean if there is NO bin file it didnt find the OEP even tho it successfully dumps it?
BenJ
08-18-2002, 09:23 AM
don't know exactly.... I'm just explaining how it works by me...
Nemizis
08-18-2002, 10:13 AM
thanks a lot

just HexEdit the Bin file and reverse the bytes for the OEP?

kewls!

lemme try
armkiller2002
08-18-2002, 10:42 AM
Originally posted by Nemizis
1. I have setup a page with screengrabs of how I followed the
instructions for a specific target your dumper supports and yet
it all failed

The right values for IT:
RVA - 1000h (it's VB app - IT RVA is 1000h always !)
Size - FCh
minawahib1
08-18-2002, 06:41 PM
hi all,
i need some help
plz from arm killer and any one have good knowlage i have program protected by armadillo 2.51 and by armadiloo 2.6beta1
the protect by hardware finger print
can any one eplain how i can open this progam plz
i have all progam but i can't understand
plz any one help me
SCARF12
08-22-2002, 12:23 AM
I just tried this on a armadillo 2.53 protected application, it says that the 1st dump is ready in dump.exe however there is no such file?
armkiller2002
08-22-2002, 07:42 AM
Originally posted by SCARF12
I just tried this on a armadillo 2.53 protected application, it says that the 1st dump is ready in dump.exe however there is no such file?

Try the latest Armadillo Killer build :
hxxp://unpacker.narod.ru/
SCARF12
08-24-2002, 02:58 AM
There that worked now.
However when i try and run the dump it does not work, going to look into it.
armkiller2002
08-24-2002, 07:09 AM
Originally posted by SCARF12
There that worked now.
However when i try and run the dump it does not work, going to look into it.

You can try the latest build 4 (hxxp://unpacker.narod.ru) or compress the dump by UPX, usually it fixes all PE problems.
ReaL|sTy
08-27-2002, 02:20 AM
my opinion is programmers that used such fool packers intended to protect their softwares don't have brain to make their own protections....... i have seen softwares harder to crack not packet...... i like the idea you guys are doing great work kicking armadillo and asprotect. i wonder when a 100% working unpacker will arrive for this babiess like the unpacker caspr for asprotect :) i'll hope the unpacker Gods will finally kill asprotect and make and update with the Best unpacker ever made for Aspr.

a question to armkiller2002 you wrote in your readme file:

[x] Support Armadillo 2.60c versions (except CopyMemII only). Wait for few days please.
[x] One more Armadillo version is supported
[x] Now you see only one messagebox with final message (The dump is ready. Bla-bla-bla).
[x] Support of expired version was added :) So you can easy reset trial counters for every
Armadilled application! I'm gonna to write a special app that resets trial counters and
hides a nag-screen ;) Use Armadilled applications for free.

is there a way manually to: x] Support of expired version was added :) So you can easy reset trial counters for every
Armadilled application! I'm gonna to write a special app that resets trial counters and

without dumping or unpacking the exe file.. ???
the_analyst
08-27-2002, 11:47 AM
Hi,

> i wonder when a 100% working unpacker will arrive >for this babiess like the unpacker caspr for asprotect >:) i'll hope the unpacker Gods will finally kill asprotect >and make and update with the Best unpacker ever >made for Aspr.

Actually, i wonder why you guys keep making unpackers?
You should keep those private, or stop making them.
What's the point ? unpacking Asprotect (which sucks even more than armadillo if you ask me, every new versions are cracked the day it is out :) or armadillo manually doesn't take much time at all.
Especially since there is public IAT rebuilders.

Armkiller seems to support Warez.
if you look the readme file, you will find a LOT OF urls to protected applications, and he gives the unpacker to crack them too.
Moderators here, you keep saying that warez and cracks are not allowed, and you sometimes bash the poor guy that publish his keygen with source code, but you don't say anything to this ? i don't understand..
The source code is at least something that you can learn from.

What with Armkiller ? you only learn where to get free softwares..
It is pathetic if you ask me.
You say that you don't wanna loose this site, but you are supporting warez indirectly..

By the way, armkiller, why do you only make unpackers for armadillo? there are others lame packers waiting too :)
Ok, they have all been cracked black and blue, especially Asprotect :) but also Vbox, Bitarts, and the rest :)

The reason could be, that you are working for some protector ? you wouldn't use such a nick else i guess. You are trying to bash armadillo only! You just released unpackers for it..

I have heard rumors that you are Alexey :-)
Yes guys, armkiller COULD be Alexey (or a very close friend of him)
Armkiller speaks perfect russian too :)

Now, im getting pissed off by all of this crap.
Armkiller, why don't you code a nice unpacker for Asprotect? since it sucks even more than armadillo, it shouldn't be hard for you :)
You would also provide urls for protected applications, wouldn't you ?

h**p://groups.google.fr/groups?hl=fr&lr=&ie=UTF-8&oe=UTF-8&frame=right&th=c988a9de248c738b&seekm=wR%25o8.87%24ml2.7154%40newsread1.prod.itd.earthlink.net#link1

Pretty interesting :)

Notice the :

"Yes, Alexey is the author of ASProtect. He is NOT a cracker, though he
actually
CAN crack virtually any program -- just because he has an excellent
experience
in assembler, reverse-engineering, protection, cryptography etc."

;-)

My 2 cents,

Analyst

ps :

h**p://www.reversing.net/board/viewtopic.php?t=70

Mastering russian language as an art :-)
esther
08-27-2002, 12:32 PM
Hi the_analyst,
>Moderators here, you keep saying that warez and cracks are >not allowed, and you sometimes bash the poor guy that publish >his keygen with source code, but you don't say anything to this ? >i don't understand..
>The source code is at least something that you can learn from.

Btw I didn't stop them from uploading source code.But who wanna upload source??? ;)
We tried to stop ppl uploading unpackers,keygenators and even iat.txt and bin files coz it doesn't help newbies at all.They have to learn how to use the tools rather than downloading ppls working thingies.
Eventually I can't stop them from posting links and so forth.We have delete it many times...Did they listen???
Read this ;)
http://www.woodmann.net/forum/showthread.php?s=&threadid=3480
http://www.woodmann.net/forum/showthread.php?s=&threadid=3577

Regards
ReaL|sTy
08-27-2002, 01:34 PM
excuseme does unpacker mean or looks like crack for you?? did i upload something here?? yes good unpackers deserve credits and are great because will make our live easier and we don't have to spend no time unpacking , fixing the exe... by the way Asprotect and armadillo packer author sucks... and they won't win this battle!! excuseme the words.. but it is true :) i think armakiller is doing great job.. not even unpacker gods have made a working unpacker for armadillo... alexey is working hard to make asprotect better and i don't think armakiller could be Alexey. lol

greetings to Armkiller!!
the_analyst
08-27-2002, 01:36 PM
hey

>Btw I didn't stop them from uploading source code.But who >wanna upload source??? ;)

i was referring to this :

h**p://www.woodmann.net/forum/showthread.php?s=&threadid=3667

I meant, that this one is not very important, the guy didn't actually want to spread warez at all.
Plus, Irfanview used to be freeware , even if there is a registration :)

>We tried to stop ppl uploading unpackers,keygenators and even >iat.txt and bin files coz it doesn't help newbies at all.They have >to learn how to use the tools rather than downloading ppls >working thingies.

Yes, that's right.
Unpackers are not too bad when they are not made to spread warez. I once made an unpacker for armadillo, i published it, and never updated it publicly.

>Eventually I can't stop them from posting links and so forth.We >have delete it many times...Did they listen???

yes i know.
there isn't so much posts about armkiller though ;-) you could erase the whole threads.

>Read this ;)
>http://www.woodmann.net/forum/showthread.php?>s=&threadid=3480
>http://www.woodmann.net/forum/showthread.php?>s=&threadid=3577

sorry then ;-)
But you got my point anyway.

Best Regards,

Analyst
Duelist
08-27-2002, 08:10 PM
Totally agreed with the analyst.

Seems to me like Armkiller's purpose is to damage the authors of Armadillo, possibly for the benefit of one of it's competitors. Maybe Armkiller is indeed Alexey himself?

//D.
evaluator
08-27-2002, 09:14 PM
Hehe, guys!

So you can see my Answers to armkiller in this thread!
I asked him about reasons...Did you see answers???

For today I can make this Resume about armkiller:

1. He Not teachs newbiez about reversing ARMAD
2. He ignores newbiez & our questions

make you resumes..Duelists..

the_analyst!

easy..
don't teach - how to moderating, teach - how to reversing.

>>Armkiller seems to support Warez
This is DECISION.

>>Actually, i wonder why you guys keep making unpackers?
>>You should keep those private, or stop making them.
EveryOne is free in his Rights.
Or you are NEW manager for human's rights?

PS
armkiller(prog) is NOT unpacker, but dumper for CopyMem protected...

UNPACKERs ARE COOL
the_analyst
08-27-2002, 09:58 PM
Hey,

>For today I can make this Resume about armkiller:
>1. He Not teachs newbiez about reversing ARMAD
>2. He ignores newbiez & our questions

you are pretty naive, aren't you ?

>the_analyst!
>easy..
>don't teach - how to moderating, teach - how to reversing.

I did this years ago :)
I can teach english though ;-)

>>Armkiller seems to support Warez
>This is DECISION.

What do you mean ?
It is not the good place for warez anyway mate.

>>Actually, i wonder why you guys keep making unpackers?
>>You should keep those private, or stop making them.
>EveryOne is free in his Rights.
>Or you are NEW manager for human's rights?

Now that was a very smart reply.

>PS
>armkiller(prog) is NOT unpacker, but dumper for CopyMem >protected...

Call it as you want..
It is not an unpacker because the author is too lame to make his own IAT rebuilder :) but oh well ...

>UNPACKERs ARE COOL
Have you ever made one ? :-)

Analyst.
armkiller2002
08-27-2002, 10:07 PM
Guys!

What the strange topic? I had free time and just try to write a tiny dumper that just dumps a program image (it doesn't ever restore IT ) and I'm bad guy, work for Armadillo competitors and a king of warez scene or ever Alex :) LOL!

When do you see Procdump or CASPR or PCGuard decryptor or
Armadillo Deprotector nobody asks - why do you support your decryptor or utility ? Do you you work for Armadillo competitors?
What's the crap! Why do you ask me ??? Is it a free forum or it's
a sitting of the court? So everybody who creates an utility is a cracker and support warez by default ???
armkiller2002
08-27-2002, 10:14 PM
Originally posted by the_analyst
It is not the good place for warez anyway mate.

Analyst, where do you see warez? Did your Armadillo Deprotector support warez or not? It's very interesting question - have you got a permission to write Armadillo deprotectors and others haven't :)

It is not an unpacker because the author is too lame to make his own IAT rebuilder :)

I'm totally agree with you - it's a lame tiny dumper - what else? Why do you so aggressive? Calm down.
the_analyst
08-27-2002, 10:20 PM
>Guys!
Girl :)

>What the strange topic? I had free time and just try to write a >tiny dumper that just dumps a program image (it doesn't ever >restore IT ) and I'm bad guy, work for Armadillo competitors and >a king of warez scene or ever Alex :) LOL!

yeah, pretty funny isn't it ? :)

>When do you see Procdump or CASPR or PCGuard decryptor or
>Armadillo Deprotector nobody asks - why do you support your >decryptor or utility ? Do you you work for Armadillo competitors?
>What's the crap! Why do you ask me ??? Is it a free forum or it's
>a sitting of the court? So everybody who creates an utility is a >cracker and support warez by default ???

You are the only one that provides a lot of urls for target applications. how do you call this ?

For me it's Warez :)

Moreover, I have never seen any cracker with such a nickname.
What about one unpacker for Asprotect now then ? :)
ASPkiller sounds as good as Armkiller :D

Analyst
evaluator
08-27-2002, 10:22 PM
the_analyst!

>you are pretty naive, aren't you?
teach me eNgliSh first:)

>It is not the good place for warez anyway mate.
explain how that support is made here...

>Have you ever made one ? :-)
nop! i am musician ~8-)
Kayaker
08-27-2002, 10:23 PM
Thank you for your opinions on this. I fully agree that this has become too crack/warez oriented. Wanting to develop code for fun and improve it is one thing, and this board can and should be used for this. But the attitude that some people seem to take of a personal vendetta against any and all protection or shareware authors is pitiful. Yes, this is damaging to the author trying to develop a protection. And you take pleasure in this? Let's not turn this board into a bad B-movie version of Invasion of the Cracking Groups shall we?

I've ignored even reading this thread because I didn't like it, but I see where it's going and that the more enlightened reversers don't think much of it either, so this particular thread is now closed. OK, Armadillo Killer is now available for use. Done. Any and all flames or otherwise can be directed to the Off Topic forum please.

Regards,
Kayaker


Yet another FLEXIm target ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Yet another FLEXIm target ...
PDA

View Full Version : Yet another FLEXIm target ...

testing999
08-16-2002, 07:48 AM
For those who love FLEXIm, here's another target ... (I found lots of FLEXIm text in the exe, so ....)

MapInfo v7.0

URL : http://betaftp.mapinfo.com/mapinfo/MI70/Mipro7Trial.exe
SIZE: 95,600,081 bytes
HOME: http://www.mapinfo.com

MapInfo Professional v7.0, the industry's leading business mapping solution, lets you perform sophisticated and detailed data analysis to drive insightful decisions.Use MapInfo Professional to:

> Create highly detailed maps to enhance presentations and aid in decision making
> Reveal patterns and trends in your data that may otherwise be impossible to see
> Perform sophisticated and extensive data analysis
> Understand customer and marketplace demographics
> Manage geographically based assets, such as stores, people and property
> Plan logistics and prepare for emergency response

The award-winning MapInfo Professional package includes a built-in geocoder, more than 450MB of data and an extensive collection of pre-designed maps. It's simple to use, powerful and easily integrates with other mapping applications.

To view all of the new features and functionality of MapInfo Professional v7.0 versus previous versions, click here (http://www.mapinfo.com/miprocomparisonchart).


Help a newbie please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help a newbie please
PDA

View Full Version : Help a newbie please

Alph
08-16-2002, 08:04 AM
Hi,

I am new to reverse engineering, but have been programming for some time already. I just installed SoftIce and looked at the innards of Tabledit, and I'd be grateful for a few answers.

Tabledit is a shareware protected by a serial number registration.
It's at www.tabledit.com

What I did, roughly :

I break on GetDlgItem. I see that there is 2 of those, getting username and password, and storing them in fixed memory locations.

Then a first call, which I will go in more detail below.

The a second call, which looks like to me is just doing some clean up with windows.

Then I go into the kernel/_freqasm stuffs.

What is happening here ? Am I right in thinking that windows is now taking care of another thread and doing some window management ? or is tabledit calling those ? or triggering those with a semaphore maybe ?

Anyway.. then another call, I see that it is somewindow stuff, and that a window is refreshed with Table edit 2.60 demo.. so I guess the checking for the correct serial was above.. maybe ?

Then more freqasm/kernel/user..

Is there some debug files for windows dll that I can give to softice to see what is happening better ?

Then back to tabledit, back to freqasm/kernel/user, and I finally arrive at an event server loop (I think... made of TranslateAccelarator, Translate message and DispatchMessageA), which makes me sure that the program decided now that my password was no good.

So back to the first call.

I see that it does first some register access, creates an entry with my username and password.

I'd expect the program to do that after it has validated my password... any idea why it happens before ? (or maybe I did not see the validation ?)

Then the program does some length calculation, checks if the username is not User, Registered, or Chafe (?)

Then it changes the first letter of the username to a capital..

It tries now to convert the password to a hex number at some point, which makes me believe that the password is a hex number.

Then a few other things happen, which I do not totally understand.. and then we are back in the main program..

If someone would care to see if I understand (at least something...) correctly, and give me a hint where the actual validation of the password takes place, I'll be thankful.

Also (yes I'm full of questions..) can I quickly go back to the main program when windoze decides to do kernel/user/freqasm stuff ?

Is there a way to see the stack more easily than displaying memory, then looking how the pointers/data items were entered and write it down ?

Why does softice give me some addresses like with segments, like
1234:004654567.

I thought that with 32 bit app, all the segments/offsets were not used anymore ?

Does some segments still have a meaning ?

Thanks !
Fake51
08-16-2002, 08:57 AM
Why does softice give me some addresses like with segments, like
1234:004654567.

The segment : offset has indeed been abandoned. Instead, what you're looking at is selector : offset. The idea is that, under protected mode, there is a table in memory which holds a number of selectors. Each selector has a number of characteristics, such as privilege level, base address, addressing mode, and so on. So instead of having to translate the segment and offset to get a real address, now you're just looking at a flat address, that's added to a base address by the cpu. Look into protected mode if you want to know more.

Fake

Edit: hate those frigging smileys when they turn up the wrong place .... segment:offset
least
08-16-2002, 08:58 AM
Hi,
I'am quite new too, but I hope I can give you some hints. First of all, is your target packed?
If not, try to disassemble it (IDA is great), it can give you some valuable info that you can hardly find in debugger (like crossreferences).
If it is packed, first try to unpack it and continue with step mentioned above. Big help is Icedump too, both for unpacking, and for its tracex command which can help you with the freqasm stuff. And the last hint - try using bpm on the password and name addresses with option rw, it will tell you when the program reads or writes it (maybee bpr can help too but it will slow your machine).
Hope it helps.
Regards
least
Fake51
08-16-2002, 09:52 AM
Some hints:
- To break this one, use bpm's on name and serial. The calc'ing of the serial is all over the exe, not just in one place.
- Use your disassembler and search for "unregistered". One place pops up, and lo and behold, what do u find just before that? The magic memory check.
- Adding these two, your tactic might be: figure out where the flag is set, and how it relates to the name and serial. In other words: go debug!

The programmer has made the job easier: hardcoded offsets, and only one place where he modifies the flag. Shouldn't be too hard ;)

Fake
naides
08-16-2002, 01:57 PM
Originally posted by Alph
Hi,

I am new to reverse engineering, but have been programming for some time already. I just installed SoftIce and looked at the innards of Tabledit, and I'd be grateful for a few answers.

Tabledit is a shareware protected by a serial number registration.
It's at www.tabledit.com

What I did, roughly :

I break on GetDlgItem. I see that there is 2 of those, getting username and password, and storing them in fixed memory locations.

GOOD. NOW PUT A BPR ON THOSE LOCATIONS, SO ANY TIME YOUR PROGRAM READS THEM, MORE THAN LIKELY FOR VALIDATION PURPOSES, YOU WILL KNOW

Then a first call, which I will go in more detail below.

The a second call, which looks like to me is just doing some clean up with windows.

Then I go into the kernel/_freqasm stuffs.

IT IS NOT UNUSUAL FOR THE FLOW OF CODE TO GO THROUGH KERNEL, USER, ETC CODE DURING THE FLOW OF THE PROGRAM. USUALLY, WHAT HAPPENS THERE IN THE WINDOWS DLLS IS NOT RELEVANT FOR YOUR CRACKING, BUT OCCASIONALLY, IT IS. AT FIRST INSTANCE, DO NOT SPEND TOO MUCH TIME ANALYSING WHAT THE KERNEL CODE T CODE DOES

What is happening here ? Am I right in thinking that windows is now taking care of another thread and doing some window management ? or is tabledit calling those ? or triggering those with a semaphore maybe ?

EITHER/OR

Anyway.. then another call, I see that it is somewindow stuff, and that a window is refreshed with Table edit 2.60 demo.. so I guess the checking for the correct serial was above.. maybe ?

NOW YOU HAVE A GENERAL HYPOTHESIS THAT THE SERIAL VALIDATION TOOK PLACE BEFORE THIS PIECE OF CODE

Then more freqasm/kernel/user..

Is there some debug files for windows dll that I can give to softice to see what is happening better ?

YES THERE ARE AVAILABLE IN THE MSOFT SITE. AND NO, THEY DO NOT HELP UNDERSTAND WHAT YOUR APP IS DOING, ONLY WHAT THE KERNEL IS DOING, AND YOU DO NOT WANT TO DEBUG THE KERNEL OR THE USER32 DLL, DO YOU?

Then back to tabledit, back to freqasm/kernel/user, and I finally arrive at an event server loop (I think... made of TranslateAccelarator, Translate message and DispatchMessageA), which makes me sure that the program decided now that my password was no good.

So back to the first call.

I see that it does first some register access, creates an entry with my username and password.

YOU ARE WARM

I'd expect the program to do that after it has validated my password...

NOT NECESSARILY

any idea why it happens before ? (or maybe I did not see the validation ?)

IT MAY STORE THE PWORD GOOD OR BAD AND DO THE ANALYSIS LATER.

NOTE WHERE THAT ENTRY IS LOCATED, AND TRY TO BREAK SOFTICE (bpr, bpm?) WHEN THAT ENTRY IS READ. I AM NOT SURE WHAT YOU MEAN BY ENTRY: REGISTRY ENTRY OR MEMORY LOCATION ENTRY.

Then the program does some length calculation, checks if the username is not User, Registered, or Chafe (?)

I WOULD TRY IMPUTING THOSE STRINGS AS USER NAMES AND SEE WHAT HAPPENS

Then it changes the first letter of the username to a capital..

It tries now to convert the password to a hex number at some point, which makes me believe that the password is a hex number.

IS IT DIRECTLY CONVERTING A STRING INTO A HEX NUMBER OR IS IT MAKING A HASH OF THE PASSWORD?. . .

Then a few other things happen, which I do not totally understand..

i THINK YOU SHOULD TRY TO GO SLOW
HERE, IT SMELLS LIKE THE VALIDATION ROUTINE MAY BE CLOSE. PUT A BPM ON THE ADDRESS OF THE HEX EQUIVALENT OF YOUR PASSWORD, SO YOU CA TELL WHEN THE CODE READS IT

and then we are back in the main progam..

THE VALID, NO VALID INFO MAY HAVE BEEN PLACED ON A FLAG, IN MEMORY OR IN A REGISTER DURING THE VALIDATION ROUTINE ( THAT YOU HAVE NOT ISOLATED YET)

If someone would care to see if I understand (at least something...) correctly, and give me a hint where the actual validation of the password takes place, I'll be thankful.

Also (yes I'm full of questions..) can I quickly go back to the main program when windoze decides to do kernel/user/freqasm stuff ?

F12 (PRET) GOES FASTER

Is there a way to see the stack more easily than displaying memory, then looking how the pointers/data items were entered and write it down ?

WS COMMAND OPENS A WINDOW FOR THE CALL STACK. OTHERWISE LEARN TO USE THE 4 DIFFERENT DATA WINDOWS SICE PROVIDE AND KEEP ONE POINTED TO THE ESP
Why does softice give me some addresses like with segments, like
1234:004654567.

I thought that with 32 bit app, all the segments/offsets were not used anymore ?

Does some segments still have a meaning ?

Thanks !

UPPERCASE WAS USED TO MARK MY COMMENTS, NOT TO SCREAM
Kayaker
08-16-2002, 09:31 PM
Hi All,

I like the purely theoretical approach to this, an unknown and difficult problem, helpful wise reversing suggestions to solve it, resulting from a good description of the problem. Makes a hell of a more interesting thread than another crack patch upload. Someone mentioned this forum getting duller and duller by the day? Lol, truer words have never been spoken my friend :D

Anyway, this is fun reading because there is one more piece to the puzzle. Everything said were excellent suggestions which will get you to the inevitable fact that there is no solution to this problem. Keep this possibility in mind always and be suspicious when approaching a reversing problem.

Your analysis of the general code flow and the curious returns to kernel code were correct, and you were right in thinking this didn't seem right. Keying in on TranslateMessage to know you've gone too far in code was a good trick, as is always using an API monitor, which will often pick up the exact code you're looking for.

Getting to know API code flow and the general way in which the kernel handles program calls is important, especially to be able to recognize when the code isn't behaving as you think it should. You were expecting at least one more call to validate your s/n and it seemed to never be made, always returning control to kernel code. Well, I'm afraid that's actually the answer, I guarantee you won't find the s/n check because it doesn't even exist in this particular target.

This is a good target to try to uncripple the features and remove the watermarking, but the serial number routine is entirely fake I promise you. Confuse-A-Cracker code. Everybody remember the Monty Python sketch "Confuse-A-Cat"? lol, I always think of that :p The ref to Chafe is a crack author check from a very old version (1.06?) which had a valid routine, future versions did not, it was just quietly removed. I have a very fond place in my heart for this particular app since this was my pet project for months on which I was weaned into the art of reversing, something akin to a Mother's teat if you will...

Cheers,
Kayaker
naides
08-16-2002, 10:05 PM
KAYAKER:

I guess you are having a blast reading all the now useless stuff I wrote.

Well, that is the way I would have done it, if it the serial evaluation code did exist.
Kayaker
08-17-2002, 03:31 AM
Wasn't useless at all naides, it was textbook. Sometimes the textbook just needs to be thrown away that's all, as I'm sure you've experienced, that's the fun of it :)
Fake51
08-17-2002, 12:48 PM
This gives it away pretty easily: (from the help file)

Entering your password:

When you've gotten your password following registration:

· Follow the instructions you received with your registration code and go to the registered user page on any of the above sites.

· Download the latest full version of TablEdit.
· Install the files included in the zip (*.exe) file over those of your installed demo version and start the program.

Lol. Mind you though, it's possible to make the program show that you're a registered owner, although the program will still show up as demo.

The thing does indeed run thru some serial calc'ing, that's your standard run of the mill translate serial to hex and mess around with the name. There's a value in mem that's checked when the thing wonders if it should display the about box with a reg button or not, and this value holds the transformed value from the name calc'ing. The value is checked against 0 however, so you have to patch it to change it ;) Guess the author didn't bother changing his program too much when doing the stripped version.

Fake
cHeCksUm
08-24-2002, 08:51 PM
Hehe,
Reminds me of Muzicman... It was an app I cracked a while back. I like to return to the first apps I cracked now and again to see if they / I have improved. Well anyhow I worked on the serial routine for ages looking back on all my notes from previous versions but I could not crack the sucker. Seemd to be going in circles. In the end I decided to give it a break, and I forgot about it. Funny thing a while later I need just such an app so I went and purchased Muzicman and lo an behold was given a completely different download link from the one on the main page. In other words some time between my first attempts and the last one they had removed the serial routine.... I should have read the readme... would have saved me two three days of work.... but hell it was fun... and informative ;).

// cHeCksUm


First beta of new DeDe available
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > First beta of new DeDe available
PDA

View Full Version : First beta of new DeDe available

DaFixer
08-16-2002, 12:48 PM
it can be found here:

http://www.balbaro.com/ftp/dede/dede.3.20.04.prerls.rar

there are still things which are not completely working or not working at all.

The dsf editor is fully functional. Can be accesed via "show functions" from Options->Symbols menu for a loaded dsf file.

The dfm editor is mostly done. It can not save in changes in the executable. There is still what to want from the form recreation. Btw it is done in a smart way and im searching for a smart way to finish it :)

Clicking on a button disassembles the OnClick event handler for this button. If you see in the disassembly "* reference to control ...." click on it :))

Thats it for now. Waiting for comments and ideas.

The debugger probably will be a separate application distributed with DeDe. Im also working on it.

Oh and there are some improvenemts for a classes list. Try the popup menu or clicking on the columns.
DaFixer
08-16-2002, 01:51 PM
dont try the dfm editor with DeDe itself
TBD
08-16-2002, 02:26 PM
when started it shows an exception error
"access violation at 77F6754B in ntdll.dll, read
of address 000027" but in runs

on loading a delphi 5 program it shows another
exception and does nothing ...

also it doesnt want to exit, "exception error" :(

maybe it is not NT compatible ?

cya
TBD

btw, it shows the same problems in
Dede 3.10b build 1525 (exe only) :(
DaFixer
08-16-2002, 03:27 PM
Originally posted by TBD
when started it shows an exception error
"access violation at 77F6754B in ntdll.dll, read
of address 000027" but in runs

on loading a delphi 5 program it shows another
exception and does nothing ...

also it doesnt want to exit, "exception error" :(

maybe it is not NT compatible ?

cya
TBD

btw, it shows the same problems in
Dede 3.10b build 1525 (exe only) :(

I develop it on Win98 and test it on Win2k and Win98. Give me a link to that delphi 5 program that crashes the processing
DaFixer
08-16-2002, 03:29 PM
Originally posted by TBD
btw, it shows the same problems in
Dede 3.10b build 1525 (exe only) :(

btw you can get delphi, compile it and debug sources to see why it crashes on NT
TBD
08-19-2002, 06:30 AM
the program is BeyondCompare 1.9f [old version, 2.0 is now
available]

http://www.scootersoftware.com/bc19f.exe

i cannot get delphi, so i cannot test the software.
maybe there is someone with NT to test it :)
DaFixer
08-19-2002, 03:16 PM
quote:
the program is BeyondCompare 1.9f

just to let you know there is no problem processing this program on win2k
DaFixer
08-19-2002, 03:25 PM
find it here

http://www.balbaro.com/ftp/dede/dede.3.20.04.prerls.rar
TBD
08-19-2002, 03:29 PM
dumb me ...
after unzipin' 3.02full and replacing with 3.20 exe
it works like a charm :)

nice work dafixer and *thank you*,
TBD
Manko
08-20-2002, 12:05 AM
I get a 'Softice is not active or hidden...' when I try to export.
I'm using SoftICE 4.25.something... on w2k.
Could you just include an option NOT to check first? :)

/Manko
DaFixer
08-20-2002, 09:44 AM
quote:
I get a 'Softice is not active or hidden...' when I try to export.
I'm using SoftICE 4.25.something... on w2k.

well i use the oldest detection method for softice with checking for devices called SICE, SIWVID or NTICE with CreateFile. This should also catch sice on 2k right? If you have hidden your softice with another program then it wont be detected.

quote:
Could you just include an option NOT to check first? :)

why you need option not to check for softice ? :)
Manko
08-20-2002, 10:06 PM
Originally posted by DaFixer
quote:
I get a 'Softice is not active or hidden...' when I try to export.
I'm using SoftICE 4.25.something... on w2k.

well i use the oldest detection method for softice with checking for devices called SICE, SIWVID or NTICE with CreateFile. This should also catch sice on 2k right? If you have hidden your softice with another program then it wont be detected.

quote:
Could you just include an option NOT to check first? :)

why you need option not to check for softice ? :)

As far as I know I have not hidden softice in any way...
Still dede doesn't see it. (?!)
So that's why I would like dede to be able to export sym and load in softice, anyway. :)

/Manko
DaFixer
08-21-2002, 12:46 PM
quote:
As far as I know I have not hidden softice in any way...
Still dede doesn't see it. (?!)

May be someone can point me why its not detected on Win2K and probably how is called the device it creates on nt. I guessed it is SICE no?

quote:
So that's why I would like dede to be able to export sym and load in softice, anyway. :)

You can compile and load the map file by your self. Just use the .map file output and the tools to compile this map file which are deployed with softice. Btw DeDe uses exactly the same tools. I dont remember the name of the compiler byheart at the moment.

What i can do is to ask the user for confirmation to continue even when softice is not detected.
Manko
08-21-2002, 03:03 PM
Originally posted by DaFixer
quote:
You can compile and load the map file by your self. Just use the .map file output and the tools to compile this map file which are deployed with softice. Btw DeDe uses exactly the same tools. I dont remember the name of the compiler byheart at the moment.

Thanks for the tip! :)

Originally posted by DaFixer
quote:
What i can do is to ask the user for confirmation to continue even when softice is not detected.

That would be great! :)

/Manko
Qwer
08-22-2002, 07:06 AM
2 DaFixer :

I find small 'bug' : Dede can't process unpacked programs if it import section is not have name '.idata'. If i rename import section to '.idata' all work correct. ( This 'bug' not work on not original (not packed/unpacked) programs, i try to rename .idata section to other name, but all work correct )

Sorry for my poor english.
Best regards, Qwer
DaFixer
08-23-2002, 03:53 PM
quote:

I find small 'bug' : Dede can't process unpacked programs if it import section is not have name '.idata'. If i rename import section to '.idata' all work correct. ( This 'bug' not work on not original (not packed/unpacked) programs, i try to rename .idata section to other name, but all work correct )

DeDe should first check for import table rva directory entry in the pe header. If this rva do not correspond to none of the sections then it searches for section with name '.idata'. I havent seen so far the problem you have described. Of course when the PE header is correct there should be no problem processing dumped target but if its not and there are no section names there is no generic way to identify which section is which :)
britedream
08-24-2002, 09:41 AM
HI !,
The URL for downloading dede 3.20 is not working.Please, advise
where to download. Thanks.
DaFixer
08-24-2002, 11:18 AM
http://www.balbaro.com/ftp/dede/dede.3.20.04.prerls.rar
Athlon
08-24-2002, 12:02 PM
Does it support Delphi 7?
DaFixer
08-24-2002, 08:52 PM
Originally posted by Athlon
Does it support Delphi 7?

Man! Delphi 7 came out today. Give me some time :)) and give some time to the authors to code delphi 7 apps :)) Btw delphi 7 has new .dcu format so it will take some time to addapt the dcu dump engine. May be first release will be with no dcu.2.dsf engine support for delphi 7


newbie prob with reversing an ipaq app
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > newbie prob with reversing an ipaq app
PDA

View Full Version : newbie prob with reversing an ipaq app

hambam
08-16-2002, 01:39 PM
Hi,

need once again a little help.

After I finally installed this recommended IDA Pro 4.04 for doing some reverse engineering for my ipaq, read several newbie first steps tuts and crackme solutions, i started my very first try with phone manager from ia style. (iastyle.com)
It has a evaulation period of 14 days and is protected by a registration code combined with the email address listed in the ipaq device information.

First of all, i installed the app on my ipaq and copied the exe back to my pc.
Then, loaded into IDA, the upcoming messages for some missing dlls (aygshell, mfcce300,olece) canceled (allright?) and okay, now i have a good look at the code.
Next step, I tried to find some text like 'sorry', 'expired', 'registration' or 'purchasing', but noting found.

okay, more difficult as i whished for my beginning, but no cause to stop.

Next chance, perhaps i could find a function call to get system date, but negative, i only found a GetTimeZoneInformation, i believe this isn't the right way.

Does anyone have the right hint for me?
hambam
08-19-2002, 11:55 AM
okay, i found out that the serial is limited to length of 5 chars.
So i looked for 'strlen' and found a heap.
But nothing was compared with 0x05,
then i looked for all cmp R0,0x05 found one location but a simple check by changing the value to 8 didn't result the wanted effect, the same with 0E (the trial works for 14 days)
Changing the system date results:
'Program data or start time for using has been modified'

It seems to be a hard job (not only for me?), because i'm to able to set brps.

I found something like a disassembler running on the device itself (h**p://w*w.rainer-keuchel.de/software.html)
but i'm not sure it's working as requested.

Would be nice if someone could aid me with some hot hints.:(
evaluator
08-20-2002, 08:17 PM
All, about you are talking, you must done y0rself.
Search, Read & Learn

Dear Newbie!
Iwarez
08-20-2002, 10:25 PM
What do you think about getting a resource viewer and searching the strings there? After you get the ID you should search for loadresstring with that specific ID. Should help you out.
hambam
08-22-2002, 03:01 PM
@Iwarez: do u know any ressource viewer running on ipaq?

Now i've installed MS Emb.V.Tools and was able to debug this little thing.
But totally confused on what the code is doing.
Certainly it belongs to my inadequacy.:(

Here's the program entry point:
start
STMFD SP!, {R4-R7,LR} ; sub_0_50F54
MOV R4, R0
MOV R5, R1
MOV R6, R2
MOV R7, R3
BL loc_0_51048 #what the heck is done here?
MOV R3, R7
MOV R2, R6
MOV R1, R5
MOV R0, R4
BL WinMain # inside, the nagscreen is opened and displayed, including the button functionality
LDMFD SP!, {R4-R7,LR}
B loc_0_510A8

I wasn't able to find any time cmp or set reg flag. I didn't find also a if-clause which let display the nagscreen or not. But this must be inside one of these two BL's?!

@ evaluator: i'm still searching, reading and (trying to) learn(ing), but the way could be a little bit easier with a direction to walk, or?
DakienDX
08-22-2002, 06:51 PM
Hello hambam !

"BL" is the "Call" function.

The code you showed us is the same as writing:

Application.Init
Application.Run <- somewhere here is the nagscreen
Application.Done

Not only the nagscreen is shown in "Run", but the whole program is initialized and run. So you've basically found nothing.

You might want to read this (http://www.woodmann.net/fravia/hexc_evtdebug.htm) and this (http://www.woodmann.net/fravia/nchanta_Abusing_microsoft_EVT2.htm) tutorial for some information on applications not running on x86 CPUs.
Iwarez
08-22-2002, 11:18 PM
You need to copy the .exe over to your PC and view the resources there. If you use resource hacker (Very good) you need to convert the ID's first to HEX before searching them in IDA with Alt-i. I believe you can also search direct by removing the '0x'.
waynek
08-23-2002, 12:38 PM
BL loc_0_51048 #what the heck is done here?

BL is the ARM "Branch and Link" instruction, basically a call.
The return address is stored in the LR reg (r14) rather than on the stack as x86.

You've had some good advice on this board already - load the arm executable into some resource viewer (brw, whatever) and search the string table just as Iwarez said... however, there is one small thing to add here. Because of the way ARM stores it's instructions (and uses the internal barrel shifter) you will need to do something like... eg:

You're searching for "Registration failed!", and it's string ID 0x7F13.

Becase the ARM code will compile to something like:

Mov r0,#0x7f00
Orr r0,r0,#0x13

You will need to (obviously) search for "0x7f" to make sure you find the string reference you're looking for.

After that it's all fairly simple usually, in fact easier than most x86 things because all opcodes are 4 bytes long so finding space for your code is a simple matter :)

-WK
hambam
08-23-2002, 01:51 PM
Hi,

clearly, the BL is a call, i knew.
i'm able to follow the program while debugging (mostly), but don't understand what the program really does.
I tried to debug the app step by step so see whe the screen is opened. Somewhre before there must be testing sequence. But wether i found out how and where the program holds the regged status and where it's read,
nor where it branches to good or bad guy. "Suddenly" the nagscreen pops up and i'm as clever as before.:(

i explored the ressources with ressource hacker and found the dialogs at 30001 and 3002 and found the myst string 'sorry...' at 50400 (Hex: C4E0).
And i searched through with IDA all occurences of 0xC4 but didn't find one MOV with 0xC4 in.
waynek
08-23-2002, 03:55 PM
ok, in that case the program probably stores the string reference "locally" (in what ARM calls a "literal pool", to make it close enough to be pc-relative)... so what you get is something like:

ldr r0,[pc,#0x208] <-- loads 32bits from pc+0x208 to r0

and suddenly r0 points to your string reference.

Search again for all 0xC4's, and see if there is one after a chunk of code stored as DCD 0x0000C4E0 for example, then scroll up a little in IDA and you should see the code you need...

Good luck :)
Iwarez
08-23-2002, 10:06 PM
ARM programs are easy to crack as the source is very clear to read and related to the intel IS. I suggest you don't search for 0xc4 but for 0xc400 or for 0xE0. It can't be very hard.

I think waynek meant that but swapped the codes he typed before...

If you are really really stuck, contact me at xxx.sharewood.org. (xxx = www) The people there would also like to learn and are PPC and HPC minded ;)
hambam
08-26-2002, 10:14 AM
First of all, thx for your hints.

Searching for 0xC400 was succesful, so i found the str-ref for 'sorry evaluation period expired' and 'x remaining days'

BL j_mfcce300_366
LDR R3, [R4,#0x7C]
MOV R1, R4
ADD R0, SP, #0
CMP R3, #0
LDR R3, [R1,#0xC8]!
LDR R3, [R3,#-8]
BNE loc_0_4BD04 ...... to str-ref '...expired...'
CMP R3, #0
BLE loc_0_4BB7C ...... to '...days remaining...'
BL j_mfcce300_321
B loc_0_4BB88

I debugged with a breakpoint just a few bytes before and let the prog 'ignore' the BNE and the BLE.
The result was, that the prog displays the 'start trial'-button again, but pressing this button, quits the prog nevertheless.

The subroutine was called from
DCD j_mfcce300_2379
DCD j_mfcce300_1079
.rdata:0005673C DCD sub_0_4B9E8 .... here! ...
DCD j_mfcce300_2013
DCD nullsub_14

and i can't find the call for this location.

further hints are welcome as always ;)
waynek
08-26-2002, 12:47 PM
Hmmm, ok...

BL j_mfcce300_366 <-- which syscall is this?
LDR R3, [R4,#0x7C] <-- your "good guy" flag...
MOV R1, R4
ADD R0, SP, #0
CMP R3, #0 <-- is flag 0?
LDR R3, [R1,#0xC8]!
LDR R3, [R3,#-8]
BNE loc_0_4BD04 ...... to str-ref '...expired...' <-- if flag != 0
CMP R3, #0
BLE loc_0_4BB7C ...... to '...days remaining...' <-- if flag < 0
BL j_mfcce300_321
B loc_0_4BB88

So... without saying anything more, I think you should be able to see what you need to do? Of course it's possible there are other good/bad flags and other checks, but for this particular one... :)

-WK
hambam
08-26-2002, 02:51 PM
BL j_mfcce300_366 <-- which syscall is this? = str manipulation i think, but which meaning?
LDR R3, [R4,#0x7C] <-- your "good guy" flag... i assumed but ...
MOV R1, R4
ADD R0, SP, #0
CMP R3, #0 <-- is flag 0?
LDR R3, [R1,#0xC8]!
LDR R3, [R3,#-8]
BNE loc_0_4BD04 ...... to str-ref '...expired...' <-- if flag != 0
CMP R3, #0
BLE loc_0_4BB7C ...... to '...days remaining...' <-- if flag < 0
BL j_mfcce300_321 <-- str manipulation, too, what meaning , too?
B loc_0_4BB88

ok, as i said, simply setting r3 to 0 or nop'ing the BNE and BLE isn't the right way. On one hand, the nagscreen appears with the 'start trial' button again (instead of the register button), looking like the app can't expire any more but on the other hand, pressing 'start trial' quits.
So there must be another flag which turns the button functionable.

But i would prefer to disable the nagscreen completely, but i've probs with going back the code.

The subroutine starts from 4B9E8 and is refrenced from 5673C. (as mentioned above) But how could i resolve the location where the prog goes to 4B9E8?
waynek
08-26-2002, 06:18 PM
>The subroutine was called from
>DCD j_mfcce300_2379
>DCD j_mfcce300_1079
>.rdata:0005673C DCD sub_0_4B9E8 .... here! ...
>DCD j_mfcce300_2013
>DCD nullsub_14

ok, this is a jumptable, so you need to find the address of the first item in this table (00056734?) and look for the instructions that load that address (everything else will be an offset from that)...eg:

ldr r0,[pc,#0x100] <-- might load base of table
add r0,r0,#0x08
mov pc,r0

or similar sort of rout I guess... IDA will do it's best and cross-ref these for you, but it won't recognise them as call/ret (or branch in ARM :) ) because technically speaking they're not...

Good luck! And if you want to PM me the name of the app, I'll take a look myself if I get time so I can answer your questions better.

-WK
hambam
08-27-2002, 12:06 PM
another day, another try, ...
could it be that a debugger protection found his way to the portable devices?
Setting a breakpoint and run never breaks again after the window is once opened. :mad:
And it could be sooo easy, with this little wcscmp...

the following code looks very suspiciously :;)
MOV R1, R7 --> R7 holds my entered test serial, i think
ADD R0, SP, #0xC --> no idea
BL j_wcscmp --> whooop?
MOVS R3, R0
BEQ loc_0_4F2D4 --> jump to?
MOV R0, #0x410
ORR R0, R0, #0xC
BL j_mfcce300_315
CMP R0, #0
BEQ loc_0_4F2CC --> jump to?
MOV R3, #0x1E
STR R8, [SP,#8]
MOV R1, #0xB400 ->B403 = str_ref 'Serial invalid'
STR R3, [SP]
MOV R3, #0x64
STR R8, [SP,#4]
MOV R2, #0xC8
ORR R1, R1, #3 ->
BL sub_0_41CA0
B loc_0_4F2D0

4F2CC: MOV R0, R8
4F2D0: BL j_mfcce300_704
4F2D4: ADD SP, SP, #0x3C
LDMFD SP!, {R4-R8,PC}

Something other looks strange:
the window which is displayed after entering a bad serial, displays also an strange text: '200:200:20:0' which isn't depending on the entry.
waynek
08-27-2002, 12:38 PM
Well, to be honest I'm not sure that it's anti-debug protection, I've had a lot of problems using the embedded VC debugger on various programs, some of which I wrote myself and I *KNOW* they didn't have any protection :) (except for being very poorly coded...)

Anyway, to your src snippet:

MOV R1, R7 --> your serial, or the one calced by the program?
ADD R0, SP, #0xC --> r0 = a "serial" from the stack
BL j_wcscmp --> compare unicode strings
MOVS R3, R0 --> put the result code in r3 (and set flags)
BEQ loc_0_4F2D4 --> jump to end of subrout below
MOV R0, #0x410
ORR R0, R0, #0xC
BL j_mfcce300_315 --> which rout? using resource id 0x41c?

----8<---snip!---

wcscmp should return 0 if the strings match (which I assume is good for our purposes), so disasm the code that the program would take if r0=0 when it returns from the BL j_wcscmp...

Keep digging :)
hambam
08-27-2002, 04:09 PM
another idea,

could it be possible, instead of displaying 'invalid serial number' just simple displaying one or two register values?

something like:

LDR R0, [serial] --> not really needed, because of the right one should be already be in R0, or?
MOV R1, #0
MOV R2, #0
BL MessageBox

would be sooo nice! :D
hambam
08-28-2002, 07:15 AM
I've tried this:

The mfcce_300_674 (SendMessage) is at 50918.
The BL fount at 4F288.
That results the BL to A2 05 00 EB, or?

MOV R1, R7
ADD R0, SP, #0xC
MOV R2, # 0
A2 05 00 EB: BL j_SendMessage
BEQ loc_0_4F2D4
MOV R0, #0x410
ORR R0, R0, #0xC
BL j_mfcce300_315 --> what is this BL doing?

But the MessageBox isn't displayed.
Shouldn't the program pause at this SendMessage waiting for a OK from me?
waynek
08-28-2002, 04:49 PM
Sorry, you've totally lost me now :(

I think you should tell me what the program is you're looking at, so I can disasm it for myself and make sure I'm looking at the same code as you are...

If you want me to take a look + try to help, private message me the name or publically reply if you want others to help instead hehe!

-WK
hambam
08-28-2002, 04:56 PM
oh, i really sent you a pm, but never been read :(

i mentioned it allready in my very first opening post:

the program comes from 'ia style' found at iastyle.com
the program is called 'phone manager'

would be very nice, if someone throws me a new hint.
I'm running out of ideas. :confused:
hambam
09-03-2002, 07:06 AM
ok, i simply tell you my next episode...

I've finally found out, that i'm able to set a working breakpoint just after entering a serial of free choice.
the program breaks and brings me to 4C6C8. There's a lot of wcscpy's, two reg entries were read ({7CA42CDB-C9A6-4c1d-A803-094B448EC405} and {4286CEC3-9F62-4735-8F5B-677683B1617F})
and then the strange code:

BL j_setjmp
MOVS R3, R0
BNE loc_0_4C838 -> to bad guy str ref
MOV R3, #0x254
ADD R3, SP, R3
MOV R2, #0x19C
ADD R2, SP, R2
ADD R1, SP, #0x5C
ADD R0, SP, #0x18
BL sub_0_4E09C -> a big checking sub

The big sub makes the whole checking thing returning several times at the MOV R3,R0 instead after the sub (as normally).
As you can imagine, it's no solution to simply nop'ing this BL. The result is in displaying the 'thanks for register' message but quitting the prog nevertheless. So it seems to be very tricky. I believe that the serial number is used to calculate a different return address. How clever. :mad:
waynek
09-03-2002, 12:40 PM
I had a very quick look at this app at the weekend, and I think you're in the correct place now - the string refs I found interesting were 0xC3B5-8, and the subrout starting @ 4c520 seems to be the one to work on.

I also noticed a string ref that said "This program has been modified" or something similar, so expect a CRC somewhere along your path :)

Sorry I don't have time to dig deeper right now, I'm very busy IRL. If you're still looking at it in a week or so, I'll be happy to take another look with you...

-WK
hambam
09-03-2002, 03:08 PM
yes, C3B8 i found too (thanks...).
the code which loads the str for displaying is found only a couple of bytes below of my code snipet (at 4C7B4).

The 'program has been modified' doesn't seem to be a real CRC check. I've made code changes several times now and no prob with this message.
This message is displayed if you try to modify system date.
So i think, it's only to block some newbies like me (but without success ;))

I think, i will need your assistence next week, because of i didn't found a bad guy / good boy- switch so far and there's too much knowledge missing.

deep thx so long and i'm looking forward for your reversing job. (Certainly i'm still on my way to understand the prog)
hambam
09-06-2002, 12:22 PM
in the meanwhile, i've totally lost any new ideas how to go on, so i decided to simply look trough the code and just patch something somewhere, just were the code looks strange.
I know it's the worst way to get any result, but i'm a little bit frustrated now.

Perhaps in the middle of a night, a new strategie bites me and i find my way back to seriousity.
:( :( :(


anti-debug stuff?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > anti-debug stuff?
PDA

View Full Version : anti-debug stuff?

fjrp2
08-16-2002, 06:03 PM
Hi!

Is there any way to avoid anti-debug trick such as:

(16-bit code follows):
cli
xor ax,ax
mov es,ax
mov ax,es:[84] ;old int 21h
mov es:[4],ax
mov ax,es:[86]
mov es:[6],ax
sti

or using lidt/change idt in 32-bit protected mode?
Fake51
08-16-2002, 06:27 PM
Sure, but it typically takes som manual labor.

With the 16-bit code just jump over the code in question, and then log all calls to int 21h. Looking at the new handler, it should be easy to see when an int 21h would proceed to protection code, and when it'll just jump to the old handler. Then reroute accordingly.

Basically, do the same with 32-bit code.

Fake
fjrp2
08-16-2002, 06:42 PM
Thanx for your quick answer, Fake51!

But is there a way to know when the the real int21 is being used, and when is the 'fake'? Instead of doing it by hand (imagine, if thew guy is paranoid and has fullfilled all around with this stuff)

And in protected mode, is ther an easy way to access IDT?
DakienDX
08-22-2002, 11:41 AM
Hello fjrp2 !

It looks to me like program executes INT 01 instead of INT 21 to prevent single stepping through the code.
So both INT 01 and INT 21 point to the old INT 21 handler. I don't know why you want to know when INT 01 and when INT 21 are executed, since they're equal, and I don't know what you want to do with it. If you plan to single-step through the application, you must redirect the INT 01 handler a bit. However, I don't know how to do this in SoftICE, but Turbo Debugger will handle this fine.

You should redirect the INT 01 to some memory location where you some bytes for your own code. (I use 9F?0:0000 most time)
At this location you place some code like
Push BP
Mov BP, SP
Cmp Word Ptr SS:[BP+4], 01CDh ; Look if called by INT 01
Pop BP
Je EmulateINT
Jmp SegmentOldINT01:OffsetOldINT01 ; normal INT 01 by TF, call debugger INT 01
EmulateINT:
Jmp SegmentINT21:OffsetINT21 ; call was by direct INT 01, call INT 21 insteadI didn't care about the flags here, but you can add some code to handle them if you like.

So when you're tracing code, TD's INT 01 will be called, but if you step over an INT 01 call, the original INT 21 will be called, since TD places an INT 03 after the INT 01 call and executes the INT 01 call normally. You can even set breakpoints with this.
fjrp2
08-22-2002, 05:55 PM
Thank you DakienDX!

Just what I need :).


Softice and screen refreshing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice and screen refreshing
PDA

View Full Version : Softice and screen refreshing

Flack
08-16-2002, 11:28 PM
Hey guys,
I have a question on softice. I am currently running it in windowed mode which is what I want. Now, is there a way to make it so that when the screen refreshes, it paints over the softice window? For example, when I get to a call that does some repainting on the game screen, my softice just flickers and the call is done. According to the tut Im reading, its supposed to be painted over.

Anyone have any ideas?

Thanx for the help.

-Flack
cr.ap
08-17-2002, 02:28 AM
you can press "F4" to see the programm screen.

cr.ap
Flack
08-17-2002, 02:40 AM
I know that I can do that but that will just show me what was drawn under the softice window. I want the actual softice window to be painted over.
Kayaker
08-17-2002, 05:32 AM
Hi

Not sure if this is the problem you meant, but F5 a couple of times in Windows (refresh desktop) gets rid of the scrambled background Softice screen you sometimes see after returning from SI.

Kayaker
Bengaly
08-18-2002, 07:10 AM
naa, i think he ment this:

when u step over a Call SI disapear for like ½ sec
which causes a "flicker"..
well from what i know it hapens under win98 with si 4.05,
ds 2.6 uder win2000/xp doesn't make this flicker.
i guess its video card problem (i got gf20)..try play with settings of si..else use win2000 :-) with ds2.6/7
cya
DakienDX
08-18-2002, 10:36 AM
Hello Flack !

I assume you're looking for the command FLASH [ON | OFF].

According to the SoftICE help it says "FLASH - Restore screen during P and T".

So your screen will be updated every time you do a F8/F10 step. (default key settings)


Can I set a breakpoint on a key press?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Can I set a breakpoint on a key press?
PDA

View Full Version : Can I set a breakpoint on a key press?

Flack
08-17-2002, 02:09 AM
Hello,
Is it possible to make softice break on a key press. For example, if I wanted softice to pop up when I hit the insert key, is that possible?

Thanx for the help,

-Flack
naides
08-17-2002, 04:22 AM
Yes.

I would use bmsg [handle of your app] wm_keyup if (Wparam==[ VK_TAB])

Wparam is in esp-c I think

The virtual key code of [tab] VK_TAB is 09h,
but your app may have changed it.
if you want sice to break when the tab key is released.

Hope this helps
Flack
08-17-2002, 10:36 PM
Thanx for the reply but Im still having some trouble.
I type this into softice:

bmsg 8B8 wm_keyup if (esp-C==2D) (where 8B8 is the handle)

to break on insert key, but it doesnt break. When I use hwnd to find the handle of the app, is it the first one I see or not? For this app the insert key is supposed to be a shortcut for pressing a button. Do I need to use the handle of the button?

Anyway, I would really like it to break when I release the insert key so any help is appreciated.

Can you maybe use notepad as an example? Like, have softice break whenever you release the tab key in notepad? For notepad I only found two handles, one called Notepad and one called Edit. However, I couldnt get sice to break.

Thanx a lot,

-Flack
naides
08-17-2002, 11:02 PM
Originally posted by Flack
Thanx for the reply but Im still having some trouble.
I type this into softice:

bmsg 8B8 wm_keyup if (esp-C==2D) (where 8B8 is the handle)

Try first without the IF clause, as I said, I am not sure where in the stack is the wparam take a look at the stack and you can tell where it is

to break on insert key, but it doesnt break. When I use hwnd to find the handle of the app, is it the first one I see or not? For this app the insert key is supposed to be a shortcut for pressing a button. Do I need to use the handle of the button?

Use the handle of the active window of your app.

Anyway, I would really like it to break when I release the insert key so any help is appreciated.

Can you maybe use notepad as an example? Like, have softice break whenever you release the tab key in notepad? For notepad I only found two handles, one called Notepad and one called Edit. However, I couldnt get sice to break.

Thanx a lot,

-Flack
Snatch
08-18-2002, 12:45 AM
Why not just find the message loop of the routine address with Spy++ and use good old Ida Pro to figure out where WM_KEYUP is trapped and how it handles it. Deadcode is always easier than livecode.

Snatch
DakienDX
08-18-2002, 10:28 AM
Hello Flack !

It looks like your breakpoint should be bmsg 8B8 wm_keyup if (@(esp-C)==2D).

This makes sure that SoftICE compares the value at the address ponited by[ESP-C] instead of the value ESP-C itself.

Also, parameters are pushed onto the stack before the call, so any paramter will be at [ESP+??]. So [ESP-??] will not work for parameters.


Inside a MD5 (?) protected Java prog
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Inside a MD5 (?) protected Java prog
PDA

View Full Version : Inside a MD5 (?) protected Java prog

Artifex
08-17-2002, 06:23 AM
Hi, fellows.
Here comes attached a decompiled java class which verifies the license serial number, and I hope you will enjoy reading as a thriller.
With the informations that we get from it("MD5", "MODULUS_HASH", "MODULUS_WRAP", "PUBLIC", and BigInteger values), do we need more to keygen the prog ?

Thanks in advance.
Artifex
cyberheg
08-17-2002, 08:58 AM
Yes you forgot the most important thing you need. A motherfucking fast computer to factorize the public key if you want to solve it without replacing the keypair. Without spending more then a few minutes on it a safe bet is that it uses RSA with a pretty high N.
My reasons for saying this is:

public static final BigInteger PUBLIC = BigInteger.valueOf(0x10001L);

This value is a common one for E and the public key itself N is

public static final BigInteger MODULUS_WRAP = new BigInteger("s4c8z8jq19imm4xg0im5aw556gaxksv6jgo2dtdynpnmxkerb86nsetcgnrbmhcmmcix3sisthihf0lrzlo4znqepklqolnm86n4dgabga8cctyf3dtivp3yp4mdor1xi8z18pu88q1bnkdoze4xsiq2ay0spnb9c4gt4ztfff8j0mpi14kk1e5qwpgb5hf4ej9n65", 36);

which seems to be stored in radix 36 from what the java api documentation says.
Then it does a modpow() operation using these two numbers:
biginteger2 = biginteger2.modPow(PUBLIC, MODULUS_WRAP);

It also uses MD5 but this is really unimportant until you get around this part first.

// CyberHeg
Artifex
08-17-2002, 09:27 AM
Hi, CyberHeg, and many thanks for the explanations.
One more question :
I suppose that the prog needs its private key to decode the serial number, and the private key must be somewhere within the files. Is that correct ?

Artifex
cyberheg
08-17-2002, 09:31 AM
No, thats the beauty of public key encryption. Your public key is public and the private key is private. Assuming this is a private key encryption which have been done then the authors of this license scheme encrypts the licenses with the private key and it gets decrypted with the public key.

Your task is to derive the private key from the public key which (if implemented correctly) should be a task mathmatically so huge that it would take more then a life time.

I suggest you go read some stories about Alice and Bob and publickey cryptography. There is plenty free reading material on the web including full books in html and pdf format.
One of these is Applied Cryptography by Bruce Schneider.

// CyberHeg
Artifex
08-17-2002, 10:37 AM
Hi, CyberHeg, and again many thanks for the explanations.
I have read many pages about public key encryption, I compiled and run many short demo programs in C, Java, Maple etc..., and I still get confused on the most basic principles as those you had to remind me of.
Now I got it clearly, but for how long ? The time to write this, and I already need to read again your explanations and understand what part uses or needs which key.
I know about p, q, n, d and e. Usually each part has is own e and own d. As they share the same p, q and n, one part encodes with the other's e and the other part decodes with his own d. So the d private key must be somewhere (in the other's safe or mind when two people are exchanging informations, or -in the case of a software- in some file).
But in the case of that serial number both sides (the serial number coder and the serial number decoder) have the same e and the same d. The serial has been encoded with d (that we don't know) and is decoded in the program with e = 0x10001. Like in the case of a DSA signature ?

Sorry, if I am still mistaken.

In the case of this prog, we can't find valid SN, but we can rub out all the RSA lines, return "Yes, the SN is correct " :) and recompile the .java. The guy wrote all the RSA protection for nothing (like in JBuilder, and many others).

Artifex
mike
08-18-2002, 04:27 AM
Yes, that's right. The verifier is for your own protection, so that you know it came from a particular source. It's not to prevent you from doing stuff.
jjhsd
09-04-2002, 08:28 AM
one possible scheme is to taking a hashing on user's name, then apply your private key on it, the output will be the registration code. in your program, apply public key to the registration code and compare it with the hashing value of user name.

the good thing is that public key in the program can only verify the registration code, but cannot generate.
Artifex
09-04-2002, 11:29 AM
Hello, jjhsd !

It has been so easy to rub out all the RSA stuff from the license.class, then to recompile it, get the program working and throw it to the trash bin !

Until recently we used to deal with long...long asm routines shifting, multiplying, xoring etc... lines after lines....

Now we have 1024-bit prime products.

But we still arrive to a simple flag : 0 = uncorrect SN, 1 = correct SN.

Nihil novi sub sole.

Artifex.


Pencil and paper decryption ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Pencil and paper decryption ?
PDA

View Full Version : Pencil and paper decryption ?

Artifex
08-17-2002, 06:43 AM
My target is a java prog whose classes are zipped and crypted.
I attached a fragment of the crypted file and the same decrypted (by the prog itself at runtime). So we have plain and crypted text.
The decrypted file is 597776 bytes long and the crypted one is 597777.

I will modify a class, recompile it, rezipp it, and I will have to crypt it back, so I need to guess the algoritm.

If you compare both fragments you can see that all zeroes of the plain text are just xored with their position in the file plus 7.

But with the other bytes it seems a bit more complicated.

TIA for informations.
Artifex

Sorry, I forgot to attach the files. I will do it in next message.
Artifex
08-17-2002, 06:48 AM
Here comes the attached file.

Regards.
Artifex

<deleted>

I can't understand why the attached file has been deleted, but I absolutely refuse to discuss it in order to avoid such boring serie of messages as in "JBuilder and DSA" thread about the threat of lawyers etc...

If someone wants to compare plain and crypted text, he may want to run the prog (Photopulse, whose only interest for me is the protection). The crypted file is photopulse.jar and at runtime the prog decrypts it in c:\temp. Save the 584Kb file before quitting the prog.
That simple...

Artifex
nofurs
08-17-2002, 12:49 PM
>I can't understand why the attached file has been deleted, but I >absolutely refuse to discuss it in order to avoid such boring >serie of messages as in "JBuilder and DSA" thread about the >threat of lawyers etc...

>If someone wants to compare plain and crypted text, he may >want to run the prog (Photopulse, whose only interest for me is >the protection). The crypted file is photopulse.jar and at runtime >the prog decrypts it in c:\temp. Save the 584Kb file before >quitting the prog.
>That simple...

If thats simple?copy and paste the file in here.Why bothered to upload? Me thinks only only plain source code is allowed to upload here no utilities,exe,patched is allowed.

regards
cluesurf
Artifex
08-17-2002, 01:44 PM
Hi, cluesurf.
Here is a fragment of plaintext :
00000000 504B 0304 0A00 0000 0000 6192 A82C 0000
00000010 0000 0000 0000 0000 0000 0900 0000 4D45
00000020 5441 2D49 4E46 2F50 4B03 040A 0000 0000
00000030 0061 92A8 2CD5 D202 09E3 0000 00E3 0000
00000040 0014 0000 004D 4554 412D 494E 462F 4D41
00000050 4E49 4645 5354 2E4D 464D 616E 6966 6573
00000060 742D 5665 7273 696F 6E3A 2031 2E30 0D0A
00000070 4372 6561 7465 642D 4279 3A20 416E 7420
00000080 312E 342E 310D 0A49 6D70 6C65 6D65 6E74
00000090 6174 696F 6E2D 5665 6E64 6F72 3A20 5068
000000A0 6F74 6963 6120 496E 632E 0D0A 436C 6173
000000B0 732D 5061 7468 3A20 6A67 656E 2E6A 6172
000000C0 2073 6178 7061 7468 2E6A 6172 206A 6178
000000D0 656E 2D63 6F72 652E 6A61 7220 6A61 7865
000000E0 6E2D 646F 6D2E 6A61 7220 6C6F 6734 6A2E
000000F0 6A61 0D0A 2072 0D0A 496D 706C 656D 656E
00000100 7461 7469 6F6E 2D56 6572 7369 6F6E 3A20
00000110 7631 2D30 2D31 0D0A 496D 706C 656D 656E
00000120 7461 7469 6F6E 2D54 6974 6C65 3A20 5068
00000130 6F74 6F50 756C 7365 0D0A 0D0A 504B 0304
00000140 0A00 0000 0000 6092 A82C 0000 0000 0000
00000150 0000 0000 0000 0400 0000 636F 6D2F 504B
00000160 0304 0A00 0000 0000 6092 A82C 0000 0000

Here is the encrypted version :
00000000 7A57 430A 0E01 0C0D 0E0F 1070 80BB 3815
00000010 1617 1819 1A1B 1C1D 1E1F 2028 2223 2468
00000020 6373 6904 6365 6A02 7E64 3335 3833 3435
00000030 3637 59AB 9217 E9EF 3C36 A341 4243 A745
00000040 4647 5C49 4A4B 0108 1A0E 7D18 1C15 7B18
00000050 1719 111F 1F08 0873 1319 2D00 0C0A 0200
00000060 1513 453F 0F19 1F04 0101 4A51 435D 4478
00000070 7C34 0A1C 1B0F 1919 533D F9BB A2C2 EAF1
00000080 A6B6 A6BD A4BA 8187 C7E2 E0FD F7FE F1FB
00000090 E2F6 ECF0 F5F5 B1CB FBF1 C4CE D099 84F5
000000A0 CEC8 DCC0 C9CA 8CE4 C0CC 9EBC B8F0 D8D4
000000B0 C5C4 95E9 DBCF D487 9ED5 A7A4 ACED AEA4
000000C0 B4E7 BBA8 B2BB ADB9 A6E1 BAB0 A0F3 BEB4
000000D0 AEB2 B6F4 B9B4 AEB8 F0B5 8193 C289 859D
000000E0 8389 C58D 8586 C287 8F9D D09D 9D94 C09F
000000F0 D89D 99F4 F0DB 8EF0 F4B6 6D71 6E66 6960
00000100 6873 697D 6364 6220 586A 6262 7B7C 7A2F
00000110 3661 2934 2A36 2D10 1456 4D51 4E46 4940
00000120 4853 495D 4344 4200 7A46 445D 5709 1465
00000130 5E58 4C56 6A4E 504E 5B32 4A4C 4813 0F46
00000140 424D 4849 4A4B 4C2D DCE7 7C51 5253 5455
00000150 5657 5859 5A5B 5C59 5E5F 6002 0D0E 4B35
00000160 2D64 6C63 6A6B 6C6D 6E0F E2D9 5E73 7475

-------------------

Notes :
First byte of encrypted version (0x7a) is surely relevant, but it is not an encrypted byte of the plain text.
First encrypted byte is at offset : 00000001 (0x57) and encrypts the plain text byte which is at offset 00000000 (0x50).

As I wrote in first message, 0x00 ---> 0x00 + 7 + position.

I am working on byte 0x0a and listing the encrypted values according to position, and trying to guess the algorithm.

Artifex
cyberheg
08-17-2002, 02:01 PM
Excuse me but isn't is a bit stupid to guess the algorithm when you have the target which does the decryption itself?

You wrote yourself that the program decrypts it at runtime. So naturally it must hold the algorithm as a parts of it's code. Why not look for that instead of guessing? For all I know it could be OTP (study some book if you're in doubt what it is).

Somehow this reminds me the newbies in programming who wrote a program that failes in one way or another and then instead of using a debugger to find out where the program fails they are trying to guess it by reviewing the source code.

// CyberHeg
Artifex
08-17-2002, 03:13 PM
hi, cyberheg, and thanks for your comments.

As you asked gently for it, I excuse you.

As you didn't suppose, I tried to find the decoding routine somewhere in the prog, but didn't succeed (it is a short .exe and a lot of java classes, some in the two crypted packages and some in clear packages, but very numerous and I didn't choose to decompile them all, eventhough I have the tools).

BTW, don't tell me that the decrypting routine can't be in the crypted packages, because I already guessed that.

I run the short .exe in Softice,
decoding is at :004016b1 call 401190
and I got lost (it seems that it calls the java virtual machine).

With paper and pencil I'm working on encryption of 0x0a and 0x65.
It can be OTP, but :
-the first suite of zeroes giving 0x0c, 0x0d, 0x0e, 0x0f and 0x10
-the second suite giving 0x15, 0x16, 0x17...0x20
-0x0a coded as 0x0a+3+position
make me feel that there is an algorithm.

Artifex
Snatch
08-18-2002, 12:43 AM
Look harder. Look harder. Look harder. Java encryption techniques are lame just a couple of xor and what not I am guessing based on what I have seen. There is a damn java decompiler you have your work cut out for you. This is a cakewalk. Dont try to figure it out by comparing thats bad technologies. Reverse better.

Snatch
mike
08-18-2002, 04:20 AM
Who deleted it? I didn't, and I don't know why it should have been. It's not a serial number or a cracked program. I might not check the forum every couple of hours, but I usually check every day and read all the new posts. I read them yesterday and today. (This thread pooped up fast).

If you disagree with something that has been posted, there's a link on evey post that says "Report this thread to a moderator." Please don't go around deleting stuff without telling me.

By the way, you can use something like grep to search through the jad files for xor or names like "encrypt".
Artifex
08-18-2002, 06:21 AM
To Mike :
OK, Mike. No problem.

To Snatch :
I will look harder, but I didn't make the choice yet of decompiling all those classes.
I thought I would not have to command : jad *.class

Artifex
Artifex
08-18-2002, 09:33 AM
Hi, all fellows.

No need to encrypt back the .jar file after rewriting and recompiling ! No need to guess the encryption algoritm !

I tried the following manoeuver :
I replaced the encrypted .jar files with the decrypted ones. I thought that the prog would crash, because, at runtime, it will decrypt not the files it expected but the already decrypted ones.
It didn't crash ! The decryption of the decrypted files doesn't change the bytes, i.e. gives the decrypted files !

The cause may be the presence of that supplementary first byte (0x7a) in the encrypted file. Without it (i.e with the decrypted file) there is no transformation of the following bytes.

It is now possible to rub out the RSA protection, and rezip the classes.
Fellow Gordon Freeman are you there ?

Artifex
naides
08-29-2002, 08:13 PM
Hi Artifex:

The encryption Algo is waht you said and only what you said:

Cypherbyte = plaintextbyte XOR (position + 7)

Look at it in binary and you will see the light.
Attached you will find an Excel Worksheet with the details.
Artifex
08-31-2002, 07:28 AM
Hi, naides, and many thanks for the information.
I didn't guess it myself because I made a sum instead of an XOR.

Naides, eres alguien !

Artifex.


Newbie-Question: How to add code with WDASM or Code Snippet Creator?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Newbie-Question: How to add code with WDASM or Code Snippet Creator?
PDA

View Full Version : Newbie-Question: How to add code with WDASM or Code Snippet Creator?

Nat
08-18-2002, 04:29 PM
Hi there,

I am an absolute newbie. Therefore, please do not read this thread if newbie questions bother you ;-)

I want to do a very simple thing. It has nothing to do with sophisticated reverse engineering. I just want to add some code to an application and, nevertheless, I find it very hard to do this.

The problem is that there are so many tools and I am not sure which tool I should use (my OS is WinXP). I also do not know how to use the tools.

This is what I have already done:

I have identified with Winhex the hexcode I want to change. It is "6A 00 E8 34 64 FF FF". Then I opened WDASM and tried to find this piece of code. I had some difficulties because the offsets in WinHex and WDASM are different (you probably roflka when you read this...but that's a poor newbie's prob ;-). I used the search function in WDASM and finally found "E8 34 64 FF FF". I found this code only once. Therefore, I am relatively confident that I am at the right place of the file.

WDASM told me that my piece of code means the following:

6A 00 = push 00000000
E8 34 64 FF FF = call 0040498C

Now ... I am already stuck ;-) I want to change this "call". What I want to do is the following. I want to jump to somewhere else and then return and continue with the "call". I am unable to figure out how to do this. I need to overwrite the hexcode at this place and insert a working piece of code which takes me to another place in the file and then I want to come back and continue with the call. I do not know which tool I need to use for this and how to use it. (Once I have managed to do this I can start to insert additional code which will be executed before I continue with the call. But that's not part of my question.).

I would be very grateful if someone could answer this question or help me out with a tutorial describing such most elementary stuff. If possible at all I would like to avoid the use of SoftICE because its seems to me that this tool is even more difficult to understand than WDASM or Code Snippet Creator.

Thanks so much for your help,

Nat

EDITED: I continue trying to find a solution for my problem and can report the following progress ;-)

I have loaded the file with WDASM and "loaded the process". It seems to me that something like a debugger with three windows popped up. One window has a button called "goto address". I entered the offset of the call and it seems to me that WDASM executed my file and stopped exactly before the call. Now I have found a button called "patch code". When I press this button, another window (the "Coder Patcher") pops up. I am asked to enter a new instruction for the call 0040498C @ EIP 0040E553. That's exactly what I want. But where should I jump? And how can I return from this location? And finally, how can I save the file after I have patched it in this way?
DakienDX
08-18-2002, 05:44 PM
Hello Nat !

I would strongly recomment using a PE-Editor for this too. A good one is LordPE. You can get it from the Programmer's Tools link below. You can use it to view the sections of the executable and alter their attributes. You can then find out where the program's code section ends (it's called ".code" or "CODE" most time). You should have some space available between the end of the code and the end of the section (only 00h bytes). This is the place to add your code.

With LordPE you can see the BaseAddress of the .EXE. So if your program would have a Base of 00400000h (very common), your code section would start at the file offset 600h and the place near the end of the code section where you want to add your code would be F800h, you would calculate 00400000h-600h+F800h=40F200h. 0040F200h is the so called "virtual" address. So you would enter "Call 0040F200h" with W32DASM at your patch-location.

Then you can insert your own code there (remember to save the registers with "PushA" and restore them with "PopA"). At the end of your code you should place a "Jmp 0040E553". This will jump back to the address which was called by the original call before you modified it.
Nat
08-18-2002, 06:14 PM
@DakienDX Thank you! I will try this ...

Cheers,

Nat

EDITED:

Sorry for continuing my demonstration of incompetence ;-) I did what Dakien recommended and downloaded LordPE. There are several versions. I decided to use LordPE Deluxe. Unfortunately, the download does not include a manual. I my google search for "LordPE manual" did not help.

I started the application and a relatively small screen with two windows appeared. The first windows shows the path of my memory resident apps. The second window is empty. On the right there are several buttons. I clicked the button PE editor and loaded the application I want to manipulate.

I received the following PE Header information. Entry Point E504, Base of Code 1000 - Size of Headers 400. (Please let me know if I looked at the wrong information.) Then I clicked the button "Sections" and another window opened. Here it also says Code VOffset 1000, VSize EF0C, ROffset 400, RSize F000. I highlighted with my mouse the line showing the information about the code section, made a right click and chose "hex edit section". Another window (a hex editor) popped up. I see offset 400 (apparently the beginning of the code section).

I also discovered that my files has an "image base" of 400000. I guess that is the "base address" which Dakien mentioned. Now I tried to do the necessary calculation but I did not understand why Dakien used the numbers 600h (file offset - my file offset seems to be 1000) and F800h (is this the end of the code section? how did Dakien know this? it appears to me that the end of "my" code section is 400000 + VSize?). Anyway, I opened WDASM and checked in order to check whether the result of Dakiens calculation would help me.

With WDASM i opened my application with "file to disassemble" and had a look at the WDASM main window. My application is devided into several sections. It says that the code section starts at (virtual?) offset 4001000. Yipee...this seems to be in line with the information I derived from LordPE (image base + voffset). Now I move on and look for the end of the code section. The last thing I can find are a couple of zero bytes starting @ 40FF15. However, the last byte @ 40FFFB has a value of 32138BC000. Hope that's not a problem.

Now I decided that I want to modify the call @ 40E553. I want to call 40FF15 instead of 40498C.

Wonder how to do this with WDASM...I once again start "Debug -- Load Process" and the three windows open. The applications seemed to be executed but halted somewhere. It is not halted at the beginning of the code section but at the programme entry point (@40E504). Seems to make sense...although I do not understand it ;-) But let's continue. I go to the right WDASM window which does not have a title and press goto address. Another window pops up and I enter 40E553 (the offset of my call). Aha..it seems to work. Now the right window without title shows my call.

I try to patch this call. I highlight the respective line with my mouse and press the button "patch code". Another window pops up. I already know it. It says "EIP 40E553" and "call 40498C". There is a box called "Enter New Instruction Below". I enter call 0040FF15. Then I press "apply patch" and "make permanent".

It does not work...last time i tried this it did not work either. Damn..I am stuck again. Wait..I made a mistake...I need to press the enter key and now the new instruction is shown in a box called "Code Patch Listing". I press again "apply patch" and also "make permanent" and then I press "close".

Yeah..it did work. I am the most dangerous patcher the world has ever seen...

Now I need to go to 40FF15 and include the instructions mentioned by Dakien. I do not want to enter any additional code right now but just jump to the location to which the original call directed (which I have overwritten). Therefore I will simply include a "Jmp 40498C". Hopefully, this is correct.

I go to 40FF15, enter the patch mode and I can see that the current value of this byte is "add byte ptr [eax], al". Strange...I thought this was a zero byte? Have a bad feeling but I need to continue. Therefore I replace this command with "jmp 40498C".

Now I close WDASM...I hope everything is saved. Damn!! It was not saved. What am i doing wrong? Arghh..everything again.

****
I did everything again. But I can't find a way to save the modifications I have made. I am stuck once again. Can anybody help?

Thx,

Nat
cr.ap
08-18-2002, 09:30 PM
hi nat,

im also a newbie so i could not help you really..but if want to patch a file i use hiew.
i think its a lot easier to path code with hiew than with w32dasm.

cr.ap

ps: sorry for the bad english...
Nat
08-18-2002, 09:45 PM
Thx cr.ap for the tip and also for your moral support ;-)

I have already downloaded hiew...apparently the wrong version. I does not even have a GUI but seems to be a command line tool. I can't get it to work. But I probably ..just the wrong version. I will continue to look for it.

Cheers,

Nat
cr.ap
08-18-2002, 09:56 PM
Originally posted by Nat
I does not even have a GUI but seems to be a command line tool. [/B]

hmm..its a console app...perhaps you should run it from an ms-dos-window.

once your in you open your file press F4 choose decode...go to the location you wanna patch press F3 for edit mode then you can press enter an easily put in you code.

when you finished press F9 to save.

hopw it helps

cr.ap
DakienDX
08-18-2002, 09:59 PM
Hello Nat !

OK, I may have started a bit too fast for you.

Yes, "BaseAddress" is "image base". I took the numbers I mentioned just as example. 600h or F800h will most likely not fit for your application.

As you found out, there is a V (=virtual) and a R (=real) size and offset. You must take the virtual offset if you're calculating something like addresses in memory and the real offset if you're calculating offsets in the file on disk.

So your ".code" section starts at 400h in the file on the disk and is F000h bytes long.

So If you want to calculate the end of the code-section in the file, you add 400h and F000h and get F400h. Before F400h you should have some hexadecimal 00h (in a hex-editor). This is the place where where you can place your own code.

However, in memory the end of the code-section is at "image base"+VOffset(code)+RSize(code). 400000h+1000h+F000h=410000h. This is where the code section ends in memory. Since the VSize is only EF0Ch, you should have at least F000h-EF0Ch=00F4h bytes to insert your own code.

The hex-code 0000h would be the ASM instruction "Add Byte Ptr [EAX], AL" if it was executed. It should start at 40FF0Ch in memory.

If W32DASM doesn't save the patches, you need to do it by hand.
You must write down what you patched, as well as the virtual offsets of the patch data.
You wrote that the first patch you did was at 40E553h, the second at 40FF15h.
So you need to calculate the virtual offsets back to real ones.
Subtract 401000h from the values (image base + VOffset) and you get D553h and EF15h. This is the position in the code-segment, so you need to add 400h (ROffset) to it to get it's position in the file on the disk. (D953h/F315h)
You can edit this locations with your favourite hex-editor and insert the patch-bytes you wrote down there.

HIEW is a text mode application which runs in a DOS command prompt, it has no GUI.
Nat
08-18-2002, 10:10 PM
@cr.ap Thx again. Now I have Hiew6.81 and, in principle, it works fine.

I did what you said and found my call again. However, the offsets are completely different in hiew.

The call, which is located @ 0000D953 points to 3D8C now. Therefore, I am not sure to which address I should jump now.

I need to find some free space at the end of the code section so that I can include a jmp 3D8C and jump to the destination of the orginal call.

I do not know how to find the end of the code section with hiew. I can only scroll and gues...

Any ideas? Thx,

Nat

EDITED: @Dakien I replied to cr.ap before I saw your posting. Thanks so much for this detailed explanation!! I still need to read it thoroughly but I feel that I will really understand it :-)

I also believe that your suggestion to use a simple hex editor will be the easiest way for me because I already know winhex and now i also understand WDASM (just a little bit). The only question I currently have is the following:

When I use WinHex for patching, I need to insert hexcode. What is the easiest way to translate my assembler commands like jmp... and call... into hexcode? It seems to me that hiew can do this?

Cheers,
Nat

2ndEDIT: I withdraw my last stupid question because I figured out the answer myself. I can have WDASM do the translation. Thanks again @ all

I will try it out now ...
Kayaker
08-19-2002, 05:39 AM
Hi Nat, Others

What you're experiencing is something everyone goes through at first, getting used to the tools and techniques, it will come soon. You would find help in some of the tutorials, but some of them don't explain the basics very well, assuming you already have the knowledge. If you want a complete example of how to do a basic reversing job, how to find a suitable location for and create an inline patch, and all the background information necessary to do it, then you might want to look at a few of my own tutorials. I tried to develop them as detailed guides to some basic reversing techniques as much as possible, something I found lacking when I was learning the stuff.

There are descriptions of any modifications you may need to make to the PE file, setting up the basic patch points for jump and return, how you can develop your inline patch in Softice memory to test it, how to dump the patch from memory or use HIEW to write it from scratch, and more, all without using any fancy patching tools which only hide what's being done.

There are other tuts that explain other things, but if you want some detailed information on creating an inline patch then I'd suggest looking at my TracePlus tutorial, which creates a patch for a new menu item resource and includes details of how to trace a menu item to the code it calls and modify it. The Regmon tutorial is a bit more advanced but the basic principles remain the same, in that it creates an inline patch which loads your own dll, and an example of how to create the dll. This can be used as a module to perform even further reversing tactics without the bother of having to create complete new inline patches on every target.

There's tons more information out there, but these might be a good starting point, hope they help.

http://www.woodmann.net/fravia/TracePlus_MenuPatch.html
http://www.woodmann.net/fravia/kayaker_RegmonPlus.htm

Regards,
Kayaker
Nat
08-19-2002, 08:43 PM
...

1. I have changed the topic of the thread because it was misleading. We do not talk about Code Snippet Generator.

2. Thanks @ Kayaker. I have already read the tutorials and I will save them. At the moment, however, I am still too ...well too stupid to completely understand them.

3. I will continue to explain in detail what I am doing because I could imagine that other absolute newbies may encounter the same difficulties:

*******

Today, I was unable to continue my project because I needed to work. That's a pity because I am really excited about it now ;-) This evening, I have started again ...

I believe that I have understood the basic concepts of using PELord, WDasm and WinHex. I have modified the file as follows.

@ 40E553 : I have included a call to F315, i.e. I have inserted the hexcode E8 B8 0D C0 FF.

@ 40FF15 : I have included a jmp 3D8C (the original destination of the call which I have overwritten) = hexcode E9 2A 58 BF FF

Well...you will probably not be suprised...it did not work :-) The program crashed. I believe the reason are not my mediocre patching skills anymore but my lack of understanding assembler. In order to figure out what's wrong I need to understand the code which I want to patch. Therefore, I have dissassembled the (original) file with WDASM and saved the result:

{...}
:0040E51C E89763FFFF call 004048B8

* Possible StringData Ref from Data Obj ->"`"
|
:0040E521 BB3C014100 mov ebx, 0041013C
:0040E526 BF28014100 mov edi, 00410128
:0040E52B BE30014100 mov esi, 00410130
:0040E530 33C0 xor eax, eax
:0040E532 55 push ebp
:0040E533 6877FA4000 push 0040FA77
:0040E538 64FF30 push dword ptr fs:[eax]
:0040E53B 648920 mov dword ptr fs:[eax], esp
:0040E53E 6808434100 push 00414308
:0040E543 6A00 push 00000000
:0040E545 6A00 push 00000000
:0040E547 6898554000 push 00405598
:0040E54C 6800140000 push 00001400
:0040E551 6A00 push 00000000

* Reference To: kernel32.CreateThread, Ord:0000h
|
:0040E553 E83464FFFF Call 0040498C !!!!!!!!!!!!!!!!!!!!****
:0040E558 A174014100 mov eax, dword ptr [00410174]
:0040E55D 8B1508434100 mov edx, dword ptr [00414308]
:0040E563 8910 mov dword ptr [eax], edx
:0040E565 E81A78FFFF call 00405D84
{...}

I have marked with exclamation marks the section which has to be patched. (Please don't question the location.)

The idea is to redirect the call to somewhere else and then to come back and jump to the original destination of the call. I want to redirect the call to the following place in the file which seems to be "empty":

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FEB6(C)
|
:0040FF09 7B00 jpo 0040FF0B

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FF09(C)
|
:0040FF0B 00000000000000000000 BYTE 10 DUP(0)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040FEBB(C)
|
:0040FF15 00000000000000000000 BYTE 10 DUP(0) !!!!!!!!!!!!****
:0040FF1F 00000000000000000000 BYTE 10 DUP(0)
:0040FF29 00000000000000000000 BYTE 10 DUP(0)
:0040FF33 00000000000000000000 BYTE 10 DUP(0)
:0040FF3D 00000000000000000000 BYTE 10 DUP(0)
:0040FF47 00000000000000000000 BYTE 10 DUP(0)
:0040FF51 00000000000000000000 BYTE 10 DUP(0)
:0040FF5B 00000000000000000000 BYTE 10 DUP(0)
:0040FF65 00000000000000000000 BYTE 10 DUP(0)
:0040FF6F 00000000000000000000 BYTE 10 DUP(0)
:0040FF79 00000000000000000000 BYTE 10 DUP(0)
:0040FF83 00000000000000000000 BYTE 10 DUP(0)
:0040FF8D 00000000000000000000 BYTE 10 DUP(0)
:0040FF97 00000000000000000000 BYTE 10 DUP(0)
:0040FFA1 00000000000000000000 BYTE 10 DUP(0)
:0040FFAB 00000000000000000000 BYTE 10 DUP(0)
:0040FFB5 00000000000000000000 BYTE 10 DUP(0)
:0040FFBF 00000000000000000000 BYTE 10 DUP(0)
:0040FFC9 00000000000000000000 BYTE 10 DUP(0)
:0040FFD3 00000000000000000000 BYTE 10 DUP(0)
:0040FFDD 00000000000000000000 BYTE 10 DUP(0)
:0040FFE7 00000000000000000000 BYTE 10 DUP(0)
:0040FFF1 00000000000000000000 BYTE 10 DUP(0)
:0040FFFB 000000000032138BC000 BYTE 10 DUP(0)

[This is the last part which has been disassembled by DASM and apparently it's the end of the code section.] I want to redirect the call to 40FF15.

Taking into account what I have done before (and which leaded to a crash) I am now worried about the following issues:

When I redirected the call @ 40E553 to 40FF15 I made probably a mistake because I did not take into account that a couple of bytes had been pushed on the stack (or in several registers?). Apparently, such bytes were used as parameters for the orginal call. I am worried that these parameters were somehow affected by my call and the subsequent jump to the original destination of the call. However, I do not know what exactly happens when I use the commands call, jmp, ret etc. I also do not know what exactly happens when I push bytes on the stack and/or in a register. I can also not properly distinguish between the several registers and the stack.

In addition, I am concerned about the fact that 40FF15 seems to be referenced by a jump @ 40FEFBB (according to the WDASM comment). This could be bad because this could result in a loop after I have inserted my jump @ 40FF15.

Alas....I definitely need to read some more tutorials. However, I find it hard to find a tutorial which deals with commands like call, jmp, ret etc. This is because most assembler tutorials use instructions like invoke and so on.

I would be really grateful if somone could point me into the right direction...

Thanks,

Nat

EDITED: In the meantime, I have started to "debug" the original file. I have loaded it with DASM and set a breakpoint with F2 in the main window. Then I went into the small window without title and pressed run. The application was executed but halted at the breakpoint. I have chosen 40E521 as a breakpoint. Now I have pressed "step into" / F7 and I was able to see exactly what happened. I could see (in the window with the title EIP...) how the values of the registers in the upper left of the window changed after the execution of each command. This was really interesting. I seems to me that everytime the command push is used the register esp is affected. (Need read about esp ;-).
Moreover, I need to figure out exactly what happens to the registers when I execute a call. Hmm...but I think that's it for today.
DakienDX
08-19-2002, 09:10 PM
Hello Nat !

So you've patched the right location, but wrote the wrong bytes there. :(
How did you get the bytes to wrote there? (E8 B8 0D C0 FF)
(If you did it with HIEW, you probably entered a wrong value as the jump-destination.)

At first you must know how a "call" works. It's "E8 ?? ?? ?? ??", where the ?? denote how far to jump form the end of the jump-instruction (patch location + 5 bytes). So you calculate (F315h - (D953h + 5)) and place this value instead of the ?? in the call instruction.

The same counts for a jump (E9 ?? ?? ?? ??), also 5 bytes long. You calculate (EndLocation(=original call location) - (CurrectLocation + 5)) and replace the ?? by this number. It will be a negative number (>80000000h) since you're jumping back and not further.

"Jmp" instructions never change any registers (expect EIP, which is just a "virtual" register), "Call" and "Ret" instructions just change ESP, which is also not important most of the time.

You don't need to worrry about registers here. As far as I can see the situation, the original "Call" would call a "Jmp" to "CreateThread". The patch should "Call" a "Jmp" to your code which does a "Jmp" to "CreateThread". So nothing changed here. You just need to find out how jumps and calls are calculated.
Nat
08-19-2002, 09:31 PM
...it's really great, Dakien, that you help me so much!! I will need to read your anwer thoroughly. Thereafter, I will tell you why I did the mistake.

Cheers,

Nat

EDITED: I understand! I mistakenly assumed that a call jumps to an absolute address. I was not aware that the jump goes to a relative address which has to be calculated. I will try this out now.

Ok...now I will do the following:

@ 40E553=9D53h : I will insert a call to F315. Because I am @9D53h it need to jump F315 - 9D53 + 5 (+5 because of the call...but don't ask me why ;-) = 55C7 bytes forward. That is I must insert a "call ..." which is equal to a hexcode E8 BE 70 BF FF (I did the conversion into hex with WDASM ... when you enter "call 55c7" as a patch it tells you also the corresponding hexcode).

*******
EDITED!!! (with reference to Dakien's reply): Thanks .. ok..then the hexcode to be inserted is E8 55 C7 00 00 -- i guess that your suggestion E8 C7 55 00 00 was just a typo ... or is there any reason to switch the numbers?)
********

(By the way...what does the "h" mean? HexWorkshop does not show this sign. And how do I calculate in hexadecimal...don't have my pocket calculator here...ahh..thanks god I have not deinstalled the Windows XP calculator ;-)

@ 40FF15 (virtual address) = F315 (address in the file): I will insert a jmp to Endlocation - CurrentLocation +5

EndLocation is original call location ...aehmm...its probably not 3D8C (because this is not the original destination of the call but just a relative number of bytes to be jumped forward). That is ... I need to actually calculate the EndLocation=original call location. (Arghh...I am not a mathematics professor!) Ok...9D53 + 3D8C = DADF ( I don't add + 5 this time...but am not sure whether this is correct). I do not trust my own calculation...but continue.

EndLocation (DADF) - CurrentLocation (F315) + 5 = FFFFFFFFFFFFE7CF
...at least that's what my calculator says. However...the number is to big...probably because the calculator used a qword and not a dword. The correct number should be FFFFE7CF ... possibly ;-)

The hexcode is E9 FF FF E7 CF. !?

Ok..now I need to insert E8 55 C7 00 00 with HexWorkshop @ 953h and hexcode E9 FF FF E7 CF @ F315.

ARGHHH...can't think anymore. Will do this tomorrow at work ;-)

[ to be completed...i just "save the thread" so that nothing gets lost]
DakienDX
08-19-2002, 10:21 PM
Hello Nat !

It seems you made a mistake again. :(

If you're running W32DASM you must always use virtual addresses. So you would use "Call 0040FF15", but only if you're at EIP 0040E553h. Else W32DASM will generate an invalid jumps since it uses the wrong start address for the "Call".

So if you want to call a location 55C7 bytes forward from the end of the "Call" instruction, you call would be "E8 C7 55 00 00". Very simple. :D

Of course you must do the same thing again for the "Jmp".

I only use "h" to show that it's a hex number. In a hex-editor it's obsolete, but it's a difference if you tell somebody "go 256 bytes back" or "go 256h bytes back", since 256=100h, so 256!=256h.
Nat
08-20-2002, 10:06 PM
...I am swamped. Left the office @ 10 p.m. (although I started early in the morning). Now I am too tired to do anything but watching a movie.

I know that my code is still not correct (have tried this yesterday night). The call still goes to the wrong address (have checked this with WDASM). Will try to identify my mistake tomorrow (if I have time). Need to check everything again...right from the beginning.

G'night,

Nat
JMI
08-21-2002, 12:09 AM
Nat:

One of the confusing, but simple things which seems to be confusing you is the order of the listing of the bytes in the address that you are going to add for your new jump. What you have to remember is that in the assembly the bytes are listed in REVERSE order. For example you wrote:

*******
EDITED!!! (with reference to Dakien's reply): Thanks .. ok..then the hexcode to be inserted is E8 55 C7 00 00 -- i guess that your suggestion E8 C7 55 00 00 was just a typo ... or is there any reason to switch the numbers?)
********
He responded that you had it wrong and it had to be :

********
So if you want to call a location 55C7 bytes forward from the end of the "Call" instruction, you call would be "E8 C7 55 00 00". Very simple.
********

He just didn't state that the reason he was correct and that you were incorrect is that because of the way the processor works it pushes the bytes in REVERSE ORDER . Therefore is you want to end up with an address that the processor sees as 55C7 you have to push it as C755 and this is the way you would find the address in the assembly if you viewed the code with a hex viewer. It would also explain why you can't find addresses in a file listed in hex in the code if you don't understand this concept.

Regards.
Nat
08-21-2002, 12:41 AM
@JMI Thank you for helping me out!!!

I believe that I now understand what you and Dakien are telling me. Initially, it confused me that neither 55 C7 nor 7C 55 is correct.

But now I see that 55 C7 consists of two separate bytes and not each byte is reversed within itself but only the order of the bytes is reversed. This must be because a byte is the smallest size which is interpreted by the processor. In other words, I do not push entire words on the stack but merely separate bytes. And because the stack works LIFO (last in first out) I need to reverse the order of the bytes. Hope ... this is a correct interpretation of your hint.

@Dakien Sorry for questioning you at all ;-)

Thx everyone,

Nat

P.S.: Why am I unable to find a tutorial which teaches me these basics right from the scratch. I guess I am the most ignorant person who has ever posted in this forum ;-)

P.P.S.: Now I can't go to bed but must try this out ... ;-)

EDITED:

Ok .. I will reverse

"Ok..now I need to insert E8 55 C7 00 00 with HexWorkshop @ 953h and hexcode E9 FF FF E7 CF @ F315."

to

"Ok..now I need to insert E8 C7 55 00 00 with HexWorkshop @ 953h and hexcode E9 CF E7 FF FF @ F315."

2nd EDIT: Ok..ok...still more mistakes..I know ;-)
JMI
08-21-2002, 01:07 AM
Nat:

Here are three articles which may help. The first is "Calculating Offsets" by Lord Rhesus which explains how to calculate short and long jumps and the offsets and the "little edian" reversing of the bytes.

The second is The "Call Relocation Table and Its Importance" by Fravia+, which explains that there is something at the end of most windows files which contain, again in reverse order, the addresses of many jumps.

The third is part of the Mannon_'s Tales to his Grandson. this one is on "Registers, Memory, and how Assembly Language came to mankind." It has alot of useful information about the register system and how things are stored and viewed in disassembly of windows code.

All three of these articles, I believe are contined in the Fravia+ Forum which is a companion to this Board and linked at the very bottom of these pages. If for some reason my attachment doesn't work, let me know and I'll try to email them to you. I may be only able to attach one at a time.

Regards,
JMI
08-21-2002, 01:31 AM
Nat:

I am also attaching a copy of the W32dasm.hlp file. This file is old, from 1997, but it may provide some useful information on use of the program. There are tutorials on the web, if you take the time to learn how to search, which will answer most of your questions.

I didn't follow all the addresses you have been using for your jumps, but a possible problem, addressed in the Lord Rhesus article I attached above, is that there are both short and far jumps and they use a different op code. If your first jump is a "far" jump and you used "EB" it wouldn't work. If its a "long" jump the op code has to be "E9". Just a thought.

There are also tools available to help you calculate jumps, but since you've been doing your homework, you knew that, right?:D :D :D
Just a gentle nudge that sometimes we get so excited by the prospect of cracking something NOW we forget to take the time to STUDY the process of how this is done as well as we should. There is a great deal to learn and always more to look for.

Regards.

Edit.

File is too big to attach.. If you want it send me a PM with an email address and I'll send it along.
Nat
08-21-2002, 07:22 AM
@JMI Thanks again!! I have downloaded the Tutorials. Moreover, I believe that I already know the mistake...but let's not promise too much. Hopefully, I will have a little bit more time this evening.

As regards the WDASM helpfile...I will search the web for it and will contact you later if I am not able to find it.

As regards, the tools which help me to calculate jumps. No...I did not know that such tools are in existance. Actually, I did not even know that it's so difficult to calculate jumps ;-)) Will make my homework and learn how to calculate jumps manually. Thereafter, I will search for the tools.

Best regards,

Nat
Kayaker
08-21-2002, 08:10 AM
You might want to try a "live approach" on this as well as learning to calculate offsets Nat. Personally I'm actually too damn lazy to bother calculating offsets if doing a patch ;) I usually assemble it in Softice using the 'a' command where I want to begin the patch, then either dump those bytes with Icedump or take note of them and transfer those bytes to HIEW to hard write the patch. Offsets for jumps and calls, including API calls, are automatically calculated for you in the correct context as you type in the patch.

If you write the complete inline patch in Softice, you can continue to edit individual lines without tracing, then as you are happy with the code, start tracing to test it out, write a few more lines and trace/test it some more. You can even insert "INT 1" statements into your code to force a Softice break when your code is run, (when you have "I1HERE ON" enabled in Softice). A development and debugging environment all in one. For anything more than the simplest patch I figure it's easier to program it in and let Softice take care of the offset details. At the very least you can use the 'a' command to confirm that your offset calculations are correct.

To do this safely you need to set up a basic jump/return structure. You would try to find a location in code where it is convenient to overwrite the existing code for the initial jump. A jmp statement to an empty location in memory (often at the end of the .data section made executable and fully paged in), takes 5 bytes, and whatever is overwritten *may* need to be emulated in the patch. Start with a simple

jmp patch
/ restore overwritten bytes
/ jmp return to program code exactly where you left off

In Softice trace to the first line you've selected to overwrite, type 'a eip' for 'assemble at the current location', press Enter, write the new jmp statement pointing directly to your empty code section, and when you're finished press Enter twice. You may need to add nops (90h) after the jump statement to make up for bytes you've overwritten. Single trace this new line at you're at the start of your inline patch.

Type in the overwritten bytes and basic jmp return and now you've got a template to work on in Softice. Make several backup copies and just set a breakpoint on the starting address of your patch in empty code and start writing. Every so often you can dump a good section of your code patch and hard write it into the file to test it out. If you want to just exit from what you're doing, inserting a simple RET will usually give you a recoverable crash, rather than just letting improper code run which might be more likely to cause a system hang instead.

What's important is where you want the code to jump to after your inline patch runs. Depending on what you're doing you may want to return to program code to allow any default Windows processing to occur, or you might want to go to another part of code and not return, or you might want to access the return value of the call from the stack and exit directly from the main call you are within. You must be careful of the stack no matter what you do.

Just a few more ideas you can bring to work :D

Kayaker
Nat
08-22-2002, 10:58 PM
...it's getting better and better:

1. This time I left the office at 10:30pm.

2. My WinHEX sucks. It does not correctly show the hexcodes of the file. I believe that it's not properly cr**d. Well, at least HIEW works as it should.

3. My Internet Explorer sucks. I can't post anymore because there seems to be a cookie problem. The browser asks me to log in although I have already done so. Well, at least Opera works fine.

***

Despite these struggles, I made some progress last night! :-)

I correctly calculated the first (forward) call so that it takes me to F315. I patched E8 BD 19 00 00 into the file.

My previous patch (E8 C7 55 00 00) was completely wrong because

1. I did not carefully listen to grandmaster Dakien's advice. It screwed up the calculation with the brackets.

2. I mistakenly used WDASM for the calculation. It turned out that I get a different result when using the Windows calculator.

Anyway, now my call really leads me to F315 where my backward jmp is already waiting to be executed. I have confirmed this with WDASM's debugger.

****

So far I have not been able to correctly calculate the backward jump. This is because I do not completely understand Dakien's calculation method. He said:

"The same counts for a jump (E9 ?? ?? ?? ??), also 5 bytes long. You calculate (EndLocation(=original call location) - (CurrectLocation + 5)) and replace the ?? by this number. It will be a negative number (>80000000h) since you're jumping back and not further."

I am not sure how to figure out EndLocation. I believe it must be determined as follows:

The original destination of the call @ 9D53 was E8 34 64 FF FF. Therefore the EndLocation should be FF FF 64 34 (because the data is pushed onto the stack in reverse order for purposes of a call) + 9D53 (start location of the original call) = 10 00 00 187 (if my calculator is right). Seems strange to me...I have enabled Qword and Hex in the GUI of the calculator.

EndLocation - (F315 + 5) = 10 00 00 187 - F31A = FFFF0E6D should therefore be the address which I need to use for my backward jmp @ F315. The address still needs to be reversed (i.e., it must be 6D 0E FF FF).

Hmm...don't think that this is right.

Cheers,

Nat Nobrainer

P.S.: Thanks, Kayaker. I will keep your hints in mind.
DakienDX
08-23-2002, 11:11 AM
Hello Nat !

Maybe a hint in the right direction will help you.
So, here's what you have:

You are at: 0040E553h virtual, 0000D953h real
You want to go to: 0040498Ch virtual, 00003D8Ch real
You want to go over: 0040FF15h virtual, 0000F315h real

Take 0040FF15h, subtract (0040E553h + 5), get 000019BDh
Take F315h, subtract ( D953h + 5), get 000019BDh
Call would be: E8 BD 19 00 00

Take 0040498Ch, subtract (0040FF15h + 5), get FFFF4A72h
Take 3D8Ch, subtract ( F315h + 5), get FFFF4A72h
Jump would be E9 72 4A FF FF
I hope you understand now how to calculate calls and jumps.
Nat
08-26-2002, 05:16 PM
Dakien,

Thank you once again. Your explanations are terrific. I definitely got the concept now. (My main mistake was that I did not properly distinguish between real and virtual offsets. Therefore, I used WDASM in an inappropriate manner.) But now everything is clear to me. The patched proggie works perfect and I can start with another learning project ... I will try to add a function (with the help of code snippet creator) to an existing application... ;-)

I would also like to thank everybody else who helped me.

Cheers,

Nat


a question to armkiller ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > a question to armkiller ?
PDA

View Full Version : a question to armkiller ?

BenJ
08-18-2002, 04:32 PM
Perhaps you can help me plz ?

Supose I have a target that performas as follow :

- creete thread and so on + 2 writeprocessmemory
- than shows first reminder msgbox, I click OK
- than performs setworkingprocesssetsize,
- than call edi to eip of target thread -> launches target

ater this, no more writeprocessmemory (never !)

Does it mean that the taget is fully decrypted once before launching ?

In this case, I suppose that copymemII is not used ?

Last question : I have impression that arma adds sections to the exe of the created thread, which are not in the original unprotected exe. what's the deal with these sections ?

Thx in advance
evaluator
08-19-2002, 07:05 AM
1. mostly seems there is not copymem.
just look in dump's code section with some viewer &
try with your EYES detect, if code is crypted.

Or simple run unpacked prog.

2. If sections are at the END, you can successfuly wipe them in LORDPE
& then with hex-editor.
BenJ
08-19-2002, 02:48 PM
Hi Evaluator,

In fact I wondered why I find 2 processes with copymem off ? I've found the answer : this is due to debuggerblocker (guess where I found the answer... hehe)

The code section actually IS valid (I compared with a valid dump made with armkiller...)

The pb I have is that I can not make my dumped exe work, even after fixing eop. The problem come when rebuilding the IT : most of the API pointers are valid (point to actual API adress), but some are not... and I can't find what's the deal with these invalid pointers... i'm going to try to trace these calls, but not easy...

Do you know how arma works with IT ?
evaluator
08-19-2002, 03:07 PM
you must try debug that unresolved IAT entries.
This is main unpacker's work!

Or! you can try CATCH moment, when IAT is builded by armado & look for original names:)
BenJ
08-19-2002, 07:22 PM
well, ok i understand how redirection works... There are even some "masked" calls, that make imprec (for example) find wrong api when tracing.... in fact I could notice and resolve all redirections manually, but I could be wrong as imprec is..

Problem now : how can I find the moment when the "new" idata section is written or modified ? I've been trying by basic tracing... painful ! what i'm sure is that IT is modified after that the target process as been launched...

Is there a way in SI to break on say : when writing in another process' .idata area ?

Sorry for my basic questions, this is my first trial on packed pgm.
evaluator
08-19-2002, 09:34 PM
yes of course, for this debugger has BreakPoints:)

Try for example LoadLibraryA & watch to IAT-place...
BenJ
08-20-2002, 07:16 AM
right ! finally caught the moment where all seems to be written (plenty of repz movsd)

OK I'm now going to search for all the "good" data I need, but was wondering : who could dare making his program being manipulated like this ???? Not me ! ;)

To be followed...


visual dbase reverse
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > visual dbase reverse
PDA

View Full Version : visual dbase reverse

yugung
08-18-2002, 05:38 PM
hi all,
i'm now tryng to reverse a program written in vdBase.
It's a bit like a return to the old time when i tried to reverse vbasic 3 files as the exe is 'Interpreted'and the runtime-Interpreter (DB2KRUN) is the horse who make all the works.

So IDA is pretty useless as the program exe (4,5 mb) don't give me any useful output, no decompiler seem to exist, working with softice it's like a nightmare (remember the Visualbasic pre-smartcheck times ?).

In the programs don't exist any serial input, so the registration probably is deep inside some dbf config table.

Any idea how to proceed ? Any one has already experience on Vdbase reversing ?
Thanks

YuGung


Looking into .obj files rather than the .exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Looking into .obj files rather than the .exe
PDA

View Full Version : Looking into .obj files rather than the .exe

Mother
08-18-2002, 11:30 PM
Hi all,

I've got a program for which I have the VC++ .obj files, one header, and resources (enough to compile it). This program has a rather annoying message box which I'd like to get rid of.

My question is: would it be better to simply look at the .exe or does the possesion of the .obj files make life any easier? I've not really reversed projects from their .obj files, just from the compiled .exe, so this is a bit new to me.

Thanks,

Mother
naides
08-19-2002, 12:24 AM
Mom:

Having the .obj files is such an unusual situation in this sort of RCE that I Doubt many people in this forum have ever tried to crack an app from the .obj files. So by mere experience point of view, exe files probably have been addressed more often.

.exe files allow live debugging, .obj files do not.

.obj files are already in object code, but are missing the linking info. You would have to reverse engineer the linking process as well as the app itself.

In one word, I would go for the .exe first
cyberheg
08-19-2002, 07:11 AM
usual or unusual is not the question and is kinda pointless.

When you have the object files you have advantages. Lets say you want to remove this MessageBox permanently then you only need to do it once in the object file and use this obj for every time you compile your programs.
Often objects hold more symbol information which gives alot convienience.

What I would do is look inside this obj to find the offending call. If you won't succed that easily then write your own small test program which would causes this MessageBox to pop up and then you can see which part of the code it is (by comparing the disassembly of the final linked file with the object).

Notice you can also use objects to make signatures for IDA which would make it even easier to work with on linked files.

Maybe naides could explain what he means with "You would have to reverse engineer the linking process as well as the app itself." as this does not really make sense. The code in the object is the same as the linked file where relocations are beeing processed if needed and externals and imported files are matched together.

// CyberHeg
DakienDX
08-19-2002, 07:28 PM
Hello Mother !

Of course an .OBJ file gives more information, but mainly to the linker.

You can't find imported function calls (since the import table isn't build yet, you would just have a "Call [00000000]") and all memory refered pointers are also invalid. If you're looking for a specified "normal" (example 12345678h) value, you can find it in the .OBJ file, but if you're looking for memory locations, the .EXE may have a "Mov EAX, 004F80AC", but the .OBJ might only contain a "Mov EAX, 0ACh" or "Mov EAX, 80ACh" or anything else you might imagine. (ending with ACh probably, but not necessary)
naides
08-19-2002, 08:02 PM
Cyberheg

Maybe naides could explain what he means with "You would have to reverse engineer the linking process as well as the app itself." as this does not really make sense. The code in the object is the same as the linked file where relocations are beeing processed if needed and externals and imported files are matched together.

Yes, I think I used a very poor choice of words. What I meant was that you will have to work, by hand, all the references to static libraries, global variables, resorces and some external functions, which is the job of the Linker. I have not done it, but I figured one may have a harder time following the flow of the program and figuring out calls to the static libraries and other external modules.
Mother
08-19-2002, 08:14 PM
OK, thanks for all the replies - after some digging around with your suggestions and comments, I think it's going to be easier looking at the disassembled .exe than the .obj files - the only real advantage of having them is that I can modify resources and recompile.

Cheers,

Mother
Thigo
08-20-2002, 03:49 PM
LOL
.obj files are fucking usefull when U need to crack sth... from what do you think IDA build sig files ?? From .obj !! You got all the names in the .obj and I think it's enough to crack it... even if u cannot use the debugger. But infact you can, just find a place u find suspect in the obj and seek it in the built exe to trace... once u know how to crack it in the .exe you can do the same in the obj. Very easy


LordPE Deluxe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > LordPE Deluxe
PDA

View Full Version : LordPE Deluxe

yoda
08-19-2002, 01:29 AM
Bonjour boys...

New LPE is out:

ZIP version (http://y0da.cjb.net/LordPE/LPE-DLX.ZIP)
EXE version (http://y0da.cjb.net/LordPE/LPE-DLX.EXE)

y
nofurs
08-19-2002, 12:30 PM
Hi yoda,
Why don't you send it to protools instead of uploading here ;)

Regards
Solomon
08-19-2002, 01:07 PM
great tool! my favorite:)
Nat
08-19-2002, 07:58 PM
@yoda Thanks!!
DooGie
08-19-2002, 11:24 PM
Nice yoda. Keep up the good work.
comrade
08-20-2002, 04:26 AM
Why are there so many LordPEs?
yoda
08-20-2002, 07:42 AM
Hi comarde :)

In fact there're just some LordPEs...I just use a name instead a version number for every new LPE,coming out...maybe this is a bit confugsing for some people...the history file shows the release date of every single version, so that one can keep track of the process...

y
foxthree
08-20-2002, 08:27 AM
Yoda:

Fantastic work!!! But, 1 q?

I always get Connection timed out connecting to y0da.cjb.net? Why? Is the server so busy? Can you upload it somewhere else too? Maybe exetools forum/Protools?

Thanks and once again, good work.

Signed,
-- FoxThree

<Edit>

Sorry, man! It was just my proxy :(

</Edit>
evaluator
08-20-2002, 08:32 PM
Hello, y0da!

you are our Legend!
*****************

May I ask you 1 Q!?

Did you plane to make for LP high-memory-dumper driver for NT-based OS(me dislike them).
This dumper will good for comparing clear mem with debuger-loaded mem

Do it & your tool for sure will be last...!

shit! I want to say "at least" :)

Would you like, we will your testers!?
yoda
08-25-2002, 11:04 AM
Oh....hear the answers...

>>I always get Connection timed out connecting to y0da.cjb.net? >>Why? Is the server so busy? Can you upload it somewhere >>else too? Maybe exetools forum/Protools?
Dunno...the side is hosted by a free webspace provider...I think, thats the course which makes the hp mostly unavailable outside from europe and America...

>>Did you plane to make for LP high-memory-dumper driver for >>NT-based OS(me dislike them).
>>This dumper will good for comparing clear mem with debuger->>loaded mem
Yes...I really planed sth like that but while coding LPE DLX my brain wiped the idea...wouldn't be so hard when I think right of it...maybe in a future version...but I dunno what do include in LPE anymore...
evaluator
08-25-2002, 08:55 PM
OK, thanx for answer!

As gift, take little "bug" report:)

IF I open file in LP & will browse deep, BUT will NOT change anything,
when close file >> LP anyway changes file's MODIFIED attributes.
This is not so good for system files.
OK!?

If you not understand my eNgliSh, ask my..
yoda
09-01-2002, 11:58 AM
Hey Evulator...

The modifed time of the file is modified because every file that is closed is flushed to disk before deallocating its memory...I don't update the file physically during editing time...all the changes are performed and the the end, when the user wishes to end all modification operations, the new file state is written 2 disk...

>>Did you plane to make for LP high-memory-dumper driver for >>NT-based OS(me dislike them).
>>This dumper will good for comparing clear mem with debuger->>loaded mem
If you like that feature, code it !!!
Read \docs\LDE.tXT. You'll find every information you'll need to code such a 'plugin' for LordPE. In \SDK\LordPE\LDE\ you'll find a full example on such a library.
Would b nice 2 c u coding such a utility....

y
evaluator
09-01-2002, 04:50 PM
Yoda, you not understood what I sad!

I mean:
LP changes file-mod time EVEN IF NOTHING IS MODIFIED.
just review sections or directories.

Now clear?
yoda
09-01-2002, 04:55 PM
Yes, because the mapped file is always flushed to disk when the PE editor is closed...also if nothing was modified..
So you write a LDE ? :)
evaluator
09-02-2002, 08:14 AM
nop!

& not plain:(

But will you correct that "flush", please!
yoda
09-02-2002, 02:11 PM
>>But will you correct that "flush", please!
Maybe I'll apply a add a file time recover functionality in a future version...
Maybe Deluxe is the last version !?

y
RaX
09-02-2002, 09:42 PM
Beggers can't be choosers.

yoda, your tool is fantasic! keep reaching for the sky dude ;)


shrinker problem ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > shrinker problem ...
PDA

View Full Version : shrinker problem ...

himanshu
08-19-2002, 03:22 PM
hi there,
i was trying to dump wisdec.exe which is packed with shrinker 3.4 . well i changed the shrinker0 segments charactristics to e0000020 and loaded the exe with symbol loader and traced the OEP(call [ebp-20],the shrinker way of jumping to OEP) .but the problem is that when i dump the program, the dumped exe still contained the shrinker segments,only the size of the exe increased from 250 to 608k.

well i tried using icedump's /DUMP 400000 98000, /BHRAMA and plain ProcDump to dump the exe, but no luck.can somebody plz tell me what i am doing wrong.

----
exe=wisdec.exe,packed with shrinker 3.4
OEP=004560ec
base=400000
size of image=00098000
----

BTW, while dumping i found that really strange things were happening. when i ran wisdec.exe , i found that its shrinker segments automatically disappeared and instead there were CODE and DATA segments.really strange...

it was only later that i found it was due to SirCam ;) but now that i have got rid of it, i am still not able to cleanly dump it.

neone ... ????
DakienDX
08-19-2002, 07:41 PM
Hello himanshu !

I'm not familiar with Shrinker 3.4, but as far as I know it's a normal packer without anti-debugging code.

Since it's a packer, it packs a file and it's nothing special if a packed file is 250kb and the unpacked 650kb. ;)

You should find at first the place where the Import Section is unpacked in memory, but still original, and dump it to disk.
Then you should trace until the jump to the OEP (Call [EBP-20h] according to you) and freeze the program there. You can do it either with ICEDump (Win9X) or by placing an "JMP EIP" at the memory location and exiting SoftICE.
No you can dump the process with ProcDump or similar, insert the previously dumped Import Section, change the OEP and fix the import pointer. (You remeber what [EBP-20h] contained, do you?)
You can of course rename the Shrinker section names if you like, but that doesn't interact with the unpacked program's ability to run.


Softice - how do I return to calling code?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice - how do I return to calling code?
PDA

View Full Version : Softice - how do I return to calling code?

sync
08-19-2002, 04:17 PM
I've read several tutorials that suggest breaking on a Windows message api and when the break brings up SI, to use F11 to return to the calling code. When I use F11 I exit SI.

In the SI manual it says that F11 is the 'G' command and that the 'G' command, when used without any parameters, is the same as the 'X' command.

So what command is used to return to the callng code? I thought that F12 (P RET) would work, but it also exits SI.
DakienDX
08-19-2002, 07:57 PM
Hello sync !

Yes, the G command is the same as the X command if used without paramters.

But normally the F11 command is "G @SS:ESP" which stands for "run the program until you get to the memory location where SS:ESP points to".

This works fine if you're at the begin of a Windows API. But as soon as something changes the stack pointer (because of "Push ???" or "Sub ESP, ???"), the location @SS:ESP will not contain your return address but usually some useless code.

However, F12 (P RET) should work fine with APIs. It exits the SoftICE window and runs the program until it reaches a "RET" command and pops up SoftICE again. However, if there is no RET command or depending on the protection used in the program, it will not stop.
sync
08-19-2002, 08:28 PM
Hello DakienDX,

Thanks for explaining "G @SS:ESP". I guess since I didn't understand what "@SS:ESP" meant, I only wrote down that F11 = "G". duh :rolleyes:

I found something that seems to explain the problem I'm having. I don't understand most of it, but will try if it works.

GetWindowTextA uses _stdcall calling convention. That means that arguments will be pushed right to left. Since SoftICE pops up before the prologue code is executed, the EBP stack frame isn't set up yet. So we had to use ESP to address the argument. Here's how the stack will look like when SoftICE pops up :-

...
[ESP+0Ch] - nMaxCount
[ESP+08h] - lpString
[ESP+04h] - hwnd
[ESP+00h] - return EIP

When the function returns, GetWindowTextA will place the text it retrieved to the location pointed to by lpString (LPTSTR is a long pointer to a null terminated string). Thus, we had to use SoftICE's indirection operator (it's the * character, same as C language. For example, the command :-

D *(esp+8)

This means, "show in data window, the location pointed to by the content of esp+8". Since, this is a very common operation, SoftICE had a shorthand for it: esp->8. Alright then, now we can set a breakpoint such as this :-

BPX getwindowtexta DO "D esp->8;"

When we hit F12, we return to the caller and the text we entered will sit nicely at the top of the data window, waiting for us to set up a BPR with it. Why don't we do a return to the caller automatically? Well, in my case, the screen flashes, and I hate it. But, if you want to try, you can set the breakpoint as :-

BPX getwindowtexta DO "D esp->8;P RET;"
DakienDX
08-19-2002, 08:38 PM
Hello sync !

The "@" and "*" signs do the same in SoftICE. I just use "@" because it's easier to find for me on the keyboard (just my personal oppinion).

The text passage you found does not explain why your "P RET" or "G @SS:ESP" doesn't work. You'll have to try yourself a bit. Sometimes breakpoints don't work depending on OS and SoftICE installation.

But the text you found will help you to start with basic cracking. :D
sync
08-19-2002, 10:03 PM
Originally posted by DakienDX
The text passage you found does not explain why your "P RET" or "G @SS:ESP" doesn't work.
Yes, after reading it again, I see that now.

I've tried a bunch of tutorials and none of them work on my system the way they are supposed to.
Manko
08-20-2002, 12:16 AM
I had the same problem... sortof?
I was using softice 4.05 for nt on a w2k.
f10,f11 and f12 would NOT work as they ought to do...
I upgraded to softice 4.25 from the driver studio package and now it works like a charm! ... :)

/Manko


DS 2.6, icedump, win XP -> fail
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DS 2.6, icedump, win XP -> fail
PDA

View Full Version : DS 2.6, icedump, win XP -> fail

chitech
08-20-2002, 01:11 AM
Hallo everybody

I use SoftICE Driver Studio 2.6 on Windows XP. I have binding the icedump image into ntice.sys with ntid -> OK.

Everything looks fine until I type:

pagein d 400000 512 c:\memory.dmp

IRQL must be below DISPATCH_LEVEL to use this extension.

Can anybody tell me what I am doing wrong

Thx

Chitech
username
08-20-2002, 05:26 PM
Originally posted by chitech
pagein d 400000 512 c:\memory.dmp

IRQL must be below DISPATCH_LEVEL to use this extension.

you have to be in a win32 app's context (i.e. not after a blind break-in with ctrl-d).
chitech
08-21-2002, 01:09 AM
Now it works!!

thx a lot

Chitech


a wrong disassembly?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > a wrong disassembly?
PDA

View Full Version : a wrong disassembly?

dion
08-20-2002, 03:38 AM
i'm confused who is wrong, is it wrong disassembly or ida. i'm seeing lot of db 66h occurances. examples:

push ebx
mov ax, 30h
db 66h
mov ds, ax
assume ds:nothing
mov eax, [ebp+arg_C]

mov ax, 30h
db 66h
mov ds, ax
assume es:nothing
db 66h
mov es, ax
db 66h
mov fs, ax
db 66h
mov gs, ax

but strangely, i dont see this db 66h in hiew. anyone knows who is wrong? if ida is wrong, then how to fix it?
thanks
comrade
08-20-2002, 04:22 AM
Perhaps IDA is dissassembling in 16-bit mode when the code is 32-bit?
username
08-20-2002, 05:44 PM
Originally posted by dion
but strangely, i dont see this db 66h in hiew. anyone knows who is wrong? if ida is wrong, then how to fix it?
thanks
Neither is wrong, the difference in the disassembly is the result of the treatment of the Operand Size override between HIEW/IDA, they both represent the same code (byte sequence).
dion
08-21-2002, 03:22 AM
thanks username.
accidentally, i read a source code file in 98ddk pack, a file named drv2.c, which is have strange and have same 66h value. the listing is:

_asm
{
_emit 66h _asm push si ; push esi
_emit 66h _asm push di ; push edi
_emit 66h _asm mov ax,word ptr function ;eax = function
_emit 66h _asm mov bx,word ptr dev ;ebx = device
_emit 66h _asm mov cx,word ptr buffer_size ;ecx = buffer_size
_emit 66h _asm mov dx,word ptr flags ;edx = flags
_emit 66h _asm xor di,di ; HIWORD(edi)=0
les di,buffer
mov si,es ;si=es
call dword ptr VDDEntryPoint ;call the VDD's PM API
cmp ax,word ptr function
je fail
_emit 66h _asm mov word ptr result,ax
fail: _emit 66h _asm pop di ; pop edi
_emit 66h _asm pop si ; pop esi
}

mmm... what u mean with operand size override, username? then do u know how to fix it in ida?
username
08-21-2002, 10:05 AM
Originally posted by dion
mmm... what u mean with operand size override, username?
First of all, you should download the Intel manuals from http://developer.intel.com/design/pentium4/manuals/ and then read at least chapter 3 (more precisely 3.6) in the first volume.
then do u know how to fix it in ida?
What do you want to 'fix'? IDA behaves correctly as well as i indicated already. If you want to change the visual representation of such instructions then you can turn on PC_ANALYSE_NOPREF in your ida.cfg (or better, idauser.cfg), but this works only for IDA 4.16 and up.
dion
08-22-2002, 03:24 AM
wee... thanks username :D


help please!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > help please!
PDA

View Full Version : help please!

NE1
08-20-2002, 03:25 PM
First, let me say hi to everyone since I am new to this board.
I am trying to reverse the protection used in GU1TAR PR0 3 and have hit a road block. Why this program? Well my very first attempt at cracking/reversing an app was with the previous version of this program. The previous version had only one serial number I could find on the web, and no cracks or keygens, so I figured, rather than do something that has allready been done several times, I would try something new. Anyway, I was successful, first at cracking and patching the program, and then reversing it and making a keygen (not released, just did it to see if I could). Anyway, I learned a lot about the tools and assembly doing that. Eventually the program was updated to the version it is at now. Unfortuanetly, the demo version of the program is crippleware, and cannot be made full. Fortunately, the full version can be found on a couple of different sites on the net.

Anyway, onto the protection. Unlike the previous version that just used the Name to generate the Serial Number (and the real serial could easily be found in memory), this version appears to use a checksum (I haven't tried any protections like this previously).
The serial number consists of 15 numbers.
There are 2 checks that I know of. When the program is first loaded and it reads your reg info from the ini file it calls the checking routing, and the second is (when there is no reg info in the ini file). when you enter your Name and Serial into the program for the first time, it calls the same checking routing.
Anyway, I was able to reverse that part of it.
It basically reads in your name, and generates a checksum from your name. Then it reads in the serial number you entered and checks the format of the serial number to make sure it matches the following format.
Makes sure it is 15 chars long.
Then it does the follwing checks.
((1st digit + 2nd digit) * checksum from name) mod 10 = 11th digit
((3rd digit + 4th digit) * checksum from name) mod 10 = 12th digit
((5th digit + 6th digit) * checksum from name) mod 10 = 13th digit
((7th digit + 8th digit) * checksum from name) mod 10 = 14th digit
((9th digit + 10th digit) * checksum from name) mod 10 = 15th digit
From the above checks, it is really easy to come up with several serial numbers that will match the name you use.
Now when you enter a serial number that fails the above checks, it prompts you, with an invalid liscence warning, and then allows you to try again.
If you enter the correct serial number, the program loads, you see the splash screen showing that it is registered to whoever, and the program runs.
If you enter the wrong serial number, that does pass the checking routine above (as I stated, there are many numbers that would work), the program loads, you see the splash screen saying that it is registered to whatever name you used, but then the program just exits, with no warnings or messages.
Obviousy there is another check somewhere, that further specifies the format of the serial number, and I can only guess that the reason for exiting without and warnings, etc., is just to frustrate crackers, etc. As of yet, I have not been able to find where this additionally checking is occuring. My main interest in this is just for educational purposes, but at this point it is becoming a challenge. I was wondering if anyone may have seen a similair protection scheme used, and might be able to offer some tips on what to look for.
Fake51
08-20-2002, 04:55 PM
Well, there could be several things going on:

Well, if it checks the serial again, there's two ways it could do it:
1 - check the info already loaded.
2 - load info again, and do some new checking

1 - watch the info already loaded, use some memory read/write breakpoints

2 - monitor the places where the serial is stored, and check to see when it's loaded again.

In the case of 1, you might also be in the position, that some of the serials that appear to be ok, are actually bad numbers. This seems unlikely though.

A technique you can use is to locate the unexpected exit, and then trace backwards. Chances are that it call exitprocess to end, and if that call is relatively close to the extra checking, well, you're in luck. The module could also be notifying itself to shutdown via messages. So, you could also monitor the messages that is being sent to it's window procedure.

Fake
DakienDX
08-20-2002, 05:12 PM
Hello NE1 !

I can't say much more to the process of going on since Fake51 already said much.

But this type of protection is quite usual. It's found in many programs. Some check a few extra bit's later, some just tell you "Thank you for registering" when you give the first serial number check a "valid" number, while the first check was meant to fail and the second one is the real serial check which interprets the serial in a completely different way. Some let you restart the application to verify the serial, making it harder to find the real comparing. Some check the serial in the main program, show "Registered" and an external DLL or VxD checks the serial again for a few other bits only when doing things like saving a file. I even found one which accepts any serial number, says "Thank you" and is registered. But the next day it tells you you've 29 of 30 days left. You enter again any number and it tells you that you've 28 of 30 days left 24 hours later. (This one was actually "released" by a warez-group. They even included a serial for it: "Please make sure you copy and paste the serial or else there might be a typing error" ;) )
NE1
08-20-2002, 05:27 PM
Hi, and thanks for the replies. As I said, I do have a couple of valid serials to test with, so I am fairly cartain that the reversing I have done so far is accurate. There are a bunch of calls I didn't trace, mainly because they are nested like 20 or more calls deep with varied jumps. This is why I asked about tracing the jump table in the "Tools of The trade" forum :) Hoping to find where the path changes, so I have a quick starting point. I also did try tracing back from the Exitprocess call, as it appears to be called from only 2 places, but again, it is within a nasty nest of calls, so I haven't gotten to far from there yet, although my eyes are starting to go buggy, so I may just be missing it. I know I'll get there eventually, was just hoping for a shortcut.
arieri
08-22-2002, 02:50 PM
hello

In case you haven`t figured out , put a break on
PostQuitMessage and trace back from there and you be close!!

regards

arieri
NE1
08-23-2002, 11:41 PM
Thanks for the tip Arieri :)
PostQuitMessage lead me to what I was looking for...
Currently reversing that part of the protection... Will update this thread when I am done...
NE1
08-24-2002, 04:12 AM
OK, going through this part of the code, I have been able to figure out what the magic number is (142857 decimal). When this number is multiplied by the checksum from the name, the result is the first part of the serial number.
The test used in this part of the code does the following.
It takes the first X numbers (haven't traced to see how it determines how many numbers to take as of yet, probably based on the size of the checksum), and divides them (as one whole number) by the checksum.
It then converts the result to a whole number.
Then it does the above math again, but does not convert the result to a whole number.
Then it compares the 2 results, and if they do not match, it calls PostQuitMessage.
So it appears that the requirement here is that the result must be a whole number.
I was able to determine the magic number by entering a valid name and serial found on the web, and thus the result of the above math resulted in the magic number, and I was able to verify it with the second valid name and serial found on the web.
Given all this, it appears that the code is not actually calculated anywhere in the program (so far anyway), thus making it unabled to be reversed (as without allready having a valid name and serial, you would not be able to determine the magic number).
Knowing this magic number, we are able to calculate most of the serial number required, and knowing the requirements I posted previously, the last 5 digits are a given, if we know the first 10, so the only problem we run into is if the result of multiplying the checksum by the magic number results in less than 10 digits.
So, the last thing I need to figure out is how the remaining digits are calculated if the above situation occurs. I will have to trace into the part of the code that determines how many digits to use for the above division, and maybe the answer will be in there.
NE1
08-26-2002, 08:20 PM
Didn't have much time to do anything over the weekend, but I did manage to figure out how it determines how many numbers to muliply by the magic number (and that turned out to be all I need to know). This part of the code reads in the last 6 digits of the serial number that was enetered. It then takes the first number of those six, to determine how many digits from the first part of the serial to multiply by the magic number.
So, from that we can determine that the 10th digit must be the length, of the result of, the checksum multiplied by the magic number.
Any digits that are left uncalculated, are insignificant, as long as the pass all previous tests.
So, we now have all the information necessary to make a keygen.
The math for the checksum is as follows:
checksum = 0
counter1 = 1
counter2 = name length
DO
get char in name at position counter1 - 1
checksum = (checksum + (char * counter)) mod 1000
counter1 = counter1 + 1
counter2 = counter2 - 1
loop while counter2 > "0"
checksum = (checksum + 81) mod 1000

Then we multiply the result of above, times the magic number (142857 decimal).
The result of the above calculation should gives us 8 or 9 digits.
Those digits are the first part of the serial, and the length (8 or 9), is the 10th digit of the serial.
If we got 9 digits, then we have all 10 digits of the beginning of the serial, and the last 5 are determined using this formula:
((1st digit + 2nd digit) * checksum from name) mod 10 = 11th digit
((3rd digit + 4th digit) * checksum from name) mod 10 = 12th digit
((5th digit + 6th digit) * checksum from name) mod 10 = 13th digit
((7th digit + 8th digit) * checksum from name) mod 10 = 14th digit
((9th digit + 10th digit) * checksum from name) mod 10 = 15th digit
If, previously we only got 8 digits, then the 9th digit can be chosen at random, and then you would use the same formula to determine the last 5.
NE1
08-26-2002, 08:56 PM
I wanted to point out that Ollydbg, saved me a ton of work reversing this protection scheme, with its run trace capabilities.
As the secondary checks on the serial number, are in the main program code, it allowed me to follow certain values through several calls, without having to reverse everything that was happening in between. Also, being able to do other stuff, while debugging the program, (where as in Softice I would be stuck in the Softice window, and would have to disable my bp's and exit softice to do anything else), was an added bonus. Not to mention the fact that the program is free :) I think it just replaced Softice as my favorite tool.


Does a tool like this exist?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Does a tool like this exist?
PDA

View Full Version : Does a tool like this exist?

NE1
08-20-2002, 04:06 PM
Hi, I was wondering if there was any tools available (or softice patches, plugins, etc.), where you could specify a starting and ending address, and it would dump a trace of the code in between the 2 address. Kind of like TMG Ripper Studio, except that it would actually run the program and dump only the path that was followed? And in order that it was followed, rather than in order of the address of the code.
NE1
08-20-2002, 04:20 PM
Actually to make it simpler. Just a jump table of all the jumps that were taken in the order that they were executed.
DakienDX
08-20-2002, 04:55 PM
Hello NE1 !

No, such a tool does not exist.
This topic has been already discussed many times.
You would have found information about it by using the search function.
Try SoftICE or ICEDump if you don't know further. (Read the manual or search on this board to find out how to do it)

If you want to have a tool like this, code your own kernel mode tracer which logs all jumps.
But people who are able to code such a thing won't need it. ;)
Just finding a "good boy"/"bad body" message isn't so hard.
username
08-20-2002, 05:13 PM
Originally posted by DakienDX
No, such a tool does not exist.
Yes, such a tool does exist, although apparently not many are aware of it: icedump's tracer engine can be told to log various amount of trace info (or extended to log anything of course). Take a look at its '/option t' command.
NE1
08-20-2002, 05:31 PM
I wondered if icedump could do that, but I could not find much info really on how to use it. Most info on it is related to unpacking programs etc, and not tracing. Do you know any good sites with extended info on icedump. Also, I am using DS 2.6 with Win XP, and ANTI-Softice patches. Will this be a problem with using icedump?
DakienDX
08-20-2002, 05:40 PM
Hello NE1 !

Yes, ICEDump on WinNT is a problem, because you've no /TRACEX command, to be exactly, you can just load and dump memory.

The only other method is switching off the code window and programming a self repeating macro just doing "P;P;P;P;P;P;P;P;...". But you'll soon notice that this isn't the yellow part of the egg. ;)
NE1
08-20-2002, 05:54 PM
Ahh, thanks for the info, and I see what you mean about the self repeating macro. I was also checking out Iczelion's tutorials on the Win32 Debug API, to see if I could do it that way. One of the tutorial's (#30), basically single steps through a program and counts the number of instructions. I think I might be able to use that as a starting point to make something myself to do it.
Of course I could be getting in over my head here :) hehe, but that is part of the fun...
JMI
08-20-2002, 08:01 PM
NE1:

Check out an article by Lord Soth titled "SoftIce's Back Trace buffer and some advanced commands" which appears to discuss methods of tracing program flow similar to what you are looking for. You can find it on the "What's new" page of the companion +Fravia site listed on the bottom of the page.

It has some very usefull Softice command discussion on commands most people don't bother or know how to use. On the Back Trace Buffer it states :
[QUOTE]

Well folks, we've finally reached the part of the essay which you've all been waiting for. This little section describes the SI back trace buffer and how to use it. Now, I'm sure some of you got some ideas on how this buffer works, but actually, it takes some thinking and planning and some luck to use it appropriately.

We all know the common problem. Sometimes we would like to know what was the program's flow of execution before SI popped (due to a BP or whatever..).

The trace buffer, while able to give us this information, will only help us if we set everything up right. If we don't, the trace buffer will not give us anything at all.

The reason this happens is very simple. SI has a limited sized buffer to use for storing logged instructions, and because of that, it would be pointless to have a backtrace utility without specifying a certain range of locations to monitor. What I'm trying to say basically is that SI can only monitor and log instructions that are in a predefined range of addresses.

If any of the instructions in that range are executed, SI will log them into the backtrace buffer, and allow us to enter trace simulation mode, which in turn allows us to see what was executed.

Once there are instructions in the buffer, we can either display them, trace them and basically do anything we wish with them, while using the trace commands (the special trace simulation commands).

So in order to even start this, we need to learn how to set a range for monitoring. This can be done with the following command:

bpr xxxxxxxx yyyyyyyy T [W]

[END QUOTE]

The article continues and contains a great deal of useful information on using Softice to a greater potential.

Regards.
username
08-20-2002, 11:56 PM
Originally posted by NE1
I wondered if icedump could do that, but I could not find much info really on how to use it.
w9x/doc/icedump6.txt should have all the info you need.

Also, I am using DS 2.6 with Win XP, and ANTI-Softice patches. Will this be a problem with using icedump?
The public version of nticedump does not support tracing, so you'll need some other tool, and since NTICE does not have the backtrace buffer feature either, you're pretty much left with non-kernel based tools. You should try OllyDbg's tracer which is based on the win32 API (and is therefore considerably slower than a kernel mode based tracer), but may still cut it for your purposes.
NE1
08-21-2002, 04:53 PM
Again, thanks for the info. As for Icedump, I read the doc in the NT directory, which did not have much info in it. I figured the 9x version was basically the same, but I have since read it, and as was stated it does have the info I was looking for about Icedump. As for the back tracing tutorial. I have read others, but the one mentioned looks like it has the level of detail I am looking for. Even if I can't use these things right now, I still like having the information for future reference, etc.
So, thanks again, to everyone.... :)
dion
08-22-2002, 03:15 AM
have u try my LOG3 plugin for trw, NE1? maybe it can fulfill what u need :D
Aimless
08-22-2002, 12:58 PM
Think above the crowd.

Softice is not the ONLY debugger.

Icedump is not the ONLY cool extension to a software.

All of the following will do what you want, in UNLIMITED quantites (does it even of the file exceeds GIGs of data, which it will if you TRACE all rather than TRACE OVER all)

Tools:

1. Ollydbg 1.06 and above.
2. Microsoft debugger
3. Turbo Debugger (very small level logging)

Personal choice for such traces on ONLY THE PATH followed?

Ollydbg.

Hands down the best tracer I've ever seen.

Better than Icedump in trace logging.

Have Phun
NE1
08-22-2002, 01:28 PM
Hi dion, No I have not tried, that. As of matter of fact, I have never tried TRW. I guess I will have to try that as well.

In any case, I am getting to the point where I am thinking that having this functunailty is not going to help anyway. As DakienDX pointed out:

Just finding a "good boy"/"bad boy" message isn't so hard.

Which under normal circumstances I agree with. It is just the protection I am trying to currently reverse, seems to have some tricks thrown in. I have tried the old paper and pencil method of tracing the jump tables used in this protection, and seem to be getting different results each time using the same input. I would have to confirm that as I could be just making a mistake as I have to trace through a lot of calls, but if it is the case, then a trace is not going to help the way I originally thought it might.

As for Aimless's reply.
I have tried Ollydbg, and am aware of it's hit trace and run trace capabilities. I just have not figured out how to use that functionality as of yet. I don't know what conditions I have to set to have it do a conditional trace, or even a trace all for that matter, and if I do not enter any conditions, the trace log is empty. It is just a matter of figuring out how to use the program I guess. I do use a lot of tools in addition to Softice. It is just that with Softice, there is most likely a tutorial somewhere, that can explain pretty much anything you need to do using Softice. The same cannot be said for other debuggers, thus making them a little harder to figure out the more advanced functionality of the programs.
NE1
08-22-2002, 02:10 PM
I fugred out how to the run trace in Ollydbg.
Thanks for all the help....
NE1
08-23-2002, 05:26 PM
Aimless,
Ollydbg worked excellant. Thanks again for the suggestion.


Need some help with app please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need some help with app please
PDA

View Full Version : Need some help with app please

Flack
08-20-2002, 08:01 PM
Hello,
I d/l'ed a fully functional demo of an app that helps you make Windows help files, called Help and Manual. Now, I was able to remove the 14 day trial period but something else is messing me up now. Everytime I compile a new help file, sprinkled throughout it are messages like UNREGISTERED DEMO COPY and stuff like that. Does anyone know how I can stop it from doing that? Maybe I could do something to remove the time limit that will also remove those messages, I dont know. To get rid of the time limit I nop'ed the calls that popped up the demo nag screen after the demo time trial was up and I was able to continue using it.

Anyway, any help is appreciated.

Thanx a lot

Flack
evaluator
08-20-2002, 08:15 PM
>>Thanx a lot

N0 thanx:(

All, about you are talking, you must done y0rself.
Search, Read & Learn

or your post seems like crc-help request..

Don't replay!
Flack
08-21-2002, 06:12 PM
Ok then, can someone at least tell me what I am looking at so that I may go "Search, Read & Learn" by myself? I thought after I passed the time limit it would be fine but obviously I was wrong. I dont mind reading and I would search but I dont know exactly what to search for. Maybe someone can help me out. Im not asking that anyone do it for me.

Flack
DakienDX
08-21-2002, 06:46 PM
Hello Flack !

Why don't you write the "unregistered" text down and search for it in the application?
If you're looking for a bitmap, try a resource editor. Deleting the bitmap may help, but will probably not.
If you're looking for text, try normal and UNICODE, replace the text by spaces or 00h.
Find the place where the bitmap/text is loaded and inserted into the help file, find out why this is done, check for flags preventing it.
The list is very long, just try by yourself.

Follow the links below and you'll end up in pagers dealing with similar situations.
Flack
08-21-2002, 10:26 PM
Thanx for the tips DakienDX. I opened up the exe in HexWorkshop and searched for the inserted text:

This help file was created with an unregistered copy of Help & Manual. © EC Software. All rights reserved. This message will not appear if you compile this help file with the registered version of Help & Manual.

However, the closest thing I can find was:

..is h..f.@ile was c..ed wit@.h.` unregiste.. co..py of.K. . EC Sof..tware. All right...Qserved. Th..m..ag....i.0not appear if......mp..t..h.w..the.0..v..ers

I changed the letters that I recognized to spaces and the message did disappear. Anyway, I would like to find where the program inserts the text into my help file.

What breakpoint would I use so that softice would popup when I hit a certain button in the program? Im hoping that if I can break in when I hit the compile button I can step through and find where the text is inserted. Would this be helpful or am I totally off base?

I apologize if my newbie questions are irritating, I just want to be able to do this.

-Flack
DakienDX
08-21-2002, 11:45 PM
Hello Flack !

The text you found looks like the .EXE is packed. It shouldn't be encrypted/protected since you can still read parts of the text. So you should unpack it first and then go further.

You can use BMSG in SoftICE, but I wouldn't recommend it. I suppose a helpfile creation is a complex work and you wouldn't find anything you're looking for so easy in all the code.

One idea might be that the "unregistered" message is inserted into the help source file (.RTF), so you might compile your help file as normal, edit the generated .RTF file and remove the "unregistered" messages and compile it again using the windows help-compiler.

This works if you're creating a .HLP file, but not on .CHM files. So you have to find a similar way there too. However, this is just a workaround, nothing practical.
Flack
08-21-2002, 11:59 PM
Hey DakienDX, thanx for helping me out. I thought of editing the files and then compiling them with windows help compiler and I was easily able to remove all of the unregistered messages (all I have to do is ask Help and Manual to not delete the temporary files so I can edit them and compile on my own), which is good, but kind of tedious. Anyway, Ill unpack it and continue trying to find a way.

Once again, thanx a lot for your help

-Flack
dion
08-22-2002, 03:31 AM
didnt u see links in the bottom of this page, theres bvery good link to start with, Flack, especially fravia collection/CrackZ.

wish u luck, Flack
Flack
08-23-2002, 06:41 PM
Hey DakienDX,
You said that the text I found looked like the exe is packed and that I should unpack it first and then go further. When I checked with PEid with what the exe could be packed with, it didnt find anything. So if it is not packed, where can the message be? I checked all of the files that it came with but they are not in there either.

Anyone have any suggestions?

Thanx

-Flack
DakienDX
08-23-2002, 07:30 PM
Hello Flack !

The text looks really packed to me. If the .EXE is not packed/protected, then maybe it uses some internal compression.

At least you've found the (partial) "unregistered" message. You should try breaking with SoftICE on "read" from this memory location. You might come over the decrypting procedure this way.

I don't know if you've won much then, since you would have to repack the patched data and you don't know how it was compressed. The only other way apart from editing the .RTF files would be to search if there is a "registered" flag somewhere which disables the "unregistered" message.
evlncrn8
09-18-2002, 04:55 AM
might be packed ?

hmm it might be .. of course it could also possibly be doing stuff like...

mov esi,offset unregisterednagbuffer
mov dword ptr [esi],'ernU'
mov dword ptr [esi+4],'tsig'
mov dword ptr [esi+8],dere'

etc etc..

think about it.. if the exe was packed, and he changed those bytes, and then ran the exe, surely it would crash?


Asprotect tutorials
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Asprotect tutorials
PDA

View Full Version : Asprotect tutorials

magistral
08-21-2002, 12:49 PM
Anyone knows where can i find +splaj's asprotect tutorials?.
i cannot find it with google !!.
(only found it in krobar, but all links are broken).

thanks.
[yAtEs]
08-21-2002, 01:05 PM
Originally posted by magistral

(only found it in krobar, but all links are broken).

that would be because google refers to my host a lot, which wont
be back up for a couple of days, try krobar.cjb.net and u'll find
working mirrors.

yates.
dion
08-22-2002, 03:26 AM
search it here :D
JMI
08-22-2002, 04:28 AM
You will find one of them here:

http://www.woodmann.net/forum/showthread.php?threadid=2001

Regards.


Stupid Newbie Revirgin Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Stupid Newbie Revirgin Question
PDA

View Full Version : Stupid Newbie Revirgin Question

RevirginHelp!
08-21-2002, 04:06 PM
I always hear great things about ReVirgin's Tracer but I am really new can someone tell me how to use it Please dont flame me :(
nofurs
08-21-2002, 04:13 PM
Hi,
check out this page http://www.woodmann.net/fravia/what_new.htm
There are couple if tutes explaining how to use.


uic strainer...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > uic strainer...
PDA

View Full Version : uic strainer...

ZaiRoN
08-21-2002, 05:35 PM
hi to all!
it's time to work on something hard!!!

this is a strainer made for an italian reversing group: UIC.
the first line of the attached file says:
"This crackme is simple, you must only arrive to Congratulation Box..."
attention, don't believe in him!

inside you'll find many interesting things: seh, interrupts modification, anti-sice stuff, and so on.
it isn't a classical name/serial crackme, it's like a puzzle...

as i said before it's not for newbies but everyone is well accepted and experienced fellow(s) will help you ;)
i thought the project can be very useful in order to improve our knowledge :)

needed literature: intel manuals (especially #3)
http://developer.intel.com/design/pentium4/manuals/

good luck & have fun ;)
ciao,
ZaiRoN
ZaiRoN
08-22-2002, 10:32 PM
hi!
i don't know how many people are working on this target; anyway, here is a little help in order to start play with the crackme.

at first, the main problem (i think) is that the crackme crash (or block) your machine if you set breakpoint.
the problem resides in the initial part of the proggie where some interrupts handler are changed.
here is some code:

00401000 call GetVersion ; it doesn't work on NT system
00401005 cmp eax, 80000000h
0040100A jnb short near ptr loc_401071
...
00401071 call near ptr byte_40167F ; modify int3 (breakpoint exception). new int3 handler = 401755

the first important call is the one at 401071:

0040167F mov eax, 401755
00401684 mov word ptr ds:byte_402721, ax
0040168A shr eax, 10h
0040168D mov word ptr ds:dword_402727, ax
00401693 sidt ds:qword_4026C7 ; get base address of idt (interrupt descriptor table)
0040169A mov ebx, dword ptr ds:qword_4026C7+2 ; ebx points to idt base address
004016A0 add ebx, 18h ; ebx points to int3 handler (the original)
004016A3 mov edi, 4026CDh ; where to save the original int3 handler
004016A8 mov esi, ebx ; esi points to int3 handler
004016AA movsd ;
004016AB movsd ; save the original int3 handler
004016AC mov edi, ebx
004016AE mov esi, offset byte_402721 ; esi points to the new int3 handler
004016B3 movsd ;
004016B4 movsd ; change the int3 handler. the new handler is at 401755
...
ok, in this way the crackme can do everything when an int3 in raised! (look at 401755...)
how to deal with this?
hmmm...personally i don't allow the crackme to execute the call at 401071 and when an int3 is called, i change the eip to the right handler: 401755.

as said before, this is not the only int that is modified but you can apply this method to the others (remember to sign the new handler(s)!):)

well, someone want to continue?

regards,
ZaiRoN
Kayaker
08-25-2002, 06:32 AM
Nice job finding this one Zairon! It has a few, er, twists and turns... Interesting choice of interrupts, INT 9, INT 18.., I've taken the tact of ensuring NONE of the interrupts in the IDT get hooked by jumping past the series of Calls which hook each INT. This may backfire on me because one of them may be needed to find the correct route through.

I've directed the code past a seemingly bogus CreateFile call, and a section which would have wiped out large portions of code with garbage, to the "obvious" _lopen / _lread of a key file. From there it seems to branch to 3 more trouble spots depending on the results from the keyfile, it either Rehooks INT 4 (don't think it's unhooking it, especially since it doesn't unhook the IDT on exiting), or executes a BOUND instruction (equivalent to an INT 5), or runs directly into a bunch of INT 4 instructions.

There is a small trick to getting _lread to return successful, can you see it from this code?

:00401404 push 1
:00401406 push offset aBonzokey_key ; "BonzoKey.key"
:0040140B call _lopen
:00401410 push 1Eh
:00401412 push offset unk_0_40214D
:00401417 push eax
:00401418 call _lread
:0040141D mov eax, ds:dword_0_402152+2
:00401422 mov ebx, ds:dword_0_402152
:00401428 div ebx
...to checks

I haven't checked, but I'm *hoping* a correct keyfile might decrypt some code which jumps to a good section. Also, it's possible one or more of the new Interrupt Service Routines (ISR's) that the program installed for Interrupts 2-5, 9 or 18, may contain some code which also decrypts an important section. Mind you, all the ISRs look a little odd, they may be just to cause crashes. The Softice command 'IDT' will display the Interrupt Descriptor Table and will show the addresses of the new ISRs installed.

There's couple of interesting things in this. It begins with an SEH installation and the sequence of IDT hook calls just before the first message box, and then goes on to load a small dialog box. When the 'register' button is clicked there is a decryption of a binary string at 402028h which *should* decrypt to a valid filename for a CreateFileA call one would think. However it just creates another binary string which can't be converted into ascii.

:00401393 push offset aC51f6I ; "c+5¦1f!6|i+"
:00401398 call CreateFileA

If you DID allow CreateFileA to be called, then it goes on to do an interesting wipe of 2 code sections. It uses the RDTSC (Read Time Stamp Counter) command as a random byte generator to use as an xor value for wiping code. RDTSC returns the number of clock cycles since the CPU was powered up or reset as a 64-bit count in EDX:EAX. It can be used for testing the relative speed of a code section between two RDTSC commands. Here it just gives a random xor value in AL. This code is used to wipe a section at 40130Ah and 4013D4h, which includes the keyfile routine. Nice trick for wiping a section of memory.

:004013A8 xor ecx, ecx ; clear counter
:004013AA mov ebx, 40130Ah ; address to start overwriting

:004013AF RDTSC ; returns a dword in eax
:004013B1 xor [ebx+ecx], al ; xor with byte [address + ecx]
:004013B4 inc ecx
:004013B5 cmp ecx, 1FCh ; overwrite 1FCh bytes
:004013BB jnz short loc_0_4013AF

:004013BD xor ecx, ecx
:004013BF mov ebx, 4013D4h
:004013C4 RDTSC
...

The INT 9 is particularly fun, giving an impressive video hang, I get a mottled gray background with a single blank icon square around where the mouse cursor used to be ;p I think the keyfile needs a closer look to see if it's really part of the protection.

My $.02 for now,
Kayaker
ZaiRoN
08-25-2002, 04:39 PM
Hi Kayaker!
your post are always interesting.

> There is a small trick to getting _lread to return successful, can you see it from this code?
hmmm...no.
_lread *should* work fine, why not!?!
you have to pay attention on the 'div ebx' instruction.
infact, if you don't put right values in the BonzoKey.key you can have a 0/0 operation that will raise exception...

> I think the keyfile needs a closer look to see if it's really part of the protection.
i think that the keyfile is here only for kidding us!

- if the CreateFileA function find the keyfile, as Kayaker said, we will reach this piece of code:

:004013A8 xor ecx, ecx
:004013AA mov ebx, 40130Ah
:004013AF rdtsc
:004013B1 xor [ebx+ecx], al ; EXCEPTION: C0000005h write memory violation

the .CODE section has only 'readable' and 'executable as code' attributes but NO 'writable' attribute.
so, the instruction in 4013B1 will raise an exception.
put a bpx on 401AA5 (the entry point of the exception handler) and see what happen when you step the xor instruction.

... exception handler...
:00401ADC cmp eax, 0C0000005h ; write memory violation
:00401AE1 jz short loc_401A81 ; our jump...
...
:00401A81 mov ds:byte_40216C, 7Fh
:00401A88 mov ds:byte_40216D, 0C0h
:00401A8F mov eax, offset loc_401A99
:00401A94 xor word ptr [eax], 7777h ; damn! another write memory violation!!!

this cause a recursive jumping from this snippets and the seh handler.
the problem is that i really don't know how to exit from this jumping sequence !?!
and, it doesn't have much sense !?!

- if the CreateFileA doesn't find the keyfile, you'll reach a piece of code where some interrupts are called.
those are int9, 3, 4...
maybe this is the right way but who knows!?!

ok, this is a simple description based only on ida dead listing because momentarily i don't have sice/olly...
don't know what do you think about the keyfile but this is my thought...
i'm waiting your thought/suggestion/comment ;)

regards,
ZaiRoN
mike
08-25-2002, 06:40 PM
The only limitation is that you can't put a jump directly to MessageBox routine
this is not valid :)))So do an indirect jump, or a push/ret, or do a direct jump to just before the MessageBox routine, or write your own crackme puzzle that has the same messagebox and send it back or...
Kayaker
08-25-2002, 07:54 PM
Heh, I don't know which is the right door. I've traced through one of the 3 or 4 directions the _lopen keyfile routine could take, but I'm not holding out any hope on an easy solution there. The routes just seem to lead to bad code with nonsense decryptions. The CreateFileA routine might be used to open a keyfile if you changed the code to point to a valid ascii filename, but it doesn't seem to matter because success leads directly to CloseHandle anyway.

Why _lread might fail...? Permissions?

After the CreateFile routine is the RDTSC routine.

:004013A8 xor ecx, ecx
:004013AA mov ebx, 40130Ah
:004013AF rdtsc
:004013B1 xor [ebx+ecx], al ; EXCEPTION: C0000005h write memory violation
:004013B5 cmp ecx, 000001FC
:004013BB jne 004013AF

Interestingly, the EXCEPTION doesn't occur on a simple memory write. You can trace through this code and see the addresses from 40130Ah change, but (40130Ah + 1FCh bytes > 004013AF) and eventually the rdtsc code itself gets overwritten as it's processing the loop.

I don't even have the programs SEH handler enabled, as you've shown Zairon, it doesn't seem to be much use either. Not too sure... I think it's time to look at the problem backwards and see if the goal of the challenge (show a Congratulation Box), can be found and tied to the earlier code. It may require a partial decryption or other patching, but you could use one of the hooked interrupt routines or the SEH to run some of your own code. There is a bit of code before the _lclose routine that looks interesting...

Kayaker
evaluator
08-26-2002, 07:30 PM
Hello!

crackmes are not my hobbie, but I dld this crackme just for look.

My Q is:
this prog has bug (it crashes on w98se),
or it is speacially done & we must correct prog?
Kayaker
08-26-2002, 07:36 PM
Hi evaluator, Yes, this is part of the challenge it seems.

K.
ZaiRoN
08-26-2002, 07:58 PM
Hi evaluator!
directly from the rulez.txt attached file:
"Ah.....don't worry if it will crash :P"

bye,
ZaiRoN
Bengaly
08-27-2002, 07:57 AM
Well it doesn't run on Win2000,
it says:
Questo progrrama non puy essere utilizzato su sistemi windows NT"

to fix this, just change the cmp eax,ur version

original:

call GetVersion
cmp eax, 80000000h
jnb short near ptr loc_0_401070+1
push 20h
push offset aWrongSoVersion ; "Wrong SO version!"

patch:

well, breaking at offset 600 with INT 3 will led us fetch the Version, in here at least i get: 0893005h, so Changing the
80000000h to 05009308 (Win2000 professional) will fix this small problem, and bring us to the evil calls with lotsa crashes :)
cya
Bengaly
08-27-2002, 09:17 AM
here is a runnable fix of the file.
its tested on my machine (Win2000 & win98se), i guess mabye it will crash on the GetVersion, but u only need to change the cmp eax,ur version (if thats the problem).
i guess its not so hard to fix this crackme in order to run it properly, but if someone can't, just explore my small fixes.

-> ah i just checked on win98se (dual boot), the fix is working there too..so i hope u wont get any probs .
-> (btw, the register button crashes in win9x, is that supose to be a part from the protection?..i dont know yet, but on win2000 it just close the crackme when pressing the register button)

cya
Ben
nikolatesla20
08-27-2002, 02:03 PM
I guess it's protected, eh? When it doesn't even run worthwhile, and uses os specific trix.

Whatevah. Talk to the hand, man.

-nt20
Bengaly
08-27-2002, 02:12 PM
its not protected with any packer or alike, its just use some damn jmps from place to place and using ints to kick ur ass or some faults which raise exceptions,
i would think that the readfilea is a decoy since it always gets -1.
i guess in order to fix ur route u will need to make some inline patches, but that just a though.
ZaiRoN
08-27-2002, 03:20 PM
Hi all!!!

Ben:
maybe it works well on win2k but i suggest you to work on win98 system only.
the italian message sounds like "the program cannot run on windows NT system" ... but you should already know this :)

for all:
as said in the first post, this crackme is like a puzzle!
there are many interesting things inside but the main problem is: how i could join this things together!?!

perhaps you know already these information; however, it's here some points on which being able to discuss together:

- run the crackme with filemon enable. the crackme close filemon (and crash...)
so, the crackme detect filemon !?!
there are many ways to find if filemon is still running but the most general is the one that use the createfile approach.
i guess if the CreateFile function is used for this and i guess if the bytes from 402171 are here for taking "filevxd.vxd"...

- starting from 401607 there is a decryption routine. it decrypts 68 bytes starting from 401026. it used a double xor-layer but i'm not able to find the right key.
this piece of code is reachable from two different point:
1) from the jump relative to the invalid_opcode error code.
2) from the lines above if you decrypt well the two bytes at 401605. it *should* be a checksum or something like; look inside the call at 4015C4...

- when i was looking at the disasm code, i was thinking about this imaginary flow execution:
the first call of the CreateFile fails because the filename has non sense; then (after some code...) 68 bytes from 401026 are decrypted.
after the execution of the 68 new bytes_code we will jump down directly to the CreateFile function.
the second call of the CreateFile is used to detect filemon (and the filename is "filevxd.vxd")
if the filemon is not found we will arrive at _lread function and ...

these are only my considerations that obviously could totally be mistaken but who can say it !?!

Kayaker: maybe we have to take the two doors :)

regards,
ZaiRoN
Bengaly
08-27-2002, 04:26 PM
i ran file mon with the crackme and there was no crash ;P
and it didn't look for any bonzokey.key, but that just over win2000 and also the crackme works fine here..
evaluator
08-27-2002, 09:34 PM
My suggestions:

1. we should change to WRITBLE code section.
2. There are INT01s & there is code for change INT01 handler(4018FF), but it not executed.
This is first reason for crush w98-system.
IF assume: this is trick, so when you meet INT01, you also should execute
his own handler (40193C).

ZaiRoN!
We need more Rules for game called PUSSLE or POSSIBILLITES will eat us!
Bengaly
08-28-2002, 07:31 PM
Face it might evaluator.
u can't do it :D :D
evaluator
08-29-2002, 10:54 AM
what if it is like "white joke"?

I traced inside all INT handlers & found many interesting things,
but can't force to right decrypt code at 401026.. later about it.

Now anyway, lets try "arrive to Congratulation Box".
But where is code for it??
Yah! I guess it starts at 401261 & 24 bytes are crypted.
Why I think so!?
I just calculated how many bytes is need for MessageBox routine + 1jump
& this code is also 24 byte:)

Lets write at 401261:

6A20--------with ICON please:)
68C4254000--Gooooooood!!!!!!!!
68D7254000--Oh Yeah! I'm registered now!!!
6A00
E848A00000 -call MessageBoxA
E9C1030000 -jump to Full exit routine with IDT restoring

so we need also:
1.change jump at 40125F to no-jump (EB44>EB00)
2.nop 2 byte at 40199A for avoid crash

Hope it helps for true UncrackMe.
evaluator
08-29-2002, 10:03 PM
YUUUUUUU!

Unbeleaveble Job Done!

1. all crypted(xor-ed) code will decrypted & then patched
2. SEH-handler remanaged
3. XP(nt)-compatible

Who CAN!? Who can'T???
evaluator
08-30-2002, 04:14 PM
OK, Final Version uploaded(Major Update:).

So what now?
Should I somewhere send my un_pussled work?
Or it is already done??(Zairon, I kill you, if so~:0)
ZaiRoN
08-30-2002, 04:35 PM
have you ever slept in this days!?! :p

i have a little question for you:
how you have made to find the eight bytes from 40216B ?

byebye,
ZaiRoN
evaluator
08-31-2002, 04:35 AM
Hi, ZaiRoN!

about bytes: in disassembly I found referenses to these bytes,
but only 6 are valid. Problem is byte 40216F (63 seems wrong)
& then for byte 402171 (becuase it calculated from 40216F).

Later about how I found..
First answer on my previous Questions, please!
ZaiRoN
08-31-2002, 10:02 AM
Hi evaluator !!!
First answer on my previous Questions, please!do you want to know if someone has just solved this crackme?
yes...but i think the are no tutorials yet on the net.
anyway you can send your solution to Quequero (people are always happy when someone break his crackme :D )

regards,
ZaiRoN
evaluator
09-02-2002, 07:22 PM
eh, you kill me..

OK, I performed BruteForce analyze in Mind about what final XOR can be
for range 401026-40106A.
Using HexWorkShop I exported this range:
63 84 89 E8
C2 82 8B B7
8E 8D 23 B5
F5 96 E8 A8
43 44 32 95
BB 31 12 D8
D0 F7 A8 CE
05 B5 38 38
F1 7E 12 DD
D0 F7 A8 99
DE BD 2B 69
C6 34 51 B0
B7 42 9B 61
78 C2 BA E8
C2 86 AC A2
41 76 AC 2B
3B AF DD 5D

then I sad to myself:
most used byte in code is 0h,
so in each column I choose 2time repeated byte & I have this variant:
C2 -- A8 A8

then I XORed range of code with it & it looks very like as normal code!
Some tries and I get second byte.. so summary XOR is:
C2 B7 A8 A8

backward XOR this with bytes from 40216B-6E & I have correct 2 bytes for 40216F & 402172
VIVA, ITALIA!

Mutch easy was range MessageBox range, because I first wrote my code & then according
to this found XOR.

So final 2 Q I have are:
1. IF my XORs are right, authors before XOR-ing "damage" that code, so I patch it.
(Or my XOR is incorrect??)

2. Is no-bruteforce way for find correct byte 40216F?
ZaiRoN
09-03-2002, 07:13 PM
Hi evaluator.

>...(Or my XOR is incorrect??)
your 0xA8A8B7C2 xor value is right. i agree with you that some byte has been modified after the xor.

i have take a look at your modified file. you have added/removed several lines of code.
is this the right way!?!
it's strange but, is a *massive patch* necessary?

i havn't still tried but i'm thinking to change only few bytes:
- the few bytes that were changed by the author in the (two) encrypted code. i don't know yet the right values...
- bytes from 402133/40213A: 23 1F 4C 3A E1 A8 E4 92
- bytes from 40216B/402172: 00 CF 06 7A C2 78 AE D2
i must say that without your work (maybe) i wouldn't be never successful to find those values...thx!

anyway, what do you think? it could work?
i'll try in the next days...

regards,
ZaiRoN
evaluator
09-03-2002, 08:27 PM
massive patch??

as I wrote, SEH-handler is damaged so I added my SEH-manager (103byte)

in 1st dexored section I patch 5 byte, in 2nd- 4 byte.

OK, make your job & lets compare.


assembling my own prog to 'fix' import data sections
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > assembling my own prog to 'fix' import data sections
PDA

View Full Version : assembling my own prog to 'fix' import data sections

Kr0n0
08-21-2002, 05:38 PM
hi...
i'm trying to do my own ImportSectionBuilder, but i'm not sure if i'm taking the right direction or screwing up
the prog takes an input something like this:
-------------------------------------------------------
kernel32.dll: CreateFileA CloseFile ExitProcessA
user32.dll: MessageBoxA
...etc...
-------------------------------------------------------
but does the order of the imports matter? i mean, if in the original importsection kernel32 imports came first, can the user32 come first on the rebuilt importsection
and what about the 'Hint' does it interfere in any way the imports's order? or can i set it as NULL

thanks for your help and any feedback and sugestions are appreciated :)

ps: if anyone wants to get involved with this or make this as a miniproject RCE (since i'm a newbie myself) just say so :)

kr0n0 aka k0m0d0
DakienDX
08-21-2002, 05:53 PM
Hello Kr0n0 !

I'm not sure if I understand what you're trying to do.

Are you trying to write a program which creates an import table which you can insert in any of your programs and redirect the calls to the imports later or are you trying to re-build an import table for an application you cracked?

If you're just trying to build your own import table to learn and play with, the order of the imports and DLLs doesn't matter, since you will only have a few you can redirect by hand.

However, if you are working with some comercial application where you want to rebuild the import table (because it was messed up by a packer) you must care about both the order of the DLLs and the exact order of the imports.

The "Hint" doesn't matter. You can set it to 0000h without any problems. Several compilers do this by their own.
esther
08-21-2002, 05:54 PM
Hi Kr0n0,

It depends on the program itself.trace through the code using softice or you can use Revirgin or Imprec to see how its done.

Regards
[yAtEs]
08-22-2002, 12:30 PM
Originally posted by Kr0n0

but does the order of the imports matter? i mean, if in the original importsection kernel32 imports came first, can the user32 come first on the rebuilt importsection
and what about the 'Hint' does it interfere in any way the imports's order? or can i set it as NULL

in theory the order of your dll IAT's doesnt nor do the
descriptors matter as long as its all correctly created (-; oh
and hints can be null too.

but pratically remember to take into consider the IATs order
if your chopping and changing something since code is patched
to the entries

yates.
Kr0n0
08-22-2002, 01:40 PM
i see... :)

but do the packers/cryptors always screw up the .idata the same way? it seems not. (i've only done 4 packers: and of those 4 only upx and fsg screw it up)

so in your opinion what approach should i take?
1) fix the .idata from scratch, simply using the imported names functions and .DLL
search for imported function
rebuild the corresponding part of the .idata using GetProcAddress and GetModuleHandle
get to next import

2) use the screwed .idata
search for imported function
check to wich .DLL it belongs
rebuild the corresponding part of the .idata using GetProcAddress and GetModuleHandle
fix RVAs in the .idata
get to next import

i think 1) is simpler and it simply relies on the import names and .DLL being present, which are always there!

and about the ordinal thing? if it's imported in ordinal, the only thing i have to worry it so the RVA point to [address_of_imported_function - 2] right?

thanks for your replies :)
[yAtEs]
08-22-2002, 02:41 PM
Originally posted by Kr0n0

but do the packers/cryptors always screw up the .idata the same way? it seems not.

so in your opinion what approach should i take?

nope, depends what your doing, what do you want to achieve?
, sounds like your trying to build a whole new import table
for any upacker which might be tedious (;

if its for a specific packer you better off learning what it does
to the import table and reversing the changes, or dumping from
oep and figuring out a fix method, rather than taking the phrase
rebuild an import table so literally ;-) the 'more raw' approach
which you seem to be taking can be done for a specific packer if
you know how it works and where tables/asciis and stuff are stored.

thats what i think anyway, i probably got it all completely wrong
what ur doing, but hey thats me ;-)

yates.
DakienDX
08-22-2002, 06:24 PM
Hello Kr0n0 !

Not all packers/protectors screw up the import section the same way (you usually don't say "screw" for packers, since they only do what windows would do else). There are generally several ways.

The simple way would be if the packer simply packs the .idata section as it is and unpacks it while executing the .EXE. This way you have an .idata section which you can dump (before the unpacker starts to load the imports) and insert in your dumped program.

An other way, used by UPX also, is that the packer re-aranges the .idata section before it compresses it, so that there is less data which needs to be compressed. This way you'll never have a "normal" working .idata section while unpacking. So you've to rebuild the import table with some import rebuilder.

A third way, usually not used in simple packers, is that the protector re-aranges the .idata section before encrypting it, like before, but also redirects the imported functions to it's own routines. This way you won't be able to rebuild the import section by looking which address belongs to which function in which DLL, since the import table's entries point to the protector's code instead of the imported functions.
Kr0n0
08-22-2002, 07:45 PM
my idea is to make a generic .idata rebuilder, that picks up the imported names and .dll files from an unpacked-and-non-functional .idata that was dumped using icedump, just after the packer/cryptor as unpacked/decrypted it, or just before it reaches EP of prog! (i hope i clears things out :)

[yAtEs]
but from what you said the closest thing i can get i to make a generic .idata 'fixer' only for a specific packer/cryptor of it's corresponding version

DakienDX
1) like EZIP or EXE32PACK

2) like UPX or FSG

3) this is a hard one :( the RVAs instead of pointing to a symbol name (ex:MessageBoxA) points to a symbol of the packer (ex:a symbol in a .dll of the packer)
but the symbols that are present in the RAM after it decrypted are used indeed; OR are there for confusing and use the redirection and there the redirection procedure gets the real imports and fixes the FirstThunks of the decrypted .idata in RAM

i hope i didn't confuse things even more :)

but for a packer/crypter to work :) it always have to have the imported_functions and .dll_files stored somewhere! (there's no way out of it), and before it gives control to the prog it has to have ALL FirstThunks with correct addresses to the imported_functions
DakienDX
08-22-2002, 10:15 PM
Hello Kr0n0 !

You will not have problems with KERNEL32, USER32 or other system imports, but non-system DLLs will be a problem if you just use a dump instead of the actual running process.
Let us say the program is using four own DLLs. Each of them has a image base of 10000000h. When the first DLL gets loaded, it will probably be loaded at address 10000000h. But if the next DLL is loaded, the address space it wants to load into is already in use by the other DLL. So this DLL uses a different address space. The same goes for the other two DLLs.

So if you've an entry in the import table pointing to, for example, 10004130h, you can't tell in which DLL to look for the imported function, since all of the four DLLs could have been loaded at that address.

However, if you're rebuilding the import table while the program is running, you can check which DLL is loaded at which address and know in which DLL to search for the imported function.
This problem does not happen with system DLLs like KERNEL32 or USER32, since they are always loaded at the same address in memory.

There is also an additional problem when using a dump. The protector could have destroyed the names of the imported DLLs. So any DLL on your system might be the one you're looking for.

The possibility I talked about the third time works a bit different as you think. The protector might not have stored the imported functions and DLLs somewhere in memory. It has no need to give all FirstThunks correct API addresses before passing control to the decrypted application. It could be that all imported functions just point to one single procedure in the protector's code. When an import is called, the protector calculates the imported function from some of it's own internal tables and jumps directly to the API. This way the program will run like normal, but you'll have never any valid addresses to imported functions in your import table.


Fsg 1.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Fsg 1.3
PDA

View Full Version : Fsg 1.3

bart
08-21-2002, 07:32 PM
Have phun

h**p://www.xtreeme.prv.pl/files/fsg13.zip
Thigo
08-22-2002, 12:27 AM
would be nice if you could upload this file to a correct server... this one is impossible to reach :(
JMI
08-22-2002, 04:37 AM
Thingo:

Perhaps the problem is on your end. I didn't have any trouble downloading it. If you can't get it send me a PM with an email address and I'll send it to you.

Regards.


Problems finding OEP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problems finding OEP
PDA

View Full Version : Problems finding OEP

magistral
08-22-2002, 01:33 AM
I'm having problems finding the OEP in aspr 1.2[NewStrain].

Which generic methods exists to find it?.
I cannot find the signature (61,ff,e0) in memory with Sice.

even if i get a supposed OEP with OEPfinder or peid 0.8, i cannot get sice to popup. (i use a bpm in the supposed OEP address, and i use SuperBPM).

any tips?.

thanks.
Solomon
08-22-2002, 02:46 AM
please search the old posts. This has been discussed many times:)
magistral
08-22-2002, 12:00 PM
yes, i've downloaded and readed *ALL* posts about asprotect, but all posts always assume that u can found the OEP.

my problem is with the bpm's.
Kr0n0
08-22-2002, 07:58 PM
maybe i'm not helping much,since i'm a newbie, but....
do u have bpm problems how? the prog doesn't run, error message?

keep your eyes open for instrunctions like:

jmp eax

jmp far address that is in a difference range than current eip (ex:eip = 450000 and u jmp 401000)

push reg/mem and then ret

call far address (after the prog finishes, control returned to packer and packer exits)

popads

<
even if i get a supposed OEP with OEPfinder or peid 0.8, i cannot get sice to popup. (i use a bpm in the supposed OEP address, and i use SuperBPM).

any tips?.
>

the packer problably fools both those progs nicely so your best option is to do it manually

ps: i've your desperate try using Christoph Gabler's GenericUnpacker (hope i idn't misspeled his name :)


Program's memory location in SoftIce (DriverSuite2.6)+ W2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Program's memory location in SoftIce (DriverSuite2.6)+ W2k
PDA

View Full Version : Program's memory location in SoftIce (DriverSuite2.6)+ W2k

d.u.h.a.C.Z.e.k
08-22-2002, 07:40 AM
Hi all,
how can I find out where (in memory) is located program? How I can set BPX on program when I don't know CS segment address?
If program is running and I press CTRL+D SoftIce show me only hal! process...
Jon
08-22-2002, 09:25 AM
well try breaking on a api the program uses ... :) and softice will popup when it will use this api
DakienDX
08-22-2002, 11:11 AM
Hello d.u.h.a.C.Z.e.k !

You should try loading the program with the SoftICE Symbol Loader or with ICELoad.
This way you'll start debugging at the entrypoint of the application, which enables you to break on events taking place before the application is really running. (for example programs checking trial time left at startup)
It's also the only way for command line application which show just a few lines of text and exit again.
arab
08-28-2002, 06:12 PM
I usually solve this problem by switching the address space to the program i want to debug

i.e.

:addr iexplore

then i can set the break point properly

arab


Reversing (Finding WndProc)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing (Finding WndProc)
PDA

View Full Version : Reversing (Finding WndProc)

SilSaLaMaTa
08-22-2002, 03:52 PM
Hi,
How can I find WndProc of a window ?
I'm tring to reverse Yahoo! Messenger , I want to add a button for voice button . I want the talk button always pressed without checking "Hand Free" .
I tried Bmsg and a spent a lot of time , but i didn't find out where Yahoo! Messenger pass the code to the DLL (Yacsui.dll I think). Can anyone help me plz?
Fake51
08-22-2002, 04:47 PM
Lol, finding the wndproc is usually rather easy. This is because all windows receive many different messages, and there's no reason to handle all of them yourself. So the idea is: look for DefWindowProcA and start tracing backwards thru the program flow. You should soon see something like

cmp eax,111h
je somewhere
or
cmp [ebp+??],111h
je somewhere
or
sub eax,100h
je somewhere
dec eax
je somewhere
sub eax,somemore
je somewhere

That's the typical way of checking for messages, and should tip you off.

Fake
SilSaLaMaTa
08-22-2002, 06:30 PM
Hi,
Didn't help . I found the "cmp eax,yyy" and the jumps, eax was the message , but eax was never == 201 (WM_LBUTTONDOWN) .
ZaiRoN
08-22-2002, 06:56 PM
hi SilSaLaMaTa,
the message WM_LBUTTONDOWN not necessarily must be in the wndproc.
if you don't find it, then it means that the proggie doesn't use it.
you can try with the generic wm_command and then try to look for wParam value...

bye,
ZaiRoN
DakienDX
08-22-2002, 07:01 PM
Hello SilSaLaMaTa !

One other try might be to open the application in a Resource Editor, find the ID of the button and break on "EAX=WM_COMMAND" with the high word of "wParam" = BN_CLICKED and the low word of "wParam" = ButtonID. (lParam shouldn't be 0)
SilSaLaMaTa
08-23-2002, 10:46 AM
Hi !
Understood :D
Thanx alot :)
Now I should Work on adding the function .


hardlock maybe?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > hardlock maybe?
PDA

View Full Version : hardlock maybe?

bytexus
08-22-2002, 10:55 PM
The target program i think it uses Lmax licenses(never heard of it).By the way i've seen some references of hardlock.vxd (wich it is instaled on my system root) on a file but i think the program doesn't use this protection(i might be wrong). The program asks for a serial and unlock code or a license key(file) wich i could not find. I,ve fooled the program to think that i have a valid license file but things stoped here.
I stoped looking for serials and began tracing for a check for the license and i managed somehow to start the program but when i use some of the options i get a message with the missing license.
If anyone knows how to deal with this please post. Excuse my bad English.
hobgoblin
08-23-2002, 04:24 AM
Hi there,
What is the name of the program?

hobgoblin
DakienDX
08-23-2002, 11:31 AM
Hello bytexus !

If you've a hardlock.vxd file, the program may use a HASP or Hardlock dongle. You can check this by going to the manufracturer's home page www.ealaddin.com and downloading the HASP and Hardlock SDK files and documentation. Now you can check if the program uses any of the dongle functions.

The program might use either serial/unlock, keyfile or dongle to know if it's registered, or it might use all of them. You can find more information on dongles in CrackZ Archives, link below.

If you get a "license missing" message when accessing some menu entries, chances are high that you've to deal with a dongle.
Antipodean
08-23-2002, 04:24 PM
>I stoped looking for serials and began tracing for a check for the license
>and i managed somehow to start the program but when i use some of the options
>i get a message with the missing license.

This sounds like the options you are trying to select are additional options above the base package, and when you select them it goes back to the dongle to see if this option is enabled.

The menu option may be normally disabled unless the info from the dongle says to enable it, but whatever you did to get the program working makes it enable the menu items.

This could make an interesting route to see what else the dongle may contain in the way of "extra" options for the base program package.
bytexus
08-24-2002, 11:21 AM
The target it is Eplan 5.40 SP1(cad design and stuff). Until now i've found a way to deal with most of the options from the menu because i've found a function (call eax) wich calls most of the options from other files(.dll). Each option from the menus it is linked to another file an i have to patch at least 10 files until now.
I have some questions to make .
1) How can a program restore the changes that i make in memory?(i patch a program in the memory after i quit the option and then i reuse it whitout quit from the prog).
2)is this program protected with hasp/hardlock? I should say that it did'nt seem to me to be very hard to crack. the files are'nt packed/encrypted and i've found a lot of references with the word dongle.
3) it is posibile to run a dongle prog whitout having the dongle?
I want to know if it is another possibility to crack this prog. i,ve found a common point to patch but if i patch it i'll have an illegal operation(there are two functions which are called before running the options from the mens). Im sure that the real license check it is in a single file lclic32.dll(the error messages are here ,and it exports some functions "getlicense", "freelicense")
I'll post the file if anyone want's
DakienDX
08-24-2002, 01:43 PM
Hello bytexus !

When you "quit the option", you exit the loaded module, the DLL gets unloaded. When you select the option again the DLL is loaded unpatched from disk, so all changes are gone.
Dongles don't need to encrypt the whole program. There are two ways of protection. Shell and Library. Shell means there is a wrapper around the whole application which checks for the dongle end decrypts the application when the dongle is found (either with or without data from the dongle). The library method is used when the manufracturer implements the dongle checks himself, either by using an extenal DLL or by linking the dongle check code directly into his application. So he can check the dongle for the allowed options on each menu item selected.
It depends on the dongle and the implementation. If the dongle is just used to say "Dongle present"/"Dongle absent", it will work without dongle. However, if the dongle is used to decrypt some internal data which is needed to run the application, you need the dongle.


Need some clarafication on this tut plz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need some clarafication on this tut plz
PDA

View Full Version : Need some clarafication on this tut plz

Flack
08-23-2002, 04:04 AM
Hey guys,
I was following this tut on generic unpacking and I came to a point that is unclear to me. Its the point where I have to find the IAT start + Size (step 3). The tut says :

"Launch your hexeditor and edit your DUMP.EXE. Search for the following 2 bytes: FFh,25h Look at the address it jumps to on the first occurence (or any other occurence). For example: JMP DWORD PTR [40D2AC]...."

Now, when I search for FF 25 in my dump.exe using my hexeditor, I find many matches. Also, when I find some matches, how do I know what address a jmp jumps to just by looking at the hex of the dump? Does he mean search for FF 25 while in softice? One more thing, what does FF 25 represent and why am I searching for it?

And after that the tut says:
"Now for the length; scroll down untill you see 9x '00' bytes. I'm not sure if 9 is a magic number with this shit but it seems so ;) Furthermore after those 9x00 you'll see stuff that doesn't look like the above anymore."

How can you be sure that after the 9x00's you found the end of the IAT?

Anyway, up to this point everyhting was going fine. Hopefully someone can clear up these probably stupid questions so that I can continue.

Thanx a lot for your help :D,

-Flack

P.S. Heres the link to the tut if someone would like to take a quick look: http://www.woodmann.net/fravia/predator_unpacking.htm

P.P.S. Is the creation of a new IT always required? The reason Im asking is because in one tut, where I unpacked a Neolite packed notepad.exe it ran fine without any need for any IT stuff.
DakienDX
08-23-2002, 10:37 AM
Hello Flack !

I'll try to explain you your questions a bit.
There are two ways of calling imported functions. The are generally equal (expect the call-size) and depend on the programming language you're using.
Imp1:
Call DWord Ptr [00403000]

Imp2:
Call JumpToImport
...
JumpToImport:
Jmp DWord Ptr [00403000]The methode Imp1 starts with FF 15 and calls the imported function directly. Imp2 calls some location, usually at the end of the .code segment, where a jump to the imported function is placed (FF 25).

But one of the two possibilities is (nearly) always present, so you can find your import table in memory, even if the entries of the import table are redirected to some of the protectors own code. In the target, used in the tutorial, FF 25 is used. The IAT doesn't need to start at the beginning of the .idata section, the author asumed this as well. Since there is no one and only definition how the size of the IAT is calculated, I don't see any point in finding 9 times 00h, which is no magic value and I've never seen it. The only thing you can tell for sure is that the IAT ends with 5 times 00000000h (official documentation).

No, the creation of a new IT is not always required. You should read the other topics in this board as well, since it has be discussed many times the last days.


I`m going insane with Tabledit 2.60d
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > I`m going insane with Tabledit 2.60d
PDA

View Full Version : I`m going insane with Tabledit 2.60d

ste_ger
08-23-2002, 11:03 AM
I`ve been reversing the latest version of tabledit (2.60d), a guitar tab demo.
I`ve managed to fix the save limit of only 16 bars, also fixed the ascii, html and abc 16 bar limit for export. Got it saying im the licenced user and all the nags are fixed, print watermark now gone too.

But I`m stuck on the midi export limit, i cant understand why i cant find the checks, cause i thought it would be the same as the other limits.
There are hundreds of bits mislead cracker code in this prog, its taken me over 40 hours to get as far as i`ve got, and another 20 hours trying to find this last check.

I`m going insane!!!
DakienDX
08-23-2002, 11:07 AM
Hello ste_ger !

I'm sorry you're going insane.
But did you just want to tell us you're going insane or do you have any questions?
We have an Off Topic Forum for small talk. ;)
ste_ger
08-23-2002, 11:33 AM
Well, with the previous 16 bar limit checks, I used a combination of lwrite, lread and hmemcpy bpx`s, and did some reversing on the files saved. Got some valuable info from the saved tab files, found the offset in the saved files of the amount of bars in the tab file. Then I searched for all occurences of this to find where in the prog the number of bars got written and traced back from there to get the jump if above 16 bars (ja 10).

But with the midi files it isn`t as easy because I cant find any reference in the saved midi, that shows how many bars have been saved, all the checks are probably done before its saved.

My question is, could someone please give me some advice on what is the best method to use, what bpx would be best to start with.

And how do I set a bpx right after I click save?

Thanks
DakienDX
08-23-2002, 02:21 PM
Hello ste_ger !

You must find the WndProc (already discussed here (http://www.woodmann.net/forum/showthread.php?threadid=3638), please search before asking).
There is a difference between a button pressed and a menu call. So you must break on "WM_COMMAND", where lParam is 0 and the low word of wParam contains your MenuID.
ste_ger
08-24-2002, 04:36 PM
I finally have finished it, had some more probs with the save check, there was another check that couldn`t save a tab of more than 48 bars, fixed that.

And I eventually found the midi export check using Wdasm`s debugger, kept my eye on the Operations display to see where it compared against 10h.

Found a lot of answers searching this forum, I find it easier to learn from other peoples q&a on here than most tutorials I`ve found.

Many thanks
ReaL|sTy
08-27-2002, 06:03 AM
bpx on sendmessagea or dialogboxparama if i haven't forgot......it will drive you to the call of the first nag...... this program authors likes to bother alot nagging and nagging.. some functions are maybe not disable but most of them will give you a nag.... save funtion is disable.. i guess ;) all those nag are coming from just one place counting now.. you need exactly 2 bytes to make it good some additional bytes could count to remove some text like demo... the first start up nag at the beggining replace it with EB06 that's all so the program won't crash, that nag is made with the user32.dll.. ok now go to one of the options that has the program that usually display the demo dialog bpx on postmessage to make sure i will catch, the dialog will be displayed as usual after you press ok Sice will break.. good.. trace until you're on the program CODE stop there.. look the address go to W32dasm or IDA go up.. not down! then you will see lots of call all those call are the demo dialog and actually the one that prevent to save.. you only need to change a Push(55) to a Ret (C3) hex the file now try it :D

RVA's:

0041AE40

0041AF12 <--- there's a Push 68...... change 68 to C3 to remove the demo text at the top. usually will appear if you check the about feature and press ok..

0044A9C0

done!


about the kazaa-encodiing PEX 0.99b
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > about the kazaa-encodiing PEX 0.99b
PDA

View Full Version : about the kazaa-encodiing PEX 0.99b

SOLDIER8514
08-23-2002, 04:17 PM
kazaa 1.7.2 seems to be encoded with an alterate version of
pex 0.99b so i cant disassemble it with w32dasm...

Hope someone can help with this...
www.kazaa.com ? :cool:
nofurs
08-23-2002, 04:24 PM
what tools are you using to unpack?
where are you stuck?
If ya don't provide information show some effort ppl can't help ya.
SOLDIER8514
08-23-2002, 04:58 PM
i ve used procdump , pe-scan and w32dasm

and in order to unpack i tried with the las version of Dex
nofurs
08-23-2002, 05:09 PM
Hi,
if those methods failed you have do it manually.
read this tut on Pex
hxxp://xxx1.lunarpages.com/codeinside/Gallery.html
SOLDIER8514
08-23-2002, 05:14 PM
hxxp://xxx1.lunarpages.com/codeinside/Gallery.html

and http://xxx1.lunarpages.com/codeinside/Gallery.html

doesnt work :confused:
nofurs
08-23-2002, 05:17 PM
x=w
SOLDIER8514
08-23-2002, 05:18 PM
thanks
SOLDIER8514
08-23-2002, 05:22 PM
kazaa 1.7.2 seems to be encoded with an alterate version of
pex 0.99b so i cant disassemble it with w32dasm...

Hope someone can help with this...
http://www.kazaa.com ?

i ve used procdump pe-scan w32dsm and last version of DEX
DakienDX
08-23-2002, 05:37 PM
Hello SOLDIER8514 !

Can't you keep something in mind for just one hour?

You started the same discussion 65 minutes ago in the Packing and Unpacking Forum and replied there four minutes ago the last time.

Do you mind keeping the discussion in one Forum and in the one it belongs to?

And you already heard that you'll get no help without showing some effort.

Veni, Vidi, Vici.
Moved, Merged, Closed.


softice with vmware
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice with vmware
PDA

View Full Version : softice with vmware

dya
08-23-2002, 04:44 PM
hello to everybody,

i recently tried to install softice under a vmware guest OS, and it seems it crashed the virtual machine ... think i'll have to reformat and try again but if anyone could give me some advice on settings, it would be great ;)

cu later.
DakienDX
08-23-2002, 05:25 PM
Hello dya !

I'll give you "some advice on settings".
In the right upper corner you'll find some button between "f.a.q." and "home".
Try hitting it, enter "vmware" and press "Perform Search".
It's not very difficult, trust me.


Unpacking VBox 4.20 Experied
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking VBox 4.20 Experied
PDA

View Full Version : Unpacking VBox 4.20 Experied

Acid_Cool_178
08-23-2002, 06:06 PM
I have the file "C:\WINDOWS\Vbox\Common\vboxt420en-us.vboxlm" So I'll guess that I'm dealing with one VBox protected application.

This thing is, it are experied and now I want to crack it, I have read some tutorials at krobar but i found them in no help, the "bpx ShowWindowA" don't work. I have done the CTRL+N trick in OllyDbg (i'm using that debugger) and coudnt find that import.

Any ideas on how it's possible to crack vbox in ollydbg ?

sorry for this post, it seems quite desperate.. and it is..

Acid_Cool_178
DakienDX
08-23-2002, 07:11 PM
Hello Acid_Cool_178 !

Do you mean "expired" (=trial time over) in your title? If yes, you need to reset it again. This can be done by deleting the "ws*.???" file in your windows\system directory (* is a number and ??? is the extension I don't remember any more) and the "os*.???" (if present) file in your root directory, as well as the windows\VBox directory. You should also uninstall and reinstall the application.

I don't know how to work on VBox with OllyDBG, but there are some tutorials available for SoftICE and TRW. Two dealing with 4.3 (1 (http://www.woodmann.net/fravia/dezzy_vbx43tut.htm) + 2 (http://www.woodmann.net/fravia/tsehp_vbx43tut.htm)) and one dealing with 4.2 (1 (http://www.woodmann.net/fravia/vbox42.htm))

The first 4.3 tutorial is said to only work with 4.3, but I managed to handle 4.2 by modifying it a bit, but I don't remember how any more.
wbe
08-23-2002, 09:32 PM
That was os######.bin and ws######.ocx in the previous versions. Dunno if it's still the same or enough for a trial time reset.

OllyDbg doesn't appear to be the right/best choice since you've got to deal with some encryption/decryption routines. I didn't notice any radical change in different versions of Vbox protection in the past. Read the tuts. That will give you the insight you need.

Good luck.

wbe


Generating IDA .sig files from Delphi units?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Generating IDA .sig files from Delphi units?
PDA

View Full Version : Generating IDA .sig files from Delphi units?

bsod
08-23-2002, 07:38 PM
Hi all.

Is there a way to create IDA signatures from .dcu files?

Thanks for any help,
bsod
DaFixer
08-23-2002, 08:26 PM
Man, use DeDe :D
bsod
08-25-2002, 10:05 PM
Hi DaFixer,

yes, DeDe is a really great tool for Borland apps, and yes, I use it too ;), but I just wondered if it's possible to create those .sig files for IDA. Anyway, thanks for your reply and thanks for creating DeDe, it really rocks!


[SentinelLM] WlscGen.exe: not enough tokens?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > [SentinelLM] WlscGen.exe: not enough tokens?
PDA

View Full Version : [SentinelLM] WlscGen.exe: not enough tokens?

Guybrush
08-23-2002, 07:57 PM
When i try to generate a code i get the error:
Wlscgen
---------------------------
WARNING: You do not have enough tokens to generate this license.
Contact your vendor to purchase additional tokens.
---------------------------
OK
---------------------------What does this error mean?
Is it about the meter count? my meter says:
remaining for regular: infinite and trial 0.. but i'm not trying to generate a code for a trial license.

I patched the exe by following CyberHeg's tutorial, did i miss something?
Guybrush
08-29-2002, 02:29 PM
Ok i found the problem, the meter says Infinite but it's still being compared, and infinite is 0..
So i was able to fix it with a few FFFF's in my dongle emulation, but later i just patched the jge check :)

I also added extra code to the exe so when you generate a code it pops up a nice dialogbox where you can enter your custom vendorid, and also removed the damn delay while generating :D


Setting a breakpoint in Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Setting a breakpoint in Softice
PDA

View Full Version : Setting a breakpoint in Softice

sync
08-24-2002, 02:42 AM
I installed Win2k in a partition for using SI, so I no longer have XP problems. I've read a lot of tutorials but I still can't get SI to break at both the right time and the right place.

I want SI to break on the first instruction after a call to GetWindowTextA and I want it to break after I've entered the password. How do I do that?
dion
08-24-2002, 03:29 AM
thats weird. hmm... try to TRACE the program until the window show up, dont use bpx yet. and then type whatever u want then press enter.

hope that will solve the problem.
sync
08-24-2002, 03:49 AM
It would take forever to trace to that point. But even if I could, I would have to exit SI to enter the password, and then there wouldn't be anything to bring me back into SI.
DakienDX
08-24-2002, 10:01 AM
Hello sync !

I don't think I understand you correctly.
GetWindowTextA does not pop up a box where you can enter something and exits after that.
GetWindowTextA lets you read the text entered in some edit control. It will be called after you entered text and pressed "OK" or "<Return>" or similar.

I think you have a program which executes GetWindowTextA several times before it shows you the field where you can enter something.
If this is true, you should clear all breakpoints, enter the text, set a BPX on GetWindowTextA and press the "OK" button then. You can get to the first instruction after the API by pressing F12 then.
Also check what was read, since some programs read the windows caption before they read data entered in the window.
sync
08-24-2002, 02:35 PM
>>GetWindowTextA does not pop up a box where you can enter something and exits after that.
Yes, I finally discovered late last night that my assumption is not true.

>>GetWindowTextA lets you read the text entered in some edit control.
I also made this assumption, but it's not always true as you point out. What is the point in reading the window's caption?


SOFTICE : need a function for decrypt ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SOFTICE : need a function for decrypt ...
PDA

View Full Version : SOFTICE : need a function for decrypt ...

SOLDIER8514
08-24-2002, 04:47 AM
i m unpacking PeX_v099_Notepad deliver with MUP_PeX_v0.99
under softice and i m on the decryption method :

1234 blablabla
1235 blablabla
1236 ....
1237 .....
1238 dec ecx
1239 JNZ 1234

and it turn on itself 11000 times !!! :confused:
How can i execute this code without xxxxx millions of F8 ?

i cant use : R ECX=0 cause there are many operations on the others regs

Is there a special function for do those 11000 jumps in Softice ?:confused:

Bad Code ! Bad ! :mad:
SOLDIER8514
08-24-2002, 05:04 AM
sorry for this question i known i can use BPM but i m very tired

i m in front of monitors since 3 days and night ,

i m going in bed good night !
evaluator
08-24-2002, 05:14 AM
OK!
BUT CLEAR ALL BPX's before sleeping:)
serkul
08-24-2002, 02:01 PM
maybe just 'g [nextinstructionaddress]'


some thoughts/questions regarding asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > some thoughts/questions regarding asprotect
PDA

View Full Version : some thoughts/questions regarding asprotect

magistral
08-24-2002, 05:01 AM
Last days i've trying to unpack asprotect protected programs.

i've seen that both rv and imprec fails in resolving all the api's (without appling the asprotect plugin). (btw the plugin always fails in at least 1 api and resolves it wrong).

Those not resolved/bad api's are (in most cases) this:

D8133C GetModuleHandleA
D8139C GetCommandLineA
D813B4 LockResourceA
D81358 GetVersion
D81390 GetCurrendProcessID
D81388 GetCurrentProcess
D813C4 GetVersion or FreeResource

The adresses are the pointer in the application that rv/imprec cannot resolve. Ofcourse those addresses are from 1 paticular application, but i've seen that in a lot of applications, the pointer always end in the last 4 values eg: 133C, 139C,....,13C4.
Maybe aspr have some pattern in emulating the api's.

I've seen in aspr that always is 1 pointer = 1 api call.
But, what will happen whan alexey just make a redirection algo that put 1 pointer = n api call's. ?.
Which kind of solutions we will have?, we will must to emulate the apis in the unpacked exe?.
That is a good point to start investigatin, before alexey.

Hey alexey, start to improve aspr, u lazy. ;).

greets.
evaluator
08-24-2002, 05:11 AM
WE WILL...
WE WILL...
ROCK YOU..


Pushing button
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Pushing button
PDA

View Full Version : Pushing button

SilSaLaMaTa
08-24-2002, 12:04 PM
Hi ,
Is there anyway to push two button together in a window ?
or Pushing a button while typing in a edit box ?
I want to make the button always pushed .
DakienDX
08-24-2002, 02:20 PM
Hello SilSaLaMaTa !

When you press a button, a message is sent to the window telling that the button was pressed. The same goes for releasing the button.
Normally the action associated with the button happens when releasing the button. (press a button, move the mouse off the button, release the mouse button and you'll see that nothing happens)

So if you would press two buttons, one of them must be the first, the same happens when releasing them. The first button is released, the window gets the corresponding message, the action associated to it takes place, then the second button is released, the window gets the message and the second action takes place.
So there would be no difference pushing two buttons at the same time or one after the other (expect that you can't press two buttons at the same time).

I'm really wondering why you want to have a button always pushed.
SilSaLaMaTa
08-24-2002, 02:36 PM
Hi ,
There is a Talk button in Yahoo! Messenger , while u push it , u can speak . but while u r speaking , u can't type ! u should keep your mouse on the talk button .
I want to make that button pushed , so I can type (or do something else) :D
Talk button works when u push it ,when u release it , then u can't talk anymore .
DakienDX
08-24-2002, 03:20 PM
Hello SilSaLaMaTa !

Now I understand what you're trying to do.

Find the window procedure (WndProc, discussed lately), check what happens if the "Speak"button is pushed and patch it as you like.
(remove the "button released" function, change the button into a checkbox with a resource editor and modify the old functions to fit a checkbox, modify the button so that it's on if you press it one time and off if you press it an other time, ...)
NervGaz
08-24-2002, 03:24 PM
write a tool that gets the windowhandle that the proc that checks for for the button, and the sends the BN_CLICKED message to the proc like every 5 seconds or something... but that's not really a great solution... best i can think of right now tho
SilSaLaMaTa
08-24-2002, 03:28 PM
hi ,
Greate idea to change the button to a Checkbox , but I can't find the button in the resources :( all of the resources is in Res_msgr.dll , this one is in that too (cause I search for "Talk" in Unicode , and it found in that) , but ResourceHacker and PeExplorer didn't show it .

NervGaz :
u should keep button pushed to talk . so u can't send message to it every 5 seconds or ... BN_CLICKED is not helpful , because the button need WM_LBUTTONDOWN .

Edited :
DakienDX : I didn't find WndProc for Talk button :( I found it for other things (volume control and the others) . there is no defwindowproca . I found somewhere that executes when u release the button , but didn't find what happens when u push the button . When button pushed there is a bar that shows the volume . I found the function that draw the bars , but didn't help :(


Symbol Loader wont work???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Symbol Loader wont work???
PDA

View Full Version : Symbol Loader wont work???

crassy
08-24-2002, 01:10 PM
Hi all.

When I load a prog into Symbol Loader (File/Open module and then Module/Load/Yes) SoftIce is supposed to break at the beginning of the prog, right? Well, mine doesn't... I wonder why?

I use Win98SE and SIce 4.05.334
nofurs
08-24-2002, 01:20 PM
where is the begining? youe question is vague
SilSaLaMaTa
08-24-2002, 02:38 PM
hi ,
maybe u have to change the section flags (charasteristics) .
Ohno2Cracked
08-24-2002, 06:16 PM
I have the same problem with SI. And I changed the characteristics of the starting section to 0xE0000020
(execute,read,write,code)

But it simply doesn't stop at entry. I tried the same with notepad, no success, it runs as a madmann.

BTW, a bpx on a win32 api does work, SI pops up.

background:
I'm hacking a packed program. For that I need to break the program just after it depacked.

note: I even re-installed SI, no success!!!

Anybody ideas???
nofurs
08-24-2002, 06:22 PM
Hi Ohno2Cracked,

Try icedump
crassy
08-25-2002, 10:28 AM
Originally posted by cluesurf
Try icedump

Could you please be more specific?
nofurs
08-25-2002, 11:02 AM
>Could you please be more specific?
RTFM before asking questions
Ohno2Cracked
08-25-2002, 08:27 PM
I already tried icedump :-)

Maybe there is something wrong with the version. I use SI 4.05.334

Has somebody else same problems with this version?
crassy
08-25-2002, 11:53 PM
As i said I have the same problem EXACTLY.

Tried IceDump + IceLoad... Wont even work with Notepad.
nofurs
08-26-2002, 11:56 AM
[>I already tried icedump :-)

>Maybe there is something wrong with the version. I use SI >4.05.334

>Has somebody else same problems with this version?

Ya should check the version before booting to windows

SoftICE 3.23 (Windows 95 / Windows 98 xxxx 1-2)
(C) Copyright 1994 - 1997 NuMega Technologies. All rights reserved.

1096K extended memory allocated for symbols
8K extended memory allocated for back trace
29K extended memory allocated for exports
256K extended memory allocated for display history

and select icedump 3.23
username
08-26-2002, 01:48 PM
Originally posted by cluesurf
Ya should check the version before booting to windows

Wrong approach, you have to look at the Version Info resource in the corresponding ntice.sys and take the version/build info from there. Alternatively 'grep DriverStudio history.txt'. Any other source for version cannot be trusted and should not be relied upon.
Ohno2Cracked
08-26-2002, 06:38 PM
Just before my tennislessons writing this reply :-)

Ok then. I solved the problem with installing driverstudio 2.6. I don't know the problem with SI 4.05.334, maybe it has something to do with the combination SI and Athlon 1800 xp. But once again it's just guessing.

Yes finally I can set breakpoints.

Btw crassy, u can download it via eDonkey :)
serkul
08-26-2002, 10:45 PM
another way to 'step into an application' is possible using lordpe from yoda.

- 'bpint 3' in softice
- use 'Break & Enter' feature in lordpe
- patch the 1st byte of the app back to its original value because it was changed to int 3
Ohno2Cracked
08-26-2002, 10:47 PM
Just before my tennislessons writing this reply :-)

Ok then. I solved the problem with installing driverstudio 2.6. I don't know the problem with SI 4.05.334, maybe it has something to do with the combination SI and Athlon 1800 xp. But once again it's just guessing.

Yes finally I can set breakpoints.

Btw crassy, u can download it via eDonkey :)


BillPro & OllyDebug
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > BillPro & OllyDebug
PDA

View Full Version : BillPro & OllyDebug

cHeCksUm
08-24-2002, 08:39 PM
Quick question. Is there a way to, as in softice, set a breakpoint on for example hmemcpy in Ollydebug? I am working on this target (BillPro) and I have cracked it already (really easy to patch) but to keygen it is more of a challenge for me as I haven't keygen'ed any app before. Therefore I have to follow the methods used in keygen tutes pretty close and the problem is that most are written for softice. As I don't have softice I was wondering if I could achieve similar results in ollydebug? I know how to set normal breakpoints on interesting calls etc. Thanks.

btw I recommend this target (BillPro) for newbies as it's quite a fun target and good learning experiance (well for complete newbies like me anyhow).

btw anyone here know a good board for discussing game protection cracking like starforce, tages, safedisk etc.?

// cHeCksUm
Athlon
08-24-2002, 11:49 PM
Take A Look Here (http://www.exetools.com/forum)
TheSearcher
08-25-2002, 03:57 AM
***Is there a way to, as in softice, set a breakpoint on for example hmemcpy in Ollydebug

You should rtm ;)
****btw anyone here know a good board for discussing game protection cracking like starforce, tages, safedisk etc.?

All protections are discuss in here afaik
cHeCksUm
08-25-2002, 11:46 AM
hmmm. the exetools page seems to be down. I'll try it later... thanks for the info. The manual for ollydebug... never thought of that ;) I'll check the web site. Thanks.

// cHeCksUm
stealthFIGHTER
08-25-2002, 02:46 PM
Originally posted by cHeCksUm
Quick question. Is there a way to, as in softice, set a breakpoint on for example hmemcpy in Ollydebug?
// cHeCksUm

Hallo cHeCksUm,

I don't know in which language is you target coded but try to use alternative breakpoints, such as GetWindowText, GetWindowTextLength, GetDlgItemText (Ctrl+N in OllyDbg).

If it's in Pascal/Delphi these breakpoints won't help you :(.

Regards,
sF
cHeCksUm
08-26-2002, 11:33 AM
@ stealthFIGHTER

Thanks for the help. I will try it. The program is written in C so I guess it should work.

// cHeCksUm


FSG 1.31 Update
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FSG 1.31 Update
PDA

View Full Version : FSG 1.31 Update

bart
08-24-2002, 09:25 PM
http://www.xtreeme.prv.pl/files/fsg131.zip

http://atpa.eu.org/~bart/xt/files/fsg131.zip
Bengaly
08-28-2002, 01:46 PM
dont forget to add a checkbox saying "dont compress resources"
in your next release.
that would be handy - but less compression i know.
Cya


W32Dasm Problems....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32Dasm Problems....
PDA

View Full Version : W32Dasm Problems....

ReaL|sTy
08-25-2002, 04:59 AM
i had a couple of cases that freeze or don't even let dasm start its job. the program is not even packet, sure is crypted with blowfish or something similar borland C++ 1999 written as PEid 0.8 says. IDA seems to work but it won't disassemble the file correctly or complete as i've note. i'm missing something?? are these new trick agains disassembling..? i tried to change some charateristhics sections to E0000020 but it won't make any change.

maybe these are fool cuestions for some of the reversing experts that contribute and participate in this board.. :) but... any tips or help will be great

here's the target:

http://www.choung.net/download/st153.exe

thanks for all who contribute to keep the knowledge alive!!! i want to say that this board is great.. greetings to all of you :D
JackD
08-25-2002, 11:28 PM
It's related to the exports - don't know why though on this target.

Zero the export info in PE header and w32dasm will behave just fine on this proggy! Obviously this is a bad fix for certain RE work like on dll's where this info is needed. Maybe Bratalarm, Cold Coder, Harlequin, or one of the other w32dasm patch experts will come up with a fix for this.

Related to other w32dasm 'hangs', w32dasm only allocates 252 bytes for each export name and this is frequently not enough. If this is increased to say 512 bytes, many w32dasm 'hangs' are eliminated. This can be done by replacing FFFFFF04 with FFFFFE00 in w32dasm.exe at 17 address locations between 0045d3c4 and 0045dbee.
ReaL|sTy
08-26-2002, 01:29 AM
yes my friend i'm glad you reply.. it works.. it took more time disassembling than reversing :) i did in seconds.. only one byte change so time limit and nag is gone.. a tip for those interested... change a Push (55) to a Ret (C3) job done! you have to find where to patch :D there are some other ways to kick this trial.. but i usually like the faster way..
egg
08-26-2002, 08:31 AM
Anybody got any URLs for w32dasm patches/updates ? :)
ReaL|sTy
08-26-2002, 04:21 PM
http://www.woodmann.net/protools


WinXP: SoftICE breakpoints dont work?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WinXP: SoftICE breakpoints dont work?
PDA

View Full Version : WinXP: SoftICE breakpoints dont work?

Vaboc
08-25-2002, 05:37 AM
hi guys.

i have Windows XP as OS and softice from the DriverStudio 2.6.
(Windows XP compatible).

SI work fine. but when i set a bpx GetDlgItemTextA, softice dont popup :( ?

example: i have read a tutorial to sniff a serial for macromedia flash 4. i have confi. the winice.dat.
ok: i must start flash4. then click on "Buy Now" and go to the screen for the serial number. i must tipp a 10 digit number. THEN CTRL+D to go in SI, and now set the brakepoint "bpx GetDlgItemTextA". Now i must leave SI (F5) and press the OK button from flash. Normaly SI must now popup, but dont work! :((

anyone know what is the problem?

2. the bpx hmemcpy dont work :( !? why?
i have cracked in 1998 an win95/98 system, with SI fpr win9x, the bpx hmemcpy have worked.

now i have (read up) WinXP and the softice from driverstudio.
can me anyone please help with this 2 problems, so that i can cracking on this machine? :-)

Big THX and BIG sorry for my very bad english :--))
JMI
08-25-2002, 06:09 AM
Vaboc:

The problem is that you jumped right in for a first post without reading the posting guidelines that are highlighted in red on the first page of this forum. If you had taken the time to do that, as instructed, you would have used the "search" button with a question such as "softice +breakpoints+WinXP" and you would have found that your question has been asked many times before and what answers there are, have already been given many times.

The short answer to your question is that DriverStudio 2.6 simply doesn't work consistently on WinXP. Many people report that their breakpoints don't work correctly and some that they don't work at all. Read the prior questions and answers and then comeback with something new. There appears to be no real solution until Numega fixes the probram and someone releases it on the net or you buy a real copy of the newer versions.

Also, if you did a search of "hmemcpy+WinXP" you would have found that this was a patch left over from dos which was never included in WinNT, which is the basis for WinXP. Therefore it simply doesn't exist in WinNT, Win2k, or WinXP. You will have to actually learn about the API's and find another call that gets you close to what you want. This has also been discussed many times and the "search" button should get what you need, if softice actually worked well on WinXP.

Regards.


IrfanView v3.75 KeyGen source c0de
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IrfanView v3.75 KeyGen source c0de
PDA

View Full Version : IrfanView v3.75 KeyGen source c0de

hack3r2k
08-25-2002, 01:16 PM
Hey there newbies !!!

I know that for lot's of you coding a keygen still remained a
secret as u can't find so easy source codes of them on net ...

Last night while i was coding a keygen for IrfanView v3.75 i thought that it will not be a bad ideea to share with all of you
the source code of it .... Resource file it's not included cause it not represents interest

All i ask is that not to be lame enought to publish it (u know what i mean) :mad:

Any questions ??? (PM me)

So, here it is ... :D

------->If you want to exchange this zip file, do it by email. I cannot have this link or any uploads that contain such stuff<--------

BTW... it's not a good ideea not to upload filez :mad:
esther
08-25-2002, 04:54 PM
Hi Keygens are not allowed
hack3r2k
08-25-2002, 04:58 PM
Hey !

Can u explain me (PM) WTF keygens are not allowed here ?? I damn curious to know why as long as i publish the src only:mad:

bye
esther
08-25-2002, 05:02 PM
coz this is not a warez board
hack3r2k
08-25-2002, 05:22 PM
:)

I didn't said or thought that its a warez board but i know that it's intented for learning new things ... All i do is to let ppl to learn how 2 code a keygen

bye
Athlon
08-25-2002, 05:48 PM
Long Time No See Hack :)
serkul
08-25-2002, 05:49 PM
the url doesn't work for me.
hack3r2k
08-25-2002, 08:30 PM
[
it works dude :)
JMI
08-25-2002, 08:53 PM
hack3r2k:

It would appear that truthfulness is not one of your strong suits. You claimed in your response to esther

[QUOTE]
Can u explain me (PM) WTF keygens are not allowed here ?? I damn curious to know why as long as i publish the src only
[UNQUOTE]

This statement is blatently untrue since your zip file contains BOTH a src file and an apparently working exe keygen file.
When ester informed you that this is not a warez board you again misrepresented the truth by stating that:

[QUOTE]
didn't said or thought that its a warez board but i know that it's intented for learning new things ... All i do is to let ppl to learn how 2 code a keygen
[UNQUOTE]

This is again blatently untrue or you wouldn't need to attach a working keygen with your scr file.

Apparently you feel that your interests are more important than this Board and that you can do whatever you want to, even if it endangers this Board. Obviously you have no real concern for what we try to do here.

With any luck at all this whole sorry thread will be deleted and that is what I will attempt to have accomplished.

Regards.
hack3r2k
08-25-2002, 09:04 PM
Hey !

I did what u asked ! (i removed the exe)

http://sagemboard.web1000.com/IrfanView_v3.75_KeyGen_src.zip (in this pack u can find only the ASM source)

best regards,
.:hack3r2k:.
Woodmann
08-25-2002, 09:07 PM
I'm sorry to have edited some posts.

If I had left the link up, by tomorrow I would have received a phone call telling me that I have 1 hour to remove it or they shut me down. Because this place receives so much attention, the people who host my server REALLY do call me.

Please understand this so that we can keep this place alive.

Peace, Woodmann
hack3r2k
08-25-2002, 09:13 PM
Sorry for any problem created ...

If u think that the link to the src file will also cause problems then remove please the whole thread because will then have no sense...

best regards,
.:hack3r2k:.
bart
08-29-2002, 02:42 PM
Irfan View is shareware??

http://www.irfanview.com/ and look at the main title

"IrfanView - Freeware Graphic Viewer"

keygen for freeware hehe
hack3r2k
08-29-2002, 07:45 PM
Heh !

It's true that is freeware but as long as it have a registration box i said that i wont harm nobody by making this keygen :) and release the src of it ...

best regards,
.:hack3r2k:.:D


MSR value reader for win2k/xp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MSR value reader for win2k/xp
PDA

View Full Version : MSR value reader for win2k/xp

Snatch
08-25-2002, 01:30 PM
Hi guys I am wondering how useful this program would be to you guys. People are using debuggers to find out where a sysenter with a certain eax value is going to end up going. But after spending a little time in NTOSKRNL.exe I discovered how easy it was to use global memory pointers (FFDFF000) to get the tables. The 2 tables are actually stored in NTOSKRNL.EXE and WIN32K.SYS. If you guys want the program I will post it. I am hoping to find a way to get the named entries for the entire table as in what API call(user32, kernel32, gdi32, etc) invokes it. Discovering the names of the target calls is unfortunately not possible as the symbolic information I have was not thorough enough and only had some names. Or IDA is being flakey. We will see though. So if you guys want it I will post it its quite small. Its developed completely on XP and I am pretty sure it should work on 2k as well but I would need testing.

Snatch
username
08-25-2002, 08:37 PM
Maybe check this out: http://www.cmkrnl.com/arc-newint2e.html from 1998.
Snatch
08-26-2002, 08:02 PM
Thanks a million. Now I scrap that project. That was precisely what I wish I had previously. Thanks again.

Snatch
f0dder
08-26-2002, 09:19 PM
I hope snatch isn't trying to take credit for stuff I wrote (and on 2k, not XP). In case anybody is interested, here is a KMD for reading arbitrary MSRs, and a loder that uses it to read MSR 0x176, aka the SYSENTER_EIP_MSR. About a days work, since it's my first KMD. Shouldn't crash, but as always, sync.exe.

Have fun.
username
08-27-2002, 11:23 AM
Originally posted by f0dder
Shouldn't crash, but as always, sync.exe.
Be careful as trying to access invalid MSRs will raise a GPF - I could not find where you were handling that case. For a proper implementation you can take a look at Winice and IceDump's /RDMSR and /WRMSR commands.
f0dder
08-27-2002, 05:01 PM
Ah yes, seems like I deleted the exception handler - I had it in some test code, forgot to add it to the final.
Snatch
08-27-2002, 08:56 PM
Nah f0dd I am taking a completely different approach. I never need to call rdmsr. You can use pointers in global memory to track down the tables the two of them actually. Then I found out its really simple you disassemble win32k.sys and ntoskrnl.exe and theres a table of functions in both and those are the msr values for given eax values. Very simple. No need to bother with using global memory tricks to get the pointers to the tables. 0xFFDFF000 contains useful stuff though. Check the DDK for more :).

Snatch
Snatch
08-27-2002, 08:58 PM
f0dd your program is useful to get the actual MSR value though :). However if you just want to find out where a certain eax value lands no real need to use a debugger. Just disassemble the aforementioned files. And find the tables they arent hard to find either. I believe 0 is the start of ntoskrnl.exe and 0x1000 is the start of win32k.sys table. Anyway actually debugging the resultant call is messy. I just figured out what I was doing wrong ;).

Snatch


"Patch program" functions removed in IDA Pro?!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > "Patch program" functions removed in IDA Pro?!?
PDA

View Full Version : "Patch program" functions removed in IDA Pro?!?

dELTA
08-25-2002, 08:32 PM
I just noticed that the submenu called "Patch program" under the edit menu of IDA Pro is removed in version 4.21! These are the functions that e.g. let you enter your own assemly code into the file, and custom data bytes and so on.

If I open the exact same database in version 4.17, those options are there as usual, but they're nowhere to be found in 4.21. :(

I looked in the IDA help file and update notes, but couldn't find anything about it. They can't just have removed this, right?! It's a very handy feature, also for many other purposes that cracking.

Does anyone have any idea whatsoever about how to access these functions in current versions?

(and yes, I searched on this board too, and found nothing about it)
_Servil_
08-25-2002, 09:24 PM
greetings,

don't know how it works. perhaps some editing of config files gets it back.

h**p://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=1;t=000343
Iwarez
08-26-2002, 06:24 AM
You can edit the config file to get it back...
dELTA
08-26-2002, 12:16 PM
Yep, I found it after reading on their support board, thanks!

But it's still a bit ominous that they have removed it like that I think, and also they give pretty evasive answers to people who ask about it on their board, so I'm not sure what's up with that.

I really hope they don't remove it completely in a future update, that would be really stupid. :( It's a really useful feature.
dELTA
08-18-2004, 04:59 PM
Ok, in the recent versions it seems to be even worse. :( You can still get those menu items back the same way (see below), but now when I try to produce a diff file after having done my patch, the diff file always turns out blank anyway!? (I normally make the patch inside IDA, then produce a diff file, and then feed this diff file to a special patcher I have written, which takes these diff files as input)

Has anyone else experienced this problem? Any solutions or suggestions to what might be the problem?

And also, for documentation purposes, here is the procedure to get the patch menu items back, discussed in the posts above:

1.
Open the file "idagui.cfg" for editing.
2.
Search for the term "DISPLAY_PATCH_SUBMENU".
3.
If it exists, change its value to "YES" instead of "NO", and if it doesn't exist, add the following line to the file:
DISPLAY_PATCH_SUBMENU = YES

Btw, is there a smarter way to export a patch you have made inside IDA, than the one I describe above? If I remember correctly, the "Create exe file" did not include my patches when I tried earlier... :-/
dELTA
08-18-2004, 05:09 PM
Ok, I found some discussions about it here:

http://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=1;t=000498

http://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=1;t=000547

and it actually seems to be a bug in IDA 4.5.

The problem is that I cannot find that plugin they are talking about in that thread, and my IDA license expired before 4.6 was released, so I cannot check myself if is has been fixed in that one (it's not certain though, because those bastards are being so incredibly reluctant to touch anything that's related to the patch function due to the "bad things" it can hypothetically be used for, even if it involves fixing a bug in their own program it seems). :(

Could anyone who has access to a (legal) copy of IDA 4.6x check if this problem is resolved in that version?
sarge
08-20-2004, 03:24 PM
The "Patch program" option DOES exist under the "Edit" menu in IDA 4.6.0. It has three choices:

Change Byte
Change Word
Assemble

All three have ellipses (...)

I've never used it, so I don't know how well it works.

Sarge
dELTA
08-20-2004, 05:14 PM
Do you mean that these items are present in the edit menu without having to edit the config file in version 4.6?

And could you maybe just try to patch one or a few bytes in the middle of the code segment of some random disassembled file in IDA, then save your IDA database, and then use the "Create DIF file" from the "Produce" item of the "File" menu, and see if the produced file turns out empty or not? That would be really great, if you have a few minutes to spare.
sarge
08-21-2004, 11:56 AM
Umm..Yes and No.

If you run IDA, without specifying a target program, you will get the Patch menu option. If you later load a target, or start IDA with a target, you will NOT get the Patch menu.

The reason has to do with the way IDA starts. When IDA loads, it reads the IDA config script. At this point, the Patch option is enabled. When IDA loads a target (either thru the File menu or as parts of its Command line), it again reads the config script. This double read is necessary for IDA to both set itself up, and to set up the disassembler for the appropriate processor. After that, it reads the USER config script. That script has the command that causes the Patch option to be turned off; that's why you have to edit it.

Once the Patch option is enabled for usage with a target file, you can then patch a program. I chose a simple 2-byte jump command, and used the Patch/Word option to simply reverse the two bytes with each other. Then, using the Dif command, produced a small text file with the ".dif" extension. Opening the file in Notepad showed three lines; the first was the obligatory "...created by IDA..." announcement, followed by two lines of a before/after description.

As an FYI, I don't believe I had to do a database Save inbetween.

Hope this helps.

Sarge
dELTA
08-21-2004, 12:33 PM
Ok, thanks for the confirmation! I'm glad to hear they fixed that bug in 4.6.

When I do the exact same thing in 4.5, I also get a dif-file containing three lines, but rather as follows (i.e. containing no data about the patch):

This difference file is created by The Interactive Disassembler

target.exe
sarge
08-21-2004, 01:46 PM
One minor correction:
The second cfg IDA reads is the IDA GUI config file; the USER config file (if it exists), is third.

If I get a chance, I will try the same thing in 4.5.

Sarge
dELTA
08-21-2004, 02:53 PM
That would be great, to rule out any possible differences in our procedures.
sarge
08-21-2004, 06:53 PM
My 4.5 "fails" in the same manner your does.

Sarge
dELTA
08-21-2004, 06:55 PM
Ok, excellent to have that settled once and for all, thanks!


Aspack trouble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspack trouble
PDA

View Full Version : Aspack trouble

Soldat
08-26-2002, 12:22 PM
Hello!!

I have trouble with following program

AD Picture Viewer Version 2.4.1

http://www.abroaddesign.com/picview/picview.zip

I tried to unpack this stuff

(OS win 98)

I think I found OEP

It was 4DF6A8 (found pattern 61,FF,E0 with Soft Ice)

something like

push ebp
mov ebp ,esp
.....
.....

Rebuilded IAT with Revirgin ,found 4 unresolved APIs

after manually resolvation they were

GetProcAddress
GetModuleHandleA
GetCurrentProcess
GetVersion

all in KERNEL32.dll

I did generation of IAT with DUMPED.exe
put new OEP with PE-Editor by Yoda (after dumpfixer)

Try to run but there was crash
then I try to compare the pattern of original program and dumped.exe

the difference was at address
4069DC ret

after it the original program returns in 4xxxxx area
and the DUMPED.EXE
returns in 7xxxxx where after following instruction

cmp ( I've forgotten what ) it jumps to KERNEL and
message

This program performed ilegal operation and will be closed

apears

I beleive this is some of protection checks but I don't know which

because I don't have to much experience

Thanks for help

Soldat
SilSaLaMaTa
08-26-2002, 01:19 PM
Hi Soldat
I found OEP at 4DfB98 (Version 2.5 build 231).
After rebuilding the IT , the OEP was like this :
push ebp
mov ebp,esp
.
.
.
call 000451D74
Call [4E5B70]
.
.
.

I got an error while executing this line . I ran the original
file and in softice I trace up to that line .
Then d 4E5B70 . 4E5B70 -> xxxxx -> ... -> 4DF470.
so I changed "Call [4E5B70]" to "Call 4DF470" .
and the Prog runs normally :D
serkul
08-26-2002, 01:59 PM
and the Prog runs normally

as long as you can be sure that [4E5B70] contains 4DF470 in any case (on any system)
hobgoblin
08-26-2002, 02:11 PM
Hi there,
Maybe you got some of the imports wrong or messed up. I used Revirgin and it came up with these unresolved imports:

21 000E61E4 011CE494 0000 ?????? to_Resolve
22 000E61E8 011CE8E4 0000 ?????? to_Resolve
26 000E61F8 011CE944 0000 ?????? ??????
63 000E629C 011CE8E4 0000 ?????? to_Resolve
92 000E6318 011CE954 0000 ?????? ??????
107 000E6354 011CE900 0000 ?????? ??????
112 000E6368 011CE494 0000 ?????? to_Resolve
114 000E6370 011CE8E4 0000 ?????? to_Resolve
125 000E639C 011CE938 0000 ?????? ??????
127 000E63A4 011CE964 0000 ?????? ??????

After tracing in Softice I found them to be:

21 Getprocaddress
22 Getmodulehandlea
26 Getcommandlinea
63 Getmodulehandlea
92 Lockresource
107 Getversion
112 Getprocaddress
114 Getmodulehandlea
125 GetcurrentprocessID
127 Freesreource

When I traced in Softice it looked like that the import at 92 is Getcurrentprocess. This is wrong. The call here have a ret 0004 instruction at the end. This indicates that this is a "dummy" call. When I checked in the resolved list in Revirgin, it looks more "natural" to change it to Lockresource.
At 127 the import seems to be Getversion. But the same goes here, only that it looks more natural to change it to Freeresource.

That's it. After changing the code as described by SilsalaMata, it runs perfect. To top it: It is also registered.:-)
Try to enter a code via the About screen, you'll see what I mean. And the 30 day period is now "hardcoded" into the program, so it never epxires.
The only thing left to be removed is the trial text.

Hope this helps,
hobgoblin
Soldat
08-27-2002, 09:39 AM
Yes I've made it but I have question for you

Hobgoblin or SilSaLaMaTa

Yes the crash was because IAT ,because I didn't do as well

now would you explane me how did you find that

26 000E61F8 011CE944 0000 ?????? ??????

was

Getcommandlinea

then

107 000E6354 011CE900 0000 ?????? ??????

Getversion

and

125 000E639C 011CE938 0000 ?????? ??????

125 GetcurrentprocessID

because when I traced them with tracer in Revirgin they appeared

to be

GetModuleHandleA
GetModuleHandleA
GetVersion

then I checked the addresses of them

(011CE944,011CE900,011CE938 ) wirh Soft-Ice

and found the same as with Revirgin (by the way I use v1.3 of Revirgin)

When I did as you Hobgoblin,when renamed in the same way

everythink was good (also I changed call according to

SilSaLaMaTa)

At least the protection ( I mean window that apears before

starting program about key entering hasn't wanished)

I didn't check time limitation because there is still several days for demo

And also if you want Hobgoblin ,explane me again about those

fake APIs where did you see them to be

LockResource

FreeResource

my Revirgin didn't rename anythink ,maybe is something wrong

with me

Thank you both
hobgoblin
08-27-2002, 08:05 PM
Hi there,
Nice to see that you resolved some of your problems.
Instead of me repeating and rewriting a lot of stuff, you can easily get all the answers you need if you search this board for the information revealed to all of us by +Splaj, Kayaker and a couple of others devoted to reversing the Asprotect protection.
I can't possible imagine I have something new to add to what they have shared on this board.
Just search using the names I just gave you, and you will find a lot of stuff, maybe somehow fragmented and spread out over several posts. But I can asure you: By digesting that information you will get a very detailed understanding about Asprotect.

good luck,
hobgoblin


Decompressing and saving UPX compressed section to a file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Decompressing and saving UPX compressed section to a file
PDA

View Full Version : Decompressing and saving UPX compressed section to a file

egg
08-26-2002, 12:53 PM
Ive just written my first decrypter (for LameCrypt :D), and am now trying to write my first unpacker - UPX seems a good one to start with (im using 1.20) as it has no protections, small decompressor etc. (Yes i know upx.exe has a built in decompress option, but im doing this for learning so that doesnt matter). Ive ripped the decompressor out ok so I can call it and it compiles fine, but im having troubles setting it up at the start -- what should the registers be?

For example, it starts out like this:
pushad ;save registers
mov esi, 0100D000 ;which is the very first address in the disassembly
lea edi, dword ptr [esi+FFFF4000] ;what does this do, and why?
push edi
or ebp, FFFFFFFF ;why?
jmp 01011672
nop (x 6)
:01011672
mov ebx, dword ptr [esi]
sub esi, FFFFFFFC
adc ebx, ebx

.... down to ...
popad
jmp 01006420 ;jump to the (now decompressed) original program

All I want to do (and i'll do it even if it kills me!) is decompress the compressed section and save it to a file. I don't want to rebuild the exe or anything like that, all i want to do is decompress and save the decompressed bit. Can anybody help me on what I should be doing before calling the UPX decompress algorithm?

Any help would be very much appreciated, I really want to learn how to do this but it's going to take about ten years longer without help from you guys! :)

Cheers,
Egg
DakienDX
08-26-2002, 07:59 PM
Hello egg !

I don't really see your problem here. The decompression code works regardless to which value the registers are set at the beging of the decompression procedure (of course ESP=00000003h would be bad ;) )

As you already wrote, ESI is the start of the compressed code. EDI is the address where the decompressed code is written to. These are the only registers which must be set at the start of decompression.

I can't tell you why EBP is set to "-1" before decompression, but to understand that you must also study the compression. Since I doubt that you're planning to do this you should just take it as it is.

If you just want to save the decompressed section to a file you don't even need to take care about the OEP.
egg
08-27-2002, 03:56 AM
Ok thanks, it seems Im calling it correctly :)
But one last problem -- it seems to be decompressing too much, and it then GPF's with a memory read error. Any idea what I should be looking for in regards to how she gets out of the loop/knows when its at the end and can stop decompressing/call the OEP ?
DakienDX
08-27-2002, 03:19 PM
Hello egg !

I can only think of two possible reasons for your problem.
You have not copied all the compressed data out of the file. (including appended 00h bytes at the end of the "UPX1" section)
You have to few space in your destination buffer. The data is compressed, so it'll become much bigger when getting uncompressed.
You'll need enough space, so you could take 10x the size of the compressed data or simply execute UPX -l <filename>, take the size shown there and add a few extra bytes.
egg
08-28-2002, 05:35 AM
Thanks very much for your help Dakien, nobody else seems able or willing :(
Ive 99% finished it, it's just this last bit that's strange :). And if I can get this working just once with UPX, it'll open the gate for me to attempt other unpackers, so I'm not going to give up on this one!

Im definately reading the compressed section correctly, including 0's at the end, LordPE verified that the section I had taken was the right one, and 100% intact. I'm also allocating a string that is 10 times bigger than the compressed section, so space shouldnt be an issue (especially as it's just notepad.exe compressed from 50k to 28k).

sPtr = STRPTR(sData) ;sPtr points to sData, the compressed data
sDec = STRPTR(sChunk) ; sDec points to the allocated area to decompress to (just nullchars)
;now set up some registers so that theyre the same as UPX
! xor eax, eax
! mov edx, &hFFFFFFFF
! mov ecx, &h01010101

;now starts the UPX algo ...
! pushad
UnUPX:
! MOV ESI, sPtr ;esi points to sData
! MOV EDI, sDec ;edi points to sChunk
! PUSH EDI
! MOV EBP, &hFFFFFFFF
! JMP LOC_010118C2 ; (i used TMG Ripper to get the algo)
...
... down to ...
...

LOC_010119E8: ';Ref: 010119DF
! CALL DWORD PTR [ESI+&h000011DB0]
LOC_010119EE:
! popad
And then, I write the contents of sChunk to disk (which should now contain the decompressed section). Sounds like flawless theory to me :)

It compiles fine but crashes with "0x00000000 referenced memory at 0x00000000. The memory could not be 'read'"

Any ideas?
evaluator
08-28-2002, 08:09 AM
hello!

>>mov esi, 0100D000 ;which is the very first address in the disassembly
>>lea edi, dword ptr [esi+FFFF4000] ;what does this do, and why?

IF you will do little analyze, you will FIND:
At start ESI used by UPX for keep UPX-packed section address,
then at EDI it calculates unpacked-section start address.
Don't be lazy, debug & understand.

UPX also changes content of code section for relocation purposes.
So dumping directly after unpacking is NOT right idea in 90%.
You must wait, when UPX also finishes relocating in CODE section.
Or unpacked will crash..
egg
08-28-2002, 08:43 AM
At start ESI used by UPX for keep UPX-packed section address,
then at EDI it calculates unpacked-section start address.
That was obvious from after my first post :)

Ive done a lot of debugging and analysis, everything looks right so im not too sure whats wrong :(, that is why I come here for help, it's a last resort but I don't know anybody else anywhere who is capable of helping with this specialist area
evaluator
08-28-2002, 08:52 AM
So last step for help you can this:

pack & upload somewhere all files and I will look.

OK?
DakienDX
08-28-2002, 09:29 AM
Hello egg !

The part where the code craches doesn't belong to the unpacking code any more, but to the import handling. The call is a call to LoadLibraryA and since your import table will not be at the location the call points to, it will fail.

Since you wrote you just want to decompress the section and not rebuilt the .EXE, you're finished after the plain unpacking. The unpacker will end right after the Loop instruction. If you put you're Popad there and delete the code after it it'll work fine. You don't need to set EAX, ECX, EDX at the start of the unpacker. Their values will be set by the unpacker before they're used.
egg
08-28-2002, 09:57 AM
Dakien, THANK YOU! :) Youve hit the nail on the head -- I had originally ripped the whole thing down to popad, but trimming it down to the loop instruction as you suggested and putting the popad after that worked perfectly -- the decompression worked perfectly and because im no longer running code that didnt need to be executed, im not getting any GPFs.
So, my problem solved, and I can now go on to learn how to unpack other unpackers, hopefully without having to bother you guys :)
The door is now open!


debugs debugger's int handler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > debugs debugger's int handler
PDA

View Full Version : debugs debugger's int handler

dion
08-27-2002, 03:23 AM
lately i'm facing problem with debugging TRW2000 with softice. i want to trace the int1 or int3 process from TRW. first, i try bpx in the int_handler from TRW... but no luck, softice wont popup. then i try to use BPR and softice hang up :( then i use bpm, but my computer reboot instantly >( then... i try to BPM not in TRW, but in a loaded program [ie notepad] and BPM at an address just right before BPX from TRW, still... cant reach the int1/3 routine :(

me... wondering, how debugger author debug his int_handler? if anyone know how this thing done, please help me...

just another question: when TRW loaded, the idt for int1 and int3 was replaced for a moment. how the replace process achieved? do the previous one was 'chained' or not?

thanks
Kayaker
08-27-2002, 06:56 AM
Hi dion,

I took a quick look at TRW in memory and noticed both the int01 and int03 routines use VxDCall 'Get_Cur_Thread_Handle' very early, so why not set a Softice breakpoint on that instead? Type 'VCALL <partial-name>' in Softice, and you can get the spelling right before setting the bp.

Breaking on a system API should be more reliable than setting a straight bpm in an ISR in vxd code in what is likely a locked code segment, it's possible that Softice might not break on this. You could try SuperBPM.

TRW looks to use a regular IDT hooking routine, using the SIDT command to load the IDTR Register and store the IDT base address and limit from the IDTR register. Check the Intel docs and search this board for previous threads on how to the hook the IDT.

The previous int handlers may be chained to if TRW doesn't want to handle the interrupt, but for INT 1 and INT 3 I would think TRW would not want to pass control to Softice, or Icedump, or Frogsice, or the default Windows handler, or whatever the old interrupt handler was when the IDT was hooked.

Cheers,
Kayaker
dion
08-27-2002, 11:30 AM
wee... thanks Kayaker :cool:

hope it'll work like u said, i'm gonna trying now.
[yAtEs]
08-27-2002, 12:04 PM
you may find this handy for debugging softice its self

-----------------------------
http://www.woodmann.net/protools/files/debuggers/iceclimber.zip

IceClimber by trapflag. 28.VI.2001.
IceClimber 1.0 (3K).

This vxd enables you to set bpxes inside SoftICE's code itself, so you will be able to trace it more comfortably
-----------------------------

regards,
yates.
Kayaker
08-27-2002, 07:30 PM
Interesting you mention that [yAtEs]. I was going to bring up the Iceclimber trick as well, then realized Dion probably wasn't trying to break into Softice code itself. But it is an interesting trick by itself. It's actually an easy patch in Softice you can keep permanent without using the Iceclimber vxd all the time. Basically its the code below in winice.exe:

:C003AD24 cmp eax, ds: off_0_C000BC95 ; starting address of WINICE
:C003AD2A jb short loc_0_C003AD34 ; patch to bypass error
:C003AD2C cmp eax, ds: off_0_C00F1EBC ; ending address of WINICE
:C003AD32 jbe short loc_0_C003AD36 ; if bpm set in winice code
:C003AD34 clc
:C003AD35 retn
:C003AD36 push esi
:C003AD37 mov esi, offset aBreakpointsNotAllowedWithinSoftice ; "Breakpoints not allowed within SoftICE"
:C003AD3C call sub_0_C001DE15

If your breakpoint address is set within winice code then you get the error message and the bpm never breaks. Dion, you should check if TRW may do something similar.

Tracing in Softice code is actually a lot of fun and probably the best way to learn how a real debugger works <that others try to imitate ;> It's also a good way to try to improve Softice. If you look at winice long enough you might discover that virtually *every* function in SI can be accessed and traced through disassembly or code through 1 function - the BCHK Boundschecker "Backdoor" interface.

There's enough information here for an essay, which I was thinking of writing one day ;-) , but it's basically related to the SI commands you can execute through your own code using the old:

mov ebp, 4243484Bh ; 'BCHK'
mov al, 0Eh ; Execute a SoftICE command
mov edi, offset SICommand ; ascii of command, i.e. 'SICommand db "HBOOT", 0'
INT 3

Softice intercepts the INT 3 and checks if the command is a valid one it wants to use. There are only 38 of them allowed, most of them just basic information commands, hboot is really the only "active" command allowed. It's interesting how the check is made. The ascii command used is identified, and a single byte bitmask value is retrieved from a table, this is then checked with the BT command against a long bitmask string. The bitmask string is hardcoded into winice and can be found by searching for the dwords immediately after "BCHKWPV.table r".

Here's the start of the BT section where it's decided where to branch to, to process whatever command has been sent via the BCHK interface OR typed into the SI window :

====================================
C00813FD BT DS: DWORD_C0081B07, EDX ; check byte against bitmask
C0081404 jb short loc_C0081412
C0081406 mov esi, offset aInvalidCommand ; "Invalid command"
C008140B call sub_C00818F5
C0081410 jmp short loc_C008141B

C0081412 push ebp
C0081413 call ds: off_C0022DC7[edx*4] ; jumps to *every* Softice command

The value of EDX is important here, it is the single byte bitmask value for the SI command you selected. This value is used as an offset to a jump table, which itself jumps to each and every Softice code routine that you might want to explore in winice.exe. The bitmask (edx) value for every function can be found in a table beginning at hex offset 00054288 in winice.exe. Hmmm, I guess I have to give an example here..

----------------------------------------------------------
Let's say you wanted to explore in code the I1HERE command, which enables whether Softice will break on an INT 1. Searching in winice.exe you'll find the ascii / bitmask table:
000543FF 49 31 48 45 52 45 00 51 I1HERE.Q

The "0051" is the bitmask value for this particular command. Plugging this value into EDX you can trace directly to the code associated with it:

I1HERE == 51h == EDX

C0081413 call ds: off_C0022DC7[edx*4]

(C0022DC7 [edx*4] == C0022DC7 + (51h*4) == C0022F0B)

:C0022F0B dd offset sub_0_C002926F
which leads to
:C002926F mov esi, offset dword_0_C002142F
:C0029274 call sub_0_C001F612
:C0029279 jb short loc_0_C0029288
:C002927B call sub_0_C0026808
:C0029280 jb short loc_0_C00292A1
:C0029282 mov ds: byte_0_C003509D, al

And the last line is the I1HERE ON/OFF flag. If al=0 I1HERE is OFF, al=1 I1HERE is ON.
------------------------------------------------

I found this so handy I made a module I use when writing vxd code to automatically set the flag to I1HERE ON, so I can use "INT 01" in code to debug it.

Well, I guess that's the snippet for the day :D

Regards,
Kayaker
JMI
08-28-2002, 02:10 AM
Kayaker:

Looks like you got caught in the "oops, I forgot to turn off smilies" :D :D Great stuff as usual.

Regards.
Kayaker
08-28-2002, 03:00 AM
Doh!

Thanks JMI. Fixed. Now the only smilies are the real ones :p

Cheers,
Kayaker
dion
08-28-2002, 11:21 AM
If your breakpoint address is set within winice code then you get the error message and the bpm never breaks. Dion, you should check if TRW may do something similar.

i had trying to BPX/BPM at vxdcall and no respon from SI. also, i had trying to make it with TRW itfself, but no luck too, ie i dont see CCh in bpx location from SI screen. actually, i think i'm agree with what Hwoarang said in another thread that i should use BPR instead BPX. its just bcoz the int3 was has been replaced by TRW, so SI wont break in any way. but if it true, strange... TRW not respond to it.

i thought that maybe debugger cant put a bp when itself using int3 as a door to break in, bcoz it'll cause a forever loop [if we can do int in ISR] or it'll trigger something bad that always make my computer to reboot. then i thought its not softice which dont want anybody to be able to trace within [especially ISR area], but bcoz its not safe to do so from debugger itself. mmm... maybe u can verify this, Kayaker.

virtually *every* function in SI can be accessed and traced through disassembly or code through 1 function - the BCHK Boundschecker "Backdoor" interface

i've heard this for long time, but now i'm really curious... how *exactly* si put this BCHK, when it is set? cant be before CCh, can it?

btw, nice snippets... more complete than mine ;)
[yAtEs]
08-28-2002, 12:49 PM
core blimey Kayaker, you know how talk dont ya ;-)
wish i knew someone like you in rl to talk rce for hours
with heh, :eek:
Kayaker
08-29-2002, 03:01 AM
Heheh, Yates, I would quite enjoy a brain picking RL conversation over a pint with you. Your vxd tuts were very useful ;-) I have had the pleasure of speaking real life with one fellow reverser, and while enjoyable it feels really weird at first saying some of these reversing terms out loud ;) Far cry from the black screen of Softice.

You're right Dion that you can't trace or set breakpoints in Softice if TRW has control of the INT 1 and INT 3, I wasn't really thinking when I suggested breaking on the system api, essentially the same thing. However, you might be able to play with it manually and use one against the other. This is just an idea and may not work.

OK, Softice uses INT 1 for single step tracing, INT 3 for breakpoints. Your problem is that you want to break into the TRW interrupt handlers for these same INTs to trace the code in action. But of course the Softice functions for tracing and breaking are now gone. Therefore in theory, if you could "turn off" the TRW INT 01 you could write in an "INT 1" in code in the *INT 03* handler routine for TRW as a way of breaking. Just as you would normally do with I1HERE ON.

Also, if you could "turn off" the TRW INT 03 handler you could also write in an "INT 3" in code in the *INT 01* handler routine of TRW with I3HERE ON. This make sense?

To do this you can manipulate the IDT table after TRW has loaded, replacing the TRW INT 1 or INT 3 routines with the original Softice handler addresses. You may know this but, Ctrl-D into Softice and get the IDTBase address by typing "IDT" in SI. Display this address in WORD format. Each entry in the IDT is composed of 2 Dwords specifying the segment and offset of the current interrupt handler, followed by the next entry. Here's an example from my notes:

; Each entry in the IDT takes up 2 dwords and is laid out in a 'table' format:
; 016F:80003008 1390 0028 EE00 C000
; ( screendump of my IDT entry for INT 5 gate at 0028:C0001390 )

; 1390h are bits 31...16 of the address
; 0028h is the Target Segment Selector
; EE00h is a bunch of flags we don't care about
; C000h are bits 15...0 of the address

; The entry for each interrupt can be found at
; [Base address of IDT + Interrupt number * 8 bytes]
; So for this example for INT 5, the offset is 5*8=40

After TRW hooks the interrupts, you can change them back to the default Softice handlers when you want. I often do this when a nasty crackme (or my own code crashes, lol) doesn't unhook the IDT after exiting. Prevents a lot of system hangs doing this...

Now, if you had hex patched TRW with an INT 1 (01CDh) at the very beginning of the INT 03 handler routine, then removed the TRW INT 01 handler address from the IDT table and replaced it with the original Softice one, IN THEORY the Softice INT 1 should break (I1HERE ON) inside your TRW INT 03 handler when it is triggered. All fine and good up to this point.

Since single step tracing is now enabled in Softice, you should be able to trace as usual right? Well, actually no, because you've frupped up the TRW code and can't replace the bytes since the "INT 1" will have been stepped over. So what you can do is...

-------------

Depending on how determined you are, there is another way you could do this without having to patch anything into TRW I think. You know VxDCall Get_Cur_Thread_Handle is called very early in both your TRW interrupt routines. You can hook the calls with VMMCall Hook_Device_Service and you get your very own interrupt procedure to play in.

Load TRW and get it set up, manually replace the original Softice INT 1 handler. Then you start your Hook app which will trigger when TRW uses the Get_Cur_Thread_Handle call. In the HookProc interrupt routine you set an INT 1 at the start of your code. Softice should break and you're in tracing mode. You can now call other vxd services as well and possibly discover the CONTEXT structure of TRW at the time of its interrupt or whatever else you might want.

You end the HookProc with
jmp [OldServiceAddress] ; Chain to previous hook

Now the trick is getting back to TRW code from your HookProc. If you have single step tracing enabled in Softice you should be able to trace it back to the original code (and discover a lot of system code while doing it). You could only do this in one interrupt routine though, the other you'd have to do something like setting breakpoints instead of tracing.

Somewhere on this board I've posted a working SystemHook1.zip example of how to set a system hook using VMMCall Hook_Device_Service. You just change the service you want to hook. In this case it would be Get_Cur_Thread_Handle. Get_Cur_Thread_Handle returns the handle in EDI and uses Flags, you can set up a stack frame at the start of your HookProc to access the stack, maybe find the return address in TRW...

There is one caveat to this, and that is that you've got a hook procedure operating within an interrupt. I'm not sure if this could cause some unexpected reentrancy problems. It likely would actually, but you could deal with that in code since you're only doing this for debugging purposes.

If you just want to see the TRW code run you might be able to fake it by copying the handler routines into your own code and see how they operate. Rip out the handler routines from the TRW vxd if you can and stick them into your own innocuous hooked interrupt, like INT 6 or something. It might crash or hang but you can at least see how Get_Cur_Thread_Handle and the other code operates. Not sure exactly what you're trying to do.

Hope this helps,
Kayaker
dion
08-29-2002, 10:42 AM
lotsa thanks for ur nice and bunch reply, Kayaker ;) it takes several hours headache reading these stuff [just kidding :p].

but, i get it already now, by changing a byte in TRW ISR... it generates a GPF/fault [i dont remember what fault, maybe coz by locked page?] and popup the softice screen right in TRW ISR code. what i'm want to do was tracking TRW ISR stack frame, bcoz i remember that i've read somewhere that TRW has a bug in handling segment from one of fs/gs/??.

There is one caveat to this, and that is that you've got a hook procedure operating within an interrupt. I'm not sure if this could cause some unexpected reentrancy problems.

i dont know if i'm wrong, but have u ever wonder how debugger msg loop would looks like, Kayaker? i just get info from disasm, that shows that this msg loop was reside in these ISR. so lotsa thing like call vmm services and the other vxd call was executed in this loop. that somehow wierd and i felt that i'm missing something important here, but i dont know what is that. mmm... if u know about this msg loop [for debugger in general], could u give just a little pseudocode? i already post this matter in another forum, but like always... gets no answer :(

Somewhere on this board I've posted a working SystemHook1.zip example of how to set a system hook using VMMCall Hook_Device_Service

mmm... lately i'm wondering how to do that in TRW plugin, and yeah! i could compile it successfully ;) but not test it yet, just compile. and related problem with this Hook_Device_Service is... is there any reverse function for GetVxDServiceOrdinal() macro? besides, looks like TRW [and softice too maybe] was listing this VCALL ordinal from hardcoded string... how terrible! :( just thinking what would happen if theres 'version conflict' of vxd service stuff here?

regards


Question about 1mcrypt with cro for fle*lm v7+?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question about 1mcrypt with cro for fle*lm v7+?
PDA

View Full Version : Question about 1mcrypt with cro for fle*lm v7+?

SeanC
08-27-2002, 08:41 AM
Hello,

For implementing cro, have someone the experience about it.

1. Why 1mcrypt a single fe@ture got different results time by time when cro is used?
2. As I examine makekey, lc_cryptstr just carry site_code (type, data, keys, pubkeysize, pubkey, pubkeyinfo1, pubkey_fptr, ..., crokeys). pubkey should be able to find in d@emon, but what about prikey? After call lc_cryptstr, license key is already generated. There is no prikey info for lc_cryptstr. Does another function "lc_crypt" do that?
3. Default key size is 12, and 16/22/31 when cro is used. Does makekey go like:
step 1, Use different glseed to make SIGN.
step 2, Fix key size 15 of lmprikey from 12.
step 3, Carry new SIGN and lmprikey for RSA encrypt.
Does it correct?


IAT rebuilding for unknown packer ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IAT rebuilding for unknown packer ??
PDA

View Full Version : IAT rebuilding for unknown packer ??

SilSaLaMaTa
08-27-2002, 10:17 AM
Hi ,
There is a prog at : ftp://ftp.douran.com/packages/isputil/download/ispengine.zip
FileName : ispengine.exe

PeID didn't recognized what packer it is .
I unpacked the prog (OEP at 46AE5C) , found IAT at 75000 ,size = 99C.
Some imports are not found , and I can't found them using softice .
I tried ImpRec switch loader , but the prog doesn't run .
I can't find out what is the error , can anyone help me ?
SilSaLaMaTa
08-27-2002, 12:07 PM
I traced the prog , it seems that it has some kind of section checking
, I don't know , it's comparing section names and a lot more that I can't understand :(
snaker
08-27-2002, 02:49 PM
ispengine.exe - 0x47d1cc
ispengine_srv.exe - 0x474c7c

I think these are the correct entrypoints...I got correct import tables corresponding to them using ImpREC as well...

About the packer, it is a modified version of ASPack, the OEP jump code is same, the outer decryption layer seems a bit different. Maybe be a derived packer...
SilSaLaMaTa
08-27-2002, 06:07 PM
Hi snaker

your OEP for ispengine.exe look strange .
my dumped file at 47d1cc bytes are : 60,E8,46,00,00,00,00,00,68,...
It's not like the oep ... I don't know , I put a BPM , sice didn't break .
I think it's packed twice with it's packer (ASPack) .
I can't fix it . if your file is working , plz send that to my email (SilSaLaMaTa@Yahoo.com)
, I'll work on your file to see the diffrence .


a question to kayaker about OEP finding
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > a question to kayaker about OEP finding
PDA

View Full Version : a question to kayaker about OEP finding

r00t
08-27-2002, 02:06 PM
I'm having problems in finding the OEP in an asprotect packed application WITHOUT using /tracex.
I've readed a post from some guy regarding a Kayaker "essay" about unpacking G6 ftp server.
1st set a bpx on virtualalloc
then press f5 5 or 6 times
2nd set bpx on getprocaddress
then press f5 5 o 6 times, in the first time sice pops up with getprocaddress, f12 4 times and we are in the IAT loop.
the set a bpm x on a call after the loop.
now trace the OEP from there (less time to wait). Anyways /tracex is too much time for a pentium I 200 Mhz.
How can i do to reach the OEP BY HAND from that location?. I get lost and cannot reach. Aspr makes a lot of SEH's tricks.
btw, the signature trick (61,ff,e0) dont works.
Im dealing with aspr 1.2[NewStrain], as PEid 0.8 says.

Greets and thanks.
foxthree
08-27-2002, 02:37 PM
Hey r00t:

That "some guy" happens to be me :D. I remeber that article by Kayaker very distinctly as I learnt from that initially. BTW, look for +SplAj guru's post on finding OEP (I think) in New Strain (rebased OEP Code).

Signed,
-- FoxThree
snaker
08-27-2002, 02:58 PM
r00t, why not use the signature byte trick?

Well most of the times if an application is protected with ASPR, it is compiled in an HLL ... author is too damn lazy to code in ASM and make his own protector! :)

Well then read some tut for it,I think someone must have written it...
Better even the Generic OEP Finder included with PEiD uses this trick with some other tricks...so maybe it could give you the correct OEP...

Infact I am quite startled that maybe no one mention about it...Either it dont work...or no one uses it!

Which one is it? :p
hobgoblin
08-27-2002, 04:29 PM
Hi there,
Just out of curiousity: What program are you working on?

regards,
hobgoblin
egg
08-27-2002, 06:19 PM
Does anyone have a URL for that essay/tute by Kayaker ?
JMI
08-27-2002, 08:15 PM
egg:

You really need to learn how to search. It will help you find most of what you want. If you had gone to the "Search" button at the top of the Forum and entered "G6 ftp server" you would have found a thread by that title from 01-08-2002. Actually the thread has several long comment by Clandestiny, relaying information from Kayaker about asprotect.

You will find the thread here:

http://www.woodmann.net/forum/showthread.php?threadid=2482&highlight=G6+ftp+server

Learning to help yourself will make you a better reverse engineer.

Regards.
r00t
08-27-2002, 09:39 PM
thanks for the reply, some g.., sorry foxthree ;).
i cannot found those post from +splaj about new strain OEP finding.
I guess new strain dont have a new form of OEP hiding, but the my main interest is some generic tip/technic to avoid those SEH's tricks and trace throught to reach by hand the OEP.

thanks and greets.
JMI
08-28-2002, 01:19 AM
rOOt:

Let's go through the simple steps ONE MORE TIME. Go to the "Search" button. On the left side is a place to enter a topic. On the right is a place to enter a member's name. In the "right" button enter "+Splaj". When the window pops up, look down at the number 11 listing. It is of a thread titled "New/Latest ASProtect Strain." This is probably the one you want.

Now, another GOOD suggestion. Go back to the "Search" button and again type "+Splaj" in the "right" hand button. Now read and copy EVERY thread where +Splaj discusses how to attack Asprotect and/or SEH. An even BETTER suggestion would be to copy EVERY thread where he has made comments.

The easest method of saving the thread in a condensed and readable format is to open each thread, one at a time, go to the bottom of the thread and click on the "Show Printable Version".

When the window opens, click on the button on the "right" hand side of the top of the page, which says "Show all (number) posts on one page." This will give you all of the thread, especially if it is more than one page.

Then go to the File menu in your browser and click on "Save As" and give it a title. The default title always starts with "Rce messageboards Regroupment" and then the title of the Thread. I usually just remove the "Rce messageboards Regroupment" part and keep the original title of the thread for reference.

The second step is to make some form of organization for your record keeping of these threads so that you can find them again. As one example, I have a "unpacking" directory and within that directory, I have a subdirectory titled "ASPROTECT" to organize all things I've downloaded about this protection. Then it's easy to go back and review.

Since the search with "+Splaj" wont give you ALL threads about Asprotect, you could go back and do another search with "asprotect" in the "left" button. Then you will get ALL threads discussing asprotect, even if our resident unpuxing God didn't feel the need to post a reply.

Again you could save any of those threads which contain information that you deem useful and you will then have your own library of great stuff about the evolution of the tricks, and removing the tricks, in this protection over time.

The same process can be followed for other topics of interest. My own collection is approaching 10 GB and growing every day.

Regards.
evaluator
08-28-2002, 08:11 AM
JMI!
you are terrible flamer~:)
ONE idea for you:
Make some standart FORM for this kind Q & copy+paste.
But I think, you should OPTIMYZE CODE SIZE:)
evaluator
08-28-2002, 08:29 AM
Hello, r00t1

Softice for w9x already conteins Not-yet-defiated-Weapon: BPR
So use readonly-BPR for code section & enjoE.
For ASSpr, readonly-BPR will break when ASSpr checks code-section.
Disable temporary & when chacker routine will finish, enable again.
I assume, you know about so jumps in code section before OEP...

Hello, snake!

If I right understand, you are about searching OEP in dump according to compiler type.
Yes, it is old good idea & last time I always use & test it successfully.
BUT IN FACT, unpacker must ANYWAY search for OEP in debugger..:(


help with this crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > help with this crackme
PDA

View Full Version : help with this crackme

chitech
08-27-2002, 10:51 PM
hallo everybody

I have a problem when I try to use "bpx getdlgitemtexta" on this crackme (attached). When softice break I press F5 and it breaks again (name/serial). After that I press F11 once to go back to the caller.

Normally it looks like this:

push xxx
push xxx
push xxx
push xxx
call User32!GetDlgItemTextA
...
...

But now it shows something I don't understand. Please guide me.

how to save/dump the assembler-code in softice into a tekst file?

Thx

Chitech
ZaiRoN
08-28-2002, 11:01 AM
hi chitech,
i have take a look to the crackme.
it uses a method to make your life hard while you are stepping the code.
there are many useless instruction like jmp, call, pushad/popad, pushf/popf between the real instructions used by the crackme for the name/serial check.
when you are stepping, remember that all the instructions between a pushad-popad and pushf-popf block are completely useless so don't take a closer look to them :)

here is the first 3 useful intruction:
402D1E: test eax, eax
402D59: jnz 40309E
403186: mov esi, 40701B
use them in order to understand how the flow proceed ;)

the crackme seems not much difficult (i haven't reverse it yet...) but the problem is the stepping and the fact that you'll find instructions like:
shl ecx, 18
shr ecx, 18
that are here only for kidding you.
how to save/dump the assembler-code in softice into a tekst file?the command /dump of icedump is what you are looking for but imho don't help you too much in this specific case.
use ida, it's optimus for this subject; you can see all the code used by the crackme...

anyway i suggest to put this thread in the mini project area and see if anyone wants to join you in this project.

hope it helps!
regards,
ZaiRoN
chitech
08-28-2002, 11:41 AM
thx u.....now I see the light ;)

I will put this thread in the mini project area and continue my reversing there :)

Chitech


Remove a VBox 4.3 protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Remove a VBox 4.3 protection
PDA

View Full Version : Remove a VBox 4.3 protection

Onit
08-28-2002, 09:18 AM
Hi,

I'm a newbie in RCE. I try to remove a vbox 4.3 protection from an app using Dezzy/DoD tutorial - "How to manually remove a vbox 4.3 protection", but the dumped file didn't work (generate a page fault).

After a bunch of trial & error (and crash), I finally get a running app, simply by changing the option in Procdump -> 'rebuild import table' instead of 'rebuild new import table'.

Anybody can tell the difference of those settings ?

My second question, the new exe is bigger than the original. Is it ok? or maybe there are a lot of unuseful code in the app which could be removed ?

Thanks
DakienDX
08-28-2002, 09:48 AM
Hello Onit !

The difference between the two settings is described in the ProcDump manual.
* Rebuild import table.

Detect import table using heuristical criterea and fixup the import ta-
ble if found.

* Full Import rebuild. (=rebuild new import table)

Detect import table, generate a new import section, generate import
function names & ordinals. There is a BIG chance that generated PE runs
perfectly ;). In order to be 100% perfect, RUN PROCDUMP32 From Target di-
rectory in this specific mode.A VBoxed .EXE is always packed, so the unpacked .EXE will be bigger. There will be probably also much useless code in the unpacked file, but if you're a newbie to RCE, as you say, you shouldn't care much about it.
Onit
08-29-2002, 05:56 AM
Hi DakienDX,

Thanks for the explanation.

I read the manual eventhough I didn't understand the details ;). I'm just curious why the dumped file didn't run correctly when I use the full import rebuild, as described in the tutorial : "Under imports, select 'rebuild new import table', and according to the manual : "There is a BIG chance that generated PE runs perfectly". So I thought I missed something during the dumping process.

Anyway, thanks again.


delphi for newbie help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > delphi for newbie help
PDA

View Full Version : delphi for newbie help

m.albert
08-28-2002, 07:04 PM
Hello after unpaking it successfully (aspack) I am trying to reverse engineer an application written in delphi (registration by serial, no name).
Spent hours looking at code but could not find a cmp or test which looks useful.
Strings appear to be encrypted. looks so hard.
Can you advise a good tut or an easy method that I could use.
Thanks
Michael
Bengaly
08-28-2002, 07:30 PM
u tried DeDe ?
if not, than try, else just use SoftIce..
Manko
08-28-2002, 07:46 PM
Use Dede!
It's an awsome tool!

You can view all the forms and when you find one that seems to fit ie. proper caption or buttons or something, you can view the code that executes after you have typed in serial and pressed the button. The calls in the listed code will have descriptive names souch as:

* Reference to: controls.TControl.GetText(TControl):System.String;

:P

If you double click on a call it will also be dissassembled...

You can export references to w32dasm, ida and softice! :)

I tend to take an adress after the gettext and break on it in softice... Works great! :)

Mind you, I'm just interested, can hardly even call myself a newbie cracker... If you need more info, just ask! :)

/Manko
stealthFIGHTER
08-29-2002, 01:15 AM
Hello Michael,

try some tutorials on my page (Delphi oriented).

Good luck,
sF
bestobest
11-25-2004, 08:29 PM
Went to your page clicked on re and said page cannot be displayed
dELTA
11-26-2004, 06:01 AM
It might have something to do with the fact that this thread is over 2 years old... :rolleyes:
JMI
11-26-2004, 09:11 AM
What? You mean to tell me that people don't guarantee that their web pages will be hosted at the same URL "forever" so that I can find anything I want without doing any serious work? Oh what a cruel world. :eek:

Regards,
tdennist
11-28-2004, 10:38 AM
Have you tried to see if Google caught a cache of it before it came down, whenever that was?


W32Dsm Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32Dsm Question
PDA

View Full Version : W32Dsm Question

Aerzan
08-28-2002, 09:51 PM
It never used to do this, but whenever I try to search for some text and it finds it and I double click on it, it spreads out some of the words like this all the way accross the screen, and doesn't show the text i searched for:

* R E F R E N C E

and

* P O S S I B L E R E F R E N C E

and stuff like that...It never used to do that before...

How do I stop it from doing this :(

Aerzan
Bengaly
08-28-2002, 10:14 PM
mabye the font u use is bably show the opcodes?
try diff font..
Aerzan
08-29-2002, 01:17 AM
I don't know. I also tried redownloading it and it was still the same...but it wasn't like that before.
Aerzan
08-31-2002, 04:22 AM
Ok, I recently downloaded W32DSM89 and everything was great! Then I opened it up and dissasembled an exe file, and searched for some string text, and the string text appeared like this:

* P O S S I B L E S T R I N G R E F R E N C E :

and stops like that on the end of the page instead of like this (How it used to be):

* Possible String Refrence: *String here*

And this really bugs me because it's harder to read, and navigate around W32DSM. If this has happened to anyone before, could you please help me to fix this? If you don't know, can you tell me a link where you downloaded it from? Thanks

Aerzan
esther
08-31-2002, 06:22 AM
Hi,
Don't post twice in the forum.
Your problem should be solve by changing the fonts and size.

Click menu Disassembler,Font,select font,change the size of the font,ok.Click menu Disassembler again and Save default font and done.
Aerzan
08-31-2002, 01:46 PM
Sorry about posting twice.

I have tried multiple fonts and sizes, but the letters still seemed to be spaced apart. I tried Arial, with multiple sizes, then Times New Roman, again with multiple sizes, Tahoma, etc... Could it be a problem with the settings?
JMI
08-31-2002, 02:16 PM
Aerzan:

Just a wild thought here, but since you didn't say, maybe this is part of the problem. You have said that the program used to work correctly and that you downloaded it again, which means that you reinstalled the one you downloaded, but you didn't say whether you just installed OVER the old version, or uninstalled the old one and installed the new one.

Sometimes programs have DLL's and other parts that are stored in other places or just use DLL's from Windose to run parts of their programs. If you didn't "uninstall" you wouldn't necessarily remove "all" of the old components of W32DSM89. Try "uninstalling" then reboot and then try installing again.

Second possibility is to consider if you installed any "other" programs between when W32DSM89 worked correctly and when it didn't. One or more of any other programs you installed may be interferring with its processing of fonts, since W32DSM89 itself does not create it's own fonts, other that it gives you the option to select a font that comes from Windose and its directories.

One last crazy though. Did you actually click the "Save Default Font" after you selected the "new" font? If you just selected and then closed the dialog box, it doesn't save the change. I'm assuming you already knew that, but didn't see it in your post.

Anyway, it way too early where I am and these are just some thoughts to try before I am fully awake. Good luck.

Regards.
Aerzan
08-31-2002, 05:02 PM
JML:

It worked! Thanks! I uninstalled it, rebooted, and then reinstalled it. and btw, yes, I did click on Save Font after I chose a new font every time. Thanks for all your help!


ollydbg help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ollydbg help
PDA

View Full Version : ollydbg help

m.albert
08-28-2002, 10:14 PM
Thank-you to nervegaz for the previous answer.
I have 2 additional questions.
I'm trying to debug with ollydbg and I get these 2 messages while tracing (whereas the program runs to the end when I click on it without debugger)

Exception OEEDFADE use shift F7/F8/F9 to pass exception to program

Access violation when writing to 019ACAF6 use shift F7/F8/F9 to pass exception to program

I can get through the first by typing shiftF7 although I dont know if it is ok to do so. On the other hand the program is stuck after the second error message and Shift F7 doesnt help.

What do these messages mean ?
How can I correct them?
Thanks and Regards
Michael
JMI
08-28-2002, 11:07 PM
m.albert:

If you want to ask an additional question on a post you have already made, you don't need to start a new thread. At the top and bottom of the window are buttons which reads: "New Thread" and "Post Reply." If you use the "Post Reply" button, your second question will be in the SAME thread, instead of starting a second one on the same topic.

Regards,
stealthFIGHTER
08-29-2002, 01:19 AM
Originally posted by m.albert
Thank-you to nervegaz for the previous answer.
I have 2 additional questions.
I'm trying to debug with ollydbg and I get these 2 messages while tracing (whereas the program runs to the end when I click on it without debugger)

Exception OEEDFADE use shift F7/F8/F9 to pass exception to program

Access violation when writing to 019ACAF6 use shift F7/F8/F9 to pass exception to program

I can get through the first by typing shiftF7 although I dont know if it is ok to do so. On the other hand the program is stuck after the second error message and Shift F7 doesnt help.

What do these messages mean ?
How can I correct them?
Thanks and Regards
Michael

Keep pressing Shift+F9 until the program run again. If this error still occurs try to restart the debugging session (Ctrl+F2).

sF
Aimless
08-29-2002, 01:55 PM
You might understand that the program you are debugging could be having a single step/trace check...

Alternatively, it could also be checking on breakpoints...

or, the fact also remains that Ollydbg is simply not able to take it...

Are you sure its not packed/crypted ? Even "SECTIONS" of it, I mean??

Have Phun, Always.
Fake51
08-29-2002, 02:06 PM
The first is rather typical for olly, it's most likely an exception raised OUTSIDE the program, say in the kernel for instance. The second one seems to reside within the program, and could be everything from a bug to a debug check. Locate the last one, see why it happens, and try to step over the command at hand without executing it, or perhaps redirecting the code flow.

Fake
m.albert
08-29-2002, 08:12 PM
actually it is a program that was initially packed with aspack and that I have unpacked manually.
Michael


Armadillo protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo protection
PDA

View Full Version : Armadillo protection

incapable
08-28-2002, 10:34 PM
Target file dvdidle : dvd region-free

This file is armadillo protect.

Has someone any idea to defeat this.

How can i unpack this target.

Thanks,

Incapable (in France)
Js
08-28-2002, 10:53 PM
No doubt the easiest way is armkiller's excellent dumper and rv to rebuild imports. Contrary to popular opinion I think you can use a tool like armkiller's and learn from it if you are prepared to put in the work.
regards
JMI
08-28-2002, 11:12 PM
incapable:

These Forums are equipped with "Search" buttons which appear at the top of the Forums. Go to the search button and enter "armadillo" on the left side and you will find many threads about how to unpack armadillo. Read those threads and you will learn alot about what you need to do. You should ALWAYS attempt to help yourself BEFORE you ask someone else to do your work for you.

Regards.
incapable
08-29-2002, 12:48 AM
JMI,

I search in the forum before to post my question.

As you can see, except the armkiller tool, any really good solution to defeat armadillo 2xx.

So, i seek info to learn about.

Regards,

Incapable (in France)
evaluator
08-29-2002, 10:38 PM
OK!

Now IF_you_search_was_unsuccessfull, make Question!

"I not understand this..there..How to.."
JMI
08-29-2002, 10:59 PM
incapable:

It is obvious that you DID NOT read the contents of the Forums on unpacking armadillo, as there are TWO FULL PAGES of threads with this subject, many, if not most of which are about unpacking this protection system. There are several LONG threads which discuss the issues in detail.

Since you have NOT shown that YOU have done ANY work, it would appear that all you want is for SOMEONE ELSE to crack this program for you, or give you a tool to do the job and that is not what is done here.

As the Forum Guidelines will inform you, if you had bothered to read them, if you want help, you need to do your own research, make your own attempts, and when you get stuck, come and show your work and where you are stuck and someone will most likely attempt to guide you to the right path to an answer.

Regards.
incapable
08-31-2002, 12:19 AM
Je vous répond en français, parce que sincèrement, vos réponses me gonflent.

Oui, j'ai regardé les différents sujets des forums, mais je n'y ai trouvé aucune réponse pertinente.

Oui, j'ai essayé plusieurs choses, comme virer les anti-sices, Wdasm, patcher en mémoire, softice et setprocessworkingsetsize, push 0/1.

Je m'étonne, que personne n'essaie de cracker armadillo en mémoire.

Oui, je sais encore trouver un bouton search.

Non, je n'ai pas à justifier de ce que j'ai fais ou pas fais comme recherche sur ce programme. Vous avez une drôle de représentation de l'entraide et de la communauté.

You definitely don't have french spirit.

Incapable.
JimmyClif
08-31-2002, 01:57 AM
Originally posted by incapable
Je vous répond en français, parce que sincèrement, vos réponses me gonflent.

Oui, j'ai regardé les différents sujets des forums, mais je n'y ai trouvé aucune réponse pertinente.

Oui, j'ai essayé plusieurs choses, comme virer les anti-sices, Wdasm, patcher en mémoire, softice et setprocessworkingsetsize, push 0/1.

Je m'étonne, que personne n'essaie de cracker armadillo en mémoire.

Oui, je sais encore trouver un bouton search.

Non, je n'ai pas à justifier de ce que j'ai fais ou pas fais comme recherche sur ce programme. Vous avez une drôle de représentation de l'entraide et de la communauté.

You definitely don't have french spirit.

Incapable.

:D

I answer you in french because honestly your answers are making me mad. edit: mad, pissed off, enraged

Yes I had a look a a lot of subjects in the forums but I couldn't find a satisfying answer.

Yes, I tried many different approches including getting rid of the anti-ice's, wdasms, inline memory patching, SoftiCe and setprocessworkingsetsize and push 0/1.

I'm stunned that nobody ever tried to crack Armadillo in memory.

Yes, I do know where to find the search button.

No, I do not need to justify what I've done or did not do concering research on this app. You have a weird representation of "helping" and a community.

You definitively don't have french spirit. edit : couldn't resist typing that one again.

-----------------------------------------------
Incapable,

Essaye de donner plus d'infos. Ne reste que la et dis "Feed me Infos" mais essaye de generaliser tes idees de ce que tu veux faire en detail. Puis demande une question.

Salutations,
JimmyClif
-----------------------------------------------
Now : I crawl back under the stone I came from :D
Kayaker
08-31-2002, 02:45 AM
Salut Incapable,

Please try to understand this, then we can continue with the proper spirit that already exists on this board, IF it is used right. Help is a precious commodity, and this is une ecole, a place of study and theory.

No one is questioning your ability or anything else. But read your own post back to yourself. The only information there is

Target file dvdidle : dvd region-free
This file is armadillo protect.
Has someone any idea to defeat this.
How can i unpack this target.

These 4 lines indicate that you are looking for a quick crack answer, nothing more. You've offered nothing back to the community in a spirit of return for your request, nothing to base a specific answer to, no starting point for discussion for other people to learn anything. We just don't do that on this board, you must understand this. If you want to discuss specific parts of the protection, the code, some point of trouble you come to when doing it yourself, then you are free to do so, if what you are really trying to do is learn.

It's a hell of a big topic, and there HAS been work done before on the protection. How can you expect a complete answer when the question is not even complete? So at what point are you stuck at? Oh, you haven't started yet? Come back with some code, a problem, a desire to learn, something, anything! and maybe you can just get what you're after.

You guys just don't get it do you? What a waste of what we could have with the talent here...

Kayaker
evaluator
08-31-2002, 10:09 PM
Kayaker!

I dld thiz prog & what I see in License.TXT!

>4. REVERSE ENGINEERING.
>You agree that you will not attempt to reverse compile,
>modify, translate, or disassemble the SOFTWARE in whole or in part.

What you think about? Is it valid?

I simple assume, guy called "You" is not me:)
_Servil_
08-31-2002, 10:32 PM
HI,

your quoted paragraph in similar form is a part of every EULA.

If it's valid? You must decide. ;=)

http://www.woodmann.net/fravia/legal.htm
JMI
08-31-2002, 10:37 PM
You've got to ask yourself the question: "If I didn't buy the software, am I bound by the license?" The answer would appear to be that if one is going to break the law by having and using a pirated copy of the software, the license doesn't matter much either.

And to our musician friend: It is always true that "you" can't be "me." And who would want to be "me" when they could be "you." :D

Regards.
evaluator
09-01-2002, 08:22 AM
Ok, I discovered who is "You"!
incapable <- is "You":)))))))

incapable, sorry guy! "You" are so unlucky ;(;

But some info I give you.
1. this prog not uses CopyMem.
2. For anti-SoftIce-debug trick you can use ICEDUMP or FrogIce
3. you can use ArmKiller(it dumps and discovers OEP)
4. finally you need resolve ImportTable (6 unresolved IT-funcs manage yourself)

BTW, this prog silently exists on my PC. (I have not DVD)

****
Now about that license term!

It can be used for only NOT PACKED-PROTECTED programs!!
Because we are not so stupid for start "compile, modify, translate, or disassemble"
packed-protected prog! We make dump from memory & ...
However dump is NOT that distributed program.exe about worries autHor & License.<-DOT

Cry now;)
BenJ
09-01-2002, 08:13 PM
Hi all,

armadillo again : it's only a simple question about one point I can't understand with arm:

I'm now able to unpack targets manually, no problem. For IT rebuilding, the best I found is : find the routine which changes the API pointers : in this routine, at one moment you can see where arm stores an array with all the original API names... dump it and rebuild manually....

There is only one thing : for one target (not on others I tried), the code section was "dump protected" : some pages attributes where "page_readexecure_guard". The problem is : I have never been able to find how arm sets these attributes. I thought about virtualallocex or virtualprotectex, but never found these api called with the "page_rx_guard" attribute.

In fact it's not a problem, caus this antidump protection does not stand in win98 for the same target, only in win2k.... don't know why... But I would like to know how arm does this ! haven't found anything related to this on the web... guess I missesd smthing...any idea ??


Encryption modes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Encryption modes
PDA

View Full Version : Encryption modes

stealthFIGHTER
08-29-2002, 01:52 AM
Hello all,

can somebody explain me when (or which of them) encryption modes are used? (ECB, CBC, OFB, CFB, OFBC).

I saw this encryption modes in some kind of cryptos (IDEA, Blowfish...). Please if can somebody provide short! description of these enc. modes, it would be cool :).

Thanks,
sF
DakienDX
08-29-2002, 08:58 AM
Hello stealthFIGHTER !

I'll try to explain what I know about them.
ECB: Basic encryption mode for block-ciphers. The encrypted block is just stored as it is. You can start decryption anywhere in the encrypted data (of course on a block-size boundary). Same input data results in same output data. You can insert/delete blocks without affecting any other blocks.
CBC: All blocks are chained together. You Xor the original data with a random value (must be present for decryption), encrypt it and take the encrypted block as random value for the next encryption. This way blocks with same data look different. If you delete/insert a block, you'll be unable to decrypt the next block.
CFB: Block-ciphers can only work with blocks. So if you want to encrypt some data smaller than the block (for example one byte), you've a problem. So you take a random value again (needed for decryption), encrypt it, Xor the data with the leftmost byte of the encrypted random data, Shl the random value by one byte and put the Xored byte at the rightmost position (this is the encrytped byte). You can see that no decryption routine is used here. The byte is decrypted by Xoring it back with the leftmost byte of the random value. If you insert or delete a byte, all data after that byte cannot be decrypted any more.
OFB: Similar to CFB, but I can't tell you exactly how it's done, since I didn't understand it correctly. It uses the original random value somehow for encryption every time, not the encrypted. It is said to be unsecure if you don't use it on the whole blocksize instead of just one byte, which makes CBC possible again.
OFBC: Sorry, but I've never heard of that.
cyberheg
08-29-2002, 10:03 AM
It's amazing what a search on google can do, some people here could learn of that.

Here is a more detailed discription on some of the modes:

http://home.ecn.ab.ca/~jsavard/crypto/co0409.htm

Don't forget to also lookup CTR mode which you didn't mention yourself. This is a very popular mode for AES and personally I think AES-CTR would be a good replacement for a stream cipher like RC4.

// CyberHeg
DakienDX
08-29-2002, 01:30 PM
Originally posted by cyberheg
It's amazing what a search on google can do, some people here could learn of that.Hello cyberheg !

I'm really impressed how much this document informs about the OFB mode. If I start counting the letters it will probably have about 20% more letters and about 20% less information than I wrote.

I also find it very interesting how the OFBC mode works. It is described there in exactly zero letters. And not a single mention of CTR on the whole domain.

And it is extremly easy to understand the Base26 number system they use all over the place there. I find it much better than any stupid hex/binaray examples or even a bit of explanation.
stealthFIGHTER
08-29-2002, 08:13 PM
Cool DakienDX :),

this is exactly what I want to see. Again thank you.

Originally posted by cyberheg
It's amazing what a search on google can do, some people here could learn of that.
// CyberHeg

Hello CyberHeg,

of course, I did a search on google and I'm sure there is more info. about enc. modes than DakienDX wrote, but I don't need it (as I wrote 'short! description' will do) so detailed.

Anyway thank you too for the link.

Best regards,
stealthFIGHTER
cyberheg
08-29-2002, 09:32 PM
I'm sorry DakienDX if you don't find the document useful. I could say the same thing from my point of view about your post but I leave it to the reader and their opinions.
However I like personally reading facts from books and documents rather then just believe in everything written on a messageboard (no this is not a offense).

As for CTR mode again it's easy to find the needed information with a websearch.
Here is a doc on AES-CTR:

http://csrc.nist.gov/encryption/modes/proposedmodes/ctr/ctr-spec.pdf

// CyberHeg
DakienDX
08-29-2002, 09:47 PM
Hello cyberheg !

This wasn't meant offensive from my point of view, just ironic.

It was just the document you linked to. You wrote "some people here could learn of that" and posted a document not telling any more than I wrote already.

And the Base26 number system in the examples made the whole thing completely confusing.

Of course I didn't invent those cipher modes, I read about them also, not when posting, but some time ago. I know how ECB, CBC and CFB work and I know that I haven't understood OFB when reading it.

Entering "ECB CBC CFB OFB" into Google gave me 14000 results, adding "OFBC" gave me 0 results. So I was quite sure I was not the only person who never heard about it.

So I decided to be a bit ironic. :D
mike
08-30-2002, 03:51 AM
You can also check out my favorite reference, Applied Crypto:
http://www.unixqi.com/crypto
DakienDX
08-30-2002, 07:38 AM
Hi mike !

Thank you for the link. I know that page.
Well, I actually didn't know that page until you posted it here, but I have the same page as .CHM file.

Strange, the webpage doesn't contain a "Brought to you by tE!//TMG" string after the Preface. :D
Bengaly
08-30-2002, 11:30 PM
this book as said by Bruce Schneier him self in his newest book "trues & lies" (something like that) that it is complete crap book (delicated words -> useless nowdays) ;D
dont complain to me, complain to bruce ;)
mike
08-30-2002, 11:46 PM
No, 'Secrets & Lies' says that he was wrong about the idea that crypto can, by itself, provide security. Applied Crypto is still a great crypto reference.

DakienDX: does the .CHM have the full-size pics in it? Or is it like this one, where all the image links are bad...?
Bengaly
08-30-2002, 11:49 PM
ahh yes "Secrets & Lies" i remember now i took it from uni, scanned it a bit and saw it was a boring book with nothing new ;)
than i went on scanning William Stalling's book which is really cool ;) [ i got +- 30-60 pages scanned in jpg no html/txt ] ;)
DakienDX
08-31-2002, 09:53 AM
Hi mike !

The .CHM file contains the images and the links work too, but they aren't any better.

I've found an online copy of the book where the links work fine, but the linked pictures are only resized versions of the old ones. You still don't see more, maybe even less.

You can't expect much if you're looking at an 8kb tumbnail and get redirected to a 12kb "full" picture.

I don't know if the big pictures are around anywhere.
stealthFIGHTER
08-31-2002, 04:59 PM
Hello DakienDX,

you say a .CHM file? Is it the same book (but converted) that can be found on CrackZ's site? (html file format, include pictures)

Thanks,
sF
Bengaly
08-31-2002, 05:12 PM
yeah same book in .chm format made by tE!/TMG
i also got it if someone need it...(somewher on cd)
DakienDX
08-31-2002, 05:51 PM
Hello stealthFIGHTER !

I don't know where I got it from, but I think it was from tE!'s website when it was still online.

Where on CrackZ site can I find it? There's nothing of that size on the page.
esther
08-31-2002, 06:11 PM
Hi all,
There is only applied crypto in CrackZ site.
check out this link hxxp://www.woodmann.net/crackz/Keygens.htm#crypto
DakienDX
08-31-2002, 06:20 PM
Hi esther !

Thank you for the link. I though it was on CrackZ site directly, but this is only a link to some other page. At least I found out that "Dokz" was the right section to look in. ;)

Yes, it's the same file as the .CHM I have.

The page was really slow for me. You'll will find a faster source by looking for "appliedcrypto.zip" with Google. (I found this file when looking for the "big" pictures missing in mike's link some days ago)
esther
08-31-2002, 06:42 PM
;)
stealthFIGHTER
08-31-2002, 08:14 PM
Originally posted by DakienDX
I though it was on CrackZ site directly, but this is only a link to some other page.

Hi DakienDX,

Quote from CrackZ's:

...An edited and much smaller HTML version of this book is available here (thanks go to Bicho for this link).

And the word 'here' links to file f*p://ftp.zedz.com/pub/crypto/incoming/acrypto.zip so... :).

Regards,
stealthFIGHTER
JMI
08-31-2002, 08:31 PM
DakienDX:

Attention, Attention !!

Function.php file configuration error. :) stealthFIGHTER has exposed a slight defect if the system to prevent clickable URL's, outside the Forum, unless, of course, they were never intended to block FTP sites. Otherwise, some further editing appears to be required. If, and when, it is done, I would appreciate getting a copy of how you do it, although it would appear, from what you previously provided that a similar format line would do the trick, but I'm less than a php newbie.

I keep hoping that giving your solution to Aaron at exetools forum isn't the reason we can't reach the site any more. I know I only cut and pasted and didn't try to recreate it on my one. :D

Regards.
DakienDX
09-01-2002, 09:51 AM
Hello stealthFIGHTER !

Will you tell me that the FTP file is on CrackZ page directly? ;)

The file is edited and much smaller and has the same contents as the other link, expect this one contains only the text and not the links from the page it was teleported from. It looks exactly like the online copy at mike's link.

The only thing which started this discussion was "Is it the same book (but converted) that can be found on CrackZ's site" and I looked at my CrackZ copy and didn't find it as ZIP file. So I was a bit confused.
DakienDX
09-01-2002, 09:55 AM
Hello JMI !

No, no function.php configuration error. ;)

Woodmann upgraded the board and overwrote my changes, so the URL handling system isn't online any more.

But I'm fixing it soon. It should be back online sometime today.
stealthFIGHTER
09-01-2002, 02:52 PM
Originally posted by DakienDX
Hello stealthFIGHTER !

Will you tell me that the FTP file is on CrackZ page directly? ;)

The file is edited and much smaller and has the same contents as the other link, expect this one contains only the text and not the links from the page it was teleported from. It looks exactly like the online copy at mike's link.

The only thing which started this discussion was "Is it the same book (but converted) that can be found on CrackZ's site" and I looked at my CrackZ copy and didn't find it as ZIP file. So I was a bit confused.
Oh,

my mistake, sorry :o


Programs similar to TMG Ripper?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Programs similar to TMG Ripper?
PDA

View Full Version : Programs similar to TMG Ripper?

egg
08-29-2002, 03:51 AM
Ive been searching through this forum since I joined a week or so ago, and ive done a lot of manual browsing through the Tools Of Our Trade forum, but havent seen any descriptions of programs similar to TMG Ripper. My google searches also havent been fruitful. So what other rippers are available?
Thanks in advance,
Egg, the other crackme
DakienDX
08-29-2002, 09:05 AM
Hello egg !

I personally didn't even know TMG Ripper Studio.
Most people here will use IDA for work like this.

Of course this kind of program has some practical approach, but you can't use it very well with newer compilers. (ASM code still works fine)
So I think it'll more understanding and rewriting instead of ripping code.
Aimless
08-29-2002, 01:53 PM
You might try a 'crude' approach...

1. Download Ollydbg
2. Trace into or over and record the same in a file
3. rip to heart's content

works so much better than TMG.

Have Phun, Always


Another ASPack problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Another ASPack problem
PDA

View Full Version : Another ASPack problem

Soldat
08-29-2002, 01:30 PM
Hello !!!

There is a program

STG Folder Print Plus 1.7.4

delete

it is packed with ASPr

I Try to unpack it but had a weird problem ,I beleive it is because

IAT but can't find mistake

The OEP is

6657BC

there were several unresolved APIes,I found them to be

0192E494 GetProcAddress

0192E8E4 GetModuleHandleA

0192E944 GetCommandLineA

0192E954 LockResource

0192E900 GetVersion

0192E938 GetCurrentProcessId

0192E954 FreeResource

There is one call at 665816 that should be rename in

call 664A7F

but the problem is before that line ,program doesn't crash ,but

just do nothing after starting

I use WIN 98 , and did resolvation with ImpRec 1.4.2+

the same think happens if you use Revirgin

Thanks
hobgoblin
09-07-2002, 05:03 PM
Hi Soldat,
I found a way to unpack it so it runs as it is supposed to do.
Answer this post if you're still ineterested in unpacking it.:-)

Regards,
hobgoblin
Soldat
09-08-2002, 11:58 AM
Of course Hobgoblin I am ( in case you haven't read message I sent you)

Soldat
Soldat
09-13-2002, 09:32 AM
Problem is Solved

IAT was OK

Whole Thanks to HOBGOBLIN


Complete Newbie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Complete Newbie
PDA

View Full Version : Complete Newbie

Aerzan
08-29-2002, 04:56 PM
Hey

I've been trying to crack for a while, but all the tutorials I find are can't seem to help me. The only tools I can find are W32Dasm and Hiew, and I can't download softice because I'm using windows xp and can't find a patch for it. Just about every tutorial I've read uses Softice, and if it doesn't, it uses some other tools that I can't seem to find. And when I read tutorials that use targerts, I can't find the version that they use because it's outdated or somethin. I can't seem to crack any program and I've tried numerous times! Nothing is working for me :( If anyone knows of a good tutorial/site that could get me started, it would be VERY much appreciated. Thanks
esther
08-29-2002, 05:07 PM
http://www.woodmann.net/forum/showthread.php?threadid=3676

check this out
Aerzan
08-29-2002, 05:25 PM
Thanks...

I have read many tutorials which list many tools to download...
what tools do you suggest I get...and btw, I can't get softice because I have Windows XP.
thanks
esther
08-29-2002, 05:36 PM
search the forum winxp you will find information
http://www.woodmann.net/forum/showthread.php?s=&threadid=3420&highlight=wi

NO WAREZ IS ALLOWED
ZaiRoN
08-29-2002, 05:46 PM
hey Aerzan,
softice is the best debugger but it's not the only one.
you can try to use Ollybdg; userfriendly and simple to use. it's a good tool and (imho) nice for newbies.
if you want to work on simple target, look at the mini project area. there are many thread newbie-oriented (some with tutorial)...
my 2$...

regards,
ZaiRoN


How to find OEP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to find OEP
PDA

View Full Version : How to find OEP

mray
08-29-2002, 07:02 PM
Can anyone tell me the method of finding the OEP, i mean most tutorials will tell you to trace till you see a certain pop or certain call instruction, and say that the eip is there. What I would like to know is how someone first discovered that the OEP is there, I mean, I realize the packer has to unpack the program first.. so it's code runs first, but what are some API's it must call to launch the original program, i mean, is there a certain API call which comes directly after the program has been packed? or how do you all locate the ending of the packer/cryptor ..
DakienDX
08-29-2002, 10:12 PM
Hello mray !

If you're tracing, the OEP is quite simple to find. Most time you jump/return from the protector's code segment to the program's code segment.

Before starting to trace you should look where the original code segment starts and where it ends. Some packers hide this information and merge anything into one segment. Then you must guess if you jump to the code segment or not. The original program's code will look different than the packer's code, since the unpacker is written in ASM and the program is mostly written in some high level language.
If more than one packer is used on the program this gets more difficult.
You must learn to feel how a jump to the OEP looks like. There are no special rules.

After the OEP of a (high level language) program you usually find a "call" to GetVersionA/GetCommandLineA/GetStartupInfoA or a "call" to __set_app_type/__p__fmode/__p__commode or no direct visible calls depending on the compiler used. If you're debugging a Visual Basic program you'll find a "push" instruction followed by a "call" to the library MSVBVM??.DLL and no code after that any more (it looks like bad opcodes).


non PE or NE but msdos exe reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > non PE or NE but msdos exe reversing
PDA

View Full Version : non PE or NE but msdos exe reversing

mancini
08-29-2002, 08:13 PM
i have this curiosity and a need lately to learn to tamper into non PE and NE files
bul let me better show you for one specific example

look in the file atached to this post (stellar.jpg)

im sure you can notice the grey nag screen in the middle of the capture
it just pops up whan you want to save and closes the saving operation when you press ok on it
so my guess is that just removing that one will leave the copying process live

but how ?.. windasm doesn't show not a single text string from the dissasembled executable anywhere

in softice i cant trap the spawning nag window because i dont know what bpx to set for it

it should be a 16 bit call like MessageBox ? i tried a lot of similars in softice but none worked
i am a little familliar with the win32 API calls but where to ge the ones for msdos .. are there any ..cos if there are i cant find them

the file is compiled by Borland C++ and im running out of debugger disasemblers to run it thru ....

i guess its time to learn IDA ... buy it too ...does it suport non PE files ?

anyone have experience with this type of executable reversing ?
could you spare some advices/instructions ?
DakienDX
08-29-2002, 10:40 PM
Hello mancini !

W32DASM doesn't show any string references? So there are two possibilities. The first one is that the "W" stands for Windows and not for DOS, the second one that DOS you have no string references in DOS. Both are true.

In DOS you don't set a BPX on an API, since DOS has no APIs, just interrupts. So you must use BPINT. Of course you must also know on what INT with which value in AX to break.

DOS has no APIs, as said, and it has no window functions also. The program creates all screen output without the help of any interrupts. Maybe it uses a "write one char with given color at cursor position" interrupt call, but I doubt that.

Yes, IDA supports DOS files. DOS reversing is totally different from Win32 reversing. You have much to learn and there is little information available.
mancini
08-29-2002, 11:32 PM
well at least i know now what i have to do next
unlike the deadend i reached on my own

and i allway have you guys to bother with endless questions :)
Kayaker
09-05-2002, 07:38 AM
Here's something you might want to look at Mancini.

HOW TO CRACK, by +ORC, A TUTORIAL
Lesson 2: tools and tricks of the trade

When a protection scheme is marked by the issuance of a specific message on the screen, you could go into the program and locate the code that emits this message, and then determine what triggers it. A good way to start the location process is to see if a system call is used to display the string. Interrupt INT_21, INT_10 or INT_29 are usually used to display text messages to the console.

When the message's display is not a result of one of these system calls, direct video writing is probably being used. If you know the screen location used, and if that part of video memory is not used for anything else at the time (a big if), a memory write breakpoint could be set on the video buffer address
corresponding to the first character's position. If this won't work, use the step-over/step-around tracing technique while watching for the message to appear.
-------------------------------

Kayaker
mike
09-06-2002, 04:08 PM
windasm doesn't show not a single text string from the dissasembled executable anywhereHave you tried looking at it with a hex editor? windasm, when it works, is great, but it fails a lot, too. If you can see the string w/ a hex editor, then chances are the exe isn't packed and you can use softice's search memory command to locate the string. Then you put a bp on the range of bytes in the string.


newbie Q: convert assembler 2 hex
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > newbie Q: convert assembler 2 hex
PDA

View Full Version : newbie Q: convert assembler 2 hex

chitech
08-29-2002, 09:57 PM
Alo everybody

I have some problem when I try to make inline patch. How do I convert assembler code to hex. Please guide me (links?)

For example how is this converted?

:00405BF2 E909800000 jmp 0040DC00

Thx

Chitech
DakienDX
08-29-2002, 10:10 PM
Hello chitech !

How Call and Jmp instructions are calculated has be discussed already lately.

Please read this (http://www.woodmann.net/forum/showthread.php?threadid=3607) post.

For everything else go to the Intel homepage and download the opcode reference for the processor you have (I don't know if AMD has something like this also). But beware, you'll end up in 500 pages of text or even more.
chitech
08-30-2002, 12:09 AM
alo DakienDX

endlocation = (orginal call location - (currentlocation +5))

:D :D

Now it works :D :D

Just a question: why do I have to add 5 bytes to currentlocation?

Thx a lot to u

Chitech
DakienDX
08-30-2002, 12:45 AM
Hello chitech !

This was also discussed.
The relative address is counted from the end of the instruction.

The Call instruction is 5 bytes long. (E8 ?? ?? ?? ??)
You have to add 5 to the current location, so you're at the end of the instruction where the relative counting starts.

If you're in 16-bit code, the Call is only 3 bytes long. (E8 ?? ??)
So you would have to add 3 to the current location.
chitech
08-30-2002, 01:09 AM
Alo DakienDX

Ok...now I see it......U r right. It has been discussed

Now it's time to add func. to programs. It's fun when u can calculate the offsets and it's working :D

Thx again

Chitech


RegMon & FileMon. COnflicts!! please Help!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RegMon & FileMon. COnflicts!! please Help!!
PDA

View Full Version : RegMon & FileMon. COnflicts!! please Help!!

Newbie2k2
08-30-2002, 09:25 AM
i got this Aspr. protected variant.. maybe modified for betters results by the author... i don't want or need to unpack it by now.. but i need my regmon and filemon. working it seems this app. detects everything, Sice, Filemon......... it close my regmon every time i tried to open the program. the patchs available at Programmers tools don't work with latest versions and i can't get olders ones... the cuestions is how can patch my regmon or file mon to avoid detection by this target:

i want to see what's going on in the registry while the bitch is loading but it won't let me.. it close both file monitor and reg monitor made by sysinternal network... both are latest version 4.34... i guess.

please guys i need some good instructions or tips.... not complaints or just a line saying this has been discused before... i'm new here...

thanks!!!:D
dion
08-30-2002, 11:40 AM
mmm.. try bpx on CloseHandle to see what have been done by that b**** ;)
Newbie2k2
08-30-2002, 02:30 PM
i can't even run Sice, it seems icedump needs a little update... frogice always crash...... i want to know how to patch regmon and filemon to avoid detection.......
JMI
08-30-2002, 03:49 PM
Newbie2k2:

Here you came with your first post and once again we have someone who thought their question was SO important that they didn't bother to look around first or READ THE POSTING GUIDELINES before they posted a question that has, indeed, been both asked and answered here before. Had you bothered to read those guidelines, you would have discovered that your eyes did not deceive you, that is actually a "Search" button at the top of the forums and, "surprise," if you use your brain and the button, you will very often find that the answer to your question is already here. and available to you without asking it again.

Use the "Search" button and enter the obvious choices for YOUR problem, which are "asprotect + regmon" and you will find (and should have already found) the answer to your question, some of it from no less an illuminary than CrackZ himself.

Another good use of your brain, instead of the "somebody help me, I too lazy to try to help myself", type of reaction, would be to think about "how" a program running on your computer might actually be detected by another program, and if detected, how would it shut it down. This, of course, might mean that you will have to begin to learn something about API's and the steps Windows goes through to find and close a program.

If you had bothered to examine any of these issues, you would have found help for the problem of asprotect shutting down Sice also. Consider the possibilities of using the "Search" button and something obvious from you questions, such as "asprotect+ Sice+shutting down" or, perhaps, just "asprotect+softice."

Again, using your brain, you might have checked out some of the Links at the bottom of the Forum and done some actual research. Here's another hint: Go to the AntiCrack Site and look at the "Current Active Section" or, wow, even use the search feature there and you'll discover, (and should already have discovered) that they have two sections titled "RCE Anti-Debugger" and "RCE Anti-Disassembler."

The point of all this is not to attack you, but to point out the failure of your efforts/attempt to help yourself. Learning to search is one of the most important skills you can learn about reverse code engineering, because that is how you find the information that is already available about the subjects that interest YOU. The Guidelines suggest that you take these steps BEFORE posting your question, but you should have done it on your own simply because going out and finding the answer actually teaches you something, i.e. how to find the answer. Learning how to find the answer, will lead you to discover that there is a very great wealth of material already available out there, if you will only bother to look. If you don't know "how to search," again there is an entire section devoted to the craft in the Fravia's mirror, linked at the bottom of the Forums.

Regards.
nofurs
08-30-2002, 04:13 PM
woh what a harsh flamming!
They are just lazy to search.They have brains coz they want you to help them to find it
JMI
08-30-2002, 04:51 PM
cluesurf:

I do not believe that I wrote a "personal" attack on Newbie2k2. I clearly criticized the lack of effort and the failure to read the posting guidelines, not the individual, but I did actually gave the answer to the problem (or more correctly, where it may be found.)

I have no need nor interest in doing anything other than "teaching" that the answers to most questions are already available for those who will make an effort to look for them. Just giving the answer "teaches" the person who receives it very little. Helping to "teach" them how to attempt to analize what the issues are that they need to solve and how to go about seeking the answer on their own gives the "tools" that are needed to problem solve in life in general, and in RCE in particular. I neither believe nor suggest that all answers are out there, but the process of the seeking is of value in and of itself and is the "how" we learn to actually "think."

I'm not interested in punishing Newbie2k2 or getting some form of "mea culpa" for the lack of effort. I'm interested only that Newbie2k2 and others LEARN how to attempt to find the answers by using their brains as a necessary skill. The form of my response "assumes" that they have a brain, and simply haven't exercised it on the subject yet.

This is supposed to be one of the places where people who have attempted to help themselves come when they can't find the answer, not where they ask a question they haven't attempted to investigate or solve themselves. Even though Newbie2k2 did not make that effort, or at least didn't show any effort, I still taught "how to find the answer" that was already there.

Regards.
nofurs
08-30-2002, 05:07 PM
You emphasie three times
>Use your brain
:p :p :p :p :p :p :p
DooGie
08-31-2002, 12:51 AM
JMI

Feel you were a bit hard on Newbie2k2. The guy is trying to learn and probably becoming impatient by hitting a brick wall all the time. We've all done it. You've obviously got a lot of patience and experience. Others need guiding in a gentler way.


ASPacked notepad: manually unpack problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPacked notepad: manually unpack problem
PDA

View Full Version : ASPacked notepad: manually unpack problem

NoSleep
08-30-2002, 12:05 PM
Hello,

I want to manually unpack notepad, i know this is newbie question so i used NotePad for target.

I have problems finding OEP for notepad :(.

I know that OEP for notepad is 6420 but when i packed it with ASPack, OEP is 10001.
So I want to find OEP for Notepad in packed version.
I tried LordPE function break&enter and with SoftIce i am lost in code.

Would you suggest me first step for unpacking notepad ?

Thanx in advance.

OS: WIN 2000Pro
Packer: ASPack 2.12
Debuger:SoftIce 4.05.334
nikolatesla20
08-30-2002, 02:48 PM
Hmm Why is this whole OEP question like a bad virus on the board lately? Do some searching, you will get answers on how to find OEP.

Every windows program gets its own memory space, so the original OEP is ALWAYS the OEP. If you know what the OEP is on the orginal file, it will be the same in the unpacked file. That can't be changed, or the program would not run right (without relocations anyway).

So look at IMAGE_BASE + ENTRY POINT in memory to find OEP. If imagebase is 00400000 and entry point is 5000 then OEP is 00405000.

-nt20
egg
08-30-2002, 04:26 PM
Originally posted by nikolatesla20
Hmm Why is this whole OEP question like a bad virus on the board lately? Do some searching, you will get answers on how to find OEP.
I guess some people just want the treasure without the hunt :D
(don't invite such people over at Easter time)


Krypton 2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Krypton 2
PDA

View Full Version : Krypton 2

the_analyst
08-30-2002, 01:58 PM
Hello everyone,

I came across this lil crackme yesterday when someone pointed me to it. I didn't have time to work on it much because im finishing some other projects, but i thought you might be interested by its anti debugging features
On win9x, put a bpx and you computer freeze when you run it. same happens with a BPM..
if you trace it the wrong way, you freeze also..
it has bpx detection, and nice anti debugging features.
try to open it with IDA and it will complain with a message i had never seen yet.
You are not allowed to change the oep so it show the good boy message.. Read the readme carefully ;)

Im going this week end, but i will have a better look next week. If you guys wanna play ;-)

oops forgot to add a lil url ;-)

h**p://www.lockless.com/products/Krypton2.zip

Best Regards,

tHE ANALYST
ZaiRoN
08-30-2002, 04:04 PM
HI the_analyst !!!
nice to see another hard level project for this area :D

if you want to have an introduction to the protection used by the target, take a look at this thread:
http://www.woodmann.net/forum/showthread.php?threadid=1122&highlight=krypton

i have already resolved this crackme for which i will not participate to the project.
in any case i will be here in order to try to help you if you have some problem...

have fun!
regards,
ZaiRoN
Bengaly
08-30-2002, 06:17 PM
i think analyst pretty much can manage on his own :P -> he is l33to :))
ZaiRoN
08-30-2002, 06:59 PM
lol Ben :)

my aid is not only turned to the_analyst but all the companions whom they will want to try this crackme :p

cya,
ZaiRoN
evaluator
08-31-2002, 04:15 AM
Ok, I look Lockless & dld from there.
Heh, I enjoed playing with krypton2 on XP! (i crazy man~:)

But seems, because of Ethic, we can't review this crackme here!
Because it is "official crackme" of Lockless.

Am I right!?

If yes, stop now:(
ZaiRoN
08-31-2002, 09:50 AM
Hi evaluator
the official Lockless's crackme is Krypton #3.
if i remember well Krypton #2 was the old trial crackme so i think there are any problem on working together on it :)

have fun!!!
ZaiRoN
the_analyst
09-02-2002, 08:30 AM
Hey :)

Ok, im back from the neat week end, and i will give this crackme a lil try.
I did check it quickly and i have it almost decrypted here.
So the goal of the crackme is to have a working executable that show some windows, and if you press some buttons, it must gives you the good boy message? am i correct ?

At the moment, the only part of the executable that seems still encrypted on my box is the ressources. I looked quickly, but didn't see anything that seems to uncrypt it yet. any hints?
i really didn't work a lot on it yet, but the goal of this mini project area is to share ideas, so ideas and comments are welcome.
Anyway, im curious in the method you guys used to decrypt it.

Did you trace the int handlers ? and is the final decrypted exe looking like this (at this VA at least) :

401000 : jmp some location

some location : call decrypt_datas
call some_bpx_detections_and_shites
a lil anti soft ice here.

does it look like this ? or is there anymore layers ?

i have all the dialogboxparam code in my dump, so i guess i did it well, but i still miss the ressources.

Ok, now it's time to go at work!
I will post when i got back if i got the chance to work on it again.

regards,

Analyst

ps : Bengaly, i ain't leet and moreover, im feeling rusty nowadays :)) i didn't reverse a lot in the last few months, gotta do some exercices ;-)
ZaiRoN
09-02-2002, 09:54 AM
Hi the_analyst

>Did you trace the int handlers ?
i suggest you to trace (new) int handler ;)

>...i still miss the ressources.
ehhe...the previous answer will guide you to the resource.

regards,
ZaiRoN
the_analyst
09-02-2002, 12:52 PM
>>Did you trace the int handlers ?
>i suggest you to trace (new) int handler ;)

i, of course, did trace the new int handler ;)
did i miss one ?
the one i traced when i looked quickly at the crackme was the one that decrypt .code section.
if you keep tracing, you come to a nice IRETD.
if you trace it you freeze ;-)

So, at this very moment, i did "r eip 401000"
and the .data decryption takes place.
Did i forgot some place ? i didn't see the ressources decryption.

>>...i still miss the ressources.
>ehhe...the previous answer will guide you to the >resource.

well i did trace the new handlers ;)
which int handler is used for ressource ?

I can't try until i get back to home, so im posting this from memory.

I may be completely wrong since im rather rusty nowadays hehe. Although, my decrypted exe contains everything but ressources, so i shouldn't be that wrong.

Regards,

Analyst
ZaiRoN
09-02-2002, 01:20 PM
Hi the_analyst,
i don't know if you have already seen it but the new_int5_handler is redefined not only one time ;)
(dr register's check will guide you ;))

regards,
ZaiRoN
evaluator
09-02-2002, 01:28 PM
Heh!

It calls to GetSystemTime then compares to own value & not jumps to
good place.

Is this trick? (I assume so)
Or crockme just expired!?

on XP my un_crocked anyway not runs. W98 is GREATTT:)

What now? K3!??
Should I upload here my work for check-comparison or move to archive?
ZaiRoN
09-02-2002, 01:52 PM
you are too fast eval :)
or maybe the target is too easy for you :p

k3 question: it's a trial crackme. we can't talk about it...

regards,
ZaiRoN

ps eval: you haven't answer to my question on uic strainer thread...
evaluator
09-02-2002, 07:23 PM
but I little not understand what exactly want Yado.
I simple unprotected target & found way for correct run.
Is this solution?
Or solution is InLine patch??

about K3 i joke:)
the_analyst
09-05-2002, 02:15 PM
Hey :)

I had a quick look at it today, and i finally did it.
I was mistaking somewhere..
My bad.. not good to stop reversing for months.

>It calls to GetSystemTime then compares to own value & not >jumps to good place.
>Is this trick? (I assume so)
>Or crockme just expired!?

Well the crackme is some fake trial application.
So the expired thing is normal.
Although, I didn't even had to play with this ;-)

btw, R eip xx just rocks ;)

Analyst

ps: Except Evaluator, Zairon and me. noone tried this one ?
it is funny :)
evaluator
09-05-2002, 07:52 PM
BTW, at same time I unpacked also K3.

I force it to play music. Is it all, ZaiRoN?

Or I also must show some DialogBoxParamA with logo in _rsrc?
Would you like, I send you unpacked?
ZaiRoN
09-05-2002, 08:25 PM
hi eval,
i trust you, no need to send unpacked file :)
> Is it all, ZaiRoN?
btw, why the question was directed me? i'm only curious :p

best regards,
ZaiRoN
Bengaly
09-05-2002, 10:48 PM
LOL zairon :)))
mambox
09-09-2002, 10:54 AM
would ever be a tutorial for this crypter?

were fine for all people who didnt manage to unpack it.

thanks
the_analyst
09-09-2002, 02:24 PM
there will be a tutorial soon.
since i posted it on a french board, i don't want to spoil their fun.
Wait and some tutorials / notes will be released ;)

Best Regards,

Analyst
ZaiRoN
09-09-2002, 05:09 PM
Hi mambox,
i don't know if you have solved this crackme but in the meanwhile you can put here your doubts or questions.

regards,
ZaiRoN


xframe problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > xframe problem
PDA

View Full Version : xframe problem

bart
08-30-2002, 04:37 PM
Does anybody know what's wrong with 'xframe' command under 98SE, it doesnt work (no frames message), ive got SI from DS 2.6, under XP everything is fine...


Delphi (SolSuite 2002, 12.0) too hard for me?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Delphi (SolSuite 2002, 12.0) too hard for me?
PDA

View Full Version : Delphi (SolSuite 2002, 12.0) too hard for me?

Manko
08-31-2002, 12:20 AM
Hi! Have been trying to understand this proggy, but I just can't get any further...

Can't understand the validation routine though I can trick it, almost... (It's registered to "Trial Version")
Am able to get access to all shuffles, but if I restart it's unregistered again.

It writes a file called (for me) solsuite.c12 which contains serial and name (You type it in after you have passed with the serial) and some other stuff...
I don't know how to break on access of that file...

Please tell me it will be too hard for me so I can give up! :P

Or do you have any ideas on the serial-validation?
I just get lost in the code... :(

solsuite.com

/Manko
NervGaz
08-31-2002, 01:57 AM
Originally posted by Manko
I don't know how to break on access of that file...

Have you tried bpc CreatFile/CreateFileA ? or perhaps they're trying to be tricky and are using _lopen/_lcreate... just a few ideas... eve if they use the delphi functions you should end up in one of these eventually when opening a file... unless they're really realy sneaky and have their own ring-0 routines for opening files...
Manko
08-31-2002, 01:51 PM
Sigh!

I had got it into my head that it wouldn't work so I didn't try...
It breaks and it reads and it computes and I still get lost...

Maybe I should just give up? ...but I hate that...
If I only understood more of what's going on...

So many flags and stuff, the stack's heavily used too I think...

Sometimes it feel so easy to follow, but sometimes...

This code seems harder to understand... Can't even find some points to patch... But I guess you WOULD make this part harder...

Hate being a helpless newbie... :P

/Manko
NervGaz
08-31-2002, 02:09 PM
i usually go with deadlistings when i get stuck while debugging... just remember where in the code you break in... you get a bit better overview of the code in deadlistings IMHO
JMI
08-31-2002, 03:06 PM
Manko:

Don't forget that if the program is Delphi, you can also look at it with DeDe.

Regards.
Manko
08-31-2002, 04:20 PM
Originally posted by JMI
Manko:

Don't forget that if the program is Delphi, you can also look at it with DeDe.

Regards.

First thing I did. :)
Couldn't get it to dissassemble the parts I liked though...
And the whole thing took too much time and then went out of space.. :(

/Manko
Manko
08-31-2002, 04:23 PM
Originally posted by NervGaz
i usually go with deadlistings when i get stuck while debugging... just remember where in the code you break in... you get a bit better overview of the code in deadlistings IMHO

Yup, good idea. :)
Will do that. Too bad though I couldn't get DeDe to do the whole prog. And not really the parts I wanted either...

/Manko
JMI
08-31-2002, 04:48 PM
Manko:

A few more pre-breakfast ramblings.

I reviewed some of the DaFixer's DeDe recent posts (and now noticed that you posted there on using DeDe). Maybe there is something on the stealthFIGHTER's site that can help you. He has a lot ot tutorials on his page which deal with name/serial issues in Delphi apps. Google with "stealthFIGHTER" will get you right there.

If you are making changes they don't appear to be writing to the .c12 file. Have you checked for file write API's and/or attempted to save your changes to file? Also have you checked if it is writing to the register with some information about a valid serial?

Regards.
cHeCksUm
08-31-2002, 10:19 PM
I have an old version already and I will take a look and see if I can help you /give you some hints. Post my findings tomorrow.

// cHeCksUm
cHeCksUm
08-31-2002, 11:26 PM
Well I have cracked the version I have (8.1 I think) so now I know I can help you ;). Well I have just done a nasty in memory byte patch (i.e. non permanent yet it doesn't have to be) so it accepted any code. Will try some other approaches like getting the valid serial etc. Just post if you need more help. In case you are wondering the tools I used are WDASM and OllyDebug. I simply used WDASM and searched for text strings. Then fired up OllyDebug and set some breakpoints on suspicious strings I found in WDASM and voila.

P.S. What version are u trying... it's quite possible that they changed the routine.... so maybe my info will not help.

// cHeCksUm
ZaiRoN
08-31-2002, 11:29 PM
Hi!
nice game Manko :)
i have take a look at the proggie thinking that i will have found an easy protection because the old version (can't remember the release) had a very easy protection (bad_boy to good_boy convertion :)).
i'm totally wrong because the target seems well protected!

here is some quick note:

when it runs, the proggie looks for filemon, dede (and maybe something else) and close them if running.
dede can't help me too much because there's no trace of interesting resources, i mean something like regForm...
in the dead_list i haven't found interesting messages that can bring me directly to a check routine.
i think that some string are crypted in some way; the code is full of crypted string.

moreover, the proggie has a simple breakpoint detection; it checks for all the api used. the funny thing is that there are two checks on each api but (fondamentally) are the same :)
here is how check if a breakpoint is placed on a single api:

4CA814:
...
004CA834 MOV AL,BYTE PTR DS:[ESI] ; i.e. esi -> "jmp@MessageBox"
004CA836 MOV AH,66
004CA838 ADD AH,AH ; 66h + 66h = CCh
004CA83A CMP AH,AL ; al is CCh if a bpx is present
004CA83C JE SHORT SOLSUITE.004CA842 ; if equals jump to bad boy...

the other method is a simple cmp between the first byte of the jump@ with 0CCh and you'll find it at 4CA87C.

those are very simple checking method and maybe it's simple to break this target but...who can say it!

those are only few words for now but hope it helps in some way :)

regards,
ZaiRoN
cHeCksUm
08-31-2002, 11:52 PM
ahhh... I am downloading the new version as we speak... no wait as I speak... no that's not right.. as I write ;)... as they are on version 12.0 now!!! I didn't even know I had such old programs on my file server (8.1 that I have is from 2001!!!). Well as soon as it's down I'll take a look at it and see how much has changed... hopefully it will be more challenging now!!!

// cHeCksUm
Manko
09-01-2002, 12:08 AM
I done it! Now all works great and looks good! Maybe I should write an essay about blind cracking? :P

btw, this was SolSuite 2002 v12, very different from earlier versions which were not so very tough, I understand...

Dede gave me great info to begin with; RegCode's the form to be looking at. The process of the okbutton is called help2, or something... I dissassemble with dede and break in softice on some of the early adresses. I just follow code, getting to know it... don't understand it all but I see things happening... getting an idea of where I'd like to go/not go...
look at jumps, forcing my way to the goal.
(Just patch 2 places...)
Work ok. Unlocked program. But at restart I'm unregged.
Got help to realise I needed to check createfilea.
regg is stored in solsuite.c12, also read on start.
after much tracing and confusion, decide to fiddle with similar code i alter before. change one jump, all is regged! :)
Don't understand a thing. Very confusing code...

Ask questions if you like, I'm content.
(almost... wish I knew more, what it do...)

Really tired... go bed, sleep till children wake me... sigh! :)

/Manko
Manko
09-01-2002, 12:13 AM
And a really great THANKS to everyone who gave an interest in my predicament. :)

Now I go to bed!

/Manko
cHeCksUm
09-01-2002, 06:32 AM
@ Manko
hmmmm.... After having disabled the five or so debugger checks I was able to get to the routine I wanted. It is similar to the old ones but all strings are encrypted. What I cannot find is the place in which in compares the real serial to the fake one. I know it has to be somewhere around 4cdbdb3 but I cannot find it. Can you shed some light on this issue!? I have been able to get the reg to accept any serial but I am missing one or a byte patch somewhere as it isn't working....grrrrr!!! Well seeing as how it's 7:34 in the morning I thikn it's time I go to bed!!! Check in with everyone tomorrow....

// cHeCksUm
Manko
09-01-2002, 03:16 PM
Originally posted by cHeCksUm
@ Manko
hmmmm.... After having disabled the five or so debugger checks I was able to get to the routine I wanted. It is similar to the old ones but all strings are encrypted. What I cannot find is the place in which in compares the real serial to the fake one. I know it has to be somewhere around 4cdbdb3 but I cannot find it. Can you shed some light on this issue!? I have been able to get the reg to accept any serial but I am missing one or a byte patch somewhere as it isn't working....grrrrr!!! Well seeing as how it's 7:34 in the morning I thikn it's time I go to bed!!! Check in with everyone tomorrow....

// cHeCksUm

Never saw those debugger checks, and they didn't affect me either!? Very irritating! I have NOT patched Sice but still it avoids detection?! Dede can't see it either...

So it's somewhat similar...? Maybe I spoke too hastily. :)
And you will easily find the other place you have to patch with
tracing from createfila... Probably this has already been done by you? :)

Can anyone explain this code to me? Don't understand them
and don't know how to see the results of them...

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004CBC75(C), :004CBC87(C)
|
:004CBD99 DD45B0 fld qword ptr [ebp-50]
:004CBD9C D81D74C14C00 fcomp dword ptr [004CC174]
:004CBDA2 DFE0 fstsw ax
:004CBDA4 9E sahf
:004CBDA5 7212 jb 004CBDB9
:004CBDA7 DD45B0 fld qword ptr [ebp-50]
:004CBDAA D81D8CC14C00 fcomp dword ptr [004CC18C]
:004CBDB0 DFE0 fstsw ax
:004CBDB2 9E sahf
:004CBDB3 0F860E010000 jbe 004CBEC7

I guess this one would have been easy to patch if I had only known more assembler... How about fishing a serial?
Possible? Maybe I will find out for my self when I understand those lines... (?)

Hmm... float-point? my serial in float in **ebp-50? real serial in **4cca8c. turn on to show real? then traceback "algo"... or check what gives the real serial in **4cc18c?

Probably ought to experiment... Perhaps later...

/Manko
cHeCksUm
09-01-2002, 06:36 PM
@Manko:

No I was wrong the routines are changed quite a bit. However there is an "upgrade" version of the key in which you are thn prompted to enter a key from a previous version... think that is what confused me. Anyhow I cannot find the second byte patch you are talking about.... I have traced createfilea till my face was blue ;). I have managed to get the "registered to" to appear on the splash (under the unreg logo!?) but that about it. Could you maybe give me a hint. I too don't understand the floating point instructions. If one looks at [ebp-50] there is nothing in it... i.e. it is zeroed... so the right serial is not there. The instructions as far as I can tell seem to be adding up two floating point numbers... but like I said I don't understand it properly.

Two other things I am wondering. Do you know what the 52181165046432 number is and what it's checked against (might differ on your systme)!? Then there is and encrypted string (a12763ww) which unencrypts to 1abgfcGG. I have no idea what that is for either.

Some more misc info. There is a file in c:\windows called fmx_tia8.dfv which I have come to the almost certain conclusion that it is infact the encrypted date when the prog was installed. I'll delv into that some more. Also when the jump at 4CbDB3 is changed to always and the program accpets any code... it does infact write the info into the solsuite.c* file. However if one checks the about box it still says TRIAL version and like you knwo a restart and you get the TRIAL dialog etc. So somehow there is another check that is called. Well if you have more info I would appreciate some help as this is a very good learning session for me...

// cHeCksUm
Manko
09-01-2002, 08:17 PM
Originally posted by cHeCksUm
@Manko:

No I was wrong the routines are changed quite a bit. However there is an "upgrade" version of the key in which you are thn prompted to enter a key from a previous version... think that is what confused me. Anyhow I cannot find the second byte patch you are talking about.... I have traced createfilea till my face was blue ;). I have managed to get the "registered to" to appear on the splash (under the unreg logo!?) but that about it. Could you maybe give me a hint. I too don't understand the floating point instructions. If one looks at [ebp-50] there is nothing in it... i.e. it is zeroed... so the right serial is not there. The instructions as far as I can tell seem to be adding up two floating point numbers... but like I said I don't understand it properly.

Use the loader to start solsuite; bpx createfilea; first stop is some cfg or dat; f5; now eax holds solsuite.c12(or some other number), it contain your name and serial and other stuff; f11; in solsuite code; f10 till you get code similar to what you already know; patch the right jump; smile! :) (I'd hate to think this only work on my puter...)

Two other things I am wondering. Do you know what the 52181165046432 number is and what it's checked against (might differ on your systme)!? Then there is and encrypted string (a12763ww) which unencrypts to 1abgfcGG. I have no idea what that is for either.

Seen so many numbers in that one I've stopped caring... :P
No idea about the other one either, though I've seen it.

Some more misc info. There is a file in c:\windows called fmx_tia8.dfv which I have come to the almost certain conclusion that it is infact the encrypted date when the prog was installed. I'll delv into that some more. Also when the jump at 4CbDB3 is changed to always and the program accpets any code... it does infact write the info into the solsuite.c* file. However if one checks the about box it still says TRIAL version and like you knwo a restart and you get the TRIAL dialog etc. So somehow there is another check that is called. Well if you have more info I would appreciate some help as this is a very good learning session for me...

// cHeCksUm

You saw that to? :)
I could never find that file. :(
Guess it was deleted every time I regged.
Jupp it's as it should be. It doesn't get fully regged until the solsuite.c12(any number?) "passes"... :P

/Manko
Manko
09-01-2002, 08:38 PM
btw, cHeCksUm

ZaiRoN mentioned the api-calls were bugged. Maybe you are getting the "runarounds"?
Perhaps break on createfilea+3 instead!? :)
Though I can't for the life of me see why I shouldn't have been caught by it too... ?

/Manko
NE1
09-02-2002, 12:24 AM
Can anyone explain this code to me? Don't understand them
and don't know how to see the results of them...

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004CBC75(C), :004CBC87(C)
|
:004CBD99 DD45B0 fld qword ptr [ebp-50]
:004CBD9C D81D74C14C00 fcomp dword ptr [004CC174]
:004CBDA2 DFE0 fstsw ax
:004CBDA4 9E sahf
:004CBDA5 7212 jb 004CBDB9
:004CBDA7 DD45B0 fld qword ptr [ebp-50]
:004CBDAA D81D8CC14C00 fcomp dword ptr [004CC18C]
:004CBDB0 DFE0 fstsw ax
:004CBDB2 9E sahf
:004CBDB3 0F860E010000 jbe 004CBEC7

This is a typical Floating point comparison routine.
It basically copies a value to the FPU stack Compares it with another value. Sets FPU flags based on comparison, and then copies the Flags to the 8086 flags, so that something can be done based on the result (i.e.conditional jump, etc.)

Here is the breakdown of the first part: (The second part is doing the same thing with different values).

:004CBD99 DD45B0 fld qword ptr [ebp-50]

Takes the 64 bit value that is stored at the address that is in ebp-50, and converts it to 80 bit precision, and then pushes it on the FPU Stack (st(0)).

:004CBD9C D81D74C14C00 fcomp dword ptr [004CC174]

Floating point comparison. Compares st(0) with the value at the address specified by 4CC174. Then Pops st(0). Sets FPU flags based on result of comparison.

:004CBDA2 DFE0 fstsw ax

Stores the fpu status register (flags) in ax.

:004CBDA4 9E sahf

copies fpu status registers (flags) to 8086's flags register

:004CBDA5 7212 jb 004CBDB9

Jump if below. Jumps if Carry Flag has been set (Carry = 1)

Hope this helps...
Iwarez
09-02-2002, 12:24 AM
I don't think there is a place where serials are being compared. The serial is independend of the name you enter later on. The program only needs two places to patch. I suggest you find first the place to patch after the serial is entered. After that you know how the ok/bad routine looks. After that search for references to solsuite.c12 and look for same code. It's easy to find.
cHeCksUm
09-02-2002, 02:28 AM
@Manko

Thanks for the help I wil have another look at it tomorrow. I used OllyDebug for this session as I don't have softice that works on XP. So that is why I had to disable the annoying anti breakpoint crap. It was only four place (two NOPS and two RET). So that shouldn't be the problem. Most likely the reason I couldn't find the other patch point was because I was tired. I found the place where it read the file no probs just not anything that looked like the other check :(. Like I said I'll have a look at it tomorrow again. I also verified that the file in c:\windows is the encrypted date. Fiddled around with it and got an "extended" trial... nothing interesting.

@Iwarez

I understand that the serial is independant of the name however it still needs to check if your serial is valid. I guess it just applies the floating point math and expects some result or other.... I have to understand the fp math algo though...

// cHeCksUm
cHeCksUm
09-02-2002, 09:13 AM
Found it!!! Can't believe I missed it in th first place. Well anyhow I have written a small "tute" (more of a description of what I did). Don't know if it's worth publishing here though. Thanks everyone for the help. Now any suggestions for the next target?

// cHeCksUm
Paul333
09-04-2002, 01:33 AM
Checksum i'd be interested in seeing your tute!!

Thanks :)

paul333
cHeCksUm
09-04-2002, 08:43 AM
You are not the only one to request it. So I was thinking of posting it here.

As this is rather specific tute I am not sure it is appropriate to post here... I'll have to ask the moderators... if they ok it I'll post it in this thread else I can email it to you etc..

So moderators is it better to email this tute or post it here? Thanks.

// cHeCksUm
Paul333
09-06-2002, 01:45 AM
Sorry to be a pest Checksum.......how u getting on with the tute:)

Thanks :)

paul333
TheSearcher
09-06-2002, 01:49 AM
Hi cHeCksUm,

Send it to Woodmann ;)

regards
cHeCksUm
09-06-2002, 02:23 PM
Know why lightning never strikes the same place twice? Because ome time is enough to completely and utterly ruin your day/night!!! Yesterday @ 6'ish lightning struck out all our servers :(. Had a nice all-nighter @ work.... don't you just love lightning!!!

Well anyhow the tute is done I have sen it to a couple of people vi email. I will send it to Woodmann and see what he does with it. I just want to reitterate the fact that it is more of a "cracking note sheet" than a proper tutorial so don't get your hopes up; it's not an earth-shattering orgasmic wave of knowledge that will enlighten you and generally make you a better person.... incase that was your impression that is ;).

// cHeCksUm
Paul333
09-06-2002, 07:23 PM
Thanks Checksum...

im not looking for a fantastic tute..just a note saying where to patch the second jump :)

If ANYONE has been sent Checksums tute can you please forward to me please as i never got one :(

Thanks

paul333
Nigma
09-26-2002, 08:21 PM
well , it was really interesting to read all of these posts , but I must say that there are few things to explain :

first checksum was right there are two and maybe more
reg routine one for 12 version and one for the upgrade ,
but I don't think that there is a place which our fake serial
is compared to real one , instead there is a routine { this
is the registartion CORE } at the call before 005FE187
and after that there are some VERY INTERESTING COMPARE
instructions .

well check it if u want ?

BTW , don't even think to find a good serial by just tracing ,
if u want to find a good serial , trace the reg core and after
understanding what's going there write
a bruteforce proggie in your favorite code .

if u want a working serials for this version or something else email - me !

good luck everyone !
Paul333
10-01-2002, 07:10 PM
Checksum just checked my old email addy and got the tute you made for Solsuite 12..many thanks mate ..ill study it now for futore ref:):)

paul333
Iwarez
10-02-2002, 11:30 PM
Many thanks goes to the one who suggested the serial checking routine and the compares. Thanks to him I could make a valid serial. I learned a lot while keygenning. So, once again, thank you!


VBOX v4.5 - Corel WordPerfect Office 2002 Trial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VBOX v4.5 - Corel WordPerfect Office 2002 Trial
PDA

View Full Version : VBOX v4.5 - Corel WordPerfect Office 2002 Trial

dx50azlm
08-31-2002, 02:42 AM
I've been looking into how VBOX v4.5 works, and after following the tutorials that are already out there (dEZZY's and r2/+Tsehp's) I keep having the same problem.

My target is wpwin10.exe, and it's definately VBOXed with v4.5. TNT already put a crack out for this suite, but I wanted to investigate further. "So, I'll use TNT's unpacked wpwin10.exe for comparison." I thought.

I used the following setup to get the dump: SoftIce v4.05, latest IceDump, SoftIce Backdoor Keeper, etc. All under Windows 98 Second Edition. I followed the tutorials and all went as planned. I found the OEP at 00401480, about 10 lines above a break at GetVersion (thankfully it wasn't as hard as I'd feared). The unpacked executable from the TNT release has its entrypoint at 00401480 as well. So at least I know that's correct.

I then did a 'bpm cs:OEP x' and relaunched the application. SoftIce snapped and I was right at the OEP with the code staring me right in the face. This is my first time using IceDump, so I was hoping someone could help me out with this problem I keep coming across: I use the /PEDUMP feature of IceDump and make the PE file as needed. I don't know if I'm getting the parameters right, but I thought the imagebase was 00400000 and the EIP was 00001480. The file gets dumped and I exit SoftIce.

When I inspect the dumped file, it doesn't run (crashes, something to do with kernel32.dll) and the PE sections are called "PREVIEW", "WeiJunLi" and ".rsrc". Something's up here. It sounds like I'm dumping the wrong process.. I thought those were markers of a VBOXed file, not an unpacked VBOX file. I've tried running Revirgin, Imprec and all the other tools I can think of to get the dump to work, but no luck as of yet.

Any ideas as to what I'm doing wrong?
JMI
08-31-2002, 03:40 AM
dx50azlm:

You indicate that you have read a couple of tuts on VBox and you have made a good effort to show your work, but you have left out one important part of the Posting Guidelines. That is that you do a search of the forum to see whether your question has been asked, and possibly answered, before. Because VBox 4.5 is not the latest version of VBox, there is a good chance that there is information here and on the Web about this protection, You have not indicated that you have read the VBox threads here and I just did a quick check with the "Search" button and there are several, including one titled "VBox 4.5," with a seven step solution from Admiral +Tsehp himself.

Check out those threads and see if they give you a clue to your issue, try them out on your exe and then come back and ask further questions.

Regards.
dx50azlm
08-31-2002, 05:03 AM
Sorry for not stating that I had used the search feature already. I searched the message board first for 'VBOX', not 'VBOX v4.5' so my criteria was most likely too broad. Thanks for the tip.

Because VBox 4.5 is not the latest version of VBox, there is a good chance that there is information here and on the Web about this protection

My fault on this one. I knew that Vbox v4.5 was old, but I didn't know just how old. Now that I know, I'll be prepared when I come across a more advanced future version :)

You have not indicated that you have read the VBox threads here and I just did a quick check with the "Search" button and there are several, including one titled "VBox 4.5," with a seven step solution from Admiral +Tsehp himself.

I read that thread already, and the various tips/methods posted in that thread still wouldn't give me a correct dump (mangled IAT or not). However, I don't give up easily. I will go back and triple check everything to make sure I didn't make a silly mistake setting up SoftIce, etc. I won't ask another question about this until I've read every previous thread and only if my dump is still not working.

Thanks for your help.
JMI
08-31-2002, 07:44 AM
dx50azlm:

I'm glad that you searched, but a little confused why a search here with "VBox" would not have shown you the VBox 4.5 threads. (It gave me three pages of threads.) I found at least three directly titled something relating to VBox 4.5. One titled "vbox 4.5, trace X 6.025 & DreamWeaver 6" , one just VBOX 4.5, and the last "vbox 4.5 tut some problem with iat fixing proc" from as recently as 8-05-02, discussing problems with the r2 tut.

All of these threads discuss rebuilding the IAT. Nothing in your post mentions that you have investigated this issue or which OS you are running. You may have been mislead by the r2 tuts comment by +Tsehp that he didn't find a mangled IAT on Win2000, but he still describes using ReVirgin to fix the Imports, as do all of the threads here. There are also comments that there may be relevant materials in the VBox 4.3 tuts. In any case, if you haven't fixed the IAT, this is most likely your problem.

By the way, I own this program and the exe that comes off the disk is 49,202 K. The wpwin10.dll is 7+ mg and the wpwen.dll is 4+mg. This tells you something about the comments in the threads that the exe is just a "loader" for the main components of the program. If it cant' find its imports it isn't going to function.

So, next question: Did you repair the import table? Did you check the IAT manually or with ReVirgin/Imprec??

Regards.
TheSearcher
08-31-2002, 07:52 AM
Hi,
>Nothing in your post mentions that you have investigated this >issue or which OS you are running

He did you didn't read throughly

***I used the following setup to get the dump: SoftIce v4.05, ***latest >IceDump, SoftIce Backdoor Keeper, etc. All under ***Windows 98 >Second Edition
username
08-31-2002, 11:03 AM
Originally posted by dx50azlm
When I inspect the dumped file, it doesn't run (crashes, something to do with kernel32.dll) and the PE sections are called "PREVIEW", "WeiJunLi" and ".rsrc". Something's up here. It sounds like I'm dumping the wrong process.. I thought those were markers of a VBOXed file, not an unpacked VBOX file. I've tried running Revirgin, Imprec and all the other tools I can think of to get the dump to work, but no luck as of yet.

Any ideas as to what I'm doing wrong?
Hints: w9x/doc/icedump6.txt and '/hydra' and '/option p'.
JMI
08-31-2002, 01:59 PM
TheSearcher and dx50azlm:

TheSearcher is correct that I missed noticing that dx50azlm specified that dx50azlm is using Win98se. I recall that the r2 tut is discussing the reversing effort on Win2K and +Tsehp's comments were about that OS. I still suspect that the problem is the rebuilding of the IAT, but we'll have to await further word from dx50azlm to know for sure. I again notice that he has said that he has tried revirgin and imprec, but problems with this process are not that unusual.

I think username is suggesting that you check whether you have rebuilt the PE header when making the dump, which is an option in /PEDump configured with the /option p command. If you haven't reset the virtual and physical sizes (which I also forgot a few times) you dump will not run. See the "doc" subdirectory in your icedump directory.

Regards.
dx50azlm
09-11-2002, 06:45 AM
JMI said:

I'm glad that you searched, but a little confused why a search here with "VBox" would not have shown you the VBox 4.5 threads. (It gave me three pages of threads.) I found at least three directly titled something relating to VBox 4.5. One titled "vbox 4.5, trace X 6.025 & DreamWeaver 6" , one just VBOX 4.5, and the last "vbox 4.5 tut some problem with iat fixing proc" from as recently as 8-05-02, discussing problems with the r2 tut.

I'm sorry for not being more clear :( I meant that I had searched for posts on VBox v4.5 and I was looking for something more specific. I should have added in the word "revirgin" to my search because I believe that's where all of my problems are happening. I will read those posts immediately!

JMI said:

In any case, if you haven't fixed the IAT, this is most likely your problem.

I thought so. I tried for 2 days after I posted my second reply to this thread to rebuild the imports. I used Revirgin v1.3 as it was the last version to run under Windows 98. This is where my problem was (and still is). I couldn't figure out how to work the program at first (it runs fine, but the documentation is difficult to follow) and that's what kept holding me back. I would load the initial wpwin10.exe and then launch Revirgin. It would be in the processes list just as expected. After clicking on it and entering the right OEP that I fished out of SoftIce (I found it by using +Tsehp's suggestions for breakpoints), I tried figuring out what to do next. I clicked "Fetch IAT" and Revirgin did it's thing, showing me a lot of imports in the big listbox. Many of them were all "??????", and others were the more familiar "kernel32.dll" type. My main problem was, I couldn't figure out how to make the it.BIN file like many tutorials suggest..

JMI said:

By the way, I own this program and the exe that comes off the disk is 49,202 K. The wpwin10.dll is 7+ mg and the wpwen.dll is 4+mg. This tells you something about the comments in the threads that the exe is just a "loader" for the main components of the program. If it cant' find its imports it isn't going to function.

Funny thing.. I own WP 6/7/8 and 9, but not this one. I just didn't need a word processor anymore a few years back because I started using LaTeX for everything :) But then someone asked me if I had WP 10 and after looking around, it didn't turn up. So I grabbed the trial version from Corel's website and when I saw the VBox logo on the nag screen, I was happy. I've been out of cracking for a few years (life always gets in the way, right?) and decided it was time to have a new look at VBox. I knew the EXE was just a loader because it was so small, but I still couldn't rebuild its imports. So that's why it wouldn't run.. going outside and getting natural sunlight must be slowing my mind!

TheSearcher said:

He did you didn't read throughly

***I used the following setup to get the dump: SoftIce v4.05, ***latest >IceDump, SoftIce Backdoor Keeper, etc. All under ***Windows 98 >Second Edition

That was my setup at the time. Since then I've given that computer a new home and I'm back to my Windows 2000 machine. Now I have another problem: SoftIce for Win2K won't work due to a video card issue. I'm going to try installing DriverStudio v2.6 to see if it goes away. The problem is when I try to bring up SoftIce with Ctrl+D, either nothing happens or the screen freezes with no SoftIce window visible. Crazy. I've got an nVidia TNT2 Ultra 32MB AGP 2x card under Win2K with the latest (v40.41) Detonator drivers. I've had this dumb problem for years on my Win2K machine, which is why I kept the Win98se box around. I'm going to try a new setup and see what happens. Maybe using an ATI Radeon card would help matters here.

username said:

Hints: w9x/doc/icedump6.txt and '/hydra' and '/option p'.

Which brings me to the other problem I had when trying to unpack this VBox'ed program.. I loaded ProcDump v1.6.2 up and started the Bhrama server. I set a 'bpm OEP x' and SoftIce snapped. I tried using the '/hydra' command and specified the target Bhrama server window as required.. but ProcDump kept crashing. Something to do with kernel32.dll. I could never get ProcDump working normally under that installation (clean Win98se install with just SoftIce and other tools loaded), which I always thought was really strange. So, this method didn't work for me.

JMI said:

TheSearcher is correct that I missed noticing that dx50azlm specified that dx50azlm is using Win98se. I recall that the r2 tut is discussing the reversing effort on Win2K and +Tsehp's comments were about that OS. I still suspect that the problem is the rebuilding of the IAT, but we'll have to await further word from dx50azlm to know for sure. I again notice that he has said that he has tried revirgin and imprec, but problems with this process are not that unusual.

I think username is suggesting that you check whether you have rebuilt the PE header when making the dump, which is an option in /PEDump configured with the /option p command. If you haven't reset the virtual and physical sizes (which I also forgot a few times) you dump will not run. See the "doc" subdirectory in your icedump directory.

Thanks for your help, it's greatly appreciated. You are right in assuming my problems were with rebuiling the IAT. No matter how hard I tried, I couldn't get Revirgin to work, but that was under Win98se. I'm using Win2K now so things should be different. The tutorial gave great directions that worked under Win98, but the part on rebuilding the IAT was a little sketchy at first. Now it's clear what needs to be done. ImpRec came up with an error probably because the IAT was all mangled to begin with.

I did make a PE dump using /PEDump and loaded it up in a PE editor right after. I then fixed the checksum and it looked like the virtual/physical sizes were correct, but then again it's probably something I overlooked being so rusty at reversing right now :)

I'll go read those docs over again, and I'll try unVBoxing a different program to see if it's any easier to do than unpacking WP 10.

Thanks again!
JMI
09-11-2002, 07:20 AM
dx50azlm:

Good response and effort at solving the problems. I seem to recall reading some comments/articles about softice and the nVidia TNT2 video card. You might want to check you have the latest drivers. Also try a search here with "softice+ nVidia" and/or "softice + video" type queries and maybe a google search for good measure.

Also revirgin 1.3 is the last update for Win98 and it still has some issues and is not being updated. Win2K is the way to go unless and until all WinXP softice problems are resolved. The new DriverStudio v2.7 is "out." Haven't had time to install it yet. Maybe this weekend. Real life, as you stated. It's supposed to have some improvements for WinXP and such. There are threads here about the new features.

There is also an updated icedump to check out.

Good luck.

Regards.
username
09-12-2002, 11:41 AM
Originally posted by dx50azlm
username said:
Which brings me to the other problem I had when trying to unpack this VBox'ed program.. I loaded ProcDump v1.6.2 up and started the Bhrama server. I set a 'bpm OEP x' and SoftIce snapped. I tried using the '/hydra' command and specified the target Bhrama server window as required.. but ProcDump kept crashing. Something to do with kernel32.dll. I could never get ProcDump working normally under that installation (clean Win98se install with just SoftIce and other tools loaded), which I always thought was really strange. So, this method didn't work for me.

Hmm, I think there is some misunderstanding here. /hydra has nothing whatsoever to do with Procdump/Bhrama, i don't know where you got that from. Basically when you're at OEP and just about to use /pedump, you specify a plugin to be used during import rebuilding by /hydra. All the rest is automatically done (or so i think, the VBox plugin should work up to 4.6 at least, maybe even newer).
evaluator
09-12-2002, 10:10 PM
dx50azlm!

Did you tried RV for resolving imports?
DakienDX
09-12-2002, 11:51 PM
Hello dx50azlm !

You wrote you're using the latest ICEDump.

Maybe there's a bug in the newest ICEDump which detains the import rebuilding work. At least ICEDump 6.0.2.6 isn't compatible any more with SoftICE 4.05.334 on Win98. As soon as I load any executable (protected or not) with either ICELoad or the SoftICE Symbol Loader, I get a BSOD and the only way out is switching to SoftICE without seeing it on the screen and typing hboot. :(

After many reboots, some lost clusters and many crosswise connected files I switched back to 6.0.2.5. Now the only dangerous thing on my computer is Windows. ICEDump 6.0.2.5 works without problems. :)

ImpREC is also a good choice, maybe the best if you're not familiar with import rebuilding and must choose between ICEDump, Revirgin and ImpREC. (and manual rebuilding of course ;) )

Revirgin needs the most manual work and is difficult to understand for people new to it, so it might be a good choice to try one of the other two possibilities first.
dx50azlm
09-21-2002, 07:13 AM
To DakienDX, evaluator, username, JMI and TheSearcher: thank you so much for the help thus far. As of tonight I was able to make a working dump by properly rebuilding the imports of wpwin10.exe. It took some figuring out, but it seems the problem was with IceDump and the version of SoftIce I was using. I used the latest version of IceDump with the /hydra option and the dump was made without any problems thanks to the handy vbox plugin.

Here are some personal replies:

JMI said:
dx50azlm:

Good response and effort at solving the problems. I seem to recall reading some comments/articles about softice and the nVidia TNT2 video card. You might want to check you have the latest drivers. Also try a search here with "softice+ nVidia" and/or "softice + video" type queries and maybe a google search for good measure.

Also revirgin 1.3 is the last update for Win98 and it still has some issues and is not being updated. Win2K is the way to go unless and until all WinXP softice problems are resolved. The new DriverStudio v2.7 is "out." Haven't had time to install it yet. Maybe this weekend. Real life, as you stated. It's supposed to have some improvements for WinXP and such. There are threads here about the new features.

There is also an updated icedump to check out.

Good luck.

I just installed the latest Detonator drivers (v40.41) and I'm going to install SoftIce once again to see if the problems go away. I'm going to run the search as soon as I post this reply and I know that someone out there has had the same video card/softice issues that I've had.

I noticed revirgin 1.4 is much better than 1.3. I'm running it under Win2K without any problems and am loving every minute of it :) After homework is out of the way for some courses I'm taking at the moment, I'll throw DriverStudio v2.7 on and see what happens. Also, the updated IceDump is what I used to get a my good working un-vbox'ed dump. It turns out the old version didn't play very well with Win98se and my particular version of SoftIce (even /hydra was broken!). Thanks for all your help.

username said:
Hmm, I think there is some misunderstanding here. /hydra has nothing whatsoever to do with Procdump/Bhrama, i don't know where you got that from. Basically when you're at OEP and just about to use /pedump, you specify a plugin to be used during import rebuilding by /hydra. All the rest is automatically done (or so i think, the VBox plugin should work up to 4.6 at least, maybe even newer).

This is exactly what I ended up doing, but after unpacking the latest version of IceDump. Everything is much, much better now.

evaluator said:
Did you tried RV for resolving imports?

I did. It turned out that running v1.3 under Win98se wasn't as stable as it could have been. But running v1.4 under Win2K solved all the problems. To make my dump I used /hydra and the vbox plugin like username mentioned, but also managed to fix the bad IAT with revirgin v1.4 too. The GUI was a little hard to figure out at first, but the tool did its job, and for that I am thankful for such wonderful software.

DakienDX said:
You wrote you're using the latest ICEDump.

Maybe there's a bug in the newest ICEDump which detains the import rebuilding work. At least ICEDump 6.0.2.6 isn't compatible any more with SoftICE 4.05.334 on Win98. As soon as I load any executable (protected or not) with either ICELoad or the SoftICE Symbol Loader, I get a BSOD and the only way out is switching to SoftICE without seeing it on the screen and typing hboot.

After many reboots, some lost clusters and many crosswise connected files I switched back to 6.0.2.5. Now the only dangerous thing on my computer is Windows. ICEDump 6.0.2.5 works without problems.

ImpREC is also a good choice, maybe the best if you're not familiar with import rebuilding and must choose between ICEDump, Revirgin and ImpREC. (and manual rebuilding of course )

Revirgin needs the most manual work and is difficult to understand for people new to it, so it might be a good choice to try one of the other two possibilities first.

I switched to an even newer version of IceDump and all of the problems I described went away. I've never had a BSOD by using either of the loaders, but I'd get GPFs in kernel32.dll for no reason when the OS was just sitting idle. That's why I couldn't ever get ProcDump to work. As soon as I switched to the newest IceDump (v6.026) everything worked as it should. Strange, no? So I go to v6.026 and things start working, but you go to the same version and things stop working. Interesting to say the least!

ImpRec is my favourite tool right now, but it sometimes is unable to do what's mentioned in some tutorials (the ones that recommend revirgin for example). It's very friendly compared to revirgin, which IMHO is a powerful software that needs an illustrated manual for first time users that goes through the most common steps needed to get a working IAT for your dump. I just simply couldn't figure it out, but that's probably a byproduct of aging :)

Thanks everyone for your help. The target is dumped and fixed now, and I understand more about vbox. In the end, understanding is really all that matters. The dumped programs are fine, but nothing beats sniffing the inner workings out of a commercial protection.


Help with Hiew
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help with Hiew
PDA

View Full Version : Help with Hiew

Aerzan
08-31-2002, 03:55 AM
When ever I'm in decode mode in Hiew, and I push F5 to goto a hex code,it says "Jump out of file". It says that with every hex code I type in...Does anyone know what's wrong with it?
_Servil_
08-31-2002, 06:29 AM
hi,

you didn't state the notation using (virtual / raw ?)
check hiew again and C how offsets change switching global/local mode, make clear how are virtual offsets mapped
hobgoblin
08-31-2002, 07:20 AM
I take it that you want to jump to a specified address after pushing F5. Do this: Push F5, then hit the period sign button (".", without quotes), then type in the address. Hit enter. This is the normal procedure. But if you have found an address using softice, and if the target is packed, you will still get the message you mentioned. Then you have to unpack the target first...

regards,
hobgoblin
Aerzan
08-31-2002, 01:51 PM
The tools I use are W32DSM89, and Hiew.

Whenever I try to crack a file, I open it using W32DSM and search in string data refrences for the string. I double click on it, and scroll up until I see the first je or jne. I then open up notepad, and type in the @offset code without the @offset or the h at the end. Then I close W32DSM and open Hiew. I search for the file. Then I hit F4 and decode it, then I hit F5, and I typed in the offset code. It said Jump Out of File. So I tried putting the period in front of it. It didn't give me the jump out of file error message, but it didn't move to the code.

Does anyone know the problem?
JMI
08-31-2002, 03:01 PM
Aerzan:

Do you know and understand the difference between the addressing mode between W32DSM89 and a hex viewer such as
Hiew? By that I mean do you know the difference between VRA (virtual relative addressing) and Raw or Real (file offset addressing)?

W32DSM89 uses VRA or virtual addressing and most hex viewers use Raw addressing, or location within the file. Virtual addressing is "relative" to the OEP while Raw is a spot within the file on disk. I don't use Hiew, but if you aren't converting the VRA addresses to Raw addresses you can expect that a je to an address such as je 0040125D, and the "40125D" was what you entered, are almost certainly going to get a location which is a "jump out of file." Here's a thread which discusses some of these issues on another problem with W32DSM89
http://www.woodmann.net/forum/showthread.php?threadid=3607&perpage=15&pagenumber=2

Also see this one, where DakienDX discusses this issue:http://www.woodmann.net/forum/showthread.php?threadid=2239&highlight=virtual+address+real+address

He wrote:
{Quote}
You must know that Win32 programs have 'segments', which have a virtual address space where they are loaded into. Your program searches for strings and displays their physical offset. These 'segments' have a virtual size, a virtual address, a physical size and a physical address. Physical means here the place in the file and it's real size. The virtual address is a position in memory where the program is loaded into and the virtual size the memory size the program allocates.

It is nothing unusual that the data from 400h in the original file is loaded into the memory at address 00401000h. So if your program would find a string at 484h in the file, W32Dasm would show it at address 00401084h.

If you go onto a disassembled line in W32Dasm, it should show you the 'virtual' address, but also the corresponding 'physical' address.

All segments are defined in the PE-header. You should search for some information on it and try to understand how it works.
[End Quote]

Aimless then added:
[Quote]

alternatively...

try putting your wdasm green bar on the line which you want to find the address of.

On the left hand side the address you see is the "Virtual Address". that means, as it is in memory

On the STATUS BAR, you will see an address. This is the physical address in the file.
[End Quote]

Do a little more research on these issues and you will probalby find your answer. The status bar, at the bottom, will show you something like "Code Data @00401234 (the address of the je instruction, not the jump address) @Offset 00000634h in file (whatever). From this example the 634h is what you want. If you are using that type of offset already, it is probably packed and needs to be unpacked before the file is big enough for the address to still be "in the file." Can't tell more from you question.
Also remember there is a big difference between "634h" and "634" but I don't know Hiew to know whether it explicitly recognizes a hex number from a decimal one.
Regards.
Aerzan
08-31-2002, 05:10 PM
Thanks for your reply, JML

First off, No, I do not know the difference between VRA and Raw offset addressing. Most tutorials I read simply state to open the file with W32DSM, disassembly it, search for the Registration Unsuccessful text, scroll up and look for the first je or jne you see, write down the offset address, open Hiew, Hit F5 type it in, and then change 75 to 74, or 0F85 To 0F84 or vice versa. Then they state that the program should be cracked. Not one that I read explained anything about VRA or Raw addressing.

I have tried this with many programs, and it proved to be inaffective. Don't criticize my "Newbieness" but I have not cracked one program in all the attemps that I've tried (which is about 10-20).

I have even read tutorials with target programs, and I have not been able to follow them. Most of them that I read, use softice (which I cannot use due to my computer (windows XP)) and the others use programs that I can't find because the tutorials and/or programs are.... (forgive me if I'm being offensive) "outdated".

But I think the real problem is me.

But back to the topic:

I think I found out the problem.

Most tutorials I've read tell me to create a backup copy of the program. So, I right click on whatever.exe, and click create shortcut, and it creates shortcut to whatever.exe. When I'm in Hiew, looking for the program, it lists: whatever.exe, and whatever.lnk.

And I clicked on the backup copy of it to edit it. I'm guessing that that was my mistake. I was supposed to click on the whatever.exe, instead of the whatever.lnk. And I suspect I was getting the "Jump out of file" error message, because the offset code was not located in the .lnk file?

I'm not very good at cracking...in fact, I'm very horrible. but I hope I can learn...someday.

Aerzan
JMI
08-31-2002, 05:38 PM
Aerzan:

We all start as newbies with no knowledge and we achieve some knowledge by reading other peoples works and analysis. No matter how much you have read there will always be more to read and more to learn. Don't be too critical of yourself. There are plenty of others who will fulfill that role for you.:) Even without understanding Virtual and Raw address you went through the steps correctly and it didn't work because you did something differently from what you read in the tut. (made a link file and tried to change that.)

This illustrates something both good and bad about following tuts.They give you a path to follow which leads to a solution. However if the variables change, if that specific version of the software is not available or has been updated, the path might lead nowhere. Second, if you just blindly follow the path, rather than trying to understand the "what" and "why" of what is happening, you aren't actually learning because you really don't understand why it works.

There is a very great amount of material needed to begin to understand how to become a competent reverse code engineer and the more one attempts to shortcut the learning process the less effective one will eventually become. There are certain very basic concepts, like understanding assembly language basic coding and the use of registers and how certain essential API's function that are NECESSARY to have a good grasp of what's happening when you use the tools.

IMPATIENCE is the most difficult issue to overcome. We want to crack program x right now and we don't want to take the time necessary to learn the basics before we jump in, bash it, and can brag to our friends what we've accomplished. It is by the nature of the beast a loooong process and ongoing. Give yourself time to gather the information and keep working and come here when you are stumped. Be proud of the fact that YOU figured out what the problem was, rather than embarassed that you made it in the first place. One of the major ways we learn is by making and discovering our mistakes. Now this is one mistake you wont make again.

By the way, to make a backup copy you want to use the "save as" function and save the "new" copy with a different name you will recognize as your 2nd copy of programx.exe.

Regards.
Aerzan
08-31-2002, 06:01 PM
thanks for your reply. You've been a big help so far.

I am still confused on how to create a backup copy.

Do you simply open the file, then goto save as? This does not work with some programs, such as GMUD. I right click, and I see "run as" but I can't find any Save as, except in editors, such as notepad, wordpad, etc, but I don't think this is the function you were talking about.
DakienDX
08-31-2002, 06:03 PM
Originally posted by JMI
Can't tell more from you question.
Also remember there is a big difference between "634h" and "634" but I don't know Hiew to know whether it explicitly recognizes a hex number from a decimal one.
Hello JMI !

Hiew takes all numbers without a suffix as hexadecimal numbers and they must start with a digit. You can append a "h" but it doesn matter.
If you want to enter a decimal number, you've to append "t" to the number. (Hiew 6.30+)
DakienDX
08-31-2002, 06:11 PM
Hello Aerzan !

JMI is not talking about a right click on the program in the windows explorer, but about the "Save as" function in Hiew. At least I suppose that. ;)

Simply open a file in Hiew, press [Ctrl]+[Num-*] to mark the whole file and F2 (PutBlock) -> filename and leave the offset empty or put "0" in the field.

If you want to do this in the explorer, drag&drop the file in the same directory with the [Ctrl] button pressed. Then you've a file "Copy of program.exe" you can work with.
Aerzan
08-31-2002, 06:16 PM
Thanks Dakien!

I found the drag&drop + ctrl method a lot easier!

Now I can try to crack programs without the fear of messing them up and having to redownload them :D

Aerzan
JMI
08-31-2002, 06:17 PM
DakienDX and Aerzan:

I was having a little brain freeze from lack of food and was indeed thinking of file editors, rather that explorer and/or wincommander and/or drag & file type programs. DakienDX has beaten me to the correct response and enlightened us on how to use Hiew better.

Regards.


need some help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > need some help
PDA

View Full Version : need some help

The Keeper
08-31-2002, 02:21 PM
Hello everyone,

im having some problems with this program, one thing i found weird is that the program doesnt use ebp to reference variables, i see it passing by the stack(esp)

the first part of the algo is:

int z=0;
char final[100]={0};
char table[]="XATSFNH6Y8LP5R47CZMBGJDEKV3UQ9W2";
MD5_CTX context;

lstrcpy(buffer,"$GrkC{s%zCA");
lstrcat(buffer,name);
lstrcat(buffer,"cSW<=j!hmc");
len=lstrlen(buffer);

MD5Init(&context,1);
MD5Update(&context,(unsigned char*)buffer,len);
MD5Final(szHash,&context);

/*
now below is the part im stuck at, i dont understand the MagicNumber procedure, the proc which makes this number seems to be at RVA 00402A24, if anyone could help me with it, funny thing is that there are 4 valid serials but there is no difference between them.

if you've traced into it, please give me hints on how to make tracing better in this kind of program, ida disassembly was very weird, i couldnt see how many parameters were being passed very well and stuff, the tools i have used until now are softice, ollydbg, hiew and ida pro.

*/

for (i=0;i<16;i++)

{
z=MagicNumber(szHash[i]>>0x04);
GetFinal(z);

z=MagicNumber(szHash[i]>>0x0F);
GetFinal(z);

}

GetFinal(int z)
{
char temp[100]={0};
wsprintf(temp,"%c",table[z]);
lstrcat(final,temp);
}

the program im looking at is called NxPowerlite (www.nxpowerlite.com)

Thanks in Advance
The Keeper.
The Keeper
09-03-2002, 06:52 AM
hello,

did i post in the wrong place || noone is interested || i need to put more ?

regards
keeper.
DakienDX
09-03-2002, 10:07 AM
Hello The Keeper !

No, I think it's the right place but perhaps little public interest.

I downloaded the program an veryfied your specifications. Evrything you wrote was correct. (not completely, it's szHash[i] and 0x0F and not szHash[i]>>0x0F, but I think it's just a miss-spelling)

The only thing I can tell that the "MagicNumber" procedure decides if the digit is used for the serial or not. The procedure would generate a 32 byte long serial, but only 25 bytes are expected. So it needs to skip 7 bytes. But always the same 7 bytes are skiped and after a very easy scheme. I won't tell more. Just try it.


Krypton v0.4 unpacking contest :))
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Krypton v0.4 unpacking contest :))
PDA

View Full Version : Krypton v0.4 unpacking contest :))

evaluator
08-31-2002, 08:01 PM
My suggestion:
Lets unpack yado's protector KRYPTON v0.4
Very nice un-PackMe
http://www.lockless.com/products/L02_Krypton04.zip

Here I uploaded my unpacked ArtWork:)
But archive is PASSworded.
Let's make competition in unpacking!!

Who Can!? Who CAN'T???
ZaiRoN
08-31-2002, 08:49 PM
Hi to all!!!
eval: i have moved your last post because the "Krypton 2" thread is only for those who want to play with the crackme.
hope you doesn't mind me :p

anyway, i hope this will be not a race for the first one that will unpack the file correctly but a thread where new trick or any interesting things are explained to all :D

good work!!!

regards,
ZaiRoN
snaker
09-01-2002, 05:40 PM
Strange, I manage to unpack all files I protect but the protector executable seems a bit different.

Eval: How you rip out the code it calls to even after unpacking?
evaluator
09-02-2002, 08:25 AM
"In the beginning God created Analyze"

So, my recommendation is:
Analyze some calls, trace & watch what happens in code section.
For example do analyze far:call at 40110D & then post here your results.
tHE SnaKe
09-04-2002, 01:03 PM
hi evaluator

but what is the pass of u're file??? :confused:
evaluator
09-04-2002, 04:57 PM
Hey:)

I passworded it for kiddy competition!
RULEZ:

So if you also unpack-deprotect it,
1. you canupload also passworded (or send it to me)
2. If your work will at least identical with my,
YOU will reach 1 PLACE. (not me!)

PS.
For info:
I fully unshelled. so you also..for 1 place:)


Good newbie target...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Good newbie target...
PDA

View Full Version : Good newbie target...

cHeCksUm
08-31-2002, 10:18 PM
Well I worked on another good target for newbies (maybe too simple for anyone but the utmost newbie). The program in question is Filescavenger 2.0c. I cracked it in two ways so far. First a simple byte patch and then by simply getting the valid serial. I also am pretty sure I have the whole generate key routine so that it can be keygenned, however I do not have the skills to keygen it .... yet (that's why I am studying C). That is my next aim. If anyone else wants to look at it I would be glad to help if you get stuck.

// cHeCksUm
#FadE
09-02-2002, 04:54 PM
Well Im the utmost newbie (been learning about 3 days now). I know some basic asm, how to use W32Dasm, SoftICE etc. I then read this and thought I may aswell give it a shot. I disassembled it and looked through the string refs buts thats as far as I've really got. I can see a lot of strings that could lead to something but Im not sure which one would do what. I used knowledge from another tut and just tried nop ing out a je but hiew wouldnt let me change it because its read only.

Could you guide me in the right direction please?
#FadE
09-02-2002, 06:52 PM
Well since I posted I got a bit further :)

I got hiew working properly now.
I also found the Invalid License code string. This however only has a bit of code associated with it, no jumps. Just:

* Possible StringData Ref from Data Obj ->"Invalid license code."
|
:0040FAB5 6800264600 push 00462600
:0040FABA B9F8884600 mov ecx, 004688F8
:0040FABF E819980200 call 004392DD

From there I followed the call to 004392E7. There was a jne there so Ive tried changing that to je but it didnt seem to work. The program ran but with blank spaces in various places. Also with that jne changed to je, the Invalid License Code box is now a blank box with no text in lol. Think I went down the wrong path there.
serkul
09-02-2002, 07:18 PM
i didn't try it, but i assume you have to look before the string reference you found.

because at this point you are likely to be already in the "bad guys area".
cHeCksUm
09-03-2002, 06:16 AM
I will post some help as sooon as I get into work :).

// cHeCksUm
cHeCksUm
09-03-2002, 07:52 AM
now I'm at work.... so this is what I did. I loaded up the app in OllyDebug and set a breakpoint just before I entered a code (hint use the following form: 5-4-5-5-5 [i.e. # of digits between "-"]). Then when I pressed OK. Bang I am in the code... now simply trace over until you get the pesky "Invalid Serial" box. Now just examine the code above and you should, providing you keep a close eye on the code, be able to pretty much figure out where to patch (hint: much easier not to patch actually). If you need more help just hollar.

// cHeCksUm
NE1
09-03-2002, 01:19 PM
Fade,
You do not need to change instructions to NOP's or change JNE's to JE's, etc. That usually would be your last step when you are sure you found the right place to patch, and only if you know what you are actually changing (i.e. changing one instruction does not always only effect that one instruction). Instead you should set your breakpoint in Softice on the jump you want to test and then just toggle the flag that is being used for the test (type "r fl z" in softice for the zero flag (without the quotes)), then exit softice and see if you got the result that you expected. When you do finally find the right jump, etc, I also would not change the jump instruction, but instead the compaison instruction (depending on the case), so that the comparison always gives the result you want (this way it works all the time, whereas changing the jump instruction, would make it fail when the right serial is used, etc.).

Example:
84C0 test al, al
0F8477010000 je 0044C275 ;jump if bad serial

The Test instruction AND's the values and sets flags based on result. As it is AND'ing a register with itself there are only 2 possible results.
0 and 0 = 0 or
1 and 1 = 1
What we want here is to never take the jump (the jump is basically, jump if the result is zero), so we need the result to always be 1 and not zero.
So if we change the code to this:
0C01 or al, 1
0F8477010000 je 0044C275 ;jump if bad serial

The possible results are this:
0 or 1 = 1 or
1 or 1 = 1
Thus always resulting in 1, and never taking the jump.
In addition to this, the OR instruction takes this form:
or dest, source ;dest := dest or source
Thus the destination register is assigned the result of the OR comparison, and in this case is set to 1 as it should be (as it would be if the correct serial was entered).

Anyway, that is just an example...

When dealing with easier protections, your best bet is to try and see where the serial number you entered is compared with the real serial number (if there is such a comparison being done, i.e. easy protections), then you do not have to patch the software at all, as you will always know where to find the correct serial number to use for whatever name you use (and then you are on your way to making your first keygen).
Manko
09-03-2002, 03:24 PM
Originally posted by cHeCksUm
use the following form: 5-4-5-5-5 [i.e. # of digits between "-"]).

// cHeCksUm

5-4-5-5-4 was right on my machine....

/Manko
#FadE
09-03-2002, 04:37 PM
Okay, thanks to cHeCksUm and NE1. I didnt realise that I should be using softiCE to crack this app, I was just browsing through code in Wdasm and hiew and modifying some je and cmp's. I should be able to do it from here, thanks for the help :)
#FadE
09-03-2002, 07:46 PM
Hmm, I got filescav.exe open in Ollydbg but Im not sure where to place the breakpoint. Bear with me as Im still learning debuggers :)

Would you find the serial code or just run the app, type the serial then breakpoint so it traces...

The only thing I dont get is the interaction with debuggers and programs. Do you run the debugger first, set BP's then run the program or vice versa??
cHeCksUm
09-03-2002, 08:00 PM
@ NE1
>>You do need need to change instructions to NOP's or change >>JNE's to JE's, etc

No I do not agree with that as the correct serial can be found (easily) thus rendering a patch useless, as you suggest later on as well.

@ NE1:
>>I also would not change the jump instruction, but instead the >>compaison instruction (depending on the case), >>so that the comparison always gives the result you want (this way it works all the time, whereas changing >>the jump instruction, would make it fail when the right serial is used, etc.).

I do not agree completely with the above. What if you change a JNE or JE to a JMP or NOP. Then this will always work no matter if you enter a correct serial or not. However I do agree that it could be better in certain circumstances. For example if the program has multiple checks and uses the value for multiple other things. Then changing the compare so that the value always ended up as TRUE/FALSE would be preferable. I like to patch as little as possible.

@ Manko

Ooops... Careless of me.... I thought (or rather didn't think) that all it was 5-4-5-5-5 for all systmes :(. One should be careful what one says so as not to mislead the seeker of the advice.... my bad.

@#FadE

Softice or OllyDebug. Whichever you prefer. I find OllyDebug nicer to work with as it has a better "overview" of all the data. However I would suppose more experianced crackers would appreciate softice more as it seems more resiliant and stable (by resiliant I am refering to the problems with breakpoint checks I had with OllyDebug in a previous crack exercise). Just hollar if you need more help.

// cHeCksUm
cHeCksUm
09-03-2002, 08:22 PM
You need to set the breakpoint before you click on the ok button. However some programs you can break on by just typing the number... so no need to press the ok. If you set it before you start the application you will get tons of breaks as the program runs... and your not interested in those (now anyhow). In every case though you need to first set the breakpoint. Some more useful tips are:

To set a breakpoint in OllyDebug on a certain instruction simply highlight that instruction in the code view screen (ALT-C) and press F2. To highlight an import (MessageBoxA, GetDlgItemTextA, HMEMCPY etc.) Press CTRL-N when you have opened the program in OllyDebug and are on the code view screen. To later enable or disable certain breakpoints go to the breakpoint window (ALT-B) and right click on the breakpoints (or simply press space).

There are several "good" functions to break on when searching for serials. The above are just three examples. You really need to read some more tutorials on cracking and you'll quickly learn when and what to use.

When you break on a function you need to understand somewhat what it is doing. For example if you break on a string compare function you might land in/near the serial itself and might not need to trace so far. If you set on for example MessageBoxA you will most likely need to trace to and through the first RET call so as to land closer to the good/bad boy JMPS or compares etc. This I find is one of the harder parts of cracking (exept for understanding what the assembly lang. is telling you) as sometimes you do not fully understand why or when a certain function is called. Hope this helps you some more. Good luck cracking.

// cHeCKsUm
NE1
09-03-2002, 10:25 PM
cHeCksUm,
Ooops, that is supposed to read:
You do NOT need to change instructions to NOP's or change >>JNE's to JE's, etc

I will edit it, and correct it, so as not to confuse people.

As for changing the comparison routine, as I said, it depends on the specific case. As for NOP's, yes they do work, as long as you know how to use them correctly. In my example: I exchanged a 2 byte instruction with a 2 byte instruction, and therefore no other lines of code are affected. That seems better to me then changing a 6 byte conditional jump to a 1 byte NOP (or 6 NOP's).
I guess as long as you know what you are doing, it does not make that much of a difference. I mainly wanted to offer another option, as most tutorials just tell you to NOP away, and often don't even bother to explain to you how to do this, and what effects it might have on the rest of the code. With tools like Ollydbg (which wasn't around when I first starting learning this stuff), which fills the NOP's for you, it is not as bad as it used to be (i.e. Doing it inside Softice, when you are still learning and are not completely sure of the consequences of changing the instruction to a NOP, and then watching all the lines below change, and then the program crashes, and you don't know what you did worng, etc, etc). Anyway, you make a good point as well, and all options should be considered, and anyone of them can be better than another depending on the situation.

FADE
Ollydbg is fine. I only mentioned Softice because you mentioned it in your first post.
I know some basic asm, how to use W32Dasm, SoftICE etc.
th_snake
09-05-2002, 04:54 PM
Hi
At first i couldn't belive it, but i keygened some by my self.
The tutorials i used was written By ShAdE, and can be found at my site, at "Shades memorial section". All needed tools are there as well.
Also, all the keygens at my site includes all the resoueces etc needed to get the idea. You can see the original asm code from program plus the changes i've made.

Can be found here (http://snakepage.cjb.net)

Download the tuts, learn them, do the exsample, and you're almost there.

You can do it
cHeCksUm
09-06-2002, 02:30 PM
ok... thanks for the tip. I'll have a look at it later as at the moment I have enough new stuff to learn ;). Also I am learning to code C properly (need some new *nix stuff sowhy not code it myself..).

// cHeCksUm


remote anywhere 3.8.26 troubles ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > remote anywhere 3.8.26 troubles ???
PDA

View Full Version : remote anywhere 3.8.26 troubles ???

theeta
09-01-2002, 07:37 AM
hey there all ......something strange is happening here.......in this prog remote anywhere 3.8.26 (a trial copy which can be obtained frm *links not allowed*) i located the serial making+checking routine at offset 004083da. now inside this call the routine that calculates the UseKey from BiosKey is at offset 00414ab2. the entered UserKey and calculated Userkey are compared between 00414ad8 - 00414b20 in a loop....which runs 8 times....comparing 2 bytes a time....
so i noted down the right key and then entered it again in registration box....but oops again the same "wrong key" box pops up....so i decided to check up the comparing once again .....what i found that the program compares both (same) keys and still gives me the error box....:-(
what possibly could be the reason ?? any help will be really appreciated ....

some data that i would like to mention here.....

The MAC no. of my machine - 44 45 53 54 00 00 ( dial up )
the BiosKey for my machine - KJM3 - JMOL - NXVA - BNLW
the UserKey i got - EBSCA - QYKW - KWYT - 6HV2

thnx in advance

theeta.

ps - all the offsets i have mentioned above are of ds.exe(directory server)......
theeta
09-01-2002, 06:38 PM
correction:

The key i got was EBSC - AQYK - YWTJ - 6HV

sorry for that typo..;-)

thnx.


how can i creat a packer?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how can i creat a packer?
PDA

View Full Version : how can i creat a packer?

bytexus
09-01-2002, 10:23 AM
Where can i find some documentation about packing pe files? I'm very interested in this subject.What knowledge it is suposed to have and how does the process works?
DakienDX
09-01-2002, 10:48 AM
Hello bytexus !

Try to read as many documentation of the PE file format as you can get. You'll need to understand the PE format nearly perfect before you can start.

Very good knowledge of ASM is also an important point as well as knowing what you can do on different operating systems and what not.

First you should start with a simple encryptor (maybe XORing every byte by 01h). Go over to compression later when the encryptor works. If I remember correctly, PeSentry and Stone's PE Encryptor come with source code so you can look how they work.

Since I'm sure you can't write a compression algorithm right out of your hand you should look for some free compression library like JACLG1 or aPLib.
bytexus
09-02-2002, 10:36 PM
Thanks for your answers. for he moment i've found some references to pe format,i've found jcalc compresion library(by jeremy collake PeCompact i think). My question is how do i do it? If i can tell in some small detail in some regular terms(i don't have a lot of knowledge for the moment) the exact steps that you got to make to create a packer.
cyberheg
09-03-2002, 06:24 AM
Like DakienDX said without knowledge of PE you won't get far.

However the basic steps are as following:
I'd rather call it tasks and not steps since one task can involve alot of coding. In my research a proper packer could easily become many many many thousand codes of lines so depending on how proper code you write even a simple initial packer could become a few thousand lines.

1. Write a file processor which will append your loader to the target. The target is the program you want to protect. This processor should add a section, append loader, process relocs, process import directory, encrypt/compress the other sections of the file and ofcourse remap the entrypoint.

2. Write a simple loader. This should be relocation free (VERY VERY IMPORTANT). This can be done either with delta setup or making a reloc section for the loader and remap the reloc directory info to the loader. Then it should decrypt/decompress the target sections, load imports and fix relocations.

So now you got the needed tasks to do it. Again if theres anything you don't understand of what I've written most of the words can be looked up in any PE document, I recommend Luevemeyer.

// CyberHeg


IDA & argument propagation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA & argument propagation
PDA

View Full Version : IDA & argument propagation

tom_324
09-01-2002, 08:25 PM
How to propagate argument names to called function in IDA?

C like examlpe:
int f1(int a; int b)
{
f2(a,b);
}

Now, when I rename parameter 'a' into 'vendorcode' how to propagate new name through f2 function and its called functions?

Kernel option2 'propagate stack argument information' and 'reanalyze program' does not help.

Tom
bsod
09-01-2002, 09:17 PM
Edit -> Function -> Set function type
tom_324
09-01-2002, 09:40 PM
Thanks for the reply.

Yes, that renames stack arguments through function f1 but NOT through function f2. So it helps, but does not propagate arguments to called functions. Any other solution?

Tom


Driverstudio 2.6 and Windows XP SP1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driverstudio 2.6 and Windows XP SP1
PDA

View Full Version : Driverstudio 2.6 and Windows XP SP1

Snatch
09-01-2002, 10:54 PM
Yes folks at winbeta.org they have seemed to get every leaked build and build 1106 of winxp sp1 is now gold. I just downloaded it. I am wondering how SP1 will be in respect to Driverstudio and Softice. Any information is appreciated. Until then I uninstall it all and dont put it back on until the OK message. Cuz I cant afford to have this computer messed.

Snatch
UrgeOverKill
09-03-2002, 03:31 PM
Actually I installed it and just used sice last nite w/no problems. I installed most of the updates when they came out and had no probs. You just have to change your key though. hehe....
Snatch
09-06-2002, 07:49 AM
Well now that I can get it from Microsoft Premier Download I decided to get it. It actually was identical to the leaked version byte for byte but hey if Microsofts version messed my computer up they are liable better safe than sorry ;). Not like the giant cares they have a legal department larger than most small business sizes most likely hehe.

Anyway with SP1 yes Driverstudio 2.6 works and *gasp* my computer didnt lock up on boot. Thats honestly why I was afraid eheh. Well of course now I need new symbols which I will wait a week or so on. And hey DriverStudio 2.6 doesnt work still too. Some things dont change. The exports are still resolved to wrong addresses losing the high order word and the selector is messed. I wish I could get my hands on 2.7.....

Snatch
UrgeOverKill
09-06-2002, 09:03 PM
I wish I could get my hands on 2.7.....

No probs, if I can help w/sice working w/XP let me know. Do it here almost daily and *when* I get a copy of 2.7 or is it 3.0......<hint:hint>.....I'll slide one your way. ;)
Snatch
09-06-2002, 09:28 PM
Maybe we could start a project to reverse DS 2.6 and find out why it is mishandling exports and patch it ;). It would be in the Softice load code. I am not going to hold my breath on 2.7 or 3.0 because it seems for once the community has a lack of caring about the tool or it would be floating already. Numega is not Datarescue. They dont try as hard.

Snatch


the tale of the virus and the headers (help)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > the tale of the virus and the headers (help)
PDA

View Full Version : the tale of the virus and the headers (help)

mancini
09-02-2002, 02:28 AM
recenty i was infected with the W95:Weird.10240 virus
what can i say .. it infected only and all my exe files
having only AntiViral Toolkit Pro with virus updates i made the mistake of letting it desinfect the files

And now most my executables that were installation packages are broken
Installshield ones i rename to .cab, the msi ones to .zip winzip ones the same......and the rest all work if i remove the zeros and/or update the crc so i can use them after all and some installation packages still work without any fixing
BUT the WISE ones are defintely ruined and the AnalogX packages... well they are way too strange
(all sections have a 00000000 virtual size and have 2 nonstandard sections)

Strangely tho' all the rest of my noninstaller executables includding ones packed with a executable packer work fine

this are the differences between the way my .exe files looked before and how they look now
(the first 4 are as they occured to xns3.exe and netscan.exe as example ... anyway . they are both WISE installation packages)

-1-the Size of Image changed from (xns3.exe 00006000 to 00074000)
(netscan.exe 00007000 to 00181000)
-2-the Resource Table Size changed from (xns3.exe 00000640 to 0006E040)
(netscan.exe 00000640 to 0017A440)
-3-the Virtual Size of the last section changed from (xns3.exe 00000640 to 0006E200)
(netscan.exe 00000640 to 0017A600)
-4-the Raw Size of the last section changed from (xns3.exe 00000800 to 0006B603)
(netscan.exe 00000800 to 00177A01)
-5-the Characteristics of the last section changed from (all exes 40000040 to E0000000)
-6-the .exe files got a random number of EOF extra data zeros
-7-the .exe files got a wrong CRC check
(.rsrc is allway the last section in the case of installs)

So now i have to spend who knows how manny nights and days asking and learning and trying to find a way to fix my executables back

Kapersky lab who makes AVP keeps putting me off and has no intent of helping me and PE Explorer, the only software i found to fix most of the problems automaticaly, also breaks executables if they are installation packages and they too care not bout my emails.

Now ..obviously i can fix the crc, remove the zeros and change the characteristics
but still remaining are the first 4 problems ... i can update them too of course but i dont know with what values
so i allready almoust finished a program that batch fixes the last 3 problems and i think i can write one to do the same with the first 4 ... change the values that is but i dont know how to make it calculate the values for each file it finds in its batch list.
my best bet is that it aint even possible and i need to manualy calculate that but there must be a way

does anyone have any ideeas about this or about the general problem ?

look in the zip above for screenshots of the full headers of the files
JMI
09-02-2002, 04:33 AM
mancini:

Since I'm in charge of nagging about searching, I did a quick google with "W95:Weird.10240" and there are several companies who claim that their software can "repair" the effects of this virus. Both Panda Software and McAfee make this claim, but I have had no reason to test their products on this virus.

The McAfee site makes this claim:

Removal Instructions
All Users:
Script,Batch,Macro and non memory-resident:

Use current engine and DAT files for detection and removal.

PE,Trojan,Internet Worm and memory resident:

Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner:

SCANPM /ADL /CLEAN /ALL

Maybe the software from one of these companies could help fix the damage. Might be worth a try.

Regards.
mancini
09-02-2002, 04:52 AM
man
im sure youmeant good
but
didnt you see :

"having only AntiViral Toolkit Pro with virus updates i made the mistake of letting it desinfect the files"

that shitty antivirus allready desinfected my files and messed them up further more even

do you undertand now that the idea of running a antivirus on a executable with no virus but a broken pe header is . well not bright ?
Kayaker
09-02-2002, 04:58 AM
Hi Mancini, that sucks bigtime. I got hit with the Weird virus a while back, from code I knew but got infected on another persons system. I was lucky in that I was doing testing on the code at the time and noticed a slowdown and strange behaviour from my system and HD as the virus was rewriting exe files. I was able to stop it somehow and it "only" infected a few hundred of my files.

I'm just looking at a Wise installer package here, and can see that for this particular target the .rsrc section as reported by a PE editor is virtually only the Icon/GroupIcon of a regular PE file. The rest of the section is the installation resources that are loaded from code into windows/temp and are huge in comparison. This section isn't defined in the PE header as part of the loadable resources nor is it included as part of the ImageSize from the looks of it.

After AntiViral Toolkit got through with cleaning up the files it must have used the true file size to base the ImageSize on, and rewrote the .rsrc sizes in the PE header wrong. You might be able to find the start of the .rsrc section, the raw offset hasn't changed, and select a block size into the resource that includes only the default resources present. i.e. for the Icon/GroupIcon section mine seems to be 400h bytes in size. The end of the section should be recognizable as being zero padded. It isn't critical to replace the exact original value of VirtualSize of the rsrc, so 400h for VSize and RSize should be OK. The ending point should also be the "perceived" ImageSize that you will need to restore as well. I'm not sure if the AnalogX packages are the same, but maybe you can use this information.

Regards,
Kayaker
DakienDX
09-02-2002, 11:04 AM
Hello mancini !

I had a virus some time ago too. I don't remember its name but it did "nice" work. About 350 .EXE files where infected.

I even had "looked" at the downloaded file, thought "protecting an installation package with a selfmade Xor encryption, how imaginative" and executed it. It took a bit too long to load the small file. So I tried notepad, which took also about 5 seconds, and pressed RESET. :D

So I set "BootGUI=0" and started the whole thing from DOS. I used NAV with the latest virus-definitions, rebuilt one file which I had in infected and original form, compared them and said "no way".

I had the same problem you have with the WISE installers.

A normal WISE installer is a stub, with some user-set versioninfo in the .rsrc section and an appended installation package. They use the file-size to check if they have been modified.

However, this makes it impossible to digitally sign the installation files. So they've invented a new stub. The old installation .EXE is placed as whole in the .rsrc section of the new stub. So a digital signature can be appended after the .rsrc section.

So here is the solution. Since the (signed) stub was infected and was repaired, the real installation program is still unaffected in the insided of the .rsrc section. So you only need to extract it from there.

Use a hex-editor, find the second occurence of "This program cannot be run in DOS mode", go a few bytes back to the "MZ". Start there and save the data until the end of the file. Run the new .EXE. If it runs you're lucky, else you'll have to find and remove the digital signature. It starts with a DWord telling how long it is (=how long to the end of the file). So start seaching at the end of the file and go back. Truncate the file when you've found it.

(I was able to restore about 250 files from backups, so I had to repair the other 100 by hand. It took me about two weeks.)
mancini
09-03-2002, 12:09 AM
first of all i need to note this:
(i have mispeled W32:Weird.10240 as W95:Weird.10240 in my first post)
anti viral pro reports the virus i had as W32:Weird.10240
panda antivirus reports the virus i had as W32/Weird.10240.B
norton antivirus reports the virus i had as W32.Weird (G1)
sophos antivirus reports the virus i had as W32/Weird-10240
mcafee antivirus reports the virus i had as W95/Kuang.GR

As part of its infection routine the virus drops a randomly named file with a size of 10,240 bytes hence his name

more info about it:

It is not a dangerous memory resident parasitic Win32 virus. It writes itself to the end of PE EXE files (Windows executable) by increasing last file section and modifying PE header fields. The virus copy in infected files consists of two parts. First part (starter) is a short routine (about one kilobyte of code and data), the second part is the main virus code (about 10Kb of size) encrypted with silly encryption loop.

When the infected file is executed, the starter takes control, decrypts the second part of virus code, drops it to Windows directory as a PE EXE file with random name and executes it. The main virus instance stays memory resident as a hidden Windows application, runs a low priority thread that periodically scans drives' directory trees, looks for PE EXE files and infects them.

DakienDX it must be that you got infected by a different version of the virus or i have wise installs of a different wersion because i cant find in not a single wise installer 2 occurences of the string "This program cannot be run in DOS mode" but only one

i am working on the ting and hopefully ill get to the end of it
nedless to say i am very thankfull for all your guys imput and Kayaker
the .rsrc raw offset brings be at the start of a file info string that is between 2 zero paddede areas and that seems quite strange

anyway im a litle confused now but ill sort it out and hope i can count on your help again at a later time when i will have some progress
DakienDX
09-03-2002, 08:36 AM
Hello mancini !

I never said I had the same virus. The one I had was not memory resident. On execution it infected either .EXE files in 75 directories or 300 .EXE files, depending what limit was reached first.

The WISE installations I had were signed, so there was the signed stub I described. The ones not signed had still the same stub.

I used DOS to find out how the virus worked. The first API it used was GetCurrentDirectory, so I patched my KERNEL32.DLL to compare the instructions at the calling address for the virus pattern and if they match, jump some bytes further to the jump back to the program's OEP. (skip the "virus" part) So I could repair the files under Windows.

The manual file repairs I did were really hard. I had to look for an uncorrupted copy of programs using the same compiler/installation system/packer/... and compare the differences. Sorry I can't help you more, but it's hard to handle with this kind of things.
RaX
09-11-2002, 10:44 PM
I even had "looked" at the downloaded file, thought "protecting an installation package with a selfmade Xor encryption, how imaginative" and executed it. It took a bit too long to load the small file. So I tried notepad, which took also about 5 seconds, and pressed RESET.

DakienDX, that's the saddest thing I've ever heard.
You need something to do in your free time ;P
DakienDX
09-12-2002, 12:09 AM
Hello RaX !

Maybe I download me a virus and execute it every month to have something to do something in my free time. ;)

Oh, wait, I'm already visiting the board in my free time. Shall I send you any virus I download instead?
(don't worry, this was the first and last virus I ever got)

Just one rule makes sure you don't get a virus: Don't execute suspicious files you download for friends without an internet connection. ;)

Now my software installation packages are all called "*.EX&". :D


Data structure for big Integer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Data structure for big Integer
PDA

View Full Version : Data structure for big Integer

jjhsd
09-02-2002, 12:04 PM
Hi,

I plan to code a program to simulate RSA encryption. I am using JAVA but do not want to use the inbuilt Big Integer Class. Could anyone advise me how to store the large integer? (> 100 digits) and how to write the function which do the same as pwoerMod.

thanks a lot!

C
Artifex
09-02-2002, 04:16 PM
If you change your mind and accept to use the BigInteger class (and its modPow(e,n) method) you may have a look to this web page :
http://homex.coolconnect.com/member2/wailian/QuickStartRSA/

Loading that page you will load a RSA.java file which you may read.

I attached that page, another interesting java source (publickey.java) and a javascript implementation (rsajscript).

Artifex
jjhsd
09-03-2002, 12:55 PM
the problem is that using bigint class will lead java code that i've written can not immigrate to another language in the future, which doesn't have bigint class ready to use. (the code has to be rewritten.)
Artifex
09-03-2002, 02:00 PM
After tasting Java for your simulation you won't want any other language ! :)

I can hardly understand why you want to use Java, and only a part of the Java language... but it's up to you.

If you want to try to re-invent the wheel (I mean BigInteger methods), you will have to store your long integers in strings and write an addition and a substraction routine. With them you will be able to emulate modpow(e,n). I would understand it 25 years ago, but nowadays... ? In the midtime very smart guies worked for us.

I prefer Java, but you could write your simulation in C and use Freelip or MIRACL libraries.

Artifex
jjhsd
09-04-2002, 08:05 AM
thank you for your reply. i think i can check Java's biginteger class for representing large numbers. but how about mod arithmetic? could you please kindly provide me an effective algorithm to compute mod?

thanks in advance. ;)
Artifex
09-04-2002, 11:05 AM
The Java BigInteger class has all methods to compute mod arithmetic.

If you don't want to use them :confused: (!!!???) you will have to do the following :

A power is a succession of multiplications
a multiplication is a succession of additions
a division (or a modulo) is a succession of substractions.

You know that.

So you store the big integers in strings.
You extract each character (=figure) of the first string and add (or substract it) with the corresponding character (=figure) of the other string, and create a third string with your results.
"123456789...........123456789"
+
"123456789...........123456789"
---------------------------------------
".........................................578"

and so on... and so on...in a loop.

Each compute is a one figure compute.
It is up to you to choose to work in radix-10 or radix-2

I keep it short because we are off topic.
You could get better information on a programmation language forum.
Good luck.

Artifex
jjhsd
09-05-2002, 12:10 PM
thanks for your help, i will try it! :D
Artifex
09-05-2002, 03:15 PM
I attached a few lines of C. If you compile them you will be able to compute instantly a two big integers product. The method is not the addition method, but the way we multiply two numbers on a blackboard.

Here are two runs :

First big integer ?
123456789123456789123456789
Second big integer ?
123456789123456789123456789
gave the result :
=15241578780673678546105778281054720515622620750190521
or
First big integer ?
123456789123456789123456789123456789123456789123456789
Second big integer ?
123456789123456789123456789123456789123456789123456789
gave the result :
15241578780673678546105778311537878076969977842402077577351019811918920046486820281054720515622620750190521

If it is not correct you may want to debug them !

The division is a bit more tricky.

Smart programmers spent months trying to improve their biginteger routines. With the way you decided to work you will spend more time testing your computation routines than yours rsa simulation ones !

Enjoy yourself !

Artifex
jjhsd
09-06-2002, 02:02 AM
Thank you so much for your great help! I will check the attached source code. :)
Artifex
09-06-2002, 05:59 AM
I edited the source in order to make the draft a little bit clearer.

Artifex


Any info on the Softice SIWTR command?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Any info on the Softice SIWTR command?
PDA

View Full Version : Any info on the Softice SIWTR command?

Kayaker
09-03-2002, 06:56 AM
There's a Softice command that has very little information about it - SIWTR. It seems to be a Trace Buffer that you can turn on and off. The SI command line help is little use:

:h siwtr
ce buffer (don't know why it's called this in the status bar)
SIWTR [name | handle] [ON | OFF]
ex: SIWTR tb-name ON

:siwtr
Handle Name State
0000: SIW95 ON
----------------

At the beginning of the procedure handling the SIWTR command in winice.exe are 3 error strings which give a little more information about the command:

:C00B0364 aOnlyNamedTraceBuffersCanBeTurnedOnOff db 'Only named trace buffers can be turned on/off',0
:C00B0394 aInvalidTraceBufferHandleX db 'Invalid trace buffer handle: %x',0
:C00B03B4 aErrorDisplayingTraceBuffer db 'error displaying trace buffer',0
...
:C00B03D2 sub_0_C00B03D2 ; Beginning of main SIWTR procedure

Within the long routine are potential calls to other error strings defined at the end of the proc:

:C00B060C aHandleNameState db 'Handle',9,'Name',9,'State',0
:C00B0620 aBufferHandleXIsNotInUse db 'buffer handle: %x, is not in use',0
:C00B0644 aInvalidTraceBufferParameterS db 'Invalid trace buffer parameter: %s',0
:C00B0668 aUnexpectedParameterS db 'unexpected parameter: %s',0
:C00B0684 aExpectingOnOffNotS db 'expecting on/off, not %s',0
:C00B06A0 aUnknownOptionS db 'unknown option: %s',0
:C00B06B8 aSystemMemoryAllocatedForSBase0xXSizeDk db 'System Memory allocated for %s: base=0x%x, size=%dk',0
:C00B06F0 aScopeTableInaccessible db 9,'(scope table inaccessible)',0
---------------------------------------------

There are the backtrace and the history buffers, defined in winice.dat, and likely several internal ones, but I can't figure what this one might be used for. Turning the state of the buffer called "SIW95" ON or OFF doesn't seem to affect the behavior of the Backtrace buffer or its trace mode, breakpoints and tracing remain normal, I'm not sure what else to check.

This may be a remanent of an earlier version of SI, or some debugging function or something, but I've been able to find no references whatsoever about it. It's likely one of these virtually undocumented Softice commands, but I just thought someone may have come upon it before or has any ideas what it might refer to.

Thanks,
Kayaker
[yAtEs]
09-03-2002, 11:13 AM
http://www.woodmann.net/IDArchive/ID-RIP/database/essays/lordsoth/SI-adv.htm

this sprung to mind, although you've probably seen it and
there doesnt appear to be any mention of that command
at a quick glance.
UrgeOverKill
10-04-2002, 08:33 PM
Kayaker, what ver are you using ?
disavowed
10-04-2002, 09:19 PM
Originally posted by [yAtEs]
http://www.woodmann.net/IDArchive/ID-RIP/database/essays/lordsoth/SI-adv.htm

why is the charset for that in hebrew? :)
hobgoblin
10-04-2002, 10:12 PM
I think Lord Soth speaks Hebrew...

hobgoblin
Kayaker
10-05-2002, 04:29 AM
Interesting use of View html Source disavowed...;)

I'm using v4.05(334) on Win98SE UrgeOverKill, though the SIWTR command exists in winice.exe seemingly unchanged at least as far back as v3.25. I'm not sure about the newer DriverStudio versions since I don't use them, maybe someone could type in 'SIWTR' and see what is spit back. It's rather tantalizing to read the strings and think there's a Softice function you can allocate a base and size for in system memory and define a named trace buffer. And what the heck is a Scope Table? I've been meaning to enable breakpoints within Softice and do some live tracing of this function but haven't got around to it yet, though you've spurred my curiosity again.

I've discussed before an easy trick for finding *any* function in Softice using IDA (Debugs debugger's int handler thread with Dion in the TOT forum), but I'll mention it again for interests sake. It's based on the old BCHK Boundschecker interface built into SI. Every command you type into the SI window goes through a central jump table, even if the command itself isn't supported by the 'BCHK' set of instructions (by my count by analyzing the bitmask string, only 38 of them are).

Each SI command is defined in winice.exe as a null terminated ascii string, followed by an Index value. This index value is compared in a BT (bit test) instruction, ones which match the bitmask test are allowed via the BCHK command, and the index value is then used as an index into a jump table which leads to the function call itself. Ones which don't, go elsewhere but the jump table can still be used to find *any* of the Softice functions. The bitmask string itself is hardcoded into winice and can be found by searching for the dwords immediately after "BCHKWPV.table r".

As a general example, if you search for 'SIWTR' in winice.exe or with IDA you will find the ascii string and its Index value (82h) used in the BT test:

:C00232D8 db 53h ; S
:C00232D9 db 49h ; I
:C00232DA db 57h ; W
:C00232DB db 54h ; T
:C00232DC db 52h ; R
:C00232DD db 0 ;
:C00232DE db 82h

The Index value is stored in EDX and used in the BT instruction:

====================================
C00813FD BT DS: DWORD_C0081B07, EDX ; check byte against bitmask
C0081404 jb short loc_C0081412
C0081406 mov esi, offset aInvalidCommand ; "Invalid command"
C008140B call sub_C00818F5
C0081410 jmp short loc_C008141B

C0081412 push ebp
C0081413 call ds: off_C0022DC7[edx*4] ; jumps to *every* Softice command
====================================

Now, small digression. The addresses above are for v4.05(334), but if you search in IDA for every instance of mov esi, offset aInvalidCommand (should only be a few), you should find the BT instruction and the jump table call instruction for any version of Softice.

Now the next step is calculating the jump table call address using the appropriate Index value for whatever Softice ascii command you are interested in finding the code for. This is quite simple...

i.e. SIWTR Index value == 82h == EDX

C0081413 call ds: off_C0022DC7[edx*4]

(C0022DC7 [edx*4] == C0022DC7 + (82h*4) == C0022FCF)

:C0022FCF dd offset sub_0_C002A222 ; SIWTR

which leads to

:C002A222 mov esi, offset dword_0_C002142F
; esi is now the string instruction (i.e. "SIWTR") you typed into the command line window
:C002A227 call sub_0_C001F612 ; string parsing routine
:C002A22C push esi
:C002A22D call sub_0_C00B03D2 ; main SIWTR function
:C002A232 retn

That's it. This technique can, as far as I can tell, be used to find the starting code of any Softice function. There is only one caveat if you decide to live trace the code after enabling breakpoints within SI (see the TOT thread for how to do that). Notice the mov esi, offest instruction string line. This IS the actual string typed into the command window, so anything you type in there afterwards, including F8 and F10 tracing key presses, will overwrite that memory address and you will see it happening. Meaning ESI in the string parsing routine will be screwed up! So you have to be very careful with your choices of breakpoints. Choose BPs and do tracing *after* the main string parsing routine is completed, or if that memory address is reused elsewhere.

One more thing, since we're already totally off tangent from the original subject...;-) How to convert the IDA address to a real address you can find in Softice and use the 'd' and 'u' commands for pseudo-tracing? If you type 'VXD Winice' in SI you'll get the starting Address of the first segment of winice.exe. For me this is C002F3A4. So to convert any IDA address I just add 2F3A4h to it.

Try it out with the memory address of the command line - C002142F + 2F3A4 = C00507D3. Now display this address C00507D3 in Softice and you should see exactly what you type into the command line window.

Lol, not sure why I went here, but the question still remains - WTF is SIWTR? :D

Cheers,
Kayaker
naides
10-05-2002, 01:26 PM
When I type SIWTR in SoftIce v4.27, from DS v2.7, I get "invalid command" from the time I type the 'I' character.

It does not exist in the help list either. So it is stripped from the user interface. I will do a little IDA digging, to see if there are traces of its presence in the winice.exe code.
UrgeOverKill
10-07-2002, 10:12 PM
The SIWTR is actually an internal debug log for Numega, and was probably used to 'debug' sice during its updates and such. It serves hardly any functionality to the casual user and I think has been gone since DriverStudio 2.0.

Although its remains on the command list, its pretty much obsolete.

Hope this helps

+UoK


How to Unpack *.msi file?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to Unpack *.msi file?
PDA

View Full Version : How to Unpack *.msi file?

phop007
09-03-2002, 08:14 AM
How can I modify(delete, Insert, Replace file) *.msi without unpack the *.msi file.

Thank in advance.
NervGaz
09-03-2002, 08:54 AM
you could try grabbing M$'s MSI SDK... it contains a few interesting tools...
DakienDX
09-03-2002, 09:02 AM
Hello phop007 !

.MSI files are no archives, they're installation packages for Windows Installer.

They're working basically with the Microsoft .CAB format, but it seems to be a new version since many files can't be extracted.

Just open the file, serach for "MSCF" (header of .CAB files) and dump the file from there until its end.

If you're lucky, you can extract the files. It's possible that they have many hex-digits before the real file name or even only hex-digits and no real file name.

But I would say it's not possible to replace any file in the installation package. The Microsoft specification says that a .MSI package isn't allowed to be modified after creation. And I must admit they do their job prety well.

The only way would be to create a transform package (.MST). You can add files there which are included in the installation too. This ones should overwrite files installed by the .MSI file. But you need to include not only the .MSI, but also the .MST, SETUP.EXE and a customized SETUP.INI with the software.
mutante
09-03-2002, 09:12 AM
Try using *.msi /a
DakienDX
09-03-2002, 09:26 AM
Hello mutante !

I'm sure you don't mean *.msi /a.

The correct syntax is "msiexec /a <file>.msi".

I totally forget that option. But it's possible to lock that option while creating the installation.
foxthree
09-03-2002, 09:40 AM
Double Click the .msi in a RAR package and it will open and display the contents for you :D

Signed,
-- FoxThree
DakienDX
09-03-2002, 09:48 AM
Hello foxthree !

This doesn't work for me. I'm using v3.00 and compressed a .MSI package as .RAR.
When double-clicking on it inside the .RAR it will simply decompress and execute the .MSI file.
TheSearcher
09-03-2002, 12:31 PM
Hi DakienDX,
Tried winrar3 it only displays and extract msi files only.You can't add files using winrar and it only supports zip and rars
foxthree
09-03-2002, 02:54 PM
Yo Dakien!

Try WinRAR 3.00 on RV MSI package and you'll see that it displays the contents and allows you to extract them. This is the way I got to install RV 1.5 on my Win9x.

Signed,
-- FoxThree
DakienDX
09-03-2002, 03:40 PM
Hello foxthree !

It works on .MSI file using the old .CAB file format, like Revirgin.

I tested it on three other files, two using the new format (hex digits before the filename) and one on an even newer format (only hex-digits and no filename) and none of them worked.

WinRAR doesn't handle these files, but the .CAB file shell-extension built into Windows.
h8er
09-03-2002, 10:57 PM
Here is a plugin for Windows Co**ander.. with this you can read msi files
phop007
09-04-2002, 02:07 AM
Thankz everybody!! I found Far Manager(wxx.rarlab.com)+Doc viewer plugin and this very helpful...


kill process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > kill process
PDA

View Full Version : kill process

kalisto
09-03-2002, 09:58 AM
Hi all, I unpack asprotected target, patch two bytes for removing registration and proggy run, but problem I encountered is I cannot exit proggy.
Of course I can kill process with lordPE but it is not best solution. Proggy is 7D Shifter ver 1.0
hxxp://www.7dgames.com. It is cute little game. Any suggestion.
DakienDX
09-03-2002, 10:18 AM
Hello kalisto !

Maybe you would like to share a bit more information.

Why can't you exit the program?
Is the "X" grayed out?
Is the menu entry for "exit" disabled?
Can you exit the ASProtected copy?
Can you exit the unASProtected but unpatched program?
Does the program import ExitProcess or similar?
Are you sure you rebuilt all imports correctly?
Did you have still the same problem after rebooting?
kalisto
09-04-2002, 08:50 AM
More explanation.
Patched unpacked proggy has dialog box with four button help, paste(for pasting reg.key), register and exit button.
All buttons are active (not grayed). When I press exit button nothing happend. You can play game but dialog box dissaperred.
Of course meny exist with two pop up. First has exit options (not grayed). Pressing that exit button proggy disaperred but proggy still runing. I know that because proggy is on lordPE display.
ExitProcess API exist and if you force proggy to ExitProcess API(assembling to jmp ExitProcess) proggy exit.
Asprotected proggy is OK. I probably rebuiled imports OK with imprec with asprotect plugin enabled but I must nop one call to one location otherwise proggy crash but that patch is irelevant and I can exit normal. Rebooting nothing change.
Interest thing is I unpack proggy on win 2000 only with olly dbg ,imprec and PEID for finding OEP.
Finnaly unpatched proggy exit OK but I cannot play.:D
DakienDX
09-04-2002, 09:16 AM
Hello kalisto !

"PEID for finding OEP" ?

You mean you ran the program, dumped it when the first dialog box poped up and used the OEP resolved by PEiD?

My guess would be that the program has already set some internal variables and you dumped them too. So the program doesn't set the variables when running again. (since they're already set) This could mean some variables contain wrong values or pointers.

But if you traced the program with OllyDbg to it's OEP, suspended it there and dumped it then, there should be no problem with this.

If a "Paste" button is present, it's possible that the program uses the ASProtect build-in registration functions. (so nobody needs to enter the long registration string manually) So it could be using values passed by ASProtect to the exported functions. If the ASProtect layer is removed, the exported functions are not called any more and the values are unset.

I don't know more possibilities at the moment.
kalisto
09-05-2002, 09:29 AM
Yes Dakien DX I traced program to OEP provided by PEID (great tool) but also checked with Foxy's OEP finder and it's same. Of course I suspend proggy with famous loop -jmp eip - and then dump with lordPE.
Maybe you should look at program yourself.:D
DakienDX
09-05-2002, 08:24 PM
Hello kalisto !

I've no problems on my PC. I can press all buttons. I needed two patches to get rid of all registration code which nobody needs.

The program uses the ASProtect built-in registration functions. Read in the ASProtect documentation to see how they work.

Normally the program shouldn't be able to run if it is unpacked but unpatched. Try to find the error there and patch it away as well as the next error and the program will run.
kalisto
09-06-2002, 10:22 AM
Hi Dakien DX
I patched (nop) call at 401702 because it jump to asprotect address which dont exist.
FF15 94424400 CALL NEAR DWORD PTR DS:[444294]
and address 00427E9F 74 09 JE SHORT dumped_.00427EAA (74 with 75).
Second patch is neccessery because if it is not patched I can't play. It just completely exit.If I change 74/75 I can play but when I press exit proggy dissapered from screen but still run in memory.
My question is did you remove dialogbox titled "Notice about UNREGISTERED ..."
How you start game. I press exit button or register button ----msgbox---OK.
Did you patch address as I did or something else.
What OS you run. I unpacked on win 2000.
Thanks!
NervGaz
09-06-2002, 10:38 AM
Originally posted by kalisto
If I change 74/75 I can play but when I press exit proggy dissapered from screen but still run in memory.

Sounds like it issues an EndDialog() (or something similar) but doesn't RET from the WndProc so it never get to ExitProcess()... Just a thought tho I might completley wrong...
DakienDX
09-06-2002, 11:05 AM
Hello kalisto !

Yes, I patched the same address at 00401702. But you must not Nop out the call, you must redirect it to the procedure it was supposed to call. (trace into the call while the ASProtect layer is still present and see which procedure it calls)

After that the program thinks it's registered and tries to load the name it's registered to. But this fails also if the ASprotect layer is not present. So you can set the value it tries to load to "0" and see the unregistered message only in the about box (and it runs without any limitations) or you can change the value and set your own registered owner text somewhere.
kalisto
09-07-2002, 07:10 AM
After all I did it. Thanks Dakien DX. I patched 401702 into jmp 401708, then 40170F into jne 401781 and finaly 00401789 into jne 00401816 and works fine. Thanks again.:D
DakienDX
09-07-2002, 08:28 AM
Hello kalisto !

Not they way I thought of, but if it works it is OK.

If you don't remove the ASProtect layer and trace into the call at 00401702, you'll find some ASProtect code which calls a procedure in the main program. Remember this address and patch the unpacked file to call that address instead of NOPing out or jumping over the call.

Then the program tries to read the name it's registered to and tries to get it's length. Since the address points to ASProtected code, it is not valid and will fail. Set the address to "0" so the program skips this part and just shows "Unregistered Version" or redirect this address to some address in the program's memory and put your name there. Then it shows "Registered to: " and your name.
kalisto
09-11-2002, 07:16 AM
Yes you are right. Thanks!.


Typical code sequence for encryption?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Typical code sequence for encryption?
PDA

View Full Version : Typical code sequence for encryption?

d.u.h.a.C.Z.e.k
09-03-2002, 07:11 PM
Is there any typical sode seq that help me to find out what type of encryption algorythm is used in programs? IMHO it doesn't exist but I hope... :-)
DakienDX
09-03-2002, 07:29 PM
Hello d.u.h.a.C.Z.e.k !

Sorry, but as you feared, there is no way to find out what encryption algorithm is used.

You may be lucky and know the program used to encrypt the file because of it's file extension or format. Perhaps this program offers several encryption algorithms/modes/hash functions and saves what combination of them was used in the encrypted file too.

If you can see many blocks of the same size which look the same, you can say that a block cipher with a block size of blocksize bytes was used in ECB mode, but it's also possible that this information is completely wrong and the person who encrypted the data choose special patterns which look like "blocks" when getting encrypted.

But else there is no way to know it. I would consider an encryption algorithm where you can tell that this algorithm was used as "cryptographically unsecure".
mike
09-03-2002, 09:18 PM
See http://www.woodmann.net/fravia/mike.htm for a piece I wrote on finding encryption code.

Once you've found it, tables of constants are your best bet for figuring out what it is.
DakienDX
09-03-2002, 10:48 PM
Hello d.u.h.a.C.Z.e.k !

Yes, mike's way is possible of course too.

I was only fixed to the idea that you have a file or only encrypted data and want to guess the encryption algorithm from that.

Else you can search for algorithm specific patterns/initialization values to get your answer.
mike
09-04-2002, 04:19 AM
Unless the cipher is very weak, DakienDX is right. It's practically impossible to tell that it's not just random, let alone what encryption algorithm it is. For example, you need to analyze something like a terabyte of known keystream of RC4 to distinguish it from random.


tcpip.sys?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > tcpip.sys?
PDA

View Full Version : tcpip.sys?

disavowed
09-03-2002, 08:26 PM
i'm working on modifying how windows (xp) handles certain packets. for example, right now i'm trying to prevent windows from returning a RST when someone tries sending a (SYN-)ACK to a closed port. i'm assuming that this is controlled by tcpip.sys, but i'm not positive. has anyone done any work in this area before?
NervGaz
09-03-2002, 09:05 PM
probably... but why don't you just write your own KMD and intercept the (SYN-)ACK and just drop them? shouldn't be too hard
disavowed
09-04-2002, 01:43 AM
the problem is, despite all the reading i've been doing lately, i've had trouble finding an "easy" (without me having to re-write tcpip.sys or an ndis interpreter or something like that from scratch) way of intercepting them before they reach tcpip.sys (if that is what handles them). i don't see how a kmd would help :)
NervGaz
09-04-2002, 07:15 AM
I'm not sure when tcpip.sys is loaded ie. boot, system or automatic... but if you write a KMD that is loaded before tcpip.sys (providing it isn't loaded at boot) it would be before tcpip.sys in the driver chain, iirc, and as such would intercept the packages before it... or you could write one that simply hooks that part of it and RET's without handling it, in effect dropping it... but that is not so easy...
Snatch
09-04-2002, 07:43 AM
Im very interested in this work too. If I get bored I may track down where in tcpip.sys all the good stuff is. disavowed remember something called IDA Pro. And the other thing called symbols from Microsoft. They make a very powerful pair ;). In fact I got way into plenty of sys files that way.

Snatch
foxthree
09-04-2002, 03:47 PM
Ppl:

Look for documentation on NDIS Intermediate Driver and prepare for nightmares and a heavy dosage of sleepless nites/caffeine....

Signed,
-- FoxThree


PE Explorer reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PE Explorer reversing
PDA

View Full Version : PE Explorer reversing

squidge
09-03-2002, 10:24 PM
I'm trying to find the serial checking algorithm in the program "PE Explorer" by HeavenTools, but seem to be having a hard time. I've DeDe'd the executable, which is in Delphi 3 format (from running PEID on it) and I've got a IDA and WDASM89 listing.

Now, upon select "About" from the help menu, it seems to call a routine at 42CA94 to check if the program is registered or not, and if not, puts up a nag box before the About box. If the program has expired, the nag box changes to a "Buy Info" and "Quit Program" box. This box seems to be created by a routine at 42FB50.

I notice that choosing the registration option and entering bad data doesn't give any clues like "Invalid serial code", but simply calls the same routine as the about box routine calls. Now considering I can't find any code in the registration form for checking or generating any kind of hash or serial, I can only assume it's done each time from 42CA94.

However, even running it through the debugger in W32DASM and through SoftICE, I fail to see any of my text that I previously entered into the registration box in any of the routines prior to the nag-box appearing.

Has anyone got some ideas on more how this program works? I'm not interested in a crack or keygen, but more about where in the program the actual checking algorithm is, so I can create a keygen for it. I can patch the program to be registered, but I'd rather not, and generate a valid serial without modifying the original code.
Timmy
09-05-2002, 01:05 AM
I haven't looked at this prog but sometimes the data you enter is not checked at all but stored in a file or in the registry. When the program is run the file (or registry) is read and the check for validity is carried out before the program loads.
Athlon
09-05-2002, 02:03 AM
There is a tut about this on exetools forum is you can access it :(
squidge
09-05-2002, 08:05 AM
ExeTools seems dead at the minute :(

However, I've found the algorithm, created a valid name/serial pair and tried it on PEX. It registers in that name, but still says it's an evaluation copy! I gone through the code with w32dasm in debug mode, and it seems to pass on all the jumps, then writes out an encrypted file called "pexdata.rdat", which I have figured out the encryption for and can decrypt and create my own "pexdata.rdat" which it accepts, but it still says I have X days left, even though the about box says "Licensed To: myregname".

Due to the obvious an unique XORing on the username, I have found the place where it rechecks the serial on startup, but it seems to pass the checks, so I'm a bit puzzled at the moment.

Will keep looking however. Thanks for the replies.
crUsAdEr
09-06-2002, 04:31 AM
Hi squidge,

I worked on 1.60 long time ago... yeah found out about the key file n the encryption there but as u have discovered, the program still refused to reg... In the end i still had to resovle to patching the damn program... LOTS of patches cos it has so many hidden checks...

i did looked at their website n found out that in order to buy the program, users have to download some files from them so i guessed that the download file will also make patches to the program so that it is registered n there is no way to use a key file or serial number to register the program but that was purely my guess... u can investigate further, i believe that my information might even be outdated but ah well... i remember spending a significant time on this nice proggy :>>... brought back some good memory...

cheers
squidge
09-06-2002, 08:09 AM
Thanks for the info m8, I took another look at it last night and wrote a keygen anyway, so I could check different versions of names (eg, with/without spaces, etc) without tracing the exe for the correct serial every time. They all showed the name in the about box, but didn't reg the program. Sigh.

Also wrote a file reader for the pexdata.rdat file to just see if there was any secret values in there I didn't know about, but after decrypting, all that is stored is the username with the first 16 bytes XOR'd with specific values, and the serial number stored as two 32-bit values.

Tracing through the program I couldn't find anything else about the way the registration worked, so In the end I gave in and patched it.

If anyone wants my "keygen" or pexdata.rdat decryption routines, then just ask and I'll email you the sources. I wrote them in C++ Builder 5.


can't resize or add new section
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > can't resize or add new section
PDA

View Full Version : can't resize or add new section

chitech
09-03-2002, 11:58 PM
Alo

I want to add funtionality to notepad (winxp). I have found where I want to jmp from and now I need a place to add my code. I use LordPe deluxe.

1. use .Code section -> not enough space :(

2. resize last section (.rsrc)
- set Vsize and Rsize to a bigger size.
- set flags to E0000060
- Sizeofimage changes automatic.

Now the program don't start -> Notepad.exe is not a valid win32 application.

3. Add new section -> same problem :(

What am I doing wrong. I have used the "search function" but can't find anything.

Please guide me....Thx :)

Chitech
DakienDX
09-04-2002, 08:36 AM
Hello chitech !

I can't verify this on my own, since the WinXP Notepad fails to load some imports on Win98, but if you add a new section, you overwrite the start of the "Bound Imports" table in the header.

So one possibility would be resizing the .code section and correcting all affected pointers, or moving the "Bound Imports" table some bytes forward in the header and correcting the "Bound Imports" directory entry, so you've space for a new section.

I don't know why you can't resize the .rsrc section. I tried it and it worked. The program still showed my that it can't find some imports, but I think checking if a file is a valid Win32-PE file comes before trying to load imports. ;)
chitech
09-04-2002, 09:44 AM
alo DakienDX

I forgot to "truncate at end of section" Me very bad :(

Thx DakienDX.....(everytime I post a tread u r the first person who answer my questions) :D

See u guys around

Chitech


installshield or msi ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > installshield or msi ?
PDA

View Full Version : installshield or msi ?

The Keeper
09-04-2002, 03:38 PM
hello, i have a program.msi which when launched seems to be a install shield protection, but when i reach the serial part and enter
name/comp/serial and search all HD for *.ins and *.inx nothing is found, can it be the MSI protection instead of the install shield one ? if so any hints, any hints at all is appreciated.

thanks in advance
The Keeper
nikolatesla20
09-04-2002, 06:38 PM
My guess is it's a real life red blooded msi package, which uses the windows installer service.

What I have seen done in MSI installers with reg code entry is a DLL that is in the binary table in the MSI, which gets extracted into memory and run, and the reg code is passed to it to determine valid or not. So you would have to extract the DLL and then you could reverse that to determine how to get a good code.

You can use a tool called "Orca" from the microsoft website to open MSI file databases and modify / whatever you wish to them. Theoretically, you could make it skip over the reg dialog, but this would only work if the program never checks later again.

In numerous books and readings, this is why it is a BAD IDEA to have the installer take care of reg codes or anything like that. BAD !

-nt20
The Keeper
09-04-2002, 07:35 PM
hello

i have extracted the content of the msi file with msiexec /a file.msi
i have the program and i can install it manually if i want but then it wouldnt be cracking, im thinking now, to be sure if its the msi protection or the install shield, i just need to see a pic of how a regbox of a install shield is, this one asks for

Name
Organization
Serial number (format 1111-111111-11)

doesnt this look like install shield ? if anyone got pics of the reg screen of both i'd like to see it =)

there is a data.cab in the same dir as the msi too, i opened it and it has some long name files with hex digits at the end.
btw, i tried to get orca but it is inclkuded in sdk only could u upload somewhere if u have it standalone ?

anything that helps is welcome
thanks in advance
DakienDX
09-04-2002, 08:02 PM
Hello The Keeper !

If you have a .MSI file as setup executable, it's Windows Installer for sure.

All dialogs are completely customizable, so how it asks for the serial number is not the point here to identify it.
(In InstallShield "normal" you can also customize all dialogs)

InstallShield can produce two output formats, the "normal" InstallShield and the .MSI. So two installation can look the same but are still different.

If you can read the .CAB file, it's a Windows .CAB file, so it's Windows Installer again. (InstallShield "normal" uses .CAB files too, but they have nothing in common expect the extension)

The MSI SDK is about 7MB and Orca is about 2MB, so why should anybody download it, unpack it and upload Orca somewhere seperatly?
The Keeper
09-04-2002, 08:51 PM
Hello Dakien,

i've clicked to download the sdk and it tells me

Confirm Install Selections

--------------------------------------------------------------------------------

Download size: 43.4 MB
Install size required: 92.4 MB

Drive space available: 0 KB Download Time: @56.6 1 hr 46 min
@256 23 min
@1536 4 min

where can i get this small one ? :) thanks again, so its msi, anyone ever reversed the serial scheme of a msi installer ? any hints are appreciated now, all my bp are failing but i dont think i should debug the msi virtual machine and yes the "place"(dll?) which generates the serial

thanks in advance
Keeper
DakienDX
09-04-2002, 09:35 PM
Hello The Keeper !

Here's the direct download link to the file.

http://msdn.microsoft.com/msdn-files/027/001/457/IntelSDK.msi (8670KB)

Maybe you found the wrong SDK with the search function.
NervGaz
09-04-2002, 09:49 PM
actually as soon as the sdk is installed orca.msi is laying around on your harddrive... unless you remove it of course... if anybody feels more like grabbing orca at 2.4MB the the full SDK at 8.6MB (atleast the one i have... you can grab it from http://nervgaz.ath.cx/Orca.msi
The Keeper
09-05-2002, 01:19 AM
hello,

thanks dakien, nerz, niko

any of u guys know how to identify where a dll ends ? i found where it starts by the MZ but not where it ends..i believe that its with 00's but if any of u know a way that i can be 100% sure that i reached the end of a dll :)

regards
keeper
NervGaz
09-05-2002, 07:10 AM
how do you mean when does it end... is it inside something else?... in that case just grab everything after the MZ and the take a look at it in LordPE or something else to get the imagesize... and just delete everything after that... bah. too tired to give a really good explanation right now... hope you know what i mean
The Keeper
09-05-2002, 04:11 PM
hello nerz, yes its inside something else, yes understood what u mean, i did that before posting, but before i opened the procs.dll in lordpe dir to check if the imagesize was == dll size but it isnt

see: size of image 00005000 (20480d)
file attributes: size: 8,5kb, 8,704 bytes 65.536 bytes used

am i doing something wrong ?

Keeper
DakienDX
09-05-2002, 07:10 PM
Hello The Keeper !

The DLLs are stored in the .MSI file. They're extracted and loaded when they're need and unloaded and deleted after they've been used.

You can be lucky and the DLL shows you an "invalid serial" message. If this happens, you can find the DLL file in your Windows TEMP directory.

But this wouldn't be Win2000 compatible as defined by Microsoft. :( So the installer loads the DLL, gets the return value, deletes it again and shows the message according the the return value in normal Windows Installer dialogs without help of the DLL.

So the best would be run the installation, get to the serial check, set a breakpoint on DeleteFile (both A and W depeding on OS) and enter a false serial number. You should break then. Modify the filename to be deleted so the DeleteFile function will fail. (give it a good return value so everything seems fine to the installer)

Now you've the DLL verifying the serial. :)


TCL code in an EXE? Duh?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > TCL code in an EXE? Duh?
PDA

View Full Version : TCL code in an EXE? Duh?

crassy
09-04-2002, 10:35 PM
Hi all!

First of all: THIS IS NOT A CRACK REQUEST!!!

Im trying my luck on a proggie... When i disassemble it with IDA I see loads of TCL code inside the exe... It also seems to use tcl84.dll and tk84.dll...

It also logs the error to a log-file when i run it with an invalid license... Here's a short bit of the log

Execution stack:
invalid command name "none"
while executing
"$algorithm encrypt $str"
(object "::encryptor1-3D767C97" method "::Encryption::Encryptor::encrypt" body line 2)
invoked from within
"$encryptor encrypt [clock format [clock seconds] -format "%y%m%d""
(object "::licenseControl0-3D767C97" method "::License::LicenseControl::isRegistryExpired" body line 31)
invoked from within
"isRegistryExpired $readRegistry $featureMap"
while constructing object "::licenseControl0-3D767C97" in ::License::LicenseControl::constructor (body line 16)
invoked from within
"::License::LicenseControl::constructor $_majorVersion $_minorVersion"
while constructing object "::licenseControl0-3D767C97" in ::UML::License::LicenseControl::constructor (body line 1)
invoked from within

The thing is that ive searched for any reference to "LicenseControl" in the TCL code in the exe, and there are none...

Any ideas / general tips? I've never seen TCL code enbedded in a exe...


CrackMe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > CrackMe
PDA

View Full Version : CrackMe

ReBirth
09-05-2002, 10:35 AM
I have writen some CrackMe

if someone is interested i will post them here

Best Regards
hambam
09-05-2002, 10:42 AM
I have something to say, if someone is interested i will post it here ...
sounds similiar, or?

But seriously, post the crackme urls or what ever, if someone is interested, he will open this thread and perhaps he will take a look at your crackmes, too.

So long...
ZaiRoN
09-05-2002, 12:13 PM
Hi ReBirth,
the best thing you can do is to create a new thread in the mini project area and put your crackme (or an url) in it.
in this way, who was interested can try your crackme.
use a single thread for a single project (crackme) and don't post 2 or plus crackmes together; in this way you can give us the time to work on one specific target.

regards,
ZaiRoN


Question about Internet Download Manager v3.0.7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question about Internet Download Manager v3.0.7
PDA

View Full Version : Question about Internet Download Manager v3.0.7

gordon freeman
09-05-2002, 12:05 PM
(Thread title renamed to avoid wrong interpretation of the title)

Hi,
I'm trying to make a keyMaker for Internet Download manager 3.0.7.
I found the following things :

- The Serial must be 23 characters long as : AAAAA-BBBBB-CCCCC-DDDDD
- The valid characters are in the range : "LOXMP7WBZAQ2CVUNE04KYFGHJRS981TI3D65"
- A checksum is performed as follow :
for "AAAAA"
int ck = 0;
for each char in "AAAAA"
pos = position of the character in the allowed characters string.
ck = 37*ck + pos

at the end ck must be divisible by 11 (ck % 11 = 0)

* the same method is used with BBBBB that must be divisible by 29.
* checksum of CCCCC divisible by 17.
* checksum of DDDDD divisible by 5.

Even if the serial is accepted, (the application will shutdown), on the next launch the app will detect that is not registered.

Can anyone help me to deal with this prog.

Thanks.


newbie Q: far jump?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > newbie Q: far jump?
PDA

View Full Version : newbie Q: far jump?

chitech
09-05-2002, 05:04 PM
Alo everybody

I have use relative jmp in .code/.text sections to jump to my own code and it works just fine.

Now I have a problem there is not enough space in .code section so I have to jump to the last section -> .rsrc section.

example I want make a far jump with absolute adresse

from .text:01002A8A
to .rsrc:01012948

Went I use IDA to make the jump to the destination the hexcode will be: EA 48 29 01 01 03 00 ->

segment= 0003
offset= 01012948

When I run the program in ollydbg and set a breakpoint on .text:01002A8A and press F7 (step into) it says: access violation when reading [FFFFFFFF].

What am I doing wrong? and how do IDA know that rsrc segment=0003?

Please guide me...Thx

Chitech
nikolatesla20
09-05-2002, 05:38 PM
A "near" jump in 32 bits should be enough.

A near jump is a displacement from the next instruction, and the opcode "E9" can take a 32 bit offset as its operand. SO....

You want to go from : 01002A8A

And get to : 01012948

The jump instruction itself will take 5 bytes, one for the instruction and a DWORD for the offset. SO now you will be going FROM: 01002A8F.

01012948 - 01002A8F = FEB9

So the encoded instruction would be

E9B9FE0000

I think that should work.

-nt20
chitech
09-05-2002, 06:25 PM
alo nikolatesla20

It works just fine :)

source : 01002A8A (.text)
destination : 01012948 (.rsrc)

is it because 01002A8A(source) + FFFF(near 32bit) = 01012A89 < 01012948?

what if the distance between source and destination is more than FFFF......should i use far jump? How is the segment/offset for the far jump calculated? :confused:

I thought that when you use "near jump" it can only jump within the same code segment but in this case I jump from .text to .rsrc or am I wrong? :confused:

Thx

Chitech
DakienDX
09-05-2002, 06:31 PM
Hello chitech !

In Win32-PE programs you have no segmented addresses, so your jumps will be always "near" or "short" and never "far".

The .rsrc section has usually different section attributes than the .code section set.

.rsrc sections are not executable and are shareable.

You can probably imagine what happens if you try to execute code in a non-executable section.

So you have two possibilities. The first would be to increase the size of the .code section and add your code there. The second would be to set the executable and remove the shareable attribute to/from the .rsrc section and add your code there.

I would prefer the first way. If you want to do a task bigger than just cracking the program in some way (for example adding functions to the program), you should think about writing an external DLL and redirecting your code to this DLL.
chitech
09-05-2002, 06:41 PM
alo DakienDX

Now I understand.... :rolleyes:
It's because when I set a label in IDA (destination) and want to jump/call to this label it automatic make a far jump/call.

thx a lot DakienDX :cool:

Chitech
nikolatesla20
09-05-2002, 08:24 PM
Just a quick note regarding segments.

In a PE file the sections are not the same as "segments". In the 32 bit world, a program will usually reside in one large segment. That's why the addressing mode is called "flat mode".

The only reason sections exist in a PE is to allow the PE loader to assign different attributes to the area of memory in which the section gets copied. For example, the execute, read, write, bits. Or the shareable bit like DakienDX mentioned. It also allows for a more compact file , because in memory a PE might actually take up a lot of room, but on disk it is contiguous. A section allows you to reference an offset in the PE file where data starting there should be put in a certain memory location by the loader, where in memory for example the sections might be very far apart, or have a different alignment than the file does.

Just remember segments are a 16 bit application programming term and not needed in 32 bit programming, unless you are doing very low level systems programming.

-nt20


softice help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice help
PDA

View Full Version : softice help

PETER
09-06-2002, 08:13 AM
hello

Im a newbie in using softice. I install softice suite 2.6 to my computer (nt4.0). And i have one program ( made by delphi) which i want to crack( try to find registration codes). Questions: do i have to load it to symbol loader?. I red some articles about crack program, but they don´t tell how to prepare program before finding codes from there. I red softice manual also but that wont tell any how to start

would somebody please tell what i to do to start to finding codes from that program.

regars

peter:)
nofurs
09-06-2002, 11:25 AM
Hiya,
Did you read the posting guidlines in the main Rce Regroupment?
Did you search the web?
Did you search the forum?
PETER
09-06-2002, 11:49 AM
hello

Yes i red manual search web finding articles etc. Softice manuals dont tell how to dealing if you open program which you going to crack. Maybe my english knowledge is so bad that can´t understand all. But i need only simple answer. Do i need to load program (which i gonna crack) to symbol loader. I try to load it and loader give a message : an error occured during symbol translation/load.
This is new task to me find codes. But when nobody cracked that program i have try myself. I know it´s a hard work to learn assembly language and also softice but i try to if i get help.

regards

peter
nofurs
09-06-2002, 12:50 PM
Hiya,
press the button "yes" and you will know
search the web softice www.google.com softice tutorials
You will find softice how to
PETER
09-06-2002, 01:40 PM
Hello

Sori people for stupid questions. I was too quickly to write instead to search. When i search i found answers to problem which i have. So using 3rd party program symbol loader give a message: An error occured.. so i have to load program which i gonna crack.

But what have to put in command line argument in symbol loader. I mean (delphi program)? Did´t find any examles of those arguments. Manuals tell but dont get good examles. Also need examles of those other settings.

regards

peter
nofurs
09-06-2002, 03:10 PM
Hiya,
My small advice is find tutorials that has targets available in the web.This will help you much more.Post where you stuck,put some codes in here and ppl will help you


annoying ads
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > annoying ads
PDA

View Full Version : annoying ads

dzidzia
09-06-2002, 10:52 AM
Hi,

I'm trying to remove ads from one of the 'messengers'
at first i tried just to remove it with resHacker and
borland's workshop but it didn't work... then i saw
it was packed with UPX, and that's why i got the
messages 'resource is broken'. I procdumped it
with success but it's still the same shit. It was
compiled with delphi and with W32Dasm i see
somethin' like _TCHat but it leads to 000000s at the
end of code... (i caught windows hwnd in softice,
but i found no way to deal with it...). Is there any way
to repair those resources? thatnks in advance

dzidzia
mancini
09-07-2002, 12:49 AM
my bet is that you need to propperly unpack the executable first
i belive procdump only suport old upx versions
first get a program like file insPEctor XL or Language 2000 to find out the version of the packer
then get a unpacker for that version or unpack it in softice+icedump

also a resource editor can not remove ads from a program but in a few special situations
like when the dialog box in wich the ads apear has not the ads feed from a dll to it but it has a builtin static box in a dialog that you can resize to 0 height and 0 width
most modern adware programs rely on exports from dlls like the cd_clint.dll of cydoor that use a cache of adds or download them while online

also reed Reversing 'Adware' by Modifying Window Display Properties by Kayaker

oh and use Spy & Capure by Kobi Krichmar to identyfy your ad window parametres
dzidzia
09-07-2002, 08:35 AM
thanks mancini,

I downloaded file insPEctor XL and Language 2000...
and guess what? - procdump was totally enough
to decompress that stuff. Only Borland Workshop
and ResHacker were too 'weak'. I read the tutorial...
was ready to press ctrl+d...but before I downloaded ExeScope ver6.10.

inside TCHat I saw nothing but...

object h1: THttpCli
URL = 'http://idi.tlen.pl/adinfo.php'
ProxyPort = '80'
Agent = 'Mozilla/3.0 (compatible)'
Accept = 'image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, */*'
NoCache = False
ContentTypePost = 'application/x-www-form-urlencoded'
MultiThreaded = False
OnDocBegin = h1DocBegin
OnDocEnd = h1DocEnd
OnRequestDone = h1RequestDone
Left = 64
Top = 88
end

but instead of decreasing the window size I took different
approach...i just changed interval hehe and the banner
doesn't come up at all...

cheerz

dzidzia
disavowed
09-08-2002, 03:35 PM
for future reference, if you download upx, you can use it to unpack most files that were packed with upx :)
(no need for procdump)
stealthFIGHTER
09-08-2002, 09:02 PM
Originally posted by disavowed
for future reference, if you download upx, you can use it to unpack most files that were packed with upx :)
(no need for procdump)

Yes, but only in case the packed .exe were not additionally modified...

sF
hack3r2k
09-08-2002, 09:56 PM
If was modified no problem ...

1. Check the sections names (should be UPX0, UPX1, [.rsrc])
2. Open the exe with an hex editor and check for the upx stamp (should be for ex. stamp BYTE '1.22',0,'UPX!',0C - analyze some upxed file to see where it comes) cause if it's not there or modified upx will say 'posibly hacked/modified' ...

That's all folks !

This is the most upx protection scheme that i've seen.:D

best regards,
.:hack3r2k:.


XP SP1 and XP SP1 Symbols
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > XP SP1 and XP SP1 Symbols
PDA

View Full Version : XP SP1 and XP SP1 Symbols

Snatch
09-06-2002, 08:02 PM
hxxp://www.microsoft.com/ddk/debugging/symbolpkg.asp#Windows%20symbol%20packages

That is the SP1 RTM symbols just updated

hxxp://download.microsoft.com/download/whistler/SP/SP1/WXP/en-us/xpsp1_en_x86.exe

There is the service pack final itself.

Both from your favorite candyshack.

Snatch


Reversing IDA protection (the real one)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reversing IDA protection (the real one)
PDA

View Full Version : Reversing IDA protection (the real one)

Balam
09-06-2002, 08:04 PM
Well, never found a paper about real IDA watermark, kind of impressive for a some people who consider themselves elite. :p

(that's the troll part of this post)

Now to serious things.

As you know datarescue implemented a watermark in each executable of IDA. This is something that strikes you when you manage to get two same versions of two different users.

Basically each exe is packed with Aspack, you'll notice the difference in size. Once expanded (Caspr works well), you will see that the files are very different, yet they do not have different features (obviously).

The catch is that the addresses of the sections are different, starting with the second. This implies that the whole code is different each times it makes a reference to data/code located in another section.

The size is different too... This might be caused by the linker, maybe I should worry about it though...

Obviously, IDA links a version at each requests from the users (anyone who upgraded their versions know this is possible) and this is how they can track leaks, even with a forged/hacked key...

So the solution would be to do some kind of plugin for IDA :p that would parse the executable and fix the addresses to another, a blank, neutral one, resulting in a completly unwatermarked version of IDA, if no other watermark is applied, of course.

You could code your own disasm engine too, and do something about it.

Their shit reminds me the metamorphic virusii in a much lamer way. I'm pretty sure their shit is only based on stuff they supply to the bcc linker.

Any remarks about it welcomed (plz don't post blah you're ghay to hack IDA, coz you're the only ghay here :cool: ).
Snatch
09-06-2002, 09:25 PM
Quine wrote some interesting stuff about reversing the watermarks in IDA a while back. You should check the Tsehp mirror. I am not so sure that it is linked for each user. I think they may have an obfuscation tool. IDA.KEY is also of interest. I think this topic is underdone because not enough people own a legitimate copy of IDA Pro. And even if they do they dont have 2 copies at their disposal. I am interested in the protection though and would be willing to colaberate. I assume you are talking about 4.30.

Snatch
Balam
09-06-2002, 10:33 PM
No, I only managed to get two copies of 4.21. I can assure you the linking is different, it cannot be done by some obfuscation tool. I really know my way around compilers, and I can recognize the modifications were done at compilation (well linking to be more precise).

I read all the "essays" (as you guys like to call that) about that, but the key is no problem, it's mundane to remove it. The problem is to alterate the linking to remove the watermark. It's non-trivial, writing plugins for IDA is a pain in the ass, so I guess I'll quickly have to write a little ia32 disasm... :/

Yet there may be additional watermarks...

Datarescue greatest fear is to have an "unmarked" IDA hitting the black market, which is understandable. :) I'm a bit disapointed now though, coz I was expecting to find some kind of poly/metamorphic engine and found nothing...
Snatch
09-06-2002, 11:23 PM
Well once again I am going to disagree with you. They have several distributors. You are going to convince me now that they have given source code to all of them and tell them to do a different compilation process for each one. Sorry but I seriously doubt that. And I know that a new copy can be made in less than 10 minutes. I cannot tell you any more than that however. Remember. An advanced enough tool can do anything and even make it appear to be different linking. What your goal should be is to make the two copies you have identical somehow. Thus you elminate all watermarks. If addresses can identify the copy at that point then just change them all. Course we still have to worry about all the w32 files and IDA.KEY.

Snatch
Balam
09-07-2002, 09:28 AM
thx for the info... :)
Snatch
09-07-2002, 08:08 PM
Can you tell me anything about the stuff you have noticed with respect to differences. I think if we make our own PE-Aligner we could somehow do this. Yes it would involve rewriting the entire file and almost all directories but it would probably kill the protection. And how would linking something again produce different results. Thats something strange to me because the linker usually just combines the object modules and builds the PE. But unless size or other things are changing durastically doesnt sound like it wouldnt reproduce the same thing twice. I would be interested in working with you on this.

Snatch
Balam
09-07-2002, 08:40 PM
Basically I've noticed the addresses of the sections are different, after the first one. You can decide this at linking, amonst other things (like base address, etc.).

Since the .data sections have different addresses, the code is different (offset differs).
Snatch
09-07-2002, 09:25 PM
Why couldnt this be obfuscated after the fact. If the addresses are different that is a matter of simplicity. The relocation table has all of them. You could make your watermarker just load the whole relocation table and if the relocation in question is between the start and end address then add a certain ammount to it. You dont need a disassembler. You need a PE viewer that can actualy read not only what addresses are relocated but what is at each of those addresses. Now you have sparked my interest in this big time. It sounds that dewatermarking may be easier than we thought.

Snatch
Balam
09-08-2002, 08:44 AM
if and only if this is the only watermark... Then you are right, parsing the relocations (if still present) would solve the problem...

The problem is that the size also differ... The following files appear to be different :

ida*.exe
*.ldw

*.ldo seem to be identical.
Most of dll I have tested seem identical.

The best way would be for you to get two copies of IDA...
CASPR will unpack without a problem your executables.
Anticode
09-11-2002, 05:08 PM
once i tried to compile the loder example from idasdk.
I got an error saying ident.obj could not be found.
searching the sdk for ident.cpp or ident.obj failed so i greped for 'ident' and found this line in loader.mak:
OBJS=$(F)$(PROC)$(O) $(OBJ1) $(OBJ2) $(OBJ3) $(OBJ4) $(OBJ5) $(OBJ6) $(L)ident$(O)
so for every loader you build it tries to link with ident.obj.
because of the fact that the sdk is just some headers and a library used to build ida itself and the fact that the file is called ident i jumped into the conclusion that ident.cpp must be the watermark!!

this can explain why the first section is diffrent from one user to another: because the watermark is in the first section (code i think).
and can explain how distributors watermarks ida: distributors gets from datarescue a distribution kit: all the *.ldo and other files that are not watermaked, all other files comes as a .obj file plus a utility (watermark generator) that produces ident.cpp, compiles it and links all the .ldw and ida itself aginst it.

If that is true, obfuscation could involve just nopping that area.
since this is the only static link of external code (all other functions are exported by ida.wll), my idea how to find the watermark without another copy of ida is to search all the .ldw files for similar blocks.

hope i helped.
Cheers.
Snatch
09-11-2002, 08:34 PM
Clearly file size normalization and segment and address realignment must be done as well though. Otherwise they could probably tell whose copy it was. If I had 2 copies I might experiment. But with 1 copy you can never be sure. The goal would be to take 2 copies. Deobfuscate and have them be exactly identical at the end.

Snatch
taz
12-14-2002, 11:31 AM
Hello Guys

I have found a solution to use Ida 4.30 Pro. Somebody had send it to me without the Ida.key and i had copied the Ida.key from my ida 4.15 Pro into this version and the version of 4.30 works without any problem.

Regards Taz
KSA
12-14-2002, 07:19 PM
Hi,

I have my own IDA Pro ver 4.17

and bring a key from a friend and as Taz says it works without any problem. Is't possible to have the IDA Pro 4.30 FULL without the key and test it ;)

KSA
Snatch
12-14-2002, 10:34 PM
That is far from a solution the watermark is not the key file. The key file is blatently obvious. The water mark is latent and in the w32 and exe files. It has to do with the alignment and filesize. If you release that IDA 4.30 you will screw over that person. They might as well have sent you their IDA.KEY it is just another lace in the protection the obvious one. So keep that copy private and dont screw over another user.

Snatch
Nobody
12-16-2002, 01:49 AM
One question about sparc disassembly .
I did the Sun Sparc disassembly sucessfully in the past .
Recently i try it in the 64bits (Solaris >2.7 ) . The IDA return the unknow format in elf . Does someone have the soultion for disassemble the 64bits Sparc elf file ?
Ishkabible
12-31-2002, 07:15 PM
Check out /usr/ccs/bin/dis (man dis). It comes with Solaris.

I've used it for several projects and it seems to do a reasonable job. Now if I can just get a handle on RE Windows stuff.

Ish


button enabling delay
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > button enabling delay
PDA

View Full Version : button enabling delay

mancini
09-07-2002, 12:31 AM
in a c++ aplication with a single window there is a start button that has a 30 seconds delay (it is grayed out for 30 seconds after you start the program)
i have read Lord Soth's menu-items tutorial and the references on menuitems from the TORN@DO cracker's notes
now . i have tied a lot of things and all unsuscesfull but i allways ended back at this paradoxal thing (to me)
i load the program wait some 5 seconds till it finishes loading (still 25 seconds to go till the button is enabled) then go in softice and put brekapoints on all menu handling api's i found in this particular program's import table :
deletemenu
destroymenu
checkmenuitem
enablemenuitem
modifymenu
modifymenua
loadmenua
getmenustate
getmenu
getmenuitemcount
getmenuitemid
trackpopupmenu
appendmenua
and still at the 30 second the button is ungrayed but without softice breaking on any of those breakpoints

(btw the program does not show a counter of any sort of how manny seconds remain or anything)

zipped below are text files with all imports from this program
could i miss a api i should have breakpointed or sould it be another cause ?
Kayaker
09-07-2002, 05:08 AM
Hi Mancini,

You say the start button is grayed out for 30 seconds. Unless the button control has a menu counterpart, menu related APIs won't be being used here, though that's a good list of them. The program may be doing it in a couple of ways. Like many reversing problems, understanding how something may be coded at the system level is the first step in figuring it out. The Win32 programmers guide (or *much* better the MS SDK), and an API monitor are invaluable. From the guides can be found the basic ways in which a control can be created and how it can be modified. From this information can be devised a strategy for dealing with the problem by accessing the APIs or Windows messages.

The control may be being loaded from the resource file or being created in code. If it doesn't exist in a resource editor then it's probably the latter. If it's the latter it may show up in the Softice 'hwnd <task>' list. If you've got a hWnd for it then you've got control over it with BMSG message breakpoints, if not then there are APIs.

This sounds like a delayed Dialog box splash screen or something. The program may be creating the pushbutton with CreateWindow and the WS_DISABLED (equ 8000000h) style, and using the EnableWindow API or the WM_ENABLE message to control it. You could start by checking the CreateWindow calls and see if it's apparent there is a separate control being created for the pushbutton.

By using a SendMessage call it's easier to hide the fact that the control is being handled. You can monitor a call like this for the proper control Id and check for the WM_ message being sent. I haven't checked this code, but I think something like this could be used

invoke GetDlgItem, hDlg, ControlID
; returns handle of dialog box control in eax

invoke SendMessage, eax, WM_ENABLE, FALSE, 0
; WM_ENABLE equ 0Ah

-------------------------

Another way would be to create the control during the WM_INITDIALOG message as the dialog box is being created, as an ownerdrawn button with the BS_OWNERDRAW (equ 0Bh) style of a CreateWindow call. If so, the ownerdrawn control would use a SendMessage call with the WM_DRAWITEM notification code to modify the look and function of the control. This might be called like this:

invoke SendMessage, hDlg, WM_DRAWITEM, ControlID, offset lpDRAWITEMSTRUCT

The WM_DRAWITEM message is sent to the parent window of an owner-drawn button, combo box, list box, or menu when a visual aspect of it has changed. The last parameter, which would be the first pushed in the SendMessage call, contains a pointer to a DRAWITEMSTRUCT structure which can be used to control the look and function of the control. One of the flags that can be set is for ODS_DISABLED (equ 4h) - The item is to be drawn as disabled. This flag may be being set in a separate instruction that you can change.

Putting together all this API info, you can devise a strategy for finding where the button is being created and how it may be being controlled. If this was a toolbar button then it might be being handled with the specific Windows message TB_ENABLEBUTTON. You could modify the CreateWindow call to create the button enabled to start with, but this won't necessarily enable the function of it if more code is being controlled by the 30 second timer. Again, a WM_TIMER Windows message may be being used if you can't find any SetTimer or KillTimer calls.

I'd suggest starting with an API monitor and see what calls are actually being used to enable the button after the 30 second interval. Then try a Windows messaging spy such as Borlands WinSight, ISpy or similar and see if you can detect any suspicious messages being used. This should lead you to the timer function as well. Once you've found it it's usually easy to deal with.

Post if you have problems, hope this helps.

Kayaker
Athlon
09-07-2002, 05:47 AM
Kayaker where can I get the MS SDK?
Kayaker
09-07-2002, 06:43 AM
Athlon, you can browse the Platform SDK Windows API reference online at

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winprog/winprog/functions_by_category.asp

or d/l it from

http://www.microsoft.com/msdownload/platformsdk/sdkupdate/

It's something like 350 MB total, 190MB for the core SDK, but I think it can be d/l in bits and pieces depending on what you want out of it. The important stuff I've isolated for general work, some 92 .chm files takes about 100MB uncompressed. You'll have to see what's available and what you can afford downloading.

Kayaker
Athlon
09-07-2002, 07:36 AM
Is the SDK only for XP :(
Snatch
09-07-2002, 08:06 AM
Heh reversers I have noticed know jack about programming. Too bad. The SDK is pretty much the same for all OS's because the API is almost identical. The DDK on the other hand is much different.

Snatch
cHeCksUm
09-09-2002, 09:06 PM
I might not know jack about programming but I know a programmer named Jack... no really I do ;)..... Yeah I know off-topic.... just had to.

// cHeCksUm
Paul333
09-10-2002, 04:29 AM
Kayaker thanks for your reply .i learned from it and wish all replies where in depth like this:)

paul333
Kayaker
09-10-2002, 04:48 AM
Thank you and you're welcome Paul333, you just made it all worth while by the fact that you learned something. It's what we need to do, keep passing on the knowledge, that's what it's all about.

Kayaker


ASProtect v1.2 on a dll (plugin)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect v1.2 on a dll (plugin)
PDA

View Full Version : ASProtect v1.2 on a dll (plugin)

UltimAtomMAX
09-08-2002, 10:22 AM
Ok, so I've scanned the file with File InsPEctor, and give me the ASProtect v1.2 compiler.
I'm not sure but i've found the OEP with a GetVersion and F5 until the file is being loaded in memory, then typed "S 0 L FFFFFFFF first bytes of EiP", then I use the result in a "bpmb result x", F5 and F10 many times, I have this (Don't take care about Offsets):

:0000003C B878563412 mov eax, 12345678
:00000041 50 push eax
:00000042 034525 add eax, dword ptr [ebp+25]
:00000045 5B pop ebx
:00000046 0BDB or ebx, ebx
:00000048 8944241C mov dword ptr [esp+1C], eax
:0000004C 61 popad
:0000004D 7506 jne 00000055
:0000004F 6A01 push 00000001
:00000051 58 pop eax
:00000052 C20C00 ret 000C

:00000055 50 push eax
:00000056 C3 ret

Is that the POPAD of ASPROTECT routine ? Because after the ret on 00000056, eax = OEP and ret goes to OEP :

:10089FFF 55 push ebp
:1008A000 8BEC mov ebp, esp
:1008A002 53 push ebx
:1008A003 8B5D08 mov ebx, dword ptr [ebp+08]
:1008A006 56 push esi
:1008A007 8B750C mov esi, dword ptr [ebp+0C]
:1008A00A 57 push edi
:1008A00B 8B7D10 mov edi, dword ptr [ebp+10]
:1008A00E 85F6 test esi, esi
:1008A010 7509 jne 1008A01B
:1008A012 833D1CBFE10300 cmp dword ptr [03E1BF1C], 00000000
:1008A019 EB26 jmp 1008A041

So I make the dump with "a eip, jmp eip" and LORDPE, fix EiP & sections with PEditor, Rebuild IAT with ImpREC (it find every imports, but one discovered with ASProtect plugin).

So I've tested the loading process with no IT, so a message says "Can't Load the plugin", and if that module isn't loaded, some other module of that plug aren't loaded. Now testing with original packed file, and everything is OK, the plug is loading and a Splashscreen appears. Now testing the module with a rebuilded IAT, It loads !!! But damn, no Splashscreen and the sofware that load the plug does'nt appear on the screen, but only in the taskbar. I think my IT is now correct, but it seems that the plug check in memory if ASProtect is loaded, and if not, the plug doesn't give me a Splashscreen and break the software. Please help, how could I fix it ?
+SplAj
09-09-2002, 08:20 AM
Hello UltimAtomMAX

I read your post several times and got more and more mystified !!!

Do you need to find OEiP in latest aspr1.2x targets and also use plugin safely ?

a 'popad' instruction per se does not mean that it's going to reveal the original EntryPoint.
Alexey uses pushad/popad to save/restore registers state a lot of times ;)

Also the plugins with Imprec1.4+ work as they should. I've coded several plugins for different
esoteric IAT protection schemes.....but never had a 'failed to load' problem. You should examine
the 'options' and have a play......./me curious :) maybe unselect 'use PE Header from Disk' if you are attacking a dll process.

Spl/\j
(c) 2002
UltimAtomMAX
09-09-2002, 09:17 AM
Ok so the ASprotected file is the dll (the plugin of the software), not the sofware itself.
My OEP was good, because the dll is now dumped, IAT rebuilded, and little trick fixed, and now the plugin loads perfectly.
But I need to Unpack another dll to crack.
I've already Dumped, but can't have the full IAT with RV/ImpREC, and I don't understand how to rebuild manually the IT.
Could you help me, because I don't know how to trace the unresolved calls... Tried BPX GetVersion, and U XXXXXXXX where XXXXXXXX is the address given by RV, but can't see any call...
Could you explain a detailled "how to" to trace calls with SI...
Thanx.
+SplAj
09-09-2002, 10:51 AM
Hello

If you successfully de-aspr a dll already, then next dll is same procedure...or wtf ?

I am curious to see this target in action, please PM me with URL.
UltimAtomMAX
09-09-2002, 11:30 AM
Not same procedure, because i don't know how to trace the unresolved calls of the second dll. The first was easier, cause the IAT was rebuilded sucessful with RV/ImpREC, but the second has many unresolved Imports.
So I don't know how to retrieve them with SI tricks, like you explain in your tuts when there are unresolved Imports. I don't understand for example in your Commview 3.1 tut :

In RV select the CV.exe and unclick --Autofix sections’, then press --fetch IAT’ and RV fills the following :-

IAT Start RVA 001A0230
IAT Length 00000908 (this time correct, but be careful and manually check the jmp table in SICE window)

Press the --IAT Resolver’ and then --Resolve Again’ buttons. All but the following IT have been successfully found :-

021 001A0284 00E8C548 0000 ?????? to_Resolve
022 001A0288 00E8C8F8 0000 ?????? to_Resolve
027 001A029C 00E8C94C 0000 ?????? ??????
064 001A0340 00E8C8F8 0000 ?????? to_Resolve
090 001A03B0 005881EC 0000 ?????? ??????
109 001A03FC 0058826C 0000 ?????? ??????
126 001A0440 00E8C914 0000 ?????? ??????
134 001A0460 00E8C548 0000 ?????? to_Resolve
136 001A0468 00E8C8F8 0000 ?????? to_Resolve
151 001A04A4 00E8C944 0000 ?????? ??????
152 001A04A8 00E8C93C 0000 ?????? ??????
154 001A04B0 005882A0 0000 ?????? ?????? <- these are from Win2K & RV so will be different addresses from Win98/ME

1st Save your resolved.txt J Most can be fixed up with the --Enable Trace’ & --Trace’ function and --Resolve Again’ button pressed. Save your resolved.txt again J Now you have to trace MANUALLY those final few unresolved entries. I can tell you that most are from that API cluster we saw earlier and others will be FreeResourceand LockResource. These 2 API have a RET004 from the stack, so just selecting a random API will fail you with a RET. Take care. Look at the ALPHABETIC names of the resolved.txt. You get a big clue from this J. Ok, to trace is easy.I will do one with you. See item 21/22 MUST be Get??? API.
Close all programs and set a bpx GetVersionagain and start CV.exe. When you F12 back to the API cluster do a U E8C548 (or whatever the memory location is for you). You will see immediately the link to the API cluster EAX stored location. Match the memory to the API. For the item 109 this is LockResource you will see a PUSH blah RET004 code.

021 001A0284 BFF76DA8 01A3 KERNEL32.dll GetProcAddress
022 001A0288 BFF77716 018D KERNEL32.dll GetModuleHandleA
027 001A029C BFF8C5DA 0149 KERNEL32.dll GetCommandLineA
064 001A0340 BFF77716 018D KERNEL32.dll GetModuleHandleA
090 001A03B0 BFF9FA9F 02F5 KERNEL32.dll SizeofResource
109 001A03FC BFF92F48 023E KERNEL32.dll LockResource
126 001A0440 BFF92F1B 01DC KERNEL32.dll GetVersion
134 001A0460 BFF76DA8 01A3 KERNEL32.dll GetProcAddress
136 001A0468 BFF77716 018D KERNEL32.dll GetModuleHandleA
151 001A04A4 BFF84948 015B KERNEL32.dll GetCurrentProcessId
152 001A04A8 BFF96347 015A KERNEL32.dll GetCurrentProcess
154 001A04B0 BFF92F43 0135 KERNEL32.dll FreeResource
UltimAtomMAX
09-09-2002, 11:33 AM
An failed to do that :

Set a BPX GetVersion. Press F5 and trace back to asprcode with F12 and see a cluster of API that Alexeyjust maps the return value (in EAX) to memory locations.......

016F:017AC7BC 6A00 PUSH 00
016F:017AC7BE E8897CFFFF CALL KERNEL32!GetModuleHandleA
016F:017AC7C3 A34C367B01 MOV [017B364C],EAX
016F:017AC7C8 E8977CFFFF CALL KERNEL32!GetVersion
016F:017AC7CD A344367B01 MOV [017B3644],EAX
016F:017AC7D2 68AC357B01 PUSH 017B35AC
016F:017AC7D7 E8907CFFFF CALL KERNEL32!GetVersionExA
016F:017AC7DC E83B7CFFFF CALL KERNEL32!GetCurrentProcess
016F:017AC7E1 A348367B01 MOV [017B3648],EAX
016F:017AC7E6 E8397CFFFF CALL KERNEL32!GetCurrentProcessId
016F:017AC7EB A350367B01 MOV [017B3650],EAX
016F:017AC7F0 E81F7CFFFF CALL KERNEL32!GetCommandLineA
016F:017AC7F5 A340367B01 MOV [017B3640],EAX
016F:017AC7FA C3 RET

I've founded the OEP with another trick.
+SplAj
09-09-2002, 12:11 PM
To manually trace a re-directed API just look at the unresolved and then while holding target in EB FE loop Ctl-D into SI and U the call eg from above example :-
027 001A029C 00E8C94C 0000 ?????? ??????

in Si type U E8C94C' and examine the code.

it will look something like :-

0167:0132138E 8BC0 MOV EAX,EAX
0167:01321390 E8DB3DFFFF CALL KERNEL32!GetVersion <- FAKE call
0167:01321395 A1F06C3201 MOV EAX,[01326CF0] <- restore GetCommandLineA
0167:0132139A C3 RET

so if you hade MANUALLY logged that memory block where ASPR saves GetWhatWeWant API result then you will know that [1326CF0] holds result of GetCommandLineA API ;)

Is that it ???

I'm still waiting for PM with URL of target (be quick my PM box is filling with requests...)
UltimAtomMAX
09-09-2002, 02:43 PM
Sorry about the target, but only a few people can have it. You cannot get it on the web, but if u find for me an upload place, I can give you the files. I will try your tricks, thanx very much.
UltimAtomMAX
09-10-2002, 02:00 PM
Ok, I actually use revirgin to Un-Asprotect a dll target.
Now I select the host process, then the wanted dll in "Select Module to Attach".

Selecting my dll and :
Error
Image Import Descriptor corrupted, enter the OEP and click FetchIAT.

So bypass this error, correcting the actual OEP with the dll's one ( 1921B founded with SI ) and clicking "Fetch IAT" :
Message
Found Nothing

So I decide to run ImpREC to do the same thing, entering OEP, then "IAT AutoSearch" works... RVA : 1A000 Lenght : 620.
So ImpREC does that job, not RV.

Now Switch to RV and lauch "IAT Resolver" ( works ) and "Resolve again" ( works too ), then a lot of imports are unresolved, so I decide to "Save resolved" to resolved.txt
It works.

Now try to resolve an unresolved with ASProtect 1.2 Emu dll.
Found !

Great...
Now it's time to resolve that import, so "Resolve again"...
Argh !!!
WTF !!!
Revirgin
External exception EEFFACE.
What's that ???

Ok, don't want to panic, I close Revirgin, then Start it again...
An re-select the process and the dll...
So don't want to relaunch the "IAT Resolver", and then "Load resolved".

I select my resolved.txt
Argh !!!
WTF !!!
Revirgin
Access violation at address 004AAAFE in module "REVIRGIN.exe". Read of address FFFFFFF9.

Now, what can I do to rebuilt my IAT...
I am under Win2K SP3, maybe that's the sh*t...
UltimAtomMAX
09-10-2002, 02:06 PM
Here is the ImpREC IAT, I have the same with RV...
But take a look at the last FThunk, maybe my Lenght is incorrect...
Because I have :
1 0001A470 xrend.dll 001E ?GetComputeParallelDepth@BucketRend@@QAEHXZ
but xrend.dll is the file I want to resolve... So why there is an imported function on itself...???
Or if my lenght is incorrect, how could I find the true lenght ?
UltimAtomMAX
09-10-2002, 02:13 PM
So I've traced level 1 some unresolved in the last FThunk, And there is a lot of duplicate imports...
Is this FThunk can be deleted ? Because when I Fix my dump without that FThunk, the files works...
Here is the traced level1 solved tree
+SplAj
09-10-2002, 02:34 PM
You are getting good :)
________________________________________________
Is this FThunk can be deleted ? Because when I Fix my dump without that FThunk, the files works...
________________________________________________

YOU proved the theory :)

To get the length take a look at the dump with UltraEdit........examnining the raw offset all should make things a lot clearer.

BTW A.F.A.I.K. EEFFACE, EEFFADE, EE5L1CE, EEFFOUR etc etc are Dumb Delphi exception lookup codes - well maybe not slice and four ;)
Dump the plugin and you'll see.
UltimAtomMAX
09-10-2002, 02:43 PM
So thank you for your help, but now I have some other problems to crack the files, but now don't need to ask in that place, seems have no more unpacking problems ;)
Thank you very muuuuuuuuuuuuuch !!!
But need to know how to fix the RV problems...


Ecomsoft products Asprotected
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Ecomsoft products Asprotected
PDA

View Full Version : Ecomsoft products Asprotected

LOUZEW
09-08-2002, 04:28 PM
Hi, all guys on this board.

From here i've reversed a lot of progs but I'm newbie in unpacking.I've learned alot from this board and specially threads and tutorials by +slaj about asprotect.

I'm now working on Elcomsoft products, i started with AOXPPR_P.EXE ( Advanced Office XP Password Recovery Pro ), you can find it

OK, found OEP, used revirgin but it still remain some unresolved. I've learned again but i can't find them for sure.

Can anybody help me with this example ? You can find here in attachment an RESOLVED.TXT file generated by RV.

Thank's

louzew@libertysurf.fr
esther
09-08-2002, 04:40 PM
Hi LOUZEW,

There are lots of threads regarding this topic.Search the forum
No iat attachments is to be upload.cut and paste the part which is not resolved .

Regards
LOUZEW
09-08-2002, 04:52 PM
OK ester,
Sorry for this attachment, i'll post now unresolved only !

OK, i know there is a lot of threads about that on this board, i've learned more and more of them, i still have pb to resolve these ones, if somebody can help !

Thank's
foxthree
09-08-2002, 05:27 PM
Hey:

I just resolved AOXPPRPro version successfully under Win9x. If you're talking about the unresolved one in USER32.dll thunk, refer to my post on ADPRPRPro and the reply by Crusader... In fact there are only a few APIs in USER32.dll that do a RET 0014 :)

Signed,
-- FoxThree

PS: BTW, the above is my assumption only. You've not given any sufficient info as to which APIs you haven't been able to resolve yet :(
LOUZEW
09-08-2002, 08:59 PM
Hi, Foxthree
Thank's alot for responding, i've read many of your posts !
I've take a look too for your post on ADPRPRPro and the reply by Crusader.
OK, but i'm a newbie in unpacking and i still have prob to locate unresolved functions.

I'll post here in attachment UNRESOLVED.TXT from AOXPPRPro, maybe can you take a look, and if you have resolved it successfully, maybe can you explain how do you do to find these unresolved functions.
LOUZEW
09-09-2002, 05:59 PM
Hi, foxthree
I don't know Why but somebody deleting attachment from my last post, It was only unresolved from AOXPPRPro !
Maybe the guy deleting it can explain (i'm refering to the esther reply)

OK, for you Foxthree, the unresolved calls are following :

25 001F34F0 BFF8E0CD 0133 KERNEL32.dll FreeLibrary
26 001F34F4 013213C4 0000 ?????? ??????
27 001F34F8 BFF8E150 0138 KERNEL32.dll GetACP

30 001F3504 BFF779D5 0158 KERNEL32.dll GetCurrentDirectoryA
31 001F3508 01321388 0000 ?????? ??????
32 001F350C BFF92F1B 01DC KERNEL32.dll GetVersion

52 001F355C BFF776F7 018B KERNEL32.dll GetModuleFileNameA
53 001F3560 0132133C 0000 ?????? to_Resolve
54 001F3564 BFF9100F 0196 KERNEL32.dll GetOEMCP

56 001F356C C0193CDC 019F KERNEL32.dll GetPrivateProfileStringA
57 001F3570 01320EE8 0000 ?????? to_Resolve
58 001F3574 BFF8CAE1 01A6 KERNEL32.dll GetProcessHeap

99 001F3618 BFF9C654 023C KERNEL32.dll LockFile
100 001F361C 013213B4 0000 ?????? ??????
101 001F3620 BFF820A9 0249 KERNEL32.dll MapViewOfFile

I hope you can tell me how to find them ! ( i have to learn again..)

Thank's
JMI
09-09-2002, 06:44 PM
LOUZEW:

Perhaps you didn't read the warning which is now part of the header of all of the Forums, except "Off Topic" which states, in capital letters:

"DO NOT UPLOAD ANY TARGET SPECIFIC CODE."

Perhaps you didn't understand when esther (look I spelled it correctly this time) told you to "cut and paste" rather than "attach" sections of code. Although it wasn't stated, we can assume that it is intended to prevent someone else from taking an attachment and pasting its information into their own file and get a potentially working program. Again assuming, we can conclude that is another attempt to prevent the wolves constantly nipping at the heels of this Board from claiming that the Board is facilitating the distribution of cr*cked software.

It shouldn't be that difficult to cut and past a small section of the code as you appear to have done in you last post and this is not "directly" insertable into someone else's efforts, even though it can be re-typed into their output.

Just as an aside, have you considered using Softice to look at the addresses in the "unresolved"? It is generally unlikely that you will find something from a different API in the middle of references to KERNEL32.dll, but you could go to the first address at 013213C4 and see what you find right at that address and above and below this address. Here is a cut and paste from our resident unpaxing God, +Spl/\j, from the thread RIGHT BELOW YOURS, in which he wrote:

[quote]

To manually trace a re-directed API just look at the unresolved and then while holding target in EB FE loop Ctl-D into SI and U the call eg from above example :-
027 001A029C 00E8C94C 0000 ?????? ??????

in Si type U E8C94C' and examine the code.

it will look something like :-

0167:0132138E 8BC0 MOV EAX,EAX
0167:01321390 E8DB3DFFFF CALL KERNEL32!GetVersion <- FAKE call
0167:01321395 A1F06C3201 MOV EAX,[01326CF0] <- restore GetCommandLineA
0167:0132139A C3 RET

so if you hade MANUALLY logged that memory block where ASPR saves GetWhatWeWant API result then you will know that [1326CF0] holds result of GetCommandLineA API
[end quote]

Give this a try.

Regards.
foxthree
09-09-2002, 07:55 PM
Hello there:

How much ever hard I try, I can't answer better than +SplAj and JMI. Seek and ye shall find ... Follow, +SplAj's post as posted by JMI and you'll never miss...

Signed,
-- FoxThree
LOUZEW
09-09-2002, 08:06 PM
OK guys (JMI & Foxthree)
First of all (about attachment) i was thinking that this text file was only a piece of text and not a section of code, i've noted your advice !

I'll try now what you said JMI and let you know

Thank's again for your responses guys !
esther
09-10-2002, 11:35 AM
Hi FoxThree,JMI,
Thanks for directing newbies to search the board ;).How ironic when the answer is right under your nose and you didn't bother to look at it :( :eek:

Best Regards
+SplAj
09-10-2002, 12:46 PM
LOUZEW

The public release of ASPR1.2x plugin that fits Imprec/RV worked for a long time.

This is a delphi 'bloatware' dll , but a packed version. Currently it does NOT resolve the latest Alexey trick to shake off API tracers :-

001F3500 kernel32.dll 01DC GetVersion <-WRONG should be GetCommandLineA

If you un-assemble that redirector call in SI you'll see wtf gives ;)

BTW wtf is '+slaj' ??????? r u taking piss :)
LOUZEW
09-14-2002, 08:55 PM
Hi, all
many thank's for your responses and your help. I've read many posts and tutorials this last two days and found some interesting things. I've read the evaluator post that describe Api calls and their offset from begining of aspr module. My UNRESOLVED calls where exactly at these offsets. Well, dumped and fix now AOXPPRPro.exe but have still a Pb. The App crashe, lot of work again, i'll read more again !

Only a question : HOW do you do to know theses api calls ?, cause following your tuts, i never seen them, maybe something wrong for me, here is what i do :

BPX GetVersion. F5 and trace back to asprcode with F12 , after that never seen the following

xxxxxxxx : PUSH 00
xxxxxxxx : CALL KERNEL32!GetModuleHandleA
xxxxxxxx : MOV [yyyyyyyy],EAX
xxxxxxxx : CALL KERNEL32!GetVersion
xxxxxxxx : MOV [yyyyyyyy],EAX
xxxxxxxx : PUSH 017B35AC
xxxxxxxx : CALL KERNEL32!GetVersionExA
xxxxxxxx : CALL KERNEL32!GetCurrentProcess
xxxxxxxx : MOV [yyyyyyyy],EAX
xxxxxxxx : CALL KERNEL32!GetCurrentProcessId
xxxxxxxx : MOV [yyyyyyyy],EAX
xxxxxxxx : CALL KERNEL32!GetCommandLineA
xxxxxxxx : MOV [yyyyyyyy],EAX
xxxxxxxx : RET

I've found this sequence only on an older Asprotected App (Aspr 1.2)

TO Foxthree : till you've fixed it, Maybe can you PM me a little tut for the complete unpack/Fix method with AOXPPRPro for exemple.

I really want to know more on Asprotect ( the protected App don't care but i have this one and allready worked on)

In advance, Thank's to all of you my friends !!!
evaluator
09-15-2002, 07:19 AM
>>that never seen the following

Because that code peace is from older aspr versions.

Now is another code. Debug aspr code & find it.
Don't be lazy.


Question on coding a patcher...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Question on coding a patcher...
PDA

View Full Version : Question on coding a patcher...

foxthree
09-08-2002, 04:36 PM
Hi PPl:

Firstly, Hiya +SplAj guru :D Glad to see you're back ... Now thingz get interesting :) ...

OKey, I've managed to "fix" an application so that it is completed unpacked and regged. Now what I want to do is to make a patch for it.

But, the packer is our fav. ASPR and the proggie itself is doing lot of CRC checks of code. I have all the original CRC bytes and need to poke it into the memory using a loader.

My idea is as follows:

(1) Break at the OEP of the proggie (After ASPR does its job)
(2) Alloc Memory in the Target app and write original CRC values
(3) Modify the CRC checker code to read this CRC values instead of computing it
(4) Regg the application (Memory writes)

I've written the loader using the Debugger approach and it works perfectly fine. I am able to break at the OEP (after ASPR does its work) so now I just have to poke the correct CRC values. But question is where do I store these values. I try to call VirtualAllocEx but it fails with error code = 120 (This Op. is valid only on Win32??? whatever that means :()

Can somebody help??? I believe AIPH is used to make patches for ASPRed apps. But I try with latest AIPH version and they fail.

Also can I create a section and write the CRC values there? If yes, is there a library out there that can add sections to PE file programatically. I did find some sample code on Icz. web site but it doesn't work on target (ASPR says File Corrupt :()

Signed,
-- FoxThree
hack3r2k
09-08-2002, 10:03 PM
Try to visit : http://y0da.cjb.net :) (Code snippets section)

best regards,
.:hack3r2k:.
+SplAj
09-09-2002, 09:03 AM
Hi Fox3

that's a nice challenge you set yourself. However, lets review the reason for doing it.

1) You unpack and rebuild a target
2) You fix the annoying bugs made by programmer
3) You have no HD space left on your 120GB IBM ATA100 HD (too much mpeg pron)
4) You need to discard your 3 meg exe and revert to using original 800k exe but need to patch it with loader/in-line.
5) you try GlObals AIPH (but it fails on your target)
6) you want to re-invent wheel......STOP!

Then lets ask GlObal for his assistance (if he has some spare time). He spent a lot of hours studying aspr codewoods to create his application. He generously gave us a release version to play with. So we should try and develop it , team work blah blah , the nice way :)

It just needs a 'Yureka' event for us mere 'unpackers' to get into his in-liner code and understand AIPH and make it work for ANY target. (but really you have to manually unpack/rebuild because how to fix bugs otherwise ?)

NB
==
If ANYONE considering releasing lame-ass-patches-for-the-masses then /ME == NOT interested.
disavowed
09-09-2002, 02:29 PM
Originally posted by +SplAj
3) You have no HD space left on your 120GB IBM ATA100 HD (too much mpeg pron)

foxthree: solution to that problem of yours: use the new windows media 9 series video encoder:
"The new WMV 9 creates high quality video for streaming, download-and-play, and physical format delivery, with a 15-50 percent compression improvement over WMV 8 (the highest gains occur at the highest bit rates). This means that a WMV 9 file is typically only half the size of a MPEG-4 file of comparable quality."
(from http://www.microsoft.com/windows/windowsmedia/9series/encoder/quality.asp)

that should help solve the problem you have of having your porn take up too much hd space, like you said
Solomon
09-09-2002, 03:06 PM
hehe, I guess fox3 means dealing with CV 3.:D

If so we can put the hash values at the entry point of MD5Update( ). This is a very long procedure and it is called only by the the crc check routine. So there is enough space to hold the hash.
+SplAj
09-09-2002, 03:28 PM
Tamos product unpackers

If you use the 'SV Black-Box' system it uses only 90 (Dec) bytes to
fool the CRC loop in CV3.4

I thought we discussed this already ?

I did review that CV3.4 thread and let out a big sighhhhhh, no further comment here.

Disa,

does WMV 9 make horse dick == midgey's dick ??? I would not want to go blind following the action ;)
foxthree
09-09-2002, 07:44 PM
Hiya +Splaj guru:

I think you misunderstood me. Me wanna make patch so that I need not have to repeat the same exercise for Win9x and Win2K (rebuilt IT and paste etc...) Since, I unpacked in NT, I wanna make it work without much ado under Win9x too. Thats' why. I *NEVER* release patches for lame-ass-public :)

Also, I tried both Solomons' and your SV-Black-Box method, +SplAj and both "ROCKS" absolutely. :D

BTW, Solomon, nice guess and you're right and yipppeee my lil' loader works like a charm on both Win9x and Win2K on the latest CV 3.4.243 :D

In Evals' words, ALLA FINITA COMMVIEW COMEDIA :)

Thanks +Splaj for you rather humurous comments and disa, u too.

I'll be seeing you "gurus" around :D

Signed,
-- FoxThree

PS: +SplAj guru, check ur PM :)


armkiller on Dvd region-free
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > armkiller on Dvd region-free
PDA

View Full Version : armkiller on Dvd region-free

sobdk
09-09-2002, 12:44 AM
Ok, I have read serveral of the post on the board about unpacking armadillo and they have helped a lot, but I still haven't been able to unpack my target successfully.
What I have done so far:

1. I ran armkiller on my target, and found the eip.bin file containing the oep, which I verified using windasm on my dump.

2. Then I used imprec on it to repair the iat. First it says the imported functions are ok, but when I build it the file doesn't run. So Then I increase the size of the iat, and some of the functions show up as invalid, but I can't seem to repair them because when I run auto trace the program crashes.

I am running winxp, I don't know if this helps or not, but please give me some advice on how I can fix the iat!
DakienDX
09-09-2002, 09:39 AM
Hello sobdk !

Are you sure you rebuilt the right IAT?

I think you rebuilt Armadillo's IAT instead of the applications IAT which is wrapped by Armadillo. The other possibility would be that you didn't start at the IAT, but started rebuilding somewhere in the IAT and maybe left out the imports of some DLLs.

Why does everybody want to unpack DVD Region Free? This is not the first question about it and the people don't understand that they don't have a full working copy if the IAT and the OEP is rebuilt. Then you are only at the place where manual cracking starts.
BenJ
09-09-2002, 06:41 PM
It's useless to launch "trace" function for IAT rebuilding with Imprec : arm will manage to make imprec find wrong API calls !

Don't know wether newest versions of armkiller rebuild IAT or not... but I've found that the best way is to trace arm when it modifies the API pointers BEFORE launching the target : in this process (same proc is called for each api), you'll find somewhere in memory an array with the original api names... print it, so you can than check the apis imprec has rebuilt, and eventually correct them

;)
sobdk
09-10-2002, 01:09 AM
Thanks for your help, I just want to make sure I understand what you are saying. I am a newbie when it comes to cracking, and haven't come across a program that has been packed before.

BenJ, are you saying that after I use armkill on my target there isn't a way to rebuild the iat automatically? If so, you mention a way to manually rebuild it. Could you be a little more specific? I understand what a iat does, but I don't know how to find the list of api's you mention in the memory, and I don't know what program to use to rebuild the iat after I have found the api's. I guess I am not sure how you would tell which api goes where either.

Sorry I have so many questions, I would like to learn, if you know a good tutorial about this please let me know.
JMI
09-10-2002, 02:16 AM
sobdk:

It's my job (and self appointed at that) to remind people they are supposed to try to help themselves and search for answers before they post questions here. Our resident unpaxing guru, +Spl/\j has even started using my initials as a substitute for the word "search" (as in "you should do a JMI").

Your subject is Armadillo. Go to the top of the Forum and click the search button. On the left side you will see a place to enter a subject for your search. You can use more than one work and the "+" sign. Yes, I know that you said that you had " read several posts" but you still used armkiller, instead of trying to learn how to actually unpack this puppy.

Go back and actually READ the posts from several of the threads where they talking about actually unpacking Armadillo. Using "Armadillo + unpacking" I got 11 threads, at least two with 30+ posts. As I recall the one started by ThrawN has some good information in it. Most of the others will also.

If you "sux" at unpacking, READ the general unpacking threads on how to trace a re-directed IAT. The one right below this one on elcomsoft has some of +Spl/\l's wisdom.

I do not seek to give you a hard time. My mission is to teach "how to find information." If you learn THIS skill you are making great progress on becoming a good reverser. The information, certainly the basic information you have asked about, is out there (and is already here) and it is only a demonstration of lack of effort to not seek the information yourself BEFORE you ask someone here to take you by the hand and lead you to the basic knowledge necessary to do what you want.

It takes time and effort. There is NO easy way to actual learning. Make that effort and YOU will be the wiser for it. You will actually learn very little if someone just shows you how to solve the problem for THIS program. You want to learn how the IAT works and how protectors screw with it to try to prevent you from doing what you want to do here.

If everyone is in too great a hurry to crack their first "whatever" instead of learning the complex information necessary to understand what they are doing and trying to do, they have to keep coming back for the basic questions.

This is not the same as helping someone who read the material and doesn't understand it yet, but your response seems to suggest that you just haven't read enough yet. Give it a shot and come back with more focused questions.

Regards.
BenJ
09-10-2002, 07:25 AM
sodbk: I confirm what JMI wrote : some days ago, I was exactly at the same point you are. Now I've unpacked successfully several targets, without armkiller... and in between I've learned plenty of things !

Just to answer your questions :
- there is a difference between "resolving APIs" (resolve the right pointers to the right apis in iat), and "rebuild iat" (fix dump). Imprec will be usefull to rebuild IAT , but before you must verify that apis have been resolved correctly (whatever the tool you use : armkiller or your brain)

- I had got problems in the past with former versions of armkiller:all the pointers were not correctly resolved. That's why I went into manual unpacking. For this all necessary info is in this forum.
sobdk
09-10-2002, 05:41 PM
Thanks BenJ and JMI

I appreciate your replies, infact I new I would get these replies from someone because I seemed to have made the fatal cracker flaw in my post I asked for help. Go Figure. Every forum I have ever read when someone doesn't understand and asked for help they always get the do a search reply. It is for that very reason that I don't normally ask, I just skip to the do a search part, which of course I did prior to my post.

JMI
I went back again and read every post about armadillo that I could last night thinking that I might have missed something or that maybe now that I was further into my target that some of it would be more helpful. Unfortunately while there is a lot about armadillo on these forums they are all about older versions, I am working with 2.52 I think, and there info doesn't seem to apply to me. The info on the boards about 2.52 and later, is very vague, and doesn't help much at all. I also did searches elsewhere last night, and found a tutorial that helps with manual unpacking in general though there target was with asprotect. This tutorial seemed pretty good, and I am sure there is a lot of good info out there I just need to find it. How else did you guys learn to do this shit right?

Anyway I have one question which is similar to what I asked to begin with. It was mentioned by BenJ that because amardillo mangles the iat it can't be fixed by imprec or revirgin. In every post/tut that I read when it comes to the iat part of unpacking your target every one says they used revirgin, or imprec to trace them. The ones who don't say they used these tools say they manually rebuilt the iat but don't say how. I guess I don't understand why some people say that you can't use imprec or revirgin, but everyone seems to use them without claiming that they did other stuff first(redirected the api calls). Infact the short instructions with armkiller tell you to use these tools.

I hope my post doesn't sound angry, believe my I'm not, and I do appreciate the efforts of anyone who replies.

As always I will continue to search for the answers
evaluator
09-10-2002, 08:04 PM
JMI!

WHY YOU DON'T USE "SEARCH" BUTT0N BEFORE POSTING?????????????

I found many identical posts from you~;0
JMI
09-11-2002, 03:00 AM
evaluator:

Our musician friend, didn't you see the "repeat" symbol at the end of the measure? I had to "repeat" the measure, err, message again. It's my job. :cool:

sobdk:

Perhaps it would be useful to take a step back and consider the basic concept of what the protectors do and what they have to start with. For this process you need a good understanding of the PE format and how things are generally organized in such files. You need a general understanding of how import and export tables function and how they are generally organized within a PE file. For example, you start with the understanding that a PE file MUST be able to find its imports and exports, or it CAN NOT function. The imports are organized in the IAT, which tell the program what special pieces of other code the programs needs to work properly, regardless of whether it comes from Windo$e or something specific to that program.

Now, if you have this general understanding about how things HAVE to work, you are a leg up on the process of restoring the program to that condition by removing the protector's tricks designed to prevent you from finding out how to register or otherwise use the software fully without paying for it. So next you need some general understanding of the types of "tricks" that the protectors use to mess with your mind and attempt to keep you from seeing the real code.

There are several basic tricks that they can try to make that task more difficult. They can, and the better ones do, mess with efforts to disassemble and/or debug the program, under the theory that if you can't see the code, you can't "fix" it. They can encrypt parts or all of the code to make it difficult to understand. They can screw with the IAT in several ways, but the more common it to give you something that may "look" like the IAT, but it has been redirected somehow in an effort to screw with the IAT reconstructors, Revirgin and Imprec. So you end up with an IAT, but it doesn't seem to lead to the correct APIs, so the "dumped" program doesn't work.

So we need some generic plans of attack on their efforts. The first and formost is to understand that the program HAS to remove its obfuscation and/or have code that leads to the CORRECT APIs, or it CAN'T work. If you start from that point, then you recognize that your job is to FIND where this happens, that point in the protector's code where the relevant part of the code is decrypted and/or re-directed somewhere else. This can be done is several different ways and the "correct" code could be written to the file somewhere and a way to find it written in the "original" location, or it might be stored in memory, either encrypted or decrypted.

Assuming you master the first hurdle and can actually look at the code (because if you can't, you aren't going to manually unpack it) you need to realize that you can actually trace the protection code as it decrypts or moves the important code parts somewhere else. This is different from tracing a dump of the exe, which is generally assumed to be the code AFTER the protector's code has done it's thing and moved stuff around, and maybe back again.

So if you have reached the OEP and then dumped your exe, there is a very good chance that the protector has ALREADY screwed the IAT. One safer approach, but often more difficult, is to watch the protector's code "unwind" itself and often you can actually see it decrypt an IAT and then mess with it in some fashion. For this type of protection scheme, you can often trace to that "magic moment" and then dump the IAT and paste it into a later dump from the OEP and, by that means, "fix" whatever the protector's code did to it, AFTER it decrypted it.

Another technique involves understanding how the re-directed IAT's function and using a debugger (again assuming you have mastered the attempt to prevent you from doing this very thing) and "trace" the IAT entries to determine where they actually go and "fix" your dumped IAT with this information.

So where does all this get you. If you understand that the protectors are working very hard to try to stay ahead of +tsehp and the author of Imprec and find some way to make revirgin and/or imprec fail to "resolve" the IAT or, better yet, make you THINK you have the correct IAT, when you don't, you will understand that for some protector's products, you need to check the results to make sure they are correct.

If you don't understand how to trace an API in the IAT, you only know how to use someone else's tool, and when the protectors learn how to mess with the tool, you are screwed. If you know how to defeat anti-debugger and anti-disassembler code, you have a leg up and now you only need to know how to trace and what to look for.

So to answer your question on how does one learn how to do this sh*t right, the direct answer is that at some point we read a great deal of material on each of the concepts I mentioned above, not just those directed at our "immediate" target" and eventually, over time, one gets a "feel" for the code and a better clue as to where to try to break into their efforts to see the important stuff.

You might not see this as "help" or as not the "help" you want "now." But I believe it is the help you really need to make real progress.

Regards.
sobdk
09-11-2002, 06:39 AM
JMI

Thank you I do find what you said very helpful, I had already found some tutorials that explained the method of finding the IAT in a debugger and tracing each jmp to the part of the code that redirects each api. But I like the idea of your method, which is probably what BenJ was saying about finding the IAT in memory before the protector mangles it and dump it. I will try both and see if I can succeed at one of them.

I think with the tutorials I have found and your help I will be able to get this one.

All you cracking masters just remember if a newbie asks to learn, and not just the answer it doesn't hurt to point them somewhere like anticrack.de, www.woodman.com, or somewhere they can find good info. "Do a search" is pretty vague for a newbie. I didn't even know this forum existed until I read the readme file in armkiller. And this forum has lots of info. And the whole "newbies need to learn to search the internet" thing is great, but you should remember that you learned that in one of Fravia's tutorials, so point them to it.
JMI
09-11-2002, 07:48 AM
sobdk:

I agree with your point about not just saying "search" and that is why I try to always give some guidance on where and/or how to find information. If you read my first post to you, you will notice it does contain some pointed directions on techniques for finding information on your subject, because it wasn't clear the extent of the search you had already done. I try to make it a practice to include an "if you had used the search button you would have found "XXX" type statement along with the reminder to try first to help oneself.

I truely wonder how many of our readers here have actually taken the trouble to visit the Fravia companion site and explored its many facets and wealth of information. That is where I started and the section on "How to Search" was one of the very first sections I reviewed and downloaded and studied.

I'm sure that people come here from all sorts of different paths through the dark codewoods. As I recall I did a basic search on one of the old line seach engines of "cracking" and "reversing" and just started checking our things that looked interesting and ended up here.

As for pointing people to anticrack.de, I refer people to specific section of their archive all the time and their site is Linked at the bottom of this Forum. CrackZ' archive also is worth reviewing if you haven't checked it out yet.

I have a general reluctance to refer people to tuts, even though I have more than 16 gigs of them on my HD, because I tend to believe that starting too early to just FOLLOW a tut inhibits the learning process necessary to gather the broad range of knowledge needed to do MORE than follow. Others have different opinions, but I believe that tuts are useful for studing concepts more that techniques, because by the time you get a tut the software programmer should have already changed something in the code and if you are relying on the tut, instead of an understanding of what you are doing, you are screwed again.

One has to assume, and you know what that makes of "u" and "me," that the protectors are reading boards like this to see what is said about their product and reacting to that information. We know Alexey LongRussianSurName reads the fourm from time to time because he has posted here. So learning how to crack v2.4 of something doesn't always mean that you know how to attack v2.4b or v4.5 of something. If you learn the basic concepts, then you have a head start and have to only discover the "new" twists.

And we don't direct people to 66.36.228.12 when they are already here, but, again, I have frequently directed people on other forums to seek answers here.

Regards.


problems with W32dam....need some help!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > problems with W32dam....need some help!
PDA

View Full Version : problems with W32dam....need some help!

Newbie2k2
09-09-2002, 09:37 AM
when finishing processing the lines of a file it got freezed and stop responding.. would someone please tell me what to do??? it start ok. process the jumps. then the problem comes when starting processing the lines...

as i saw moderators or new rules don't let me post links on here PM me for the app. link is someone is interested on helping me.. please!!!! the App. name is Smart Draw..

thanks !!!
squidge
09-09-2002, 11:50 AM
Lots of programs can cause w32dasm to fall over, try IDA on it instead.
Newbie2k2
09-09-2002, 02:04 PM
i need W32dasm to work with me.. i don't understand IDA is not so easy as Dasm.. please someone guide me or tell me how to patch Dasm to remove this problem..
JMI
09-09-2002, 04:48 PM
Newbie2k2:

Most likely the problem is not with W32dasm, but is that the programmer of the software has coded something in his program to confuse W32dasm. There really isn't a way to "patch" W32dasm to "fix" the problem with the individual code, because it attacks the way that a dissembler works. You have to patch the program's code if this is the problem.

What I would suggest you do first (and again what everyone is supposed to do before posting a question) is do a search here for threads on "W32dasm" using the "+" sign with various other words, such as "stops working"or some such. My own quick search listed 181 topics addressing this combination, including several that have titles that should be of interest.

Second, use the link on the bottom of the Forum and go to the Anticrack site, then go to the articles section and to the "Current active topics" section. There you will find a section of articles titled RCE Anti-disassembler" which will describe for you how they block W32dasm from working.

One of the most common is to have a couple of jumps that jump back and forth to eachother. There is a short article there by
?ferret which describes this trick. You would see something like
************
400000 JMP 401000
401000 JMP 400000
He notes that:

this keeps the disassembler busy processing jump references til it run out of RAM and locks.....

pretty smart thinkin, but ez to defeat after u figure it out.....if u run across a proggy that does this, open it up in a hexeditor and nop those jumps (they aren't executed anyway)
***********

You are probably going to have to learn how to look at the code in a debugger to find this type of trick if W32dasm freezes.

There are also threads here discussing problems with the memory W32dasm allocates for export names, which you should read.

Give this a try and come back with more questions if you review these subjects and still don't figure out a solution.

Regards.
Newbie2k2
09-09-2002, 07:37 PM
:mad: dear JIM yes i did search but this case i think has never been explained before.... noping those JUmps which i don't think are really jumps make the exe unusuable. anyway won't make any changes.. still crashing.. only happend with this exe file.. i got enought RAM.. this is the error message:

Processing lines.....line 6788

then:

W32DSM89 caused an invalid page fault in
module KERNEL32.DLL at 01d7:bff9db61.
Registers:
EAX=c00309c4 CS=01d7 EIP=bff9db61 EFLGS=00010212
EBX=00630354 SS=01df ESP=0062ffc8 EBP=00630264
ECX=00000000 DS=01df ESI=00630370 FS=0ef7
EDX=0063027c ES=01df EDI=00e7fe28 GS=0000
Bytes at CS:EIP:
53 8b 15 e4 9c fc bf 56 89 4d e4 57 89 4d dc 89
Stack dump:
i need an expert or someone to try that exe to see what is going on.. please i need help. can you try it JIM?
here it is :
Newbie2k2
09-09-2002, 07:57 PM
JIM ok.. i got it... problem solve by deleting the last section.. thanks for your gently reply and for not insulting me like before :D
Kayaker
09-10-2002, 12:53 AM
Hi

Let me give a bit of explanation of what's going on here. Yes, W32Dasm fails to properly disassemble PE files which have a slightly "non-standard" resource section. If you look at this file in a resource editor you'll see certain "Named Resources" such as "PNG" "SERIAL" "WMF" that go along with the standard resources such as cursor, bitmap, icon, etc. WDasm can't handle these types of resources and a crash eventually occurs somewhere in Kernel UnhandledExceptionFilter code.

Specifically, if you look at the exe file in an editor like PEBrowse you can see the Named Resources listed:

NumberOfNamedEntries = 0x0007 ; Named Resources
NumberOfIdEntries = 0x000B ; Standard Resources

Named Entry #1 ; i.e. "PNG"
Type = 0x80009226
OffsetToData = 0x800000A0
Characteristics = 0x00000000
TimeDateStamp = 0x00000000
...follows the structure of each individual resource under the heading Named Entry #1

Named Entry #2 ; i.e. "SERIAL"
Type = 0x8000921E
OffsetToData = 0x800001E8
...follows the structure of each individual resource under the heading Named Entry #2

----------------------

The .rsrc section is built as a tree-like structure with pointers to branches and subbranches describing each resource. A resource editor follows these branches and compiles them for our convenience, but in the PE file it's built up beginning with pairs of dwords for each Named (or Id) Entry, giving the Type and OffsetToData, which is a pointer to the next branch of that particular resource. In hex mode it looks like this, where the first WORD is the NumberOfNamedEntries value and follows are the DWORD values for each Named Entry#

001F900C 0700 0B00 2692 0080 A000 0080 1E92 0080
001F901C E801 0080

If you were to change the NumberOfNamedEntries to 0 and delete the pairs of dwords, Type and OffsetToData, for each Named Entry by changing them to 0 as well, W32Dasm should be able to disassemble the file. This is why deleting the .rsrc section worked.

This is an old W32Dasm bug that I'm sure could be fixed if someone bothered trying. I'm assuming W32Dasm is reading this section to get the String Refs. Somewhere in that part of the code it chokes on these Named Entries, which could be as simple a thing as the way it parses the names and the " " characters. What do we need to do here, create a mini project "Improve W32Dasm" ?? ;-)

JMI's replies have in reality only ever meant to be helpful, and his 'search till you drop' advice is probably the best advice all around. If your search was thorough you also would have found an old archived post by me right next to the other ones you found, describing this exact problem and its cause, or references to it in earlier threads on this board. I'm not saying you should have or could have found it and related it to your problem, just that it does exist and is in the huge database of information available.

Heh, why do people keep calling you JMI JIM? :D

Cheers,
Kayaker
JMI
09-10-2002, 02:25 AM
Kayaker:

Once again you have proven that although you are "happy when wet," you are most certainly not "all wet." I guess people think that my nick is a name, instead of initials and while there is a name "JIM" there is no name "JMI." Anyway, I know who they are referring to, and have been called much more colorful names.

:D :D

Regards.
Newbie2k2
09-10-2002, 02:41 PM
i really apreciated your help and replies guys!! thanks alot :D


How to patch an encrypted dll after it's loaded?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to patch an encrypted dll after it's loaded?
PDA

View Full Version : How to patch an encrypted dll after it's loaded?

scruffy
09-09-2002, 05:35 PM
I hope some of you clever guys can help me. :)

I've managed to patch encrypted exe files before by creating a loader/WriteProcessMemory but now I need to do this with an encrypted dll. This particular dll is itself called by an encrypted exe which I've managed to dump but I have no idea how to access the unencrypted dll memory for patching once it's loaded!

I think the dll is packed using armadillo cos pe-scan tells me there's a 90%+ match using the heuristic search.

Please help!! :confused:
scruffy
09-10-2002, 11:00 AM
I managed to get it done! :D

I used ProcDump to dump the decrypted dll to a file for disassembly and then used thewd's excellent "Process Patcher" utility to patch the dll after it loaded. It allowed me to patch the dll loaded by the child process created by the original encrypted exe.
Woodmann
09-10-2002, 10:38 PM
I like posts like this one :)

He managed to think and solve his own problem.

Peace, Woodmann


help on delphi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > help on delphi
PDA

View Full Version : help on delphi

m.albert
09-09-2002, 09:55 PM
Hi I'm looking for the serial number check part of a program written in Delphi.
It seems to me looking at the section below that I'm not too far from the target. Each digit of the entered serial is compared with 20.
What do you think?
Should I explore close to this?
Thanks and Regards
Michael

* Reference to: system.@LStrLen:Integer;
| or: system.@DynArrayLength;
| or: system.DynArraySize(Pointer):Integer;
|
00409ADE E86DA7FFFF call 00404250
00409AE3 8BF0 mov esi, eax
00409AE5 BB01000000 mov ebx, $00000001
00409AEA EB01 jmp 00409AED
00409AEC 43 inc ebx
00409AED 3BF3 cmp esi, ebx
00409AEF 7C07 jl 00409AF8
00409AF1 807C1FFF20 cmp byte ptr [edi+ebx-$01], $20
00409AF6 76F4 jbe 00409AEC
00409AF8 3BF3 cmp esi, ebx
00409AFA 7D0A jnl 00409B06
00409AFC 8BC5 mov eax, ebp

* Reference to: system.@LStrClr(String);
|
00409AFE E8BDA4FFFF call 00403FC0
00409B03 EB17 jmp 00409B1C
00409B05 4E dec esi
00409B06 807C37FF20 cmp byte ptr [edi+esi-$01], $20
00409B0B 76F8 jbe 00409B05
00409B0D 55 push ebp
00409B0E 8BCE mov ecx, esi
00409B10 2BCB sub ecx, ebx
00409B12 41 inc ecx
00409B13 8BD3 mov edx, ebx
00409B15 8BC7 mov eax, edi

* Reference to: system.@LStrCopy;
|
00409B17 E83CA9FFFF call 00404458
00409B1C 5D pop ebp
00409B1D 5F pop edi
00409B1E 5E pop esi
00409B1F 5B pop ebx
00409B20 C3 ret
naides
09-10-2002, 04:16 AM
Originally posted by m.albert
Hi I'm looking for the serial number check part of a program written in Delphi.
It seems to me looking at the section below that I'm not too far from the target. Each digit of the entered serial is compared with 20.
What do you think?
Should I explore close to this?
Thanks and Regards
Michael

* Reference to: system.@LStrLen:Integer;
| or: system.@DynArrayLength;
| or: system.DynArraySize(Pointer):Integer;
|
00409ADE E86DA7FFFF call 00404250
00409AE3 8BF0 mov esi, eax
00409AE5 BB01000000 mov ebx, $00000001
00409AEA EB01 jmp 00409AED
00409AEC 43 inc ebx
00409AED 3BF3 cmp esi, ebx
00409AEF 7C07 jl 00409AF8
00409AF1 807C1FFF20 cmp byte ptr [edi+ebx-$01], $20
00409AF6 76F4 jbe 00409AEC
00409AF8 3BF3 cmp esi, ebx
00409AFA 7D0A jnl 00409B06
00409AFC 8BC5 mov eax, ebp

* Reference to: system.@LStrClr(String);
|
00409AFE E8BDA4FFFF call 00403FC0
00409B03 EB17 jmp 00409B1C
00409B05 4E dec esi
00409B06 807C37FF20 cmp byte ptr [edi+esi-$01], $20
00409B0B 76F8 jbe 00409B05
00409B0D 55 push ebp
00409B0E 8BCE mov ecx, esi
00409B10 2BCB sub ecx, ebx
00409B12 41 inc ecx
00409B13 8BD3 mov edx, ebx
00409B15 8BC7 mov eax, edi

* Reference to: system.@LStrCopy;
|
00409B17 E83CA9FFFF call 00404458
00409B1C 5D pop ebp
00409B1D 5F pop edi
00409B1E 5E pop esi
00409B1F 5B pop ebx
00409B20 C3 ret

Smells to me that this code is scanning the string pointed by edi for control characters, with a value of 20 or less. when it finds them, it ignores them and continue with the next. if the char is above 20, ie, printable, does one more check and appears to copy it into the address contained in ebp.

I think it is getting rid of non printable chars. you are cold, but getting warm
m.albert
09-10-2002, 07:32 PM
Which of the following sections is most likely to contain the check routine for the serial?
Thanks
Michael

|* Reference to: sysutils.Trim(System.AnsiString):System.AnsiString;
|* Reference to: system.@LStrAsg;|
* Reference to: system.TObject.Free(TObject);

* Possible String Reference to: 'ŠEÿ[‹å]Ã‹ÀU‹ì3ÀUh?H^'
|
* Reference to: system.@LStrClr(String);
|
* Reference to: system.@LStrClr(String);
Manko
09-10-2002, 09:46 PM
Originally posted by m.albert
Hi I'm looking for the serial number check part of a program written in Delphi.
It seems to me looking at the section below that I'm not too far from the target. Each digit of the entered serial is compared with 20.
What do you think?
Should I explore close to this?
Thanks and Regards
Michael

Hi, Michael!

Why don't you just break on some adress from that listing and find out for your self if it's checking your serial?
If so, just follow it and see what you can find!

Have you already checked the code when you press ok in the regform or the code when you call upp the regform?
That is, disassemble in dede and get a good adress to trace from in sice...
Usually you can follow it sucessfully from those.

//Manko
m.albert
09-10-2002, 09:49 PM
I would like to use ollydbg instead of softice is that OK do you think?
Manko
09-10-2002, 09:52 PM
Originally posted by m.albert
Which of the following sections is most likely to contain the check routine for the serial?
Thanks
Michael

|* Reference to: sysutils.Trim(System.AnsiString):System.AnsiString;
|* Reference to: system.@LStrAsg;|
* Reference to: system.TObject.Free(TObject);

* Possible String Reference to: 'ŠEÿ[‹å]Ã‹ÀU‹ì3ÀUh?H^'
|
* Reference to: system.@LStrClr(String);
|
* Reference to: system.@LStrClr(String);

Those are not sections, those are calls.
Taken out of context like that, they mean next to nothing to me...
(So why do I bother answering...:P)
Please include more code and tell us how you got that code...
From what form and what button or was it a call further in from souch a point or did you trace in after having exported the symbols from dede?
There's just not very much info to go on. :)

//Manko
stealthFIGHTER
09-11-2002, 12:36 AM
|* Reference to: sysutils.Trim(System.AnsiString):System.AnsiString;

Trim trims leading and trailing spaces and control characters from the given string. (useful)

|* Reference to: system.@LStrAsg;|

Assign a string.

* Reference to: system.TObject.Free(TObject);

useless

* Possible String Reference to: 'ŠEÿ[‹å]Ã‹ÀU‹ì3ÀUh?H^'

useless

* Reference to: system.@LStrClr(String);

Clear a string.
m.albert
09-11-2002, 10:18 PM
here are the sections which look interesting.
Which one do you think I should focus on?
Thanks
Michael

* Reference to: controls.TControl.GetText(TControl):System.String;
|
005E47F2 E8F53DE5FF call 004385EC
005E47F7 8B45F0 mov eax, [ebp-$10]
005E47FA 8D55F4 lea edx, [ebp-$0C]

* Reference to: sysutils.Trim(System.AnsiString):System.AnsiString;
|
005E47FD E8D252E2FF call 00409AD4
005E4802 8B55F4 mov edx, [ebp-$0C]
005E4805 8BC3 mov eax, ebx

* Reference to: system.@LStrAsg;
|
005E4807 E808F8E1FF call 00404014
005E480C C645FF01 mov byte ptr [ebp-$01], $01
005E4810 33C0 xor eax, eax
005E4812 5A pop edx
005E4813 59 pop ecx
005E4814 59 pop ecx
005E4815 648910 mov fs:[eax], edx

****** FINALLY
|
005E4818 682D485E00 push $005E482D
005E481D 8B45F8 mov eax, [ebp-$08]

* Reference to: system.TObject.Free(TObject);
|
005E4820 E857E9E1FF call 0040317C
005E4825 C3 ret

005E4826 E9B1F0E1FF jmp 004038DC
005E482B EBF0 jmp 005E481D

****** END
|
005E482D 33C0 xor eax, eax
005E482F 5A pop edx
005E4830 59 pop ecx
005E4831 59 pop ecx
005E4832 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: 'ŠEÿ[‹å]Ã‹ÀU‹ì3ÀUh?H^'
|
005E4835 6852485E00 push $005E4852
005E483A 8D45F0 lea eax, [ebp-$10]

* Reference to: system.@LStrClr(String);
|
005E483D E87EF7E1FF call 00403FC0
005E4842 8D45F4 lea eax, [ebp-$0C]

* Reference to: system.@LStrClr(String);
|
005E4845 E876F7E1FF call 00403FC0
005E484A C3 ret

005E484B E98CF0E1FF jmp 004038DC
005E4850 EBE8 jmp 005E483A

****** END
|
005E4852 8A45FF mov al, byte ptr [ebp-$01]
005E4855 5B pop ebx
005E4856 8BE5 mov esp, ebp
005E4858 5D pop ebp
005E4859 C3 ret
stealthFIGHTER
09-11-2002, 10:40 PM
Hello m.albert,

I can't see any important routine here... (except first two)
But try to concentrate on the first two routines...

* Reference to: controls.TControl.GetText(TControl):System.String;
|
005E47F2 E8F53DE5FF call 004385EC
005E47F7 8B45F0 mov eax, [ebp-$10]
005E47FA 8D55F4 lea edx, [ebp-$0C]

Program reads the input string (serial) probably from TEdit.
(input := TEdit1.text)

* Reference to: sysutils.Trim(System.AnsiString):System.AnsiString;
|
005E47FD E8D252E2FF call 00409AD4
005E4802 8B55F4 mov edx, [ebp-$0C]
005E4805 8BC3 mov eax, ebx

Trim trims leading and trailing spaces and control characters from the given string
(input := Trim(input))

* Reference to: system.@LStrAsg;
|
005E4807 E808F8E1FF call 00404014
005E480C C645FF01 mov byte ptr [ebp-$01], $01
005E4810 33C0 xor eax, eax
005E4812 5A pop edx
005E4813 59 pop ecx
005E4814 59 pop ecx
005E4815 648910 mov fs:[eax], edx

Nothing with your input/serial.

****** FINALLY
|
005E4818 682D485E00 push $005E482D
005E481D 8B45F8 mov eax, [ebp-$08]

* Reference to: system.TObject.Free(TObject);
|
005E4820 E857E9E1FF call 0040317C
005E4825 C3 ret

005E4826 E9B1F0E1FF jmp 004038DC
005E482B EBF0 jmp 005E481D

Nothing with your input/serial (usually).

****** END
|
005E482D 33C0 xor eax, eax
005E482F 5A pop edx
005E4830 59 pop ecx
005E4831 59 pop ecx
005E4832 648910 mov fs:[eax], edx

****** FINALLY

Nothing with your input/serial (usually).

* Possible String Reference to: 'ŠEÿ[‹å]Ã‹ÀU‹ì3ÀUh?H^'
|
005E4835 6852485E00 push $005E4852
005E483A 8D45F0 lea eax, [ebp-$10]

* Reference to: system.@LStrClr(String);
|
005E483D E87EF7E1FF call 00403FC0
005E4842 8D45F4 lea eax, [ebp-$0C]

* Reference to: system.@LStrClr(String);
|
005E4845 E876F7E1FF call 00403FC0
005E484A C3 ret

005E484B E98CF0E1FF jmp 004038DC
005E4850 EBE8 jmp 005E483A

****** END
|
005E4852 8A45FF mov al, byte ptr [ebp-$01]
005E4855 5B pop ebx
005E4856 8BE5 mov esp, ebp
005E4858 5D pop ebp
005E4859 C3 ret
Nothing with your input/serial.

As you can see there are ONLY system (SysUtils, SysInit, Windows units) functions that Delphi uses.

sF


Problem with "Dongle" prot. App...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Problem with "Dongle" prot. App...
PDA

View Full Version : Problem with "Dongle" prot. App...

cHeCksUm
09-10-2002, 12:53 PM
Hia,
I am working on a target called Tapeview and have run into some trouble. Some general info:

- The "real" version is protected by a dongle of some kind along with a key.
- There is a trial version that one can download that expires after 14 days.
- There are three versions of the program. Bronze, silver and gold.
- One can receive extended demo keys that make it gold/30 day. This leads me to believe that the demo is the full version, and can be cracked without key/dongle.
- It complains when setting date back.
- The demo version needs a password for the setup.
- The setup program used is some thing called innosetup.
- It is MS VC++

So what I have done so far is I have cracked the setup password so the application installs ok. However cracking the application seems harder. When browsing through the code with ollydebug I saw several references to "debugger detection" etc. but they never seemed to trigger on OllyDbg. However when trying to breakpoint on the usual functions for serial fishing I get nothing. I am able to break on createfilea during start-up but I haven't found anythign interesting yet (ongoing). So if anyone here could give me some hints as to how to proceed I would appreciate it. I am not asking for a complete answer... just some hints. I will post when I find something intersting. Thanks.

// cHeCksUm
hobgoblin
09-10-2002, 07:51 PM
Do you have an URL for the target?

hobgoblin
MTB
09-11-2002, 01:54 AM
Hiya Checksum

First does it complain after time expired you do NOT have a dongle. If yes, the protection is probably fairly simple. Down load a copy of IDA, and the usual dongle signatures. Run it over night on your exe, yes overnight it will take a while even on a 1Ghz machine, then search for your string.

If it doesn't complain about missing a key, you have a fair amount of work, you can try using IDA to see if you have a dongle sigature ie read, else try softice with the usual breaks. Hint go to the archieved CRACKZ site and download ALL the dongle tutorials including frog's print dongle bashing (yes I know it's old but hey software developers can't read).

Good Luck

MTB
cHeCksUm
09-13-2002, 06:43 PM
Sorry for not answering the Q's but I have been away all week attending courses. Anyhow the target can easily be found by searching for the name on google.

@MTB

The thing is I know it does not require the Dongle. The trail version comes without one. And so yes it complains of time trial expiring without dongle. The trial version without code is "bronze version" with 14 day trial whilst one can get a code which enables the trial to "gold version" and 30 day trial instead of 14. The code is computer specific, so one code will not work on two different machines. It is also ime dependant, and probably based on ones name (not sure here). Anyhow I have not had time to look at the target mroe since my first post, but as weekend has come it's time to roll up ones sleeves and get down and dirty with this target. Anyhow what I was asking before still stands. Since none of my traditional breakpoints seems to work I was wondering what else I could try!? Also is it possible to break on HMEMCPY in OllyDBG? Well I'm off to explore. Thanks for the ideas so far.

// cHeCksUm
cHeCksUm
09-20-2002, 05:54 PM
Well I have managed to "semi" crack it. In other words I can get it to work ok but I have to patch the thing by hand each time :(. At least now I know what I am dealing with. Seems to be armadillo wrapped target. It's time for me to put this target down... go read some tutes on armadillo and then come back and fully crack it. Thanks for the help.

// cHeCksUm
cHeCksUm
09-24-2002, 07:13 PM
Well keeping at it eventually paid off. After much trouble I managed to crack and patch the application fully this weekend. Wooohooo.... my first go against Armadillo... ok so I didn't unpack it but I cracked it at least... new version and all :]. The only thing is it still shows as a trial, but Gold edition that never expires, but I have one more thing to do. To make it think it is fully registered. The problem is the program starts up fine but after a while it dies most likely (about 99.999% sure) because of a dongle check. I can feel that the check is just round the corner though... I've got it on Zen radar and am homing in for final lock and... kabam!!!

Well enough ranting it's time for bed as it's another day at work tomorrow. Btw again thanks to the peep's on the board.... some threads where of great use on this target (and of course others as well). Happy cracking!

**
Ah almost forgot. I might do another tute as a "thank you" for all the help I have gotten here (contribute some myself in other words). Problem is not to make it target specific... might have to try another target with the same protection (armadillo) before I write a tute.
**

// cHeCksUm


softice help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice help
PDA

View Full Version : softice help

PETER
09-10-2002, 01:43 PM
hello

Trying to find a codes but cant`t find them ( for the program which i try to crack). There are lot of articles how to crack programs.
But cause i´m not a cracker much less know about assembly language it become a hard job
to crack. And even understand softice that allmost too much for me.
But i try nevertheless (cause i´m little bit intresting to crack). Thats explanation for a stupid questions. So when i load a program to a symbol loader and then before i push
registration buttom i go to softice and set pbx getwindowtexta.
Then back to program and accept own registration codes. Softice pop up and then start searching. Many tutor give a advice to press F10 a few times and then some places D something (exampl. d eax). How do i know places where i type D ... and is it possible to see codes (if place is right) in understandable form. So if i search through codes and type D.. when i think about there might be a codes. Is that anything sense?
(sorry bad english).

regars

peter
ZaiRoN
09-10-2002, 06:21 PM
Hi peter.

hmmm...
reading tutorials is always interesting and very helpful but attention!
when you are reading a tutorial, especially when you are a beginner, the most important thing to do is answer to several questions:
- why he's doing this thing?
- why he's using this particular command?
- which thing makes this particular command?
if you follow tutorials like an *automa*, you'll never increase your knowledge...

the F10 command is used to step through the code (and you should know that); it's useful because it's the only way from which you can understand (or try to understand...) what the proggie is doing in his name/serial routine protection (or elsewhere...).
for the 'd' command, there isn't a specific time to be used. you decide when it's the rigth time to use it.
personally i use it very often especially when i'm approaching a new target.

the best thing to make is to use both comnands in order to try to give a sense to the code you are stepping; obviously a little bit of assembly knowledge is needed (instructions are always the same)

use your brain and your finger will press F10, 'd ...'and many other commands at the right time :)

these are only few words and i don't know if is what you are looking for but i hope it helps a little bit...
good luck!

regards,
ZaiRoN
PETER
09-11-2002, 06:31 AM
Thanks for advice. I´m thinking about is there any sense to trace those codes. All my trouble begun when i installed 30 days working proggie. It left some mark into my computer. And because i don´t find it i thought i need then registration codes. Maybe it´s possible to find that mark in the register which that proggie left ( there might be other marks also). When i only find good proggie to sniff to register and also chance there dates. I try Active Registry Monitor. That shows a install date, but dont give fix it. Maybe that solve problem if i can chance a install day. I think it would be easy than using softice.

regards

peter


annotations
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > annotations
PDA

View Full Version : annotations

m.albert
09-10-2002, 07:23 PM
Is there an easy way to annotate electronically a disassembled program ex in w32dasm to indicate what the different sections are doing ?

Thanks
Michael
Manko
09-10-2002, 09:36 PM
Originally posted by m.albert
Is there an easy way to annotate electronically a disassembled program ex in w32dasm to indicate what the different sections are doing ?

Thanks
Michael

Go to protools and get a patch for w32dsm!
I think at least one of them enables the ability to comment the code...

/Manko


For newbiez-ASsPROT-unpacker help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > For newbiez-ASsPROT-unpacker help
PDA

View Full Version : For newbiez-ASsPROT-unpacker help

evaluator
09-10-2002, 09:09 PM
I see very many place is trushed on this MB because of ASS-emulated IAT-tricks.
So for help to MB(!) I wrote here some easy-generic info.

Emulated APIS for latest ASsPR ordered by their adress in ASsPR module:
(calculated from base of ASsPR module)

1 base+10EE8 =======KERNEL32.dll GetProcAddress
2 base+1133C =======KERNEL32.dll GetModuleHandleA
3 base+11358 =======KERNEL32.dll GetVersion
4 base+11388 =======KERNEL32.dll GetCurrentProcess
5 base+11390 =======KERNEL32.dll GetCurrentProcessId
6 base+1139C =======KERNEL32.dll GetCommandLineA
7 base+113B4 =======KERNEL32.dll LockResource
8 base+113C4 =======KERNEL32.dll FreeResource

--
Sometimes also is emulated 1 API from USER32.DLL====DialogBoxParamA

PS.

BAD NEWZ:(:
usualy when ASS read thiz, he will update..

GOOD NEWZ;);
we are here..&

_WE WILL,
___WE WILL,
_____ROCK YOUUUUUUU! <-protz

[Licensed to QUEEN]
kalisto
09-11-2002, 07:15 AM
Long live our friend AL SOLODNIKOV.:cool:
Dr.Golova
09-11-2002, 01:10 PM
[i]
1 base+10EE8 =======KERNEL32.dll GetProcAddress
2 base+1133C =======KERNEL32.dll GetModuleHandleA
3 base+11358 =======KERNEL32.dll GetVersion
4 base+11388 =======KERNEL32.dll GetCurrentProcess
5 base+11390 =======KERNEL32.dll GetCurrentProcessId
6 base+1139C =======KERNEL32.dll GetCommandLineA
7 base+113B4 =======KERNEL32.dll LockResource
8 base+113C4 =======KERNEL32.dll FreeResource
[/B]

But where DllFunctionCall for VB progz ??? :confused:
evaluator
09-11-2002, 04:31 PM
Dr.Golova!

Can't understand you.
Explain.
DakienDX
09-11-2002, 05:11 PM
Hello Dr.Golova !

evaluator wrote the information to tell newbies what imported DLL functions ASProtect emulates to confuse the reverser and the import rebuilder.

Now ask yourself, which of the functions evaluator pointed out are used in Visual Basic programs?

If a function isn't imported or the DLL isn't even used, ASProtect doesn't emulate these functions.

Very simple to understand, but your question was also quite confusing.
You could try to explain your problem or your question as bit more detailed next time.
So non-native english people like evaluator (and like yourself) will be able to understand it.
evaluator
09-11-2002, 06:00 PM
DX!

Dr.Golova is NOT newbz.

Maybe he jokes?
LaptoniC
09-11-2002, 11:42 PM
No He is not joking here is the list of emulatedapis by aspr

_type=1 ---->GetModuleHandleA kernel32.dll
_type=2 ---->GetVersion kernel32.dll
_type=3 ---->GetVersionExA kernel32.dll
_type=4 ---->GetCurrentProcess kernel32.dll
_type=5 ---->GetCurrentProcessId kernel32.dll
_type=6 ---->GetCommandLineA kernel32.dll
_type=7 ---->LockResource kernel32.dll
_type=8 ---->FreeResource kernel32.dll
_type=9 ---->SizeofResource kernel32.dll
_type=A ---->DialogBoxParamA user32.dll
_type=B ---->DllFunctionCall MSVBVMxx.dll

if it is vb app dllfunctioncall is also emulated.
DakienDX
09-11-2002, 11:50 PM
Hello LaptoniC !

OK, this was my fault. :(

I'm no Visual Basic user and I've never seen it anywhere.

So I thought "DllFunctionCall" would be some synonym for "Any function imported from the VB runtime library".
evaluator
09-12-2002, 07:17 AM
Heh!

Never hear, somebody asked for help-unpack asspoted VB...
Curious! (& how i like vb00)

OK. "Thanks for your submission", Dr.Golova!
Dr.Golova
09-13-2002, 11:56 AM
Originally posted by evaluator
Heh!

Never hear, somebody asked for help-unpack asspoted VB...
Curious! (& how i like vb00)

OK. "Thanks for your submission", Dr.Golova!

As we know, in VB you can't create any exported functions for using aspr API, so DllFunctionCall used in VB applications for communications with aspr layer, like GetProcAddress in native app (normally DllFunctionCall used in VB for calling any external dll function). I'm unpack several VB progz and always found this emulated function (yeah, only one emulated stub). aspr plugin for Revirgin can't resolve it :( Surely, manual fix this shit is very easy, but who knows....


unknown algorithm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > unknown algorithm
PDA

View Full Version : unknown algorithm

ajron
09-11-2002, 12:51 AM
Hi!

I have a problem with some algo. I included its pseudo code below. It's something like PowerMod but not exactly. It's used in public key cryptography. Does anyone know what's this? The algorithm operate on m,e,n and e is like in RSA e=65537. I do calculation for a few first e.

e=1: [m] mod n
e=2: [m^2-2] mod n
e=3: [m^3-3m] mod n
e=4: [m^4-4m^2+2] mod n
e=5: [m^5-5m^3-5m] mod n
e=6: [m^6-6m^4+9m^2-2] mod n
e=7: [m^7-7m^5+14m^3-7m] mod n

This is an algorithm:

In: M,N,E

R=M mod N
A=2
B=R

for(bit=BitCount(E)-1; bit>=0; bit--)
{
if(BitSet(E,bit)) // if bit=1
{
A=[(N-R)+(A*B)] mod N
B=[(N-2)+B^2] mod N
}
else // if bit=0
{
B=[(N-R)+(A*B)] mod N
A=[(N-2)+A^2] mod N
}
}

Out=A

Best regards,
Ajron.

ps. sorry for my english ;)
Dimedrol
09-11-2002, 08:35 AM
Hi,

This is a LUC public key encryption scheme.
Here there are some links regarding it http://www.kisa.or.kr/technology/sub1/LUC.htm

Regards, Dimedrol.
ajron
09-11-2002, 11:27 AM
Thx a lot ;)

Best regards,
Ajron.


Delphi counterpart to RegQueryValueExA?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Delphi counterpart to RegQueryValueExA?
PDA

View Full Version : Delphi counterpart to RegQueryValueExA?

Manko
09-11-2002, 04:32 PM
I'm sitting here with a program that on registration writes the serial to the registry and probably checks it later...

I've been braking on RegQueryValueExA and have not gotten anything out of it. :(

Is there a function in delphi 6 for reading keys in the registry which doesn't call RegQueryValueExA?

/Manko
Manko
09-12-2002, 12:00 AM
Didn't get any further with finding the delphifunction, but the coder was kind enough to hardcode the name of the key in the app. :)

I didn't find it at first as I'm new to IDA. (W32dasm wouldn't work with this proggy...) I just saw the place he wrote to the registry...

It bothers me that I would NOT have found my way if he had crypted that text...

/Manko
Manko
09-12-2002, 12:29 AM
Sigh!

I'm a dork!
Now that I know where it read the key I thought I'd see for sure if it not use regqueryvalueexa.
Of course it did... *blush*
How I could miss it, I do not know... except, there was a shitload of hits that just looked stupid. (Just because i don't know better...) Hmm... But I can swear I didn't encounter it...
I had even automated the task using several data windows looking for both resultbuffer and keyname and some other... hmm... Maybe I'm just too unexperienced. Probably looked at wrong things... Or was too impatient...

Next time I'll not be sidetracked. :)

btw, IDA seems great!

/Manko
naides
09-12-2002, 02:09 AM
I am glad we helped you with your problem :p


problem after unpacking asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > problem after unpacking asprotect
PDA

View Full Version : problem after unpacking asprotect

loman
09-11-2002, 04:58 PM
Hi, I've just unpacked powerstrip, protected with asprotect.... trying to run it , I receive an exception error, due to an instruction

mov al,[ebx]

I discovered that happens because outiside the call containing the instruction above, there's a call to GetVersion.
In original file it calls the GetModuleHandleA,pushes results in a location of memory and then pop this value in eax and them move in eax a value stored in memory....... I don't past code since don't want to go against board's rules..... btw I discovered that the zone of memory from wich data are fetched are initilized by GetVolumeInformationA, that's not run anymore after chaining the ip... my question is how to get the real call done since I've no the info of getvolume? is there any irc channel where I can discuss with you? thanks.......regards .....

-loman
evaluator
09-11-2002, 05:58 PM
write unresolved adress for fake GetVersion

U can also paste little disassembly here
loman
09-11-2002, 06:59 PM
seg000:0040287A call GetVersion <-Fake
seg000:0040287F lea edx, [ebp+var_4]
seg000:00402882 call sub_0_4027F8
seg000:00402887 mov ebx, eax
seg000:00402889 xor esi, esi

at 004027f8 we've

seg000:004027F8 push ebx
seg000:004027F9 push esi
seg000:004027FA add esp, 0FFFFFF00h
seg000:00402800 mov ebx, eax
seg000:00402802 jmp short FUNCTION

eax in dumped is C0000A04 while in original one is something as 8173A1A8,

seg000:00402804 inc ebx
seg000:00402805 mov al, [ebx] <-exception
seg000:00402807 test al, al
seg000:00402809 jz short primo_salto
seg000:0040280B cmp al, 20h
seg000:0040280D jbe short loc_0_402804
evaluator
09-11-2002, 07:17 PM
Congratz!

So it is:

GetCommandLineA

You are ~100 newb asked about incorrect
GetVersion (plugin use:)
loman
09-11-2002, 08:03 PM
how do you say it's getcommandlinea?? from what do you understand it??

are you reachable on irc?
SilSaLaMaTa
09-11-2002, 08:27 PM
Hi ,
Just search in the forum ...

Look at the next lines (after getversion) .
loman
09-11-2002, 08:39 PM
thanks :)
loman
09-11-2002, 09:17 PM
I've fixed it...now it works only under win998, on XP I receive a Exception Error..... I'll install debugger under it...


Sucessful (?) ASProtect unpack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sucessful (?) ASProtect unpack
PDA

View Full Version : Sucessful (?) ASProtect unpack

pknight
09-12-2002, 06:04 AM
Hey, I'm new to manual unpacking.. Been plugging away at unpacking an asprotected .EXE & I've had a *little* success ;)

I used the loader.exe (mentioned in other posts), dumped w/ ProcDump and rebuilt the IT w/ ImpREC. The unresolved API calls I resolved w/ the list evaluator posted (thnx evaluator). Revirgin didn't seem to resolve ANY API calls which was wierd.. I corrected the GetVersion entry (GetCommandLineA).

The result? I have an executable that actually runs (<grin> - a first for me w/ asprotect hehe). However, if I load the .EXE in OllyDbg I get the following message:

Bad or unknown format of 32-bit executable file

If I try to use IDA, I get:

Can't find translation for virtual address 001600AC

The .EXE doesn't seem to be quite up to par yet. Any suggestions?

-pknight

PS. Is there a SuperBPM equivalent for NT SICE? I'm running SICE under XP and my breakpoints/p ret's aren't triggering :(

PSS. are string refs too much to hope for w/ an asprotect unpack?

(thanks in advance!)
evaluator
09-12-2002, 07:16 AM
OK!

You NeeD update your tool!
Download new LordPE & use it as dumper and as rebuilder.

in Rebuilder's Option choose:
Status window; Dumpfix; Validate PE;

now dump program, rebuild all & see what happens.
Stone()
09-12-2002, 07:49 AM
This error can be caused by Ollydbg being overly cautious about exe formats, and happens regularly on dumped aspr targets.
It can be fixed with a 1 byte patch to Ollydbg itself. Olly knows about the problem but just hasn't gotten around to fixing it yet.

Here are the bytes from an *OLDER* version of Olly. Just search for the same pattern in the new version, and FORCE the jump in question:

0044D75F 837DF402 cmp dword ptr [ebp-0C], 00000002
0044D763 7513 jne 0044D778 // FORCE JUMP TO AVOID BAD EXE ERROR

0044D765 8D4E50 lea ecx, dword ptr [esi+50]

0044D768 51 push ecx

* Possible StringData Ref from Data Obj
-> "Bad or unknown format of 32-bit "
->"executable file '%s'"

0044D769 687D0B4900 push 00490B7D
nikolatesla20
09-12-2002, 02:56 PM
What do you mean by string refs being hoped for?

Usually just dumping the program will give you the string references clean. If not, maybe you got a bad dump. It happens sometimes !

-nt20
pknight
09-13-2002, 02:02 AM
Just to follow-up on this..

Using LordPE as a dumper resolved my problem!! I didn't even need to use the Rebuild PE feature because ImpREC seemed to take care of dump fixing for me.

Stone, thanks for the OllyDbg tip btw. If it gives me grief in the future, I'll make use of your patch :cool:

-pk


Blowfish
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Blowfish
PDA

View Full Version : Blowfish

peterg70
09-12-2002, 10:51 AM
I have an application that seems to be using Blowfish encryption.

First question I have is it possible to keygen this sort of application.

Here is some more info as to the inputs.

Computer ID Code
Serial Number (must be 16 numbers or letters 0..9 or A to F)
Password (32 Characters )
Name
Location

There seems to be different types of licenses (academic, Normal, Network)

Also has time period licensing.

Previous cracks exist for program but no longer work due to new implementation of code.

I have started looking at the code and have found what looks like a encrypted code

98whr387!h8u%#fnuw$q&rhf8whADfwh

which goes through a decoding function to produce another code.

Looking for guidance in what I should be looking for to reconize the correct procedure for blowfish.
i.e.
Secret code decrypt
Password decrypt
create new code and check

Anyway any thoughts welcome.
peterg70

PS
JMI
Don't bother telling me to search as I have done this already

Anyone who wants a look at this the program name is WinSim Design II (18mb download)
:)
Solomon
09-12-2002, 11:09 AM
Try to find the encryption/decryption key of symmetric algo. If the key is a constant byte-sequence, it can be easily keygened, otherwise have to brute-force it, which seems not possible for blowfish.

The blowfish algo/procedure can be identified by its constants of P array and S-box.
peterg70
09-12-2002, 01:16 PM
Solomon:

Can you expand what you have said above

How can I tell if its constant byte once I find the algo

What do the constants of P array and S-box look like?

I have continued investigating the software and have located a few routines for converting the code to bits etc.

Could someone have a look and let me know if this is keygenable as this seems the easiest way at the moment.

peter
cyberheg
09-12-2002, 02:04 PM
Could someone have a look and let me know if this is keygenable as this seems the easiest way at the moment.

Yes someone should do the work for you because it's easier... I think I follow you clearly. If you're not interested in doing something yourself then go away!

As for the information you gave and additionally asked for.
Get the blowfish reference source code in C, compile it, study it in asm. See how the initial S/P-boxes are done and how the keysetup is done. Follow the decryption and encryption function to get a feeling for how a 64 bit block cipher is made up and executed.

If it's keygenneable all depends on how the symetric key is used and how long it is (incase of bruteforcing it). With a 'carded' serial such schemes would be keygenable without additional steps like public key encryption.

// CyberHeg
peterg70
09-12-2002, 02:17 PM
Cyberheg

I ain't going away :)

I am working my way through the code at the moment and have managed to get it working by patching at the moment
Damn need to find another check.

BUT Since I have done little on the encryption with blowfish i simply ask people who have done it before to comment. I didn't ask for it to be keygened and sent to me.

Even with Blowfish you can always patch the exe provided they haven't encrypted anything with key.

Its late

Nighty Night
peter
JMI
09-12-2002, 03:23 PM
peterg70:

My mission statement does not authorize me to tell people to search if they have indicated that they have done so. :D Unless I misread the post, of course, which I have done on some occasions. :rolleyes:

Even if you hadn't stated that you had searched, I would not have read your post as suggesting that you hadn't done some work and it suggests you are just looking for some guidance from others more familiar with the subject matter, not a solution to you particular issue.

Good luck with your efforts.

Regards.
stealthFIGHTER
09-12-2002, 09:01 PM
Hello peterg70,

I know only a bit about Blowfish, but here is my small idea/hint: You can try to locate the initialization of P-box and S-box (loading the initial values into the context) by searching some of the values from P-box/S-box array in IDA.

I hope this is not nonsence :confused: .

Best regards,
stealthFIGHTER
mike
09-12-2002, 09:31 PM
http://www.unixqi.com/crypto/appendix-b.html#Heading5

Source for blowfish. You can find the S and P tables here.
First question I have is it possible to keygen this sort of applicationMaybe. Too little info to tell. Do they use public key stuff at all?
peterg70
09-13-2002, 11:17 AM
Mike

Thanks for the Info. Will look into it a bit more.

Just a piece of clarification. Is blowfish a one way encryption system.

i.e. Convert XXXXXXXXX to YYYYYYYYYY but not able to go from YYYYYYYYYY to XXXXXXXXX
OR
is it Convert XXXXXXXXX to YYYYYYYYYY and YYYYYYYYYY to XXXXXXXXX.

Its implementation into software seems a bit vague to me. If they encrypt a section of the code with blowfish then they must be able to decrypt it later.

If the software uses the blowfish implementation to wrap a password (similar to crapkey) then all blowfish will do is decrypt the code to say numbers and then these numbers will be used in various parts of the code for different tasks.

My current feeling from looking at the code) is blowfish must be a two way encryption which uses the Computer ID/Name/Location and Some secret numbers to wrap the password.

Does this sound right???

Peterg70
Solomon
09-13-2002, 11:30 AM
Blowfish is a symmetric algo(two way), just like DES/Twofish/IDEA etc. For symmetric algo, the encryption key is the same as decryption key. So if you can find the key, it is broken, coz the encryption/decryption algo is known.

MD5/SHA-1 etc are one-way hash algorithms.

Here you can find the Blowfish algo description and source code
hxxp://www.counterpane.com/crypto-gram.html
peterg70
09-13-2002, 11:32 AM
I found the table with all the constant in it. Definate Blowfish

I put a break on it and it don't break on it at all????

A red Herring Blowfish?

Don't make sense

peterg70
peterg70
09-23-2002, 08:56 AM
Phew

Have learnt alot about blowfish (reading up on it) most of it went in one ear and out the other. :)

Is there a simple tool out there that has the blowfish code implemented but that doesn't encrypt/decrypt files but instead does strings.

Something like this
http://www.pk67.com/test/blow.html

What I guess i am looking for is something that will scan for the key.

I know the Data before and after decryption. So looking for something that I can enter some test strings to see if it will reverse to the correct code or a brute forcer for the finding the key. Yes I know the key space is huge but would like to trial it anyway.

Anything out in the ether for this. Let me know.

peter

PS any sign of crapkey 6.0 on the net yet??
mike
09-23-2002, 11:23 PM
You need to be more specific about how blowfish is used for us to give suggestions on how to attack it. You said that you know the data before and after it gets decrypted. What mode is blowfish being used in? ECB (no chaining) CFB (stream cipher) CBC (cipher-block chaining) CTR (counter mode) ? Give us as much information about when and where blowfish is applied.

For example, if they have a fixed key embedded in the software, it's trivial to break and you can even write a keygen. If it hashes your password, uses that as the key to decrypt a license file, that can be broken easily and keygenned. If there's a fixed block of data and your password has to decrypt it, then you can't keygen it, but you can send the password around; since that's the only one that can decrypt it, it can't identify you.

All of these and more are possible given the limited info you've posted.
peterg70
09-24-2002, 02:41 AM
Mike

As usual in two lines of text you've blown me across the room. I am still at the stage of understanding how blowfish works before I can even assume how it is implemented in this program.

I have been trying to use a bit of zen instead. The reason I believe blowfish is used is because of the obvious configuration of the software but none of this is ever called (at least that I have found yet).

From feeling the code its seems to do the following.

Take a 32 character password (0-F only) as input.

It then checks if the decryption routine has been initialised. If not it runs through a fixed string value (embedded in the code) through the "Decrypt_Code" routine.
My initial guess it creates a table of decoding for hashing the password. (The word FISH is at the start of this table)

Then it runs through the decrypt_code with the 32 char password.
and converts this into a string.
I Know what values I want in the various bits of the decrypted string but need to convert it back to the encrypted string first.

I know brute forcing it will work. i.e. Change each character in the password until the decoded number matchs what I want but the key space is large 16^32 which would take a while.

But in regards to your question about ECB,CFB,CBC,CTR my guess is the CFB (Stream cipher) but Its a guess

If you want you can PM or Email me to discuss further.

Thanks again
peterg70
mike
09-25-2002, 12:39 AM
the key space is large 16^32 which would take a while16^32=(2^4)^32=2^(4*32)=2^128 (!)
It then checks if the decryption routine has been initialised. If not it runs through a fixed string value (embedded in the code) through the "Decrypt_Code" routine.
<snip>
Then it runs through the decrypt_code with the 32 char password and converts this into a string

Blowfish has two inputs (key, ciphertext) and one output (plaintext). You've only shown one input here.

I can see two scenarios, neither of them convincing: one is that you have to provide a key to decrypt the "fish" message to some ciphertext with the proper bits. The problem is, it's just as hard for the author to find a key that sets the bits as for the cracker.

The other is that you provide part of the plaintext and decrypt it under a fixed key to get your special bits. The problem is that all you need to do is pick your bits and encrypt them to break the system, so anyone who knew anything about crypto wouldn't do it that way.

If you change bytes in the blowfish tables, does the plaintext change?

If so, put a read breakpoint on them. If it doesn't stop, you either set the breakpoint too late (after the program loaded and already went thru them) or your breakpoints don't work.

If the plaintext doesn't change, they're a red herring!


Flex Feature Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Flex Feature Problem
PDA

View Full Version : Flex Feature Problem

jjhsd
09-12-2002, 01:04 PM
I am trying to make a valid license file for Metrowerks CodeWarrior 8 30-days trial version.

I am using FlexGen2000 and have already found the vendorcode with 80 bits magic number. But while finding for feature, after replacing lmgr326b.dll with modified version, the dialog pops up only shows feature's version, the title(feature are supposed to show here) is blank. Could anyone advise me how to deal with this problem? Did any body know what the name of feature is?

btw: FLEXlm used in CodeWarrior 8 is 6.1. (Told by FLEXGen)

Thanks a lot!


wanna play a game ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > wanna play a game ??
PDA

View Full Version : wanna play a game ??

SpeKKeL
09-12-2002, 02:48 PM
Howdy,

Wanna play a game search [/url]astatix+dragon.exe[/url]

Why it is posted in this forum ? hint hint..

Btw I made a nice plugin.

Ciao,

Spek

:cool:
esther
09-12-2002, 04:08 PM
Hi SpeKKeL,
Sorry i edited your link.Btw nice work :cool:
SpeKKeL
09-12-2002, 04:18 PM
No prob you're right no more direct links...
btw i only wrote a api resolver for it(hehe i even don't know where it's packed with) but i succeeded in rebuilding.

:rolleyes:

Good luck

Spek

(seems to be telock>>> with new api-redirection code !)
evaluator
09-24-2002, 10:36 AM
Yeah!
Congtratz Spekk!

Seems you found new(!) version of tElock!
Inside protector's code I found check for opcode "CD" in kernel's api!
Because WKT's "famoso" telock-dumper puts INT05 in kernel.
But this check not presents in telock0.98 I have.

But tE wrote, he close his project. "true lies"!?

Hey! JMI!
What you know about latest tElock!?


Find "EXE is damaged" by NetCaptor v7.01
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Find "EXE is damaged" by NetCaptor v7.01
PDA

View Full Version : Find "EXE is damaged" by NetCaptor v7.01

Solomon
09-13-2002, 02:52 AM
netcaptor ncsetup.a1000.exe

It's a Delphi target. The following job has been done:
1. unpack the ASPack or use SMC to patch it. I use the 2nd way.
Put 2 into CS:[52E094], we get a registered version.

2. Search for the references to DS:[52E094], we find the "Invalid Key" check, which is located at CS:4E84F8.

Now we have to locate the "EXE is damaged" message, which seems to be an integrity check. This msg will pop up about 10 minutes after its launching. Obviously this msg is encrypted. I have tried "BPX CreateFileA" to locate file CRC check, but no luck. And I also tried setting a BPM in the memory location where I patched the code, no hit yet.

Decompiling it with DeDe, we can see that the msg box is a dialog of TFrmConfirm, which is dynamically created each time, so you can't set a BPM on the "EXE is damaged" string to find out where it's decrypted, coz the addr of plaintext string changes each time.

I need help to locate this EXE check. Thx
foxthree
09-13-2002, 03:49 AM
Hi Solomon:

Try to run APISpy on the unpacked and rebuilt EXE to locate the exact API used to make the window appear. Or you can use bpx on CreateWindowEx to break into in SoftICE and then trace backwards from there.

I've fixed many a apps using this technique [which never fails as the app has to call CreateWindow at somepoint to display the nag :)] the latest being the Tamoz guys play tool :D....

A bit tardy, but will help. I'm curious to hear other techniques too :)

Signed,
-- FoxThree
Solomon
09-13-2002, 04:22 AM
yeah, actually I BPXed CreateWindowExA/ShowWindow and traced back, but couldn't find the exact place where it does the following. For appz written in VC++, it's easy, while a bit difficult for Delphi/BCB appz.

TFrmConfirm *pForm = new TFrmConfirm( );
pForm->ShowModal( );
SpeKKeL
09-13-2002, 09:23 AM
you could allso try setting a bpx on one of the time api's,
which will lead you to the popup message.
I thought i used gettickcount a few times.

(you could kill the rest of the apps which use these api's)

Ciao,

Spek
Solomon
09-13-2002, 10:47 AM
thx but GetTickCount( ) and SetTimer( ) are called too many times by many appz in the system
SilSaLaMaTa
09-13-2002, 03:06 PM
Hi solomon ,

I don't know what is exaclty happening ,
but I changed a byte and I didn't get the message more ,
I have 7.0.2 Beta1 .
The message would appear after unpacking ...

0042515B A1 68 A6 52 00 mov eax, ds:dword_0_52A668
00425160 83 78 08 00 cmp dword ptr [eax+8], 0
00425164 7F 04 jg short loc_0_42516A
00425166
...
0042516A
0042516A loc_0_42516A:
0042516A B0 01 mov al, 1
0042516C
0042516C loc_0_42516C:
0042516C 88 45 FF mov [ebp+var_1], al
0042516F 80 7D FF 00 cmp [ebp+var_1], 0
00425173 74 75 jz short loc_0_4251EA
00425175 EB 61 jmp short loc_0_4251D8

I changed "mov al,1" at 42516A to "mov al,0" and no message :D
SelfChecking should be somewhere near .
I didn't checked the prog exactly to check if the prog running normaly with this change . but It runs .
Manko
09-13-2002, 03:48 PM
Originally posted by SilSaLaMaTa
Hi solomon ,

I don't know what is exaclty happening ,
but I changed a byte and I didn't get the message more ,
I have 7.0.2 Beta1 .
The message would appear after unpacking ...

0042515B A1 68 A6 52 00 mov eax, ds:dword_0_52A668
00425160 83 78 08 00 cmp dword ptr [eax+8], 0
00425164 7F 04 jg short loc_0_42516A
00425166
...
0042516A
0042516A loc_0_42516A:
0042516A B0 01 mov al, 1
0042516C
0042516C loc_0_42516C:
0042516C 88 45 FF mov [ebp+var_1], al
0042516F 80 7D FF 00 cmp [ebp+var_1], 0
00425173 74 75 jz short loc_0_4251EA
00425175 EB 61 jmp short loc_0_4251D8

I changed "mov al,1" at 42516A to "mov al,0" and no message :D
SelfChecking should be somewhere near .
I didn't checked the prog exactly to check if the prog running normaly with this change . but It runs .
I'd be more interested in knowing how you found that place than knowing where it is. :)

edit: (I'm probably not going to check it out, but somehow suspect I'd not be asking if I did...?)

/Manko
Solomon
09-13-2002, 03:55 PM
Thx. Late night now, will check it tomorrow:)

Originally posted by SilSaLaMaTa
I don't know what is exaclty happening ,
but I changed a byte and I didn't get the message more ,
I have 7.0.2 Beta1 .
Solomon
09-14-2002, 07:00 AM
now mission completed :D (v7.02 beta 1)

:004E8701 8D45F4 lea eax, dword ptr [ebp-0C]
:004E8704 E827B2FEFF call 004D3930 <-----------FindFirstFileA inside
:004E8709 E8CE62FAFF call 0048E9DC
:004E870E 3D00350C00 cmp eax, 000C3500 <------------size check
:004E8713 7E61 jle 004E8776
:004E8715 A1ECCC5200 mov eax, dword ptr [0052CCEC]
:004E871A 803800 cmp byte ptr [eax], 00 <----------another check
:004E871D 7557 jne 004E8776
Solomon
09-14-2002, 07:40 AM
oops, not completed yet:(
There are other exe checks
SilSaLaMaTa
09-14-2002, 11:41 AM
Hi Solomon ,
1- My NetCaptor.exe size is 707,072 (0xACA00) ,why it's compating it with 0xC3500 ?

2- I just changed the byte as I said , and I'm not getting any message ... Did u check that ?
Solomon
09-14-2002, 12:39 PM
1. the unpacked file size is greater than C3500, hence greater than ACA00.:D
2. You can't change that byte, coz this procedure is called many times. That means it's not only for exe check purpose.

search in IDA for references to 004EB18C(which displays the err msg), you will find sth. Now it seems to be defeated.

Originally posted by SilSaLaMaTa
Hi Solomon ,
1- My NetCaptor.exe size is 707,072 (0xACA00) ,why it's compating it with 0xC3500 ?

2- I just changed the byte as I said , and I'm not getting any message ... Did u check that ?
hobgoblin
09-14-2002, 12:48 PM
Ho solomon,
I small question: I can't find the references you made here:

1. unpack the ASPack or use SMC to patch it. I use the 2nd way.
Put 2 into CS:[52E094], we get a registered version.

2. Search for the references to DS:[52E094], we find the "Invalid Key" check, which is located at CS:4E84F8.

I can in Sice find 52E094, but putting any number in that location doesn't change anything. And the address 4E84F8 doesn't exist.

Do you have another version than me? I downloaded the latest one today.

Just wondering....

And how did you find the location you mention?
Solomon
09-14-2002, 12:58 PM
The first post is for v7.01, the others are for v7.02 beta 1.
Here are some data for v7.02 beta 1:
CS:[52F094] //registered = 2
CS:4E8808 //Invalid key check

Just set a "BPX LoadString", you can see how NAG strings are loaded in CS:406F64.

Originally posted by hobgoblin
Ho solomon,
I small question: I can't find the references you made here:

1. unpack the ASPack or use SMC to patch it. I use the 2nd way.
Put 2 into CS:[52E094], we get a registered version.

2. Search for the references to DS:[52E094], we find the "Invalid Key" check, which is located at CS:4E84F8.

I can in Sice find 52E094, but putting any number in that location doesn't change anything. And the address 4E84F8 doesn't exist.

Do you have another version than me? I downloaded the latest one today.

Just wondering....

And how did you find the location you mention?
hobgoblin
09-14-2002, 01:07 PM
Thanks a lot for the fast reply.:)

hobgoblin
Stone()
09-14-2002, 05:46 PM
What do you mean I can't change that byte? I changed it to

3D00350C00 cmp eax, 000C3500 to

3D00350C10 cmp eax, 100C3500

004EB000 55 push ebp -> c3 and no more trouble

004FF538 ok we register here

so no more nags and self checks, mission completed?
Solomon
09-15-2002, 07:26 AM
I mean you can't change "mov al,1" at 42516A to "mov al,0".:)
SilSaLaMaTa
09-15-2002, 08:16 AM
Understood , Thanx :)


Changing keymap in Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Changing keymap in Softice
PDA

View Full Version : Changing keymap in Softice

hobgoblin
09-13-2002, 09:48 PM
Greetings,
I have a question I need some help to clear out. I have installed Softice Driver studio 2.7 on two systems, WinXP and WinME, and it both runs very smoothly. So far, so good.:-)
On my XP system I changed the keyboard mapping by using the program keymap.exe that comes with Softice. (I'm Norwegian, and very happy to be able to use the norwegian key set instead of the one that comes with Sice (USA)). This worked very well on my XP system, but when I try to do the same on my ME system, I run into problems. On the XP I put the keymap.exe in the windows\system32\drivers\ catalog and typed "keymap.exe ntice.exe".
On my Me system I put the keymap.exe in the windows catalog and typed keymap.exe winice.exe.
But then I get an error messagebox saying "Couldn't find the magic cookie", and no changes takes place.
I installed the whole Driverstudio package on both systems.

Does someone have a good idea on what to do?

All kind of input is welcomed...

regards,
hobgoblin

PS: Could not find any interesting solutions when I traced the help files and etc in Driverstudio.
bsod
09-13-2002, 10:37 PM
try winice.vxd instead of winice.exe
hobgoblin
09-14-2002, 07:58 AM
Thanks.:-)

hob


A challenge (or the many faces of ASProtect)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A challenge (or the many faces of ASProtect)
PDA

View Full Version : A challenge (or the many faces of ASProtect)

hobgoblin
09-14-2002, 08:07 AM
Greetings,
I have a little challenge for those who have nothing do to this weekend. Go to xxx.eldos.org and download Timelyweb.
Try to unpack it.
I've tried but no success. I get to the point where I have located teh four usual redirected api's. Then after tracing a little bit, the program just stops working. I can't even get it to run. The program exit's after calling and executing the api findclose.
The program doesn't actually exit, but it hangs. Maybe the api findclose returns the wrong value. I don't know. Haven't quite figured it out yet. An interesting point is that in the call before it hangs, Alexevs name pops up a couple of times if you check the memory at certain locations while tracing the call.
Or maybe he is out with some new tricks?

Anyway, I'm going back to try some checking of using findfirstfilea and so on....

I just tought I mention this for some of the unpacking addicts here..:D

regards,
hobgoblin
PS: A friend told me that Revirgin doesn't work on this one either....
DakienDX
09-14-2002, 11:16 AM
Hello everybody !

This one is really new. Maybe the protection's author starts reading the Intel Instruction Set Handbooks and tests the protection on serveral different computers before publishing it!

When I start the program, nothing happens and the program simply sits on the task list doing nothing.
Not that I'm running a debugger or something else on my computer, it simply doesn't work.

So what should I do next? Yes, restart the computer, load SoftICE and start to debug, since there is a bug in the protection else it would run.

The program starts and does nothing. I'm wondering why, enter SoftICE and find myself in the following (simplyfied) loop.

01 VarX = 6
02 RDTSC
03 If ((EAX Mod 8) == 4) then Goto 02
04 If ((EAX Mod 8) == 0) then Goto 02
05 AL = (EAX Mod 8)
06 VarY = 0
07 VarZ = 6
08 If (Table[VarY] == AL) then Goto 02
09 If (Table[VarY] != FFh) then Goto 12
10 Mov Table[VarY], AL
11 Goto 15
12 VarY = (VarY + 1)
13 VarZ = (VarZ - 1)
14 If (VarZ != 0) then Goto 08
15 VarX = (VarX - 1)
16 If (VarX != 0) then Goto 02

Table db FFh, FFh, FFh, FFh, FFh, FFh
I can't see what the use of this code should be. If it worked like the portection's author thought of, it would loop as long as the value returned by RDTSC doesn't return the values 1,2,3,5,6,7 in the bits 0-3 of EAX.

Here comes the problem. On my computer, a GenuineIntel P4, the RDTSC instruction returns always a value of 0 or 4 in the bits 0-3 of EAX.
So this pice of code will always end up in an infinite loop, in real and in protected mode, with debugger loaded or with no debugger loaded.

At this point the .code and .data sections are decrypted, but the IAT is still encrypted. So I have no way to even fix the problem as legal owner.

Nice protection. It prevents being used on usual 100% Intel computers. How imaginative. ;)
hobgoblin
09-14-2002, 11:33 AM
You got to be kiddin' me..:D

What you say is that this progam will never work as it is supposed to do if you have an Intel P4 on your machine?

Then this got to be an error made by the makers.

As you say: Nice protection..:rolleyes:
Kayaker
09-15-2002, 08:14 AM
Hi guys,

Just when you think there's no new twist... To start with, I had no problems loading or tracing the app on Win98SE, but I've got a P3. This RDTSC usage is very curious. There are a series of these commands used and they seem to access a couple of small jump-address tables, depending on their return value and the subsequent calculations. After a DIV, the edx remainder is used as an Index into a JMP NEAR . Since RDTSC returns a (relatively) random number, there seems to be a small element of randomization built into this routine.

The 1st RDTSC break occurs after the beginning of the .text section has been decrypted to recognizable Delphi, but before the IAT decryption routine starts. This app appears to be normal except for this extra call just before IAT decryption. The many faces indeed ;-)

After returning to high mem unpacking code after a VirtuallAlloc call that signals the end of the main decryption of the .text section, the code returns to the system through a FindClose call. FindClose returns to VirtualQuery, and via Kernel32 ORD_0001 more Asprotect code is called which contains the RDTSC routine. Some memory is allocated with GlobalAlloc then 'RDTSC' is used 4 times in unique code, then 40 more times within a LOOP. The LOOP is run 10 times and the results of the loop seems to vary slightly each time the app is run, sometimes calling GetTickCount, sometimes not.

In general the command is used like this:

18F1EE8 6A02 PUSH BYTE 0xh ; [ESP+8]
; Push DIV value, I've only seen x = 2, 3, 5, 8, and FFh

18F1EEA E80DFAFFFF CALL 18F18FC
18F18FC 52 PUSH EDX
18F18FD 0F31 RDTSC ; Read Time-Stamp Counter
; Read current value of processor’s time-stamp counter
; into EDX:EAX

18F18FF 31D2 XOR EDX, EDX ; don't need high-order 32 bits
18F1901 39542408 CMP [ESP+8], EDX ; don't want to div by zero
18F1905 7405 JZ 18F190C
18F1907 F7742408 DIV DWORD [ESP+8] ; divide time-stamp in eax
18F190B 92 XCHG EAX, EDX ; return remainder of DIV in eax
18F190C 5A POP EDX
18F190D C20400 RET 4

The RET 4 seems to always be to one of three instructions.

CMP EAX, BYTE +4
or
JMP NEAR [EAX*4+18F1EF6]
or
JMP NEAR [EAX*4+18F1F0C]

The returned EAX is a single digit Index value. There seems to be a general pattern in the sequence of
[i]PUSH BYTE 0xh
..
RDTSC
calls, but it also looks like there can be some variability as well. The value pushed will be the divisor used in the DIV statement, which in turn will affect the remainder in EDX which is used as the next jump table Index value, and so on through all the RDTSC calls.

------------------------------

The whole routine begins with a call to GlobalAlloc just before the first RDTSC call. The allocated memory is used for decrypting something, but I've no idea what really, this is only part of a larger routine.

12 18E5198 FF25F0818F01 JMP [ KERNEL32 - GlobalAlloc ]
...
22 18F2069 E87AFEFFFF CALL 18F1EE8

23 18F1EE8 6A02 PUSH BYTE +2
; begins with 2 as the divisor
24 18F1EEA E80DFAFFFF CALL 18F18FC
25 18F18FC 52 PUSH EDX
26 18F18FD 0F31 RDTSC
27 18F18FF 31D2 XOR EDX, EDX
28 18F1901 39542408 CMP [ESP+8], EDX
29 18F1905 7405 JZ 18F190C
30 18F1907 F7742408 DIV DWORD [ESP+8]
31 18F190B 92 XCHG EAX, EDX
32 18F190C 5A POP EDX
33 18F190D C20400 RET 4

34 18F1EEF FF2485F61E8F01 JMP NEAR [EAX*4+18F1EF6]

The several JMP NEAR [EAX*4+18F1EF6] instructions are interesting because the absolute address jumped to can vary depending on the results of the RDTSC div. Each time you run the app the pattern can be slightly different it seems. This jump leads to further RDTSC calls which push either BYTE +5 or BYTE +3 to [ESP+8] in the DIV statement.

--------------------------

When JMP NEAR [EAX*4+ 18F1F0C] is used, it's always to a loop which begins with PUSH BYTE +8 and leads back to the JMP NEAR [EAX*4+ 18F1EF6] statement which can branch as just mentioned between +5 and +3.

18F1F05 FF24850C1F8F01 JMP NEAR [EAX*4+18F1F0C]
18F1F20 C3 RET
18F206E E2F2 LOOP 18F2062

; total loop is 105 lines
18F2062 E8C9F8FFFF CALL 18F1930
18F1930 6A08 PUSH BYTE +8
..
18F18FD 0F31 RDTSC
..
18F1907 F7742408 DIV DWORD [ESP+8]
18F190B 92 XCHG EAX, EDX
..
18F1937 83F804 CMP EAX, BYTE +4
18F193A 0F84F0FFFFFF JZ NEAR 18F1930
18F1940 C3 RET
.
.
18F1EE8 6A02 PUSH BYTE +2
..
18F18FD 0F31 RDTSC
..
18F1907 F7742408 DIV DWORD [ESP+8]
18F190B 92 XCHG EAX, EDX
..
18F1EEF FF2485F61E8F01 JMP NEAR [EAX*4+18F1EF6]

...to further RDTSC calls which use either
PUSH BYTE +3 or PUSH BYTE +5

I haven't got the foggiest what this code is supposed to be accomplishing in the grand scheme of things ;) Does any of this fit in with what you were seeing DakienDX? I haven't checked how the bit values returned with RDTSC might affect the code flow and whether an endless loop could be created. What could be so special about P4 and RDTSC?

/endsession

Kayaker
Snatch
09-15-2002, 09:53 AM
Upon further analysis this protection is driving me crazy. This is very clever. I will have to study it a lot longer. DakienDX and Kayaker your comments were helpful but this ones going to take a bit more work. Wonder who made this protection or if we can find info on it anywhere?

Snatch
DakienDX
09-15-2002, 11:01 AM
Hello Kayaker !

We're talking about the same piece of (bad) code.

I've only seen the division by 8 and taking the result, but I couldn't get further on my CPU. :(

The RDTSC instruction reads the number of CPU clock cycles since the last RESET. It's immune to SoftICE freezing Windows, not like the GetTickCount function. The value should be "random", but Intel says the instruction takes 20-24 CPU clock cycles. This way they maybe let themselves a backdoor open for always having the bits 0 and 1 cleared in EAX after executing RDTSC on a P4.

I can't tell about any small jump tables, I haven't seen them. It just kept me in the endless loop and when I gave the loop the values it expected (1,2,3,5,6,7) I was taken to another loop, also RDTSC, but different this time. I think it could be your third piece of code, since it was a "Cmp EAX, 4; If EQ goto ??? else Ret" loop. After the Ret, EAX was compared with 0 and then again I was in an infinite loop.

After I had passed this loop, I tried to run the program, but I got a BSOD. (even with "FAULTS ON")

I remember having seen the GetTickCount call right below the RDTSC code, but it was never called on my computer.

I think the tables generated are only used to confuse the reverser. In the first piece of code all jumps would be executed, only the order would be different each time. They can't be sure to get always the same values out of RDTSC and they can't be sure that the values come in the same order every time.

But we had this kind of (bad) protection already. When switching form the 486 to the Pentium, Intel enhanced the instruction prefech queue so that it would detect any memory changes made after filling the queue. This was a nice "feature" used by some protections. It was impossible (yes, completely) to trace the code. But now all protections using this feature didn't run any more and it was impossible (yes, also completely) to run the programs.

But I don't think the P4 is too new that anybody has ever tested a program on it. I have even two of them. ;)
foxthree
09-15-2002, 11:39 AM
Hi Kayaker/Dakien:

Nice this one :D The best way to defeat a cracker is to not allow him to run the code at all :D :)

Anyways, just to add a small point to Dakien, in fact to allow refreshing of the prefetch queue, one needs to call FlushInstructionCache(). I hope most loaders/patchers are making use of this otherwise they may not work on older CPUs. Also, would this by any chance be Alexey's ways of rebasing the OEP to "totally random". I mean the current rebased OEP has been completely analzyed by +Splaj and I have my own "home-brewn" version of analyzing the rebased OEP.

Could this be Alexey's attempt at "true" OEP rebasing :)? Just a thought ...

Signed,
-- FoxThree

PS: Thanks to hobglobin for this "funny" target :)
+SplAj
09-15-2002, 11:49 AM
Dak

I have just d/l some targets ready for tonite :)

But looking at the d/l infos maybe Eldos already know of your predicament ?

:-

Version 3.30 (build 143). released 09.10.2002, 1381 Kb
Download.com:
EldoS site: EldoS TimelyWeb
EldoS mirror site: EldoS TimelyWeb

Version 3.30 (build 141). Use it if build 143 fails to load.
EldoS site: EldoS TimelyWeb
Version 3.30 (build 138). Use it if build 143 fails to load.
EldoS site: EldoS TimelyWeb

maybe 'Fails to load' == P4 chip ?
evaluator
09-15-2002, 01:18 PM
I think:
maybe this is some TEST-version of asSpr.
here I detect new(for asspr) tricks.

1. garbage bytes in before&after IAT
2. garbage bytes between DLL-thunk blocks
3. strip 14 bytes of OEP to asspr-memblock
4. new kind of IAT-redirector code (RV & imprec sux)

Maybe new crackers joined to ASS?

About RDTSC.
I have P3 CopperMine600 so have not any probs for run.
DakienDX
09-15-2002, 02:19 PM
Hello foxthree !

"prefetch queue" is not the same as "prefetch queue".
I know that the two strings are identical, but we're talking about two completely different things.

Hi +SplAj !

Thanks for the tip. I didn't read it because it was only two lines below the donload link. ;)
Build 141 runs on my P4 and I've unpacked it successful.
I noticed that the jump to the OEP is always at a different location in memory, while the ASProtect base address is the same every time.
I haven't tried Build 138 yet. This could be the "normal" version, Build 141 the "hard" version and Build 143 the "anti-P4" version.

Hi evaluator !

ImpREC works fine for Build 141. I had only one strange entry with the following code:

Push EDX
Push C0xxxxxx
Ret
This one leads me to WideCharToMultiByte. I've no idea how or why this works and why the import table points to this code. Perhaps it's really a test version of ASProtect.

OEP of Build 141 is at 00621558h if it helps anybody. If the theory is correct, it should be there as well in Builds 138 and 143.
SpeKKeL
09-15-2002, 02:43 PM
I didn't look at the targets here mentioned but i had several nasty
experiences with latetest imprec 1.4.2+ (aspr/telock).
Sometimes imprec refuses to: change an api, invalidate, or make use of a plugin.
Something to do with seh's ??
Maybe it's only on my sys, but imprec 1.3 seems to work still the best.
(not all updates are an improvement)
btw nobody did play the game ??(see my other thread)

Cheers,

SpeKK
DakienDX
09-15-2002, 03:33 PM
Hello everybody !

I just want to update my adoptions.

Build 138, 141 and 143 are different builds, not the same ones with different ASProtect options. Therefore it's OEPs are different.

The function WideCharToMultiByte is not called when executing the application, so I don't know if the strange call would crash or if it would work.
It looks like the procedure is hooked by some driver, but GetProcAddress returns the original KERNEL32.dll API.
evaluator
09-15-2002, 04:04 PM
hobgoblin!

my unpacked EXE normally runs.
When crashes your? Soon after start or after 13 min~:0?

Hi Spekk!

What game about you?
BTW, download this target (v3.3.0.143) & play with it:)
hobgoblin
09-15-2002, 05:11 PM
Hi guys,
Seems you have sorted it out.:)
I just can't do anything right now. My main machine collapsed earlier today, I think the motherboard went straight to hell.:mad:
So now I'm humping away on an old laptop, but can't do any research. I'll guess I have to go out and buy myself a new one tomorrow.
I'll get back in the race as soon I have a new machine.

hobgoblin
DakienDX
09-15-2002, 06:23 PM
Hello hobgoblin !

Looks like we've similar problems. You can't execute the program since your motherboard is broken and I can't execute it because I've a P4. :(

If you decide to get a new CPU too, choose it wisely, you know now what can happen if you're using a common CPU. ;)

Hello everybody !

I've played around a bit with Build 141 and found out that the redirected API leads to WinExec really.
I checked the ASProtect code and it really executes GetProcAddress(WinExec) and saves the address in the import table.

I found some references to the call in the disassembly. Eight parameters are passed to the call. WideCharToMultiByte takes eight parameters, WinExec only two.

Can somebody please check this on your computer for Build 141 or Build 143?
hobgoblin
09-15-2002, 06:38 PM
Hi guys,
Can't stay away for too long can I?:rolleyes:

DakienDX:
You bet I'll get a nice one this time. Planning on getting the fastest Intel there is.:D

I have not checked out what you described, but I have successfully unpacked it and rebuilded it on my other machine.
Nothing new was revealed to me during the process. I used a loader to locate the oep and the dips (yeah, I know: lazy son of a b...). I located the usual 4 redirected api's, and had no problem using Revirgin to rebuild the imports. It resolved all but 10 calls. And these 10 were the usual ones. I didn't jump the dips or anything. All usual business. And it ran nicely without further work. (Didn't run it for extended time though).
Just wanted to let you guys know...
BTW: I worked on build 141.

regards,
hobgoblin

A question: I've been searching all afternoon for a proggie called Superbpm for NT. And I only find Superbpm. If someone have seen where it is lately,could you please notify me by mail or something? I know it exists, because I have it on my other computer.
TIA.
evaluator
09-15-2002, 06:44 PM
what thunk you want for check?
write addr for v143.

Generally you should watch for Imp-names when they are decypted
& you will be 99% sure.
DakienDX
09-15-2002, 07:31 PM
Hi evaluator !

I don't have any offsets for 143, since it doesn't execute on my computer. (P4 -> infinite loop)

I checked 141 (which runs on my computer) and found one import which is somehow completely wrong.

In 141 it's at address 0062C354h. It's the import between WriteFile and WaitForSingleObject.

It must be WideCharToMultiByte, but when loading the imports, ASProtect executes GetProcAddress("WinExec"). GetProcAddress returns an address in the C0xxxxxxh address space, runs through the normal redirecting code and puts the address in the import table. Here's the code from the import table:

; Possibility #1
Push EDX
Push C0xxxxxx
Ret

; Possibility #2
Push EDX
Jmp C0xxxxxx
C0xxxxxxh is the (value+1) returned by GetProcAddress for WinExec.
But the function should be WideCharToMultiByte and not WinExec.
(I still don't know why I get C0xxxxxxh instead of KERNEL32 address space)

So I was wondering if anybody can verify that it runs the same on his computer.
I know we're no ASProtect's bug checking team. (maybe we are ;) )
evaluator
09-15-2002, 08:08 PM
ok, now write peace of rv.txt with few imports
before & after
TaGaDaPaF
09-15-2002, 08:36 PM
soz but, what's the problem with build 141 ?
my dump working find, and it can export url (writefile)
DakienDX
09-15-2002, 09:02 PM
Hello evaluator !

I don't know why this should help.

The API isn't resolved and the address the import table points to is different every time you run the program.

I know what the right API is, but I don't understand why ASProtect loads the wrong API.

And TaGaDaPaF, I think I just told you five minutes ago to read to FAQ. Then you would have read the thread before posting and would have posted something which fits the topic or wouldn't have posted anything at all.
+SplAj
09-18-2002, 12:31 PM
*new* ASPR v1.3x ?
===================

Finally I had a chance to play with Alexey's new aspr release
on that lame target from Eld*s site :-

1st thing to note for us poor guys is the demise of POPAD + JMP EAX (61 FF E0) as the
clue to getting to OEiP.

instead we have something like this :-

0167:013A4EA4 E800000000 CALL 013A4EA9
0167:013A4EA9 5D POP EBP
0167:013A4EAA 81EDBD6F4900 SUB EBP,00496FBD
0167:013A4EB0 8D8DD16F4900 LEA ECX,[EBP+00496FD1]
0167:013A4EB6 03CB ADD ECX,EBX
0167:013A4EB8 894101 MOV [ECX+01],EAX
0167:013A4EBB EB00 JMP 013A4EBD
0167:013A4EBD 55 PUSH EBP <-part of Original EXE !!!
0167:013A4EBE 8BEC MOV EBP,ESP
0167:013A4EC0 83C4F4 ADD ESP,-0C
0167:013A4EC3 53 PUSH EBX
0167:013A4EC4 56 PUSH ESI
0167:013A4EC5 57 PUSH EDI
0167:013A4EC6 B838126200 MOV EAX,00621238
0167:013A4ECB 68DE196200 PUSH 006219DE <- OEiP ???
0167:013A4ED0 C3 RET

Note that SEVERAL 1st bits of codse are here also !!! (thanks Evaluator)

Also note that the 'double-dipping' scheme is still present .... so extra care to be taken ;)
Next is the BEAUTIFULLY coded *new* *rebased* and *randomized* IAT re-director
enc/decryption to the real re-director code. This I have to say is a great
programming achievement from Alexey - well I have to say that cos i'm gonna show
you how to bust it :)

The code is an attempt to stop the IAT tracer from RV/ImpREC......
For RV's Tsehp tracer, RV managed to find a lot of API, but
unfortunately it does NOT have a 'cut-thunk' feature as the IAT is ONE LONG
muther fucker without any 00000000 spaces to define one dll from the next.
Imprec has this feature but unfortunately COMPLETELY FAILS to trace any API at
all - for me ?

So the first solution is to wait months for Tsehp and G-Rom to update their
nice toolz for us (coz they are buzy) .... er no, we do it ourselves with a
plugin :)

Unfortunately the plugin system is lacking the parameters to make a real
'tracer' out of it, but I managed to fix this IAT and here is the procedure :-

1_ run target to OEiP (G <OEiP_address> after SuperBPM/NtDump)
2_ hold with eb fe
3_ start Imprec
4_ resolve the imports (manually find the IT ????)
5_ see only ONE long import !!!
6_ CUT the crap thunks out
eg:-
FThunk: 0022C1F0 NbFunc: 00000400
0 0022C1F0 ? 0000 95298DE7 <-CUT HERE
0 0022C1F4 ? 0000 00F9925C <-fake redirectors to be de-crypted
0 0022C1F8 ? 0000 00F99368 to real re-director.....
0 0022C1FC ? 0000 00F99384
0 0022C200 ? 0000 00F993A0
0 0022C204 ? 0000 00F993C0
0 0022C208 ? 0000 00F993D0
0 0022C20C ? 0000 00F99414
0 0022C210 ? 0000 00F99454
0 0022C214 ? 0000 00F99494
0 0022C218 ? 0000 00F994B0
0 0022C21C ? 0000 00F994CC
0 0022C220 ? 0000 00F994F4
0 0022C224 ? 0000 00F99514
0 0022C228 ? 0000 00F99534
0 0022C22C ? 0000 00F99570
0 0022C230 ? 0000 00F995B0
0 0022C234 ? 0000 00F995EC
0 0022C238 ? 0000 00F9960C
0 0022C23C ? 0000 00F9962C
0 0022C240 ? 0000 00F99674
0 0022C244 ? 0000 00F80F18
0 0022C248 ? 0000 00F81388
0 0022C24C ? 0000 00F9969C
0 0022C250 ? 0000 00F996BC
0 0022C254 ? 0000 00F996DC
0 0022C258 ? 0000 00F813F8
0 0022C25C ? 0000 00F996F8
0 0022C260 ? 0000 00F99718
0 0022C264 ? 0000 00F99758
0 0022C268 ? 0000 00F99794
0 0022C26C ? 0000 00F997D4
0 0022C270 ? 0000 00F99808
0 0022C274 ? 0000 00F99848
0 0022C278 ? 0000 00F99884
0 0022C27C ? 0000 00F998A4
0 0022C280 ? 0000 00F998C8
0 0022C284 ? 0000 00F998E8
0 0022C288 ? 0000 00F99928
0 0022C28C ? 0000 00F99948
0 0022C290 ? 0000 00F9996C
0 0022C294 ? 0000 00F9998C
0 0022C298 ? 0000 00F999AC
0 0022C29C ? 0000 00F999D4
0 0022C2A0 ? 0000 00F999F4
0 0022C2A4 ? 0000 00F99A18
0 0022C2A8 ? 0000 F80AD623 <-CUT HERE!!!
1 0022C2AC user32.dll 011C GetKeyboardType
1 0022C2B0 user32.dll 01B0 LoadStringA
1 0022C2B4 user32.dll 01C4 MessageBoxA
1 0022C2B8 user32.dll 0026 CharNextA
0 0022C2BC ? 0000 33A0E371 <-CUT HERE!!!
1 0022C2C0 advapi32.dll 01AD RegQueryValueExA
1 0022C2C4 advapi32.dll 01A3 RegOpenKeyExA
1 0022C2C8 advapi32.dll 018A RegCloseKey
0 0022C2CC ? 0000 0151B35D <-CUT HERE!!!
1 0022C2D0 oleaut32.dll 0093 VariantChangeTypeEx
1 0022C2D4 oleaut32.dll 000B VariantCopyInd
1 0022C2D8 oleaut32.dll 0009 VariantClear
1 0022C2DC oleaut32.dll 0007 SysStringLen
1 0022C2E0 oleaut32.dll 0006 SysFreeString
1 0022C2E4 oleaut32.dll 0005 SysReAllocStringLen
1 0022C2E8 oleaut32.dll 0004 SysAllocStringLen
0 0022C2EC ? 0000 98DE7654 <-CUT HERE!!!
0 0022C2F0 ? 0000 00F99A40
0 0022C2F4 ? 0000 00F99A64
0 0022C2F8 ? 0000 00F99AA4
0 0022C2FC ? 0000 00F81388
0 0022C300 ? 0000 00F99ACC
0 0022C304 ? 0000 277D6D43 <-CUT HERE!!!... etc etc etc for all imports.
etc etc

save your 'tree.txt'

8_ Now using my alpha release of'aspr13.dll' plugin select the fake re-directed calls. Imprec will say FAILED
but SAVE and immediately RELOAD the 'tree.txt' and select them again and select 'Trace Level1 (Disasm)'
and voila,API calls appear..SAVE the tree.txt.... :)

You still have to figure out the GetVersion/GetCommandLine/LoadResource etc etc API manually.
Rebuild the IAT in the usual way and your done.

I enclosed some GIF piccy's + plugin dll to explain the procedure.........I hope that helps the blind ones !

Greetz to all, esp. Alexey. Nice new aspr work for a 'lazy guy' uh ;)

Spl/\j
[c]2002
+SplAj
09-18-2002, 02:35 PM
EldoS TimelyWeb - Version 3.3.0.144 - Released 15 September 2002
----------------------------------------------------------

What's new:

[ Legend: ]
[ + Added feature ]
[ * Improved/changed feature ]
[ - Bug fixed (we hope) ]

---
15 September 2002
v.3.3.0.144 Minor update
- Alexey fixed a problem with running on Pentium 4 processors.
SpeKKeL
09-18-2002, 08:29 PM
Hajo,

Yep i did this target without to much trouble, using imprec 1.3
and my own plugin for those few unresolved(resolved all).
Yes imprec can't find iat and you must cut a loooot of thuncks..

Sjit i was just writing about this pre-oep thing while i was reading some earlier posts and saw it's allready written..
That's why i had to push another number in eax...!!

Nice playing here,

Greeets

SpeKK
hobgoblin
09-18-2002, 09:48 PM
Greetings +Splaj,
Nice of you to come up with some info to work on. I have one question for you: How did you find the code where the first 14 bytes of the real program is located? Together with the OEP?
It changes location every time you load the program, so I guess it used getlocaltime or some other related api to somehow randomize where the final code before jumping to the oep is going to be located?

regards,
hobgoblin
Hwoarang
09-18-2002, 11:55 PM
Splaj, here is a url for you:

http://www.onefog.com/

I had to modify iat handler, since the Splaj plug-in didnt worked..
evaluator
09-19-2002, 08:21 AM
hello, splaj!

I wrote little tut for you, how to make little graphic files.
Tools used: IRFANVIEW

Load your GIFs in IRFANVIEW;
Decrease Color Depth > 8 color;
Save as PNG for ZIP (solved 37000 bytes)
OR save as BMP with SOLID-archive compression! (solved 45000 bytes)

EnjoE!
+SplAj
09-19-2002, 08:40 AM
Hi Eval
=====

Actually i did think about 'protecting' my little dll (8k un-optimized) with Titty III .......but then it would have been 800k ;)

Thanks go to MS Paint for the shit gif compression :) all complaints about bloatware to Bill please as I don't care....

Hi SpeKK
======

I tried your GWWW API plugin dll and it works a treat on Win98SE, but not in Win2K ?
I almost got round to poking your nice code into my dll as well.....but thats for the next Beta plugin, cos Alexey will make some changes ;)

I never tried 'old' version of Imprec ! thanks for the tip.

Hi Hobgob
=======

Please re-read the GetSystemTime infos on rebase OEiP....same scheme different 'signature bytes'....HINT HINT :)

Happy reversing to all.

Spl/\j
hobgoblin
09-21-2002, 07:48 AM
Hi there everyone,
Well, I managed to unpack Timelyweb into a working copy. After reading +Splaj's latest reply I also managed to find a couple of ways to find the oep quite easily. The dumping went eay, so did changing the oep value 14 bytes backwards, and then add the 14 bytes the program loads in a higher memory location. To rebuild the import table was more work than I anticipated to begin with.:)
After making the program loop at oep, I tried Revirgin to find the import. It worked well after entering the correct iat address and size. It also listed all the false api calls. But since there is no way (as far as I know) to cut thunks when you run Revirgin, I had to switch to Imprec. Then I had to do as +splaj explained. But Imprec came up with less resolved api calls than revirgin. I ended up with 30 calls that had to be manually typed in. It was easy since I already knew from Revirgin what they were supposed to be. And of course I had to change the "old" redirected api calls (ten calls).
Nice target. Nice to see and learn something new in Asprotect.
But I keep thinking: maybe there is a way to change how the program decrypts and stores iat values during runtime (during unpacking), so all these false api calls were removed and not loaded into memory? And then Revirgin could catch all but the correct api calls?
Or maybe the author of Revirgin could add a cut thunk feature in the program? it would sure be helpful.:D
Thanks for the help......

regards,
hobgoblin
nikolatesla20
09-30-2002, 08:26 PM
You can do a form of cutting with RV. In fact, it was this very "protection" that I have always been prepared for, because I've run into it before, in small weird ways.

This is actually something I always did myself, with RV, because sometimes it wouldn't get the IAT length correct, and so I would just throw in a nice large number. Because of that you end up with a whole bunch of empties on the end of the IAT.

All you gotta do is tell RV to save the IAT. you know, save as text.
Now open it up in notepad and cut out the ones you don't want, change the order ( the first column) , and save it. You could probably even use Excel to do this quicker. ( the reordering of the first column of numbers )

Go back to RV and open up the IAT text and now you can export you shiny new IAT table.

I use this technique at lot as well to replace incorrect IAT calls, instead of typing the memory address into RV and pressing "Resolve" again, ( which can be dangerous, it can lock up my win98 computer sometimes ), I simply leave the address at whatever it was, and just change the DLL name and the function name in the resolved.txt file. Then I bring the text file back in, and create my IAT. The names are the only important part anyhow. :)

-nt20
hobgoblin
10-01-2002, 03:04 PM
Thanks for the idea.:-)
I should have thought about this one, as I have been working with Excell for years...
Nice.:D

hobgoblin
evaluator
10-01-2002, 09:58 PM
while using excel..
in debugger clear-up IAT-space before IAT will decripted & enjoE:)
hobgoblin
10-02-2002, 06:24 AM
I'm not sure I understand how you do that. Can you please explain how you do it?

regards,
hobgoblin
evaluator
10-02-2002, 08:14 AM
before asspr will write something in IAT,
fill IAT-section with 00h in debuger's data window(as it was clear in previous versions).
That is clear garbage bytes, not used by protection.
hobgoblin
10-02-2002, 05:58 PM
Nice.:)
It works like a charm...
Thanks for the tip.
Actually I want to say thank you for all the information you post on this board. I always find it helpful.

Regards,
hobgoblin
foxthree
10-06-2002, 07:17 PM
Hello Folks:

Joined the party late but the beauty is that fun part is always there... Anywayz, all the greats have seen and forgotten this by now ... +SplAj guru, Eval, SpeKKel.

After tracing a while, I did find a couple of ways (apart from the nice GetSystemTime hook) to find the OeIP in like 2 secs... But the fun part is the IAT... Maybe +Tsehp will code Cut Thunk in future release of RV. I personally like RV 'coz it resolves APIs much better :) Or may be someone out there will write and release an ImpRECT Tree -> RV IT.txt converter ... Being just too lazy :)

Yep, unpaxed and got it running.... Indeed phun...

See ya around,

Signed,
-- FoxThree
hobgoblin
10-06-2002, 07:49 PM
Hi Foxthree,
Want to share your newfound ways of finding the OEP with us, or is it a secret?
:D

hobgoblin
GlObAl
10-06-2002, 09:26 PM
hello hobgoblin and all,
its not a secret to find the oep...
in every new version it get easyer and easyer... ;)

1. Start you target.exe

2. Break everywhere you want for example but a bpx on enablewindow and open the about or something like that.

3. After breaking type the following in sice...
s 0 l ffffffff C3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90
and Softice will show you an address thake this address and use it with the U commant for example u address than scroll up 1 line and you will see the oep...

push OEP
ret
nop
nop

thats it, quit easy...

best regards...

P.S.: Inlinpatching still possible ;)
hobgoblin
10-06-2002, 10:20 PM
Right.:)
I'm using something similar. I usually bpx on getversion, do a search for the iat decryption routine, and when I'm done getting the info there, I continue with a bpx getversion. After it breaks, I do a search for 03,CB,89,41,01,EB,00,55
Softice gives back an address, and when I do a U <address>, I end up in the same place as you do. The only negative with my approach is that I have to restart the program, and go via Getsystemtime to get to the same code. Hmmm, think I will try your method.
What I'm curious about is whether there is an "elegant" way of using the API's to find out what the OEP is?
hobgoblin
evaluator
10-07-2002, 07:46 AM
Hello!

IF in prog used bytes ripping from OEP, then

PUSH [address]
RET

is not OEP, but place where continues execution after ripped OEP.
So you firstly must restore this ripped bytes before this place
& then mark start of restored byte as OEP.

IF NOT used ripping, that is OEP.

So now we need to break on that ripped bytes inside asspr memory.
either debug whole shit.

Either use old method of stack checking.
Most "correct" protectors restores startup stack(ESP) value before OEP.
So checking this ESP is not bad idea yet:(

(for example, DAEMON in his beta protector not restores ESP. That is trick, not mistake.)
foxthree
10-07-2002, 09:56 AM
Hello all:

Hmm it seems that many ppl. are interested in finding "elegant" ways of finding ASPR OEP. There are really phun ways of finding OEP with ASPR... which is what I like :D

What GLobal wrote is correct and what Hob writes is correct too. However, after relying on signatures for finding OEP (and I still do), I try to find "universal" ways of finding OEP (if possible without sigs).

Remember, the trick here is that protectors can only "incrementally" change their code not "drastically". For ASPR, its strength is its weakness :) I'm referring to the SEH stuff ....

Anyways, let's not make life easier for Alexey our friend :D I'm sure gurus like +SplAj and Eval have already a couple of nice tricks themselves ;) ...

Eval: I think by ripping part of the OEP code Alexey intends to send the KanXue Studio Loader out of the window and he has succeeded in that as the stacks are unbalanced now ... but we can rectify that can't we ? ;)

Signed,
-- FoxThree


suggestions and thoughts about a new project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > suggestions and thoughts about a new project
PDA

View Full Version : suggestions and thoughts about a new project

ZaiRoN
09-14-2002, 12:27 PM
hi All.

in this days i was thinking to a new project. i know that some projects are not yet completed but i think that it's time to talk about the future projects for this area.
it's always difficult to find something of interesting that can be involved more persons why we are in many and all various (everyone has the own preferences). i have some ideas in my head but before create a new thread, i would like to know your thoughts. obviously, i don't have to be the only one to propose -or impose- a project. the area is opened to anyone, especially timidest that sometimes has fear to make question why they think are too *stupid* (nobody will never say to you *lame*...i hope :p). doesn't count the level of difficulty of a project, the most important thing is to see that someone can learn something!

back to my thoughts:
we could start a project for learning how a new dialog (not the usual messagebox) is added and managed to a program. this argument is interesting but at the same time not much immediate for those who they try for the first time. in fact, it requires the definition of a new routine handler (for the new dialog). in this way we will be pushes to learning something new about assembly and to understand how is the structure of a generic routine handler. it would be a beautiful project where beyond to the usual use of a debugger or a disassembler, there is the possibility to add new code. moreover, we will have the possibility to use new tools *ad-hoc* (i.e. code snippet creator) for adding new code lines (that are not the usual 4/5 lines...). i have made a search on the net but i have not found tutorials interesting for which it could be a plan to hold in consideration.

otherwise, we can do a classical project and beyond the usual protection routine based on name/serial, keyfile, regfile we could involve in:
- something about inline-patching
- cryptography. if i remember well, this idea was born in an old post. i don't know too much about crypto so if someone wants to help us is the welcome.

there is the possibility to cover many different argument, we have only to decide and focalize our attention to a specific project and then...start with it!!!

ok, that's all. i hope to receive comments or new ideas from you!

best regards,
ZaiRoN
RaX
09-14-2002, 09:38 PM
Projects are always good, especially if it involves coding. I'm not entirely clear as to what it is you want to make. I've only been skim reading this board for a while so Im not sure what your idea of a project is, but whatever it is, if i can help I'd be happy to....
Kayaker
09-18-2002, 11:52 AM
Hi Zairon,

It's difficult to please the masses isn't it? Especially if the masses won't tell you what pleases them. One thing I've thought about a few times for a different kind of project, but never got around to it, is designing a Reverse Engineering Crossword Puzzle. Y'know, with clues like

1. Name of the Win32 API which, when given the handle of a control, returns the identifier of the specified control (12 letters)

2. Definition of Bit 8 in 80x86 EFLAGS register (2 words, 4,4)

3. Opcode Instruction 31D2h (3 words, 3,3,3)

4. "PE + 80h" (simple definition, 2 words, 6,9)

5. Sum of digits in slang expression when written numerically for "elite" (9 letters)

Something like that anyway. I wonder if there's any way we could standardize things using a demoware or freeware crossword puzzle maker, such that everyone could submit their own crossword puzzles for others to solve? I don't know which one might be the best that won't become a problem to use, but we'd need a standard format. The puzzle files are simply small binaries with the questions and answers encoded.

If designing a crossword puzzle proved too difficult, maybe just a series of questions that can be read in as a text file plugin and placed into levels in a simple crackme style skeleton. If 10 people submitted say 10 questions (and 10 answers) designed to challenge, vex, and tittilate, then we'd have 100 questions and answers for people to learn from. My gosh, people would actually have to do research to solve it! No more mind-numbing codewood excursions into Softice (unless the clue required it), but actual reading and scanning and searching to find the answers to the clues. Zounds, what a concept ;-)

Anyway, there's 2 more pence to ponder.

Cheers,
Kayaker
Snatch
09-18-2002, 12:15 PM
Nice idea Kayaker. I quite like that as it encourages memorization of opcodes, flags, etc to make us better reverses and quicker on our feet. I think there are free crossword platforms you could do this for. It would be neat have everyone submit questions and someone could throw it together.

Snatch
nikolatesla20
09-18-2002, 03:38 PM
Great idea, Kayaker, I like it a lot.

Of course Zairon's first suggestion appeals to me as well, but hey look at my name tag.....:D ( I love code snippet creator )

-nt20
ZaiRoN
09-18-2002, 10:00 PM
Hi Kayaker,
congratulation for the idea! this could be an interesting and amusing project.

> I wonder if there's any way we could standardize things using a demoware or freeware crossword puzzle maker
to standardize a demo/freeware puzzle maker could be very interesting.
i have found many puzzle maker program on the net but the big problem will be to choose one program to work with. i'm not a crossword puzzle player and i can't help you on finding the best....

>we'd need a standard format
yes, a standard format is necessary. i have a question for you (and for all other mates):
why do you want to use binaries in order to encode questions and answers? Why not a simple text file?

to nikolatesla20 & RaX: glad to see that someone is interested in code injection :)

regards,
ZaiRoN
Bengaly
09-19-2002, 08:09 PM
write the proper opcode for:
add dword ptr [ebx*8+edi+AB3D13CC], esp

:) :)
Snatch
09-19-2002, 08:46 PM
LOL well who doesnt know the MOD R/M and SIB byte encoding values I mean come on guys ;).

Better though in all realism would be something like which register cannot be used when using a scaled index byte. That one we SHOULD know.

Snatch
Clandestiny
09-23-2002, 02:03 PM
A crossword puzzle? Now, that is a very creative idea... !!! And of Zairon's ideas, I like code injection... Not really a big one on crypto as I never could really get into the level of math required ;)

Cheers,
Clandestiny
Paul333
09-23-2002, 08:52 PM
Yep a crossword sounds cool..but can you keep it on a gentle learning curve for us newbies....:)

Thanks

paul333
UrgeOverKill
09-24-2002, 01:47 AM
hmmm, a crossword. What about different levels of it, such as a no corners blank scenairo typical of regular crosswords....
ZaiRoN
09-25-2002, 04:50 PM
it seems that the idea of the crosswords is liked to many:)
before beginning this new project i think we need to agree on what we want to do. i have seen some answers like "good idea" or "very interesting" but...what we will want to do exactly? Kayaker has proposed two different possibilities:
1) to work on a demo and reverse it for reading our puzzle, encoding them in .exe (or something else)
2) to put questions all together in a crackme level style

the first proposal is decidedly more interesting and requires some time in order to organize the work.unfortunately, in this days i'm busy with university and i don't have much time to find a suitable crossword proggie.

for the second proposal....well, it's much more simple and fast.
anyone could prepare some questions (atleast ten for everyone), and put them in a .txt file (question + answer + level).if wished you can transmit them me using the PM; i will put all the questions in an *answerme* and when we have a good number of questions we could launch the challenge. obviously, if there is someone else that wants to collect the questions and to organize all is the welcome and can also make yourself ahead :)

regards,
ZaiRoN
Kayaker
09-25-2002, 06:53 PM
Way to kick some butt Zairon, heheh ;) I've been wanting to make a reply to all the enthusiasm, but I haven't been sure of the best approach either. There are several good CP programs out there, but it's a little early in the game to be choosing a specific one and basing everything on people having to, erhm, 'attenuate any restrictions' the demo program might present ;-D

Besides which, I figure part of the fun and challenge should be for people to go through the process of having to design their own crossword puzzle Clues and Answers. At least on a basic level so they get some appreciation of how difficult it can actually be to come up with a good crossword puzzle.

So, to that end I was going to suggest this proposal. There is a small freeware crossword puzzle compiler program (with source no less) written by PC Magazine called WordJunction. I've been testing it out and it seems to work reasonably well. It doesn't have all the fancy capabilities of predesigned grids etc, etc, but I gave it about 50 "RCE" words of variable length as Answers, and it easily made up a 24x24 grid of about 35 of those words. This seemed to be about its limits, but was good enough for the purposes.

I figured those who want to play with this can give a go at designing their own puzzle and present it if they wish. Even if it's a small one, or basic, or subject specific, or whatever. It might be interesting to have separate subjects like a Cryptography Crossword Puzzle, etc.

Or, save the RCE Clues and Answers they come up with and submit them as Zairon suggested via PM or whatever. Once we get 50 or 100 good clue/answer combinations then one of us could design 1 or 2 medium sized puzzles from the words and present them for everyone to play with.

If someone gets keen while doing this and designs a more complete puzzle they want to present on their own, that's cool. They could use any CP program they wanted to to design it then simply attach it as an RTF or other suitable output file. This doesn't have to be an electronic crossword puzzle - remember pen and paper? Anyway, all suggestions are good, but to start with here's the WordJunction program I spoke of, and we'll see how things progress:

ftp://ftp.zdnet.com/acq/downloads/pub/zd/PCMag/pcmwrdjc.zip

Cheers,
Kayaker


Hiding SoftIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hiding SoftIce
PDA

View Full Version : Hiding SoftIce

SilSaLaMaTa
09-14-2002, 07:51 PM
Hi ,
I installed ds 2.7 on my XP ,
I want to hide it .
I tried nticedump for ds2.7 , I got BSOD .
Is there anyway better than patching ntice myself ?
DakienDX
09-14-2002, 09:41 PM
Hello SilSaLaMaTa !

Maybe you read this (http://www.woodmann.net/forum/showthread.php?threadid=3496) thread. I know it's only patching SoftICE itself, but there is no other way at the moment.

Download the patch, compare a unpatched and a patched version 2.6 of NTICE.SYS and apply the changes to NTICE.SYS from 2.7.
(ICEDump 6.0.2.6 gives even a BSOD on Win98. ;) )
SilSaLaMaTa
09-15-2002, 08:15 AM
Thnx DakienDX ,
I have read Splaj tut about patching sice .
When I was using ds2.6 , I was patched it myself ,But I had someproblems with registry .
Snatch
09-16-2002, 09:02 AM
Well I think you better redownload IceDump...apparently there was a typo in it causing all these crashes and The Owl who does not have ntice on his machine any more did fix the problem. Too bad it is the final release of this great tool.

Snatch
DakienDX
09-16-2002, 09:42 AM
Hello Snatch !

Thank you for the information. I verified the error and there was a "Push ECX" where a "Pop ECX" should be.

But only the ICEDump (W9x) part was affected, NTICEDump is unchanged.

But in the corrected 6.0.2.6 version I get still a BSOD on Win98 with SoftICE 4.05.334 when trying to load any program.
Snatch
09-16-2002, 11:30 AM
Ah OK so there is still another minor bug. Actually I read about this on the other forum The Owl's one and if we tell him where the bug is chances are he will post it again with the fix :).

Snatch
Snatch
09-18-2002, 06:52 PM
DakienDX: Better go try and download again its been updated yet again to fix another minor annoying bug ;). Hopefully this solves your problem.

Snatch
DakienDX
09-20-2002, 03:58 PM
Hello Snatch !

Thank you again, but it still crashes for me. :(

I can live with 6.0.2.5, as long as I don't get the idea to use SoftICE 4.27. ;)

You're playing with avatars, right? I have two different avatars for you within two minutes. ;)
Snatch
09-20-2002, 04:02 PM
Ah ok. Well I would not worry I think others are trying to work and kink out the bugs so as you said nothing wrong with sticking to 6.025 until everything is working.

I am playing with avatars hehe how did you guess ;). I actually saved yours and tried to load it in and of course guess what :( dimensions too large. I am a little curious thought because I have had to scale almost all of the avatars I have found.

Snatch
Snatch
09-21-2002, 03:25 AM
Well DakienDX this is becoming a bi-daily event now. But according to the IceDump site several more bugs were fixed. The key word several is encouraging :).

Snatch


ATA programming
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ATA programming
PDA

View Full Version : ATA programming

goatass
09-15-2002, 05:24 PM
I'm trying to figure out how I can write a program that will use the ATA spec's command codes to perform tasks on hard drives. My main reason for this is I want to try to make a bruteforcer for the ATA security feature used in the XBox. The ATA sepc provides a set of security features to lock the hard drive unless you have the password. I'm trying to write a program that will attempt to brutforce this password but I have no knowledge of programming the PIO. The ATA spec talks about using registers and command codes to do stuff but I have no idea how to do that. Does anyone have any experience in this area of programming? or has ny idea where I can get more info?

Thanks,

goatass
dion
09-16-2002, 03:31 AM
hi, goatass, i cant help on this, but i know theres lot of H/W guys at http://board.win32asmcommunity.net/

that surely/maybe can help you about PIO.

regards
Snatch
09-16-2002, 08:44 AM
Heh well now adays must harddrives use DMA or UDMA(there is 133-mode 6 out now). PIO mode 4 is quite slow in comparisson. I would probably get the specs for the harddrives in question though. The ATA standard is a public standard too I believe you can obtain.

Snatch
xor37h
09-16-2002, 09:50 AM
Hello goatass,

I am not entirely sure if this is what you are looking for,
but the "security scheme" you describe sounds quite similar to
the one present on the microsoft xbox gaming console.

I have included some links for you, if nothing else they provide
an interresting read.

Unlocker program with source code:
http://web2.athen227.server4free.de/hddunlock.zip

Interresting forum thread:
http://www.xboxhacker.net/cgi-bin/ikonboard/ikonboard.cgi?s=3d85898d28b2ffff;act=ST;f=4;t=6184

also check out the harddisk information at:
http://xbox-linux.sourceforge.net/articles.php

if you are looking for source code and information for doing lowlevel
ida/ata coding/hacking you should check out:

http://www.ata-atapi.com/

Best Regards, xor37h
xor37h
09-16-2002, 10:16 AM
Re,

lolness, just read your post again, this time a little more detailed
and see that you are infact talking about the xbox ;-)

anyway, for the xbox the password can be recovered by knowing
only the xbox serial number (on the sticker), if you contact me (private message/email) I will share the information with you.

Best Regards, xor37h
goatass
09-16-2002, 07:27 PM
Thanks alot for all the help guys. I got the ATA specs and read over them and found out sorta how to use the command codes described in the specs. Basically what I found out was that you need to use the IN or OUT commands in assembly, for example:

out 0f2h, eax will do the Security Unlock command with whatever (in eax) as the value (password).
I wrote a small program that issues some of these commands and it works ok, I still have to research the more complicated commands before I use them and break my HD :)

xor37h, I'm not really trying to find the password for a Xbox but mainly trying to unlock a HD that is located in some kind of HomeServer so I can use it as a computer. But this would help in making a util for unlocking anything, Xbox, HomeServers, whatever.

Thanks for the links, they were all helpful.
goatass


AsProtect ... still
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AsProtect ... still
PDA

View Full Version : AsProtect ... still

TaGaDaPaF
09-15-2002, 07:53 PM
I have problems with PowerStrip 3.28 (search powerstrip in google)
i unpacked it well... but ! when i lauch it, the nag screen does not appeir, and the menu in the tray bar is not showing up (but double-click on it works fine)
i assume 50C8A4 must be called. (not called in my dump, but called in the packed one)
What's wrong ?!?!
TaGaDaPaF
09-15-2002, 08:23 PM
actualy it is called, but nag screen not coming out, and config dlg is allways shown (not in the packed one)
DakienDX
09-15-2002, 08:43 PM
Hello TaGaDaPaF !

It looks like the program uses the built-in registration functions of ASProtect.

ASProtect can be set up to call special functions when executed as trial version.

So it can be that if this function isn't executed any more (ASProtect removed) the program thinks it's registered and doesn't show the nag screen.

And for your information, this is no "Please check why my crack doesn't work" forum, so read the FAQ and learn how to ask questions.
TaGaDaPaF
09-15-2002, 08:50 PM
of course it's not a 'why my crack..'
im just asking if someone could help me unpacking this one, cause the menu is not showing up in the systray... (wrong api call ?)
loman
09-16-2002, 01:26 PM
if you've softice loaded..... you've to use icedump to hide it, witout it doesn't start........ even I 'm trying to unpack it..... there's one api I'm not able to rebuild.....that's at RVA 0014E16C
if you wan't we can just work together
TaGaDaPaF
09-16-2002, 04:56 PM
0014E16C = GetCommandLineA

ok ...
solved :) dump working fine
thx
loman
09-16-2002, 06:49 PM
on xp or 98? with what u have dumped? mine works only under win2k........dumped with lordpe and fixed with imprec, since rv reboots
TaGaDaPaF
09-17-2002, 07:12 AM
dumped under 2k :), check your inbox
loman
09-17-2002, 08:09 AM
TaGaDaPaF: please clean you pm folder..... so I can answer you, thanks for the help


A problem about upx deccompress?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A problem about upx deccompress?
PDA

View Full Version : A problem about upx deccompress?

powerful
09-16-2002, 05:39 AM
I checked a exe file with fi. It reported the exe file was packed by upx1.21,when I used "upx -d " decompressed the file,upx gave a error " CantUnpackException: header checksum error"?
why?Please help me!
SilSaLaMaTa
09-16-2002, 07:14 AM
Unpack it manually :)
powerful
09-16-2002, 08:50 AM
but I am a newer. I haven't ability to unpack it manuall.Is there any tools?:(
foxthree
09-16-2002, 11:22 AM
Hi Powerful:

Somewhere I've read: "Whenever somebody asks you whether you can do something, say you will try ... and then give it your BEST shot". If you live by this philosophy, then you'll succeed. Everybody here once were (are still here ;)) newbz.... Search the forum, search the the web for some good UPX tutorials and I assure you, you'll not remain newbz any longer!!!

Signed,
-- FoxThree
powerful
09-16-2002, 12:56 PM
How great you are!I will do that. Try to do something.I believe I will succeed.Thanks.
DakienDX
09-16-2002, 01:13 PM
Hello powerful !

The smiley you've choosen to reply to foxthree's post says it all. ( :o - embarrasment )

You should follow his advice. If you know an automatic unpacker you will be happy and unpack the program. When you find the next version of UPX you'll come again and ask again for an unpacker. But if you know how to unpack manually, you will never need help of other people again.
Snatch
09-16-2002, 03:42 PM
In otherwords - give a man a fish you feed him for a day teach a man to fish you feed him for a lifetime. Or so the old proverb goes :).

Snatch
DakienDX
09-16-2002, 05:46 PM
Hello Snatch !

The RCE translation is the following:
Give a man a crack, and he'll be hungry again tomorrow,
teach him how to crack, and he'll never be hungry again.But it's not too good to be put on the main page, else many people will say "I'm here, I don't know anything, I won't read any tutorial, I want you to teach me how to crack xyz". :(


My dll is now unpacked and cracked, but...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > My dll is now unpacked and cracked, but...
PDA

View Full Version : My dll is now unpacked and cracked, but...

UltimAtomMAX
09-16-2002, 11:53 AM
ASProtect 1.2
Dumped with LordPE, IAT with RV (all resolved)
Fixed EiP, Import directory,etc...
LordPE Rebuild PE options : - Status win - Rebuild IT - Valid PE.

It works fine for me, but...
These dlls fails to be loaded on others computer...
Maybe it is a reloc table pb, but if it is that, I don't know the process to rebuild a reloc table...
DakienDX
09-16-2002, 12:55 PM
Hello UltimAtomMAX !

If it's just a relocation problem, this should be quite easy.

You don't need to rebuild the relocations, they're in their original form in the dump you've made. You just need to fix the entry in the image directory. You must put the original position and length in there.

You could rebase the image base to it's old value too, but that's just a cosmetic change and does only work if you've fixed the relocation table.

If this doesn't work, how does the DLL "fail" to load on other computers? (DLL not found, Import not found, crash, BSOD, ...)
UltimAtomMAX
09-16-2002, 01:39 PM
How could I find "the original position and length" of relocations, because this is the same for the ASpacked & Dumped file, so when I check directories under LordPE...

In the ASpacked one:
Relocation: 0019590C Size: 00000008

In the Dumped & Rebuilded one:
Relocation: 0019590C Size: 00000008

Image base of ASpacked dlls still the same with the dumped ones:
ImageBase: 10000000
UltimAtomMAX
09-16-2002, 01:40 PM
Message :
"Failed to load xxxx.dll"
DakienDX
09-16-2002, 06:13 PM
Hello UltimAtomMAX !

The relocations are a whole section. You must check every section if (nearly) every second byte is a value between 30h and 3Fh.
Take this section as the start address and the length is how long it is to the end of the relocations, where all the 00h until the end of the section begin.

Check if the dump has really as base address of 10000000h. The header is taken from the disc, but in memory there might be a different address.

Go to the OEP and see if you've something like
10023456: Call DWord Ptr [10045678]in the code. (offsets are choosen random, but the image base must be the same)

If you've something like
10023456: Call DWord Ptr [016B5678]you must change the image base to the right value.

The error message looks like the DLL tries to load into address space which is already used by another EXE/DLL, which happens if there is a relocation problem. (no or invalid relocations)
UltimAtomMAX
09-17-2002, 12:51 AM
Thank you very very very much !!!
This is my first dump and it works very fine now !!!
I love you DakienDX ( in MegaMan X5 too;) )


SafeSerial (sase.ocx Aspack)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SafeSerial (sase.ocx Aspack)
PDA

View Full Version : SafeSerial (sase.ocx Aspack)

JanDebug
09-17-2002, 03:43 AM
Hi,

i disassembled the prog "CycleTimer", available on h__p://w_w.cycle-trader.com/program/download.htm
direct link is
direct link removed
file size about 17 MB

I logged the installation with "InstallWatch" to find the differences in three snapshots: on installation, on first run, on expired.
I found nothing, absoluteley nothing to make a refresh of the 14-day-trial.
Hereafter i searched for the safeserial-functions in prog and found two:
"SafeSerial1_OnNotRegistered" and "SafeSerial1_OnTerminate"
but i cannot find the code where the check is made, IF the prog is already registered or not. I disassembled with W32dsm, i traced with Ollydbg, i found nothing...
I unpacked sase.ocx with AspackDie 1.4 and cann't find these two functions...
With ResourceHacker i found, it's version 2.3.9 of SafeSerial.
Need help, please, i want to understand this ****ing safeserial-protection.

Best Regards

Jan

JanDebug@gmx.net
JMI
09-17-2002, 05:16 AM
JanDebug:

Here you come with your first post and want so badly for someone to take your hand and guide you through the solution to your cracking needs. It appears that you have failed to read the posting guidelines or the Frequently Asked Questions. Had you done so your would already know that this is not the place to come when you have done very little to help yourself and simply want someone else to solve a non-specific problem that you are having because you really don't know how to unpack any program if one of the ready made tools won't solve the immediate problem for you.

My function here is to tell you that the FIRST thing you should have done on your own was some research on the safeserial protection system on the internet to discover, on your own, what others may have already done with this protection. Had you done this you would have already discovered that they claim that their software has never been cracked, given up, and tried something else.

For example: are you aware that several versions of this software are available on the net to download and examine??? I'm not talking about the software you want to crack, I talking about the protection program. Have you studied it?

I would guess not because you have apparently identified that you don't have more than the basic skills at analysing programs.
Don't get me wrong. There is NOTHING wrong with not having expert unpacking skills. The problem is that you haven't demonstrated that YOU have made ANY attempt to help yourself in understanding the task at hand.

For example, do you know if this is a delphi program, as the protection company states on their site that it works with delphi, C++, VC++ and others. If your program is delphi, do you know what tools are available to disassemble it?? If it's VC++ do you know what tools?

If you had searched, you would have discovered that someone named votan claims that he has unpacked and patched the demo version of the safecast program itself and that should give a good indication of how to approach your problem. Yes, I know if you actually look you will find that votan's article is in a language other than English, but you should know that there are ways to get rough translations of other languages on the net and the portions of his article which address the code give very good clues on how to attack this system.

In short, you haven't done enough work to really warrant help and have just given the appearance that you want someone to crack this program for you and we don't do that here. You need to do some more homework on your own and come back with a focused question that demonstrates you have done some actual work and have a question more focused than "please help." Also READ the posting guidelines.

Regards.
JanDebug
09-17-2002, 01:42 PM
Hi JMI,

>...have just given the appearance that you want someone to crack this program for you...
- no, i want no one to crack this prog: " i want to understand safeserial-protection" was my last sentence.

>...If you had searched, you would have discovered that someone named votan...
- Surely, i have read votan's tutorial (i found no other), surely i have translated the technical content from turkish language, but it's not the same way, the other prog is checked, if it's registered or not.

>...because you have apparently identified that you don't have more than the basic skills at analysing programs.
- YES, YES, YES, i know, and i hoped to find here someone who can give me additional information, because a search in forum-database find only two info-requests about SafeSerial. These both requests about information was none answered, and for my question you find only many words to tell me, i should first search and learn ...

If it's on interest for anyone: meantime i know, sase.ocx check the reg-tree [HKEY_CURRENT_USER\Software\Microsoft\File Manager] (created during installation) and the files bootlog.txt and detlog.txt in c:\
If the trial expires, the files lf.ssf, Error.log, rf32sa.dll, sase.ssm, tk.ssf where changed.
I don't know, how SS change the original Bootlog/detlog, i found only change of file-attributes, but additions can be found in these files, if both files are NOT present and SS created they on start.
If i delete or move all seven files and this reg-tree, trial starts again.

Regards

Jan
JMI
09-17-2002, 04:10 PM
Jan:

There were several points to my post and you seem not to have grasped them. The first was that there is a way we do things here which you didn't follow. That being the doing of your own work, showing what you have done and asking a pointed question about the process with an indication showing that effort.

NOW you say you have done some searching and read votan's article, but did you understand what it was about?? It's about cracking the program safeserial itself. Has it occurred to you yet that if you download safeserial itself, crack it the way votan did and study its workings in Dede, you might have some clues to how the program performs the file modifications you are describing???

Second, you may have, but have not stated that you have done any other research on safeserial. For example, have you reviewed the information that is available on the company site, including the two screenshots of the information that is used to register the program and their information on how the program checks the identity of the machine on which it is running.

Third, you have not stated that you have made any observations about the operation of the software in the debugger, although you mentioned you "traced in OllyDebug" looking for two forms which you did not find. Did you, perhaps search for any of the forms mentioned in the votan article or "trace" the code as it accessed the register or the files you describe?

Again with no disrespect intended, you have not shown that you have any basic understanding of the API's which might be relevant for your study of these issues. You may, indeed, be very knowledgeable, but YOU HAVE NOT SHOWN YOUR WORK. You have simply stated that it modifies certain files, but you don't seem to have a clue about how that might happen. Have you examined the API calls for modifying files, have you looked into these issues at all. If you have, again you have not stated enough information to make it clear that you are trying to help yourself solve this problem.

"Understanding the software" means studying how it works as it unwraps the "protected" software it is protecting. This starts from the moment that you click on the install. You watched it with InstallWatch at three points. Perhaps regmon would have given you a fuller picture of its access to the registers and shown you "when" it accessed the other files. Again, I suggest that you download the demo of safeserial and study how it works.

Since you know it changes certain files on your C: drive, you might even have to do a clean install of windows and save a copy of those files somewhere and then install you target and do a compare of the files after the changes. One thing you should know as a basic. If it has written files on your C: drive that seem to be part of the protection, the program HAS to go read the information in those files, or at least check for their existence at some point in the start up process. There are specific API's used to do this checking which you have not suggested you are aware of or have used. Did you, by any chance try deleting those created files and the register entries and trace the code to see if you missed any?? You said that if they are deleted that the timelimit is reset. Did you check the functions which read the time and date??

So the point, again, is that while you might be very knowledgable, you have not given any good indication that you understand the basic processess used to do the things that you have observed. If that is the case, you still need to do more homework. You could go to the anticrack link on the bottom of the page and start reading "the art of dissassembly." If you do understand more than you have shown, then you still need to make your question more clear than "I don't know how they do that."

Regards.

By the way the url of the "art of disassembly" is hxxp://aod.anticrack.de
mueller5321
09-19-2002, 07:35 PM
@jandebug

Read your email and think bigger.
Not patch generate :-)
taz
12-14-2002, 11:42 AM
Hello

I have the some problem. My Safeserial 2.3.9 protected programm is written at VB6. I have read votan`s manuel, but it doesn`t works.

I used softice with icedump (i am a Softice newbie:-( and there aren`t the area of idata and aspack.

My questions how can i find the Oep or has someboy a solution for this problem.

Regards Taz
Fuji
12-18-2002, 07:47 PM
Hi Mueller5321,

Nice to see you are alive again ;)
I have keygened all S@feserial protected Im@geCr@ft C compiler
and some other goodies...
Once again, thanks for your help
Kind regards

Fuji
RvaZero
12-18-2002, 08:08 PM
As mueller5321 said;
"Think Bigger"

SafeSerial is a lame protection so aspack is protects it. ;) This is lame :P

I can imagine mueller5321's mail (to jandebug) ;)
So easiest method for keygening safeserial is hooking its own key calculation procedure. :)

I can give a tip. Key is generated in Cod*serv.ocx So if you able to find the routine you can call it outside ;)
note:

1- Fix stack.
2- Analyze well that what is WideString ;)
3- Find the arguments to pass the routine
bla bla :)

And use an unpacker for aspack this can be easier if you don't know manual unpacking.

regards
mueller5321
12-19-2002, 09:45 PM
Originally posted by taz
Hello

I have the some problem. My Safeserial 2.3.9 protected programm is written at VB6. I have read votan`s manuel, but it doesn`t works.

I used softice with icedump (i am a Softice newbie:-( and there aren`t the area of idata and aspack.

My questions how can i find the Oep or has someboy a solution for this problem.

Regards Taz

@Taz,
i am still looking for some "nice" safeserial protected targets to verify my knowledge. What is your target ?

@ Fuji
Yes the year after the Y2K was a nice year for professionals :-)
Can you send me a target list?

@RVAzero
Why make so much work. Use their own tools, which they delivery to you without any further costs. All you need is a little bit zen and 4 bytes of information entered on the right point of code. It allways a good idea to select the own useful values instead of to let the random do his work ;-)
Aspack is really lame.

@All the wotan tutorial readers.
There is a bug in his tutortial. The license typ information he selected is not the best choice :-) Take a better look to the dead code than wotan. Maybe there should be a updated version somewhere in the web :-)
RvaZero
12-19-2002, 10:35 PM
[mueller5321]
I wrote letters above for coding keygens. Not more. ;)

Use their own tools, which they delivery to you without any further costs.

Yes using SafeSerial tools is right way ;)
Its simple to calc good keys from [uncrackable (author of safeserial said this)] random numbers bla bla :p ;)

I think i cant told very well. my english not good :/
This examples can be good for all. ;)

[-------SafeSerial OCX Keys and License Types-----]

[License Types]

ENTERPRISE EDITION 83h="131"
PROFESSIONAL EDITION 82h="130"
STANDART EDITION <82="-129"

[Application Keys]

Num1 Num2 Num3 Num4
SAMPLE = 066 077 088 099 >"066077088099"
SAFESERIAL = 188 193 240 217 >"188193240217"

[-------ImageCraft Keys and License Types-----]

[License Types]

PROFESSIONAL 07D1h="2001"
SPECIAL EDITION 0BB9h="3001"
STANDART EDITION XXXXh="1001" or Any other number but "1001" is good ;)

[Application Keys]

Num1 Num2 Num3 Num4
ICCTINY = 183 010 237 249 >"183010237249"
ICC430 = 111 028 062 027 >"111028062027"
ICCAVR = 069 115 184 041 >"069115184041"
ICC08 = 152 147 037 043 >"152147037043"
ICC11 = 058 143 102 180 >"058143102180"
ICC12 = 008 180 198 019 >"008180198019"
ICC16 = 230 207 169 176 >"230207169176"

[GenerateUnlockCode Procedure Arguments]
Push RegisterUser [0/1]
Push offset CustomerID ['XX XX XX XX XX XX']
Push offset MaxExecutions ['0'-'255']
Push offset DaysAllowed ['0'-'255']
Push offset LicenseType ['0'-'9999']
Push offset Counter ['0'-'255']
Push offset ApplicationKey ['XXXXXXXXXXXX']
Push offset lpUnlockCode DWORD
Push offset lpConfirmationID DWORD
mov cl,UninstallApplication [0/1]
mov dl,ResetExecution [0/1]
mov al,ResetInstallDate [0/1]

call GenerateUnlockCode

Return:
lpUnlockCode=Offset of UnlockCode String
lpConfirmationID=Offset of ConfirmationID String

And yes Votan's tutorial is buggy.
i told this him. He is my friend. ;)

Regards.


Toughts on code de-obfuscator(s)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Toughts on code de-obfuscator(s)
PDA

View Full Version : Toughts on code de-obfuscator(s)

SiNTAX
09-17-2002, 08:23 AM
Has anybody done some work on code deobfuscators (ie. for the anti-disassembly stuff SafeDisc and the likes add to code).

I have Imhotep from AntharXes (did I spell this correct). It does a decent job, but not a perfect one.

Just wondering if this can simply be done with some crafty IDA scripting?!

In the safedisc unwrapper from R!sc there was a cleaned dump of the SD dll's, I doubt this was all done by hand..
[yAtEs]
09-18-2002, 02:20 PM
risc got a maid to clean his dlls (-;

It just takes a little time and analyse, dead list something
for example the safedisc dlls and define into bytes what you
think is junk and refined the code after, after awhile you'll
spot the patterns, obfuscation general works by adding
certain bytes to after certain opcodes, for example CALL EAX
is FF E0 stick an EB on it, EB FF E0 makes a jmp -1
so it jumps back to the FF E0 and is disassembled wrong
etc

yates.
SiNTAX
09-18-2002, 03:06 PM
Yups.. I know how this stuff works, but I doubt anyone sane of mind would do it completely manually :)

Imhotep does a decent job at it, but not a perfect one... I think using a decent disassembler like IDA with a script file could do wonders.

The 100% automatic tools usually fail in various places.

(It would be nice if OllyDbg had something like that built-in... Now THAT would be cool!)

.. for the record ... been playing a bit with a v2.60.52 SD file (maybe get it to run in WINE one of these days)

Sure miss PROTECT / Frogsice under WinXP :D
cyberheg
09-18-2002, 05:31 PM
I once tried a safewrap protected program which I assume uses same type of obfuscation as safedisc itself. However I was supprised how 'stupid' the obfuscation was. If the same thing goes for safedisc I am sure it's possible to write a good anti tool for it.

Maybe one of you could post more examples of this type of obfuscation.
In most cases obfuscation is applied on compiled code or to-be-compiled code and assuming most engines aren't smart enough to track which registers are in use then mostly obfuscation are made of "null instructions". From safewrap I remember stuff like xchg eax, edx; xchg edx, eax and push/pop series.

However there exists ways to make obfuscation harder to make it harder to remove again.

// CyberHeg
bsod
09-18-2002, 10:05 PM
well, many protectors simply use the same obfuscator code again and again, so we simply search for those bytes over the whole code section and nop them out..

bye,
bsod
SiNTAX
09-19-2002, 08:23 AM
SafeDisc doesn't use the exact same sequence over and over again, that would be too easy.

As for an example:

[correctly decoded version]
07E6F loc_10007E6F: ; CODE XREF: .txt2:10007E76j
10007E6F mov ebx, ebx
10007E71 jg short loc_10007E79
10007E73 nop
10007E74 jle short loc_10007E79
10007E76
10007E76 loc_10007E76: ; CODE XREF: .txt2:10007E6Dj
10007E76 jmp short loc_10007E6F
10007E76 ; ---------------------------------------------------------------------------
10007E78 db 2Bh ; +
10007E79 ; ---------------------------------------------------------------------------
10007E79
10007E79 loc_10007E79: ; CODE XREF: .txt2:10007E71j
10007E79 ; .txt2:10007E74j
10007E79 js short loc_10007E84
10007E7B
10007E7B loc_10007E7B: ; CODE XREF: .txt2:10007E86j
10007E7B nop
10007E7C xchg eax, eax
10007E7E jg short loc_10007E89
10007E80 xchg ebx, ebx
10007E82 jle short loc_10007E89
10007E84
10007E84 loc_10007E84: ; CODE XREF: .txt2:10007E79j
10007E84 jz short $+2
10007E86 js short loc_10007E7B
10007E86 ; ---------------------------------------------------------------------------
10007E88 db 22h ; "
10007E89 ; ---------------------------------------------------------------------------
10007E89
10007E89 loc_10007E89: ; CODE XREF: .txt2:10007E7Ej
10007E89 ; .txt2:10007E82j
10007E89 jnz short loc_10007E96
10007E8B push ebx
10007E8C call nullsub_23
10007E91 ; ---------------------------------------------------------------------------
10007E91 pop ebx
10007E92 jz short loc_10007E96
10007E94
10007E94 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
10007E94
10007E94
10007E94 nullsub_22 proc near ; CODE XREF: sub_10007E20+1Dp
10007E94 retn
10007E94 nullsub_22 endp
10007E94
10007E94 ; ---------------------------------------------------------------------------
10007E95 db 38h ; 8
10007E96 ; ---------------------------------------------------------------------------
10007E96
10007E96 loc_10007E96: ; CODE XREF: .txt2:10007E89j

And this is how it normally looks like:

10007E6F ; ---------------------------------------------------------------------------
10007E6F
10007E6F loc_10007E6F: ; CODE XREF: .txt2:10007E76j
10007E6F mov ebx, ebx
10007E71 jg short loc_10007E79
10007E73 nop
10007E74 jle short loc_10007E79
10007E76
10007E76 loc_10007E76: ; CODE XREF: .txt2:10007E6Dj
10007E76 jmp short loc_10007E6F
10007E76 ; ---------------------------------------------------------------------------
10007E78 db 2Bh ; +
10007E79 ; ---------------------------------------------------------------------------
10007E79
10007E79 loc_10007E79: ; CODE XREF: .txt2:10007E71j
10007E79 ; .txt2:10007E74j
10007E79 js short loc_10007E84
10007E7B
10007E7B loc_10007E7B: ; CODE XREF: .txt2:10007E86j
10007E7B nop
10007E7C xchg eax, eax
10007E7E jg short near ptr loc_10007E88+1
10007E80 xchg ebx, ebx
10007E82 jle short near ptr loc_10007E88+1
10007E84
10007E84 loc_10007E84: ; CODE XREF: .txt2:10007E79j
10007E84 jz short $+2
10007E86 js short loc_10007E7B
10007E88
10007E88 loc_10007E88: ; CODE XREF: .txt2:10007E7Ej
10007E88 ; .txt2:10007E82j
10007E88 and dh, [ebp+0Bh]
10007E8B push ebx
10007E8C call nullsub_23
10007E91 pop ebx
10007E92 jz short loc_10007E96
10007E94
10007E94 locret_10007E94: ; CODE XREF: sub_10007E20+1Dp
10007E94 retn
10007E94 ; ---------------------------------------------------------------------------
10007E95 db 38h ; 8
10007E96 ; ---------------------------------------------------------------------------

Fixing this in IDA is as simple as going to the adress of the label with the +1 (in this case loc_10007E88), pressing U for undefined code, then go 1 down and press C for code.

So a simple script that does that sequence will clean up the decode.

Imhotep works a bit different, it finds null instructions like mov ecx,ecx and NOP's them out.
SiNTAX
10-08-2002, 01:17 AM
Ahh finally took the time to code something up... anyway it's actually not that hard to do.. should have done it sooner :)


IDA script
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IDA script
PDA

View Full Version : IDA script

bart
09-17-2002, 09:45 AM
I wrote this script to remove align x from deadlisting, now when its executed, it comes into infinite loop, what am i doing wrong?

#include <idc.idc>

// noalign(0x4bd000,0x5a1cd0);

// remove align x from deadlisting
static noalign(from,to)
{
auto ea,i,j,x;

for ( i = from; i < to; i++)
{
ea = i;

ea = FindText(ea,SEARCH_DOWN | SEARCH_NEXT,0,0,"align ");

if (ea != BADADDR)
{
MakeUnkn(ea,0);
Message("%08lX: align x\n",ea);
}

}
}
bart
09-18-2002, 11:45 AM
Fixed :)

#include <idc.idc>

// noalign(0x4bd000,0x5a1cd0);

// remove align x from deadlisting
static noalign(from,to)
{
auto ea,i,j,x;

ea = from;

while ( ea <= to && ea != BADADDR)
{

ea = FindText(ea,SEARCH_DOWN | SEARCH_NEXT,0,0,"align ");

MakeUnkn(ea,0);
Message("%08lX: founded align x\n",ea);

}

}


SmartCheck...no, not a TOT topic
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SmartCheck...no, not a TOT topic
PDA

View Full Version : SmartCheck...no, not a TOT topic

salsa
09-17-2002, 10:52 PM
I've tackled a VC++ program lately. It was a Petite packed prog. I manually unpacked it in no time. I thought the unpacking process would be the difficult part. However, the actual reversing soon turned out to be a real pain in the a**.

There was a terrible tamper check. It took almost a day to reverse (The tuts I read later were telling that it was a Petite feature. However, the prog had its own, either). Then, I was able to see the main screen. The nightmare had just begun when I found out that 75 % of its features were crippled. I started debugging. Another day have passed without any fruitful result. Tried active and passive approaches. All the TOTs, techniques and tricks I know have failed. I was exhausted. At that very moment, I decided to do something really strange. I fired up my SmartCheck and loaded the daemon. While analysing the program flow in great surprise (Yes, it worked for a non-VB prog) I caught a keyword which was missing in the string ref list; "Unregistered". Damn, it was checking sort of a regged-or-not flag after many calls to RegQueryValueExA. Honestly, I know this is the first thing to look for and I did but, couldn't catch and missed it with Sice. The author have deliberately put in so many junk routines to fool the reverser. Anyway, I patched a couple of jumps, altered the content in the registers and finally removed the msgbox. I didn't know if SmartCheck can be used on non-VB progs.

Rationale:

The wheel may have been reinvented many times. But, who cares. Each inventor benefits from it, for sure.
zacdac
09-18-2002, 03:06 AM
I agree, smartcheck can be a great help when trying to locate a specific area within an application. Even just for telling you that a certain window was generated with a messagebox, dialog, mfc etc..

ZD
cyberheg
09-18-2002, 06:20 AM
Did you ever think Smartcheck could be used for anything other then cracking?

I've used it for programming (yes VC++ programming) to catch some leaks in programs. You'd be supprised but it actually works if you know how to use it.

My opinion on this is that people gets narrow minded of all these tutorials floating around saying for VB use smartcheck. It's a tool like anything else not written specificly with VB in mind and probably not with cracking in mind either.

// CyberHeg


hiding softice under winxp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > hiding softice under winxp
PDA

View Full Version : hiding softice under winxp

loman
09-18-2002, 07:36 AM
Hi, I would to hide softice under windows xp, I've tryied using nticedump but it seems not to work as well as on win98, does exist another way to hide si? I don't know .....something like frogice? thanks

-loman
DakienDX
09-18-2002, 08:04 AM
Hello loman !

What about using the serach function the next time before posting?

There is a thread in the Tools of our Trade forum which is just two days old about hiding SoftICE.
loman
09-18-2002, 08:12 AM
sorry man :(


MSIE reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MSIE reversing
PDA

View Full Version : MSIE reversing

Snatch
09-18-2002, 12:18 PM
Well guys I dont know if you noticed but if you try to get FrogsIce his website is STILL MSIE hostile(this time it pops up a never ending add to favorites). Anyway I am wondering since I assume all he is using is the UserAgent string to determine the browser how we can actually permanently change the user agent? I know you can append to it using the group policy editor but how to change the initial part I am not sure. And since MSIE could be part of the OS or anything I havent the foggiest notion where to check first ;). Any ideas or information would be great(I assume someone has already done this so why bother to reinvent the wheel ;)).

Snatch
DakienDX
09-18-2002, 12:35 PM
Hello Snatch !

The are several possibilities to do this.
Get some program/firewall which blocks or changes the user agent.
Disable JavaScript when accessing the page.
Use somthing else than MSIE.
Try to look at URLMON.DLL and WININET.DLL.
Try to search. (I think of text search, this way I found the two DLLs)You can see if it worked at http://hammer.prohosting.com/~fongdev/cgi-bin/checkenv.cgi.
Snatch
09-18-2002, 12:46 PM
Thanks for the quick reply DakienDX. Regarding the possibilities you listed:

1) I used to have Norton Personal Firewall but now that we have a NAT router I feel pretty safe(well I shouldnt I am DMZ host right now hehe). Anyway yes it did a fine job of blocking the user agent string ;). I would rather not bloat my 1.5gb of RDRAM800 with firewall software though if I dont have to.

2) I just tried disabling scripting and your right that works to stop it from fudging IE I saw the lame little 100 byte javascript to make it keep adding the favorite(100000 times hehe).

3) MSIE is there and easy but your right there are other options. I dont think IE is a particularly good or bad browser I am rather neutral on the issue and I hardly care. I have yet to try Opera though and I probably should just for fun sometime :).

4) IDA is disassembling them both right now ;).

5) That was one thing I was wondering. If Microsoft was going to make it easy on you. Of course I can unicode text search too but I thought maybe it would be encrypted.

Well I will tell you what I turn up. Thanks so far.

Snatch
Snatch
09-18-2002, 04:30 PM
DakienDX: you were right. URLMON.DLL is the correct file. Actually with symbols loaded you find a nice routine
GetUserAgentString

.text:760FFF98 mov dword ptr [ebp+20h], offset ??_C@_0L@BLHKBGPH@Compatible?$AA@ ; "Compatible"
.text:760FFF9F mov dword ptr [ebp+24h], offset ??_C@_07NGFJPNPN@Version?$AA@ ; "Version"
.text:760FFFA6 mov dword ptr [ebp+10h], offset ??_C@_0M@CBNGAKHO@Mozilla?14?40?$AA@ ; "Mozilla/4.0"
.text:760FFFAD mov dword ptr [ebp+14h], offset ??_C@_0L@JNOGJJCA@compatible?$AA@ ; "compatible"
.text:760FFFB4 mov dword ptr [ebp+18h], offset ??_C@_08JKJAIFDB@MSIE?56?40?$AA@ ; "MSIE 6.0"

Well I tried modifying all of those and that did change it. Nice site by the way great easy way to see what your browser is emitting in the headers. Well frogsprint.cjb.net still doesnt want to load but I think its a different reason now I view source and it looks like the whole forum is there and working but all I see is a little button in the upper left and it appearing to load. Next mystery ;). Of course I have to disable javascript or I still get the MSIE SUCKS favorite loop annoyance.

Snatch
Czerno
09-25-2002, 11:54 AM
Well Snatch, I don't believe your problem nor the way your tackling it worthy of the "advanced" qualification.

Anyway, two solutions:
- basic : browse to Frog's using something else than MSIE ! I would suggest the OffByOne.

- "advanced" ;~) use some filtering proxy like the Proxomitron (in fact nobody "advanced" should ever be browsing the web without something like that...)
Look at the actual http headers and contents when connected to the offensive page - both with MSIE and with the other browser - and see if you can find out what Frog's filters are based upon, and then learn how to make a customized "antiFrog" Proxomitron filter.

I have made such a filter just for fun, I can visit Frog's forum with it and MSIE without a problem. No I won't just give out the answer, you want to learn don't you,
"M. Advanced" ?

LOL

--
Czerno (The Passer-by)
Guybrush
09-25-2002, 02:39 PM
you can change your user-agent string in:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent

change the default key and or postplatform subkey
disavowed
09-25-2002, 10:29 PM
Read http://www.winguides.com/registry/display.php/799/ on how to change more than just the browser name. (And yes, this works with IE6 too, not only IE5 as the registry key may suggest)
Snatch
09-25-2002, 11:37 PM
Czerno: yes I agree your method is a good way to do it and I would learn a thing or two about proxies. However I tried to make this more of a reversing challenge where I would disassemble and patch to get around. Though I will no doubt investigate your method as well.

disavowed: thank you that is priceless registry information in fact that site is now bookmarked as there is a lot already there that we dont have to figure out ourselves ;).

Snatch
disavowed
09-26-2002, 04:00 AM
np. i was actually looking for that exact info for quite some time, and couldn't find it until Guybrush's post led me to the reg key to search for via google
JMI
09-26-2002, 04:14 AM
Do any of you have an actual working URL for Frog's Print's home page? I went through about 13 pages of google references, mostly to FrogsIce, without finding a homepage that is currently working. Most of them suggest it was the one that started with "thepentagon.com" which is apparently dead.

If anybody wishes to suggest that I need to search, take your best shot now, or forever hold your peace. :D Maybe I just need to "google" en francais. (sorry no acent marks.)

Regards.
Woodmann
09-26-2002, 05:00 AM
Hmmmmmmmmmmmmmm.................

This may be my chance to "spank" Mr. Search.

The lateset post on the FP messageboard says that the host
Indiano.org is down. I'm not sure about what the rest of the post says because I cant read French.
This post was dated 9-19-02

I also found a post somewhere dated about Feb of 02 that said
that updates would be coming.

OBC
Snatch
09-26-2002, 05:03 AM
Hello JMI,

I thinke we all trust that you of all people have done a thorough job of searching :).

I actually stumbled upon the link a while ago on this great(now a little bit outdated) page:
asm.deformed.us

Under Download Tools -> Numega at the bottom it has the link: frogsprint.cjb.net

Turn off javascript if you are using IE or add favorites pops up 100000 times ;). Also change the user agent or you wont get to the page. Its actually hosted on the same server that other message board is I believe.

Snatch
Woodmann
09-26-2002, 05:15 AM
Howdy,

It links back to the same messageboard.

OBC
JMI
09-26-2002, 05:33 AM
Non, Non, Non mon amies.

Can't spank "Mr. Search" until a "working URL for Frog's Print's home page" is produced. I did not request a URL for the Frog's Print forum. :D :D His home page used to link through "NetForwad", which does not appear to be related to Indiano.org, but might be.

Nice try, but no cigar. :cool:

Regards.
Snatch
09-26-2002, 08:35 PM
Well dont I feel dumb now ;). Woodmann I could never get the page to display in IE even with a changed user agent and javascript disabled it would simply display a little box in the upper left. When I viewed the source of course I noticed the forum part. It looked a lot different than the other one. Guess I was wrong :(. JMI: I believe that forwarder actually used to point to indiano but the site never worked even when it did. Then it changed and apparently points to the forum on some page of it I guess but of course it is IE protected unlike other entrances. So I guess the question remains... Hope someone out there has the answer.

Snatch
JMI
09-26-2002, 08:50 PM
Snatch:

It's not too dificult to download Opera and use it for access such as this. I've noticed no problems having both Opera and IE open at the same time and going back and forth between them. A few times I've even had multiple copies of IE and Opera going at the same time.

indiano could be the actual server where Frog's Print's Homepage was located, but his redirector through NetForward itself is no longer good. I'm using Win2K now and FrogsIce isn't very relevant any more for me anyway. Patching is the way to go there, a la +Spl/\j's advice.

Regards.
SiNTAX
09-26-2002, 09:03 PM
Mozilla also works without a problem. Anyway I'm not sure he is only checking the useragent... he could also try out common IE exploits, which obviously don't work on other browsers.
Snatch
09-27-2002, 09:17 PM
Ah ok some interesting things. I have hesitated from ever using any other browsers besides IE after disliking Netscape immensly. I dont know why it just never worked for me. Opera and Mozilla I heard are excellent but I figure all the default browser stuff and all that never worked well. Extra bloat etc. But judging from you guys sounds like I should give them a try as they might be quite good :). IE despite all its flaws supports most of the latest technologies decently well. As far as FrogsIce guess your right JMI thing of the past and patch away.

Snatch
Czerno
09-29-2002, 10:41 AM
Well Snatch, here's a hint : the anti-IE trick on Frog's page is not with headers, rather it's a device in the HTML coding ( a "marquee" loop with parameters specifically designed to make IE choke, using up all your CPU time ..)

So unless you fell like correcting the I.E. bug ( quite an interesting exercise in reversing I admit ),
the only solution that works, and works very well, is the one I sketched in my last post : use a tool that interfaces as a proxy to IE and rewrites the page, suppressing or modifying the annoying marquee loop. I strongly suggest you got and studies the Proxomitron, that is a very flexible tool with which you can do almost anything to transform your "experience" on the Net ;)

Best of lucks

--
Cz. (The aser-by )
SiNTAX
09-29-2002, 08:55 PM
Hey.. call me lazy.. but... isn't it easier to just use another browser?! :)
Czerno
09-30-2002, 05:51 PM
Sure :) But since you seemed to insist on visiting Frog's with IE, I gave you the hinting...

You should try the Off-by-One : it is a small self contained exe, perfect for everyday browsing.

Best of lucks,

--
Czerno
Snatch
10-01-2002, 12:10 AM
Thanks Cz I learned a trick or two and now I can browse with IE :). AFAIK this is the only site on the web left that is still IE hostile so I have been trying to apply it to other situations but cant find any other IE exploit pages that havent been fixed with SP1.

Snatch
SiNTAX
10-01-2002, 12:14 AM
Now we are turning to the other 'Dark Side' but here goes:

h**p://www.pivx.com/larholm/unpatched/

Still enough exploit possibilities left :D


Intel Chip Blunder
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Intel Chip Blunder
PDA

View Full Version : Intel Chip Blunder

Snatch
09-18-2002, 12:32 PM
Well lately I have been reading the processor manuals when all the sudden a most brilliant idea struck me. Most of us are familiar with the following sets of instructions:
J?? (7x or 0F 8x)
CMOV??
SET??

Now lets see here they apply conditional jumps to mov and set instructions not others. Those instructions also take up a whopping total of 64 opcodes in a 511 opcode set!(255(non 0F) + 256(0F)) Well sorry but um why in the world did Intel just not make a simple 16 prefixes. Conditional PREFIXES in fact. Then we could use EB/E9 to do conditional jumps. All of the mov instructions could be conditional and think about the possibilities with having conditional add, sub, mul, rot, etc. This would free up tons of opcodes and add tons of functionality. And it wouldnt be a major architecture redesign on the chip at all. Chip would still execute the same its just the prefix would trigger some additional microcode. Is what I am saying logical? Yes I know backward compatibility blah blah blah. But hey this adds a ton of functionality and makes things a lot more clean cut in my opinion saving tons of opcodes.

Snatch
tgodd
09-18-2002, 12:55 PM
Try reading the Architecture manuals on the Alpha processor.
hehe

Can you say borrowed technology Boys and Dirls.

The reason for these new opcodes is for pipelining.
They can deduce what the condition is going to be long in advance (a best guess by the processor) and set up the pipeline accordingly.

And for those syntax accurate types, I know this is not 100% accurate. But I do not want to respond with a Novel.

Regards,

tgodd


Rebuilding Import Tables Manually
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Rebuilding Import Tables Manually
PDA

View Full Version : Rebuilding Import Tables Manually

Jon
09-18-2002, 01:24 PM
Hey

i have this program that has ASPR 1.2x, i found the oep dumped the exe tried to rebuild import tables with Imprec but it crashed same happend in Revigin so i my only way now is rebuilding the import tables manually show in the old ASPR 1.2 u could c the names of the sections in the PE Header while here i have 11 Sections 8 without out a name and the last 3 are .date . adata and .rsrc so i have no idea which one is the .idata im looking for... is its a merge of all the 8 sections without a name is it only one of them i dont know :( plz help im out of ideas


deobfuscation java class
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > deobfuscation java class
PDA

View Full Version : deobfuscation java class

chitech
09-18-2002, 03:21 PM
Alo

I have download a nice applet. It works fine but a nag frame is coming up everytime i click on it.... :(

I decompiler the class file with DJ java decompiler....The source file look almost like a ordinary java file.....but never mind...I found the bad guy :)

Now I want to compiler the file again....but the source file contains non java statements like "else", "goto". :(

Any body know a good obfuscation program or is there another way to get away with it.

Thx

Chitech
SiNTAX
09-18-2002, 03:35 PM
"else" is allowed in Java.

Have you tried using JAD yet?!

Oops just saw that DJ is a GUI front-end for JAD.. so never mind..

>> http://kpdus.tripod.com/jad.html
chitech
09-18-2002, 04:10 PM
alo SiNTAX

U are rigth else is allowed :o

Do I have to know what kind of obfuscation program it's using so I can maybe use the build-in deobfuscation function.

Please guide me.....

Thx

Chitech
Clandestiny
09-19-2002, 03:02 AM
Hiya,

Though it is entirely possible that you might be able to recompile a decompiled class file, it will probably be problematic. And if it is obsfucated, you will never be able to recover a perfect copy of the original source. This is mainly due to the fact that obsfucators permanently remove information contained in the original class files (ie. like original variable and method names, which are renamed to meaningless garbage). There is no way to recover this information. It is also possible to transform / obsfucate the actual code flow such that it is more difficult to follow. It is my understanding that there are some deobsfucators which will attempt to reverse these obsfucating algorithms and transformations, but I have not used any of them myself and cannot vouch for their effectiveness. Zelix KlassMaster is an obsfucator / deobsfucator you could look at.

If recompiling the decompiled class files remains problematic, you might consider an alternative approach... And that is patching the Java bytecode itself, much like you would hex edit a regular .exe. In addition to "decompiling" Java classes, it is also possible to "disassemble" them. JCD is a disassembler that can be used for this task. Once disassembled, you will need to locate the function you need to patch and examine the surrounding asm instructions to plan your patch. In order to do this you will probably need to download a copy of the java opcode mnemonics. This should be available in the VM Class file specification from java.sun.com. Don't foget, that your patched class will be run through the java bytecode verifier so if your patch is overly, umm, "creative" it probably will not run ;) You could also try to reassemble the disassembly using Jasmine, a java bytecode assembler.

If you want a more concrete explanation, +Tsehp did an essay on patching java a while back. You can find it here: http://www.woodmann.net/fravia/keyser_patching_java_essay.html

Cheers,
Clandestiny
chitech
09-19-2002, 07:45 AM
alo Clandestiny

It's the hard way :( but just the information I need.

Maybe a solution : I can successful dump a java class from memory, will it still be a lot of garbage or is it been deobfuscation?. (sorry for my bad english)

Please guide me.

Thx

Chitech
SiNTAX
09-19-2002, 08:08 AM
If you just want to disassemble java byte code, then you could also use IDA, which is capable of disassembling Java Byte codes.
chitech
09-19-2002, 08:15 AM
alo SiNTAX

Thx for the answer...

Chitech
Clandestiny
09-19-2002, 02:03 PM
Originally posted by chitech

Maybe a solution : I can successful dump a java class from memory, will it still be a lot of garbage or is it been deobfuscation?. (sorry for my bad english)

I presume you're asking weather you can eliminate the obsfucation on a java class by dumping it from memory, as you would strip off the compression / encryption of a packed .exe by waiting until it had been loaded and unpacked in memory before dumping an image of it to disk. If your class was encrypted, I would agree with you... Your class would have to be decrypted before it could be put through the Java Class Loader and executed... BUT encryption is not the same thing as obsfucation. A class will execute, obsfucated or not... An obsfucated piece of code will run and maintain the same functionality as an unobsfucated piece of code... It has simply been stripped or transformed in a way that makes it more difficult for a human reader to understand. Simplest case: Your java virtual machine doesn't care if it is running methods with descriptive names like CalculateSerial or DisplayNagScreen. For all it cares, your code might as well have method names like Garbage1 and Garbage2. Therefore, the obsfucator can change CalculateSerial to Garbage1 and the JVM doesn't care. Only *you* will care when you go to decompile it. Same with the code flow transforms. The code still does the same thing, it is just uglier. Consider a nice piece of code with easy to understand high level control structures like if, else, and elseif statements. Now, transform all of those instructions to cmp, jmp combinations. You haven't changed the functionality, but you've taken it up a notch in complexity for the programmer to understand. Clearly, this would not deter an ASM programmer, but from the point of view of the average high level OOP programmer, converting their high level control directives to ASM would be a form of "obsfucation" ;) Another concrete example of the concept of obsfucation would be self modifying code... The code runs, but it is a bitch to trace (for you ;) )... The processor doesn't care if its running SMC or not.

Patching is probably the cleanest and easiest solution in this situation, especially since you're only changing a few bytes to remove a nag screen.

Cheers,
Clandestiny
chitech
09-19-2002, 02:28 PM
alo Clandestiny

thx for the answer....

So the only way out is find the bad guy and patch it. I will use the "view java byte-code" which is build in DJ-java decompiler.

Wish me luck...

Chitech


Newbie Roadblock, some help please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Newbie Roadblock, some help please
PDA

View Full Version : Newbie Roadblock, some help please

PipeLN
09-18-2002, 06:33 PM
I have a wonderful little delphi prog that just keeps on protecting itself and now I need a little help. If the program is registered you have full functions. If unregistered you are limited to a certain number of items in the DB. Here is the background:

Unpacked the program, fired up W32DASM and found no String Refs (don't know why, it works on other progs just fine). Then I used DEDE and got exactly what I needed.

First, it had a serial check. I nopped out the instruction to go to the verify routine and this worked well and I thought I was close to wrapping up. I put in a fake serial, clicked ok and then it starts accessing the internet. It does a server check by going to a webpage that either returns a 0 (bad boy) or a 1 (good boy) and a little message. It only takes two arguments like this: http://www.server.com/register.asp?Key="KEY"&machineid="MACHINE ID" . I assume it has a database that only allows the program to be used if the keycode and machine ID are correct. I don't know if the keycode is based on the machine id or not. So I changed it to check my server which returns a 1 every time.

So this is what I know about the protection on this app:

Enter Serial
Checks serial to make sure it is a valid serial.
If it is a valid serial, it goes to a web page and verifies this serial against this machine ID.

Now I need to figure out the routine that checks the serial and see if I can come up with a keygen. There are so many calls and jumps that I could spend days wading through the code and never get anywhere. I have narrowed it down to one section of code that is called each time it needs to know if the key is correct (I think). I didn't know what to snip out so sorry if it is long:

0059AE00 55 push ebp
0059AE01 8BEC mov ebp, esp
0059AE03 83C4D8 add esp, -$28
0059AE06 53 push ebx
0059AE07 33C9 xor ecx, ecx
0059AE09 894DF8 mov [ebp-$08], ecx
0059AE0C 894DF4 mov [ebp-$0C], ecx
0059AE0F 8955FC mov [ebp-$04], edx
0059AE12 8B45FC mov eax, [ebp-$04]

* Reference to: system.@LStrAddRef;
|
0059AE15 E8D2A0E6FF call 00404EEC
0059AE1A 33C0 xor eax, eax
0059AE1C 55 push ebp

* Possible String Reference to: 'éê”æÿëë‹Ã[‹å]Ã'
|
0059AE1D 68F1AE5900 push $0059AEF1

***** TRY
|
0059AE22 64FF30 push dword ptr fs:[eax]
0059AE25 648920 mov fs:[eax], esp
0059AE28 33DB xor ebx, ebx
0059AE2A 8D45F4 lea eax, [ebp-$0C]
0059AE2D 50 push eax
0059AE2E B903000000 mov ecx, $00000003
0059AE33 BA01000000 mov edx, $00000001
0059AE38 8B45FC mov eax, [ebp-$04]

* Reference to: system.@LStrCopy;
| or: system.@LStrCopy;
|
0059AE3B E81CA1E6FF call 00404F5C
0059AE40 8D45F8 lea eax, [ebp-$08]
0059AE43 50 push eax
0059AE44 B908000000 mov ecx, $00000008
0059AE49 BA04000000 mov edx, $00000004
0059AE4E 8B45FC mov eax, [ebp-$04]

* Reference to: system.@LStrCopy;
| or: system.@LStrCopy;
|
0059AE51 E806A1E6FF call 00404F5C
0059AE56 8D45FC lea eax, [ebp-$04]
0059AE59 50 push eax
0059AE5A B9FF000000 mov ecx, $000000FF
0059AE5F BA0D000000 mov edx, $0000000D
0059AE64 8B45FC mov eax, [ebp-$04]

* Reference to: system.@LStrCopy;
| or: system.@LStrCopy;
|
0059AE67 E8F0A0E6FF call 00404F5C
0059AE6C 8B45F4 mov eax, [ebp-$0C]

* Possible String Reference to: 'PHT' <----Huh?
|
0059AE6F BA08AF5900 mov edx, $0059AF08

* Reference to: system.@LStrCmp;
| or: system.@LStrCmp;
|
0059AE74 E8CF9FE6FF call 00404E48
0059AE79 755B jnz 0059AED6
0059AE7B 8D55F0 lea edx, [ebp-$10]
0059AE7E B904000000 mov ecx, $00000004
0059AE83 8B45F8 mov eax, [ebp-$08]

|
0059AE86 E8051DF7FF call 0050CB90
0059AE8B 84C0 test al, al
0059AE8D 7447 jz 0059AED6
0059AE8F 8D55E8 lea edx, [ebp-$18]
0059AE92 B908000000 mov ecx, $00000008
0059AE97 8B45FC mov eax, [ebp-$04]

|
0059AE9A E8F11CF7FF call 0050CB90
0059AE9F 84C0 test al, al
0059AEA1 7433 jz 0059AED6
0059AEA3 8D55D8 lea edx, [ebp-$28]
0059AEA6 B910000000 mov ecx, $00000010

* Possible String Reference to: '50D93887C578BEEE265F16F5321CFBAD' <---Not Key, possibly an old hardcoded key that is invalid now?
|
0059AEAB B814AF5900 mov eax, $0059AF14

|
0059AEB0 E8DB1CF7FF call 0050CB90
0059AEB5 84C0 test al, al
0059AEB7 741D jz 0059AED6
0059AEB9 8D55D8 lea edx, [ebp-$28]
0059AEBC B910000000 mov ecx, $00000010
0059AEC1 8B45F0 mov eax, [ebp-$10]

|
0059AEC4 E87F2DF8FF call 0051DC48
0059AEC9 8D55E8 lea edx, [ebp-$18]
0059AECC 8D45D8 lea eax, [ebp-$28]

* Reference to : TAboutForm.~PROC~0051DC74()
|
0059AECF E8A02DF8FF call 0051DC74
0059AED4 8BD8 mov ebx, eax
0059AED6 33C0 xor eax, eax
0059AED8 5A pop edx
0059AED9 59 pop ecx
0059AEDA 59 pop ecx
0059AEDB 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '‹Ã[‹å]Ã'
|
0059AEDE 68F8AE5900 push $0059AEF8
0059AEE3 8D45F4 lea eax, [ebp-$0C]
0059AEE6 BA03000000 mov edx, $00000003

* Reference to: system.@LStrArrayClr;
|
0059AEEB E8709BE6FF call 00404A60
0059AEF0 C3 ret

0059AEF1 E9EA94E6FF jmp 004043E0
0059AEF6 EBEB jmp 0059AEE3

****** END
|
0059AEF8 8BC3 mov eax, ebx
0059AEFA 5B pop ebx
0059AEFB 8BE5 mov esp, ebp
0059AEFD 5D pop ebp
0059AEFE C3 ret

I am too new to understand what is important in the above code (besides the obvious refs). I don't want someone to give it away because this is something I want to do myself. I just need a little breakdown of what the above code may do and a gentle SHOVE in the right direction.

I don't want to include the software name but if you want to take a look at the exe PM me.

|PipeLN|
naides
09-19-2002, 01:47 AM
0059AE00 55 push ebp
0059AE01 8BEC mov ebp, esp
0059AE03 83C4D8 add esp, -$28
0059AE06 53 push ebx
0059AE07 33C9 xor ecx, ecx
0059AE09 894DF8 mov [ebp-$08], ecx
0059AE0C 894DF4 mov [ebp-$0C], ecx
0059AE0F 8955FC mov [ebp-$04], edx
0059AE12 8B45FC mov eax, [ebp-$04]

* Reference to: system.@LStrAddRef;
|
0059AE15 E8D2A0E6FF call 00404EEC
0059AE1A 33C0 xor eax, eax
0059AE1C 55 push ebp

* Possible String Reference to: 'éê?æÿëë?Ã[?å]Ã' WHAT IS THIS?
0059AE1D 68F1AE5900 push $0059AEF1

***** TRY
|
0059AE22 64FF30 push dword ptr fs:[eax]
0059AE25 648920 mov fs:[eax], esp
0059AE28 33DB xor ebx, ebx
0059AE2A 8D45F4 lea eax, [ebp-$0C] DESTINATION ADDRESS FOR @lStrCopy (1)
0059AE2D 50 push eax
0059AE2E B903000000 mov ecx, $00000003 THREE CHARS TO COPY
0059AE33 BA01000000 mov edx, $00000001 FROM POSITION 1
0059AE38 8B45FC mov eax, [ebp-$04] SOURCE STRING ADDRESS

* Reference to: system.@LStrCopy; COPY IT
| or: system.@LStrCopy;
|
0059AE3B E81CA1E6FF call 00404F5C
0059AE40 8D45F8 lea eax, [ebp-$08] DESTINATION OF THE NEXT CHARS
0059AE43 50 push eax
0059AE44 B908000000 mov ecx, $00000008 EIGHT CHARS TO COPY (2)
0059AE49 BA04000000 mov edx, $00000004 FROM POSITION 4
0059AE4E 8B45FC mov eax, [ebp-$04] SOURCE STRING ADDRESS

* Reference to: system.@LStrCopy;
| or: system.@LStrCopy;
|
0059AE51 E806A1E6FF call 00404F5C COPY IT
0059AE56 8D45FC lea eax, [ebp-$04] DESTINATION ADDRESS
0059AE59 50 push eax
0059AE5A B9FF000000 mov ecx, $000000FF 256 CHARS TO COPY
0059AE5F BA0D000000 mov edx, $0000000D FROM POSITION 13
0059AE64 8B45FC mov eax, [ebp-$04] FROM THE SOURCE STRING. GOT RID OF THE FIRST 12 CHARS

* Reference to: system.@LStrCopy;
| or: system.@LStrCopy;
|
0059AE67 E8F0A0E6FF call 00404F5C COPY IT
0059AE6C 8B45F4 mov eax, [ebp-$0C] REMEMBER THE FIRST THREE CHARS OF THE STRING? IN (1)?

* Possible String Reference to: 'PHT' <----Huh?
|
0059AE6F BA08AF5900 mov edx, $0059AF08 NOW THE ADDRESS OF 'PTH' IS IN EDX

* Reference to: system.@LStrCmp;
| or: system.@LStrCmp;
|
0059AE74 E8CF9FE6FF call 00404E48 ARE THE FIRST 3 CHARS == 'PTH'
0059AE79 755B jnz 0059AED6 IF NOT GO TO BADBOY?
0059AE7B 8D55F0 lea edx, [ebp-$10] I DO NOT KNOW WHAT IS IN EBP-10
0059AE7E B904000000 mov ecx, $00000004 PARAMETER FOR NEXT CALL
0059AE83 8B45F8 mov eax, [ebp-$08] CHARACTERS 4 TO 12 COPIED IN (2)

|
0059AE86 E8051DF7FF call 0050CB90 BETTER CHECK WHAT THIS CALL DO
0059AE8B 84C0 test al, al IF al==0
0059AE8D 7447 jz 0059AED6 FORK OFF!!!
0059AE8F 8D55E8 lea edx, [ebp-$18] I DON'T KNOW WHAT IS IN EBP-18
0059AE92 B908000000 mov ecx, $00000008 PARAMETER FOR THE MISTERIOUS 50CB90 CALL
0059AE97 8B45FC mov eax, [ebp-$04] NOW THE ADDRESS OF THE REST OF THE STRING

|
0059AE9A E8F11CF7FF call 0050CB90 CALL THE FAMOUS 50CB90 (LIKELY TO BE THE CHECK)
0059AE9F 84C0 test al, al RETURNED 0 IN al?
0059AEA1 7433 jz 0059AED6 FORK OFF!!!
0059AEA3 8D55D8 lea edx, [ebp-$28] ANOTHER MISTERIOUS PARAMETER IN THE STACK
0059AEA6 B910000000 mov ecx, $00000010 ANOTHER PRAMETER FOR THE FAMOUS CALL

* Possible String Reference to: '50D93887C578BEEE265F16F5321CFBAD' <---Not Key, possibly an old hardcoded key that is invalid now?
|
0059AEAB B814AF5900 mov eax, $0059AF14 NOW WE GIVE IT A HARCODED STRING

|
0059AEB0 E8DB1CF7FF call 0050CB90 CALL OUR KEY ROUTINE
0059AEB5 84C0 test al, al al == 0?
0059AEB7 741D jz 0059AED6 F**K OFF!!!
0059AEB9 8D55D8 lea edx, [ebp-$28] SAME PARAMETER AS BEFORE, MOST BE THE ADDRESS OF A STRING!
0059AEBC B910000000 mov ecx, $00000010 SAME PARAMETER AS BEFORE
0059AEC1 8B45F0 mov eax, [ebp-$10] NOW GIVES EBP-10 AS PARAMETER ANOTHER STRING ADDRESS?

|
0059AEC4 E87F2DF8FF call 0051DC48 A DIFFERENT CALL TO BE EXPLORED
0059AEC9 8D55E8 lea edx, [ebp-$18]
0059AECC 8D45D8 lea eax, [ebp-$28]

* Reference to : TAboutForm.~PROC~0051DC74() WONDER WHAT THIS DOES?
|
0059AECF E8A02DF8FF call 0051DC74
0059AED4 8BD8 mov ebx, eax PRESERVE EAX IN EBX
0059AED6 33C0 xor eax, eax THIS IS WHERE ALL THE FORK OFF BRACHES END UP
0059AED8 5A pop edx
0059AED9 59 pop ecx
0059AEDA 59 pop ecx
0059AEDB 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '?Ã[?å]Ã'
|
0059AEDE 68F8AE5900 push $0059AEF8 dELPHI HAS THIS TYPE OF STRINGS
0059AEE3 8D45F4 lea eax, [ebp-$0C] FIRST THREE CHARS FROM (1)
0059AEE6 BA03000000 mov edx, $00000003 PARAMETER FOR

* Reference to: system.@LStrArrayClr;
|
0059AEEB E8709BE6FF call 00404A60
0059AEF0 C3 ret

0059AEF1 E9EA94E6FF jmp 004043E0
0059AEF6 EBEB jmp 0059AEE3

****** END
|
0059AEF8 8BC3 mov eax, ebx
0059AEFA 5B pop ebx
0059AEFB 8BE5 mov esp, ebp
0059AEFD 5D pop ebp
0059AEFE C3 ret
PipeLN
09-19-2002, 04:09 PM
Thanks for the info naides! So now I know the serial is a string of 12 letters/numbers probably starting with PHT. I am now able to follow the code and see WHY it won't register. Now I just have to find the flag that makes the program think it is registered and I will be set.

Will post more results later today. If any of you want to take a crack at this little program, PM me and I will give you the URL.

|PipeLN|


Driverstudio 2.7 and Windows Me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driverstudio 2.7 and Windows Me
PDA

View Full Version : Driverstudio 2.7 and Windows Me

h8er
09-18-2002, 10:16 PM
Is it possible to load the new build of Softice of Driversuite 2.7 under Windows Millennium with the Windows Millennium Loader utility of Icedump team ?? I've tried but seems don't work with this new release (no problem with the old releases)..

Any idea ???
hobgoblin
09-19-2002, 05:29 PM
Hi there,
Why do you need the loader? I installed it on my machine (WinME) without problems. You only have to have a debug program you can download from Microsoft for free on your machine first. When you install it on ME just follow the instructions, and Softice takes care of everything...

regards,
hobgoblin
h8er
09-20-2002, 10:26 PM
I have currently installed Ds7 on Windows Me with the Windows Me DDK but with the loader i can decide at boot-time if load Softice or not... i don't want Softice loading everytime...
Kaz
09-20-2002, 11:14 PM
I tried to install it on my laptop with WinME and the loader, it worked just fine. Mouse is kinda screwy tho, guess its not ment to be used with a touchpad :(
h8er
09-21-2002, 10:51 PM
Hi Kaz

Did you install the complete WinMe ddk ???


EAccess Error in IDA when disassembling dump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > EAccess Error in IDA when disassembling dump
PDA

View Full Version : EAccess Error in IDA when disassembling dump

figugegl
09-19-2002, 03:13 AM
i have manually unpacked an aspr (new strain) app. i had to do it the hard way as i wasn't able to dump it - icedump, lord pe, procdump failed. what i did:

* dump every section, 3rd one is 52 mb!
* realign 3rd section
* paste all together, pe header from disk
* update pe-header (phys. size and offset of some sections)
* rebuild imports with imprec

the dump is now 1.4 mb and runs fine.

but now i'm unable to get a listing. ida starts and after a while just quits with an error message: EAccess Error. i guess it has to do with the huge virtual size of the 3rd section (0335D000h), but i don't know why.

the sections (sections 1..3 don't have names):

sec1 00001000 0008D000 00001000 0008D000 E0000040
sec2 0008E000 00006000 0008E000 00006000 E0000040
sec3 00094000 0335D000 00094000 0005C000 C0000040
.rsrc 033F1000 0001C000 000F0000 0001C000 C0000040
.text 0340D000 00011000 0010C000 00011000 C0000040
.adata 0341E000 00002000 0011D000 00002000 C0000040

does anybody have an explanation?


DakienDX --> Patching SHELL32.dll ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DakienDX --> Patching SHELL32.dll ???
PDA

View Full Version : DakienDX --> Patching SHELL32.dll ???

Clandestiny
09-19-2002, 03:29 AM
Hiya Dakien,

Your allusion to kernel patching in another post peaked my curiosity...

I've patched SHELL32.dll, the AutoRun.Inf part, so the AutoRun function is completely disabled, Windows doesn't even try to open the file, so the drive doesn't spin up to high speed when I open the explorer, but don't access the CD.

If you could provide some details for this particular patch, I'd be most grateful :) From the sound of it, it looks like you may have found a way to fix one of my "pet peeves" with Win2k. Ever since I installed Win2k, I noticed that it had this annoying habit of freezing up "My Computer" or "Explorer" for 10-30 seconds whenever I insert a CD. I presumed this was related to the autorun functionality and attempted to modify a couple of keys in the registry for both disabling autorun and supressing the autoinsert notification message. It never really fixed the problem and I never dug any deeper into this annoyance. If your patch addresses this problem, I'd love to get some details so maybe I can fix it once and for all.

Thanks,
Clandestiny
Snatch
09-19-2002, 07:16 AM
A lot of times what you find when disassembling shell32 and applying symbols is that there is a registry key to disable so no patch is necessary. This is always of course the preferable way I mean thats what the registry is for ;). There are the few settings that are undisableable without a patch but not many.

Snatch
DakienDX
09-19-2002, 09:24 AM
Hello Clandestiny !

The patch is for Win98. I quickly checked a SHELL32.DLL from Win2K, but I couldn't find it in there.

You could fire up SoftICE and set a try to break on GetFileAttributesW. In Win98 I had PathIsUNCServerA and PathIsUNCSeverShareA before the call. I've checked the "W" variants, but I couldn't find any import looking for file attributes near.

If you find something like this, you should be in a call. Trace out of the call and Nop out the call as well as the following jump.

Sorry, but I can't tell any more at the moment since I've no Win2k to check it, so this is just a guess how it could work on Win2k.


pagein error in si 4.2.7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > pagein error in si 4.2.7
PDA

View Full Version : pagein error in si 4.2.7

pLayAr
09-19-2002, 07:45 AM
when I use "pagein d 400000 10000 \??\c:\dump.bin"
i got such a error msg "IRQL must be below Dispatch_level
to use this extension".

what's wrong? and how can i deal with this problem?

thx much!
Timmy
09-24-2002, 01:16 AM
I had the same error too but for some reason it went away. Anyone clarify what this is?
UrgeOverKill
09-24-2002, 01:57 AM
I do believe that is a Sice internal error in regards to memory paging and or swap file issues. You probably were running out of memory or had some other app going on at the same time sice had to use its resources. I know that its a vauge answer, but that is what we thought happened. A tech here had a similar error pop up....
username
09-25-2002, 08:04 PM
Originally posted by UrgeOverKill
I do believe that is a Sice internal error in regards to memory paging and or swap file issues. You probably were running out of memory or had some other app going on at the same time sice had to use its resources. I know that its a vauge answer, but that is what we thought happened. A tech here had a similar error pop up....
That's one weird tech, cracking on work time? ;-) Seriously though, what if you guys once in your life took a look at the nticedump source code? ;-)


Preventing API hooking????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Preventing API hooking????
PDA

View Full Version : Preventing API hooking????

yaa
09-19-2002, 04:08 PM
Hello,

I was wondering if there is any way to prevent hooking a given API???
Is this how some applications are able to prevent being dumped or is it done some other way???
Thx,

Regards,
YAA
disavowed
09-20-2002, 12:17 AM
Originally posted by yaa
Is this how some applications are able to prevent being dumped or is it done some other way???[/B]
some protections do hook readprocessmemory to try to prevent themselves from being dumped
dion
09-20-2002, 03:55 AM
i think what you should do is not prevent but checking whether its hooked or not. you can check routine signature to ensure authenthication.

regards
cyberheg
09-20-2002, 06:27 AM
So the big question is even if you stop targets from beeing dumped from programs like procdump, lord pe or similar, will it stop icedump? In most cases it won't which is why it's kinda stupid to implement such anti hooking stuff. I mean most people don't get fooled by such anyway since they use icedump.
The interesting question is if it's possible also to do a anti action against icedump.

// CyberHeg
SiNTAX
09-20-2002, 08:08 AM
Originally posted by dion
i think what you should do is not prevent but checking whether its hooked or not. you can check routine signature to ensure authenthication.

How can you verify the authenticity of an API?! Every windows/DLL version can have a different checksum or am I missing something?
dion
09-20-2002, 11:45 AM
well, SiNTAX, actually i dont know either. and this one is protector's job to find out [ie how sig verifier from microsoft work for every dll, maybe?]. btw, yaa, what kind of hooking do you want to prevent, a global or local?

regards
[NtSC]
09-20-2002, 06:06 PM
Hello.
You can get the Base of the DLL,your APi-Functions belongs to and compare those first Bytes..

For Example : Dll-Base: BFxxxxxx ; Api-Function: BFxxxxxx

If that Adress kinda differs much,you can be sure something
isnt as it should be.

For other Stuff you could check the Modules,loaded by a Program.
If neat Things like ApiHooks (Hi EliCZ) are used, u should find 1 more Module as your Program usually has...

Cheers,[NtSC]
yaa
09-20-2002, 08:27 PM
How can an app prevent being dumped by hooking the readprocessmemory API???

Regards,
YAA
Hwoarang
09-20-2002, 08:58 PM
it's a lame way to prevent reading of the process memory..the hook should probably check the PID and if it's the application which should not be dumped..blabla
^DAEMON^
09-21-2002, 02:47 PM
hmmm probably u should take a look @ ifsmgr :)

^DAEMON^
disavowed
09-21-2002, 02:57 PM
Originally posted by yaa
How can an app prevent being dumped by hooking the readprocessmemory API???

http://216.239.35.100/search?q=cache:oEyvVKhSIfcC:daemon.anticrack.de/antidump.txt
SiNTAX
09-21-2002, 06:17 PM
Originally posted by disavowed
http://216.239.35.100/search?q=cache:oEyvVKhSIfcC:daemon.anticrack.de/antidump.txt

; this program here is *PRETTY* good, but everything can be defeated
; @ least this will stop most crackers :)

LOL...

int 5 --> NOP

But guess that was not the point :D
Hwoarang
09-22-2002, 12:36 AM
hum about that anti-dump code...why ring0 and not VirtualProtectEx:P
SiNTAX
09-22-2002, 01:00 AM
Originally posted by Hwoarang
hum about that anti-dump code...why ring0 and not VirtualProtectEx:P

Maybe because of this:

Windows 95/98/Me: You cannot use VirtualProtectEx on any memory region located in the shared virtual address space (from 0x80000000 through 0xBFFFFFFF).

?!

But then.. 95/98/ME is FINALLY dying a slow death.. about time!
Hwoarang
09-22-2002, 01:33 AM
It worx to deprotect any address within Kernel32 memory range under Win9x
^DAEMON^
09-23-2002, 01:07 PM
bugger, this are small samples... it's not a solution to include into a "protection"... it's just the IDEA!

and it's more or less useless to work on anti-dumping code since there is always a solution to dump... (code_mangling is better)

^DAEMON^
SiNTAX
09-23-2002, 01:28 PM
Originally posted by ^DAEMON^
bugger, this are small samples... it's not a solution to include into a "protection"... it's just the IDEA!

and it's more or less useless to work on anti-dumping code since there is always a solution to dump... (code_mangling is better)

^DAEMON^

Ehehe I was aware of that.. hence the 'LOL... But guess that was not the point '
^DAEMON^
09-23-2002, 04:49 PM
np


xor protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > xor protection
PDA

View Full Version : xor protection

pknight
09-20-2002, 06:16 AM
hi, i can't upload target specific code (despite the fact that there is ~no way to identify the target from this code).. if someone wants my commented asm key validation routine, pm me..

so, now for the problem :)..
my main question is: how do all the prostar reversers approach this situation because i'm stuck? ;) also, is there a common name for this key validation technique (i.e. one better than "xor protection")?

problem:

key is of form:

XXXXX-XXXXX-XXXXX-XXXXX-XXXXX
^^^^^set #1

it is validated by a routine that does the following:

groupY = f( 5 hex characters in set Y )
groupY is 3 bytes

block = byte1, byte2, byte3, ... byte15
= group1, group2, ... group5

var_1D = byte1 ^ byte2 ^ byte3 ^ ... ^ byte14

if( byte15 == var_1D )
GOOD
else
BAD

-> need to find combination of byte1 .. byte15 that work
-> under constraint that set #i passes critera in subroutine.
-> ~500,000 possibilities for each set #i

i first tried the easy approach: set #1 == set #2 == .. == set #4
then byte13 ^ byte14 = byte15 would give you an answer :)
unfortunately, this case doesn't work with any valid sets :(

i wrote a brute forcer to get all valid sets.. i wrote one too to try with set #1 == set #2 and solve the rest.. it's still pretty ridiculous and i don't expect a solution from it :)

-pknight
pknight
09-20-2002, 06:18 AM
:confused:
FoolFox
09-20-2002, 08:19 AM
Hello,

I'm no sure to fully understand what you mean, but we'll try anyway....

I think you are talking on a XOR encryption scheme. Even if it's
part of basic encryption scheme, it's still encryption. Don't know
if a protection using this encryption scheme have a specific
name...

I'm in trouble to understand the part where you say :

it is validated by a routine that does the following:

groupY = f( 5 hex characters in set Y )
groupY is 3 bytes

from this, i understand that the key must be of the form XXX-XXX-XXX-XXX-XXX, not XXXXX-XXXXX-XXXXX-XXXXX-XXXXX ?

anyway, about the XOR encryption, the key is :

If ((a XOR b) = c) then ((c XOR b) = a)

You can extend that mathematically, as far as i know (i'm not
a real beast in crypto....)

if you got Var15 = var_1D = byte1 ^ byte2 ^ byte3 ^ ... ^ byte14,

ithen you can compute each of the byte using the formula :

byte14 = Var15 ^ byte1 ^.... ^ byte 13

looping value for each byte1, ... byte 13 should give you all
possible byte14 for each case.....

Is that answering your question ? or i'm totally aside ? :)

Regards
Fox
pknight
09-20-2002, 04:54 PM
the original key you enter is of the form
XXXXX-XXXXX-XXXXX-XXXXX-XXXXX

each XXXXX then gets mapped to a 3 byte group YYY. so, what goes into the xor's is a "key" that looks like
YYY-YYY-YYY-YYY-YYY (ignore dashes, they're just there to show 5 3-byte groups)

finding a solution to byte1 ^ byte2 ^ ... ^ byte15 is actually very easy. the problem comes from

YYY = f( XXXXX ).. not even all XXXXX make it to YYY! some are ok, some are 'filtered' (bad)

you're solution to byte1 ^ byte2 ^ ... ^ byte15 must also be a valid YYY. hrm, i've got an idea.. if i get anywhere w/ it, i'll let the messageboard know :)
pknight
09-20-2002, 04:56 PM
byte1 ^ byte2 ^ ... ^ byte15 above should read
byte1 ^ byte2 ^ ... ^ byte14 = byte15

-pknight
mike
09-21-2002, 04:55 PM
Well, let's have a look at f(XXXXX)=YYY. Post pseudocode (i.e. if you were going to rewrite the algorithm in a language other than asm, how would you do it?)

You're looking for a collision on one byte:

sum(i=1 to 14) y_i = y_15 (*)

right? Say some fraction 0 < r < 1 of the XXXXX's are accepted. Statistics say that if f is random, you should only need to try around 256/r random X combinations before you get a match. (i.e. there's a r/256 chance that (*) holds.)
pknight
09-22-2002, 01:42 AM
ok, i figured it out.. don't know why i didn't think of this before the first post :rolleyes: . thanks for your replies!

the bytes were being grouped as follows:
group1 = byte1, byte2, byte3
group2 = byte4, byte5, byte6
...
group5 = byte13, byte14, byte15

from this, i needed to solve:

byte1 ^ byte2 ^ ... ^ byte15 = 0

nothing new right? ..right :)

if you calculate an xor for each group:
xor1 = byte1 ^ byte2 ^ byte3 = 1-byte
...
xor5 = byte13 ^ byte14 ^ byte15 = 1-byte

it is obvious there will be a many-to-one mapping for groups to xor bytes. this is because there are way more than 256 groups and there can be at most 256 unique xor bytes. so, instead of brute forcing through byte combinations byte1..byte15, i brute-forced through byte combinations xor1..xor5. e.g.

xor1 ^ xor2 ^ ... ^ xor5 = 0 (where xor_i are 1 byte)

the values that were possible for xor_i bytes were found by figuring out which XXXXX passed function f() and calculating xor_i for each. these were stored in a list, then the list was unique'd. this left 128 unique xor_i values.. not too shabby hehe

ignoring the fact that i was duping some of my efforts calculating stuff like x ^ y ^ z *and* z ^ y ^ x etc. (order doesn't matter) i let loose my 1.4ghz on it and it took 8 hours to scan the whole solution space. once i found a valid combination, i then went *back* to scan the XXXXX for ones that produced the right xor_i's.

:cool:

-pknight


DriverStudio 2.7 is *out*
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DriverStudio 2.7 is *out*
PDA

View Full Version : DriverStudio 2.7 is *out*

Athlon
09-20-2002, 06:14 PM
Had to be the one to announce it :D
DakienDX
09-20-2002, 06:28 PM
Hello Athlon !

Thank you for the information. I'm sure many people were already waiting for it.
(must be the first time that something is moved from Off Topic to another forum)

This topic is closed to prevent people asking where they can download it.

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

I hope this is clear now and forever.


imprec question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > imprec question
PDA

View Full Version : imprec question

fotisl
09-20-2002, 07:27 PM
Hi,
I'm new to upacking and i would like some help on imprec. I attach to the process i want to dump, i use IAT AutoSearch, then get imports, i use autotrace for all invalid imports, but when i try fix dump i get a message saying 'Invalid dump file! Can't match RVA to Offset in the dump file'. The dump is created using armkiller.

Thanks a lot,
fotisl
DakienDX
09-20-2002, 08:01 PM
Hello fotisl !

You forgot to enter the right EIP in ImpREC.
You've not resolved the program's imports, but the protection's imports.
Since the protection is already stripped from the dump, ImpREC can't fix it because it would try to access data outside the file.
fotisl
09-22-2002, 01:24 PM
What i did is select the process from the process list and imprec found an eip. I used this one. Is it the wrong one? Any ideas how i can find the right one?

Thanks!
DakienDX
09-22-2002, 04:08 PM
Hello fotisl !

ImpREC didn't find the "right" OEP, it loaded it simply from the protected executable.
You can find the right OEP if you decide to read the program's documentation.
You must understand that even those automatic unpackers all people are running after need at least some kind of knowledge to use them.


Smartcheck version info
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Smartcheck version info
PDA

View Full Version : Smartcheck version info

h8er
09-20-2002, 11:01 PM
Which is the latest official Smartcheck version ??

Thx
DakienDX
09-20-2002, 11:10 PM
Hello h8er !

I don't know which is the latest "official" version, but the latest version on its way through the internet should be 6.03, which is also sometimes refered as "6.3".

It's also the latest stand-alone version, the other (possibly higher) version is included in "DevPartner for Visual Basic".
h8er
09-21-2002, 10:47 PM
Thx DakienDX
Snatch
09-22-2002, 12:02 AM
I believe the latest official version would be part of DevPartner Studio 7.0(hello scene why havent we seen anything since version 6.6 ;)). Anyway I dont know what specific SmartCheck version it is but I imagine the versioning is somewhat logical so it would be 7.0. I dont believe its sold standalone anymore though so looking for the whole package might be the best bet. Of course DevPartner for Visual Basic contains it too. Numegas purchase site does not list it standalone.

Snatch
Snatch
09-22-2002, 12:03 AM
Just a further thing to note because I have this bad habit and so many others do too, NUMEGA is now obsolete. Yes they are Compuware now and they have basically phased the old name out of everything slowly but surely and so we should try to remember this not that it matters but hey better right than wrong.

Snatch


IDA disassembly relocation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA disassembly relocation
PDA

View Full Version : IDA disassembly relocation

laserman
09-22-2002, 04:48 AM
I have a dll linked for a nominal load address of 400000, but the application always loads it at C590000. Can I tell IDA to produce a disassembly that shows the addresses that I see in a running system? I tried changing the image base in the dll header, and IDA then showed the correct addresses for the code, but literals (variable offsets, call target addresses, etc) still appeared with values based on a load address of 400000. I could probably keep tweaking the header in the file, but surely IDA can do all that for me??

Regards,
DakienDX
09-22-2002, 09:17 AM
Hello laserman !

You might want to rebase the DLL.
This can be done both with LINK.EXE from MASM as well as with REBASE.EXE, included in several SDKs/DDKs.

I don't know how IDA could do this itself.
laserman
09-22-2002, 10:05 AM
Thanks DakienDX,

I'll look into your suggestion. But am I missing something? When the dll gets loaded and the system decides that it has to reside at a different address in the callee's address space, I thought that it just went through a fix-up of all the relocatables, just like when an exe is loaded. And if the info for the system to be able to do that is in the file, why couldn't IDA do it? Do I not understand the way a dll is loaded and mapped into the callee's address space? Can you enlighten me, please?

Thanks again,
DakienDX
09-22-2002, 10:53 AM
Hello laserman !

A DLL is basically loaded the same way as an EXE when you compare the relocation part. The only problem is that many EXE files don't have relocations any more and they're "based" to some address which is never occupied by some other program, so they don't need to relocate.

You must not ask yourself why can't IDA relocate the DLL, you must ask yourself why should IDA do it. IDA is meant to be a disassembler. It shows how the code is arranged in the program, how the jumps and calls work and how the data is accessed. It is not important at which base address this happens, since it will always work the same way.

I just told you how I would handle your question, but I will never do it since there's no need for it.

If you're planning to somehow "use" the address the DLL is loaded to, you can never be sure that it is loaded at the same address, not on your computer and not on any other computer.
laserman
09-22-2002, 11:13 AM
Hmmm,

Ok. First, Rebase.exe worked a treat. I now have an IDA listing on paper with numbers in it that are the same as I see when running the app under the debugger. It just means that I can easily glance at referenced locations (and areas nearby to them) without having to go through mental gymnastics to do the relocation in my head. Maybe I'm not making myself clear, but I find it useful... thanks for the pointer.

Now, if I could switch in and out of SI to look at IDA, it would all be un-necessary...

Regards,
Snatch
09-22-2002, 12:19 PM
We all have run into that annoyance of DLLs being based at a different memory address but a simple displacement and quick calculation(I hope you have a calculator that can do hex easily like a TI-34 ;)) can do the trick quite easily. At least I dont have trouble using the on the fly displacement method ehhe.

Snatch


Tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tool
PDA

View Full Version : Tool

bLaCk-eye
09-22-2002, 09:04 AM
I have i question for:
How does an memory dumper works.I mean how do i build(make) one.??
Hope it's not a too stupid question:confused:
Snatch
09-22-2002, 12:21 PM
Theres plenty of API calls to help you with this. I suggest you get an API reference and look at ReadProcessMemory and WriteProcessMemory for starters though theres a lot more you have to do than that but I would begin there.

Snatch


DevPartner 7.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DevPartner 7.0
PDA

View Full Version : DevPartner 7.0

Athlon
09-22-2002, 12:03 AM
We might see DevPartner 7.0 soon ;)
Snatch
09-22-2002, 12:04 AM
That is very very good news Athlon. Hopefully professional too ;). In fact I am considering purchasing it because the tools can be quite handy and VS.NET support isnt really present in version 6.6 which I have.

Snatch
Athlon
09-22-2002, 12:29 AM
Well heres the thing I have DevPartner Pro 7.0 Trial and I was gonna ask if you all would help me crack it (because im not that advanced yet) and I thought maybe you all would help me because it's such a great program and you all want it to so I thought it might get different responses than regular "crack requests" so we will see if anyone will help :)
Woodmann
09-22-2002, 02:06 AM
Howdy,

Ya'll need to keep that shit on the qt.
Do it by email between yourselves.

I dont want to see any "can you send it to me posts"

Peace, Woodmann
Athlon
09-22-2002, 02:14 AM
Will Do Woomann, if you want any info about it PM me or email me AthlonNet@yahoo.com Thanks!
JMI
09-22-2002, 02:42 AM
Athlon:

What's the size of the 7.0 version. I have 6.6 (non-trial) and by comparing, maybe we can determine whether it is complete or not. If you've installed it, does it have a SmartCheck labeled version 7.0?

Regards.
Athlon
09-22-2002, 02:51 AM
262 Megabytes no I haven't installed it because I been getting ready for vacation :D I'm gonna go install it now and will be back soon to let you know
Athlon
09-22-2002, 03:25 AM
Well guys gotta wait it don't and won't install SmartCheck without VB installed so I guess I have to install it
DakienDX
09-22-2002, 09:34 AM
I was gonna ask if you all would help me crack it (because my favourite excuse here)Hello everybody !

I can only see one thing here.
It's a request we don't like around here.
So keep your emotions with you.
You're not on a crack request board.


Some questions about ASProt dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Some questions about ASProt dll
PDA

View Full Version : Some questions about ASProt dll

Lemon13
09-22-2002, 10:34 AM
Hi all, thanx in advance for reading my troubles...
I'm tryng to reverse a firewall, Outpost Pro (deleted): anyone has experienced it yet? Well I'm new at unpacking adn so on, but I'm reading some texts about.
The problem is that the program is protected by ASProtect, which encrypts the dll that loads the ui. At the moment of loading this library (opst_ui.dll) from the module engine.dll there's the validatio check plus the time limit dialog.
I dumped it, but the thing I can't work out by myself is the OEP. There's a lot of self-modifing code (I think is half of aSPRotect and half of the dll itself, but I don't know...). Tracing it does not work: it crashes at some kernel code.
If anyone has some time, I will be very happy to have a 'tutor' for this program.
Thank you!!!
Lemon13
09-22-2002, 10:52 AM
it's build 18xx, if this could help.
DakienDX
09-22-2002, 11:02 AM
Hello Lemon13 !

How did you "dump" it without knowing the OEP?
You can only dump at the OEP or else your dump will probably not work since some data is already initialized.

Why don't you use the search function? ASProtect is the most discussed protector here and anything about it can be found just by searching.

So you want to "reverse" the program and you are searching for a "tutor".
I'm sure this could be interpreted different, but I will leave it as it is now.
Lemon13
09-22-2002, 06:18 PM
Sorry if my questions could be a little stupid: I admit, I'm quite new to unpacking problems but I could _not_ find out by myself the OEP. However, you say that without knowing the OEP you can't dump because you will have initialized data: but I can't find out the exact point where it jumps inside the real code of the user interface.
Believe me, I trace inside every call and after many days of "work" I understood it jumps inside the real code from a kernel routine: don't ask me how it does this, because when tracing with softice there's a crash due to invalid instruction inside the kernel call. My little request was to find out someone who had already cracked Outpost, if he could give me help.
Tell me if the thread is too stupid, I will learn more and then come back.
nofurs
09-22-2002, 06:23 PM
Hi,
Think that DakienX has mention search the forum.There are lots of threads about this.

> My little request was to find out someone who had already cracked Outpost, if he could give me help.

You have come to the wrong forum.You should post some code and show that you have "done".
Paul333
09-23-2002, 09:20 PM
I think i know where Lemon's coming from, i suspect he's a bit like me ..ive cracked a lot of "normal" programs and the majority of them was by trial and error...thats normal apps BUT when it comes to unpacking apps packed with a protector like ASPROTECT im totally stumped....im lost LOTS of peeps say in there tutorials ok find the oep then go on to telling you what it is they dont explain how to find it they just assume you should know but its hard for us newbies even with tutorials....heres an example im trying to unpack Sniffem which is packed with asprotect 2.1 new strain ..i know i need to find the OEP so i used PIED v1.81 chose find entry point from its menu and it gives me 40b0co..i then use that number in REVIRGIN 1.3 and click resolve...i see lots of function names and guess its working helping me find the imports..but theres 1 missing so i click RESOLVE again but still 1 missing ...im stuck at this point because theres 1 still missing i have to find it manually but i havnt a clue how to go about it ..so please bear with us newbies ..sometimes it helps us if someone can talk us thru our probs bit by bit so we get a greater understandibg how to go about unpacking these apps ..it be great if one of you could sit down and write a really indepth guide on how to unpack a these apps bit by bit leaving nothing out .it be appreciated :)

paul333
evaluator
09-24-2002, 08:55 AM
hey!

For make proper unpacking everyone must use tool called DEBUGER.
REVIRGIN, imprec, "PIED"(PEID!?) & others are additional helper tools for make your life easy!
(for example you are not forced to build ImportTable manually)

So when you miss some api name in RV you will use DEBUGER & look at problem with you eyes.
So you will find OEP manually & will be 100% sure it is right.

SO START LEARN USING DEBUGER!

PS.
for RV leave value 401000 in OEP field.
Lemon13
09-26-2002, 08:19 AM
hi all,
a lot of thanx to ... who suggested me to learn to use debugger. I added to it the brain and finally I arrived to OEP. I searched the pattern POPAD; JMP EAX and it was always located in a range of data and code. But this only after the loading of the dll. But the real problem was that this adress (of POPAD;JMP EAX) changes everytime the program is run. But it follows a pattern, and after some work I found it's located ~20 bytes before one of the two ascii strings 'MFC42.DLL' (second occurence) or 'gger' (first) (which stands for debu_gger_ detected etc), and in the byte where POPAD;JMP EAX will be decrypted there's a 0x69. After some time I found out the OEP, which is E7506D. Is this the standard asprotrect routine?
I used superbpm too!
Now I'm going to search for more info about IAT and RVA before posting anymore, no more stupid questions. thanks to all and sorry for my first post!
DakienDX
09-26-2002, 09:56 AM
Hello Lemon13 !

Well, well, this is a much better attitude now. :)

The problem why the jump to OEP is always at a different location is already known. ASProtect uses GetSystemTime to randomize this part of the protection.

If GetSystemTime "returns" the same value two times, the jump to OEP is also at the same address both times, so you can break on it.
BruceLee
09-26-2002, 09:08 PM
thx for tip abot GetSystemTime. I found OEP :) It's no problem anymore, hehehe, until next version ;)

Bruce Lee
Lemon13
09-27-2002, 06:40 PM
hi all,
I fell better now that you wrote me that I have not spend my time in useless work!
In those days i've got few time to spend on my target, but I have a question: I made the dump (after entering a infinite loop on the OEP) with LordPe and I used the [partial] option, is it right?
and another question: the dll itself has is own IAT? is it right or it uses in some way the executable IAT? this because tutorials are 99.9% about .exe files and not on dll and now I'm a little confused on the way to re-build a valid import table.
However I will work it out...
thank you!!! bye
DakienDX
09-27-2002, 10:11 PM
Hello Lemon13 !

If you use the right values for a partial dump it'll work fine, but you should try a full dump first, so you don't need to care about the values you're using.

DLLs have an IAT too, just like EXEs. You can unpack a DLL nearly the same way as an EXE, but you'll have to take care about the relocations and the image base, because this is important in DLLs, not like in EXE files where you can usually ignore it.


Strange Things: Cxop, WinMe, Ds 2.7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Strange Things: Cxop, WinMe, Ds 2.7
PDA

View Full Version : Strange Things: Cxop, WinMe, Ds 2.7

h8er
09-22-2002, 11:26 PM
I've installed Ds 2.7 on Windows Me but not loaded (i' ve changed the checked io.sys with the original) and a very strange thing is happened: CacheX for Opera doesn't start (show me the dialog "debug is not allowed") but Softice is not loaded !!!!! :confused: :mad: , i've tried to reinstall the program but the problem still remain. No problem under WinXp... Any idea ???


DOS-Kernel Cracking Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DOS-Kernel Cracking Question
PDA

View Full Version : DOS-Kernel Cracking Question

thenite
09-23-2002, 12:02 AM
Hello,

I have a problem with reversing an OS-loader / kernel:
It is the evaluation version of the ROM-DOS by Datalight,
which has a small 'bug'. When booting it displays a message
("You are using the eval version blabla...") und waits for
the user to press ESC. This is what I would like to fix.

But I don't have a clue where to start... The IDA-deadlisting
doesn't give me any hints (too much asm and too little
Interupt-calls ;-) and I don't know how to use a debugger
in this...

So it would be really great if someone could help me with this or
give me a hint on how to proceed with this...

Thanks very much in advance.
Aimless
09-23-2002, 06:44 AM
Decide the working of the same first:

1. Is this in the ROM ?
2. Is this loaded by ROM, but the first in the line of drivers?
3. Is it a .SYS file loaded by DOS?

1) If it is the ROM, you will have to search the message board and find out my tips on hacking ROMS. You will require softwares OTHER than simple IDA. Debuggers (current stock) are not sufficent.

2) If it is loaded as the first driver by ROM, then you will have to bring it down on the chain of drivers(suggest you look that up first).

3) Simple. IDA is best here (remember, UNPACK and DECRYPT, if necessary) before doing the same.

The reason you are not seeing many interrupts is because an interrupt is used by DOS. If this thing is capable of existing without DOS, then it will have its own methods of communicating with the hardwares. Find that out and you will know what to do. You can also use ROM-DUMPERS to dump the rom, disassemble it, mark the checks and remove them. Remember though, it will NOT be a jump/jne/jnz...etc at all. Instead it will be a loop of keyboard scan where it waits for the user to press ESC. Your best bet is to:

1. Dump the ROM
2. Understand the hex equivalent of the ASCII value of ESC key (or check SCANCODE value in hex)
3. Search for the same in the dump (you'll get a LOTTA hits)
4. Filter them. You know that its in a loop. Check for the same
5. The loop would be executed by some jump/jne/jnz....etc. but reversing them would prolly throw the whole system out. So instead, check for the values in the register and change them.

Have Phun
thenite
09-23-2002, 09:31 AM
Thanks for your reply!

The protection sits in the part of the OS, which is written
to the bootsector of the HD or FD, so its first loaded
when starting the OS.

My first idea was to look for the loop and for the ESC-scancode, too,
but I didn't get any result with this.

About the scancode: For DOS the ascii-code for ESC would be 0x1b (27).
Is this DOS-specific or is it valid for any OS ?

Maybe, is there a way to use a program like VMWare to start
the OS an then using a debugger on it?

cu
DakienDX
09-23-2002, 10:24 AM
Hello thenite !

If it is like you say and the "nag" is written to the boot sector of the HD or FD, then there is not much code which could contain the "nag", especially on FDs.

The ASCII code for ESC is 27 (=1Bh), but at deep OS level it's not likely that anything is done with the help of ASCII codes, but with the help of SCAN codes.

The SCAN code for ESC is 01h. You can get these code for other keys with help of INT 16. Just set AX = 0, execute and INT 16, press any key and after that AL will contain the ASCII code and AH the SCAN code of the key.

If you don't find it with help of INT 16, you should look for something like IN AL, 60. After this AL contains the SCAN code of the pressed key (but it doesn't wait for a key to be pressed).

So you might find something like this somewhere:
; Print out the shareware message here
; Maybe with INT 10, maybe directly by writing into the screen buffer.

X: In AL, 60h ; Get a key
Cmp AL, 01h ; Cmp if ESC
Jne X ; If not stay in the loop
thenite
09-24-2002, 10:39 AM
Hi, thanks for the hints!
I didn't thought about the difference between scancode and ascii code.
But unfortunately this didn't get me any further. I couldn't find
any occurence of the int 16h and no in al,60 or similar....
I even dusted off the old sourcer, for trying it istead of IDA, but
this didn't help, too. So I give up *g*

If there's someone who wants to take a look at it, drop me line
and I'll send it to you (~200Kb).

Many thanks for your tipps,
cu


a crackme of sorts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > a crackme of sorts
PDA

View Full Version : a crackme of sorts

mike
09-23-2002, 04:43 AM
Once you learn perl, you have to write a few japhs. They become mini-reversing puzzles for those that read them. All they do is print 'Just another Perl hacker,' (with a comma at the end). Here are my first two attempts:

$_=q]#*'$$*$$($$)%#,*$$#&$$)$#'$#&'%#+#$#&'$#+%$#'#,*#,,$#*$#&'#''];$
/=q s\s$\%$###$g;\s#&#***#g;0 1chr}1m;(...);g}5'',1(ord)-42}3//;s;;$/
=~s@\*@\\\$@g;$/=~s;\d;qw}print map{ 5 split 3 join }[$&];eg;eval$/;#

$_="You know--Rodney from Roy,like last week's episode!";
s/[^a-z -]*//ig;tr[mRoeny tifl askd-][Preach Jolt sunk,];
print $_{q!JAPHANACRYPTOGRAM!},(reverse split//)[14..38];
Kayaker
09-23-2002, 05:17 AM
I moved this from off-topic Mike. Maybe someone can figure this out and I can learn wtf it means ;)

Regards,
Kayaker
Bengaly
09-24-2002, 07:15 AM
crypto is taking over mike's brain :)
mike
09-28-2002, 01:07 AM
The second one is easiest.
$_ is the default scalar variable in Perl. If a command doesn't have a parameter, it grabs it from here. So the first line sets $_ to the string "You know--Rodney from Roy,like last week's episode!"

The second line uses the substitution operator and the transposition operator. The substitution s/[a-z -]// replaces everything that isn't a letter, a dash, or a space with nothing. The switches ig mean case Insensitive and Global. There's no argument to tell it what string to use, so it uses $_.
What's left is "You know--Rodney from Roylike last weeks episode"

The transposition tr[mRoeny tifl askd-][Preach Jolt sunk,] replaces each character in the first list with the corresponding one in the next list. $_ is now "Yeu ncew,,rekcah lreP rehtona tsuJ waanu apoueka". You should be able to see the string now and guess what the rest of the program does.

$_{q!JAPHANACRYPTOGRAM!} is blank because I haven't defined it before (it's an element of %_, a hash table). split // takes the string and turns it into an array of characters. reverse turns it around. [14..38] takes the letters 14..38. print prints!
SiNTAX
09-28-2002, 01:27 PM
Somebody's been following the Perl Obfuscation Contest :)

h**p://www.sysadminmag.com/tpj/obfuscated/

Anyway something even kewl'er:

Wolfenstein 5K
h**p://www.the5k.org/description.asp/entry_id=946

Wolfenstein in JavaScript, just 5kb in size.. what will they think next...

Anyway we're getting REALLY off-topic now.


How to write program for tracing OEP?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > How to write program for tracing OEP?
PDA

View Full Version : How to write program for tracing OEP?

BruceLee
09-23-2002, 09:18 PM
Hi!

Anybody have idea? Which API Should I used?

Thx, Bruce Lee
SiNTAX
09-23-2002, 10:53 PM
There are 2 ways that I can think of... the easy way and the good way..

* easy way

write a program that single-step debugs your target until the EIP reaches a certain address (range).

* good way

same as above, but emulate 'dangerous' instructions that might take control away from your program.

Both have been done before.. OllyDbg has a tracer that can even log each and every instruction executed.

For the second case.. have a look at the IceDump source.
username
09-25-2002, 08:08 PM
Originally posted by SiNTAX
write a program that single-step debugs your target until the EIP reaches a certain address (range).

* good way

same as above, but emulate 'dangerous' instructions that might take control away from your program.

It's not only about 'taking control away' but also about 'detection of being traced'.

Both have been done before.. OllyDbg has a tracer that can even log each and every instruction executed.
Last time i checked, icedump could do that too.


Avoiding INT1 detection of SoftICE under WinXP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Avoiding INT1 detection of SoftICE under WinXP
PDA

View Full Version : Avoiding INT1 detection of SoftICE under WinXP

SiNTAX
09-23-2002, 10:59 PM
Does anybody have a tool or tip to avoid INT1 detection of softice (WinXP)?! As it stands now, SI just treats the INT1 as a NOP.. or if you use I1HERE it breaks but doesn't execute the exception handler.

Thought I'd ask, before trying to patch SoftICE myself...
evaluator
09-24-2002, 09:06 AM
Yah!

In general you must NOT DO "F8" (single step) on this instruction & exception handler will work!

BTW, this is not subject for this forum.
SiNTAX
09-24-2002, 09:23 AM
Originally posted by evaluator
Yah!

In general you must NOT DO "F8" (single step) on this instruction & exception handler will work!

BTW, this is not subject for this forum.

Really? I thought (plain/unpatched) SI would just skip the instruction.

I'm almost certain SI handles the INT1 a bit differently than when no SI is present.
evaluator
09-24-2002, 11:12 AM
I know about difference & how to...
SiNTAX
09-24-2002, 11:29 AM
I'll just hook INT1 and check if the exception was caused by an INT1 instruction, if so.. pass it on to the old INT1 handler instead of giving it to SI.

Shouldn't be too hard to do..
evaluator
09-24-2002, 08:08 PM
so happens without your "help":)
SiNTAX
09-24-2002, 11:21 PM
Originally posted by evaluator
I know about difference & how to...

So do I now :)

8...4->C...5 :D
evaluator
09-25-2002, 12:00 AM
not enaf!
find ^DAEMON^ 's home page, download "sice detector" & make test.

Bye!
SiNTAX
09-25-2002, 12:18 AM
'SICE_NOT_FOUND' is enough for me :)

^DAEMON^ 's "sice detector" doesn't detect my SoftICE when I use I1HERE ON and then 'X' when SI breaks.

But my new and improved version does..
evaluator
09-25-2002, 11:10 AM
you not understand fully trick,
but this is because of not enauf implementation by ^DAEMON^!

I just upgraded his prog, so it will detect NTICE in 3 kind!!!

So I need ^DAEMON^'s permission for publish it:(

^DAEMON^,^DAEMON^! where are U!?
SiNTAX
09-25-2002, 11:30 AM
I understand it perfectly.. don't worry :)

Anyway my original beef was with an SD executable, which uses INT1 as a first SI detection. Changing the exception code resolved the detection.. so problem solved..

But.. you speak of 3 methods.. I only count 2, so guess there's one more way. Feel free to share it.

1) eip +2
2) exception code
3) ?
evaluator
09-25-2002, 01:00 PM
as already wrote: single stepping(F8,F10) on INT01.
This not implemented in "SiceDetector", so if you trace program in ntice, it "not founds".

also there is another easy detection for ntice:)
^DAEMON^
09-25-2002, 03:59 PM
hi,

my page is currently down... i don't know when it will go online again...

u can release it of course

(btw. i don't know when i'll update my page the next time
i've other projects running currently)

^DAEMON^
evaluator
09-25-2002, 06:06 PM
Hell_to_you DAEMON!

OK! Here is UPGRADED INT01_SICE DETECTOR.
1. Detects single step on INT01 instruction
2. Detects if INT01 is trap (so NTICE is here)

2-nd case self-intends error code kind (80000003 or C0000005), so I not included test for it.

BTW, I have only XP, so test it on W2k, nt..
SiNTAX
09-26-2002, 08:08 AM
Might as well make it complete and add:

..to exception handler
mov eax,[ebp+8]
mov eax,[eax]
mov [exception], eax
...

Then test in main code:

cmp dword [exception],C0000005
jnz .sice_found

section .data
exception: resd 1

---
At least that will even work when *NOT* single stepping the target in SoftICE.
SiNTAX
09-26-2002, 05:17 PM
Well here's my version.. and since I was playing around abit with code obfuscation, I included that aswell :)

NOTE: feel free to give your comments on the obfuscation, but keep in mind that the test of the result is not hidden away.
SiNTAX
09-26-2002, 05:18 PM
LOL! Forgot to attach the file
Solomon
09-29-2002, 03:33 AM
In my Win2k, it works no matter whether I press F8 on the INT 1 or not, coz you check the exception code 80000004 in your SEH handler.:D

Originally posted by SiNTAX
LOL! Forgot to attach the file
SiNTAX
09-29-2002, 08:52 PM
Indeed :) So.. what did you think of the code obfuscation?! Did it totally suck, or was it OK?!
evaluator
09-29-2002, 10:36 PM
Hello, Solomon!

What exception code produces your w2k system?
(just intresting:)
SiNTAX
09-30-2002, 12:16 AM
The exception code normally is: EXCEPTION_ACCESS_VIOLATION EQU 0C0000005H

If it's not, then there is something else loaded :)

I tried it on: NT4, NT2k SP1 & WinXP

Solomon... did you mean that the detector does a faulty detect if no debugger is loaded?! Or did you just mean that it worked?!
Solomon
09-30-2002, 02:23 AM
Hi,

sorry I didn't express it clearly. The detector works.
It can detect SICE whether I press F8 on the "INT 1" instruction or not.

I have traced through this detector. The exception code is 80000004(STATUS_SINGLE_STEP)
SiNTAX
09-30-2002, 08:31 AM
Pfwew :)

Question... if an INT1 occurs and you handle the exception directly instead of going through Windows (so if the IDT vector of INT1 points to your code), then where is the exception code put on the stack?!

If I read the Intel docs correctly, it should be at [esp], ie stack frame should be:

CS
EIP
Exception Code

But if I have a look at the code of NTALL:

00010875 pusha
00010876 lea ebx, [esp+24h] ;ptr to segment sel.
0001087A lea ecx, [esp+20h] ;ptr to EIP
0001087E mov ecx, ss:[ecx] ;get EIP
00010881 xor eax, eax
00010883 mov ax, ss:[ebx] ;get segment sel.
00010887 push gs
00010889 push ds
0001088A db 66h
0001088A mov gs, ax ;load seg.sel.
0001088D db 66h
0001088D mov ds, cs:word_102AC
00010895 cmp word ptr gs:[ecx-2], 1CDh ;was instr. and INT01?
0001089C jnz short loc_108A3
0001089E lea ecx, [ecx-2]
000108A1 jmp short loc_108AD

Then it seems that the exception code is missing?! (PUSHA adds 20h to stack, so the ESP+20h should give the exception code, but instead gives the EIP)

Anybody care to enlighten me?!
cyberheg
09-30-2002, 09:01 AM
Since noone else mentioned anything on it I'd like to say a few things about the obfuscation in your code.

I'm not gonna go into big details (atm. I am writing a obfuscator myself for the last 2 months where I tried also to be innovative and also do alot of research on the subject).

Your obfuscation is weak, very weak. It took me exactly 5 minutes to learn your patterns in generated code and how to deal with them. Since I don't have access to a debugger from work I had to stick with the freeware IDA.

Some hints which you might want to think of is you can devide obfuscation into code flow and runable garbage. It's important to handle things apart to make something strong.

Let me show you a example of what I think is weak:

CODE:0040101A loc_0_40101A: ;
CODE:0040101A ;
CODE:0040101A jnz short loc_0_401013
CODE:0040101C xchg ecx, ecx
CODE:0040101E jz short loc_0_401013

Ida tells me the code goes same places no matter the flag setting.
The push offset; inc [esp] isn't gonna fool anyone for long either.

As for runable garbage it's hardly worth talking about:
mov eax, eax
xchg ecx, ecx

and at the bottom of the file there is alot not dissassemable code. I assume you just padded the file with random bytes or similar. There was very little IDA couldn't handle correctly which is another indication that the code flow obfuscation isn't strong enough.

// CyberHeg
SiNTAX
09-30-2002, 09:37 AM
Thanks for the comments.. I must add that I didn't put alot of time into it.. it was one of those 'hey let's try this'-thingies :)

Anyway I fully agree with you, that correcting the disassembly in IDA isn't much of a problem once you know what is going on.. However, the point is that it takes an effort on the user's part to correct it.

The push/inc [esp] is indeed easy to spot but the point here is to get IDA off track, ie. it doesn't recognize this as a simple JMP, therefor stops the disassembly.

The sequence with all the push's and then the ret's makes understanding the code flow harder (but is easy to single-step trace). So I think this is ok.. ie. it offsets IDA and it confuses the reverser.

As for the runnable garbage.. it's meant to do nothing.. that way you can easily interlace it with existing code.. and it takes a deobfuscator like Imhotep to clean it up.

The crap at the bottom of the file isn't mine :) It's just something that the NASM/ALINK combo added.
cyberheg
09-30-2002, 10:43 AM
Originally posted by SiNTAX

The push/inc [esp] is indeed easy to spot but the point here is to get IDA off track, ie. it doesn't recognize this as a simple JMP, therefor stops the disassembly.

The sequence with all the push's and then the ret's makes understanding the code flow harder (but is easy to single-step trace). So I think this is ok.. ie. it offsets IDA and it confuses the reverser.

As for the runnable garbage.. it's meant to do nothing.. that way you can easily interlace it with existing code.. and it takes a deobfuscator like Imhotep to clean it up.

The crap at the bottom of the file isn't mine :) It's just something that the NASM/ALINK combo added.

With runable garbage I agree with you that it must not interfear with the real code. However it's possible to do many steps to make advanced/intelligent garbage which will stop any disassembler or engine without emulation facility.

For imhotep I found many many holes in it which can make it useless. My last attempt I laffed alot because it managed to clean up some of my code but then again it also made a endless loop out of it which resulted in useless cleanups.

In short what you're trying to do with push $;inc [esp] or those conditional jumps are just 'advanced jumps' but it's possible to make them even more intelligent.

// CyberHeg
SiNTAX
09-30-2002, 11:20 AM
Originally posted by cyberheg
With runable garbage I agree with you that it must not interfear with the real code. However it's possible to do many steps to make advanced/intelligent garbage which will stop any disassembler or engine without emulation facility.

Very true.. but this was hand-written.. if I'd make an obfuscator tool, it'd make it more challenging ofcourse... throw in alot of register shuffling and crap like that..

And every now and then do some register shuffling that actually changes some registers.. as most reversers tend to get sloppy with repetetive tasks :)

For imhotep I found many many holes in it which can make it useless. My last attempt I laffed alot because it managed to clean up some of my code but then again it also made a endless loop out of it which resulted in useless cleanups.

Imhotep is indeed buggy.. it tends to get stuck alot (hell if you run it on a recent SafeDisc it will clean up too much and then go in an endless loop)

In short what you're trying to do with push $;inc [esp] or those conditional jumps are just 'advanced jumps' but it's possible to make them even more intelligent.
// CyberHeg

True.. but intelligence is something for an automated tool.. not for 5 minute handcrafted code. Also, it's hard to hide something in a 20 line program :)

Hell if I'd have to write an obfuscator, I'd probably grab the LCC compiler source and make it spew out all kinds of crap between valid code sequences.
The things you could do then would make great nightmare material !
SiNTAX
09-30-2002, 02:58 PM
Originally posted by SiNTAX

If I read the Intel docs correctly, it should be at [esp], ie stack frame should be:

CS
EIP
Exception Code

Guess I should have worn my glasses when reading that document:

IA-32 Intel Architecture Software Developer's Manual, Volume 3
p165 / 5-23. Interrupt 1 - Debug Exception (#DB)

Exception Error code

None.
evaluator
10-01-2002, 12:00 PM
^DAEMON^!

"Little" question I have to you:

On XP I build Tflag-tracer & successfully tested on your
"DP-teunlock" & "Protect v0.6.7 beta - last.exe".

for "Protect v0.6.7" instuctions counted until OEP = 0C6AD99B h.
(from "KiUserExceptionDispatcher" routine included 4 instruction for each occurence)

Can you somehow confirm this fact!?
(if you have your own tracer or something else)
^DAEMON^
10-04-2002, 02:44 PM
hi ev,

just check icedump tracex or revirgin's tracer... i can't check sorry
evaluator
10-05-2002, 03:09 PM
heh!

DAEMON, nice joke!
At least you must know, your "protect-last-beta" is NON-traceble by Icedump on my W98se,
and also RV1.5 can't trace it on XP.

OK, so you not have your own tracer..

BTW, what hard targets can you (& all others) recommend for testing my tracer?(for XP)

Already tested:
tElock last
poxylock1.3
pcguard 4.06 demo
XLoK Loader Version 1.3.2714
SiNTAX
10-05-2002, 03:13 PM
Originally posted by SiNTAX
The exception code normally is: EXCEPTION_ACCESS_VIOLATION EQU 0C0000005H

If it's not, then there is something else loaded :)

Right.. had an insightful moment and came to the conclusion that fixing this is 'tres simple' :)

On WinXP: EB 8003f40d 8e

And yippe... detection fixed.
evaluator
10-05-2002, 04:38 PM
congratz:)

Finally you did it!

Can you share some info for me, because you have many OpS.

I interesting for R0 & R3 Segment Register values for each nt-base OS.

For example in XPpro I have:
R3:

CS 001B
DS 0023
SS 0023
ES 0023
FS 0038 or 003B
GS 0000

R0:

CS 0008 <-
DS 0023
SS 0010 <-
ES 0023
FS 0030 <-
GS 0000

So what values are in W2k & NT4 (& 3.5!?)
^DAEMON^
10-05-2002, 05:16 PM
hmm strange protections ?

i c u tested already k-kryptor...
aspr ?
peshield ?
pecrypt ?

^DAEMON^
SiNTAX
10-05-2002, 10:05 PM
Originally posted by evaluator
congratz:)

Finally you did it!

Can you share some info for me, because you have many OpS.

I interesting for R0 & R3 Segment Register values for each nt-base OS.

So what values are in W2k & NT4 (& 3.5!?)

Well it worked before too... but this is the easiest way ofcourse.. thanks for not helping :(

I only have WinXP at home... at work I have access to more OS'es but helas no soft ice to check it.

Anyway I think the segment regs are the same for all NT based OS'es.

So.. is your tracer capable of tracing through device driver calls & Ring-0 calls?!
evaluator
10-06-2002, 07:23 AM
Crack-tracer's generally are for Ring3 protected proggs;)

BTW, what R0-tracer you know!? & why is need it for Drivers!?
For such thing need Debuger, IMHO.
nikolatesla20
10-24-2002, 07:57 PM
evaluator, could you please answer a question for me?

I was looking at your detector, and trying to understand how it uses the exception frames to its adavantage to detect SI.

Here's the code at the beginning

:00401000 E80E000000 call 00401013
:00401005 8B5C240C mov ebx, dword ptr [esp+0C]
:00401009 8383B800000004 add dword ptr [ebx+000000B8], 00000004
:00401010 33C0 xor eax, eax
:00401012 C3 ret

:00401013 31C0 xor eax, eax
:00401015 8CC8 mov ax, cs
:00401017 80FC00 cmp ah, 00
:0040101A 755B jne 00401077
:0040101C 6467FF360000 push word ptr fs:[0000] <-no exception handler pushed yet?
:00401022 646789260000 mov fs:[0000], esp
:00401028 CD01 int 01
:0040102A EB12 jmp 0040103E <-- Single step ends up here. U ARE BAD BOY !
:0040102C EB20 jmp 0040104E <-- normal operation here. (GOOD)
:0040102E 6A00 push 00000000 <-- SI present ends up here....how? (YOU ARE BAD BOY!)

* Possible StringData Ref from Data Obj ->"Hello!"
|
:00401030 6800204000 push 00402000

* Possible StringData Ref from Data Obj ->"NTICE FOUND by ^DAEMON^!"
|
:00401035 6840204000 push 00402040
:0040103A 6A00 push 00000000
:0040103C EB2B jmp 00401069

what I'm wondering about is how is the exception handler being set up in the first place - because there is never a push <address> before the fs push itself. So how does the exception frame work?

Also, I understand how the single step could be detected, if INT 1 is "ignored" or in other words, SI "handled" the int1 exception, and the program continues on. (Similar to how SI would react to an int3 "CC" exception, used for bpx). But how, when you are not setting a bpint 1, does it jump over both "JMP" instructions and end up in ^DAEMON^'s code?

I'm reading up on exception frames, etc, but I still dont understand fully how this works. Especially since it doesn't seem like there is ever an address passed in to handle exceptions. Can you please help me ?

-nt20
DakienDX
10-24-2002, 09:09 PM
Hello nikolatesla20 !

The expection handler is already pushed on the stack at 0040101Ch.
When the call at 00401000h is executed, it places 00401005h as return address on the stack, which is the same as pushing it directly on the stack.
nikolatesla20
10-24-2002, 09:24 PM
Thanks DakienX, I had already thought of that - the only address I could see being pushed was the one in the call instruction.

But I still didnt understand how this would end up landing on the right instruction, the second JMP.

BUT NOW I GET IT ! YAY!

I just remembered that yes this code will get called now after the exception. Right? And it looks like it takes the EIP register and adds 4 to it....to land on the proper "JMP"...

am I on the right track here?

So the way SI responds to the Int 1 must be slightly different - the docs I have say that on an int 1, eip will point to "the next instruction". However I dont think thats right I think it stays on the int1. If in SI it does end up on the next instruction , then I see how this works, because eip+4 would be the "^DAEMON^" detection message.

:00401000 E80E000000 call 00401013 <--- The call pushes next address on stack.
:00401005 8B5C240C mov ebx, dword ptr [esp+0C] <-- this becomes our exception handler. It adds 4 to EIP.
:00401009 8383B800000004 add dword ptr [ebx+000000B8], 00000004
:00401010 33C0 xor eax, eax
:00401012 C3 ret

:00401013 31C0 xor eax, eax
:00401015 8CC8 mov ax, cs
:00401017 80FC00 cmp ah, 00
:0040101A 755B jne 00401077
:0040101C 6467FF360000 push word ptr fs:[0000]
:00401022 646789260000 mov fs:[0000], esp
:00401028 CD01 int 01
:0040102A EB12 jmp 0040103E <-- If we single step, no exception, no EIP+4
:0040102C EB20 jmp 0040104E <- Normal, for EIP+4 to work, then exception EIP must still be on int 01 instruction.
:0040102E 6A00 push 00000000 <-- EIP+4 lands here if somehow int 01 was handled and EIP pointed to the instruction after it. (SI do this? )

* Possible StringData Ref from Data Obj ->"Hello!"

One thing I don't understand yet tho. On my own machine, which has softice on it, I wrote a little test program using int 01. I set up and exception handler, and everything works as expected. Granted, I am not modifying the EIP register tho.

So is this the *trick*, modifying EIP? Because SI must set EIP to point to a different instruction after the Int 01 than it would be without SI.

-nt20
SiNTAX
10-25-2002, 05:57 PM
nikolatesla20, a hint: without SI loaded, you don't get a debug exception but you get another type of exception.
evaluator
10-26-2002, 02:57 PM
Hi, nikolatesla20

You wrote too many eNgliSh for me.
IF you Q is:
"Why on clear system Exception-EIP is ON INT01 instruction
& why with NTice Exception-EIP is after INT01"

So answer "jokerly" already done in this thread. But anyway:

On clear system windz in IDT sets 8E byte for INT01 descryptor.
This means DPL=0.

>Virtual-8086 Mode Exceptions
>#GP(0)> (For INT n, INTO, or BOUND instruction)
>If the IOPL is less than 3 or
>>>the DPL of the interrupt-, trap-, or task-gate descriptor is not equal to 3.

So IF Ring3 task attemps to make DPL=0 INT, happens GP = INT0D (not given INT).
In stack processor pushes start of instruction, which made GP.
Windz INT0D hanler-manager will put C0000005 as error code.
So in SEH-report we have error-instruction start + error code (Access Viola;).

If NTice (..Sice) loaded, it changes 8E byte to EE, e.g. now INT01 is DPL=3.
Ring3 task normally can attemp DPL=3 INT & in stack will saved next insturction address,
because INT is CALL:). Then NTice will check, if set BPX-BPM for task here. If nothing will
found, NTice sends execution to windz INT01 handler as it think out-error happens.
Windz's INT01 handler then manages error & puts 80000004 as error code.

That's all Falks!

BTW
nobody yet explaned??
Maybe I will use SEARCH..
nikolatesla20
10-26-2002, 04:33 PM
Thank you evaluator !

I did do a search but I never really got such a clear answer like you gave. Thank you very much :)

And yes, that is what I was asking, why , without SI, the error would be ON the INT01, and with SI, it would be AFTER the INT01.

I thought it must have had to do with the difference between being a GP (General Protect) or TRAP , but I wasnt sure how windows handled the INT01 by default. I was searching the web also and could not find an answer to this.

-nt20
nikolatesla20
10-28-2002, 08:46 PM
In S.I.,

"IDT"

"db <address of IDT base>"

"ALT + D"

Change 14th byte from EE to 8E.

"Enter"

Detection gone. Also, doing this allows you to step into windows exception handler if you are F8'ing. :)

-nt20
Manko
10-29-2002, 06:50 AM
Seems to work with a couple of detectors... ;)

Back to your fine Patch!

Do we not have to rename the ntice.sys and correct for that?

DAEMON has a small detecter that says it finds ntice.sys loaded on w2k... But maybe it's not important yet? Noone uses it...?

/Manko
SiNTAX
10-29-2002, 07:49 AM
Originally posted by SiNTAX
Right.. had an insightful moment and came to the conclusion that fixing this is 'tres simple' :)

On WinXP: EB 8003f40d 8e

And yippe... detection fixed.

A bit less verbose :p
Manko
10-29-2002, 07:54 AM
Didn't see that one!
You're in my book of reverance, as well! ;)

/Manko
SiNTAX
10-29-2002, 08:26 AM
Originally posted by evaluator
Crack-tracer's generally are for Ring3 protected proggs;)

That's because no-one took the time yet to make one that does R0 too :)

BTW, what R0-tracer you know!? & why is need it for Drivers!?
For such thing need Debuger, IMHO.

Don't know one (unless you count BOCHS). But I see it being useful as some protections use device drivers.. and what is to keep anyone from putting ALOT more code in a device driver (not like the silly SecDrv from SD)
nikolatesla20
10-29-2002, 02:32 PM
Oh, sorry SINTAX,

I guess I didnt understand your patch "EB". I didnt mean to steal your idea at all, it just didnt dawn on me !

Sorry 'bout that ! :) But thank you for all your help !

I was thinking it should be possible to patch ntice.sys for this (or whatever program loads SI - winice.exe?) - for example, ntice.sys is obviously hooking into the IDT. If you look at the IDT function offsets, they lead into softice code. So wherever the SI loader sets up the IDT I would think you could change how it sets the DPL for INT1.

To Manko: There are LOTS of ways to check for SI. Sometimes you just have to go program by program.

-nt20
SiNTAX
10-29-2002, 02:44 PM
Originally posted by nikolatesla20
Oh, sorry SINTAX,

I guess I didnt understand your patch "EB". I didnt mean to steal your idea at all, it just didnt dawn on me !

Sorry 'bout that ! :) But thank you for all your help !

-nt20

No problem at all...


DriverStudio and DevPartner with VC++ Standard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DriverStudio and DevPartner with VC++ Standard
PDA

View Full Version : DriverStudio and DevPartner with VC++ Standard

Vaboc
09-24-2002, 12:38 AM
hello.

Nr. 1: Can i use Numega DriverStudio with the Microsoft Visual C++ 6.0 Standard Edition? fully functional...? or need i the Professional Edition?

Nr. 2: Can i use Numega DevPartner with the Microsoft Visual C++ 6.0 Standard Edition? fully functional...? or need i the Professional Edition?

Big thanks for your answer :)
Snatch
09-24-2002, 04:08 AM
Do you even know what the tools are? Judging from your question it seems like you have little concept. DriverStudio is for driver development and has several utilities with it and most notably SoftIce which is all I would say 90% of the people browsing this and like forums use. Hence Softice Driver Suite the cut down version is perfectly adequate. It should work with anything on an IA-32 Windows platform and Numega tells you what versions of Windows are supported. They actually bundle along the latest DOS and Windows 3.1 SoftIce too which is quite handy if you ever for some odd reason need to go back to those. DevPartner is specifically designed for Visual Studio on the other hand and note you did not specify versions even. I believe they have seperate DevPartner versions to support other platforms such as Borland. Some versions support VS 6.0 others VS.NET I believe they are backward compatible though. So in conclusion: better to look around Numega's web site than ask a foolish question here.

Snatch


SoftICE 'bprw' vs. Athlon processor (lockup)???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE 'bprw' vs. Athlon processor (lockup)???
PDA

View Full Version : SoftICE 'bprw' vs. Athlon processor (lockup)???

Clandestiny
09-24-2002, 01:22 AM
Hiya,

OK, this sounds absolutely crazy but I have to ask if anyone here has experienced a similar problem...

I recently built a new system containing an Athlon XP 2200 processor and A7V333 Socket A Motherboard with KT333 chipset. Well, I installed SoftICE and it seems to work great until I attempt to perform a backtrace using the bprw 'module name' T command. At this point 1 of 2 things happen... 1) It locks the entire system up irrecoverably 2) The trace simply fails reporting that the 'backtrace buffer is empty' when attempting a 'show' command. The internal winice variable containing the total number of instructions logged likewise remains at 0. More often, scenario 1 happens though :( Strangely, an ordinary range breakpoint works fine (bpr 'address' rw). Needless to say, I am running the same version of SoftICE I've used on Win98 for the past 2 years and the only thing that has changed is the system I am running it on. I am curious if my new motherboard or processor could have anything to do with this problem ??? Could it have something to do with the way it handles paging? And more importantly, how can I fix this...??? I am really at a loss here and will welcome any suggestions.

Thanks,
Clandestiny
pappy28
01-20-2003, 11:39 AM
Hi Clandestiny,

I was running Windows 98 on a 333 mhz system with 64 megs of ram and using Softice 3.25. The bpr I set would always lockup the system and the only way out was to re-boot.

I also ran the same version of windows and the same version of Softice on a 650 amd with 128 megs of ram and the same thing happened.

Because of this I've never used the bpr because I just figured it wasn't going to work.

I thought I heard someone say that this only happens when you use an amd processor but I'm not sure.

Pappy28
Solomon
01-20-2003, 08:24 PM
I got the same result when using BPR in Win98SE with AMD processor. DriverStudio v2.7
LaptoniC
01-21-2003, 05:51 PM
I vaguely remember some discussion about this subject on ElicZ's board.
naides
01-22-2003, 10:11 AM
I doubt I am going to tell you something that you don't know but. . .

In theory, the internal workings of a CPU should be transparent to the applications runing in them, thanks to a layer of interrupts and BIOS and other software devices that make the comunication between code and CPU abstract and formalized. Apps that code very close to the bare metal, like a Kernel level Debugger, may not be as protected and may run into trouble with the internal workings of the CPU.

One of the aspects in which AMD differs substantially from Pentium ids the PipeLine and Branch Prediction devices, which, if you consider carefully, could collide with the BPR T instruction. BUT I do not know that for a fact.

A possible solution is to find a registered user of SoftIce (There has to be at least one, don't you think?) tosubmit your question to Numega technical support, or, if any Numega coder reads in this board ( I would not be surprised), to kindly help Clandestiny with his problem.
naides
01-22-2003, 04:11 PM
Did you try, in Winice.dat turning

Pentium = off

And

Mapping non-exiting pages = Off?

Look in Using SoftIce.pdf, trouble shooting area.


ASProtect v1.23 drive me crazy :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect v1.23 drive me crazy :(
PDA

View Full Version : ASProtect v1.23 drive me crazy :(

BruceLee
09-24-2002, 04:18 PM
Hi,

Now I have a little problem with ASprotect v1.23.

Proggie is Simple.ReStopAll.Pro 1.0 build 6
url: DELETED - Get the Hint?
size: ~500kb

but no matters

Problem is:

I found entry point: 0040BDF3h and dump and bla bla.
Start ImpREC & try first IAT auto search, but nothing. Then I enter real entry point and again search.
ImpREC found IAT at RVA: 11000 Size 360
:))))
ok!
then show invalid , trace level1 and ImpREC is dead! POOF!
I attach you unresolved.zip!
ok, ok, now I want to do this manualy, there is a problem!

example:

1 00011194 kernel32.dll 0210 InterlockedIncrement
0 00011198 ? 0000 00DD1210
1 0001119C kernel32.dll 0131 FreeEnviromentStringsW

I put breakpoint on real entry point and trying to unassemble 00DD1210h:

004111A8 65369210 65369040 65367A40 6536B5E0 ..6e@.6e@z6e..6e
---------------------------------------------------------------------------
0040BEB4 56 PUSH ESI
0040BEB5 FF1598114100 CALL [00411198] ; here I am
0040BEBB 50 PUSH EAX

<F8>

:00DD120E 8BC0 MOV EAX,EAX ;landing here
:00DD1210 55 PUSH EBP
:00DD1211 8BEC MOV EBP,ESP
:00DD1213 8B4508 MOV EAX,[EBP+08]
:00DD1216 85C0 TEST EAX,EAX
:00DD1218 7507 JNZ 00DD1221 ; no jump
:00DD121A A17469DD00 MOV EAX,[00DD6974]
:00DD121F EB06 JMP 00DD1227 ;jump , hmmm
:00DD1221 50 PUSH EAX
:00DD1222 E8313FFFFF CALL KERNEL32!GetModuleHandleA
:00DD1227 5D POP EBP ; after jump
:00DD1228 C20400 RET 0004

it is GetModuleHandle or what??

Next example drive me crazy!!!!

0041114C 00DD1270 00DE4DB8 00DE4DC4 00DE4DD0 p....M...M...M..e..6e
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
:0040BE67 FF154C114100 CALL [0041114C] ; I am here <F8>
:0040BE6D A3A8734100 MOV [004173A8],EAX

landing here

:00DD1270 6A00 PUSH 00
:00DD1272 E8E13EFFFF CALL KERNEL32!GetModuleHandleA
:00DD1277 FF35F06CDD00 PUSH DWORD PTR [00DD6CF0]
:00DD127D 58 POP EAX
:00DD127E C3 RET

GetModuleHandle again? I don't think so!
but which API is it???
after ret

EAX=8158B5D8 EBX=00560000 ECX=815ACEBC EDX=815A8090 ESI=00000000
EDI=00000000 EBP=0066FE38 ESP=0066FDC4 EIP=0040BE72 o d I s z a P c
CS=0167 DS=016F SS=016F ES=016F FS=2DC7 GS=0000
ÄÄÄÄÄRESTOPALL!+33A8ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄdwordÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
:004173A8 8158B5D8 00000000 00000000 00000000 ..X.............
:004173B8 00000000 00000000 00000000 00000000 ................
:004173C8 00000000 00000000 00000000 00000000 ................
:004173D8 00000000 00000000 00000000 00000000 ................
:004173E8 00000000 00000000 00000000 00000000 ................
:004173F8 00000000 00000000 00000000 00000000 ................
:00417408 00000000 00000000 00000000 00000000 ................
:00417418 00000000 00000000 00000000 00000000 ................
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄPROT32Ä
:0040BE67 FF154C114100 CALL [0041114C]
:0040BE6D A3A8734100 MOV [004173A8],EAX

hmmm... I'm lost :( How can I know which aPi is correct & how can I found them.

Sorry for bad English! Please give me a hand! I know that is no problem for you!

Regards,
Bruce Lee
hobgoblin
09-24-2002, 08:12 PM
If you do a search on this board (the button up on the right), you will find that all your questions will be answered after doing a little bit of reading.
Just to help you off: do a search for kayaker (or G6 FTP server, if you want...). Read all in that threads.
What you are asking is pure basics for unpacking Asprotect. When I started reading the threads, I quickly learned the necessary skills. It is much better to read, try out stuff and learn as you go by than get served a ready made solution. That's my opinion.:-)
Good luck.:-)
hobgoblin

PS. I checked out this program before posting this reply, and didn't find any particular problems at all.
BruceLee
09-24-2002, 08:56 PM
Thank you for responding :) I'll try!

BruceLee
BruceLee
09-25-2002, 08:49 PM
I read previous thread about asprotect.. I read that asprotect is in dll. But how dump aspr.dll for reversing?

And how we know what return example GetCommandlineA?

Thx, Bruce Lee


Disabled Save Function / Hidden RegWindow
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Disabled Save Function / Hidden RegWindow
PDA

View Full Version : Disabled Save Function / Hidden RegWindow

KacDrc
09-24-2002, 06:26 PM
Hi all

I'm working on an old version of Fruity Loops (2.7.0 i think) and although I first just tried to unpack it (aspack) i thought it would be only half work if I wouldn't crack it.

So after I unpacked it without problems I tried to enable the SaveFunktion but I'wasn't able to manage this! I've found a global var to enable the SaveMenuEntry, to Change the "demo Version" to "TS404 version" and so on but every time I try to save as a *.flp file there happens nothing!!! I've checked the SaveFunction several times for another cmp but I did'nt find one. Am I to stupid to find this f*ckin second cmp or may it be the programmers removed the real save Function?

The other problem is that I wasn't able to show the RegWindow.
I found this with Resurce Hacker and DEDE but by clicking the RegMenuEntry there's only a stupid html doc be shown. So I tried to change the RegWindow.FormShow routine with TipForm.FormShow routine but this didn't work. I manged to change the window's wich were shown in my own Delphi test Prog but Fruity Loops does strange things I dont understand.
May be somebody knows some Delphi reversing tuts cause I've only found DaFixers good tutorials.
So after this didn't work I read in a forum that there are special Keys wich activate the REGwindow but this works only for older Version of FL and I didn't found a combination for the newer Versions. Does somebody know how to get the HotKeys wich are used in a Programm?

Ok. I hope somebody can help me becaus I've worked for over 3 weeks and i'm going to become mad if i'm not even able to crack this simple Serial Check.

(Sorry for my bad english but i'am a "SAUERKRAUT FRESSER")


unpacking as usual
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking as usual
PDA

View Full Version : unpacking as usual

salsa
09-24-2002, 11:08 PM
Killing the unpacked one softly.

Well, I am a newbie and working hard to sharpen my unpacking abilities over a variety of packers/protectors available on the net. To my chance, I've messed with all UPX ones lately (I mean, only the ones which you fail on the -d command). One of them was a real hard nut. I applied the usual manual unpacking routines and failed. Then, tried the off the shelf unpackers, UPX fixers, etc., etc. All got fooled. The problem was the OEiP. All got it wrong. The program was starting, calling the usual APIs and then silently exiting thru ExitThread. Well, the author must have had a good knowledge of TOT since he played with the PUSHAD thingy. Anyway, I did some careful and timely debugging and found the correct OEiP, dumped, fixed, etc,...

The question is, why did the authors put too much effort on UPX? Maybe because it packs better or did they loose faith in the MYTHs lately, seeing each new version's fall in no time after their birth.

Comments?

salsa


FlexLM 6.1 an Vendor Defined HostID
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM 6.1 an Vendor Defined HostID
PDA

View Full Version : FlexLM 6.1 an Vendor Defined HostID

McGinster
09-25-2002, 05:17 PM
Hi all

I have a question regarding FlexLM 6.1
I have a target that uses Vendor_Defined_HostID
lc_set_attr with multiple calls of 3A

So I persume that different ID's are supported
Looking deeper in the calls I found that there
are 4 Vendordefined ID's with different integer
values. The 4th argument seems to be a pointer
to a function (it's always the same pointer for all
4 ID's), but it's never called.

How to proceed from this point ?. I have already
extracted the Keys 1-5 and Seeds 1/2. Target
does not use cryptfilters,checkout filters or lc_new_job

What really drives me crazy is that the license file
I already have uses HOSTID=ANY and a VENDOR_STRING and it works.

Perhaps somebody can help me in understand this

Greetings

McGinster
VoxQuietis
09-26-2002, 12:57 PM
You should look within the SDK for the vendor defined hostid example. It is usually applied for the incorporation of non-Globetrotter dongles. So if You want to generate a license with HOSTID=STRANGE_DONGLE=12345678 then You need to declare the STRANGE_DONGLE as a vendor defined hostid. After that lmcrypt can produce a valid license.

I should also point to the fact, that the mentionend declaration is only required for the parsing of the feature line, i.e. You don't need to supply a fully working STRANGE_DONGLE.c file. Usually the S/W vendor implements a check, whether You are running the application on a STRANGE_DONGLE= xxx machine. If he doesn't do that check, it should be considered as a flawed implementation, where a simple HOSTID=ANY does overcome all the additional protection.

So don't waste You're time with the actual implementation of the vendor defined hostid unless You're shure that You want to reverse it, e.g. because You are interested in emulating a dongle.

HTH
- Vox.
McGinster
09-27-2002, 02:17 PM
Hi again

Tried it, and failed :(

Changed vendor_hostid.c, the build rules for lmcrypt
and added the call for the vendorid in lmcrypt.c right after
the call to lc_init

I still get -8 for the license checkout

Perhaps I have overseen something ...
I used the values from lc_set_attr
where esp->c points to the hostid struct
this struct contains a char* to the hostidname
a int value, in this case 3e9, then 0 and then
a pointer to a function. I used the values of char*
and int. Is that correct ?

Greetings

McGinster


missing imported dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > missing imported dll
PDA

View Full Version : missing imported dll

BlackBuster
09-26-2002, 06:38 AM
hi

Could u point me where am i messing, this little proggie from gamehouse, whatword.exe. it is pack with asprotect. i was able to locate where to patch this to make it run as registered, locate the oep which i think its at eop=4f3495 and dump this with the patch. run imprec and revirgin. The imprec can only locate kernel.dll as the only imported dll and i was able to rebuild all the import table from kernel32.dll and fix the dump file.

But when i run the dump file it crush at addr=8a5674 which is called from

0177:0041C250 PUSH 00007FFE
0177:0041C255 PUSH 00
0177:0041C257 CALL [004E8B6C]
0177:0041C25D MOV [004C6254],EAX
0177:0041C262 C3 RET

dd 4e8b6c contains 8a5674
u 8a5674 contains the address of user32!LoadBitmapA

So the address from 4e8a88 to 4e8b84 contains address of a routine that jump to user32.dll imports.

I managed to replace all of the address from 4e8a88-4e8b84 with the address of the imports so that it calls directly to the user32 imports then dump again.

Run the dumped file. It runs perfectly. Reboot the system and run again. it runs but when i exit it crushed. i traced that it calls gdi32.dll imports that is were i crushed. i noticed that when icedump is loaded it runs perfectly and all of the imports address are all present that why it runs without problem..

What is icedump doing that this progie runs without problem or am i missing a thing here. Plz help.......................

TIA
DakienDX
09-26-2002, 09:45 AM
Hello BlackBuster !

You might want to search in this Forum for the answer.

It's a new release of ASProtect where the "0" DWords seperating the loaded DLLs have be replaced by some other value.
Therefore you'll find only one big IAT thunk with all imported fuctions from all loaded DLLs.
BlackBuster
09-27-2002, 03:34 AM
Hi DakienDX!

Though, i have never found the thread you're refering to. You've just gave me an idea. Appz is working now. Thanks a lot.
DakienDX
09-27-2002, 10:25 AM
Hello BlackBuster !

The thread I'm refering to isn't very old, only a few days.

You'll find it here (http://www.woodmann.net/forum/showthread.php?threadid=3812).

You also find out how the jump to the OEP is done in the actual version.


G6 ftp tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > G6 ftp tutorial
PDA

View Full Version : G6 ftp tutorial

mambox
09-26-2002, 02:07 PM
Hi,

hope not to be flamed but cant find the tutorial how to unpack asprotect on G6 Ftp by kayaker,some dudes told me its the best tut all included questions can be found but cant find.

even search button bring me on topic but not the tut himself.

can anyone help?

thanks!
TheSearcher
09-26-2002, 02:09 PM
Hi,
Thats the one read it ;)
hobgoblin
09-26-2002, 03:17 PM
Hi there,
Try do a search for "G6 FTP", but without he quotes. Check out the last of the 5 responses you get. That's the thread. (The "tut" you're looking for was written by Kayaker, but it was posted in this thread by clandestiny).
Good luck.:-)

hobgoblin
JMI
09-26-2002, 03:33 PM
Mambox:

hobglobin has given you the help you need. There is no reason why using "G6 FTP" should not have given you the thread you were looking for because it's titled "G6 FTP server." You were apparently confused because it wasn't started by Kayaker and he did not write (directly) the major contents. However, the title of that post suggests that you should have read it carefully and then you would have discovered it was the one you needed.

Also remember that you can search the Forum by "author" and could have found all the posts by Kayaker and checked interesting ones out for content. This one goes back quite a ways so you would have had to look through several pages before getting to the right one. Another hint. If you had used both "G6 FTP" on the left and Kayaker on the right, you would not have found the specific article because Kayaker's post does not contain that specific term. He just comments on Candestiny's report of his tut.

Regards.
mambox
09-26-2002, 05:46 PM
Thanks!

i were confused its not started and author by kayaker as you said.

sorry to appear a bit lame...

get to make one thread of clandestiny type.
i know asprotect topic make angry coz its a simple trick for all of you...

going to study this one now.

bad english sorry :)
esther
09-26-2002, 06:09 PM
All those who didn't bother to search are lame ;)
Thumbs up!
JMI
09-26-2002, 06:19 PM
mambox:

Do not be discouraged if you don't always understand. You are attempting to do something in another language and that requires skills that many do not have. Those who are struggling in a "foreign" language deserve extra patience and assistance. My own efforts and those of the others who posted were only to help you learn better how to search the forum. You did try to search, you just didn't understand how it works.

I suggest that you do the following. Look through many of the posts in the Unpacking Forum. At the bottom of the page you will see a button titled "Show Printable Version." If you click that button you will get the thread without all the unnecessary buttons and things. On the top right there is another button which says "Show all [number] posts from this thread on one page." Click this button and all the posts will be on one page. Download these threads to your harddisk and study them offline when you have time. This will give you a library of ways to unpack various protection systems. Save them in folders by protection type, such as asprotect and the other. When good threads appear with useful tips, save them as well. Eventually you will have your own library.

Asprotect is not simple for anyone who hasn't worked with it a great deal, but you need to remember that there is a lot of information already here. You need only learn how to find it. One way would be to do a search for "asprotect" and/or "aspro" and read and copy all the threads with detailed information.
Regards.

Don't be discouraged. Just keep trying. Remember that your brain is always the most important tool.
mambox
09-26-2002, 06:47 PM
you justify me to continue with those words!

thanks!


IceDump - load?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceDump - load?
PDA

View Full Version : IceDump - load?

BruceLee
09-26-2002, 06:18 PM
Hey!

How load proggie in SoftIce with /load command, it is command in IceDump:

In readme wrote:

/load <address> <length> <proggiename>

??
nofurs
09-26-2002, 06:56 PM
Hi,
below is an example
400000=imagebase
8dfe0=address

/load 400000 8dfe0 progie name
its the same way as dumping a proggie
/pedump 400000 8dfe0 progie name

Hope it helps ;)
BruceLee
09-26-2002, 09:03 PM
I'll try but don't work ...

Thx, anyway!

Bruce Lee
JMI
09-26-2002, 09:34 PM
BruceLee:

Did you use the full path to the proggie name? Such as C:\program files\proggie name? or whatever?? Maybe it is not finding your proggie because the path name is not complete. Give it a shot.

Regards.
DakienDX
09-27-2002, 12:40 AM
Hello BruceLee !

I might have misunderstood you, but are you trying to load a program or just some data?

You can only load some data from disc with the /LOAD command. If you want to load a program or if you want to break at the program's OEP you must use SoftICE Symbol Loader or ICELoad.


revirgin IAT tracer fail
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > revirgin IAT tracer fail
PDA

View Full Version : revirgin IAT tracer fail

Rainor
09-26-2002, 10:45 PM
i'm working in a telock packed target.
Look like revirgin miss some kind of API redirections, if someone had interest i can post the code snipped here.
Also TELOCK detect revirgin tracer, i had to install the old Win98, and use ICEDUMP tracex protect commands to found the original OEP.

another question (maybe lame)
how i break in the proggy adress space??, in WIN98 i get the windows handle with hwnd , put a breakpoint and after the break in user.dll hit a few times F12 until i land in proggy code.
In win2000 hwnd only give a 32bits addres (no selector).

Btw look like the best OS for cracking is Win98 coz , most of antisoftice tools, tracer , unpacker work fine here.

R


annoying bug of SoftICE Symbol Loader :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > annoying bug of SoftICE Symbol Loader :(
PDA

View Full Version : annoying bug of SoftICE Symbol Loader :(

Solomon
09-27-2002, 05:57 AM
Sometimes I need to translate a *.TDS(Turbo Debugger Symbols) to *.NMS, but when I use SoftICE Symbol Loader to open the *.tds file, it complains "not supported file type". I have to reboot and re-load and translate it, this time it works.

This bug exists in DriverStudio v2.6/2.7.

Any comments?

:( :mad:
Solomon
10-11-2002, 02:51 AM
found a way to avoid this bug.
Just use the command line utility NMSYM.EXE to translate *.TDS to *.NMS.


Softice for NT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice for NT
PDA

View Full Version : Softice for NT

Uradox
09-27-2002, 02:54 PM
Just something that i brought up today and found many other users of softice for NT (weither it DS or not) have the same problem
The Win2k (i believe same for XP) bootscreen no longer is displayed.
This is somewhat of a anoyance cause you cannot see scandisk either.
Is this a generic bug thats been passed down from generation? And is there a way to fix it

Thanks

Uradox


16-bit packed file - How to identify packer?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 16-bit packed file - How to identify packer?
PDA

View Full Version : 16-bit packed file - How to identify packer?

squidge
09-27-2002, 11:15 PM
I've got a 16-bit DOS-based program that's been packed with an unknown packer. The file is an EXE at about 5kb. I've noticed that the filename is copied into the file itself at position 0x200, prefixed by the letters "bm". The strings used inside the program are easily readable, and I've noticed the string "Packed file is corrupt" near the end of the file.

The header of the file is as follows (starting from the "MZ" header signature) : (all hex) 4D 5A D6 01 0A 00 00 00 20 00 5C 01 FF FF 1A 02 80 00 00 00 10 00 FD 00 1E 00 00 00 01 and the rest of the bytes are 0x00 upto 0x1FF.

From the information - does anyone have any idea to packer used? There are some other files in the same directory that are protected with CopyControl and compressed in the same way, so I'm wondering if this is some kind of shell around the program. However, this particular compressed file doesn't care whether or not the protection exists or is valid.

It seems that, from various strings in the executable, that the original compiler was Borland C 4.5 (It requires BRUN45.EXE to run)

I've tried to run CCLOOK on the programs, but it just returns no results, saying there's no copycontrolled programs on the disk. The program itself has a copyright of 2002. It can not be downloaded from the net, only bought via mail order.
Kayaker
09-28-2002, 12:17 AM
Hi Squidge

Anything DOS packer related I usually head over to Exelist at
http://groups.yahoo.com/group/exelist/messages/

There's a couple of things from there you might want to check out

ROSE SWE UnPaCKER PaCKaGE by Ralph Roth
http://come.to/rose_swe

and the Typ 2002 file recognition/ archive lister/ compiler detection proggy typ_d32.arj
http://www-user.tu-cottbus.de/~kannegv/programm/typ_d32.arj
or
http://www-user.tu-cottbus.de/~kannegv/programm/index_e.htm

I haven't had occasion to use either one of them but they might be able to detect the packer/wrapper, if not, someone on that forum might be able to help.

Kayaker
DakienDX
09-28-2002, 09:32 AM
Hello squidge !

The EXE is not packed. It was only linked with LINK /EXEPACK, so the relocations are stripped off the EXE and are "compressed" at the end of the EXE to save disc space. When you run the file it relocates itself.

The signature "bmFILENAME" is not used in C programs. BRUN45.EXE is the "Quick Basic/DOS" runtime library, so it's no C program but a BASIC program.

If you had a CopyControl protected DOS EXE, you would have seen it with CCLOOK.

The "MZ"-header of a DOS EXE is the same as the "MZ"-header of a PE file (expect value at 3Ch) and uninteresting to indentify a packer.
Snatch
09-28-2002, 04:38 PM
There can be a fine line in some cases with compression vs packing. I have never really seen any formal definitions. Compression is a form of protection. Cracking groups hate it also because they generally cannot release a patch but instead must release the whole exe patched which is a lot larger ;). Unless they can code specific unpacker logic into the crack program. Since you have a DOS Basic program(boy do I remember the good old days of BASIC PDS 7.1) I recommend checking out this site made by DoDi the maker of the vb decompilers.: http://members.aol.com/vbdis/ He decided to start working on older basic. However I havent seen a formal decompiler yet but it is possible and actually should not be that difficult. Should be easier than VB. Basic compiler can compile with a dependency the runtime or it can link the runtime in staticly but either way it is interpreted code not native.

Snatch
squidge
09-28-2002, 08:00 PM
Thanks for the replies, I think therefore the best approach would be to try and track down a version of Quick Basic and the compiler and see if I can (manually or by writing a program) decompile any of the programs. I may then be able to release my own decompiler.

Looking at the code again with IDA, it certainly seems like an executable stub, followed by a lot of unknown data, which I assume would be the tokenised code to interpret.
Snatch
09-29-2002, 04:51 AM
Sounds like BASIC. Visual Basic actually is very quick cut it simply pushes the main program structure on the stack and calls ThunRTMain of the VB Virtual Machine which then takes care of the rest of the loading. But in old BASIC its got to do a lot more work like loading the dependency file or if its staticly linked then the loading code is all in the program. It is not even in the same ballpark as VB decompilation though and frankly I dont see why there hasnt been a decompiler for it yet. Take a look at that web page he has a useful utility on there. Of course you may need to translate the German but thats what babelfish is for ;).

Snatch
DakienDX
09-29-2002, 09:52 AM
Hello Snatch !

The program is not packed nor compressed. I put "compressed" in double-quotes to show that it is really not like that.

The relocation "compression" works after a simple idea.
What takes less space?
?? DWords
1 DWord followed by ?? WordsI think the answer is clear. ;)
(assuming you have more than 1 relocation)
squidge
09-29-2002, 12:49 PM
I managed to find QuickBasic, and the compiler and help files, and it seems EXEPACK does more than simple compression of the relocation part. According to the documentation, it also does Microsoft's most famous compression - RLE, compressing runs of the same byte. This certainly seems to hold true as I've managed to decompress the file and put the reloc info back in it and there's a lot more nulls now than there was before. The program still runs as a bonus too :)

Now that the first program is in a state to be decompiled, I turned my attention to the second and last. This seems to be the same compression, but with some kind of encryption applied over the top. There's no "bm<Filename>" at address 0x200, although I have figured out that If I take the bytes at 0x200, and then XOR them each by 0xD5, the result is "bl<Filename>". Considering that the code at the program entry point is completely different than normal, I'm assuming this is some kind of wrapper than an manual attempt at disguising the program.

So now this is becoming more of a challenge - I've got to strip the encryption from the program before I can decompress and reloc it, and get it ready for decompilation.

If any wants to have a look at the program, I'll happily email it to them (It's 54.9Kb).
squidge
09-29-2002, 05:49 PM
Ok, I got a version of CopyControl from MicroCosm and played with it for a while. It seems the encryption on the second file is actually the copycontrol shell. It seemed like nothing more than simple XOR encryption by 0xD5. Wrote a little C program to decrypt it, and now it's decrypted, decompressed and ready to be decompiled like the first file. Cool thing is, it still works and no longer depends on the token being on the HD in order to function :)

No idea why CCLOOK didn't find it, unless I was using an out of date version (3.03 - last version you can download without a user/pass combo).

Thanks for the help people - and if anyone wants to help me on the quest of designing a QuickBasic decompiler, let me know. I have seen them for download, but the authors wanted £500 upwards before they would send them :(
Snatch
09-29-2002, 10:34 PM
That is a clever way to compress relocations never thought of that ;).

As far as your compression goes why not try something like TEU it is very good at unpacking. If at that point its not unpacked then maybe the strings are encrypted within the program as in youve unpacked it as much as you can. I remember trying to crack old Sierra games. I gave up every time. They had an interpreter and data files. The data files contained the entire game but unfortunately I had no way of reading or changing them. And reversing their entire interpreter would have been a lot of work. That protection was truly brilliant though. And it made it easier for them to code the game too. Too bad when Sierras games went to Windows they couldnt keep that up. Look at Half-Life theres more crazy patches and things for it then most games ;). Though most of those are hooks on OpenGL since its pretty open to exploitation.

Snatch


Iceload not breaking on entry...?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Iceload not breaking on entry...?
PDA

View Full Version : Iceload not breaking on entry...?

triz-
09-28-2002, 03:26 AM
(First off, I just wanted to give a quick thanks to anyone who replied to my thread a few months back about ASP*****t, especially Splaj, who was kind enough to e-mail me a few things about the program I was looking at. I didn't want to come back asking for help about something without giving my thanks first :) )

Anyway, I recently had to reformat the old HD. After reinstalling good old Windows 98 SE (I'll upgrade...one of these years...), I reinstalled Softice 4.05, Icedump and Iceload. Copied NMTRANS.DLL to Iceload directory, loaded Icedump/load and tried running a program with it...BSOD :eek: OK, that's weird. Reboot, and again, same thing. :mad: Uninstall SI, install DriverStudio (with SI 4.2.7 build 562), run appropriate Icedump, run Iceload, load an ASP*****ted proggy, crossed my fingers and ran - program runs without breaking. Tried again, same thing. Loaded good old Notepad (why is Notepad used as a target for everything, vile or benign?) and ran - loaded without breaking. :mad: Even the normal Symbol Loader itself won't break on anything.

:confused: Anyone here have any clue why this might be happening? Iceload worked just fine before I formatted, and I don't recall anything special I did to get it to work.
Kayaker
09-28-2002, 05:45 AM
Shhhhh, don't tell anyone, but I think you can say 'Asprotect' here, the mods aren't that anal :p

But seriously, just to take a step back and simplify things a bit... You said you copied NMTRANS.DLL to the Iceload directory, loaded Icedump /load and tried running a program with it and got a BSOD. Maybe you meant something else, but I don't understand why you were using Icedump's /load command at all. Then you installed DriverStudio and added even more variables to the problem.

You may have tried this but I'm wondering what your results are with the *very* simplest situation, Win98SE + Softice 4.05 + the vile yet benign Notepad, either with the SI loader or with IceLoad, but without Icedump loaded. If IceLoad did its job then you should see the 'WinICE Notified' message meaning the appropriate flag for a WinMain break has been set in winice.exe. If that combination still doesn't break at the program start then we can eliminate Icedump and DriverStudio from the equation. The next question might be does Softice break at all on APIs and is your reinstalled winice.dat still OK? Maybe you could recheck these things and report back.

Kayaker
DakienDX
09-28-2002, 09:12 AM
Hello triz- !

I have the same problem with ICEDump 6.0.2.6. It simply gives me a BSOD when I try to load any protected or unprotected executable with SoftICE 4.05 on Win98. This happens both with ICELoad or SoftICE Symbol Loader.

So I'm using ICEDump 6.0.2.5 and have no problems. You should try the previous version too, it should work.
bsod
10-06-2002, 09:32 PM
Hi triz,

well, it happens that I *just* upgraded from DS 4.2.6 to 4.2.7, due to the final, working release of icedump 6.026, and i have the very same problem :(. Load a programm into symbol loader, run, and no break, although the "Break on WinMain" etc. is enabled.
I then tried to load some DOS executable via dldr.exe, and surprise, surprise, it breaks at EP, and also the 16bit wldr.exe makes SoftICE pop up at correct EP of 16bit windows application.
But the funny thing is, when loading a 32bit program, this time with debug information, in symbol loader, it breaks! Seems that the "Break on WinMain" has become what it sais literally: it breaks just when there's actually something called "WinMain", "_main",... but not on plain entry points anymore.
Probably NuMega wants to make cracker's life a little harder..

bye

PS. this sucks! :eek:
Snatch
10-07-2002, 04:18 AM
Very interesting bsod! Maybe if we make a tool to make a symbol file with the name WinMain at the EP of the target program we can restore the functionality ;). Or maybe we can disassemble ntice and patch it so it doesnt require a symbol there. After all it is called the "symbol loader"

Snatch
bsod
10-10-2002, 09:34 PM
doh.. had to reinstall windows so i couldnt check earlier..
when loading nms file with WinMain symbol, it breaks.
hm would be nice if it was possible to find a way to patch the winice.vxd.. i'll try but i doubt i'll succeed ;)

bye
toteu
10-11-2002, 10:40 PM
This should get you started:

nmtrans!NmSymLoadExecutableEx
nmtrans!DEVIO_SetWLDRBreak
- this one sets the (BPM type) breakpoint
via DeviceIOControl 0x9c40601c
find related code in ntice.sys

PS:
Indeed having nms loaded on XP with DS 2.7 it breaks
Just tested now.(with _WinMain it breaks)
naides
10-12-2002, 05:36 AM
Based on what Kayaker wrote in another posting, he is working on a solution for Sice 4.27 breaking at the entry point again, like in the good ol' days. I have been using a temporary solution, while the l33t come with a more elegant fix: I edit the exe file in question, and change the entry point byte, which 99.9% of the time is '55': push ebp to 'CC': int 3.
Now I place a bpint 3 in softIce and viola, SIce breaks at the entry point. I then reset the first byte of the code to '55' and go my merry way.

Once inside the memory space of the app, setting breakpoints on common use API starts working again.

I am aware I may just have invented the wheel, but hey, if it works. . .
Kayaker
10-12-2002, 05:53 AM
Just to mention...LordPE Break'nEnter + BPINT3 does that really nice too (racing tire?) ;-)


Here is the SuperBPM for WinNT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Here is the SuperBPM for WinNT
PDA

View Full Version : Here is the SuperBPM for WinNT

Solomon
09-28-2002, 04:36 AM
a Chinese guy wrote this tool.
Solomon
10-02-2002, 03:10 PM
Has anyone reversed it?

It's written with DriverWorks. Seems to hook NtContinue/RtlUnwind etc.
SiNTAX
10-03-2002, 01:39 PM
Euhm stupid question maybe, but what is it supposed to do?!

Had a quick search and found:

---
SuperBPM by EliCZ. 26.V.1999.
SuperBPM (2K).

Sometimes your breakpoints can be (BPM, BPIO -h, G, HERE, P, P RET) ignored. With SuperBPM everything is all super, zuprgut.
---

But I've not had any problems with breakpoints not working on my XP setup.
squidge
10-03-2002, 01:53 PM
From the docs:

Purpose
-------
Sometimes can be Your breakpoints (BPM, BPIO -h, G, HERE, P, P RET) ignored.
With SuperBPM is all super, zuprgut.
(This is basic version. The full version will be released after I feel it's
needed.)
Test
----
- Run SuperBPM, enable Erase.
- Load CodeSafe.exe (v3.1, size 546304) into NuMega SoftICE, G 4168E0
- Load CodeSafe into LiuTaoTao's TRW, BPM 4168E0 X, G
^DAEMON^
10-04-2002, 02:43 PM
hmmm the question is : WHO needs that ?
latest sice recovers breakpoints on it's own
Solomon
10-05-2002, 09:19 AM
Really? I will check it.
Did ECliZ release SuperBPM for WinNT/2K a long time ago? Sorry I don't know. :)

Originally posted by ^DAEMON^
hmmm the question is : WHO needs that ?
latest sice recovers breakpoints on it's own
evaluator
10-05-2002, 05:09 PM
DAEMON!

>>latest sice recovers breakpoints on it's own

Hey! this means, it will work as you have ALWAYs loaded SuperBPM!???

So tElock & other like protections will ALWAYS crash under NTICE!?

Or there is some FANTASTIC scheme of recovery???
^DAEMON^
10-05-2002, 05:11 PM
no they won't crash...
elicz just informed me that it "recovers" @ least bpm's

(cause he tested it on messbpm)

^DAEMON^
evaluator
10-05-2002, 06:16 PM
DAEMON!

You talk strange things!
I already discuss about BPM, not about BPX!
Or you don't know, how works tElock's BPM scheme!?
^DAEMON^
10-07-2002, 04:19 PM
heh, evu... calm down... take a look @ messbpm... then come back (telock is more or less using messbpm's "tech"... debug exceptions)

take messbpm and set a BPM ExitProcess X
and run it... u'll see

^DAEMON^
evaluator
10-07-2002, 05:19 PM
DEARRRR DAEMON!

1. Run SuperBPM for W9x, turn on flag "ERASE" & then run telocked-exe
Happens: "CRC error!"

2. Run chinese SuperBPM on XP. Then run telocked-exe.
Happens: "CRC error!"

You can contact tE for explanation!!!

>..easy..
>..heh..
^DAEMON^
10-08-2002, 03:33 PM
seems u don't know much about exceptions...
debug exceptions can't be emulated neither by superbpm nor by pbpm

these exception HAVE to occour
^DAEMON^
SiNTAX
10-08-2002, 03:46 PM
Originally posted by ^DAEMON^
seems u don't know much about exceptions...
debug exceptions can't be emulated neither by superbpm nor by pbpm

these exception HAVE to occour
^DAEMON^

EVERYTHING can be emulated :)
evaluator
10-08-2002, 07:39 PM
DAEMON!
Finally you UNDERSTAND me!!!

NOW back to my QUESTION:
>IF latest sice recovers breakpoints on it's own,
SO tElock's scheme will crash or no!?

You need just practically test this on newest NTice.
^DAEMON^
10-09-2002, 04:13 PM
heh... well "crash" is not correct...(crc won't be correct) sice cannot handle this...

ds2.7 has just something like pbpm already included...

^DAEMON^


Destruction of Listbox Hscroll?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Destruction of Listbox Hscroll?!
PDA

View Full Version : Destruction of Listbox Hscroll?!

Manko
09-29-2002, 09:11 AM
In the resources this particular Listbox has both VScroll and HScroll but when I use the program it doesn't have the Hscroll.
I am guessing it destroys it, or it doesnt include it if it's just a template. I have no idea what the code for this would look like.
How does one go about dostroying/adding HScroll on an existing dialog?

/Manko
comrade
09-29-2002, 04:17 PM
ListBox WS_HSCROLL is not automatically added, and program should manually tell the listbox the extent of the horizontal scrollbar. Probably that style was just a mistake by the programmers.
Kayaker
09-29-2002, 05:30 PM
Hi

I have a feeling this is a bit of a bug with listboxes, or maybe it's by design, the vertical scroll seems automatic but the horizontal scroll needs to be controlled by the LB_SETHORIZONTALEXTENT message.

An application sends an LB_SETHORIZONTALEXTENT message to set the width, in pixels, by which a list box can be scrolled horizontally (the scrollable width). If the width of the list box is smaller than this value, the horizontal scroll bar horizontally scrolls items in the list box. If the width of the list box is equal to or greater than this value, the horizontal scroll bar is hidden. To respond to the LB_SETHORIZONTALEXTENT message, the list box must have been defined with the WS_HSCROLL style.

I've seen the same thing in the APISpy32 input and output dialog boxes for example - even if the text is wider than the listbox, the HScrollbar doesn't appear. One solution might be to patch in a SendMessage call to the dialog box with LB_SETHORIZONTALEXTENT, and wParam set to a small width (or maybe the width of the listbox), then the scrollbar should appear. The easiest solution to the main problem however, if it was feasible, might be to increase the width of the dialog box, and then increase the width of the listbox so the majority of the text wasn't cut off. This is what I did (via a resource editor) with APISpy32 because I was so annoyed with the tiny size of the output dialog.

Kayaker
Manko
09-29-2002, 10:59 PM
Originally posted by Kayaker
Hi

I have a feeling this is a bit of a bug with listboxes, or maybe it's by design, the vertical scroll seems automatic but the horizontal scroll needs to be controlled by the LB_SETHORIZONTALEXTENT message.

I've seen the same thing in the APISpy32 input and output dialog boxes for example - even if the text is wider than the listbox, the HScrollbar doesn't appear. One solution might be to patch in a SendMessage call to the dialog box with LB_SETHORIZONTALEXTENT, and wParam set to a small width (or maybe the width of the listbox), then the scrollbar should appear. The easiest solution to the main problem however, if it was feasible, might be to increase the width of the dialog box, and then increase the width of the listbox so the majority of the text wasn't cut off. This is what I did (via a resource editor) with APISpy32 because I was so annoyed with the tiny size of the output dialog.

Kayaker

Yup, ApiSpy32... :)

Actually, I did it the same way but often the params extend beyond the maximum new width.
It felt like a quick and dirty fix rather than a proper reverseing.
I suspected the author had done something tricky, a newbie such as myself wouldn't understand.

'Tis why I'm at it again... :)

Thanks alot for the help! It seems it would work. :)

It should be pretty straightforward, including a large LB_SETHORIZONTALEXTENT somewhere...

Oh, well... not tonight, anyway... :)

Thanks again!

/Manko
Snatch
09-29-2002, 11:25 PM
Well you might first go to a resource viewer and find the listbox and see its styles assuming its static(ya im a dynamic freak I dont like having fixed resources ;)). Anyway then you can search with IDA for immediate values of LM_XXX. This works well. You will land near or in the message handler. If it is MFC or whatever then you just need to find the rdata pointer table for the CListBox. You have lots of options in disassembly to figure out what is going on. Just have WinUser.h ready to look up the ListBox message or style numeric values.

Snatch


SoftICE virgin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE virgin
PDA

View Full Version : SoftICE virgin

toonboy
09-29-2002, 10:07 AM
I am new to this reverse engineering lark and am having problems getting to grips with SoftICE. I am using SI via DriverStudio 2.6 under XP.

My target is a CrackMe from one of the forums. The CrackMe is built with no debug info so I used IDA pro to get a MAP file which I subsequently use to produce a NMS symbol file using Util16/nsym.exe and mnsym.exe

The EXE uses MSVBVM60.DLL, so I load this as an export into Symbol Loader. I also open and load CrackMe.NMS, which appears to be successfully read by SL - this is comfirmed when I enter "sym" in SI command window.

I then insert the following breakpoint, "bpx msvbvm60!rtcmessagebox", as directed by the CrackMe help text. Again, this is accepted without error.

Finally I open and load the EXE in SL (module settings, debugging: load executable, translation: publics only). SL gives the following translation Error "No debug info ..", but carries on and runs the application.

However, IT DOESN'T BREAK !

What am I doing wrong ?
Solomon
09-29-2002, 10:25 AM
you are not wrong, it's a bug of Compuware.

Originally posted by toonboy
However, IT DOESN'T BREAK !
What am I doing wrong ? [/B]
toonboy
09-29-2002, 11:04 AM
Is there a workaround for the bug ?
naides
09-29-2002, 08:51 PM
Toonboy.

Do a search in the board using 'XP' and 'driverstudio 2.6'. You will see that SIce has quite an unpredictable behavoir in XP.
The solution to the 'bug' may be DSv2.7.
_Servil_
10-01-2002, 06:59 PM
I had never luck with ice on xp, ds27 is even freezing the system, always when I start the service. i've given up and keep it installed on win98 which seems imo generally better for debugging sessions.
Solomon
10-02-2002, 03:08 PM
No, DS 2.7 still has this "NO break" bug.

Originally posted by naides
The solution to the 'bug' may be DSv2.7. [/B]
toteu
10-06-2002, 09:12 PM
This works for me:SICE + W2K SP0/1/2
Loader32 2.6.0 (build 336)

File/Open/EXE file
Module/Settings/Debugging/Load Executable (even it is already selected on the interface, just select ii once again and Apply)
make sure Stop at WinMain etc. is checked
Module/Load and all works flawlessly...

Please let me know if it works for you.This should work for 2.7 too.

Regards,
toteu
Local
10-07-2002, 01:08 AM
I also had a lot of trouble with SoftIce in XP, so I decided to go dual boot, keeping XP and installing 2000 on a partition. It took a lot of effort, as Windows XP doesn't want to let you install 2000. (I only have one harddrive). I had to boot up to MS-DOS (I used a boot disk, but if your 2000 cd is bootable you're set) and installed 2000 on a partition. Then I had to boot up with the XP install disk and go into the Recovery Console to fix the MBR. Here's what you have to do:
-FIXBOOT ;Fixes the mbr
-cd .. ; changes dir to c:\

-attrib -h ntldr
-attrib -r ntldr
-attrib -s ntldr
-copy D:\i386\ntldr C:\ ;copy a good version of ntldr from the XP install cd to XP partition

-attrib -h ntdetect.com
-attrib -r ntdetect.com
-attrib -s ntdetect.com
-copy D:\i386\ntdetect.com c:\ ;copy a good version of ntdetect from the XP install cd.

Then I had to install SoftIce for NT on my 2000 partition. I also had to add \noguiboot to the reference to the 2000 install in c:\boot.ini on the XP partition.

Hope that helps you get started.
MTB
10-07-2002, 02:06 AM
Local

I recommend a product called "System commander" it allows the loading of multiple operating systems on a single hard drive. The most important feature is it can help you fix stuff when you wipe out a portion of the operating system, but that would never happen to anyone we know? This is a lot easier than using the microsoft boot manager which works some of the time, but not all of the time. SC even lets you use Linux.

There are free ware versions of this and similar programs, you can try hxxp://www.cnet.com for help, look under software downloads.

MTB
Nobody
10-10-2002, 04:32 PM
I have the "No break" problem in XP for DS2.6 .
After install DS2.7 , it work normal now .
You should look for the error message show on SI after initialize
the net start ntice service .
There are some API hook failuar message there .
I search google and find someone request the ntice.sys from compuware to fix the bugs. He mention the bugs coming from the XP patch.


Hardware ID based serial number
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hardware ID based serial number
PDA

View Full Version : Hardware ID based serial number

wonderwoman
09-29-2002, 01:45 PM
Can somebody please help me, I am trying to crack a serial number for a program. The serial number uses a hardware ID so it changes from computer to computer. WOuld it bepossible to lock the hardware ID so it does not change as I have a serial number for 1 computer. It appears that the password is binary based and is therefore like trying to find a needle in a haystack.

Can anybody please help me

wonderwoman:confused:
esther
09-29-2002, 03:26 PM
*sigh* crack request again
wonderwoman
09-29-2002, 04:09 PM
what are you talking about "crack request" I have no intentions of requesting cracks I am only after help in order to do it my self. You would not be able to get the program anyway

Any USEFUL comments would be very welcome

Thanks

Wonderwoman
esther
09-29-2002, 04:16 PM
Did ya read the FAQ?
What tools are ya using?
where are ya stuck?
Show some code and effort and ppl will help
wonderwoman
09-29-2002, 04:33 PM
Yes I have read the FAQ (maybe I could of been a bit more specific)

I am using SI with frogice to stop SI being detected.

I am geting to the password screen and using hmemcpy as a breakpoint to gain access into the code.

I can usually crack this type of protection by looking through the code for were the password you entered is compared to the actual password (serial fishing) but I have never come accross the protection were the password is locked to your computer using hardware ID.

Also can the programmer use the password in binary format so it will just display meanless letters were you are trying to display the memory location output.

Sorry for any misunderstanding

WonderWoman
esther
09-29-2002, 04:38 PM
Hiya,
Thank you for respecting the board.
Try Bpx Getvolumeinformationa it might help.

Best regards
Nigma
09-29-2002, 08:53 PM
Well , a hardware ID is actually a string when we talk
about keygens . try to find in the reg routine when
this string is first used , at this point jmp to somewhere
else in the proggie's code ( like inline patch ) and change
the string to some uniqe hardware ID , for example your hardware ID ! so there is ONLY ONE HARDWARE ID so you
will need just one key to distribute.
wonderwoman
09-29-2002, 09:15 PM
Thanks esther and nigma

Would it be possible to change the string in the the reg file, as I have got 1 computer were the program works and i am tring to duplicate the string on the other computer so the 2 computers have the same ID. I have used regmon to try and locate the string but upto now it has been pretty ellusive.

WonderWoman
disavowed
09-29-2002, 09:18 PM
Originally posted by wonderwoman
You would not be able to get the program anyway
don't count on it ;)
Woodmann
09-29-2002, 10:11 PM
Disa......:eek:

;)

Peace, Woodmann
Snatch
09-29-2002, 10:37 PM
I have come across this type of program before and its a royal pain. Most likely though all you have to do is patch one jump where it does the compare unless of course it stores other information like what kind of user you are etc. Often patching in these cases would require more work than its worth. I would definetly go for a keygen. You can get the hardware ID I imagine from the registry so just input that into the keygen and have it generate valid keys. The algorithm should not be hard to find. Disassemble it and see if IDA gives you library functions that can make life much easier.

Snatch
Clandestiny
09-30-2002, 02:48 AM
Hiya,

Without knowing the name of your target and without benefit of any code, it is difficult to give *specific* advice... With that said, have you considered running an API monitor? Its very probable that the prog is using a standard windows API to obtain the hardware specific info (ie. like GetvolumeinformationA which Esther suggested). You should be able to pick out suspicous function calls from your log and then you can look them up in your API reference. Alternatively, you could study the list of imports from your disassembly, but IMO the real-time API log will give you less "noise" to sift through in looking for your function. If you need more specific help, I'm afraid you'll have to provide more specifics about what you've tried, some code where you think the serial is calculated....ect.

Cheers,
Clandestiny
tgodd
09-30-2002, 03:46 AM
Try using a disk editor and edit the Primary Drives MBR to have the same serial number as the drive the software is currently working on.
tgodd
09-30-2002, 03:52 AM
It is also possible that the software is uding the hardware MAC address of your nic card.
cyberheg
09-30-2002, 07:51 AM
I was wondering... There was a time when Intel introduced their cpu serial thing. I wonder if it's possible to get hold of via software or you need to enable it before it gets availble. Maybe some of you guys messed around with it before. Today it's common to use serial of the formated partition but as you guys pointed out allready it's easy to exploit and change using a diskeditor for your own needs.

// CyberHeg
DakienDX
09-30-2002, 08:41 AM
Hello tgodd !

I'm sure you don't think of the HDs MBR, else you must be mistaken.
No serial number is stored in the MBR, only the partition boot sector loader.

Hello cyberheg !

Only the P3 had a serial number. It was always activated and if you didn't like it you had to run an Intel program every time you restarted your computer to disable reading the serial until the next reboot. Some weeks after the P3 was out the first magazines found ways to enable the serial again without rebooting.

Since the endusers weren't very happy that they were "unique" users, Intel decided to drop the CPUs with serial number again.
cHeCksUm
09-30-2002, 10:23 AM
Hello,
Thought I might give some general advice. I cracked a program that uses the same type of scheme (i.e. hardware based; program Legato Networker Solaris/Windows if your wondering.) What I found there was that it was really annoying (read hard) tracing around the code to find the serial routine (it uses like twenty different exe's; and all do specific stuff... (talk about unix prog. port ;) ) and it has multiple codes. Anyhow in the end the easiest way to crack it was by simply cracking the compare routine. However I still go back to that target now and again to see if I can make a keygen for it. An idea would be to find the DLL it uses to check the serial and (if possible... speculating here) write a "custom" keygen which utilizes their own DLL to create a valid serial. Another approach is to find the part which generates the hostid and simply make it the same as your other machine either by:
a.) modifying the generation routine
b.) having it not generate but set it rather.
Well as I am myself a newbie this is all the advice I can give. Hope it maybe gave you some ideas of how to attack it.

// cHeCksUm
wonderwoman
09-30-2002, 10:49 AM
I know exactly what you mean checksum I spent 12hrs yesterday searching through the code for the right compare and I am still yet to find it. I used the getwindowtexta breakpoint and searched high and low for the correct compare statement. Is it possible as I know the serial is 11 sets of 4 number (12c4-1221.....) that the serial number will not show up as it is stored in hex. I also think that each set of 4 numbers are compared seperatly and there is eleven of them. I think I am a bit out of my depth with this program as I do not have a great deal of experience, I have cracked simple serial protection but his is another level. I do know it uses the getvolumeinformationa to get the hardware ID, but I have got no chance of patching the hardware ID. I will check to see if it uses the partition ID it may well do.

The program is called winserver but it is not avaiable to download off the internet, it is not commercially available

Thanks everyone for your posts,

wonderwoman
cyberheg
09-30-2002, 10:50 AM
Thanks for the info DakienDX. I read a few weeks ago that the next version of Intels cpu's will include digital certificates which should be even worse then those serials numbers.

This is probably offtopic for this thread though.

// CyberHeg
Lord_Soth
09-30-2002, 10:52 AM
I've come accross a protection that is even worse.
I can't really get into any specifics but it profiles your
system and that is used to generate a keyfile (the generation part is done at the company's side).
bitchin'

hehe
tgodd
09-30-2002, 02:34 PM
You are so correct DaikenDX;

My slip.
wonderwoman
09-30-2002, 02:48 PM
Can anyone please point me in he direction of a good tut on this subject (serial crack which uses Hardware ID) I have looked high low and cannot find anything, I feel as though I am banging my head against a brick wall.

:p WonderWoman :p
Snatch
10-01-2002, 12:23 AM
Bottom line is the hardware ID you are seeing could be any number of things. Look at the one Microsoft makes! Hashes together all kinds of things to try to make it as unique as it can. The P3 serial might or might not be in there. It could check if the P3 serial is a available if it isnt it stores one value and if it is it stores the actual serial value hashed etc. Theres infinite possibilities of what could have been done. You need to use API spies and see if theres any hardware function or special CPU instructions CPUID for one being executed. Chances are everything is done in one routine.

Snatch
UrgeOverKill
10-05-2002, 03:27 AM
Originally posted by wonderwoman
Can anyone please point me in he direction of a good tut on this subject (serial crack which uses Hardware ID) I have looked high low and cannot find anything, I feel as though I am banging my head against a brick wall.

:p WonderWoman :p

you might try Snakes home page. It was up a while ago, kinda dated but good place to start.
fjrp2
10-07-2002, 05:24 PM
Hi wonderwoman,

I read a very nice article about hardware-checking routines (related to the new Fritz technology) that it might help you.
I'm going to search it and I'll post you the link tomorrow.

It was like an ISP provider that also offered 'resorces' to 'abonate' lusers, I mean users.
Then i'd remotelly check for some hardware info in the client and either let him download/use/etc or not.

It was nicely explained, with an example.

(Btw, nice to see more girls here :) )
esther
10-08-2002, 02:03 AM
(Btw, nice to see more girls here :) ) [/B][/QUOTE]

Zen-Cracking? :D ;)
Kayaker
10-08-2002, 04:27 AM
Originally posted by esther
(Btw, nice to see more girls here :) )

Zen-Cracking? :D ;)

LOL, good point
But welcome anyway if Zen is correct :cool:

Kayaker
fjrp2
10-08-2002, 06:29 PM
Hi wonderwoman,
as promised I'm attaching here the doc.
It's incredible how much it reminds me of some old 'dongles' (the boasting I mean): "Impossible to crack", "the ultimate anti-pirating gizmo", "it would take 10,000,000 years to find the correct password"... ;)
That's the pdf.
And if you visit their page you have there some more info PLUS a complete explanation of how they hacked Windows XP hardware-checking routine.

Hope it helps.
(Now, how about a date?)

[EDIT]Hi wonderwoman,
the .pdf was too big to download (it's 140.985 bytes long), so I just copyed the first page, and let you search for it ;)
Js
10-08-2002, 08:15 PM
fjrp2 you smoothie, how do you know ww is a girl?, esther has been around for years and I though he was a woman till recently. Guess if ww is not a girl your request should be in the "peverse engineering forum" :-)
fjrp2
10-10-2002, 04:27 PM
Hi Js,

I know, but you gotta try first.
I also use the reversing approach with it ;)
hobferret
10-19-2002, 10:54 AM
Hi there, I have come across something like this a long time ago. In the end I found that a bpx VarBstrCmp gave the answer!:p

BTW just been down to Corona looking for more aliens!!!


icedump 6.026 final working
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icedump 6.026 final working
PDA

View Full Version : icedump 6.026 final working

bsod
09-29-2002, 10:56 PM
well, at least for me, the crashes when trying to load a program are gone (running Win98SE) :)
sadly, this seems to be the last icedump we'll see in the near future.
anyway, big regards to the owl and g-rom (and all others ;) for taking time to fix this final release.

regards,
bsod
Snatch
09-29-2002, 11:28 PM
I was just going to post that. Thanks for stealing my thunder ;). According to them it was an NASM bug.

The Owl said and I quote
"and this time tested too ;P, thanks to G-RoM for both. lesson learnt, don't use latest version of your tools for building stable releases ;-). at least we have a test case to reproduce a nasm bug, yet another thing to fix... "

And the IceDump homepage contains:
"UPDATE: apparently nasm 0.98.35 is not stable yet, please redownload icedump if you got it before 2002.09.29 18:45 GMT "

So everyone go redownload and throw away your old versions finally a stable release. Though I had some luck with it before. I think extending the functionality of IceDump is in order too I was thinking of something with MSRs.

Snatch
DakienDX
09-30-2002, 12:56 PM
Hello bsod !

Now it works fine, even for me. :)

It's a good feeling to see that your own source code works and the compiler/assembler you're using is responsible for your program crashes, not you.
username
09-30-2002, 04:04 PM
Originally posted by Snatch
I think extending the functionality of IceDump is in order too I was thinking of something with MSRs.
Do you mean something beyond /RDMSR and /WRMSR or the native MSR in DS 2.7?


Mechwarrior4 keeps detecting Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Mechwarrior4 keeps detecting Softice
PDA

View Full Version : Mechwarrior4 keeps detecting Softice

Nick
09-30-2002, 07:30 PM
I have WinXP SP1, and am using Softice 4.05 NT with the XP patch. I am new to Softice but am eager to learn it.

I want to run Mechwarrior4 and Softice at the same time but Mech4 keeps detecting Softice and then closes itself. I tried using that FrogsIce clone called "NT ALL 0.6" but this still doesn't work.

If anyone can find a solution to getting Softice running with Mechwarrior4 it would be much appreciated.

Thanks :)
DakienDX
09-30-2002, 10:13 PM
Hello Nick !

Don't you care about reading manuals or FAQs?

If you know that a tool named FrogsICE exists, you must have tested it and found out that it doesn't work on NT based systems. It contains a file called Code.txt where all ways it prevents SoftICE from detection are described.

So if you know that a program can open the SoftICE video driver to test if SoftICE is loaded, then why don't you set SoftICE to break as soon as a file with the name of the video driver is opened and skip the check?

The next point is why do you want to have SoftICE and MechWarrior running at the same time?

Do you want to disable the copy-protection? Do you want to find some ingame data to create a trainer? (I won't judge over that now) Do you think you can cheat in multiplayer games? (same as before)

If you want to bypass the copy-protection, search for posts about SafeDisc on the board. I know it's no usual "insert CD or I won't run" protection, but it's SafeDisc.

If you want to get some in-game data, remove the copy-protection. It's SafeDisc which checks for SoftICE, not the game. Either unpack it maually (good exercise) or find a crack for it (bad exercise). Then continue your research.
Nick
10-01-2002, 06:57 AM
I think Mechwarrior4 actually uses Safecast.

Anyway, the reason I am doing it is not really to cheat but to edit a number in the game code. I can do it with "newbie" gamehack tools to some extent, but they are easily defeated because Mech4 uses DMA-(Dynamic Memory Allocation).

Because it uses DMA it means that when I edit a value in memory or even freeze it in memory it does nothing because the value has moved to a different memory location. So my only solution is to use Softice to change the value of the raw game code.

This is the tutorial I am learning DMA from: http://files.joako.com/Great%20new%20dynamicmem%20tut.txt

As an aside:
The Devs of Mech4 keep claiming that it is "unhackable", And to a certain extent they have been proven correct because after over 2 years since release mech4 has no publically known cracks/hacks while typical games like Warcraft3 have had cheats only weeks after they have come out.

There are rumors that some people uses "packet editors" to cheat online, but I think this has been debunked by the fact that DirectX prevents it or something like that. I actually wouldn't mind reading some tutorials on packet editing.
DakienDX
10-01-2002, 09:25 AM
Hello Nick !

So you don't want to cheat? You only want to change a "number"? And you would also like some packet editing tutorial?
I think it's very obvious to all of us what you want to do. :(

What makes you sure it uses SafeCast? Only because it doesn't ask for the CD every time you start it? SafeDisc and SafeCast are very similar after all. So it wouldn't be a big difference if it uses SafeCast.

So you want to follow your tutorial.
Do you know ASM?
Have you ever worked with SoftICE before?
Can't you explain your problem with your own words instead of quoting every second word from the tutorial?

"As an aside:"
I could find 4 cracks and about 20 pages with cheats/trainers for MechWarrior 4 just by using Google for five minutes.
Your tutorial has also some "bugs". Do what I suggested you in my previous post. I haven't said anything new now.
Uradox
10-01-2002, 12:09 PM
Nick, mech4 does indeed use safedisk
Thats the only softice check you will encounter.
As for cheats the game is very well known to be secure against online hackers/crackers and as yet there isnt any working cheat. Its very interesting, i had a look at this game some time back as a request for a friend. The game doesnt even let you connect to the online servers with a altered exe. And the very first version of it mearly sent a single packet which determined to the server if the game had been modified. Since then its incredably more complicated and the game does outright checks all over the place at the servers request. Give in with this quest :)
Nick
10-01-2002, 06:11 PM
Well I am still gonna try to modify the .exe

And Dakien plz show me one hack that will allow me to cheat online, because I really don't believe you found one. I and just about everyone on the large Mech4 message boards have not found any. I don't want to sound disrespectful but I have been playing this game for over two years and there has been no sign of any hacks/cracks so if you found one it would be a miracle.

As for Safedisc/Safecast I will try both unless Safedisc works right away.

Anyway thanks for the help guys, I have always respected reversers and the cracking community. :)
DakienDX
10-01-2002, 08:07 PM
Hello Nick !

You never said anything about online cheating. You said "after over 2 years since release mech4 has no publically known cracks/hacks".
From my point of view a crack is something which disables a CD check or removes the protection and a hack is something which modifies the game to execute in a different way. (=non-official add-on)
Since I doubt you're talking about a "hack", but rather about a trainer, I looked for them.

I looked around in the pages Google gave me and found out that the cheats work only in single-player games. (what a suprise)
I also found four different multiplayer trainers. One said it works only in LANs, two said they would run with the 2.0 update and one had no special description. They had all the "heat off" and the "more speed" options, one had also "unlimited ammo".

I have no way to test them or to verify that they really work nor do I know if the 2.0 update is outdated , but I won't give any links to cheaters who're too stupid to use Google.

The main part in reversing is searching, so you should search for FrogsICE alternatives before asking for them. Use the search function of this board and you'll find many topics discussing how to hide SoftICE from detection.

And just something more from my side you should think about. If you really belive that nobody found any cheats in two years, then why should you be the choosen one who finds them all just by disabling the SoftICE detection and following some outdated tutorial telling you that code you want to patch is always located at the same memory address?

I'm sorry that this has to end up this way, but your answers didn't tell anything about what you tried and where your problem is. It looked like you're simply ignoring my advices. We don't know the problem you're stuck at. If you don't tell us what your problem is, we can't help you. If it's only hiding SoftICE, then use the search function.
^chaos^
10-03-2002, 07:52 AM
back when mech 4 came out i made a multiplayer trainer but didn't release it, it had things such as infinite jump jets, unlimited ammo, and i was able to have my armor weigh nothing even when it was maxed out, which allowed me to have the best engine and all the weapons i had slots for. however i do not know if they increased their protection in updates, hopefully they have. just search for the value of lets say ammo, once you get the value BPM on it, and then change the SUB command to ADD and your ammo will increase as you fire it. same thing with jump jets and what not, the armor thing is too complicated to explain.
Nick
10-03-2002, 04:34 PM
Originally posted by ^chaos^
back when mech 4 came out i made a multiplayer trainer but didn't release it, it had things such as infinite jump jets, unlimited ammo, and i was able to have my armor weigh nothing even when it was maxed out, which allowed me to have the best engine and all the weapons i had slots for. however i do not know if they increased their protection in updates, hopefully they have. just search for the value of lets say ammo, once you get the value BPM on it, and then change the SUB command to ADD and your ammo will increase as you fire it. same thing with jump jets and what not, the armor thing is too complicated to explain.

Interesting. Did you edit the .exe or did the trainer just change the value of a memory address? If you changed a memory address then mech4 may not use DMA afterall.

I can actually change my score and change the timer pretty easily when I'm online, but only when I am hosting a game. So I wonder if your trainer worked even if someone else was hosting?

I am kinda confused how you changed the speed value considering it's a float value.

EDIT: I would like to know how you got Softice running with Mech4? Thanks.
Snatch
10-03-2002, 07:20 PM
Just as a general discussion with games that have tons of checks to protect against modifications using checksums disk read memory reads etc...the truth is though most of them never are cracked they all are POSSIBLE. Remember if they have the program read memory you can fake it. If it reads the disk you can fake it. If it does a checksum you can fake it. Any checks can be faked since they are executed locally. However the effort required in doing this is enormous. So all your patches you have to make sure if that memory is attempted to be read, you return a fake response. If it checks the memory area you added or injected code then you fake a response as if its not there. If you cover all that you should be ok. If you modified the disk best be advised to have a backup of the original file and have it check that one for verification. That works for checksums too however for memory that can be a bit tricky. Fact of the matter is it takes a lot of time energy and unless Mech4 cheats mean the world to you probably not worth it. In fact Mech5 will probably be out before you can get around it. Not to mention all they have to do is release a minor or any kind of update to make a ton more work for you. Good luck though with whatever approach you take.

Snatch
Nick
10-03-2002, 11:52 PM
Well, I have tried so many progs to try and unwrap safedisc from MW4 but none of them work. The razor1911 No_cd patch does not work either. I am still getting told to "insert disc 2". Why the hell can't they test a no_cd crack before they release it?
Nick
10-04-2002, 01:06 AM
I am really at the point of giving up now, there seems to be no way of removing safedisc from MW4. All I want to do is run MW4 and Softice at the same time, but this has proven to be an impossibe task.

I have tried all the no_cd cracks/patches on the gamefix site and have looked at all the forum posts on GamecopyWorld and have tried all the safedisc unwrappers I could find.

So many times with this game ppl release a "fix" and neglect to actually test if it works and so they are just releasing garbage.
DakienDX
10-04-2002, 10:09 AM
Hello Nick !

A No-CD crack is not necessarily something which allows you to play automatically without CD.

Some of them allow you to use backup CDs, some tell you something like "copy the AUDIO folder from the CD to your game directory" and some can be used just by overwriting the .EXE.

The message you got could mean that you've either not done a full install (I don't know if it's possible), you forgot to copy files from the CD to your HD (or change a registry entry) or that you only got a "backup-CD" patch.

"insert disc 2" is no SafeDisc message. This looks like the protection was removed (=no SoftICE detection any more) and the game itself only reads some files from CD.

So you can insert your CD and start debugging.
Uradox
10-05-2002, 06:14 AM
No-CD means game is able to be run without the cd with some conditions like maybe copying some material from the cd
Fixed-EXE means the exe can only be used with a backup copy of the game. Most just for commercial protections like cdilla.

^chaos^ if you try that now and your a client you get disconnected from the server as if there was some problem :)

Uradox


Softice 4.2.7 loading
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice 4.2.7 loading
PDA

View Full Version : Softice 4.2.7 loading

Snatch
10-01-2002, 12:18 AM
An interesting I have forgotten to care about until now has been that formerly when I had Softice 4.2.6 at startup on Windows XP it would flash SIWVID and then Softice with the press escape to cancel loading at the bottom of the screen. Then when boot was finished ctrl+d took me into Softice. Now with 4.2.7, on boot it just shows SIWVID no Softice and then to start it I have to run that Start Softice batch file that simply does a "net start ntice". I am a little confused as to why this is done now and wasnt before. I am even more confused what Softice has to do with the net command unless it is setting up remote debugging or something of the like but ctrl+d wont respond until of course I execute that. The reason I ask is because maybe someone else has noticed this and also it never did this before and AFAIK I configured it the same exact way as I always do.

Snatch
Timmy
10-01-2002, 02:41 AM
I've just upgraded to 4.27 from 4.26 on Win2k and have not seen any differences on boot. Must be summat in the startup config ???

I run on maual mostly and all I get on boot is Press ESC to cancel loading SIWVID as before. I use same winice.dat as before.
pknight
10-01-2002, 05:59 AM
If you have DS2.7->Settings->Startup = Manual, then you need to use the batch file that starts the ntice service.. However, if you have one of the other startup options selected, you can still start it automatically at bootup..

-pk
NervGaz
10-01-2002, 06:27 PM
Just a comment on the question about the net start command... net start <servicename> is the command to start a service through the command prompt on NT/2K/XP and it doesn't have to be net related, any kind of service can be started this way unless it's disabled
Snatch
10-01-2002, 08:54 PM
Well what is interesting is I have system enabled not manual...that is mainly why I am wondering what on earth is going on. You are right about net start being a way to start a service not networking I was thinking of net use. Maybe I should select another option reboot and then switch back to system and reboot again see if that fixes it.

Snatch


FLEXlm 8.1a
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXlm 8.1a
PDA

View Full Version : FLEXlm 8.1a

Zigmund
10-02-2002, 06:46 PM
Does anyone worked with FLEXlm 8.1a? I have discovered non-standart (like 7.0) interface... no lmgr327a.dll etc...
Who can help me? Answer please....
And... where can I find SDK for FLEXlm 8.1a...

Thanks a lot for answering...
Woodmann
10-02-2002, 08:56 PM
NO NO NO NO NO NO NO NO

NO
evaluator
10-03-2002, 07:42 AM
OK:)


OEiP - How to .... ? (ASprotect v1.3)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > OEiP - How to .... ? (ASprotect v1.3)
PDA

View Full Version : OEiP - How to .... ? (ASprotect v1.3)

BruceLee
10-02-2002, 08:08 PM
Hi all!

I have a little problem, and I'm sure that you can help me.

Problem:

I found OEiP:

004432B0 0000 ADD [EAX],AL
004432B2 FF150C724700 CALL [0047720C] ; *** OEiP ***
004432B8 33D2 XOR EDX,EDX
004432BA 8AD4 MOV DL,AH
004432BC 891590B14D00 MOV [004DB190],EDX

but something is wrong. Look this:

014D5959 PUSH EBP ; *** part of original EXE ***
014D595A MOV EBP,ESP
014D595C PUSH FF
014D595E PUSH 004AF5A0
014D5963 PUSH 00447028
014D5968 MOV EAX,FS:[00000000]
014D596E PUSH EAX
014D596F MOV FS:[00000000],ESP
014D5976 SUB ESP,58
014D5979 PUSH EBX
014D597A PUSH ESI
014D597B PUSH EDI
014D597C MOV [EBP-18],ESP
014D597F PUSH 004432B2 ; *** OEiP ??? ***
014D5984 RET

How to dump this file (where) and how to fix it, please?

BruceLee
evaluator
10-02-2002, 08:29 PM
so why you not ACTIVATED youR fantasy?

IF you wrote:
>014D5959 PUSH EBP ; *** part of original EXE ***
it means you Can restore this bytes!

>014D597F PUSH 004432B2 ; *** OEiP ??? ***

Why?
OEP will place where you will put that bytes.

>Where I must put?(VirtualQuestionEx)

PUSH 004432B2
RET

I guess(why not you?) : this instructions returns executions to next code after riped peace.
So put that PART fo original code before 004432B2...

exclude:
PUSH 004432B2
RET

>Why exclude?

~:-0

**************
NOW I have Question to you!!

Why you think, this is ASPR1.3!??
Have you true info!?

else say: "zorry"
Iwarez
11-01-2002, 06:39 PM
I don't think it's asprotect 1.3 but it sure is a new version. I got my hands on a complete new game that's protected by asprotect and it has the same thing as the target above. The first few executions are being executed in asprotect address space after that you get redirected to the normal address space where the rest is executed. The first few bytes have a different address where they are stored every time. I just cut and paste the bytes where they belong, adjust the oep and it worked fine...


SoftICE search function ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE search function ?
PDA

View Full Version : SoftICE search function ?

spuTniK
10-03-2002, 12:28 PM
Yo guyz, who can tell me wether it is possible to find each location of a (equal) String in the memory with the Sice search-function ?

My problem is :
I was searchin for a Fakeserial "112233" with the command
s 0 L FFFFFFFF "112233", but I was only shown one Adress in the DataSegment where this String was stored, although it was stored at another location ( in the same Segment ) too.
So what can I do to find the other(s) ?

Thx for Help,
spuTniK
xor37h
10-03-2002, 12:55 PM
easy answer

type:

s

to search for next occurence...

xor37h
spuTniK
10-03-2002, 01:25 PM
Thanx a lot for answering ( so fast ), xor37h

ciao spuTniK
Snatch
10-03-2002, 07:21 PM
My question is how do I have Softice not search its own memory with that command. I mean the string you pass to the s command is stored in Softice memory and finding it annoys me ;).

Snatch
Kayaker
10-03-2002, 08:30 PM
Originally posted by Snatch
My question is how do I have Softice not search its own memory with that command. I mean the string you pass to the s command is stored in Softice memory and finding it annoys me ;).

Snatch

Well, it may annoy you Snatch, but you should be grateful for it. Consider it like a seatbelt or set of brakes on a car. Have you ever continued a search with the 'S' command beyond SI memory? Odds are if you're using an upper address limit of FFFFFFFF you'll eventually hang your system when it just can't seem to find that very last occurence of the string.

Unless you're specifically scanning C0000000 and above, then if you ain't found your string by then, you ain't gonna find it. So take the forced stop in Softice memory as a blessing and get the hell out of the 'S' search function, if you know what I mean.

Try it sometime, then see if it's any less annoying than having to reboot ;)

Kayaker
Snatch
10-04-2002, 05:44 AM
Well I did not know Softice was at the end of the address range. Just recently when I was playing around with IEXPLORE.EXE in memory of course it loads a bunch of DLLs to do the dirty work but I was searching for all occurances of MSIE and replacing them with NOMS and of course I did land in Softice address space searched again and it came up with the same string later in Softice address space and kept doing it probably because I was going through the entire command history. Then I decided to push the start address up and your absolutely right. Crash and reboot. Still do not understand why that happens. But I guess your right it is a good thing ;).

Snatch


aspr license routine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > aspr license routine
PDA

View Full Version : aspr license routine

Nigma
10-03-2002, 11:10 PM
Hi everyone ,

I traced some asprotect routines , and I know that many appz
protected by it are registered by a licesene which checked by
rsa-1024 , my question is :

At the end of the check routine , isn't it just a matter of flag/indicator which is triggered if the license is OK ??

If yes, does someone saw something like that ??

well I came to that speculation by thinking of the app which
protected , the app does not check our license before
it show the nag , it just check some flag/indicator . I know that
because the rsa-1024 routine is at aspr code and it is not
called by the app .
DakienDX
10-04-2002, 10:48 AM
Hello Nigma !

You might want to look at the ASProtect documentation. Then you would understand how it protects an application.

It has callback functions which the protected program can use to to interact with ASProtect, even after the application is loaded and running.

You will also find out that ASProtect uses "signatures" and encrypts parts of the code segment. This parts will be skipped if no license key is present, but if you tell ASProtect that a right key was found (inversing a flag/jump), ASProtect will decrypt the encrypted parts of the code segment with the license you've provided. Since you license will be invalid (else you wouldn't want to do this), the code will be decrypted wrong and simply crash on execution.

So the if the license is OK is not a question about a flag and the application can call the RSA procedure itself (over the callbacks).
DakienDX
10-06-2002, 02:29 AM
Hello Nigma !

No, the callback functions don't exist any more when the program is unpacked.

You have to manually clear the values passed the program by ASProtect (address of registered name, days left, ...), since these values are already set at the OEP and contain some memory address which is not present in the unpacked file. This will finally lead to some memory access error.

How the program reacts on the missing callbacks is different. Some crash since they try to use the callbacks without checking if the address they're calling is 00000000h, some will work without the callbacks since they check if ASProtect passed them a callback address or if the address is still 00000000h.

Then there are two callbacks, one is executed if trial version, the other is executed if registered version. It depends on the program if it's "normally" registered and sets itself to trial if the callback is executed or if it's vice versa.

But this isn't the main problem. This is just a basic cracking issue.
The parts of the code segment which are encrypted with help of the signatures will still be encrypted if you unpack the file, so without a valid license there will be always code missing (for example the save function). You can only get a complete dump if you have a valid license. (and then you probably wouldn't try to unpack it)
DakienDX
10-13-2002, 09:36 PM
Hello _Servil_ !

I have never tried myself to bruteforce the missing bytes, but it should be impossible. As far as I know it uses Twofish to encrypt the data. I don't know how many bits the password is long, but probably 64 or 128 bit.
With 64 bits it would take many years and with 128 bits it would be nearly impossible.

As I already wrote, the encrypted code is decrypted only with a valid license. If the key is invalid the program will just jump over the code (or crash if you told ASProtect that the key you entered was correct, but is was really not).

If you've heard about ASProtect documentation, why don't you download ASProtect and read it instead of asking if it is possible to download it.


SafeDisc V2.60.52
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SafeDisc V2.60.52
PDA

View Full Version : SafeDisc V2.60.52

SiNTAX
10-05-2002, 03:24 PM
As a first-time unpacking effort, I thought I'd take a SafeDisc game and put my teeth into it..

Just to make it a bit challenging, I'm not using any anti-si tools (am using WinXP, so Frogsice etc don't work anyway).

I've been able to pass all debugger checks, but I think I missed something somewhere because if I run the target under SI, it crashes after showing the SD splash screen.

So I was wondering if somebody could shed some light onto this.

(additional question.. probably is something for ToT forum, but here goes... is there a 'good' tool to cut/paste parts of a file .. ie. SD has sections that are scrambled, so I dump the descrambled part but then want to paste it into my file that I run through IDA.. any pointers?!)
SiNTAX
10-05-2002, 10:10 PM
Originally posted by SiNTAX

(additional question.. probably is something for ToT forum, but here goes... is there a 'good' tool to cut/paste parts of a file .. ie. SD has sections that are scrambled, so I dump the descrambled part but then want to paste it into my file that I run through IDA.. any pointers?!)

For that last part... WinHEX seems to do what I want..
SiNTAX
10-11-2002, 01:54 AM
Originally posted by SiNTAX

I've been able to pass all debugger checks, but I think I missed something somewhere because if I run the target under SI, it crashes after showing the SD splash screen.

Wheee... no more crashing... found another trick to detect SoftICE.. thank you Macrovision :-)
SiNTAX
10-13-2002, 12:27 AM
Whippee.. found OEP and IAT so now all that rests, is to resolve the import table... time to download ReVirgin (or ImpRec.. we'll see which one is better) and study how to do that crap.
LaBBa
10-13-2002, 01:23 AM
will u do a tut about all of that ??? and share with us all u lerned ?
SiNTAX
10-13-2002, 01:55 AM
Originally posted by LaBBa
will u do a tut about all of that ??? and share with us all u lerned ?

Euhm.. wasn't planning on doing that, no. But I'm willing to help those who have questions about it.

Hell if a newbie like me can do this, then it probably isn't very hard
:D
[yAtEs]
10-16-2002, 06:36 PM
Originally posted by SiNTAX

(additional question.. probably is something for ToT forum, but here goes... is there a 'good' tool to cut/paste parts of a file .. ie. SD has sections that are scrambled, so I dump the descrambled part but then want to paste it into my file that I run through IDA.. any pointers?!)

create a file called ending in .IDC and write something like

#include <idc.idc>

static main(void)
{
auto hFile;

hFile = fopen("mydata.bin", "rb");

if (0 != hFile)
{
loadfile(hFile,0,0x00402317,0x110);
fclose(hFile);
}
}

in it, that'll load in ur data over the top, saves you having to
start ur database(idb) from scratch. you could modify the above
and make a function to take in the file,loc,size :-) oh and its F2
to load the script,

regards,
yates.
SiNTAX
10-16-2002, 10:45 PM
Well I just used WinHEX to cut 'n paste the changed bytes into my working file and the select 'Load File->Reload the input file' in IDA.

Works like a charm.. and keeps my database intact too.

The File Compare in WinHEX is pretty nice.. if it would understand the PE format it would be f*cking-A ! :-)

Hmm maybe I should take the time to patchup that CryptDecrypt routine so that it only decrypts.. that way I would only have to dump once.. but then again.. I already have a pretty decent dump :)
[yAtEs]
10-16-2002, 11:36 PM
Originally posted by SiNTAX

Hmm maybe I should take the time to patchup that CryptDecrypt routine so that it only decrypts.. that way I would only have to dump once.. but then again.. I already have a pretty decent dump :)

yer, i run all the encrypted blocks first and decrpyt them to a memory image then dump that so i have a fully decrpyted dlls
LaBBa
10-17-2002, 08:58 PM
hey why not ??? it only will take u a lil time ..
plz if u can write a tut for us all ...
[yAtEs]
10-18-2002, 09:39 AM
there's a french one here if ur interested,
http://www.yates2k.net/cd/TSD27p.txt
DakienDX
10-18-2002, 12:02 PM
Hello LaBBa !

If SiNTAX isn't planing to write a tutorial, you must accept it.

SafeDisc is already some years old and has been discussed many times before.

You're supposed to learn and not to let other people write the solutions for your crack requests.
If you just read a cracking tutorial for every new version comming out, where would the learning effect be?
SiNTAX
10-18-2002, 12:39 PM
Originally posted by DakienDX
Hello LaBBa !

If SiNTAX isn't planing to write a tutorial, you must accept it.

Pfwew.. was almost starting to feel guilty.... NOT :D
Bengaly
10-18-2002, 01:48 PM
LaBBa

accept that ppl harot :)
SiNTAX
10-18-2002, 01:48 PM
Originally posted by [yAtEs]
there's a french one here if ur interested,
http://www.yates2k.net/cd/TSD27p.txt

yAtEs.. interesting site you have there...

h**p://www.yates2k.net/amiga.cracking.txt

Sniff.. now that brings back memories! (aahh where are the days.. MFM, RNC, 4489, 8911, ...)... anyway.. I'm drifting.. no use dwelling on the past..
LaBBa
10-25-2002, 03:22 AM
ok.. ok .... i got it ! don't need to tell me more then

2 times :D .

i have alredy raed all the tuts about all the old SD tricks...

i hope that i will get it in the end...


an oldy ASpack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > an oldy ASpack
PDA

View Full Version : an oldy ASpack

LaBBa
10-06-2002, 02:15 AM
i alredy once asked about :
Examine32 v4.00
that both imprec and revirgin couldn't find the AIT and fix it..

i saw the two replays of nikolatesla20 and h8er and i thoght
that "ok they done it again they can unpack all"
but after a while i had some spare time and wanted to do it
by my self ...

h8er posted this :

"dump the file oep is 1000

load examine with symbol loader

bpr 442000 442000+948 rw

0187:0045017D C1F902 SAR ECX,02
0187:00450180 F3A5 REPZ MOVSD <- you pop here
0187:00450182 8BC8 MOV ECX,EAX
0187:00450184 83E103 AND ECX,03

at 450182 d 442000 this is your it an down there's the complete iat so here dump 442000 948

IT Rva 42000 size f0
IAT Rva 420f0 size 948

fix the dump " end of h8er words

i done all of that step by step .. but still some things are not the same ,like :

1) if i do a : 'bpr 442000 442000+948 rw'
i will NOT pop here:
> 0187:00450180 F3A5 REPZ MOVSD <- you pop here

2) after the dumping and pasting it back still doesn't work...

if can some1 plz help me with that with better explnations i will
be very thankful
SpeKKeL
10-06-2002, 04:41 PM
Howdy,

aspack=dump and run !

No iat pasting and so on !

Just dump the prog at it's latest ret (you know after the popad..)

Correct oep to the real oep

Bypass the simple "msgbox blabla is corrupted"

One little note:dump with lordpe, seems icedump struggles with the import-table when you use pedump)

Succes,

SpeKK.
hobgoblin
10-06-2002, 07:46 PM
Hi there,
Here is some input on this kind of target. (I do it this way everytime I reverse an Aspacked program). Make the program break at entry point. Then simply trace through the code using F8/F10 until you reach this point in code:
016F:0045015F 5B POP EBX
016F:00450160 5E POP ESI 
016F:00450161 59 POP ECX
016F:00450162 58 POP EAX
016F:00450163 EB08 JMP 0045016D
016F:00450165 0000 ADD [EAX],AL
016F:00450167 42 INC EDX
016F:00450168 0100 ADD [EAX],EAX
016F:0045016A 004101 ADD [ECX+01],AL
016F:0045016D 8BC8 MOV ECX,EAX
016F:0045016F 8B3E MOV EDI,[ESI]
016F:00450171 03BD22040000 ADD EDI,[EBP+00000422]
016F:00450177 8BB552010000 MOV ESI,[EBP+00000152]
016F:0045017D C1F902 SAR ECX,02
016F:00450180 F3A5 REPZ MOVSD
016F:00450182 8BC8 MOV ECX,EAX
016F:00450184 83E103 AND ECX,03
016F:00450187 F3A4 REPZ MOVSB

It doesn't take long to get here. Put a breakpoint at 450177, and run the program. When it breaks, check the values stored in edi. When you see the starting address of the IAT, check out the value stored in ecx. The IAT address can be found by using LordPe or something similar. The value in ecx is the size of the import table. (The size you listed in your post is wrong, the correct one is 1E00).Now, before you can do a dump you have to get to address 450189, after the two REPZ instructions. Then you can dump it.
Now you have a fully working IAT that you can paste into the dump.
This method can be used on all Aspack'ed programs to get a virgin IAT.
Hope this helps a bit.

hobgoblin


SI Breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI Breakpoints
PDA

View Full Version : SI Breakpoints

m4nd4t3
10-06-2002, 02:46 AM
I have a newbie question regarding breakpoints in SoftIce. I need to set a BPX on an API used in a 3rd party DLL. The exe calls the API from License.DLL and when I try to set a bpx it says 'Symbol not loaded'. I tried adding it to winice.dat

EXP=C:\Program Files\Program\Program.exe
EXP=C:\Program Files\Program\License.DLL

But I still receive the same message. What am I doing wrong? How should I import these APIs so I can use them?
Pyrae
10-06-2002, 04:45 AM
Actually the SI Symbol Loader is enough to dynamically load exports.
In winice.dat try something like

EXP=C:\Progra~1\App\YourDLL.dll

or

EXP="C:\Program Files\App\YourDLL.dll"

as SI might have problems with spaces in those strings.

so long, Pyrae
naides
10-06-2002, 03:12 PM
Originally posted by m4nd4t3
I have a newbie question regarding breakpoints in SoftIce. I need to set a BPX on an API used in a 3rd party DLL. The exe calls the API from License.DLL and when I try to set a bpx it says 'Symbol not loaded'. I tried adding it to winice.dat

EXP=C:\Program Files\Program\Program.exe
EXP=C:\Program Files\Program\License.DLL

But I still receive the same message. What am I doing wrong? How should I import these APIs so I can use them?

Also try the utility called "symbol loader" in your SoftIce folder.
You should be able to point and click the license.dll you are aiming to include, then you should be able to bpx on it.
If every thing else fails, dissassemble the .dll, find the entry point of the API you wish to break on, and change
the first byte for "CC", Int 03, noting the original byte. then, in softIce place a bpint 03 breakpoint. it shoud break when the API gets called. Once there, you have to manually revert the "CC" byte to its original value, or the app will surely crash.
m4nd4t3
10-07-2002, 01:22 AM
The tilde worked. I never even thought of it. Thanks much everyone.


AsProt crash...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AsProt crash...
PDA

View Full Version : AsProt crash...

bogdan
10-06-2002, 10:04 AM
I tried to unpack many progs that are protected with AsProt 1.3 but they all seem to crash. There is some kind of new protection in this version?
There is a topic that was created by prejker with the subject another asprotect newbie. In that topic hobgoblin
says that he managed to get this progy ( Advanced Log Analyzer 1.2) to run. How?

Ok here's the code from Advanced Log Analyzer 1.2:
EAX=0051A464 EBX=00000000 ECX=007BFF68 EDX=00000000 ESI=00000087
EDI=0051A46C EBP=007BFCD4 ESP=007BFCBC EIP=00403A95 o d I s Z a P c
CS=017F DS=0187 SS=0187 ES=0187 FS=391F GS=0000 FS:00000000=007BFE2C

00403A7A A1ACF45100 MOV EAX,[0051F4AC]
00403A7F 85C0 TEST EAX,EAX
00403A81 744B JZ 00403ACE
00403A83 8B30 MOV ESI,[EAX]
00403A85 33DB XOR EBX,EBX
00403A87 8B7804 MOV EDI,[EAX+04]
00403A8A 33D2 XOR EDX,EDX
00403A8C 55 PUSH EBP
00403A8D 68BA3A4000 PUSH 00403ABA
00403A92 64FF32 PUSH DWORD PTR FS:[EDX]
00403A95 648922 MOV FS:[EDX],ESP
00403A98 3BF3 CMP ESI,EBX
00403A9A 7E14 JLE 00403AB0
00403A9C 8B04DF MOV EAX,[EBX*8+EDI]
00403A9F 43 INC EBX
00403AA0 891DB0F45100 MOV [0051F4B0],EBX
00403AA6 85C0 TEST EAX,EAX
00403AA8 7402 JZ 00403AAC
00403AAA FFD0 CALL EAX ;when ebx=2, eax=40691C this call crashes the program
00403AAC 3BF3 CMP ESI,EBX
00403AAE 7FEC JG 00403A9C ;loop until ebx=esi
00403AB0 33C0 XOR EAX,EAX

I've seen the G6 FTP Server tutorial, and i tried to put some ret's in the calls that are crashing but that doesn't work.

Can anyone please help me?
Is this related to double dipping in ASProt?
SpeKKeL
10-06-2002, 04:47 PM
Did you look to this thread:

A challenge (or the many faces of ASProtect) !!

SpeKK.:o


newbie unpacking question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > newbie unpacking question
PDA

View Full Version : newbie unpacking question

xkrylonx
10-07-2002, 04:46 AM
I'm having some trouble getting the imports to come up in w32dasm, after unpacking a neolite1.1 packed exe.

I've been reading alot trying to get a better understanding of how to manually rebuild/unpack files, but its been a bit confusing (I'm learning more each time I re-read the tuts and threads though!)

So my approach was determining how the exe was packed using PE-Scan, then I unpacked it with ProcDump. After dumping it, the program would give an error that it could not initalize properly. I rebuilt the PE using ProcDumps rebuilder, all the standard options except I chose "rebuild the import table". It worked succesfully and the program executed fine then.

However, when I check out the exe in w32dasm, the imports don't come up. After searching the threads I found what I thought was the answer to my problems:

-------------------------
The Imports aren't encrypted with Neolite and the program should run fine as dumped, but if you want to see them with PEditor or W32Dasm, you need to change the RVA of the Import Table to the real one, not the one pointed to in unpacking code. This is an address in the Optional Header that points to the Image_Import_Descriptor (IID) table, a set of 5 DWORDS that gives information about each dll. One way to find this address is to do a hex search for the starting address of the IAT, which is at 89000, the beginning of the .rdata section. If you search for "009008" you'll land in the middle of the IID table. Find the starting address offset for this table and change the RVA and size of the Import Table as shown in PEditor to the correct values (A4F90 and 104) and you should see the proper Imports in a disassembly.

Kayaker
--------------------------

But I'm having a hell of a time getting this to work. I tried a few different approaches, like loading up the dumped/working exe into ReVirgin and having it dump the IT, then I tried inserting that into a new section of the exe and pointing the IT RVA to that... all with no success.

I'm not giving up, I'm just hoping to get some insight! I'm probably just too tired.. maybe another set of eyes will help. Thanks.
Kayaker
10-07-2002, 07:16 AM
Hi xkrylonx

Wow, that thread was over a year and a half old and I had to redump Neolite packed notepad just to remind myself how to do it ;) I think you've got the same situation, the RVA in the Import Table entry of PEditor needs to point to the start of the IID. Try it on notepad and see where and what this actually is (at the start of the .idata section at 6000, the IAT proper starts at 62E0 (Win98SE). For a good explanation of the Image_Import_Descriptor I usually recommend Understanding Import Tables by Yates (Immortal Descendants Archives).

For your unknown dumped app that works but doesn't have fully described imports yet, you can probably find the middle of the IAT by looking at the first API call in the program *before* Softice resolves it as you step over it. i.e. with notepad, the first call looks like 'Call [4063E0]', which SI will resolve to GetCommandLineA when you F10 over it. 4063E0 is somewhere in the middle of the real IAT. Display this address and scroll around that section until you find the start of the IID (at 6000). You can learn to recognize the array of 5 DWORDS describing the IID by studying notepad. The IID isn't necessarily at the beginning of the .idata section, but that's a good place to start, if not you'll have to search around. Once you've found the start of it and its size, enter these values under 'Import Table' in PEditor and the imports should be resolved.

I'm not really a fan of using ProcDump or the like to dump and rebuild imports, I usually do an Icedump raw dump with /DUMP 400000 [size of image] [filename] and fix up RS=VS and RO=VO (OK, I'm lazy and use PEditor for this), and fix up any import pointers manually if necessary. This is just my personal preference. If you've already tried rebuilding the imports and the file has been "optimized" by an external app then you've got to account for any differences in Raw and Virtual offsets in any further modifications you might want to make including patching.

Let me know if this makes sense,
Kayaker
xkrylonx
10-07-2002, 07:29 AM
Glad I caught this before I went to sleep!

Well first, I'm running Win2k + the DriverSuite version of SoftIce... although I'm considering setting up one of my other computers with 98se again just for cracking work, because almost all of the tuts use IceDump and such!

The target is BlackWidow v4.16 (there is a newer version, not sure if its packed the same), as I forgot to mention in the prior post. I read some more threads and tried to use ImpRec to restore the imports as well.. but still the same result.

I will check out those archives you mentioned, and also examine packed versions of notepad and hopefully get a better feel for what is going on.

Thanks for the help, I'll be posting again soon..


SOFT-ICE wince.dat Download
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SOFT-ICE wince.dat Download
PDA

View Full Version : SOFT-ICE wince.dat Download

The +Jonathan
10-07-2002, 07:30 AM
New feature:

(1) Improved F-12 & F-11:

Auto set Break Point on the last F-11, or F-12 press EIP that will back to windows.

(2) F-2 become a "reverse TEST condition" that will make jump if it was originally NOT.

(3) Support:

DUMP [SIZE]

It will dump to c:\DUMPED.EXE (With win 32)
Kayaker
10-08-2002, 04:13 AM
Hi

Thanks for the updated .dat file. I have a question for you though, on your site you have a jpg of a Softice screen, how did you manage to capture it? I've been playing with the idea of doing just that recently, just for the fun of it. The only possible solution I've found, other than taking a direct picture, is using a second computer and the SERIAL32 program to run Softice in a DOS box, then capturing the console window with the default Alt-PrintScreen which you can then paste into a paint program.

Instead, I thought about finding the SI screen in video memory and trying to dump/capture it directly. There are a couple of little known SI commands, CTRL-ALT-C and CTRL-ALT-arrowkeys which allow you to centre and move the Softice screen around your desktop. Since these must use the screen coordinates of the SI window, I thought the boundaries might be accessible from this code (which I haven't found yet anyway).

Your screen capture jpg looks a little off-centre, but I was just curious how you managed it at all. Also, in your .dat file why do you have such a large value for DRAWSIZE=2000000?

Kayaker
The +Jonathan
10-08-2002, 06:54 AM
Thank for asking such a good Question. ). I strongly recommand you to visit my "forum" and post that question on my form (below is the link I WILL answer it ^_^

Visit My Forum (http://bbs.ysl.net/bbs/?MID=127014)
Snatch
10-08-2002, 07:11 AM
I checked out the site and forum and all was cool except the forum is in Chinese...very difficult for me to effectively navigate or post to it. Maybe you could provide us the answer here? I am also interested in taking screenshots practically though Kayaker did have one possible way.

Snatch
Kayaker
10-08-2002, 07:25 AM
Uhmm, OK thanks, but other than a bunch of edit boxes in what looks like a submit form of some kind and a bunch of smiley face icons, none of the text on your "forum" is recognizable in my browser (Chinese site?). I can't even tell what is says on the buttons. I see only one question there, posted by you, and even though it's in English, all it says is something about Mr. Jackson being fucking gay. To be honest, this doesn't give me a lot of confidence in posting a question there and whether this is a serious forum or a joke.

Is there any reason why you can't answer me here where others could read it and we could perhaps develop some ideas towards accessing Softice video memory or developing a screen capture utility?

Kayaker
The_Philosopher
10-08-2002, 08:40 AM
;)
This is screen from TRW2000.
:p

The_Philosopher
Kayaker
10-08-2002, 11:06 AM
Originally posted by The_Philosopher
;)
This is screen from TRW2000.
:p

Doh, you're right. That's what I get for believing everything I read. So it's a fake Softice jpg but I guess the windows are similar enough to TRW for its purposes of demonstration. I suppose it was too difficult to just admit that up front when asked...

Guess we're back to square one Snatch ;)
username
10-08-2002, 05:46 PM
Originally posted by Kayaker
Is there any reason why you can't answer me here where others could read it and we could perhaps develop some ideas towards accessing Softice video memory or developing a screen capture utility?
How about a 'grep -i video icedump/w9x/src/inc/' ? I can see several symbols that are probably pointing to the right direction. Maybe someone should volunteer for writing some script or plugin for IDA to import the icedump includes ;-). Just my 2 cents of course.
Kayaker
10-08-2002, 08:16 PM
Hi, thanks for the input. I had definitely looked at cmd_screendump.asm as a starting point and figured line 61 was the clue:

call GetVideoMem ; get start of video memory

then follows the parsing routine for the various /screendump modes. I got hung up though on just how the defined value for oVideoMem was determined for each different version of Softice, or why modifying the linear address was necessary for some of the 3.x SI versions:

in util.asm

;------------------------------------------------------------
; eax: linear address of the video memory as used by winice
;------------------------------------------------------------
GetVideoMem:
mov eax,[oVideoMem]
mov eax,[eax]

%if WINICE_VERSION_MAJOR = 3
%if WINICE_VERSION_MINOR = 22 || WINICE_VERSION_MINOR = 23
|| WINICE_VERSION_MINOR = 24
push ebx
mov ebx,[oLinAddrPhysical_0_MAXPHYS]
add eax,[ebx]
pop ebx
%endif
%else
%endif
;------------------------------------------------------
i.e. for 4.05.334e
oVideoMem dd 0x0001D87B

for 3.24g
oVideoMem dd 0x000115BB
oLinAddrPhysical_0_MAXPHYS dd 0x000067CD

I thought the Mode 4 dump into an EPS formatted file would suffice to be able to convert it into a graphic, but initially the only conversion program I had tried was CorelDraw7 and all it gave was a gray background with the text of the filename and "Icedump EPS Export v1.0".

However, I just tried the same thing using PaintShopPro to convert the EPS file, and lo and behold, it worked perfectly! What can I say? Kudos ;-)

I'm still curious about that addressing though...

Regards,
Kayaker
Snatch
10-08-2002, 08:49 PM
2 computers would be a nice way to do it though still. Cant believe I was fooled into thinking that was a Softice screenshot though. I never really thought much about how difficult a screen shot of a ring0 debugger would be but its an interesting challenge. I will take a look at the mentioned code but this is sounding like a major project to me ;).

Snatch
username
10-09-2002, 10:50 AM
Originally posted by Kayaker
Hi, thanks for the input. I had definitely looked at cmd_screendump.asm as a starting point and figured line 61 was the clue:

call GetVideoMem ; get start of video memory

then follows the parsing routine for the various /screendump modes. I got hung up though on just how the defined value for oVideoMem was determined for each different version of Softice, or why modifying the linear address was necessary for some of the 3.x SI versions:

Ok, i took a look at it too and what i think happens here is that callers of GetVideoMem expect a linear address for the video memory and for some reason certain 'old' versions of SoftICE require a different mechanism to compute it (if someone has those versions, he/she could verify this theory). In any case, since this code seems to work for icedump, so should it work for you as well IMHO ;-).

I thought the Mode 4 dump into an EPS formatted file would suffice to be able to convert it into a graphic, but initially the only conversion program I had tried was CorelDraw7 and all it gave was a gray background with the text of the filename and "Icedump EPS Export v1.0".

However, I just tried the same thing using PaintShopPro to convert the EPS file, and lo and behold, it worked perfectly! What can I say? Kudos ;-)

It just occured to me that you may have another 'easy' way to get graphics output. The thing is that based on the /screendump code we can safely assume that the softice video memory (or at least the one accessed by /screendump) is in a very well known format, the one used back in the DOS world since the mono video cards came into existence (and i think every modern card still supports it). This mode is very simple, it stores two bytes per character (ascii code/attributes such as color) in a linear array, so if you could find out the softice font bitmaps (it must have them somewhere or get it from the video BIOS/whereever) and the color encodings (the 24 bit RGB equivalents) then you could write a simple conversion routine for the raw dump.

Grepping for 'font' i see a few hints so that may be a good starting point and for the RGB values you could just 'invent' something 'close to what it looks in softice' at the beginning.

PS. why on earth is the timeout for answering so short? You guys make one choose between the toilet and posting right away, as i had to learn it the hard way :P.


Help on Sase module
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help on Sase module
PDA

View Full Version : Help on Sase module

campa
10-07-2002, 09:12 AM
Hello,

I'm reversing safe serial and I have to put a break on execution in a memory range (access to sase.ocx)

I've tried bpx eip if eip>xxx where xxx is the beginning of the sase.ocx module... and it does not work.

Whats wrong? And does anyone knows how to proceed ?

Thierry.
xor37h
10-07-2002, 02:06 PM
Hi Thierry,

Well I dont wabt to ruin all your fun, but here goes:

Getting the four 3byte encode numbers is easy:

bpx CreateFileA
F12
d *(eip+642e9)

Here is a TASM framework for a keygen, which uses the codeserver.ocx in an smart little way to do the work for us...

extrn LoadLibraryA : proc
extrn FreeLibrary : proc
extrn GetProcAddress : proc

.data
szLibrary db 'c:\codeserv.ocx',0
szDllRegisterServer db 'DllRegisterServer',00h
sub_8B41DC dd 0
hLibrary dd 0

; ---------------
dd 20
sase_CustomerCode db 32 dup(0)
dd 3
sase_MaxExecs db '255', 4 dup(0) ; (0-255, 255=unlimmited)
dd 3
sase_MaxDays db '255', 4 dup(0) ; (0-255, 255=unlimmited)
dd 3
sase_LicType db '131', 4 dup(0) ; (0-9999). 131 for enterprise SAFEREG
dd 1
sase_Counter db '0', 4 dup(0) ; (0-255, 255=unlimited)
dd 12
SAFEREG_EncodeBytes db '188193240217', 4 dup(0) ; SAFEREG (188,193,240,217)
off_UnlockCode dd 0
off_ConfirmationCode dd 0
; ---------------

.code
code_begin:

; ---------------

call LoadLibraryA, offset szLibrary
test eax,eax
jz error_Loading_DLL

mov dword ptr [hLibrary], eax

push offset szDllRegisterServer
push eax
call GetProcAddress
test eax,eax
jz error_Loading_DLL

add eax, 43598h ; add RVA+43598h to get offset of sub_8B41DC
mov dword ptr [sub_8B41DC],eax

add eax, 29Ch
mov byte ptr [eax], 0C3h ; patch a RET at 008B4478

; ---------------

push 31 ; The max length of the string to get +1
push offset sase_CustomerCode ; Pointer to the sase_CustomerCode string
push IDC_EDIT1 ; The text box to get the string from
push __hWnd ; The handle of the dialog
call GetDlgItemTextA ; Get the szName string

xor eax, eax ; check the size of the string
xor ecx, ecx
dec ecx
lea edi, sase_CustomerCode
repne scasb
not ecx
dec ecx
mov dword ptr [sase_CustomerCode - 4], ecx

mov dword ptr [off_UnlockCode], 0
mov dword ptr [off_ConfirmationCode], 0

push 1
push offset sase_CustomerCode
push offset sase_MaxExecs
push offset sase_MaxDays
push offset sase_LicType
push offset sase_Counter
push offset SAFEREG_EncodeBytes
push offset off_UnlockCode
push offset off_ConfirmationCode
xor cl, cl ; [ ] Uninstall
xor dl, dl ; [ ] Reset Execution
xor al, al ; [ ] Reset Install Dat
call sub_8B41DC

cmp dword ptr [off_UnlockCode], 0
jz error_Invalid_CustomerCode

cmp dword ptr [off_ConfirmationCode], 0
jz error_Invalid_CustomerCode

push dword ptr [off_UnlockCode]
push IDC_EDIT2 ; The edit box to put the info into
push _hDlg ; The dialog handle
call SetDlgItemText ; Set the text

push dword ptr [off_ConfirmationCode]
push IDC_EDIT3 ; The edit box to put the info into
push _hDlg ; The dialog handle
call SetDlgItemText ; Set the text
ret ; return

error_Invalid_CustomerCode:
ret ; return

code_end:
end code_begin

Best Regards, xor37h
esther
10-07-2002, 03:36 PM
wtf no keygens allowed!
naides
10-07-2002, 05:46 PM
Originally posted by campa
Hello,

I'm reversing safe serial and I have to put a break on execution in a memory range (access to sase.ocx)

I've tried bpx eip if eip>xxx where xxx is the beginning of the sase.ocx module... and it does not work.

Whats wrong? And does anyone knows how to proceed ?

Thierry.

do not use bpx, use bpr cs:begining_of_the_module_in_ram cs:end_of_the_module_in_ram R(ead) or (e)X(ecute)

when a piece of code is executed, it has to be read first!

Now BPR is not included in Sice versions 4.26 and 4.27
xor37h
10-07-2002, 11:05 PM
esther,

If you could just chill out, i DID NOT post a keygen, I posted a crippled none target specific peice of code that showed how one could do a keygen.

This post is not more incriminating than what you would be able to see in one of the numerous flexlm threads or so.

So mr-look-for-something-to-scream-and-shout-about, take a could shower...

Best Regards, xor37h
esther
10-08-2002, 01:37 AM
Hi ,
Why bothered if its a cripped skeleton


Neolite 2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Neolite 2
PDA

View Full Version : Neolite 2

Melvill
10-07-2002, 06:01 PM
Hi Guys

Some days ago I intended to do a small challenge that consisted manually unpack a program packed with Neolite 2.
Everything run well, i used a technique described by CoDe_InSiDe (my gratefulness) but the result was not the expected.
The unpacked file was perfect. I have changed 2 sections in Charecteristics C0000040 for E0000020. I executed the program but an unknown error " this program have done an illegal operation and it will be finished " and later another box appears with the error restrictions " This operation was canceled due to existent restrictions in this computer ".Can you tell me what's going one ? Why i can't run the app. with the unpacked file? Are there any antidesassembler protection?

Thank you
Melvill
foxthree
10-07-2002, 08:18 PM
Err...... when the unpacked program didn't run, how do you say that the unpacked program was "perfect"? U mean, you found the exact details written by Code_Inside for NeoLite 2?

Signed,
-- FoxThree
Melvill
10-08-2002, 09:03 AM
Sorry,

yes i found the exact details written by Code_Inside.I can disassembler with W32dasm with string ref. and strange address with many NOP's.

The App is CubaseDemoSX 1.02

thnks for any help to understand this protection

Melvill
foxthree
10-08-2002, 03:11 PM
Melvill:

Just dled it and unpaxed it and running fine. Why don't the Steinberg guys fix the crash when the app is shutdown? Oh well....

Okey, before we can help you:

(1) What was the OEP for the application you found?
(2) How did you dump the code from memory?

Signed,
-- FoxThree
esther
10-08-2002, 05:07 PM
Hi,
Maybe he didn't change the correct the OEP using peditor .Just my 1/2 cents :P
Melvill
10-09-2002, 01:07 PM
Hi foxthree and esther

Thnks for your help i had a mistake on EP. now works fine

Thnks guys


a forever farewell to vb nag screens
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > a forever farewell to vb nag screens
PDA

View Full Version : a forever farewell to vb nag screens

kathras
10-07-2002, 07:57 PM
hello all,
I wrote this tut cause of the countless newbies asking questions on the removal of nag screens from vb progs. Most of the time they are brushed off or are told to patch the dll's(for obvious reasons, this is undesirable)

I have been out of the thick of things for a very long time, so I am unsure of the procedures here... so I have removed the link for the program in the tutorial by posting it in a .txt file format to avoid any possible legal issues, but left the name of the program there. If there is a problem with the name being there I will remove it
Paul333
10-12-2002, 06:36 PM
EXCELLENT!!.....Thanks kathras ill keep this for futore reference:):)

paul333


just a bug in ds27 & W9X
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > just a bug in ds27 & W9X
PDA

View Full Version : just a bug in ds27 & W9X

Timbo
10-07-2002, 11:14 PM
the bigger winice.exe (not vxd/exe combo) file isn't
loading well because it's mapping to wrong place (for me)
e.g. "_vcomm_opencomm"
i'm getting a gpf but not with the exe&vxd combo

anyone knows why or knows how to fix ???


FLEXlm 8.1 once more...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXlm 8.1 once more...
PDA

View Full Version : FLEXlm 8.1 once more...

Zigmund
10-08-2002, 06:21 AM
I have simple question...
How knows ditaled syntax of GetHOSTID() function in FLEXlm 8.1?
I need to know input & out parameters...
tom_324
10-08-2002, 08:16 AM
D.1.18 lc_gethostid()
Syntax
hostid = lc_gethostid(job)

Description
lc_hostid() should normally be used instead.

Returns the hostid for the local host. lc_gethostid() is simply a call to lc_getid_type(default_hostid_type).

Parameters

(LM_HANDLE *) job From lc_new_job().

Return

(HOSTID *) hostid A pointer to the HOSTID struct, filled in for the current host, or NULL on failure.

--------------------------------------------------------------------------------

Note: The memory returned by lc_getid_type() is shared by lc_gethostid(), and both functions free this memory when called. Therefore, do not call lc_getid_type(), and then lc_gethostid(), and expect the first pointer to remain valid.

--------------------------------------------------------------------------------

Error Returns

LM_CANTFINDETHER Cannot find ethernet device. If this error is returned, a null HOSTID pointer will be returned. (Prior to v5, this was a NOHOSTID type, rather than a NULL pointer).

See Also
lmclient.h for the definition of the HOSTID struct


RSA Mini Project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > RSA Mini Project
PDA

View Full Version : RSA Mini Project

Bengaly
10-08-2002, 05:52 PM
since this little project need to teach us how to keygen/reverse the RSA rutines, iv decided to put this one here insted of the crypto forum.

i know some (as well me) dont know much about cryptosystem, but really well want to know and study it.

i have found a small Crackme uses RSA-24 (as the author says).

the task is to keygen it!.
but also to post messages about how it work,how to use the prime,and rsa parameters,what the crackme do and finally how to keygen and share sources.

there are pretty much well documented information about how RSA is being used and how to use it.

here is the RSA crackme:

http://lkubaski.free.fr/reverse/crackme/RSAcrkme10.zip

some docs can be found at crackz's site,and of course google.

ttl
Ben
foxthree
10-08-2002, 09:03 PM
Pretty interesting :)

Signed,
-- FoxThree
Bengaly
10-08-2002, 09:24 PM
========================
* Possible StringData Ref from Data Obj ->"9901"
|
:004029CD 68DC004200 push 004200DC
:004029D2 8D8C24E4000000 lea ecx, dword ptr [esp+000000E4]
:004029D9 E852E7FFFF call 00401130

* Possible StringData Ref from Data Obj ->"12790891"
|
:004029DE 68D0004200 push 004200D0
:004029E3 8D4C241C lea ecx, dword ptr [esp+1C]
:004029E7 C784246406000000000000 mov dword ptr [esp+00000664], 00000000
:004029F2 E839E7FFFF call 00401130

* Possible StringData Ref from Data Obj ->"8483678"
|
:004029F7 68C8004200 push 004200C8
:004029FC 8D8C2474020000 lea ecx, dword ptr [esp+00000274]
:00402A03 C684246406000001 mov byte ptr [esp+00000664], 01
:00402A0B E820E7FFFF call 00401130

* Possible StringData Ref from Data Obj ->"5666933"
|
:00402A10 68C0004200 push 004200C0
========================

i guess the first parameter is e, but for the others i am trying to see which ones from the number parameter it could be.
foxthree
10-08-2002, 09:53 PM
Yeah, I too think so. Till now what I've found is that the serial must be 14 chars long. Since it is RSA 24, the modulus must be 24 bits which means 3 bytes == 6 Hex digits. Damn, I'm unable to find anything that is 6 hex digits that can be used as the modulus :(

Shit what does these numbers mean: 12790891, 8483678, 5666933...

Signed,
-- FoxThree
ZaiRoN
10-09-2002, 12:24 AM
Hi Bengaly, foxthree!!!

nice project Bengaly :D

difficult to say what these values are but there is an interesting call in the check routine at 402ADB.
this call is called 2 times; it takes some params as input and returns a value.
the first returned value is compared with 8483678 and the second with 5666933

i have take a quick (time to go to bed :)) look at the call (call 402310) and i have found some nice informations in this call.
there are some numbers involved in this call:
- 7 chars from the serial
- 9901
- 12790891

there are also some operations:
call 401EB0: mod operation
call 401770: * operation

look carefully at 4023BD/4024CA cycle!!!
i suggest you to step this call using custom numbers; for example change 9901 to 5 and use the serial 00000020000003; that could help you to understand.

that's all for now...I hope not to have made errors!

'night.
ZaiRoN
Bengaly
10-09-2002, 09:25 AM
from what iv checked in this:

serial -> 14 chars long
24bit RSA Encrypto

parameters:
---------------
9901 ; possible E
12790891
8483678
5666933
---------------

there are 2 functions which will compute 2 diff numbers for each 7 chars of the serial:

example: 12345678901234
##################

function 1:
---------------
00402AB7 |. 8D5424 18 LEA EDX,[DWORD SS:ESP+18] ; edx = 12790891
00402ABB |. 8D8424 E000000>LEA EAX,[DWORD SS:ESP+E0] ; eax = 9901
00402AC2 |. 52 PUSH EDX ; /push 12790891
00402AC3 |. 8D8C24 0404000>LEA ECX,[DWORD SS:ESP+404] ; |
00402ACA |. 50 PUSH EAX ; |push 9901
00402ACB |. 51 PUSH ECX ; |Arg1
00402ACC |. 8D8C24 9C05000>LEA ECX,[DWORD SS:ESP+59C] ; |ecx = first 7 chars (1234567)
00402AD3 |. C68424 6C06000>MOV [BYTE SS:ESP+66C],4 ; |
00402ADB |. E8 30F8FFFF CALL crackme.00402310 ; \compute number
-------------------------------------------------------

after this function the value computed is:
5041268

function 2:
-----------------------------------------------------
00402AF4 |. E8 37E6FFFF CALL crackme.00401130 ; edx=8901234
00402AF9 |. 8D4424 18 LEA EAX,[DWORD SS:ESP+18] ; eax=12790891
00402AFD |. 8D8C24 E000000>LEA ECX,[DWORD SS:ESP+E0] ; ecx=9901
00402B04 |. 50 PUSH EAX ; /push eax
00402B05 |. 8D9424 CC04000>LEA EDX,[DWORD SS:ESP+4CC] ; |
00402B0C |. 51 PUSH ECX ; |push ecx
00402B0D |. 52 PUSH EDX ; |Arg1
00402B0E |. 8D8C24 4403000>LEA ECX,[DWORD SS:ESP+344] ; |ecx=8901234
00402B15 |. C68424 6C06000>MOV [BYTE SS:ESP+66C],6 ; |
00402B1D |. E8 EEF7FFFF CALL crackme.00402310 ; \compute number 2
-----------------------------------------------------

after this function, computed number is:
8483678

some final checks:
--------------------------
00402B4E |. 8D8C24 CC04000>LEA ECX,[DWORD SS:ESP+4CC] ; ecx=5041268
00402B55 |. E8 66F2FFFF CALL crackme.00401DC0 ; test serial
00402B5A |. 85C0 TEST EAX,EAX ; eax=1 ? -> bad
00402B5C |. 0F84 A3000000 JE crackme.00402C05 ; bad_boy
------------------------------------------------------------

i still can't figure out which numbers are:
N
P
Q
e could be 9901, but i may be wrong
D

comeone crypto freaks do some help!
Ben
ZaiRoN
10-09-2002, 04:08 PM
like Bengaly has said there are tons of paper about the rsa cryptosystem but for those who they are lazy (like me :p) here is some notes from rsalabs that could help you:
http://www.rsasecurity.com/rsalabs/faq/3-1-1.html

moreover, three interesting tutorials:
http://www.woodmann.net/crackz/Tutorials/Rsa.htm
http://www.woodmann.net/crackz/Tutorials/Rsalu48.htm
http://www.woodmann.net/fravia/goatass_rsa_tut.htm

and finally, the link for the last (!?!) tE!'s rsatool:
http://www.woodmann.net/forum/attachment.php?postid=18043

you should have all the necessary...

regards,
ZaiRoN
the_analyst
10-09-2002, 10:41 PM
Hello,

i wrote a tutorial about this crackme almost 3 years ago now :) (under my old nick acid burn)

h**p://www.woodmann.net/IDArchive/ID-RIP/database/essays/acid/rsa.txt

Yet it was not very very detailed, but i guess it could help :)
This crackme can't ben keygenned, since it doesn't work on the name IIRC.

Regards,

tHE ANALYST
ZaiRoN
10-09-2002, 10:54 PM
Hi the_analyst,
i have read this tutorial right now and i have found that is incomplete :p
nothing serious :)
the tutorial is very good but the serial is not the only one you have pointed out: there are three valid serials ...

regards,
ZaiRoN
the_analyst
10-10-2002, 12:42 AM
Hello,

The tutorial is old, i wasn't very experienced anyway hehe
Actually, there are WAY more than this ;-P

so, if one part is correct the serial is validated ;P
ie :

71676221234567 works
71676220031337 works
71676221122334 works
71676229874124 works etc..

but :

12345673196885 works
31337003196885 works etc..

Just my lil addon ;-)

Regards,

tHE ANALYST

Originally posted by ZaiRoN
Hi the_analyst,
i have read this tutorial right now and i have found that is incomplete :p
nothing serious :)
the tutorial is very good but the serial is not the only one you have pointed out: there are three valid serials ...

regards,
ZaiRoN
Bengaly
10-10-2002, 06:14 AM
yeah!

(7 Random nums)+Decrypted

or

Decrypted+(7 Random nums)

or

Decrypted+Decrypted

upto the second :)
ZaiRoN
10-10-2002, 08:12 AM
oh yeah!
my *three serials* were referred to the different patterns explained by Bengaly.
my mistake :rolleyes:

regards,
ZaiRoN


Good, fun, Cracking for newbies!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Good, fun, Cracking for newbies!?
PDA

View Full Version : Good, fun, Cracking for newbies!?

Manko
10-08-2002, 10:17 PM
Being a complete newbie with almost exclusively, only "crapprotections" on my throphy-belt, I must say I really enjoyed taking a crack at this target:

IP-Tools 2.08

The program might not be worth keeping, but it's nice to see, they at least (tried to make(?)/)made an effort to protect it! :)

If you take a crack at this one I'd be happy to receive statusreports, ideas, requests for help/hints or whatever!

But remember!
Test it thourougly, before you think you've succeded!
I have, and honestly don't know for sure if I did it. :)

/Manko
Manko
10-09-2002, 04:05 PM
OK, more info...

It's the usual Name/serial/timelimit thingie.

There is no correct serial to fish, instead it produces a longer portion of bytes from the name and serial respectively.
These are checksummed agains each other, and one or two places (forgot) are compared against each other.
There's also a crc-check.

The nice thing is that these are used later too... :)

If you press some of the buttons in the program you/it will cause access violations and tell you, you've probably used a cracked serial or the program was cracked.

I've managed to quiet it down, but I'm just waiting to be surprised. :)

There's a number of things I don't understand though, but I'll probably dig deeper too...

Hope someone else will be interested! ;)

/Manko
Iwarez
10-09-2002, 09:16 PM
The CRC was easy to find and to quiet down. The nag screen was also easy to kill. So, uhm, what's the problem? I must say that they did not really hide their CRC checking or their checkings on serial numbers. Anyway, it was a nice target to play with but not really difficult.
Manko
10-09-2002, 10:54 PM
Nope, it's not hard, it's just that I haven't run into this sort of thing before, and so there must be others that haven't and would benefit from doing this crack, or atleast find it amusing. :)
I know that almost all of you are WAY ahead of me... ;p

...but just to be sure...
Have you tried going into options and then get out?
And have you tried to run (start) the NB Scanner or the Port Scanner for example?

You probably have already done this and if so I'd like to hear how. Could you pm me? Maybe you have a much nicer solution than I had. :)

(Probably I cracked it some hard way, and came out thinking too much of the protection. I think he ought to have taken it further though. Because it was too simple, if I am finished...)

/Manko
disavowed
10-10-2002, 04:03 AM
Originally posted by Manko
These are checksummed agains each other, and one or two places (forgot) are compared against each other.

two
Iwarez
10-10-2002, 07:39 PM
Well, don't think I ain't a newbie. Sometimes there are things discussed here where I can only dream about (ASProtect and import table rebuilding, sometime someday but not for now).

The CRC routine I changed so that it would return the correct CRC so that any checks done with the result would work. I did indeed go to the options and tried all the buttons and all works well. I may add that the program doesn't think it's registered. It doesn't show the about box with my name or something like that. I only killed the CRC routine and the resulting nag that comes up every once in a while. Registering it was not the exercise I needed. I only wanted it to run correctly after I patched it and I wanted no nag screens.
hobgoblin
10-10-2002, 08:25 PM
Hi guys,
Maybe I have stared too long on this one, but I just can't seem to find the CRC routine. Anybodu wants to shed some light for me?
I've found the spot where the program checks the key-file, and can make the program look regg'ed. But as you say, tha'ts not enough. I did put a bpr rw on the area where I changed the code, but no luck so far in finding the CRC..

Mail me of you feel like it...

hobgoblin.
Manko
10-10-2002, 08:27 PM
to Iwarez,

Ahh! Oki. Well I ofcourse did the same with the crc.
I went on and forced some jumps and discovered I had to do something with the data the name/serial had produced.
(EDIT: Maybe I should not give away my solution? Might spoil things... Ask me if you like...)
...because of my sollution I'm not sure there's not a suprise come later down the road.
But I also suspect there IS no timelimit, to the effect of crippling/disabling the prog... Setting the clock after expiration does nothing I can see... Or maybe I only did that on my crack? Hmm... Maybe it just get more anoying with the nag?

Anyway... What makes me wonder even more is that the "elite" crackheads have put out loaders for v2.07. More than one group.
Haven't bothered to reverse them, but, why?!
Doesn't seem to be a need... Maybe we should check up on them?
Would be cool if there really was something missing in our cracks... Maybe it's just their response to the crc-issue though? :(

Wonder if the 2.07 is much different to 2.08?

Enough talk... Guess I should just go look. :)

/Manko
Manko
10-10-2002, 08:37 PM
Originally posted by hobgoblin
Hi guys,
Maybe I have stared too long on this one, but I just can't seem to find the CRC routine. Anybodu wants to shed some light for me?
I've found the spot where the program checks the key-file, and can make the program look regg'ed. But as you say, tha'ts not enough. I did put a bpr rw on the area where I changed the code, but no luck so far in finding the CRC..

Mail me of you feel like it...

hobgoblin.

The crc is only for the exe. I guess you didn't change it? Just the data from the computation on the name/serial? Or is there a keyfile needs to be made?
If so, you're most welcome to tell me more about it! :)

/Manko
Manko
10-10-2002, 08:51 PM
Originally posted by Iwarez
Sometimes there are things discussed here where I can only dream about (ASProtect and import table rebuilding, sometime someday but not for now).

Exactly how I feel. Maybe I could wing it with some good threads from here and some tutorial, but I almost don't feel worthy of trying yet! ;P
I need to take SOME time yet, learning to feel the code and use the programs and so on. Heck, I haven't even tried keygenning yet. :)

(hrm.. I better go get those loaders now... instead of lurking around this, admittedly, very fine establishment, writing nonsense... :P There's work to do!)

/Manko
hobgoblin
10-10-2002, 09:58 PM
I found it, and I found out how to get around the CRC check. I also found out a way to crack it. At least, that's how it looks.
I just needed to get away from the program for a while, then I saw the solution right away when I got back.....
You can make a fake keyfile, and then change a couple of jumps in the programs checking routine. That's how I started out. Later I discovered a simpler way to do it....:D

I just have to check it out to be sure.

regards,
hobgoblin
ZaiRoN
10-12-2002, 01:56 PM
in the past days i have take a look at this target. I have tried to understand how the serial check is done without success.
is there someone who has tried to understand how the serial check is performed?

here is some info for those who want to help me:
004ACC90 CALL IP_TOOLS.004236F4 ; returns the length of the registration name
004ACC95 MOV EAX,DWORD PTR SS:[EBP-8] ; eax -> registration name
004ACC98 LEA EDX,DWORD PTR SS:[EBP-4]
004ACC9B CALL IP_TOOLS.00407B88 ; moves the name in a new buffer
004ACCA0 MOV EDX,DWORD PTR SS:[EBP-4] ; edx -> name
004ACCA3 MOV EAX,EDI
004ACCA5 CALL IP_TOOLS.00423724
004ACCAA LEA EDX,DWORD PTR SS:[EBP-8]
004ACCAD MOV EAX,DWORD PTR DS:[ESI]
004ACCAF MOV EDI,DWORD PTR DS:[EAX+1F4]
004ACCB5 MOV EAX,EDI
004ACCB7 CALL IP_TOOLS.004236F4 ; returns the length of the name
004ACCBC MOV EAX,DWORD PTR SS:[EBP-8] ; eax -> serial you have typed
004ACCBF LEA EDX,DWORD PTR SS:[EBP-4]
004ACCC2 CALL IP_TOOLS.00407B88 ; moves the serial in a new buffer
004ACCC7 MOV EDX,DWORD PTR SS:[EBP-4] ; edx -> serial
004ACCCA MOV EAX,EDI
004ACCCC CALL IP_TOOLS.00423724
as you can see it performs the same operation for both name and serial.
004ACCD1 LEA EDX,DWORD PTR SS:[EBP-8] ; edx -> serial
004ACCD4 MOV EAX,DWORD PTR DS:[ESI]
004ACCD6 MOV EAX,DWORD PTR DS:[EAX+1F0]
004ACCDC CALL IP_TOOLS.004236F4 ; !?! don't know exactly !?!
004ACCE1 MOV EAX,DWORD PTR SS:[EBP-8] ; eax -> name
004ACCE4 CALL IP_TOOLS.0049578C ; is your name just registered!?!
004ACCE9 TEST AL,AL
004ACCEB JE SHORT IP_TOOLS.004ACD29
004ACCED PUSH IP_TOOLS.004ACF5C ; ASCII "Sorry, your registration name ("
004ACCF2 LEA EDX,DWORD PTR SS:[EBP-8]
004ACCF5 MOV EAX,DWORD PTR DS:[ESI]
004ACCF7 MOV EAX,DWORD PTR DS:[EAX+1F0]
004ACCFD CALL IP_TOOLS.004236F4
004ACD02 PUSH DWORD PTR SS:[EBP-8]
004ACD05 PUSH IP_TOOLS.004ACF84 ; ASCII ") is found on the "Black List".
the crackme does a check on the registration name you have typed. in the exe (starting from offset 0x947A0) i have found some *strange* strings. these strings are firstly decrypted to a real name and then are used to check if a name has been reused.
for example:
the second encrypted name is: Rrucsglgadnr ARyauykmnovnxds FMvodrerrits
the call at 49C7C4 converts it in the real name: Ruslan Raimond Morris
the decryption is very easy to understand...1° char: yes, 2° char: no, 3° char: yes and so on :)
the question is: who are these persons? i don't think that the proggie updates the file with new registered user; does it have not much sense!?!
bha... go on:
004ACD29 LEA EDX,DWORD PTR SS:[EBP-8] ; [edx] -> registration name
004ACD2C MOV EAX,DWORD PTR DS:[ESI]
004ACD2E MOV EAX,DWORD PTR DS:[EAX+1F0]
004ACD34 CALL IP_TOOLS.004236F4
004ACD39 CMP DWORD PTR SS:[EBP-8],0 ; the name must be != NULL
004ACD3D JE IP_TOOLS.004ACF0E
004ACD43 LEA EDX,DWORD PTR SS:[EBP-C]
004ACD46 MOV EAX,DWORD PTR DS:[ESI]
004ACD48 MOV EAX,DWORD PTR DS:[EAX+1F4]
004ACD4E CALL IP_TOOLS.004236F4
004ACD53 CMP DWORD PTR SS:[EBP-C],0 ; the serial must be != NULL
004ACD57 JE IP_TOOLS.004ACF0E
004ACD5D LEA EDX,DWORD PTR SS:[EBP-10]
004ACD60 MOV EAX,DWORD PTR DS:[ESI]
004ACD62 MOV EAX,DWORD PTR DS:[EAX+1F0]
004ACD68 CALL IP_TOOLS.004236F4 ; returns the length of the name
004ACD6D MOV EAX,DWORD PTR SS:[EBP-10] ; eax -> registration name
004ACD70 CALL IP_TOOLS.0049E07C ; hmmm...creates buffer1 using the name
004ACD75 MOV EDI,EAX
004ACD77 LEA EDX,DWORD PTR SS:[EBP-10]
004ACD7A MOV EAX,DWORD PTR DS:[ESI]
004ACD7C MOV EAX,DWORD PTR DS:[EAX+1F4]
004ACD82 CALL IP_TOOLS.004236F4 ; returns the length of the serial
004ACD87 MOV EAX,DWORD PTR SS:[EBP-10] ; eax -> serial
004ACD8A CALL IP_TOOLS.0049E118 ; hmmm...creates buffer2 using the serial
004ACD8F CMP DI,AX ; first check !!!
004ACD92 JNZ IP_TOOLS.004ACF0E
004ACD98 MOV EAX,DWORD PTR DS:[4E22CC] ; eax -> buffer1
004ACD9D MOV EDX,1FF ; 1FFh = 511
004ACDA2 CALL IP_TOOLS.0049E060 ; checksum on 0x1FF-0x0B bytes starting from buffer1
004ACDA7 MOV EDI,EAX
004ACDA9 MOV EAX,DWORD PTR DS:[4E21D0] ; eax -> buffer2
004ACDAE MOV EDX,1FF ; 1FF = 511
004ACDB3 CALL IP_TOOLS.0049E060 ; checksum on 0x1FF-0x0B bytes starting from buffer2
004ACDB8 CMP EDI,EAX ; checksums must be equals
004ACDBA JNZ IP_TOOLS.004ACF0E ; second check !!!
004ACDC0 MOV EAX,DWORD PTR DS:[4E22CC]
004ACDC5 ADD EAX,7
004ACDC8 MOV EAX,DWORD PTR DS:[EAX] ; takes a dword from buffer1+7
004ACDCA MOV EDX,DWORD PTR DS:[4E21D0]
004ACDD0 ADD EDX,7
004ACDD3 CMP EAX,DWORD PTR DS:[EDX] ; compare between two dwords from buffer1+7 and buffer2+7
004ACDD5 JNZ IP_TOOLS.004ACF0E ; third and last check!!!
easy to understand. there are some different checks.
the only thing we have to do is to understand how buffer1 and buffer2 are created.
there is something interesting at 49F9E6/49F9FF where creates the buffer1.

would you like to help me ;)

regards,
ZaiRoN


IDB 2 SIG for IDA Pro 4.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDB 2 SIG for IDA Pro 4.3
PDA

View Full Version : IDB 2 SIG for IDA Pro 4.3

darko
10-09-2002, 07:02 PM
---------------------------------
IDB to SIG
version: 0.03 beta 07.10.2002 18:14
---------------------------------

This is an update of Quine's "IDB to SIG" plugin.

1. Source code changed to match with IDA SDK 4.3
2. MS VC++ 6.0 project

New in 0.03:
- current functions are now appended to PAT file
- bug fix

0.02
- first release

Installation:
=============

DEFAULT idb2sig.plw IN THIS PACKAGE IS FOR IDA 4.3!
If you want to use it with some other version of IDA you have to recompile it.

a) Copy idb2sig.plw into IDA's plugin directory.
b) Add next line to plugins.cfg:

idb2sig_for_current_function idb2sig Alt-2 2

Use:
=====

1. Position at some function in IDA-Wiew
2. Press Alt-2
3. Enter file name
4. Process resulting pat file with sigmake
darko
10-13-2002, 09:41 AM
In the attachment....
Anticode
10-17-2002, 02:50 PM
could you be kind and provide binaries for 4.15 and 4.17?
darko
10-17-2002, 03:36 PM
I do not have IDA SDK for 4.15 and 4.17. If you have them, just set SDK include directory and IDA library and recompile the plugins. It is a 5 min of work.

darko
Anticode
10-17-2002, 05:04 PM
Yes, I know its no problem - If you have the SDK... :(
i thought since you have the 4.3 SDK you probably have 4.15 an 4.17 also
Maybe someone else here have the SDK and can build it? :confused:
darko
12-21-2002, 10:31 PM
---------------------------------
IDB to SIG
version: 0.04 beta 21.12.2002 23:10
---------------------------------

New in 0.04:
- bug fix for reference bad address
- last entered PAT file name saved as default for file dialog
darko
12-24-2002, 09:05 AM
I have no feedback from users on this plugin.
Any sugestion or a feature request?

darko
[yAtEs]
01-10-2003, 02:37 PM
this contains a UI too, heres the latest, havent looked
at the one above yet, i will do so later

http://www.reverse-engineering.info/idb_2_pat.zip

// IDB to PAT v1.0
// Plugin module for IDA Pro v4.30/IDASDK430
//
//
// * LICENSE/: Freeware / Public domain :-)

* The CCITT CRC 16 code written by Ilfak Guilfanov
* Portions were originally written by Quine


BigNum Calc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > BigNum Calc
PDA

View Full Version : BigNum Calc

Bengaly
10-10-2002, 07:57 AM
is there a calculator that can evolute an expression like:
i.e: (rsa)
(xxxxxxxxxx^xxxxxxxxx)mod xxxxxxxxx

or any big number expressions?
Artifex
10-10-2002, 09:17 AM
Hi, Bengaly.
You want to compute c = x ^ y mod z.
With Jason Tiscione's Big Calculator you can compute a = x ^ y,
then b = a / z, then c = a - (b * z).
address :
h**p://www.geocities.com/SiliconValley/2548/

other solutions :
1. write a few lines of Java.
2. or C using Miracl library
3. or UBASIC 8.8e - A free Basic interpreter with fast multiprecision arithmetic
4. or Maple (demo version)

Artifex
Bengaly
10-11-2002, 05:11 PM
thnx artifex,

iv wrote a quick RSA bignum calculator using miracl lib, no need to waste time on searching some other calculator.
Artifex
10-11-2002, 07:27 PM
Hi, Bengaly. The C prog with the Miracl library is a good option.

You have also a Modpow(a,b,n) function in UBasic.
Here is a link :
h**p://jacobi.math.wvu.edu/~mays/545/UB/UBASIC.htm
h**p://jacobi.math.wvu.edu/~mays/545/UB/ub32i88f.zip

It is worthwhile to test it.

Artifex


Problems when patching an executable
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Problems when patching an executable
PDA

View Full Version : Problems when patching an executable

kranz
10-10-2002, 08:25 AM
Hello all,

This is a strange problem I've been having. I used SoftIce to reverse a small application and to make in-memory changes. Everything seemed to work, so I noted the required changes, and went ahead to patch the file. But when I ran the executable, after applying the changes, it crashed precisely when executing the code I modified. I should note that the file isn't packed, and that I patched it with a hex editor.
I double checked everything, and even disassembled the file with Wdasm to make sure the changes were correct. But still, it crashes.

I have come up with one possible explanation. The changes I made included adding code right after the last instruction in the file, and a call to that location. It was initially zero filled, and Wdasm showed it as part of the code, so I figured that I could overwrite it. Is it possible that the app crashes because it tries to access code that isn't inside a valid code section?

Any help would be greatly appreciated. TIA.
NervGaz
10-10-2002, 10:07 AM
Did you remember to NOP out suff that was left behind (remaining parts of the code changed if any)... otherwise the CPU will try to execute invalid opcodes and you will crash... just a thought...
neviens
10-10-2002, 11:47 AM
Have you corrected PE header (Virtual & File size of executable section), to include your new code?
Neviens.
kranz
10-10-2002, 12:29 PM
NervGaz:
Yes, I did that, and it ran perfectly well when I edited it in memory.

neviens:
That's the thing exactly, I didn't extend any section. There was just some unused space at the end of .text where I inserted my code, so I didn't have to update the PE header.

UPDATE:
It seems that the crash doesn't occur at the new code, but rather at some completely unrelated part of the app. I get a page fault which normally doesn't happen.
Again, I made the exact same changes to the code, first "live" and then to the file, but when I run from disk it crashes. Any thoughts?
the_analyst
10-10-2002, 12:58 PM
Checksum ? CRC ?
naides
10-10-2002, 01:04 PM
Originally posted by kranz
NervGaz:
Yes, I did that, and it ran perfectly well when I edited it in memory.

neviens:
That's the thing exactly, I didn't extend any section. There was just some unused space at the end of .text where I inserted my code, so I didn't have to update the PE header.

UPDATE:
It seems that the crash doesn't occur at the new code, but rather at some completely unrelated part of the app. I get a page fault which normally doesn't happen.
Again, I made the exact same changes to the code, first "live" and then to the file, but when I run from disk it crashes. Any thoughts?

Correct me if I am wrong: You make the changes when the prog is already loaded in memory, using Sice, and it works fine, but if you make the changes on disk the program crashes, in a different section of the code with a page fault?

Smells to me Some thing wrong is happening during the early stages of the program, i.e, program loading, like a CRC check, or code alignment, or decoding stuff, that you bypass when you load the program in memory and modify the bytes later.

I would try this approach, Listen carefully:

Load your program in Sice symbol loader and make it stop at winmain function: This will load the program and place a breakpoint at the program entry point. When Sice breaks, place bpm's on the addresses of the bytes you modify, and try to fish out the part of the code that reads those bytes early during the program initial stages.

When you find it, deactivate or correct what needs to be corrected.

Also, the 0's you see at the end of the .text section where you placed your extra code may be used at an early stage of the program, either wrongly reading or overwriting some of your bytes.

Just a suggestion.
Artifex
10-10-2002, 06:27 PM
Another possibility :
when you debug with Softice it puts CC (= int 3) opcodes where you want breakpoints. When you exit from Softice it replaces the CC's with the original opcodes.
Sometimes (depending on how you exit from Softice) the replacement is not made and the remaining CC's cause a crash.

A good precaution is to debug with a copy of the prog, and then patch and run the original prog.

My 2 cents.
Artifex
figugegl
10-10-2002, 11:23 PM
i've had the same problems with some upx'ed programs. usually you can insert your own code where it jumps to the oep, but sometimes this wouldn't work, even though the space seems to be unused. in such a case i end up searching for another free spot, which normally isn't hard to find.

i haven't looked deeper into it, but i was wondering why...
kranz
10-11-2002, 12:19 AM
Thanks for all the replies.

I thought of a checksum myself, but it seems a bit unlikely, becuase (as maybe I should have mentioned earlier) the crash doesn't happen at startup. It doesn't happen after a fixed amount of time either.
Still, I will try naides' method, maybe it will give me some new insight.

Artifex, I did patch a fresh copy of the app.

I will report back if I find the cause to this.
kranz
10-11-2002, 11:41 AM
Apparently it was a CRC check. I guess it is calculated at startup but compared only later. Anyway, I wrote a small proggie to change the values after the executable is loaded, and now it works.
Thanks for the help.


smartcheck easter egg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > smartcheck easter egg
PDA

View Full Version : smartcheck easter egg

disavowed
10-10-2002, 08:35 PM
this is pretty cool, i had never known about this before (yes, it works, i tried it): http://www.eeggs.com/items/13892.html
Paul333
12-25-2002, 02:39 AM
COOL!!..Just shows you what you can find..Who finds these things anyway??..lol

paul333
disavowed
12-25-2002, 06:32 AM
assuming it wasn't a numega person who leaked the egg, it was probably found like this:

looking in smartcheck's directory, one can see that SCBCE.DLL is unusually large (over a meg). checking it with a resource editor shows the avi easter egg. and further, checking its exports, we see one and only one function: ShowEgg

looking in SMARTCHK.EXE, we see ShowEgg at 401720h, proc-gotten and called in the function around 409934h (originally called by a message translator when you double right-click in the about dlg box). to call ShowEgg, it verifies that the mouse is over the bulb icon (PtInRect at 409918h) and the keystates (shift+ctrl makes [ebp+8]=0Eh for tests at 4098efh and 4098f5h).

tada :rolleyes:


Debugging java byecode
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Debugging java byecode
PDA

View Full Version : Debugging java byecode

chitech
10-10-2002, 09:44 PM
Alo everbody.

Anyone know a good program that can debugging java bytecode realtime. Something like Softice from compuware.

The program must showing java bytecode and not assembler (softice).

Thx

Chitech


checking correctness of flexlm license
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > checking correctness of flexlm license
PDA

View Full Version : checking correctness of flexlm license

ferg_jl
10-11-2002, 11:58 AM
Hi,

I have recently been studying modelsim 5.6d and have exctracted what I belive are the correct seeds. So I generated a license and everythign seems to be fine, except the simulator crashes when I try to certain operations. This puzzled me, is this something to do with the license or the setup of the simulator??

So I got a known good license and crypted it using my seeds. The keys on the feature lines are not the same!!!..

My question is two license files with the same seeds are generated at very different times have the same keys??..

If they will have the same this means that I have the wrong seeds or modesim is doing an extra level of encryption, I have already traced all the calls to lc_set_attr and it does not use crypt filters and nothing else that looks like it is using anything extra.

Am I missing something? ..Has anyone had any experence will modelsim?...Is there something else I need to look for

BTW modelsim is using 6.1g

Cheers

J
Avalonder
10-12-2002, 06:33 PM
Hi ferg_jl,

i've had problems too, when i moved from 5.6b to 5.6d. The feature line keys are generated with verfmt 5.1, so they have encrypted the start date at four positions in the key. If this start date is not equal to that of your known good license, the keys will differ. If you omit the start date in the license (source) file, lmcrypt will use the current date. MSIM 5.6d checks the start date range, also license duration (permanent isn't possible any more with floating licenses) and the host id can't be of type ANY. For example a license source line should look like this:

FEATURE featurename vendordaemon 2002.08 end-date 10 start:01-oct-2002

After crypting this line, the start date is encrypted in the key. You should study the range checks, and find out the correct bounds for start date, end date and also version number. Look in routines (vlm.exe) where lc_auth_data is called. When you take care of this checks in your license file, most problems should be solved.

BTW there is still another problem with 5.6d and the LEON project. The simulator crashes in iu.vhd. This problem can be fixed, when compiling the project with vcom from 5.6b. This can be a bug in vcom, because it dosn't use flexlm anymore, but may be also, that vcom checks for certain entries in some *.ini files, and when missed them, vcom restricted the memory usage to the evaluation version.
ferg_jl
10-13-2002, 08:25 PM
Thx, thats done it.

J


how to show the module size
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > how to show the module size
PDA

View Full Version : how to show the module size

spiderman
10-11-2002, 04:59 PM
hi,

I think, in softice, there must be a command that can show the size of one specified module being used. however, I didn't find it. would you please tell me?

thank you
Kayaker
10-11-2002, 07:19 PM
Hi

MAP32 <taskname> will give you a section map of a process, then calculate the size by subtracting the base address from the relative ending address of the last section.

QUERY <taskname> will give you the entire virtual address map of a process, then you could calculate the size by adding just the committed regions of the module itself.

The MAP32 command is probably the easiest, can't think of any other way offhand.

Kayaker


w32dasm winxp problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > w32dasm winxp problem
PDA

View Full Version : w32dasm winxp problem

IcedSoul
10-11-2002, 06:05 PM
Hi,

under WinXP I get some weird code from w32dasm.
Have anyone an idea, how to display the normal code ??

Many thx
Greetz
IcedSoul

hxxp://mitglied.lycos.de/animeboard/Image1.jpg
kathras
10-11-2002, 06:28 PM
try changing the default font. Some downlods of w32dasm have some weird fonts selected as default. This should fix your problem.
triz-
10-11-2002, 06:35 PM
Your font is simply set to either Symbol or Wingdings (don't recall which). The same thing happened to me once after downloading it. :) Change your font and you're good to go.
IcedSoul
10-11-2002, 06:39 PM
Thanks !!

Now it looks great... ;)

Greetz
IcedSoul


Windows Command Keyfile
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Windows Command Keyfile
PDA

View Full Version : Windows Command Keyfile

squidge
10-12-2002, 11:40 AM
I'm sure most of people using this board either use or have heard of Windows Commander. We all know it's kinda easy to patch the program to be registered even though it's a compressed/crc checked proggy.

However, I'm not interested in cracking the program. But whilst I looked at the latest version I looked at something I've never bothered looking at before - the wincmd.key loading and checking routine.

Now, this seems like a great key file function, and looks well protected with it's encryption from a glance. Is anyone else interested in trying to find out how it all works ?

[Mod: If this is in the wrong forum, please move it]
Solomon
10-12-2002, 03:51 PM
maybe its unbreakable RSA, according to some warez releases NFO file.
squidge
10-12-2002, 06:49 PM
ahh, public key encryption, with the decrypting key in Windows commander, and the encrypting key firmly in the hands of the author ?

Kinda shoots down the thread a bit...


Armadillo dumping
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo dumping
PDA

View Full Version : Armadillo dumping

LaBBa
10-12-2002, 06:43 PM
hi all

well i know that all ppl will tell me to use the latest arm_killer

dumper to do that ... but i wish to lern how to do that manualy

so if any1 can help me with that plz do ...

i know alredy the OeP thingy and all others tricks so just the
dumping part is missing every time i try to dump it it get fucked
up with a mem errors etc...

tnx
Uradox
10-13-2002, 06:22 AM
If you use the search feature on this board your results will be fruitfull. There has been plenty of posts on this in the past so you should find all the information you want, allready here

Uradox


Does there tools to spy Hardlock-Server exists?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Does there tools to spy Hardlock-Server exists?
PDA

View Full Version : Does there tools to spy Hardlock-Server exists?

cleaner
10-14-2002, 04:16 PM
Hello everybody,

Are there known Tools (except testapi.exe) for monitoring/spying a Hardlock Server over network?
DakienDX
10-14-2002, 06:37 PM
Hello cleaner !

You must be a bit more specific to get an answer.

I suppose you don't simply want a dump from the TCP stack of the Hardlock Server.

What do you want to do exactly?
cleaner
10-14-2002, 07:35 PM
Originally posted by DakienDX
Hello cleaner !

You must be a bit more specific to get an answer.

I suppose you don't simply want a dump from the TCP stack of the Hardlock Server.

What do you want to do exactly?

Hello DakienDX!

Thx, for your reply!
Well, my problem is a Programm (called MIPS) which is protected by Hardlock. Cause i'm really new to reversing, i was stupid enougth to tryed to unprotect this program and thought that it could as easy as following the code with a debugger to the specific position were i have to make some changes to get the programm running... but i had no luck. After a while i recognized that MIPS is using a DOS Hardlock-protection (from 1995, i guess.. cause the programm is that old) Well.. after consulting the homepage of aladdin, i was really upset that hardlock also uses code encryption and so on... far out of my ability. I don't know, if my target program is using code encryption, but i guess it does.
After some more exploring of the internet, I've found a tool, which is able to readout Hardlock Dongles, but this was no goal, cause i don't have direct acces to the dongle. But an idea grew up...(So far the history :/ )
For information, i have access to an intranet (in school), where the program (MIPS) is used with an Hardlock-Server-Solution.
So i thought, that there must be a program, which can cheat the Hardlockserver, to let the server think that it handles with the real application. Maybe there are possiblities, like outreading the dongle or recovering the encryption-key, or what ever... i even don't know or believe of the existing of such software, but maybe you know.

Thats it.
DakienDX
10-14-2002, 10:17 PM
Hello cleaner !

The first problem is already solved, you have access to the dongle (even if it's only over network). This makes the difference between "impossible" and "possible" to remove the dongle check.

I don't understand how you want to "cheat" the Hardlock Server. Do you want to run a modified copy of the program in school or do you want to run it without the dongle at home?

You can forget about recovering an encryption key or reading out the dongle.

The next question is if the program is protected by the object or the shell method. Shell means the whole application is wrapped with dongle code and it will be only executed with the correct dongle available. Object means the application calls some functions to check if the dongle is present. In the object method it might not necessary use the Hardlock encryption, which makes it possible to patch it to run without the dongle.

Since you said you're new to reversing it might be a problem. You will only find help here if you need it, nobody will do your work. So you have to learn reversing yourself. This brings two additional problems with it. Problem one is that you must learn DOS reversing which isn't an easy task and problem two is that you might have to do the reversing in school.

I don't think your teacher likes it if you install a debugger in school. ;)
cleaner
10-15-2002, 03:45 PM
Hello DakienDX!

Because i don't know, how to go on with that problem, i was searching the internet for tools. When i found the Hardlock Dongle Readout Program, i was thinking that somewhere maybe a program exists, which can retrieve information from the hardlockserver by authorisating itself, to be itself the REAL Application that just wants to check, if the dongle is set all right.

So that was just the idea... but the more i go into it, i think i should better keep away from it. So don't waste up your time with it.

Thank you anyway!
squidge
10-15-2002, 10:49 PM
It seems that what you are trying to do is to EMULATE the dongle on a PC that does not have the dongle, correct ?
cleaner
10-16-2002, 08:50 PM
Originally posted by squidge
It seems that what you are trying to do is to EMULATE the dongle on a PC that does not have the dongle, correct ?

Hello squidge!

Yes, in that way you're right! But i have no software to do so, nor to read out the dongle over network.

Because i don't have the nessesary skills to code such a program i give up on this problem : (
Woodmann
10-16-2002, 10:37 PM
Howdy,

You can learn this. Check out CrackZ pages listed below.
It should help you greatly to understand what you want to do.

Peace, Woodmann
squidge
10-16-2002, 10:49 PM
It would be near impossible to emulate the dongle fully, but by the true nature of the dongle, they use some quite complicated algorithms, plus parts of which can be replaced by the user program. However, considering the fact that the program itself must know what to send the dongle, and what to expect to receive, the program is the insecure part here.

Don't try and sniff the network traffic however, it's bound to be encrypted using some time dependant functions, so will be changing constantly to prevent this kind of sniffing. You need to get to the source - find out what talks on the network to the dongle; is it the main program or a seperate part? Once you have that you can begin building a lookup table of requests and expected responses, which you can then either build into a dongle "emulator" (obviously will work only with this program) or supply the results directly to the program by patching.

If the programs code is indeed encrypted, then it must decrypt itself into memory before running, so try TR on the program and see if you can find the program entry point. Then you can dump out an unpacked/decrypted version of the program and find out exactly what it is doing.

The give away signs here once the program is decrypted is pretty much the same as a lot of current Windows programs - error messages. The authors of some software still seem to be following down the age old method of dongle checking:

if (CheckForDongle()==FALSE)
{
ErrorMessage();
exit;
}

Therefore, locating the error message leads you directly to the actual dongle code in many cases.

May the force be with you :cool: :)
tgodd
10-20-2002, 06:50 AM
Full Blown emulators do exist for the hardlock.
And as for reading out the seeds; that is also possible.
DakienDX
10-20-2002, 10:30 AM
Hello tgodd !

Hardlock emulators are supposed to exist. You can buy then for $500+ on some shady russian internet pages.

And these emulators are not for DOS.

Just for your information, a Hardlock doesn't have anything like a "seed". So talking about reading out Hardlock "seeds" is like talking about what broadcast stations you can receive with a clothespin.
tgodd
10-20-2002, 03:38 PM
The first hardlock emulator was available from Canada in the early 90's.

And yes it does not have seeds in the conventional sense.

But there are 3, 16 bit values which make up the Algo unit.
Thes 3 values can be determined by reading the lock device and doing a back calculation.

With a good knowledge of the hardlock, the 3 values can be determined within 30 seconds.

Trust me you are WAY out of your league on this one.
:D
DakienDX
10-20-2002, 06:44 PM
Hello tgodd !

If there was a Hardlock emulator available, why was it never made public?

The Hardlock encryption is quite simple. You send some data to the Hardlock, it encrypts/decrypts the data and sends it back. The algorithm itself is unknown. (expect perhaps to some people opening the Hardlock and getting it directly from the Hardlock)

A Hardlock has a ModuleAddress (16-bit value), which is really no secret (every program using the Hardlock must pass it to the Dongle).

And there is a 48-bit secret key, which is assigned for you by Aladdin. They press it on your personal Hardlock programming card and only they know the 48-bit value, not even the company using the Hardlocks for protection.

So you must have a programming card for Hardlocks, a Hardlock and you must know how to change the 48-bit key of the card.
I don't think Aladdin will tell you how to change the key on your own or give you the same key as any other company. ;)

Could you explain me what 3 16-bit values "make up the Algo unit"?

If you're referring to the 48-bit key as 3 16-bit values, what would you have than?
I doubt you can read it out (I may be mistaken), if you could, you would need physical access to the company's computer programming the Hardlocks (not just a original Hardlock).
Then you would need to know a way of "pressing" the key on your own programming card (supposing you have one).

Then you could makes your own "original" Hardlocks, but to emulate them you must know how a Hardlock works internally and how it uses the 48-bit key. (or your 3 16-bit values)

This is what I know about Hardlock, you can tell me if I missed something important. I would also like to know what's so special about the three misterious 16-bit values.
(if you don't want to make it public, you can also send me a PM)
tgodd
10-20-2002, 08:15 PM
SafeKey formerly Safesoft systems has had an emulator for the hardlock since the early 90's. They send out a reader which reads absolutely everything inckluding the 3 16-bit values from the algo unit.

As a matter of fact the Hardlocks can be reprogrammed using just the programming board which they send to their Clients who purchase their locks. The board does have to be slightly modified however, and *special* software written to program the locks.

Nothing is needed to read the lock except the lock device itself.

If you do not beleive me, then try getting a hold of the safesoft emulator and reader software, and see for yourself.
tgodd
10-20-2002, 08:18 PM
I wrote the reader so I know....

:D
tgodd
10-21-2002, 03:35 PM
Sab,

Clear out your private messages.
I can not respond.

Regards,
TGODD
Sab
10-21-2002, 11:55 PM
right back at you (: Your mailbox full.
tgodd
10-22-2002, 12:19 AM
;)
oops.


Anti-Smartchk? ImageHlp.dll... int3? what?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Anti-Smartchk? ImageHlp.dll... int3? what?
PDA

View Full Version : Anti-Smartchk? ImageHlp.dll... int3? what?

Manko
10-14-2002, 05:55 PM
I don't get this.

I try and load a couple of programs and run them through smartcheck. Not VB. Just to see how much it reports and if and when it can be good to use anyway.

More than one app has presented me with the following situation.

It doesnt really report any events. the count is on maybe13, but nothing more happens except in the "loader" window it shows Imagehlp.dll being loaded and unloaded for eternity... Hmm...

I've changed the window name and id of smartchk.

Is this some normal anti-debug? Haven't done any studying on those yet. Don't find anything on the net, probably I'm just not finding the right words to search on...

Any ideas?

/Manko
Aimless
10-16-2002, 03:59 AM
What you are probably encountering is a Smartcheck breaker executable. Just as Softice is easy to be detected, its also easy to detect Smartcheck.

In order to override these, you must first find out HOW smartcheck gets detected. Smartcheck generally runs itself and from within itself, runs the program to be monitored. This implies that the program can check for smartcheck executables, .SUP files and the like.

Try searching for "Ryan" minus the quotes and you will get an idea of the same (some smartcheck tips too...). If you write to him and are polite, maybe he will even tell you how to do it.

Have phun, always.


Help needed !!! [cep2reg.exe]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help needed !!! [cep2reg.exe]
PDA

View Full Version : Help needed !!! [cep2reg.exe]

GEnto
10-14-2002, 05:56 PM
Hello, Im trying to know what is the pass generated in cooledit pro 2.0. The soft to register is cep2reg.exe. I usually use w32dasm89 to patch.

This is not a crack request. Is only a idea request.

Im blocked, Can anybody tell me one idea to attack this soft.?

I use SendDgitemtextA to break in softice when the window is shown.

The name and key character are taken by cep2reg.exe by one on one. (hmemcpy). I think that the cmp is made when i introduce one caracter.

his soft extract archives into windows temporaly folder. [GLCxxx.TMP and GLFxxxx.TMP]

Im trying to jump the register window, but i think this not work.

Thx everybody. [Sorry for my bad english, Im spanish one]
DakienDX
10-14-2002, 06:25 PM
Hello GEnto !

Since this is not a crack request as you say, but an idea request, I'm giving you the idea.

Forget about hmemcpy, if you find something using this function you'll probably end up somewhere deep in the setup script interpreter.

There is a nice DLL extracted into your TEMP folder, which exports some nice functions with some nice names like GetSubVersion, CEGetVersion, CheckFile, BigIniRead, BigIniWrite, VerifyPassword, ConvertRegCode, GetCDInfo and VerifyPasswordEx.
It would be a nice idea to look at the nice functions.
It would be even more nice not to bypass the the registration window, but to find a name/serial combination so that you don't need to bypass it. Else you might wonder yourself what the nice window telling you about an invalid registration is doing on your screen when you start the program.

And because I decided to be nice I'm not telling you that you need to be able to read at least something before using warez.

Isn't this nice? ;)
GEnto
10-14-2002, 07:01 PM
Hello, lots of thanks.

I have found them, with w32dasm, FileINspector XL . (I have not seen them because are exported functions, umm stupid !!!)

I dont know how to use them, ill try anything.

Thaks again for your faster and goodest answer.

Bye from spain.

PD. Yes its very nice...
Guybrush
10-15-2002, 06:13 PM
Just to let you know, it's possible to register cooledit 2 pro without the cep2reg.exe, and it's more challenging too :D

I succesfully wrote a (bruteforce)keygen for it, it's still somewhere on my hdd i think :cool:
GEnto
10-15-2002, 06:39 PM
:confused: Hello, at this moment I dont know how to load the exported f() on softice.

Force brute?

:confused: But you need to know what is written in the windows registry. Name, Number and NumberViewed.

I never haven't used a furcebrute keygen.

Do you need to open cooledit, every time a number is forcebrute generated?
Guybrush
10-15-2002, 07:19 PM
when cooledit is started it checks your name and key in registry, if they are correct then you are registered, simple as that.

i wrote a bruteforce keygen because i think the algo that checks the key with username cant be reversed easily.
GEnto
10-15-2002, 10:15 PM
Hello, yes i know that checks name and key in registry. I have one name/key correct, but I want to take another one name/key and how it works.
Woodmann
10-15-2002, 10:51 PM
OK,

I think I know what he is trying to say.

He has a valid registration, he wants to see how
to make a new one by looking at what the prog does
with his valid one.

I think the problem is that GEnto thinks that the registration
process is passed in a plain text sort of way. This is why he cant see how his valid license is passed.

Yes/No ?

Peace, Woodmann
squidge
10-15-2002, 10:58 PM
I've not used this software, but since a few nice functions are exported from one of the files (VerifyPassword, ConvertRegCode, GetCDInfo, etc) then I would look for any other files in the distribution that uses these functions to try and find out the parameters for them and what they return, and then write my own program to use them. If you find a routine in there for verifying a key/name pair, then you can disassemble that routine to find out how it works, or write a bruteforce key-gen (assuming you know the format of the key/user entry of course).
GEnto
10-16-2002, 12:17 AM
Hello

Thanks for everybody.

Yes Woodmann I mean that. (sorry for my bad english)

I am not looking for all the pass on memory.

I think that the key is checked by a simple comparation of the characters.

For example: take 1st caracter -> cmp, take 2nd then cmp, and ....

I mean one by one caracter.

If anyone has any idea, plz post it.

Again thanks to everybody.
Woodmann
10-16-2002, 12:50 AM
Howdy,

There is a nice DLL extracted into your TEMP folder, which exports some nice functions with some nice names like GetSubVersion, CEGetVersion, CheckFile, BigIniRead, BigIniWrite, VerifyPassword, ConvertRegCode, GetCDInfo and verifyPasswordEx.

Squidge and Dakien have great ideas where to look.
Now you have to figure out how to understand just exactly how
the process works. Anymore information and it becomes someone else doing your work.

Peace, Woodmann


Patch for DriverStudio to fix problem of Symbol Loader not breaking at WinMain
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Patch for DriverStudio to fix problem of Symbol Loader not breaking at WinMain
PDA

View Full Version : Patch for DriverStudio to fix problem of Symbol Loader not breaking at WinMain

Kayaker
10-14-2002, 10:25 PM
Hi All,

Well, after some digging into the bowels of winice I found the source of the problem of why the DriverStudio versions of Symbol Loader don't break at WinMain. Rather than patching winice I found a spot to set a flag in Nmtrans.dll instead. I'll detail what's going on later, so it can be adapted to other DS versions, but for now I just want to make sure it works for others as well.

This patch is ONLY for the DS2.7 Nmtrans.dll version, file date 6/20/02, file size 544,853 bytes. I was working on Win98SE but I hope it works on Me and XP as well. Lemme know if it's OK...

EDIT: Updated patch compatible with all DS versions is in a later post.

Kayaker
naides
10-14-2002, 10:46 PM
Mr canoer, I am very proud of you and thank full for your efforts. your fix works for me in DS 2.7 winXP. I will let you know about DS 2.6 and W2000 in a few hours.
( I will try to understand what you did to DS2.7, that is what I mean)
Manko
10-14-2002, 11:43 PM
Patch is ok on win2k! :D
Great work!
Looking forward to the explanation. :)

/Manko
Kayaker
10-15-2002, 01:07 AM
All right, cool. It's a simple 3 byte patch, though the reason behind it is a little more involved. I'll explain some of the winice stuff later, but here's the patch point, which is universal in all versions of nmtrans.dll. Where the difference lies in DriverStudio is within winice.exe itself, but patching this takes care of that. The checkbox feature to turn breaking on WinMain on or off still seems to work as well.

Original:

:1001CD7A 25FFFF0000 and eax, 0000FFFF

:1001CD7F 50 push eax
:1001CD80 8B4DDA mov ecx, dword ptr [ebp-26]
:1001CD83 51 push ecx
:1001CD84 8D55B0 lea edx, dword ptr [ebp-50]
:1001CD87 52 push edx
* Reference To: nmtrans.DevIO_SetWLDRBreak

Patched

:1001CD7A B801000000 mov eax, 00000001 ; Patch

:1001CD7F 50 push eax
:1001CD80 8B4DDA mov ecx, dword ptr [ebp-26]
:1001CD83 51 push ecx
:1001CD84 8D55B0 lea edx, dword ptr [ebp-50]
:1001CD87 52 push edx
* Reference To: nmtrans.DevIO_SetWLDRBreak

Actually, I'll fix the patcher so it's universal for all DS versions, give me a few hours...
Snatch
10-15-2002, 04:13 AM
Well its about time someone figured this out congrats Kayaker! Some information on why eax = 1 is better than eax = 0 - ffff would be interesting and what eax represents here not to mention what the value typically is when it doesnt work and how it gets set in the first place hehe. Very nice work though its about time DS 2.7 works completely :)

Snatch

Edit: Well silly me I forgot to tell you that it worked and on WinXP Pro with SP1
hobgoblin
10-15-2002, 04:35 AM
nicely done.:-)
Unfortunately it didn't work on my system. (DS 2.7, and correct nmtrans.dll, winXP Pro with sp1 installed),

I have just tried it on WinME, still no luck. When I put a breakpoint on the adress where nmtrans.dll has been patched, softice doesn't even break. A possible solution or explanation would be nice...
Do you guys have symbols loaded in the loader when you run it? I have that on the XP system, but not on the WinmE system. Either way, Sice doesn't break at programstart.

All kinds of input will be appreciated...:)

regards,
hobgoblin
lownoise
10-15-2002, 06:56 AM
Very nice:) ,

Congrats to you kayaker.
For me its working great on windows XP corp with servicepack 1

lownoise
backeyes
10-15-2002, 12:19 PM
congratulations : nice one m8

works for me on win 2k sp3 ! many thanx

regards
JimmyClif
10-15-2002, 08:14 PM
Cheers,

I'm off to buy XP and DS 2.7 to test it... (;))
disavowed
10-15-2002, 11:57 PM
Originally posted by JimmyClif
Cheers,

I'm off to buy XP and DS 2.7 to test it... (;))

jimmyclif, ltns
UrgeOverKill
10-16-2002, 12:40 AM
cool!, thanks and nice job !!
UrgeOverKill
10-16-2002, 12:42 AM
sorry, forgot to say its working fine on 2.6....
Kayaker
10-16-2002, 02:33 AM
Shucks, if I had known it was going to be so popular I would have made it shareware! Oh hell, who am I kidding? With this audience? ;-)

OK, here's an updated patch which *should* be universal for all DS versions. It does a byte scan for the unique string immediately after the patch point
50 push eax
8B4DDA mov ecx, dword ptr [ebp-26]
51 push ecx
instead of using an absolute offset. This code is identical in DS2.7 and SI4.05, so I'm assuming it is for everything else in-between as well. Please let me know if you find otherwise or it doesn't work.

I also changed the patch itself slightly from the earlier one. Either instruction patch works OK, this 1-byte patch is just more 'logical' as you'll see, no need to update it if you don't want to. This updated file also contains the *brief* explanation to follow, as well as the patcher source if anyone cares to look at it.

Hobgoblin, I hope you can sort out what the problem is, hopefully comparing system notes with others might solve it. If not, and if you like, we can go through the Softice code and see if it's taking the proper "path", at least through this part of the code. I've got all the jumps and such logged, plus the proper way to get into the code, so we might be able to at least eliminate one source of the problem...

To Snatch, Oh Ye of the inquiring mind and many questions :-) I don't know if this explanation will answer all your queries. Perhaps a reversing + results session is in order. The good stuff starts with NmSymLoadExecutableEx where the PE file is mapped into memory and the entry point found in a usual manner. Let us know what you find ;)

JimmyClif, you will let us know the "official" reason for DS not breaking at WinMain then? ;p

OK, here's the new patch, do what you like with it.
Kayaker
10-16-2002, 02:42 AM
And the explanation:

Ever since the DriverStudio versions of SoftIce came out people seemed to be having problems with getting Symbol Loader to break at WinMain. As it turns out there is a small difference in the winice driver from earlier versions in the routine which sets the "CC" breakpoint on the program entry point. This patcher fixes the problem by making a small patch in nmtrans.dll and should be universal for all versions of DriverStudio. Here is a *brief* explanation of the source of the problem...

============================================
To start with, here is the patch in the DriverStudio v2.7 nmtrans.dll. By changing the 1 instruction we affect a variable used in winice, and *ensure* that Symbol Loader will break at WinMain.

Original:

:1001CD7A 25FFFF0000 AND EAX, 0000FFFF ; PATCH HERE

:1001CD7F 50 push eax
:1001CD80 8B4DDA mov ecx, dword ptr [ebp-26]
:1001CD83 51 push ecx
:1001CD84 8D55B0 lea edx, dword ptr [ebp-50]
:1001CD87 52 push edx
* Reference To: nmtrans.DevIO_SetWLDRBreak

Patched:

:1001CD7A B8FFFF0000 MOV EAX, 0000FFFF ; PATCH

:1001CD7F 50 push eax
:1001CD80 8B4DDA mov ecx, dword ptr [ebp-26]
:1001CD83 51 push ecx
:1001CD84 8D55B0 lea edx, dword ptr [ebp-50]
:1001CD87 52 push edx
* Reference To: nmtrans.DevIO_SetWLDRBreak

==============================================

The nmtrans.dll function DevIO_SetWLDRBreak is used to communicate to the winice driver via a DeviceIOControl call that the user wants to break at the program entry point. The DevIO_ConnectToSoftICE function opens the vxd in the usual way with CreateFileA and returns a valid handle. Then DeviceIOControl is called, pushing the dwIoControlCode (9C40601C) for the proper function within the winice vxd to set the "Stop at WinMain" flag. For more info on the functioning of nmtrans.dll, see IceLoad by The Owl, G-RoM and Muffin.

This unique dwIoControlCode (9C40601C) in nmtrans.dll is our "ticket" into the correct function in winice itself. (All addresses are from DriverStudio v2.7)

...
_text:1001FFBD push 9C40601Ch ; dwIoControlCode
_text:1001FFC2 push esi ; hDevice
_text:1001FFC3 call ds:DeviceIoControl ; communicate with winice

A search in winice.exe reveals the following code:

:C00007B0 mov ecx, [esi+0Ch] ; DeviceIOControl dwIoControlCode
:C00007B3 mov edx, ecx ; 9C40601Ch
:C00007B5 shr edx, 10h ; isolate HiWord
:C00007B8 cmp edx, 9C40h ; equal to 1st part of dwIoControlCode?
:C00007BE jnz short loc_0_C00007E0
:C00007C0 mov edx, ecx ; 9C40601Ch
:C00007C2 shr edx, 2 ; E7101807h
:C00007C5 and edx, 0FFFh ; 807h
:C00007CB cmp edx, 800h
:C00007D1 jl loc_0_C0000AAD
:C00007D7 sub edx, 800h ; 07h
:C00007DD inc edx ; 08h
:C00007DE mov ecx, edx
:C00007E0
:C00007E0 loc_0_C00007E0: ; CODE XREF: :C00007BE
:C00007E0 inc ecx ; 09h
:C00007E1 cmp ecx, 17h
:C00007E7 jnb loc_0_C0000AAD
:C00007ED JMP DS:OFF_0_C0007E10[ECX*4] ; JUMP TO CORRECT ROUTINE

What all this boils down to is getting the correct Index value of 09h in ECX. The JMP statement address then becomes C0007E10 + [09h*4], which leads to:

:C0007E34 dd offset loc_0_C0000928 ; main function called by DeviceIO_WLDR

Following the code...

:C000093F push dword ptr [eax+0Ch] ; 1
:C0000942 push dword ptr [eax+10h] ; 0
:C0000945 push dword ptr [eax+8] ; 0, BUT THIS IS THE CRITICAL VARIABLE!
:C0000948 push dword ptr [eax+4] ; CCh (ooh, what's this? ;-)
:C000094B push dword ptr [eax] ; filename of program to be loaded
:C000094D call sub_0_C003718D

That middle variable, dword ptr [eax+8], is going to turn out to be the critical one. It is moved into CX, then later into a small buffer containing the name of the program to be loaded, the "CC", some other flags and the word WINMAIN.

:C003719A mov ebx, [ebp+arg_0] ; filename of program to be loaded
...
:C00371B9 mov edx, [ebp+arg_4] ; CCh
:C00371BC mov cx, [ebp+arg_8] ; CRITICAL VALUE MOVED INTO CX

Now comes the major difference in the code between DriverStudio 2.7 and Softice 4.05, and the how and why that patching that instruction in nmtrans.dll works. Basically all we are doing is duplicating the code that existed in the 4.05 version.

DriverStudio 2.7:
:C003714A mov ds:dword_0_C0037FA6, edx ; CCh
:C0037150 mov ds:byte_0_C0037F7E, 4
:C0037157 mov ds:word_0_C0037FA2, 0FFFFh
:C0037160 mov ds:word_0_C0037FA0, cx ; WE WANT THIS TO BE 0FFFFh
:C0037167 mov ds:dword_0_C0037FAE, 0
:C0037171 movzx ecx, byte ptr [ebx]

Softice 4.05:
:C00607E4 mov ds:dword_0_C0061642, edx ; CCh
:C00607EA mov ds:byte_0_C006161A, 4
:C00607F1 mov ds:word_0_C006163E, 0FFFFh
:C00607FA mov ds:word_0_C006163C, 0FFFFh ; LACKING IN DRIVERSTUDIO
:C0060803 mov ds:dword_0_C006164A, 0
:C006080D movzx ecx, byte ptr [ebx]

This is basically the crux of the matter, but certainly doesn't convey the complexity of the Softice code or give an appreciation of the true excellence of the debugger. Getting lost in the codewoods is the only way to do that ;-)

Enjoy the patch

Kayaker
cyberheg
10-16-2002, 12:04 PM
So like why the value 0xffff? Besides that it's equal to v4.05 and (by luck?) works I don't see the explanation/reason why you want this value.

// CyberHeg
ricco
10-16-2002, 03:24 PM
coool !!! but it doesn't work on my system xp pro with sp1 installed and Softice Driver suite 2.7. So I'll be enjoy to watch your log and try to fix this.
hobgoblin
10-16-2002, 03:34 PM
Okey.
I have traced the nmtrans.ll, and it passes over the patched area, the patched value is placed in memory, the program goes on to where the api DeviceIOcontrol is called at 1001FFC3 (kayakers address). But then the program starts, it doesn't halt at starting point. I'm not sure how to go from here. I guess I have to trace winice.exe from here, but how to enter it at the right place?

another thing: How did you get to dissamble the winice.ece in IDA? I mean, I tried it myself, but couldn't find any addresses below appr. c0000600. I certainly couldn't find the address you posted (from :C00007B0 and so on..)

hobgoblin
username
10-16-2002, 05:01 PM
Originally posted by hobgoblin
Okey.
I have traced the nmtrans.ll, and it passes over the patched area, the patched value is placed in memory, the program goes on to where the api DeviceIOcontrol is called at 1001FFC3 (kayakers address). But then the program starts, it doesn't halt at starting point.Give the new iceload a try, it comes with some patches for ntice.sys that may help you.
another thing: How did you get to dissamble the winice.ece in IDA? I mean, I tried it myself, but couldn't find any addresses below appr. c0000600. I certainly couldn't find the address you posted (from :C00007B0 and so on..)Did you make sure that you loaded the LE/VxD part into IDA and not the MZ stub only?
hobgoblin
10-16-2002, 06:02 PM
thanks for the tips.
The dissambling in IDA is now okey. I found the code I was looking for.
But I don't need iceload. I'm primarely interested in understanding why kayakers patch is working for almost everyone except me.:-) I have used Lordpe and bpint3 successfully earlier on to break at program start, and are mostly happy with that.
I will check it out though. Maybe there is something to be learned there too.
Now I just need to find out how to break into winice during runtime.
Maybe someone have a nice tip? :)

Later: I got it to work on WinME now. Seems like kayakers patch didn't do the job, because when I checked the instructions at the address 1001CD7A, it read mov eax, 00000001. After changing it to mov eax, 0000FFFF it worked.:)

Now, only XP remains unresolved...

hobgoblin
Timmy
10-16-2002, 10:21 PM
Probably talking rubbish here so don't have a go, did you patch both dll's?
hobgoblin
10-17-2002, 04:32 AM
Yes, I did.

hobgoblin
lownoise
10-17-2002, 08:42 AM
hobgoblin,

On my Xp box softice breaks on the winmain with the following configuration.

Make sure softice is not activated.

Start de symbol retriever and download the symbols for ntoskrnl.
Edit your settings so that by the softice initalization the symbols are loaded for ntoskrnl
apply Kayaker patch for driverstudio :)
Reboot your system and start softice. Now try breaking on winmain.

Hopes this helps:)

Lownoise
hobgoblin
10-17-2002, 02:33 PM
No, it doesn't work on my computer.
Thanks for the tip, though.:)

Looks like I have to do some debugging of winice.exe/vxd. I have tried a little bit, but can't find a way to enter the code. Tracing only leads me into an endless codestream of the system .dll's, but no winice.....
You don't happen to know how to get into winice itself, do you?

hobgoblin
lownoise
10-17-2002, 03:01 PM
No i don't know how to get in winice/vxd:(

Are there any other using XP and having the same problem or not?

Lownoise
Clandestiny
10-17-2002, 03:21 PM
Hiya,

You can use IceClimber to set breakpoints in winice code. It is available on protools.cjb.net.

Cheers,
Clandestiny
Kayaker
10-17-2002, 04:56 PM
Hi Hobgoblin,

I was looking into this last night for the ntice.sys versions. I'm not at my home computer right now so I can't paste the exact details, but here's what I noticed. I unpacked the DriverStudio Data.cab file and saw there are 4 versions of the "winice" driver. Which one is installed on your computer I guess depends on your OS. There is winice.vxd, for Win3.1; winice.exe, for Win95/98, and 2 versions of ntice.sys, presumably for Me/XP/NT. I'm still using good 'ol Win98SE (where BPR and Backtrace still works, yeah! ;-), so the driver I was working with was winice.exe.

So I disassembled the two ntice.sys versions and noticed some differences and some similarities to what I saw with my winice.exe driver. To start with, the CMP instruction to the dwIoControlCode (9C40601C) is a direct one, instead of using the shr/and manipulations and a jump table. So a text search in IDA for '9C40601C' will give you a direct hit.

What I had done to break into winice code was to set a breakpoint on a very handy VMMCall that luckily happened to be just above the code I was interested in, called _EnterMutex. So basically I was using only 2 breakpoints, bpx DeviceIOControl, then bpx _EnterMutex. Return from _EnterMutex and you are directly in Softice code.

If you check your ntice.sys version, you'll see there is a similar call somewhere above the '9C40601C' cmp instruction. I forget the exact name of it right now but it's recognizable as a Mutex call (and pink in IDA). It's not a VMMCall per se, but it is an external call, so you may be able to set a breakpoint on it directly as well. In fact it may actually call down to VMMCall _EnterMutex and simply be a wrapper, I don't really know anything about how the WinME-and-above kernel is different from Win98, so that's only a guess. In any case, you could try setting a bp on this system call and see if Softice breaks.

It is a bit of a pain because you generally have to F8 through everything. For example if you try to F11 out of the _EnterMutex call back to winice code, you'll get the familiar "Breakpoints not allowed in Softice" message. Unless you've patched winice beforehand to allow breakpoints within its own code that is. Unfortunately Iceclimber only works on 4.05, but I've mentioned how that's done in another thread and you could probably apply permanently your own patch to your own version by following that idea. Even then, setting direct bps on winice code doesn't always seem to work, I've had both success and failures when it comes to that.

Also, F10-ing over calls may or may not work for you either. With 4.05 (which I had patched to allow breakpoints) I was able to F10 over any call it seemed, but with DS2.7 (which I hadn't) I found F10-ing over several calls simply started the program up, again as if Softice was unwilling to RET to its own code. (This didn't apply to system calls though...) And finally, I have no experience in single stepping through ring0 code in ME/XP, so I don't know if there are any hidden dangers lurking, heh.

Anyway, try breaking on that Mutex call (you should be able to see it in IDA), and set the bp *after* you've first broken on DeviceIOControl, else you'll probably get the wrong break. One thing you might want to check first is if DeviceIOControl is even returning the correct values. Set a bp on the address in nmtrans.dll immediately after the call, I think EAX returns 1 and EBX should be 0. This might be a bit of a wild goose chase. I don't really know *what* that FFFF flag does actually or what it stands for, just that it's associated with manipulating the "CC" and patching it seems to work (for most people anyway ;-)

Your problem could be further on as well, after returning from DeviceIOControl there are critical calls to CreateProcess then ResumeThread. I know these are the basis behind the idea of "code injection" for example, and I want to continue to trace within them to see, if possible, exactly how and where the "CC" is physically written to the entry point and how it all relates to the PE Loader. (There's an interesting call to CreateRing0Thread that I want to know what it's doing ;-)

Hope it works,
Kayaker
hobgoblin
10-17-2002, 05:37 PM
Hi Kayaker,
Thanks a lot for the input. I will dig into it and hopefully get deper into what's going on.:)
I'll get back to you (and others) with results later on...

thanks for taking the time pass on the information.

hobgoblin
toteu
10-17-2002, 06:21 PM
The breakpoint at least for me is set by DR registers.
Tracing and disassembling with IDA both versions (9x and NT/2K/XP) shows a lot of similarities.
On 9x Im able to trace 100% with TRW2K and it certainly is a BPM X type For example set all 4 registers with BPM X before launchin file
(for example BPM 1 X, BPM 2, BPM 3 X, BPM 4 X )
and the internal_DRregs_table of ICE being full, the loader doesnt break at OEP.
Im not sure that if it doesnt try after seeing the table full(i.e. all 4 regs used) to put a CCh , but fails for some misc reasons

The flag you noted is newly used in structure modinfo (see iceload code).Im sure that the best would be to update iceload at iceload 1.8 beta with that flag set (modinfo.0x132 or 0x134 forced 1, as I remember).See iceload sources
Only if the stricmp with symbols winmain, winmain16 etc fails in ICE driver code they are used as I see now.

Also studying icedump shows that the bug with first non executable section can be ported easily on NT version as it its very similar code.This would solve also the packed files which
have 1st sect marked as nonexec.I have patched DS 2.7 NT version and tested on XP (a la icedump9x) and works 100%.
Tested on the fly DS 2.6 on 2k and everything is ok.
Further studying inc files of icedump and nticedump, I realised that they contain a lot of info and I wrote 2 IDC scripts for IDA to parse them and propagate the info in disassembly.Very useful.
Also the easter egg in DS 2.5,2.6, 2.7 is obtained typing ver jim
in SICE.Being used by now :) with IDC scripts I wrote other 2 scripts to decrypt these strings in IDA disassembly.I will attach the scripts but please note (they are very bad hand coded not optimized etc. :)
but they simply work..this is the most important thing..:)
The bp seems is set via INT41H debbuger's interface.
I have tested DS 2.6 on 98SE , DS 2.6 on 2K, DS 2.7 on XP SP0
with all these and everything works as expected.
I can also upload the patch for DS 2.7 for nonexec 1st section but Im sure you can do it by using the scripts to auto comment code based on INC files of icedump, nticdump.

Attached are the IDC scripts.Use them to propagate the info from INC files in the correspondent disassembly version of SICE (9x/NT).
Jon
10-17-2002, 08:57 PM
You have done a really gr8 job but its not nessacery all u need to do is change an option in symbol loader and u r done :D ill tell u where:

Load a Module
now go in the Menu to Module-->Settings

in General tab u should choose Load Executable and check Stop at WinMain,Main...

now in the Translation Tab choose Symbols and source code

Press Apply and ok and click on Ctrl+L now sometimes it wont ask u: "An Error occurd blablala. Load Executable anyway?" and ofcourse we enter yes and it will break, if this messsage doesnt appear just go again to Module-->Settings and press ok try Ctrl+L again should work if not go again to Module-->Settings press ok and Ctrl+L the max time i needed to go to Module-->Settings was 3 times so its not that bad ;) give it a try Good luck and Kayaker u really have done a gr8 work 10x for all your efforts
hobgoblin
10-18-2002, 07:24 PM
Well, here I am once more.:)

I have patched ntice.sys so I can enter the file without getting the message "No breakpoints allowed...". I did follow Kayakers advice. I checked the return values of the call to DeviceIOControl, and eax returned 1 and ebx 0. I managed to get to ntice.sys through breakpoints on DeviceOIControl and ExAcquireFastMutex. A F11 after breaking on ExAcquireFastMutex brought me there. But when I try to set a bpx or bpm in the code immediately after the point where I entered the code, nothing happens. And when I try to trace (F10 or F8), my machine reboots after executing a couple of instructions (right after the call after the call from ntice.sys to ExAcquireFast Mutex).
Why does it reboot? And why doesn't breakpoints stick in the ntice.sys code? I know of the program that makes breakpoints in Sice possible, but as far as I know I can't use it on DS 2.7.
Any good ideas out there?

hobgoblin
Kayaker
10-19-2002, 12:07 AM
Hi

Your whole system reboots eh? There was one very strange occurrence I had, which I didn't bother mentioning before (wasn't sure it'd come up ;), but in looking at the ntice.sys code I'm wondering if something similar isn't happening to you since it seems to occur at around the same place. There was a single mov [address], 01 instruction which froze my system if I tried to step over it. I actually had to nop it out to continue tracing. Once that single instruction was memory patched once, I was OK until reboot. Even if I tried to edit in '01' to the memory address the system froze immediately. For some reason this addy seemed unwriteable if you tried to single step over the instruction. The situation was identical with 4.05 or DS2.7, with the winice.exe driver on my Win98SE system.

There were no adverse effects to nopping it out and all other tracing was OK. The instruction occurs just after Install_Exception_Handler, where 01 is moved to the memory address, and is cleared with a mov 0 just before the same EH is removed with Remove_Exception_Handler. So it looks to be a fairly inconsequential flag.

Here's what it looks like, and since you said the problem was right after the call after the call from ntice.sys to ExAcquireFast Mutex, why I thought it might be the same.

winice.exe:

:C0000776 VMMCall _EnterMutex ; comparable to your ExAcquireFastMutex
:C000077C add esp, 8
:C000077F push esi
:C0000780 mov esi, offset dword_0_C0004497
:C0000785 VMMCall Install_Exception_Handler
:C000078B pop esi
:C000078C call sub_0_C002EB06; code here is *identical* to your call sub_0_46B18

:C0000791 mov ds:dword_0_C000448B, 1; problem instruction, must nop this out
...
:C00007B8 cmp edx, 9C40h ; dwIOControlCode

ntice.sys:

:00060229 call ds:ExAcquireFastMutex ; does this call include an Install_Exception_Handler function?
:0006022F call sub_0_46B18 ; *identical* code, as mentioned above

:00060234 push 1
:00060236 pop eax
:00060237 mov dword_0_B6547, eax ; looks like it might be the problem instruction?
...
:0006028F cmp ecx, 9C406014h ; dwIOControlCode

If you can understand what I'm getting at, does this sound like the problem spot? If so try nopping it out and see if you can continue tracing.

Out of curiousity, have you tried IceLoads new 'invlpg' ntice.sys manual patch yet which might just solve all your problems? Unfortunately all I can do is apply the patch, look at it in IDA, and gape in wonderment at the reasoning behind it and how the solution was sussed out ;-) But I'd be interested if it does indeed solve the breakpoints problem for others.

btw Toteu thanks for the useful information, though I'm nowhere near making use of your scripts yet ;)

Kayaker
sirius
05-01-2003, 05:11 PM
congratulation Kayaker, your really doing a good job.
Kayaker
05-01-2003, 09:57 PM
Thanks. All the moderators are doing a good job. Hope this particular thread solved a nagging problem.

Kayaker
SpeKKeL
05-17-2003, 07:51 AM
First of all i must say the patch works well on my system.
(win XP)

Only thing is that it doesn't break at some packed targets (like aspr). I know, just modify the section flags and it will stop.
But some targets simply check their prog if it is modified..so then we have to patch/skip that code bla,bla,bla....

So if you want a simple break on those targets hop to kernel GetCurrentDirectoryW and put a breakpoint at: call [ebp+8]
(some lines below) and step into it,..the first instruction is entry-point of your packed prog.

SpeK


Run-Time Debugging Full-Screen Applications in Windows 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Run-Time Debugging Full-Screen Applications in Windows 2000
PDA

View Full Version : Run-Time Debugging Full-Screen Applications in Windows 2000

Malakar
10-15-2002, 04:06 AM
I've always used SoftICE (v4.05) for run-time debugging, but it requires me to turn off read-only memory protection in order to install it in Win2k. I don't want to compromise my system stability so I'm not willing to do that, especially since it doesn't give me more specific information.

So looking for alternatives, I found WinDbg and OllyDbg. Both are pretty good, and have Windows GUI interfaces. The problem is when they break when a full-screen (DirectX) app is active, the game freezes (as it should) but you cannot go back to Windows without killing the debugger's process.

My searches for information on this topic so far have been unsuccessful, so I came here to ask if anyone knows a good solution. I would really appreciate any information that any of you may have. My e-mail is malakar2@hotmail.com just in case you want to mail me, but replying to this post is fine.

Thanks,
-Malakar
dion
10-15-2002, 11:57 AM
try to seek help in win32asmboard.cjb.net
theres lotsa directx freaks

cheers


Question about ECC points addition...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Question about ECC points addition...
PDA

View Full Version : Question about ECC points addition...

SeanC
10-15-2002, 06:29 AM
Hi,
After study some essays about ECDSA, one question bother me as following:

For an ecc curve, y^2 + x*y = x^3 + a*x^2 + b over E(F2m),
Points P(x1, y1) and Q(x2, y2) are both belong to E(F2m),
If P==Q, P + Q = 2*P = (x3, y3),
x3 = r^2 + r + a, where r = x1 + y1/x1.
y3 = x1^2 + (r+1) * x3.

My target is to calculate 2^n * P, where n is a large integer.
My question is: r = x1 + y1/x1 should not be always an integer. I set the value of y1/x1 to be an integer instead. So after my calculation, 2^n * P is not correct.

For example, x1 = 2, y1 = 6, a = 8, b = 8, order n = 101.
2^1 * P = (38, 30)
2^2 * P = (36.4xxx, 64.8xxx) <= Not integer.
.................................................<= So the next is not correct if set the previous x3 and y3 to integers.

Does anyone help me to correct it?

Thnks

SeanC
mike
10-16-2002, 03:02 AM
Why do you need integers? If you use real numbers, they ought to work just fine. If, on the other hand, you're trying to do ECC on a finite field like GF(2^n), then you do division with inverses:

a/b = a*inv(b)

Multiplication and division work a little differently on finite fields than on reals. I can refer you to some number theory pages on that, if you'd like.

Also, have you read certicom's ECC tutorial?
SeanC
10-17-2002, 06:01 AM
Yes, please. I read some papers from certicom already. What paper could see detail about this part?

For a/b, I just check add one or not. How to do it real number if a , b are big integers.
mike
10-18-2002, 05:19 AM
A thread on galois fields:

http://www.woodmann.net/forum/showthread.php?threadid=3217#post17209

Here's an easy example to show how to do 1/2 with modular arithmetic. Take n=7. Then 1/2 = inv(2) = x such that x*2=7k+1, where k is an integer. x=4 is one solution. To see that it behaves like 1/2, take 6*4 = 24 = 3*7 + 3 = 3 mod 7.

Something similar happens in galois fields.

For real numbers, don't set the coordinates to integers. Leave them as reals. That's all.
SeanC
10-18-2002, 07:07 AM
Oh!

It's Euclidean alogrithm, isn't it? I use it before.

ax = 1 mod b => x = a^-1 mod b.

For finite field over F2^m, the irreducible f(x)=x^m + x^k + 1.
such as sect113r1 in SECG, ecc Curve y^2 + xy = x^3 + ECCa * x^2 + ECCb,
m=113, k=9
ECCa="003088250CA6E7C7FE649CE85820F7"
ECCb="00E8BEE4D3E2260744188BE0E9C723"
Base point: G(Gx0, Gy0)
Gx0="009D73616F35F4AB1407D73562C10F"
Gy0="00A52830277958EE84D1315ED31886"
Order
n="0100000000000000D9CCEC8A39E56F"

2*G: Gx = r^2 + r + ECCa, which r = Gx0 + Gy0 / Gx0.

If I want calculate r, which is correct?
use r = Gx0 + Gy0 * (Gx0^-1 mod n), is it correct for using order?
or
use r = Gx0 + Gy0 * (Gx0^-1 mod f(x))?

I confused above. Also, what goal for compressed base point and compressed order.

Thanks.
mike
10-20-2002, 11:42 PM
use r = Gx0 + Gy0 * (Gx0^-1 mod f(x))if by ^-1 mod f(x) you mean the inverse in the field, then yes.Also, what goal for compressed base point and compressed order.Sorry, I don't know what that means (I know very little about ECC).
SeanC
10-22-2002, 03:12 AM
Thanks a lot.

Certicom use a compressed base point G, which is half length of bit string. I don't know what do they do.

Also, we didn't use the order n. It is the maximum order of G, isn't it? Maybe not.


is XOR mathematically distributive ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > is XOR mathematically distributive ??
PDA

View Full Version : is XOR mathematically distributive ??

FoolFox
10-16-2002, 08:11 AM
Hello,

First of all, i'm not natively speaking english, so i may use incorrect
terms... I've a little problem about mathematics related to logical
operation....

I'm working on a serial protection, which basically is the following check :

x is the registration serial
the program compute a value y by adding value a to x ( y = x + a )
the program compute a value z by xoring x by a value b ( z = x xor b )
the program check if y xor z result of a value c

So, in order to compute the serial, i would use the three equations i got :

(1) : y = x + a
(2) : z = x xor b
(3) : c = y xor z

as i'm seeking a way to compute x :

from (1) : x = y - a (1')
from (3) : y = c xor z
(2) in (3) : y = c xor x xor b

if i replace the last result in (1') i can extract x :

x = ( c xor x xor b ) - a
x + a = c xor x xor b
x xor ( x + a ) = c xor b
x xor x + x xor a = c xor b <== Is that right ???

if (i recall correctly), x xor x = 0 then :

x xor a = c xor b

can i say, x = a xor b xor c ???

I've tried to make some search on the subject but either i've to dig under
millions of results or others are not helping for me yet...

Regards
FoolFox
ZaiRoN
10-16-2002, 10:04 AM
Hi FoolFox,

>x xor ( x + a ) = c xor b
>x xor x + x xor a = c xor b <== Is that right ???
no.
look at this simple example:
x =1
a = 1
x xor ( x + a ) = x xor x + x xor a
replacing:
3 = 0 <-- NO...

how to find the right serial?
at this moment i'm able to see only a brute approach...

regards,
ZaiRoN
DakienDX
10-16-2002, 10:08 AM
Hello FoolFox !

Your calculations were right until your last step.

c xor b = x xor ( x + a )
c xor b = x xor x + x xor a

If we set the two expressions equal and reduce everything, we would get the following phrase:

x xor (x + a) = x xor x + x xor a
x xor (x + a) = x xor a
x + a = a
x = 0

You can tell either by just looking at it or by testing with numbers that this is not equal unless the serial number "0" is the only valid serial, which I doubt.

What are a, b and c? Are they all constants or is one or all of them somehow calculated?

Oh, ZaiRoN was first. ;)
FoolFox
10-16-2002, 02:43 PM
Hi,

Thanks for the point, at least i know where i'm stuck now....

as far as i've seen of the whole process, two of the three values (a,b & c) are constant and one is related to the username.

But i've still to dig that part, I'll focus on that now as it may
help to resolve the last step...

....otherwise i'll go on brute-force... :)

Regards
FoolFox
mike
10-18-2002, 05:15 AM
check out the thread from naides in the crypto forum on this topic


Anti Dump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anti Dump
PDA

View Full Version : Anti Dump

SpeKKeL
10-16-2002, 11:50 AM
Hajo,

For a change no aspr bla bla...
Had this morning a go with pelock from some polish bart..
After lot of garbage code, idt attempts, and so on i safely landed on the oep !
Now i struggled with dumping (yes the author told he had implented an anti dump (lordepe/procdump ) feature.
Some closer look to the header didn't reveal anything to me.
Question: Which ways are there besides the ff ff, to prevent dumping ?

Ciao,

SpeKK
evaluator
10-16-2002, 12:27 PM
Hi!

I have NOT any prob for dumping "PELock" by Bartosz with LP_deluxe..

What is wrong for you?
SpeKKeL
10-16-2002, 12:42 PM
I wonder,

From where did you dump ??
oep 401beb

Spekk
_Servil_
10-16-2002, 06:00 PM
hi spekk,

virtualprotectex?

did you had problems dumping under win2k/nt/xp?
dumping within win9x works sometimes for me when the xps fail,
some memory protecting schemes used don't take effect on win9x, saw some thread about this (...shrinker... ? i think)

however not too sure about it.
evaluator
10-16-2002, 06:17 PM
yep, seems new version you try.
Ok, I will look.
evaluator
10-16-2002, 06:37 PM
Hey!

just checked v1.04 on W98se & XP.

Step1: "Correct image size"
Step2: "Dump partial"

& I have DUMP.
Nothing was wrong.

BTW:
I had unpacked PELock1.01 & 1.02.
It uses runtime decr-encryption for code peaces.
SO simple dump SHOULD be useless..
SpeKKeL
10-17-2002, 03:45 PM
Hee, thanks eval,

Correct image size did the trick >> dumped, and now writing a little code to trace the imports ...push ret push ret and so on...

After that i'll try to rebuild all,

(you did rebuild the prog. ???)

CiaO,

Spekk.
evaluator
10-17-2002, 06:45 PM
Eh, Spekk!

I can't imagine, you missed so easy fact as "correct image size".
Tsss! WoodMann can put you in "Hall of Shame" ~:0

& can't understand your maniakal hobbie- writing plugins for tracing redirectors.

For example, you can in debugger patch PELocks resolver code,
so it will directly put true Import addres in IAT, not redirected!

For code decryprting:
You need analise dump for crypted sectors, write start address for eachs decryptor call,
then on OEP jump to each of them & decrypt. Lot of workz.
SpeKKeL
10-17-2002, 09:05 PM
hahahahaha ....Yep you're right eval,

But on the other sight, i don't shame to ask questions.............
Never to old to learn something !
Writing plugins..hehe it just give me some satisfaction and it
improves my home brewed coding.

Happy unpacking eval,

see you,

Spekk


Reversing an UPX-packed program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Reversing an UPX-packed program
PDA

View Full Version : Reversing an UPX-packed program

Peacemaker
10-16-2002, 11:59 AM
Hi guys,

I already did a post in Advanced cracking but my post has been deleted by the way. I don't know why but i think it was because the guys from the board thought of it being a crack-request.

So i write again: THIS AIN'T A CRACK-REQUEST!

I just need to know how to find the adresses to patch. I Know that the program is packed with UPX, I also know how to unpack this program and I know that it is surely impossible to get an useable keyfile for registry...
But I know it is possible to patch that file.

The program I talk about is Nokia LogoManager from Mike Bradley. It can be found at logomanager.co.uk
The program starts up and if you do a "bpx regqueryvalueexa" youl see that the program look in registry "HKLM\Software\Mike Bradley" it looks for your name, email address and key.

So if anyone is able to help me finding a way to make the program think that it has found an useable key so that it starts up registered I would be very thankful.

And YES I have read the other threads but I haven't found a way myself to do that thing.

Thx in advance,

peacemaker

P.S.
Please don't delete that thread,
change it, move it, but don't delete it
TheSearcher
10-16-2002, 12:14 PM
Hi,
1) You didn't explain your approach
2)You have posted the wrong forum again it should be newbies forum ;)
Peacemaker
10-16-2002, 01:21 PM
Sorry for posting again into the wrong forum, but I didn't have a clue where to post right, so if anybody could move it into the right section it would be great. what do you mean with approach?
I just got no clue how to stop that fuckin' program checkign the registry for the right writings. It must check that at startup because there must be a flag set. if that flag is 0 i guess, it displays the DEMO screen in the edit window and if it's 1 it won't display, so please if anyone can help do so...
squidge
10-16-2002, 02:17 PM
Can you explain what you have done so far to try and trace the protection and what you have done to attempt to work around it ?
wbe
10-16-2002, 04:08 PM
P(e)acemaker, this is not the correct way to ask help in this forum.

Just pick a few random threads and examine them. Then try to understand why some posts were replied and some ignored. That may give you a clue.

Otherwise, someone will take the battery of your p(e)acemaker out.
Manko
10-16-2002, 04:54 PM
Hmm... This smells funny...

How can it be that he knows it's checking for those in the registry, but don't have more info on what the program does with them?

My guess is, this is still a crackrequest. ...although the person MIGHT be wanting to learn... ?
I'd advice him to read more tutorials and start with simpler schemes. (If it even is a hard one? I won't check! :P)

...or at the very least, do his very best to make it sound as if he'd done something... :P

Sorry, if this offends you, but you HAVE to make an effort, you know!? :)

/Manko
Peacemaker
10-16-2002, 05:12 PM
Okay guys,

now I'll tell you how this thread was done...

I wrote the thread from my workstation, while I was working (or havin' a short break) because I don't have internet access at home because I moved from one city to another and got no money at the moment for internet access. Now I'm at my parents where I got internet connection but there I'm using Win2k and I can't get SICE breaking on any bpx I set. In my flat I got a new PC with Win98SE installed and SICE working. That's why I can't do sice'ing here and so I only can tell you what I did so far and what I can do with the unpacked and disassembled "logomanager.exe".

This is what it looks for in the registry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Mike Bradley\LogoManager]
"Username"=""
"Password"=""
"RegistrationKey"=""

The thing is that you can crack all off the program but the DEMO text in working window and the first splash.
And if you do a "bpx regqueryvalueexa" you can follow the routine which checks at startup, but you can't find a serial... :(

So I'll tell you more if I find out something new,.. I don't want you to crack it, but I need help in cracking it because I can't follow up the other threads about it...

Thx in advance
squidge
10-16-2002, 08:14 PM
Hmmm. Since the registry values for regname/serial etc are empty, bpx'ing regqueryvalueexa isn't going to give you a serial number as there's nothing to pull back anyway, and only extremely lame authors use fixed serial numbers so there's no compares to check.

What you need to do is to enter a fake serial number into the registry in the places you suspect it checks using regedit, and then follow the program through to find out how the programs detects this is a bad serial, and then change the serial so that the program will take it as valid. The is the only reason by bpx'ing regqueryvalueexa I can think of.

If you are not experienced enough to work out the serial algorithm, then you can always search for the "good guy / bad guy" flags and either flip them or remove all references to "bad guy". This is almost always easier than "fishing" for a valid serial number. For example, I recently looked at a shareware program of interest, and although the serial calculation routine used some kind of RSA signature to verify the serial (which is approx 200 bytes long) all you see at the end of the routine is the infamous MOV EAX, 1 or a jump to XOR EAX, EAX if the serial was bad. Nobody needs to tell you how to get round that kind of protection.
Peacemaker
10-23-2002, 02:30 PM
No, I don't want to catch a serial number, just want to find the fuckin' flag which decides if its regged or not...

:(
squidge
10-23-2002, 02:34 PM
Which you can easily do by using a valid serial number...
Peacemaker
10-24-2002, 08:14 AM
...believe me, why ain't there any keygens or serials out? because its that hard to get or just impossible :(
squidge
10-24-2002, 08:42 AM
You could always do it the long and tedious way - use a fake serial and then see where it jumps out, follow the code through and see where to "good guy" call would be. Normally there's a single "bad guy" so you should be able to find it quite easily. Lot more difficult than toggling a flag, but certainly not impossible.


RV tracer seems not work on...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > RV tracer seems not work on...
PDA

View Full Version : RV tracer seems not work on...

spiderman
10-16-2002, 04:42 PM
the latest version of RV seems not work on G-Lock Easymail professional 4.1.

-target's url: DELETED
-one dialog pops up when tracing, said, sorry but your 30-day trial has expired.....
-my win version, build number: win2k 5.00.2195 + sp3

anybody, esp Tsehp can look into it?

Thanks,
foxthree
10-16-2002, 09:31 PM
Spiderman:

Don't get me wrong, but why do you need RV's tracer? If I remember right, Easymail is ASPRed (I may be wrong, long time since I saw this target :o) Maybe latest ASPR strain, maybe Alexey improved his decryptor...

RV is a great tool but don't rely too much on RV's tracer then you wouldn't learn anything. Tracers in general is only for beginning exploration into code woods. Like +SplAj and others say, the real stuff is what is inside your head. Use it...

and hey... don't forget the board's search ;)

Signed,
-- FoxThree
BruceLee
10-17-2002, 08:49 AM
LogfileTail
Download file size: 756 K
=========================

Packed with ASProtect v1.23 A.S

----------------- 1. FINDING OEP AND DUMPING ------------------

01894AB3 55 PUSH EBP
01894AB4 8BEC MOV EBP,ESP
01894AB6 83C4E8 ADD ESP,-18
01894AB9 53 PUSH EBX
01894ABA 56 PUSH ESI
01894ABB 57 PUSH EDI
01894ABC 33C0 XOR EAX,EAX
01894ABE 8945EC MOV [EBP-14],EAX
01894AC1 8945E8 MOV [EBP-18],EAX
01894AC4 B894904800 MOV EAX,00489094
01894AC9 6862944800 PUSH 00489462
01894ACE C3 RET

558bec83c4e853565733c08945ec8945e8b894904800 ; bytes to add before 00489094
OEP = 0489094-16 = 48907E

-------------------- 2. GETTING IAT --------------------------

call 01xxxxxx
call 01xxxxxx ; I type here d *edi
mov edx, [edi]
mov [edx], eax
jmp 01xxxxxx

edi = 48e17c
d 48e17c and scroll down
? 492000 - 48e17c
3e84

Ok, I filed that memory range with 00h.

Start ImpREC
Put in ImpREC oep = 89462
IATAutosearch, getImports

show invalid -> trace level 1 <<<<<<<< FAILED!!!
i try with aspr v1.2 plugin but again FAILED!!!!

Later I'll try with Splaj ASPr v1.3 plugin but FAILED too!

It's a lot of SM code :(

In attach is my tree.txt with unresolved functions.

Can anybody helps me?

Bruce Lee
evaluator
10-17-2002, 09:45 AM
Seems you meet newest ASSPR.
We had discussion about.
Use search function.
BruceLee
10-17-2002, 09:58 AM
I saw thread with new asprotect, but doesn't help! This is different or newest version :(

Bruce Lee
evaluator
10-17-2002, 11:10 AM
When "any" protector does redirection of IAT,
first it resolves real Import address, then makes redirection.

So when some tools can't resolve for you Import, you should open
debugger & try to find, where true import_name resolving happens.
So you will know real import name.

This is very general hint. So work on it, upgarade your skills.
BruceLee
10-17-2002, 11:20 AM
I open debugger and I find functions, but to many functions is unresolved and before any api calls is a lot of code. Resolving manualy unresolved api calls is Sizif's job.

Try it!

Bruce Lee
+SplAj
10-17-2002, 09:04 PM
spiderman
========

big clue for you
__________________________________
'sorry but your 30-day trial has expired.....'
__________________________________

Tsehp made RV sharewarez ?
errr NO!!!!.....g-lock don't want you to play anymore ;)

BruceLee
=======

AT LAST ....... a NEW fuckin aspr target to compare . THANK U :)

I made a mistake in my pre Aspr plugin cos I only had 1 target.
see attached zip containing new 1.23 pre plugin.

The LogFileTail is now v 0.9.1 IAT 8E17C (724) and use my plugin 1st, then save tree, load tree and use 'Trace Level 1 (Disas)' on unresolved api, then cut the lame thunk to get dll's and finally patch in the GetWotWeWant API (GetCommandLineA, etc etc)

CYA

i'm back into hibernation mode........


Call for Mike's comments
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Call for Mike's comments
PDA

View Full Version : Call for Mike's comments

naides
10-16-2002, 10:31 PM
Hi mike:

There is a thread in the newbie forum that may fall in your area of expertise

http://www.woodmann.net/forum/showthread.php?s=&threadid=3990

It boils down to solving for x the following equation

x + a = x xor b xor c

where a, b, c are known and x is unknown. We could replace b xor c = d
being d another known quantity
giving:

x + a = x xor d

Does this equation have an analytical solution?

I am not sure, but if we could express

x + a

in terms of logic operations, xor, and, not, even if they are valid only in a finite numeric space, or conversely, express

x xor d

in terms of an algebraic formula the equation could be solvable.

Is it possible?

Thanks for your comments
mike
10-18-2002, 05:14 AM
There's an infinite number of solutions if there are any. Try solving it for small numbers and you'll see what I mean.

Essentially, any place that a and d don't match you have a carry:

0+1 =1
0^1 =1

1+1=10
1^1=00

so you just have to keep track of the carry bit as you move from low order bits to high order bits.

It should be obvious that there's no solution if a and d are opposite parity, i.e. one is odd and the other is even.
mike
10-21-2002, 09:34 PM
Also, since XORing can never set carry bits, there are no solutions if a>d

Also, d has to be of the form (2^n)(2^m - 1) because every time you carry, there's another 1 in d, and no more bits are affected when the carrying stops. For instance:
011101 + 001000 = 100101 = 011101 ^ 111000
111000 = (2^3)(2^3-1)

So there are no solutions if d is not of the form (2^n)(2^m - 1)


Armadillo unpacking: NetScanTools v4.30a
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo unpacking: NetScanTools v4.30a
PDA

View Full Version : Armadillo unpacking: NetScanTools v4.30a

Solomon
10-17-2002, 03:35 AM
I don't know which version of Armadillo is used.

I take the following steps to unpack it.

1. suspend the child process at OEP 44CB87.
2. fix the PE header at RVA 0x3C (pointer to ImageNtHeaders) and 0x126(NumberOfSections) in the child process memory.
3. At 640426 of child process , change "add edx,1" to "add edx, 0" to prevent its re-encryption of memory pages.
3. Find a empty place in child process, insert a piece of code there to scan the whole EXE memory to trigger the decryption of every page.
4.make a full dump of child process.
5. Select parent process in ImpREC, manually fix 0x15 entries, then fix the dump.

Now I get a unpacked exe, but there are still many "INT 3" in the unpacked exe to fix. Just set a BPINT3, you will see them. Armadillo debugger(parent process) uses these INT3s to change the control flow of the debugee(child process). I tried GetThreadContext/SetThreadContext to catch the EIP in the CONTEXT struct, but there are some problems to fix them.

If anyone has the idea how to fix the INT3s, please let me know. Thx!
Solomon
10-18-2002, 03:36 AM
no comments?:(
foxthree
10-18-2002, 08:35 PM
Hi Solomon:

Why not write a debugger (a loader) which just says DBG_CONTINUE on INT3's ? I know a *loader* may not "sound" elite, but for some ppl. it is ;)

Signed,
-- FoxThree
Solomon
10-19-2002, 05:44 AM
The debugee does not continue execution after INT3. It jumps with a little distance. Anyway I will try to patch the INT3 with some jumps.

Originally posted by foxthree
Hi Solomon:

Why not write a debugger (a loader) which just says DBG_CONTINUE on INT3's ? I know a *loader* may not "sound" elite, but for some ppl. it is ;)

Signed,
-- FoxThree
evaluator
10-19-2002, 06:38 AM
You should try anouther way to dump:)
foxthree
10-19-2002, 04:17 PM
Eval:

How might that be?

Signed,
-- FoxThree
evaluator
10-19-2002, 06:11 PM
probably in march I creaTORROed easy idea for CopyMem (:>to ASS:)
& use it until tomorrow(~:)

But LITTLE I'm afraid, if I publish it, then Mojo-jojo-authors will manage it.
But it is very hard to imagine, how they will kill...

Huh!?
What to do?
foxthree
10-20-2002, 03:44 PM
Yo Eval:

If you intended to be cryptic with that post, let me tell you you've succeeded :). Does the words "in march I creaTORROed" supposed to be a clue or sumthing. [I searched the board for the duration of March and CopyMem+Eval and turned up nothing. That's why I ask ;)]

If you think Chad and his boyz will steal ur ideaz, may be you can PM.

Signed,
-- FoxThree
evaluator
10-20-2002, 05:34 PM
So your opinion is:
share _TORRO_method with SELEBRATED KNIGHTs of GRAAL!?

..bad..

In other way, I like CopyMem->to_ASS protection.
Because of it IMHO(tep?), Arma is better then ass..
So why defiat it!?

>>If you think Chad and his boyz will steal ur ideaz

Not steal, but defiat..
As wrote, it is hard to imagine how, but anyway..

OK, if I open my _TORROSO_method & then Mojo-jojo will defiat it,
what COMPENSATION you can give!?
foxthree
10-20-2002, 06:16 PM
Eval, if you want to hang on to your "patented" _TORRO_method, fine, hang on to it. The reason I asked you was I thought and still think this is a place to "learn and share" and not just "learn and lock". If you "really" want to share your brand new idea without the author of the prot. knowing anything abt. it, you still have the PM. But I guess it is not in your interest to share the "patent" :) No offense taken. It is your choice. Thanks anyways!

<rant>
Since youre comparing ASPR with ARMA, my 2 cents:

Sure ARMA is great, page-by-page decryption and all but look at the overhead it is adding to the code. Who needs it? All protectors in my opinion are "virii" but IMHO, ARMA is more so than ASPR.

Since, you're one of the earliest guys to dump ASPR.dll, disassemble it and you'll see the elegance/simplicity of Alexey's code, however ARMA is just bloatware...

BTW, I know that you know that there are tons of packers that do page-by-page decryption incl. Yados' Krypton3 and Bart's PELock, so ARMA is not too good as an idea either :(
</rant>

Signed,
-- FoxThree
evaluator
10-20-2002, 08:51 PM
>>BTW, I know that you know that there are tons of packers that do page-by-page
>>decryption incl. Yados' Krypton3 and Bart's PELock, so ARMA is not too good as an idea

Allow me point to your little mistake.
None of them uses "page-by-page decryption".
ASS, SVKP, PELock by Bartosz crypts selected blocks of code.
(Yados Krypton does not this, as I can remember..)
This method is called with another way.(forgot name..like Dinamical decryption..)

BTW!
Look here, you want tell, that PELock's author is that Bart,
who distributed cracked SEPP?
foxthree
10-21-2002, 11:23 AM
Hi Eval:

My mistake. Indeed I was wrong in referring to the page-by-page decryption but what I *intended* was that decryption based on invalid opcodes triggering decryption (the debugger approach) is not anything new. [In fact, a guy I know wrote a "private" tool - something similar to ARMA's functionality plus adding code to completely fux up the PEHeader completely....] Krypton indeed does this as a search on this topic by XoAnino would tell you.

Anywayz, I know a couple of "barts" but I'm not sure it is the same bart. The bart I was referring to was the one in the thread started by SpeKKel about unpacking PELOCK (polish bart)...

Have phun,

Signed,
-- FoxThree
evaluator
10-22-2002, 08:41 PM
Sorry, Solomon!

I not looked inside this target & seems I missed this new future CC.
(I mistakly think, you did incorrect dumping).

Ok, lets again learn ARMA..
_Servil_
11-06-2002, 06:20 PM
hello there,

tried today get rid the ints in get right but it showed useless since the Crypt/Decrypt loop doesn't decrypt all anymore -- what's the add edx,... trick, it might work better..

.text1:005DF7E0 xor edx, edx
.text1:005DF7E2 mov ds:patch_counter, edx ; store jump patches done
.text1:005DF7EF mov [ebp+segment_to_decrypt], edx
.
.
decrypt_loop_start:
push 0 ; decrypt
. .
.text1:005DF9C6 mov edx, ds:decrypt_data
.text1:005DF9CC lea eax, [edx+esi*4]
.text1:005DF9CF push eax ; lpData
.text1:005DF9D0 mov ecx, [ebp+segment_to_decrypt]
.text1:005DF9D6 push ecx ; segment_to_decrypt
.text1:005DF9D7 call EnCrypt/DeCrypt ; changed to call .text1:005E0584 directly
.text1:005DF9DC add esp, 0Ch
.text1:005DF9DF mov ecx, [ebp+segment_to_decrypt]
.text1:005DF9E5 cmp ecx, 173h ; code size 0x174000 * 4
.text1:005DF9EB jge i3handler
.text1:005DF9F1 inc [ebp+segment_to_decrypt]
.text1:005DF9F7 jmp decrypt_loop_start
.
.
.
i3handler:
.
.
.
.text1:005DFD33 patch_next:
.text1:005DFD33 mov eax, ds:patch_counter ; jump patches done stored
.text1:005DFD38 cmp eax, ds:patches_total
.text1:005DFD3E jg done_and_do_snapshot_here
.text1:005DFD44 mov ecx, ds:EIPtable
.text1:005DFD4A nop
.text1:005DFD4B nop
.text1:005DFD4C nop
.text1:005DFD4D nop
.text1:005DFD4E mov edx, [ecx+eax*4]
.text1:005DFD51 mov [ebp+Context.Eip], edx
.text1:005DFD57 mov [ebp+var_8DC], edx
.text1:005DFD5D mov [ebp+var_8E0], 0
.text1:005DFD67 mov eax, ds:patches_total
.text1:005DFD6C mov [ebp+var_608], eax
.text1:005DFD72 loc_5DFD72:
.text1:005DFD72 mov ecx, [ebp+var_8E0]
.text1:005DFD78 cmp ecx, [ebp+var_608]
.text1:005DFD7E jge short loc_5DFDD5
.text1:005DFD80 mov eax, [ebp+var_608]
.text1:005DFD86 sub eax, [ebp+var_8E0]
.text1:005DFD8C cdq
.text1:005DFD8D sub eax, edx
.text1:005DFD8F sar eax, 1
.text1:005DFD91 mov edx, [ebp+var_8E0]
.text1:005DFD97 add edx, eax
.text1:005DFD99 mov [ebp+var_8E4], edx
.text1:005DFD9F mov eax, [ebp+var_8E4]
.text1:005DFDA5 mov ecx, ds:EIPtable
.text1:005DFDAB mov edx, [ebp+var_8DC]
.text1:005DFDB1 cmp edx, [ecx+eax*4]
.text1:005DFDB4 jbe short loc_5DFDC7
.text1:005DFDB6 mov eax, [ebp+var_8E4]
.text1:005DFDBC add eax, 1
.text1:005DFDBF mov [ebp+var_8E0], eax
.text1:005DFDC5 jmp short loc_5DFDD3
.text1:005DFDC7 loc_5DFDC7:
.text1:005DFDC7 mov ecx, [ebp+var_8E4]
.text1:005DFDCD mov [ebp+var_608], ecx
.text1:005DFDD3 loc_5DFDD3:
.text1:005DFDD3 jmp short loc_5DFD72
.text1:005DFDD5 loc_5DFDD5:
.text1:005DFDD5 lea edx, [ebp+Context]
.text1:005DFDDB push edx
.text1:005DFDDC mov eax, ds:dword_5EBA58
.text1:005DFDE1 add eax, [ebp+var_8E0]
.text1:005DFDE7 mov cl, [eax]
.text1:005DFDE9 push ecx
.text1:005DFDEA call get_type_of_jump ; retval in AL:
.text1:005DFDEA ; 0 for short jump
.text1:005DFDEA ; otherwise long
.text1:005DFDEF add esp, 8
.text1:005DFDF2 and eax, 0FFh
.text1:005DFDF7 test eax, eax
.text1:005DFDF9 mov ecx, [ebp+Context.Eip]
.text1:005DFDFF push 0 ; lpNumberOfBytesWritten
.text1:005DFE01 jz short short_jump
.text1:005DFE03 long_jump:
.text1:005DFE03 mov edx, [ebp+var_8E0]
.text1:005DFE09 mov eax, ds:dword_5EBA48
.text1:005DFE0E mov eax, [eax+edx*4] ; offset to jump in eax
.text1:005DFE11 mov ds:opcodes, 0E9h ; long jmp
.text1:005DFE18 sub eax, 4
.text1:005DFE1B mov dword ptr ds:opcodes+1, eax
.text1:005DFE20 push 5 ; nSize
.text1:005DFE22 jmp short patch_the_code
.text1:005DFE24 short_jump:
.text1:005DFE24 mov edx, ds:dword_5EBA5C
.text1:005DFE2A add edx, [ebp+var_8E0]
.text1:005DFE30 xor eax, eax
.text1:005DFE32 mov al, [edx] ; offset to jump in al
.text1:005DFE34 dec al
.text1:005DFE36 shl eax, 8
.text1:005DFE39 mov al, 0EBh ; short jmp
.text1:005DFE3B mov word ptr ds:opcodes, ax ; lpContext
.text1:005DFE41 push 2 ; nSize
.text1:005DFE43 patch_the_code:
.text1:005DFE43 push offset opcodes ; lpBuffer
.text1:005DFE48 dec ecx ; step back to int's addr
.text1:005DFE49 push ecx ; lpBaseAddress
.text1:005DFE4A mov eax, ds:lpProcessInformation
.text1:005DFE4F jmp continue_where_space
.text1:005E0481 continue_where_space:
.text1:005E0481 mov ecx, [eax]
.text1:005E0483 push ecx ; hProcess
.text1:005E0484 call ds:WriteProcessMemory ; WriteProcessMemory
.text1:005E048A inc ds:patch_counter
.text1:005E0490 jmp patch_next

about the crussader-grassy method, it worked on arm2.60a but not later (can someone enlighten wot changet there?)
something had to, the snapshot is still full of garbage. ;o(
crUsAdEr
11-06-2002, 10:41 PM
First thing, you have to make your loop longer to include the key generation process... each block is now decrypted with a diff key generated before decrypting so you have to include that in your loop

Secondly, there are more jump type than just EB and E9.. there are alll together 11h type of jump like JA, JBE, JLE etc... so your patch wont work

Hmm, the jump type are mixed ard in different program, for example GetRight has jump type 9 as JMP while Arm 2.61 has type Bh as JMP... i guess this make it harder for armkiller to create a generic unwrapper... i have to rearrange teh jump table in my code to make it to work... however with a fully decrypted code section, n rebuilt IAt.. the damn prog Get Right still refused to run, somethiing is wrong with stack n i cant figure it out :(... Must be additional check in Get Right cos the arma 2.61 dump runs great... shall wait n see if anyone has any idea wat is wrong with it ... time to give Alexey a break guys, take a look at Armadillo will ya :)

Regards,
crUsAdEr
evaluator
11-07-2002, 08:28 AM
WHAT!?????

Getright is now protected with arma? can't beleave..
crUsAdEr
11-07-2002, 09:38 AM
Done, Get Right is running liek a baby now :)... Armadillo is learning from AsProtect to have hidden check for its server :)... Woodmann was wrong, late night reversing doesnt help much... a good sleep does wonder, found the few checks in no time :)... Sleep is good for you sometimes, Woodmann :D

Regards,
crUsAdEr
_Servil_
11-09-2002, 10:42 AM
hi cruSSader,

can't believe you could fix da thing ;--)

thanks makes things clearer but still failing, two qestions yet ---
1st, could you state what you meant by 'loop longer'? i'm jumping as far as possible, almost the start of ACCESS_VIOLATION handler, anyhow don't find the place created decrypt keys? Did you mean the two xored values used also by filling the tables for ..jmp.. reconstruction? (there's more xor keyz also..)

secondly, i see __much__ the restored jumps are not opcode alligned, i mean they reside inside existing instr... BAD!...is the table at 005EBA4C trustworthy? (i assume it points to next address after the int...)

thanks
crUsAdEr
11-09-2002, 11:45 AM
Hi Servil,

I wrote a little tutorial on Get Right adn it is posted on fravia watsnew page... take a look if you wish... i tried to explain some stuff there but i am quite afraid it is not as reader-friendly as my AsProtect tutorial...

cheers,
crUsAdEr


about g6 and asprotect again...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > about g6 and asprotect again...
PDA

View Full Version : about g6 and asprotect again...

backeyes
10-17-2002, 01:05 PM
Sorry i'm late but i've read g6 ftp server tutorial, and i have a small question first : can you guys tell me which g6 version was it ?
Because i downloaded the last v2.1.0 build 40 and my oep is different : oep is 503A04 for me
But that's not really a problem, certainly a different build...

Anyways i read and understand all g6 tutorial but my unaspr app still doesn't work. Here's what i did :

- find oep with kayaker's way : 503A04
- dump : /dump 400000 170000 c:\dumped.exe
- made VA=RA and VS=RS, fix oep and first section in dumped.exe
- resolved all api with revirgin (i tried with imprec too) and attached iat at offset 170000. i'm going to attach my resolved iat here...

And my unaspr exe don't crash but run in background. i now there's other asprotect tricks after but don't think my problem comes from there, i certainly have another problem before that...

tell me if you want more details about something i did
Any help would be very appreciated

best regards
esther
10-17-2002, 04:54 PM
Hi,
>dump : /dump 400000 170000 c:\dumped.exe

170000 should be the size of image not iat offset

oep is 503A04 =503A04-40000=?
backeyes
10-17-2002, 11:15 PM
yep you're right esther but in this case size of image and and where i put my new resolved iat offset are the same
Atfter dumping i attached iat at offset 170000 with size 3000 so that my new size of image is 173000

and for oep : 503A04 - 400000 = 00103A04

I think these two things are right for me ;)
so wtf ?

regards
backeyes
10-19-2002, 06:01 PM
anyone ? :confused:
Kayaker
10-19-2002, 07:11 PM
Hi

Forget the fact that it's G6 or whatever. Are you well familiar with what's been coined the Double Dip and the ways to deal with it? If not, then go back and search this to exhaustion in previous Asp threads. This should point you in the right direction.

Kayaker
backeyes
10-20-2002, 01:07 AM
yeah you're right, all asprotect text i read didn't speak about Double Dip, certainly due to older asprotect version :confused:

Thanx Kayaker, i think it will point me in the right direction
Let's fire up sice now ;)

thanx again
regards
TheSearcher
10-21-2002, 06:27 PM
Hi Kayaker,
*what's been coined the Double Dip and the ways to deal with it?
I don't really understand the"Term" Do you mean double layer of encrypted code?

Regards
Kayaker
10-21-2002, 06:58 PM
Hi TheSearcher,

That was Splaj's clever term for the behaviour of Asprotect to occasionally "dip" more than once into the regular program address range to run some code during unpacking from VirtualAllocated high memory.

The term is used pretty loosely, so pertinent threads will come up in a search for
Double Dip
DoubleDip
D-Dip
Dip + Asprotect
Dip + Splaj (relax, I didn't say Dip = Splaj :p
...

Also check just about any thread in the Unpacking forum for Asprotect + Splaj, SV, Solomon, FoxThree, Crusader, Evaluator... who'd I miss?

This thread, out of many, is probably a good start I guess.

http://www.woodmann.net/forum/showthread.php?threadid=2799&highlight=dip+Asprotect

Kayaker
TheSearcher
10-23-2002, 11:09 AM
Hi Kayaker,
I have read about it 10 times :p.What +Spalj describe is weird
about dipping and sources ;).Kinda funny anyway.New Aspr is more complicated great improvement.

Regards


Azpr's new check time algo !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Azpr's new check time algo !
PDA

View Full Version : Azpr's new check time algo !

Nigma
10-18-2002, 10:04 PM
Hello all ,

As u may know proggies protected with the asprotect version
doesn't closes filemon & regmon anymore . It seems that
Alxey doesn't have anything to hide in the registry , I tried
to get more trial time with no success .
Does someone konw how to crack the new aspr time
check ?
Paul333
10-19-2002, 12:21 AM
I dont know if its the same for all apps but the one ive got is packed with the new strain of asprotect 1.2 and when my trial period runs out i just double click a reg file i made for it and it runs:):)...so obviouly it does check certain keys for flags but what those keys are im not too sure at the mo as .the reg file i use has 16 keys/values in it ..How did i make it??....It wasnt straight forward ..i installed the app using easyclean but somehow it didnt catch all the keys that where changed but thankfully i already had a copy a registry i had saved using an app called Testrun months ago :) so i reinstalled that registry and the asprotected app ran again like new ...in order to track what keys where changed i saved a copy of that old test run registry in Advanced registry tracer then ran the asprotected app again and did a compare ...so as i say im not exactly sure what keys where changed by asprotect but ill check it out

paul333
foxthree
10-19-2002, 04:23 PM
Nigma:

It is pretty straightforward. I tested it with LogFileTail (latest-latest-ASPR strain :D). *Hint* Look for ASprotect in the regmon trail and you can't miss it.

Signed,
-- FoxThree
Paul333
10-19-2002, 08:17 PM
foxthree..nope its not as simple as that:).......Just deleting or renewing the value in HKEY_USERS\.DEFAULT\Software\ASProtect\Data doesnt work:(

paul333
wbe
10-19-2002, 09:26 PM
Try this:

Delete the related binary value under HKEY_CURRENT_USER\SOFTWARE\ASProtect\Data

then use Microsoft's Regclean.exe. Run the app.

:p

P.S. I didn't actually try this because I usually finish aspr off first. Somebody once told me about this trick.

Good luck
Nigma
10-19-2002, 10:02 PM
Found Something !!

well I found that if I delete the reg under ASPROTECT which
foxtrhee talked about aspr reads a lot of registry keys and
build new value . After little tracing I saw that aspr is
using the REGENUMKEYEXA api to read almost all CLSID
I think it is to fool REGMON ( to make it hard to read all
the keys and see something interesting ) but I am sure
it is use it to build the new value that I mentioned , because
when I deleted some CLSID keys the proggie starts a new
trial time !
wbe
10-19-2002, 10:18 PM
Tried on a couple of aspred progies now.

In fact, there is always one specific CLSID key (for each app, of course), not some. A quick search on regmon log reveals the repetitive patterns.

Take a closer look.

:p
foxthree
10-20-2002, 03:29 PM
The CLSID AFAIK was an old ASsPR trick. I still vividly remember the time I deletec the HCKR\CLSID to get the trial back. That was way back (I think CoolMouse from ShellToys or something like that). Anyways, I think the new strains did away with CLSIDs but who the heck knows phully...there are too may ASsPR strains. Hey may be AV vendors should name ASsPR strains for our sakes :D

Signed,
-- FoxThree
wbe
10-20-2002, 06:51 PM
Hiya, foxthree

KAV now identifies aspr. Versions 1 to early 1.1 are mostly not identified. Then it identifies as "PE_Patch". From early 1.2 to date it is "PE_Patch+ASProtect". I have a couple of progies which always use the latest version. So I can closely follow what's new with aspr now. KAV also gives some indications on the version upgrades. It takes longer (and longer) for it to identify latest aspr versions regardless of size of the executable.

Anyway, I compared five September babies (latest being Sep., 22) and here is what I got:

If "HKEY_CURRENT_USER\SOFTWARE\ASProtect\Data\XXXXXXXXXXXXXXXX" (the value of which holds the the date of installation) is missing, Aspr always checks below key amidst of a thousand junk ones to assure if no trial reset attempt is made. I guess the key holds the unique product identifier data:

[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{XXXXXXXX-XXXX-11D6-8481-000054534544}\TypeLib]

So, deleting both gives you a virtual clean install each time. At least, this was the case for my PC. I couldn't check it on another PC.

Hope this serves as a useful hint for "those who could not unpack in 30 days", as +SplAj once quoted (and, what a courteous wording of him) in a reply to the thread I started about "latest aspr tricks".

Have you got stg. interesting about the new strains, foxthree?

wbe
;)
Peacemaker
10-21-2002, 08:29 AM
Last weekend I did a loader on Advanced Office 2000 Password Recovery. so you can register the program much easier:

1. Go to registration screen of the program
2. Enter any serial
3. Set a bpx messageboxexa
4. when it breaks press f12 until program code and take the next call
5. Go inside by pressing F8
6. Overwrite the first bytes by doing an
"a" (without the ") + press ENTER, and then writing 1 in al by doing an "mov al,1" (without the ") +ENTER and then setting a return by typing "ret" (without the ") + ENTER
7. Remember the Virtual Addresses you did that and do a loader for this program

You need to do an aspr loader, normal loaders won't work because aspr protected programs have loader protections. you get some ASPr loader asm source from the WKT! site...

ciao, Peacemaker
foxthree
10-21-2002, 10:27 AM
Peacemaker:

I don't think *any* serial would work. How did you manage to decrypt the code encrypted fragments in aopr?

Signed,
-- FoxThree
Peacemaker
10-21-2002, 11:45 AM
I haven't managed to get a valid serial yet, and I think this won't happen some day. I created a loader which registered Advanced Office 2000 Password Recovery 1.20. And if you wan't me to, I could send you the asm source of the loader.
I use Win98SE with SoftIce 4.05 and Icedump loaded to crack this app. It's easy doing a loader, but it's also possible to unpack an de-blacklist a blacklisted serial an register with the serial you de-blacklisted. But this would take spending much more time, so doing a loader is the easiest and the fastest way to do it...

greetz, peace
foxthree
10-21-2002, 01:32 PM
Hmmm... if I remember right, Elcomsoft guys encrypt critical code sections that can be decrypted only with the correct serial. The same was the case with aopr 1.2 which I last unpaxed and regged. Unless they've changed the scheme, if you just force decryption with some random serial, the code will be junk and surely the app will crash. Did you try accessing the disabled portions of the application after regging? I'm sure you'll see by what I mean.

Hint, search for posts by the great +SplAj, SV and of course my friend Crusader :) [Where art thou, Crus...?]

Signed,
-- FoxThree
Peacemaker
10-21-2002, 02:19 PM
@fox: you mean the 5 char limit at the wordlist search? i now can search for more than 5 char passwords...

is that what you meant? i think so or?

I've seen a rls from a group which name I now can't remember but that I'll post here if I'd time to dupe. The group released the pro version of the program WITH keygen,... thought of it being a joke but need to know if this file really exists...
foxthree
10-21-2002, 03:17 PM
AFAIK, there has been no keygens for elcomsoft apps (atleast publicly) and there has been only serialz leaks. Again, I ask, how did "any" serial work?

Signed,
-- FoxThree
evaluator
10-21-2002, 05:06 PM
Hello, Peacemaker!

I did as you wrote,
e.g. overwrote the first bytes with your full text:

"a" (without the ") + press ENTER

NOT WORX!

What is wrong!?

~:0
+SplAj
10-22-2002, 12:06 PM
Peacemaker

I do not believe that it is possible (in the short run of a milion years or so) that a specific aspr target can be keyed.

What I know can be done, as i've done it myself, is this :-

1) Find a blacklisted key for your target
2) use it and trick target (aspr code !) that key is ok
3) Target 'decrypts' ALL encrypted trial sections (e.g open 'VBA' in AO2000pro)
4) dump and rebuild exe
5) correct the header with .code, .data. .bss .rsrc etc etc
to get back to original exe ;)
6) re-RUN ASPR on your unpacked target as a new project with a NEW set of keys ......and you have a keygen !

I have done this with last AO2000pro v1.20
ASPR simply re-encrypts the marked sections and U own the target.

Now......I am waiting for latest AOXPpro 'blacky' to appear ;)
and NO I don't release keygens......but I may do a tut on this scheme....or
Peacemaker
10-23-2002, 08:35 AM
I sure believe that the target only fully decrypts if a valid serial is entered. but as I see the program is fully registered and the crippled functions work as well. If you want me to I'll send you the loader.

I would be interested in the scheme described last of using a blacklisted serial, unpacking it an then re-protect it with asprotect and so doing your own keygen.

I'll be waiting for the tut ;)
Peacemaker
10-23-2002, 08:36 AM
@+splaj: I read a lot of your posts, and I did a long search for your tutorials on the net, but I haven't had any success in it. WOuld it be possible to send me some tutorials of yours or is there still a site where I can find them?

thankfully, peace
+SplAj
10-23-2002, 02:48 PM
hi peacemaker

sadly (or gladly) www.discompress.com is no more :( all my old ramblings are hyperdust.

I keep thinking about making tuts in the standard format of Fravia html.....but as i'm usually sipping whiskey+coke by the poolside each day and with the mp3 music from my iPaq adding to the haze such ideas soon get blown away .......

Honestly, tuts are a bad bad bad idea, unless they discuss the theory and make the user THINK..... too many times JNZ 456789 is not in the latest target app....and confusion and frustration abound.

So do this :-

Find AO2000pro version 1.20......
Unpack it, make the jumps to get 'business licence'

All should be ok ......except if you press VBA ....hmmmm shit.

Now SEARCH the www for a 'blacky' ( thats not asian pron ;)
enter into the registry 'key' You will notice it is Elcomsoft own proprietry licence scheme, much more 'insecure' than Alexeys, but it is still used by ASPR to decrypt just the same.

Now trace through the code again in original ASPR protected version, make it 'business licence' again with WinHex or SI poke, whatever,now it is fully registered AND decrypted, VBA is zuper gut :) and NOW dump and rebuild this baby.

Compare the 2 dumped.exe files with HexWorks...... all sections are decrypted and you own AO2000pro.

Now some fun, PLAY with that licence.... how many characters have to be valid.....hmmm bruce force maybe possible this side of a million years ;) ....maybe I like RCE......maybe I play Bruce Lee with OTHER Elcomsoft targets......... eeeeeeeyaah :)
_Servil_
10-23-2002, 06:21 PM
Hello,

this might be a little OT but as I see elcom discussed here their sn check func is what I wanted ask here recently, this is a simple, no-call/loop/jump, but pretty long (couple hundreds ops) sub taking something like 'magic tale' ;-) with sn producing another serial. The goal is to get input -- serial, knowing the result and second arg -- after hours of work the formula could be constructed but it's too complex to isolate input serial, for me, and BF is pointless since the serial has over 20 characters. Did someone inverse these funcs? Just curious.
JMI
10-23-2002, 07:58 PM
Peacemaker:

If you do a search "here" with "+Splaj tuts" you will find some of his masterpieces from his discompress site. A number of them are also in the unpacking section of Krobar's site.

wbe:

I'm working on trying to "reactivate" an aspr 1.2 file which has expired through problems with attempting to learning sice on win2k. I am going through the regmon printout and find no key

[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{XXXXXX
XX-XXXX-11D6-8481-000054534544}\TypeLib]

like you suggested as being checked by the program if the asprotect\data file is deleted. Are you using Win98? and do you know if the file is different on Win2k??

I noticed that the exe file from setup creates a key in HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common AppData.

It also seems to make some interesting use of
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed

and a strange one called

HKCU\SOFTWARE\MICROSOFT\Windows\CURRENTVERSION\Explorer\UserAssist\{75048700-EF1F-11D0-9888-006097DEACF9}\Count\HRZR_EHACVQY:%pfvqy2%\OvgFuncr FZF Zrffratre

which might be interesting, and a value is set there, but I haven't had time to check it out yet.

Still having major problems with Sice on Win2k. Haven't figured out why "EXP=\%SystemRoot%\System32\advapi32.dll" doesn't seem to work to load advapi32.dll from my winice.dat file when the rest of the entries work fine, but I can load it with the loader. Can't much play with the registry without its API's. What I need is more time to play and less time to work on this friggen computer.

Regards.
wbe
10-23-2002, 11:29 PM
Hi JMI,

I'm using W98 and I never had a chance of trying it on W2K. The closest PC to my laptop is in a 1k miles distance on this deserted land.

All I can suggest is to look for some similar repetitive patterns in regmon log as exemplified in:

[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{XXXXXX

XX-XXXX-11D6-8481-000054534544}\TypeLib]

and "RegEnum" may be a good keyword to start searching in the log.

Another interesting point is that, after deleting Data under Asprotect, Microsoft's Regclean always catches these orphan \TypeLib entries along with some other keys found in the log . No other reg manipulation tool I have could do this. I couldn't figure this out yet. Anyway, it serves as an automated trace remover for aspr
:p

I haven't had any occasion to check the other keys you've talked about. My W98 works in perfect harmony with sice in all respects. I cannot afford upgrading after reading all the posts about the troubles other pals are having.

Wish you good luck

wbe
JMI
10-24-2002, 12:13 AM
Hi wbe:

You should get a pony to ride to the closest internet cafe. :D
Win98 seemed easier for Sice, but it was always crashing. Not a good thing when you need to get work out the door and it's on the computer and it won't work. Win2k is much more stable.

Thanks for this info. I'm still looking through the regmon printout. Just for your infor the word to review in the regmon printout is "EnumerateKey" rather than "RegEnum." When you spend hours editing the printout to remove the "checkkey" and "openkey" and "querykey" and then "closekey" you are finally left with just entries of "createkey" and "enumeratekey." This particular program makes a pass through "all" the "uninstall" files to bloat its printout or is it looking for something?? Interestingly, it doesn't seem to check the keys for numega or softice. Now that's strange.

I downloaded an ebook titled Nt and Win95 Registry and I am very curious to find out what the heck some of the entries are. There is always something more to read and always a great deal more to learn.

Stay safe out there.

Regards.
+SplAj
10-24-2002, 07:43 AM
_servil_

I know what you mean, all those 'advanced we-crack-U-pay' tools appear to have unbreakable serials.

You can trace that long algo and find an expected 16byte result....but the bastard soft uses the serial not the calculated result to decrypt with :(

However, If you try my method discussed above you'll be suprised at how weak their use of aspr really is.

1) They maybe use something like AO2KP-BLAH-BLAH-BLAH
2) and the real weakness is the shortness of the 'decryptor' part, the rest being BLAH ;)

Have a play and you'll see

Now Elcom will switch to Alexeys inbuilt key ?
Peacemaker
10-24-2002, 08:28 AM
@+SplAj: I'm sure your instructions are right and well working, but I haven't had much experience in unpacking btw inline patching asprotect yet.

At the moment I'm gonna fuck up myself with the shitty version 4.6.2 of Vbox on Adobe GoLive 6.0 ENG. I know there's still a thread open on this board discussing that problem, but noone found a good clearing of the problem till today. :(
Sure there are some good crackers who did, but thats not me :( I dumped, fixed sections and OEP did the imports but there must be one till two imports failed, even if ImpRec said it was right and all are fixed...

So back to AO2000PR...
Are there some good Tutorials out playing with the version of asprotect the program is protected with? who wrote it? where to find?

Thanks for your time your greatness ;)
wbe
10-25-2002, 11:06 AM
Hi JMI,

I am awfully sorry for the incorrect search word :o

I can't stay online for long nowadays (having problems with my sat link and relays), and aspr is my only toy to play while I'm off duty. So, my head was full of some set of APIs while I was typing.

What's the size and intended OS version of your target? If it's 1-2M big and works with W98, I'd like to have a look at it. Post the URL or PM it. It may be a chance to discuss some aspr behaviors on different platforms. Hopefully, if I can manage to arrive here again before you finish it off.

Regards,

wbe
JMI
10-25-2002, 06:34 PM
wbe:

While I was working my way through the 24,000+ lines of my RegMon file in attempts to identify the second key that aspr places on my Win2K machines for my target, I took your advise and installed and used my copy of RegClean and, lo and behold, it worked to remove the added "TypeLib" file that the program added and allows a "clean" install with a renewed time limit. This particular target allowed only 13 "executions," so even if the program was "executed" to the start-up screen, and not actually "run," this counted as one of the "executions." I was having so many problems with Sice that I quickly used up my limit. My first problem with the use of RegClean was that there were many "orphan" entries on the first run that were "cleaned" (even though I had used a commercial registry cleaner shortly before) and none of them were in the format you identified.

So my next effort to "identify" the offending entry was to re-install the program, again use its uninstall exe, open RegEdit and erase the Asportect\Date key and run RegClean again. This time I got only one "new" removed entry, and again I was able to make a "new" clean install with a "new" time limit. So this technique works on Win2K as well as your report of its success on Win98.

After doing this several times, it became clear that, at least on Win2K, aspr was creating the "second" key "at random." The form for the key numbering format was always different, although the critical key had two constant repeating factors: It was always "TypeLib", like you stated, and always added near the end of the CLSID structure.

Having now identified an "easy" method of restarting the "timelimit", I began to study my RegMon file to attempt to gain a better understanding of what the program was doing, both to create this key and hide it from our prying eyes. What I found is rather interesting and a good lession in efforts by the protectors to hide their work.

I have not yet finished my analysis, but the first thing I did was to remove all the entries which were not explorer and/or target related entries from the RegMon printout. (A piece of advise here for those who haven't spent a lot of time with RegMon, TURN OFF ALL OTHER PROGRAMS RUNNING IN THE BACKGROUND BEFORE ATTEMPTING TO TRACE AN INSTALL, otherwise there can be whole lot of "extra" crap to remove, or ignore in the printout.)

We know that to make a key for use by the program, there has to be a call to QUERYKEY, and/or ENUMERATEKEY, then perhaps OPENKEY, and, if the key doesn't exist, CREATEKEY. But this is only the start. Having "Created" the key, the system next checks it "Key" entries and has to "Create" them and check their "Default" status and "create them" by SETVALUE. Then it has to "Create" a "TypeLib" and SETVALUE on a "Default" setting and then call OPENKEY again and SETVALUE once again with the aspr data. Now we have the "Key" that aspr uses to check against the Asprotect\Data Key.

So how do we find this "Key" if we don't simply use RegClean to remove it for us? It's relatively simply when we now know what to look for. With the caution that I've only analyzed this one target for this issue, I note that the creation of the "timelimit" key occurs in the RegMon printout almost directly above the creation of the Asprotect Key and Asprotect\Data key and is simple to spot with a fairly "clean" RegMon printout. So it appears that this issue is resolved (for now) but there is more interesting material to be learned from analysis of this printout.

First, to make it difficult for us to use Sice or some other debugger to find the creation of this Key, the program appears to run through almost the entire CLSID list probably MORE THAN ONCE, calling OPENKEY, QUERYKEY, and ENUMERATEKEY so often that anyone attempting to trace with these api's in the debugger would have a very very long process of tracing to get down to the end.

Since, at least on Win2K, there is no set pattern on the form of the "Key" that is created, it would be difficult to filter the breakpoint on those entries. However, it should be possible to construct a breakpoint which only checks (in the proper API format) calls to CREATEKEY and SETVALUE and break only on the important calls here. There is also the current limitation that the "Key" is of "TypeLib" as a possible additional filtering limitation. I haven't had time to try this yet, but it should work. Certanly RegEnumKeyExA would make one go blind and angry with all the hits to useless calls checking the list of the CLSID's.

But, wait boys and girls, there's more. This program also creates Key entries for its 'Version" and SETVALUE on a "version" number. It also creates a "control" for the program to use. However, the really clever thing that this version does is that it creates these "Keys" IN EXISTING KEYS FOR OTHER PROGRAMS.

Part of what it is doing with all its calls to EMNUMERATEKEY is to check the CLSIDs for existing entries of "TypeLib." When it had reached near the end of the list (so far all my Keys have been in CLSIDs which begin with an alphabet letter after checking most, if not all the others more than once) it somehow finds an existing key which DOES NOT HAVE A "TYPELIB" and grafts aspr's key into the existing key by calling CREATKEY and SETVALUE. I don't know enough yet to know how this is possible (always more to learn) but it is clearly what is happening here.

Not only was it able to graft this "TypeLib" Key on to an existing Key for something else, it was also able to graft the "version" and "control" entries onto a DIFFERENT key on some of the installs. I am still checking to determine whether it does this if the Key it chooses for the graft of the "TypeLib" already had a "version" and/or "control" entry, but it makes sense that this might be the case, because on at least one of the installs, it created all three keys grafted onto the same existing Key.

The only good news is that all of this happened (on this program at least) immediately above the creation of the Asprotect and Asprotect/Data Keys and was clearly visible in the RegMon printout, even if it would have been a very long long long way into a trace in Sice without proper filtering of the registry calls.

Now that I've figured out how this "timelimit" issue works, I can go back to my original task of figuring out how to make Sice work for me on Win2K and manually unpack this puppy to help someone who asked for "easy English" assistance on this particular target.

One last thing visible in the printout is that aspr is making some form of a hash out of machine specific information. The person I am trying to help sent me a copy of his Asprotect\Data file which, naturally, didn't work on my machine. On his machine he was able to "reinstall" his Asprotect\Data file with 6 executions left and keep resetting it that way. I didn't try this on my machine yet, because at first I didn't save the original install Data file before crashing my computer many times with Sice. It would be something else to check. On the start-up screen of this program it clearly identifies a hash of this "hardware identification" which did not change with the various installs. In the printout from RegMon one can see some of the reads of information which appears to have been used to create this information.

Enough for now. Time to get back to real world work.

Regards.
wbe
10-25-2002, 09:47 PM
Good work JMI, a very informative and scrutinizing essay of yours. A rather unexplored area of aspr "codewoods" has now been cleared.

This, imho, serves as an unofficial announcement about a Service Release in the upcoming days :D

Regards,

wbe
Paul333
10-27-2002, 01:05 AM
Nice one JMI:)....

Its thorough in depth replies like this that i learn lots from ...THANKS!!

paul333
nikolatesla20
10-27-2002, 03:48 AM
That's what the software lab is for.

I load up a clean win9x machine, run RegCompare.

Load up the software.

Run RegCompare.

Print out the differences. Find encrypted values. Date checks defeated. Piece of cake. Works every time.

This is my standard operating procedure on date limits, besides using RegMon. Regmon gets too involved tho, because its live and it gets ALL registry activity if you don't set filters.. It's better to use the Reg Compare deadlist, so you only look at DIFFERENCES.

Bow to the power of Registry Compare.

-nt20
Peacemaker
12-04-2002, 11:09 AM
@foxthree: It is possible to keygen an elcom software...
as I said I now GOT this keygen I talked about. I can't tell you who did it atm, because I'm at work. But when I'll go home I can send you the keygen if you want me to. In the nfo its written that the progra,m itself was protected with MD5 algo. So its possible to keygen. And one guy did.
crUsAdEr
12-04-2002, 12:41 PM
Hi Peacemaker..

That would be interesting... i am sure our resident Cipher Knight will be interested in this if it is a REAL keygen... though Elcomsoft uses MD5 encryption, most of the password recovery stuff has a small security leak built-in :).. so it is possible to fully reg them... but a real keygen would be very interesting to study...

Are you sure the guy who releases it doesnt do as SplAj has said? Does the keygen works with the version downloaded from Elcom site? And How many different keys does ti generate? :D :D

regards,
crUsAdEr
Peacemaker
12-04-2002, 12:51 PM
hi crusader:
i haven't tried many of the keys but it seemd to work.
but it also may be possible that the guy did like +splaj had said -> unprotecting->de-blacklisting->regging->reprotecting
So I'll upload the keygen anywhere when I'm home and up. :-)
ReaL|sTy
12-04-2002, 07:30 PM
you asked how new ASPR time limit algo. works.. easier than before maybe you know that previous ASPR versions reads the last time accessed from some registry key made in:

[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\.....

with different values depending of your WIn OS "product ID" if you make the value common in any win OS(win9x,Win Me,XP,2k,NT) then key for XX program will work for any of them. the idea is make it generic so if you make a loader for the registry which it deletes the key or value then the program won't never expire

for previos ASPR versions the key is made reading this registry values:

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion]
"LicensingInfo"=" "
"ProductId"=" "
"ServicePackNumber"=" "
"SubVersionNumber"=" "

the first key it reads is SubVersionNumber if the key is not present it will read ServicePackNumber or maybe the other which i don't remember then depending of the value, it mades (example):

[HKEY_CLASSES_ROOT\CLSID\{AA77D79D-D672-783D-D199-B1DA75B391CD}]

[HKEY_CLASSES_ROOT\CLSID\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}]

if you make the values "ServicePackNumber"=" " <<----
"SubVersionNumber"=" " similar for each win OS the CLSID key/value will be the same

of course for each aspr packet app. the clsid key will be different even if your WINDOWs ID is the same

some people thought the key is made because aspr protected app. reads some other infomatin like the HD key. that's wrong.

now is easier than before aspr time limited app. works by adding the registry key:
HKEY_CURRENT_USER\SOFTWARE\ASProtect\Data you all know that ;)

first it reads the String Value "Key"="" if not present then it goes to check time limit, this is in case the program is protected with the Encription registration method aspr uses

if you check with reg monitor you note that dosen't read other time limit related key but actually it does ,the fact is that it has two checks.

it does the first check on: HKEY_CURRENT_USER\SOFTWARE\ASProtect\Data

it writes there the first time that you ran the program with some hex values (encrypted values)

if you hit your clock forward you'll note that program is still expired or becomes expired :(

if you put the normal/actual date back program is still good and working only if you delete the key ........ASProtect\Data again because after expiration it modify the hex values to tell the program the next time you try to run it it was expired , will read the key and will continue expired

have you tried to delete that key open reg monitor and run the program again to see what happend then?

this is what it does ramdonly read for many keys on:
[HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\...

this happend if the first check: HKEY_CURRENT_USER\SOFTWARE\ASProtect\Data is not present then i goes/jump for the second time limit check

which is in: [HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\

is hard to find because it reads too fast and reads there many keys not for the program. if you're advanced win user you can delete the complete Key CLSID also delete ASProtect\Data run the program again and you'll see how beutiful the program takes some delay then made again ASProtect\Data and a key (example) in: [HKEY_CLASSES_ROOT\CLSID\{AA77D79D-D672-783D-D199-B1DA75B391CD}] with the actual date ;)

this could be generic for each win os on different aspr packet programs if you take the current date hex values: HKEY_CURRENT_USER\SOFTWARE\ASProtect\Data the same key of CLSID and you could use some time faker or something and you app. won't expire and you can use for it any win OS. if you took the same registry keys/values and make some kind of time limit loader that gives the date when the keys were working. all is done! i decided to give this information because sometimes is easier than you think and never noone spoke about this (i think). hope this help many of you :p my native language is not english if someone did not exaclty understood something you can PM me if desire.about deleting CLSID complete key.. becarefull because you win could crash. only do it as i said if you're experienced and you know how to fix/recover registry backups .i told this so everyone could see how this new aspr time limit check works in case you can't find the right CLSID key note that it also generates the CLSID keys ramdonly, if you delete it and you delete ...ASProtect\Data it will generate another CLSID key different each time you delete it. i'll hope i'm not breaking any rules on here with this information. please if something is wrong forgive me and moderators please edit or delete this reply.
JMI
12-04-2002, 08:27 PM
ReaL|sTy:

I would be extremely careful about suggesting that anyone delete their entire CLSID strings because you will most likely get results you didn't anticipate and this is COMPLETELY UNNECESSARY. If you have read my previous posts in this thread you will note that aspr places the CLSID key "at random" by reading through the keys to find one without a "TypeLib" subkey near the end of the list (at least this is what it does in Win2K). It then adds information and a"TypeLib" key to some other program's CLSID key. In other words it does NOT create a new CLSID key, it just modifies one that is already there but doesn't have a "TypeLib" subkey attached to it.

However you DO NOT NEED TO FIND THIS KEY ITSELF. If you delete the asprotect key and then run microsoft's RegClean, it will find and remove this added "TypeLib" subkey everytime. I Tried it more tha 50 times and each time the "TypeLib" subkey was in a different CLSID which had not had it's own "TypeLib" subkey already and running RegClean found and removed it easily. These two steps reset the timelimit without dangerous modifications of the registry, such as deleting ALL the CLSID keys. Give it a try. I haven't tried it with other OS systems yet.

Regards.
ReaL|sTy
12-04-2002, 08:48 PM
sure JIM this is just another matter of finding the CLSID key which isn't hard at all but this is for knowledge only.. anyone can try it sure is dangerous as i said for experienced users only. you can export it( for savety) and import it as soon as you see how your aspr packet app. works and made the key i did it like that just for testing purposes in Win98 Se
Nigma
12-04-2002, 08:56 PM
if u want to defeat this time procedure do the following :

first delete the key asprotect in HKCU\software
then :

bpx ENUMEREGKEYex if *esp<02000000 do "r esi 1"

press F5 until the proggie run .

good luck !
ReaL|sTy
12-07-2002, 03:38 AM
btw anyone knows how the time limit clock checks works on armadilled protected ones? ;)
banshee
05-03-2003, 01:10 PM
Searched for some info about Elcomsoft product protection. Idle curiosity made me to bring up this old long thread.
Peacemaker & crUsAdEr:
What about keygen - is it real keygen and it works? (actually doubt) :)
_Servil_
05-03-2003, 04:54 PM
It's just what +Splaj has written,
(I have tried Splaj's trick on some elcomsoft a time ago but aspr required additional HWiD or name (don't remember exactly yet) to generate the keys, since I know elcomsoft doesn't require either I got quite fooled...
There is only keygen rite for AO2kPR made by fallen which is however not keygen in it's real sense, you will have to bruteforce the db hardcoded and have luck enuf 2guess the initial seed'n'algo used to generate the series... ;))
banshee
05-04-2003, 02:09 PM
Unpacked the last version of Elcomsoft's AIMPR. +Spl/\j thanks for tips. For me the easiest way was to rip&paste three pieces of code from the original aspred file (of course I had blacklisted serial). Don't understand what is those keygens is needed for, now I have full working app without any limitation. Anybody knows how often they change key which parts of code are encrypted with? Seems that not too often...


CoDe_InSiDe's "checkit" crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > CoDe_InSiDe's "checkit" crackme
PDA

View Full Version : CoDe_InSiDe's "checkit" crackme

rmlobvx
10-19-2002, 03:47 AM
CoDe_InSiDe's crackmes are always very interesting, so lets check this one out...no pun intended. Rather than solving only for the proper serial we are also going to find the SoftICE detection (a simple, classic use of it, no problem at all) and write our own decryptor for the EXE. It is a simple algorithm and will be very easy to understand, but we'll learn something from it for sure. The crackme is attached. I would rate this project as somewhat low newbie level.

rmlobvx
rmlobvx@reverse-engineering.info
ZaiRoN
10-20-2002, 10:15 PM
Hi rmlobvx,

>CoDe_InSiDe's crackmes are always very interesting
i agree with you :)

i'm working on this target and i'm only using ida because this crackme offers the possibility to learn something new: idc language :).
this is a language similar to C (you have to know a little about C :)) and is included in ida. take a look in the ida help to see a little guide on this *new* language.

i have used idc to decrypt the two areas.

- first of all, you have to create a .idc file. call it as you prefer...
- after that, you have to write the decryption procedure:

static decrypt() // the name of the
procedure
{
auto area, tmp_byte; // variables declaration

// decrypt the first area
area = 0x401000;
while (area < 0x40137F) // while statement
{
// gets the byte pointed by area and adds 1 to it
tmp_byte = Byte(area) + 1;
// patch the byte pointed by area
PatchByte(area, tmp_byte);
// moves to the next byte
area = area + 1;
}

// decrypt the second area
area = 0x401400;
while (area < 0x4014CF)
{
tmp_byte = Byte(area) + 1;
PatchByte(area, tmp_byte);
area = area + 1;
}
}

- save the file; go to ida and press F2 to load the file
- it's time to execute the script. press Shift+F2 and type the name of the procedure to execute: decrypt();
- hit ok. if you have not made some error, the script will be executed and the area will be decrypted
- game over!

as you can see, idc he is much simple one to use, very amusing, and if it is used well it is also much powerful.

now, the code is all in front of us and to find the right sequence is not very hard...

good luck and have fun!!! :D

ZaiRoN
Kayaker
10-21-2002, 05:08 AM
Very cool Zairon! I will be making much more use of IDC scripts from now on ;)
ZaiRoN
10-23-2002, 06:22 PM
thx Kayaker ;)

I have found the sequence but there is a little problem: the crackme crash -due to the 'inc edi' instructions located in the range 0x400FF8/0x400FFFF.
The problem is easily solvable changing a value in the pe-header; which will be this value? :p

regards,
ZaiRoN
Kayaker
10-24-2002, 04:46 AM
Hi Zairon

Yes, I've definitely just become a real fan of IDC scripts, lol. Made very good use of Toteu's Icedump-to-IDA script for a start, pretty sweet. I see there's a few interesting script examples at the Datarescue site as well, particulary the Bit Fields tutorial. For a long time I've been wanting to come up with an app/technique to identify the MSG parameter of SendMessage/SendDlgItemMessage calls, a suitable script just might be the ticket and I think I'll play with the idea...

Back to the topic at hand, it's hard to tell what Code Inside had in mind there, those calls to the end of the PE header seem to have no purpose except to confuse the issue. What I did was to bypass them entirely after the first check (401f00 = 01 = "A") to what looked like the continuation of the proper check sequence at 401304. To determine what was a valid s/n I selected *every* letter, (filling every byte in the buffer at 401f00 with 01), then followed the pattern of checks and changed the buffer to match. What was left were 7 bytes still filled with 01 which when converted to their letter equivalents would anagram to a "word" that was at least pronouncable, and would solve the puzzle.

Cheers,
Kayaker
ZaiRoN
10-24-2002, 03:03 PM
Hi Kayaker!

>it's hard to tell what Code Inside had in mind there...

at first, i thought like you...i was wrong.
there's a value in the pe-header that specify the length of all headers - and so the offset to the first section's raw data...;)
you should have the answer now :)

bye,
ZaiRoN
ZaiRoN
11-01-2002, 11:23 PM
I don't know if someone is working on this crackme or if it's just dead, anyway rmlobvx asks us to write a specific decryptor for the target.
Attached you will find my decryptor; nothing special, it's written in c and maybe badly coded but someone can learn how to write a simple decryptor from it ;)

regards,
ZaiRoN
evaluator
11-06-2002, 12:08 PM
So I did:
Change byte at D5h: 04>10, so header become 1000h size & includes in memory
code at FF0
then analyze &.. I get this word:

AHMNOPT

what it means!?

BTW, Zairon!
Can you force IDA to analyze that code in PE-header!? :)
ZaiRoN
11-06-2002, 02:55 PM
good job evaluator! Too easy for you :p

>AHMNOPT
>what it means!?
I have found the meaning of this strange string by shuffling the letters (my english vocabulary is very limited)
Finally, PHANTOM is the word we were looking for

>Can you force IDA to analyze that code in PE-header!?
I never thought about that and I don't know if there is an IDA's features to perform the operation.

Anyway, if you want to see which are the instructions in range 400FF8/401000, you can use this simple way:
1. click on: File/Load File/Additional binary file...
2. open the crackme file (Check it!!!)
3. you'll see a box with:
- Loading segment: where ida puts the new bytes. The default value points to the end of the ida's output (if the last instruction processed by ida is at 402FFF, the value will be 403000). You can leave it therefore.
- Loading offset: you can ignore this value.
- File Offset in bytes: we want to view instructions starting from 0x400FF8 so, put 0xFF8 here
- Number of bytes: 8
- 'Create segments' and 'Code segment': check both item...
4. I don't know why but ida creates a new 16bit-segment; we need to convert it to 32bit-segment. CTRL-S to view the segment; edit the new segment and change:
- check '32-bit segment'
5. Go over the first 'db 47h ; G' and type 'c'. You will see the hidden 'inc edi' instructions :)

If someone else knows a better way to do the job he's the welcome ;)

regards,
ZaiRoN
doug
01-12-2003, 10:24 PM
An alternative way of doing so.. when you open a new file, you are prompted for several options..

Put a check next to "Manual Load"

You will be prompted for several things, one of them being "Load the file header".

the pe header will then be loaded, and u can do whatever u want.
ZaiRoN
01-13-2003, 02:39 AM
Thx doug!
This is the correct way to analyze the code :D

ZaiRoN


Hard to unpack :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hard to unpack :(
PDA

View Full Version : Hard to unpack :(

BruceLee
10-20-2002, 06:14 PM
ArtIcons Pro 3.24
=================

ASProtect v1.2? A.S. .data

OEP: 128500

Invalid functions:
Kernel32!GetProcAddress
Kernel32!GetModuleHandleA
Kernel32!GetCommandLineA
Kernel32!GetModuleHandleA
Kernel32!LockResource
Kernel32!GetVersion
Kernel32!GetProcAddress
Kernel32!GetModuleHandleA
Kernel32!GetCurrentProcessId
Kernel32!GetCurrentProcess
Kernel32!FreeResource

But If I dump at OEP: program crash :( raed of address 01xxxxxx!

Before the program comes to the OEP, it dips into the code 7 times,
then it goes to the OEP. I manipulate the first four dips. At the
first four call I see that the program via eax pushes a value to
an adress, [00xxxxxx]. I jump over this instruction.
In fifth call I do a similar thing. The call is longer.
In sixth call I can manipulate program to always have executions left.

Last call is untouched.

Program starts normal but then goes crazy :((((((

Can anybody unpack this proggie to work normal after unpacking?
I do a search in previous threads but not found anything can help me.

Please give me a hand,
Bruce Lee
DakienDX
10-20-2002, 06:30 PM
Hello BruceLee !

I don't need to unpack the program, it sounds to me like something which has been discussed already before and which is really easy to fix.

ASProtect can pass the registered username to the application. (as NULL-terminated string) So the program can load the string and use the value. (for example to display it in the "About" box)

The string is always present, even if it is empty. Then the value passed to the program by ASProtect is a pointer to a single 00h byte.

The memory the address points to is in the ASProtect address space and if you remove ASProtect, this address space does not exist any more and you get a read error. Setting this address to 0 helps most time. (program thinks ASProtect didn't pass him anything)
BruceLee
10-21-2002, 08:38 AM
Hello DakienDX !

I don't think so because on about box wrote:

Registered to:
TRIAL VERSION
DAY 5 of 30
DakienDX
10-21-2002, 09:54 AM
Hello BruceLee !

Have you tested what I suggested or not?

Could you post the piece of code where the read error occurs?

Can you tell what happens if this piece of code is executed while the ASProtect layer is still around the application?
BruceLee
10-21-2002, 01:20 PM
Hmmm I quit! :(

Program after unpacking just gonne crazy and pop up two dialog in same time, menu bar is flashing, pop up dialog for shutdown windows :( No error messages! Strange!
zombieys
10-22-2002, 04:48 AM
bpx findfirstfilea
BruceLee
10-22-2002, 10:08 AM
bpx findfirstfile and then?
+SplAj
10-22-2002, 11:35 AM
Hajo

GDI......he he

This target was discussed by the RV Beta bashers a long time back in the good old days ........ /sigh

I remember that Eval the terrible stuck his numero uno moojo thing far up the backside of this unpacked ArtIconsPro.exe and the strange GDI api problem......

Eval, Eval where for art thou Eval..............
zombieys
10-22-2002, 11:55 AM
can i post the crack download?
+SplAj
10-22-2002, 12:19 PM
Zombyies

_____________________________
can i post the crack download?
_____________________________

err...NO....

how does this relate to 'bpx findfirstfilea' ???
lets do this the proper way in here

....PLEASE !!!........
foxthree
10-22-2002, 07:03 PM
I just unpacked under Win2K and the app. does not do whatever you said BruceLee. But it rather gives a series of Access violations each time touching ASPR code (since it is no longer present). BTW, talk about paranoid, this author checks for ASPR for every mouse click you make. If you really need this software, prepare to crack:

Unpax: ~2 mins
Patching *crazy-number-of-aspr-checks* : ???? :D

Signed,
-- FoxThree
zombieys
10-23-2002, 05:27 AM
sorry
my english is poor
so i can't say more

artpro2.24 can check file size
you need bpx findfirstfilea

open and close artpro2.24,u must do it
Solomon
10-23-2002, 05:58 AM
yes many Dephi appz use class TSearchRec to get file size info etc.

TSearchRec is a simple wrapper of FindFirstFile/FindNextFile/FindClose.
BruceLee
10-23-2002, 09:43 AM
Thx all for helping me!
Now it's work perfectly :)

Yes, bpx FindFirstFileA!

Look at address 4E8903 CALL 00461ADC. This call always return 0009D000 in eax.
Change this in yours dumped file! Address 00461adc is calling on 9 locations.

Bruce Lee
backeyes
10-23-2002, 08:55 PM
0009D000h = 643072 = our target exe size
There's a check with 1000000 so that if the exe file is less than 1 Mb exe will run perfectly
So you're right we change to return from the call with 0009D000 in eax or change all 1000000 check with 2000000 for example as our unpacked exe is about 1,7 Mb

Anyways, i have a small question...
"Look at address 4E8903 CALL 00461ADC"

I can't see how from bpx FindFirstFileA you landed at 4E8903 :confused: (i agree it's the interesting call but am unable to land here on my own)
Could you help me please ?
thanx ;)

regards
BruceLee
10-23-2002, 09:21 PM
00408F7E 50 PUSH EAX
00408F7F E840DCFFFF CALL 00406BC4 ; FindFirstFileA
00408F84 8BF0 MOV ESI,EAX ; landing here
00408F86 897314 MOV [EBX+14],ESI
...
00408FB0 C3 RET ; ok, return

00461B32 85C0 TEST EAX,EAX ; return here
00461B34 7508 JNZ 00461B3E
00461B36 8B9DACFEFFFF MOV EBX,[EBP-0154]
00461B3C EB03 JMP 00461B41
...
00461B70 E85B2BFAFF CALL 004046D0
00461B75 C3 RET
00461B76 E9711CFAFF JMP 004037EC
00461B7B EBDC JMP 00461B59
00461B7D 8BC3 MOV EAX,EBX
00461B7F 5B POP EBX
00461B80 8BE5 MOV ESP,EBP
00461B82 5D POP EBP
00461B83 C3 RET ; return

004E8903 E8D491F7FF CALL 00461ADC ; interesting part
004E8908 8BD8 MOV EBX,EAX ; return here
004E890A 81FB40420F00 CMP EBX,000F4240 ; in eax = ebx = 1B6000
004E8910 7E2B JLE 004E893D ; no jump

Look at this code in original articons.exe. Bpx on CreateWindowExA, and then bpx on 4E8903. Subroutine on address 461ADC always return 0009D000 :) and then on 4E8910 jump!

Open dumped file in W32Dasm. Go to address 461ADC. This address is calling on 9 locations:

49ace9
4ae555
4e8832
4e88ad
4e8903
4e891f
4f9107
4f9186
505cf8

Patch this locations in dumped file. Example:

Address 4e8903 -> | e8 | d4 | 91 | f7 | ff | ; call 461adc (original bytes)
------------------|----|----|----|----|----| ; replace with
Offset e8903 -> | b8 | 00 | d0 | 09 | 00 | ; mov eax, 9d000 (patched bytes)

Same on other 8 locations. Run dumped file. It works!!!!! :)))))))))

Bruce Lee
backeyes
10-23-2002, 09:49 PM
waw what a fast and great reply ;)

It's only 2 ret in fact, i dunno how i could have missed that but i understand now

thanx again
regards


A small tool...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A small tool...
PDA

View Full Version : A small tool...

foxthree
10-20-2002, 06:28 PM
Hiya Fellow RCEs:

Just a small tool to help in the IT Rebuilding process for Revirgin. Nothing great but helps you to find the addresses and hint values for a given API in RV format. All you'll have to do is to copy+paste it in RV.txt or whatever. Supports Win98SE/Win2K.

Let me know your thoughts / comments.

Signed,
-- FoxThree
Js
10-21-2002, 10:01 PM
appeciated, cheers.


Making IDA work "like" w32dasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Making IDA work "like" w32dasm
PDA

View Full Version : Making IDA work "like" w32dasm

instant
10-20-2002, 11:29 PM
Hi,

I'm new to this, and I've read some primers on IDA, but I am still having some problems.

When I open a resource in w32dasm I can quickly see all strings and find the locations in the code where these strings are accessed.

But in IDA I am only shown "push 204h" for example, and have to make my own comment for them.

And I dont see any information in the .data section about these strings, even though they should be there.

Could someone point me in the right direction, if any, to get these strings sorted out? :-)

(I'm using ida strings 0.4D already, but this does'nt seem to list as many as w32dasm does.. )

Some parts of the .data section seems to be like

.data 40002 26 B
.data 40004 27 C

Whereas in w32dasm I would see "BC.... " etc on the same "line".

Should I just read the Primers again, or is there some secret option I have yet to find? :-)

Thanks.

26 and 27 are most likely not B C, but, it was an example :)
disavowed
10-21-2002, 01:44 AM
assuming you're using ida 4.x, click the green "N" in the button bar (or press shift-f4) for the "Names window".

and rtfm
instant
10-21-2002, 09:20 AM
Originally posted by disavowed
assuming you're using ida 4.x, click the green "N" in the button bar (or press shift-f4) for the "Names window".

and rtfm

Well, if your knowledge about IDA consists of

"Green N buttons" and Shift-F4, as well as 'read the fucking manual', I must say that you're not much use.

Hopefully your manners do not reflect the general population at these boards, and someone with more manners, and knowledge might step forth and give some *helpfull* information.

But perhaps you're one of those "elitist hackers" that feel that everyone should go through the same hardships that you have instead of being able to ask those with more knowledge the hows and whys, and then try for themselves.

And about the N button/Shift-f, as well as the strings plugin. These do not show the same ammount of data w32dasm does, is there a way to make it do so?

Also; IDA shows some information like this

.data:00447C9C 53 db 53h ; S
.data:00447C9D 6F db 6Fh ; o
.data:00447C9E 66 db 66h ; f
.data:00447C9F 74 db 74h ; t
.data:00447CA0 77 db 77h ; w

whereas w32dasm would show it on one line "softw..." etc. Can IDA be configured to show it the same way?

(my questions are most likely aimed at everyone else here, as disavowed have'nt shown to be of much help.. He can change probably, so I'm not dismissing him (for now).

Regards,
Manko
10-21-2002, 09:41 AM
I use IDA Pro 4.17.
One added feature is a new stringsfunction.
I think it's pretty good. It will do what you just asked for...
I still use both, though...
Patching and textsearching on code is better in w32dasm, I think...
And for quickies, IDA takes too much time.
Though, more and more, I tend not to mind...
'Cause I love IDA... :P

/Manko
NervGaz
10-21-2002, 10:57 AM
Set up IDA to use the correct type of ascii strings, i.e. ASCII_C_STYLE for
C/C++(and win32asm for that matter) programs and so on... Either you can do
this in the ida.cfg file or in the seetings part for ascii strimng styles... If it still
doesn't show the strings correctly just hit "A" at the beginning of the string...
After setting up the correct style of course... And remeber that pascal/delphi uses
the byte in front of the string to see how long the string is... Hopefully this will
help you poke aronud with the strings a bit more... This is by the way what you
would have found in TFM(tm)...
disavowed
10-21-2002, 11:16 AM
Originally posted by instant
Well, if your knowledge about IDA consists of

"Green N buttons" and Shift-F4, as well as 'read the fucking manual', I must say that you're not much use.

Hopefully your manners do not reflect the general population at these boards, and someone with more manners, and knowledge might step forth and give some *helpfull* information.

But perhaps you're one of those "elitist hackers" that feel that everyone should go through the same hardships that you have instead of being able to ask those with more knowledge the hows and whys, and then try for themselves.

i answered your question, and what's more i gave you advice on how not to get flamed in the future. you obviously have not read any ida primers nor tfm. your question was much like "how do i open a file in notepad". it could have been answered by looking at the commands in the menubar or reading ida's help file. but again, i was in a helpful mood, so i decided to answer your question anyway, hoping to give you a headstart instead of forcing you to go through "hardships" (although learning how to display strings in ida by reading a help file is NOT a hardship, and if you think it is, i recommend you give up any plans of reverse engineering, because they will be way over your head).
instant
10-21-2002, 07:09 PM
Originally posted by disavowed
i answered your question, and what's more i gave you advice on how not to get flamed in the future. you obviously have not read any ida primers nor tfm. your question was much like "how do i open a file in notepad". it could have been answered by looking at the commands in the menubar or reading ida's help file. but again, i was in a helpful mood, so i decided to answer your question anyway, hoping to give you a headstart instead of forcing you to go through "hardships" (although learning how to display strings in ida by reading a help file is NOT a hardship, and if you think it is, i recommend you give up any plans of reverse engineering, because they will be way over your head).

Thing is, you dont know how to get the result I asked about, and no primer or anything I have seen says anything about it either, so either it is impossible, or not that easy to enable, thats why I asked.
Timmy
10-22-2002, 01:23 AM
I'll have a mars bar that he does.

Anyway, the IDA strings thing has been covered before. Me thinks a tad more W32Dasm work needs to be done before IDA can be used to anywhere near its potential.
Aimless
10-23-2002, 05:43 AM
With power, comes total control.

With total control, comes...well, tedium!

Write a small program in C/C++ and then re-write the same in Asembly. Understand the lines of codes (heaps, actually) that go in the assembly program. Though assembly gives you TOTAL control, its is more tedious.

Similarly with IDA. Its FAR more powerful to W32Dasm. And it gives you TOTAL Control. Unfortunately, that means, you have to do LOTS of things manually. (Theoritically, you could automate them, but lets leave the macros/plugins/idc scripting for later).

The example you gave is what IDA displays as default. It will display the data section byte-by-byte. All you need to do is go across to the first word, mark the section and press "U" for making it unmarked. THEN, you type in "A" to make it ASCII and it will display it in a line. Let me clarify:

.data:2001 0xA 'S'
.data:2002 0xB 'o'
.data:2003 0xC 'f'
.data:2004 0xD 't'
.data:2005 0xE 'i'
.data:2006 0xF 'c'
.data:2007 0xA1 'e'

is what you see in the data section. Well, it should actually display the same as:

.data:2001 'Softice'
.data:2008 'No debuggers allowed..."

and so on. To do this you will have to place your cursor at .data:2001 and then mark the data upto .data:2007. (Marking is the same as in any word-processor. Press shift and the arrow keys to mark).

Press "U" to make it unidentified.

Select that range again (yes, again!) ie. from .data:2001 to .data:2007 and this time, press "A".

This will make the same as ASCII. You will now see:

.data:2001 'Softice'

You have to do this for EVERY string that you want to find (did I not say, IDA is better than W32dasm, more control, but the control comes for a price?). IDA leave it up to the user to decide which string starts where. W32dasm tries to intellegently guess the same. Of course, w32dasm becomes easy, but can also give erroneous strings. So there.

I trust that your questions are answered. You will have to read the help file for a list of IDC functions that you can use. They are TOO many to be ennumerated.

IDA is also a specialist tool. A very specialist tool. People who use IDA are generally top-of-line people who have the ability to learn everything by reading the manual. HENCE, you will find no tutorial about macros/idc scripts/plugins, etc. If there are, they are ususally for a specific purpose.

Have Phun,
figugegl
10-23-2002, 06:19 AM
first of all: i'm a big fan of IDA. i don't use w32dasm anymore, actually i never have. but handling IDA takes time, and as stated above, some tasks are tedious.

that's why i wrote a little program called ShowString. It shows every string in a file. in most cases i check the strings before any attempt of cracking a target. just for fun and it usually tells me a lot. my little program is far from being perfect, some functions haven't been implemented yet, but it does its job :)
disavowed
10-24-2002, 02:24 AM
Originally posted by figugegl
that's why i wrote a little program called ShowString. It shows every string in a file. in most cases i check the strings before any attempt of cracking a target. just for fun and it usually tells me a lot. my little program is far from being perfect, some functions haven't been implemented yet, but it does its job :)

figugegl, i haven't tried your program, but anyone reading this thread may also want to take a look at bintext (which i highly recommend): http://www.foundstone.com/knowledge/proddesc/bintext.html
Polaris
10-24-2002, 06:50 PM
Originally posted by instant
Well, if your knowledge about IDA consists of

Also; IDA shows some information like this

.data:00447C9C 53 db 53h ; S
.data:00447C9D 6F db 6Fh ; o
.data:00447C9E 66 db 66h ; f
.data:00447C9F 74 db 74h ; t
.data:00447CA0 77 db 77h ; w

whereas w32dasm would show it on one line "softw..." etc. Can IDA be configured to show it the same way?

Regards,

IDA does not display this string in W32dasm style because:

1) it has not come over it during autoanalisys. More precisely,there were NO xref to that address (data:00447c9c).

2) the default string style was not the right one. IDA by defaults expects C's '\0' terminated,and this could not be the case.

In any other case,IDA would have generated a name (aSoftw... if you are using defaults).

Polaris

Frost And Winter Return To My Eyes...


new free debugger?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > new free debugger?
PDA

View Full Version : new free debugger?

dion
10-21-2002, 09:36 AM
hi all, i knew this one from exetools, a debugger for win9x/ME.

url : h**p://www.finalseraph.org/hume/tmp/twx2002.zip

cya
[yAtEs]
10-23-2002, 01:18 PM
Originally posted by dion
hi all, i knew this one from exetools, a debugger for win9x/ME.

url : h**p://www.finalseraph.org/hume/tmp/twx2002.zip

cya

looks strangly like a TRW ripp off, theres even 'TRW' mentioned
in the manual at some point
dion
10-24-2002, 03:07 AM
IMO, yes it is. and from what the author says, looks like it uses 90% TRW code and 10% softice code ;p


sice display
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > sice display
PDA

View Full Version : sice display

chami
10-21-2002, 10:39 AM
Can anybody tell me why my sice 4.05 (NT ) on win2k is not
displaying that little short black screen whereas all the activities freezes as i start sice by pressing ctrl-D. Here ctrl -D works the same way as it should .
all activities are paused but no change of view ,
black screen is absent. when again i press f5 or ctrl-D all movements are restored.
i have used generic vidio driver at installing time.my
other relevant informatin are as follows-

H.P. plug and play monitor

H.P. ProSavage PM133(TM) display adapter
driver files are::- s3NBm.sys
& s3NB.dll

can anybody tell me what to do for display...of softice.
jole
10-22-2002, 01:25 AM
Some problem here. Win2K SP3 on a GeForce4 Ti4200 with the latest drivers at the moment, which is v40.72

I had trouble booting too -- did you have to escape on the "press escape to skip softice" prompt? Might explain the problem if it isn't correctly loaded.

I haven't run softice in over a year, but I'd like to get it up and running again so any insight into this would be appreciated.
JMI
10-22-2002, 01:50 AM
Did either of you perhaps use the "search" button here and inquire about "softice" and "video cards" and/or "screen" and/or "freeze"?? Issues with the screen not working or freezing, etc have been discussed on many threads here. A little review is in order.

Some. but not necessarily all these problems can be solved by updating Sice to the 2.7 DriveStudio version. Check out these earlier threads. There are still issues with some of the Geforce Display cards reported.

Regards.
jole
10-22-2002, 12:50 PM
"softice freeze" gave only one relevant hit which a thread that suggests a downgrade to 5.x nvidia drivers (ain't gonna happen!) or getting the Special Debug Symbols from MS. The URL was stale but I found it now at:

http://www.microsoft.com/windows2000/downloads/tools/symbols/

.. which is a 100Mbyte download. <sigh>
NervGaz
10-22-2002, 12:55 PM
Use the symbol dowloader util that comes with DS2.7 (probably the ones before too), then you can grab the ones you need


fireworks problem(vbox4.6.2)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > fireworks problem(vbox4.6.2)
PDA

View Full Version : fireworks problem(vbox4.6.2)

bytexus
10-21-2002, 10:25 PM
I'm having a prob with this macromedia program. I'm using a bpx seterrormode after i push the try button and three lines away i have a jmp to eip.Until here all is O.K. When itry to dump it procdump tells me that"these procceses can't be dumped" and pedump tells me that it can't create a buffer with that size?Recently i have removed vbox from Dreamweaver Mx (same vbox version) with no prblems.
Any suggestions?
+SplAj
10-22-2002, 07:53 AM
Hajo

12mb dumped.exe == LordePE ;)
bytexus
10-23-2002, 09:27 PM
I've tried to dump it with lord pe but i get an error message"could not grab process memory".Whit the second dump engine he had dump me the file but he warns me that half of it it is filled with zeros. I 've tried to dump each section(worked) but i don't know if i created the exe correct.
I 've taken the header from the original file+all sections(dump) + section with imports(imprec),but the file still doesn't work.
Are there other posibilities?
bytexus
10-30-2002, 08:11 PM
I (finaly) managed to dump the target with lordpe after seversl tryes. Found the iat address and rebuilded with imprec and with Revirgin (2 of the imports were wrong getmessagea peekmessagea) correct the OEP but program locks after loading allmost all the files.I must say that i've rebuilded the iat at least 3 times but i've had the same success. If anyone knows why please post.
Thanks.
+SplAj
10-31-2002, 07:40 AM
Please describe the following :-

1) Your O/S;
2) The Fireworks MX version (6.0.0.273 ? );
3) The memory address where you are holding and attempting to dump from;
4) The ImportTable VA memory address start and also length you found.

Then we can have an idea wtf is going wrong for U and offer some better assistance .......
bytexus
11-04-2002, 06:48 AM
I've made a dump in win98 and one in WInXP pro.
I d0nt know the exact version of the proggram(i'm not at home wright now)but i can tell you the va address of the import table was d1a000(image base 400000,oep 7ffa58 iat length C74 ,782 imports) all those in Win98. I think the size of the original exe(not the dumped one) was less then 12 megabytes and the length of the dumped was more then 12 megabytes(C03000???).Found 3 unresolved imports (CreateProcessA,GetMesagea,PeekMessageA). Over winxp foun only 2 (GetMesagea and PeekMessageA).After i correct them i try tu run the program but somewhere it hangs.My guess is that some imports were wrong resolved.Found some imports twice (_hread)look at there addresses in the it and thay were correct.
If there are some wrong imports haw can i detect them without compare each of it manualy.
+SplAj
11-04-2002, 09:08 AM
Bytexus

_______________________________________________
..the import table was d1a000(image base 400000,oep 7ffa58 iat length C74 ,782 imports)..
________________________________________________

Maybe you made a typo ? I.T. CANNOT be at d1a000 !! thats over the end of the image size......I think you should have 91a000.

The rest is ok. I never had a problem so far in 3 months and there is nothing in my notes about anti-dump checks for this target.

? when u attached rebuilt IAT to '.NewSec' offset C03000 is the PE header ok. (sometimes IMprec makes a mess of the auto-fix-iat) Try an older version 1.3. or try RV.

If you can trace the memory location of the crash. Is it an API fault or something else...???


PELock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PELock
PDA

View Full Version : PELock

mR_gANDALF
10-21-2002, 10:49 PM
I`m trying with the latest PeLock protect scheme that has the follow dificulties:

- Doesn`t allow any debbuger to run (SICE, TRW, Olly)
- With FrogIce I saw it makes 3 attempts to detect Sice (without it running): First a code 2 (see frogice.txt) and then 2 MeltIce.
- Tracing through the Code 2 zone I saw it makes a HLT instruction (in the example of FrogIce.txt there is an INT3 instead) and then gives the control to VMM. After that there is hang-up of the program and you can`t restart it. I`ve been looking for that Code 2 antidebbuging detection but found nothing.

Excuse me for my bad english.
Anybody has a clue oto this?

tHANKS

mR_gANDALF
evaluator
10-22-2002, 01:15 PM
for info:

PELock has absoletely NO debugger detection against XP (W2k).
So you can try unpacking there & also you will fail!
because I see you are newbie in unpacking.
So I recommend to you: learn unpacking on easy targets.

Also you can find little info in another post.
Search.
mR_gANDALF
10-22-2002, 09:45 PM
Estimated friend:

I dont consider myself an expert in unpacking but have descompressed manually several schemes included ASprotect 1.23, Aspack, Armadillo 2.60 and others.

You say that there is no DEBBUGER detection for XP. What do you mean, that Drive Studio 2.7 wont be detected running in XP?
I have not tried that, in fact (BUT I WILL), because I use to debbug with SICE 4.05 under W98 that let me use FrogIce to detect antidebbuger code. Anyway it surprise me an egg.

You say that in XP it wont be unpacked either. So, what you suggest?

Grateful
mR_gANDALF
foxthree
10-22-2002, 10:58 PM
Eval:

Under Win2K with SICE 2.6 DS loaded, PELock exits quietly. Maybe not XP but definitely debugger detection on Win2K :)

Signed,
-- FoxThree
evaluator
10-23-2002, 08:35 PM
I checked it on XP.
It not uses INT1 or INT3 & other for detect NTICE.
It uses CraeteFileA > NTICE
But XP not gives right answer:)
So probably W2k gives right answer. Check it.

For W9x. It uses "silent" debugger detection;
In IDT it will check, if C0 is first byte in INT1 address.
So catch it here. Also for easy catching IDT access,
you can use IceDump with command
/protect on

Hey, Mister!

Why you think I WAS your friend ?:0
mR_gANDALF
10-24-2002, 06:10 PM
I tried aldo in XP...but nothing.

I will check that suggestions you give me.

Anyway I already Know how to trace this program and get the registration

Try if yoy want

http://www.quickmenubuilder.com/files/download.php3?Fichier=qmb.exe

Thank you... FRIENDS
sv
10-25-2002, 10:50 AM
Hi Reversers !!

Pelock is a very insteresting one !
I have rebuilded qmb and i have found some interesting things.
Perhaps everybody already knows that !!! ;)

Before landing in code section memory (EOP) some target opcode have been executed.
(QMB : 5 instructions or 12 bytes 5133a8 isn't right EOP).
Be carefull to found real EOP. Then you have to dump process and paste these bytes.

Rebuild IT (There is garbages bytes between thunks.)

More difficult : There is some parts of code decrypted at runtime.
You have to decrypt it and jump over recrypt call.

After that you can rebuild a clean exe :)

Regards

SV
mR_gANDALF
10-25-2002, 11:11 PM
I have tried with /protect on and it is a childs game to avoid debbuger detection.

In fact I am newbie :-(

Anyway with TRW2000 loading after the program you can trace the registration code and its easy to find the registration serial. There is no obfuscation at all. Also with SICE /protect on.

Another question is how to find the oep. I have tried with bpr but it seems it never comes the oep. Also with getprocaddress, but there are almost 40 calls to this before the program runs.

How do you get this oep?
SpeKKeL
10-26-2002, 04:56 PM
Believe me,

It reaches the oep, a quick manner ?? just trace till you fall a sleep...yes it took me some time.
Use tracex command 400000 500000 and you'll will break a looot of times.
If you once know where it crypts and decrypts you can easily bpx
there.
Just finished my imports resolver for this (1 entry unresolved)

SpeKK
SpeKKeL
10-31-2002, 04:04 PM
Pffff,

Yep costed some time to decrypt "all"without executing the main
prog.
After that patched all those re-crypting stuff and rebuilded
the imports.
My thanks to s.v for giving some insight !

But finally rebuilded pelock..

SpeKK.

(Alex, you must study this protection...) ;)
Kayaker
10-31-2002, 04:30 PM
Originally posted by SpeKKeL
(Alex, you must study this protection...) ;)

Ouch :p
SpeKKeL
11-04-2002, 02:18 PM
quick menu builder

Looks that this is done with an earlier version (less decryption)
the rest is the same..

Oep>uncrypt all>dump>rebuild iat>patch all high calls >done.

sv : oep 5133a8...:confused: ...(just pushed the right value in eax and no prob.)

Ciao,\

SpeKK
sv
11-05-2002, 08:29 AM
Hi Spekk

Yes it may works, but some other target not !
Here is code executed in Pelock memory before landing 'EOP'.

.0051339C: 55 push ebp
.0051339D: 8BEC mov ebp,esp
.0051339F: 83C4F4 add esp,-00C
.005133A2: 53 push ebx
.005133A3: B8C42F5100 mov eax,000512FC4

Here there is nothing really needed other than eax value !

Regards

SV
mR_gANDALF
11-09-2002, 10:34 PM
Thank you very much for your replies.

Do you know where can I download any tutorial about descompresing a target protected with PELock?

Thanks
+SplAj
11-10-2002, 04:22 PM
a tut.....

Here is Win2K notepad.exe protected with PeLock1.04 until I get my notes together on full 'PeLock1.04 demo' unpacking ;)

As it's std Notepad.exe u know OEiP is...... IAT is ......... :)

Look out for 'fake OEiP' entry
See IAT redirection takes some 1st section of api call
no 'decryption/encrypton' markers tho.....
size is 0 for dumping......etc etc

good old notepad.exe .... best unpackers tool around

BTW get the PElock demo NOW......
+SplAj
11-10-2002, 04:24 PM
holy missing target batman.....


Revirgin , tracing, etc.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Revirgin , tracing, etc.
PDA

View Full Version : Revirgin , tracing, etc.

nikolatesla20
10-22-2002, 02:05 PM
I've learned so much in this past year and a half about reversing, I would like to thank everyone here that has helped me, and especially those that have shared their great tools and information!

One thing I have yet to learn is system drivers. The big question in my head still is: How exaclty does Revirgin "trace" code execution? Now, I know we wouldn't want to give out ever bit of info, lest it be used against us, but if +Tseph or anyone could guide me in the right direction (or PM me) as to how this works.

I'm under the assumption that it uses some kind of system level driver, although I am not 100% sure. ( I do know there is tracer.dll ). My latest theory is that the code is emulated? Because I don't understand how a unresloved api could just be "entered" and executed at will....well, I guess you could change eip :)

I would just like to get some sort of idea on how this is done and if anyone would have some information to help me learn I would greatly appreciate it.

As soon as I acquire DS 2.7, (In process) I'll try and update the anti-detect patches for it....

-nt20
Hwoarang
10-23-2002, 12:03 AM
icedump sources are free, check them...


ida mdi?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ida mdi?
PDA

View Full Version : ida mdi?

_Servil_
10-22-2002, 05:47 PM
hello, need some help with ida --

1. Is it possible to write plugin or script to work with two idabases simultaneously? does ida have ability to copy'n'paste a snippet of code from one executable to another and export as bin? (v4.17)
2. can i insert (via plugin or script) some ops into code (otherwords to move a block of code a little ahead, best with appripriate jump/calls/ref realloc)
3. finally i'm looking for ida plugins api manual / ida script description.
[yAtEs]
10-23-2002, 01:12 PM
Originally posted by _Servil_
hello, need some help with ida --

1. Is it possible to write plugin or script to work with two idabases simultaneously? does ida have ability to copy'n'paste a snippet of code from one executable to another and export as bin? (v4.17)
2. can i insert (via plugin or script) some ops into code (otherwords to move a block of code a little ahead, best with appripriate jump/calls/ref realloc)
3. finally i'm looking for ida plugins api manual / ida script description.

1. probably, but im not sure. you can open a couple of instances
of ida quite happly unless you have ida4.3 and win98 :mad:

2. unless you have the ida sdk you'll need to write IDC's
references can be found here,

http://www.datarescue.com/idadoc/919.htm

you could read bytes from a va and save to a bin file, then
reload and use the patchbyte function to move reload stuff
etc etc

3. see link above for an idc api ref

yates.


just another simple keygen me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > just another simple keygen me
PDA

View Full Version : just another simple keygen me

javelin
10-22-2002, 11:32 PM
Objective is just write an keygen for it.
ZaiRoN
10-25-2002, 10:14 AM
Hi javelin,
welcome back :)

someone is working on this project?
the characteristic of this crackme suggests two methods for those who wishes to try:
1. write a keygen ripping code from the crackme
2. inject some code to turn the crackme in a keygenerator

both tasks are not too hard but the problem is that is a console type crackme. at first, i feared about console proggie, don't know why...but there is nothing different from other programs!

The 'Thank you for registering' and 'Invalid Serial' messages will lead you on the routine protection...

regards,
ZaiRoN
Reparion
11-04-2002, 10:43 AM
Hi javelin
I started working on this project because this would be nice for me to learn write keygenerators.

I hope I can produce working keygen for this ;)

I must stress that this will be my first actual keygenerator.. so don't expect too much from me ;-)
javelin
11-04-2002, 06:39 PM
Hi Reparion,

If you need any help you can post msg. here or pm/email me.

atleast someone is working on my keygen me.

i check the boards once a day at least.

Javelin
Reparion
11-05-2002, 11:29 AM
Hi,
I started to analyze this program and I found that it's input buffer is located in stack (perhaps this is C code, I am not 100% sure)
and, I've renamed 2 subs to 'StdIn' and 'StdOut', so the code will be more readable.
and THEN after the program gets name and code, it initializes 10 byte size variables in the stack, given values from 1 to 10.

Just a quick look at the code, more will follow..and please notice me if any of this is incorrect ;)
Reparion
11-05-2002, 11:38 AM
just to correct my own mistakes ^^
the program initializes 10 WORDs in the stack,first variable with value 1, second with 2 and so on till the 10:th variable...

cheers


Armadillo and CopyMem II decryption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo and CopyMem II decryption
PDA

View Full Version : Armadillo and CopyMem II decryption

crassy
10-23-2002, 02:25 AM
Hi all!

I just found the following tut on a russian site and thought that even you people who don't know Russian (alongside Chinese the best language for a reverser to know) might benefit from the info. So I translated the text... Here it is!

Thanks to the author of the original text!!!

---------------------------------------------------------------------------------

21.10.2002 Armadillo and CopyMem II
Author: Hex
Translated by: Crassy
I don't like unpackers, they make you lazy. Then the author of the unpacker disappears, and thats it. You don't know how it works. This point of view also goes for Armkiller. Therefore I'll describe how to crack Armadillo's decryption with CopyMem II.

Armadillo works like this: it starts two processes:
1) The one that we called. Its like a server.
2) Created by the server (client)

So the server runs the client in debug mode, and when DebugEvents happens it unpacks the client, makes the import etc. and then runs it.
CopyMem II: is a feature of the server. When its enabled the server dynamically decrypts client's code section in blocks of 1000h bytes. After execution of the code of this page it encrypts it again. That means that server watches for page faults, and when they happen decrypts the missing block and puts it in place. So our goal is to force the server to decrypt the whole program and not encrypt it any more.

Tools: Softice, IDA.
As an example I take Armadillo 2.61 Public build 2000 itself. It's the latest version atm and uses CopyMem II.
We disassemble Armadillo 2.61 with IDA. Then we run Armadillo, click "Basic" and don't do anything more.. Now we put bpx Writeprocessmemory and click "Protection" - "Edit Project". SoftIce pops up. We do bd * and press F12 3 times. We see this (I've put some comments in):

_text1:0044D6BD push 0 ; EnCryptBit - 1 - encrypt, 0 - decrypt
_text1:0044D6BF mov esi, [ebp+PageNumber]
_text1:0044D6C5 shl esi, 4
_text1:0044D6C8 mov eax, [ebp+PageNumber]
_text1:0044D6CE and eax, 80000007h
_text1:0044D6D3 jns short loc_0_44D6DA
_text1:0044D6D5 dec eax
_text1:0044D6D6 or eax, 0FFFFFFF8h
_text1:0044D6D9 inc eax
_text1:0044D6DA
_text1:0044D6DA loc_0_44D6DA: ; CODE XREF: sub_0_44C5FD+10D6j
_text1:0044D6DA xor ecx, ecx
_text1:0044D6DC mov cl, byte ptr ds:unk_0_4591E0[eax]
_text1:0044D6E2 mov edx, [ebp+PageNumber]
_text1:0044D6E8 and edx, 80000007h
_text1:0044D6EE jns short loc_0_44D6F5
_text1:0044D6F0 dec edx
_text1:0044D6F1 or edx, 0FFFFFFF8h
_text1:0044D6F4 inc edx
_text1:0044D6F5
_text1:0044D6F5 loc_0_44D6F5: ; CODE XREF: sub_0_44C5FD+10F1j
_text1:0044D6F5 xor eax, eax
_text1:0044D6F7 mov al, byte ptr ds:unk_0_4591E1[edx]
_text1:0044D6FD mov edi, ds:dword_0_456238[ecx*4]
_text1:0044D704 xor edi, ds:dword_0_456238[eax*4]
_text1:0044D70B mov ecx, [ebp+PageNumber]
_text1:0044D711 and ecx, 80000007h
_text1:0044D717 jns short loc_0_44D71E
_text1:0044D719 dec ecx
_text1:0044D71A or ecx, 0FFFFFFF8h
_text1:0044D71D inc ecx
_text1:0044D71E
_text1:0044D71E loc_0_44D71E: ; CODE XREF: sub_0_44C5FD+111Aj
_text1:0044D71E xor edx, edx
_text1:0044D720 mov dl, byte ptr ds:unk_0_4591E2[ecx]
_text1:0044D726 xor edi, ds:dword_0_456238[edx*4]
_text1:0044D72D mov eax, [ebp+PageNumber]
_text1:0044D733 cdq
_text1:0044D734 mov ecx, 1Ch
_text1:0044D739 idiv ecx
_text1:0044D73B mov ecx, edx
_text1:0044D73D shr edi, cl
_text1:0044D73F and edi, 0Fh
_text1:0044D742 add esi, edi
_text1:0044D744
_text1:0044D744 DeCrypting:
_text1:0044D744 mov edx, ds:dword_0_459A74
_text1:0044D74A lea eax, [edx+esi*4]
_text1:0044D74D push eax ; hHash
_text1:0044D74E mov ecx, [ebp+PageNumber]
_text1:0044D754 push ecx ; PageNumber - number of page to decrypt.
_text1:0044D755 call ArmaCryptDecrypt
_text1:0044D75A add esp, 0Ch
_text1:0044D75D and eax, 0FFh
_text1:0044D762 test eax, eax
_text1:0044D764 jz short loc_0_44D770

The code from _text1:0044D6BF to _text1:0044D74D is just the calculation of codes for decryption of the given page.
To decrypt a page we have to, after execution of

_text1:0044D75A add esp, 0Ch

put the number of the desired page into [ebp+PageNumber] and jump to
_text1:0044D6BD push 0
In this way we can write a small loop to decrypt all pages right there in SoftIce.
How are page numbers used?
Page number *1000+401000 = address where the decrypted piece is put. So to find out how many pages there are we look at the PE:
Rva of section .text = 1000, Rva of the next section (.rdata) = 2A000 ie the number of pages = ((2A000 - 1000 ) / 1000) - 1 = 28h pages (I found out -1 by trial and error :) )
But before writing a loop we have to consider one more detail: Inside ArmaCryptDecrypt there are two different calls of the same procedure:
One:

_text1:0044E3FF push 0 ; Decrypt...
_text1:0044E401 mov ecx, [ebp+hHash]
_text1:0044E404 push ecx
_text1:0044E405 mov edx, [ebp+PageNumber]
_text1:0044E408 push edx
_text1:0044E409 call Crypting
_text1:0044E40E add esp, 0Ch

Two:

_text1:0044E48F push 1 ; Crypt...
...............
_text1:0044E542 mov edx, ds:dword_0_459A74
_text1:0044E548 lea eax, [edx+esi*4]
_text1:0044E54B push eax ; Crypting...
_text1:0044E54C mov ecx, ds:dword_0_459A88
_text1:0044E552 mov edx, ds:dword_0_459A8C
_text1:0044E558 mov eax, [edx+ecx*4]
_text1:0044E55B push eax
_text1:0044E55C call Crypting
_text1:0044E561 add esp, 0Ch

The first one always decrypts, while the second one encrypts and removes the page from memory (ie sets No_access).
We do not need it to remove the page at all, Therefore we leave only the first call. The second one happens only if
_text1:0044E47C jle loc_0_44E57C
doesn't jump.

Therefore to decrypt the code section we need to patch
_text1:0044E47C jle loc_0_44E57C
to
_text1:0044E47C jmp loc_0_44E57C
and the write the loop I mentioned earlier. Then we dump the decrypted code section.. Easiest way to find OIP is to set BPX SetProcessWorkingsetSize and after 20 lines there is OEP. Then we make a dump at the OEP, and put the code section into it. We restore the import (best under NT/2k, but there shouldn't be any problems in Win98). And work with the rest of the licensing...

What more is there to say... If we look at addresses 44D60B and 44D57B we see the same pieces of code with two differences:

_text1:0044D57B push 1 - Encrypt!
...............
_text1:0044D5E8 mov eax, [ebp+PageNumber]
_text1:0044D5EE sub eax, 1 - Previous page
_text1:0044D5F1 push eax ; PageNumber
_text1:0044D5F2 call ArmaCryptDecrypt

and

_text1:0044D60B push 1 - Encrypt!
.........................
_text1:0044D678 mov eax, [ebp+PageNumber]
_text1:0044D67E add eax, 1 - Next page
_text1:0044D681 push eax ; PageNumber
_text1:0044D682 call ArmaCryptDecrypt

So before decrypting a new page it encrypts the previous and the next one. In Armadillo 2.61 Public build 2000 its not used, but it's good to know. :)
Solomon
10-23-2002, 02:57 AM
really good essay. I wish I had learned Russian at university.

There is also another quick way to find the OEP. Just BPX WaitForDebugEvent, then check the addr of the first page_fault/access_violation in the EXCEPTION_RECORD.

There is also another way to decrypt every page in the child process. Just suspend the child process(client) at OEP and write a small piece of code in the client to scan the whole exe memory. This scan will trigger the decryption of every page. But we should disable the re-encryption first.

Most of the tricks are in the WaitForDebugEvent/ContinueDebugEvent loop. Definitely this loop is the startpoint of unpacking.

Pls check my post about NetScanTools in this forum. There is new(maybe) INT3 feature
foxthree
10-23-2002, 06:49 AM
Nice tut... more or less coincides with my findings but however clears up a lot of cob-webs.

<edit>
Question: Why does ARMA have to handle page faults? Does not encrypted code mean == INVALID_OPCODE Exception? AFAIK, Page faults happen only if the memory accessed is paged out and OS handler will take care of restoring it from disk? Correct me if I'm wrong, though?
</edit>

<request>
What is the URL for this russian site?
</request>

Thanks,

Signed,
-- FoxThree
Solomon
10-23-2002, 12:39 PM
MS documents VirtualProtect/VirtualProtectEx/PageFault in MSDN.
crassy
10-23-2002, 01:49 PM
Originally posted by foxthree
<request>
What is the URL for this russian site?
</request>

www.xtin.org
foxthree
10-24-2002, 04:49 PM
Thanks, crassy! Now I'm too eager to learn Russian. Who will teach me Russian on this board :)?

Signed,
-- FoxThree
crassy
10-25-2002, 01:05 AM
I will, if you teach me Chinese. ;)
_Servil_
10-28-2002, 09:40 AM
hello,

what i'm doing wrong,
the dump is still not correctly decrypted
here i see nothing new since the crussader's post but as it worked on previous version, the decrypt is still bad either wit or without loop check....
is this scheme valid still?

edit - I tried use armkiller to obtain correct dump, though as it says
should be able defeat copymem yet, anyhow the dumped section
is crushing as well.

btw. dumping by armkiller under winxp produces total garbage in
dump, had to run it under win98 but it hadn't decrypted all the
segments though.


icepatch
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > icepatch
PDA

View Full Version : icepatch

mannwood
10-23-2002, 05:29 AM
Is there an icepatch for the latest version of SICE on win2k?

Thx!!

Manny
Woodmann
10-23-2002, 09:13 PM
You really couldnt come up with a more "creative"
name ?

Moodwann
JMI
10-23-2002, 09:22 PM
How about Odmannwo? :D :D

Regards.
DakienDX
10-23-2002, 09:33 PM
Hi Woodmann !

What's with Jbbqznaa?

Can you reverse this one? It's really easy. :D
Snatch
10-23-2002, 10:10 PM
An imposter! Though Woodmann must know who it is by IP identification. Ah the light at the end of the tunnel. You guys must have heard about the internet attack recently...9 core internet servers taken down yet nobody was affected in any significant way. Not bad. Since this thread is already off topic and clearly this fellow needs to read the FAQ I might as well share with you some modern ways of profiting.

http://www.tshirthell.com/hell.htm

Amusing but disturbing what they will profit off nowadays?

Snatch
Woodmann
10-23-2002, 11:18 PM
What's with Jbbqznaa?

Bob Crack ?

OBC
DakienDX
10-24-2002, 08:06 AM
Uv Jbbqznaa !

Jebat nafjre. :(

Unir lbh rire urneq nobhg EBG13?
Be fubhyq jr chg vg vagb gur pelcgb sbehz? ;)
FoolFox
10-24-2002, 10:07 AM
LRNU... YNORYRQ NF PNRFNE PLCURE....

:)

Regards
FoolFox
DakienDX
10-24-2002, 11:55 AM
Uv SbbySbk !

Lbh tbg gur cbvag. ;)

Vg'f n fcrpvny inevnag bs gur Pnrfne Pvcure naq pnyyrq EBG13 (fvapr gurer ner 26 yrggref va gur nycunorg)

Vgf znva checbfr jnf gb uvqr fbzr jbeqf va arjftebhcf be fbzrguvat yvxr guvf. Gur snpg gung Rapelcgvba=Qrpelcgvba znxrf vg rnfl gb hfr. Rira Jvaqbjf unf n EBG13 qrpelcgbe (rapelcgvba jbexf gur fnzr jnl), ohg vg vf bayl fhccbfrq gb jbex jvgu arjftebhcf.
foxthree
10-24-2002, 01:00 PM
Guvf bar vf dhvgr byq, Qnxvra ;)

Signed,
-- FoxThree
FoolFox
10-24-2002, 01:06 PM
JNF NJNER BS EBG RAPELCGVBA JVGU GUR SNZBHF EBG26 BAR...YBY..

:))
username
10-24-2002, 01:59 PM
Fbzr uryc sbe gubfr jub unir lrg gb svther vg bhg, fbeg bs pngpu 22 gubhtu ;-)

uggc://gbbyf.trug.arg/ebg13.ugzy
ZaiRoN
10-24-2002, 02:34 PM
flht lmnep ren hbl :p:D:p
FoolFox
10-24-2002, 02:42 PM
Crazy ?? Noooooooooo :)

(nice variation aside of that..... )
Kayaker
10-24-2002, 06:15 PM
Originally posted by DakienDX
Rira Jvaqbjf unf n EBG13 qrpelcgbe

Ernyyl? Jurer vf vg hfrq?
DakienDX
10-24-2002, 06:21 PM
Uv sbkguerr !

V xabj vg'f byq ohg vg frrzf yvxr Jbbqznaa qbrfa'g xabj nobhg vg.

Uv hfreanzr !

Gung'f n avpr yvax lbh cebivqrq. V guvax vg'f zhpu zber pbzsbegnoyr gb glcr vg vagb lbhe oebjfre vafgrnq bs nffrzoyvat zl pbqr rnpu gvzr jvgu n arj zrffntr. ;)
Tbbtyr "EBG13" urycf n ybg. :Q

Uv MnvEbA !

.xpveg ehbl gbt V yvgah 52GBE bg 1GBE leg rz rqnz lyynre hbL :D

Uv Xnlnxre !

Vg'f vacyrzragrq va Bhgybbx Rkcerff. Ohg vg jbexf bayl vs lbh ner ernqvat cbfgf va n arjftebhc, vg jba'g jbex jvgu R-Znvyf lbh tbg be juvpu lbh'er jevgvat.
ZaiRoN
10-24-2002, 06:32 PM
Uv QnxvraQK,

> .xpveg ehbl gbt V yvgah 52GBE bg 1GBE leg rz rqnz lyynre

YBY :D
Snatch
10-24-2002, 10:02 PM
Gurer zhfg or cebtenz gb qb guvf. Translating one was enough! Ya I know I am lazy could write my own ;) But my head hurts from doing this stuff already!

irav ivqv ivpv!!!

Snatch
Kayaker
10-24-2002, 10:42 PM
Originally posted by Snatch
Gurer zhfg or cebtenz gb qb guvf.
Snatch

v.r. jjj.ebg13.pbz

...Though I spent my lunch hour coding my own program until I figured out wtf it was all about. Catch-22 (13?) indeed ;-)
Woodmann
10-24-2002, 11:25 PM
Ummmmmmmmmm...........

:rolleyes:

I have no excuse.
Wait, I do........

I blame it on my 12 year old intelligence :eek:
(shameless poke)

Peace, Woodmann
Iwarez
10-24-2002, 11:39 PM
TERNG RAPBQVAT... RFCRPVNYYL GUR MNVEBA GEVPX :) FGENATR JBBQZNAA FGVYY QBRFA'G TRG GUR CBVAG :Q
Woodmann
10-24-2002, 11:55 PM
yrf ur qbrf

jbbqznaa
Iwarez
10-25-2002, 06:41 AM
CURJ, YHPXL LBH QB! LBH NER JNL GB FZNEG ABG GB HAQREFGNAQ GUVF ;)
DakienDX
10-25-2002, 07:36 AM
Hi Woodmann !

"yrf ur qbrf" -> "les he does"

Maybe you should practice a bit more. ;)

I think "mannwood" is totally confused now. What was the thread about?

I remember, vprcngpu. :D
Snatch
10-25-2002, 12:19 PM
Bu QnxvraQK gung vf irel irel avpr. N yvggyr tbbtyr frnepu sbe rot13 va snpg erirnyf ebg13 svefg uvg fb ibvyn! Jbj guvf znxrf yvsr zhpu rnfvre. Naq V qvqag rira unir gb pbqr nalguvat. Gubhtu V jbhyqag gel gb farnx guvf rapelcgvba ol gur AFN...

Fangpu
mannwood
10-30-2002, 01:38 AM
eheheh I would never presume to be the "Master" woodmann :)

I am just his humble servant ;)

ps where is +Tsehp? His email has been down for a while now.
Woodmann
10-30-2002, 01:43 AM
Howdy,

Other endeavors have him busy.

Peace, Woodmann


FlexLM 8.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM 8.1
PDA

View Full Version : FlexLM 8.1

Zigmund
10-23-2002, 11:54 AM
I have a question, and I beg you to aswer...
I have a program protected by FLEXlm 8.1a (LM_BEHAVIOR _V8)... and It certanly differs from lmgr327 protection for example...

In this way I don't know how to find SEED's (1st-4th) for 8.1 and also I don't know how works and where to find SIGN2 stuff

Could you help me?! Please....

PS. I was trying to fix GetHostID function, but when .exe loads it all my fixing became wrong... How it possible? And how to find where rmcl.dll or .exe (which runs) corects! my fixing?

...Help me please...
padspcb
10-23-2002, 06:05 PM
After cro some things happened..
1- no need to use the seeds encrypted in struct (the xor key5)
2- Key5 now is named unique and is embedded on daemon or dll
3- Keys can have any order, so this must be specific also
4- CRO is bullsh!t, just bit setting on vendor hash enabling or not level
5- On 8.1 some new stuff appeared, more keys, whew...

Some actions:
find sg() , remember? check for demo keys...
After it you will find the unique and nice stuff like some
pushing, and this is the key order...
cro can be disabled in vendord check, hah, make it fail, so key
reverts to ye old license.
But some stuff like rc5 etc is f*cking difficult to emulate, but
somewhere it checks supplied with expected, and thats the catch.
Like cst with those silly passwords. They try to hide tencoding exe..
but sometime code has to run, just takes patience and F7 instead of F8/F10 on ye old debug

Find enclosed a simple recode 8, with big help from mozzie who fixed nb skips on cro.

Attachement removed, no keygens allowed
tongxl
04-06-2003, 03:45 PM
[QUOTE]Originally posted by padspcb
[B]After cro some things happened..
1- no need to use the seeds encrypted in struct (the xor key5)
2- Key5 now is named unique and is embedded on daemon or dll
3- Keys can have any order, so this must be specific also
4- CRO is bullsh!t, just bit setting on vendor hash enabling or not level
5- On 8.1 some new stuff appeared, more keys, whew...

Some actions:
find sg() , remember? check for demo keys...
After it you will find the unique and nice stuff like some
pushing, and this is the key order...
cro can be disabled in vendord check, hah, make it fail, so key
reverts to ye old license.
:confused: how to disable cro??
flyingsilicon
04-13-2003, 05:44 AM
Unfortunately, during 8.0 to 8.1 something important happened again.
8.1, 8.1a, 8.2 and latest ones uses 3 encSeeds instead of 4. Some other thing is happened in order codes.
But more unfortunately, there is not any essay about this pattern on the net. there is some helps only written by PadsPCB (thant to his friendly advises. very lovely reverser just like NB) and nothing more.
Could any other reversers give us some more info about it?
Waiting...
FlyingSilicon


Crypkey SKW.EXE unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crypkey SKW.EXE unpacking
PDA

View Full Version : Crypkey SKW.EXE unpacking

squidge
10-23-2002, 12:06 PM
I'm working on a Crypkey protected program, and have read through the past discussions on Crypkey. Found the master key, sitekey, and sitecode, as well as a entry key and restriction key. I've run these keys through ckinfo to get more information from them.

Now, I need a crypkey key-gen to play with, so I've downloaded the Crypkey 5.7 SDK and used WinRAR to bypass the InstallShield password protection, and installed the SDK. Obviously SKW.EXE will not run as it can't find a valid license, so need to unpack and then patch it.

I've disassembled the EXE with both w32dasm and IDA, but get lost in the code and never end up with a working dump (using ProcDump).

Has anyone got any pointers on how to attack this kind of EXE wrapping ? It seems like the unpacking part of Crypkey is the least talked about subject on this board.
Solomon
10-23-2002, 12:42 PM
As I remember unpacking CrypKey is very easy for old versions.:D
squidge
10-23-2002, 01:01 PM
It doesn't seem that simple from where I'm looking at it. The only place talked about unpacking it when searching was using w32dasm to step through it, and then use procdump and revirgin.

However, w32dasm on my version of SKW just causes w32dasm to crash. Going to try ollydbg now.

[... time passes ...]

Yup, Ollydbg worked a treat, found the OEP, dumped it, revirgin on it, and it worked. Oh yeah, changed the EP in PE section too, obviously.
Solomon
10-23-2002, 01:16 PM
CrypKey does not touch the IT/IAT, so ......
hobgoblin
10-23-2002, 01:19 PM
hi there,
What target did you work on? I successfully unpacked a Crypkey protected a while ago, and it was amazingly easy. I'm just curious about another one of these proggies, and it could be nice if you named your target...
:)

Mail me if you want...

hobgoblin
squidge
10-23-2002, 01:25 PM
It was the SKW.EXE from the Crypkey 5.7 SDK. w32dasm wouldn't touch the file, but, like you say, it was incredibly easy using Ollydbg.
peterg70
10-24-2002, 04:40 AM
Ahhh

Crapkey rears it head again. Wonder if 6.0 will ever come out

Unpacking the SKW.EXE is very simple even with w32dasm.

Just step over the code until the EIP is in the correct range and then procdump. No need to fix IAT or anything else (execpt EP in header)

Once that is done a simple two byte mod and voila a full key gen interface.

Catch Ya

Peterg70

PS you might want to do a search for crapkey on this board It may pop up some more info for ya
squidge
10-24-2002, 08:33 AM
Crapkey. LOL :) Thanks.

As for w32dasm it won't even load the file into memory, so I can't use the debugger to step through the code, it just crashes. This might be because it's doing something naughty that WinXP doesn't like. Like I say though, Ollydbg had no problems with it and after that it was unpacked and working in about 5 minutes.

To test out the protection before I do my main target, I decided to grab the nearest disk next to me, which just happened to be a copy of PC Format with UK Info on it. Loaded up both IDA and w32dasm, and found a nice breakpoint which gave me loads of keys in EAX to view.

So, now I have the master key, 3 different site keys (7 day, 30 day and 20 runs), 4 restriction keys, a user key, 3 site codes and finally an entry code. Decrypted them all with ckinfo and found the company info, password, etc. All I need do now is transplant this info into the key gen and then run it. I've already patched the SKW to generate key belonging to any company.
squidge
10-24-2002, 11:42 PM
All done. Got Crypkey Site Key Gen to generate a key for itself, registered it, and then proceeded to generate keys for several other Crypkey applications, which all worked first time without any problems.

I really thought Crypkey would be more interesting than this. Ah well :)
peterg70
10-25-2002, 04:01 AM
If you want more fun you should try the following

Try getting the correct password and company ID etc without using CKINFO.

Look for V6.0 which will have Harddisk ID encoded into it somewhere.

Took me a while originally to get the password as we didn't have CKINFO. So don't rely on tools like CKINFO since they will not work with the next version and if they are not update you will get stuck big time and you be begging for info again on this board.

You now know what you need to achieve as a compiled code but try to understand how to collect the info without other programmed tools.
squidge
10-25-2002, 08:20 AM
That is exactly what I am trying to do know. I know I can create keys for any application, but I want to know now how the keys are encoded from the data that ckinfo generates (eg. Company number/etc). That way, when a new version is released, It shouldn't be too difficult to find out what is new in the algorithms.

I agree with your tools also, although the tools provided are very helpful, it is also extremely useful to be able to get the information without such tools. This is the same for unpacking and many other RE tasks - sure, there may be an unpacking for X, but the next version is bound to work around it, and you know how to do it manually, you'll know what has changed.


Driver Studio *2.7* anti detect patches.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driver Studio *2.7* anti detect patches.
PDA

View Full Version : Driver Studio *2.7* anti detect patches.

nikolatesla20
10-23-2002, 09:10 PM
Patches updated for Driver Studio 2.7

SoftIce Anti-Detection patches, as per +Splaj's walkthru. ALL Credits go to +Splaj, small credits to myself for creating the patch.

Once again, Int 1 detection NOT patched !

Tested on Win2K vanilla ( No Service packs).

-nt20
foxthree
10-24-2002, 06:46 AM
Hi Tesla:

Nice work! One quick question though: I did create a 2.6 anti-detect patch based on +SplAj guidelines and it works fine. Only that in the SoftICE Log I always get this "KeExceptionDispatcher.....<blah> <blah> etc" but it works fine. Do you observe the same thing with 2.7 patch.? Maybe I patch the ExceptionHandler part wrong...

I'll try to install 2.7 on some machine here and test the patch :)

Signed,
-- FoxThree
nikolatesla20
10-24-2002, 01:52 PM
Yes, I saw the same thing in the 2.6 patches I made.

I didnt see it in these patches now though - mainly because I could not find a reference in the file anywhere to "UnhandledExceptionFilter". It just wasnt there. Which is probably a good thing!

-nt20
TekBoy
10-26-2002, 09:09 PM
Could someone please tell me where to find this +Splaj walkthrough?
esther
10-27-2002, 06:59 AM
Originally posted by TekBoy
Could someone please tell me where to find this +Splaj walkthrough?

lazy "noobie" search the threads ....
robber804
11-11-2002, 09:15 PM
I believe the unhandled you are looking for is at offset 4DF95
[yAtEs]
11-24-2002, 06:46 AM
oooh ahhh interesting,

I just moved from 98 to 2k and have found the softice detection
methods have changed/grown etc, so im working a small .sys
and it all works apart from one check im ahaving trouble with,
after reversing ntice i found softice puts a 0CCh on
UnhandledExceptionFilter, but masks it, put 90 90 on the first
2 bytes and exit and go back to softice and amusingly theres
55 90 there now, anyway, trying to think of a way to fix detection
of this kind in my .sys, or maybe patching ntice.sys, anyway
ideas anyone?

I tried the zip provided above out of curoisity and my softice display seem to stop showing its self :p, i havent tried it again
since im more interested on working on my own solution and
understanding the bits and pieces atm.

'+Splaj's walkthru' has been mentioned, ive searched for this but
failed, could someone point me in the correct direction thanks,

regards,
yates.
JMI
11-24-2002, 03:50 PM
[yAtEs]:

"Softice" on the left side of the search page and "+Splaj" on the right will get you to a thread titled "In Win2K how to defeat the anti-debug trick of Asprotect?". It's from 9-24-2001 and is found at:

http://www.woodmann.net/forum/showthread.php?s=&threadid=1806

Caution: Note for those without experience, (not intending to include [yAtEs] in this category) do not blindlessly patch at the addresses shown because these things can change in different version of Softice than the one being discussed, so "search" your version and don't forget to read the entire thread for one additional thing to patch. Also check out +Spl/\j's "detect" tool to see if you patched the correct things.

Regards.
esther
11-24-2002, 04:12 PM
Hi JMI,
Are you slave of [Yates] ;D.
Some ppl complain about me telling ppl to search the board :D
well Who CARES :ddddddd
[yAtEs]
11-24-2002, 07:45 PM
Originally posted by JMI

"Softice" on the left side of the search page and "+Splaj" on the right will get you to a thread titled "In Win2K how to defeat the anti-debug trick of Asprotect?".

ah ok, after another search engine battle session i managed
to find that. thank you for the link, much appreciated.

Originally posted by esther

Are you slave of [Yates] ;D.
Some ppl complain about me telling ppl to search the board
well Who CARES :ddddddd

yes he is my slave, but its ok i pay him well.

regards,
yates.
JMI
11-26-2002, 06:40 AM
[yAtEs]:

If I keep up the good work, any chance I could get a small raise this decade???:p :p

Regards.


SICE (4.0.5 334) bug ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SICE (4.0.5 334) bug ???
PDA

View Full Version : SICE (4.0.5 334) bug ???

Czerno
10-23-2002, 11:25 PM
Hi ! strange bug found to-day, whereby the divide-error vector in V86_mode IDT at (physical) 0 is corrupted :

Incredibly, with soft ICE loaded it reads D8CA:F9E instead of 00CA:F9E ! (00CA being the MS-DOS.SYS segment on systems with 1 HD...) . Byte 3 corrupted !

I noticed that first on a Win95 and found the exact same bug on a quite different Win 98 SE !! Are you guys having same problem ? Or is it my copy only ?

Of course once acknowledged it is rather easily corrected - but this bizarre trashed byte @00000003 raises suspicion that other places in memory could be damaged too and stay unnoticed untill... boom ! ( As far as the RM IDT is concerned, only vector zero is damaged at byte 3)

Looking fwd to your evidence - could this be a 'well known' problem?

--
Cz.

O.T: since the W95 system is 486-based, I coded a tiny time-fixer for SICE. Just a .com that will read the time from the CMOS clock using int 1A and rewrite it to BIOS (and DOS) using int 21, took me five minutes to code under debug.exe (!) so hardly do I dare to offer it but if someone asks I'll post the 20 bytes or so. I do not have it available here and now, sorry...

Regards,

--
Czerno (The Passer-by)
Czerno
11-07-2002, 09:28 PM
Hi men !
My 'connectivity' has dropped to near zero :(
No comment of my previous msg ? Then I assume the problem is with my copy of SIce - True, I patched it a bit, but only the internal keyboard driver tables.

Here's what happens exactly : between when SIce is launched from real mode DOS 7 to when it breaks ( processing the INIT= string ), the byte at $0:3 is INCREMENTED by the constant 0D8h !!!!

If nothing is done at this stage, later when Win is loaded it will of course copy the trashed byte into the hidden copy of the RM memory it uses for initializing VMs ...

Workaround is to correct the byte 3 at this stage,
I added smthing like : eb $0:3 0 ... to my INIT string.
And it works, too :)

However I would like to investigate further what's happening ! Again , could you ppl quickly check whether or not your byte "3" is correct at SICe INIT time ?

My SICE version is 4.05 IIRC .

TYIA

--
Cz
Kayaker
11-07-2002, 11:17 PM
Hi Czerno

My IVT shows the same thing with byte 3, and the msdos.sys segment seems to be 00C9 (only 1 HD) instead of your 00CA. Here's a partial output for my system, from a little app which spits out the vector table coded by [yAtEs] from his ID Intercepting DOS Interrupts and Vectors tut:

Vector Table Contents
-+-+-+-+-+-+-+-+-+-+-

Interrupt #00 D8C9:0F9E 0000:0000
Interrupt #01 0070:0465 0000:0004
Interrupt #02 0560:0016 0000:0008
Interrupt #03 0070:0465 0000:000C
Interrupt #04 0070:0465 0000:0010
Interrupt #05 F000:FF54 0000:0014
Interrupt #06 F000:7F58 0000:0018

No idea where the D8 comes from. Running Win98SE, SI 4.05(334). Do you think this has any effect on the system, or just that it shouldn't be happening in the first place?

Edit: Just tried without SI loaded (oh and what a naked feeling ;), and sure enough the correct entry is 00C9:0F9E. Any evidence from winice.exe where it's writing the D8 to the IVT?

Regards,
Kayaker
Czerno
11-08-2002, 10:55 PM
Thanks Kayaker 4 the feedback! I feel less lonely now ;)

>Running Win98SE, SI 4.05(334).
Same here .

>Do you think this has any effect on the system, or just that it >shouldn't be happening in the first place?

Why of course it's a bug, you -must- have it corrected else any div by zero error in any app that doesn't have its own handler will crash the VM.

The workaround is simple however, as I mentionned in my previous post: only add an

"eb 3 0;"

to that INIT= string ...

Let's only hope that there are no other, less conspicuous but even more dangerous, glitches in our copies of that wonderful tool, S.Ice !

>Any evidence from winice.exe where it's writing the D8 to the IVT?

Not writing D8, rather ADDING it to whatever the inital byte at physical 00000003 !
One would want to debug the SIce initialization, but that is not easy, because debuggers do not like to be debugged ;) Disassembling the winice.exe would seem to be an alternative,
if you feel like doing it. I haven't got time for such detours I am afraid.

Best wishes

--
Czerno


Newbie need help...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Newbie need help...
PDA

View Full Version : Newbie need help...

John
10-24-2002, 12:51 AM
Well I'm not sure this is even possible but this looks like a good place to ask.

I have an exe file which containes a few lines of plain text I need to change and still have a working exe. I need to make the following:

fhud.sdf....fhud....fhud....rhud.sdf....rhud....rhud....ghud.sdf....ghud.

...ghud....thud.sdf....thud....thud....shud.sdf....shud....shud....

Into:

fhud.sdf....fhud....fhud....rhud.sdf....rhud....rhud....ghud.sdf....ghud.

...ghud....thud.sdf....thud....thud....shud.sdf....shud....shud....mhud.

sdf....mhud....mhud....

Which is adding an extra 28 characters, I know enough to know just adding the line will result in a busted exe. So does anyone know if this would be possible and still have a working exe?

Thanks for reading
John
Woodmann
10-24-2002, 01:25 AM
Howdy,

Because this is posted in the newbie forum.............

You got to start this all over again. Go read the FAQ.
Search your target or what you want to do using the
search function or using Google.

No one will be able to derive anything from what you
have posted.

Please try again.

Peace, Woodmann
salsa
10-24-2002, 07:52 AM
Aaah, Woodmann I appreciate your efforts towards keeping the board neat and tidy.

Another nominee for the "Place" ?

Regards,

salsa
Woodmann
10-24-2002, 10:17 PM
Hi,

I cant move it to the "hall" He asked nicely and posted it where
it belongs. Although this may be the 339th time I will regret
leaving such a thread up on the board ;)

OBC


Asprotect..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect..
PDA

View Full Version : Asprotect..

Hopcode
10-24-2002, 01:51 AM
Hello!

Im working on a target. its called "Aston" and its a shell for windows. So you can have a better desk ;)
Anyway, i am messaging you guys, because i would like to know how to determinate, which version of asprotect my target id using.
Does Asprotect contains some values in it to determinate the versions? such as the stuffs you can find on a securom or safedisc executable ?
I have been searching and found nothing, but i could have missed it.
While working on this target, im experiencing one problem.
There are several exe files, and 3 of them are protected by Asprotect. I managed to unpack 2 of them, and the third one is almost working, but still crashes. Dunno why. im doing the same than on the 2 other targets!

Could someone have a look and tell me how old is it ?
i think its 1.2 with api emulation, but im not sure.

h**p://www.astonshell.com/dl.php?aston.zip

Maybe it crashes because of checks or missing Asp addresses.
The exe im having problem with is "A-master.exe".
The two other ones have been unpacked without any problem!

is :

push api
mov eax, some_addi
call eax

a trick of asprotect ? or did i fuck something up ?
(except API emulation i mean..)
I unpacked a good amount of asprotect targets already, and never found this yet, you guys prolly did, but i don't spend my time on asprotect :) there are so many versions out there!

Please, don't flame and don't tell me to search the forum because i had a look already. Im looking forward constructives answers, and no "you are newbie in unpacking" craps.

For now, i wish you guys a good day.

Best Regards,

HopCode
Woodmann
10-24-2002, 02:41 AM
Let me get this right,

You managed to unpack 2 asprotected targets but you cant unpack the third one.????

Please, don't flame and don't tell me to search the forum because i had a look already. Im looking forward constructives answers, and no "you are newbie in unpacking" craps.

How can you unpack your target without knowing what it is protected with? Did you guess? Did they unpack themselves?

Have you ever used a file analyzer? do you know how to read
a pe header? they make tools to do that also.

Look, dont come in here and talk that crap about you already searched.

SEARCH AGAIN........

You obviously did a shit job the first time.

No Sig. I'm pissed off
+SplAj
10-24-2002, 07:25 AM
Hopcode

Maybe I know what your problem with ASPR is. It is quite a nice trick ;)

I won't spell it in B&W......

However, to help I suggest you unpack and rebuild 'LongFileTail' as a project. You should get to a messagebox with 'Check #4 error'........

When you show me the snippet of code that makes this error i'll explain the trick.... if it's not too obvious by then ;)

later
Hopcode
10-24-2002, 12:01 PM
>You managed to unpack 2 asprotected targets but you cant >unpack the third one.????

Exactly, the last one use some other tricks. prolly some checks to see if asprotect is still there. i UNPACKED it, but its not working fully..

>How can you unpack your target without knowing what it is >protected with? Did you guess? Did they unpack themselves?

jesus christ.. i KNOW its asprotect, i was wondering WHICH version it was. there are dozen **different** versions of 1.2 because Alexey didn't make a version change, but its internal changed.

>Have you ever used a file analyzer? do you know how to read
>a pe header? they make tools to do that also.

Listen well, instead of bashing me like a complete RETARD, what about understanding the POINT of my post.

I already unpacked securom, safedisc 2, asprotect and other protectors, yet one of the 3 files use something i never came accross. i wondered if i could have some HELP and not some LAME bashing ok ?

>You obviously did a shit job the first time.
you obviously are retarded :-)

>No Sig. I'm pissed off
So am i :-)

Administrator of this nice place is as smart as a 12 years old kid.

HopCode
zombieys
10-24-2002, 12:36 PM
en...
unpack aston is hard work

i can help you
but i only did aston 1.62 not 1.70

see here
a-master
01A7:00422080 POP EBX
01A7:00422081 POP EAX
01A7:00422082 MOV EAX,[EAX+02]
01A7:00422085 MOV EAX,[EAX]
01A7:00422087 JMP EBX
01A7:00422089 POP DWORD [EAX] //see it ,it will do wrong
01A7:00422080 POP EBX
01A7:00422081 POP EAX
01A7:00422082 MOV EAX,[EAX+02]
01A7:00422085 MOV EAX,[EAX]
01A7:00422087 JMP EBX
01A7:00422089 POP DWORD [EAX]
01A7:0042208B JMP EBX
01A7:0042208D ADD [EAX+EDX*4],EAX
01A7:00422090 DB FF
01A7:00422091 DB FF

01A7:00422014 POP EBX
01A7:00422015 POP EAX
01A7:00422016 MOV EAX,[EAX+02]
01A7:00422019 MOV EAX,[EAX]
01A7:0042201B JMP EBX
01A7:0042201D POP DWORD [EAX] //see here it will do wrong too
01A7:0042201F JMP EBX
01A7:00422021 BOUND ECX,[EBX+408DFFC0]
01A7:00422027 ADD [EBX],AL
01A7:00422029 ADD [EAX],AL
01A7:0042202B ADD [EDX+EBX*4],CL

disassembler a-master and search "call eax"
you will find more

good luck...
Hopcode
10-24-2002, 01:04 PM
Hello :)

Thanks, i will have a look at it ;-)
See you soon ;)

HopCode
Hopcode
10-24-2002, 01:05 PM
Originally posted by zombieys
en...
unpack aston is hard work

i can help you
but i only did aston 1.62 not 1.70

see here
a-master
01A7:00422080 POP EBX
01A7:00422081 POP EAX
01A7:00422082 MOV EAX,[EAX+02]
01A7:00422085 MOV EAX,[EAX]
01A7:00422087 JMP EBX
01A7:00422089 POP DWORD [EAX] //see it ,it will do wrong
01A7:00422080 POP EBX
01A7:00422081 POP EAX
01A7:00422082 MOV EAX,[EAX+02]
01A7:00422085 MOV EAX,[EAX]
01A7:00422087 JMP EBX
01A7:00422089 POP DWORD [EAX]
01A7:0042208B JMP EBX
01A7:0042208D ADD [EAX+EDX*4],EAX
01A7:00422090 DB FF
01A7:00422091 DB FF

01A7:00422014 POP EBX
01A7:00422015 POP EAX
01A7:00422016 MOV EAX,[EAX+02]
01A7:00422019 MOV EAX,[EAX]
01A7:0042201B JMP EBX
01A7:0042201D POP DWORD [EAX] //see here it will do wrong too
01A7:0042201F JMP EBX
01A7:00422021 BOUND ECX,[EBX+408DFFC0]
01A7:00422027 ADD [EBX],AL
01A7:00422029 ADD [EAX],AL
01A7:0042202B ADD [EDX+EBX*4],CL

disassembler a-master and search "call eax"
you will find more

good luck...

Thx for this .
I already figured what was crashing, but i wasn't sure if it was really a trick, or something i miss did!

I will dig in more, and try what splaj+ told me :)

Thx !

Regards,

HopCode
BruceLee
10-24-2002, 06:54 PM
It's interesting target :)

Please attach your IAT resolving!
Hmmm, I thing my resolving APIs are wrong!
evaluator
10-24-2002, 07:18 PM
>>Administrator of this nice place is as smart as a 12 years old kid.

If so, BEST CHOISE for you must be:
GO AWAY.
Woodmann
10-24-2002, 10:09 PM
Please, don't flame and don't tell me to search the forum because i had a look already. Im looking forward constructives answers, and no "you are newbie in unpacking" craps.

See this ^^^^^^^^^^^^^^^^^^^^^^^^^^^

If you want to come in here and be so bold then you get what
you deserve.
Dont post things like this, it is arrogant. It says to me that you are too big to do any research, just gimme my answer.

You have cracked Asprotect, Congratulations.

And your point was..... Tell me the trick ????

Please dont irritate the 12 year old, I might have a tantrum.
Hopcode
10-24-2002, 10:17 PM
>See this ^^^^^^^^^^^^^^^^^^^^^^^^^^^
so what?
When i read this board, i see too damn often guys bashing others telling them to search when they already did... its kind of irritating already..

>If you want to come in here and be so bold then you get what
>you deserve.
>Dont post things like this, it is arrogant. It says to me that you >are too big to do any research, just gimme my answer.

It was not arrogant at all.
Most of the arrogants guys on this forum are the moderators.. but oh well.. I was just telling that i did the search and that i didn't wanted to have a bash reply like it OFTEN happens to others..

>You have cracked Asprotect, Congratulations.
that's not the points. i wanted to share something with you guys, i think that's why this board is all about.

>And your point was..... Tell me the trick ????
not really. my point was :

1- does Asprotect contain something to identify which build was used to protect a target, such as the things that you can find on securom or Safedisc 2..

2- Im experiencing some problems on a target. i managed to unpack 2 files out of 3. the third one is different, it seems to use a nice trick, prolly some checks to see whether the asprotect shell is there or not. have you ever seen this ? did i do something wrong ? could we talk about it ?

Now do you see a "gimme the trick, i don't wanna work myself at all?"

>Please dont irritate the 12 year old, I might have a tantrum.

Next time, don't bash like an idiot without understanding what's going on then.. splaj+ was nice and answered me politely, so did i..
Hopcode
10-24-2002, 10:21 PM
Originally posted by BruceLee
It's interesting target :)

Please attach your IAT resolving!
Hmmm, I thing my resolving APIs are wrong!

hello,

sure no problem.
Maybe its not even good? although i could unpack 2 of the 3 files..
I used Imprec for this.

Regards,

HopCode
Woodmann
10-24-2002, 11:40 PM
Splaj is doing you a great favor.

I have a response to your original questions,

Maybe
Maybe
No
Yes
No

Now tell me how that helps you? You asked the questions and I answered them.

Now, if no one here knew the answer to the "riddle" you ask,
what would you do?

Send it via pm, enough of this in here.

Woodmann
BruceLee
10-25-2002, 11:49 AM
Aston
=====

A-master.exe
------------

ASProtect v1.2?

Startup Eip = 00401000
First dip: call 0040D968
Second dip: call 0040AF74
OEP = 00420F60

:::::::::: DUMPING ::::::::::

1. dip
------
PUSH EBP
MOV EBP,ESP
MOV EAX,[004226F4]
MOV EDX,[EBP+08]
MOV [EAX],EDX ; before is execute typed: r edx 0
POP EBP
RET 0004

2.dip
-----
PUSH EBP
MOV EBP,ESP
MOV EAX,[EBP+08]
MOV [0042223C],EAX
POP EBP
RET 0004

OEP
---
PUSH EBP
MOV EBP,ESP
ADD ESP,-0C
MOV EAX,00420E78
CALL 00401110
CALL 0040AF84
CALL 0040100C
MOV EAX,EAX
ADD [EAX],AL
ADD [EAX],AL

:::::::::: GETTING IAT ::::::::::

My IAT is same as yours.

:::::::::: FIXING DUMPED FILE ::::::::::

1. error
--------
0042071B PUSH KERNEL32!GetLocalTime
00420720 MOV EAX,00422280
00420725 CALL EAX ; *** error ***
00420727 XOR EAX,EAX

replace call eax with jmp 420727.
offset 20725: FFD0 replace with EB00

2. error
--------
0041A53E CALL KERNEL32!GetProcAddress
0041A543 CALL EAX ; *** error ***
0041A545 MOV [EBP-08],EAX

for me eax = 0 (call 0 ???). In Original in eax return 1E(30 days).
I replace call eax with inc al,1e.
offset 1a543: FFD0 replace with 041E

No more errors! Now it works fine and forever!

Bruce Lee
Hopcode
10-25-2002, 12:46 PM
Hello Bruce Lee !

Thx for those informations, but i patched those already ,and the problem for me is :

it doesn't crash anymore since 2 days now, the application runs normal BUT its not good! i patched it like you already. (sort of)
When you run the protected target you see many "tabs" such as
Aston, Taskbar, Toolbars etc..

On my exe, i only have Aston Tab! that's why i posted in first!
I could get ride of the errors, but the file was somewhat fucked!
Maybe i did something wrong if it works fine for you..
i have the same OEP, you have the same IAT than me. Weird.
Lemme have another look at it. I will let you know.

you sure that you have all the "tabs" ?

Regards,

HopCode
BruceLee
10-25-2002, 12:53 PM
Hello Hopcode!

Yes, I'm 100% sure! Just do what I wrote!

Bruce Lee
Hopcode
10-25-2002, 02:12 PM
Ok, i tested and effectively, it does *work*.
In fact, depending of how you patch the first crash, you either get a complete user interface , or a limited one. I just had to change the way i patched it, weird. Altho i remember having it run with normal interface and then crashes later on.
Next time i will know that the way you patch it can sometimes trick you..

Anyhow, if you play with options in A-master , you will find it crashes somestimes. it looks like there are some other checks.
There are a couple of Call eax left in the program. Maybe those are checks too!

Im not looking for a crack anyway, i just wanted to understand why i had that weird interface. Thx for the info my friend.
Now i can delete this target :)
You might want to spot every checks tho ;)

Thx again!

Regards,

HopCode
BruceLee
10-25-2002, 02:44 PM
Hey Hopcode How did you dump Aston.exe?

Can you help me? I can't dump it to work!

Bruce Lee
Hopcode
10-25-2002, 03:22 PM
Originally posted by BruceLee
Hey Hopcode How did you dump Aston.exe?

Can you help me? I can't dump it to work!

Bruce Lee

hey,

what's the problem with this one ?
there were no problems at all!

I used /tracex to find OEP, there are 2 dips then you are at OEP. OEP is looking exactly like on a-master.exe :)
Then i used /pedump img_base OEP_rva c:\aston\file.exe

then i used Imp Rec to rebuild IAT. and that's all. it then works like a charm. same with Thwizard.exe.
Have you some problems to rebuild the IAT?

Have Fun,

HopCode


Probably a stupid question, but hey who knows...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Probably a stupid question, but hey who knows...
PDA

View Full Version : Probably a stupid question, but hey who knows...

foxthree
10-24-2002, 04:21 PM
Fellow RCEs:

I have been having this question for a long time (since I started working with NTICE). When we are able to load NTICE even after OS start (like for instance using "net start ntice") why isn't there a way to unload NTICE, such as say "net stop ntice". Is that because NTICE "messes" ;) up your system so badly that only a reboot will unload the driver from the system?

I have been scavenging info. about PM debuggers but still no idea why this is not possible. If you guys think I'll get the answer after further "scavenging", feel free to ignore this one...

Signed,
-- FoxThree
NervGaz
10-25-2002, 08:41 AM
My guess would be that NTICE messes with the IDT (and other things) and then other drivers might mess with them too so NTICE can't restore thr original IDT when it's unloaded the chose not to make it " stopable", since if you can't restore itr to it's current state but remove the NTICE stuff it would make the system unstable... ummm hope that made any sense... but in short i guess it's because NTICE messes up your system so badly...
tgodd
10-25-2002, 05:32 PM
If Softice is able to manage the IDT, GDT, Page tables, etc., then it IS in fact able to reverse things and put them back to the current state.

My opinion is that the NUMEGA and/or Compuware were just plain lazy.

Regards,

TGODD


DS 2.7 Patch correction. Sorry.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DS 2.7 Patch correction. Sorry.
PDA

View Full Version : DS 2.7 Patch correction. Sorry.

nikolatesla20
10-24-2002, 06:39 PM
Foxthree pointed out that he no longer got the "Xhandledexception" message in his softICE logs - at least I didnt get it.

This brought to my attention that I had missed something, so I ran +Splaj's detector and lo behold it detected thru "Int 3 on Kernel32!UnhandledExceptionFilter".

I've removed the UnhandledExceptionFilter reference now, and it's clean (Still, except for int 1).

Get the fix here.

http://www.woodmann.net/forum/showthread.php?s=&threadid=4031

or Here as an attachment

My apologies to everyone who already downloaded.

Speaking of Int 1 detection, couldn't you just write a SI macro that increments the EIP to the right location before continuing...works on evaluator's modifed version of ^Daemon^'s detector. Perhaps would work reliably?

-nt20
pLayAr
10-25-2002, 10:06 AM
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
TRACER: Entering DriverEntry
TRACER: Initialisation done...
TRACER: Unloaded
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter
kernel32!ZnhandledExceptionFilter

???
nikolatesla20
10-25-2002, 02:24 PM
I wouldnt worry about it. The whole point is to hide SI....nobody said it would work 100% like normal. :)

You can change the name back if you want to and it wont do that anymore. If you encounter a program that checks for it, you can always change it again.

Dont forget, if you are modifying a system driver you need to correct the checksum after you mod it. Use LordPE.

-nt20
foxthree
10-25-2002, 02:50 PM
Hi Tesla:

If you refer to my earlier post, I said I did get the "Unhandled Exception Handler" strings in the log window with 2.6 anti-detect patch and that I would test your patch with 2.7 and then let you know. May be typo????

Anywayz, I got caught up in something and couldn't test it but Player's logs shows same stuff! May be not a "problem" per se but just annoying ;)

Signed,
-- FoxThree
nickman
10-25-2002, 03:46 PM
@nikolatesla20: Thanks for your job, but I have a problem with that:) In any situation under 2k I could not manage to make sice 4.2.7 menu visible but it is in there:confused: same problem with 4.2.6 and your 4.2.6 patch...in unpatched mode there is no problem. I guess it is related to NTICE.SYS, thanks:)
nikolatesla20
10-25-2002, 04:02 PM
um, what do you mean "softice menu" ?

Do you mean the actual softice screen?

If you mean the actual screen, make sure you are patching all 3 files included in the zip. The SoftICE video driver gets a name change, so ntice.sys need to also know the new name to work.

-nt20


IDC script project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > IDC script project
PDA

View Full Version : IDC script project

ZaiRoN
10-24-2002, 11:54 PM
from Kayaker's last post:
"Yes, I've definitely just become a real fan of IDC scripts, lol. Made very good use of Toteu's Icedump-to-IDA script for a start, pretty sweet. I see there's a few interesting script examples at the Datarescue site as well, particulary the Bit Fields tutorial. For a long time I've been wanting to come up with an app/technique to identify the MSG parameter of SendMessage/ SendDlgItemMessage calls, a suitable script just might be the ticket and I think I'll play with the idea..."

This might be an interesting project:)

I have wrote a little script and might be a good starting point for those who want to try. The program look for Msg parameter of SendMessage functions:
#include <idc.idc>

static main()
{
auto start, end, temp;

start = SegStart(BeginEA()); // start address
end = SegEnd(BeginEA()); // end address

// you can cut this message. i have put them for...indeed i don't know why :ppp
Message("\n\n\nSimple script that try to find SendMessageA function");
Message("and try to identify his Msg parameter.");
Message("\nSearch starts from address: "+atoa(start)+"\n\n");

// walk through the entire section
for (start;start<end;start=NextAddr(start))
{
temp = Rfirst0(start);

if (Name(temp) == "SendMessageA")
{ // the function has been found
Message(atoa(start)+" refers to "+Name(temp));

// walk back and looks for 'push Msg'
start = PrevAddr(start);
while (GetOpnd(start,0) == 0)
{
Message("\nno valid instruction at: "+atoa(start));
start = PrevAddr(start);
}
Message("\npush hWnd found at: "+atoa(start));
start = PrevAddr(start);
while (GetOpnd(start,0) == 0)
{
Message("\nno valid instruction at: "+atoa(start));
start = PrevAddr(start);
}

// i have found the param...
Message("\nmsg param pushed at:" +atoa(start)+" is: "+GetOpnd(start, 0));

// now we have the Msg and we can make the check!
// we can use a very long switch that covers each wm_command
// or maybe we can work directly on a specific file
// filled with commands and values

start = start + ItemSize(start);
start = start + ItemSize(start);
start = start + ItemSize(start);
Message("\nrestart from: "+atoa(start)+"\n\n");
}
}

Message("\ngame over!!!\n");
}
nothing special, i'm not a guru_script. there are many useless messages; only for debug, you can cut.
from now, everyone can put here his ideas, comments, source and everything else.

for informations on idc take a look at: http://www.datarescue.com/idabase/
there's also an interesting directory under ida called 'IDC' with lots of scripts :)

I hope that it is what kayaker wanted to make...

good work!
regards,
ZaRoN
ZaiRoN
10-26-2002, 05:25 PM
the new version of the script.
- sendmessage_param.idc : the script
- wm_messages : i have put some wm_ messages inside

you have to open the file sendmessage_param.idc and to change the path of the wm_messages file.

it's not perfect (i know...) but i hope to receive feedback like bugs, comments, improvements or everything else.

cheers,
ZaiRoN
Kayaker
10-26-2002, 07:25 PM
Hi Zairon

I finally got a chance to start working with your first script, using it as a template with a small test program to begin to learn the *hundreds* of IDC script commands. There's not a lot of script examples out there, full-on plugins being the next step, though I found a few, and Mammon_'s Tales to Fravia's Grandson ...An IDA Primer...had a few good ones.

To debug the script I used a Warning command at various points to output diagnostic info to a message box, rather than the Message command which doesn't allow you to stop the code flow. I don't know if this is a bit of a bug, but if I stopped the displaying of the message boxes with "Hide", I could only get them back by closing IDA and reopening the file. I couldn't find an option for this, but do you know if there's a way to "Unhide" displaying of message box messages after you've selected to Hide them and decide to rerun a script?

Your new script runs fine and looks to be a good strategy, and seemed to catch the WM messages that were included. A minor arguable point, but the inner loop might run a bit faster with a small check before testing for SendMessageA. Instead of testing on a byte-by-byte basis it would be on a valid address-by-address basis, i.e.

Instead of

for (start ; start < end ; start = NextAddr(start))
{
temp = Rfirst0(start);
if (Name(temp) == "SendMessageA")

I used

for (start ; start < end ; start = NextAddr(start))
{
temp = Rfirst0(start);

while ( temp != BADADDR)
{
if (Name(temp) == "SendMessageA")

There is one more serious problem I came across though, with some programs such as Notepad (!!), IDA gave an error message on beginning to disassemble it that "Imports segment could be destroyed, uncheck 'make imports section' at loading time". Even though all imports were defined in the subsequent disassembly, i.e. SendMessageA calls were correctly disassembled, the idc script missed them entirely and the whole strategy failed. This even happened with calc.exe, where there was no import error message but again the idea failed. Can you imagine what this might mean for rebuilt dumped files? This might be a failing in Rfirst0 where the instruction isn't recognized as an Xref. Maybe we could use AddCodeXref to create a user defined call type? I don't know if this could solve the problem, just an idea.

Cheers,
Kayaker
nikolatesla20
10-27-2002, 04:00 AM
Kayaker,

Hey :)

Just reading your post - my theory on why Notepad and Calc. exe fail is because some M$ programs like that, do not have a conventional IAT table. In effect, the first thunks are bound imports I beleive, so they do not point to the function names as normal exe's do.

Try out my tool, First Thunk Rebuilder, on the file, and running your script again, and see what happens.

http://www.woodmann.net/protools/files/utilities/firstthunk.zip

For dumped files to operate normally with ALL tools, THIS tool is very handy.

Let me repeat, YOU SHOULD ALWAYS USE THIS TOOL ON A DUMPED FILE. It brings the new IAT in the dump to 100% compatibility to how most files are linked.

enjoy...

-nt20
Kayaker
10-27-2002, 06:34 AM
Hey, just thought I'd pass this on. I found a handy command to step back a set number of disassembled instructions to find the MSG parameter, rather than using the PrevAddr / GetOpnd combination to do it byte-wise. PrevNotTail - This function searches for the previous displayable address in the program.

Once you've found the SendMessageA call:

Call_Address = start; // Save original address

for ( i=0 ; i<2 ; i++ ) {
// MSG param is pushed 2nd last for SendMessageA
start = PrevNotTail(start);
}

// Warning(" MSG Param pushed at " + atoa(start) + " is " + GetOpnd(start, 0));

start = Call_Address; // Restore original address

For SendDlgItemMessageA it would be:
for ( i=0 ; i<3 ; i++ ) {
// MSG param is pushed 3rd last for SendDlgItemMessageA

Thanks nikolatesla20, I'll try it out and let you know ;)

Kayaker
Kayaker
10-27-2002, 08:05 AM
Hi nt20

As your app says, Bugs? What Bugs? :)

Sorry to say, minor problem, notepad and calc already contain the correct import addresses in the First Thunk in the raw file. (as you mentioned). The IMAGE_THUNK_DATA RVAs are not replaced (or don't need to be anyway) during PE loading. Before using your rebuilder the First Thunk contained i.e. BFE815EA, afterwards it contained the correct RVA to RegSetValueExA of 00006D88. However on loading the First Thunk is apparently not initialized so still contains the addy 00006D88 instead of the correct API address and crashes with an invalid page fault.

I didn't try it on a dumped file, but doesn't the same situation occur with a dump, the First Thunk is already intialized with the valid addresses for the system it was dumped on? I'm using the Win98SE version of notepad, maybe newer versions were linked differently.

Actually, I was just doing a bit more research on this trying to figure out if there is something defined in the PE header to "tell" the loader to initialize the First Thunk or not, or whether the PE Loader (which I've seen almost NO documentation on how it really works) somehow decides itself, when I found this interesting snippet from
Peering Inside the PE: A Tour of the Win32 Portable Executable File Format by Matt Pietrek which pretty much describes the situation:

----------------------------------------------
Why are there two parallel arrays of pointers to the IMAGE_IMPORT_BY_NAME structures? The first array (the one pointed at by the Characteristics field) is left alone, and never modified. It's sometimes called the hint-name table. The second array (pointed at by the FirstThunk field) is overwritten by the PE loader. The loader iterates through each pointer in the array and finds the address of the function that each IMAGE_IMPORT_BY_NAME structure refers to. The loader then overwrites the pointer to IMAGE_IMPORT_BY_NAME with the found function's address. The [XXXXXXXX] portion of the JMP DWORD PTR [XXXXXXXX] thunk refers to one of the entries in the FirstThunk array. Since the array of pointers that's overwritten by the loader eventually holds the addresses of all the imported functions, it's called the Import Address Table.

For you Borland users, there's a slight twist to the above description. A PE file produced by TLINK32 is missing one of the arrays. In such an executable, the Characteristics field in the IMAGE_IMPORT_DESCRIPTOR (aka the hint-name array) is 0. Therefore, only the array that's pointed at by the FirstThunk field (the Import Address Table) is guaranteed to exist in all PE files. The story would end here, except that I ran into an interesting problem when writing PEDUMP. In the never ending search for optimizations, Microsoft "optimized" the thunk array in the system DLLs for Windows NT (KERNEL32.DLL and so on). In this optimization, the pointers in the array don't point to an IMAGE_IMPORT_BY_NAME structure—rather, they already contain the address of the imported function. In other words, the loader doesn't need to look up function addresses and overwrite the thunk array with the imported function's addresses. This causes a problem for PE dumping programs that are expecting the array to contain pointers to IMAGE_IMPORT_BY_NAME structures. You might be thinking, "But Matt, why don't you just use the hint-name table array?" That would be an ideal solution, except that the hint-name table array doesn't exist in Borland files. The PEDUMP program handles all these situations, but the code is understandably messy.
-------------------------------------------

Interesting eh? MS strikes again, lol.

Kayaker
nikolatesla20
10-27-2002, 02:01 PM
Sorry to hear about it not working - I tried it on my XP notepad and calc and they both ran just fine afterward..

Ya the whole IAT thing is messed up ! lol. The FirstThunks , if bound , are used if the PE loader sees the versions are correct. Come to think of it, really how would it know eh? Anyway then its supposed to look at the orginal table. But in some files that doesn't exist. HOwever, in all the microsoft linked files I've looked at it's always been there. (The "Original First Thunks")

That's the whole reason I made the tool, is on dumped files, we are rebuilding the Original First Thunks. Which works fine, but it leaves the FirstThunks pointing in the wrong place, and tools like Code Snippet Creator only look at the First Thunks *bug IMHO* so they need to be corrected. :)

Well, enough self-promotion.

-nt20
ZaiRoN
10-27-2002, 04:19 PM
hi!
>I couldn't find an option for this, but do you know if there's a way to "Unhide" displaying of message box messages after you've selected to Hide them and decide to rerun a script?

imho, there's no way...

>for (start ; start < end ; start = NextAddr(start))
>...
>while ( temp != BADADDR)

sorry but i don't understand the reason why you have added the while statement.
I tryed this code but it goes in loop; I suppose you have also added some instruction -inside while statement- to update start or temp variables... anyway, there's another nice instruction: NextNotTail (do you remember PrevNotTail?)
now, I have a testing instruction_by_instruction:

instead of:
for (start;start<end;start=NextAddr(start))
{
temp = Rfirst0(start);
if (Name(temp) == "SendMessageA")

use:
for (start;start<end;start=NextNotTail(start))
{
temp = Rfirst0(start);
if (Name(temp) == "SendMessageA")

notepad and calc.exe:
this is a BIG problem. hmmm...I don't know if AddCodeXref could solve the problem but there's a stupid way to solve the problem.
from my notepad.exe file:

.text:00401378 call ds:SendMessageA

the script doesn't recognize the call. you try to use:

temp = 0x401378;
Message("\ncall ds:message points to: "+atoa(Dfirst(temp)));
Message("\nand the function is: "+Name(Dfirst(temp)));

and look at what happens. it would be an interesting way.
i'm trying the AddCodeXref function, i'll tell you next.

ZaiRoN
ZaiRoN
10-27-2002, 05:47 PM
some bugs ;)

we need to recognize the right 'push Msg' instruction:
.text:00401A7F push 0Eh ; Msg
.text:00401A81 mov eax, hWnd ; Msg = unknown message. please, update wm_messages file
.text:00401A86 push eax ; hWnd
.text:00401A87 call ds:SendMessageA

we need to recognize the right wm command:
.text:00404B06 mov ebx, 0C2h
.text:00404B0B push esi ; wParam
.text:00404B0C mov eax, hWnd
.text:00404B11 push ebx ; Msg = unknown message. please, update wm_messages file
.text:00404B12 push eax ; hWnd
.text:00404B13 call ds:SendMessageA

it will not be an easy thing...

ZaiRoN
ZaiRoN
10-27-2002, 07:29 PM
you can solve the first problem using the function GetMnem that get mnemonics of instruction.
the idea is to go to the search of two previous push instruction.

Call_Address = start;// Save original address

for ( i=0 ; i<2 ; i++ ) {
// i'm looking for 2 push
if (GetMnem(PrevNotTail(start)) != "push")
i = i-1;
start = PrevNotTail(start);
}

ZaiRoN
Kayaker
10-28-2002, 05:25 AM
Yeah, there are definitely some issues with implementing this well. Imports not recognized if the IAT is fupped, offset and indirect pushes of the MSG param (heh, hadn't thought of that one Z. ;-), and what else? Oh, how about support for non-WM_ messages that might be of interest? Not everyone needs to know that an app is sending a BN_DISABLE message to a button for example, but it could come in handy.

I've been thinking along the lines of creating message "families" and allowing the user to select any of them to try to ferret out any undefined non-WM_ messages. The main WM_ script can be automatic over the whole file, then any missing values can be selected with the mouse, a message family selected, and a new script can be run on one line via a hotkey. Lol, at this point I'd just be happy having the WM script run on notepad, but what the heck, ya gotta dream ;p

What I did was to get IDA to do the dirty work of creating an Enum table of WM message constants, which is included in the main idc file, and having the MSG param replaced with a descriptive definition with one simple instruction. To create the Enum table you simply select any one WM_ MSG operand with your mouse, right click and select "Use standard symbolic constant". Then select File/Produce/Dump typinfo to IDC file, which will spit out *all* the message constants within that family (wm, bm/bn, lb/lbs,...). Then you can paste the Enum table into your idc file and access the fields with

OpEnumEx(start, 0, GetEnum("MACRO_WM"), 0);

This will parse through the table (named MACRO_WM) and match up the MSG constant with a valid text definition for it.

Here's what I've got so far, which seems to work on "normal" test programs, but these other few issues with a nonstandard setup really need to be looked at next! It looks like you've got some good ideas there Zairon. If anyone has any comments on any of this it'd be great.

Kayaker
ZaiRoN
10-28-2002, 04:17 PM
>heh, hadn't thought of that one Z. ;-)
This *mini* project is being becoming a *large* project ;)

I like your new strategy; it is much elegant and clear, good work!

it works well on *normal* programs but for the others? maybe the best thing to do is to study a new case at the time. Which will be the first? Seems to be there the embarrassment of the choice ;ppp

later,
ZaiRoN
Kayaker
10-28-2002, 06:41 PM
Originally posted by ZaiRoN
>
This *mini* project is being becoming a *large* project ;)

Lol, yes once you get into it it kind of takes on a life of its own doesn't it?. It is fun though...

Case in point, I just updated the above zip file so it avoids totally the problem with the "funny" imports of notepad et al. It seems that using the combination

----------------
for (start ; start < end ; start = NextNotTail(start)) {
temp = Rfirst0(start);

if (Name(temp) == "SendMessageA") {
-----------------

only works if the First Thunks aren't bound, as per earlier discussions. Instead, the updated file seems to work no matter what, plus it catches the differences in how an import can be defined by IDA

---------------
for (start ; start < end ; start = NextNotTail(start)) {
temp = Rfirst0(start);

if (GetOpnd(start, 0) == "SendMessageA" || GetOpnd(start, 0) == "ds:SendMessageA") {
----------------

There's at least one other situation that needs to be taken care of, when you get something like
mov esi, ds:SendMessageA
...
call esi ; SendMessageA

Note that the *comment* is put in by IDA, it recognizes what the call is, so what we need is a way to return comments and check them as well. I haven't found a command yet to do that actually, there is MakeComm (make comment), but I haven't seen a corresponding 'GetComm' or something like that, any ideas?

Mind you, my eyes are getting blurred by this point from reading the damned idc help file and being frustrated with the vagueness of it all and lack of cross referencing! Anyway, the new file should work better.

cya,
Kayaker
ZaiRoN
10-28-2002, 09:14 PM
There's at least one other situation that needs to be taken care of, when you get something like
mov esi, ds:SendMessageA
...
call esi ; SendMessageASeems there is no way to get comments; is it possible!?! References about this language are not much.
In the meanwhile we can use something like this to solve the problem:

if ((GetOpnd(start,1) == "ds:SendMessageA") || (GetOpnd(start,1) == "dword ptr ds:SendMessageA"))
{
Message("\n"+atoa(start)+" mov "+GetOpnd(start,0)+", "+GetOpnd(start,1));
--- here we have to *trace* the code looking for 'call <register>' ---
}

later...
ZaiRoN
ZaiRoN
10-28-2002, 11:51 PM
Hi Kayaker,

I have noticed that we use instructions Rfirst and Rnext uselessly. Try to remove them and see with your eyes. Only GetOpnd is needed.
Look at this:

if ((GetOpnd(start,1) == "ds:SendMessageA") || (GetOpnd(start,1) == "dword ptr ds:SendMessageA"))
{
temp = start;
for (temp;temp<end;temp=NextNotTail(temp))
{
if (GetMnem(temp) == "call")
{
if (GetOpnd(temp, 0) == GetOpnd(start,0))
{
addComment(temp);
temp = end;
}
}
}
}

This only recognizes the first 'call <reg>'. We need to check when the time to stop the 'call <reg>' search is. For today it is enough, I go to bed...

'night!
ZaiRoN
[yAtEs]
10-29-2002, 04:37 PM
Hi,

Just reading through your posts and saw you labelling up API
params, this was probably just an example for your IDC scripts
but i thought i'd mention you can parse C header files and
function prototypes into IDA (:

yates.
crUsAdEr
10-29-2002, 05:06 PM
Hi guys,

Just jump back to join the board and i simply think this is such a good idea, thanx for reminding me of it... my scripting skill is about 2 hrs old, C programming a few days old :)... but it already helped me inline patch our fav protector :)...

Regards,
crUsAdEr

P.S : Global : i hope you use idc script to break the first 4 layers :)... if not then maybe you should try now :D
Kayaker
10-29-2002, 06:26 PM
Originally posted by crUsAdEr
Hi guys,

Just jump back to join the board and i simply think this is such a good idea, thanx for reminding me of it... my scripting skill is about 2 hrs old, C programming a few days old :)... but it already helped me inline patch our fav protector :)...

Regards,
crUsAdEr

P.S : Global : i hope you use idc script to break the first 4 layers :)... if not then maybe you should try now :D

Howdy Crusader,

I think many of us are wallowing around in the shallow end right now with idc scripting ;-) There's just as many IDA "Pro's" around as well (forgive the pun), but in general there just doesn't seem to be much in the line of 'primers' on the subject of scripts and/or plugins. It seems we're stuck with the IDA help file and what info we can glean from the few examples that seem to be around. Or maybe this project might be enough to kickstart people on the subject...

Funny you mention that combination. How's your Russian? :)

Plugin ??? IDA Pro: AsPack/ASPR ????????????

http://reversing.net/tools/004/aspr.html

Cheers,
Kayaker


IceDump & VXDLDR_LoadDevice error ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceDump & VXDLDR_LoadDevice error ???
PDA

View Full Version : IceDump & VXDLDR_LoadDevice error ???

Clandestiny
10-25-2002, 01:27 AM
Hiya,

I seem to be having a problem loading IceDump. The error message is the infamous "VXDLDR failed to load icedump"...
Not wanting to be too much of a lamer ;) , I did a search of previously addressed IceDump load problems and have looked into the proposed solutions. Several of these mentioned the need for loading the kernel32.dll exports in winice.dat. I have done this, but the error remains...

Digging just a little bit deeper, I set a breakpoint on VXDLDR_LoadDevice, the call that loads the IceDump driver.

include vxdldr.inc

mov edx, [Devicename]
mov eax, [Flags]
VxDcall VXDLDR_LoadDevice
jc errorhandler

Devicename
Address of a null-terminated string specifying the filename of the VxD.

Flags
Indicates whether the device is initialized by the system or by the calling VxD. If this parameter is VXDLDR_INIT_DEVICE, the device is initialized by the system. Otherwise, this parameter should be zero, and the calling VxD should initialize the device and send the SYS_DYNAMIC_DEVICE_INIT message.

The flags parameter is the above mentioned VXDLDR_INIT_DEVICE and the Device name simply the path to icedump. The function fails with a return value of 07h, which corresponds to a VXDLDR_ERR_DEVICE_REFUSED. According to the MSDN, the meaning of this error is "Specified device operation not allowed. " Further investigations on this particular error, it's cause and solution have not turned up very much.

For whatever its worth, I should also mention that I am running Win98 SE on an AMD Athlon XP 2200 processor and the system is currently in a dual boot configuration with Win2K (Win98 is installed on the F partition and Win2K on the primary partition C). I would also like to say, that I currently have an old 300 MHZ machine with Win98 SE installed from the same Windoze copy on drive C, running the exact same version of SoftICE, and the exact same version of IceDump and it works perfectly.

...Now would be a good time to extend my complaints even further, I suppose ;) I am also having extreme difficulties with using the bpr function on my AMD system (it works find on the old 300 MhZ). Any attempt to use *any* form of the bpr or bprw locks up my system irrecoverably when I attempt to resume execution of the target. I have concluded that winice never makes it into the int 0E page fault handler (bpr works by marking the target pages 'not present'), and locks up immediately upon any attempt to resume execution. Therefore, the an error must occur when SoftICE sets up the range breakpoint. I am attempting to examine the bprw function in winice, but have met with extreme displeasure at any attempt to trace it (breakpoints don't work, a manual int 3 breaks but causes a page fault when I try to trace...ect).

If anyone can shed some light on this or has experienced similar problems I would be eternally grateful to hear of it :D

Thank You,
Clandestiny
Kayaker
10-25-2002, 07:27 AM
Hiya

As you know, you and I have been working on this tirelessly, LOL, since you made that fateful decision to upgrade with an AMD processor, and BPR hasn't worked on your system since. So much for porting our Backtrace buffer disassembler to DriverStudio :-[ I was playing with something tonight that might quick-step us through some of the code...

The first step might be to see if the SI breakpoint structure is being filled correctly on a BPR. You can do this by comparing between your 2 systems, this would at least be a beginning. After applying Toteu's Icedump-to-IDA inctoida.idc IDC script, winice becomes *much* more readable, and damn, even understandable, big kudos to both sides ;)

The BPR routine begins here more or less. bUserCommand is the command you typed into the command window, i.e. BPRW Notepad T, pSkipWord is basically a parsing routine, and pAllocateBP is where we want to start.

:C003A638 c_BPR proc near
:C003A638 mov esi, offset bUserCommand
:C003A63D call pSkipWord
:C003A642 jb loc_0_C003A7DF
:C003A648 call pAllocateBP
:C003A64D jb loc_0_C003A7FB
:C003A653 mov ebx, eax
:C003A655 call pExpression2Integer
:C003A65A jb loc_0_C003A807
:C003A660 call pCheckAddress
...

following pAllocateBP...

:C003B130 pAllocateBP proc near
...
:C003B132 mov ecx, 0FFh
:C003B137 mov eax, 0
:C003B13C cmp byte ptr ds: (aTdjf+4)[eax], 0
:C003B143 jz short loc_0_C003B14F
:C003B145 add eax, 183h
:C003B14A loop loc_0_C003B13C
...
:C003B14F lea ebx, aTdjf[eax] ; "TDJF"
:C003B155 call pCheckBPEntry
...

If you double click on the aTdjf entry you'll find the starting address of the Softice breakpoint table, which you can convert to your memory addy and display in SI.
:C003B8D4 aTdjf db 'TDJF',0
Each array in the table begins with the word 'TDJF' (whatever that means), is 183h bytes long, and there are 256 of them, allowing for 256 possible breakpoints. If you display the address 100h*183h from the starting address you'll find the last of the arrays.

Now I went through and set up several breakpoint types and /screendumped them to try to determine the exact format of the structure, and while not exhaustive I can tell you that for SI4.05 it *does not* match the Softice breakpoint structure as outlined by Ralf Brown! (This was outlined in the FGJM interface in his famous Interrupt list). Even the breakpoint mode and type values seem different from what was documented for the old SI versions (was this valid in 2.x?).

I'm realizing it's useless to paste any of the screendumps or make assumptions on the correct BP structure without a lot more work, but I'll up the output I've got so far as an example, along with a few observations, plus the original Ralf Brown definitions. If you compare them closely you can start to see patterns, i.e. which byte defines a R, W or RW type BPM breakpoint etc.

Clandestiny, compare what you get with your AMD and see if it matches my BPRW Notepad T, or check it on your other system. If it looks like the BP structure is being filled correctly, then your problem lies further on. This should help reading the disassembly as well knowing what you're starting with and the significance of a line like 'cmp dword ptr [ebx], 464A4454h'

(btw, bpm rw seems to work better in SI than bpm x, if you can find a good memory addy to use that won't be called elsewhere from where you want to trace and won't cause a crash 'n burn...)

I won't bore these fine people any further, good night ;)

Cheers,
Kayaker
username
10-25-2002, 01:43 PM
Originally posted by Clandestiny
Several of these mentioned the need for loading the kernel32.dll exports in winice.dat. I have done this, but the error remains...

I think it's user32.dll exports as well (check the manual ;-).

Otherwise, this parameter should be zero, and the calling VxD should initialize the device and send the SYS_DYNAMIC_DEVICE_INIT message.

How about tracing the SYS_DYNAMIC_DEVICE_INIT handler code in icedump? That should tell you what and why fails...

...Now would be a good time to extend my complaints even further, I suppose ;) I am also having extreme difficulties with using the bpr function on my AMD system (it works find on the old 300 MhZ). Any attempt to use *any* form of the bpr or bprw locks up my system irrecoverably when I attempt to resume execution of the target.

Too much RAM maybe?
username
10-25-2002, 01:53 PM
Originally posted by Kayaker
Now I went through and set up several breakpoint types and /screendumped them to try to determine the exact format of the structure, and while not exhaustive I can tell you that for SI4.05 it *does not* match the Softice breakpoint structure as outlined by Ralf Brown! (This was outlined in the FGJM interface in his famous Interrupt list). Even the breakpoint mode and type values seem different from what was documented for the old SI versions (was this valid in 2.x?).

I think that old int3 based API would not let you directly specify the contents of an internal structure, so no wonder there's no match.

I'm realizing it's useless to paste any of the screendumps or make assumptions on the correct BP structure without a lot more work, but I'll up the output I've got so far as an example, along with a few observations, plus the original Ralf Brown definitions.
Before you overdo yourself, take a look at icedump.cjb.net... ;-)
Kayaker
10-26-2002, 05:37 AM
Very nice. And only available within the past week as well. I ran the scripts with only minor complaints from IDA, and matched up the definitions with what I had recorded, filling in the gaps. It's interesting to see how the bp structure fields change with the different breakpoint types. This clarifies quite a bit, thanks for the heads up ;-)

Kayaker
Clandestiny
10-27-2002, 04:17 PM
Thanks guys :)

How about tracing the SYS_DYNAMIC_DEVICE_INIT handler code in icedump? That should tell you what and why fails...

I have solved my IceDump problems... I traced the SYS_DYNAMIC_DEVICE_INIT code for the vxd as suggested. The final problem was a bit, umm... embarassing :o I found the problem in the GetAPIInfo function during IceDump initialization which gave me the sneaking suspicion to recheck the exports. I had previously checked that the exports were loaded in winice.dat. What I had not checked was that the path for the exports was correct... My Win98 partition is now on drive E, not C anymore! And I traced a hundred lines of VxD code to find this out :eek: !

Too much RAM maybe?

Well, not unless 256 MB is too much... I pulled out my other 256 MB stick to try the suggesion in desparation though (total is normally 512) ;) I don't have any DDR RAM smaller than 256 so I can't say if 256 is too much. I can hardly believe that it could be too much though! Thanks for the pointer to the IDA scripts. Since I can't trace this part of winice very well, I suppose I will start by examining the breakpoint structures between the working / non-working machines as Kayaker suggested. Any other places you could point me to look for the origin of this type of lockup on range breakpoints. I have no doubt you have a much better grasp of winice internals than this desparate newbie blindly stumbling through the bowels of winice ;)

Kayaker, thanks for the very informative post and other info you sent me :) I'll be getting back to you with some more info soon. Just wanted to extend a public thanks for all of the help :D

Cheers,
Clandestiny
username
10-29-2002, 09:45 AM
Originally posted by Clandestiny
And I traced a hundred lines of VxD code to find this out :eek: !

Hey, isn't that how we all really learn (by making then figuring out our mistakes ;-)?

I can hardly believe that it could be too much though!

I can't give you the reference but i have these faint memories about winice not working (well) if you had 512 MB due to some memory allocation conflict with vcache or some other similar driver.

Thanks for the pointer to the IDA scripts. Since I can't trace this part of winice very well, I suppose I will start by examining the breakpoint structures between the working / non-working machines as Kayaker suggested. Any other places you could point me to look for the origin of this type of lockup on range breakpoints.

I would definitely start reading and following the very nice winice documentation by Spath. Along with a properly prepared IDB it should be almost like reading a book ;-).

I have no doubt you have a much better grasp of winice internals than this desparate newbie blindly stumbling through the bowels of winice ;)

I'm sorry bro but i think i'm not really your guy. You should probably talk to folks like Spath or the icedump people or Sten&Mamaich over at reversing.net.
Kayaker
10-29-2002, 05:50 PM
Originally posted by username
Along with a properly prepared IDB it should be almost like reading a book ;-)

Properly prepared and delicately spiced, a pair of culinary delights:

http://reversing.net/tools/021/index.htm

:D
DakienDX
10-31-2002, 03:45 PM
Hello username !

Since you don't remember the reference any more, here's a little hint (http://www.woodmann.net/forum/showthread.php?threadid=804) for you. :D

I'm just wondering how you're remembering this "faint memories", but keep telling me that you weren't around at this time. I guess this is a bit strange, isn't it? ;)

I haven't seen any posts from "the icedump people" on this board the last months as they don't seem to be posting here any more, right?
JMI
10-31-2002, 04:14 PM
Darn DaikenDX :D :

You beat me to the punch with the reference to the "#804" post.
I certainly recall it rightly enough because I had this exact problem when I upgraded my RAM to 512 mg.

And does it really matter WHO username might be if the information provided continues to be of high quality, even if, at times, it might come with a sharp edge?

Keep this great information coming folks, there's ALWAYS more to learn.

For those of you reading along who may not have already done so, you can find a copy of +Splath's essay on "Softice Internals" here:

http://www.woodmann.net/crackz/Tutorials/Siceints.txt

It's a good one to add to everyone's library.

Regards.
username
11-06-2002, 12:32 PM
Originally posted by DakienDX
Since you don't remember the reference any more, here's a little hint (http://www.woodmann.net/forum/showthread.php?threadid=804) for you. :D

Cool! I should remember to use the search engines more, doh :P.

I'm just wondering how you're remembering this "faint memories", but keep telling me that you weren't around at this time. I guess this is a bit strange, isn't it? ;)

It's easier than trying to guess it: google for 'vcache windows crash' and you'll see (that vcache itself has a problem with large amounts of RAM, not hard to figure that softice won't improve on that ;-).


softice help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice help
PDA

View Full Version : softice help

molimo man
10-25-2002, 01:52 AM
hi ppl im a newbie. i just installed softice onto my pc. its win xp and i cant seem o get softice to run. it says in loader32 that softice is not loaded. is there anyone out there that can help me at all???????

thanks
Kayaker
10-25-2002, 02:14 AM
Hi

One of the great things about this board is that it's been going, under its present guise, for over 2 years, meaning there is a huge repository of information in the database which can be searched. Combined with the tutorials from several years past on many aspects of reversing, this makes it a HUGE repository of information.

One of the first rules/suggestions for newcomers, besides reading the FAQ (#1), is to search the database to see if your question has been answered before, and in many cases it has. Try the Search function in the upper right corner and put in a few keywords, such as (Softice + XP) + install. See if you can find what might be a simple solution to your problem there. If you still can't get it working then come back and explain your problem with *details*, such as what version of Softice you are using and if you have any XP service packs installed.

Also, if you noticed there is a Tools of the Trade forum specifically for these types of questions, so don't be surprised if you find this post soon moved there. Hope this helps.

Kayaker


Unpack tElock 0.99
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpack tElock 0.99
PDA

View Full Version : Unpack tElock 0.99

ken
10-25-2002, 05:50 AM
Are there some tools or way to unpack PE Files packed with tElock 0.99

===========================================
www.occultsoft.com (http://www.occultsoft.com)
Solomon
10-25-2002, 06:09 AM
You will be told to search:D

Have you tried exetools site?

TELock is very easy to unpack.
ken
10-25-2002, 09:25 AM
there are just some old version of tElock.
and i have not found one on exetools.com.
And I have not search one on google.

===========================================
www.occultsoft.com (http://www.occultsoft.com)
ken
10-25-2002, 09:29 AM
PS. and some can not run under 2000/NT


SoftIce Not breaking in XP? Try this.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce Not breaking in XP? Try this.
PDA

View Full Version : SoftIce Not breaking in XP? Try this.

nikolatesla20
10-25-2002, 02:52 PM
Of course anyone who's intimately familiar with SoftIce will probably already know this, but I finally figured it out (it seems).

Even with DriverStudio 2.7, I could not get SI to BPX on anything in XP with SP1. In fact, you would know why, if you go into SI and do a "U messageboxa". It shows you nothing. No code. So it basically doesn't even know where the code is.

If you read thru the SI release notes, it states that you can make SI load the symbols for ntoskrnl.exe. Since binaries of the exe will be different in SP1, I think this "breaks" it. (Even though compuware says 2.7 supports XP with SP1, I can't get it to work, on two different computers with SP1). To make SI load the symbols and work correctly do this:

1. Get the symbols for ntoskrnl.exe from microsoft. I just used the nice handly utility that comes with DriverStudio 2.7, It's called Symbol Retriever. You can open this up, and select the file you want symbols for (ntoskrnl.exe) and click "Get symbols". It will automatically go to m$'s site and download the current symbols for that file and convert them to *.nms format. Nice huh? :)

2. NOw, go to Symbol loader and "Edit -> Softice INitialization Settings".

3. Go to "Symbols", and add the ntoskrnl.nms file that you just downloaded/created with the symbol retriever.

4. Go to "Advanced" and enter "NTSYMBOLS=ON" in the text box and press "Add".

5. Reboot.

After this SoftICE should work correctly and see the correct addresses. I just tried it on XP SP1 which SI wasn't working correct, and it fixed it just fine.

Oh, and Read the SI Manual If you are newb !

-nt20
hobgoblin
10-25-2002, 07:07 PM
Hey.:D
Thanks for the tip. That was the missing link for me to get softice to break at program start when loading a program via the loader.
I did apply Kayakers patch, but it didn't work. I have traced through a lot of Softice code the last few days without finding the solution. The patch did what is was supposed to do and put the value FFFF in the memory at the right place. And I couldn't find any flaws while tracing all the way until I ws back in nmtrans.dll.
But now it works...:) :)

Nice,

hobgoblin
Snatch
10-25-2002, 09:57 PM
Funny, in DS 2.7 I did not need to load symbols to have the imports loaded properly. The bug in DS 2.6 was that imports for the main DLLs or any EXP= in the softice initialization file would not be resolved into memory properly. Noone really ever investigated why and I am surprised Numega did not catch it. Having symbols in addition since they include the imports did seem to solve the problem in many but not all cases. But 2.7 fixed it all for me symbols or no symbols though I must admit that symbol downloader utility is very handy ;). Softice not breaking on winmain is a completely seperate error. That is what Kayakers patch is for. I fear that people are mixing those 2 glitches up. Though I fear people are breaking at winmain too much. Yes it is a useful technique but often completely unnecessary. I rarely if ever require a break upon entry. Of course I am more of a dead code reverser but still even if you are investigating a serial check on load I am sure you can find an API that will lead you right into the code you want to look at not the entry point ie RegQueryValueEx or CreateFile, etc... Yes I realize entry point can be useful but it seems far overrated to me. If you dont have it you can probably find a way to do what you need anyway :).

Snatch
nikolatesla20
10-25-2002, 10:15 PM
Well, yes, this wasnt to solve the WinMain problem. I myself could also care less about WinMain. This was to fix my problem of not being able to set ANY breakpoints at all.

I am a dead code reverser as well by the way. I mean I prefer it that way.

-nt20
Snatch
10-26-2002, 02:57 AM
Well looks like we have some things in common. I would hope most reversers are of this approach though. I feel with live code I am going on a journey where I am looking for specific values and to not understand the code but to see how it changes the registers and memory. With dead code I understand and look at the big picture. Anything I am completely baffled on I can always use live code if necessary to help understand. The freedom one has with a dead listing is at least for me a more relaxed perspective. I guess its the difference between a keygen and a serial but for me I always start with a dead listing and go from there.

Snatch
naides
10-26-2002, 04:15 AM
I was one of the people in which Kayaker Patch worked right away. The Symbol Exports for NTOSKRNL.EXE were loaded into Sice BY DEFAULT, so I did not have to do what Nikola is describing. And Neither would I ever figure it out.

Now, what I am thinking about may be old news, so please don't flame me for saying it:

In the win98 memory model, Each app had a memory space, but the system libraries and API were shared by all applications, so they had a known, defined and easily findable memory address.

In the new memory model, XP each app has a full memory space that it owns, and has it's own copy of the system libraries it uses within its memory space.
While in Win98 a bpx CreateFile referred to a single instance and publicly known address of the CreateFile API, In the new model each program has an instance of CreateFile in its memory space, So a general BPX CreateFile does not make sense unless you further qualify which instance you are referring to. There are several of them, each belonging to the memory space of an app. Am I wrong in my interpretation of the problem of BPX on APIs?
SpeKKeL
11-22-2002, 02:47 PM
Yep,

Just have a new comp. here installed with xp.......... .
At setting up SI i expected problems like setting bpx's etc.
Tried all sugestions but all faild untill i tried to softice's driversuits configuration settings > here you can specify when loading softice.First i tried "boot" (load softice before windows loads)
this didn,t work so i switched to "system" (start softice with windows) and YES this did the trick.
(i do not know if this will correct all problems (cause it seems some people have prob's and others none...) but it's woth checking this.)

Okee,

Happy reversing on xp ! :D

SpeKK.
nikolatesla20
11-23-2002, 08:52 PM
naides:

2K and XP exhibit "copy on write" memory for system files. ALL programs share the same system data (user32.dll, etc) unless one of these files gets modified by an external program, then the O.S. copies the data and swaps out the page from the other programs, to protect them.

This is to allow "protection" from a bad program trying to hook into all other programs with some sort of global API overwrite.

However, SoftICE lies underneath the system and hence it wouldn't fit into this catergory in my opinion. Once the system is loaded, API addresses don't change, even under different processes. (the code could change tho, and if it did, the O.S. would copy it into that specific process and page out the shared code to protect itself.)

-nt20


VxD spy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VxD spy
PDA

View Full Version : VxD spy

raider
10-26-2002, 05:18 PM
The program in question uses a dynamic VxD not only for accessing the hardware in ring 0, _but_ also as a protection scheme.
From what i've seen, when the user is not registered, the fields in the DeviceIoControl are invalid or some flag is passed.
Thus the VxD does nothing.

My question:
Is there any way i could intercept the data going to & coming from the VxD. How? Is there any tool for this?
I've read several essays on VxD, but none exploits this subject.
And tool VxDMonitor only gives me what i already know.
tgodd
10-26-2002, 09:21 PM
You can use creative ways to hook into a VxD.

The routine whichs is hooked in would Log the Incoming packet, and make a call to the original routine, and upon return would then log the outgoing packet.

You'll have to learn to write VxD's.

:p

Regards,

TGODD
tgodd
10-26-2002, 09:33 PM
Psst.

You can hook the Vxd Loader routine and check for the VxD ID.
When the correct Vxd ID is spotted you could then replace values in the Vxd's DDB.

In other words, your VxD would wait for the correct VxD to load, and once it is spotted being loaded, you can then re-vector some or all of the services.

ie. Hook the Vxd's Control, V86Service, and/or PMService.

What data you choose to log will depend on some initial reversing you'll have to do yourself.

Regards,

TGODD


smell the RAT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > smell the RAT
PDA

View Full Version : smell the RAT

+SplAj
10-27-2002, 09:49 AM
The LongTail Rat challenge

Thanks to all you fellow reversers that wanted to unpack
LongFileTail (Hop's challenge) and filled my PM box with requests for a URL.... :(

well this was obviously tooooo kryptic .......

LongFileTail == LogFileTail

The target as discussed in the following recent thread by spiderman :-

_________________________

RV tracer seems not work on...
__________________________

It has latest ASPR protection and nice SEH to point the way to Check#3, Check#4, Check#5 MessageBoxA error debugging afetr unpacking ;)

BTW a good tip is to use 'LogFileTail' in Gooooooooogle search box..... HINT HINT for JMI !

have fun as usual
Hopcode
10-27-2002, 02:10 PM
Heya :)

I figured out that "LongFileTail" never existed and found LogFileTail sometimes after my pm message :-)
I didn't have the time to work on it yet tho. I donwloaded it and its waiting for me ;)
I just started to play with CloneCD 4.

Regards,

Hopcode
JMI
10-27-2002, 06:13 PM
+Spl/\j:

I smelled the rat shortly after I sent my PM, but your PM box was already full for my follow-up. At first I thought you had simply mis-typed "LogFileTrail," as in RegMon output, but soon figured that was not correct and that you were just fuxing with us in your "usual" funny style. At least your "kryptic" entries are somewhat more clear than some of the humor from our musician friend. We need to help him improve his English so he can teach us all the great stuff he has learned about unpaxing and debug registers.

What I wanted to also ask you, or anyone else who might know, is if you have a chance to review my comments on the "Azpr's new check time algo" thread about aspr placing its timelimit registry entry inside some other program's registry file, how M$ permits this to occur. It doesn't seem like very good planning to permit some other program to muck with a programs registry entries, but I have much to learn about the registry and have just started my "Windows NT/2000 Native API Reference." Managed to find it "used" at one of the online booksellers for a substantially reduced price.

I'm still having major problems in my transition using Sice in Win2K, but most of life has a learning curve. Didn't expect this to be different. Still not having much luck getting it to break inside aspr programs and I'm trying to figure out the context switching and address switching concepts adequately.

OK, I'm off to do my goooooogle searchs.

Regards.
sv
10-28-2002, 01:21 PM
Hi +SplAj , Hopcode , JMI , all

Nice one.
In this case, 'old good dead listing' is very usefull to find "Check#" code ;).

Regards

SV

PS: Somebody knows PELock Target (!=Quick Menu Builder) ?
crUsAdEr
10-29-2002, 11:30 AM
Hi guys,

What a long time since i last post anything vaguely related to cracking/reversing... my brain does get rusty...

been back for a while but been tied up with thigns to settle down so did not have tiime to do much... just warm up with some AsProtect inline patching... yeah doesnt seem that hard anymore... esp it seems easier everyday... thought i just pop by and say hello to everyone... think i will share my AsProtect.idb file with everyone since it is just rusting in my hard disk anyway... it might be handy for some people to get to known AsProtect better, like where it calculate the trial time, where it performs CRC etc...

Global, did you sit down with pen n paper to brute the first 4 layers of AsProtect :)? i was too lazy n decided to patch all 4 of them :)... i am waiting for your new AIPH cos i think the old one can be optimised a bit more now that i already get my hand dirty with asm...

cheers,
crUsAdEr
GlObAl
10-29-2002, 06:15 PM
Hello crUsAdEr,
nice to hear something from you :)
new AIPH is ready sice some time and it works much better than the old one because you dont need to brute any layer or so.
in new version you only have to choice the target.exe and press patch :) like armpa ... and yes armpa still work :)

best regards...
foxthree
10-29-2002, 07:27 PM
Yo Crus:

Kinda one handed since you weren't around ;) So howz things. Nice to see ASsPR doesn't surprise you... => means ur brain is still functional and still sharp. Join in, friend :)

Signed,
-- FoxThree


Convert memory to string
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Convert memory to string
PDA

View Full Version : Convert memory to string

haex
10-27-2002, 06:39 PM
Ok this is the case:

ecx=12345678

That is ,it doesn't contain the value 12345678 but it refer to that memory location.

And now I want to push the VALUE "12345678" to the stack. (Not the value that is in the memory location 12345678.)
So that it can be shown in a MessageBox.

How do I do that?:confused:

I'm a newbie so I'm not sure that I made my question clear enough or used the right terms. :o

/haex
ZaiRoN
10-27-2002, 07:19 PM
Hi!
you can use wsprintf function which formats and stores the value (12345678) in a buffer.

int_wsprintf(
LPTSTR_lpOut, // the output buffer
LPCTSTR_lpFmt, // format specification
... // optional arguments
);

for a complete description, make a simple search on google or at msdn ;)
anyway, here is a masm style example:

format db "%X",0 ; format specification: unsigned hexadecimal integer in uppercase
serial db 10 dup(0), 0 ; the output buffer
titolo db "and the value is...",0
...
mov ecx, 12345678h ; the value you want to convert
...
invoke wsprintf,OFFSET serial, OFFSET format, ecx
invoke MessageBox, NULL, offset serial, offset titolo, MB_OK

regards,
ZaiRoN
haex
10-28-2002, 12:17 AM
Ok, thanks for answering. :)

But either I didn't understood your answer or I didn't made myself clear enough.

I'll try again:

I don't want to convert a number to a string.
I want to convert a memory adress to a string.

I'm trying to patch a prog. I have found the good serial and I want to display it in the "Wrong serial"-message.
The problem is that the serial is a memory adress .

The good serail i.e. :12345678
and
ecx=12345678

That is if I, d ecx in sice i don't get the serial, cause the serial is the memory adress.

How do I convert the adress to string so I can push the string "12345678" ?

Ok, hope I made it clearer.
Kayaker
10-28-2002, 01:22 AM
Hi

It's as Zairon said, you use wsprintfA to convert the value of a register, OR the value in a memory address that's contained in the register to a string and display it in the messagebox. You don't need the mov ecx, 12345678h statement, that was just to make the point that that was what was contained in ecx.

The format to display ecx is exactly as described:

invoke wsprintf,OFFSET serial, OFFSET format, ecx

If you want (which you say you don't) the value pointed to by a memory address that may be in ecx, then it would be:

invoke wsprintf,OFFSET serial, OFFSET format, dword ptr [ecx]

There's only one thing you need to be careful of though is that wsprintfA uses the ECX register, so whatever was in it will be gone. If you want to preserve it then transfer it to another register first and use that in the wsprintfA statement.

Get it?

Kayaker
Snatch
10-28-2002, 03:08 AM
push ecx would push the value on the stack even if its pointing to a memory address or if it is a number. Since it is a memory address [ecx] makes sense though. Now wsprintf is the bottom line string formatting function for everything in c/c++ even if your using String classes or whatever so chances are the program you are modifying has the function in it somewhere. You will need to find some space maybe from the alignment or expand the file to get probably about 80 bytes of code to do what you need to do. you will probably want to use a "%X" format string assuming you want the serial in upper case hex or maybe %U if you want unsigned decimal etc you can read the docs on format specifications. Now if this doesnt work because your target is written in another language you can find the equivalent function or you can write your own simple routine though it would certainly take more code. If its decimal though it is very simple find an 11 byte memory buffer to output to and do something like:
mov ecx, 11
mov ebx, memory address to convert to string
mov edi, memory buffer address
mov [edi + ecx], 0
dec ecx
looplocation:
mov eax, ebx
and eax, 9
mov byte ptr [edi + ecx], 30h
add byte ptr [edi + ecx], al
div ebx, 10
dec ecx
jnz looplocation

Of course that is cheap and primitive as it has leading 0 padding but it works(I think I just wrote it out quickly). For hex you would do similar except you would divide by 10h and and with Fh and you would need to check if its greater than 9 to do the alpha characters. Either way its not too difficult to write your own routine to do the conversion :). If that is easier than using routines from within your target that is.

Snatch
haex
10-28-2002, 01:38 PM
Thanks Snatch!:)

I think you have answered my question.(Maybe the other guys did it to but I didn't realise that)
It turned up to be more complicated then first thought, maybe a good patching lesson for me.
And yes the serial is in hex.

But I have some other work to do right now,:mad: so I will try it later.

/haex


Webextractor questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Webextractor questions
PDA

View Full Version : Webextractor questions

kandinsky
10-27-2002, 08:19 PM
Hello guys,

well, I am really new in all the softice & unpacking. I started this weekend with installing softice :)

Well, i suppose all my questions are already in other threads but anyway,

I dont know the OEP for the proggy.
I suppose its 0047C2C8 can somebody verify this please?

I read in a post, that i can find the oep with a search for 03,90,90,90,90,90 bla and i found it that way in WinXP... Under win98 i do the same and it guides me to a totaly wrong address :(

Apart from this, the proggy reads a key from the reg, I unpacked an older version(2.0) and it doesnt read the key anymore.

The license key is read by aspr code, when i unpack it, can i still register it or do i have to calculate with crypted routinces?

When I load the unpacked version 2.0(which is running) into windasm i get an error "unknown pe-format"....

I know all the questions are quite lame, I just started...

Sorry & Greetings

Thanks in advance

Kandinsky

P.S.: Please dont ban me for the lameness... I want to read the response :)
Woodmann
10-27-2002, 09:23 PM
Howdy,

You wont be banned.
All you need to do is show you have made an effort.
Since you are a fresh off the turnip truck newbie, you can ask
your questions, you might want to concentrate on 1 or 2 at a
time though.

Please, try not to reference what target you are working on,
especially with a link. Only give out the name if someone asks.

Peace, Woodmann


Asprotect 1.2X challange
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect 1.2X challange
PDA

View Full Version : Asprotect 1.2X challange

raider
10-27-2002, 08:33 PM
Hey guys,

I've come face to face with this program, from the same company as asprotect: ***.entechtaiwan.com file PStrip, v3.29 build 342

PEiD reports -> asprotect 1.2x.

Loader reports -> 1st unpacker call at 00511184
-> OEP = 00539928

ImportREC -> enter OEP = 00139928
click IAT auto
get imports
-> 329 unresolved
show invalid
trace level 1
-> 156 unresolved
But other tries with ImportREC gave me other unresoved numbers...!! Could it be because I'm using win98se??

So far i couldn't do anything good on unpacking it.
Could you enlighten this newbie on how to successfully unpack this program?

RaiDer
Hopcode
10-28-2002, 05:33 PM
Hello,

I unpacked your target without problems.
Which version of ImprRec are you using ?
I used Auto Trace features, then there were some unresolved entries. I found some of them using the Emul plugin and i replaced some manually.

Some are emulated and need to be replaced manually.
At least, i did so. :-)

Regards,

HopCode
raider
10-28-2002, 07:14 PM
Using ImpRec v1.13 under win98se, could this be the problem?

Do you recall, how much unresolved did you get at first?
And how many to be replaced manually?

Thanks :)
RaiDer
Hopcode
10-28-2002, 10:22 PM
Hello,

im using win98 SE too.
My version of ImpRec is more recent than yours.
You should try Revirgin maybe. i can't share my version of ImpRec.
There were something like 5 api to manually resolve i think.
Don't forget , you also need the plugin :)

Later,

HopCode

Originally posted by raider
Using ImpRec v1.13 under win98se, could this be the problem?

Do you recall, how much unresolved did you get at first?
And how many to be replaced manually?

Thanks :)
RaiDer
raider
10-29-2002, 07:23 PM
I'll give it a try with Revirgin, to see what comes up.

Thanks :)
RaiDer
foxthree
10-29-2002, 07:25 PM
HopCode:

What do you mean by "my version of ImpREC"??? The last time I checked, ImpREC was written by MacKT, so unless HopCode == MackT, sorry, man you're outta luck. First, unless you've reversed ImpREC and add some cool functionality, it is not "YOURS". PERIOD.

And Raider, you *MUST* try Revirgin.

Signed,
-- FoxThree
Hopcode
10-29-2002, 07:57 PM
Hello :)

Just to clarify things.

>What do you mean by "my version of ImpREC"??? The last time I >checked, ImpREC was written by MacKT, so unless HopCode == >MackT, sorry, man you're outta luck. First, unless you've
>reversed ImpREC and add some cool functionality, it is >not "YOURS". PERIOD.

haha :) you are quite funny :-)
i meant that the version i have is not the version available on protools for instance. many guys have it, but i think im not allowed to share it. that's all :)
Calm down my friend, no need to post such things :)
I didn't reverse imprec , just wrote a couple of plugins for it.

Cheers!

HopCode.
raider
10-30-2002, 06:45 PM
Finally managed to get something...
Replaced manually:
0014F160 GetModuleHandleA
0014F69C GetVersion
0014F6C4 GetProcAddress
0014F6D4 GetModuleHandleA
0014F6FC GetCurrentProcessId
0014F700 GetCurrentProcess
0014F704 FreeResource

Still to find:
0014F16C ??
0014F658 ??

I'm i in the right direction...:rolleyes:

Thanks, :)
RaiDer
+SplAj
10-31-2002, 08:06 AM
raider and other ppl....

It is really unbelievable that those lame-ass api calls are still giving soooo much problem. The public tools and plugins are now out-of-date. You will be defeated by your own trust in them. Get back to manual mode or maybe make a private plugin. Thats fun

Now, 'they' have been documented approx a zillion times on this MB already. Evil Eval even got so bored that he posted the list AGAIN only a few weeks ago (ok he forgot VB ThunkMain, but who cares for VB).

Find that list, print-it-out, file it in your 'Crack File' in section ASProtect.

raider, a quick review of your list does NOT include :-

GetCommandLineA
LockResource

Where are they...........;)
TheSearcher
10-31-2002, 08:37 AM
>i meant that the version i have is not the version available on >protools for instance.

Its a private tool now and always.MackT only shares with friends or groups I guess ;)
raider
10-31-2002, 11:42 AM
Thanks +SplAj
Found the Evil Eval post "For newbiez-ASsPROT-unpacker help".

update to my list:
0014F16C GetCommandLineA
but
0014F658 (Seems false...?)

Does all the emulated APIS have to be present? :confused:

Thanks, :)
RaiDer
+SplAj
10-31-2002, 02:17 PM
raider

______________________
0014F658 (Seems false...?)
______________________

false as in teeth .......?
or false as in a RET004 at the end of call == LockResource

______________________________________
Does all the emulated APIS have to be present?
______________________________________

it is best to fill the jigsaw with some api , don't leave a job unfinished ;)
raider
10-31-2002, 06:11 PM
______________________________________
false as in teeth .......?
or false as in a RET004 at the end of call == LockResource
______________________________________

the 2nd one (sorry for my incorrect language)

By the way, 'ollydbg' doesn't find any reference to that address.
Isn't this odd? Could it be that it isn't ever used?

Thanks, :)
RaiDer
raider
11-02-2002, 12:31 AM
well guys there's more into it...:eek:
there are several protections anti-dump.
i think only a guru will be able to put it to work,
and most likely it will be a tutorial.
After all this prog is from the same guys as asprotect. :mad:

RaiDer
neviens
11-02-2002, 12:27 PM
it's not a tutorial worth, because nothing interesting is
here. Standart Asprotect unpacking , check of asprotect
presence in program code @0053F1DD and nagscreen.
I can suggest you bpx ntdll!KiUserExceptionDispatcher
breakpoint with following F10, F10, dd ebx+c , for finding
wrapper presence check code in situations like this.
Still not a guru,
Neviens.
Hopcode
11-02-2002, 01:19 PM
Hi

raider:

I didn't see any anti dump at all.
Everything went fine :)

>it's not a tutorial worth, because nothing interesting is

I agree. Every tutorials around are covering the same aspects of asprotect, and its every damn time the same.b

>here. Standart Asprotect unpacking , check of asprotect
>presence in program code @0053F1DD and nagscreen.

What nagscreen is that?
i unpacked it and didn't look more since it worked just fine.
It maybe has some checks to see whether its registered or not, but i could care less ;)
I just wanted to see if this target had something interesting in it, and it did not, im afraid;

Where are you stuck raider?
Can you tell us what you call by "anti dump"?
Maybe you badly fixed the file and it crashes like hell, but its not a check ;-)

Regards,

HopCode
raider
11-03-2002, 04:35 AM
______________________________________
Where are you stuck raider?
Can you tell us what you call by "anti dump"?
Maybe you badly fixed the file and it crashes like hell,
but its not a check ;-)
______________________________________

Well here's what i've done:
54F160 GetModuleHandleA-----[fixed on Revirgin]
54F16C GetCommandlineA------[fixed on Revirgin]
14F658 LockResourse----------[Patch JMP code with RETN 4 + NOP's]
54F69C GetVersion-------------[fixed on Revirgin]
54F6C4 GetProcAddress--------[fixed on Revirgin]
54F6D4 GetModuleHandleA-----[fixed on Revirgin]
54F6FC GetCurrentProcessId---[Patch JMP code with RETN + NOP's]
54F700 GetCurrentProcess-----[Patch JMP code with RETN + NOP's ]
54F704 FreeResource----------[Patch JMP code with RETN 4 + NOP's]

The result:
The dump crashes randomly before start (but often at 40349C)

Thanks, :)
RaiDer
Manko
11-03-2002, 09:04 AM
I'm just a newbie, and this was my third aspr unpacking...
...but I believe you shouldn't patch it like that...
It won't return anything... So of course it will crash, sooner or later... !?

I usually "save resolved" (in revirgin) to a textfile and then edit in the .dll-names and the name of the calls then "load resolved" and do a resolv again... The names are the only important thing, as someone more experienced ones said here...

There IS ofcourse a check for aspr in this prog.

seg001:0053F1D4 5B pop ebx
seg001:0053F1D5 58 pop eax
seg001:0053F1D6 8B 40 02 mov eax, [eax+2]
seg001:0053F1D9 8B 00 mov eax, [eax]
seg001:0053F1DB FF 30 push dword ptr [eax] -> Here will be pushed a dword from "Exitprocess"
seg001:0053F1DD 8F 00 pop dword ptr [eax] -> Here it will write it back and crash if aspr is not redirecting.
seg001:0053F1DF FF E3 jmp ebx

If you can't see this code, it's because these bytes are "inc"d when not used.

If you didn't see the nag and din't do anything about this code, you've probably been sloppy and not checked if pstrip was ok.
You'll probably find you can't get the rightclickmenu from the traybaricon of pstrip...

But patching the nag, ie tooltips with 4secondcountdown, is not hard...

/Manko
foxthree
11-03-2002, 09:33 AM
Hey guys:

What crash are you talking about? This one is a older version of ASsPR with the standard dump+rebuild+paste sequence. No crash on rebuilt app certainly. Of course Nag is there (5 second countdown of Tip of day) but that can be patched like Manko said ... but definitely no crash!!! And I can indeed get the right click trackpopupmenu.. with Options, App Profiles ... blah, blah...

Raider:

If you're interested, I could ul the IT.bin and the rebuilt binary in some place. PM me...

Signed,
-- FoxThree

PS: Raider, Your rebuilt IT seems to be correct :) and always use RV as public version of ImpREC can't evade some ASsPR redirection tricks :(

Rebuilt binary: 2009420 bytes on Win98 SE
Manko
11-03-2002, 09:44 AM
Strange, maybe is different if not w2k? nah...

It most definitely crashes for me...
Cause of the code I showed, and reason as commented.
It's not because of aspr just the check...
When I patch the code I mentioned it works right.

Would really like to see what we might be doing wrong if anything...

/Manko
evaluator
11-03-2002, 04:37 PM
I had unpkd PSTRIP 3.26 Build 328 on w98se, so can confirm for manko:
yes, there is such redirection_present_checking scheme.
Hopcode
11-03-2002, 05:03 PM
Hi,

I forgot about that nag.
Im in vacations.. so i cannot check.
its the tip of the day nag IIRC..
As Foxtree said (and as i said earlier), there is no crash once unpacked. Just a nag screen to be patched. I can access the menu without problem either.

Regards,

HopCode
foxthree
11-03-2002, 05:07 PM
Hey Eval:

The version I unpacked is latest dled from Entech site. Ver 3.29 Build 342. Win98 SE. No crash on Win98 SE.

But what Manko said is right: The code snippet looks like this:

5B pop ebx (ebx = 50xxxx)
58 pop eax (eax = 4053ac)
8B 40 02 mov eax, [eax+2] (Now, eax = 54F72C)

Now look at rebuilt IT table to see @ 54F72C =>
378 0014F72C BFF8D4F8 00F8 KERNEL32.dll ExitProcess

8B 00 mov eax, [eax] (Addr of ExitProcess API BFF8D4F8)

FF 30 push dword ptr [eax] (First 4 bytes of ExitProcess)
8F 00 pop dword ptr [eax] (Here it writes back to KERNEL32.dll ExitProcess 4 bytes successfully!!!! NO CRASH. CAN U EXPLAIN?)

FF E3 jmp ebx (Normal execution)

To test it I put 4 zeros in the place after push and pop restored the original bytes back. Like I said W98 ;)

Signed,
-- FoxThree
Manko
11-03-2002, 05:11 PM
Is this simply a question of what version we're talking about?
I worked with PowerStrip 3.29 build 432 on w2ksp3.
What about you?

/Manko
Manko
11-03-2002, 05:13 PM
Din't see your post there foxthree. :)

Could it be that w98 allows writing in kernel-space?

/Manko
Hopcode
11-03-2002, 05:17 PM
As i said, im not home.
I worked on the version available for download when raider posted on the board. so i guess its the same version he mentions :)
im using win98 SE.

HopCode

Originally posted by Manko
Is this simply a question of what version we're talking about?
I worked with PowerStrip 3.29 build 432 on w2ksp3.
What about you?

/Manko
foxthree
11-03-2002, 05:38 PM
Manko:

Okey. You were right. Even under Win98 exception occur. The reason why I didn't get it was 'coz of IceDump. For some funny reason, Icedump change page prot. on Kernel32.dll. So, if you load icedump and load pstrip, voila Kernel32!ExitProcess writable. Else only readable so exception.

Hob: Try without Icedump and you'll see what Manko says no right click :(

Evil Eval is right again :D

Signed,
-- FoxThree
raider
11-03-2002, 11:34 PM
Please check your pm Foxthree :)

RaiDer
evaluator
11-04-2002, 10:10 AM
When unpacked PSTRIP, I also found this TERRIBLE mistake in ICEDUMP, but not wrote,
because in world are many BAD boys, who can write BAD programs and damage REVERSERS HDD-MBR,
just checking if system-DLL's are writeble...

Now you can imagine, how all REVERSERS was (or ARE) under risk because of ICEDUMP's-team Mistake.
crUsAdEr
11-04-2002, 11:21 AM
Now now, eval... you are going overboard... The license agreement surely stated that you use it at your own risk... icedump is a great tool on win98... like everyone else says... Dont blame the tool writers or the tools... If you think they are not good, dont use them, code your own!!!

Show the writers some respect, everyone make mistake... no program is bug free...
evaluator
11-04-2002, 11:49 AM
Where I blame?

I jusT WARN!
jsteed
11-04-2002, 01:51 PM
If you want an example of malicious programming check out RegDrill. It is written in p-code. If not patched correctly it will delete your vmm32.vxd. :mad:
raider
11-05-2002, 11:20 AM
Here's another curiosity:

If you run the DUMPED, without the patch suggested by manko, there's no right-click on tray bar icon (ok, we've already cover this).
But, debug this DUMPED on OllyDbg.
:D right-click is operational.

But hei, now there's a new protection:
right-click->display profiles->configure->advanced timing options (dimmed)

Will this baby have an end...:mad:
Well like i've said at the beginning, the fact this prog is released by the same guys as asprotect isn't a coincidence!! :cool:
DariuZ
10-22-2003, 06:15 PM
raider and other ppl....

It is really unbelievable that those lame-ass api calls are still giving soooo much problem. The public tools and plugins are now out-of-date. You will be defeated by your own trust in them. Get back to manual mode or maybe make a private plugin. Thats fun

Now, 'they' have been documented approx a zillion times on this MB already. Evil Eval even got so bored that he posted the list AGAIN only a few weeks ago (ok he forgot VB ThunkMain, but who cares for VB).

Find that list, print-it-out, file it in your 'Crack File' in section ASProtect.

raider, a quick review of your list does NOT include :-

GetCommandLineA
LockResource

Where are they...........;)

This post is old as hell, but just wanted to know where i can get my hands on that list. thx'

//DariuZ
Manko
10-23-2003, 03:49 AM
Hi!

If you read the whole thread instead of replying, you'd sortof have the whole list. :rolleyes: (Maybe one api missing, but with minor amount of intelligent searching you'd find that one too...)

/Manko

This post is old as hell, but just wanted to know where i can get my hands on that list. thx'

//DariuZ


Heh, new armkiller is ready.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Heh, new armkiller is ready.
PDA

View Full Version : Heh, new armkiller is ready.

Unpacker
10-27-2002, 10:49 PM
http://unpacker.narod.ru
Hopcode
10-28-2002, 12:13 AM
Hey! Good work Mate!

I does not work on Armadillo itself though.
It is still a Copy Mem II stripper i suppose, therefore it does not work on the other protections.
Good work anyway!

Regards,

HopCode

Originally posted by Unpacker
http://unpacker.narod.ru
TheSearcher
10-28-2002, 01:06 AM
you seem like to change your nick everytime new versions comming up.Your links have been posted everywhere in the forums!


FlexLM 7.2g
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > FlexLM 7.2g
PDA

View Full Version : FlexLM 7.2g

cillonzo
10-28-2002, 02:54 PM
hi
i am looking for any tutorial for this flexlm, because i am a newbie.
I have looking, but i not have found any dll that referer to 7.2g in my application, the file exe it's very big maybe it's all in one!!!!

sorry for my english
cillonzo
squidge
10-28-2002, 03:54 PM
Maybe this should therefore be in the newbie forum...

Flex can certainly be static linked to your target, but all you need to do is download the sig file and you'll know where they are, and can extract the seeds required.
cillonzo
11-02-2002, 09:34 AM
this application don't have any dinamic link....because the .exe file have all in one....

bye cillonzo
squidge
11-04-2002, 08:28 AM
yes, like I said, it's static linked... Download the dev .lib and compare the code, make the sig files, and then tell IDA to find the functions for ya.


Softice doesn't break !!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice doesn't break !!!
PDA

View Full Version : Softice doesn't break !!!

Dinetti
10-29-2002, 10:11 AM
Hi !

I have installed DS 2.7 on AMD Athlon 800 MHz, 512 MB SD Ram,
A7V Mainboard, WinXP SP1 German Corporate.
On my target i put some breakpoints ala:
example: bmsg hWnd wm_lbuttondown
Sometimes the breakpoint work, sometimes not :confused:,
sometimes only some messages.
With the L option, he does'nt list any messages.
The same computer with Win2k Server.
All breakpoints (bmsg) working fine.
What's wrong ?
Thx Dinetti
squidge
10-29-2002, 01:36 PM
It's an incompatibility. There is a program to protect against this on Protools, but the other way around is to use Win98 instead of XP.

SuperBPM is the name of the prog - "Sometimes your breakpoints can be (BPM, BPIO -h, G, HERE, P, P RET) ignored. With SuperBPM everything is all super, zuprgut"


Question about KERNEL32!LockResource.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question about KERNEL32!LockResource.
PDA

View Full Version : Question about KERNEL32!LockResource.

neviens
10-29-2002, 12:46 PM
Hi all!
After searching in KERNEL32.dll for code replacement API
for one well known protector, found a LockResource,
fitting my needs.
It perfectly replaces the code in protector:

push ebp
mov ebp, esp
mov eax, [xxxxxxxx]
mov eax, [ebp+8]
pop ebp
ret 4

with:

Exported fn(): LockResource - Ord:024Eh
|
mov eax, [esp+04]
ret 4

, _but_ from win32.hlp I found following:
>..The LockResource function locks the specified resource in memory...

Here comes my question - how it is possible with this
simple mov and ret? Is it (locking) really done?
Don't want any resource locks in my unpacked app. :),
Neviens.
_Servil_
10-29-2002, 06:30 PM
why don't you look to kernel32.dll?
this func really does just holy nothing
Nigma
10-29-2002, 08:28 PM
Hi ,

well , when u F I R S T meet those instructions , how can u relize
that it is the lockresource API ?

I found azpr's API emu routine , but I could not find anything
about those instructions and their connection to the
LockResource API in azpr's code !
Snatch
10-29-2002, 09:44 PM
People have discovered this over time. LockResource effectively does nothing simply returns the pointer you pass to it. It is there for compatibility and because in the future if they decide to make the resource handles actual handles and not memory addresses that act as handles also then the behavior could change and there goes ASPR. In fact ASPR is doing something very bold there in assuming Windows will not change and it is likely. If you look FreeResource I believe does nothing either simply zeroes the pointer. It is actaully an obsolete function though LockResource is still listed as current meaning it still could change and then all ASPR applications would cease to work in fact I would find it hilarious if maybe WinXP SP2 did this. I would have to laugh ;). Think about what some of these API functions are meant to do. In a lot of cases it is a lot simpler or merely to reserve future enhancements etc in advance or for backwards compatibility. I believe only 4 functions are actually moved straight into the EXE because they are globally the same on all versions of Windows in Kernel32.

Snatch
+SplAj
10-31-2002, 08:23 AM
For ASPR and redirection trick what you said is true.

I found a lame-ass Commercial (dis)Protector that claims to use
the Resource API's :-

ProActivate
========

License Link is a feature which allows the protected application to obtain information at run-time regarding the protection status and machine ID as determined by the security envelope, along with some user-specified information that is included in the license file. This information is stored by the security envelope at run-time as RCDATA (#10) resources within the executable that can be accessed via the Win32 API sequence, FindResource(), LoadResource(), and LockResource().

License Link information consists of the following:

Status Code

Protection failure status indicating which (if any) protection tests have failed.

Resource Identifier: PALICENSELINKSTATUSCODE
Data structure: 4 bytes (unsigned long)

Bit definitions:

0x00000000 - Status OK
0x00000001 - InvalidOwner
0x00000002 - InvalidOrganization
0x00000004 - InvalidMachineID
0x00000008 - BeforeStartDate
0x00000010 - AfterEndDate
0x00000020 - UsageLimitReached
0x00000040 - DaysLimitReached

Nice of them to explain :)


Problems with Armadillo-ed application
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Problems with Armadillo-ed application
PDA

View Full Version : Problems with Armadillo-ed application

darklomba
10-29-2002, 01:04 PM
The application is called Octo Site Compiler, and it uses Armadillo 2.20, as PE-Finder told me.

I tried to use Every Armadillo-against application, but none seems to be working.

In my case the evaluation perios has expired, but, Armadillo Killer 2.6 version says it supports expired versions

Any idea??

Thanks.
foxthree
10-29-2002, 07:34 PM
Yo!

I've unpaxed a couple of latest ARMA versions, but not expired ones. However, older ARMAs' keep something in the registry flagging expiry. Remove that and you're all set. I can't confirm this though. I'm not in the other 'puter right now... Give it a shot!

Signed,
-- FoxThree
Unpacker
10-29-2002, 08:13 PM
Originally posted by darklomba
The application is called Octo Site Compiler, and it uses Armadillo 2.20, as PE-Finder told me.

I tried to use Every Armadillo-against application, but none seems to be working.

In my case the evaluation perios has expired, but, Armadillo Killer 2.6 version says it supports expired versions

Any idea??

Thanks.

If you need unpacked EXE - send me a private message with your
e-mail address. The size of zip archive will be 372 KB.
Hopcode
10-29-2002, 10:14 PM
Hey armkiller,

I cannot manage to unpack Armadillo.exe :(
could you help ? did you work on those int 3?
Copy Mem is not a big problem. ints 3 are.

Thx!

HopCode

Originally posted by Unpacker
If you need unpacked EXE - send me a private message with your
e-mail address. The size of zip archive will be 372 KB.
Unpacker
10-29-2002, 10:37 PM
Originally posted by Hopcode
Hey armkiller,

I cannot manage to unpack Armadillo.exe :(
could you help ? did you work on those int 3?
Copy Mem is not a big problem. ints 3 are.

Thx!

HopCode

I know the solution ang going to add it to ArmKiller but a bit later.
At the moment I know only two apps that use this trick (NetScanTools and Armadillo itself), so it's not a problem for now.
Hint: Try to find the place of int3 handling and check how armadillo calculates the new EIP after int 3 exception :)
Hopcode
10-29-2002, 10:53 PM
hey!

nice mate!
Did you manage to unpack both files ?
or is just theory for now ?
im interrested by those findings! i understand how it places the int 3 and stuffs. its not random at all. :)

Thx again.
if you could mail me armadillo.exe unpacked, i could see how you rebuilded it! or is it just plain theory?

Enjoy!

HopCode

Originally posted by Unpacker
I know the solution ang going to add it to ArmKiller but a bit later.
At the moment I know only two apps that use this trick (NetScanTools and Armadillo itself), so it's not a problem for now.
Hint: Try to find the place of int3 handling and check how armadillo calculates the new EIP after int 3 exception :)
darklomba
10-30-2002, 02:03 PM
It was not my intention to make it the "simplest way". I was just lookingo for something I found on another pages.

A tip, like "you should notice it creates a temporary file, look for it".

I didn't came here for quick solutions, I just wanted to post some questions and to see if someone had the same problem unpacking an application with armadillo.

It was not my intention to create this kid of posts here, and I want to tell you that I'm really gratefull to be a member here.

So guys, if my post was an error, sorry, that's all I can tell you. It in your hands now to understand that.

Bye and Luck. :cool:

I hope to find you here in the future, when I have some answers.

Again. Sorry.
Js
10-30-2002, 10:38 PM
End of discussion.

(content deleted by woodmann)


help with Redirected API calls in Armadillo 2.53x
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help with Redirected API calls in Armadillo 2.53x
PDA

View Full Version : help with Redirected API calls in Armadillo 2.53x

Peek
10-29-2002, 02:43 PM
Hi

I have big problem with IAT reconstruction
I have programm protected with Armadillo 2.53x, it's Delphi compiled.
dump can be done, I got OEP but problem is that Revirgin or ImpRec can find IAT
I check for any API call which do sw in memory ( for example Kernel32!GetModuleHandleA )
and I see

all I trace in TRW2000

First API call

PUSH EAX
PUSH BYTE +00
CALL 0040619C - API CALL (I not see Kernel32!GetModuleHandleA String)

At 0040619C is:

JMP NEAR [0046C20C] - All looks ok yet at 0046C20C is 84296418

At 84296418 (normally must be BFF77716) is:

PUSH BFF77716 - Store to Stack Kernel32!GetModuleHandleA address
JMP BFF957CA
........
........
........
at BFF957CA is:

PUSHF
CLD
PUSH EAX
PUSH EBX
PUSH EDX
MOV EDX,[FS:20]
..... etc

many some code with compare and jumps etc
at end is:

POP EDX
POP EBX
POP EAX
POPF
RET - now address BFF77716 is pickup from stack and there is main Kernel32!GetModuleHandleA JUMP

so , it's Redirection but problem is that for other API calls is other TRICK code not the same
so is any FAST way to Rebuild IAT ???
also in DUMPED programm RVA is bad

is any fast solution or only manually reconstruction ????

thx for answer
crUsAdEr
10-29-2002, 05:09 PM
Hi there,

havent seen armadillo for a while but may i ask what prog r u trying to unpack?

crUsAdEr
_Servil_
10-29-2002, 06:15 PM
hi peek,

have meet similar problemz on arm260 recently (rebuilding on win98 with imprec there were tooo much imps unresolved i inspected those calls in disassembly and wrote lame plugin for imprec (maybe the attachment is present yet in my thread, try to search) - if you doing on win98 you can give it a try, maybe it worx (written for 2.60). If it wouldn't help try to simply inspect those calls in .dbgr or rebuild on NT kernel where the obfuscation doesn't seem to occur (IMO).
Peek
10-29-2002, 06:44 PM
Hi all
thanks for response
about SW which I try to fix then Sorry but I can't tell,sorry
Also when in IMPREC I put good OEP and try IAT AutoSearch then IMPREC can find anything. When I put manually RVA (which I found) and push GET IMPORTS (IMPREC) or IAT RESOLVER.
_Servil_ I found UR plugin and will try . maybe will help :))
I'm not 100% sure if it's Armadillo 2.53x , PE-SCAN show me that.
will let U know.
thx !

Ciao
Peek
10-29-2002, 06:46 PM
sorry I forgot to finish one line: :)

Also when in IMPREC I put good OEP and try IAT AutoSearch then IMPREC can find anything. When I put manually RVA (which I found) and push GET IMPORTS (IMPREC) or IAT RESOLVER then I see many imports unresolved except 3 ...

:)
Peek
10-29-2002, 06:59 PM
Sorry _Servil_ UR plugin not working for me with my sw
it just take some time and not find anything
hmm so I see only 2 methods, make own plugin (not know yet how) :) , seond way fix all in memory by debugger and after use Imprec or Revirgin

thx for all

Peek...
foxthree
10-29-2002, 07:31 PM
Go for the second one, it is far easier ... unless you want to give SpeKKel a run for his money :D (Hi SpeK)

Signed,
-- FoxThree
Peek
10-29-2002, 07:46 PM
yep :)
but it's look like approx. 100 imports :)))

thx
Unpacker
10-29-2002, 10:01 PM
Originally posted by Peek
Hi

I have big problem with IAT reconstruction
I have programm protected with Armadillo 2.53x, it's Delphi compiled.
dump can be done, I got OEP but problem is that Revirgin or ImpRec can find IAT

Run your app thru ArmKiller - it decrypts a dump and fixes all redirected API :)

hxxp://unpacker.narod.ru
Peek
10-30-2002, 06:30 AM
Unpacker , no it not working. it can dump it but API's are from ARM_SERVER
for other sw protected with 2.53x working but not for this one...
I spend some time and fix all redirection to correct API calls. (included file) but programm still not work, it's look like some API's are declared few times and maybe programm make call to wrong API?

b.r
Unpacker
10-30-2002, 07:10 AM
Originally posted by Peek
Unpacker , no it not working. it can dump it but API's are from ARM_SERVER
for other sw protected with 2.53x working but not for this one...
I spend some time and fix all redirection to correct API calls. (included file) but programm still not work, it's look like some API's are declared few times and maybe programm make call to wrong API?

b.r

Send me the link - I'll check this baby :)
Solomon
10-30-2002, 08:34 AM
I tried your killer v2.61 with NetScanTools v4.30a, unfortunately nothing happenned.:confused:

Originally posted by Unpacker
Run your app thru ArmKiller - it decrypts a dump and fixes all redirected API :)

hxxp://unpacker.narod.ru
crUsAdEr
10-30-2002, 12:36 PM
+++++++++++++++++++++++++++++++
hmm so I see only 2 methods, make own plugin (not know yet how) , seond way fix all in memory by debugger and after use Imprec or Revirgin
+++++++++++++++++++++++++++++++

I suggest the thhird way which is my usual way of rebuilding API, find in memory where API is redirected, patch the loader not to redirect API, usually it is simple NOP :D

a good start is bpx GetProcAddress

cheers,
Unpacker
10-30-2002, 06:05 PM
Originally posted by Solomon
I tried your killer v2.61 with NetScanTools v4.30a, unfortunately nothing happenned.:confused:

What did you wait ? A clear EXE without int 3 crap? :) Or just a dump without CopyMem? I sent you my ideas about int 3 fragments thru PM, but your box was full :(
Solomon
10-31-2002, 01:43 AM
hehe, I just want to compare it with my munual dump. I noticed that "private box full" message and empty the box. anyway, thx
Recently this forum is full of Armadillo posts:D

Originally posted by Unpacker
What did you wait ? A clear EXE without int 3 crap? :) Or just a dump without CopyMem? I sent you my ideas about int 3 fragments thru PM, but your box was full :(
_Servil_
10-31-2002, 04:26 AM
hi,

had a quick look to the 'unpaxed' dump and confirm it contains _alots_ of int 3's, also found (i think about ;) ) the place in the server handling these, as described, and, maybe it wouldn't be much problem to fix several instances, but ints are injected too often (they seem all be around dialog boxes (to fool user it's not decrypted ?)

dunno for now, maybe it would be enuf remove those interrupts from program? (nonsense ;) ?)
manually replacing every inerrupt seems be a hard nut.
crUsAdEr
10-31-2002, 08:25 AM
Hi folks,

As you all know, int3 are inserted and exception occurs, then the loader of arma will adjust eip according to an encrypted table of movement, i have patched the loader to make it write on the debugee "EBxx" or E9xxxxxxxx whenever int3 is encountered depends on the how far we the eip is adjusted... it works fairly well in patching those int3... except of course u have to play with the program to make sure it execute as much of its code as possible so we can patch al the int3...

However, my debugee still has some unhandled exception and crash at some points... will work on it further.. just thought you guys can try the same way.. i know i am not a good coder so someone else might be able to patch the loader more effectively...

cheers,
crUsAdEr

P.S : bah.. just saw Solomon Net Scan thread... guess we have the same idea... so have you succeeded yet :)?
Peek
11-01-2002, 11:41 AM
hi Guys

I want to tell that i'm get imports on windows XP like told somone here. I use ImpRec coz , Revirgin can't find it says something about "rows" . I put good EOP and RVA and voila !
Now can somone to tell me, why on Win98 any sw can't find but on XP it find without any problems.
When I check that redirections in memory then any plugin can't resolve it coz many redirections use other "fake" code to hide good call to api, also fake code include any compares and jumps. So plugin must be very "smart"

b.r

Peek
nofurs
11-01-2002, 11:51 AM
Hi,
coz latest Revirgin only supports and works well in Win2k and Xp.
crUsAdEr
11-01-2002, 06:16 PM
Hi folks,

Yeah, guys, i am back with mroe updates, esp for "unpacker" or "armkiller :D ... hopefully you can code your armadillo soon...

AS we all know, int3 is the newest trick that armadillo comes up with... and our dump wont run cos there are too many int3 lying around.. what they are? Simply "jump"s that armadilloo replaces...

This is a real good idea, basically armadillo created for Tables of jumps at the packing time...

Table 1 looks like this
69 21 40 00 14 2F 40 00 88 31 40 00 80 36 40 00
6C 3B 40 00 5D 42 40 00 B3 42 40 00 32 44 40 00
which are addresses of int3, or where the jumps are.

Table 2 looks like this
0F 0B 00 0B 00 0F 00 00 0F 03 00 07 0B 00
For each dwords in table 1, there is a corresponding byte in table 2 that will say what kind of jumps that is! The code below is a snippet example of how the debugger determines what jumps and what to eip to take next
0044F1D6 case_F: ; CODE XREF: JMP_classify+2Cj
0044F1D6 ; DATA XREF: 0000:0044F23Co
0044F1D6 mov eax, [ebp+context]
0044F1D9 mov eax, [eax+0C0h]
0044F1DF and eax, 40h
0044F1E2 neg eax
0044F1E4 sbb eax, eax
0044F1E6 inc eax ; al = 0 if Z flag set
0044F1E7 jmp short loc_44F1FC ; JNZ
0044F1E9 ; -------------------------------------------------------------------
0044F1E9
0044F1E9 case_10: ; CODE XREF: JMP_classify+2Cj
0044F1E9 ; DATA XREF: 0000:0044F240o
0044F1E9 mov ecx, [ebp+context]
0044F1EC xor eax, eax
0044F1EE cmp dword ptr [ecx+0ACh], 0 ; check ecx = 0
0044F1F5 setz al ; al = 1 if ecx = 0
0044F1F8 jmp short loc_44F1FC ; JCXZ

Yep, that is what it is... finally the last two tables store the distance eip should move, table 4 is if the jump is taken and table 3 if jump is not taken

table 3
04 04 05 05 01 05 01 01 05 05 01 04 04 05 01 04
As we can see, there are only 3 possible values for table 3, which can also tell us how long the jump instruction is..
01 = short jmp EBxx, 74xx, etc
04 = long jump E9xxxxxxxx
05 = I dont know how to call these jumps :>... 0F 84 xxxxxx etc...
Take note, the value is 1 byte smaller the instruction length cos "CC" already take up 1 byte

Table 4
70 AC BF FF 11 A7 BF FF EA A0 BF FF FC A1 BF FF
04 00 00 00 4F 05 00 00 0D 00 00 00 04 00 00 00

Voila, so now the final task to do is to code a simple program that runs through the 4 tables and updated our dump to make it work perfectly... armadillo time is almost up again :>

That is all for now, I sux at coding so i am hoping some of us will do the coding and share his little utility :)... though i will prolly do one myself soon...

Cheers
crUsAdEr

PS. Peek, do a bpm on IAT, then bpx getProcAddress then F12 to see how IAT is redirected... repeat the procedure on both win 98 and 2k/XP to see how most IAt are not redirected on 2k/XP.. or even better if you can, dump the armadilo.dll in your protected program to see how IAt is redirected.
Peek
11-01-2002, 06:28 PM
to cluesurf : I try latest one version 1.5 for XP and also can't find anything...

b.r

Peek
Solomon
11-02-2002, 10:37 AM
Nice work, buddy:D

Originally posted by crUsAdEr

Voila, so now the final task to do is to code a simple program that runs through the 4 tables and updated our dump to make it work perfectly... armadillo time is almost up again :>

[/B]
nofurs
11-02-2002, 03:20 PM
Hiya,
First you quote:

>Also when in IMPREC I put good OEP and try IAT AutoSearch >then IMPREC can find anything. When I put manually RVA (which >I found) and push GET IMPORTS (IMPREC) or IAT RESOLVER.

later you quote:
[QUOTE]Originally posted by Peek
[B]to cluesurf : I try latest one version 1.5 for XP and also can't find anything...

Then do it manually.
Btw don't blame the tools they are the best
evaluator
11-02-2002, 07:25 PM
So 2 ways we have:
1. understand kind of each jump & rebuild... :(
2. rip arma-emulator & insert in dump.exe :)
freelancer
11-02-2002, 08:47 PM
Hello.
Originally posted by evaluator
So 2 ways we have:
1. understand kind of each jump & rebuild... :(
2. rip arma-emulator & insert in dump.exe :)
Both already done. A week ago :) There are unpacked armadillo at exetools, btw...
evaluator
11-03-2002, 07:12 AM
Congratz!

IMHO I not trash time on this & not recommend to other,
UNtil this method will proven on more targets & become standart.

In fact "code mangling" on already compiled target requires "dis-assempling" engine without mistakes!
I not think, arma-authors done such "dis-assembler"...


tracex on NT...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > tracex on NT...
PDA

View Full Version : tracex on NT...

backeyes
10-29-2002, 11:04 PM
hi all

I did a search for that in the board but can't find it (but tell me if i'm wrong) ;)

In fact as icedump has less functions on win NT than the one we can use with win 98, there's no /tracex anymore :(
So i wonder if you guys have a way to "tracex" on win NT or something that sounds like tracex because i can't find it in new icedump with NT and it's a very useful tool ;)

thanx in advance :)
regards
backeyes
nikolatesla20
10-30-2002, 12:03 AM
For tracing on Win2K / XP you can use Revirgin. This is better ! Because you can still use other windoze proggies while its running or once it's stopped tracing.

In Revirgin click the big "Tracer" button and load the program you want to trace, set the address limits, and press "Until back". It will trace until EIP is in the range you indicated.

Revirgin tracer is like 80% faster than /tracex. (maybe an exaggeration, but its FAST!)

-nt20


dump problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > dump problem
PDA

View Full Version : dump problem

salsa
10-29-2002, 11:41 PM
dump problem on Win98

It is the latest aspr antidump trick, I think. -tracex [sect.1] [sect.2] does not work because sice stops at almost every line in between the section boundaries. I search for 61, FF, E0 and sice returns an address then I set BPR [address] [address]+1 R IF (EIP==[address]) and F5. Prog starts with or without SuperBPM.

Tried aspr loader, it gave me an OEP, I dumped and fixed. Everything seemed OK ( A VB prog, so no problem auto tracing and all MSVBVM60.dll imports are there). However, this time at entry point ThunRTMain calls an address from where it jumps to a pointer and then the prog silently terminates thru ExitProcess as I traced with sice. So, this is clearly a special OEiP for the dumped version of the prog. Only solution I got so far is to have it inline patched by a ready made tool. However, this is not actually what I want.

Question: how to safely arrive at POPAD before starting the prog? -tracex and BPR at the signature bytes used to work in the past, but not this time.

Thanks.
JMI
10-30-2002, 01:04 AM
salsa:

Have you read +Spl/\j's "aspr 'randomizer II' f*xed" thread? You probably have a version of aspr that uses "GetSystemTime" to "rebase" the OEP EACH TIME the program is restarted. Therefore, if you "find the OEP with 61 ff e0, BPR [address] [address]+1 R IF (EIP==[address]) and F5" and then RESTART the program, OEP will now be at a DIFFERENT ADDRESS. If you dump from the addres of OEP from the previous start, it will NOT be correct for a second landing at that address or on following starts, except by chance.

Food for thought.

Regards.
username
10-30-2002, 07:22 PM
Originally posted by salsa
It is the latest aspr antidump trick, I think. -tracex [sect.1] [sect.2] does not work because sice stops at almost every line in between the section boundaries.How about changing the tracer code to peek at the would be pop up address and continue tracing if it's some specific instruction like 'ret' (or whatever aspr uses)?
SpeKKeL
10-30-2002, 09:25 PM
And what about giving eax (after getsystemtime) all the time

the same value (like 000000) ????????

Your oep will then be always the same...........................

Sstttt, (don't tell anybody) :p

SpeKK.
salsa
10-30-2002, 09:53 PM
Thank you all !

GOT IT.

Phew... What a daemon...
Solomon
10-31-2002, 01:51 AM
There may be no POPAD any more in new ASPR.
Check this target "Absolute Time Corrector".

ASPR has moved the first few instructions of original program to its own address space.:D
nikolatesla20
10-31-2002, 04:30 AM
Since this is VB, it is VERY simple to find OEP.

For NORMAL packed VB apps:
Simply dump the RUNNING program, and then mod the sections so WinDasm will open it. There will be a string reference to "VB5!". The OEP is right at this string reference. VB pushes this string and then calls ThunRTMain, and then it's running.

For "Advanced **Protect" apps:
If you know the address of "VB5!" string you could just put a BPM R on it and this may land you on the PUSH "VB5!" right at the OEP of a VB program, even if ASP* recreated it in its own space. You'll need the code anyway right?

-nt20


looking for a VB3 compiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > looking for a VB3 compiler
PDA

View Full Version : looking for a VB3 compiler

0ffs3t
10-30-2002, 02:46 PM
Could someone suggest where to get a VB3 compiler plz?
Tnx
oldmantn1@gmx.co.uk
nofurs
10-30-2002, 02:47 PM
what is vb3 compiler?
0ffs3t
10-30-2002, 03:04 PM
a compiler for Visual basic 3 source
nofurs
10-30-2002, 03:13 PM
ketchup or chilli?
Kayaker
10-30-2002, 03:38 PM
You put chilli on your fries cluesurf? ;)

Just so we have it straight, that's a compiler not a decompiler right? Dodi would be for the latter, for the former I did a plain google for 'free vb compiler' and found

http://www.freebyte.com/programming/compilers/envelop.html

I can't make out if it supports VB3 but it was written in '96 so may have been the only version around at the time. You can try it anyway, total size is 7.4Mb.

Kayaker
nofurs
10-30-2002, 03:45 PM
Nope I put both :D
I thought requesting tools are not allowed ;)
Oh somehow I need a tool called search engines can you give me ;P

cluesurf
0ffs3t
10-30-2002, 04:23 PM
Tnx kayaker!!!
it's exactly what I'was looking for....

I'm looking for a VB3 opcode list too, (I already searched it with google...) maybe you know if it exist or not?

sorry for my bad English.

Cluesurf:
It seems you never needed help from other peoples during your life.... or maybe you got it and forgot what it means... ;)

Thanks again kayaker!
nofurs
10-30-2002, 04:43 PM
>>Cluesurf:
>>It seems you never needed help from other peoples during >>your life.... or maybe you got it and forgot what it means...

Hmm I need help.I forgot to how to use the search engine ;)
Please teach me will ya? ;)

PS:Tools are not allowed to request here.Kayaker is kind enough
to point you to the right direction.You should read the main page of RCE.I always like to help if I'm able to but plase read it before posting anything ;)

Side Note :
And some guys told me you can crack something with a notepad.
Without using softice,w32dasm,hexeditor or I** LOL
r4g3
10-30-2002, 07:08 PM
my mama sayd: vb(any version) is SHIT, need some scripting language - use java, or i`ll hit you with a 5kg brick.
so i installed m$vs7 .net & now have some pervert conversation with it`s nice gui every time i code.
this is my aim of life (the conversations) .... well more or less. + sometimes i drink (milk), 'fix' some code,
C2H5OH.
Snatch
10-30-2002, 09:55 PM
An opcode list is available in the runtime library. Trust me it is. Not saying digging is easy especially with 16-bit code. But hey IDA can work wonders for you and a full decompiler would be writable with some understanding. And the format and structure is much easier than the later versions.

Snatch
0ffs3t
10-31-2002, 11:31 AM
Cluesurf:
I readed the red advise ".. Don't ask where can find tools....) on the "Tools of the trade" header forum, I figured out it was different for the newbies forum....
I ask sorry to all.... anyway I asked for it just because it's a very old compiler.
Thanks for you reply and don't worry with me :)

Thanks Snatch, I go to search for. ;)


ddk *grr*
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > ddk *grr*
PDA

View Full Version : ddk *grr*

nikolatesla20
10-30-2002, 09:18 PM
Well, thought I would try and learn something new today, so I figured, hey why not try to write a KMD that patches the IDT against INT 1 detection for SI?

So I am just using DriverWorks which came with DS 2.7. I told it to build a Generic NT4.0 driver. Anyway, after about 4 or 5 BSOD's (oops :p ) I got it working. Had to use inline assembler to get it just right - been a while since I did bitwise ops in C.

The driver works cool, it's a *.sys driver that upon load, patches the IDT, and on unload, undos the patch. You can load it with "net start <name>".

BUT. I hosed something up in my Build Environment now, and I can't actually build the driver from MSVC anymore, it's looking for something and it cant find it. Earlier it kept complaining that the environment variable "BASEDIR" wasnt set, and to choose it. SO I did, and everything worked fine. However, if I closed VC++ (to get ready for another BSOD lol) it would forget and I'd have to enter it again.

SO I decided to add the environment variable properly and went into My Computer -> Advanced, etc,. But I didnt notice I had accidentally clicked on "Edit" instead of "Add" and I overwrote another variable, and I don't remember what it was anymore. :(

And now the VC project doesn't see that some support libs have already been built, and it won't launch vcspawn.exe anymore...*ugh*

So now my VC++ driver builds are busted. I can still build from the command line with nmake tho. But that sux.

Hey but the driver worked ! Cool !

-nt20
Manko
10-30-2002, 11:12 PM
Softice init-string:

code on;fault off;lines 80;wd 20;wc 40;e 8003640d 8e ;X

...is what I use...

But nonetheless, I think it's supercool you're doing this for the masses! :D

/Manko


How can a COMPLET newbie start??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How can a COMPLET newbie start??
PDA

View Full Version : How can a COMPLET newbie start??

xenz
10-31-2002, 11:50 AM
:confused: :confused: :confused:

I searched thes bord but i didnt found a threat wich can help me out auf my confusen. I men can someone explane me how to start.

in fakt:

^^^^I need to understand how softice workes: maby Tut's?
^^^^I need to understand how w32dasem works: maby tut's?
^^^^I need to understand how hiew works: maby tut's?

but with hiew and w32dasm I started and I learned a bit about them.

can someone of you out thear help me get along?
:rolleyes:
TheSearcher
10-31-2002, 12:01 PM
Hiya,

^^^^I need to understand how softice workes: maby Tut's?
Do you mean how to use softice? check out krobars.cjb.net

^^^^I need to understand how w32dasem works: maby tut's?
same as above ;)

Regards
FoolFox
10-31-2002, 02:38 PM
Hello,

h**p://tsehp.cjb.net (h**p://go.to/tsehp) may be also a good
place for more general information on the subject...

Regards
FoolFox
Nigma
10-31-2002, 08:50 PM
Look at krobar's collection and all your questions will be
answerd !

**** unless you are a lazy one ****
JMI
11-01-2002, 03:15 AM
xenz:

A very good place for the complete newbie is at "#Cracking4Newbies " which you will find at
http://c4nfaq.cjb.net/ . It provides a good overview of some things you need to start learning and definitions of terns you will come across. It is also available is several languages.

Also look at the bottom of this page. There you will find links to some of the site already mentioned and places to acquire some of the earlier versions of tools you might need. One of the most important things you will eventually need to learn is how to SEARCH. Once you master this skill, you will be able to find most of the tools and information you need to advance your skill level.

Also pay attention to the "Search" button at the top of the Forums. It can lead you to a great deal of information on most of the subjects you would be interested in. Patience is one of the other things you will need as you start out. There is a great deal to learn BEFORE you jump into the most difficult projects. Start with something easy and take the time to learn about the basics of the craft.

Also you might want to check out a thread in the Unpacking forum from 12-2001, started by matthew with the title "A good starting point." Go to the search page, put "a good starting point" on the left side and "JMI" on the right side under username. For some reason "Matthew" doesn't work, maybe because he is no longer a member. There you will find some good leads to information that will help you get started.

Good luck.

Regards.
MTB
11-02-2002, 02:24 AM
I strongly recommend FRAVIA's (see the bottom home page of this site) old site and his beginning cracking tutorials, followed by a liberal dose of crackz's site (ditto). It will be a long strange trip for you!

The road you want to take is long grasshopper, patience is required to learn.

May the force be with you.
MTB


CoDe_InSiDe's tutorial about Pex
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CoDe_InSiDe's tutorial about Pex
PDA

View Full Version : CoDe_InSiDe's tutorial about Pex

th_snake
10-31-2002, 05:51 PM
Hi
I'm looking for a tutorial written by CoDe_InSiDe for unpacking Pex.

I found a link to a place it should be, but it's a broken link:
lunarpages.com/codeinside

If someone have it, i'll be happy if it can be sent to me:
th_snake@hotmail.com

My target is KazaaLite V2.0

The only reason is that i NEED to replace the system tray icon, so i can keep downloading files during work hours... (Yeh, same problem as a few month ago).

If someone with more experiance in unpacking want to take the chalange together with me, That's even better, i'm too bad in re-building what ever needed, dumping and so, and this should be my last chance to learn it. For me, It's now or never !
I've read Krobar's tut about what's going on with the Api's, i'm lost in the woods..

Best regards
the snake
Kayaker
10-31-2002, 05:59 PM
Hi snake,

CoDe_InSiDe's page is now hosted by AntiCrack.de, you can link from the main page or

http://mup.anticrack.de/

His Pex tut is somewhere in there.

Cheers,
Kayaker
th_snake
10-31-2002, 08:20 PM
Hi Kayaker

Thanks for the reply.

I'm sorry about the "... read Krobar's tut..", it was written by you and i appologize for that !!!

Regards
the snake


Greetings from amateur reverser
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Greetings from amateur reverser
PDA

View Full Version : Greetings from amateur reverser

Reparion
10-31-2002, 09:54 PM
Hi. This is my first time when I post here, and I hope that I am welcome :)

Let me introduce myself.
I started reversing programs about 1 year ago when I was fascinated in learning assembly language. And so it went, I gained more and more knowledge while I studied 'ancient' dos applications. Then I moved to the world of windows. The beginning was really hard and I kept somehow going, but too often I was in a lack of knowledge.

And finally, I found this forum..

Well.. Just to introduce myself here ;)
bye
Woodmann
10-31-2002, 10:01 PM
Hi,

What took you so long to find this place ?

Peace, Woodmann
Snatch
11-01-2002, 03:53 AM
Hahah Woodmann I think he forgot to go to Fravia's searchlores page first. Seriously I think that page is more useful than anything else. Because once you have learned to search(and think) you can find any information on anything. And noone needs to feed or teach you the information though that can help any motivated person can learn on their own like most of us do reading tutorials and learning assembly language. Searching is a key for everything in every day life too. I am still not a master at it but I know enough to get by. And a few years ago I was so weak at it that I made myself look foolish all too often. Even on this board in its early existance. I think its an ability too few have. Maybe I am being a bit extreme though I dont know everyone elses opinion well I know JMI's :). With all that being said I still agree with Woodmann what took you so long to find this board. Oh ya and welcome to the board. I know I find it most informative and I am sure we are all happy to have someone who actually is into reversing and not cleverly wording crack requests ;).

Snatch
Solomon
11-01-2002, 05:27 AM
hehe, I'm lucky that 5 years ago I found Fravia's old page and his forum.:D
wbe
11-01-2002, 07:06 AM
Here you will find nothing but the most talented reversers and their brainstorming sessions (No, not speaking of myself).

Just a friendly advice for a good start. On this board, NEVER EVER ask something which looks like, smells like or sounds like a crack request.

OK? ;)

wbe
JMI
11-01-2002, 07:31 AM
Reparion:

Welcome and save us and yourself any grief by reading the posting guidelines and the Frequently Asked Questions. You will notice the link at the top of the main page. Also please notice the "Please use the search function before posting" statement. What this means is that you should do two things before actually posting a question.

1. Use the "search" button to attempt to see if someone has asked questions on your subject before. If so review them to see if they answer your question.

2. If you did a search and didn't find anything on your subject, or found something, but it didn't answer your question, or you didn't understand it, give some indication in your posts that you have tried to find the answer yourself without success.

People here will not complain about your efforts if you show that you have tried to help yourself first. We all were "newbies" at some point, and all of us are newbies on some issues, but each of us should make an effort to solve our own problems before enlisting the help of others. We learn more that way.

If you check out the thread right below this one you will find some suggestions on places to start looking for learning materials. If you are already familiar with assembly language programing, you already have a leg up on many who have joined here and it will come in handy when you move on to Unpacking and defeating protection systems.

Regards.
Reparion
11-02-2002, 10:59 AM
Thanks.. I must confess that Im above the 'warez' thingie, and I do realize that you aren't going to do my work for me, as I want to learn by myself and I think this is the right place to do that..
Paul333
11-02-2002, 02:25 PM
Hi Reparion..im a newbie as well :)

Its a good crowd here and you,ll learn a lot from them :)

paul333


Vbox 4.6.2 on Coreldraw 11 - LAME
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Vbox 4.6.2 on Coreldraw 11 - LAME
PDA

View Full Version : Vbox 4.6.2 on Coreldraw 11 - LAME

Lbolt99
11-01-2002, 09:20 PM
Hello,

Back from a several month hiatus, I am at work again on stuff and my most recent target is Coreldraw 11. The trial version is available from Corel's web site, which they seem to change around all the time. To save the hassle, just go to link removed after logging into their ftp site.

Alright, those of you around awhile remember Vbox 4.3 on Coreldraw 10 was a piece of cake. Well this one is too, except for a lame trick that Corel decided to throw into the mix.

Corel 11 works very similar to Corel 10 - there's a bunch of small .EXE files for the programs, basically just launchers, and a zillion .DLL files.

The new version of vbox doesn't do anything for corel because their launcher exe file only imports kernel32.dll. So just dump it as you would anything else, and rebuild with revirgin. My method was to break on getversion, and several lines up was the OEP: 401771, and dump with LordPE.

So there we have the exe stripped of Vbox. Now we try running it: whoa! The dumb vbox screen comes up again. So I tried renaming the vbox directory so it couldn't access the vbox dll files. Re-run Coreldraw, up pops a box "Couldn't access vbox files". bpx messagebox, it goes back to a process called "crlfrmwk100.dll". Turns out, they decided to put vbox on one of the startup dll files.

After a bunch of false leads trying to figure out the OEP of the crlfrmwk100.dll file, I tried a different method:
I looked at a couple of the other dll files, and noted one of the common asm statements near the oep. I went and dumped the free-running process of the crlfrmwk100.dll file, pulled it up in W32dasm, viola! A search for the string revealed what proved to be the correct OEP: 24B45823. So I put a bpm cs:24b45823, and dumped the dll file. At this point, the relocation needs correcting: its pointing to an area in the PREVIEW section, and needs to be changed back to where the .reloc section is. Nothing else needs to be done with the relocations cause it always seems to load into the base at 24AB0000. Also, fix the OEP: rva 95823. The import table is untouched! You don't even need to rebuild it.

So was the powerful and tough Vbox 4.6.2 good enough to protect Coreldraw11? No. And their little .dll idea didn't pan out either :)
nikolatesla20
11-01-2002, 09:49 PM
Yeah, VBox is pretty darn easy, I unwrapped Flash MX in a day or two - took me longer only because Revirgin got some API's wrong and I had to trace them manually in SI.

Once again, it shows how much you can do with a dead listing, even when something is "protected". I use that technique on packed VB apps as well, since they push a "VB5!" string at their OEP. Just dump it and search for VB5! and you've found the OEP.

Here is another little trick I like to do sometimes: If you are having trouble locating the OEP.

1. Dump the file anyway, while its running. Who cares about initialized pointers, etc. We just want to look for OEP.

2. Rebuilt the IAT as much as you can. Don't bother rebuilding the WHOLE thing, just a basic single level trace is good enough just to get most of it.

3. Patch the IAT into the file, and correct your IAT VA and size, and correct any section characteristics so you can disasm it.

4. Open up the file in WinDASM, and try to find an API that is usually near the beginning of a program. (GetCOmmandline, or GetVersion, etc.) For MFC programs , it's usually __set_app_mode.

Just another way to skin the cat.

-nt20
salsa
11-01-2002, 11:51 PM
nikolatesla20,

Your method on aspr does not work! I followed your advice given in reply to my post "dump problem". I found the string with my hexeditor, checked the address with w32dasm on the dump I made whilst the prog was running and yes it is the address that should be pushed (the first instruction below ThunRTMain).

In fact, aspr loader gets the OEP and points the same address that the prog should return. However, this instruction is missing on the dump. On the previous version of the same VB prog (protected with the previous version of aspr) that push instruction was there. I think it safely resides somewhere inside aspr space now.

For your info
nikolatesla20
11-02-2002, 01:32 AM
Yes, salsa. Thanks for letting me know!

It's just because of the new Asprotect version, which copies some of the original code to itself now. Older versions never did so.

Plus not all protections are Asprotect :) So it works on those.

-nt20


Code Injection with Code Snippet Creator: W32Dasm + Mouse Wheel support
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Code Injection with Code Snippet Creator: W32Dasm + Mouse Wheel support
PDA

View Full Version : Code Injection with Code Snippet Creator: W32Dasm + Mouse Wheel support

Kayaker
11-02-2002, 09:39 AM
Hi All,

A while back I added mouse wheel support to my Win98 Winhlp32.exe file, basically because I was tired of not being able to mouse scroll in the Win32 Programmers Reference. I thought this would make a good project, but then I found out the Win2K and above versions of winhlp32.exe had mouse wheel support already built in. Damn MS anyway for stealing my idea! ;-) Aha, then I realized W32Dasm doesn't have mouse wheel scroll capabilities either, so this has now become the target for this project.

Usually I build a patch directly in Softice with the a(ssemble) command, which allows me to test and modify it on the go, then dump the bytes and insert them into the file with a hex editor and/or rebuild it using HIEW. This time however I decided to try out Iczelion's Code Snippet Creator, and I must admit to being very impressed. So this is a combination project which can deal with code injection/patching as a whole, as well as learning how to use this nifty tool.

What we want to do is find a spot in the Windows messaging queue in W32Dasm where we can insert a jmp to our patch code. The patch code itself will contain the new code to test for and handle the WM_MOUSEWHEEL message. The messaging queue is where messages such as WM_COMMAND and others are processed. This is the first hurdle to overcome for those who have never delved into or patched this area before. Finding and recognizing this code and understanding roughly what it is doing is the first step. I'd recommend focussing on trying to find where WM_COMMAND itself is handled. This message is called, for one, when a Menu item is selected and has a constant value of 111h, so a BMSG breakpoint can be used to break on it. From the BMSG break there are techniques to trace directly to the start of the messaging queue. If you are unsure how, I would suggest as a start looking at the Menu Enabling Project we had some time ago and Clandestiny's tutorial (on the main site) that came out of that, the techniques are discussed in there.

Menu Enabling Project (http://www.woodmann.net/forum/showthread.php?threadid=126)

There are other messages you could use and other ways to find the proper code area, including deadlisting, keying in on recognizable message constants such as "111h" for example, but whatever works for you.

What I'll do is supply the MASM code snippet that I used to develop the patch, or you can develop your own. Most of what you need to know about handling WM_MOUSEWHEEL is in the Win32 Programmers Reference, or you can go to MSDN for more info. If you do use the Snippet Creator you will need MASM installed of course. This isn't a complete copy and paste, you'll need to change what needs to be changed to get the right hWnd and wParam values for the real target, plus W32Dasm is a little peculiar actually, so this patch isn't necessarily as easy as it might seem.

Without giving too much else away, here is a generalized snippet that I developed in a test listview app before turning it into a patch, change what you see fit. There are more sophisticated ways to handle WM_MOUSEWHEEL but this was sufficient for my purposes. Every scroll of the mouse wheel up or down advances the page 3 lines (set in the loop). If the shift key is also held down then it's a full page scroll, this is a bit of an improvement on the standard routine that I just personally like.

; ListViewClassName db "SysListView32",0
; (example has nothing to do with W32Dasm but you may want
; to use a class name in your code)

.ELSEIF uMsg == WM_MOUSEWHEEL ; constant = 20Ah

; invoke FindWindowEx, hWnd, NULL, ADDR ListViewClassName, NULL
; WM_MOUSEWHEEL is sent to the Parent window, I needed the
; listview Child window for the SendMessage calls.
; This may not be the case with W32Dasm, check out what's
; happening! In any case, EAX is now the hWnd of the Listview
; itself (I think in W32Dasm it's a Listbox).

mov edx, wParam
mov ebx, edx
and ebx, 0ffffh
; LOWORD is returned in ebx, indicates if virtual key held down
sar edx, 16
; HIWORD is returned in edx, +ve value scroll up, -ve down

.IF SDWORD PTR edx < 0 ; Negative value of high-order word = wheel down

.if ebx == MK_SHIFT ; SHIFT key is down (0004h)

invoke SendMessage, eax, WM_VSCROLL, SB_PAGEDOWN, 0

.else
mov ebx, 3 ; scroll 3 lines for each wheel movement

.while ebx != 0
invoke SendMessage, eax, WM_VSCROLL, SB_LINEDOWN, 0
dec ebx
.endw
.endif

.ELSE ; Positive value of high-order word = wheel up

.if ebx == MK_SHIFT ; SHIFT key is down (0004h)

invoke SendMessage, eax, WM_VSCROLL, SB_PAGEUP, 0

.else
mov ebx, 3

.while ebx != 0
invoke SendMessage, eax, WM_VSCROLL, SB_LINEUP, 0
dec ebx
.endw
.endif

.ENDIF
.ENDIF

As for setting up and using Code Snippet Creator, if you decide to use it, the help file should be enough, but we can deal with problems if they arise. If you happen not to have a mouse with a wheel then you could always assign line/page scrolling functionality to W32Dasm with a hotkey instead (handle WM_KEYDOWN). If there are any questions don't be afraid to ask, there are many who can help with this. I know ZaiRoN has wanted to do a Code Snippet Creator project for a while :)

Good luck and have fun.

Cheers,
Kayaker
ZaiRoN
11-02-2002, 09:17 PM
I know ZaiRoN has wanted to do a Code Snippet Creator project for a whilegrr, you have stolen my fantastic idea :mad:

Joking apart, great job Kayaker! I really enjoyed this project and i'm planning to add more mouse_features ;)

regards,
ZaiRoN
Kayaker
11-03-2002, 12:25 AM
Originally posted by ZaiRoN
grr, you have stolen my fantastic idea :mad:

Heh, borrowed, ZaiRoN, borrowed...;) As Mammon_ gives us this fine code of ethics in his idc scripting examples (available at CrackZ btw), "use, steal, change, but do not claim."

Hopefully this will be the first of many such projects. Snippet Creator makes it SO convenient to develop complex patches by simply coding them in in the familiar environment of Masm32. Please pass on any other feature snippets anyone comes up with, so we can develop Zuprgut tools of the trade ;-)

Regards,
Kayaker
ZaiRoN
11-03-2002, 02:52 PM
You are forgiven this time :p
Zuprgut !?! what does it mean?

ZaiRoN
Kayaker
11-03-2002, 03:24 PM
Originally posted by ZaiRoN
You are forgiven this time :p
Zuprgut !?! what does it mean?

ZaiRoN

Lol, thanks :D

Zuprgut? Something I stole, er borrowed, from the SuperBPM doc. Doesn't seem to be too common a term, German for 'super good' maybe? Klingon perhaps?

Kayaker
ZaiRoN
11-03-2002, 04:11 PM
Klingon perhaps?
hihihi, maybe!
Have you ever tryed the Klingon google version?
No!?! Go to google and click on 'preferences'; choose klingon interface language and see with your eyes :eek:

ZaiRoN
ZaiRoN
11-03-2002, 09:21 PM
I was playing with the new wheel's feature and I noticed a strange thing regarding down direction. When I move the wheel very fast (in down direction) the page, instead of scroll down, scrolls up. At first, I thought the problem resides in my implementation, a little bit different from yours. I didn't use the signed dword in the first if-statement but a simple 0x78h check; so, I have tryed your code but it doesn't work, the scroll is always in only one direction: up. The weird thing is that I have made an asm proggie for test wm_mousewheel and both methods (my and yours) works perfectly... I'm not able to give an answer to the problem; it's only my problem or it happens to you too?

ZaiRoN
Kayaker
11-04-2002, 12:58 AM
Hmm, weird.

No, I can spin the mouse wheel up or down fast until my finger falls off with no odd behavior. As I mentioned, WDasm is a little peculiar, and so is how you're supposed to handle WM_MOUSEWHEEL:

The WM_MOUSEWHEEL message is sent to the focus window when the mouse wheel is rotated. The DefWindowProc function propagates the message to the window's parent. There should be no internal forwarding of the message, since DefWindowProc propagates it up the parent chain until it finds a window that processes it.

You may have noticed the WM_MOUSEWHEEL message is sent twice, hence the patch is called twice, once with the hwnd of the listbox and then with the hwnd of the parent window. I'm not sure why this is, if it's because the two controls have the same class name (I thought about changing one of them to check), or whether it may have something to do with what the above description implies. In an asm test app there is only 1 message sent (with the parent hwnd) that I can detect, and this you handle through uMsg.

How are you returning from the patch (and where did you place the jump)? Normally in an inline patch of this sort I might restore the stack and return directly to Kernel code from whence the msg handling call came (the call from between K32Thk1632Prolog -> K32Thk1632Epilog) rather than returning to program code and running unnecessary instructions.

But with WDasm this wasn't really feasible (notice the msg params aren't directly accessible from EBP within the main message handling routine that your patch accesses, but are pointed to in an address within EBP, kind of an indirection, plus there's a lot of other code run before ever restoring the proper stack and returning to Kernel code). So I just returned to the address after the patch jump, but preserved the flags (and registers of course) so the program would continue on and follow the normal code flow for an *unhandled* WM_MOUSEWHEEL message. Eventually DefWindowProc is called and is handled in whatever default manner Windows chose.

The fact that there are 2 hwnds processed in your patch doesn't really matter too much I think because in one of the cases the SendMessage calls will simply fail and no scrolling will occur (when it processes the Child window hwnd). If you don't want this redundant code to run then use FindWindowExA to filter out the incorrect one (returns 0 instead of a valid child hwnd).

I don't what else it might be unless your mouse is sending bogus signals. I'm using a Logitech cordless. Here's my Snippet Creator settings:

[OPTIONS]
SNIPPET_VA=401000
PATCHOPTION=1
REDIRECT=2
REDIRECT_VA=490E7A ; directly on cmp esi, 111
RETURN=1
RETURN_VA=490E80
RESTORE=0
TARGET=...\W32Dasm\W32dsm89.exe

Kayaker
ZaiRoN
11-04-2002, 01:04 PM
I have found where the problem resides: wParam !!!
Directly from w32 help:
The value of the high-order word of wParam. Indicates the distance that the wheel is rotated, expressed in multiples or divisions of WHEEL_DELTA, which is 120.

I -superficially- thought that the only possible two values could be +120/-120...

ZaiRoN
ZaiRoN
11-04-2002, 06:21 PM
For those who had already added the wheel features, I would like to suggest another task. Maybe it's not very useful but always fun.

I'm thinking to add another button to the 'W32Dasm Alphabetical List of Imported Functions' dialog. What will this button do? We will use this button to run the win32.hlp reference guide and to display the page of the selected imported function.

I don't have tried yet but I think that (if you want) you can follow these guidelines:

1. add the new button:
the easiest task of the project, you should know how to add a button (i.e. resource hacker)

2. find the routine where messages (relative to this dialog) are handled:
windasm uses a weird method to work with messages and maybe this could be not easy, don't know. Maybe a look to the other dialog functions will help you to find the routine (i.e. OpenClipboard function)

3. add code to:
- get the name of the selected Api. This snippet will help you:
invoke SendMessage, hListBox, LB_GETCURSEL, 0, 0
invoke SendMessage, hListBox, LB_GETTEXT, eax, ADDR Where_To_Save_The_Selected_Text- run Win32.hlp guide.
Every .hlp file are runned using win32hlp.exe file. This .exe file allows you to specify some input parameters, I don't put the list here...use google :p.
Here is an example on how to run Win32 guide and to display the MessageBox page:

win32hlp.exe -k MessageBox c:\...path...\Win32.hlp

We know how to run the reference but we don't know yet how to run the win32hlp.exe file.
To run files, there are some different ways. Windasm uses CreateProcess function to debug processes so we can simply use this function :)

For now, I don't have other ideas.
If you have any comments, questions or other things about this project, don't hesitate to come out ;)

ZaiRoN
crUsAdEr
11-09-2002, 03:50 AM
hmm...

forgive me but u guys are too fast... been busy for a few days n boom.. the project is already finished :D ... anyway.. i would like to work on something slightly differently... i would like to add more feature on revirgin or imprec through the right click mouse button...

Can you give me some hint on how to start? i am quite lost on which msg to catch n handle still...

thanx,
crUsAdEr


bpx lc_init
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > bpx lc_init
PDA

View Full Version : bpx lc_init

cillonzo
11-02-2002, 06:43 PM
i am newbie
i am not use often so i don't understand how i can break with the function lc_init.....maybe i must change winice??

many thanks and sorry for the ask

cillonzo
r4g3
11-02-2002, 09:34 PM
include the exporting file in your winice.dat
exp=x:\...\filename.ext
usually it`s a .dll
CrackZ
11-03-2002, 11:22 AM
Hiya,

lc_init() is from FLEXlm.

You need to either load the exports from the lmgr*.dll if that is what your target uses, or if statically linked, apply a .sig in IDA, export it to .map, use msym to convert to .sym and load that via the symbol loader (the 2nd one depends on FLIRT recognising lc_init btw, which you'll have to check).

Regards

CrackZ.
cillonzo
11-03-2002, 05:57 PM
thanks for your replay

I have found in my *.exe with lmtools (globtr.....er) this :

Flexlm v7.2g (liblmgr.a)

so i'am in confusion because i don't have found the static linked!!!

Now i must found the kind of lmgr*.dll use this application??

Regards

cillonzo


Maybe new Azpr trick ?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Maybe new Azpr trick ?!
PDA

View Full Version : Maybe new Azpr trick ?!

Nigma
11-02-2002, 09:06 PM
Hello everyone !!

Well I downloaded
AbsoluteShield Internet Eraser Pro 2.32
from download.com ( search for AbsoluteShield )
and I thought "another Azpr protected software !"
well I unpacked the proggie and did all revirgin procedure ,
But guess what : the F****** proggie does not run , in fact
it fails before reaching the OEP ( at the windows loader ).
I am familiar with Azpr protected proggies and I thought maybe
there is a new trick ?

I know that you are all tired from Azpr unpacking but Please check
this one and tell me if you discovered something new .

Thank you all !
nikolatesla20
11-03-2002, 04:20 AM
can you give more details, such as what exactly happens when it "does not start".

-nt20
foxthree
11-03-2002, 11:18 AM
I hope you're referring to AbsoluteShield Track Eraser 2.32 from sys-shield. (There was no AbsoluteShield Internet Eraser Pro 2.32). Very old strain of "standard" ASsPR. Nothing new. Did you fix the APIs properly? Esp. the user32.dll's DialogBoxParamA?

Signed,
-- FoxThree
Manko
11-03-2002, 11:30 AM
Something must have gone wrong when you did dumping or rebuilding or something, cause it worked fine for me.

More info please! :)

/Manko
Nigma
11-03-2002, 08:27 PM
Well , first , I must say S O R R Y guys !
there is no new azpr trick !
I don' t know why but revirgin created wrong import table ,
the original_first_thunk and the first_thunk contained offsets
that are outside the Pe offset ( 2A357600 in the first_thunk )
and that cause the problem , the window's loader tried to
get DATA from invalid address .

So Manko rights , it is suppose to be no problem to unpack
this target !

Thank You All !!!!!


Writing to Process memory within SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Writing to Process memory within SoftICE
PDA

View Full Version : Writing to Process memory within SoftICE

foxthree
11-03-2002, 10:57 AM
Hello:

I was wondering if there was a way to write a certain pre-defined byte to a process memory within softice. I know I can do a "ed <mem> <value>" but what if I wanted to fill say 1K block from some memaddr1 with 00s? Is there a macro or somthing to achieve this from within softice itself? Otherwise I'll have to write a small proggie to do this... :(

Signed,
-- FoxThree
r4g3
11-03-2002, 11:26 AM
well this is almost as coding WinXp2.006

push eax
push ebx
push ecx
mov ebx,memaddr
xor eax,eax
xor ecx,ecx
loop:
mov [ebx+4*ecx], eax
inc ecx
cmp ecx, 100h
jle loop
pop ecx
pop ebx
pop eax
jmp back_to_app_code

it`s not an optimized code , but should work :)
hobgoblin
11-03-2002, 03:56 PM
What about the F command in Sice?

F <address> l <lenght> <type of bytes to be written>

Or did I misunderstand the question?

hobgoblin
foxthree
11-03-2002, 04:50 PM
Hi Hob:

Thanx a lot, buddy! I didn't think it would be so easy :). May be I should RTFM... anywayz, thanks a bunch :)

Signed,
-- FoxThree
esther
11-03-2002, 05:20 PM
>May be I should RTFM... anywayz, thanks a bunch :)

sure you need to :p
foxthree
11-03-2002, 05:33 PM
Hi Esther:

Sorry for asking something that was in TFM :( It wouldn't happen again! I wouldn't want to give you any more work than you already have ;)

Thanks,

Signed,
-- FoxThree
esther
11-03-2002, 05:36 PM
Hey FoxThree,
I was just pulling your leg :P Sorry :(
foxthree
11-03-2002, 05:41 PM
Esther:

NP :)

Signed,
-- FoxThree
Kayaker
11-03-2002, 06:49 PM
Ahch, 'F' is obscure enough for me not to fall into the rtfm category.

Did you know that 'F' is one of those SI commands you can send via the BCHK interface? Check this out FoxThree, maybe you can incorporate it into a Win9x app for fun or profit :p

Cheers,
Kayaker
foxthree
11-04-2002, 05:19 AM
Hi Kayaker:

Man, good one :) I totally forgot about the BCHK interface ... ofcourse No ICEDUMP :D... Nice proggie, the wet one. BTW, what profit? where, where, where ??? :D

Signed,
-- FoxThree
esther
11-04-2002, 05:27 AM
Hi FoxThreeadthemanual :p,

>what profit? where, where, where

He meant knowlege ;)
Kayaker
11-04-2002, 03:54 PM
Originally posted by esther

>what profit? where, where, where

He meant knowlege ;)

Heh, he's probably looking for something a little more tangible than that that he can put in his pocket..

Hey just out of curiousity, does the app work on Me/XP? I have no way of checking it but I was wondering if the BCHK interface is actually still active on those Win versions. There may be some restrictions when it comes to memory access, but I was wondering if it worked at all?

Kayaker
foxthree
11-05-2002, 07:06 AM
Yo Kayaker: Right :) (Jus' kidding ;))

Alas, I too do not have a working WinMe/XP installation around here.

Signed,
-- FoxThree
Kayaker
11-05-2002, 07:16 AM
...there must be some other brave adventurous soul around willing to put it to the test then?
Snatch
11-07-2002, 11:38 AM
Did not work for me on WinXP SP1.

The exception Breakpoint
A breakpoint has been reached.
(0x80000003) occured in the application at location 0x004010b1.

Okay just slapped myself awake after looking at the source and duh. So if I turn i3here on then I go into the debugger and nothing happens. Looks like the interface is no longer exported :( and its just being interpreted as a normal int3 breakpoint. Unless there is some option in Softice that I have set wrong...

Snatch


Armadillo 2.61 =(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 2.61 =(
PDA

View Full Version : Armadillo 2.61 =(

Mega Desperate
11-03-2002, 06:14 PM
Hi!1.. i really desperate! .. i can't find the fucking OEP !!.. i read this topic in unpacking forum "Armadillo and CopyMem II decryption " .. i put bpx SetProcessWorkingsetSize .. and trace ..i go to CALL EDI , he's show OEP!!! =-D ... i put bpx..08-) ...Woppss!! ..

004DD5CC MOV AH,CB ^ <-- ..what is this shit?¡¡¡ .. i find the address and show me this -->>55 PUSH EBP
004DD5CE AAM ^
004DD5D0 AND EAX,AD4A6BB0

Please help me i really not understand .. how i can go to the OEP..

Thank u =-)
_Servil_
11-03-2002, 06:43 PM
hi,

arma seems be in the fashion at this time ;-)

the oep is at 22966 rva

instead wot you mentioned try to look for a common post-oep apis called -

getversion
getstartupinfoa
getcommandlinea
or
getmodulehandle

btw. the latest armkiller is able to find the oep for a while aswell
crUsAdEr
11-03-2002, 10:34 PM
Hey hey,

read and learn.. do you know what the hell is copy-mem?
Mega Desperate
11-04-2002, 05:48 AM
Originally posted by crUsAdEr
Hey hey,

read and learn.. do you know what the hell is copy-mem?

Yes !1 is CopyMem II ...=8-P
esther
11-04-2002, 06:01 AM
>Yes !1 is CopyMem II ...=8-P

Nope CopyMem II is !1
Mega Desperate
11-04-2002, 07:37 AM
Originally posted by esther
>Yes !1 is CopyMem II ...=8-P

Nope CopyMem II is !1

Yes is COPY Mem II ...create 2 processes
..Sorry this one --> 1 ..finger error..=8-|


VFAT Error when loading softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > VFAT Error when loading softice
PDA

View Full Version : VFAT Error when loading softice

shank!
11-03-2002, 11:15 PM
I have done so much work on fixing this problem. finally, i had figured out what was causing it, but i have a new problem:

ndis.vxd is conflicting with softice or vise-versa and i cant figure out how to fix this problem because ndis.vxd is a network driver and is what i need to access the internet, i can load softice when i choose not to load ndis.vxd but then i cant access the internet. wich is crap, because im still learning softice and i need access to the internet for information on softice when i need it.

does anyone know how i can fix this? is there a way i can get softice to ignore this driver or vise-versa?

im using windows 98, and i have Cable(i put this down for obvious reasons). and pentium 3, 296mb ram

if you need anymore information, tell me.
Thanks
Woodmann
11-04-2002, 12:00 AM
Howdy,

I think MS makes a utility to debug ndis.vxd if not I am
sure you can find out how to debug it.

Is softice breaking on ndis.vxd?
How about a cheap and cheesy solution and update the driver.
There are different versions for different win 98 releases.

Peace, Woodmann
shank!
11-04-2002, 12:38 AM
well, faults are off, so sice isnt breaking on anything
i'll try the update, thanks

but before i do, this problem has been like this since before i even had cable, i had high speed before.
but i'll try the driver update
shank!
11-04-2002, 01:24 AM
nah, didnt work.
if you have anymore options, please let em know. thanks
Woodmann
11-04-2002, 01:31 AM
Howdy,

Check the MS site for info on how to debug ndis.

Peace, Woodmann
esther
11-04-2002, 05:16 AM
Hi,
extract the files ndis.vxd from your original cd and replace the old
ones.
Hopes this helps.

Regards
shank!
11-04-2002, 07:10 AM
Check the MS site for info on how to debug ndis.

i got confused after awhile, aha, i didnt really get any of it

Hi,
extract the files ndis.vxd from your original cd and replace the old
ones.
Hopes this helps.

eh, i tried that, didnt seem to work either
esther
11-04-2002, 07:14 AM
Originally posted by shank!
i got confused after awhile, aha, i didnt really get any of it

eh, i tried that, didnt seem to work either

you have to do it in safe mode dos prompt and the copied the files.
Not in windows ;)
shank!
11-04-2002, 09:07 AM
that didnt work either :(

and my softice use to run fine, i dont see how ndis.vxd has anything to do with softice. im starting to give up on this problem, i have asked everyone and looked everywhere for a solution and nothing seems to work.
Woodmann
11-04-2002, 10:33 PM
OK,

Lets start again. What did you do to fix the original VFAT problem?

Was it this: http://support.microsoft.com/default.aspx?scid=KB;EN-US;q139063&

Next, what is the network card and the details (version # et al)

What exactly happens when you try to run softice and the network driver at the same time.

Peace, Woodmann
shank!
11-05-2002, 01:17 AM
What did you do to fix the original VFAT problem?

im not sure if this is what you mean, but:
i chose not to load ndis.vxd when i booted up my computer, and softice worked fine.

http://support.microsoft.com/default.aspx?scid=KB;EN-US;q139063&

i have looked at alot of pages like this, non of them solve my problem :(

Next, what is the network card and the details (version # et al)

D-Link DFE-530TX PCI Fast Ethernet Adapter

What exactly happens when you try to run softice and the network driver at the same time.

computer crashes, gives me this error:

VFAT Device Initialization Failed

A device or resource required by VFAT is not present or is unavailable. VFAT cannot continue loading.

System halted.

Although, softice does load the settings first, so i know softice isnt corrupt. After it loads the settings from winice.dat it sits for a bit, then i get the error.

i have also did a logged boot, nothing looked "suspicious" in the bootlog file.

(thanks for helping, by the way)
naides
11-05-2002, 04:21 AM
Suggestion:

Consider Altering the order in which NDIS.VXD and SoftIce.exe are loaded.

You can monitor windows in a stepwise fashion and find out when NDIS.VXD gets loaded: By Config.sys? By Autoexec.bat? by the win.ini etc? explore ways to delay its loading until Sice is active. Or the other way around.

Can you manually load Sice after the computer and Windows have completed the boot process?
you will not have kernel level debugging, but at least will help you isolate the level of conflict.

Have you tried placing another network card?
Have you tried moving the network card to a master slot in the PCI bus, or to a slave slot?

Have you tried other, newer or older versions of Sice?

Look at here:
h**p://support.microsoft.com/default.aspx?scid=KB;EN-US;q139063&
And see what may you learn.
DO NOT GIVE UP YET!
shank!
11-05-2002, 04:36 AM
i'll have try those.

and yes, i have tried an earlier version of softice and still gave me an error, im using 4.05 right now

thanks for your input


TELock 0.99
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > TELock 0.99
PDA

View Full Version : TELock 0.99

ByTESCRK
11-04-2002, 07:02 AM
Hi somebody has the subject? Please send me. :(

I promise to read the FAQ <- I don't write this!... :)
snaker
11-05-2002, 08:48 AM
It's a private release, like many other version made just for TMG or tE!'s personal friends, so much as we would want, I think getting our hands on it would not be very likely.

Also, IMHO 1.00 and a newer version is also out.
ByTESCRK
11-05-2002, 01:14 PM
Thank you snaker!

Sorry by the FAQ.
nofurs
11-05-2002, 01:21 PM
This is probably "warning" from the mods.
Read the FAQ before posting anything here
ByTESCRK
11-05-2002, 02:17 PM
Thank you! :D No problem.


Strange crypkey target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Strange crypkey target
PDA

View Full Version : Strange crypkey target

squidge
11-04-2002, 09:28 AM
I recently used a crypkey protected application that seems different than normal. It can be registered the normal way (using SKW/CKI), but unpacking the program was a bit more of a challenge than normal.

Crypkey programs are, normally, incredibly easy to unpack. However, I could not dump this target using ProcDump or most other dumpers. Further inspection revealed that even before the target reached OEM, there was several memory areas around the process code with state of "Reserved" rather than "Committed". Ended up writing my own process dumper which managed to dump it successfully.

Correcting the section headers went fine, but the import table had been nuked - not something that I remember Crypkey protected apps doing - I even tried running the latest Crypkey Stealth over one of my own programs, but the import table was intact and the process was easily dumpable.

Even stranger, Revirgin couldn't find anything usable most of the time, and dumped out what could only be described as garbage when it did. Imprec found a working table however, but screwed up the section headers of the target when applied to the target. In the end I gave in, and did it manually.

I've managed to successfully get the program working in the unpacked state, but I'm wondering if any else has noticed this with any Crypkey protected apps ? Looking through the original (packed) code it just seemed like standard Crypkey Stealth protection, which you can spot a mile away.
hobgoblin
11-04-2002, 10:07 AM
What target are you looking at? Could be interesting to look at it...:)

hobgoblin
squidge
11-04-2002, 10:22 AM
Spectra Audio Analyse RTA 132 v13

See PM.

Not really interested in the target by any means, but it's protection interested me and that's what made me unpack it. Now it's unpacked and working, it'll most likely be deleted :)
hobgoblin
11-05-2002, 04:23 AM
Well, I haven't seen something like this before. The import table can easily be dumped, as far as I can see (using Softice), but I haven't been able to solve the dumping of the file. I have only tried to dump it at different locations. I also tried to partially dump the sections, but couldn't dump all of them.
How did you do that?

hobgoblin
squidge
11-05-2002, 07:48 AM
Dump the sections of the program's process space seperately, but miss out the ones with a status of Reserved. Once these sections are concatenated together and a proper section header built for the resulting file, you only need an import table for it to work properly. There's a import table to dump within the process, but only the locations are there - no the function names, so the file will not execute until this is fixed. (Well, not strictly true - the names are there, but the pointers to them have been nuked)

With the strange section alignment used, both LordPE and Imprec both screwed up the PE file every time they were used as they assumed a section alignment of 1000.

I don't think I could have chosen a better program to test my new dumping engine on :)
SpeKKeL
11-05-2002, 02:09 PM
Hajo,

You should try lordpe's active dump engine>intellidump>select!

(verry intelli..)

Dumping without a prob.(yep some zero padded locations.
Your oep will be a few instructions before
the jmp....(make shure the right value is pushed(4b002c !)

No need to rebuild the imports, thay are all there
Do not forget to rename your dumped.exe.
:D

Ciao,

SpeKK.
squidge
11-05-2002, 03:03 PM
So you got a working dump just be using LordPE's intellidump and fixing OEP ?
SpeKKeL
11-05-2002, 03:08 PM
uhhhh...i think so ....??

SpeKK.
squidge
11-05-2002, 03:26 PM
damn ! :eek: :(

Ah well, at least I learned a lot about the PE file structure :)
SpeKKeL
11-05-2002, 03:36 PM
Glad i could help ;)

SpeKK.
squidge
11-05-2002, 07:51 PM
Aha! LordPE has built in Import-builder for dumped progs, maybe that's why it worked. My own app will dump these and fix the imports too now anyway, so I is happy :)

Just implemented a nice new feature to it also, it can dump Crypkey "stealth" target, find OEP, rebuild the header so it runs without the encryption wrapper, and then tell you vendor ID, app ID, password etc used so you can enter them in SKW. No more needing to look through dumped file for the hex strings and using ckinfo :cool: :cool: :cool:
hobgoblin
11-05-2002, 09:42 PM
This is not working for me. I use the intellidump, and the dumping goes okey. But I think I have a problem finding the right place for the OEP. I have tried to dump from the address 410056 (after the instruction push 4c002c is executed, I have tried to dump it from the jmp instruction just below, but nothing works. I also tried to dump it form the location 4B2230 (which I first thought to be the correct OEP). When I tried all this, the program doesn't even load properly in the Softice loader. Where am I going wrong here.?
A hint would be helpful..

hobgoblin

PS. I did rename the dumped file.
squidge
11-05-2002, 10:01 PM
OEP is stored at <have> section, pos 14 in the code. Eg. If section says 5B0000, then OEP will be stored @ 5B0014. A longword upwards (behind the area storing OEP) also stores the section the unpacked program lives in, but we know this is normally the first section anyway.

As for dumping, dump from start of section of first section named "code" with code attribs, this was RVA 10000 on my system, and should be pretty much the same on yours.

Eg. on this particular app, HAVE section is at RVA 1B0000, so OEP is stored at 1B0014, which would be file offset 169014 (hex). VMA is at 1B0010. Don't forget these are stored as intel longwords.
hobgoblin
11-05-2002, 10:41 PM
Okey,
I did dump it from the address 5B06F9, but after changing the OEP to what I found (0041000), it still doesn't run. I get the message "This is not a valid ....... program", so I guess I somehow managed to screw up the import table (or header). I used LordPE's intellidumper. I guess I have to look more into the import table.

Thanks anyway,

hobgoblin
squidge
11-05-2002, 10:58 PM
Quick way to check the import table: Load resulting dump into LordPE, Click "directories" and then "import table". If clicking Kernel32 shows you function names, then import table is ok. If it only shows addresses, then it needs repairing. Also, don't confuse the import tables! There are two in the resulting dump - one used by the decryption routine (contains very few calls) and one for the actual app (much more calls).

You should be dumping from RVA 10000 upto RVA 1D1000 to get all of the process.

41000 is the correct OEP, but don't forget the section alignment ! If any of your sections violate the alignment, the program will not run, showing the error you describe.

Also, if you are using XP, ensure SizeOfImage is also aligned, or XP will not load it, and will just show the "blah not a valid Win32 blah blah". LordPE seems to corrupt this by using the wrong alignment.


help with Cyberlink powerdirctor 2.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > help with Cyberlink powerdirctor 2.0
PDA

View Full Version : help with Cyberlink powerdirctor 2.0

hamohd70
11-05-2002, 07:04 AM
powerdirector is 30 days trial and 3 mins recording time max in the trial version.
this version doesnt ask for a serial so i managed to patch it to remove the 30 days limit BUT could not find where to 3 mins recording limit is placed!
im using Olly to do the job!
any suggestions please?
Kayaker
11-05-2002, 08:05 AM
3 min = how many milliseconds = something in hex to search for?

SetTimer/KillTimer?

WM_TIMER handled?

?
squidge
11-05-2002, 01:05 PM
What happens when the 3 minute limit is reached, is there a dialog box, etc?
hamohd70
11-05-2002, 08:49 PM
msg?
no! it doesnt show any msg! it just stops recording...

for timers i will try to trace this ...

thankx
squidge
11-05-2002, 09:48 PM
Ok, I downloaded a copy, and will have a look at it later.


Softice: (hmemcpy problem)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice: (hmemcpy problem)
PDA

View Full Version : Softice: (hmemcpy problem)

Nick
11-05-2002, 08:56 AM
When I type "bpx hmemcpy" and press enter I get the following error: "Symbol not defined (hmemcpy)"
esther
11-05-2002, 10:26 AM
Hi,
1)You should read the posting guidelines which is the link is shown below my signature

2)check your winice.dat which should not commented with ;

EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
EXP=c:\windows\system\shell232.dll
EXP=C:\windows\system\advapi32.dll

3)hmemcpy function doesn't exist in win2k or winnt

Regards
Nick
11-05-2002, 11:33 AM
I'm using Softice 4.05 NT with the XP patch (I'm running XP).

If I can't use hmemcpy then what can I do?
esther
11-05-2002, 11:52 AM
Eventually you didn't search the board.Theres a button near to the right hand corner
Search for WinXP
nikolatesla20
11-05-2002, 02:24 PM
Windows XP does not have the hmemcpy routine. That only exists in 9x.

You'll have to find another method to land on the information you are trying to bpx on.

-nt20
Nick
11-05-2002, 06:32 PM
Alright I searched and it seems that the only solution is to have Win98. I may as well install 98 on my other partition just for debugging.

It's annoying though. Surely Numega must have resolved this by now.
nikolatesla20
11-05-2002, 07:26 PM
Look! I has nothing to do with Numega.

The Windows XP operating system itself DOES NOT contain the routine hmemcpy. It is a Microsoft issue. XP is based off of WIndows NT.

hmemcpy is a crappy old 16 bit routine, in the heart of Win9x. Almost all of Win9x underlying kernel is still 16 bits ! That's why its so slow compared to Win2k/XP, because it's always going through a call gate (thunks).

-nt20
Pr1mus
11-06-2002, 09:18 PM
You don´t need hmemcpy at all. Infact it´s alot better to NOT use hmemcpy at all. Unless you are lazy and don´t want to learn new stuff all the time :P
Btw, win98 is ALOT faster on this machine than XP.
Microsoft XP is just crap when it comes to cracking. Win2k or Win98 are the only choices you have :)
Nick
11-12-2002, 10:20 AM
Originally posted by nikolatesla20
Windows XP does not have the hmemcpy routine. That only exists in 9x.

You'll have to find another method to land on the information you are trying to bpx on.

-nt20

Like what? As a newbie to Softice it is very hard since 85% of the tutorials on the web seem to be written in 1998-1999 which means Win98. So as I read all these tutorials that say use "hmemcempy" or use "windowboxa"...etc I feel powerless as I have WinXP and therefore a crippled Softice.

I wish some sites would make some Softice tutorials for XP otherwise it feels like I'm going in a time warp to 1998.
Aimless
11-12-2002, 12:20 PM
A better way to do the same would be:

1. Get a utility that can dump imports sections. You can try programmerstools.org for the same.

2. Get a good API reference Help file. The same is available as FTP (free) from Borland's site

3. Get a internet connection.

Once you have all 3, you can do the following steps:

1. Search for your particular API in the help file. Chances are it will describe what it does. It will also highlight you as to whether it is due to become obsolete. In case it is, it will also highlight which alternate API to use.

2. In case you do not manage to find info over there, you can connect to msdn.microsoft.com and type your API in the SEARCH function. You will DEFINITELY get the necessary information you seek.

Have Phun
hobgoblin
11-13-2002, 08:10 AM
If you install Softice properly on XP ( Driverstudio 2.7), apply the patches originally made by Kayaker to fix the loader problem, and finally get hold of SuperBPM for NT, all you will miss is the hmemcpy function and the breakpoint on range function. It takes time to learn how to use Softice to its fullest potential. Surely you can learn a lot from tutorials written some years ago, and that is a good start. But you can learn more from try out Softice on your own while reading the manuals. I used to crack on Win98 and WinME, and sure I used hmemcpy most of the time to "get into" programs. But what I sacrified by doing that was getting a deeper understanding of for instance api calls in general. After getting over to XP, and to some extend, Win2K, it was as I had to learn a lot of things all over again. The truth was that I had to learn how to use Softice properly for the first time....
Today I don't even miss the hmemcpy function, because I never need it. And believe me, it is much more fun nowadays, because I have started to see how useful Softice really can be when you get to terms with the more subtle aspects of it.
Good luck in your cracking efforts...:)

regards,
hobgoblin
Nick
11-13-2002, 08:26 AM
Originally posted by hobgoblin
If you install Softice properly on XP ( Driverstudio 2.7), apply the patches originally made by Kayaker to fix the loader problem, and finally get hold of SuperBPM for NT, all you will miss is the hmemcpy function and the breakpoint on range function. It takes time to learn how to use Softice to its fullest potential. Surely you can learn a lot from tutorials written some years ago, and that is a good start. But you can learn more from try out Softice on your own while reading the manuals. I used to crack on Win98 and WinME, and sure I used hmemcpy most of the time to "get into" programs. But what I sacrified by doing that was getting a deeper understanding of for instance api calls in general. After getting over to XP, and to some extend, Win2K, it was as I had to learn a lot of things all over again. The truth was that I had to learn how to use Softice properly for the first time....
Today I don't even miss the hmemcpy function, because I never need it. And believe me, it is much more fun nowadays, because I have started to see how useful Softice really can be when you get to terms with the more subtle aspects of it.
Good luck in your cracking efforts...:)

regards,
hobgoblin

I need a tutorial on API calls and how they relate to Softice and breakpoints, do you know any good links for this info?

Thanks.
naides
11-14-2002, 01:10 AM
Try the cracker notes, form Tornado.
Used to be in the Inmortal descents site.

http://www.woodmann.net/IDArchive/ID-RIP/releases.htm

Has a beginner's API reference.
Nick
11-14-2002, 06:58 AM
Originally posted by naides
Try the cracker notes, form Tornado.
Used to be in the Inmortal descents site.

http://www.woodmann.net/IDArchive/ID-RIP/releases.htm

Has a beginner's API reference.

Hmm, that doesn't really help cause it doesn't say if those API calls are valid in WinXP. Basically I need a version of Softice that can understand WinXP API calls, and then I need a list and description of all the WinXP API calls. I don't see any other realistic way of learning this.
Nick
11-14-2002, 07:13 AM
BTW: Do I want "DriverStudio" or "SoftICE Driver Suite"? They seem like similar products.

http://www.compuware.com/products/driverstudio/
UrgeOverKill
11-15-2002, 01:41 AM
Nick, IMHO If you have a choice I would recommed the SoftIce Driver Suite. If and when you become familiar with it, that suite of tools offers a decent range of tools that you can explore.

Depending upon your knowledge of code, Softice can be a real pain. Debugging from the low end of it all can be difficult, but stay with this board it has the best *minds* out here and we all learn from each other.

As far as using XP or 98, hmm, I have both machines running its repectible sice(s) and I think the XP is acyually faster than the 98. Assuming of course that yours is properly configured..........

Alot of my work is typically fast and down and dirty. :D

Good Luck


Aspr - Aspack double pack? :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspr - Aspack double pack? :)
PDA

View Full Version : Aspr - Aspack double pack? :)

kandinsky
11-05-2002, 11:46 AM
Hi Freaks,

i m trying to unpack an aspr target...

The problem is, I cannot GET THE FUCKING OEP...

The Loader cause an runtime error and its the first target I cannot find the correct oep.

PeID doesnt report correct OeIP and although its a Delphi Target i cannot even get the OEP with Dede...

It might be double packed with aspack or I am just to lame.

See.ya

***.webextractor.com
esther
11-05-2002, 11:58 AM
There are about 5224 threads disscussing this topic.
Search the forum.

Paste the codes show what you have do some effort.
kandinsky
11-05-2002, 01:33 PM
Well,

anyway i am not able to find the correct oep.

I tried icedump too..

Loader, Icedump, oepfinder, hm, searched for bytes in memory, bla bla bla...

I cannot verify a correct oep, because none of the Oep-Finders is working and with icedump cannot achieve neither...

Well maybe just a fucking multi-dip software....

I will buy the software

Gongrats Alexy
nofurs
11-05-2002, 01:39 PM
Very good support software authors ;)
hobgoblin
11-05-2002, 03:43 PM
Hi there,
Don't give up.:)
This is actually fairly easy.This is how I did it:
I only used Softice and Icedump.
a) bpx getversion. When Sice breaks, disable bpx, do a search for the byte sequence 5B,EB,CE,61 (this is at the end of a call where Aspr builds the import table, but that's not important here). Put a bpmb xxxxxxxx x on the location you find. When Sice breaks there, disable breakpoint, and put a new one on the third ret instruction below of the location you broke at. When Sice breaks, disable breakpoint.
b) Use the tracex function in Icedump. Tracex will break 3 times at dips, then it goes into a leeeengthy loop. (You may step over it using a breakpoint). After that tracex breaks once more, and that's at the OEP.
Now, this is the latest(?) version form Alexey, so the first few bytes is actually executed while still in the high memory area. Check the value stored in ecx. That's the location for the jump instruction in the high memory area to the OEP. If you see what's stored in the ebx register, that's the number of bytes executed before the program jumps from the high memory to where you are right now. If you dump the number of bytes you see in ebx, from the instruction before the one pointed to by ecx, and upwards, you have the missing bytes you have to paste into your dumped program to make it work. Now all you have to do is to adjust the OEP.

Hope this helps..

regards,
hobgoblin
foxthree
11-05-2002, 03:47 PM
Yo:

Hob good one!

Kandinsky:

There is an easier method. Search the board for tips. This is the newest strain of ASPR started by Hob himself ;) XXC2C8 == HINT!

Signed,
-- FoxThree
TheSearcher
11-05-2002, 04:19 PM
Hiya,

The latest I think is ATC.Try it out have fun ;)

Additional information:
Look at the post salsa dump problem
hobgoblin
11-05-2002, 05:35 PM
What is ATC??

hobgoblin:D

Forget it. Found it out...:)
foxthree
11-05-2002, 05:48 PM
Hiya Hob:

The Infamous ATC.... You're going to have some phun indeed, Hob ;)

Signed,
-- FoxThree
crUsAdEr
11-05-2002, 07:39 PM
**********************************************
Hi Freaks,

i m trying to unpack an aspr target...

The problem is, I cannot GET THE FUCKING OEP...

The Loader cause an runtime error and its the first target I cannot find the correct oep.

PeID doesnt report correct OeIP and although its a Delphi Target i cannot even get the OEP with Dede...

It might be double packed with aspack or I am just to lame.
**********************************************

Hmm, what does "Freaks" supposed to mean?

I do share Kayaker sentiments few months ago now when he complained about excessive posts/threads concerning AsProtect discussing about the same thing over and over again... NO matter how well discussed the topic already is, there is always some newcomer who start a new thread again without searchign the board :( ...

Resigned,
crUsAdEr
kandinsky
11-06-2002, 10:39 AM
Hi dudes,

well, i found a breakpoint with a search for 30,90,90,90,90,90,90,90 in winhex too...

For my case it was 0047c2c8... I thought its wrong because, in all case at this breakpoint is a call function and i was quit confused...

So i will try out the way hop describes to rip the byte and include it in the unpacked....

Thanks for everything...

See.ya

BTW.: I regged the software :) :)
kandinsky
11-06-2002, 12:23 PM
Well,

i still have problems... I found the correct oep, in win98 its for me 0047c310 and in xp its 0047c2c8...

Everything worked fine, but still I get an runtime error when i try to run the unpacked version...

Please explain again, how i copy the bytes and with bytes i have to copy... Sorry, I didnt understand it...

The ebx register holds the number of bytes to copy.. In this case its 0c, but then?

Thanks in advance...

Kandinsky
Zilot
11-20-2002, 09:34 AM
-
Zilot
11-20-2002, 09:55 AM
Hi Kandinsky !!!

Maybe I'm too late with this replay , but if you still hasn't

unpacked ( or the worse, bought ) this is how I did it

Ok let see , the entry in real code is 47C2C8 but is not the OEP

the OEP is 47C2BC , why this , because you have to "rebuild"

first several bytes embedded in unpackers routine

And in your hex editor start from 47C2BC and fill it with next

sequence

55,8b,ec,83,c4,f4,53,b8,1c,c1,47,00 until you reach 47C2C8

CALL at 47C2C8 don't touch

There are three dips before OEP , bypass 1. and 3. ( dont touch

the 2 nd , it is about the key file )

Then about IAT , this is my IAT with ImpRec

There were 2 unresolved Apis ( after using plug- ins )

GetModuleHandleA (C91369)

Lock Resource (C913F4)

After dumpfixing everything should be OK but only with running

this is not the END yet because there is SIZE checking on

4747D4 , replace 'jl' on 4747D6 with jump

And at the end there is one more thing , when you try to close

the program there will be the screen about run time error

it is because some pointer checking on 403764 and just put

two nops instead jz

Ok But this is not the end with this Agony , you can not save

more then A hex extracted E-mails from the site

Try to do it by yourself , shouldn't be complicated

Regards

Soldat

PS: There is one golden rule , don't buy something you can't touch
because all the most beautiful things in life are free and intangible
Paul333
11-20-2002, 09:09 PM
This is way above me!!....Does something like above take you's all night or 10 mins??...is it hard work....sounds it :)

paul333
kandinsky
11-28-2002, 02:27 AM
Hi Soldat,

the way you described worked...

I did everything and now i got a cracked & bought version, but at least a lot more knowledge....

Thanks for everything


debugger for linux
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > debugger for linux
PDA

View Full Version : debugger for linux

nguyen_nam
11-05-2002, 06:26 PM
hi,

i have read some articles on hculinux.cjb.net just to see that windows rulez!

no wdasm, no sice, no trw, no smartcheck, no regmon , nothing :( what's good in linux cracking?

or maybe there are some good debugger (besides GDB) that I don't know yet?

that's really hard to do any works without those handy tools.

nguyen_nam
NervGaz
11-05-2002, 09:36 PM
As far as debuggers go you have fenris and privateice... dunno how good they really are but they're supposed to be a whole lot better than gdb... and there's strace() and a whole lot more that's really interesting for runtime patching and stuff like that... i suggest poking around some of the articles at www.phrack.org for more info on reversing in linux/Unix... mostly hacking related but still slightly reversing related info...
Nobody
11-07-2002, 04:12 AM
Try PICE and ltrace . Otherwise u had to choose the "programming" debug tools like adb and gdb . Dump utility like nm ,objdump and elfreader . IDA can do the great job on linux/unix static analysis . But it often need to dynamic watch the parameters pass and return from call . It need to set the break points at the target address . And we had better feed some symbols table to the debugger before go into the deep hell . Here i often got the windows version 1st then find out the right location exisit in data session to patch. Then i can find the same pattern in solaris/linux to patch them . The only difference is the big-little endian problem. This method work well in many cases . Besides,it is a need for program developer and dedicate engineer to test the software . So it is often leave some back-door in the initialization routine . One of the good place to patch is to change those initial values in global variables . All things go worse if you try to patch on the downstream . They jump to branch on certain conditions . Then you should take every cases if valid check goes everywhere . I have look the great help in the invent of the disassembly flow chart in the recent IDA 4.21 and 4.30 . That help me a lot in tracing the program flow in a global vision keep in my mind . With this flow chart , it can trace from the error of root back until the righ path . It often can judge it from the return status register EAX is one or zero . If you are not a legal user of IDA , i suggest you to have one to keep the latest version of IDA. Its new feature make my life easy in crack tools. And tools make my life further easy .
nguyen_nam
11-11-2002, 03:03 PM
>>But it often need to dynamic watch the parameters pass and return from call . It need to set the break points at the target address . And we had better feed some symbols table to the debugger before go into the deep hell . Here i often got the windows version 1st then find out the right location exisit in data session to patch. Then i can find the same pattern in solaris/linux to patch them .>>

I never got PICE work for me. Compiled against my kernel, but at last got some weird error.

I have used ald as alternative. Work quite good, thought it's not SICE :))

My approach was the same. Crack target in windows, do a dead listing in IDA and use ald to debug under Linux. So cracking in Linux is a kind of 2 in 1.


crypkey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > crypkey
PDA

View Full Version : crypkey

HELLBDER
11-05-2002, 11:12 PM
I have a crypkey protected app called pronest 5.0 it is a cnc profile nesting program for plasma,Laser or waterjet cutting. It seams to be useing a newer ver of crypkey. "although i can see traces of other protection that has ben taken out by the developer. The app i think is wrapped. And myself doing a total rip of the protection as far as i am conserned is out of my spectrum. What would be nice is to build a key gen for it. I have access to a working "but limited key" and have played with it a little trying to figure out what algorithim it was using to decipher but have had no luck doing it manualy. If any of you know where I can find some one that has had experience with the "newer" breed's of this crypkey protection please post a little sometin somethin on this board for me. Or if you can crack this thing in your sleep then that's fine too. "just show me how ya did it";)

My company has a copy of this software that is legal "True and blue" all the 3500 washingtons bought it. I am trying to crack it for educational purp's.
Woodmann
11-06-2002, 01:15 AM
Howdy,

I think you may be just a tad in over your head on this one.

Are you sure you are not missing some info about Sentinal ?
What is the Dongle? Or does this particular prog not require one?

1) Dongle : Yes/No ?
2) Name of Dongle.
3) Are you triple sure its Crypkey ?

There is a post in this very forum that concerns newer versions of Crypkey. Did you read it ?

OK, all fucking around over. You want a crack dont you ?
Just one little piece of crack to get you by. Next thing you know
your a crack junkie and hanging around foreign servers in languages you dont understand.

Now, I answered your request as you have asked it.
This I can assure you, no one will help you until you help your self. Especially since the last half of your post is lame.

Read the FAQ.

OBC
HELLBDER
11-06-2002, 02:52 AM
Yea I am triple sure that it is crypkey I have played around with this thing for month's there is no dongle for the version 5.0 of this software the 4.5 had a sentinal but the new 5.0 is only the cryptkey wrapper "5 .dll's and the .exe. I have a licensed version available. The thing is I would like to install it on another pc for my personal use. Hence I am the only person that uses it or know's how in my buisness so i dont think it is a total goddamn sin after getting my company to give them 3500 for the new ver. Yes I do want to crack the thing. I have read alot of shit about cracking the old shit but not the newer crypkey stuff 6.3 I beleve. And to tell you the truth I dont really understand a goddamn thing about the older stuff. These sites that are for newbie's seam to have all sort's of shit that go around about way of telling you nothing. Basicly you run the app link the dll's then dump them from ram?doing what?
or is that the other way around? Or do I runn the app break the line and insert a jump? Do I need to know Assembly? To read the code after i dump it? What and how can I make a jump with?
yes I read the section below about crypkey "how do you think I found this site?" They are newbie's holy shit! What the fuck are the badasses like! But realy every site or forum that I try and get help or find out some thing about this I get the same shit. I am not paying anyone to crack it or do I want somone to crack it for me all I am asking for is a little help that no one alse know's anything about I guess. This thing has become an obsesion to me I will crack the thing no matter what it takes. The cheez has ben set. And im hungry.:eek:
Woodmann
11-06-2002, 04:44 AM
Very good,

You have made me happy :)
The help you desire is here, you just need to be able to understand it. This is the biggest problem to all the new ones that come here. If you cant look at the code and understand the basics, you will not be able to advance. Go to protools and get the tools you need to see how the prog works.

This is not an easy road. If you can show an understanding then you will be able to understand the help that is offered.

Later, Woodmann
foxthree
11-06-2002, 07:02 AM
Neo: "I know what you're trying to do...."
Morpheus: "I'm trying to free your mind, Neo. But I can only show you the way. You're the one that has to walk through it..."

Is it just me or does anybody else think this dialogue resembles the above from Matrix. Great writing Woodmann...

Woodmann style :

Peace :)

Signed,
-- FoxThree


anybody try pop*3*hot yet?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > anybody try pop*3*hot yet?
PDA

View Full Version : anybody try pop*3*hot yet?

one_kelvin
11-06-2002, 03:20 AM
I've easily bypassed the registration on versions 1.6 and 1.7. (no unpacking needed)

1.8 may be over my head.

wdasm loads nothing.

no unpacker i use identifies it...

should i even bother?

you can get 1.8 here:

h**p://www.pocketpccity.com/software/files/SetupPop3Hotc.exe

v1.8 has been replaced by izymail @ h**p://www.izymail.com
FoolFox
11-06-2002, 07:19 AM
Hello,

FileInfo 2.5 report it as packed with ASProtect 1.22

Regards
FoolFox
karlitoz
11-06-2002, 03:56 PM
Hi, my first post here

im newbie too, and i hope to learn something from u

i've d'ling the pop3hot and analized with fileinspector xl

it said its EXE Protector 1.37a

greetings! & be good :)

(sorry for my english is very poor :( )
one_kelvin
11-06-2002, 11:49 PM
FoolFox:

Thanks dude! You are correct! I found FI 2.5 (i had 2.49a) and got the same result. I also downloaded asprotect and ran it on the file, and it confirmed it was already protected.Now back to work ... :P

KArlitos:

I got the same result, its a dead end. I'll update on progress. If ur a newb, try getting pop3hot v1.6 or 1.7...they are extremely easy to bypass...even i did it, lol.
one_kelvin
11-08-2002, 03:09 AM
from what i've been reading asprotect 1.2 is a tough bean to crack. I've taken a detour with my target and deduced the product id is a combination of getvolumeinfo of the volume serial number and the size of the drive. I started reversing the algorythm that the target used to get the product id from the getvolumeinfo stuff. I guess i thought maybe the reg code (to be placed in the registry) would be same getvolumeinfo (in the correct form) and the target would use the same algorythm to match the product id from it.

Anyone have any opinions whether this approach has merit? Right now i have a xcel spreadsheet coded with vba (with some nice looking forms i might add :P) to help me..I'm probably 25% done.

TIA>
FoolFox
11-08-2002, 07:36 AM
Hello,

that look like a trial and error approach... :), well, maybe
not the straight way but sometime it can give quick
results... up to you to see if you are willing to take time
for it...

You said :

>I started reversing the algorythm that the target
>used to get the product id

so, that's mean you have dumped the exe and got
a view of the checking routine also... is the exe
working ? using tools like RegMon in this case should
point you to the entry where he read the key, and
check it's format, if he read the key from registry...

Regards
FoolFox
+SplAj
11-10-2002, 03:52 PM
'file not found' 48 pffffff

maybe after de-aspring this target u should check out it's dependencies (see win/system....Encrypt6.ocx (a dll)) and use ;)

URL :-

http://www.devpower.com/encrypt/
karlitoz
11-12-2002, 05:32 PM
hi again

after many attemps to crack (and reads tutors), think is time to ask for help, target is the same above (hot3pop), :confused:

i try to using symbol loader to load the prog, but it dont break

i cant dissasemble it, wdsam32 hangs up, then i have read i must change c000040 to e000020 characteristic with pe-editor (procdump), but it still hang (when i try to run the modified exe it say file corrupted!)

then it try to follow another tut. from
http://www.lunarpages.com/codeinside (how to break into oep int03) but it dont break

whats wrong, someone please help! i need a little push :(

sorry for my english
and thanks at all!

me.
Manko
11-12-2002, 07:09 PM
Hey, Karlitoz! :)

You don't really need to break at start, that is, the info you need comes later and is very well documented on this site.
Just look in the unpacking section in some of the recent aspr threads and you'll even find tips on what to search for...
Aspr is selfchecking so it will be really hard to make changes before you unpack/dump.

disassembling aspr is a pain and wont acomplish much because it is packed too. :P

I was VERY respectful (afraid) of aspr before. I started instead with a good dose of "ordinary" cracking, learning asm/tools, and now that I've done some aspr, I think it's not that hard, really... ;P
(I had ofcourse read a lot and there are exceptions...)

What's extremely vital; is to protect softice from aspr tricks!
There are info on that here and in tuts/tools on the net also.

I'll be happy to help you but you need to SEARCH, SEARCH, READ, READ, READ first and THEN experiment! ;)

/Manko


Generic ways to find OEP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Generic ways to find OEP
PDA

View Full Version : Generic ways to find OEP

black_ice
11-06-2002, 05:28 AM
hi guys

is there a generic way to finde the OEP of packed softwares ??

please answer me
even if u have stupid idea

:confused: :confused: :confused:
+SplAj
11-06-2002, 06:32 AM
The easiest way is to get the packer/protector and use it on notepad.exe

then BPMB CS:Notepad_OEiP X

and the last packers code execution address is shown in the log window. U that and you see the 'signature bytes'. Usually a POPAD or POPFD with a ret or JMP OEIP.......

Then you find the same sequence in memory for your target.

(dont use G Notepad_OEiP, does not show the last execution)
crUsAdEr
11-07-2002, 01:49 AM
Sorry SplAj, but i cant seem to use your trick... condemn me if i am wrong but the log window you refered to the command window as well where we typed our command? i tried bpm OEP on a few program but it doesnt show instruction address of the previous instruction...

I am win2k SP3 with DS 2.6? No icedump loaded... what is wrong?

Thanks
crUsAdEr

P.S : Kayaker, yep this is the thread i was thinking as missing, cos i thought i just saw it for a while, then i went to do something else then come back there were quite a few new threads that move on top and i thought the thread was delete... lesson learnt, should have always scrolled down!!! Sorry about that :>... thanks kayaker.
black_ice
11-07-2002, 04:34 AM
thanx body

i tried this command but it does not work
can u explain more in details , it would be better if tell one target
u already unpacked it with this way and how u found the OEP
foxthree
11-07-2002, 05:17 AM
Hi Crus:

Sure it does. Take a look at the log window. For ex. I tried bpmb ShowWindow x and when softice breaks, see in the low window something like this:

Breakd due to BPMB:ShowWindow DR3
MSR LastBreakFromIp = XXXXXXX
MSR LastBreakToIp = XXXXXXXX

It is the FromIP that is of interest ;) BTW, how did you think, I found all those OEiP Sigs for OEPFinder ;)

Signed,
-- FoxThree
crUsAdEr
11-07-2002, 08:09 PM
Hmm,

what version of sice are you guys running? Is there any special setting for sice? I have tried various ways of bpm or bpmb for that matter... the only thing that appears on my log window is
Breakd due to BPMB:ShowWindow DR3

Yep, only ONE line above!!! Nothing else??? What is your config FoxThree?

cheers
crUsAdEr
esther
11-08-2002, 01:18 AM
Hi crUsAdEr,
Most probably you are using old softice.Try newer versions ;)bpmb showwindow x
hobgoblin
11-08-2002, 04:33 AM
I do get the same result as crusader. I'm using the latest Softice (2.4.7). Is there any special settings that needs to be set?

hobgoblin
neviens
11-08-2002, 07:25 AM
on DS4.2.7 (build 562), W2K, SP3.
Not working- Sice 4.0.5, W98.
Configuration files are installation default.
Neviens.
esther
11-08-2002, 10:42 AM
Hi All,
I'm using win98.Not sure of Winme or win2k.My sice is ds 2.6

Regards
evaluator
11-10-2002, 04:41 PM
You, guys, failed to read FUQ..

What processors you have?!....
esther
11-10-2002, 04:52 PM
>You, guys, failed to read FUQ..
>What processors you have?!....

FUP :D


ASProtect - new OEP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect - new OEP
PDA

View Full Version : ASProtect - new OEP

BruceLee
11-06-2002, 10:38 AM
HTML Link Validator v.3.45
==========================

Download size < 1Mb

ASProtect v1.23,

maybe not new, but no more 61 FF E0 or C3 90 90 90 90 90 90 90 90 90 ... to find OEiP!

PUSH 00
JMP 501EB4 ; jump to OEP ???

Search for IAT and found this:
IATRVA: 0013F398 IATSize: 000001EC
but only kernel32.dll thunk!

hmm, look on it!

Regards,
Bruce Lee
foxthree
11-06-2002, 11:07 AM
Hi Bruce:

Yep, this one looks kinda new ... I say kinda 'coz I vaguely remember seeing this sig looong back. In this proggie, OEiP sig is PUSH EAX, RET. I'm trying to rebuild this program to confirm the OEiP that I found. Just hang on!!!

Using the OEiP I "predicted", I'm able to see all the thunks (advapi, gdi, user etc.). So, mostly it is right but let me verify....

Signed,
-- FoxThree
esther
11-06-2002, 11:31 AM
Hi,
Its cryp32 not asprotect.Looking for further information ;)
foxthree
11-06-2002, 12:36 PM
Hi Esther:

Are you sure? This one is from Lithopssoft. It is ASsPR...

Signed,
-- FoxThree
BruceLee
11-06-2002, 12:48 PM
Hi!

Yes, this is asprotect, I'm 99% sure!

I resolved IAT.

Now I must fix dump!

Best regards,
Bruce Lee
esther
11-06-2002, 01:06 PM
Hiya FoxThree,

The file I download is 676kb
setup file name is hlvsetup
Did I downloaded the wrong one?

Regards
foxthree
11-06-2002, 01:22 PM
That's the one. It is ASsPR indeed :D

Signed,
-- FoxThree
BruceLee
11-06-2002, 01:27 PM
I think my OEiP is wrong !!! :(

Did you find the OEiP, foxthree?

Bruce Lee
esther
11-06-2002, 02:09 PM
Hi all,
Yep its assprotect and the dll is cryp32 :P
foxthree
11-06-2002, 02:27 PM
hey BruceLee:

You might benefit from taking a look at NchantA's tut at tsehp.cjb.net (Unpacking Asprotect). It is an "exact" one but the IT table is mangled differently... Maybe Alex is mix-n-matching.... however, I managed to waddle through my notes to find that good tut by NchantA. Like I said, I remember seeing this one before ;)

Signed,
-- FoxThree

PS: Esther: Hmmm... what dll??? am I missing sumthing here :(
foxthree
11-06-2002, 03:07 PM
Hey:

I think I have pretty much the correct OEP (XX1EB4) but still the unpacked proggie is crashing :mad: I've debugged for the past 1/2 hour without luck and I always get 0xc0000026 at 77FB186C???? None of the code that causes this exception look like ASPR checks?? Any clues/pointers?

Signed,
-- FoxThree
esther
11-06-2002, 03:49 PM
Hi all,
My program is weird.It got a error message "error loading library type" after executing.The program doesn't start at all ;ppp.
BruceLee
11-06-2002, 05:00 PM
Hello foxthree, esther!

I think there is antidump routine or something similar. I can't dump with /pedump. If I dump with LordPe I have same problem as you! :(

Bruce Lee
Pr1mus
11-06-2002, 08:48 PM
It uses some sort of anti-imprec routine ans some other tricks
i´ll have a more detailed look later on this week prolly.
Btw, Bruce Lee mail me asap plz :)
BruceLee
11-06-2002, 09:14 PM
Can't mail you, sorry. My account is to small. I found IAT, see attachment. I think is good.

Problem is in OEP :(

REgards,
Bruce Lee
hobgoblin
11-06-2002, 09:19 PM
I do get some different findings than the rest of you guys..
I found the oep to be 401000, the import table address to be 53F138, size F8C. This program seems to use the latest import protection to render RV and Imprec useless. But you can get around this one by doing as +Splaj have explained. Besides from that it looks like an "older" version. You have 4 dips before going to the OEP. The first one is quite different than usual, but the 3 others are as usual. There is no execution of code in higher memory before jumping to ordinary code and the OEP, as in the latest version of Aspack.
I manipulated the program to build a clean import table during te unpacking using the method described bu evaluator. After that I just used RV to get the imports. Got it all except the usuall ones.

My problem is here:

0187:004F5EA9 55 PUSH EBP
0187:004F5EAA 68F45F4F00 PUSH 004F5FF4
0187:004F5EAF 64FF31 PUSH DWORD PTR FS:[ECX]
0187:004F5EB2 648921 MOV FS:[ECX],ESP
0187:004F5EB5 803D6987530000 CMP BYTE PTR [00538769],00
0187:004F5EBC 740A JZ 004F5EC8
0187:004F5EBE 68588B5300 PUSH 00538B58
0187:004F5EC3 E8D44B0200 CALL KERNEL32!EnterCriticalSection
0187:004F5EC8 83C307 ADD EBX,07
0187:004F5ECB 83E3FC AND EBX,-04
0187:004F5ECE 83FB0C CMP EBX,0C
0187:004F5ED1 7D05 JGE 004F5ED8
0187:004F5ED3 BB0C000000 MOV EBX,0000000C
0187:004F5ED8 81FB00100000 CMP EBX,00001000
0187:004F5EDE 0F8F93000000 JG 004F5F77

When the program is executing the call to Entercriticalsection, it crashes. This call is also made in the unpacked version.
Well, this is how far I got right now. Does someone have any experience with this?
Will post more findings, if any..

hobgoblin
Iwarez
11-06-2002, 10:39 PM
I think the OEP is at 401000. After extraction etc. etc. I found the standard entrypoint stuff at 401000.

BTW. Once again I pressed the new thread button where it should be reply.... Damn buttons. It's about the HTML parser.

EDIT: I hope this is the one you meant (Kayaker)
JMI
11-07-2002, 12:25 AM
Iwarez:

If you press the "new thread" instead of the "post reply" button, you can press the "edit" button and then there is a "delete" button at the top to completely remove your thread. I beleive you can only delete the thread if you start it, but using the "edit" button" you can delete a "reply" you made.

Regards.
crUsAdEr
11-07-2002, 01:11 AM
Hi guys,

this one is an old trick discussed by Tsehp and SplAj long long ago... search for Chameleon Clock and you will find the answer...

Watch the first DIP *hint*
it is a good idea to look at all the dips cos all of them serve a specific purpose...

LOL.. i wasted 1 hr woondering what the hell went wrong when i finally realised Alexey got me

push ebp
mov ebp, esp
push [GetVersion_result]
pop eax
mov esp, ebp
pop ebp
mov eax, [GetCommanLIneA_result]
ret

LOL.. was tracing and wondering how the hell my commandline looks funny and the prog crashed there... guess i must be careful cos Alexey is using old trick to bluff hasty cracker like me :(...

regards
crUsAdEr
Iwarez
11-07-2002, 06:15 AM
I tried to delete it but it said I had no rights.
JMI
11-07-2002, 06:27 AM
Iwarez:

That's because your "thread" was moved here before you tried to delete it.

Regards.
BruceLee
11-07-2002, 08:50 AM
For me this function is GetCommandLineA not GetVersion. OEP is 401000. Program still crash on location 4f5ec3, call Entercriticalsection!

Bruce Lee
crUsAdEr
11-07-2002, 09:36 AM
Yep Bruce Lee,

I realised my mistake :)... yeah... OEP is NOT 401000!!! so search for Chameleon CLock and give it a try, or check out those dips...

I can post the answer now but hey, what is the fun without trying... hours of reading all the AsProtect threads do pay off :)...

regards,
crUsAdEr
hobgoblin
11-07-2002, 03:30 PM
Well, I figured it out. first, I too recalled the discussion around Chamelion Clock (or whatever the name was..). And then I tried some new things while dumping the program. I agree that the OEP isn't (or maybe shouldn't be is a better word...). But when I tried to dump it from what looks like the original OEP (the address listed in the jump instruction at 00401054), it still crashed. More accurate: it froze a few instruction down from the OEP. And the reason is that the program tried to read and use an adress that wasn't accessible, the esi/eax register was emtpy. So it froze. The adress that was supposed to be read was loaded into memory in the second call upwards from the jump instructions at 00401054. The program need this information to run properly. Another thing: by checking out the first dip, which is unusal long, it looked to me as the program did some register checking. I tried to ret from this call, then go to the new OEP and dump it. No success. It failed to even get there. So after some trial and error this is what worked for me:
In the high memory just before the call to the first dip is executed, there is a conditional jump. I forced the program to jump, then put the program into a loop at address 00401054 and dumped it. After pasting in the rebuild IAT, I set the new OEP to be 401000. And guess what: it runs like a dream.:)

just me sharing some info...

regards,
hobgoblin
esther
11-07-2002, 05:20 PM
Hey Hobgoblin,

Sorry I can't execute this program on my machine :(
Guess I have to give up this program.

A small experience ;)

0030:00400300 04 10 40 00 03 07 42 6F-6F 6C 65 61 6E 01 00 00 ..@...Boolean...
0030:00408000 00 00 01 00 00 00 00 10-40 00 05 46 61 6C 73 65 ........@..False
0030:00401020 04 54 72 75 65 8D 40 00-2C 10 40 00 02 04 43 68 .True.@.,.@...Ch

if the OEP is decrypt you will see it

Regards
JMI
11-08-2002, 03:51 AM
Bruce Lee:

Follow the advise and do a search using Chameleon Clock and you will find this thread:

http://www.woodmann.net/forum/showthread.php?threadid=2565

which discusses the "Entercriticalsection" problem.

Doing a search with "entercriticalsection" will find several additional entries, including this one:

http://www.woodmann.net/forum/showthread.php?threadid=2775

where +Spl/\j discusses how to avoid the problem.

Again this is to demonstrate the value of searching yourself for the solutions to your problems, rather than relying on others to solve them for you.

Regards.
crUsAdEr
11-08-2002, 06:18 AM
Wow JMI :D

that was efficient, just read my posts in Feb and man, I was staggering towards making my first Asprotect kill... gosh and i was asking silly question like everyone else.. does bring back some good memory heh, FoxThree :>?

Yep, then now i realise that HLV.exe is same case as Reg Organizer... even OEP looks similiar!!!

Yep, i guess AsProtect is really over-discussed :>...

Anyway, i just coded a beta version of Asprotect plug-in for Imprec/Revirgin.. anyone care for testing? It handles all the emulated APIs only!

regards
crUsAdEr
BruceLee
11-08-2002, 08:39 PM
Hello crUsAdEr, JMI, esther, hobgoblin, Pr1mus, Splaj !

Check out!

New Chameleon clock:

Chameleon Clock v3.0 beta 4 / November 6, 2002.

ASProtect v1.23.b

OEP=4BEB2C

Only one dip.

My IAT is attached! I use all trick, but I can't make to work it!
It's hard! Too much!

Bruce Lee
BruceLee
11-08-2002, 08:40 PM
My resolved IAT!
Pr1mus
11-08-2002, 08:54 PM
:)
crUsAdEr
11-09-2002, 12:36 AM
Hi Bruce Lee,

What did you do with the first dip then?

regards,
crUsAdEr


Reversing CD Phone Book
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Reversing CD Phone Book
PDA

View Full Version : Reversing CD Phone Book

narnar2000
11-06-2002, 03:28 PM
Hi all,

Anyone have any ideas about this? I have a phone directory on CD and I want to be able to reverse it so that I can put in a number and get back an address and name... I think it might be a Paradox database but I'm not certain. Any help would be good.

Thanks
FoolFox
11-07-2002, 07:33 AM
Hello,

Well, except if the directory is kind of encrypted, this
should not be too hard.

First i would extract 3 or 4 samples of what kind of
data are in the DB using the original soft.

Then, try to figure the way the data are stored, ex :

1st field : Index, 2 byte
2nd field : Name, 30 bytes
3rd field : etc....

Once you have done that, you are ready to write a
little app that will fetch any data in the form you want.

If it's a standard/common DB, good chance that you will
find even some tools to reduce this process

Regards
FoolFox
disavowed
11-07-2002, 04:04 PM
alternatively, you can use infospace's reverse lookup: http://kevdb.infospace.com/info/wp/reverse.htm
narnar2000
11-07-2002, 04:32 PM
Thanks for the replies. I don't know much about Paradox dbs but I'm pretty certain that it is encrypted. I've run Paradox password crackers on some of the files on the CD but they haven't helped. It is possible that it's not a Paradox db after all... I've no way of knowing (except from what I read elsewhere on the Web regarding this CD, see http://www.hackwatch.com/~kooltek/reversecd.html).
I've tried to import the db into Access but it complains that "The external table is not in the expected format".

As regards using http://kevdb.infospace.com/info/wp/reverse.htm, I don't live in the States, I live in Ireland... And to the best of my knowledge, reverse phone directories aren't permitted here... (they certainly don't exist publicly outside the hands of the telecoms companies and the government).

Is there a way to identify what type of db it is?

Here's a DOS listing of all the files in the data directory of the CD:

Directory of D:\TELECOM3

09/10/1998 13:55 <DIR> .
01/01/1601 00:00 <DIR> ..
18/09/1998 00:30 921,768 A1.ADH
17/09/1998 23:26 24,857,638 A1.ADJ
18/09/1998 00:49 2,214,696 A1.BRO
18/09/1998 00:18 922,148 A1.HHH
17/09/1998 23:30 262,162 A1.HSH
18/09/1998 00:48 12,979,170 A1.IND
09/10/1998 09:57 233 COMPWIN.SET
20/07/1998 11:25 223,535 Crp.bro
18/09/1998 00:06 4,024 DC.HHH
17/09/1998 22:38 262,162 DC.HSH
18/09/1998 00:48 3,402,103 DC.IND
18/09/1998 00:48 379 DCP.BRO
18/09/1998 00:06 4,024 DCP.HHH
17/09/1998 22:40 262,162 DCP.HSH
18/09/1998 00:48 3,402,103 DCP.IND
09/10/1998 09:57 1,280 FULLWIN.TEM
18/09/1998 00:32 145,340 IT.ADH
17/09/1998 23:37 1,214,697 IT.ADJ
18/09/1998 00:49 334,981 IT.BRO
18/09/1998 00:18 144,544 IT.HHH
17/09/1998 23:37 262,162 IT.HSH
18/09/1998 00:49 625,179 IT.IND
20/07/1998 11:25 101,122 Icp.bro
31/07/1998 10:09 67,162 Inp.bro
20/07/1998 11:24 100,516 Irp.bro
18/09/1998 00:46 1,082,384 MA.ADH
18/09/1998 00:39 25,960,045 MA.ADJ
18/09/1998 00:48 2,339,924 MA.BRO
18/09/1998 00:33 973,444 MA.HHH
18/09/1998 00:32 262,162 MA.HSH
18/09/1998 00:48 13,496,450 MA.IND
18/09/1998 00:23 705,416 NM.ADH
17/09/1998 22:55 17,394,207 NM.ADJ
18/09/1998 00:06 703,996 NM.HHH
17/09/1998 22:58 262,162 NM.HSH
18/09/1998 00:48 9,072,617 NM.IND
18/09/1998 00:06 42,992 NMF.HHH
17/09/1998 23:05 262,162 NMF.HSH
18/09/1998 00:48 8,326,394 NMF.IND
18/09/1998 00:48 15,710,343 NMP.BRO
18/09/1998 00:16 5,342,672 NMP.HHH
17/09/1998 23:01 262,162 NMP.HSH
18/09/1998 00:48 13,000,496 NMP.IND
09/10/1998 09:57 133 PROG_RUN.LOG
18/09/1998 00:48 339 RT.BRO
18/09/1998 00:06 4,024 RT.HHH
17/09/1998 22:42 262,162 RT.HSH
18/09/1998 00:48 3,402,076 RT.IND
18/09/1998 00:32 4,036 SD.ADH
17/09/1998 23:34 6,806,846 SD.ADJ
18/09/1998 00:49 475 SD.BRO
18/09/1998 00:18 4,036 SD.HHH
17/09/1998 23:35 262,162 SD.HSH
18/09/1998 00:49 3,403,454 SD.IND
17/09/1998 22:13 18 STOPWORD.DAT
18/09/1998 00:06 9,792,060 SY.HHH
17/09/1998 22:36 262,162 SY.HSH
18/09/1998 00:47 16,048,694 SY.IND
18/09/1998 00:49 71,324,014 TELECOM3.DAT
17/09/1998 22:13 275 TELECOM3.DEF
18/09/1998 00:48 50 TELECOM3.ENK
17/09/1998 19:09 291 TELECOM3.FB4
18/09/1998 00:49 420 TELECOM3.FDL
17/09/1998 22:17 3,402,068 TELECOM3.IND
17/09/1998 22:17 34,020,980 TELECOM3.INF
17/09/1998 22:30 45,927,864 TELECOM3.NOD
20/09/1998 10:24 5 TELECOM3.QA
17/09/1998 19:09 99 TELECOM3.RB4
18/09/1998 00:49 118 TELECOM3.RB5
18/09/1998 00:49 118 TELECOM3.REC
18/09/1998 00:49 218 TELECOM3.RUP
18/09/1998 00:48 63,848,448 TELECOM3.TTI
09/10/1998 09:57 0 TEMDOS.MNU
09/10/1998 09:57 21 TEMWIN.MNU
05/07/1993 16:14 1,417 VALIDCHS.DAT
75 File(s) 426,694,401 bytes
2 Dir(s) 0 bytes free

Do any of these file names/extensions mean anything to anyone?

How would I begin to solve this?

Many thanks,

narnar2000
naides
11-07-2002, 09:08 PM
I do not know most of the file names and extensions you posted but:

Look at the bigger files (they should contain most of the databases) They tend to be in the form:

A1.ADJ and then you find a A1.IND about half the size.

Keep looking and you see NM.ADJ and lower down NM.IND

and so on. Smells to me that the ADJ files contain the bulk of the data and the IND files are indexes for the correspondent data. There are some .IND files that do not correspond to an .ADJ file, but their name is a derivative of an .ADJ file i.e.

There is one NM.ADJ

but you find NM.IND, NMF.IND NMP.IND, all of them bulky files, but around half the size of the .ADJ.

Look at the contents of each .ADJ files with an hex editor. If it is a database, it may contain a header and then some recurring structure: the records.
It may or may not be encrypted. Chances are, this being a commercial product, it is encrypted.

One course of action would be decrypting and reconstructing the database(s), then designing your own reverse searcher.

An interesting and True-Blood Reverse Code Engineering project.
FoolFox
11-08-2002, 07:22 AM
Hello,

About h**p://www.hackwatch.com/~kooltek/reversecd.html,
well, i wouldn't take that as a fact. From what it appears to
me, someone told someone that probably this may be a
paradox DB. Without even 1 clue about what have made
someone guess that.

So far, i think that focusing on Paradox only with one info
like that would be too restrictive. You may loose much time
trying all paradox related stuff where you may have a
totally different DB.

As have said naides, look at the big files. And if they look
encrypted, then you'll have to dig the exe that is grabbing
the info from the DB.... have you already take a look at the
main app ??

Regards
FoolFox
foxthree
11-08-2002, 11:25 AM
Some observations (may be obviously made by others) that I'd like to mention:

1. Look at PROG_RUN.LOG (looks like some king of log where in you can gather some "inside" info)
2. AD/MN ==> A-to-D, M-to-N??? alphabetically ;)
3. Just open the .DAT files in a hex editor and see if you can find regular text. If yes, chances are it is not encrypted.

Also, the best way to verify if it is Paradox Db is to get a "real" paradox Db and search for "signatrue" strings and see if these are present in the .DAT philes ;)

Signed,
-- FoxThree
narnar2000
11-09-2002, 03:36 AM
Thanks again for the replies...

I looked in *.ADJ with WinHex - names and addresses are stored in plantext here... Along with a whole load of non-alphanumeric bytes. The names are stored alphabetically, as you'd find them in a phone book, but following each name are many 'garbage' bytes (I've noticed the number of such bytes correlates to the frequency of the surname, ie SMITH has thousands of bytes immediately after its listing, whereas an uncommon name like SMIROV has only a few). The names of areas, towns etc are also stored in this fashion.

TELECOM3.DAT contains no names, addresses or numbers in plaintext format.

The string 'Paradox' is not in any of the files, so maybe it's no Paradox db after all.

None of the files in the directory contains my phone number in plaintext, so it seems the phone numbers table is encrypted.

I'll see if I can glean anything from the app with SoftICE, but I was hoping I wouldn't have to go down that route...

For what it's worth, here are the contents of some of the smaller plaintext files:

PROG_RUN.log
Command REM done

Command SET_LOGFILE done

Command SET_DIR done

Encrypting...
Encryption Complete.
Command ENCRYPT done

TELECOM3.RUP
DC VC 8
RT VC 8
NM VC 8
BD VC 8
A1 VC 8
SD VC 8
PH VC 8
IT VCR124 8
SL VCR124 8
SY VCS 7
MERGED MA C A1 IT

TELECOM3.FDL
DC 1 C 0 * Type:
RT 1 C 0 * Record Type:
NM 1 C 0 * Name:
BD 1 C 0 * Business Desc:
A1 1 C 0 * Address:
SD 1 C 0 * Directory Area:
PH 1 C 0 * Telephone Number:
IT 1 C 0 * Address:
SL 1 C 0 * Indent phone No's:
MA 1 C 0 * Address:

TELECOM3.DEF
field NM 0 25 0
title 'Name'
tab-stop
text ' '
title ' '
tab-stop
field A1 0 30 27
title 'Address'
tab-stop
text ' '
title ' '
tab-stop
field DC 0 11 59
title 'Type'
tab-stop
text ' '
title ' '
tab-stop
field SD 0 4 71
title 'Area'
tab-stop
newline

TELECOM3.FB4
DC 1 C 0 * Type:
RT 1 C 0 * Record Type:
NM 1 C 0 * Name:
BD 1 C 0 * Business Desc:
A1 1 C 0 * Address:
SD 1 C 0 * Directory Area:
PH 1 C 0 * Telephone Number:
IT 1 C 0 * Address:
SL 1 C 0 * Indent phone No's:

Thanks,

narnar2000
naides
11-10-2002, 08:28 PM
OK narnar.

What yu describe in the .ADJ files sounds more like the structure of an index file, in which a search term i.e 'SMITH' is associated with all the occurrences of such term in the actual database i.e a lot while other search terms like 'SMIROV' is associated with a few occurences.

These findings suggest that the true database is perhaps TELECOM3.DAT, the biggest file in the lot, bu it does not contain actual alphanumeric data, only tokens to the search terms, which are stored in the indexes.

That is bad news.
Good News:

Relational databases coding is quite an involved procedure. A company in their right mind would not re-invent the wheel and come up witha brand-new database system when other, very powerful and thoroughly debugged and tested systems are available.

Look in the web site of the company that made the CD. Look in their help files, look in their patent lists, try to find out what database format they used.

I AM NOT SURE THAT THE WORD 'PARADOX' IS THE SIGNATURE OF PARADOX DATABASES.

The number of commonly used db in windows is small. search and dig their organization and signatures, then try to identify the db system your CD uses
Antipodean
11-11-2002, 05:22 PM
>TELECOM3.DAT contains no names, addresses or
>numbers in plaintext format.

This is probably the root database file, and may contain pointers to all the other files. I don't know how large an area the data base covers, but my guess would be that htis would be the root place for selecting area codes, or however it is selected.

>None of the files in the directory contains my phone
>number in plaintext, so it seems the phone numbers
>table is encrypted.

If there is stuff in there in plain text, then I doubt the numbers are plain text, or encrypted. A more compact way of storing numbers would be as binary numbers. A 64 bit number would be large enough to store the number of almost any phone number within an area code. If an area code is part of the number then that may be a seperate 16 or 24 bit number.

Another thing you may wish to consider, is how the plain text strings are stored. My pick would be that there will be a length code of some sort, a byte is probably sufficient, to store the length of a string in a field. If there is no length byte, then the possibility of storing lots of spaces unneccessarily exists.

If this is the case you may be able to take a short cut into reading the table using pascal.
squidge
11-11-2002, 11:28 PM
Just a quick tip - I've seen databases store large numbers (eg. phone numbers) using nibbles before now, this way you can easily store 2 digits of the number per byte. Other's just store it as an unsigned long or the like.


LordPE dumper vs. Icedump vs Procdump etc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > LordPE dumper vs. Icedump vs Procdump etc
PDA

View Full Version : LordPE dumper vs. Icedump vs Procdump etc

Lbolt99
11-06-2002, 03:44 PM
Hi, was just wondering what the general consensus is as far as dumper of preference. From what I can tell, they all work pretty well; I've gotten working dumps in general regardless of which I've used. Although I haven't extensively tested them. Would like to hear what the "dumper of choice" is, and why. It seems everyone uses one or the other. Thanks
r4g3
11-06-2002, 07:58 PM
i find icedump to my liking. Mainly because it`s a 'all-on-one' tool. No need to suspend the target with jmp to sefl loop or icedump :)
LordPE is a cool PE editor. ProcDump is a bit old & supersessed by IceDump.
squidge
11-06-2002, 08:11 PM
ProcDump can dump a few old packed proggies, but is now no longer supported or being developed. It's getting a little old now.

LordPE and Icedump are you best bets.


Hasp4 Double Trouble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp4 Double Trouble
PDA

View Full Version : Hasp4 Double Trouble

hack3r2k
11-06-2002, 09:54 PM
Hi there !

My problem is kinda big i think cause i have a HASP4 envelope on a program. The thing i need is the HaspCode() algorithm for hasp4. It will be nice if someone would share it with me. If not at least i ask him to calculates responses for - Seed = DF3 Pass1 =0292 Pass2 = 2DF1. I tried to calculate them but i'm not sure that i obtained the corect result that is AX=0048 BX=4202 CX=4808 DX=004A.

best regards,
.:hack3r2k:.
cyberheg
11-07-2002, 10:12 AM
Without a working dongle for your target you will probably fail hard.
Once you get past the few first checks you will probably see that it sends smaller or larger amount of data through the dongle for encryption/decryption.
In some of the Hasp4 envelopes I've seen it sends the whole section through the dongle in pieces like 0xf000 bytes or there about. In other newer versions (march 2002 which I believe is the newest) it does alot of pseudo random checks by decrypting smaller pieces of code and compare it with a precomputed table which is kinda annoying since all it's code is obfuscated which just adds a bit more fun to the debugging.

Good luck.

// CyberHeg
hack3r2k
11-07-2002, 09:31 PM
This happens also on HASP4 standard ? I seen some progs prot with envolope that worked after filling the regs with the correct values... Anyway u didn't said to me if those values i posted are correct...

bye
cyberheg
11-08-2002, 08:11 AM
Originally posted by hack3r2k
This happens also on HASP4 standard ? I seen some progs prot with envolope that worked after filling the regs with the correct values... Anyway u didn't said to me if those values i posted are correct...

bye

Yes, also on Hasp4 standard. What else does there exists but standard? The most common one is Hasp4 M1 or TimeHasp4. Rest are just Nethasps and the M4 model(s).
No I didn't tell if your values are correct because I don't know if they are correct and frankly I don't care either.
There doesn't exist any public discovered algorithms of HaspCode for Hasp4 dongles.
How did you find those values anyway? Used the HaspCode algorithm for Hasp3? or find the checking from the envelope?

// CyberHeg
tgodd
11-08-2002, 01:11 PM
HaspCode works the same for all versions of Hasp.
It is mearly a bit addressing scheme.
The code and docs are out there everywhere.

All readers go out and retreive the Linear version of the
Hidden number, and as far as any of the docs out there, it
would appear that nobody has been able to base the results
of HaspCode on the Password, nor has there been any reason too.

So unless you know the Linear version of the hidden number, I
am afraid you are S.O.L.

And judging from the fact that nobody else has been able
to tell you this, it would appear as though most peoples
knowledge of this is mearly based upon reversing, and not
a true understanding of the Hasp.

Get a reader... Read the lock device... And submit the Lock data,
and you'll have a dozen or so people claiming to be experts, with all the answers you need. In truth all you would need then would be an emulator to do a validation of the Seed value, and not need to listen to these so called 'Experts'......

I believe there is a reader and emulator on Crackz site.

Anyhow, have fun and good luck.

Regards,
TGODD
Iwarez
11-08-2002, 11:28 PM
The internal hasp codes can be rebuild from the passwords given. I used that method succesfully on 4 dongles.

@Hack3r2k
Your returned values are wrong. Even if you swapped the passwords your codes are still wrong. Not even close.
tgodd
11-09-2002, 01:02 AM
I do not doubt this.

However what would be the need if you had access to the lock anyways.

I would also be curious as to the algo used to do this.

Regards,
TGODD
Iwarez
11-09-2002, 09:25 AM
I was a while ago very curious about the HASP as the company I work for uses them and I wanted to know secure they where. I searched the whole web and found what I needed. You should also go and search. Besides the fun it will also give you knowledge.
tgodd
11-09-2002, 03:44 PM
Again I itterate.

The only time you would need to calculate the Haspcode from the seed would be if you did not have the lock device.

I was the original reverser of the Hasp and I do know how to calculate them from the passwords, but this method was never implimented in our emulator, which was the first by at least 3 years.

So knowledge is not something I am in need of at this time....

:D

I was only curious to see the algo that YOU used to calculate the seed. But hey thats cool if you do not want to share.

I do understand that.

Regards,
TGODD
Iwarez
11-09-2002, 07:40 PM
IC, sorry for that.

I used the source at http://anticrack.p15106404.pureserver.info/modules.php?op=modload&name=News&file=article&sid=3407 to create my emulator.

The reason why I emulate is that I did want to run our program without the dongle. It's a VB program so I replaced the hasp32vb.dll with a selfmade dll. I could offcourse include the complete seed table in my dll but I wanted it to be generic. So I was very pleased with the above mentioned source. Since then I knew the HASP sucks. :D
CrackZ
11-10-2002, 07:24 PM
Hiya,

I've written a reply to this post about 3 times now, and the msgboard keeps timing me out and I lose it (I'm pissed off!), final try ;-).

With respect to the previous posts.

1. The algorithm posted in the link before has been known for 4 years or more, it was probably (don't want to deromanticise the whole zen pondering nonsense) recovered from an errant HASP library, which can still be found on the web somewhere, load it into IDA and away you go.....

2. The old HASP envelope depended on HaspCode() responses to a given seed/passwords for decryption, Quine's essay describes the entire process (MD5 ad nauseam). The new HASP 4 implementation of HaspCode() AFAIK changes only the secret table, this can be recovered with either the dongle or (maybe?) some knowledge of some good responses to a given seed.

3. The HASP 4 envelope does NOT depend on HaspCode() for its decryption, instead the real work is by new block services (Encode/DecodeData 0x3C/0x3D), this is the REAL task, and if they've done it half way good (think sproQuery() here), its going to be very secure for a while.

4. Rumours. I heard that someone has these new encode/decode services mapped out (I don't believe this to be true). From someone with close links to Aladdin, I was informed there is not a generic solution, they'd be crazy to do more security by obscurity imho so I believe it to be true, effectively this implies you need access to the dongle, and the dream of a generic emulator is defeated right there.

5. My HASP drivers for HASP 3 are available on the net. If you want my HASP pack with source or someone wants to host it, I'll upload.

Regards

CrackZ.
tgodd
11-10-2002, 07:35 PM
You are 99-100% correct CrackZ.

the 1% being that one Martin McKeen claims to have
cracked the Hasp4 3c and 3d.

I can not confirm this, nor has anybody else that I am connected to.

The SproQuery (legacy *nonEnhanced) has however has been cracked for quite some time now. (93-94). That would have been Rainbow SuperPro.

There is still some legacy software out there which does only use the Hasp Function 2 (HaspCode). As far as the Hasp 3c & 3d, there is now way to go crazy randomizing what you throw at the lock (if only to screw a cracker up), because there is no way for the vendors to validate the random queries.

So one could find the valid queries and still emulate them.
Could make for a pretty hefty table however.

Regards,
TGODD
hack3r2k
11-10-2002, 08:03 PM
Hi !

Thank you all for your suggestions. I guess that without the original dongle i can't make that shit work. So the only chance i have to crack that proggy is to put my hands on it's dongle and spy it's answers at 2, 3C, 3D services... I think that it's possible no ? :mad:

best regards,
.:hack3r2k:.
JMI
11-10-2002, 08:20 PM
CrackZ:

Have no information to contribute to this interesting topic other than a possible solution for CrackZ's timeout problem. Having run into this a few times myself on longer posts, I've taken to composing replies in a word processor and copying and pasting into the Reply box. That way your "time" in the box can be limited. Worked for me. Should work for you.

Regards.
tgodd
11-10-2002, 08:29 PM
Yes it is very possible.

The function 2 is easy.
Just follow the link that Iwarez posted.
You'll get alot out of that, and the code snippet there will do exactly what you want.

The 3C & 3D you will have to log those to find the apropriate responses, if in fact you need to at all.

Do not be discouraged by anyone here.
Some of us are more knowledgable than others but that comes with experience.

And never back down from a daunting challenge, there is always something to learn even if you are not successful.

As far as the hasp goes, it was originally cracked in 92'-93'.

and cyberheg,
The HaspCode function (Hasp Function 2) is the same for all hasps, with only one exception which I saw 8 Years ago (before that Hasp4).

Regards,
TGODD
Iwarez
11-10-2002, 08:47 PM
@CrackZ
I would like the HASP package you made. Only thing it could do is make my HASP knowledge a bit better. Thanks for your time.
CrackZ
11-11-2002, 12:02 AM
Hiya,

My HASP package proved to be a bit big for the upload, so I've sent it to Woodmann and hopefully he can add it somewhere to my old site + a link here and you can figure out what to do from there I hope. The code was based on the HASP v4.65 drivers, but should work with the current v4.7 on Aladdin's site, it takes advantage of Aladdin's desire to modularise their code by merging everything into hardlock.*.

Tgodd: Indeed I was contacted by the aforementioned Martin McKeen, but he seems to be hard to track down and from the crumbs I gleened from him I think his solution requires access to the dongle. Indeed with sproQuery() I was referring to the latest or last generation of Rainbow creations (advanced algorithm).

JMI: Exactly what I ended up doing in the end *grin* and am doing now ;-), writing it in NotePad, thanks for the suggestion though.

Iwarez: Logging your HASP calls shouldn't really be too much of a problem with the dongle, you could do it either at API or driver level, I hope to implement some code to log 0x3C/0x3D services sometime, I think unpacking is probably a better way to go to be honest, rather than emulation.

Regards

CrackZ.
Woodmann
11-11-2002, 12:27 AM
http://www.woodmann.net/crackz/CrackZ'sHASPPackage.zip

Say thank you to CrackZ :D
JMI
11-11-2002, 01:19 AM
A BIG THANK YOU to CrackZ for his many efforts and contributions to the RCE knowledge database.

Regards.
MTB
11-11-2002, 02:01 AM
I double the really big thank you to CrackZ. Several questions for crackz, how many man months did this take you? How did you come up with the method?

THANKS AGAIN

MTB
tgodd
11-11-2002, 02:18 AM
Just out of curiosity.....

CrackZ

What locks can you emulate?

TGODD
Iwarez
11-11-2002, 06:38 AM
Thank you Crackz for uploading this. I'll take a look at it and try to learn... BTW, it wasn't me who wanted to log the hasp calls...
CrackZ
11-11-2002, 10:19 PM
Hiya to all.

In briefness:

1. Iwarez, sorry, I realise my post was meant to be to hack3r2k regarding logging ;-), sometimes the eyes are too quick for the mind or perhaps the other way around.....

2. MTB, most of the code, the int 6 handler, the decryption routines, even the decrypted data were all dumped from the HASP drivers themselves, actually decrypting them and so on proved to be little more than time consumption in SoftICE, although I had to force some of the 11 routines to be decrypted manually resulting in some pretty hard crashes ;-). About 2 days work I'd say, that and fiddling with MASM and debugging to get the thing working ;p.

The weakness arose from my noticing that hardlock wen't from about 40k to around 440k in a few driver increments, the v4.01 drivers I was planning to use did all the direct dongle I/O on the HASP side, in fact if anyone plans attacking the HASP 4 new services don't use the new drivers, grab v4.01 and examine the I/O there. Later on Aladdin 'modularised' this to pass in a structure via Hardlock in later versions, this is where the weakness lies, and it also means for dongles I don't recognise the control can be handled by the real HASP code.

About 1 further day was spent getting the bugs out of the NT/2K version, some of the string handling there was pretty ugly in ASM, and there were 2 nasty bugs to solve, the mov eax, ds:KeNumberOfProcessors rings in my ears for some reason ;-).

3. Tgodd.

I wrote emulators (drivers) for Sentinel/DK2 and Hardlock a while back, sadly as you are probably aware, 2 of these do not have generic solutions for certain API functions, I'm no hardware engineer, so until someone discloses what I'm missing they remain incomplete, although implementation errors from most developers mean I can usually get a solution through ;P.

Regards to all on this thread.

CrackZ.
tgodd
11-11-2002, 10:39 PM
CrackZ,

I can sympathize with you on the KeNumberOfProcessors.
;)

My approach, due to legalities is purely emulation, however,
code patching is an all too familiar evil.

BTW my claim that I was first to reverse the Hasp is in fact true.
I was emulating on Win3.1 back in 93 and even earlier.

I'll tell ya... When I first saw the NT DDK I thought I was screwed.
Man what a change from Vxd writing....

It all seems so trivial now......

Regards,

TGODD
FoxB
06-03-2003, 07:47 AM
Delete....
esther
06-03-2003, 09:43 AM
Thank god its not working :D :D :D :D :D :p
CrackZ
06-03-2003, 07:05 PM
Hiya,

Well I haven't posted for a while, so a quick bit of info from me.

I'm pretty close to finishing a new HASP driver which will actually be a Hardlock.* replacement (will support old HASP INT 6, new HASP and Hardlock's).

Aladdin merged everything into Hardlock.* and now rely on code
obfuscation of a banality that really defies belief, unfortunately the encryption of the API structure still depends and OR/XOR/ADD/SUB and a seed, all wrapped up in tedious little loops to make tracing boring.

Expect some docs/stuff soon on my www. Like 2 weeks time. Also expect me to have fixed a few annoying bugs.

Regards

CrackZ.
JMI
06-03-2003, 07:26 PM
FoxB:

Try the CrackZ link at the bottom of the Forums. That is the "old" address of the server, not the current one.

Regards.


need help to resolve iat please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > need help to resolve iat please
PDA

View Full Version : need help to resolve iat please

backeyes
11-06-2002, 10:14 PM
hello,

(First sorry, it's an asprotect problem one more time...)
My problem isn't on a particular target but on particular asprotect versions i think, but it's certainly better to deal with that on a specific target so he it is :
Crystal Button v1.45 : can be downloaded at crystalbutton.com (us version)

I dumped it with icedump without problem, it dips only one time in code at 4085A0, found oep etc etc...
We can see that iat begin at address 497000 and is 72C size too

And here is the thing i didn't understand :confused: :
There are 6 unresolved api, for me :

123 000971F8 0132139C 0000 ?????? ??????
133 00097220 0132133C 0000 ?????? to_Resolve
141 00097240 01320EE8 0000 ?????? to_Resolve
157 00097280 013213B4 0000 ?????? ??????
161 00097290 01321358 0000 ?????? ??????
199 00097328 01321388 0000 ?????? ??????

For the second and thirth api i did a "u 0132133C" and "a u 01320EE8" and find it's GetModuleHandleA and GetProcAddress, but others only put a value in eax (and i can't find something like a "mov [eax], api" like some asprotect versions)
So my question is : how can we know which api it can be with knowing the return value only ? with a few experience i think it's easy but when we begin with that...
And is there an usefull api documentation somewhere ? can't find that :(

Thanks and continue with this great and helpfull board, i already learnt a lot of things and am very happy to be there :)

regards
JMI
11-06-2002, 11:02 PM
backeyes:

Time for you to exercise your button pressing skills and do a search of this board for threads on asprotect. One of the best things you could do is use the search button and put "asprotect" in the left side and "+Splaj" on the right side. Then open each thread, go to the bottom of the file, click on "show printable version, then click on the top right button, which says "Show all (number) posts from this thread on one page" and copy them ALL, one at a time to your HD and read them carefully.

THEN repeat this process using "aspr" and "+Splaj" and, again, copy all the threads you don't already have to your HD.

THEN repeat BOTH of these steps AGAIN using first "asprotect" and then "aspr" on the left and "evaluator" on the right.

THEN, just for good measure, REPEAT AGAIN, just using first "asprotect" and then "aspr" on the left.

After you have copied ALL these threads to your HD and READ them ALL, you will have the answer to your question, and the answer to MOST questions about past versions of asprotect available to review.

The problem is that your question has been asked several times already. That's why you are asked to use the "search" button BEFORE asking a question.

The more specific answer to your question is that asprotect, in this version builds an array of addresses where it has "emulated" the "return value" of the API. What the hell is the "return value" of the API you ask?? This also is explained in the prior threads.

Here's a good clue. Check out this thread and you should understand, it's titled "asprotect question" posted by vbdisease on 01-30-2002. You should find it with the "search" I suggested. It is at:

http://www.woodmann.net/forum/showthread.php?threadid=2603

Evaluator also gave us a good list on the re-directed APIs of asprotect in a thread titled "For newbiez-ASsPROT-unpacker help." You can do your own search for that one.

It is NECESSARY if you want to understand and attack asprotect that you READ and REVIEW these prior threads, then your questions can be about things that haven't been discussed before.

Regards.
Zilot
11-10-2002, 04:37 PM
Hi backeyes !!

Your APIs Are

GetCommandLineA--------->146139c
GetModuleHandleA--------->146133c
GetProcAddress------------>1460ee8
LockResource-------------->1460ee8
GetVersion----------------->1461358
GetCurrentProcess--------->1461388

I'm working on Win 2k OS, so maybe this addresses are different
with you

Yes there is one dip

its address is 14638cb , just bypass it ( bypass jz instruction with force jumping).The EOP is 43C0F0

After IAT rebuilding everything is fine , but there is still protection

with adding TRIAL message after saving , indenpendent of file

packing , time limitation is broken but this is here

Good Luck !!!

Soldat
backeyes
11-11-2002, 02:53 AM
Yep thanx to jmi (seems i missed a post :) ) i finally found my problem and unpacked it

Now there's save limit, nags, time limit but my problem isn't there...
I saw that, when exporting a created button, the result is very bad : only bad and dark pixels
Everything work fine but this, so i dunno how to deal with this problem. I can't see where is the problem...

Any help would be appreciated
regards


Advanced search in Softice?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Advanced search in Softice?
PDA

View Full Version : Advanced search in Softice?

haex
11-07-2002, 01:05 AM
Hi all!

I'm wondering if there is any way to search the memory with regular expressions?
Like:
s 0 L ffffffff 'Start,*,'End'
were * could be any bytes. It would find : StartANYTHINGEnd

or
s 0 L ffffffff 'Start?End'
where ? is a single arbitrary byte.
Would find: StartXEnd

Maybe a plugin, patch or something?
It sure could be useful for serial-fishing!:)

I have looked in TFM, and searched the board and internet, but I couldn't find anything. Maybe my searching skills isn't enough.

/haex
Snatch
11-07-2002, 11:42 AM
Wow that is a great idea actually. Dont think Softice supports it but with some imagination you could probably write a plugin to do it. Though regular expressions can be a pain often. There are a lot of prewritten classes for handling them. Then interfacing with memory and not crashing the system would be a tough one too :). Havent heard anything to do this though. Generally just search for a peice of the string you are looking for and then see if things match out when you get there.

Snatch
haex
11-07-2002, 06:21 PM
Ok!

Well it almost would be to easy to be able to search for the good serial if you only knew how it looked like.If it has teh pattern 1234-ABCD-1234 you could search for ????-????-???? where ? is any character. Cause just searching on '-' gives way to many results.

Writing a plugin myself is beyond my knowledge,so I'll encourage the pros to make one.;)

/haex (let me know if you do)


Recognizing ....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Recognizing ....
PDA

View Full Version : Recognizing ....

BruceLee
11-07-2002, 01:42 PM
How to recognize algoritam in software? It is MD5, SHA-1, RSA or something else?
foxthree
11-07-2002, 01:52 PM
Mike the resident crypto wizard wrote something of this sort loooong back... :) [Hajo Mike! Where art thou?}

Look here:http://www.woodmann.net/fravia/mike.htm

Signed,
-- FoxThree
ZaiRoN
11-08-2002, 10:08 AM
In addition, I have written a tutorial (nothing special) on a target that use MD5:
http://www.woodmann.net/fravia/Zai_TabMail.htm

it might help you...

regards,
ZaiRoN
BruceLee
11-08-2002, 10:29 AM
I read your tutor. It's great. Well done! But MD5 and SHA-1 are similar? Don't you think that?

Bruce Lee
ZaiRoN
11-08-2002, 12:04 PM
thx.

What do you mean with *similar*?
Maybe the *design* is similar but those are two distinct algorithms.

For example:
- Initialization constant:
MD5 : 0123456789ABCDEFFEDCBA9876543210
SHA-1: 0123456789ABCDEFFEDCBA9876543210F0E1D2C3
- Message digest:
MD5 produces a 128-bit message digest
SHA-1 produces a 160-bit message digest
...

ZaiRoN
BruceLee
11-08-2002, 12:29 PM
The simplest way is to recognize constants used by the algorithm. Almost all block-cipher algorithms and hash-functions have predefined constants used in calculations.

For example, MD4/MD5/SHA use constants 0x67452301, 0xEFCDAB89, 0x98BADCFE, 0x10325476, 0xC3D2E1F0 (the last is only in SHA) for initialization. So, if you see such constants in the program most probably it uses something of MD4/MD5/SHA kind.

Another example: RC5 uses constants 0xb7e15163 and 0x9e3779b9 in 32-bit version, and constants 0xb7e151628aed2a6b and 0x9e3779b97f4a7c15 in 64-bit version.

Of course, encryption/hash algorithm is not defined by constants only, but they allow to restrict set of possible candidates.

Regards, Bruce Lee
crUsAdEr
11-08-2002, 12:55 PM
I have had some troubles dealing with big number algorithm... is there a way of identifying them as well? like RSA and stuff?

thanks
crUsAdEr
dx50azlm
11-10-2002, 05:12 AM
Originally posted by crUsAdEr
I have had some troubles dealing with big number algorithm... is there a way of identifying them as well? like RSA and stuff?

thanks
crUsAdEr

You can usually recognize which algorithm is being used by the type of parameters needed for input. RSA needs two primes p,q selected at random which are then multiplied to give a value for n (n=pq). Better implementations of RSA will have certain smoothness tests for n that deter various factoring attacks (Pollard's p-1 and p+1 method for example). Phi(n)=(p-1)(q-1) is the next to be computed. A variable e is selected at random such that 1 < e < Phi(n) and gcd(e, Phi(n)) = 1. The pair (n,e) is the public key. Lastly, d is computed as d = e^(-1) modulo Phi(n). The private key is (n,d) or (p,q,d).

So if we count everything up, that's p,q,n,Phi(n),e, and d. If you're reversing a program, the best way to detect if RSA is being used is to figure out if any of these computed values are being using in some sort of encryption or decryption function. There's no quick way to do this, but if you know the mathematics behind the major schemes that are used in practice (RSA, DL, or EC) you can study an assembly listing and almost always guess as to which one is used.

RSA encryption can be spotted easily. Let m be the plaintext and E(m) the encryption function. c = E(m) = m^(e) modulo n. Let D(c) be the decryption function. m = D(c) = c^(d) modulo n. It's easy to spot since modular exponentiation can only be done efficiently a certain number of ways. The most commonly used algorithm is the Square and Multiply algorithim. But sometimes you'll come across Right-to-left Binary Exponentiation (which works on finite Abelian groups, identity=1), Left-to-right Binary Exponentiation, Left-to-right k-ary Exponentiation (also called the Window Method), Sliding Window Exponentiation, Simultaneous multiple Exponentiation, Montgomery Exponentiation, and the list goes on. Check Chapter 14 (Efficient Implementation) of the Handbook of Applied Cryptography for a complete rundown of each algorithm.

The trick is to recognize if one of these is being used. Program them yourself in a language like C, and then compile your programs. Reverse engineer your test applications to see how the algorithms will look in targets written in C.

The same thing goes for implementations of the Discrete Logarithm Problem. A common example of the DLP exists in many programs that need two users to share a private key for symmetric encryption. To agree on a secret key, the two users use the Diffie-Hellman Key Exchange, which is an instance of the DLP. Tell tale signs in programs that this is being done: A predetermined group G is used with an element g (in G) as a generator of the group. So <g> = G. The order of g is computed and saved for later use. On one user's side, the program selects a random 'a' in [1,ord(g)]. If the order of g is unknown, an upper bound is used instead. Then g^(a) is computed in the group, and is sent to another user. The program then waits for the other person (who selects a random 'b' in [1,ord(g)] and computes g^(b) in the group) to send over g^(b). The target program then lifts g^(b) to the a-th power and that becomes the shared secret that was passed over an insecure channel. Look for fast exponentiation algorithms that work in finite Abelian groups (also in Chapter 14 of the Handbook).

It takes some practice to spot them, and sometimes it's impossible to tell because of strange implementations (ie: non-standard polynomial splitting algorithms for finite fields [or their extensions]), but at least we can always make a good guess.

Just know the math behind the different cryptosystems, and write some of your own programs that you can disassemble and study. Commercial programs that use strong crypto usually have functions like "Square_And_Multiply" in the dead list.. if the programmers suddenly had a momentary lapse of judgement.. always use this to your advantage!
mike
11-10-2002, 08:58 PM
Wouldn't you know it... the first activity on this board in three weeks and it happens when I'm away :)

All the responses have been great, IMO. If you think MD5 and SHA are similar, that's because the guys who made SHA took MD5's design and expanded it.

One highly underrated way of finding out what algorithm has been used is checking the docs and/or writing the software author! It's surprising how often this works.
ZaiRoN
11-11-2002, 01:56 PM
Hi mike!
writing the software author! It's surprising how often this works.
Are you joking? :eek:

ZaiRoN
mike
11-11-2002, 09:36 PM
Nope. It's like virus writers who brag about their creations; often the same thing goes for bad crypto! Of course, don't expect him to give you details, but even a broad overview can help you make sense of what you're seeing.

Also, I recommend taking the approach of a "fellow shareware author" trying to "emulate his excellent protection." :D


complete nube - can't load symbols into SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > complete nube - can't load symbols into SI
PDA

View Full Version : complete nube - can't load symbols into SI

guppy59
11-07-2002, 11:14 PM
I'm trying to load the msvbvm60.dll into the SI Symbol Loader (whatever version is in Driver Suite 2.7) but it just says "no debug info found", which I understand is normal, but also, msvbvm60.dll not loaded. Hence (I am guessing) that is why when I try to set a breakpoint on __vbaStrCmp, it doesn't work. There is probably not much hope for me if I can't even get that far, but if anyone can offer any pointers for boson software I'd be grateful!
Woodmann
11-07-2002, 11:26 PM
I have got to do something about this.........:(

http://www.woodmann.net/forum/search.php?action=showresults&searchid=30957&sortby=lastpost&sortorder=descending

Even a newbie HAS to read the FAQ.

OBC
guppy59
11-08-2002, 07:43 AM
Thanks, I was going wrong by not loading it as an export.


open source tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > open source tools
PDA

View Full Version : open source tools

neutrino
11-08-2002, 01:35 AM
i think that reversers are a community, people that help other people having fun, and specially learn new and interesting things on hardware and software.
I'm a linux user and programmer, where 99% of programs are open, and my question is:
why a lot of tools written by you comes without source code?
I have also read bad things in some threads like "private plugins" etc...
I think that a piece of source code could clarify things more than 2000 posts.
Bye.
Kayaker
11-08-2002, 04:53 AM
Hi

I tend to agree with you. Though I can see several possible sides/explanations to the issue. It's funny you ask that question because I've been thinking of exactly that the last few days. I'm in the process of coding a little RE app, unique but benign, nothing better or nothing worse than many floating around, which I was planning to release with source. I have learned much from studying other peoples sources and always appreciate it when they do release it, that I like to respond in kind.

I decided to look at another little lame-ass app that I knew might have some similarities and thought it was actually stupid that they went to such lengths to "hide" how they coded a fairly basic app. Nothing special, just calling all APIs with indirect calls to LoadLibrary/GetProcAddress. "What's the use?" I thought. On the other hand, coding something this way IS part of the mystique and fun of RCE. More likely however, it was done to raise the "l33tness" of their code ("Ooh, I have no idea how you did that, you must be a really good l33t coder. Phear me!"), or they didn't want some "lamer" ripping off their code.

There are degrees of 'open-source' as well I feel, at least to any competent reverser. Simply not releasing the source, but not purposely trying to obfuscate or protect the code, I'd call 'partial' open-source. That depends on the complexity of the program of course. Then there's something like Icedump, the ultimate complex, ultimate open-source example. It doesn't need to 'hide' anything because it exposes nothing without serious study and gradual understanding.

Then there's the concept of wanting to hide how RCE apps work from the "bad" guys (that'd be the shareware programmers and protectionists). A questionable attitude at best, but I guess it's all part of the cat and mouse game that actually works in both directions. Good protection leads to good deprotection RCE app leads to modification in protection --> modification in RCE app -->..--> private plugins -->??

Another reason not to release source I can somewhat understand is that it takes a bit of work to release somewhat *useful* source with comments. Often you code things during a frenzied session and forget yourself what the hell you were thinking of at the time, but hey it works ;-) Some people may not want to release because it 'exposes' their shitty programming skills to the world at large (see 'raising the l33tness factor' above). Or maybe simply they just don't want to or just don't care, the app was written to do a job, nothing more, and telling people how you did it doesn't enter into the equation.

Whatever the reasons, I respect the decision, it IS their code after all and they can do what they want with it without justification. I know nothing about the attitudes in Linux programming, but it seems that it's more involved with the *development* of an OS + programs, and is a relatively new and expanding field. I can understand the attraction to those who crave for something new and exciting. A lot of RCE however, at least at this level, seems to be locked into the life and death struggle between shareware and those who want to crack shareware.

Open source is nice when it's there, and helps if you're trying to learn a new language (be it ASM, C or whatever). In terms of 'techniques' then you just have to work at it a bit more, often learning as much or more than if the answers were simply laid out in front of you.

Interesting question Neutrino.

Regards,
Kayaker
ZaiRoN
11-08-2002, 09:04 AM
Some people may not want to release because it 'exposes' their shitty programming skills to the world at large (see 'raising the l33tness factor' above)

For this they should leave the source code. I think that one of the best manners, to increase the experience, is the comparison with the others.

ZaiRoN
Kayaker
11-08-2002, 09:48 AM
You're right Zairon, what I meant really was that they might *think* their programming skills are crappy, and if they don't feel confident enough to release the source they might feel 'exposed' if they do. Hence rather than sharing their code, they hide it.

I don't really think that *anyone* who can code even 1 line of code is a shitty programmer, much the opposite actually. Coding is a skill to be learned and an accomplishment to be proud of when you do. I'm certainly not knocking anyone who programs even the most basic app. I'm a perpetual newbie to coding and learning every day, and certainly don't consider myself an accomplished or leet programmer. One thing about sharing your code though I think is that it does entice you to improve it to the best of your abilities ;)

Kayaker
Aimless
11-08-2002, 12:58 PM
No one works for free...

Good software does not fill your stomach...

No code released is a chance to earn money...

Who wants to pay for a system that has source code pasted all over?

Who wants to have a virus writer create a software that looks exactly like yours, having a dangerous virus inside? How'd you know the difference?

Charity is best left for the rich...or the mad geniuses...

Linux? Open source!!

Sure, that's why the new versions are coming out with an "economical" package of $30 (for 8 CDs and help manuals included...throwing in support too). Is this not how the commercialization begins...?

Surprisingly, people do write GOOD software. Our attitude is what is required to give us confidence to tackle the tough ones. Hence statements like ..."Stoopid protection" or "my mother could take that out during breakfast..." and so on.

Have Phun,
nikolatesla20
11-08-2002, 02:05 PM
Maybe it was just late where you live when you wrote that but I still dont get the point. If you read it it doesn't make sense - are you for or against open source?

By the way this is WRONG FORUM! :)

-nt20
nikolatesla20
11-08-2002, 02:18 PM
I the spirit of open source !

Even though I know most people won't give a crapola about this program :D here are the sources for "First_Thunk", my dumped IAT repair tool.

Yes, there are some nice comments in the code but please don't bash me for that goto that I abused in an infinite loop ! hehehe.

It's written in Delphi 6 (pascal).

-nt20
squidge
11-08-2002, 03:09 PM
Yup, I'll be partly open-sourcing my process dumper soon. I say partly as I will not be open-sourcing the crypkey parts of the source for obvious reasons. It should work with minimal modifications without the crypkey code however.
Bengaly
11-08-2002, 08:41 PM
hi,
i think that source code is important untill it comes to some parts where the author had worked hard to get what he wanted.
of course sharing source code increases the amount of knowledge for those who really learn from it!
the way some people think about source code wont be changed, some will say its good, or bad..
eventually if someone tried hard he can acomplish the same job without the source code.
the best would be to share the source code with some other coders who you know will help reduce the amount of bugs, leaks..whatever.
no one can expect his code to be perfect!

since its the Tool of the trade section, i'll put a small reMake of an old win32asm (coded by savage/pC) done by me and friend in VC++ about mouse hooks.
a simple Password (*****) unMasker when directing mouse over editbox.
source code included for others to learn from.

though it may be useless now days, claming software for your own gain that has been done by others is very selfish.
do not distribute software done by others without permission, this should keep the balance between those who dont care and those who care.

i'v spoke too much...
i am usually tend to read at this forum and not much talking ;)
if i find something interesting other than unpacking here, let me know :)

p.s
Kayaker,
gotta love ur replys!
Zero
11-08-2002, 09:14 PM
why a lot of tools written by you comes without source code?
well...
sometimes the application is not very interesting.
sometimes the source code will shock you, because it is only a fast-hack-code.

There are many possibilities to NOT publish your source... or do YOU really publish everyting you have coded in you life ??

I don´t think that anybody here will prevent you to look into a special source... but maybe the coder just want to see that you are not a lamer but you are really interested to develop this special tool.....
neutrino
11-10-2002, 01:27 AM
i'm very happy that some other thinks like me.
Zero, i spend most of my spare time in coding open source programs for linux.
The amount of knowledge that i have gained from reading other's source code is invaluable.
i quote backorifice2000 as an example of an excellent open source program.

regards.
neutrino


Code Injection (plz help)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Code Injection (plz help)
PDA

View Full Version : Code Injection (plz help)

Nick
11-08-2002, 04:08 AM
note: "***" does not refer to any particular game/application, so this code isn't target specific

Hi again,

I managed to locate most of the memory addresses I need in *** using TSearch, and now I want to go about injecting my own code to make a patch using TSearch.

There is a float variable in the game called "available option" for when you build your character, my goal is to prevent this value from decreasing so that I can make an uber-sweet modified thingy.

After searching for the value in memory I came up with the address 60823D8 which stores the value for "available option. So then I set a breakpoint on this address, and then returned to the game and decreased the available tonnage by 1.

Then the debugger popped up with the following line:

006b47e1 D91E fstp dword ptr [esi]

What I want to do is to prevent the "one of the options" from decreasing by injecting my own code.

Now in TSearch I believe you have to use the 'easywrite' tool for code injection as is shown in their tutorial. What I need to know is what to write in both the "patched" and "unpatched" boxes of the 'easywrite' program. The code I'll be injecting will require an offset that does not interfere with the game, I was thinking of maybe using an address of one of the nops shown in the above disassembler code.

I was wondering if you could help me with what to write in the 'easywrite' patcher?

Thanks a lot.
nikolatesla20
11-08-2002, 04:22 AM
I'm wondering if it may work if you just nop out the fstp instruction. Then it would never "update" the value at all.

The only "thing" is this might only be the displayed value, versus the value that is strored in the actual game. I've read that *** is protected fairly well against hacking. Does this include trainers?

-nt20
Nick
11-08-2002, 04:33 AM
Originally posted by nikolatesla20
I'm wondering if it may work if you just nop out the fstp instruction. Then it would never "update" the value at all.

The only "thing" is this might only be the displayed value, versus the value that is strored in the actual game. I've read that *** is protected fairly well against hacking. Does this include trainers?

-nt20

Well there were in fact 2 addresses 60823D8, and 20BEB94. Now that I have tried the nop on 60823D8 like you said it seems that 60823D8 is only a displayed value. 20BEB94 However does seem to work when I nop it, but it makes the game go kinda screwy and distorted.

The fact is that I want to practice doing something more sophisticated than nopping as I am trying to learn about code injection..etc.
Nick
11-08-2002, 04:52 AM
Yeah, so 20BEB94 was the correct address, I set a breakpoint on it and it displayed a: "fstp dword ptr" thing; which i nopped but that kinda crashed the game, and the game has some kind of checking mechanism where it must compare the "available option" with "max option" and "current option".

Nopping didn't seem to help much, I think code injection will be a cleaner solution for this, and I won't have to search for the value each time I load the game.

edit: I'll post the assembly that I get for the breakpoint of the real address (i.e what was in 20BEB94) and from there I'll try to work out some code injection.
ZaiRoN
11-08-2002, 09:21 AM
I think that the crash happens because you have nopped an instruction that modifies the state of the floating point stack; you have to preserve the state of the stack. If you want to avoid the update of the value, I suggest to change into something like:
fstp dword ptr [<address>]
where address points to 8 useless bytes.

regards,
ZaiRoN
Aimless
11-08-2002, 12:46 PM
Try getting memory scan tools:

Gamehack, Gamethis, gamethat, etc. will work IF and ONLY if the tonnage is at constant address ALL the time.

In case it is NOT at the same address all the time (like, for eg: Diablo and Diablo2,) you will have to find the TRIGGER that does this. And remember, it may be that for speeding up the game, more that one instance of this address manipulator could be used.

Have Phun,
^chaos^
11-08-2002, 01:22 PM
well i emailed you, your problem is that you are nop'ing the wrong thing. post some code above 005eee3d, in particular any add/inc sub/dec . If this function is called, trace back through the functions and find where the value is being modified.

my age of mythology tutorial explains it a lot better then i will again. i would recommend checking out the other tutorials on my site to get some insight.

http://www.s-i-n.com/chaos/myaomtut.txt

^chaos^

trainerology: the source for game hacking tutorials
www.s-i-n.com/chaos/

From what i recall on hacking weight, is that i went to the armor screen, found the value for current # of armor or current weight, i forget ..its been a while, and i set it to zero and then i added on more armor and then reduced the thing to 0. that was with just simple mem hacking, if i had bothered to install si i woulda nop'd the inc/add instruction that added weight / armor.
Nick
11-11-2002, 05:45 AM
Thanks,

Sorry, I have been away for a few days, I'll get back to work on this now and post my results. Thanks for the instructions ^chaos^ I'll try that.
Nick
11-12-2002, 12:34 AM
Ok guys, here is the update on my progress:

After doing memory searches on the "Option 1", "Option 2" and "Option 3" I came up with the following:

Option 1:

005ef4a8 D99EB8030000 fstp dword ptr [esi+0x3B8]
005ef4ae 5E pop esi
005ef4af 5D pop ebp
005ef4b0 B001 mov al,0x1
005ef4b2 5B pop ebx
005ef4b3 59 pop ecx
005ef4b4 C3 retn
005ef4b5 5F pop edi
005ef4b6 5E pop esi
005ef4b7 5D pop ebp
005ef4b8 32C0 xor al,al
005ef4ba 5B pop ebx
005ef4bb 59 pop ecx
005ef4bc C3 retn
005ef4bd 90 nop
005ef4be 90 nop
005ef4bf 90 nop
005ef4c0 8B442404 mov eax,[esp+0x4]
005ef4c4 56 push esi
005ef4c5 57 push edi
005ef4c6 8BF1 mov esi,ecx
005ef4c8 50 push eax
005ef4c9 E872A0EEFF call 0x004D9540
005ef4ce 8BCE mov ecx,esi
005ef4d0 E8BBFEFFFF call 0x005EF390
005ef4d5 33C9 xor ecx,ecx
005ef4d7 8A8E70010000 mov cl,[esi+0x170]
005ef4dd 8D54240C lea edx,[esp+0xC]
005ef4e1 52 push edx
005ef4e2 894C2410 mov [esp+0x10],ecx
005ef4e6 8D8884030000 lea ecx,[eax+0x384]
005ef4ec E8AF75E2FF call 0x00416AA0
005ef4f1 8DB894000000 lea edi,[eax+0x94]
005ef4f7 57 push edi
005ef4f8 8BCE mov ecx,esi
005ef4fa E8515FE2FF call 0x00415450
005ef4ff 84C0 test al,al
005ef501 7508 jnz short 0x005EF50B
005ef503 56 push esi
005ef504 8BCF mov ecx,edi
005ef506 E8E583E2FF call 0x004178F0
005ef50b 5F pop edi
005ef50c 5E pop esi
005ef50d C20400 retn 0x4
005ef510 51 push ecx
005ef511 53 push ebx
005ef512 56 push esi
005ef513 57 push edi
005ef514 8BF9 mov edi,ecx
005ef516 E875FEFFFF call 0x005EF390

Option 2:

006b47e1 D91E fstp dword ptr [esi]
006b47e3 5F pop edi
006b47e4 5E pop esi
006b47e5 5B pop ebx
006b47e6 8BE5 mov esp,ebp
006b47e8 5D pop ebp
006b47e9 C3 retn
006b47ea 8A5001 mov dl,[eax+0x1]
006b47ed 80FA3D cmp dl,0x3D
006b47f0 7574 jnz short 0x006B4866
006b47f2 80F92B cmp cl,0x2B
006b47f5 7518 jnz short 0x006B480F
006b47f7 83C002 add eax,0x2
006b47fa A320B38200 mov [0x82B320],eax
006b47ff E86C480100 call 0x006C9070
006b4804 D806 fadd dword ptr [esi]
006b4806 5F pop edi
006b4807 D91E fstp dword ptr [esi]
006b4809 5E pop esi
006b480a 5B pop ebx
006b480b 8BE5 mov esp,ebp
006b480d 5D pop ebp
006b480e C3 retn
006b480f 80F92D cmp cl,0x2D
006b4812 7518 jnz short 0x006B482C
006b4814 83C002 add eax,0x2
006b4817 A320B38200 mov [0x82B320],eax
006b481c E84F480100 call 0x006C9070
006b4821 D82E fsubr dword ptr [esi]
006b4823 5F pop edi
006b4824 D91E fstp dword ptr [esi]
006b4826 5E pop esi
006b4827 5B pop ebx
006b4828 8BE5 mov esp,ebp
006b482a 5D pop ebp
006b482b C3 retn
006b482c 80F92A cmp cl,0x2A
006b482f 7518 jnz short 0x006B4849
006b4831 83C002 add eax,0x2
006b4834 A320B38200 mov [0x82B320],eax
006b4839 E832480100 call 0x006C9070
006b483e D80E fmul dword ptr [esi]
006b4840 5F pop edi
006b4841 D91E fstp dword ptr [esi]
006b4843 5E pop esi
006b4844 5B pop ebx
006b4845 8BE5 mov esp,ebp
006b4847 5D pop ebp
006b4848 C3 retn
006b4849 80F92F cmp cl,0x2F

Option 3:

006b47e1 D91E fstp dword ptr [esi]
006b47e3 5F pop edi
006b47e4 5E pop esi
006b47e5 5B pop ebx
006b47e6 8BE5 mov esp,ebp
006b47e8 5D pop ebp
006b47e9 C3 retn
006b47ea 8A5001 mov dl,[eax+0x1]
006b47ed 80FA3D cmp dl,0x3D
006b47f0 7574 jnz short 0x006B4866
006b47f2 80F92B cmp cl,0x2B
006b47f5 7518 jnz short 0x006B480F
006b47f7 83C002 add eax,0x2
006b47fa A320B38200 mov [0x82B320],eax
006b47ff E86C480100 call 0x006C9070
006b4804 D806 fadd dword ptr [esi]
006b4806 5F pop edi
006b4807 D91E fstp dword ptr [esi]
006b4809 5E pop esi
006b480a 5B pop ebx
006b480b 8BE5 mov esp,ebp
006b480d 5D pop ebp
006b480e C3 retn
006b480f 80F92D cmp cl,0x2D
006b4812 7518 jnz short 0x006B482C
006b4814 83C002 add eax,0x2
006b4817 A320B38200 mov [0x82B320],eax
006b481c E84F480100 call 0x006C9070
006b4821 D82E fsubr dword ptr [esi]
006b4823 5F pop edi
006b4824 D91E fstp dword ptr [esi]
006b4826 5E pop esi
006b4827 5B pop ebx
006b4828 8BE5 mov esp,ebp
006b482a 5D pop ebp
006b482b C3 retn
006b482c 80F92A cmp cl,0x2A
006b482f 7518 jnz short 0x006B4849
006b4831 83C002 add eax,0x2
006b4834 A320B38200 mov [0x82B320],eax
006b4839 E832480100 call 0x006C9070
006b483e D80E fmul dword ptr [esi]
006b4840 5F pop edi
006b4841 D91E fstp dword ptr [esi]
006b4843 5E pop esi
006b4844 5B pop ebx
006b4845 8BE5 mov esp,ebp
006b4847 5D pop ebp
006b4848 C3 retn
006b4849 80F92F cmp cl,0x2F

This is the updated and correct code:

Option 1: 005ef4a8 D99EB8030000 fstp dword ptr [esi+0x3B8]

Option 2: 006b47e1 D91E fstp dword ptr [esi]

Option 3: 006b47e1 D91E fstp dword ptr [esi]

Notice how "Option 2" uses the exact same code as "Option 3" which is weird, I double checked this and it is right.

What I still need to know from this is how to inject code in order for the "Option" of my *** to be unlimited. I was thinking of modifying the .exe directly using OLLYDBG or using Win32Dasm and a Hex editor. More importantly I need to know WHAT to inject... i.e (How should I modify these lines of code to get the results that I want).

Thanks again for your time and comments ppl.
Nick
11-12-2002, 01:55 AM
And for ^chaos^ here is the code above and below 005ef4a8 (from Win32Dasm):

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:005EF431(C)
|
:005EF439 33C9 xor ecx, ecx
:005EF43B 8A8F70010000 mov cl, byte ptr [edi+00000170]
:005EF441 8D542410 lea edx, dword ptr [esp+10]
:005EF445 52 push edx
:005EF446 891D08E27A00 mov dword ptr [007AE208], ebx
:005EF44C 894C2414 mov dword ptr [esp+14], ecx
:005EF450 8D8E84030000 lea ecx, dword ptr [esi+00000384]
:005EF456 E84576E2FF call 00416AA0
:005EF45B 8BD8 mov ebx, eax
:005EF45D 85DB test ebx, ebx
:005EF45F 7454 je 005EF4B5
:005EF461 8B451C mov eax, dword ptr [ebp+1C]
:005EF464 50 push eax
:005EF465 8BCE mov ecx, esi
:005EF467 E854B20000 call 005FA6C0
:005EF46C 84C0 test al, al
:005EF46E 7445 je 005EF4B5
:005EF470 57 push edi
:005EF471 8BCB mov ecx, ebx
:005EF473 E85869FCFF call 005B5DD0
:005EF478 85C0 test eax, eax
:005EF47A 7439 je 005EF4B5
:005EF47C 8B96BC030000 mov edx, dword ptr [esi+000003BC]
:005EF482 D9451C fld dword ptr [ebp+1C]
:005EF485 8B4D20 mov ecx, dword ptr [ebp+20]
:005EF488 8B86C0030000 mov eax, dword ptr [esi+000003C0]
:005EF48E 03D1 add edx, ecx
:005EF490 8996BC030000 mov dword ptr [esi+000003BC], edx
:005EF496 8B5524 mov edx, dword ptr [ebp+24]
:005EF499 D886B8030000 fadd dword ptr [esi+000003B8]
:005EF49F 03C2 add eax, edx
:005EF4A1 5F pop edi
:005EF4A2 8986C0030000 mov dword ptr [esi+000003C0], eax
:005EF4A8 D99EB8030000 fstp dword ptr [esi+000003B8]
:005EF4AE 5E pop esi
:005EF4AF 5D pop ebp
:005EF4B0 B001 mov al, 01
:005EF4B2 5B pop ebx
:005EF4B3 59 pop ecx
:005EF4B4 C3 ret

Also here is the code above and below 006b47e1 (from Win32Dasm):

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:006B47C1(C)
|
:006B47C9 8A08 mov cl, byte ptr [eax]
:006B47CB 80F93D cmp cl, 3D
:006B47CE 8B3518B38200 mov esi, dword ptr [0082B318]
:006B47D4 7514 jne 006B47EA
:006B47D6 40 inc eax
:006B47D7 A320B38200 mov dword ptr [0082B320], eax
:006B47DC E88F480100 call 006C9070
:006B47E1 D91E fstp dword ptr [esi]
:006B47E3 5F pop edi
:006B47E4 5E pop esi
:006B47E5 5B pop ebx
:006B47E6 8BE5 mov esp, ebp
:006B47E8 5D pop ebp
:006B47E9 C3 ret
Nick
11-12-2002, 09:16 AM
Well, I took a break from trying to hack the option and decided to have a go at hacking another option in the game. I actually managed to create a trainer that stops *** from experiencing the condition up even when the option is turned on! The only problem is that it does not work in multiplayer. Once I connect to a server and then click the "option" button on my trainer the server kicks me out. I guess the server must check that your original .exe has not been modified.

The trainer I made is for the new *** that just came out last week. The trainer works fine in single player, but I need to find a way of fooling the server into thinking I have the original .exe, maybe packet editing?
Manko
11-12-2002, 09:28 AM
Give it up, Nick! :(

I can understand the fascination, since it's supposed to be really hard to crack the onlinegaming of ***...
But trying to cheat online is so low. :(

Anyway... I doubt VERY much that it'd be JUST a matter of checking the exe. The server most likely KNOWS that your heat must raise when you perform certain task's, so you're screwed anyway! :P

/Manko
^chaos^
11-12-2002, 08:07 PM
005EF499 D886B8030000 fadd dword ptr [esi+000003B8]

well that line looks suspcious either nop it to change it to fsub and your weight should not increase...

and for the other thing, that inc eax looks suspicious so you might want to nop that.

as for the server booting you out, i have no idea, did you change some bytes to nop's or what. but they probably added some kind of server side protection, who knows.
Nick
11-13-2002, 12:24 AM
Originally posted by ^chaos^
005EF499 D886B8030000 fadd dword ptr [esi+000003B8]

well that line looks suspcious either nop it to change it to fsub and your weight should not increase...

and for the other thing, that inc eax looks suspicious so you might want to nop that.

as for the server booting you out, i have no idea, did you change some bytes to nop's or what. but they probably added some kind of server side protection, who knows.

The FSUB worked on singleplayer! But on multiplayer the server was too clever for that and booted me.

But how hard can it really be to find and bypass these checking mechanisms by the server? There must be a method that people know of.
Nick
11-14-2002, 06:29 AM
Welp, I can hack the game inside out but I can't get away with it on the multiplayer servers.

^chaos^ I wonder how your hacked .exe did not get booted off servers? Did you have to defeat any in-game checks?
^chaos^
11-14-2002, 04:59 PM
im sure they got smart and put in some protection against such hackery.. what though i couldnt tell you. if it works in single player then you did your job right.. but its something that the server checks.. when does it disconnect you? here is a little tale of bad hacking.

some idiot released a starcraft trainer oh so many years ago, he thought it worked online for minerals.. what it did was up them to 9999999 on your client. however the game..the other plays knew the real value of the minerals. when the game depleted its real minerals...and then you tried to build something with your phantom minerals.. the game booted you.

so what im saying is that if you hacked the ammo for instance.. when do you get disconnected? when you fire 1 bullet.. when you deplete your ammo.. instantly?
Nick
11-14-2002, 06:49 PM
Originally posted by ^chaos^
im sure they got smart and put in some protection against such hackery.. what though i couldnt tell you. if it works in single player then you did your job right.. but its something that the server checks.. when does it disconnect you? here is a little tale of bad hacking.

some idiot released a starcraft trainer oh so many years ago, he thought it worked online for minerals.. what it did was up them to 9999999 on your client. however the game..the other plays knew the real value of the minerals. when the game depleted its real minerals...and then you tried to build something with your phantom minerals.. the game booted you.

so what im saying is that if you hacked the ammo for instance.. when do you get disconnected? when you fire 1 bullet.. when you deplete your ammo.. instantly?

Always instantly.
^chaos^
11-15-2002, 06:15 PM
bummer. it could be a million things so its hard to say. atleast i hope your learned something, its too bad it didn't work in multiplayer.


easy but how ?????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > easy but how ?????
PDA

View Full Version : easy but how ?????

black_ice
11-08-2002, 04:24 PM
hi guys
i don't know how to make infinite loop to dump the software from the memory

please tell me how to do that

:confused: :confused: :confused: :confused: :confused: :confused:
norby
11-08-2002, 05:34 PM
Hi!

in SoftICE, type "a eip"

then you can change instructions,

type "jmp eip"(this will make infinite loop), then enter, then enter

and then you can dump

btw: dont forget to change the bytes back in the dumped file, if your changed instruction was a part of your dump

Norby
JMI
11-08-2002, 05:41 PM
black_ice:

This is an easy subject and one that YOU can find by doing YOUR OWN search. Put "dumping + OEP" in the left side of the search function and then READ some of the threads. YOU can also find information on what to do here in many tuts you will find on the "What New" page on the +Fravia site, which is linked at the top of the page. Yes, if would be FASTER if we just told you the answer, but you wouldn't really learn how to help yourself. Now come on, make an effort.

Regards.

OPPS! Too slow. norby, you really didn't help black_ice, you only encouraged him to be lazy and not do his own work on a very easy subject. This is supposed to be the "Newbie Forum" not the "Do the work for me" Forum.
rgbsky
11-08-2002, 08:13 PM
please see here:

1¡¢a eip jmp eip£¨use before OEP£©
2¡¢/suspendx pid£¨use "proc" to get the pid£© £¨SoftIce£©
3¡¢suspend £¨TRW£©


help!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help!
PDA

View Full Version : help!

rgbsky
11-08-2002, 05:47 PM
who can tell me the usage of POS in ProcDump32 Script?
No POS in ProcDump32 Script examples.give me a usage example,thanx!

this is explain in ProcDump32:
POS function
Set current memory location FOR ALL FUNCTIONS. The location is depending on object start.
howie
11-08-2002, 10:03 PM
hmm...mot sure, but maybe this one helps:

http://www.woodmann.net/protools/files/unpackers/easyscripting.txt
rgbsky
11-10-2002, 12:35 PM
:) Thanx!!!
now I see.


Armadillo IAT plug in
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Armadillo IAT plug in
PDA

View Full Version : Armadillo IAT plug in

crUsAdEr
11-08-2002, 08:29 PM
Yo guys,

Just get my hands itchy on masm n trying out thigns... here is plug in for Imprec/Revirgin to recover redirect API by Armadillo... just show all API not traced and select the plug in... tested on Get Right 5.0, armadillo 2.61 and 2.51 on my win2k box... need some import from win98 users if possible... Comments are welcome

Reagrds,
crUsAdEr
Pr1mus
11-08-2002, 09:15 PM
works for me, but you already know that since a few hours :D
Anyway, this is a very nice plugin :)
Cheers Crusader!
dtribatz
11-10-2002, 06:14 PM
Nice work crusader!
I will try it...

Danke, dtribatz


Tiny tool for S-ICE\Win9x released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tiny tool for S-ICE\Win9x released
PDA

View Full Version : Tiny tool for S-ICE\Win9x released

Czerno
11-08-2002, 11:43 PM
I almost forgot ... Here's FWIW the tiny tool I recently wrote for myself : it's a DOS .com file weighing a couple dozen useful bytes
(no typo! Not megabytes or even kilobytes :) )

Goal : update the BIOS/DOS/Win system time with the real time clock's time in cases the former lost sync, which may happen if interrupts have been disable over a period, such as when popping-up S-ICE.

Install : copy the Setclock.com executable to any folder ( where you put your misc executables, or maybe to the Softice folder ), then make a shortcut (hint: drag and drop com file to the desktop and/or to a folder under the start menu). Rename shortcut to a descriptive name such as "Reset the Clock", set its properties to run minimized.

Usage: when needed, just double click the shortcut you made in "install" step, and presto... windows clock updates;

Source: None. I wrote the thingie in 5 minutes with pencil,paper, and "debug.exe" : should you want to get to the Setclock "source", you just "debug setclock.com" - No need even to have Wind*ws loaded !

HTH ! 2 last notes :
1. The program will work on a 286 (but SICE-W won't ;) No need for a Pentium (TM) here..;
2. The attachment is the actual, non compressed , com file. Zipping it would have increased its size in effect !
Remove the bogus .txt extension before using !
Paul333
11-09-2002, 12:19 AM
Thanks Czerno ..

This'll come in handy so good thinking :)

paul333


Unpacking Elicense
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Elicense
PDA

View Full Version : Unpacking Elicense

peterg70
11-09-2002, 07:05 AM
I have a target that uses the vtcpak33.dll as part of its protection.

I was looking at unpacking/unwrapping the elicense part of the software but found that the program had already expired.

Thought No probs just delete the mmf.sys file. So I shutdown the service LicCtrl and deleted the mmf.sys file.

Then ran the software which restarted the service LicCtrl and the product was still expired. Anyone have any other thoughts on reseting the trial period. It seems all the previous tutes explain how to unpack the proggie but they require the program NOT to be expired or else no way to get to OEIP.

Used Filemon but apart from some *.nls files that are accessed during the service startup not much there.

In registry found a weird thing HKLM\software\licctrl\licctrl\licctrl\licctrl is the path but when trying to access the last one get a key error and not able to delete it.

Just though is that it uses the registry to hide the data but How can I delete or see whats there.

peter
Kayaker
11-09-2002, 10:59 AM
Hi

Will it Export that registry key to a .reg file OK so you can see that final value? Sounds like a really weird error. Regedit won't allow you to delete the whole key?

Kayaker
peterg70
11-09-2002, 11:00 PM
the export starts to export but when it gets the that specific key it just doesn't write anything.

Could be a corrupt registry entry on my side but don't know how I created it. Was thinking this might be part of the version 3 of elicense.

Still unable to reset the trial period.

peter
Artifex
11-10-2002, 07:17 AM
A few months ago we had a thread on an e-license protected prog.
here are some notes :

Prog. protected with vtcpak33d.dll

With Softice :
bpx bff6430d if (ax==9001)
F5
bff6430d jmp eax
f10
xxxx9001 (02319001 or 021f9001)

g 0222ffad or g 0210ffad (xxxx - 000f)

if your 30-day trial period is not over :
at xxxxffad nag screen (TRY, BYE, QUIT)
f10
xxxxffad
xxxxffb2
g 02483bff (or xxxx + 0022)
02483bff jmp [024a2024] = jump to 52ac00 (OEP)
a
jmp eip
/dump 400000 3e7000 dpdump1.exe
------------------------------------------

IF YOUR 30-DAY TRIAL PERIOD IS OVER :
r eip xxxxffb2
g 0223145c : don't jump to 022388e
g 0223388e : jump to 022333dc
g 0223464b : wrapper does unpacking
g 0223465d : wrapper works upon PEHeader (changes it, moves it (?) and zeroes part of it (4000xx to 4002xx)
g 02483bff jmp [024a2024] = jump to 52ac00 (OEP)
a
jmp eip
dump
-------------------------------------------

Dump crashes (is has a zeroed PEHeader).

That thread closed when we got our aim.

Good luck.
Artifex
peterg70
11-10-2002, 09:35 AM
Artifex

Thanks for that but having done a search i had found that.

The vtcpak33d.dll is different from the vtcpak33.dll that I have.

Nothing corresponds and there seems to be IAT encryption in there but I still can't get the trial period reset.

Hmmm.

Need a drink and a new way to look at this.

peter
squidge
11-10-2002, 01:42 PM
You may find this program helpful, it describes a way of hiding data in the registry without regedit being able to delete, display or being able modify the data. It seems a few programs are already using this method as part of there protection. Only seems to work on 2k/XP, but I assume that's what most people are using anyway.

It includes full source code.
Kayaker
11-10-2002, 05:15 PM
Interesting trick, it sounds exactly like what's happening. Wish I could check it out but it's not for Win9x apparently.

Just wanted to mention another little app that clears some system restrictions including access to the registry with Regedit (as one version of Merak Mail did if it caught you fiddling with it). It's called Key2000 and is available at

http://www.bookcase.com/library/software/win9x.security.undef.html

or directly

ftp://ftp.simtel.net/pub/simtelnet/win95/security/key2k_13.zip

Kayaker


Reversing our own tools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Reversing our own tools
PDA

View Full Version : Reversing our own tools

crUsAdEr
11-09-2002, 11:41 AM
Hi guys,

I decide to start this project here to reverse one of our tool... imprec 1.4.2+ by MackT... I have tried to contacted him to ask his permission first before start a project on this board but i couldnot find his email and he hasnt been on irc for a motnh or so i heard... so if you do not like the idea this project at all then just drop me a note and I will STOP this project immediately...

Basically, new AsProtect version fill in garbage in IAT so Imprec/Revirgin finds lots of garbage IAT entrys... which makes tracing n disassembling slower and annoys me... so i want to implement a new feature *Remove invalid thunk* on the right click menu of Imprec, which check all the invalid IAT entries and remove them automatically... since Imprec already has a Cut/Remove thunk feature... it should not be too hard to add in a few lines of invoking IsBadPointer :>... that is the idea and it is fairly useful so i hope ppl will join in this project as well...

Hmm.. so okie, Zairon, how do I start :>? just give me a hint :>...

Thanx,
crUsAdEr

P.S : if any of you can contact MackT, would you kindly please help me convey my msg and I will immediately stop this project if he wishes so! Thanx.
Kayaker
11-09-2002, 12:38 PM
Sacrilege, Blasphemy! Heretic, Defiler! Have you no Shame??!
:D
Actually, this was in reply to your post in the Snippet thread but I see you've carried it into a new project, cool. Here's a start for handling the right click feature.

Heh, oh what the heck... TrackPopupMenu is what you're looking for. Throw RV into DeDe and you'll see the right click popup menus and their OnClick events in the main form. To trace set a bp on TrackPopupMenu and make note of the 6th param, handle of owner window. Allow the popup menu to show and select one of the menu items (I wouldn't suggest Tracer unless you like BSODs), and you should return to SI immediately after the TrackPopupMenu API. A message has now been posted to the owner window informing it of your selection.

Now set a BMSG hwnd WM_COMMAND where hwnd is that 6th param and let it run. You should break in Kernel.Alloc on something that looks like:
push 1180E1B
push 30000
jmp 014f:7616

That 1st push statement address is the very start of the Windows message handling routine. You can set a bpx on that address directly (qualify the bp with your regular program CS: value since you're in the wrong context), and let SI run again. You should break and you can start tracing, watch the hWnd, wParam and lParams associated with the WM_COMMAND message being pushed in the various calls and you should quickly find the CMP EAX, 111 call. You can now insert your patch point jump here as we did above, and your patch will handle the message from your new menu item.

The next trick will be to add a new menu item to the Popup Menu. You can probably find one of the menu creation APIs doing this and use CreatePopupMenu, AppendMenuItem, InsertMenuItem or whatever to add your own. Check out the list of existing IDs used and use a unique one (RV uses Tracer=3, Edit=4, Reset=7, etc.).

Have fun with the modifications ;)

Kayaker
ZaiRoN
11-09-2002, 02:03 PM
Hi crUsAdEr,Kayaker

Kayaker, you are damn fast, did you sleep sometimes ;p

Here is how ImpRec works:
ImpRec loads the poupmenu dynamically using the function CreatePopupMenu which returns the handle of the newly created menu.
When the new menu is created the subitems are added using the API InsertMenuA:
BOOL InsertMenu(
HMENU hMenu, // handle of menu (returned by CreatePopupMenu)
UINT uPosition, // menu item that new menu item precedes
UINT uFlags, // menu item flags
UINT uIDNewItem, // menu item identifier or handle of drop-down menu or submenu
LPCTSTR lpNewItem // menu item content
);

The syntax is clearly enough. If you want to add a separator line remember to put NULL as lpNewItem. The first InsertMenuA call defines the first menu voice, the second call puts the item under the first and so on.
Finally, the API used to display the menu is the function TrackPopupMenuEx:
BOOL TrackPopupMenuEx(
HMENU hmenu, // handle of menu
UINT fuFlags, // positioning flag
int x, // horizontal position
int y, // vertical position
HWND hwnd, // handle to the window that owns the menu
LPTPMPARAMS lptpm // NULL ;)
);
Yu have all the necessary to add a new item :)
Now, the only thing you have to do is find the messages handling routine. I think you can follow Kayaker's explanation or you can work directly on the SysTreeView32 control used by ImpRec ;)

ZaiRoN
tgodd
11-09-2002, 04:00 PM
Here is a C snippet to create a Taskbar Menu.
It's easy to convert it to assembly code.
Everything you need is here.

Hope this helps.

HANDLE hmHandle;
HMENU myMenu;
HICON myIcon;
NOTIFYICONDATA myIconData;
WNDCLASS myWndClass;

hmHandle = GetModuleHandle(NULL);

myMenu = LoadMenu(hmHandle, IDR_MENU1);
myIcon = LoadIcon(hmHandle, IDI_ICON1);

myWndClass.style = 0;
myWndClass.lpfnWndProc = WndProc;
myWndClass.cbClsExtra = 0;
myWndClass.cbWndExtra = 0;
myWndClass.hInstance = ghInst;
myWndClass.hIcon = myIcon;
myWndClass.hCursor = 0;
myWndClass.hbrBackground = 0;
myWndClass.lpszMenuName = 0;
myWndClass.lpszClassName = "MyClassName\0";
myWndClass.hIcon = myIcon;

RegisterClass(&myWndClass);
myHWnd = CreateWindowEx( 0, "MyClassName", "MyWindowName", 0,0,0,0,0,0,0, hmHandle, 0);

myIconData.cbSize = 58;
myIconData.hWnd = myHWnd;
myIconData.uID = 'MYuId';
myIconData.uFlags = 7;
myIconData.uCallbackMessage = 0x400;
myIconData.hIcon = myIcon;
strcpy (myIconData.szTip, "This is my tip text!!!\0");

Shell_NotifyIcon(NIM_ADD, &myIconData);

LRESULT WINAPI WndProc(HWND hWnd,UINT uMessage,WPARAM wParam,LPARAM lParam)
{
POINT myP;
HMENU tmpMenu;

switch(uMessage)
{
case WM_USER:
switch(lParam)
{
case WM_RBUTTONUP:
GetCursorPos(&myP);
tmpMenu = GetSubMenu(myMenu, 0);
TrackPopupMenu(tmpMenu, 4, myP.x, myP.y, 0, hWnd, 0);
return 0;

default:
return DefWindowProc(hWnd, uMessage, wParam, lParam);
}

case WM_COMMAND:
switch(wParam)
{
case ID__ABOUT:
sprintf(ErrString,"This is my About Box!!!");
MessageBox( 0, ErrString, "ABout", 0x40);
return 0;

case ID__MENU1:
sprintf(ErrString,"This is my Menu #1 Option!!!");
MessageBox( 0, ErrString, "Menu #1", 0x40);
return 0;

case ID__MENU2:
sprintf(ErrString,"This is my Menu #2 Option!!!");
MessageBox( 0, ErrString, "Menu #2", 0x40);
return 0;

case ID__EXIT:
DestroyWindow(hWnd);
return 0;

default:
return 0;
}

case WM_DESTROY:
PostQuitMessage(0);
return 0;

default:
return DefWindowProc(hWnd, uMessage, wParam, lParam);
}

}

Regards,
TGODD
crUsAdEr
11-10-2002, 11:43 AM
Thanks guys,

I have located places to intercept the message loop and decide on how to patch it... right now i am having difficulty identifying the routine handling the Import Tree itself, as in accessing it and how to remove them from the list...

Any suggestion on how i should try to identify those VC++ routine?

Thanx
crUsAdEr
ZaiRoN
11-10-2002, 04:08 PM
Hi crUsAdEr,

The message handlers routine seems to be after the call of TrackPopupMenuA function.
In fact, after this call, the program controls if one of the items of the popup menu has been pressed (cmp dword ptr [esp+24],111h); if it has been pressed, it controls which it is the item pressed through the value contained in ecx.
This is the enumeration given to the items:

Invalidate function-0
Trace level1-2
Trace level2-3
Trace level3-4
Cut thunk-1
Delete thunk-5
Switch *LOADER*-8
Expand all nodes-6
Collapse all nodes-7

Except 'Switch *LOADER' all these items are handle using the jump [ecx*4+41620C]. Here you will find all the information that you have need.as in accessing it and how to remove them from the list...I'm not totally sure but from what I have seen, the program uses the message of TVM_DELETEITEM in order to delete an item from the list; you can recognize it from the 'push 1101' before the call of SendMessageA.

For more information on TreeView control, you can take a look at:
http://spiff.tripnet.se/~iczelion/tut19.html
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/shellcc/platform/commctls/treeview/reflist.asp

Hope it helps!

ciao,
ZaiRoN
crUsAdEr
11-10-2002, 10:25 PM
yeah.. thanx zairon...

was wondering wat the hell is that message :> "push 1101"... tried searching through windows.inc but it is not there... okie... time for more research... sign... i should have learnt C last time instead of delphi :mad: ... ah well

shall keep repoting my progress here... does anyone else wanna join in as well :D ?

cheers,
crUsAdEr
ZaiRoN
11-10-2002, 10:58 PM
was wondering wat the hell is that message :> "push 1101"... tried searching through windows.inc but it is not there.
The message is TVM_DELETEITEM and there is but it's *hidden*:
TVM_DELETEITEM equ TV_FIRST + 1 <-- 1100 + 1 = 1101

ciao!
ZaiRoN
foxthree
11-11-2002, 06:41 AM
The best way to attack these kinds of problems is to use DLL injection techniques rather than doing inline patches. It is far easier to code a separate DLL and then to inject it into the process ... and also easier to debug ;)

Look at samples from the DLL Injector "guru" EliCZ :)

Signed,
-- FoxThree
crUsAdEr
11-13-2002, 04:15 AM
On the way there... :>

Yep thanx Zairon for the input... been busying myself reading about Treeview... i have a another slight problem... I am not quite sure how to unselect an item in the treeview... there is TVIS_SELECTED state value, there is TVM_SELECTITEM... but there isnt any TVIS_UNSELECTED :(... so do i just set State to TV_ITEM to be 0???

I was trying something like that but it doesnt seem to work... so could you show me a short example of using TVM_SETITEM...

thanx
crUsAdEr
ZaiRoN
11-13-2002, 10:22 AM
Hi crUsAdEr,
reading msdn I have found something that could help you:
lResult = SendMessage( // returns LRESULT in lResult
(HWND) hWndControl, // handle to destination control
(UINT) TVM_SELECTITEM, // message ID
(WPARAM) wParam, // = (WPARAM) (DWORD) flag;
(LPARAM) lParam // = (LPARAM) (HTREEITEM) hitem;
);
where:
hitem --> Handle to an item. If hitem is NULL, the control is set to have no selected item.

That might be the way. I'm a little bit busy and I can't try...

good luck!
ZaiRoN
tgodd
11-13-2002, 12:58 PM
One of the best places I have found to get info on windows
API programming is at this site http://www.mvps.org/vbnet/
It's a VB sight but its easy to do the translation to assembler.
After all it is windows API you are using.

Check it out.

Regards,

TGODD
crUsAdEr
11-13-2002, 01:17 PM
Zairon : I just want to unselect 1 item and keep the rest selected, but thanx anyway.. dont worry i will get on on my own :>....

FoxThree : yeah, a dll is easier but heeding Kayaker advice, i am using Code Snippet Generator for this project.. seems to work fine :>...

tgodd: thanx a lot, i will check it out...

cheers guys,
crUsAdEr

P.S : Code Snippet Generator assemble my patch fine but refuse to patch the file or export binary saying my code use a function that is not present in the target file??? I amsure all APIs used are imported, i even add another set of import API (those that i use) just in case but still the same error msg :(? Can someone tell me what is wrong?
NervGaz
11-13-2002, 04:29 PM
deselecting 1 item would as far as I can figure the PSKD documentation out would be to zero out the state member of the LV_ITEM struct... Doesn't seem to be any other way...
Kayaker
11-13-2002, 04:36 PM
Hi crUsAdEr,

I had that Snippet Creator error message as well when I used an API that wasn't on the import list, even though I had added the import via the menu. I think it had something to do with the order you did it in, I think you need to add the imports then reopen the import-patched file as the project file before trying to assemble any patch code. Something like that anyway, but yeah it seemed a bit quirky that way.

I agree with FoxThree that dll injection techniques are fun, EliCZ's stuff is without equal for sure. I've never had much the need for such complexity though, a simpler basic approach much like Iczelion's loader/injection implementation in IczDump has worked wonders for me.

You could also do a combination inline patch/dll 'inject' where the 'patch' is a LoadLibrary/GetProcAddress routine that simply calls your own dll. This way you've got a small dll loading routine you can patch into any app, somewhere in the msg handling routine let's say, but the bulk of your coding can be done in your own dll in a more familiar dev. environment.

All in all I still like SC a lot ;)

Kayaker
sv
11-14-2002, 08:36 AM
Hi crUsAdEr

I have done some check in my rebuilder to avoid invalid thunk too.
I think you have to do 'IsBadPointer' but it's not enough (some bad entries aren't badPointer!).
My solution is to check in code section, for each thunk, if there is a call [thunk], jmp [thunk] or mov xxx, thunk.
It's not perfect but for the moment it works pretty well.

My 2 cents ;)

SV
crUsAdEr
11-14-2002, 06:06 PM
Hi sv,

Thanks for the input.. yeah Imprec also has already done its check with IsBadCodePtr already.. so i will need a more rigorous check algorithm but that is for the later part...

Does it take long for you to do that? Search for reference for each pointer? I was afraid it might be slow...

Right now i am working on general reversing skill, adding functionalities and coding in asm... the dudes in win32asm board have helped me fixed some bug in dealing with Treeview... now i am off next to find out where Imprec store the target exe PId and process handle...

thanks guys ofr the help, reversing is really quite fun... it makes you feel like you can make any programs do what you want :>... though i am no where that good yet but ah well :D ...

Regards,
crUsAdEr


Greetings on the board,
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Greetings on the board,
PDA

View Full Version : Greetings on the board,

hobgoblin
11-09-2002, 05:20 PM
Greetings guys,

I'm not sure what forum I should use for this thread, but here it is....
I have a nice challenge for those interested. I have been looking on a target for a couple of hours, and I'm getting more and more interested. The target is encrypted. When you dissasemble the exe file, you can see that the dissasembled body clearly consists of two section. One starts in the address area 4xxxxx, the other starts in the area 7xxxxx. But you see no textstrings or no import information.When you load it in the Softice loader, you start at a 7xxxxx address. While stepping through the code, you will see the program checks the Disks (Getvolumeinfoa), it checks for Drivetypes. It loops several times while it decrypts what is to become the final executable. You can during these loops see how the program builds the sections, the header and so on. Now, and here comes the interesting part: I checks whether Softice is loaded in memeory.(Easy to find). I'm not quite sure, but I think it checks for Regmon too. (Haven't really checked all it is looking for yet..). You can put breakpoints, and the program still runs. You can manipulate the program to jump/not jump during runtime, but if you change something in memory (or in hardcode), you will get problems. Either you get a message saying that you have no valid license etc., or you get a windows error message. If you change something in hardcode, and try to manipulate your way through the code to emulate the course it takes when it is untouched, you will eventually get trouble because then the program seems to decrypt the program wrong, and you'll eventually avoid what can be called getting to the OEP.

Nice, heh?:)

The target is Xselerator 2.5.7, and can easily be found on the net..

Regards,
hobgoblin


How To defeat EVER Lock Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How To defeat EVER Lock Protection
PDA

View Full Version : How To defeat EVER Lock Protection

ajaki19
11-10-2002, 11:51 PM
I have a vb4 Program with EVER LOCK Protection and I want to Know How To defeat it. Please
excuse my english
thE Cur!ouZ
11-13-2002, 09:33 PM
hi ,

1- I think i see in the net a tools named NEVERLOCK, it's a deprotecter for EVERLOCK..
2- it's a Tut about this protection writed by Tomboy, u can find it in Krobar site or in this site.

Good luck..

cheer..
ajaki19
11-15-2002, 10:47 PM
Thank You


Patcher Outputs ASM Source
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Patcher Outputs ASM Source
PDA

View Full Version : Patcher Outputs ASM Source

Athlon
11-11-2002, 08:24 AM
I know it says dont ask where to get tools of the trade but this one is free so I hope I can ask :)

anyway to the question, I had a patcher that output the ASM Source it was very useful because it was nice to learn from etc.. I seem to have lost it (format) wondering if anyone knows where to get it or atleast the name. I searched google with no results thanks for your help :cool:
Manko
11-11-2002, 09:46 AM
Hmm... Cogen II, wasn't it? :)
I think the Snake has it in some tut by someone on keygenning...

/Manko
Athlon
11-11-2002, 10:28 AM
no thats not it :( there is another one I hope someone knows which one I am talking about
Manko
11-11-2002, 10:38 AM
...though, CogenII is a patcher and outputs asmsrc, so maybe you should give it a try? Might not find that better one, you're searching for...

...ofcourse, you might be wanting to get at other functions than byte-patching...

/Manko


Assembly comparison??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Assembly comparison??
PDA

View Full Version : Assembly comparison??

Nick
11-11-2002, 08:42 AM
I have 2 .exe files that I have disassembled with Win32DASM and I want to compare the two disassembled .exes... i.e (Compare all the ASM of both files for any differences).

Thanks.
FoolFox
11-11-2002, 10:22 AM
Hello,

Save the two disassembled files as text files and take them
in something like windiff... or similar dev tool, windiff may
become quit old...

this may worth have a look, didn't tried it myself :

h**p://www.grigsoft.com/wincmp.htm

Regards
FoolFox
squidge
11-11-2002, 10:29 AM
If they are almost identical apart from a few opcodes, then use the dos utility FC.

Eg.

FC asm1.asm asm2.asm > diff.asm

diff.asm will now contain the differences.

FC is provided with Windows and can do both text and binary files.
tom_324
11-11-2002, 11:12 AM
Note that FC will not work if there is a small difference in linking offset, eg. the same routines are placed at location+offset in the second file. Then FC will show a lot of differences for same code. Text compare of disassember output files is a bit better but still a lot of work.

Tom
+SplAj
11-11-2002, 01:01 PM
LOL

I think you need to use HWorks (hex workshop 3) to find the dif bytes (to patch) between your 'unpacked-target.exe' and the 'ready-cracked-unpacked-target.exe'.........

Just <right-click> on exe's and 'compare'. That gives you the offset ;)

that it ?


Chameleon Clock 3 b4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Chameleon Clock 3 b4
PDA

View Full Version : Chameleon Clock 3 b4

Manko
11-11-2002, 10:05 AM
Was gonna take this privately with BruceLee, but he doesn't receive pm's... :P

Can't get this to work right and wonder if someone knows anything about it?

I deleted crap from iat section before it fill it with apis. I redirected eip from first instruction in 1st dip to ret04 at end of it then dump at oep.

Make code (in hole) to call 1st dip then jmp oep.

It starts fine! But when I access popuptrackmenus the shutdown almost at once and on 3 occations explorer crashes shortly after I terminate program.

On CC 2.51 I was tricked by Freresource and then made it only ret04 and all was ok. Thought this was same, but no luck. :(

Any ideas?

/Manko
foxthree
11-11-2002, 11:21 AM
Manko:

Clear your PM

Signed,
-- FoxThree
crUsAdEr
11-11-2002, 01:23 PM
Yeah, i have the same problem...

I can access everything fine... except that after about 1 mintue my Explorer crashes... it happens all the time so it is definitely somethign to with Chameleon Clock chekcing for AsProtect present?

SetTimer not the case used here i think.. bpx on it only give the 5sec delay at the nag box.. then if we put our mouse at the task bar chameleon clock, then settimer is called every 0.5 sec to do refreshing i guess... so it is somethign else probably.. the thing is that it causes Explorer to crash!!! i am stuck as well :(...

regards,
crUsAdEr

P.S : has anyone seen this?
Secure Family Album
Old or New AsProtect? No API emulation, IAT redirection scheme stolen from VBox :>...??? new seh trigger? or is this old? used to be "xor [eax], eax" now it is "lea eax. eax"!!! Minimal onfuscation and stuff... no OEP hiding anymore?
Manko
11-11-2002, 02:04 PM
Originally posted by foxthree
Manko:

Clear your PM

Signed,
-- FoxThree

Yup, now EVEN the outbox is empty. :)

/Manko
esther
11-11-2002, 05:10 PM
Hi crUsAdEr,

>P.S : has anyone seen this?
Secure Family Album
Old or New AsProtect? No API emulation, IAT redirection scheme stolen from VBox :>...??? new seh trigger? or is this old? used to be "xor [eax], eax" now it is "lea eax. eax"!!! Minimal onfuscation and stuff... no OEP hiding anymore?

Although the compiler sigs are similar to as* but it seems to be another type of encryptor.

Latest as* check out Ta*, com*.Double protection as*+aspa**?

Check out guys ;)

Regards
hobgoblin
11-11-2002, 07:42 PM
Hi esther,
What on earth do you mean? What program do you want us to check out?:D

Regards,
hobgoblin
crUsAdEr
11-11-2002, 08:28 PM
********************************************
Although the compiler sigs are similar to as* but it seems to be another type of encryptor.
********************************************

I can BET with you a pint of beer it IS Aspr...lol... everythign else is the same with old/usual Aspr... i mean everythign else :)...

regards...
crUsAdEr

P.S :esther, tell me when u wanna buy me beer :)

P.P.S : sorry.. file analyser identifies it as AsProtect 1.1b.. lol.. it is Dakien faults that taught me not to use tools...
esther
11-12-2002, 01:03 AM
Hi Hobgolin,
I'm talking about commview ;)

crUsAdEr:

>P.S :esther, tell me when u wanna buy me beer
P.S.S.:I'm not alcoholic sorry no b33r for you :D

>P.P.S : sorry.. file analyser identifies it as AsProtect 1.1b.. lol.. it is Dakien faults that taught me not to use tools...

Blame yourself ;p

Regards
evaluator
11-12-2002, 09:28 AM
esther :)

#DF

Tamos is in AGONY!!!
They can't use latest (betas!?) ASsPR because of
OEP-stripping ~~;0
Manko
11-13-2002, 11:06 AM
Sigh! Feel stupid! Have done this already...

Link -> Thread on pstrip... (http://www.woodmann.net/forum/showthread.php?s=&threadid=4054&perpage=15&pagenumber=2)

My comment is a few posts down...

But if you don't like the link... :)

seg001:004C11C0 5B pop ebx
seg001:004C11C1 58 pop eax
seg001:004C11C2 8B 40 02 mov eax, [eax+2]
seg001:004C11C5 8B 00 mov eax, [eax]
seg001:004C11C7 FF 30 push dword ptr [eax]
seg001:004C11C9 8F 00 pop dword ptr [eax]
seg001:004C11CB FF E3 jmp ebx

When not run these bytes are encoded. (Just INCed.)

The exact same code. Though MORE used this time I think.

Thanks for not messing me again FoxThree! I was being lazy! ;P

/Manko
crUsAdEr
11-13-2002, 01:05 PM
Nice one Manko,

I missed that totally :)... how did you find it?
Manko
11-13-2002, 02:44 PM
I often have the drawer of the application I'm working on open while I'm doing my thing...

I suddenly noticed how one file was growing fast when I ran the dumped exe... :)

I seems it handles it's own exceptions and dumps info of the callstack and maybe something else (deleted it. DOH!) in a logfile...

Anyway, that adress range was often represented... :D

/Manko
crUsAdEr
11-13-2002, 03:27 PM
LOL.. very nice, Manko...

lesson learnt.. READ THE LOG FILE :)...

cheers
crUsAdEr
foxthree
11-13-2002, 04:10 PM
Hi Manko:

U're welcome :D and crus... yes it has the same protection as PStrip. In fact, after finding it, I sent PM to Manko *hinting* the irony of the situation... I too found it only by taking look at *.log and of course EliCZ "tiny" tools ;)

[Look for CheckAlarm handlers ;)]

Signed,
-- FoxThree


[OllyDbg] new users forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > [OllyDbg] new users forum
PDA

View Full Version : [OllyDbg] new users forum

TBD
11-11-2002, 10:53 AM
hi there,

I reopen the OllyDbg user forum (previously OllyDbg Users Liner) today, on 2nd year OD anniversary. It is dedicated for sharing plugins, tips&tricks and information about OllyDbg.

here is the link - http://ollydbg.has.it

I hope you will have a great time there.

thanks and enjoy,
TBD

ps. working on a tutorial how to write plugins in Sphinx C--


OLLYDBG Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > OLLYDBG Question
PDA

View Full Version : OLLYDBG Question

Nick
11-11-2002, 06:58 PM
Does OLLYDBG have a memory search function? For example searching for a value in a game, then switching back to the game and changing the value and then searching for the new value...etc until I get the address of the value I want? (kinda like TSearch)
squidge
11-11-2002, 11:31 PM
You can search the segments of a loaded process for a specific value if that's what your looking for. You'd have to write down the memory addresses manually however each time as there's no built-in "game cheat system" as such.


Serial Fishing .... but not trivial !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Serial Fishing .... but not trivial !
PDA

View Full Version : Serial Fishing .... but not trivial !

Nigma
11-11-2002, 09:11 PM
Hello everyone !!!!!!

Well, everyone is busy with unpacking Azpr but I hope you'll
find some time to deal with this proggie :

http://absolutist.com/ssaver/ascii_art/asciiart.exe

It needs a Reg code but find the reg routine is not trivial at
all ( well for me it is a problem ) .

When I saw this proggie I thought BULLSHIT , 2 MINUTES WORK
but .....I guess you know the continue :mad:

Thank you all !
Aimless
11-12-2002, 12:22 PM
Could you tell us what you have done so far on this?

And how exactly (or where exactly) are you getting stuck in your apprach steps?

Have Phun
Nigma
11-12-2002, 08:18 PM
Well , the proggie is registered by a file setup.exe but after you
put the registration info the proggie does not break even if
BPX HMEMCPY is set , if U play with window messages you may lost in the code !
I patched the proggie so it can show all the pictures available in the directory BUT there is still the begginnig NAG which tells you
to register !

(((I have three quarters from the proggie -> cracked)))

after looking at the main proggie's code I think that the NAG is shown even if we register , BUT I am sure I am wrong so I gave the ball 2 U !

Hope you'll find something !
Thank you !
squidge
11-12-2002, 09:30 PM
What OS are you using? Just in case, you do know that hmemcpy bpx will not work under XP ?

Also, what is the program written in, VB, Delphi, C, Asm ?
howie
11-13-2002, 10:45 AM
hi nick,

have you tried so use the search function within si?

s 0 l ffffffff "entered code or whatever" ??

just my two cents ;)
Nigma
11-13-2002, 08:13 PM
First I must say that the NAG which I mentioned in my second
reply is appears in the registered version too !
( the programmers say so in their FAQ )
So I cracked the proggie !

But I am still trying to fish a serial !

Howie :

I tried that but still get lost in the code , the has a lot of shit in
it !!

squidge :

I am using WIN98 , the program is written in C -> PEid says so !
and is packed with UPX -> not a problem to us !
FoolFox
11-14-2002, 07:27 AM
Hello,

Compiled with Borland C++ Builder 5.5.

I wonder if this is not the debug version ??? i've
a lot of what seem to be debug messages...

Regards
FoolFox
karlitoz
11-14-2002, 02:52 PM
hi all!

just playing with some files, the registered nag screen? its into *.clp files (intro.clp)

lookin into sclps directory i found various clp files..

i was think .... lets play with them

copy any *.clp file to main directory (sbck.clp changing its name to intro.clp) and.... voila!!

this app has been registered to.... etc etc etc :)

NOte: playing with others clp maybe could hang up your systems :P

i think this prog no need crack, i think its full version, just the first nag screen telling you must register... but... where put the registration info (i mean name, company, serial??) in the register???

hope you understand my poor english :rolleyes:

Karlitoz
Nigma
11-14-2002, 08:14 PM
karlitoz :

to put the registration info u need to run setup.exe which can
be found in the proggie's directory !

this proggie has one limitation : it shows only 5 pictures and not
all the pictures (*.asc) which are found in the proggie's directory.

Again , I patched it successfully I am just trying to fish the serial.
The answer is windows messages but I am lost in the code !

So try your luck !
squidge
11-14-2002, 10:55 PM
:confused:

The CLP files are just bitmaps, they have nothing to do with registering the program. Overwriting them will only overwrite the nag screen (intro.clp) with another bitmap.

Originally posted by karlitoz
hi all!

just playing with some files, the registered nag screen? its into *.clp files (intro.clp)

lookin into sclps directory i found various clp files..

i was think .... lets play with them

copy any *.clp file to main directory (sbck.clp changing its name to intro.clp) and.... voila!!

this app has been registered to.... etc etc etc :)

NOte: playing with others clp maybe could hang up your systems :P

i think this prog no need crack, i think its full version, just the first nag screen telling you must register... but... where put the registration info (i mean name, company, serial??) in the register???

hope you understand my poor english :rolleyes:

Karlitoz
Nigma
11-15-2002, 08:38 PM
Well guys -> work is finished !
I found the place where the proggie compares our serial
in fact it does not compare the serial to something but
compares our NAME to something . That thing is our serial
mixed with our E-MAIL by a VERY LONG algorithm !
I must say that for a 10 $ proggie this one protected very well !

Thank you all !
squidge
11-15-2002, 11:36 PM
Did you notice any seeds in the algorithm? Just as I'm thinking along the lines of one decent algorithm for all there programs, but with different seeds, rather than a weak, but completely different algorithm for each program.
Solomon
11-27-2002, 08:31 AM
The new versions of games from this company are protected with Elgamal-32 signature algo. Pls refer to another thread in crypto forum section.


HyperLock PE envelope emulator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HyperLock PE envelope emulator
PDA

View Full Version : HyperLock PE envelope emulator

votan
11-12-2002, 10:30 AM
Hi everyone
I prepared an emulator for HyperLock PE envelope ver 6.0 .
HyperLock envelope can encrypt code section and the decryption depends on the keys from the key generator inside the correct dongle.
My emulator can emulate this key generator and works good.
I have tested it.. but I havent released it yet because I try to also
emulate dos,Ne envelope mechanisms too. Maybe I can make a generic emulator..
Also I work on hardware emulation..

At this point I need your help. If you have any Hyper-Lock protected program, please notify me. So I can know about the previous version of HyperLock and use them to improve & test my
emulator(s).

Thank you for your attention.
GaBOSS
08-17-2003, 09:25 AM
i have a DOS program writen in Clipper, who use same type protection. I try to find Entry point after Dongle protected section is unpacked, but program allway exit with memory protection error.
Do you have a some ideas?


Tea
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Tea
PDA

View Full Version : Tea

crUsAdEr
11-12-2002, 12:56 PM
Hi guys,

Just a small question... if i have plaintext and cipher of a TEA encryption, is there a way of extracting the key out of it?

Thanx,
crUsAdEr
NervGaz
11-12-2002, 01:10 PM
You could do a bruteforce attack, but other than that I don't think so....
mike
11-12-2002, 08:33 PM
If you figure out a way, let me know ;)
r4g3
11-16-2002, 01:19 PM
the Tiny Encryption Algorithm is indeed very small and therefore bforcing it may be very fast. Even more - it`s a block cipher so there`s no need to process the whole plaintext. It is sufficient to check if the generated ciphertext for one block mathes the original ciphertext of the same block, this enables to drop the wrong key without processing the whole ciphertext.
The algo implementation has only 2 functions: encipher, decipher.
If to use encipher the above apply.
If decipher - the generated plaintext part & the original plaintext part must be compared.
Well i guess it`s elementary :)
dunno if any of these is faster than the other ...
NervGaz
11-16-2002, 04:17 PM
If anybody's interested... from testing my version of TEA encrypt is roughly 16 clock cycles faster than decrypt... that on a 1.2GHz Tualatin@1.6Ghz In any case 16 clock cycles won't make any major difference
crUsAdEr
11-16-2002, 06:31 PM
Hi guys..

hmm.. how feasible is it to bruteforce a full TEA key then?
10h byte = (2^8)^16 = 2^128 key space??? isnt that too much?

NervGaz, i have written a TEA routine myself but it is by no mean optimised... can I take a look at your code then?:D

Regards,
crUsAdEr
r4g3
11-16-2002, 09:19 PM
10h byte = (2^8)^16 = 2^128 key space??? isnt that too much?

it may be worse :)

1. a file can be used as a key. lets say some 700 MB cd image. in such case every block gets a new key until EOF, then wrapps to the start.

2. though the std number of iterations is 32 it can be changed easily - no need to be a rocket scientist (they r supposed to be 'not stupid') Running thru a vast space of 2^128 iterations may be insuficient if a wrong number is chosen. everything from zero again in this case :)

3. which brand/flavour it is exactly ? the initial streaming or a block cipher ?

what do u expect anyway ? TEA is a strong algo, plus non-standart - XOR & AND. no std known attacks apply (Pollard`s RHO, birthday, ...)

ok. this is the 3rd variant of this post (first 2 went above FFFFFFFF with opera7b crashing )
crUsAdEr
11-16-2002, 11:25 PM
I can confirm it is stardard TEA with 16 bytes key length..

it is CBC with known initial vector... each block is 4 bytes so i guess it is fairly fast.. only the key space is huge... you guys reckon it is feasiable to try bruting this one?

Thanx,
crUsAdEr
cyberheg
11-17-2002, 10:24 AM
No it's not feasiable with that keysize. I wouldn't even waste my time trying. Unless you can find some shortcut which will make it the real key used much smaller then 128 bits it's wasted time.

There were some talk about TEA not beeing fully secure hence a new variant called XTEA was released but I don't think it's weakend enough to call it broken.

In general anything (depending on the algorithm) it's not worth trying anything above 32bit on home computers.
If any of you remember it took 300000 computers and 5 years to bruteforce a RC5 with 32 rounds in the distributed.net challange which was a 64 bit key used.
So now go think how long it will take to do 128 bit.

Good luck.

// CyberHeg
NervGaz
11-17-2002, 08:48 PM
My versions of TEA...

The original TEA version

Encrypt PROC v:DWORD, k:DWORD, n:DWORD

mov edi,v
mov esi,k
mov ebx,[edi]
mov ecx,[edi+4]
xor eax,eax
.WHILE n > 0

add eax,9e3779b9h

mov edx,ecx
shl edx,4
add ebx,edx
mov edx,[esi]
xor edx,ecx
add ebx,edx
mov edx,ecx
shr edx,5
xor edx,eax
add ebx,edx
add ebx,[esi+4]

mov edx,ebx
shl edx,4
add ecx,edx
mov edx,[esi+8]
xor edx,ebx
add ecx,edx
mov edx,ebx
shr edx,5
xor edx,eax
add ecx,edx
add ecx,[esi+12]

dec n
.ENDW

mov [edi],ebx
mov [edi+4],ecx
ret
Encrypt endp

Decrypt PROC v:DWORD, k:DWORD, n:DWORD

mov edi,v
mov esi,k
mov ebx,[edi]
mov ecx,[edi+4]
imul eax,n,9e3779b9h
.WHILE n > 0

mov edx,ebx
shl edx,4
sub ecx,edx
mov edx,[esi+8]
xor edx,ebx
sub ecx,edx
mov edx,ebx
shr edx,5
xor edx,eax
sub ecx,edx
sub ecx,[esi+12]

mov edx,ecx
shl edx,4
sub ebx,edx
mov edx,[esi]
xor edx,ecx
sub ebx,edx
mov edx,ecx
shr edx,5
xor edx,eax
sub ebx,edx
sub ebx,[esi+4]

sub eax,9e3779b9h

dec n
.ENDW

mov [edi],ebx
mov [edi+4],ecx
ret
Decrypt endp

The newer one I think it was called TEAn or something like that

tean PROC uses ecx ebx esi edi data:DWORD,key:DWORD,rounds:DWORD
LOCAL limit:DWORD

mov eax,data
mov ebx,rounds
mov edi,key
mov edx,[eax]
mov ecx,[eax+4]
xor eax,eax
dec eax
.IF ebx>80000000h
neg ebx
imul eax,ebx,9E3779B9h
.IF eax!=NULL
.WHILE eax!=NULL
; First 32 bit chunk
mov ebx,edx
shl ebx,4
mov esi,edx
sar esi,5
xor ebx,esi
mov esi,eax
xor esi,edx
add ebx,esi
mov esi,eax
sar esi,11
and esi,3
add ebx,[edi+esi*4]
sub ecx,ebx
; Second 32 bit chunk
sub eax,9E3779B9h
mov ebx,ecx
shl ebx,4
mov esi,ecx
sar esi,5
xor ebx,esi
mov esi,eax
xor esi,ecx
add ebx,esi
mov esi,eax
and esi,3
add ebx,[edi+esi*4]
sub edx,ebx
.ENDW
.ENDIF
.ELSE
inc eax
imul ebx,9E3779B9h
mov limit,ebx
.IF eax!=limit
.WHiLE eax!=limit
; First 32 bit chunk
mov ebx,ecx
shl ebx,4
mov esi,ecx
sar esi,5
xor ebx,esi
mov esi,eax
xor esi,ecx
add ebx,esi
mov esi,eax
and esi,3
add ebx,[edi+esi*4]
add edx,ebx
; Second 32 bit chunk
add eax,9E3779B9h
mov ebx,edx
shl ebx,4
mov esi,edx
sar esi,5
xor ebx,esi
mov esi,eax
xor esi,edx
add ebx,esi
mov esi,eax
sar esi,11
and esi,3
add ebx,[edi+esi*4]
add ecx,ebx
.ENDW
.ENDIF
.ENDIF
mov eax,data
mov [eax],edx
mov [eax+4],ecx
ret
tean ENDP

both of them could be optimized both for speed and size if I felt like it but the easiest oine would be to remove the possibilty to chose the amount of rounds and calculating a set limit value, but that probably won't happen
Bengaly
11-18-2002, 06:44 PM
hey , same algorithm as in REA #4
:)
geeker
12-04-2002, 05:25 AM
TEA and XTEA are both Fiestel networks. Attemping to recover a key under a known plaintext attack is equivalent to solving nonlinear equations over Z_2. This is NP-hard.

On a slightly related note, for encrypting large blocks of data with TEA (or XTEA), the inner loop can be sped up significantly by pulling the keyschedule computations out. Unrolling the loop by a couple of iterations also helps. Check out libtomcrypt at http://libtomcrypt.iahu.ca

Granted, this won't help brute forcing a key, since any single key isn't reused, so you'd need to recompute a new key schedule anyway.
mac
12-30-2002, 10:07 AM
I totally agree with cyberheg - 128 bit keysize are completly out of range. Imagine a counter counting from 0 to 2^128 - even if this counter runs with 10 mio counts per second you would need longer than the universe will exist to count...

so try finding some papers on vulnerabilities of TEA - but i guess you wont be that lucky....

cya

mac
tgodd
12-30-2002, 03:40 PM
You could speed up your bruting by considering the following:

The highest likelyhood is that there will be an equivalent number of high bits as low bits in the key.
On the flip side it is less likely that the key will contain all the bits high, or all bits low.

So as opposed to using an algo that would do a standard count,
i.e. 1 2 3 4 5 6 . . .
you would have a routine which would start with equal high bits to low bits, i.e.
on an 8 bit key it would start 0f 17 1b 1d 1e 27 2b 2d . . .
and once finished the equal high to equal low
it would then start with the sequences which are unevenly balanced by 2 bits then by 4 , etc, etc.

regards,

tgodd
mike
12-30-2002, 09:10 PM
you would have a routine which would start with equal high bits to low bits, i.e.
on an 8 bit key it would start 0f 17 1b 1d 1e 27 2b 2d . . .
and once finished the equal high to equal low
it would then start with the sequences which are unevenly balanced by 2 bits then by 4 , etc, etc.Let's consider how many of those there are, OK?

Given 128 bits, you want to pick 64 of them to be on and 64 off. That's 128 choose 64 = 128!/(64!64!) = 2x10^37 = 2^124. So you've only cut down the search space by a factor of 16, and you don't even know if your assumption is right!
tgodd
12-30-2002, 09:45 PM
You are correct that an assumption is being made.

However, you must treat the unknown as a random.

Statistically, what I have suggested is by far the quickest
way to brute force the unknown number.

Random numbers:
If you analyze any random number it rarely reaches the maximum and rarely reaches minimum, and is more likely to be someplace closer to the middle.

Whatever gains can be made in bruting out a number, can only be advantageous.

P.S. It was only a suggestion. I am only trying to contribute, based on my experiences.

Regards,

tgodd
mike
01-03-2003, 04:25 AM
P.S. It was only a suggestion. I am only trying to contribute, based on my experiences.We appreciate that. I was trying to point out that 2^124 is still far too big a keyspace to brute-force.
tgodd
01-04-2003, 12:17 AM
Don't get me wrong.
My method will not reduce the total loop count.

It will statistically increase the chances of an early hit.

that is all.

regards,

tgodd
comrade
01-04-2003, 03:53 AM
How did this discussion go from finding key if both plaintext and ciphertext are known to brute-forcing key?
mike
01-04-2003, 08:24 AM
Well, you can't bruteforce the key if you know less than a plaintext and its ciphertext, and there's no faster way known to get the right key given plaintext & ciphertext than by bruteforce.


ExeStealth 2.41 EXE Protector
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ExeStealth 2.41 EXE Protector
PDA

View Full Version : ExeStealth 2.41 EXE Protector

squidge
11-12-2002, 06:16 PM
Well, just downloaded this to see what it has over the competition. It claims to be a Cryptor, CRC Protect, Anti Dump, Anti Softice & Anti smartcheck. Well, that's what you get from the program.

In reality, it must be the weakest EXE protector out there. I don't know if things are different under 98, but under XP it takes about 5 seconds to unpack a program "protected" with it.

It adds about 30Kb to the site of any EXE protected. The first thing you notice with the packed and "protected" program is that all the programs protected by it smell of UPX, and that is because they are UPX-packed programs (well, the loader is anyway). However, unpacking them, dumping them from memory/etc is useless as all you'll get is the loader. You'll not get the original program.

Look at the main protector program again and you'll find it also packed with UPX, and once unpacked, find out it's written in Delphi.

Unpacking the loader reveals more interesting information though:

c:\temp27¦_$\

Yup, you guessed it. All protected apps, when run, are unpacked into that directory. They have the hidden bit set, but that's about it. Copy the EXE out of that directory, and you have the unpacked program in it's original form - not even slightly modified.

Now what I can't believe is that this "protector" is shareware, and they expect you to pay money for it.

Am I missing something here, or does this program simply take your EXE, encrypt the entire file as if it was just a straight binary file, and then stick it's own AntiSoftice, AntiSmartcheck, CRC Protected stub on the start?
SpeKKeL
11-12-2002, 07:15 PM
hehehe....

I reported this some time ago to the autor's website (forum) ....
Whithin a half our the forum was closed...:eek: .
Well is does what is says: it stealths the temp.exe.:p

Ciao,

Spekk
squidge
11-12-2002, 09:24 PM
Well, yeah, it does indeed stealth the EXE... until you run it, that is :)

With this being a new version, and being at 2.41, I expected a little more. I'd love to see what 1.00 was like!

I can't believe they don't know how to unpack the program to memory and run it from there, or perhaps it's there patented "unpack to disk" method that makes the programs completely undumpable, and that they are so proud of that feature, they want to keep it as-is!


Hardlock dongle, locking up SoftIce (with windows hang)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hardlock dongle, locking up SoftIce (with windows hang)
PDA

View Full Version : Hardlock dongle, locking up SoftIce (with windows hang)

cyco2
11-14-2002, 08:43 AM
Hello,

Sorry I start my first post with a question. I must say I searched through this forum for a while, and unfortuniatly I couldn't found an anwser. Thank you for trying to help me.

I got a program, it is protected with a hardlock key. Atm I got not the hardlock key here, but if I need it I can arrange it (or at least a dump of it). Can I use those "emulator-software" dumpers? or will it only dump in such a way, the company who supplied it can make sense of it?

Now to the program itself ;), I was trying to run it without a dongle... and what u think I got .. the famous message:

------------------------------------------
"Error 7 : Hardlock not found."
------------------------------------------

I think it is pretty clear now, by what dongle it is protected. I looked at the sections, it contains a ".Protect" section. And the Entry Point is pointing to somewhere in that section. BUT, when I start on my Win2k machine Softice and I try to re-run the program my computer hangs. I tried tools to hide SI, but well under NT there aren't much who can. So Installed on some other computer Win98, I start up there clean, install the program. Same msg box, after installing SI, it hangs ALSO :(. Now I tried FrogSice, it gave me 2 places with SoftIce detection. when I press on both places Yes in frogsice-his-blue-screen, the program crashes somewhere in the hardlock.vxd...!?!

Is there a standard procedure for hardlock?, is this what I describe normal, or are this some kind of own implementations of the coder.

I red somewhere on the Inet, that Hardlock uses 3 softice detections. The CreateFileA method, and some others, how can I defeat them all?

Sorry, but I really will stop asking now hehehe :P, but my last question is, how can I see clearly if the program is encrypted. I can disamble, and see lots of string references, normally I should say no, but well I don't have to much experience with this all.

Thanx a lot for reading. I hope somebody can help me out :)

Goofy
[FreeStylers]
esther
11-14-2002, 10:40 AM
Hi,
I assume you have read the FAQ.
The main page of Rce messageboards Regroupment there's
a link which has large info's on dongles:CrackZ Archive.
cyco2
11-14-2002, 11:46 AM
hmm, yes... but well of coarse I cannot say I red ALL the tutorials, but the ones I think I could find about hardlock, aren't telling me how to defeat the anti-softice thingy. Please correct me if I'm wrong, and better present a link which could help me then :)

thanx again.
tgodd
11-14-2002, 12:29 PM
Hardlock is not a nice target for a newbie.

Regardless of how many tutorials he reads.

Hardlock will play with the DR7 register as well as the debug registers.

You have to find the place in the driver and patch them out.

Unfortunately, I am unable to help you any further with this.

The readers out there typically will just build a big table, which then gets used to calculate the 3 - 16 bit numbers used by the algo unit. These numbers are NOT held in the serial eeprom.

Regards,

TGODD
Manko
11-14-2002, 12:43 PM
Anti-anti-softice-info for w2k(NT) was recently discussed here and the sollutions are ready for deployment... You just have to search...

If you don't have the same version of sice there are hints to older threads that contain the info you need to work it yourself...

It is not always so that every aspect of a crack is addressed in a tut. So you have to search for info on that separately...

Good Luck!
/Manko
cyco2
11-14-2002, 01:15 PM
I understand what you all saying, though I red all the tutorials that has the word hardlock in it (that where found by google). I still doing my best. I understand that there are various ways for soft-ice detection, I will just try some more.

but how can I be sure the program "needs" a dongle for decrypting, is it encrypted when the EP is pointing to the .Protect code? or does this means nothing?.

Anyway, I'm very pleased with the help of ya ppl here ;)
UrgeOverKill
11-15-2002, 01:54 AM
Hi Cyco2,

If you do a search on this board with the term Hardlock, you will find 18 possibilties with your answer, and as I searched through them I found many threads that will lead you toward your answer.
cyco2
11-15-2002, 07:40 AM
Well I'm sorry people, I may be very greeny new to this forum (and understand / accept ppl are bitching to newbies), but I'm not new to cracking. I keygenned a lot, though I must say dongles are quiet new for me. I did a search yes, but please don't tell me all the post contains anwsers for me, but for then I understand, I'm new so why spent time.

Sorry to ask these questions, I guess u ppl should ignore them. Though if you are a nice guy, and you want to help a fellow cracker out, response here then please. With some information that is more useful then:

Look in search etc.

I really did look in them. :(

well anyway, if some1 needs help on keygenning drop me a line, I AM willing to help ;)

ps. Of coarse I'm pleased by the responsed I got from ppl that tried to help me, please don't feel offended.
cyco2
11-15-2002, 07:07 PM
g00d... I did some more research.

the program is protected with HL-CRYPT.
I got thanx to "nikolatesla20" (anti anti si patches) rid of the Soft-Ice hang in Win2k. Though somewhere SI is still detected. I get now this error:

---------------------------
Hardlock Protection System
---------------------------
Error 1003 : Internal Error.
---------------------------
OK
---------------------------

I guess it is another anti debugger check. I was reading all the tutorials, and HL-CRYPT isn't possible to solve without a dongle. Well I could arrange a dump of the dongle. But is this enough? Is there any1 who did some HL-CRYPT analyses? I'm willing to write a big tutorial how I do this crack. I hope I can get some support :)

sorry about my bitching earlier, just got frustrated from reb00ting ;) hehehe

Thanx ppz...
cyco2
11-15-2002, 09:17 PM
Alright I found some more interestion stuff...
The Int 3 Check I think... look here:

00AEFEDB 93 XCHG EAX,EBX
00AEFEDC 8ADB MOV BL,BL
00AEFEDE CC INT3 <== This is some kind of bastard
00AEFEDF 0F85 70040000 JNZ 00AF0355 <== Jumps here

The registers had the following values:
ESI = 00004647
EDI = 00004A4D

From crackz his page I saw this:
--------------------------------------------------------
:? 4647
00004647 0000017991 "FG" <-- Magic Val. 1.
:? 4A4D
00004A4D 0000019021 "JM" <-- Magic Val. 2.

28F1:0092 MOV SI,4647
28F1:0095 MOV DI,4A4D
28F1:0098 PUSH CS
28F1:0099 POP DS
28F1:009A MOV AX,0911h <-- Function 0911.
28F1:009D MOV DX,000Eh <-- Points at null-terminated command (in this case HBOOT).
28F1:00A0 INT 3 <-- Call Interrupt.
--------------------------------------------------------

Well should I just nop that int 3 instruction?

When I do it goes further for a while... jumping from jmp to jns to jmp etc :(
but anyway after a while it will enter the NTDLL module and after running this code

77F83789 > B8 1C000000 MOV EAX,1C
77F8378E 8D5424 04 LEA EDX,DWORD PTR SS:[ESP+4]
77F83792 CD 2E INT 2E

it will jump the next instruction.

00AEE72A 0000 ADD BYTE PTR DS:[EAX],AL
00AEE72C 0000 ADD BYTE PTR DS:[EAX],AL
00AEE72E 0000 ADD BYTE PTR DS:[EAX],AL
00AEE730 60 PUSHAD
00AEE731 8BC9 MOV ECX,ECX
00AEE733 E6 C1 OUT 0C1,AL <======= It suddenly starts here, but crashes on the instruction
00AEE735 50 PUSH EAX
00AEE736 77 66 JA SHORT 00AEE79E
00AEE738 47 INC EDI

After crash I get this message box:

---------------------------
sttwin.original.exe - Application Error
---------------------------
The exception Privileged instruction.

(0xc0000096) occurred in the application at location 0x00aee733.

Click on OK to terminate the program
Click on CANCEL to debug the program
---------------------------
OK Cancel
---------------------------

Well I really don't have a clue... how to track this all down :(

[*EDIT*]

Some more information, This is from Win98SE
btw.... FrogsIce tells me this:
------------------------------------------------------
=> Sttwin
** SOFTICE DETECTION ** code 0B, at cs:00AFA1EA
Attempting to load: SIWVID (string ref at cs:00D2FBC4)

=> Sttwin
** SOFTICE DETECTION ** code 02, at 0167:00AEFEDE
Interrupt:03h eax=40128300h ebx=49B80C01h ecx=00000DF0h
edx=00AF11D0h >esi=00004647h >edi=00004A4Dh ebp=00D2FB40h

SEH proc address at cs:7FC39E61
------------------------------------------------------

then the program crashes on a instruction in the Hardlock VXD


Nice article
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Nice article
PDA

View Full Version : Nice article

Maldoror
11-14-2002, 11:35 AM
Hello

I have found an article that could be interesting for newbies:
http://www.codeproject.com/useritems/stackdumper.asp

Greetings!
M.


Please Help w/ FoolFox Tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Please Help w/ FoolFox Tutorial
PDA

View Full Version : Please Help w/ FoolFox Tutorial

ftothe3
11-14-2002, 02:49 PM
I'm a newbie (thats why im posting this here) trying to learn something from the tutroials. Ok.. so i opened up a few of them, then got around to reading FoolFox's Tutorial (http://www.woodmann.net/fravia/ffx_ftpp2.txt) [target: PrimaSoft AutoFTP premium v3.4] I have win32dasm 8.93 and winhex 10.55 (like him) I followed the tutorial closely... the only problem i'm having is not being able to find the string refs: "Code Accepted! Thank you for registering " "Code Not Accepted! Please try " in win32dasm. this is the code i get in win32dasm:
:004C877E 668B0DB8874C00 mov cx, word ptr [004C87B8]
:004C8785 B202 mov dl, 02
:004C8787 B8C4874C00 mov eax, 004C87C4
:004C878C E80FFAF8FF call 004581A0
:004C8791 EB15 jmp 004C87A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004C877A(C)
|
:004C8793 6A00 push 00000000
:004C8795 668B0DB8874C00 mov cx, word ptr [004C87B8]
:004C879C B202 mov dl, 02

BUT in the tutorial he gets this code:
:004C877E 668B0DB8874C00 mov cx, word ptr [004C87B8]
:004C8785 B202 mov dl, 02

* Possible StringData Ref from Code Obj ->"Code Accepted! Thank you for registering "
->"our software."
|
:004C8787 B8C4874C00 mov eax, 004C87C4
:004C878C E80FFAF8FF call 004581A0
:004C8791 EB15 jmp 004C87A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004C877A(C)
|
:004C8793 6A00 push 00000000
:004C8795 668B0DB8874C00 mov cx, word ptr [004C87B8]
:004C879C B202 mov dl, 02

why aren't i getting this "stringdata ref"?!?!
btw: followed the rest of the tutorial and got the serial... but without this "stringdata ref", i wouldnt of known where to begin!
FoolFox
11-14-2002, 03:19 PM
Hello,

In order to reproduce your step, i've just DL the target and
the shareware version of W32Dasm. As i could'nt get it
right now from members.cox.net/w32dasm (trouble with
connection right now), i've grabbed it from
h**p://www.downseek.com/download/21279.asp,
wich should be just the plain demo version.

Si i ran again the setup (previous was erased a while ago :)),
I don't think there was track of previous cracked version on
my HD, and the installed FTP was reacting as a normal
shareware version (nag screen, etc...)

I've taken it under the demo version of W32Dasm i've
just DL, and using String reference, i got among others :

"CoAddRefServerProcess"
"CoCreateInstanceEx"
"Code Accepted! Thank you for registering "
"Code Not Accepted! Please try "
"CoInitializeEx"
"COMBOBOX"

Double click on the string directly lead me to :

:004C877E 668B0DB8874C00 mov cx, word ptr [004C87B8]
:004C8785 B202 mov dl, 02

* Possible StringData Ref from Code Obj ->"Code Accepted! Thank you for registering "
->"our software."
|
:004C8787 B8C4874C00 mov eax, 004C87C4
:004C878C E80FFAF8FF call 004581A0
:004C8791 EB15 jmp 004C87A8

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004C877A(C)
|
:004C8793 6A00 push 00000000

So, right now i'm not really able to figure why you didn't get
the ouput as you should.

As the tutorial was clearly targeting newbies, i found it quit
disapointing that you could not get the result I got, and I'm
really willing to find why, in order to update the tutor. So,

- What OS are you running on ?
- What kind of processor are you using ?
- What are your regionnal settings ?
- Are you using a special charater set ?

anything you can think about, just PM or mail me the info,
if you can recall where you get your copy of W32Dasm
(i've got so many version myself, demo, c*...., patched....)

Right now, what you could try, is to reproduce the whole stage
using OllyDebug, i've just checked it, you should be able to
follow each stage with it, as in W32Dasm. Once loaded
OllyDebug, right click on the code, select 'search for', then
'all referenced text string'. Among result you should get :

Text strings referenced in Ftpprem:CODE, item 8493
Address=004D61DD
Disassembly=MOV EAX,Ftpprem.004D623C
Text string=ASCII "Code Accepted! Thank you for registering our software."

From there, reproducing the W32dasm stage should be
quit easy... but i'm still willing to understand why you didn't
got it directly with W32dasm....

I've done it under WinNT 4.0 & Windows 98. Sames results.

Regards
Foolfox
ftothe3
11-14-2002, 04:52 PM
thanks for the really quick reply foolfox!
ok this is my system info...
os: win xp (NO sp1)
processor: athlon xp 1800+ (intel sucks :-P)
regional settings: united states
special character set: none

anyway... i decided to try downloading another version of win32dasm... and it worked!!!! i downloaded the it from the link you gave me and another link (http://www.exetools.com/files/disassemblers/wdasm89.zip) BOTH WORKED! this is the weridest thing ever.
you probably don't believe that it didn't work with my other version so here are two screen shots: (hosted on my apache webserver :).. yes i live in new york)
http://ftothe3.dnsalias.com:6080/stringrefwindow.JPG
http://ftothe3.dnsalias.com:6080/stringrefnotincode.JPG
(side note: my service provider doesn't let me host on port 80 ;))
IF for some reason you want to download the version of w32dasm that was giving me trouble, here it is: http://ftothe3.dnsalias.com:6080/W32Dasm.zip (i just zipped it)

WOW.. thank you.. now i know why ALL those tutorials weren't working!!!!!!!!!!:D :D :D :D :D :D (sorry maybe i'm a little too excited)
crUsAdEr
11-14-2002, 05:53 PM
Hi guys,

This might not help but i have encountered this problem before with W32dasm not showing string reference... that is unpacked file with its data section flag as "uninitialised data" tehn W32dasm will not be able to get string reference...

Also, i think you need a W32dasm patch for it to show Unicode string reference...

Foolfox : kickass tutorial for newbie, very nice.. just a small comment
++++++++++++++++++++++++++++++++++++++
Go back to W32Dasm, and search for the string "Code not accepted". Notice that we
are not going through the String reference menu, which will only show you the
FIRST occurence of the string. We want to see all place where this string is used.
That's why the search should be done through the search menu, and not the string
ref menu.
++++++++++++++++++++++++++++++++++++++

That is not true, you can double click on the string in the string reference box and W32dasm will bring you to the next reference if any... not very important but ah well .. though i will just let you know..

cheers
crUsAdEr
FoolFox
11-15-2002, 07:20 AM
Hello,

crUsAdEr : Tnx for the info, i though it didn't worked, probably
have try wrongly once or twice and didn't retry....
will review the tutor.. :)

ftothe3 : Glad to ear you finally get womething :)
have take your copy of W32Dams and got same
results, I'll compare it with the one I got and try
to find out why this one didn't report all string, as
have stated cdUsAdEr, probably a question of
patching somewhere.....

I'll let you now if i found something about it...

Regards
FoolFox
FoolFox
11-15-2002, 01:21 PM
Hello,

Ok, there is two bytes that differ from your W32Dasm of
the standard distribution:

If i take the first version you tryed :

00417568 |. 75 28 JNZ SHORT W32bad.00417592
0041756A |. 8D85 98F4FFFF LEA EAX,DWORD PTR SS:[EBP-B68] <= this is the modified value
00417570 |. 50 PUSH EAX ; /String
00417571 |. E8 DE760900 CALL <JMP.&KERNEL32.lstrlenA> ; \lstrlenA
00417576 |. 83F8 04 CMP EAX,4

In the standard edition, the value is :

0041756A |. 8D85 28F6FFFF LEA EAX,DWORD PTR SS:[EBP-9D8]

And this code is exactly the loop that will fetch all strings, if
you trace the code in the standard version, you'll see all
strings coming one after the other, using your version nearly
all string returned are empty.

I don't understand the point of doing this modification. It
probably have been patched (i would find it quit strange that
a corrupted sownload will result of just those two adress bytes
changed), but i don't understand in order to get what it would
have been patched this way. Maybe someone more experienced
can give a hint about ??

Regards
FoolFox
?ferret
11-26-2002, 01:21 AM
Maybe it's the version patched to show VB string refs?

(Been awhile since I've bothered with the patched version, but I remember I used to keep both versions of the executable because the patched one would give odd results on "normal" exes)

Just an idea...
FoolFox
11-26-2002, 07:44 AM
Hello,

Think also of something like that, got several version of
w32dasm but the one i got patched for VB string is not
exactly the same version as the one i got not patched, so
if i try to locate what the patch have modified i found too
much results actually, still trying to get two same version
one patched the other one not in order to check if that was
the case... but it seem's i've also tryed several version of
w32dasm and none of mine acted like the one of ftothe3..
(in each case i was able to see the messages)...

still looking.. :)

Regards
FoolFox


Need help before i go nuts!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help before i go nuts!
PDA

View Full Version : Need help before i go nuts!

Snoop
11-15-2002, 12:33 AM
Hi all,
I am doing a crackme that i had to do a couple of work on it to do my homework!. Everything i had to do is done. I understand how the serial is generated with the name and every thing. Since i am more than a newbie :D even if the work on this crackme is finish i wanted to go further and learn more. So i decide to do a keygen for the crackme. Nothing to write my mom about, but still, for a newbie it's just ok. I am using radASM and the keygen is in MASM. I could read asm good, but to write it and code with it it's another thing. It's not my programming language as i work with a 4gl in life. Ok nof said.

What i did is only took the code block that generate the serial in the dead listing (am using ollydbg) and took it to generate in the keygen. Brefly, the only thing to do is recreate the same thing that the proggie does... But when i click on the generate button i have a window error message telling me that the application is using blabla part of the memory and that this cannot be "read"...
In other word, it stop! I suppose that in my routine i probably use a register that am not suppose to.. anyway. Could somebody point me out as i am really confuse :confused:
Here is the code for those who could see the problem write away and below i will include the src with the exe. Waiting a reply i will continue and try to figure out what is the problem.
Am on win2k, this prog is writting with RadASM v1.1.2.7, and link and build with MASM v5.
Keep in mind that i am a real newbie in asm programming so please dont come up with some complex explanation. :D
Snoop

Keygen proc
xor edx, edx
xor eax, eax
xor ebx, ebx
mov edi, offset buffer2 ; EDI will have the serial generated
mov esi, offset buffer ; ESI hold the name entered
mov ecx,10
JMP1:
MOVSX EAX,BYTE PTR DS:[ESI+EBX] ; Pickup character
test al, al ; Verify if finish
jz JMP2 ; If finish then get see u!
CDQ
IDIV ECX
XOR EDX,EBX
ADD EDX,2
CMP DL,10
JGE jmpsub
MOV BYTE PTR DS:[EDI+EBX],DL
INC EBX
JMP JMP1

jmpsub:
SUB DL,10

JMP2:
xor edx, edx
xor eax, eax
xor ebx, ebx
ret
Keygen endp
end start

** this is a refresh version
Kayaker
11-15-2002, 04:13 AM
Hi

Works for me on Win98SE. I don't see anything overtly wrong with your code or the compiled PE. You could try upgrading to MASMv7 or use the .386 directive instead of the .586 one with MASMv5. Have you verified the DS: qualifier in your mov statements doesn't point to an invalid data segment with Win2K for some reason? Try removing them (they're not really necessary) and see what happens. Debugging with Softice should lead you to the invalid call I would think.

Kayaker
Snoop
11-15-2002, 05:24 AM
hi Kayaker, i have removed the ds statement, nothing change.
I tried after, instead of picking up each character of the name entered with MOVSX EAX,BYTE PTR DS:[ESI+EBX] statement to
LODSB and instead of saving with MOV BYTE PTR DS:[EDI+EBX],DL
i put STOSB, in a way or another they all point to the same register(that's what i've read...) and i still have the same error message... :(
Thank's for your advise anyway. I will keep on looking up, try to change couple of things a see how it goes..
Keep you inform of that.

Snoop
Kayaker
11-15-2002, 07:35 AM
What's the exact error message? Like, what's the blabla in "blabla part of the memory"?
Snoop
11-15-2002, 07:59 AM
Well.. i am trying to upload a snapshot but dont seem to find how to do so..
anyway its a windows error message saying...

Instruction "0x77e0fa1c" is is using memory segment
"0x0000002b". The memory could not be "read"

Click ok to terminate the program.
Click Cancel to debug the programe.

Note that this is translate as i work with win2k (french) but it exaclty what it mean's..

Like i said, at one point in the program i guess that am using a bad register to do a certain instruction. It compile but go crazy when running.
--> Kayaker, you say that it's running on win98se? If you put a name and click on the generate does it actually generate you something?

Snoop
Snoop
11-15-2002, 09:14 AM
Ok, i have some development here as my wife and kids are about to get up for a new day, and me the crazy i did a trip round the clock :o

at the begining of the keygen procedure i do a xor ebx,ebx (to put it at zero) and a bit further i am using this ebx to do a xor and increment it for my loop.

well this is the problem, if i remove the xor ebx,ebx at the begining there is no problem but the result is not good. When i have the xor ebx,ebx at the begining i have the error msg when running.. humm :confused: So i tried to initialize it with a mov edx,0 instead.. nop! wrong answer. So i really have a problem with this logic. I found the problem debuging with ollydgb(tried sice but for now find this one more convivial for newbie).

So there i am. Stick with some register... and still dont know how to correct it..

Snoop
neviens
11-15-2002, 10:06 AM
Try to save used registers @ begin of proc and restore
at end:

push ebx
push ecx
.
.
.
pop ecx
pop ebx

Neviens.

PS Your source compiles different and don't work on
my w98se, but precompiled .exe works well.
ZaiRoN
11-15-2002, 10:07 AM
Hi Snoop.

first of all, I have seen the image; the link http://www.quebecweb.ca/images/errormsg.jpg is right, where's the problem?

I have win98se too and I have tried your keygen, no crash for me. I don't know why your proggie crash
Anyway:
If you put a name and click on the generate does it actually generate you something?I inserted a name and the keygen generated this sequence of bytes: 02h 08h 09h 03h 07h
Strange serial, I bet the right serial is 289375 (02h+30h, 08h+30h, ...).

I read you have ripped the code from the original crackme; this might be the problem. Are you sure you have not missed something?
Here is a little thought (I could be wrong) about the keygen which might help you:
CMP DL,10 <-- the serial is filled with numbers (0..9)
JGE jmpsub
MOV BYTE PTR DS:[EDI+EBX],DL
INC EBX
JMP JMP1

jmpsub: <-- you will arrive here if DL is not in 0..9 range
SUB DL,10 (*) <-- after that: 0 =< DL < 10 so it might be a new serial char

JMP2:
xor edx, edx <-- edx = 0(*) which is the sense of this? Maybe after that there is a jmp instruction to 'MOV BYTE PTR DS:[EDI+EBX],DL'

my 2 cents...

regards,
ZaiRoN
Snoop
11-15-2002, 10:58 AM
--> neviens, i will try that. Thanks.

--> ZaiRoN, here is the gen from the crackme

1 - 401632 |> 0FBE041E /MOVSX EAX,BYTE PTR DS:[ESI+EBX]
2 - 401636 |. 99 |CDQ
3 - 401637 |. F7F9 |IDIV ECX
4 - 401639 |. 33D3 |XOR EDX,EBX
5 - 40163B |. 83C2 02 |ADD EDX,2
6 - 40163E |. 80FA 0A |CMP DL,0A
7 - 401641 |. 7C 03 |JL SHORT 401646
8 - 401643 |. 80EA 0A |SUB DL,0A
9 - 401646 |> 88141F |MOV BYTE PTR DS:[EDI+EBX],DL
10- 401649 |. 43 |INC EBX
11- 40164A |. 3B1D 63344> |CMP EBX,DWORD PTR DS:[403463]
12- 401650 |.^75 E0 \JNZ SHORT 401632

Ok, my understanding of this is that...
(refer to number at left)
eax hold the name
ecx = 10
PTR DS:[403463] hold the lenght of the name entered

1- move in eax 1 character from the name, wich would be the
character at the position that ebx have, ex ; Name = Snoop and
ebx = 0, then we pick up "S" and so on...

2- Converts the signed dword in EAX to a signed quad word in
edx:eax

3- Signed integer division, in this case the src value is a word so
dx:ax is divided by ecx (wich is 10), the quotient is stored in AL and the remainder in dx.

4- perfome an exclusif or
5- Add 2 to edx
6- Compare DL with 10
7- If dl is less to 10 then jump the next line
8- if dl is equal or greater to 10 then substract 10 to dl
9-Store the first number of the valid serial
10- inc ebx for the loop purpose
11- Compare ebx with the length of the name user have input
12- if not zero then perform the hole thing again.

Ok, now there 2 other loop after this, one who perform calculation of the serial that the user as entered and the other one is the validation. But the one important is the one describe.
So now my problem is not really the understanding it's more the programming in asm! :D
So what i thought was simply that the same peace of code and badabim badabang i would have a nice little kengen. But it look's like the asm program do not like what am doing with EBX register, as i mention before in previous reply. I really dont know why.. here is my new procedure as i work on it and change it. Now this is working(well...way of speeking) but the serial that it generate's me is this square character , if i enter Snoop i will have 5 square character as serial... :rolleyes:

Keygen proc
xor edx, edx
xor eax, eax
;if i do a xor ebx,ebx or mov ebx,0 here it will crash at run time.
mov edi, offset buffer2
mov esi, offset buffer
mov ecx, 10

JMP1:
LODSB
test al, al
JZ JMP6
CDQ
IDIV ecx
XOR EDX,EBX
ADD DL,4
CMP DL,10
JGE JMPSUBIT
MOV AL,DL
STOSB
INC EBX
JMP JMP1

JMPSUBIT:
SUB DL,10
STOSB
INC EBX
JMP JMP1

JMP6:
ret
Keygen endp

I think i know why, this is because before entering in the loop, EBX is not at zero, it hold some kind of value from i dont know where, and i cant perform a xor ebx,ebx or a mov ebx,0 just before entering in the loop because then it will crash at execution.
So i hope i was clear... maybe a bit to much!!! :D
Thanks

Snoop
ZaiRoN
11-15-2002, 12:01 PM
Maybe I misunderstood you, sorry :rolleyes:

Please, correct me if I'm wrong (I need to understand). You have fundamentally two problems:
1. Find the reason why the proggie crash
2. Find the right serial (and not 5_square_character)

1.
Your keygen crash when ebx=0; this sounds strange. Have you tried to step (line after line) the keygen with Olly ? Which is -exactly- the instruction that cause the crash? The 'xor ebx, ebx'?

2. Ok, now there 2 other loop after this, one who perform calculation of the serial that the user as entered and the other one is the validation. But the one important is the one describe.- the crackme takes the name and performs a calculation on it obtaining n1
- the crackme takes the serial and performs a calculation on it obtaining n2
- if n1=n2 then you are registered, otherwise not registered
Does the program work in this way?

I think i know why, this is because before entering in the loop, EBX is not at zeroHmmm... are you sure? Either if ebx=0 the serial will be *5_square_character*...

ZaiRoN
Manko
11-15-2002, 12:23 PM
You have to format your key for output, else it won't display...
The code snippet you have was never meant to SHOW the key...

As for the crash... dunno. Maybe you can't send it such a "faulty" string?
(I know Jack-shit about programing, though...)

/Manko
Snoop
11-15-2002, 04:23 PM
ZaiRoN
Please, correct me if I'm wrong (I need to understand). You have fundamentally two problems:
1. Find the reason why the proggie crash
2. Find the right serial (and not 5_square_character)

1. Find the reason why my keygen is crashing
2. yes

the crackme takes the name and performs a calculation on Does the program work in this way?
Yes, exaclty like that.
This is the second loop of the crackme (Take the serial that the user have input)
MOVSX EAX,BYTE PTR DS:[ESI+EBX]
99 |CDQ
F7F9 |IDIV ECX
MOV BYTE PTR DS:[EDI+EBX],DL
43 |INC EBX
3B1D 63344> |CMP EBX,DWORD PTR DS:[403463]
JNZ SHORT 401632

It does the same thing except the xor, adding 2 and sub 10 if greater.

And the final loop only compare the result of first loop with result of second loop.

So for my key gen i only have to take the same code as the first loop but except adding 2, i have to add 4 to dl before storing because in the second loop of the crackme(the calculation made by the serial entered) there is not the addition.

Ex, name Snoop
valid serial 75760
if i enter this it will go to good boy
what it did
The first loop, after generating the valid serial for Snoop in edi i have a result of 53548
The second loop, after taking the serial that i have entered(who was 75760) and perfoming the calculation will have have 53548
Third loop compare both and jmp either bad or good boy.
Me, in my key gen, i take the name entered, perform the same calculation as the first loop but instead of adding 2 i add 4 in order to get a valid serial number.

Maybe Manko is right here

You have to format your key for output, else it won't display
seem's very logic and this would explan why i get some square's, but how?? :)

As for the crash... dunno. Maybe you can't send it such a "faulty" string

When i am adding xor ebx, ebx before the loop and i trace the keygen i remark that it actually generate the valid serial number (and dont crash at this point) it crash when calling the SetDlgItemTextA (when the good serial generate from the keygen is being display in the grey edit box of the keygen) it's like if doing the xor ebx,ebx change the type.. i dont know...

Is there a way that i could take a variable instead of ebx? Because bottom line the only reason why i need ebx is to perform a xor and increment it for the loop, so it act as a counter.

Many apologies to all if this is not very clear.. im trying to explan the best i could. I dont want to sent the crackme as it is part of the REA web site that Kayaker point me to be a good place to learn (And it really is). So this is like my first homework, so i dont want to sound like somebody who is trying to have other's to do it for him. Like i said in the very beginning I did all that was to be done an understand everything that as to be understand for this crackme, i could of just right away submit my thing's and would be upgrade to the next crackme level. It's only that i would like to submit this keygen i am working on. I dont have to submit real keygen in order to go to the next level, only write what i would do to recreate a good serial. So this i know exaclty what to do
to keygen it.

This keygen is beyond the thing i had to do... only for me. But my problem lies on the programming language. I would be able to do this little generation in 2 minute with a 4 gl language... but it's been doing 2 ... days!!!! With this assembly thing. I am the kind that dont givup easely but i am starting to think about it.... :(
Thank's

BTW, I have upload a refresh of my keygen so if you would like to download it as the other is out of date.

Snoop
ZaiRoN
11-15-2002, 05:03 PM
Hi Snoop.Me, in my key gen, i take the name entered, perform the same calculation as the first loop but instead of adding 2 i add 4 in order to get a valid serial number.Your analysis is not properly correct. You need to do something else to solve the problem. Sorry but I can't say anymore (Zero might kill me ;))

When i am adding xor ebx, ebx before the loop and i trace the keygen i remark that it actually generate the valid serial number (and dont crash at this point) it crash when calling the SetDlgItemTextA (when the good serial generate from the keygen is being display in the grey edit box of the keygen) it's like if doing the xor ebx,ebx change the type.. i dont know...So, 'xor ebx,ebx' might not be the problem; try to change manually the value pointed by edi before SetDlgItemTextA (put something like: 0x30 0x31 0x32) and to see if the keygen crash again. If the crash doesn't happen then the problem resides in the serial otherwise...don't know.

Don't discourage yourself and good luck!
ZaiRoN
Kayaker
11-15-2002, 05:05 PM
Ahhh, EBX. You MUST preserve ebx, edi, esi if you use them in any procedure. Push/pop them as neviens said or uses the USES directive.

I should have seen this with my eyes closed because JimmyClif reminded me about my sloppy use of the ebx register in my Snippet Creator thread code just the other day, lol. (of course in a real patch you always use pushad/popad and maybe pushfd/popfd to protect your ass ;)

Preserving ebx is apparently less critical in Win98, where you can get away with it, than it is in Win2K and above. You could probably trace into the Kernel code after returning from the wm_command proc and find where original value of ebx is being used.

Go to the Win32ASM messageboard and do a search for 'register preservation' or similar and you'll find several discussions about the issue, and why ebx is probably the culprit in this case.

http://board.win32asmcommunity.net/search.php?

Kayaker
Snoop
11-15-2002, 05:19 PM
Kayaker
You could probably trace into the Kernel code after returning from the wm_command proc and find where original value of ebx is being used
I effectivly did it.. like you say it is not at the program point but in the kernel.. and this is being beyond my knowlede to follow this for now :p I will try to push/pop and go read a bit on WIN32Asm board. Thanks for the info

ZaiRoN
Your analysis is not properly correct. You need to do something else to solve the problem
:confused: Well.. :D i was thinking getting it right... I will try to see what you mean. But when i do it manually (calculation) on a paper it always return the good value... strange.. anyway I will find out what is missing.

change manually the value pointed by edi before SetDlgItemTextA (put something like: 0x30 0x31 0x32) and to see if the keygen crash again
Yes i will try this, did not think about that.

BTW, cant beleave how fast are coming the reply's here! Very nice board with very pleasant poeple to help us out.
Thank's a bunch to you guy's/gual's for your support.
I am going to sleep a bit as i am starting to see my computer screen moving from left to right without even touch it... :rolleyes: (i think this is not a good sign :D !!) i will get back on this after and keep you inform
Thank's again
ZaiRoN
11-15-2002, 05:28 PM
This explains why sometimes my asm programs crash on w2k system.

ZaiRoN
Manko
11-15-2002, 06:15 PM
Originally posted by Snoop

quote:
--------------------------------------------------------------------------------

You have to format your key for output, else it won't display
--------------------------------------------------------------------------------

Maybe Manko is right here

seem's very logic and this would explan why i get some square's, but how?? :)

Snoop
Just add 30 to each byte and you have the ascii for the corresponding number... :)
Zairon mentioned it earlier in the thread, sorta...

/Manko
Snoop
11-15-2002, 08:59 PM
Just add 30 to each byte and you have the ascii for the corresponding number...

flow of generation;
pickup let's say character "s" from the name field

HEX = 73
DEC = 115

divide 115 by 10, put reminder in DL, (whitch is interesting me)

DL = 5
Add 2 to DL
DL = 7
Store DL
repeat for next caracter.
(Me in my key gen i would add and additional 2 to DL as in the serial validation of the crackme there is no add 2 to DL)

So in the crackme name field if i enter s in the name and 9 in the serial field and validate this jump to good boy.

so let's say that after the gen loop from the name example (abcd) in the crackme the valid serial is 2560 ( **those are not the correct value but only for purpose of example) then me in my key gen i would have to output 4782 to the user as a valid serial key. So in the crakme if i enter abcd in the name and 4782 in the serial this will go to good boy.

Let's say example after the valid gen in the crackme the value is 8 then me in my keygen i would have to output 0 because its 8 + 2 wich is 10 but if 10 or greater i substract 10 to the value...

Quote from ZaiRoN
Your analysis is not properly correct. You need to do something else to solve the problem

That's why i dont really know where i am missing something here... because the way i do it it always generate a valid key for the name entered... but i will continue to look closely to see where i am missing something.

See u all
Snoop

Follow up

Ok forget about what i said in this reply... I've decided that tonight once for all i would kick the s**t out o that! :D I've turn'ed on some Marley in my speaker's, twist a cap of Guiness (well... more than one!) light up a biggie sp.. heee cigarette of course, sit back comfortably, read this post from the begining, and I was ready to roll :cool:

ZaiRoN, i guess i know what i am missing. I'll check a thing or two and come back on you for this one.

neviens and kayaker, yes, push and pop actually did correct the problem. Thank's. I read a bit more about it on the w32asm board.

Manko, i will format it and let you know. I just realize that i have a hard time to switch between ascii ->hex->decimal and decimal->hex->ascii.
So that's it.. anyway. It maybe very stupid to do for some but for me i am learning alot and i like it.
G'night
Snoop
Snoop
11-17-2002, 05:40 AM
Well, thanks for clearing me some points everybody. Yesterday, like said in the previous reply, i've decided to go for it.
I know understand and i learned alot from this crackme as it was my first one and my first keygen to.. :)

Greeting's all
Snoop


New FSG, 197 bytes of loader code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New FSG, 197 bytes of loader code
PDA

View Full Version : New FSG, 197 bytes of loader code

bart
11-15-2002, 10:19 PM
New FSG, this time loader code is 197 bytes long

http://smola.pac.pl/fsg133.zip

have phun, and trow away upx from your hdd :P
squidge
11-15-2002, 11:40 PM
Ah, but FSG still crashes on some dumps I try to compress, which UPX will pack no problem!


OllyDbg 1.08 released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > OllyDbg 1.08 released
PDA

View Full Version : OllyDbg 1.08 released

yaa
11-16-2002, 02:58 PM
Hello,

for anyone interested OllyDbg 1.08 has been released at http://home.t-online.de/home/Ollydbg/.
Also a forum regarding the debugger can be reached at http://rohanpall.com/ollydbg/.

Regards,
yaa
esther
11-16-2002, 03:20 PM
You have posted the wrong forum.Should be in TOT


Help with DeviceIOControl function
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help with DeviceIOControl function
PDA

View Full Version : Help with DeviceIOControl function

squidge
11-16-2002, 06:08 PM
Got a program here that is using DeviceIOControl as part of it's protection, and can't seem to work out what it's doing with it.

According to MSDN docs, the IO control dword is created like so:

#define CTL_CODE( DeviceType, Function, Method, Access ) ( \
((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
)

The DWORD IO Control Code I have is 8001201C. However, once I have broken this down into DeviceType, Access, Function and Method, I fail to find anything about the function it's trying to execute - certainly can't find anything in the winioctl.h header file.

The function uses a 16 byte in buffer and a 16 byte output buffer if it helps to try and match the function. Program uses the resulting output buffer to determine registration status.

Any ideas ?
tgodd
11-16-2002, 06:32 PM
DeviceIoControl is typically used to access a device driver.

CreateFile is used to open the driver and get a handle to the driver.

File the CreateFile function and you have found the driver.

Reverse engineer the driver to see what it is doing with the packets you are sending it.

Regards,

TGODD
squidge
11-16-2002, 09:11 PM
Thanks, I have now found what was happening, it was using a previously (silently installed) kernel mode device driver to check the registration status of the application. The input and output buffers were encrypted with a simple XOR. The device driver itself checked the disk and registry for eval/registered status and returned a structure containing the results.

Now to visit MSDN to find out how zwOpenKey, zwCreateKey etc work and how they are different to the normal ones.
tgodd
11-16-2002, 09:42 PM
Good Luck in your endevours.

Regards,

TGODD


I need help with tELock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I need help with tELock
PDA

View Full Version : I need help with tELock

Nebob
11-17-2002, 02:05 AM
I'm working with an application packed with tE, and I'm not having much luck dumping it properly. Here's what I've done:

Used procdump to dump the image. Segments still encrypted at this point.

Attach ollydbg to the app and dump memory for each of the segments. These are not encrypted, but they may be obfuscated like the IAT redirection and padding.

Use procdump to replace encrypted segments in image with decrypted dumps from ollydbg, then rename the segments from PCGW32 to .text, .data, etc.

My question is, what should I do now to get this working? The tE version used appears to be an internal one, because tE unpackers can't deal with it.

Also, I have two code segments and two data segments. How do I go about rejoining these?

Any help you can give me is greatly appreciated.
esther
11-17-2002, 03:48 AM
First you didn't try executable tools to verify the proctection.
Second You didn't bother ot search the web.
Third you didn't read the FAQ.
Fourth you don't even bother to search the threads in this forum.
Fifth you didn't show more effort and post some codes here :rolleyes:

Its packed with Pcguard....
evaluator
11-17-2002, 11:41 AM
1. upgrade your tools: procdump -> LORDPE
2. you NEEED to learn&use tool: DEBUGGER
3. Show little start code of protector.. (can you?)

**
esther, [you WILL insane]..
esther
11-17-2002, 04:10 PM
I am insane
Nebob
11-17-2002, 04:36 PM
Originally posted by esther
First you didn't try executable tools to verify the proctection.
Second You didn't bother ot search the web.
Third you didn't read the FAQ.
Fourth you don't even bother to search the threads in this forum.
Fifth you didn't show more effort and post some codes here :rolleyes:

Its packed with Pcguard....

I realize my post was not thorough enough. I apologize.

(1) Yes, I did try PE-Scan 3.31. It told me the compressor is tELock 0.98 with 100% certainty. Look:

http://members.rogers.com/nbozovic/pescan.gif

(2) I indeed did search both these forums and the web. Of the four unpackers I found, one claimed to work with .98; that one didn't work under XP, so I installed 98 using VirtualPC to try it out. When I try to use it, it simply reboots the machine. I think this is probably tELock's mutex protection. The main site I saw mentioned with tELock unpacking tutorials is "discompress.com", which won't load for me (down?)

(3) Yes, you're right I did miss the FAQ, and fail to post code, something I should not have done.

1. upgrade your tools: procdump -> LORDPE
2. you NEEED to learn&use tool: DEBUGGER
3. Show little start code of protector.. (can you?)

I did stumble across LordPE while searching for a solution last night. When I used it to dump the program, it basically achieved the three steps I had done, automatically. The executable still wouldn't run.

In the compressed executable, we have:

.PCGW32:005BDBD6
.PCGW32:005BDBD6 public start
.PCGW32:005BDBD6 start:
.PCGW32:005BDBD6 jmp loc_0_5BC000

then

.PCGW32:005BC000 loc_0_5BC000: ; CODE XREF: .PCGW32:005BDBD6j
.PCGW32:005BC000 nop
.PCGW32:005BC001 pusha
.PCGW32:005BC002 call near ptr loc_0_5BC007+2
.PCGW32:005BC007
.PCGW32:005BC007 loc_0_5BC007: ; CODE XREF: .PCGW32:005BC002p
.PCGW32:005BC007 call near ptr 5CA80Ch

That call is outside the compressed codesegment, clearly meant for runtime.

In my semi-uncompressed exe, we have startup code that looks like this:

.idata:005BDBD6 public start
.idata:005BDBD6 start proc near
.idata:005BDBD6 jmp loc_0_5BC000
.idata:005BDBD6 start endp

followed by:

.idata:005BC000 loc_0_5BC000: ; CODE XREF: startj
.idata:005BC000 jmp loc_0_41B630

^^ This is at the beginning of the imports segment. Following it are a couple of hundred bytes of zeroes, then what I assume is the actual imports data. From there we jump to the actual program.

.text:0041B630 loc_0_41B630: ; CODE XREF: .idata:005BC000j
.text:0041B630 push ebp
.text:0041B631 mov ebp, esp
.text:0041B633 push 0FFFFFFFFh
.text:0041B635 push offset unk_0_4262D0
.text:0041B63A push offset sub_0_41A938
.text:0041B63F mov eax, large fs:0
.text:0041B645 push eax
.text:0041B646 mov large fs:0, esp
.text:0041B64D sub esp, 58h
.text:0041B650 push ebx
.
.
.

Obviously there are some unresolved references that IDA can't deal with here, most likely calls to GetSystemInfo and such.

I'm still learning (who isn't), so please take it easy with me :)
esther
11-17-2002, 04:53 PM
Hi,

It's pcguard not telock!
Search through the forums using this PCGW32.
There is a tutorial on this pcguard written by BlackB
http://www.woodmann.net/fravia/blackb_iris.html

1)You need to find correct the OEP.If you are sung win9x try icedump with this command /tracex.
2)Fix the IAT using Revirgin or Imprec

Regards
evaluator
11-17-2002, 06:45 PM
Hi! Nebob

It is TELOCK:)

***
esther, [you WILL insane]..
evaluator
11-17-2002, 07:16 PM
tElock unpacks original ImportTable, redirects & than strips.
So if you can work with debugger, try catch moment, when IT unpacked & dump there.
You found correct OEP. tE is cool guy & keeps for us "JUMP OEP" at loader segment start;)

Quick tutor for tElock dumping:
1. Load program in debugger
2. tape in debugger:
"U VirtualFree"
3. set BPX on 2-3 instruction below "VirtualFree"
4. each time debugger breaks, dump prog.
5. in one dump SURE you will have original ImportTable.
6. you need to determine in dump Address & SIZE of IT & enter it in LordPE.
7. OEP you can determine by JUMP instruction at loader section start in dumped image from running task.
8. LordpPE using: Always use "Correct Image Size" option before dumping.
Also I attached screen for Options>Rebuilder I always use.
You can use "dump full" (or "dump partial" & then Rebuilder).
Nebob
11-17-2002, 07:44 PM
edit: n/m all that

Thanks for your time, I'm going to play around with this some more...


Debuggers/Disassemblers?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Debuggers/Disassemblers?
PDA

View Full Version : Debuggers/Disassemblers?

ftothe3
11-17-2002, 04:18 PM
hello. some of you may remember my post about what exactly a disassebler is. i found out (by reading art of disassebly) that a disassembler takes machine code (1s and 0s) and converts it to assembly (mov add je... etc.) now my question is.... what exactly does a debugger(like softice) do, and how does the debugger work? secondly, (and probably the most stupid question ever posted on this board) why can't we convert assembly to c++ (i know compilers convert from c++ -> assembly. why then cant we reverse the process?)

enough stupid questions for today,
ftothe3

-- thanks for the help
r4g3
11-17-2002, 07:12 PM
debuger lets you trace the executed code. You can actually see how the program is behaving in a particular situation (jumps, register values) and change them as desire. everything goes in real time - pressing F10 in SI executes the next instruction, while in dead-listeing (the one disassemblers give you) all you can see is the program code, you have to decide yourself if a jump is taken, register values, ect...

why can't we convert assembly to c++ (i know compilers convert from c++ -> assembly. why then cant we reverse the process?)

ever heard of one way functions ? why it`s impossible to decompose concrete back to water & cement ?
heard of a physics law about all systems spontaneously moving to the lowest energy level ? or maybe going backwards in time ? some things are simply irreversable :)

hmmm, theoreticaly it is possible to write a spohisticated piece of shit to produce a compilable source code out of a simple binary, noone has appeared to be _so_ crazy to do that so far :)

finaly u can always start reversing yourself, everything is possible in this case :)
naides
11-17-2002, 09:43 PM
Question 2

http://www.woodmann.net/forum/showthread.php?s=&threadid=2576&highlight=decompiler

Question 1

A debugger looks at a program while it is running. The variables hold real life values, the conditional jumps happen or not based on actual, real-time conditions, the loops go round and round as many times as a loop go round.
A debugger performs an exploratory surgery on a living program, a dissasembly is more like an autopsy.
ftothe3
11-17-2002, 10:35 PM
thanks for the replies, ok the difference between debuggers and disassemblers is crystal clear to me.
but..... in naides's link to the other thread...
naides says:
For the kind of tinkering necessary for RE, use of decompilers provides little advantage.

that doesnt make sense to me. Right now, i know vb and c++ and a little bit of assembly. for me, it is VERY hard to read through assembly and a LOT easier to read through c++ (isn't that why we dont just code in assembly, why we invent high level languages like c++?!) so then why do you say decompiliers provide little advantage?
disavowed
11-18-2002, 02:20 PM
don't worry, you're not in the wrong. i don't know what naides was thinking, other than "i can read asm as easily as c++". if that's the case though, then i guess his statement makes sense. in general, though, it's much "easier" (define "easier" however you like) to work with higher level languages than lower level.
ftothe3
11-18-2002, 02:40 PM
so then r4g3 is right?
ever heard of one way functions ? why it`s impossible to decompose concrete back to water & cement ? asm --> c++ is impossible .... just because!
neviens
11-18-2002, 03:07 PM
I think, it is possible, less or more. Every compiler produce his own patterns, while building a code. If somebody might want to code asm to C convertor (?),
he definetely will have to find out all those patterns (C#, C++, Delphi, etc., etc.) and put in to the code. Other question, is it necessary? For RCE - it isn't I think, because, anyway, most protection routines are coded in asm, and therefore it is impossible to produce any C code from them. About reading the asm code- some years, and you will read it without problems :).
Neviens.
NervGaz
11-18-2002, 03:09 PM
Not really... just a huge hassle... take a look at the asm2pas thingy at dafixers dede page... but that's pretty much as good as it gets... basicly it just reformats the asm code so it looks like pascalish code...
r4g3
11-18-2002, 04:47 PM
finaly u can always start reversing yourself, everything is possible in this case

as i said this i ment u can always rewrtite asm code back to c. the only question is how much time it would take for ya.
for one way functions: maybe there exist/will be discovered a sophisticated/very expensive method for concrete -> water + cement :)
someone one day just might get really pissed of a 0 from math exam and solve the DLP .... :)
naides
11-18-2002, 07:17 PM
I propose an experiment:

Write a simple program in C.
Should contain at least one function call and use pointers.

Compile it with one of the old Borland C compilers, then find, if you are lucky, the right Borland decompiler.

Now look at the source code and the decompiled code and you will see that the decompilation is quite less what one would expect.
The decompiled code is spagetti code mess, and you can hardly recognize any of the structures and functions you used in the original code.

Now think about a complex C++ with objects, ad hoc in-line functions etc etc, and you will get the picture. You will see that you stand a better chance of RE the code at the ASM level, instead of sifting through non-documented and fragmentary C-like code.

Dissasemblers are universal, decompilers are compiler specific.

If the coder used imported libraries and classes, which the rule in VC, Borland C and Delphi, you are out of luck!!!
They won't reverse into any remotely understandable C-like code, and more than likely most of the code will remain in ASM format.

Taht is what I meant when I said that RCE tinkering is better achieved using ASM.

Getting C like code that make sense out of an exe or a .dll file is an unrealistic expectation.
squidge
11-18-2002, 11:11 PM
Very true, I recently used a VB3 decompiler to find out how it talked to a dongle and to emulate such dongle. Even though it did a good job of decompiling it, it was a complete nightmare to go through and I would have much preferred the ASM code instead, had the app not been compiled to P-Code. I suppose what added to the nightmare is that the dongle was tightly integrated into the app - not just a simple "is dongle there" but the dongle decided what data was displayed at what points, and in what formats. Changing a single byte in the dongle, for example, changed the entire program from English to German.
Bengaly
11-20-2002, 07:16 AM
ftothe3 writes:
i found out (by reading art of disassebly) that a disassembler takes machine code (1s and 0s)

... opcodes (hex) -> asm representive
ftothe3
11-20-2002, 09:57 PM
wow! this discussion exploded :cool: since ive last been here (i havnt been able to get on the board its been down for me) anyways, yea takes 1s and 0s to hex then gets opcodes i know what dissassembler does! :p anyway i understnad now that decompliers are hopeless and will neverexist (for now atleast) i just have so much trouble reading assembly :( (maybe im dyslexic) thanks for the input people. hope someday ill get better at assembly
dataworm
11-21-2002, 06:48 PM
Originally posted by ftothe3
so then r4g3 is right?
asm --> c++ is impossible .... just because!

Hum Asm -> c++ is possible, it would just require aloth of work

The main issue with ASM to C++ is that you must you must take in consideration all the compiler and all compiler optimisation.

There is a plugins for IDA pro named Desquirr that try to revert the asm code of a function into "C like" code...

A other reason is that most ppl that could write the software to do ASM to C++ could probably read ASM code better than C++ code :D so they have no real use of doing it

Anyway if ASM to C++ would be possible, they would probably start making some new laws to throw reverse engeneer into jail ;)
MinuroKun
04-13-2004, 02:22 PM
Well, there is no reason a person couldn't make an Assembly -> C++ compiler. The only problem thus far is the logic required to do so. and for the record you can take concrete and separate it back out into it's parts, it just takes much more effort than it's worth. The problem with it is that C++ is much more dynamic than Assembly, allowing a person to complete more complex tasks in fewer lines of code. So, the challenge to making a Assm -> C++ converter would require that it do pattern matching to take the multiple lines of assembly and put them into one C++ command. Also there are a few things you can do in Assm that C++ just wouldn't like so you would have to handle that as well. Then you would have to do optimization on the code you created to make it at least somewhat readable. It's not something that can't be done, but for the work it would take and the problems it would create, I think it's just generally accepted as not worth while.
Polaris
04-13-2004, 02:38 PM
wow! this discussion exploded :cool: since ive last been here (i havnt been able to get on the board its been down for me) anyways, yea takes 1s and 0s to hex then gets opcodes i know what dissassembler does! :p anyway i understnad now that decompliers are hopeless and will neverexist (for now atleast) i just have so much trouble reading assembly :( (maybe im dyslexic) thanks for the input people. hope someday ill get better at assembly

Hmmm.... Decompilers are surely not a dream: they do not exist just because money involved in not worth the time to spend to do some. Even only basic compiler techniques can bring outstanding results in the filed.

Also, if you don't trust me, have a look to REC - fully working C decompiler. Or just look at hxxp://boomerang.sourceforge.net for a better explanation of these topics ;).

Byez,
Polaris
Aimless
04-13-2004, 11:54 PM
Just a confirmation Polaris...

Have you sold to and re-packaged the product as LANTERN? (It comes for $190, I believe)

If so, good to know you've become rich ;)

Have Phun
Polaris
04-14-2004, 07:55 AM
Just a confirmation Polaris...

Have you sold to and re-packaged the product as LANTERN? (It comes for $190, I believe)

If so, good to know you've become rich ;)

Have Phun

INQUISITION was sold in mid-october to a company which is not the one that produces lantern (sorry (for me) no real richness, just some cash...:(). I was told that INQUISITION was to be heavily specialized to deal with only one compiler to solve a single (but big, if it required automation) source code recovery...

However, I really don't know if it was reselled/adapted/more... I can't judge by the shots. Anybody has tried it?

Byez,

Polaris


unpacked proggie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > unpacked proggie
PDA

View Full Version : unpacked proggie

hobferret
11-17-2002, 04:28 PM
Anybody out there know anything about speedcommander8, it does not appesr to be packed but it must be somehow. Finding the EIP is easy, revirgin and imprec both work but fail to find 4 api's. 3 of them are easy but the 4th is a mystery. Tracing thru the proggie does not call any api but crashes if you jump over it or do a ret on the call. Version 7 was packed with VBOX and was simple but GOD only knows what this one is!

Any suggestions???:confused:
esther
11-17-2002, 04:31 PM
Hi,
Did you try PEiD?
hobferret
11-17-2002, 05:28 PM
Hi esther

No I didn't try peid coz looking at the file there is no MZP or .adata sections, however, I just tried it and behold it tells me its alexy again - Aspr1.2. Still does not help though:)

Thanks for your reply. Will have to keep digging!!

Rgds hob:cool:
Manko
11-17-2002, 07:55 PM
Hows abouts a lill snippet from thata there api?

/Manko
hobferret
11-18-2002, 08:38 PM
Hi Manko

The prog calls a S/R indirectly and goes thru Kernel32FindResourceA - Kernel32LoadResource - Kernel32LockResource then calls User32DialogBoxIndirectParamA.

In the dumped version the three Kernel calls are missing! Just calls the User one and obviously crashes!!:confused:

See if you can work that out coz im scratching my head:eek:
Iwarez
11-18-2002, 09:04 PM
I leeched version 9 and that's aspr 1.3. I ripped it off in about 5 min after I could debug it better. When you try to register via the menu it offers you can generate a valid serial for your name. Very very easy....
Manko
11-18-2002, 09:19 PM
The reason why I'm the only one answering is that you already have the info you need...

We have established it's aspr, and when I see what you have written, would still have prefered some codelisting, it seems to me (still a newbie, with only 5-6 aspr under my belt) you have not been successful in searching the forum, or you would have known what this is...

It's just an ordinary emulated api. Obviously NOT the one you have now put in, since you say yourself it calls some other apis before the one you have tried...

Do your homework! Search again! (...or if you give up, PM me instead...)

This thread is dead.

Good Luck!

/Manko

Yo, Iwarez! That's not particularly helpful nor very nice...
You trying to make him feel small or do you need a clueless newbie to feel big?!
Yaeah, I'm just bitching, but I loathe comments like that.
But maybe you had other motives? Sorry about bitchin' but it felt right... :P
Iwarez
11-18-2002, 09:37 PM
Well sorry that, but this target is really very easy. But now for a more helpful answer (newest version 9):

- The oep can easily be found when you bp at getstartupinfoa
- You miss bytes at the oep which you can find when you are able to break at the first bytes that are executed in the main program memory. Just copy and paste those to where they belong and dump the program
- IAT I restored with ImpREC and a plugin for aspr 1.3 I found here.
- After ImpREC rebuilded the PE I corrected the OEP and the nag was gone and the program runs.

Optional:
- Debug the dumped app and get a valid serial number. After you get it you can use the program as it was (with asprotect).

Better Manko?
Iwarez
11-18-2002, 09:43 PM
Some bp's for the optional part:

BP at 467ff0 in target
BP at 64130c2b in mxcmn40

have fun.
hobferret
11-20-2002, 09:18 PM
Hi again Manko
Sorry abt delay in getting back bin down rio grande camping!
Below is the code listing the proggie calls - all from ONE indirection, that's what I mean by the three KERNEL calls are missing in the dumped prog. I can't find anything on these forums that resemble this so please tell me where you found it!!
BTW I didn't know version 9 has been released - I will get hold of that and see if it's anything similar.:)

017F:00ECC898 55 PUSH EBP
017F:00ECC899 8BEC MOV EBP,ESP
017F:00ECC89B 53 PUSH EBX
017F:00ECC89C 8B5D08 MOV EBX,[EBP+08]
017F:00ECC89F 8B4518 MOV EAX,[EBP+18]
017F:00ECC8A2 50 PUSH EAX
017F:00ECC8A3 8B4514 MOV EAX,[EBP+14]
017F:00ECC8A6 50 PUSH EAX
017F:00ECC8A7 8B4510 MOV EAX,[EBP+10]
017F:00ECC8AA 50 PUSH EAX
017F:00ECC8AB 6A05 PUSH BYTE+05
017F:00ECC8AD 8B450C MOV EAX,[EBP+0C]
017F:00ECC8B0 50 PUSH EAX
017F:00ECC8B1 53 PUSH EBX
017F:00ECC8B2 E8157BFFFF CALL KERNEL32!FindResourceA
017F:00ECC8B7 50 PUSH EAX
017F:00ECC8B8 53 PUSH EBX
017F:00ECC8B9 E87E7BFFFF CALL KERNEL32!LoadResource
017F:00ECC8BE 50 PUSH EAX
017F:00ECC8BF E8807BFFFF CALL KERNEL32!LockResource
017F:00ECC8C4 50 PUSH EAX
017F:00ECC8C5 53 PUSH EBX
017F:00ECC8C6 E8917BFFFF CALL USER32!DialogBoxIndirectParamA
017F:00ECC8CB 5B POP EBX
017F:00ECC8CC 5D POP EBP
017F:00ECC8CD C21400 RET14

Regs
/hob
:confused:
norby
11-20-2002, 11:05 PM
Hi!

the function you are looking for is probably DialogBoxParamA..
hobferret
11-21-2002, 10:06 PM
Hi Norby

Already tried that one - any more ideas anyone??:)
esther
11-22-2002, 01:46 AM
Nope :p
hobferret
11-22-2002, 10:27 PM
Hi everyone

Well finally got it working and the latest version 11/15/2002 but now have another problem. The "cracked" versions are all in German:D I dont get the lingo - all the data strings are in German too.

Anyone know how to get it back to english - there must be some Germans reading this - if you are give me a tip:confused:

Thanx 4 all who replied;)

hob
hobgoblin
11-23-2002, 07:47 AM
Nice to see that you made it.:)
But I'm curious: What api function did you find to be the correct one?

hobgoblin
hobferret
11-23-2002, 09:40 PM
Hi hobgoblin

I didn't find the answer to the bogus call I found a piece of code:
XXXXXXXX MOV EAX,[ESI+xxxx]
XXXXXXXX TEST EAX
XXXXXXXX JNZ XXXXXXXX
So I changed the ESI+xxxx so it loaded 01 into the register and then jumped. So it must have been something to do with flags being set haven't looked at it again to clarify coz it's working NOW. But after getting past that hurdle I got another crash imprec said it was FreeResource but it really was GlobalUnlock:)

However, as I said it's all German and I don't understand that lingo, Spanish yes but not German. There must be something in there that sets the lingo but being as when you look at it in WDASM it's all GERMAN!!:confused:

I would also like to know how that guy found the serial coz it ain't easy in the version I got!
Regards
hobferret:cool:


New Tool: Regmon Log Duplicate Remover
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New Tool: Regmon Log Duplicate Remover
PDA

View Full Version : New Tool: Regmon Log Duplicate Remover

Kayaker
11-17-2002, 07:46 PM
Hi All,

I created a little "health-oriented" RE app designed to ease the eye strain of poring over those multi-thousand entry Regmon logs. You know the ones I mean, those created by apps that seem to enum everything in your Registry just for the sake of doing so. You stare at them long enough to try to find out if they're doing something bad like trying to access your poor old Mom's bank account records or something, and your eyes will start to bleed.

The app parses the Regmon log Registry Key "Path" string of each entry and cuts it off at a subdirectory (\) level set by the user (Filter Level). A CRC32 value is then calculated on the remaining string. Any further occurrences of the same CRC32 value are considered "duplicates" and are discarded.

The string the CRC32 value is calculated on is actually a combination of the Process, plus the filtered Path string, and optionally the Request (CreateKey, OpenKey, QueryValueEx, etc.). Entries with one or more CLSID {} values can be handled separately so unique values are preserved irregardless of the Filter Level chosen.

The results seem accurate, thousands of redundant Regmon entries can be reduced to a couple of hundred unique ones (depending on the settings chosen) in milliseconds. Of course only the first occurrence of a duplicate is kept and is really only the "root" of the entry, but by selecting a series of Filter Level settings you can choose the degree of detail you want to reveal.

The app works equally well on Filemon logs. Full ASM source is included, so if you don't like something, you can change it. Bug reports, inaccurate results or other comments are welcomed. Enjoy ;)

Cheers,
Kayaker

EDIT: File updated for > Win2K
backeyes
11-18-2002, 10:56 PM
Downloaded 64 times and not even a reply ?

Thanks kayaker for the great idea and great works, very usefull stuff :)

Anyways it seems that i have some errors, don't have time to look more at it atm but all i can say is that the program crashed the first time i launched it, now it runs but gives me an read error at "0x77e12b22" because it uses address "0x00e003e1" (and others when error comes back again)
it happens sometimes in launching the program, clicking on about or settings...

And...i use win 2k sp3

Any idea ?

regards
squidge
11-18-2002, 11:05 PM
Probably most people are like myself - downloaded app as it may become useful, but not actually used it as such yet.
Kayaker
11-19-2002, 01:19 AM
Thanks for the feedback guys! I figured it'd be one of those handy apps to have around, not necessarily shake the RE world to its foundation, lol :D. It was actually JMI's woeful story of having to sift through 20,000+ Regmon log entries that finally spurred me to code this idea I'd had for quite a long time. Of course it was meant as an ASM coding example as well for anyone who might be learning the stuff.

That sounds like an odd error backeyes, thanks for mentioning it. I put an SEH handler in the main parsing routine which should catch all errors there, but I have a sneaking suspicion what it might be since it doesn't sound like it came from that proc. I always preserve registers in any of my own procs I call, but only coding in Win98 on my own stuff I always forget that preserving ebx, edi and esi in the main message handling code as well is CRITICAL (as I'm beginning to learn). We just went over this in another thread too, lol.

By default a Windows API function will (can) freely modify eax, ecx and edx. Also by default it will preserve ebx, esi and edi if it uses them. It doesn't seem critical to preserve ebx, esi and edi if you use the code yourself in Win98 (at least I've never had any problems with it which is why I've developed this bad programming habit I suppose), but obviously it's deadly in Win2K and above. JimmyClif warned me of this (and it looks like you were right, bud ;) , and Snoop found the exact same thing with ebx in his keygen recently.

So, lesson learned big time. I added the appropriate push/pops to the WM_NOTIFY routine where I think the error might be coming from, so if you could try this update and confirm it fixed the problem or not I'd appreciate it. It's the only thing I can think of offhand, and chances are the problem might not happen to others. I did get someone to beta test it on Win2K before releasing it and there were no problems on that system. If it works I'll update the previous link.

Thanks,
Kayaker

EDIT: Previous file updated now.
backeyes
11-20-2002, 12:18 AM
yep it works now ;)

well done and thanks for the fix

regards
backeyes
JMI
11-20-2002, 03:29 AM
So Kayaker:

If you have fixed my problem with having 20,000+ lines of regmon output to review, what am I going to do to keep me busy for late night problem solving to keep me out of trouble?? Oh well, I guess I could always go back to actually disassembling and debugging. It's getting too cold at night to go back to trying stealing hubcaps again. :D

Glad my previous sad tale of travail (sniff, sniff, pun intended :p ) helped inspire you to give us this useful tool. Wait, I know, I can finally take the time to try to figure out how the heck to actually get a mouse to work in Softice in my Win98se partition. I have a touch pad mouse on my Keyboard, a wireless trackball, and even a M$ serial mouse installed. All three operate just fine while I'm in Win2k sp3, and the cordless works fine in Softice DS 2.7 on Win2k, but I haven't gotten Win98 to recognize both the cordless (which is USB) and the serial M$ Mouse at the same time and Softice on that partition will not recognize any of the mice. It is a definite bummer no have no mouse in Softice at all. :confused:

There you go, another "woeful" challenge for our definitely "not all wet" coding Moderator. :)

Regards.
Woodmann
11-20-2002, 04:25 AM
Hey,

You have got to be kidding me........

You of all people should be able to navigate without a mouse.

Lazy old timer :eek:

Later, Woodmann
JMI
11-20-2002, 04:50 AM
Woodmann:

1. It WAS a fumble! (inside joke :D )

2. I can "navigate" without the mouse, it's just frustating that I can not get the damn thing to work as it is "supposed" to. :D For example I can switch windows in Softice with the keyboard commands, but if I move the mouse it just flashes the pop-up menu across the screen, in general alignment with the vertical position of the mouse.

And I got spoiled debugging on my Mac using the mouse. There I could more easily open multiple windows anchored to the registers and/or the stack and watch the data get moved in and out of memory. Thing I liked best about it was that I could have a white screen with black letters, which probably is only something I got used to, but I sure like it a whole lot better than a black screen with various colors for text.

M$ has the serial mouse in my device manager, but so far, no matter what I have tried, it still tells me the device is not available or not functioning properly and "searching" for new equipment fails to recognize their own friggen product. Maybe its a conflict between the various mice, but one that's not occuring in my Win2k setup.

And besides, when one gets to be my venerable age its nice to be able to lean back in the chair and "navigate" with the cordless trackball, leaving my other hand to "play" with whatever else may be handy. But enough about "self-abuse." :D Sure glad my mother was wrong and I haven't gone blind yet! :rolleyes:

Regards. :rolleyes:
Kayaker
11-20-2002, 05:03 AM
>>It's getting too cold at night to go back to trying stealing hubcaps again.

Interesting wording, does this mean you've so far been unsuccessful at stealing hubcaps? Mind you, I can understand the discomfort. Being more than a few miles north of you, various body parts have already begun to stick to cold metal objects...

>>Glad my previous sad tale of travail (sniff, sniff, pun intended ) helped inspire you to give us this useful tool.

Ahh JMI, it simply means you're an inspiration to us all ;)

>>It is a definite bummer no have no mouse in Softice at all.

Sorry, can't help you there other than offering misery loves woeful company solace. At home, Logitech cordless + Win98SE == glorious 4.05 SI mouse support. At work (shhhh..), Logitech cordless + Win98SE == DiddlySquat. Go figure. Either locale + DS2.7 == mouse on steroids that won't sit still for a second!

I respectfully bow out of this challenge :)

Cheers,
Kayaker
Woodmann
11-20-2002, 05:36 AM
OK,

The two of you's have got me on this one.
I shall gracefully bow out of this thread :)

Later, Woodmann
JMI
11-20-2002, 05:39 AM
Guys:

I knew in my heart it was wrong to be feeding that damn mouse the steroids. Sorry. Will go back to the "regular" mouse food diet right away.

And I used the money my parents gave me for the ballet lessons for Dr. Pepper and never learned to do anything "gracefully." :D

Regards.


hooking a plugin export entry in ollydbg?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > hooking a plugin export entry in ollydbg?
PDA

View Full Version : hooking a plugin export entry in ollydbg?

_Servil_
11-17-2002, 07:54 PM
hello,

i 'm struggling to hook a plugin exported entry in ollydbg. the eproblem -- the module is loaded only when needed and unloaded instantly after execution (imprec). i tried to locate the getprocaddress followed the call into module but there are just two such a places, which only test the export entry presence discarding the address immediately ;(
with help of filemon i located place where plugin is executed (dunno if executed but file is accessed)

0043C9EA FF15 DCE14300 CALL NEAR [DWORD DS:43E1DC] ; kernel32.ResumeThread

which leads to int 2e which olly can't step-in, that may be the reason why it refused to stop at int 3 though i3 triggering was on and i placed bpt at the api start.. anybody would know how to hook to the api? (thanks)
squidge
11-17-2002, 10:59 PM
Try the "break on new module" option in the debugging options, and then when the module of interest is loaded and you see it in the executable modules list, double click the module and place a breakpoint on execution of the exported entry. Once the other app calls it, you'll see where it got called from by examing the return address on the stack.
_Servil_
11-18-2002, 07:46 PM
tried this first but it doesn't break, i think the problem is ollydbg lacking ability to go thru interrupt. (maybe i'm mistaked but i guess the plugin is executed during resumethread)
squidge
11-18-2002, 10:53 PM
can you pm me a link to the app and where you need to place the bp?

also, did you try a normal olly breakpoint? If so, have you tried using a hardware breakpoint on execution instead ? I found times where olly wouldn't break, but a hardware breakpoint worked.
_Servil_
11-20-2002, 04:25 AM
thanks, the host application is import reconstructor self (h**p://www.mackt.cjb.net), and the dll is own plugin i'm trying to debug -- for certain reason i can't use rundll32 but run imprec is required.

of course i tried as software as hw breakpoint as int3 (int3 handling is enabled), nothing works. my assumption is still that the plugin is executed by ResumeThread && everything inside int 2e is to ollydbg hidden ;-(
squidge
11-20-2002, 08:15 PM
I'll have a look-see.
_Servil_
11-20-2002, 09:09 PM
yet i send a sample to simulate plugin's export with place to break.

about the breakpoints iwasn't fully correct in fact i _didn't_ set any sw/hw breaks since it's impossible unless the module is loaded and i'm not able to catch the module in short time is executed. i don't have any further idea.


Version of Armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Version of Armadillo
PDA

View Full Version : Version of Armadillo

vXd
11-17-2002, 08:41 PM
I'm extreamly new to this 'art' and reading a ton, but i've got a question that I can't seem to find by either searching this database, sorting through tuts, or by any other means.

I've got an application here that deffinatly uses Armadillo and I'm pretty sure it's using a version over 1.90, since all the tuts talk about a tmp file generated when executed. This app does not, however. This application was packaged around 4/2001 so it's nothing extremely new. My question is, how does one know what version of Armadillo was used? Is it just be examing the shell code itself?

Also, This armkiller app that appears to *almost* do everything for you... What should you expect when using it? I run it, select the application thats protected and then the application starts up. Shouldn't the program output a unpacked exe?

Thanks for any information that can get me on my way!
vxd
crUsAdEr
11-17-2002, 10:17 PM
Hi there,

Armadillo has custom builds for different apps so it is hard to tell version of Armadillo, they have so many beta and alpha release, there isnt a point in keeping track of version anyway... unpacking armadillo has been discussed here and the general method is the same...

Visit RealmSilicons.com to get a feel of what it is like, then search for keywords like copy-mem :>... u will find a ton...

regards
crUsAdEr
vXd
11-18-2002, 04:20 PM
Ok, makes sense...thanks!


Nag problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Nag problem
PDA

View Full Version : Nag problem

Tyelcon
11-17-2002, 10:58 PM
Hi,
I got the following code in WinDbg through bp UpdateWindow. However, when using wida to edit it, it cannot find the code. Same in hiew. I thought perhaps the 7's should be 0's, but that didn't help. Any thoughts on how I can edit it? Thanks.
Tyelcon

77d5ea3c 0f83fcdf0100 jnb USER32!TrackPopupMenu+0xac4 (77d7ca3e)
77d5ea42 33c9 xor ecx,ecx
77d5ea44 8a8e5816d477 mov cl,[esi+0x77d41658]
77d5ea4a 83e13f and ecx,0x3f
77d5ea4d ff148d581ad477 call dword ptr [USER32!CreateWindowExA+0x584 (77d41a58)+ecx*4]
77d5ea54 e91d86feff jmp USER32!SendMessageA+0x47 (77d47076)
77d5ea59 33c0 xor eax,eax
77d5ea5b 40 inc eax
77d5ea5c 50 push eax
77d5ea5d ff7508 push dword ptr [ebp+0x8]
77d5ea60 894510 mov [ebp+0x10],eax
77d5ea63 e8bf92feff call USER32!ShowWindow (77d47d27)
77d5ea68 ff7508 push dword ptr [ebp+0x8]
77d5ea6b e84692feff call USER32!UpdateWindow (77d47cb6)
77d5ea70 53 push ebx
77d5ea71 53 push ebx
77d5ea72 ff7508 push dword ptr [ebp+0x8]
77d5ea75 6a10 push 0x10
77d5ea77 e8ca91feff call USER32!NotifyWinEvent (77d47c46)
77d5ea7c e9529cfeff jmp USER32!IsDialogMessageW+0x1bb (77d486d3)
77d5ea81 817de413010000 cmp dword ptr [ebp-0x1c],0x113
77d5ea88 74cf jz USER32!LockSetForegroundWindow+0x98 (77d5ea59)
77d5ea8a 817de418010000 cmp dword ptr [ebp-0x1c],0x118
77d5ea91 74c6 jz USER32!LockSetForegroundWindow+0x98 (77d5ea59)
77d5ea93 817de404010000 cmp dword ptr [ebp-0x1c],0x104
77d5ea9a 0f85339cfeff jne USER32!IsDialogMessageW+0x1bb (77d486d3)
77d5eaa0 e9b19cfeff jmp USER32!IsDialogMessageW+0x23e (77d48756)
77d5eaa5 3bc3 cmp eax,ebx
squidge
11-17-2002, 11:09 PM
It looks like you have landed in the heart of one of the system API's. If you used softice to get here, you may want to use the F12 key a few times once landing to get back to application code.

If you really want to edit it, try looking at the file user32.dll, but I don't think you want to do that.
Tyelcon
11-18-2002, 04:04 AM
Oh I see, thanks. Does anyone know how to f12 in WinDbg?
squidge
11-18-2002, 07:47 AM
Ah, WinDbg... You could possibly examine the stack for return addresses to your app code? (assuming you know the valid addresses for it)


symbian / armi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > symbian / armi
PDA

View Full Version : symbian / armi

trecky
11-18-2002, 07:39 AM
hello

i disassembled some nokia 9210 symbian files. it works fine. all is readable.

but:
1 - how can i see when it is requesting info from a resource fie ?
2 - how do i know which dll function is called ?

to 2 - ther is a list of used dll's in each executable file. and some bytes earlier i can see that a list of numbers appear which seems tobe links to the function of the dll's but how do i know to which dll function one if the numbers is refered to ?

bye
dataworm
11-21-2002, 03:30 PM
Originally posted by trecky
hello

i disassembled some nokia 9210 symbian files. it works fine. all is readable.

but:
1 - how can i see when it is requesting info from a resource fie ?
2 - how do i know which dll function is called ?

to 2 - ther is a list of used dll's in each executable file. and some bytes earlier i can see that a list of numbers appear which seems tobe links to the function of the dll's but how do i know to which dll function one if the numbers is refered to ?

bye

For #2 the function name are droped at the compilation of the DLL, do you have that DLL?

If yes try to load it with IDA, you'll see that all the exported function name in it are missing... If you have a .pdb for that file it will contain all the function name, you can load that file with the DLL in IDA and you'll see all the function name then you export the IDT wih IDA plugins (Create IDT files) and you'll able to use the zipids program to compress it in .ids(you'll need to d/l that soft from datarescue webpage idsutils if i remember well) then retry to disassemble your other file and you should be able to see the content. IF you give me more info about the platform and development tool for it I might be able to help you more, I just had the same issue with the pocketpc ARM MFC...
trecky
11-22-2002, 01:08 PM
hallo

i dont have ida unfortunately ! i use the tools supplied with the nokia 9210 sdk. objdump disassembles as well.

i know the output of ida - and it is very helpfull !

so how do i get otherwise to it ?

something else - which exe format does the new symbian 6.1 use ? i can not disassemble files with objedump anymore !? any idea which parameter i have to change for it ?!

for 9210 apps (symbian 6.0) it works like this :
objdump --target=binary --architecture=arm -D --start-address=0x7c %1 >%1.asm

i tryed it with the objdump from the 7650 sdk but this seems tobe the same objdump !

ciao
dataworm
11-22-2002, 02:44 PM
Originally posted by trecky
hallo

i dont have ida unfortunately ! i use the tools supplied with the nokia 9210 sdk. objdump disassembles as well.

i know the output of ida - and it is very helpfull !

so how do i get otherwise to it ?

something else - which exe format does the new symbian 6.1 use ? i can not disassemble files with objedump anymore !? any idea which parameter i have to change for it ?!

for 9210 apps (symbian 6.0) it works like this :
objdump --target=binary --architecture=arm -D --start-address=0x7c %1 >%1.asm

i tryed it with the objdump from the 7650 sdk but this seems tobe the same objdump !

ciao

I got no idea, never worked with objdump... But if you send me the files(including the DLL and all debug related file) or tell me where i can find them(if they are all part of the sdk) , I might check what i can do, and maybe send you the .asm generated by IDA... send me a email...


anyone have a IDS file(IDA Pro) for wince ARM mfcce300.dll?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > anyone have a IDS file(IDA Pro) for wince ARM mfcce300.dll?
PDA

View Full Version : anyone have a IDS file(IDA Pro) for wince ARM mfcce300.dll?

dataworm
11-18-2002, 05:17 PM
I am looking for mfcce300.ids for WinCE ARM. I have no idea if it come in the IDA Pro advance version, but it does't in the standart version.

I have been able to rebuild most wince arm ids file with the utility dll2idt but for mfcce300.dll it does't seem to contain the true exported function name... To be able to see the true function name you have to compile with debug( witch most software won't be compiled with).

I have started to build the file comparing the exported debug name with the release of some soft i have compiled, I have reatch 422 declarations yet, but i am far from the around 4317 declarations.

If the file does't exist, i'll probably just continue my work and i'll make the IDS file public( if anyone is interested in it ).

So anyone have mfcce300.ids?

Thanks
Dataworm
dataworm
11-21-2002, 03:32 PM
Forget this, I have solve my issue. I finished to generate the mfcce300.ids for arm if anyone want it just ask...


Does SI4.05 support different keyboards?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Does SI4.05 support different keyboards?
PDA

View Full Version : Does SI4.05 support different keyboards?

BeHereNow
11-18-2002, 06:57 PM
I have a DVORAK keyboard layout but when I start SI it doesn't recognize it, and it registers the keys as in qwerty keyboard. Any thoughts or solutions would be greatly appreciated.
Czerno
11-18-2002, 08:40 PM
You need to manually patch the keyboard tables inside the winICE executible - Using a hex editor of your choice, locate the "SIWK" header towards the end of the file ; it follows 4 arrays of bytes IIRC, each one indexed by the key scancode (0 to 58h), giving the ASCII translation for the key. First table for unshifted, then shift+key, ctrl+key, alt+key. In those tables, values greater than 80h are NOT ASCII codes, rather they refer to SICE functions, better leave those alone. The other ones - plain ascii chars - you may modify according to your keyboard layout. I did exactly this for my French kb. So good luck !

When you're thru you might want to allso patch the kb tables inside the serial (serial32) executibles. They follow more or less the same layout.

HTH

--
Cz.
BeHereNow
11-22-2002, 07:37 PM
Thanks for the answer.


uk info & ckinfo ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > uk info & ckinfo ??
PDA

View Full Version : uk info & ckinfo ??

sadsack
11-18-2002, 10:47 PM
i have used this great piece of programming to change osis to 1000, but does anyone know how to change from light to pro version, using the relevent .ckinfo file, I.E. which do i change in these,
#Default Script (ckInfo)

ScriptName=UK Info Disk 2002 v7.00 (ER)

Action=CreateSiteKey
UserKey=**** **** **** **** **** **
NumberOfLicences=100
NetworkLicence=yes
AddToExistingLicence=no
LicenceDuration=unlimited
KeyOptions=7
KeyLevel=170

would it be the keyoptions or keylevel,
or possible what do the keys refer to?

many thanks in advance..
squidge
11-18-2002, 11:16 PM
It seems that what you are asking for someone to do your work for you - convert from lite to pro, rather than a general RE question; therefore you may want to try elsewhere as this is not a crack-request board.

However, what you want to do is quite easy with the Crypkey Sitekey Generator, downloadable from the Crypkey website after reversing the UK Info exe file and finding lots of useful keys which state exactly what values to use for what options...
sadsack
11-19-2002, 12:59 AM
thats a fair response, but would it be possible for u to elaborate on my 2nd question about what the keyoptions or key levels actually do?
squidge
11-20-2002, 12:01 AM
The SDK Documentation for Crypkey decribes both in full. Far better than I could describe myself. I suggest you download it to find the background behind Crypkey and how it's supposed to work/etc, then you'll have a far better understanding of the system.

Remember: Google is your friend :) It shouldn't take you longer than 5 minutes to find a downloadable SDK...
sadsack
11-20-2002, 12:54 AM
many thanks.......... i will read.

i have managed to go to pro, but now all i get when run is that there is a problem with the registry....
r4g3
11-20-2002, 06:00 PM
so this is how 'advanced reversing' loox like ...
squidge
11-20-2002, 08:04 PM
:)


Senselock dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Senselock dongle
PDA

View Full Version : Senselock dongle

Tron101
11-20-2002, 12:36 AM
Hi guys

Has anyone had experiences with reversing the protection used by the SenseLock dongles? The only information I can find on the net about this is in Chinese(?).

Specifically Sense Lock version 3.

Any information would be appreciated.

http://www.sense.com.cn/xwdt/cfca.htm

Thanks

Tron101
squidge
11-20-2002, 08:24 PM
All I know about it is that it's a USB dongle (paralell ones may exist too) that protects the program through encryption. The dongle itself does the decryption, so you need this before you can use any program protected by it (unless the authors of the software protected by the dongle did it in a really crap way)

Certainly can't find any SDK's or anything about it.
Tron101
11-21-2002, 02:10 AM
Hi squidge

Yeah I know that it is USB and yes there is a parallel version available, otherwise the makers of the software utilizing it may lose some customers (who either don't have USB ports or all USB ports are used up) + the fact I saw some references to the parallel port in the program that I am trying to reverse.

One thing though, there is a DLL there that seems to contain readable function names and stuff, some sort of development library DLL , trying to find a way to decompile it rather than disassembling it.

Still a SDK would be nice.


AsProtect - new version?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AsProtect - new version?
PDA

View Full Version : AsProtect - new version?

norby
11-20-2002, 10:50 PM
Hi!

I found one proggie with probably new version of Asprotect. It has a new redirection system for all kernel32.dll and comctl32.dll APIs (except of those emulated). First it does some heavy SMC (about 20 jumps) and then it executes first few instructions of redirected function in its address space...

for example:

0177:00A0068C PUSH EDI
0177:00A0068D PUSH 00000127
0177:00A00692 SUB EDX,EDX
0177:00A00694 PUSH BFFA191F
0177:00A00699 PUSH DWORD PTR FS:[EDX]
0177:00A0069C MOV FS:[EDX],ESP
0177:00A0069F JMP BFF77AF2

and then it jumps to kernel32 and skips first few instructions

KERNEL32!CreateFileA
0177:BFF77ADF PUSH EDI
0177:BFF77AE0 PUSH 00000127
0177:BFF77AE5 SUB EDX,EDX
0177:BFF77AE7 PUSH BFFA191F
0177:BFF77AEC PUSH DWORD PTR FS:[EDX]
0177:BFF77AEF MOV FS:[EDX],ESP
0177:BFF77AF2 MOV EDI,[ESP+14] <--jumps here
0177:BFF77AF6 SUB EAX,EAX
0177:BFF77AF8 LEA ECX,[EAX-01]
...

it prevents bpx and I also tried to trace it with Revirgin 1.30 and ImpRec, but both failed; I had to trace all APIs manually

The only function where ImpRec's tracer succeeded, was GlobalUnlock, where it jumped to the beginning of the function and it didn't skip any instructions in kernel32 code

proggie: xxx.imagedupeless.com
crUsAdEr
11-21-2002, 05:05 AM
Hi Norby,

Yep... THAT is IT, the new version of AsProtect :)...

This kills Imprec and Revirgin for sure, i am impressed that you get Imprec to trace one kernel API, i couldnt get any :mad: ... AsProtect is really going into VBox direction with its IAT redirection scheme... plus poly-enigine generated to calculate jump to redirected API and "rebased" each run... so each run you will get a different decryption routine address and a whole set of different decryption keys... :D ..

I just came out with this idea of ripping decryption routine out of AsProtect and hence code this plug-in... please help me test it so hopefully i can improve it and make it more generic... I have only tested it with this apps and on my win2k box...

Norby : I am impressed you traced everything manually :).. you are lucky it is only 17h kernel imports :)

Anyone else seen other apps protected with new Aspr :)?

thanx
crUsAdEr
norby
11-22-2002, 03:14 AM
Hi crUsAdEr,

thanks for the plugin, good work :-)

it works in W98 without problems (with this program)..

I downloaded some other Asprotected programs today, but all were protected with older versions...

btw: I even found one asprotected program that didnt work packed, only unpacked ...(Secret Explorer, xxx.lastbit.com)
hobgoblin
11-22-2002, 04:21 AM
Hi crusader,
Is this plugin supposed to work with Imprec or RV? Or both?
It can't get it to work on my box (XP):(

regards,
hobgoblin
esther
11-22-2002, 04:31 AM
Most probably for Imprec.RV doesn't has a plugin feature...
crUsAdEr
11-22-2002, 10:28 AM
hobgobling,

can u be more specific? like wat went wrong? plug in does not load, not recognised? or fail to trace? if so wat errors code doea it give in the log window? like 201, 202 or 220 etc...

cheers
crUsAdEr
hobgoblin
11-22-2002, 02:23 PM
Hi crusader,
It loads, it traces, but all it returns is error code 204.
BTW, it was a typo in my last post. I'm cracking this one on WinME, not XP.

regards,
hobgoblin
_Servil_
11-22-2002, 06:07 PM
hi !

crUsAdEr you were too fast ! ;-)

since i had no idea how to rip the key from .aspr (is the api calcluated each time the same way?), since the emu seems to be modified each time a tried to follow the code, maybe this will work too ?

tried for imagedupes and win98 only , however
crUsAdEr
11-22-2002, 10:20 PM
wow, is it a tracer? some comment would be good (wonder why few ppl put comments on their codes:(... i have only coded a tracer with debug API only.. so it is a good exercise to look at this code... pretty long though :/...

any reason why is this win98 only???

Hobgoblin : error 204 = Invalid pointer, which you will probably see a lot because aspr inserted lots of junk value in between First Thunk so of course the plug in will report error 204.. you must check on the valid pointer pointing to a redirected API routine... take notes that First Thunk are quite spread out, pretty far apart so make sure you get you IAt range right...

cheers
crUsAdEr
hobgoblin
11-23-2002, 11:49 AM
Hi crusader,
I figured it out.:) I'm just a little bit impatient sometimes. ...
I unpacked it successfully, and it runs smoothly...
But when I tried your plugin, I got error 205. After cutting away all the invalid thunks, I used a plugin tracer named aspr13.dll, and all imports except 4 go resolved. These I traced manually. Is it you that wrote the tracer plugin too?

regards,
hobgoblin
crUsAdEr
11-23-2002, 01:53 PM
Hi Hobgoblin,

Nah.. the plug in tracer is written by Servil.. all credit goes to him...

Funny, cos my plugin doesnt have error code 205??? at least not the one posted above... are you using the same one as above :>??
hobgoblin
11-23-2002, 04:29 PM
Hi Crusader,
I might have used another one.:rolleyes:
I'll check it out later on. It seems like I mixed yours with another one (older).

regards,
hobgoblin
JMI
11-23-2002, 06:03 PM
hobgoblin:

Perhaps yours is the second version of +Spl/\j's from October which appeared in the thread "RV tracer seems not work on... "

Regards.
_Servil_
11-24-2002, 07:15 AM
Originally posted by hobgoblin
...and all imports except 4 go resolved. These I traced manually.

hi hobgoblin, about the unresolveds, those are my bugs, soorry about that, anyhow i'm glad to hear it worx..
Zilot
11-25-2002, 12:01 PM
Crusader !!

Your plug-in works fine with me , on Win2K , all Kernel.dll apis were resolved with your plug-in ( nothing needed to be resolved manually )

but as Hobgoblin said with Servil's several apis in Kernel.dll stayed unresolved , and don't know what is with Comctl32.dll
because I didn't try to do after.

For those who might could't find IAT , here it is

Regards Soldat :p


Office patch
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Office patch
PDA

View Full Version : Office patch

bedrock
11-21-2002, 04:46 PM
I have got office xp and i have patched the mso.dll file to disable the activation, now i am trying to do the same thing with office 11 beta, i wonder if anyone help me?
nofurs
11-21-2002, 04:55 PM
XXX have got office xp and i have patched the mso.dll file
what's office xp?
bedrock
11-21-2002, 05:06 PM
sorry if my question is too lame, but i am new to this.

Thanks for pointing out my lameness :o
nofurs
11-21-2002, 05:13 PM
You should have read the FAQ before entering this forum and yet you post this kind of questions in here!
If you new in cracking learn asm language.use google to search for Art of asm.It's a lame excuse that you said you didn't read the FAQ...


crUsAdEr - Armadillo 2.61 Tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > crUsAdEr - Armadillo 2.61 Tutorial
PDA

View Full Version : crUsAdEr - Armadillo 2.61 Tutorial

Mega Desperate
11-21-2002, 07:19 PM
:rolleyes: ..Hi .. Congratulations!! for ur tutorial!!.. it's good!! .. i have a question ...

"Trace a bit more down you will see this :

0044E421 A1 88 9A 45 00 mov eax, ds:block_count
0044E426 83 C0 01 add eax, 1 ; increment decrypted memory block
0044E429 A3 88 9A 45 00 mov ds:block_count, eax ; in process counter"

..mmm..i have this ...

005DE721 A1 88 9A 45 00 mov eax,

It's correct? .. i think that ur code is decrypted... .mmm please tell me ..

tnkx... =-D
crUsAdEr
11-21-2002, 07:58 PM
Hmm.. i dont understadn what you mean...

But my code is original form armadillo, i simply run IDa on it.. no decryption...

cheers
crUsAdEr
gorge
11-21-2002, 09:22 PM
Where is the Arm Tutorial?
ZaiRoN
11-21-2002, 10:45 PM
Hi gorge.
In the mainpage of this forum there is:
Please visit the tutorial section. There are many works that will help you.Click on the word tutorial and you will see many interesting tutorials ;)

regards,
ZaiRoN
Shopping_Guide
11-22-2002, 03:33 PM
Firstly, i wanna say big thx for your tut crusader. It was a nice tut.
Because i don't wanna be bothered INT3 yet,
i tried your tut at Armadilled 2.60 target.
But my (manually) dumped file is wrong/not working.
Because when i dump it using Armkiller 2.61, my final dumped is working fine.
So the problem is my (manually) dumped file.
I wanna learn manually, not depend Armkiller again.

Here's what i did :
1. bpx setprocessworkingsetsize, F5
2. SI breaks, F12
3. Press F10 several times until i land at CALL EDI
4. Still at CALL EDI, i did bc * then bpx writeprocessmemory
5. Press F5
6. SI breaks, f12 twice

005E0421 A1 88 9A 45 00 mov eax, ds:block_count
005E0426 83 C0 01 add eax, 1
005E0429 A3 88 9A 45 00 mov ds:block_count, eax
<--------SNIP------------>
005E0470 mov edx, ds:block_count
005E0476 3B 15 70 66 45 00 cmp edx, ds:max_number_of_decrypted_block
005E047C 0F 8E FA 00 00 00 jle ok

7. At 005E047C, i always make it jump. change 0F8E to 90E9
8. then press F12 once, i land 005DF9DC :

005DF92D 8B 8D 2C FA FF FF mov ecx, [ebp+FFFFFA18]
005DF933 3B 0D 84 9A 45 00 cmp ecx, ds:text_section_size
005DF939 0F 8D C7 00 00 00 jge continue_1
005DF93F 6A 00 push 0
005DF941 8B B5 2C FA FF FF mov esi, [ebp+FFFFFA18]
005DF947 C1 E6 04 shl esi, 4
005DF94A 8B 85 2C FA FF FF mov eax, [ebp+FFFFFA18]
<----------SNIP--------------->
005DF9C1 83 E7 0F and edi, 0Fh
005DF9C4 03 F7 add esi, edi
005DF9C6 8B 15 74 9A 45 00 mov edx, ds:key_address_table
005DF9CC 8D 04 B2 lea eax, [edx+esi*4]
005DF9CF 50 push eax
005DF9D0 8B 8D 2C FA FF FF mov ecx, [ebp+FFFFFA18]
005DF9D6 51 push ecx
005DF9D7 E8 86 0B 00 00 call Decrypt_codes
005DF9DC 83 C4 0C add esp, 0Ch <== I LAND HERE!
005DF9DF 25 FF 00 00 00 and eax, 0FFh
005DF9E4 85 C0 test eax, eax
005DF9E6 74 0A jz short bad_jump

9. press f10 once, land at 005DF9DF. I type :
a eip (enter)
inc dword ptr [ebp+FFFFFA18] (enter)
jmp 005DF92D (enter)
(enter)
10. still at 005DF9DF, i type
e ebp+FFFFFA18 (then change something to 00000000)
e 005DF939 (change 0F8DC7000000 to 7DFE90909090)
11. bc *, press F5
12. LordPE

Is my procedure correct? Please guide me back to the real track.

My 2nd question is, in this target (VBOWatch by moonlight-software; 420kb),
bpx writeprocessmemory won't break.
The appz just show up without break on that bpx.
How to deal with this target?

TIA,
SG
crUsAdEr
11-22-2002, 10:10 PM
Hi shopping Guide...

It does look alright to me... the way you dump it... how about trying to compare the dump with armkiller dump and see what are the differences??? Cos from the look of it i cant really tell what is wrong...

Hmm, the second question.. i tried installing VBOWatch.. heh.. protection for VB program :)??? it refused to run saying i have resetted my clock... which is duh cos i did NOT... i thought it was sice detection but no, i rebooted without sice and it still wont run, maybe it is my Chameleon clock that quietly change the time.. but ah well... so i cant help you on that.. tell me hwo to fix the clock thingie then maybe i could try t see how... :)

good luck,
crUsAdEr
crUsAdEr
11-24-2002, 12:04 AM
Hi Shopping Guide,

Try bpx WriteprocessMemory before the nag starts... :>... the best way is disassemble armadillo and study deadlisting :)

cheers
crUsAdEr


symbian 6 and 6.1 difference !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > symbian 6 and 6.1 difference !
PDA

View Full Version : symbian 6 and 6.1 difference !

trecky
11-22-2002, 01:09 PM
hi

which exe format does the new symbian 6.1 use ? i can not disassemble files with objedump anymore !? any idea which parameter i have to change for it ?!

for 9210 apps (symbian 6.0) it works like this :
objdump --target=binary --architecture=arm -D --start-address=0x7c %1 >%1.asm

i tryed it with the objdump from the 7650 sdk but this seems tobe the same objdump !

ciao


2 Easy proggies for Newbs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > 2 Easy proggies for Newbs
PDA

View Full Version : 2 Easy proggies for Newbs

nikolatesla20
11-22-2002, 02:48 PM
When this program first came out, it was a pain in the butt. Or, maybe I was just too newb myself eh?

Anyway, this is a common trend lately - if I wait long enough the program authors come out with a new version that is actually easier to "free".

No links, just search in Yahoo or Google.

-----------------------------------------------
Firstly, just updated - Program name: Quick3D

Nice program you can use to view and convert between 3d model file formats. Still a bug in DirectX format in my opinion (texture coords are upside down).

The author finally allows you to download pro version, and it actually saves files. (changes filename to "shareware_output.xxx").

So newb, your mission is to defeat first two nag screens (and closing nag screen), and also remove the savefile renaming. This mission is very easy, in my opinion.

Hints: File is not packed, don't need anything more than WinDasm :)
------------------------------------------------

-nt20
-=elgura=-
11-22-2002, 08:57 PM
hi nikolatesla20

well this was indeed an easy target though a well choosen,
becouse the CALL's ( 5 ) wasn't right infront of your eyes. needed to do some "backtracing"... i liked that!
as the task was just to get rid of nags and get around the namechanging at save... so i just nop'd out the calls.

i don't list the calls here. if there is someone else trying this softw.
anyway is there a "lesson two" ????
nikolatesla20
11-22-2002, 09:58 PM
Good job !

Yes, it's amazing how simple it is, everything can be bypassed by nop'ing some calls. Actually, I nop'ed very little. just edited the function instead with a RET just in case I would ever miss a call :)

By the way, you might also want to "edit" your string resources when you are done too hehe.

Um, ya the "second" lesson was a mistake, I had listed "Beam Screensaver" , but now I notice in version 1.72 they are using Armadillo, and that is definitely not a newb protection.

-nt20


Brute force exercise
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Brute force exercise
PDA

View Full Version : Brute force exercise

ZaiRoN
11-22-2002, 11:26 PM
Hi All,

I would like to present this interesting crackme coded by Spider (hi Spider :)).
The purpose of the crackme is to find a valid serial to register it. Some bytes inside the crackme are crypted in some way using the serial and guess what we have to do? Our mission is to brute the crackme to find the right serial!

In general, there are some way to brute a target but only one is the best way ... Who will be the best bruter? :)

If you enjoyed this one, it might be interesting to take a look at the 2° BruteMe by Spider...we'll see.

Good luck!
ZaiRoN
Bengaly
11-23-2002, 09:40 AM
actually, it is more boring than interesting :D

find 2 numbers where:
num1 < 0x1B000000
num2

if(num1+ num2 == 0x98D969A7)
TestSecondBlock()

entering 0000000098D969A7 will pass the fist check , but ofcourse its invalid :D
writing a BF is not the prob, time is (if BF based on random numbers generator)
the below BF is based on random num generator, so have fun BFing
_Servil_
11-23-2002, 10:06 AM
hi ZaiRoN !

the s/n is 1A29****7EB0****

actually my bf had only 1 loop but i must admit, i guessed a bit ;---)

.text:0040159A failed: ; CODE XREF: .text:004014A2j
.text:0040159A ; .text:004014B4j
.text:0040159A ; .text:004014BCj
.text:0040159A ; .text:004014C8j
.text:0040159A ; .text:004014F3j ...
.text:0040159A 6A 30 push 30h
.text:0040159C 68 6A 31 40 00 push offset a:Lamah ; ":-| Lamah!!!"
.text:004015A1 68 17 31 40 00 push offset aTheSerialIsNot ; "The serial is not correct. Check that y"...
.text:004015A6 FF 75 08 push dword ptr [ebp+8]
.text:004015A9 E8 0C 01 00 00 call MessageBoxA

.text:00401532 loc_401532: ; CODE XREF: .text:00401544j
.text:00401532 A1 D4 31 40 00 mov eax, _1stoctet
.text:00401537 31 03 xor [ebx], eax
.text:00401539 A1 D8 31 40 00 mov eax, _2ndoctet
.text:0040153E 31 43 04 xor [ebx+4], eax
.text:00401541 83 C3 08 add ebx, 8
.text:00401544 E2 EC loop loc_401532
.text:00401544 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
.text:00401546 6C EC 2A DB 1E 3E 60+encrypted_start dd 0DB2AEC6Ch, 0F3603E1Eh
.text:00401546 F3 DB A7 3B 36 00 3D+ ; DATA XREF: .text:00401523o
.text:00401546 20 14 6F 44 81 2B 08+ ; .text:00401573o
.text:00401546 3D D8 09 6E 6C 29 E5+ dd 363BA7DBh, 14203D00h
.text:00401546 3D 35 58 2F dd 2B81446Fh, 9D83D08h
.text:00401546 dd 0E5296C6Eh, 2F58353Dh
.text:00401566 01 db 1 ;
.text:00401567 00 db 0 ;
.text:00401568 00 db 0 ;
ZaiRoN
11-23-2002, 10:37 AM
Hi!

Bengaly:
Like you have seen the operations made by the crackme on the serial are very simple; this because is not the aim of the crackme.
writing a BF is not the probhmmm....you are wrong Ben, this is the problem!

This project is made to study the better approach to brute this little target. Base the crackme on a random algorithm might be not the better way. How do you check if the serial is valid? :)

_Servil_:
Congratulation! Too easy :)but i must admit, i guessed a bitGuessed on what!?! Btw, I think it's necessary if you want to optimize the brute ;)

For those whom are playing with this crackme, it might be interesting to see the algo that you have used.

Good luck !
ZaiRoN
Sphinx
11-26-2002, 09:09 PM
Hi i`m trying this brute force me

Like Zairon said on the board the problem is not the brute forcer but how to check all posibilities automatic, the serial is used to generate opcode that calls the messagebox with the good job message (am i right here this is a little bit self modifing code).

The brute forcer not totaly random becuz you have 8 hex char that must be under 1b000000 is num1 + num2 = another value,

I can write a brute forcer that makes serials that will answer to the demands but i don't know how to try all these possibilities automatic maybe you can give me some pointer on how to do that?

thx in advance Sphinx
ZaiRoN
11-26-2002, 11:10 PM
Hi Sphinx.

In general, with this kind of target the idea behind a brute_force approach is the same.
Suppose you have a proggie that has an encrypted area and you have to find the right key to decrypt the area.
You can proceed in this way:

1. decrypt the area with key_i
2. check(s) on the decrypted area
3. is the area decrypted well?
4.a yes: quit and show the right key
4.b no: encrypt the area using key_i. Jump to #1 and execute the steps using a different key

Like you said: "the serial is used to generate opcode that calls the messagebox with the good job message". MessageBox function: this is the key to solve the problem!
In general, the MessageBox function is used in this way:

push box_type
push box_caption
push box_text
push owner_handle
call MessageBox

In the above 5 code lines there are many informations you can use to perform the check on the (decrypted) area:
- every instruction has his own opcode (i.e. 'push xxx' starts with byte 68h)
- every instruction uses a specific number of bytes
- you should know the address of the message relative to caption and text box
- you should also know the owner_handle

Playing with this info, you can personalize your brute as you want :)

ZaiRoN
Sphinx
11-27-2002, 02:12 PM
Yes that's what i mean, thx a lot.

Do you code this inline in the program it self or do you copy the area that is altered in your own bruteforcer and check there for valid asm code? This is really a nice challenge

Sphinx
ZaiRoN
11-27-2002, 06:35 PM
Personally, I wrote an external program that works with the encrypted bytes. However, nothing prevents you from doing the work inside the Crackme.

Let us know your progress ;-)

ZaiRoN
Sphinx
12-04-2002, 04:16 PM
hi all,

I finished this little project and got an working serial, The bruteforcer i wrote isn't very clean coded :), but i`m going to try to get it a little faster and in a nice window. (not console and not using files) don't ask why:)

This selfmodifing code was nice i had not seen it before.

I put my tutorial with this reply so you can see how i did it,
Comment and remarks are welcome!

Sphinx
ZaiRoN
12-04-2002, 10:41 PM
Hi Sphinx,
nice tutorial!Comment and remarks are welcome!Ok, I would like to say two little things.

I taked the code from your tutorial:push 6A x
push 68 A8 31 40 00
push 68 77 31 40 00
push ff x <-- (*)
call E8 0C 01 00 00

//decrypted guess for push title and push message
array[10] = {68 A8 31 40 00 68 77 31 40 00}
// two bytes you don't know for sure
// after that you have the call
array2[5]= {E8 0C 01 00 00}
(*) Indeed, you know these two bytes; these bytes represents the handle of the window that is stored in: dword ptr [ebp+8]. So, you can add 75 08 to your guessed bytes :D

i`m going to try to get it a little faster
I don't know if you followed the general brute-force approach I wrote in a post above; if you have done so, attention. You can optimize it!
Hint: try to remove the task 4.b...

regards,
ZaiRoN
spider
12-07-2002, 07:55 PM
Hello boys! :cool:
I'm the author of the crackme, and I've been lurking for the last few days to see how your works on the crackme was going on, and I am happy to see you liked it :)
Congratulations to _Servil_ and Sphinx who solved the crackme.
I'll continue to read your post (if you want, you may try to solve my second bruteme, where checking for the correctness of the serial being tested is very difficult [or at least I hope so])

Sphinx: Let us know your progress. As Zairon said, the check algorithm can be optimized and the way to do this is tricky and beautiful :)

Spider
Paul333
12-09-2002, 04:13 AM
Cheers all ..really enjoyed reading the above & Spinx's tut :)

paul333
Sphinx
12-09-2002, 03:44 PM
he ZaiRoN

about that optimizing you said remove step 4b, in my bruteforcer i don't have that step.
This is how i did it: I made an extra array that is just as big as the crypted part(decrypt). In every loop i xor the crypted array with key and put the result in the decrypted array (extra array i declared)
and than check for the valid asm code. if correct print key and exit else next key and do it all again.

Maybe ZaiRoN and Spider would like to see it an other way? I don't think i know exactly how. :)

Sphinx

ps: Sure i would like to try solve the second bruteme. I`m not that good but we will see.
spider
12-09-2002, 08:32 PM
Originally posted by Sphinx
he ZaiRoN

about that optimizing you said remove step 4b, in my bruteforcer i don't have that step.
This is how i did it: I made an extra array that is just as big as the crypted part(decrypt). In every loop i xor the crypted array with key and put the result in the decrypted array (extra array i declared)
and than check for the valid asm code. if correct print key and exit else next key and do it all again.

Well, working with two arrays is almost the same as re-encrypting the same array, because you have to load from an array, decrypt, and store to another array. There is a way to speed up working to the same array... and without having to re-encrypt! :)

Bye, Spider


ElGamal Signature
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > ElGamal Signature
PDA

View Full Version : ElGamal Signature

AdamA
11-23-2002, 03:12 PM
Hi,

if anybody would like to improve its Crypto-knowledge, should have a look at Gem Slider 2.5. They use ElGamal-32, so you dont need a Cray at home to solve the DLP. It is a nice protection based on ElGamal-Signature.

Happy crypto-reversing,
AdamA
Solomon
11-24-2002, 04:06 AM
Hi

there is another one: Bubble Shooter v5.01.
though keygen is out. It's also Elgamal-32 signature, using __int64 to implement it. It took me several hours to brute-force it.
strafer
11-24-2002, 01:47 PM
Originally posted by Solomon
Hi

there is another one: Bubble Shooter v5.01.
though keygen is out. It's also Elgamal-32 signature, using __int64 to implement it. It took me several hours to brute-force it.

hi Solomon, did you mean that you take hours to solve the DLP?
:)
Solomon
11-25-2002, 02:39 AM
yeah, maybe 2~3 hours. It may be optimized to shorten the brute-forcing time.
Here is the result:
public key = (y, g, p), where y = g ^ x (mod p).
y = 0x260992DA
g = 0xFD3242AC
p = 0x797A8D77
I got x = 0x2B83B537 after brute-forcing.

Originally posted by strafer
hi Solomon, did you mean that you take hours to solve the DLP?
:)
Solomon
11-25-2002, 03:19 AM
Ooops, moment ago I found that both the above 2 progs are from the same company:D :D
strafer
11-25-2002, 09:22 AM
...yea,i did not believe what you have said above for such a long
time to solve the 32bit dlp for the first time i saw this thread. then i do it myself using the p, y, g you provide, i gota reasonably long period to work the 'x' out from that. it's really weird, i just
thought. for the reason why some other case in which the key length is mush longer than this one can be brute-forced in a short
times? it do not like the IFP which is just base on the key length,
the longer the key is the harder to solve the problem.
pardon for my poor knowledge, and any suggestion/hints from you are appreciate!
AdamA
11-25-2002, 11:18 AM
Hi,

you can use the pollard-rho implementation from miracl-lib(index.cpp). It took me about 1sec to solve to DLP with pollard-rho.

AdamA
Solomon
11-25-2002, 11:31 AM
Will read it. Thx

Originally posted by AdamA
Hi,

you can use the pollard-rho implementation from miracl-lib(index.cpp). It took me about 1sec to solve to DLP with pollard-rho.

AdamA

which is the best?

Some efficient algorithms for the discrete logarithm problem have been reported. They include the Pollard's rho algorithm of logarithms [Pol74], the Pohlig-Hellman algorithm [PH78] and the index-calculus methods [HR83]. The index-calculus algorithm is the most efficient method known for computing discrete logarithms. It is a sub-exponential time algorithm for some groups [MvOV99] but not elliptic curves
AdamA
11-25-2002, 01:26 PM
Of course the index-calculus is the best, but I have never seen a working implementation of it, so far:mad:
I always use the Index.cpp(pollard-rho) from miracl.
But you will get some problems with Index.cpp, solving DLPs with good and big(>160bit) parameters. I got these problems with Dictation Buddy(highcriteria.com).

AdamA
strafer
11-25-2002, 02:18 PM
thx!
and i also use the same version of index.c to do that. hehe.
Solomon
11-27-2002, 08:46 AM
for Gem Slider v2.5

__int64 p = 0x797A8D77;
__int64 g = 0xA6258277;
__int64 y = 0x0AFBBF83;
__int64 x = 0x2F0917AC;

We have to factorize (p-1) before using index.c in MIRACL.
strafer
11-27-2002, 09:43 AM
after the factorization, we should use the result to get the order
of the generator which we should use in the dlp sovling. :)
watj
12-28-2002, 03:14 AM
Originally posted by Solomon
yeah, maybe 2~3 hours. It may be optimized to shorten the brute-forcing time.
Here is the result:
public key = (y, g, p), where y = g ^ x (mod p).
y = 0x260992DA
g = 0xFD3242AC
p = 0x797A8D77
I got x = 0x2B83B537 after brute-forcing.

HI Solomon!
Can you tell me How can brute-forcing? tools?
Thanks!
mike
12-28-2002, 04:21 AM
You don't need any "tools" except a programming language that implements 64-bit integers. Just run through all 4 billion or so possibilities for x and check to see that g^x mod p = y. Use the square-and-multiply method of exponentiation and you'll never need more than 64 bits.
Solomon
12-28-2002, 07:52 AM
yeah I did as what mike said.
The index calculus algo will take much less time.

Originally posted by watj
Can you tell me How can brute-forcing? tools?
watj
12-28-2002, 08:32 AM
Originally posted by Solomon
yeah I did as what mike said.
The index calculus algo will take much less time.

Can you give me source code or similar function program? I want to get the result¡£:)
mike
12-29-2002, 08:05 PM
If you're only interested in the result, it's already been posted. If you want to learn something, go get the MIRACL library like he said, read the docs, and code something yourself.

I'm willing to make a trade, just for teaching purposes: you go factor p-1, post the factors, and I'll walk you through Pohlig Hellman, which is really pretty fast, too, for this size.
Noxerus
01-04-2003, 11:56 PM
Originally posted by mike
you go factor p-1, post the factors, and I'll walk you through Pohlig Hellman, which is really pretty fast, too, for this size.

*Newbie to cryptography alert*
I want to be walked through Pohlig Hellman too! :)
And there, I factored (797A8D77 - 1):
The 5 prime factors are: deleted by mike.

I will delete the primes from this post as soon as Mike sees it, so watj can factor it for himself :)
mike
01-05-2003, 09:19 PM
I'll post more when watj responds or it becomes obvious that he's not coming back. In the meantime, see

http://www-math.cudenver.edu/~wcherowi/courses/m5410/phexam.html
watj
01-06-2003, 01:46 AM
Originally posted by mike
I'll post more when watj responds or it becomes obvious that he's not coming back. In the meantime, see

http://www-math.cudenver.edu/~wcherowi/courses/m5410/phexam.html

Discrete logarithm calculator

http://www.alpertron.com.ar/DILOG.HTM
mike
01-06-2003, 03:01 AM
Yes, Dario's got a lot of good stuff on his site; there's an ECM-based java applet for doing factoring, too.

Watj, are you interested in a walk-through of Pohlig-Hellman, or did you find what you were looking for? (Yes, Noxerus, I'll still cover it for you if you want.)
Noxerus
01-08-2003, 04:51 PM
Me, I'm still interested :)
mike
01-09-2003, 04:44 AM
In this case, all the primes are raised to the first power, so we've got it somewhat easier. If the prime were, say, 19, then

p-1 = 18 = 2*3^2

so we'd have to do more work on the 3's.

Here we have p = 0x797A8D77 = 2038074743
p-1 = 2038074742 = 2 x 11 x 67 x 211 x 6553

Fermat's little theorem says that a^(p-1) mod p =1 for all 0<a<p. That's where the (p-1) comes from.

So x2 = a^((p-1)/2) is going to be a square root of 1 mod p, either 1 or -1. x2^2 = 1 mod p.

And x11 = a^((p-1)/11) is going to be an eleventh root of 1 mod p, either 1 or one of the ten other roots. x11^11 = 1 mod p.

And so forth for each of the prime factors of p-1.

We want a = y = 0x260992DA = 638161626.

Calculate y^((p-1)/2) mod p = 638161626 ^ 1019037371 mod p = 1. We know that g^0 = 1, so x mod 2 = 0.

Calculate y^((p-1)/11) mod p = 638161626 ^ 185279522 mod p = 530667471. This one isn't immediately obvious what it is, so we calculate powers of g^((p-1)/11):

4247929516^( 0 (p-1)/11) = 1

4247929516^( 1 (p-1)/11) = 530667471 Here it is!

4247929516^( 2 (p-1)/11) = 1476055738
4247929516^( 3 (p-1)/11) = 1577372493
4247929516^( 4 (p-1)/11) = 1556672107
4247929516^( 5 (p-1)/11) = 1164698744
4247929516^( 6 (p-1)/11) = 157526512
4247929516^( 7 (p-1)/11) = 332468944
4247929516^( 8 (p-1)/11) = 1273244622
4247929516^( 9 (p-1)/11) = 620334131
4247929516^( 10 (p-1)/11) = 1501332952

So x mod 11 = 1.

Calculate y^((p-1)/67) mod p = 638161626 ^ 30419026 mod p = 837055778.

Calculate powers of g^((p-1)/67):
4247929516^( 0 (p-1)/67) = 1
4247929516^( 1 (p-1)/67) = 969279158
4247929516^( 2 (p-1)/67) = 627462209
4247929516^( 3 (p-1)/67) = 1923309045
4247929516^( 4 (p-1)/67) = 1491205505
4247929516^( 5 (p-1)/67) = 1616231650
4247929516^( 6 (p-1)/67) = 1430903068
4247929516^( 7 (p-1)/67) = 858152029
4247929516^( 8 (p-1)/67) = 700138780
4247929516^( 9 (p-1)/67) = 450173072
4247929516^( 10 (p-1)/67) = 1145195681
4247929516^( 11 (p-1)/67) = 265253246
4247929516^( 12 (p-1)/67) = 1590062376
4247929516^( 13 (p-1)/67) = 1610058652
4247929516^( 14 (p-1)/67) = 538804611
4247929516^( 15 (p-1)/67) = 222570830
4247929516^( 16 (p-1)/67) = 77171383
4247929516^( 17 (p-1)/67) = 995947742
4247929516^( 18 (p-1)/67) = 1843915853
4247929516^( 19 (p-1)/67) = 1434514064
4247929516^( 20 (p-1)/67) = 817579263
4247929516^( 21 (p-1)/67) = 1887925213
4247929516^( 22 (p-1)/67) = 15849998
4247929516^( 23 (p-1)/67) = 84615908
4247929516^( 24 (p-1)/67) = 1949393505
4247929516^( 25 (p-1)/67) = 652376957
4247929516^( 26 (p-1)/67) = 525399415
4247929516^( 27 (p-1)/67) = 1801408622
4247929516^( 28 (p-1)/67) = 893704256
4247929516^( 29 (p-1)/67) = 647363056
4247929516^( 30 (p-1)/67) = 1533497277
4247929516^( 31 (p-1)/67) = 1719778403
4247929516^( 32 (p-1)/67) = 832957763
4247929516^( 33 (p-1)/67) = 554248528
4247929516^( 34 (p-1)/67) = 1718318301
4247929516^( 35 (p-1)/67) = 1649641819
4247929516^( 36 (p-1)/67) = 1162586056
4247929516^( 37 (p-1)/67) = 838130037
4247929516^( 38 (p-1)/67) = 1442672583
4247929516^( 39 (p-1)/67) = 385980540
4247929516^( 40 (p-1)/67) = 1473057032
4247929516^( 41 (p-1)/67) = 1958149338
4247929516^( 42 (p-1)/67) = 187216864
4247929516^( 43 (p-1)/67) = 317573875
4247929516^( 44 (p-1)/67) = 1191478852
4247929516^( 45 (p-1)/67) = 773712805
4247929516^( 46 (p-1)/67) = 1563067286
4247929516^( 47 (p-1)/67) = 1255085586
4247929516^( 48 (p-1)/67) = 162828941
4247929516^( 49 (p-1)/67) = 542963462
4247929516^( 50 (p-1)/67) = 164666018
4247929516^( 51 (p-1)/67) = 1582717187
4247929516^( 52 (p-1)/67) = 205968428
4247929516^( 53 (p-1)/67) = 876471562
4247929516^( 54 (p-1)/67) = 1756421293
4247929516^( 55 (p-1)/67) = 172990721
4247929516^( 56 (p-1)/67) = 601398531
4247929516^( 57 (p-1)/67) = 1990839337
4247929516^( 58 (p-1)/67) = 861384721
4247929516^( 59 (p-1)/67) = 732439570
4247929516^( 60 (p-1)/67) = 663613693
4247929516^( 61 (p-1)/67) = 1965313413
4247929516^( 62 (p-1)/67) = 1133873381

4247929516^( 63 (p-1)/67) = 837055778 Here it is!!

4247929516^( 64 (p-1)/67) = 1046026847
4247929516^( 65 (p-1)/67) = 2034779028
4247929516^( 66 (p-1)/67) = 301596515

So x mod 67 = 63.

We do the same thing for 211 and find

y^( (p-1)/211 ) = g^( 124 (p-1)/211 )

so x mod 211 = 124.

We do the same thing for 6553 and find

y^( (p-1)/6553 ) = g^( 1824 (p-1)/6553 )

so x mod 6553 = 1824.

Now we know what x is modulo all these different primes, we have to reassemble them using the Chinese Remainder Theorem. That I leave to you as homework. Post it below.


IDA Difference file patcher???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA Difference file patcher???
PDA

View Full Version : IDA Difference file patcher???

crUsAdEr
11-23-2002, 08:04 PM
Hi folks,

I am just wondering if there already is a small tool that reads the difference file produced by IDA and then patch the exe? I am sure there must have been... it is a fairly simple task, i am just lazy :D so if there is such a tool already then i dont need to write reinvent wheel and write another one..

I did a quick search on google and IDA website but couldnt find anything useful...

Thanks for any link,
crUsAdEr
Asm_Freak
11-29-2002, 02:31 AM
I made one somtetime ago. Just e-mail me at asmstudio(at)hotmail(dot)com and i'll send it to ya.

JP


Exceptions after unpack of Winace 2.11
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Exceptions after unpack of Winace 2.11
PDA

View Full Version : Exceptions after unpack of Winace 2.11

semsen
11-24-2002, 01:21 AM
I am reasonably new at the cracking stuff, and have only just started learning about unpacking, procdumping...etc

Recently, I have tried to crack Winace 2.11. It is protected by a (apparently modified to make the procdump unpackers fall over) version of ASPack.

Using SoftIce, I managed to trace to the point when code was uncompressed, and found the entrypoint as well. I dumped (using procdump) the memory contents just before it jumped out of the unpacker code, modified the entry point (and the jmp eip), and then proceded to actually cracking the 30-day limit (which was a piece of cake).

All this is brilliant, i'm happy, as the prog works fine (unpacked prog with no limit), or so i thought!

Strangely, after a few times of running the program, the executable stops working fine, throwing every time an (unrecoverable) exception when loading.

I have been completely unsuccesful at figuring out why this is. Spending hours tracing through code, it looks like it is trying to jump to a memory location that isnt winace's, but i'm really not sure!

I know i am just a newbie compared to all the people out there, and i must be doing something wrong, but don't know what that is. Has anyone experienced this type of problem? Can anyone help?

And, yes, i DO know there are millions of s/n's out there that will register the prog without trouble, but i'm actually doing this for fun!
Woodmann
11-24-2002, 01:56 AM
Howdy,

And, yes, i DO know there are millions of s/n's out there that will register the prog without trouble, but i'm actually doing this for fun!

Serials are not the reason why this place is here. We are here for the very reasons why you have chosen not to go and find a serial :)

You desire to know how a protection works and that is exactly what you will find here.

As far as your problem, I have never heard of an .exe that works a few times then stops. It could be trying to jump to a memory space looking for info. There seem to be many version of this modified aspack.

You should search the forums for more information, then post again some more stuff that you have learned from your target.

Read everything you can find, winace is not the easiest thing to start out with.

Peace, Woodmann
r4g3
11-25-2002, 09:33 AM
maybe u`ve first ran a packed exe thru symbolloader/siloader.
Uhm i dunno how/why it is so, but in this case u have the program context 'saved' (any bytes patched appear unchanged on a second run) The problem could be that u did smth wrong when unpacking & after reboot when no packer shit code was left in ram the app crashed.....

i can get the (in)famous rtfm aswer to this, but why is it so because siloader set some pages to not be discarded after app exit ? (this is the only thing i could think of :)
Aimless
11-25-2002, 12:04 PM
Hi,

You have encountered a program in the category:

"If-hacker-broken-show-nothing-wrong-for-2-days-then-act-funny"

In short, the validation routine has got double checks. You will have to find those out. A good idea is to:

1. Download Ollydbg

2. Install Windows (again). Break the protection scheme using the normal ice/procdump/etc tools. When you are sure it runs properly (or so you think), trace the application through Ollydbg

3. After a few days, when the error comes up, trace the same through Ollydbg again.

4. COmpare the original with the first. Note that Ollydbg ALSO traces ALL modified registers :) You can now find out where the validation routine is getting validated itself.

Have Phun.
semsen
11-26-2002, 12:21 AM
Well, thanks for the replies.

I can tell you its a great and refreshing pleasure to have found a place where there are other people like me who are not just shouting out asking for serials and cracks but actually have an interest in protection schemes.

As a little exercise, i actually managed to crack the software by adding extra patching code in the loader, keeping the executable packed. But i only felt a minor satisfaction from this, as this didn't explain what went wrong when trying to unpack to original version.

So, back to the topic, yes, indeed, i think its softice loader that leaves stuff behind, as i re-unpacked winace without using the loader, and rebooting afterwards just to be sure, and sure enough, my dump aint working! Big exception error, page fault.

So, bad news: i aint figured it out yet,
good news 1: its probably me not doing the dumping process right, or overlooking some crucial aspect of unpacking.
good news 2: It might not be a make-cracker-happy-for-a-couple-of-days-then-screw-up program after all...

Although i DO realise its up to me to do the bookwork and practicing, further help and tips would be much appreciated.

Sorry if i'm irritating the f*** out of you for posting long messages and acting like an annoying newbie, but, hopefully, i will calm down soon...!
norby
11-27-2002, 03:12 PM
hi!,

you should probably rebuild the import table;

the same thing you wrote (first time runnning fine, after reboot crashing) happened to me twice in past days with 2 aspacked programs...

use ImpRec, click on Iat Auto Search, then Fix Dump and it should work OK (for me it did with aspack, but didnt try Winace yet)..

Norby


TButton Property
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > TButton Property
PDA

View Full Version : TButton Property

Melvill
11-24-2002, 05:06 PM
Hi Guys

I have a litlle reverseme made in Delphi 6 and i do not understand how it works in hex.

for ex. in the app we have a TButton disabled and i know that the value is 08 and for the enabled it works with 00. Now where can i check all this values ? are there some kind of Winuser.h for Delphi ?

Thnks

Melvill
squidge
11-24-2002, 07:08 PM
Yup, from your Delphi install directory, look here:

Source\Rtl\Win\Windows.pas

This is basically the Windows.h header file in delphi format. If your Delphi was installed in D: for example, look in:

d:\Program Files\Borland\Delphi6\Source\Rtl\Win\windows.pas
Kayaker
11-24-2002, 07:16 PM
As I'm about to post...

Huh, didn't know about that Squidge, I'll have to reinstall Delphi and check it out.

As far as I knew there was no easy listing of these parameters, it's sort of a trial thing, you make a few test apps with different control properties and compare their hex differences. As you found out 08 = Disabled, and if I remember correctly 09 = Enabled (00 works as well I guess). Actually you don't normally get the default Visible=True property in the compiled program, only if Visible=False I believe.

There are some similarities with VB I believe and if you check in the MiniProject forum there was a thread or two which discussed some of this, it might help clarify some of the unusual Delphi structure as well.

There are a few good tuts on the main site dealing with Delphi structure you may want to read

Delphi Reverse Engineering
Adding functionality to a Delphi program
Written by +DaFixer

http://www.woodmann.net/fravia/dafix_t1.htm

And the two papers linked from that one:

LaZaRuS paper Finding standard functions in Delphi/C++ Builder and also some facts about DFM RCDATA in the +Aitor work DFM Files, Windows RCDATA and Object Conversion Routines

Hope this helps,
Kayaker
Melvill
11-25-2002, 11:33 PM
Thnks guys for your help.

I understand that i will have a very long journey in the way to clarify this parameters on Delphi structure.

I have time...

thnks again guys

Melvill


Driverstudio 2.7 and video problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driverstudio 2.7 and video problem
PDA

View Full Version : Driverstudio 2.7 and video problem

Cps530
11-25-2002, 12:33 AM
I have just installed Driverstudio 2.7 and I can't see SI anymore. After pressing CTRL-D, everything freezes, SI is there, but nothing happens until I press CTRL-D again to return to W2k (I'm using video card GE Force, W2k SP3 and universal video driver in SI - changing to full screen VGA mode nothing happens). I have found in this MB some references to the same problem and the thing seems to be related to SIWVID. But until now I can't figure out how to solve the problem. Has anyone a clue about it? Thanks in advance.
Woodmann
11-25-2002, 12:55 AM
Howdy,

Have you tried using the uni-driver in windows ?

Peace, Woodmann
Cps530
11-25-2002, 12:58 AM
No, I have not. How to do that? THKS
UrgeOverKill
11-25-2002, 01:42 AM
Hiya,

If you are using XP, do you have SP1 installed??
Woodmann
11-25-2002, 01:57 AM
OK,

Just so you know, there are a lot of people who are having
problems with GE FORCE video cards.

I have a Rage video card, to use my generic windows drivers I have to do the following.

Go to: My computer-control panel-display-settings-advanced-adapters-properties-driver-update.
Check the display known drivers box (or whatever it is called)

This will now allow you to manually change your video driver.
My Rage has something called "vga compatible" this is the generic
driver that makes this video card work on anything. It runs in 256 colors with the "blind" person screen resolution.

If this does not work, the easiest hting to do is go to : system-hardware-device manager-click on display adapters and highlight it then right click and un-install. Restart on the way out and PNP will get you back on track.

Good luck, and you cant charge me for someone to fix this if it doesnt work. If you dont feel comfortable doing this then dont do it.

Later, Woodmann
JMI
11-26-2002, 06:44 AM
And, We could add that it would have been good to have searched the Board BEFORE you posted your question, because, as Woodmann said, there have been many with similar problems with the new SI and video cards.

Regards.
Cps530
11-26-2002, 10:07 PM
Sorry gods! oh, sorry again, GUYS! I have read BEFORE and I had not found the solution. So, I decided to ask you, gods! (sorry, guys!).
Woodmann
11-26-2002, 11:37 PM
Hi,

Please drop the "gods" crap. Names on a screen, thats all everyone is.

Now, how about getting back to the problem of trying to get a
GE FORCE video card to work with SI.

Who makes the GE card ? How about trying the manufacturers
drivers instead of the custom GE ones.

How about checking video memory in SI ?

Maybe try an older driver studio?

There is a solution, you just have to keep trying or else you can wait for DS 2.8 and hope that fixes it.

Later, Woodmann
Tron101
12-15-2002, 01:39 AM
Choose the Universal Video Driver and then click TEST. Once that's done restart the computer. When you are in windows start softice and everything should be fine, I had that same problem with my nvidia geforce card.

what I'm assuming is you don't know how to bring up the full screen.... that's why you may have messed around with the video and stuffed it up. Just type the following at the sice prompt:
Lines 60 [press enter]
Width 160 [press enter]

both of these settings are suitable for 1024x768 resolution on a 17' monitor.
LOUZEW
01-07-2003, 11:57 AM
HI, guys
Read this post and all other related too !
I have the same Pb (Abit Siluro GF2 T400 with DS 2.7 under XP).

Does anybody can tell us Where is really the Pb ( Detonator Driver, Manufacturer Driver, SoftIce Uni-Drv, The video card ..... ?)

I've read in a post, it's due to SIWVID, is that true ? and what is the Pb ?

Thank's to lightning us !
squidge
01-07-2003, 01:32 PM
Just for the record, I use Driver Studio 2.7 under WindowsXP on a Geforce 4 4200 without any problems. I use the Uni-driver (SoftIce-in-a-Window driver). Only problem is that I can't use the mouse, but don't really want to anyway.
nofurs
01-07-2003, 01:47 PM
Another thing some Geforce 2 affects sice on search command too.I have to use my old trident card ;)
LOUZEW
01-12-2003, 03:25 PM
Hi, all
i've finally set DS 2.7 and GeForce 2 to work fine !

Where was the problem ?

My motherboard is a MSI K7T266 Pro ( a VIA chipset based one). When installing W98, i need to apply the VIA 4in1 patch to be able to work, then migrating to XP, i have installed theses drivers too but the AGP patch make XP to freeze. So i've formatted and re-installed XP WITHOUT this AGP patch and all is OK.
Now i'm working like a charm with DS 2.7 and my GF2 T400.

Hope this can help other members here !


Reversing games
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Reversing games
PDA

View Full Version : Reversing games

chronos
11-25-2002, 05:34 AM
Hi there,

I read a lot of tutorials on reversing windows programs with tips on breaking SI at the registration process using BPX GetWindowTextA, GetDlgItemTextA, GetDlgItemInt, etc. But I discovered that SI does not break with the above APIs (for example, the registration for the game called Bejeweled from Pop Cap at h**p://www.popcap.com/installer_download.php?url=WinBejeweled_setup.exe.
Does anyone knows I can break straight after the password prompt for this case or any good tutorials that shows how to do it? Thanks for the help.
Solomon
11-25-2002, 06:05 AM
Delphi/BCB progs never call GetWindowTextA etc to get the string from editbox. You can find out why by reading the VCL source code(It's written in Object Pascal).

I often use "BPX DestroyWindow" after the "Incorrect key" dialog pops up and press the OK button, then trace back to find the regcode validation routine.

There is another way to find the routine. Just use RegMon/FileMon to find where the registration info is stored, put a fake key there, then BPX RegQueryValueExA/CreateFileA/_lopen.

Also don't forget the dead-listing way. You may find clues by string references there.

good luck.
FoolFox
11-25-2002, 07:17 AM
Hello,

If any usual way didn't work for you, I think it's worth
then spending time analysis the death listing, using any
string related to the password prompt (windows title,
labels, mesasgeboxs messages,etc...), try to locate them
inside the listing and from them you can see :

- where it was called from..
- where it could go...

from there, mostly depend on what you look at...

Regards
FoolFox
hobgoblin
11-25-2002, 08:29 AM
Hi there,
I cracked this one a while ago. Try to use W32dasm or IDA (if you prefer this one), and do as the rest of the guys suggest. You will see that you get all the clues you need to reverse it. If I remember this correctly, you only have to change a couple of bytes to make it registered. When you dead-list it, you will also get clues enough to find out how to make Sice break at the correct place.:)
Good luck,
hobgoblin
disavowed
11-25-2002, 12:15 PM
also, DeDe is extremely useful for reversing delphi apps
chronos
11-26-2002, 05:38 AM
Hi people, thanks for all the replies.

Solomon, thanks for the tips. It looks like the program doesn't use windows to prompt for password or showing the bad guy message. It does write to the registration details into the registry at the end of the program but I can't get sice to break on memory access for the details (weird...I wonder how it store the details there in the first place). Anyway, I learnt something from your suggestions :).

FoolFox and hobgoblin, yep, I think I would have to do it the hard way. By saying dead-listing, do you mean using disassemblers to get the whole program listing in ASM? The problem with this program is it doesn't flow properly. It looks like after it draws the screen for registration details, it doesn't call any routines to get the input. It simply goes on and on repainting the surface (loops). Geez, being a newbie sure isn't easy :P. Anyway, my thanks for your tips.
Solomon
11-26-2002, 07:08 AM
hi,

The reg code is stored here:
HKEY_LOCAL_MACHINE\SOFTWARE\PopCap\ZoneBejeweled\RegName
HKEY_LOCAL_MACHINE\SOFTWARE\PopCap\ZoneBejeweled\RegCode

so, search for "RegCode" in the disassembled text, we are lucky tol find 2 occurences. The first is for RegSetValueExA, the 2nd is for RegQueryValueExA. I prefer he latter as a breakpoint. Put a BPX there. After the regcode is read from registry, set a BPM on your fake code. You can refer to MSDN documentation about the parameters of RegQueryValueExA. Write down the buffer addr passed to this API, your fake code will be stored there.

If it moves your code to another buffer, put a BPM/BPR on the new buffer too.

* Possible StringData Ref from Data Obj ->"RegCode"
|
:0043365F 68D4DB4A00 push 004ADBD4
:00433664 8B8DFCFEFFFF mov ecx, dword ptr [ebp+FFFFFEFC]
:0043366A 51 push ecx

* Reference To: ADVAPI32.RegQueryValueExA, Ord:017Bh
|
:0043366B FF1510304A00 Call dword ptr [004A3010]
:00433671 85C0 test eax, eax
:00433673 0F855F030000 jne 004339D8
FoolFox
11-26-2002, 07:32 AM
Hello,

Yeah chronos, study the death-listing mean taking it
with a disassembler, and search for interesting strings.

Currently, if you fix the PE header (hint: check the section
flag in the .text header), you'll find this with W32Dasm,
inside the string reference table :

"CLICK HERE TO REGISTER NOW!"
"Click here to register online"
"http://www.popcap.com"
"http://www.popcap.com/register.php?theGame=bej"
"http://www.popcap.com/win32updatecheck.php?pro"
"popcinfo.dat"
"ReferId"
"RegCode"
"REGISTER BEJEWELED"
"REGISTER NOW TO REMOVE THIS DELAY!"
"Register Now"
"Register online to remove the "
"Register"
"Registered Name"
"registration information below."
"Registration Invalid"
"RegName"
"THANKS FOR REGISTERING!"
"The registration number you entered "
"UNREGISTERED VERSION - YOU HAVE "
"UNREGISTERED VERSION"
"Up to Date"
"Update Check"
"Update Count = %d"
"Updates"
"Version "
"Version: "
"When you have registered, enter "
"You must register online now to "

From there, there is various way to find it what you want
to get....

Regards
FoolFox

P.S. : You should at first change those h**p://www.popcap.com,
just in case :)
chronos
11-27-2002, 09:29 AM
Hi Solomon, I tried tracking the the RegQueryValueExA routine and noted down the buffer address and set a BPM on it to break whenever it is accessed (and I thought, Ah Ha! Gotcha now). But, when it broke next, its offset address was 77F82BC1 ! (which is way out of range) Do you know how I can find that code?

FoolFox, I tried using the Text Ref to find the bad guy message and I managed to patch a location to show the "Thanks for registering" message:

.text:00412C4F test eax, eax
.text:00412C51 jnz short loc_412C5D <- patch to jmp
.text:00412C53 mov ecx, [ebp+var_50]
.text:00412C56 call sub_4116F0
.text:00412C5B jmp short loc_412CCC

The problem is the game stay unregged after the message.

Thanks for the all the help and suggestions... Please inform me if anyone managed to reverse engineer the registration process before ;). I would really love to find out (this is the hardest program for me so far).
FoolFox
11-27-2002, 09:51 AM
Hello,

Well, it look like you patched one location, while there is probably
other's location to patch that have still to be found.....

will try to have a closer look...

Regards
FoolFox
chronos
11-27-2002, 09:55 AM
Wow FoolFox, that was a quick reply. Hope you'll be able to find the other location. Thanks! :)
Solomon
11-27-2002, 10:18 AM
Did you BPM the buffer AFTER the api call? If you BPM it BEFORE the api call, it will break when kernel dll fills the buffer, just as you got.

Originally posted by chronos
Hi Solomon, I tried tracking the the RegQueryValueExA routine and noted down the buffer address and set a BPM on it to break whenever it is accessed (and I thought, Ah Ha! Gotcha now). But, when it broke next, its offset address was 77F82BC1 ! (which is way out of range) Do you know how I can find that code?
FoolFox
11-27-2002, 10:39 AM
Hello,

Well, fast but not really helpfull, he... :)

i'me currently looking at it, wonder wich version you're working
on ? I'm on :

BEJEWELED
for Windows
version 1.5
October 29, 2001 (stated in the readme, have take it from
their website)

currently, adresses does not match. I've got the jump you
patched, think here :

00417AEE |. 8A91 F0000000 MOV DL,BYTE PTR DS:[ECX+F0]
00417AF4 |. 85D2 TEST EDX,EDX
00417AF6 |. 75 67 JNZ SHORT WinBej.00417B5F ; jump to THANKS FOR REGISTERING

Is that one you've patched ? then I'm afraid you are not
going in the right direction... you are curently patching a jump
to show a THANKS FOR REGISTERING message, whenever you
are or not, it will show the message. But as you've said, you are
still unregistered because the program Know that you are
unregistered. Just making him showing the message won't
get you registered, especially if he check at several place.

This call is at the end of a long function, starting at :

00417A3B |> 8B95 48FEFFFF MOV EDX,DWORD PTR SS:[EBP-1B8]

Setting a BP on 00417A3B, run the proggy

The program break. Running it step by step show that is tagged
as UNREGISTERED even before having a single windows displayed. If you want to register it, you have to make it
believe at the start that you are registered.

For your message, if you land on some adress like 77F82BC1 then
most probably you are inside a system DLL, not the proggy, so
at this point you have to trace back to the location of the call, or
run it till a RET to get back to your prog.

Currently i'm lokking on the RegCode direction.... will let you
know if I got the illumination about...

Regards
FoolFox
FoolFox
11-28-2002, 01:44 PM
Hello,

didn't had really the time to look at it but found that
tutor on one popcap game... you should have a look
at it :

http://anticrack.p15106404.pureserver.info/modules.php?op=modload&name=News&file=article&sid=1757&mode=&order=0&thold=0

Regards
FoolFox
Nigma
11-28-2002, 08:53 PM
I am familiar with your problem on BPX after the
reg info is entered , I just began a thread which called :
"Serial fishing but no trivial" it discuss the same problem.
I can give you a hint . well in some games at the window
which contain the reg button there is a button which link
you to the game site , the api which opens the browser
is ShellExecuteA so after disassemble the file look for this
function ( it does not used so much so you'll find a one or two)
and begin the trace in the code line above (put bpx until you
manage to break before the reg Form is shown) then you will
land at the reg core !

Give it a try , I managed to find the reg core in Big Money
( this is a PopCap game ) and I cracked it very easily
(2 minutes work ) !

Good luck !
chronos
12-02-2002, 10:02 AM
Hi guys, sorry for the late reply. Thanks for all your help. After reading all your ideas and tips, I finally managed to find the reg routine and able to patch it to be regged.

For those who are interested, this is the code that I changed:

00420C00 mov al, [ebp-0E0h]

to

00420C00 mov al, 1
00420C02 nop
00420C03 nop
00420C04 nop
00420C05 nop

The program will then think that it's regged and work like a regged version completely. Thanks again for the tremendous help.


Need help with debugging
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help with debugging
PDA

View Full Version : Need help with debugging

crackzilla
11-25-2002, 05:00 PM
I need to set a breakpoint on button click event to see what code is executed. What debugger would be the best and how can I do this?

The program is VB6 native. SmartCheck didn't help.

Thanks
esther
11-25-2002, 05:09 PM
Did you read the FAQ?
Did you search the web or forum?
There are lots of tools you can use ollybug,softice and so forth....
crackzilla
11-25-2002, 07:26 PM
Thanks anyway.

I'll try OllyDbg, I don't like the SoftIce interface.
hobferret
11-25-2002, 10:42 PM
Come on esther give him a little help:)

Look for handles [HWND] then break on window message [BMSG] I.E. BMSG WM_LEFTBUTTONUP:D

We all have to learn somehow and a bit of help works fine:cool:

/hob
esther
11-26-2002, 04:03 PM
Hi,

hobferret:-
Look for handles [HWND] then break on window message [BMSG] I.E. BMSG WM_LEFTBUTTONUP

>>>Should be bpx wm_lbuttonup
bmsg window handle(odblah)
The above can be use in softice,not sure of ollydbg though

Ps:he should read it ;) (FUQ) :D

Regards
crackzilla
11-26-2002, 04:44 PM
Thanks, the job is done:)
crackzilla
11-26-2002, 05:20 PM
BTW, it was a freeware program. I had to patch the exe in 3 places to remove the limitations.

bpx wm_lbuttonup works in OllyDbg, but I did it different by using
__vbaStrComp (before I read your replys).

In OllyDbg:

1) Right click on disassembly window
2) Search for -> Name in all modules
3) found __vbaStrComp by browsing the _huge_ list and set a beakpoint on it

Is there a way to do this easier? If I use bpx __vbaStrComp I get a large list of Intermodular calls, it doesn't sets a simple breakpoint.

Thanks


Why does IDA behave like this? (arbitrary halt of disassembly, and more...)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Why does IDA behave like this? (arbitrary halt of disassembly, and more...)
PDA

View Full Version : Why does IDA behave like this? (arbitrary halt of disassembly, and more...)

dELTA
11-25-2002, 10:35 PM
With this post I attach a small com-file. It is a pure dump of the executable code in the Master Boot Record of a harddisk on a Windows 98 (Swedish language version) computer.

When I disassemble this file in IDA I notice several annoying and confusing things, that I would really appreciate if some of you assembly/IDA-wizards could clarify for me.

First of all, all offsets mentioned below are the offsets shown in IDA. The corresponding file offsets are 100h less (IDA takes into consideration the runtime PSP when adding 100h to the offsets I guess?).

Strange thing number 1:

At offset 01A6 there is a jmp to offset 04A6. At this target address (04A6) IDA only disassembles one single instruction, namely "cli". Then it has just stops the disassembly and marks the bytes after this as "unexplored". Why would it do this? As far as I know, the "cli" instruction only modifies the interrupt mask, and does not in any way divert the control flow?

Strange thing number 2:

The practically same thing happens at offset 0175, which contains a call to offset 01D7. At this target address (01D7) IDA also only disassembles one single instruction, namely "push si". Then it just stops the disassembly and marks the bytes after this as "unexplored". And "push si" certainly does not divert the control flow, right? What's up with that?

Strange thing number 3:

At offset 013C, there is a call to offset 01D6. At this target address (01D6) IDA disassembles one instruction, and then it decides that this instruction is the entire body of this called procedure, like this:

proc near
01D6: inc cx
endp

Note also, that the next offset is the target offset mentioned in situation 2 above, containing the instruction "push si", which is in turn followed by the "unexplored" data.

Strange thing common for all these situations:
Whenever I try to force IDA to treat any unexplored bytes as code (e.g. the bytes after the single instructions in situation 1 and 2), by putting the cursor on the first line of unexplored data and then pressing the C button, I always just get the message 'Command "MakeCode" failed'.
What the %@£€#%?!? That is exactly how that IDA-command always repsonds when I try to use it, it has never been able to work a single time for me. Just because IDA has decided in advance that these bytes are not code it seems to refuse to even consider the possibility, even though the traced control flow runs right into these offsets!

Summary:
So, my questions are:
Why does IDA just halt the disassembly on arbitrary places like this (and end procedures on equally arbitrary places, like in situation 3 above)? And what am I doing wrong with the C ("Make code") command? There's not much "interactive" about the disassembler if it always overrides any and all of my requests to change its initial opinion about anything, now is it. :( Has anybody ever gotten that command to work?

I'm using IDA 4.21, but it has acted exactly the same for me with earlier versions too.

Any explanation regarding any of these issues would be greatly appreciated, since this is starting to drive me completely crazy. :(

Thanks!
ZaiRoN
11-26-2002, 12:25 AM
I think that IDA is unable to recognize this type of instructions.
For example, I have tried to force IDA to recognize the instruction (at :4A6) 'movzx eax, byte ptr [bp+10]' using the 'assemble instruction' option but the result is only a message: 'invalid mnemonic'.

If you want to know something more about your file, this link might help you: http://www.geocities.com/thestarman3/asm/mbr/MSWIN41.htm

my 2 €...
ZaiRoN

ps. wdasm & hview display the instructions in the right way :D
disavowed
11-26-2002, 12:45 AM
Originally posted by ZaiRoN
ps. wdasm & hview display the instructions in the right way :D
that makes the score:
wdasm: 1
ida: 94018

:)

in all honesty though, that is very interesting that wdasm can do it but ida can't. dELTA, perhaps you should consider contacting ilfak and ask him what the problem is
dELTA
11-26-2002, 12:59 AM
Thanks for the link!

In that analysis of the code, it turns out that (at least some of) these exact positions where IDA abruptly ended the disassembly contains instructions that "MS-DEBUG" cannot disassemble correctly either.

But how on earth can there exist so many instructions that neither IDA nor MS-DEBUG can decode? Why can't they simply decode all legal instructions? I mean, after all there is only a finite number of them, and they are even arranged in a quite logically sound space?! Anyone have any idea whatsoever why they might do that?

And as bad as it might sound to just skip the ability to decode certain perfectly valid instructions, it seems even worse to silently abort the disassembly of all code-flow paths that come upon one of these, not to mention refusing to give any explanatory error message when a "MakeCode" command is issued and fails. :( While being such an incredibly cool and powerful disassembler, I still get really disappointed in IDA sometimes. :(
dELTA
11-26-2002, 01:06 AM
Sure disavowed, I will try to ask the IDA guys, and I'll return here later with the official explanation.

(it would still be cool to hear if anyone here has any ideas about what I wrote about in my last post above)
disavowed
11-26-2002, 01:08 AM
Originally posted by dELTA
it seems even worse to silently abort the disassembly of all code-flow paths that come upon one of these

it's not totally silent. if you look in the Problems Window (View->Open Subviews->Problems), you'll see it says:
seg000:01D8 NODISASM db 66h ; f
seg000:04A7 NODISASM db 66h ; f

so it does say where it ran into problems, and what the problems were (NODISASM short for "no disassemble johnny-5"? :)
disavowed
11-26-2002, 01:13 AM
problem solved!!!

set your Processor Type in IDA to "Intel 80x86 processors: metapc"

now it disassembles your above 2 issues correctly! :)
dELTA
11-26-2002, 01:29 AM
Cool, thanks disavowed!

I didn't see that IDA all of a sudden defaulted to the 8086 instruction set just because it was a com file. :o Normally (with PE files) it always defaults to metapc.

Then I would like to apologize to IDA for my former complaints, and instead add a new one :): Stop defaulting to processors that might not potentially be able to handle the instructions in a piece of code that is loaded, at least without giving an expressive warning that this might be the case when an undecodable instruction is found. I mean, what can defaulting to the 8086 instruction set possibly be good for (especially compared to the problems it might cause)?


Test Eax,eax ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Test Eax,eax ???
PDA

View Full Version : Test Eax,eax ???

FoolFox
11-26-2002, 10:52 AM
Hello,

This may sound as a stupid question, sorry, but i'm stuck on that since
few days and my searches on the subject didn't helped me so much...

I'm trying to figure the following code, at wich condition the jump will
occurs... :

test eax,eax
je .....

EAX is a 32bit register

So far, what i know :

The TEST instruction (Test for bit pattern) performs a logical AND of
the two operands updating the flags register without saving the result

Usage: TEST dest,src
Modifies flags: CF OF PF SF ZF (AF undefined)

Ok. I can tell you that you will find that on MANY web pages, each of them
happily publihing exactly the sames infos, nothing more than what i've shown
above.

I understand the usage of the TEST instruction with a command like this one :

test ax,00000010b

here, a jump would be executed only if the second bit of ax=1, no matter
of what others bit values are, right ?

but i don't see the point of testing eax against eax ?? when this could be
an interesting condition to check ?? Does it only deal with flags ? (Carry,
Parity, Auxiliary, Sign ?)

I'm currently digging results returned by a search on 'test eax' but i'll
be there for quit a while.. :)..

Regards
FoolFox
dion
11-26-2002, 11:10 AM
if i'm not wrong, test opcode doing AND logic against each its param. so if test eax,eax, it is doing and eax,eax. it can be use for testing if eax was zero or not.

hm... maybe ;p

regards
wbe
11-26-2002, 12:39 PM
FoolFox, here is an excerpt from the Intel document:

3-450

INSTRUCTION SET REFERENCE

TEST—Logical Compare

Description

Computes the bit-wise logical AND of first operand (source 1 operand) and the second operand
(source 2 operand) and sets the SF, ZF, and PF status flags according to the result. The result is
then discarded.

Operation

TEMP SRC1 AND SRC2;
SF MSB(TEMP);
IF TEMP = 0
THEN ZF 0;
ELSE ZF 1;
FI:
PF BitwiseXNOR(TEMP[0:7]);
CF 0;
OF 0;
(*AF is Undefined*)

Flags Affected
The OF and CF flags are cleared to 0. The SF, ZF, and PF flags are set according to the result

Opcode Instruction Description

A8 ib TEST AL, imm8 AND imm8 with AL; set SF, ZF, PF according to result
A9 iw TEST AX, imm16 AND imm16 with AX; set SF, ZF, PF according to result
A9 id TEST EAX, imm32 AND imm32 with EAX; set SF, ZF, PF according to result
F6 /0 ib TEST r/m8,imm8 AND imm8 with r/m8; set SF, ZF, PF according to result
F7 /0 iw TEST r/m16,imm16 AND imm16 with r/m16; set SF, ZF, PF according to result
F7 /0 id TEST r/m32,imm32 AND imm32 with r/m32; set SF, ZF, PF according to result
84 / r TEST r/m8,r8 AND r8 with r/m8; set SF, ZF, PF according to result
85 / r TEST r/m16,r16 AND r16 with r/m16; set SF, ZF, PF according to result
85 / r TEST r/m32,r32 AND r32 with r/m32; set SF, ZF, PF according to result

Hope you are familiar with the above imm and r/m stuff.
FoolFox
11-26-2002, 01:52 PM
Hello,

thanks for the details...

the pseudo-code listing was VERY instructive.

as far as i know, imm = immediate value, r/m are
register or memory values, which could be 8, 16 or
32bits....

Ok, so what i understand right now is that my jump
could not only be triggered if the register is null (which
was also what i was thinking, tnx Dion :)) but also by
the SF and PF flag, right (i'm excluding reg =0, so ZF=0 )?
but then wich condition will make it jump ? only SF=0
&& PF=0 ??

I think i'll more visit Intel site and play a little bit with
my masm & Olly right now :)

Regards
FoolFox
JimmyClif
11-26-2002, 02:05 PM
It's a quick and safe way to see what eax is :)

test eax eax

Sets ZeroFlag if eax == 0
Sets SignFlag if eax < 0 (less than 0 - negative)

Compared to AND - test does not change the first operand.

JE also checks the ZF just as JZ.

Hope this helps.
JC
FoolFox
11-26-2002, 02:54 PM
Hello,

Thanks JC, it helped me a lot to see what was
finally an error of my part, i was focusing on this test eax,eax
missing few line after what was really important for me
at this point.. :((

But you all helped me a lot to better understand this
Test feature along with flags, i've learned some real
interesting stuff today.... glad i come to work today :)

Tnx again!

Regards
FoolFox


Softwrap - new ver. - man. unpacking?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softwrap - new ver. - man. unpacking?
PDA

View Full Version : Softwrap - new ver. - man. unpacking?

MeaCulpa
11-26-2002, 10:54 AM
Hi All,
I'm working on Softwrap v.3.5 - 3.6.1 protected targets, and need some pointers please..... (BlackBird; Eisenbeiss;)

Target: anything protected with a new softwrap.

Problem: the newer softwrap has a funtion to not allow any trial period for evaluation....you have to buy online etc. before the app unlocks...

Research: There's 2 essays out (both version 1.x related) from Blackbird and Eisenbeiss. In older versions you could deadlist to get string refs and start from there. Alternatively bpx'ing on WritePocessMemory (etc.) APIs would provide a starting point for dumping.....
NchantA also wrote an essay, does anyone have this one please?

[The file format stayed largely the same, with license file .sw; loader exe file of +- 360kb (same for all apps) and the .locked file with RSA512, destroyed import table etc..)

What if the app does not allow evaluation, there is no string/data references, nothing. It does not start the program so we cant get a starting point for unpacking/dumping....

( I am thinking along the line of altering the loader exe so that it changes the options with wich the app was packed, so that it changes from no eval/trial to allowing a trial.....just an idea
Can this still be unpacked manually.
Any help/suggestions would be welcome please.

thanks
MeaCulpa
MeaCulpa
11-26-2002, 10:59 AM
Hi All,
A possiblle target (v.3.5.0 of softwrap)
Target: something this company...
<deleted> (30 megs i think) just go one dir up from the link and get something like the chemistry module for a smaller (16meg) download. All products from this company is packed with v.3.5

Alternatively, i've already packed notepad.exe with the packed and can upload that also if needed. I've done different packing options on it - but the version is the newest available ie. v3.6.1.
Perhaps we can start on the older version....

( I have wrapped notepads with all the options, please email or PM me if you would like to get these.......)

A bit more detailed info below....please pardon the few bits that is repeated from post #1.

First of all there is about 6 protection options available when wrapping,
an application with Softwrap.

Briefly listed the allowable protection options available are:
a) date restrictions - allowing use of x number of days or up to a certain date
b) usage restrictions - allowing x number of runs
c) usage and date restrictions - combinations of above
d) no restrictions - no restrictions (may use updates etc.)
e) totally restricted - no trial period allowed

Unfortuneately the option used in the above
target (or any other programs from the above company) is protected with the
"Totally protected" option, allowing no trial period.

I was able to verify the following protection features:

1. The format/files of a packed application is still largely the same and consists of 3 files...
app.exe - loader for encrypted app.locked. Aparently this is the same loader used for all softwrapped applications. The filesize is always 368kb.

app.locked - RSA 512 encrypted, import table destroyed version of original app.exe
(previously in v.1.x called app.locked.exe)

app.sw - license file. The filesize is always 3.50kb. As far as i can see the contents
is 100% different for different wrapping options.

2. Perhaps the largest difference/update: None of the files are disassembler
friendly anymore. A messagebox says: "The PE file is not in Standard Windows Format.
All Data References will be terminated." when disassembling the loader.exe with Wdasm32.
We therefore can't directly use the CreateProcess and WriteProcessMemory APIs
from a deadlisting. (Refer to Eisenbeiss' and Blackbird's essays)
Especially when there is no trial period allowed, in which case there is no "Try me"
button - so we can't use bpx CreateProcess and hit the button, and unpack from there...

3. I assume SoftWrap still contains the old CreateFileA API method of checking sice.vxd, ntice.vxd, regmon.vxd and filemon.vxd - which can be easily verified by deadlisting a v.1.x protected application......so we'll just use FrogsIce together with InstallWatch.
Regmon and filemon keeps running during my installation. Perhaps becuase i've
renamed the installation dirs....

4. When i patch/hexedit the .sw file, the program does not complain....
When the file is deleted it says: replace the file for the process to continue
(Blackbird reports getting "Hacking attempt" messages upon tampering with the .sw
file or the registry license. Further tampering renders the software unuseable.)

5. The following file/folder registry changes are made.
(Using something like InstallWatch is more convenient in this instance than using
regmon/filemon)
C:\Program Files\SoftwrapLicense\ - folder is empty
C:\Program Files\Global.sw - created after installation
C:\FONTS\SWFont9.fnt - created after installation
C:\CONFIG\desktop.idf - created after installation

HKEY_CLASSES_ROOT\smallfont\shell\open - license added here
HKEY_LOCAL_MACHINE\SOFTWARE\Softwrap\52C48EF1C3583
516A831AE2CA6EA651E7DFE6229 - license added here

Step 1:
---------

Since there's no string/data references, and the loader.exe is wdasm32 unfriendly i really dont have a clue.
Please help.
crUsAdEr
11-26-2002, 12:39 PM
Hi,

I have looked at softwrap... the loader is protected with xlok so you will need to unpack that first... though you can try to crack teh loader in memory and then use a process patcher... unpacking xlok is a very good exercise... make a dump and study it... rebuild import table is the tricky part...

Have fun,
crUsAdEr
wbe
11-26-2002, 01:52 PM
See the attachment. All credits go to our musician friend.

After fixing it accordingly, you'll be left with a few instructions which require a little attention. Use BlackB's tut. It's almost the same for this version, just a few more places to patch ;)

Good luck
crUsAdEr
11-26-2002, 04:23 PM
Hi wbe,

You mean by inserting these import, the dump will work??? I am afraid not... also, the key here is manually :)...
wbe
11-26-2002, 07:51 PM
Hi Crus,

You mean by inserting these import, the dump will work??? I am afraid not... also, the key here is manually ...

Of course not. Those were the imports of the working dump built by our musician friend. Just to give one an idea what the final imports should be. In fact, except the Xtreamlock encrypter, there is nothing new in the current version. Once you get the dump working, it serves as a generic loader for each and every softwrapped app. All you need to do is change the name of the .exe.

I patched the final loader just the remove the limitations and the nag screen. Once the loader is decrypted, you can break on CreateProcessA (provided the trial has not expired) and dump the original exe (.locked) before ResumeThread to completely remove Softwrap without any further work, as pointed out by BlackB in his tut.

PM me if you'd like to have a look at my "refined" loader. And, again, I didn't dump it. I just polished it. It's evil eval's work. If you need the decrypted generic loader only, a search on "Softwrap" should bring you there ;)

wbe
crUsAdEr
11-26-2002, 08:19 PM
Nah, thanx wbe...

I am not interested in a cracked softwrap or any woftwrapped products... i have done the dumping xlok myself, just wanted to help MeaCulpa to do some unpacking instead of readily using a cracked version... i hope that is not what he is after.. or else he will PM you :) and this thread will be closed...

regards,
crUsAdEr
wbe
11-27-2002, 01:57 AM
Crus,

You got me wrong. My intention was not to release a cracked stuff and I have no doubt about your dumping skills either. I've read your previous posts about woftwrap. Just thought you may want to have a readily available dump to ease the process of seeing what's new with the latest one other than the crypter.

We all copy&paste sometimes, not because that we are not able to complete the missing part but just to speed it up. Don't we?

Regards
MeaCulpa
11-27-2002, 05:49 AM
Thanks for all the help so far everyone..
Yes, Crusader, you are correct...i am NOT interested in getting the
unpacked loader.exe from you (or anyone - no offence;) There is nothing to be learned by going that route...and then i would have used #crackz instead of spending my time studying - wouldn't I ?

What i am however interested in is studying the protection methods, and learning how to do this myself.....

I will study this further, try and try again, and request the valued and appreciated help from youguys when i'm stuck.

Again thaks.

Regards,
MeaCulpa

P.S. -> I got NchantA's essay on the old softwrap if anyone is interested.
Iwarez
11-27-2002, 06:27 AM
With ollydbg you don't need to unpack softwrap first. Just put a bp on writeprocessmemory and get the buffer it attempts to write. Most of the time the buffer is 400h bytes long. Olly can copy/paste a memory buffer so if you load a second instance of olly you can paste the correct code into the app. This should fix it....
budgood
12-26-2004, 07:20 PM
things have changed a little,since2002,now trying to breakpoint & this setup is looping continually back to kernal its of course a virtual breakpoint im dealing w/if i continue w/this is crash inevitable?
JMI
12-27-2004, 11:44 AM
What if you actually READ THE FAQ and follow it's directions and THEN try to ask a proper question.

Regards,
budgood
12-29-2004, 10:14 PM
sorry for asking what i thought was a legit "Q" ReTards,
__________________


logging a SI trace to a file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > logging a SI trace to a file
PDA

View Full Version : logging a SI trace to a file

JH1234
11-26-2002, 03:38 PM
Hi,

I am trying to reverse a simple hash function, it would help greatly if I could dump my backtrace to a file as unassembled instructions. Is there anyway to do this?

Thanks

JH
crUsAdEr
11-26-2002, 04:27 PM
Hi,

What do you mean unassembled??? You mean disassembled? you can try closing the code window with "wc" command in sice then press keep pressing F8 starting from beginning of hash function till the end of it... then you can close sice and open Symbol Loader, save sice log history to a text file and you will have it there :)...

cheers
crUsAdEr
Clandestiny
12-06-2002, 02:27 AM
Hiya JH1234,

Hehe, an age old question you ask, my friend... And one of the most lamentable oversights in functionality the Numega team ever made regarding our beloved degugger :D

Well you can use icedump to make a manual dump... Instructions are stored in the backtrace buffer in a 7 byte format consisting of address (4 bytes), code segment selector (2 bytes), and ring (1 byte). Use the search command to locate the buffer using the first address from your trace, multiply the total # of instructions logged by 7 bytes and that will be your dump size.

Alternately, you could try out the backtrace dumper utility Kayaker and I worked on... Its still in a beta stage and has never been publicly released, but it does work decently well in most cases. I would suggest you mail Kayaker about it as I haven't worked on it in quite some time due to some really disappointing issues with my AMD processor regarding the SI backtrace feature. I'm certain he has the most up to date copy of our code and will probably send you a copy if you ask nicely ;) LOL, no complaints if it crashes though, cause you'd be getting a beta :p

Cheers,
Clandestiny
naides
12-06-2002, 04:33 AM
I most confess that i am one of the ungrateful beta testers of the trace dump pack, and I never properly expressed my appreciation for your (Kayaker and Clandestiny) efforts.

The utility has worked seamlessly, and served me well, Lord Vather, as long as I stayed in the Win9x realm. Newer editions of Windose and Sice lack such a handy contraption.

WHY I'd like to ask?


More armadillo fun
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > More armadillo fun
PDA

View Full Version : More armadillo fun

nikolatesla20
11-27-2002, 05:20 PM
I've been going thru Crusader's tutorial, but I'm still having some problems getting all my pages loaded. Let me explain.

I downloaded the latest armadillo. Its version 2.65 now. I wrapped a generic windows program that I made in MFC with armadillo, using copymem II plus debug blocker, medium compression, simple softICE detection. I am trying to unpack it now. I am using Win2K / XP with DriverStudio 2.7.

Ok.

First I load the sucker into IDA. The armadillo "server" is actually a debugger. The debugger loop sits and watches for errors, such as page faults. Of course we will get a page fault right away when the program loads because armadillo sets up the pages to "PAGE_NO_ACCESS". We can disassemble the protected file and see what is going on.

It's easy to trace thru the code (especially with IDA) to see the check for a PAGE_FAULT. Here is a piece of it:

.text1:00447522 mov ecx, [ebp+lpDebugEvent]
.text1:00447528 mov edx, ds:lpProcessInformation
.text1:0044752E mov eax, [ecx+4] ; Check process ID is correct
.text1:00447531 cmp eax, [edx+8]
.text1:00447534 jnz loc_44869B
.text1:0044753A mov [ebp+dwContinueStatus], 80010001h
.text1:00447544 mov ecx, [ebp+lpDebugEvent]
.text1:0044754A cmp dword ptr [ecx], 1 ; Debug Event code : EXCEPTION_DEBUG_EVENT
.text1:0044754D jnz loc_447EF9
.text1:00447553 xor edx, edx
.text1:00447555 mov dl, ds:byte_463A7C
.text1:0044755B test edx, edx
.text1:0044755D jz loc_4477D5
.text1:00447563 mov eax, [ebp+lpDebugEvent]
.text1:00447569 cmp dword ptr [eax+0Ch], 80000001h ; EXCEPTION_GUARD_PAGE
.text1:00447570 jnz loc_4477D5
.text1:00447576 mov ecx, [ebp+lpDebugEvent] ; GOES HERE IF PAGE_FAULT
.text1:0044757C mov edx, [ecx+24h]
.text1:0044757F mov [ebp+ExceptionAddress], edx
.text1:00447585 mov eax, [ebp+lpDebugEvent]
.text1:0044758B mov ecx, [eax+18h]
.text1:0044758E mov [ebp+AddressAgain], ecx
.text1:00447594 mov edx, [ebp+lpDebugEvent]
.text1:0044759A xor eax, eax
.text1:0044759C cmp dword ptr [edx+20h], 0
.text1:004475A0 setz al
.text1:004475A3 mov [ebp+var_5D0], al
.text1:004475A9 mov ecx, [ebp+ExceptionAddress]
.text1:004475AF sub ecx, ds:dword_463A8C ; Subtract the image base
.text1:004475B5 shr ecx, 0Ch
.text1:004475B8 mov [ebp+SectionNumber], ecx
.text1:004475BE xor edx, edx
.text1:004475C0 mov dl, ds:byte_463A7D
.text1:004475C6 test edx, edx
.text1:004475C8 jz loc_4476EA ; This will usually jump here - think it jumps if to decrypt

So, at the end of that, we have a jump to the decypting routines.
Here's the decrypting routine:

.text1:004476EA cmp [ebp+SectionNumber], 0
.text1:004476F1 jl loc_4477D0
.text1:004476F7 mov ecx, [ebp+SectionNumber] <- Loop back to this point
.text1:004476FD cmp ecx, ds:AmountOfSections
.text1:00447703 jge loc_4477D0 ; If its above amount of sections, go to next set of checks.
.text1:00447709 mov edx, [ebp+var_564]
.text1:0044770F and edx, 0FFh
.text1:00447715 test edx, edx
.text1:00447717 jz loc_4477C6
.text1:0044771D push 0
.text1:0044771F mov esi, [ebp+SectionNumber]
.text1:00447725 shl esi, 4
.text1:00447728 mov eax, [ebp+SectionNumber]
.text1:0044772E and eax, 80000007h
.text1:00447733 jns short loc_44773A
.text1:00447735 dec eax
.text1:00447736 or eax, 0FFFFFFF8h
.text1:00447739 inc eax
.text1:0044773A
.text1:0044773A loc_44773A: ; CODE XREF: sub_44665D+10D6j
.text1:0044773A xor ecx, ecx
.text1:0044773C mov cl, byte ptr ds:unk_4631F0[eax]
.text1:00447742 mov edx, [ebp+SectionNumber]
.text1:00447748 and edx, 80000007h
.text1:0044774E jns short loc_447755
.text1:00447750 dec edx
.text1:00447751 or edx, 0FFFFFFF8h
.text1:00447754 inc edx
.text1:00447755
.text1:00447755 loc_447755: ; CODE XREF: sub_44665D+10F1j
.text1:00447755 xor eax, eax
.text1:00447757 mov al, byte ptr ds:unk_4631F1[edx]
.text1:0044775D mov edi, ds:dword_460238[ecx*4]
.text1:00447764 xor edi, ds:dword_460238[eax*4]
.text1:0044776B mov ecx, [ebp+SectionNumber]
.text1:00447771 and ecx, 80000007h
.text1:00447777 jns short loc_44777E
.text1:00447779 dec ecx
.text1:0044777A or ecx, 0FFFFFFF8h
.text1:0044777D inc ecx
.text1:0044777E
.text1:0044777E loc_44777E: ; CODE XREF: sub_44665D+111Aj
.text1:0044777E xor edx, edx
.text1:00447780 mov dl, byte ptr ds:unk_4631F2[ecx]
.text1:00447786 xor edi, ds:dword_460238[edx*4]
.text1:0044778D mov eax, [ebp+SectionNumber]
.text1:00447793 cdq
.text1:00447794 mov ecx, 1Ch
.text1:00447799 idiv ecx
.text1:0044779B mov ecx, edx
.text1:0044779D shr edi, cl
.text1:0044779F and edi, 0Fh
.text1:004477A2 add esi, edi
.text1:004477A4 mov edx, ds:dword_463A84
.text1:004477AA lea eax, [edx+esi*4]
.text1:004477AD push eax
.text1:004477AE mov ecx, [ebp+SectionNumber]
.text1:004477B4 push ecx
.text1:004477B5 call sub_44870A ; Call ArmaCryptDecrypt
.text1:004477BA add esp, 0Ch
.text1:004477BD and eax, 0FFh <--- I inserted my code starting here
.text1:004477C2 test eax, eax
.text1:004477C4 jz short loc_4477D0 ; Want to loop here to decrypt all sections (increment section count first)

Yep, same as Crusader has pointed out before. No big deal here. We just change the JGE at 00447703 to an infinite loop, then we clear [ebp+SectionNumber] to zero, and we set AmountOfSections to a nice big number (like 1000h), and finally we edit the code to increment the SectionNumber and loop to 004476F7. I added this code at location 004477BD, right AFTER the "add esp, 0Ch" code. Maybe this was not good. Crusader's tute said to put it right at that point. Maybe this is what is causing my problem?

Anyway, the last piece of code to patch in memory: This is the actual decrypt routine that gets called. we want to always decrypt.

.text1:0044889A
.text1:0044889A loc_44889A: ; CODE XREF: sub_44870A+297j
.text1:0044889A mov edx, ds:dword_463A98
.text1:004488A0 cmp edx, ds:dword_46067C
.text1:004488A6 jle loc_4489A6 ; patch this right here
.text1:004488AC mov eax, ds:dword_463A98
.text1:004488B1 sub eax, 1
.text1:004488B4 mov ds:dword_463A98, eax

So we patch that jump at 004488A6 so it always jumps, just like the tutorial.

The final result I get if I look at the process in S.I. is weird. Not only did I not get all of the sections (I'm only missing a couple), but in most places, only ever - other - section is actually decoded. I mean the section is present and readable, but it's filled with zeros. So that's the main problem I'm having. I still cant dump it yet with LordPE because apparently a couple of pages are still missing.

By the way, yes I am trying to learn how to do this manually, so if you do have an unpacker, feel free to mention it, but dont beat me in the head with it! :)

You can get the protected file I made from here:

http://webpages.charter.net/nikolatesla20/testmenu.zip

To try it out yourself.

If you want a real life challenge that uses Armadillo, you can try out Beam Screensaver, which got me into this.

http://beamscreensaver.com

Anyway, it's weird, I think I just got my program to dump now, but I'm still not sure why - sometimes it seems to work better than others :) But I still haven't been able to get the screensaver dumped yet.

Thanks for the tute Crusader!

-nt20
_Servil_
11-27-2002, 06:25 PM
hello,

got just a similar problem doing on the getright beta, also following crUsAdEr's step-by-step workaround, but found something fishy in 'decrypted' code section right when I was going to patch the breakpoints, noticed not at all the locations, referred by the i3 places table were breakpoints found (instead it some code, seeming make sense hwoever).

tried several changes -
-- changing the ArmaCryptDecrypt call directly to it's subsequent call to decrypt since there's a conditional jump that could possibly skip the main part (?)
-- making the loop infinite till crush (dump before confirming crash messagebox)
-- armkiller latest build
-- loop around 'ArmaCryptDecrypt' call located further in the exception_handler

the dump never matched all breakpoint places, since this is good indicator of fully decrypted section. given up at this point since i have no further idea.
crUsAdEr
11-27-2002, 10:10 PM
Hi Nikola,

I have dumped both your menu test and the screen saver with no problem... which makes me wonder what is wrong? A few ppl already complain that they cant get things right...

What OS are you guys running? I doubt this is the problem but who knows... mine is win2k SP3...

The only reason i can think of is when you patch at offset 4477BD like this
inc dword ptr [ebp+section_number]
jmp up_to_loop

you reset the section number to zero before excuting the code above, so when you loop start, it will start with 1 instead and you fail to decrypt first block!!!! You have to reset section_number to 0 after the increment...

To see if each section are decrypted correctly, try tracing over the final call at 4477B5, try with the first few value of ecx, see if you trace over the call, if eax==1 then decryption is OK... if not then somethign is wrong...

That is all i can think of now...

Servil :
If you look at my Fix_Dump source code to fix int3, you will realise that not all address in the Table are inserted with and int3... so that is not a good indicator if your dump is not OK.

cheers
crUsAdEr
crUsAdEr
11-27-2002, 10:23 PM
Found your bug Nikola,

You patch the AMountOfSection to 1000 which is wrong, yo should not do that... because that is the limit for your decryption loop... in my tutorial when i said patch the Max number of decrypted block, i mean patch the value at dword_46067C which is referred to at instruction "text1:004488A0" of your code snippet instead of patching the jle... this is when armadillo check if max number of decrypted block allowed, which is half of total number of blocks...

So try that, hopefully it should work now...

Cheers
crUsAdEr
nikolatesla20
11-27-2002, 10:57 PM
Thankx for looking at it crusader, HAH ya I didnt even think to look to make sure I clear to zero after I execute my newly inserted instruction.

HMM. I will keep looking. Just for a little nugget - does the screensaver contain the Int3's?

At work I am running Win2K SP3 , at home XP pro SP1.

-nt20
nikolatesla20
11-27-2002, 11:23 PM
Ok thank you crusader, I got the screensaver dumped now. Just have to start building it IAT table. (didnt go thru that whole part yet).

As a side note, as usual the registration check is even simpler now that it relies on ArmAccess.dll

-nt20
crUsAdEr
11-27-2002, 11:37 PM
Cool Nikola :>

I did not check if it has int3 features so i am not sure abt that.. now you have a good dump then you can check it out yourself :)... after rebuilding IAT could you help me test the armadillo plug in i posted in TOT forum? in WIn XP esp. see if it works.. i really want to learn how to code OS-independent code but very few ppl replied whether the plug in works :<... h well, if u have the time....

Cheers
crUsAdEr
nikolatesla20
11-28-2002, 05:13 AM
Thanks again for the help, Crusader.

After I got the screensaver dumped correctly, I rebuilt the IAT using ImportREC (even though I prefer Revirgin). Revirgin , even when I would enter the IAT start address, just wouldn't even start to resolve.

I used ImportREC with your plugin and it worked great. Here was my own method for resolving the IAT:

I first disassemble the dumped file after correcting the OEP, the symbol table pointer bad values, and the code and data start values. This gives me a disassembly to find a CALL DWORD PTR [xxxxxxxx] call, which would be an API.

Then I started the packed file, thinking that even though armadillo does copymem, the original IAT HAS to be present for the program to run at all. I mean at least the addresses have to be in memory and available. So in SI I got the the [xxxxxxxx] address and sure enough there are the values. Scroll up and down to get the start and length values.

Put these into ImportREC and press "Get Imports". You get a few invalids. Use your plugin on them, and wallah, perfection.

I've now removed the further flaws such as time checks, and its running great - WinXP Pro SP1.

Thanks for the help on *rmadillo, in my opinion this program is harder in some ways then *SProtect. But easier in the fact that you can disassemble a file protected with it to see how the protection works!

-nt20
crUsAdEr
11-28-2002, 08:22 AM
Hi Nikola,

Yep, thanx for the replay.. here is how i do it normally... start with bpx SetProcessWorkingSetSize then find call edi, note down value of edi (OEP), then immediately bpx WriteProcessMemory and do the decrypt until infinite loop... there i make a full dump, fire up Imprec and enter the OEP, Imprec will automatically search for IAT for you without fail, then "Get Import", then SHowInvalid... it works because after you force armadillo to fully decrypt your file, and suspend then... Imprec will be able to run through the whole program code and find IAT for you...

Just a final thought,
Cheers
crUsAdEr
nikolatesla20
11-28-2002, 01:02 PM
Yes, very good method, which I was going to use except for 2 small things:

1. Once the hacked armadillo process locks up, it literally eats my CPU. I have to get into task manager and right click on it and lower its priority. It does this on both Win2K and XP. So, it takes a little while to do this because the thread seems to just eat cycles, even though it's default priority. It does this with any armadillo program I've forced a decrypt on. The dump works fine tho.

2. I had already dumped the SS, and forgot about trying to resolve. Otherwise, yes, the best time is to do it while the process is suspended. But my computer was actually blue screening (XP yikes!) for some reason and I wanted to minimize the damage, so I shyed away from hacking the process again. Incidentally, I don't like how SoftICE changes your file itself when you change opcodes. I have to keep a backup of the file for each time after testing the forced decrypt, if it didn't work.

Anyway, it's good to know that there is another way to resolve the IAT just using the normal protected program as well. ImpREC works for that but Revirgin doesn't . Revirgin should work on a suspended process, however.

-nt20
Mega Desperate
11-30-2002, 02:36 AM
Originally posted by crUsAdEr
Hi Nikola,

Yep, thanx for the replay.. here is how i do it normally... start with bpx SetProcessWorkingSetSize then find call edi, note down value of edi (OEP), then immediately bpx WriteProcessMemory and do the decrypt until infinite loop... there i make a full dump, fire up Imprec and enter the OEP, Imprec will automatically search for IAT for you without fail, then "Get Import", then SHowInvalid... it works because after you force armadillo to fully decrypt your file, and suspend then... Imprec will be able to run through the whole program code and find IAT for you...

Just a final thought,
Cheers
crUsAdEr

Hi..!! =-P ... i have dump file.. but i not understand.. why ImpRC & Revirgin they say to me ..that the IAT is all correct.. =-|..

I dump correctly?¡ .. i did this.

Put bpx setprocessworkingsetsize ... go to CALL EDI ..now bpx writeprocessmemory .. i push F12 two times .. i now here:

005DF9DC 83 C4 0C add esp, 0Ch <== I LAND HERE!
005DF9DF 25 FF 00 00 00 and eax, 0FFh <--edit here
005DF9E4 85 C0 test eax, eax
005DF9E6 74 0A jz short bad_jump

push F10 ...

now put

a eip
inc dword ptr [ebp+FFFFFA18]
jmp 5DF92D

005DF92D 8B 8D 2C FA FF FF mov ecx, [ebp+FFFFFA18]
005DF933 3B 0D 84 9A 45 00 cmp ecx, ds:text_section_size
005DF939 0F 8D C7 00 00 00 jge continue_1

5DF939 <-- here put "JMP EIP"

now go to LordPE ... and dump full ...

it's correct my dump? ... and If I am in the correct thing .. Please!! ...say to me since I reconstruct the IAT?¡ -.. .:confused: :confused:

I read other topic ...

"..I used ImportREC with your plugin and it worked great.."

u can to provide this plugin?¡ ---

thank u =-D
r4g3
11-30-2002, 02:27 PM
"Mega Desperate" ? ... doesn`t that leed to a suicide, sooner or later ?
nikolatesla20
11-30-2002, 06:26 PM
MegaDesperate,

Make sure you select the correct process when you try to rebuild the imports. YES the dumped file will have a good IAT , but it is NOT THE RIGHT ONE. It's an IAT put there by Armadillo.

For the plugin, search the unpacking forum (search button) for "armadillo plugin" and you will find the thread with the link.

BTW I still get small crashes every so often with the screensaver, I used SI and found it was a crash in opengl, in the texture coords calls. The screensaver does not use the int 3 trick ( I bpint 3 and it never comes up), but I clearly get a bad pointer now and then. Could just be a program bug, but I haven't investigated further. I think I'm done with this for now.

-nt20


Dogbert's Genuine Patching Engine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Dogbert's Genuine Patching Engine
PDA

View Full Version : Dogbert's Genuine Patching Engine

Dogbert
11-28-2002, 10:09 AM
Hi !

After quite some time I've released a new version of ScAEvoLa's Patching Engine which is now named "Dogbert's Genuine Patching Engine". I've implemented a bunch of nice additions and fixed a few bugs.
Btw, it would be nice if Kaparo would replace the old version with this one on protools.

I hope you like it.

Dogbert

------
"Today I started to hate people in advance."


Reversing our own tool: HexWorkShop
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Reversing our own tool: HexWorkShop
PDA

View Full Version : Reversing our own tool: HexWorkShop

ZaiRoN
11-28-2002, 03:25 PM
Hi All!

What do you thing about an 'adding funcionality project'?
HexWorkShop is a nice hex editor with many features but not totally oriented to RE. With this project, we will try to make this target a little more RE like :). I have in mind two different project but for now we will work on the first one.

Our mission is to modify the 'Goto' dialog box.
I don't know if you use this tool but -like many others- after you have opened a file, you can jump from a byte to another using a simple dialog box named 'Goto' (Ctrl-G to access the dialog). I often use this feature to locate the byte(s) to patch but the problem is that you have to provide the offset you want to reach. exempli causa: if you have to patch the byte at VA=403020 you have to find the offset relative to that VA and then insert it; this is very nasty because you have to use an FLC or a disassembler to discover the offset.
What I want to do is to modify the dialog and let it accept also Virtual Address value. Basically, the only thing we have to do is to perform the conversion from Virtual Address to Offset and then call the usual goto_function.

I think we can split this project in various tasks:
1. Find the WndProc relative to the dialog 'Goto' and try to understand how the program handles various messages received by the dialog
2. Figure out how to do the conversion from Virtual Address to Offset
3. Add the new choice_button to the dialog
4. Add the new code

OK, I think it's time to begin with the first task!

To retrieve the WndProc you might work in two different ways.
To perfom the jump, the program reads the value you put in the edit box, so breaking on something like GetDlgItemText function could show you the way.
Another way might be to use the WinHelp function (is called when you click on the 'Help' button); I often use this function when it's possible because I think it's an easy way to find the WndProc(and maybe because I readed it on an old Neural Noise's great tutorial ;))

Please, let me know what do you think about the project and/or if you want to change something.

regards,
ZaiRoN
lamer__
11-28-2002, 05:19 PM
somehow hw doesnt work correctly for me...it doesnt save...
r4g3
11-28-2002, 07:02 PM
2. Figure out how to do the conversion from Virtual Address to Offset

uhm are you going to read the PE header for that ? (is there any other way ?) that would make a hell lot of asm coding...
nikolatesla20
11-28-2002, 08:11 PM
Hmm. Pretty cool idea.

Yes, you would have to read in the PE header to do this, but that isn't really all that hard. You can quickly verify it's a PE with a few simple functions. Plus you should be able to just tack this code on the end of Hex Workshop in a new section.

Come to think of it, this would be a pretty nice feature. I get sick of having to use a seperate program for File locations...

Only thing is, I use old Hex Workshop, not the new ones. So even if I did it , it wouldn't be compatible with others :)

HINT on finding the WinProc: Usually I just start the program up and then use my Visual C++ tools (Spy++) and drop the crosshair on the window and click OK. It will then tell you the address of the WndProc. :) Simple as that.

-nt20
ZaiRoN
11-28-2002, 08:26 PM
Hi r4g3/nikola,

uhm are you going to read the PE header for that ?Yes, it should be necessary.

Yes, you would have to read in the PE header to do this, but that isn't really all that hard.These are the ideas I had to solve this problem:
- you can retrieve the informations you need when the file is loaded
- the file loaded is mapped somewhere in memory and you can retrieve informations from there

This 2° task could be done in many ways, and like nikola said: 'Come to think of it' and to decide which is the best!

>I use old Hex Workshop
Download my version :p

Let me know ;)

regards,
ZaiRoN
Kayaker
11-29-2002, 03:26 AM
Excellent idea Zairon. I always grumble at having to disassemble a file with WDasm or whatever just to get a hex offset to use with the Hexworks GoTo feature. The resource dialog for GoTo looks accessible in a resource editor, so it should be easy to resize it and add another edit box and button or something. The file you open is already mapped into memory by HW itself and if you break on MapViewOfFile you can find a few places where you could put in a small patch to transfer the returned starting address of the mapped view into your own variable.

You could type in your VA, convert it to an offset and then programmatically transfer the result into the original HW offset edit control and it's ready to go. Here's a snippet I use in code for VA to Offset conversion, maybe it can help. If you were reading the VA from your own edit control you could probably convert it to a dword value with GetDlgItemInt, then you just pass it to this proc.

pPE_MapView DWORD ? ; starting address of the mapped view
Address DWORD ? ; VA Address

invoke VAToOffset, Address

;===============VAToOffset proc=====================
VAToOffset PROC uses edi esi edx ecx VA:DWORD

mov esi, pPE_MapView

assume esi:ptr IMAGE_DOS_HEADER ; MZ
add esi, [esi].e_lfanew ; MZ + 3Ch
assume esi:ptr IMAGE_NT_HEADERS ; PE
mov edi, VA ; edi == Linear Virtual Address
sub edi, [esi].OptionalHeader.ImageBase ; Linear VA - ImageBase = RVA

;--------------------------------
; If address selected is outside of program code,
; RVA will be < 0 or greater than Image Size

mov eax, [esi].OptionalHeader.SizeOfImage ; SizeOfImage
.if edi < 0 || edi > eax
ERROR MESSAGE
mov eax, 0
ret
.endif

;-------------------------------

mov edx, esi
add edx, sizeof IMAGE_NT_HEADERS ; PE + F8 = Start of SectionHeaders
mov cx, [esi].FileHeader.NumberOfSections ; NumberOfSections counter in ECX
movzx ecx, cx

assume edx:ptr IMAGE_SECTION_HEADER
.WHILE ecx>0 ; check all sections

.if edi>=[edx].VirtualAddress
mov eax,[edx].VirtualAddress
add eax,[edx].SizeOfRawData

.if edi<eax ; address is in this section
mov eax,[edx].VirtualAddress
sub edi,eax
; edi == difference between specified RVA and section's RVA
mov eax,[edx].PointerToRawData
add eax,edi ; eax == FILE OFFSET
ret
.endif
.endif

add edx,sizeof IMAGE_SECTION_HEADER ; go to next section
dec ecx

.ENDW

assume edx:nothing
assume esi:nothing

VAToOffset endp
;===============End VAToOffset proc=================

COMMENT %
IMAGE_FILE_HEADER STRUCT
Machine WORD ?
NumberOfSections WORD ?
TimeDateStamp DWORD ?
PointerToSymbolTable DWORD ?
NumberOfSymbols DWORD ?
SizeOfOptionalHeader WORD ?
Characteristics WORD ?
IMAGE_FILE_HEADER ENDS

IMAGE_NT_HEADERS STRUCT
Signature DWORD ?
FileHeader IMAGE_FILE_HEADER <>
OptionalHeader IMAGE_OPTIONAL_HEADER32 <>
IMAGE_NT_HEADERS ENDS

IMAGE_SECTION_HEADER STRUCT PE + F8 = Start of SectionHeaders
Name1 db IMAGE_SIZEOF_SHORT_NAME dup(?)
union Misc
PhysicalAddress dd ?
VirtualSize dd ?
ends
VirtualAddress dd ?
SizeOfRawData dd ?
PointerToRawData dd ?
PointerToRelocations dd ?
PointerToLinenumbers dd ?
NumberOfRelocations dw ?
NumberOfLinenumbers dw ?
Characteristics dd ?
IMAGE_SECTION_HEADER ENDS
%

Waiting for the fun to begin...:)

Kayaker
ZaiRoN
11-29-2002, 06:59 PM
Hi friends!
There is sufficiently enthusiasm to make a very good work :-) thx Kayaker for the snippet!

Today I worked a little on the program.
The program is not packed and is written with visual c++ (and use mfc; gr...!) so I suggest you to use IDA to study the program.

task 1:
I tried to understand where the WndProc is located and how messages are handled. I have to admit that I am not totally confident with mfc and -please- correct me if I made something wrong or if there's an easy way to solve the problem.
With mfc based programs, I usually use the AfxFindMessageEntry function to retrieve where messages are checked. Use IDA search function to locate this function.
Every message received in this function has this structure:

struct AFX_MSGMAP_ENTRY
{
UINT nMessage; // windows message
UINT nCode; // control code (or WM_NOTIFY code)
UINT nID; // control ID (or 0 for windows messages)
UINT nLastID; // used for entries specifying a range of control id's
UINT nSig; // signature type (action) or pointer to message #
AFX_PMSG pfn; // routine to call (or special value)
};

The most important value is the last, pfn. This is the address of the routine that manage this particular message.
In every mfc based program, AfxFindMessageEntry has the same scheme.
:004945D1 push ebp
:004945D2 mov ebp, esp
:004945D4 push ebx
:004945D5 mov ebx, [ebp+arg_0] ; ebx points to our AFX_MSGMAP_ENTRY
:004945D8 mov eax, [ebp+arg_4] ; windows message received by the dialog
:004945DB mov edx, [ebp+arg_8] ; control code
:004945DE mov ecx, [ebp+arg_C] ; control ID
:004945E1 cmp dword ptr [ebx+10h], 0 ; this is the first instruction of the *while*
; that looks in the message_map for our message
:004945E5 jz short loc_494604 ; no message is founded
:004945E7 cmp eax, [ebx] ; ebx points to our AFX_MSGMAP_ENTRY structure
:004945E9 jz short loc_4945F0 ; jump if the message is founded
:004945EB add ebx, 18h ; moves to the next message in the messagemap
:004945EE jmp short loc_4945E1
:004945F0 cmp edx, [ebx+4]
:004945F3 jnz short loc_4945EB
:004945F5 cmp ecx, [ebx+8]
:004945F8 jb short loc_4945EB
:004945FA cmp ecx, [ebx+0Ch]
:004945FD ja short loc_4945EB
:004945FF mov [ebp+arg_0], ebx ; save the AFX_MSGMAP_ENTRY relative to the message received
:00494602 jmp short loc_494609
:00494604 xor eax, eax
:00494606 mov [ebp+arg_0], eax
:00494609 mov eax, [ebp+arg_0]
:0049460C pop ebx
:0049460D pop ebp
:0049460E retn 10h
Obviously, this function is called many times so a conditional breakpoint is needed ;-)
Following this scheme, I have found where Go_button_message is handled; take a look at the 'pfn' parameter in the structure pointed by ebx @4945FF.

Now that we know this information, - theoretically - we can read (if is present!) the VA from the new edit box, convert it and then pass it to offset to the offset edit box

ZaiRoN
Kayaker
11-30-2002, 01:42 PM
That's really good information you gave there Zairon. It makes getting a handle (sorry) on the MFC message handling routines a lot easier. Definitely clarifies what at first appears to be a mess. I'll outline a bit of what I did if it might help as a guide for anyone considering trying this.

I decided to sacrifice the Help button as a Convert button (who the hell needs a help button on the Goto dialog anyway?) This way the original Go button function is untouched.

What I did first was to get the CtrlID of the Help button (047E) from WDasm and set a conditional breakpoint with it on the last cmp before the AFX_MSGMAP_ENTRY is saved. When the help button is clicked it will break there after all the checks are done and the code is about to go to the specific Help routine.
:004945DE mov ecx, [ebp+arg_C] ; control ID
...
:004945FA cmp ecx, [ebx+0Ch]

BPX 4945FA if (EBX->0C) == 47E

A little tracing and you find the Help routine here:

:00412674 mov eax, 004B4347
:00412679 call 00446BF0 ; Set up SEH
:0041267E
...
buncha gargage
...
:004126D4 Call WinHelpA
:004126DA jmp 0041270D ; Restore SEH

I decided to leave the existing SEH handler in place and create the main patch jump at 0041267E, and return to 0041270D which would exit gracefully.

Once again I decided to use Snippet Creator, and is really the best way considering how much code the entire patch took. To start with though, the first thing you need is the return value from MapViewOfFile that Hexworks uses to map the target file into memory. Setting a bp on that API you find it's called 3 times, the 3rd one being the charm.

:00410FC3 Call MapViewOfFile ; return value is the starting address of the mapped view
:00410FC9 cmp eax, edi
:00410FCB mov dword ptr [esi+10], eax
:00410FCE je 00410FDF
:00410FD0 push edi

I decided to create the first patch at 00410FCE, all you're simply doing is saving the value in eax to your own variable. What I found was the easiest was to do this patch *first* and note the ABSOLUTE value of the address it's saved to. Then in the 2nd patch with the main VA to Offset conversion you access the absolute address directly. You do this first patch on the *original* HW file, then use this patched version as the file for the *2nd* patch. By doing this patch first you don't disturb the absolute address of your saved variable and you can make all the changes you want in your main patch without losing the reference.

Here's how I set up the first patch in Snippet Creator:
Choose 'Patch as New Section'
Choose 'Redirect Control From Code Section' and use VA 410FCE
Choose 'Return To Program' and use VA 410FD0
Choose 'Restore Overwritten Instruction'

The patch itself is simply:

-----------------
dummyvariable DWORD ? ; starting address of the mapped view

.code
mov dummyvariable, eax
------------------

Now, you will need to trace into this patch and note down the Absolute address the mapped view is stored in by Snippet Creator, for me it was 520020h. Now you can create the 2nd patch using this address as the start of the MZ header for your conversion routine.

As mentioned above I chose 0041267E as a redirect address and 0041270D as the return VA for the 2nd patch, but I chose not to restore the overwritten instructions since they were all within the useless Help file routine anyway.

I won't spoil it by posting all my code but I will mention a few things. If you haven't used Snippet Creator before, you write your patch with all the normal Masm (or Tasm) syntax, plus includes and proc declarations. However, instead of using the .data and .data? directives it's best to simply list all your data variables at the start of the patch and jump over them to the beginning of the code section. If you do use the directives, SC will assemble and patch the file OK, but the data variables will be compiled in a section that isn't mapped into virtual memory. I found this out by crashing and checking with a PE editor that something doesn't work quite right if you do this.

So instead just do something like:

Includes and Proc declarations
jmp @F
...
Data variables
...
@@:
.code

You may not need the .code declaration but I found it was necessary if you use any ASSUME directives.

OK, one more thing. How to find the hWnd of the Edit control and main dialog box?

Hints:

GetMessagePos function returns a long value that gives the cursor position in screen coordinates. This position is the point occupied by the cursor when the last message retrieved by the GetMessage function occurred.
i.e. when you click the mouse on the Help button (could also use GetCursorPos)

WindowFromPoint function retrieves the handle of the window that contains the specified point.

GetParent function retrieves the handle of the specified child window's parent window.

Between this and the CtrlIDs you've got all you need to access the edit control or anything else in Hexworks.

Cheers,
Kayaker
ZaiRoN
12-01-2002, 03:27 PM
I'm back.

Hi Kayaker,
very nice work!

I have finished the project in a little bit different way from you.

I'm testing this new version at the moment but maybe you are interested in how I solved the problem.
The guidelines that Kayaker gave us is fine and the use of CodeSnippetCreator is perfect.

First of all, I haven't sacrificed the *poor* Help button :-).
I added a new label "Virtual Address:" and, of course, a new edit box for the virtual address. I have used resource hacker for doing the job.

Like you said, 'the first thing you need is the return value from MapViewOfFile that Hexworks uses to map the target file into memory'. I have also perform a check to see if the file loaded has a valid PE format. This, mainly because if the file has not a PE format I will disable the VirtualAddress's edit box. The check is very simple and is based on the keyword "MZ" and "PE". Obviously, this feature is not necessary but...hey, It's a funny game :-)

After that, I have had to add the code for the conversion. I added the new code directly in the beginning of the Goto routine . In particular, I maked a jump to my code at 4940FA. The new code perform these operations
- retrieve the handle of the VA editbox and get the VA value
- the VA value is converted in offset using your procedure
- retrieve the handle of the Offset editbox and put the new offset inside
- return to the original code that perform the jump to the new byte

How have I found the various handle?
Forced by your solution, you have used the correct and general way to find the handles; instead of, I have used a more practical method studying the original Goto routine. Infact, the program reads the offset using GetDlgItemText function in this way:

:00494118 push eax ; lpString
:00494119 push dword ptr [esi+1Ch] ; hWnd
:0049411C call ds:GetWindowTextA

'dword ptr [esi+1Ch]' is the handle of the dialog we were looking for :)
Then, I used GetDlgItem function to retrieve control's handles.
That's all.

Here's how I set up the first patch in Snippet Creator:
Choose 'Restore Overwritten Instruction'
hmmm, correct me if I'm wrong but in this way you save the mapped address only for the first file loaded !?!

You may not need the .code declaration but I found it was necessary if you use any ASSUME directives.
eheh, weird thing! In my code I use ASSUME directives without .code declaration. The .code keyword is putted in the file .asm by CodeSnippetCreator (look at the asm file that he generates) so why you need to redefine it ?

Like Kayaker said, pushed by the enthusiasm, maybe we have gone too fast; this is not a tutorial and many parts have not been explained so if you have any questions don't hesitate to ask! The project is definitely not very easy, and involved many fundamental concepts and things that you will use many times.

Well, now it's really all.

cheers,
ZaiRoN

ps. Is someone interested in a 'Reversing our own tool: HexWorkShop v3.11' part #2 ? :D
ZaiRoN
12-02-2002, 05:35 PM
Hi Kayaker,

I'm trying to make hws work with several open files and seems to be a hell; this characteristic it is not really necessary and the old one was working correctly but this would make the project much interesting and complete.
Have you tried?

I found that the program save a sort of structure for each of the opened files where it puts all the necessary informations. Unfortunately I can't say which are exactly these informations but I am almost sure that there is the address where the file is mapped (bpx on UnMapViewOfFile and close a file; you'll see how the program retrieves the right map address).
This information is very useful because we could avoid the first patch and to work directly with the structure memorize and the handle of the active MDI child (wm_mdigetactive to retrieve the handle of the active MDI child).

Unfortunately, I have some problem to find how/where the program save this data(s); any hint ? :-)

ZaiRoN
Kayaker
12-03-2002, 05:48 AM
You may be onto something there Zairon. It appears that when HW opens a second and subsequent file it unmaps the current one after copying the mapped view into another allocated memory location. This is actually quite wise, it keeps a local copy for itself while freeing up any memory Windows may want to use to map files. I thought it might be using a linked list of sorts to keep track of its local copies of mapped files, but I can't find a 'linked' list per se. Maybe it's just using a table reference somewhere.

There IS evidence of how it stores the important pointers. I opened several files and took note of the value of ESI and what values were added to that area after the files were mapped i.e:

:00410FC3 Call MapViewOfFile
:00410FC9 cmp eax, edi
:00410FCB mov dword ptr [esi+10], eax ; store starting address of the mapped view
...
:00410FD4 Call GetFilesize
:00410FDA mov dword ptr [esi+1C], eax ; store file size

Now, after opening several files I did a search for each of the values of ESI (which are just random stack values). I was looking for evidence of a linked list, i.e. a small array which might keep a few important values such as the mapped address and file name or size, *PLUS* an offset to another small array which tracked a different file, etc. Well I found each of the small arrays but didn't see evidence of linking between them. There might another linked list or maybe simply a table somewhere to each of the small arrays, but I haven't found it.

If you want to check out what I mean, break on MapViewOfFile and note the value of ESI and the API return value and the file size for 3 or 4 files. Then do a hex search in memory for each of the ESI values in turn. When you find it in stack memory, scroll the data window up a line or two and you should also see the corresponding file size and the address of the new LOCAL copy of the mapped file which was copied to a lower memory region before being unmapped to make way for the current file. Only the last file opened will be in high memory.

If HW indeed does unmap files as new ones are opened then you are quite right that this is the proper way to go, else we can never be sure the mapped address saved in the first patch will be correct after a while. If you're only opening one file it doesn't matter, but there's no guarantee a second file opening won't overwrite part of the first mapped region.

btw, you were right about not needing the .code directive, it just seemed to solve a problem at the time but obviously isn't required, and you were also right about setting the restore overwritten instruction option makes the patch only valid for one file. Hopefully your new approach will solve that ;-)

Kayaker
Zero
12-03-2002, 06:54 AM
Reversing our own tool: HWS v3.11
This remembers me that HWS 4.0 should be released this december.

Zero
nikolatesla20
12-03-2002, 05:25 PM
If HW uses MFC, it no doubt might use the document/view architecture for its MDI handling.

If so, the "document" is independent of the "view" , or window. It gets really messy and that might be why its hard to really track down how the current file mapping is stored, but it would definitely be in a collection of instances somewhere. (you have an array of pointers to objects, and then the mapping variable is an offset into that object)

-nt20
ZaiRoN
12-06-2002, 06:11 PM
Hi All.

(maybe) I have found a way to solve the problem and I need your help...

At first, following the right suggestion made by nikola, I studied how mdi childs were opened and how/where important values were stored; useless say that I lost my self in the jungle of the program's instructions (if you want to try, 'bpx createwindowex' or catch wm_mdicreate message) So, I took another way: the Goto procedure. Yes, her! The fact is that inside this function, the program has to know all the informations about the file that has the current focus; this is the reason why I started from here.

All the work starts from 4940FA. The most important value you have to take care is stored in esi; in fact, if you look at the code of this routine you will find many values referenced by [esi+xx]. esi is the address of a big table (or a structure if you prefer) that contains many (and mostly unknown) values. I will call Table1 this structure.

[Table1+6Ch] points to Table2
[Table2+3Ch] points to Table3
[Table3+6Ch] points to the address where the file is mapped from.

From what I have seen, Table3 seems have many values related to the current file, and I think is the place where the program stores informations of it; unfortunately, I'm not able to give a specific meaning to the tables.

All the work is done from sice using the search function to locate the various bytes in memory and ... of course: guessing! This is the reason why I need your help. Are you able to locate the right address with this method? If so, we can finally complete this project, otherwise...gr!

ZaiRoN
mike
01-07-2003, 02:48 AM
If only they had used eclipse--then this job would have been trivial.

www.eclipse.org
[yAtEs]
02-10-2003, 10:57 AM
check out version 4s structure system,
http://www.hexworkshop.com/images/structure_viewer.gif
super :-p

yates.
ZaiRoN
02-10-2003, 01:22 PM
Hi [yAtEs],
I have not tryed yet this new release but this feature seems to be quite interesting.
I have written a structure to recognize PE file.
Tell me if is there something wrong in it :-)

ZaiRoN
Kayaker
02-10-2003, 02:35 PM
That is a pretty cool feature indeed ;) I tried your PE structure plugin ZaiRoN and it seems to work quite well. One thing I can't quite figure out though is why the Value field of the Structure Viewer defaults to decimal or how to change it to hex. There must be a way to define a DWORD variable as hex?

Actually, your plugin and others would be a great teaching aid to understanding the structure of the PE file. Besides being useful as sort of a visual aid, pointing out where these structures reside and what they actually look like in a hex editor, the knowledge might help wean some people from relying on automagic PE fixer-upper tools so much...

Kayaker
ZaiRoN
02-20-2003, 06:16 PM
Hi all,

I have finally solved the old problem, the new version of HWS (I have used v4.00, you can do the same thing with the old version) works with an arbitrary number of opened files. I am still testing and optimizing this new feature but everything seems to be ok.
I was thinking to write a tutorial when I will be sure that everything works fine; I am very busy in these days and it will take me many days. In the meanwhile, I will give you a little description of my new approach.

I have to admit that due to the nature of the program and the incapacity of mine, I have used a non-elegant way to solve the problem.
The idea behind my new approach is related with the handle of the various MDI child windows opened.
For each file opened, I save a simple structure containing the handle of the MDI child window (the window that shows the file's bytes) and some values necessary for the conversion from VA to Offset. In this way we don't need anymore to know where the file is mapped to the memory.
I will use this data when the user decides to jump in VA.
How the program can recognize which is the right structure to be used? I mean, the jump option is for the current focused file so we need to find the right structure of this file. This is done recognizing the focused MDI child window (which is the window where the jump will be performed). In particular, retrieving the handle of the window; to retrieve this handle, you only need to send a WM_MDIGETACTIVE message. I use this handle like a key in a database that is used to retrieve data; in this case, the data represents the values used to perform the conversion from VA to Offset.

The idea is simple and also the new code is very simple. I will not give you any snippet for the moment because, as I said before, my snippet(s) are not definitive.
Btw, I am here for any suggestions, comments and/or something else ;-)

ZaiRoN
ZaiRoN
06-02-2003, 03:31 PM
Hi All,
after some months, I have finally found the time to write the tutorial. You can find it at:
http://66.98.132.48/fravia/Zai_HwsRev_eng.htm
If you want, you can post your comments/critiques/improvements/etc here.

Regards,
ZaiRoN
LOUZEW
12-05-2004, 03:08 PM
Hi, Zairon
i'm certainly a bit late to work on this app but after reading your tut, i find it so great ! and i want to RE this app too, like a new challenge for me.
Your tut is quite interesting, i'm working on 4.2 version of HWS.

In your tut you tell us to include a "HWS4.INC" file in the project, can you please, tell me where i can find this Inc file ? ?

Thank's
ZaiRoN
12-05-2004, 05:16 PM
Hi.
It is not never too much late :-)

HWS4.INC:

HANDLE TYPEDEF DWORD
NULL equ 0
WM_SETTEXT equ 0Ch
WM_MDIGETACTIVE equ 229h

;---------------------------------------------
BM_SETCHECK equ 0F1h
BST_CHECKED equ 1

;---------------------------------------------
wsprintfA PROTO C :DWORD,:VARARG
wsprintf equ <wsprintfA>

;---------------------------------------------
INFOFILE STRUCT
handleMDI DWORD ?
imageBase DWORD ?
nSections WORD ?
INFOFILE ENDS

SECTIONVALUES STRUCT
virtualOffset DWORD ?
rawOffset DWORD ?
pointerToRawData DWORD ?
SECTIONVALUES ENDS

;------------------------------------------------------------------
IMAGE_NUMBEROF_DIRECTORY_ENTRIES equ 16
IMAGE_SIZEOF_SHORT_NAME equ 8
IMAGE_DOS_SIGNATURE equ 5A4Dh
IMAGE_NT_SIGNATURE equ 00004550h

IMAGE_FILE_HEADER STRUCT
Machine WORD ?
NumberOfSections WORD ?
TimeDateStamp DWORD ?
PointerToSymbolTable DWORD ?
NumberOfSymbols DWORD ?
SizeOfOptionalHeader WORD ?
Characteristics WORD ?
IMAGE_FILE_HEADER ENDS

IMAGE_DATA_DIRECTORY STRUCT
VirtualAddress DWORD ?
isize DWORD ?
IMAGE_DATA_DIRECTORY ENDS

IMAGE_OPTIONAL_HEADER32 STRUCT
Magic WORD ?
MajorLinkerVersion BYTE ?
MinorLinkerVersion BYTE ?
SizeOfCode DWORD ?
SizeOfInitializedData DWORD ?
SizeOfUninitializedData DWORD ?
AddressOfEntryPoint DWORD ?
BaseOfCode DWORD ?
BaseOfData DWORD ?
ImageBase DWORD ?
SectionAlignment DWORD ?
FileAlignment DWORD ?
MajorOperatingSystemVersion WORD ?
MinorOperatingSystemVersion WORD ?
MajorImageVersion WORD ?
MinorImageVersion WORD ?
MajorSubsystemVersion WORD ?
MinorSubsystemVersion WORD ?
Win32VersionValue DWORD ?
SizeOfImage DWORD ?
SizeOfHeaders DWORD ?
CheckSum DWORD ?
Subsystem WORD ?
DllCharacteristics WORD ?
SizeOfStackReserve DWORD ?
SizeOfStackCommit DWORD ?
SizeOfHeapReserve DWORD ?
SizeOfHeapCommit DWORD ?
LoaderFlags DWORD ?
NumberOfRvaAndSizes DWORD ?
DataDirectory IMAGE_DATA_DIRECTORY
IMAGE_NUMBEROF_DIRECTORY_ENTRIES dup(<>)
IMAGE_OPTIONAL_HEADER32 ENDS

IMAGE_NT_HEADERS STRUCT
Signature DWORD ?
FileHeader IMAGE_FILE_HEADER <>
OptionalHeader IMAGE_OPTIONAL_HEADER32 <>
IMAGE_NT_HEADERS ENDS

IMAGE_DOS_HEADER STRUCT
e_magic WORD ?
e_cblp WORD ?
e_cp WORD ?
e_crlc WORD ?
e_cparhdr WORD ?
e_minalloc WORD ?
e_maxalloc WORD ?
e_ss WORD ?
e_sp WORD ?
e_csum WORD ?
e_ip WORD ?
e_cs WORD ?
e_lfarlc WORD ?
e_ovno WORD ?
e_res WORD 4 dup(?)
e_oemid WORD ?
e_oeminfo WORD ?
e_res2 WORD 10 dup(?)
e_lfanew DWORD ?
IMAGE_DOS_HEADER ENDS

IMAGE_SECTION_HEADER STRUCT
Name1 db
IMAGE_SIZEOF_SHORT_NAME dup(?)
union Misc
PhysicalAddress dd ?
VirtualSize dd ?
ends
VirtualAddress dd ?
SizeOfRawData dd ?
PointerToRawData dd ?
PointerToRelocations dd ?
PointerToLinenumbers dd ?
NumberOfRelocations dw ?
NumberOfLinenumbers dw ?
Characteristics dd ?
IMAGE_SECTION_HEADER ENDS
shaddar
12-06-2004, 08:31 AM
404 Zairon!! :(
Could you upload that again, or send me via PM? :D

Woah, this is 2003 stuff. Never noticed this Thread :(
Well, anyway, the 404 is real :D

thx for PM!
homersux
12-06-2004, 11:45 AM
Hey, maybe it's easier to send an email to HW author to request this feature? :devil:
LOUZEW
12-06-2004, 12:38 PM
Many thank's Zairon for this INC file, i can now progress in my study.
That job is exactly what i like to do !
LOUZEW
12-08-2004, 02:35 PM
DataDirectory IMAGE_DATA_DIRECTORY
HWS4.inc(79) : error A2008: syntax error : in structure

IMAGE_NUMBEROF_DIRECTORY_ENTRIES dup(<>)
HWS4.inc(80) : error A2008: syntax error : IMAGE_NUMBEROF_DIRECTORY_ENTRIES

Name1 db
HWS4.inc(112) : error A2008: syntax error : in directive

IMAGE_SIZEOF_SHORT_NAME dup(?)
HWS4.inc(113) : error A2008: syntax error : dup

Microsoft (R) Incremental Linker Version 5.12.8078

Am I missing anything ? Maybe an option to set in MASM (i'm using MASM8)
ZaiRoN
12-09-2004, 06:10 AM
I have no problem here. I used Code Snippet Creator leaving the original settings for masm (I changed the path directory only...)


Writing an EXE packer ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Writing an EXE packer ?
PDA

View Full Version : Writing an EXE packer ?

squidge
11-28-2002, 09:31 PM
Does anyone know of any tuts or other documentation on how this is done, or do I have to start from scratch? I already know quite a bit of the PE format (wrote a PE Viewer/Editor) so I'm hoping this will help me along.

I'm not interested in beating any current packer - I'd like to do this project just for fun really, and as an exercise.
bart
11-28-2002, 10:22 PM
Take a look at the

http://www.xtreeme.prv.pl

PeX exe packer + src
NFO (in bartpack ?? i dont remember) + src
DEF simple exe-encryptor + src
FSG ;)
evaluator
11-29-2002, 07:19 PM
Hi, bart!

2 dirti Questions..

Are you author of PeX?

Are you also author of PELock> Bartosz Wojcik?
squidge
11-29-2002, 10:14 PM
Cheers bart!
Uradox
12-04-2002, 01:21 PM
Contact me if your still interested in working on a packer. I've got a project iv done sometime ago and wish to continue it sometime in the near future, would be nice to have another hand on deck :)

Uradox
evaluator
12-04-2002, 02:25 PM
bart..

******************************
SILENCE IS GOLD..
..eh, only for proper cases..
******************************

Because according with another OLD WISDOM rule:

SILENCE GIVES CONSENT
[silence means your positive answer]

think about & try answer..

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Somebody tell me:
where ends possibilites of my DEMAGOGY..


GetProcAddress by ordinal problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > GetProcAddress by ordinal problem
PDA

View Full Version : GetProcAddress by ordinal problem

mike
11-29-2002, 05:10 AM
I'm trying to write some thunk code in C, but I'm having trouble loading some of the undocumented functions from kernel32 by ordinal:

I want to load LoadLibrary16 (35), FreeLibrary16 (36), and GetProcAddress16 (37). I tried using

typedef HANDLE (__cdecl *LL16)(char *);
static LL16 LoadLibrary16 = NULL;
static HANDLE hKernel;
...
hKernel = GetModuleHandle("KERNEL32");
LoadLibrary16 = (LL16)GetProcAddress(hKernel, (LPCSTR)35);

But it always fails. Am I doing that wrong?
I forced it to work by adding the offset (0x2AF46) to hKernel and casting it into a function.

I'm also looking for a 16-bit version of GetModuleFileName. Does GetModuleFileNameA work?
Solomon
11-29-2002, 08:47 AM
the highest bit of your ordinal should be 1?
mike
11-30-2002, 04:32 AM
the highest bit of your ordinal should be 1? Huh? like 0x80000023 instead of 35? Is that documented somewhere?

From MSDN:

GetProcAddress

The GetProcAddress function retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).

FARPROC GetProcAddress(
HMODULE hModule,
LPCSTR lpProcName
);

Parameters

- hModule
[in] Handle to the DLL module that contains the function or variable. The LoadLibrary or GetModuleHandle function returns this handle.

- lpProcName
[in] Pointer to a null-terminated string that specifies the function or variable name, or the function's ordinal value. If this parameter is an ordinal value, it must be in the low-order word; the high-order word must be zero.
Solomon
11-30-2002, 05:45 AM
Oops, what I said is wrong. sorry:(
dion
11-30-2002, 07:44 AM
interesting... mike,
you type the documentation:

FARPROC GetProcAddress(
HMODULE hModule,
LPCSTR lpProcName
);

and you type in your code:

GetProcAddress(hKernel, (LPCSTR)35);

but i can be wrong here... is it true that 35 can be refered as lpProcName? would it be KERNEL32.35 or somewhat? i dont know this, because i have problem to with 16bit dll imports. maybe someone will explain this one.

regards
bart
11-30-2002, 02:04 PM
.386
.model flat,stdcall
extrn LoadLibraryA :proc
extrn MessageBoxA :proc
.data
szK32 db 'KERNEL32',0

.code
start:
int 3

push offset szK32
call LoadLibraryA

; ordinal number
mov ecx,9

and ecx,0fffffffh ;EAX=Ordinal Nr. (np. 80000001)
push ecx ;

mov edx,[eax+3Ch] ;
add eax,edx ;
mov ecx,[eax+34h] ;
mov esi,[eax+78h] ;
pop eax ;
add esi,ecx ;
mov edx,[esi+1ch] ;
sub eax,[esi+10h] ;
add edx,ecx ;
mov eax,[eax*4+edx] ;
add eax,ecx ; EAX = ordinal address

; call api
push 21004Ch
call eax

ret
end start
dELTA
11-30-2002, 06:05 PM
I'm not sure about those exact undocumented API:s that you are trying to access, but I do know that after the first version of Windows 95, Microsoft added protection code so that many undocumented API:s could only be loaded from certain known operating system processes. You will find more info about this in Pietrek's "Windows 95 System Programming Secrets".
mike
12-01-2002, 09:20 PM
Looks like you avoid GetProcAddress entirely here. Does this traverse a table in the DLL or something?
Originally posted by bart
.386
.model flat,stdcall
extrn LoadLibraryA :proc
extrn MessageBoxA :proc
.data
szK32 db 'KERNEL32',0

.code
start:
int 3

push offset szK32
call LoadLibraryA

; ordinal number
mov ecx,9

and ecx,0fffffffh ;EAX=Ordinal Nr. (np. 80000001)
push ecx ;

mov edx,[eax+3Ch] ;
add eax,edx ;
mov ecx,[eax+34h] ;
mov esi,[eax+78h] ;
pop eax ;
add esi,ecx ;
mov edx,[esi+1ch] ;
sub eax,[esi+10h] ;
add edx,ecx ;
mov eax,[eax*4+edx] ;
add eax,ecx ; EAX = ordinal address

; call api
push 21004Ch
call eax

ret
end start
Kayaker
12-02-2002, 05:20 AM
Hi All

This is interesting, creating your own .lib file as Peitrek outlines in Win95 Secrets, as dELTA mentioned (see Appendix A) seems to be the elegant way to go. You create a .def file with the undocumented kernel functions you want to include and use the VC++ 'lib' function to compile a .lib file.

He provides a version of the K32lib.lib and K32lib.def files in the source and I'll up them here if anyone wants to try it. From the docs:

To use K32LIB.LIB in your project, you should place it immediately after
KERNEL32.LIB in the list of import libraries. This forces the Microsoft linker
to place the code and data from K32LIB.LIB contiguous with the code
and data brought in from KERNEL32.LIB. You'll see two references to
KERNEL32.DLL in the resulting executable. Don't be too concerned,
though. You're getting two IMAGE_IMPORT_DESCRIPTOR headers
for KERNEL32.DLL, but not two copies of all the data that describes
each imported function.

Borland C++ users can take K32LIB.DEF and run it through IMPORT. LIB
to create an import library in the proper format for TLINK. The command line
in this case is:
IMPLIB K32LIB.LIB K32LIB.DEF
You can place K32LIB.LIB anywhere in the import library list; TLINK
doesn't care about the order in which it appears.

For MASM I think you can use the L2EXTIA.EXE provided in Hutches Masm32. It successfully created an inc file in EXTERNDEF format, but I haven't tested out its use yet.

The K32lib.def file Peitrek uses doesn't have any newer undocumented functions (he lists 100 while my Win98SE kernel has 122), but it should have what you need. i.e. it lists
LoadLibrary16@4 @35
FreeLibrary16@4 @36
GetProcAddress16@8 @37

If you want to roll your own GetProcAddress function, Iczelion's PE tut #7 Export Table will explain how to walk the export directory of kernel32 as bart did, accessing the IMAGE_EXPORT_DIRECTORY and AddressOfNameOrdinal array.

The other option if this is just a one-shot deal on your own system, is to get the address directly using IDA (a little idc scripting project to create a .def file perhaps? ;-)

Let us know if the K32lib.lib file works if you decide to use it. I think I'm off to try it in Masm ;-)

Regards,
Kayaker
mike
12-02-2002, 07:48 PM
Kayaker wrote:The other option if this is just a one-shot deal on your own system, is to get the address directly using IDAYup. That's what I meant when I wroteI forced it to work by adding the offset (0x2AF46) to hKernel and casting it into a function.How many different versions of Kernel32 are there?
Bart-thanks for the code snippet; Kayaker-thanks for the pointers & zip. They look like just what I need.

Lots of references to Pietrek's stuff; is it available online anywhere?
ZaiRoN
12-02-2002, 08:08 PM
Hi.
try here:
http://www.wheaty.net/

ZaiRoN
mike
12-03-2002, 12:41 AM
Zairon- I've seen his homepage. I was wondering if anyone had put his now out-of-print book online, or at least could quote me some relatively unique text from the middle of the book for doing a search myself ;)
Kayaker
12-03-2002, 02:42 AM
I tested out thunking down to Win16 and it worked out OK. For Masm you need to create an inc file from the K32lib.lib file with L2extia.exe and include them both. As for making use of the returned address from GetProcAddress16, calling QT_Thunk directly seems to be the way to go to call a 16 bit dll. For a good example of how it all fits together check out

Direct Thunking in Windows 95
Using undocumented calls to bypass the thunk compiler - Matt Pietrek
http://www.ddj.com/documents/s=952/ddj9614c/9614c.htm

From the doc:
Calling QT_Thunk in your code requires you to do two things. First, you have to put the 16:16 address to call into the EDX register. Second, the code from which you're calling QT_Thunk should have an EBP stack frame set up, and at least 0x3C bytes of local storage that you're not relying on. This unusual step is required because QT_Thunk builds its convoluted stack frame for calling the 16-bit code in the region below where the EBP register points to.

Following his example I was able to call directly the 16 bit MESSAGEBEEP function of User.exe. Not too exciting a thing to do with the technique but at least the feedback was immediate ;)
Here's the pertinent code:

include k32lib.inc
includelib k32lib.lib

KernelDllName db "Kernel32.dll", 0
QT_Thunk db "QT_Thunk", 0
User16Exe db "User.exe",0
MessageBeep16 db "MESSAGEBEEP",0

hLib HANDLE ?
hLib16 HANDLE ?
pQT_Thunk DWORD ?
pMessageBeep16 DWORD ?

;=================Thunk16===========
Thunk16 proc

; Set up a stack frame as suggested by Pietrek
push ebp
mov ebp, esp
sub esp, 3Ch

invoke LoadLibrary, ADDR KernelDllName
mov hLib, eax
invoke GetProcAddress, eax, ADDR QT_Thunk
mov pQT_Thunk, eax

invoke LoadLibrary16, ADDR User16Exe
mov hLib16, eax
invoke GetProcAddress16, eax, ADDR MessageBeep16
mov pMessageBeep16, eax

push MB_OK
mov edx, [pMessageBeep16]
call pQT_Thunk

invoke FreeLibrary16, hLib16
invoke FreeLibrary, hLib

mov esp, ebp
pop ebp

ret
Thunk16 endp
;===============END Thunk16==========

Great fun. Now maybe I'll call the User.exe function BOZOSLIVEHERE and see what it actually does ;p

Kayaker

PS Mike. I think the Ebook is at his home page if you check under Downloads. It's also on the RCE CD which is now available for d/l.
mike
12-03-2002, 03:02 AM
PS Mike. I think the Ebook is at his home page if you check under Downloads. It's also on the RCE CD which is now available for d/l.Only the code is available on his download page, none of the explanation. As for the RCE CD, I'd pay someone for a copy, but I'm on dialup, so no chance of downloading it. :(As for making use of the returned address from GetProcAddress16...I'm already doing that, so no worries there.
Kayaker
12-03-2002, 05:33 PM
Originally posted by mike
Only the code is available on his download page, none of the explanation. As for the RCE CD, I'd pay someone for a copy, but I'm on dialup, so no chance of downloading it.

Well I'll be, there's no book in the RCE CD either, just the code examples. Am I the only one with the full pdf file? No idea where I picked it up but since it exists I'm sure you can find it. Perhaps I can add it to the archives if it seems too difficult to find.
ZaiRoN
12-03-2002, 07:00 PM
Hi.I can add it to the archivesThere is not need Kayaker:
http://www.dore.ru/library/windows/PietrekBook.pdf

ZaiRoN
Aimless
12-04-2002, 09:12 AM
Post me a site where I can upload the electronic book in PDF format

Have Phun,


Need nfo about dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need nfo about dongle
PDA

View Full Version : Need nfo about dongle

blade-II
11-30-2002, 03:57 PM
Hi,

I've been lookin' for tuts for Key-Lok II, but I haven't been able to get them. Please, to anyone having dealt with such hardware device, any advice, comments or guidelines are welcome.

There are a lot of info about, hasp, rainbow, etc... but regarding this one I have found almost nothing...

Regards

Blade-II
Woodmann
11-30-2002, 10:20 PM
Hi,

If you are just looking for info about the dongle, you
may find some usefull stuff on their website.

If you have the dongle and want to reverse it, take a look
at CrackZ pages. You will get a general idea for what you need
to get started. There is also a reference to keylok on his site.

If you have software but not the dongle........good luck, you
wont reverse it in a few hours unless you can think like a dongle.
You got more info for us ?

Later, Woodmann
blade-II
12-01-2002, 12:31 AM
ThnX a lot Woodmann for your support....
This is what I can say:

Originally posted by Woodmann
Hi,

If you are just looking for info about the dongle, you
may find some usefull stuff on their website.

-------------------------------------------------------------------
Yep, I've got some public manuals from their WebSite. This is usually the first step everybody should follow. I would like, however, to get some documentation "for internal use only".
But they are almost impossible to find.
---------------------------------------------------------------------

If you have the dongle and want to reverse it, take a look
at CrackZ pages. You will get a general idea for what you need
to get started.

------------------------------------------------------------------------
I know, there is a quantum leap between reversing with dongle and without it. I don't have such device anyway. I have read Crackz pages and they put a lot of light on this topic but, as I said, mainly for mainstream brand models
-------------------------------------------------------------------------

There is also a reference to keylok on his site.

____________________________________________
I didn't know it, I will go straight there...ThnX
----------------------------------------------------------------------

If you have software but not the dongle........good luck, you
wont reverse it in a few hours unless you can think like a dongle.
You got more info for us ?

----------------------------------------------------------------------
Yep indeed, and thanX again...
-----------------------------------------------------------------------

Later, Woodmann
MTB
12-01-2002, 03:08 AM
Blade II

Hopefully the software vendor was stupid like most of them are. I recommend you hopefully find messages such as "Dongle not found running in demo mode" or "Software limited because dongle not found" ETC. Using IDA trace back several calling routines and lable them check_dongle, check_dongle_2, etc. Eventually you will find the program read dongle. It will be easy from there.

MTB
Sab
12-02-2002, 06:31 PM
Hi.

Generally any keylok II dongle can be reversed without any need of a dongle. The seeds used for keylok II dongle are 99% of the time embedded within the application simply because the developers api refference is geared to make one do such a horrible thing (: Same goes with envelope btw. I managed to emulate the internal kfunc but that was not needed in the end.
Its a easy dongle to deal with , have fun. -Sab
blade-II
12-03-2002, 06:00 AM
Hi,

ThnX a lot MTB, Sab and chief Woodman for your kindly support.
From your words guys it seems that this dongle gives a weaker security than sentinel, hasp or hardlock devices. Tracing back msg strings within IDA sounds pretty good and reminds me former security breakin' tasks I've done before.

I will have fun for sure. I'm gonna install the target right now..

Regards

blade2

:cool:
hobgoblin
12-03-2002, 08:36 AM
I'm interested in targets like this. May I ask what target you are working on?

regards,
hobgoblin
blade-II
12-04-2002, 06:29 PM
Originally posted by hobgoblin
I'm interested in targets like this. May I ask what target you are working on?

regards,
hobgoblin

target is opengvs....

regards


APDFPR Pro V2.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > APDFPR Pro V2.1
PDA

View Full Version : APDFPR Pro V2.1

hobferret
11-30-2002, 08:47 PM
Hi all

Got APDFPR Pro V2.1 with new asprotect but have a problem - this might interest you hobgoblin. EIP is at 0041B02A where it jumps to 0041B640, you need this space for patches!! At 0041E50A there is a redirected call which includes GetModuleHandleA some pushes and pops then a return. At 0041B85C there is another redirected call which includes GetModuleHandleA and again some pushes and pops and a return. But different from the one above.:)
If you use imprec or revirgin and allocate GMHA the prog crashes, so I used the "spare" section to patch - i.e. at 0041B640 CALL 0041B029 insert the code then the call to GMHA and some more code, the same at 0041B85C CALL 0041B034 e.t.c. This works fine but somewhere there is yet another rediredted call or at least I think so coz just a bit further in you get the stack corrupted.:mad:
I spent a few hours last nite searching but can't see the wood for the trees. Anybody offer any help?

BTW for some reason /tracex won't work with this version either!!:confused:
_Servil_
12-01-2002, 09:08 AM
don't know if you talking about the same thing i think but push [ebx]/pop [ebx] calls are sometimes called to detect the protection layer presence.under 'normal' conditions dynamic library doen't allow to rewrite it's code.

simply, skip the call

btw. it just brought me to idea, would it be possible to write a signature for IDA to recognize and name the As*protect library calls embedded in the resolved app? ;p (sorry for OT)
bart
12-01-2002, 11:09 AM
i saw it also in image dupeless (inside exes body), i would like to see new aspr help file to find out what's new :)
hobgoblin
12-01-2002, 05:06 PM
Well, I got some different results than you did, bart. First of all, tracex worked nicely for me. I suspended the program in a loop at 41B640 (which I used as OEP), then dumped it and used revirgin to find the iat table and to rebuild it. I found 8 unresolved apis, which I traced manually. After rebuilding the program the ususal way using LordPE, it ran as it is supposed to do. Well, almost. It didn't crash, but I can't get the about box or register box to open. And when I disassemble it using W32dasm, I only get a few strings. (But that may be due to w32dasm. Haven't tried IDA on this one yet).

hobgoblin
hobferret
12-01-2002, 05:24 PM
Hobgoblin Hmm, strange...

Are you saying that you attach the tshep section using LordPE rather than letting revirgin do it itself?
:confused:

If so what difference does it make?

Maybe you could PM me your IAT to see what if any the differences are, you have these long winter nites in Norway so just maybe you could - or even post it here - or is that not allowed anymore.:)

Anyway thanks for replying I thought you may be interested in this one!;)
Iwarez
12-01-2002, 07:09 PM
hobgoblin, I dumped the program and fixed the imports and there was no problem getting to the about/registration screen. Maybe one of your imports is wrong?
nikolatesla20
12-01-2002, 08:17 PM
I would not rely on Revirgin's autopatcher, it is not reliable, sorry to say. Just add a new section to the dump with LordPE, go to revirgin, enter the RVA of the new section and press "generate!" and then patch in the imports yourself with a Hex Editor, and then go back to LordPE to point the Import directory to your new section. ALso dont forget to correct the imagesize after doing this manually.

-nt20
hobgoblin
12-01-2002, 10:12 PM
Hi iwarez,
Did you use revirgin or imprec? And could you please mail me yor idata section? I'm just interested to compare it with mine.

hobferret: I like to compare iwarez idata section with mine first, then I get back to you, okey?

hobgoblin
Manko
12-01-2002, 11:36 PM
Mine worked on first try too. ;P (Hi, hobgoblin!)

/Manko
hobgoblin
12-02-2002, 08:20 AM
Hi manko,
Sorry for not being able to get back to you as promissed.:(
Sometimes things get tangled up IRL, and I don't get around to do everything I want to...
Seems to me that you get along fine in the wonderful world of reversing...:)

hobgoblin
Iwarez
12-02-2002, 09:11 AM
Hobgoblin, I'am not at home right now. when I get back I'll send it.
Iwarez
12-02-2002, 08:04 PM
Is this software possible to make full version? I managed to make it think it's registered but it will only work for passwords up to 4 chars in length. Tried to find the code that does the generating but failed. Anyone more luck?
_Servil_
12-02-2002, 08:29 PM
find thread of .asprotect licensing, essay from SplAj
Iwarez
12-02-2002, 09:30 PM
Thanks servil for your post but I already know of code encryption. What I was trying to say was that if the program can run from 1 to 4 it can also run from 1 to 10 or whatever. Actually, when I perform a sequence of actions the program is actually fooled into running a bruteforce with a greater length...
Zilot
12-03-2002, 08:19 AM
Hobferret !

This is not new Aspr , it is very old with

8113e0----------->DialogBoxParamA (User32 ) (rva 4b5a8)

this is wrong resolved with autotracer in ImpRec and is Find ResouceA , rename it in DialogBoxParamA

and in ImpRec there is another incorrect resolved Api with plug-
ins

and instead

81139c------------>GetVersion you should put GetCommandLineA

rva 4b724 , OEP is 41b643

Hobgoblin !

About window works , PM if you are still interested in IAT

Regards Soldat :p
hobferret
12-04-2002, 12:45 PM
Soldat

Do not agree with your EIP not all progs start with PUSH EBP etc.

Anyways I got mine goin last nite with all the features enabled - still with EIP @ 41B024.:)

Nearly sunrise so Im goin:(

Hobgoblin will PM you details!!:cool:

BTW all the data strings must be in the dll's coz nowt in WDASM

Thanx 2 all who gotten involved:cool:
hobferret
12-04-2002, 08:18 PM
Hi again all out there

Just spent 10min @ lunch and got it registered - quite easy really!!:rolleyes:

BTW B4 when I was goin on about dll's forget it there are none:cool:

Regs to all out there;)

HOBGOBLIN dont 4get yr PM


Armadillo 2.61 IAT Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 2.61 IAT Problem
PDA

View Full Version : Armadillo 2.61 IAT Problem

Mega Desperate
12-01-2002, 04:19 AM
nikolatesla20 thnkx ... but doesn't work =-( ..Look

i dump file and select dumped file in memory ...with ImpRec ..now i put OEP that is DD5CC , push "IAT AutoSearch" .. ..wops!!..

"Could no find anything good at this OEP ! :-( "

='( ... It is not important if process chooses ... Always this mistake goes out for me... now .. if i leave the OEP that has the ImpRec predetermined ... It gives me the result:

RVA 00121000 Size 000001F4

It´s correct =-P ... but i try "GetImport" ...And return to the same thing ...It is not important if process chooses ....always the IAT is quite correct ...why?¡ ....my dump is bad?¡ ... ..please help me ... i really not understand =-( ....what is wrong? ...

Thank u =-)
nikolatesla20
12-01-2002, 08:10 PM
Which program are you doing? the Screensaver?

Anyway DO NOT put in the OEP, neither ImpREC OR Revirgin really need it.

What you want to do is TELL ImpREC where the IAT starts yourself. You can do that by just filling in the IAT start and length values yourself, in the text boxes. Then, instead of pressing "IAT search", just push "Get Imports".

In a program like this, you have to tell it manually where the IAT starts and how long it is. You can do that by finding an import address (such as a call dword ptr [xxxxxxxx] instruction) and going to this xxxxxxxx address in SoftICE, and then scrolling up to find the IAT start, and then down to find its length.

I suggest you study how an IAT looks in memory some more. Also, perhaps you didnt know that ImpREC and Revirgin would work if you just put in the numbers yourself. In that case, now you know. Revrigin, however, will still not work on this.

-nt20


Has anyone worked on AEA products?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Has anyone worked on AEA products?
PDA

View Full Version : Has anyone worked on AEA products?

flyingsilicon
12-03-2002, 08:38 AM
Hello all nice guys here,
Thanks to all RCEs because I really learned so much usefull thing by reading their posts and essays, specially thanks to NBlendr who was so much kindfull with every newbies, another thanks to CrackZ.
I have a problem with one of AEA products, its very expensive but thr similar products of this company are fixed via some other groups.
I would like to know if anyone has any eperience with AEA products which are protected by SLM.
rgrds
FS
r4g3
12-03-2002, 04:47 PM
Advanced Reversing Forum

l33t cr4ck3r:
hey ppl do u know how to reverse stuph ?
tell me plz
i don`t

about _what_ were you thinking when wrote this newbie-ish post here ?

"....ho was so much kindfull with every newbies...."

maybe the logics was advanced reversing = newbie section for advanced newbies, or what ?
flyingsilicon
12-07-2002, 10:36 PM
Hi my dear friend,
Sorry for my mistake!
Its very usual just because I'm a newbie. So I cannot allow myself to ENTER to advanced...department. All doors are closed or me over there.
But about you: I respect to you and your knowledge! But
Please be a bit more kindfull and friendly with me and others, just like NB and others, Yes you have a gold mine at your knowledge briefcase, but I'm a poor , hongry man on the road.
rgrds
FS
Its a fact that a newbie needs help, and makes mistakes all time.please excuse meeee


RV Tracer (not for the apis...)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RV Tracer (not for the apis...)
PDA

View Full Version : RV Tracer (not for the apis...)

Manko
12-03-2002, 05:31 PM
I've read a lot about how you should use revirgin on win2k because it is faster than icedump's tracer + you don't have to install w98 (yay!).
...but I have never been successfull in using RV-Tracer. Guess it was SOME time since it got beat, but is there not a way to get it working again?
I ask because I'm a stupid lazy clueless newbie who wich not to install w98...
besides I couldn't even get a copy of system commander and I already have w2k installed and no other computer, so it seems like a lot of trouble to go through...
But it disturbs me not to be able to unpack a lot of proggies...

/Manko
crUsAdEr
12-03-2002, 06:52 PM
Hi Manko,

What cant you unpack without a tracer?
hobgoblin
12-03-2002, 07:29 PM
Hi Crusader,
A question (it may sound stupid, but....):
How would you find the dips in Asprotected proggies if you can't trace with /tracex or revirgin (or the infamous loader that's floating around)?
regards,
hobgoblin
Manko
12-03-2002, 11:09 PM
Yup!
That's pretty much what I was going to say. :)

Though I reallise I shouldn't have to rely on tracers and stuff if I was a real (good) reverser...
Wasn't it you, crusader, who wrote a tut where you reversed the dll of an aspr? It might be easy for you but when the only working "tracer" on w2k (read something loader) doesn't work with an aspr, I lack the skills to either reverse the loader or the aspr, so I'm beat... :(

/Manko
crUsAdEr
12-04-2002, 01:27 AM
Neccessity is mother of all invention i guess... i started out cracking on win2k so i never had the luxury of using icedump... so i have grown used to not having a tracer...

Regarding Aspr... there are ways of finding dips... if you want to dump and reversed aspr.dll i can help... aspr create a table of all the dips before OEp so if you can dump it, you can tell where aspr is going to dip...

You can do bpm 401014 x then trace on a bit and dump from there, or you can catch the IAT redirection routine and dump from there, or you can try finding the push series as i wrote on the tutorial which forms the skeleton of aspr.dll... there are ways i guess... even the Solomon ntcontinue trick will also works...

Ah well...


Devpartner7 vs. web browser performance?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Devpartner7 vs. web browser performance?
PDA

View Full Version : Devpartner7 vs. web browser performance?

_Servil_
12-03-2002, 06:41 PM
Greetings,

It is not too tool of yours trade but rather somebody else's but I would ask here since it is quite specific soft and don't know where else I could get an expert answer: After installing this product web browser's response degrades very rapidly. It's sure that devpartner is someway hooked to IE, dunno for what reason but previous version didn't require this (IMO). Also my question is if (and what) can I do to detect how it is hooked up, and eventually remove the relationship, if it won't harm functionality under visual studio ofcourse. thanks.
Woodmann
12-04-2002, 02:14 AM
Howdy,

I think your problem might be the analyser that comes with
the package. I dont know if it is backwards compatible or frontwards compatible. You got the latest version of IE ?

Other then that everything I have read says it is fully compatible.

Later, Woodmann
Snatch
12-05-2002, 02:46 AM
I had a weird problem with it too. My development studio would get really slow accessing files and it was hard to explain the behavior. If I never used any of the DevPartner 7.0 utilities though then it VS.NET would run fine so I am not using it for now. But its relationship with IE I have no idea IE still works perfectly smoothly for me.

Snatch


Sentinel Super Pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel Super Pro
PDA

View Full Version : Sentinel Super Pro

bloke
12-04-2002, 02:06 AM
Hi there. I am working on a scheme to bypass the sentinel protection on an older bit of development software (16-bit) I use at both uni and home. Obviously if anybody else needs the dongle I can't work on my stuff so I want rid. I got the suggested software (WDASM and SoftICE) and read through Crackz tutorials and set to work. I have limited asm knowledge but I'm trying to improve that with the linked tutorals. I couldn't find the 7242 string any of the dll's so I set the old bpio 378 and waited. It broke in one of the main dll's several times but seemed to loop the same few addresses for most of them. I also found the DeviceIoControl string in one of the dll's and flaged that but that seemed to break just at desktop (maybe win98 testing port or something). So I gave up on that avenue. Now I'm at a juncture and could do with some advice. I thought getting IDA and applying the sig files to it may help (if that works for 16-bit files) if not I'm a bit stuck. When I load the file with symbol loader I get the message 'error no debug information available' and WDASM is a bit touchy if I try and adjust a bit of the code. Could you give me a few hints on how to continue.

yours sincerely

Bloke
Woodmann
12-04-2002, 02:30 AM
Hi,

Sentinel Super Pro.

Are you sure its Super Pro? 16 bit is old stuff.

Hints :
make sure it is Super pro.
Search for 16 bit Sentinel stuff.
Can it be emulated?
If not then whats next?

Name the proggie if you run into more trouble.

Sentinel can be reversed, many have done it.

Peace, Woodmann
tgodd
12-04-2002, 04:58 AM
You are 100% correct Woodman.

It could very well be a standard sentinel Pro.

I remember the early ones about 3-4 inches in length.

tgodd
bloke
12-04-2002, 02:36 PM
It definately a super pro, I have the dongle in front of me. I tried ida with the super pro sig files but to no avail. It didn't find any instances even though that is where softice breaks. The program I am working on is t*st-point. Any further advice would be grately appreciated. I was going to include what I think is the offending dll for your perusal but it is too big. You can download it from the website with the same name (The upgrade is actually the whole program).
JackD
12-04-2002, 10:05 PM
Definitely Sentinel and definitely 16-bit!

The Sentinel code you are looking for is in tpmain.dll and is easily "fixed" - especially if you have the dongle.

This app will also run with a CryptKey license.


PHP Encrypter ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PHP Encrypter ?
PDA

View Full Version : PHP Encrypter ?

Zero
12-04-2002, 02:16 PM
Since this forum discusses packer as well...

Does anybody knows HOW a PHP Encrypter works ?
(I do no talk about Obfuscation, I mean real encryption like Zend Encrypter or SourceGuard)

Zero


tracedump?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > tracedump?
PDA

View Full Version : tracedump?

dion
12-05-2002, 08:15 AM
hi all, is there any way to log traced instruction in softice? i heard that someone has made it [maybe Kayaker or... ] named tracedump or somewhat. i had search the board but find nothing about it. anyone knows?

thanks
Kayaker
12-05-2002, 04:33 PM
PM me Dion

Kayaker


Hardlock Memory Dumper
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hardlock Memory Dumper
PDA

View Full Version : Hardlock Memory Dumper

cyco2
12-05-2002, 05:33 PM
hey ppl... a while ago I asked something on the forum, well some ppl at this forum started to bitch.
Anyway I don't care, and I WANT to help ppl in stead of bitching all day.

Here is one of my first tests... I will come back with a more advanced one.

This is only for testing... if you got a hardlock dongle at your home, pls test this.

btw, a brute forcer is also coming for module addresses. I found a way to do this in less then 3 hours.

All are programmed on the low level api.

Also I found a secret undocument API which covers the verify key calculation.

my final will be WITH source code ..... I hope ppl will like it.

Goofy...
Bengaly
12-05-2002, 05:49 PM
who who :)
go get them =)
and puke on all bitchers :-)
CrackZ
12-06-2002, 07:14 AM
Hiya,

I don't know what you used to brute force the MOD_AD, but 3hrs seems awful slow to me ;-), I managed it in around 20 minutes with just the ASM sample they provide in the SDK.

Anything wrong with testapi.exe for the rest?.

Regards

CrackZ.
cyco2
12-06-2002, 07:34 AM
well ur right... crackz... testapi will do it. But why is there a API_FUNCTION (dec 30) which is undocumented where ya can create a verify key with?... I mean I could not find it in any doc / source of them.

Second I did not optimize it yet, to set flags like don't search for USB auto and crap... the slowness of the bruteforce atm is the LowLevel api... not my code. And btw their High Level ASM example is ... well not very pretty right ?:)

I will optimize the bruteforces also in ASM, so maybe I will all together get more and better results. And then again I'm talking about bf'ing the whole range (1 to 8192*8), often the Dongle has a module address between 26000 and 35000 (I got 5 different dongles here).

But you are right crackz... I hoped only I could help some ppl out since there are no such tools available... maybe u even want to host the tool when it is ready?

/me wrote a very easy to use CHardlockDongle Object, which can encrypt/decrypt (KEYE) unlimited count of bytes.... :) (not the 64k limit like the HL API got). it will be with the source

Let me know if ya interested, and if you know things about Hardlock you think I should know by making this tool... please tell me :)

thanx for responding...

Goofy...
tgodd
12-06-2002, 08:27 PM
You should be able to do it in a few minutes.

Regards,
TGODD
tgodd
12-06-2002, 08:43 PM
Just a small hint.

There are only 8160 (decimal) possibilities.

Regards,

TGODD
cyco2
12-08-2002, 04:13 PM
Thanx for the info... though how ya know only that small range will cover all the module addresses? And what is the range exacly, I'll put it in my program, with the help of all ya ppl I can make as best working program possible. :)

Anyway let me know what kind of features you think would be handy if ya have to deal with a hardlock dongle?

Goofy...
Sab
12-09-2002, 09:02 AM
Hi cyco nice upload. Needs work of course but im sure ppl will find it quite nice to try. Maybe it might be a nudge for others to start uploading similar findings on the same dongle or perhaps different ones(: Whether they are discovered already or not. Keep on Keep'n on (: -Sab
marcos135
04-04-2004, 07:47 AM
Here is my test for my hardlock usb dongle....
excecute the file in dos mode and run "dongle/test "argument
and it will show the module address automatically....


Sandman's Reverse Engineering site
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Sandman's Reverse Engineering site
PDA

View Full Version : Sandman's Reverse Engineering site

StarsInTheSky
12-05-2002, 07:07 PM
I've seen lots of links to sandman's reverse engineering site with the description that it's the best site on the net for beginners. But every link in surely hundreds of pages I visited looking for it is broken!!!

But I found this place. Maybe someone can tell me what has happened to it, and where its tuts are!? please?

/going through krobar's place now :p
naides
12-05-2002, 08:01 PM
http://www.woodmann.net/forum/showthread.php?s=&threadid=4199

http://www.woodmann.net/RCE_CD/

+Sandman.zip rip is among the files provided by Woodmann and addressed in that thread
StarsInTheSky
12-06-2002, 12:12 AM
thank you =)


IDA 2 SICE plug-in failed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA 2 SICE plug-in failed
PDA

View Full Version : IDA 2 SICE plug-in failed

Solomon
12-06-2002, 02:45 AM
when I try to save the NMS file, IDA2SICE plug-in failed. The message is "I2S: plugin doesn't support undefined(unNamed) bytes in structure _MIDL_STUB_MESSAGE". plugin ver is v0.03g, IDA is v4.15

regards
tom_324
12-07-2002, 09:03 AM
Contact Mostek on e-mail from 'readme.txt'. Provide enough details for bug to be reproduced and he will be happy to help.

Tom
banshee
01-02-2003, 01:55 PM
I solved this problem in the very simple way. I opened "Structures..." subview and looked for structure where the plugin failed, it lloked like this

0000 tagACCEL struc ; (sizeof=0x6, standard type) ;
0000 fVirt db ?
0000 db ? ;here plugin failed
0002 key dw ?
0004 cmd dw ?
0006 tagACCEL ends

Then I changed type of fVirt to dw and everything worked fine. Think I could also just name that byte to get the same results.

0000 tagACCEL struc ; (sizeof=0x6, standard type) ;
0000 fVirt dw ?
0002 key dw ?
0004 cmd dw ?
0006 tagACCEL ends

Hope it helps.
Solomon
01-03-2003, 10:41 AM
thx, I will try it.:)


Serious softice problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Serious softice problem
PDA

View Full Version : Serious softice problem

Nebob
12-06-2002, 04:57 AM
I have DriverStudio 2.7, with Softice 4.2.7.562, ROR release. When I try to start softice "net start ntice", my whole system freezes! Hard lock, no mouse, keyboard, only a power cycle fixes it.

I've tried this with both XP SP1 and (just installed a moment ago) 2K SP3. Any ideas? What can I do?
disavowed
12-06-2002, 02:41 PM
what video mode are you using? if not the universal (windowed) one, try using that
Nebob
12-06-2002, 06:37 PM
Yeah, it's the generic video mode. You think it could be SP3? Does anyone have it working on an SP2 machine?
_Servil_
12-06-2002, 07:13 PM
I have the same problem, except it happens on xp_sp1, don't know what combo of hw/sw factors determines this, regardless if with/without nticedump it stops system response.
No solution. Previous builds didn't work but at least they started.

Only workarounds I know about to switch to another debugger or use it on Windows9x/me, it works well then.
UrgeOverKill
12-07-2002, 06:57 AM
Take a look over at DriverHeaven.net, they are quite helpful and have solved many a video problem.

Use their SEARCH function, type in your videocard manufacture and maybe you'll find a common thread that suits you.;)
tgodd
12-07-2002, 01:56 PM
Use a monochrome card and an old monochrome monitor.

Thats how we had to do it in the early days.
Softice still allows you to do this.

The problem is that most monochrome cards are ISA and most motherboards are not.

I keep one of my machines around which still has one ISA slot.

Regards,
TGODD
JH1234
12-09-2002, 10:18 AM
Hi,

I was actually about to post details of a similar problem: I am trying to run si405 on win2k sp3, on a compaq laptop. The system freezes when I hit CTRL-D, and unfreezes and resumes normal operation when I hit CTRL-D again. I have tried a variety of video modes, have tried disabling mouse (I am aware there is an issue with Synaptic touchpads on laptops - I have tried removing it from device manager and using a standard ps2 mouse). I have tried telling it to patch or not patch keyboard driver, but still, always the same behaviour.

Anyone have any further suggestions?

Cheers

JH
crUsAdEr
12-09-2002, 10:39 AM
Hi,

I used to have problem installing softice also... on win2k softice 4.05 is incompatible with GeForce II and above gfx card, i installed Driver Studio and softice runs fine now... Yep, DS 2.7 on Win2k SP3...

I have also seen cases of Driver Studio not working on new GeForce 4 card on both win2k and winXP so maybe that is the case for you guys... i have not known any solution for GF4 gfx card though installing on win98 seems to solve the puzzle...

Regards,
crUsAdEr
tgodd
12-09-2002, 12:32 PM
Yes DS 2.7 will possibly fix your problem.
Running XP I would still have my NV driver crash on occasion
with my GeForce 3 card.

So I went out and got an ATI card.

I find the best for debugging.

Have been since Sice 1.(something or other).

But your problem sounds to me to be a video driver problem.

Be sure you have a version of directX to which you have a video driver which is for the same version of directX, and use the Universal video drivers.

Regards,

tgodd
r4g3
12-13-2002, 05:37 PM
Originally posted by tgodd

Be sure you have a version of directX to which you have a video driver which is for the same version of directX..

...........................:confused: :)
tgodd
12-13-2002, 05:54 PM
You do not want directx 5 for example with a video driver only compatable to directx 4.

Plus knowing microsoft, I wouldn't beleive that a video driver compatable to directx 8 would be compatable to directx 5.

I have had bad experiences with this.

It may not always be the case.

Regards,
tgodd


aspro layer check removal
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > aspro layer check removal
PDA

View Full Version : aspro layer check removal

howie
12-06-2002, 09:25 AM
hi there,
i managed to rebuild the iat of many aspro targets thanks to the information provided here and hours of tracing :)
most of my dumps ran after eg. removing a filesize check, fixing "step backs" to aspro-layer or fixing further initialized variables.

but in new ones i more and more encounter stack-problems, if i fix the dump like i traced in real application :(
below is an piece of code i found in a programm. i assume this is the correct oeip, also i assume i managed to rebuild the iat (just the normal suspects). my question: am i fishing in the wrong seas? in otherwords, is this a valid oeip, and second how to fix it?

first loop fills some memory aera with zeros, this fails in the dump. i just nopped away instruction at 00401BB3. but the retn (and the following retn's in programm) produces errors caused by an invalid stack.

00401B9D > $ 833D 20B64F00 >CMP DWORD PTR DS:[4FB620],0
00401BA4 . 74 2F JE SHORT dumped.00401BD5
00401BA6 . B8 03000000 MOV EAX,3
00401BAB > 8B15 20B64F00 MOV EDX,DWORD PTR DS:[4FB620]
00401BB1 . 33C9 XOR ECX,ECX
00401BB3 . 894C82 F4 MOV DWORD PTR DS:[EDX+EAX*4-C],ECX
00401BB7 . 40 INC EAX
00401BB8 . 3D 01040000 CMP EAX,401
00401BBD .^75 EC JNZ SHORT dumped.00401BAB
00401BBF . B8 08B64F00 MOV EAX,dumped.004FB608
00401BC4 . 8940 04 MOV DWORD PTR DS:[EAX+4],EAX
00401BC7 . 8900 MOV DWORD PTR DS:[EAX],EAX
00401BC9 . A3 14B64F00 MOV DWORD PTR DS:[4FB614],EAX
00401BCE . C605 C0B54F00 >MOV BYTE PTR DS:[4FB5C0],1
00401BD5 > 33C0 XOR EAX,EAX
00401BD7 . 5A POP EDX
00401BD8 . 59 POP ECX
00401BD9 . 59 POP ECX
00401BDA . 64:8910 MOV DWORD PTR FS:[EAX],EDX
00401BDD . 68 FD1B4000 PUSH dumped.00401BFD
00401BE2 > 803D 4DB04F00 >CMP BYTE PTR DS:[4FB04D],0
00401BE9 . 74 0A JE SHORT dumped.00401BF5
00401BEB . 68 C8B54F00 PUSH dumped.004FB5C8 ; /pCriticalSection = dumped.004FB5C8
00401BF0 . E8 AFF8FFFF CALL <JMP.&KERNEL32.LeaveCriticalSection>; \LeaveCriticalSection
00401BF5 > C3 RETN ; RET used as a jump to 00401BFD
norby
12-06-2002, 05:27 PM
Hi Howie!
Where can I found that program? I will look at it.
Iwarez
12-06-2002, 09:48 PM
This doesn't look like a valid OEP. Probably a few bytes above the first function are all zero. This is because ASProtect executed them in high memory. If you break at your "OEP' 401B9D you should check the registers and the memory they point at. If I'am correct the ECX register contains the memory adress where there's something like this:

push 401b9d
retn

Voila, there are your missing instructions...


Is there a "Signature" for SentinelLM 7.2 protected programs?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Is there a "Signature" for SentinelLM 7.2 protected programs?
PDA

View Full Version : Is there a "Signature" for SentinelLM 7.2 protected programs?

naides
12-06-2002, 05:57 PM
I am dealing with certain software package, which distributes a time limited demo and a very complex encryption/packing scheme.
It does not have the clasical SentinelLM 7.1 features including its license file.
The license appears to be a long binary key in the registry, whose name ends in LM (License manager??)

Questions:

1)Are there any clues that would indicate this is a Rainbow Sentinel 7.2 protected package?

2)Are the SLM 7.1 generated licenses useless in 7.2 prgrams? Of course I would think yes, but I would like to hear if anybody has actually tried it.
naides
12-11-2002, 05:23 AM
Please. I do not think my post can be THAT lame.

I will ask again:
I have a program X, which I can post the name if anybody requests.
Previous versions have been protected with SentinelLM 7.1.

It is a time limited demo, with a loader, and it is packed and heavily protected to my time traking attacks. The overall scheme of protection is quite similar to SlLM.

I worked on the hypothesis that the program was protected with some version of SlLM:

I did not find a license file being read at the start of the program, only a registry entry which has a name ending on LM

I dissasembled the loader program with IDA, and applied all the available Sentinel 7.1 flirt:
I did not found any call to a known 7.1 function, but I do not have a 7.2 flirt, so it still may be using 7.2 API.

Ergo: At this point I am unsure if I am dealing with a new variant of SentinelLM (7.2???) or with a completely new protection scheme.
I was wandering if anybody has been in my situation before, and know of some typical file names, file extensions, code patterns that are typical of SlLM 7.2, and may help me solve this issue.

Thanks in advance


A short note to .vxd authors ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A short note to .vxd authors ...
PDA

View Full Version : A short note to .vxd authors ...

Czerno
12-06-2002, 09:58 PM
Hi fellows ! Just a reminder here to those of you write VxD's for the Win 9x/ME OS, using the MS Win98 DDK tools : don't forget to try and set the WIN40COMPAT flag ( define it in the assembly BEFORE including the DDK definitions, or as an option on the ML.exe command line ) !

This will ensure you target Win 95 as well as the newer versions. In case you have unknowingly made use of some 98- or ME-only function , the assembler will warn you in any case so no problem, either you revise your code if possible to avoid the offending function, or you renounce supporting 95 but at least you will know why you did !

Too often I found on this site VxD's which could work perfectly under 95, only they would not launch because they'd been compiled with the '98 DDK not using the above mentionned definition !!! Of course it's possible to patch the binary VxD afterwards using a hex editor changing the required DDK and SDK versions to 4.0 , but hey! that's a pain in the neck and it shows the lameness of the programmer at that ;)

HTH !
--
Cz.
cyco2
12-07-2002, 02:39 AM
I absolutly agree... it is lame if don't know that you are write VxD libraries for non W95 system... though... the question still keeps spinning to my head... are that still so many win95 users around?

if so, pls ignore this msg, I don't want to offend btw in any way, I'm just curious.

Goofy...
Woodmann
12-07-2002, 03:43 AM
Errrrrrrrrrrrrrr............

I am sure there are still some who use win 95 but,
The 98DDK will be replaced and people will stop writing for
98 just like 95 and 3.11.

Then what ? (I'm just asking)

Later, Woodmann


[q] Unpack of uncompressed exe.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > [q] Unpack of uncompressed exe.
PDA

View Full Version : [q] Unpack of uncompressed exe.

panicshift
12-07-2002, 04:12 PM
I try to dump calc.exe that not compressed.

so, run calc.exe, and in loadPE i do dump.

i confirmed that address of entry is same.

but, dumped.exe is crash.

What's the problem?

is this loadPE problem?

My Step :

1. Run Uncompressed calc.exe

2. Full dump with loadPE(option : Full dump : force RAW mode)

3. And run dumped.exe, but crash..

file size : same
Entry Addr : same

fc original_calc.exe unpacked.exe /b

000000D4: 00 5B
000000D5: 00 4C
000000D6: 00 6F
000000D7: 00 72
000000D8: 00 64
000000D9: 00 50
000000DA: 00 45
000000DB: 00 5D
00001094: 71 08
00001095: B8 B9
00001096: 83 00
00001097: 79 78
00001098: A3 E1
00001099: 5C 84
0000109A: 85 02
0000109B: 79 78
0000109C: 1A BB
0000109D: AC AD
0000109E: 83 00
0000109F: 79 78
000010A0: E5 78
000010A1: AC AE
000010A2: 83 00
000010A3: 79 78
000010A4: 96 4C
000010A5: 14 11
000010A6: 83 00
000010A7: 79 78
000010A8: E1 1E
000010A9: 42 3C
000010AA: 83 00
000010AB: 79 78
000010AC: 75 0C
000010AD: B1 B2
000010AE: 83 00
000010AF: 79 78
000010B0: 83 56
000010B1: 57 1F
000010B2: 83 00
000010B3: 79 78
000010B4: 03 6A
000010B5: EF F5
000010B6: 83 00
000010B7: 79 78
000010B8: 25 5A
000010B9: 46 3E
000010BA: 83 00
000010BB: 79 78
000010BC: 2F 64
000010BD: 46 3E
000010BE: 83 00
000010BF: 79 78
000010C0: 35 6A
000010C1: 46 3E
000010C2: 83 00
000010C3: 79 78
000010C4: 2C 70
000010C5: 7C BB
000010C6: 86 03
000010C7: 79 78
000010C8: 8F 26
000010C9: B3 B4
000010CA: 83 00
000010CB: 79 78
000010CC: F8 EA
000010CD: 14 1D
000010CE: 83 00
000010CF: 79 78
000010D0: 5E 70
000010D1: BA 3E
000010D2: 83 00
000010D3: 79 78
000010D4: 74 08
000010D5: 71 B5
000010D6: 86 03
000010D7: 79 78
000010D8: 04 9E
000010D9: 55 26
000010DA: 83 00
000010DB: 79 78
000010DC: 80 DC
000010DD: F1 F7
000010DE: 83 00
000010DF: 79 78
000010E0: CD 14
000010E1: 18 62
000010E2: 84 01
000010E3: 79 78
000010E4: 75 B5
000010E5: 2D 30
.......
........
00016800: 01 20
00016803: 00 60
00016804: 10 2E
00016805: 01 64
00016806: 00 61
00016807: 00 74
00016808: 00 61
0001680A: 13 00
0001680C: 65 84
0001680D: 78 0F
0001680E: 65 00
0001680F: 5C 00
00016810: 63 00
00016811: 61 30
00016812: 6C 01
00016813: 63 00
00016814: 2E 00
00016815: 64 10
00016816: 62 00
00016817: 67 00
00016819: 2E 30
0001681A: 65 01
0001681B: 78 00
0001681C: 65 00
00016828: 00 40
0001682B: 00 C0
0001682C: 00 2E
0001682D: 00 72
0001682E: 00 73
0001682F: 00 72
00016830: 00 63
00016834: 00 18
00016835: 00 26
00016839: 00 40
0001683A: 00 01
0001683D: 00 30
00016841: 00 40
00016842: 00 01
00016850: 00 40
00016853: 00 40
Kayaker
12-07-2002, 06:15 PM
Right you are. If you check in a hex editor and use LordPE itself (select View always first thunk) you'll see the changes from 1094-10E8 are the msvcrt.dll import addresses in the IAT. While they are bound imports (already have their addresses listed) in the original file, the PE loader is obviously reinitializing them to the real addresses on your own system. Nothing unusual here.

As for the other changes it does look like LordPE corrupts the resource section of the file it's dumping. What it seems to do is use the .rsrc section to make a copy of the PE header so it can add its little [LordPE] logo to it. The entire header from MZ to the section headers is duplicated there and is presumably copied into the correct position at the start of file later. This is the difference in the PE header from D4 to DB.
000000D4 5B 4C 6F 72 64 50 45 5D [LordPE]

I have to admit, while LordPE is a wonderful tool I've always been a little annoyed at its adding of this superfluous stuff. The early PEditor version of it added 60 bytes of "Modified with PEditor 1.7..." to the PE header and I found in a mini project we had long ago that it corrupted a particular file because it ran into the next section and overwrote a critical dword zero delimiter.

It was about this time I learned to make all modifications to the PE header manually and do all dumps as raw /dump Icedump dumps and not rely on any other tools. I'm sure LordPE could allocate some separate memory to make its changes instead of using the files .rsrc section.

Kayaker
nikolatesla20
12-07-2002, 07:52 PM
No, I beleive the real problem here is that you dumped calc.exe while it was running.

The first BIG thing all dumpers learn is to never to that. You have to SUSPEND the program at its OEP. Otherwise you will get initialized variables and initialized pointers. The program will see the pointers are already initialized and won't re-initialize them, and hence you get bad pointers all over the place, and in a computer, a bad pointer is death.

If there is one thing you must learn and keep with you at all times, it is DUMP AT SUSPENDED OEP.

-nt20
JimmyClif
12-07-2002, 08:51 PM
IIRC there's an option in LordPE to disable the little 'tag' it creates inside the PE header.... Some commandline thing.... Don't remember exactly how or where I read or saw that ;)

TTFN

JC


Damn i'm so near to unpack this one
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Damn i'm so near to unpack this one
PDA

View Full Version : Damn i'm so near to unpack this one

backeyes
12-07-2002, 04:44 PM
hello,

I spend two nights on Aston v1.8 and i know i can't be far from the goal (unpack it). The program can be found quite easily i think, just look for Aston and go to their official web site

First there's 3 exe protected with last asprotect version, to begin i unpacked Thwizard.exe and A-master.exe, but still have the same problem on them (crash at 40103F)

Take Thwizard.exe for example, here's what i did :
- double dip : i skipped first dip and keep second dip coz we need the value in a redirect call later
- dump at 4133FF which seems to be oep, but that's last asprotect version so we must add : 55,8B,EC,83,C4,F4,B8,1C,33,41,00
And now the oep is 4133F4 (- 400000)
- okay then i rebuild iat with no problem as it's not my first asprotect target, except we must be carefull here :
000222F4 user32.dll 0093 DialogBoxParamA

Now i thought all would be fully rebuild, but i traced and saw unpacked Thwizard.exe fucked at 40D3CB when it calls DialogBoxParamA...
I first thought this api wasn't DialogBoxParamA as it crashed and try to replace it with asprotect original code to have a better view, and same problem again, so i guess it's not the api...

Could you guys have a look ? thanks for you help again (and btw if i forgot to explain something just tell me, i'll correct that)
howie
12-08-2002, 01:59 PM
hi there,

i just downloaded the app and have some fast questions. i discovered 3. dips.

1. dip: 401014
simple return

2. dip: 41071c

41071d mov ebp,esp
41071f mov eax,[0041d4a0]
410724 mov edx,[ebp+08]
410727 mov [eax],edx // stores 6E3861 at 4212CC
410729 pop ebp
41072a ret 0004

3. dip: 4107b8

4107b8 push ebp
4107b9 mov ebp,esp
4107bb mov eax,[ebp+08]
4107be mov [0041d1cc],eax // stores 410730 at 41d1cc
4107c3 pop ebp
4107c4 ret 0004
4107c7 nop
4107c8 call [0041d1cc] // <- here it will be called
4107ce ret

here my question: u sure skipped the second dip, but why? this looks like a redirection, too. am i wrong?

oh..yes..oeip is 4133ff for me, too :) will have soe deeper look into it soon.
backeyes
12-09-2002, 06:35 PM
Hi,

First thanks fo your try on it ;)
And...no i don't think it's a dip problem, and i even try without skipping it to be sure

If you have a few times (it must take one minute...) to dump and rebuild it, we could see if you have the same problem

I still have an error calling 40103F and i know it happens when calling DialogBoxParamA but i guess there's a long piece of code between these two address so i can't find the precise location that call 40103F :(
Manko
12-09-2002, 10:01 PM
Hmm... No probs here...

Do I have to do anything special to trigger that error?

Did you perchance use that a there rv-helper... ??

If not... Need more info...

/Manko
backeyes
12-10-2002, 12:51 AM
I used ImpRec to rebuild the iat, in cutting thunks and so on, but i've just tried with revirgin and it works at least for Thwizard.exe and Aston.exe, because the third exe (A-master.exe) always keep saying :
Instruction at address "0x00000000" use memory address "0x00000000" ....

It's a bit strange because there's the same aspr version on all 3 files and only this one give me this error, but i keep looking for the problem atm ;)

Did you perchance use that a there rv-helper... ??

mm no i'm used to do a maximum manually, i prefer to learn a maximum of things hehe

Anyways i'll reply again when i'll have had a deeper look at third exe...
Thanks Manko to try it too :)

regards
Manko
12-10-2002, 09:16 AM
Ahh! oki. :)

I used rv first try, maybe why it worked. Haven't tried a-master...
Will maybe look into it later.

btw, if you zero out the iat-area before it's mangled/created you get a fresh nice iat with rv. ...and probably imprec too?

/Manko
backeyes
12-10-2002, 12:52 PM
Damn, my two working files work on my win 2k sp3 and win 98 but i gave them to a friend to test and it seems that it won't work on other's windows version, and it seems i get this problem with all last aspr version protected stuff

Manko check your pm please :)

regards
Manko
12-11-2002, 12:30 PM
Can't help you with Win"X"-compability... Have only W2k...

I solved A-Master last night, though. :)

It was interesting...

1.
It uses the same aspr-check I've posted about twice already, although this time it's not deced/inced but each byte is xored with it's rellative possition. And it never crashes inside it, since a SEH(?) has been initialized before it, wich continues the execution causing some variable to not be set and lets it crash later, diverting attention from it.

2.
When I get a fault in an unpacked asprd app I tend to consult dr.dawson... In this case the fault was on adress 00000000 so I looked at the returnadress instead and found an adress where getprocaddress is called and a jmp eax is made. Naturally this doesn't work unpacked. The asprd version gets an internal aspr-adress and puts it in eax. This address leads to a routine that puts the number of remaining trial-days in eax. :)

Go Patch! ;)

/Manko
backeyes
12-13-2002, 01:52 PM
thanks to Manko it finally works...

I knew that it was a fault on adress 00000000 but i couldn't find the return address, now it's done thanks to drwatson ;)

call getprocaddress
call eax <- eax = an aspr address, the call return our days left

That's why it crashed, it patched it with a double inc eax so that instead of 0 it returns 2 (always 2 days left...)

That's not all, after there was a bad value somewhere in eax that made a jump active, but if we jump the prog exits, so i patched it into two nop and it works fine

There's still one problem : i think all my unpacked aspr (last version only) run only on my win 2k sp3 and win 98 because i gave it to some friends of mine to test, and i don't have another windows version to have a look at the problem

Hope Manko and someone else could resolve this :)
thanks Manko again

regards
crUsAdEr
12-13-2002, 02:17 PM
Hi backeyes,

Well done on the job against aspr... anyway, here is a tip on how to find all these crash error.. debug it with Olly Debugger and set debugging exception to catch all Exception... then you will be able to find where call eax is generated, as well as aspr trick of checking loader present or not...

If you had posted your problem that it crashes at 0000000 then i think solution would have been provided much faster :) instead of saying generally that your dump crashes... anyway it is always good to work out things on your own :)....

Cheers,
crUsAdEr
backeyes
12-13-2002, 05:02 PM
ok i'll try to see with ollydbg too :)

thanks for this other tip
nikolatesla20
12-13-2002, 06:12 PM
My favorite technique is to "Faults ON" in SoftICE and then you can walk the stack.

Just do a "dd esp" and you will see what is on the stack. Take values that look like addresses, and unassemble them. This can help lead back to the problem area. Walking the stack is one of the most powerful techniques you can develop - of course it doesn't work at all with JMP's. Grr. However, on a fault, SI will tell you the last two addresses that were executed.

-nt20


+puark's never written articles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > +puark's never written articles
PDA

View Full Version : +puark's never written articles

yaa
12-08-2002, 12:29 AM
Hello,

today I have read an old article published by Fravia and written by +puark on how to better protect C programs and this is closed with +puark stating that future articles would have covered the following:

How to use encrypted strings and how to avoid having to decrypt them into memory
How to encrypt parts of your C and C++ program.
How to calculate Cyclic Redundancy Checks on part of your program
How to detect bpx and bpmb type breakpoints in your code
How to stop a cracker from getting any useful information from your program resulting from putting a bpmb for read or write on a key global data variable
How to use system API calls (such as MessageBoxA) in such a way that breakpoints on them never break and API Spy programs don't report their usage

Unfortunately +puark doesn't seem to have written any other article.
I wanted to document myself more on how to do the above things and was wondering if anyone here is willing to give me a hint or two on what to look for or experiment on.

Regards,
yaa


Interesting book
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Interesting book
PDA

View Full Version : Interesting book

separator
12-10-2002, 12:45 AM
I searched something at amazon.com and found this:

Crackproof Your Software (With CD-ROM) by Pavol Cerven

Did anybody read it? I think it is maybe interesting.
disavowed
12-10-2002, 03:03 AM
after taking a quick look at an excerpt, it's good to see that it's not a marketing scam full of buzz-words, and that it actually has real technical stuff in it. to quote:

---------------------
ASPack’s decompression routines contain several jumps that are designed to confuse a cracker but which really present problems only for the inexperienced ones. For example, ASPack’s decoding routine contains only a few anti-debugging tricks. If a file is loaded into SoftICE’s Symbol Loader, the program will not stop at the beginning. However, once you find the beginning of the program, insert INT 3h or an equivalent there, and set the breakpoint to this INT, then run the program, it will stop right at the beginning. Or, you can load the program into ProcDump and change the characteristics for the .text section. Here you will probably find C0000040; change that to E0000020 and the program should always stop at the beginning in the SoftICE loader. (I’ll describe this more fully in Chapter 7.)
------------------------

however, i don't know how much any of us could really learn from it. it seems like it (naturally) is aimed towards a coder who has little-to-no experience in reversing. overall, it's probably quite a good book for a shareware coder, but a waste of time for any of us
disavowed
12-10-2002, 03:05 AM
heh, woodmann, bug in vbulletin? :)
crUsAdEr
12-10-2002, 03:59 AM
disavowed :)... it is your quote VBcode, when using it you need to insert enter to break the line yourself.. :>

did u actually buy the book?
Kayaker
12-10-2002, 05:49 AM
Originally posted by disavowed
heh, woodmann, bug in vbulletin? :)

Heh, no, CODE tags are CODE tags, if there's no CF/LR in the text it'll keep scrolling forever to the right until it falls off your screen and beyond. I removed the tags so the default word wrap now kicks in and we can all read it ;)

Kayaker
separator
12-11-2002, 11:01 PM
to disavowed:
Yes, maybe you are right and this book is not interesting for crackers, but do you know other book about this topic? I don't and then I bought it. Now I can tell (write), this book is pretty interesting. Many informations and all of them in one place. There are many anti-debug tricks and I can write, this book is something like bible :)
Ofcourse there isn't everythhing and some informations are out of date, but still it is pretty good book.

Btw: At CD is special version of PESHiELD registered for book :)
Zero
12-17-2002, 03:44 PM
"Detecting Softice by calling INT 3h or 68h....."

well, if this is all this book can teaches us....
UrgeOverKill
12-25-2002, 04:15 AM
Even though the info is pretty selective I've read it and its nice to have that info all in one book. I think $35.00 is well worth it and recommend it to any newbie who needs a good reference point.

Besides any book that mentions The Owl can't be all bad.:D
disavowed
03-25-2003, 10:04 AM
http://ganzillo00.nm.ru/CrackproofYourSoftware_PavolCerven_pdf_en.rar
bart
03-25-2003, 12:43 PM
The who?
ryan
03-26-2003, 08:12 AM
It's a waste of money. If you know how to search, you will basically get every info there is in the book on the internet. There is nothing new. Hardly worth the money.
disavowed
03-26-2003, 09:53 AM
Originally posted by ryan
If you know how to search, you will basically get every info there is in the book on the internet.
umm.. no need to search, i just posted the url above
nofurs
03-26-2003, 10:48 AM
the link is Service Temporarily Unavailable
gonna find another one ;)
Kilby
03-26-2003, 12:04 PM
I will be kind and say that he must have researched the commercial games protections long before the book was written:

eg
---------

If you start a SecuROM−protected program from an original CD, you can dump it using the latest version of
ProcDump. While developers should consider this cracking possibility, it would be even better if SecuROM
itself concentrated on tackling this flaw.

----------

He also mentions Diablo 2 using securom

Well I hate to say this but for a very long time beforethe release of Diablo 2 procdump didn't dump securom files simply because all API calls pass through the securom decryptor.

Basically take all info in this with a very large pinch of salt.

Kilby...
r00t
03-31-2003, 11:22 PM
<No warez requests>
disavowed
04-01-2003, 03:47 PM
no clue


flexlm 8.0c sdk builds 8.0c makekey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > flexlm 8.0c sdk builds 8.0c makekey
PDA

View Full Version : flexlm 8.0c sdk builds 8.0c makekey

zhanzixin
12-10-2002, 01:59 PM
I have a target protected by flexlm 8.0d,
I got info below with the method Nolan Blender's Zendenc FLEXlm 7.2 cracking information essay supplied

vendor name "gxxxxxxLM"
job struct is
[009425B0] - 00000066 f...
[009425B4] - 009700a3 ....
[009425B8] - a566b39e ..f.
[009425BC] - d8bcaf0b ....
[009425C0] - 495cdefe ..\I

vendorcode struct after call
[0012EA38] - 00000000 ....
[0012EA3C] - 00000004 ....
[0012EA40] - 7808afc9 ...x
[0012EA44] - 811b262d -&..
[0012EA48] - 220a3bb4 .;."
[0012EA4C] - 7e844866 fH..
[0012EA50] - 9acbaf14 ....
[0012EA54] - 8ebb4b85 .K..
With the newest calcseed,which correct the g bug,I got the 2 seeds
seed1 = d754e6af
seed2 = 2e476f4b
also vendor key 1-4
With Mr. macilaci's method I got the same seeds,so i am sure the
seed1-2 and vk1-4 are correct.So I generate vkey5 with lmvkey, FlexSeedGen,lmrecode( with v8 support),no one can pass flexlm
SDK 8.0c 's validation. cause an error Invalid FLEXlm key data supplied FLEXlm error: -44,49
Any one can tell me : Is my vkey 5 wrong ,or 8.0c cannot generate
8.0d keygen? How can I get correct vkey5 satified 8.0d
zhzx@slof.com
zhanzixin
12-10-2002, 11:39 PM
vendor name = "geomaticLM" job struct is
[009425B0] - 00000066 f...
[009425B4] - 009700a3 ....
[009425B8] - a566b39e ..f.
[009425BC] - d8bcaf0b ....
[009425C0] - 495cdefe ..\I

vendorcode struct after call
[0012EA38] - 00000000 ....
[0012EA3C] - 00000004 ....
[0012EA40] - 7808afc9 ...x
[0012EA44] - 811b262d -&..
[0012EA48] - 220a3bb4 .;."
[0012EA4C] - 7e844866 fH..
[0012EA50] - 9acbaf14 ....
[0012EA54] - 8ebb4b85 .K..
Nobody
12-12-2002, 11:23 AM
They change the globalseed in 8.0d .
That's why you got the -8 return .
Check your 8.0d target's l_sg and l_zint to get the correct glseed
and seedval .
zhanzixin
12-13-2002, 01:10 AM
Hi Nobody

I have patched the lmrecode as PadsPCB said like below.
He said this glseed is up to 8.1 good.
Why it can't work on 8.0d?
Wish your reply. Thank you.

PadsPCB's post

For those of you who need, i've upped here a recode for up to 8.1
but only change in this particular is the glseed
case(8): /* version 8.0 */
glseed = 0x3CDE3EBF;
break;
and on nbl_svk
/* PATCH for version 8 - uses different value here. */
if (glseed == 0x3CDE3EBF)
{
seedval = 0x6F7330B8;
}

If anyone have success on 8.1 plese give me a call

Best

PadsPCB
Nobody
12-13-2002, 03:19 AM
I found the different seedval in VerificationNavigate 2002 (v8.0d in its daemon ).
if (glseed == 0x3CDE3EBF)
{
seedval = 0x50B99F4A;
}

Maybe you can try it and see if it's the root cause of your problem . If you have 8.1/8.2SDk ,please kindly share with us .
zhanzixin
12-13-2002, 03:26 AM
Thank you for your help. I have solve this problem absolutely.I 'll
list my work below as a return for people who help me.
fiist , I find something interesting. From my 8.0c protected app and
8.0c sdk I find the glseed and seedval 8.0c used are just the same as 7.x's, 0x788f71d2 and 0x7648b98e . And 8.0d use a different pair 0x3CDE3EBF, 0x6F7330B8 .These info can be extracted from l_sg and l_zinit easily.So i do my work step by step.
1 feeds info to lmcode.h with vkey1-4,seed1-2 and vkey5 generated by lmrecode with 8.0d glseed&val patched.
2 when an error occur, a lmnewgen.exe( or lmrand2.exe for MD link) generated. patch its l_zinit and l_sg with 8.0d glseed&val
and named it lmnewgen_for80d.exe
3 modify makefile
lmnewgen_for80d.exe demo.exe -o lm_new.c
4 run build and it pass correctly and lmcrypt.exe,makekey.exe etc
generated.
5 patch lmcrypt.exe,makekey.exe etc 's l_zinit and l_sg with 8.0d glseed&val. and all OK!
That all.
zhzx@slof.com
Nobody
12-13-2002, 04:23 AM
Sorry i give the wrong seedval. It's the constant use in l_n36buf to scramble with time derived random value. Not the seedval .Thank you for your information . You did the great job .
zhanzixin
12-14-2002, 12:16 PM
I summatize my work below so as not to reply to the e-mail one by one.
The background is, I have a target app protected by flexlm 8.0d,and
like most of you,I have only 8.0c SDK which was downloaded from the
CrackZ's Reverse Engineering Page.I also have latest calcseed and
lmRecode.
First,I make a lmgr8.0 sig file from the lmgr.lib and lmgr8a.lib and
lmgr_md.lib included in 8.0c SDK,and apply them to my target's deamon.
With some additional effort,I find l_sg,l_new,l_zinit,l_ckout_string_key etc.
Then I load the deamon into WDASM with the command line parameter like
"-T zzx 8.0 4 -c license.dat" and insert a break at l_new calling as Mr
Nolan Blender essay teach me.When step over call lm_new instruction I
got job struct,vendercode struct and vendor name.With calcseed I got
vendor key 1-4 and encseed 1-2.With the method of Mr. Maculaci I have
the same result,So I am sure these info are correct.After that I input
this data to lmrecode and vendor key 5 generated.I feed all of these
to lmcode.h of 8.0c SDK and build it, then a error occured after
lmnewgen.exe was generated:
Invalid FLEXlm key data supplied FLEXlm error: -44,49
Second,I checked the l_sg and l_zinit of lmnewgen.exe and found its glseed
and seedval are same as 7.x and defferent from 8.0d. The glseed&val pair
of 7.x up to 8.c are 0x788f71d2 and 0x7648b98e,and these of 8.0d and later
are 0x3CDE3EBF, 0x6F7330B8.Please note it when you use lmrecode or other
lmtools.
The following work is easy.All my keys and seeds are correct,but not fit
for 8.0c.So I patch lmnewgen.exe:

_l_zinit proc near ;
push ebp
mov ebp, esp
sub esp, 8
mov eax, [ebp+arg_4]
neg eax
sbb eax, eax
and eax, 0D0E83B58h
add eax, 788F71D2h ; glseed !!!!!!!!!!!

_l_sg proc near
push ebp
mov ebp, esp
sub esp, 24h
mov [ebp+var_C], 7648B98Eh ; seed val !!!!!!!!!

and rename it to lmnewgen8.0d.exe.
modify makefile
lmnewgen demo.exe lm_new.c
to
lmnewgen8.0d demo.exe lm_new.c
Run build.bat and no more error and lmcrypt.exe,makekey.exe etc generated.
Run lmcrypt.exe license.dat the error occur again:
Invalid FLEXlm key data supplied FLEXlm error: -44,49
So we should patch lmcrypt.exe,makekey.exe etc one by one if you need,I
think lmcrypt.exe is enough. It has the same _l_sg and _l_zinit so you
can patch it easily.
That all. I don't know how about 8.1 because I have neither 8.1 target
nor 8.1 sdk.
zhzx@slof.com
Meneldor
04-12-2004, 01:31 AM
Hi to everyone!
Are there anybody who practiced this strategy? I have several questions...


help on unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help on unpacking
PDA

View Full Version : help on unpacking

klika
12-10-2002, 05:56 PM
Hi, I`m a beeginer and have a question about unpacking this program, program won`t load if Softice is loaded, and
when I load program first and the Softice Windows reboots, W32dsm89 also crashes, I can load it with IDA
and OllyDBg. PEiD reports that file is Win32 PE File - GUI, pe-scan reports that no packer is found, but when I load
it into OllyDBg reports "Compresed code? Quick statistical test of module TREK reports that its code section is
either compressed, encrypted or contains large ammount of embedded data." Here is beginning of program, so can
you please take a look and point me in a right direction.

00412000 > $ E8 17190000 CALL TREK.0041391C
00412005 . 40 INC EAX
00412006 . F2:6F REPNE OUTS DX,DWORD PTR ES:[EDI] ; I/O command
00412008 . C3 RETN
00412009 A8 DB A8
0041200A AF DB AF
0041200B 05 DB 05
0041200C 99 DB 99
0041200D 07 DB 07
0041200E 5D DB 5D ; CHAR ']'
0041200F FF DB FF
00412010 18 DB 18
00412011 84 DB 84

0041391C $ F8 CLC
0041391D . 73 01 JNB SHORT TREK.00413920
0041391F A9 DB A9
00413920 . 60 PUSHAD
00413921 . 836C24 20 05 SUB DWORD PTR SS:[ESP+20],5
00413926 . F9 STC
00413927 . 72 06 JB SHORT TREK.0041392F
00413929 . 54 PUSH ESP
0041392A 2B DB 2B ; CHAR '+'
0041392B A2 DB A2
0041392C 5C DB 5C ; CHAR '\'
0041392D AF DB AF
0041392E D2 DB D2
0041392F . 8B5424 20 MOV EDX,DWORD PTR SS:[ESP+20]
00413933 . C1CF 20 ROR EDI,20 ; Shift constant out of range 1..31
00413936 . C602 D2 MOV BYTE PTR DS:[EDX],0D2
00413939 . C742 01 6EAF67>MOV DWORD PTR DS:[EDX+1],7367AF6E
00413940 . BF 1C190000 MOV EDI,191C
00413945 . BB 4292666F MOV EBX,6F669242
0041394A > C00A 0F ROR BYTE PTR DS:[EDX],0F
0041394D . C102 CC ROL DWORD PTR DS:[EDX],0CC ; Shift constant out of range 1..31
00413950 . 87C0 XCHG EAX,EAX
00413952 . 66:8102 15EF ADD WORD PTR DS:[EDX],0EF15
00413957 . C1C6 20 ROL ESI,20 ; Shift constant out of range 1..31
0041395A . 66:C102 10 ROL WORD PTR DS:[EDX],10
0041395E . 8002 8D ADD BYTE PTR DS:[EDX],8D
00413961 . 8032 A2 XOR BYTE PTR DS:[EDX],0A2
00413964 . EB 00 JMP SHORT TREK.00413966
00413966 > 802A 09 SUB BYTE PTR DS:[EDX],9
00413969 . 87D2 XCHG EDX,EDX
0041396B . 311A XOR DWORD PTR DS:[EDX],EBX
0041396D . 66:812A 3FEC SUB WORD PTR DS:[EDX],0EC3F
00413972 . 8102 02155647 ADD DWORD PTR DS:[EDX],47561502
00413978 . F8 CLC
00413979 . 73 02 JNB SHORT TREK.0041397D
0041397B . 40 INC EAX
0041397C 89 DB 89
0041397D . C10A BE ROR DWORD PTR DS:[EDX],0BE ; Shift constant out of range 1..31
00413980 . EB 01 JMP SHORT TREK.00413983
00413982 ? 08F9 OR CL,BH
00413984 . 72 04 JB SHORT TREK.0041398A
00413986 15 DB 15
00413987 32 DB 32 ; CHAR '2'
00413988 . 95 XCHG EAX,EBP
00413989 . 3F AAS
0041398A . 83C2 04 ADD EDX,4
0041398D . C1CB 77 ROR EBX,77 ; Shift constant out of range 1..31
00413990 . C1C6 20 ROL ESI,20 ; Shift constant out of range 1..31
00413993 . 83EF 04 SUB EDI,4
00413996 .^0F85 AEFFFFFF JNZ TREK.0041394A
0041399C . 61 POPAD
0041399D . C3 RETN
Program starts to loop in this part.

Also when I attach to the proccess I cant see part of the program in which I want to change few jumps (when program is in the main menu), that part becomes
visible only when I click on button which starts that part of the program, so I cant patch it, strings in that part are
not visible when program is in main menu, is that some sort of realtime encryption/decryption. Here is that part when program
is in main menu and after that is listing which becomes visible when I click on button that starts that part of program.

00B9C5EF C7 ??? ; Unknown command
00B9C5F0 B8 81D64D42 MOV EAX,424DD681
00B9C5F5 7C 03 JL SHORT 00B9C5FA
00B9C5F7 092D 06122820 OR DWORD PTR DS:[20281206],EBP
00B9C5FD 2118 AND DWORD PTR DS:[EAX],EBX
00B9C5FF 21A2 BC554BE5 AND DWORD PTR DS:[EDX+E54B55BC],ESP
00B9C605 96 XCHG EAX,ESI
00B9C606 57 PUSH EDI
00B9C607 4A DEC EDX
00B9C608 90 NOP

when button is clicked:

00B9C5EB 8B95 78FBFFFF MOV EDX,DWORD PTR SS:[EBP-488]
00B9C5F1 B8 F0CBB900 MOV EAX,0B9CBF0
00B9C5F6 E8 6D8BF4FF CALL 00AE5168
00B9C5FB 85C0 TEST EAX,EAX
00B9C5FD 74 16 JE SHORT 00B9C615
00B9C5FF B9 00CCB900 MOV ECX,0B9CC00
00B9C604 B2 01 MOV DL,1
00B9C606 A1 FC69B900 MOV EAX,DWORD PTR DS:[B969FC]
00B9C60B E8 000FF5FF CALL 00AED510
00B9C610 E8 E77EF4FF CALL 00AE44FC
00B9C615 8D95 74FBFFFF LEA EDX,DWORD PTR SS:[EBP-48C]
00B9C61B 8BC3 MOV EAX,EBX
00B9C61D 8B08 MOV ECX,DWORD PTR DS:[EAX]
00B9C61F FF51 1C CALL DWORD PTR DS:[ECX+1C]
00B9C622 8B95 74FBFFFF MOV EDX,DWORD PTR SS:[EBP-48C]
00B9C628 B8 30CCB900 MOV EAX,0B9CC30
00B9C62D E8 368BF4FF CALL 00AE5168
00B9C632 85C0 TEST EAX,EAX
00B9C634 0F85 A9000000 JNZ 00B9C6E3
crUsAdEr
12-11-2002, 12:42 AM
Hi klika,

For this kind of program using obfuscation, your best bet is to use IDA to disassemble it... then you can disassemlbe and study it properly.. it has nice idc script feature which allow you to modify the disassembly, remove garbage code etc...

What target is that? Looks like a crackme to me?

cheers
crUsAdEr


Mini-tute: Getting rid of Armadillo nag
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Mini-tute: Getting rid of Armadillo nag
PDA

View Full Version : Mini-tute: Getting rid of Armadillo nag

nikolatesla20
12-10-2002, 07:22 PM
Heh. Hope someone finds this useful/cool. Just got er done.

********************** KILL THE NAG *************
***
*** Target: Armadillo 2.65 build 2221
*** Freed By: nikolatesla20
*** Date: December 10, 2002
*** Purpose: Freeing
***
*************************************************

Hi all,

This is a tutorial about using armadillo to protect your own files without having to have a registered armadillo program.

I've been working with Armadillo for a little while now, just trying weird things to see how I can break it. I've been protecting my own test files, and then trying to load them into my own loaders, debuggers, etc, to edit memory during run time. Most of the time armadillo seems to catch something is wrong if it's too early, and it bombs out on you. I tried one very unique thing this morning however, and it worked, and I think it's quite hilarious......:)

When you download the armadillo evaluation, there really are no limits. You are allowed to use it as long as you wish, but you cannot distribute with it. The main item that prevents you from you doing so is a nice little nag screen that comes up before your protected app that says "This version of armadillo is not registerd..blah..blah..not licensed for distribution". Since CruSader already gave us such a nice tutorial on removing armadillo protection, I decided to try an opposite approach, so I could USE armadillo, but I'd have to kill this nag in my own protected apps. It really is no problem to dissassemble a protected file in IDA, but you won't find the nag in there anywhere. Why? Because it's in the DLL that gets decompressed into memory during runtime. This is the "arma.dll" that CruSader tells us how to dump from memory.

But still, that doesn't help us, because then the only way around it would be to patch that file in memory after it was unpacked during your protected program's startup. The only reliable way to do that would be to either inject code or put another wrapper around your already protected application. I tried those techniques and got away with some things (like adding another section, etc.) but not others (couldn't use a cave). Armadillo was pretty good at preventing any code redirection as well, with some sort of CRC checks and stuff.

Suffice it to say I got bored looking at doing it this way. What I really needed was a way to have the armadillo.dll file ALREADY be how I wanted it BEFORE it ever made its way into my protected application. Well, I found the way to do that.

CruSader seemed happy that he could dump the armadillo.dll from memory while in his protected app, but did you know that it simply sits naked inside armadillo.exe itself? Yes, its just a simple resource file. And lo and behold, its not even CRC checked. Can you believe it?

So for starters, if you don't have a dumped dll file from going through CruSader's tutorial, you can get one very easily by using eXeScope and opening armadillo.exe, and going to the resource section. The DLL's are under the "HEADERS" resources. Take the third one in the list, and export it as "whatever3.dll". Now you have a clean DLL. No memory dumping required ! It's not even encrypted ! *oops* Silicon Realms!

Open that sucker up in IDA. Go to "MessageBoxA" reference, and double click on the second call reference and you will see this code:

.text:1000E9BD sub_1000E9BD proc near ; CODE XREF: sub_1000DE51+606p
.text:1000E9BD ; sub_1000E55A+33j ...
.text:1000E9BD
.text:1000E9BD var_4 = dword ptr -4
.text:1000E9BD
.text:1000E9BD push ebp
.text:1000E9BE mov ebp, esp
.text:1000E9C0 push ecx
.text:1000E9C1 push ebx
.text:1000E9C2 push esi
.text:1000E9C3 push edi
.text:1000E9C4 call sub_1000F40B
.text:1000E9C9 mov eax, dword_10022EC4
.text:1000E9CE mov esi, ds:MessageBoxA
.text:1000E9D4 mov ebx, 10040h
.text:1000E9D9 mov edi, offset aDistributionWa ; "Distribution Warning"
.text:1000E9DE mov eax, [eax+4ECh]
.text:1000E9E4 test eax, eax
.text:1000E9E6 jz short loc_1000E9EF <-- this checks for a good message string in memory
.text:1000E9E8 push ebx ; uType
.text:1000E9E9 push edi ; lpCaption
.text:1000E9EA push eax ; lpText
.text:1000E9EB push 0 ; hWnd
.text:1000E9ED call esi ; MessageBoxA
.text:1000E9EF
.text:1000E9EF loc_1000E9EF: ; CODE XREF: sub_1000E9BD+29j
.text:1000E9EF mov ecx, dword_10022EC4
.text:1000E9F5 call sub_1000B710
.text:1000E9FA test eax, eax
.text:1000E9FC jz short loc_1000EA10

Notice that jump if zero on 1000E9E6? It will completely jump over showing the "unregistered" nag if it notices that there is no string in memory to show. We want that jump to jump always, in other words, change its byte from 0x74 to 0xEB. So let's do it!

Open up LordPE or PEditor and get the Hex offset in the file of that instruction and write it down. I came up with 0xE9E6.

Now, open armadillo.exe again in eXeScope. Go to the "HEADERS" resources again, and click on the third item (Resource ID 121 in my version). This is one of two versions of the armadillo.dll (ID 121 and ID 153). Anyway, notice it already has an offset in the file. Fire up Calc.exe and add (Resource offset + instruction offset). BE sure you are in HEX mode in Calc!. This is where you will find the offending instruction. Now, scroll down in eXeScope to the address. I have the latest armadillo evaluation version (2.65 build 2221) and the address I got was 0x97466. Once you get there, simply type in the new byte value "EB". Done!. Now you have to do the same thing for the second version of the DLL. The difference between them as I found was one uses SI detection, and the other doesn't.

The other DLL is Resource ID 153. I'll let you calculate the offset to the instrcution. REMEMBER tho that you will have to export and dissassemble this DLL to get the instruction's address again. Since its a different version it won't be in the same place. Once you have edited both resources, you are good to go! Go back out and protect your file, and test it. Wooot! No more nag screen. Now I must say that is quite sad that the Silicon Realms guys put so much work into "anti-crack", etc, but they never seem to bother checking their prebuilt code blox. Well I guess others can enjoy the mistakes eh?

'Til next time...

-nt20

*Remember you have to BUY software if you really want to use it so if you use this software please support the authors and purchase it*
crUsAdEr
12-10-2002, 11:30 PM
Very nice, Nicola :)...

I exported all teh 5 dlls and look at them, but they are also different from the dll i dump??? Funny.. i guess armadillo append which dll depends on which option of protection you choose??? Not sure...

Armadillo is a weak protection heh... now that it has also been keygenned and unpackers are coded (private though)... i guess we'll expect armadillo 3.0 soon, wonder why there are still apps protected with armadillo...

Next packer on the bashing list :)??? any idea :)?

cheers
crUsAdEr

P.S : Nikla, maybe you could study armadillo further and tell us how the different dll are used.. i am going on my holiday :)... have fun and keep us up to date with reversing :)
nikolatesla20
12-11-2002, 12:44 AM
Thanks for the comments crusader...sometimes I feel though I may never approach the skill level that you are upon! I just try to think out of the box when I can as well :)

Ya, crusader, it appears to use a different file depending on the protection options you choose.

By the way, two of those files are actually EXE's. You can tell by looking at their imagebase. In fact, it's basically the entire code the gets wrapped around your app. They all come together to form the final protected program.

OH - just one more thing for you crusader if you are reading this, I dumped arma itself but I'm still having trouble fixing the int3's..oh well. Thank you very much for the information and tutorials !

As for the next protection....well you know Code-Lock still has not been fully defeated. Although it's easy to pirate (just hard to "*rack").

I have an idea for a new utility but I still haven't had much success coding it yet. It would be a utility to help reverse protections that use COM objects, such as Code-Lock. AND event tho armadillo has been defeated by a lot of people, I still wouldn't mind to continue trying to make my own little unpacker, just to learn how its done. But I haven't gotten too far just yet.

-nt20
crUsAdEr
12-11-2002, 01:20 AM
Hi Nikola,

What is the problem with int3 fixing? I was thinking of coding a generic int3 fixing prog but i have no time, and arma is losing my interest...

CodeLock :)? Probably nice protection but i reverse for the fun of it, and VB is not fun to reverse so ah well... maybe, one day but not now :)...

cheers,
crus
nikolatesla20
12-11-2002, 02:14 PM
Um ok, this is the int3 trouble I was having. I know I can edit your dumpfixer sources, but I just thought it would be good to explain this.

I'm a "fairly" certain I've followed the dumping of the jump tables from memory correctly. I dumped the whole table in one chunk actually the third time I was trying this, and then just broke it up with Hex Workshop into the 4 pieces required.

Basically, and I know I dont want to depend on canned tools of course (gotta use your brain), the EXE that exists right now for fixing exits telling me it can't find the right jump opcodes. OK. So I walked thru the code manually , no not debug mode, just on paper and pen , to see what it was doing. What was wrong with my tables....

The first thing that makes me wonder is the address table that I get from arma. Here is a snippet from its beginning. I know this is the beginning because I stepped thru the code to find out the exact address it was using for the address table (table_1).

Here are excerpts from the 4 tables, I've brought out the first value on its own for your inspection.

This is the address table (table_1)

69214000
462F4000503640003E3C4000B74240000D4340008C44400021464000024E4000086A40002C6A4000AB6B4000B86B4000BF6B4000C16B4000B1764000BE764000C5764000D7764000E0764000

Here is the first entry in the "distance" table (table_4):

90E0BFFF
D6D0BFFFC9CABFFF0BC4BFFFB5BDBFFF67BDBFFF6ABBBFFF16B9BFFFC3B2BFFF1C97BFFFC497BFFF04000000

That's a pretty big negative number!

And here is the "jump instruction length"

05
010501010101040405040405010404050505010401010104050505010101010404050505050501010101050101040405

and finally the "jump type"

02
020E0D02080E0E0E0E02020E0E020C0C0C0E0C08110E0C1108110E0C010E0E020C0C0C020211020E02110E0E0E02020E

If you notice the first address in this table is 00402169. And yes, if you go to that location in a HEX editor there will be a CC byte one bye before it. However, if you look at the code location in WinDASM, it appears to be a valid code sequence:

:00402113 55 push ebp
:00402114 8BEC mov ebp, esp
:00402116 83EC54 sub esp, 00000054
:00402119 8B4508 mov eax, dword ptr [ebp+08]
:0040211C 53 push ebx
:0040211D 56 push esi
:0040211E 57 push edi
:0040211F 8D9800100000 lea ebx, dword ptr [eax+00001000]
:00402125 6A12 push 00000012
:00402127 59 pop ecx
:00402128 8D75AC lea esi, dword ptr [ebp-54]
:0040212B 8BFB mov edi, ebx
:0040212D C745AC886A3F24 mov [ebp-54], 243F6A88
:00402134 C745B0D308A385 mov [ebp-50], 85A308D3
:0040213B C745B42E8A1913 mov [ebp-4C], 13198A2E
:00402142 C745B844737003 mov [ebp-48], 03707344
:00402149 C745BC223809A4 mov [ebp-44], A4093822
:00402150 C745C0D0319F29 mov [ebp-40], 299F31D0
:00402157 C745C498FA2E08 mov [ebp-3C], 082EFA98
:0040215E C745C8896C4EEC mov [ebp-38], EC4E6C89
:00402165 C745CCE6212845 mov [ebp-34], 452821E6 <- supposedly there's an int3 here
:0040216C C745D07713D038 mov [ebp-30], 38D01377
:00402173 C745D4CF6654BE mov [ebp-2C], BE5466CF
:0040217A C745D86C0CE934 mov [ebp-28], 34E90C6C
:00402181 C745DCB729ACC0 mov [ebp-24], C0AC29B7
:00402188 C745E0DD507CC9 mov [ebp-20], C97C50DD
:0040218F C745E4B5D5843F mov [ebp-1C], 3F84D5B5
:00402196 C745E8170947B5 mov [ebp-18], B5470917
:0040219D C745ECD9D51692 mov [ebp-14], 9216D5D9
:004021A4 C745F01BFB7989 mov [ebp-10], 8979FB1B
:004021AB C745F804000000 mov [ebp-08], 00000004
:004021B2 F3 repz
:004021B3 A5 movsd

It's just that it doesn't look like this location needs patching at all, in fact, if you run thru arma, I put a bpx on the code that reads from the tables, (especially the address table) and it never breaks on any address below 00416000. In other words, an Int3 never comes thru with an address below that. I have no idea why these lower addresses are in the table..I'd say about the first 10 or so addresses for sure appear to contain valid code sequences. The only thing I can think of is of course to mislead an autopatcher.

I'm thinking all you really need to do in the dumpfixer is to ignore errors and just keep going on to the next location, instead of bombing out right away. Only thing I can think of right now.

I still must be missing something..mabye this is going out on a limb but seems like some of these int3's might be function calls now and not just jumps..

-nt20
crUsAdEr
12-11-2002, 02:55 PM
No Nikola,

Sorry for the misleading info but the DumpFixer will not bomb out as you think... not all the address in the tables are used... if you look at my source code, it will walk the address table, read each address, munis 1 byte, then check if there is a CC there, if there is then it is an int3 replacing jump, if not then get next entry of table...

The dump fixer will only bomb out because the jump type classification is changed... for my version of armadillo for example, jump type B is a LONG JUMP E9xxxxxxx but for another version it is a JNZ short jump for example.. hence the program will check the length of the instruction as well, just to be sure not to mess thigns up... That is why my fixer bomb out...

So to make it work for your case, you will need to look into the Jump_classify routine of armadillo server to get the type number and then rearrange the order of my Data declaration... the first entry is type 0, then Type 1 etc... that is all you need, then compile and run...

You can try coding somethign more generic, that will read the Jump_Classify routine automatically and retrieve the jump type classification etc...

Hope this helps,
crUsAdEr
nikolatesla20
12-11-2002, 03:04 PM
Thanks crusader, yep I just thought of that, and was starting to look into it :) I figured the jump codes must have changed in this version.

-nt20
nikolatesla20
12-11-2002, 05:07 PM
crusader , just one more little bit of help, and I've got it. Thanks for the help so far.

Look, I just have trouble with bit ops in my head. I can handle AND and OR but SBB and NEG are killing me for some reason. Does this look right?

mov edx, [ebp+Context_Arg]
.text1:0045357B mov eax, [edx+CONTEXT.EFlags]
.text1:00453581 and eax, 0C0h ; Check zero flag and sign flag
.text1:00453586 neg eax ; eax negative if either flag is set
.text1:00453588 sbb eax, eax
.text1:0045358A neg eax ; eax = 1 when neither flag are set
.text1:0045358C jmp loc_453626

I just can't get my head around it ! grr!
-nt20
crUsAdEr
12-11-2002, 05:21 PM
Yep...

Here is my version

case_2:
mov ecx, [ebp+context]
mov eax, [ecx+CONTEXT.EFlags]
and eax, 0C0h ; check Zero and Signed flags
neg eax ; set Carry flag if eax!=0
sbb eax, eax ; eax = 0 if Carry flag not set
inc eax ; al = 1 if S and Z flags both not set
jmp loc_44F1FC ; al = 0 if either flag set
; JG

It will jump when al==1

Hope this helps :)...
crUsAdEr
nikolatesla20
12-11-2002, 06:56 PM
*sigh*

I fear this is over my head for now. I just start falling asleep looking at bit ops. I thought I had the order right, but the my dumpfixer still wont work.

Guess I need to sleep on it some more

-nt20
nikolatesla20
12-11-2002, 08:59 PM
ALright!

I got it yay!

I went thru and did as many as the jumps as I could looking at IDA ( I mean I figured out the "jump table"). Then rearranged your JMP opcodes to match.

The problem was that I did happen to have a bad table_2 dump. I was missing the first 4 bytes. I ran armadillo again and put a bpx in the code that get the jump type and noticed that my table wasn't in the right location, so I went back out the hex workshop and fixed it, ran the patcher, and it worked.

armadillo is now running just fine all unwrapped and happy. AND it's a LOT faster.

Thanks for your help and bearing with me, crusader ! (I still hate looking at bitwise ops tho)

-nt20 (happy boy :) )

oh, and here's the new asm code for patching the int3's of the latest armadillo evaluation version.
szon
12-13-2002, 08:02 PM
Hmmm you want to crack it but i saw few days ago keygen for armadillo :>
nikolatesla20
12-13-2002, 10:22 PM
Keygens wont allow you to disasm the code to perform your will upon it.

There are several ways to approach a target. Why do some consider patching to be "ugly?". I consider it the just as good as keygenning, isn't the whole point to reverse engineer? Yes it is. When data is on my hard drive, it belongs to me. I wish to modify it. While I would say people who write keygens are very intelligent to be able to figure out the algorithms involved, everyone had their own preference.

I do not prescribe to any particular reverse engineering religion. No thank you, I respectfully decline.

-nt20
Iwarez
12-13-2002, 10:43 PM
Also using someone else's keygen won't make anyone any smarter. Reverse engineering a protector and understanding the inner part does. After that you can always decide to use the keygen.

My noble opinion...
ReaL|sTy
01-02-2003, 10:28 PM
great information... thid board is great to share knowledge and information this is great information and i just grabbed it ;) sure armadillo ins't so good at all you can even patch the main Nag window for the armadillo program without unpacking it and just one byte hex edited needed 82/90 or 80/7E if you know what i mean :p i agree with iwarez comment. thanks god people and board like this one exist!
SpeKKeL
02-07-2003, 11:57 AM
Hajo,

H'mmm we are back in town .....??!!
I was playing with lydia (email checker) what i think is a nice prog(fast and easy).It's protected with armadillo and i just wondered if i could patch the prog in high memory(9xxxxx), but i can't.
I found the places:expired or not ,the set back clock check and even a nice build in utility which is called fixclock (it resets the install date to the time it is,so another 30 days to go)
So if i only could patch it(i used all memory patchers but all faild)
Any solutions for patching ??

(btw removing the nag works 100 %)

SpeK.


Best memory searcher?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Best memory searcher?
PDA

View Full Version : Best memory searcher?

Aquatic
12-12-2002, 07:00 AM
What is the best tool for searching for values in a program's memory? The only good one I know is TSearch, but even that is limited sometimes.
Manko
12-12-2002, 08:26 AM
I use WinHex. Dunno about TSearch...

/Manko
Solomon
12-12-2002, 08:53 AM
winhex
FoolFox
12-12-2002, 09:45 AM
Yeah, WinHex rules... :)

Regards
FoolFox
Aquatic
12-17-2002, 10:49 AM
WinHex isn't anything like TSearch. TSearch lets you search for a value in memory, then change the value in the application, then search for the new value by setting conditions like "value has decreased" ..etc (as a process of filtering the results till you get the address you want).
Manko
12-17-2002, 12:43 PM
If you wanted a tool to cheat in games, why didn't you just say so? :P
Search the net, they're not hard to find.

/Manko
Bengaly
12-18-2002, 07:09 AM
check out http://gamehacking.com/
comrade
01-04-2003, 03:56 AM
WinHack has many features, and I also like GenTrain. Both let you do multi-step comparative searches.


softice symbols ramblings
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice symbols ramblings
PDA

View Full Version : softice symbols ramblings

flekso
12-12-2002, 12:22 PM
how come softice complains about missing symbols then stops after you supply it with some files that contain symbols - shouldn't symbols (if present) be located in the image file itself?


New ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New ?
PDA

View Full Version : New ?

SpeKKeL
12-12-2002, 01:45 PM
Hajo,

After formatting all my drives i lost all my sources etc.....:mad:
So after installing all my debug-progs i started to unpack our
beloved aspred-tagets :D

My first target was some advanced registry tracer.It looks like some new (correct me if it isn't) redirection scheme for some
imports (winexec,loadlibrarya,createprocessa).

Cause i didn't had any sources anymore i began to write a new
plugin.
I know this should be one of the other xxxx, but i did more for my
programm development(very very low)

Just take a look at the prog and who wants to test my aspr-resolver just yell !

Found another one: absolute internet eraser pro.
and latest awave studio..okee lot's
of targets for you to play......

Ciao,

Spekk


Cyberheg SuperPro Shell Tuts help please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Cyberheg SuperPro Shell Tuts help please
PDA

View Full Version : Cyberheg SuperPro Shell Tuts help please

sope
12-12-2002, 02:41 PM
Hi, to all

I am working on a target & i don't have the dongle.
Reading Cyberheg tuts on Breaking the shell i have marked the similar
type of code which i come across in the tut.

I found the main switch & below the result
First time we have
msg (1) CD03

00FB1DE5 callby_CD03: ; CODE XREF: start+20Aj
00FB1DE5 mov ax, :word_FA7C4C-->ax=03D5
00FB1DEB mov ecx, :dword_FA7C40--ecx=FA6CA8
00FB1DF1 push eax
00FB1DF2 push ecx
00FB1DF3 call sub_FB16C0 ; depending on ax we have value in eax
00FB1DF8 add :off_FA7C38, edi; this subtracts 4 (add 0xFA7C38, 0xFFFFFFFC = 0xFA7C34)
00FB1DFE mov ecx, :off_FA7C38 ecx=FA7C34
00FB1E04 add esp, 8
00FB1E07 mov :dword_FA7C40, eax -->eax=FA6CA8
00FB1E0C mov [ecx], eax -->save it
00FB1E0E jmp continuedelay

msg (2) BA51 ---> Calls SproFindNextUnit &
Calls sproFormatPacket & fills 0x404 bytes (1028 bytes) with defaults i guess.

msg (3) 22B7

00FB1B2A call sub_FB16C0 ; get our response
00FB1B2F add esp, 8
00FB1B32 mov ecx, :off_FA7C38 ; get constant ecx=0xFA7C34
00FB1B38 sub [ecx], eax ; subtract eax=0
00FB1B3A jmp continuedelay ; continue

msg (4) 0611

00FB1A14
00FB1A14 loc_FB1A14: ; CODE XREF: start+28Aj
00FB1A14 ; start+297j
00FB1A14 mov eax, :off_FA7C38
00FB1A19 add :off_FA7C38, esi
00FB1A1F cmp dword ptr [eax], 0
00FB1A22 jz continuedelay ; was the result zero?
00FB1A28 mov eax, :dword_FA7C40
00FB1A2D mov :off_FA7C3C, eax
00FB1A32 jmp continuedelay

Default the result will be zero and the jump will occur. So far so good.

msg (5) 1A44 ---- GetQuery

00FB1AE0 callby_1A44: ; CODE XREF: start+107j
00FB1AE0 add :off_FA7C38, edi (subtracts 4 --> FA7C38-4 = FA7C34)
00FB1AE6 call :dword_FA7C40 ; Call GetQuery
00FB1AEC mov ecx, :off_FA7C38 ; get where to save
00FB1AF2 mov [ecx], eax ; save -->eax=0
00FB1AF4 jmp continuedelay ; continue

msg (6) CD03 (2nd Time) CD03 look up after the Call subtracts 4 from FA7C34 which become FA7C30
mov [ecx], eax -->stores eax = 0xFA5004 in ecx = 0xFA7C30

msg (7) CD03 (3rd Time) CD03 look up after the Call subtracts 4 from FA7C30 which become FA7C2C
mov [ecx], eax -->stores eax = 0xFA5290 in ecx = 0xFA7C2C

msg (8) 22B7 (2nd time)

00FB1B1C callby_22B7: ; CODE XREF: start+124j
00FB1B1C mov ax, :word_FA7C4C ax=0x03D5
00FB1B22 mov ecx, :dword_FA7C40 ECX=0xFA5004
00FB1B28 push eax
00FB1B29 push ecx
00FB1B2A call sub_FB16C0 ; get our response
00FB1B2F add esp, 8 EAX = FA5004
00FB1B32 mov ecx, :off_FA7C38 ; get constant ECX=FA7C2c
00FB1B38 sub [ecx], eax ; subtract in my case FA5290-FA5004=00008C02 = 028C0000
00FB1B3A jmp continuedelay ; continue

Doubt: I want to clarify is 0000028C is the constant for this target ? This is also used in msg B323 Decrypting
routine see below B323

continue.... next post pls...
attached a file ask.zip
sope
12-12-2002, 02:44 PM
continue from above post ....

msg (9) CD03 (4th Time) below is the code & value

00FB1DE5 callby_CD03: ; CODE XREF: start+20Aj
00FB1DE5 mov ax, :word_FA7C4C-->ax=0234
00FB1DEB mov ecx, :dword_FA7C40--ecx=FA5000 VA of Section 7
00FB1DF1 push eax
00FB1DF2 push ecx
00FB1DF3 call sub_FB16C0 ;
00FB1DF8 add :off_FA7C38, edi; EAX=0x16E8B35
the addition actuall subtracts 4 (0xFA7C2C-4 = 0xFA7C28)
00FB1DFE mov ecx, :off_FA7C38 ecx=FA7C28 where to save
00FB1E04 add esp, 8
00FB1E07 mov :dword_FA7C40, eax
00FB1E0C mov [ecx], eax -->save eax=16E8B35
00FB1E0E jmp continuedelay

msg (10) B323 ---> call the Decrypting Routine

00FB1D7B callby_B323: ; CODE XREF: start+1EFj
00FB1D7B mov ebp, :off_FA7C38
00FB1D81 mov eax, :off_FA7C38 ; response address
00FB1D86 add ebp, 8
00FB1D89 mov ecx, [eax] ; our response = 16E8B35
00FB1D8B push ecx ecx=16E8B35
00FB1D8C mov edx, [eax+4]
00FB1D8F push edx edx=028C = doubt: counter or constant ?
00FB1D90 mov ecx, [ebp+0]
00FB1D93 push ecx ecx = FA5004
00FB1D94 call :dword_FA7C40 ; my case call 0xFB1EF0
00FB1D9A mov [ebp+0], eax
00FB1D9D add :off_FA7C38, ebx
00FB1DA3 jmp continuedelay

Call 0xFB1EF0

00FB1EF0 loc_FB1EF0: ; DATA XREF: 0000:00FA7394o
00FB1EF0 ; 0000:00FA7B54o
00FB1EF0 push ebx
00FB1EF1 xor eax, eax
00FB1EF3 push esi
00FB1EF4 push edi
00FB1EF5 mov esi, [esp+14h] ; counter esi=028C
00FB1EF9 shr esi, 2 esi=A3
00FB1EFC mov ecx, esi ecx=A3
00FB1EFE dec esi esi=A2
00FB1EFF test ecx, ecx zero ?
00FB1F01 jz short loc_FB1F34 ; Finish
00FB1F03 mov edx, [esp+10h] ; decryption_start_address = FA5004
00FB1F07 mov edi, [esp+18h] ; our response = 16E8B35

00FB1F0B loc_FB1F0B: ; CODE XREF: start+7C2j
00FB1F0B mov ecx, edi -->ecx=16E8B35
00FB1F0D mov ebx, edi -->edx=16E8B35
00FB1F0F shl ecx, 4 -->ecx=16E8B350
00FB1F12 add edx, 4 -->edx=FA5008 is this next DWORD ?
00FB1F15 shl ebx, 5 -->ebx=2DD166A0
00FB1F18 add ecx, edi -->ecx=18573E85 -->(16E8B350 = [i.e. ecx after shl 4] + 16E8B35 [our response])
00FB1F1A shr ecx, 9 -->ecx=C2B9F
00FB1F1D xor ecx, ebx -->ecx= 2DDD4D3F (C2B9F ^ 2DD166A0 [i.e. our response 16E8B35 shl 5] )
00FB1F1F add edi, ecx -->EDI=2F4BD874 ---> (our response 16E8B35 + 2DDD4D3F)
00FB1F21 mov ecx, [edx-4] --> [edx-4] = [FA5004] = 2F55D874 original bytes
00FB1F24 xor ecx, edi --> ECX=1E0000
00FB1F26 add eax, ecx --> EAX=0+1E0000 = 1E0000
00FB1F28 mov [edx-4], ecx -->save it in [FA5004] = 00001E00 new bytes
00FB1F2B xor edi, eax --> EDI=2F55D874 (2F4BD874 ^ 1E0000)
00FB1F2D mov ecx, esi --> ECX=A2
00FB1F2F dec esi --> ESI=A1
00FB1F30 test ecx, ecx --> is it zero ?
00FB1F32 jnz short loc_FB1F0B loop
00FB1F34
00FB1F34 loc_FB1F34: ; CODE XREF: start+791j
00FB1F34 pop edi
00FB1F35 pop esi
00FB1F36 pop ebx
00FB1F37 retn 0Ch

I am know understanding what u mean to say in below para.

/Tuts - As per tut first we get tResponse from tResponse += (((tResponse << 4) + tResponse) >> 9) ^ (tResponse << 5)
tResponse = 2F4BD874

This gets xor'ed with the first DWORD to decrypt which is stored in *(lpCryptedBuffer).

00FB1F21 mov ecx, [edx-4] --> [edx-4] = [FA5004] = 2F55D874 original bytes
00FB1F24 xor ecx, edi --> ECX=1E0000 <<--- here it gets xored & we get decrypted DWORD

In *(lpUnCryptedBuffer) = FA5004 we have the first decrypted DWORD 0x001E0000 which in this example is wrong. Becuase Sum = EAX starts with 0, sum will become the same value as the decrypted DWORD.
00FB1F26 add eax, ecx --> sum = EAX = 0 + decrypted DWORD 1E0000 = 1E0000

Next when xor'ed with tResponse, tResponse will hold
the first encrypted DWORD from the file 0xF4120473. -Tuts/

00FB1F2B xor edi, eax --> original encrypted DWORD = EDI=2F55D874 (2F4BD874 ^ 1E0000)

Best Regards
Sope
cyberheg
12-12-2002, 07:30 PM
Heh!

Looking back I am not sure I even understand my own explanation.
What I did mean however is that there several bugs in the algorithm used for decryption the sections. I'm sure you do understand that the decryption goes on blockwise in chunks of 32 bits. The 2nd dword will get decrypted correctly no matter which key is used. This means on 2nd round you should be getting some plaintext. Your task is now to start guessing the first 4 bytes of plaintext and code a program to verify your guess.

Another way which is better is to implement a full bruteforcer for this. Some months after writing the article I wrote a distributed system much like the Distributed.net challange which I used to break sentinel shell with. With a little luck any sentinel shell would fall within 10 minutes on maybe 5 computers using a very optimised version of the algorithm. Using a less optimised one it would take like 2 hours to break but then it should also work on almost any program using sentinel shell.

As for the rest if your questions about emulation it's the same which goes on in every program I've seen. It starts with those sproread calls and ends with the sproquery calls.

// CyberHeg
sope
12-13-2002, 06:46 AM
Hi CyberHeg

Thank you for your time & reply.

I now do understand what you mean in the above para.
I have modified it accordingly.

> Your task is now to start guessing the first 4 bytes of
> plaintext and code a program to verify your guess.

> Another way which is better is to implement a full bruteforcer

ok! now i get stuck. I need to find examples of bruteforcer
to understand what you are trying to tell.

Just 1 more question suppose if i leave that byte in my case 1E0000
& go ahead with other messages which will follow (a long list)
would it be of use or at some point later in the program original bytes will be required ?

Regards
Sope
CrackZ
12-14-2002, 01:59 PM
Hiya,

To add to Cyberheg's essay/post.

The basic challenge of the Sentinel Shell (if one could call it that) is to guess a valid byte or if you are trying to do it really quickly, a dword, of the section you are trying to decrypt. On very small sections (say 0x10000h) or less one can quite simply try all the possible combinations, just rip the decryption routine out that you have pasted above and the data you are decrypting, add a quick loop and check the value in EAX at the end against the sanity check value from your target.

On larger code sections this isn't practicle to do, it might take a few weeks or more on a single PC, like Cybh says, a bit more computing power and away you go.....essentially the only thing you can then do is reduce your keyspace by quickly scrapping unlikely key candidates, so lets say you decrypt the first dword, and examine whether the decrypted data it produces has a likely byte in the first position, I reckon from discussion with Cybh and others, if you check for 68/6A/90/55/00 and one other byte that escapes my memory right now (perhaps they'll post it, might be C3?), you cut the complexity of the brute force, since you only need decrypt the entire data for keys satisfying that criteria.

It doesn't take a genius to work out that with a bit of luck you'll have the key required a lot quicker than a straight search of the keyspace, of course if you examine other files in your target you can probably guess/look for better bytes :P. Any further help you need drop me some files and I'll let you know how I get on ;-).

Regards

CrackZ.
cyberheg
12-15-2002, 10:49 AM
Originally posted by sope

Just 1 more question suppose if i leave that byte in my case 1E0000
& go ahead with other messages which will follow (a long list)
would it be of use or at some point later in the program original bytes will be required ?

CrackZ gave you some good notes on how to make a bruteforcer so go ahead and makine it now.

I'm not sure I understand your second question. If you don't recover the real bytes of the program it will crash when you reach the program entrypoint.

// CyberHeg
sope
12-16-2002, 07:25 AM
Hi CrackZ / CyberHeg

CrackZ:

I need to clarify 1 thing i.e. Sanity check value of my target

> just rip the decryption routine out that
I understand this line.

> the data you are decrypting,
Ok with this too.

> check the value in EAX at the end against the sanity check value
> from your target.

I need to clarify what do you mean by sanity check value of my target

First time EAX = 0x1E0000 after decryption,

do you mean to say first crypted DWORD 0x2F55D874h

or you mean to say i need to find the value (our_response)
which will after performing the above decryption routine
we should have the value 0x2F55D874h in EAX ?

am i thinking right, i am not getting your hint.

CyberHeg:

I was trying to ask is suppose i leave the first Decrypted DWORD i.e.
(0x001E0000) in my case which is wrong & move forward with other messages
which will follow. I tried BPM on the address where the DOWRD i.e.
(1E0000) get stored thinking i might be used somewhere but it was not
used. Hence i asked you a question about it.

I got the reply. I need to find the correct DWORD at first decryption level.

Regards
Sope
sope
12-17-2002, 07:42 AM
Hi to all

I need to clarify is this the sanity check value which i get by tracing the returned call 74BB which gets xor'ed with 4D82A4E6 & then followed with a compare call 0611 which
cmp dword ptr [eax],0 ; was the value zero ?
jmp continuedelay ; continue

So i guess 4D82A4E6 is the sanity check value which you are referring.

Please any one who can look at the code & tell me if i did the
brute force in corret way. attached file "brut.zip"

Regards
Sope
sope
12-17-2002, 03:14 PM
Hi, to all

I guess, reached OEP & it crashed.
reason: decryption is done with a wrong query response.

I need to find the right query response for the decryption stage all will
go through.

Can anybody confirm is this below pattern for OEP of Sentinel Shell ?

00FB1EA7 C20C00 RET 000C
00FB1EAA 8B44241C MOV EAX,[ESP+1C]
00FB1EAE 8B4C2418 MOV ECX,[ESP+18]
00FB1EB2 8B542414 MOV EDX,[ESP+14]
00FB1EB6 50 PUSH EAX
00FB1EB7 51 PUSH ECX
00FB1EB8 52 PUSH EDX
00FB1EB9 FF15706BFA00 CALL [00FA6B70] ; this will lead to OEP
00FB1EBF 5D POP EBP
00FB1EC0 5F POP EDI

Regards
Sope
cyberheg
12-21-2002, 09:11 PM
Originally posted by sope
Hi, to all

I guess, reached OEP & it crashed.
reason: decryption is done with a wrong query response.

I need to find the right query response for the decryption stage all will
go through.

Can anybody confirm is this below pattern for OEP of Sentinel Shell ?

00FB1EA7 C20C00 RET 000C
00FB1EAA 8B44241C MOV EAX,[ESP+1C]
00FB1EAE 8B4C2418 MOV ECX,[ESP+18]
00FB1EB2 8B542414 MOV EDX,[ESP+14]
00FB1EB6 50 PUSH EAX
00FB1EB7 51 PUSH ECX
00FB1EB8 52 PUSH EDX
00FB1EB9 FF15706BFA00 CALL [00FA6B70] ; this will lead to OEP
00FB1EBF 5D POP EBP
00FB1EC0 5F POP EDI

Regards
Sope

Yeah I think it's correct. The function which calls the error message is the same one calling OEP.
As you wrote yourself it's most likely that the program crashes because of wrong query responses.

At first sight your bruteforcer looks ok but I didn't compile it or try it since I don't got your target to compare with.

There are some things which makes me think you did something wrong though. Firstly the file 1.bin is very small. The first query response is for the whole code section so having a file so small makes me think you picked the wrong data. The compare to see if the decryption is correct looks fine though. Another thing is the initial query response.

our_response dd 01600000h ; start with this value

What makes you think it's nearby? Guessing?

// CyberHeg
CrackZ
12-22-2002, 01:22 AM
Hiya Sope,

Now that I have your target.....

I won't post the entire set of notes I have for you until I've broken it myself, you'll learn more that way I think.

But to confirm, the first section is decrypted from address 0x401000 and has a size of 0x334EA6 bytes (about 3.2Mb's), this makes bruteforcing the entire keyspace pretty much a non-existant option, I'm trying a reduced keyspace search right now, but I think even my method is looking like 24hrs or so (and of course there is no guarantee I will even find the key ;-) ).

The sanity check value for the first section is 0x58E1CD28, I don't know where you got the other value from ;-).

Regards, I'll post more when I've got the answers .....

CrackZ.
sope
12-22-2002, 07:55 AM
Hi CyberHeg / CrackZ

CyberHeg:

> Yeah I think it's correct. The function which calls the error message is the same one calling OEP.
> At first sight your bruteforcer looks ok
Thanks for the confirmation of both things brute force & OEP.

> There are some things which makes me think you did something wrong though.
> Firstly the file 1.bin is very small. The first query response is for the whole code section
> so having a file so small makes me think you picked the wrong data. The compare to see if the
> decryption is correct looks fine though. Another thing is the initial query response.

> our_response dd 01600000h ; start with this value
> What makes you think it's nearby? Guessing?

I'll try to clarify it. I picked up the the small file because i was not
sure about the brut program i wrote & the sanity check value which CrackZ was referring to.

I saw that the shell first time decrypts 028C bytes with a good response 16E8B35 which is already there inside the exe file & hence i made the brut start with 01600000h.

CrackZ:

> But to confirm, the first section is decrypted from address 0x401000 and has a size of 0x334EA6 bytes (about 3.2Mb's),
> this makes bruteforcing the entire keyspace pretty much a non-existant option, I'm trying a reduced keyspace search
> right now, but I think even my method is looking like 24hrs or so

I did followed your hints/advice & i tried too try to reduce the key space searching for the first byte of decrypted section
for the below value 68/6A/90/55/00/C3 added /CC /C7 / 6D to it but still no luck.

> (and of course there is no guarantee I will even find the key ;-) ).
yeah! i can understand. Now some guessing & luck is all that we want :)

> The sanity check value for the first section is 0x58E1CD28,

Thanks for the confirmation.

> I don't know where you got the other value from ;-).
Once you reach the 3rd time B323 i.e. the decryption routine for section 401000 size 334EA6 i dumped section 7 why ? because i saw that the sanity value which we get is from that section address space. so i dumped the whole section 7.
& I searched for the byte 28 CD E1 58 shown below

A6 4E 33 00 6E 61 27 B8 28 CD E1 58 00 00 00 00
00 90 34 00 00 10 01 00 E8 ED DA B6 6D C7 7B A9

What we see is the next decryption routines sanity check also there.

3rd time B323 decryption routine: sanity check value 58E1CD28 & size 334EA6

4th time B323 decryption routine : sanity check value A97BC76D & size 0x00011000 [Section 3]

Also i confirmed this by tracing the msg which came & fourth time i reached B323 decrypting routine & then msg 74BB we get the same sanity check value which is already there.

After this i reach the OEP & a Crash.....this is obvious.

Regards
Sope
CrackZ
01-05-2003, 03:34 PM
Hiya Sope,

OK, since I now have your target, here is how I proceeded ;-). I hope it helps you.

1. Locate Sentinel functions.

FB8EB0 - sproFindFirstUnit()
FB9080 - sproRead()
FB9470 - sproQuery()

2. Order of events.

1st break - sproFindFirstUnit(Developer ID 0xF580), patch :

00BACED1: 00 0E
00BACED4: 00 02

2nd break - sproRead(Words 0x30,0x34,0x38,0x3C,0x0), patch :

00BAD0A1: 00 0E
00BAD0A2: 55 66
00BAD0A3: 8B B8
00BAD0A4: 44 02
00BAD0A5: 24 00
00BAD0A6: 14 5F
00BAD0A7: D1 5E
00BAD0A8: E0 C2
00BAD0A9: E8 0C
00BAD0AB: 00 05
00BAD0AE: 5D 00
00BAD0AF: 8D 00
00BAD0B0: 7D F6
00BAD0B1: 17 46
00BAD0B2: 0F 12
00BAD0B3: B7 04
00BAD0B4: 04 75
00BAD0B5: 38 0F
00BAD0B6: 8B 66
00BAD0B7: 7C C7
00BAD0B8: 24 46
00BAD0B9: 18 06
00BAD0BA: 66 39
00BAD0BB: 89 0B
00BAD0BC: 07 66
00BAD0BD: 33 B8
00BAD0BE: C0 39
00BAD0BF: 5D 00
00BAD0C5: 39 8B
00BAD0C6: 30 7C
00BAD0C7: 80 24
00BAD0C8: F5 14
00BAD0C9: FF 0B
00BAD0CB: FF 75
00BAD0CC: FF 13
00BAD0CD: FF 66
00BAD0CE: FF C7
00BAD0CF: FF 46
00BAD0D0: FF 06
00BAD0D1: FF 10
00BAD0D2: FF 04
00BAD0D3: FF 66
00BAD0D4: FF B8
00BAD0D5: 08 10
00BAD0D6: 08 00
00BAD0D7: 09 5F
00BAD0D8: 09 5E
00BAD0D9: 0A C2
00BAD0DA: 0A 0C
00BAD0DB: 0B 00
00BAD0DC: 0B 8D
00BAD0DD: 0C 64
00BAD0DE: 0C 24
00BAD0DF: 0D 00
00BAD0E0: 0D 66
00BAD0E1: 0E C7
00BAD0E2: 0E 46
00BAD0E3: 0F 30
00BAD0E4: 0F 0A
00BAD0E5: 10 00
00BAD0E6: 10 66
00BAD0E7: 11 8B
00BAD0E8: 11 44
00BAD0E9: 12 24
00BAD0EA: 12 10
00BAD0EB: 13 66
00BAD0EC: 13 89
00BAD0ED: 14 46
00BAD0EE: 14 34
00BAD0EF: 15 56
00BAD0F0: 15 E8
00BAD0F1: 16 6B
00BAD0F2: 16 E7
00BAD0F3: 17 FF
00BAD0F4: 17 FF
00BAD0F5: 18 0A
00BAD0F6: 18 C0
00BAD0F7: 19 75
00BAD0F8: 19 17
00BAD0F9: 1A 66
00BAD0FA: 1A 8B
00BAD0FB: 1B 46
00BAD0FC: 1B 36
00BAD0FD: 1C 66
00BAD0FE: 1C 89
00BAD0FF: 1D 07
00BAD100: 1D 66
00BAD101: 1E 8B
00BAD102: 1E 46
00BAD103: 1F 06
00BAD104: 1F 50
00BAD105: 20 E8
00BAD106: 20 A6
00BAD107: 21 F5
00BAD108: 21 FF
00BAD109: 22 FF
00BAD10A: 22 5F
00BAD10B: 23 5E
00BAD10C: 23 C2
00BAD10D: 24 0C
00BAD10E: 24 00
00BAD10F: 25 90
00BAD110: 25 66
00BAD111: 26 8B
00BAD112: 26 46
00BAD113: 27 06
00BAD114: 27 50
00BAD115: 28 E8
00BAD116: 28 96
00BAD117: 29 F5
00BAD118: 29 FF
00BAD119: 2A FF
00BAD11A: 2A 66
00BAD11B: 2B 3D
00BAD11C: 2B 0C
00BAD11D: 2C 00
00BAD11E: 2C 75
00BAD11F: 2D E0
00BAD120: 2D 66
00BAD121: 2E B8
00BAD122: 2E 03
00BAD123: 2F 00
00BAD124: 2F 5F
00BAD125: FF 5E
00BAD126: FF C2
00BAD127: 31 0C
00BAD128: 31 00
00BAD129: 32 8D
00BAD12A: 32 A4
00BAD12B: 33 24
00BAD12C: 33 00
00BAD12D: FF 00
00BAD12E: FF 00
00BAD12F: 35 00
00BAD130: 35 53
00BAD131: 36 56
00BAD132: 36 57
00BAD133: 37 8B
00BAD134: 37 44
00BAD135: FF 24
00BAD136: FF 10
00BAD137: 39 0B
00BAD138: 39 C0
00BAD139: 3A 75
00BAD13A: 3A 0A
00BAD13B: 3B 66
00BAD13C: 3B B8
00BAD13D: FF 02
00BAD13E: FF 00
00BAD13F: 3D 5F
00BAD140: 3D 5E
00BAD141: 3E 5B
00BAD142: 3E C2
00BAD143: 3F 10
00BAD144: 3F 00

Full sproRead() emulation, we patch words 0x30/0x34/0x38/0x3C all to 0xFFFFh and the
dongle serial number to 0x3039 (12345) ;-).

3rd break - sproQuery(), identify Cybh's GetQuery(sub_FB1590) & GetResponse(sub_FB15A0).
First break however is algorithm descriptor of 0. Code preliminary emulation routine for this :

00BAD493: 00 0C
00BAD494: A1 66
00BAD495: E4 B8
00BAD496: F8 02
00BAD497: FA 00
00BAD498: 00 5F
00BAD499: 8B 5E
00BAD49A: 7C 5B
00BAD49B: 24 C2
00BAD49D: 3B 00
00BAD49E: 07 8B
00BAD49F: 75 FF
00BAD4A0: 0E F6
00BAD4A1: 8B 46
00BAD4A2: 7C 12
00BAD4A3: 24 04
00BAD4A4: 1C 75
00BAD4A5: 89 10
00BAD4A6: 07 66
00BAD4A7: 33 C7
00BAD4A8: C0 46
00BAD4A9: 5F 06
00BAD4AA: 5E 39
00BAD4AB: 5B 0B
00BAD4AC: C2 66
00BAD4AD: 18 B8
00BAD4AE: 00 39

4th & 5th breaks - sproQuery(), this time we need to handle GetQuery() & GetResponse().

00BAD4AF: E8 00
00BAD4B0: DC 5F
00BAD4B1: 80 5E
00BAD4B2: FF 5B
00BAD4B3: FF C2
00BAD4B4: 35 18
00BAD4B5: D6 00
00BAD4B6: 99 8B
00BAD4B7: 06 44
00BAD4B8: FD 24
00BAD4B9: 8B 18
00BAD4BA: 7C 0B
00BAD4BB: 24 C0
00BAD4BC: 18 75
00BAD4BD: 3B 12
00BAD4BE: 07 66
00BAD4BF: 75 C7
00BAD4C0: 18 46
00BAD4C1: E8 06
00BAD4C2: DA 10
00BAD4C3: 80 04
00BAD4C4: FF 66
00BAD4C5: FF B8
00BAD4C6: 35 10
00BAD4C7: A7 00
00BAD4C8: 09 5F
00BAD4C9: 23 5E
00BAD4CA: 7B 5B
00BAD4CB: 8B C2
00BAD4CC: 7C 18
00BAD4CD: 24 00
00BAD4CE: 1C 8B
00BAD4CF: 89 FF
00BAD4D0: 07 66
00BAD4D1: 33 8B
00BAD4D2: C0 5C
00BAD4D3: 5F 24
00BAD4D4: 5E 24
00BAD4D5: 5B 66
00BAD4D6: C2 83
00BAD4D7: 18 FB
00BAD4D8: 00 38

6th break - sproQuery(static query data 0xB827616E). This does the first round of decryption.
Start address 401000, size 0x334EA6 bytes, correct result should be 0x58E1CD28. The decryption
routine is FB1EF0. Recovering the key ..... My brute force code enclosed, the size of the
section is 3.2Mb's so essentially you are going to have to get lucky ;-).

Addendum - You did get it in the end by brute force, response is 0xD53B03F3, general point here really was that you got just 1 .exe so guessing any sort of plaintext was never going to be easy, a lucky guess on the first byte though of 0xCC would have reduced the time to a few hours ;P.

7th break - sproQuery(static query data 0xB6DAEDE8). This section was small enough to search the entire keyspace in a *reasonable* amount of time, with most SuperPro envelopes it is usually only the first section one needs to get lucky with. Response 0x937E647D.

00BAD4D9: 8B 76
00BAD4DA: 7C 10
00BAD4DB: 24 66
00BAD4DC: 18 C7
00BAD4DD: 8B 46
00BAD4DE: 07 06
00BAD4DF: 3D 14
00BAD4E0: 6E 04
00BAD4E1: 61 66
00BAD4E2: 27 B8
00BAD4E3: B8 14
00BAD4E4: 75 00
00BAD4E5: 07 5F
00BAD4E6: B8 5E
00BAD4E7: F3 5B
00BAD4E8: 03 C2
00BAD4E9: 3B 18
00BAD4EA: D5 00
00BAD4EB: EB 8D
00BAD4EC: DE 7E
00BAD4ED: 3D 3C
00BAD4EE: E8 53
00BAD4EF: ED 57
00BAD4F0: DA 50
00BAD4F1: B6 E8
00BAD4F2: 75 CA
00BAD4F3: 07 97
00BAD4F4: B8 FF
00BAD4F5: 7D FF
00BAD4F6: 64 66
00BAD4F7: 7E C7
00BAD4F8: 93 46
00BAD4F9: EB 30
00BAD4FA: D0 10
00BAD4FB: 33 00
00BAD4FC: C0 66
00BAD4FD: 5F 8B
00BAD4FE: 5E 44
00BAD4FF: 5B 24
00BAD500: C2 14
00BAD501: 18 66
00BAD502: 00 89

End - Now I get an error loading import libraries, think I'm missing a few DLL's, maybe you can send me them. The program also decrypts its own Sentinel object, so there are more checks, the best strategy here is to work out what patches you need to apply, then modify the encrypted data to produce the code you need. The only problem with this is that you'll also need to fix the query checksums.

Regards

CrackZ.
sope
01-07-2003, 10:28 AM
Hi CrackZ

Thanks for your time, your note and your brute force on this target.

I need to know what is the values (WORD's) starting from
0xBAD0A1 to 0xBAD144 do i need to paste it in the target ?

> Full sproRead() emulation, we patch words 0x30/0x34/0x38/0x3C all to
> 0xFFFFh and the dongle serial number to 0x3039 (12345) ;-)

I did not get your point. I have pasted the sproRead, sproQuery
emulation, do i need to change in it ?

Regards
Sope

-----
Below is the emulation i did for this target
sproFindFirstUnit

1st break sproFindFirstUnit()

00FB8EC4 CALL 00FB2CF0
00FB8EC9 MOV ESI,EAX
00FB8ECB CMP WORD PTR [ESI],7242
00FB8ED0 XOR EAX,EAX
00FB8ED2 NOP
00FB8ED3 NOP
00FB8ED4 NOP
00FB8ED5 NOP
00FB8ED6 POP ESI
00FB8ED7 POP EBX
00FB8ED8 RET 0008
00FB8EDB ADD EAX,00000000

2nd break sproRead()

00FB909B CMP WORD PTR [ESI],7242
00FB90A0 JZ 00FB90A2
00FB90A2 PUSH EBP
00FB90A3 CALL 00FB90A8
00FB90A8 POP EBP
00FB90A9 LEA EDX,[EBP+1E]
00FB90AC POP EBP
00FB90AD MOVZX ECX,WORD PTR [ESP+10]
00FB90B2 SHL ECX,1
00FB90B4 MOVZX EAX,WORD PTR [ECX+EDX]
00FB90B8 MOV EDI,[ESP+14]
00FB90BC MOV [EDI],AX
00FB90BF XOR EAX,EAX
00FB90C1 POP EDI
00FB90C2 POP ESI
00FB90C3 RET 000C
00FB90C6 JL 00FB90EC
00FB90C8 ADC AL,0B

3rd break sproQuery()
> Code Preliminary emulation routine for this :

00FB948D CMP WORD PTR [ESI],7242
00FB9492 JZ 00FB9494
00FB9494 MOV EAX,[00FAF8E4]
00FB9499 MOV EDX,[ESP+18] <--- Query from Stack
00FB949D CMP EAX,[EDX]
00FB949F JNZ 00FB94B0 <---Next Query
00FB94A1 MOV EDX,[ESP+1C] <-- response from stack
00FB94A5 MOV [EDX],EAX <-- save
00FB94A7 NOP
00FB94A8 XOR EAX,EAX
00FB94AA POP EDI
00FB94AB POP ESI
00FB94AC POP EBX
00FB94AD RET 0018

> 4th & 5th sproQuery, this time we need to handle
> GetQuery() & GetResponse()

00FB94B0 CALL 00FB1590 <--- GetQuery
00FB94B5 XOR EAX,FD0699D6 <--- xor with FD0699D6
00FB94BA MOV EDX,[ESP+18] <--- inputed query value from stack
00FB94BE CMP EAX,[EDX] <--- is same
00FB94C0 NOP
00FB94C1 NOP
00FB94C2 CALL 00FB15A0 <--- GetResponse
00FB94C7 XOR EAX,7B2309A7 <--- xor with 7B2309A7
00FB94CC MOV EDX,[ESP+1C] <--- response from stack
00FB94D0 MOV [EDX],EAX <--- store it
00FB94D2 XOR EAX,EAX
00FB94D4 POP EDI
00FB94D5 POP ESI
00FB94D6 POP EBX
00FB94D7 RET 0018

now i am doing something wrong i guess, because i am shown with a error which i have been seeing from long time.

So from this point onwards i used to manually change the flags & reach the decryption routine.
sope
01-08-2003, 05:41 AM
Hi CrackZ

I reached the OEP = 715700 so i dumped the file

/pedump 400000 315700 C:\dmp.exe <enter>

Now followed the code i found below codes

(1) SproFindFirstUnit

004FB0C5 loc_4FB0C5:
004FB0C5 push 0F580h ; <--- Developer ID
004FB0CA push offset unk_75C7AC ; <--- Rnbospro Handle
004FB0CF call sub_7053D0

So i emulated as above.

(2) I found below Querydata & good response being moved.

Querydata being moved for sproQuery

004FB0F1 loc_4FB0F1:
004FB0F1 mov byte ptr [ebp+var_5C], 0B6h
004FB0F5 mov byte ptr [ebp+var_5C+1], 3Ch
004FB0F9 mov byte ptr [ebp+var_5C+2], 0A3h
004FB0FD mov byte ptr [ebp+var_5C+3], 0BFh
004FB101 mov byte ptr [ebp+var_58], 0A0h
004FB105 mov byte ptr [ebp+var_58+1], 0B2h
004FB109 mov byte ptr [ebp+var_58+2], 93h
004FB10D mov byte ptr [ebp+var_58+3], 0C3h

Good response being moved

004FB111 mov byte ptr [ebp+var_CC], 14h
004FB118 mov byte ptr [ebp+var_CC+1], 0EDh
004FB11F mov byte ptr [ebp+var_CC+2], 0Bh
004FB126 mov byte ptr [ebp+var_CC+3], 0FDh
004FB12D mov byte ptr [ebp+var_CC+4], 0AFh
004FB134 mov byte ptr [ebp+var_CC+5], 0F5h
004FB13B mov byte ptr [ebp+var_CC+6], 8
004FB142 mov byte ptr [ebp+var_CC+7], 96h

SproQuery emulation 026h, 3Eh, 0Ch, 24h

004FB149 push 8 <--- length
004FB14B lea eax, [ebp+var_D4+4]
004FB151 push eax <--- response32
004FB152 lea ecx, [ebp+var_94]
004FB158 push ecx <--- response
004FB159 lea edx, [ebp+var_5C]
004FB15C push edx <---queryData
004FB15D push 26h <--- cell address
004FB15F push offset unk_75C7AC <--- packet handle
004FB164 call sub_705990 <--- RNBOsproQuery

So i emulated the sproquery show below

007059AD CMP WORD PTR [ESI],7242
007059B2 JZ 007059B4
007059B4 MOV EDX,[ESP+1C] <-- response from stack
007059B8 MOV DWORD PTR [EDX],FD0BED14 <--- first 4 bytes
007059BE MOV DWORD PTR [EDX+04],9608F5AF <--- remaining 4 bytes
007059C5 XOR EAX,EAX
007059C7 POP EDI
007059C8 POP ESI
007059C9 POP EBX
007059CA RET 0018 <--- ret

New we have the below compare

004FB1EE push 8 <--- length
004FB1F0 lea ecx, [ebp+var_94]
004FB1F6 push ecx <--- our response
004FB1F7 lea edx, [ebp+var_CC]
004FB1FD push edx <--- good response
004FB1FE call sub_70FBA0 <--- compare it
004FB203 add esp, 0Ch
004FB206 test eax, eax <-- all ok

compare is checked 3 times.

Next we reach the SproRead() 0Fh, 0Eh so i emulated show below

007055BB CMP WORD PTR [ESI],7242
007055C0 JZ 007055C2
007055C2 PUSH EBP
007055C3 CALL 007055C8
007055C8 POP EBP
007055C9 LEA EDX,[EBP+1E]
007055CC POP EBP
007055CD MOVZX ECX,WORD PTR [ESP+10]
007055D2 SHL ECX,1
007055D4 MOVZX EAX,WORD PTR [ECX+EDX]
007055D8 MOV EDI,[ESP+14]
007055DC MOV [EDI],AX
007055DF XOR EAX,EAX
007055E1 POP EDI
007055E2 POP ESI
007055E3 RET 000C
007055E6 JL 0070560C

After this i reach a point in program offset 0x4FBD80 we find similar type Querydata (shown above) being moved & good response so i applied the same emulation shown above for SproQuery() & same 3 times compare & then same sproread().

Now i get runtime error page faults 0x45FA14, i guess i am doing
something wrong somewhere OR something with import table program i dumped is not properly rebuilded OR my SproRead not proper i need to find the perfect dongle word put it at that offset. I got stuck again

Can u give me hints, i am so close to finish it after a long time!

Regards
Sope


Identify the target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Identify the target
PDA

View Full Version : Identify the target

Mfriend
12-12-2002, 07:10 PM
Hi

I'm quite new to RE ( about ~1/2 year ) and have found a very intersting target. Advanced Softice detection ( frogice, ntall, icedump, various anti-debugging tricks, aso.
I'm pretty sure that the programmer ( some shareware author ) does not protect his software with "custom" tricks ( except CRC checking )

- after some manual unpacking strings like "yoda" appeared in the dumped exe=> he uses more than one packer.
But the real interesting part follows:
The target is one single exe ~ 1 Mb size. Dumped process is 60 Kb. This 60 kbyte ( I'm not finished with all the packer layers ) appears to be only some Loader/Unpacker for the real software which is encrypted in the 1 Mb exe file ( after the process image ).

Guessing OEP for each layer is quite hard for me.. are there any other "generic" ways to recognize an OEP ?
( the only one I know of, and which appears on this board too is:
POPAD
RET )
Well, and building up IT... I don't really know when I'm correct.. for some reason the target quits itselfe without any error - even with a complete messed IT.. ( perhaps I've missed some CRC/size check )

Now - does anyone of the grand-crackers have an idea which protection this could be ? Reminds me somehow of "Himan 2" (securom v2. + "special tricks") where some dlls and other program parts are built up in memory by the encrypted executable.

I have spent nearly an hour ( maybe too less )into looking for tutorials which explains how to crack multiple protected targets. Does anyone know of some resources I should look into, before I start asking questions here ?
I have to admit.. I prefere to find it out by myself.. but this finding out has cost me nearly 2 weeks by now - and I really don't know if I'm on the right track ( unwrapping layer by layer ).
Mfriend
12-13-2002, 10:28 AM
update:

a few further layers removed - I have also found a reason why IT didn't need any modification - All the packers ( so far ) have used the same functions which has used the first packer. ( yes I could have checked that in the first place ).
It's like a matroschka - you open a doll - and there is another doll in there..

Does noone recognize the protection ? ( Loader which loads an encrypted part in the same exe )
squidge
12-13-2002, 01:22 PM
The only protection I've seen which has an exe size of, say, a few meg, but when dumped, only outputs about 60kb has been a lame exe cryptor written in Delphi (forget the name). You didn't need to find the OEP or anything though as it decrypted the main part of the app to a temp directory on your hd and executed it from there. Of course, it deleted it afterwards.

So my advice would be to use filemon and check that this is not happening - if the program is decrypting into memory, you can normally dump the entire memory range including the decrypted and crypted parts of the prog.
Mfriend
12-13-2002, 01:56 PM
No, filemon hasn't catched any suspicious file-access.

And the loader ( it must be some loader ) confuses me a lot... mainly because it keeps detecting softice...

another newbie question: how to hide current 4.2.7. Softice on W2k ?

ntall fails
nticeset fails ( tried to update pntice.ini, but without success )

I have found several topics on this forum but nothing helping me much..

SplAj says somewhere he has posted an "EliCZ macro set" ... but I've never found it.

Maybe I should try to hide softice by my own first, before I start to crack right away :) ... but on the other hand.. why invent the wheel again ?
Mfriend
12-13-2002, 02:17 PM
addon:
I have found out so far:

-The loader process overwrites itselfe with the decrypted process which is hidden after the stored process image in the executable.
( process image size changes )

-loader is heavy guarded by packers ( anti-debugging, anti-dumping )

Where I'm stuck right now:

this anti-softice tricks....

so I change tactic and will try to patch my softice installation to remain undetected. This could take a few days...
crUsAdEr
12-13-2002, 04:19 PM
This sounds interesting, may i know what you are playing with :)?
Mfriend
12-13-2002, 04:28 PM
uhm.. how embarrassingly...
after hiding si ( thanks SplAj for his nice tut I ve found ) there was no problem dumping the real process image.

now this was too easy :|

since the target runs only on w2k ( squidge and I discovered ) the 2 weeks I ve spent on that weren't worth it.

but Ive learned how to hide softice on w2k/xp..

@squidge: thanks
Mfriend
12-13-2002, 04:49 PM
the target was a reception client for highspeed networks ( called FFR Fast File Receiver ) by WizzCast ( the author's nick )

The "project" seems to be dead ... ( hp is down about 3 weeks now )

well.. anyway I look for a new target.. which is worth writing a tut about it...

Happy reversing,
mystical friend
JMI
12-13-2002, 06:41 PM
Mfriend:

Just a word for anyone looking to hide softice.

In addition to +Spl/\j's walk-through there was a patch for hiding DS 2.7 by nikolatesla20 in a thread titled "Driver Studio *2.7* anti detect patches" dated 10-23-2002 in the TOT Forum. It made all the patches for everything except int 1 detection. In that thread I also posted a link to the +Spl/\j walk-through. Nikolatesla20 also posted a previous patch for DS 2.6.

There is also a multipage thread from 09-23-2002, titled "Avoiding INT1 detection of SoftICE under WinXP" which discusses how to avoid even this detection method. There is a "Detect" program posted by +Spl/\j which will show you if your patches are working.

These were all posted within the last 90 days (except the +Spl/\j walk-through) and could have been located with rather simple searches and/or simply looking back through the listings on the TOT Forum.

Regards.
Mfriend
12-13-2002, 11:08 PM
of course you are right - a little bit more searching would have spared me to ask about si hiding on w2k/xp/nt.

I do hate it too, if the same questions are asked over and over again -

thankyou to point me to the int1 threads.

mf


InstallAnywhere java install program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > InstallAnywhere java install program
PDA

View Full Version : InstallAnywhere java install program

x-gen
12-12-2002, 08:14 PM
Greetings,

Any pointers on how to dissasemble or step through java code.

I have an installe .exe that extracts a java program wich then runs and installs the product.

A serial number is required, whats the next step ?
Must i w32dasm the javaw.exe ?

Thanks in advance
Newbie
Mfriend
12-12-2002, 08:40 PM
There are classfiles extractors available on the net - after you have extracted them either by using them (simple) or doing it by hand ( the way I would do it ) - you can use decompilers like jad/cavaj to gain sourcecode.
hmm InstallAnywhere uses an obfuscator, I think. This could make things more complicated - but there are also java disassembler available ( javad, IDA Pro ), or even virtual mashine debuggers ( like softice for your system ) jdb is even shipped with the jdk.

I'm pretty sure - if you read some tuts about java cracking ( search the web ) you will make it... but don't expect a step by step instruction by anyone on this board.

Threads you could have found if you have used the search button in this forum:

http://www.woodmann.net/forum/showthread.php?s=&threadid=3840&highlight=java

http://www.woodmann.net/forum/showthread.php?s=&threadid=2356&highlight=java

http://www.woodmann.net/forum/showthread.php?s=&threadid=2205&highlight=java

http://www.woodmann.net/forum/showthread.php?s=&threadid=1602&highlight=java

http://www.woodmann.net/forum/showthread.php?s=&threadid=1416&highlight=java

http://www.woodmann.net/forum/showthread.php?s=&threadid=1283&highlight=java

http://www.woodmann.net/forum/showthread.php?s=&threadid=1316&highlight=java

Mystical Friend

erm.. now I see your question about javaw.exe .... Please learn some java basics before you start to crack.


mamaich BlindStudio?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > mamaich BlindStudio?
PDA

View Full Version : mamaich BlindStudio?

dion
12-13-2002, 03:12 AM
hi all, is there anyone working on this, i mean continue mamaich work or is there any new infos about it?

thanks
dion
12-15-2002, 01:46 PM
uhm, i dont know is it me dumb or none really interested. as far as i know, BlindStudio debugger by mamaich are the *only* debugger for windows nt with *source code* in the net. u can grab it at EliCZ website, not in mamaich one [dont know why he remove it]. well, it really advanced for me to learn what he code inside. that's why i post this thread, to know how much people working on it and/or whether they want to share his work.

regards


flexlm (hard to explain)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > flexlm (hard to explain)
PDA

View Full Version : flexlm (hard to explain)

Zigmund
12-13-2002, 08:01 AM
target: a^^dl 5.2 by ald^c

so it has flexlm 8.1a and it's really hard to find any ENCRYPT_SEED1(2,3,4) :(

all princips described at woodmann page give no results
(for exmpl: hiding real calculated seeds by const)

could anyone give me some hints to discover that info (seed's), coz verndor_keys and cro could be generated by lmv8xx tool by vendor_name.

flexlm 8.1a is really hard debbuging process. (rmcl.dll)

any idees?


Reversing CD Phone Book PART II
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Reversing CD Phone Book PART II
PDA

View Full Version : Reversing CD Phone Book PART II

narnar2000
12-13-2002, 08:37 PM
Hi all,

I posted a message here recently regarding reversing a phonebook on CD.
I haven't had enough time to spend trying to extract/crack the database.
However, I did find that the driver app allows for up to 5 search results at a time to be exported to a text file. The results include the name, address and phone number of each match.

Which got me thinking that perhaps this would be an easier feature to exploit... But, of course, the problem is how to alter/fool the app into spitting out any number of results in one go. My guess is that there's a hard-coded max value (=5) somewhere in the binaries. I disassembled the DLL which provides the "export to file" function and from what I could make out, it seems that it has no max value check. No real surprise there... so presumably the "if (numResultsToExport > 5)" check is in the driver app itself. But where????

I changed a few 0x74s to 0x75 etc but to no avail.

Anyone got any ideas about how to locate a hard-coded value?

Thanks.
naides
12-13-2002, 09:59 PM
Originally posted by narnar2000
Hi all,

I posted a message here recently regarding reversing a phonebook on CD.
I haven't had enough time to spend trying to extract/crack the database.
However, I did find that the driver app allows for up to 5 search results at a time to be exported to a text file. The results include the name, address and phone number of each match.

Which got me thinking that perhaps this would be an easier feature to exploit... But, of course, the problem is how to alter/fool the app into spitting out any number of results in one go. My guess is that there's a hard-coded max value (=5) somewhere in the binaries. I disassembled the DLL which provides the "export to file" function and from what I could make out, it seems that it has no max value check. No real surprise there... so presumably the "if (numResultsToExport > 5)" check is in the driver app itself. But where????

Perhaps close to the place where the "export to file" function is called.

I changed a few 0x74s to 0x75 etc but to no avail.

Anyone got any ideas about how to locate a hard-coded value?

Keep in mind that the digit '5' may not appear at all in the dissasembly:

If the counter varible is zero based counts less or equal to 4 gives a total of 5 cycles

The counter variable may be set to 4 and then decremented after each cycle,

The counter value may be set somewhere else in the file and is passsed in a register or in a stack variable, which is not obvious in dead listing. Eaxmple

TEST ECX, [EBP-10]
JZ 41567

ECX holds the count, EBP holds the limit (Perhaps 4?) but you don't see the value.
Thanks.
FoolFox
12-16-2002, 07:28 AM
Hello,

Searching for a single value as 5 in a big exe should not
only return you tons of results, it may be difficult to find
which is the one you want to fix....

You export option come from a menu right ? then maybe
you should have a look at the ressources in order to know
which ID the menu got, and find that back in the main exe
(where there is a loop that make a compare on the various
menu entries)...

from there, then study the part of code called.... if you are
lucky you may even got access to a function that retrieve
a whole record info on one shoot....

Regards
FoolFox
Paul333
01-04-2003, 01:08 PM
Its noit a very good app if it only allows 5 exports!.

Have you checked to see if you can buy "Credits" which allows higher rates of exporting?..

I "fixed" another telephone app that only allowed 1 export if no PROFILES "Credits" so you had to buy these to export in greater numbers......I done a memory search to find the keys but also found it stored the number of profiles in the registry!!

Check if you can up your exports number ..SURELKY YOU MUST?

paul333


ISS Realsecure 6.5 iss.key protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ISS Realsecure 6.5 iss.key protection
PDA

View Full Version : ISS Realsecure 6.5 iss.key protection

ccntv2
12-14-2002, 08:31 PM
Some body have try defeat the protection of the ISS Realsecure 6.5?

Thanks
Woodmann
12-14-2002, 10:33 PM
Hi,

Now why would someone want to play with a software
that is used to protect servers ?

I can only think of two reasons and one of them is someone
is really bored and has mastered all the other protections.
After further review, it takes an incredible amount of time
to try to get an evaluation version. Someone who is bored would not go through all the bullshit to get the software.

Now, you dont need to justify why you have the software.
Try to include something more to your post like:

IT IS PROTECTED BY.........
YOU HAVE ANY CODE TO POST.............
IS IT EVEN USED ON WINDOWS SERVERS............

¥OBC
r4g3
12-14-2002, 10:45 PM
shit ! what a kewl avatar !
¥OBC
can i get one to use with my nick ? please please .... what must i do for it ?
ccntv2
12-14-2002, 11:48 PM
First:

Well, I not want that no body loss the time trying to crack the program :-). Only want to know is somebody have try crack it.

I am trying to search what protection it have becouse a want crack it.
I now that other program of the same company (ISS Internet Scanner 6.21) have the following protection and use one similar iss.key file:

---------------------------------------------------------------------------------
Keyfile is in base64. After it's converted to base256, it (except last 10 bytes) gets decrypted with Blowfish using XOR of last 10 bytes with MD5 value of some hardcoded copyright string. Last 10 bytes of the key must be equal to MD5 value of decryption result. The
decryption result contains another Blowfish key, along with one more
MD5 digest and DSA signature and public key. Also it contains one
more encrypted buffer. This buffer gets decrypted with BF key 2, then
the hash is taken and compared to the above MD5 value. If they're
equal, then DSA signature for this hash is verifyed. If it's valid,
routine continues. Last decrypted buffer contains key chunks, each
(quite) of them contains small header with chunk type, customer
number etc. along with chunk data and (again) DSA signature and public key. If signatures are ok in all chunks (this time they're
verified using SHA-1), the key is nearly acctepted, but the following
checks has little to do with cryptography.
DSA is used with 512bit large prime. Only P, G and Q are hardcoded in
the executables. Public key is in the keyfile.
-----------------------------------------------------------------------------------
I am trying to find if this protection is similar to the ISS Realsecure 6.5.

Second:

Is not dificult download the software of the www.iss.net and It can run in workstation too not only in server. of couse i know the blackice
but i want ISS Realsecure becouse a want protect several machines.
Woodmann
12-15-2002, 12:51 AM
but i want ISS Realsecure becouse a want protect several machines.

oooooooooooooooooooo........... bad answer.
That is stealing that is bad bad bad.

Besides I have never seen anything about that soft on this
site.

¥
(Anyone can use the avatar but, you must be L3e70 :)

LAter, Woodmann


Olly Debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Olly Debugger
PDA

View Full Version : Olly Debugger

mR_gANDALF
12-14-2002, 10:57 PM
I would like to resolve a question...

What do you think about Olly Debugger in comparison to SoftIce?
Should we prefer this new program instead of SoftIce?
Is it Better?

Thanks
naides
12-14-2002, 11:25 PM
NO
Iwarez
12-14-2002, 11:40 PM
I like olly more than SoftICE. Olly makes the things clearer sometimes.
tgodd
12-15-2002, 05:45 AM
A would agree with naides.

It is not better.

It can be used along-side softice just as IDA can be used along-side.

It can be a great tool, but nothing replaces a good system debugger.

My 3 cents.

Regards,

tgodd
_Servil_
12-15-2002, 08:34 AM
yes and no.

ice is a kernel-level debugger and olly application-level, this means while ice lays under OS olly is on top. Each has obviously its pros and cons. In this I agree with iwarez, unless you need to struggle anti-debug/seh/interrupts/driver probs/... i found olly more handy. Olly is weak.
mR_gANDALF
12-15-2002, 10:31 AM
Thanks to all for your replies,

but I would like to get deepen...

Which is the difference regarding antidebugging tricks/SEH/interrupts, which is better and why?

Why is Olly weak? Wich are thier "weakness"?

Thanks again

mR_gANDALF
squidge
12-15-2002, 01:20 PM
I prefer using Ollydbg when tracing through an app to find out what it's doing as it's far friendly with system API calls etc and generally much more user friendly. However, when working on packed exe's and system level breakpoints (eg. bpx'ing in sys libs) then it's Softice all the way. Once a programs unpacked and I'm no longer interested in system calls, I use Ollydbg alongside IDA and it makes commenting the IDA source much easier. Perfect for creating keygens and the like.
Zero
12-18-2002, 10:12 AM
mR_gANDALF:

but I would like to get deepen...

Which is the difference regarding antidebugging tricks/SEH/interrupts, which is better and why?

Why is Olly weak? Wich are thier "weakness"?

Olly is weak because it is an Application Level Debugger.

One silly example:

imagine your target has some anti-disassembler tricks inside.
Olly starts with a disassembly before you can debug it. Therefore Olly will crash. (Like w32Dasm).
SoftIce is a real-time debugger so anti-disassembler protections does not harm it.

Next Olly is getting better with identifying SEH structures but Olly has not the advantages of a real-time debugger like SI

Anti-Debugger tricks will crash both (sure there are ways to work around this)

One nice feature of Olly is that you can comment your code und Olly remembers these comments in the next debugging session.

Hope this helps you a little...
raffaelo
12-29-2002, 06:37 PM
use both, make the tools work together


take back on flexlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > take back on flexlm
PDA

View Full Version : take back on flexlm

pipofrfr
12-15-2002, 12:23 AM
yup eveybody,

so take back on flexlm,...???

i've a big pbm...
i've got the l_sg, because of the flair,..., i've got all of them in fact...but, where to find the vendor id, where to find the seeds...is it a joke...i've read all your papers, but, none of them gave me the soluce...

it's only a flex v7.0D...flexgen or efalicgen, i don't want them, i only want to reproduce the results...and to crack my target, of course...but, :

first:
between, wdasm and ida, there is a gap...
second:
your's tut only told me where to break, but what about the real basic...
it's true that it's not for beginners, but, three years i know the word flex...i've read them, read again and again...
say it slowly...bpx on "something", in order to find the vendor, next step, bpx on lsg, in order to find the call which call the good_lic_key...or something else,..., i need help...
i need help again...
i need help again...

so, it's a required...help me please...i can do many things, build a sdk, a map, a nms(i'm not too stupid, i think i hope),althought i'm only a "pseudo" student on mathematical modeling...

i don't want the soluce, i only want some help...
Woodmann
12-15-2002, 12:44 AM
Howdy,

Have you looked at dans essay on CrackZ site?
search for danflex.htm.

Later, Woodmann
CrackZ
12-15-2002, 11:04 AM
Hiya,

I'm going to be a bit terse here.

If you've found l_sg(), you've got all the information you need.

The vendor structure (contains vendor keys), and vendor name are all passed to the seed hiding function, all that remains is for you to dig them out with a debugger, unless of course your target is doing something fancy (which it sounds like it isn't), either way you dig the point.

I'm sorry to say I just don't believe you've really done the required research, but hey ;-), correct me if I'm wrong or post exactly what you can't dig out and I'll try and help from there, try to include code snippets.

Regards

CrackZ (cranky old bastard).
Nobody
12-16-2002, 02:29 AM
You can use the new flowchart feature on IDA to view the
global structure 1st then dive into the detail step by step .
Like the following picture show l_sg flow..
picture removed
pipofrfr
12-17-2002, 09:20 PM
yup,
and if it's a dll nor the exe who incorporeted the flex code, we don't care...???....
pipofrfr
12-20-2002, 10:27 AM
yup everibody,

i need U again...

in fact, it's flexlm v7.0d, with sign=ten characters...(strange for me)
if i understand well, this means that there are cro_keys...but, looking in the corresponding sdk, i don't find reference from them...so, i can't give it to him...
any help will be nice...
SeanC
12-23-2002, 09:17 AM
For cro, it's very hard.

Look into lmrand2.obj, libcrvs.lib, libsb.lib. And search Certicom's website for the ECC stuff(sect113r1 should be more simple).

Finally, bruteforcing it.

But the newest version is v8.3b, don't waste time on the old version.

SeanC
padspcb
01-15-2003, 03:34 AM
Hi friends

>in fact, it's flexlm v7.0d, with sign=ten characters
seems this is no cro, just strenght default, so all techniques apply.

As everybody says, bp on l_sg......, but what the heck is l_sg ??
l_sg is obviously lm_new.c so you got even the source code!!!
What does it do anyway?, Well, on crypting, time info was included in keys,
and it must be taken off. l_sg has a UNIQUE seed and time calls,
then it mounts 4dws on current jobs first dw and xors the keys.
After that is changes the ORDER of the keys, so they can be any
combination 0123,1032,3021 etc...
My recode takes vendord, keys, order and unique to get seeds 1 & 2.
If you need, send me email/pm

Now cro, there is some methods but basically you need to build the target with the sdk.
Unfortunatedly we dont have the lmnewgen.c BUT we have the object file with debug info.
Change your makefile to add /DEBUG to the LD variable
Build a target with faked seeds 3 & 4
Generate asm from lmnewgen.exe and you will understand what has to be done.

It generates the pri and pub keys (the headers)
Well, after it copies the expanded seeds 3 & 4 to a memory, it starts making the keys. Pri first then pub.
You must now compare the generated with the pub in daemon/sw
If not, change values and do again.
There is some math before, but important is to get concept.
For an old 8.1 target it can take up to 2 days.
But all vendors have received FREE the update to 8.3 so don't bother wasting your time in this.
Method for 8.3 is exactly the same, the only trouble is that now we have 3 seeds! so you can get 2^32 DAYS to get them....
Also routines are realy time consuming, some 100ms per loop
_sb_initialize
_sb_sha1Begin
_sb_sha1Hash
_sb_ecdsaSignBegin
_sb_sha1End
_sb_fipsRngOptionalInput
_sb_ecdsaSign
_sb_ecdsaSignEnd

So good luck

PS
How secure is this board anyway??
Dont u think more detailed talk should be in private??
All this cro stuff started due to essays like Dan's ...


installshield 6.0 scripting trouble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > installshield 6.0 scripting trouble
PDA

View Full Version : installshield 6.0 scripting trouble

archmage
12-15-2002, 09:00 AM
hello all

i am reversing an installshield 6.0 compiled installer, i have read many tutorials, but i am having a bit of difficulty, it seems that the protection for the serial is in the script itself -- but i really dont understand what is going on, can anyone clarify me what this code does?

/* 00004DD0: 0006 */ n0007 = 0x00015601; //a standard value?
/* 00004DDC: 0006 */ n0008 = 0x00000040;
/* 00004DE8: 0006 */ n0009 = 0x00000051;
/* 00004DF4: 0006 */ n000A = 0x0000007D;
/* 00004E00: 0029 */ StrSub(s0009, s0006, 0x00000000, 0x00000003);
/* 00004E14: 002C */ StrToNum(n0004, s0009);
/* 00004E1E: 0029 */ StrSub(s0009, s0006, 0x00000004, 0x00000001);
/* 00004E32: 0006 */ s000A = s0009;
/* 00004E3C: 0029 */ StrSub(s0009, s0006, 0x00000006, 0x00000001);
/* 00004E50: 0007 */ s000A = s000A + s0009;
/* 00004E5D: 0029 */ StrSub(s0009, s0006, 0x00000008, 0x00000001);
/* 00004E71: 0007 */ s000A = s000A + s0009;
/* 00004E7E: 0029 */ StrSub(s0009, s0006, 0x0000000A, 0x00000001);
/* 00004E92: 0007 */ s000A = s000A + s0009;
/* 00004E9F: 0029 */ StrSub(s0009, s0006, 0x0000000C, 0x00000001);
/* 00004EB3: 0007 */ s000A = s000A + s0009;
/* 00004EC0: 002C */ StrToNum(n0005, s000A);
/* 00004ECA: 0029 */ StrSub(s0009, s0006, 0x00000005, 0x00000001);
/* 00004EDE: 0006 */ s000A = s0009;
/* 00004EE8: 0029 */ StrSub(s0009, s0006, 0x00000007, 0x00000001);
/* 00004EFC: 0007 */ s000A = s000A + s0009;
/* 00004F09: 0029 */ StrSub(s0009, s0006, 0x00000009, 0x00000001);
/* 00004F1D: 0007 */ s000A = s000A + s0009;
/* 00004F2A: 0029 */ StrSub(s0009, s0006, 0x0000000B, 0x00000001);
/* 00004F3E: 0007 */ s000A = s000A + s0009;
/* 00004F4B: 0029 */ StrSub(s0009, s0006, 0x0000000D, 0x00000001);
/* 00004F5F: 0007 */ s000A = s000A + s0009;
/* 00004F6C: 002C */ StrToNum(n0006, s000A);
/* 00004F76: 0010 */ n000B = n0008 * n0004;
/* 00004F83: 0010 */ n000C = n0009 * n0005;
/* 00004F90: 0007 */ n000B = n000B + n000C;
/* 00004F9D: 0007 */ n000B = n000B + n000A;
/* 00004FAA: 0008 */ n000B = n000B % n0007;
/* 00004FB7: 000F */ n000B = n0006 - n000B;
/* 00004FC4: 000F */ n0000 = n000B - 0x00002710;
/* 00004FD3: 000D */ n000B = n0000 == 0x00000000;
/* 00004FE2: 0004 */ if(! n000B) goto label_0008; // normal if also, this is the bad boy jump
/* 00004FEE: 0005 */ goto label_0009; //good cracker!

thank you!
Solomon
12-15-2002, 09:22 AM
My suggestion is :
get an InstallShield package from google and install it, then read its help for its API references such as StrSub/StrToNum ...
archmage
12-15-2002, 11:32 AM
hey, thanks for your quick reply!

but, i already figured it out and i have found its similar to vb, so i coded a vb program to try it, but i guess this would be a bit of a brute force program am i right?

i dont know how to brute force it though.. any suggestions?

(please dont make comments on vb, i know more languages but vb seems to do the job well)
squidge
12-15-2002, 01:25 PM
What you have there seems to be some kind of serial CHECKING algorithm. You'll need to reverse it to create a generator instead. With what you have that's not too hard to do - just think about math's class and rearranging equations to find the missing numbers/etc and it'll come out quite easy. Then you can use the checking algorithm to verify your code works. No need for brute force.
archmage
12-15-2002, 02:00 PM
look at this before the serial label

it does this then it goes ahead and jumps to the algorithm, under on econdition, it checks for the n000B to equal 12 if(!n000B)
or otherwise if FALSE, then jump to checking algorithm or am i right?? im really confused..heh...any clarifications would be appreciated

// : Jump Referenced(3):
// : 00004D46, 0000505F, 000050C1,
label_0006:
/* 00004D5D: 0006 */ s0000 = "";
/* 00004D67: 0021 */ function_00DC("ASK_SERIAL_NUMBER");
/* 00004D81: 0006 */ s0001 = LAST_RESULT;
/* 00004D8B: 0021 */ function_0157(s0000, s0001, s0004, s0005, s0006);
/* 00004DA0: 0006 */ n0000 = LAST_RESULT;
/* 00004DAA: 000D */ n000B = n0000 == 0x0000000C;
/* 00004DB9: 0004 */ if(! n000B) goto label_0007; // normal if
/* 00004DC5: 0005 */ goto label_0005;

plus, the serial would have to be 14+ digits
since later on u can see above, the code checks for StrSub(C,1) and StrSub(D,1) or for the 13th and 14th digit

so it can't be less than 12, right?

thank you!

[edit begin]

30931804804051

that serial would then make that same code i posted 2 posts above true right? lets look at the math

309 3 1 8 0 4 8 0 4 0 5 1
1 0 8 4 5 <= this is the 5th,7th,9th,11th,and 13th
8 4 0 0 1 <= this is the 6th,8th,10th,12th,and 14th

ok, so now, we see that the serial calculates like this

n000B = 64 * n0004;
64 * (first 3 characters)

64 * 309

n000C = n0009 * n0005;
= (last digit) * (5th, 7th, 9th, 11th, and 13th digit)

5 * 10845

n000B = n000B + n000C;

54225 + 19776

n000B = n000B % 87553;
74001 % 87553

n000B = n0006 - n000B;
(6th,8th,10th,12th,and 14th digit) - n000B

84001 - 74001 //the result here has to be 10000

n0000 = n000B - 10000 (decimal);
10000 - 10000

if(n0000 == 0)
n000B = true;
else
n000B = false;

except that serial gives me "wrong serial, try again" why?


looking for new dissasembler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > looking for new dissasembler
PDA

View Full Version : looking for new dissasembler

sonkite
12-17-2002, 01:18 AM
i was looking through this forum some time ago i think it was this one... anyways i saw some screenshots of a new dissasembler by gadix(i think) which looked nice it was still in beta stage at the time i have looked at old post with no sucess... does anyone know which one i mean?

tnx
Woodmann
12-17-2002, 02:14 AM
Howdy,

Check the tool links down below.

Peace, Woodmann
Kayaker
12-17-2002, 02:44 AM
Hi

Do you mean the one mentioned in the Anticrack forum maybe? Screenshot is about 6 posts down.

http://board.anticrack.de/viewtopic.php?t=967&sid=b18b3347de7d909ba6a0ad255c334a8b
sonkite
12-17-2002, 03:17 AM
Originally posted by Kayaker
Hi

Do you mean the one mentioned in the Anticrack forum maybe? Screenshot is about 6 posts down.

http://board.anticrack.de/viewtopic.php?t=967&sid=b18b3347de7d909ba6a0ad255c334a8b

yepp thats the one tnx very much guess i was looking in the wrong forum =)
JMI
12-17-2002, 03:20 AM
which Time??:D

Regards.
h6h
12-17-2002, 11:03 AM
I found an other one ... simple and useful

" HT is a file editor/viewer/analyzer for executables. The goal is to combine the low-level functionality of a debugger and the usability of IDEs. We aim towards a perfect hex-editing ability and support of the most important file formats.

Supported formats
Support means that HT will be able to correctly display and modify the executable header, image and other extensions specific to the file (import/export sections, relocations, debugging information etc.). Support will probably include the following file formats:

Win32 portable executables (PE) (good support)
Unix executable and linkable format (ELF) (good support)
DOS standard executables (MZ) (supported)
Win32 linear executables (LE) (supported)
Windows/OS2 "new" executables (NE) (supported)
Unix common object file format (COFF) + DJGPP COFF (supported)
OS2 linear executables (LX)
M$ object files (.obj)

Copy, paste, histories, undo
HT will in its final stage support some very comfortable function like copy, paste and undo. Most dialogs will have a history.

Searching/Replacing
Searching/Replacing in HT is going to be a very powerful function. You will be able to search using these methods:

hex/text search/replace
the simple hex/ascii search, options: case insensitive
C/ASM string search/replace
takes a mixed (C/ASM style) string as argument, options: case insensitive
regular expression search/replace
powerful extended regular expression search and replace function (perl style), options: not yet specified
Debugging features
The code analyser will have many advanced features that make understanding the analysed code much easier. These features include: call/jmp-tables, cross-references (xrefs), functions, special code wrappers for import-stubs, automatic label generation, powerful search functions

HT will be able to save code labels using these file formats:

.SYM binary file format
.MAP text file format
and others... "

take a look at :

http://hte.sourceforge.net/screenshots.htm

let's test ... it's free
and ( with source code ) WooW

Regards

.


Where is the Mark ??? (CrapKey)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Where is the Mark ??? (CrapKey)
PDA

View Full Version : Where is the Mark ??? (CrapKey)

Mandar
12-17-2002, 10:01 AM
1)What is the problem....
I am studying timetrials and how they mark the fact that the
licence has expired . I am using a target protected with CrapKey .

2)What is the protection.....
It is CrapKey Version 5.6
( I found this by checking 'CrypKey Version' in cki32h.dll properties ).

3)What tools are you using....
FileMon , RegMon on Win98

4)What tutorials have you read....
General Timetrial tuts and Marigold's tut about CrypKey

5)Show your output listing WITH comments....
I am attaching Regmon/FileMon logs.

6)NOW ask your question....
As you can see in the logs :
RegMon: there are no obvious entries here .
Filemon: there are only two possibilities of
a mark : ckinfo.txt and jsm51161.tbl .
So how does the program know that license has expired ???

Attachement deleted.
We don't need RegMon/FileMon logs, we need disassembled code with your comments, problems and possible solutions.
Snatch
12-17-2002, 11:33 AM
Mandar, the solution is not always found in Regmon or Filemon I suggest some other approaches. I used to think of them as great tools that would always show me where the data in the registry or what file was being used. It certainly is not that easy why not try some other approaches?

Snatch
squidge
12-17-2002, 01:24 PM
Yup, it's quite easy now to enter data into the registry without regmon being able to spy on it. There's also ways around Filemon so don't assume that just because they are not giving you the place of storage, that it is not happening...

Note also that some programs simply list a directory (normally a big one, like Windows\System) which doesn't really show a great deal in filemon, and then check the time/date or attributes field of a few specific files to get the installation date.
FoolFox
12-17-2002, 01:25 PM
Hello,

There is numerous way to check how many days have passed,
if you want to study time trial scheme you better ask yourself
"how could i check that time in a way that's not easily tampered
with ?"

you can just check the date when your app have been created and retrieve the system date from the Bios.... or try to find more obscure way to do so.....

Regards
FoolFox
r00t
12-26-2002, 01:09 AM
squidge:
it's quite easy now to enter data into the registry without regmon being able to spy on it?, really?, how can i do it?.

(I'm on Win98).

Greets


Import Address Table patching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Import Address Table patching
PDA

View Full Version : Import Address Table patching

SmallMan
12-17-2002, 02:18 PM
I'm trying to modify the behaviour of a kernel API function in a Win32 program.

So far I've created a DLL containing all of the functions the program imports from KERNEL32 (Obviously changing their names slightly), and each function calls the original function from the kernel with the exception of the one I'm trying to modify. I patched this new DLL into the program's Import Address Table by simply overwriting the KERNEL32 entry (They are the same length).

However, whenever I then try to run the program, I get an access violation. Is there something I've missed? Are certain kernel functions "tied" to the code that uses them in a special way? Is it naive of me to declare ANSI parameter-based functions with original non-resolved declaration in my DLL? Is there a simpler way to modify 1 function? :confused:
nikolatesla20
12-17-2002, 02:43 PM
Just a little more info ?

How did you compile your DLL? Win32 system DLLS are stdcall, so make sure you are declaring stdcall functions, or your stack will be hosed and you'll GPF.

Also, um, what do you mean you changed their names slightly....if you did that the entire IAT table would need to be changed, not just the DLL name entry.

You could also patch in a call to your own DLL quite easily by editing the IAT table manually and adding a new DLL entry. (In other words, add your DLL name reference, and then change the IAT table to point to the function name in that DLL instead). But this would be only if you were familiar with the IAT structures well enough.

-nt20
SmallMan
12-17-2002, 03:08 PM
I didn't explicity declare them as stdcall, no. That's not the default?

By changing the names slightly, I mean:-

GetTickCount

becomes

KetTickCount (K for KERNEL32) in the IAT, and a matching function is in my DLL, which returns GetTickCount(). The length of the names doesn't change. Where the names would be duplicate (For example GetCurrentDirectoryA and SetCurrentDirectoryA) I change the second character of one of them to E, and so on.

A restriction placed on what I can do is that the file size must not change. I've read a page about adding my DLL separately to the imports, but that would increase the file size.

I'd say I know the PE image structure fairly well (I wrote a program that changes the data, I don't do it manually, sticks in my head better that way). :D
JimmyClif
12-17-2002, 05:02 PM
/me is scratching my head....

You patched all the functions from Kernel32.dll so that they have different names.. then you created a dll with the real names which have the real names of the functions pointing to the renamed ones...

One problem is that Kernel32.dll always needs to have the 'thing' corrected... Checksum.. there we go... maybe you forgot about that... Use Pe-Sum for that... (protools)

Other thing is... why if you just want to modify 1 single function aren't you using a Hook for that ? Or patch Kernel32.dll at the function you want to take over pointing to your Dll ?
nikolatesla20
12-17-2002, 05:09 PM
If you are using VC++:

Go to the Project settings dialog

Go to C++ tab

Under the drop down box, select "Code generation".

Under "Calling convention" select "__stdcall". It's __cdecl by default in a win32 DLL project.

Save the project.

NOW

Names will usually get decorated with crap. You will see this if you open your dll in the dependency viewer. Exported functions will be decorated with extra characters. To avoid this, make a *.def file for the DLL.

NOW don't let somebody here fool you that you don't need the next step below! YOU DO. You can use _declspec to declare the function for exporting, but it will get DECORATED. If you use a DEF file, it won't. We don't want it to be decorated. SO use a DEF file. (If you use a DEF file, you don't need to declare _declspec or anything like that at all.)

Now, Go to "Project -> add files to project" and select a text file. Name it <your dll name>.def

In the def file, simply type a line that says "EXPORTS"

now put the name you want the exported function to have and then "=" and then the name of the actual function in the DLL.

Example:

EXPORTS
KessageBox=KessageBox

Then the linker won't decorate the names. It will export the names clean. Otherwise you'll get decoration. (decoration is when the name of the function in the DLL contains extra info about amount of parameters, parameter type, etc, for example, KessageBox could end up being exported as ?KessageBox@@YGHXZ@).

Do this an recompile and it should now work.

-nt20
SmallMan
12-17-2002, 11:37 PM
I always use .DEF files, so that's not a problem. If I can alias the function names however, I wouldn't need to change them in the program's IAT. Thanks for that. :D

A checksum shouldn't come into it. Nothing knows (or should know) that my KERNEL32 replaces the real KERNEL32 and as there's nothing in the imports section of a PE image to flag a "special" DLL, there should be no questions asked.

I don't think directly patching KERNEL32.DLL is an option (An anti-virus program would probably intervene). I could create a copy of the kernel local to the program, but I don't know how to "insert" my function into it.

Just to clarify, the program doesn't crash immediately, just a small way into its initialisation process I get an Access Violation. It makes a few calls, including the one I've changed, at startup, then Sleep, then a few OutputDebugStrings, and then stops. If I debug it with the normal kernel referenced the next thing the debugger notices is the dynamic loading of a DLL.
Woodmann
12-18-2002, 12:43 AM
Howdy,

I am also having trouble understanding this but,
I'm not the most intelligent person :)

Dll's are trying to load into the same space.
Are you sure the import table is correct.

Maybe start over and try the "hook" method.
It seems like a lot of work to change one function.

Later, Woodmann
SmallMan
12-18-2002, 01:17 AM
Load into the same space? How could that happen? I thought at run-time the PE loader loads each DLL and then maps them to the image's requirements. Could my DLL be obstructing the real kernel DLL? :confused:

Perhaps there's a way to patch the function by writing a program that calls CreateProcess with the program and suspends it, accesses the process's memory and changes it there?
nikolatesla20
12-18-2002, 03:18 AM
Actually, smallman, that is usually how it is done (loaders). It's very easy to suspend the created thread and then patch its memory , as long as you know where to patch.

Anyway, I was thinking - if you are getting an error on a loading DLL after a while, then it's a GetProcAddress problem it seems to me. On one hand, it's good the have your DLL have the name "Kernel32.dll" for any cases of GetProcAddress to work right, but this could cause a problem if somehow the system grabs the real kernel32.dll, also kinda dependent on the O.S. you are using - in it's win98, kernel32.dll is in shared memory and will only be loaded once......

I wouldn't think you would want your DLL name to be "kernel32.dll" , it should be something different, but of course then GetProcAddress won't work (if it so happens to be using that to access the ONE function you want to change.)

Well, who knows but I suspect a GetProcAddress problem.

I think it would be a better solution to patch memory at load time. It's very easy to do, since CreateProcess gives you a nice handle to all the information you need.

-nt20
SmallMan
12-18-2002, 04:26 AM
I fixed it!!!:D :cool:

Remember:-
Originally posted by SmallMan:-
Is it naive of me to declare ANSI parameter-based functions with original non-resolved declaration in my DLL?

I used the proper ANSI-based declarations for all of the "functionA" functions that needed it and voilá. Forgot XP == NT, hence string functions resolve to "functionW", for Unicode. :rolleyes:

I'd still like to persue the patching in memory thing, though. Anyone know a good page or two for it?
SmallMan
12-28-2002, 01:29 AM
Okay, I've messed about a bit, and this what I've tried to achieve:-

1. Open a program using CreateProcess, using debugger flags and loop to get hold of the PE image base address.

2. Move through the PE structure to the IAT once the initial breakpoint has been hit (That should ensure Windows has written the current addresses to it).

3. Replace the address for a specific function with that present in my program, the program that started the process. :p

Now, I seem to have run into a bit of trouble with WriteProcessMemory, in that it won't let me overwrite the address in the IAT (GetLastError() == ERROR_NOACCESS). I know there are flags in the characteristics of sections that make them read-only, etc., but how does that work in memory? If it's located on a specific page, can't I unlock it somehow (VirtualProtectEx) ? :confused:
nikolatesla20
01-06-2003, 03:00 PM
Not sure why you get that error, I've had no problem writing anywhere into a process when created with DEBUG flag using CreateProcess- make sure you are using OpenProcess() before WriteProcessMemory, just to be sure..maybe that will help?

-nt20
EAX
05-16-2004, 01:35 AM
you can do that you are doing, but is an easy way to do it, and not only is aplied to one process.
here is a code sample, is in asm.
but only works on win98/me, because xp and nt do not admit the VirtualProtectEx on a shared memory page.
EAX
05-16-2004, 01:48 AM
fist of all :Sorry my english.
Hey you, why did you think that every section have a protection flags: RWX and some others like share, etc.
This is because every process have a 4gb of virtual memory, this is not actually the real RAM memory but is emulated by a paging process.
The common page size is 4k = 4096 bytes, so every space addres of each proces is dividen in pages of 4k maximum, each page can be commited,free or reserved; and each one have protection flags for access.
you cant just go wherever you want and write, even there is places where you cant even read.
So you fist must do this,
1)determinate the address to write
2)call VirtualQueryEx specifing that address, this function retrieve the base address of the page that contains that address and his size (in the structure BASIC_MEMORY_INFORMATION), and also gives the protection mode.
3)If the page is read only, execute, execute read or some else you must have to change to execute_read_write. You can do this whit the function VirtualProtectEx
4)you change the value at the address
5)Set the previous page protection.

So that is all, an one more recomendation, change to asm32 and make me a happy
_______________EAX
EAX
05-16-2004, 01:58 AM
Here is a help that isnt so much if you dont know assember, if you dont know asm you must start to do it because you lose a lot of resources in programming if you only know only one language, even more if you that isnt assembler because you can do EVERYTING with asm.
have luck with your proggie, i hoppe this info to be usefull to you.

here is an local api hook of the MessageBoxA
________EAX


help me on reversing hash function
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > help me on reversing hash function
PDA

View Full Version : help me on reversing hash function

akimp3
12-17-2002, 02:24 PM
Hi

I am trying to code a little proggy for decrypting
award bios password. I know that a lot of this proggy
are ready to use ,but i want to learn something.

I have dumped the cmos with different passwords and
i have found the hash of the password the hash is a 16
bit value.
here is some sample :

@ = 4000
a = 6100
2 = 3200
space = 2000
@a = 6101
@b = 6201
@2 = 3201
@space = 2001
a@ = C401
b@ = C801
2@ = 0801
ba = E901
space@ = C000
aa = E501
@@ = 4001
@a@ = C405
@b@ = C805
@2@ = 0805
@space@ = C004
ab = E601
@aa = E505
@ab = E605
ab@ = D807
space@space = 2003
@@a = 6105
@@2 = 3205
a@@ = 5007
2@@ = 6004
aa@ = D407
a@a = 7107
a@b = 7207
@aa@ = D417
a@@a = A11D
aaaa = 3520
aaaaaaaa = 5555
abcdefgh = C471

at left is the password string and the right side is the hash.
as you see for example the hash of @ is 4000,as you know
the ASCII code of @ is 40h.
hash(@a)=6101 theASCII code of a is 61h and ROL 40,2
(40 rotate left two time is 1) so the hash is 6101.
As you see i can not figure out the hash algoritm used by
Award could you please give me a hand?
how should i analyze this data?
do i need to find more hash examples?

I am waiting for your helps.
squidge
12-17-2002, 05:11 PM
Why not just decompile a recent Award bios ?
akimp3
12-17-2002, 05:28 PM
Hi
thank you very much for your quick reply if you mean
dissassembling, i have already done that but as you know
the bios code can not use any interrupt becaure there is no OS
and itself is the bios.so it works directly with the hardware.for
example it writes directly to the graphic memory for displaying
a message.So the dissassembled code in not comprehencible,i can not find the hashing part.
if you have any suggestion please don't hesitate.

thanks
mike
12-17-2002, 08:39 PM
I think he meant reversing any of the "Award BIOS" cracker programs. I think the hash is a linear function of the inputs, however, so if you get enough in/out pairs for each length you can solve it directly.

Basically, you have a variable for each input bit and a variable for each output bit. Each variable is, of course, either 0 or 1. You put one line in your matrix for each pair and then XOR rows so you get a diagonal matrix of input bits. This will show you what the function is.

If you want to come up with a password that matches the hash, just solve for a diagonal matrix of output bits instead.
naides
12-17-2002, 08:45 PM
Just a suggestion:

1 - I think the hash includes a 00 byte at the end of the string, as a string terminator.

Attempt to systematically produce the hash of sequential first single bytes:

00 hash 0000
01 hash 0100
02 hash 0200
.
.
.
FF hash FF00

then pairs of bytes SEQUENTIALLY

0000 HASH ?
0001 HASH ?
.
.
.
6201
.
.
.
6204

And so on. If the hash is simple enough (a VERY wild assumption, the hash can be very complicated) , you may get a glimpse of the nature of the opearations

Also think that the hash takes an undefined number of bytes, and produce a short int. any series of ops have to be constructed under these restrictions.
squidge
12-17-2002, 10:28 PM
Yup, that's what I meant, but it ended up getting rushed and so half-finished.

I've attached some source code that recovers BIOS password from a range of bios makes (award, ami, etc as well as some specific laptops). As this source code is freely available on the net for download, I don't see a problem publishing it here for anyone interested.

Note: I've no idea if this code is compilable - it's meant for educational purposes only.

Originally posted by mike
I think he meant reversing any of the "Award BIOS" cracker programs. I think the hash is a linear function of the inputs, however, so if you get enough in/out pairs for each length you can solve it directly.
akimp3
12-18-2002, 12:14 PM
Hi

than you(sqidge,mike,naides) for your help i found some good details that will solve the problen foe string with one an two
character here are my discoveries:

a@
0000000001100001 61
0000000011000010 rol,1 c2
0000000001000000 40
0000000100000000 100 rol,2
0000000111000010 01c2
0000000111000100 01c4 add 2
0000000111000100 01c4

1100010000000001 c401

rol1 x
rol2 y
x=x+y+2
b@
0000000001100010 62
0000000011000100 rol,1 c4
0000000001000000 40
0000000100000000 100 rol,2
0000000111000100 01c4
0000000111001000

rol 1 x
rol 2 y
ROL,1(low niblle y)
x=x+y
ba
0000000001100010 62
0000000011000100 rol,1 c4
0000000001100001 61
0000000110000100 184 rol,2
0000000111100110 01E6
0000000111101001 low nublle y*2 01E9
rol 1 x
rol 2 y
rol ,1 low nublle y*2
x=x+y

a@a 7107
0000000001100001 61
0000000011000010 rol,1 C2
0000000001000000 40
0000000100000000 rol,2 100
0000000111000010 01C2
0000000111001000 01C4

0000000111001000 01C4
0000001110010000 rol,1 390
0000000001100001 61
0000000110000100 rol,2 184
0000010100010100 514

0000011101110001

0000000111001000 01C4
0000011100100000 rol,2 720
0000000001100001 61
0000001100001000 rol,3 308
0000101000101000 0A28
0000001010110111 0A28-771
0000011101110001 0771

a@b 7207
0000000001100001 61
0000000011000010 rol,1 C2
0000000001000000 40
0000000100000000 rol,2 100
0000000111000010 01C2
0000000111001000 01C4

0000000111001000 01C4
0000001110010000 rol,1 390
0000000001100010 62
0000000011000100 rol,2 C4
0000010001010100 454
as you see the formula is:
1-rotate one time to left the first ascci code.
2-rotate two time to left the second characters ascii code.
3- add this two number
4- rotate to left the low niblle of the new number.

by this formula works fine for string of length 1,2
but the part yhat i rotate the low nibble of the sum is not
rigth for string that have 3 or more character so i have to do
something else instead of rotating.
I don't know witch operation will give me the disired result.
please help me to solve this.

akimp3
akimp3
12-18-2002, 01:39 PM
@mike

Hi

I am very stupid and i can not understand the matrix that
you told,could you please give me a shape or an example of the matrix?

thanks

forgive me for being a dumb

akimp3
mike
12-18-2002, 07:59 PM
Did you ever do solving systems of linear equations in high school? Like

a+2b+3c=52
a-b+c=8
a-2b+c=0

You make a matrix

1 2 3 52
1 -1 1 8
1 -2 1 0

And then add and subtract multiples of rows until you get

1 0 0 6
0 1 0 8
0 0 1 10

and you know that a=6, b=8, c=10.

In this case, we had 3 inputs and 1 output. In your case, you'll have 8n inputs and 16 outputs, where n is the number of characters in the password. All your variables are either 0 or 1. Use XOR instead of adding or subtracting.

If you're right about adding being part of the algorithm, though, this won't work. Look at the file squidge posted to be sure it's all linear (only rotates, shifts, or xors).
akimp3
12-19-2002, 04:01 PM
Hi
Thanks to all of you that helped me in learning.
Finally i have foung the algorithm of generating this hash.
Here it is:

x=0;
i=0;
while(string!=null){
{
rol(x,2); //rotate left
x=x+char[i];
i++;
}

Now that i have the algo,as far as i know a hash is a single way function so after reading the hash from the cmos i have to use a
bruteforce to find what character have produced this value.
Is it really impossible to make a reverse function for the hash
after finding its algo?
if not, is there anyway to optimize the bruteforce?

thanks

akimp3
mike
12-19-2002, 08:28 PM
If the password is 4 chars or less, you can reverse it directly, since the rol doesn't bring any bits around to the low end. Pretend rol x,2 is x=x*4 and then you have something like

hash = 4^3 str[0] + 4^2 str[1] + 4 str[2] + str[3]

You may be able to extend it to five chars by guessing high bits of str[0].

Anyway, if you can do four or five chars fast, then you can brute force the rest of the chars very quickly.


unpacking Official CFF Crackme 3.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking Official CFF Crackme 3.0
PDA

View Full Version : unpacking Official CFF Crackme 3.0

dipeshrestha
12-20-2002, 05:25 AM
Hi all,

I am trying to manually unpack the Official CFF crackme 3.0 with the help of one tutorial. the apps. is packed with UPX.

In his tutorial (that I have attached with this post), he said to find the pattern 61E964B5FEFF and replace E9 with CC. Now what i am not understanding is why to search that specific pattern? How to find out that pattern in another apps. packed with other packers? I am eager to learn more about this. Can u help me with this stuff?

Also when i replace E9 with CC and run that program it crashes after i get out from Sice.

Crackme can be downloaded from: h__p://www.snet.com.np/dipesh/crack.zip

dipeshrestha
Still Beginner :mad: :mad: :mad:
Snatch
12-20-2002, 06:46 AM
I believe that string is the place where it jumps to the OEP as E9 is a long jump. He recommends you change it to CC so it will break in the debugger at the int3 and you will be able to step and get to the OEP. However you must replace while you are in the debugger the CC back to the E9 and set the IP to the E9 instruction otherwise it will start executing the address of the jump as assembly instructions and that is never good... I am no unpacking wiz so if I am wrong here somebody tell me but this one seems fairly straight forward.

Snatch
ZaiRoN
12-20-2002, 09:58 AM
You are right Snatch!

>Now what i am not understanding is why to search that specific pattern?
Upx places the code to unpack the file between pushad and popad instructions. A classical scheme of the upx loader is the next:

pushad
<--- LOADER USED TO UNPACK THE FILE --->
popad
jmp OriginalEntryPoint ; this jump will bring you to the beginning of the unpacked file

In the specific case, you have:
455BB0 60 pushad
---
455D06 61 popad
455D07 E9 64 B5 FE FF jmp 441270 ; here, if you want you can dump your unpacked file So, CoDe_InSiDe said to find the specific pattern because in this way you don't need to step the entire loader. You can use this method for every program packed with upx (the pattern will not be the same ;-))

regards,
ZaiRoN

ps. why don't you use 'upx -d filename.exe' !?! :p


A little challenge (maybe?)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A little challenge (maybe?)
PDA

View Full Version : A little challenge (maybe?)

hobgoblin
12-23-2002, 03:39 PM
Hi guys,
I've been playing around with CDRoller 4.11 for a few hours. In the unregg'ed version you can't save your files (you can't rescue or copy files from a disk to your HD). To get it registered you have to fill in a valid serial. I don't care about finding the serial, but I'm interested in finding out a way to patch the program into saving files when you rescue/copy files. I have located a call starting at 48D6E4 that takes care of showing a dialogbox when the rescue process is starting. (You have to force the program to jump at 49FD30 first, otherwise you never enter the call at 48D6E4).Someplace during this call the api writefile is called, at least it has been like that in previous versions (in the regg'ed version), and the rescued file is written to my HD). But I can't find out where this takes place....
I may have gone blind on this one and missing an easy solution. I have checked with an earlier version, and in that one everything is clear. But not in version 4.11....
So if someone doesn't have anything better to do, please take a look and see if you can solve the riddle.:)
All kinds of feedback is welcomed..

regards,
hobgoblin
ZaiRoN
12-24-2002, 02:52 PM
Hi hobgoblin,

Nice target you have found!
The proggie is not packed, is relative small and it's quite interesting. It offers the possibility to learn how to use one of our tools. In fact, the program is written in Delphi and DeDe is the tool that makes our lives much more easier.

Hobgoblin, I have take a look at the target, in particular at your advice, without success because I lost myself in the code :-)
So, I tryed to study the protection routine. For those whom want to try it I suggest to load the file with DeDe and look at 'Forms' panel. TFormAbout is the Class Name contains the definition of the registration dialog box. In particular, it contains the object TButton with the method 'OnClick = ButtonAcceptClick'; this is the function called when the 'Accept' button is pressed. To find the code of this method is simple; select the 'Procedure' panel and the unit 'About'. Now, you have all the necessary in front of you! Btw, the routine protection I have found seems to be fake (4795EE/479654); in fact, to find a working serial is very easy but the problem is that after the congratulation box, the program still remains unregistered. I fear the program saves some datas in the file .cfg but I'm not totally sure.
The program needs much more stepping :D

ZaiRoN
squidge
12-24-2002, 03:16 PM
DeDe is indeed a brilliant tool, and now that the source code is available to all, it's even better :)

Let's not forget our program identifier programs too though, I still regard PEID as a great program that can not identify numerous packers, but can identify compilers too. A quick right-click on the target immediately tells us it's not packed and written in Delphi.

Run the program, and try to extract tracks and it shows the message "Unregistered version performs an actual CD media reading and" blah blah... Search for this with a hex editor and it gives us a few locations, one of which is 9f23C. Looking at the sections in the file, we can see this is in the code section and would resolve to 49fe3c. Finding a reference to this gives us a nice cmp/jnz just before it. Flipping this junk gets rid of the nag. It doesn't register the program or create the output file however - for that, we need to setup the flags near the beginning of the program, and not let the program itself interfere with them. This is quite an easy task, so is not documented here.

I used Ollydbg to flip the jump as I didn't want the bother of hex editing the file and rerunning it.

(Note that the addresses above point to what seem to be a red herring and points to code that is not actually called? It is upto you to find the correct string and reference as we are not allowed to do this kind of work for you.)


This PE file is not in standerd windows format ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > This PE file is not in standerd windows format ???
PDA

View Full Version : This PE file is not in standerd windows format ???

Care+
12-23-2002, 10:26 PM
hi..
when i opened an exe file with w32dasm i got this message saying :"This PE file is not in standerd windows format All data references will be terminated"..........
i searched the net fount the same thing with a program the auther saied to delete .rsrc from program object i ..
i used a hex editor and fill the area of this object with zeros but the same problem still show up and w32dasm shows no resources references
it's clear an anti-dissassmbler trick but how can i solve such a problem ?

Thanks & Best Regards
Care+
Woodmann
12-23-2002, 11:46 PM
Howdy,

search for anti-disassemble, anti-softice etc: The button is in the upper right corner of every page.

Peace, Woodmann


Need help with unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help with unpacking
PDA

View Full Version : Need help with unpacking

sailor_eda
12-24-2002, 06:07 AM
1)What is the problem....
Need help unpacking a small program, actually a keygen. I'm curious to know how it works.

2)What is the protection.....
Dont know exactly and all the manual ways to unpack dont work. I'm sure I'm not doing this properly.

3)What tools are you using....
- Procdump 1.6
- PEditor 1.7
- Unpack
- IDA Pro 4.01
- Revirgin

4)What tutorials have you read....
Tutorial written by Predator [PC/pGC]
Unpacking: a generic approach, including IT rebuilding.
+ several others

5)Show your output listing WITH comments....
- They are bunch of dump files, dont know how to include those here.

6)NOW ask your question....
sailor_eda
12-24-2002, 06:10 AM
Sorry, forgot to ask my questions

- I'm not sure if the dump from procdump is correct or not.
- Using PEditor to fix the section tables just gives me an error messages saying that "this file in not in win32 format."
- What am I doing wrong? Or is my whole approach wrong?

Any clues, tutorials that explain this particular kind of packing would appreciated.
Woodmann
12-24-2002, 06:32 AM
Hi,

You are unpacking a keygen ?

This confuses me :(

If you are trying to unpack a program try pe-scan to find out
what it is packed with.

Actually start over again with what you are trying to do.
(prog name, what is the packer, what are your problems)

Peace, Woodmann

Thank you for reading the FAQ :D
Kayaker
12-24-2002, 07:08 AM
Lol, someone's been reading the FAQ :D You'll get help. Procdump is a bit old and may not be able to handle certain packers, at least without a script. You may be better to manually trace to what you are sure is the OEP and do an Icedump /PEDUMP, or (my personal preference) a raw /DUMP and rebuild with PEditor (VS=RS, VO=RO and maybe rebuild the imports).

If you want to use Procdump or LordPE/PEditor instead you should suspend the process at the OEP with 'jmp eip' and do a full dump with the minimum number of "fix-it" options until you are sure you're getting a reasonably good dump. Some other members may know the best settings to use say for some of the new features of LordPE. If you got an error message that the dump is not in Win32 format, take a look at the PE header in a hex editor and make sure it looks at least somewhat similar to a regular PE header, PEditor likely only looks for the presence of "MZ" and "PE" before kicking out that error message.

Could be a number of things, depending on the packer, but this is a start without more info.

Cheers,
Kayaker
sailor_eda
12-25-2002, 06:44 AM
Thanks for the simple pointer. I've been trying to unpack a keygen - I was curious to see how they generated the serial number.

For the past 5 days I've been trying different ways to unpack this little program and its almost too easy with PE-Scan.

Thanks for your help. It is really appreciated.

You guys are awesome.

Sailor


linux reverse engineering
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > linux reverse engineering
PDA

View Full Version : linux reverse engineering

himanshu
12-24-2002, 02:18 PM
i just downloaded the mikrotik router for setting up a linux based router. but mikrotik router is a commercial product and requires a serial number.

since i have never cracked a linux app before , so i decided to give it a try.

Since the installation program is very primitive and dd's the image on hard disk. so u cannot create create partition manually.

i have two hard disks,so i installed it one hd and used the explore2fs utility to read the partition from windows xp.

i looked in the rc.d directory to check for startup daemaons.there was a symlink to /nova/bin/login.
so, a quick search for "invalid id", in the folder /nova, listed the following apps:
/nova/bin/login
/nova/bin/key
/nova/bin/unlok
/nova/bin/racoon

so i loaded them into IDA. the program unlok generates the key by using some ioctl calls. it also accese the /nova/etc/serial file. dont know for what.and if the key is correct it stores in /nova/etc/license

so , there are two approaches, either i generate a keygen or either we patch the programs.

so, here i need your help now. some pointer to good linux reversing site will be helpfull.

thanks
squidge
12-24-2002, 03:20 PM
This will not help you now, but maybe useful in the future. did you know that if a program uses DD to install itself to a partition as a full operating system, you can mount that file using the mount command by using the loop option ? I use this option for mounting cd images downloaded from the net instead of writing them out. You can then tar the files up, or extract them to a place on your fat32 file system, which makes exploring using a non-linux based os much easier.


hmmmmmmmmmmm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hmmmmmmmmmmm
PDA

View Full Version : hmmmmmmmmmmm

peterg70
12-25-2002, 03:24 AM
Interest Problem.

I tried to run the new skw from crapkey and tried to attach with ollydbg once the program was running.

I get unable to attach?? tried version 1.08 no difference.

Any ideas

peterg
squidge
12-25-2002, 10:24 AM
I thought I had the latest crapkey SDK, but it doesn't do anything like you described in this and previous messages - is there somewhere I can get the SKW from you so I can take a look at this? It seems quite interesting than before. I don't want the sdk, just the SKW exe and any of it's support files it requires. I'll PM you an email if that's better than www/ftp addy.
squidge
12-27-2002, 12:03 AM
Ok, I now know why you can't attach to a running Crypkey 6 Stealth app. It's because it's already being debugged. By itself :)

Yup, the loader code creates a spin-off process, and calls it with it's own process id. This process then takes over the parent using DebugActiveProcess, but runs the parent as normal. Of course, now the parent is being "debugged", it can't be accessed by any other app !

OllyDbg tries to attach to the process using the same call, but this will fail because it's allready being debugged.

Naturally, this also means you can't run any Crypkey stealthed app in a debugger, as the spin-off process will not be able to gain control of it's parent as your debugging it, so the program will simply exit with an error message from the child.

Not sure how deeply nested this goes - whether I can simply strip all the debug code from a stelthed app, or it actually uses it for something useful. If I just get rid of the DebugActiveProcess call, I can find the OEP of the original process, but the import addresses are mashed, so the program simply crashes. Dumping it and examining the import table gives a valid table, but with corrupted DLL names and function names.

It's about time Crypkey gave us something new to get our teeth into :) I wonder who designed it for them.... <G>


Changing page table entry flags
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Changing page table entry flags
PDA

View Full Version : Changing page table entry flags

spark!
12-25-2002, 01:02 PM
Here's my problem:

MODULE .txt 0003 0167:0217A000 00001E25 CODE RO

I want to patch the code inside using my own code executed directly from SICE. Of course it cannot happen as long as the memory above is RO. The result is nice GPF when trying to patch. So I wanted to change flags from RO to RW, I played with /pageflag from icedump but it didn't change anything for me. Guess I don't know how to use /pageflag :) I tried also to play with VirtualProtectEx but since proc/thread won't show MODULE anywhere I can't get its PID thus I can't get the handle - so I can't use VirtualProtectEx.

So I'm asking - how to use /pageflag or how to manually change the flags for this section?

Merry Christmas everyone :)
Fake51
12-25-2002, 01:58 PM
Use a PEeditor, for simplicity.
Or look thru some essays bout createprocess and virtualprotectex.

Fake
spark!
12-25-2002, 02:18 PM
The trick is that I can't use PE editor. This code is unpacked from another code and probably protects itself using VirtualProtect. I don't want to change this. I want to deprotect it after that. I looked all over this board and googled searching for virtualprotectex. All I found was examples with known handler (you create the process so you know the handler).
Fake51
12-26-2002, 01:23 PM
And what stops you from doing the same?

Fake
tgodd
12-26-2002, 02:24 PM
The page directories/tables are cached.

So if you manipulate the page table and/or page directory,
you have to force the processor to reload the tables.

You should really read up on the paging mechanism.
You can download intel docs here:

hxxp://x86.ddj.com/intel.doc/inteldocs.htm

(change the xx to tt of course) :)

This is a great resource for intel processor info,
as it includes information on undocumented opcodes and the like.

Hope this will help you along.

Regards,

tgodd

P.S. Merry Christmas and have a Happy New Year.
spark!
12-28-2002, 10:41 PM
Thanks, I'll have a look then :)


un unknown
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > un unknown
PDA

View Full Version : un unknown

Mostek
12-25-2002, 09:12 PM
Well guys you can check this one if you want.
No file inspector detects it.

http://www.hc11.demon.nl/thrsim11/thrsim11.zip

Peace
Mostek
squidge
12-26-2002, 01:34 AM
Seems to be PC-Guard -> hxxp://www.sofpro.com

Looking on there website, it seems to be yet another shell protection...

Extract -> "you don't need any source code changes or great programming experience to accomplish professional software copy protection of your programs. PC Guard can by used by anyone, from professional programmers to programming beginners."

One other nice thing I've seen on there is "Feel the power of pure assembly coding! All PC Guard family products are mainly coded in ASM for speed, tight code and the best security. Dos version is 100% coded in 8086 assembly. Windows versions are coded in C++ (user interface) and 80386 ASM (all of the protection code).". Don't know about you, but I just love protection code written in pure asm. So much more easy to follow than optimised C/C++.

They also advertise a demo of the protection system on there front page, which is available for downloading.

I'll check it out later. May be interesting...
Mostek
12-26-2002, 02:40 PM
Yeah I kinda figure that out. Snacker gave a 5min shot at it and all he got with dumping is 3.4kb. :(

And as I don't know shit about this packer protection, as I'm more into driver programming, I thought you guys will have a little fun with it. A Christmas gift. ;)

Anyway going back to programming 8051(a school project). :)

Of course if you'll find something interesting I'm more than interested in that reading. :)

Peace
Mostek
squidge
12-26-2002, 02:49 PM
Yup, managed to dump no more than 4Kb :(

Downloaded the demo version of PC-Guard and told it to protect Notepad.exe (something that I know the EP of) but the resulting file will not work regardless of what settings I use, which makes out job a little harder.

However, you can break into it by attaching to the process with Ollydbg and view the memory there. Trying to dump the memory however gave me a nice blue screen and restart (winXP).

I'll have to check out the loader code and see what it does.
Mostek
12-26-2002, 03:03 PM
There is even a small anti sice in there. :)

Peace
Mostek
_Servil_
12-27-2002, 06:46 PM
hello

i looked at your app and dont know too much about pcguard but if i can believe pe-scan it's pcguard.

if you have LordPe, try fix the imagesize before you dump, it makes the snapshot little bigger ;)

anyhow i didn't resolve original entrypoint since it didn't allow debugger to trace through the protection layer.

dumped on-the-fly for IDA and found WinMain at 0x00512538. However this can't be real EP, no refs to it from the app module - it might be handled by BC's lib function __startup() (but no occurence in main module), or it might be called from the gui-dll, btw. protected by PCG too.

are you going to release the resource dereferencer thingy for ida?
squidge
12-27-2002, 07:54 PM
Hi m8,

After my first 4kb attempt I did try again with fixing the image size. However, although the output was over 1mb, about 900Kb of it was full of zeros.

Had a look at a PC Guard decryptor from our favourite tools website and although the PC Guard GUI looks like a 9 year kid designed it, the actual protection itself seems pretty serious.

I'm going to carry on and play with Crypkey 6 a bit more, as I'm having some real fun with it.
Iwarez
12-27-2002, 09:49 PM
The OEP is at 401000. I'am pretty sure of this. I also fixed the IAT but I have problems breaking on the OEP because of the anti-debugger stuff. Therefore (or because maybe my dump is bad) I experience a GPF when running it.
Mostek
12-28-2002, 02:15 AM
_Servil_

Was "are you going to release the resource dereferencer thingy for ida?" for me?

If yes. Are you talking about strings plugIn?
If yes. There is a plan for doing this, but the lack of time is really big at my end. :(
School and programming a sound card driver eat pretty much all the time I have.
But as I have promised this to Tsehp I'll do it eventually.

Peace
Mostek
p.s. It looks the progy is a real bastard. :)
Uradox
12-29-2002, 06:41 AM
OEP is indeed 401000 good work Iwarez
GUI.exe
ITRVA = 0016B10C
Size = 0000653E
See attached imprec tree.
Unpacked exe is roughly the same size as protected
Should now run without any problems

:D
_Servil_
12-29-2002, 07:16 AM
HI guys,

my copy is showing an error

The following connectable components can't be found;
- Switch
- LED
- 7Segments
- Hex7Segments
- Byte7Segments
- Word7Segments
Probably because the required DLL's are deleted or misplaced. Please reinstall these components.

Interesting it shows also when I restore all the original files (actually there's only the executable modified by me).

And yes Mostek, I thought the string plugin. I think it'd be useful, something like w32dasm does into comments.
Mostek
12-30-2002, 04:25 PM
Uradox: Could you send the unpacked file to my mail?
So that I can disable the other demo limitations and give working progy to my friend.

I would be very happy if you could.

_Servil_: I think the next time I'll have a little time I'll not work on i2s but on strings plugin.
Could you please send me the picture of how the resource reference looks in WDasm (I'm not using it for a long time so ..).

Peace
Mostek
TheSearcher
12-30-2002, 05:01 PM
:eek:
Think you should unpacked yourself Mostek
Mostek
12-30-2002, 05:24 PM
As I sad before I don't know anything about unpacking. :(

I know it's sad, but that's life. I only have so much time.

And more I'm not saying that he should send me the progy,
if he will I'll be very happy or friend of mine will be,
if not well that is life too.

Peace
Mostek
Woodmann
12-30-2002, 10:19 PM
Ya'll know better then this..................

If you want to conduct such bizniz, take it on the
down low, email was created for such a purpose, aaaight.

Peace out,

¥OBC
Mostek
12-31-2002, 02:32 AM
My humble apology. :)

Peace
Mostek
banshee
01-01-2003, 08:38 PM
I also unpacked this proggy. Just one stupid question ;-)
What kind of SI detection in SplAj's classification it uses:

1) NTice class driver check(meltice)
2) BHCK boundschecker check
3) GF,MJ check
4) UnhandledException check
5) SIWVID class driver check
6) Int 1
7) Actual installation of SI in the registry
or any other?

I didn't use any patch for SI, just manually edited ASCII "NTice.sys" in target's memory.

P.S. My reconstructed IT has some differents in size and your's doesn't work by me. What is the problem?
esther
01-02-2003, 12:50 AM
Hey guys!
you are not supposed to upload IT.txt files in here
Kayaker
01-02-2003, 05:37 AM
OK guys and gals, we've reached a consensus and these it.txt file attachments have to be considered in the copy 'n paste 'n crackit category, just as a matter of course, considering the target is also named.

Sorry, they seem harmless enough because they're not intended for lamers for sure, but if we have to enforce rules for the good of the board then we have to live by them too.

People can still rip a protection apart to learn how it works and discuss things to death and have fun here, I mean that's the whole point, but this can be done without these complete IT fixups.

Regards,
Kayaker
Uradox
01-02-2003, 05:50 AM
Sorrry bout the import fix.
banshee first of all my sice has been patched and program did run fine.
As for import size yes my size is way bigger than the table attualy is but the imprec version i was using was screwing up if i cut the size down. If you use my import.txt you will notice a diffirence between that and if you were to just use my details (cleaning and cutting to be done :))

I didn't use any patch for SI, just manually edited ASCII "NTice.sys" in target's memory
I take it by doing this you understood then what sice checks it was doing?
banshee
01-02-2003, 01:40 PM
Firstly, I am very sorry about posting IT. I had to notice that rules changed.

Uradox: The irony is that I managed to recognize where the check is performed, but I am still newbie and don't know what exactly tricks from the list I posted above looks like.
If anybody who read this thread can explain what kind of detectionit uses:
Check begins by calling GlobalAlloc for some buffer, then it calls the function that enumerates all loaded *.sys modules (don't remember it's name exactly). After doing that it scans the buffer and compares filenames with predefined ASCII "NTice.sys". So by patching in memory that value we get SIce hidden.
Crimson Sunset
01-03-2003, 02:12 AM
No need to use imprec or revirgin on this target
a clean import table is decrypted when run.:D

Can't seem to understand the anti-softice trick used however,
and Pcguard itself isn't fooled by editing "NTice.sys" string in mem.
(beginning to get frustrated, hope someone will give me a hint)
Kayaker
01-03-2003, 06:01 AM
OK, you got me interested ;)

The PCGWIN32.EXE program itself, I don't know about something packed with it, uses the old CreateFileA method of Softice detection (Meltice). Many, many, many times... Detects for \\.\SICE, \\.\NTICE, \\.\TRW, and something called \\.\ZTW (wtf is that?)

After the call to CreateFileA, if it returns a valid handle to say \\.\SICE, there's a call to CloseHandle and SetErrorMode, then C847h bytes are overwritten somewhere with 0's then the killing call to ExitProcess is made. What's interesting is how it handles the check for a valid er, handle, making use of the Zero Flag and SMC to hide where the decision is made. Here's a little unobfuscated code for fun which shows what's going on. This is from TraceDump, a perhaps soon-to-be-released app for Win98 which makes use of the power of the Backtrace feature of Softice...

After decrypting the Import table a call to CreateFileA is made...

44DBBB 6A00 PUSH 0 ; hTemplateFile
01 44DBBD EB01 JMP SHORT 44DBC0
02 44DBC0 9C PUSHF
03 44DBC1 EB01 JMP SHORT 44DBC4
04 44DBC4 EB08 JMP SHORT 44DBCE
05 44DBCE EBF7 JMP SHORT 44DBC7
06 44DBC7 9D POPF
07 44DBC8 EB01 JMP SHORT 44DBCB
08 44DBCB EB03 JMP SHORT 44DBD0
09 44DBD0 6A00 PUSH BYTE +0 ; dwFlagsAndAttributes
10 44DBD2 60 PUSHA
11 44DBD3 E803000000 CALL 44DBDB
12 44DBDB EB01 JMP SHORT 44DBDE
13 44DBDE 58 POP EAX
14 44DBDF EB01 JMP SHORT 44DBE2
15 44DBE2 40 INC EAX
16 44DBE3 EB01 JMP SHORT 44DBE6
17 44DBE6 FFE0 JMP EAX
18 44DBD9 EB0E JMP SHORT 44DBE9
19 44DBE9 61 POPA
20 44DBEA 6A03 PUSH BYTE +3 ; OPEN_EXISTING
21 44DBEC EB01 JMP SHORT 44DBEF
22 44DBEF 60 PUSHA
23 44DBF0 E803000000 CALL 44DBF8
24 44DBF8 58 POP EAX
25 44DBF9 EB01 JMP SHORT 44DBFC
26 44DBFC 40 INC EAX
27 44DBFD EB01 JMP SHORT 44DC00
28 44DC00 FFE0 JMP EAX
29 44DBF6 EB0B JMP SHORT 44DC03
30 44DC03 61 POPA
31 44DC04 6A00 PUSH BYTE +0 ; lpSecurityAttributes
32 44DC06 EB01 JMP SHORT 44DC09
33 44DC09 9C PUSHF
34 44DC0A EB01 JMP SHORT 44DC0D
35 44DC0D EB08 JMP SHORT 44DC17
36 44DC17 EBF7 JMP SHORT 44DC10
37 44DC10 9D POPF
38 44DC11 EB01 JMP SHORT 44DC14
39 44DC14 EB03 JMP SHORT 44DC19
40 44DC19 6A00 PUSH BYTE +0 ; dwShareMode
41 44DC1B 60 PUSHA
42 44DC1C E803000000 CALL 44DC24
43 44DC24 EB01 JMP SHORT 44DC27
44 44DC27 58 POP EAX
45 44DC28 EB01 JMP SHORT 44DC2B
46 44DC2B 40 INC EAX
47 44DC2C EB01 JMP SHORT 44DC2F
48 44DC2F FFE0 JMP EAX
49 44DC22 EB0E JMP SHORT 44DC32
50 44DC32 61 POPA
51 44DC33 6800000080 PUSH DWORD 80000000 ; GENERIC_READ
52 44DC38 60 PUSHA
53 44DC39 E803000000 CALL 44DC41
54 44DC41 EB01 JMP SHORT 44DC44
55 44DC44 58 POP EAX
56 44DC45 EB01 JMP SHORT 44DC48
57 44DC48 40 INC EAX
58 44DC49 EB01 JMP SHORT 44DC4C
59 44DC4C FFE0 JMP EAX
60 44DC3F EB0E JMP SHORT 44DC4F
61 44DC4F 61 POPA
62 44DC50 50 PUSH EAX ; //./SICE
63 44DC51 EB01 JMP SHORT 44DC54
64 44DC54 9C PUSHF
65 44DC55 EB01 JMP SHORT 44DC58
66 44DC58 EB08 JMP SHORT 44DC62
67 44DC62 EBF7 JMP SHORT 44DC5B
68 44DC5B 9D POPF
69 44DC5C EB01 JMP SHORT 44DC5F
70 44DC5F EB03 JMP SHORT 44DC64
71 44DC64 FF95784E4100 CALL NEAR [EBP+414E78] ; CreateFileA
72 44DC6A EB01 JMP SHORT 44DC6D ; returns with Zero Flag set
73 44DC6D 60 PUSHA
74 44DC6E E803000000 CALL 44DC76
75 44DC76 58 POP EAX
76 44DC77 EB01 JMP SHORT 44DC7A
77 44DC7A 40 INC EAX ; unsets Zero Flag (ZF)
78 44DC7B EB01 JMP SHORT 44DC7E
79 44DC7E FFE0 JMP EAX
80 44DC74 EB0B JMP SHORT 44DC81
81 44DC81 61 POPA
82 44DC82 8BD8 MOV EBX, EAX ; mov CreateFileA handle to EBX
83 44DC84 60 PUSHA
84 44DC85 E803000000 CALL 44DC8D
85 44DC8D EB01 JMP SHORT 44DC90
86 44DC90 58 POP EAX
87 44DC91 EB01 JMP SHORT 44DC94
88 44DC94 40 INC EAX ; no change to ZF
89 44DC95 EB01 JMP SHORT 44DC98
90 44DC98 FFE0 JMP EAX
91 44DC8B EB0E JMP SHORT 44DC9B
92 44DC9B 61 POPA
93 44DC9C 43 INC EBX ;

; if EBX contains a valid handle this has no effect on the ZF, it's still unset
; if EBX contains FFFFFFFFh (SoftIce not detected) this *sets* ZF to "on"

94 44DC9D EB01 JMP SHORT 44DCA0
95 44DCA0 9C PUSHF
96 44DCA1 EB01 JMP SHORT 44DCA4
97 44DCA4 EB08 JMP SHORT 44DCAE
98 44DCAE EBF7 JMP SHORT 44DCA7
99 44DCA7 9D POPF
100 44DCA8 EB01 JMP SHORT 44DCAB
101 44DCAB EB03 JMP SHORT 44DCB0
102 44DCB0 C3 RET
103 44D93F EB01 JMP SHORT 44D942
104 44D942 9C PUSHF
105 44D943 EB01 JMP SHORT 44D946
106 44D946 EB08 JMP SHORT 44D950
107 44D950 EBF7 JMP SHORT 44D949
108 44D949 9D POPF
109 44D94A EB01 JMP SHORT 44D94D
110 44D94D EB03 JMP SHORT 44D952
111 44D952 744F JZ 44D9A3 ; if ZF not set you're a Bad Boy!

The same code is called for all the debug drivers PCGuard checks, and is repeated at several different addresses just to keep you on your toes. How to defeat it? Don't know, don't care ;-)

Cheers,
Kayaker
banshee
01-03-2003, 10:30 AM
OK, think I have to explain it more precisely, it seems to be interesting. As I understood Kayaker you are talking about PCGuard in general:
The PCGWIN32.EXE program itself, I don't know about something packed with it,
but what about the link posted in the beginning of this thread
h**p://www.hc11.demon.nl/thrsim11/thrsim11.zip

pe-scan reports that it's pc-guard 4.03d-4.05d, PEiD with hardcore scan that it's pc-guard 3.03d. I installed SICE 2.7 and nikolatesla's pathes but the target still detects it. I traced a little the detection routine and found that proggy calls ntoskrnl!NTQuerySystemInformation then scans returned list of loaded modules and compares with ASCII "NTice.sys" (actually with "NTic"). I fooled the program by bpm on that ASCII and patching it, so I unpacked program without problems. Now have a question: is this method of detection in the list of antisice tricks posted here by +SplAj about 1.5 year ago. If not, can you explain the class of method and how it can be defeated. Think that changing name of SICE driver may help. Am I true?
+SplAj
01-03-2003, 11:11 PM
Well

This NTQueerFuckerInformation is NOT recommended by M$
in the MSDN

/Quote :-

Remarks
The NtQuerySystemInformation function and the structures that it returns are internal to the operating system and subject to change from one release of Windows to another. To maintain the compatiblity of your application, it is better to use public Win32 API functions mentioned above instead.

If you do use NtQuerySystemInformation, access the function through run-time dynamic linking as shown in the example below. This gives your code an opportunity to respond gracefully if the function has been changed or removed from the operating system. Signature changes, however, may not be detectable.

/End Quote

However it is working right now with Win2k SP3 and WinXP SP1 as a nice SI detector simply by finding the name of 'NTice.sys' in the system folder (you can also use it for the other 2 sys files )
as described by banshee.

I made a quick exe to replicate this function. It worked on my 5 PC's ;)

Source and compiled exe are attached for your pleasure ..........

Spl/\j
banshee
01-04-2003, 09:45 AM
What about defeating this detection? We can patch memory each time manually or create a loader, but is there any way to do it automatically? I compiled simple loader with R!SC's process patcher for above target (I mean link in the beginning, not the +SplAj's file). On my Win2k SP2 it works fine.


Dumping WindowsCE DLL's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dumping WindowsCE DLL's
PDA

View Full Version : Dumping WindowsCE DLL's

jal0
12-26-2002, 02:20 AM
Hi,

Not sure if this is the right place to post this kind of thing, but the problem is similar to unpacking a dll, so here it goes.

I'm working on trying to port linux to the CASIO BE300 PDA, trying to reverse some of the DLL's which hold hardware device registers and such.

One of the things that makes this hard is that all of the system dlls, are in compressed form on the device and cannot be copied to my host PC (they can only be accessed though the kernel). By compressed, i mean that the file itself is in some proprietary format and compressed. It is also impossible to even open the dll as a binary file. The DLL's, are actually hardware drivers used by the kernel.

I had an idea to manually load the DLL in question, using LoadLibrary() (which hopefully will uncompress it), then dump it's in-memory image to file. I would then transfer this image to the pc where i would manually rebuild it.

In testing, using LoadLibrary() does indeed cause the DLL to be uncompressed and loaded into the current processes address space.

I guess what i am looking for is some sample code, pointers, or howto's on dumping a dll loaded into memory to a file. Then applying the proper fixups to recreate the dll.

Now most of the code that i have found on the seem to be is assembly language and targeted at some particular executable packer. But in my situation, once the DLL has been loaded, no further trickery is needed. Just the dump and fixup's as though it was a normal dll.

Any help in these matters would be greatly appreciated.

Thanks,
Jal0


Crypkey 6.0 Stealth Unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crypkey 6.0 Stealth Unpacking
PDA

View Full Version : Crypkey 6.0 Stealth Unpacking

squidge
12-28-2002, 12:24 AM
An application protected with Crypkey Stealth component, version 6.0. Unlike the old pre-6.0 versions, these seem to be protected much better than the old ones.

When the program is run, a small temporary file is created which is 10Kb in length. This is run as a side-process to the parent and gets given several parameters, such as the full path to the parent, the parent's process ID, a location in the process ID's memory, and finally a couple of file handles to play with. It attaches itself to the parent using DebugActiveProcess and screams if it can't do it (for example, if your trying to debug the parent app). Once it has succeeded it runs the app as normal, but receives all debug notification events.

Meanwhile, the target app is decompressed and placed into memory by multiple calls to WriteProcessMemory. The import table however, is not written or decompressed. After a bit of event synchronisation between the parent and it's sibling process using CreateEvent/WaitForSingleObject, it turns into uses pipes for two way communications between the two processes.

Now, after all that, it finally places the import table into it's resting home and all API calls are resolved. This table is useless if the app is dumped unless you have something like Revirgin handy, as several things get trashed on the way.

The program then calls the OEP and everything runs as normal.

Or so you think. Dump the app and rebuild the IT and it'll still crash.

That's because instead of the normal table of JMP commands for jumping to various API calls, they have all been replaced with INT 3 breakpoint (0xCC) commands. That 10Kb sibling program the parent spawned receives the breakpoint exception as it's debugging it, and then calls the API on the parents program behalf by checking the entries in the exception structures (such as the exception address).

Once the program is finally repaired to normal, it runs as if it wasn't packed in the first place.

Has anyone noticed this kind of protection used in other programs? I'm interested to find out how they managed to implement such as scheme, looking at the old (and basic) Stealth protection used in 5.7 and earlier.

Now all I need do is write an unpacker for these executables, as they take quite a while to do manually.
nsaihan
03-29-2003, 12:39 PM
You say: "Now all I need do is write an unpacker for these
executables, as they take quite a while to do manually"

So that sounds like you have done it at least once. Could
you say what tools you used and what approach you used
to interrupt the sequence so you could "dump the app"?

I find I am motivated to do one, manually, even if it is less
than convenient. (Unless you already wrote such an
unpacker and are willing to share it.)

Noam
squidge
03-29-2003, 12:56 PM
Yes, I have already written an unpacker for Crypkey 6.0 applications, but I feel it not appropriate to publish to the web.

It is quite easy to dump however - think about the protection of Armadillo whilst examining this one, and you shouldn't have any problems.
jacky1108
08-18-2004, 01:54 AM
squidge, I have a app protected with crypkey 6.x, I tried many times to unpack it, but all failed. could you give me a detail tut about this? and I sound another problem that the app shows a strange site code like "NW8B R8TT XY00 VJV0 75KT 00Q", it's longer than normal one, when I tried use this to generate site key, sitekey generator says the length of the site code is not correct, do you know why?
sorry for my poor English.


Ecdsa
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Ecdsa
PDA

View Full Version : Ecdsa

LaptoniC
12-28-2002, 01:35 PM
I have a program which is protected by ECDSA afaik.The protection is not a big deal one byte patch removes all limitations but I am interested with serial scheme.It uses ECDSA and by examinin exe I learned that it uses borzoi library.I guess also it use Degree 163 Binary Field.Could anyone give me a hint about this ?

program winvdr hxxp://www.artech365.com
borzoi library hxxp://dragongate-technologies.com

Thanks.
AdamA
12-29-2002, 11:04 AM
Hi,

163bit is very strong and borzoi uses standard NIST-curves. The chance of getting the private key is very low. Maybe there are some implementation failures, which allows you to get the private key, borzoi is open source. If they choose weak curves there is a chance, but with NIST-curves.....
check:h**p://www-rcf.usc.edu/~mdhuang/cs599/MOV.pdf

good luck,
AdamA


TRW2000 : keyboard / mouse ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > TRW2000 : keyboard / mouse ...
PDA

View Full Version : TRW2000 : keyboard / mouse ...

Czerno
12-28-2002, 11:57 PM
Hi everybody ! Hope you had a great Xmas time.

Recently I experimented with the new chinese thing mentionned in Subject, looks promising to say the least, but I find I have at least two annoying problems which, maybe, someone can share advice about them, they are :

1. Mouse: can't have the mouse activated whatever settings in the .ini file :(

For reference purposes: Win 98 SE , PS2 "logitech clone" mouse .

2. I will likely patch the keyboard driver to suit the national keyboard I'm using. Before I put the hands in the engine though, has anyone done so before ? (yes I -am- lazy ;)

See you

--
Cz.
dion
12-29-2002, 01:28 PM
hihi... but my kbd patch seems not working so good. so, i afraid i could not offer your need. see my homepage in trw section for plug-ins if you want to see for a while ;)

regards
Czerno
01-01-2003, 03:29 PM
sighted your text, Dion ! Unfortunately i don't have my programming station available until a few days to check what your findings give...

'Bout the "out e1,ax" instructions though, I guess they are just a sort of "wait" for in/out delay(very common in BIOSes. ports other than E1 are sometimes used for the same goal, of course with that sort of coding there is always the risk that the "dummy" port number is -not- dummy on some platform after all ;~)

Cheers and ... happy new year to all who happen to read !

--
Czerno
dion
01-02-2003, 06:12 AM
Thanks Czerno for the info ;)

btw, i think you can program your own ps2 mouse driver and hook the buggy code :D

regards
Czerno
01-03-2003, 09:23 PM
Well, I had 2 spare hours today within which lapse I successfully patched TRW's keyboard tables to handle a foreign keyboard :)

Some hints for anyone wants to follow my track : (all offsets are Hex and relative to start of file trw2000.sys)

The keyboard translation table (i.e., OEM scan code -> ASCII char or special function ) is at +3490C. It is comprised of 59h * 4 bytes, indexed by OEM scan code value from 0 (dummy) to 58.

Each group has =

+0 : type (0:modal key/1=letter/2=other ASCII/6=number keys, 1st row/other: special processing,need not concern us for the patching here)
(for types 1,2,6):
+1 : UNshifted ASCII (0 to 7F / or FF=none)
+2 : shifted ----------
+3 : with CONTROL, ---------

so just change those characters you need to. If your keyboard has some "alternate" (third) graphics on some keys, you should assign them to the "Control+key" combo instead of the Windows "right alt".

Have fun !

And uh, Dion , I checked your text, too . Unfortunately I think you are a bit too blindly brave, almost everything you did is nonsense (only the "test al,20" instead of "test al,2" was a bug as you correctly realized ;)
When I take the time, I shall comment and explain that keyboard stuff ; meanwhile I suggest you cancelled the changes you made, as any problems you encountered are not to be solved thus IMHO ...

C. U.

--
Czerno
dion
01-04-2003, 07:34 AM
hi Czerno, wow! thanks a lot ;) that's because i felt none care about it :D

almost everything you did is nonsense

uhm... would you please tell me which one of them?

When I take the time, I shall comment and explain that keyboard stuff

wow! i wait for it ;)

regards
Czerno
01-04-2003, 09:36 PM
Originally posted by dion

uhm... would you please tell me which one of them?

OK you 're welcome; BTW I apologize for the word nonsense which may feel rude when I didnot mean to be.

> mov ebx,FB8B0080h
> mov cl,2
EBX is correct and should not be changed ( look at Vkd.inc for the meaning of this.) CL=2 means hotkey active on release IIRC and should be OK too but you may try other conditions here ; only ensure you have read the docs before making mods !!!

I do not know how severe a problem you encounter with TRW2000. I haven't got serious trouble in this respect either on the 486 or the K6/2 system. The annoyment with the "control" state, as you noted, is easily circumvented by operating the control-key and it is mostly unavoidable ( depending on how applications try to monitor key states beyond relying on windows messages ). Also you might try to leave the debugger using the "X" command rather than the control-hotkey combo if this is where you're having trouble...

After quick peeking at TRW's keyboard code, I can see a possible source for serious annoyment though, in that it makes use of the non-standard Kb Controller command 0D2h ( in order to reinject scancodes at the "output buffer" and have them trapped later by windows' keyboard vxd ) This command however is not part of the original AT 8042 KbCtrlr, so it may not be understood by all and any modern chipsets ... that might explain lockups on some machines. TRW is very different in this respect from SICE which has its own full fledged treatment for keyboard and does not interact with Windows' vxd .

As for the mouse, I haven't looked at how it is treated. On a modern PCI system with a "PS2"-like mouse port,
my mouse is not operative under TRW, even with the "winmouse=ON" setting . Do you know any one had a similar problem ?

Meseems the website of TRW is down so no hope to contact the authors ... or do you know the new URL, or active discussion forum of those people ?

Regards
--
Czerno
dion
01-05-2003, 05:42 AM
or do you know the new URL, or active discussion forum of those people ?

well, frankly i dont know ;p from chinese friends said that LiuTaoTao had left the scene long time ago :(

uhmm.... about mov cl,2, i had tried to experiment with it and found that changing it to OnComplete was more stable in my computer [dont lock the kbd so often].

about mov ebx, blah.... well, its work, so why bother ;)

gee! hope you'll write some patch info about D2h and if it true is the source of bug. about sice, yup, i agree, it is more independant.

ps. could i know what your job is, Czerno? i see you had enuff h/w exp here :)

regards
Czerno
01-05-2003, 06:39 PM
Example for the french keyboard, plus a small how-to ...
File attached.
HTH

--
Czerno
Czerno
01-06-2003, 09:33 PM
To swap the left/right mouse buttons under TRW,
you may swap the byte values at offsets 2DA78
(original=20h) and 2DA84 (original = 10h) in the
TRW2000.SYS file !

You might do the patching with an hew editor of
your choice, or even you might do it with TRW running, using TRW2000 to patch itself in memory ...

Of course you may want to add a menu and controls
to the TRW2000.EXE windows app for doing the patch.
Left as an exercise to the reader ... ;)

--
Cz.
dion
01-07-2003, 07:27 AM
about "control" state, i thought its not the ctrl key whos wrong here, and i neva use ctrl key to exit, but F5 and still locked up. just replace it with alt, and you'll know what i meant.

about mouse stuff, some obvious prefs [prior to v1.23 in RVA]:

1) .1E164 GetMouseData
2) .1E3AD SerialMouseIRQHandler
3) .1E219 PS2MouseIRQHandler

oh, before forgot, for v1.22 the kbd table is on +34BEC IIRC ;)
and thanks for the file, its uploaded ;)

regards
Czerno
01-10-2003, 04:29 PM
>about "control" state,...
The problem here is not with the "control" used for returning to Windoze, it's with the "control" state left when popping-up the TRW. It goes without the saying that, for things to work smoothly, the same keystate should be in effect when Windoze retrieves control over the operations : the best way to approximate this IMO is to set the flags to CL=1 (CallOnPress), not 8 or 2.
In this way, the same state of the control key (down) is retrieved when Windoze gains control than when it lost it ! Try it, it feels much better - though no perfect quickpatch solution exists. For one, be sure to press the same control key (left or right) when leaving than when popping into TRW .

> about mouse stuff, ...

Thanks, I found that code of course, but had no time to experiment. The fact is, on my old system all works perfectly, whereas on my newer APTIVA the mouse is inactive under TRW, though both are PS2-alike mice ! Well, I'll have to do some debugging with the help of the debug version of the vmouse.vxd I'm afraid !

Oh BTW I suggest you substracted 100000h from the offsets in TRW2000.SYS as you give them. I assume you get those values from something like Wdasm that loads the .sys at its "preferred" load address of 100000, but really that means nothing for an "NT" sys mini driver !

> and thanks for the file, its uploaded
You mean you put it on your site ? Well uh, you're
welcome but please do pass the warning that it's quick and dirty ;) Did you patch your own kbd ?

C.U...
--
Czerno
dion
01-12-2003, 08:21 PM
thanks Czerno, i understood what ur meant now ;)
btw, i dont need to patch my kbd table since it works fine already.
Czerno
01-13-2003, 04:53 AM
I found it was the Logitech drivers for that wheel-mouse that somehow prevented TRW2000 from "seeing"/using the rodent ;

after nuking them drivers and forcing the standard Microzoft PS2 mouse drivers, everything is good ...:)

Oh well, I lost the use of the middle mouse button in the process. The standard control panel DLL does not even mention it. Is there a tweak for forcing a 3-button mouse to be recognized while staying with the basic mouse vxd ? I do not want to let any kind of "mouseware" autodetect the contraption, since it would likely destroy my "fix" , I am afraid it would :(

P.S. The wheel is functionnal its only the 3rd button which isn't. The mouse is branded DeXXa fwiw. I would use the 3rd button as a shortcut for 1st-button-dbleclick.

--
Czerno aka The-Passer-by


IDC scripting question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDC scripting question
PDA

View Full Version : IDC scripting question

disavowed
12-29-2002, 03:08 PM
I'm looking to use the functionality of Edit->Patch program->Assemble in an IDC script. Is this possible?

(I would have loved to have posted this to DataRescue's webboard, but alas, I am not a registered owner)
tom_324
12-29-2002, 03:24 PM
in idagui.cfg set

DISPLAY_PATCH_SUBMENU = YES // Display the Edit,Patch submenu

Tom
disavowed
12-29-2002, 04:48 PM
yes, i have that already. i meant i want to be able to do something in my idc script like:

Assemble(address, user_input'ed_asm);

but, of course, there is no such idc function
tom_324
12-29-2002, 05:45 PM
Maybe this can be used

// Change value of a program byte
// ea - linear address
// value - new value of the byte

void PatchByte (long ea,long value); // change a byte

Tom
disavowed
12-29-2002, 09:58 PM
nope, because you can only use ida's patch functions on unexplored code :(

besides, i need to interpret asm code (e.g. 'nop'), whereas ida's patch functions expect hex (e.g. '0x90')


Armadillo 2.6x ..I´m a lame =(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 2.6x ..I´m a lame =(
PDA

View Full Version : Armadillo 2.6x ..I´m a lame =(

Mega Desperate
12-29-2002, 11:20 PM
I really hate this shit ...:mad:

U can help me?¡...

I follow this steps to dump:

Here's what i did :
1. bpx setprocessworkingsetsize, F5
2. SI breaks, F12
3. Press F10 several times until i land at CALL EDI
4. Still at CALL EDI, i did bc * then bpx writeprocessmemory
5. Press F5
6. SI breaks, f12 twice

005E0421 A1 88 9A 45 00 mov eax, ds:block_count
005E0426 83 C0 01 add eax, 1
005E0429 A3 88 9A 45 00 mov ds:block_count, eax
<--------SNIP------------>
005E0470 mov edx, ds:block_count
005E0476 3B 15 70 66 45 00 cmp edx, ds:max_number_of_decrypted_block
005E047C 0F 8E FA 00 00 00 jle ok

7. At 005E047C, i always make it jump. change 0F8E to 90E9
8. then press F12 once, i land 005DF9DC :

005DF92D 8B 8D 2C FA FF FF mov ecx, [ebp+FFFFFA18]
005DF933 3B 0D 84 9A 45 00 cmp ecx, ds:text_section_size
005DF939 0F 8D C7 00 00 00 jge continue_1
005DF93F 6A 00 push 0
005DF941 8B B5 2C FA FF FF mov esi, [ebp+FFFFFA18]
005DF947 C1 E6 04 shl esi, 4
005DF94A 8B 85 2C FA FF FF mov eax, [ebp+FFFFFA18]
<----------SNIP--------------->
005DF9C1 83 E7 0F and edi, 0Fh
005DF9C4 03 F7 add esi, edi
005DF9C6 8B 15 74 9A 45 00 mov edx, ds:key_address_table
005DF9CC 8D 04 B2 lea eax, [edx+esi*4]
005DF9CF 50 push eax
005DF9D0 8B 8D 2C FA FF FF mov ecx, [ebp+FFFFFA18]
005DF9D6 51 push ecx
005DF9D7 E8 86 0B 00 00 call Decrypt_codes
005DF9DC 83 C4 0C add esp, 0Ch <== I LAND HERE!
005DF9DF 25 FF 00 00 00 and eax, 0FFh
005DF9E4 85 C0 test eax, eax
005DF9E6 74 0A jz short bad_jump

9. press f10 once, land at 005DF9DF. I type :
a eip (enter)
inc dword ptr [ebp+FFFFFA18] (enter)
jmp 005DF92D (enter)
(enter)
10. still at 005DF9DF, i type
e ebp+FFFFFA18 (then change something to 00000000)
e 005DF939 (change 0F8DC7000000 to 7DFE90909090)
11. bc *, press F5
12. LordPE

Now.. i question this in unpacking forum and they are answer me :

"Two things I did different than you.

1. at the first jump, I dont change to jump always, rather I edit
the ds:[max_decrypt_blocks] to a large value instead
(the max_decrypt_blocks value)

2. After you edit the code, you must STEP THRU your "inc dword
ptr [xxxxxxxx]" instruction BEFORE you change the [xxxxxxxx]
to value zero. If you don't you will actually be incrementing
to 1 before you loop back around, missing an entire page. This
is the mistake I was making in my dumps before. I think that may
be the mistake you are making also. F10 thru you "inc" instruction
first, and THEN set [ebp+xxxxxxxx] to zero, and then exit SI."

Somebody can tell me ..I do this?¡¡ ... I do not have idea since this becomes or that I must put in [ ebp+xxxxxxxx ]. they say me that it presses F10… if I make..but... in where or how?¡ :confused:

Thank u =) ... and thank u for help me... :rolleyes:


ServU Ftp Password Decryption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > ServU Ftp Password Decryption
PDA

View Full Version : ServU Ftp Password Decryption

peterg70
12-30-2002, 11:51 AM
Been asked if it is possible to reverse engineer the password from the password file for a servudaemon.ini file (part of servu ftp)

By looking around have found some info that says its s/key encryption. Also found other info that says its the same as the crypt used on Unix Passwd files.

Anyone here know for sure. Further info would be appreciated.

Thanks

Peterg
LaptoniC
12-30-2002, 01:29 PM
Afaik it is crypt.I once cracked with john the ripper.(Servu v2.4)I dont know what is being used in new versions.


Vbox
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vbox
PDA

View Full Version : Vbox

linda
12-31-2002, 12:14 PM
Mathcad 2001 demo is a toughie for vbox

U can find the oem point easy enough 00420906 using marigolds
lesson.Tsehp then goes on to list the decoding routine in VBOXT which xors and xors the 05 or 04 in the table at rva 24000.

Actually i have used revirgin to unravel all the jumps/calls from 24000 on for D28.Ive now got alist of all the subroutines from this point.Interestingly enough though if u try and run it it slips into the abyss after a call to winmain and trashes.

This is a good protection.not sure if this will ever be fixed.
This may be the biggun.

beanhauler:confused:
squidge
01-01-2003, 01:19 AM
Sure there's no API emulation or hooking in the app? I know this is rare for a vbox app, but it's certainly possible. That way as soon as the app is stripped of it protection, it'll crash - which is what it seems like it's doing to you.
linda
01-01-2003, 03:36 PM
:confused:

hmm think this is a new way from the makers of vbox
Perhaps Tsehp may have some comments.
Thanks for the reply though its good to know there are others
out there

Beanhauler
mojo2k2
01-05-2003, 02:24 AM
dreamweaver, probabbly other macromedia apps, wordperfect, probably other corel apps, delphi, painter.. others
all these apps trial comes with new-age possibly "secret" versions of vbox labeled "4.3" .. but is it 4.3?

aladdin systems sneaking around behind crackers backs
Lbolt99
01-16-2003, 10:39 PM
I just cooked up Corel Graphics Suite 11 and Wordperfect Suite 10.. both currently available as trials from the site... nothing to indicate "stealth" versions. Floorplan 3D by IMSI was protected by 4.3 but it was really 4.3 :)

Originally posted by mojo2k2
dreamweaver, probabbly other macromedia apps, wordperfect, probably other corel apps, delphi, painter.. others
all these apps trial comes with new-age possibly "secret" versions of vbox labeled "4.3" .. but is it 4.3?

aladdin systems sneaking around behind crackers backs
mojo2k2
01-19-2003, 05:19 PM
see it's easier to believe that it wasn't my cracking skills but rather a vbox conspiracy..
sigh.. thx for the followup


pelock anti SI detection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > pelock anti SI detection
PDA

View Full Version : pelock anti SI detection

+SplAj
12-31-2002, 12:18 PM
hello again

I'm gonna paste some asm here so I *hope* i'm in the right forum :rolleyes:

Now, Evaluator disclosed some infos that IceDump left Colonel32 memory w-i-d-e-o-p-e-n ....naughty naughty tsk tsk. is it true... is the nemesis here.......

How to detect Icedump is loaded in Win9x O/S .....

Just run latest PElock 1.05 Demo and you'll see :eek:

how does it know.... you have /protect on but the bastard still knows you are using SoftICE !!!! (btw this Bart is not Bart, the other is Bart , Evaluator)

heres how :-

TASM ASM :cool:

.386p
.MODEL FLAT,STDCALL
locals
jumps
UNICODE=0
include w32.inc
include PELOCK.INC
extrn GetProcAddress :PROC

.data

msg1 db "PELock 1.05 check 'IceDump' test",0
msg2 db "SEH triggered ok....Did NOT detect IceDump....:) ",0
msg3 db "*** I C E D U M P *** D E T E C T E D :( ",0
mark db 0
iKern db "Kernel32",0
iExit db "ExitProcess",0

.code

Start:

xor eax,eax ;zero to EAX for setting xhandler
push offset SEH_handler ;address our new SEH handler
push dword ptr fs:[eax] ;save previous handler address
mov dword ptr fs:[eax],esp ;set our new xhandler
call GetModuleHandle, offset iKern
call GetProcAddress , EAX, offset iExit ; get 'ExitProcess' memory location
add dword ptr [eax],00 ;try and write to it....SEH if no IceDump else

push eax ;just ExitProcess...should NEVER GET HERE !!!]
call MessageBoxA,0, offset msg3, offset msg1,0
ret ; this will ret into ExitProcess and your gone !!!

;DEMO_START This is how EASY pelock programming-in-source-code is (see pelock.inc)

;place here some ' registered user only ' bit of code blah blah blah

;DEMO_END but i disabled it (;) for my example
; and included a bit of home made crypto :o

iNop: db 05Eh,06Ah,087h,0C4h,07Fh,02Eh,03Dh,04Eh ; for phun.......

pop dword ptr fs:[0] ;set previous handler
add esp,4 ;clear stack
cmp mark, 1
jnz jump

call MessageBoxA,0, offset msg2, offset msg1,0
call ExitProcess, -1 ;end program

jump:

call MessageBoxA,0, offset msg3, offset msg1,0
call ExitProcess, -1 ;end program

;+++++++++++++++++++++

SEH_handler:

mov eax, [esp+04] ;set EAX to address with exception #
mov ecx, [esp+0Ch] ;read to ECX address start of context structure
mov dword ptr [ecx+0b8h], offset iNop ;return EIP
mov eax, [eax] ;read exception number
sub eax, 0C0000005 ;ACCESS_VIOLATION error value
jnz SEH_handler_end ;if it isn't Exception Breakpoint jump (not our exception call)
inc mark ;set mark because xhandler ran
xor dword ptr [iNop+4],0DEADBEEFh ;decrypt running code with DeadBeef+ShitFace ...hmmm
xor dword ptr [iNop+0],05417FACEh

SEH_handler_end:

ret ;back to program ..we hope ;)

ends
end Start
Woodmann
12-31-2002, 07:36 PM
decrypt running code with DeadBeef+ShitFace ...

BWAHAHAHAHAHAHHAHAHAAA ;)

Later, Woodmann
bart
12-31-2002, 07:51 PM
hmm so who am i? ;)

or [ExitProcess],0 can be easily defeated by setting bpm ExitProcess + superbpm :)
JMI
12-31-2002, 08:07 PM
Gosh:

"DEADBEEF" and "BEEFABAD" for years were part of the decryption code on PACE copy protection for the MAC some years ago. Found it in most of my MAC early music software. Haven't had time to check if they have changed their strips on the newer stuff for the MAC.

And Bart: Obviously you are the "other one." :D You, of all people, should be able to tell the difference. :cool:

Regards.
+SplAj
01-01-2003, 03:27 PM
hi bart the real bart ;)

PElock 1.05 is my first find for this trick in a commercial protector.

Seemed too much of a coincidence.........it was NOT in v1.04.

I just made a SI macro that set EAX to 0 , poke EIP back to the offending line, X, and SEH caries on as normal. Actually in this case the real code that is RET to is some 4928 lines back. If you follow the SEH you'll get to SUB DWORD PTR [EAX+B8],00004928

hmmm that a boring infos for N Y day....

cya
SpeKKeL
01-02-2003, 08:25 PM
Hajo,

svkp-protector claims to be the first who can trap icedump..,
H'mm i protected good old notepad and deprotected it without
to much problems, the svkp.exe file itself seems to be more difficult..
It has some anti-trace routines and icedump detection.(protect on will not be triggered)
Maybe (talking about icedump detection) this is also a nice target
to play with..(i can't see how they detect icedump there my knowledge is poor in these fs,seh,drx's bla bla beef..) :(

Happy new year,

Spekk.
Hwoarang
01-03-2003, 09:10 PM
I am having trouble getting Pelock.exe run on Win2k with Sice loaded, even if I managed to make it run on Win9x.
Also it's very weird how my Win2k reboots whenever I set a bp on a api..(maybe I should disable the BCHK interface?)
+SplAj
01-03-2003, 11:27 PM
yes hwo

BIG troubles...... try bpm exitprocess rw and see how he uses the old trick of API protection... no BPX on API allowed (CC check)

Also he (t'other bart) uses INT1 fault of SINGLE_STEP error instead of expected STATUS_ACCESS_VIOLATION with SI running......so SEH steps through to RET MessageBox..FluckOfCracker....instead of redirecting to real flow......

i'm sure not many ppl will run pelock 1.05 on Win2K/XP

(and WinXP with SP1 is a real MF challenge for the nerves !!!)

anyway have phun and keep D FS:0 / D CS:[FS:0+4] checking the SEH. The year has only just started....

Spl/\j
crUsAdEr
01-04-2003, 06:39 AM
If i remember correctly, PElock uses int1 and UnhandledException API check on win2k

So simply patch IDT to remove int1 check and then do this
bpm UnhandledExceptionFilter
then change the value in eax from "CC" to "55"

That is all :>
Hwoarang
01-04-2003, 12:06 PM
I know of both int1 and UnhandledExceptionFilter check..I was able to run previous versions of Pelock on WIn2k with Sice...but the new one seems to use some new trick
r4g3
01-04-2003, 02:04 PM
for ( int i = 0; i < 0xFFFFFFFF; i++ )
{
cout << "(and WinXP with SP1 is a real MF challenge for the nerves !!!)"
}
bart
01-04-2003, 04:57 PM
did you saw that update.exe from XP SP1 is full of encrypted code and asm snippets eg.:

010079E2 pusha
010079E3 pushf
010079E4 call sub_100AAB4
010079E9 push eax
010079EA lea edx, ds:0FEFB881h
010079F0 lea ecx, ds:19905CF5h
010079F6 sub esp, 8
010079F9 mov [esp+30h+var_30], edx
010079FC push ecx
010079FD shl eax, 10h
01007A00 or eax, 0Ch
01007A03 sub [esp+34h+var_30], 0EEF3E64h
01007A0B pop ebx
01007A0C mov [esp+30h+var_2C], eax
01007A10 jmp short sub_1007A3C

0100955C mov [ebp+var_1A8], edx
01009562 lea ecx, ds:10F1C526h
01009568 add ecx, [ebp+var_1C8]
0100956E sub ecx, [ebp-1ACh]
01009574 sub ecx, 0FF12FAAh
0100957A jmp ecx
0100957C ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
0100957C lea ecx, ds:0DC096DAh
01009582 sub ecx, [ebp-1A8h]
01009588 add ecx, [ebp-1C4h]
0100958E sub ecx, 0CC00144h
01009594 jmp ecx

010276AB pushf
010276AC pusha
010276AD push offset unk_1027967
010276B2 push 1
010276B7 call sub_1007A3C
010276BC add esp, 4
010276BF jmp eax
evaluator
01-04-2003, 07:36 PM
"Hi, BTW +SplAj"! :)

I assume, u have xmas-LIBian-vacations & remember this MB..

So letz broke IceDump!?
(RRREALLLY easy-peesy!)

But before start, I need little help. (Maybe NOT_THAT_bart can help me?)

..I found one resouce_Crackme. & I try play with it using RSRC_editors.
So I removed many thingz, for example all contents of 2nd tab.
But I can't remove this 2nd("Project") tab.

So my question is:
RSRC_editors sux or this 2nd tab must be disabled from program code?
Kayaker
01-04-2003, 10:25 PM
Hi Eval

I had a look at it and saw what you did. (this is a crackme?:D) Unfortunately tab windows are inserted into code as children of a "SysTabControl32" parent dialog with TCM_INSERTITEM, so even if you delete the controls, or even the whole child dialog resource, the "tab" will still show. If you delete the SendMessage call that does it it might work. It might look something like this...

tci TC_ITEM <> ; Tab Control struct
strTab1Text db "PELock",0
strTab2Text db "Project",0

; ----------------------------------------------------------
; Add Tabs to Tab control, fill TC_ITEM struct
; ----------------------------------------------------------

mov tci.imask, (TCIF_TEXT or TCIF_IMAGE)

mov tci.pszText, OFFSET strTab1Text ; 1st Tab control
mov tci.cchTextMax, SIZEOF strTab1Text
mov tci.iImage, 0

invoke SendMessage, hTabDlg, TCM_INSERTITEM, 0, OFFSET tci

mov tci.pszText, OFFSET strTab2Text ; 2nd Tab control
mov tci.cchTextMax, sizeof strTab2Text
mov tci.iImage, 1

invoke SendMessage, hTabDlg, TCM_INSERTITEM, 1, OFFSET tci

Kayaker
tgodd
01-16-2003, 03:02 PM
You will find something close to that in alladins Hardlock driver.
BEEFBABE and CAFEBABE.

regards,

tgodd
squidge
01-16-2003, 03:22 PM
I prefer the one in Crypkey 6 -

0x1234

:) :D :) :D :)


WinXP Cracking problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > WinXP Cracking problem
PDA

View Full Version : WinXP Cracking problem

Angel
12-31-2002, 06:47 PM
Hi guys. I've been into cracking for a while although I'm still a newbie and in the past few days I faced this problem:
I've been hapilly cracking with Windows 98 but since times are changing I decided to follow the flow and use DriverStudio under WinXP. Everything fine SoftICE was breaking and all. But then I applied a crack I had done a little while ago in Windows 98 (which was working fine) and in XP wasn't functioning properly.
Let me explain: proggie's name was Backup Xpresso. It generates a site code which is probably dependant on the registry and then expects you to enter a registration code. What I have done was to turn the proggie to it's own Keygen. Since there was a memory echo of the reg code I followed the programme flow upto a MessageBox and I changed the last PUSH to point to the location of the reg code in memory.
This in Win98 works like a charm. Why doesn't it work with XP? I mean the CS changes but the address should remain the same (or am I wrong)?
One last question. Could anybody tell me some good breakpoints for XP? (mostly if there's an equivalent to hmemcpy -- not memcpy --)
Thanks for your patience and by the way it's a great forum!
squidge
01-01-2003, 01:16 AM
What is not working? Your registration code is not working, or the dialog box now shows corrupted text rather than the reg code?
naides
01-01-2003, 03:33 AM
Originally posted by Angel
Hi guys. I've been into cracking for a while although I'm still a newbie and in the past few days I faced this problem:
I've been hapilly cracking with Windows 98 but since times are changing I decided to follow the flow and use DriverStudio under WinXP. Everything fine SoftICE was breaking and all. But then I applied a crack I had done a little while ago in Windows 98 (which was working fine) and in XP wasn't functioning properly.
Let me explain: proggie's name was Backup Xpresso. It generates a site code which is probably dependant on the registry and then expects you to enter a registration code. What I have done was to turn the proggie to it's own Keygen. Since there was a memory echo of the reg code I followed the programme flow upto a MessageBox and I changed the last PUSH to point to the location of the reg code in memory.
This in Win98 works like a charm. Why doesn't it work with XP? I mean the CS changes but the address should remain the same (or am I wrong)?
One last question. Could anybody tell me some good breakpoints for XP? (mostly if there's an equivalent to hmemcpy -- not memcpy --)
Thanks for your patience and by the way it's a great forum!

It is dificult to know without tracing the code oneself but:

-You are right, the code segment changes, but the address of the serial string is either in the DS data segment or in the stack which also change. in general, relative addresses like parameters in the stack are conserved in different OS, but indirect pointers
may change.

It is possible that some XP API work in a different fashion, and the Reg code address was passed through indirect pointers. The crack you made for W98 may be pointing to the wrong place in mem now.

There is only one way to find out, is to trace the code in your new winXP and see if the Reg code address and the address pointed by your crack coincide or not.

The story around hmemcpy have been discussed at nauseum in old threads, give it a search.
Angel
01-01-2003, 04:46 PM
Thanks to both of you guys (sorry squidge for not being clear enough). Naides thanks for helping out. The fact is that I would trace the proggie if I could find a damn breakpoint that works. The only one that breaks is Createfile but when I do a pret (F12) it just throws back to the programme. Any help for some usefull bp's for WinXP?

A lot of happy new year's to all the guys in the forum!!!
naides
01-01-2003, 05:06 PM
well, there are several issues here.

In XP, the MOST helpful BP is break at the entry point.

searchback the Message board, and DL Kayaker patch, if you have not done it before. nOW LEARN TO PLACE A bREAK pOINT AT THE ENTRY POINT OF YOUR APP.

Once then you can place BPX on the app code, close to he area where your crack used to work. the cs address you see in Sice is the same you see in a Dissasm of your app.

Then Sice breaks close to where the action is taking place.
Angel
01-01-2003, 05:43 PM
Thanks a lot for your help! I've just tried Kayaker's patch but it ain't working. I used the universal patch since I have version 2.6.
I fire Sumbol Loader load the module but all I get is the initial screen of my target. Any help here? Am I supossed to configure SoftICE in a certain manner for the patch to work?
squidge
01-01-2003, 08:04 PM
You have driver studio v 2.6 ? Just as I thought the first WindowsXP compatible version of DS was 2.7.
Angel
01-01-2003, 10:52 PM
Ooooooooops didn't know 'bout that ! Sorry for my ignorance! Off to download DriverStudio v2.7. Thanks a thousand squidge!

However thanks to the help I got on this forum I finally made it and cracked my target. This Olly Debugger is awesome!!!!

Thanks again for your help!
squidge
01-01-2003, 11:08 PM
Have to agree, OllyDbg rox :) Most of the time now I don't even need SoftIce :)
sloppysam
01-03-2003, 01:22 AM
Have to agree with you on that one Squidge. I am fairly new to cracking and was having an awful time with softice studio under xp. It runs fine under 98 but seems to have some real problems with XP.

Ollydbg is better in my opinion for newbies. It is so much easier to use in my opinion. The gui is just so much nicer than SI. There is a lack of tuts for using it for cracking but there are a few. It does seem that it is becoming more popular as a tool.

For all of you newbies having trouble with SI, get Olly and try it. I don't think that you will be sorry.

Sloppysam


anti-softice, armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > anti-softice, armadillo
PDA

View Full Version : anti-softice, armadillo

jllec
01-02-2003, 08:30 PM
Hi.
I've protected a little program with armadillo 2.2 and I remove the detection of softice with FPloader. All is Ok and it don't detect softice.
If I protect the program with amadillo 2.5 (or more), I see a nagscreen with :

" this program use a secret key..."

If I remove manually the protection by createfilea... with armadillo 2.2 it's Ok; but there is always the same nag with armadillo 2.5.

Where is the difference between theses versions?

Somebody can tell me What does I do?
Thanks.


How to dis SPARC-excutable file by IDA?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to dis SPARC-excutable file by IDA?
PDA

View Full Version : How to dis SPARC-excutable file by IDA?

SeanC
01-03-2003, 01:26 AM
Hi,

Found dis SPARC-excutable file using IDA pro on PC. How? Is UNIX lib in http://www.woodmann.net/fravia/rpat-en.html neccessary? Then how about debug?

Thanks a lot.

SeanC
ZaiRoN
01-03-2003, 10:28 AM
Hi Seanc,
I have never tried to disasm this type of file but, IDA has these two voices in its list of the processors available:
SPARC series: sparcb <-- big endian
SPARC series: sparcl <-- little endian
Try to use one of these options.

>Then how about debug?
You could try to use gdb; you find it in every distro. Otherwise, a very powerful debugger is DDD.

my 0.2€ suggestion...
ZaiRoN
SeanC
01-07-2003, 02:15 AM
Hi ZaiRoN,

Thanks a lot.

I am using ddd for dising and debuging in SPARC workstation somewhere. But I don't have my own workstation doing what I want. So, I try to use IDA instead.

SeanC


#i need target program for reversing training
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > #i need target program for reversing training
PDA

View Full Version : #i need target program for reversing training

ccdp71
01-03-2003, 06:20 AM
hi..
i was found so many good tutorial, but
almost tutorial have't include target program.
my problem is i can't found anyother target program.
anybody have recent reversing tutorial or anyother good site?
i mean ,include target program.
im newbie, i was tired.
help me plz.
happy new year~
Kayaker
01-03-2003, 07:19 AM
Hi

Try the Anticrack link posted below and join their crackmes/reversemes/forum adventure, you'll find plenty of targets and help to start you on your way.

Kayaker
artik
01-06-2003, 11:02 AM
http://www.crackmes.de <-- all you need (crackme's + solutions :) )


Bug in Hex Workshop, anyone knows if it's fixed?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Bug in Hex Workshop, anyone knows if it's fixed?
PDA

View Full Version : Bug in Hex Workshop, anyone knows if it's fixed?

dELTA
01-03-2003, 05:25 PM
I remember reading a thread here before, in which it was mentioned a bug in Hex Workshop that made it silently fail to write data to some files under certain conditions (files over a certain size, too high offsets, too large data pastes or something like that). It was discussed because it caused big trouble for someone during a project, until he found out that it was not his fault, but that his file modification had partly failed due to this bug. Sadly I cannot find that thread again. :(

I was just wondering if anyone knows what I'm talking about, and if that bug has been fixed yet? Hex Workshop seems to have been stuck on version 3.11 for quite a while now, so I'm a little afraid that it hasn't. :( Although it's a very nice program, such a bug simply means just too much potential trouble for me to dare using it. :(

Anyway, in that same thread, someone else recommended another hex editor that should be somewhat equal to Hex Workshop, and I would really like to take a look at it if I just knew its name, but I don't. :(

So, can anyone recommend a really good Windows hex-editor (i.e. not Hiew), except Hex Workshop? (I've already tried to search for other such discussions in this forum, but didn't find any)

Any and all tips would be much appreciated.

Thanks!
esther
01-03-2003, 05:44 PM
Hi,
JimmyClif has given you the right search methods
search for it ;)
Kayaker
01-03-2003, 06:18 PM
Originally posted by dELTA

I was just wondering if anyone knows what I'm talking about, and if that bug has been fixed yet? Although it's a very nice program, such a bug simply means just too much potential trouble for me to dare using it.

Yeah, it seemed it had trouble saving large files sometimes when you would add a large amount of data to the end of the file (i.e. paste a new IT, heh.) It would corrupt the file with random bits of data from your harddrive. Really strange bug, I would find bits of text from some asm file or letter in the new section of the saved file. I heard someone else experienced that as well.

I found a simple solution though. It had something to do with saving the file under the same filename with 'Save'. If you selected SaveAs and a new filename it would save the file OK no matter what the size.

Now, I'm going to scold you slightly, not for the usual 'searching' rhetoric which I think there's a little too much fuss made over anyway, but for what you said about "...too much potential trouble for me to dare using it...". Now I'm only teasing, but that's a BAAAADDDD attitude to have if you're going to do RE. That's like saying you never want to delve into Ring0 because you're afraid it might hang your system. Get over it and grab your crash helmet :p

Kayaker
r4g3
01-03-2003, 06:26 PM
What do you think about UltraEdit v8.0 ? (v9 is crap)
Kayaker
01-03-2003, 06:44 PM
Originally posted by r4g3
What do you think about UltraEdit v8.0 ? (v9 is crap)

Yeah I'm a little dubious about v9 too. I use UE as an ASM IDE and found the new version gives problems with some syntax highlighting settings and mouse clicks often turn into line selects too easily. A few nice new features like the search combo box but overall v8 seems a little less quirky.
dELTA
01-03-2003, 06:59 PM
Thanks for the reply Kayaker! I never actually thought anyone would know what I was talking about. ;)

I must defend myself from your light scolding though :):

1.
There is one big difference between using a software that has a bug that can silently and undeterministically cause lots of trouble for you, and diving head-first into ring-0 code: If my ring-0 experiments wreak havoc with my computer it is my own fault, and I also have control over it and can fix it. In the former case, I cannot do anything, and just have to put up with the fact that any problems with my patched files might be due to a faulty patch, and not my own fault, which is very uncomforting. :( (ok, I guess I could theoretically reverse Hex Workshop and fix the bug myself, but let's be sensible here ;))

2.
It was not just "the usual searching rhetoric" from my side, I really tried to find it by searching, but some things are very hard to find in that way, since either you must already know certain keywords which might be the exact things you are looking for (and hence don't know them before finding the answer :)), or you get so many hits that you never find what you're looking for anyway. :( But I agree that there is a little too much fuss about the searching here, which is why people always feel compelled to mention that they "have already searched but didn't found the answer" in every post. Otherwise you risk being immediately flamed, which is neither fun nor productive. Of course I understand that some questions could indeed be resolved very easily by searching, so sure these people should have searched and should be told so, but some things are very hard to find, even if they have indeed been discussed here before (see the reasons above), and hence, some people here should maybe take it just a little more easy with the "use the search" flames.

But in any case, even though my statements above might seem a little serious, I know that you were just joking and they are in no way directed to you, I just thought some people on the board should read that. ;)

Thanks again Kayaker.
hobgoblin
01-03-2003, 09:23 PM
Maybe of no interest, but HexWorkshop is available in a 4.0 beta version.
hobgoblin
LOUZEW
01-04-2003, 06:28 PM
Right Hobgoblin !
I'm using HW 3.11 from a long time with the bug described here, i've now 4.0 beta and it seem to work fine (only the last beta).
ZaiRoN
01-04-2003, 06:47 PM
Hi hobgoblin/LOUZEW,
have you tried this last version of HWS?
I have not tried it yet mainly because the new features that have not captured my attention and because I like old friendly tools :D
Btw, I have seen they have released the beta n° 4, it seems to be very bugged...

ZaiRoN
Solomon
01-07-2003, 01:38 AM
v4.0 final is released.
dELTA
01-07-2003, 10:55 AM
I'm not sure, the news-entry regarding this on http://www.bpsoft.com is dated "5 Jan 2004", so maybe it's just a prediction about when they will have a bug-free version available. ;)
dELTA
01-07-2003, 11:14 AM
The bug discussed in this thread is not mentioned in the "bug fixes" section of the version history of version 4.0. :(

Are you sure it's fixed LOUZEW? Have anyone else verified this (e.g. by trying it with a test case that always failed in 3.11)? I don't have any good test case, so I cannot verify it myself. :(
LOUZEW
01-07-2003, 11:50 AM
Just D/L the 4.0 final.
Trying now, let you know !
LOUZEW
01-07-2003, 10:53 PM
OK, it seem to work right now (also with large files)
dELTA
01-08-2003, 12:25 AM
Ok, cool, thanks!

Still strange that they didn't mention it in the version history though!? :confused:
cyco2
01-08-2003, 07:50 AM
I discovered the same bug yes ;)

I bug-reported it like 3 weeks ago, it was happening with version 3.11 and with 4.0 beta 3 (at that time). But it seems to be fixed in version 4.0 final.

I think it maybe sounds little said to tell copy paste of more then 0x100000 bytes will cause a crash... especially when the changelog also includes the new 4GB support! ;)

not that I found it the right way, I think they better always can be honest what is fixed and what not. Anyway it is working now, so who cares....

ppl at BPSoft... keep up the good work.

(ps. Though I really don't like they didn't send any reply on my mail).


Asprotect 1.2x [New Strain] ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect 1.2x [New Strain] ???
PDA

View Full Version : Asprotect 1.2x [New Strain] ???

h8er
01-04-2003, 10:19 PM
Hi guys

I've tried to unpack Avisplitter 1.1 (h**p://w*w.brizsoft.com) under Win98 SE; Peid and pe-scan tell me that the program is protected with Asprotect 1.2x [new strain]. I've found the Iat rva and leght (for me rva=71190 and lenght=720) and the Oep with the Tracex method (6587b or 61ec, i'm not sure) but the program has the Asprotect 1.3 iat trick explained by +SplAj here: http://www.woodmann.net/forum/showthread.php?s=&threadid=3812&perpage=15&highlight=challenge&pagenumber=2
I've cut all the crap thunks but the aspr 1.3 alpha plugin fails to resolve the redirected imports...
How can i do the job without trace manually every redirected import?? (i attach my partially solved imprec tree)
Please someone tells me if i've made a mistake

Thx to all
esther
01-05-2003, 04:11 AM
>Please someone tells me if i've made a mistake
First you should not upload the IT.txt.Post the post which you do not undertand.

>How can i do the job without trace manually every redirected import??
Don't think theres an easy way
squidge
01-05-2003, 12:33 PM
Don't think you can, unless you can think of a way and write a program to do it for you.

Welcome to the world of reverse engineering ! Where hours seems like days... :)

Originally posted by h8er

How can i do the job without trace manually every redirected import??
_Servil_
01-05-2003, 06:47 PM
it's the same issue as imagedupeless

i hadn't time to de-redirect redirected apis and to make it work on all libraries, but, you can then mostly see the correct API address in debugview's log somewhere near the end of listing ;=)

maybe if I stole some time i could tune it to work little better.

regards
h8er
01-05-2003, 11:05 PM
Thx for the help guys!
SpeKKeL
01-07-2003, 07:59 PM
sjit,

Just when i finished my (old) plugin, i discovered this thread..."new strain".

Yep this looks very new to me:lots of our redirected api's are now Re-redirected !And some other api's where called via cxxxxxxxx.
Okee just unpacked this target with my new aspr-resolver(plugin)
and all where resolved.

I shall look for some other targets to test it better.

Greets,

Spekk.
SpeKKeL
01-08-2003, 04:56 PM
Just made some little modifications and tested on avi-splitter 1.2
seems all works, so hereby i attach my plugin so you can test
a little further.
(read the txt file before using...)

Ciao,

Spekk
h8er
01-11-2003, 04:42 PM
A great thanks to SpeKKeL and _Servil_ for the plugins my iat now seems to be correct. I have a problem with the Oep, i've tried with Tracex but i think that this method fails with this Asprotect version. Any help on how i can find the Oep is really appreciate..
Zilot
01-12-2003, 04:31 AM
OEP is

OEP=465C7F without stolen bytes ( there are 11 of them )
crUsAdEr
01-12-2003, 09:31 AM
To find OEP generally, watching stack is a good trick... works on most packer i find...

if there is a pushad then there will probably be a popad :>... or some stack correction... the value of ESP should be preserved i think :> bpm at the right place and you will find it... hope this is good enough a hint :>...

cheers
crUsAdEr
Zilot
01-12-2003, 11:08 AM
SpeKKel , _Servil_ or one

who found IAT

can you PM your IAT, I had to resolve manually about 15 APIs,

your plugins with some APIs works with some not, so I'm not

sure if I found them as well because when I start dumped I get

nag screen about limitation and when press continue trial

program crashes,registration,and button for key entering

work fine so I

don't know is it because IAT or there is some trick with size

checking or CRC, and that is why I'm asking for IAT just to

compare. I'm working on win2K

Soldat
SpeKKeL
01-12-2003, 04:22 PM
Hajo,

Well i only tested my plugin on w98 so......
Are you talking about 1.1 or version 1.2 ?
Just trace your rebuilded prog to the place where the exception is made and compare it with the original.
I didn't encounter any checks or whatever (maybe there are..).

Spekk.
Zilot
01-13-2003, 01:12 AM
Version is 1.2

But if you say that there is no similar things (checkings) it is up to
IAT

Soldat
_Servil_
01-13-2003, 12:06 PM
Soldat,

This app has no callback check. If it crushes it's caused by wrong IT or missing stolen bytes. I've fixed the plugin so it finds all calls under WinXP but fails mostly on Win98. It's caused by certain API work different on 9x and NT platform.

And the import obfuscation has changed again ;)
Zilot
01-14-2003, 04:19 AM
Finally I did it, but without plug-ins. I patched redirect/encrypt procedure and there were no need for plug-ins (for newer). Usual 10 emulated APIs were unresolved, and older plug-ins I think by Crusader, resolved it as well
Now proggie runs Ok

Thanks to Jim

Soldat
h8er
01-15-2003, 05:20 PM
Hi Soldat

i've tried to break at your oep=465c7f but i've failed... how did you reach it ??
hobgoblin
01-15-2003, 10:27 PM
Hi there,
I used tracex (I'm used WinME to crack this one), and found the OEP to be 46587B. (But after unpacking it you must set the OEP to be 465870 and add the "stolen" bytes stored in the high memory).

hobgoblin
Zilot
01-16-2003, 04:13 AM
Hi h8er !

When you started this thread there was version 1.1 of Avispliter, in the mean time it is quit and there is 1.2 version when I tried to unpack, now maybe newer, are you talking about 1.1 or 1.2 or maybe newer.

Soldat
h8er
01-18-2003, 04:48 PM
My version is 1.1 so it was a misunderstanding ;)


To solve crackme without using debugger.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > To solve crackme without using debugger.
PDA

View Full Version : To solve crackme without using debugger.

ZaiRoN
01-05-2003, 06:52 PM
Hi All!
The first project of the 2oo3...WoW!

Sometimes, in particular when I'm approaching a new target, I like to take confindence with it looking at the dead list; solving a problem only using a debugger is often possible. But of course, is not always so easy, especially when the routine we are studying has been written to make us confused or when there are many jumps and many controls.
In this case, it's convenient to use IDA because it has an internal interesting tool that can help us to put all the things in order, the tool is WinGraph32 and it can show you the flow of the code inside a simple block diagram.

To use this tool is very simple, the only thing you need to do is to put the cursor on an instruction and hit F12; in this way, you'll see the flow chart (instruction-by-instruction) of the code near the instruction. There is another option that can be activated using CTRL-F12 combination; this feature is quite different from the other because it shows you the flow chart call-by-call.

As you have already understood, the purpose of this project is to solve the crackme without debugger. In this way we will increase our experience in walking through the dead list only and of course, using wingraph too.
Obviously, I suggest IDA but if you want, you can do the job using Windasm, it's a little bit hard!!! If you are in trouble or if you don't understand some instructions, feel free to ask everything.

The crackme is not so difficult (not packed, written in assembly, no hidden code (!?! :p)). Look at the tip in the attached file and at the name of the crackme...you have to pay attention when you will move through the various states :D
The crackme has been written by Basse and you can find it in the Biw-Reversing home page: http://biw.rult.at/
Take a look at this group site, it's quite interesting and contains lots of crackmes to practice with :-)

Good luck mates!

ciao,
ZaiRoN


crypto crackme thought experiment
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > crypto crackme thought experiment
PDA

View Full Version : crypto crackme thought experiment

mike
01-05-2003, 09:52 PM
This is a thought experiment to show that RSA protections can sometimes be broken even though they use big keys.

Consider this protection scheme: User enters name and serial number. Program computes 48-bit CRC then raises it to a large power mod n, a 2048-bit number. Finally, checks to see that the encrypted CRC matches a stored value.

We want to write a serial number generator--no modification of code.

If we had one good license, we could break it instantly (how?); what if we don't? Brute-forcing the 48-bit keyspace would take months on hundreds of computers. There's another way that has a good probability of working that only needs one computer with a few hundred megs of RAM and less than a day. What is it?
Bengaly
01-06-2003, 05:22 PM
hi mike,
check this post:

http://board.win32asmcommunity.net/showthread.php?s=&threadid=5200&highlight=rsa

it is quite long, funny & interesting.
ttl.
mike
01-06-2003, 08:23 PM
I've seen that particular algorithm proposed several times on sci.crypt. I came up with it myself when I first read about RSA. It doesn't work.

Does anyone have the answer to the easy question from the first post: how to break it with a single good license?
r4g3
01-06-2003, 08:34 PM
Originally posted by Bengaly
it is quite long, funny & interesting.
ttl.

it is very long. wa funny at the begining. interesting ? hell no. that .. ehm .. *** sch.jnn continues with his 'you are very close .. blah blah ..' to the very end. red first 5 pages, got bored, @ #15 he still gives the same bull* :\

in short he`s an asshole. no more, no less.
How could someone actually could seriously claim to solve smf as well studies as IFP :) What else than some stupid 'visual multiplication' was proposed there ? Nothing! hmmm ...

oh & btw i`ve discovered smf extremely kewl & leet: a vb app to do 2 incredibly marvelous thing:
1. it gives the phone number given ip (dial-up connection)
2. once having the phone # it unpax al of aspx-ected targets out there on the net & hax the victims pc doing the following: the crt is damaged by imprinting "SEX" on it`s surface & the user is bit hard by the mouse ...

that shit should look similar to any mathematician as mine to anyone of you...

for the last note: haven`t you ever thought of this 'sollution' as so far 'revealed' by our new genius ? once wasted a whole sheet of paper to realise it`s useless...
mike
01-06-2003, 09:11 PM
OK, 'nuff with that other thread. It's irrelevant.
Woodmann
01-07-2003, 03:37 AM
Howdy,

If we had one good license then why not make
our own little proggy to do the work ?
I smell something in PERL ala Maurer.

Yes/no/maybe ?

Later, Woodmann
mike
01-07-2003, 06:39 AM
So you have one name and serial; it concatenates them, computes a 48-bit CRC of the result, encrypts it and compares the ciphertext to a stored one. What work, specifically, would you do in your "little proggy" ? :)
FoolFox
01-07-2003, 10:01 AM
Hello,

If we had one good license, we could break it instantly (how?);

wow...i'm not into crypto but you raise my interest...

Does it involve a kind of quick factorisation of the know licence ?

Regards
FoolFox
nikolatesla20
01-07-2003, 02:03 PM
I will call this an "internet educated" guess since I am certainly not a math expert BY FAR.

Here's the only thing I can think of to add to the thread - you are calculating a 48 bit CRC from concatenated strings, and then encrypting it.

Well, first of all, if you have a encrypted comparison, you know what is has to turn out to be. And in my "guess" that means the CRC always has to be the same value or it won't work. Is this right? (I mean if you encrypt a different CRC value, I doubt you would get the same as the stored encrypted value, ever?) So now you need to figure out the CRC algo so you know how to combine the strings?

Just my thinking as of now..

-nt20
fcjohn
01-07-2003, 04:39 PM
As far as my limited experience goes, you're exactly right, nikolatesla20. Only one CRC "plaintext" will produce the correct stored value "cyphertext."

I'm curious about mike's method of solving it without a license. Obviously, factoring the 2048-bit n is out. My guess would be to use the weakness of the short message, as mentioned here: http://crypto.stanford.edu/~dabo/abstracts/ElGamalattack.html

A few important lines from the paper:
Suppose the plaintext M is m bits long. For illustration purposes, when m=64 we obtain the following results:

For any RSA public key <N,e>, given C=M^e mod N it is possible to recover M in the time it takes to compute 2*2^(m/2) modular exponentiations. The attack succeeds with probability 18%. The algorithm requires 2^(m/2)*m bits of memory.
mike
01-07-2003, 07:29 PM
Well done, you two. That's the whole of it. Only one CRC is right; the author calculates what serial number needs to go with a name. Since CRC is linear, you can do it instantly if you know what CRC you're trying to reach (for those of you who doubt it, try looking at the definition of CRC32 and find four bytes whose CRC is 0xDEADBEEF).

The trick is the short message. Many 48-bit numbers can be factored into two numbers less than 28 bits long. Calculate j^e for j=0 to 2^28, store 4 bytes of the result. Then for each one, divide m^e by j^e and see if the other factor is in your database. Chances are pretty good it'll be in there for one of them {up near 50%, actually; the 18% from the paper applies to calculating sqrt(# of plaintexts). If you calculate more--like we do here with 2^28 instead of 2^24-- then the success rate improves pretty fast}.

If people like this sort of thing, I can design a few more with similar flaws...
Woodmann
01-08-2003, 08:22 PM
Hi,

I like it, I instantly fell for it :D

Caught me looking to hard at the encryption instead
stepping back and looking at everything.

I would like to see some more, it may just drag me
into the crypto world :)

Peace, Woodmann
squidge
01-08-2003, 09:43 PM
I spotted the CRC flaw with a known license key, but hadn't a clue how to retrieve the CRC without a license.

Certainly gets my vote for more :)


Licence file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Licence file
PDA

View Full Version : Licence file

tiggerthedude
01-05-2003, 10:15 PM
Have a prog which contains three versions in one. ie
standard, plus and pro editions
there is a 48 byte licence data file (loaded on start up) which contains serial no and version details

I'm trying to figure out licence file to end up with pro version but
Windasm98 plus other progs crash when it loads exe file

Language says written in pascal and compiled with borland delphi
borland debugger says not 32 bit

Can anyone help with advise as i'm new to hacking on the PC
ZaiRoN
01-05-2003, 10:34 PM
Hi tiggerthedude,

To begin, you read this page; you will find surely your answer:
why windasm plus other programs crash (http://www.woodmann.net/fravia/rce-faq.htm)

good luck,
ZaiRoN
mike
01-06-2003, 12:13 AM
Actually, Z, the question is in there, but it looks like the answer has been removed. Woodmann, do you know anything about that?
Kayaker
01-06-2003, 02:16 AM
Funny what you find when you search for 'W32Dasm + WDasm + crash"

http://www.woodmann.net/forum/showthread.php?threadid=3779&highlight=w32dasm+wdasm+crash

I don't know if this addresses your problem though because you said loading it with other programs causes it to crash as well. What other programs and what are the exact error messages?

Good point about the missing answer though ;)

Kayaker
naides
01-06-2003, 02:50 AM
Originally posted by tiggerthedude
Have a prog which contains three versions in one. ie
standard, plus and pro editions
there is a 48 byte licence data file (loaded on start up) which contains serial no and version details

I'm trying to figure out licence file to end up with pro version but
Windasm98 plus other progs crash when it loads exe file

Language says written in pascal and compiled with borland delphi
borland debugger says not 32 bit

Can anyone help with advise as i'm new to hacking on the PC

Option 1: Download IDA, there is a freeware version that I think is still available from their site. Dissasm with IDA is a little more involved than windasm, but once you get used to it, it is a very powerful tool and usually immune to anti-dsasm tricks.

Option 2: attack the program with a debugger. save a copy of the license file and replace its contents with some easily recognizible text. then run the proggie and look at the error message.
activate the debugger and find the bogus license text in memory, put a bpm, rerun the program, catch the code that reads and evaluates the license file contents, provided it is loaded to the same area in memory. Or place a break point in createfileA and catch the program opening the license file etc, etc, etc.

If all I am saying sounds like greek to you, read some tuts about license file cracking, and also the cracker's notes, available somewhere in this site.


hidden forms of program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > hidden forms of program
PDA

View Full Version : hidden forms of program

dipeshrestha
01-06-2003, 09:00 AM
Hi all,

This is dipeshrestha again. I have installed a program called "Itweaku.exe" and it was limited version. I never intended to crack that program thinking that the limited version was programmed seperately and the full version of program is seperately coded. But when i loaded that program in EXESCOPE , i find out that there is a form (number: 166) that have textbox for name and registration code.

i am amazed that the author had hide that form. but it cant be viewed when i run that program. Is that possible to hide that form in such way? Can i used this form for registering program?

program can be found from: www.snet.com.np/dipesh/Itweaku.exe

PLS somebody help me

dipeshrestha
still beginner :mad: :mad: :mad:
squidge
01-06-2003, 01:24 PM
Just because the form is there, doesn't mean the code to handle it is. It's much easier to remove the code only.

Also, please don't post direct links to targets on this board. You could be flamed, or worse, banned.
naides
01-06-2003, 03:13 PM
Originally posted by squidge
Just because the form is there, doesn't mean the code to handle it is. It's much easier to remove the code only.

Also, please don't post direct links to targets on this board. You could be flamed, or worse, banned.

Actually, the link is pointing to his personal Site, not to the software maker's
esther
01-06-2003, 05:11 PM
Hi.
>Actually, the link is pointing to his personal Site, not to the >software maker's

Dunno let the Mod's decide ;)

Btw Post More of your findings,else be prepared to be delete

Regards
Kayaker
01-07-2003, 02:16 AM
Like squidge says there's likely code missing, a smart move but not necessarily that effective unless a *lot* of code has been removed. Let's take a look in W32Dasm for clues...

The DialogID for the reg box in Exescope is 166, A6 in hex. Use the DlgRef in W32Dasm and you can find what looks like complete handling code for all the edit entry controls. Oh oh. Compare the complete structure of this MFC code with working dialog boxes, and you notice it looks to be in OK shape. Especially compare how the procs for all the other dialog boxes begins and you notice one glaring difference - there's no
* Referenced by a CALL at Address:
to begin the proc. Aha. Perhaps all that is missing is the code that calls it after handling the OK button. I'm not sure why there are 4 separate procs but they're all similar in that they seem to be needing a direct call reference. You should get hold of some MFC documentation and find out what all those ordinal calls do, you might be able to narrow down your choices of which is the proper proc to call.

Finding this code which handles the OK button, if it exists, is a little tricky at this point. If you're lucky all that is missing is the call to the proc that you've already found. The other problem is that the dialog isn't actually on screen so you can't do any live tracing. Here you may only be missing a menu item to call it. You can add your own menu item easily enough but what is the proper ID for it that is handled? I suspect the handling code may be there (it's easier just to delete the menuitem), so what you could do is search for any unused menuitem IDs that might be the one you want. Most of them are numbered sequentially so you might be able to find a reference in the deadlisting or a live trace that is handled but "doesn't seem to go anywhere". This might lead to the code which loads the registration dialog resource.

Worse comes to worse this is all code you could create yourself, menu item -> FindResource, LoadResource and you've got the dialog on screen. THEN you can trace the OK button and see if you can join it up with the proc that needs to be called.

None of this means you can register it or the s/n checking routine is actually there, but I suspect you could get a working version of the reg box which (apparently) handles all the input, and go from there. The other way to look at it is how does the demo differ? It seems that 4 or 5 of the dozen or so tab dialogs are "Pro version only" and the only difference seems to be that the "Apply" button doesn't respond when you make a change. What you could do is find out how clicking a checkbox in one of the 'good' dialogs immediately enables the Apply button, while clicking a checkbox in a 'Pro' dialog does nothing.

It may even be lamer than that and all you have to do is permanently enable the 'Apply' button and all changes you make will take effect. That's pretty easy to check and if that's the case the programmer has created a "weakest link". The fact that they didn't remove the registration dialog resource or apparently much of the handling code except maybe commenting out a few linking elements should be a warning to shareware programmers that a little more is needed.

Hope this gave you some ideas,
Kayaker
dipeshrestha
01-07-2003, 06:54 AM
Thank you Kayaker,

thank u very much for your nice explanation. Now it is all clear to me. B y the way, i am very much sorry to post the DIRECT LINK in this forum. i am thinking that the program is very old and also i have forgotten the site from where i have download that program. I think that it is better to have a look at the program itself, rather than writing all the explanation about that program.....

anyway once again lots of thanks goes to kayaker guru for his nice explanation...

dipeshrestha
Still Beginner :mad: :mad: :mad:


NeoProject
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > NeoProject
PDA

View Full Version : NeoProject

Hoof Arted
01-06-2003, 11:12 AM
Hi,

I would just like to know your comments on this http://theneoproject.com.

Do you think they will get it and if so, how long do you think it will take ?
mike
01-06-2003, 08:13 PM
They're not even sieving. It's a waste of processing power. Do folding@home.
r4g3
01-06-2003, 09:07 PM
have you seen the program itself ? The speed difference when minimized is ~10x compared to when in showing the window. what a stupid idea to show every tested itteration ... no matter the algo used it`s a stupid thing to do. Heh goes @ 1work unit/1min on my athlon1667
Sab
01-06-2003, 10:43 PM
In order to verify the public key, the private key would be kept within xbox hardware. I think a more feasible attack would be the hardware itself. Although, if private key is extracted I guess one couldnt make as much $ with that as they would selling actual modchips? Already been done imo. (: -Sab
mike
01-07-2003, 12:35 AM
Nope, the private key isn't in there. The public key is. It's used for checking the signature on the code that's being loaded.

What someone needs to do is put an easter-egg in a game that will load arbitrary code and then get the game signed...
Hoof Arted
01-08-2003, 11:32 AM
Would it not be possible to calculate the private key if you had the unsigned software, the signed software and the pub key?
mac
01-16-2003, 02:06 PM
hi sab,

you got the harware reversing view of things, eh ?????
:-)))))

but as mike said, no private key in the xbox - just
normal signature verify...

cya

mac
mike
01-16-2003, 05:40 PM
Originally posted by Hoof Arted
Would it not be possible to calculate the private key if you had the unsigned software, the signed software and the pub key? Nope (at least not faster than any other way).

If it were possible, then digital signatures wouldn't be worth anything, right?

BTW, anyone know what hash is being used? Because usually, they'll sign a padded hash of the data rather than the data itself.
AdamA
01-17-2003, 10:15 AM
Hi,

Read this nice article about xbox security:
h**p://xbox-linux.sourceforge.net/articles.php?aid=1&sub=Xbox%20Security%20Concept

AdamA


knapsack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > knapsack
PDA

View Full Version : knapsack

ancev
01-06-2003, 11:02 PM
hi,

as result of a rainy afternoon, i coded this knapsack crypto implementation, as described in "applied cryptography", by bruce schneider.

h**p://coderz.net/vecna/knapsack.zip

was a nice way to spend some hours, and learn new things. maybe somebody find some spare time to break it(as this knapsack implementation its insecure).

ancev


Searching Games
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Searching Games
PDA

View Full Version : Searching Games

Woodmann
01-08-2003, 02:03 AM
Greetings,

I have come up with a simple searching game.
I hope to teach those who have troubles with searching.

Some will find this easy, others will find it difficult.

There is nothing obscure, it is all done with the most common
tools used to search.

This is a basic search game, it should not be so over-whelming
that you cannot do it.

Do not post your answers here, email the answer to me.

You may ask any questions in reference as to how to formulate
or refine your searching techniques.

Every Wednesday I will post a new search question.

Peace, Woodmann

woodmann@woodmann.com
Woodmann
01-08-2003, 02:05 AM
Here we go,

Who made the 2.2-re motor ? (what company)

Good luck !!! :)

Woodmann

People who have answered this :

1) disavowed
2) Sloppysam
3) Zairon
4) Twisted EndZ
5) BeHereNow
6) HumbleExistence
7) fat64
8) sha_k
Woodmann
01-14-2003, 06:11 PM
Question:

Where is Nietzsche buried ?

Post no answers email them to me

woodmann@woodmann.com

People who have answered this:
(in no particular order)

1) Kayaker
2) esther
3) Snatch
4) Mike
5) Naides
6) etherlord
7) Sloppysam
8) Twisted EndZ
9) UraDox
10) 4oh4
11) disavowed
12) ZaiRon
13) Manko
14) Mandelbrot
15) BeHereNow
16) Humble Existence
17) Sphinx

The more who participate, the faster the game progresses.
Woodmann
01-15-2003, 04:26 PM
Well my little crackers :)

It's funny, I am listing these questions in order of difficulty
to me. Everyone said the Neitzsche question was easier then
the 2.2RE question. Apparently I search different then the rest
of the world :eek:

Now, I am kind of stuck. the questions start to branch off into
different areas. I will throw this one out to Ya'll :

Name the last upstream router/server before you get to:
http://www.drscholls.com.

You know the rule, email the answer to me

woodmann@woodmann.com

Those who have answered this correctly:

1) Kayaker
2) Manko
3) Snatch
4) Mandelbrot
5) Sloppysam
6) ZaiRon
7) etherlord
8) Uradox
9) disavowed
10) naides
11) 4oh4
12) BeHereNow
13) Humble Existence
Woodmann
01-18-2003, 05:36 PM
What company owns the trademark for Timber wolf chew
in the United States ?
(big coporate buy outs cloud the picture)

I am getting to many wrong answers.
Write down the question and the hint.
Think about it for a few minutes.

Hint: search tobacco manufacturers

Post no answers, email them to me :

woodmann@woodmann.com

Those who have answered this question:

1) /haex
2) esther
3) Sloppysam
4) cHeCksUm
5) etherlord
6) BeHereNow
7) sha_k
Woodmann
01-25-2003, 06:29 PM
You have made me sad :(

No one is willing to make an effort to solve this.

Maybe you need some more "easy" searches.

What do the letters cpcpc stand for in the cpcpc theorem ?
(they cant get any easier then this)

Post no answers, email: woodmann@woodmann.com

People who have answered this correctly:

1) Uradox
2) Sloppysam
3) esther
4) Disavowed
5) etherlord
6) cHeCksUm
7) BeHereNow
Woodmann
02-11-2003, 08:43 PM
Your next question...........

What was the old area code for the mojave phonebooth ?

As always, post no answers, PM to me.

Those who have answered this question correctly:

1) JimmyClif
2) disavowed
3) Kayaker
4) Winston
5) eSn-mIn
6) FoolFox
7) Nudnik
8) UrgeOverKill
9) dELTA
10) BeHereNow
11) Humble Existence
12) Sphinx
Woodmann
02-20-2003, 06:30 PM
Lets try something a bit more difficult..........

Finish this email address : stsk61@
You may ask for help.

Post no answers here,PM me with the answer.

Who has answered this correctly ?

1) Disavowed
2) lownoise
3) Uradox
4) ZaiRoN
5) the_analyst
6) Kayaker
7) MarcELBichon
8) eSn-mIn
9) Winston
10) dELTA
11) FoolFox
12) BeHereNow
13) HumbleExistence
Woodmann
02-24-2003, 04:27 PM
This mans identification number is BI600.
His first name is Brad.

What is his last name ?

Post no answers, PM them to me.

Those who have answered this correctly :

1) dELTA
2) ZaiRoN
3) lownoise
4) BeHereNow
Woodmann
03-06-2003, 06:36 PM
Are the questions to difficult or are you lazy and
unwilling to make an effort ?

momo is a regional name for this animal.
What is the more recognized name for momo ?

PM the answer to me.

Correct answers from :

1) dELTA
2) ZaiRon
3) Kayaker
4) Asbury
5) Winston
6) esther
7) UrgeOverKill
8) BeHereNow
9) Humble Existence
10) Sphinx
Woodmann
03-10-2003, 09:43 PM
Your target is a song :
Youth of America

Name the person who sang it.<<<<READ THIS AGAIN

There have been a couple of different
versions of this song. I want the original.
Obviously look at the date of the recording.

Post no answers, PM your answer to me.

1) ZaiRoN
2) Asbury
3) Winston
4) dELTA
5) Bengaly
6) BeHereNow
7) Humble Existence
8) Sphinx
9) sha_k
Woodmann
03-17-2003, 08:48 PM
This is a painting by a famous painter :

"In the meadow"
This is the exact name, there are no deviations.

If you need to see it I will make it so.

It was pointed out to me be many people
that I neglected to ask the question.
You all figured it out anyway ;)

Post no answers, PM me.

Those who have answered this correctly :

1) nudnik
2) disavowed
3) eSn-mIn
4) diz
5) NervGaz
6) ZaiRoN
7) lownoise
8) wbe
9) BeHereNow
10) Asbury
11) Humble Existence
12) Sphinx
13) dELTA
14) Winston
15) sha_k
16) FoolFox
Woodmann
03-24-2003, 06:44 PM
OK,
There will be no hints for this search. You dont need them.

I am looking for the date of death for :

Richard J Celata

Post no answers, PM your answer to me.

1) Asbury
2) dELTA
3) Winston
4) BeHereNow
5) HumbleExistence
Woodmann
04-23-2003, 07:26 PM
Your next question........

Regarding United States Currency:

What was the largest note ever in circulation ?

As always, PM your answer to me.

Those who have answered this correctly:

1) Asbury
2) nikolatesla20
3) BeHereNow
4) dELTA
5) JMI
6) hobferret
7) Sphinx
Woodmann
05-03-2003, 08:27 PM
Well...........

I see that most of you will only make the
effort to answer the easy ones.
Thats better then many who visit here........
Most dont even make an effort. I guess they
all have the skills to find everything they need.

So I suppose there wont be any more lame questions
about why SI doesnt work or can someone give me
flex seeds or I dont know why this wont work,
I un-packed it................ You all have the 2K1IL's

I need a phone number.....

Luciano Polizzi, he lives in Cerda.

E-mail/PM the answer to me please.

Those who have answered this question correctly:

1) Asbury
2) peterg70
3) disavowed
4) dELTA
5) UrgeOverKill
6) ZaiRoN
7) BeHereNow
8) sha_k
9) hobferret
10) FoolFox
11) Sphinx
12) clone-d

Woodmann
Woodmann
06-05-2003, 05:59 PM
Hi,

Sorry for the delay...............

I am looking for the patent number for a Walther model 1.

Good luck :)

Those who have answered this correctly:

1) Kayaker
2) UrgeOverKill
3)
4)
5)
6)
7)
8)
9)


Links
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Links
PDA

View Full Version : Links

r00t
01-08-2003, 12:00 PM
Im searching a good collection of cracking links, yes maybe isnt a good post, but i cannot found Lazarus site on google (and a lot others).

Thnks in adv.
esther
01-08-2003, 12:32 PM
Hi,
Probably its not up in the net anymore.
Do some searching in the forum you will find an old copy of that site.start with r*cxx c** ;)

Just a kind reminder,read the FAQ on the main page of this forum
before posting anything here
sai
01-09-2003, 06:04 PM
Hi,

these are some nice pages:

http://www.woodmann.net/crackz/index.htm
http://zor.org/krobar/
http://www.anticrack.de
http://www.woodmann.net/IDArchive/ID-RIP/index.htm

sai
JimmyClif
01-09-2003, 06:46 PM
His referrer ( http://hello.to/lazarus ) still works but not much happening there... Oh well... That's how the net works... Dead sites, dead links.. /me shrugs...
r00t
01-10-2003, 09:56 AM
Ok, i cannot found lazarus copy site in the forum.

esther, can u pinpoint it?

greets.
esther
01-10-2003, 10:51 AM
Hi root,
There's a button on the top of right hand corneer
http://www.woodmann.net/forum/search.php?

Search for rce cd*
Happy searching ;)


New Tool: RTA 1.00
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New Tool: RTA 1.00
PDA

View Full Version : New Tool: RTA 1.00

squidge
01-08-2003, 10:46 PM
This is a tool for all of us that like attacking EXE files and other such files with hex editors. It's a small assembler - you type your asm into the edit box and it gives you out the opcodes required for that instruction. It can handle patches upto 4095 bytes in length, which is enough for most people :)

After you have finished your patch, you can either copy the hex codes or asm into your clipboard, or save the hex/asm/binary to a disk file.

Instruction-wise, it supports all standard 80x86 commands, including the FPU & MMX. SSE is however not supported.

Screenshot & Download: hxxp://www.ibiblio.org/paulc/rta/
Kayaker
01-08-2003, 11:22 PM
Nice job. I know someone who's getting into polymorphic code and this just might be handy for generating those small snippets of code that accomplish the same thing ;)

I'm sure you know your app just begs to be reversed too :D

Cheers,
Kayaker

EDIT - Thought I'd "sticky" these two 'New Tool' threads for a few days to give people a chance to check them out. Maybe encourage others to post their owns apps..?
JimmyClif
01-09-2003, 12:58 AM
Nice work!
squidge
01-09-2003, 02:13 PM
Instead of reversing my app, why not look at the assembler engine in source code form ? After all, I only wrote the GUI :)

h**p://home.t-online.de/home/Ollydbg/

is where I grabbed the source code for the assembler. Save's writing it myself :-)

Course, if you prefer to reverse my app, then feel free. It's not protected in any form (not that it would stop you if it was :D

Originally posted by Kayaker
Nice job. I know someone who's getting into polymorphic code and this just might be handy for generating those small snippets of code that accomplish the same thing ;)

I'm sure you know your app just begs to be reversed too :D

Cheers,
Kayaker

EDIT - Thought I'd "sticky" these two 'New Tool' threads for a few days to give people a chance to check them out. Maybe encourage others to post their owns apps..?
disavowed
01-11-2003, 12:02 PM
great tool! great work!
Bengaly
01-14-2003, 11:47 AM
well,
the point of doing tools..is by doing them your self..
downloading a ready soruce code is not in that term :-)
code ur own assembler engine, you will learn much more from doing it your self...
ahh well, nice job on the interface ;)
squidge
01-14-2003, 05:52 PM
didn't have time to do my own assembler m8, otherwise I would have done. There was only a "limited instruction set only" assembler out there, so OllyDbg's source's seemed the ideal thing to use. Nice interface over it and bingo :)

I allready know how the intel cpu opcodes work as I've written a disassembler. Not a very good one mind, but it disassembles small files. I now just use IDA.


Palm Os Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Palm Os Reversing
PDA

View Full Version : Palm Os Reversing

yktan
01-09-2003, 01:19 AM
Hi everyone, just like to find out if anyone does reverse engineering on Palm OS software. I used to be able to use tools to disassemble programs made for the 86k (motorola) processors but since they came out with Palm OS 5, I can't seem to find any disassemblers that can correctly disassemble OS 5 programs with ARM specific codes (besides IDA which I do not have the processor module for). Anyone knows how to go about it? Thanks for the help.
Kayaker
01-09-2003, 01:22 AM
Like this?

http://www.dreamimpression.com/palmdemon/
yktan
01-09-2003, 02:04 AM
Hi Kayaker, thanks for replying. I'm currently using pdemon v0.27 and I think it doesn't support native ARM codes (when I try to disassemble, it gives me a lot of unrecognised "armc" resources). Do you know of any disassemblers that can work with native ARM codes? Thanks for your help.
Carpathia
01-15-2003, 05:56 PM
Hi there. You are right, pdemon doesnt support armlets at the moment. I had looking at adding support in the middle of last year, but documentation was sparse, and test binaries were just non existant.

I would be grateful if you could provide URL's to any PRC's utilising ARM, as I am still interested in adding ARM support when I get a spare moment. Sadly I no longer have time to trawl the palm sites inspecting apps myself :(

Thanks

Carpii
yktan
01-17-2003, 02:14 AM
Hi Carpathia, one program that I've found containing armlet codes is PocketTunes which you can find at: h**p://www.pocket-tunes.com/pockettunes/dl/pTunes1.2.zip
Good luck and thanks for making suck a great disassembler! :)
Carpathia
01-17-2003, 07:23 AM
Thanks for the information. ARM uses a very elegant instruction set, and so hopefully it shouldnt take very long to add rudimentary support to pdemon.

Although IDA does support the ARM chip, it apparently does not disassemble arm extensions embedded in palm binaries, (possibly due to the fact there seems to be no support for IDA switching processors in the middle of a disassembly, I dont know). Im sure they'll fix this tho ;-)

In the meantime be aware that all calls to a native ARM subroutine must be preceded by trap to PceNativeCall. You can at least possibly use this to determine if anything of interest might be in the ARM routine.

If you havent yet subscribed to the pdemon mailing list, please do so, as that is the only place I announce new versions.

Cheers

Carpii
yktan
01-21-2003, 09:18 PM
Hi Carpathia, thanks for the info and good luck with the program enhancements.
Anyway, know of any tutorials that deals with cracking "packed" or "installation" PRCs like Palmwars? When I look at the code of the program, it's just a small code that unpacks its code. Any help will be appreciated. Thanks.
Carpathia
01-22-2003, 02:11 PM
I remember three very old tutes by a guy called BadToast but they were all trivial patches and not really worth reading. Latigo wrote a palm reversing tute on this site, but Im not aware of many others.

There is no way I know of to easily (read quickly) unpack a palm app. It can be done with debuffer, I spent a long time on a doc reader app, dumping portions from debuffer, turning this hex dump back into real binary, and then patching this back into the app and fixing up the structure. Its not much fun but can be done if youre willing to put the time in. Perhaps todays pda debuggers have progressed enough to make this easier, maybe try palmdebugger or southdebugger.

Im hoping to add a feature to pdemon which will allow you to replace code segments, and it will fix up the application structure, but at the moment its just another feature on my long to do list :)

RE: Palmwars, this is not actually packed that I can tell, but appears to be compiled as a standalone binary written in FORTH (Oh FORTH, my day grows brighter every time we cross paths).

The actual code is held in the p4ap resource, locked into memory by the stub (the only bit of the disassembly palmdemon is showing you), and then executed. This doesnt really help you because you still need to be able to get at the p4ap disassembly. Palmdemon is currently 'in between' versions and so I am reluctant to release a version which allows you to disassemble the p4ap segment. In the meantime however, you should be able to export the resource from pdemon (right click on tree view node), and then run this through one of the other disassemblers (pildis, pilotdis), and see what this brings up. Note that I havent tried this, there is a possibility the dumped p4ap is still packed, with the decompression routine begin written in FORTH :-)
I will investigate further when I have time.

Regards

Carpathia
yktan
01-24-2003, 09:57 PM
Thanks for the very lengthy and informative reply. Programs made with Forth is definitely out of my league for the moment. Probably I'll try and look up some information when I get the time. Thanks a lot for the invaluable info. :)


ImpRec/RV questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ImpRec/RV questions
PDA

View Full Version : ImpRec/RV questions

triz-
01-09-2003, 01:30 AM
I have 2 questions about ImpRec/RV.

1) I've been using ImpRec for nearly a year now, with no complaints. It's been running on Win98SE with no problems. My old harddrive recently became a paperweight, so I popped in a new drive and reinstalled Windows. Now, when I run it, the program stalls for about 10 seconds (cursor changes, indicating it's doing *something*) then page faults somewhere inside the code. I tried running a copy copied over from the old drive, and a freshly downloaded copy, so there's no chance of the file being corrupted. Anyone ever ran into something like this before, or maybe have any idea on how to fix it? I'm not cool enough to be in MackT's inner circle and have any newer version of it :)

2) Given the problem above, I've tried using Revirgin again. I trace an ASProtected program through, find OEP, suspend, enter OEP, Fetch IAT -> IAT Resolver -> Resolve again. Every ASProtect API emulator plug-in I've tried simply returns 'error' when I try it, so I loaded kernel32.dll into W32DASM, manually trace each API, and put in the DLL name, ordinal number (from the disassembler), function name and address of it. Each function is fully fixed. When I click Generate, it says 'Some function(s) are not resolved...' :confused: Check the list again, umm, they're all there. Generate it anyway, try running the 'fixed' EXE - crash, what a surprise. :rolleyes: Check the .bin file generated by Revirgin, and the manually fixed APIs aren't even in there. :mad: Tried the whole damn thing again, same result. Is RV set to automatically throw manually fixed APIs away, or is there some arcane step I've never read about that I'm missing?
+SplAj
01-10-2003, 09:34 PM
triz

from my limited knowledge of these tools, I kinda remember Imprec uses the nice API call descrption, like DialogBoxParamA....
and RV prefers the API call memory addy like BFF52FD5. No parsing is done.

So in RV even if you are careful and type in the full name without the memory address...tough shit, it's lost. Just the memory address is good enough.

ALSO DO IT IN THE 'TEXT FILES' AFTER SAVE THEN RELOAD.....saves the nerves a little :)

Spl/\j
tsehp
01-11-2003, 02:28 PM
hi,
rv is not maintained since a lot of time now. I don't have any time for it, such a shame.

whoever wants to maintain the api part (not the tracer ) can mail me, and I'll send the sources to a serious proposal.

regards,

tsehp


Need help with win32 asm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need help with win32 asm
PDA

View Full Version : Need help with win32 asm

Nebob
01-09-2003, 11:10 PM
I have a simple program that I want to modify. When this program starts, it displays a window with a few buttons. The user must click one of these buttons, at which point stuff happens. I want to modify the program so that the button is automatically "clicked", and user intervention is not required. I'm having a great deal of trouble coming up with the right method to achieve this.

In winmain, I have code that calls:

GetSystemInfo
FindWindowA
SetForegroundWindow

and so on when the program first starts. When this is done, the program calls "init_main_wnd":

call init_main_wnd

If this fails, we do a whole bunch of error checks to find out what wen't wrong (can't register window class, etc) and bail out.

Now at the beginning of init_main_wnd, we have:

.text:00415C10 push ebp
.text:00415C11 mov ebp, esp
.text:00415C13 sub esp, 30h
.text:00415C16 mov [ebp+WNDCLASSEX.cbClsExtra], 0
.text:00415C1D mov [ebp+WNDCLASSEX.cbSize], 30h
.text:00415C24 mov [ebp+WNDCLASSEX.cbWndExtra], 0
.text:00415C2B push 0Fh ; nIndex
.text:00415C2D call GetSysColorBrush
.text:00415C33 mov [ebp+WNDCLASSEX.hbrBackground], eax
.text:00415C36 push 7F00h ; lpCursorName
.text:00415C3B push 0 ; hInstance
.text:00415C3D call LoadCursorA
.
.
.

And so on. Later, we have:

.text:00415C79 mov [ebp+WNDCLASSEX.hInstance], edx
.text:00415C7C mov [ebp+WNDCLASSEX.lpfnWndProc], offset msg_handler

Which is important, since this is our message pump.

In msg_handler, we have a long series of:

cmp [ebp+Msg_], some_msg_here
jxx handler

Then later, we have:

.text:00416D9F cmp [ebp+Msg_], WM_COMMAND
.text:00416DA9 jz button

This is the code that compares the msg with 111h and handles the case for *any* button. Because there is more than just one, when we follow the jz, we have:

.text:00416E71 button: ; CODE XREF: msg_handler+49j
.text:00416E71 mov ecx, ds:lpParameter
.text:00416E77 mov edx, [ebp+arg_C]
.text:00416E7A cmp edx, [ecx+320h]
.text:00416E80 jnz usrname_btn
.text:00416E86 cmp ds:dword_4377D8, 0
.text:00416E8D jnz stop_btn
.text:00416E93 mov [ebp+var_4], 0
.text:00416E9A jmp short start_btn

Here we finally find the handler we need, "start_btn".

"start_btn" jumps to a chunk of code that creates a new thread:

.text:00416ECD push ecx ; lpThreadId
.text:00416ECE push 0 ; dwCreationFlags
.text:00416ED0 mov edx, ds:lpParameter
.text:00416ED6 push edx ; lpParameter
.text:00416ED7 push offset cthread ; lpStartAddress
.text:00416EDC push 0 ; dwStackSize
.text:00416EDE push 0 ; lpThreadAttributes
.text:00416EE0 call CreateThread

At offset "cthread", we have the proc that calls the actual computation routines for the thread.

.text:00417B20 cthread proc near ; DATA XREF: msg_handler+177o
.text:00417B20
.text:00417B20 arg_0 = dword ptr 8
.text:00417B20
.text:00417B20 push ebp
.text:00417B21 mov ebp, esp
.text:00417B23 mov eax, [ebp+arg_0]
.text:00417B26 push eax
.text:00417B27 call sub_401B10
.text:00417B2C add esp, 4
.text:00417B2F xor eax, eax
.text:00417B31 pop ebp
.text:00417B32 retn 4
.text:00417B32 cthread endp

From there on, we get into FP code which doesn't interest us.

I've tried patching absolute jumps to various pieces of code at various locations in order to achieve this result, but I've been unsuccessful -- my program always crashes or errors out. What is the proper method to achieve something like this, and where should I put it?
Kayaker
01-10-2003, 12:34 AM
Hiya

These are buttons on a window as opposed to a dialog, and not toolbar buttons? I assume they're ownerdrawn with the 'BUTTON' class then, you don't see that too often, I've only seen examples. In either case you might be able to handle it with the same strategy of sending a wm_command message with the control ID of the button, sometime during startup but after the button has been created. Even if this is a created button, I think GetDlgCtrlID will still get you the control ID if you pass it the hwnd of the button. Or you might be able to send wm_lbuttondown/up directly to the control hwnd which should initiate the wm_command message you need.

You might be able to dispense with all that and just invoke your own CreateThread with the pointer to the thread function that's going to be called anyway once you press the button. Once the thread is created it should return to wherever you called it from so (hopefully) you shouldn't have any stack crashes. Making sure you preserve any CloseHandle (hThread) / ExitThread calls. Since all you really want to do is have this code run automatically this might be the most direct route. I think a small patch with a few lines of your own code is in order ;)

Cheers,
Kayaker
Nebob
01-10-2003, 03:40 AM
Truth is, I'm not entirely sure. It *looks* like a dialog to me, but the code seems to indicate that it's a window. Would the fact that I can't find any resource files for the dialog/window indicate that it was created through code instead of a resource compiler? I guess it doesn't really matter. The button is not on a menu; in fact, it's just a regular pushbutton that you'd find on a dialog or property page.

The "directly calling createthread" approach was the first one I tried. Unfortunately, that doesn't work for this reason: when you click the button, it doesn't only start a new thread -- instead, it starts timers, updates displays and toggles it's own caption from start to stop. If I bypass all that, the program doesn't work correctly.

Sending a WM_COMMAND to the button has its problems as well. The window between the button's creation and the entry to the main translate/dispatch loop is extremely small and doesn't seem to offer me any opportunity to insert additional code. I considered creating a new section in the file, but code injection is admittedly something I'm very hazy on.

Two questions: Can code snippet creator help me with this?

and

Is it possible to write a small external utility that starts the process, waits for the right time, sends the message then terminates itself? What are the functions that I would need? (I can RTFM myself :) )
ZaiRoN
01-10-2003, 12:18 PM
Hi Nebob,I considered creating a new section in the file, but code injection is admittedly something I'm very hazy on...Can code snippet creator help me with this?I suggest you to use Code Snippet Creator. It's *maybe* the most powerful tool for add code: the only thing you have to do is ...to write the needed code. Everything else is up to CSC. Use this little tool is very simple, it has also a good help. However, in the mini project area, there is a thread developed by Kayaker (that has stolen the idea to me :p ahahah :p) to learn to use CSC:
Code Injection with Code Snippet Creator: W32Dasm + Mouse Wheel support (http://www.woodmann.net/forum/showthread.php?threadid=4089)
You may try to do the project and see how it's easy to add code.
Is it possible to write a small external utility that starts the process, waits for the right time, sends the message then terminates itself? What are the functions that I would need? (I can RTFM myself )Writing a kind of loader you should solve the problem.
Fundamentally, you have to follow these steps:
1) Create and run the process using CreateProcess.
2) Wait until the application is not totally loaded using WaitForInputIdle function.

Your dialog is now loaded and you have to send the right message.

3) First of all you need to know the handle of the dialog and then, the handle of the button.
You can use FindWindow (or FindWindowEx) to retrieve the handle of the process and, GetDlgItem to retrieve the handle of the button.
4) After that, you have only need to send the message: SendMessage, handle_button, WM_LBUTTONDOWN, 0, 0

Basically, I think, it's all you need to solve the problem.
To use this function is very easy; check them in Windows32 Programming Reference or at MSDN. Of course, if you have problem, tell us.

regards,
ZaiRoN
Nebob
01-10-2003, 12:44 PM
Final edit:

I used ZaiRoN's solution.

CreateProcess() -> WaitForInputIdle() -> FindWindow() to find the main window -> FindWindowEx() to find the button -> SendMessage(WM_LMOUSEDOWN) -> SendMessage(WM_LMOUSEUP)

Works like a treat. Thanks for all your help.


Vbox 4? help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vbox 4? help
PDA

View Full Version : Vbox 4? help

K19
01-10-2003, 12:05 AM
Hi to all!
The target I`m working on is Adobe Photoshop 7.0.1 Tryout. This is Vbox protected not like older versions that were demos so is a fully functional program only that at the program start Vbox nag appears...
I didn`t found any tutorial on this so I had to start from the bottom. The Vbox files in this version are vboxa.dll, vboxat.dll, vboxm.dll, vboxr.dll, VBOXTA.dll, VBOXTB.dll, vboxten-us.vboxlm

I`ve somehow managed to make Psp. expire so I had to make my copy work and did that with softice( If I could only patch VBOXs vboxm.dll). I then followed the code and found the Photoshop`s EIP, and so on...
What I`ve concluded is that the IAT is not messed up but the problem is there are some calls through the IAT that call a routine in vbox that returns the real function(I don`t know how it gets those APIs). Now, I could make a patch to put the real calls in the IAT and then dump it. The only problem is that after I enter the call from Psp there is no record in memory from where that call came from so I don`t know where to put the good APIs in memory in correct order.

Any help would be appreciated!
+SplAj
01-15-2003, 09:41 AM
hmm..

Have you the toolz ? Like LordPE etc etc ?????
_________________________________________________
What I`ve concluded is that the IAT is not messed up but the problem is there are some calls through the IAT that call a routine in vbox that returns the real function(I don`t know how it gets those APIs). Now, I could make a patch to put the real calls in the IAT and then dump it.

The only problem is that after I enter the call from Psp there is no record in memory from where that call came from so I don`t know where to put the good APIs in memory in correct order.
___________________________________________________

Did you try a tracer tool like RV / Imprec .. They do - and did ;) the
job on those 2 whoppper exe's (ImageReady/Photoshop)

The few thing I can add is HAVE PATIENCE. Turn 'Faults OFF@ in SI and keep 'HOOK' or 'TRAP' the re-directed API. Keep saving the iat.txt and IGNORE ANY 'Program has crashed , press OK to exit...' just carry on and get the IAT.

The other part is that it can take ~15 minutes for the Imprec to tag the dumped exe with a new IT and save it to disk.... these are 15meg whoppers.

Have phun.....I didn't.....same old VBox :(

Spl<>j
K19
01-16-2003, 05:04 PM
Thanks +SplAj for the infos!
I managed to rebuild the IAT but now I`m really stucked. Revirgin did it`s job with the API calls except for one. When I try to trace it windows gives me a bluescreen. I traced with Sice the call and saught that is not a windows API call, it is a subroutine in vboxtb.dll and what`s worse is that I THINK it`s linked with Photoshop`s message processing because it is working in background; the code looks like shown below:

-----PHOTOSHOP!.rdata+06E0-------
0177:00F6D6E0 00 00 4A 03 EF CA F4 BF-EA CA F4 BF 8D 58 F4 BF ..J..........X..
0177:00F6D6F0 E7 47 F4 BF 00 00 4B 03-00 00 4C 03 00 00 4D 03 .G....K...L...M.
0177:00F6D700 FB C8 F4 BF 5A 59 F4 BF-00 00 4E 03 2A 11 F4 BF ....ZY....N.*...
0177:00F6D710 4C 4E F4 BF 2C 1C F4 BF-00 00 4F 03 00 00 50 03 LN..,.....O...P.
0177:00F6D720 6D 24 F4 BF D3 24 F4 BF-1D CA F4 BF 00 00 51 03 m$...$........Q.
0177:00F6D730 00 00 52 03 6A 43 F4 BF-00 00 53 03 00 00 54 03 ..R.jC....S...T.
-----

016F:00BE7601 PUSH EDX
016F:00BE7602 CALL [00F6D6E0] = 034A0000 (RV/Imprec freezes)
016F:00BE7608 MOV [EBP-54],EAX
016F:00BE760B TEST EAX,EAX
---------
016F:00BE761D CALL [USER32!TranslateMessage]
016F:00BE7623 LEA ECX,[EBP-50]
016F:00BE7626 PUSH ECX
---------
016F:00BE7627 CALL [USER32!DispatchMessageA]
016F:00BE762D JMP 00BE75E8
-------------------
016F:00BE763C JZ 00BE767B
016F:00BE763E CALL [KERNEL32!GetTickCount]

The call @BE7602 then goes here:
016F:034A0000 CALL 0700E61F
016F:034A0005 INC ESI
016F:034A0006 XOR [EBX+00000000],EBX

and,

016F:0700E61F PUSH EBP
016F:0700E620 MOV EBP,ESP
--------------------------------
016F:0700E642 CALL 0700E659 -> calls are decrypted
016F:0700E647 ADD ESP,10
016F:0700E64A MOV EAX,[EBP-04]
016F:0700E64D MOV EBX,[EBP-08]
016F:0700E650 MOV ECX,[EBP-0C]
016F:0700E653 MOV EDX,[EBP-10]
016F:0700E656 POP EBX
016F:0700E657 LEAVE
016F:0700E658 RET -> ret`s to Winapis usually
---VBOXTB.DLL---

this time returned in VBOXTB.DLL :

016F:0700EBA3 CALL 0700EBC1
016F:0700EBA8 PUSH DWORD PTR [ESP+10]
016F:0700EBAC PUSH DWORD PTR [ESP+10]
016F:0700EBB0 PUSH DWORD PTR [ESP+10]
016F:0700EBB4 PUSH DWORD PTR [ESP+10]
016F:0700EBB8 CALL [USER32!GetMessageA]
016F:0700EBBE RET 0010
016F:0700EBC1 PUSH ESI
016F:0700EBC2 MOV ESI,0705A3D0
016F:0700EBC7 PUSH ESI
016F:0700EBC8 CALL [KERNEL32!InterlockedIncrement]
016F:0700EBCE CMP DWORD PTR [0705A3D0],64
016F:0700EBD5 JNZ 0700EBF2
016F:0700EBD7 CALL 070034DD
016F:0700EBDC TEST EAX,EAX
016F:0700EBDE JZ 0700EBD7
016F:0700EBE0 CALL 07008BBF
016F:0700EBE5 TEST EAX,EAX
016F:0700EBE7 JZ 0700EBD7
016F:0700EBE9 PUSH 00
016F:0700EBEB PUSH ESI
016F:0700EBEC CALL [KERNEL32!InterlockedExchange]
016F:0700EBF2 POP ESI
016F:0700EBF3 RET
------VBOXTB!PREVIEW+DB9E------

Well, some ideas? I really don`t know from where to start with this...

Regards,
K19.
+SplAj
01-19-2003, 04:06 AM
But you found it already :rolleyes: !!!!

____________________________________________
016F:0700EBA3 CALL 0700EBC1
016F:0700EBA8 PUSH DWORD PTR [ESP+10]
016F:0700EBAC PUSH DWORD PTR [ESP+10]
016F:0700EBB0 PUSH DWORD PTR [ESP+10]
016F:0700EBB4 PUSH DWORD PTR [ESP+10]
016F:0700EBB8 CALL [USER32!GetMessageA] <-- :eek:
016F:0700EBBE RET 0010
_____________________________________________
hobferret
01-19-2003, 11:52 AM
Hi K19

R U A 10 legged K9 or what:)

There is another to look out for in this mess and that is USER32.dll PeekMessageA

/have fun - ferretman:D
bart
01-20-2003, 07:55 AM
Splaj you are my g0d :) :)

Did they (eldos) blocked G.B. key?
+SplAj
01-22-2003, 12:39 AM
bart

u mean anycalc key ? v1.76... I don't know...this app is toooo boring to play with. May '02 was last time I deleted it from HD :eek:

BTW it's been ~5 months without playing with ASPR.... i'm nearly cured :rolleyes:

send PM

Spl<>j
K19
01-22-2003, 06:07 PM
Thanks everyone for the help!
Sorry my response comes this late but I had an exam and couldn't follow the messageboard.
+Splaj, you were right about the GetMessageBoxA, but the odd thing is that it works even with the same parameters pushed (00) for w_param and l_param and EDX is no hwnd!? Same thing with another call that remained unresolved that was PeekMessageA (I also nopped this call and it worked; didn't work with the other one).
Another strange thing (for me), after I traced all the calls with RV I still got 3 calls that RV detected that were from "newasn.dll" . Of course there was no such file and I was getting lots of errors so I traced with Sice in the original program and it found it was calling "asn.dll". There was no such file either.
I got the filename in the end and it's "asn.er.dll". :confused:

Now all works except when I want to open a dialog like "File/New" or the menu it gives me a "Program execution error" dialog... and the problem is not in the patched calls because I also patched in the original program and it gave no errors... Well, I'll just have to try harder ;)

Thanks to all again.

K19.
Lbolt99
01-22-2003, 11:48 PM
Shit, you know, after breezing thru Corel Graphics Suite 11 and Wordperfect Suite 10 (both vbox 4.6.2), I got the Adobe Illustrator 10 trial and have run into trouble. Clicking on the Vbox logo on the trial screen reveals that its v4.6.2, but there is a notable difference in the section table. Most 4.6.2 I've seen looks normal but with a ".PREVIEW" section as the last one. This one looks sort of the section table of an app protected with v4.3.

I dumped it easily enough but RV comes up with only a 50% complete import table. It worked fine resolving all imports (except the usual getmessagea and peekmessagea) on the two corel packages (8 .exe files and 2 .dll files total). The funny thing is, I ran into the same problem with a vbox 4.3 protected app. The import table was 50% botched but if I started up the program with the IAT encryption skipped, everything resolved fine. I'm going to see tomorrow if that same thing works on AI 10, as soon as I figure out how to skip over the encryption/redirection to vboxm.dll in v4.6.2. You can find the IAT routine easily enough with a bpx on getprocaddress before hitting the "try" button.
+SplAj
01-25-2003, 01:48 PM
bart

Just found that key on my cd archive and d/l latest anycalc. all is ok. still registered :D

I searched the net but could not find any 'escaped' keys...so G. B. is safe ;

btw a lot of sql worms out there today ....... :p

Spl/\j


reversing Delphi 6 code ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > reversing Delphi 6 code ...
PDA

View Full Version : reversing Delphi 6 code ...

FriX
01-10-2003, 10:33 AM
Hi all!
I need lil' help.
I'm not gonna post code or anything like that, just, need advice from guys who seen this kind of a problem.

I have Delphi 6 app (D6), it was packed with AsProtect 1.2.X[New strain], anyway, it's unpacked now. PE sections have been fixed. I can run it and disassemble with W32Dasm with no problems.
But, since it's D6 app, DeDe will save me some time while reversing it. Problem is : DeDe can't disassemble it.
When i choose file and process, it's saying : "it's maybe packed or not Delphi app." Ok, np, i've tried to Dump Active Process when my unpacked program is running, so, ok, it's disassembled. But, no forms or procedures ?! So, i've look at .rsrc section and noticed there is no TPF0 signature before forms. I've added it. DeDe can find only 2 forms (but, not the ones that i need). And finaly seen that whole PackageInfo section is empty!Just 00 bytes in whole section. So, that's why DeDe can't find forms (??), except 2 useless that i dont need.It's maybe some kind of protection, but, i dont know how to 'rebuild' PackageInfo 'buffer' form that app ?!
Btw, if this helps, When i put TPF0 on all forms, i get sometimes ReadStream error ...

I hope someone has some advice or maybe solution for this kind of problems.
Thx.
Btw, sorry for bad english...
TheSearcher
01-10-2003, 11:54 AM
You don't like to search the board do you?
search the board you will find some clues about delphi forms.
squidge
01-10-2003, 01:26 PM
1) search board

2) use IDA with Delphi6 FLIRT.

both will give you gr8 results.
Kayaker
01-10-2003, 04:37 PM
Originally posted by FriX
Delphi 6
AsProtect
TPF0

The TPF0 issue came up recently. I think a manual fix is possible, if long and boring, if you really want DeDe...
FriX
01-10-2003, 08:49 PM
Ok, sorry, i've just regged and second later posted this message. So, i'll try to search
thx guys ...

btw, squidge, thx on IDA hint, i didn't knew that there is support for Delphi 6.
volodya
04-09-2003, 12:46 PM
Guys! There are no Delphi 6-7 signatures for IDA! Even for IDA 4.3!!!
squidge
04-09-2003, 02:44 PM
then make your own. It's not exactly difficult.
volodya
04-09-2003, 03:06 PM
Which files should I use to build VCL-sigs?
squidge
04-09-2003, 03:18 PM
Whatever files the linker would bundle with the dynamically linked app. These normally end up in ".bpl" so just do all of those for now.
dion
04-10-2003, 05:59 AM
Originally posted by squidge
Whatever files the linker would bundle with the dynamically linked app. These normally end up in ".bpl" so just do all of those for now.

uhm... ever asking that question long ago, and no one replies. sorry, but i think you never doing it, isnt it, squide?
squidge
04-10-2003, 07:20 AM
I'm not doing it no, but then again, I don't need to as I've not got a delphi prog I want to hack.


RSA-576 - Factored
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > RSA-576 - Factored
PDA

View Full Version : RSA-576 - Factored

[yAtEs]
01-10-2003, 04:00 PM
according to this http://www.theneoproject.com
the 576 has been successfully completed by
someone,

yates.

other refs:

http://www.rsasecurity.com/rsalabs/challenges/factoring/numbers.html
Woodmann
01-10-2003, 09:53 PM
Howdy,

I didnt find anything that said it has been completed :(

Later, Woodmann
r4g3
01-11-2003, 12:09 PM
That`s what they write on their site:

"We have started development of our new client and expect to have something available for private testing within the month. We have taken "The Squares of RSA-576" off of our page as it was getting a little confusing, people were mistaking it for the factors of the RSA-576 challenge and actually submitting them to RSA and trying to claim the prize."

As for xbox challenge: isn`t 2048bit key a bit too much ? :) If the new client will be somehing like used to bf rsa576 it`s gonna take more than eternity to find the private key, and we don`t want m$ to thrive that long, do we ? :) Anyway 2048 is way too big for any kind of attack, unless ... ever heard of quantum technology ? :) Some 20 years in the future 2048 key may be as secure as 48 is our days ... ehhmmm this is called progress right ? :]
cyberheg
01-11-2003, 01:06 PM
It turned out to be bogus. That RSA-576 isn't solved. Soon after it came out that it was factored I saw this post in sci.crypt:

---
The RSA-576 challenge number has *not* been factored. It looks as if some
moron took the Squares of RSA-576 from our front page, mistaken them for
true factors and submitted them to RSA, its just got messy from there.
Sorry for the post, next time I will just keep it quiet.

Someone as well (a news reporter) also stated that we factored the RSA-576,
which we did not. They thought the squares of RSA were indeed the
factors...

Sorry,
Mike Curry
The Neo Project
---

// CyberHeg
nikolatesla20
01-11-2003, 05:01 PM
hm

Those NeoProject guys are lately making *sses of themselves....
Best to keep the mouth shut..

-nt20
mike
01-12-2003, 02:43 PM
Does anyone know what numbers they had posted on their site expressing n as a sum of squares?
SiNTAX
01-12-2003, 03:21 PM
Originally posted by r4g3

As for xbox challenge: isn`t 2048bit key a bit too much ? :) If the new client will be somehing like used to bf rsa576 it`s gonna take more than eternity to find the private key, and we don`t want m$ to thrive that long, do we ? :) Anyway 2048 is way too big for any kind of attack, unless ... ever heard of quantum technology ? :) Some 20 years in the future 2048 key may be as secure as 48 is our days ... ehhmmm this is called progress right ? :]

Guess it's a matter of feeling (EXTREMELY) lucky :-) Afterall.. it's only

$ bc
bc 1.06
Copyright 1991-1994, 1997, 1998, 2000 Free Software Foundation, Inc.
This is free software with ABSOLUTELY NO WARRANTY.
For details type `warranty'.
2^2048
32317006071311007300714876688669951960444102669715484032130345427524\
65513886789089319720141152291346368871796092189801949411955915049092\
10950881523864482831206308773673009960917501977503896521067960576383\
84067568276792218642619756161838094338476170470581645852036305042887\
57589154106580860755239912393038552191433338966834242068497478656456\
94948561760353263220580778056593310261927084603141502585928641771167\
25943603718461857357598351152301645904403697613233287231227125684710\
82020972515710172693132346967854258065669793504599726835299863821552\
51663894373355436021354332296046453184786049521481935558536110595962\
30656

combinations :D
r4g3
01-13-2003, 12:16 PM
Originally posted by mike
Does anyone know what numbers they had posted on their site expressing n as a sum of squares?
Ok so now we shall do smf called advanced (extremely 1337) gugl searching
.......

http://216.239.39.100/search?q=cache:HMZJV7M1YGoC:theneoproject.com/main.html+rsa+576+squares&hl=en&ie=UTF-8

In case the cache is updated too soon here`s the original message:

The Squaresof RSA-576
or informative purposes (and because its really cool) I thought I would show you the Squaresthat make up RSA-576._ We figured these out on Saturday.
n = 1881988129206079638386972394616504398071635633794173\
82700763356422988859715234665485319060606504743045317388\
011303396716 199692321205734031879550656996221305168759307650257059_
n = a^2 + b^2 + c^2
a = 398017045382089878415265626948620390590002479658724153\
282455340640389423051450174406163_
b = 1725724326360365415307337925664645215926710369527337257466\
76634094909201001175453410463_
c = 11_
mike
01-13-2003, 03:09 PM
Yeah; I checked archive.org, but they didn't have anything. I missed the obvious google cache I use every day. Duh...
mac
01-16-2003, 02:00 PM
Most thing i hate is ignorance - so the neo project maximizes this for me - beeing ignorant AND wasting the time, money and belive of other poor people witch cant judge themself what they are donating to.....

I was so angry i posted this (see link) on neo project forum - but even this they dont understand...

http://www.theneoproject.com/wbboard/thread.php?threadid=650&boardid=2&styleid=1&sid=a37be583744c4e96b462a1b63ec572ce

Hopefully someone will stop them...

raaaarrrrrrrrrggh

mac


ASPack 2.11 - random decryptor!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPack 2.11 - random decryptor!?
PDA

View Full Version : ASPack 2.11 - random decryptor!?

onebitshort
01-12-2003, 07:58 AM
ASPack 2.11 (and 2.11c, 2.11d etc) seem to be very different from all other ASPacks (including the latest, 2.12). All of the ASPacks except for 2.11 are very easy to analyse, and often its just a matter of searching for the popad to find the jump to the original entry point, but 2.11 is very strange -- it seems to have just two instructions, with the second instruction jumping to a decryptor that decrypts the unpacking code -- after the decryption, the unpacker goes to work just like all the other ASPacks, but none of the other ASPacks have this decryptor. In addition to this, the decryptor seems to be random - I compressed notepad.exe a dozen times, and all of them had different decryptors (which all worked though!). I hate to use the word 'polymorphic' to describe a packer, but I cant think of a better word to describe it. Only the 2.11 variants seem to do this - all the other variants (before and after 2.11) behave like any other 'normal' packer.

Can anyone elaborate on this strange behaviour?

Many thanks in advance,
OBS
onebitshort
01-14-2003, 10:47 AM
So nobody here can comment on ASPack 2.11? Interesting ... ;)
I've searched the forum for "2.11" but found virtually nothing related to this topic. Surely I'm not the only person here to have discovered the difference between ASPack 2.11 and all the other ASPacks ... ?
Dr.Golova
01-14-2003, 06:38 PM
Comments? Hmm, yeah, ASPack 2.11 realy use polymorphic encryption stealed from some virii, but all oher versions don't use them :)

Originally posted by onebitshort
So nobody here can comment on ASPack 2.11? Interesting ... ;)
I've searched the forum for "2.11" but found virtually nothing related to this topic. Surely I'm not the only person here to have discovered the difference between ASPack 2.11 and all the other ASPacks ... ?
onebitshort
01-14-2003, 08:59 PM
Ok, so i'm not hallucinating then :)
So ASPack 2.11 uses polymorphic code borrowed from a virus? interesting ...!


crypto thought crackme #2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > crypto thought crackme #2
PDA

View Full Version : crypto thought crackme #2

mike
01-12-2003, 03:30 PM
A protector has decided to code his serial number verification scheme in Iota, so it's all interpreted minimalistic code. Not much of a chance of understanding it. You know that all it does is a simple string compare to some unknown value, so the pseudocode looks like this:

for (i=0; i<len; i++)
if (myserial[i] != trueserial[i]) return false;
return true;

Since you can get an iota interpreter, you can take his code and run it on whatever serial numbers you want without having to type them in.

You have no idea how long the serial number is.

How do you break this?
Kythen
01-12-2003, 04:19 PM
Simple, a timing attack.

Brute force each character, one at a time from 0 to i. When a character is correct, it will take longer to run as the loop will execute at least one more time. This reduces the brute forcing to O(256*i) assuming Iota uses 8-bit ASCII characters.
mike
01-12-2003, 04:49 PM
Right!

What do people think--should posters ROT13 their answers or something, so that others that aren't so quick can try their hand? Or should I just make them harder? Or both?
Kayaker
01-12-2003, 11:48 PM
Ebg13 vf cebonoyl abg n onq vqrn!
Rot13 is probably not a bad idea!

BTW Mike, these are great, thanks :cool:
FoolFox
01-13-2003, 01:09 AM
Hello,

Very interesting samples you gave us, I would personnally
prefer if people just pm you the solution they found and you
wait few days to post the good ones... I'm very interested to
have the solutions if I can't find out how to do but i'm
likely to search a bit by myself first...

Don't know if Rot13 would be sufficient... quite easy to
sort out....

Regards
FoolFox
ZaiRoN
01-13-2003, 04:43 AM
Hi All!

FoolFox, I do not like too much the idea of sending the answers to Mike, it creates a sort of limit to the spirit of these projects.
Often, a problem can be solved in many manners and, in these cases, talking about the various approaches to the problem and comparing the various solutions can be useful.

The idea of the rot13 is interesting but in the long run it could turn out heavy to converse in this way.
Perhaps, for every crypto_experiment, we could create two threads where in the second we will only put the solutions; but, I do not know if it is the better thing to make...

MnvEbA (ernql gb fcrnx va ebg13 :D )
peterg70
01-13-2003, 05:46 AM
Mike

Your making me think. (Not sure if this a good thing or a bad thing)
Keep them coming.

It certainly makes someone think differently. I think we study the minutie rather than the whole picture.

Catch ya around
peterg70
FoolFox
01-13-2003, 06:31 AM
Hi,

Yeah, Zairon, I agree with you that showing various
responses could help other's to think, and someone may
very well came up with something anybody else thought
about...

Well, dunno, two thread could be nice but how be able
to know if a message should be posted in the discussion
or the solution one ?...mmm... this may make thing less
clearer than we may want at first....

For me, as long as i'm able to learn something, I'll deal
with it :)

Regards
FoolFox
mike
01-13-2003, 03:16 PM
Don't know if Rot13 would be sufficient... quite easy to
sort out....The idea of rot13 isn't to make it hard, just to keep from spoiling the fun. If you have an idea that you think might work on part of the problem, it's ok to post it in cleartext. If you know your solution busts the thing wide open, rot13 it. I'll leave it to the posters to decide which one is appropriate.
Kythen
01-13-2003, 06:25 PM
Hey all,

Sorry I posted so quick! I didnt' mean to spoil it for everyone. Just thought I'd answer and let everyone learn a little. Heh, I also didn't realize I had posted only an hour and change after mike.

I'll keep my mouth shut a bit longer next time :D

BTW, for those of you wondering how I knew the answer, it comes from research done on smartcards. I was working on one of the crackmes in the REA reverser course that was simulating a smartcard, so I got curious and looked up a little bit on them. This timing attack is used on some smartcards and other security hardware.


softice disassembly problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice disassembly problem
PDA

View Full Version : softice disassembly problem

rowdy
01-12-2003, 09:44 PM
Hi All

I was stepping thru program and came to block of code that would not display at EIP in code window.

e.g. CS:EIP = 16c7:02e7

Code window would only display from 16c7:0000
I can scroll down to 02e7, but when i step, code window reverts back to displaying 16c7:0000. Does anybody know why it does this.
Thanks in advance

Rowdy
abigagli
02-07-2003, 04:43 AM
:confused: Hi, I'm facing the same exact problem (Driverstudio 2.7 and Xp pro sp1).. I'm having a really bad time 'cause I'm working on an old VB3 prog which is full of 16-bit code... I tried on the net and the faqs, but I didn't find anything.
Don't know if you found something, please, in case let me know...
Anyway, if you turn off the window code (wc) then you're able to see the current eip disassembled, but its still a pain...


IDA IDC/plugin writing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA IDC/plugin writing
PDA

View Full Version : IDA IDC/plugin writing

crassy
01-13-2003, 08:14 AM
Hey all!

I'm trying to write a script/plugin for IDA...

One thing it should be able to do is hide rows of disassembly... Does anyone know if it's possible?


crypto thought crackme #3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > crypto thought crackme #3
PDA

View Full Version : crypto thought crackme #3

mike
01-13-2003, 05:31 PM
You want to generate serial numbers for an app.
The serial check goes like this:

Check signature on MD5 of serial number (gotten from the
author). If it fails, return false.

word i;
qword state;

usernamelen = length of username from the textbox
srand(CRC32(username));
state=(rand()<<48) + (rand()<<32) + (rand()<<16) + rand();
for (i=1; i<4096; i++)
{
op=username[i mod usernamelen]&7;
switch (op)
{
case 0: state += rand(); break;
case 1: state >>= 1; break;
case 2: state -= rand(); break;
case 3: state <<= 1; break;
case 4: state += (1<<31) ; break;
case 5: state >>>= 37; break;
case 6: state <<<= 23; break;
case 7: state += (1<<63); break;
}
state ^=(rand()<<48) + (rand()<<32) + (rand()<<16) + rand();
}

if (serial = state) return true;
else return false;

<<< is left rotate, BTW. You're willing to buy one signature. What's your attack plan?

(Remember, if you have the answer, rot13 it before posting, but you're free to post ideas in cleartext)
mike
01-14-2003, 09:09 PM
Here's my first hint:

Gur svefg cneg bs guvf, gur fvtarq ZQ5 bs gur frevny, vf haoernxnoyr (hayrff arbcebwrpg gnxrf penpxvat ZQ5 ba vafgrnq bs gelvat sbe na EFN xrl--V guvax gung jbhyq or ernyyl pbby)

Gung zrnaf lbh'ir tbg bar frevny ahzore gb jbex jvgu. Gur frevny ahzore vf ragveryl qrgrezvarq ol gur hfreanzr. Jung cebcregvrf fubhyq gur hfreanzr unir?
FoolFox
01-15-2003, 01:42 AM
Uryyb,

Nf sne nf v Xabj...

Gur ZQ5 nytb gnxr na vachg zrffntr bs na neovgenel yratgu naq cebqhpr nf bhgchg n
zrffntr qvtrfg (svatrecevag) bs svkrq yratgu bs 128ovgf. Lbh pna'g cebqhpr gjb
qvssrerag zrffntrf hfvat gur fnzr svatrecevag.

Nf lbh fnvq, ZQ5 nytb vf n bar-jnl shapgvba. Pna'g or erirefrq.

Fb, gur Hfreanzr zhfg or havdhr sbe rnpu yvprapr, evtug ?

Vs jr tbg gur hfreanzr, jr pna evc gur vavgvnyvfngvba cunfr sebz gur nccyvpngvba
(nccraq cnqqvat ovgf, nccraq yratgu, rgp.. nf qrfpevorq va gur rkpryyrag Mnveba'f
cncre nobhg gung) gb frr jvgu jvpu inyhrf vg qrnyf. Bapr jr tbg gur inyhrf, jr fubhyq
or noyr gb pbzchgr n pbeerpg frevny sbe nal hfreanzr.

Ertneqf
SbbySbk
mike
01-15-2003, 02:03 AM
I decided this comment was worth sharing...
Hello,

As far as i Know...

The MD5 algo take an input message of an arbitrary length and produce as output a message digest (fingerprint) of fixed length of 128bits. You can't produce two different messages using the same fingerprint.

As you said, MD5 algo is a one-way function. Can't be reversed.

So, the Username must be unique for each licence, right ?
Note that only the hash of the serial is signed, not the serial itself or the username. Can you prove that there's a one-to-one relationship between a username and serial? If so, can you break the system? If not, does one username generate many serial numbers, or are there many usernames that give one serial?
If we got the username, we can rip the initialisation phase from the application (append padding bits, append length, etc.. as described in the excellent Zairon's paper about that) to see with wich values it deals. Once we got the values, we should
be able to compute a correct serial for any username.

Regards
FoolFox

You don't need to do anything with MD5 to find out the correct serial for the username; it's the algorithm I gave.
FoolFox
01-15-2003, 04:32 AM
Ok, thanks for pointing my misunderstanding on this one..

mmm...

will have to think again about it....

Regards
FoolFox
nikolatesla20
01-15-2003, 11:02 AM
Whfg n pbhcyr fznyy thrffrf:

Svefg, gurer vf PEP32 ba gur hfreanzr. Guvf pbhyq or creuncf hfrq gb trarengr n qvssrerag hfreanzr sbe n tvira frevny....

Nyfb, enaq() vf hfrq n ybg urer. Vs vg'f n jrnx enaq vg znl or na nggnpx cbvag.

-nt20
Kythen
01-15-2003, 01:58 PM
Vz tbvat gb iragher n thrff gung svaqvat n frevny vfa'g ernyyl
bhe gnfx. Jung jr ernyyl jnag gb qb vf trarengr hfreanzrf gung
jvyy perngr gur frevny jr unq fvtarq. Nf zragvbarq va bar bs
gur rneyvre ceboyrzf, bapr lbh xabj gur qrfverq inyhr bs gur
PEP, lbh pna nyzbfg vafgnagyl trg gur erdhverq qngn inyhrf gb
znxr gung PEP. Gur gevpx gb guvf jbhyq or znxvat fher gur arj
hfreanzr unq gur fnzr ybjre 3 ovgf va rnpu punenpgre nf gur
bevtvany. Bar jnl nebhaq guvf jbhyq or gb znxr gur hfreanzr 4096 punef ybat (vs cbffvoyr). Gung jnl nyy lbh unir gb qb vf nccraq gur pbeerpg punenpgref gb gur raq gb svk gur PEP naq lbhyy unir
n inyvq frevny.
mike
01-15-2003, 02:32 PM
Kythen got it again! Avoid translating his post if you want to solve it yourself. nt20--flesh out your first suggestion and see what you come up with.


Unpacking Armadillo 2.xx + Aspack 2.xx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Armadillo 2.xx + Aspack 2.xx
PDA

View Full Version : Unpacking Armadillo 2.xx + Aspack 2.xx

r00t
01-14-2003, 07:12 AM
Hi all, i need help unpacking an application that uses Armadillo 2.xx in combination with Aspack 2.xx.

The name is Mail Direct Pro 1.7.0.20.

Following Crusader's tutorial i was able to reach the OEP, (54c001) but those address lands directly in an ".aspack" section and if u look at the code:

.aspack:0054C001 public start
.aspack:0054C001 start:
.aspack:0054C001 pusha
.aspack:0054C002 call near ptr loc_54C007+3
.aspack:0054C007

Those pusha and jmp XXXX it really looks like the EP of aspack.
Theoretically i must be able to dump Armadillo and then use some automatic tool to unpack aspack. (like yoda's aspackdie). But im having problems bcoz the app hangs up.

i guess the app is completely desencripted by the armadillo layer.

greets and thanks in adv.

ps: sorry the mistakes, bocz english isnt my mother language.
Tame
01-14-2003, 08:28 AM
once you get into the .aspack section bpx getprocaddress
then look for the

popad
mov eax, OEP

hope this helps
tame
p.s this aint the best explanation but its off the top of my head
DrDemento
01-16-2003, 06:00 AM
Today discovered a strange thing,
The Armadillo protection writes in the EntryPoint (with WriteProcessMemory), the opcodes EB FE, and then 55 8B.

As anyone knows, EB FE is the opcode of "jmp eip", it looks like Armadillo dumps his own protected app!!.

Maybe is a new version of Armadillo. The proggie is from 2003.

Greets.

ps: Hey Crusader, can u take a look of the program, and maybe u can update a little the Armadillo essay.


Unpacking an unknow packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking an unknow packer
PDA

View Full Version : Unpacking an unknow packer

tazmanian
01-14-2003, 08:52 AM
HI guys, i'm quite new in unpacking, so don't be shy on help me :)

i'm trying to unpack a program that uses his own packer...not any comercial packers like Aspack, UPX,bla bla...

O found the OEP using /tracex and i've tried to dump the image to an file...it dumps (i used /dump) but there is no pe header...
What can i do to dump it with pe header?

Thanks!
nofurs
01-14-2003, 09:37 AM
Did you search the board for clues?
how do you dump your file?
You should try upx first rather than jumping a l33t tall building
and kill yourself
squidge
01-14-2003, 10:43 AM
pack a program using UPX and try to unpack that before trying to do something like this.
Js
01-14-2003, 11:59 AM
Hiya tazmanian,
I've unpacked it, seems ok. I will need some translation from you so I can check it out a bit. Assume you speak portuguese?. I will pm you after I catch some zzz's.
tazmanian
01-14-2003, 05:45 PM
thx man...could you give me some knowledge about this packer?

Send a pm to me with the portuguese words :)


easiest-to-unpack packers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > easiest-to-unpack packers
PDA

View Full Version : easiest-to-unpack packers

onebitshort
01-15-2003, 10:43 AM
Just out of morbid curiousity, other than UPX and LameCrypt <grin>, what do you guys think are the easiest/simplest packers to unpack?
hobgoblin
01-15-2003, 12:25 PM
Asprotect.:)
You know why? There is so much information floating around on how to do it....

hobgoblin
squidge
01-15-2003, 01:07 PM
Any program protected by Crypkey Stealth v5.xx. Prob easier than UPX ! You can get the Stealth program (and some nice targets to practice on) from the 5.x Crypkey SDK.
Crimson Sunset
01-15-2003, 01:14 PM
Trialmaster and Softwrap are quite simple


Help needed with UPX protected program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Help needed with UPX protected program
PDA

View Full Version : Help needed with UPX protected program

yktan
01-16-2003, 12:08 AM
Hi, I'm trying to unpack a program protected by UPX (pe-scan reports possible UPX 0.80 - 1.23) called unwc that can be found at h**p://www.etextwizard.com/download/unwc/unwc.zip

What I've done so far is:
(1) I traced through the unpacking routine and found that the possible OEP is at 4B8290.
(2) I put the program in an infinite loop at the jump and tried to do a full dump with both procdump and lordpe.
(3) After dumping, I tried to change the program entry point to B8290 using PEditor but when I tried to run it, it says "The application failed to initialize properly (0xc0000005). Click on OK to terminate the application.
(4) I did another full dump and used imprec to fix the IAT. But when I tried to run the program, it just disappears.

Can anyone tell me what I've done wrong? I've been fiddling with it for a few days but still can't find the problem. Thank you for your help.

Note: I'm using Win2k, if that will make any difference.
onebitshort
01-16-2003, 12:57 AM
upx.exe -d packedfile.exe
yktan
01-16-2003, 01:46 AM
Hi onebishort, I tried to do UPX -d but it tells me:
"upx: unwc.exe: CantUnpackExeception: header checksum error", that's why I resort to manual unpacking (besides, it's about time I do some practice :P)
squidge
01-16-2003, 02:17 AM
You don't need to repair the Import's in a UPX packed prgoram is it doesn't mess with them. Just pause the program with something like Ollydbg and dump. Change OEP with something like LordPE and it's done.

4b8290 is the correct OEP, but it seems to be double-packed.
yktan
01-16-2003, 03:46 AM
Thanks squidge, for the reply. I've never come across the methods to unpack a double-packed program (I've searched the messageboard without success too). Do you know of any tutorials that I can learn more about it? Thanks a lot for all the help. :D
squidge
01-16-2003, 03:58 AM
basically all you do is unpack the program as normal until it is in running state, and then unpack again until you get through to the main program.
yktan
01-16-2003, 04:14 AM
Thanks for the quick reply squidge. From what you said, is this what I should do?
(1) Go on debugging after the jump to 4b8290 until I find another unpacking routine.
(2) Get the jump to the next OEP.
(3) Stall program and dump.
(4) Change PE to correct OEP?

Sorry, just trying make sure what I'm thinking is correct. Thanks heaps for the help :)
onebitshort
01-16-2003, 04:19 AM
UPX starts out with pushad, so all you basically have to do is find the first popad that gets called, dump the process, and restore the EP to the OEP. There are also quite a few un-UPX'ers floating around ...
squidge
01-16-2003, 04:35 AM
yup
Kayaker
01-22-2003, 05:30 PM
OK, people must be getting really bored here lately because now we're starting to correct each others grammar, which just ain't right ;-) So here's one those on both sides of the protection fence might want to look at for fun.

RAW DUMP this with Icedump /DUMP and use the Dumpfixer option of PEditor 1.7 (VS=RS, VO=RO) and change the OEP. This is all that's needed, please don't use any fancy-ass tools to rebuild the IT and autodump it and such, it's overkill and often doesn't seem to work with UPX.

Now things get fun, anti- code up the yingyang to marvel over. Anti- regmon, filemon, winhex. winice.exe, trw2000, trw, loader32, w32dasm89, procdump, ollydbg, 202 (winice vxd ID),... probably missed some, didn't even see Meltice. "Monitor Tools Found" and "Debugging Tools Found" strings, and finally a nice filesize check. Can all be circumvented to get a running app, at least runtime.

Just thought I'd pass this on...:)

Cheers,
Kayaker
squidge
01-22-2003, 06:25 PM
Hmmmmm..... :)
JMI
01-23-2003, 11:11 AM
This "people" aint really bored. :p Was only trying to make a small tease by implying, with the start of the sentence, that squige was wrong about his program "not being faulty", when we all know its not, and then re-directing the implication to a "wrong" common gramatical usage, which squidge correctly understood as just a silly pedantic exercise. :D :D

Regards.
esther
01-24-2003, 06:41 PM
execrise? :p
squidge
01-24-2003, 07:10 PM
I'm not playing this game anymore, you canna even get me name rate !

:D ;)
Woodmann
01-24-2003, 07:29 PM
BWAHAHAHAHAHAAAHAHAHAHAHAH.................

Pops got caught in his own game :) :D

Later, Woodmann
squidge
01-24-2003, 07:34 PM
Sorry, couldn't resist :)
JMI
01-24-2003, 08:46 PM
Well "xkuse" meeeeee.:D I never calimed I could sel. In fact I've known for more that 50 years that I kaint.;) If I could spell, my father probably would have insisted I go to med school instead of the low life I have chosen. But I do regret muspelling "what's his name's, name" :D Purely unintentional and usually results from too many hours actually sitting here doing actual work on this here machine that has nothing to do with reversing. Also results from a failure to squint hard enough if I happen to not be wearing my glasses at the time. Getting older is hard on the eye sight. Damn I need a secretary who can spell.:D

Humbugaly (see I can make up words too)

Pups, err, Pops.

(Edit: At the personal request of "what's his name" I identify him for all the world as "SquiDge" with a capital "D" to emphasize its importance, and to remind me, myself, and I to include it always in the future.):D :D And I removed some of the evidence of my past transgression. :p

Regards.
:D :D
esther
01-25-2003, 10:21 AM
will I blam ma keyboad, itz alwayz stucs on t

ma tapo ers

Woodmann-Wootmann,Wotman

JMI-JEM,JIM

KaYaker-Kayakor,Kayako

esther-assther-askther,eater

Retards :D :p
squidge
01-25-2003, 12:21 PM
So you think it's funny do ya to miss of my name on yer list?

:p :D :p :D :p :D :p :D :p :D
JMI
01-25-2003, 12:45 PM
As my son would say... It was my bad.:(

/me is so ashamed, /me goes back to study me dictionary and improves me eyesight. Surgery might help. Perhaps a frontal lobotomy??:p

mea culpa, mea maxima culpa. :D

Regards.
squidge
01-25-2003, 01:48 PM
It doesn't seem like you've edited the post to include my name as of yet... :mad: :mad: :mad:

:D
Woodmann
01-25-2003, 03:22 PM
esther,
You make me laugh to hard...........

:) :D

Woodmann
JMI
01-25-2003, 03:42 PM
Woodmann-Wootmann,Wotman:

Don't laugh too hard, you could hurt yourself.

Regards.
esther
01-26-2003, 08:30 AM
>>So you think it's funny do ya to miss of my name on yer list?

Ya won me to flam ya?

http://www.geocities.com/SouthBeach/Lagoon/9819/squidge.html

http://www.agentland.com/Download/Intelligent_Agent/244.html

dum thiz iz off topic :p

Regrets :D
squidge
01-26-2003, 10:16 AM
Errr... Thanks.... Bitch :D ;)
Kayaker
01-26-2003, 12:49 PM
What have I wrot, er wrought? Sorry I brought it up....
squidge
01-26-2003, 01:19 PM
Yeah, Kayaker, it's all your fault :D
esther
01-27-2003, 06:55 AM
Stop Bit'ching Kayaker ya bitch :D
Btw Why didn't delete all thiz weird post ;)
squidge
01-27-2003, 07:06 AM
No delete coz it funee :)


FLEXlm - no imported functions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > FLEXlm - no imported functions
PDA

View Full Version : FLEXlm - no imported functions

raffaelo
01-16-2003, 07:18 AM
I have a problem with Compaq Visual Fortran 6.6
It is protected with FLEXlm 7.2, but there's no
FLEXlm specific dll. Instead, DEVVFL.PKG and
DECFOR90.EXE are protected by FLEXlm, but not
using imported FLEXlm functions...

So I'm not able to recognize the important FLEXlm
functions to be able to get the seeds, though I've
read all the tuts available on the subject, and
browsed the previous posts.
tom_324
01-16-2003, 07:45 AM
That means FlexLM is statically linked in the executable.
lmgr.lib is what you are looking for. Make a signature file of it and apply it in IDA.

Tom
raffaelo
01-16-2003, 08:07 AM
thanks a lot, i will try it out...
don't know how to make a signature file, but
time to learn now !
squidge
01-16-2003, 01:55 PM
To make a signature of a .lib file to apply to an exe, you need to download the FLAIR package:

hxxp://www.datarescue.com/ida/flair421.zip

Once you have downloaded it (it's only a few hundred Kb) you should use "sigmake" to create your signature.
hobgoblin
01-16-2003, 02:31 PM
Hi squidge,
When I try to download Flair 2.41 using your link, a password is required to get it.

regards,
hobgoblin
squidge
01-16-2003, 03:08 PM
Yup, enter your normal username and password you got from Datarescue. It's only them trying to make sure only registered users are allowed to download the files.
hobgoblin
01-16-2003, 04:17 PM
Nice. You have to buy a copy of IDA to get access.:(
Well, thanks anyway for information.

hobgoblin
nblender
01-17-2003, 10:43 PM
Surely a bit of searching will yield the flair kit, and you can make
DIY sigs. Or you could possibly find .sig files that have been
made for you already by some kind soul.
hobgoblin
01-18-2003, 02:07 AM
I did do quite an extensive search without luck. I only found version. 3.81 (I think). But luckily I got a mail from a friend with Flair 4.21 attached.:)

hobgoblin
squidge
01-18-2003, 03:08 AM
IDA 4.30 is pretty much wide spread at the moment, and comes with the latest FLAIR and SDK...

Obviously, I can't give you a link (apart from to Datarescue). So please don't ask for one.
hobferret
03-25-2003, 10:47 AM
Hi to hobgoblin;)

Forget my PM I managed to get a copy:)

Regs
/hobferret


Project Idea : Modifying MSN messanger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Project Idea : Modifying MSN messanger
PDA

View Full Version : Project Idea : Modifying MSN messanger

Hopcode
01-16-2003, 11:30 AM
Hello,

MSN apparently doesn't allow one to hide his presence (like the invisible option in icq)
Well it does, but then you can't talk with anyone. you can only send mail to them.
Sometimes it is nice to set your status as invisible, so you can
talk with a specific person.
My idea as a new project is to reverse MSN messanger and to make it allow the sending of messages, even when we are invisible.

Anyone interested ?

HopCode
sloppysam
01-16-2003, 01:38 PM
That definitly sounds like an interesting project. While we are on the topic of reversing MSN messenger. I wonder if it would be possible to add some form of encryption to the messages. I do not know if that would be extreemly difficult.

Maybe it would function similar to pgp. Just a suggestion.

Sloppysam
Snatch
01-16-2003, 01:42 PM
It may prove a futile attempt if the MSN servers are set up to prevent messages from being sent when invisible mode and not the software itself. Sometimes a cracking project can turn into a hacking project when you are dealing with things such as this. Depends on how well set up the MSN servers are and how they work.

Snatch
Hopcode
01-17-2003, 07:04 PM
Yes, you are right Snatch.
we need to have a look at it.
but we definitively can add encryption anyway.
Any other guy interrested?
sloppysam
01-18-2003, 05:28 AM
Stop me if I am out of line here but I think that it would be a better plan to go after trillian instead of msn.

I don't know if this is feasible or not. I personally do not have the skills required yet to do something like this. This is just a suggestion.

I am still just reversing crackmes while I learn to program slowly so I am a newbie.

It would make sense though If we were to go after a program to allow encrypted communication that it would be the most functional IM out there. That is trillian or some of the other multi-service messengers for linux.

This could make it increasingly difficult though. Dealing with the different clients but then again just my two cents.

sloppysam
pig_dog
04-16-2003, 05:49 AM
this seems like a very good project, i suppose one way of doing this is to add an option to block temporerelly all other people on your list, and only allow one person to see you, you could have an option when you log on to only see specific people.
Hopcode
04-23-2003, 12:57 PM
Not a lot of ppl seemed interrested.
Meanwhile i switched to trillian, so i hardly have msn installed.

Im still not sure if its possible to do it.
It might be all controlled by the MSN server.
deedee
04-25-2003, 05:35 PM
hello Hopcode,

It seens a very interesting projet for MSN, i'm not a reverser and i don't know any thing about programmation, but i'd like to give some idea:
if somebody can add a new fonction in order to count how many smily and "lol" used by the user each conversation, it will be funny. :cool:

regards
deedee


debuggin technique? dumping eip
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > debuggin technique? dumping eip
PDA

View Full Version : debuggin technique? dumping eip

fred
01-16-2003, 01:51 PM
Is there any way do dump all the eip adresses wich a program is actually using in a certain moment?

abstract example:

_function
cs:eip 0 instruction // used
cs:eip 1 instruction // used
cs:eip 2 instruction // not used maybe jmp before
cs:eip 3 instruction // used
cs:eip 4 instruction // used
cs:eip 5 instruction // not used maybe jmp before
cs:eip 6 instruction // used
.....

the dump should display Adress no 0 1 3 4 6.
Is this possible witch Softice or another Debugger ?
squidge
01-16-2003, 01:58 PM
runtrace log of Ollydbg ?


crypto thought crackme #4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > crypto thought crackme #4
PDA

View Full Version : crypto thought crackme #4

mike
01-16-2003, 08:54 PM
Continued fractions of the square roots of non-square integers are periodic. The period itself is a palindrome followed by twice the first term:

sqrt(5) = [2; 2,4, 2,4, 2,4,...]
sqrt(13) = [3; 1,1,1,1,6, 1,1,1,1,6, ...]
sqrt(29) = [5; 2,1,1,2,10, 2,1,1,2,10, ...]
sqrt(31) = [5; 1,1,3,5,3,1,1,10, 1,1,3,5,3,1,1,10, ...]

See http://mathworld.wolfram.com/ContinuedFraction.html for more details about continued fractions.

This proggy uses that fact to check serial numbers. The code takes an integer and verifies that the continued fraction representation of its square root matches the following checks:

Each term in the continued fraction except the first and last must be a number between 1 and 27, where 27 indicates a space, and 1-26 are A-Z. The first five are CACCG, while the last five are (of course) GCCAC. The middle ones encode the username forwards and backwards.

For example,

sqrt(serial) =
[(x); C,A,C,C,G,M,I,K,E,E,K,I,M,G,C,C,A,C,(2*x), ...]

In order to win this one, you've got to post a serial with your handle in it.

Easy question: Why CACCG?
Kythen
01-17-2003, 05:22 PM
Two words.... yay Mathematica!

Serial for Kythen = 1375676437308924001678248151500557858
ContinuedFraction = [1172892338328170682; 3, 1, 3, 3, 7, 11, 25, 20, 8, 5, 14, 14, 5, 8, 20, 25, 11, 7, 3, 3, 1, 3, 2345784676656341364, ...]

BTW... mike, the serial for your nick is 20285330574668271999128210 and the Continued Fraction is [4503923908623; 3, 1, 3, 3, 7, 13, 9, 11, 5, 5, 11, 9, 13, 7, 3, 3, 1, 3, 9007847817246, ...]

Thanks to a couple of my math professors for their book/course on number theory! ;)
mike
01-17-2003, 09:35 PM
What functions did you use? Did you bruteforce something, or solve it explicitly in Mma.?
Kythen
01-17-2003, 10:20 PM
Well, I originally tried bruteforcing with FromContinuedFraction[], but of course that wasn't very efficient or necessary. What I ended up doing was plugging in x and 2x and solving for what the serial must look like. Of course, it always ends up being a quadratic formula. Now, you figure out a value for x that will make this quadratic formula result in a integer. The second degree coefficient appears to always be 1, so it ends up reducing the problem to finding an x value that will make the (Bx + C) component of the quadratic formula an integer. Most, if not all of the time, B and C will be fractions with the same denominator. Let the numerator of B be r, the numerator of C be s, and the denominator be t. Solve the linear congruence rx = -s mod t to find the value of x. Plug this x back into the quadratic formula to get the serial.

I didn't write the functions I used to do this. My number theory book included a Mathematica package that has a function to find the form of N given the continued fraction of sqrt(N).
mike
01-18-2003, 01:58 AM
Cool! I wasn't aware you could solve it that way, though it makes sense now. You might like to look at the paper I got the idea from. It's by J McLaughlin, multivariate polynomial solutions to pell's equation. Google search on "polypel2c" to find it. It gives a closed form solution (I suspect it's the one your book used). It also shows that there are patterns which can't occur.


Xcr 0.13
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Xcr 0.13
PDA

View Full Version : Xcr 0.13

onebitshort
01-16-2003, 10:37 PM
Ive searched the net and this forum for info on XCR 0.13, but nobody seems to have covered it yet? You can get it from http://www.lockless.com/products.html
Im having problems finding the section of code just before the jump to the OEP, does anyone know what it looks like?
sv
01-17-2003, 05:16 AM
Hi

What is your problem, if you have found EOP ?
With import thunk @ 404000, code is between 401000 - 404000.

SV
+SplAj
01-19-2003, 04:13 AM
gotcha.... :eek:


Crazy Idea Time (Kernel Level Debugger)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crazy Idea Time (Kernel Level Debugger)
PDA

View Full Version : Crazy Idea Time (Kernel Level Debugger)

naides
01-16-2003, 10:42 PM
Shut me up if I am completely over the line.

Let us post the most desirable features one would like to see in a kernel level debugger.
I, for example, would like to see a BPR feature in Sice versions 4.26 and up, so I could use Kayaker's tracedump work again in WinXP

Once we get a collection of ideas of the most desirable debugger for a cracker, let us make one.

Either by plugins into Sice, a growth from Ollydebug, or from scratch, A concerted effort.
So we do not have to relay so much on the wimps of numega.

I have less than 1% of the talent such a project entails, but I know the talent exists, right here
Kayaker
01-17-2003, 12:23 AM
Interesting idea Naides. Heh, I'd like to see the Tracedump backtrace buffer disassembler work on XP too. In fact Clandestiny has been bugging me to get Win2K at least so we can try working on exactly that. It has proven very effective on 9x, but as you say above that there's no support for the BPR command necessary to produce the backtrace.

I believe this is an issue with the OS not Softice since DriverStudio ntice.sys still contains the code for all the BPR commands. I haven't read all the DS documentation to see if Numega broaches the subject, what is the actual reason for this, dealing with page permissions? And what happens if you try a BPR command, get an error message or does it just lock up?

What I'd like to see is a report by someone who has tried IceExt by Sten, a SoftICE NT plugin with full source which tries among other things to emulate the BPR command of the debugger.
http://stenri.pisem.net/
He actually doesn't advise using the BPR command because it's still under development, but I think it would be worthwhile to look into. It doesn't necessarily mean you could do traditional backtraces though because the traced instruction addresses still need to be stored in a buffer (the effect of the BPR "T" verb) before you can think about disassembling them.

What I'd like to try is developing a simple Ring0 tracer (which conceptually I have very little idea how to practically go about that yet), which would dump each of the traced addresses into a buffer. Nothing more, no IT fixups or tracing of redirected addresses or anything else, just a raw dump until the tracing stops. Then these addresses can be disassembled in Ring3 just as we've done with Tracedump on the addresses stored in the Softice backtrace buffer. Perhaps it's time to start looking into this ;)

Kayaker
sv
01-17-2003, 06:51 AM
Hi Kayaker

"What I'd like to try is developing a simple Ring0 tracer.."
Yep, i agree !!! It's a good idea, we need this kind of tool.

SV
Kayaker
01-19-2003, 12:22 AM
Salut SV ;-) For anyone into this tracer engine stuff, or for those of ye who seek the OEP, there's a nice open source project by Christoph Gabler worth looking into. Generic Unpacker Win32 (GUW32) includes surprisingly well commented examples of a Ring0 and Ring3 tracer. As well it incorporates and includes source of MackT's ImpREC dll (v1.1).

http://www.woodmann.net/protools/files/unpackers/guw32.zip

There are other snippets by Gabler around in a similar vein that are worth digging up as well...

Kayaker


Problems with RV tracer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems with RV tracer
PDA

View Full Version : Problems with RV tracer

Lbolt99
01-16-2003, 10:56 PM
Hello,

I need help getting the RV tracer to work. Not the API tracer but the one used for finding OEP. I'm using RV 1.51 on a Win2k SP3 platform on a "clean" system (ie minimal processes running).

I select the app to trace, then put in the boundaries, hit start trace. After a few seconds, it comes back with 0's for # of instr traced. The process is left running in the background, and can't be killed unless the system is rebooted.

I did another test and ran UPX on notepad.exe, so I have a known OEP, re-ran RV tracer, put in a range containing the OEP, same results.

I tried on another Win2k system and the same thing happened :(

Any comments? thanks
Cunegonde
01-27-2003, 09:00 AM
hello!

Well, to find the OEP, you should use PEiD which is way better than RV.
To rebuild you IAT, use Imprect, which is WAY better than RV!

Good luck :)
nofurs
01-27-2003, 09:05 AM
>>Well, to find the OEP, you should use PEiD

Are you sure you are using the right tools? ;)
Cunegonde
01-27-2003, 09:16 AM
At least I don't use revirgin ;)

Use PEiD, tracex, guw, or SCU, whatever, but not revirgin! :)
nofurs
01-27-2003, 09:21 AM
Please don't complain about tools here.If you are so great write your own
Cunegonde
01-27-2003, 09:28 AM
I don't complain at all.
There are very good tools available, which work, I'm just happy with them! I only try to share this with a guy having problems. I think that this can help.
And in any case, it's always better to know all the tools available, to test them, and then to choose what suits your needs.
nofurs
01-27-2003, 09:31 AM
>>Use PEiD, tracex, guw, or SCU, whatever, but not revirgin!

This is the evidence!
the_analyst
01-27-2003, 11:55 AM
Originally posted by cluesurf
>>Well, to find the OEP, you should use PEiD

Are you sure you are using the right tools? ;)

PEid has a "find OEP" function.
I guess he refered to thise one.. :-)

my 2 cents,

Analyst
Lbolt99
01-27-2003, 03:57 PM
Originally posted by Cunegonde
hello!

Well, to find the OEP, you should use PEiD which is way better than RV.
To rebuild you IAT, use Imprect, which is WAY better than RV!

Good luck :)

I have tried Imprec for rebuilding the IAT, but I could never get it to work as well as RV. Since migrating to a Win2k platform, I have yet to see an "OEP finder" that works right. I find them manually now using various techniques.

I still use tracex on a win98 platform for asprotect, to check for double dips, but that's it. Even that I want to abandon as soon as I figure out how to find the DD's without tracing.
nikolatesla20
01-27-2003, 09:02 PM
Howdy Lbolt99

asprstripperXP will tell you the DD's, it works great. Might as well use it :)

-nt20


SoftIce Server - dynamic stopping & restarting
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce Server - dynamic stopping & restarting
PDA

View Full Version : SoftIce Server - dynamic stopping & restarting

Aimless
01-17-2003, 03:29 AM
Just wondering...

Working on win2k server... with ice 4.05 for nt...

the work that I am doing, frequently requires to re-read the initialization settings. The only way to do it is to constantly reboot the machines after making the necessary initialization changes. however after some time this gets tedious. So...

Is there any way where we can stop and restart the NTICE service?

Have Phun


Micro-tute: Original CD emulator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Micro-tute: Original CD emulator
PDA

View Full Version : Micro-tute: Original CD emulator

nikolatesla20
01-17-2003, 10:10 AM
Hello all,

Target: Original CD emulator 2.05

This program is a classic display of a chain only being as strong as its weakest link. Please , if I blabber on, skip to the end, I found an easy way to defeat this target *without unpacking*.

First of all, I believe this target is protected by the latest version of *SProtect. I'm just guessing of course, it could be telock. PEScan says teLock .98. I've never unpacked a teLock app before, this is my first..Anyway, it has an IAT with re-redirected imports. What a mess! BUT it's easy anyway, because if you look in memory at where one of the imports gets redirected you will see crap like this:

JMP 00C300A2

then after the JMP:

JMP 00C30163

Then you go there, and it's

SUB EAX,0000045
MOV EAX, 00BE0453
INC EAX
PUSH [EAX]
RET

Yep, the SUB is at completely useless instruction. Notice the MOV, and then the INC. If add one to EAX and then "DD eax" you will see the real import address that gets pushed. Big deal you say? Well, it's a big deal , because you will see there is an entire table in memory of these import addresses. In fact, it's the same format as the original IAT table would have had. Scroll to the top and bottom of the table you see in memory and write down the addresses. Now get out of SoftICE and "dump partial" these memory ranges with LordPE. Open them up in a HexEditor and now you have all the right addresses (you could probably even plug them into Revirgin). All you have to do if figure out the names. Why is this a big deal? because the beauty of Windows linkers, functions are always in alphabetical order. You can just go down the line and plug them into ImpREC. In other words, the order of the functions in this table is the same as the order they should appear in ImpREC when you are fixing the bad addresses.

With ImpREC, I was able to cut out a lot of bad thunks, which exist in the IAT. It's easy to find these because they will have addresses which don't make sense at all. After you cut out all the bad thunks, you can repair the IAT with the tables that you dumped from above. In this program I found 4 tables. Just look up the function names the correspond to the addresses in the table. (You can use S.I. and do a "U <address>" to get the name - I'm sure there is a faster way of course, but this is how I did it) There will actually be around 188 functions that exist in memory tables, from Kernel32, gdi32, user32, and shell32. I am pretty sure this is *SProtect.

Anyway, I did all of this, and then dumped the process at what I thought was the OEP, and it still wouldn't work, so I tried a different approach. I noticed that the program would just exit, so I put a bpx on ExitProcess. This led me to a DLL called “ECCverify.dll”. I dissassembled my dumped OCDE.exe file (after I pasted on my fixed IAT), and looked for references to ECCverify.dll , and here is one:

:0040375B EB05 jmp 00403762

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403756(C)
|
:0040375D B8D3074B00 mov eax, 004B07D3

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040375B(U)
|
:00403762 50 push eax

* Reference To: eccverify.ECCVerify, Ord:0001h
|
:00403763 E850AE0A00 Call 004AE5B8
:00403768 83C408 add esp, 00000008
:0040376B 84C0 test al, al
:0040376D 0F8481000000 je 004037F4
:00403773 66C743106803 mov [ebx+10], 0368
:00403779 33D2 xor edx, edx

* Possible Reference to String Resource ID=40002: "Registed to: "
|
:0040377B B8429C0000 mov eax, 00009C42
:00403780 899544FEFFFF mov dword ptr [ebp+FFFFFE44], edx
:00403786 8D9544FEFFFF lea edx, dword ptr [ebp+FFFFFE44]

notice the test at 0040376B. Also, notice that if we don’t jump, we are considered registered. Notice “Registered” is spelled wrong? Nice :p So all we need to do is make sure ECCverify returns a 1 here. So make your own ECCVerify.dll to try it ! Fire up VC++ and write a vanilla dll with one exported function “ECCverify” and have it just return a 1, and replace the original ECCVerify.dll, and run the orginal program. Lo! It works! No more nag screen, and it thinks I’m registered. You can click on "register" and enter your name and just a couple of letters for the code, and click ok - restart the program, and it says its registered to you.

Holy crap that was too simple. After all the “protection” on the program and it’s DLL, all you needed to do was make a fake DLL. Just goes to show you that a good RCE man will think “out of the box” (and dll protections are stupid).

‘til next time
-nt20
Nebob
01-17-2003, 01:23 PM
Haha, nice :) Reminds me of the old salesagent protections that dumped themselves when you flipped a bit :)

Why do you type *SProtect instead of ASProtect? If someone searches for "asprotect", they won't find your post!


Winsock spy programs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Winsock spy programs
PDA

View Full Version : Winsock spy programs

dELTA
01-17-2003, 12:14 PM
I'm looking for good Winsock spy programs, which can monitor communications over e.g. separate TCP-connections, and display the logged data in a good way. Can anyone recommend any such good software (not TracePlus)? What are you using yourself for these tasks?

Thanks for any tips!
disavowed
01-17-2003, 12:44 PM
for a packet sniffer, i HIGHLY recommend iris from www.eeye.com
dELTA
01-17-2003, 07:35 PM
Ok, thanks disavowed, I'll be sure to take a look at it.
All I really want right now is a good program for displaying the whole course of a TCP-communication session with an unknown protocol, but I've been looking for a good general packet sniffer too.

Does anyone else have any other suggestions or opinions for such tools? It's always good to have a few good ones to choose from, since they often all have some good features and some things that could be better.
squidge
01-18-2003, 03:10 AM
Winsock Spy was a good one. It only shows 20 bytes however in the unregistered version, but it's quite easy to get it to display more :)
dELTA
01-18-2003, 05:51 AM
Ok, do you have an URL for this program?
(when searching I get a lot of hits for programs called Winsock Spy, so I can't know which one you mean, and many of them seem to be crappy).
^chaos^
01-18-2003, 09:58 AM
i do not know your intentions, however if you need a wsock spy program that is able to modify outgoing / incomming data then grab yourself WPE PRO 1.3 (98/me) or WPE XP (2k/xp/9x) from
http://fly.to/mtc/

its written by my buddy oliver. theres some help on how to use it (1.3) at www.s-i-n.com/chaos/ under tutorials.
esther
01-18-2003, 10:04 AM
beware Spy Vs Spy ;)
squidge
01-18-2003, 11:15 AM
Unfortunately I don't. I remember it was a commercial program with a 20 byte limit, but that's aboit it. I used it for hacking the protocol of WinMX, but soon got bored.

Originally posted by dELTA
Ok, do you have an URL for this program?
(when searching I get a lot of hits for programs called Winsock Spy, so I can't know which one you mean, and many of them seem to be crappy).


Reverse Flash (MX) Code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Reverse Flash (MX) Code
PDA

View Full Version : Reverse Flash (MX) Code

giorgio
01-18-2003, 08:10 AM
Hi,
I have a prog here that is programmed in Flash MX (could see it with an hexeditor). There are some "edit"-fields on the form and a "Check"-Button.

Now my question is: How can I jump to the code, where the information are read of that editfield ?

Thank you very much for your help!

Greetings,
giorgio
esther
01-18-2003, 08:15 AM
Hi,
Did you take the time reading the faq?
There are important informations regarding about this board.
naides
01-18-2003, 08:54 AM
Originally posted by giorgio
Hi,
I have a prog here that is programmed in Flash MX (could see it with an hexeditor). There are some "edit"-fields on the form and a "Check"-Button.

Now my question is: How can I jump to the code, where the information are read of that editfield ?

Thank you very much for your help!

Greetings,
giorgio

I have dealt with Macromedia written apps before, and Flash MX is basically the newest version. They can be painful to reverse because none of the typical windows API calls are used, so BPX on GetWindowTextA, CreateWindow, etc etc simply do not work.

If I remember correctly, this is the way I finally defeated it:

First I used an API spy program, Ispy was its name, and found out the handle of the window that received my password along with the window messages it was seeing.
Then I entered a bogus password in the edit field and put, in SoftIce, a break point: BMSG Handle_of_the_Window WM_LBUTTONUP

When you click the OK button, Sice breaks. Search in memory the bogus password bytes, and put a BPM on the location, which is high in memory. Then you let the program run and the password gets serially copied to several places in memory by the Flash routines. keep track of these memory locations with BPM breakpoints. with patience, you eventually land in the code that evaluates and validates the password.

An alternative method, which was suggested to me but I never had the need to try, is to Download the MacroMedia Flash MX SDK, learn their proprietary API structure, load their symbols in Sice or IDA and Put BP on the functions they use to capture and manipulate text form edit boxes, which, as I said before, are different from the better known windows API routines.

Hope this makes sense to you.
giorgio
01-18-2003, 09:16 AM
Hi naides,
thank you for your answer. This is a great tip and I will try it as soon as I can. Then I will post the results/next questions in this thread!
So as I said, thank you very much for the help, naides!

@esther: I have read the board FAQ and I have also thought about the way I post my question. If something is not correct it would be very nice if you would tell me e x a c t l y what is incorrect. Thanks.

Greetings,
giorgio
esther
01-18-2003, 09:22 AM
Hi,
You didn't mention about what tools you are using to crack.
You didn't put codes explaining where you are stuck.
Guessing what you do is not a good idea ;)
disavowed
01-18-2003, 10:34 AM
don't know if it works for mx, but sothink's swf decompiler is a great tool
mac
01-18-2003, 03:14 PM
Originally posted by esther
Hi,
You didn't mention about what tools you are using to crack.
You didn't put codes explaining where you are stuck.
Guessing what you do is not a good idea ;)

esther - did you get your all 186 posts from newbie bashing ?

:-P

mac
giorgio
01-18-2003, 04:09 PM
Hi disavowed,
thank you for your tip. I have downloaded the decompiler here: http://www.srctec.com/flashdecompiler/ (for everybody else who is interested in it...).

@esther:
hi, you said:
"You didn't mention about what tools you are using to crack." <- I've forgotten to tell you that I am using Softice, if someone knows what it is, maybe not ? ;)
"You didn't put codes explaining where you are stuck." <- I can't put codes in here, cause no bpms on normal apis work.
But thanks for your advice.

@esther:
I nearly thought that too, but I don't dare... :D

Thank you for your help!

Greetings,
giorgio
esther
01-18-2003, 11:08 PM
Originally posted by mac
esther - did you get your all 186 posts from newbie bashing ?

:-P

mac

Hi,
:eek:
zip all the post send it to me or get bashed!


Revirgin 1.5.1 Bug???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Revirgin 1.5.1 Bug???
PDA

View Full Version : Revirgin 1.5.1 Bug???

hobferret
01-20-2003, 04:39 PM
Hi to tsehp

:) Thanks for your gr8 program, I have the latest version and trying to patch a large file I get the following:

Access violation at address 00406DAD in module "Revirgin.exe".
Write address of 00000000

Any ideas buddy??

/regs hobferret

Keep up the good work!!!
:rolleyes:
squidge
01-20-2003, 05:30 PM
Revirgen has not been updated for a good while, and last I heard, Tsehp was looking for someone else to take over the program.

Try something like ImpRec.
esther
01-20-2003, 06:23 PM
or try squidgeIT :p
squidge
01-21-2003, 02:07 AM
:p


crypto thought crackme #5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > crypto thought crackme #5
PDA

View Full Version : crypto thought crackme #5

mike
01-20-2003, 04:52 PM
A company uses a single license file for a suite of programs. There are some cheap features and some very expensive ones. Which features of the programs you can use are encoded in the license file. The license file is encrypted with the author's private key. If you raise it to the power of his public key mod n (2048 bits = 256 bytes) it looks like this:

struct license
{
byte zero[1];
byte userinfo[227];
byte privileges[8];
byte sha1[20];
}

sha1 is the hash of the 235 bytes consisting of userinfo and privileges.

What's your attack plan? rot13 if you solve it, as always!
nikolatesla20
01-21-2003, 03:47 PM
Jryy, thrffrf ntnva ol zr. :)

Svefg, fvapr lbh xabj gur fgehpgher bs gur yvprafr svyr, lbh qba'g pner nobhg jurgure vg'f rapelcgrq be abg. Lbh pbhyq whfg zbqvsl gur cevivyrtrf ovgf hagvy lbh trg jung lbh jnag gb jbex. Nsgre lbh zbq gubfr, lbh fvzcyl erqb gur FUN1 lbhefrys naq ercynpr gur fun pbqr nf jryy.

-ag20
r4g3
01-21-2003, 05:18 PM
fbzr gubhtugf sbez zr :)
Jr xabj gur ertvasb fgehpgher gb pbagnva bar cerqrsvarq olgr - mreb, cyhf ynfg 20 olgrf vf n unfu bs gur erfg qngn. Gurer`f ab ceboyrz gb trarengr n inyvq hapelcgrq yvprafr svyr, lrg guvf tvirf hf abguvat fvapr gb rapbqr vg pbeerpgyl jr zhfg cbffrff gur cevixrl.
Ohgr sbepvat sbe 0 nf svefg olgr naq gur ynfg 20 olgrf zngpuvat gur erfg bs cynvagrkg nfu fun1 unfu vfa`g gur jnl, vf vg ? :)
Nal bgure cbffvovyvgrf ? fbzrubj v qba`g frr nal. Oehgrsbepvat whfg gb zngpu gur svefg olgr gb or '0' jbhyqa`g or n ceboyrz, ohg vagebqhprq fun znxrf gur jubyr svyr vzcbegnag. Jvgubhg gur unfu jr pbhyq whfg trg fher gung (yvp^choyvp zbq a)[0] == '0', guvf jbhyq tvir fbzr genfu olgrf nf hfre vasb, ohg jung n uryy, ertvfgrerq zrnaf ertvfgrerq. Lrg guvf vf abg gur pnfr :)
ogj "Vs lbh envfr vg gb gur cbjre bs uvf choyvp xrl zbq a (2048 ovgf = 256 olgrf) vg ybbxf yvxr guvf:" naq fvmrbs (yvprafr) == 1 + 227 + 8 + 20 == 256
Ubj qbrf a ybbx yvxr ? Bapr ntnva: jr xabj gur svefg olgr gb or 0k30 - gur uvturfg olgr bs gur erzvaqre Fb jung ? qrnq raq ntnva.

uru guvf whfg cbcrq gb zl zvaq. vs gur nytb hfrq vf efn gura r fubhyq or < 65536
oehgr sbepvat jbhyqa`g gnxr 10^kk lrnef ...

bx rahs bs oyhaqrevat. gvzr gb fyrrc :)
mike
01-21-2003, 05:53 PM
First, r4ge, the most significant byte (the bignum library is big-endian) is 0x00, not 0x30.
nt20 wrote:
First, since you know the structure of the license file, you don't care about whether it's encrypted or not. You could just modify the privileges bits until you get what you want to work. After you mod those, you simply redo the SHA1 yourself and replace the sha code as well.Seems r4ge has an answer for you:r4ge wrote:
There`s no problem to generate a valid uncrypted license file, yet this gives us nothing since to encode it correctly we must possess the privkey.
More from r4ge:
Bute forcing for 0 as first byte and the last 20 bytes matching the rest of plaintext ash sha1 hash isn`t the way, is it ?Well, it's one way, but it would take 2^168 operations!if the algo used is rsa then e should be < 65536
brute forcing wouldn`t take 10^xx years ...Assume the public exponent is 3. How would you attack it then?

What if the private exponent were smallish instead--say, less than 2^512?

Is there a way to do it if the exponents are chosen at random?

What attacks don't target the crypto, but instead some other aspect of running the code? The only restriction here is that we can't distribute a modified version of the exe...
Kythen
01-21-2003, 07:06 PM
Jryy, urerf zl purrfl nafjre sbe abj. Vg znl abg or vqrny naq
V erfreir gur evtug gb guvax hc n orggre bar, ohg vg vf jung
V jbhyq cebonoyl qb vs V jrer nggnpxvat guvf ncc. Jevgr n yvggyr
ybnqre rkr gung cngpurf gur choyvp xrl vafvqr gur ncc jvgu lbhe
bja choyvp xrl. Gura lbh pna znxr inyvq yvprafr svyrf jvgu
lbhe bja cevingr xrl. Nyy lbh unir gb qb vf qvfgevohgr gur
ybnqre naq yvprafr svyr(f), ab zbqvsvrq rkr. ;)
mike
01-21-2003, 08:11 PM
Kythen-now what if the key was checksummed in the app?
nikolatesla20
01-21-2003, 09:04 PM
Well, then you just patch the checksum check as well :P with the loader.

-nt20
mike
01-22-2003, 02:30 AM
Either that, or patch the privs bits at runtime. I think they call them "trainers" in video games.
nikolatesla20
01-22-2003, 08:23 AM
Just wanted to say mike, I really appreciate these crypto thought posts - it helps to see how to think in alternative methods. (Which I prefer to do most of the time)

Keep up the good work!

:)

-nt20
r4g3
01-22-2003, 11:13 AM
perngr yvprafr svyr gb or 256 0k0.
cbjre (yvp, nalguvat) zbq a = 0k0
svefg olgr = 0k0 ?? lhc
abj fun1 (); ....
cnefvat 235 0k0 nf cnenz, shapgvba rkvgf nf vs ab fgevat jnf fhccyvrq, gurersber unfufgevat = 0k0
fgepzc (yvpunfu, arjunfu) rdhnyf fgepzc ( cge_gb_ahyy_fgevat1, cge_gb_ahyy_fgevat2 )
Fb guvf yvprafr purzr vf fvzcyl n ovg ohttl ;]
Jryy bs pbhefr guvf qrcraqf ba fun1 () vzcyrzragngvba, ohg fubhyq jbex jvgu nyy p cebtenzf (naq gur erfg jvpu hfr 0k0 nf fgevat grezvangbe).
Be vg vfa`g fb ? V qba`g unir n pyhr, ohg znlor fun nytb abeznyl cebqhprf 0k0.. bhgchg sbe 0k0.. vachg

uz, ohg guvf znxrf cevivyrtrf gb or 0k0 gbb ...

.. v pnzr gb guvf orpnhfr bs "Svefg, e4tr, gur zbfg fvtavsvpnag olgr (gur ovtahz yvoenel vf ovt-raqvna) vf 0k00, abg 0k30." Ng svefg v gubhtug "bu jryy. znlor gur nhgbe unf fbzrguvat gb qb jvgu mreb[qnl] .. be vg`f uvf snibhevgr ahzre .. be nalguvat .." ohg nsgre guvf uvag: "jgs ?! jul guvf cnegvphyne inyhr ?" Fb guvf vf gur bayl fbyyhgvba gung pnzr hc gb zl zvaq gb znxr hfr bs 0k0 ...
urur :C
mike
01-22-2003, 01:35 PM
r4ge- another good idea! Check the implementations of the crypto components to make sure they don't do stupid things like hash strings with a null terminator instead of with a length. You can look for errors in the bignum code, too.

Assuming it's implemented OK, you should need to tell it your buffer size. You want a buffer that's 227 bytes of zeros (following your idea), followed by the privs you want, for a total of 235 bytes.

How big a number is the result? Does that help at all?
r4g3
01-22-2003, 02:44 PM
Originally posted by mike
Check the implementations of the crypto components to make sure they don't do stupid things like hash strings with a null terminator instead of with a length. You can look for errors in the bignum code, too.

what/wich/(witch :) implementation ? you mean like Crypto++ ? don`t really get it. nothing mentioned in your initial post. thought this was a 'totaly theoretical' crackme :confused:
mike
01-22-2003, 04:52 PM
No, I just meant that you tried hashing some data and because your hash function was expecting a null-terminated string, it returned without processing the data. If there was a similar bug in the software I'm asking you to think about, you could crack the system that way. This one doesn't have a particular answer; I just want you to think of lots of ways to attack it. The loader was a good one. Checking to see if low-exponent attacks are possible is a good idea (the zeros in the user info fit in here). Note that you can choose part of the stuff being signed yourself. Are there any properties involving multiplication you can come up with? How about stalking the author online--can you break into his computer and get the key? It's illegal, of course. Do you want to take that risk? Et cetera.


problem with rta
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > problem with rta
PDA

View Full Version : problem with rta

himanshu
01-21-2003, 05:53 AM
hi there,
there seems to be some dfferences between opcode generated by rta and that generated by softice and hiew.

dunno...neone else had some problem like this ??
esther
01-21-2003, 06:58 AM
yup there are some errors
eg: mov eax,eax=89c0
RTA: mov eax,eax=8bc0

SQUIDE! would like comments and feedbacks ;)
squidge
01-21-2003, 07:23 AM
There's more than one way to assemble an instruction, so instructions assembled by different programs may differ in the binary they produce.

However, you can be sure that they disassemble back into the exact same instructions, and execute the same. Eg. 89c0 and 8bc0 are identical in the command they perform.

To check, I've just created a small EXE in MASM, and db'd the hex bytes directly into the program. Disassembled by OllyDbg, W32dasm and IDA all produce two lines of the same instruction.
nikolatesla20
01-21-2003, 08:37 AM
From the masm32 opcodes help file:

The MOV instruction.

First instruction:

89 / r MOV r/m16,r16 Move r16 to r/m16

Second instruction:

8B / r MOV r32,r/m32 Move r/m32 to r32

looks like an operand size difference. However, in the case of mov eax,eax - such a thing would not matter, if you think about it. So in that case they are the same.

-nt20
esther
01-21-2003, 11:09 AM
When it comes to opcode programmers with hexeditor its a pain on ass :rolleyes:
squidge
01-21-2003, 04:32 PM
Maybe, but complaints to Intel please as my prog aint faulty :)
esther
01-21-2003, 06:20 PM
DOH! :p
JMI
01-21-2003, 06:57 PM
squidge:

Allow me to correct you, that should read "my program isn't faulty." :D :D

Regards.
squidge
01-22-2003, 07:22 AM
Well, hello Mr. Pedantic :p

;)
JMI
01-22-2003, 10:46 AM
Well that certainly raises the level of discourse. :p And that aint bad. :D

Regards.
esther
01-22-2003, 11:12 AM
Be Pedantic,DOH identic :p
Its not a complain its feedback,check that or get whacked :D :D

Regards
squidge
01-22-2003, 12:31 PM
/me goes to find a large baseball bat... :D


Interlok LM, someone experienced with it ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Interlok LM, someone experienced with it ?
PDA

View Full Version : Interlok LM, someone experienced with it ?

OHPen
01-21-2003, 06:42 AM
Hi,

i have an app which is protected by Interlok-LM. I'm totally new to that kind of protection sheme but i want to learn it.
It's difficult to find Tutorials about Interlok. I searched the Web but only found one fucking tut which is 4 years old.
I need some license file to start to victim-app so i have to find a way to create one or defeat to check-routine !!!!

So i have some questions in order to start with it:

1. Which kind of protection is Interlok LM ? Like FlexLM ?
2. Is there some common way to begin reversing Interlok ?
3. What have i look for, special dll's, sice detection, etc ?
4. Are there tut's for Interlok, URL ?
5. Are there different versions of Interlok LM ? How can i detect which version is used ?
6. Is this protection used together with dongles ?

Hope there is someone who can tell me a bit about Interlok. Really want to learn that stuff.

THX for your help,
OHPen

BTW. The App i try to reverse is called LiveStage Pro !
esther
01-21-2003, 07:13 AM
found 2 one is from Tsehp and the other is macilaci.
Don't you think its a hard start for newbies in this kind of protection?
OHPen
01-21-2003, 07:24 AM
Thx for your short reply ;)

Sorry but i'm sick of serial fishing and patching.
I decided it's time to start new stuff and i choose Interlok.

The two essays on tsehp are worthless, i have a newer version than the described one and i'm using win2k.

It seems that there are not much people who are able to beat Interlok, and that's the point it becomes interessting to me ;)

I only want to collect info about Interlok in order to try to beat it.
Maybe i'm not able to solve, but i have to try, you know.

So is there no one which have experience with new Interlok stuff ?
The threads on the board i've found are not very useful, so don't tell me to search the board for it ;)

I don't know whether is very difficult or whether it takes long time to understand Interlok but i REALLY want to get that bitch.
But i still need help ;)
squidge
01-21-2003, 07:27 AM
See if you download the SDK first, as it'll come in mucho handy.
OHPen
01-21-2003, 07:30 AM
Sorry, don't understand what you mean !
Do you mean the Interlok LM SDK ?
squidge
01-21-2003, 07:39 AM
yesh
OHPen
01-21-2003, 07:43 AM
Only can download the stuff if i have some customer-password, so i'm not able to.

@ Squidge :Have you ever dealt with Interlok ?
squidge
01-21-2003, 07:46 AM
It seems you need to develope your searching skills...
Woodmann
01-21-2003, 04:01 PM
So i have some questions in order to start with it:

1. Which kind of protection is Interlok LM ? Like FlexLM ?
It can be like flex, you can buy different types of protection

2. Is there some common way to begin reversing Interlok ?
Its the same as any other protection

3. What have i look for, special dll's, sice detection, etc ?
It can have anti-debug code

4. Are there tut's for Interlok, URL ?
It seems that Interlok is used mostly for mac/apple programs, this could be the reason why you dont see many tuts.

5. Are there different versions of Interlok LM ? How can i detect which version is used ?
pe-scan maybe

6. Is this protection used together with dongles ?
I doubt it

Peace, Woodmann
JMI
01-21-2003, 06:42 PM
Let me say first that I have kind of lost touch with my Pace reversing and would anticipate that there has been some significant changes in Version 4, but I can give you a great deal of information on "how it used to work" because I used to regularly remove it from my Mac music software over the years. Having said that much, the following should be considered with the following facts in mind: First Mac software used to work completely differently from PC software, in that the Code was in sections which were only loaded "as needed" by the program. In order for the program to know whether a section of code was "already" loaded or not, there was a "jump table" which indicated whether a section was loaded, and if loaded, where in memory it could be found, with the specific location of it's parts. This was true with the MAC software at least to version 8, but the new MAC software is apparently based upon a UNIX kernal and I haven't played with it in some time to see how it is organized.

What the older PACE protection code would attempt to do first is blow up the debugger. Obviously if you can't use the debugger, you aren't going to make much progress at studying the code. You had to find a way to prevent that from happening and one can assume that the current versions attempt the same thing. However on the MAC what they did was mess with something called the Vector table, which was where the MAC handled exceptions. They would reset the vector table to their own code and the MAC debugger would no longer work. Again I don't yet know if this is still used in MAC software and one could assume anti-debugger code on the PC side.

If one was able to keep the debugger going you could discover that the protection scheme wrapped the "real" code in a form of encryption, which was really just a checksum that started with a given value, usually "BEEFABAD" on the "encrypted" code sections. The checksum of the first code section was used on the "next" section until a checksum of all the section had been run. This "final" checksum was the one that was used to actually decript the code sections. What PACE would do was put this information in a specific memory location and then refer to the "decryption code" each time a code section was loaded into memory. If your debugger worked you could eventually find this code and write a program, or use part of theirs to decrypt the whole code sections and write them to disk with the decryption. One of the things they had done was patch the various procedures, equivilant to API's which handled reading and writing code sections and changing their attributes to attempt to prevent this very thing. It didn't work, at least for me, back then.

So what does all this have to do with the current version?? and on the PC?? for which they do at least sell software?? Maybe nothing and maybe a lot. Over all the years I studied and removed their protection system they did not change their basic system or process very often, although they would tweak it somewhat. Therefore, I would look for the following as a good start:

Is the code "encrypted" on the downloaded program or on disk, if you own it? If so, there is a good chance they are still using their old checksum method of "encryption", but I don't know now.

They will clearly have some anti-debugger code, because that is their mind set and, although it is possible that they have changed, they didn't over many years. MAC or PC, this is an effective to deter the faint of heart from further attempts, but it is only a first step.

Finally, reviewing the Interlok system, and I have downloaded their manuals, which are available from their web site, or at least were, they do have a dongle which can be used with the software, but I haven't seen one used and haven't attempted to analize one yet. Most MAC software and most PC music software, where PACE had it's market, still don't use donglels.

Like many other projects, this is one that I would like to return to, so if you have a target in mind, you might PM me and when I finish pushing this large rock up this hill I might be able to take a look at it.

Regards.


Help with PE MSCAN with ARMADILLO
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with PE MSCAN with ARMADILLO
PDA

View Full Version : Help with PE MSCAN with ARMADILLO

digialex
01-22-2003, 01:06 PM
Hello, I am at the very beginning trying to understand how Armadillo has protected an interesting program.
I cracked several other programs with the help of ide, sice or vbasic with smartcheck, but this is the first time with an encrypted pgm.
My first goal is to "discover" my serial code and eventually to completely remove the protection.
I am searching a "way" to start with IAT or other tricks to bypass armadillo security, I read the CRUSADER tutorial but was not useful for me.
If someone wants to help me the pgm can be downloaded at www.ms*an.com *=c (ms*an sstv ), the price itself is cheap but is the first time I found a hard to crack pgm with such a low price and I have to learn a lot from that.
thanks
Woodmann
01-22-2003, 03:57 PM
Howdy,

In what way did the Crusader tutorial not help you ?

Peace, Woodmann
digialex
01-22-2003, 04:48 PM
Hello Woodman, thanks for the attention.
I did exactly the exercise in the crusader essay and all was ok.
Then I passed to my proggy and at the very beginning sice breaks at writeprocessmemory but I cannot see the "usual decrypting routine", maybe my prog is protected by another version of arma?? In the meantime I am trying to trace into the pgm the two registration codes I inputted, I am going into a lot of code but I discovered a few things tha maybe useful for the future (eg: the second code must be x'10' long);please i have another question for you: in wich manner is possible to discover ( with sice ) if I am debugging the server or the client copy of the pgm? is possible to switch with sice from one to the other one?
Woodmann
01-22-2003, 04:59 PM
Howdy,

Thank you for a good response.
I think we need to back up and discover what
version of Arma you are playing with.

Later, Woodmann
Hopcode
01-23-2003, 05:01 AM
Hi!,

Armadillo is using crypto for his serial scheme.
So if this app is using armadillo's registration system.
You better think of unpacking it rather :)

Just my two cents,

Hop.
crUsAdEr
01-23-2003, 07:01 AM
Howdy,

TO see if you are tracing the server or client code... use
proc

in sice... sice will list all running process and put a * on the currently being debugged process... if * is on the first process then it is the server, if on the second process then it is the client...

cheers,
crUsAdER
digialex
01-25-2003, 03:36 AM
Thanks af all for the replyes..... sorry but I cannot update because forum was down.
Thanks Crusader, i made a mistake, I did a BPX on writeprocessmemory without checking the active process.
I am working now with my proggy, trying to unpack for more fun, and I am on
PUSH 0
mov ecx, [ebp+key_address]
push edx
call Decrypt_Encrypt
add esp, 0Ch
Now when you say "Try looping around" or "trace a bit more down" what you mean? I have to trace with F10? F12?
The address ranges are not similar (5E0xxx - 44Exxx) so maybe there is a jump inside the decrypt routine but after a lot of tryes I never jump into the next step of code.
Please can you be more clear from this point forward?
Excuse for the poor knowledge of pe programs, i am a newbe but I am searching to learn more.
Thanks for the help DIGIALEX
digialex
01-30-2003, 02:57 PM
Hello, I come back with some more skill on Armadillo and IAT rebuild.
I passed about 5 days studying some other essay's (+tshep cool mouse, from Karpoff auspex
and PowerGuard) and some other IAT docs. I did several cut and paste from one doc to another
and finally I will be able to correctly dump an app ( now my target is PowerGuard)
, I decoded the routine that does the API redirect and found all the missing API's,
I rebuilt the IAT with Revirgin and all seems fine but........
When I load the application in SICE some areas are missing.
The more important missing area starts at x'400FFF' up to x'403FFF', looking into this
range I can see only ????????, that probably means "memory not allocated or
reserved", thus a KERNEL32 abend occurs.
Looking into the dump with HexWorkshop I found that all the code is present.

The code base addr is 400000 the OEP is at 92858.
Some cut and paste below of code probably clears my situation:
<***************************>
Disassembly of File: power***rd.exe
Code Offset = 00001000, Code Size = 000918DC
Data Offset = 00093000, Data Size = 0000236C

Number of Objects = 0013 (dec), Imagebase = 00400000h

Object01: CODE RVA: 00001000 Offset: 00001000 Size: 000918DC Flags: 60000020
Object02: DATA RVA: 00093000 Offset: 00093000 Size: 0000236C Flags: C0000040
Object03: BSS RVA: 00096000 Offset: 00096000 Size: 00000CA5 Flags: C0000000
Object04: .idata RVA: 00097000 Offset: 00097000 Size: 00002538 Flags: C0000040
Object05: .tls RVA: 0009A000 Offset: 0009A000 Size: 00000010 Flags: C0000000
Object06: .rdata RVA: 0009B000 Offset: 0009B000 Size: 00000018 Flags: 50000040
Object07: .reloc RVA: 0009C000 Offset: 0009C000 Size: 00009298 Flags: 50000040
Object08: .text RVA: 000A6000 Offset: 000A6000 Size: 00010000 Flags: 60000020
Object09: .data RVA: 000B6000 Offset: 000B6000 Size: 00010000 Flags: C0000040
Object10: .reloc1 RVA: 000C6000 Offset: 000C6000 Size: 00010000 Flags: 42000040
Object11: .pdata RVA: 000D6000 Offset: 000D6000 Size: 00090000 Flags: C0000040
Object12: .rsrc RVA: 00166000 Offset: 00166000 Size: 0004C000 Flags: 50000040
Object13: .tsehp RVA: 001B2000 Offset: 001B2000 Size: 000033F8 Flags: E0000020

+++++++++++++++++++ MENU INFORMATION ++++++++++++++++++

There Are No Menu Resources in This Application

+++++++++++++++++ DIALOG INFORMATION ++++++++++++++++++

Number of Dialogs = 1 (decimal)

Name: DLGTEMPLATE, # of Controls=001, Caption:"", ClassName:""
001 - ControlID:045F, Control Class:"STATIC" Control Text:""

+++++++++++++++++++ IMPORTED FUNCTIONS ++++++++++++++++++
Number of Imported Modules = 16 (decimal)

Import Module 001: KERNEL32.dll
Import Module 002: USER32.dll
Import Module 003: ADVAPI32.dll
Import Module 004: OLEAUT32.dll
Import Module 005: KERNEL32.dll
Import Module 006: ADVAPI32.dll
Import Module 007: KERNEL32.dll
Import Module 008: MPR.dll
Import Module 009: VERSION.dll
Import Module 010: GDI32.dll
Import Module 011: USER32.dll
Import Module 012: KERNEL32.dll
Import Module 013: OLEAUT32.dll
Import Module 014: COMCTL32.dll
Import Module 015: SHELL32.dll
Import Module 016: comdlg32.dll

+++++++++++++++++++ IMPORT MODULE DETAILS +++++++++++++++

Import Module 001: KERNEL32.dll

Addr:BFF7B07B hint(00D7) Name: DeleteCriticalSection
Addr:BFF6BB13 hint(0238) Name: LeaveCriticalSection
Addr:BFF6BAEE hint(00E2) Name: EnterCriticalSection
Addr:BFF74606 hint(0217) Name: InitializeCriticalSection
Addr:BFF74520 hint(032B) Name: VirtualFree
Addr:BFF70191 hint(0329) Name: VirtualAlloc
Addr:BFF649A8 hint(0243) Name: LocalFree
Addr:BFF6488C hint(01F3) Name: GlobalAlloc
Addr:BFF66A10 hint(01E1) Name: GetTickCount
Addr:BFF92173 hint(027F) Name: QueryPerformanceCounter
etc.
<************************>

I think something is wrong in the offsets that are slightly different from original file.
Thanks for your support. DIGIALEX
digialex
02-07-2003, 04:06 PM
After a while I definitely unprotected Powerguard.
It was an entry missing in the IAT table, so all the others API's were shifted of +x'C' bytes forward.
Now I am focused on my primary target, mscan;
I let you informed.
Woodmann
02-07-2003, 05:39 PM
:)
digialex
02-14-2003, 01:09 PM
Hello Crusader, pls I need your help to solve the last thing that is annoying me with mscan pgm.
Now I completely dumped, resolved all the IAT imports and fixed ( I hope ) all the INT3.
Now the pgm starts ok and no bugs are present but the registration screen always pop's up at the end of pgm init.
It searches for ARMACCESS.DLL, you know what this module is,
it seems its is linked into the main pgm and the dumping procedure has not removed the call.
Do you think I can remove the call or I MUST search for my registration code??
p.s. I am playing with your pgm trying to modify it because all the jump types are different from yours.
A strange thing happens with jump type 4, the pgm decremet it here:
dec eax
je ShortJump
dec eax
dec eax
dec eax
jne NearJump

mov al, byte ptr JumpOpcodes[edx*4+1]
test al, al
je @end_loop

I am trying to understand these lines, ca you help me?

Thanks
eSn-mIn
03-23-2003, 07:24 PM
I've been working in this int 3 trick and have two questions..

When Armadillo decides if the jump has to be taken, there are two "rare" cases. I've resolved all other cases and there is only missing JLE and JG:

- case 1

.text:004CC616 mov edx, [ebp+Context]
.text:004CC619 mov eax, [edx+0C0h]
.text:004CC61F and eax, 11000000b
.text:004CC624 neg eax
.text:004CC626 sbb eax, eax
.text:004CC628 neg eax
.text:004CC62A jmp loc_4CC6C4

Does exists any conditional jump that jumps only if (ZF \/ SF)?
I've searched it and i don't think so..
It should be: (ZF /\ (SF<>OF)) shouldnt?

- case 2

.text:004CC53C mov ecx, [ebp+Context]
.text:004CC53F mov eax, [ecx+0C0h]
.text:004CC545 and eax, 11000000b
.text:004CC54A neg eax
.text:004CC54C sbb eax, eax
.text:004CC54E inc eax
.text:004CC54F jmp loc_4CC6C4

The same with (¬ZF /\ ¬SF) that should be (¬ZF /\ (SF==OF))

Is it some bug?

The other question, is that armadillo patches the program without checking if it is modifying code or data, so i have this in my tables:

First patch:

Address: 004010C9h
Type: 11h (JB)
Instruction Size: 05h
Distance: 0FFBFEE6Fh

So, Destiny -> 004010C9h + 0FFBFEE6Fh = FFFFFF38 !!!

Is it another bug?


.NET assembly problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > .NET assembly problems
PDA

View Full Version : .NET assembly problems

crassy
01-22-2003, 01:36 PM
Hi all!

I've got an add-in for VS.NET that I'm trying to fix...

The app itself is written in C# and is easily decompileable.
It uses 512-bit RSA for the serial. As I couldn't find any way to
get the private key I patched the target dll with a new public key that I generated.

Now to the problem:
As soon as I change a byte in the dll it fails to load giving me "Strong name validation failed" error. After looking around a bit I found that the problem probably is that .net assemblies can be signed so that they won't be played with. The utility for signing is called sn and is included in VS.NET.

I've found a site that seems to have some info on this but unfortunately it's in some strange language (Jewish?).
The URL is http://www.twoguru.com/playground/cs_tutorial/other/assembly3.htm .

Anyway, I've tried skipping strong name verification (sn -Vr x.dll), generating a new key pair and signing with it (sn -k and sn -R), but came nowhere...

If you want to test this I attach a test dll where i recreated the problem. Just set a reference to it and do Console.WriteLine(TestLib1.Class1.STR);
. It prints "Haj Haj". Now change this message at offset 68Eh in the dll and rerun. Voila!

I'm really in need of ideas here.. IMO we'll see this kind of protections more and more now that .net is on the rise.

Thanks!
crassy
01-22-2003, 02:43 PM
Here is the attachment
disavowed
01-22-2003, 06:53 PM
short solution:
patch StrongNameSignatureVerificationEx from mscoree.dll to always return 1

long solution:
reverse the hashing in StrongNameSignatureVerification from mscorsn.dll
i've attached a little program below (with asm source) so that you can easily step through this function with a debugger
disavowed
01-22-2003, 07:46 PM
the attachment
crassy
01-23-2003, 01:43 AM
Thanks for replying!

Patching the dll doesn't seem to be an elegant way to solve this, so I'm getting to work on reversing the hashing algo asap (if it's reversible that is ;) ). I'll post my findings here when I'm done.
cyberheg
01-23-2003, 02:22 AM
Please read and try this:

http://www.msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx

Here is a PE article which mentions the .NET header, IMAGE_COR20_HEADER structure, (in the section named .NET header) which pointed to by the IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR in the data directory.

If you look at figure 10 you'll see the IMAGE_COR20_HEADER structure it has a bit in the DWORD named Flags which is named STRONGNAMESIGNED. From what I understand if this is disabled then strong name hashes aren't used anymore.

Since I don't have a target myself I'd like you to see if it's possible to modify this and make it work.

I was studying this thing recently since I tried to make a simple "pe packer" for .NET exe's. The problem was then that no matter what I did it kept showing a MessageBox with an error like "_CorExeMain execution failed". Maybe one of you know if it's possible to turn on some debugging or extended error logging to see what goes on when a file loads to get a clue why such errors happen.

// CyberHeg
disavowed
01-23-2003, 10:15 AM
lord pe's pe editor allows you to view this table:

Directories -> COM

however, the only flag in the dll we've been working with is COMIMAGE_FLAGS_ILONLY. STRONGNAMESIGNED is not there :(
(so changing that bit wouldn't help)
zacdac
01-24-2003, 07:00 PM
G'day..

Attached is a patched testlib1 dll to demonstrate that it is possible to patch .net assemblies.

There are several methods that may be used to patch the assemblies, however you have to be aware of several gotchas as well.

Zac
crassy
01-25-2003, 04:31 AM
Hmm... So you flipped a byte at 22Ch from 80h to 00h... Would you please explain why?
disavowed
01-25-2003, 10:10 AM
interesting.. he changed the length of the StrongNameSignature from 80h to 0. i guess if the framework sees that the signature length is 0, it assumes it doesn't exist, and thus doesn't check it. nice work, zacdac
zacdac
01-25-2003, 04:07 PM
Howdy..

@disavowed - correct. I think it maybe a bug with the .Net framework.

Couple of gotcha's..

a) This method will only work with win form applications, not with asp.net applications.
b) Only strong name assemblies may be stored in the GAC, so patched assemblies may not. Note if an assembly is stored in the GAC, it will take precedence over a local copy.
c) The offset of the size of the strong name signature in not constant.

Another method to allow patching of .net assemblies is to modify the strong name attribute. This however changes the assembly manifest information and requires that existing applications be recompiled. This method works for asp.net assemblies.

A third method (in theory) is to replace the public hash stored within the assembly. Note that only the last 80 bytes of the hash are stored. Keep in mind that the purpose of strong named assembly is to allow unique identification via digital signatures and is not an attempt at protection.

@crassy - if you need some help reversing your target, drop me a pm.

Zac
crassy
01-27-2003, 12:02 PM
Thanks for your help everyone. I patched the length of signature in the target and it works perfectly!

Originally posted by zacdac
A third method (in theory) is to replace the public hash stored within the assembly. Note that only the last 80 bytes of the hash are stored. Keep in mind that the purpose of strong named assembly is to allow unique identification via digital signatures and is not an attempt at protection.
Zac

Hmm, now thats interesting... Have you seen any docs on how this hash is calculated?
zacdac
01-27-2003, 03:25 PM
Not really... There are some concept docs on msdn

hxxp://msdn.microsoft.com/msdnmag/issues/01/03/buildapps2/default.aspx

But nothing detailed enough.

Zac
R3v3nG3
08-11-2004, 10:47 AM
Couple of gotcha's..

a) This method will only work with win form applications, not with asp.net applications.

...

Another method to allow patching of .net assemblies is to modify the strong name attribute. This however changes the assembly manifest information and requires that existing applications be recompiled. This method works for asp.net assemblies.

...
Zac

Hi all!
I'm "working" with an asp.net assembly. I tried to resign the assembly with a new keypair but during execution the assembly doesn't pass the validation.
Anyone con help me?
Thanks!
R3v3nG3
omega_red
08-11-2004, 12:11 PM
If the app relies only on .NET framework's strong name checking (it doesn't perform internal checking about existence of its public key), you can just remove the public key from it. See following links for details:

board.anticrack.de/viewtopic.php?p=24882#24882

Disassembling/modifying/reassembling is a very good approach most of the time, only code obfuscation may cause some trouble. Even if the app checks for existence of public key (using Reflection for example), you can just remove/modify this code and recompile ;)
R3v3nG3
08-12-2004, 07:38 AM
It works! :)
Thank you omega-red!
Bye,
R3v3nG3
SiNTAX
08-12-2004, 10:06 AM
If I'm not mistaken, Mono has strong name support.. so you will find the source code of the SN & GAC parts in there... might be useful..

hxxp://www.mono-project.com/about/index.html


insufficient memory free error
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > insufficient memory free error
PDA

View Full Version : insufficient memory free error

rrdjackit
01-22-2003, 05:53 PM
+Orc tutorial projects suggest in his tutorial running the game pooldemo.exe.

Does anyone know how to run this game program? Is anyone doing the tutorial project #1? Is this game a dos or windows program?

I tried running this in dos mode but the os indicated no mouse detected. If I run it in windows mode, the error insufficient
memory free is generated.

Please, does someone know how to configure this game. This game is Arcade pool by East Point software.

I am running under Win98 and a PIII 600 mhz system.

Hope you can help.

thanks.
Woodmann
01-22-2003, 06:35 PM
Howdy,

You nead to research autoexec.bat in the win98 environment.
If you dont have an autoexec.bat file then you need to make one or make a boot floppy that includes the needed drivers.

The problem is win98 doesnt have DOS mouse drivers.

If you need more help: woodmann@woodmann.com

Peace, Woodmann
esther
01-22-2003, 07:58 PM
Hi,
below is a sample of autoexec.bat

@ECHO OFF
PROMPT $p$g
PATH C:\WINDOWS;c:\DOS;C:\UTI;C:\SBPRO;C:\NORTON
SET TEMP=C:\TEMP
C:\MOUSE\MOUSE
rrdjackit
01-22-2003, 11:29 PM
I already have a mouse but still it runs giving a insufficient memory free error.
esther
01-23-2003, 02:23 AM
Hi,
If you have suffient ram.,most probably the file is corrupted.Try download pooldemo again
in http://www.woodmann.net/fravia/zipped/pooldemo.zip
FoolFox
01-23-2003, 03:33 AM
Hello,

This is a problem you may have with mostly all old DOS based
games.

To free needed memory load your dos system and drivers in high memory, this should free enough room for you to run your game.

To do so, you have to modify your config.sys file :

add line :

DOS=HIGH,UMB,AUTO

It will load DOS in the upper memory area

you can also load your device driver in high memory using:

DEVICEHIGH=<your driver name here>

For driver that are loaded throught the AUTOEXEC.BAT, use the
following command :

LOADHIGH=<your driver name here>

Regards
FoolFox
esther
01-23-2003, 04:03 AM
Howdy,
Check my autoexec.bat,config.sys its blank.it still works ;)

regards
FoolFox
01-23-2003, 04:19 AM
Hello,

There are some lucky people out there....

I don't have a 98 at hand right now but I recall having
serious trouble with many dos config under w98 by the
past.... :)

but... if I recall correctly...wasn't there a option when
shutting down 98, something like "Reboot in DOS mode ?",
wich may solve the trouble as well ? :)

Regards
FoolFox
esther
01-23-2003, 04:34 AM
Yeah,
He need to use softice 2.6 for dos or something I can't recalled.
He doesn't need to boot to dos prompt if pooldemo works under windows enviroment ;)

*There are some lucky people out there....
Lucky? Nope I have not win any money ....

Regards ;)
Kayaker
01-23-2003, 09:12 PM
Hi

I can run it on Win98 (P3 600MHz) with no special autoexec/config setup. You might try opening C:\Windows\command.com to open a dos window and play with the properties/memory settings. Mine are all set on AUTO but some particular config may work for you. Shooting the ball straight is a different problem entirely ;)

Kayaker


HASP v4.13 - Bysoft
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HASP v4.13 - Bysoft
PDA

View Full Version : HASP v4.13 - Bysoft

OHPen
01-23-2003, 06:56 PM
Hi,

atm i try to do some stuff with HASP-Protected software called Bysoft.

HASP Driver version: v4.13

Someone have experiences with it ? Can i use the same method to crack it like described on fravia's page or anticrack for older versions ?

THX,

OHPen
squidge
01-23-2003, 08:17 PM
You can do this:

Read the FAQ.
Search the board.

And you'll find your answer. If you require further advice, read the FAQ and follow it.


DVDXcopy 3.1 Removing "Features"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DVDXcopy 3.1 Removing "Features"
PDA

View Full Version : DVDXcopy 3.1 Removing "Features"

cHeCksUm
01-25-2003, 11:30 AM
Hello,
Finally I had some time to practice some cracking and found (or rather bought) an interesting target; DVDXcopy. The program is packed but I cannot for my life figure out what program the author used... not that it mattered a great deal. Anyhow I have come as far as I can with this target until I have read more about PE format and such so that then I maybe can unpack it. This is what I have found so far if someone else is interested in looking at the target.

Well first of all I bought this program to try it out and I must admit it works quite well except for a certain number of annoying "features". First of all the program appends some silly text to the copied DVD... this I do not like. Second it will not let you copy the copy... of course I would NEVER do such a thing ;)... but it annoyed me none the less. And last but not least it has an irritating nag.

So I loaded up my favorite debugger and started working. It was clear from the begining that the exe is packed. This wasn't much of a problem (at first) since I used the live approach to cracking it. Anyhow looking through the code I found all the licensing crap... but not the things I was after. So I traced around in the code and finally, a multitude of program restarts and many breakpoints later, I stumbled/arrived at the code I wanted. Seeing as how I am a newbie, I am not sure about this statement, but the program seems to be "double packed" or it only unpacks certain parts at a time. Could someone elborate on exactly how this target is packed should you or have you worked on it. Anyhow once inside the right code the DVD backup copy crap and annoying text could be quickly removed. Now since all I ahve to learn is memory patching and I'll be set ;)... until then I guess I'll have to use some ready made loader/memory patcher. Actually I think memory patching will be the next thing I look at. Well if anyone needs help with this target feel free to ask and I will help as much as I can. Like I said above if anyone could elaborate on the packing method (or even just the name so I can read up on it) please post here. Thanks.

// cHeCksUm
squidge
01-25-2003, 01:42 PM
Not sure what packer was used on this file, and whatever it was, it's got some kind of anti-dump protection which renders progs like LordPE unusable.

Does not seem to have anti-debug protection however, and so it's quite easy to dump the unpacked program using OllyDbg, fixup the IAT, and then begin working on the unpacked program.

I downloaded the "registered users only update" from there website, so hopefully this is the same version as you have. Just need to write some kind of keygen for it now as I aint :) a registered user...

Edit:

Seems like this is no packer, but a license manager that adds it's 180Kb stub onto the program to be protected. Anti-Dump and Anti-SoftIce, but not Anti-OllyDbg :)

Until a valid registration code is entered, I don't know the original entry point of the actual program, or have the correct import table, but I'm sure it can't be too hard to reverse the algo or patch the LM to find those...
nikolatesla20
01-25-2003, 05:11 PM
I'll be looking at this for a little while just for the enjoyment.

Here's a report from Commview 4.0, which I also just finished :)

After you press the register button.

GET /solo/unlock/getcode.asp?LicenseID=2147483647&CustomerPW=YELLOW&code1=311097607&code2=4620484 HTTP/1.0
HOST: activate.321studio.com

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Sat, 25 Jan 2003 23:08:58 GMT
Connection: Keep-Alive
Content-Length: 478
Content-Type: text/html
Cache-control: private

<html>
<head>
<title>Customer Service | Unlock Key Results</title>
</head>
<script language="JavaScript">
<!--
function setfieldfocus(work)
{

}
//-->
</script>

<body bgcolor="#FFFFFF" onload="setfieldfocus()" link="#663399" alink="#663399" vlink="#663399" text="#000000">
<center><img src="../images/solo/customer_top_01.gif">
<p><h2>Invalid Data Entered!<h2><p><input type=hidden value="Error Response = 100" id=hidden3 name=hidden3></center>
</body>
</html>

hehe. Might be able to just hack this by editing hosts file for name resolution and feed it your own web page. Just thinkin' outside the box like I like to do. Haven't tried it tho.

Also, click "Phone registration" and enter a password - the password must be 7 chars long. 8 chars is "invalid password". (7 is "incorrect password")

-nt20
Js
01-25-2003, 05:16 PM
Hiya,
version I did was sometime in dec 2002 so may have been updated
oeip 00443648.
iat 00[4]48000
Seem to recall bp on dialogparama or one of dialogbox calls where you are asked to enter a code before it will even start, exit's if you select cancel but returns to main code if you just use the close gadget so next time don't enter that call, I'm fairly sure a bp on Getprocaddress was enough to see where the api's are being redirected and easily fixed. I know its a bit sketchy but I didn't make many notes on this one. I got a working dump out of it and could maybe dig out the rv resolved text if it helps though obviously not allowed to post it here.
squidge
01-25-2003, 05:40 PM
yup, been updated since then.

to be honest, not looked at this proggy till cHeCksUm posted about it. Seems that it could be pretty useful after it's had a few features removed :)

Don't know how it worked back in december, but it seems now that when the program loads up, it allocated a piece of memory, which then contains the license manager part of it, and it is this code that calls the original OEP. Only spent about 5 - 10 minutes on it so far, so stopped at the point where it calls the win32 dialog procedure.

Will take a look at the phone and web methods, and see if I can get it to go past the "enter your license" part, then hopefully will have a good OEP and IAT to play with :)

Must say though, I love how it uses SEH to move between the protection dialogs and check your activation codes :)

This is almost a proper license manager, none of that Crypkey crap :)
squidge
01-25-2003, 06:15 PM
Originally posted by nikolatesla20
hehe. Might be able to just hack this by editing hosts file for name resolution and feed it your own web page. Just thinkin' outside the box like I like to do. Haven't tried it tho.

Also, click "Phone registration" and enter a password - the password must be 7 chars long. 8 chars is "invalid password". (7 is "incorrect password")

-nt20

Seems like the password length is variable - If you enter a single "1" for the password without a license ID, you get the "Enter activation code" rather than "Invalid/Incorrect Password". Entering another "1" in both boxes gets you "Invalid activation". So it's seems everything is variable, and a single character is best to bypass most of the checks :)
nikolatesla20
01-25-2003, 06:20 PM
hehe

dang can't concentrate on this right now - did 3 programs last night.

Well whatevah - tried a few eax edits and jump redirects, no where just yet.

-nt20
Iwarez
01-25-2003, 07:23 PM
I passed through the license manager onto the OEP at 450114, could rebuild IAT but I fail to get a correct dump. Maybe someone here can help me on how to get a valid dump?
squidge
01-25-2003, 09:05 PM
Well, I've digged up some information on this program from some foolish debugging strings that were left in the license manager. I suppose they thought it was ok to leave them in considering the code is compressed afterwards - do they think we don't check for this kind of stuff? Anyway...

This program is protected with SoftWareKey's ProtectionPlus system. You can download a demo of there software from there website, and the SDK manual is available for viewing online :) I don't know if the demo is actually the SDK or not as I've not managed to connect to the ftp site as yet :(

The documentation alone however has told me what a number of the functions inside the manager are doing however, which should be handy when it comes to keygen time - and it doesn't seem that difficult ! However, I think the best approach is to strip the program of this LM completely. Then we can start removing the features we don't want from it.

Ok, typical license manager. Replace the checking routine with "MOV EAX, 1; RET" and the program registers itself and never bothers you again with the "please register" nag screen. I thought this was going to be better than Crypkey for a minute then as well, but it turns out worse than some shareware programs :D
nikolatesla20
01-26-2003, 01:07 AM
havent found the place for that mov eax,1 yet but I did find this string whilst memory fishing

nowizdatymeferallgudmenstocumtwodaateofdarekuntry

pretty funny huh

-nt20
squidge
01-26-2003, 06:57 AM
Doesn't make a whole lot of sense, but pretty funny none the less!

The place to put the MOV EAX, 1; RETN is in the SEH handler after the DialogBoxParamA call and the call to pp_tcode. Basically I've looked at the SDK docs, and this function needs to return a valid number in EAX between 1 and 50 to say the activation number and license you entered is valid, and a zero return is invalid. So just make it return 1 in your debugger (no need to modify the exe on disk) and it'll register itself forever. The code doesn't seem to be ever called again after the first run :)

So hopefully today I can easily find the OEP and reconstruct the import table, then patch this muther :)
+SplAj
01-26-2003, 06:59 AM
version 3.1 wtf

u mean 1.31 ? :-

DvdXcopy v1.3.1 *INCL KEYMAKER*þ Cracked by....: tam Release-Name..: CR-DV131.ZIP
Supplied......: CORE
Release-Date..: 01/08/2003

don't waste yer time lads....

Also isn't this DVDx another 'front end' for a load of old beta softs (divx, tmpeg, cdburner aspi from roxio/nero, dvd ripper) to make a DVD rip 'suite' like 'Replicant coded in VB6 !!!!' How can they have the nerve to 'sell' such shiiiiite.... and ppl pay $99 for it !!!!

bwaaaa.

Squidge I am interested in CrapKey6 detail.......

wtf did u do with their *lame* API name scrambler and wtf did u do about *rally lame* Int3 debug/debugee Armadillo clone. :rolleyes:

All done, had a busy weekend .....now /me bored waiting for PElock 1.07....cumon bart wotsit :P
squidge
01-26-2003, 08:13 AM
Originally posted by +SplAj
version 3.1 wtf

u mean 1.31 ? :-

DvdXcopy v1.3.1 *INCL KEYMAKER*þ Cracked by....: tam Release-Name..: CR-DV131.ZIP
Supplied......: CORE
Release-Date..: 01/08/2003

don't waste yer time lads....

+SplAj,

Registering the program seems to be the easy part. I now want to remove the license manager from the code completely, so we can change a few things in the way it operates. I think the version released by Core is just a keygen/hack ?

Also isn't this DVDx another 'front end' for a load of old beta softs (divx, tmpeg, cdburner aspi from roxio/nero, dvd ripper) to make a DVD rip 'suite' like 'Replicant coded in VB6 !!!!' How can they have the nerve to 'sell' such shiiiiite.... and ppl pay $99 for it !!!!

Apparantly this version is "all our own work". Apart from they use Nero and Gear DLLs. No shareware/freeware apps here. Or so they say...

Squidge I am interested in CrapKey6 detail.......

wtf did u do with their *lame* API name scrambler and wtf did u do about *rally lame* Int3 debug/debugee Armadillo clone. :rolleyes:

There name scrambler is just a simple XOR which I wrote a builder prog for descrambling. It finds the two parts of the import table, combines them together and then decrypts the names using simple XOR. The resulting file can then be placed into the program.

There Armadillo clone INT 3 stuff was even easier - when the program is unpacked, there's a load of data before the exe, this contains pointers and lengths to each part of the program - so my prog just grabs all of them and combines them together. Since these are unpacked onto a layer of INT 3 calls, my prog simply overwrites all the INT 3's with the original code. The result is that you don't need the loader anymore :)

After that, it was a simple matter of generating a sig file, and replacing the crypkey functions so the program was authorised without having to reg it.

If you want my name descrambler and/or prog builder, just ask. They are by no means standalone, and you still need to do a fair amount of debugging and the like yourself - I don't think think there are enough programs out there yet to make it all in one.

All done, had a busy weekend .....now /me bored waiting for PElock 1.07....cumon bart wotsit :P

Yup, waiting for a prog with some real protection eh? :)
+SplAj
01-26-2003, 08:28 AM
Squidge

yup, did that, coded a simple app to 'decrypt' the .code section from debug dump (with nice array of pointer buffered with 00 / 01 ) and paste to dumped exe and also xor the api names....I thought about selling it....maybe $999 but maybe your version is cheaper ;)

Yup the core is just a keymaker... did not try it yet .... i'm gonna take the stuff home..

later

Spl/\j

btw (*)(*) free pron at woodmanns .... :p
cHeCksUm
01-26-2003, 08:40 AM
@+SplAj
>Also isn't this DVDx another 'front end' for a load of old beta >softs (divx, tmpeg, cdburner aspi from roxio/nero, dvd ripper) to >make a DVD rip 'suite' like 'Replicant coded in VB6 !!!!' How can >they have the nerve to 'sell' such shiiiiite.... and ppl pay $99 for >it !!!!

No actually they have the author of Ifoedit working on the program now. Before it was seriously bloated at like 24MB but as soon as they hired him they got it down to the size it is now.... makes you wonder what the hell they did in the first place ;). It works rather well except for the annoying "features" I mentioned before... but they are gone now. The program never uses DivX or the like as the DVD is copied not ripped and compressed, hence no loss in quality etc. It keeps it in MPEG2.0. However the price is steep... but hey what can one do.

About the keygen. I saw it too... but didn't really meet my needs as I am licensed... I wouldn't ever looked at the target if it wasn't for the annoying "Cannot copy a copy" crap they have added to the program. You want to know the really funny thing? They argued in their defece (to MPAA) that it could not be used to pirate DVD's becasuse the copies of the original would be encrypted... hahahaha... yeah right... only silly check which is easily bypassed and your homefree to copy the backup... and it's backup and on and on... well you get the point ;).

Back to the target. I have installed the thing on another computer to crack it from virgin condition without registration. I'll post my findings later as I am in a bit of a hurry.

@nikolatesla20

>nowizdatymeferallgudmenstocumtwodaateofdarekuntry

Hehe... that is quite funny.

// cHeCksUm
squidge
01-26-2003, 08:50 AM
cHeCksUm : Well done, if you crack it from virgin PC, then there's no possibility of any watermarking features being placed in the copy. Although I think the only possible "watermarking" they do is perhaps add another file to the disk. Like they say, the video is not de/re-compressed, so can't really be watermarked can it ?

Better be safe though really and use a bogus license key :)

BTW, How did you patch the "You can't copy a copy" ? Did you use in-memory patching via a loader, or actually strip the program of it's license manager first and patch the actually exe file on disk?
nikolatesla20
01-26-2003, 01:06 PM
Well I feel retarted, I managed to get to the "Accept license agreement" dialog, but when I click accept, the main window comes up and then dissappears right away - so I apparently haven't found the right spot yet for the mov eax, 1 :P

Some days I'm on, and other days I can't get anywhere heh. Not in code mode this weekend I guess :)

-nt20
squidge
01-26-2003, 01:23 PM
big hint: to find the correct place to put the mov eax, 1, all you need to do is look for the debug text :)

Actually, you don't even need to overwrite the code, just let the routine run and modify the value of eax after the call, as it seems that part of code is never run again anyway :)
cHeCksUm
01-26-2003, 04:10 PM
Originally posted by squidge
BTW, How did you patch the "You can't copy a copy" ? Did you use in-memory patching via a loader, or actually strip the program of it's license manager first and patch the actually exe file on disk?

Well at the moment I am using a loader. But I will try to strip the program completely as I think I could learn a lot in doing so. Finding the right place for the nag about the "Can't copy a copy" and disabling it wasn't hard. DVDXcopy adds a file to the DVD (the file is in the program directory and can be editing to ones liking). It also adds a "watermark" to this file with program name, version and date as well as a string of characters. Other than that the copy is not watermarked in any way (well that I could find... and trust me I searched for it ;) ). Well I got home late so I don't have any time to work on it today. I'll look more at it tomorrow. Tonight it's back to another target.... legato networker... blah... I've been working on it for like three months (well not constantly but still) and I have got it to accept any activation code (that was really easy) but I still need to figure out how it generates the damn hostid to be able to make it accept keys for any machine. Then I have to do the same for the Solaris version.... hehe at least I have something to do tonight ;).

// cHeCksUm
squidge
01-26-2003, 05:33 PM
Well I backed up a DVD using the program, and notice the extra file it placed on the disk. I was going to hack it in a different way to what you mention however - instead of looking for the "you can't copy a copy" text, I was going to see how difficult it would be to get the program not to write that text file in the first place.

Also, do you know if there is a way of getting to program to write at 1x instead of 2x to dvd media?

Sounds like your diary however is pretty much booked up for the rest of the week to say the least :)
nikolatesla20
01-26-2003, 07:22 PM
I have to say I am only interested in this program to "dump" it and practice another license manager.

to copy DVD's I just use freeware tools :

DVDdecrypter
IFOEdit
ImgTools

And HP RecordNow with a Sony MRU500A DVD Burner.

Works like a charm.

Used DVD+RW Sony media, works in both XBox and PS2 dvd players.

:)

-nt20
squidge
01-27-2003, 12:10 AM
Must say, I'm only really interested in the protection also, but playing with it, it does seem to make doing DVD a little easier instead of using lots of different software, and I'm all for that :)
nikolatesla20
01-27-2003, 02:40 PM
Still, I have trubble with this thing! hehehehehe I feel stoopid

For those interested - I downloaded the demo of the SoftwareKey protection plus and ran a demo project and dumped the key dll file from mem.

Here's pp_tcode() (This is the function that verifies the machine and user codes and entered code - it sends back a number according to the function to enable)

public pp_tcode
seg000:30D33513 pp_tcode proc near ; CODE XREF: seg000:30D247D4p
seg000:30D33513 ; pp_eztrig1ex+19p ...
seg000:30D33513
seg000:30D33513 arg_0 = dword ptr 8
seg000:30D33513 arg_4 = dword ptr 0Ch
seg000:30D33513 arg_8 = dword ptr 10h
seg000:30D33513 arg_C = dword ptr 14h
seg000:30D33513
seg000:30D33513 push ebp
seg000:30D33514 mov ebp, esp
seg000:30D33516 push esi
seg000:30D33517 mov esi, [ebp+arg_C]
seg000:30D3351A add esi, 34h
seg000:30D3351D cmp [ebp+arg_8], 1
seg000:30D33521 jge short loc_30D3352A
seg000:30D33523 mov [ebp+arg_8], 1
seg000:30D3352A
seg000:30D3352A loc_30D3352A: ; CODE XREF: pp_tcode+Ej
seg000:30D3352A mov eax, [ebp+arg_4]
seg000:30D3352D xor edx, edx
seg000:30D3352F mov ecx, eax
seg000:30D33531 push ebx
seg000:30D33532 sar ecx, 0Fh
seg000:30D33535 mov dh, ch
seg000:30D33537 mov ecx, eax
seg000:30D33539 sar ecx, 13h
seg000:30D3353C mov ebx, eax
seg000:30D3353E and ecx, 0Fh
seg000:30D33541 sar ebx, 8
seg000:30D33544 mov dl, al
seg000:30D33546 add ecx, 1FEh
seg000:30D3354C and ebx, 1Fh
seg000:30D3354F imul ecx, 108h
seg000:30D33555 sar eax, 0Dh
seg000:30D33558 imul ebx, 0F3h
seg000:30D3355E and eax, 3Fh
seg000:30D33561 add ecx, ebx
seg000:30D33563 imul eax, 44h
seg000:30D33566 add ecx, eax
seg000:30D33568 lea eax, [edx+esi*2]
seg000:30D3356B mov ebx, esi
seg000:30D3356D push 1
seg000:30D3356F add ebx, eax
seg000:30D33571 pop eax
seg000:30D33572 add ebx, [ebp+arg_8]
seg000:30D33575 lea edx, [edx+ebx*2]
seg000:30D33578 pop ebx
seg000:30D33579 add edx, esi
seg000:30D3357B lea esi, [ecx+ecx]
seg000:30D3357E imul ecx, 1Fh
seg000:30D33581 add ecx, edx
seg000:30D33583
seg000:30D33583 loc_30D33583: ; CODE XREF: pp_tcode+83j
seg000:30D33583 mov edx, ecx
seg000:30D33585 and edx, 7FFFFFFFh
seg000:30D3358B cmp edx, [ebp+arg_0]
seg000:30D3358E jz short loc_30D3359A
seg000:30D33590 inc eax
seg000:30D33591 add ecx, esi
seg000:30D33593 cmp eax, 32h
seg000:30D33596 jle short loc_30D33583
seg000:30D33598 xor eax, eax
seg000:30D3359A
seg000:30D3359A loc_30D3359A: ; CODE XREF: pp_tcode+7Bj
seg000:30D3359A pop esi
seg000:30D3359B pop ebp
seg000:30D3359C retn 10h
seg000:30D3359C pp_tcode endp
seg000:30D3359C

Kinda simple I guess.

-nt20
squidge
01-27-2003, 04:19 PM
yup, so all you have to do is find code that is very similar to that and force it to return 1.

can't describe it in too much detail, otherwise the mods will be on my back for publishing an out-and-out crack :) but trace through the prog until it jumps into the memory it allocates before hand. Set a breakpoint on RaiseException API call, set another breakpoint on the exception handler pointed to in the SEH entry on the stack. Continue the program and pass the exception through to it. You'll now land in the exception handling code. Shortly after the DialogBoxParamA, you see code like the code you posted above. Mod it and your done :)

Can't really explain it much more than that.
squidge
01-27-2003, 04:27 PM
What you post will be like the following (bit easier to follow)

eax = edx;
ecx = edx;
edx = edx & 516096;
eax = eax & 7864320;
edx = edx / 8192;
eax = eax / 524288;
edx = edx + 1980;
edx = edx * 68;
eax = eax * 264;
edx = edx + eax;
eax = ecx;
eax = eax & 7936;
eax = eax / 256;
eax = eax * 243;
esi = edx + eax;
edx = ecx;
edx = edx & 2139095040;
ecx = ecx & 255;
edx = edx / 32768;
eax = 6621511;
edx = edx + ecx;
edx = edx * 3;
eax = eax * 7;
edi = edi * 2;
edi = edi + edx;
edx = esi;
ecx = edi + eax;
edx = edx * 31;
edi = edx + ecx;
ecx = esi * 2;
edx = edi;
edx = edx & 2147483647;

/*
Now we add the loop to get the 3rd value.
*/

for (int i=0; i < 3; i++) {
edi = edi + ecx;
edx = edi;
edx = edx & 2147483647;
}

Author of that was Crackz, although I can't say which program it's for because of obvious reasons...

Originally posted by nikolatesla20
Still, I have trubble with this thing! hehehehehe I feel stoopid

For those interested - I downloaded the demo of the SoftwareKey protection plus and ran a demo project and dumped the key dll file from mem.

Here's pp_tcode() (This is the function that verifies the machine and user codes and entered code - it sends back a number according to the function to enable)

public pp_tcode

<<<snip>>>

Kinda simple I guess.

-nt20
nikolatesla20
01-27-2003, 05:01 PM
Just out of curiosity, are you using OllyDbg?

HAAH I am using Olly now and now I see the debug strings you were talking about ! :)

OK I finally got it. Actually, I had it at home already too, but the main window wouldn't stay up for some reason - notice it won't let you run without a DVD drive anyway.

-nt20
nikolatesla20
01-27-2003, 05:19 PM
Since this is an MFC application,

the first call will be to msvcrt.__set_app_type

but a bpx on that and run it. (remember to load msvcrt.dll with symbol loader)

Scroll up, your OEP is 00443648.

:)

ImpREC recovers almost all the table.

-nt20
nikolatesla20
01-27-2003, 05:49 PM
I'm done.

It's unpacked and running like a baby. Bye bye license manager.

I knew I could unpack it quickly ( unpacking has become my specialty lately, since I do it so much I've gotten fairly good at it) , as long as I could get the program to run, which was what I was having problems with.

Thanks squidge.

Anyone wants a nice unpacked file.......:D j/k.....or am i....

-nt20
squidge
01-27-2003, 06:00 PM
No probs m8, I enjoy helping people that are willing to learn :)

Yeah, I use OllyDbg a lot, I find it very handy for this kind of work. Must say it was kind of silly for SoftwareKey to put that piece of debug text in there, it made it slightly easier.

I've put it aside now for the time being whilst I look at another application that I'm very interested in. The author decided to protect it with ASProtect, hopefully it won't take long to remove the ASProtect and find out how the program works itself. If it works out as good as I think it will, it could mean junking dvdxcopy.
cHeCksUm
01-28-2003, 11:03 AM
@nikolatesla20:

Well done. Cracking it was easy but I am new to unpacking so I am having some troubles. Could you just post a brief description of how you went about doing it. I am not asking for anything specific just the general jist. Appreciate any help. Thanks.

// cHeCksUm
nikolatesla20
01-28-2003, 12:28 PM
OK

First we want to get the program's OEP. But of course first it has to run! So the first task was to get the program to run, which I finally did *durr to me*.

Then we want to get OEP. Notice that the program is MFC program (imports mfc42.dll). All MFC programs start with __set_app_type after the OEP. So we can put a breakpoint on that routine and run the program. After the license manager runs and jumps to the real program, we will land on our breakpoint.

Now we are about 6 lines down from the OEP (by the way, write down the OEP for later use), no major code has taken place. In other words, there haven't been any variables initialized, etc. So we can dump right from here. In SoftICE we can assemble the current instruction so it loops on itself ("a eip <enter> jmp eip <enter>"). Now the program is frozen in an infinite loop. Make sure you write down what the 2 bytes are at EIP's location first, so you can restore them later, after dumping. (do a "db eip" and write down the first two bytes you see).

Exit SoftICE and fire up LordPE and select the DVDXCopy process. When you do so, notice one small "error". DVDXCopy reports its image size as 1000. That's wrong. It's a trick. Right click and select "correct ImageSize". LordPE will fix it. Now do a full dump. Remember that infinite loop you made? You have to go in with a Hex Editor later and restore those bytes you overwrote. (2 bytes)

Now we have to fix 2 things about the dump. Notice it does not have an icon. This is because the last section is incorrect. Open up the dumped.exe in LordPE or PEditor and go to the section editor. The last section shows 00000000 as the RawSize and VirtualSize. This is wrong. Fix it (ImageSize says 7D000, last section's size should be 1A000 for both Raw and Virtual). Hey, your icon is back now :)

Now you get to restore the imports.

How do we know where they are in the program when in memory? Easy. Disasm the dumped.exe you have now. Go to the entry point. Remember, about 6 - 10 lines down is the __set_app_type call. This is an import, so you will see the call dword ptr [xxxxxxxx]. The xxxxxxxx is where the first thunk is, which can never change. Which means in memory the IAT is in this area!

Run the program again and go into SoftICE and go to the IAT area. Scroll up and down both and get the IAT start and what you think the length is. Write it down.

Fire up ImpREC and select the process, type in the OEP, the IAT start, and IAT length and "Get Imports", and then "Autotrace". ImpREC gets almost everything in one pass, just like 14 or so not done yet. YOu can do these manually in SoftICE by going to the memory area the ImpREC says the import is at and "u <import address>" to see what the code says. I found most of them were simple "mov eax, GetDlgItemInt ; push eax, ret". So there you have your import. Depending on how good your guess was at the IAT length, you might end up with junk thunks on the end of the tree. You can cut these off. You'll know if they are junk if they don't reference a higher memory area like the other unresolved calls do.

Leave "add a section" checked and press "Fix Dump" and wallah you are done.

-nt20
Iwarez
01-28-2003, 01:17 PM
Man! Have I learned something! Now it works perfectly, thanks nikolatesla20. I've tried everything to get the dump working, but I failed to notice the last section was incorrectly sized. DUH!!! It works now so I can delete it. Nice practice. :)
cHeCksUm
01-28-2003, 01:56 PM
@nikolatesla20:
Thanks you very much. A thurough explanation. I had got so far as to get the OEP... that wasn't a problem, I simply traced with Ollydbg until it gave an "error message" noted the call I was on and then did that again this time breaking on the call and so forth until I got to the OEP (this is how I cracked the "cannot copy copy crap and the file it places on the DVD). I then read two tutes (+HCU tute and one more on manual unpacking) and managed to dump each section using ollydbg, but they dumped into .mem files (although I changed them to exe) and I wasn't sure how to go about rebuilding them (is that even possible!?). I will read through your comments again and see if I can do the same using other tools (mainly thinking of using Olly instead of softice) that way I at least have to engage my brain a little and not just be spoon fed ;).... Anyhow I REALLY appreciate the help. Thanks.

// cHeCksUm
squidge
01-28-2003, 04:37 PM
To make an exe file with Olly - save each memory block as a .mem file. Combine them together with the dos command copy:

copy /b part1.mem + /b part2.mem + /b part3.mem prog.exe

where prog.exe is the output file and the rest are your inputs.

Now you need to fix PE header (rs=vs, etc) and generate a valid import table.

Overall, it's much easier to pause the program with olly, and then dump it with LordPE. But the olly way is good to learn - as lordpe may not always work.
Iwarez
01-29-2003, 01:02 AM
There is also a plugin for olly called ollydump. Works good.
cHeCksUm
03-27-2003, 03:25 PM
For anyone who found the last version challanging and would like to take the next step 1.5 is out. A little more effort on the authors part (more anti-debugging)yet still allot same same. Good practice anyhow. It almost seems as if they read our posts on this board and then changed the protection scheme... I mean like not prompting for non-backup disk etc. hehe. The authors seem to be spending a little to mcuh time concentrating on the protection when they should be ironing out the bugs... I mean I paid 99USD for a program to backup my DVD's... not for cracking practice on how to remove unwanted features ;). Oh well.. c'set la vie. Time to get fresh with networker 7... wonder if they bothered updating their protection scheme, and then I need to look at cluster server for Solaris, and samfs. and.... and... well I got my weekend all mapped out ;) (no really I do have a life). Later boys and girls... and happy cracking to all.

// cHeCksUm
squidge
03-27-2003, 05:29 PM
Heh, happy cracking cHeCksUm, seems like you got your weekend all sorted out :)

Myself, I'm moving away from cracking and doing more RE work and finding out exactly how things work, and also putting a lot more effort into my own tools for that very job.

Really can't be bothered to do the latest version as I don't like using two disks per film, so I just use a hacked up version of dvd95copy that'll put every film onto a single DVD-R rather than 2 (I've no interest in the extras, see).
cHeCksUm
03-28-2003, 06:07 AM
I think I'll stick to cracking until I am a bit more experianced. Then I might look at RE in a more general sense. I started looking more at programming again though, mainly perl but I am planning on dusting off the old ASM books :). Maybe I'll also look at C again but 99% of my work is on ?nix (and mosly constitute text-filtering of some sort) so Perl really fits the bill and that is my main language of choice.

I really don't care that much about the extras either but I like the one button simplicity of DVDXcopy. Most of all I am just pissed that the programmers are trying to restrict what dvd's I can or cannot copy... that I do not like :(.

Well good luck witht he tools... maybe we'll see, and use, some of them on the net ;).

// cHeCksUm
the_analyst
03-28-2003, 09:16 AM
Hello,

i have an application that is supposed to be protected by
Protection Plus.
I suppose its the same target, but there wasn't any License Manager part in it. Just the wrapper Apparently.
Or its another product from the same company.

Its basically the same than Asprotect, but easier :)
If anyone want to try his hand on it (its NOT the site of the company, some guy host it on his personal web site because he is studying the protection on a forum)
here is the url:

h**p://hiacelee.free.fr/pe/AVTEval30a94setup.exe

Have fun :)


IDA Delphi strings recognition
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > IDA Delphi strings recognition
PDA

View Full Version : IDA Delphi strings recognition

_Servil_
01-25-2003, 02:13 PM
Hello,

I'd like to setup IDA to handle better Delphi strings. The analysis mostly produces similar just chunk of numbers like this

CODE:005E617C dd 0FFFFFFFFh, 1Eh
CODE:005E6184 dword_5E6184 dd 61647055h, 676E6974h, 65687420h, 64656D20h, 68206169h, 66207361h, 656C6961h
CODE:005E6184 ; DATA XREF: sub_5E5DB4+1EBo
CODE:005E6184 dd 2E64h, 0FFFFFFFFh, 0Bh
CODE:005E61AC dword_5E61AC dd 436E7442h, 69746E6Fh, 65756Eh, 0FFFFFFFFh, 10h
CODE:005E61AC ; DATA XREF: sub_5E5DB4+226o
CODE:005E61C0 dword_5E61C0 dd 706F4354h, 73694D79h, 676E6973h, 6D726F46h, 0, 0FFFFFFFFh, 8
CODE:005E61C0 ; DATA XREF: sub_5E5DB4+22Bo
CODE:005E61C0 ; sub_5E5DB4+24Bo
CODE:005E61DC byte_5E61DC db 42h, 74h, 6Eh ; DATA XREF: sub_5E5DB4+246o
CODE:005E61DF unknown_libname_1391 dd 726F6241h, 74h, 0FFFFFF00h
CODE:005E61EB dd 2FFh
CODE:005E61EF align 4
CODE:005E61F0 dword_5E61F0 dd 220Dh, 0FFFFFFFFh, 1
CODE:005E61F0 ; DATA XREF: sub_5E5DB4+28Eo
CODE:005E61FC dword_5E61FC dd 22h ; DATA XREF: sub_5E5DB4+299o

After I undefinde the block and parse strings manually, the disassembly looks better so I can see all strings like text:

CODE:005E617A align 4
CODE:005E617C dd 0FFFFFFFFh
CODE:005E6180 aUpdatingTheMedi dd 30 ; DATA XREF: sub_5E5DB4+1EBo
CODE:005E6180 db 'Updating the media has failed.',0
CODE:005E61A3 align 4
CODE:005E61A4 dd 0FFFFFFFFh
CODE:005E61A8 aBtncontinue dd 11 ; DATA XREF: sub_5E5DB4+226o
CODE:005E61A8 db 'BtnContinue',0
CODE:005E61B8 dd 0FFFFFFFFh
CODE:005E61BC aTcopymissingfor dd 16 ; DATA XREF: sub_5E5DB4+22Bo
CODE:005E61BC ; sub_5E5DB4+24Bo
CODE:005E61BC db 'TCopyMissingForm',0
CODE:005E61D1 db 0 ;
CODE:005E61D2 align 4
CODE:005E61D4 dd 0FFFFFFFFh
CODE:005E61D8 aBtnabort dd 8 ; DATA XREF: sub_5E5DB4+246o
CODE:005E61D8 db 'BtnAbort',0
CODE:005E61E5 align 4
CODE:005E61E8 dd 0FFFFFFFFh
CODE:005E61EC dd 2 ; DATA XREF: sub_5E5DB4+28Eo
CODE:005E61EC db 0Dh,'"',0
CODE:005E61F3 align 4
CODE:005E61F4 dd 0FFFFFFFFh
CODE:005E61F8 dd 1 ; DATA XREF: sub_5E5DB4+299o
CODE:005E61F8 db '"',0
CODE:005E61FE align 4

I select Delphi as the compiler and string types to Delphi. Most strings are even referred in code, thogh IDA doesn't recognize. It looks quite silly -- perhaps ida's bad setting?, Does it always handle D-strings so badly? (MSVC or assembler's strings are handled much better).

tia.


PCGuard
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PCGuard
PDA

View Full Version : PCGuard

Crimson Sunset
01-25-2003, 06:43 PM
I'm working on an unpacker for PC Guard 32 v 4.06
and I wonder if anyone knows of any apps protected with this?

(sorry for asking such a question here, but I created my unpacker with only looking at two protected apps and I just need too be sure
if I was able to do it correctly)

btw: if anyone has any questions on this "protector" I'll be happy to answer them (if I can)
squidge
01-25-2003, 07:48 PM
there was someone asking about it no long ago - search the board and I'm sure you'll find it.

Doesn't seem to be that many PC Guard apps floating around however.
Crimson Sunset
01-26-2003, 11:39 AM
there was a post on THRsim11 not long ago, that was the reason for me to start this project. I have'nt seen any other apps protected with this cryptor (except PCGuard itself), it doesn't seem to be too comon.
That makes it quite hard to find anything protected with it:(
(glad you wasn't pissed off by this post)

btw: what do you think about spesific unpackers?, do you regard them as tools or cracks?
squidge
01-26-2003, 01:15 PM
I'd say they were tools. However, the usefullness of an unpacker tool is not so great as a new version of the cryptor can easily fool the unpacker tool. I suppose it depends how often the cryptor is revised.

Personally, I always prefer a tut on how to unpack it manually than a program that attempts to do it all for you - these can much easily be used on different versions of the packer then. Unless of course it would take you several hours to do it manually.
h8er
01-26-2003, 04:34 PM
Try Cpucool (when i cracked it it was protected with PcGuard so try..)

Bye
Crimson Sunset
01-29-2003, 09:30 AM
Thanks h8er, I'll check it out

squidge: I'll will agree with you there, it saves you alot of time, but should only be used if you're able to unpack it manualy.
(it's also fun to create them):D

If you're interrested in the source I'll be happy to send it to you (don't think I'm allowed to upload it here)
-=QuAkEGaMeR=-
12-19-2004, 04:43 AM
i'd be happy if you'd send me the tool + source via email to quakeg@web.de
Solomon
12-19-2004, 07:27 AM
all eEye products?
dELTA
12-19-2004, 07:28 AM
I'd be happy if you didn't post rule breaking replies to two year old posts...
JMI
12-19-2004, 11:36 AM
dELTA'd also be happy if he gets enough rice pudding. :yay:

Regards,


Need help with FLEXlm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help with FLEXlm
PDA

View Full Version : Need help with FLEXlm

Nebob
01-26-2003, 11:47 AM
Final edit: I figured it all out. Mod can delete this.


How to create one section EXE from a multi section exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to create one section EXE from a multi section exe
PDA

View Full Version : How to create one section EXE from a multi section exe

new_age
01-26-2003, 01:14 PM
Hello!

I've unpacked a neolite2 packed exe with procdump. (I've to make some modifications because original neolite2 script settings generate a non working exe under winxp) I removed the .neolite section.

The unpacked exe has these sections:

->Section Header Table
1. item:
Name: .text
VirtualSize: 0x000D3000
VirtualAddress: 0x00001000
SizeOfRawData: 0x000D2E94
PointerToRawData: 0x00001000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xE00000E0
(CODE, INITIALIZED_DATA, UNINITIALIZED_DATA, EXECUTE, READ, WRITE)

2. item:
Name: .rdata
VirtualSize: 0x00027000
VirtualAddress: 0x000D4000
SizeOfRawData: 0x00026670
PointerToRawData: 0x000D4000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0x40000080
(UNINITIALIZED_DATA, READ)

3. item:
Name: .data
VirtualSize: 0x00014000
VirtualAddress: 0x000FB000
SizeOfRawData: 0x0000D29C
PointerToRawData: 0x000FB000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xC0000040
(INITIALIZED_DATA, READ, WRITE)

4. item:
Name: .rsrc
VirtualSize: 0x00038000
VirtualAddress: 0x0010F000
SizeOfRawData: 0x00037B5C
PointerToRawData: 0x00109000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0x40000040
(INITIALIZED_DATA, READ)

So I've saved to disk these sections and added some zero bytes to the each end to get virtualsize each of them.

I've ripped a delphi 4 compiled exe header and added some zero bytes to the end to get a 1000h file size.

Then I've copied the header and the sections and get a 147000h filesize.

With LordPE PE Editor I've modified the Basic PE Header info and set Import Table and Resources dir. info and created a new section (.FUCKIT :D)

->DOS Header
e_magic: 0x5A4D
e_cblp: 0x0050
e_cp: 0x0002
e_crlc: 0x0000
e_cparhdr: 0x0004
e_minalloc: 0x000F
e_maxalloc: 0xFFFF
e_ss: 0x0000
e_sp: 0x00B8
e_csum: 0x0000
e_ip: 0x0000
e_cs: 0x0000
e_lfarlc: 0x0040
e_ovno: 0x001A
e_res: 0x0000000000000000
e_oemid: 0x0000
e_oeminfo: 0x0000
e_res2: 0x0000000000000000000000000000000000000000
e_lfanew: 0x00000100

->File Header
Machine: 0x014C (I386)
NumberOfSections: 0x0001
TimeDateStamp: 0x3E33C24F (GMT: Sun Jan 26 11:11:11 2003)
PointerToSymbolTable: 0x00000000
NumberOfSymbols: 0x00000000
SizeOfOptionalHeader: 0x00E0
Characteristics: 0x030F
(RELOCS_STRIPPED)
(EXECUTABLE_IMAGE)
(LINE_NUMS_STRIPPED)
(LOCAL_SYMS_STRIPPED)
(32BIT_MACHINE)
(DEBUG_STRIPPED)

->Optional Header
Magic: 0x010B (HDR32_MAGIC)
MajorLinkerVersion: 0x02
MinorLinkerVersion: 0x19 -> 2.25
SizeOfCode: 0x00007400
SizeOfInitializedData: 0x00002600
SizeOfUninitializedData: 0x00000000
AddressOfEntryPoint: 0x000962FE
BaseOfCode: 0x00096000
BaseOfData: 0x00001000
ImageBase: 0x00400000
SectionAlignment: 0x00001000
FileAlignment: 0x00001000
MajorOperatingSystemVersion: 0x0001
MinorOperatingSystemVersion: 0x0000 -> 1.00
MajorImageVersion: 0x0000
MinorImageVersion: 0x0000 -> 0.00
MajorSubsystemVersion: 0x0004
MinorSubsystemVersion: 0x0000 -> 4.00
Win32VersionValue: 0x00000000
SizeOfImage: 0x00146000
SizeOfHeaders: 0x00001000
CheckSum: 0x00155FFF
Subsystem: 0x0002 (WINDOWS_GUI)
DllCharacteristics: 0x0000
SizeOfStackReserve: 0x00100000
SizeOfStackCommit: 0x00004000
SizeOfHeapReserve: 0x00100000
SizeOfHeapCommit: 0x00001000
LoaderFlags: 0x00000000
NumberOfRvaAndSizes: 0x00000010

DataDirectory (16) RVA Size
------------- ---------- ----------
ExportTable 0x00000000 0x00000000
ImportTable 0x000F7D08 0x00000140 (".FUCKIT")
Resource 0x0010F000 0x00003000 (".FUCKIT")
Exception 0x00000000 0x00000000
Security 0x00000000 0x00000000
Relocation 0x00000000 0x00000000
Debug 0x00000000 0x00000000
Copyright 0x00000000 0x00000000
GlobalPtr 0x00000000 0x00000000
TLSTable 0x00000000 0x00000000
LoadConfig 0x00000000 0x00000000
BoundImport 0x00000000 0x00000000
IAT 0x00000000 0x00000000
DelayImport 0x00000000 0x00000000
COM 0x00000000 0x00000000
Reserved 0x00000000 0x00000000

The created exe file doesn't run. What is the problem?

NA

Almost forget the reason: I can't recompress the unpacked exe file. (I've tried a lot of packers/encryptors)
new_age
01-26-2003, 01:36 PM
I've put the resources into another section. (.rsrc) I can run the program but I can not compress. (all compressor fail to compress)

NA
squidge
01-26-2003, 03:10 PM
run a pe checker on it from protools or the like, and it'll most likely give you a dozen errors. prob some kind of pe misalign.
new_age
01-27-2003, 06:20 AM
It seems that section characteristics are important for executable compressors (INITIALIZED_DATA vs UNINITIALIZED_DATA). /It seems logical/ I've modified these settings and created a standard(??) section table:

->Section Header Table
1. item:
Name: .text
VirtualSize: 0x000D3000
VirtualAddress: 0x00001000
SizeOfRawData: 0x000D2E94
PointerToRawData: 0x00001000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xE0000020
(CODE, EXECUTE, READ, WRITE)

2. item:
Name: .rdata
VirtualSize: 0x00027000
VirtualAddress: 0x000D4000
SizeOfRawData: 0x00026670
PointerToRawData: 0x000D4000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xC0000040
(INITIALIZED_DATA, READ, WRITE)

3. item:
Name: .data
VirtualSize: 0x00014000
VirtualAddress: 0x000FB000
SizeOfRawData: 0x0000D29C
PointerToRawData: 0x000FB000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xC0000040
(INITIALIZED_DATA, READ, WRITE)

4. item:
Name: .rsrc
VirtualSize: 0x00038000
VirtualAddress: 0x0010F000
SizeOfRawData: 0x00037B5C
PointerToRawData: 0x00109000
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xC0000040
(INITIALIZED_DATA, READ, WRITE)

Now UPX can compress it (I must specify do not compress resources).

But when I start the compressed exe I get this error:

The instuction at "0x7ffdf000" referenced memory at "0x80000002". The memory could not be "written".

Any idea?

NA
new_age
01-27-2003, 07:27 PM
Interesting:

Only aspack can compress and decompress the exe file. All other compressors fail on compress and/or on decompress.

NA


How to activate (unhide) options???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to activate (unhide) options???
PDA

View Full Version : How to activate (unhide) options???

GEnto
01-26-2003, 05:40 PM
Hi !!

I have patched the nags of a Microsoft Visual C++ 6.0 program but it has hidden options, the software is mp3 trackmaker.

Anybody can give me some idea about how to attack this soft.

Thanks all!!

Sorry I am a newbie and my native is spanish. (bad enghish)

[This is not a crack request, is only a idea of attack request]
naides
01-26-2003, 10:38 PM
If what you are attempting to do is to activate (ungray) ceratain features in menus and buttons, check this out:
http://www.woodmann.net/fravia/Clandestinity_MixVibes.html

there are references to other tuts in there which may give you a starting point.
If that is not what you intend, please be more specific and explicit with what you have done so far and what you want to achieve.
GEnto
01-27-2003, 11:43 AM
Ok thanks for your answer.

I'll try to explain (my english is not so good)

When I open the demo version, I can see one botton named 'grab winamp position' and under this botton i can see "More options are available in the registered version, including splitting all tracks into equal parts, and importing and exporting your tracks to and from .CUE files in order to save time"

When I open the program into w32dasm i can see:
...
009 - ControlID:03ED, Control Class:"BUTTON" Control Text:"Add Time"
010 - ControlID:03FB, Control Class:"BUTTON" Control Text:"Grab Winamp Position"
011 - ControlID:03FC, Control Class:"BUTTON" Control Text:"Import Track Times From .CUE File"
012 - ControlID:03FD, Control Class:"BUTTON" Control Text:"Export Track Times To .CUE File"
013 - ControlID:0404, Control Class:"BUTTON" Control Text:"Track Naming"
014 - ControlID:0402, Control Class:"BUTTON" Control Text:"Remove Time"
015 - ControlID:0403, Control Class:"BUTTON" Control Text:"Clear List"
016 - ControlID:03FF, Control Class:"BUTTON" Control Text:"Create Tracks"
...

Because of that I think that this botton (avaliables in full version ) can be activated in demo version. :confused:

I'll try the link, thank.

Sorry again Im spanish.
ZaiRoN
01-27-2003, 05:30 PM
Hi Gento,
"More options are available in the registered version, including splitting all tracks into equal parts, and importing and exporting your tracks to and from .CUE files in order to save time"Have you tried to spy the program with a resource editor (i.e. resource hacker)? Sometimes, these kinds of messages are placed over the hidden items and a simple manipulation of the resource might solve the problem.

009 - ControlID:03ED, Control Class:"BUTTON" Control Text:"Add Time"
010 - ControlID:03FB, Control Class:"BUTTON" Control Text:"Grab Winamp Position"
011 - ControlID:03FC, Control Class:"BUTTON" Control Text:"Import Track Times From .CUE File"
012 - ControlID:03FD, Control Class:"BUTTON" Control Text:"Export Track Times To .CUE File"
013 - ControlID:0404, Control Class:"BUTTON" Control Text:"Track Naming"
014 - ControlID:0402, Control Class:"BUTTON" Control Text:"Remove Time"
015 - ControlID:0403, Control Class:"BUTTON" Control Text:"Clear List"
016 - ControlID:03FF, Control Class:"BUTTON" Control Text:"Create Tracks"Otherwise you can try to solve the problem in another way: these lines are from Windasm's 'Dialog Reference' so, it's possible for you to find the place where the hidden items are loaded. Load the file using windasm and then click on Refs-Dialog References. Here, you will find all (or only some) the references of the objects in the dialog. Look for one of the hidden references (for example: 'Track Naming') and then double click the item. Windasm will bring you directly on something like '*Possible Reference to ...blablabla..."Track Naming"'. From here, try to understand the lines above and, the reason for which the program does not load this item. Probably, you have to find a simple conditional jump that decides to (not) load the hidden items.

Good luck,
ZaiRoN
GEnto
01-27-2003, 06:26 PM
Ok lots of thanks, nice idea to attack the victim.....

Minutes later.....

..... I've used reshack. Under the message are placed the hidden items. I can see the buttons but if i execute the program I can see the only button i refer in my second post.

Again lots of thanks to both from spain. (tomorrow i'll try with exescope, pexplorer, restor25)
ZaiRoN
01-28-2003, 04:05 AM
Gento, use the second way: windasm approach...

ZaiRoN
Clandestiny
02-27-2003, 08:41 PM
Hiya,

...Had to break this up into 2 posts (darn 10,000 char limit)...

---BEGIN PART 1---

Well I had a look at your target and I can certainly give you some pointers on how to attack this type of target... The bad news is that I believe the code for those hidden functions does not exist in this DEMO version. Feel free to prove me wrong though :p

First off, the easy part is making the hidden features visible. If you go into a resource editor and delete the static text "More options are available in the registered version, including splitting all tracks into equal parts, and importing and exporting your tracks to and from .CUE files in order to save time" you will discover that those hidden items magically appear. Yeah, the static resource was just covering them up. Nevertheless, if you run the app you still won't see the hidden items. Looking at a windows message spy, you can see that those hidden buttons have been assigned window handles and therefore you can conclude that they have been created and rendered invisible at runtime. Realizing that a tabbed view of this sort consists of multiple dialog boxes (1 dialog template for each tab), I located the creation code for each of these dialogs in IDA.

text:00401320 sub_0_401320 proc near ; CODE XREF: .text:004012DCp
.text:00401320
.text:00401320 hWndParent = dword ptr 0Ch
.text:00401320 hWnd = dword ptr 10h
.text:00401320
.text:00401320 push ebx
.text:00401321 push ebp
.text:00401322 mov ebx, ds:GetModuleHandleA
.text:00401328 push esi
.text:00401329 mov esi, [esp+4+hWnd]
.text:0040132D push edi
.text:0040132E mov edi, [esp+8+hWndParent]
.text:00401332 push esi ; dwInitParam
.text:00401333 push offset sub_0_401650 ; lpDialogFunc
.text:00401338 push edi ; hWndParent
.text:00401339 push 6Fh ; lpTemplateName
.text:0040133B push 0 ; lpModuleName
.text:0040133D call ebx ; GetModuleHandleA
.text:0040133F mov ebp, ds:CreateDialogParamA ; Create a modeless dialog box from
.text:0040133F ; a dialog box template resource
.text:00401345 push eax ; hInstance
.text:00401346 call ebp ; CreateDialogParamA ; Create a modeless dialog box from
.text:00401346

From here, you can extract the address of the DlgProc for this dialog. Its almost certain that those hidden buttons are being rendered invisible in the DlgProc when it processes WM_INITDIALOG before drawing the controls on the screen. Sure enough, this proves to be correct. The prog calls ShowWindow for each control by specifying SW_HIDE which renders them non visible on the screen.

SPLIT TAB DIALOG PROCEDURE

.text:00401650 String = byte ptr -0Ch
.text:00401650 hWnd = dword ptr 4
.text:00401650 arg_4 = dword ptr 8
.text:00401650 arg_8 = dword ptr 0Ch
.text:00401650
.text:00401650 sub esp, 0Ch
.text:00401653 push ebx
.text:00401654 push esi
.text:00401655 mov esi, [esp+14h+hWnd]
.text:00401659 push edi
.text:0040165A push 0FFFFFFEBh ; nIndex
.text:0040165C push esi ; hWnd
.text:0040165D call ds:GetWindowLongA
.text:00401663 mov eax, [esp+18h+arg_4]
.text:00401667 sub eax, 110h ;is this the WM_INITDIALOG message?
.text:0040166C jz loc_0_401895 ; disable controls in response to wm_initdialog

CASE uMsg == WM_INITDIALOG

.text:00401895 loc_0_401895: ; CODE XREF: sub_0_401650+1Cj
.text:00401895 mov edi, ds:GetDlgItem
.text:0040189B push 0 ; nCmdShow == SW_HIDE
.text:0040189D push 3F6h ; nIDDlgItem == Split Into Equal Tracks (Button)
.text:004018A2 push esi ; hDlg
.text:004018A3 call edi ; GetDlgItem
.text:004018A5 mov ebx, ds:ShowWindow
.text:004018AB push eax ; hWnd
.text:004018AC call ebx ; ShowWindow
.text:004018AE push 0 ; nCmdShow == SW_HIDE
.text:004018B0 push 3FCh ; nIDDlgItem == Import .CUE file (Button)
.text:004018B5 push esi ; hDlg
.text:004018B6 call edi ; GetDlgItem
.text:004018B8 push eax ; hWnd
.text:004018B9 call ebx ; ShowWindow
.text:004018BB push 0 ; nCmdShow == SW_HIDE
.text:004018BD push 3FDh ; nIDDlgItem == Export .CUE file (Button)
.text:004018C2 push esi ; hDlg
.text:004018C3 call edi ; GetDlgItem
.text:004018C5 push eax ; hWnd
.text:004018C6 call ebx ; ShowWindow
.text:004018C8 push 0 ; lParam
.text:004018CA push 100h ; wParam
.text:004018CF push 0C5h ; Msg
.text:004018D4 push 3E9h ; nIDDlgItem
.text:004018D9 push esi ; hDlg
.text:004018DA call ds:SendDlgItemMessageA
.text:004018E0 push offset aFileTrack ; lpString
.text:004018E5 push 3E9h ; nIDDlgItem
.text:004018EA push esi ; hDlg
.text:004018EB call ds:SetDlgItemTextA
.text:004018F1 pop edi
.text:004018F2 pop esi
.text:004018F3 mov eax, 1
.text:004018F8 pop ebx
.text:004018F9 add esp, 0Ch
.text:004018FC retn 10h

These controls can all be easily made visible by patching in a SW_SHOW (05) for the push nCmdShow parameter for each control. At this point, the controls are visible but they lack functionality. The task now becomes to find out *if* the handler code for each of these buttons exists in the DEMO. In order to determine this, I had a look at the WM_COMMAND message routing code in the dialog procedure. You'll notice that it uses a table to index the different procedures for each button and control.

SPLIT TAB DIALOG PROCEDURE

.text:00401672 dec eax
.text:00401673 push ebp
.text:00401674 jnz loc_0_401889 ; exit DlgProc
.text:0040167A mov ecx, [esp+1Ch+arg_8]
.text:0040167E mov eax, ecx
.text:00401680 and eax, 0FFFFh
.text:00401685 add eax, 0FFFFFC16h
.text:0040168A cmp eax, 1Ah
.text:0040168D ja loc_0_401889 ; exit DlgProc
.text:00401693 xor edx, edx
.text:00401695 mov dl, ds:byte_0_401928[eax]
.text:0040169B jmp ds : off_0_401900[edx*4] ; Look up handler in table

WM_COMMAND HANDLER JUMP TABLE

.text:00401900 off_0_401900 dd offset loc_0_4016B4 ; DATA XREF: sub_0_401650+4Br
.text:00401900 ; Browse
.text:00401904 dd offset loc_0_4016D8 ; Add Time
.text:00401908 dd offset loc_0_40183A ; Track Name
.text:0040190C dd offset loc_0_401722 ; Field Info
.text:00401910 dd offset loc_0_4016C6 ; Destination Folder
.text:00401914 dd offset loc_0_4016A2 ; Grab Winamp Position
.text:00401918 dd offset loc_0_401741 ; Create Tracks
.text:0040191C dd offset loc_0_401753 ; Remove Time
.text:00401920 dd offset loc_0_4017E0 ; Clear List
.text:00401924 dd offset loc_0_401889 ; Import and Export from CUE & split into equal segments (all disabled items)
.text:00401928 byte_0_401928 db 0, 2 dup(9), 1, 9, 2, 3, 9 dup(9), 4, 5, 3 dup(9), 6
.text:00401928 ; DATA XREF: sub_0_401650+45r
.text:00401928 db 2 dup(9), 7, 8, 2, 0Dh dup(90h)

From this you'll note that all 3 of our disabled functions are routed to a "do nothing" handler routine...

DO NOTHING ROUTINE FOR DISABLED FUNCTIONS

.text:00401889 pop ebp
.text:0040188A pop edi
.text:0040188B pop esi
.text:0040188C xor eax, eax
.text:0040188E pop ebx
.text:0040188F add esp, 0Ch
.text:00401892 retn 10h

--END PART 1---
Clandestiny
02-27-2003, 08:45 PM
---BEGIN PART 2---

This does not necessarily mean that the code for the missing functions does not exist, but the fact that there are no additional unused table entries seems a little suspicious to me. Also consider that there is no alternate route of processing the WM_INITDIALOG message (ie. those controls are *always*disabled during the initialization and there is no apparent flag or other check which might prevent them from being hidden). In order to further make a resonable determination of weather this code could exist in the DEMO version, I considered that in order to import / export .cue files, the app would almost certainly have to use the common dialog functions GetOpenFileName and GetSaveFileName. Looking in IDA, there are only 2 instances of GetOpenFileName and 1 instance of GetSaveFileName and these are strictly related to loading the source / destination .mp3 files. As far as I know, these are the only functions that allow a user to easily navigate directories to choose a specific file type from their HD so the fact that the only instances of these functions refer to loading the source / destination files makes it seem highly improbable that the code for these hidden functions is present in the DEMO version. I'm sure this isn't what you wanted to hear, but I thought I'd share my experiences with the thought process involved in working on a functionally disabled target :D. Of course, you could add this functionality in yourself. If you knew the structure of a .cue file, it probably wouldn't be that difficult ;)

---END PART 2---

Regards,
Clandestiny
GEnto
03-02-2003, 03:00 PM
Hello and thanks Clandestiny for your posts.

Il'll try it.

Buttons and something like this is more dificult to me because I've patched some software changing jmp, jnz and jz..... :D

Again thanks from spain.


rebuilding last import
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > rebuilding last import
PDA

View Full Version : rebuilding last import

MeaCulpa
01-27-2003, 04:43 AM
Hi All,

I am trying to rebuild the IT, of a dumped (asprotect 1.08.x) target.
I have done the following:
-dumped a OEP with /dump
-dumpfixed the header sections
-realigned and rebased

The problem is:
In RV, when fixing the imports, there are 2 that does not want to resolve. [BTW, what would cause the right-click / tracer command to be disabled?? ]
So i use the addresses, break into the programs main module, and use eg. 'u 401234' - at that address however i cant find any API calls. There is only a direct call, which i cant seem to get a bpx on....

I also noticed that RV gives an error when trying to save the reconstructed IT to a binary file??

Any help/comments please.
thanks
.mea
crUsAdEr
01-27-2003, 06:06 AM
it has been sometimes since i see a post on aspr again :)... long time havent played with it, what is the lastest version of aspr now :)? the last time i remember it was 1.4 according to our guru SplAj :>... anything new or has Alexey started a new project?

Anyway, Mealcupa, search on the boards for plug-in, explanation on aspr IAT redirection... you dont need bpx on API to find IAT, just "d" and "u" will do :>...

cheers
crUsAdEr
hobferret
01-28-2003, 10:21 AM
Bueno Dia meaculpa

Have you tried invalidating the function and then use trace level 3 (trap flag) sometimes this works:)

Utherwise do what crusader says:
dd the IAT then break on that address the dd gives you, sometimes you can't "see" the CORRECT call you may have to trace into it!!

Buena Noche - - dulce suenos!:cool:

/hobferret
MeaCulpa
02-10-2003, 03:34 AM
@Crusader,
Hi man, hope you are well....i'm not on the channels much lately - work ;(

If my mind serves me correctly : AsPack 2.12 and AsProtect 1.2x

Thanks for the info, but that is exactly my problem. "Just d and u" does not work, i only see a call xxxx instruction, on which i cant sucessfully set a bpx/bpm.

@hobferret,
Esperanza usted es amigo bien?
Yes, i have tried to invalidate it and got no success.

I will try these suggestions. Thank you very much for the help.

Regards,
MeaCulpa
Manko
02-10-2003, 04:06 AM
can you post code?
and maybe even the code it perhaps calls/jumps to?

/Manko
hobferret
02-10-2003, 06:24 AM
MeaCulpa - Trabajando demasiado eh?:o
Soy bien gracias, pero haga lo que Manko dice poste su código o MP yo su IAT.
Cuando usted se acostumbra a él, es bastante fácil.
Permítame saber que cuando usted está enviando el MP, escriba algo en esta tabla!:)
/hobferret


MUST READ for noobee!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MUST READ for noobee!
PDA

View Full Version : MUST READ for noobee!

dion
01-27-2003, 05:22 AM
hiya guys, just found [not so new tho] those *remarkable* and quite neat essay for IT noobee like me ;) i guarantee you wont regret reading this one! of course if you're noobee like me ;p

hxxp://www.searchlore.org/dissdell.htm
hxxp://www.searchlore.org/realicra/hp_slobo.htm

like Fravia+ said:

This essay is indeed an eye opener. High level of reality cracking. That's what reality cracking should be all about. A clear target, real knowledge, cleverly applied, lotta teachings. Print it with your own printer :-) and sip it slowly this evening. You will NOT forget it, nor the many reversing lessons inside it, never.

well, my time was worth spent sipping it slowly ;)
i like the technical part indeed :D
aware that there're many experts too in this board, i really would like to see someone write another one ;-)


Indentifying my FlexLM-Target !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Indentifying my FlexLM-Target !
PDA

View Full Version : Indentifying my FlexLM-Target !

OHPen
01-27-2003, 09:55 AM
Hi,

I have only one problem starting to get busy with FlexLM.
I don't have any Idea how i can figure out which version my app is using.

I disassembled it with IDA and i found a lot of FlexLM-Strings, which indicated to me that i'm surely have a FlexLM-Target.
Now i need to identify the exact version.

I have found no dll found which where used by FlexLM on this target.

But the most interessting question for me is in which file i have to start tracing ?

I know that are quite silly questions but it needed to be answered for me, else it seems that i'm not able to start my work.

Hope there is someone who can help me. And pleaz don't tell to better search, i heard this often enough.

THX,

OHPen
nofurs
01-27-2003, 09:58 AM
Then don't ask this here
OHPen
01-27-2003, 10:33 AM
THX for your wise reply, people like you have been wise.
Sorry that i borred you with my questions.

BTW in between i have found a dll called lmgr326b.dll in which i have a function called lc_init. Loaded it's exports into the symloader and fired up sice bpxed on lc_init.
After i startet my app, i only get a failure message, License-File not found. But Sice doesn't break.
Do my app don't use this dll ? I have found 3 different lmgr326b.dll in different dirs in the main dir of my app. Is it neccessary to know which one my app uses when i have loaded it into symloader ?

What's wrong with it ?
Woodmann
01-27-2003, 02:17 PM
Howdy,

I know people dont like to be told to search but, thats all
software reversing is about, searching.
You search for tools
You search for information/tutorials
You search through strings of data
You search inside the header.

I moved this to the Newbie forum so that you can understand
without getting bashed. This is a true newbie question.

Q: How do I find which version of flex lm I have ?

A: If I told you that it was 7.2 how would that help you ?

I am not trying to make fun of anyone, I just see many who start way over their heads. If you can not understand what nolan and CrackZ have written then you can not do anything with this target.

You need to start with some tutorials that include the basics of the Flex LM system. You can probably find something to get started at Krobars site.

Woodmann
squidge
01-27-2003, 04:39 PM
I must say that there is a LOT of posts regarding flexlm, and the net itself is literally flooded with tutorials about various versions of this flexlm. Searching will be your best friend, and can be much quicker than asking a question here about it, if you know what to search for.

Once a topic has literally been done to death, people start becoming bored with it and so stop answering posts from people asking the same questions that were answered several months ago, although in a slightly different context.

BTW, Loading the exports of the license manager into Softice is pretty pointless unless you know exactly what license manager the program is loading - did you search the exports of the programs in the main directory of the app and see which reference (either directly in the IAT, or by LoadLibrary) the license manager dlls? That's of course assuming that they are not statically linked to the exe, in which case the SDK will give you .lib file containing the code to search for in the exe (hint: ida & sig).


Anybody have experience on cracking dotNET applications
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Anybody have experience on cracking dotNET applications
PDA

View Full Version : Anybody have experience on cracking dotNET applications

dee
01-27-2003, 11:56 AM
Hi
i have some dll's whitch are using .NET Framework
the only tool to view data hiden in meta is y0das Metapuck
have anybody experience in cracking something like this...
thanx
disavowed
01-27-2003, 04:04 PM
zacdac seems to know his stuff (http://www.woodmann.net/forum/showthread.php?threadid=4389); maybe you could try private messaging him. or, even better, post your actual question(s) here
zacdac
01-28-2003, 01:54 PM
The only tool you really need is ildasm which is part of the framework SDK. It usually resides here

\Program Files\Microsoft Visual Studio .NET\FrameworkSDK\Bin\ildasm.exe

There is a hidden command line switch of /ADV that makes extra menu items available in the dissassembler .

You do need to know the general concepts of how the .net framework is put together.. and the concepts of how IL (ms intermediate language) works.

Zac

@disavowed - ;)


Sentinel Super Pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Sentinel Super Pro
PDA

View Full Version : Sentinel Super Pro

bloke
01-27-2003, 07:02 PM
Hi there. I am working on a scheme to bypass the sentinel protection on an older bit of development software (16-bit) I use at both uni and home. Obviously if anybody else needs the dongle I can't work on my stuff so I want rid and they don't like me borrowing the dongle overnight (I like to work to the early hours and rise late in the day!!). I got the suggested software (WDASM and SoftICE) and read through Crackz tutorials and set to work. I have limited asm knowledge but I'm trying to improve that with the linked tutorals. I couldn't find the 7242 string any of the dll's so I set the old bpio 378 and waited. It broke in one of the main dll's several times but seemed to loop the same few addresses for most of them. I also found the DeviceIoControl string in one of the dll's and flaged that but that seemed to break just at desktop (maybe win98 testing port or something). So I gave up on that avenue. Now I'm at a juncture and could do with some advice. I thought getting IDA and applying the sig files to it may help (if that works for 16-bit files) if not I'm a bit stuck. When I load the file with symbol loader I get the message 'error no debug information available' and WDASM is a bit touchy if I try and adjust a bit of the code. Could you give me a few hints on how to continue.

yours sincerely

Bloke

Hi I have reposted this in this forum because I acidentally posted it in the packers and unpackers forum. Since I wrote this I obtained a copy of IDA and ran the Sentinel Sig Files on the program but it didn't pick up any signiture functions. The program I am looking at is T*st-point with the program being available at the website of the same address (the upgrade is the full program). The offending dll is tpmain.dll but any further advice about avenues to investigate would be appreciated. Apparently it can be used with a cryptkey too but I know less about that than dongles :) ! Would this be an easier way to go?:confused:

Thanks again

Bloke
Woodmann
01-27-2003, 08:14 PM
Howdy,

Shame on you for posting the same topic again.

http://www.woodmann.net/forum/search.php?action=showresults&searchid=41538&sortby=lastpost&sortorder=descending

Please refer to your last thread about this topic
for more information.

Peace, Woodmann
bloke
01-28-2003, 10:14 AM
Yeah thanks Woodman,
I know I posted this previously on the other forum but as it was the wrong one I was hoping for a few more responses from people who would be more at my level (ie Newbies!). I did also ask a few additional questions on the end and honestly didn't want to waste anybodies time. If you could sugest some further means of isolating the offending code it would be appreciated.

Yours sincerely

Bloke


WKT VB Debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WKT VB Debugger
PDA

View Full Version : WKT VB Debugger

whoda
01-28-2003, 12:32 AM
I have tried to load a few exeutables with this app and I keep getting these errors.

Can NOT locate the VB DLL inside this compute

and

Can NOT find a ENGINE section for the DLL.

I'm running winxp pro. any help as to why I'm getting these errors?
wbe
01-28-2003, 02:08 AM
Close all other VB apps.

wbe
whoda
01-28-2003, 02:35 AM
tried that didn't work
rebooted and shut down everything still didn't work
nofurs
01-28-2003, 06:27 AM
WKT Visual Basic Debugger only debug's p-code vb programs.It might not work on native vb
whoda
01-28-2003, 12:43 PM
I'm actually going through a tutorial that uses this for the crackme I'm trying to crack
zacdac
01-28-2003, 01:41 PM
You can get that error if another app/process is trying to debug/access the target application or if the pcode debugger is already running (it may have not terminated the process correctly).

Also make sure the support dlls (the WKT dlls) are in the correct directory. Check the help text for what they are..

Hope that helps.

Zac
whoda
01-28-2003, 10:16 PM
I don't think it's anything debugging the target application or anything like this, because like I wrote earlier I have rebooted and hit clt-at delete and tried to shut download everything expect a few things.
as far as the dll files, the help menu only talks about two help files that are supposed to be in the windows directory. Both of these dll files are there.
zacdac
01-28-2003, 11:08 PM
Sorry I forgot to mention something. The error you mention will occur if any other program are accessing/using the vbruntime files. So you may have something that is running at startup etc that is a vb authored app. Close it done and it should fix the problem.

BTW, Only the bdasmdll.dll needs to be in the windows system directory, but it doesn't matter if the other one is in there or not.

Zac
esther
01-29-2003, 10:30 AM
You need to put WKTVBDE.dll,bdasmdll.dll in your system directory.

Btw what operating system are you using
sarge
01-29-2003, 12:03 PM
I had a similar problem under Win98. I have this text file as a note to myself:

WARNING!
This file will overwrite "imagehlp.dll" in the SYSTEM directory with
a different version. This version will not work under WIN98. Before
installing, make a copy of the original "imagehlp.dll", then overwrite
the new file with the copy of the original.

Maybe this will help.

Sarge
whoda
01-30-2003, 12:52 AM
thanks for the help
I did a search for both files and I have the first dll file, but when I do a search I do not have this dll file wktvbde.dll but I noticed it's in the C:\Program Files\WKTVBDE directory which if the program is calling it it should look there. But I copied and paste this file in the windows directory anyway and still getting the same error.

Durring installation I do get an error when installing. It says
Error file opening for writing imagehlp.dll. I click ignore and continue with installation. The problem is still there.

My first post indicated that I was running windows xp pro. Is anybody else using winxp pro and this utility?

I sent a friend the setup and 2 crackmes that instruction tell to open it with wkt vb debugger. My friend gets the exact same error I do
sarge
01-30-2003, 12:07 PM
Yeh, that image.hlp error thing is exactly what I got originally, too.
I just checked my install, WKTVBDE.dll is in the WKTVBDE directory, along with LOADER.exe. IMAGEHLP.DLL is in the WINDOWS/SYSTEM directory.

It didn't work for me when the copy of IMAGEHLP.DLL that comes with the program was kept in the WKTVBDE directory also, while the original IMAGEHLP.DLL was in the WINDOWS/SYSTEM directory. This (as was mentioned), should have kept them separate , but... it didn't work.

On my first install, the included IMAGE.HLP overwrote the original Windows file and crashed my system. After numerous re-starts, I followed a work-around procedure : Re-install the original Windows IMAGE.HLP file into the SYSTEM directory (from a backup or CABS), make a backup copy of it, install WKTVBDE, let it overwrite the original file, then erase the just loaded file and rename the backup copy.

As for the occurance of the error, it exists of course since IMAGEHLP.DLL is in use by Windows. I don't remember specifically how I got around it, but I am sure that that is your problem. I even sent an Email to the authors about this, but I don't know if they followed up.

Good luck.

Sarge


Really my first steps ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Really my first steps ?
PDA

View Full Version : Really my first steps ?

OHPen
01-28-2003, 05:42 AM
@Woodmann

You are right i have to read more and i done it ;)
Read about 12 Essay's(Pilgrim, Dan, NB, Macilaci, ACME, Amante and so on). In most of them is written read other Essay before so i concentrated on them in which it was not written. There are parts i don't understand and parts i do.

Okay, know i know whether i have a FlexLM-Target or not.
LM can be linked statically in the Target's EXE or dynamc from DLL.

With the LM tool, i can look which version i have in front of me.

But i have still problems.
I have a target where my lm is statically linked and i was told to break on lm_init, lm_..... and so on, before i loaded the exports in SymbLoader.
I can set the BPX no prob, but sice doesn't break. I don't know why.

Ansoft is another problem, try to replic the way it's described in the tut but it won't work. Is the Version of Ansoft's Serenade 8.5 different from the one used in the past `?

Finally i was not able to get any keys or seeds.( For Example: The es points to a addr in code (432342...., something like this)
but there is no address like that. I use the same prog Ansoft Serenade v8.5.

Is it my fault ?

I'm using Win2k, and sure the mem addresses are different, but the file addresses should be the same, or !?

Another question:

Is it possible that my app deliveres the lmgr*.dll, but it doesn't use it, so it uses a stically linked one. In order to fool us ?

Hope someone have some answers for me ;)

@Woodman I'm an learning by doing guy, no matter. So i have to learn by making mistakes AND by reading essays about it. Hope you can accept this.

There is one thing i want to say, i really interessted in lerning this stuff and i will spend a big amount of my freetime to learn it.
It will be great if you guys can support me with it.

thx

OHPen
squidge
01-28-2003, 10:28 AM
If it's statically linked, then you can't BPX on lm_init. You need to find the appropriate address in the file and set the breakpoint there.

To find the address, apply a sig to the exe file in IDA.

You can detect difference between static and dynamic by setting breakpoint on DLL load, just using the sig file in IDA to start with.
Woodmann
01-28-2003, 04:44 PM
Howdy,

You helped yourself :)

You answered some of your own questions, this is good.
If you are willing to put in the time then you will never be without
any ideas about how softs work.

Example: Serenade 8.5.
I dont know anything about this soft but, there is a very good chance that a newer version is different from an older one.
This is how they keep one step ahead of the crack makers.

Later, Woodmann


Efnet servers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Efnet servers
PDA

View Full Version : Efnet servers

disavowed
01-28-2003, 08:25 AM
anyone know of any efnet servers that don't check for open proxy ports upon connect?


ARMPA and AIPH2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ARMPA and AIPH2
PDA

View Full Version : ARMPA and AIPH2

GlObAl
01-28-2003, 03:48 PM
Hello everyone,

after updating my 2 small patchers last time on my birthday i get more and more bussy, this is why i make them public. :~)

maybe they usefull maybe not...

PATCH THE WORLD :~)


New Tool: TraceDump SoftIce Backtrace Disassembler v2.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New Tool: TraceDump SoftIce Backtrace Disassembler v2.0
PDA

View Full Version : New Tool: TraceDump SoftIce Backtrace Disassembler v2.0

Kayaker
01-28-2003, 04:41 PM
Hi All

I've decided to publicly release the Softice Backtrace Disassembler project I've been playing with for close to 2 years. With the help of Clandestiny it has turned into a very useful personal reversing tool we want to share with the general programming and reversing community at large.

Nicknamed TraceDump, this is a Win9x tool made to work in conjunction with the BACKTRACE feature of any SoftIce version 4.05 or earlier (Driver Studio support might be possible if there is enough interest). It allows convenient viewing and saving of the recorded backtrace addresses as disassembled text. Presently there is no way to do this other than looking at the backtrace in Softice and perhaps doing multiple screendumps.

Backtraces of a target program can be produced, either before or after fully loading, and in either a running or suspended state be immediately disassembled into a listview for analysis. The ability to produce a backtrace of a section of code and then suspend the process in SoftIce (with the usual 'jmp eip' technique) and disassemble it is extremely useful for analyzing programs that overwrite code or use anti-tracing techniques.

TraceDump can be used as a replacement loader for the default SoftIce Symbol Loader, accessible from a right-click Explorer shell context menu, allowing you to break at WinMain to begin general tracing or setting up of a Backtrace for later disassembly.

Multiple instances of a memory-context Disassembler, which can be run independantly, can be opened with the Backtrace results to further disassemble selected code, trace calls or jumps, including Redirected API addresses, or analyze any valid system memory.

Imports and packer redirected API calls executed during the Backtrace can be listed and saved, serving as a simple API Monitor. Standard PE Header and Import information is also available.

A very useful feature is the ability to break into SoftIce at any time after the program is loaded, in the same memory context as the target program. Since TraceDump is loaded as an injected dll and shares the same memory space, the target program will be accessed in the correct memory context for any Softice related analysis.

With the right Backtrace you can now leisurely examine all the code flow during a programs execution, including Self Modifying Code (SMC), and unpacking code which accesses high memory regions outside of the normal program range. Since the SoftIce Backtrace records the exact sequence of instruction addresses executed, the disassembled code is virtually free of all SMC obfuscation. The ability to generate fully deobfuscated code in a text format is possibly one of the most unique and useful features of TraceDump.

The help file is complete and contains backtracing examples and hints for making the most of the utility. If you no longer have Win9x installed but might want to reconsider using the powerful feature of the Softice backtrace again, the pictures and text will help you decide. There is essentially no limit to the size of the backtrace or saved disassembled text that can be produced, beyond RAM and the specific target program considerations.

On a personal note: Why version 2.0? I released version 1.0 ages ago, a very basic prototype luckily long dead and buried in which you had to search for and dump your own backtrace buffer from memory before disassembling it. I was fortunate that Clandestiny came along and said "Hey, why don't you code a vxd that will auto dump the buffer?" So we got our hands dirty with Softice code and Clandestiny coded the dumper vxd with radical notions like runtime patching interrupts into winice code and hooking them so we could track the buffer pointers to always accurately dump the correct backtrace. We played with the idea of realtime disassembly of the backtrace line by line as it was recorded, but this proved very problematic and as it turns out being able to suspend the process and dump the trace at any time is just as effective.

A lot was learned while coding this and I think we both crashed our systems enough times that all the bugs are worked out or error handled, but if not, all the usual disclaimers apply and all feedback is appreciated. Hope you find it useful ;)

Cheers,
Kayaker
and
Clandestiny
dion
01-29-2003, 04:58 AM
hi Kayaker, finally you decide to release that *unparalled* tool ;)

hey guys, for you that dont have it before, what are you waiting for, grab it right now :D
LOUZEW
01-29-2003, 12:21 PM
Hi, Kayaker
For sure you'll find enough interest to developt a DS ver, i don't know if i'm the first one, but i think other members will be interested !
Nice work !


UniToBSCPath problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > UniToBSCPath problem
PDA

View Full Version : UniToBSCPath problem

philip
01-28-2003, 05:43 PM
I'm having a problem calling UniToBSCPath in my Vxd. I'm hooking a file operation. Looking at the ioreq structure to see what file is trying to be written to. But I keep on getting a crash in the Vxd call UniToBCSPath.

But one of the values I'm passing to the UniToBCSPath (ptr to unicode path name) is all wrong. I've traced in Softice:

mov eax, dword ptr [ebp+28d]
mov eax, dword ptr [eax+12d]
add eax,4

should give me ptr to Unicode name right? It gives me something like 0FFFFFBBFh, which it then proceeds to crash on.

What is wrong? Any help much appreciated, as it's driving me nuts. This is the hook (set in place by a previous InstallFileSystemApiHook)

hook:
push ebp
mov ebp,esp
sub esp,60h ;plenty of room
....
cmp busy,1
je exit_hook
cmp dword ptr [ebp+0Ch], IFSFN_WRITE
je WRITE_OPERATION
....
....
WRITE_OPERATION:
mov busy,1
mov esi,OFFSET32 filename
push 0
push 260d
mov eax, dword ptr [ebp+28d]
mov eax, dword ptr [eax+12d]
add eax, 4 ;
push eax ; push unicode filename --PROBLEM!!!!
push esi ; destination buffer

int 20h
dw UniToBCSPath
dw IFSMgr

:confused: :confused: :confused:
philip
01-29-2003, 09:44 AM
Well I've managed to partially answer my own question. The above code works fine with IFSFN_OPEN instead of ISFN_WRITE. So I guess for a write operation there is no path given. Hence the error. Unfortunately I've got very little documentation on IFSMgr.

Any info by anyone on the ioreq structure etc would be appreciated. Thanks
ZaiRoN
01-29-2003, 10:41 AM
Hi philip,
Any info by anyone on the ioreq structure etc would be appreciated.Look at this tutorial (written by Lord Julus); it contains some informations about ioreq and ifsmgr:
http://www.cwizardx.com/vdat/turingrs.htm

Here, you will find many useful links posted by Kayaker::
http://www.woodmann.net/forum/showthread.php?threadid=3238

ZaiRoN
philip
02-08-2003, 07:43 AM
Thanks for the links, very interesting.

1)Does anybody have ifs.h btw?

2) On the off chance anyone can help on this. One way I've seen to get the path (from IFSFN_WRITE), requires the address
of enum procedure. (Which you obtain from a IFSFN_OPEN)

The code snippet I've seen for this is:
;enumFunc = ifsr.ifs_hndl->hf_misc->hm_func[HM_ENUMHANDLE];

.if pEnumFunc==0 ;if already got it then skip
mov esi,ifs_hndl ; esi ptr on hndlfunc struct
add esi,8h ; esi ptr on ptr to hf_misc
mov esi,dword ptr [esi] ; esi ptr on hf_misc
add esi,4 ; esi ptr on hm_func
add esi,7*4 ; HM_ENUMHANDLE = 7
mov esi,dword ptr [esi] ; esi = pEnumProc!!
mov pEnumfunc,esi

I actually understand the above code after repeatedly wading through MSDN. However....

ifsr.ifs_hndl is puzzling me.

I believe it can be obtained from ifs_pfh. I've not got a lot of documentation here, but I believe this field - ifs_pfh (in the ifsreq structure) is dword ptr [eax+74h], where eax is a ptr to the ioreq structure. Anyone know if this is correct? Trouble is using this value gives me a zero value for hf_misc. So something is wrong.

Any info on ifsreq structure would be appreciated.


Looking for Disk Analyser
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Looking for Disk Analyser
PDA

View Full Version : Looking for Disk Analyser

peterg70
01-29-2003, 07:46 PM
Been looking for a good disk analyser.

That is 1.44MB disk track and sector analyser to determine where some protected track is.

I believe the disk to be using Everlock and Yes I know I can copy the disk but I want to add the option to my little proggie to create the disk from scratch and then create the license file for it.
Therefore need some sort of disk analyser/viewer

What i want to do is also log what track/sector the software reads as it operates. Any thoughts on a spy program.

Software is windows based but they use the disk for license control.

peterg70
Woodmann
01-29-2003, 08:33 PM
Howdy,

I just recently saw such utilities but I can not remember where.

Try this place : http://sac-ftp.gratex.sk/utildisk13.html

Peace, Woodmann
disavowed
01-29-2003, 10:03 PM
Originally posted by Woodmann
Try this place : http://sac-ftp.gratex.sk/utildisk13.html
damn it, i was just looking for something exactly like this a few weeks ago!:
282. fakedisk.zip Fakedisk v0.99beta - Disk image file emulator

oh well.. don't need it anymore. nice to know it does exist, though

good site, woodmann
squidge
01-30-2003, 03:03 AM
Try this:

http://www.sysinternals.com/ntw2k/freeware/diskmon.shtml

Assuming your using XP, 2K or NT of course...
peterg70
02-16-2003, 09:41 PM
Hmm

Still no luck with a good disk analyser yet.

Diskmon only works for Fixed Devices (harddisks) not floppy

there must be something that can scan a disk and check the format (track/sector sizes) against the standard and show any conflicts with the disk.

Peterg70
_Servil_
02-17-2003, 12:08 PM
Blind shot,

Runtimes DiskExplorer for FAT (unless ur FDD is NtFS formated)

Though bit OT, when talking about floppy format, I'm searching too - a DMF driver working under Win2k/XP ?
mueller5321
02-18-2003, 12:41 PM
Try a look for the very old freewaretool anadisk2.06.
You can find it all over the net via google.
It is really good but it run only in dos-mode.
It has also a very "nice" copy mode.

Regards Max
peterg70
02-19-2003, 04:22 AM
@mueller5321

Thanks for that looks like what I need.
May need to run it under windows 98 though

peterg70


New interesting Kris Kaspersky books...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > New interesting Kris Kaspersky books...
PDA

View Full Version : New interesting Kris Kaspersky books...

gadget
01-30-2003, 07:19 AM
I didnt know if this should go in off-topic or newbies?
I know I may not be the first to point these out, but 'soon' to be published:-

<http://www.alistpublishing.com/books.htm>

Hacker Disassembling Uncovered
AUTHOR Kris Kaspersky
ISBN 1-931769-22-2
PRICE $39.95
PUB DATE April 2003
PAGES 600pp
SOFTCOVER 7.375 x 9.25

Code Optimization: Effective Memory Usage
AUTHOR Kris Kaspersky
ISBN 1-931769-24-9
PRICE $44.95
PUB DATE August 2003
PAGES 400pp
SOFTCOVER 7.375 x 9.25

If you liked his IDA pro vol.1 book (in russian) these should be good,
At last Kaspersky books in English!!
(contents pages on web site)

Gadget
flotsam@newsguy.com
comrade
02-08-2003, 12:09 PM
Who is Kris Kaspersky?
nofurs
02-08-2003, 12:21 PM
He is just the author mention don't you understand what is he talking about?


Welcome Back........
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Welcome Back........
PDA

View Full Version : Welcome Back........

Woodmann
02-06-2003, 07:47 PM
Welcome back my little crackers.............

:)
:D

Peace,

Woodmann
OBC
Uncle Cracker
ryan
02-06-2003, 08:02 PM
phew...
I thought you are closed for good.

:eek:

Ryan
Czerno
02-07-2003, 03:20 AM
Glad to see you're not another war casualties !

Is the woodman.com URL definitely down/done ?

So long

--
Cz.
esther
02-07-2003, 08:27 AM
Muhaha,

Its fun to "search" ;D
dELTA
02-08-2003, 06:29 AM
I just searched like a crazy man for info about this but found nothing, so can someone maybe post a thread URL or give some more info?
LiSa
02-09-2003, 04:56 AM
was frightened by the board closedown ( the definely best knowledge site must not desappear...) but find quickly the reloaction..

Wonderful administrator and anonymizer you are


Networking project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Networking project
PDA

View Full Version : Networking project

disavowed
02-07-2003, 08:15 AM
I have to do a networking programming project for a class of mine, and I'm looking for suggestions. If I decide to use your idea, I can almost guarantee you'll get the program and source code when I'm done.

The plan is to do something that hasn't been done before. To give an example, I was originally thinking of a session hijacker for high-level protocols (for example, hijacking an AIM connection/conversation, etc.). However, that's not suitable for an academic project (too malicious).

I would probably be able to choose the language, in which case it would probably be C++

Keep in mind that this can be something from scratch or an add-on (like a substantial new toolbar for IE, etc.)
FoolFox
02-07-2003, 10:17 AM
Hello,

what about an atempt at detection of covert channels ?

atempt, of course, there is so many way to do the stuff....

just an idea :)

Regards
FoolFox
disavowed
02-07-2003, 01:28 PM
If there were popular uses of covert channels and I could target one or two types of things to monitor, then maybe. But, as you said, there are sooooo many different possible covert channels, I think it would be like searching for a needle in a haystack. Thanks for suggesting it, though!
naides
02-08-2003, 05:58 PM
Out of sheer ignorance:

I know only the very basic of networking, but because of my profession, I am an expert on creating outlandish ideas:

Implement a secure data transmission protocol in which the data is transmitted and listened through ports at a pseudorandom fashion. Perhaps simultaneously and in parallel, through several ports at the time. It will switch ports on the fly during transmission based on encrypted stubs attached to the previous set of packets. It would take a hell of a packet sniffer to follow and reconstruct the transmission of encrypted data, given the high level of noise from network traffic.

I know firewalls would go crazy, but you could limit the range of ports to a limited subset.

Does it sound nuts enough?
disavowed
02-08-2003, 07:54 PM
i agree, that is an interesting idea. however, if the packets are already encrypted, why bother playing with ports if the packet sniffer can't (theoretically) decrypt them or understand them anyway?


New "tool" - S.I. int 3 / int 1 patcher
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New "tool" - S.I. int 3 / int 1 patcher
PDA

View Full Version : New "tool" - S.I. int 3 / int 1 patcher

nikolatesla20
02-07-2003, 01:14 PM
This is my first loader program and I must say I am very proud of it so far, it works pretty well I think. I finally figured out how to do the "loading" :D

OKee, the whole point of this program is for those of you with Win2K/ XP on their systems, and SoftICE. SoftICE likes to put a INT3 on UnhandledExceptionFilter , and some programs check for this. Also, SoftICE hoses int1 up in the IDT.

You ask: WHY DO I NEED THIS?
Well, no one really "needs" it, but if you have hidden softICE as best you can under win2k / XP and a program still detects a debugger, chances are it's using either int3 or int1 detection. And this program will fix both. (well, not int1 just yet, but soon). So you could give it a shot at least...

Rather than having to try and BPM on UnhandledExceptionFilter, and then step thru code, or not begin able to BPM at all anyway, because of SEH's, you can use this little utility I made up, and it should work. It heals UnhandledExceptionFilter for you.

By the way, you also will not need to have SuperBPM with this either.

ALSO I have a driver that I've written to patch INT1 as well and it works great, but I am still integrating it into this program yet, going thru all the service API's takes a while! So be patient I will have it working soon.

hxxp:\\webpages.charter.net\nikolatesla20\PatchUnhandledKernel.zip

-nt20
nikolatesla20
02-07-2003, 04:34 PM
OKee People

I've gotten INT1 to work now , I think.

In other words, I know the driver works but I had to link the driver into the program with the service manager to load it.

hxxp:\\webpages.charter.net\nikolatesla20\PatchUnhandledKernel.zip

Let me know of any glaring bugs.

-nt20
nikolatesla20
02-12-2003, 01:26 PM
Hello, I forgot to include a readme. Here are some notes:

INT 3 PATCH:

This really isn't a global patch. YOu must use the loader to patch this . Read on.

The method I used is very simple. I tried to use my device driver to patch Kernel32 itself at UnhandledExceptionFilter, but it would blue screen my machine. Apparently SI holds on to the memory..

So instead I created a program "loader" that starts an executable using createprocess, and holds it while it patches kernel32 UnhandledExceptionFilter directly in that processes's memory space using WriteProcessMemory. When I did it that way, it worked.

I know the address to patch because kernel32 (and all system dlls) are in the same virtual address space in every process (they are "shared"). So even my loader can simply ask for GetProcAddress and the returned address would be correct for any process. This is the address I use to patch UnhandledExceptionFilter in the loaded program.

This is the only way I've found to do it for now - trying to patch kernel32 globally gave me blue screens.

it would also be possible to patch code into a new process (still using a loader) to replace IsDebuggerPresent. You simply have to VirtualAlloc(), and copy the new asm you want (mov eax,0 ret) into the virtual alloc mem space, and then patch IsDebuggerPresent to call this routine instead. It would actually be pretty easy I think, and I plan on experimenting with this idea in the future. (Sort of like a dynamic code injection)

INT 1 PATCH:

This is a global patch that is good once you run it after rebooting. If you reboot, you need to run it again. This patch is applied as soon as you start my program. It uses a device driver (IDTPatch.sys) to patch the Interrupt Descriptor Table to default settings at Int 1.

-nt20
Aquatic
02-15-2003, 02:40 AM
It works great!

:)
doug
02-18-2003, 08:05 PM
Very interesting, however - why not include the source?

Several people have done work on this topic, and none of them have included the source... FP (FrogsIce), pulsar (NTALL), [...] so what happened with these two projects is they went dead/outdated as soon as their respective coder went busy.

Furthermore, If one decided to detect this tool by scanning for a driver name, for example, anyone could easily recompile using his own string/settings.
Aquatic
02-18-2003, 08:18 PM
What about creating a program that combines it with this: http://www.woodmann.net/forum/showthread.php?threadid=1806#post8485 ?

Just an idea.
nikolatesla20
02-18-2003, 09:10 PM
I will include the source -

It's mainly that I thought most people might not be able to compile the driver part.

It'll have to wait until morning when I get to work (Yes, hehe I wrote this at work)

To Aquatic:

I've already made a patch that does exactly what that post describes. Search for "Driverstudio 2.7 anti detect" and you will find it. However, I think that it could use some updating, mainly to make one nice little distribution that has everything in it. It's in my possible plans.

-nt20
[NtSC]
02-19-2003, 01:02 PM
What about implementing all your DS 2.7 Anti-Detect Patches in a Device Driver?
nikolatesla20
02-19-2003, 01:13 PM
The idea had crossed my mind, but one problem exists that I haven't studied up on yet: how to get where in memory softICE is installed, and also, making sure it's the right version. Both of which I'm sure are fairly "simple" but I haven't investigated it at all yet.

ALso, I'm not sure if that would still work 100%, since once the SI driver is loaded, you'd have to change the symbolic names somehow, and I'm not sure yet as well if it is possible to do it dynamically like that (to rename SIWVID, for example). If you mess up the renaming, SI 's window won't come up.

So for now, the patches will have to do :) There are many ways to do one thing....I've learned all of this on my own reading and by skimming the forum/net for information. So even tho it's nice to have a prepacked "tool" I think anyone can learn if they really want to know how to do their own thing.

Source Code:

hxxp://webpages.charter.net/nikolatesla20/SIPatchSource.zip

This uses the DriverWorks driver model, which you can install with SI 2.7. It also needs the 2K / XP DDK from microsoft to be installed. IF you don't kow what these are, you shouldn't be looking at the code :P

-nt20
Kayaker
02-19-2003, 07:44 PM
Originally posted by nikolatesla20
The idea had crossed my mind, but one problem exists that I haven't studied up on yet: how to get where in memory softICE is installed, and also, making sure it's the right version. Both of which I'm sure are fairly "simple" but I haven't investigated it at all yet.

-nt20

Hi nt20

I'm not sure what you're trying to patch in SoftIce, but you can get the base address of winice and a pointer to its Service Table this way. The DDB_Service_Table_Ptr gives you the exported functions of winice, few as they are, and on my system the first one seems to return the Version number:

mov eax, 00000405 ; ver 4.05(332)
clc
ret

You can get access this way

;-------------------------------------------
;VxD_PAGEABLE_DATA_SEG
; Device_Id DWORD 0202h ; Device Id for Softice
; Device_Name db "WINICE ",0 ; Device Name (only required if Device Id = 0)
; DDB DWORD ? ; returns a 'device descriptor block' (DDB) linear address
; WiniceBaseAddr DWORD ? ; winice base address
; pszName db 80 dup(?) ; receives object name of VxD
;VxD_PAGEABLE_DATA_ENDS
;===========================================

;----------------------------------------
; Get_DDB Determines whether or not a VxD is installed for the
; specified device and returns a DDB (Device Description Block)
; for that device if it is installed.
;----------------------------------------

mov eax, Device_ID
;mov edi, Device_Name
VMMCall Get_DDB
;mov [DDB], ecx ; (VxD_Desc_Block STRUC - see vmm.inc)

mov edx, [ecx+30h] ; [ecx+30h] = DDB_Service_Table_Ptr

; The DDB_Service_Table_Ptr will give you the exported functions of SI
; (I get 4 of them (type 'vxd winice' ; in SI) and the first looks like a version number)

;----------------------------------------
;_GetVxDName(DWORD laddr, DWORD pszName) - Returns base address of VxD in eax
; pszName buffer receives object name of VxD that contains the specified linear address.
;----------------------------------------

;mov ecx, [DDB]
xchg eax, ecx
VMMCall _GetVxDName, <eax, offset32 pszName>
mov WiniceBaseAddr, eax ; base winice address
; offset32 pszName returns SICE(01) + 0000FE6C

ret
;============================================================

If you need "extra space" to runtime patch some code... check in winice there are roughly 30 KILObytes of memory taken up with useless resource strings like AIRONET WIRELESS COMMUNICATIONS or ALPS ELECTRONIC CO LTD. :D

Have fun,
Kayaker
nikolatesla20
02-19-2003, 10:02 PM
Thanx for the info Kayaker, but I am not working with VxD (*blech*) Only WDM and NT native drivers - so I need to use NT kernel API calls -

Don't know if they will map to anything similar..

But that's cool stuff there!

-nt20
doug
02-20-2003, 12:05 AM
you can use NtQuerySystemInformation to find the image base of a driver, provided it is loaded & you know its name.

Basically you invoke the function with "SystemModuleInformation", then you cycle through the device name array until you find softice's, then you get the pImageBase (or is it lpImageBase) member on that module.

I hope what I've said makes sense to you. I am a little short on time, so i can't give you detailed info on it. I'm sure someone else can though.

i think ^daemon^ has used that API in one of his SoftICE detection trick.

As for the version ID, well either a crc32, a version string search, OR (better) get the version info from the .rsrc
Kayaker
02-20-2003, 12:05 AM
Alas I don't haven't any experience with sys drivers and I may only be guessing, but I was under the assumption that the WDM model supported all earlier VMM calls in some fashion. The calls certainly exist in the WDM-based XP DDK. In general they can also be called via Kernel Ord001. This was sort of brought up in another thread and never really clarified, if and how all the truely low level system calls can be called in Win2K. If vxds don't run there must be a way to access the functions without hacking into ring0. Has the VM changed that much that it's no longer accessible, or have all the functions been replaced?

In any case, the DDB VxD_Desc_Block is a structure that is installed globally when any kind of driver (vxd based anyway) is loaded onto your system dynamically or statically, giving basic information about the driver. I'm curious, do the new sys drivers not use this basic structure? What does the Softice command VXD do in Win2K? If it gives you address and DDB information and if 'vxd winice' lists its ring0 services, then they're still using the DDB. If not, then things have changed dramatically.

Point being anyway was a way to "find" where winice was loaded in memory, perhaps you can find some similar NT kernel API calls that will return a specific structure or starting address.

Kayaker
doug
02-23-2003, 10:05 PM
You don't need to code a driver to get softice image base.

@nikolatesla20:
I included "GetNTICEBase.c", it shows how to do it using NtQuerySystemInformation.

Also, since that function returns a string to the path of the driver, you could feed that info to the functions provided by version.dll and parse the version info from the resource - and that returns what you want:
ex:
"FileVersion" : "4.2.7 (Build 562)"
nikolatesla20
02-24-2003, 09:33 AM
Thanks! Cool stuff!

-nt20
neemous
03-05-2003, 10:10 PM
If one wanted to patch softice 427_562 installed under 9x
similarly, would you just search for unicode "winice" instead "ntice" and
the other strings originally described by +splaj? Or is
completely different for winice and ntice?

n
NervGaz
03-06-2003, 01:27 AM
If you're using a loader of sorts you could do something like this to hide the devicenames... saw it done by Elicz in one of his pntice.zip files.. dunno wich tho...

.data
szSiwvidSTART db 'SiwvidSTART',0
szXiwvidSTART db 'XiwvidSTART',0
szNTice db 'NTice',0
szXTice db 'XTice',0

.data?
buffer0 db 104h dup(?)
buffer1 db 104h dup(?)

.code
HideSiceDevices:
mov edi, offset buffer0

invoke QueryDosDeviceA,ADDR szSiwvidSTART,edi,SIZEOF buffer0

test eax,eax
jz DoIt

invoke DefineDosDeviceA,DDD_RAW_TARGET_PATH,ADDR szXiwvidSTART,edi

test eax,eax
jz DoIt

invoke DefineDosDeviceA,DDD_RAW_TARGET_PATH+\
DDD_REMOVE_DEFINITION,ADDR szSiwvidSTART,edi

DoIt:
mov edi, offset buffer1

invoke QueryDosDeviceA,ADDR szNTice,edi,SIZEOF buffer1

test eax, eax
jz Bail

invoke DefineDosDeviceA,DDD_RAW_TARGET_PATH,ADDR szXTice,edi

test eax, eax
jz Bail

invoke DefineDosDeviceA,DDD_RAW_TARGET_PATH+\
DDD_REMOVE_DEFINITION,ADDR szNTice,edi

Bail:
ret

;------------------------------------------------------------------------------------------------
UnHideSiceDevices:
mov edi, offset buffer0

invoke QueryDosDeviceA,ADDR szXiwvidSTART,edi,SIZEOF buffer0

test eax,eax
jz DoIt_

invoke DefineDosDeviceA,DDD_RAW_TARGET_PATH,ADDR szSiwvidSTART,edi

test eax,eax
jz DoIt_

invoke DefineDosDeviceA,DDD_RAW_TARGET_PATH+\
DDD_REMOVE_DEFINITION,ADDR szXiwvidSTART,edi

DoIt_:
mov edi, offset buffer1

invoke QueryDosDeviceA,ADDR szXTice,edi,SIZEOF buffer1

test eax, eax
jz Bail_

invoke DefineDosDeviceA,DDD_RAW_TARGET_PATH,ADDR szNTice,edi

test eax, eax
jz Bail_

invoke DefineDosDeviceA,DDD_RAW_TARGET_PATH+\
DDD_REMOVE_DEFINITION,ADDR szXTice,edi

Bail_:
ret

dunno if it works all the time but i tested it some on win2K a while back and i'm guesing it was originally written for NT so it should work i guess...
neemous
03-06-2003, 10:05 AM
thanks nrevgaz
um my mistake, I wasn't very clear/posted
in the wrong thread
I was referring to the patch described by
+splaj that is mentioned by Aquatic earlier in
this thread, the one that tesla later wrote
an auto-patcher for....


hwnd problem under XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > hwnd problem under XP
PDA

View Full Version : hwnd problem under XP

Mostek
02-08-2003, 07:17 AM
Hi guys

There is some time I'm having this problem:
when I write hwnd SIce says "can't find desktop window".

Any clues why this happens??

I've even installed a new XP on a different partition and right after SIce but still ->no desktop window.
I was thinking if this isn't a protection of some kind->bad serial or whatever.

Peace
Mostek
esther
02-08-2003, 01:36 PM
Hi
what version of softice are you using?
there are 2 options

1)installed the latest Ds 2.7

2)try load it manually

Regards
Mostek
02-08-2003, 07:18 PM
I have the latest (2.7), running it at boot->need because of the driver(well I'll test it).

Peace
Mostek
naides
02-09-2003, 01:00 PM
Under XP you need to give HWND more info: look it up in the manual (See, I did not say read the forking manual!!!)

HWND desktop | module | thread | class-name

Usually if you find out the module you want to check with TASK, HWND 'your_module' gives you the results you are looking for.

for more info RTFM page 124:D :D :D
Aimless
02-09-2003, 11:03 PM
Sadly, in Windows NT and kin, you MUST be in the correct address for the break to occur.

Type in ADDR and name of your app (as seen through PROC command)

Example:

ADDR Notepad

(I know the name of the process is Notepad because I did my PROC command before the ADDR command)

THEN:

Apply hwnd command.

Have Phun
Mostek
02-10-2003, 05:58 AM
naides I though that reading the forking manual onces is enough(a few years back). It looks not.
Anyway thanks. :D

Aimless yeah it looks that I'm at the begining again. The commands that I used under w98 doesn't work as they used anymore. Interesting was that HWND on it's own worked sometimes and it didn't rest of the times.
It looks I just got lucky to break in good proc space.

And that is why I was so clueless->it works and than it just stops. :confused:

So now I know I have to read the forking manual again. :D

Thanks guys you are a blast. :p

Peace
Mostek


Aspr IAT Cleaner
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspr IAT Cleaner
PDA

View Full Version : Aspr IAT Cleaner

Zilot
02-08-2003, 09:10 AM
Hi to all !!

Before I posted this thread I was wondering to do or not it here.
But this is the place were all big stuffs about Aspr happen so I decided to do it.
This in attachment is little tool I made in recent time (100% ASM). It tries to clean Aspr IAT, so after it just several unresolved APIs will remain and they will be easy resolved with usual plug-ins we used in old good times before a lot of garbage in IAT space. There are several garbage in IAT space, they must be cut in ImpRec with option "Cut Thunks"

So because its size ( it is like plug in ) I hope that administrator will not complain.
This was tested under Win2k ,and worked fine with several Aspred programs.

regards Soldat
Zilot
02-08-2003, 10:13 AM
In the mean time I realized that with first attached version can be problems so I changed something, and here is one improved. That doesn't mean that first one have bug.

So instruction:

1) Try with first one if doesn't make
2) Try with second, it will do

There is a little difference between version v 1.0 and this v1.0 b

Soldat :)
Zilot
02-09-2003, 06:47 AM
I realized another mistake. Nothing is changed in code, but in work direction. Both of exes in previous attachments are now in this one.
Sorry for this and any comment about "Cleaner" is wellcome.

Soldat :p
Manko
02-09-2003, 09:54 AM
I have quickly tried your little app and it's always nice to see people coding. :) (I ought to get started one of these days myself, but... :P)

Anyway. Haven't traced or dissassembled it yet, but...

1. I'd much rather see it as a plugin, since 2 apps is more pain...
2. I'd like if it zeroed out the invalid-adress trash you see sometimes...
3. It should be able to do ALL API-tricks we know of. (Existing plugins do...(If you combine them...))

I'd like this plugin to do it like,
1. Find boundaries, zero out thrash.
2. Give back command to imprec and put up a message about the boundaries. Both at the same time. Or even better; just fill in the right values... ;P
3. On the second run, resolve ALL apis! :)

I suspect though, that your app might have some nice things I should look closer at. :)
Might be that whatever you do (spy on api-mangling?) to get the boundaries is a big reason why a loaderapp is better. Maybe just make your app load imprec with the right values... ;P
Hehe...

Thought someone ought to post SOME comments!
Looking forward to comments on my comments... :)

/Manko
Manko
02-10-2003, 04:44 AM
I just quickly tried to have a look at this one, and it seems you have it protected... :p

Wonder what secrets it might contain?
Nahh... Guess you wanted it smaller too.

Don't know what you have it protected with though... :)

/Manko
neviens
02-10-2003, 10:27 AM
Protection seems to be ExeStealth, had a phun with this
baby, unpacking Morhuhn 3 some time ago. BTW there
was a funny bug in code. String in Meltice detection
was terminated with o and not zero :)
I hate the programs, that refuse to run under Sice, or
even worse reboot the puter, with loaded Icedump.
Therefore most of such a proggies become stripped from
offending code usualy.
Neviens.
Zilot
02-11-2003, 03:26 AM
Originally posted by neviens

I hate the programs, that refuse to run under Sice, or
even worse reboot the puter, with loaded Icedump.

I hate them too. My intention was something another :D(included) but this was appendix I couldn't avoid.

Soldat :p


copy and paste under Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > copy and paste under Softice
PDA

View Full Version : copy and paste under Softice

newbcrk
02-08-2003, 11:36 AM
Hello ,

How was I be able to copy and paste some ASM code of Softice to a file such as word .doc or .rtf ?
Morever I use windows NT 2000 .
I have install IceDump for Windows NT 2000 PRO but I don't know how to use it to copy and paste .

thanks . :confused:
naides
02-09-2003, 01:37 PM
Originally posted by newbcrk
Hello ,

How was I be able to copy and paste some ASM code of Softice to a file such as word .doc or .rtf ?
Morever I use windows NT 2000 .
I have install IceDump for Windows NT 2000 PRO but I don't know how to use it to copy and paste .

thanks . :confused:

The question is why would you want to copy and paste ASM code from Sice?

If you want to copy the actual bytes, like grabbing the code to transplant it into something else, use a hexeditor with disasm capabilities i.e. HIEW

if you want to obtain the dissasembed code, let us say, to write a tutor or ask a question, Sice is not the tool for the job, use a disassembler: Windasm.

If you want Sice screen shots, search back into the board, it has been discussed before.
Aimless
02-09-2003, 10:59 PM
1. Go to Softice

2. Find out the starting address from where you want the code to start (assume 400000)

3. Find out the ending address upto where you want the code to finish (assume 400300)

4. Perform ending - start (i.e. 400300 - 400000 = 300)

5. Type in the command window:

U 400000 L 300

You will find that you have got the disassembly in the command window

6. Ctrl+D to go back to windows

7. Open SoftICE Symbol Loader

8. Select File->Save to Log file

9. Give name for you file. Whatever is there in the command window (currently the disassembly for 400000 to 400300) will be saved to this file

10. This file is in text format. Open it in any word processor and save as .RTF or .DOC

Have Phun,
newbcrk
02-15-2003, 04:09 AM
:)

Thanks to Aimless an the other .
That is exactly the answer that I search with the symbol loader .


New contest on anticrack.De : CPU emulator.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > New contest on anticrack.De : CPU emulator.
PDA

View Full Version : New contest on anticrack.De : CPU emulator.

Thigo
02-08-2003, 12:02 PM
http://contests.anticrack.de
Good luck :)
squidge
02-08-2003, 02:52 PM
yummm :)

"document all opcodes..."

yeucky. Spit! :mad:

I hate documentation...
disavowed
02-08-2003, 07:51 PM
even worse than the opcode documentation, "... usage and CPU design/architecture"
i literally laughed out loud when i read that
squidge
02-09-2003, 04:21 AM
why do they always have to spoil fun-looking projects by including such requirements?
Thigo
02-09-2003, 05:24 AM
well the doc has to be here else it'd be kinda hard to understand how the CPU works and therefore it would be hard to judge...
cyberheg
02-09-2003, 09:38 AM
Cool thing.

I recently bought the book Virtual Machine Design and Implementation in C/C++ by Bill Blunden . It's a 600 pages book covering exactly this. I thought it would be useful to learn something better then those simple cpu's posted. This book got a example which includes both assembler, debugger aswell as emulator which is around 10000 lines of code. What do you know... maybe I got a advantage now.

This book takes a professional aproach though and not just talking about simple "adders" which I suppose you want.
A real example of such cpu is java and .net

Have you made any estimations of what you really want? I mean would I win if I designed a "java 2"?

// CyberHeg
Thigo
02-09-2003, 03:50 PM
well.. ppl are free to code what they want :)
The specs are quite open :)
evaluator
02-10-2003, 12:56 PM
that is very strange contest.

CPU-Emulators mostly are commercial subject because of hard work needed.

So i don't think somebody will do Emu as gift.

Why need this contest?

Or maybe will better upgrade existing EMUs?
ancev
02-14-2003, 06:27 PM
hi,

i just finished, some days ago, something similar

waste of time :p

Vecna/29A
tgodd
02-15-2003, 11:29 PM
A processor is just a state machine.

Risc would be the easiest to emulate,
while cisc would be a tad bit more complicated.

If you can write a disassembler, then you should be able to write an emulator.

Not that complicated....

Regards,

tgodd
cyberheg
02-16-2003, 04:53 AM
There is lots of difference between a disassembler and a emulator. Writing a disassembler you don't need to think just follow the code while a emulator you need to think how to create it. While the result might be the same there are other steps needed to acomplish each task. There is actually alot of theory behind making a usable architecture.
Seeing Vecna's cpu aswell as others just me realise that it's not really worth the effort. If you really plan to make a virtual machine for real use you want it to be able to do more then just add 2+2. This design of Vecna's is unsupprisingly 90% the same as the others I've seen in past. The model of handling input and output is still the same.

I had this thought about making a VM which is capable of doing something more then adding. Lets say one of the design goals would be to make checksum of code, do anti-debugging checks and/or be capable of calculating results on data which would change flow of execution or interpretted code or the interpretter itself if something is wrong.

// CyberHeg
ancev
02-16-2003, 03:39 PM
cyberheg,

i think you didnt check the code well, or dont understand asm... :rolleyes: check again the input/output, and notice its made in bits (emitbits() in the assembler, or get_bits() in the cpu)

as far i know, no real or emulated cpu do that (not that this is a great thing to do, but its unusual... very different of other things you saw)

beside this, a cpu its done so small blocks are able to build any thing... there´s no point making a cpu so HLL as to have buildin opcode for antidebug check or so

these things must be build from the small blocks: else, it risk become such thing as: load number N(the "opcode") -> execute antidebug trick number N - Switch/Case of antidebug tricks :p

ancev

ps: after this project, i discovered that, unless you´re coding a emulator for a console/computer/arcade/etc, writting a cpu for such protection/obscurity porpouses its a waste of time. :D
Hwoarang
02-16-2003, 06:07 PM
I heard that some cd protection called star force has something like this and it really showed up to be a waste of time, even if tracing/understanding protection code was very hard, cracking the actual game was quite easy.
Hwoarang
02-16-2003, 06:18 PM
btw ancev, your cpu.zip is broken..or is it broken on purpose?:P
dion
02-16-2003, 08:44 PM
yes, it is broken, so i fix it with zipfix.exe :D
mike
02-18-2003, 03:31 PM
ancev,
why a waste of time? too easy to reverse?
have a look at zot: http://ling.ucsd.edu/~barker/Iota/zot.html
This language has two operations yet it is turing complete. Having so few ops seems like it may be harder to reverse.
evaluator
02-19-2003, 01:01 PM
Sorry, I made mistake.
I mixed CPU emu with PC emulation.
tgodd
02-19-2003, 03:08 PM
I have seen such uses of state-machines in code.

The hardlock driver is one.

It is extremely time consuming to traverse the code.

However not impossible.

Regards,

tgodd


FAO Woodman: FAQ link borked...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > FAO Woodman: FAQ link borked...
PDA

View Full Version : FAO Woodman: FAQ link borked...

squidge
02-08-2003, 06:47 PM
Although the "You must read the" text refers to this site, the "FAQ" link still points to Woodmann domain, so I can't hit people over the head with it, as it's not viewable.
disavowed
02-08-2003, 07:52 PM
if they complain, tell them to use archive.org :)
Woodmann
02-08-2003, 08:10 PM
BWAHAHAHAHAHAHAHAAHAHAHA :)

I shall put it on the list of things to fix ;)

Woodmann


Interesting project? InstallShield Script Emulator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Interesting project? InstallShield Script Emulator
PDA

View Full Version : Interesting project? InstallShield Script Emulator

squidge
02-08-2003, 06:51 PM
I imagine quite a few of us look through hundreds of pages installshield decompiled setup script files when analysing a program, and I'm just wondering how useful would an emulator be for the actual .INS or .INX files ?

Rather than just plain ol' decompiling, actually emulate the code and show what functions are being called, which DLLs are being used, with what arguments, what results, etc..

Anyone thought of this or already done it ? There seems to be more and more programs now which do some protection setup in the installshield file, but use DLLs with scrambled names, so we don't know exactly what they are doing.
kittmaster
02-22-2005, 08:47 PM
Im all for it..........wish there was something like that out there!

:yay:


Using drivers to patch and hook other code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Using drivers to patch and hook other code
PDA

View Full Version : Using drivers to patch and hook other code

dELTA
02-09-2003, 02:23 PM
I've been wondering for a long time about which techniques that are used when a driver is used to patch or hook other code in the operating system. For example patching operating system modules like kernel32.dll or other third-party drivers (i.e. using in-memory patching, not modifying the actual files on disk).

Is the common technique to simply patch the memory space of the target code, e.g. the code section of kernel32.dll, or is it some more advanced things that have to be done? Are there several different techniques that are usually used for this purpose? Is it elementary to make a global patch of e.g. operating system dll:s from a driver? (With global patch I mean a patch that is seen by all other programs, contrary to the "copy-on-write"-semantic effects that can occur when doing in-memory patching of dll:s from ring3 programs)

If it is only pure patching of the target module memory that is most often used, I guess that you use a driver to do it simply because there is no way to e.g. patch the code section of kernel32.dll from a ring3 program? Or can this be done from ring3 code to, but only local to the process itself, using some virtualprotect trickery?

I have recently bought a good book about driver programming, but I am worried that it won't cover these things (at least not in an apparent manner), so I thought that I'd try to find out some rough details about the used techniques beforehand, so that I can easier spot the parts of the book that are useful for these purposes.

I have understood that several people on this board are quite handy with such driver patching acrobatics, so it would be really great if you could just throw some small pieces of info my way, just to get me started.

Any pointers to good references (e.g. essays) about this subject would be really great too.

Thanks a lot!
Kayaker
02-10-2003, 06:03 PM
Hi

I can indeed imagine that your driver programming book won't discuss too much about covert memory patching system code, heh, unless it's a cool Undocumented book ;) Your question is fairly general, but I suppose the benefit of Ring0 *IS* that you can do pretty much what you want. Driver development is actually quite fun because you do have access to all the low level system calls that the Win32 apis generally thunk down to anyway, as well as a complete programming IDE if you will.

With the VMM calls you can use string management functions, access the registry, read and write to disk, modify page permissions if necessary, hook interrupts, create system hooks, as well as modifying memory directly. I'm not sure if there are some restrictions in Win2K driver development in patching certain areas of system memory. Loading your driver from an injected dll in the target program might be sufficient to give you complete memory access.

If you're simply trying to patch the kernel or some other dll for some reason you'd probably want to look into api hooking first, which would be safer and give you more flexibility than a crude patch. But if you're after deeper system control then drivers are a good way to go.

If you're interested, there's an example program in the miniproject forum (Reversing system tools) on creating a general Hook proc in a vxd with VMMCall Hook_Device_Service, with which you can intercept pretty well any VMM service call, the example hooks VMM_Add_DDB to detect when another system driver is being loaded. There's a few ideas for you anyway.

Cheers,
Kayaker
tgodd
02-10-2003, 11:44 PM
You may have problems patching memory due to paging.
These problems, however, can be overcome.

You will need to familiarize yourself with the Ix86 Paging mechanism. A good source for reference is the Intel Secrets Web Site.. I believe it is now at Dr Dobbs Journal web site.

Regards,

tgodd
dELTA
02-11-2003, 05:21 AM
Thanks for the info Kayaker, I was actually hoping to get a reply from you. :) (and thanks for the tip tgodd too)

One very big question I have, which I'm hoping someone can shed some light upon:

How big is the difference between vxd:s and the new 2000/XP WDM? Is the same API:s used (e.g. VMM_Add_DDB), or is there a set of completely new ones? In what other areas does the main differences and similarities reside?

I have sortof decided to focus mainly on WDM driver programming to begin with, since vxd:s are something of a "dying technology", but practically all info I can find on the net about drivers is about vxd:s. :( Hence, I would very much like to know which areas of vxd programming that are useful for WDM programming to, and which ones that are exclusive too the old vxd:s only, so I can know which tuts and info that are "unnecessary" and which ones that are useful (yes, I know, no information is really "unnecessary", but since we are only given so much time in this life, some information must get priority, however sad this might be :().

Any tips, anyone?
Kayaker
02-11-2003, 11:49 AM
I know what you mean, that feeling of working with a dying technology isn't very satisfying, lol. But since WDM drivers are supposed to have cross platform compatibility and run on Win98/Me as well as Win2000 and later, I would think that little of the earlier vxd documentation is completely 'useless'.

Unfortunately none of the DDK's are available for download anymore it seems, but it's probably worth the shipping costs to get the CD from Microsnort. The only place I've seen the complete latest version of the DDK is online at

http://www.osr.com/

Actually I was just reading it and there are a couple of interesting things not in the Win98DDK that maybe allude to what Tgodd mentioned.

--------------
Accessing Read-Only System Memory

The Microsoft Windows Memory Manager enforces read-only access of pages that are not marked as writable.

Read-only memory has always been protected in user mode. However, in Windows NT 4.0 and earlier versions, read-only memory was not protected in kernel mode.

If a Windows kernel-mode driver or application attempts to write to a read-only memory segment, the system issues a bug check. See Bug Check 0xBE (ATTEMPTED_WRITE_TO_READONLY_MEMORY) for full details.

Intercepting System Calls
Some drivers intercept system calls by overwriting the driver's own code and inserting jump instructions or other changes. Since the driver's own code is read-only, this technique will cause a bug check to be issued.
-------------

My question is, would a VMMCall _PageModifyPermissions be enough to avoid the dreaded 0xBE Bug Check in these cases?

There's also this, which I guess there's probably a workaround using some of the thread or context related services:

------------
Accessing User-Space Memory

Drivers cannot allocate user-space virtual memory because they run in kernel mode. In addition, a driver cannot access memory through user-mode virtual addresses unless it is running in the context of the user-mode thread that caused the driver's current I/O operation and it is using that thread's virtual addresses.
-------------

Kayaker
tgodd
02-11-2003, 02:00 PM
The PageTable locations are hard coded into the OS.
Access the pagetable directly and manipulate the pages so that you may patch the contents, however, DO remember to set the page flags back to the way you found them to start with.

Regards,
tgodd
dELTA
02-11-2003, 02:57 PM
Very interesting info, thanks guys!

One question though:
In my infinite ignorance, I do not know what a "bug check" is. :( Could anyone give a short explanation? Does it mean that it should be completely impossible for any driver (or other software) to patch the kernel, or is there any way past such a "bug check"?

Or does it mean that the only way to patch any part of the kernel would be to modify the physical files on disk (from non-Windows mode, to get by the file locks)? I'm almost certain I have read about drivers that runtime-patch kernel code (or other parts of the kernel) but this should hence only be possible in Windows NT 4 then (except for using the "undocumented" method that tgodd is talking about)?

I would too, just like Kayaker, very much like to know if these kernel pages are given special treatment with the VMMCall_PageModifyPermissions function? Does anyone know anything about this?
Kayaker
02-11-2003, 11:49 PM
You could probably use either method, the Read/Write bit of the Page Table is usually changed directly because it's sneakier. But if you pass the flag PC_WRITEABLE (00020000h) to a call to _PageModifyPermissions you should also be able to write to any address in the page. Check out Elicz's Apithunk code for an example, the call emulates VirtualProtect with the PAGE_READWRITE flag.

If you can't thunk down from Ring3 to kernel code to make the vxd call (a la Peitrek Undocumented) in Win2K, then if you're doing this in a driver anyway you just call _PageModifyPermissions directly. You can set a breakpoint on _PageModifyPermissions in Softice (type VCALL _PageMod* in SI for the address) if you want to check it out, you can trace it any time there's a task switch on your system, such as opening a window or right clicking on your desktop (a task switch reloads the CR3 register among other things).

Start with the driver development first, worry about what you want to do with it later :)

Cheers,
Kayaker
dELTA
02-12-2003, 05:52 AM
Thanks for the info again Kayaker!

And yes, I should probably try not to get too far ahead of myself, but I just can't help it, reality is too slow, and I have too little time. ;)
nikolatesla20
02-12-2003, 05:01 PM
Perhaps I am running into a page lock problem myself?

I tried to use a device driver to patch Kernel32.dll's "UnhandledExceptionFilter" on a global scale. I bug check as soon as I try it. If I could patch the "global" copy ... but I think SoftICE would just re-patch it anyway back into an INT3. I know you can patch SI to not do this anymore, but it leaves tons of ugly trace messages in your SI window, so I prefer not to do it that way. I tried to use my INT1 patch driver to also do the INT3, but alas, writing to kernel memory bug checks.

Patching the IDT table works fine however.

I'm using Win2000 with the memory protection turned off - just as a note, patching IDT works on every machine I've tried it on (Win2k/ XP) with or without system memory protection.

By the way Kayaker, bug check means BSOD.

-nt20
dELTA
02-12-2003, 05:18 PM
Thanks for the info nikolatesla20,

When you say that it is possible to "patch the IDT table", is this the same thing that Kayaker refers to as "changing the Read/Write bit of the Page Table"?

Also, have you tried to use the "_PageModifyPermissions" function and it does not work with the kernel memory?

Also, exactly what is the difference between using and not using "memory protection" in Windows 2000/XP? Is all memory access checking disabled when not using this memory protection? I mean, at least in non-kernel code, so that I can e.g. write to the code section of a normal windows app in memory without changing the page permissions with VirtualProtectXXX?

And finally, I was the one who wanted to know what a bug check was, not Kayaker, I'm quite sure he already knows that. :) I still appreciate the info though. ;)
Manko
02-12-2003, 05:27 PM
Hi, nikolatesla20!

At the risk of sounding stupid...
What about icedump?
A while back someone discovered it left kernelspace writeenabled...
But I guess isolating the culprit in that source might be tedious... :)
And besides, I don't know the least bit about any of this, so for my ego's sake I shouldn't even open my mouth, as I'm probably WAAAAAAAAAAAAAAY off. :p

/Manko
nikolatesla20
02-12-2003, 06:58 PM
By "Patching the IDT table" I mean I can directly write into the IDT table entries with abandon.

All I have to do is:

// IDT is 5 bytes.
char IDTAddress[]={0x00,0x00,0x00,0x00,0x00};

_asm{

sidt IDTAddress
mov eax, IDTAddress
add eax, 0x0D // got to INT1 entry.
mov [eax], 0x8E //Restore normal IDT vector IOPL.

}

I can write directly to it with a mov instruction. If you try this with a Kernel32 call, you will blue screen. At least I did. Every time.

Manko: About IceDUMP: I've never gotten it to work on 2K/XP, and it doesn't hide INT1.

About Write protection: As far as I know, this is mainly for kernel mode code. You still can never write to another process from Ring3 (unless you use WriteProcessMemory and VirtualProtect, etc). WriteProcessMemory actually runs in kernel mode, switches address context to the appropriate process, and mods the data.

From what I understand, you don't have to go thru any type of page table in kernel code. The processor does that for you when you try to write to an address, since paging is part of the processor. YOu only have to make sure you are in the right process context, which means the page tables are pointing to the process you want to modify. So for example, if you are in the correct context, you could write to 0x00400000 in your process and be fine. Unless of course that page is not in memory :)

Another thing: compared to VXD's , WDM and normal NT kernel drivers are actually "easier" (if a driver could ever be so). I just used the tools that came with D.S 2.7 (Driverworks wizard, etc) and made NT style driver.

One last thing for Kayaker:
You might already know this, but a driver is always running in context of user program when it's called with a DeviceIOControl. You can use this to your advantage. Basically, all addresses will be valid in that case. As long as you don't queue the driver message packets (IRP's), you run synchronous and will be in user program context. Of course that is obvious :P Also, you can force switch the context if you have the processID - there is a kernel mode api call that will do it..KeSwitchContext(), same call WriteProcessMemory uses.

-nt20


help making ntice break on exception.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > help making ntice break on exception.
PDA

View Full Version : help making ntice break on exception.

tinman
02-09-2003, 09:32 PM
I am trying to get softice to break on exceptions. I have Windows 2000 Pro. I am writing programs that cause an exception. However, when run, my debugger does not break in. How can I make this happen? For example, the following code does not break when run (unless I load it in a debugger, and step thru it):

int func(void);

void main(void) {

func();
return;

}

int func(void) {
char buffer[8];
int i;

for(i=0;i<2048;i++)
buffer[i]='A';

return 0;
}

Thanks in advance!
Aimless
02-09-2003, 11:07 PM
In NT and kin, the exception handler (default, if not explicitly designed) is kicked off before the debugger breaks. That could be one reason why the debugger is not breaking on.

Try compiling the executable to a minimal so that it does not insert the exception handler. Alternatively, break on the NT exception handler rather than SET FAULTS ON.

Have Phun
tinman
02-09-2003, 11:22 PM
Thank you Aimless,
do you know how to turn off the NT exception handler? Or at least what to google for? I have searched for everything I can think of, but I can't find anything useful. I don't want just this program to break on exception, but all programs, the program posted was just for illustration. Do you know how to configure the NT exception handler to be the debugger of my choice?

Thanks in advance.
Aimless
02-09-2003, 11:53 PM
There are 2 paths to take:

1. Use a SYSTEM debugger, like SoftICE (or)

2. Use a Windows based debugger like (the powerful microsoft debugger - www.microsoft.com\ddk\debugging or OllyDbg)

For the first case:
============

1. Find a utility that dumps the exports from a particular .exe or .dll (like dumpbin, tdump, etc.)

2. Run the utility on kernel32.dll to get a list of functions that the dll exports

3. Search for ALL "exception" keywords

4. Breakpoint on all of them (not that you need all, just unhandledexceptionhandler is enough, but just in case if you want to be exhaustive)

5. The breakpoint will break when ANY program incurs the fault because ONLY and ONLY address below 80000000h (2 GB) is address-context sensitive.

6. Continue as you would

For the Second Case:
================

1. Install your debugger and check that it works, just in case.

2. When you are satisfied that the debugger indeed works, open the registry key using regedit.exe:

\\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AeDebug for the entries named Debugger

The value for the Debugger entry specifies the command for the debugger that will be used to analyze program errors (simply put, it will execute your debugger in the context of the failure).

Note: its pretty useless to combine and use BOTH first and second cases.
Stick with only one case.

Have Phun
tinman
02-10-2003, 11:30 AM
That is exactly what I needed to know, thanks for you patience, hopefully soon I can start contributing to this board!


Unknown packer/crypter
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unknown packer/crypter
PDA

View Full Version : Unknown packer/crypter

bedrock
02-10-2003, 02:56 PM
Hi guys,

I have a target, and i'm fairly certain it's either packed or encrypted, but i cant figure out what with. I have run PEiD and PE-Scan against it, but niether recognise it.

The target has a suspicious looking section named 'ExeS'. Just wondered if anyone has any clues?

Thanks,
_Servil_
02-10-2003, 03:36 PM
It's ExeStealth.

http://www.webtoolmaster.com/estealth.htm
bedrock
02-13-2003, 04:27 AM
Thanks for the reply _Servil_, i'm off to do some research on this now.

Ok, i just read the thread titled "ExeStealth 2.41 EXE Protector" by squidge and it's so obviouse why i couldn't dump this protected program. Oh well, sometimes it's just too obviouse.

Ok, i've been digging around for this one, but i still cant dump my target, and i have tried to locate the temp location in squidges post, but this target is with EXEStealth 2.6 and i'm pretty sure it's unpacking in memory now.

When ever i tried dumping i just get a 8k file.

Ok, i'm getting good at this searching now :) I just found this thread "EXEStealth - SPOILER - Unpacking! "


help needed : mouse drivers; WdM/ not...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > help needed : mouse drivers; WdM/ not...
PDA

View Full Version : help needed : mouse drivers; WdM/ not...

Czerno
02-11-2003, 12:03 PM
Fellows ! In relation to the problem with logitech mouse drivers not working with for me under TRW (see a previous post under TOT), I investigated a bit further, here's a small compendium of facts for reference, and questions :

0. Background :
- VxD operation & programming, I can do...:)
- HID / WDM ... have no dox/ideas how that bazaar works :( <Any good pointers (no MSDN per favor)?>

1. HW : a "Dexxa" mouse w/ 2-buttons + roulette or wheel (incl. 3-rd button). Apparently this is "logimouse" compatible, comes with "logiware"

2. SW :
a- using standard (logiware v. 9 ): this is the WDM crap
Works perfectly outside of TRW, not under it (apparently mouse presence not even detected by TRW )

b- using basic MS drivers for "PS2" mice
i.e: *vmouse, msmouse.vxd

This works both under Win and TRW ! Even the "roulette" messages are generated and work, but this otherwise perfect settings, just -ignore- 3-rd button :(

3- Help sought : Please hint to how to add 3-rd button support to the number 2 settings. That would be either
installing a replacement for the *vmouse and or msmouse.vxd that would implement the needed hooks for recording the 3-rd button status out of the actual mouse data packets and serving the *vmouse's requests for 3-rd button status ;

else pointers to sufficient info for me to implement the function - I recall reversing & modifying a DOS mouse driver in the old times, twas fun too ...

Also, would the MS "intellimouse" software work with this mouse in your opinion ?

In ny case I would prefer a manual and minimal installation of drivers (don't want to run an "install wizzard" full screen and which will ruin my work

TYIA ! Sharing of knowledge is a positive-sum game...

--
Cz.
dion
02-11-2003, 11:07 PM
just want to say hi :D :D

btw, are you really still working on that one for so long? uhm.. interesting indeed. why not seeing the source code [if there is]?
UrgeOverKill
02-15-2003, 09:59 PM
Hi Czerno,

Actually if you have a driver for a 3D/4D mouse, it should work fine.

I think I have them if you want to try it, pm me.......


Who are the new "+" ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Who are the new "+" ?
PDA

View Full Version : Who are the new "+" ?

Lise_Grim
02-11-2003, 12:35 PM
hello,

first I hope not posting on the bad forum.
Well, my question goes of course on the "+" Message Board.
With the +HCU, we had some "+" persons who
were and always are our "leaders" for R.E.

But now that's not clear.
Maybe it's the time to have new "+" ?

I'm nobody that's why I can post such message,
but I think that some members of UG, CoRE, DAMN, ECL, TMG
and other +Group, The Owl, The Analyst, our French "guru"
Christal, Crackz and many others can become "+".

But that's my advice as newbie in Cracking.

I hope you won't consider it as something not interesting.

Sorry for being so "direct" :)

Lise_Grim
Woodmann
02-11-2003, 05:52 PM
Hi,

Your post is fine, I see no problem.

The times have changed and everyone has chosen new
roads to travel. The roads they have followed include *nix,
W32ASM and VB, etc; Others have retired.

Sometimes + people will visit but the "+" is not generally
used anymore. Those days are gone now.

There are many "new" ones that have good skills.
They reside in all places that concern codeworks.

Peace, Woodmann
deedee
02-11-2003, 06:42 PM
hi lise-grim and Woodmann,

I am a pure newbie, but I would also like to give my
opinion here ... for me, the "+" is not for somebody who extremely good in technique, but somebody good in his spirit ...

I don' know in the other countries, but in the French scene, I name christal "+", because he wrote many tutorials and did a lot of thing impossible to help others crackers to advance in "cracking"(from 1998...) and i can't forget him...

today...the crff (cracking frence forum), k509 (the bigest french tutorial page) is down, and christal is gone...

for me , lots of nostalgie for this periode...

regards
deedee.
Woodmann
02-11-2003, 07:10 PM
Hi deedee,

I agree with your choice of "+" :)

And I also enjoy the history of RE.
That is why I keep this place going. :D

Peace, Woodmann
Devine9
02-11-2003, 09:54 PM
I agree with you woodman. I also think your efforts to keep the past RE scene alive are very important. This is one of the last remaining places where people cleanly pass information amongst one another without thought of whether it will adjust their current stature. A great job.

For the + though, I don't think its justified in today's scene. Back in the day being in the +HCU was a great thing, but you didn't need a + in front of your name to show it. The same goes with today. Once you have been around the bush a few times you know all the big names, you don't need the +.

also, christal is very much alive ;)

Cheers,

Devine Right [RET]
http://ret.mine.nu
tgodd
02-11-2003, 11:20 PM
Back in the 80's and early 90's there were no +'s
No forums like this one either.

One had to go it alone pretty much.

These are the times I come from.
No Tuts, No +'s, and Nobody Kraming a search engine down your throat, as there was nothing to search.

+EGO

What's the big hype. Every body has been a newbie.
Todays newbies will ultimately surpass any of todays +'s.

I'm not for +ing anyone.

just my opinion.

Regards,

tgodd
Devine9
02-12-2003, 10:17 AM
Well I was not sure as to post my first post on this board in reply to this thread, but I felt it warranted by Woodman's post, to give thanks to him for this. I've never been much for message forums, although I believe that the future of reverse engineering relies strongly on a good solid place to exchange information.

No, the beginners of today will not surpass the advanced reversers if they don't have that ability. Protections today are moving much more quickly than they have been in the past, and there is potential for advanced members to lose the connection with beginners.

On my board i've always pushed that idea and I think for the most part that idea is also brought across on this board. I have been reading this forum for a very long time, but haven't in the past subscribed to it to post. Unfortunately this thread just got screwed by the all so popular, i'm leet, let me describe my skills to everyone here tactic. Input is welcome, biographies are for your diary.

But I am looking forward to continuing this thread. This is a very important topic for the future of reversing, so if we can agree on how we all think the best route to take would be. I'd be very interested in taking it into consideration and perhaps adapting my own approach.

Devine Right [RET]
http://ret.mine.nu
JMI
02-12-2003, 11:38 AM
Perhaps it would be useful to recognize the "+" for what it is and what it is not. As I understand the history of the +HCU, it was a requirement to earn the "+" sign that the individual passed a test. Those who passed the tests, which involved complex reverse engineering skills, "earned" the certification of "+".

This is essentially little different than a number of both honorary and sanctioned "pre" or "post" designations that society or some sanctioning body premits individuals, who have passed various requirements, to afix to there names, ranging from "Dr.", "Ph.D", etc. to more mundane activities such as "certified air conditioning specialists" or simply signifying membership in an organization or group.

One can, therefore, recognizes the "+" sign, not as a designation of the human qualities of the individual or of their willingness, or ability to share their knowledge, or to teach it successfully to others, but simply as an identification that they have passed a difficult test, and that the numbers of those who accomplished that challenge, at that time, are few and skilled, and that they have earned the right to that particular designation. It is a "merit badge," designating that particular accomplishment.

We can then give them that credit of which they are due, and still judge them, in the present, not by whether or not they passed that test, but by what they have to contribute and/or teach to the rest of us attempting to master our own level of skill and accomplishment. Some with the "+" are, or were great teachers, as are many who did not take, or might not have passed, that particular test.

Perhaps there are some who envy those who have the "+" because it sets them apart, on one level, from those who do not. But instead of envying their "+" sign, let's, instead, envy the skill level that entitles them to "wear" it, and aspire to the achievment of that level of skill or higher, ourselves. They use the designation because they "earned" it, but we "honor" them only if their actions are "honorable." We all have seen that some who earned the HUC "+" are sadly lacking in redeeming social graces, but while that may lessen their appeal or usefulness to the rest of us, it does not really address the issue of their right to wear that particular "merit badge" which they had to earn. It was not given for social graces, but for having sufficient skill to pass a particular test.

I had the "privilege" of studying my profession with some of the most preminent scholars of my profession, the people who wrote many of the books used for teaching these subjects at most of the schools for this profession throughout the U.S. Most were brilliant scholars, but only some were great teachers. Some delighted in demonstrating their superior knowledge over the students and some delighted in imparting knowledge to the students. Only the second category were of much use.

So may I suggest we stop fixating on whether or not a contributor here has, or doesn't have a "+" and simply focus on whether or not we are being given information that helps us expand our own skill and knowledge. In the end, this is what really matters.

Regards.
Lise_Grim
02-12-2003, 11:38 AM
hello,

nice to see intelligent people :)

Thanks Woodmann to keep it alive, i'm sure you
will see me very soon for that :) and not for
my nfotemple (nfotemple.cjb.net) :)

Well my post was also to know conditions to be now a "+".
I mean, crypto,unpacking are now something that
"everybody" must know to be a standard cracker/reverser.

So, now (again), how can someone pretend to be a "+" ?
Is Dimedrol a potential "+" with his first Winrar 2.80 Keygen ?
Is Christoph Gabler a potential "+" with his works and his
generic unpacker ?
etc....
Is Christal a potential "+" with his works, tools which helped and help French newbies and also advanced crackers...
Is this person a potential "+" because he did 500 keygens ?
Hard to know... they have my respect and for me they are
virtual "+" :)

"lots of nostalgie for this periode" as DeeDee said... well, for me too.

Regards,

Lise_Grim
PS : I have to learn English quickly :)
tgodd
02-12-2003, 11:55 AM
No doubt Woodman deserves acclaim for
continuing this service.

Thanks Woodman.

As for the +:

There are many who do not have the +, that are well qualified
to attain it. There are many people without university degrees
that surpase the PH.D holders.

The + has and always will mean nothing to me.

People with accreditation, often Grow EGOs, which
tend to get in the way of there Intellectual capabilities.

As far as I am concerned we all do what we do to the best of our abilities.

Nobody deserves to be called a dummy, or stupid.

I've heard many a person talk with BIG words with hollow meaning.

To anybody that feels intimidated by anybody here:
Do not be intimidated by anyone.

Regards,

tgodd
JMI
02-12-2003, 12:28 PM
Which reminds me of the old joke that after going to college for four years, one can get a "B.S." degree and we all know what that stands for. If you go for an additional period of tine and write a paper, you can get an "M.S." degree which means "More of the Same." If you then continue on for a few more years, pass a test and write another paper (that almost no one will read) you can get a "Ph.D", which means simply that the original "B.S." is "Piled Higher and Deeper."

Regards.
tgodd
02-12-2003, 01:56 PM
Bwahahahahaha

I like that one.:D

regards,
tgodd
Woodmann
02-12-2003, 02:16 PM
HAHHAHAHAHAHAHHAHAHAHAA....

:)

JMI has written some very good things about the +
I can only agree with him and I certainly agree that
there are those teachers who can "teach"

I know that this topic can sometimes get a littly touchy.
Respect for others opinion is important, it is how and
why this place works.
I do not think I have every seen anyone here who has taken
exception to anyones skills.
Most of all you are kind to me ;) the one who has the least
amount of skill.

Peace, Woodmann
tgodd
02-12-2003, 02:34 PM
Oh come-on Woodman,

You kuda put a wee bit of ego into that.

:D

regards,

tgodd
JMI
02-12-2003, 03:34 PM
Wood:

Glad to see you are in it because you enjoy the history of RE. I always assumed you were in it for all the money you are making off running this board.:D :D (Oh, if they only knew the effort you have invested to keep it going for all, including the ungrateful.):)

As we used to say in the Nam, "F*ck'm if they can't take a joke, and Nuke'm 'til it hurts." Woodmann's a "+" in my book for simply keeping this effort alive, even if he doesn't know the proper football team to support. (Inside joke).:p

Best Regards.
Kayaker
02-12-2003, 04:51 PM
No arguments here on how the scene still remains alive after all this time and continues to develop. The Internet IS an interesting little worldwide social experiment. Somehow people around the globe get along and create something positive, even if it is only a discussion group. Too bad the real world can't behave in a similar respectful manner where the only border is your keyboard.

Regards all,
Kayaker
mala
02-13-2003, 06:08 AM
Hello everybody ;)

I'm very happy to write my first message here (well, unless I had registered previously with another name and forgot it, which might happen) about +HCU and the "plus" symbol. I'm happy because I always like to remember "good old times", as probably anyone does, and _these_ were _my_ good old times.

I'm also not sure about what kind of flames this message might start but hey, I trust in the board moderators ;) For the most polemic ones, understand that everything you'll read is written the way I witnessed it, and I just wanted you to know my thoughts about it. I'm not writing as an authority, because I'm not an authority at all: I'm an old cracker who (probably) cannot even rebuild a IAT, but who thinks that rebuilding a IAT doesn't solve many problems, while reversing does.

If anyone has already read this story on my website, please pardon me: I liked that so much I've decided to directly cut'n'paste a great part of it. Finally, if anyone of the old (but not SO old) school has anything to add to this story, I'd be glad to read it.

A long time ago, reversing wasn't called reversing. That was mainly because
people didn't reverse programs, but most of all because they didn't reverse
reality at all. Some of them had very good technical skills, but used them to
become famous, or even to make money, just by unprotecting programs. And even
if sometimes, thinking about those days, I wish that some of those gurus had
spread their knowledge instead of keeping everything for theirselves, now I
just think that it just wasn't the right moment. So, that period remains for
me as a Golden Era of Myth, where I could go out and buy a magazine with tons
of pirated videogames, and spend the rest of the day playing with them, good
as the original ones even if their names had always been changed... All I
learned from the beautiful intros of many games was that this art was called
_cracking_, and that some "elite" groups mastered that art so well that they
could unprotect almost any software.

Years later, a good and powerful master (whose real identity is still -and
probably will remain- unknown) decided to share his cracking knowledge with
others. Well, "with others" is not right: he wanted to share it with
_everyone_. That's why he decided to write and spread on the Internet a
collection of tutorials, in which you could learn from the basics of DOS
cracking to the standard of bar codes, reading something about Windows
protections and reality reversing too.

What was reality reversing? Well, it was just the same techniques you use for
software reversing, but applied to everything else which surrounds you in the
"real" world (how much will this world be the real one is another thing we
could speak about, but that's another story). And this doesn't mean you can
patch a jump in a person, or that you can debug a supermarket, at least not
with the same tools you use with a computer: this means, instead, that you
can use the same _mind_processes_ and _rational_techniques_ to crack a
program, reverse a piece of news inside a newspaper or buy a SBLive paying it
as if it was a SB16 (someone really did it just playing for a while with
barcodes...). And if the rational part of your mind still isnt' enough, just
follow the Zen way!

This great master was the first one I heard speaking about Zen Cracking, and
this is an idea nobody will ever be able to delete from my mind. Even now,
after so much inactivity, when I happen to crack something I sometimes still
can _feel_ the code and, as it happens when a Zen student reaches
illumination, I understand in a moment how everything works. If it happened
to you too, you can understand what I mean.

The man of Zen Cracking was +ORC, the Old Red Cracker, master for _all_ the
"pluses" you might meet in your life. If I remember well, he decided to use
that plus before his name to make it harder to find with search engines...
Anyway, all the people who wear that plus are either his students or have
decided to use it as a sign of respect to that wise man.

I was talking about students... Well, yes, because he didn't just upload his
tutorials and let them teach all the hard stuff for him, but he created an
online school for those who really wanted to learn the art of cracking. The
name of this school was "High Cracking University", and you might probably
still find something about it on the net just by searching for "+HCU" or
"+HCUckers", which is the name of its students.

I'm not one of the "first generation" students, because I reached the school
only one year after +ORC opened it. And while I was studying to solve the
"strainer" (which, IMO, was probably the easiest one in the whole history of
the university), people like +swann (the first student who published a tute
at +fravia's), +fravia (who created a website which has been a starting point
for most of the reversers you can meet now) and +gthorne (another mighty
reverser whose page has been the home of the great +orcpacks, and whose name
is still present in the +HCU*nix messageboard) were working together and
creating new tutorials which would have become guides for the next generation
of crackers.

I joined the +HCU during its second year of life, and published my first tute
on +fravia's after a few days. But the story of the +HCU is another story,
and I'll tell it another time. Since then, many years passed and I joined
other groups of reversers. I learned many new things from +HCUckers and from
other people (a big hug goes to all RingZero friends), but I still remember
what +ORC wrote just a few weeks after my admission...

I leave you with +his words: please read this mail, think that it was
October 1997 and look with your eyes how much he had already understood of
the future.

Now that you know the story, go and tell it to your kids. And if you feel
you respect this great man, feel free to put a plus before your name and/or
drop a 'hi +ORC' here in this forum (if the moderators agree ^__^). I'm
sure that wherever +he is now, if +he likes to browse his students' sites
from time to time, +he'll be happy to read this ;)

P.S. I'm sorry I had to cut away the mail +ORC wrote, but the message was getting far too long. If you like, I might post it as a separate message or you can download it from one of old fravia's mirrors.

P.P.S.: I found one URL to +ORC's mail:

http://hackjaponaise.cosm.co.jp/archives/websites/fravia/newuni.htm
tgodd
02-13-2003, 06:46 AM
1997 Not that long ago.....

I am sure then that many of the +'s have reversed my emulators then....

They know who I am then.

;)

regards,

tgodd
kugi
02-13-2003, 11:09 AM
Hi,

Thank you Woodmann and your crew for the fine job you are doing with the rce.

At one time the "+" was a big deal. Fravia would post a yearly "strainer" or test. Those who answered correctly were given the "+" by Fravia. Now, those who want to place the "+" with their handle do. Nothing to get excited about.

Regards, kugi
vgb
02-13-2003, 12:36 PM
Well, as one who has been around since Fravia's site was on Compuserve, it has been very interesting to watch the evolution of RE. The venerable +Orc was an almost magical entity - most cracking was target specific but still general enough to learn from.

Now, I think the 'mysticism'( if that's the right word ) is gone and we have some really brilliant work being done. I think the '+' is a remnant of that mysticism AND a sign of respect and achievement in passing the strainer and it's time has passed.

Been quite a while since I posted here, Woodmann - have had to re-up a few times because of it <g> but I also wanted to express my thanks to you for your interest and dedication. Maintaining an entity like this MUST be a labor of love - you sure aren't gonna get rich running it!

Take care,

vgb
Devine9
02-13-2003, 11:17 PM
Yes but above all I think that now is the time to move forward. This board talks about reversing the PE a lot.. Something I'm not fully directing my attention towards these days. There is an immeasurable amount of other things out there in this world to be reversing. To borrow a small quote from +Ma (mala), "2003 is the year of reversing." I think the reversing side of things has been on a down slope for some time, but things are beginning to change now. I look forward to the year to come, with or without the + ;)

Devione Right [RET]
http://ret.mine.nu


Code Patch Creators
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Code Patch Creators
PDA

View Full Version : Code Patch Creators

squidge
02-11-2003, 01:14 PM
Patched an application for a friend, but can't be bothered to code up an app for it. I also don't want to email the patched files, as they are 10mb each.

So - what code patch creators are there out there so are half-decent?
naides
02-11-2003, 04:19 PM
dogbert patcher from www.anticrack.de (see below) worked fine for me.
squidge
02-11-2003, 05:47 PM
Thanks.

Really should have made myself more clear however. I'm looking for a program like that, but one that will take multiple files, and create a single executable output.

For example, if I modify 5 files, I'd like it to patch the 5 in the same exe, instead of having to run the program 5 times and end up with 5 different patch files.

Not found anything on Protools however, and from a quick search on the net, it seems like I'll have to write it myself :(
disavowed
02-11-2003, 06:34 PM
squidge, where did you learn to crack? :)
why do you have 5 patched exe's, all with patches in non-overlapping places??
peterg70
02-11-2003, 07:06 PM
@squidge

If you create something let me know. Hate creating patchers for each file.
Maybe a generic front end that reads in a database and can have multiple entries. (then can store all patchs into one program)
And a Scanner program to add new information to the database.

@disavowed

maybe they are not all exe. but rather the main exe and a DLLs plus changes. Some programs tend to have a few frontend exe's and these need to all be modified in some manner.

anyway my 2 cents worth
peterg70
disavowed
02-11-2003, 07:55 PM
ohhh.. i misunderstood...

i thought there was one exe that needed patching in 5 places, and instead of progressively patching it, he patched each different spot seperately in each copy of the original exe :)

i guess now my "wtf" response makes sense :P
JackD
02-11-2003, 08:55 PM
CodeFusion 3.0 by Kobi, 1999 will do the trick and is readily available and easy to use. Try ProgrammersTools or the likes.

JackD
naides
02-11-2003, 09:30 PM
Sorry for the missunderstanding, Squidge.

There are several shareware apps in which you provide a folder with the original files, a folder with the updated files, and it does the job of comparing file by file, storing changes and producing a compact patcher.

RLN PatchMaker is one of them. There is another one I have used before, but is in my work box, and I don't remember the name
squidge
02-12-2003, 02:56 AM
Thanks, I'll have a look at CodeFusion and RLN PatchMaker.

@ disavowed: peterg70 is right. For this app, the main exe, the apps dll and a .cdr file need to be modded. They are all modded with the exact same code (as I overwrite the same function in each), but at a different position.


cant find address range
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > cant find address range
PDA

View Full Version : cant find address range

bosey
02-12-2003, 11:00 PM
Im guessing this is an elimentary question but just need some confirmation as to what is going: I am attempting to crack my first prog - im not going for anything glamorous, just a 'jz' to 'jmp' if poss.

I have dissambled in w32dasm and seen that the address range goes upto ~0044xxxx. Back in Wice I break the prog using
'bpx getdlgitem' at the 'incorrect password' dialog, no probs. the thing is, the address in the code window is in the 77xxxxxxx kinda range - totally outside the exe.!

Does this mean it uses an imported (win) .dll (which means i cant mess with it, right) or am i doing something daft.

Forgive me if this is a dumb q, but I didnt even know what assembly was 2 days ago:D (is there a thing newer than a newb?!)

cheers all.
triz-
02-13-2003, 12:28 AM
The reason it's in address range 77xxxxxx when it breaks is because that's where the function itself is; SI breaks on the function itself, not the call to it. Once it breaks on the function, you need to return from the call (hit F12) to see where it was called from. You can then go about manipulating your victim as you please. :D

Don't worry about being new; everyone starts somewhere. :)
bosey
02-13-2003, 06:30 AM
nice one! I hoped it would be an easy one,

thanx.:cool:
naides
02-13-2003, 09:25 AM
Originally posted by triz-
The reason it's in address range 77xxxxxx when it breaks is because that's where the function itself is; SI breaks on the function itself, not the call to it. Once it breaks on the function, you need to return from the call (hit F12) to see where it was called from. You can then go about manipulating your victim as you please. :D

Don't worry about being new; everyone starts somewhere. :)

Actually F11 will send you back to your program code.
F12 (pret) will take you only as far as the next ret instruction, which may still be up there inside the code bushes of the system dll(s).

to Bosey: The windows system dll(s) should not be messed with (not routinely anyway), but YOUR application dll can be modified for cracking purposes.
bosey
02-13-2003, 09:52 PM
cheers, after a couple of minutes i twigged what was going on,

regards.;)


Code Snippet Creator question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Code Snippet Creator question
PDA

View Full Version : Code Snippet Creator question

Maldoror
02-13-2003, 04:48 AM
Hello

I have two questions regarding the Code Snippet Creator by Iczelion.

Let's suppose we have a function Func1 located at(for example) VA 4091B0h in our target. We insert our snippet written in MASM32 in a new section.

1. How to call the function at 4091B0h from the snippet?
Here is what I do:
The MASM32 doesn't allow just to write:

MyProc proc
call 4091B0h
MyProc endp

For that reason I use the following:
Func1:
;push parameters of 4091B0h here
push retAddr
push 4091B0h
ret
retAddr:
ret

MyProc proc
call Func1
MyProc endp

This works fine but I think this solution is not very elegant.
So the question is:
Is this the way to call functions in the target?

2. If this is the way there it is still something that is not very clear to me.
How to deal with the relocation problems that may arise with this
push 4091B0h
ret
mechanism?
Possible solutions are:
1. Patch the target relocation table
2. Use RVA instead of VA and calculate the real address at runtime i.e. GetModuleHandle + RVA

What do you think?

Regards!
Maldoror
ZaiRoN
02-13-2003, 06:50 AM
Hi Maldoror,

I think the problem resides in the compiler you use, masm in this case. Infact, masm doesn't allow you to make a call with a direct address like you want to do. You have always to make a sort of indirect call using your push/ret combination or something like:
mov eax, <address>
call eax

or

address dd 4091B0h
...
call address

In this way you also should solve your relocation problem.

There is maybe another way to solve your problem. You can try to make the call using the code segment before the address. I have tried this way sometimes with jmp instruction and it worked fine. I have not tryed calling a 'Call' (sorry:)) in this way but you can try to use something like:

Call segment:address
or
Call dword ptr segment:address

Hope this help you.

ZaiRoN


Need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help
PDA

View Full Version : Need help

cupidon
02-13-2003, 05:01 AM
I used to post one message yesterday.
I have a problem trying to crack go screen. It seems to have trial period and we can put a serial number to register.

I used softice and W32DSM89

The problem is:

when we enter a serial, no message is displayed if it is wrong or right.
and for the trial period protection, just a msgbox is displayed and when we disassembly the prog no string can give information.

i tried some api, getLocalTime,...

heeelllp :)
FoolFox
02-13-2003, 10:30 AM
Hello,

I've just looked 2 min, so maybe my advice may not be the best, and I didn't use SoftIce, but looking with OllyDbg:

Actually there is a message. Kind of "take care to the way you write the message". Not found in main exe.... but you may
have to search on this string....from where does the prog
get it ?

But if this is not working, think another way :

0040868D > 6A 01 PUSH 1 ; /IsShown = 1
0040868F . 6A 00 PUSH 0 ; |DefDir = NULL
00408691 . 6A 00 PUSH 0 ; |Parameters = NULL
00408693 . 68 E0524500 PUSH goScreen.004552E0 ; |FileName = "https://www.regnow.com/softsell/nph-softsell.cgi?item=1596-1"
00408698 . 68 A4524500 PUSH goScreen.004552A4 ; |Operation = "open"
0040869D . 56 PUSH ESI ; |hWnd
0040869E . FF15 40534400 CALL DWORD PTR DS:[<&SHELL32.ShellExecut>; \ShellExecuteA

What does this does ? open IE for registration page ?

Where do you go when you click the Buy button ? :

h**ps://www.regnow.com/softsell/nph-softsell.cgi?item=1596-1

mmmm.....

maybe looking around may help you, trace back where this
part was called should land you in the section where there
is a choice, either the user press the Buy or Register button,
you have foudn one, finding the second may help you to
solve your trouble.....

to find where it goes when the other button is pressed...

Regards
FoolFox
cupidon
02-17-2003, 04:28 AM
Thank you for your help, but it is not really helping me.:)

I know now how it works, it set many information in the registry. And create a key called RegNo where it puts the serial number.
But i still not be able to find the serial routine.
i put a bpx regqueryvalueexa but :( no luck it breaks many times) and i dont find the right place.

You can have a look to help me a little bit more ?

thx in advance.

Cupidon.
Aimless
02-17-2003, 04:55 AM
You need to change the tools. Use IDA (freeware) and a good resource editor.

If the error message is NOT in the disassembly, chances are that it is in the stringtable. Therefore, find the stringtable identity, convert to hex and search for a relavent push.

EG:

....sample string table.....

0987 "Thank you for registering"
0988 "You are on the last day of your trial"
0997 "Please contact you local dealer..."
9966 "Sorry, your trial has expired"
9967 "Application Name"

Now in the disassembly, the code would look like:

push 12
push 26EF
push 26EE
push 23
Call MessageBoxA

No string. Your message cannot be seen. So search for the push 26EE or 26EF (note, they are HEX versions of 9966 and 9967)

You have encountered the error message. You can take it from there.

Have Phun
Manko
02-17-2003, 07:01 AM
If you wanna go the path of regqueryvalueexa this might help...

(esp+0 ReturnAdress)

esp+4 HKEY hKey, // handle of key to query
esp+8 LPTSTR lpValueName, // address of name of value to query
esp+c LPDWORD lpReserved, // reserved
esp+10 LPDWORD lpType, // address of buffer for value type
esp+14 LPBYTE lpData, // address of data buffer
esp+18 LPDWORD lpcbData // address of data buffer size

(Hmm... adress should be dword and size byte... a typo in win32.hlp?)

when it breaks do d *(esp+8), to see if the right key is being read.
then do a d *(esp+14) to see where the result will be stored.
(ofcourse emty until...) press f12 to make it happen. if it's the right data do bpm on that adress, else push f5 and wait for it to pop again...
I tried and got both serial and name. But I got lazy and didn't follow it through.... it did som stupid computations on the name, over and over again... :(

SORRY!!! I put esp-x where it's supposed to be esp+x...

/Manko
cupidon
02-18-2003, 02:21 AM
Thx Manko,
but what's about this sentence ?
SORRY!!! I put esp-x where it's supposed to be esp+x...

I tried, what u said, when softice break, after the "Push" button pressed, I looked esp+8 ok i saw the name i entered for example "Test" but i dont see my serial.

Sure you saw ?
squidge
02-18-2003, 02:31 AM
If I understand this post correctly, you are using the regqueryvalueexa function, therefore your not going to find a serial number with that unless there's already one stored in the registry (in which case, an easier method to find it would be regedit).

I assume your serial digging, in which case you'll need to trace the code following the regqueryvalueexa code to see how it generates (and compares) it's serial with the name you entered.
cupidon
02-18-2003, 02:39 AM
Yes you are right ...
With regqueryvalueexa i will see where it wants to store my serial.

But i try to find the right serial too. The problem i dont know where to search.
This software doesn't popup a window to say "Your serial is incorrect" ... so i'm searching what it's doing with my serial.
squidge
02-18-2003, 02:59 AM
once it has read your serial/name, set a memory breakpoint on that location and let the program run. As soon as it messes with it, the program will be halted.
cupidon
02-18-2003, 03:18 AM
Yes it is what i should do, but i dont know where to put my bpx cause .... as i said nothing is helping me for example a messagebox.
when i press button, try to get the software at this address, it doesnt need to install it hxxp://home.eol.ca/~andgur/software/goscreen.html and u will see in the property meny, about frame, when you click "Register" type ur serial, and push the button named "push" nothing is said.
:mad:

so where to put the bpx is a good question.

maybe a bpx GetDlgItemTextA ? and follow the code ? Can you have a look, i would like to understand how it works.
squidge
02-18-2003, 03:48 AM
it doesn't need to say anything - when it pulls your name from the edit box after you push the button, it stores your name in memory. Placing a memory breakpoint at this location enables you to see what code is used to check the name and serial are valid. Trace through this code to find out how it gets to this decision.

No dialogs are needed.
cupidon
02-18-2003, 04:35 AM
I think we have a problem to understand each other so, to be clear, what's kind of api function can be called to pull my name and serial from the Edit Field ?
Because if i want to put a memory breakpoint i need to know where to put it right ?

P.S: sorry for my troubles....
squidge
02-18-2003, 04:41 AM
maybe a bpx GetDlgItemTextA ? and follow the code ?

That'll do.
Clandestiny
02-24-2003, 11:35 PM
Hiya,

Seems the programmer of your little GoScreen target was a little more clever than average since he didn't leave a "bad boy" messagebox ;). Admittedly this makes the task slightly more difficult, but by no means impossible. I would suggest that you start by locating the wm_command message handler for when the 'register' button is pressed.

If you examined your target properly, you should have noted that it was coded C++ using the Microsoft Foundation Classes. I had a look at your target and after digging around a bit I have concluded that finding message handlers in MFC apps is even easier than regular Win32 applications.

You see, MFC stores information about all of its message handlers for a program in a table called AFX_MSGMAP. This table consists of an array of message map structures as follows:

struct AFX_MSGMAP_ENTRY
{
UINT nCode //windows message code (wm_command is 111)
UINT nID
UINT nLastID //control ID
UINT nMessage
UINT nSig
AFX_PMSG pfn //pointer to handler function
}

In this case, since we are want to know what happens when a button is pushed we are going to be interested in the wm_command message. Therefore the message value for the nCode member will be 111 for wm_command. We can also verify the control ID for the register button by using a window spy utility. And of course we will be able to extract the pointer for the handler function from this structure… Well, once we find it…

…And that brings up the most important question… How do we locate this array of AFX_MSGMAP_ENTRY structures? As it ends up, MFC makes it quite easy for us. There is a function called AfxFindMessageEntry. The prototype follows:

const AFX_MSGMAP_ENTRY* AFXAPI AfxFindMessageEntry(const AFX_MSGMAP_ENTRY* lpEntry, UINT nMsg, UINT nCode, UINT nID);

The good news is that our target uses this very function to look up it’s own message handlers! All we have to do is exploit it. Sooo, given some basic information about the message and the identifier of the control, this function will return the pointer into the array of AFX_MSGMAP_ENTRY structures that we need. Once we’ve got this pointer, we can easily extract the address of the handler function for the register button. Dare I theorize that once you have the handler for the register button, the serial routine can’t be far off (OOP at its finest, of course, heh, heh ;) )

Hope this makes sense… I actually don’t know a damn thing about MFC, but a little RE with IDA and the MSDN goes a long way ;) :D .

What's great about all this is that it lays out a *generic* procedure for finding all kinds of message handlers in MFC applications... Lots of RE possiblites :D

Cheers,
Clandestiny
cupidon
02-25-2003, 07:15 AM
I like your explaination ....
So i will look ....
cupidon
02-25-2003, 12:44 PM
I used a ressource editor to see if i can get the id of the Register Button but nothing ... maybe he creates it dynamically.

Your explaination is good, but I still can really understand, i looked with IDA, i found where was used AFxFind I looked around but it's quite hard to get the pointer ...
Manko
02-25-2003, 01:55 PM
Windows captures.

Spy & Capture by Kobi Krichmar. 06.VIII.1999.
Spy & Capture 2.7 (247K).

On programmers tools.
It will get you the id of any part of a window... ar atleast a program like it should be able too. Don't know if thats the one I've used before...

/Manko
Clandestiny
02-25-2003, 08:07 PM
Yeah, you're right... Its created dynamically so you won't find the ID in a resource editor. Really, you don't need the ID, per se, except in the sense that you want to verify that AfxFindMessageEntry is returning you a pointer to the handler for the control you're interested in. If you have Visual Studio, you can use the Spy++ tool to get this ID.

Your explaination is good, but I still can really understand, i looked with IDA, i found where was used AFxFind I looked around but it's quite hard to get the pointer ...

No, its actually quite straight forward to get the pointer... Here is a procedure you can follow that may help you to understand...

1) Locate where AfxFindMessageEntry is called in IDA and write that address down.

2) Use a message spy utility to retrieve the handle for the parent dialog and the register button's ID.

3) Now set a bmsg 'parent dialog handle' wm_command in SoftICE.

4) Click the register button and SoftICE will break. You will be in the window procedure for the dialog box and you can examine the stack to determine if this wm_command message is directed at the register button
.
BOOL CALLBACK DialogProc(

HWND hwndDlg, // handle to dialog box
UINT uMsg, // message
WPARAM wParam, // first message parameter
LPARAM lParam // second message parameter
);

If you look at the stack you will see the uMsg parameter which will be 111 for the wm_command message. The wParam and lParam values are determined by the specific message so have a look at wm_command in your API reference:

WM_COMMAND
wNotifyCode = HIWORD(wParam); // notification code
wID = LOWORD(wParam); // item, control, or accelerator identifier
hwndCtl = (HWND) lParam; // handle of control

You can now examine the wParam argument on the stack to make sure that the low word matches the ID for the register button. I make this note because other controls may also send wm_command messages (SoftICE broke a couple of times for me on wm_command messages for the edit controls before it broke on the wm_command sent by the register button).

5) Now, you know that the AfxFindMessageEntry function will be called somewhere in this WndProc to look up the actual handler for our register button so you can go ahead and set a breakpoint on it.

6) SoftICE will break. Once again you can look at the fucntion prototype and verify the parameters passed on the stack match up with the wm_command message and the register button's ID.
const AFX_MSGMAP_ENTRY* AFXAPI AfxFindMessageEntry(const AFX_MSGMAP_ENTRY* lpEntry, UINT nMsg, UINT nCode, UINT nID);

7) Step over this function in SI. An address will be returned in eax. This address is an index into the AFX_MSGMAP table. It specifically points to a structure of type

struct AFX_MSGMAP_ENTRY
{
UINT nCode //windows message code (wm_command is 111)
UINT nID
UINT nLastID //control ID
UINT nMessage
UINT nSig
AFX_PMSG pfn //pointer to handler function
}

8) Extract the handler address (which is clearly offset 6 DWORDS from the pointer to the structure returned from the previous function call).

And there you have it... Now you can set a breakpoint on the handler address and trace for the serial routine.

Hope this helps,
Clandestiny
cupidon
02-26-2003, 03:13 AM
First, Thank you to spend time to help me and sorry to be a little bit silly :p but it's strange, if i put a break point on the window handle of the dialog box SICE break everytime.
So i will not b able to push the button.
Clandestiny
02-26-2003, 08:28 AM
Originally posted by cupidon
First, Thank you to spend time to help me and sorry to be a little bit silly :p but it's strange, if i put a break point on the window handle of the dialog box SICE break everytime.
So i will not b able to push the button.

You're welcome :) I used to be a newbie too (still am in a lot of respects) I'd semi-retired from RE for a few months, bit I'm getting back into it a little bit... ;)

If you just place a breakpoint on the dialog window handle without specifying the message *type*, then yeah, SI will break constantly because there is a constant stream of messages being sent to that window. Thing is, you're not interested in most of these messages. Thats why you place the breakpoint on the window handle so SI will only break when the wm_command message is sent.

bmsg 'window handle' wm_command

Now, as I noted previously, there are other controls that can send wm_command messages (like those edit controls). That is why you need to look at the stack when SI breaks and verify that the message is for the register button.

Cheers,
Clandestiny


Why is the Fravia mirror redirect URL point to this board?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Why is the Fravia mirror redirect URL point to this board?
PDA

View Full Version : Why is the Fravia mirror redirect URL point to this board?

dELTA
02-13-2003, 02:07 PM
Does anyone know why the redirector URL to Tsehp's "Last Fravia Mirror" (http://tsehp.cjb.net) nowadays points to this board instead of the correct URL (http://www.woodmann.net/fravia/index.htm)?

This board already has its own redirector (http://fraviamb.cjb.net), which is still working fine, and the Tsehp redirector URL is even listed below as a link to the Fravia mirror?!

What's up with that?
Woodmann
02-13-2003, 04:18 PM
Hmmmmmmmmmmm........

Perhaps it is an oversight ?
We will have to wait for the owner of the redirectors
to make the needed changes.

Woodmann
dELTA
02-14-2003, 05:34 AM
Ok, thanks.
I thought it might be a mistake at first, but since it's been like that at least since the server move I thought that someone else than me would have noticed. Well, trust noone I guess. ;)
dELTA
02-14-2003, 08:28 AM
Err, now someone has changed both the above redirectors to point at the Microsoft website? Joke, or something else?
tsehp
02-14-2003, 10:38 AM
hi, it was me (tsehp) making some tests. everything back to normal now.
dELTA
02-14-2003, 11:03 AM
Ok, I'm glad to hear. :) Thanks!
tsehp
02-15-2003, 01:51 AM
no pb, we had to make 2 moves in the last 2 weeks and will surely move again in the next days, don't worry the board will still be there tall and proud ;=)

later,

tsehp
dELTA
02-15-2003, 05:52 AM
Ok, I'm sad that you're having trouble with the hosting of the board. :( I pray that it will still be around anyway, because I really love this board and all the knowledgeable and nice people on it!

Btw, may I ask why you are using this "test22" account instead of your own? It was a very long time since I last saw you post on the board with your own account, I sometimes even think that you are about to leave/quit. :( So I was very worried when the woodmann server was down the other day. Please drop by now and again and show us, the weak of faith, that you're still alive and kicking. ;)

Thanks for your efforts in making this board survive!
(and all you other admins and moderators too)
tsehp
02-16-2003, 10:11 AM
hi,
the test22 account was used because I was on vacations and only had little time to work, now everything back to normal.

I'm still here, but now I've got less time than before, lots of things in my life changed (I'm in an engineer computer school a3rd year now), so I restrain now to be the administrator of the server, helping woodmann and other moderators to maintain it and move it fast in case of our host don't please us anymore (never the opposite ;-)

In the near future, meaning the 4 and 5 year of my studies, I could bring surely new additionnal directions of this site, just because the school have a security and virus department, but the section that will be built will surely oriented to know them better and secure a system against them, we have some challenges and machines to hack and attack in our school for this purposes, so I have some ideas to bring there in a near future, if I manage to get assistance on this fact, we will have lots of fun.

I wouldn't say that I never had the idea to quit, but woodmann and me are too close to let everything down like this, the place took a long time to build, so in the case we abandon it this will be a double decision but it's out of question actually.

thanks a lot, to ask, I'm still available to everyone on my usual mail if someone wants to get news.

best regards,

tsehp
dELTA
02-16-2003, 02:50 PM
Thanks for the info Tsehp, I feel much better now, phew. :)

And really cool to hear about the ideas for the new areas of the board! Computer security and viruses are both big interests of mine, and I have relatively much experience in both areas (let's just keep it at that, shall we ;)). It also feels like it's "closing the circle" regarding the subjects of the board, since they are all very related. But just like you say, it would probably be very important to keep it at a "professional level" though, just like this board has succeeded so very good with for the current areas, or some people will surely try to take their first chance to use it to shut the board down. :( Anyway, I would be glad to help in any way I can with these potential new areas of the board (or the current areas too of course if the workload is already too high). See my mail for more info.

Respectfully,
dELTA

PS. The tsehp relocator is down again. ;)


arthaxerxes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > arthaxerxes
PDA

View Full Version : arthaxerxes

cHeCksUm
02-13-2003, 03:07 PM
Never mind... borrowed a tape drive from my firend and restored the file :).

// cHeCksUm


EXEStealth - SPOILER - Unpacking!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > EXEStealth - SPOILER - Unpacking!
PDA

View Full Version : EXEStealth - SPOILER - Unpacking!

Manko
02-13-2003, 07:10 PM
Since someone asked, though it dissappeared...

Exestealth 2.6 - Not so good protector... :(

558BEC578B45108BB8C4000000FF3733FF648F078380C400000088BB8A4000000C1C70789B8B8000000B8000000005FC9C3

55 push ebp
8B EC mov ebp, esp
57 push edi
8B 45 10 mov eax, [ebp+10h]
8B B8 C4 00 00 00 mov edi, [eax+0C4h]
FF 37 push dword ptr [edi]
33 FF xor edi, edi
64 8F 07 pop dword ptr fs:[edi]
83 80 C4 00 00 00 08 add dword ptr [eax+0C4h], 8
8B B8 A4 00 00 00 mov edi, [eax+0A4h]
C1 C7 07 rol edi, 7
89 B8 B8 00 00 00 mov [eax+0B8h], edi <<==--- !!! NOW OEP is in edi. !!!
B8 00 00 00 00 mov eax, 0 """"""""""""""""""""""""""
5F pop edi """ """
C9 leave
C3 retn

This proc will reveil OEP in exestealth... :)
Take out a signature and search with winhex, when proggy is running.
Note down adress and rerun program and break on this adress to get OEP!
When dumping, with procdump, don't forget, rightclick, correct imagesize!
When rebuilding IAT, put in oep, search and get imports and click show invalid and rightclick+tracelvl1. All good!

How did I find proc?

Pack an app you know's OEP. Break on OEP. Walk the stack backwards, looking real carefull as some things are not simply returnadress, making new breakpoints as you go along, and reach this proc. Trace it down to mov [eax+0B8h], edi and say heureka! :D
You SHOULD practice this! :p

!!! ? !!!
Remember, I have hidden my softice... You need to do that too! (Don't really know that since I haven't tried without it.) Info about that can be found elsewhere on fraviaMB if you search! Ask how, if you can't manage it... :p (But don't be lazy and not try yourself!)
!!! ? !!!

Also, let's hope the author will now improve it. :p

/Manko
bedrock
02-14-2003, 08:23 AM
Manko, thanks for this great info. I have been struggeling with this for about a week now, but following your info i have unprotected and rebuilt the imports for my target and it is working 100% now.

Thanks a lot man.
Manko
02-14-2003, 03:32 PM
Any time! :)

If you see to it you learn something from this, I will be happy! :)

/Manko
neviens
02-15-2003, 08:41 AM
One week?! Why you didn't ask for more help here? Well,
I understand, that a learning is important, but to trash a
week for this, khmm.., "protector" !?

I take a look @ one ancient IDA listing and here is:

1. In Sice you have to pass 1st SMC code with F10, while
following code appears:

nop
call _CRC1
mov ss:_CRC1Result[ebp], eax
mov eax, ss:_ProtectionFeatures[ebp]
and eax, 1 ; Sice, SmartCheck, Idag check
jz short _toGetProcAddresses

In variable _ProtectionFeatures[ebp] protector stores, what
protection features are enabled (1h=Sice check, 2h=erase
EXE header, 4h=erase imports, ...). Simply put a zero here, and all that is gone!

2. Continue F10, while following code appears:

mov ebx, ss:_ImageBase[ebp]
add ebx, ss:_OEP[ebp] ; OEP is here!
ror ebx, 7
mov [esp+10h], ebx

I think explanations isn't necessary :). Only note, that
Manko found it in other place, those ror, rol are encrypting,
decrypting instructions to hide OEP for some time.

3. After dumping @OEP remain the usual procedures:
PE header corrections and IT creation. For short programs
I don't use Revirgin or Imprec but simply write the damaged
IT by hexeditor (if you are familiar with IT structure,
it's easy). Result is "perfect crack".

I fully agree with Manko, that this "protector" requires
a serious upgrade :).
Neviens.
Manko
02-15-2003, 01:10 PM
Hi, Nievens!

This IDA listing seemed very nicely commented.
Did you do it yourself? Did it not take you at least some time, and WHY the work if it's just some crappy trash-protection... ? :p

I know that when I was even more of a newbie some months back, I knew next to no asm. I would have gotten nowhere in a week and probably given up after few hours even. :)

I give recognition to persistence and hard work when I hear about it! I know I would not last that long, and I'm not even suffering from tender age syndrome... :p

It was REALLY interesting to hear about that single point of security! Hehe... I knew it was crappy. But my god! ... :D

Anyway, gotta rush, time for eurovision song contest! :p
(I really was in a hurry. Ofcourse it was only the preliminary swedish tryouts... or something...)

/Manko
bedrock
02-16-2003, 05:22 AM
I guess my persistence counts for something then :D The thing is someelse had already cracked the target i was looking at, but i really wanted to unprotect it myself.

Once Manko helped me find OEP everyting was ok. Thanks for all your comments guys.


new primality testing algorithm?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > new primality testing algorithm?
PDA

View Full Version : new primality testing algorithm?

crUsAdEr
02-14-2003, 05:25 AM
Not sure if this has been posted or not.. but i was refered to this paper about new method of primality testing which is very fast.
http://www.cse.iitk.ac.in/news/primality.pdf
mike
02-14-2003, 09:10 PM
Actually, it's not fast at all. There are probablistic tests that run orders of magnitude faster. But they can only say that a number is "probably" prime (albeit with a very high confidence level). This paper's important because it gives an algorithm that is guaranteed to run in less than a fixed constant times the number of bits to the twelfth power (rather than exponential in the number of bits) and is guaranteed to give the right answer.


bpx problem in SoftIce
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > bpx problem in SoftIce
PDA

View Full Version : bpx problem in SoftIce

BitBanger
02-14-2003, 01:01 PM
Hello,

I encountered the following problem when using bpx type breakpoints in SoftIce. When setting this kind of breakpoint in some applications program generates exception (execution of int 3 instruction) and is terminated when program flow reaches the address of bpx. Then when i remove bpx in SI by bc command and run the program again, the int 03 instruction is still at address of previous breakpoint even after I removed it in SI and stays there until i reboot the system (i did not yet discovered how to remove this int 03 instruction without reboot). My question is: Is this behaviour caused by the protection of the application which detects breakpoints and "patches" the program or is it problem of some other kind?

Thank you for your help.
BitBanger
JMI
02-14-2003, 02:20 PM
BitBanger:

Since this is your first post and it raises a subject discussed several times before, it would appear that you did not follow your instructions to Read the FAQ (Frequently Asked Questions). Among the advises you would receive there is that you should do a search, using the search button at the top of each Forum to attempt to determine whether your question has been asked, and answered before. You obviously did not do that.

Secondly you need more detailed information to provide a viable response, such as the OS you are using and the version of Softice. Try "softice + Breakpoints" and/or "XP + breakpoints" and you will find a good analysis of prior questions and the reponses.

Regards.
BitBanger
02-14-2003, 03:17 PM
Excuse me for the question. I found some information in previous posts about the subject. BTW i encountered this problem on win 98 with SI 9x v 4.05.334

BitBanger


String references in Olly ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > String references in Olly ?
PDA

View Full Version : String references in Olly ?

Aquatic
02-14-2003, 04:24 PM
When I open the game in Olly and search for "All referenced text strings" in the CPU window it gives me a lot text strings.

But when I disassemble the game in W32dasm it doesn't give anywhere near the same amount of text strings. So, I am thinking that maybe the text strings from Olly are useless?

Basically I am going to the addresses where the text strings are pushed and then trying to find out how to manipulate the corresponding code.
Aquatic
02-14-2003, 04:43 PM
Also, the game crashes when I try to run it from Olly or do "attatch process".
_Servil_
02-15-2003, 04:13 AM
Then your game is most likely using some antidebugger trick/s, there are several kinds of these, search the board to get more info about them.

About the strings, I dindt;use w32dasm for long time but as I can remember the difference is that W32 handles only strings referenced by code while OllyDbg searches whole module and finds all chunks of code possibly being texr. You can lookup the reference point by invoking context menu upon that entry and selecting 'Find references' or put a memory breakpoint on accessing it's first character.
Aquatic
02-15-2003, 04:53 AM
Originally posted by _Servil_
Then your game is most likely using some antidebugger trick/s, there are several kinds of these, search the board to get more info about them.

About the strings, I dindt;use w32dasm for long time but as I can remember the difference is that W32 handles only strings referenced by code while OllyDbg searches whole module and finds all chunks of code possibly being texr. You can lookup the reference point by invoking context menu upon that entry and selecting 'Find references' or put a memory breakpoint on accessing it's first character.

Hmm, first I need to get the game running from Olly without it crashing.

I can get the game running with Softice in the background, but I want to be able to run it from Olly. I can't find a way to do this.
Aquatic
02-15-2003, 05:07 AM
w00t! I managed to do an 'attatch it to the process' without it crashing! I had to use that Int3/Int1 program...

Anyway, can you make it a little clearer about the string references in Olly? Will the referenced text strings found by Olly actually lead me to any useful code?
_Servil_
02-15-2003, 07:17 AM
Can't answer this question, don't know your game and first of all you must know what you are seeking. Respective string might or not lead to... Why don't you try it self? If it finds a string it means the string is there nothing more or less, you just haveto decide what's it useful for...
Aquatic
02-18-2003, 03:12 PM
Maybe if I take a string I find in Olly and then search for it in the game's memory while it is running. (doing an ascii search)
squidge
02-18-2003, 04:38 PM
and what use will that do apart from give you the exact same addresses as what ollydbg itself has found?

now, searching for the string ADDRESSES may yield something...
Aquatic
02-18-2003, 05:20 PM
Originally posted by squidge
and what use will that do apart from give you the exact same addresses as what ollydbg itself has found?

now, searching for the string ADDRESSES may yield something...

Not sure that I know how to do that. :confused:

In Olly when you do 'search for all referenced text strings' it gives you all the addresses where the strings are pushed.

For example

*Code removed*

Where 'xxx' is the process name (blanked out).

So, I know where the string is pushed, but don't know how to get the address of the actual string.

Any ideas?
squidge
02-18-2003, 05:31 PM
In your example, "ReloadTime" is the text, and the address by the push is the address of the string - 785D88.

However, if Olly gives you the reference by telling you what statements actually refer to the string, then it's pretty useless anyway as Olly is doing it all for you.

So, now you are armed with this information, it's time for you to decide whether these strings are useful or not for the task you have in mind.
Aquatic
02-18-2003, 05:36 PM
Originally posted by squidge
In your example, "ReloadTime" is the text, and the address by the push is the address of the string - 785D88.

However, if Olly gives you the reference by telling you what statements actually refer to the string, then it's pretty useless anyway as Olly is doing it all for you.

So, now you are armed with this information, it's time for you to decide whether these strings are useful or not for the task you have in mind.

What do you mean by 'statements' ?

Sorry, I'm pretty new at this.
squidge
02-18-2003, 05:45 PM
Sorry, I mean Mnemonics (I think)
Aquatic
02-18-2003, 05:59 PM
Originally posted by squidge
Sorry, I mean Mnemonics (I think)

Where does Olly tell me the 'statements' that refer to the string?
Manko
02-18-2003, 06:29 PM
Let's say your interested in what happens to the textstring "reloadtime". You get all references and investigate the code around the instruction that loaded/manipulated them.

005ED7F7 |. 68 885D7800 PUSH xxx.00785D88 ; ASCII "ReloadTime"
""""""""
^^^^^^^^
||||||||
This is the place! The code around this adress will perhaps be interesting.

I do not want to put you down, but these things are pretty basic and will be obvious to you once you get some practise. You should practice "simpler" cracking first. Getting to know tools and how code functions. There are numerous tutorials att krobar's site. Start in the newbie-section and try to understand what's going on. Tutorials often give you a short route to the answer, try to learn as much as you can anyway. Ask as many questions as you want here, we will try to help, but learning requires a lot of effort on your own behalf too... And getting results on the things you most desire might have to wait sometimes, till you have a better grasp of things. :)

/Manko
Aquatic
02-18-2003, 07:26 PM
Thanks guys.

I am doing some other basic learning stuff, but I just wanted to get some feedback from more experienced ppl.

Anyway, it looks like the address for the string is outside the scope of the game's code. I disassembled it in W32Dasm and the last address it gives doesn't come close to *Code removed*.

The tutorial I am learning from is here: http://www.s-i-n.com/chaos/strmemory.htm
(gives you an Idea where I am coming from).

Basically I looked for a JNZ in the code around the *Code removed* address and didn't find one.
Aquatic
02-18-2003, 08:00 PM
Originally posted by Aquatic

Anyway, it looks like the address for the string is outside the scope of the game's code. I disassembled it in W32Dasm and the last address it gives doesn't come close to 00785D88.

yep, when I do an attach process in Olly it gives me a message:

*Code removed*

This is probably where my string is stored. Although that module could be something completely different, in which case I don't know where that string is being stored.
squidge
02-19-2003, 02:30 AM
In Ollydbg, Select the "View" menu item, and then select "Memory". Find the closest memory location next to your your location and then write the entire line in this group and we'll tell you what it means. For example, the nearest to 785D88 could be 785000.
Manko
02-19-2003, 02:54 AM
I looked at the mentioned tutorial. It was pretty nice. You need to perhaps read it again. It explained what you were supposed to look at. It also talks about packed programs, which seems to be the case here. May I ask what your target is and what string you have chosen to look at and have you tried to see what it is packed with, using for example PeID?

...and they have not always made it so easy as to have a jnz or something, closeby.

It's nice to see new people, and I'm not THAT good at cracking, so I appologise if I come across as just putting you down. :)

/Manko
Aquatic
02-19-2003, 03:29 AM
Squidge, I think this is what you asked for.

Memory map

Address Size Owner Section Contains Type Access Initial Mapped as

*Code removed*

nb: This is only a snippet of the whole memory map.

Where '********' is the process name.

So it looks like *Code removed* is between*Code removed* and *Code removed*. What does this tell you?

Manko,

I can't reveal the target because of the rules on this forum, that's why I blank out the process name on any code I post.

The value I want to manipulate is the *Code removed*, I'm hoping it is related to the "*Code removed*" string I found in Olly.
squidge
02-19-2003, 03:56 AM
Originally posted by Aquatic
Squidge, I think this is what you asked for.

Memory map

Address Size Owner Section Contains Type Access Initial Mapped as

00767000 00047000 ******** .rdata imports Imag R RWE

So it looks like 00785D88 is between 00767000 and 007AE000. What does this tell you?

Well, add the size of 47000 to 767000 and you get 7ADFFF, so your address of 785D88 is clearly in this range. This would explain why this address is not shown in W32Dasm, as it's resource data for the program (W32Dasm only shows you the code segments). You may want to sniff around in this data space to see what else you find interesting.

Also, if you look at the access level, it's read only - that means the program itself can not write to that area of memory, so no values can be changed there. It's therefore doubtful that the "ReloadTime" variable is placed here, and this is just an area for strings. You'll have to read through the code and see what happens around the area of the PUSH for that string.

Manko,

I can't reveal the target because of the rules on this forum, that's why I blank out the process name on any code I post.
[/B]

You can disclose the target via Private Message to Manko himself.
Aquatic
02-19-2003, 04:08 AM
Well I right clicked on *Code removed*, and then clicked 'dump'. I then scrolled down the dump window and found this

*Code removed*

As you can see it says '*Code removed*'. Maybe it is just an area for strings as you say, but maybe it can lead me to the actual '*Code removed*' value?
squidge
02-19-2003, 04:28 AM
That's exactly what I'm talking about. Those strings may be searched for in some file, and when matched, assigned a value in memory, so certainly worth checking out.
Manko
02-19-2003, 04:36 AM
Hehe... So it wasn't packed. We just had to few information. :)
(Hmm... or it still might be... what does the sections look like in the file?)

Yup, you can always priv_mess people if they ask for something, but you needn't do that. You'll figure this out eventually.
Just don't ask moore than you think/do... :P
We have already answered all this...
You know how to get the adresses where reloadtime is used.
Now go there and investigate!

If your unsure what the code does. Post here and ask for help.

You might have to also put breakpoints and run it to see what happens there... Dissassemble too so you have a better overview and look in disassm and debug when you need to.

Maybe also you can give us more info on this reloadtime.
Does it come up as a number in the game somwhere, or is it only a bar? Keep working, you'll always learn something! :)

/Manko
Aquatic
02-19-2003, 05:19 AM
Actually, I'm learning a lot, heh :)

All the values I gave so far were from when I opened the .exe in Olly.

So now I actually ran the game and searched its memory (using Tsearch) for "*Code removed*" Which is what I got for '*Code removed*' from the Dump window.

It found that^ value and the string '*Code removed*' at address *Code removed*. So I disassembled the game at this address and it gave me the following code:

(It started at *Code removed* ) - scroll down

*Code removed*

Maybe you guys can find something in that code. :cool:
squidge
02-19-2003, 05:43 AM
Well done, you've just managed to turn your string into a useless disassembly listing :D

What you need to do is find the PUSH and disassemble from there - NOT from where the string starts in memory.

Don't mean to put you down, but... Try again!
Aquatic
02-19-2003, 01:53 PM
Ahh, so you want the disassembly from where the string was pushed...

Ok so that brings us back to this line that we found in Olly:

*Code removed*

^As you can see it gives the 68 (PUSH) and then the string in reverse byte order.

So I disassembled at *Code removed* and got the following code:

Sorry for these long code dumps :p

*Code removed*
squidge
02-19-2003, 03:58 PM
ok, time for you to do some work :)

Explain to us why the code you have just posted is not useful (look around the area of the PUSH).

Come on, we can help you out, but we can't do it for you.
Aquatic
02-19-2003, 04:28 PM
Originally posted by squidge
ok, time for you to do some work :)

Explain to us why the code you have just posted is not useful (look around the area of the PUSH).

Come on, we can help you out, but we can't do it for you.

Hmm, maybe you mean how there is no CMP followed by a JNZ near the PUSH? :confused:
squidge
02-19-2003, 04:33 PM
Errrr.... No.

Look at the 3rd line after the push.
Aquatic
02-19-2003, 04:38 PM
*Code removed*

So I should look at *Code removed*
Aquatic
02-19-2003, 05:08 PM
Ok so I went into the CALL and didn't find a RET so I went into a deeper CALL and then I found a RET.

I.E

*Code removed*

Then into the call at *Code removed*

*Code removed*
squidge
02-20-2003, 02:24 AM
yes, I think you need to learn a bit more assembler. Try getting some guides to Intel assembler and possibly download MASM32 to experiment.
Aquatic
02-20-2003, 12:27 PM
So basically what I was trying to do isn't actually possible?
squidge
02-20-2003, 03:33 PM
Yes, it's certainly possible. However, at the current rate it will take us about 5 years to explain how to do what you are requesting.

You don't seem to be contributing much at all and you seem to expect us to do the bulk of the work for you. For example, you are posting huge chunks of code and saying "What do I do with this?", when really you should be reading through the code yourself and trying to find out what the code is doing. Even when we drop huge hints as to what to look for, you simply post another chunk of code instead of investigating yourself.

Therefore, I suggest you pick something a little simpler, and learn Intel assembler before trying to do this target. Once you have learned Intel assembler, may I suggest a few CrackMe's to test your newly learned skill before trying to hack a "live" target ?

Originally posted by Aquatic
So basically what I was trying to do isn't actually possible?
Aquatic
02-20-2003, 04:46 PM
Ok, I'll go learn some more tutorials and stuff.

Also, I am gonna remove all the code from my posts just for personal reasons.
enko
03-17-2003, 08:48 AM
Ok guys, another newbie I'm afraid, its a question related to this one so here goes.

Having a lot of probs getting Softice to co-exist with the win2000 setup I'm using, so I tend to use W32dasm (slower I know, but I do learn a lot more having to step thru etc. Heres the thing, out of the last 5 progs I have looked at dont show the strings in reference in w32dasm, eg window pops up this product blah blah, search for "this product blah blah" not shown, but of course it IS there in hexedit. Are these strings being masked somehow (false info in header) or am I as I fear being thick.

Thanks in advance

:confused:

Enko
squidge
03-17-2003, 09:47 AM
More than likely the strings you are seeing are part of the resources in the program, and as such, these are not shown in w32dasm.

Download LordPE, enter the file offset you found the text at in the FLC section, and then see where it is...


Linking the world
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Linking the world
PDA

View Full Version : Linking the world

Devine9
02-14-2003, 11:01 PM
Well after reading Thigo's message and the exclamations of some people in reply to it. It occured to me that some people, in fact perhaps a large amount of people on this board do not search as searchlores.org would have them and have not found there way around to many sites which in some sub cultures on the net are quite popular. Well, I decided that this post was warranted. You can't really call it spam as CrackZ was supposed to add it to the links section here days ago, so here it is. If you've got some spare time drop by http://ret.mine.nu the boards and projects have been going there for quite some time, although the input we're getting is not to the degree that we are trying to reach quite yet. The boards span a greater range of topics than most other boards and with some input I think they could go a long way. Any suggestions or ideas for other projects feel free to send off a mail etc. Enjoy. And to moderators if you think this post is not warranted than feel free to delete it.

Devine Right [RET]
http://ret.mine.nu


Armadillo tutorial link ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Armadillo tutorial link ?
PDA

View Full Version : Armadillo tutorial link ?

ssb
02-15-2003, 12:19 AM
Anybody can send me a live link to crus Arm tut ? Link in tut section is dead

thanks
ZaiRoN
02-15-2003, 04:36 AM
Hi ssb,
you are right, the link is not working but...you can find the right address using the two addresses:
the old address: http://www.woodmann.com/fravia/Armadillomanual.zip
the new address: http://www.woodmann.net/fravia/

Which will be the hidden address? :D

ZaiRoN
ssb
02-16-2003, 02:39 AM
Thanks man :)


help a newbie...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > help a newbie...
PDA

View Full Version : help a newbie...

manmac00
02-15-2003, 01:28 PM
hello,
I've disassembled a prog, patch it, and trying to get a valid serial.
But having some problems.....I'm a newbie after all....
The proggy is very small and if somebody is interested in giving me some advice (not the right serial just some advice in understanding what I'm doing wrong...) I would really really apreciate....
many thanks

Mac
ZaiRoN
02-15-2003, 02:10 PM
Hi manmac00,
What is exactly your problem? :confused:
If you do not tell us more, how can we help you?

Peace,
ZaiRoN


dldr.exe - Sice is not loaded.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > dldr.exe - Sice is not loaded.
PDA

View Full Version : dldr.exe - Sice is not loaded.

banshee
02-16-2003, 10:14 AM
Hi All!
Some time ago I was reversing old DOS program. To load program to Sice I used dldr.exe (DS 2.7 and Win2k Pro) and noticed that loader doesn't work. Sure, the Sice was patched. To solve that problem I dissassembled dldr.exe to determine what method it uses to connect with Sice. Simple string search like "NTICE" etc. gave me nothing. So the question is: How to patch dldr.exe and can anybody explain how exactly it detects if Sice loaded or not?
esther
02-16-2003, 10:37 AM
Hi
does the dos program run in winxp?
No point to patch dldr coz it only runs on dos orwin9x ;)
banshee
02-17-2003, 02:24 AM
As I mentioned above my configuration is Driver Studio v2.7 and Win2k SP2. When Sice isn't hidden, I mean when it is not patched in any way, dldr runs well. But it fails to load when Sice patched. So the question remains.


norton antivirus 2003
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > norton antivirus 2003
PDA

View Full Version : norton antivirus 2003

bytexus
02-16-2003, 04:03 PM
The new version of nav Comes whith a new protection (i say). First i see the progs runs with no nags(i sayd to myself goobye vbox) but when i look at proces list i see two processes rundll32.exe. So we have a vboxed aplication(4.6.2).The main executable is not crypted with VBOX (i think) "main.exe". But the other thing that i've noticed is that the nav uses some dll "crypt32.dll"and reads some interesting values from registry. I think it uses some encryption algoritm(rsa????). I tried softice but you can breakpoint only api's(if i put a breakpoint on some memory adress a nav window will pop up), finaly i make the program run(by changeing only a jump) but the programs doesn't load the plugins->so it doesn't work. I've found the call that loads the plugins but thi was my end. I trace into some calls until i reach into a call from ole32.dll. When the prog stil is in the trial time this the cal from ole32.dll returns some (good) values in the registers.When the trials expires the call returns other values(bad) in the registers. I replaced the values with the good one but i got a crash(probably those values were on stack also).
I don't know what else i could try to do because i can't crack-it.
I must say i am a newbie and don't have too much experience.
thanks.
JMI
02-16-2003, 06:38 PM
bytexus:

It seem I could simply cut and paste most of one of my recent post on this Forum for your benefit, except the software concerned is different. This is your first post and, as with the other recent one, it is obvious you did not look around much, and clearly didn't read the FAQ. Had you done so your would have realized that you needed to search before posting your question to determine whether, and to what extent your question had been asked and/or answered before.

Had you done that, using the search button at the top of every Forum, and simply entered "vbox" you would have found some useful information, from no less an illuminary than our own resident unpaxing God, +Slpa/\, and others, which might assist you.

Read those threads, then think some more, and then follow the posting guidelines with some description of your system and the tools you are using and more about what you tried after you did your search. Then you will probably find those here willing to help.

Regards.


exetools.com
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > exetools.com
PDA

View Full Version : exetools.com

banshee
02-17-2003, 02:33 AM
Anybody knows what happened to subj. Can't access it for last three days.
JMI
02-17-2003, 12:45 PM
They have been having trouble with there access. Don't know if a problem with the redirector or not, but their forum came up late last night and there were no new posts between 2-14 and 2-16 so they were probably down for some reason.

Seem to be down again at the moment.

Regards.


file access
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > file access
PDA

View Full Version : file access

fumble
02-17-2003, 03:49 PM
there is a proggy which verifies some files. i want that program to give "true" no matter if the files were changed or not. what api calls do i have to observe ?
Kayaker
02-17-2003, 06:09 PM
Verifies files in what way? You need to give details...lots and lots of details...
squidge
02-18-2003, 02:28 AM
You could always go generic and BPX CreateFileA and ReadFile. Depending on size of files, you may be tracing through a lot of code, but that's what you get for such a generic question :)
fumble
02-18-2003, 07:13 AM
hehe ok ok sry for my generic question and thx anyway for trying to answer it as good as possible :)

ok here comes more details as far as i know. im pretty new so i dunno that much yet but i know that it claculates a kind of checksum from the files to check if they were changed or not. maybe u know sth about calculating checksums and can ask for some certain things now which i will try to answer then. another thing is that it checks for files which shouldnt be in that folder. if it finds some it temporarly renames them for the time it starts the game (this tool is an anti cheat tool which starts the game moh:aa after all test passed).

ok i want to learn learn learn so plz keep trying and teaching!!! thx alot !
squidge
02-18-2003, 07:36 AM
If its an anti-cheat tool, then the prog itself is prob protected, so I'd get some pe identification tools first. PEID is a good start. You'll prob find out that it's protected and/or compressed, in which case you'll unprotect/unpack it, and there's lot of information on how to do that on this board.
fumble
02-18-2003, 08:01 AM
ok thx, i will have a look around and find out what peid is and how to use it


Debugging a .NET application
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Debugging a .NET application
PDA

View Full Version : Debugging a .NET application

Balam
02-18-2003, 03:14 PM
I would like to reverse a .NET application.

I can disassemble it in IDA, of course, but I would like to trace it "step by step", place breakpoints, etc.

Would anyone be kind enough to provide me with the appropriate information ?
Kayaker
02-18-2003, 03:48 PM
Is the info 10 posts down helpful?
zacdac
02-18-2003, 08:05 PM
What you are really after is a MSIL (microsoft intermediate language) debugger.

There is one that is supplied with the .Net Framework SDK.
However there are several steps you need to perform first to enable debugging of IL code.

Remember this process is designed to debug your own source code. You can reverse code that you do not have the source for as long as you get around the strong named assembly first.

To debug IL code..
1) Produce an IL code listing using ildasm (dump the IL code to file). ildasm is usually found in the following dir
C:\Program Files\Microsoft Visual Studio .NET\FrameworkSDK\Bin\

2) Produce a debug information file (*.pdb) using ilasm by passing it the name of the *.il file you produced above and supplying the /debug switch. Note this will recompile the assembly (note the assembly may not run if it was intended to be a strong named assembly).

Ilasm is usually in the following directory
C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\

3) Use DBGCLR.exe which is found in the following directory
C:\Program Files\Microsoft Visual Studio .NET\FrameworkSDK\GuiDebug

When you run this debugger, you need to open the *.IL file produced in step 1 above.
Then you need to specify the program to run (the executable) and the working directory (menu debug-> Program to debug)

phew.. Now you are ready to debug the assembly. You can set breakpoints on IL instructions and view variables etc.

There are more tricks to learn, but that will get you started.

ZD
Balam
02-19-2003, 01:51 PM
Thank you very much, this is exactly what I was looking for !


Quick ASProtect question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Quick ASProtect question
PDA

View Full Version : Quick ASProtect question

squidge
02-18-2003, 04:05 PM
When an ASProtect protected application is loaded by the ASProtect loader, as the application protected with it is called once before OEP, what is this called is asprotect-speak ?

As in, it calls some routine in the app, and then calls the OEP after returning back to ASProtect code.

This seems to be setting some flags in the main protected program, so I was just wondering what option(s) in ASProtect caused this to happen? Don't see anything in the current ASProtect docs.
nikolatesla20
02-18-2003, 04:23 PM
Most people on the board call this a double dip, which I think is stupid. (Where is the double anyway).

In the Asprotect manual, look under sections about using exported functions in your protected program. It says that asprotect will delete the export table entries after it's wrapped your program. It keeps the offset of the functions to call tho. It's in the manual, trust me :) - there really isn't a "setting" in asprotect to do this, it basically looks for predefined names of exported functions in your program and if it finds them it uses them. (Such as GetNumberOfDays, etc).

-nt20
squidge
02-18-2003, 04:42 PM
Right, Will look into that in more detail. Thanks for the info.
foxthree
03-10-2003, 06:03 PM
Hiya Folks:

Long time since I posted. Nice to see some new-comers tackling ASPR enthusiastically... Tesla, I think the word D-D was coined initially by +Splaj. Why do you think it is stupid? The first dip is when it sets the flags and the second is when ASPR starts executing your code (final unwrapping...)

I thought it was a precise yet funny naming...

Greetz to all
-- FoxThree
Solomon
03-13-2003, 07:16 AM
wb fox3:)

BTW, I found sth. interesting in ReGet Pro(not Deluxe), which will help us to understand the random-zip-file-destroy trick of ReGet Deluxe. Obviously these are for Deluxe version, but they are left in the Pro version. stupid author?:D

* Referenced by a CALL at Address:
|:00414BE0
|
:004645D6 33C0 xor eax, eax
:004645D8 3905CCDD4D00 cmp dword ptr [004DDDCC], eax
:004645DE 740D je 004645ED

* Reference To: KERNEL32.GetTickCount, Ord:01BEh
|
:004645E0 FF1540234A00 Call dword ptr [004A2340]
:004645E6 2403 and al, 03
:004645E8 F6D8 neg al
:004645EA 1BC0 sbb eax, eax
:004645EC 40 inc eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004645DE(C)
|
:004645ED C3 ret

Exported fn(): ?GetDecryptProc@@YAXP6GXXZ@Z - Ord:0001h
:004645EE 8B442404 mov eax, dword ptr [esp+04]
:004645F2 A3D8DD4D00 mov dword ptr [004DDDD8], eax
:004645F7 C3 ret

Exported fn(): ?GetEncryptProc@@YAXP6GXXZ@Z - Ord:0002h
:004645F8 8B442404 mov eax, dword ptr [esp+04]
:004645FC A3DCDD4D00 mov dword ptr [004DDDDC], eax
:00464601 C3 ret

Exported fn(): ?SetDecryptionKey@@YAXP6GXPADK@Z@Z - Ord:0003h
:00464602 8B442404 mov eax, dword ptr [esp+04]
:00464606 A3E0DD4D00 mov dword ptr [004DDDE0], eax
:0046460B C3 ret
foxthree
03-13-2003, 12:28 PM
Hiya Solomon...

Howz it going? I see that you're still as much obsessed with ReGet as you were before :D Give the guy a break ;) Anywayz nice to see some old faces around ... BTW, did you checkout the latest CV ...

-- FoxThree
crUsAdEr
03-13-2003, 03:00 PM
LOL... fox3...
Howz it going? I see that you're still as much obsessed with ReGet as you were before Give the guy a break Anywayz nice to see some old faces around ... BTW, did you checkout the latest CV ...

And who is the guy obssessed with Commview :)?

Solomon, can u fill me in on what those code above do?
foxthree
03-13-2003, 03:15 PM
Guilty as charged, crusader :) :D

-- FoxThree
Solomon
03-13-2003, 07:41 PM
hey crusader,

We all know that the above exported functions are to be used by ASPR and will be deleted by ASPR if packed. At 004645D8 ReGet checks the address of Encrypt Proc, which is set by ASPR. If it's not NULL, ReGet knows it may be unpacked:confused: , so it will use GetTickCount as random scheme to destroy zip/exe files. If the procedure at 004645D6 always returns 1, every downloaded zip file will be destroyed, even in Pro version(Pro is not packed). This GetTickCount trick was discovered long time ago, but I just couldn't understand the meaning of 004DDDCC. Now it's clear:)

fox3: what's your new findings of CV?:)


Help getting back on track..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help getting back on track..
PDA

View Full Version : Help getting back on track..

krylon
02-18-2003, 06:25 PM
Hello everyone, I've recently got addicted to a fun little game Dynomite (its a yahoo game, that you can also download). Well after getting me all into the game, it wanted to be registered to continue playing (go figure)! So I figured after successfully completing many a crackme I would make this my first real target.

What I've gathered so far:

It writes some game specific info to the registry, along with how many times you've played. After play about 20+ games it wouldn't let me play anymore.. so I figured let me change the timesplayed value in the registry (not really expecting it to work). Well it didn't and then defaulted the times played to 100.

So I figured it made a file somewhere that checked for a expired game. The game directory had no suspicious files, but using filemon I found the culprit. It creates the file popcinfo.dat in c:/winnt and its value (in hex) is ..Dynomite.. when the game is still playable, and ..Dynomited.. when the timesplayed reaches the limit.

So resetting the timeplayed in the registry and deleting that file proved effective, and I can continue to play the game. However, my goal is to make it think its registered so I don't have the hassle (and so I can save my highscores!).

So a little more digging with w32Dasm and I see that it also looks for the regkeys RegName and RegCode in the registry. Which I assume it will store the values once you register the game. I made the keys manually and followed the code that querys the value and tried to trace how it manipulates the name and hopefully found the regcode that it compares my bogus one too. I think I also found a string that it may use to create the regcode from, like a sort of hash (its at 4A4900). Basically I just got lost following it around.. and maybe my approach is wrong.

So I'm posting this mainly for some input to put me back on the right track, from some people with fresh eyes! I'm gonna take a break from it tonight and jump back in tomorrow. My next step was going to be trying to break the prog when I input some bogus registration values from within the game and see if I can follow it from there.

The prog is written in C++ according the language and I do not believe it to be packed in any way. Thanks for your time (and for reading this long post!)

-Krylon
disavowed
02-18-2003, 08:05 PM
Originally posted by krylon
So I'm posting this mainly for some input to put me back on the right track, from some people with fresh eyes!
i haven't taken a look at the program, but it sounds like you're definitely on the right track. the only piece of advice i have is that it might never compare your bogus regcode to the valid one (depending on how it does the hashing, etc.)
but it looks like you don't need help, and that you know what you're doing!
Manko
02-19-2003, 03:18 PM
..Dynomited..

You know why? I thought it was really funny! :)

d=64h=100 (So now you know it stores it in 2 places...)

And right after it pulls the other from the registry, it compares them and if they differ it puts 100=64h=d in both reg and file, as you mentioned.

Anyway! Nice game! Gonna look at this one tonight...

How's it gone for you?

/Manko
krylon
02-19-2003, 03:35 PM
haha very interesting Manko...

I'm pretty much still where I was yesterday. I do have a question, what are some other ways of reading in text from the user? Being as this game doesn't use dialog boxes there is no handy GetDlgItem to look for.
disavowed
02-19-2003, 04:23 PM
GetWindowTextA
SendMessage with WM_GETTEXT
krylon
02-19-2003, 04:45 PM
Hmm, neither of those are used (well SendMessage wasn't used as mentioned).. I must admit I'm a little thrown off by the "graphical" nature of this program. I'm not totally lost, but I have been scanning the imported functions trying to find ones that looked useful for what I'm trying to do.

Thanks for the help disavowed, its appreciated. :)
Manko
02-19-2003, 06:34 PM
I solved it after many hours of tracing, to no use...
looked at dissassembly instead...
The details are fuzzy...
Followed some string and then traced back in the dissassembly and found the regproc...
It was BIG and ugly...
Was feeling tired, so I just patched it in the end...
Gona look a little more tomorrow.
It uses the same proc for the regentries and the textboxinput...
Blah, need sleep...

/Manko
krylon
02-19-2003, 09:09 PM
well I'm very interested to hear what you've found Manko.

I've been going over the code all day and its making my brain numb again. I see that it takes the RegName and converts it all to upper-case but I keep getting lost in the trace, not wanting to step into every call. I'm trying to see where it actually uses that large string to check for a valid RegCode.

If anyone else has decided to take a look at this prog please let me know! :)
Manko
02-20-2003, 02:33 AM
Forget about tracing/debugging. ;)

Dissassemble!

Follow the telltale string of all simple protections (Not to say that all protections that have such string are simple, just that the simple protections usually fall if you follow that string...) back to the jnz ... jmp and you will find the proc. ;)

Irritating, it was so simple... :P

/Manko
Manko
02-20-2003, 02:57 AM
...though it might be nice to understand what it does too...
Maybe when you know where the proc is it will be simpler, combining the dissassm with debuging, renaming procs here and there... Hmm... Maybe I will have to look into it some more....

/Manko
krylon
02-20-2003, 07:53 PM
Ok well I've managed to patch it so that it will accept bogus registration info and think its reg'd. However, each time it starts up it grabs the bogus info from the registry and checks it and fails. So basically I would have to keep registering it everytime I play it...

So I'm not there yet, and in the end I would like to understand the reg proc fully as you said and create a valid RegCode for my name. But I'm not giving up.. hah. :)
naides
02-20-2003, 09:10 PM
Originally posted by krylon
Ok well I've managed to patch it so that it will accept bogus registration info and think its reg'd. However, each time it starts up it grabs the bogus info from the registry and checks it and fails. So basically I would have to keep registering it everytime I play it...

So I'm not there yet, and in the end I would like to understand the reg proc fully as you said and create a valid RegCode for my name. But I'm not giving up.. hah. :)

OK. Now you need to catch the program opening the registry and reading the bogus registration info. its validation should follow soon there after.

Look up the Torn@do cracker notes, which are available from the CrackZ archived site, linked bellow, and learn the major registry acess APIs.
Either in a dead lsiting or in debugging look for the area where the code reads the key that contains your gegistration data. Besides, you know the key name, right? look for the string corresponding to the key name in the dead listing, or in memory. Once you know that your program has read the registration info from the registry, follow the money. . .
krylon
02-20-2003, 09:23 PM
OK. Now you need to catch the program opening the registry and reading the bogus registration info. its validation should follow soon there after.

Actually, I've been watching it take the values from the registry from the get go. Its just easy to get lost in the code here, because a lot of things seem to be going on.

Whether it reads the info from the registry or as input from the user it uses the same proc to see if its valid (makes sense). I patched the are of code right after it gets the values from the user and sends the info to the reg proc. I guess I need to back up a little and trick it deeper in the routine so that the reg procedure spits out a valid return.

Thanks for the incite naides!

-krylon
Manko
02-21-2003, 02:20 AM
Hehe... Hi, naides!

Hmm... We've done that already, and I have it patched in 1 place to always say it's regged.

The hard part is understanding it, escpecially well enough to maybe make a valid serial...

Especially if you JUST follow the keys from registry in a debugger as we've done from the beginning.

When I switched to examine the strings and the dissassembly it was pretty easy. (OK. I had to debug a certain CALL dword ptr [e?x+??] (BIG Hint!) to get there. But that was obvious...)

Now, if I could only get buzzy trying to understand the whole proc... But I guess, once I have a crack already, I get lazy...

/Manko
krylon
02-21-2003, 11:23 AM
(OK. I had to debug a certain CALL dword ptr [e?x+??] (BIG Hint!) to get there. But that was obvious...)

Exactly! I was looking at the deadlisting while also debugging and once I realised the similar calls it became clearer. However, I still haven't found the correct patch location to make it always think its reg'd.
squidge
02-22-2003, 06:22 PM
Just taken a look at this game and although it's a rehash of a old game, I got instantly addicted. Must say however that I was disappointed by the registration process - Yet another "pages and pages of code to calculate username to serial, but a simple one or zero for success/failure".

If you need some more hints, try looking at some of the text the game throws at you whilst you attempt to register with bogus information - this should lead you to a nice jump that you can follow (See Manko's post) with your debugger and place a breakpoint at. Restarting the game, you find it calls this function again near the start, so I guessed it was the "CheckIfProgRegistered" routine, and a small (two instruction) in-memory patch did exactly what I thought it did.

I used IDA to search for the text, but Ollydbg should be just as good.


Strange problem after unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Strange problem after unpacking
PDA

View Full Version : Strange problem after unpacking

tazmanian
02-18-2003, 10:51 PM
I unpacked an exe file (I posted about it a month ago), and it is a new packer...

So here cames the problem...

Here what I did:

1) Run the packed program and dump it using LordPE with no pe fix from lordPe
2) fixed the VSize and Rsize and bla bla in each section
3) Run ImportREC.exe to get the imports and fix the dump file

But now, when i run the unpacked file, it crashes...i dont know why :\
All that i got is the address that it crashes...

Here is the piece of code:
quartzo4:004286F2 call ds:GetCommandLineA ; as we can see, it is right after OEP
quartzo4:004286F8 mov ds:dword_460168, eax
quartzo4:004286FD call ___crtGetEnvironmentStringsA
quartzo4:00428702 mov ds:dword_45EA18, eax
quartzo4:00428707 call __setargv
quartzo4:0042870C call __setenvp
quartzo4:00428711 call __cinit ; This is the call that crashes!!

Folowing the call we see:

quartzo4:0043D0FA lea eax, [esi+1Ch]
quartzo4:0043D0FD push eax ; lpCriticalSection
quartzo4:0043D0FE mov [ebp+var_4], edi
quartzo4:0043D101 call ds:EnterCriticalSection ; crashes here!!!

Do you have any idea!?

Thank you very much!
tgodd
02-18-2003, 11:42 PM
quartzo4:0043D0FA lea eax, [esi+1Ch]
quartzo4:0043D0FD push eax ; lpCriticalSection
quartzo4:0043D0FE mov [ebp+var_4], edi
quartzo4:0043D101 call ds:EnterCriticalSection ; crashes here!!!

Break at 43d0fd, and post the value of eax.

regards,

tgodd
tazmanian
02-19-2003, 06:33 AM
This is the value for eax, i got it using Ollydbg

Hexadecimal: 0045E74C
Signed: 4581196
Unsigned: 4581196
Char: \x00 E \xE7 L

Can be the resource data the problem? i cant read it using Exescope, nut i can read it with PEditor.

This program uses a DLL packed with the same packer, and i unpacked the dll and seems ok, no problem until now.
tgodd
02-19-2003, 07:33 AM
You should check to see which section eax is pointing too.

You are probably off on your resizing of your sections.

regards,

tgodd
tazmanian
02-19-2003, 08:27 AM
EAX is pointing to: 0045E74C

Witch is inside the code section...

quartzo2:0045E74C db 4 ;
quartzo2:0045E74D db 0 ;
quartzo2:0045E74E db 0 ;
quartzo2:0045E74F db 0 ;
quartzo2:0045E750 db 3Ch ; <
quartzo2:0045E751 db 4Fh ; O
quartzo2:0045E752 db 6Bh ; k
quartzo2:0045E753 db 81h ; ü
nikolatesla20
02-19-2003, 08:39 AM
Not to distrust your unpacking skills, but I've found time and time again that if a program I've unpacked is crashing when I just try to run it (or even sometimes after that, for that matter) 98% of the time it's because there's a bad import.

The import recovery tools are not perfect and sometimes you just have to go thru some of them manually to make sure. A few to check are

GetCommandLineA. This gets messed up a lot!
GetVersion.
GetProcAddress.

All of these calls should ALWAYS be very suspicious to you and I never trust them 100% unless I walk thru them myself. To do that, just set a breakpoint ANYWHERE in the program. The packed program. It can be after you run it, for example, set a breakpoint on CreateWindowExA and then show the about box. When it breaks, F12 back into the code.

Now you can go to the IAT table, since you now know where it is (since you managed to unpack it) and walk thru it manually. For example, if you used ImpREC it would have told you that there was a certain import call at <address>, so do a "DD <address>" to see where that call goes. Check that address you see now, in the IAT, in SI - "U <address you found now in IAT>". You can continue to walk thru code this way, without actually exectuting the code, in SI to see where all the calls eventually end up. Yes, you have to be able to read ASM, but being able to do the IAT this way is a very useful skill if you know you have a bad import but just don't know where to start looking.

Another hint: Imports in windows EXE's are usually always in alphabetical order. If you have one hanging out of place , be very suspicious of it and trace it manually to see if it's correct.

-nt20
neviens
02-19-2003, 10:15 AM
Did you dump @OEP? This EnterCriticalSection thingie
usually pops up, when dump is done some instructions
later, after InitializeCriticalSection is done, and flag
is set. When you run a dumped proggy, this dumped flag
is checked, and program assumes, that Init is done, and
don't call it more. As result you will get an err, entering
not initialized crit. sect.
Neviens.
tazmanian
02-19-2003, 03:39 PM
Originally posted by neviens
Did you dump @OEP? This EnterCriticalSection thingie
usually pops up, when dump is done some instructions
later, after InitializeCriticalSection is done, and flag
is set. When you run a dumped proggy, this dumped flag
is checked, and program assumes, that Init is done, and
don't call it more. As result you will get an err, entering
not initialized crit. sect.
Neviens.

And how can i fixed it?
squidge
02-19-2003, 04:23 PM
Either run the *packed* program under control of a debugger and pause at the OEP, or (for example, if your debugger is SoftIce) cause an infinite loop at OEP. This ensures no data is changed whilst the program is dumped.

Dumping a running program when it has proceeded past OEP is very dangerous as you can get all sorts of variables initialised that are not supposed to be in that state on startup, so the dumped program can randomly crash - as you have experienced.
tazmanian
02-19-2003, 04:49 PM
newbie fault :)

It worked!!! thx for help you guys!!

I was dumping without doing a jmp eip in OEP address :))

Thx a lot!


How to reverse a DLL without .exe (Matlab)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to reverse a DLL without .exe (Matlab)
PDA

View Full Version : How to reverse a DLL without .exe (Matlab)

Zero
02-19-2003, 02:24 AM
A nice problem I am working on:

You can compile with matlab from c++ sources directly DLL´s.
So what you get is only a DLL which you can use within your projects.

for the c++ file you just have to define:

#include "mex.h"

and something like (The name of the file is: myDLL.c):

void calcDetection(double x[],double y[], double z[])
{
if (y[0] == 1){
z[0] = DoDet(x[0],1);
} else {
z[0] = DoDet(x[0],y[0]);
}
}

void mexFunction( int nlhs, mxArray *plhs[],
int nrhs, const mxArray *prhs[] )
{
double *x,*y,*z,*myType;
float myFloatType;

if(nrhs!=2) {
//mexErrMsgTxt("Two inputs required.");
} else if(nlhs>1) {
//mexErrMsgTxt("Too many output arguments");
}
plhs[0] = mxCreateDoubleMatrix(1,1, mxREAL);

x = mxGetPr(prhs[0]); // get first parameter in x
y = mxGetPr(prhs[1]); // get second parameter in y
myType = mxGetPr(prhs[2]); // get second parameter in y
z = mxGetPr(plhs[0]); // z contains our return value

myFloatType = *myType;
if (myFloatType == 1.00){
// do detection
calcDetection(x,y,z);
}
}

after compiling with MEX you get a DLL named myDLL.dll
You just have to throw this .dll into the directory where the main file is running

within a Matlab file you just call the function of the DLL like:

myDLL(0,1,1);

Very simple.

Now we get to the problem:

For calling the function MyCoolFunction you just have to add this in your code (assuming it exists in the .dll):

...
MyCoolFunction(param1,param2);
...

This accesses directly any (!) .dll within your path and searches the function MyCoolFunction(...).

BUT:

The function seems to be defined like this:

MyCoolFunction(param1,param2){
...
checkLicense();
...
normalCode
}

The cool thing is:
you can not see the MyCoolFunction with an app like FileInspector because there are NO exports defined !

So there are ONLY 2 ways to reverse this:

1. Reversing the Matlab Environment and hoping that you will somewhere land within the checlLicense routine. After years you know every line within Matlab but maybe not one line of the DLL
2. Reversing the DLL directly

So I want to reverse the DLL directly....

But HOW ?

btw:
if you search for strings within the DLL you find a text-resource like this: "License Invalid"
Zero
02-19-2003, 02:57 AM
Actually cracking this scheme was quite easy:

1. use PE-Explorer to disassemble the DLL
2. search for the string reference
3. find the location where this string ref is called
4. patch it or whatever (I used HIEW)

5. please move this topic to the newbie forum :rolleyes:

Sorry for posting such a lame appraoch to the advanced forum...
CADZzz
02-27-2003, 05:03 AM
Try to use the Ollydbg debugger, its excellent for adjusting dll's

1. First load the prog into Ollydbg
2. View-executable modules
3. double click the dll
4. now you r in the dll and do whatever u want...save it etc...

regards,
CADZzz
Zero
02-27-2003, 06:20 AM
sure you are right with using Olly, BUT:

please read what I have written above !

There is NO .exe file existing !
The DLL is called by Matlab with a different way, so I had to reverse the DLL directly (describe above too)


NeoProject takes on MD5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > NeoProject takes on MD5
PDA

View Full Version : NeoProject takes on MD5

mike
02-19-2003, 03:35 PM
This is the only NeoProject worth doing; the others are way out of range. This one has immediate and really cool consequences. I highly recommend it.

http://www.theneoproject.com/main.asp?PageRequest=ABOUTMD5


Genetic Algorithms? Debugger Attack? - Brute force exercise part II
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Genetic Algorithms? Debugger Attack? - Brute force exercise part II
PDA

View Full Version : Genetic Algorithms? Debugger Attack? - Brute force exercise part II

ZaiRoN
02-19-2003, 04:43 PM
Hi all,

another bruteme from spider. Beware, this new version seems to be not so easy!
You have to reach the congratulation box, Good Luck!

ZaiRoN

ps. you will find a little hint inside readme.txt file ;)
_Servil_
02-20-2003, 07:45 PM
Ciao,

Complimenti! Hai trovaro il serialle coretto ;))

Again, the 'guessing method' with a bit of luck (and ZEN pheeling ;o)) helped me to find the solution,

I find interesting this kind of crackmes, imo less frustrating as usual fishing serial from anoying algo.

regards...
nikolatesla20
02-21-2003, 10:45 AM
Since I'm really new at this stuff,

Any small hints would be appreciated.

I've already tried playing around makig inline patches in SI to brute eax, but I get past the first check, but of course then the code is still garbage because of bad xor [edx], eax

So, gotta get my brain working some more...but just a little help to shed light and then I might be able to have a revelation.

Pleeaase?

-nt20
nikolatesla20
02-21-2003, 11:17 AM
Hmm.

Now that I look at it, that second time "decryption" is actualy just re-encrypting, and then it jumps out. SO obviously there must be a message box in that encrypted code somewhere, as well as no doubt something to create the message.

So what I'm thinking, now that I read the post to the first bruteme, is that you just have to make up the code yourself for the messagebox, and brute a serial that causes the code to be decrypted to the code you wish. Sort of like programming with a xor decryptor on top....

-nt20
_Servil_
02-21-2003, 12:03 PM
Hi nikola,

as I can help, the mentioned messagebox is htere, under bot layers hwoever so you can't rely on the decryption showed in deadlisting 'coz it's continuing, but, there must be at least the second layer decryption in the 1st lawyer only, so need to concern on that.

My first idea was to let it run in loop for all 64k of acceptable variationz with SEHandler treatement but the result was unusable, also I didn't know how to tell kernel to reuse the Handler after it was triggered. Even if I knew, this is not the way to go since the random jumps are jumpping wherever it wants etc etc.

So keeping the focus on how the 2nd decryption loop could look-out is the task (once it's disclosed, the second lawyer is known in the moment aswell).
Kayaker
02-21-2003, 01:26 PM
Originally posted by _Servil_

My first idea was to let it run in loop for all 64k of acceptable variationz with SEHandler treatement but the result was unusable, also I didn't know how to tell kernel to reuse the Handler after it was triggered. Even if I knew, this is not the way to go since the random jumps are jumpping wherever it wants etc etc.

Hiyas

That was my first thought as well, allow the 2nd decryption layer to run with an SEH handler - when you finally hit the correct s/n the MessageBox would pop up, but as you say the code could resolve to anything and you could jump out of your code to absolutely anywhere, and your SEH no longer applies. I got nice BSODs trying that even though I knew the idea was flawed ;-)

The problem is it's really hard to make assumptions about what the 1st layer decrypts to. In the first crackme it decrypted directly to the MessageBox code, in this one I "assume" that it decrypts to another (hidden) decryption routine and the MessageBox is produced in the 2nd layer.

We can guess that ALL the MessageBox code is revealed in the 2nd layer, but we can't ignore the possibility that the routine might be split between the two, say the correct resource strings are decrypted in the first layer and the push [ebp+08] / Call MessageBox code is revealed in the second. We can't even assume the 2nd algorithm is even a simple xor routine on the same section of code as the first one is really.

Without being able to make an educated (or not) guess on a particular byte pattern which might be produced after the first decryption that you can use as a 'fitness test', it seems to me you'd almost want to be able to *emulate* executing the code after the first decryption to see if it led to a proper decryption of the 2nd and final code layer.

Lol, Still chewing on this one...

Kayaker
nikolatesla20
02-21-2003, 01:51 PM
Kayaker, I think you are right, I think _Servil_ was saying that the first decryption layer decrypts to the second decryption algo.

After all, there's quite a few bytes here. ..

SO the only guess would be that the 2 encrypt algo is similar to the first. It's kinda the only thing to go on.

-nt20
nikolatesla20
02-21-2003, 03:53 PM
Ok

I think i have a basic bruter working - take a look and see my bugs :p

I think the code is solid, yes it's "messy" I suppose some might think. VC++ 6.0 with asm statements. I know, I know, hammer to a needle, but hey to each his own.

Probably this will work? I just need to get some bytes to compare with - don't know if my search string is right or not. Right now it doesn't find a match at all.

Good learning anyway.

-nt20
Kayaker
02-21-2003, 04:01 PM
Just a quick thought nt20, the serial in eax can be a dword correct?
So
cmp eax, 0x0FFFFFFF
won't cover the entire range?

K
nikolatesla20
02-21-2003, 04:09 PM
That's right - I guess I figured it was close enough - and 0xFFFFFFFF is -1 - so maybe I also have to change data type to unsigned long, and then check 0xFFFFFFF0.

LOL my mistake sorry

Plus you might enjoy the lazy hack I made in asm to load the correct data pointers for memcmp :p

HMM Pretty sure I've got logic error here somewhere -..

-nt20
_Servil_
02-21-2003, 04:23 PM
Hello,

looked at the source, you are assuming the 2nd pass is the same. if I can hint try to be less strict and more general. As I think there's no other way as guessing and a bit of luck (or author's intetntion? ;)). Maybe, more apposite to call it "GuessMe"? ;)

Anyhow it would be interesting if someone can bring any 'infallible technique', if there's so.

regards,
servil
nikolatesla20
02-21-2003, 04:29 PM
Yes, for now I was assuming the 2nd would be the same.

SO I am right now going thru and trying different things, such as simple calls, or strings, etc.

I just need to think of a valid search string of data....grr.

-nt20
nikolatesla20
02-21-2003, 04:54 PM
Crap the logic is wrong somewhere.

Just take my search int matches and try them in the original program, they are not valid to get past the first check.

hmm

Found the bug. Fixed it.

change the line in the asm

shr eax, 10

to

shr eax, 0x10

DUH

ALso change the check to

cmp eax,0x00000000
jle Outtahere

I've fixed the original attatchment.

-nt20
nikolatesla20
02-21-2003, 06:31 PM
fixed another bug - the eax check should be

cmp eax,0x00000000
je OuttaHere

This way eax goes until it rolls over

-nt20
nikolatesla20
02-22-2003, 08:25 AM
I've been guessing my *ss off and getting no where.......

Pretty sure I've got all the bugs out of my bruter now. Just have no idea yet what to look for.

_Servil_, feel like compiling it with the bytes you searched for and seeing if it worx?

I get 65, 535 number matches. The serial is in those somewhere.

-nt20
ryan
02-22-2003, 05:36 PM
Nothing to contribute to here.

Just like to mention that nikolatesla20's willpower and attitude is something I have not seen for a long time in a cracker. Will not let go after taking a bite... something like a bulldog... reminds me of someone I know... ;)

You have my respects, nikolatesla20.

Regards
Ryan
nikolatesla20
02-24-2003, 01:17 PM
I have to say, if this whole thing hinges on guessing, then what is the point. I might as well feed the damn thing to a VB program that plugs in the number, and kills the process when it crashes, and just goes thru every combo, which would take about 2.5 days (Running, pluggin number, crashing and killing taking about 3 second estimated time). Of course that's why they call it BFing...

I've tried a few more string guesses- for example, I figured the 2nd decryptor would most likely have to load a pointer, so I searched for 0x11,0x40,0x00 which would be in the code section (it needs to load a pointer to the code section to do the decrypting) but that wasn't found. I find that extremely strange.

I think it's time for a hammer over the head _Servil_, PM me if you want....not asking for handouts, after all, look at all the work I've done so far. Insanity is close.

All is not lost - I have one more idea.

-nt20
_Servil_
02-24-2003, 03:45 PM
Hi nikolatesla,

as I tested your code, and it finds !
Just to change the pattern ;o)
So don't give up, the pattern is very simple.

I can provide my source if no success however.
nikolatesla20
02-24-2003, 04:13 PM
Ok :)

That at least gives me hope - like I said I just need to figure out a pattern to search for.

Right now I was experimenting with using a custom debugger of my own that tries each combo - and catches exceptions. If there is an exception it just resets EIP and sets eax to the next value to try. But it hasn't worked yet.

-nt20
nikolatesla20
02-24-2003, 04:34 PM
I got it ! yay!

You are right , the pattern is VERY simple...hehehe.... I Finally figured out what to search for - not sure if you looked for the same bytes, so yes, it is partly "luck" I guess too..

Yep, my code worked fine. That's good too, that means I'm not off my rocker...:p

Thanks for the encouragement _Servil_ !

-nt20
Kayaker
02-24-2003, 06:46 PM
Hi All,

Hehe, I know what you (were) saying nt20, I'm going the same route, but I'm not quite ready to declare "Abandon Ye All Hope" quite yet ;-) I'm still testing a brute forcer engine for false positives that I hope will be useful for more than this crackme, but here's my thoughts so far..

Scanning for decrypted bytes that disassemble to an address in the 004011xx range is a good first guess, but I'm sure you've realized that's no guarantee because 1 - the direct address could be created runtime with a simple xor or add, or 2 - the 2nd decryption *could* begin at the end of the decrypt block, which is in the 004012xx range.

We can get a bit more selective than that though with a bit test. What we're really looking for is, as an example,
MOV register, 0040xxxx
or maybe,
lea register, dword ptr [0040xxxx]

For MOV EAX this would be a byte scan for
B8 xx xx 40 00

In explanation, for the MOV statement the one-byte opcode for a 32 bit <MOV Register, immediate address> instruction (mov r32, imm32) ranges from B8h-BFh, for the 8 registers EAX to ESI. The upper 5 bits of the ModR/M byte specifies the Code field, the lower 3 bits the Reg field, i.e.
(mov EAX) = B8h = 10111 000b

The register operand being used is encoded in bits 0-2, therefore 000b indicates the EAX register. The rest are defined by:

EAX = 000
ECX = 001
EDX = 010
EBX = 011
ESP = 100
EBP = 101
ESI = 110
EDI = 111

So, if we know that bits 3-7 will always be 10111b for a (mov r32, imm32) statement, we can use this to be more selective in our brute force algorithm. As an example, this is the bit test I'm developing for this crackme, on the assumption I'm looking for any of 4 byte patterns / statements:

0B8h XX 11 40 00 - mov EAX, 004011xx
0B9h XX 11 40 00 - mov ECX, 004011xx
0BAh XX 11 40 00 - mov EDX, 004011xx
0BBh XX 11 40 00 - mov EBX, 004011xx

.WHILE ebx != 07FFFFFFFh ; Test all positive integers

; DECRYPT LOOP

; ================
; Fitness Test
; ================

cld
mov ecx, SizeOfDecrypt
mov esi, offset BeginDecrypt ; start of Decrypt block
xor eax, eax

@@:
test ecx, ecx
jz @BruteNext
dec ecx
lodsb ; check each byte

; check <mov r32,
sub al, 10111000b ; mask for opcode MOV in bits 3-7
cmp eax, 011b ; 3 ; selects for eax, ebx, ecx, edx in bits 0-2
jg @B

; check imm32> address
cmp word ptr [esi+1], 4011h ; xx 11 40 00
jnz @B
cmp byte ptr [esi+3], 0
jnz @B

; -----------------------
; Solution Found
; -----------------------
invoke wsprintf, ADDR buffer1, ADDR StringFmt, ebx
invoke SendMessage, hList, LB_ADDSTRING, 0, offset buffer1
invoke SendMessage, hList, LB_SETITEMDATA, eax, esi
invoke UpdateWindow, hWnd

@BruteNext:
inc ebx ; increment serial nummber
;-----------------

.ENDW
jmp ExitOK

; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
BeginDecrypt:
dd 8C47A73Fh
...

You could use this on other possible keywords / byte patterns such as LOOP, the author seems to like those, jmp (Jcc) xx40xxxx perhaps, or popad/ret to end the decrypt block or push ebp to begin it might be useful in other cases.

continued...
Kayaker
02-24-2003, 06:48 PM
I use the word Fitness Test because it introduces Genetic Algorithms (GAs) into the mix. There seems to be great potential in using GA's in brute forcers because they can in theory minimize the number of values you have to test, thereby reducing CPU time. The techniques are used with AI, neural nets, fractals, stock market and other types of predictive analysis and so on, and interestingly are modeled to some degree after patterns seen in Population Genetics and Natural Selection. There's much information around about it.

The Bit testing is involved in how the GA is implemented. You start with a random population, in this case serial numbers, and come up with a 'fitness test' to test each one as to how well they fit the type of organism you want to develop (i.e. one or more possible answers). We can use a bit test for this (i.e. select s/n's which produce a MOV register instruction). You test for both the Most fit and Least fit member of your population and kill the Least fit. The Most fit will Reproduce with any remaining member of the population (you can use a fit test to choose the 'best' mate) to produce a new offspring to replace the one we killed (new value overwrites old one in array).

Like in any reproduction, there is a blissful sharing of bodily fluids, resulting in a chromosome exchange or Crossover. In our case this is a sharing of bit values from each parent to produce the new value. You determine where you want the crossover to occur in whatever percentage. Mutations are useful to develop a stable population, so some bit flips can also occur.

You control initial population size, crossover and mutation rate, number of generations, and fitness test to work together to try to produce a convergent population, where there are only one or a few unique values remaining, one of them hopefully your correct serial number. Mathematically it has something to do with defining all the possible local minima from a derivative equation of your fitness test.

I have modeled a simple GA to a very basic protection idea, but it fell far short of a good protection scheme on its own, but I think it could be used as a layer of obfuscation in some manner. You have the power of creating your own life here, a population of select values produced runtime in a non traditional, harder to trace manner for example.

Heh, this got longer than I expected but I've been wanting to bring up the subject of Genetic Algorithms. My biology background got me intruiged by their application to natural populations, and my devilish RE side couldn't help but want to apply them to er, other uses :D

Perhaps Crypto Mike or someone else has used them in some form or another? This could be a very interesting topic with their applications to AI and other things.

Cheers,
Kayaker
nikolatesla20
02-24-2003, 06:55 PM
Very interesting ideas, Kayaker. Yes, that would make sense, to have a "bell curve" of inherited best matches.

Anyway, I also DID test for 00401200 opcodes as well, and of course did not find them. Once I got it decrypted I noticed why....

*Warning* Possible spoiler HINT BELOW do not continue if you want to try it yourself***

My final success was based on a guess that there would need to be a counter initialized somewhere, somehow....

-nt20
ZaiRoN
02-25-2003, 05:42 AM
Hi All,

Genetic Algorithms are very popular in these weeks.
I have only read few articles and have not tried to write algorithm about GA kind for which I could be wrong, please correct me :-)

I think that your approach to the problem cannot help us very much in this case. The problem is bound to the way which the Fitness test is executed in; in this phase of the algorithm, you must choose a value for the test like a particular characteristic which must be satisfied (not the solution, a characteristic).
As you said in the previous message, we could use the Mov instruction only working at a few bits of the instruction. This could be a right and interesting choice but who assures me that this instruction is really in the second layer? (the 'MOV register, 0040xxxx' instruction does not exist in the second layer :-p. Obviously, I used this instruction as an example only.)
I think that this is the bound fundamental problem to this Crackme, we do not have certainties on the future and all is based on guessing how the second layer will be. We do not have solid bases on which we can implement an algorithm of this kind.
right now I was experimenting with using a custom debugger of my own that tries each comboThis is also an interesting idea. I must admit that also I, like you, have used the guessing way to solve the problem but this morning I have read a solution decidedly better. The guy has written a little program that firstly runs the Crackme and then uses a bruteforce attack. The program sends a serial to the registration dialog. How does it check that the serial is really the right one? After he has sent the serial, the program sleeps for some milliseconds and as soon as he has awoke he checks if the mistake window has appeared. This is repeated until the right serial is found.
What you say!

ciao,
ZaiRoN
nikolatesla20
02-25-2003, 08:39 AM
Zairon -

Yes, that is a viable solution, and was what I was going to actually do soon if I kept not getting anywhere - plug each number into the dialog. In fact, I already spit out a text file of all possible matches and had it ready to go :p

Only then I got a bright idea to try DEBUG_PROCESS and if it got an exception it would reset the EIP to right before the decryption loop and set eax with the next value to try. However, for some reason it doesn't work quite right - seems I get 2 exceptions ? I only worked with it a little while, but it is really fast to do it this way. I still think I might get it working (which would be cool)

Just haven't written debuggers much and so I'm out of practice :)
But it would sort of work how armadillo does, on an exception, we redirect the program back to a good case scenario.

The only problem I ran into right now is it seems to work - but it locks up at like the 20th number test and I'm not sure why. Perhaps some exceptions are really not recoverable, or maybe it rean out of stack space from some bad pushes that don't get removed. If there is a reliable way to clean the stack I think it would work great.

-nt20
nikolatesla20
02-25-2003, 10:20 AM
My debugger is working pretty well - only one problem I need to figure out now.

It no longer locks up, but it does not find the correct code - if I type in the correct code in SI it works. HOwever, it gets to a certain point where the program somehow decides to get a data segment selector of zero. Don't know how that could happen without blue screening me, but it does. (Didnt even know it was possible).

So basically trying to access any memory from then afterward causes mayhem, all illegal access instructions, since the memory data segment doesn't exist.

I wonder if this is part of the stack corruption. I tested one of the lock up numbers and it caused "unknown software exception" which I believe would be stack errors. Could the stack corruption cause DS to be modified? Anyway, it's strange. Gonna try some more stuff. Seem to be getting closer with a generic BF'er for this.

-nt20
Manko
02-25-2003, 02:20 PM
Hmm...

I know little to nothing about the stack, so my thoughts may sound stupid and I might have to be set straight...

I first wondered about why it wouldn't be enough just to reset esp to the value it had when attempt started...
Then I wondered if there were values already there that was important or if there were even values there when it had not even been used...

I checked quickly and saw something I actually have seen before but never thought about... There are some sort of selfpointers there when it's not used... never thought about it though...

Anyway last thought was to just save a big chunk of the stack so you could write it back inte the process and reset esp...

Is this a stupid uninformed thought or is this possible/good?

If you think I should do some reading on this; Do you know of any good resources?

Anyway! I'm eagerly waiting to see your next statusreport, and feel free to ignore me if I'm just causing static... :P

/Manko
nikolatesla20
02-25-2003, 02:46 PM
Actually Manko, I decided to just restore the stack values to what they were before the crash, hereby fixing the stack.

Basically I walked in SoftICE and just wrote down the values of all the registers at the beginning fo the decryption loop.

Then I just wrote my debugger to restore all of those on any exception, after it resets EIP. This led to a couple more problems, tho.

First, I now could get past any exception without problem. But yet the correct serial would not work when ran in sequence with the rest. I debugged my debugger with SoftICE and found out that some serials cause the thread to almost completely crash with DS segment being set screwy (DS was getting set to zero). Suprisingly, I was able to also restore DS with SetThreadContext with my little Auto-Debugger! :) (At thread startup, I do a GetThreadContext and get the value of the DS, ES, GS segments, and keep them so I can restore them during an exception). So now I could do anything, after an exception it just keeps truckin'

However, this is the second problem now, and there is no generic way around it. Well, there is, but it's probably more work than it's worth. I got all the exceptions to work great and the debugger rescues very well. BUT some serials cause the decrypted code to form a very big, long loop. Yep, some come out to be LOOPNZ or REPNZ instructions that are HUGE. So they sit there and sit there...lol. 3 ways to fix this would be to see what the decrypted bytes are and nop them during runtime, or re-create the serial match list while looking for LOOP, etc bytes (so you don't get bad serials that cause this), or having another thread time the length between tries, if it's too long, it forces it to continue to the next test.

Well, all 3 of these are just not worth it....for me right now since I've already solved it. Option 3 would be the most generic and effective on other targets other than this one.

Even with that, still when it got to the right serial, some code didn't decypt 100% right and it just caused an exception and hence my debugger kept going on. I haven't investigated why. So it seems there's a lot of problems you have to look out for - the auto-debugger has to recover from a large amount of errors.

So for now I figured it was not a worthy attempt anymore.

-nt20
nikolatesla20
02-25-2003, 02:59 PM
Here's the source for the debugger I was playing with. Maybe someone can learn something from it? It's nothing special anyway.. :) Just your run of the mill debugger.

I didn't get eflags register restoring in there.

The way to use this is:

.5 You need to make a text file with all the possible combinations of serials in it. It's only like 750K or so. You can download one at:

hxxp://webpages.charter.net/nikolatesla20/matches.txt

1. fix the program path to point to where bruteme2 is on your system, and the path to where the matches.txt file is also.

2. Run the debugger.

3. open the serial dialog box and enter a good serial, the first one is 131071. This will cause an exception, and from there the debugger takes over :)

4. Have fun. Bruting with the debugger is VERY fast, but it doesn't really "work" yet..

-nt20
nikolatesla20
02-25-2003, 04:28 PM
After some more testing, it's apparent there needs to be a better way to restore the broken stack. (if its really broken) Hardcode , even if it matches the machine its running on, just won't cut it.

-nt20
nikolatesla20
02-25-2003, 04:55 PM
Sorry I'm posting so much, but I just really enjoy this challenge.

I've managed to restore the stack effectively.

The debugger does this by throwing an int3 at the instruction before the decryption loop (This is hit the very first time thru the program). It then catches this int3 and while it's there it grabs what the stack values are and then keeps those for later, to restore when exceptions happen. I also decided to do the same with the register values. Then it restores the INT3 to the original instruction.

Using this I finally got the congratulations box to come up when scanning thru a group of serials.

It still won't work 100% yet on the whole list of serials because like I said, some serials decrypte to infinite loops. But this could also be fixed :)

It's almost there! Check out the new and improved version.

-nt20
nikolatesla20
02-26-2003, 11:38 AM
Debugger attack is functional!

Yep, it works now hehehe :)

AUTO-DEBUGGER BRUTE FORCER

Here's what I had to do.

Each time we "crash" we need to restore everything we can back to what it was when functional. Hence, we throw an INT3 on the beginning of the decryption loop, and when this fires one time, we pick it up. While we are there, we grab the thread's context so we have ALL the registers, the EFlags, even the DS segment. Also, I grab 200 bytes of the stack.

One other thing we want to do is grab the code of the decryptor routine itself, as well as the IAT table code. Why? Because if we've come up with junk instructions, they could have hosed ANYTHING in the program up, and usually they will. So EACH TIME we have an exception, we need to restore the following:

1. The original encrypted data.
2. The decryptor code loop.
3. the IAT table, since we need this to call messageboxa.
4. 200 bytes of the stack (I just picked the number 200) - just in case
5. All of the registers, and the DS segment.

If we do this, we should be successful at forcing the loop to do our work for us.

Now, what about decrypted code that locks up ? like an infinite loop or a huge string intsruction? How do we fix that?

Easy. We create a seperate watcher thread from our debugger. Each time we encounter an exception and fix the code for the next number test, we set a flag telling the watcher to start watching. I set a sleep time of 1 second on the watcher thread. If the thread gets past this 1 second and sees that it needs to still check status, it forcibly suspends the debuggee, patches an INT3 in the current instruction, and resumes it. This forces the bruteme2 program to generate an exception, which lets the debugger take over again and go to the next number.

It works quite nicely, easily going thru all the number combinations (so far as I've tested).

If you compile this and run it you will definitely find the code you need.

Some people might think that I am giving the debugger too much information - but think, no I am not. I simply tell the debugger to restore the complete state of the program each time an exception occurs. Then I also restore the IAT - since I know that the bruteme2 uses MessageBoxA to show us the message, I can hook into that with an INT3 and watch for that address in my debugger. If that address comes thru, I can assume the decrypted code came out to something valid enought to at least call MessageBoxA, so it is very likely to be the right serial number.

To use:

1. Get the list of Serial numbers
hxxp://webpages.charter.net/nikolatesla20/matches.txt

2. change the path of bruteme2 and matches.txt in the program to fit your system and compile it.

3. run the debugger

4. open "register" in bruteme2 and enter the first serial number, 131071.

5. Press OK and the debugger takes over.

6. Wait for the message to come up that it may have found the serial.

7. Enjoy

BY THE WAY: This works on Win2K and XP. I tested it in 9X and it crashes big time.

-nt20
ZaiRoN
02-26-2003, 12:58 PM
Hi nikolatesla20.

I am impressed! You have done a great work!
Did you sleep sometimes? :p

I would never have thought that it was possible to arrive to talk about debugger-attack and GA with a crackme of this kind. Is someone of you trying to write a genetic bruter?

Best Regards,
ZaiRoN
Kayaker
02-26-2003, 04:23 PM
ZaiRoN, I'm not sure if you meant "geneTic" or "geneRic", but I think nt20 may have a handle on the geneRic :cool: Very nice nikolatesla (Gauss?), you've been able to execute the code in a protected debug environment. It'll be interesting to see how it works in other cases. It's nice to see some debugger code. You could maybe tie the bruteforcer.cpp and the debugger engine together in memory with linked lists for example so you could code the bruteforcer algo a la plugin for different situations.

I wonder how using DEBUG_PROCESS compares to instead hooking directly the interrupts likely to be called during an error when the decrypted code is executed? If Hooking exceptions via the IDT are done in ring3, the handler uses the current stack, but if done in ring0, there's the benefit that in a privilege change there's a stack switch which saves the current EFLAGS, SS, ESP, CS, EIP, and error code information to the handlers stack. The correct stack could be restored this way.

You'd have to write or patch in code, one interrupt to be a control INT (say INT 6) in which you could save the stack info as it was immediately before you begin executing the decrypted code. Then you return control and allow the code to run, catching any faults. Pretty much as you're doing with INT3 I suppose, the difference seems to be using DEBUG over direct IDT patching afterwards. Like with anything, you'd be likely to encounter initial problems with this approach too.

One thing critical in hooking an interrupt is disabling all other interrupts with CLI and restoring them with STI within your handler code to prevent reentrancy issues (very bad!). Does the DEBUG_PROCESS debugging event code take account of this nt20?

This is a good thread. Lol, I'm still working on the GA angle ;) It may not be as applicable to this crackme, because as was said this is more of a Guess-me in the final analysis. If you had a more defined algorithm to work with, a more genetic approach might be able to be used. After the first little filter algorithm of the crackme you've already got a finite population of answers to start with, including the correct one, and you need to test them all for the second decryption part. If you hit the right fitness test then yes, I think you could use the GA idea to isolate the correct s/n. But then you still have to test the answer in some form which means a visual inspection/trial, or run it through nt20's debugger.

The first small algo has too many solutions to be viable for GA I think, it would take you too many Aeons of generations to produce the correct population of possibilities. This part at least can be separated out from the rest of the decryption stuff, and creating a simple loop to run the code and save the results would make any easy bruteforcer project for anyone still interested in it. Using these results to test out the second decryption layer is the more difficult part.

Nice work.

Cheers,
Kayaker
nikolatesla20
02-26-2003, 06:14 PM
Well, there does exist I believe the possiblity to create this into a more "generic" active debugger - but then it would be somewhat like an unpacker, except it's for encrypted code :)

In fact, an approach like this would be pretty handy for active encrypted code - for example, where you may have no idea what the code should look like, but you know what is communicates with. For example, I knew that it would communicate with MessageBoxA, so I could sit and watch that call, while walking over any faults. You will get there eventually no matter what because of this. A similar technique could no doubt work in other programs.

The debugger is messy right now - the addresses are hardcoded (OEP could be gotten from the file, and address to watch could be in an INI or something). Also, I just realized that it might also be more efficient to just restore a nice big block of code each time, rather than all these seperate arrays. (Just grab a big chunk). But hey whatever works.

I belive DEBUG_PROCESS is ok Kayaker, because it freezes the entire process and all its threads. You basically have full control from there. The only thing is, this may not be very effective on any type of program that "debugs itself" (but then what is).

I've tried some of these techniques on armadillo protected apps, and really gotten nowhere as well...hmm. But there are other techniques of course. This whole concept is more suited for forcing a decryption of a specific block of code, rather than running a whole program thru it. You could probably even get away with forcing the program's EIP directly to the code of interest right away, if you've pre-stored all the right values (like maybe have a "watch" cycle that just starts the program and watches it, and then kills it and restarts it or something.)

I really found this enjoyable, mainly for the fact that yes, it's good to see debugger code :) With so many protections using such code to "protect" themselves, the more experience you have with such code the better..and then you may be able to code good unpackers, etc, as well :)

Something I'd like to become proficient at doing :)

Of interest - WindowsXP has some new debugger features, for example, it is now possible to attatch to an active process, debug it, and then DETACH WITHOUT TERMINATING THE PROCESS. That is nice. Plus you can now do a "DebugBreakpointProcess" in XP, whereby you can cause a debug breakpoint exception in another process ! Haven't experimented with it at all yet tho, but it would save having to writeprocessmemory yourself eh? Just suspend the thread (maybe you have to do so, not sure, maybe you dont!) and then call that function and resume. So you could attatch to an active process, and force it to have a debugbreakpoint so you could break in ....

-nt20
obitus
02-26-2003, 10:26 PM
Here is a C version of the bruter that works. Fill in the searchData it is a character array so : 0xFF, 0xCA, etc.

I guessed what to search for based on someone else's post, in regards to having to initialize a counter.

obitus
evaluator
03-11-2003, 12:13 AM
Hello, there!

yeah! I try read upper 3kg english..

Nikola!
I plane for you XMM crackme!!!
Confirm, have you PIII (cel) CPU?
nikolatesla20
03-11-2003, 08:24 AM
Yes I have intel PIII 550 Mhz

-nt20


in PROTETORS help!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > in PROTETORS help!?
PDA

View Full Version : in PROTETORS help!?

evaluator
02-20-2003, 01:19 PM
Hi, BTW, +SPLAJ!

in respect for Woodmann's job, I forced myself to write this little gift(?),
for show: this RCE-MB is NOT for cracking, but for researching & knowledge_sharing

So..my DEAdR Protetors, lets enlarge your phuntasy.
For now, letz EASY-PEASY defiat some futures of "some" SiCe plugin called "ICEDUMP".

1. Future- "/PROTECT"
This quite cool future changes IDT's memory attribute to "SUPERVISOR",
so easy reports Read-Write attempt from Ring3 code.
However that is also quite easy way for detect this or change
using STANDARTness windz-API!

DETECT it using "VirtualQuery" function for IDT memory page.

CHANGE it using "VirtualProtect" function.
[note: R-only pages upper 80000000 won't change, because API so coded. {Hint!?}]

2. Future- in function "/TRACEX"- option "Emulate NT win32-selectors"

Read from & write back into selectors, & will self-defiated!
(:injoi:)

3. in function "/TRACEX" RDTSC is badly simulated.
in EDX returns 0;
EAX not increments;
???~:0???

4. under "/TRACEX" SIDT simulation:
A) reports IDT address upper C0000000h. Check it, so easy:)
(because of it "VirtualQuery" will fail anyway!)
B) DAEMON already reported, that address points to fake IDT with strange structure.

.
more come tomorrow:)

*-*
in attachment I put sample EXEcuteble
Usage:
1. Set "/PROTECT ON" in ICEDUMP & execute. It will detect & restore RW/User attrib.
2. Load EXE, start tracer with command "/TRACEX 401000 401040"
2a. if you enable "Emulate NT win32-selectors" with command "/OPTION T E" & again
try "/TRACEX 401000 401040", EXE will crash.
bart
02-20-2003, 05:54 PM
but keep in mind that some of antivirus software also protects IDT pages (agains ring0 virii) :)
evaluator
02-21-2003, 01:37 AM
so if it will RW/S, VProtect API can do RW/U:)
& then check for IDT..
^DAEMON^
02-21-2003, 11:23 AM
1. Future- "/PROTECT"
This quite cool future changes IDT's memory attribute to "SUPERVISOR",
so easy reports Read-Write attempt from Ring3 code.
However that is also quite easy way for detect this or change
using STANDARTness windz-API!

so easy reports Read-Write attempt from Ring3 code <--- RingX :/
it's taking usage of the page_table :)

uhmm NO emulation is perfect... the owl said it is compatible to a LOT of protections! of course it's always a cat'n'mouse game :) u write emulation, next guy writes detection code...

^DAEMON^
Gaia
02-24-2003, 08:16 AM
Hi Evaluator,

Here you can see how Svkp detects if IceDumps is in memory:

017F:xxxxxxxx MOV ESI, AddressOfExportsByOrdinal of Kernel32.dll
...(GARBAGE)
017F:xxxxxxxx XOR EDX, EDX ; reset counter
...(GARBAGE)
017F:0D7778BD CMP EDX,[EDI+14] ; check if EDX = max ordinal exports
...(GARBAGE)
017F:0D7778C5 JAE 0D77808F ; If Icedump isn't in memory will never jump
...(GARBAGE)
017F:0D7778D8 MOV ECX,00000007 ; check 7 times
...(GARBAGE)
017F:0D7778E1 INC EDX ; Inc Counter
...(GARBAGE)
017F:0D7778FA LODSD ; load current export in table
...(GARBAGE)
017F:0D77790F CMP EAX,[ESI] ; check if current Export are equal than previous
...(GARBAGE)
017F:0D777916 JNZ 0D7778A5 ; jump if "Bad Boy"
...(GARBAGE)
017F:0D777925 LOOP 0D7778DD ; check again (7times)

* AddressOfExportsByOrdinal of Kernel32.dll WITHOUT IceDump
--------------------------------------------------------------------------------
ÄÄÄÄÄKERNEL32!ResetNLSUserInfoCache+7054ÄÄÄÄÄÄÄÄÄÄdwordÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
0030:BFFC01D8 000013D4 000013D4 000013D4 000013D4 ................
0030:BFFC01E8 000013D4 000013D4 000013D4 000013D4 ................

* AddressOfExportsByOrdinal of Kernel32.dll WITH IceDump
--------------------------------------------------------------------------------
ÄÄÄÄÄKERNEL32!ResetNLSUserInfoCache+7054ÄÄÄÄÄÄÄÄÄÄdwordÄÄÄÄÄÄÄÄÄÄÄÄÄPROTÄÄÄ(0)ÄÄ
0030:BFFC01D8 000013D4 00056000 00056005 0005600A .....`...`...`..
0030:BFFC01E8 0005600F 00056014 00056019 0005601E .`...`...`...`..

As you can see SVKP checks if there are 7 EQUAL AND CONTIGUOUS DWORDS within
ExportsByOrdinalTable from Kernel32.dll. Since IceDump hooks some K32_Ordinals,
Svkp won't find those contiguous 7Dwords and then will exit silenty.

Best regards,
Gaia


How to make a master-key. (for RL locks on doors etc)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > How to make a master-key. (for RL locks on doors etc)
PDA

View Full Version : How to make a master-key. (for RL locks on doors etc)

Manko
02-20-2003, 05:09 PM
Just read CRYPTO-GRAM, February 15, 2003. (A sometimes interesting newsletter.)

Back issues are available at
<hxxp://www.counterpane.com/crypto-gram.html>. To subscribe, visit
<hxxp://www.counterpane.com/crypto-gram.html> or send a blank message
to crypto-gram-subscribe@chaparraltree.com.

And saw this article about a guy at AT&T Labs who applied an "oracle attack" to master-key-lock systems producing a master-key in minutes.
Is your door safe? :P

Blaze's home page for his research:
<hxxp://www.crypto.com/masterkey.html>

The paper itself:
<hxxp://www.crypto.com/papers/mk.pdf>

The reaction to the paper:
<hxxp://www.crypto.com/papers/kiss.html>

News articles on the research:
<hxxp://www.nytimes.com/2003/01/23/business/23LOCK.html>
<hxxp://www.mail-archive.com/cryptography@wasabisystems.com/msg03415.html>

Previous web references to Blaze's technique:
<hxxp://sethf.com/infothought/blog/archives/000164.html>

Jewel theft using the master key vulnerability:
<hxxp://www.nbc4columbus.com/news/1921563/detail.html>
/Manko


IDA 4.50 released, with integrated debugger!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > IDA 4.50 released, with integrated debugger!
PDA

View Full Version : IDA 4.50 released, with integrated debugger!

dELTA
02-20-2003, 05:42 PM
For the people interested, I can report that IDA 4.50 was released about a week ago.

In addition to quite a few general improvements, it now has an integrated debugger!!!

The combination of the usual deadlisting and the debugger makes it a really cool tool, that is very powerful and even conceptually new in some ways. For example being able to see the runtime stack split up nicely into its frames with all named stack variables and function parameters is really cool, not to mention some of the other stuff... Seems really nice to me anyway.

Here's a little tutorial about it from Datarescue:

http://www.datarescue.com/idabase/debugger/index.htm

And here's a list of all updates in the new version:

http://www.datarescue.com/idabase/idanew.htm

*drool*... :p
squidge
02-21-2003, 02:13 AM
Yup, and you can get it from the usual places already... Not found a version that actually has the integrated debugger however :(
Manko
02-21-2003, 02:27 AM
Yeah! It would be nice to get to play with THAT one! :D

Besides, it seems this crack is much more stable, though I've not had the time to try it fully...

/Manko
dELTA
02-21-2003, 06:57 AM
Here's some more or less interesting info from the Datarescue (IDA) messageboard:

Latest version of IDA uses the network to check for other copies running with the same key. Also, some possible plans for harder protections in IDA:

http://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=1;t=000490

Datarescue strikes hard against people running pirated version and asking support questions:

http://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=1;t=000475

No more freeware version if IDA at Datarescue's website (but Fravia+ promises to keep hosting it as long as he's allowed to):

http://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=1;t=000478

/dELTA
Iwarez
03-01-2003, 04:31 PM
I tried the debugger and it works good, but it can't (yet) offer the great overview that ollydebug allows me now. Maybe I can use it together with ollydebug to sort out difficult problems. Anyways, the datarescue guys did good work with version 4.50.
banshee
03-02-2003, 12:17 AM
Iwarez: Can you tell if the debugger designed as standalone plugin or it is integrated in IDA? One more question: are you registered IDA user or somebody already warezed new version?
squidge
03-02-2003, 04:27 AM
I've see new version warezed, but not with the integrated debugger.
esther
03-02-2003, 05:13 AM
*sigh****One more question: are you registered IDA user or somebody already warezed new version?

Hopes this topic will not becomes another "where can I find the warez version" shits in here.
squidge
03-02-2003, 08:04 AM
Originally posted by banshee
Iwarez: Can you tell if the debugger designed as standalone plugin or it is integrated in IDA?

If the next question after reply to this is "Will it work on an earlier version?", then the answer is no. It's requires version 4.50 to operate.
Iwarez
03-02-2003, 03:28 PM
I'am a registered user and the debugger is integrated. I think the released 4.50 version is fake.... Also, I don't think the real version will be warezed as the distribution system changed (eg. no downloads) and they are much more cautious after the 'cracked' version of 4.30
squidge
03-02-2003, 05:34 PM
Don't the new versions also have the "call home" (to help against warez versions) and "network check" function to ensure no one else on the local network is using IDA with the same serial? (to combat companies buying one copy and using it all over the company).
dELTA
03-03-2003, 07:32 AM
Check the URL to their message board that I posted above. They claim to have no "calling home" of any sorts, but it does give you a warning if you run it on the same LAN as another copy of the same license (it still works though). It sends one UDP broadcast package and then starts to listen on the same port, and then responds to any such broadcast it receives I think.
banshee
03-05-2003, 03:51 AM
Originally posted by esther
Hopes this topic will not becomes another "where can I find the warez version" shits in here.

I'm not asking for warezed version. Thing I wanted to know: is it possible to somehow make debugger available in demo version to test it. IDA released by Skamer as discussed on exetools forum has only time and save limitations removed, there is no debugger. So who is right: Iwarez says "I'am a registered user and the debugger is integrated." and squidge says "If the next question after reply to this is "Will it work on an earlier version?", then the answer is no. It's requires version 4.50 to operate." Squidge do you mean that debugger is a plugin? In 4.5 demo there are hidden forms and menus for debugger to work. If the debugger is integrated it could be enabled, I think.
squidge
03-05-2003, 04:07 AM
I've not used 4.50 personally, but from what I've read, the debugger can only be used on 4.50.
Iwarez
03-05-2003, 04:24 PM
As I said, it's not in the previous versions. And it's not standalone. The version 4.30 I had before had no trace of a debugger. The Datarescue forum did talk about the debugger after the 4.30 was released and they asked there if there was any need to integrate it. So, you need to have 4.50 to have the debugger.
Tron101
03-11-2003, 05:54 PM
Originally posted by banshee
In 4.5 demo there are hidden forms and menus for debugger to work. If the debugger is integrated it could be enabled, I think.

Banshee I think you are right about the debugger residing in the demo version, but it's just disabled.... I wonder if we can re-enable it. I'll have a look at it to see what I can do.

Btw, is there any way to enable "Patching" in 4.3 and 4.5? It doesn't seem to allow it anymore even though the option is there before you open up a file to disassemble, but it disappears after you open a file/previous project.
Iwarez
03-12-2003, 05:21 AM
Check the idagui.cfg file.

If this line is not there add it:
DISPLAY_PATCH_SUBMENU = YES // Display the Edit,Patch submenu
banshee
03-12-2003, 02:02 PM
Some results of my investigation:
Forms and I think all debugger routines exsists in demo exe. You can enable hidden Debugger submenu in the Main menu just by editing resources. Set Visible to True (it's BCB 5 application), thats all. But debugger still remain not active at any time. Then I found some magic dword 0x0054BA00, setting it <>0 enables something - you can setup process, debugger, view breakpoints list, watch list etc. but when you try to open Debugger window or start process program crashes. I think that dword must be part of some structure and must contain some address. I tried to imagine what address it could be and wrote a script to find possible addresses (it is not perfect I think ;-) :

static main()
{
auto i,a,filename,filehandle;
a=1;
filename=AskFile(1,"*.*","File for saving list of addresses");
filehandle=fopen(filename,"wt");
Message("\nList of addresses:");
fprintf(filehandle,"\nList of addresses:");
for(i=0x00401000; i<0x005bff70; i++) i is searched address
{
if (Dword(i+0x0c)<0x00401000) a=0; down range of the code
if (Dword(i+0x0c)>0x005285b1) a=0; upper range of the code
if (Dword(i+0x28)>0x000000ff) a=0;
if (Dword(i+0x3c)<0x00401000) a=0;
if (Dword(i+0x3c)>0x005285b1) a=0;
if (Dword(i+0x4c)<0x00401000) a=0;
if (Dword(i+0x4c)>0x005285b1) a=0;
if (Dword(i+0x54)<0x00401000) a=0;
if (Dword(i+0x54)>0x005285b1) a=0;
if (Dword(i+0x5c)<0x00401000) a=0;
if (Dword(i+0x5c)>0x005285b1) a=0;
if (Dword(i+0x60)<0x00401000) a=0;
if (Dword(i+0x60)>0x005285b1) a=0;
if (Dword(i+0x64)<0x00401000) a=0;
if (Dword(i+0x64)>0x005285b1) a=0;
if (Dword(i+0x68)<0x00401000) a=0;
if (Dword(i+0x68)>0x005285b1) a=0;
if (Dword(i+0x6c)<0x00401000) a=0;
if (Dword(i+0x6c)>0x005285b1) a=0;
if (Dword(i+0x70)<0x00401000) a=0;
if (Dword(i+0x70)>0x005285b1) a=0;
if (Dword(i+0x74)<0x00401000) a=0;
if (Dword(i+0x74)>0x005285b1) a=0;
if (Dword(i+0x78)<0x00401000) a=0;
if (Dword(i+0x78)>0x005285b1) a=0;
if (Dword(i+0x7c)<0x00401000) a=0;
if (Dword(i+0x7c)>0x005285b1) a=0;
if (Dword(i+0x84)<0x00401000) a=0;
if (Dword(i+0x84)>0x005285b1) a=0;
if (Dword(i+0x88)<0x00401000) a=0;
if (Dword(i+0x88)>0x005285b1) a=0;
if (Dword(i+0x8c)<0x00401000) a=0;
if (Dword(i+0x8c)>0x005285b1) a=0;
if (a==1) Message("\n%08X function %08X %08X",i,Dword(i+0x3C),Dword(i+0x8C));
if (a==1) fprintf(filehandle,"\n%08X function %08X %08X",i,Dword(i+0x3C),Dword(i+0x8C));
a=1;
}
fclose(filehandle);
}

The conditions of comparing is that there must be addresses of some functions at certain offsets to the address we trying to find. I found about 64 addresses that may satisfy the conditions, here is the result

List of addresses:
00495438 function 00512840 nullsub
00495628 function 00512840 nullsub
00495708 function 004957D8 n
00495728 function 00512840 nullsub
004973EC function 00512840 nullsub
00497614 function 00512840 nullsub
004976F0 function 00512840 nullsub
004977E0 function 00512840 nullsub
00498B9C function 00512840 nullsub
00498C84 function 00512840 nullsub
00498D50 function 00512840 nullsub
00498E18 function 00512840 nullsub
0049AF0C function 00512840 nullsub
0049B148 function 00512840 nullsub
0049D258 function 00512840 nullsub
0049DABC function 00512840 nullsub
0049E2E4 function 00512840 nullsub
0049ECF0 function 00512840 nullsub
0049F80C function 00512840 nullsub
0049FFE0 function 00512840 nullsub
004A0084 function 004A01DC n
004A01E4 function 004A0310 n
004A0A5C function 00512840 nullsub
004A1A98 function 00512840 nullsub
004A2A28 function 00512840 nullsub
004A2B1C function 00512840 nullsub
004A2C18 function 00512840 nullsub
004A9898 function 00512834 __fastcall System::TObject::SafeCallException(System::TObject *,void *) proc near
004A989C function 00512840 nullsub
004A9944 function 004A9A0E n
004A9E48 function 00512840 nullsub
004AA120 function 00512840 nullsub
004B0434 function 004B051C n
004B0454 function 00512840 nullsub
004B0570 function 004B0660 n
004B0590 function 00512840 nullsub
004B06B0 function 004B0794 n
004B06C0 function 004B0788 n
004B06D0 function 00512840 nullsub
004B9834 function 004B998C n
004BA1A4 function 004BA2E8 n
004BA1C4 function 00512840 nullsub
004BAF84 function 004BD4B4 __fastcall Forms::TCustomForm::AfterConstruction(void) proc near
004BB098 function 004BB23C n
004BB0A4 function 004BB1F0 n
004BB0A8 function 004BB228 n
004BB2B4 function 004BB37C n
004BB36C function 004BB458 n
004C5C1C function 00512840 nullsub
004C5E9C function 004C600C n
004C5EA8 function 004C5FCC n
004C6024 function 00512840 nullsub
004C6A68 function 00512840 nullsub
004C7724 function 00512840 nullsub
004CD0B0 function 00512840 nullsub
004CD1EC function 00512840 nullsub
004CEB18 function 004BD4B4 __fastcall Forms::TCustomForm::AfterConstruction(void) proc near
004CF888 function 004CF918 n
004CF9AC function 00512840 nullsub
004CFAE0 function 00512840 nullsub
004D05F8 function 004D06C4 n
004D0608 function 00512840 nullsub
004D0EF4 function 004D1028 n
004D102C function 004D10D0 n
004D103C function 00512840 nullsub
004D1100 function 00512840 nullsub
004DFD98 function 00512840 nullsub
004E14F0 function 004E15A8 n
004E26A0 function 00512840 nullsub
004E3694 function 004E37E0 n
004E3698 function 004E381E n
004E3850 function 00512840 nullsub
004E44DC function 00512840 nullsub
004E5A4C function 004F6048 __fastcall Comctrls::TCustomListView::CMDrag(Controls::TCMDrag &) proc near
004E5B14 function 00512840 nullsub
004E69F4 function 00512840 nullsub
004E6A9C function 004E6C08 n
004E73E8 function 004F9F8C __fastcall Comctrls::TToolBar::WMEraseBkgnd(Messages::TWMEraseBkgnd &) proc near
004E7EE4 function 00512840 nullsub
004EFA7C function 00512840 nullsub
004F2528 function 00512840 nullsub
004FD470 function 004FCBB8 n
004FD6C4 function 00512840 nullsub
004FD7C0 function 00512840 nullsub
004FE058 function 004FCC58 n
005075FC function 00512840 nullsub
0052B9F0 function 004A9964 n
0052B9F4 function 005060D0 SomeFunction
0053F7A8 function 005060D0 SomeFunction
0054A6E0 function 004D0F14 n
0054A6E4 function 005060D0 SomeFunction
0054A850 function 005060D0 SomeFunction
0054EB48 function 005060D0 SomeFunction

first address is that magic value, second is the value at 03Ch offset to the first, it is an address called somewhere as a function and comments are is there any real function at that address (n means no function). I checked only one offset - 03Ch, so there are 15 more to check. Could somebody take a look may be I'm doing something wrong. And if here is some Delphi/BCB gurus their advice might be helpful.

P.S. May be my explanation is not clear enough, so any questions?

P.P.S. I forgot - all addresses is for +Skamer's internal release.
dELTA
03-12-2003, 02:50 PM
To be honest, I don't think Ilfak and the guys would ever leave the code of the non-demo parts intact in the demo version.

The only reason that the resources are still there but disabled is most likely just because they are not as convenient to #define away as the code itself. That is also most likely the reason that the program crashes once you have re-enabled the resources, since the code they are referring to in most parts just isn't there.

But hey, you never know, let us know if you find out they made some embarrasing mistakes with leaving the code intact.

I can already imagine the nerd-tabloid headlines:

"ILFAK GUILFANOV LEAVES INTACT CODE IN IDA DEMO VERSION, WE HAVE THE EXCLUSIVE HEX-DUMPS".

:D

dELTA
squidge
03-12-2003, 05:11 PM
Originally posted by dELTA

I can already imagine the nerd-tabloid headlines:

"ILFAK GUILFANOV LEAVES INTACT CODE IN IDA DEMO VERSION, WE HAVE THE EXCLUSIVE HEX-DUMPS".

:D

dELTA

LOL :) Although, like yourself, I find it highly unlikely to see the code in there, so not bothered to even look myself. The demo version is quite well protected* against hackers, with large portions missing, so I don't see why they should leave the debugger in there.

* = meaning it takes quite a while to hack it, compared to certain other commercial software using ready made off-the-shelf protection :)
banshee
03-13-2003, 07:48 AM
Guys, I'm sorry, I've mistaken. Given addresses is not for +Skamer's release, but for native demo. But nobody going to check it, so doesn't matter ;-)
kr0n0
03-19-2003, 07:48 AM
is +Fravia still hosting the demo legal version? 4.3 right?
since going throught datarescue requires one to register... etc...

could someone point the url? :rolleyes:
(not that i didn't search; i did)
thnx :cool:
banshee
03-27-2003, 09:48 AM
There is 4.5 demo on ftp.exetools.com May be I didn't understand you, what do you mean saying legal demo?
esther
03-27-2003, 11:43 AM
Hi kr0n0,

Theres an old version in fravia anti crack de (ida3b)

Not 4.3.

>May be I didn't understand you, what do you mean saying legal
demo

Theres no demo out in fravias site only beta version

updated:

I supposed legal demo means you have to fill the form and download at dataresuce's site


KeyGenning Internet Download Manager v3.12
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > KeyGenning Internet Download Manager v3.12
PDA

View Full Version : KeyGenning Internet Download Manager v3.12

OHPen
02-21-2003, 09:06 AM
hi,

i tried to write a keygen for it but i stuck !

A valid serial looks like that:

xxxxx-xxxxx-xxxxx-xxxxx

the x have to be 0-9 or A-Z, nothing else is allowed.

There are four calculations for the concerning parts. I'm working on Win2k.

I used following data:

First Name: Major
Last Name: Natano
E-Mail: OHPen@gmx.net
Serial: 12345-67890-ABCDE-FGHIJ

to debug in sice.

It seems to me that the F Name L Name & E-Mail is not necessary for the serial calculation. The Serial is compared to a table in the proggy which can be found at [EAX+004B2F74].

1.Part calculation.(XXXXX-xxxxx-xxxxx-xxxxx)

0043081E -> First Char of Serial in DL
0043082C -> Compare Char with the table and count the place it stands.
etc.

2. Part calculation.(xxxxx-XXXXX-xxxxx-xxxxx)

0043085C -> First Char of Serial in DL
0043086C -> Compare Char with the table and count the place it stands.
etc.

3. Part calculation.(xxxxx-xxxxx-XXXXX-xxxxx)

0043089B -> First Char of Serial in DL
004308A9 -> Compare Char with the table and count the place it stands.
etc.

4. Part calculation.(xxxxx-xxxxx-xxxxx-XXXXX)

004308D3 -> First Char of Serial in DL
004308E1 -> Compare Char with the table and count the place it stands.
etc.

after the calculation of the parts i have 4 values which are use for next calculation.

PART1=34681A9
PART2=3D0C707
PART3=1070E85
PART4=26A0C55

This "seeds" have to be divided by some consts. Every "Seed" with a different const.

So there's the point i stuck really hard ;(
I don't know what happen then. I've someone can help i would be great ;)

THX in advance,

OHPen
ZaiRoN
02-23-2003, 08:26 AM
Hi OHPen,

You are on the right road, the only thing you need to do is to understand the reason the final divisions are done for. After each division, the program checks for the rest of the division. Why? If you will answer to this question, you will solve the entire problem. After that, to find a working serial is easy.

However, there is something strange in this program. The messagebox is showed also when you have finded a valid serial. I have not tested if the new features are enabled but I can see my details in the "about" dialog. It may be only a bug, I don't know.
Maybe it needs a deeper look.

ZaiRoN
OHPen
02-23-2003, 12:52 PM
THX for your Reply ;)

I realized that what you say too ;)
First time i reversed the app i try to enter a valid Serial( It really a valid Serial) and the Failed-Box appeared. That's why i thought i don't understand the algo ;)

But i you are right maybe it's a bug in the prog. Maybe not, i will check this.

Cya
Manko
02-23-2003, 04:54 PM
It's a sort of "protection". Screwing with a crackers mind... I have read about this somewhere else... Or, I am wrong... But I have read about it on some other "target". Think it was even explained by the author, that time... :)

/Manko
OHPen
02-23-2003, 06:42 PM
At this point it seems to me that the progy isn't regable ;(

I created a valid serial, passed all checks and the programm exits. After restarting a Nag appears and the app is already unreged. During the registration my serial is written to the registry. Everythings looks like a standart registration procedure but there is something strange.

I looked around and saw that no one was able to write a keygen in the past. For all former version are only patch availible. That is very strange. Maybe there is no way to create a valid serial for this app, i don't know atm.

I tried it with this one:

11111-11111-11117-11115

For all parts the rest of the division is null, like it is on a "real" Serial. But it doesn't run.

It would be great if some people take a took on this app in order to find out what's this strange Protection about.

Greetz OHPen
Manko
02-23-2003, 07:47 PM
Have you checked to see if there's an aditional regcheck-routine, special when you start program?

Smarter programmers will have additional restriction-checks on the serial at other places. So's lazy cracking won't be rewarded. (NOT aimed at you.)

Have you traced it from when it grabs the serial in the registry and looked if it's another routine? or if it does something else with it anyway...?

Still it might well be that the regroutine is there but not really "connected"... (used)

/Manko
Solomon
02-23-2003, 07:49 PM
Have you checked the keygen from PGC?

I guess this baby has fake serials to fool crackers, and also has real serials.:D
Bengaly
02-24-2003, 01:16 AM
from PGC release nfo:

we have found a hidden check.
This happens when you reboot your
computer after registering with our
keygen. IDM "phones home" and compares
a value in the registry with a value
from "home". If that value is not
there than a message box will appear
stating that the "Registration Code isInvalid".
Which means registered customers
register thier product with a
"register.exe" type program. This
program usually generates thier serial
number, and sometimes places things in
the registry or file.
Well, IDM takes advantage of this and
uses it to make sure the program is
not JUST registered with a
registration code, because that means
they never had the "register.exe",
hence. a stolen registration code.

i think that more talking about this application will might turn into a crack request.
OHPen
02-24-2003, 12:13 PM
Okay i see,

only a patch is the write way to do that bitch ;)

THX,

OHPen


diffrence between f11 and f12 in sice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > diffrence between f11 and f12 in sice
PDA

View Full Version : diffrence between f11 and f12 in sice

fumble
02-22-2003, 09:03 AM
sry for this very newbish question but i am new so whatever hehe

what is the diffrence between f11 and f12 in sice? as far as i understand f11 breaks at the position of the nxt intruction after a function call (using the info stored at @ss:esp) while f12 simply watches out for the next "ret" to break one intruction after it. so it looks to me like 2 diffrent ways to achieve the same. but numega aint stupid so they wouldnt have defined 2 hotkeys for the same thing if there werent an important diffrence....would be thankful for an explanation :)
nofurs
02-22-2003, 12:46 PM
BENGALY!

YOU HAVE 2 NICKS AT THESAME TIME :D
Bengaly
02-22-2003, 12:58 PM
?
Manko
02-22-2003, 01:07 PM
Hmm... dunno...

But I have few observations...

..sometimes a push adress ret is used to jump, then f12 will not get you to the adress after the call. f11 will...

..what if execution is redirected elsewhere in a call, then f11 would fail you as the code don't return to the adress after the call and run the prog 'til next bp. :(

Probably many more things might be mentioned by others?

/Manko


PE Rebuilding Topic
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PE Rebuilding Topic
PDA

View Full Version : PE Rebuilding Topic

Bengaly
02-22-2003, 11:30 AM
heya,
some of you might find it usefull as much as me,
for now i am trying to code a simple PE rebuilder [ NOT a aligner]..
sadly no one really posted some usefull code and the rebuilding is quite more of a personal knowledge..
with rebuilding i mean: fix a dumped file [exe,dll..] and make it works like it was in the first place,
also dont take it wrong that it is another Revirgine/Imprec thingi,
all i mean is to take a normal runnnig process [not encrypted] i.e: notepad and just dump and fix it [kinda stupid thing to do, but its just for more of coding experience]

so far..by comparing through some pe rebuilders like: procdump/Lordpe iv came to bit of something:

tested on Win2k:
-------------------
FileAlignment = 4096 (1000h)
SizeOfHeaders = 4096 (1000h) (seems too big)
SizeOfRawData = VirtualSize
PointerToRawData = VirtualAddress

prob with SizeOfHeaders is that it calculated from the sum of all headers untill row of first section i think..so when dumping from memory
the dump will contain probably padded zeros (000000....) so you get a diff sizeofheaders than it should.
this trick is been used at LordPE as far as i'v noticed [ probably missed some more small stuff] and it doesn't reduce the dump's size, but it does work from time to time.
however procdump does reduce the image size by eliminating padded zeros, and didn't check more what it does..but not all dumps work =).
if some have more detailed way, tricks, good rebuild tuts please post it here...i really wanna have something that is actually public to all .
squidge
02-22-2003, 02:11 PM
You may find this helpful, it's a little process dumper thingy I started ages ago and never got around to continuing. It's quite basic still, but may give you something to use. Written in Borland C++ Builder 5.

(12kb download)
Bengaly
02-22-2003, 03:56 PM
hey,
thnx for the attachment!, ..though i don't code at borland c++ (so i can't compile your src).
but, i already have a dumper that i have done.
only thing is to collect nice tricks/examples to fix a bad dump.
squidge
02-22-2003, 06:30 PM
With your own dumper, did you list the processes in the same way as I have done? Just as there seems to be more than one way of doing so, and programs like LordPE seem to be able to get access to more processes than my own can. (My own prog gets Access Denied to a lot of the system processes, and I was just wondering how they get around this).

Thinking about dumper fixing however, if a PE file had a code section that contains nothing but several hundred Kb's worth of zero's, shouldn't it be possible to zero-ise out the RSize, but leave Roffset, Voffset and Vsize alone to have the end result of exactly the same thing in memory (Voff/Vsize not touched) but taking up no space on disk?
Bengaly
02-23-2003, 12:32 AM
With your own dumper, did you list the processes in the same way as i have done?
well, i checked your src quickly, and i haven't done it the same.
i have done it like this way:

...
...
hProcess=OpenProcess(PROCESS_VM_READ, 1, PID);
....
// allocating enough bytes to put the memory into
MemoryData=(char *)malloc(sizeof(char)*hFileSize);
...
...
...
ReadProcessMemory(hProcess,(LPVOID)ProcessAddress,(LPVOID)MemoryData,hFileSize,NULL);
...
...
WriteFile(hFile,MemoryData,hFileSize,&MemWritten,NULL);
....

thats +- how i do it which seems to be working fine,
maybe u can't dump all process because you check VirtualQueryEx() and it prevens you from accessing it. (can't say really because i can't compile/debug)

anyway, as i have seen from procdump, it does kill padded zeros from the dumped image and correct the header.
thus, not all zeros are cuted down so it probably calculate how maby to kill, however this is not how lordPE does, because it doesn't care about the padded zeros and only fix the header.
which is in both cases sometimes work/doesn't work .
squidge
02-23-2003, 08:08 AM
Thanks for that, will have to experiment more (not that I want to dump system processes - just wondered why it was different to the way LordPE etc does it)

So, basically, all you want to do is write a program that will dump, say, notepad paused at EP, and then trim the image, and end up with a fully working file with the size closest as possible to the original (as the original will not be packed) ?
Bengaly
02-23-2003, 01:38 PM
yeah well, a more detailed explanation will come handy .
i know the +- lordPE/procdump dump fixed method though, mabye there are some other ways, or maby more stuff to know in order to make the dump better.
trying to delete the padded zeors is one way, but u can ignore it though (at least i think) as long as u fix the header's size,vsize..etc
you can deleted the padded zeros to match the original exe as its on the hdd (at least i think it would work)
sv
02-24-2003, 04:04 AM
Hi Bengaly

I have coded a little dump2exe rebuilder.
To reduce exe size, i take Virtuall offset + VirtualSize and i check first non zero byte (i=i-1).
When found you have to round 200h and fix header (Raw offset & size).
If you find only zero byte, it's a BSS section.
It works fine.

Regards
SV
Bengaly
02-24-2003, 06:00 AM
you mean checking's each section.
by setting a pointer at the raw offset, and walking untill you find non zero byte, and mean while calculate how many zeros to trim and the offset where the section starts in the dump (the non zero byte) +-
if not, mabye you can show a little demostration?
Bengaly
02-24-2003, 07:44 AM
you can try my tool (see attachment).
its till wip, but if you use Win2k (didn't text XP yet) you will be able to dump the process and fix it in the pe editor (+- LordPE's way)
Win9x is not yet supported for dumping because i dont have it installed here (yet) :p

btw,
if it nags about dlls (VS errrr) its here:

-> http://www.geocities.com/shanytc/msvcp60.zip
-> http://www.geocities.com/shanytc/mfc4261.zip
-> http://www.geocities.com/shanytc/msvcrtd.zip
squidge
02-24-2003, 08:12 AM
Seems like it's becoming a useful LordPE rip-off :)
Bengaly
02-24-2003, 09:32 AM
hehe, i didn't wanted to make ugly look pe editor, so i just made it user friendly which looks like lordpe - not all though :P
sv
02-25-2003, 02:44 AM
Hi Bengaly

Sorry if my post wasn't clear ;)

Yes, for each section, point to virtual end, search non zero byte in ascending mode, when found round adresse (200h), fix sections infos (raw size and next section raw offset).

Regards
squidge
02-25-2003, 04:05 AM
Shouldn't you get the FileAlignment value from the PE header and round on that rather than assuming 200h? Unless of course you update the header to your newly rounded value.
sv
02-25-2003, 07:49 AM
Hi squidge

I think best value is less value.
I always have seen a file alignment of 512 bytes.
Humm ... for compatibility (W95) i don't think it can be less.

Regards
[NtSC]
02-25-2003, 11:22 AM
I saw a few that didnt use 200h..
Before u run into trouble sometime,and dunno why..better grab the alignment info from the pe-header and calculate the correct value.. saves more time,than possible upcoming bughunting :P


Problems with Softice detection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Problems with Softice detection
PDA

View Full Version : Problems with Softice detection

tazmanian
02-24-2003, 08:24 AM
I'm using a program that loads up BEFORE the win98 login.

Here is the problem.
I dont know what file that detects softice.

It crashes when sice is active, and only shows a dialogbox with the error with the program name: "PROTECT"
BUT there is a lot of protect files in this program

protect.exe
protect.vxd
Protect.sld
and maybe other protect.something hidden in windows directory or whatever.

The question is...
How can i identify witch file is the problem?

This "Protect.sld" is an executable file, and its packed, i think that this calls the VXD.
I tryed to unpacked it, but i was not successfull with import table.

I want to identify witch file detects softice.
Protect.exe i unpacked it, so it cannot detect sice.

Thx
LOUZEW
02-25-2003, 04:28 AM
Hi, tazmanian

Try to load SI at boot !
You can mask SI, there is some SI anti-detect tricks on this board, use the search button !


FLEXlm 7.2+: Fake daemon
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXlm 7.2+: Fake daemon
PDA

View Full Version : FLEXlm 7.2+: Fake daemon

netman
02-25-2003, 01:59 AM
woodmann,

pls remove this thread, thanks!

-- netman


Test
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Test
PDA

View Full Version : Test

LOUZEW
02-25-2003, 04:21 AM
Just a test to check posting capabilities !

From a few weeks, i can't post or reply on this forum, login/password asked any time and posts points to "forum invalid".
After trying many things, i've changed my PWD account, it seems to be OK now !
squidge
02-25-2003, 04:49 AM
all you had to do was empty your cookies...
esther
02-25-2003, 11:03 AM
or delete internet tmep files

all you had to do was empty your cookies...
cookies? you cookie monster :p
LOUZEW
02-25-2003, 02:37 PM
Hi, Squidge & Esther
Thank's for trying to help !

Before resetting my password i've done your tricks (clearing internet temp folder and cookies), nothing to do.

The ONLY ONE solution i've found is to change password on my account, i don't know why ! ! !

All is OK now, Thank's again !


File Analyzers (noob help)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > File Analyzers (noob help)
PDA

View Full Version : File Analyzers (noob help)

Aquatic
02-25-2003, 02:38 PM
I want to unpack a .exe that I have so that I can get more referenced text strings from Win32Dasm.

When I launch 90% of file analyzers to determine the protection on the .exe the analyzer program will just flash a dos box and then it will disappear...so how the fek am I supposed to use it?

(There seems to be no GUI for any of these File Analyzers).
Bengaly
02-25-2003, 02:44 PM
use PEIDentifier 0.8 by snaker (could be a newer version, dunno), its a good tool
Aquatic
02-25-2003, 02:58 PM
Hmm. I could only find v0.7 of that program, and it doesn't tell me what protection/packer is being used...etc
squidge
02-25-2003, 03:26 PM
Most analysers need to be run from the dos command line. PEID will run from windows, but make sure to use the options (eg. normal/deep/hardcore search).

0.8 is on Protools.
Clandestiny
02-27-2003, 08:58 PM
Its not necessary to know what packer was used in order to unpack something (/tracex + a small dose of brain power does wonderful things, you know :p ).

No seriously, if you look at your target in a PE editor sometimes the names of the sections can give you a clue about the packer used. Similarly, you can also sometimes find strings in a raw hex dump that will provide clues.

Cheers :)
Clandestiny


compressed data in files?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > compressed data in files?
PDA

View Full Version : compressed data in files?

Aquatic
02-25-2003, 02:52 PM
I have a program that uses compressed data in these files. So when I open these files in a HEX editor to search for values that the program gives me I cannot find those values in the files by themselves.

So I guess when the program loads these files it uncompresses the data and it makes sense. So, the uncompressed values displayed by the program will not be searhable in these files with just a hex editor.

In other words when the program uses these files the uncompressed data is shown, but if you were to open one of these files on its own in a hex editor you would not be able to just search for the uncompressed values that the program displayed.

Anyway to get around this?
squidge
02-25-2003, 03:25 PM
yup, uncompress the files :)
Aquatic
02-25-2003, 03:39 PM
Har har :rolleyes:

Yes, but I need to figure out how they are compressed in order to uncompress them.

There must be some sort of 'compression algorithm' or something like that.
Woodmann
02-25-2003, 04:28 PM
Howdy,

You need to tell us. Get a PE scanner.

Woodmann
dELTA
02-25-2003, 04:43 PM
Are the files executable (i.e. "self-extracting"), or are they processed by another program? In any case you have to pinpoint the uncompression routine in the code of the program, and then analyze/rip it.

If the compressed files are executable it is often very easy to find the code for this routine, since it's then practically the only code in the entire program, and will also most likely be placed very near the entrypoint of the executable.
squidge
02-25-2003, 05:22 PM
I've a feeling he's talking about compressed datafiles however...
Aquatic
02-26-2003, 02:04 AM
Originally posted by squidge
I've a feeling he's talking about compressed datafiles however...

yes.
dELTA
02-26-2003, 05:52 AM
Ok, still same approach, just a little harder to pinpoint the exact uncompress code. I would recommend breakpointing on some file read API:s though, and trace from there. That will probably land you pretty close too.
Aquatic
02-26-2003, 01:37 PM
Originally posted by dELTA
Ok, still same approach, just a little harder to pinpoint the exact uncompress code. I would recommend breakpointing on some file read API:s though, and trace from there. That will probably land you pretty close too.

Should I use Filemon for that? (instead of breakpoints).

It shows me where the data is written to these files, but it only shows the offset and the length. What does the "length" mean in Filemon?
squidge
02-26-2003, 03:04 PM
the length of the data that was written ?
dELTA
02-26-2003, 04:38 PM
You would want to pinpoint where in the executable code that the decompression is going on, not where in the data files that things are read (ok, maybe later on you might possibly want to know that too, but this will probably be quite clear once you have read the code anyway). So no, FileMon is probably not a very good approach to start out with, it should mostly be used to see which files a program reads, not what it reads inside them.

Hook API-commands like OpenFile, ReadFile and so on, and see where it takes you in the code.


Thanks!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Thanks!
PDA

View Full Version : Thanks!

mhonzell
02-25-2003, 07:06 PM
While I don't tend to post, I read profusely and just wanted to thank you all for some excellent work!

The INT1/INT3 tool worked great!

Never found the Kayaker tool, but then I ended up not needing it.

Moving to XP created great depressions in my forehead with SI. Sure didn't want to learn everything from scratch and this board has helped greatly.

THANKS!:D
nikolatesla20
02-26-2003, 08:29 AM
thanks for the comments :)

-nt20


security related ASM paper
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > security related ASM paper
PDA

View Full Version : security related ASM paper

Zero
02-26-2003, 05:54 AM
not sure where to put this, but maybe interesting for some ppl:

http://www.lsd-pl.net/documents/winasm-1.0.1.pdf

From the introduction:
This paper results directly from experiences of our group in the field of real penetration tests....


new debugger(vvvvvvvvery good)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > new debugger(vvvvvvvvery good)
PDA

View Full Version : new debugger(vvvvvvvvery good)

akimp3
02-26-2003, 12:05 PM
Hi
I have not come her for some time and today i see that my account was deleted.

take a look at this new debugger it is free and very good

h++p://web.vip.hr/inga.vip/index.htm
tell me what do you thin k about it.
It would be nice to write some RE tutorial for it.

bye
Kayaker
02-26-2003, 01:12 PM
Hi

There's a regular purging of unused member accounts every so often, so it pays to post occasionally ;-)

I tried this (Softice unfriendly) debugger out a few days ago, the pictures look nice but it keeps crashing on my Win98 system with various faults, whether I try to GET a process or ATTACH a process.

...invalid page fault in module <unknown> at 0000:10001409...

...Int 10h fault in msvbvm60.dll...

...GPF in user.exe...

I'm sure others will have better luck with it, but I guess that's my RE tut on it :p

Kayaker
ZaiRoN
02-26-2003, 01:14 PM
Hi,
it happens to me too. (Os=win98se)

ZaiRoN
Bengaly
02-26-2003, 02:13 PM
runz ok over win2k,
but thats a really not user friendly debugger which seems even harder to use than w32dasm's :D
i'll stick to sice and olly.
disavowed
02-26-2003, 09:17 PM
i love the author's name: Vanja Fuckar
Kayaker
02-26-2003, 09:32 PM
Originally posted by disavowed
i love the author's name: Vanja Fuckar

Lol, I was installing it at work and was trying *not* to make it use that name in all the usual install steps, but that word still ended up as part of an uninstall string in the registry. There are network registry scans that are going to pick that up, hehe.
Jon
02-27-2003, 12:29 AM
hmmm well i like the interface not like sice or ollys but ill give it a shot 10x m8 :)
seven
02-29-2004, 06:40 AM
powerfull tool
not stable ( win98se )
thx so much


bug in FGInt lib? (RSA)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > bug in FGInt lib? (RSA)
PDA

View Full Version : bug in FGInt lib? (RSA)

gnog
02-26-2003, 02:06 PM
Ive looked at the FGInt library for delphi (http://triade.studentenweb.org/GInt/gint.html), which implements big num usage for RSA.

it seems that it doesnt encrypt right, c = m ^ e (mod n) isn't calculated correctly.. anyone else noticed this bug ?

if so, where is the bug in it and how can you fix it?

thanks in advance..
Solomon
02-26-2003, 07:46 PM
Are you sure? NetCaptor also uses FGInt to implement its serial number protection and it works.:D
bart
03-02-2003, 01:57 PM
FGInt works fine

C5E974FFB63D4A3B7717D9CC07AFD194B0B6003668BC7FEAC4EEDD4467BC6C0214394465D55EA0D8A6F5B8E840CE027B7E3E26AB340E5845650D19685D08177018F6A91F7C08A18693FF7C440FEB70A9056ACCF57A2527CEAB7512A85A5472D7F31D9E398EAE6043F8CFD93A0CBB2D04495406A44DD16712CA10C9E9FA6F5E57

yeah, crack me baby :), but its possible to replace this key with your own key
Solomon
03-30-2003, 01:53 AM
Another prog which uses FGInt: FastBrowser Pro.


unloading softice?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > unloading softice?
PDA

View Full Version : unloading softice?

Aquatic
02-27-2003, 01:46 AM
I have driver studio 2.6 and I don't have Softice load before windows, I just load it manually.

I was wondering if there was a way to "turn off" or "unload" softice so that when I press Ctrl+D softice no longer comes up...

There must be a way.

Maybe via the command line?
nofurs
02-27-2003, 06:24 AM
don't load it manually.once softice is loaded you can't "switch it" off.reboot your machine


How to find referenced strings pre-loaded by DLL's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to find referenced strings pre-loaded by DLL's
PDA

View Full Version : How to find referenced strings pre-loaded by DLL's

CADZzz
02-27-2003, 04:50 AM
1)What is the problem....
MIDAS/gen , program for analysing steelstructures (www.midasit.com)

2)What is the protection.....
Sentinel

3)What tools are you using....
Ollydbg1.09

4)What tutorials have you read....
Cyberheg /Crackz (respect)/Goatass etc...

5)Show your output listing WITH comments....

Text strings referenced in wg_meng:.text, item 1489
Address=06F58385
Disassembly=PUSH wg_meng.06F88EF8
Text string=ASCII "Lock is not detected.
Please confirm if the Lock is properly connected to a Parallel Port."

6)NOW ask your question....

First i want to say is that i am totally not interested in the protection itself , my interest goes out to testing and evaluating as much as CAD/FEA programs as there r on the market, just for evalution purposes only (believe me or not)...and make a good choise for buying licenses for my construction company...

To fully test CAD programs its mostly neccesary to have full working versionsu can play with. Thats why i learned a little ASM and mega lots of ZEN for the programs that i cant find cracked in the warez scene.

As i dont understand enough ASM to emulate and reverse dongles i most times search for the piece of code that triggers the program and patch it. Mostly my chances a pretty good when the protection also includes a trial period, cause most developers just build in switches for triggering the program how to run.

My recent target r the MIDAS programs....

I managed to crack 1 out of three already...the FEModeler...because it was easy to find where the program was triggered...by referenced text strings.
Next r MIDAS/gen and MIDAS/civil.

But the other 2 programs pre-load all the text strings in memory (cause its multilanguage i guess).
I found the dll with all the english text in it, but no calls were made to that dll at all (tested by setting bp's).

Hehe...finally my question:

How can i find the place where the text is stored in memory and more important where its called from!

Regards,
CADZzz
dELTA
02-27-2003, 06:53 AM
One way would be to use e.g. softice (or any other debugger capable of setting memory-read breakpoints). Then loading the application and searching the entire memory space of it for the string (e.g. by using the search command in softice, or any other memory search tool), and then setting a memory-read breakpoint on the first character of the string.
CADZzz
02-28-2003, 08:53 AM
Thanks a lot!
I found a dll that handles the strings...

Regards,
CADZzz


GetModuleHandle return value
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > GetModuleHandle return value
PDA

View Full Version : GetModuleHandle return value

nino
02-27-2003, 12:12 PM
While reversing a program I came up to a piece of code that uses the edx register value returned from a call to GetModuleHandle(NULL).
Apparently NT-like OSs do not use it but Windows-like (9x, Me) do.
The value is treated as a pointer to a structure where the 3rd dword field [edx+8] is expected to be a -1 and if so, the value of the 2nd dword field [edx + 4] is used as a pointer to some data.

Does somebody know what this structure the edx register points to is?

I suspect the code is used as an anti-debugging trick.
ZaiRoN
02-27-2003, 01:21 PM
Hi nino,
the structure pointed by [edx+4] is the PE header of the file :-)

Regards,
ZaiRoN
nino
03-02-2003, 08:04 AM
Thanks!
I wonder... Why did they return it in the [edx+4] field? Does it mean that other fields point to other structures? ;)


safecast..autodata..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > safecast..autodata..
PDA

View Full Version : safecast..autodata..

fanta
02-27-2003, 01:46 PM
hi, newbie here but not on the web

i found this great forum through searching out safecast and cdilla workings

anyway im looking for some help from any reversers out there with cdilla safecast ..have researched as much as i can anything on this even down to it writing the details onto sector 32 on hardrive
have searched this entire forum and the web on this as well

the program is Autodata which isnt PE but NE format ..and uses the cdilla license manager etc

a few people have manage to write keygens for this license system ..ie 3Dmax ..autocad inventor..etc..and i know they are specific to the hex license file supplied..ie they have their own unique seed * that they use for the serial number generation,

when titan released 3dmax4 they released a keygen which used the cdilla32 wrapper method ..does anyone know how they did this , or if anyone has ever reversed safecast can u help me throw some light on it.. i cant dump the process from within SI or anything else and the main cdilla file that it works with for the license is cdilla05.dll

a deadlisting aproach through ida is no good on this protection
also noted that on xp the cdilla seems to work slightly different from 98 or millenium

sorry if i have rambled on lol and thanks for any help
:)


Where ? DeDe 3.50.02 build 1619 - full (with new DSF and DOI v2.3)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Where ? DeDe 3.50.02 build 1619 - full (with new DSF and DOI v2.3)
PDA

View Full Version : Where ? DeDe 3.50.02 build 1619 - full (with new DSF and DOI v2.3)

Zero
02-28-2003, 01:23 AM
I can not find this version of DeDe:

DeDe 3.50.02 build 1619 - full (with new DSF and DOI v2.3)

does anybody has a working (!) link so that I can add it to the AntiCrack download section ?

no, I don´t think this is a "warez" request

and yes, I have read the forum description:
"Do not ask where to get the Tools of our Trade. Do not even think about asking for them."

But since the DeDe site seems to be down,.....
Zero
02-28-2003, 04:52 AM
Ok,

I have contacted DaFixer and here we go:

http://www.anticrack.de/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=3843
banshee
02-28-2003, 04:52 AM
Try DaFixer's mirror site: h++p://dede.zadnik.org/IndexDF.html
There is DeDe 3.50.03 build 1625 available, check attached file for improvements


New Aspr
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New Aspr
PDA

View Full Version : New Aspr

Zilot
02-28-2003, 01:47 AM
Hi to all,
after some time there are some new Aspr juggles. This is challenge especially for ImpRec plug-in makers because it seems that older plugins don't work, or that one the newest works wrong with outing GetProcAddress everywhere he can do anything. Of course this is result under Win2K and should be checked under Win98.

the proggie is

hxxp://www.dvd2one.com/

and for plug-in makers the help with IAT is here

Soldat :p
squidge
02-28-2003, 02:44 AM
Already patched this prog a week or so ago when the new version was released (1.01 I believe it was).

Unpacked it using nothing but OllyDbg, dumped with LordPE, and got the IAT sorted using Revirgin :)

Works fine and once unpacked it's incredibly easy to patch. There's a few checks to see if the caller was ASProtect (checking the registers immediately on startup, and calling a small routine in ASProtect's code), but once you have them sorted (Basically a 5 min job - just copy the registers from the original code and examine the exception frame of the unpacked prog to find where to patch the call to ASProtect), it's quite simple.

This was under WindowsXP.
Zilot
02-28-2003, 02:59 AM
Originally posted by squidge

Works fine and once unpacked it's incredibly easy to patch. There's a few checks to see if the caller was ASProtect (checking the registers immediately on startup, and calling a small routine in ASProtect's code), but once you have them sorted (Basically a 5 min job - just copy the registers from the original code and examine the exception frame of the unpacked prog to find where to patch the call to ASProtect), it's quite simple.

Just like this, easy but haven't seen anyone complained about redirected APIs, or I plug ins just worked on other platforms, because my cleaner works just under Win2K. And about patching, there was place with mov edx,00000001, and some ptr checking, I think on address 40bb8c is variable location . And everything were to change mov edx,00000000, and to change location in exe on 40bb8c to 0 because there was 1, and after that nag screen with waiting disappeared, and trial sign also. And seemed that everything other after that worked fine.

mov edx,00000001 were after OEP, and before call for nag screen drawing, and checking of mentioned location were in call for nag screen drawing, not far from the beginning

Soldat
squidge
02-28-2003, 03:29 AM
Right, I didn't do it the same as yourself. There was a call to the whole nag-screen/registration routine which I removed completely, and then changed the test/jump afterwards to a uncond jump. Finally, there was a call into ASProtect call that basically did nothing but MOV EAX, ECX, so the call got removed and replaced with that instruction.

End result was a working program that was fully registered. I can't remember modifying and seeing any code for mov edx,00000001. Are you talking about the OEP for this instruction or the first dip into the code ? (ASProtect seems to call the packed program twice).
Zilot
02-28-2003, 04:50 AM
Ok to be more clear I dumped screens and marked mov edx,00000001 and comparation with critical mem location.
I don't have DVD so don't know is everything OK.

Soldat
squidge
02-28-2003, 05:52 AM
Quick question: Is this on 1.0.1 or 1.0.2 ?
neviens
02-28-2003, 06:45 AM
I unpacked and jumped over _splash function without
problems too. Also there was a simple half hour limit
with messagebox.
Just wandering, how is it possible to squeeze the mpeg2
coder in 80kB !?

@soldat
Seems, you lost a push ebx @ OEP, and I don't thing,
that realigning a code with nop @ end of stolen bytes
is a best aproach.

@ squidge
Where call to asprotect is? In 1.0.2 version, I unpacked,
it is absent - program runs without calls to external code.
Neviens.
squidge
02-28-2003, 06:52 AM
It seems that the ASProtect call in 1.0.1 has been removed in 1.0.2. In 1.0.1 it was present in the main message handling routine.

As for how I modified it, see attach.
Zilot
02-28-2003, 08:47 AM
I played with 1.o.2

Originally posted by neviens
Seems, you lost a push ebx @ OEP, and I don't thing,
that realigning a code with nop @ end of stolen bytes
is a best aproach.

No I didn't lose push ebx it was there, but because code lying seems like I lost. And about nop you are right. I didn't count as well the number of stolen bytes (I found one more) and when reached the end I realized that but was lazy to do writing again, so instead 00 (what was) put 90h.

Originally posted by squidge
It seems that the ASProtect call in 1.0.1 has been removed in 1.0.2. In 1.0.1 it was present in the main message handling routine.

Probably, but I'm wondering is it up to random thinking of Asprotect, will he become so clever in the future to deduce what is the best way to protect the target, or was the idea of prog maker to cross competition. :D

Soldat
squidge
02-28-2003, 11:35 AM
Originally posted by neviens

Just wandering, how is it possible to squeeze the mpeg2
coder in 80kB !?

Because there is none. There's a demuxer and remuxer, but there's no decompression / recompression. It just misses things out of the already compressed mpeg2 stream in such a way as you will not notice it.
nikolatesla20
02-28-2003, 12:09 PM
Hm that's funny, and they advertise it as being able to "recompress" the stream down. Or at least it seems that's what most people think it does.

Anyway, thanx for the help, I got it now too, and I do have a dvd burner :)

-nt20
squidge
02-28-2003, 12:33 PM
To be honest I can't see how you could possibly recompress MPEG2 in as short of time as 15 minutes (which is what it takes on my machine). So all I can say is that it removes part of the video instead.

I think we need to do a full reverse engineer on it, and see exactly how it does work.
nikolatesla20
02-28-2003, 01:57 PM
Well, according to this guide, you aren't really ripping the whole disc anyway - they are only selecting the main movie. And they say up to 90 minutes. Maybe it's just a bunch of hype?

hxxp://www.afterdawn.com/articles/archive/dvd-9_to_dvd-r_with_dvd2one.cfm

-nt20
squidge
02-28-2003, 03:37 PM
Could be.

However, they now have competition. Whilst searching the net, I found a program called DVD95COPY that claims to take an entire DVD, including menus and extras, and convert that into a 4.7gb disk just like DVD2ONE, but says it will do it "in about 1 hour". Whilst this is greater than dvd2one's 15 minutes, it does do the entire disk and is written in Microsoft Visual C++ (source: peid0.8) rather than "pure asm" (source:dvd2one cdfreaks forum).

However, whilst trying to analyse this and see how it worked differently to dvd2one (to see if the algorithm was similar or not) I came across a problem - It's packed with ASProtect and I can't find the stolen bytes :( Can find OEP, dump it and fix the import table, but I can't find those essential bytes... sigh.

Anyone help ?
Manko
02-28-2003, 07:05 PM
This was fun! :)

I like quick fixes...
Did you notice that repz stosb?
What does it do? ;)
...and also higher, is a jump to the very area it affects... :)

alexey is maybe thinking we've had it too easy... ? :p

This is just a quick fix to stop us from using c3909090909090909090909090909090909090909090909090909090 and to "hide" the stolen bytes...

/Manko
squidge
03-01-2003, 04:29 AM
aha, Thanks Manko.
S3ri@l CoDe9x
03-02-2003, 04:11 PM
Originally posted by Manko
This was fun! :)

I like quick fixes...
Did you notice that repz stosb?
What does it do? ;)
...and also higher, is a jump to the very area it affects... :)

alexey is maybe thinking we've had it too easy... ? :p

This is just a quick fix to stop us from using c3909090909090909090909090909090909090909090909090909090 and to "hide" the stolen bytes...

/Manko

Anybody know some it forms to find OEP?¡ I try with ASpr 1.3x

Thank you :P
Manko
03-03-2003, 06:31 AM
Hi, S3ri@l CoDe9x!

Are you asking me how to find OEP on this one?
If not, give me link to proggy and I can take a look.

What I wrote in my reply earlier will only make sense for someone who has found OEP but wonders where the stolen bytes dissappeared. ;P

/Manko
maxximumm
03-03-2003, 07:16 AM
Hi Manko,
There is a new version of aspro.
This proggy
h**p://www.dvd95copy.com/
is one example.
I've have found OEP but...where is the stolen byte???
I hope you would write a tut on how to find them.

Thank's a lot

Maximum
squidge
03-03-2003, 07:27 AM
Originally posted by maxximumm
Hi Manko,
There is a new version of aspro.
This proggy
h**p://www.dvd95copy.com/
is one example.
I've have found OEP but...where is the stolen byte???
I hope you would write a tut on how to find them.

Thank's a lot

Maximum

Look further up in this thread, and then look at dvd95copy...

Manko says "Did you notice that repz stosb?", and that's a massively big hint to find the stolen bytes.
maxximumm
03-03-2003, 07:54 AM
Hi squidge,
I have read the post and i take a look at repz stosb but I don't understand how to use it :(

Thank's a lot

Maximum
Zilot
03-03-2003, 08:01 AM
Hm, I thought I found new ASpr but seems in the mean time there is one newer.

This one has old redirection API trick, but OEP is more difficult to be found, especially stolen bytes.

That what Manko said is the trap. There is a part of the code like next

013C3B70 ADD EAX,B34F5E0B
013C3B75 POP ESP
013C3B76 JMP 013C3B8E (JUMP)
013C3B78 PUSHAD
013C3B79 PUSHFD
013C3B7A CLD
013C3B7B MOV EDI,00000000
013C3B80 MOV ECX,00000000
013C3B85 REPZ STOSB (overwrites stolen bytes)
013C3B87 POPFD
013C3B88 POPAD
013C3B89 JMP 013C3B8E(this will be changed to jmp 41c82E)
==> 013C3B8E ADD EAX,EBX
013C3B90 MOV EBX,00000026
013C3B95 OR EBX,EBX
013C3B97 JNZ 013C3B9B
013C3B99 PUSH EAX
013C3B9A RET

now after it comes the next part

013C3BE1 PUSH EBP (this should be OEP and start of stolen
013C3BE2 MOV EBP,ESP bytes)
013C3BE4 PUSH FF
013C3BE6 PUSH 0043C6A8
013C3BEB PUSH 00421514
013C3BF0 MOV EAX,FS:[00000000]
013C3BF6 PUSH EAX
013C3BF7 MOV FS:[00000000],ESP
013C3BFE SUB ESP,58
013C3C01 PUSH EBX
013C3C02 PUSH ESI
013C3C03 PUSH EDI
013C3C04 MOV [EBP-18],ESP
013C3C07 PUSH 013C3B78
013C3C0C RET this is return to previous part of the code

where he overwrites this part

and finally next (that is the part of first but was dumped in different pass so address are different)

013C474B MOV EDI,013C475E
013C4750 MOV ECX,00000153
013C4755 REPZ STOSB (refill the part with stolen bytes with junk)
013C4757 POPFD 013C4758 POPAD 013C4759 JMP 0041C82E

How to find this part, as usually, search for set of instructions
REPZ STOSB, POPFD , POPAD , 61 (part of jmp)

Soldat :p
Manko
03-03-2003, 08:37 AM
Hi, Soldat! (Buddy!)

You are too generous! :)

They should learn how to find these things by themselves...

I guess maybe they need to learn what they should ask for also.

It is very lazy of them to ask for what signature they should now use to find oep, when they could instead ask, "how do I go about finding the place that jumps to oep, in order to learn myself how the new version jumps to OEP" or "How do I find OEP when I don't have a signature to search for" or "I have found "the place" but where is the stolen bytes" or something...

Now all of you interested, rephrase your questions! :)

/Manko
Manko
03-03-2003, 08:44 AM
Hi, maxximumm!

You need to look at an opcode reference document and learn what repz stosb does. Also if you read the whole text again I have even answered what it does... ;)

/Manko

Originally posted by maxximumm
Hi squidge,
I have read the post and i take a look at repz stosb but I don't understand how to use it :(

Thank's a lot

Maximum
maxximumm
03-03-2003, 08:49 AM
Hi Soldat,
the problem is not the entry point but a concept question.
If i break at OEP in
0041c82E

and i look at address where i found the repz stosb the stolen bytes are just replaced with junks.
So my problem is to break at repz stosb before it is execute!!!???!!!

Thank's a lot for your help.

Maximum

Manko, thank's a lot for your reply :)
squidge
03-03-2003, 08:52 AM
Is there any "documentation" on the first versions of ASProtect (ie, ASProtect 1.0) that I can look at? I understand how current versions of ASProtect work, and how to unpack them, but are now more interested in the history of it. Anyone still have ASProtect 1.0 or a program protected with it ?
Manko
03-03-2003, 09:07 AM
Hi, again Maxximumm!

I think maybe you have given us too few informations...

If I say "use a breakpoint" it will be correct with the info you have given, and I will have insulted you at the same time... ! :p

But I guess you are frustrated that "the place" is moving around with every execution. ;)

You need to stop it from doing so. +splaj and others have shown how. Search the board, and if you can't find it anyway, you can PM me for the answere... :)

/Manko

Originally posted by maxximumm
Hi Soldat,
the problem is not the entry point but a concept question.
If i break at OEP in
0041c82E

and i look at address where i found the repz stosb the stolen bytes are just replaced with junks.
So my problem is to break at repz stosb before it is execute!!!???!!!

Thank's a lot for your help.

Maximum

Manko, thank's a lot for your reply :)
Hopcode
03-04-2003, 09:29 AM
hello,

i didn't play much with Asprotect for some times now,
but i have a question.

What is the "stolen byte" feature? (definition)
Is this just the bytes at entry point ? asprotect rip them and put them in his address space or something? then he erases them.
is this correct?
I don't have the time to check, but i wanted to be sure this is the definition of the feature.
its not a how to crack it request, it doesn't seem hard when you know what you do and asm (maxxx ;p )
just wondered about this name.

regards,

hopcode
nikolatesla20
03-04-2003, 01:14 PM
Yes, that is what it is

-nt20
crUsAdEr
03-04-2003, 02:29 PM
Manko you are such a teaser :)...

Havent touched aspr for ages but inspired but this long thread to download this prog... OEP is ripped, executed and wiped before handing over but my old trsuted method of breaking on stack still works :/...

Hope this might ease someone's pain in finding OEP ripped code
Break'nEnter with LordPE
replace original byte in sice
F8 about 5 times till you see first pushad
F8 over it
bpm esp-4 w if (*eip&FFFF)==EC8B
F5

wah lah.. that is it... sice should breaks at usual
push ebp
mov ebp, esp
.....

Forgot, superBPM must be running of course...

Enjoy and have fun! i am back to php coding...
crUsAdEr
squidge
03-04-2003, 02:37 PM
Nice trick crUsAdEr :)

Not only will that give you the OEP, but because OEP is called by JMP, you should land in aspack'd code just before the OEP, so can find the stolen bytes too (although will require a restart, but hey, no methods perfect).

As for Manko, he may be a teaser, but his hint allowed me to find the stolen bytes quite easily, which is exactly what we need. If we are all spoon fed code, none of us would know what to do for the next version of aspr...
crUsAdEr
03-04-2003, 02:58 PM
lol, squidge...

i was just joking abt Manko :>... i understand ur view of course :)...

not quite sure wat u mean by
Not only will that give you the OEP, but because OEP is called by JMP, you should land in aspack'd code just before the OEP, so can find the stolen bytes too (although will require a restart, but hey, no methods perfect).

i think the bpm will break at first instruction of the target program, doesnt matter these instructyion are rippied or not...

cheers,
crUsAdEr
Manko
03-04-2003, 03:11 PM
Hi, crUsAdEr!

I couldn't agree with you more... ;P

Your great trick hit me like a brick to the forehead and now I wonder why I didn't think of it myself... It's so obvious! But then all great inventions are like that... Ehrg... Maybe not all...

Anyway. Thanks for poping by and showing me again why I admire you... :)

/Manko
crUsAdEr
03-04-2003, 03:19 PM
gosh... this reminds me of the old day... when a post about aspr receive almost instant response... :)...

Manko, please take that back... I am nothing to be admired... just a learner trying to give back something i gained form this board... hang around and help those who come later Manko :)...

cheers,
crUsAdEr
squidge
03-04-2003, 03:43 PM
Originally posted by crUsAdEr
not quite sure wat u mean by

i think the bpm will break at first instruction of the target program, doesnt matter these instructyion are rippied or not...

cheers,
crUsAdEr

Ooops, my mistake. I interpreted your method wrongly - I assumed ESP breakpoint would be reached when the asprotect code popped it's final data off the stack to restore it to normal, as the OEP is called by a JMP so would not affect the stack itself?

Trust me to jump in without testing it out first.

Soldat: Wouldn't 60 9C FC be a better signature to search for? (pushad, pushfd, cld). It only seems to occur once in the memory on this particular target, and gives you the address just before the stolen byte mangling routine. Perfect place to stick a breakpoint :)
Zilot
03-06-2003, 06:02 AM
Crusader

Can you explane why he puts registers
pushad at the beginning, when he never after that use that, I mean never read that memory context. Even after program end :rolleyes:

Wouldn't 60 9C FC be a better signature to search for? (pushad, pushfd, cld). It only seems to occur once in the memory on this particular target, and gives you the address just before the stolen byte mangling routine. Perfect place to stick a breakpoint

It was just a quick method even without checking if there is another occurence.

Manko little devil, can not all be so obvious.

Soldat
LaptoniC
03-12-2003, 01:04 PM
Hi,
I am trying to understand new asprotect.In order to learn new tricks I tried to unpack dvd2one102.exe I guess that OEP is 408680(wrong?).I have fixed the iat program runs,but it says expired.I patched some locations but it didnt worked.I havent fixed any stolen bytes.Is there any in this program ?.I see below codes in the 408680

seg000:00408680 start proc near
seg000:00408680 push ebx
seg000:00408681 push ecx
seg000:00408682 push edx
seg000:00408683 push 0 ; lpModuleName
seg000:00408685 call cs:GetModuleHandleA
seg000:0040868C push offset aIcon ; lpIconName
seg000:00408691 push eax ; hInstance
seg000:00408692 mov ebx, eax
seg000:00408694 call cs:LoadIconA
seg000:0040869B mov edx, eax
seg000:0040869D mov eax, ebx
seg000:0040869F call sub_402070
seg000:004086A4 mov edx, 0
seg000:004086A9 mov eax, ebx
seg000:004086AB mov ds:dword_515D50, edx ;registered ??
seg000:004086B1 call sub_408520
seg000:004086B6 call sub_4021A8
seg000:004086BB pop edx
seg000:004086BC pop ecx
seg000:004086BD pop ebx
seg000:004086BE retn
seg000:004086BE start endp
nikolatesla20
03-12-2003, 04:44 PM
Your oep is wrong... :(

ALso, there are no stolen bytes in this version that I could find, anyway.

Go to the other "aspr hacking (not in ring 0)" thread and I have the source code for a OEP finder / dumper. It works great.

-nt20
squidge
03-12-2003, 05:17 PM
Small hint for doing dvd2one - look for calls/jumps, not "IsRegistered" flags - saves a hell of a lot of tracing through message loops and the like... Naturally, I'm not going to say which call/jump, but you can find it if you search the board :)
LaptoniC
03-12-2003, 06:36 PM
In this thread I saw two OEP one is 4048BC and other is 4048df.When I dump I get now 4048df as OEP iat is same as in this thread but it doesnt run.I can see it on the task list but it doesnt work.So which one is correct OEP ?.I also tried to patch 00404915 call sub_408520

and below jump but it didnt worked either.
nikolatesla20
03-12-2003, 07:02 PM
4048df is what Im using, but who knows still could be wrong. Program seems to run fine, although I haven't really used it yet.

-nt20
LaptoniC
03-12-2003, 07:21 PM
Ok Ok now I got it OEP is 000048BC.There are indeed stolen bytes here.

Soldat:You are missing one push ebx in your patch to fix stolen bytes.

Thanks for your help.
squidge
03-13-2003, 02:08 AM
There are stolen bytes in some versions of dvd2one, but instead of finding them, I just modified the code to setup the registers and it works fine :) This was using OEP 4048df


Resource editors
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Resource editors
PDA

View Full Version : Resource editors

ssb
02-28-2003, 02:36 AM
Currently i use Resource Hacker and ResTuner for my resource translation jobs.
I know that there are exist localization tools that handle translation better than the above. The problem with most of them is lack of a visual editors (for dialogs for example)
Do you know any other res editors with more features and better functionality ? I don't need advanced translation engines like those in multilizer or catalyst. Just a power res editor

any idea ?
bigcapri
02-28-2003, 07:38 AM
You ever heard of Passolo ? I'm not very familiar with these kind of progs. So I don't know if this could be usefull for you. But I played a little bit with it and it is ment (among other things perhaps) for translation jobs.

See www.passolo.de, there is a demo. Cracks are available somewhere.

greets

bigcapri
Aquatic
03-04-2003, 03:31 AM
PE Explorer is excellent: http://www.heaventools.com/
nofurs
03-04-2003, 10:11 AM
wth you guys like to post direct links.Afaik NO DIRECT LINKS ALLOWED
squidge
03-04-2003, 11:08 AM
AFAIK, Direct links ARE allowed as they are not clickable on this board. It got fixed a few months ago.
JMI
03-04-2003, 11:10 AM
Cluesurf:

Your thought is correct, but "direct links" do not work on this Forum. They added code to prevent any link outside the Forum itself from being "clickable." So one can "copy and paste" but your own browser page becomes the "referrer" page, not this Board.

Regards.
nofurs
03-04-2003, 11:29 AM
Well Ask Woodmann guys shareware links are not allowed in this forum even though its not "clickable" only names of that programs are allowed :rolleyes

beloe is my evidence ;pppp

http://www.woodmann.net/forum/showthread.php?threadid=3826&highlight=unpacker
DakienDX
03-04-2003, 12:37 PM
Hello everybody !

I think I need to clear this up a bit. ;)

Direct links do not work expect for our server's IP and its DNS name (which is currently the same as the IP by configuration). Direct links should be avoided.

Sometimes people post direct links which point to a server's secret download directory you only get access to after signing up for a trial with your full address, after showing the author that you belong to a special group of people which are allowed to use his program, to full versions or similar.

This is not the only problem, there might be also some issues about "deep-linking" to shareware authors' homepages as some of them don't like this. (it is not only related to software, but to links in general also)

The referer is the main reason for possible problems. Search engines usually don't search as deep as the single posts are linked from the main page, but if a program's author looks at the referer, he can see very easy from which page the person downloading his software came initially (and complain about it).

As response to this, we've disabled direct links pointing outside of our domain. But there is still one problem. If a user uses copy&paste and puts the link into the address bar of the window he copied it from, the referer is still submitted in most browsers (only a manually opened and empty browser window sends no referer). And the "deep-linking" issue is still not solved.

In this case, there was neither a direct link to the software given, nor were we discussing how to reverse the software which was linked.

Since I don't see the point why informing somebody about a program and the appropriate homepage should be a legal problem, this will be always fine.
_Servil_
03-04-2003, 12:42 PM
Hello

I'm seeking RE (resource editor), not resource ripper/extractor, a thing like resource editor in Visual Studio, it's very useful and far the best I know. It's problem is embeding into DevStudio IDE.
Woodmann
03-04-2003, 07:26 PM
Howdy,

There does seem to be some mis-understanding.........

The intent was not the clickable links as much as it was
posting of a direct link to a company's software.

hxxp://www.blah.com does not stop the most important spy,
the search engine.

By allowing this place to be indexed I/we take the risk by using brand names and direct links.

I realize that in order for some problems to be solved the name of the software must be made available.
I just want to try to keep it to a minimum.

No big deal, it's not like "they" dont know we are here.
Lets just not make it so easy ;)

Woodmann
Aquatic
03-05-2003, 01:35 PM
Should I remove the link?
Paul333
03-06-2003, 01:43 PM
I always use Resource Hacker and never have any problems with it and think its the BEST!!! :)

The original and the FIRST Resourse Editor was Borland resourse workshop that actually got banned by software makers..

Workshop does everythinng you,ll probably need to do when cracking etc but also has stuff you,d need to sit down and learn to get the benifit of its powerful features..I tried them all , Restorator , symantect etc but when i found Resource Hacker i was happy with it and now its all i use and need

More info here ..Its free by the way :)

http://www.users.on.net/johnson/resourcehacker/

paul333
Paul333
03-06-2003, 01:50 PM
Hi Woodman..

Check out my post above and look at my link ..No need to hxxp or h++p etc.. just tell members when posting a reply that contains links to ....

UNCHECK THE ->> "Automatically parse URLs: automatically adds and around internet addresses" <<- OPTION

So that we can use the FULL LINK like this

Resource Hacker v3.4 download
http://delphi.icm.edu.pl/ftp/tools/ResHack.zip

instead of
h++p://delphi.icm.edu.pl/ftp/tools/ResHack.zip

PS..Just noticed the link feature is turned off by the board anyway..aw well :)

paul333
DakienDX
03-06-2003, 02:37 PM
Hello Paul333 !

We know this and we can tell this everybody, but still there will be some people who are not able to read, who don't want to read or who don't think they need to read and simply ignore this advice.
Take yourself for example. You are registered since ten months and there was an announcement for more than two months telling how direct links are regulated in future. I suppose you didn't read it for what reason ever.
And as you might find out by reading, "ssb" knows Resource Hacker and he's searching for a different tool.

We had the option "Automatically parse URLs..." off by default for some time, but some people managed it to turn it on again before posting.
This is one reason why we have rules for direct links now.
druvo
03-14-2003, 12:42 AM
Visual studio is the best resource viewer. if you want to edit 16-bit programs you can use the old visual studio c++ 6.0 , if you want to edit 32-bit applications you use the visual studio .NET .

just open the exe file in the visual studio and the resources are yours to copy and paste :)


What is the data between the DOS-stub-code and the PE-header in MASM-linked files?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > What is the data between the DOS-stub-code and the PE-header in MASM-linked files?
PDA

View Full Version : What is the data between the DOS-stub-code and the PE-header in MASM-linked files?

dELTA
03-01-2003, 08:47 AM
I'm experimenting with building my own exe-files and dll-files, and the only bytes in an exe-file that I cannot find any info about is the data that the MASM linker always seems to put between the DOS stub code and the PE-header. I know that this data is not part of the exe-format itself (in files produced by other linkers, e.g. Delphi, this area is zeroed) but it would still be really interesting to know what kind of data MASM stores here?

I have noticed that the data is practically identical between different exe-files produced with MASM (only one byte in it has been observed to change) and it also always seems to include the string "Rich".

MASM outputs different data (and even different size of this data) when producing a dll file and when producing an exe file though.

This is a normal MASM DOS-stub code:

push cs
pop ds
mov dx, 0Eh
mov ah, 9
int 21h ; DOS - PRINT STRING
; DS : DX -> string terminated by "$"
mov ax, 4C01h
int 21h ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)

000E_string:
"This program cannot be run in DOS mode.", 2Eh, 0Dh, 0Dh, 0Ah, "$"

Directly after it comes this data I'm talking about, before the PE-header.

In my MASM exe-files it is the following:

00000070 <end of stub string here> 00 00 00 00 00 00 00 .......
00000080 5D 17 1D DB 19 76 73 88 19 76 73 88 19 76 73 88 ]..Û.vsˆ.vsˆ.vsˆ
00000090 19 76 73 88 0D 76 73 88 E5 56 61 88 18 76 73 88 .vsˆ.vsˆåVaˆ.vsˆ
000000A0 52 69 63 68 19 76 73 88 00 00 00 00 00 00 00 00 Rich.vsˆ........
000000B0 <PE-header begins here>

In my MASM dll-files it is the following:

00000070 <end of stub string here> 00 00 00 00 00 00 00 .......
00000080 71 D4 F7 DB 35 B5 99 88 35 B5 99 88 35 B5 99 88 qÔ÷Û5µ™ˆ5µ™ˆ5µ™ˆ
00000090 C9 95 8B 88 34 B5 99 88 BB AA 8A 88 34 B5 99 88 É•‹ˆ4µ™ˆ»ªŠˆ4µ™ˆ
000000A0 52 69 63 68 35 B5 99 88 00 00 00 00 00 00 00 00 Rich5µ™ˆ........
000000B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000C0 <PE-header begins here>

It would be really interesting to know what kind of info that MASM "hides" in this data. Does anyone have any idea whatsoever?

Thanks!


Add a new function to a dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Add a new function to a dll
PDA

View Full Version : Add a new function to a dll

lllaaa
03-02-2003, 05:36 AM
I've added the function to the import table of the dll.It worked in some platform.But failed to work with XP.

How to fixup the relocation table to make it work under any win32 platform?

Can any body help me?
Sorry for my poor English:(


Bi-Tarts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Bi-Tarts
PDA

View Full Version : Bi-Tarts

Kilby
03-02-2003, 07:31 AM
Hmmm,

I seem to have been away for so long that the bi tarts have stopped producing all their products.

Anybody enlighten me as to when they ditched their old crap and concentrated on their new crap ?

/me will go back to playing with sony due to the lack new Bi Tarts shite.

Kilby...
Bengaly
03-02-2003, 10:37 AM
heya killby! how you doing ? =)
wb ;)
Kilby
03-03-2003, 11:38 AM
Hehhe, hi Ben,

Still having a wierd ass life, and trying to find somthing to pull me away from securom.
Bengaly
03-03-2003, 12:23 PM
hehe,
well no one forced you to keep unpacking secureRom :-)
but if you have ass life, you can chill out with us old guys (we still live and kicking, if you know what i mean) :=)
good2
03-09-2003, 08:01 AM
Found out bit-arts security software was sold to a company from Texas
Kilby
03-10-2003, 04:52 AM
Ahhh,

So basically they have ditched their half arsed products.

Well lets hope they eventually release somthing for us to victimize :)


"call eax"; needle in the haystack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > "call eax"; needle in the haystack
PDA

View Full Version : "call eax"; needle in the haystack

Rhythm
03-02-2003, 04:32 PM
Fellow reverse engineers,
I could use your thoughts on a protection scheme that i'm trying to understand. Before explaining the basic idea i'll give some background information on the protection scheme (license key check).
From a Java environment a JNI call is made to a subroutine in a native dll. The dll depends on other dll's of which two are well known, namely: mingwm10.dll (Thread safe exception handling over DLL exported functions) and zlib.dll (Data-compression library).
Another interesting fact is that the SoftICE symbol loader isn't able to load the exports, which makes me think the programmers know what they are doing (fun, fun, fun! :-) ). the function body in c would look like: "int check(String license)"
The licensecheck subroutine in the dll looks somewhat like this:

1 mov eax, "first four bytes of entered license key"
2 push license key, other variable
3 mov eax, [eax+2A4h]
4 call eax ; dynamic call

5 call subroutine-at-static-address

6 repeat 1-4 with [eax+2A8h]
7 return

the dll is loaded in the 68B3**** area, since B3 isn't a common ascii char i'm led to believe that the dynamic call is destined to fail.
agree so far? :-)

this fact and the fact that exception handling in the dll is possible made me write a little application loading the dll, getting the address of the function and make a call to the function. debugging this process results in a crash at [4]. remarkable because the application doesn't crash calling the same function, regardless the serial number.

my thought are that another thread from the dll is running and is waiting for an exception to be thrown at [4] or [5] and taking over? is this possible? or is it possible that the valid license key would conclude to a 'correct' jump to code outside the dll?

what is the best approach to tackle these scheme? i'm out of options. the dll didn't give me anymore usefull information as the facts stated above.

Thanks for helping out a new oldbie :-)
bzzt
03-02-2003, 05:39 PM
can you de comp ile the java class which contains the jni call.

maybe change to do what you want and replace.

something to at least look at.
Kayaker
03-02-2003, 06:42 PM
Hi new oldbie, heh, just a couple of ideas.. You say SoftICE symbol loader isn't able to load the exports - if you've correctly identified them for loading in winice.dat (or dynamically via sym loader) and they have been successfully loaded they should show up when you type 'EXP <partial name>' in Softice. You can confirm the correct exported name syntax to use for a breakpoint this way, or break on the loaded address directly.

I can't specifically think of an "anti-" code way to prevent SI from loading exports, but it's interesting if you found a method. If this still doesn't work, you can always hex edit the first byte of the exported function in the dll to 0CCh and set 'BPINT 3' in Softice (I think that's the trick), changing the bytes back when you break. Now you could type 'THREAD' in Softice and see if there is an extra thread running in your process as you suspected...

Sounds like an interesting protection in any case..

Kayaker
Rhythm
03-03-2003, 04:11 AM
About the symbol loading problems:
First of all i have no problem breaking into the dll. In my own controlled environment it's just a matter of breaking on LoadLibraryA or GetProcAddress and take the first call to the loaded function.

In detail:
When i load the dll in the symbol loader (v2.7.0 build 562) by selecting 'Load Exports...' the event window tells me that exports have been succesfully loaded. In the 'loaded symbols' window a new entry appears with the name of the dll and the status (not loaded). Refreshing the window results in a scrambled name for the displayed dll, refreshing a second time results in an empty name. Exports have not been loaded into SoftICE. Maybe this is because of the thread/exception code in the dll, maybe it's intentionally.

bzzt, decompilation doesn't do the trick, because license key checks are made from the dll (or other dll's) too. besides i'm more interested in the works of the registration scheme :-)

time to look into the 'thread' command of softice (didn't knew it existed :-) ). more input is always welcome!
xybyre
03-12-2003, 04:25 PM
> the dll is loaded in the 68B3**** area, since B3 isn't a common ascii char i'm led to believe that the dynamic call is destined to fail.
> agree so far? :-)

I'm not sure what you mean by this. A DLL can be loaded anywhere in the process's memory space.

If you trace into the "call eax", you will probably find that it is always the same each time you run the program. If so, then it is not really a dynamic call. Does the callee change each time you run it?

The
mov eax, [eax+2A4h]
call eax ; dynamic call
may just be the compiler's way of resolving a virtual method pointer, or the programmer could be using a function pointer table.

> this fact and the fact that exception handling in the dll is possible made me write a little application loading the dll, getting the address of the function and make a call to the function. debugging this process results in a crash at [4]. remarkable because the application doesn't crash calling the same function, regardless the serial number.

Did you specify the right calling convention for the function? This has bitten me a few times. The DLL function could be declared as stdcall, cdecl, or WINAPI (aka Pascal), and if you don't declare (typedef) the exported function with the same calling convention, you will get a crash (or the function will work wrong because the parameters are out of order)

>my thought are that another thread from the dll is running and is waiting for an exception to be thrown at [4] or [5] and taking over? is this possible? or is it possible that the valid license key would conclude to a 'correct' jump to code outside the dll?

I am pretty sure that exception handlers have to be registered per-thread, so I don't think it's possible for another thread to jump in when an exception occurs. Furthermore, exception handlers are implemented differently by different compilers, so DLLs with exception handling enabled are not compatible across compilers. If you are calling the DLL function from code you've compiled with a different compiler, and the DLL function throws an exception, then that would explain why your program crashes.

Hope this helps!
Rhythm
03-13-2003, 05:05 AM
helps a bunch, thank you!

.text:68B3D110 var_18 = byte ptr -18h ; String licenseKey
.text:68B3D110 arg_0 = dword ptr 8 ; ??
.text:68B3D110 arg_8 = dword ptr 10h ; ??
.text:68B3D110
.text:68B3D110 push ebp ; Java_***_checkLicenseKey (JNI call)
.text:68B3D111 mov ebp, esp
.text:68B3D113 sub esp, 0Ch
.text:68B3D116 push edi
.text:68B3D117 push esi
.text:68B3D118 push ebx
.text:68B3D119 mov ebx, [ebp+arg_0] ; address of licenseKey
.text:68B3D11C add esp, 0FFFFFFFCh
.text:68B3D11F mov eax, [ebx] ; move 4 bytes of LicenseKey in eax
.text:68B3D121 push 0
.text:68B3D123 mov edx, [ebp+arg_8]
.text:68B3D126 push edx
.text:68B3D127 push ebx
.text:68B3D128 mov eax, [eax+2A4h] *crash* illegal address
.text:68B3D12E call eax ; dynamic call
.text:68B3D130 mov edi, eax
.text:68B3D132 add esp, 4
.text:68B3D135 add esp, 0FFFFFFF4h
.text:68B3D138 push edi
.text:68B3D139 call sub_68B3E5F0

i've assumed the var to be the licenseKey, simply because the only native function is called with the licenseKey String. could this assumption been wrong? i haven't been able to break into the dll with softice in the programs environment, only in my own setup.

>Did you specify the right calling convention for the function? This has bitten me a few times. The DLL function could be declared as stdcall, cdecl, or WINAPI (aka Pascal), and if you don't declare (typedef) the exported function with the same calling convention, you will get a crash (or the function will work wrong because the parameters are out of order)

interesting, i used typedef ... and out of order parameters certainly would explain the crash! looking into it now ...
xybyre
03-13-2003, 10:33 AM
I don't have enough code to say for sure, but looking at that code snippet, I would guess that you are interpreting the code incorrectly.

This is how I would interpret the code:
.text:68B3D119 mov ebx, [ebp+arg_0] ; get address of object
.text:68B3D11F mov eax, [ebx] ; dereference the pointer
.text:68B3D128 mov eax, [eax+2A4h] ; get address of method
.text:68B3D12E call eax ; method call

Since the function address called is calculated from the first parameter, I don't think it can be a string. I would guess that it is a pointer to a class object, and this code calls a method on that object.

Why can't you break into the code while the program is running? Can't you put a breakpoint on that address?
Rhythm
03-14-2003, 04:20 AM
>Why can't you break into the code while the program is running? Can't you put a breakpoint on that address?

Lack of experience i guess (-:
this is what i've tried:
* symbol loading doesn't work (see first message), so i can't place a breakpoint on exported functions
* placing a bpx on bpm or bpr on/near the start of the function doesn't help.
* hwnd doesn't work; softice reports that there or no active dialogs. can't place a breakpoint on the windowhandle
* i can break on loadlibrarya and getprocaddress, the first doesn't bring me any closer, the second breaks a zillion times but not where i want it too break.
* making the breakpoint conditional so it only breaks when the pid is the pid of javaw.exe results in no breaking at all
* the bpint 3 trick doesn't work too, because i think the dll has some form of simple encryption. ida dissassembles the dll correctly, w32dasm fails after some time and hiew shows opcodes that don't belong there.

if anyone has some advice at how to break into the dll let me know, i'm out of options :-)
Rhythm
03-14-2003, 08:07 AM
i've done some more puzzling. the dll has selfmodifying code. that's probably the reason why w32dasm and the symbolloader fail. the opcodes for the start of the routine are:
before modifying:
005589 *bogus add*
E583
EC
and after modifying:
55 push ebp
89E5 mov ebp, esp
83EC14 sub esp, 2Ch

hex-editing the 55 to CC gives me debugaccess ...
i'll keep you informed (-:

thanks for all the help so far!
dELTA
03-14-2003, 08:56 AM
IF you look at those opcode bytes, you will see that they are exactly the same, except offsetted with one byte, which will cause the debugger/disassembler to interpret them differently.

If the code was really self-modifying, it would not work with inserting an int3, and neither would IDA be able to disassemble it, as you earlier stated it could.

Well, sure, if the "self-modification" consists of moving the code one byte forward or backward those two things are both theoretically possible, but that would be utterly stupid and unlikely. It would seem much more likely that your debugger/disassembler has just become misaligned with the opcodes in the first case.

Also, the code you presented is a typical function prologue, and it is very common that they have 00-bytes in front of them, for address alignment.

Check the addresses again. Are those two code-snippets really taken from the exact same adress, not one byte apart?

dELTA
Rhythm
03-16-2003, 03:36 PM
you're totally right, thanks for your information. the protection scheme turned out to be nothing fancy, which is a shame because the application itself is pretty advanced.

still unanswered is why (my best guess is accidently) the symbol loader goes nuts. would be nice to exploit this.

o well, i did learn about calling conventions in the end :)


RTA 1.10 Sneak Preview and wishlist thread :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RTA 1.10 Sneak Preview and wishlist thread :)
PDA

View Full Version : RTA 1.10 Sneak Preview and wishlist thread :)

squidge
03-02-2003, 05:35 PM
Well, you people seemed to like v1.00, so I'm currently working on 1.10. Here's a screenshot of how the latest version is going:

hxxp://ibiblio.org/paulc/rtasneakpreview.jpg

That is, there's now a mode to let you work directly on files, and it will automatically convert VA and RVA addresses in file offsets - it'll even give you a disassembly of the offset and then allow you to modify that disassembly so you can be sure you got the right address.

If any of you would like other features, ask now before it goes final later in the week :)
Paul333
03-02-2003, 07:48 PM
Ive been racking my brain here trying to think up some cool little feature that might come in handy but cant think of any offhand.!!.

When you say

"That is, there's now a mode to let you work directly on files"

are you meaning we can PATCH the file directly?..That is COOL ,

if so can we have a "SAVE AS" button?

RTA does the job its created for very nice indeed!!

Thanks

paul333
squidge
03-03-2003, 04:55 AM
Originally posted by Paul333
Ive been racking my brain here trying to think up some cool little feature that might come in handy but cant think of any offhand.!!.

When you say

"That is, there's now a mode to let you work directly on files"

are you meaning we can PATCH the file directly?..That is COOL ,

Yes, that's right.

if so can we have a "SAVE AS" button?

Kinda tricky, as the opened file is mapped into memory and modified that way, but I'm sure I can get it to keep a list of changes and apply them to a different file instead.

RTA does the job its created for very nice indeed!!

Thanks :)
Paul333
03-03-2003, 06:49 AM
Nice one squidge...thanks for working on it :)

paul333


A nice intro to Cryptography
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > A nice intro to Cryptography
PDA

View Full Version : A nice intro to Cryptography

Aquatic
03-03-2003, 05:32 PM
http://www.cacr.math.uwaterloo.ca/hac/

There is a .pdf version floating around the web.
Fake51
03-19-2003, 12:41 PM
Old news. It's been around since ... forever. Nah, but for quite some time.

Fake
Aquatic
03-19-2003, 01:56 PM
What book would you suggest? :rolleyes:
Kayaker
03-19-2003, 04:23 PM
Originally posted by Aquatic
http://www.cacr.math.uwaterloo.ca/hac/

There is a .pdf version floating around the web.

Thanks.

Kayaker
mike
03-19-2003, 05:56 PM
It's a very good book. I got the original Dr Dobbs crypto books cd; there's a new version out:

http://www.digitalriver.com/dr/v2/ec_MAIN.Entry10?xid=2823&SP=10023&PN=1&V1=462117

HAC is included in both, as is Schneier's Applied Crypto, another favorite.
Fake51
03-19-2003, 06:01 PM
Originally posted by Aquatic
What book would you suggest? :rolleyes:

Heh, it's not that I would suggest another book instead (I might add one, but that's a different issue), it's that it's been recommended many times ... it's been on the rekml list too, if I remember correctly.

Fake


Is it protected by SentinelLM?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is it protected by SentinelLM?
PDA

View Full Version : Is it protected by SentinelLM?

zhanzixin
03-04-2003, 02:57 AM
I have a target which seems to be protected by sentinelLM,
but I apply all sentinelLM sigs either from CrackZ or generated
from sentinelLM SDK 7.1 , it just does't work. So I start to
doubt if it is protected by sentinelLM or version is not correct.
It has a license file which contains one line:
FEATURE xxx.xxx LOCK 1 08-Jun-99 0 1 0b5fe2243b0ce3c3e2c3 0339

Any one can tell me if it is protected by sentinelLM and the version
of it?
Thank you!
zhzx@slof.com
squidge
03-04-2003, 04:50 AM
You can normally tell SentinelLM apps by the text strings in the executable (the sentinel part of the code if statically linked)


Not a stealth..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Not a stealth..
PDA

View Full Version : Not a stealth..

neviens
03-04-2003, 06:58 AM
Hi all!
While searching for a some kbd logger, found this site and
couldn't resist to put a link here.
http://www.spytech-web.com/spyagent/stealthguide/step7.htm
Good example, how to not hide which packer is used!
Neviens.
squidge
03-04-2003, 02:42 PM
LOL :D

Question however - how do you know for sure that author didn't install that packer as a decoy? ;)
neviens
03-05-2003, 01:20 AM
Unpacked few exes- all packed with one packer. You can
guess 3 times which one :)).
Neviens.


Serial Hardlock Power Requirements
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Serial Hardlock Power Requirements
PDA

View Full Version : Serial Hardlock Power Requirements

korvak
03-04-2003, 04:10 PM
Hi All,
I am looking for information or if anyone has documentation or experience with the "Serial Hardlock" that alladin appears to no longer support. i have searched the web and the alladin site. i have not found any information on the "serial hardlock" .

i have been able to watch the data stream using a second computer (PC) to capture the stream from the serial hardlock to the host (Unix/SGI) serial port. i know this is a serial device and it gets its power from the RS232 lines and converts it to +5/gnd for the hardlock chip. i used a breakout box and i get the same signals using a PC, and i send it the same commands i have captured, yet i get NO response of ANY kind from the hardlock. i know the protocol is correct as i have made an emulator and have the host able to snd/rcv data locations from the emulator, but i fail the authenication (working on that too if you have any information on the alogorithm or how to crack it, someone named tgold said it could not be broken, yet his company would sell me one, so i ask how you broke it tgold? anyways)

if you have any information on the power requirements or the timing of a "Serial Hardlock" can you please point me in the right direction to get this to interface with a PC. Thank You in Advance for your time and help.

Korvak
squidge
03-04-2003, 04:55 PM
It most likely powers itself from the control lines on the serial port, like most other dongles. Did you monitor these lines on your breakout box? Is your own program set the lines to the same state ?

Other ways are break characters - you can send these of various lengths, and the other PC will not display them. You will need to either scope the data or analyse the sending program to find out the correct delays for these.

Also, PortMon may come in useful as it can monitor at the device level, so can why what the port is being configured as.
neviens
03-05-2003, 04:12 AM
About power requirements. You can estimate it from what
rs232 port is able to provide. Awerage PC serial port outputs
(DTR, RTS, Tx) are limited to ~8mA output current each, one
of them is used for data sending, remains 16mA for supply.
About whole problem. Why do you want to stick with
hardware emulation? Usually some app patching or code
emulation provides a more convenient solution.
Neviens.
tgodd
03-05-2003, 07:06 AM
All I can tell you is GOOD Luck !!!

Even if you manage to get a schematic, you still face the daunting task of working back through the schematic to try and figure out how you are going to build a reader.

The hardlock emulator has been available since the early 90's, yet nobody has worked back through that to figure out how to read it.

Best of luck!!

How was it broken?

Years and years of experience dealing with hardware lock devices as well as other encyption Hardware.

Regards,

tgodd
korvak
03-05-2003, 08:05 AM
(squidge) the breakout box is a 50 LED (red and green for each line) to watch all lines. from what i see my PC is setting the exact same lines. i had used a program called listen32 on the second PC to catch the data stream... will this progam/PC config not catch the special or escape/break charaters? if not where do i find portmon? is it a prgram? is it hardware?

(neviens) from what i can tell and have observed... the host sets DTR then it starts it data transfer on TD, RD... the PC program is doing the same.... yet nothing. (and i sent you a message explaining why i need to stay hardware)

(tgold) even though you seem to know alot about the hardlock device... you do not seem to provide much insight of how they work... you like to hide behind your "intellectual property" position and then seem to gloat on how hard it is and that you or our company has done it.....
what schematic are you talking about... i can pin the board which has ten transistors, 7 diodes, a bunch of caps and resistors... now going with basic logic the transistors, caps and resisitors make up the pump charge converter to change the rs232 (+-12v) to TTL (+5,gnd) signaling and the others to supply power to the chip... which used to be a Propritery ASIC from "phillips" but now is a PIC microcontroller.... if i really wanted to know the specifics on the board, i could de-populate the components and x-ray the PCB to get the traces, but it is only a double sided PCB so i do not have to go that far. and what do you mean "nobody has worked back through that to figure out how to read it".... as you pointed out in a reply to me last month (before your mailbox was full) that the hardlock is only a encryption device it does not decrypt and there are no secret words or passwords to get to the memory cells on this.... the host sends 8 bytes and you get back the 8 byte encrypted response... so what is there to work back through? given an alogorithm of unknown value... if you send enough known values and get the responses.. you can start to see patterns.... i am not a mathematician so i am also having to try and figure out the mathmatics behind this.

so does anyone have a starting point on how to figure out encryption alogorithms that are NOT "intellectual property", please do not get me wrong tgold... but if you are not able to really help then why do you post on these boards.

to the rest ou you, thank you very much for the responses and help. i am going to look into the possibility of clipping a SOIC clip on the chip and supply it +5 volts and see what that gets me....

Korvak
tgodd
03-05-2003, 08:53 AM
The Seeds are NOT contained within the memory device.
There are seed values which are fused into the ASIC (48 bits).

The algo itself is quite simple.
The difficult part is trying to read/calculate the 48 bits.

That is the only tip I can give you.

Good Luck.

Regards,

tgodd
squidge
03-05-2003, 09:18 AM
Originally posted by korvak
(squidge) the breakout box is a 50 LED (red and green for each line) to watch all lines. from what i see my PC is setting the exact same lines. i had used a program called listen32 on the second PC to catch the data stream... will this progam/PC config not catch the special or escape/break charaters? if not where do i find portmon? is it a prgram? is it hardware?

The other PC will not detect the break characters, but you may be able to see these (although not the timing) using portmon. Portmon can be download from www.sysinternals.com and is basically freeware. If the box is as simple as tgodd suggests however, I doubt it would use anything as complicated as this, although you can still use portmon to check your program against the original.
korvak
03-05-2003, 09:28 AM
(tgold) thanks again for not providing any insight on "THE" part of the hardlock which is eluding me... the alogorithm... i know there is a seed that is vendor specific which will allow upto 40,000 different seed codes.... but given that is just one of the pieces to the puzzle and not the piece i am tring to find, and i am most likely wrong in this, but the seed "IS" part of the algorithm if i do not try the same values in a different vendors key... valuein+(seed+alogrithm)=encryptedvalue.... as i do not know the seed,nor do i really want to find the seed my equation would be valuin+alogrithm=encryptedvalue, and as i am not looking for a device that works on "any and every" application i have to treat the seed and alogrithm as "one in the same" i also did not ask up to tell me the alogrithm "intellectual property again" , i asked for any help on how to find the patterns or how to find a working alogrithm for THIS instance.

please, if you are going to help and insist to hide behind "intellectual property" ... point us in the right direction and stop wasting our time with generalization that we can find by reading the documentation from the other devices alladin has to offer... i am beginning to think you work for alladin....

korvak
tgodd
03-05-2003, 10:52 PM
What I did say was that the seed is not contained within the the eeprom but rather fused within the asic itself.

regards,
tgodd
tgodd
03-05-2003, 10:54 PM
How about building a table of responses to the algo.
This is in fact how the early emulators worked.

tgodd
korvak
03-06-2003, 08:12 AM
it is true that i could build a table and that i already have tried to do that with a working table of responses... but as soon as the date changes my emulator stops working as the valuein changes=encryptedout is now changed also the first of this month is different values then the first of last month.... if i could find a decompiler for IRIX on a SGI machine i would have attempted to decompile the code to find the alogirithm, but i am not a high language coder.. i stick with hardware and microcontrollers... so it would probably take me even longer to become knowledgable enough to read the IRIX code then to just try to find the patterns and alogirithms of this device. besides the brute force table would have to be 8bytes@8bits=2^64=18446744073709551616 possible table combinantions (can someone check me on that...seems pretty high) so even at a hundredth of that the memory needed alone is prohibitive..... now based on the findings of the "hasp" i would have to assume that the hard lock has a very simular alogirithm but i have not been able to see the pattern yet, i make this assumption on the basis that if this was such a great encryption scheme... "i would of used it in my other products my company has to offer (aladdin)" but then again what the hell do i know about the way aladdin thinks? also the fact that aladdin is hidding behind "our own proprietatry alogorithm" statement tells me that if it was available in open source on the net... everyone would see how in-secure it really was and they would lose all of there business... unlike standards of RSA and 3DES and others that are time tested and proven to be very hard to hack... aladdin is hiding thier un-secure alogirthm behind a vail of secrecyor should i say "our own proprietatry alogorithm"....

"security through obscerity is worst then no security at all"

so tgodd...now what?
tgodd
03-06-2003, 09:39 AM
The Fast Algo was developed by Fast out of germany.
Alladin later aquired them.

As for the intellectual propery issue.
The intellectual property does not belong to me.

If you are so well into the know about microcontrollers, then why do you not "glitch" out the contents of the microcontroller, so that you have a comnplete disassembly.

Although, unfortunately, I am unable to devulge anything substantial, I will not allow anything to be posted which is inaccurate.

The patterns you will note, have alot of repetition in them.
This would indicate that it should be a simple algo.
This is true, it is in fact quite simple.
However, the key values are in fact extremely important, if you choose to emulate this algo unit.

Your statement about not wanting the keys, indicates to me that you are already headed in the wrong direction.

I will not add anything more, as you have indicated strongly that what I have to say is meaningless.

Good Luck.. You'll need it.

Regards,

tgodd
korvak
03-06-2003, 03:21 PM
tgodd,
i have finally gotten your attention.... i do appologize to offending you, and in the past you have only responded with generalization and stuff we can find in the documentation, you most likely will not respond to this, but it was the chance i had to take to get you to a point where you are providing more then what is already known publicly... so if i have not ticked you off to that point of no response.....your input is not meaningless... you seem to know more about this then anyone else, i just do not see why you would be on these message boards giving people information when you can not tell them anything, and if it is not your "intellectual property" whos is it? your employers? alladins? would the public knowledge of the workings of this device cause you and your family to starve?

the fact that you know about "glitching" makes me tent to believe that you might also have some experience in the DSS card area... i have not had any luck in glitching this decives mpu yet. i either have my glitch timing off or the voltage or some other varable i have not seen yet..... so i started to look at the aloririthm... i have noticed the repetition in the patterns... so why would the seed values be important if the seed makes each alogirithm act differently which inturn makes the overall alogirithm have a different "function" ? would not finding a alogirithm that creates the same results be the same thing? how would you find the key if it can not be read out and you do not have the alogirithm?

well it will be interesting to see if you even answer this... and who knows maybe i just lost the source of information i needed to get this figured out...... we shall see?

korvak
tgodd
03-06-2003, 05:19 PM
This is the only tip I can give.

The bits in the results come only from 16 of the 48 bit keys.
While the other bits manipulate which bit is addressed.

So in fact you ARE reading out the key, or at least a vital part of it.

There are copies of emulators out there.
Get a hold of one and have a look at how the algo works.
It is really quite simple.

regards,

tgodd
squidge
03-06-2003, 05:35 PM
Originally posted by korvak
tgodd,
would the public knowledge of the workings of this device cause you and your family to starve?

I'm afraid I must agree with tgodd here - reverse engineering is exactly that - spending hours, days, sometimes weeks and months figuring out how something works. You can't expect tgodd to simply say "here's the algorithm" even if he has cracked it (or even worked for Alladdin). You must learn the algorithm for yourself.

For tgodd to publish the algorithm - you would indeed gain the information needed to emulate the dongle, but you would not learn how the dongle works.

I do hope tgodd sticks to his words and does NOT make the algorithm public - like he says, there are various emulators out there that accomplish the same task - if you can not get anything from the dongle, you should attack one of these instead.

tgodd himself has already given you a lot of very valuable information, of which the first was "I will not allow anything to be posted which is inaccurate". Use this information to your advantage !

Also, if you do crack the algorithm (or are very close to it), please do not publish it - instead, keep it to email or PM.
tgodd
03-06-2003, 05:53 PM
Thank-you squidge for your kind words of support.

Just a side note for korvak.

I have not at any time ever worked for alladin, nor ever hope to in the future.

As far as DSS and glitching.
glitching has been around longer than DSS, and so have I.
:D

Best regards,

tgodd
korvak
03-06-2003, 08:39 PM
tgodd,
again i appologize for the attacks aimed towards you... i did say i did not ask for the alogorithm, but how to work towards cracking it, i dont know maybe i did ask FOR the alogirithm or it come over like that... the hits against you are uncalled for and do not speak very highly of myself. obviously you do have your reasons and i was making alot of progress on this device until i hit this alogirithm wall and with the limited time that i have to give to this project, i was getting frusterated, maybe i am not good enough to crack it and i am to stuborn to admit it... i do thank you for the help you have given... and do appoligize for my comments!

squidge... you too are right, for him to publish the alogirthm would not gain me the real knowledge of the "how it works" but only the "why it works", i guess i felt that possibly a little more of a hint would be given which has with the"The bits in the results come only from 16 of the 48 bit keys. While the other bits manipulate which bit is addressed." that he posted above. he may have said this before and in the middle of consumming all i could on dongles, missed this... why could he of not said it earlier? i dont know... that is what i was really looking for... a starting place for how the xor/shifting/transformation is involved... with this in mind i can start to run patterns of ffffffff and 00000000 and 00000001 type stuff and see what starts to form... knowing that 16 bits are used, this appears to be like the hasp if i am not mistaken .... but on the same note.. and please correct me where i am wrong tgodd... if the valuein+(seed+alog)=encryptout would not for a single instance valuein+newalog=encryptout.... at the very basic mathmatic level 2+2=4 the same as 2*2=4, two different functions same result. that is where i do not understand why the keyseed is so important? what am i missing? (i know, alot)

also why would i keep it to email or pm? would i not want to show the steps that are needed for some one to crack there own... even if i do not tell them the alog... at least show these are the steps... would this not be about building the skills of reverse engineers? i really have no intention of "giving" away everything.... that would be on the scale of script kiddies attempting to hack into companys and calling it there own skill... i was just looking for a starting place... this is not an attempt to make excuses... just trying to understand.

also reading between the lines... "I will not allow anything to be posted which is inaccurate"... screams more then what is has been given straight out... i was just to blind to hear it.

thanks for the enlightenment....

korvak
Woodmann
03-06-2003, 09:36 PM
I have watched this thread with great interest.

korvak, you have the knowledge, you are good to ask for a hint or tip for the direction to continue.
Be patient. Your answer is close.

Woodmann
tgodd
03-06-2003, 10:45 PM
I was not, nor have ever been offended by anything you have said nor anything anybody else has ever said.

We are all individuals with some level of ego, and knowledge.

The algo is not at all like the hasp.
There are selectors, shift registers, nors, xors.
The tip about looking at an emulator and reversing it is the best I can give you at this point.

Its even easier to look at than if you were to look at the discrete logic schematic, of which I have also transposed and recreated.

The hasp I first reversed back in 91-92.
I know it well.

The fast was not created by alladin.
Totally different people, and totally different knowledge set.

And again with sincereity,
Best of luck!

Regards,

tgodd
korvak
05-05-2003, 09:07 AM
tgodd,
hope all is well with you.... well i have yet to figure out the insides or the algo of this damn thing... i must have tunnel vision, or i am just not smart enough to see the forest through all of the trees... hehe ... least i can still laugh at it.... so i think i am going to try a different approach... and that is to glitch the chip... the question i have is, what success have you had in glitching PIC microcontrollers... the older ones, i have had some success with.. the newer generation of flash/eeprom chip i have yet to open... if you can tell me.. what voltage range, timing, hardware, software should i try.. if we need to take this offline? i will gladly PM you... the chip in question is the PIC 16CE625-04....

thank you in advance for any help that yo can give me in this....

korvak :D


flex8.1b
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > flex8.1b
PDA

View Full Version : flex8.1b

diazp
03-05-2003, 10:15 AM
Helllo

I would like help with flexlm8.1b. I would like find the funstion _l_sg.

Thank you

mailto:diazp2003@yahoo.fr
dELTA
03-05-2003, 11:26 AM
You must be much more specific than this if you want any help from here, and also show what you have tried so far, and in what way it failed.


Ok... COMPLETE n00b here
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Ok... COMPLETE n00b here
PDA

View Full Version : Ok... COMPLETE n00b here

alteredidentity
03-05-2003, 09:52 PM
Ok, I am what you'd call a complete newbie when it comes to cracking. I just need some basic info to get me started, like tutorials on how to read machine code or assembly language so that I can learn how to crack. Then maybe a tutorials on the art of cracking...

This is the place to be, can anybody help me out? Thanx
esther
03-05-2003, 09:57 PM
search for art of assembly in google.com
Paul333
03-06-2003, 02:12 PM
Crackers notes is really cool for new learners ..i tried to find its online pages but all i got was the downloadable version of crackers notes ..here you go

cRACKER's nOTES
http://www.fortunecity.com/roswell/borley/431/crknotes.html

paul333
Winston
03-07-2003, 12:21 PM
Hiya alteredidentity

Do a search for Krobar its a very good source of info that your lookin for :)


hmmm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > hmmm
PDA

View Full Version : hmmm

nikolatesla20
03-06-2003, 12:13 PM
I just wanna know what is up with this crap:

http://images.x10.com/all2/120x600_redYllw2.gif

These ads pop up everywhere, and suggest that we, the users of this camera, will be using it for some sort of female spying. Every ad of theirs includes a cute girl.

Perhaps they are supporting the webcam industry? Methinks so..I guess sex sells pretty much ... anything.

I think it's retarded.

-nt20
Woodmann
03-06-2003, 03:49 PM
Howdy,

I dont pay attention to any of that stuff until someone
points it out.

I bet you can buy that little wireless camera for $19.95

I wonder what the transmit range is ?

They are obviously targeting the "peeping Tom" market.

Errrrrrrrr........ 'tis crap

Woodmann


ASPR Hacking in user mode (ie. not ring 0!)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR Hacking in user mode (ie. not ring 0!)
PDA

View Full Version : ASPR Hacking in user mode (ie. not ring 0!)

squidge
03-06-2003, 02:36 PM
Hi,

I seem to be getting a lot of ASPR'd programs lately. Most of these are update versions on a regular basis (new version per week is not uncommon it seems). Unpacking these programs is not a problem, but it is getting a little boring and tedious now. Therefore, I want to write a program to help automate the task.

For testing, I use dvd2one and dvd95copy as they are fairly recent programs. I want the software to unpack both of these automatically without having to use ring0 - going to try and do it purely in user mode. Once (if) done, I will gradually expand the program to handle the other apps.

Now, the program at the moment can find the OEP of both programs noted above within a few seconds. It can also find the stolen bytes from dvd2one, fix the header, rebuild the import table, and, create a working exe file within the minute. However, it falls over on dvd95copy, as it can't find the stolen bytes. I know why this is (they are overwritten with garbage by aspr), but not sure how to get around to pausing the program before the bytes are trashed. If I use softice, I can pause the program and find the stolen bytes, but is it possible from a standard user program ?

At the moment, the program just runs the aspr'd program in debug mode, and relies on debugger event messages to see what it should do next. It's worked quite well upto now (must say however, that the SEH's in aspr's unpacking code made it a LOT easier - Thanks Alex! :-)
nikolatesla20
03-06-2003, 03:17 PM
Is there a way to tell where in memory you need to stop ? If so, you should be able to do something about it...hm.

One "trick" I used in my debug brute forcer was to throw a deliberate int3 in there somewhere -

perhaps you could pause the program at a known point - where you know the stolen bytes should be decrypted by now, then search for the apsr signature, and throw a deliberate INT3 in there, and have your debugger watch for it. When it gets hit, grab the stolen bytes.

Just a thought.

YOu'd think Alexy would have tried using IsDebuggerPresent huh? (Even tho it's easy to "patch"). I can't, for example, get Tamosoft's Commview to run under a debugger. DOn't know yet if it's asprotect or commview that's exiting in those conditions. Also never could get Armadillo to run in debugger either (even tho I used DEBUG_ONLY_THIS_PROCESS).

Also, if you are using Windows XP you can now do a couple of new debugger trix. You can for example, force another process to throw an int3 immediately (there's a call called DebugBreakProcess)

ALso, squidge, if you could PM me and help me with OllyDbg - just one small question - when I pass the exception handler to the program, I usually land in kernel exception handler, I then press ALT+f9 to get back to user code. Is this correct - and will I actually land in the SEH code - because seems most of the time I land at the next bad instruction (xor [eax], eax) right after doing this. (Unless that's just how it is)

-nt20
Sp8
03-06-2003, 04:10 PM
hi squidge,

I hope it will be PRIVATE only tool :)
coz alexey improve his assproduct without pay us ;)
plz, don't make same mistakes, don't publish your new, I hope amazing tool ;)
squidge
03-06-2003, 04:27 PM
@sp8: Well, since most people here know how to unpack ASProtect manually (and there's certainly enough information for anyone else to learn how to), and each program seems to have yet another version of ASProtect which causes existing versions of unpackers to fail, I don't really see the point is publishing another unpacker. All it seems to bring is people asking why it will not unpack prog X.

Therefore, my prog will indeed be a personal use only program. It'll be "tuned" to my set of apps and hopefully work for a while with minimal tinkering, as Alexey won't be able to get his hands on it to find out how it works :)

@nikolatesla20: int 3 seems like a good idea - I forgot about that. Aspr does dynamically allocate the memory, but since I can tell where it calls the routines, I can easily find these memory addresses and throw some INT 3 instructions in them. For now, I'll see if a simple offset patch works.
crUsAdEr
03-07-2003, 07:17 AM
Hi squidge,

How about using Hardware breakpoint on stack :)? just like the way Olly does it :)... should work...

The problem with unpacking aspr is that you will still have to fix all the small aspr loader check etc which makes it annoying... i would say a generic approach would be gl0bal's path of making generic patcher... inline patching aspr is not that hard actually, in fact quite easy reverse engineering task due to bugs in aspack :)...
squidge
03-07-2003, 07:35 AM
I assume you mean placing a "on access" hardware breakpoint at the position in the stack where aspack would access via a push ebp or similar ?

Not played with hardware breakpoints before so I'll have to find some documentation for it - is there any example code anywhere? My breakpoints normally consist of nothing more than placing int 3 into the code.
crUsAdEr
03-07-2003, 07:47 AM
hi squidge,

try bpm pack at y0da site... pretty simple to use Drx i think...
S3ri@l CoDe9x
03-07-2003, 02:40 PM
hxxp://y0da.cjb.net/ :p <-- remember change http
hack3r2k
03-08-2003, 04:55 AM
h**t://win32asmboard.cjb.net

Here you have a good program for removing Asprotect
h**p://www.is.svitonline.com/syd/

best regards,
.:hack3r2k:.
Manko
03-08-2003, 07:57 AM
Yah... syd...

But noone learns by dl.ing an automatic unpacker...

And besides... Has he even finished the new version to cope with the erased stolen bytes? Like in DVD95Copy?

(I guess if he has, I'll get shit for asking... But I'm too lazy to check it out for myself... or, maybe... nah... later!)

/Manko
squidge
03-08-2003, 09:40 AM
crUsAdEr / S3ri@l CoDe9x: I've downloaded the c source of hardware BP from Y0da's site and will be playing with it today. Doesn't seem as difficult as I first thought.

hack3r2k: AsprStripperXP is a good program, but it can't unprotect many programs - which includes the one I'm trying to get my own unprotector to unprotect (dvd95copy). It doesn't come with source either, making it difficult to support new versions of asprotect.

Manko: Not finished new version yet - I guess it will not be long however now I got source for setting hardware bp's :)
nikolatesla20
03-09-2003, 08:53 AM
Thought maybe some might find this useful to play around with , as I'm currently doing.

Some template debugger code, it allows you to load both Aspr and Armadillo programs into it. It patches IsDebuggerPresent in the program's memory as well, which allows Arma to run :)

It then passed the exceptions back to the programs to let them handle what they need to handle, but you still get the first chance.

Seems the solution maybe for them is to check the firstchance code of the exception? perhaps....then they could know they are being debugged? Maybe I shouldn't give that away :D

-nt20
nikolatesla20
03-10-2003, 03:47 PM
Ya, super easy to inline patch

Just debug and count exceptions, at last exception, patch the code you want. Done. 27 exceptions in latest aspro.

Is this too much info for Alexy?

BY THE WAY, the code I posted above only works with Armadillo on WinXP. On Win2K, it gets the child process sent to it for some stupid reason, and causes it to fail. WOrks 100% on XP tho. On WIn2K you have to patch IsDebuggerPresent the other way, without using INT3's. (create suspended, Set infinite loop at oep, let the process run, patch api, then suspend, fix oep, release. - now you can debugactiveprocess)

-nt20
squidge
03-10-2003, 04:19 PM
oi! thats how my proggy works! (and how I unpack them with Ollydbg). also means I can set breakpoints without fear of them getting cleared :)
crUsAdEr
03-10-2003, 04:42 PM
Niko :)... u r talking about a "loader" aren't you :)??? Or are you planning to "inline" the whole debugger code into aspr :)?
nikolatesla20
03-10-2003, 07:50 PM
Yeah, it's basically a loader.

-nt20
foxthree
03-10-2003, 08:03 PM
Aw, c'mon guys, don't say you haven't still disassembled and re-created your own "peidy.com loader.exe". Every ASsPR cracker MUST disassemble it...

As Eric S. Raymond states in his How To Become a Hacker essay, "Nobody should ever have to solve a problem twice."

-- FoxThree
nikolatesla20
03-10-2003, 08:33 PM
You may have a point...I don't get it yet tho - (cause I don't know what the peidy loader thingy is yet)

However, there is a complete lack of tutorials on the web that cover anything to do with creating your own loaders or unpackers. I have not found one tutorial on how to write an unpacker, and I think someone needs to do so - if not a full unpacker, at least the basic skeleton of how to get started (Even though I am sure there are several ways to do it).

Perhaps I have just not looked in the right areas yet.

Besides, sometimes the best way to learn is to just experiment :p

So what have you been up to lately foxthree?

-nt20
foxthree
03-10-2003, 08:43 PM
Tesla:

Glad to see that you're doing some good work. The loader thingy I'm referring to was the one that some chinese hacker released which found the OEP of ASsPR in a few seconds... by the stack balancing method as Crusader writes in the previous posts. You must get the binary and disassemble it. I did it and managed to learn a lot about the working of ASsPR and generic ways of defeating it. Hell, if I'm not swamped with "real-world" work, I could write a tutorial... but ...

If you want, I could send you my commented IDA listing of the loader...

BTW, have you seen +Splaj offlate?

Greetz to Kayaker, Crusader and ofcourse, the *evil* EVAL :D

-- FoxThree
Zilot
03-11-2003, 05:33 AM
FoxThree !

Why are you so shure that loader.exe uses stack balance
described by Crusader. Have you tried to load new Aspred programs with no

popad
jmp eax

and have you seen the result. The last dip is actually fake OEP, but he can't interpret as well, but also can't find real stolen OEP. And it can be due to two reasons

1) He doesn't use stack balance
2) Or new Aspr have some stack fillings before he goes on usual stack managing. For i.e the same method with stack balancing will not work in identical way with new and old Aspr. Crusader said that one have to pass pushad. But that is not the way with oldy proggies

And can that be then generic way to find OEP ? For particular version yes, but in general ?

Soldat
squidge
03-11-2003, 06:28 AM
Just for your info: my current aspr unpacker finds OEP by counting the number of access violation exceptions, then restarting the program, and before the last exception, it places breakpoint in the 401000 section of memory and prog breaks on the OEP.

Kinda more difficult to find the stolen bytes on the latest version of aspr however. On this version it does use stack balancing.
crUsAdEr
03-11-2003, 07:36 AM
Hey fox3, long time no see :)...

LOL... me kinda busy but keep comeng to read the forum, kinda nostalgic...

Anyway, i think Kanxue Studio (loader.exe) used VirtualProtect(Ex) which is what squidge should use i think, that way you wont have to re-run the target program...

Also, squidge... placing breakpoint on 401014 (bpm x)... that will ensure all codes are decrypted by then... you can also bpx and numerous Registry API that aspr uses...

Tesla : unpackers source code are there on tools sites... you can find many written by r!sc, Deamon which are pretty nice... there are too way, the proper way is reverse the loader of aspr and emulate it to fully decrypt the proggy, the lame way that i do is let proggy run and wait for the right moment to dump it... loader are basically process patcher, source code are also available, the best i found are R!sc's RPP and another one by thewd... you cna just grab them from protools... take a look on r!sc aspr1.1 unpacker :)...

Soldat : yeah, old aspr you dont trace pass pushad but the method is similiar... you cant expect a ready to use anytime solution but this way of finding OEP is pretty generic for any protector/packer...
Zilot
03-11-2003, 07:47 AM
Is your unpacker helping tool or is press and don't think. And do you manage dips automaticaly (bad for me) or leave user to manage them by himself (better), and your unpacker just give him the info about them with option which one to bypass, thouhgt it would demand once more pass, or maybe not with some tricks.

And I don't know if I've understood as well about finding stolen bytes. Have you solved that or not yet.

And if you manage dips, if you don't want to stay the secret because one guy PM me about that. Just to compare idea.

Soldat
Zilot
03-11-2003, 08:12 AM
Crusader : Also, squidge... placing breakpoint on 401014 (bpm x)... that will ensure all codes are decrypted by then... you can also bpx and numerous Registry API that aspr uses...

Yea I realized that and wanted to ask for that. But wasn't sure if is that with all proggies so. With some I tried was and gave to me several ideas about dips finding.
Can you explane whay is that ret executed. Is that some basic check
for alignment....

Soldat
nikolatesla20
03-11-2003, 08:37 AM
Squidge:

your idea for finding oep is the same way I was thinking of doing it - count exceptions and right before last exception set bpm in low memory area. Won't find stolen bytes of course but works sort of like a ring3 tracer in a way.

Crusader: I do remember browsing thru the source code of an aspack unpacker, in which they ripped the decryptor code out and used it. (Stood out in my mind because they ripped the hex code itself and just patched it in as an array, instead of actual asm instructions) However, browsing thru source code and a tutorial are not the same thing :D There were internal data structures used in the aspack unpacker, which I do not know how they came about on. It would have been nice to see how they arrived at what they did. FOr now, I was personally planning on using the lame way :p to do my own little unpackers at first - force the program to do the work for me. Obviously asprstripper author has some time on his hands....

Time to exeriment with those hardware breakpoints. Easy enough. Just a question - I've looked at some docs and I'm not sure - when a hardware breakpoint comes thru (a bpm X) what is the exception code? EXCEPTION_BREAKPOINT ? Or something else. 'Cause you may have to keep a list of the breakpoints you set and check it when the exception comes in if it's EXCEPTION_BREAKPOINT, just in case the program itself happens to do its own exceptions (so you can return exceptions that aren't yours)

Speaking of Splaj+ , I'm sure this would all be hooey to him, probably consider it a waste of time.

-nt20
nikolatesla20
03-11-2003, 09:32 AM
Squidge:

I got a similar result by counting exceptions and then evily patching int3's into the entire first half of the program. (like 00401000 to 0040a000). THen I just report any bad int3's - which will be the oep pretty much. Tried it on a couple of progs and it works.

Now if there was a more reliable way to trace down stolen bytes..

I tried VirtualProtectEx with GUARD_PAGE but I could't get virtualprotect to work, it kept just failing.

PM me to clue me on how to set the breakpoint in the 00401000 area like you are doing.

-nt20
nikolatesla20
03-11-2003, 11:38 AM
You may find this interesting to try.

It works on all the programs I tried that are asprotected.

It's an OEP finder and dump holder - finds the program oep and stops there while you dump it.

Since the orginal program was compiled using standard linker setups, mostly the code comes before any data sections. Hence I can just take BaseOfData - BaseOfCode and plop int3's into the entire code section so it will break no matter what when it hits oep. THen I restore it and let you dump. That's the basic concept.

-nt20
squidge
03-11-2003, 02:44 PM
VirtualProtectEx (processid, 0x401000, 4096, PAGE_EXECUTE_READWRITE | PAGE_GUARD, &oldprot);

Seems to work pretty well for me. Gives a 0x80000001 debug exception code back (STATUS_GUARD_PAGE_VIOLATION) with the exception address being the address that the prog attempted to execute (ie, OEP, etc :)
nikolatesla20
03-11-2003, 03:11 PM
are we giving too much away here?

let me know, maybe some posts should be deleted...:p

I still cant get virtualprotect to work - my code was very similar to yours (only difference was size argument). returns failure. Oh well int3 works too....

-nt20
squidge
03-11-2003, 05:21 PM
Might be giving a little too much away, but hey, how much can the code of protectors change now? We all know that Alexey is as idle as any coder, and wants to change his protection code as little as possible :)

True, we may be doing some of the work for him, but I think most of the posts here are valid for many packers, not just aspr, and no doub't would generate a good ground knowledge for any newbie that can code.

As for your error, are you sure you are passing the correct flags to OpenProcess? If so, what is the result from GetLastError after the VirtualProtectEx ?
nikolatesla20
03-11-2003, 06:21 PM
At first I wasnt using OpenProcess. Then I tried it with it and it still didn't work. This is on Win2K. Haven't tested it on WinXP yet.

My OpenProcess call was:

HANDLE Process;

Process = OpenProcess(PROCESS_ALL_ACCESS,FALSE,pi.dwProcessId);

Then I did VirtualProtectEx this way:

PDWORD OldProtection;

VirtualProtectEx(Process,(LPVOID)FirstSectionLow, FirstSectionHigh - FirstSectionLow, PAGE_EXECUTE_READWRITE | PAGE_GUARD, OldProtection);

I also thought of another idea: you could just virtualprotect it to PAGE_NO_ACCESS and then catch that exception.

I'm trying to think of a good way to catch which instruction led to the access of where the oep is. For example, the usual instruction is a JMP from asprotect. Is there some way to track this JMP - I thought even maybe about doing simple Trap flag tracing after the 27th exception. Could be by that late such a trace wouldn't be killed by aspro.

-nt20
nikolatesla20
03-11-2003, 07:14 PM
Seems dvd95copy's download is broken right now

anyone want to send it to me?

untouched of course. I can do the work.

nikolatesla20@yahoo

append .com

-nt20
crUsAdEr
03-11-2003, 07:54 PM
are we giving too much away here?

let me know, maybe some posts should be deleted...

Nikola :)... most stuff here are known for sometimes already... a search in the board will prolly yield the results you need :)... like fox3 said, get kanxue studio and u r done... u should really study aspr.dll before attempting an unpacker :)

cheers,
/me is gone
Kayaker
03-11-2003, 09:57 PM
Hiyas,

There's some wild ideas being kicked around here. One of the more technical packer discussions I've seen, actually dealing with programming. DEBUG_EVENT as a control proc, the coding possibilities are interesting.. But Patching INT3's over the ENTIRE code section to force catching the interrupt?? Lol, I don't think this is generally an accepted coding practice!! But, after all, this *is* RE :D Devilishly effective though.

Private unpackers are a good thing. Maybe the biweekly variations of Aspr are a better protection than all its dipsy doodling double dips combined.

It's good to see some old 'faces' around, it's terrible isn't it when RL interferes with RE? ;)

Cheers,
Kayaker
squidge
03-12-2003, 02:18 AM
Originally posted by nikolatesla20

PDWORD OldProtection;

VirtualProtectEx(Process,(LPVOID)FirstSectionLow, FirstSectionHigh - FirstSectionLow, PAGE_EXECUTE_READWRITE | PAGE_GUARD, OldProtection);

Are you sure that OldProtection is being allocated somewhere first? I'll assume it is, so try changing that PDWORD to a DWORD and putting &OldPRotection in your VirtualProtectEx.
nikolatesla20
03-13-2003, 08:40 AM
Kayaker

Yes, patching int3's is a wild idea, but hey, I like to think outside the box. It works very effectively, and isn't killed by SEH code.

You think that is on the edge, what about my blatant patching of system calls with WriteProcessMemory() ? Walking all over the system on that one. In Win2K and XP it's safe tho, because of the copy-on-write protection :) Don't you love new technology?

Also, I recently added more code to my "GenericDebug" to allow it to patch GetSystemTime() to defeat the random rebase aspr uses for the OEP jump code. That's right, no more searching for signature bytes. Just run my program once, write down the "OEP". Then before you allow it to continue, run superBPM (for NT ) and but a bpm X on OEP. Get out of my program and let the protected program run normal. BPM will show you LastBranchFromIP. This is where the jump code is. Now you can look around for stolen bytes or whatnot. If they are being overwritten, set a new bpm X in that area now. It will be in the same spot always now since GetSystemTime is patched :D Now you can get stolen bytes.

As an exercise, I plan on attempting to write a device driver that grabs the MSR registers for me on my int3 exception catch, so I can get that LastBranchFromIP ( or more probably LastExceptionFromIP) for you in my program. DOn't know if it will work yet - I know I can get the MSR's, but I don't know if the values will be right or not.

Just as a side note, superBPM allows hardware breakpoints to work as well from my debugger, not just SI :)

Yes, I have no life, and yes, I am obsessed. It's in my nature, it's why I usually beat every video game.

-nt20
nikolatesla20
03-15-2003, 10:01 PM
OK I cheated a little on the ring0 stuff. I wrote a device driver - but only to give you one more piece of info.

Here's what the new stuff does.

Patches GetSystemTime so *spr doesn't rebase anymore.
plops int3's as discussed earlier in thread.
hooks int 3 with a kernel mode driver.
uses int3 hook to capture MSR LastExceptionFromIP. This gives you the EIP at the instruction before *spr hits the OEP. That's right, no more signature bytes required, and no superBPM required. You can go to the address in SI and see if you have stolen bytes or not. (If you have a version that overwrites the stolen bytes, you'll still need superBPM to but a bpm before they get overwritten. You will be okay as long as you load with this tool, it keeps *spr from rebasing, so bpm's will work fine).

Yep, I think it's pretty useful now.

Just as a side note, I hate service api's. Grr.

THIS IS ONLY FOR WIN2K / XP !!!!!!!

Tack on a disassembler and I could show the memory area right away, and then also allow you to set BPM, it would be very very handy. SuperBPM simply hooks ZwContinue, and that's pretty much it - could be replicated into the int3 hook eventually to all work together...

-nt20
squidge
03-16-2003, 04:28 AM
Nice one nikolatesla20 !

Your source code will be very usefull for a lot of different packers/protectors I'm sure.

Attached is a disassembler for you to put into the code as and when you have the time. It's the same one as used in Ollydbg and RTA.
Bengaly
03-16-2003, 06:13 AM
actually this one is wroted by olleh, the author of ollydbg so its a nature it will be used in olly :P
as for the rta tool, well since the disasm code is under the gpl so it ccan be used freely =)
squidge
03-16-2003, 07:19 AM
yes, I know it's written by Olly, that why I said it's the same engine as used in Ollydbg, and the left the copyright and GPL in the zip file. Just downloaded and posted here for more convenience.


Disassembling Amiga roms with IDA, how?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Disassembling Amiga roms with IDA, how?
PDA

View Full Version : Disassembling Amiga roms with IDA, how?

dELTA
03-06-2003, 06:21 PM
I have an Amiga rom-file. The format is "adf", and it's some standard type of packed Amiga disk format.

I would like to disassemble the program located in this rom, but IDA cannot (quite understandable) read the format. I must first extract the executable file from it I guess (68000-assembler based executables, they should be supported by IDA).

Does anyone know how I can extract the pure files out of that adf-file, so that I can disassemble them? All the converter programs I can find can only convert it to a genuine amiga floppy disk (which cannot be read by PC's mind you). :(

Any ideas?

PS.
The reason for this is that I want to _remove_ a trainer from a game in such a rom file. I can only find it in a version where the trainer is applied whether I want it or not, and that sucks. :)
JailBox
03-07-2003, 01:15 PM
Hi dELTA

Go take a look at wotsit dot org, they got some info on ADF
Manko
03-07-2003, 01:29 PM
I'm wondering... Is this a kikstart-bootdisk for Amiga 1000?

Anyway... Since the amiga emulator reads this format... Use the emulator to load it. Then use the tool for extracting Amiga-roms to file and save it to your hd... ;)
If you're lucky it's just a file on that disk. Then just copy to hd...

Will it work? Be glad to hear if it does....

/Manko
dELTA
03-07-2003, 01:30 PM
Thanks for the tip JailBox. If I now only can find a website where I can download 2 weeks of spare time I'm sure I would have great use of it. ;)

Is there possibly anyone who's got a tip of a somewhat more practical nature? :)
dELTA
03-07-2003, 01:38 PM
Manko, the idea is good and I've had it too, but the problem is that I cannot find any emulator or tool that can export data to the "outside of the emulator", and hence I cannot store anything from inside the emulator to a file on my physical disk. :( Also, just so you know, the roms are mounted as floppy disks in the emulator.
Manko
03-07-2003, 02:01 PM
Hmm... UAE can use ide-hds... Easy to get anything out the amiga then. ;)

But maybe you're not using PC?
ehrgel... let me rephrase... Maybe you're not using windows? Is there a linux version of ida?

/Manko
squidge
03-07-2003, 03:58 PM
I've seen an Amiga emulator that allow you to "mount" a PC directory as a Amiga harddrive. Can't remember the name however :(
dELTA
03-08-2003, 07:26 AM
Thanks for the tips! I will try to get the executable file out of the rom (disk image) with UAE. If I succeed, and succeed in patching the game, I fear it will be even harder to get the patched file back into a disk-image file though, but let's hope for the best. :)
Manko
03-08-2003, 07:41 AM
Hmm... Me, stupid! I thought you were talking about the kickstart_rom all the time, when you were in fact just talking about a gamedisk...

I guess, worse case, this mightbe a trackread-bootdisk. If so, you're gonna have to get a hold of some old amiga "cracking" tools to extract and unpack the gamefiles... This might involve some amount of learning if you haven't got the skills since earlier... Hmm.

Ok, maybe not SO difficult. It unpacks itself and then you "dump" to disk... Well, well...

On the other hand, it MIGHT be even easier. Sometimes games WAS put on normal amiga-filesystem-disks...

BUT if you get it out, crack it, and want to put it back... It's easy! :)
You just put it to the mounted HD in WIN, and then in emulator copy it to disk, replacing original...

If it's trackdisk, though, you'll have to edit the trackloader and maybe repack with something and put to disk again...

I'm eager to hear statusrepports! :)

/Manko
dELTA
03-08-2003, 08:05 AM
Thanks again for the info Manko. It's actually my friend who's got the Amiga emulator and the file, so I've asked him now to try to get the file out with UAE and send it to me, and if he succeeds I will take a look at removing the trainer from it. :) So, status reports will depend on how lazy he is to get out the file from that disk, but if he succeeds, I'll be sure to tell you how it all went. :p
Manko
03-08-2003, 08:17 AM
Hehe... A thought just occured to me... It might actually be easier to get a hold of a version of the game, without a trainer, just searching the net. ;P (OK, stupid me, you wrote in the first post, you had (or your friend) already searched... But anyway...)

What's the name of the game?

/Manko
dELTA
03-08-2003, 01:10 PM
The name of the game is "Gravity Force", and for some reason all copies of this old Amiga rom-file that is in circulation seem to have the trainer in them (even the ones that don't claim to have it). :(

PS.
My friend did of course own a legal copy of this game 15 years ago on his Amiga, he promised. :D
SiNTAX
03-19-2003, 05:22 AM
Ohh this brings back fond memories.. hell I wonder why I bothered to make trainers if people just want to get rid of them :-)

Why do you want to remove the trainer? For the exercise or because it fails to run on your UAE?

Since there is a trainer on the game, it means that it was already cracked. So most likely you will find a trackloader in the bootsector. It is probably patched to first load the trainer, which will then put a value somewhere in memory indicating which trainer options you request.

Afterwards the main game will be loaded and at the start of it, there might be a patch routine that reads that value that the trainer left behind and then put the necessary redirections in place.

In the old days, there was no IDA.. so for game stuff, Action Replay was used.. and for normal executables, Resourcer, was your friend (the Amiga equivalent of IDA -- also very powerful)

Anyway.. if you get stuck and need advice.. feel free to ask.
dELTA
03-19-2003, 10:01 AM
Nice to hear from people from the good old days, thanks for the tips SiNTAX. :)

I still havent been able to disassemble the code in the first place though, and hence I cannot analyze the code either. :( I did figure myself that the loader code would be quite easy to identify and patch away somewhere in the very beginning of the code though, like you say.

The reason for wanting to remove the trainer is that it is impossible to disable it, and hence the game looses much of its fun when you're always invincible and can go through walls and so on.

The disk does not seem to have a file system, could that be the case? Was it usual that the code execution just started in the boot sector, and then it loaded any further needed data from the disk "manually", hence not needing any real file system?

Also, could Action Replay disassemble code, or just search/compare data, like the Action Replay's for most products today? How did you otherwise disassemble code that was not in "normal executables" like you called it?

Thanks!
dELTA
Manko
03-19-2003, 11:24 AM
Hi again!

Yup, the thing I called a trackloader is found first in the bootsector which you can easily read/write with tools for the amiga. (Dunno where to get those now, though.)

Yup, trackloaders was very common on game-diskettes. It was faster. And it was perhaps deemed to be more secure... ? :)

I don't remember much about the various cartridges, though I owned one variant which was often updated, and you could program it yourself too... Hmm... whatever it was named...
But they were deffinitely much more powerfull than what you mention about todays variants. :)

It's sad I remember so little... Anyway, hope to hear more on this from more knowledgable people...

/Manko

Originally posted by dELTA
Nice to hear from people from the good old days, thanks for the tips SiNTAX. :)

I still havent been able to disassemble the code in the first place though, and hence I cannot analyze the code either. :( I did figure myself that the loader code would be quite easy to identify and patch away somewhere in the very beginning of the code though, like you say.

The reason for wanting to remove the trainer is that it is impossible to disable it, and hence the game looses much of its fun when you're always invincible and can go through walls and so on.

The disk does not seem to have a file system, could that be the case? Was it usual that the code execution just started in the boot sector, and then it loaded any further needed data from the disk "manually", hence not needing any real file system?

Also, could Action Replay disassemble code, or just search/compare data, like the Action Replay's for most products today? How did you otherwise disassemble code that was not in "normal executables" like you called it?

Thanks!
dELTA
SiNTAX
03-26-2003, 09:25 AM
Originally posted by dELTA
Nice to hear from people from the good old days, thanks for the tips SiNTAX. :)

I still havent been able to disassemble the code in the first place though, and hence I cannot analyze the code either. :( I did figure myself that the loader code would be quite easy to identify and patch away somewhere in the very beginning of the code though, like you say.

The reason for wanting to remove the trainer is that it is impossible to disable it, and hence the game looses much of its fun when you're always invincible and can go through walls and so on.

The disk does not seem to have a file system, could that be the case? Was it usual that the code execution just started in the boot sector, and then it loaded any further needed data from the disk "manually", hence not needing any real file system?

Also, could Action Replay disassemble code, or just search/compare data, like the Action Replay's for most products today? How did you otherwise disassemble code that was not in "normal executables" like you called it?

Thanks!
dELTA

Are you looking at the disk via UAE in AmigaDOS, or just looking at the UAE .ADF file?! If I'm not mistaken, the ADF file is just a dump of every sector on the disk -- an amiga disk being 80 tracks, 2 sides, 11 sectors/cylinder, 512 bytes/sector -> 512*11*80*2 = 901120 bytes in total.. )

So.. the initial trackloader (or the complete one, if it's a compact version) will be in the first 1024 bytes of the file. If you put those 1024 bytes in another file and then use IDA and tell it it's 68000 code, then you should be able to disassemble it. (the first 4 bytes = 'DOS\0' if my memory serves me right).

Depending on the trackloader, it will use AmigaDOS or the hardware directly. The AmigaDOS version will issue a JSR -offset(a6) (where offset = _LVODoIO of dos.library -- check google for the parameters :)
The hardware version will be more complicated, as that one will step the floppy head itself and do the MFM decoding.. but most crackers used a self-made routine which usually was called with track/sector start + length... you might wanna search for the hex byte $4489 or $55555555.. the first is the MFM sync word, the second is a mask that is used for the MFM decoding.. if you find those, it's a hardware loader. -- don't forget that 68000 is big endian.

As for the action replay... yups it had a disassembler (without labels or anything... sometimes also refered to as a monitor instead of a disassembler). Searching for bytes was ofcourse also possible.. as was assembling instructions (it was always a bit of a guess what address you had to use on a branch etc.. as you had no labels :)

As for disassembling code not in executables... well an Action Replay could freeze the Amiga at any time and allow you to poke around in memory.. so if you knew where stuff got loaded, you could patch it. (but ofcourse, there were also anti-action replay tricks -- but I'll keep that for another mail :-))
SiNTAX
03-26-2003, 09:55 AM
Originally posted by Manko

Yup, trackloaders was very common on game-diskettes. It was faster. And it was perhaps deemed to be more secure... ? :)
/Manko

The reason was probably that you could use up all available memory and didn't have to leave AmigaDOS intact.. ie. you could take over the complete machine (which 98% of the games did).. and once you took over the machine, there was no other way than to write your own diskloader to load data from floppy..

People that had to write loaders, didn't really feel like writing the amiga dos filesystem layer also. Most used offset+length.. but some games had loaders that used a custom filesystem.

Most also used non standard syncs, layouts to prevent copying.

Popular anti-copy tricks used at the time:

- using more than 80 tracks (easily copied if you knew)
- using non standard syncs (you needed the sync to know where the start of the data was, as there is no start/end on a circle :)
- increased write density of the data.. ie putting more data on a track than a normal drive could write, reading was no problem with a normal drive... you could copy these disks with a normal drive by slowing down the drive motor.

Probably the most widely used protection was RNC (Rob Northern Computing) -- this prot used the single step->decode eip (pc) trick to prevent reversing. 1 track was used as copy protection (non-std sync and written with a special copier.. altho you could still copy it with a normal drive, if you had the right tool :D )

Those were the days... sniff.. :)
dELTA
03-26-2003, 02:04 PM
Thanks for the info SiNTAX, a very interesting and fun history lesson! :)

A while ago I looked at the ADF specification, and then disassembled the whole ADF-file as a "binary file" of 68xxx format in IDA. IDA then wants an entrypoint offset from me, so I gave it the entrypoint where the first sector started in the file.

As you said, it first had a couple of instructions, and then an a6-relative call. IDA did completely misunderstand this call, and after that all was crap. I knew that the a6-register was pointing somewhere into a system library, but not where.

Would the trainer code presumably be placed after this call (i.e. it would be executed after the return of this call) or would it in some way be reached before the return of that call, and in that case how would I locate it?

dELTA
SiNTAX
03-26-2003, 06:02 PM
Originally posted by dELTA

As you said, it first had a couple of instructions, and then an a6-relative call. IDA did completely misunderstand this call, and after that all was crap. I knew that the a6-register was pointing somewhere into a system library, but not where.

Would the trainer code presumably be placed after this call (i.e. it would be executed after the return of this call) or would it in some way be reached before the return of that call, and in that case how would I locate it?

dELTA

The load will probably look like this then (code snippet grabbed from a google search):

movea.l (4).w,a6
move.w #CMD_READ,(IO_COMMAND,a1)
move.l #$78000,(IO_DATA,a1)
move.l #$2C00,(IO_LENGTH,a1)
move.l #$400,(IO_OFFSET,a1)
jsr (_LVODoIO,a6)

As you can see, the jsr expects a structure in A1, filled with load address, length and offset of the data to load. (the A6 is loaded with the value at $4 which is a fixed address on the amiga that contains the exec.library address). When the bootsector code is called, A1 already points to a valid IORequest structure, so you just need to fill in the correct value to load something else.

The first load will probably load the trainer bit, jump to it and on return load the rest OR the load loads the gamecode+the trainer in 1 go, and then the boot loader jumps to the trainer, which then shows a menu or whatever and then jumps to the address of the game code.

You need to follow the code to know what happens.
dELTA
03-28-2003, 05:41 AM
Well, the problem with "following the code" is sadly that it just seems to end in the middle of nowhere (according to IDA's understanding of it anyway).

The initial code, which is quite similar to your example, is the following:

ROM:0000000C movea.l (dword_4).w,a6
ROM:00000010 move.l a1,-(sp)
ROM:00000012 move.w #2,$1C(a1)
ROM:00000018 move.l #$2A00,$24(a1)
ROM:00000020 move.l #loc_78000,$28(a1)
ROM:00000028 move.l #$200,$2C(a1)
ROM:00000030 jsr -$1C8(a6)
ROM:00000034 jmp loc_78000

IDA craps out on me if I try to display the opcodes ("Division by zero", kaboom, crash...). :(

As you can see, there is a jump immediately after the call to the operating system procedure.

Here is the code that is located at the destination of this jump:

ROM:00078000 loc_78000:
ROM:00078000 move.b -(sp),-(a6)
ROM:00078002 move.l $2929(a1),-(a4)
ROM:00078006 move.l $2929(a1),-(a4)
ROM:0007800A btst d6,(a3)
ROM:0007800C move.b (a6),-(a3)
ROM:0007800E move.b (a6),d3
ROM:00078010 move.b (a6),d3
ROM:00078010 ; ---------------------------------------------
ROM:00078012 dc.b $16 ; What's this?
ROM:00078013 dc.b $63 ; IDA won't decode.
ROM:00078014 dc.b 0 ;
ROM:00078015 dc.b 0 ;
ROM:00078016 dc.b 0 ;
ROM:00078017 dc.b 0 ;
ROM:00078018 dc.b 0 ;
ROM:00078019 dc.b 0 ;
ROM:0007801A dc.b 0 ;
ROM:0007801B dc.b 0 ;
ROM:0007801C dc.b 0 ;

... and so on ...

As you can see, the code simply seems to stop in the middle of nowhere? That is, if the two bytes that IDA can't understand isn't some kind of jump?

Any ideas?
SiNTAX
03-30-2003, 05:36 PM
Originally posted by dELTA

ROM:0000000C movea.l (dword_4).w,a6
ROM:00000010 move.l a1,-(sp)
ROM:00000012 move.w #2,$1C(a1)
ROM:00000018 move.l #$2A00,$24(a1)
ROM:00000020 move.l #loc_78000,$28(a1)
ROM:00000028 move.l #$200,$2C(a1)
ROM:00000030 jsr -$1C8(a6)
ROM:00000034 jmp loc_78000

IDA craps out on me if I try to display the opcodes ("Division by zero", kaboom, crash...). :(

As you can see, there is a jump immediately after the call to the operating system procedure.

Well if you follow my reasoning before, you should be able to see what this is doing :)

loc_78000 is ofcourse the ADDRESS the data is loaded to. And the other 2 params are the size of the data to load and the offset on disk where to load from (I don't have the docs anymore, so I'm not sure what is what.. my guess is that the #$200 is probably the offset, and #$2A00 the size of the data to load).

So.. instead of letting IDA disassemble 78000, just grab 2A00 bytes from your ADF file, located at offset $200 and resource that (and tell IDA that it's base address is 78000)

.01 way there.. 0.99 to go :)
dELTA
04-02-2003, 05:51 AM
Ah, I see, cool. The code at this location actually looks like a typical trainer stub. A bunch of apparent inline patches, and some other smaller code. Sadly, I feel I'm a bit in over my head in this 68000 asm and also lacking the necessary Amiga system knowledge to actually do something about it. :( It doesn't make it any better either that IDA can't understand the file format, so lots of adresses are wrong, and it's a real pain in the ass from this point on to know where any absolute jump or call will land. :(

Well, it was an interesting insight anyway. :)

dELTA
SiNTAX
04-02-2003, 02:01 PM
Right.. did this just for the fun of it, as the trainer DID work OK, ofcourse if you don't enable Collision Detection in your emulator, well... :)

(Config->Chipset->Collision Level set it to FULL instead of the default SPRITES ONLY)

Anyway as for how to patch the actual trainer thingy:

RAM:00078122 loc_0_78122: ; CODE XREF: RAM:0007812Aj
RAM:00078122 ; RAM:0007814Aj
RAM:00078122 cmpi.b #-1,($DFF006).l
RAM:0007812A bne.s loc_0_78122

** this waits till the video beam is out of sight (bit like vertical retrace)

RAM:0007812C bsr.w sub_0_782E2

** probably those dancing copper bars, didn't really look

RAM:00078130 btst #$A,($DFF016).l
RAM:00078138 bne.s loc_0_78142

** test RMB

RAM:0007813A move.l #'RGHT',d5
RAM:00078140 bra.s loc_0_78152
RAM:00078142 ; ---------------------------------------------------------------------------
RAM:00078142
RAM:00078142 loc_0_78142: ; CODE XREF: RAM:00078138j
RAM:00078142 btst #6,($BFE001).l
RAM:0007814A bne.s loc_0_78122

** test LMB

RAM:0007814C move.l #'LEFT',d5
RAM:00078152
RAM:00078152 loc_0_78152: ; CODE XREF: RAM:00078140j

So.. register D5 is filled with LEFT/RGHT depending on which button you pressed. Then lateron, the D5 is checked and the game code is patched:

RAM:00078270 cmpi.l #'RGHT',d5
RAM:00078276 bne.s loc_0_78286
RAM:00078278 clr.w (word_0_3DB98).l
RAM:0007827E move.w #$4A79,(word_0_3ED68).l
RAM:00078286
RAM:00078286 loc_0_78286: ; CODE XREF: RAM:00078276j

Just before this snipped is another load, probably the gamecode itself.

Pretty straight forward stuff.. this was fun.. pity it wasn't a harder target :)
dELTA
04-04-2003, 10:33 AM
Thanks SiNTAX! :)
Always nice to see people doing obscure things that their really good at. ;) Maybe I can show off my x86 cracking skills in some forum in 20 years or so, when it has become a forgotten art too. :D

About that collision detection, is it implemented in hardware in the Amiga somehow since it could be fixed with a setting in the emulator?!? How is this possible?

dELTA
SiNTAX
04-04-2003, 04:26 PM
Originally posted by dELTA
Thanks SiNTAX! :)
Always nice to see people doing obscure things that their really good at. ;) Maybe I can show off my x86 cracking skills in some forum in 20 years or so, when it has become a forgotten art too. :D

You make me feel old! Ohwell the language/toolbox change, but the concepts stay the same.

About that collision detection, is it implemented in hardware in the Amiga somehow since it could be fixed with a setting in the emulator?!? How is this possible?

dELTA

Amiga had 'sprites' (like the C64, or the 'object' concept on GBA, SNES).

The custom chips could do collision detection in hardware for sprites (ie. sprite-to-sprite, or sprite-to-bitmap).

Since emulating those custom chips is very cpu intensive (esp. cycle-exact), you can turn it off in UAE.

If you don't know the concept of sprites, just compare it to a hardware cursor of your GFX card.. ie a small piece of bitmap that you can freely move around on the screen, just by setting it's coordinates. (VERY fast operation.. just 2 MOV's). Amiga could display 8 sprites on 1 scanline (or more with some trickery).. vertical size wasn't limited, horizontal was.

Anyway.. all that hardware support from those custom chips was what made the amiga special. (the same like today, ie your GeForce4 making your PC special :) )
dELTA
04-05-2003, 05:40 AM
Cool! I'd never think that they had hardware graphic support all the way back then. As always, thanks for the tales from the good old days SiNTAX, very interesting! :)

dELTA
naides
04-01-2004, 06:48 PM
Cool! I'd never think that they had hardware graphic support all the way back then. As always, thanks for the tales from the good old days SiNTAX, very interesting! :)

dELTA

I just want to thank Delta for this relevant thread!!! It is already a classic
:p
dELTA
04-01-2004, 07:28 PM
Haha, you bastards, watch it so I don't make that a forum rule for real. :p
Kayaker
04-01-2004, 08:47 PM
Oh I think I peed myself... :D
dELTA
04-02-2004, 06:56 AM
Haha, shut up, I'm trying to scare the non-admins here! :D
JMI
04-02-2004, 12:55 PM
Has dELTA even been here for two years? :D I know what his postbit says, but he's an admin and can change it. I certainly don't recall him being here in 2001 when I joined. :eek: :p

Regards,
JMI
04-02-2004, 04:21 PM
O.K. :cool:

Upon further "reversing" of one of the old backups of the board, I can report that dELTA posted here 2 times in 2000, with the earliest being on 10-30-2000 in thread 1108 (and 1179); 5 times in 2001, with the first being 02-26-2001 (1456) and last on 08-22-2001 (1756). All of these posts were as "Guest." As late as 03-23-2002, dELTA was still posting as "Guest." :eek:

The first post I have found with dELTA as a "registered" poster is dated 08-25-2002 (thread 3670) so it would appear that some "changes" have been made somewhere in that "join date. :D (The directorate denies any implication in the preceeding statement as to who may be responsible for any changes. :D )

Just for the record, the backups do not go back beyond thread 90 and Kayaker has a post in thread 91, dated 10-31-2000, which is the first I can find. The first one of my own I have found is in thread 460, dated 04-23-2001, which IS consistent with my own "join date."

So it would appear that dELTA could "protest" he had "been here" longer than two years :p , but it would appear also to be correct to state that he would not have been a "member" for two years until around August of 2004.

Anyone wishing to "confirm" this information may use:

http://66.98.132.48/forum/showthread.php?t=

with the mentioned thread numbers and confirm my findings.

Regards,
Woodmann
04-02-2004, 05:05 PM
Howdy,

The problem is from changing board software if I recall correctly.
There was also a time when we had a problem with database transfer
and had the temp board.

For the record, listing the first 10, oldest first:

Kayaker
Fake51
LaptoniC
JimmyClif
CrackZ
Woodmann
dELTA
+SplaJ
Mike
esther

How the hell I am not at least #2 baffles me :confused:

Woodmann
dELTA
04-02-2004, 07:46 PM
Thanks for looking that up JMI, I actually always knew that I didn't "adjust" my join date far back enough, but since I didn't know the real date I held back a little to make sure I didn't "cheat" at least. :) Now it's adjusted to the date of that first post you found, even though I know I was practically here from day one anyway. :) This fact is even quite conveniently supported by the fact that I am referring to "the old board" in that first post of mine you mention above. And actually, I was not posting as a guest at that time either, but my original account was deleted due to some technical problems, and I had to create a new one. All posts made by any account that has been deleted are automatically turned into "guests", which is the explanation for that.

Anyway, I've been around since even before +Fravia himself came up with the great idea to start a forum at all. and at that time I had already read each and every article on his fantastic original static site too, mind you. ;)
JMI
04-02-2004, 08:37 PM
So dELTA, what you are telling me is that you are the one who gave +Fravia the idea to start the Forum in the first place. :rolleyes: Maybe either he or Tolkien, whose picture is often posted as +Fravia's, was
actually your father. ;) No wait, I know who your father is. :D And that your Mom can cook. :)

And even though you had read all that stuff on the "static site" by the time you were 18 or so, and were in on the start of the Forum, you still seem to have had only 10 or so posts in the two years between 10-30-2000 and 08-25-2002, followed by 860 more since August 2002. So, young man, just what the heck were you doing during those two years. :confused:

And Woody, you're always #1 in my book. ;)

And I supect that I'm still really the "oldest." :D

Regards,
dELTA
04-03-2004, 06:02 AM
And even though you had read all that stuff on the "static site" by the time you were 18 or so, and were in on the start of the Forum, you still seem to have had only 10 or so posts in the two years between 10-30-2000 and 08-25-2002, followed by 860 more since August 2002. So, young man, just what the heck were you doing during those two years. :confused:
Oh, I don't know, cracking stuff, lurking, getting a master's degree in computer science? ;) Or maybe it has something to do with the board problems woodmann mentions, or the earlier problems with my account.


Documentation of earlier undocumented MS API:s...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Documentation of earlier undocumented MS API:s...
PDA

View Full Version : Documentation of earlier undocumented MS API:s...

dELTA
03-07-2003, 01:20 PM
As result of a court ruling in November 2002 (in the MS antitrust case), Microsoft was forced to document a large number of earlier undocumented API:s in Windows.

Here is that documentation, for anyone interested:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnapiover/html/api-overview.asp


Do you suppose
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Do you suppose
PDA

View Full Version : Do you suppose

nikolatesla20
03-07-2003, 02:15 PM
That Alexy has his own little unpacker for his packer, and also a "backdoor" thru the encryption...

And a hard drive full of client's software :D

Just a thought

-nt20
Manko
03-07-2003, 02:17 PM
lol


How to know where I am
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to know where I am
PDA

View Full Version : How to know where I am

newbcrk
03-07-2003, 03:46 PM
:bpx getfiletime
Break due to BPX KERNEL32!GetFileTime (ET=2.15 seconds)
:u 77E7B19A L FF
KERNEL32!GetFileTime
001B:77E7B19A 55 PUSH EBP
001B:77E7B19B 8BEC MOV EBP,ESP
001B:77E7B19D 83EC30 SUB ESP,30
001B:77E7B1A0 8B4508 MOV EAX,[EBP+08]
001B:77E7B1A3 2503000010 AND EAX,10000003
001B:77E7B1A8 83F803 CMP EAX,03
001B:77E7B1AB 0F841A3F0200 JZ 77E9F0CB
001B:77E7B1B1 6A04 PUSH 04
001B:77E7B1B3 8D45D0 LEA EAX,[EBP-30]
001B:77E7B1B6 6A28 PUSH 28
001B:77E7B1B8 50 PUSH EAX
001B:77E7B1B9 8D45F8 LEA EAX,[EBP-08]
001B:77E7B1BC 50 PUSH EAX

Hello , I haven't break at the good place because I am under a api of the kernel .
How to know when I am under my target ; under a API of my target ?
Will it be writte for example
Break due to BPX 'name of my target'!GetFileTime (ET=2.15 seconds)

i press F12 and I have the code .By all apparences I am not under my target too I read call [kernel32getfiletime] and CALL [KERNEL32!CompareFileTime]

Break due to BPX KERNEL32!GetFileTime (ET=1.91 seconds
.................. call [kernel32getfiletime]
:u 77547B33 L FF
001B:77547B33 85C0 TEST EAX,EAX
001B:77547B35 7415 JZ 77547B4C
001B:77547B37 83C324 ADD EBX,24
001B:77547B3A 8D45F8 LEA EAX,[EBP-08]
001B:77547B3D 53 PUSH EBX
001B:77547B3E 50 PUSH EAX
001B:77547B3F FF152C135477 CALL [KERNEL32!CompareFileTime]
001B:77547B45 85C0 TEST EAX,EAX
001B:77547B47 7503 JNZ 77547B4C
001B:77547B49 6A01 PUSH 01
001B:77547B4B 5E POP ESI
001B:77547B4C 57 PUSH EDI
001B:77547B4D FF154C135477 CALL [KERNEL32!CloseHandle]
001B:77547B53 5B POP EBX
001B:77547B54 8BC6 MOV EAX,ESI
001B:77547B56 5F POP EDI
001B:77547B57 5E POP ESI
001B:77547B58 C9 LEAVE
001B:77547B59 C20800 RET 0008
001B:77547B5C 55 PUSH EBP
001B:77547B5D 8BEC MOV EBP,ESP
001B:77547B5F 6AFF PUSH FF
001B:77547B61 68B07B5477 PUSH 77547BB0
Thanks for all ideas
squidge
03-07-2003, 04:35 PM
1) Read FAQ's

2) Search board. This has been answered many times already.

3) Download SoftIce tuts.
Winston
03-07-2003, 04:40 PM
Hiya newbcrk

From the little info you gave I'm guessin your talkin about SI.

A simple search would have found the answer your lookin for :)

Need to know how to use them tools, but the answer is right below the code window and lower right. hope is what you lookin for
dELTA
03-08-2003, 07:36 AM
Yes, in one of the borders of the softice screen, it usually reports "<current_modulename>!<current_area_or_address>", like you said.

But an API breakpoint will always break in the dll where the API is located, not in the code that's calling it. By looking at the stack directly after the breakpoint hits, you can place another breakpoint that is guaranteed to get you back immeditately after the call inside the caller code (ok, if noone is editing the stack manually before the return, but this should not happen too often).

It will never report like you suggest though ('name of my target'!GetFileTime), since there is no area named "GetFileTime" inside your module, it will most likely just be an address after the exclamation mark once you are back inside your module.
Solomon
03-08-2003, 07:52 AM
try conditional breakpoints, such as
"BPX GetFileTime if (pid==XXX)", where XXX is the process ID of your target.

also don't forget the STACK command.:D
Manko
03-08-2003, 08:12 AM
You can use the "addr" command to see a list of processes, and the one you're in will be lit up. And if you some time wich to put a breakpoint and are not in the right process-context you can use addr "name of process" to get into it, to be able to set breakpoints.

And if you are in the right context. That is if the "addr"-command shows your appname lit up in the list.
You can do like salomon sais BUT put _pid in the argument. _pid signifies "THIS PROCESS". Like so:

BPX GetFileTime if pid==_pid" (Remember! This will only work if you're in the right context already... see "addr".)

/Manko
LOUZEW
03-08-2003, 03:04 PM
Take a look at bottom of disassembly window (under SI), you'll see the module name you are debugging, if it's an API, F12 to comeback (maybe many F12) !
naides
03-08-2003, 03:56 PM
Well every body is giving recipes that should have newbcrk sorta confused now. let me add one more:

type in Sice 'ws' which activates the stack window. You will see a series of module names and addresses, which are none other that the call stack.

Where are you? inside the system dll.
who call the system dll API? the process at the top of the stack list. how do you get back to the calling process? simply click on your target process in the stack window and Sice will take you there. BPX there, where you want to stop in the target process by simply double clicking the code instruction, and let Sice roll.

Simple eh?
newbcrk
03-19-2003, 03:00 PM
Thanks at all .My answer is coming late ; 1/my english is bad .
2/As soon as i read "read the FAQ read the tutos" i shut up
Your answers confirm me I was not sure .I was a litlle confused because there are 3 greens lines wich could tell me where I am .
I choose the green line between the code window and the command window after pressing F12 of course


Symbian OS7 reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Symbian OS7 reversing
PDA

View Full Version : Symbian OS7 reversing

n03l
03-07-2003, 04:36 PM
Did anyone here have a go yet at reversing Symbian OS 7 files?

Problem with it is that

1: you need a phone running Sumbian OS7 to unpack the .sis file. The sis file is the file/program containing the needed main app and resource file (this is the easy part, as I have a phone that will do this) After installing the .sis file, you can copy all the unpacked files back to the main system. (I guess you can see the .sis file as a zip file)
After installing the file/program on the phone the .sis file will be unpacked and you will have (depending on what kind of program it is) a .app file and a .rsc file (and maybe some more un-usable data files)

2: You need to link the .rsc file (that is the file that is containing the resource ID's) to the main .app file.

Step 2 is the hard part, and up till now I did not manage to link the two file together with any of my disassemblers!

Disassembling the two files separate (.app and .rsc) is no problem, and is showing usable data! (the .app file with lots of nice code to play with, and the .rsc with lot's of nice resource ID's)

There use to be this small program (ERL) that would make a nice dumb of the resource ID's linked to the main .app, but this is only working for the older Symbian OS 6.

Someone here with any suggestions how I can link the files?

n03l.
monmur
03-29-2004, 04:10 AM
hey

2: You need to link the .rsc file (that is the file that is containing the resource ID's) to the main .app file.

Disassembling the two files separate (.app and .rsc) is no problem, and is showing usable data! (the .app file with lots of nice code to play with, and the .rsc with lot's of nice resource ID's)

what are u using to disassemble the .rsc files? when decompiling the rsc files works and you get all the resIDs .. all you would do is looking for resource api calls, wouldn't u?

plz let me know, if you already found a way.


Tool: RTA 1.10 - Released...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tool: RTA 1.10 - Released...
PDA

View Full Version : Tool: RTA 1.10 - Released...

squidge
03-08-2003, 07:40 PM
This version can assemble some commands into a smaller number of bytes than the previous version, which means squeezing them into the small spaces lots of programs leave for us should be (slightly) easier now.

File editor now built in - includes direct assembling into the executable, with full disassembler so you know where you are. Comes with useful undo feature just in case an instruction was slightly longer than you thought it was.

plus other changes, etc, etc...

To come: show string references in disassembly window. For now, it only shows either nothing, or hex codes from each instruction. To get the hex code listing, just click on the right hand column tab.

Where to get it? hxxp://ibiblio.org/paulc/rta/rta111.zip

Comments/suggestions/bug reports/etc - either by PM or in this thread. Ta !
squidge
03-09-2003, 08:00 AM
Bug fix - hex opcodes not displayed properly.
Added - hex/data references (click on the third column header in disassembly)

hxxp://ibiblio.org/paulc/rta/rta111.zip
crUsAdEr
03-09-2003, 05:48 PM
Hi squidge,

How about loading saved asm file? or text file? watever... so that i can make a patch template for certain protector, and load it each time i want to patch a prog with that protector?
Paul333
03-09-2003, 06:28 PM
Thanks squidge i was waiting on this :)

Good idea crusader!

paul333
squidge
03-10-2003, 07:10 AM
Good idea ! I'll put it on the todo list :)

I'm assuming you mean a file containing VA address and asm code to place there, and then just goes through and makes all the mods for you? If so, no problem.

Originally posted by crUsAdEr
Hi squidge,

How about loading saved asm file? or text file? watever... so that i can make a patch template for certain protector, and load it each time i want to patch a prog with that protector?
crUsAdEr
03-10-2003, 07:33 AM
Good idea ! I'll put it on the todo list

Probably harder to implement... but it would be real useful only if we can edit asm code on the fly... as in we load about 20 lines of asm, edit a single value in line 7 for example... you might want to allow variable instruction size or you just want to enforce editing to keep within the original instruction length...

Hee... i can try to think of more work for you to do if you wish :)...
squidge
03-10-2003, 07:43 AM
Well, I'm interested in any features you may have to keep me busy when I get bored, so.... :)


SICE crashes with DX 9
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SICE crashes with DX 9
PDA

View Full Version : SICE crashes with DX 9

himanshu
03-09-2003, 07:24 AM
hehe .. i just installed Directx 9 and now my debugging life is over. SICE crashes each time i press cntl-D.

So.......do not upgrade to dx 9 unless and until its neccesary. or wait for numega to come up with patch.

btw...ne one else tried installing dx9 on winxp ?? or is it just me ???
Aimless
03-09-2003, 09:51 AM
Not at all.

It works for me (ICE v4.05) for WinNT.

Works for me on:

1. NT 4
2. 2K Server
3. XP Pro

Must be something else.

From your name...Indian?

Have Phun
squidge
03-09-2003, 11:27 AM
Installed DX9 on WinXP Pro here with no problems, and sice still works.
evlncrn8
03-10-2003, 10:27 AM
same here.. no dx9 probs at all
DooGie
03-15-2003, 02:10 PM
No probs here either. Running XP Home & Driver Suite v2.7
Timbo
02-14-2004, 03:40 PM
And UP
My Specs: XP SP1, AMD CPU, NFORCE2 MOBO, ATI 9500 GFX
DirectX with ATI is a pain, didn't work at all. OGL is ok.

Fullscreen : when i hit STRG D the Computer reboot's.
Windowed : it's ok no problem at all

I tried different Drivers (GFX/NFORCE), disabled Write Combining, disabled all in bios (Pentium OFF in Winice.dat), nothing seem to work.
If anyone is running a system like this (ATI-CRAP) without problems (DX9),
please be so kind enough to post your Driver Version (Cat) and/or Winice.dat.
Bios rev of the GFX Card would be also helpfull
nikolatesla20
02-14-2004, 04:46 PM
Yes, I started having crashes after I installed new video card drivers, I would get a blue screen if I tried to start SoftICE.

I just re-installed SoftICE and it started working correctly again.

-nt20
Timbo
02-14-2004, 06:34 PM
Yes, I started having crashes after I installed new video card drivers, I would get a blue screen if I tried to start SoftICE.

I just re-installed SoftICE and it started working correctly again.

-nt20

Did it more than 20 times, fresh install of 1.xp, 2.sp1, 3.ati, 4.dx9, 5.softice
no problems except DIRECTX, tried different Resolution, different HZ,
different Rage3D Setting Tweaks, nothing really nothing helped.
Everytime in a DX-Fullscreen game pressing hotkey for SoftIce under XP
it's rebooting. (changed altkey, changed faults i3here i1here on/off )
No BSOD, no error report, just REBOOT
(edit Games are not protected (TRAOD,UT2003,UT2004 demo,)
(dxdiag fullscreen test !!!!! )

No Problem in DX window mode, no problem also under W9X
(same driver Type, same Softice ver$) and no Problems with OpenGL .
I gave it up (took too long time to install a really new runnung System)

It must be something else :(

eg. ATI-Hotkey manager(also disabled) or another GFX-Bios (swapped 5 times) or maybe even another keyboard (tried another PS2)

Tried Cpu overclock / underclock / FSB speed oc/uc, different ver$ of siwvid
Gfx underclock, no change , only reboot

A GeForce3 running fine, uninstalled ati driver, reboot with new card, installed new
GFX driver, reboot, Detect & Test with CompuW Setup Tool, reboot,
no problem with Nvidia's GFX in DX9 Fullsceen (ok sometimes window doesn't appear )

@nikolatesla20
DX version? , an Ati card ?
nikolatesla20
02-14-2004, 08:43 PM
NVidia card (GeForce 440Bx), DX 9.1b

But truthfully I haven't run it during a game in a while, so who knows. I use windowed mode, but I haven't used SI during a game in a while.

-nt20
blob
08-23-2004, 07:43 PM
Hello everyone,
sorry to push this old threap up again but im still struggling with this problem.

Like other ppl already described in some threads softice works fine for me under xp as long as i dont try to use it during a fullscreen dx game. Just when i pressed down ctrl+d the screen gets black and my pc is rebooting (Got an ATI Radeon 9600 XT - Newest ATI Graphic Driver). After months of hopeless despair i wanted to give it another try and started playing around. So i disabled "Trap NMI" and "Disable mapping of non-present pages" as someone posted it once to give it a try. Also have Disabled Pentium support checked.

And then suddenly.. hurray.. Softice popuped in the dx adventure Broken Sword The Sleeping Dragon though it used to crash it. But it still seems to be pretty unstable because after a reboot it happens to still crash / reboot the pc.

But why im actually writing this post is because another problem i got. When Softice seems to run on this dx game i get back to Windows and start e.g. Warcraft3 or some other dx game and then *BANG* Softice popups up in FullScreen showing "Break due to Embedded Int 3". Now if i x; it just starts popping up again and again with "Break due to Embedded Int3" and i can only reboot my comp to get out of it.

Now what the hell does this mean?
omega_red
08-23-2004, 07:59 PM
But why im actually writing this post is because another problem i got. When Softice seems to run on this dx game i get back to Windows and start e.g. Warcraft3 or some other dx game and then *BANG* Softice popups up in FullScreen showing "Break due to Embedded Int 3". Now if i x; it just starts popping up again and again with "Break due to Embedded Int3" and i can only reboot my comp to get out of it.

Now what the hell does this mean?

You have "i3here on" in softice?
SpiderVenom
08-23-2004, 08:55 PM
My specs:

Pentium 4 2.4GHz
DirectX 9.0c (w SDK)
ATI Radeon 9500 Pro
Catalyst 4.8
Windows XP Pro SP2
SoftICE 4.3.1

So it would seem that you can run SoftICE with the ati "crap"

And, as omega_red says, type I3HERE OFF into softice then try running one of those problem programs.
JMI
08-23-2004, 10:26 PM
And it often helps if one actually mentions which version of the OS and software one is running when you want to discuss compatiability issues.

Regards,
doug
08-23-2004, 11:05 PM
I haven't noticed any DirectX issues here myself.

However, I have experienced the same type of problems as the others have reported. I also concluded that any full-screen debugging was to be done on my nVidia machine (geforce ti) & not on the ATI one (radeon 7500).

With the ATI card, as soon as a breakpoint triggered or I pressed ctrl-d, while in fullscreen, I'd get a BSOD. This was on windows XP with SoftICE 2.7. I never really bothered investigating the problem :-/ since I could get it going right away on the next computer. I'll test what blob suggested though, thanks for the tip.

Also, I wouldn't touch XP SP2 for a long time, it's probably going to break compatibility with A LOT of our tools since they usually don't follow the 'rules' of the OS ;)
Silver
08-24-2004, 02:52 PM
I do a lot of DX stuff, I code for it so have had the DX8, 8.1, 9, 9b and 9c SDK's installed and have had no problems with sice interfering. I think I had to mess with the DX debug library config to stop "break on mem leak" or something, but once I sorted that for DX8 I've never had a problem since.
omega_red
08-24-2004, 05:53 PM
It's most probably issue with ATI drivers - I have the same reboot problem with radeon 7500 (w2k sp4, DS 4.3).
blob
08-26-2004, 07:11 AM
Mh.. maybe it was already like that before:

I just reinstalled Windows XP (no SP).
-Newest Nforce Driver
-Newest ATi Graphics Driver
-DriverStudio 3.1 / SoftIce only installed.

No when i start Softice without any changes (Universal Video Mode) it seems to work fine under DX Games.
BUT if i start Softice with IceExt like i always did before Softice will break on the most games (of course there might be the on or other exception - like doom3) with this "Break due to Embedded Int3" Error. After typing I3HERE 0FF i receive a Windows Blue Screen saying:
" A problem has been deteceted and windows has been shutdown to prevent damage to your computer [...]. In particualar run a memory check and check for faulty or mismatched memory. Try changing video adapters.
[...] Stop 0x0000007F (...) [...]"

Now i checked my ram on Boot and my 1gig (2x512) is exactly 1048576k.
Also i dont get it why Softice works fine without IceExt and crashes on the Startup of DX Games with IceExt. Actually dont wanna miss it, it has some nice features.
omega_red
08-26-2004, 08:21 AM
No when i start Softice without any changes (Universal Video Mode) it seems to work fine under DX Games.
BUT if i start Softice with IceExt like i always did before Softice will break on the most games (of course there might be the on or other exception - like doom3) with this "Break due to Embedded Int3" Error. After typing I3HERE 0FF i receive a Windows Blue Screen saying:
" A problem has been deteceted and windows has been shutdown to prevent damage to your computer [...]. In particualar run a memory check and check for faulty or mismatched memory. Try changing video adapters.
[...] Stop 0x0000007F (...) [...]"

Yes, IceExt has some problem with DX - while I can debug windowed apps with clear Softice, IceExt crashes the system just like you said. I've informed Sten about it, and he said he will take a look at it. Suppose we have to wait for next IceExt version.


Aspr IAT Cleaner
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspr IAT Cleaner
PDA

View Full Version : Aspr IAT Cleaner

Zilot
03-10-2003, 02:28 AM
Some errors are corrected now, any comment is appreciated (if it works at all).

This will work only under Win2K.

Soldat
S3ri@l CoDe9x
03-10-2003, 12:57 PM
Hi!.. good work!!

Only one question, u can tell me what versions support?

or

with that versions of aspr u have tried it?

Tnkx :p

Best Regards :rolleyes:
Zilot
03-11-2003, 02:19 AM
Should work with all versions, if you find different feel free to say.

Soldat


St4rsh1ps Unl1m1ted 2_3c
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > St4rsh1ps Unl1m1ted 2_3c
PDA

View Full Version : St4rsh1ps Unl1m1ted 2_3c

UriPui
03-10-2003, 12:02 PM
Hi,

there seems to be a very hard serial generating in that game. Perhaps you can give
me a clue how to find the right one.

All I know is that it converts from your serial
o=0
i=1
z=2
s=5
g=6

and put this into a hex value:

'123456789' = 75BCD15 = EAX = ECX

then

AND ECX,0FF (Only takes the last two digits)

and compares it with a value created from your name.

Try
Name: Chris
Serial: 000000000

It says allright but still aborts after 1OO years of playing what shows it's still
l0cked.

There must be another check. Searched for the message but found nothing.

Can you give me a clue?
h***://***.a__p_e_z__o__n_e.com/ (WITHOUT underscores)

I really like to know how this works...

Thanks in advance
Iwarez
03-10-2003, 12:23 PM
If it is like I think it is, then the serial has an easy check for the serial entry and some other checks throughout the game. Very clever and sometimes harder to find.
UriPui
03-10-2003, 12:41 PM
Hmm,

;)

is there a way to get the right serial though? Perhaps you know a tutorial about
the same type of serial checking?

regards
squidge
03-10-2003, 02:12 PM
It's very easy to get an ACCEPTED serial, but quite a bit harder to get a serial that will unlock the entire program. You'll have the watch all the variables the serial routine uses (incl the name and serial fields) and set some memory breakpoints on them to see where else they are accessed.

I remember cdrwin having a very similar system - you could generate a unlock key for it very easily, but unless you get the system exactly right (ie, not just the first check), then it wrote random files over your entire hd.
Iwarez
03-11-2003, 12:30 AM
You just have to watch where the serial is stored and put a memory breakpoint on that. Or get all the references from IDA and look where there are calculations done with the serial...
UriPui
03-11-2003, 10:29 AM
First, thanks for your ideas and the hint to look for CDRWin. It's bad I can't find
a usable good tutorial about reversing CDRWin. The one on Krobars page
is very hard to understand why and where?

My ideas 'till now:

Hmm,

probably it saves the key to the file 'd_e_b_u_g_._d_a_t_' (without underscores).

After you entered a, on the first sight, right serial it performs some _fopens and so on
what saves it into that file. Perhaps it reads it after the dialog box during the
game and compares it with something. Unfortunately I can't check it further
because it's a dx-application what causes me OllyDBG and my whole system
to lock-up when I reach a breakpoint. And I don't want to use S_o_f_t__i_c__e.

Any hints for a real NewestBie?

Thanks
squidge
03-11-2003, 10:38 AM
can't you get it to run in a window? a lot of dx-enabled apps can.
UriPui
03-11-2003, 10:59 AM
I'm afraid not. Not that application. It seems that it doesn't offer a windowed mode :(
squidge
03-11-2003, 01:37 PM
then it looks like it's a job for sice :)
UriPui
03-12-2003, 10:08 AM
@squidge: :p yeah, s1ce is really nice, _and_ it works with dx, but I don't like
it because it's resident in memory (like T_R_W). OllyDBG provides somewhat
like a safe enviroment. ;) ;) ;)

Ok, but I found out other things:

1. The file 'd_e_b_u_g_._d_a_t_' is loaded two times. One time at the start
of the game, the second time before I reach the limit (1OO turns) of the locked
version. I checked it with filemon (launched game, loaded savegame that
is just before the 1OOth turn, alt+tab to explorer and launched filemon)

2. The second point is that after it shows me the message about the locked game
it doesn't accept the 'd_e_b_u_g_._d_a_t_' (respective my serial) any more
although it has run the time before. Yeah, now I have that nice serial dialog box
again. :D
UriPui
03-18-2003, 01:54 PM
Well, I think I've stepped further:

FirstSerialCheck:
005352F4 |. C705 54735900 >MOV DWORD PTR DS:[597354],3A9
005352FE |. E8 FD0F0000 CALL <STUN.GenerateMagicNumber>
00535303 |. 8BF0 MOV ESI,EAX
00535305 |. C705 54735900 >MOV DWORD PTR DS:[597354],163
0053530F |. 83E6 0F AND ESI,0F
00535312 |. E8 E90F0000 CALL <STUN.GenerateMagicNumber>
00535317 |. 83E0 0F AND EAX,0F
0053531A |. C1E0 04 SHL EAX,4
0053531D |. 0BF0 OR ESI,EAX
0053531F |. 8D8424 7C04000>LEA EAX,DWORD PTR SS:[ESP+47C]
00535326 |. 50 PUSH EAX
00535327 |. E8 84100000 CALL STUN.005363B0
0053532C |. 8BD0 MOV EDX,EAX
0053532E |. B9 0F000000 MOV ECX,0F
00535333 |. 33C0 XOR EAX,EAX
00535335 |. 8D7C24 31 LEA EDI,DWORD PTR SS:[ESP+31]
00535339 |. C64424 30 00 MOV BYTE PTR SS:[ESP+30],0
0053533E |. 83C4 04 ADD ESP,4
00535341 |. F3:AB REP STOS DWORD PTR ES:[EDI]
00535343 |. 66:AB STOS WORD PTR ES:[EDI]
00535345 |. 85ED TEST EBP,EBP
00535347 |. 895424 20 MOV DWORD PTR SS:[ESP+20],EDX
0053534B |. AA STOS BYTE PTR ES:[EDI]
0053534C |. 0F85 FF010000 JNZ <STUN.NoValiedSerial>
00535352 |. 8BCA MOV ECX,EDX
00535354 |. 81E1 FF000000 AND ECX,0FF ; Check 1st serial
0053535A |. 3BF1 CMP ESI,ECX
0053535C |. 0F85 EF010000 JNZ <STUN.NoValiedSerial>[list]

SecondSerialCheck:
004785C2 |. C705 54735900 >MOV DWORD PTR DS:[597354],34
004785CC |. E8 2FDD0B00 CALL <STUN.GenerateMagicNumber>
004785D1 |. 83E0 0F AND EAX,0F
004785D4 |. C1E0 08 SHL EAX,8
004785D7 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
004785DA |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
004785DD |. 0B45 F8 OR EAX,DWORD PTR SS:[EBP-8]
004785E0 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
004785E3 |. C705 54735900 >MOV DWORD PTR DS:[597354],1C9
004785ED |. E8 0EDD0B00 CALL <STUN.GenerateMagicNumber>
004785F2 |. 83E0 0F AND EAX,0F
004785F5 |. C1E0 0C SHL EAX,0C
004785F8 |. 8945 F8 MOV DWORD PTR SS:[EBP-8],EAX
004785FB |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
004785FE |. 0B4D F8 OR ECX,DWORD PTR SS:[EBP-8]
00478601 |. 894D FC MOV DWORD PTR SS:[EBP-4],ECX
00478604 |. E8 979C0000 CALL <STUN.GetSerialValue> ; Here is the 2nd check of the serial
00478609 |. 25 00FF0000 AND EAX,0FF00
0047860E |. 3945 FC CMP DWORD PTR SS:[EBP-4],EAX
00478611 |. 74 0F JE SHORT STUN.00478622
00478613 |. C705 58AF5700 >MOV DWORD PTR DS:[57AF58],1
0047861D |. E8 8EDC0B00 CALL <STUN.ModifyKeyFile>
00478622 |> 833D 58AF5700 >CMP DWORD PTR DS:[57AF58],0 ; SkipCheck
00478629 |. 74 1C JE SHORT STUN.00478647
0047862B |. 833D DC445800 >CMP DWORD PTR DS:[5844DC],64
00478632 |. 72 13 JB SHORT STUN.00478647
00478634 |. C705 5C3C5900 >MOV DWORD PTR DS:[593C5C],1
0047863E |. C605 70465800 >MOV BYTE PTR DS:[584670],1
00478645 |. EB 07 JMP SHORT STUN.0047864E
00478647 |> C605 70465800 >MOV BYTE PTR DS:[584670],0
0047864E |> 8BE5 MOV ESP,EBP
00478650 |. 5D POP EBP
00478651 \. C3 RETN

GenerateMagicNumber:
00536300 >/$ 68 48715900 PUSH STUN.00597148
00536305 |. E8 66FEFFFF CALL STUN.00536170
0053630A |. 8B15 54735900 MOV EDX,DWORD PTR DS:[597354]
00536310 |. 8B0D 64735900 MOV ECX,DWORD PTR DS:[597364]
00536316 |. 03C2 ADD EAX,EDX
00536318 |. 83C4 04 ADD ESP,4
0053631B |. 8901 MOV DWORD PTR DS:[ECX],EAX
0053631D |. A1 5C735900 MOV EAX,DWORD PTR DS:[59735C]
00536322 |. 3D 00000100 CMP EAX,10000
00536327 |. 72 62 JB SHORT STUN.0053638B
00536329 |. A1 64735900 MOV EAX,DWORD PTR DS:[597364]
0053632E |. 56 PUSH ESI
0053632F |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4]
00536332 |. 0FAF08 IMUL ECX,DWORD PTR DS:[EAX]
00536335 |. 41 INC ECX
00536336 |. 81E1 FFFF0000 AND ECX,0FFFF
0053633C |. 8908 MOV DWORD PTR DS:[EAX],ECX
0053633E |. 8B35 64735900 MOV ESI,DWORD PTR DS:[597364]
00536344 |. B8 E9042FF8 MOV EAX,F82F04E9
00536349 |. F725 5C735900 MUL DWORD PTR DS:[59735C]
0053634F |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
00536352 |. 0FAF06 IMUL EAX,DWORD PTR DS:[ESI]
00536355 |. C1EA 10 SHR EDX,10
00536358 |. 40 INC EAX
00536359 |. 25 FFFF0000 AND EAX,0FFFF
0053635E |. 8906 MOV DWORD PTR DS:[ESI],EAX
00536360 |. 0FAFC2 IMUL EAX,EDX
00536363 |. C1E8 10 SHR EAX,10
00536366 |. 8BD0 MOV EDX,EAX
00536368 |. 5E POP ESI
00536369 |. C1E0 05 SHL EAX,5
0053636C |. 03C2 ADD EAX,EDX
0053636E |. C1E0 07 SHL EAX,7
00536371 |. 03C2 ADD EAX,EDX
00536373 |. 8BD1 MOV EDX,ECX
00536375 |. C1E2 05 SHL EDX,5
00536378 |. 03D1 ADD EDX,ECX
0053637A |. C1E2 07 SHL EDX,7
0053637D |. 03D1 ADD EDX,ECX
0053637F |. C1E2 04 SHL EDX,4
00536382 |. C1E0 04 SHL EAX,4
00536385 |. C1EA 10 SHR EDX,10
00536388 |. 03C2 ADD EAX,EDX
0053638A |. C3 RETN
0053638B |> 8B15 64735900 MOV EDX,DWORD PTR DS:[597364]
00536391 |. 8B4A 04 MOV ECX,DWORD PTR DS:[EDX+4]
00536394 |. 0FAF0A IMUL ECX,DWORD PTR DS:[EDX]
00536397 |. 41 INC ECX
00536398 |. 81E1 FFFF0000 AND ECX,0FFFF
0053639E |. 0FAFC1 IMUL EAX,ECX
005363A1 |. 890A MOV DWORD PTR DS:[EDX],ECX
005363A3 |. C1E8 10 SHR EAX,10
005363A6 \. C3 RETN
...
00536170 /$ 81EC 00020000 SUB ESP,200
00536176 |. 83C9 FF OR ECX,FFFFFFFF
00536179 |. 33C0 XOR EAX,EAX
0053617B |. 8D5424 00 LEA EDX,DWORD PTR SS:[ESP]
0053617F |. 56 PUSH ESI
00536180 |. 57 PUSH EDI
00536181 |. 8BBC24 0C02000>MOV EDI,DWORD PTR SS:[ESP+20C]
00536188 |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
0053618A |. F7D1 NOT ECX
0053618C |. 2BF9 SUB EDI,ECX
0053618E |. 8BC1 MOV EAX,ECX
00536190 |. 8BF7 MOV ESI,EDI
00536192 |. 8BFA MOV EDI,EDX
00536194 |. C1E9 02 SHR ECX,2
00536197 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
00536199 |. 8BC8 MOV ECX,EAX
0053619B |. 33C0 XOR EAX,EAX
0053619D |. 83E1 03 AND ECX,3
005361A0 |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
005361A2 |. 8D7C24 08 LEA EDI,DWORD PTR SS:[ESP+8]
005361A6 |. 83C9 FF OR ECX,FFFFFFFF
005361A9 |. F2:AE REPNE SCAS BYTE PTR ES:[EDI]
005361AB |. F7D1 NOT ECX
005361AD |. 49 DEC ECX
005361AE |. 75 09 JNZ SHORT STUN.005361B9
005361B0 |. 5F POP EDI
005361B1 |. 5E POP ESI
005361B2 |. 81C4 00020000 ADD ESP,200
005361B8 |. C3 RETN
005361B9 |> 0FBE5424 08 MOVSX EDX,BYTE PTR SS:[ESP+8]
005361BE |. BE 01000000 MOV ESI,1
005361C3 |. 3BCE CMP ECX,ESI
005361C5 |. 7E 17 JLE SHORT STUN.005361DE
005361C7 |> 0FBE4434 08 /MOVSX EAX,BYTE PTR SS:[ESP+ESI+8]
005361CC |. C1E2 09 |SHL EDX,9
005361CF |. 03C2 |ADD EAX,EDX
005361D1 |. BF 83841E00 |MOV EDI,1E8483
005361D6 |. 99 |CDQ
005361D7 |. F7FF |IDIV EDI
005361D9 |. 46 |INC ESI
005361DA |. 3BF1 |CMP ESI,ECX
005361DC |.^7C E9 \JL SHORT STUN.005361C7
005361DE |> 5F POP EDI
005361DF |. 8BC2 MOV EAX,EDX
005361E1 |. 5E POP ESI
005361E2 |. 81C4 00020000 ADD ESP,200
005361E8 \. C3 RETN

The program is doing two checks of the serial, that's
why it passes the first but not the second one.

Now, I'm stucked. I have no idea how to calculate my own serial. Because I cannot use breakpoints while using DirectX. :(

Any ideas?
squidge
03-18-2003, 05:26 PM
Since you seem to know where the second serial check is, can't you rip the code out into a standalone file, and play with it from there?


few Ideas
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > few Ideas
PDA

View Full Version : few Ideas

Bengaly
03-11-2003, 12:54 PM
heya all,
i won't refer this question to any software, this question should be as generic as possible.
well what i wanna do is basically this,
you have a block of code,i wanna read a register's value after this asm line has been executed and move to memory addr (pointed by the register) and dump this data to file,copy..whatever.
i.e:
...
xxxx xxxxxxx
xxxx xxxxxxx
xxxx xxxxxxx <- here we need to get the register's value
xxxx xxxxxxx
...
this block of code is reside in a dll which is loaded and called dynamicly by the exe.
e.g: CALL NEAR DWORD PTR DS:[9F4A78] ; inside dll

i am searching for the best ways to write a simple loader which will break, retrive,dump the data pointed by the register.

there are a few suggestions,
1. scanning memory for magic opcodes which will leads us to that line, usually this is either slow, or a not very good option :) !

2. threwing int 3 at dll at the offset of that line and try break in it, that wouldn't be much of a good idea since you can catch int 3 in other places whitin the dll's space.

i never tried breaking at dll called by parent caller , what would be the best way for breaking & searching ?

note: surely i will need to write a simple dbg or mem-scanner
or mabye some few other tricks.
cya Ben
squidge
03-11-2003, 01:40 PM
Small debugger and int 3 the dll. In the debugger if the exception was not at the addresses where you placed the int 3, then just pass it straight through to the program.
[yAtEs]
03-20-2003, 08:01 AM
simple pimple loader idea #1:

find the loadlibrary call,

start the process suspended, patch the line after the loadlibrary
call with EB FE, resume the process then use getthreadcontext
and keep checking eip(+B8) until ur at the eb fe, then read eax
from the context, and set another EB FE on the line you need the
reg using the dll base from eax as ur base, restore current bytes and wait until u reach the second eb fe then read the reg you need,

context reference here, http://www.yates2k.net/except.txt

regards,
yates.


NetCaptor 7.1.0 - new tricks
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > NetCaptor 7.1.0 - new tricks
PDA

View Full Version : NetCaptor 7.1.0 - new tricks

xybyre
03-12-2003, 05:11 PM
I've just patched the latest NetCaptor, v7.1.0. I was just wondering if anybody else had difficulties with this program...

Previous versions were packed with aspack, I believe. This one seemed to be packed with UPX. I manually unpacked this one, since I could. :) I never could unpack an asprotected proggie manually... (thank goodness for aspackdie)

anyway, the new trick here is putting the tamper-checks in exception handlers, and when it detects something wrong, a new instance of NetCaptor is created and the current process terminates. The newly-created process displays the "bad cracker" dialog.

If you break in the function that terminates the program, you don't get a call stack because of the SEH. So how do you know what code called the current function? The answer for me was IDA. IDA pointed out all of cross-references to the function and allowed me to track down the bad-cracker-check function.

It's kind of ironic, though. Now all of their bad_cracker checks call the same function to display the nag and quit. So one patch takes care of it all. (okay, there's another patch for the reg flag, but that's not really worth mentioning)

In cases like this, is there a way to find out the caller of a function without requiring the use of IDA?
S3ri@l CoDe9x
03-12-2003, 08:04 PM
I really never try to crack this app , i post one tutorial for this version, ( Thanx Real|sty/TSRh :p)

I hope that this can help u! :p

Best Regards! :rolleyes:
Solomon
03-12-2003, 08:04 PM
nice work. But really new tricks? Maybe these tricks have been there for many versions. It can be "unpacked" with an "UPX -d NetCaptor.exe" now. And it can be patched in 10 minutes after disasm, including the size_check/invalid_key_check.:D

Just search for "65537"(which is the public exponent of RSA, implemented with FGInt) in the dead-listing, key validation routine can be located and the registered_or_not flag can be found.

CODE:00506FC3 call System::_16823
CODE:00506FC8 cmp eax, 96h
CODE:00506FCD jl loc_50720D
CODE:00506FD3 lea edx, [ebp+var_1C]
CODE:00506FD6 mov eax, offset a65537 ; "65537"
CODE:00506FDB call @Base10StringToFGInt
CODE:00506FE0 xor eax, eax
CODE:00506FE2 push ebp
CODE:00506FE3 push offset loc_507206
CODE:00506FE8 push dword ptr fs:[eax]
CODE:00506FEB mov fs:[eax], esp
CODE:00506FEE lea edx, [ebp+var_8]
CODE:00506FF1 mov eax, offset aC5e974ffb63d4a ; "C5E974FFB63D4A3B7717D9CC07AFD194B0B6003"...
CODE:00506FF6 call @ConvertHexStringToBase256String
CODE:00506FFB lea edx, [ebp+var_24]
CODE:00506FFE mov eax, [ebp+var_8]
CODE:00507001 call @Base256StringToFGInt
CODE:00507006 xor eax, eax
CODE:00507008 push ebp
CODE:00507009 push offset loc_5071E9
CODE:0050700E push dword ptr fs:[eax]
CODE:00507011 mov fs:[eax], esp
CODE:00507014 lea eax, [ebp+var_8]
CODE:00507017 call System::__linkproc__ LStrClr(System::AnsiString &)
CODE:0050701C lea edx, [ebp+var_8]
CODE:0050701F mov eax, [ebp+var_4]
CODE:00507022 call @ConvertBase64to256
xybyre
03-12-2003, 09:48 PM
Solomon,

I've been using NetCaptor since version 6.x, and my latest version was 7.0.1. 7.0.1 didn't have those new tricks in it. It just displayed the dialog from the timer function, and I was able to pause it and look down the call stack (or pRet) to find the calling function.

Thank you for pointing out that UPX command. I still have much to learn about packers (can't you tell? :p), so I needed the practice.

That info about the RSA implementation will come in handy as well, but how did you know it used RSA for key validation? Is it just a part of your routine to search for it?

My real concern was whether it was possible to track down those protection routines without the help of a disassembler. What can I do in this situation if I don't have IDA handy? The stack doesn't show the calling functions.
Solomon
03-12-2003, 10:47 PM
I got the same problem(no call stack etc.) when I first tried to crack it(v7.0bx or so).

It displays error NAGs in a new thread, not new process(Do u agree?). So if we trace back, we will land at the end of this thread then get lost. With SoftICE only, it's also easy to find where the new thread is created, e.g where the hidden check/jump is. Let me explain.

Finally I find out that all hidden checks have sth. to do with the Registered_or_Not flag just as you have got.

if (Registered_or_Not == 0)
{
This is evaluation version.
CheckSystemDateTime( );
if (expired version) Registered_or_Not = 1;
}

if (Registered_or_Not == 2)
{
This is registered version, now do some hidden checks here.
}

so set a BPM on this flag, we will find almost all the hidden checks. Also we can search for this flag in W32Dasm dead-listing if we don't want to limit ourselves to debuggers only.;)

CODE:004F209D mov byte ptr [esi], 0 <--Evaluation Init
CODE:004F20A0 xor eax, eax
CODE:004F20A2 mov [esi+4], eax
CODE:004F20A5 call sub_506F54 <----key validation
CODE:004F20AA mov al, [esi]
CODE:004F20B1 cmp al, 2 <------registered ver?
CODE:004F20B3 jz short loc_4F2132
CODE:004F20B5 lea eax, [ebp+var_C]
CODE:004F20B8 call sub_4D5B5C <------check sys date/time
CODE:004F20BD mov eax, [ebp+var_C]
CODE:004F20C0 mov [esi+4], eax
CODE:004F20C3 cmp eax, 0Fh <------15-day limit hit?
CODE:004F20C6 jle short loc_4F20CB
CODE:004F20C8 mov byte ptr [esi], 1 <-------expired version

The size check can be found by "BPX FindFirstFileA". Many Delphi/BCB appz use this API(wrapped by TSearchRec) to get file size, instead of GetFileSize etc. Such as CommView, YATS32......(perhaps Alexy told them to do so:D )

CODE:004ED36D add esp, 0FFFFFFF8h
CODE:004ED370 mov ebx, eax
CODE:004ED372 mov eax, ebx
CODE:004ED374 call sub_4EDC94
CODE:004ED379 mov eax, esp
CODE:004ED37B call sub_4D5B5C
CODE:004ED380 call sub_48EE44
CODE:004ED385 cmp eax, 0C3500h <--------size check
Solomon
03-13-2003, 01:07 AM
here I attach the FGInt.sig for any one who doesn't want to install big Delphi to compile FGint.pas then get a sig file.
xybyre
03-13-2003, 09:51 AM
I believe the older versions displayed the nags in a separate thread, but this new version definitely creates a new process to do it. I used OllyDbg and when the nag popped up, I'd switch to OllyDbg and see "Terminated" in the status bar.

004F065C runNetCaptorNag proc near ; DATA XREF: sub_4F0640+1o
004F065C
...
004F0696 call getExeFilename
004F069B lea eax, [ebp+var_4]
004F069E mov edx, offset aBoing ; " --boing"
004F06A3 call @@LStrCat ; __linkproc__ LStrCat
004F06A8 mov eax, [ebp+var_4]
004F06AB call @@LStrToPChar ; __linkproc__ LStrToPChar
004F06B0 push eax
004F06B1 call j_WinExec ; runs "NetCaptor.exe --boing"
004F06B6 mov eax, ebx
004F06B8 call terminateApp
If I run "NetCaptor --boing" from the command prompt, I see the nag.
Solomon
03-13-2003, 07:18 PM
yes, you are right. I'm wrong about this for the new version. :)

Originally posted by xybyre
I believe the older versions displayed the nags in a separate thread, but this new version definitely creates a new process to do it. I used OllyDbg and when the nag popped up, I'd switch to OllyDbg and see "Terminated" in the status bar.


anti crack book
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > anti crack book
PDA

View Full Version : anti crack book

nikolatesla20
03-13-2003, 01:34 PM
anyone own this book?

http://www.amazon.com/exec/obidos/ASIN/1886411794/qid%3D1005923108/sr%3D8-2/ref%3Dsr%5F8%5F1%5F2/104-7762686-7005523

-nt20
disavowed
03-25-2003, 10:03 AM
http://ganzillo00.nm.ru/CrackproofYourSoftware_PavolCerven_pdf_en.rar
SiNTAX
03-26-2003, 09:26 AM
Originally posted by nikolatesla20
anyone own this book?

http://www.amazon.com/exec/obidos/ASIN/1886411794/qid%3D1005923108/sr%3D8-2/ref%3Dsr%5F8%5F1%5F2/104-7762686-7005523

-nt20

Browsed through it on books24x7.com... looked like crap to me!
crUsAdEr
03-26-2003, 05:36 PM
Oh come on guys... i think this book is gold for the community and should be added to all tools/tutorial site... such a comprehensive reference that would save newbies and even experienced ppl tons of searching :)...
doug
04-09-2003, 06:09 PM
i dont think you will find anything new in there.. at least from the table of content, it looked like a collection of various tricks found on the popular cracking & reversing websites...


Help with a real RCE problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Help with a real RCE problem
PDA

View Full Version : Help with a real RCE problem

naides
03-13-2003, 07:40 PM
I am having a rather annoying problem with a piece of software, which I am not going to name here, but could be asked in private. It has no real comercial value in any case, because is useless unless it is tied to a $500K instrument.

The problem:

One of the functions of the instrument is controlled by clicking on the different rows of a spread-sheet like window. The Software has a bug, and I cannot select any row that I need, or modifiy parameters in that row. It acts as a grayed-out option.

I called the company and a they went through several options, trying to correct the problem. I know it is not a problem of the instrument, or the hardware interface, because I can test it with the service utilities and It works fine. They eventually threw their hands on the air and told me "we will get back to you" 7 days ago.

I have no alternative, there is not an alternative software that can operate the instrument.

I also know that the software package works OK in other computers, so the problem is idiosyncratic to my BOX.

I reainstalled, not only the software, but the whole operating system, to no avail.

I have tried to trace the code that handles my clicking on the row, by using Sice, and a API spy utility. I placed a BMSG handle_of_the_window
WM_Lbuttonup.

Sice breaks into MFC42.dll. I can trace through the code in User32 that deciphers the message, to a short piece of code inside the application main exe, which gets called cosntantly, and dipatches a message.

What I need to find is the piece code that handles the OnClick event. I know Kayaker (Hi Kayaker, please help me if you read this) have explained some methods to do such a feat in "ungraying" buttons tuts.

I need sugggestions.
I think the problem has to do with the way the software converses with MFC42.dll but I am weary of messing with this system file.

Thanks in advance
Solomon
03-13-2003, 07:52 PM
try to get the corresponding MFC42.NMS(MFC70.NMS for VC7), it may help u to understand the MFC framework under SoftICE.

If u install VC++ 5/6, you can generate MFC42.NMS from MFC42.PDB/MFC42.MAP, which reside in your system dir.

I can upload MFC42.NMS + MFC42.DLL if you can't get it. about 4MB(no MFC source packaged in it)
Kayaker
03-13-2003, 10:50 PM
Hi naides, are you sure it's that dll causing the problem? Just a thought, but the spreadsheet is likely a listview whose mouse click notifications are controlled by Comctl32.dll and versions inadvertently get overwritten by some software. I recently had a problem with a common control not behaving correctly because of an incorrect version. (Can you confirm with a class monitor what type of common control it is, and with a message monitor what messages *other* than the button clicks are being sent?)

There are several important common control notifications sent in the form of a WM_NOTIFY message that require version 4.71 or later for example,
NM_CLICK - Sent by a list-view control when the user clicks an item with the left mouse button.
LVN_ITEMACTIVATE - Sent by a list-view control when the user activates an item

If you have IE5 installed, which might not be the case with your instrument, you'd have version 5.81, there's nine of them from 4.0-6.0. Especially with the software that comes with these types of instruments (often outdated, more often poorly written .-), you'll want to match the date written with an appropriate version. If it's not this we can look at something else.

Kayaker
naides
03-13-2003, 11:38 PM
Thanks Solomon and Kayaker, you are always helpful. I will examine your suggestions tomorrow and get back for more, if they do not work. I wish I could get more in-dept info about the Software, but: 1) I cannot load a lot of RCE tools in the computer because of supervision/security issues ;)

2) I cannot load the software into my home computer, it does not work without the hardware attached.
Kinda tight eh?
naides
03-17-2003, 05:53 PM
Just to let you know that the solution for my problem was in the general direction that Kayaker point out.

Talking about lousy developed software, it overwrote, at the end of the installation, another, previous version of a dll, which was responsible for the control that was faulty. A listview variant.

Thanks to kayaker suggestions I was able to isolate the dll and remedy the situation.

You are awsome!
Kayaker
03-18-2003, 05:03 PM
Naides, Great! Lucky guess I guess. I've had enough exposure to similar types of software tied to equipment of this sort, probably know your brand name too, and, well, just find it pretty crappy sometimes ;-) Still even the realm of 16 bit code at times. 16 bit code and a dongle protection, and a JZ patch around a message box..., /me shakes head at the piss poor implementation sometimes, lol.

So these guys had a dll which handled their *own* listview-style control drawing and handling functions? Or is the dll tied to the way MFC handles it?

Kayaker


KMD -- manual unloading???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > KMD -- manual unloading???
PDA

View Full Version : KMD -- manual unloading???

Clandestiny
03-13-2003, 08:20 PM
Hi guys,

I apologize in advance if this is a bit off topic, but I figured one of you guys might be able to help me a bit.

Currently, I'm writing my first KMD. At this point the kmd and the loader assemble, but at this newbie starge of development there seem to be a few bugs which bring down the system when it acutally runs, heh, heh ;) I'm using the CreateService / OpenService / StartService API's to dynamcially load the driver. As its currently crashing before before being properly unloaded, I can't load it again until after a reboot and even sometimes after a reboot the CreateService returns with an ERROR_SERVICE_DISABLED. I know there are some registry entries associated with services so I'm guessing that perhaps the driver is flagged in the registry for deletion, but the registered service is only deleted when the system is *properly* shut down, not locked-up cold necessitating a hard reboot? I really have no idea... I'm probably way off the mark here and I only have a couple of sketchy examples to go on. Anyway, does anyone know if there is a procedure for manually unloading a failed driver? :confused: This rebooting and ERROR_SERVICE_DISABLED problem is driving me nuts.

Thanks in advance,
Clandestiny
dELTA
03-14-2003, 06:46 AM
Are you using Win9x or NT/2k/XP?

All info for registered drivers/services can be found under the current registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

If the driver is set to disabled there, you can either change its state manually, or delete the entry completely to reset it (then reboot).

If you are using NT/2k/XP, there are some more tips I can give.

A quite generic solution is to search for your driver name in the registry (e.g. "my_driver.sys") and see what you find. The entries in which it will occur is often not very hard to "reverse". :)

dELTA
dELTA
03-14-2003, 06:49 AM
Stupid board software... Do you see the line with the registry key above? As you can see, it is broken off in the middle of the word "Services", and no matter how I try to edit it, it will still be broken off in the exact same place. Seems like some kind of "maximum wordlength" or something...
evlncrn8
03-15-2003, 11:20 AM
sometimes you can unload a kmd by typingf

net stop kmdname

from a cmd window.. works for most i've tried, but the kmd must have an unload service for it to work i think.
Clandestiny
03-16-2003, 05:04 PM
Thank you guys for the input.

dELTA, the driver is for Win2K. I have edited the registry as you suggested. I've observed that this works great provided that you do a clean shutdown / reboot, however, if the driver locks up in a blue screen forcing a hard reboot I find that I will still get the ERROR_SERVICE_DISABLED problem on the next restart. At that point, if I go in and edit the registry after the first hard reboot and do a clean shutdown/ boot I am able to load the driver again. So basically this requires 2 restarts, 1 hard reboot after the crash and 1 clean reboot after editing the registry. It's still a pain in the ass :mad: ! Guess its what I get for playing around with KMDs, eh? ;) I'm open to any additional tips / examples you've got for Win 2k drivers... :D

Thanks,
Clandestiny
dELTA
03-16-2003, 07:07 PM
In Windows 2k/XP you mostly don't need to edit the registry by hand in this way if you don't want to. You can also do the following:

1.
On your desktop, right-click "My computer".

2.
From the menu, choose "Manage", a window will appear.

3a.
For non-kernel-driver services you go to the item "Services and Applications --> Services".

3b.
For kernel drivers you go to the "Device manager". You then bring out the "View" menu from the top menu bar and choose "Show hidden devices". A new item called "Non-Plug and Play Drivers" will now appear in the list to the right. Under it you will find items for all kernel drivers registered in the system.

4.
On any of these driver/service items, you can right-click to bring up options for editing its properties and enable/disable/uninstall it.

About the reboots, yes, that is what you get for playing around with drivers. ;)

It might be possible to do the followng to make it just a single reboot though:

1.
Load the driver.

2.
"Pause" the driver before it gets to the potential crash point.

3.
Delete the registry entries for the driver.

4.
Continue execution of the driver.

5.
If the driver crashes your computer, all should be well again after rebooting. If it does not crash, you simply restore the registry entries after your tests are complete.

It's probably most easy to make a little program for quick removal/restoration of the registry entries.

Good luck!

dELTA
separator
03-19-2003, 05:28 PM
I think great tool for unload driver from memory is DriverMonitor from DriverStudio. It can unload driver and remove it from registry too. Just select driver and click to icons :)
Clandestiny
03-19-2003, 08:22 PM
Thank you dELTA and separator! :D DriverMonitor is EXACTLY what I was looking for... And to think I had it already installed on my HD w/ the rest of DriverStudio and SoftICE with no idea wtf it was used for till now... /sending myself to the corner to RTFM ;) :D

Thanks,
Clandestiny


A strange question (bytes)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A strange question (bytes)
PDA

View Full Version : A strange question (bytes)

Aquatic
03-14-2003, 12:44 AM
Let's say you know that a certain value in a game can only be a '1 byte' value (0-255). How would you change the code so that this value can become a 2 byte value?

Sometimes you want to set a value higher than 255 but you can't because when the programmer made the game he declared that variable to be a 1 byte value. It would be nice to find a way around this.
FoolFox
03-14-2003, 01:37 AM
Hello,

I think you may face a big problem, rewriting
nearly all the code.

If the code handle the var the way it's declared (working
on 1 byte), even if you extend the var(storage) to two
bytes, you'll have to goes through all parts where the prog
access the data in order to be sure that the prog handle
correctly (if the prog use al to read the var, you 'll have
some trouble to take your 2nd byte in account)....

I'm not able to think of 'a way around this' right now...

Regards
FoolFox
dELTA
03-14-2003, 06:24 AM
Just as FoolFox says, this will most likely be a quite hard and most of all tedious task, due to several reasons. But there might be much easier ways to achieve your goal. Please be a little more specific about your current project, and we might be able to give some other good tips and solutions.

dELTA


AsPack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AsPack
PDA

View Full Version : AsPack

LowF
03-14-2003, 03:23 AM
Problay noob question but... *hehe*

unpack aspack isn't hard, but one problem i never managed to see, and that is where is aspack i should stop and dump import table, before it's to late, i use olly so isn't best debugger sadly, anyone point out code snippit or something, only thing i still wanna learn, otherwise i have to use revirgin to get it, not always it works!
Solomon
03-14-2003, 04:30 AM
In softICE, set a BPM at the start address of Import Table, you will know when to dump the IT.:)
LowF
03-14-2003, 06:12 AM
K, thx for tip!

99% of questions got answer that is to easy to figure out....


Crusader - PELock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Crusader - PELock
PDA

View Full Version : Crusader - PELock

S3ri@l CoDe9x
03-14-2003, 03:46 AM
One question mr crusader:

I look u tutorial and i see that u said that u have
Win2k and SP3

U have soft ice 4.05 for NT or have Driver Suite?

If is Driver Suite...What version? :confused:

tnkx :p
crUsAdEr
03-14-2003, 05:15 AM
I think DS 2.7.. not sure :(...
not with my box nowadays...


Self-deleting exe:s, widespread technique won't work?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Self-deleting exe:s, widespread technique won't work?!
PDA

View Full Version : Self-deleting exe:s, widespread technique won't work?!

dELTA
03-14-2003, 07:33 AM
There are several tricks for making programs that are in one way or another able to delete themselves, without leaving any traces in the system.

One of the most wide-spread techniques, and also the one which is supposed to be one of the most platform independent (between Windows versions) is the following:

1.
Start the program you want to delete (EXE1).

2.
From this program, drop a second exe file (EXE2).

3.
Open a file handle to EXE2 from EXE1, using CreateFile, with the flag "FILE_FLAG_DELETE_ON_CLOSE".

4.
Execute EXE2 from EXE1 (e.g. with CreateProcess), causing the operating system to open another file handle to EXE2.

5.
Let EXE1 exit and terminate (which will implicitly cause its filehandle to EXE2 to close, leaving only the operating system's filehandle to EXE2 left open).

6.
EXE2 waits for EXE1 to terminate, and as soon as it detects this, it deletes EXE1 from disk.

7.
After successfully deleting EXE1, the job of EXE2 is complete, and it exits and terminates, causing the operating system's filehandle to it to close.

8.
The general concept and idea is now that EXE2 should immediately be deleted upon this closing of the last open file handle to it. This is also a seemingly correct assumption, especially when you read the entry for the "FILE_FLAG_DELETE_ON_CLOSE" flag of the CreateFile API in the Win32API reference:

FILE_FLAG_DELETE_ON_CLOSE
Indicates that the operating system is to delete the file immediately after all of its handles have been closed, not just the handle for which you specified FILE_FLAG_DELETE_ON_CLOSE.
The problem is that on the contrary (according to my own experiments), the file deletion does only work if the last file handle to be closed is the one that was opened with the "FILE_FLAG_DELETE_ON_CLOSE" flag. If any file handle is left after this, nothing will happen when it is closed, and the file will hence not be deleted.

This will of course prevent the whole self-deleting exe technique to fail, since the operating systems handle of EXE2 always have to be closed after the handle that EXE1 opened (the one with the FILE_FLAG_DELETE_ON_CLOSE). This is because EXE2 will not succeed in deleting EXE1 before EXE1 is closed, and as soon as EXE1 is closed, its handle to EXE2 will be implicitly closed. And EXE2 will not terminate before it has successfully deleted EXE1, and hence, the operating system's handle to EXE2 will not close before EXE1 has terminated and (implicitly) closed its handle to EXE2.

There is even ready-made example code to be found on the web that is supposed to demonstrate this technique, and the people who provide it claim to have used it successfully. But I have tried this very code on both Win98, Win2000 and WinXP, and in all cases, the dropped exe fails to automatically delete when it terminates, hence being left on the disk.

This makes me wonder if this whole technique is just someone's drug induced fantasy, based on a mixture of the incorrect statements in the Win32 API reference and their own lazyness not to actually try the code themselves (and then obviously lying about having gotten it to work).

So, my question here:

Has anyone reading this post ever gotten this to work, or at least ever seen a program that succeeded in using this technique?

Also, I attach the very small source code of the example program that is supposed to accomplish this with this post. It would be very nice if people could compile it (it should compile right away in VS 6/NET, if inserted into a standard console application), and try it on their systems to see if it succeeds there.

It will simply print out the full path of the EXE2 it has created, and then use the procedure described above.

The desired result is that both the main exe (EXE1) and the created EXE2 should be deleted from the disk afterwards, but in my case EXE2 will always remain on the disk. :(

Thanks for any help or tips!

dELTA
dELTA
03-14-2003, 07:42 AM
Here is the source for the short example program (2685 bytes).
foxthree
03-14-2003, 01:07 PM
Interesting you mention it. Myself and my friend were discussing this the other day as a new way to prevent patching your code. You see any modification to your code, you self-destruct. Maybe annoying but hey...

However, I believe my friend tried it and had the same effect something like you said. My suggestion to him was to do something like uninstall proggies do... Uninstall Programs uninstall other files *and* finally delete themselves. Why would you need 2 EXEs for this. The uninstall way looks far more 31337 ;)

I think it also can be done in a platform independent manner using some VC++ linker switches... I believe Matt Pietrek mentioned something about this in one of his articles... I'm sure you'll find it if you search the web... Why don't I post the link u say, heh I'm suffering from a disease called laziness :D

Happy hunting,

Signed,
-- FoxThree
dELTA
03-15-2003, 08:07 AM
Thanks for the reply FoxThree! Some questions though:

However, I believe my friend tried it and had the same effect something like you said. My suggestion to him was to do something like uninstall proggies do... Uninstall Programs uninstall other files *and* finally delete themselves. Why would you need 2 EXEs for this. The uninstall way looks far more 31337 ;)
And more exactly what do you mean with "like uninstall proggies do"?

Most uninstallers use the Windows Installer services, which can assist in deleting the last file, since it's really the Windows Installer service that is performing the tasks, and it is still left in the system afterwards. The majority of the uninstallers that are not using the Windows Installer services are using MoveFileEx/wininit.ini to remove the final executable on the next reboot. This is elementary, but the problem is that it is not instant, the file will be left on the disk until the next reboot, and I really don't want that.

I think it also can be done in a platform independent manner using some VC++ linker switches... I believe Matt Pietrek mentioned something about this in one of his articles... I'm sure you'll find it if you search the web... Why don't I post the link u say, heh I'm suffering from a disease called laziness :D
I have very hard to see how the linker can have anything whatsoever to do with such a thing? :confused: Also, I cannot find any Pietrek article discussing the subject of self-deletion. :( It would be great if you could explain some more, or maybe even give me that link if you can find it. ;)

Thanks!

PS.
I see some people have downloaded the test program source code. What results have you gotten while running it?

PS2.
For people suffering from the same disease as FoxThree, I have included the compiled exe file with this post. :D (Yes, mega-bloated to 156 kb, courtesy of VS6 :eek: ).
mike
03-16-2003, 03:53 PM
http://www.google.com/search?q=pietrek+"self-deleting"
dELTA
03-16-2003, 06:12 PM
Yes, I have seen a bunch of articles and texts about it too, but some of them contradict each other, so I thought I'd ask some people I can trust for additional first-hand info.
mike
03-16-2003, 09:48 PM
disavowed
03-17-2003, 12:06 AM
http://board.win32asmcommunity.net/showthread.php?s=&threadid=1152


any experiences with "Xtreme protector"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > any experiences with "Xtreme protector"
PDA

View Full Version : any experiences with "Xtreme protector"

nikolatesla20
03-14-2003, 10:23 AM
Hm. Worth a try, or is this an enhanced virii..

http://www.xprotector.com/xprotscr.htm

Especilly check out this option:

http://webpages.charter.net/nikolatesla20/antidebug.jpg

Option 4 is appalling.

Um, you know, it "might" be illegal to crack - (if it is, prove it. I can crack anything I want on my own computer, as long as I don't distribute it, so there - the data is on MY hard drive), but I would think crashing the system could be equally accountable. Two wrongs don't make a right, do they?

Wonder if I'll get in "trouble" for "stealing" their graphic :D

-nt20
squidge
03-14-2003, 02:42 PM
I've taken a look at this protector, and all I can say is - who will use it? Hopefully very little. Most software makers want to simply go "protect exe" and be done. It can take about 15 minutes to go through all the questions than XP asks. At one part it mangles you code and interleaves it with it's own, and then asks you to test to program to ensure it doesn't crash. Therefore, I doubt many people will use it.

Think about it - prog is developed, protected, and finally sent to beta testers. Testers report faults. Developers can't reproduce the fault as it was because the protected has mangled the code too much.

I think the name does it well however - "Xtreme" is a perfect word, although I think it's too extreme.

No doubt however, that once the relevent signatures have been applied, you can trace the injected code and remove it. Although, to be honest, I'm not really interested in the program after it added 1.2mb of code to my standard "hello world!" masm prog (1536 bytes - used for unpacking packers/protectors).
gorge
03-14-2003, 02:51 PM
I also tried it myself, my program in memory went from 4MB to 16MB, 1 thread to 64 threads. Took a while to load when I first executed the proggie with the protection. It adds a ton of stuff and slows down the code :(

I tried booting the protector under Windows 98 and it crashed. :rolleyes:

I don't think too many shareware developers will use this :p
Kayaker
03-14-2003, 06:20 PM
Tend to agree, great in theory but fails in practice. Still, it's interesting to study the techniques even if it won't fly as a viable protector.

Five pages of notes later, ... Within the 3Mb packer exe file contains a complete dynamically loaded vxd, XPROTVXD, which is decrypted and run if you get by the debugger check. This is unique, the vxd may be 'bound' to the original PE file much as can be done with a dll, such as various PE binders do. Nice way to hide a vxd (can you find its sys counterpart in 2K?) The vxd code simply returns the INT 1 and INT 3 IDT address entries for ultimate hooking, maybe in ring3.

The SMC code of the packer itself is kind of funny because it makes extensive use of the SIDT and RDTSC commands, perhaps to scare the cracker into thinking its using these to access the IDT or use as a single step timing trap, but they do nothing but add some obfuscation. There's no tricky SEH used in general from what I could see, but there's these little stack jump loops providing partial decryption mixed in with the SIDT/RDTSC twiddlings and everything runs through Call EAX calls.

The SMC is a little different from what I've seen, but you can certainly walk through it if you last long enough. It begins with walking the export directory of kernel32, getting LoadLibraryA and associated calls, accessing start addresses of user32, advapi32, ntdll.dll, doing a \\.\ NT/SICE and SIWVID thing with CreateFileA, then starts getting the rest of the imports. The vxd is loaded later, Icedump /protect seems to be handled. No idea if a packed file behaves the same way, but I always like to look at the packer itself first.

It's ironic, if you don't have API bp's set, after the vxd loads it "announces" itself in the Softice window, 'Copyright the XProtector Team'. Tadaahh... Wait a minute, the End User should never see that!! I'll give it an A for originality ;)

Kayaker
nikolatesla20
03-14-2003, 06:57 PM
Well, unfortuately for me, it rebooted my system - guess I didn't have SI hid well enough? oh well.

-nt20
SpeKKeL
03-15-2003, 10:24 AM
Ajo,

I tried allso xprotector, seems it doesn,t allow to set any kind of bpx's or bpm's.Try to trace one instruction and the prog. crashes like hell.(anti tracing).I could bypass the debugger check but fails on the crackers toolz detection..........
Wonder how i could bypass that anti-tracing stuff??

SpeKK.
Kayaker
03-15-2003, 02:47 PM
You have to be careful as well if you crash messing around with this because the vxd can stay loaded and your INT 1&3 IDT addresses will stay corrupted, requiring a manual fix or a reboot. The hidden driver trick is used in a packed file as well, at least in Win98.

There's only 1 section of code pointed to by the Control proc jump table addresses which does anything other than return immediately. It appears to only pass an address pointer back through the DIOCParams structure to 2 dwords indicating the IDT entries for INT 1&3. There's no indication of *how* it gets those addresses, but some of those earlier SIDT commands may actually do something.

Just for the hell of it, here's the vxd code

:vxd xprot
VxD Name Address Length Seg ID DDB Control
-------- Dynamically Loaded VxDs -----
XPROTVXD CEC101C0 001820 0001 0000 CEC101C0 CEC11980

:u cec11980

(Vxd Control entry proc)
0028:CEC11980 SUB EAX,1B
0028:CEC11983 CMP EAX,09
0028:CEC11986 JAE CEC1198F
0028:CEC11988 JMP [EAX*4+CEC11991] ; jump table, eax=09h is valid
0028:CEC1198F CLC
0028:CEC11990 RET
...

ESI = pointer to DIOCParams struct
0028:CEC119BB CMP DWORD PTR [ESI+0C],00 ; check dwIoControlCode
0028:CEC119BF JNZ CEC119C5
0028:CEC119C1 XOR EAX,EAX
0028:CEC119C3 JMP CEC119DF
0028:CEC119C5 CMP DWORD PTR [ESI+0C],01
0028:CEC119C9 JNZ CEC119DF
0028:CEC119CB LEA EAX,[CEC10210] ; return INT 1/3 pointer
0028:CEC119D1 MOV EDI,[ESI+18] ; to ring3 via lpvOutBuffer
0028:CEC119D4 MOV [EDI],EAX
0028:CEC119D6 MOV DWORD PTR [ESI+20],00000004 ; lpcbBytesReturned
0028:CEC119DD XOR EAX,EAX
0028:CEC119DF RET

The list of tricks employed in this PE-PROTECTOR enhancement is impressive, and even the help file is worth a look. The bottom line in a practical sense though is - like was said, a 3Kb exe file exploded to 1,123Kb with a minimum of options selected. That kind of says it all..

Kayaker
dELTA
03-15-2003, 05:55 PM
In any case, it seems like the guys who created it had quite a fun time doing it. Damn, they put some serious work into this one. ;)
tE!
03-17-2003, 05:08 PM
Seems they had loads of fun inventing their pricing, too. EUR 800 for "Company License". Good Joke :) Well, at least the logo is neat :D
crUsAdEr
03-17-2003, 09:37 PM
remind me of PE-Protector :)... after i unpacked it, Windows 98 was unusable with most drivers corrupted... such bad coding practise ..:mad: ... the thing was tt PE-protector was a collection of anti-debug, anti tracing and anti-dumping found on the web put together plus the multiple thread/process of armadillo... and banally repeated a zillion times... no fun learning new tricks... the specs of XProtect looks almost same as PE protector except that tricks are repeated TWO zillion times instead :/...
evaluator
03-19-2003, 12:46 PM
seems this Rahucha DONT learns here:
Replacing INT1 & INT3 is INCORRECT!!!

Because at least other protectors does test this
handlers...

LEARN or be learned...
Hwoarang
03-19-2003, 03:47 PM
ROFL...nice way to make your application unstable and eat loads of memory+ you have to pay for this shit...geee
separator
03-19-2003, 05:23 PM
Whole Xtreme Protector is very wrong protected. I don't know who first started use change IDT and other important structures. Every normal person can recognize it isn't right. It isn't right if some applications call Ring0 in wrong way. Then is whole system unstable and random crash and if someone try run two applications protected with different stupid protectors then crash and nobody will help it.

Thier idea of SMC code is good, but it isn't new. They lie, they are not first! Who will first use full metamorphism in his protector he will be first. But it isn't easy and we will wait some time for this protector. They stolen many of code from other protectors, some coded alone, but this code is not important. Nothing new? Yes, I never seen before protector which protect 11kb application and after protection files has 1.2MB. It is crazy and if they are think it will be help against debugging they are crazy too. It isn't problem skip all no important parts and debugg only important. If they are thinking debugging is not possible, then is possible emulate their code with code emulator and their stupid protector will never find it. I don't need soft-ice or icedump find what protector does.

I don't know if they are tried run protected application at slow computers, but it must take maybe minutes.

I tested some applications and their brand new thread system "little" slow down them. If protection spoil functionality of application then it isn't good protection.

Last stupid thing about this protector is price. I don't know but many better protectors cost less and I don't know if someone will pay many for protector which does these crazy things. But who know? Maybe someone will pay them :)

I am sorry for long post, but I hate stupidity and Xtreme Protector is pretty stupid application.

Btw: I am sorry for my horrible english :)
gorge
03-19-2003, 07:40 PM
I tried it on my Portable, 133 Mhz with 48MB RAM. I have two other protectors on my portable that perform rather well considering my slow computer.

I took a Delphi app with one form and nothing else, it is 286K after compiled. It took nearly 10 minutes for X-Protector to protect the application LOL.... I nearly fell asleep. The application swelled to over 1 MB eekkkkkk. After protection my computer crashed (win 98) so I rebooted. It took 10 seconds for the protected app to boot. My OS is now unstable for some strange reason aughhhhhhhhhhhhhhh.

X-Protector is on Download.com at $212.00 U.S. Are these guys insane?????
Gaia
03-20-2003, 04:42 AM
Evaluator, I think IDT (Int1-3) is restored at OEP, because after XProtector I execute SVKP (that executes Int1 trick on Win2K) and works fine

Gaia

cracking VBOLock...
Gaia
03-20-2003, 10:46 AM
New version of xtreme...

Gaia

- =(SoftIce is my best friend)= -
separator
03-20-2003, 06:56 PM
to Gaia:
Did you try to run SVKP and X-treme shit in same time? I think it will not work. If yes, then they after thier int procedure call real int procedure. But I think, it will not work because they are not that smart :)

As I wrote in other place in this forum. I had big problem with thier driver. It crash sometimes (not sometimes, but always :) ) my Outlook.

I started work on this shit and it is possible debug it with my Sice on Win2k. I will post some information very soon. Maybe I will post log from emulator where will be possible find what protector does.
evaluator
03-21-2003, 01:10 AM
DeaR GAIA!
1, While XPROTECTOR1.02 is running on my XP, INT1 & INT3 are set to FFFFFFFFh.
bug??????

2. you mean, in newest version this removed?
Ok, I will see..
evaluator
03-21-2003, 01:44 AM
just checked 1.03 version..
all is same. While it is running, INT1 & INT3 are set to FFFFFFFFh.

enjoe!?

I attached XP's partial IDT. {DOCUMENT}
Gaia
03-21-2003, 03:32 AM
Is your IDT dumped after OEP? Strange because I try to execute Win32Debug (Iczelion examples) and it works :confused:

Gaia
rahucha
03-21-2003, 05:33 AM
Hello,

Sergio and I are the programmers of Xtreme-Protector. It's hard to see how old friends of us criticize our hard work and don't want to help us at all. I know that most of the crackers are very strict with their comments towards software protections (well, I was the same when i was younger ;)), that's not a problem and I accept all your comments with respect. What it's really amazing for me is that you are not willing to help us even a bit. Instead of just saying "Xprotector is shit cos my program crashes....." you could send us your program and we'll work hard and fast to make your program compatible with Xprotector. We'd like to have much money and have plenty of computers and many programs to test Xprotector, but that's not our case and we need the support of friends to help us. When you see that Xprotector works with your programs and you think that our protection is weak or crap anyway, then you could post here how bad Xprotector is as a software protector, and criticize Xprotector as an experienced cracker that has studied the protection itselft.

This new technology might seem quite incompatible (IDT modification, drivers...) but we have been working almost a year to make this technology fully compatible with all programs and processors. Yes, you could try to run Xprotected programs and other programs that make INT1/3 tricks, all of this will work with no crashes.

Separator, I'm willing to hear from you and solve your problems with your crash and outlook. We have released this because after hundreds of tests we didn't report any bugs. Of course, our tests don't cover all kind of programs and configurations, but with the help of all of you, Xprotector can be fully compatible. We have done the automatic bug report to make even easier for YOU to send the information about your crash....but nobody seems to use that.

Xprotected programs might seem very big, slow, etc....Well, we were not planning to do a protector for Pentium 1 computers because computers are changing and we think that protections should change too.

Please, if you want to help us, send us an email with the program that you see the bug and your Windows platform. If you don't want to help us and want to continue critizing about how incompatible/bad/crap Xprotector is, that's fine too.

Thanks a lot for testing Xprotector,
Rafael
Kayaker
03-21-2003, 09:50 AM
Originally posted by rahucha

Please, if you want to help us, send us an email with the program that you see the bug and your Windows platform. If you don't want to help us and want to continue critizing about how incompatible/bad/crap Xprotector is, that's fine too.

Thanks a lot for testing Xprotector,
Rafael

Seems a reasonable request. Good Luck.

Regards,
Kayaker
nikolatesla20
03-21-2003, 10:12 AM
I didn't start this thread to criticize the product itself, I started it because I don't agree with the option to "reboot windows". I think even if the software is being cracked, that is NEVER a polite thing for a commercial product to do. I would be more like something a virii would do. Frankly, if a company had this type of protection which can do such a thing, there would be many that would definitely not buy it. Also, if the product is so uncrackable, that what would such an option be useful for? It only "protects" itself by crashing the system. Once again, that is not protection, it is comparable to a virus in that it could damage the system. Rule one of any protector should still be "do no harm". What if someone installed a debugger on a critical machine and they did not know there was a program that used XProtector on the machine already? What if this was a machine used for medical purposes? It is slipperly ground to be playing in this way.

The other argument I put forward is that messing with ring0 is definitely more powerful. However, without intimate knowledge of the operating system, you can never guarantee any type of real stablility. Here is the crux: Crackers like to play with ring0 because they can gain more power. But their "adjustments" are local to their machine. A commercial product that plays with system structures should be a little more scrutinized.

Unless of course, you pass your protection driver through Microsoft's Compatability labs and get it certified.

-nt20
bart
03-21-2003, 11:13 AM
well ive got Athlon 1800 XP, 256MB ram and your message box "intro" is started ~10s after i double click on it :), should i buy Pentium 5 ;) ?, another thing, nice compression ratio 1:1000 :P, and finally it doesnt work on my Win98 box without all kinds of debuggers/tools (ive send you example, but i didnt receive fixed version of protected exe to test it), but anyway good luck with it.
gorge
03-21-2003, 11:22 AM
I protected a program in Delphi 4 using X-Protector. I left Delphi 4 running in the background. When I executed the protected program Delphi 4 generated an error which I could not shutdown.
I had to turn the power off, this is not good. :o could be the debugger in Delphi that triggered X-Protector??

Also, X-Protector does not work in Virtual PC or VMware.
Lots of users use these enviroments especially companies.
I use them for testing the different platforms for my software.
I would not buy a product that did not run in these enviroments.

Lots of users still have machines between 300-850 Mhz
and this protector is too slow for these older machines.

rebooting or freezing the system if a Debugger is active is serious stuff.

I would bring the price down to under $100.00 and get customers using your protector until it is stable then increase the price.

;)
rahucha
03-21-2003, 12:14 PM
nikolatesla20:

I agree with you about that option and understand why you started this thread. Reboot your system is a very strict way to finish your program in case that a debugger is found. I would never protect my software with that option. We just wanted to give some freedom to the end user and it is his/her responsability of using that option and the damage that they could cause (If you have a look to the Xprotector help file, you can see that we make a clear advise about this)

bart:

We have tested Xprotector in 450Mhz and 2Ghz processors mainly. Amazingly, there is not much difference between this two processors when running a protected program (at least that you inserted hundreds of decryptors, specially drx decryptors).It surprises me a lot that it's so slow in your 1800Mhz. Have you put a patch in a critical part of your program? We have fixed all the problems with all the EXEs that people have sent us, Im really sorry but Im afraid that we didn't get yours. If you could send it again, that would be perfect.

gorge:

Thanks for telling us that bug. We are going to try to reproduce the same bug and fix it.

Xprotector doesn't run on VMware. I tried it long time ago and I realised that every program that modifies the IDT cannot be executed under VMWare. Then, I tested other protectors and most of them didn't work either. I wrote an email to VMware Inc. long time ago telling them this. I didn't get any replies back. Is it our fault that we cannot run under VMware or is it VMware the one that should support this?

About the price...Many shareware authors have told us that the money is OK for a good software protector. If you think that a good software protector could increase your sales (selling ONLY 5 more copies) you could get your money back. Isn't that a good investment?

Thanks again for all your support,
Rafael
nikolatesla20
03-21-2003, 12:20 PM
rahucha:

I just wanted to tell you I appreciate your reasonable responses. It would be easy for some developers to get upset and start a flame as a rebuttal. Thanks for keeping this peaceful :)

-nt20
evaluator
03-22-2003, 12:55 AM
Hello, again.

IDT dump I made after XPROTECTOR.EXE starts & appears its window.
So that is...INT1 & INT3 are killed.

But! Very can be, Rahucha does this only for XPROTECTOR.EXE
& for protected program INTs will restored!?
OR this is BUG for XP?

What is your answer, Rahucha?

PS.
Statistic:
On my PIII600CEL:
1. XPROTECTOR.EXEv1.02 window appears in 4sec
2. XPROTECTOR.EXEv1.03 window appears in 2.5sec
cyberheg
03-22-2003, 09:51 AM
Why are you guys helping him? In my opinion he doesn't deserve that since he just takes advantage of getting free beta testing time. If I wanted to give away bug reports of this kind at a technical level I'd be sure I got paid for my time too. If he really means that he's thankful for this kinda help I think he should go share the incomming money with you or just pay you freelance per hours spent.

But the truth is he cares shit about you as any other protection developer does. Thats why I care shit about them too.
After all as a developer of this kind he must see you as the enemy since thats what his product is about. Thats why the more talk he can get out of you of what weaknesses and bugs you find the more he is able to improve it to make it harder for you. Is that what you want?
Earlier in this thread most of you guys said this program was kinda useless protectionwise so why are you helping him improving it?

I could go give suggestions how to improve X-Protector too but until someone pays me I'll keep my mouth shut.

// CyberHeg
gorge
03-22-2003, 10:19 AM
Originally posted by cyberheg
Why are you guys helping him? In my opinion he doesn't deserve that since he just takes advantage of getting free beta testing time. If I wanted to give away bug reports of this kind at a technical level I'd be sure I got paid for my time too. If he really means that he's thankful for this kinda help I think he should go share the incomming money with you or just pay you freelance per hours spent.

But the truth is he cares shit about you as any other protection developer does. Thats why I care shit about them too.
After all as a developer of this kind he must see you as the enemy since thats what his product is about. Thats why the more talk he can get out of you of what weaknesses and bugs you find the more he is able to improve it to make it harder for you. Is that what you want?
Earlier in this thread most of you guys said this program was kinda useless protectionwise so why are you helping him improving it?

I could go give suggestions how to improve X-Protector too but until someone pays me I'll keep my mouth shut.

// CyberHeg

I care about you CyberHeg :D
crUsAdEr
03-23-2003, 07:09 AM
Yeah,

As i recall Ni2... you didnt want to help me at all last time... after i posted my finding abt PE-Protector you simply disappear... so why should we crackers/reversers help u now? You did not want to help others, tell me a good reason why i should do otherwise?
gorge
03-23-2003, 11:09 AM
I got a Blue screen and half my messages in OutLook Express Disappeared when I was testing X-Protector. I removed this crap from my system as it is very unreliable. Testing is over. It is not compatible with a lot of regular software. :o
rahucha
03-24-2003, 06:33 AM
Hello,

evaluator:

The state of the IDT for XPROTECTOR.EXE and protected programs are the same. It's not a bug what you see in your XP (should be the same in all Windows platforms). All your programs should work fine. Even at the same time with packers with INT1-3 tricks.

Thanks for your time stats for Xprotector. We are going to study if we can make it faster in a next version.

cyberheg:

None of you are my enemies but all the way around. In fact, many things that I know I learnt them when I was much younger with the help of people from the scene and I also shared my knowledge with the rest of you. I will never forget the help that many of you gave me.

About the "free" tests...I'm just like one of you and not a company with money. Sergio and I just decided to make something difference sacrifrycing many things during the time that we've been programming xprotector, because we believed in that. We have the same money as a "normal" cracker has and we have done everything by ourselves and with the help of friends (tests, english corrections...). We just can give big thanks to all of them and offer our help whenever they need it. Ask for help is our only way to get out of this. And one thing....Windows XP also makes the automatic bug report when your system crashes....and they don't pay us for that.

Anyway, I didn't enter in this forum to ask for help. I just got impressed about how some people that don't have idea about our protection can say that it's crap because it crashes (a BSOD can be fixed in a few minutes) or we have a shitty protector because if you put SKVP it WOULD crashes because the IDT is "destroyed" (when they DON'T even tested that!) and instead of test it, It's faster for them to write a post here ard say that we are not so clever to do that, xprot shit....I didn't want you to make tests so we sell more copies or something like that, I wanted that xprotector will work on your computer so you can make REAL comments about the protection itself.

crusader:

I remember that I tryied help you in a few bits in Pe-Protector. I didn't enter much here as I only had inet at work (not very nice to enter here from your work ;)) Besides, following the rules of this protection/cracking game....crackers must discover how things work internally without the protection author tell them....at least that was one of the rules long time ago ;)

gorge:

I'm really sorry for your BSOD. We'd like to have many computers so we are the only ones that get those nasty BSOD. Thanks a lot for trying Xprotector and sorry again if you lost some data. I understand that you don't want to test it again.

Best regards,
Rafael
Kilby
03-24-2003, 09:20 AM
Grrr I lost the message that I had typed in :(

Anyway,

All I wantto say is that I am too busy to take new things apart these days.

However, I have watched the wrapper wars for years, and protection by bordom simply dosn't work, layer upon layer of the same old crap dosn't cut it.

SMC & the like dosn't work (honeltly remember when the 486 was introduced), and bloated/slow apps just annoys everybody and creates a reason for cracking the app, this reason is "TO TRY AND MAKE IT RUN PROPERLY."

Those reversers who don't like any info going to protectors and commercial coders avert your eyes now !

Wrappers don't work for very long !

Shareware authors need to learn to code !

Currently they draw their little boxes in VB & Delphi (some even venture into VC), and type in their couple of hundred lines of code and hit F7, then they call themselves programmers.

The app automagically (sic) appears and they don't know what's going on under the covers.

In Borland & M$ we trust ;)

Asprotected apps are often cracked, why is that ?

Simple they compile their app, run asprotect, upload to their website then watch the cracked version of their app appear across the internet.

I'm sure Alexy gets a lot of complaints, but how much more can he do ?

However (as I remember with my very bad memory) asprotect does allow additional protection, for functions to be decrypted only if a valid serial number is present, but how often that ability used ?

When is the last time you saw an asprotect license generated, a very long time ago is when.

Even games companys have caught onto this and securom provides triggers that games authors (much more knowledgeable than shareware authors usually) can set up triggers that cause problems with unwrapped games.

So how do you protect an app from me ?

Easy create it in VB, and I will simply refuse to install it. I am tired of VB installs screwing up my machine. This is the real future of protection ;)

So what would I do to protect an app ?

I have written a dumper for a certain well known wrapper (very commercial) and wish to give it to some friends, however I do not wish for it to spread (I don't want any (more) real trouble turning up at my door.)

So what can I do well I need somehing that provides encryption, secure keys, locking to particular machines and date or # of run limitation.

After looking at many packages the only one that seems to provide some reasionable security,reliability & stability is asprotect.

Unfortunitely apart from not having any money I don't wish to buy an cryptor for the sake of the 9 ot 10 people who I wish to have the unwrapper. I also wish Alexy well as he also bears us no ill will (as people like us generate his income,) so I will not be ripping off asprotect.

Though if he wants to give me a copy I would be be very happy.

Regards,

Kilby...
tE!
03-24-2003, 01:23 PM
'elo! i agree to kilby by like 100%. it's not so hard to create a good individual protection for a piece of software in a reasonable time. of course this requires a bit more knowledge than many semi- or non-professional developers have. probably this isn't even a formal question of qualification but of interest and commitment. on the other hand i understand some programmers very well. programming a useful and stable software can take much time and many programmers simply don't be inclined to spend many hours of work in the development of a good protection, because the only reasons which make such protections necessary are crackers like us and insincere users.

ni2 and his friend showed us the result of their hard work. no doubt they put a lot of work in that protector, but that's no real reason for their pricing model. sooner or later they will probably spend 10 minutes of hard work into a marketing lesson and correct their pricing :)

rahucha: I didn't want you to make tests so we sell more copies or something like that, I wanted that xprotector will work on your computer so you can make REAL comments about the protection itself.

who believes this ? you released the protector as commercial software, thus you want to earn money with it. people on this board are for sure the best testers for your software you can get for free. they have more knowledge than most of your current/future software developers (at least concerning software protections - i'm sure). but why the hell should they help you ? friendship ? that's a dubious excuse for imposing other peoples kindness (always remembering your commercial interest). i'm sure it would be a different story if you'd have released that protector as freeware.

i can't say anything about the quality of the protection xtreme protector offers, because i didn't even try to have a look at its protection components. my personal opinion (as simple user) is that i don't like it because of the huge size increasements and the startup-delay of protected applications. if you won't spend much work on it again to get rid of these disadvantages and the compatibility issues i can read about on this board, i doubt about a promising future of xtreme protector.

anyway, at least you are not only talking but try to invent something new. hats off for that. greets to you and all the other guys hanging around here ;)

tE!
goatass
03-24-2003, 04:07 PM
Hey guys I don't think we need to bust on x-protector, it has its advantages and disadvantages just like any other protector out there. I'm glad finally someone came out with a protector that does a little more than mess around with the imports. This x-protector is their first attempt at it, I'm sure it will evolve into something worth while. The reason for their first release is to get reactions just like they are getting now so they can improve. I understand people don't want to help because they are not getting paid to do so and that's fine but busting on the product when it's in its early stages doesn't do anyone any justice.

I think x-protector has some good ideas just have to be implemented differently. The main reason why so many protections out there don't do so much is because the end user will not talorate the application's behavior. There are sacrifices that developers make like whether you want to satisfy the end user and make money or protect the app to death so no one can steal it but sell very little copies. This is something that x-protector guys need to think about.

I personally think that if x-protector is kept up it could be a great product, just need to see what the market is looking for. Don't secure Fort Knox to a point where you can't get access to your own gold.

goatass
Kilby
03-25-2003, 04:50 AM
I'm not coming down against Xtreme protector it's good to see people trying, it's harder to create than destroy.

Xtreme isn't snake oil, butI feel that they are on the wrong track when the app bloats.

Once you suss out what a packer does, it becomes relatively easy to unpack.

Without the author working to the strengths of a packer/cryptor the battle is already lost.

There will always be a way in that the cryptor author hasn't thought of, the easy crack. If not the packer then the algo used for the registration keys.

The future is to provide an API to the apps author and to get him/her to use it. It dosn't matter how good an reverser you are if the code isn't ever decrypted, unless a valid key is present (and then you can fingerprint for the key used).

I wish Ni2 & friend all the success the success they can get but I do urge an rethink of their methods. If an product gets an reputation for problems (even on inital release) then it will be avoided.

Regards,

Kilby...
cyberheg
03-25-2003, 06:10 AM
Originally posted by Kilby

Xtreme isn't snake oil, butI feel that they are on the wrong track when the app bloats.

You're wrong. This is exactly a example of snake oil in terms of protection. If these guys opened the source code to the public would it have same strength? Doubtfully.

The whole idea about protections like these is that people don't know how it works and/or because of the zillion checks like crusader pointed out it gets too boring to trace through it.
But if you look at the components of this protection it doesn't change in any way from Asprotect, Armadillo etc. etc. You still got the same scenario. First you got a loader which decrypts the real program then you got a jump from this loader to the real program. Whether you like it or not protections of this kind only works until people find a way to emulate the environment so the loader thinks it's not beeing spy'ed on.
There are technologies here though which makes this system stronger then others like automatic patching of the unencrypted programs.

// CyberHeg
nikolatesla20
03-25-2003, 07:13 AM
Exaclty.

The only true protection a shareware author could make is either a demo, in which the full software code IS NOT PRESENT, or to follow the instructions corrrectly (for instance, with asprotect), and use encrypted sections of code that don't get decrypted unless you have a code.

However, as Splaj mentioned before, one key can be used in aspr to force it to work as a keygen.

There will always be SOME way around, if a cracker is determined enough.

-nt20
LowF
03-25-2003, 09:21 AM
Hmm seems to load fine on my comp, took about same time as asprotect to load!

got 700 P3 , 384 ram and XP Pro!

maybe guys should try to unload som shit , i don't have softice or anti debugger stuff on same time, turned of most background progs, still np....

and i know after this topic i get about 50 crap msg...about how much idiot i am ;))
Kilby
03-25-2003, 11:04 AM
Cyberheg,

I disagree with Xtremem falling into the category of Snake Oil, for me this is reserved for special items which don't do anything vaguely like what they claim (bi-tarts products come to mind about this).

Xtreme Protector simply dosn't do things the way that we would choose to do it. If it stops a crack due to bordom then it has done it's job (not very classy but technically a success).

nikolatesla

If alexy didn't carry about the blacklisted serials then things would be a bit harder :)

But either demos with 'missing code' not disabled buttons, or properly encrypted registered functions are the only practical way to go.

LowF

If I wanted application conflicts then I would buy an Apple Mac

However I don't want application conflicts.

We are in a multitasking, multi threading environment and it should be coped with properly.

May god help their customers tech support departments, I'm sorry sir you must remove these apps before our product will run :(

Example:

I run softice legally in work and at home, and I reserve the right to have whatever programs or hardware I own !

Having softice installed won't crack an app, try finding a key for Secure CRT using softice, it's not a magical path to free apps.

Sometimes the presence of softice is a sign that you are installed on a developers machine and I often work from home so as I can see my kids sometimes.

Therefore if a cryptor is secure it should be able to tolerate the presence of a debugger (I have yet to see an eula which says you are not allowed a debugger on your machine).

Note:

I will run one of my little apps across xtreme protecter to see what happens abd post it here, provided my ADSL connectivity has returned.

Anyway regards,

Kilby...
crUsAdEr
03-25-2003, 10:06 PM
Killby,

I disagree with Xtremem falling into the category of Snake Oil, for me this is reserved for special items which don't do anything vaguely like what they claim (bi-tarts products come to mind about this).

Xtreme Protector simply dosn't do things the way that we would choose to do it. If it stops a crack due to bordom then it has done it's job (not very classy but technically a success).

I beg to differ... you could say things like that about Bi-tart because you have done much work with it... i have done little work with Bi-Tart, a bit here and there but never a full research though i have done a fairly thourough job with PE-Protect and all i could say is, the task of reversing PE-Protector is like looking at the code, clean junks, then search through code archives on the web for old and known tricks... I still have the comprehensive listing of most of PE-Protector features i found in the packed version of PE-Protector itself and looking at the comparison to XProtector, not much has changed... though i admited i only had a brief look at the old version of XProtect

I would say PE-Protector was more like a complete collection of anti-stuff found on the web, and if XProtector is the same, it would be stealing/packaging the free knowledge shared by this community and charge an exorbitant amount of money for it... the reason is that i found some code in PE-Protector which was an exact copIES of example code someone else posted for free in this community... which is NOT very nice...

though snake oil is a strong word, it is SNAKE OIL comparing to other product of that price range... imagine it is more expensive than IDA :)... in fact a few times more... what a laugh...
evaluator
03-26-2003, 02:07 AM
Hello, Rahucha!

1.
You are RIGHT!
In tricki way you rehandle INT01 & INT3.
I tested this R3 protectors:
.telock
.pcguard4.06
.pelock1.05

2.
I know way(R3), when your driver can't handle INT01 & does BSOD.

3.
&&&&&&&& ANYWAY!!
Doing this with INT01 & INT3 is incorrect.

Many other protectors (unknown for us, or in future..)
just checks in IDT location of INT01 & INT3 handlers,
if they are in NTOSKRNL range etc. (SVKP1.051 I know).

So I recommend: use INT01 & INT3 handlers, BUT
restore immediatelly after use.
Kilby
03-26-2003, 04:11 AM
Crusader,

I think you hit the nail on the head in the last sentance, snake oil is too strong a term for xtreme protector, but it's not a product that I would wish to rely on, even if it was $10.

The only reason I mentioned crunch2 is that it did NONE of what it claimed (it was the first thing I ever unpacked after 5 hours of study), with my limited ability that is a poor proformance on the part of the protector.

I mention this nodue to false modesty but due to the fact that a little zen, lateral thinking and a refulal to be beaten are the reasons I beat targets, and not great technical abilitys like many here.

I only spent a few minutes with xtreme and don't really feel that I have a right to comment on the technical ability behind it, and the same with svkp which I think may be a similar item with waves of the same old code thrown at the reverser.

BTW I have to congratulate you on your recent essays they are excellent .

Regards,

Kilby...
nikolatesla20
08-26-2003, 02:50 PM
Originally posted by rahucha
nikolatesla20:

I agree with you about that option and understand why you started this thread. Reboot your system is a very strict way to finish your program in case that a debugger is found. I would never protect my software with that option. We just wanted to give some freedom to the end user and it is his/her responsability of using that option and the damage that they could cause (If you have a look to the Xprotector help file, you can see that we make a clear advise about this)

Thanks again for all your support,
Rafael

If that's the case then why does Xtreme protector itself reboot my machine which has DS2.7 installed.

-nt20
bart
08-26-2003, 03:12 PM
Well maybe it thinks your PC need to rest for some time?

I think real software developers who use all kinds of debuggers rtc. to make software fucking luv all those protectors with anti tricks :)
squidge
08-26-2003, 05:46 PM
It starts becoming fun when a developer is told to evaluate a protector on the latest development build of a project, only to find out is blindingly resets his machine without warning just because he has developer tools installed, such as Softice.

If I was the developer the above happend to, I certainly wouldn't be recommending the application, that's for sure. There should at least be a warning of this when the program is being installed, so it can be uninstalled again without running it.
Kilby
08-27-2003, 09:55 AM
I had forgotten about this thread.

I think we all agree that we wouldn't pay $149 for somthing that causes instability and bloats apps as much as this currently does.

Snake Oil = matter of opinion.

Anyway just to say regarding the detection of softice in packers.

The game Chaser (by Jo Wood) which I bought is a securom app which then appears to be packed with the SVKP.

Why mention this well it detects NTICE even when the debugger service isn't actually started, to play/install the damn game I have to actually uninstall softice.

Personally I find that very intrusive, it's also very hard to get a refund on a PC game.

As I have a legit sice I really should complain to Jo Wood as I don't thinks it's their place to say what can be installed on my machine, unless it's directly attacking one of their products.

Regards,

Kilby...
nikolatesla20
08-27-2003, 10:42 AM
I agree , exactly. I think is B. S. when they detect just that you have it installed. Like I've said before, this ISNT PROTECTION. A true protection can stand up to being debugged, right? I don't consider it a protection when you simply don't allow any debugger to exist.

Also, I agree, they have no right to decide what's installed on my machine.

-nt20
evlncrn8
08-27-2003, 11:12 AM
just when you mentioned chaser there, it is one of the most protected games i know, not only svkp, it had securom and armadillo.. jowood are paranoid.. and yet the game was cracked so all their efforts were kind of pointless, which further reinforces the futility of these protection products
Kilby
08-27-2003, 03:35 PM
No wonder theres so many complaints about the game crashing, with all those in there ;)

Previously I had thought that Jo Wood where just crap at their quauality testing, and now I find it's deliberate :)

Speaking of such things apparently the coders of starforce 3 have decided that nobody should have both SCSI & IDE cdroms in their PCs.

Yeah like I'm gonna disable any of my hardware or software for some damn game.

Kilby...
squidge
08-27-2003, 04:49 PM
I used to a have a SCSI cdrom in my system until it packed up and waved byebye, now I just stick to ide as they are pretty much the same. Only SCSI in here now is harddisks.

Personally though, I hate this "generalization" protectors are starting to use. "Most people will not have scsi cdroms, so we will not work on those that do", "Most people will not have softice, so we'll crash those systems that do", etc, etc. It's all about working on the majority now and stuff the rest of the people. Soon it'll be if you've not got a standard spec major brand PC system, then appX will not work as your obviously a hacker or pirate of some sort.
nikolatesla20
08-29-2003, 02:35 PM
Webpage:

hxxp://www.wiretapped.net/~fyre/sst.html

Service Hooking
Intercepting ("hooking") calls to executive services is a matter of locating the information about the service and modifying it to call our own functions, which could then transfer control back to the original handler.

The only thing left to discover is the service ID of the services we want to intercept. Disassembly of the real handler functions shows that each one begins like this:

MOV EAX, service_id

So the data stored at the beginning of each handler function is B8 xx xx xx xx. B8 is the i386 MOV EAX, imm32 opcode, xx xx xx xx is the 32-bit service ID. An expression such as the following is sufficient to get the service ID:

ulService = *(PULONG)((PUCHAR)pbHandler + 1);

Windows XP
In order to discourage people from using these undocumented interfaces, Microsoft attempted to write-protect the service tables in Windows XP. Writing to them causes a blue screen of death, unless the pages are somehow made writeable first.

The simplest method is to disable the WP bit in the i386's CR0 register before modifying the table. For example:

MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
; modify table
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX

Another method is to modify the PTE's for the pages that the service table resides in so that the supervisor (executive/kernel) may write to them.

Limitations
Because the methods used rely on undocumented kernel interfaces, they are liable to stop working on more recent versions of Windows. Microsoft has shown that they dislike the use of these interfaces by making most existing code using them fail to work correctly on Windows XP, and are likely to do it again.

However, there are no suitable alternatives to these techniques.

Once again, unless your driver becomes Microsoft Certified I think you should at least inform users that there is inherent dangers in using it. And what about user's customers?

-nt20
separator
09-02-2003, 03:29 PM
Hello,
I checked Chaser some time ago. Joowood are really paranoid, because they used more protections in same time.
I am using Soft-Ice and installer detected it too when I disabled it. It wasn't SVKP, but Armadillo! I can't install game because stupid detection of two CD-Roms. It wasn't problem with patch.

Joowood used SVKP to main exe and enveloped with it SecuRom. Main exe worked fine.

Btw: Did someone unpack main XProtector's EXE?
evaluator
09-04-2003, 11:40 AM
>>Btw: Did someone unpack main XProtector's EXE?

you mean protector himself? or in that game is..
separator
09-05-2003, 03:18 PM
to evaluator: Yes, I am talking about protector himself.
Shoob
09-05-2003, 04:28 PM
Simple answer: No - and it will took the reverser some time. Btw and im not think to go on, on this target cause it can destroy your machine nicely.
evaluator
09-06-2003, 01:42 PM
It is pleasant to hear, people still keep common sense,
but whether for a long time?
I have thought that cd-game was protected by it..

as about unpucking,
I little played with xprot without debuger & unpucked it until "last" step;
(e.g. stripped code peaces)
maybe If I somehow shall get second-hand HDD, i will continue this useless playing..
disavowed
09-23-2003, 08:36 AM
Originally posted by evaluator
(e.g. stripped code peaces)
evaluator, i thought you used a translator to post here. how the hell did it give you "peaces" instead of "pieces"? :)
LaBBa
09-23-2003, 03:23 PM
hi ppl !

it's been a while since i post .. and now i saw this ... i looked a lil and this technic of coding is looking very known to me ..

^D^ man did u done that :D ??
dELTA
09-23-2003, 04:10 PM
Disavowed, if you thought that eval is using a translator you really can't have been paying much attention to his posts. ;) The closest thing to a translator that might possibly have been used to generate that is a PRNG. :D
crusher
10-28-2003, 06:26 AM
Just some notes.

First of all, this protector is not a so-much fun.
I participate in a kind of business where lots of software authors are using Xprotector, just as "security by obscurity" principle.
I already managed to dump several executables protected by it, but only partially (yes, missing the well-known IAT :))
Sorry saying this, but I have some interests in being able to dump these, so I won't help you Sergio&Rafael out with the method (unless you give the clue restoring IAT for *current* versions :))
You might say it is not fair, although this is the point when our interests are the opposite.
(Others are welcome for subject, thou' :))
After all, I need to express my personal problems with this.

- Yes, you give the freedom to users to choose "RESET WINDOWS" option in general. This would be a fair offer if and only if our world were homogene (people with different skills equally filling up the population). BUT since this is NOT the case, and 88% out of software authors are IDIOTS, who still believe this intellectual property shit, but won't even like to ever make a *PERFECT SOLUTION* (ytes, we came to the difference between theory and practice, got it?), instead, believing reset for a false alarm is the greatest fun.
I have an application I already dumped, and great for reversing, although I miss some APIs since NO IAT rebuild is done. I tried several (not so much, anyway, for example, let it be 100) times to find it out, although the 243k software (which is now 2.1M) loads on my 3GHz P4 in 8-10 seconds, I try to make an operation, and in less than a sec (let it be 1 s) it reboots my computer, which process lasts say 2 minutes.
That is, in our example:
15 minutes total of program "loading"
1.5 minutes total of experimenting (in 1s fractions, anyway)
3 hours and 20 minutes of computer POST and boot process.
Please, tell me, this had to be the fun??
(any help is welcome)

Yes, if it'd run under VPC or VMWare, I would had only to restart it, it is not a crisis, but it does not.

- My program utilizes (very nice indeed.......) a Schlumberger Cyberflex E-Gate Smart Card protection, which consumes a bit of CPU time, so when I load the app, and it interacts with the JavaCard, sometimes it shuts down the SB subsystem with a message related to no access to PC/SC interface, if not, I should wait for the end of operation for GDI to redraw its form. All this on my mentioned computer (it has 512M DDR533 BTW).
This is remembering me to my old PM experiments, when I tried to save/restore the TSS of my 1 running task for every single instruction (breakpoint yeah).
Just wondered what my CPU was capable to.
Now I see, thanks :)

- Among others, sometimes the app itself resets with no obvious reason.
(I think should first disable this reset thingy)

- After all, I can ONLY close my program with Kill Process option, if not, I get an infinite loop in a thread running on PL0 (i hate your "ring" word) with TP_TIME_CRITICAL...

That's all for now. Any ideas, helps on IAt or any other clear mechanism of this stuff is welcome.
evaluator
10-28-2003, 08:37 AM
>this protector is not a so-much fun.
it is on last level of incorrectness.
Those, who use xprotected-programs,
are under serious risk to crash own hardware.

Recommended:
Try to search for other users of these programs(in forums, groups)
& togather perform simple customer attack:

"Dear sir, we are very interesting in your software.
"But your program in 98% of cases resets our PC.
"As we informed, this happens because of dangerous protector.
"Do not hesitate, and use other correct protector,
"or we shall not buy your software.
"Or! Give us full Warranty for case of hardware crash,
"which will include all commercial loss.

we can support this attack with our opinion.

>where lots of software authors are using Xprotector
Can't beleave if lot of authors lost money in xprot!
(maybe, mostly they was "protected for free"!?)
Anyway, point me to this "software area".(here or in PM)

later about IAT.
Pyrae
10-29-2003, 07:23 AM
Did anyone actually take a look at XProtector's KMD
(until that one takes over, there seems to be nothing really new)?

I'm always getting caught on some JMP [ESP-0C],
where [ESP-0C] points to current EIP, thus ending in an infinite loop.
Guess this must be some kind of "running line" stuff, but there's no LastBranch record helping me out on my damn P4...:(

I'd really like to get to the rebooting triggers...
Btw, is it the keyboard controller method or some triple faults?

Guess no serious developer/publisher would really use such a hardware kicking protector for retail soft, but it seems like it might be real fun to reverse it...

regards,
Pyrae
evaluator
10-29-2003, 08:22 AM
you must guess that trick,
remember you are in R0, look at stack when trace..

AND this easy trick is incorrectly done!!!
Pyrae
10-29-2003, 06:54 PM
you must guess that trick,
remember you are in R0, look at stack when trace..

AND this easy trick is incorrectly done!!!

Ok, I found out how to quickly bypass it, but must admit, that I still don't really know what makes the difference between single-stepping and letting it run... :o
What is so R0-specific about this one, eval?
And why do you think this trick is incorrect? Because it uses undefined stack space?

Back to the code woods,
Pyrae
Zwyzum
11-02-2003, 11:09 AM
Nothing new? Yes, I never seen before protector which protect 11kb application and after protection files has 1.2MB.

Maybe this is a new trend in protection. I guess it would be difficult to find your 11kb in a 1.2Mb pool. :D

Zwyzum
crusher
11-27-2003, 06:22 PM
nothing new? still stuck with IAT...
Six Black Roses
12-31-2003, 01:08 AM
I always wondered why protectors made themselves obvious by jumping to or calling the program (going to the OEP). I thought it'd be more effective to line the protector code right up against the program code, so there's no jump. I thought it'd be more efective to have some sort of periodical CRC check of memory segments. But the only thing I couldn't figure out is how to automate all that, while still remaining stable.

After I skimmed through the whitepaper thing, I must admit I became a little intimidated. Little did I know that in a minute I'd discover it's a small dog that barks and doesn't bite.

I downloaded the trail, and the first thing I tried was to apply this protector to the standard Notepad.exe that comes with Windows XP. I upped all the settings, including the keygen thing. Well, the keygen failed. So I removed that, and tried again. So about 5-7 minutes later, the final exe was ready. I launch it. And about 15-20 seconds later I see a "This software has been protected with the DEMO version of x-protect... blah, blah, blah". And another 10 seconds later I get the standard Windows XP box that comes up when software crashes.

Now, I don't have debuggers installed (except Olly, which wasn't running), and the only thing I had running was the usual Winamp, Internet Explorer, Norton AntiVirus, etc.

And about those times... they seem too slow. I mean, I know I don't have a top of the line system, but I'd think 1.9 Ghz, 512 DDR ram would launch notepad succesfully sooner than 30 seconds.

I must say that whoever is thinking of charging 200 dollars for this has bitten down on his penis too hard.

Let's talk practice... The only software packages that'd need this sort of protection are better off handing out dongles with the executables actually inside the dongle, decrypted with a serial number and then a check from the internet servers at least 50 times throughout the application, all while still asking for a CD. But then, the CIA doesn't publically release any of their computer things.
JMI
12-31-2003, 01:27 AM
Most of us aren't limber enough to "bite down hard" on our penis, or maybe we just aren't that well endowed. :D

Regards,
dELTA
12-31-2003, 07:35 AM
Please note that these statements by JMI do in no way necessarily represent all members of the admin/mods team. :D
JMI
12-31-2003, 06:03 PM
And here we have dELTA, shamelessly and wishfully discussing his "member' again. :rolleyes: We may need to adopt a "truth in advertising" policy for the Board. :D

Regards,
AzynchriX
01-02-2004, 10:56 PM
Your files will need a diet after that...
D-Jester
01-24-2004, 01:05 AM
Why couldn't you have said that he bit his tongue...honestly...bite the little general...

I don't even joke about that...
GabryJ
02-12-2004, 10:05 AM
X-Protector Unwrapped by Eithel in ExeMp3 2.21
crusher
02-14-2004, 01:35 PM
really? who is Eithel??
and which version of Xprotector? :)
Shoob
02-14-2004, 03:24 PM
really? who is Eithel??
and which version of Xprotector? :)

EXEMp3 = Asprotect

[EDIT]

EiTheL do pack their cracked asprotect file with their leet XProtector nothing more.
l0rtsu
02-18-2004, 05:52 AM
At least one game seems to have been packed with xtreme protector hxxp://www.nforce.nl/nfos/clear_txt.php?id=56710
comunicatel
04-10-2004, 11:31 AM
Any news about this unpacker?
Does anyone succeed in unpacking X-prot protected aplication
evaluator
04-10-2004, 12:42 PM
firstly, does anyone succed to find valuable program protected by it?
once i dld 19 megs, & it was shamelest VB's shamelest program..fif, fif..
Pepone
04-10-2004, 02:55 PM
2evaluator: Try Jazl.rR.dio. Hope it's enough "crypted", JMI for sure around. :D
JMI
04-10-2004, 04:02 PM
Nah. He's probably sleeping and won't notice and probably can't break the clever code anyway. :rolleyes:

Regards,
comunicatel
04-10-2004, 04:58 PM
I see that some people claim to unpack x-prot but I do not see any Ideas here.
I remember the times when people wrote tutorials and shared their ideas. ;)
Pepone
04-10-2004, 07:10 PM
2JMI: LOL, 2 persons inside you ? Don't worry inside me too. :D
JMI
04-10-2004, 08:00 PM
I try never to limit myself to just "two" personalities. :D

Regards,
evaluator
04-11-2004, 01:25 AM
heh!
Jasler was that shamelest prog i dumped..
cRk
04-11-2004, 02:03 PM
Evaluator i remember i asked you gently to dump Jazler.and not to crack it ..not matter it is VB the main idea was only to dump it. but i also remember that i asked you how you did it.. but i never got a response/answer

and that rar file you supplied me with Jazler included (dumped)
.. you wrote me the pass..... but never worked ... maybe you were just jocking? :p

if you want to practice with a delphi one (XPROCTECTED) look for handycafe and tell us how you do it in case of success. i'll private message you the link to download directly...

Regards
JMI
04-11-2004, 03:28 PM
Why would you need to send him the link when any simple search with a search engine would find the download?

Regards,
cRk
04-11-2004, 03:32 PM
Why would you need to send him the link when any simple search with a search engine would find the download?

Regards,

sure! i did because maybe he would say hey.. i'm lazy can't find it :D LOL
evaluator
04-12-2004, 03:34 AM
crk, remember me, what password i sad to you? write here.
But i can remember, i wrote, how i dumped it.
comunicatel
04-18-2004, 06:45 AM
So any news about unpacking or you want to keep your knowledge for youself.
After many tryes I have no idea how to unpack such a target even without IAT restoring


A reverser busy day
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A reverser busy day
PDA

View Full Version : A reverser busy day

Artifex
03-14-2003, 12:04 PM
Hi, everybody.

I worked a program recently written and protected with aspack.
There are five sections called : aspack, aspack, .rsrc, pcompact, pcompact.

No file checker could tell me what version of aspack it is. I would like to know that. Do those names ring a bell ?

I unpacked it manually and arrived at the :
popad
jmp to Entry Point.

in Softice I did the usual :
a
jmp eip

then I dumped it with Lord PE and restore the IAT with Import Rec.
Dump worked as the packed program.

Strings References where very poor (only 3 !). I patched a few places to disable the anti-softice and nasty nagscreens.
----------------------

Then I tried another way :
instead of dumping and IAT rebuilding, I tried to patch the packed prog. After
popad
jmp to Entry Point there was about 200 free bytes.
On the "jmp to Entry Point" line I typed :
a
mov dword ptr [0044????], 90909090
mov word ptr [0044????], 9090
....
....
....
jmp to Entry Point
g

Program worked OK.

I saved the live patch with :
/dump 0047???? c0 patch.bin
and with HexWorkShop I patched the packed program. All worked OK.
-----------------------

Then I tried to assemble the patch with TASM or MASM. And now is the question :-)
When I type in Softice build-in assembler :
mov dword ptr [0044????], 90909090
Softice puts : c7 05 ?? ?? 44 00 90 90 90 90
that line writes an immediate value (90909090) into an immediate memory.
[0044????] doesn't mean "the value stocked into 0044???? memory". It means the memory itself.

When I assemble the same line with TASM or MASM they refuse ("illegal immediate"). To have the same result I must write :
mov eax, 0044????
mov dword ptr [eax], 90909090
which is longer.

Why SoftIce assembler accepts to write directly 90 90 90 90 in dword memory 0044????, and the other assemblers don't ?

TIA
Artifex
Artifex
03-15-2003, 12:03 PM
Answer came from alt.lang.asm

Trying to compile this source with TASM :
MODEL Tiny
.data
.code
.386
org 100h
Start:
mov dword ptr [445120h], 90909090h
END start

throws an "illegal immediat" error

but TASM compiles OK this one :

MODEL Tiny
.data
.code
.386
org 100h
Start:
mov dword ptr [ds:445120h], 90909090h
END start

The debugger assembler doesn't need this ds: mention, he knows where data are.

Artifex
squidge
03-15-2003, 01:15 PM
It's more of a assumption rather than "knowing". In RTA for example, any address like the one you specified is assumed to be referenced to DS unless you tell it otherwise. So it'll happily accept the way you typed it into SoftIce.
Artifex
03-15-2003, 01:36 PM
Hi, Squidge, and many thanks for the information. I begin to understand a little better the situation, and read more about "overriding".
Until know I knew enough asm for my needs, but this problem told me that I need to learn more.

Artifex
Artifex
03-16-2003, 12:36 AM
Hi, again, Squidge.

I tested RTA110.exe
It does exactly what I needed.
I didn't know that you were the author.

Congratulations.

Artifex


HASP services 32h and 6, and MD5?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HASP services 32h and 6, and MD5?
PDA

View Full Version : HASP services 32h and 6, and MD5?

Guybrush
03-15-2003, 11:44 AM
I have a target that's protected with HASP.. it's my first HASP expierence..

after reading a lot of tutorials i'm still not quite sure how it works.

when i start the program i get a nice message box that my hasp dongle is not found.
so i put a bpx on freeenvironmentstringsa and i'm near the haspcode.

strange thing is, first call is not with service 1 or 2.. it calls directly with service 32h and esi=38h which means it it will return a 38h block in eax after the call. ecx will hold an errorcode.

so i manually changed the returned block with some random stuff.. (not sure what to put here yet) and changed ecx to 0 (no error)

after that it will break another time with service 6, which will return the HASPID in ebx and edx. and error in ecx.

and that's all, after that i found out it MD5 sums my HASPID i think.. and checks it, i manually changed the jumps but it still fails :(

so i basically have 2 service calls (32h and 6) and some MD5 check but not sure what to do :(

i think i need to emulate the readblock, so it will be correct with the haspid.. but i havent found where it makes the check...
hack3r2k
03-15-2003, 01:10 PM
Hi !

If program you are talking it's protected with HASP4 the you should forget about cracking it if u don't have the original dongle of the program or if u don't have the new algos for encrypting/decrypting... Anyway for old one this is posible. I attached here the program+soures of my hasp services spy wich i think that u'' find usefull

Also take a look at this link:

http://www.woodmann.net/forum/showthread.php?s=&threadid=3342&highlight=hasp+services+spy

best regards,
.:hack3r2k:.
Guybrush
03-15-2003, 02:36 PM
ok how do i find out if it uses the new algo.. and why will it be impossible?

also the program is enveloped because i cant disassemble it and it has .prot01-prot11 sections..

so i dont think i can use your spy in this case.. :(
squidge
03-15-2003, 04:30 PM
I may be wrong here, but I thought the HASP Enveloped programs actually used the dongle to decrypt parts of the code, so unless you know how to do this manually, it's pretty much impossible.
CrackZ
03-16-2003, 10:28 AM
Hiya,

The section names don't sound as if they are the HASP envelope, since its single section and afaik there is no way to get the envelope program to create any more.

So I'd 'guess' you've got a regular HASP API target using a packer.

Service 32 (ReadBlock).

IN EAX->where returned data will be placed, ESI=block count, EDI=offset of read

OUT EAX->number of words read, ECX=status (0), EDX->EAX

Reading 38h=full 112 bytes, most probably this is a MemoHASP, look for checks (bpr on the returned data or fill it with 0xFFFF as a starting point).

Service 6 (HaspID).

OUT EAX=low part of ID, EBX=high part of ID, ECX=status(0), EDX=HASP API version

Don't touch EDX, its not really used.

MD5 doesn't really come into this, the old HASP envelope used the MD5 hash result of the returns from HaspCode() as a decryption key, the new envelope uses HaspCode() internally (modified table) and new 0x3D HaspDecodeData() FEAL service (which really only generates 64 or 128-bit data) for decryption. Either way your target doesn't sound like its using these.

If you've got a target URL, I'll happily take a quick look.

Regards

CrackZ.


Getting hold of handles and/or ID:s for threads of running processes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Getting hold of handles and/or ID:s for threads of running processes
PDA

View Full Version : Getting hold of handles and/or ID:s for threads of running processes

dELTA
03-15-2003, 12:06 PM
Does anyone know if it's really not possible to get hold of an ID or handle to an arbitrary thread in a running process by way of "normal" win32 API commands (i.e. without using the ToolHelp or PSAPI libraries)?

When you create a process with CreateProcess, you are handed 4 numbers, the ID and handle of the process itself and the ID and handle of the main thread of the process, but when you attach to a running process with OpenProcess, you only get the ID and handle of the process itself, no thread info (which is of course quite understandable, since no thread can be considered "more main" than another in a process once it is running).

But the problem is that I cannot find any combination of "normal" win32 API commands for enumerating threads of a running process or in any other way getting hold of an arbitrary thread of a running process.

So, does anybody know for sure if this is impossible or not?

I don't really have high hopes about it after looking around on the net, but it seems like such a missing piece of the native debug API to me, that's all.

Thanks.
dELTA
disavowed
03-17-2003, 12:02 AM
why not disassemble the toolhelp functions and see what api they use?
foxthree
03-17-2003, 06:47 PM
Why do you want to avoid ToolHelp32 APIs?CreateToolhelp32Snapshot works admirably... Also, to get hold of a thread in arbitrary process... use OpenThread() API.

... trivial unless I'm missing something here...

Signed,
-- FoxThree
dELTA
03-17-2003, 07:09 PM
The OpenThread API does not work on Windows 9x (ok, it works on ME, but who cares).

The ToolHelp functions only work on Windows 9x.

Disassembling the ToolHelp functions, I'm sure its code would boild down to parsing some 9x-dependent undocumented system structures.

The reason I wanted to do it with the "genuine" Win32API was to make it platform independent, which none of the above is. :(

Thanks for the tips anyway guys! Sadly, I've already considered and rejected them all before though. :(

dELTA
disavowed
03-18-2003, 12:48 PM
so what if you can't figure out the structures? find what api functions are being called, and the work from there.
nikolatesla20
03-18-2003, 01:22 PM
Toolhelp is included in Win9X, Win2K and above. SO unless you plan on developing for NT4 (which is a waste of time) you can use the toolhelp functions just fine.

As a guess, Toolhelp no doubt calls NtQuerySystemInformation for what it wants.

-nt20
foxthree
03-19-2003, 03:57 PM
You should checkout the latest proggie from none other than our friend EliCZ... EliRT ...

You would be amazed how this guy does all this :)

Signed,
-- FoxThree


Thoughts Required
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Thoughts Required
PDA

View Full Version : Thoughts Required

peterg70
03-16-2003, 05:55 AM
I have a program that uses a program to authorise it.

The program is written in Visual Basic 6.0 (PEiD)

Looking around and searching have found no info on decompiling VB6.0 although there was some discussion about this early on.

Anyone has seen recent stuff regarding decompiling VB6.0 programs

Otherwise what is my best method of attack.

Info I know so far.

Program can transfer license to and from diskette.
Program uses a .dat file to store license Information
It has a Computer ID code and also a Code Entry Number (dependent on License Info)
and will accept a authorisation code.

What I am looking for is ways to attack it I have trapped it on getDLGitm but this seems to go around and around in User32.

At no time do I see my serial number in memory.

Peterg70
squidge
03-16-2003, 06:21 AM
Tried SmartCheck by Numega? Used to work quite well on VB Progs.
TOTEU
03-16-2003, 08:08 AM
Try with EXP MSVBVM60!

Begin with bpm __vbaStrCat x and see what you can get

EXP MSVBVM60!__vba*
will give you more

TOTEU
wbe
03-16-2003, 09:16 AM
SmartCheck, Sice, ...and the good old w32dasm if you need some string refs.

wbe
peterg70
03-18-2003, 06:28 AM
Will grab Smartcheck now.

I gone a bit further now and found the routine called from inside the program for good/bad guy BUT

Is there a API guide for all the function declared in the MSX6.0.DLL file. I need something that says _VBALateIDCall is...........................

Any thoughts.
Peterg70


corporate espionage account?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > corporate espionage account?
PDA

View Full Version : corporate espionage account?

mike
03-16-2003, 03:57 PM
I remember reading a first-hand account of a bunch of french hackers performing some corporate espionage just for kicks. I thought it was ArthaXerxes, but I've googled all over and can't find it, and I don't remember the site where I first read it. Does anyone else have a copy, or know where I can get one?
Kythen
03-18-2003, 10:18 PM
Hmmm... I knew I should have saved that article. I'm 99.9% sure it was ArthaXerxes that wrote it and that it was on his "Nexus", but bugger if I can find it now. Looking through my index.dat file I found the url http://www.altern.org/xerxes/d4/ttos.html

The link is dead now, but maybe it'll help with searching. If you find it please let us know!
2nEw
03-23-2003, 05:42 PM
I have the document in PDF format it is by ArthaXerX`es


help with asm source
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > help with asm source
PDA

View Full Version : help with asm source

LowF
03-17-2003, 04:52 AM
not sure really where to post this thread!

got asm file i managed to cut and past together *lol*, and it's real mess but need help with it, got problem with writefile function, btw it's tasm source, don't want any masm or nasm source, anyone feel they skilled on asm coding, then if u can contact me on icq 595219, and i send file , really just want it to work!
squidge
03-17-2003, 07:40 AM
hxxp://win32asmboard.cjb.net/ ?
ZaiRoN
03-17-2003, 02:18 PM
Hi LowF,
which is exactly your problem with WriteFile? The function fails? Have you got problem to compile the file? Or something else...

Btw, this is the syntax of the function:

BOOL WriteFile(
HANDLE hFile, // handle to file to write to
LPCVOID lpBuffer, // pointer to data to write to file
DWORD nNumberOfBytesToWrite, // number of bytes to write
LPDWORD lpNumberOfBytesWritten, // pointer to number of bytes written
LPOVERLAPPED lpOverlapped // pointer to structure needed for overlapped I/O
);

Important: the file must be created with GENERIC_WRITE flag.

I don't use tasm anymore but if I remember correctly you need to include the function using the Extrn keyword:

Extrn WriteFile:Proc

Now, you can call the function.
This is a simple example:

...
text_to_write db "example!",0
bytes_written dd 0
...
call WriteFile, handle_file, offset text_to_write, 8, offset bytes_written, 0

Hope it helps you...

Regards,
ZaiRoN
NervGaz
03-17-2003, 03:17 PM
zairon: the code is correct but you have to add stdcall to the model declaration... if you don't you have to push everything for your self

push 0
push offset bytes_written
push 8
push offset text_to_write
push handle_file
call WriteFile

for the example
ZaiRoN
03-17-2003, 04:10 PM
Hi NervGaz,
you are right, I was taking it for granted :D


Hasp 4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Hasp 4
PDA

View Full Version : Hasp 4

ChORdlESS
03-17-2003, 05:45 PM
Greetings Members

I Was Just Wondering About hasp 4 dongles cracking and i was thinking it was impossible at this time as some crackers said to me untill a guy called 1ST chalnged me that he can crack HASP 4 so i toled him that i have a programe protected with HASP 4 and he toled me that he can do that in 3-4 days and voila after 4 days he forwarded to me the programe with an emulator for the dongle and i was shocked becaouse the sw was working 10000000% as the protected programe!!!!

so plz can some one give a tut in how did he do that !!!

thank you
naides
03-17-2003, 05:56 PM
Check the CrackZ archive site linked below within this page. He has extensive coverage of Dongles in general and HASP in particular.

By the way, this post belongs either in the Newbies or the off topic forum.
tgodd
03-17-2003, 11:12 PM
There are products that can do it out of the box.
What's this 3-4 day thingy.

Bwahahahahaha

:D

tgodd
TOTEU
03-18-2003, 12:04 PM
It is possible even if you don't know 3C and 3D services to emulate HASP4
Problem is if the developer really used 3C and 3D services.
Even with the envelope which performs (1,2,3C,3D) services
you can log all data and emulate haspdecode and haspdecode by a (big)tables of responses. (you could use CRC32 for recognizing the 3C/3D input data, just for fun)
The envelope I saw used:
a) service 1 (once)
2) service 2 (3-4 times) but using only two seeds
3) service 3C (once, block size 8bytes)
4) service 3D (blocks with size 0x7FFE and 2-3 smaller blocks)

All these can be implemented either in a minikernel emulator running in ring 3 or in low level driver.

Regards,
TOTEU


ReadProcessMemory vs. WinXP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ReadProcessMemory vs. WinXP
PDA

View Full Version : ReadProcessMemory vs. WinXP

tazmanian
03-17-2003, 08:39 PM
Hi guys, i'm trying to do an app that reads DUDATA.DLL from DuMeter to get the current down and up speed...but i'm with problems with WinXP. The ReadProcessMemory returns 0 (fails), while in win98 works fine...

See the code:
.data
ClassName db "TfrmDUGraph",0
BreakPoint dd 1000E150h,0 ;Address from DUDATA.DLL!!!
.code

invoke FindWindow, addr ClassName, NULL

.if EAX!=NULL
mov hWindow, eax
invoke GetWindowThreadProcessId,hWindow,addr Process_ID

invoke OpenProcess,001F0000h,0,Process_ID
mov hProcess, eax

invoke ReadProcessMemory,hProcess,BreakPoint,addr buffer,4,0
..
...
....
What is the problem with WinXP?

Thx for your help!
[NtSC]
03-18-2003, 08:59 AM
Problem might be that the Dll could be relocated to a different base Address,wich would make clear why your ReadProcessMemory fails...
If itsd not that, try to change the Page Attributes and try again..
...Just a guess ;)
disavowed
03-18-2003, 12:42 PM
also, this might be the kind of thing that only works if you're logged in as admin

i believe there's also a registry setting somewhere that allows/disallows access for readprocessmemory to other process, but i'm not 100% sure
[NtSC]
03-18-2003, 02:40 PM
As long as you dont mess with System Files, the Windows File Protection shouldnt get in your Way..
For an ReadProcessMemory you shouldnt need Admin Rights,
as long as you dont wanna do it in R0 :)
squidge
03-18-2003, 05:29 PM
By default, XP will only allow you to ReadProcessMemory of your own created processes. That is, you can't read system processes, or the processes of other users (normally, service apps come under "other users" even if your the only users on the system).

Also, you must make sure that the OpenProcess call you used previously to access the process passed with the access value of PROCESS_VM_READ or higher.
tazmanian
03-18-2003, 08:43 PM
Originally posted by squidge
Also, you must make sure that the OpenProcess call you used previously to access the process passed with the access value of PROCESS_VM_READ or higher.

That was the problem!
Thank you guys for your help!
I appreciate....

it works now :)

thx a lot!


Preventing Decompilers / Disassemblers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Preventing Decompilers / Disassemblers
PDA

View Full Version : Preventing Decompilers / Disassemblers

BOB
03-18-2003, 11:24 AM
I am sorry if this is in the wrong forum but PLEASE help me.

I am writing a thesis / dissertation regarding software security, trying to help developers create protections.

Looking through the old tutorial (1998ish) I have found a number of assembly routines that stop S-Ice etc.. but are there any newer methods.

For example - how can you prevent Smart Check, or IDA, or W32 Dasm in, lets say, using Delphi???

If yuou have any other ideas on protection systems, even if they are crackable or quite strong, I would be very GRATEFUL.

Thanks
ZaiRoN
03-18-2003, 01:32 PM
Hi BOB,

imho, the whole board is a place where the reverser guys learn how the protections work and, where developers are supposed to learn how improve their protections.
Listing all knowed anti-methods is difficult but you can use the search function to locate some of them.

You can start with it and if you want to know something about a particular method, feel free to ask...someone will help you :-)

Regards,
ZaiRoN
squidge
03-18-2003, 05:35 PM
Different tricks apply to different apps (and even different versions of the app!). For example, an infinite jump reference in w32dasm will lock up the app, but this will not have any effect on IDA.

Best protection against IDA is never use constant addresses in data or jumps - make everything reference the registers, and ensure the registers are setup using algorithms. (Eg. CALL EAX instead of CALL 4521A4, whereas EAX is setup previously in some math's algo). Very impractical however, and pretty much impossible unless you code the entire thing in ASM.

Other than that, tokening is a good way - I've yet to see a disassembler make anything out of a QBasic 4.5 program beyond the loader :)
Kayaker
03-18-2003, 05:47 PM
Hi

ZaiRoN pretty much has it right, this whole place is full of tricks and you just have to start learning where the level of 'deprotection' lays. I'm sure you've researched other things, but there are several essays around outlining protection ideas you can use, try Fravia's Searchlores protection articles for a start, CrackZ archives has some good stuff, I remember even the Delphiforum site had quite a good page on protection tips and tricks contributed to by several knowledgable reversers.

Re Delphi... there are several ready made commercial protections around of course, but I seem to remember a unit put together by someone of packaged Delphi anti Sice and other tricks, though I don't know if I'd bother with them. If you figure out a trick, someone will figure out a way around it, and how you implement it is critical in how easy or hard that will be. A few anti tool tricks by themselves are nothing much unless tied into a larger protection. If you have more specific questions...

Regards,
Kayaker


Home made DIY Dongles...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Home made DIY Dongles...
PDA

View Full Version : Home made DIY Dongles...

squidge
03-18-2003, 05:44 PM
Just wondering how many of you have "played" with software protected by home made DIY dongles that use the serial/parallel port?

Interested in what some people without millions of pounds to spend on custom RISC technology have come up with.

The only home made dongle protected programs I've played around with have been either incredibly simple, or incredibly stupid. The last one used a variation of SHA-1, and worked by passing data to the dongle, and then checked the result by using the exact same algorithm in the main program (which was called immediatly after collecting the result back from the dongle!).
tgodd
03-18-2003, 08:05 PM
All parrallel port dongles typically need 2 things:
A Clock Signal and a Data Line.

If you can obscure how the data is being clocked in it can make things somewhat confusing.

In some cases single wire is used, such as the dallas buttons.

Single wire can be extremely timing sensitive.

The micro processor idea can be reversed quite simply by glitching the code out of the micro, giving the reverser a complete disassembly.

Gate array logic typically consumes too much power.

Descrete logic far to bulky.

ASIC can be cost ineffective.

Leaving the typical 1, 2, or 3 wire memory devices, which can be easily defeated, and/or duplicated.

Not sure that this tells you much.
It may help!?!

Regards,

tgodd
neviens
03-19-2003, 03:20 AM
>The micro processor idea can be reversed quite simply by
>glitching the code out of the micro, giving the reverser a
>complete disassembly

Simply by glitchin the code not allways is so simple,
somtimes a some freezing/cooking is necessary,
somtimes it's simply impossible!

Question about latest USB HASP and Sentinel dongles.
What micro is used (CY7C63101A from Cypress??)?

Neviens.


Tracing into IIS
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Tracing into IIS
PDA

View Full Version : Tracing into IIS

mashedpatatas
03-19-2003, 03:40 AM
Can anyone help me with a problem...

I have the CODERED packet dump and tried to infect my IIS server with it, and it succeeded.

Now, what I want is to breakpoint into the CODERED virus while trying to execute in SoftICE. What do I breakpoint in SoftICE to get there?

TIA!
dELTA
03-19-2003, 10:06 AM
If it's a pure stack buffer overflow (i.e. not just redirecting the execution to a heap buffer with an overflowed return address), it should work to set a memory execution breakpoint on the entire stack (Note: NOT a BPX).

If you know in what function it happens, you can narrow it down to a smaller stack area, if a large area execution breakpoint won't work, or even simply put a memory write breakpoint on the return address of the function on the stack.

dELTA
evlncrn8
03-19-2003, 10:37 AM
fill the code u inject with 0cch
set i3here on in softice
send the packet.. wait for the break
considerably easier


In IDA Pro, how can I found the machine code of instruction?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > In IDA Pro, how can I found the machine code of instruction?
PDA

View Full Version : In IDA Pro, how can I found the machine code of instruction?

flexlm
03-19-2003, 06:38 AM
In IDA Pro, how can I found the machine code of instruction?
such as:
_text:00413B96 mov [ebp+var_C], 7648B98Eh

what's the machine code of the above instruction?
nikolatesla20
03-19-2003, 08:12 AM
Go into Options -> General -> Disassembly

There is a box "Number of opcode bytes", change this to something other than zero (8 should be sufficient).

-nt20
flexlm
03-19-2003, 08:36 AM
Thank for your reply


In IDA Pro, how can I modify a instruction?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > In IDA Pro, how can I modify a instruction?
PDA

View Full Version : In IDA Pro, how can I modify a instruction?

flexlm
03-19-2003, 08:31 AM
In IDA Pro, how can I modify a instruction?
such as:

_text:00413B96 mov [ebp+var_C], 7648B98Eh

I want to modify the above instruction to:

_text:00413B96 mov [ebp+var_C], 88888888h
dELTA
03-19-2003, 09:52 AM
You can enable the patch-tools in the edit menu by having the following line in your idagui.cfg file:

DISPLAY_PATCH_SUBMENU = YES

Btw, your recent posts in this forum are more suitable for the newbie forum. Please try to post in the right place.

dELTA


OOps i did it again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > OOps i did it again
PDA

View Full Version : OOps i did it again

druvo
03-19-2003, 02:01 PM
Hi everyone,

I have some tool that might be very nice to see, i use it for my own but i was lazy to finish it, i have reached 50% of it so i will release version 0.5

I hope you like it

:)


No CD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > No CD
PDA

View Full Version : No CD

zhas
03-19-2003, 04:28 PM
Hi
This is my first post here
I was trying to make the game run without CD
So as written in tutorials I was setting
bpx GetDriveTypeA breakpoint
and as written in those tutorials i was changing
83F805 into 83F803 in the code for example
Reference To: KERNEL32.GetDriveTypeA, Ord:00DFh
:0041D976 FF151CA56F00 Call dword ptr [006FA51C]
:0041D97C 83F805 cmp eax, 00000005
:0041D97F 752A jne 0041D9AB
But the Game still asks 4 CD
So what have I done wrong?
Or what else should do or look 4?
Thanks.
evlncrn8
03-19-2003, 04:41 PM
there are probably further checks below in the code, calling GetVolumeInformationA etc etc.. all you've done is changed the compare from...

'is it a cdrom' (cmp eax,5)

into

'is it a hard disk)' (cmp eax,3)

so keep on tracing and analysing the code there
Manko
03-19-2003, 06:07 PM
It could also be that you have to change the paths the game uses, because they might be pointing to the cd. If so, they'll probably be in some file or in the registry...

/Manko
Aimless
03-24-2003, 03:34 AM
New Game == Big headache (usually commercial CD protection systems)

Old Game == Good chance to bypass CD (usually Quake 2 and below era)

Which one is yours?

Have Phun,
zhas
03-26-2003, 04:30 AM
I think its old one i think so
zhas
04-04-2003, 03:33 AM
Thanks guys you relly helped me!
Recently I came across anothergame for which I wanna make NOCD patch
The problem is that when SoftIce is active and I start the game it asks to turn off the debugger
( I suppose I should opt for FrogIce in that case)
So when i start the game without CD messagebox pops up it says about corrupted registry etc.,
This message box is from the temp file xxxx.tmp from the system temp folder that is deleted
immediately after I press OK button
the executable itself is about 100 kb I guess all data is stored in a big file with gro extension
Besides in registry there is a line that says:
Installed from I: (CD-Rom)
So I m a little at a loss
Could anyone give a hint on what I should go or look for?
Any suggestions are welcome
Thanx
SiNTAX
04-04-2003, 05:14 AM
Sounds like safedisc to me.. Check the executable for the string 'BoG' in the first few kb's (also the CDROM will contain a file Secdrv.sys and some numeric files, like 000001.xxx).

If that is the case, then I think this target is probably too difficult for you (judging from your initial post.. I might be wrong)
zhas
04-04-2003, 06:55 AM
SiNTAX
You are damn right there is Bog string a few times
but not in exe (its only 9 kb) but in the *.ori file
If that is the case, then I think this target is probably too difficult for you
So u think its not even worth trying?
Such a miss
Mayb any tuts on the
case like that?
SiNTAX
04-04-2003, 09:13 AM
Hmm are any of the following files on the CDROM?

clcd16.dll
clcd32.dll
clokspl.exe
00000001.tmp
secdrv.sys

??
zhas
04-05-2003, 06:12 AM
Only
00000001.tmp
secdrv.sys
from your list
and also
00000002.tmp
00000000.016
00000000.256
SiNTAX
04-05-2003, 06:35 AM
Yups.. that's SafeDisc then..

So u think its not even worth trying?

Well.. it's always worth trying.. but this is not really a newbie target.. you need to do ALOT more than just skipping a test.
zhas
04-05-2003, 09:32 AM
But I gotta get some point to start from
Some tutorial on similiar case would b great
Also I think its good 4 a newbuy 2 start with smth
difficult in order 2 learn :rolleyes:
sai
04-06-2003, 03:16 PM
Hey,

well as a newbie I wouldn't start cracking with Safedisc, simply because you will fail and that will frustrate you. Try to get an older game like Sin, Quake 2 or 3 for example and start cracking with those as they have some simple Cd Checks to start with (and there are also Tutorials for those games out :)
Kilby
04-08-2003, 06:19 AM
Personally I would suggest heading for older Eidos games.

Thief, Tomb Raider 3, as they check for oversized files and can be done with a one byte patch, or four nops (whichever you prefer).

If you want to go into encrypted files then copylok which was on the original release of Oni, Sudden Strike, Battle of Britain are fairly easy options.

However these require dumping and IT rebuilding but are nice items to learn with.

After that older securoms are nice to work with.

Regards,

Kilby...


FLEXLM: How can i found Seed3 and Seed4?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXLM: How can i found Seed3 and Seed4?
PDA

View Full Version : FLEXLM: How can i found Seed3 and Seed4?

flexlm
03-19-2003, 08:13 PM
My Target is protected by Flexlm 8.0c. How can i found Seed3 and Seed4, CRO1,CR2?
Woodmann
03-19-2003, 08:42 PM
Howdy,

You need to read some tutorials.
Check CrackZ site, the link is below.

Woodmann


Xtreme-Protector
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Xtreme-Protector
PDA

View Full Version : Xtreme-Protector

gorge
03-20-2003, 04:00 PM
is Xtreme-Protector truely uncrackable? :confused:
nikolatesla20
03-20-2003, 04:35 PM
hehe, well to be cracked, a program first has to run. Programs with Xtreme protector have a hard time doing that :p

-nt20
squidge
03-20-2003, 04:50 PM
Yes, it's virtually uncrackable, as, like nikolatesla20 says, the protected programs don't even run most of the time ! How do you crack something that doesn't work in the first place ? :)
Gaia
03-20-2003, 05:41 PM
Hello Gorge

If you could execute a program you can break it, Xtreme-Protector also.
But with my experience(5years) on cracking I think that XProtector and
StarForce are the best protections that I have never seen. Both uses ring0
on NT systems. I think is the future...experience says that every ring3
protector will be cracked in few days

Of course, is MY OPINION ;)

Gaia
separator
03-20-2003, 06:44 PM
Hello Gaia,
are you joking? Compare X-Treme shit with StarForce? There is nothing for compare. I never had problems with StarForce protected application. I had many problems with X-Treme protector. My Outlook crash everytime after some minutes. When I removed X-Treme shit's driver, everything works correctly.

Btw: You can't compare X-Treme shit with StarForce because X-Treme protector uses only shitty SMC, but StarForce uses another method. I don't know name for it. They use their own language and then thier interpreter run it. Something like VB P-Code and I think this is future and not stupid ring0 tricks in X-Treme shit.
Gaia
03-21-2003, 03:53 AM
As I has say is MY OPINION

Yes Separator, I know a lot StarForce VM(Virtual Machine). I have not compared these two protection in technique but in effectiveness against reversers

I cracked Safedisc, Securom, LaserLock, Vob, CopyLok and I cannot compare any with StarForce, can you?
I cracked AsProtect, tElock, Svkp, Pelock....and I cannot compare any with Xtreme-Protector, can you?

I don't defend xtreme, but I am boring fucking ring3 protectors

Gaia
Kilby
03-21-2003, 05:00 AM
Gaia,

I don't think it was really an attack against you, more one against the reliability of xtreme protector :)

I havn't seen anything protected with starforce yet (I'm sure that I will though).

Most of us have got bored with the manual unpacking of such items.

Eventually you will decide to write an unwrapper or dumper and discover a truely harsh world ;)

I would suggest posting an essay regarding svkp as I certainly havn't seen a essay on it and my quick look at it suggested that it was quite interesting.

Regards,

Kilby...
Gaia
03-22-2003, 01:23 PM
Hi Kilby

the only thing complicated cracking Svkp is rebuild all encrypted blocks in .text section. Find the oep and rebuild imports is very easy

regards,
Gaia
separator
03-25-2003, 10:40 PM
Gaia:
What version of SVKP did you crack? Because I bought this protection and two days ago I received new version. It is 1.30 beta and it has some interesting new features.

It uses move code from entry point. It isn't interesting because something like it uses ASProtect and some other protections too, but it obfuscates this code. It obfuscates this code very well, if it stoles 10bytes then obfuscates it to more than 100 bytes. I found this code in code but it isn't possible set it back to entry. I can't deobfuscate it, because it is very hard. Did you find something like it before?

I wrote to AntiCracking what they planned in future. They planned use this obfuscation method for selected blocks of code. If someone uses it to interesting code, then this code looks like StarForce code. It is very hard to understand what this code does. I think this is future and not X-Treme. I think anti-debug tricks are good, but sometimes unstable and very soon breaked.

Btw: New version of SVKP uses compression of file too. I waited for it, because previous versions only protect files. They inproved DLL protection too, it works now very well.
Gaia
03-26-2003, 05:01 AM
separator:

It uses move code from entry point. It isn't interesting because something like it uses ASProtect and some other protections too, but it obfuscates this code. It obfuscates this code very well, if it stoles 10bytes then obfuscates it to more than 100 bytes. I found this code in code but it isn't possible set it back to entry. I can't deobfuscate it, because it is very hard. Did you find something like it before?

I hear that Pelock do the same, and according to Xtreme-Protector wizard they do the same

I wrote to AntiCracking what they planned in future. They planned use this obfuscation method for selected blocks of code. If someone uses it to interesting code, then this code looks like StarForce code.[B]

I can talk about SVKP 1.30 because I don't see yet, but lastest demo is very very far of StarForce

[B]It is very hard to understand what this code does. I think this is future and not X-Treme. I think anti-debug tricks are good, but sometimes unstable and very soon breaked.

Antidebugs are as good as protector can hide them. I don't know will be the future but I think this is not SVKP unless Pavol makes some optimizations. It takes 50seconds in my 500Mhz to launch protected DreamweaverMX

Regards,
Gaia


Help me with armadilled app!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help me with armadilled app!!
PDA

View Full Version : Help me with armadilled app!!

jackii
03-20-2003, 10:23 PM
Hi, armkiller:

I'm one armkiller user who like your famous program very much ^_^

Also i've known 'bout that Armadillo Killer 2.6 was already released.

And I've tried it. Some early simple packed software can be easily un-packed.

But.. These days when I trying to un-pack one game-tool, i met some terrible thing &_& .

First I cannot succeed in un-packing that program with ArmKiller 2.6
It told me that "Unknown version!"

Then, I tried to un-pack it by myself. I've tried many ways to find the OEP,

but I can not! So.. now.. I still don't know how to dump them out :(

If you're free, Please help me with it ! And tell me the point!

Thankyou very much!! (Forgive my poor english:)

The URL: DELETED

Extract the pack, and the file named "muhero.exe" is the packed-file.

I use PEid to find out that :

the pack is: Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks.
jackii
03-20-2003, 10:33 PM
BtW, i'm using Ollydbg, PEid, LordPE, ImportRec.

I've tried bpx SetProcessWorkingSetSize , but it doesn't work.
I even cannot trace to "call edi" instruction.

Then , I knew that Armadillo will create another process during
the up-packing routines. So I "bpx createprocessa", trying to
trace out the OEP, but I failed:(

At last, I tried "bpx VirtualProtect" to break just before the armadillo warning me about the debugger:)
but also I cannot trace to the "Call edi"

Who could tell me how to find the OEP?
And How to dump it?
(It always seems difficult to dump from the app)

Thanx to all of your mans:rolleyes:
S3ri@l CoDe9x
03-20-2003, 11:15 PM
Please read the tutorial about unpack armadillo by Crusader u can find here :

hxxp://www.woodmann.net/fravia/what_new.htm <--- remember change http

I not speak english (but i understand) and i translate this tuto in spanish i attach in this post . I hope that can help u :p

Remember !! :

Armadillo it's not a wanabe protection, If ur knowledges are poor u sides seriously problems for unpacking.

And Using Soft Ice!!! :rolleyes:


Crk Guardant Dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Crk Guardant Dongle
PDA

View Full Version : Crk Guardant Dongle

dee
03-21-2003, 04:12 AM
I have one prog protected with guardant dongle
main exe crypted and novex32.dll
Does anyoune have some info or experience about cracking that dongle
thanx
squidge
03-21-2003, 05:04 PM
No, but I'm sure that there is some information on the 'net about reversing it :)

Google is your first point of call, followed by the FAQ on this board before you post anything else.
dee
03-23-2003, 11:11 AM
I've searched ewherywhere and found only one tutorial in china language about novex (maybe you want to translate it:)) ), i would never post if i was not shure there is no other option;)
so if u cuold help i will apreshiate it, if not, i know everything about FAQ and else;)
regards
thanx
squidge
03-23-2003, 11:50 AM
Well, I just searched for about 5 seconds and found an unpacker for your crypted exe, and some nice documentation to remove the dongle calls, should there be any left after unpacking, so I would suggest you try searching again :p
dee
03-23-2003, 01:20 PM
If you are talking about Guardant Dongle PE Envelope Unpacker 0.x by SnowPanther it is not working, my file is with crypted import table, and also it is protected with novex32.dll, so anyway thanx for searching ;) if you found something better just give me a link or share in this msgboard
thanx
squidge
03-23-2003, 01:22 PM
The fact you are asking for a link is an obvious sign that you have not read the FAQ...
vzz
03-27-2004, 07:04 AM
Hi!

This is russian dongles in Moscow

Company Activ

3 dongles
Aptus - old key, not sale - low protect
2 chip
1 nvram 93c46
1 logic 74alc...
5 diodes, 10 resisters
copy hardware (programmator, copy nvram)
software - program copy nvram dongles<->dongles

Geardant Stealth (local, net) HARD PROTECT
3 chip
1 login 74als
1 nvram 93c46 (dump in crypt)
programmator nvram<-> nvram NOT WORK
in dongles individual (unical) ID serial number
Crypt nvram in ID serial number + public code

1 pic16lcf84a

~8 algoritm crypt
3 code private code read, private code write, private master code
code is 4 byte

Guardant Fidus (is madium protect)
is Stealtsh.
~4 algointm crypt
3 chip

PIc
vzz
03-27-2004, 07:07 AM
Search site
www.yandex.ru
www.rambler.ru
www.google.com.ru
www.google.ru
www.apport.ru

Activ
www.novex.ru
www.guardant.ru
soft,manual, drivers,forum protect, message board
vzz
03-27-2004, 07:09 AM
Guardant stealh
nvram data dump crypt not hard
is xor, rol bit
vzz
03-27-2004, 07:12 AM
Soft for Stelth is not workly
1 program soft password generate for dongles
1 program novex32 (old version 2.50) path spy password (Хрен его знает как она работает)


where can i found thd flair tools to making the sig file for flexlm?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > where can i found thd flair tools to making the sig file for flexlm?
PDA

View Full Version : where can i found thd flair tools to making the sig file for flexlm?

flexlm
03-21-2003, 05:45 AM
where can i found thd flair tools to making the sig file for flexlm?
what's the newest version of flair?

Please don't tell me to download it from IDA Pro home page!
esther
03-21-2003, 07:10 AM
You're pretty lame.You didn't see it just right under your nose!
nblender
03-24-2003, 10:52 PM
I think what you're looking for is flair381 - the flair kit is around the internet with some careful searching, or you could check on the CD if you are a registered user.
JMI
03-24-2003, 11:46 PM
flexlm:

Has it not occured to you that you could enter "flair" into any search engine and LOOK for available copies of the program???

And esther may be "insane" :D but you were given the answer. Look at the bottom of the page and the links and "yee shall find what yee seeks."

REgards.
prt
03-25-2003, 08:11 AM
Russian tools site
you find here flair 4.21
hxxp://www.wasm.ru/toollist.php?list=13


Flex Lame Tuts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Flex Lame Tuts
PDA

View Full Version : Flex Lame Tuts

LaBBa
03-21-2003, 06:52 AM
hi all ..

i was told that if i want to lern FlexLM i should read the Crackz tut page ...
so i did ..
i read and read and read and read etc...
but all the tut there are starting from the middle .. :mad:
i searched for more and all was the same ... all
starts from the middle of the cracking !!

there is no (or i didn't find any) STEP BY STEP tut about
FlexLM thats why i got SAD !!! :(

if any1 can help me with that plz post once and for all
a g00d tut !

tnx
LaBBa ....
esther
03-21-2003, 08:09 AM
Search for the first part and the end part.Fixed the puzzle and write a tutorial ;)
Woodmann
03-21-2003, 03:31 PM
Howdy,

Check some of the other links at the bottom of this page.

Woodmann
LaBBa
03-22-2003, 10:55 AM
first of all :
i'm sorry if i offended someone by sayin : Lame tut
they r very high level cracking and i got Mad that i didn't
found any full tut....

i will write a full tut step by step about all that will contain all
as soon as i will crack at least 1 fucking FlexLm

if anyone would like to join and help ... plz DO !!

=D
squidge
03-22-2003, 01:41 PM
Personally, with programs protected with FlexLM and the like, unless the program is updated regularly (say once a month or so), I believe the protection should be removed completely, and not key-genned.

It's true that there's no "from the ground up" tut on FlexLM, but if you search this board and the tuts, you'll find everything you need.
LaBBa
03-22-2003, 04:06 PM
yea i gess u r right..

i gess i got used to unpacking and the approach of cracking...
thats why i got lasy.... :rolleyes:
esther
03-22-2003, 08:55 PM
Didn't you've read my title.I'm insane :DDDDD
squidge
03-23-2003, 02:56 AM
I think we all know that esther :) :D
esther
03-23-2003, 09:18 AM
Hmm Sqoodge,

Do you really think you know I'm insane? Probably you are the same :eek:
squidge
03-23-2003, 10:15 AM
quite possibly ;)
nblender
03-24-2003, 10:47 PM
There are a couple of comments that I should make here.

Firstly, when dealing with flexlm based protections, its generally better to build a key generator, since sometimes critical data is stored in the license file. The program does not have to be patched, so this greatly lessens the probability of a bad crack. Unless all the calls are properly patched out, there is a chance that various problems such as memory leaks may be introduced, or locations that patching may be required are missed. Certainly some of the later versions of flexlm require some patching, but this should be done as minimally as possible to reduce the chances of introducing defects into the program. The attitude that a keygen is superior to a crack is fairly pervasive; that is why a "keygen" can be released when there is a "crack" released already, but the converse is not true. Keygens often work for minor updates of a program too, cracks (execpt for certain context dependent ones) are dependent on the version being exactly right.

As far as tutorial go, flexlm has been fairly heavily documented. Generally the documents that you'll find won't be pure hand holding, since by any reasonable measure basic flexlm is fairly straightforward, and you won't generally have to deal with packing and antidebug tricks, and for that matter in most cases you won't even have to rip any code.

Some add ons/options require more reverse engineering, or the use of some proprietary flexlm tools, and some versions of flexlm require patching. In the Fravia archives, and on CrackZ' page, you will find what you need for most flexlm targets. If you need to go beyond that, the path, even though not publicly document isn't that hard to find.

Having said that, you'll probably get a lot more help from here if you put down what you've tried, and where you're having difficulty.


Command line switch routine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Command line switch routine
PDA

View Full Version : Command line switch routine

Stilgar
03-21-2003, 03:05 PM
I'm reversing a old DOS game (reversed the structure of the high scores and levels) and I need a little help: how can I find the routine where a command line switch is checked? Example: yourapp /switch (or -switch). I searched for info about it, but had no good results.

I'm using Wdasm to obtain a dead listing and softice for DOS to debug.

Thanks in advance, and I hope that my bad english isn't a problem. Sorry :)
disavowed
03-21-2003, 03:14 PM
"The command line switches are received by the program
from the program segment prefix (PSP) beginning at offset 80h."

In other words, the command line is located at ES:[80h] when the program starts.
Aimless
03-24-2003, 03:39 AM
Usually, old dos programs have their commandlines spelt out easily in IDA. Alternatively, simply tdump the file for strings and they'll be there in all glory.

Note that some programs (dos based) use single line params (which you can easily check in the PSP) to trigger a value in a table that could be encrypted/compressed or god knows what. The values are triggerd in certain sequence only. This implies, that knowing the options (tdumping or PSPing) may not get the desired result.

Best idea is to run the program under IDA and trace the stack pointer, to see if its being accessed somewhere. For a more detailed view about the contents, ICE would do.

Have Phun,
Stilgar
03-24-2003, 06:30 AM
Thanks, disavowed and Aimless. After the post of disavowed, I used the info about PSP to search and found a comprehensive explanation at

h++p://www.ee.up.ac.za/~justin/cos284/asm/psp.html

I had a look at the code and found the "probable" areas. I'll look with S-ICE later and post the results. If this doesn't work, the suggestion of Aimless is my next step (run under IDA).

Thanks for the help!


Softice 4.05 NT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice 4.05 NT
PDA

View Full Version : Softice 4.05 NT

crackn101
03-22-2003, 10:23 AM
Hi everyone.
First off, i must say that it's been a long time since
the last time i used softice.
And that was for windows98.
I now have win xp.
I installed softice 4.05NT
It seemed to install just fine, but when i went to reboot,
windows gave me a blue screen that said it wouldn't
boot into windows to 'prevent damage to my system'
or some crap.
So i had to shut down and reboot using 'last known good
configuration' and
windows loaded up again, but alas, no softice.

My Question is this :

Is this version of softice the best choice ?
and do i need to perhaps download any additional drivers
to keep this from happening again ?

TIA for any suggestions.

crackn101
nofurs
03-22-2003, 10:54 AM
I've got a pretty good suggestion

1)Read the FAQ before you post anything here

2)theres a search button up on the 2 right hand corner
dELTA
03-22-2003, 11:10 AM
3) Driver Studio 2.7 should work pretty ok. :)
squidge
03-22-2003, 01:44 PM
well, since SoftICE 4.05NT is meant for WindowsNT, and not WindowsXP, I'm not suprised it didn't work :D

Like dELTA says, DS2.7 will work fine however.

And please, use the search button before posting next time, this question has already been answered before!

Before you post another message, DO NOT EVEN THINK ABOUT REQUESTING LINKS TO DS2.7 !
crackn101
03-22-2003, 02:48 PM
I was not going to ask for a link.
Believe it or not, i DO know better than that. :)
You are right i should have done a more extensive search.
SICE is -the- best debugger, but it seems that i am moving on
to olly dbg. At least for right now.
I did not find a complete ds2.7 source.
I think it was exetools that did have it at one time, but the
main site is down, and the mirror does not have it.
AND NO i am still not asking for a link, so don't flame me.
(just incase you were starting to wonder. ;) )
I did find the sice4.27 rip by Croaker,
but it didn't install very well.
Anyhow, olly dbg is a nice debugger, and it is gaining some
popularity.
Maybe someday there will be more tutorials using olly dbg.

Thanxs for the feedback.
mythical
05-21-2003, 11:38 PM
I have DS2.7 and I got the same error.
I seems to do fine when I load it manually.
....BTW I use olly, but still have to referance to SI at times.
So you need to find it.....!!!!!Krobar can tell you where!!!!!!

Good luck. ;)
JMI
05-22-2003, 01:30 AM
There are also several good posts and a couple of files to aid in the hiding of softice under WinXP & Win 2000. There is also a file for making Softice properly break on winmain. These are all available here if you use the search button. ry various combinations of "softice +Hid*" and "softice + break."

Regards.


Tool Update: RTA 1.20 released...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tool Update: RTA 1.20 released...
PDA

View Full Version : Tool Update: RTA 1.20 released...

squidge
03-22-2003, 06:38 PM
Yup, it's another new version. This one contains a (very) basic scripting language to automate patches that you might want to apply to more than one file. It also includes string searching, viewing the imports directory, and finally some of the useful values from the pe header.

The scripting support will be expanding over time, so if you have any ideas for it, drop them in this thread. The same goes for the rest of the program really as well.

Suggestions already noted: ability to change the entry point, pe re-aligner, create executable patch file from the modifications. These will probably be in v1.3.

Like always, if you find any bugs/etc, either put them in this thread, or PM them.

URL:

hxxp://ibiblio.org/paulc/rta/
squidge
03-23-2003, 04:28 AM
Sample script file, as there's no documentation to the prog as of yet. (However, if anyone wants to help with that...)
Paul333
03-23-2003, 07:47 PM
Thanks Squidge for upating

paul333
crUsAdEr
03-25-2003, 03:40 AM
wow.. nice one squidge, that was fast for so much updates... u must be real free or a darn good coder :)...

i like the scripting feature :)... would be ideal if we can script byte patch as well... perhaps there is a way of doing it that i dont know about? How about searching a n-th occurance of a byte pattern starting from specific VA, RVA, section etc.. forward or backward direction... would be nice cos that would make the patching engine more complete :)... and inline patching protectors easier and more fun :)...

I feel like a nagger but hey, you ASKED for it :)...

cheers,
crUs
nikolatesla20
03-28-2003, 04:02 PM
More suggestions

Minimize button,

Always on top option

-nt20
squidge
03-28-2003, 05:14 PM
Thanks for the suggestions. However, it looks like I'll be needing to rewrite it now before making any more changes as it's becoming a nightmare to navigate around. It was started of as a quick hack, but now becoming greatly expanded so needs to be redesigned to accomodate this.

I'll write up the new spec / requirements tonight, then start rewriting end of the weekend.
Paul333
05-22-2003, 01:33 PM
Just thought id say it again "I think this is a great tool best of its kind i reckon"

Been using it to generate not just jmp's but mov's , push's etc.

It also taught me that instead of only being able to change a far contional jump like

0F845D001900

to its opposites like

0F855D001900
0F875D001900

etc etc

But that i could just jump direct like this

E95E001900

As you see this can be a really powerful aid if used wisely

Thanks again Squidge :)

paul333
disavowed
05-31-2003, 03:26 PM
Originally posted by Paul333
It also taught me that instead of only being able to change a far contional jump ... to its opposites... i could just jump direct
#1 rule of cracking: never replace a conditional jump with another conditional jump
Paul333
06-06-2003, 05:51 PM
Hmmm y not Disavowed ? :)

If the user has bought this program jump to section without ANY further checks or restrictions OTHERWISE dont jump so i can enforce restrictions and lots of nags...

Wouldnt changing a jump if to a direct jump not be the best in the above situation?

oops sorry Dissavowed you didnt mean my direct jump but your meaning i think changing a jump from

je jump if equal

to a

jne jump not equal

is bad ettiquette..Why?

Just say im cracking an app realtime and early on i meet a routine that checks for a certain value...lets say

"if eax =1" JUMP TO Nag routine

otherwise

stay here in the good section

I find that if i change it to its opposite like

"if eax =1" DONT JUMP to Nag routine

It helps me further into the crack

because after changing 2 or 3 conditional jumps to there opposite
i get the app to say "FULLY REGISTERED

them further on in the crack iF i then make a further change to another jump and it suddenly goes back to "UNREGISTERED"

i say BINGO..ive found the really important jump that affects all others .so i keep the change i made to that jump and go back and change the first ones i did back to there original state and HEY PRESTO cracked!!!..

I would never have discovered how much that last jump affected the app if the initial changes i had made where direct jumps as opposed to there opposites!

So in my opinion theres nothing wrong withy changing a jump if equal to a jump not equal.....ok i know that its best to change flags, values, etc as opposed to jumps but if u cant and do change jumps then i see no harm in it in fact in the above situation it actually heps to solve the crack???

paul333

paul333
just
06-07-2003, 12:59 PM
You don't invert conditional jumps because you get things like people getting nagged the first 30 days they own a program to buy, and only after that can they actually use the program. Or a person accidentily inserts his original cd instead of the backup cd and can't play his game.

You can change jumps, but you change them so they always do the right thing.
Paul333
06-07-2003, 06:26 PM
Originally posted by just
You can change jumps, but you change them so they always do the right thing.

EXACTLY....whether its inverted or direct :):)

paul333
squidge
06-08-2003, 02:54 AM
I have to agree here, inverting jumps is ok for experimentation purposes when you can't see any other option, but once you have found the correct combination of jumps, you should change them to the correct direct jump.

Oh, and another thing. Like our master always said - if your killing a jump so it never jumps, use NOPs as a last resort. Something like "INC EAX, DEC EAX" does the same thing but can't be detected as easily, or even cause a jump to the next instruction, etc.
disavowed
06-08-2003, 02:24 PM
Nothing new to add, I just wanted to put closure on my initial statement. The first lines by squidge in the post above this is exactly what I meant.


ASPR CALL EAX Loop
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR CALL EAX Loop
PDA

View Full Version : ASPR CALL EAX Loop

LaBBa
03-22-2003, 07:28 PM
hi all ...
i know that this was talked before but i didn't found anything to help me...

i have tried to unpack a prog called :
System Cleaner v4.88 build 106

i found the Stolen bytes and replace them and restor the IAT
but the prog still crash...

so i traced it and found this:(copy from OllyDbg)

00404AF4 PUSH EBP
00404AF5 PUSH _SYSTEMC.00404B22
00404AFA PUSH DWORD PTR FS:[EDX]
00404AFD MOV DWORD PTR FS:[EDX],ESP
00404B00 CMP ESI,EBX
00404B02 JLE SHORT _SYSTEMC.00404B18
00404B04 MOV EAX,DWORD PTR DS:[EDI+EBX*8]
00404B07 INC EBX
00404B08 MOV DWORD PTR DS:[587640],EBX
00404B0E TEST EAX,EAX
00404B10 JE SHORT _SYSTEMC.00404B14
00404B12 CALL EAX
00404B14 CMP ESI,EBX
00404B16 JG SHORT _SYSTEMC.00404B04

i have found out the in the Packed file the registers Values are
deffrent from the unpacked file so at the 8 time the loop is made it jumps to a invalid place...

i have upacked it using PE-Editor and i cant find why the values are deffrent...

well its seems like all the values are biger the the packed values in the register by 1000h ....

weird...
btw.. ASPR stripper XP can unpack it well ... i just wonder why
the manual unpacking didn't worked as well ???

i used win98 to unpack... and OllyDbg 1.09b as a debugger...
squidge
03-23-2003, 02:57 AM
sounds like you didn't get all the stolen bytes...
LaBBa
03-23-2003, 04:22 AM
in ASPR Striper XP 1.25 it says :
"Found 0bh stolen bytes"

i found also 0bh stolen bytes...

55,8b --- 2
ec,83,c4,f0 --- 4
b8,8c,bd,57,00 --- 5
-----------------------------------
total == 11 == 0Bh
kyrios
03-25-2003, 02:33 PM
Fix the dumped file :

******************** Program Entry Point ********
:0057C4AC 55 push ebp
:0057C4AD 8BEC mov ebp, esp
:0057C4AF 83C4F0 add esp, FFFFFFF0
:0057C4B2 B88CBD5700 mov eax, 0057BD8C
:0057C4B7 E8A4AFE8FF call 00407460
:0057C4BC FF15B45B5800 call dword ptr [00585BB4]

In dumped file (using stripper), it call to 0057BD20
In ASPRed mode, it call to 0057B980
Now your dumped file will work ok

make it yours :

:00541E0F 0F94C0 >>>> B00090
:0056121A 762C >>>> 7600
:0056A6AD 0F94C2 >>>> B20090
:0056A6C9 0F94C2 >>>> B20090
:0056AA2C 0F85 >>>> 90E9
:0056F532 75 >>>> EB
:0056F6B4 75 >>>> EB

kyrios
Iwarez
03-25-2003, 03:03 PM
Let him do the patching himself. The question was how to fix the dump manually and not how to patch it. Also the stripper is completely unnecessary as manual dumping also works. (Believe me I tested it).
LaBBa
03-27-2003, 03:58 PM
Tnx anyway i dound out what was wrong ,

i fixed the API's Wrong ! (i'm lame;)

but all works fine...


CopyMem 2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CopyMem 2
PDA

View Full Version : CopyMem 2

S3ri@l CoDe9x
03-23-2003, 02:19 AM
Hi all :p

I see in one board ( hxxp://www.xtin.org/) one post about CopyMem 2. But i not understand ,this post is written in Russian lenguage :confused: , I don't have idea:confused: . Anybody can translate in english lenguage?

I hope that anybody know this lenguage .. I attach in this post.

Tnkx :p
LaptoniC
03-23-2003, 05:43 AM
I dont know russian but, according to source code here ismy guess.He injects inject.dll to armadillo's process and because the dll will have same rights in the process he can dump it.However this code only works on win2k/xp I guess because CreateRemoteThread,VirtualAllocEx are notsupported on win9x/Me.Of couse you can use ELiCZ's Elirt library for this.Hope I am not wrong.
r4g3
03-23-2003, 12:44 PM
babelfish.altavista.com
S3ri@l CoDe9x
03-23-2003, 02:57 PM
Originally posted by LaptoniC
I dont know russian but, according to source code here ismy guess.He injects inject.dll to armadillo's process and because the dll will have same rights in the process he can dump it.However this code only works on win2k/xp I guess because CreateRemoteThread,VirtualAllocEx are notsupported on win9x/Me.Of couse you can use ELiCZ's Elirt library for this.Hope I am not wrong.

Yes i understand the source , but i find understand all text and babelfish.altavista.com it's really bad :rolleyes:

Best Regards :p
neviens
03-24-2003, 05:02 AM
Not exact translation.
Neviens.
PS English and Russian are not my mother languages, fatal
errors and BSOD are possible, you have been warned!
S3ri@l CoDe9x
03-24-2003, 01:47 PM
Originally posted by neviens
Not exact translation.
Neviens.
PS English and Russian are not my mother languages, fatal
errors and BSOD are possible, you have been warned!

Tnkx!! :p It´s good translation.

Best Regards :rolleyes:
nikolatesla20
03-24-2003, 01:55 PM
Thank you!

The technique works quite well.

-nt20
JMI
03-24-2003, 02:36 PM
You might also want to check out this article, posted on AntiCrack back in January 2003, entitled: "Armadildo and CopyMem II decryption."

hxxp://www.anticrack.de/modules.php?op=modload&name=News&file=article&sid=3742

Regards.


Avoid INT1 detection of NTICE under 2k/XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Avoid INT1 detection of NTICE under 2k/XP
PDA

View Full Version : Avoid INT1 detection of NTICE under 2k/XP

pasha
03-23-2003, 02:28 AM
greetz

first of all my apologies to be starting another thread under the same heading. as much as i hate to do this, i wanted to know some info on int 1 detection from the gurus.

as i read from the previous posts on the same heading. there are 3 ways to detect NTICE using int 1

1) Check if INT1 is trap gate - if so NTICE installed
2) CHECK exception code of INT1 - C0000005 if NTICE installed
3) EIP+2 - INT1 DPL=3 then NTICE installed

okay, now my question is how do i change the exception code so that the (2) method is defeated. do i need to hook KiUserExceptionDispatcher ??? or is there an easy way out ?

awaiting a reply...

best regards
pasha
the_analyst
03-23-2003, 06:29 AM
Hello,

I may be wrong, i just woke up :)
But as far as my sleepy brain can think, i would tend to say that the exception code of INT 1 is pretty much related to the int 1 descriptor dpl.

IT does return C0000005h if soft ice is NOT here (EXCEPTION_ACCESS_VIOLATION)

now if Soft ice IS running, you have 80000004h.
(EXCEPTION SINGLE STEP)

So if you have Ntice, Descriptor of INT 1 is set to DPL 3 and it returns EXCEPTION SINGLE STEP, else without sice, Its descriptor is set to DPL 0, and it returns EXCEPTION_ACCESS_VIOLATION.

Basically, detection 2 is related to detection 3 ;)
Hope it makes sense, im dragging ass.

Regards,

Analyst
pasha
03-23-2003, 02:13 PM
greetz

thnx a lot analyst. :)

best regards
pasha


differents offset between hexworkshop and Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > differents offset between hexworkshop and Softice
PDA

View Full Version : differents offset between hexworkshop and Softice

newbcrk
03-23-2003, 05:18 AM
1/I can't open my target with WINDASM
2/My target is not packed .I have used PE-Identifier which said the compiler "Microsoft Visual C++ 6.0" and that's all .
3/My offsets are completly differents between Softice ex :
001B:77E7B19B 8BEC MOV EBP,ESP
001B:77E7B19D 83EC30 SUB ESP,30
(I am under my target I am sure)
and Hexworkshop ex : entry Point 0058BECC
so that I can't patch .I don't find the offset wich interrese me .I see that under Hexworkshop I have a lot of zero but the offset is higher under Softice without a lot of 00 (remplaced by 77)
What am i be able to do ?
ZaiRoN
03-23-2003, 08:19 AM
Hi newbcrk,
1/I can't open my target with WINDASMWindasm crashes when it's loading the file or the output windasm gives you is empty? To fool windasm is very easy, a simple search in the board will help you. Btw, try to use IDA; it might be not much user friendly at first but it's very powerful.

3/My offsets are completly differents between Softice ex:
001B:77E7B19B 8BEC MOV EBP,ESP
001B:77E7B19D 83EC30 SUB ESP,30
(I am under my target I am sure)Hmmm...are you really sure?
I think that these lines are not from your target file but from a dll used by the file (correct me if I am wrong).
Reading one of your recent messages I found this:

001B:77E7B19B 8BEC MOV EBP,ESP
001B:77E7B19D 83EC30 SUB ESP,30

These are two lines of code from GetFileTime function, inside Kernel32.dll. Is Kernel32.dll the file you want to patch?
First of all, you need to find the code of your target so, reread the thread "How to know where I am" trying to understand what the other guys have told you; after that, when you will be inside your target (and not in the dll used by your target) I am sure you will be able to find the right offset

ZaiRoN
newbcrk
03-23-2003, 01:18 PM
Well by all apparences I understand nothing .
dELTA
03-23-2003, 01:36 PM
:p
squidge
03-23-2003, 01:37 PM
You may to try your hand at Ollydbg rather than Softice if your still a newbie...
wbe
03-23-2003, 04:12 PM
IDA is another disassembler.

(I am under my target I am sure)

Well, you may be, but you are inside a call to Kernel32.dll as ZaiRoN pointed out. Don't just rely on the indication given on the lower right part of your Softice screen. When your executable calls an external function (a dll) you are assumed to be under your target but looking at an offset which does not exist in your target's .exe.

OllyDebug (another debugger) seems to be right choice for you, both for debugging and for any other purpose you'd expect from w32dasm.

wbe
Aimless
03-24-2003, 03:28 AM
Try this:

1. Get IDA Pro

2. Disassemble

3. Unless its VB or Delphi program, or one of the exotic unary languages, you should see the instructions.

4. If you do not, its probably encrypted/compressed, no matter what the identifier program says.

5. Search GOOGLE for "cracking <targetname>". or search it for "<targetname> compressed with" or "<targetname> encrypted with". This should let you know if its encrypted.

6. If that does not work, try "anti-disassembler <targetname>"

7. Go to programmerstools.org Go to the UTILITIES section and download some VA to RVA offset calculators (there is a good collection of them. Download them all)

8. This takes care of converting between raw addresses (as seen in hex editor) as against the virutal addresses (as seen in the debugger)

9. Finally, remember w32dasm has issues running in 2000 and XP. It HAS to be in a directory or two below the root. If its nested too deep, it'll balk on you. Make sure that you are having the full version of w32dasm too. (Wean yourself away from that to IDA)

Have Phun,


PESHIELD: NTICE Detection method
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PESHIELD: NTICE Detection method
PDA

View Full Version : PESHIELD: NTICE Detection method

pasha
03-23-2003, 10:43 AM
greetz

back again,

my NTICE is patched against all known methods (as given in the DriverStudio 2.7 patch by splaj)

also, i have the idtpatch for restoring my int 1 including the unhandledexceptionfilter

but still i find PESHIELD 2.5 Detect Numega Softice ..:((...

anyone have any idea ?, btw i heard PESHIELD uses a nice method discovered by elicz under win nt ..any idea on that ?

awaiting a reply..

best regards
pasha..


NTICE Detection method in PESHIELD ????
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > NTICE Detection method in PESHIELD ????
PDA

View Full Version : NTICE Detection method in PESHIELD ????

pasha
03-23-2003, 12:32 PM
greetz

back again,

my NTICE is patched against all known methods (as given in the DriverStudio 2.7 patch by splaj)

also, i have the idtpatch for restoring my int 1 including the unhandledexceptionfilter

but still i find PESHIELD 2.5 Detect Numega Softice ..(...

anyone have any idea ?, btw i heard PESHIELD uses a nice method discovered by elicz under win nt ..any idea on that ?

awaiting a reply..

best regards
pasha..


okay, all is fine now, BUT...kernel32!unhandledexceptionfilter
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > okay, all is fine now, BUT...kernel32!unhandledexceptionfilter
PDA

View Full Version : okay, all is fine now, BUT...kernel32!unhandledexceptionfilter

pasha
03-23-2003, 05:31 PM
greetz

okay, i finally figured out what the problem was. i patched driver studio 2.7 as per instructions by splaj and when i patched the "kernel32!unhandledexceptionfilter" i was able to defeat peshield successfully.

now comes the wierd part. i wrote a small program for myself using SEH and that program simply exits midway somewhere in the SEH chain. same thing happens to SD2 exes too.

anyone out there have any ideas on this ?

best regards
pasha
dELTA
03-23-2003, 06:51 PM
You have to return the correct parameters from each exception handler, or otherwise the chain will always break. Did you do this in all your exception handlers? In protection schemes like SD, I'm sure that they can return "the wrong values" on purpose, to break the chain intentionally for some reason.

dELTA
pasha
03-23-2003, 07:05 PM
greetz

well i checked my SEH handler and its absolutely fine. but if what you say is true that protection systems like sd2 can return wrong values and break the chain, then how is it working without softice loaded ?

best regards
pasha


Resource Editing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Resource Editing
PDA

View Full Version : Resource Editing

yan_kur
03-23-2003, 10:51 PM
I try to edit resources (pictures) in an executable file compiled by visual basic 6. I use PE Explorer and Resource Hacker, but they can't find any picture, only the icon.
Is there anyway to edit resources in an exe compiled by VB6??
Iwarez
03-24-2003, 12:46 AM
No, there are no resources in a VB6 file. You have to get the location of the pictures yourself.
yan_kur
03-24-2003, 01:02 AM
How do I find the picture I want to edit?
Can I edit the picture using hex editor? How?
Aimless
03-24-2003, 03:21 AM
There are 2 ways to go about doing this:

Way number 1 - The picture file method
============================

1. Here, the picture exists as a seperate .BMP/.JPG/.GIF whatever.

2. Go to sysinternals.com

3. Get FILEMON and REGMON

4. Check to see which picture file is being accessed using FILEMON

5. Check if the registry points to any picture file using REGMON

6. Do not be surprised if the picture is not in the normal extension like .bmp or .jpg

Way number 2 - The Binary method
=========================

1. You can assume that the picture is NOT in the VB6 executable

2. But, it CAN be in the .DLLs that the VB6 program checks

3. Get a dependency scanner (www.dependencywalker.com) and get going on the dlls accessed (including delay loaded and getproc-ed ones)

4. Ignore the System dlls (kernel, advapi, user, etc)

5. Resource edit those dll files that you find other that the above.

Way number 3 - Highly difficult, but not impossible
===================================

If the picture plays an important part, chances are, its going to be in the encrypted form. In this case, your best bet is to use a debugger and try to find out where the picture is being accessed. This is very difficult, but not impossible. For you to decrypt, and for the programmer to encrypt.

Have Phun
yan_kur
03-24-2003, 03:35 AM
It seems that the pictures are inside the code, no dlls, just vb runtime :(
So they're encrypted in the exe file?
Aimless
03-24-2003, 03:43 AM
Quite possibly.

Alternatively, it could be EMBEDDED in the code.

Search the msgboard for BIOS cracking in Compaq for my reply on the COMPAQ bmp and how to extract it.

It is also embedded.

Have Phun,
yan_kur
03-25-2003, 02:35 AM
Yeah, it's embedded in the code.
I found the JFIF header and end of image, extract that block, open in mspaint, o yes that's the image I want to replace.
I replace the block with my own jpeg block, now the application show my picture :)


Insert some functions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Insert some functions
PDA

View Full Version : Insert some functions

yan_kur
03-24-2003, 01:12 AM
I want to insert some functions to an exe file. I don't know how to do that. Anyone can give me information about how to do that? What tool should I use?
squidge
03-24-2003, 02:12 AM
You can use a hex editor as long as you can find a place big enough to insert your code.
yan_kur
03-24-2003, 02:35 AM
I know a little about assembly language but not the exe format.
How do I find empty space? Is that the place with '00'? Is there any tool to shift the offset so I can make enough spaces?
Thanks
Aimless
03-24-2003, 03:14 AM
Yan_kur,

You have to do the following:

1. Go to Immortal Descendents site (you can find a link of the archive below in the FAQ)

2. Search for "Adding functionality to Notepad"

3. Also, go to tsehp.cjb.net

4. Search for Razzia, adding functionality, DeFiler and code caves

5. Search in google for "CODE INJECTION" (minus the quotes, of course)

Have Phun,
yan_kur
03-24-2003, 04:11 AM
OK thanks a lot.
I'll try to understand the tuts.
Stilgar
03-24-2003, 06:49 AM
You can look at kaz a.k.a vman tuts on Trillian (I have found one at h++p://www.neschip.com/vman/trill.html) or the Spider Solitaire Game (Spider Solitaire Reverse Engineering Paper, pdf). They are pretty easy to follow.
yan_kur
03-25-2003, 10:06 PM
Ok, I've found the code cave. No proble with code injection.
I still don't know how to inject some variables in the .data section.
Manko
03-26-2003, 01:22 AM
Hmm... put your variables (data?) in the cave also... ?
Or did yu mean something completely diffrent?

/Manko
yan_kur
03-26-2003, 02:25 AM
I want to put new data which contain text and print that text on the screen. How to do that?
squidge
03-26-2003, 02:28 AM
Put the data in the code section and reference it there. If you need to modify the data, ensure the flags for the code section says it's writable (if it's not, make it so :)
yan_kur
03-26-2003, 02:45 AM
Sorry, newbie here.
How to know that the flags for the code section says it's writable And if it's not how to make it so?
neviens
03-26-2003, 03:34 AM
Most (if not all) compilers make non writeable .code sections.
This info is stored in flags dword of section table of PE header
of file. It looks like 60000020, and is editable with any
PE editor (LordPE for example).
Neviens.
yan_kur
03-26-2003, 03:40 AM
OK, thanks that's very helpful.


weird output of JAD Java decompiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > weird output of JAD Java decompiler
PDA

View Full Version : weird output of JAD Java decompiler

Solomon
03-24-2003, 09:06 AM
I got the following statement from JAD. But I can't find the byte sequence 0xAC(\254), 0xED(\355) in the corresponding class file(The class file is not obfuscated.). Strange?

public static final byte[] StringToBytes(String s)
{
byte abyte0[] = new byte[s.length()];
for(int i = abyte0.length - 1; i >= 0; i--)
abyte0[i] = (byte)s.charAt(i);

return abyte0;
}

util2.StringToBytes("\254\355\u0100\u0105");
mike
04-08-2003, 12:21 AM
It's a static string, so it would be in a string table, right? Have you looked at the bytecode at all?


Can someone explain the unhandledexception mystery !!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Can someone explain the unhandledexception mystery !!!!
PDA

View Full Version : Can someone explain the unhandledexception mystery !!!!

pasha
03-24-2003, 12:50 PM
greetz

i spent long hrs trying to figure out what was the problem with kernel32!unhandledexceptionfilter patch in driverstudio 2.7 as explained by spath.

the patch works with some exes (peshield for example) but other exes like sd2 just exit somewhere along the SEH chain if my guess is right.

i would request someone (SPLAJ!!!!!! :) ) to please explain what exactly this undhandledexception patch does to softice. the sd2 exes work fine without softice but with this patch they exit why ???

somone plz throw some light on what is going on ?? :(

thnx in advance

best regards
pasha
pasha
03-26-2003, 08:03 PM
greetz all

pffff..after long hrs of disassembly under IDA of NTICE.SYS, i finally managed to patch some more locations (problem was NTICE was feeding in improper codes during exceptions which could be detected) of course you can do a faults off inside sice to achieve the same results. well what do you say, i found that out after i spent almost 4 hrs on the disassembly :p

now, my problem has not been solved completely, after this i was able to get some other exes which were exiting to run, but still sd2 exes just exit some where at 0x7765ABCC which i suspect to be in the kernel32.dll exception rerouting area.

i also did some tinkering with KiUserExceptionDispatch to monitor what exceptions were caused and to my surprise found that there were none generated by the sd2 executable !!!!. yet it exits...:(

i request..splAjjjj...!!!!...nicolatexla20!!!!!...analyst!!! someone..plz do help me out with this wierd behaviour if someone knows the answer to this..

thnx in advance...

best regards
pasha
[yAtEs]
04-10-2003, 08:12 AM
allo,

softice sets the first opcode of undhandledexceptionfilter
to 0CCh, so it has its own internal breakpoint on the api
to catch exceptions, safedisc scans for the 0CCh opcode,
(at the start of all kernel apis actually) so a quick fix is
to grab some space in the kernel a code a
jmp undhandledexceptionfilter, then set the export table
to this jmp, that way safedisc will check the jmp and not the
start of the real api.

on the subject of safedisc anti-softice, u'll also need to remove
DR7 bits softice sets, i'll never seen this covered anywhere but
the way i do it is, to disassemble NTICE, text search for DR7
you'll find about 4 refs with it, doing an OR with a 3xxh number,
subtract 300h and patch, i.e patch away 03.

also change the int 1 dpl, IDT to get base, then,
EB BASE+1*8+5 EE hm or was it 8B :-)

hope that helps,
yates.
Darren
04-10-2003, 09:13 AM
Hmmm interesting stuff, yates is it possible u could expand
somemore on the last bit about int1 and the IDT

thanx

Darrren
[yAtEs]
04-10-2003, 10:23 AM
Hi,

Sure, was you referring to the format of the IDT or more about
how its used, for the format take a look here,

http://www.yates2k.net/idt.htm

relevant bits, would be,

--------

To get the dpl we'll read the 5th byte, but this also contains the present and Interrupt
gate marker, so

mov byte ptr [ebx+5],dpl

1 00 01110
P DPL 32bit INT

The DPL is just 2 bits of this byte, so we have a max value of 3, simple set it
and replace the byte at +5

DPL 0 = 8Eh
DPL 1 = AEh
DPL 2 = CEh
DPL 3 = EEh

---------

yates.
Darren
04-10-2003, 11:52 AM
thanx for the reply, insteresting and deep stuff

i do have another question if u dont mind regarding

Originally posted by [yAtEs]

softice sets the first opcode of undhandledexceptionfilter
to 0CCh, so it has its own internal breakpoint on the api
to catch exceptions, safedisc scans for the 0CCh opcode,
(at the start of all kernel apis actually) so a quick fix is
to grab some space in the kernel a code a
jmp undhandledexceptionfilter, then set the export table
to this jmp, that way safedisc will check the jmp and not the
start of the real api.

i guess this would be a live patch into memory or could kernal32.dll
be edited directly on disk ?

as if the kernal32.dll exports where altered to point to this
new undhandledexceptionfilter wouldn't sice look this up through
the export table or does it use another method to grab the
function address ?

Thanx

Darren
pasha
04-10-2003, 01:26 PM
greetz yates

thnx a ton for the reply. i have been trying my heart out for the past 3 weeks now, i have cut and pasted secdrv.sys disassembly code all around my room and look at it every time trying to figure out what is happening :p

now i am gonna try what u have said, but Dr7 is only set like that when i load the exe thru the symbol loader isnt it ??

coz when i coded a KMD and performed devio and checked Dr7 it was 400h which is the normal value with/without sice loaded.

owl told me that there is some check with Dr7 GE/LE bits in safedisc 2, but i found none in the disassembly uptil now. can u please confirm this ???

thanks again.

best regards
pasha
pasha
04-10-2003, 02:52 PM
greetz yates

i tried ur method of dr7 patching in ntice.sys (am using DS 2.7)

these were the locations for me

.text:00047128 or ebx, edx
.text:0004712A or ebx, 30Ch
.text:00047130 mov dr1, esi
.text:00047133 mov dr7, ebx

text:00047143 or ebx, 303h
.text:00047149 mov dr0, esi
.text:0004714C mov dr7, ebx

.text:0004715C or ebx, 330h
.text:00047162 mov dr2, esi
.text:00047165 mov dr7, ebx

and

.text:00047175 or ebx, 3C0h
.text:0004717B mov dr3, esi
.text:0004717E mov dr7, ebx

but to no aval :(, the sd2 exe still abruptly exits without any message boxes (2.90.40, igi2) when i patch kernel32!unhandledExceptionFilter in ntice.sys to Zhandledsomecrap, if i leave it as it is, it gives me a "Debugger Detected" message as usual.

any ideas ??

best regards
pasha
doug
04-10-2003, 05:02 PM
just one little thing.

also change the int 1 dpl, IDT to get base, then,
EB BASE+1*8+5 EE hm or was it 8B :-)

I believe it would be 8E, but i'm sure thats what u meant, since a couple lines after you mentionned

DPL 0 = 8Eh
evlncrn8
04-10-2003, 06:11 PM
/me pokes yates and smiles ;p
[yAtEs]
04-10-2003, 06:16 PM
Darren,

>as if the kernal32.dll exports where altered to point to this
>new undhandledexceptionfilter wouldn't sice look this up through
>the export table or does it use another method to grab the
>function address ?

yup exactly, as i said its just a quick fix, for on the fly fix, you can
make .sys to patch it if you like.

pasha,

Hmm exits silently eh, sounds you may of past the main checks
and being quit by something else, the main stuff is here,

10002F73 E8 15 E4 FF FF call antidebug
10004560 <- different checks for each call, all should return 0!

10004608 E8 83 4E 00 00 call BCHK
1000461B E8 50 4D 00 00 call UnhandleExceptionFilter_Check
10004654 E8 D7 4A 00 00 call INT_1_Check

couldnt find the dr7 one, maybe they (re)moved it ?

ur dr7 listings look ok too.
it could be exiting cos it detects daemon tools or acholo 120%
axvodka.sys or something, also any BPMs will make it exit

.txt2:1000D830 BAD_EXIT ; quit and screw stack
bpm here and backtrace ur exit if you like too :-p

Doug,
yup

yates.
SiNTAX
04-11-2003, 04:34 AM
SecDrv func 3c checks both DR1 and DR7. So don't use DR1 or patch your SecDrv. (which is probably better, as they also check the offsets between INT vectors <hint> )
[yAtEs]
04-11-2003, 05:00 AM
oh yeh, i tried unloading my driver and doing, r eax 0 after the
unhandleexceptionfilter call and it just quit like you said,
seems you need at least int 1 or 3 hooked to alter the interrupt
displacement (:

yates.
pasha
04-11-2003, 10:40 AM
greetz

ahh...:)..finally a hint...

---------------------------------------------------------------------------------
SecDrv func 3c checks both DR1 and DR7. So don't use DR1 or patch your SecDrv. (which is probably better, as they also check the offsets between INT vectors <hint> )
---------------------------------------------------------------------------------

but i thought the INT vectors offset check was only valid under win 9x/ME ????? is it valid under NT/2K too ?? hmm..time to check this out

okipoki, am off to try this one too..not leaving this sd2 crap till i get to the bottom of it..now my room is full of NTICE and SECDRV disassembly sources :p. man now i know why ppl call me a moron..

thnx a ton

best regards
pasha
Darren
04-11-2003, 10:56 AM
Thanx for answering a couple of questions of mine yates
and also sorry pasha sort butted into your thread a little :)

always good to discover more methods sice might be
detected

Darren
[yAtEs]
04-11-2003, 12:24 PM
ur welcome :)
pasha
04-11-2003, 02:18 PM
greetz

i tried the last approach to reduce the distance between int1 and int 3 (1Eh) by just redirecting thru my KMD int1 and int3 handlers that are just 06 bytes apart

without sice

I1OFFSET: 0x80465A96
I3OFFSET: 0x80465D6E
DIFF: 0x000002D8

with sice
I1OFFSET: 0xBAE13729
I3OFFSET: 0xBAE13747
DIFF: 0x0000001E

with my kmd
I1OFFSET: 0xED5E14BA
I3OFFSET: 0xED5E14C0
DIFF: 0x00000006

but still sice simply exits without display of any message box when i patch that kernel32!unhandledexceptionfilter to kernel32!Zhandledexceptionfilter.

if i leave it alone, then it displays that "debugger detected" msgbox.

so in a nutshell, i have patched/done the following
1) int 1 DPL=0 using my kmd
2) meltice (by changing all the names as in splajs patch)
3) int1-int3 distance using my kmd
4) int 3 bchk by splaj patch
5) int 41 debugger check patch
6) CC at first byte of unhandledexceptionfilter
7) DR7 patch in ntice.sys
8) i dont use any of DR1-Dr3 for breakpoints
9) faults off in sice

man, i still cant think how the hell sice is detected under NT/2k..:((...

i would appreciate any pointers on this..i know i shouldnt be asking, but it has been a month almost since i set out to defeat sice checks by sd2 under NT/2k/XP :p

thnx again

best regards
pasha
Lunar_Dust
04-11-2003, 03:26 PM
Softice could still be detected using OpenService with "ServicesActive", which returns strings of the current services active.

For example, go into Device Manager on Win2K or XP. Now click "View->Show Hidden Devices", and you will see NTice is listed as a device. YOu have to somehow change that name.

I haven't gotten around to doing so, I don't know how to do that yet.

-Lunar_Dust
pasha
04-11-2003, 03:29 PM
greetz lunar

i guess splajs patch takes care of that renames NTICE inside NTICE.SYS and SIWVID.SYS to ZTICE and also renames SIWVID to ZIWVID. so any of the createfilea, openservice, queryobjectdirectory, or any other meltice variants will not suceed coz NTICE is no longer the device name.

best regards
pasha
nikolatesla20
04-11-2003, 04:53 PM
No, it does not - I am the one who created the patches based of Splaj's walkthru, and I have them applied on my systems, and NTice is still listed in the services. The patches simply rename "CreateFile" name (The symbolic link) but the device name seems to still come out at NTice if you look at hidden devices. Just try it, you will see it is there even with patches installed.

-nt20
dELTA
04-11-2003, 05:14 PM
Isn't this name (the one displayed in the "hidden devices" list) simply based on a value in the driver's registry key?
Manko
04-11-2003, 05:37 PM
Might be... I know I patched the registry, but to be sure I also patched the "three files" and renamed NTice.sys... Now my sice is safe from openservice-trick... ;P

...and also DAEMONS NtQuerySystemInformation-trick.

Ofcourse I had first patched NTice.sys with NicolaTesla20's fine patchers, to get rid of the usual stuff. :)

/Manko
pasha
04-11-2003, 06:31 PM
greetz all

thnx a ton for the replies, i patched the registry as well as the files against openserviceA detection scheme.

but still sd2 2.90.40 seems to fish out my softice somehow .. i really have no clue on what detection scheme they have used ????

hope someone who has done tells me what detection in the world does sd2 uses ...hehe..this has been my all time greatest experience with NTice/sd2..

thnx again

best regards
pasha
Manko
04-11-2003, 07:08 PM
Just to be sure... Have you actually tried if your patching succeded?

htetep://daemon.anticrack.de/

sice_detection Explanation:
OS: NT/2000/XP by scanning the loaded drivers (simple but as always EFFECTIVE!)

There are more detecters, for usual stuff posted on THIS board too...

/Manko
pasha
04-11-2003, 08:13 PM
greetz manko

yep, i tried the listing and it doesnt show up as ntice anymore in the services panel. also i coded a small proggy using OpenService to list all services and it wasnt shown there either with Ntice, i renamed it to something else.

but in any case i dont think sd2 uses this mechanism because the exe displays msgbox just after the first deviceiocontrol to secdrv.sys, i put my money mostly on some DrX stuff, but yet even after patching all the things, the msg still pops up :(

i have patched my NTICe against all of the daemons detections and other detections. securom, peshield, pelocknt, armadillo, etc..the only stuff which detects it is sd2

so am awaiting any pointers.. :)

best regards
pasha
nikolatesla20
04-11-2003, 09:58 PM
um,

all I have to say is sd2 is using a system driver for this? well then you could be in big trouble. ... You should try to disam the sys file and see what it's doing (of course I'm sure you've already done so) -- sys files can't be protected.

The problem is the sys file could be using undocumented crap for doing its thing. Which may make it kinda hard to track down.

Plus, it's a deviceiocontrol call, can't you just modify the return buffer....

-nt20
pasha
04-12-2003, 12:28 AM
greetz nikola

yep, i have disassembled secdrv.sys and am looking thru it documenting it everyday :).

also the first thing i tried was attack using the devio modify buffer, but sd2 uses some kinda complex buffer techniques, it passes an input buffer and the devio call modifies the buffer accordingly and that data is used somewhere else in the program. i have the pattern of the failed devio call but i cant just patch it coz i would not know what it was expecting in the output buffer meaning i have to crack that logic which seems pretty complex at first looks.

so am looking at places where checks are performed with Drx and other stuff.

hopefully i should be able to find someting soon..:) or someone can help me on the way..but all in all this has been a tremendous learning experience for me with secdrv and ntice internals..:)

thnx again

best regards
pasha
SiNTAX
04-12-2003, 04:36 PM
Well I haven't seen the V2.90 Secdrv yet.. but the one I had a look at, wasn't all that 'special'

Which secdrv function are you having problems with?! The secdrv function is put in the input buffer at position 0x0C. (the positions before that are: dwVersionMajor (0x00), dwVersionMinor (0x04), dwVersionPatch (0x08)and then you have dwCommand at 0x0C)

TIP: ignore those 4 dwords that get xor'ed in the output buffer.. it's nothing interesting (it's the KeTick value, but xor'ed over 4 dwords to 'hide' it). It's checked in the main dll to see if the call didn't last TOO long (ie. to screw people using 'normal' debuggers that don't freeze time)
SiNTAX
04-12-2003, 04:39 PM
Just looked it up.. the secdrv I had a look at way back was:

dwVersionMajor= 0x03;
dwVersionMinor= 0x0D;
dwVersionPatch= 0;
pasha
04-12-2003, 08:04 PM
greetz sintax

without ntice loaded the first 2 deviceio call as as follows ---

1)DeviceIOControl:Device:00000070, Code:EF002407, IbufSize=00000514, OBufSize=00000C18
===Inbuf starts===
03|00|00|00|12|00|00|00|00|00|00|00|3E|00|00|00|52|A0|8C|DB|3A|0D|19|4F|FD|94|2
E|A8|84|7C|BB|3C|

as seen
dwVersionMajor=0x03
dwVersionMinor=0x12
dwVersionPatch=0x00
dwCommandCode=0x3E

and then you have 2 more detections ---

IsDebuggerPresent call
NTICE detection caught call.
CreateFileA: \\.\Global\SecDrv, -->00000078
CreateFileA: \\.\Global\SecDrv, -->00000078

and then

2) DeviceIOControl:Device:00000078, Code:EF002407, IbufSize=00000514, OBufSize=00000C18
===Inbuf starts===
03|00|00|00|12|00|00|00|00|00|00|00|3C|00|00|00|52|A0|8C|DB|3A|0D|19|4F|FD|94|2
E|A8|84|7C|BB|3C|0

here dwCommand=0x3c

now, with ntice loaded we have this ---

1st device io call -
1) DeviceIOControl:Device:00000070, Code:EF002407, IbufSize=00000514, OBufSize=00000C18
===Inbuf starts===
03|00|00|00|12|00|00|00|00|00|00|00|3E|00|00|00|EC|C9|8C|DB|3A|0D|19|4F|FD|94|2
E|A8|84|7C|BB|3C|

as seen dwCommandCode=0x3E

and then you have 2 more detections ---

IsDebuggerPresent call
NTICE detection caught call.

BUT, the second device io call is never executed and i get the MessageBox saying debugger detected...

so i figure there is some problem with the device io call with dwCommandCode = 0x3E...any ideas what that function does ??

best regards
pasha
SiNTAX
04-13-2003, 05:55 PM
That isn't it..

3e = SETUP
3c = Check DR1 & DR7

The 3e call gives you the verification data you need to make the other calls to secdrv.
For example, if you wanna (ab)use the secdrv driver, you first make a SETUP call, using an input buffer that has:

pSi->dwVersionMajor= 0x03;
pSi->dwVersionMinor= 0x0D;
pSi->dwVersionPatch= 0;
pSi->dwCommand= 0x3e; // SETUP

(0x12 VersionMinor in your case), then on all subsequent calls you use the verification data returned by the setup:

pSi->bVerificationData[0] = pSo->bVerificationData[0];
pSi->bVerificationData[1] = pSo->bVerificationData[1];
pSi->bVerificationData[2] = pSo->bVerificationData[2];
pSi->bVerificationData[3] = pSo->bVerificationData[3];

(pSi = pointer to input buffer, pSo = pointer to output buffer)

With that information, you can try the 0x3c call.. it will give you 2 dwords back.. 1 with DR1 and 1 with DR7.

Have you done the following in SI:

> eb 8003f40d 8e

As mentioned before.. this changes the INT1 DPL.
pasha
04-13-2003, 08:09 PM
greetz sintax

thnx for the amazing stuff, never knew so much about input/output buffers for sd2 devio. guess i will keep this thread going ;)

yes, i have patched int1 DPL.

also, what i fail to understand is, if as u say 0x3E is for setup and then 0x3C is for getting Dr1 and Dr7. then why didnt the ~df409b.tmp (sd2 dll) issue a second devio call with 0x3c when ntice was loaded. it simply issued only the 0x3E call as i had posted in the previous message and then showed me the message box. any ideas on this ???

also, here is a snippet from secdrv.sys that i think is responsible for storing dr1 and dr7. can u confirm this plz -- :)

loc_1093A: ; CODE XREF: sub_1092C+7j
.text:0001093A mov eax, dr1
.text:0001093D mov [ebp+arg_4], eax
.text:00010940 cmp [ebp+arg_4], 0BD331200h
.text:00010947 jnz short loc_10950
.text:00010949 mov eax, 3871DD10h
.text:0001094E jmp short loc_10959
.text:00010950 ; ---------------------------------------------------------
.text:00010950
.text:00010950 loc_10950: ; CODE XREF: sub_1092C+1Bj
.text:00010950 mov eax, dr7
.text:00010953 mov [ebp+arg_4], eax
.text:00010956 mov eax, [ebp+arg_4]
.text:00010959
.text:00010959 loc_10959: ; CODE XREF: sub_1092C+22j
.text:00010959 mov ecx, [ebp+arg_8]
.text:0001095C and eax, 500h
.text:00010961 mov [ecx], eax
.text:00010963 mov eax, [ebp+arg_C]
.text:00010966 mov dword ptr [eax], 4
.text:0001096C mov ax, 1
.text:00010970
.text:00010970 loc_10970: ; CODE XREF: sub_1092C+Cj
.text:00010970 pop ebp
.text:00010971 retn 10h
.text:00010971 sub_1092C endp
.text:00010971

i think i might need to patch something in here :> ????

awaiting a response as usual and thnx a ton once more

best regards
pasha
SiNTAX
04-14-2003, 02:05 AM
Well it's because SD is doing another test that you haven't found yet. All tests that SD does are all put in 1 subroutine call, they are called sequentially.. so just dump the main dll after the IsDebuggerPresent call (return) and then you will be able to quickly find all the tests.

As for the code sequence:

.text:0001093A mov eax, dr1

--> change to XOR EAX,EAX

.text:0001095C and eax, 500h

--> change to AND EAX, 400h

And that's one test less to worry about :)
pasha
04-14-2003, 12:12 PM
greetz sintax

thnx.. will now try what you said, and see waht the tests are.

best regards
pasha
Manko
04-14-2003, 03:12 PM
Hi!

You HAVE to tell us what you find! ;)

/Manko
pasha
04-14-2003, 11:04 PM
greetz

i am lost :(, here is what i got from the dumped ~df394b.tmp

.txt2:100099D0 sub_100099D0 proc near
.txt2:100099D0
.txt2:100099D0 arg_0 = dword ptr 8
.txt2:100099D0
.txt2:100099D0 push esi
.txt2:100099D1 push offset unk_10064260
.txt2:100099D6 xor esi, esi
.txt2:100099D8 call sub_10011F1F
.txt2:100099DD push eax
.txt2:100099DE call sub_10011F43
.txt2:100099E3 add esp, 8
.txt2:100099E6 test eax, eax
.txt2:100099E8 jz short loc_10009A06
.txt2:100099EA call eax <== IsDebuggerPresent()
.txt2:100099EC mov esi, eax
.txt2:100099EE test si, si
.txt2:100099F1 jz short loc_10009A06
.txt2:100099F3 call sub_1000127A <== Meltice ???
.txt2:100099F8 mov si, ax
...
...

now this sub is called from

.txt2:10004560 sub_10004560 proc near
.txt2:10004560 push ebx
.txt2:10004561 mov ebx, [esp+arg_4]
.txt2:10004565 xor eax, eax
.txt2:10004567 push esi
.txt2:10004568 mov esi, [esp+4+arg_0]
.txt2:1000456C test ebx, 100h
.txt2:10004572 jbe short loc_10004586
.txt2:10004574 push esi
.txt2:10004575 call sub_100099D0 <== prev sub
.txt2:1000457A add esp, 4
.txt2:1000457D test ax, ax
.txt2:10004580 jnz loc_10004688
.txt2:10004586
.txt2:10004586 loc_10004586:
.txt2:10004586 test bl, 4
.txt2:10004589 jbe short loc_1000459D
.txt2:1000458B push esi
.txt2:1000458C call sub_100098D0
.txt2:10004591 add esp, 4
.txt2:10004594 test ax, ax
.txt2:10004597 jnz loc_10004688
.txt2:1000459D
.txt2:1000459D loc_1000459D:
.txt2:1000459D test bl, 8
.txt2:100045A0 jbe short loc_100045B4
.txt2:100045A2 push esi
.txt2:100045A3 call sub_10009800
.txt2:100045A8 add esp, 4
.txt2:100045AB test ax, ax
.txt2:100045AE jnz loc_10004688
.txt2:100045B4

is this the procedure you are talking about sintax ?? where all the checks are.. well i dont really seem to be getting anywhere do i..hmm....need to dwell on this more..

hehe, another night gone..:p

best regards
pasha
[yAtEs]
04-15-2003, 05:53 AM
I gave you this already,

10004560 <- different checks for each call, all should return 0!

10004608 E8 83 4E 00 00 call BCHK
1000461B E8 50 4D 00 00 call UnhandleExceptionFilter_Check
10004654 E8 D7 4A 00 00 call INT_1_Check

start from 10004560 and make sure you get to the bottom
w/o returning 1 for anything,

yates.
pasha
04-15-2003, 10:08 AM
greetz yates

holy cow, right you are..man this explains, i am now forgetting all the important details which ppl have told me :(..thnx yates, now for more drilling and finding out what the hell is happening with those checks...

thnx again

best regards
pasha
pasha
04-16-2003, 01:02 AM
greetz all

w000t...finally..finally..some good news and some bad news as well :(

good news is that i found out that the check was at the location

1000461B : Call UnhandledExceptionFilterCheck

and was positive all other tests (DR7, DR1, etc etc was negative with all the patches which all u ppl suggested)

the amazing part is i patched the unhandledexceptionfilter from 0xCC to 0x55 using a dll injection scheme. now, i know for sure that igi2.exe does not create any other process and hence the write will be permanent i thought..but NO..:o..the crazy thing is when i checked the detection routine the check for 0xCC was positive even tho i patched..then i knew numega was upto something and keep reinserting their 0xCC in every KeSwapContext i guess....

anyways now i tried splajs approach and patched ntice to rename kernel32!UnhandledExceptionFilter to kernel32!ZnhandledExceptionFilter...the amazing thing now was, all tests passed but the sd2 exe simply exited without any messagebox..

what i thus figured was, this patch to ntice was of no good and maybe it was messing around with ntice functioning and hence the functioning of the SEH chain itself. (btw i could see a hell lot of debugging messages inside of ntice "kernel32!ZnhandledExceptionFilter" thats the line that was printed a lots of times inside ntice console)

now that i know its all with this unhandledexceptionfilter, i am gonna try writing my KMD to hook KESwapContext and remodify the 0xcc to 0x55 everytime. so i wont be interferein with numega i think ...and maybe...maybe..for once god might shine some light into my room and give me salvation...:)

awaiting any pointers..and thnx a ton once again to all

best regards
pasha
SiNTAX
04-16-2003, 06:06 AM
If you have found the cc cmp instruction, then you can pass it using a BPM with a DO statement that sets the test to false.

e.g.

xxx CMP AL, 0xCC

BPM xxx DO "r al 1;x"

Not as nice, but it does the trick.
Manko
04-17-2003, 08:47 AM
...or read my thread on the UnHandledExceptionFilter issue... ;P

/Manko
pasha
04-17-2003, 12:15 PM
greetz Manko

thnx a ton mate..this was what i needed ..;)..btw u wont belive it..before i saw your thread, i was documenting the exact same in ntice.sys disassembly :p...now i will be using ur hard work :)

thnx once again..and may the lord have mercy upon me and show me some light once i finish this and try again..:)

thnx again..

best regards
pasha
pasha
04-17-2003, 01:25 PM
greetz manko

:(, i tried this one too, its a clean solution but the sd2 exe simply exits without any messagebox.

this is what i have --

1) all the checks in sd2 return 0 in ax and hence have no problems

2) secdrv.sys functions are properly executed without any problems.

3) i have the following patched and tested succesfully for my NTICE (DS 2.7)--

a) INT1-INT3 offset check via my KMD suggested by sintax
b) INT1 DPL check via my KMD
c) OpenServiceA check
d) CreateFileA/lcreat and other Meltice Variants
e) UnhandledExceptionFilter patch as suggested by Manko
f) DR7 patch as suggested by Yates
g) i dont make use of DR1-DR0 as suggested by Sintax and have faults off
h) INT 3 BCHK patched
j) INT 3 FJGM patched
i) Registry keys patched
j) NMTRANS.DLL patched
k) INT 41 debugger check patched

judging from no messagebox, all i can think of it is that sice checks have been thwarted successfully but there is something else going wrong which is causing the sd2 exe to exit abrubptly.

i really dont know what is happening here..why is the sd2 exe exiting abrubptly like this ?...any ideas ? (wonder what on earth sintax patched to make his working ....hmmm..;) )

best regards
pasha
SiNTAX
04-17-2003, 06:47 PM
Check the secdrv.sys function calls.
nikolatesla20
05-30-2003, 12:31 PM
Your int1 / int3 offset change is wrong. Sd2 checks to see if the distance between the entries is LESS THEN OR EQUAL to 1E, not greater. If it's less, is says there's a debugger. At least in the latest Sd2 I am looking at (Raven Shield).

I just simply patched the secdrv.sys file. I don't like messing with ntice.sys , I try to do as little as possible...

The way I did things is this: disasm the secdrv.sys with ida, and show the bytes. Find the routine that uses sidt. Search for the code bytes in memory in SI, they will always be there because the driver loads at boot. Put a bpx there and you can now modify this puppy on the fly to see how it works, when you go to run the game.

text:00010A80 0F 01 4D F8 sidt [ebp+var_8]
.text:00010A84 8B 45 FA mov eax, dword ptr [ebp+var_8+2]
.text:00010A87 83 C0 08 add eax, 8
.text:00010A8A 8B 18 mov ebx, [eax]
.text:00010A8C 83 C0 10 add eax, 10h
.text:00010A8F 8B 00 mov eax, [eax]
.text:00010A91 25 FF FF 00 00 and eax, 0FFFFh
.text:00010A96 81 E3 FF FF 00 00 and ebx, 0FFFFh
.text:00010A9C 2B C3 sub eax, ebx
.text:00010A9E 89 45 0C mov [ebp+arg_4], eax
.text:00010AA1 61 popa
.text:00010AA2 8B 45 0C mov eax, [ebp+arg_4]
.text:00010AA5 3D 00 01 00 00 cmp eax, 100h <-- if the value is below, it jumps "Bad guy"
.text:00010AAA 76 0B jbe short loc_10AB7 <--- Patch this to NOP's and recalc checksum, reboot.
.text:00010AAC 8B 45 10 mov eax, [ebp+arg_8]
.text:00010AA

Now my raven shield asks for the CD rom, so I can work from here on out, appears debug detection is disabled..(I also already edited the DR7 check in secdrv.sys too)

Hope that helps...

-nt20
pasha
05-30-2003, 08:56 PM
greetz nikola

never thought this thread would become active again but here it is ;)

thnx a lot for the reply will try and get back :)

best regards
pasha
aka
05-30-2003, 09:43 PM
Hi Manko,

How do i patch the registry and rename ntice.sys as you said. ?

I already patched 3 file. I download DAEMON' s sice_detection.

NtQuerySystemInformation trick, Do I have to use bp on NtQuerySystemInformation in debug ?

Thanks Manko
SiNTAX
06-02-2003, 08:29 AM
Originally posted by nikolatesla20
Your int1 / int3 offset change is wrong. Sd2 checks to see if the distance between the entries is LESS THEN OR EQUAL to 1E, not greater. If it's less, is says there's a debugger. At least in the latest Sd2 I am looking at (Raven Shield).

-nt20

Like I said.. check secdrv.sys function calls (function 3d in this case)


driverstuio 2.6 + sofice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > driverstuio 2.6 + sofice
PDA

View Full Version : driverstuio 2.6 + sofice

delcaos2
03-24-2003, 10:20 PM
hi everybody

im just a beginer, i install driver studio 2.6 , and softice, (i never worked whith the older versions), i want to know if there is a special setting under soft ice in order to set a bpx hmemcpy,?

because everytime i type bpx hmemcpy i get the answer: symbol not defined(hmemcpy)

and im just beginer, and i found a couple of exercises (to get more deeper in that art of reverse software engineering) but they need to set a bpx hmemcpy to be accomplish

my O.S. is windows xp pro

anny help gonna be greathfull
nikolatesla20
03-24-2003, 10:29 PM
Unfortunately, hmemcpy does not exist in Windows XP.

You will need to learn other methods instead. hmemcpy is only on Windows 98.

Welcome to our humble boards, - Also, please remember to read the FAQ and to use the Search feature !!!

-nt20
delcaos2
03-24-2003, 11:07 PM
tanks nikolatesla20,

i already do a searching about that and i undertand better now,
tanks,
btw
can you point me to some tutorial tacking about VB5 and p-code

because when i try to open an program whith
smartcheck give that mesage:
................... smartcheck is unable to provide substantial debbuging information for projects compiled to p-code.......

tanks
JMI
03-24-2003, 11:36 PM
delcaos2:

It is time that you learn that it is generally the practice here that you are expected to search, yourself, for answers BEFORE you ask a non-specific question. Failure to do so gets you reminders from others that this is what you should have done first. There is a search button at the top of each of the forums. If you use the search button and enter either "VBCode" or "P-code" you will find numerous prior threads with discussions of these issues.

If you really are looking for tuts then you need to learn how to search on the net. You also need to pay attention to the links at the bottom of the forum pages which will take you to various collections of tuts on many subjects. In short, I am trying to gently remind you that it is YOUR responsibility to make the effort to acquire the information you need. This is the exact reason you have ALREADY been told to "read the FAQ and to use the Search feature."

This is the place where, AFTER you do some homework and don't quite understand, you are supposted to ask questions which show the work you have ALREADY done and where you are still stuck.

Go to Krobar, or anticrack and look for tuts on your subjects. Use your search engine and enter "VB 5 + tuts" and again with "tuts + p-code." You will find what you need in several languages, THEN come back for help.

Regards.
delcaos2
03-24-2003, 11:41 PM
tank again

and sorry about posting questions that already has been answered,

i gonna keep attention about that

well ,searching time comes!!

tanks


Something Different.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Something Different.
PDA

View Full Version : Something Different.

peterg70
03-25-2003, 05:24 AM
I am looking at a program called chat watch. Looks like Blowfish protection.

I decieded to do it the easy way and went looking for a patch.
Current version is 2.5.2

Best I can find is 2.5.1

Since the patcher is using a generic patcher "File created by ScAEvoLa's PatchEngine" Then I though well why not find out how 2.5.1 was patched and do the same.

So reverse engineering the Patcher i.e. Something Different.

What happens when you have generated the patch and can't find the same software again. Your stuck if you can't reverse the patcher.

Anyone interested search for chat watcher to find the right patcher.

I wish people would list how they attacked a certain product so that other people can understand the method rather than a generic patch
Kilby
03-25-2003, 11:13 AM
You may get lucky by taking the patcher apart.

But all it is likely to tell you is that bytes at particular offsets where nopped.

If you strike really lucky the patcher will check the bytes before patching them, from that you may be able to assertain what instructions where patched.

However in reality that is likely to be less than useless as it is probably a jnz xxxx and theres many occurences of those in every app.

The only thing I can sensably suggest is to look for an site with the older version still available for download, then work from there.

Kilby...
squidge
03-25-2003, 03:37 PM
Kilby is right. Most patch engines simply create a CRC of the file and if it matches, they blatantly write over the old code with the patched code. This gives you nothing.

So what you need to do is fine version 2.5.1 on the 'net, download it, and then copy the exe somewhere before patching it, and afterwards find the differences using something like FC. One done, find the equivalent locations in the new file.
Iwarez
03-25-2003, 03:59 PM
Or have the fun reversing and patching it yourself?
Iwarez
03-25-2003, 04:09 PM
Well that was no fun :( Found and registered it within a few secs... Didn't even need to patch it.
peterg70
03-26-2003, 03:44 AM
@Iwarez

Not everything has to do with cracking but understanding.

I bypassed the protection in little time but the main aim I did it was to wonder if it was possible to work out from a previous version to do the next version.

Problem with this one is that its Visual basic 6.0. Still wish I had a decoder for CODE recovery for VB6.0. People call this a decompiler.

oh well

life goes on.
Kilby
03-26-2003, 04:00 AM
If you want somthing with the same protection over several versions I have a couple of products in the house like that.

Once I get the titles I will pass them on, meanwhile secure CRT and other vandyke products have the possibility of a generic patch if you want to try that.

Thought I like their products so much I actually buy them (now that I have a little money).

Kilby...
Iwarez
03-26-2003, 05:02 PM
So the fun was to look how someone else patched it the previous time and if it was possible to recreate the patch for the new version?
peterg70
03-27-2003, 04:40 AM
Why not.

Hell I look at weird shit but at I learnt something.

Sometimes the weirdest stuff will lead you to interesting stuff.


Flexlm 8.1a another challenge!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Flexlm 8.1a another challenge!
PDA

View Full Version : Flexlm 8.1a another challenge!

flyingsilicon
03-25-2003, 08:42 AM
sorry, the message has gone to Advanced forum.
FS.


K-Protean v1.0: anti-bpm, anti-bpx, anti-traced, anti-frogsice...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > K-Protean v1.0: anti-bpm, anti-bpx, anti-traced, anti-frogsice...
PDA

View Full Version : K-Protean v1.0: anti-bpm, anti-bpx, anti-traced, anti-frogsice...

ZaiRoN
03-25-2003, 05:42 PM
Hi All,
I have found this interesting crackme and I think it's suitable for this area.

The crackme package contains 3 files: an exe, a dll and a VxD. As you will have already understood it's not the usual boring name/serial crackme and as I said in the title, it has some tricks to make hard our life.

The two goals of the crackme are:
- remove a nag
- write a working keygen

The algo used by the crackme is very simple but this is not the aim of the crackme, the aim is to learn how the various tricks work. You will see that the way to reach the name/serial routine it's not very easy :-)
The 3 files are not packed and I have made nearly all the job only using IDA because... you will understand!

This might be an occasion for most of us to learn how seh, vxd and some anti-sice tricks work. For the moment I will not tell you other, I hope to see a beautiful project.
Good luck!!!

ZaiRoN
the_analyst
03-25-2003, 07:08 PM
Hello,

Its a bit late here, but im having a look at this crackme.
im running 2K, i cannot execute it, so im disassembling it.

So far i have seen one of the frog's ice detection code (if there are many, no idea yet), 2 or 3 parts of the name serial algo which as you mentioned, looks pretty straightforward.

I have seen something strange, but im too tired to think at the moment. (2am)

Regards,

Analyst
ZaiRoN
03-31-2003, 07:33 AM
Hi All,
I am curious for nature and only wanted to know whether someone is working to this project? Is it too easy, too difficult, too boring?
What is wrong with it?

Regards,
ZaiRoN
FoolFox
03-31-2003, 08:35 AM
Hello,

in fact i've some trouble to even make run it... and didn't
got so much free time those weeks, so didn't look for so
long....

I work on windows NT 4.... when I try to run it he gave
me: Process32Next entry point could not be found in
kernel32.dll.....

so i guess I would need either a w2k or a 98 to run it....

Regards
FoolFox
FoolFox
04-03-2003, 09:12 AM
Hi,

I'm trying with the death listing way......ahem.....

Just for curiosity, it look like to me that the _chkesp
function is just there to pass some debug info,
or does it have something to do with anti-debug ?
(waiting for an error on normal use, error have to be
handled to make the soft run correctly ??)

00401613 _chkespIfNotNull: ; CODE XREF: __chkespj
00401613 push ebp
00401614 mov ebp, esp
00401616 sub esp, 0
00401619 push eax
0040161A push edx
0040161B push ebx
0040161C push esi
0040161D push edi
0040161E push offset aTheValueOfEspW ; "The value of ESP was not properly saved"...
00401623 push offset unk_420058 ; module name
00401628 push 2Ah ; line number in source file
0040162A push offset aI386Chkesp_c ; name of source file
0040162F push 1 ; report type
00401631 call __CrtDbgReport
00401636 add esp, 14h
00401639 cmp eax, 1
0040163C jnz short loc_40163F
0040163E int 3 ; Trap to Debugger
0040163F

Regards
FoolFox

I have only formatted the code for a best view
ZaiRoN
04-03-2003, 04:37 PM
Hi FoolFox,
chkesp function has nothing to do with the protection routine, it's not an anti-debug trick!
As suggested by the name, the function checks that esp is valid on function return. The crackme is written using msvc++ and the compiler lets you to use a particular option: /GZ (Enable Stack Frame Run-Time Error Checking). If this option is setted, the compiler will add this function after every call.

Regards,
ZaiRoN
evaluator
04-04-2003, 11:34 AM
hi there..

after Dld, I become interesting, because it uses VXD & I expected
lot of crazy R0 trikO.. but then..
Oke, so this VXD just needed as BSOD-Messagebox :(

then I search&search for cryptor-decryptor code.. not found!
Then only I guess, calculation of Summ of input chars is decryptor??

IF (Summ of NOMRE's chars) - (Summ of CLAVE's) = 0A9h
THEN BSOD-registered

Or maybe there is some-any ultra-hidden check???
{Can't beleave dEar}

But very interesting is that VXDWriter! Where to find!?
FoolFox
04-08-2003, 06:14 AM
Hello ZaiRoN,

I'm still trying to figure it using death listing approach (missing
my debugger), and I'm currently trying to locate the anti-debug tricks...

I've found a call that may be a catch for a breakpoint that
could be set on GetDlgItemTextA....

0040BF20 loc_40BF20: ; DATA XREF: .text:0040C0C7o
0040BF20 mov ecx, dword_4237BC
0040BF26 push ecx
0040BF27 call sub_401005 <- checking if BP set on API GetDlgItemTextA ??
0040BF2C add esp, 4 (return eax=1 if bp set ??)
0040BF2F test eax, eax
0040BF31 jz short ReadUserEntry
0040BF33 mov esi, esp

If that's the case, this could be easily defeated by either
changin the jz 401430 to jmp short 40142c, or change the
mov eax,1 to mov eax,0.....

0040142A jz short loc_401430
0040142C xor eax, eax
0040142E jmp short loc_401435
00401430 ; ---------------------------------------------------------------------------
00401430
00401430 loc_401430: ; CODE XREF: sub_40101E+40Cj
00401430 mov eax, 1

I see that loc_401400 save all registers, make room on stack,
probably trying to check if a trap to debugger is done...

00401400 loc_401400: ; CODE XREF: sub_401005j
00401400 push ebp
00401401 mov ebp, esp
00401403 sub esp, 44h
00401406 push ebx
00401407 push esi
00401408 push edi
00401409 lea edi, [ebp+var_44]
0040140C mov ecx, 11h
00401411 mov eax, 0CCCCCCCCh
00401416 repe stosd
00401418 mov esi, [ebp+arg_4]
0040141B mov ah, 10h
0040141D add ah, 9
00401420 shl ah, 3
00401423 add ah, 4
00401426 mov al, [esi]
00401428 cmp al, ah
0040142A jz short loc_401430
0040142C xor eax, eax
0040142E jmp short loc_401435

but I can't figure how he catch this ??

Regards
FoolFox
ZaiRoN
04-08-2003, 10:27 AM
Hi FoolFox/evaluator,

FoolFox:
you are right, he is checking if bpx is been setted on GetDlgItemTextA.
Look at this:00401418 mov esi, [ebp+8] ; esi -> address first byte of the function
0040141B mov ah, 10h ; eax = CCCC10CCh
0040141D add ah, 9 ; eax = CCCC19CCh
00401420 shl ah, 3 ; eax = CCCCC8CCh
00401423 add ah, 4 ; eax = CCCCCCCCh, ah = CCh
00401426 mov al, [esi] ; al = first byte of function GetDlgItemTextA
00401428 cmp al, ah ; al = CCh ?
0040142A jz short loc_401430
0040142C xor eax, eax ; bpx not present: eax=0
0040142E jmp short loc_401435
00401430 mov eax, 1 ; bpx is present: eax=1He checks if the first byte of the GetDlgItemTextA routine is CCh. This byte is CCh if you have put a bpx on that function.

evaluator:
your analysis is correct. I know that it's too easy for you but don't you think it might be interesting for people with less experience? ;)

Regards,
ZaiRoN
FoolFox
04-10-2003, 01:50 AM
Thanks ZaiRoN,

much clearer now :)

Regards
FoolFox
ZaiRoN
05-24-2003, 02:12 PM
Hi,
I have found the solution I wrote some times ago for the crackme site.
It's only a final explanation; if someone has resolved the crackme in different way, he(she) can posts its solution and/or criticize mine :-)

Ciao,
ZaiRoN


Detach A Debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Detach A Debugger
PDA

View Full Version : Detach A Debugger

Ricardo Narvaja
03-26-2003, 03:28 AM
I try detach a debugger in this case OLLYDBG of the process in XP, read the Microsoft Info for the APIS used for this, DebugActiveProcesSStop with parameter the ID of the process for detach and DebugSetProcessKillOnExit, with parameter 0 for continue process after close OLLYDBG but don't function OLLY close and process exit always, what fails here?

Sorry for my bad english I speak spanish only.

Ricardo Narvaja
nofurs
03-26-2003, 04:58 AM
hmm wrong section this post shouldbe in TOT
Manko
03-26-2003, 05:47 AM
Originally posted by cluesurf
hmm wrong section this post shouldbe in TOT

Nah... It's not a question about Olly, it's a question of how to code antidebug code, sortof... (?) And that is not TOT, is it?

Anyway... Someone will hopefully answer with something usefull, because I can't...

/Manko
nofurs
03-26-2003, 08:36 AM
Hi,

I'm referring to Tools of the Trade forum.

maybe he's refering after using above api it doesn anti-ollydbg or the other way round... just a guess
Ricardo Narvaja
03-26-2003, 11:36 AM
I am not question for a tool only for the correct use of this apis, and if any have experience detaching any debugger or the process in any form, injecting code, or in any way, the forms i try not function at all, always close process when i close ollydbg, injecting a piece of code with this apis in a way microsoft suggest use this apis.

Ricardo Narvaja

Originally posted by cluesurf
Hi,

I'm referring to Tools of the Trade forum.

maybe he's refering after using above api it doesn anti-ollydbg or the other way round... just a guess
doug
03-31-2003, 08:14 PM
Are you trying to do some anti-debug trick?

something like: Copies itself into another process and continue executing from there.. is that what u want?

Also, what are the "APIs microsoft suggest" you're refering to?
Ricardo Narvaja
04-01-2003, 02:34 AM
No, no antidebugging, i study this only for cracking, if you make changes and detach teh debugger, RUN and in other point of program atach again you can crack better and antidebugging tricks, are less efective.

In the Microsoft page

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/appendix/hh/appendix/enhancements5_5ppv.asp

Quit and Detach
Windows XP makes it possible to debug a user-mode application and then detach the debugger, without killing the application.

And this

Control over Whether Terminating a Debugger Also Terminates the Process Being Debugged
Prior to Windows XP, terminating a debugger would always kill all processes being debugged by the debugger. The new DebugSetProcessKillOnExit routine allows a debugger to control this behavior and select either a detach or the default kill.

And this

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/debugsetprocesskillonexit.asp

DebugSetProcessKillOnExit

The DebugSetProcessKillOnExit function sets the action to be performed when the debugging thread exits.

BOOL DebugSetProcessKillOnExit(
BOOL KillOnExit
);

Parameters
KillOnExit
[in] If this parameter is TRUE, the debug thread will kill the process being debugged on exit. Otherwise, the debug thread will detach from the process being debugged on exit.
Return Values
If the function succeeds, the return value is nonzero.

If the function fails, the return value is zero. To get extended error information, call GetLastError.

Requirements
Client: Included in Windows XP.
Server: Included in Windows Server 2003.
Header: Declared in Winbase.h; include Windows.h.
Library: Use Kernel32.lib.

See Also
Basic Debugging Overview, Debugging Functions, DebugActiveProcessStop

And there are debuggers use this feature now

debugger WINE

http://www.winehq.com/hypermail/wine-patches/2002/02/0121.html

XP adds a few new debugging APIs. The most interesting is used to
detach the debugger from its debuggee(s) without actually killing the
debuggee.
this patch implements this (as well as two other untested features)

Patch the debugger for make this (detaching)

Ricardo Narvaja


Live DLL Injector.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Live DLL Injector.
PDA

View Full Version : Live DLL Injector.

nikolatesla20
03-26-2003, 09:27 AM
This is a quick and dirty tool based off of this thread:

http://www.woodmann.net/forum/showthread.php?s=&threadid=4577

I know injectors already exist, but hey you get my source code too, so there.

This is only the DLL injector part - you will still have to write the DLL yourself.

Of course I am going to expand this in the future (to correct PE header for me, to set up DLL for dumping, etc).

-nt20
the_analyst
03-26-2003, 10:41 AM
That's very kind of view to provide such a tool :)

Especially the way you made it. i used to be lazy about injecting dll into process spaces. i will certainly use your tool now :-)

Coding the dll isn't a problem at all.

Thanks for this handy tool. i will test it as soon as i have the time to!

Regards,

Analyst
sv
03-27-2003, 09:14 AM
Hi Analyst ;),nikolatesla20

Very nice & simple way !! at least for NTlike.
I'm going to change my injector :)
Thanks

SV


I need help for a Flexlm 8.1a target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I need help for a Flexlm 8.1a target
PDA

View Full Version : I need help for a Flexlm 8.1a target

flyingsilicon
03-26-2003, 03:31 PM
sorry!
Deleted after a while by writer.
dELTA
03-26-2003, 04:21 PM
Maybe it would have been better not to post 10 pages of practically uncommented code, shown that you had made any effort whatsoever yourself, and made the question a little more specific instead? ;)

Just a guess anyway... :rolleyes:

dELTA


Un-packing UPX packed exes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Un-packing UPX packed exes
PDA

View Full Version : Un-packing UPX packed exes

peter
03-26-2003, 04:24 PM
Im not sure were to post this as its a question reguarding Sice symbol loader and manual un-packing.

heres my problem, I am trying to manually un-pack a upx packed exe but when i try to load the module into Sice symbol loader i get a message saying problem translating module,load module anyway. So i load the module and Sice doesnt break. I have edited the PE characteristics section from upx0 E000080 to E000020 as it says in all the tuts that i have read,but the symbol loader still wont load the exe.

So my question is, is it a fault with my symbol loader or am i doing something wrong,i have followed every tut i can find on the subject but still no joy, also could any one tell me useful break points to use in Sice to find the OEP in UPX packed exes Thanx in advance

I am using Softice driver suite v2.7 on Win xp Home edition sp1
thanx again
Nebob
03-26-2003, 04:32 PM
upx -d yourfile.exe
squidge
03-26-2003, 04:38 PM
either that, or, if the header is mangled, use Ollydbg (freeware) and search for the jump. Shouldn't take more than 5 minutes to unpack and have it working. No need to use Softice on something as simple as UPX.
Gaia
03-26-2003, 04:45 PM
Better use Break & Enter of LordPe to break at entrypoint

Gaia
S3ri@l CoDe9x
03-26-2003, 06:20 PM
Enter Here:

hxxp://zor.org/krobar/ <---- remember change http

U were finding many tutoriales on upx ( In Unpacking Section)

Best Regards! :rolleyes:
Kilby
03-27-2003, 02:06 AM
Assuming that it really is packed with UPX.

An alternate methods is to use break & enter in lordpe for loading the target.

Kilby...
dELTA
03-28-2003, 04:50 AM
But on a more technical level (i.e., not just "use this and that and it will work"), what can cause an exe-file not to break on the first instruction in Softice, except the well known section characteristics trick (bug?)? It seems like such an elemenary thing to break on the first instruction in the program, so I simply cannot understand why Softice could have even the slightest problem doing this? Someone mentioned a "mangled header", could anyone elaborate on that?

Anyone?
Kilby
03-28-2003, 04:56 AM
Tyhe only reason I have come across for an .exe not to break is the section charisterics.

Though after multiple runs you may find that it will not break on loading, if this happens then disable all break points and try again (I think this is a bug in the loader).

Of course the thing is to be sure that's it's really UPX that has been used to pack the .exe.

As for the UPX scramblers, it just changed the .exe ehough to stop upx from unpacking the file.

Regards,

Kilby...
Shoob
03-30-2003, 02:10 PM
Its very easy with olly, set an bp on the oeip, jump with F9 to it and then dump the whole process. Change OEP to the new one. What i forgot in the past was to change the Base of Code and Base of Data in the Optional Header. Else Olly will tell you by dissambling, that Entry Point is outside the range. This fact is also not reported by any UPX tut.

Usefull BP is GetProcAdress. Dunno if anyone is interest in an little upx tut defeading with olly..
LOUZEW
03-30-2003, 02:35 PM
Hi,
Maybe it's not specific to your UPXed file !
There is a pb with DS 2.7 under XP SP1, if you're interested pm me your email !
squidge
03-30-2003, 03:43 PM
:confused:

I never changed the BOC or BOD in a UPX packed file as the entry point should be an RVA from image base anyway. So why does Ollydbg complain ? The resulting exe's work fine under both XP and 98, so I'm a little puzzled.
peter
03-31-2003, 01:53 AM
It is definetly packed with upx,as i have un-packed it with an un-packer. I just want to learn un-packing and as far as im aware upx is one of the easiest to start with. as i am a newbie to un-packing i thought id start with an easy one:D
Shoob
03-31-2003, 08:57 AM
Yes squidge you don't have to change the BOC and BOD the file will run without any errors. But i got the error "entry point is outside the code (as specified in the pe header)" under olly if i don't change the BOC to the Virtual Offset of UPX0 (.Code) and the BOD to the VO of UPX1(.Data).

I have probs at imprec, it fucked up the API imports so the fixed dump run, but the imported API's couldn't be resolved by win32dasm and olly. Any suggestions?. every api looks like kernel32.#307 etc.. With Revirgin all works fine.
squidge
03-31-2003, 01:22 PM
If this is till UPX, why are you bothering? No need for either imprec or Revirgin as the IAT is as virgin as they come :)
Shoob
03-31-2003, 03:02 PM
sorry i was to lazy to open an new thread. I know by upx packed files no need for rebuilding but for example Asprot, neolite its nessesary.

imprec is even a very good program but with this confusing iat rebuilding i cannot deal with it.
squidge
03-31-2003, 03:58 PM
Imprec can't handle the crap entries in Asprot'd progs though, so you either need to remove them before using imprec, or use Revirgin.
axle
09-25-2003, 07:28 PM
HI

My first post here :)

Anyways I'm also having problems breaking on the OEP of a UPX-packed file...I actually wrote my own "crackme" and then packed it with UPX 1.24w...I did actually manage to breakpoint on the OEP but only after much grief, (and I'm not exactly sure what I did differently when I was able to do finally do it). Most of the time it wouldn't break, but one or two times it did break (also I had no problems breaking on API's) on the OEP and I have no idea what I did different. Also somebody on this thread said that you don't need to rebuild the IAT after you dump the file, (if it was packed with UPX) but if that's true how come when I disassembled my crackme with w32dasm after I had dumped it, there were no import modules?

Anyways if anyone has any answere to these questions, I would MUCH appreciate it as this is very frustrating.
deedee
09-26-2003, 06:57 AM
maybe just right click on your exe to see if it's a read only file?


Is it possible to remove DMA from a program?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Is it possible to remove DMA from a program?
PDA

View Full Version : Is it possible to remove DMA from a program?

Aquatic
03-26-2003, 04:28 PM
DMA = Dynamic Memory Allocation.

All this time people have been trying to figure out ways of getting around DMA, but is it possible to actually go into the code and remove the instructions that cause the DMA? (just fill the DMA initializing code with nops).

In other words, I don't think that DMA "just happens out of the blue" it has to be a part of the actual code, there must be some code that tells the program to "use DMA", this is what needs to be removed and/or changed.

Essentially you would be castrating the program's ability to use DMA.

What is the feasibility of doing this?

Thanks :)
squidge
03-26-2003, 04:35 PM
Since most programs require it to function, the feasibility is very low, and in some cases, impossible.

Take for example a program that allocates 100 blocks of memory of 10kb in size each. These are dynamically allocated (as you describe). If you disable the programs ability to create these blocks, it needs to store them somewhere else, and the only other place is within the section table entry so that the pe loader will allocate and initialise them for you on program load. Much less efficient and uses much more memory than necessary as they are there all the time rather than only when needed.

Personally however, I think you are confused and need to learn more of WHY programs use it.

If this question however was a piss-take (hard to tell), then I admit I've biten the back end of the horse.
Aquatic
03-26-2003, 04:42 PM
Then I guess the only way to get around DMA is to create a memory map, becuase (I think) the location of values in memory always stay relative to eachother even when the program is restarted.

So, say you wanted to always read a specific value even when the game was restarted how would you do it? Would you use a known pointer and then go from there?
dELTA
03-26-2003, 04:45 PM
Well, if I haven't misunderstood you completely, it's about as easy as any other large scale modification of a program.

Certainly theoretically possible, but most likely very tedious and prone for mistakes.

You would have to locate all calls to dynamic memory operations (like allocations and deallocations) in the entire program, and replace them with your own code. This code would in turn practically have to be a complete dynamic memory system that operates on a "heap" that is based on a static buffer. This static buffer would in turn have to be allocated by you, probably by adding or modifying a section in the PE-file if you want to be completely free from external dynamic memory operations. :)

Do you have any programming experience with dynamic memory handling? Your post indicates that you might not have grasped the concept of dynamic memory allocation completely, but maybe I just don't understand what you mean. Please be a little more specific about what you want to accomplish, and more to the point why you want to do it, and I will hopefully be able understand (and help) you better.

dELTA
Aquatic
03-26-2003, 04:54 PM
Well, really I am more of a noob that is just asking "far out" questions. :p (hey it's the newbie forum!)

Well if one can't easily remove DMA, then perhaps you could learn how it works in terms of being able to predict how it is going to allocate memory. Is there any system that DMA uses to decide how it is going to allocate memory? Or is it all random?
dELTA
03-26-2003, 05:03 PM
Practically all dynamic memory systems use deterministic algorithms, but due to many reasons it is practically impossible to predict where a certain memory block will be allocated anyway.

The best thing would probably be to hook the allocation function, check if the caller is the one you're looking for, and in that case save the return value of the allocation function (the pointer to to the block). For this you would only need to know where the alloc function is called in the program, and it will the work fine.

But again, please explain what you are trying to accomplish, and why. It might very well exist a much easier way to do it.

dELTA
Aquatic
03-26-2003, 05:11 PM
Well basically it is just to create a game trainer that can always read a specific value such as "number of bullets" even when the game is restarted (DMA). However, I want to find a way of doing this without having to actually change any of the game code. Otherwise I would just store the value at the pointer into an empty address and then read that.

I know it doesn't really sound that exciting, but it is something I have been trying to do.
squidge
03-26-2003, 05:14 PM
If you are trying to track down "NumberOfLivesLeft" for example in some game, which would work no matter how many times you restarted, what you would normally do is lookup the process to find out where it's currently sitting in memory. Then find out where it stores all the pointers to it's allocated memory, and then look into those places for your data and modify it. Any process that allocated memory has to store the pointer somewhere, and whilst it's true that this pointer could be in further allocations, those have to be stored somewhere too, and the end result is that one of them will be in the programs data segment which will be a simple offset from the VA start address, and can be found quite easily. You can then traverse through the programs internal tables and eventually find the data your looking for.
dELTA
03-26-2003, 05:28 PM
Well, actually, the "final pointer" could also be a local variable of a function (hence located on the stack, possible not on the same address each time), but the probability is relatively high that you will be able to trace it all the way to the data section anyway. ;)

Also, for a bit more hands-on advice about how to do this:

1.
Search for the value in memory with your favorite game-trainer-utility.

2.
Put a read-breakpoint on this value's location.

3.
When the breakpoint goes off, note the address of the code that references it.

4.
Disassemble the executable containing this code in e.g. IDA, and analyze the code all the way back to the "final pointer". There might be more dynamic steps in the pointer chain which might require you to repeat this process several times before reaching the final location though.

dELTA
Kilby
03-27-2003, 02:17 AM
OK try here,

hxxp://sheeprec.cjb.net/

theres a tutorial on DMA.

Sheep knows his stuff and is pretty damned helpful, if you can track him down :)

Kilby...

(Can I have my money now sheep ?)
Kilby
03-27-2003, 02:18 AM
BTW

I recomend reading up on malloc, and also how sections in PE files work.

Regards,

Kilby...


launch.com hacking experiment
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > launch.com hacking experiment
PDA

View Full Version : launch.com hacking experiment

nikolatesla20
03-26-2003, 11:03 PM
For those familiar with Launch.com , this may be of interest.
This is just a little bit different of a reversing project than you may be used to.

After about 2 days, here are the results of my experiment.

Launch.com has a media player that only lets you skip songs 5 times, and it plays ads at certain intervals. I wanted to hack the player to form a local html file that sets up the player to play how >> I << want it to work. I've managed to succeed quite well so far.

I've removed both of the above limitations and set up a local player. I also removed the malfunctioning "player display", now it just displays the album cover art and the song's title. (Cool - I just changed the javascript to parse the XML coming back to strip out only what I wanted). It also gives me a nice skip button under the player. Some of the webpages still reference the original site (like for song playlists, etc). but most of the java code is now local.

This is set up to play the dance station and Launch, AND you will have to input your own username and userID. If you browse the the "title.html" code you will find the spots to change these. Actually, you don't even need a valid username, and the userID doesn't need to be valid unless you are trying to get accurate song info. The SongInfo code could not be changed and yet still work, since it's dynamic code - it comes from an ASP server on launch.com's end. But the javascript code locally does an XML transform on this code before displaying it, and this is where we can interject and modify it. In this case I only display the album art and song title and artist. This removes all the graphics and other javascript , which become broken anyway, because I'm loading most of the site from my hard drive.

One thing you will notice looking thru the code in title.html is that the website tracks everthing you listen to. I haven't gotten to removing this "feature" yet - although I did remove some of the tracking code.

Your mission is to try hacking this code to play the genre you are interested in, or you could just ignore this post :p

The player is in "title.html" and the info is still gotten from the main Launchcast.com website, except I modify the data before it gets sent to the songinfo window frame. The bulk of javascript is pretty much in title.html. In fact, I don't think any of the javascripts I've included are used, but they are there anyway - I was experimenting on how far I could go in rebuilding a local functioning version.

The nice thing is the title.html java code will now be local, and you can modify it to your liking, removing tracking, and skip restrictions, and ads (LOL it actually checks if an ad is playing - so I modded the code that if it sees and ad is playing, it simply calls doSkip() LOL ), and you name it.

Player.html is the main file that you want to open in your browser.

-nt20


tElock 0.9x modified/private
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > tElock 0.9x modified/private
PDA

View Full Version : tElock 0.9x modified/private

bedrock
03-27-2003, 04:02 AM
I am trying to unpack a target which has been packed with the subject (according to PEiD 0.8)

I am using DriverStudio 2.7 on WinXP SP1

I am also using IceExt by sten.

My target runs fine with no breakpoints set. As soon as I set a bpm OEP x i get a MessageBox saying

"CRC error! File content has been modified. If you run a system debugger, clear all breakpoints before running this program!"

I assume this is purely tElock detecting softice, but i dont understand what mechanism it is using (possibly int3)

Aswell as IceExt, i have also tried nticedump, ntall and a couple of things i found whilst using the search button at the top of the page from nikolatesla20:

http://www.woodmann.net/forum/showthread.php?s=&threadid=4419

http://www.woodmann.net/forum/showthread.php?s=&threadid=4031

None of these seem to let me set a bpm at OEP for my target so that i can dump it.

Maybe i am doing something wrong, if so then a pointer in the right direction would be helpful.

--
bedrock
the_analyst
03-27-2003, 05:43 AM
Hello,

BPM doesn't modify the program's code.
Especially not with an int 3. (BPX)

He might detect that you did set a bpm and kick your ass.
Though, i don't see why he would show such a message.
wtf CRC :-)

Maybe to confuse you a bit.

he could access the context of the app with "GetThreadContext"
or via SEH to read the context structure.
Then we could check if your DRx are set to 0, else, he would
show you such a message.

I guess he would also set your DRx to zero first somewhere to erase your bpm and make sure DRx are set to zero.

I think Soft ice in DS 2.7 prevent BPM erasing, he could detect you this way. not sure if it applies since it does work without bpm set though.

Anyway, i just woke up, and its just an idea.

Im off to take a shower :-)

Regards,

Analyst
bedrock
03-27-2003, 06:21 AM
Analyst, thanks for your info.

I've done some more searching and just been reading this thread

http://www.woodmann.net/forum/showthread.php?s=&threadid=2949

I'm afriad that I dont yet understand a lot of this though.

--
bedrock
Solomon
03-27-2003, 07:58 PM
Here is my suggestion:

Don't use BPM for tELock if you don't know where/when to set a BPM, coz tE uses debug registers to do anti-debug check. He uses debug registers to set 4 breakpoints in its own code and count it. So if you set BPM, the count will not be 4, then you will get crc error. The following quoted code snippet is the core part of this trick. You can set BPM after this. Obviously we can use BPINT3 to locate this trick.

001B:005BD07F POP EBP
001B:005BD080 LEA EAX,[EBP+46]
001B:005BD083 PUSH EAX
001B:005BD084 XOR EAX,EAX
001B:005BD086 PUSH DWORD PTR FS:[EAX]
001B:005BD089 MOV FS:[EAX],ESP //set up own exception handling frame
001B:005BD08C INT 3 //software breakpoint exception
001B:005BD08D NOP
001B:005BD08E MOV EAX,EAX
001B:005BD090 STC //1st hardware breakpoint here
001B:005BD091 NOP
001B:005BD092 LEA EAX,[EBX*2+00001234]
001B:005BD099 CLC //2nd hardware breakpoint here
001B:005BD09A NOP
001B:005BD09B SHR EBX,05
001B:005BD09E CLD //3rd hardware breakpoint here
001B:005BD09F NOP
001B:005BD0A0 ROL EAX,07
001B:005BD0A3 NOP //4th hardware breakpoint here
001B:005BD0A4 NOP
001B:005BD0A5 XOR EBX,EBX
001B:005BD0A7 DIV EBX //devide-by-zero exception
001B:005BD0A9 POP DWORD PTR FS:[0000] //will continue execution here after exception handling
001B:005BD0AF ADD ESP,04
001B:005BD0B2 MOV SI,4647
001B:005BD0B6 MOV DI,4A4D
001B:005BD0BA MOV AL,[EBP+00000099]
001B:005BD0C0 JMP 005BD161
//This is the entry point of own exception handler
001B:005BD0C5 MOV EAX,[ESP+04] //EXCEPTION_POINTERS.ExceptionRecord
001B:005BD0C9 MOV ECX,[ESP+0C] //EXCEPTION_POINTERS.ContextRecord
001B:005BD0CD INC DWORD PTR [ECX+000000B8]
001B:005BD0D3 MOV EAX,[EAX] //switch(ExceptionRecord->ExceptionCode)
001B:005BD0D5 CMP EAX,C0000094 //case EXCEPTION_INT_DIVIDE_BY_ZERO:
001B:005BD0DA JNZ 005BD100
001B:005BD0DC INC DWORD PTR [ECX+000000B8]
001B:005BD0E2 XOR EAX,EAX
001B:005BD0E4 AND [ECX+04],EAX //dr0 = 0
001B:005BD0E7 AND [ECX+08],EAX //dr1 = 0
001B:005BD0EA AND [ECX+0C],EAX //dr2 = 0
001B:005BD0ED AND [ECX+10],EAX //dr3 = 0
001B:005BD0F0 AND DWORD PTR [ECX+14],FFFF0FF0 //dr6 = FFFF0FF0
001B:005BD0F7 AND DWORD PTR [ECX+18],0000DC00 //dr7 = 0000DC00
001B:005BD0FE JMP 005BD160
001B:005BD100 CMP EAX,80000004 //case EXCEPTION_SINGLE_STEP:
001B:005BD105 JZ 005BD113
001B:005BD107 CMP EAX,80000003 //case EXCEPTION_BREAKPOINT:
001B:005BD10C JZ 005BD120
001B:005BD10E PUSH 01
001B:005BD110 POP EAX
001B:005BD111 JMP 005BD160
001B:005BD113 CALL 005BD119
001B:005BD118
001B:005BD119 POP EAX
001B:005BD11A INC BYTE PTR [EAX] //increase the number of hardware breakpoints
001B:005BD11C SUB EAX,EAX
001B:005BD11E JMP 005BD160

001B:005BD120 MOV EAX,[ECX+000000B4]
001B:005BD126 LEA EAX,[EAX+24]
001B:005BD129 MOV [ECX+04],EAX //dr0 = 005BD0A3
001B:005BD12C MOV EAX,[ECX+000000B4]
001B:005BD132 LEA EAX,[EAX+1F]
001B:005BD135 MOV [ECX+08],EAX //dr1 = 005BD09E
001B:005BD138 MOV EAX,[ECX+000000B4]
001B:005BD13E LEA EAX,[EAX+1A]
001B:005BD141 MOV [ECX+0C],EAX //dr2 = 005BD099
001B:005BD144 MOV EAX,[ECX+000000B4]
001B:005BD14A LEA EAX,[EAX+11]
001B:005BD14D MOV [ECX+10],EAX //dr3 = 005BD090
001B:005BD150 XOR EAX,EAX
001B:005BD152 AND DWORD PTR [ECX+14],FFFF0FF0 //dr6 = FFFF0FF0
001B:005BD159 MOV DWORD PTR [ECX+18],00000155 //dr7 = 00000155
001B:005BD160 RET
001B:005BD161 SUB AL,04 //AL = (number of hardware breakpoints - 4)
001B:005BD163 MOV [EBP+00000099],AL //for data decryption later

Use BPX instead. But don't set a BPX at the first instruction of Win32 API, coz tE checks whether it's 0xCC. You can set a BPX at the 2nd/3rd... instruction£¬ for example, BPX VirtualProtectEx+3
the_analyst
03-27-2003, 08:00 PM
Looks like i wasn't wrong :-)

Analyst


Wise Installers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Wise Installers
PDA

View Full Version : Wise Installers

eclipse2k2
03-27-2003, 05:26 AM
I'm reversing a dongle protected WISE installer, I have located the file to reverse and I have been able to reverse it using softice, the problem comes when I try to change the orginal file compiled in the installer with the one I have reversed, anyone know how to do it without having to rewrite the full installer?
Thank you in advance.
squidge
03-27-2003, 07:19 AM
Search the usual tool sites, there are many programs to do this.

Yes, I know "Searching" is alien amonst most of you, but it does bring rewards :)
eclipse2k2
03-27-2003, 10:59 AM
I have do it before with instalshield installers without problems cause there are tools to modify the cab files or lib files but WISE installers are packed in a single exe. (the only tools that I have found only unpack the contents, dont let you add or modify those files)
I finally could solve the problem downloading the trial version of wise package studio, adding the cracked file to generate an installer, and using the debug mode that comes with e_wise I could rip the packed file that I use to overwrite the packed exe in the original installer. Dirty, but worked fine. I had some extra problems cause the patched exe had diference size (bigger) than the original packed exe, so what I did was pack the cracked file with upx and I added extra data until I could make a file with the same file size. Really dirty, I know it, but now everything works fine.
squidge
03-27-2003, 12:23 PM
It is quite difficult to replace files in a single file WISE installer, but there is no need - you can extract all the files, modify the ones you want, and still end up with a wise installation package. Only difference is that it'll be a multiple file distribution archive instead of a single one.
disavowed
03-27-2003, 01:57 PM
Originally posted by squidge
Only difference is that it'll be a multiple file distribution archive instead of a single one.
that's what winzip is for ;)
squidge
03-27-2003, 05:24 PM
You mean the self extractor? :)
eclipse2k2
03-28-2003, 02:16 AM
I have read that WISE uses PK to compress the files in the installer, but taking a look to the compressed file I didn't found any PK/Zip signature so I decided to make an empty installer with the trial version of WISE with only the exe I had to include and then rip the compressed file from that installer and paste it to the installer I wanted to crack.
It worked fine this way but maybe somebody have a better solution to make it more polite.
Thanks to everybody for taking the time to help me. Really apreciated.


A new generic multipurpose patcher tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A new generic multipurpose patcher tool
PDA

View Full Version : A new generic multipurpose patcher tool

druvo
03-27-2003, 06:40 AM
Hello everybody,

A new generic multipurpose patcher "Patcher". The program can patch registery,files, processes, combinations of those... Currently the latest version is 0.9

The program can generate an exe file after the patches you had created.

Any comments or suggestions i would appreciate it very much at druvos@yahoo.com

P.S: the process patches can be generated but the code of running that kind of patch is yet still under implementation
S3ri@l CoDe9x
03-27-2003, 12:13 PM
Good Work! ....:p

Best Regards! :rolleyes:
druvo
03-28-2003, 03:14 PM
thank you S3ri@l CoDe9x,

i apreciate that

best regards for you too


2 ASPR old Tuts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 2 ASPR old Tuts
PDA

View Full Version : 2 ASPR old Tuts

LaBBa
03-27-2003, 04:05 PM
i posted at : new2cracking.cjb.net 2 old aspr tuts
an step by step tuts...
i'm sorry that i didn't post it before...

i must tnx u all ... because of u i know how to unpack ASPR
real g00d so this is 2 aspr tuts (old aspr )

and i will post also a step by step tut about how to unpack
ASPR 1.3 (the NeW) but this time with OllyDbg ..

i know i will say that i will post a step by step tut about
Flex but .. still no luck here ... ;)
maybe soon maybe later...

TNX ALL !!!
squidge
03-27-2003, 05:41 PM
You don't seem to have a method for finding the stolen bytes, or did I skim-read your documentation far to quickly? I was just interested whether or not you was using nikolatesla20's method, but it seems not.
Manko
03-28-2003, 01:58 AM
I'm looking forward to seeing your new tut, and have hopes it will not be another TraceX tut, as I feel those are becoming too numerous anyway... (Did I just put me foot in me mouth?)

/Manko
LaBBa
03-28-2003, 04:10 AM
"You don't seem to have a method for finding the stolen bytes, or did I skim-read your documentation far to quickly? I was just interested whether or not you was using nikolatesla20's method, but it seems not."

the new tut that i will post by using Olly as a Debugger will explain how to find the stolen bytes...
Manko
03-28-2003, 11:27 AM
Great, LaBBa!

I know many people have requested tuts on cracking with OllyDbg, and tackling aspr with Olly is even better! :)
Keep up the good work! Can't wait to see it! :)

/Manko
LOUZEW
03-28-2003, 12:51 PM
Hope we can read this new tutorial soon !
squidge
03-28-2003, 02:46 PM
It would be interesting to see the tut with Ollydbg, but I hope the "stolen bytes" recovery part isn't based on a signature search... Also, it would be nice to see if it works on the newer versions of Asprotect that destroy the stolen bytes by the time the program has got to OEP.
Iwarez
03-28-2003, 03:56 PM
That's also possible with olly, but I found it harder to do. I can't get olly to break on the memory although the location is known. :rolleyes: If I put a memory breakpoint I get bothered everytime aspr writes at that memory location which is a hell of a lot of times...
LaBBa
03-29-2003, 01:52 PM
Not like that !! there is an easy way !! u will see!


*slap* n00bie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > *slap* n00bie
PDA

View Full Version : *slap* n00bie

TrailerTrash
03-27-2003, 05:28 PM
I have checked the FAQ!!

After reviewing post on this board and being a begginer programer (7 monthes in class) I have decided to learn this "reverse engineering". My question comes accross as this:

What are some good tools to start out with, that are free?
-I searched FTP sites and google for SoftIce and a few others but no luck.
What is an easy project?
-I'm thinking about a few old shareware games to begin with.

If thier is something I missed please lemme no b/c I am a n00bie and I probaby deserve the flame/bash:(

BTW: Im not doing this to be "cool" or "elite":o

Thank you
~[]Trailer Trash[]~
squidge
03-27-2003, 05:46 PM
I'd start by downloading OllyDbg and a few simple programs such as dvd95copy and dvdxcopy. All these are free to download, and OllyDbg is free to use :)

Once you know Ollydbg well and have done some programs, then is the time to move onto SoftIce. Far too many beginning jump into softice first and then are totally confused as they've never seen assembler code before, let alone debugged or reversed it.

To be honest however, I only use SoftIce for one or two "tricky" situations where Ollydbg is useless, but that certainly isn't many!

Try and get your hands on a copy of IDA if possible. The demo version is perfectly fine for most people, and there is a cut-down freeware version too (but not on DataRescue's webpage). If you can find a full retail version that has not be butchered to death, then that is good to, just don't ask us where to get any of this stuff from.

I'd get a copy of PEID too - it's a file identifier. I find that reversing 32-bit PE file is far easier than the 16-bit programs (much easier to "debug" as many more programs support them). So unless your old shareware programs are 32-bit (PEID will tell you this), then I'd kick them into the trash for now.
TrailerTrash
03-27-2003, 06:33 PM
Got me PEID and OllyDbg, couldnt find anything else so I am going to look for some tut's and think of a easy project to try
Thanx!
Woodmann
03-27-2003, 07:47 PM
Hold up there sporty.......................:)

Wheres your hex-editor and Wdasm ?

If we are starting at the beginning.......

Also, find tuts that also have the target included.
It will make things so much easier then trying to apply
an old tut to a newer version.

Check out Krobar's site for newbie tuts.

Woodmann
the_analyst
03-27-2003, 07:47 PM
Hello,

While I totally agree with Squidge i would not put my hands
directly into the engine, and learn how it works first.

If you are planning to do learn reverse engineering,
i would advise you to LEARN assembly first.
By learning i don't mean understanding was a "cmp" does, nor what "jnz" does, but actually to code in assembly.

Even simple applications like the examples on Iczelion site are an invaluable help. As soon as you understand how to code some bit of assembly, how to call API, how you feeds them with parameters, where they return their values, what are the registers of an intel cpu, what they are used for and all the rest, you will find debugging and cracking a LOT easier because you actually understand what you are reading, and you won't end up patching every je/jne you find around a stupid error message without having a fucking clue about what's going on. That's what do 90% of nowadays newbies IMO.

I'd advise you to read main chapters of Art Of assembly (not the HLL version) and to get your hand on some win32asm programming with Iczlelion's site and examples.
Win32ASM (http://www.win32asm.cjb.net)

Wish you good luck.

Regards,

Analyst
evlncrn8
03-28-2003, 12:13 AM
need info / explainations on what asm code means ?

http://www.cs.nyu.edu/~yap/classes/machineOrg/helppc/helppc21.zip

download that...

http://www.cs.nyu.edu/~yap/classes/machineOrg/helppc/

the above link explains what it is and how to install...

its an old (dos based) program but its still VERY useful when beginning.
TrailerTrash
03-28-2003, 02:21 PM
Thanx for all your help guys, im going to the book stores tomorrow to get some things and read all the stuff in the links!
squidge
03-28-2003, 02:51 PM
I must agree with the "learn to program in asm first" part, as most of the programs that people hack now are not the simple "switch the jne/je jump" like they once were, they are more like rewrite a hole section of code (few hours tops), or spend days trying to find all the comparisons.

Recently, I "extended" the lifetime of a commercial compiler for an embedded Microcontroller, and the program was protected using SentinelLM. They used the challenge-response throughout the program with the license manager several hundred times. It was far easier to rewrite one of the sentinel routines and code my own response routine for there challenge rather than attempting to find all the comparisons.
xtra
03-28-2003, 03:06 PM
it's been a long time since i messing up some DOS games. i gotta learn some real cracking now. thanks for this valuable info for a newbie like me. i wish there were a sticky for a newbie . i m kinda lost in my path right now and need to find a dierction. asm, softice , Ollydbg . what is the first step for a compeltely nooob???

Thanx
squidge
03-28-2003, 03:18 PM
I'd say learning ASM is really the first thing - you'll be seeing it and working out what it does a lot, so need to be very familiar with it.
Aimless
03-31-2003, 02:17 AM
Learning ASM is definitely the way to go.

But I think more in terms of "reading" ASM rather than "coding" ASM.

And learning coding need not turn you into an expert cracker, necessarily.

A good thing would be to crack windows based programs rather than DOS based ones. 32-bit ones are the ones to look out for.

The verneable Winzip is the best to learn cracking. Start by searching for winzip version 5.0 and gradually move upwards to the 8.0 version.

Subsequently, try your hand and various "primitives" rather than specializing in one field (say, unpacking only). This will give you more insight to cracking than learning how to code ASM will ever do.

However, most importantly, enjoy yourself.

Have Phun
the_analyst
03-31-2003, 06:02 AM
Learning how to code in win32asm do help a damn lot.
you don't need to be expert in coding, just to know how to make simple files using API.

You will learn what an API is, how they take their parameters,
how they return their values.. the basis.

Then you can start to try your hand on targets as you mentionned.

Most newbies just bpx getwindowtexta just because they read to do so, without having any fucking clue about what does that api,
what it returns, what parameters it takes..

That's my point.

Understand how it works, then research on targets.


Armadillo Jump Fixer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Jump Fixer
PDA

View Full Version : Armadillo Jump Fixer

eSn-mIn
03-28-2003, 03:08 PM
I've decided to modify crusader's jump fixer, because in tables there are false entrys (if a byte 0xCC already existed), and his program patches all of them whereas there are times that code must be left as is..

So, I've attached this code that must be compiled for every unpacked file because type of jumps change from one to another version :/


SafeDisc v2 softice detection under 2k/XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SafeDisc v2 softice detection under 2k/XP
PDA

View Full Version : SafeDisc v2 softice detection under 2k/XP

pasha
03-28-2003, 06:58 PM
greetz all

i was playing around with a sd2 executable, and even tho i patched my driver studtio 2.7 against all detections, the sd2 exe simply exits without showing any messages.

SinTax originally posted an article back in 2002 that he had found a new detection scheme and also the antidote :)

Sintax or anyone else who knows this, can u plz help me out since its been a week where i have been trying to patch my ntice against detection..am getting a little desparate..:)

thnx in advance and hope to hear from someone soon.

best regards
pasha

(PS: SinTax i have priv msged u too..sorry bout that..plz dont be offended)
S3ri@l CoDe9x
03-28-2003, 11:14 PM
I really have a long time that i not unpacking :p

Well ..i attach 2 tools that maybe can help u .. One of them was created by +Splaj for PELock 1.05 and it's for IceDump ..the other (Universal Unprotector) it's great ! .. read the .NFO file ...

Best Regards! :rolleyes:
pasha
03-29-2003, 12:36 AM
greetz

i have already patched my DS 2.7 aganst all the methods as mentioned in the proggie u gave, also icedump is only in case of 9x and i am using 2k/xp.

thnkx a lot for the response though. hopefully someone (sintax !!!!..wake up plz :) ) will help me with this sd2 exe just exiting..:(

best regards
pasha
evlncrn8
03-29-2003, 03:55 AM
you dont get the 'unload your debugger and try again' msgbox?
pasha
03-29-2003, 10:47 AM
greetz

no, i dont get any msgbox, the exe simply exits.

that is exactly waht i am asking about. i know sintax faced the same problem sometime back.

best regards
pasha
LowF
03-29-2003, 01:27 PM
tried to set bpx on exitprocess and destroywindow such...

problay trace where it triggers


ExeProtector 1.37a
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ExeProtector 1.37a
PDA

View Full Version : ExeProtector 1.37a

axel
03-29-2003, 03:32 AM
Hi Guys,

Do you have some kind of information,tutorial or some tool, for defeat this protection.

I had look for all over the web for this ExeProtector 1.37a but all the links are broken.

Thnks

Axel
S3ri@l CoDe9x
03-29-2003, 03:16 PM
First one question .. u use the tool File Inspector? ... this shit it's really bad to identify packer/protector :p

Using PEiD ...download

hxxp://protools.cjb.net

Best Regards :rolleyes:


ASPR 1.3x OllyDbg Tut
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR 1.3x OllyDbg Tut
PDA

View Full Version : ASPR 1.3x OllyDbg Tut

LaBBa
03-29-2003, 05:26 PM
hi.. like i saied this is the OllyDbg tut about how to
unpack aspr 1.3x

if anyone can find in olly a better way to find the stolen bytes
plz post here...
squidge
03-29-2003, 05:57 PM
Not bad :)

I like your use of the trace/run trace feature, but do note that different versions of asprotect have a different amount of exceptions. It's safe to do multi-pass - in the first you find how many exceptions there are and in the second you can just do one less.

Other than that, It seems quite an informative tut, although I must admit to only read like ever 3rd word or so :)
LaBBa
03-30-2003, 11:33 AM
yea i know that but as i saied .. the last one is alwes with the same writing ..
Xor
jmp
pop

etc...
Manko
03-30-2003, 03:15 PM
Hi, Labbas!

Actually, the very last one, will not have a "eb 01" after the xor-thingie... :)

I'm guessing it was a typo? :)

NICE tut regardless! :)

Maybe you even taught Squidge a new trick? ;P

/Manko
squidge
03-30-2003, 03:38 PM
He did indeed :)

I never thought about using the tracer built into Olly for unpacking AsProtect apps, but the again I just prefer writing my own app instead of learning how to use someone elses :D
LaBBa
03-30-2003, 05:54 PM
well the hole command line of Olly is wierd !
i first tried to write like this :

TC IF(EIP>400000&&EIP<900000)

but it didn't work !

the hole command line method of Olly should change like that TRW2000 done.. they know that ppl are regular to SoftIce and they make it as easy as possible for ppl and show a more nice example with a BP command(in TrW2000 BP is also a trace command)

so plz .. if some one could make the Olly Command line more user friendly , it will be great !
xybyre
04-02-2003, 04:42 PM
LaBBa,

This is a nice tutorial! It's nice to find all the bits and pieces of unpacking asprotect in one neat package. The explanation of the stolen bytes was very well done!

On step 2, OllyDbg is breaking because of a memory access violation, not because it's loading a new module.

You didn't mention the three entries in the IAT that point to aspr functions. These need to be manually traced in the original program.

btw, a newer version is on their web site. (perhaps this is why you didn't mention those functions; they weren't in the old version?)

oh, I do have a recommendation for finding the stolen bytes! Set a trace condition where the command matches "REP STOS BYTE PTR ES:[EDI]" (use this instead of the eip<900000 condition). This will get you the missing bytes and also the OEP (just continue tracing a little further!) :)

btw, you can set trace conditions via the GUI instead of using the command line plugin. It's more user-friendly. ;)
LaBBa
04-03-2003, 01:22 AM
xybyer :
well u seem to have more expriance with aspr in olly then i do
so plz .. if u or anyone else that have spare time plz do a tut with more explanation that i (lame me) did.. :)

don't think for a moment that i know how to use Olly !
i just wanted to lern how to use Olly so i just writed a tut about
my lerning about unpacking in Olly...
i'm kinda New at this Olly thingy...
JMI
04-03-2003, 07:37 PM
A few random observations from my own adventures with Ollydbg on this project. First, thanks to LaBBa for getting me interested enough in his tutorial that I finally installed Ollydbg and tried it on this target. I do note a few points which seem to differ with his tut, but do not know whether they may be the result of the fact that he appears to be using XP and I am using Win2kSP3.

First a comment on xybyre suggestion to use "REP STOS BYTE PTR ES:[EDI]" as the trace condition. I tried using this condition and after more than 1 hour on my 2.5 ghz P4, it was still "tracing" and hadn't reached the "rep stos" point yet. Was much faster to use the EIP<900000.

Having reached that point and noted that EAX was 57e318, I decided to start the program and Olly again and this time trace until "EAX==0057e318". Again, this was very quick and it disclosed the code immediately below the:

012C532C 60 PUSHAD <--- Returns to here
012C532D 9C PUSHFD
012C532E FC CLD
012C532F BF 42532C01 MOV EDI,12C5342
012C5334 B9 53010000 MOV ECX,153
012C5339 F3:AA REP STOS BYTE PTR ES:[EDI]
012C533B 9D POPFD
012C533C 61 POPAD
012C533D -E9 19972BFF JMP 0057EA5B

which was erased by the REP STOS BYTE PTR ES:[EDI]. That code is:

012C5342 03C3 ADD EAX,EBX
012C5344 BB 0B000000 MOV EBX,0B
012C5349 0BDB OR EBX,EBX
012C534B 75 02 JNZ SHORT 012C534F
012C534D 50 PUSH EAX
012C534E C3 RETN
012C534F E8 00000000 CALL 012C5354
012C5354 5D POP EBP
012C5355 81ED E27F4900 SUB EBP,497FE2
012C535B 8D8D D07F4900 LEA ECX,DWORD PTR SS:[EBP+497FD0]
012C5361 2BC1 SUB EAX,ECX
012C5363 8985 CC7F4900 MOV DWORD PTR SS:[EBP+497FCC],EAX
012C5369 8D85 BA7F4900 LEA EAX,DWORD PTR SS:[EBP+497FBA]
012C536F 8D8D 23804900 LEA ECX,DWORD PTR SS:[EBP+498023]
012C5375 03CB ADD ECX,EBX
012C5377 8941 01 MOV DWORD PTR DS:[ECX+1],EAX
012C537A 8D85 D07F4900 LEA EAX,DWORD PTR SS:[EBP+497FD0]
012C5380 8D8D BE7F4900 LEA ECX,DWORD PTR SS:[EBP+497FBE]
012C5386 8901 MOV DWORD PTR DS:[ECX],EAX
012C5388 B8 53010000 MOV EAX,153
012C538D 8D8D C37F4900 LEA ECX,DWORD PTR SS:[EBP+497FC3]
012C5393 8901 MOV DWORD PTR DS:[ECX],EAX
012C5395 55 PUSH EBP
012C5396 8BEC MOV EBP,ESP
012C5398 83C4 F0 ADD ESP,-10
012C539B B8 18E35700 MOV EAX,57E318 <------
012C53A0 68 2C532C01 PUSH 12C532C
012C53A5 C3 RETN

You will notice that the third instruction from the bottom is the one that puts "57e318" into EAX, then pushes the address of the PUSHAD above, and returns. It then erases this subroutine.

I also noted a difference on the "stolen bytes" from what LaBBa reported, and again I don't know if this is a result of my OS. Using the search for "PUSH EBX, PUSH ESI, PUSH EDI" I arrived at:

012C8989 51 PUSH ECX
012C898A 51 PUSH ECX
012C898B 83EC 10 SUB ESP,10
012C898E 53 PUSH EBX
012C898F 56 PUSH ESI
012C8990 57 PUSH EDI
012C8991 64:A1 18000000 MOV EAX,DWORD PTR FS:[18]

While LaBBa reported his "stolen bytes" as "55,8b,ec,83,ec,54" + the MOV EAX 57e318 (or "b8 18 e3 57 00"), mine appear to be as shown above plus the MOV EAX 57e318. If anyone has an explaination, I would be interested. I am still studying the program to see if it will search again after finding the first instance of the search criteria. For those of you who might not know, because you didn't bother to search, there is an Ollydbg forum where there is alot of information on how to make the program work. I'm busy reading my way through when I have some spare time for playing.

Regards.
LaBBa
04-04-2003, 08:57 AM
i was wrong u ARE RIGHT !!

GooD JOB !

Next Time Write a tut for us :)
xybyre
04-04-2003, 11:28 AM
JMI,

hmm... that's odd. I just tried it again, and it takes 7 minutes on my P3 1.13 Ghz laptop (512 MB RAM, running in the background while I'm reading this forum). Did you bypass the two loops after the final exception (as described in the tut)?

Tight loops make a big difference when tracing. When it takes too long, you can pause the program (F12) and step through the code to make sure it's not in a loop. If it's in a loop, just run past the end of the loop (F4 on the next instruction) and continue tracing (alt-F11). This can speed up tracing when you are impatient.

I installed v 4.89 build 112. I wonder if that's making a difference? The stolen bytes for this version are different as well.

LaBBa,

Please don't get defensive because of our comments/suggestions. You wrote a very good tutorial, and we were only trying to point out some things you could change to make it better. It takes a lot of knowledge, time, and effort to write a tutorial, so we greatly appreciate your contribution. :)
JMI
04-04-2003, 11:57 AM
xybyre:

I don't think LaBBa was being defensive, note the smilie face. I certainly wasn't criticising his work because I wasn't sure whether or not the difference in the "stolen bytes" was the result of the different OS used or not. I don't see how he could have extracted the code he shows in the tut and it be "incorrect" unless there are more than one place where the "PUSH EBX, PUSH ESI, PUSH EDI" appears. I don't yet know how to do a "search again" in Ollydbg or whether or not it is even possible.

It is possible that I was too quick when I reloaded the target and reset Ollydbg before I tried the trace with "REP STOS BYTE PTR ES:[EDI]". I'll check it again when I have time. Also I used the Command-line rather than the GUI condition trace, and that might make the difference. For me the program "never" stopped "tracing" before I simply stopped after about an hour, but as I stated, this is my own first attempts with Ollydbg and I'm still "learning the ropes."

I was working with v 4.89 build 110, like LaBBA, but have downloaded build 112 for "testing" later, when time permits.
By the way, using Imprec 4.2+ I got 27 "unresolved" API's, many fewer than with the older version LaBBa used, which is available by SEARCHING the net.

Regards.
xybyre
04-04-2003, 02:09 PM
When I searched for "PUSH EBX, PUSH ESI, PUSH EDI", I got many matches (you can press "ctrl-L" to search again). I'm not sure if it's possible to retrieve the stolen bytes that way, though. Aren't they written only once, executed, and then overwritten? If so, then a search through memory after reaching OEP wouldn't find them. Then again, I'm not too familiar with this protection, so I'm probably wrong. :p

There are two options for tracing via the GUI: "trace into" and "trace over". I believe the "TC" command does a "trace into", since "trace over" would skip over all function calls.

I used Revirgin 1.5.1 to rebuild the imports. It got everything except for GetModuleHandleA (if I remember correctly) and those other three you have to manually trace.
Hopcode
04-04-2003, 03:32 PM
Hey!

Nice tutorial LaBBa.
It misses some more explainations though.
you say for example to use : TC EIP < 900000 or something
but you don't explain why.

A newbie might want to know why you selected this command and why it works. I think the idea is to teach them how it works, and so, they will be able to make such nice tutorials themselves a bit later.

Just beeing critical, and its not meant to be harsh.
But for you other tutorials, please add more explainatations on why you do / try things so the others will be able to think the good way, when they encounter a new protector.

Thanks for making tutorials on olly though

HopCode!
JMI
04-05-2003, 04:00 AM
On further reflection:

After reading xybyre's reply and now knowing how to search again (Ctrl+L; and it helps to read the Quick Start list of "menu functions" before one starts, Duh!) I also found many instances containing the "PUSH EBX, PUSH ESI, PUSH EDI" series. I believe the problem was in the assumption, taken from LaBBa's Tut, that this string would indicate one of the forms of "stolen bytes" described as his "way" number 2, which was described as:
Stolen+Bytes_1
Stolen+Bytes_2
Stolen+Bytes_3
PUSH EBX
PUSH ESI
PUSH EDI
. . . .
. . . .
. . . .
REPZ STOSB
POPFD
POPAD
JMP_TO_OEP

Based upon the code that was contained in the subroutine erased by the "REPZ STOSB" target, this appears to be an incorrect assumption. Most of the instances of "PUSH EBX, PUSH ESI, PUSH EDI" in this target appear to be connected to API's, if one looks a little further down in the code below them.

I believe the "Stolen_Bytes" are contained in the bottom section of the subroutine which is erased by the "REPZ STOSB" and, interestingly, LaBBa had this information correctly identified for his discussion of an earlier version of this target, found in http://www.woodmann.net/forum/showthread.php?threadid=4576

There he reported, for v4.88 build 106, that:

in ASPR Striper XP 1.25 it says :
"Found 0bh stolen bytes"

i found also 0bh stolen bytes...

55,8b --- 2
ec,83,c4,f0 --- 4
b8,8c,bd,57,00 --- 5
-----------------------------------
total == 11 == 0Bh
. . . . . . . . . . . . . . . . .

You will notice that his first 6 bytes are:
55 PUSH EBP
8BEC MOV EBP,ESP
83C4 F0 ADD ESP,-10

Followed by the address "Moved" into EAX:

b8 8cbd5700 MOV EAX 0057bd8c

For v 4.89 build 110, only the address "Moved" into EAX changed to 57E318, so the instruction changes to:

B8 18E35700

[remember the address is shown in the hex listing (and in the hex editor) "reversed" byte by byte.
0057E318 is in the file as "18E35700"]

Put these together and you get:

55 PUSH EBP
8BEC MOV EBP,ESP
83C4 F0 ADD ESP,-10
B8 18E35700 MOV EAX 0057e318

Which just happens to be the code I found by tracing until EAX==57e318, shown above in my prior post as:

012C5395 55 PUSH EBP
012C5396 8BEC MOV EBP,ESP
012C5398 83C4 F0 ADD ESP,-10
012C539B B8 18E35700 MOV EAX,57E318 <------

So I believe that these are the correct "stolen_bytes", which when put with the POPFD, POPAD, JMP_to_OEP becomes:

55 PUSH EBP
8BEC MOV EBP,ESP
83C4 F0 ADD ESP,-10
B8 18E35700 MOV EAX 0057e318
9D POPFD
61 POPAD
-E9 19972BFF JMP 0057EA5B

We appear to have a "convenient" hole in the file, of 11 bytes (B hex) before address 57EA5B in which to put "55,8B,EC,83,C4,F0,B8,18,E3,57,00" and then, as LaBBa says, we have to adjust the OEP back these 11 (B hex) bytes to
57EA50 and our "stolen_bytes" should be back in place.

Tomorrow, I'll check the build 112, to see if the "stolen_bytes" are the same and whether the MOV EAX address and OEP are changed again, which I suspect will be true.

So, again, the technique for finding these "stolen_bytes" is to follow LaBBa's steps to get to the OEP and write down the address shown in EAX (in this case 0057E318). Then close the target and Ollydbg, restart the target, restart Ollydbg, follow LaBBa's steps to the end, except, instead of tracing to EIP<900000 (which is a search for code outside of the usual range of the ASPR wrapper, use EAX==[value_found_in_EAX], which in this build was 0057E318.

This will give you the "erased" code section shown in my prior post here (at least for this build) and should give you the code until this procedure of hiding the stolen_bytes is changed.

Regards.


question about crussader's tut on arma
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > question about crussader's tut on arma
PDA

View Full Version : question about crussader's tut on arma

kyrios
03-30-2003, 11:59 AM
Hi mr Crusssader,

recently i read your tut about arma. I can follow the tut until INT3 fixing. I'm stucked on this part.
I can see this code after loop process (few lines below)

005DFDD5 8D 95 28 F7 FF FF lea edx, [ebp+Context]
005DFDDB 52 push edx
005DFDDC A1 58 BA 5E 00 mov eax, ds:table_2
005DFDE1 03 85 20 F7 FF FF add eax, [ebp+relative_location] ; location in table_1 where eip is found
005DFDE7 8A 08 mov cl, [eax]
005DFDE9 51 push ecx
005DFDEA E8 24 12 00 00 call Get_Jump_Type ; determine which kind of Jump it is
005DFDEF 83 C4 08 add esp, 8
005DFDF2 25 FF 00 00 00 and eax, 0FFh
005DFDF7 85 C0 test eax, eax
bla..bla..bla....

My Q is how to reach to this line. I tried to F8 or F10 but I always got read process error. and the target is quit.

And please tell me how, where and when to dump the 4 tables cause in your tut you forgot to write about it. The how Q must be use /dump feature, am i right?
About where Q, i tried to look at ds:table_2 / ds:table_3 /ds:table4 but i only saw mostly 00 bytes. So it must be not the correct table which i looking for.

Sorry for my poor english mr Crus.

TIA,
kyrios


SintAX ;), some help plz with this sd2 sice detection under 2k/xp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SintAX ;), some help plz with this sd2 sice detection under 2k/xp
PDA

View Full Version : SintAX ;), some help plz with this sd2 sice detection under 2k/xp

pasha
03-30-2003, 06:45 PM
greetz all

sorry to be bothering all of you. its only that i have tried my best and patched ntice against all possible detection methods. i have securom, peshiled, pelocknt and other stuff working fine except for safedisc 2 exes :(. would love to know the antidote which sintax found for his woes sometime back.

as i said, the sd2 exes simply exit without display of any messages. i have breakpointed on KiUserExceptionDispatcher, ExitProcess, RtlUnwind and what not to see where the hell the problem was, but to no avail :(.. hope sintax can just type in a few lines for me :)

awaiting a reply..

best regards
pasha
doug
03-31-2003, 07:56 PM
i'm sorry, i don't want to be offensive in the comment i will say..
But i've noticed you posted half a dozen questions (all in diff threads) on avoiding anti-softice tricks.. and it is clear that most of them are related to safedisc2.. maybe you should search more still..
or try an easier target before.. and come back to this one later on once you have gained more experience?
pasha
03-31-2003, 08:23 PM
greetz

where better to search than this place :). point taken master, shall hone my skillz further

best regards
pasha
Shoob
04-01-2003, 09:42 AM
Pour passer les protections anti-débuggeur, la solution la plus simple consiste cacher notre débuggeur (SoftIce) à l'aide de
programmes bien sympathiques comme par exemple FrogsIce (de Frog's Print). Ce programme rend inefficace les routines de détections.
Les techniques de détection de SafeDisc étant quasiment resté identiques entre les versions, vous pouvez toujours utiliser le preset
"C-Dilla SafeDisc" dans FrogsIce (facultatif, car le mode par défaut marche bien aussi). Pour information, les routines de détections
utilisées sont les suivantes:
- API Test_Debug_Installed / IsDebuggerPresent
- MeltIce (avec \\.\SICE et \\.\SIWVID)
- INT 68h
FrogsIce passe très bien toutes ces protections. Un gros merci au passage à Frog's Print pour son magnifique travail. (A noter que
vous pouvez aussi utiliser IceDump comme anti-détecteur.)

remarks several things: it contains
anti-softice routines which are cryptes, which means taht you will not be
able to modify
these ant-softice routines on the disc in order to neutralize then
definitvely. instead you will not
find the code of these routines in the file since this code is crypted. a solution consists in coding a function
which modifies the code in memory after the function of decoding finished its work but the things become
complicated singulartly when you have multi-crypted code (for the studied case, this is however feasible). to
pass anti-debugger protections the simpletest solution consists to hide our debugger (softice) using programs sympathetic
nevers such as for exmple FrogsIce. this program makes ineffective routines of detection the techniques of detection of
safedisk having almost remaned identical between the versions you can always use the preset c-dilla
safedisk. in forgsice (optinal because the mode by defect well also goes).

for example the routines of detection
used are as follows: API Test_Debug_Installed/ IsDebuggerPresent - MeltIce

(with SICE and SIWVID) - INT 68h FrogsICe
passes all those protections very well. a large thank you with the passage

to frog's print for its splendid work. (it should
be noted that you can also use icedump as anti-detector) still a general remark after launching the loader will
decipher these routines of protection and will charge them in memory like a process with share. in addition these
routines remain used througout the execution of the main program (game).

Two cut's of execellent SD2 tuts. I hope that you have the needed original cd to decrypt the code!

good look..

pps: the lower you post, the more results you will gain ;) (yes my english sucks heh.)
SiNTAX
04-01-2003, 03:03 PM
Originally posted by pasha
would love to know the antidote which sintax found for his woes sometime back.

Alot of hard work, sweat and tears. Anyway the best way to learn is by doing it yourself. If you get stuck, then think.. if you really get stuck, ask for advice.

As for tutorials.. don't read 'em beforehand, spoils part of the fun..

Hmm this sounds like something out of a FAQ.. maybe I should use that 'search' button and find out.. ohwell I'll just ask.. it's easier :)


reversing a 16-bits dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > reversing a 16-bits dll
PDA

View Full Version : reversing a 16-bits dll

efy
04-01-2003, 03:36 AM
Here is my prob
I've to use a dll that controls a mesure machine. that dll isn't documented at all.
The thing is that it is an old dos dll 16 bits, and tools like dependncy walker do not work
all i've found is light tuts, and nothing really about how to do this with an old dll.
So if some1 could show me the way, that would be nice
Efy
naides
04-01-2003, 05:07 AM
Well, I can only tell you that I share your pain. If you look my few previous posts you would know I have been there.

-Doubt you will find a lot of help in tutors. Most serious protection and reversing started in the Win32 era. The few docs I found dealt mostly with disk based protections, which were very fashionable in late 80's early 90's.

- dissasm and tracing 16bit dlls is laborious, but not impossible. You have to revisit the segment: offset model memory, to keep from getting lost.

-To simplify things, try to narrow down the export function or functions you are dealing with, and their internal and external dependencies. You have to do it by hand, but usually, these .dll are relatively small, less than 100 Kb.

Before diving into code: search carefully the manufacturers of the instrument you are dealing with. If you are lucky, they may have updated the drivers and interphase software to a win32 platform.

Sorry I can not be more helpful, unless you have a more detailed/specific question
efy
04-01-2003, 05:18 AM
The size is Ok, it's about 5 ko
The thing is that i've never done that before, and i absolutly don't know how to begin
This dll is used to pilot a com port that is linked with a mesure machine. The people that are using this machine want not to go through the software developped by the constructor of the machine
this software is tsap, a dendrologic soft
and the dll can be found here muetes.free.fr/projo
Anyway thx naides :)
Efy
naides
04-01-2003, 06:04 AM
OK efy.

To begin, you should spell out what YOU want to do with the .dll: Do you want to change the behavoir of some function(s)?
emulate it?
Rewrite it?

I quickly looked at a dissasm of your dll and it does not export any functions (damn!). So your app loads it and refers to its code by ofset. This complicates things a little.
You need to learn how the .dll is loaded and how your app gets the address to call or jump into your .dll code.

Is the main exe of the program also 16 bit? if not, dissasembling the main exe and looking at the areas where your .dll code get called can be quite informative.

judging by the size of the .dll, it contains only a few functions, and 30% of the space is taken by 00, probably buffers for I/O communications.
efy
04-01-2003, 06:18 AM
I would like to know the functions written in this dll, to use it in another apps
I quickly looked to the exe files (packed) it's 16 bits to
It's exactly that, it's the dll used to communicate with the mesure machine
squidge
04-01-2003, 06:27 AM
Like naides' says though, you need to disassemble the program that currently talks to it, in order to figure out what functions it supports and how to use them.

Or you could possibly by-pass the DLL and communicate to the machine directly by snooping the comms with the original software and RE that?
efy
04-01-2003, 06:34 AM
I already tried that, but this gave me weird results, like two differents mesures after a reboot :confused: .
that's why i look how does this dll work
tgodd
04-01-2003, 10:44 PM
Alot of these old machines, as well as many new ones are
controlled by PLC's (Programable logic controllers).

It would be easier to reverse the code in the Controller.

I would suggest you find out which controller is being used
and find some documentaion on it.

Regards,

tgodd


16 bit code inside W1nd0se XP Kernel
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > 16 bit code inside W1nd0se XP Kernel
PDA

View Full Version : 16 bit code inside W1nd0se XP Kernel

naides
04-01-2003, 05:25 AM
This post is out of curiosity.

I been tracing certain app that contains several 16 bit modules.
What arouse my curiosity is that I often find myself tracing through 16 bit code WITHIN the winXP kernel.dll. This is sort of unusual, and I thought all the latest (XP) Win code was 32bit.

Since win98 phased out I had not seen 16 bit code inside win system dlls.
Does anyone seen or have more info on this?
squidge
04-01-2003, 06:28 AM
Are you sure this 16-bit code isn't just a thunk layer to the 32-bit code in order to provide backward compatibility?


Tutorial for Ollydbg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tutorial for Ollydbg
PDA

View Full Version : Tutorial for Ollydbg

MrSmith
04-02-2003, 02:58 AM
Hi,

I wrote a tutorial how to use Ollydbg, but I'm not sure how and where to post it.

Any advice ?

MrSmith
Manko
04-02-2003, 04:53 AM
Hi!

I'm not one to judge these things, but if you post it here as an attachment, I think it would be good...

(...or maybe in newbie cracking, if it's a beginners guide...?)

/Manko
FoolFox
04-02-2003, 05:01 AM
Hello,

...or send it directly to woodmann, like that your essay
will be added to the tutorial section of the board.

Regards
FoolFox


Linux Lice Debugger - A request....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Linux Lice Debugger - A request....
PDA

View Full Version : Linux Lice Debugger - A request....

Zero
04-02-2003, 02:59 AM
This is a "little" request:

There is a debugger "Lice" (http://www.ltrix.com/) for Linux OS.
Actually it is not possible to download a trial of it (only on request).

For the next codebreakers magazine (codebreakers.anticrack.de) I need somebody who has tested this tool and who could write one or two pages for the Tool Reviews section.

Anybody here who can help ?

(This is NO warez request ! I don´t want to have this tool, I only need a review of it!)

thx to all
Zero
SiNTAX
04-02-2003, 02:05 PM
What's wrong with gdb?
squidge
04-02-2003, 04:35 PM
Everyone knows GDB, so I suppose he wants something a little different for his mag.

Don't see why Zero can't just email them however and ask for a review copy.
Zero
04-03-2003, 12:50 AM
Lice seems to have some nice features which makes it close to SI.
And yes, I will ask them, but I am afraid that they will give me a copy (even a trial) ;)


Armadillo License Management How To...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo License Management How To...
PDA

View Full Version : Armadillo License Management How To...

crusher
04-03-2003, 02:24 PM
Hi

my question is preliminary

Is there any other methods for an app protected with Armadillo 2.20 and unwilling to run without a proper name/key pair to decrypt except implementing the key generation algorithm and issuing a brute-force attack with some speculations on plaintext?

that is, is the license management involved in encryption key generation, with a hash created from token data used for keygen, for instance?

Regards

crusher
S3ri@l CoDe9x
04-04-2003, 02:46 AM
Visit this link

hxxp://exetools.com/forum/showthread.php?s=&threadid=1848 <-- remember change http

Download this program... in NFO instructions ..The method has for cracking this type of protections not if it works with the version 2.20 ... I treat with 2.65 and I do not work ..

good luck! :p

Best Regards! :rolleyes:
bart
04-04-2003, 11:06 AM
yeah, unpack it and write emulator of armadll.dll (all apis are available in arma docs).
nikolatesla20
04-04-2003, 11:08 AM
how can you unpack it if it's unwilling to run

huh?

:p

-nt20
bart
04-04-2003, 11:13 AM
buy it :rolleyes: ?
crusher
04-04-2003, 11:58 AM
i wouldn't buy it as it sells for $500 :)
I mostly can dump an Armadilloed app when I am able to let not only the Armadillo code to work :)
any answer regarding the original question?
I'm wondering about LICENSE MANAGEMENT not ENCRYPTION.
thanks


.fuckMut section and OLESCMLOCKMUTEX - ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > .fuckMut section and OLESCMLOCKMUTEX - ???
PDA

View Full Version : .fuckMut section and OLESCMLOCKMUTEX - ???

crusher
04-03-2003, 02:31 PM
I have an exe previously prot'd with tElock 0.8 and after unpacking I noticed a special section called .fuckMut which contains the entry point.
It issues a call to CreateMutexA function with 3rd parameter as constant 'OLESCMLOCKMUTEX' defined in ole32.dll.
Does anyone have any ideas about what this can be (if it is generic either) and more stressed on that constant?
I did not find anything in W32 API help files nor on MSDN.

Any help would be greatly appreciated.
Kayaker
04-04-2003, 12:18 AM
Hi

What is your app running that uses OLE? I can see this mutex-object name OLESCMLOCKMUTEX being used as part of a normal Object Linking process, many apps may call it and the system usage of that particular object name increments. It may use it with one of the Wait functions.

There seems to be a number of this class of CreateMutex object names, a quick search sees reference to them being used with several processes including Explore.exe, IExplorer.exe, winvnc.exe, outpost.exe and others of that ilk (Winsock2Protocol). You'd have to get into Ole programming references to see how they are used in normal programming though,
OLESCMLOCKMUTEX
OLESCMSRVREGLISTMUTEX
OLESCMGETHANDLEMUTEX
OLESCMROTMUTEX

The question is, is the app using it as part of its normal function or is it really trying to .fuckMut?

A common use of CreateMutex is to find if another instance of your application is running, GetLastError returns ERROR_ALREADY_EXISTS, but you'd use a unique object-name and not a system defined one. Your app may be messing with Ole (calling home?), but where does the .fuckMut come from, tElock or the apps protection?

Kayaker
evaluator
04-04-2003, 10:43 AM
tsss.. Kay..

This guy unpacked tElocked EXE with WKT's unpacker;
Just for kiddi, WKT replaces tElock's section with this one (OEP is hidden).

This guy needs to find only OEP & then strip this section.
bart
04-04-2003, 10:57 AM
Mutex object is created in telock's loader code, and then its checked in application code, if its already created, that means application is protected (just read telock doc's), and WKT unpacker add emulation of telock's loader. I wouldnt remove it from the unpacked application :)
crusher
04-04-2003, 11:46 AM
Hi

yeah Bart gave me the right answer thanks :)
I knew nothing about tElock in general and tried to manually unpack it with no success. then I used WKT's tElock dumper, whereas I also tried to strip section with must-be-correct OEP but it locked up :)
thanks for notes on tE!'s protector and WKT's unprotector, now I think I should see some sources and docs :)
thanks
Kayaker
04-04-2003, 01:03 PM
Ahaahhh...., Interesting ;-) That's a clever strategy, create a mutex object in the loader code and check if it's still there in the application, if it's not then presumably the app has been messed with and unpacked...

But, why use what appears to be a system defined mutex name OLESCMLOCKMUTEX that may already exist in the system and has a usage count? (other than trying to hide what is going on) Where is the discrimination between the kernel object created by the loader and the one with the same name created by for example Explorer.exe? In other words, how does the application 'know' it's been unpacked (if that is the purpose) simply by calling CreateMutex with this non-unique object-name?

Actually you're right, from the tElock docs this is indeed what is going on, a use of the old ERROR_ALREADY_EXISTS trick for detecting multiple instances, and it seems the programmer him/herself chooses the Mutex name to use. Still, it seems this might be a bad choice of names unless I'm missing the point here. If you use Handle.exe by Mark Russinovich (Sysinternals) and run it on your system you'll probably find at least one existing reference to that particular mutex object name OLESCMLOCKMUTEX

i.e.
EXPLORER.EXE pid: FFFF9DCB
4: Process EXPLORER.EXE(FFFF9DCB)
8: Mutex OLESCMLOCKMUTEX
...

Bingo, so unless the app can discriminate between the mutex created by tELock and the one created by Explorer it seems this tactic is going to fail, again because the name is NON-unique and apparently that's the whole point of how tELock implements it.

??
evaluator
04-04-2003, 02:26 PM
I did not know about that possibilities of
telock!!
Sorry!

I also not see such like prog, uses this kind of check. NoSorry here:)

Point me..
bart
04-04-2003, 02:47 PM
Several apps protected with telock uses this trick, eg. polish double telocked SafeLock

http://www.safelock.prv.pl/

MultiSys

http://www.vojtas.fr.pl/
crusher
04-04-2003, 04:46 PM
it appears to be that mutexes belong to processes - that is, for me at least (under w98) many processes seem to have their own OLESCMLOCKMUTEX...
I should install an XP first (needed anyway because of CreateRemoteThread...) and check this then.
better - my app has TWO mutexes by the same name :) really funny :)


a new crptor/pakcer is out!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > a new crptor/pakcer is out!!
PDA

View Full Version : a new crptor/pakcer is out!!

thematrix
04-05-2003, 04:09 AM
i a new paker is out
it crashes all the cracking tools like softice,procdump,w32dasm
no tool is working if its running it crashes procdump if its in memory when the program is running
the program encrypted with this pcker is:-
cd shield se 1
download link:-
http://mindestworx.free.fr/CDSEsetup-trial.exe
hope to see this bitch fucked by a good unpcker
thanks
bart
04-05-2003, 05:49 AM
I didnt notice that :), import table can be easily rebuilded using imprec...
Manko
04-05-2003, 08:24 AM
hi, thematrix!

Search this forum and you will learn ways to hide better your softice... About the other tools... They can be hidden too, but even easier is to not let the program be in running state when you use tools...

I have to admit at first glance, I dunno what this is...

I just get an illegal copy message when I try to run it...

Is that what happens when run crackertools?

...or does it crash when those are found? Hmm...

Hmm... gonna check more later perhaps... Hmm...

/Manko
Manko
04-05-2003, 08:50 AM
It seems to mostly just close down crackerapps...
also it uses isdebuggerpresent and i saw a int 68... tss..

I'm far to lazy to do this right...

/Manko
thematrix
04-05-2003, 09:49 AM
yeah this pcker firstly does not run when softice is running and even using frogice to hide softice
and when u run procdump to try unpacking it ot crashes procdump
and iwth w32dasm it again crashes w32dasm
so how to unpack the file?:(
hope some expert help me doing this
thanks
Manko
04-05-2003, 10:58 AM
I can run SoftIce without any problem. You have to patch SI to become, invisible... (almost) Search on board!

Have you tried icedump? (Though there are now plenty tricks to see it too...)

He probably checks for frogsice, and then you're dead... :(

Tricking w32dasm is easy, IDA is better...
Though disassembling it will give you nothing as it is packed...

You should never use procdump unless process is paused...

I guess I'll have to make a cd to practice this protection on... (ok I make a virtual one... no waste CDs...)

/Manko
Manko
04-05-2003, 11:30 AM
Strange protection... It breaks my app, lets it run with any protected CD (I might be wrong.) and enlarges it almost 1meg... :(

/Manko
Shoob
04-05-2003, 11:44 AM
i found an entry point in the CDSE exe. file but its only about the text section that could be dumped the rest is losed. file about 1,4 kb. ive fixed the image size with lordpe and the file icon comes back. i didn't get the iat thats a prob.. maybe manually rebulding it. Look at the attach. im to lazy to check out the cd protector :D but this file looks like an new petite version. In fact the latest petite versions were that easy :rolleyes:

ive tried the exe protector also but it did nothing to a file ?? strange
squidge
04-05-2003, 12:39 PM
Protected files are left in CDShield's "Ready" directory, along with some other files. There's a #cdsh.dat file containing the following:

ZW8BzHV6HRPtOAYUS5EeXiGCozGQrXxuQegA3P3QbA6cE/cSG/ZfbCrPkSKE00KQh2rvDvqE
rfWk+B/x7zJjXWpaeC+k7wWPnPBqWUeGHfBDAyHCFVLMvUilYwedrk2976O3nu7I+tZmeark8y/Op0dAckYRPN+XFSFaB5rvkFrCxILGhNr2qTUtXWs4buPuSuBxmf5hpL1f3gDkIK3ZVQFR//ZRK8EMcqq2LqOyN1RJdiF0Y+Y+WJBh0hK8McL2wIuHYJ//926Amt8QpPqPjdVBEvXTEpUMLDHLWauTgoUTRR4tfB8vFeV1S2ItSruQszpn6oST2Sd7ou1KUj22VrRpy0a9pB3ab4AiMFva36pVDCk=

Which looks to me like some kind of RSA key, although I could be wrong.

There's also a file called "#<progname>" where <progname> is the file you protected. This seems to be simply an encrypted version of your entire original file. The file size is identical to the file you protected. Maybe the cdsh.dat file is the key for decrypting or encrypting the file?

Looking at the newly protected file, I see "Compressed by Petite (c)1999 Ian Luck.", and PEID says it's protected by Yoda's Cryptor.

I'm going to have to do more research on this after I've got my current projects out of the way. Surely the "Petite" business and the "Yoda's Cryptor" signature is bogus to fool us unpackers?

In the middle of the file, you can see a VS_VERSION_INFO structure, which seems to mean that it could be a standard exe joined onto a encrypted file?

Also, at the end is the following strings:

~0049.tmp
MyApp
STANDALONE

I can see that ~0049.tmp does get created in my temp directory upon running the protected file, and it's 300kb, the date and time are exactly the time the protected app was executed, but the VS_VERSION_INFO states that it's a plug-in for MultiMedia builder.

Strange...

Ok, Just checked out the files it creates every time app is run and they are the following:

Squash Productions - Enhancing MMB!
Systools Plugin for MMB

Why is a protector using MMB?!
dELTA
04-06-2003, 06:00 PM
What is MMB in the first place? :)
squidge
04-07-2003, 02:23 AM
MMB - MultiMedia Builder.
Shoob
04-08-2003, 10:08 AM
Ok a little suggestion: (not finally cracked!)

target notepad.exe (wxy.geocities.com/freetryin2000/)

1. Open the protected file with ollydgb and click away the whole error msges (out of pe header, compressed file).

2. Toggle Breakpoint on Import at GetProcAdress (if you know how to use olly you know how to set breakpoints on apis!).

3. Press Shift+F9 until the stack window show (yes there will be an out of pe header error be - ignore).

ProcNameOrOrdinal = "IsDebuggerPresent"

trace with F8 until you are in the main code.

you are @ 52869D trace to 52869F and set an jmp.

you are @ 5286A9 trace to 5286B3 and set an jmp.

at 52870B you return with F8 to 52873E

4. Set an Breakpoint on Pushad at 52875C and press shift + F9

wot the code after 528768 is lost hehe.

trace to 528766 and take a jump into the bath of 00's.

5. Press 2 times shift+F8 and you are in the ntdll thread.

Ok Press F8 until you are in the main NOTEPAD thread again.

....

Scroll down ... to 52411C and set an breakpoint on it.

(im to lazy to explain this whole loops and jump heh)

SHIFT+F9 will you bring you there.

6. Press F8 you are now at the OEP. The the whole code is red, isnt it? :P because of replacing the whole code with the decrypted one...

Don't move, start LordPE and select out notepad task with the left and rightclick -> CorrectImageSize.

rightclick again -> dump full.

7. Close LordPE but dont close Olly.

=========================
The Imprec way
///////////////////

start Imprec, click to the Active process and enter the OEP

4913F0 -
400000

= 913F0 enter it. Click on IAT Auto Search, the on Get Imports.

voila there are all valid sections.

Close Olly and Fix Dump(dumped.exe) file.

Open your dumped_.exe file whit peditor and change the oep to 913F0.

Open Sections, look at raw offset from text and code.

Change your Base of Code to: 1000
Change your Base of Data to: C6000

Save exit done.
================================

The revirgin way
////////////////////

Open revirgin and select your notepad task.

enter OEP: 913F0
RVA: B8FFC
Size: 750

click IAT resolver, lenght shoud be 118 now.

Close olly, open the original notepad.exe with peditor and have a look at the size of image 12A000 enter it into RVA at revirgin under IT Values + generator. Click on generate.

Select you dumped file. and safe the table as dump.bin or whatever else lol.

Open the .bin and the dumped exe file in a hex editor and select the first 4 bytes from the .bin file. Copy them to the clipboard and search for them in you dumped.exe, you will gladly have an result at 12A000. Go back to you .bin file and press CTRL+A to select everything, now CTRL+C.

Back in your dumped.exe go before you bytes 18A1 and hold the left mouse button, scroll down until the end of the file.
Now press ctrl+v to paste your iat and replace the old one.

Save your dumped.exe again. Exit your hex editor.

Open your dumped.exe file with peditor and change the oep to 913F0.

Open Sections, look at raw offset from text and code.

Change your Base of Code to: 1000
Change your Base of Data to: C6000

Save exit done.
=======================================

Problem: Don't work so YOU should help :P

Open with Olly: Ok all seems fine..

Start: Bang! msacm32.drv -> "Corrupted Stand alone file (1)"

There must be an crc check somewhere :rolleyes:

:confused:

- I had a look at 43148B where it shows "STANDALONE" a from from MMBuilder as well ...
Zilot
04-12-2003, 03:59 AM
Part 1

Yes, this is Petite, but I don't know which version because I've never had bussiness with it, and now I was intrigued.

OEP is 4913F0 and was pretty easy to find that. Even PeId could do that.

And after fixing IAT (what was again very easy to find) seemed everything was OK. But after starting there were several ugly messages. Something about standalone file.

There was maybe possibility to inspect for conditions about jumping over messageboxes with warning, but after sometime I realized that is uselles bussiness.

What is the tricky part. I don't know if anyone noticed that ImpRec wonted work if CD-shield runs ????? (That was with me) and that was maybe the first trap. And then I started to thing what can be that about standalone. And got him. Protected file has at the end one section, but is not marked and it starts at

Section start -----------> B6600

and ends at

Section end ------------>173931
Zilot
04-12-2003, 04:07 AM
Part 2

And unpacker checks for information stored there. And he doesn't check for

particular address, just takes the end of a file, and it is base address for forward

checks. Why he does that, because cracker will as usual attach IAT at the end of a

file and there will be for sure error during unpacked works. But also in dumped that

part wasn't saved. So everything that must be done is to save that section on disk

(with Lord Pe), first of course you have to add section header in original file with

size=BD332, and start in B6600.

After that in dumped with fixed IAT as usual you have just to load new section from

the disk previously saved. And after than BUM !!
Proggie is working :D , but is still unregistered :mad:

BTW there is no CRC or so.

Here in section I talked about.

Soldat :p
Zilot
04-12-2003, 04:11 AM
Section is splited

Part 1
Zilot
04-12-2003, 04:13 AM
Part 2
Zilot
04-12-2003, 04:15 AM
Part 3
Zilot
04-12-2003, 04:17 AM
Part 4

(no more)
Shoob
04-13-2003, 04:15 AM
but is not marked and it starts at

Section start -----------> B6600

and ends at

Section end ------------>173931

i've only got that XX and CD-Shield sections what do you mean with one section? don't see any unmarked section.
Zilot
04-13-2003, 09:40 AM
You have to add new section header with above borders, and that is what I attached. You can do it as I said with LordPe, and after that you'll have _NewSection after CD-Shield, this new one is actually unmarked, and you have to mark it just to load to HDD.

Soldat


Crypkey??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Crypkey??
PDA

View Full Version : Crypkey??

hobferret
04-05-2003, 01:58 PM
Hi everyone.

In the forum I found someone mentioning the Crypkey Sitekey Generator, downloadable from the Crypkey website. :)

Anyone willing to point me in the right direction coz all I can find there is the Crypkey instant demo, nothing at all about a sitekey generator:confused:

Hope someone can help - thanks in advance;)

/hobferret
04/05/2003
squidge
04-05-2003, 03:22 PM
The sitekey generator is included with the SDK, which you can download from Crypkey Canada if your a registered user.

If your not registered, there are plenty of sites which mirror the SDK/etc, but don't advertise the fact. However, these sites are quite easy to find with a good search engine such as google.

Please however, don't ask for links to these sites (even via PM).


Help with unpacking, plz ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with unpacking, plz ?
PDA

View Full Version : Help with unpacking, plz ?

Friky
04-05-2003, 04:09 PM
Packed with : Titanium v3 from Bit-Arts
Link : h**p://www.inet.hr/~tkresoja/fusion3.zip
Size : 2.59 MB

Hello ppl!

Sorry, i'm newbie in unpacking ...

Can u guys guide me thru unpacking Fusion v3 ? (packed with Titanium V3)
I have Win 2k, DS 2.7 with ds_2_7_patches from Lunar_Dust and IceExt...
But, still can't run app while SI running.
I've debugged and when i'm on 04E73CD, next step is SI closed ... ?! wtf ?

Thx very much!

Btw, i know it's been cracked by HeathCliff (Contact me man plz, at fr1c(remove_this)@aris.ffk.hr !), but, need help on just unpacking it.

-
Laterz,
Woodmann
04-05-2003, 06:36 PM
http://www.woodmann.net/forum/search.php?action=showresults&searchid=49271&sortby=lastpost&sortorder=descending

Read and learn please.


Hacking games for spare time
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Hacking games for spare time
PDA

View Full Version : Hacking games for spare time

dELTA
04-07-2003, 06:02 PM
At the following URL you can find a bunch of hacking games (mostly covering web authentication):

http://quiz.ngsec.biz:8080/

If you have some spare time and feel like brushing up on these subjects, it can be quite fun.

dELTA


dll-in-the-middle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > dll-in-the-middle
PDA

View Full Version : dll-in-the-middle

mike
04-08-2003, 12:17 AM
Anyone know of a tool to automatically generate spy dll's? I.e. you give it a dll, it generates another one with the same exports but all they do is record the parameters and pass the call on to the real one?

Thx
squidge
04-08-2003, 02:47 AM
How do you know how many parameters there are to each export, and whether the parameters are pointers to strings etc? DLL do not export this information without a good disassembler such as IDA.
Darren
04-08-2003, 08:22 AM
No doubt this could help with working out the parameters
sent to the functions

http://www.binary-soft.com/dll2lib/dll2lib.htm


Loading a second exe from memory(not from disk)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Loading a second exe from memory(not from disk)
PDA

View Full Version : Loading a second exe from memory(not from disk)

Piron
04-08-2003, 03:56 AM
Hi,

I am writing this message here because my idea works like a loader/unpacker and working styles of them can help me :

Problem is this : I am writing a program tha will load a second one but I want to load it from one of my resurce files. I write code to load exe from resource to memory and getting a pointer for beginning of it. No problem with it.

I am using createprocess to load an exe with same name and same size (all same I just copy it to disk but this has a different window header to see which is working).

I looked exe with wdasm and I see that imagebase is 51000000
I don' understand this. I write this exe with delpgi and 00400000 is set in delphi?? I ignored it.

I used create_suspended for not starting exe. And after that I use a writeprocessmemory to write from resourcefiles beginning to 51000000 but I get error 487 , I tried to put a virtualprotectex but I am getting an error of 87.

So what can I do ?

I found a software that called thinstall; It uses a virtual directory,
packes all your files into one exe, hooks apicalls to load files and if they are in it's virtual directory it is loading them from there. That is very near what I want but program is nearly $750 and that is too much for me. there is not a crack or a serial for it. It checks serial with an internet connection. Too much for me. I write to programmers of it but they said they can not help me....

I am adding code bellow to see what hell is it ....

Is anyone has idea (with a sample) about how this works ??

unit Unit1;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls;

type
TForm1 = class(TForm)
Button1: TButton;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;

var
Form1: TForm1;

function GetResourceAsPointer(ResName: pchar; ResType: pchar;out Size: longword): pointer;

implementation

{$R *.dfm}
{$R c:\test\test.RES}

procedure TForm1.Button1Click(Sender: TObject);
Var
path:string;
// Res: TResourceStream;
res:Pchar;
StartInfo : TStartupInfo;
ProcInfo : TProcessInformation;

tamam:boolean;
WrittenBytes: Cardinal;

ResSize: Longword;
oldattr: longword;
aaa:variant;
lpMsgBuf:string;
begin
GetDir(0,Path);

res:=GetResourceAsPointer('TESTFILE', PChar('EXEFILE'), ResSize);

FillChar(StartInfo,SizeOf(TStartupInfo),#0);
FillChar(ProcInfo,SizeOf(TProcessInformation),#0);
StartInfo.cb := SizeOf(TStartupInfo);

Tamam := CreateProcess( PChar('LOOP_TEST.EXE'), nil, nil, nil,False,
CREATE_SUSPENDED+NORMAL_PRIORITY_CLASS,
nil, nil, StartInfo, ProcInfo);

tamam:=VirtualProtectEx(ProcInfo.hProcess ,nil,4096,PAGE_READWRITE,pointer(oldattr));

aaa:=GetLastError();

tamam:=true;

If tamam=true Then
Begin
Tamam:=False;

tamam:=WriteProcessMemory(ProcInfo.hProcess ,Pointer($51000000),res,resSize,WrittenBytes );
//I get an error of 87 invalid arguments here

aaa:=GetLastError();

// tamam:=VirtualProtectEx(ProcInfo.hProcess ,Pointer($51000000),resSize,PAGE_EXECUTE,pointer(oldattr));

// tamam:=WriteProcessMemory(ProcInfo.hProcess ,Pointer($51000000),res,resSize,WrittenBytes );
//I get an error of 487 invalid adres here

If tamam=true Then
ResumeThread(ProcInfo.hThread );

CloseHandle(ProcInfo.hProcess);
CloseHandle(ProcInfo.hThread);

End;

end;

function GetResourceAsPointer(ResName: pchar; ResType: pchar;out Size: longword): pointer;
var
InfoBlock: HRSRC;
GlobalMemoryBlock: HGLOBAL;
begin
InfoBlock := FindResource(hInstance, resname, restype);
if InfoBlock = 0 then
raise Exception.Create(SysErrorMessage(GetLastError));
size := SizeofResource(hInstance, InfoBlock);
if size = 0 then
raise Exception.Create(SysErrorMessage(GetLastError));
GlobalMemoryBlock := LoadResource(hInstance, InfoBlock);
if GlobalMemoryBlock = 0 then
raise Exception.Create(SysErrorMessage(GetLastError));
Result := LockResource(GlobalMemoryBlock);
if Result = nil then
raise Exception.Create(SysErrorMessage(GetLastError));
end;

end.
dELTA
04-08-2003, 05:53 PM
Judging from your post, you're way in over your head, and it would be too complicated to explain it all. The only tip I can give you at this point is to read up on Windows processes and the PE-file format. Also, it's not a good idea to post large amounts of uncommented code like that, it will just make people ignore your posts.

dELTA
Piron
04-09-2003, 01:34 AM
I agree with you, but I need a solution for this problem. I read a lot about windows processes and memory management but they are not telling too much about my problem.

There are many document about how to make a patch or building an unpacker in crack or hack sites but they are just making 2-4 byte differences in a process's location.

They are not changing full data on virtual adress space .

I am open for other ideas,too....

sorry for long message with source.....


Rename NTice service. SuperHidden! :P
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Rename NTice service. SuperHidden! :P
PDA

View Full Version : Rename NTice service. SuperHidden! :P

Manko
04-09-2003, 01:40 AM
Hi, all!

I guess this is nothing new to most of you, but...

Someone once posted a small sicedetecter that using ntquerysysteminformation got a basepointer to something that contained, among other things, the names of all (?) services and just scanned through them and found NTice, even though I had hidden it with Nicolatesla20s patch...

Also now Soldat told me that armadillo uses openservice to find out if we have NTice service running. (I have not done armadillo ever yet. Believe it or not.)

Someone once, when i was even more of a newbie, said you have to deal with these things on a case by case basis. While that is very true, many times for many reasons, I never liked that answer... So I thought about this simple idea, but only just now actually tried it.

Anyway, I just tested yesterday to rename the service, rename all important occurances in the registry and rename all affected textstrings in the 3 important sice-files... (Those usually patched. Not actually all three though... One didn't contain the strings... I think...)

It worked ofcourse. Now sice is superhidden! :)

Just remember that if you have patched it before, you ofcourse need to find ZTice aswell as NTice. Don't forget, search BOTH unicase and c-style textstrings! ;)
(And use same length on names...)

/Manko
nikolatesla20
04-09-2003, 07:12 AM
Yes, armadillo does use this technique - they use OpenServiceA with "ServicesActive".

It's quite easy to defeat on it own however :)

-nt20
Manko
04-09-2003, 07:23 AM
Hi, NicolaTesla20!

Yup. I tried it out as soon as he told me. Pretty easy to beat.

But don't you agree that it's pretty good not having to bother? :)

/Manko
doug
04-09-2003, 03:18 PM
hmm..

I thought u had to register a driver to get it up as a service.
Or is that handled automagically by ntice each time it loads?

I was looking into that recently (I posted the get ntice base thingie on this board), but ran out of free time. I mean, I did try once to modify the registry strings; and I concluded it was probably not the best option (as I ended up with a messed up softice:p) to modify the service name.

That shields softice against another detection trick.. but you're still helpless against tricks like star-force use - they completely override the int1/int3 to its own exception handler (thus any bpx/bpm/single step results in their exception handler to be dispatched).
Anyone saw/defeated a similar trick?
nikolatesla20
04-09-2003, 03:52 PM
Well,

Such a protection would be easy to defeat in my opinion, just stick the orginal SI entries into the IDT again....

I'm sure someone will write a driver that watches the IDT and restores it when it messed with. Perhaps using guard pages... :)

-nt20
doug
04-09-2003, 06:03 PM
Such a protection would be easy to defeat in my opinion, just stick the orginal SI entries into the IDT again....

yea.. i guess. unless the protection persistently patches it.

I'm sure someone will write a driver that watches the IDT and restores it when it messed with. Perhaps using guard pages...

i suppose that would do it. I don't have enough experience on the topic to safely say much more..
thx for the reply.


Can somebody remind me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Can somebody remind me
PDA

View Full Version : Can somebody remind me

Kilby
04-09-2003, 04:13 AM
Can somebody remind me where I have seen the tag peetles

It's used in Ultra Protector to denote sections which are to be encrypted.

However I cannot remember wher I have seen this tag before, can anybody remind me ?

Kilby
banshee
04-10-2003, 10:05 AM
There is some protector from A&1 Software (as written on the it's window header) called PEetles. It is a part from the help file:

This part of help is mainly designed for the advanced user,for the protection of the embedded code. PEetles can protect your selected part of the source code ,the protection do anti-debug,anti-dump,anti-trace,anti-disassemble and then decrypt the protected source in memory to run .

Example for ASM Developer:
start:
...
db 'hahaha',0,0 -------------------------->
dd 2500 dup(0) -------------------------->Space and flag reserved for PEetles
db 'peetles_begin'-------------------------->

------------------>Your asm code begin need protection ,this is example
mov esi, offset MsgCaption
call uppercasep
invoke MessageBox, NULL,addr MsgBoxText, addr MsgCaption, MB_OK
------------------>Your asm code end need protection

db 'peetles_end' ------------------------>Flag reserved for PEetles
...
end;

Example for DELPHI Developer:
First copy files (peetles_begin.inc and peetles_end.inc) to your project directory.
procedure TForm1.RegisteredButtonClick(Sender: TObject);
begin
...
{$I peetles_begin.Inc} ----------------> Space and flag reserved for PEetles

-------->your delphi code begin need protection;example code
GetUserNameAndPassword;
if Verified <> True then
application.terminate;
-------->your delphi code end need protection;

{$I peetles_end.Inc} -----------------------> Flag reserved for PEetles
...
end;

Example for C++ Builder Developer:
...
_asm{db 'hahaha',0,0; dd 2500 dup(0) ;db 'peetles_begin';}--->Space and flag reserved for PEetles
------------------>Your BCB code begin need protection ,this is example
GetUserNameAndPassword();
if Verified != True then
selfkill();
------------------>Your BCB code end need protection

_asm{ db 'peetles_end'; } ------------------------>Flag reserved for PEetles
...
end;

Example for VC++ Developer:
First copy files (peetles_begin.vc and peetles_end.vc) to your project directory.
{
...
#include "peetles_begin.vc" ----------------> Space and flag reserved for PEetles

-------->your c++ code begin need protection;example code
GetUserNameAndPassword();
if Verified <> True then
selfkill();
-------->your c++ code end need protection;

#include "peetles_end.vc" -----------------------> Flag reserved for PEetles
...
};

I think it could be found on exetools site, as far as i remember I downloaded it from there.

Hope it will be helpfull :)
Kilby
04-11-2003, 11:16 AM
Many thanks I knew that I had seen it before but couldn't remember where.

Seems like this protecter has either changed name or theres been a bit of robbing going on.

Kilby...


About Titanium and Fusion v3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > About Titanium and Fusion v3
PDA

View Full Version : About Titanium and Fusion v3

Zilot
04-09-2003, 05:25 AM
Part |

I've read tutorial about unpacking Bit-Art, and that what is said there is OK but
is enough just for main screen appearing. After that each button causes some
crash. It is because there are some more calls inserted into code to prevent
using unpacked version.
Every call decrypts itself and after that it encrypts itself again. And the best
method to see what code suppose to execute instead inserted call is to watch
what's going on with stack
and after restoring registers and flags there is "health code" 5 bytes long.
And after that there is again pushing registers and call encryption.
calls table starts at 4e30f5 and eds at 4e4ec1 and I put breakpoint at the
beginning on each, and then took somea actions, so I knew which of calls is
invoked. After that was easy. And there is one call that is not in this table and
is responsible for IAT erasing, he can be found by breaking on IAT writting.
So additional in tutorial about patching is next:
Zilot
04-09-2003, 05:27 AM
1.

4485e9 call 470ed4 <------- Erases IAT
should be
4485e9 lea edi,[esi+3c]
push 20

2.

44860a call 4e3d11
should be
44860a movzx ecx,ax
mov [edi],eax

3.

444b01 call 4e3da2
should be
44860a movx ecx, byte ptr [esp+08]

4.

41284f call 4e32a3
should be
41284f mov [esi+7C],ebx
push 0F

5.

412895 call 4e3386
should be
412895 mov [esi+58],ebx
mov eax, esi

6.

4460fa call 4e4428
should be
4460fa mov esi, ecx
mov [ebp-10], esi

no more weird calls
And the way how was registration patched is wrong. That call mustn't be

overwitten, because some strange ractions happened.
Instead I did next

402199 push eax
should be
402199 push edx

and

4021b0 test eax,eax
should be
4021b0 test edx,edx
Zilot
04-09-2003, 05:29 AM
I tried after this some programs and had more and less success. Some of them were

packed perfect, but some not. So I'm wondering is it because registration or not.

And sometimes after several times of packing the same program, he was packed in

wrong way. Any comment, suggestion. :confused:

If one wants my exe it is OK. :o


TryMedia
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > TryMedia
PDA

View Full Version : TryMedia

buntus
04-09-2003, 06:29 AM
Hi folks,

Some big fan of pacman asked me to have a look at this :

hxxp://fe.trymedia.com/d/alawar/2u10p_d/trygames/PacmaniaII.exe

1. Facts :

It appears to be protected by ActiveMark from TryMedia. I had a look at it, dumped it,
fixed import table, fixed relevant api calls. They actually emulate a few API for which
u can find a translation table in memory (ie APINAME, Offset of garbaged emulation),
hence u can easily fix those :

call dword ptr is replaced by nop call emulatedAPI (90 E8 XX XX XX XX).
jmp dword ptr is replaced by nop jmp emulatedtAPI (90 E9 XX XX XX XX).
mov dword ptr is replaced by nop mov reg32, Offset emulatedAPI (90 BX XX XX XX XX).

The following detection strings are used, it is easily bypassed :

FilemonClass
RegmonClass
File Monitor - Sysinternals: www.sysinternals.com
Registry Monitor - Sysinternals: www.sysinternals.com
\\.\NTICE
\\.\SICE
\\.\SIWVID
\\.\FROGSICE
\\.\SUPERBPM
INT3 backdoor is used too.

Loader APIs are checked for softBP (1st and 2nd byte... sounds dangerous to me, ah well).
Some API code is replicated in a buffer too (CreateThread for instance and Sleep).
Entrypoint is easy to find as well (0x2958D), the image is using thread for doing some
tasks, and you will find the UPX loader code to decompress, resolve API of some code
inside (Sigh !!!) which is garbaged.

2. Problem :

For some reason, it does an infinite loop after being fixed while accessing the file
MAIN.ARF (Seek Offsets are different from trial and dumped version). I Looked at it for
2 days and I can't figure out what is the thing I missed. I'd be very glad to get any
input from you guyz from this target. It must be a very stupid thing, coz the whole scheme
looks plain dodgy (we are very far from a ProtectCD, ASPR, VBOX, or SafeDisc wrapping scheme).

Thanx in advance.
xybyre
04-11-2003, 03:12 PM
This one is interesting. I cannot run it under OllyDbg. It terminates after a number of exceptions. I'm at work now, so can't try it with sice. Procdump's tracer fails, and revirgin's tracer causes a BSOD.

I wish I could figure out how it was detecting the debugger. I'm not too familiar with anti-debugger tricks, so I'm pretty much stuck at the unpacking stage...

I'll try it again using softice. Maybe then I may be able to give you some input. :)
Albed0
04-12-2003, 08:33 PM
The reason is that MAIN.ARF is encrypted too. In fact seems some kind of virtual file system that is accessed by the emulated APIs you removed. Look the tags at the beginning and the end of the file. Not a casuality the emulated APIs were those that access the filesystem. Very interesting.
The file seems to be decrypted using a openssh generated certificate. And I'm seeing a Perl interpreted embedded!. Weird. Definitively worth a more deep look.
CuTedEvil
05-31-2003, 01:15 AM
Umm.. sorry if it sounds lame, but is there any unpacker? or unpacking tutorial for this protection?? (ActiveMark)??

I've never seen a protection like it be4 :confused:

thanks in advance

cya
CuTedEvil


OllyDbg..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > OllyDbg..
PDA

View Full Version : OllyDbg..

BorlandD
04-10-2003, 01:30 AM
I've been using Softice for about a month or so and from reading the earlier threads I was turned on to OllyDbg. I got comfortable
using softice but OllyDbg is so easy to use, I've started using it more then SI. Softice seemed to crash a lot on me, but I still use it. Anyway, I was wondering if there was a way to use 'Animate
into/over' and have OllyDbg stop on a specific string.

Thanks
BorlandD
_Servil_
04-10-2003, 03:56 PM
Yes, Trace options/Evaluation of expressions topics - RTFM.
There's Odbg phorum http://ollydbg.win32asmcommunity.net/.


Fileopen Pdf encryption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Fileopen Pdf encryption
PDA

View Full Version : Fileopen Pdf encryption

jennyc
04-10-2003, 03:40 AM
Hi,
This is my first post on tsehp's cool board.
Recently i have been studying for some computer networking exams
and i came across some encrypted pdf's which i could not open.
Being quite desperate to open them i looked for standard tools
and found none(ElcomSofts pdf decrypter did not work).

I decided to learn something more about pdf encryption and how to break it. I am a newbie to reversing so if this sounds silly my
apologies. Also i have not been succesfull in breaking the encryption because i am a newbie and i need to study for exams.
I am hoping that someone will be intrested after reading this and
help me with the encryption routines.

Adobe-Acroread(pdf viewer) has support for 3rd party plugins to do
the encryption/decryption. Open a pdf file using a HexEditor.
I used Xemacs (much nicer raw pdf view) and go to the end of the file.
You will see a /Encrypt line. This means that the file is Encrypted.
Go a few pages up. You will see a /INFO,/V,/FILTER line.
/Filter Standard implies file was encrypted using standard Adobe Encryption. This uses a 40 bit key which can be brute forced.
To learn more about Adobe's standard pdf encryption and format
about a pdf download PDFReference.pdf from adobe.com.
This is not about Adobe but about FileOpen.
So the /Filter line will be /Filter FOPN_foweb.
it could also be FOPN_fLock this means the file was encrypted using another product of www.fileopen.com called personal-publisher.
/V 1 means doc is protected by version-1.
/SVID Service-ID /DUID Document-ID.
/INFO contains contact-info-of-document-publishers-server.

All this info can be obtained from the Webpublisher2 manual.
/INFO is encoded by some special proprietary algorithm.
When the PDF file is opened the plugin unencodes /INFO
and uses the info to contact the publisher's server to
authenticate etc...but first the plugin checks in
C:\Windows\Application Data\some_configurable_dir
for a .sek LICENSE file.
some_configurable_dir is specified in the pdf's /INFO
structure.
The exact name of the .sek file is built from /INFO data.
It consists of the Publishers-ID.SVID.sek
Publisher-ID is alloted to you by fileopen once you buy the
package which costs 4000$$$ approxi!!.
For the demo the ID is 10006.
The .sek file contains a KEY to decrypt our PDF. It also contains
PDF open/print/how-many-days-left-to-expiry etc etc permissions.
And it is encrypted with the machine-id which is got from System-info/volume-info etc i think. This encryption serves 2 purposes. One we cant modify the license file and give ourselves
permissions after getting a valid KEY.
Two we cant transfer the license to another machine since the
machine-id on the new machine will be calulated and will not match
the old machine-key.
The .sek file is encrypted using RC4/MD5 and some proprietary
algorithm!!.
I took the machine key and md5sum(on linux) and then passed it to rc4 and tried decrypting the .sek file but it didnt work.
I tried with 5 byte md5 key and 5byte md5hash.
So i hope some one can help me understand this part!!.

The pdf contents are encrypted using KEY which is downloaded
from the publisher's server encrypted and stored in the license file. Since i dont have acess on the publishers server without
paying 3000$ i dont have the pdf keys.....
HOWEVER the pdf keys are exactly 5 bytes in LENGTH
Not 4 not 3 exactly 5 bytes.
Which means it is VERY VERY easy to brute force this and
obtain a valid key!. It mostly contains a-z and 0-9.
Once we understand how exactly the pdf encryption is done
we can brute force rc4 directly since the key length is 40bits
and directly extract the rc4 key instead of breaking our head
about the Publishers-key-string or trying to reverse md5.

One more thing..only the pdf string/image objects are encrypted not the whole pdf.

Also this PDFEncrypt.exe program works on Linux/Solaris
and Siul-hackey might very very very easily
figure all the encryption because
THE LINUX BINARY HAS NOT BEEN STRIPPED!!!!!!
this means that gdb works nicely, Functionnames are there
objdump also works and prints all function names

The machine key was found out by running netcat...nc.exe on port 80 and putting a entry in hosts.sam so that plugin contacts my
localhost machine and prints the machineid.
The exact format of what to send to the plugin is given in the
manual for the product...or mail me and ill send it..

Adobe-standard-encryption uses 2 keys a user and a owner key.
I dont think the plugin is using 2 keys just 1.
So some special problems occur. With adobe because it used
2 keys we could verify the validity of the key by comparing
one key against a hashed version of the other...

Howevre here because the pdf is crypted with only 1 key how
do we verify??????

Disabling the license checks within the plugin also seems very
easy once we can brute force and get the KEY.
They have lots of simple test/jne pairs

#########################################################
The plugin name is FileOpen.api. There is another plugin
called FileOpenTest.api not sure about the name since i am typing
all this from memory...that comes with the package.
This was used by the fileopen developers for debugging the client
side :) and is filled with string references!!!!.
It should be too easy for someone who knows even a little
to figure out the whole scheme of things.
The log file is called dsomething.txt not sure forgotten
##############################################################

Grrr!!!! if only i knew a bit more :( :(

So theese are the highlights that i could figure out. Please remeber i am very very new to all this!.

If anyone is intrested in helping me break this encryption
please contact me.
Kilby
04-10-2003, 04:19 AM
You seem to have done quite a bit of work already, however this would probably get more responces in the crypto section.

Kilby...
evlncrn8
04-10-2003, 04:59 AM
that is of course assuming it isnt a starforce protected pdf file (i've never encountered one personally so i have no idea what it looks like) ...
peterg70
04-10-2003, 06:31 AM
Just a quick read.

Do you have the full PDF that is completly encrypted??? if so maybe post or send me a link to the PDF.

If the PDF requires the Plugin to work send me a link for the plugin as well.

I have done a similar document control system for something I use myself.

I am interested in further information as well.

Catch ya
jennyc
04-10-2003, 07:33 AM
The package is 2126709 bytes(2Mb) so i cant upload.
Its available on mail requests.
You can use it to create encrypted pdf's and test things out.
The 2 plugins come as part of the package.
Copy FileOpen.api to the plug_ins diectory in Adobe.
Then start up adobe to be able to READ crypted plugins.
PDFEncrypt is used to encrypt the pdf's.
FileOpentrace.api is also there. You cant copy
both plugins to plu_in directory and use. Copy either one and use it.

A short note on encryption modes used. Its all there in the manual
or in the config_wahtever.fow files in TestFiles/Mode_f/encript_before/definition.fow

The plugin can authenticate via
Username/Password: here adobe-reader prompts u to enter a
password/login pair. this is sent via a cgi get request using http/https to the pdf-publishers server.
EG: Session Verification Request https://site.com/cgi-bin/script.pl?Request=DocPerm&ServiceID=594&DocumentID=4576&Stamp=1007398586&
ProdVer=1.1.0.0&Session=87654321&Machine=3S2EE27N

EG: Username/password verification request
https://site.com/cgi-bin/script.pl?Request=DocPerm&ServiceID=594&DocumentID=4576&Stamp=1007398586&
ProdVer=1.1.0.0&UserName=myusername&Password=mypassword&Machine=3S2EE27N

The server authenticates you using perl/asp whatevr and sends back
EG: retval=0 fail;retval=1 success;retval=2 success and offline perms follow
RetVal=1&ServId=594&Docuid=4576&Perms=1&Code=12345&NotifyClose=1
EG: notifyclose=1 menas when u close doc plugin notifies server.
RetVal=2&ServId=594&Docuid=4576&Perms=1&Code=12345&NotifyClose=1&OfflinePrints=c&Offline
Expire=100d

100d=100days

After the data from the server is retrived it gets encrypted and
then added or a new license file.sek is generated.
NOTE: before contacting the server the plugin checks for a license.sek to see if u have offline perms etc..
jennyc
04-10-2003, 08:03 AM
objdump -xS PDFEncryptor>diss

strace -s 2000 -o strace.defU-RST.foe PDFEncryptor -f unenc/U-RST-D-100.pdf -i D-100 -d defU-RST.foe

strace -s 2000 -o strace.D-100 PDFEncryptor -f unenc/C-ABC-D-100.pdf -i D-100

Attachment is linux.zip which has the output of above commands.
jennyc
04-13-2003, 08:44 PM
Anyone written a plugin for adobe..maybe there is a way to extract the key like that...
peterg70
04-14-2003, 02:14 AM
This is someone elses work.
But it may help or lead you down the right path.

*********************************
/* fileSaveAs.c

This program reads a pdf encrypted with the fileOpen plugin,
and attempts to write a plain pdf.

Compile with:
gcc -g -o fileSaveAs -lssl -lcrypto fileSaveAs.c

To compile, you'll need packages libssl09-dev and libCrypto.
This is a list of things that must be worked out:

1) It does not decrypt strings, so there is no navigation
bar on the left, no author, no additional info and such.
2) Often in the resulting pdf there are many white pages.
3) I had only one ebook to work with, so the salt that
I have blatantly hardcoded may be different.
4) The ebook I have contains the strings '/FOPN_fLock /V 1',
I guess that it is the version of the plugin. There
certainly are other versions of the plugin, I don't
know about them.
5) When printing, sometimes acrobat reader says that there
are illegal characters.

So much to do...
*/

#include <stdio.h>
#include <openssl/md5.h>
#include <sys/stat.h>
#include <sys/fcntl.h>
#include <getopt.h>

#define MAX_OBJ_LEN 2000000
#define STREAM_STR "stream"
#define END_STREAM_STR "endstream"
#define OBJ_STR " obj"
#define END_OBJ_DELIM "endobj"
#define ENCRYPTION_STRING "/Encrypt"

/* I know this is ugly, but hey, I said there is much
to do! Begin here! */
unsigned char pObjBuf[MAX_OBJ_LEN];

#define SHUFFLEUP(YY, XX, ZZ, AA) { \
YY=0; \
YY=(char)*ZZ; \
YY=YY << XX; \
AA |= YY; \
ZZ++; }

unsigned char S[256];
unsigned char K[256];

/* This is the only thing they added on top of plain RC4. */
void superSecret
(
unsigned char *pData,
int nIntParam,
MD5_CTX *pMd5Ctx
)
{
unsigned long lTmp1,
lTmp2,
lTmp3,
lTmp4,
lTmp5,
lTmp6,
lTmp7;
unsigned long *plPoint1;
unsigned char *plMainPnt;

plMainPnt=pData;
if(0 == nIntParam)
return;
lTmp4=pMd5Ctx->Nl;
lTmp7=nIntParam;
lTmp7=lTmp7<<3;
lTmp4+= lTmp7;
lTmp4 &= 0xFF;
if(lTmp4<pMd5Ctx->Nl)
pMd5Ctx->Nh++;
lTmp6=nIntParam;
lTmp6=lTmp6 >> 0x1d;
pMd5Ctx->Nh+= lTmp6;
pMd5Ctx->Nl=lTmp4;

if(0!= pMd5Ctx->num) {
plPoint1=(unsigned long *)pMd5Ctx->data;
lTmp5=pMd5Ctx->num ;
lTmp5=lTmp5 >> 2;
lTmp7=pMd5Ctx->num;
lTmp7&= 3;
lTmp1=lTmp7;
lTmp4=pMd5Ctx->num;
lTmp4+= nIntParam;
if(lTmp4>= 0x40) {
lTmp4=plPoint1[lTmp5];
switch(lTmp1) {
case 0:
SHUFFLEUP(lTmp4, 0, plMainPnt, lTmp4);
case 1:
SHUFFLEUP(lTmp7, 8, plMainPnt, lTmp4);
case 2:
SHUFFLEUP(lTmp6,0x10, plMainPnt, lTmp4);
case 3:
SHUFFLEUP(lTmp7, 0x18, plMainPnt, lTmp4);
}
plPoint1[lTmp5]=lTmp4;

lTmp5++;
if(lTmp5 <0x10) {
do {
SHUFFLEUP(lTmp4, 0, plMainPnt, lTmp4);
SHUFFLEUP(lTmp6, 8, plMainPnt, lTmp4);
SHUFFLEUP(lTmp7, 0x10, plMainPnt, lTmp4);
SHUFFLEUP(lTmp6, 0x18, plMainPnt, lTmp4);
plPoint1[lTmp5]=lTmp4;
} while(lTmp5<10);
}
lTmp7=0x40-pMd5Ctx->num;
nIntParam-= lTmp7;
MD5_Update (pMd5Ctx, (unsigned char *)plPoint1, 0x40);
pMd5Ctx->num;
} else {
pMd5Ctx->num+= nIntParam;
if(lTmp1+nIntParam<4) {
lTmp4=plPoint1[lTmp5];
switch(lTmp1) {
case 0:
SHUFFLEUP(lTmp4, 0, plMainPnt, lTmp4);
nIntParam--;
if(0 == nIntParam)
break;
case 1:
SHUFFLEUP(lTmp7, 8, plMainPnt, lTmp4);
nIntParam--;
if(0 == nIntParam)
break;
case 2:
SHUFFLEUP(lTmp6, 0x10, plMainPnt, lTmp4);
}
plPoint1[lTmp5]=lTmp4;
return;
}
lTmp7=pMd5Ctx->num;
lTmp7=lTmp7 >> 2;
lTmp3=lTmp7;
lTmp2=pMd5Ctx->num & 3;
lTmp4=((unsigned char *)plPoint1)[4*lTmp5];

switch(lTmp1) {
case 0:
SHUFFLEUP(lTmp4, 0, plMainPnt, lTmp4);
case 1:
SHUFFLEUP(lTmp7, 8, plMainPnt, lTmp4);
case 2:
SHUFFLEUP(lTmp6, 0x10, plMainPnt, lTmp4);
case 3:
SHUFFLEUP(lTmp7, 0x18, plMainPnt, lTmp4);
}
plPoint1[lTmp5++]=lTmp4;
if(lTmp5<lTmp3) {
do {
SHUFFLEUP(lTmp4, 0, plMainPnt, lTmp4);
SHUFFLEUP(lTmp6, 8, plMainPnt, lTmp4);
SHUFFLEUP(lTmp7, 0x10, plMainPnt, lTmp4);
SHUFFLEUP(lTmp6, 0x18, plMainPnt, lTmp4);
plPoint1[lTmp5++]=lTmp4;
} while(lTmp5<lTmp3);
}
if(0 == lTmp2)
return;
lTmp4=0;
plMainPnt+= lTmp2;
switch(lTmp2) {
case 0:
plMainPnt--;
lTmp4=0;
lTmp4=(char)*plMainPnt;
lTmp4 << 0x10;
case 2:
plMainPnt--;
lTmp6=0;
lTmp6=(char)*plMainPnt;
lTmp6<<8;
lTmp4|= lTmp6;
case 1:
plMainPnt--;
lTmp7=0;
lTmp7=(char)*plMainPnt;
lTmp4|= lTmp7;
case 3:
plPoint1[lTmp5]=lTmp4;
return;
}
}
}
if(0 == ((unsigned long)plMainPnt & 0x3)) {
lTmp5=nIntParam;
if ((lTmp5>> 6) >0) {
lTmp5=lTmp5<<6;
MD5_Update (pMd5Ctx, (unsigned char *)plMainPnt, lTmp5);
plMainPnt+= lTmp5;
nIntParam-= lTmp5;
}
}
plPoint1=(unsigned long *)pMd5Ctx->data;
if(nIntParam>= 0x40) {
do {
if(plMainPnt!= (unsigned char *)plPoint1) {
memcpy((unsigned char *)plPoint1, plMainPnt, 0x40);
}
plMainPnt+= 0x40;
MD5_Update (pMd5Ctx, (unsigned char *)pMd5Ctx->data, 0x40);
} while(nIntParam>= 0x40);
}
lTmp1=nIntParam;
pMd5Ctx->num=lTmp1;
if(0 == lTmp1)
return;
lTmp5=lTmp1>>2;
plPoint1[lTmp5]=0;
memcpy((unsigned char *)plPoint1, plMainPnt, lTmp1);
}
peterg70
04-14-2003, 02:14 AM
/* From 'Applied Cryptography'.
Yes, they used an algorithm from a book.
I can understand: after all, it is a good algorithm.
But If I wanted to distribute some encrypted data, I wouldn't
put the algorithm _AND_ the key in the same place. */
void CreateRc4Sbox
(
unsigned char *pKeySeed
)
{
int i=0;
int j=0;
int nRealIndex;
unsigned char nTemp;

for (i=0; i<256; i++)
S[i]=i;

for (i=0; i<256; i++)
K[i]=pKeySeed[i%16];
nRealIndex=0;
for (i=0; i<256; i++) {
j=(j + S[i] + K[nRealIndex])%256;
nRealIndex++;
if(nRealIndex>9)
nRealIndex=0;
nTemp=S[i];
S[i]=S[j];
S[j]=nTemp;
}
}

/* Also from the book */
int Rc4Decrypt
(
char *pCryptoData,
int nCryptoBufLen,
char *pResults,
int nResultsBufSize,
unsigned char *SBox
)
{
short nByte;
int nClearPos=0,
nBuf=0,
nBuf2=0,
nCount,
nSwap,
nLength=nCryptoBufLen,
nAdv;
while(0!= nLength) {
nBuf++;
nBuf &= 0xFF;
nCount=SBox[nBuf];
nBuf2 += nCount;
nBuf2 &= 0xFF;
nSwap=SBox[nBuf2];
nAdv=nSwap;
SBox[nBuf]=nSwap;
SBox[nBuf2]=nCount;
nCount += nAdv;
nCount &= 0xFF;
nByte=SBox[nCount];
nByte ^= *pCryptoData;
nClearPos++;
*pResults=nByte;
++pCryptoData;
++pResults;
nLength--;
}
return nClearPos;
}

/* this function calculates the key and executes the Rc4
decrypt loop. Here I have hardcoded the salt: 'DgNab'.
It may change in other ebooks but I only have one... */
int mainDecryptLoop
(
unsigned char * pCryptText,
int nCryptSize,
unsigned char * pClearBuffer,
int nClearBufferSize,
int nNumObj
)
{
unsigned char rc4Key[16],
keyBuf[8];
int nClearLength,
nIdx;
MD5_CTX md5Ctx;
unsigned char salt[20];

for(nIdx=0; nIdx<8; nIdx++)
keyBuf[nIdx]=0;

*(int*)keyBuf=nNumObj;
strcpy(salt, "DgNab");
MD5_Init(&md5Ctx);
superSecret(salt, 5, &md5Ctx);
superSecret(keyBuf, 3, &md5Ctx);
superSecret(keyBuf+4, 2, &md5Ctx);
MD5_Final(rc4Key, &md5Ctx);
CreateRc4Sbox(rc4Key);
nClearLength=Rc4Decrypt(pCryptText, nCryptSize, pClearBuffer, nClearBufferSize, S);
return nClearLength;
}

/* the following is just some PDF parsing.
The juicy part is over, I'm afraid... */
int removeSecurityString
(
unsigned char *pBeginBlock,
unsigned char *pEndBlock
)
{
unsigned char *pTemp;
for(
pTemp=pBeginBlock;
pTemp!=pEndBlock;
pTemp++
) {
if(!strncmp(pTemp, ENCRYPTION_STRING, strlen(ENCRYPTION_STRING))) {
while(
'\n'!=*pTemp &&
'\r'!=*pTemp
) {
*pTemp=' ';
pTemp++;
}
}
}

return 0;
}

int scanFile
(
const int fh,
const int ofh,
int *pnWrote
)
{
int numObject,
nCryptLen,
nClearTextLength,
bStayThere;
unsigned char *pStart,
*pStartCrypted,
*pBeginBlock,
*pCurrent;

for(;;) {
bStayThere=1;
pCurrent=pObjBuf;
pCurrent+=strlen(OBJ_STR);
pStart=pCurrent;

while(bStayThere) {
if(1>read(fh,pCurrent,1)) {
removeSecurityString(pBeginBlock, pCurrent);
write(ofh, pBeginBlock, pCurrent-pBeginBlock);
return 0;
}
if(!strncmp(pCurrent-strlen(OBJ_STR), OBJ_STR, strlen(OBJ_STR))) {
pCurrent++;
write(ofh, pStart, pCurrent-pStart);
while(*pCurrent!=' ')
pCurrent--;
pCurrent--;
while(*pCurrent!=' ')
pCurrent--;
*pCurrent=0;
numObject=atoi(pStart);
bStayThere=0;
}
pCurrent++;
}

pCurrent=pObjBuf;
pCurrent+=strlen(END_OBJ_DELIM);
pBeginBlock=pCurrent;
bStayThere=1;
while(bStayThere) {
if(1>read(fh,pCurrent,1)) {
write(ofh, pBeginBlock, pCurrent-pBeginBlock);
return 0;
}
if(strncmp(pCurrent-strlen(END_OBJ_DELIM), END_OBJ_DELIM, strlen(END_OBJ_DELIM))) {
pCurrent++;
continue;
}
for(pStart=pObjBuf-strlen(END_OBJ_DELIM); pStart!=pCurrent ; pStart++ ) {
if(!bStayThere)
break;
if(strncmp(pStart, STREAM_STR, strlen(STREAM_STR)))
continue;
pStartCrypted=pStart+strlen(STREAM_STR)+2;
for(pStart=pStartCrypted; pStart!=pCurrent ; pStart++) {
if(strncmp(pStart, END_STREAM_STR, strlen(END_STREAM_STR)))
continue;
nCryptLen=pStart-pStartCrypted-1;
nClearTextLength=mainDecryptLoop(pStartCrypted,nCryptLen,pStartCrypted,nCryptLen,numObject);
bStayThere=0;
break;
}
}
write(ofh, pBeginBlock, 1+pCurrent-pBeginBlock);
bStayThere=0;
}
}
return 0;
}

int Usage
(
const char *szMessage
)
{
fprintf(stderr, "%s\n", szMessage);
fprintf(stderr, "Usage: \n");
fprintf(stderr, "-h : this message\n");
fprintf(stderr, "-i file : input file\n");
fprintf(stderr, "-o file : output file\n");
return 255;
}

int main
(
int argc,
char **argv
)
{
int ifh,
ofh,
nWrote,
nOffs;
char *strInputFileName,
*strOutputFileName,
ch;
struct stat statStruct;
strInputFileName=NULL;
strOutputFileName=NULL;

while((ch=getopt(argc, argv, "hi:o:"))!= -1) {
switch(ch) {
case 'h':
return Usage("Help message requested");
break;
case 'i':
strInputFileName=optarg;
break;
case 'o':
strOutputFileName=optarg;
break;
}
}

if(NULL == strInputFileName)
return Usage("Must give input file");

if(NULL == strOutputFileName)
return Usage("Must give output file");

if(stat(strInputFileName, &statStruct))
return Usage("Error opening input file");

ifh=open(strInputFileName, O_RDONLY);

ofh=open(strOutputFileName, O_WRONLY|O_CREAT|O_TRUNC, 0666);

nWrote=0;
if(scanFile(ifh, ofh, &nWrote))
return Usage("Problems scanning file");

close(ifh);
close(ofh);
return 0;
}
jennyc
04-14-2003, 11:49 PM
Ive already taken a look at that file. I got it from Rusty mae's site..or is that Kyler larids site...
Anyway yeah it was a big help!. They havent changed the crypt
routines that much since the elcomsoft debacle.
Trouble was when i started it in gdb and tried to trace through
it refused to enter the MD5Routines..i think this was because
i dont have a E-book pdf file...anyway since my last post
ive changed my tactics....

1. I am first going to bypass all the save/print disable routines.
That is pretty trivial to achieve...just patch the je's and test..
2. They use the fucntion InternetReadFile to do the job of reading
the config info via https..im thinking of reading the info from
its buffer..trouble is this will be encrypted(https)..
so ill try and figure out where his decryption routine is and
read it there...then ill try and figure out where he passes
the key(40bit RC4 key) to adobe. This will be after all the bit mangling and md5summing has been done.

The advantage of this is that i can then directly bruteforce RC4.
Instead of breaking my head against the md5 wall...
Lets see how things go...figuring out the https routine
and reading the plaintext key seems to be the hardest...
peterg70
04-15-2003, 07:18 AM
I assume you already have the PDF file that is encrypted and unencrypted.

Any chance of getting an encrypted file.

Peterg70


How to set bpx on Save?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to set bpx on Save?
PDA

View Full Version : How to set bpx on Save?

Th3_Ang3l
04-10-2003, 05:44 AM
Hi guys. I want to ask a question. I'm currently cracking an app and I wanted SoftICE to break each time I click on File Save/Save As menu. How is this possible?
ZaiRoN
04-10-2003, 06:11 AM
Hi Th3_Ang3l,
you can try to break on the function GetSaveFileName. This function (used by many applicatiopns) creates the classical "save dialog box" when you click on "Save as" item.

Regards,
ZaiRoN
Th3_Ang3l
04-10-2003, 06:37 AM
Hi ZaiRoN and thanks a lot for your response. I've tried it but it doesn't seem to break. Any other ideas?

Sorry for the double post.
esther
04-10-2003, 06:57 AM
Hi,
Did you try bpx enablemenu?
just a thought
banshee
04-10-2003, 09:52 AM
What is the compiler of your application?
Th3_Ang3l
04-10-2003, 11:31 AM
Thanks to everyone for their response. enablemenu doesn't work.
Why do you need the version of the compiler?

Anyway I'll try to explain the situation a bit.
I'm working on this programme that catalogues all your disks files hard disks etc. This proggy is packed, has a nag and a limit on the number of disks you can store. Anyway I've unpacked it, got rid of the nag but the problem is the number of disks.

Let me explain: this proggie blocks the number of disks you can catalogue to 5. When you try to catalogue another disk it gives you a nice messagebox with the usual crap. That wasn't difficult to reverse. The problem is that when you save your catalogue of 6 or more disks the programme accepts it yes, but when you re open it it still contains 5 disks (meaning that all number of disks superior to 5 get cut off)

My question is this: how can I control what gets saved in the file?
What would be a good bpx to set? (I've also tried createfilea and indeed breaks but it doesn't seem to get anywhere)

Thanks to everyone that have responded
Manko
04-10-2003, 11:43 AM
Try WriteFile, it should write the data...
or if they are little tricky... _lwrite or _hwrite..

/Manko
squidge
04-10-2003, 12:26 PM
Are you sure it doesn't bother saving the records to the file? Maybe it just doesn't bother loading them? Have a look with a hex editor.
Th3_Ang3l
04-10-2003, 12:41 PM
WriteFile indeed breaks but I can't seem to get anywhere.
:(

Hi squidge. Thanks for responding. Good idea. Didn't think of it. I'll take a look.

Thanks to both
Th3_Ang3l
04-10-2003, 12:47 PM
Nothing. The data isn't saved in the first place. DEAD END HERE.


Hardlock, fake or really implemented
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hardlock, fake or really implemented
PDA

View Full Version : Hardlock, fake or really implemented

OHPen
04-10-2003, 05:47 AM
Hi folks,

atm I'm working on an App called Dips

www.rocscience.com/downloads/dips/DipsDemo5.exe 7MB

If you want to take a look on it ;)

The strange thing is that i first thought it's protected with HARDLOCK, 'cause i found some String's in it called HARDLOCK.VXD.

I know Hardlock.VXD is called by the Hardlock drivers but in this case it isn't ! Is it possible that it's fake and hardlock isn't really implemented ? I tried to use filemon to catch supicious files being called but they aren't.

Hope you guy's will take a look at it, .
and give me a hint.
THX in advance,

OHPen
masi
04-15-2003, 12:34 PM
Hi OHPen,

I had a look at this target (actually it was the demo of 'Phase 2' from the same developer) about 1 year ago. I installed the demo version and noticed e.g. limitations of 'demo-projects' (only those could be loaded), controlled by a file ('demofiles.txt' <- erase the content of it and you can't load any project). Since i didn't want to reverse the demo version, i tried to install the update, which can be obtained freely from the site you mentioned, too.
When i noticed, that the developer totally screwed up the installation process of that update (by searching the original program in a wrong directory), my motivation was nearly at zero and I only took a quick look at the demo-version again. (I also was not able to persuade the update to install over the demo-version. Did you manage it?)
You're right, there are traces of the Hardlock dongle in the demo version too, but this version does not make use of the dongle (the string you mention is a resource, which the developer left in their source and the compiler didn't recognize as not required for program execution.
If the compiler didn't erase that string, there must be an execution path to that string and further to the places, where the dongle driver is loaded and the dongle calls are executed.
I found it nearly always difficult to find the beginning of the branch, where the program decides wheather to run in demo- or in full mode, if (and only if) the program is (like the one we are speaking about) designed to only run in demo-mode (a 'real' demo, instead of a version which switches between modes, depending on the dongle beeing connected or not).
The only solution in 'your' case would be, to 'backtrace' in you disassembled code, beginning from the part, that should be executed if a dongle is connected, to a point, where your debugger would trigger. You always have to set a bpx on a branching, start the program and hope for your debugger to trigger. Eventually you will find a je/jne... that leeds to your dongle code.
Good luck!

To sum it up: for me it seems that you are dealing with a demo-version, that doen NOT communicate with the hardlock. If you can get the update of the full version to install on your computer, it probably would be a different case.
OHPen
04-15-2003, 01:30 PM
Thx masi for your help,

i checked your infos and agree, i think too that the author have only forgotten the strings in it's source ;(

So i think it would be VERY VERY difficult to get this version working like a full one.

Cya

OHPen


PAL/GAL chip breaking code?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > PAL/GAL chip breaking code?
PDA

View Full Version : PAL/GAL chip breaking code?

dion
04-10-2003, 06:07 AM
well, i think the subj was really off topic, if not sorry to post it wrongly. anyone know about how to read protected PAL or GAL chip, i.e. 16V8, 20V8, 18V8, etc... that having the security code set up?
scorpie
04-11-2003, 09:49 AM
I think the best way to "read" the PAL is just giving "complete" combination of input, since the input is "finite". Write down the output, and "rebuild" the function (Karnaugh Map, Tabulation, etc.). If possible, use a Programmer (HILO System, SunShine, etc.).

Scorpie
dion
04-12-2003, 09:28 AM
Originally posted by scorpie
I think the best way to "read" the PAL is just giving "complete" combination of input, since the input is "finite". Write down the output, and "rebuild" the function (Karnaugh Map, Tabulation, etc.). If possible, use a Programmer (HILO System, SunShine, etc.).

Scorpie

thanks Scorpie. yup, and the problem is this programmer can't read a protected one. after seeking more info, i read somewhere about timing issue, anyone know if i should care about it or not?
neviens
04-12-2003, 12:33 PM
Timing isue was relevant to gal programming on older
chips only. Never ones you can program over PC paralel
port withot worries about timings. Some time ago I
used programmer from this site:
http://se-ed.net/mpu51/gal/gal.html
About protected gals. As Scorpie pointed out, best aproach
for read out protected low density pal, is provide all possible
code combinations to its inputs and read all coresponding
outputs, then build a logic chart from this table.
Neviens.
dion
04-13-2003, 01:31 AM
thanks neviens. but i dont mean that timing, i mean timing in the "formed" function. but i felt something wrong here. need to check it out. btw, anyone know exactly how this security bit is applied in the chip? with encryption or with blown fuses?
squidge
04-13-2003, 03:36 AM
It's normally always blown fuses in current PALs/GALs. You can't access the internal structures without wiping the entire chip (unless of course you can read it with a laser).

Just do like others have suggested - provide every possible input and map the outputs.
dion
04-24-2003, 06:04 AM
if it would be the case, i wont asking this thing here. i got confirmed myself with someone in china that someone had cr4ck this protection, and when it first sold out, it priced $300, but after a mass production, it sold $10. well, i thought there must be somehow a way to read it, because its not using blown fuses method. anyone in china must be know this one, would there be someone told me how this can be done?


dll Asprotected
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > dll Asprotected
PDA

View Full Version : dll Asprotected

mR_gANDALF
04-10-2003, 12:01 PM
I was playing with a nice tool, PacthFactyory from hxxp://www.patchfactory.com/ that let you try for 30 days. Borland C++ 6, not packed, with a little nag before the start of the proggie. No packing, no antidebugging, just a time protection scheme based on registry. But, first surprise: The keys keeping time of trial rest on an ASProtect key. So, is it a only registry ASProtect protection? No packing? Sadly not. There is a df.dll that is in fact asprotected. Anyway it is easy to locate the comparison regarding trial, end of trial and regged version. But how to change? No loaders working (fuckfmn from smola - I really like this-; either yoda loader ). AsprStripperXP 1.35 not working, tried all options and traced the dumped (heap of shit). Tried to unpack the dll and rebuild IAT. It Seems easy, emulated and redirected API`s as usual. But then ... Loadlibrarya doesn`t find the new oep of the dll. Ah!... maybe I have to change the import section of the exe file. Second surprise: No df.dll imported library in the vp.exe import section. How is this possible? I can trace throght the LoadLibrayA call within the vp.exe to df.dll. Even more, it looks clear that this dll is responsible of the trial and the nag. It is the first time i see something like this. Any clues?

Thz

mR_gANDALF
Shoob
04-10-2003, 05:46 PM
1023481 JMP EAX

10003873 PUSH EBP
10003874 MOV EBP,ESP

44CCE0 is the call to LoadLibraryA of df.dll...
mR_gANDALF
04-11-2003, 04:36 PM
How to unpack this dll?

The keypoint of the protection is in F93D23 jz (either in W98 or WinXP in mycomp). This is RVA of the asprotect code. I guess that unpacking that dll would reverse the protection regarding that it is the only asprotected file in the program. Any clues.

mR_gANDALF
[Breaking the bRaIn]
squidge
04-11-2003, 04:40 PM
Since the DLL is loaded by the main prog, and the main prog itself is not packed, can't you allow the main prog to load it and then patch the unpacked process image from the main prog? This would seem the easiest way to handle it.
Shoob
04-11-2003, 05:08 PM
set an bp on 10003873 dump the dll, change oep and rebuild the iat for the dll. the question is had anyone ever rebuilded an iat for an .dll file ;)
Manko
04-11-2003, 05:25 PM
A little late, and shoobs been trying to tell us this was pretty easy.... but here is some info...

IAT Start: 09000 (RVA) BASE: 010000000
End: 09110 (RVA)
Length: 110

Fix it!

Dip-Table at adress: 1016988
100023B0 100022F0 0 0 10002420 0 0 0 0 0 0 0 0 0

Jump over all of those!

Jump to OEP at: 1023048 ( Code: 61FFE000 4C300201 )
OEP at: 10003873 reached from 1023049

Dump? :)

/Manko
Shoob
04-11-2003, 05:28 PM
i'am junior thanks for the suggestion manko
Manko
04-11-2003, 05:43 PM
Now I see you posted the question, had anyone ever rebuilt IAT for dll... Actually, I had not. And untill I finally saw that button in the upper right corner of ImpREC, I didn't know how... :)

...and about those dips... I'm guessing they don't matter much. Skip or not... I think it won't do much difference, but I did...

/Manko
Shoob
04-11-2003, 05:45 PM
every day a new fact for me :) i'm new to this but this dll thingie is a nice option.

rva: 9034,9068 aren't reacheable (hook and tracer freezes imprec.) An idea without softice?
Manko
04-12-2003, 05:17 AM
Hmm... I guess you're trying to use option 2 & 3 tracer? Don't use them. They are not needed, and often do not work.

Use plugins to resolve asprotect special emulated apis instead. Or do them manually. :)

It worked perfectly for me. I have it unpacked and running, so we need to figure out what goes wrong for you.

Plugins exist in this forum if you search. ;)

If this is not it, explain further...

(I guess I'd be a fool to ask if you used the button up in the right corner... since it seems you could get at them... you must have done this...)

YUP! I just checked and those RVA contain normal apsr-emulated apis... do them manually, if you have not practiced this much... if you have and are bored with this bit use a plugin.
Ofcourse you HAVE to use sice or olly or something else that can show you what this code looks like... also ther's tons of info on these things here if you search. :)

If you need more help, you can always pm me.

/Manko
mR_gANDALF
04-12-2003, 10:33 AM
These are my reults for df.dll:

oep: 100023B0 (Tracex)
IAT RVA: 9000 (ImpRec)
Size of IAT: 114 (ImpRec)
Unresolved IAT entries (Revirgin)
F90EFO, F91360, F91388 : False entries.
RVA (9034) Adress (F91388) -> Equivalent to Mov EAX, C000A04 (but any value will work)
RVA (9030) Adress(F913CC) -> Equivalent to push 0, GetModuleHandleA, Mov Eax, 81985580 (in my comp this a pointer to the name of the exe loading the dll)

Then I dump the dll at its oep (icedump). Then dump IAT from revirgin , make a new section in df.dll to inject the rebuilt IAT and redirect 9030 and 9034 to a graft with the equivalent code. Then redirect the oep of vp.dll and the IAT adress.

But tracing through the LoadLibraryA call within vp.exe takes you to a odd RVA, not 100F001 as in the original dll or the new oep set in the LordPE editor. Then I thougth maybe I should change also the df.dll functions adresses imported by the exe file. But when looking the imported functions in vp.exe the surprises is that df.dll doesnt appear.

Thats how the story is.
Surely I`m doing something wrong. Need clues.
Manko
04-12-2003, 11:01 AM
Hi! :)

Originally posted by mR_gANDALF
These are my reults for df.dll:

oep: 10001014 (Tracex)
IAT RVA: 9000 (ImpRec)
Size of IAT: 114 (ImpRec)
Unresolved IAT entries (Revirgin)
F90EFO, F91360, F91388 : False entries.
RVA (9034) Adress (F91388) -> Equivalent to Mov EAX, C000A04 (but any value will work)
RVA (9030) Adress(F913CC) -> Equivalent to push 0, GetModuleHandleA, Mov Eax, 81985580 (in my comp this a pointer to the name of the exe loading the dll)

Then I dump the dll at its oep (icedump). Then dump IAT from revirgin , make a new section in df.dll to inject the rebuilt IAT and redirect 9030 and 9034 to a graft with the equivalent code. Then redirect the oep of vp.dll and the IAT adress.

But tracing through the LoadLibraryA call within vp.exe takes you to a odd RVA, not 100F001 as in the original dll or the new oep set in the LordPE editor. Then I thougth maybe I should change also the df.dll functions adresses imported by the exe file. But when looking the imported functions in vp.exe the surprises is that df.dll doesnt appear.

Thats how the story is.
Surely I`m doing something wrong. Need clues.

Oep is wrong. The adress you found is just the adress where aspr-code checks to see if the section is executable. It was a simpel ret, when you found it.

How do you mean those are false IAT-entries?!

And the way you resolved those 2 other APis... Hmm...

Read up good on asprotect and things will become clearer.

The fact that you don't see df.dll in imports of vp.exe is simply that it's not done that way here. You always have a choice when you build program. Either put it in importstable or load it with code. This programs code loads the dll and then uses APIs to get the adresses of the functions in it. :)

/Manko
mR_gANDALF
04-12-2003, 12:23 PM
It`s true, the first RVA breaking into Sice is a ret. Strange code to be a oep. The next time Sice breaks is 100023B0 that checks registry (I misstyped oep , tracex points 1000023B0).
I know that functions from dll`s may be imported that two ways (chapter 17 of Iczelion assembler tutorials) but thought it was a possibility of error.
I also thought that F90EF0, F91360 AND F913B4 were false entries becuse they are never called from the code.
Never read anything about asprotect in dll ONLY.

So i guess from your words that dumping at the ret RVA and making that oep, and rebuilding IAT with ALL unresolved entries (included those NEVER referenced) injecting the code and redirecting, the program should work.

I`ll try that way.

Thanks.
Manko
04-12-2003, 06:23 PM
Hi!

I didn't mean you should read up on aspr related to dlls. I meant you needed to study IAT rebuilding in aspr, dip-handling and anything else is never bad. :)

Nope! YOU mentioned 10001014 first... I explained what that was, but never suggested you should dump at it. You should dump from OEP which comes after ALL dips.

I questioned your method to resolve IAT entrys, because sometimes answers are not the same. (Like if you change system, or similar...) And you might be right about some entries NOT being used. But do you know this for sure? Have you tested ALL functions of the program, so you can know they are not being used?

Ahh! When I look at dissassembly now, they are all used in code... ;)

(btw, when you have managed all, you will still notice that when you try to make patch, you get an exception... It's just the usual trick... This time, they do not even try and hide it...)

/Manko
JMI
04-12-2003, 06:39 PM
Having played with AsprStripper on a few targets to check against my manual unpacking with Imprec and/or RV, I find that AsprStriper had been identifying three "API's" with multiple addresses.

AsprStripper has both an "unpacking" and a "Reversing" button. The "unpacking" button will identify the three "unresolved" entries and the "reversing" button will attempt to "resolve" them. However, in reviewing the disassembly of the files when using both of the alternative methods, I did not find any additional API's after using the "Reversing" button and the program seemed to run fine without the three "extra" entries. Imprec revealed nothing other than the "junk" between API's and the usual suspects unresolved.

I have not looked at this target yet.

Regards.
mR_gANDALF
04-12-2003, 07:13 PM
Hi Manko!

I did mention 10001014 at first. It was misstyping of my notes, sometimes happens. As you can see, I proposed 100023B0. Of course I dumped from that oep. I am talking ALL time about that (see ABOVE).

I havent taken a look at the "dissasembly". Better I traced through the code with a bpm on that 5 entries. Notice that the three I mentioned are not referenced.

Better than general suggestion, it should be gratefull a concrete reference or a personal experience. That what I asked for.
Tracing the code often helps, dont think so?.

Thz

mR_gANDALF
Manko
04-12-2003, 07:30 PM
Hi!

It's cool! :)

But we still need to find what's wrong with your dumped file. :)

ABout 100023B0... It is not OEP. If this was a normal app and not a dll. You would have a file that sets that registry item and exits into thin air... But now, that might not matter much. As it's mainly those functions in the dll that are important. :) The good thing about dumping at first dip is ofcourse that no internal values have been set yet... (There are cases when some values actually must be set, but not here... I write to much... hrm...)

Ok, What exactly do you wich me to tell you?

The only data that hasn't been posted in this thread already is what I resolved those api to...

But there might be many other problems too I guess... I don't use icedump, so I can't say what might happen there...

Maybe something else...?

/Manko
mR_gANDALF
04-13-2003, 04:35 AM
From my point of view, there are several unresolved matters :

1. Asprotect protection ONLY from a dll. I didn`t see this before. Maybe there is something written deep in the web i didn`t find, maybe its a mistake.
2. Trying to dump that dll. Apart form unresolved entries, that could break the program, the dumped dll doesnt work at all. I mean, the LoadLibraryA that loads the dumped dll doesnt reach the modified oep although you change it with a PE Editor. It goes to a 00000000 RVA or something like that. So, I think this step is previous to resolving IAT. Ill try as SHOOB says, maybe he found the correct oep and thats half of the problem.
3. Dumping the dll and leaving it free from asprotect would break the protection? Probably yes, as it is in asprotected code where the "jz bad guy" is present. Regarding what SQUIDGE says, it is not possible to patch dll from the exe, as when the dll give back the control to the exe file, the protection has already been checked, and before it is loaded you cannot pacth. Teorically you could pacth inside asprotect code, but this must be really heavy.

Thz

mR_gANDALF
Manko
04-13-2003, 07:36 AM
Hi!

The steps for unpacking a dll are so similar to that of an exe, and as you say it's not as common, that I think none to many would care to make a tut about it. If you read up on aspr... There are tons of info in this board. It will apply to the dll too...

Yes. Shoobs OEP is right. I'm fairly certain as I've found it to be so independently, and I do have some amount of excperience in this matter. (Besides, my dumped dll works.)

A suggestion for dumping, is to try LordPe, instead. There is nothing wrong with icedump, but I can't help you with it, so...
The trick to use for this is putting a "jmp eip" (eb fe) into code before or at eip, so it won't continue execution. If you put it AT oep you need to edit it back to original bytes later. (jmp eip, is
endless loop...)

btw, if you use OllyDebug you don't need to alter code for pause. Though I realise unpacking aspr with ollydbg is pretty different, a tut was just posted on this board... The good thing here is that u can use any number of other tools at the same time. :)

Yup! Unpacking it, is your best bet. :) (Patching will be much more work in my opinion.)

/Manko
mR_gANDALF
04-13-2003, 02:07 PM
I tried both with Icedump and LordPE, using the EB,FE trick, of course. Dont think i post this thread at the first inconvenient.
I have red a lot about ASP, long time ago, also written something.
I`ll try again, but any help will be wellcome.

Thz

mR_gANDALF
Manko
04-13-2003, 05:05 PM
Hi!

Right now I can only think of two problems...

1. I jumped over all dips. Did you? Maybe some things have been setup so that it won't work... Try dumping at first dip. The one you mentioned. Before any of it's code has been executed.

You still have to use the proper OEP though as LoadLibraryA expects to get back the right info and initdll code is at proper oep...

2. Maybe you accidentally skipped out an entry in iat.rebuilding causing many other entries to get displaced? This would make calls to wrong apis...

/Manko
mR_gANDALF
04-15-2003, 05:47 PM
Thz to all you, guys, without your help i wouldnt get out from my "brain omelette" :D

This are my final results:

OEP10003873
RVA 9000
length 110

Unresolved IAT entries:

9098, 9034 and 9030. Both 90dc and 9068 are false entries. 90dc is used to import GetModuleHandleA.

I make the following graft to substitute the first 3 entries:

9098:
Push ebp
Mov ebp, esp
Mov eax, [ebp+8]
push eax
call [100090DC]; here i placed GetModuleHandleA
pop ebp
ret 04

9034:
mov eax, c0000a04
ret

9030:
push 0
call [100090DC]
mov eax, ecx
ret

Working perfectly and free of protection in win98 and WinXp

Thz you all guys, speacially to Manko, to whose patience i owe the knowledge of unpacking DLL ASPROTECTED.
Manko
04-15-2003, 06:23 PM
Hi!

Cool!

I'm so glad you made it! :)
Thought you had given up! :P

Now, I have to give you next task...

If you run your proggy now and try to make a patchfile, you will be dissapointed...

Exception! :(

It's a common trick used to check if aspr is still present...

But you can find it. :)

You just need something that will show you on wich adress an exception has occured.

They have not even "hidden" it, like they usually do. :rolleyes:

/Manko
mR_gANDALF
04-16-2003, 03:39 PM
Something like

1000126a push dword ptr [eax]
1000126c pop dword ptr [eax]

changeable for

1000126a mov eax, eax
1000126c mov edx, edx

Maybe?

:D

Maybe inline patching of Mov byte ptr[4F9C0E ], 0 would remove unregistered label?

:D

Thz again Manko for your support. Be around here, I`m having problems with arm :D :D

mR_gANDALF
JMI
04-17-2003, 04:07 PM
I don't know if this may be relevant, but thought I'd throw it out there for your consideration, bare in mind that I have not looked at this target. I have been recently working on some aspr targets and was reading and re-reading crUsAdEr's tut on the aspr dll. He reported problems disassembling because its "header" had been striped. Eventually, recognizing that aspr was a Delphi product, he stole and adjusted a header from another Delphi dll and then was able to disassemble it in IDA, using the Delphi Flirts. Just a thought of something which might be of some assistance here, even though the project may be completed.

Regards.
Manko
04-17-2003, 04:45 PM
Hi!

Yeah! If alexey would actually do some major changes for once, we'd all be doing that. :)

I have tried this a couple of times before, but stupid me, I was trying with a pe header from a delphi app, not from a dll...

Maybe, I'll have to try this again, now that I've understood one source of my failure... ok, it worked, except that it didn't show any apis... :(

Not now though... I should be buzy commenting the source of my small aspr-debugger... But I get sidetracked...
(I'll give away app and source when I'm done...)

/Manko
mR_gANDALF
04-18-2003, 02:55 PM
I think Magnetoman and me are in the same point: How to download the jmp tables to rebuild the jz/jnz replaced with int by arm. As Crushader found and explained in his marvellous tute, you have to dump the 4 tables and then rebuild with the help of his own utility. The question is: How do we dump that 4 tables...

mR_gANDALF
PD: I think i posted this in the wrong place... :(
Manko
04-18-2003, 04:30 PM
If you've found them?

Winhex. or dump partial in imprec... or whatever... shouldn't be a problem, IF you have found them...

But I never tried any of this, so...

But I have to say, you're just a tad bit off topic here, mr gandalf! ;P
(Actually, you weren't even replying to something...?)

/Manko
Nitrus
04-19-2003, 02:42 PM
Which params are you guys feeding tracex? I have been trying tracex on this one DLL that I have here, and I am getting no results. First I tried /tracex 00400000 eip-8 and then I tried /tracex 10000000 eip-8.
Shoob
04-19-2003, 03:53 PM
i've did it with a bp on memory access at the df code section.
no tracex used here..


Breaking on an API programmatically
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Breaking on an API programmatically
PDA

View Full Version : Breaking on an API programmatically

Iwarez
04-10-2003, 12:09 PM
For a softwrap dumper I plan to work on I want to receive a breakpoint when the program calls writeprocessmemory. Does anyone of you know how to achieve this? I tried using readprocessmemory and writeprocessmemory with valid processhandle but the funtion fails on reading anything outside the image of the exe. Help appreciated.
Iwarez
04-10-2003, 03:37 PM
I found out I passed a parameter wrong so the function would fail anyway.... Sorry. I now found I could succesfully write my own bytes in the API's code :D
squidge
04-10-2003, 04:52 PM
ISTR, nikolatesla20 wrote a sample program that did this a bit ago and submitted it to the board as an attachment. It was basically for patching IsDebuggerPresent on Armadillo'd apps. I believe the filename was "genericdebug".


Dynamic Breakpoints?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Dynamic Breakpoints?
PDA

View Full Version : Dynamic Breakpoints?

Eric Snyder
04-10-2003, 06:15 PM
Hello. I am working with a 16-bit Windows app in Softice. I wish to make a log entry every time a CALL instruction is executed. My only problem is that I cannot figure out how to automate testing an instruction on every program step. It would be easy if there was some way to set a breakpoint on a dynamic value (such as the current CS:IP). Using Macro recurssion doesn't seem to work either.
I would greatly appreciate any ideas you might have.

Thanks,

Eric
Kayaker
04-11-2003, 12:43 AM
I'm not sure what you mean by making a log entry, but you could simply do a Backtrace on the code region you're interested in and look at the results later, use the HEAP command for the 16bit segments.

If you're trying to log API calls, even the 16bit ones, you should be able to set a BPR R(ead) on the import table address range and SI will break on every access.

Either
BPR ds:importStart ds:importEnd R

Or, you could use the EADDR qualifier to specify the address range to break on, (if you are on an import call, ? EADDR or D EADDR returns the import table jump address hidden under the Softice generated name), i.e.
BPRW <taskname> if (EADDR >= ds:ITStart <= ds:ITEnd)

Or similarly with EVALUE to specify only Kernel32 addresses (example),
BPRW <taskname> if (EVALUE >= ds:BFF70000 <= ds:BFFC0000)

Not sure what else you're trying to accomplish.

Kayaker
Eric Snyder
04-12-2003, 01:58 PM
Thanks Kayaker. I'm sorry for being unclear. When I said that I wanted to "log" every CALL instruction I meant that every time CS:IP pointed to the instruction CALL (less interested in external CALLs) I wanted SI to write this to the history buffer, or to macro an icedump. Basicly I want an overview of this programs branchings during a certain period of its execution.
One way which I know will work is to BPX the 107 functions I was interested in, but I really didn't feel like doing all that typing. BPRing CS:<segstart> CS<segend> is ok, except that it would limit me to only four segments. Even then, and this REALLY bothers me, I cannot seem to access the indirect value of CS:IP. [@CS:IP],[*CS:IP],[CS:IP.0], and [CS:IP->0] only return "Invalid Indirection". EADDR does not seem to be helpful in this, but I am still looking at it. This problem bothers me more than anything!

Thanks,

Eric
Kayaker
04-12-2003, 11:53 PM
Hi

>BPRing CS:<segstart> CS<segend> is ok, except that it would limit me to only four segments.
BPR breakpoints don't fall into the maximum-of-4 limitation of BPM bps if that's what you mean. You should be able to BPR the entire module by specifying the taskname, if you then type BL you should see breakpoints set up for every segment. You can also include or exclude specific segments from breakpoint activation with the CSIP command, this is an old holdout of early Softice that only works on 16bit apps.

I just did a backtrace of a 16bit app with several segments with
BPRW taskname T
and displayed it with SHOW. This may not be your ideal solution, but at least you get a record of the exact code execution, /screendumps of the backtrace will give you output, (if you were to do backtracing on 32bit PE files in Win98, TraceDump is the ultimate tool of choice of course...:p

Indirection with 16bit apps does seem difficult because of the segment/selector information built into address type values. I tried several combinations of indirection operators and couldn't get the contents of cs:ip returned either, presumably you want to test the opcodes for a call function. I don't know how else you could test for a CALL, the only thing you might be able to test for is a segment change using the underscore "_" directive to evaluate CS as a constant at the time the breakpoint is set, a Call to another segment should be picked up this way
BPRW taskname R if (cs != _cs)

Kayaker
Eric Snyder
04-13-2003, 02:31 AM
Thanks again for the info. I ended up importing my IDA listing into MS Access, and using a recurssive query I got a list of all of the function calls I wanted. I then wrote a query that wrote out a SI Macro BPXing each function I was interested in, as well as DOing cls; stack; screendump.

It might have been the long way around, but it worked! :)

Eric
Kayaker
04-13-2003, 02:54 AM
Nice solution! The query and macro you wrote out might be a good reference for those wanting to do the same thing, if you would like to post it.

Regards,
Kayaker
squidge
04-13-2003, 03:39 AM
Nice idea! I've never seen MSAccess used in this way before - just goes to show really that some of Microsoft's software is useful for hacking after all... :)


Combinations of Sice and Win98
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Combinations of Sice and Win98
PDA

View Full Version : Combinations of Sice and Win98

naides
04-12-2003, 12:44 AM
This is a general question for the audience, not a specific problem:

I recently updated my computer by changing the MB and the CPU to an athlon 2200. I left a partition running Win98, for RCE reasons. The Sice version I have installed in this partition is 4.05 for Win9X. It works OK, except when I try to place BPR break points: The computer freezes irreversibly. Only way out is cold reboot.

Has anyone used Driverstudio 2.6 or 2.7 with win98? What about with an Athlon CPU? Do you think instaliing newer versions of Sice in the old OS may help my problems or only compund them?
Kayaker
04-12-2003, 01:17 AM
My, doesn't this sound familiar? ;)

http://www.woodmann.net/forum/showthread.php?threadid=3878&highlight=athlon
naides
04-12-2003, 11:08 PM
I know, Kayaker, my wet friend. I remember that thread. I was hoping that clandestiny or some of the other affected people might had run into more information around the issue. I am looking around, so far without luck.

Cya
naides
05-11-2003, 06:20 AM
This is a follow up in the remote case anybody is still interested. I re-reupdated my system to using Pentium 4, 3 GHtz.

When I try to use BPR in Driverstudio 2.7 under win98, still locks the computer. So the problem with BPR is not idiosyncratic to Athlon
h8er
05-13-2003, 06:23 PM
i have Win98Se with DriverStudio 2.7 and no problems with a Athlon Thunderbird 1.33 Ghz


HELP : Sice in Windows .NET
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HELP : Sice in Windows .NET
PDA

View Full Version : HELP : Sice in Windows .NET

dreamweavermx
04-13-2003, 02:12 AM
I started to use SICE ( v2.7 ) in a week or two . But when I try to apply any tricks from any tutorials ( I collect them from Krobar website ) , it's always NOT work. I've included needed export as SICE user guide but it is still not working.
Ex : From a tutor , I set a bpx GetWindowTextA but SICE not pop up when it must .....
Windows.Net is Windows 2000 upgrade and any Win32 process must pass through csrss.exe process , I just know this.

Please , please if anyone are using SICE on Win XP , Win 2000 or Win.NET please show me a hint.
Perhap I must use Symbol Loader to load program ???
BTW : When I go into SICE , the bottom blue bar seems to show a strange name ex " P$#VC ". Please NT-SICE guru , help me explain it.
P/S : I did a search and I just found my post :-((
JMI
04-13-2003, 02:40 AM
You need to use the search button on the top of the Forum and search for "Win2k + Sice" and WinXP + Sice" and read all the prior threads. Then try it again substituting "Softice" in the above search terms. This has been discussed many times before. There are things that need to be done to get Softice to work well, or at all, with Win2K and/or WinXP.

Regards.

(Edit: As I was telling you to search, you had apparently started that process and edited your own question. Good effort, but remember there are several threads on this subject.)
dreamweavermx
04-13-2003, 02:44 AM
Many thanks I found it.
This is a excellent board !!!!


Need some HASP-Dongle targets...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need some HASP-Dongle targets...
PDA

View Full Version : Need some HASP-Dongle targets...

OHPen
04-13-2003, 09:57 AM
Hi guys,

i'm starting to get into dongle-bashing atm and therefore i need some targets. I prefer HASP, 'cause i think it better tutorialize ;)

Hope you can gimme some URL's soon:

OHPen
esther
04-13-2003, 11:12 AM
hmm isn't it your "duty" to do that?
OHPen
04-13-2003, 11:28 AM
hmm,

maybe it is esther, but it seems to me that i failed ;(
First i tried to get new Version of the ones described in the old tutorials but most of the apps doesn't exist anylonger or uses now a different way to protect (flexlm for e.g).

Then i tried to search for vendor help to customers which have problems getting there dongle run, but most of the soft is no for upload.

So i have a little Prob, you know.
I thought it would be not problem for the experts to give me some names which i an use for starting dongle-bashing.

Maybe or maybe not...
esther
04-13-2003, 11:44 AM
You didn't try hard enough to search the the web.Its right under your nose and you can't see it.You are being lazy
Woodmann
04-13-2003, 05:50 PM
I can not say this enough...........

Visit the links associated with this website.

Woodmann
OHPen
04-13-2003, 05:51 PM
i will, i will

thx in advance

OH


time trials
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > time trials
PDA

View Full Version : time trials

qweasdzxc
04-13-2003, 04:26 PM
I have looked far and wide, but still haven't found anything describing this problem.

I am trying to kill a timer in my target. I have killed a nag screen and the 30 day limit so far, But when you execute the prog you are limited to 4 minutes of runtime...

I have looked for settimer, killtimer, getsystemtime, and ofcourse the milliseconds (240000), and the HEX equivalent (3A980)... I have also set a break for the 4 minute nag screen, but I got trapped in USER32.dll

The timer does not use the system time. I can start the app, then change my system time and the app always runs for 4 minutes.

My guess is that the app sets it's own independant timer, I have no experience with that yet. Can someone point me to a good tutorial? or offer any relevant advice?

Ida reports that the app is coded in C++, Is there a trick with some C++ library that I'm missing?
Manko
04-13-2003, 05:16 PM
You tried gettickcount?

And about the time... No smart coder would use exactly 4 mins, since it will be easy to find. (Though I agree, this is quite common... So coders are not that smart, then... :P)

There are many other apis to get time too...

Hope someone will help you with the question about timers.

/Manko
qweasdzxc
04-13-2003, 06:35 PM
No, I haven't tried Gettickcount. didn't know about it...
I know I need to read more, but I don't feel like I learn by reading, I like to learn by hands on methods, this way what I learn seems to stick around a little better.

I have a feeling that I am right ontop of the section I need to be in, I keep narrowing down and I have a couple of screens of interesting code. I have identified the VU Meter in the app, and I have a jmp out of that code into a rather large loop with SEVERAL calls. I am close, but I still cant see it. I can't find anything I recognize from any tuts I've read.

I have timed this with a stopwatch, it is 4 minutes!! I wasn't too suprised by that,

I will check for a reference to Gettickcount in Wdasm and see what I come up with.

Thanks!!
qweasdzxc
04-13-2003, 10:24 PM
I didn't find Gettickcount...

I think it might be time to try a different debugger.... Or maybe put this to the side for now, I've been stuck on it for almost a month. :(
dELTA
04-14-2003, 07:49 AM
A generic trick that might sometimes work surprisingly good in these situations is to search for the constant of the time limit. In your case I would try to search the entire deadlisting for the constant 240 (4 minutes in seconds) and 240000 (4 minutes in milliseconds). Check the code around the places where they will possibly occur. If you see a compare with these constants, try to track the compared data backwards and you might very well end up at the time-sample function (not that you would really need it once you have found the location of the compare, but anyway, for academical interest :)).

This is the reason why "clever programmers" might choose a constant that is a little bit off (e.g. 240345 milliseconds, or 239 seconds), like Manko mentions above.

dELTA
disavowed
04-14-2003, 09:23 AM
why not make a program to keep readprocessmemory'ing your app's process space, take a snapshot every few seconds, and then compare the snapshots to see what area of memory has a variable that keeps incrementing

there might even be some game trainers out there that do this automatically
banshee
04-14-2003, 09:45 AM
Just a thought:
There is rdtsc command that return number of ticks since your PC started. You can use it combined with processor MHz information to determine how much time lasted since the last call. (Think API GetTickCount uses that command) Try to search for that command in your disassembly listing.
tgodd
04-14-2003, 11:11 AM
It could be possible that they are accessing the Clock using direct IO via a device driver.

I have seen many an exe with an embedded driver which they load to do direct IO, then unload when finished.

Just a small possibility.

Regards,

tgodd
nikolatesla20
04-14-2003, 12:48 PM
Another thing - did you only check the Imports for GetTickCount or did you also check strings table? Because it could be a dynamic import.

If you are using SI, another thing you could do is set a Breakpoint on a window message. You'll have to grab the softice manual to know what I'm talking about ...if you installed D.S 2.7 you will have that.

Anyway, get the window's handle and then do a breakpoint on WM_TIMER and see if anything comes thru or not...

It could be that any DLL that the program uses could actually do the counting, etc, etc.. so if it's using DLLs look at those too.

-nt20
Iwarez
04-14-2003, 02:44 PM
Don't know about you but I'am getting interested in which program you try to get to work.
qweasdzxc
04-14-2003, 06:05 PM
I have been using Ollydbg since I cant get softice to run on my machine. (problem with video card + drivers) I tried to search the dead listing I got from Wdasm and I finally found settimer, and Killtimer. Why wouldn't they show up in Olly?

The program is GuitarFX 2.6 .... it is a true demo prog. I found a reference to a serial number, just no place to input one in the demo.
This demo is limited by the number of days, time limit of effects processing, time limit of recording, you can't import wave files for playback during record, and ofcourse nag screens.

It looks like USER32.dll is keeping track of time, I guess I finally caught a break here!

Thanks everyone.
Kilby
04-15-2003, 06:38 AM
Please excuse me if I appear to critisize as that is not the intention.

You folks are really going about this the hard way ;)

I blame this on the fact that reversing these days is almost completely baised around breakpointing on API calls, unpacking, and finding where the serial number is compared.

ATM you are guessing which API is used and attempting to work from there, disavowed is on the right track but reinventing the wheel :)

You are curently suggesting bruteforce, this is acceptable, but wernt computers built to do the bruteforce work for us humans :)

Go and find yourself a nice game training tool (gamehack being one of them), and use that to find the counter. Let your PC do the work ! From there you can find the right piece of code easily.

It's lazy, easy and saves a lot of wasted effort when you can put the effort into something else more deserving.

If I appear patronising then I apologise, but I feel that the breadth of knowledge in todays scene is starting to constrict.

So much time is spent thinking about how things are done via the OS, between unpacking, decryption and the like.

Simplicity works learn to use it.

Try to lose thinking about the complexity of modern operating systems, think about what you want to do, then hit the right piece of code first time.

I think I will put somthing into the off topic section about this as I think there is quaite a lot to say about this.

Regards,

Kilby...
dELTA
04-15-2003, 07:08 AM
I'm sorry to say this after your long lecture and everything Kilby ;), but in my opinion it is most likely that there is no "counter" at all. There simply isn't a good reason why it would be saved.

My guess is a timer procedure looking something like this:

//This is the only data saved in the data segment
int calculated_limit_time; //This will never be changed,
//only calculated once at program startup

//This is the checking procedure
void TimerProc(void)
{
if (sample_time() > calculated_limit_time)
{
exit_program_or_whatever();
}
}

This means that the sampled time will be at the best saved on the stack (also possibly only in a register), which means you can never find it with a mem-compare-tool program.

Or even easier, the timer itself might be set to 4 minutes, and then just call exit_program_or_whatever() immediately in the TimerProc. In neither of the cases there will be any data so perform "differential analysis" on.

Also, in my opinion trying to figure out the workings of the program is always better than bruteforcing it. Bruteforcing only works for certain stupid protections, while "guessing" (or rather concluding/zenning) will always work. This also makes you smarter and more experienced each time, which in turn makes it even easier to predict the workings of the next program.

dELTA
tgodd
04-15-2003, 08:16 AM
Extremely well put delta.

I'm in agreement with everything you have outlined.

Having a deep understanding of how these things work
is essential to reverse engineering.

If you are using a tools which do most of the work for you, then
you are not truely reversing.

It is one thing to use the tools, when you understand how these things work.
It is completely something else when you rely on those tools, due to a lack of understanding of how things work.

I always suggest to Windoz "experts", whom I have been aquainted with, to learn Doz to expand on there abilities and understanding of the OS.

This is simply put, "Getting your hands dirty".

You can not fix a car if you are afraid, or incapable of touching an oily nut or bolt.

Get down and dirty folks.

Regards,

tgodd
Kilby
04-15-2003, 10:02 AM
This is split into two replys.

This is the civil and measured, as was the maposting it is in reply to

Delta:

No lecture intended just wanted to say that it can be much easier when you apply lessons elsewhere. Even if you are unsuccessful, atleast there is something to remove from the list of possibles.

As you say it depends on how it is implemented.

All too often things are implemented badly and timers are very prone to this (you would be surprised to see the number of apps that do exactly this).

I most certainly am not zen like (I wish I was but I'm way too up tight), but a couple of minutes testing for holes & general stupidity yields many dividends.

Learning to ignore the spurious noise within windoze enables you to discover what is really happening. Though possibly I just suffer from a low bordom threshold.

BTW: The most likely way for me to have a go at such a timer is:

1: Check what timer apis are in the import table

2: Check for counters

3: Log calls to getprocaddress for that task to see if anything is resolved at runtime (write a logger for this).

4: Use an API logger to log what timer calls are used by the app in question (write your own for this too).

5: Start monitoring any suspect memory addresses of API calls

6: How it exits (thats always useful)

It's sorting the wheat from the chaff, and only takes a couple of minutes and can save hours of wasted effort.
To me the bruteforce method is sticking breakpoints on every time related API and waiting for the right call, then nopping the following conditional jmp

I work from one side (excluding things) and other people work from the other end looking for things to include it's all personal pereference.

I simply feel that too much of what people call reversing in windoze is purely hoping to bpx on the right API. I have in the past made 1000s of calls to particular APIs just to annoy the people who rely on this technique. It really is funny

Anyway I hope you understand where I am coming from.

Kilby...
Kilby
04-15-2003, 10:05 AM
Second post.

Now I feel that I must be less reserved and civil.

The following is not supposed to be a flame and it is a bit off topic, but I feel that it is nessicary if you feel it isn't then thats fine.

If my original posting came across as arrogant, then I must state that wasn't the intention, possibly the posting in the off topic section may clear things up.

However I do feel that I am responding to arrogance, at least partialy directed towards me, I may be misreading it, or perhaps English is not the native tongue of tgodd, but I still feel that I must respond.

tgodd:

I thought, reversing is using whatever tools you have at your disposal, sometimes it's off the shelf, sometimes it's home grown, sometimes the tool is your mind.

Computers where built to remove repedative operations, and I dunno about anybody else but searching for the right bit of code can in fact be repeditive.

Once you find the guilty party then it's time to exercise your creativity to do something about it (I hate NOPs with a vengance).

So it's OK to use SICE (robbed no doubt), or ollydebug but not to use something that looks for changed values ?

oh dear ! I seem to have got it all wrong sorry !

Please be careful in what you say and how you say it, there is always somebody out there with a longer list than you and they may have know considerably more than you assume.

So how low down and dirty should one get ?

Windoze:
Hate it, but it's there and I have done way enough to comment within it to comment.

Dos:
Been there seen it done it, didn't bother with the Tshirt.
Redirected calls to mscdex and int 21
Long before sice was in the background, remember int 13
Game trainers, tsr's many apps and .sys files tweaked and rewritten

Amiga Dos:
Turn off the OS and hit the hardware directly.
Custom disc loaders, unpacking, 1KB demos
Code optimization for psygnosis developers
Using the blitter to help multiply complex numbers
DTMF decoder
Where is that T Shirt

Atari ST:
Where are those unpackers & disk loaders.
Oh theyr'e under the T shirt

Z80, 6502 and 6809 8 bit home machines.
Where are thise custom tape and disk load/save routines
The network driver for the BBC micro
The home designed & built samplers, network interfaces modems, parallel & rs232 ports, etc.
Mains ring networking.
Wrote own assemblers and debugging roms
T Shirts wheren't invented then.

6800 single board computer.
No assembler (hand assembled)
100 bytes of ram, hex keypad, 7 seg led display.
The only way to save your code was in a notebook using a pen.
Played tunes in an AM radio using interfearence from the machine, by using times loops

Hmmm what about building registers on a breadboard using NAND gates.

I think I still have the furs we cavemen wore in those days.

Anyway you can stop clapping your flippers like a demented seal that wants a fish from delta.

Possibly I have misread your post, but I doubt it.

Kilby...
tgodd
04-15-2003, 12:08 PM
I did not mean for my response to be offensive.

As for The list you gave on your experiences.
Yes I have been there and done that also.
The 80's were a wonderful time.

DEC PDP-11's
RadShack Mod 1, 3, and coco
Osbourne
Amiga
Pet

I still know all the CP/M fast keycodes.

I've been there also.

What does one do when the tool does not give him what he wishes for?

Pray?

Give me a break.
My suggestion was in fact the most rudimentary.
All requests for the time MUST do IO to the device.

You find the IO you can backtrack to anywhere.

Do you disagree with this logic?

Tools are useless without source or at least an understanding of how they work.

For praying will not yield much with respect to results.
The more one knows of inner workings, the less likely the project will be handed over to somebody of greater knowledge.

I do did not in previous messages try to be arrogant.

And correct me if I am wrong, but it sounds to me as though you discount the fact that you have had these past experiences.
Could somebody relatively speaking "new" to this stuff, not benefit from knowing how these things work.

It's sick to see people having to kiss feet to get answers from people who do have this inner workings knowkledge.

And as far as Breadboarding descrete gates, I would recommend anybody try it.

Imagine how clean peoples code would be if they knew
boolean algebra, and understood Karneu maps.
I know I proly misspelled Karneu, but this is not a spelling 'B'.

I am sorry for coming across so agressively, but your message DID warrant a defense.

regards,

tgodd
nikolatesla20
04-15-2003, 01:03 PM
"In my day, I hacked the AND gate by crossing the wire directly to the +5V line..and I LIKED IT!"

And I suppose both of you had to walk uphill both ways to the lab?

LOL

-nt20
tgodd
04-15-2003, 01:16 PM
Bwahahahaha

Stumbling, every step of the way.
Go to be that the knees hurt!!!

tgodd
dELTA
04-15-2003, 01:23 PM
:D
Not to mention that most of the time we were completely out of NAND gates, and had to build all our logic by only using OR gates. ;)
Kilby
04-16-2003, 12:57 PM
Well I'm glad that we all have that sorted out then.

(it wasn't your io post I was replying to BTW)

regards,
Kilby...
cRk
04-18-2003, 01:36 AM
i was able to get some info. and practice on this target, actually thanks to a cracker called realisty i was able to get the right places where the limit message comes and the cmp involved on this.... but there's one problem.. the program is crashing with a bluescreen after skeeping this limit.. it looks like i'm missing something or maybe this can't be cracked? because we're missing part of the Code... remember this is a demo....... did you handle to finish it and is working??.. if you want i can paste my research on this here.. just let me know. :)
Manko
04-18-2003, 02:54 AM
Hi!

Your thinking is slightly off. If it works during the timelimit, ofcourse it will work after, if you patch it right. :)

He is using something to trick you, no doubt...
...or maybe...

How did you patch it?
And have you looked into the proc, or the instructions
that create the values that are being compared?
Maybe he sets some things up...
Maybe you left the result... and he is using it later?

/Manko
dELTA
04-18-2003, 08:05 AM
A bluescreen after a patch is typically either a deliberate integrity check by the programmer (which can in that case be removed too), or a bad patch (which can in that case be rethinked and redone in a better and more correct way ;)).

dELTA
Kilby
04-18-2003, 03:48 PM
This comes back to understanding the code.

90% of the time a simple nop or jmp patch will do the job.

However every now and then the author will look for such changes, leaving a couple of choices.

1: Subvert the original protection in a suitably discreet place

2: Patch all the authors checks

/Hint on

My preferred option is 1.
eg if there is a call to the protection routine, set the appropiate flag at the start of the routine then return early, authors seldom check for patches at the start of a subroutine, usually they check the last few bytes.

/hints_off

Kilby...
qweasdzxc
04-18-2003, 07:10 PM
cRK, I haven't really had time this week, been busy at work. I was planning on going to a party tonight, but work blew that, So, I am going to try this again!
JMI
04-18-2003, 07:36 PM
Haven't played around with this program, but know that there is a partially working crack floating around out there for this version. The person who wrote the crack says that the 4 minute time limit is connected in some way to an "overflow of the level meters," which suggests a possible buffer. He suggests that the only way to prevent it from "overflowing" and stopping the program is starting and stopping the level meters.

Now I'm not suggesting that anyone use a ready made crack for this program, because you won't learn anything by doing that (and he didn't "solve" this problem any), but his "observation/suggestion" does seem to indicate a good potential point for analysis of the code. Maybe it's not an "overflow" or maybe it is, but it certainly suggests that this might be a very good place to begin the search for the elusive "timer." This is also reported as a truely crippled demo without the code for "input function," which is the only true way to "protect" demo software, but it still can provide a good object for study of the protection system.

Regards.
qweasdzxc
04-18-2003, 07:53 PM
You can turn the VU level meter off... I know that if you pause execution of the program code while the levels are on, you can step right into the level meters! you find a loop... at somepoint a condition is met and you jump into the normal program code, and eventually back into the meters. (didn't spend too much time on this part). By pausing with the meter levels off, you drop into the normal program code and it seems to contain the important code. I'm still looking.
disavowed
04-18-2003, 10:01 PM
well, i finally decided to take a look at this for myself

i tracked down where the messagebox was coming from, although that wasn't particularly useful. i then decided to look for one of those programs i had mentioned for making game trainers. after 5 minutes of searching with google, i found this, which suited my needs perfectly: http://www.gw32.de/english.html

it allows you to search for changing values in memory. quite simply, i just watched for areas of memory that kept increasing. the only address of memory like this in the process's address space is: 0x55C7D8 (gamewiz32 will say 0x55C7D9... close enough)

so, we take a look at 0x55C7D8 with ida. lo and behold, it's initialized to 0 when the thread starts, and it's constantly updated and checked in sub_419690. setting some wise breakpoints with olly lead me to figure out that the '5' in:
.text:00419719 cmp dword_55C7D4, 5
is actually the number of minutes allowed + 1. setting it to 1 will cause it timeout immediately. setting it to 2 will cause it to timeout after 1 minute, whereas originally the 5 causes it to timeout after 4 minutes. anyway, chaning
.text:00419720 jl short loc_419773
to an unconditional 'jmp' instead of a conditional 'jl' gets rid of the timeout.
disavowed
04-18-2003, 10:06 PM
heh, evidently that causes an eventual overflow. the solution would probably be to just prevent the counter from incrementing. i'll leave that as an exercise for the reader, now that you know what sub_ to look in ;)
qweasdzxc
04-18-2003, 10:13 PM
Disavowed, I agree with you that the memory dump/compair is the easy way to do this, I have been trying to trace the code, and figure it out for myself, the hard way, (so I can better understand the OS, and what protection schemes really do, plus learn some more assembly). According to your post, I am in the right area of code though. :D ....
JMI
04-18-2003, 10:21 PM
qweasdzxc:

Let me encourage you to maintain that attitude. Learning to understand the Code is the essence of what you need to advance your skills at RCE. Patching without knowledge is not a learning experience you can generally apply on other software. If you improve your level of understanding, you will be able to carry this forward when you begin to examine your next target.

Regards.
cRk
04-19-2003, 12:43 AM
Guitar FX BOX 2.6

:0041A384 C1E005 shl eax, 05 <-- 05? maybe 4.59 Min.
:0041A387 03C2 add eax, edx
:0041A389 F6401001 test [eax+10], 01 <-- press Start
:0041A38D 7428 je 0041A3B7
:0041A38F 8B0DC8C75500 mov ecx, dword ptr [0055C7C8]
:0041A395 E876FBFFFF call 00419F10 <-- continue process
:0041A39A A1C8C75500 mov eax, dword ptr [0055C7C8]
:0041A39F 40 inc eax
:0041A3A0 99 cdq

once we're on 00419F10 there's alot of piece of code which i think
it handles the sounds process... please correct me anytime if i'm
mistaken.. i'm here to learn more and correct my mistakes...

continuing..

check a little the big piece code.. and go down until you get to

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0041A0AD(C), :0041A0DB(U), :0041A124(U), :0041A16A(U)
|
:0041A17D 8B4DF8 mov ecx, dword ptr [ebp-08]
:0041A180 E80BF5FFFF call 00419690 <- let's go here

on 00419690 continue reading the sound process and there alittle cmp
which compares a virtual (rva) location with 05 which mean our target
dosen't read 4 minutes exactly as it says.. i think it reads 4.59 minutes... go to 00419690 and read a little until you see this:

:00419713 890DD4C75500 mov dword ptr [0055C7D4], ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004196F6(C)
|
:00419719 833DD4C7550005 cmp dword ptr [0055C7D4], 00000005 <<-- compare minutes here
:00419720 7C51 jl 00419773 <-- if 5 minutes passed jumps-|
:00419722 C705506D550001000000 mov dword ptr [00556D50], 00000001 |
:0041972C 833D6CC7550000 cmp dword ptr [0055C76C], 00000000 |
:00419733 740D je 00419742 |
:00419735 8B0D94C75500 mov ecx, dword ptr [0055C794] |
:0041973B E8E02DFFFF call 0040C520 |
:00419740 EB12 jmp 00419754 |
|
* Referenced by a (U)nconditional or (C)onditional Jump at Address: |
|:00419733(C) |
| |
:00419742 8B1588645500 mov edx, dword ptr [00556488] |
:00419748 8B02 mov eax, dword ptr [edx] |
:0041974A 8B0D88645500 mov ecx, dword ptr [00556488] |
:00419750 51 push ecx |
:00419751 FF5048 call [eax+48] |
|
* Referenced by a (U)nconditional or (C)onditional Jump at Address: |
|:00419740(U) |
| |
:00419754 8B1518C75500 mov edx, dword ptr [0055C718] <----------- jumps here
:0041975A 8955EC mov dword ptr [ebp-14], edx
:0041975D 6A00 push 00000000
:0041975F 6A00 push 00000000
:00419761 6865040000 push 00000465
:00419766 8B45EC mov eax, dword ptr [ebp-14]
:00419769 8B481C mov ecx, dword ptr [eax+1C]
:0041976C 51 push ecx

* Reference To: USER32.PostMessageA, Ord:01DEh
|
:0041976D FF15D0D44400 Call dword ptr [0044D4D0] <-- our nag message comes here

if we make jmp on 00419720 you'll note if won't give any nag and will keep working but somehow it will stop and you'll note the level meter will stop and will give you a bluescreen fatal error after 2 or 3 more minutes , the system says to pressed any key and bye bye program.. i wonder if there's still another check for this maybe a cmp? because i also have tried all time related possible solutions and still not luck

the only possible compare i found for this is the above one but i guess there's something more
somewhere... i'll hope i'm missing something. another thing is that the nag about the 4 minutes limit looks like a messageboxa.. if you do bpx messageboxa sice will break when the 4.. minutes are over.. the messageboxa comes from 0041FF74 i don't see there any cmp or way to skip it it looks that first call USER32.PostMessageA while tracing a little just before the limit is over
and exactly the message comes from 0041976D then the messageboxa shows up .

i got this code where the messageboxa comes from :

:0041FF6D 8D05C0E94100 lea eax, dword ptr [0041E9C0] <-- read here, there's a C3 only
:0041FF73 50 push eax
:0041FF74 FF2538545500 jmp dword ptr [00555438] <<--- Messageboxa here
:0041FF7A 5F pop edi
:0041FF7B 5E pop esi
:0041FF7C 5B pop ebx
:0041FF7D 8BE5 mov esp, ebp
:0041FF7F 5D pop ebp
:0041FF80 C20800 ret 0008

to skip the nag message i did change push (55) for C3 at the begin of that piece of code on
0041FEB0, but it won't make any change.. it only remove the messageboxa :(

if i increment value on cmp dword ptr [0055C7D4], 00000005 for
cmp dword ptr [0055C7D4], 00000009 i guess it should read 9 = minutes in this case ?

while tracing alittle bit more.. while the program process the sounds looks it read locations
between 0041BFDC & 0041BED7 there's a loop and i think that maybe there's the function where it stops the sound processing. "i'm not sure" i wonder what exactly KERNEL32.SleepEx does
because there are many references about it there..

is there a way to make it loop so we won't have to press manually start each time 4 minutes has passed ? like simule we have pressed "Start" after 4 minutes has passed. any ideas which bpx should i set to catch where exactly the sound processing stops?.. you can note it when the level meter stops responding.. that's a good sign. i tried closehandle but nothing happends.

Any tips, complaints or possible help is welcome to resolve the time limit mistery of this program.
qweasdzxc
04-19-2003, 06:54 AM
The SleepEx function causes the current thread to enter a wait state until the specified interval of time has passed, or until an I/O completion callback function is called.

This function is available only in the Win32 API.

DWORD SleepEx(

DWORD dwTimeout, // time-out interval in milliseconds
BOOL fAlertable // early completion flag
);

Parameters

dwTimeout

Specifies the time, in milliseconds, that the delay is to occur. A value of zero causes the function to return immediately. A value of INFINITE causes an infinite delay.

fAlertable

Specifies whether the function may terminate early due to an I/O completion callback function. If fAlertable is FALSE, the function does not return until the time-out period has elapsed. If an I/O completion callback occurs, the function does not return and the I/O completion function is not executed.
If fAlertable is TRUE and the thread that called this function is the same thread that called the extended I/O function (
ReadFileEx or WriteFileEx), the function returns when either the time-out period has elapsed or when an I/O completion callback function occurs. If an I/O completion callback occurs, the I/O completion function is executed.

its a fancy wait command... IN this program I think it has to do mainly with sound latency, the coder probably used this for faster code, while still being able to pause a thread...
almos
04-20-2003, 08:16 AM
It is easy to get THAT counter:

004196EF cmp dword ptr [0055C7D8], 00000000
004196F6 jne 00419719
004196F8 mov edx, dword ptr [0055C7D4] ;get minutes
004196FE mov eax, dword ptr [0055C7D4] ;ditto
00419703 mov dword ptr [4*edx+00554364], eax ;store it elsewhere...
0041970A mov ecx, dword ptr [0055C7D4]
00419710 add ecx, 00000001 ;increment minutes!!!
00419713 mov dword ptr [0055C7D4], ecx
00419719 cmp dword ptr [0055C7D4], 00000005 ;cmp time with limit
00419720 jl 00419773 ;not yet 4+1, continue
...
shortly after comes the routine to increase minutes:

00419773 mov ecx, dword ptr [0055C7D8] ;
00419779 add ecx, dword ptr [ebp-18] ;x80
0041977C mov eax, dword ptr [0045CCFC] ;22050 (Hz?)
00419781 cdq
00419782 and edx, 0000007F
00419785 add eax, edx
00419787 mov esi, eax
00419789 sar esi, 07
0041978C imul esi, 0000003C ;60 (second)
0041978F shl esi, 07
00419792 mov eax, ecx
00419794 cdq
00419795 idiv esi ;when edx=0, 1 min elapsed!
00419797 mov dword ptr [0055C7D8], edx ; <<<

Thus, by putting 0 into edx/[55C7D8] a few times, one can trigger the '4 mins limit reached' condition, rather than physicaly waiting out the 4 minutes :) So it's possible to make it 'faster', but unfortunately won't work the opposite way - 'fixing' this counter (say by changing the increment to 0 at 419710) later still results in a blue screen.
How it does that, I still don't know, but I doubt if uses any patch/integrity check. I reckon rather it is some buffer or stack overrun causes the blue screen.

A time check not necessarily requires a windows timer. For example, with a sound sample rate of 22050 Hz, when processed say 11025 samples then 11025/22050 = 0.5 second has elapsed. One can just count how many times were sound buffers filled... etc. and derive the duration. In fact, there are quite a few other 'counters' (using floating pont numbers) related to sound processing. Yet, I feel the solution is not with those FP values. How do I reckon?

Previously I eliminated all limitations from 2 older (2,1, 2.5) versions, but when tried the usual fixes on this version (maybe in July last year) failed with the 4 mins limit. If there is no another 'time check' then sure has some 'screw-it-up' routine. It may be just writing memory/buffers eg. [offset+counter x constant] which eventually kills Windoze, unless stopped in good time (bit over 5 mins). This surprise is surely absent from the older versions. Since the major difference is in multithread use in v2.6, I guess that's the suspicious part to deserve extra attention. For example, there is another (faster) 'counter' at [0055C7EC], related both to the common minute counter and also to thread activation.

In any case, this is a real bitch, a good protection.
qweasdzxc
04-20-2003, 09:13 AM
Almos,

Your right about making the timer faster, I managed to get the 4 minute nag in about 30 seconds of runtime!! But I didn't manage to slow it down yet.

I suspect that there is a second check elsewhere. I have found several references to killtimer since I decided to use Wdasm to look at the code. I set breakpoints on two of them and let the app run out the 4 min. I didn't hit either brp. I also checked the 20 second recording limit with the same brp's, and failed to break on either. So, I am going to back trace the code to see what calls the two killtimer's. I have a feeling that it will be a second "security" timer.
tgodd
04-20-2003, 09:55 AM
I have personally written code which requires that the counter continue to count.

If the counter is stalled or advanced the program crashes.

Do not always rely on being able to stop or advance the counter.

The values will be referenced more than likely within another
thread.

You may want to focus there!!

Just a point to take into consideration.

regards,

tgodd
cRk
04-20-2003, 10:50 AM
i got the idea.... this program always read the system time.. because how it knows 4 minutes has passed? sure is reading system time clock somehow.. if we reverse this to fool it and skip reading the system time clock.. this is just a suggestion.. btw i think all wee need is to find the right place to patch , i would not consider this a good protection.. other thing it is possible the code to process the sound it's done to stop right away after 4 minutes and there's now way back, no loop or C3. so forcing it to continue it will just crash.. why bluescreen? maybe takes too much memory,while doing nothing after 4 minutes "Not sure". or maybe we're missing the part of this code where the program could have a loop to keep processing. it is possible it has an internal counter that counts appart from the system clock?.. i don't think this is done with killtimer.. SICE will break right away before the little nag..in this case don't break anywhere..
qweasdzxc
04-26-2003, 10:46 AM
Tgodd might be right.. the program does setup a new thread after startup. And I do think there is a second counter somewhere. I set olly for just in time debugging, to check the program crash after 4 minutes and when I broke, I was dumped into a real mess. instructions overlapping blocks, unknown commands, and illegal procedures.

Crk you might want to look at getsystemtime as filetime, this just occured to me. I will check on that too. But you can start the program and get into the 4 minute loop, then change the system time with out the nag appearing. At any rate, I've been too busy to look at it much.


SOFTICE Problems..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SOFTICE Problems..
PDA

View Full Version : SOFTICE Problems..

cRk
04-13-2003, 06:01 PM
i've have searched for some discussions about this.. but all i could found was about problems setting breakpoints and some other.. my problems is that i can run Driver Studio 2.7 on my winXp.. i made a clean full installation and all was great.. i got the retail version.. but i can't make SICE to load with WinXP. i checked some of the best options to load it but it won't even run not even in manual mode from the start menu.. it always freeze my system.. i got WinXp Pro with all updates until now.. does anyone experienced this conflict?........ i also have the cuestion and doubt... Does SoftICE 4.05 can be installed and work on WinXP?.. if i can't make driverstudio to run well on WinXp maybe the one for Win NT works?? btw thanks in advanced for any replies or possible help
JMI
04-13-2003, 06:13 PM
Your post does not explain what the problem is that you are having and whether you search the board "here" for other posts related to "WinXP+Softice".

For example, have you set Sice not to load on start-up so that you have to use the loader to make it active? When the system starts do you have the statement on the bottom of the screen that you can press escape to stop the loading of Softice? Have you set it in the configuration to do this? You shouldn't be attempting to "start" it from the "start" menu, but with the "Loader." Did you rtfm by any chance??????

There are many things to check, because D.S. 2.7 should work.

Regards.
cRk
04-13-2003, 06:51 PM
yes brother i see the message press Esc to abort SICE loading... this show up in case i want it to load in the boot matter... when i see the welcome messsage almost my winXP is loading then it stay there and nothing happend.."Freezed" then if i decided to run it from the shortcut of the start menu the MsDos shows up but nothing happends... then i have to reboot the system manually (reset).. i hardly want it to run..... my system is very stable and clean.. i got 320 MB of ram and a good video card.. i don't see nothing wrong on my system.. maybe a program installed is detecting SICE and freezing up my system??... i'm thinking About TWEAKXP Pro.. latest version because has many SICE checks, regm. FileMon..... but in fact i don't have it running at start up with windows... any ideas??
pasha
04-13-2003, 08:40 PM
greetz crk

i had problems too with DS 2.7 and my WinXP on boot. however, i was able to start it up manually. so its kinda wierd ..

however, now i run DS 2.7 on 2k pro and it works absolutely fine with no problems.

i know this might not be of much help, but just thought i would state it neverthless.

best regards
pasha
LOUZEW
04-14-2003, 12:39 PM
Hi, Crk
I remember when i've installed DS 2.7 for the first time under XP, i Had the same Prob.

My motherboard is a VIA chipset based one, then i had installed the VIA patches like the doc said !

After a few days i found the Pb: The VIA AGP driver (included in the 4 In 1 Drivers from VIA)., OK formatted the HD , and installed XP again without the VIA AGP Driver. After that ALL Work fine !

Ah, yes an other thing, With XP SP1, there is some tips to know to make DS 2.7 breaking at entry point, if you have these prob, let me know, i'll give you some infos on this subject !
cRk
04-14-2003, 07:04 PM
i got a PCChips motherboard.. all work fine in my system, and all program i've installed work OK on winXp.. but i'm a little confused... i think this is happening due to a system debugger detection that TweAkXP Pro latest version is doing.. i see that actually has a .sys and a .dll files that looks they handle and checks for debuggers those files are located in the system32 dir. i see something in them about killdebugger..... i think this stuff is detecting the debuggers and crashing my system some how... i'll try to make arestore point and clean all that TweakXP Pro garbage then i'll make a new installation again.. i know this driver studio should work ok.. and something is not working on my system.. anyway this WinXp is not so good as microsoft promised...this window crash for nothing means is so delicated that for nothing you can't imaging you could be formatting your hard drive. to get it back booting.. one last cuestion ..could this happend due a bad serial used? i mean maybe the keyg.... i used is not so good at all. btw thanks for replies ;)
naides
04-14-2003, 09:25 PM
As far as I can tell, a bad serial will prevent DS2.7 from install, it does not sabotage its functioning.

Have you tried to follow the start-up WinXP trouble-shooter?

It may help you isolate the file: exe, sys, drv etc that dislikes the presence of Sice, and remove it from your system.

In esence you do a stepwise boot, until you get to the area that locks your computer, note it and squash it.

Am I telling you old news?


function disbaled
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > function disbaled
PDA

View Full Version : function disbaled

thematrix
04-14-2003, 06:21 AM
i am newbie the 1st info i would like to give u
i was cracking pcmedik i was the find the final checking to and patched and it give the thanks message but till the sone functions r disabled?what could be the problem
thanks
squidge
04-14-2003, 07:22 AM
Let me guess, you changed a JE or JNE to the opposite to bypass the test? If so, there's most likely lots of other checks in the program that you'll need to do this also.

Or the much better way - find out how this flag gets set (eg. find out how the serial is calculated/etc) and write a keygen/registration program.
Shoob
04-14-2003, 09:31 AM
if you have luck try to look in you favourite dism for the success string and look a little up there must be a call before the jne, get in and look wich addresses referes to it.

don't work often btw.
thematrix
04-15-2003, 04:25 AM
the problem is that there isnt any string refrence in this file as myself somehow unpack it it wasnt unpakced well as there is no string ref section enabled i am new in unpack cant find a good genral manual unpack tuttorila the 1 presnet r very confusing
Manko
04-15-2003, 07:02 AM
Hi!

Have you run this exe throug PEID to see what it is packed with?
If so, please tell us, since that will make it MUCH easier for us to help you.

/Manko


icedump help??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > icedump help??
PDA

View Full Version : icedump help??

thematrix
04-15-2003, 04:47 AM
how to use and install icedump as i searched and found no goos tutorial how to use and install icedump i have not used it my life befor so pl help me
thanks
Kayaker
04-15-2003, 10:53 AM
Run the icedump.exe version from the directory corresponding to your Softice version (type VER in Softice if you don't already know it). That's it. The console output will tell you if you've got it right. Now within Softice you can use the commands such as /dump, /pedump, /screendump, /tracex, /protect, etc (these are probably the most commonly used). If you're confused about the syntax of the commands, do a Search on this board for the actual command (i.e. "/dump") and you'll likely find examples.

There are no Icedump tuts that I'm aware of, but this is of course all in the manual, so the old addage RTFM applies. If you're confused by what it says, RTFM again. If you still have questions, feel free to ask them - after RTFM yet once again.

Kayaker
hobferret
04-15-2003, 02:07 PM
Hiya thematrix

Don't forget to have exports loaded in SI:)

/hobferret;)
thematrix
04-16-2003, 03:28 AM
Hiya thematrix

Don't forget to have exports loaded in SI

/hobferret
what r exports in SI?
nofurs
04-16-2003, 05:12 AM
Hoi,

What he meant was the exports in the winice.dat

EXP=c:\windows\system\kernel32.dll
EXP=c:\windows\system\user32.dll
EXP=c:\windows\system\gdi32.dll
EXP=c:\windows\system\comdlg32.dll
EXP=c:\windows\system\shell32.dll
EXP=c:\windows\system\shell232.dll
EXP=C:\windows\system\advapi32.dll

just uncomment the ";" in front of it

hobferret:

you are answering out of the question
I'm just "explain" a bit more on what your answer is
FoxB
04-16-2003, 05:41 AM
Hi ALL!

I run the icedump.exe version from the directory corresponding to your Softice version (type VER in Softice - view 4.0.5 build 334).
ICEdump says me:
------------
idedump v6.0.2.1 for winice v4.05 build 334 loader
icedump was not loaded yet
VXDLDR failed to load icedump
------------

Any idea?

FoxB
nofurs
04-16-2003, 05:46 AM
pls be specify your operating system

icedump doesn't works ds 2.7 if you are in win98se
FoxB
04-16-2003, 05:51 AM
Win98se 8-(

FoxB
nofurs
04-16-2003, 07:24 AM
Hi FoxB,

I have check that softice version you mention.That currently version is for win95.
You have to find later versions of icedump id6018.zip.If you can't find it mail me I'll send it to you
thematrix
04-16-2003, 09:40 AM
ok after choosing the right it started working thanks
but how to use when i CLtr+d and softice pops up and hwne i give command like :- /DUMP does not work??


Scent thoughts by a grumpy old man
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Scent thoughts by a grumpy old man
PDA

View Full Version : Scent thoughts by a grumpy old man

Kilby
04-15-2003, 08:16 AM
After responding to a post in the newbies section, I have decided to pose these questions in the off topic section.

1: Is the current knowledge base becoming to constricted in the RE community ?

2: Are we ourselves making things too complecated for our own good ?

-----

1:
Cue Grandad Kilby,

When I started off I wanted to convert tape based games to microdrive or disk, there where very few apps to get interested in, and even less reason to actually own them.

Later game training turned up.

It was simple at first, load the file and save to disc.

Then came custom loaders, then SMC, encryption, passwords and even API redirection

All the same things that you are seeing these days.

The difference was that there was no processing power and almost no memory, you where happy if you had a few hundred bytes free to work on a target. You developed a lot of lateral thinking, such as hiding code in display ram, writing custom tape & disk routines, writing your own disc copiers. What I am trying to say is you had to have a very wide range of knowledge and abilitys.

Now it sems that many people get upset if there isn't a handy API to break on with a jnz right after it.

All the lateral thinking seems to have vanished.

Apart from Damn and tE! nobody really seems to look for holes in the publishers crypto implementation for example. It all seems to be a couple of nops or a game of hunt the API call.

I honestly think there needs to be a little more thinking as I have watched the departure of some of the "more interesting and able" scene members.

Yes there are interesting folk on the way, but there are less of them every year, for the first time I really think I see what Fravia truely intended.

It's all so bland & generic that I am in a quite withdrawn phase currently. It's simply not very interesting.

First there was visual programming, now it feels like visual reversing has arrived :(

For the most part the folk in the ripping scene are probably doing the most interesting stuff at the moment (when they start playing with bigfiles anyway).

-----

2:

This may not be fair as the original discussion was in the newbies section, but as we know much of the interesting 'work' happens there anyway.

What prompted this was regarding an app that terminated after 4 minutes of use.

There where replys there from folks who know more about packers, API redirection, code injection and stuff, than I know (and I suppose that wouldn't be hard either).

However what struck me was that although inteligent suggestions where being made but it was all so complicated, and it didn't have to be that way.

It's like the music scene in the 70s where any real innovation had turned into bands like Supertramp & Yes. Basically lots of clever people doing clever things, but losing sight of the fact that a 3 chord song with a decent 3 piece bvand, can be much more effective than a classicly trained 12 piece band with all the latest kit.

Only one other person really looked at the fact that ther ewas a counter, and that the value the counter started at (or indeed ended at) was unimportant and that was disavowed, but even he made issue more complex than it should have been.

The important fact is that there is a counter !

The API used to determine when to decrement that counter dosn't matter.

Step away from APIs, crypto functions, API redirection, IDT & SICE detection and think about what uses counters. Games use them, for lives, ammo and all that shit. So get a copy of gamehack and off you go. It's a small (and imperfect) example of the RE community ignoring simplicity, and making their own lives harder in the process.

This is not intended to criticize anybody, but are we actually patting ourselves on the back too much about how clever we are ?

I personally am always in danger of dissapearing up my own arse with some of the overly complex ideas I come up with.

After all Alexys cleverness in asprotect (for example) is undone by his own customers not using what he provides.

If Alexy dropped all the double dip, hiding of the OEP and API redirection, and his customers used his license manager and asprotect API properly, would asprotected apps be any harder to deal with ? TOO DAMN SURE IT WOULD.

Things would be much worse even if his customers used a new private key for each major update so there whern't loads of blacklisted serials carried around to make it easy to dump anyway. It costs nothing at all to email out updated serials to all your registered customers.

In reality it no great hassle to the customer (if done properly), als they also like to know that when they pay for an app, that everybody who uses the same app has had to pay the same price. Otherwise they think "well why should I be the only paying customer."

Yes we do have over complex systems before anybody thinks I am suggesting otherwise, but always keep the goal in mind. A few minutes thinking can save hours of work, especially if you work outside the accepted norm.

Sorry if this is overly long I may be a grumpy old bastard today, but I don't want to see talent wasted.

Kilby...
disavowed
04-15-2003, 09:09 AM
thanks for the backhanded complement ;)
Hoof Arted
04-15-2003, 09:31 AM
Kilby,

Thanks for the insight. I have always been a strong believer that there is always a simple way and hard way to do things. Not just RCE wise. It has been months since my last post to this forum, partially because I kind of lost interest in RCE and kind of because I now have a 9 month old and a very demanding job. Enough of my bull. Here is what I want to say.

I have lost interest in RCE because I did not want to become involved in the complexity of dealing with problems that take days to solve when I clearly did not have the time available. I also did not want to spend every waking moment thinking about the problems that I needed to overcome, life is too short. You are correct that people are not shown that there is more to this than, patch this, bxp that. Many times I have discussed the problems with the whole RCE "education" system and how it could be resolved but nothing ever came of it.

It is about time that those of us who do or dont do this sort of thing go back to basics. Learn to take things at face value and forget a little of the stuff we learned in the "other" applications we had a look at. I recently inspected an application that checked the serial against a database on the internet and returned a HTML result, STD, PRO or Platinum.

At first, my response was to try figure out a way to change the application to execute my own code and make changes to itself and do a bit of inline patching and blow me off and and and...

That would have taken me deep into the heart of the application and driven me mad. I went for a smoke, came back and sat down. I closed the debugger and opened the application in a HEX editor and changed every instance of "Platinum" to "Errorkey" and low and behold, the application has Own3d. A simple text change.

My point is that I whole heartedly agree with you that we often climb up our own arses thinking that we know the "best" way of doing something when often it is right in front of us. Time to teach the newbies that giving yourself extra lives or power in a game is just as important as creating the ultimate 5001 in 1 keygen. When you know how to play with the debugger, actualy play with it, the hard stuff becomes very easy.

Until December ;-)

Hoof
nikolatesla20
04-15-2003, 09:42 AM
I agree with you Kilby!

Yes, there does become too much dependence on API's nowadays, but you have to admit, that is how the Windows OS works for almost all it does, so almost everthing uses an API somewhere - and when you're a newbie, there is so much to learn it's overwhelming. So they feel they need to start with something that is familiar.

Personally, I like to think out of the box, and reverse by thinking, not by examine what functions are called, because you can always find a hole somewhere that the programmer didn't think of. For example, I once had a program that had a similar time limit. So I tried searching for the hex code that equated to the time. I didn't find it of course, but after only a little more searching I found that section where he was doing the checking, and what the programmer did was simply get the time and ad FFF to it, and then check it. So lesson learned, another thing to keep an eye out for - to think out of the box.

That's why it's good to learn ASM and good to learn file formats and good to learn all that low level stuff. I gives you more power and creativity to do things in different ways than just using some middle - man code like API's.

I agree with you 100% Kilby, I myself have been impressed by the lateral thinking by groups like Damn and tE! -

A program is a life form, it breathes data. It takes in something, and outputs something. All you need to do is examine the inputs, and the outputs, and then glance at its digestive system, and you can usually tell how to mess with it already from there. That's what the "zen" stuff is all about (zen? whatever. It's called smarts!). All you have to do is outhink, outcreate the programmer.

Anyone can do that if they really want to, and you don't need tons of fancy tools, but practice helps. Newbies have to start somewhere until they learn all the ropes. Maybe it's just because newbies get good and then they leave this place. After all, when's the last post you've seen by Splaj or evaluator, etc.? They are masters of their art, and they are hardly seen.

So the quality of the posts you see is due more the fact, in my opinion, that the older wise quality ones don't come around anymore. They've solved their challenges already and now they are bored.

-nt20
Kilby
04-15-2003, 10:18 AM
The original title should have been Recent thoughts by a grumpy old man.

However Scent could be a better choice after all (though chosen by my crap typing).

Diavowed:

The complement wasn't supposed to be backhanded I'm just lazier than you :)

Hoof Arted:

Congrats on the 9 month old.
You have summed up what I have been feeling for a while but I just can't walk away from finding out how things work ;)

nt:
A good question always provokes a good answer, though it may not be the one that you want.
Evaluator and Splaj had a way of doing that :)

Personally I like simple and clean, and to know what I don't need to look at before attempting any work on the actual code.

However I feel that I may have started a disgreement with somebody who want's it to be a complex black art :eek:

Only for experts who understand all the code :eek: and you arn't allowed to cheat by using tools :confused:

Anyway I have probably put my foot in it again.

love N hisses,

Kilby...
dELTA
04-15-2003, 12:47 PM
I'd really hate to ruin this nice philosophical moment and everything ;), but I still don't think that you will find a counter in that program if the programmer had half a brain (see my post in that thread). :D

Why are API:s so bad in this case? Breaking on the API that is used to sample the system clock (or the timer API:s) would be an excellent, not to mention simple and clean, method to pinpoint the time-checking code in such a situation. Having a good understanding of which API:s that are probable to be used in a certain situation is an unvaluable tool for reversing/cracking programs!?! Once you have pinpointed the correct position in the code through the API, you read it, understand it, and apply a graceful 1-byte patch to kill it. :) Can't think of a better way actually.

But sure, I'm guess some of the things you say are good and true and all, I just think the API thingy is quite unprovoked, that's all. ;)

Later,
dELTA
dELTA
04-15-2003, 01:25 PM
Didn't see your reply in the newbie forum until now Kilby. Anyway, I just think your original post in the newbie forum was a bit easy to misunderstand, that's all. Now let's just all be friends, ok? ;)
Kilby
04-16-2003, 01:10 PM
If I was hard to understand, sorry, my boss was wandering in and out so it's had to get a good train of thought.

I hate apis only because 90% of so called reverse engineers, bpx an api then look for the jnz straight afterwards.

In ye olde days you where aleays on a voyge of discovery as apps programmers tended to find their own solouion.

Back then the code woods really did exist.

Friends again ?

More like when was it any other way :)

Best wishes,

Kilby...
dELTA
04-16-2003, 06:16 PM
Just like you say, I don't remember being anything else than friends. ;) Anyway, maybe just consider using less provocative language in future posts to avoid similar situations altogether, just a tip. :)

Later,
dELTA

PS.
A good way to stop your boss from coming into your room all the time is to engage in lengthy discussions about useless things with him everytime he comes. Then he will stop coming at all after a while. :p
Woodmann
04-16-2003, 06:46 PM
I hope your not "flexing" on Kilby ;)

Woodmann
dELTA
04-17-2003, 08:59 AM
Just trying to clear up a little misunderstanding in the newbie forum, and looking out for the good atmosphere of the board, that's all. :)

dELTA
JMI
04-17-2003, 04:16 PM
Hey! I'm not sure Kilby is old enough YET to be grumpy. :D I though that was a dispensation reserved for me, or is my dementia just acting up again?? :p

Regards.
Kilby
04-18-2003, 03:41 PM
Nope no flexing noticed ny me :)

However I just use provocative when I feel it is being used towards me (nope it wasnt delta who used it).

Kilby...


SoftICE battles DOS-Mode !?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE battles DOS-Mode !?
PDA

View Full Version : SoftICE battles DOS-Mode !?

OHPen
04-15-2003, 01:38 PM
Hi folks,

following configuration is used:

Win2k 5.00.2195 (SP3), using SoftICE 4.27 (build 562) with IceDump & IceExt. After i fired up Sice i can't even start any DOS-Box, when i tried i got an exception and DOS-Box got closed.

What can i do to solve this fucking prob.
It's very fucking for me, 'cause i have to run Hiew and other tools together while Sice running in background, but i CAN'T !!!!!

Please give me some hint,

thx in advance,

OHPen
Aimless
04-15-2003, 05:07 PM
Maybe a little respect and better language?

Using the "Phuck" word 2 times is not making you leet. Neither is it emphasising your problems so that reversers will rush to solve your issues, because you used "THE" word.

This is a RCE messageboard for reversers. Not a SEX channel in a freeware chat room. So a decent language vocabulary would help.

As for your question...

1. It seems that installation of Win2K/Ice47/IDump/IExt may not be a good combo for your machine.

2. Do this therefore:

a. Uninstall Softice, Icedump and Iceext
b. Try running the DOS command prompt
c. If it does not run, you may have to install Win2K afresh
d. If it works, or after you have successfully reinstalled Win2k, install softice
e. Try running the command prompt after the installation of Softice
f. If it does not work, you need to get the standalone version of NTice 4.05 (stop using the DS 2.7 one)
g. If this works, then you install IceDump
h. Try running your command prompt after that.
i. Try the same with Iceext.
j. Just follow this simple isolation prodecure, and you should be able to find out where the problem is.

Remember, that Windows 95/98 have their internals split open by Numega. Hence all these complicated clustering of applications will work. NT/2K is a different ballgame, and I doubt that considering the speed of release of the NT family, Numega really caught up with the kind of depth they did for the 95/98 ones. Any software working at System Levels in NT/2K is suspect of crashing or making your system behave erratically, unless of course, its from Mircosoft.

And mind the language too.

Have Phun


Correctly stated question gives the true answer...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Correctly stated question gives the true answer...
PDA

View Full Version : Correctly stated question gives the true answer...

banshee
04-15-2003, 02:52 PM
One thing I want to discuss: is there any way to make unreversable serial number protection? I mean not uncrackable, cos there is always possibility to change je->jne, but unable to keygen. Usually process of serial check seems like that two parts must be equal:
1. entered serial = f(some magic) or
2. some magic = f(entered serial)
3. or like that (entered serial)^(some magic1) = (some magic2), where ^- some operation
The first way is more stupid cos by changing some bytes reverser gets keygenerator built-in in the main application. Last two ways are similar, I think, and the leak of that scheme that developer of protection has to generate true serial himself. That makes f reversable:
true serial = f`(some magic)
Of course he can make that f very complicated, but finally it will be reversed just because it is reversable by definition
My question is: anyone has an idea to solve that problem and create unbreakable serial check? May be I can't see the simplest way, just point me. :confused:
r4g3
04-15-2003, 03:12 PM
ye.
runtime code decryption using asymetric cipher
dELTA
04-15-2003, 03:28 PM
Yes, as r4g3 says (although in very few words ;)), the best way to do this is to use asymmetric cryptography (like for example RSA).

Example:

Software publisher does this:

X = encrypt_with_key1(secret_value + salt)

Program does this:

Y = decrypt_with_key2(X)
if ( <Y == secret value + some salt>)
{
<license is valid>
}
else
{
<bad cracker>
}

Where key1/key2 is the asymmetric key-pair, and X is the "serial" that is given to the customer. Key1 is kept secret by the publisher (in his keygen), and key2 is embedded in the application. Salt can contain any data, e.g. info about the current licensee and such.

Please note that this is a very simple and schematic example.

This scheme is impossible to keygen without breaking the crypto itself.

dELTA
banshee
04-15-2003, 03:45 PM
Thanks guys!
Yee, it was very simple. I had dim ideas about that assymmetric cryptography and you perfectly described everything that I couldn't get clear for myself. Thank you.
There is only one question remains: why every developer doesn't use that method? :D
dELTA
04-15-2003, 03:50 PM
First of all, because they don't know jack shit about such things. :)

Second of all, because most asymmetric crypto algorithms are quite hard to implement for most people (requiring bignum-libraries, a brain, and other such rarities ;)).

dELTA


Strange problem...with softice!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Strange problem...with softice!
PDA

View Full Version : Strange problem...with softice!

plopzz
04-15-2003, 04:03 PM
Hi

I work on a program who make me mad...

It only work on NT system, so i use driver studio 2.7 with anti softice detection from Splatj ...

First problem :
- When i put bpint 3 in SI and run the application with LordPE (Break'n'Enter), the application don't break (fake OEP ??)
- The application continue to detect softice (APP exit after 1 second, without any box or other)

Nota : sice_detection from daemon detect softice too (not with the int1 trick)... How i can hide softice (in the most case)

Thanks
S3ri@l CoDe9x
05-03-2003, 06:40 AM
Hi :p

U try with this patches?

hxxp://www.woodmann.net/forum/showthread.php?s=&threadid=4031&highlight=driver+studio <--remember change http

Best Regards! :rolleyes:


Sort Algo Challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Sort Algo Challenge
PDA

View Full Version : Sort Algo Challenge

squidge
04-15-2003, 04:30 PM
Consider the following data:

Couple of hundred text strings (300 at the very very most, 100 being the norm) where each is maximum length of 20 characters.

Need to sort this list into ascending order.

Easy? Yes. However, here's the stinger:

The sort must be done with as minimum amount of memory as possible (talking bytes here, as in absolute maximum of 100 bytes for RAM, and 300 bytes of write-once-per-sort storage) - the above memory (where the strings are located) may be modified a maximum of the number of items there, but can be read as many times as required. Speed is not an issue.

Only solution found as yet is to simply go through the list looking for all the 'A's and place them into a sequential table. Then do the 'B's followed by the 'C's etc. 2600 reads later we are done. Only one byte write is used per item found. Not a very good sort as it's only sorted on the first letter, but I've not thought of a better method as of yet.

The reason for the limitations is that this is to go into Microcontroller (ie. very limited ram) with a eeprom to hold the text strings, and the eeprom can be read any number of times, but can only be written to a finite number of times.

So, any ideas?
dELTA
04-15-2003, 04:56 PM
So, is there a limitation on the size of the code that is used? Must it also be in the 100 bytes of RAM?

dELTA
dELTA
04-15-2003, 05:04 PM
Is there any problem with the following?:

First, define a function to compare two strings cmp_str(str1, str2), normal simple compare function, returns -1, 0, 1.

Then simply go through the list of N strings N times, each time finding the "smallest" string that is left (i.e. the first in the sorted result), by using the function mentioned above. Everytime, copy the found string to the final destination and overwrite it in the source position (e.g. write a zero on the first character if it's null-terminated). This only requires a couple of pointers in the RAM, nothing more.

This will get you a perfect sort (not only first letters), and it will execute in O(N^2) (i.e. quadratic time complexity), only writing each string once in the target memory and overwriting the first character of each string once in the source memory.

Good solution? Or did I misunderstand anything?

dELTA
squidge
04-16-2003, 01:05 PM
Well, I can't see anything wrong with that myself. Thanks for that. Code space isn't a problem (Kb's worth it), it's just ram that's at an extreme premium. Think I may add a bitmap (in std ram) to the code as reading from the memory where the strings are stored is very slow (hundreds of clock cycles), and this will tell me the strings I've already stored in the destination. Using 1 bit for each entry shouldn't take up too much space - about 13 bytes for 100 entries. I'll have to see if it'll fit.

Although it'll be ok as it is, any ideas for making it faster? Code space certainly isn't a problem.

Don't forget that the 100 bytes of ram is simple RAM that is fairly quick (few clock cycles) whilst there is also 300 bytes of external ram, but this is a lot slower (hundred of clock cycles) and can only be written a finite number of times.
dELTA
04-16-2003, 06:07 PM
Sure, there are lots of ways to make it faster, I just concentrated on a simple example, and did not care about speed at all since you said it did not matter.

Good way to make it much faster:

Create a pointer-array in the ram, referencing all the strings (as long as the ram is enough for the number of pointers anyway, otherwise you're screwed). You can optimize the space it will take by not using real pointers, but indexes from the start of the string buffer. This should make it possible to only use 16 bits per string "pointer" most likely. Then use e.g. the quicksort algorithm (or any other fast and non-memory-consuming algorithm) on this array of pointers. Finally use the sorted array to dump all the strings after each other to the target memory, all sorted. This should get you an O(n*log(n)) time complexity (well, quicksort has actually an O(n^2) worst case complexity, but an O(n*log(n)) average complexity, but there are algorithms having a O(n*log(n)) worst case complexity too).

dELTA
SiNTAX
04-17-2003, 07:03 PM
Just curious... What microcontroller are we talking about?! PIC? Atmel?

Anyway sorting algo's are easily found on the web.. no point in reinventing the wheel!
dELTA
04-17-2003, 07:32 PM
As you see in my last post, I did not reinvent the wheel. I just adapted existing algorithms to an implementation limited by the certain premises described. My suggestion in the first post was just a very simple example to see if I had understood the premises correctly, and also it was much easier to describe than e.g. the quicksort algorithm. :)

dELTA
squidge
04-18-2003, 03:51 AM
The microcontroller I'm using is the ST72C314J4. This is a 8-bit 16kb Micro with 512 bytes ram, running at 14.7456Mhz. Some of that ram is used by the stack, and a lot of the rest is used by my program. I have about 120 bytes left to play with and wish to an efficient sort algorithm with it.

The text for the strings is stored in an external eeprom (as it's the only place big enough where I can store them). I talk to this eeprom by standard I2C communications.

Sort algorithm's on the net are numerous and very easily to find. However, they are not suited to this application as I really don't want to do any more writes to the chip than necessary, so the strings must stay where they currently are and not be overwritten.

So, that means I can only use index's for the strings. There will never be more than 255 strings, so a single byte is enough to store this index. This also means a lookup table is easy enough to store.

I've converted dELTA's first suggestion into a lookup table method by searching for the smallest string, and then placing it's index into the lookup table, and continuing until there is no more strings left to search.

I don't think the second suggestion would work, as even with 8-bit indexes, a 250-string table would require 250 bytes of ram, which I don't have.

By using a bitmap array however on the first suggestion reduces the number of searches by approximately half, as each time through the loop another item is removed from it. Using this technique, it will sort 90 strings in just under 20 seconds - which isn't too bad (hence the "executing speed not that important" in my original message). However, any ideas on how to reduce this time further are welcome.
SiNTAX
04-18-2003, 05:55 AM
Didn't know that one.. made a disassembler for a ST20 a while back, but guess it has a different instruction set.

Anyway.. it sounds like the external eeprom bandwidth is your biggest concern..

Does your application (more precisely, your strings) lend themselves to compression?!

e.g. very simple.. if all your strings are A->Z (uppercase), you only need 4-bits to store a letter, so you can have 2 chars in 1 byte, doubling your bandwidth to your external storage.

(static) huffman compression probably wouldn't work here, as you don't have the memory for the tables.
squidge
04-18-2003, 06:02 AM
Unfortunately, the string table contains A-Z, a-z, 0-9, as well as spaces, underscores, and hyphens. These can not be modified as the strings are written to a display later.


Did someone say...Dongle?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Did someone say...Dongle?
PDA

View Full Version : Did someone say...Dongle?

Rackmount
04-15-2003, 04:50 PM
Ok...in order to prevent myself from getting the "lamer" label, I will describe my progress on a target I have been fiddling with for a while now. To start with, the program states: "Attention Demo Users: The software downloads are the same for demo and licensed users. Licensed users have a hardware key that allows them to read their own data files. Demo users may only read data files supplied by X-XXXX (they are password protected files). Without a hardware key (or floating license), the software will start and identify that it is running in DEMO mode." Actually, there are many modes such as standard, pro, even-more-pro, etc. that the program can switch to depending on the read dongle.

Step 1: I poked it in its eye to see if it blinks - lovely messagebox when a file is read in demo mode (with password removed) that says....buy the damn software! and then program quits. A few little changes (jne -> je)from the bad message to a good one gets us lost in an endlessly repetitive loop....hmmm...bad choice, most likely missed flag(s), but it does get us close to some code that must determine if the password is correct.

Step2: I cut it open and look at its innards - deadlisting gives sooo many good strings that I feel there should be no problem tracing the path, as every wrong turn SHOUTS error messages. Ahh...hey now I can see some references to sentinal rainbow pro dongle...a few more seemingly random eye pokes gets me nowhere, but the spalsh screen now proudly states that that the version is "CRACKED" (ok...it isn't really, this is just a pathetic attempt to boost my morale and was done by a little hex editing) I trace into the belly and find the switch that selects mode...I point it to ultra-supreme-maximum-pro...and it starts...ahhh there is my splash screen again...now it says that the program is entering god-mode...yay! Lets load a file without a password...death! bummer...ok restart and try one with a password...death! double bummer...probably more flags missed....hmmm ok now lets go back a bit and try..

Step3: Study all info I can about rainbow superpro dongles...got the sentinal SDK and read every dang tutorial on dongle bashing and have decided that this bugger is gonna get beat eventually. However, it seems that the only dongle bashing I'm doing is against my brain...due to space limitations and for the sake of the moderator's sanity I will end this rambling for the time being.
End.

For those who are curious, I will provide additional information regarding this target if asked. I do want to defeat this puppy eventually, but I am in no hurry. This is not the most recent version of this software, and I have not checked to see if current version uses same protection(s).

The purpose of this thread is to vent and provide others with some insight as to how tenacity and stubborn pride can assist in the difficult projects. Don't forget the humor as well.
MTB
04-15-2003, 07:46 PM
Rackmount, I assume you have IDA, with the appropriate pluggins.

I suggest the following strategy (you almost have it).

1. Find the read dongle call. (which you have, NOTE this is called virtually all the time by most programmers who are lame).

2. Back track up 1 to several calls. If this routine is called only once you are in luck. This is the routine to brute force / patch.

3. IF Step 2 isn't a good choice, now the hard part. Find ALL the calls to the read dongle in your IDA listing. Check to see if they do the same checking, patch as necessary.

AKA brute forcing (it always works).

Your other option in IDA.

Find the "Buzz of dongle not found messages" then fix those jumps. Note if it checks a word / flag search for that flag EVERYWHERE in the code, sometimes (not often, programmers are lazy) they will put in a check and dump you out WITHOUT printing a message.

See the links on this web site to crackz's archieved site.

This can be done with W32dasm but IDA's easier.

Best of luck

MTB
Rackmount
04-17-2003, 12:29 PM
Find the read dongle calls? Do you mean the RNBOsproRead call?
I have found the RNBOsproFindFirstUnit and can break on it in SICE and the IDA sigs for sentinal have nicely labled dongle calls...only a few hundred that I have seen so far...oh...did I forget to mention this is a rather large program? I tried creating a symbol map file for SICE and it whimpered patheticly when I tried to load it, "out of memory space for symbols." I have alot of memory allocated for backtrace and symbols for SICE but I have to leave some resources available for my lil-ole-comp to run...Hey a question to those who might know...I have seen alot of comments from one of the IDA sig files in my proggie such as _I386SPRO551MSOFTCD@4 what the heck is this telling me? The I386 seems to say intel, SPRO is easy, MSOFT...yea ok so its a windows proggie, CD@4 ...?? This seems to be something I may want/need to know. Thanks MTB for the comments...it seems there has been some new stuff added to the dongle section at Crackz archived site...I haven't been there in too long I guess.
CrackZ
04-17-2003, 01:39 PM
Hiya,

For the @ part, consider the number of parameters passed through the stack for each of the Sentinel functions you have identified and therefore how much is required to correct it ;-).

Regards

CrackZ.
sope
04-18-2003, 07:26 AM
Hello Rackmount

If u have experience in emulating super pro you can skip this post.

If not i'll advice you to solve CrackMe by CyberHeg (http://www.woodmann.net/crackz/Tools/Dongles/Spcrkme.zip)
its *worth* solving to understand super pro dongles.

It's a small file not at all hard, implementation of functions,
storing return values & activating algorithm cell is extremely well done.

Once you finish solving it try with the target you have, things will be
much more easier to understand, you will definately know which part
you have to emulate & how it should be emulated.

Good Luck.
Sope!
Rackmount
04-18-2003, 12:10 PM
Thank you Crackz and Sope for your responses...Sope...I appreciate the link...however, you assume alot by saying when you solve this...lol...true...I have done several intermediate range type reverses...however...there is so much to learn...and that is in constant flux...I have added code to reenable missing / restricted menu functions in a few proggies (felt mighty good after those worked) so I thought...hey I should do dongles...they should be a kick! I will now refocus my time on this crackme until I have it mastered (however long it takes) so my next posts will be in new thread as I require hints/help during this learning excursion. We shall soon see if dongles are a kick, or how hard they can kick. Later all....Rackmount
squidge
04-18-2003, 12:31 PM
Dongles can indeed be fun - specially when the author decides to check the result of one dongle result, and then passes another value to the dongle, uses that result as a critical value of the application. Naturally, the second one should never be executed if the first one fails, but if you hack the first one out, the incorrect code of the second simply crashes the program.

Other fun projects are license managers - some of them (eg. Sentinel LM), when implemented properly, use the license managers challenge/response feature, but only check parts of the return code (which is normally a 16 byte value) after the call, and check various other parts of it at other parts of the program. Only problem with this is that the challenge/response algorithm is normally quite easy to get a hold of (well, it is in the latest Sentinel LM), and the secret keys are far too easy to decrypt. It ends up you creating the code that does calling part of the challenge response routine in the LM and passing back exactly what the application was looking for, rather than trying to kill jumps. I like these as they make you use your brain slightly.

If you want to play with license managers, I can recommend IAR's C Compiler for AVR Micro's. You can download a 30 day demo protected with the above LM. It uses a challenge/response algorithm, and there's no instant dialogs when one of the LM routines fails.


New contest : crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > New contest : crackme
PDA

View Full Version : New contest : crackme

Thigo
04-16-2003, 05:28 AM
http://contests.anticrack.de
Zero
04-22-2003, 08:10 AM
btw:
most ppl are patching this, but you can really keygen it ;)


Armadillo System Time Clock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Armadillo System Time Clock
PDA

View Full Version : Armadillo System Time Clock

cRk
04-16-2003, 08:31 AM
i would like any good information about the above subject....i want to know how really this system time checks armadillo does with the clock works.. because i have searched all over to look for possible fake files or registry entries to compare system times.. but i haven't got still luck.. i'll hope some expert will arrive here and explain me a little about it.. maybe an ArmKiller ? :cool:

"Your System clock was changed back possible to defeat the security of this program.. please contact the author..... or Reboot..."

Nothing happend after reboot... it keeps reading somewhere... it looks armadillo in some ways is good but you guys know.. if it runs it can be defeated!

is it possible it could be using a similar method as cryptkey does? for time limit/runs...
disavowed
04-16-2003, 11:12 AM
i haven't done any research on armadillo, but it could be checking file creation/modification times
cRk
04-26-2003, 02:30 PM
maybe LunarDust would help me to explain how to find this or how this time checks armadillo does works..?? my intention is to learn.... any help or tips?
S3ri@l CoDe9x
04-27-2003, 04:24 AM
... u try find and patch this?..or find that the program run? .. u try delete :

HKEY_LOCAL_MACHINE\SOFTWARE\The Silicon Realms Toolworks

This chain checks the installation ... delete this and again run the application :p

If this fails erases the chains of the program and uninstall and reinstall again :rolleyes:

Best Regards :rolleyes:
SpeKKeL
04-27-2003, 07:02 AM
Ajo,

Didn't study it but some time ago i ran into a nice feature which was baked into the armadillo-ed prog itself.
Thought it was called " fixclock" .
It's a feature which will reset the starting day of your evaluation. I'am not sure but i think this sits in every armadillo-ed prog.
When you study this you should discover all!
I ran into it when i was trying to break on the day's check.

Succes,

Spekk
bl00dk@
04-27-2003, 07:54 AM
It could also be writing to a sector on ur HD like SafeCast, then a DiskMonitor would help.

JohnWho.
fuzzy_seacow
04-27-2003, 09:35 PM
I've also tried to find out where Armadillo is able to detect date changes. The clues I've got so far is:

The pagefile.sys file is referenced from armadillo code so it might compare date with the date of pagefile somehow.

The timecheck doesn't work in XP when logged in as a restricted user. (haven't validated this myself, read it on the admarillo forum I think)

/seacow
cRk
04-28-2003, 07:48 AM
deleting HKEY_LOCAL_MACHINE\SOFTWARE\The Silicon Realms Toolworks won't make any change.. that was the first thing i looked and tried long time ago.. also i think there's a new one called HKEY_LOCAL_MACHINE\SOFTWARE\License .... that some program use it. deleting also won't make any change but i found out that it use it somehow. i got a program blocked with this system time checks and i decided to email the author to solve this problem as armadillo message says. :P the author send me the command + key to run the fix clock stuff that the program has.. then i monitored that it writes some hex data in that key when fixing the clock.. that was all i could find. i wonder how this really works? i think from many experts that has this board someone most know exaclty where to find and manually remove this... if someone don't want to tell me here then use PM. why this information is so hard to find.. looks some of the Armadillo Protection system is unbeatable ? or some people is afraid that the armadillo author might be reading this .... ?
Viper Zx
04-29-2003, 04:06 PM
Download -> Regmon / Filemon!

http://www.sysinternals.com/ntw2k/source/regmon.shtml

http://www.sysinternals.com/ntw2k/source/filemon.shtml

BUT you must Patched this Tools or Armadillo would check this and HIDE interesting from your eyes. ;)

Example what must deleted:

[HKEY_CLASSES_ROOT\CLSID\{ED86CA99-271F-13D1-B2E4-0060975B8649}

[HKEY_LOCAL_MACHINE\SOFTWARE\Licenses]

[HKEY_LOCAL_MACHINE\SOFTWARE\The Silicon Realms Toolworks\Armadillo]

In your TEMP Directory (all) -> ?.tmp

Sorry for my bad English!

Bye

Viper Zx
cRk
05-13-2003, 12:10 AM
thanks Viper.. this is the right info. i was looking for. btw the CLSID key might be different for each winOS or for differents target i just confirmed.. maybe is hardware ID based? anyway i'm tring to find a generic way about how this work....

deleting:

[HKEY_LOCAL_MACHINE\Software\Licenses]

[HKEY_CURRENT_USER\Software\Licenses]

[HKEY_LOCAL_MACHINE\Software\The Silicon Realms Toolworks]

[HKEY_CURRENT_USER\Software\The Silicon Realms Toolworks]

and the CLSID key that regmonitor shows right after the License.. one... ;)

HKEY_CLASSES_ROOT\CLSID\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

the deleting all *.*.tmp files from the TEMP dir. and done!

but i'm still having a problem under winXP also in win9x i can't make regmonitor to work out... it is showing everything but the CLSID key that most be found to remove the time check is not there :( i did everything i could to patch regmonitor.. i removed all text caption but still dosen't work.. would you give me an advice how to patch it correctly and exactly what to patch?

i only could found the CLSID key using WinSteal that thas a regmonitor included .also RegistryMonitor98 (PRUDENS INC.) and i didn't have to patch anything on them to get the key, but this tools only works under win9x/ME i need to learn how to patch regmonitor correctly.. the one from system internals in order to catch the key i need to find under WINXp.

i did search about patching and hiding regmonitor but those tricks i guess don't work with armadillo... could be that system internals's regmonitor is not so good at all?? please.. any advices.. are welcome... also complaints if desire :p
gorge
05-13-2003, 10:15 AM
It is probably using the caption and classname to check if regmon is available. Change the classname and caption and it should work :D
Manko
05-13-2003, 01:17 PM
Hi!

Sometimes when things have been patched for detection, the "magic" in PE-Header have also been changed...

Dunno what this is, and why it needs to be altered,
but maybe this is the case here too?

/Manko
cRk
05-13-2003, 05:24 PM
gorge would you explain how to do it?? if you see i'm here is to learn and get information about it..... i still can't make it work.. :confused: i changed all the caption but how to remove the classname??
squidge
05-13-2003, 05:38 PM
cRk: Search for "class" in the exe of Regmon, you'll most like find things like "RegMonClass". Rename these.

As for the magic in PE files, this should never be altered, as it's one of the values Windows uses to verify it's a valid file.
cRk
05-13-2003, 05:50 PM
all i could found was an api: RegisterClassA and : Unknown Info Class , \\REGISTRY\MACHINE\SOFTWARE\CLASSES this is with the newest Registry Monitor..... any tips, ideas??

if anyone is interested to test this to verify it.. get latest Blaze Media Pro 4.01 to play for a while and confirm i'm right...

also take a look at Winsteal.. you can grab it from : hxxp://212.14.34.87/~devon/down/uzytki/ws.zip in case you don't have it.. is old, obsolete and only works in win9x but its regmonitor included works like a charm... it is sad it does not work in WInxp. about the one from system internals.. maybe the armadillo author work with them combined and that's the reason don't read the key armadillo target make/read in the Root/CLSid registry part.. just a comment! lol :cool:
cRk
05-13-2003, 10:47 PM
sample key for most armadilled targets that use the system time clock implemented with armadillo:

[HKEY_CLASSES_ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649}]
"0"=hex:70,9c,25,c3,dc,72,48,9d,d1,8b,f9,ef,94,b0,4d,0c,cf,59,c3,d5,96,6e,2f,\
db,78,ba,6c

[HKEY_CLASSES_ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649}\Version]
@="1.0"

but also i found out that some targets write to:

[HKEY_CURRENT_USER\Software\Classes....

Sample:
[HKEY_CURRENT_USER\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649}]
"0"=hex:9f,11,b0,7a,24,bf,30,6b,e1,e5,47,ae,94,f0,09,bc,9b,80,6b,03,c7,a4,07,\
b1,d9,8a,f1

[HKEY_CURRENT_USER\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649}\Version]
@="1.0"

on "0"=hex....... store the time check with encrypted hex data

i still need to find out how to make regmonitor from system internals to work out... i can't think that the most famous regmonitor don't work with this.. in that case should i called this a bug? umhhhh.. i would like to try an older version ..anyone have an old version to try out?.. i'm still waiting for Viper.. comments about this.. how did you make it?
:p

Results with WinSteal :

CreateKey CURRENT\Software\Microsoft\Windows\CurrentVersion\
Bmp CreateKey
Bmp OpenKey LOCAL\Software\Microsoft\Windows\CurrentVersion SUCCESS hKey: 0xC2A20A90
Bmp QueryValueEx LOCAL\Software\Microsoft\Windows\CurrentVersion\SubVersionNumber SUCCESS
Bmp CloseKey LOCAL\Software\Microsoft\Windows\CurrentVersion SUCCESS
Bmp OpenKey LOCAL\Software\Microsoft\Windows\CurrentVersion SUCCESS hKey: 0xC2A20A90
Bmp QueryValueEx LOCAL\Software\Microsoft\Windows\CurrentVersion\SubVersionNumber SUCCESS
Bmp CloseKey LOCAL\Software\Microsoft\Windows\CurrentVersion SUCCESS
Bmp OpenKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS hKey: 0xC2A20A90
Bmp CloseKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS
Bmp OpenKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS hKey: 0xC2A20A90
Bmp QueryValueEx LOCAL\Software\The Silicon Realms Toolworks\Armadillo\{071BD7C95D8CDD898} SUCCESS
Bmp CloseKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS
Bmp OpenKey ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649} NOTFOUND
Bmp OpenKey CURRENT\Software\The Silicon Realms Toolworks\Armadillo NOTFOUND
Bmp OpenKey CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649} NOTFOUND
Bmp OpenKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS hKey: 0xC2A20A90
Bmp QueryValueEx LOCAL\Software\The Silicon Realms Toolworks\Armadillo\{D8CDD89871BD7C95} NOTFOUND
Bmp CloseKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS
Bmp OpenKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS hKey: 0xC2A20A90
Bmp QueryValueEx LOCAL\Software\The Silicon Realms Toolworks\Armadillo\{71BD7C95D8CDD899} NOTFOUND
Bmp CloseKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS
Bmp OpenKey LOCAL\System\CurrentControlSet\Control\CommAlias NOTFOUND
Bmp QueryValueEx 0xC2A100A0\PORTNAME SUCCESS "COM1"
Bmp QueryValueEx 0xC2A100A0\FRIENDLYNAME SUCCESS "Communications Port (COM1)"
Bmp QueryValueEx 0xC2A20750\PORTNAME SUCCESS "LPT1"
Bmp QueryValueEx 0xC2A20750\FRIENDLYNAME SUCCESS "ECP Printer Port (LPT1)"
Bmp QueryValueEx 0xC29FF130\PORTNAME SUCCESS "COM4"
Bmp QueryValueEx 0xC29FF130\FRIENDLYNAME SUCCESS "HSP56 MR"
Bmp OpenKey LOCAL\System\CurrentControlSet\Control\SessionManager\KnownVxDs NOTFOUND
Bmp OpenKey LOCAL\System\CurrentControlSet\Control\CommAlias NOTFOUND
Bmp QueryValueEx 0xC2A100A0\PORTNAME SUCCESS "COM1"
Bmp QueryValueEx 0xC2A100A0\FRIENDLYNAME SUCCESS "Communications Port (COM1)"
Bmp QueryValueEx 0xC2A20750\PORTNAME SUCCESS "LPT1"
Bmp QueryValueEx 0xC2A20750\FRIENDLYNAME SUCCESS "ECP Printer Port (LPT1)"
Bmp QueryValueEx 0xC29FF130\PORTNAME SUCCESS "COM4"
Bmp QueryValueEx 0xC29FF130\FRIENDLYNAME SUCCESS "HSP56 MR"
Bmp OpenKey LOCAL\System\CurrentControlSet\Control\SessionManager\KnownVxDs NOTFOUND
Bmp QueryValueEx 0xC2A20750\FRIENDLYNAME SUCCESS "ECP Printer Port (LPT1)"
Bmp QueryValueEx 0xC29FF130\PORTNAME SUCCESS "COM4"
Bmp QueryValueEx 0xC29FF130\FRIENDLYNAME SUCCESS "HSP56 MR"
Bmp OpenKey LOCAL\System\CurrentControlSet\Control\SessionManager\KnownVxDs NOTFOUND
Bmp OpenKey LOCAL\Software\Microsoft\Windows\CurrentVersion SUCCESS hKey: 0xC2A20A90
Bmp QueryValueEx LOCAL\Software\Microsoft\Windows\CurrentVersion\SubVersionNumber SUCCESS
Bmp CloseKey LOCAL\Software\Microsoft\Windows\CurrentVersion SUCCESS
Bmp CloseKey LOCAL\Software\The Silicon Realms Toolworks\Armadillo SUCCESS
Bmp OpenKey ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649} NOTFOUND
Bmp CreateKey ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649} SUCCESS hKey: 0xC2A20A90
Bmp SetValueEx ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649}\0 SUCCESS 70 9C 19 C3 DC 72 3C 91 ...
Bmp OpenKey ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649}\Version NOTFOUND
Bmp CreateKey ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649}\Version SUCCESS hKey: 0xC2A206F0
Bmp SetValueEx ROOT\CLSID\{B9A1B7AE-0E0F-13D1-B2E4-0060975B8649}\Version SUCCESS

Bmp OpenKey CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649} NOTFOUND
Bmp CreateKey CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649} SUCCESS hKey: 0xC2A20A90
Bmp SetValueEx CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649}\0 SUCCESS 9F 11 8C 7A 24 BF 44 67 ...
Bmp OpenKey CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649}\Version NOTFOUND
Bmp CreateKey CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649}\Version SUCCESS hKey: 0xC2A206F0
Bmp SetValueEx CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649}\Version SUCCESS "1.0"
Bmp CloseKey CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649}\Version SUCCESS
Bmp CloseKey CURRENT\Software\Classes\{4B7BEAFF-A184-13D1-B2E4-0060975B8649} SUCCESS
Bmp QueryValueEx 0xC189CD70\MSVBVM60 NOTFOUND

:cool:
diz
05-14-2003, 04:43 AM
You can change class by finding string %d-%d in exe. Change it to, lets say %f:%f, or anything else you can think of (this is parameter for the sprintf function). This should be enough I think.
Viper Zx
05-14-2003, 05:59 AM
Originally posted by diz
You can change class by finding string %d-%d in exe. Change it to, lets say %f:%f, or anything else you can think of (this is parameter for the sprintf function). This should be enough I think.

This is it!

Tschau

Viper Zx
cRk
05-14-2003, 12:18 PM
Great!!!!!!! i feel like learning something new every day.. thanks for all your help and replies guys! :)


Softice under Windows XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice under Windows XP
PDA

View Full Version : Softice under Windows XP

Magnetman
04-16-2003, 11:33 AM
Hello,

can somebody tell me, if softice runs under Windows XP? I can only find versions vor win95,98 and NT.

Thank you
JMI
04-16-2003, 12:11 PM
Magnetman:

It is obvious that you did not looking around here before asking a question that has been addressed many many times here before. That also means that you didn't bother to read the FAQ, which are the Frequently Asked Questions. What you need to do is use the search button on the top of each Forum here and enter into the search box on the left the words "WinXP + Softice." You will then discovery the many threads discussing issues relating to WinXP and Softice.

The short answer to your question is that only Driver Studio 2.7 or Driver Suite 2.7 with Softice 4.2.7 seems to work fairly well with WinXP. There are, however, several issues including video cards and other things that give problems. Research these issues in the threads you find in the search and then come back with specific question, but DO NOT ask where you might get the software. That is not permitted here. Again, searching will lead you to what you need and is a necessary skill for RCE.

Regards.


Dillodump / ImpRec
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dillodump / ImpRec
PDA

View Full Version : Dillodump / ImpRec

Magnetman
04-16-2003, 01:51 PM
Hi,

Im trying to unpack an exe file that is protected with Armadillo.
I used the great tool DILLODUMPER 1.8 from [LUNAR_DUST] to Dump the prog from memory.
Im very unexperienced to unpacking.:(

In his manual he describes how to use it. It´s easy because it´s almost all automatic :)
In the last step i have to work with ImpREC. In his manual he discribes it as follows:

>> "4. Turns off API redirection, so you can rebuild in a snap with ImpREC."

I downloaded ImpREC but I don´t know how to use it :(. The DILLODUMPER gives me the following Output:

Loading victim process..
Examining .....
New Process is 774h
New Process Thread is CB8h
Executing...
Preparing....
Starting normally
Scanning....Please wait..
Acquired !
Acquired !
Fixing Advanced NTIce Detection....
Expired Check arma 2.85 found..fixing...
Import Redirection found..fixing...
Syncing .....
Attempting dump, please be patient...
OEP FOUND! : 6D973Ch
Program dumped..
Header fixed..
Dump Successfully fixed !
WAITING HERE FOR IMPORT REBUILDING
You may rebuild the imports with ImpREC. There IS NO IAT REDIRECTION
The process ID is 774h
Import table is at: 2E3000h, size: 3830h
Press any key when done to exit <<===== Here I run ImpRec

Okay at that point I run ImpRec, select The Process 848h out of the process List.
Then ImpRec reads the DLL Files? Or something like that and fills in
the Section "IAT Infos needed" the following parameters:

the Following default values:
OEP 003250B9
RVA 00000000
Size 00001000

Hmmmm... but are these values correct? Or do i have to use the values in the
DILLODUMPER window? :confused:
Ok I would say RVA=00000000 and Size=00001000 aren´t correct :cool:. But Whats with
the OEP?

DILLODUMPER says OEP=6d973C
ImpRec says OEP=3250B9

which one is the correct one???

In the RVA and size box, i would use the DILLODUMP output RVA=2e3000, Size=3830
Is that Okay???

Hope someone can help.

Greetz :)

Magnetman
_________
squidge
04-16-2003, 02:10 PM
Hi,

The prog gives you the exact values to place into ImpRec, so ignore whatever ImpRec says, and overwrite them with the values that the unpacker gives you. Since it's unpacking the prog, it's best to use the values it gives as it has a bit more "inside information" than Imprec does with it's simple scanning engine.

Note that even though IAT redirection has been disabled, there may be crap thunks that need to be removed before you can use the IAT.
Manko
04-16-2003, 02:12 PM
Hi!

Why don't you even, atleast try and manage this yourself before you post something like this?

Did you even stop and think a little?
Is it too hard to try for yourself first?
And why didn't you try to get som info on how to use ImpRec?

You need to learn that, while many here wiches to help, you can't just hand over everything to someone else. It's you that need to learn, so make an effort! ;)

Do these things and THEN come back for help! :)

/Manko
Lunar_Dust
04-16-2003, 02:37 PM
Hello,

You should go ahead and use the values given by DilloDumper. ImpREC will then grab a clean IAT , but you will have to delete lots of bad thunks as well.

As stated already, you should know how to use ImpREC pretty well to do it this way, so it pays to read up !!

It helps to be familiar with unpacking to at least some degree when using this, as, it's only a TOOL ! :), can can't do everything for you....( YET !).

One small note - OEP to enter into ImpREC from DilloDump - you must take OEP reported by DilloDump and subtract imagebase from it and then enter that into ImpREC- otherwise ImpREC will screw your entry point when you patch the dump.

Can't give too much to newbs ... sorry :)

-Lunar_Dust
squidge
04-16-2003, 05:07 PM
I'm in a helpful mood today, so I'm going to be generous...

Imagebase can be got using LordPE.
DilloDumper gives you a OEP VA. ImpRec requires an RVA. LordPE can do the conversion for you if your that idle :)
Manko
04-16-2003, 06:33 PM
Sorry, Magnetman!

I didn't properly read your post and was too hard on you.
You HAD thought of some things for your self...

:o

Please accept my apologies... Guess I'm having PMS or something... :p

/Manko
Magnetman
04-16-2003, 08:50 PM
Hi,

thank you for your help.
Im sorry but Im still a beginner in that unpacking bussiness.
But I try to learn about it, do do that I have to post stupid questions sometimes - sorry. But for a newbie those things arent such clear.

so here is another one :(

this IAT table is a table, where the functions of the importet dll´s are stored is that correct?

OK. As LunarDust and Squidge said, there will be a lot of bad thunks.
Hm you adviced me to delete them out of ImpRec.
Hmmmm... aren´t those functions be needed by the unpacked proggie?
Do I really have to delete them?
In the ImpRec manuel, there is something about tracing for the bad functions. I tried all three Tracing Functions but the functions keep invalid :(
So just erasing it?

And now I just wanna thank everybody who has helped me in the past und everyone who will do it in the future :)
Manko
04-17-2003, 01:52 AM
Hi!

I hope to redeem myself, so here goes. :)

Yup, it was correct, about IAT... or... I might be confused too...
The table we are working with is like you mention.
The table we try to create will contain the names of dlls and it's functions. At runtime this information is used to create the table of adresses. This is so it will work regardless of wich version you have on your dlls, or your operating system...

What armadillo does, also like aspr, is fill the whole IAT table with trash-bytes (actually, maybe it is there from the start...), then it gets filled with correct API-adresses. Inbetween those will be dirty bytes...
It does this to trick us. We are trying to build the information that creates the table table of adresses at runtime.
If we leave invalid entries, the program won't run, so you need to delete them.

You're carefullness in this situation is good, because in other situations there will be adresses that don't get resolved merely by using the three trace functions. They have to be done manually...

In this situation though, the dillodumper have done it for you, so it should be ok to delete them. :)

When you get more experienced, this will feel natural...
At the meantime you can atleast, notice that they really don't seem to fit in, do they...?
(Actually, I've never looked at armadillo, so I don't know if this is close to aspr... I'm too lazy perhaps... :P)
Also, these entries will either not go to any dll at all, or they will go to dlls the proggy are not using, and probably not to the startbyte of any function either... You could ofcourse check this manually if you like. :)

/Manko
Manko
04-17-2003, 02:08 AM
Hi!

I've not looked at your proggy yet, and are not familiar with the complexities of armadillo, but I was thinking about those invalid entries...

Have you tried removing those with your dillodumper?
It would be quite safe if you check few things...
1. They lead to above app/armadillo-space...
2. SymGetSymFromAddr doesn't return true... or if it does...
3. SymGetModuleBase doesn't return true...
-- Erase crap bytes... :)
-- Ofcourse you'll have to do SymInitialize, with handle to debugged process and fInvadeProcess = True...
-- I realize though SymInitialize might be killed in certain cirumstances... It was for me in one case... (I was doing aspr thugh, so anything I say here is kinda uninformed...Hmm...)

I'd be glad to hear, what you think. :)

/Manko

Originally posted by Lunar_Dust
Hello,

You should go ahead and use the values given by DilloDumper. ImpREC will then grab a clean IAT , but you will have to delete lots of bad thunks as well.

-Lunar_Dust
mR_gANDALF
04-17-2003, 04:58 PM
I`m playing with an arm protected proggie. Find dillodumper really good and crushader tutorial about it just marvellous. I would like to have just one of his neurons :D

Everything is understandable to me except when I get to the jmp table. How do I dump the 4 tables? I guess that once I have table.dmp and so, the jmp fixer coded by crushader or the one fixed by eS_mIn would solve that.

Another question is: It seems that dillodumper rebuild the IAT, as tracing the dumped there are calls to API`s that looks to work fine. So is it always necesary to manually rebuild IAT? Do i have to delete the IAT and rebuild it? And, Why do we have to use ImpRec? I find revirgin quite better than ImpRec. And, Why has Revirgin download dissapeared from Fravia? Has it something to do with +Tsehp good bye?

This was more than 2 question but my head is crying for my hungry neurons :D :D

mR_gANDALF
Magnetman
04-17-2003, 05:06 PM
Hi!

thanks for the help.
Now it´s unpacked :)
The thing with the OEP was wrong.

Now it runs.
But it gives an "External Exception" Message sometimes, when
working with it. :(

Hm...

either something with the unpacking is still wrong or
i have to find out if there are some environment variables
which are needed to be set.

*greetz*

Magnetman
_________
squidge
04-17-2003, 05:17 PM
Since this is an ARM-protected proggy, your exceptions are most likely going to be INT 3 instructions in the unpacked code. These must be corrected manually, as DilloDumper doesn't fix them.

( If this is not what you are talking about, please correct me )
Magnetman
04-17-2003, 06:22 PM
hi,

Oh yeah i have seen that too after loading the proggie into MS VC++.
It always stops at an int 3 assembly instruction.
Who can that be corrected?

just overwrite the int 3 by an nop instruction created an memory access viaolation.
Manko
04-18-2003, 03:22 AM
Hi!

(First, I have not worked with armadillo, but this is my understanding...)

The thing about armadillo is that it's a debugger for the real app. When it protected the app, it substituted som conditional jumps, and maybe something else for breakpoints (CC). When the debugger (armadillo) notices these BPs, he will look at what adress it came from and what flags were... and make a jump to the right place. If you wich to resolve this you have much more work infront of you...

Some API usually used by debuggers are:

GetThreadContext
ReadProcessMemory
Write........................
WaitForDebugEvent
ContinueDebugEvent

That is just general... Might not apply as much to armadillo. But very probable...

/Manko
Magnetman
04-18-2003, 05:29 AM
Hello,

i will try it by the tutorial of crusader. he describes the problematic with the int 3 shit.
i hope i will work it out.
will come back if i get probs.
But it goes forward : ) step by step.
Magnetman
04-18-2003, 09:09 PM
Hi again :(

I could mange, to dump the 4 Jump tables for the int 03 problem.
I did that with softice and icedump.

I unpacked the application with Dillodumper and with icedump.

Then I tried, to fix the int 03 bugs by using the tool in the essay of Crusader.
But in both cases it gives the error message:

"Error patching dump file! Unable to locate correct Jump opcodes!"

Anyone out there who did it correctly somewhen?
This armadillo shit drives me crazy :(

*greetz*

Magnetman
---------------
nikolatesla20
04-19-2003, 10:04 AM
Patching the int3's is really a pain in the butt !

The problem is these int3's are called "nanomites", and they are only enabled in armadillo in "custom builds" for customers. And the thing is, each build has a different jump table.

So in other words, you have to edit crusaders asm code for the jump table fixer, so have the jump codes in the right order. The only way is to step thru the program and see what the flags are and what it does...ugh...

anyway, that's why the jump fixer isn't working. It was so long ago for me since I did such a thing tho, I don't remember how to go about fixing the jump order. I do know it's possible tho, because I've done it.

The crusader tute does help still a little in this matter - one thing also to make sure is that the tables you dumped are complete and the right sizes.

That's all I can say for now, it's been too long since I've done it.

-nt20
mR_gANDALF
04-20-2003, 07:23 AM
So, eS-mIn fixing of the jmp table reconstructor doesnt solve that problem?

And...still I cannot understando how you dump the jmp tables...

And.., so arm is almost uncrackeable?

mR_gANDALF
nikolatesla20
04-20-2003, 08:25 AM
His fix only corrects where the jump fixer supposedly patches int3's that are not really part of the program (like data).

You still have to get the jumps in the right order.

It's not uncrackable at all, it just takes a little more work. The jump fixer program will work fine, if you get the jumps it looks for in the right order, and make sure your four tables are dumped correctly.

-nt20
Magnetman
04-20-2003, 07:45 PM
Yes, you can crack it. By dumping out the tables, und looking for what Code stands for which Jump Opcode. The nanomites are not the problem.

BUT

Armadillo is uncrackable in one case. When different functions in your targed are disabled in the Sharewareversion it could be, that they are marked as Secured Areas, which are seperately crypted by an key that legal customers of the program get from the vendor.
You can´t decrypt these Secured Areas without the Unlocking Key.

Oh i forgot. You can.
But you would have to brute force all possible Keys.
But I think this would take a couple of thousands of years :(
Lunar_Dust
04-20-2003, 09:57 PM
In that case all you need is one valid key, and then you just Dump and rebuild the program, and you are done. Not such a big deal.

-Lunar
Magnetman
04-21-2003, 08:28 AM
Yes, but this valid key you have to get somewhere?

Steal it from someone or by buying the software :)

Why cracking when still bought???
mR_gANDALF
04-22-2003, 01:15 PM
So, I keep at the dumping tables for fixing the jmp`s. I have red the Crushader tut but my neuron makes echo inside my head :P
I dont have idea of dumping "table" of jumps at all. My i have an answer please?

mR_gANDALF
Shoob
04-22-2003, 03:15 PM
The table of jumps are the IAT, every Jump below to an API so you just have to find the first jump to an API and the last, Wrote down the adresses and sub the first mem. address from the last. Now you have the base size of the Jmp table. I dunno if the jmp table in armadillo apps is at one position (as normal) or at more positions (i read 4 or so..) so you maybe have to find every table and fix them manually with an hex editor.
squidge
04-22-2003, 05:20 PM
The IAT in Armadillo is quite easy to fix - it's just one table with your usual garbage entries. The latest Dillodumper can fix this for you most of the time.

What mR_gANDALF is talking about I believe are the Nanomites - jumps in the code that have been replaced by INT 3 instructions and need to be turned back into there original jump instruction before the program will work.

This requires the dumping of four tables.
Hopcode
04-23-2003, 06:30 AM
hello,

he was talking about the int 3. right.
Also the problem is, that with crusader's tutorial, and the other enhancement of the "tool", you could fix the file "easily".
Now, it isn't possible anymore, because they have fixed a couple of weaknesses..
Im stuck on trying to unpack Arm 3.0a, the int 3 part, that is.
I think i might need to code a disassembler to get my way with the tables. entries in the tables are not all good, and you cannot find easily as before the false ones..

any advises ?

Regards,

HopCode
mR_gANDALF
04-24-2003, 07:55 AM
Yes, it is the jmp table (not de IAT :) ) want I want to fix. So i have to dump the 4 tables, then select each one of then into de utiliy by Crusahder. The question is. How to dump this 4 tables? How to locate them? And now, what is ot this wont run any more?

mR_gANDALF
nikolatesla20
04-24-2003, 11:54 AM
Whew,

that's a complicated question.

In the last version of arma (3.0a), you will have to put a bpx on GetThreadContext, and then step thru the code until you get to a point which looks similar to Crusader's tutorial. In the latest arma, they've put in lot of annoy the cracker do nothing SMC code, so just be patient and step thru it, and soon you will land on a spot similar looking to how Crusader's tutorial shows it (the spot where they load in the the first table, the table of addresses).

One you land on this spot, you can display the table of addresses in SI to have a look at it. My experience in looking at this is all four tables are sequential in memory, you can just dump the whole chunk.

What I did after that (when I did this against arma 2.85) was to just open the dumped file in HEx Workshop and work with it there, cutting out the tables one at a time, you can usually tell where each table starts by its format.

As far as the not working part, I haven't looked into that at all.

-nt20
mR_gANDALF
04-25-2003, 10:21 AM
Many, many thanks. I`ll work on this. Seem hard.

mR_gANDALF
S3ri@l CoDe9x
05-03-2003, 07:03 AM
..U work in one file with Copy Mem 2 ..or have basic protection? ...:confused:

In the basic versions of armadillo he doesn't need it :confused:

Only in certain options of copymem 2 :p

Best Regards! :rolleyes:
cRk
05-13-2003, 12:51 AM
i have searched alittle about this protections and method.. i'm alittle newbie so pls. don't tell me i didn't search and so on.... all i need is a good answer about "int3's are called nanomites" . because all i could find was comments about it but not a pricisely answer ... what exactly do this trick or protection? is it possible to be defeated? what exactly could be the definition for the so called namomites ?? any tips are welcome thANKS in adnvance for any comment or complaints :P
nikolatesla20
05-13-2003, 09:11 AM
nanomites are this:

In the protected application, at packing time, the Armadillo shell looks thru the code for the signatures "NANOBEGIN" and "NANOEND". In code between those signatures, it will remove any jump instruction (JMP, JNZ, etc), and replace it with an INT3 instruction.

Now, during runtime, the Armadillo "server" is actually a debugger. It runs the protected application as a debugged application. When an INT3 exception is triggered - the Arma server catches it. It then looks up in a table the address of where the exception occured, to see if there is a "nanomite" there. If so, it will then proceed to look in a few other tables to check what type of jump instruction used to be there, it's length in bytes, and how far it would jump. It then uses the EFLAGS register of the current position of the protected application to determine if it's supposed to jump or not.

If not, it simply moves the EIP register of the protected application by the amount of the Jump's length in bytes - simulating a jmp that did not occur. If it is to jump, it moves the EIP register by the amount to jump, either forward or backward.

So nanomites completely intertwine with the application. If you know where the tables are in memory, and you know which Jump type is what "code" in the jump type table, you can rebuild these nanomites manually, and replace the original jump instructions.

The problem is that nanomites are from Armadillo custom builds, so each customer that uses them has a different order to the types of jump intructions that exist in the table. For example, a code "0x10" could mean a JMP in one customer's build but a JNZ in another. SO it takes some work to figure out which instruction is which. But walking thru in a debugger can help you to determine this :) But it takes advanced skill to do so.

-nt20
cRk
05-13-2003, 10:32 AM
great!... i wonder how far armadillo will grow up.. looks the author is a freaky man who spends hours improving his protection but at the end just for nothing! :cool: thanks nikolatesla for such great explanation..
Manko
05-13-2003, 01:33 PM
Hi, Nicolatesla20!

Thanks for that very clear and informing post! :)

Now, I understand the troubble with tribbles... ehrg... nanomites!

(One of these days I might even try my hand at this critter...)

/Manko


IShield Single Exe password recovery?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > IShield Single Exe password recovery?
PDA

View Full Version : IShield Single Exe password recovery?

gadget
04-17-2003, 05:36 PM
Hi,

I have a single file installer archive password protected, is there a recovery for the password? There's no archive extraction till correct password entered, it's just a one line edit box dialog -- not the standard package for the web type -- I know there's a pass recovery for that. So is there a way/proggie to do this. This may be an installshield express package -- if that helps!

Thanks in advance

G^
mike
04-17-2003, 06:08 PM
Use softice to put a breakpoint on the edit window when it receives a WM_GETTEXT message. Then hit f12 until you get out of USER and KERNEL code and back into your application. Chances are you'll see a TEST EAX, EAX somewhere followed by JZ to the error box. Either force eax to 1 or change the jump to JNZ.

This assumes, of course, that it's only a password comparison and there's no real encryption. If it uses the password to decrypt the file, then you have to reverse engineer the algorithm that's being used.


Request Suggestions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Request Suggestions
PDA

View Full Version : Request Suggestions

naides
04-17-2003, 07:15 PM
I am dealing with certain package and I am running out of ideas.
I am appealing to the inspiration and lateral thinking talent, which is not in short supply in this board.

The program in question is written in/by Asym37rix T00LB00k II. This is a relative old package used to construct multimedia presentations sort-of Macromedia.

Most of its libraries, dll, etc work in a 16 bit virtual machine, so tracing the code execution with Sice is not very gratifying. Needless to say, Windows APIs are not used, and run of the mill cracking does not work. (sort of cracking a Vbasic, JAVA or a Macromedia app)

The protection itself is probably contained in the program's script-like files which bear .TBK extensions.

I searched the net and found comments about this programs saying T00LB00k uses OpenScript language as the scripting tool for its apps. I could not locate anything that remote looks like script code inside these .TBK files. They look like encoded 16 bit type MZ files. IDA will only decompile the initial stub, not the internal working of the files.

I did not see an SDK or an interpreter/Debugger for this files in the manufacturer site.

Questions to the Board: Has anybody dealt with this system, and can give me hint/suggestions about how to look under the skirt of this application?

I have the impression that I am missing something extremely simple, but I, obviously don't know what.
Manko
04-18-2003, 03:13 AM
Hi!

Not that I will supply a sollution, but you forgot to describe the protection... :P

/Manko
naides
04-18-2003, 06:19 AM
I guess you are into minor details, eh Manko? :D

The program will not run unless is 'activated'

To do that you may either get into the net, where a bona fide Macromedia app talks to a server and provides your personal info, and likely obtains a serial activation number.

If you are not willing to use the net, an alternative activation works like this:

The program gives you a computer specific number probably derived from the HD, and then you enter an activation key into a dialog box.

Needless to say, any attempt to track down the destiny, processing of an activation code gets loss in the code woods of the NTVMD.DLL and WOW32, which are part of the Windows 16 bit virtual machine system.

I have tried to track file access and Registry access to see how the prog finds out registered or not, but the fact that this prog uses NTVDM means it does such an ungodly number of file access (20000 files acessesjust to start, after filtering out any system houskeeping activity), that catching signal from noise is beyond my lame zen capabilities.
nikolatesla20
04-19-2003, 03:50 PM
Toolbook eh?

The company I work for STILL uses ToolBook to write its software tutorials..

Perhaps I can come up with something to help you in a little while. Yep, I've seen the OpenScript language .. my guess is the TBK file is interpreter bytecode. ...

Maybe I can find a debugger at work..

-nt20


New !Improved! UnHandledExceptionFilter sollution!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New !Improved! UnHandledExceptionFilter sollution!
PDA

View Full Version : New !Improved! UnHandledExceptionFilter sollution!

Manko
04-18-2003, 03:28 AM
(This is DS 2.7, but probably easy to apply to other versions with some small amount of work...)

The old patch of altering slightly the name, to make sice fail to set BP on it, has one major drawback... The irritating errormessage that floods softicewindow...

So I thought to find where in code it prints that string...
It turned out to be much simpler to find a way to make it not patch in the first place, or in my case to let it think it had patched... :)

Finding the string "kernel32!UnhandledExceptionFilter" in NTice.sys is simpel...

We need to disassemble Ntice.sys to find references too it...
...and here they are:

.text:0005DF8C 6B 65 72 6E 65 6C 33 32 21+aKernel32Unhand db 'kernel32!UnhandledExceptionFilter',0
.text:0005DF8C 55 6E 68 61 6E 64 6C 65 64+ ; DATA XREF: Get_UnhandledExceptionFilter_Adress+1Do
.text:0005DF8C 45 78 63 65 70 74 69 6F 6E+ ; Get_UnhandledExceptionFilter_Adress+3Ao
.text:0005DFAE
.text:0005DFAE
; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
.text:0005DFAE
.text:0005DFAE
.text:0005DFAE Get_UnhandledExceptionFilter_Adress proc near
.text:0005DFAE 60 ; CODE XREF: sub_4CC4E+2Cp
.text:0005DFAE pusha
.text:0005DFAF 83 3D C5 EC 0E 00 00 cmp UnhandledExceptionFilter_Address, 0
.text:0005DFB6 75 2E jnz short loc_5DFE6
.text:0005DFB8 B8 22 DA 0E 00 mov eax, offset aKernel32 ; "Kernel32"
.text:0005DFBD E8 46 96 FF FF call sub_57608
.text:0005DFC2 0B C0 or eax, eax
.text:0005DFC4 74 20 jz short loc_5DFE6
.text:0005DFC6 A3 C9 EC 0E 00 mov baseofKernel32,
eax
.text:0005DFCB BE 8C DF 05 00 mov esi, offset aKernel32Unhand ; "kernel32!UnhandledExceptionFilter"
.text:0005DFD0 E8 D1 98 FD FF call sub_378A6
.text:0005DFD5 72 11 jb short loc_5DFE8
.text:0005DFD7 3D 00 00 10 00 cmp eax, 100000h
.text:0005DFDC 72 08 jb short loc_5DFE6
.text:0005DFDE 8B F8 mov edi, eax
.text:0005DFE0 89 3D C5 EC 0E 00 mov UnhandledExceptionFilter_Address, edi
.text:0005DFE6
.text:0005DFE6 loc_5DFE6: ; CODE XREF: Get_UnhandledExceptionFilter_Adress+8j
.text:0005DFE6 61 ; Get_UnhandledExceptionFilter_Adress+16j
.text:0005DFE6 ; Get_UnhandledExceptionFilter_Adress+2Ej
.text:0005DFE6 ; Get_UnhandledExceptionFilter_Adress+44j
.text:0005DFE6 popa
.text:0005DFE7 C3 retn
.text:0005DFE8 ; ---------------------------------------------------------------------------
.text:0005DFE8
.text:0005DFE8 loc_5DFE8: ; CODE XREF: Get_UnhandledExceptionFilter_Adress+27j
.text:0005DFE8 BE 8C DF 05 00 mov esi, offset aKernel32Unhand ; "kernel32!UnhandledExceptionFilter"
.text:0005DFED E8 E8 EA FD FF call sub_3CADA
.text:0005DFF2 EB F2 jmp short loc_5DFE6
.text:0005DFF2 Get_UnhandledExceptionFilter_Adress endp

So, we'll just look at the place the adress get stored, to find more interesting procs...

.data:000EECC5 00 00 00 00 UnhandledExceptionFilter_Address dd 0 ; DATA XREF: Get_UnhandledExceptionFilter_Adress+1r
.data:000EECC5 ; Get_UnhandledExceptionFilter_Adress+32w
.data:000EECC5 ; some_ckeckUHEFpatchedr
.data:000EECC5 ; containsUHEFaddr_plusleadstorellatedprocs+Fr
.data:000EECC5 ; Unhandledexceptfltr_BP_reached+4r

We're gonna look at "some_ckeckUHEFpatched"

.text:0005DFF4 some_ckeckUHEFpatched proc near ; CODE XREF: CChere_UHEFpatchedflaghere_leadsto_checkUHEFpatched+11p
.text:0005DFF4 8B 3D C5 EC 0E 00 ; contains_UHEFpatchedflag_leadsto_checkUHEFpatched+15p
.text:0005DFF4 mov edi, UnhandledExceptionFilter_Address
.text:0005DFFA 0B FF or edi, edi
.text:0005DFFC 74 72 jz short locret_5E070
.text:0005DFFE 0A D2 or dl, dl ; Contains CC or original first byte of UHEF
.text:0005E000 74 6E jz short locret_5E070
.text:0005E002 80 3D 07 6E 0E 00 00 cmp byte_E6E07, 0
.text:0005E009 74 65 jz short locret_5E070
.text:0005E00B E8 7D ED FF FF call sub_5CD8D
.text:0005E010 A1 C9 EC 0E 00 mov eax, baseofKernel32
.text:0005E015 8B DF mov ebx, edi ; edi contains UnhandledExceptionFilter_Address.
.text:0005E017 E8 69 96 FF FF call sub_57685
.text:0005E01C 80 3D CD EC 0E 00 00 cmp Original_first_byte_of_UHEF, 0
.text:0005E023 75 24 jnz short loc_5E049
.text:0005E025 E8 0A 8D FD FF call here_it_gets_originalUHEFfirstbyte
.text:0005E02A 72 3F jb short loc_5E06B
.text:0005E02C A2 CD EC 0E 00 mov Original_first_byte_of_UHEF, al
.text:0005E031 3C 55 cmp al, 55h
.text:0005E033 74 14 jz short loc_5E049
.text:0005E035 3C 8B cmp al, 8Bh
.text:0005E037 74 10 jz short loc_5E049
.text:0005E039 3C 68 cmp al, 68h
.text:0005E03B 74 0C jz short loc_5E049
.text:0005E03D 56 push esi
.text:0005E03E BE C1 ED 0E 00 mov esi, offset aNticeUnrecogni ; "NTICE: *** Unrecognized unhandled excep"...
.text:0005E043 E8 CA B5 FF FF call sub_59612
.text:0005E048 5E pop esi
.text:0005E049
.text:0005E049 loc_5E049: ; CODE XREF: some_ckeckUHEFpatched+2Fj
.text:0005E049 8A C2 ; some_ckeckUHEFpatched+3Fj
.text:0005E049 ; some_ckeckUHEFpatched+43j
.text:0005E049 ; some_ckeckUHEFpatched+47j
.text:0005E049 mov al, dl
.text:0005E04B E8 F2 8D FD FF call sub_36E42
.text:0005E050 72 19 jb short loc_5E06B
.text:0005E052 C6 05 CE EC 0E 00 00 mov is_UHEF_BP_set, 0
.text:0005E059 3C CC cmp al, 0CCh
.text:0005E05B 75 0E jnz short loc_5E06B ; We want the "is_UHEF_BP_set" flag to BE set,
.text:0005E05B ; so maybe we just force it not to jump. :)
.text:0005E05D C6 05 CE EC 0E 00 01 mov is_UHEF_BP_set, 1
.text:0005E064 C6 05 CF EC 0E 00 00 mov byte_EECCF, 0
.text:0005E06B
.text:0005E06B loc_5E06B: ; CODE XREF: some_ckeckUHEFpatched+36j
.text:0005E06B E8 44 ED FF FF ; some_ckeckUHEFpatched+5Cj
.text:0005E06B ; some_ckeckUHEFpatched+67j
.text:0005E06B call sub_5CDB4
.text:0005E070
.text:0005E070 locret_5E070: ; CODE XREF: some_ckeckUHEFpatched+8j
.text:0005E070 C3 ; some_ckeckUHEFpatched+Cj
.text:0005E070 ; some_ckeckUHEFpatched+15j
.text:0005E070 retn
.text:0005E070 some_ckeckUHEFpatched endp

As you see, we can easily make it believe it already has a BP set. :)
(remember to repair any changes you have done earlier to the UnhandledexcptFltr-string you might have done earlier.)
Just patch it!
I patched 75 0e to 75 00. But feel free to deal with this in any way you please! (And DO explore if you get the urge.)
Also, if you do changes to a .sys, remember to recalculate checksum. :)

It's working GREAT for me! :)

Best of luck to ya'll!

/Manko

I hate scrolling sideways :) Woodmann
SiNTAX
04-18-2003, 05:35 AM
Just curious about something.. for what reason exactly does SI hook this function?!
Manko
04-18-2003, 06:52 AM
Hi!

Dunno really... Part of "Faults on"? (Maybe?)
Though it will patch regardless, so I really don't know...

I know someone made a partial explanation somewhere...
Maybe I should search... Hmm... Maybe even here...

/Manko
nikolatesla20
04-19-2003, 09:58 AM
Thanks Manko!

I always knew the best solution would be to patch the sys so it doesn't even try to patch Unhandled, but I never could track it down (I got bored)

Thanks !

-nt20
Manko
04-20-2003, 07:24 AM
Hi!

nt20:
Thanks for the recognition! :D
I was waiting for someone to appreciate my small gift. :)

( I didn't forget you Pasha! Thanks to you too! ;) )

sintax:
I was gonna write some more regarding your question,
but I think I'll have to check some things first...

/Manko
pasha
04-20-2003, 12:01 PM
greetz manko

hehe..i am not worth a thanks..:p..but i will take it..

btw, i think i will apply to macrovision as a programmer. with the amount of secdrv.sys source code that i have disassembled here in my room all around :p

man, i still cant figure out why that sd2 exe exits without any messages..checked out the secdrv functions as suggested by sintax..guess..i will go back and keep working on it..

thnx

best regards
pasha
SiNTAX
04-20-2003, 04:10 PM
Originally posted by Manko

sintax:
I was gonna write some more regarding your question,
but I think I'll have to check some things first...

/Manko

Don't worry.. I won't shoot you if the info isn't 100% accurate :D

Anyway I can imagine why they want to hook the function.. afterall.. SI is a debugger, so it's useful to know about exceptions :)
Manko
04-20-2003, 04:53 PM
Hi!

To pasha: :)
Keep up the good work! You'll get there... or die trying! :p

To Sintax:
Don't worry, I can guarante it is NOT 100% correct. :)
Seems I was right in my thinking it had something to do with "Faults On"... :)
Though, even MORE questions have arissen in my mind, while documenting the function that deals with BP hit on UHEF,
this was exhausting, so I will give it a rest...
Seems sice uses UHEF to glean info about exceptions...
Yeah, you posted that before I was finnished, but anyway...
I still don't know anything about that contextswap thingie, where it tries to repatch, everytime... why?
And I haven't understood the whole listing I'm about to spew into your face...

...so brace yourself, here goes!

.text:0005E0B0 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
.text:0005E0B0
.text:0005E0B0
.text:0005E0B0 Unhandledexceptfltr_BP_reached proc near ; CODE XREF: sub_5DF37+Ep
.text:0005E0B0 mov eax, [ebp+10h] ; BPadress...
.text:0005E0B3 dec eax ; Right on 0xCC-byte...
.text:0005E0B4 cmp eax, UnhandledExceptionFilter_Address
.text:0005E0BA jnz some_other_BP
.text:0005E0C0 cmp Faults_On_Flag, 0 ; This is the "faults on" flag! :)
.text:0005E0C7 jz short Bail_run_original_UHEF
.text:0005E0C9 mov edi, [ebp+1Ch] ; Points to stack...
.text:0005E0CC add edi, 4 ; Set to: argument for UnHandledExceptionFilter
.text:0005E0CF call read_dword ; Read argument...
.text:0005E0D4 jb short Bail_run_original_UHEF
.text:0005E0D6 mov edi, eax ; Points to an EXCEPTION_POINTERS structure...
.text:0005E0D8 call read_dword ; Read Pointer to EXCEPTION_RECORD structure.
.text:0005E0D8 ; It contains a machine-independent description
.text:0005E0D8 ; of the exception.
.text:0005E0DD jb short Bail_run_original_UHEF
.text:0005E0DF lea edi, [eax+0Ch] ; Points to ExceptionAdress.
.text:0005E0E2 call read_dword ; Read it!
.text:0005E0E7 jb short Bail_run_original_UHEF
.text:0005E0E9 cmp ExceptionAddress, eax ; Same as last??
.text:0005E0EF jz short Bail_run_original_UHEF ; Don't bother!
.text:0005E0F1 mov ExceptionAddress, eax ; Store it!
.text:0005E0F6 mov ebx, eax
.text:0005E0F8 sub edi, 0Ch ; Point to ExceptionCode.
.text:0005E0FB call read_dword ; Read it!
.text:0005E100 mov ExceptionCode, eax ; Store it!
.text:0005E105 cmp eax, 0C0000000h
.text:0005E10A jb short Bail_run_original_UHEF
.text:0005E10C cmp eax, 0C0000005h ; EXCEPTION_ACCESS_VIOLATION
.text:0005E111 jnz short Handle_Exceptions
.text:0005E113 add edi, 14h ; Point to ExceptionInformation. First part tells if the
.text:0005E113 ; AccessViolation was due to a read (0) or a write (1).
.text:0005E113 ; Second part contains the affected adress...
.text:0005E116 call read_dword ; Read It! (Read/write?)
.text:0005E11B jb short Handle_Exceptions
.text:0005E11D or eax, eax
.text:0005E11F jz short Handle_Exceptions ; If it was a write, NO jump.
.text:0005E121 add edi, 4 ; Point to second part!
.text:0005E124 call read_dword ; Read affected address!
.text:0005E129 jb short Handle_Exceptions
.text:0005E12B call sub_5E1B3 ; Does some extra work if it was a write... ??
.text:0005E130 jb short Bail_run_original_UHEF ; If it failed, just let UHEF do it's normal work... (?)
.text:0005E132
.text:0005E132 Handle_Exceptions: ; CODE XREF: Unhandledexceptfltr_BP_reached+61j
.text:0005E132 ; Unhandledexceptfltr_BP_reached+6Bj
.text:0005E132 ; Unhandledexceptfltr_BP_reached+6Fj
.text:0005E132 ; Unhandledexceptfltr_BP_reached+79j
.text:0005E132 movzx eax, word ptr [ebp+14h] ; ??
.text:0005E136 call sub_470B7 ; ??
.text:0005E13B mov dword_D879E, 10009h ; some NTice internal statuscode, I guess...
.text:0005E145 jmp short Emulate_result_of_UnHandledExceptionFilter
.text:0005E147 ; ---------------------------------------------------------------------------
.text:0005E147
.text:0005E147 Bail_run_original_UHEF: ; CODE XREF: Unhandledexceptfltr_BP_reached+17j
.text:0005E147 ; Unhandledexceptfltr_BP_reached+24j
.text:0005E147 ; Unhandledexceptfltr_BP_reached+2Dj
.text:0005E147 ; Unhandledexceptfltr_BP_reached+37j
.text:0005E147 ; Unhandledexceptfltr_BP_reached+3Fj
.text:0005E147 ; Unhandledexceptfltr_BP_reached+5Aj
.text:0005E147 ; Unhandledexceptfltr_BP_reached+80j
.text:0005E147 ; Unhandledexceptfltr_BP_reached+EEj
.text:0005E147 cmp Original_first_byte_of_UHEF, 55h
.text:0005E14E jz short Emulate_opcode_0x55
.text:0005E150 cmp Original_first_byte_of_UHEF, 68h
.text:0005E157 jz short Emulate_opcode_0x68
.text:0005E159 mov eax, large fs:0 ; SEH???
.text:0005E15F mov [ebp+8], eax ; in what?
.text:0005E162 add dword ptr [ebp+10h], 6 ; Set Eip to next instruction... hmm...
.text:0005E166 jmp short Finished
.text:0005E168 ; ---------------------------------------------------------------------------
.text:0005E168
.text:0005E168 Emulate_opcode_0x68: ; CODE XREF: Unhandledexceptfltr_BP_reached+A7j
.text:0005E168 sub dword ptr [ebp+1Ch], 4 ; Change esp like pushed...
.text:0005E16C mov edi, [ebp+10h] ; eip
.text:0005E16C ; This I don't understand. This would read 68XXXXXX
.text:0005E16C ; When it should read XXXXXXXX... ???
.text:0005E16F call read_dword ; read value to be pushed
.text:0005E174 mov edi, [ebp+1Ch] ; esp
.text:0005E177 call write_dword ; push value on stack
.text:0005E17C add dword ptr [ebp+10h], 5 ; set eip to next instruction
.text:0005E180 jmp short Finished
.text:0005E182 ; ---------------------------------------------------------------------------
.text:0005E182
.text:0005E182 Emulate_opcode_0x55: ; CODE XREF: Unhandledexceptfltr_BP_reached+9Ej
.text:0005E182 sub dword ptr [ebp+1Ch], 4 ; change esp like pushed...
.text:0005E186 mov edi, [ebp+1Ch] ; esp
.text:0005E189 mov eax, [ebp+0] ; Must be ebp...
.text:0005E18C call write_dword ; push ebp on stack
.text:0005E191 inc dword ptr [ebp+10h] ; set eip to next instruction
.text:0005E194 jmp short Finished
.text:0005E196 ; ---------------------------------------------------------------------------
.text:0005E196
.text:0005E196 Emulate_result_of_UnHandledExceptionFilter:
.text:0005E196 ; CODE XREF: Unhandledexceptfltr_BP_reached+95j
.text:0005E196 mov edi, [ebp+1Ch] ; Point to returnadress.
.text:0005E199 call read_dword ; Read IT!
.text:0005E19E jb short Bail_run_original_UHEF ; No returnaddress? Go to backup plan...
.text:0005E1A0 inc eax ; Set to one byte after???
.text:0005E1A1 mov [ebp+10h], eax ; Put Eip to returnadress+1 (???).
.text:0005E1A4 add dword ptr [ebp+1Ch], 8 ; Fix stack!
.text:0005E1A8 mov dword ptr [ebp+8], 0FFFFFFFFh ; ??
.text:0005E1AF
.text:0005E1AF Finished: ; CODE XREF: Unhandledexceptfltr_BP_reached+B6j
.text:0005E1AF ; Unhandledexceptfltr_BP_reached+D0j
.text:0005E1AF ; Unhandledexceptfltr_BP_reached+E4j
.text:0005E1AF stc ; set carry
.text:0005E1B0 retn
.text:0005E1B1 ; ---------------------------------------------------------------------------
.text:0005E1B1
.text:0005E1B1 some_other_BP: ; CODE XREF: Unhandledexceptfltr_BP_reached+Aj
.text:0005E1B1 clc ; clear carry
.text:0005E1B2 retn
.text:0005E1B2 Unhandledexceptfltr_BP_reached endp

/Manko


Compile this Under Dos
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Compile this Under Dos
PDA

View Full Version : Compile this Under Dos

peterg70
04-18-2003, 05:14 AM
Can someone help out and compile this code under dos and possible create a simple GUI with the filenameIN filenameOUT and salt key as a start.

I don't have access to a machine to compile it under windows XP.

http://www-2.cs.cmu.edu/~dst/Adobe/Gallery/fileSaveAs.c

Squidge : can you have a look (you seem to pump out these proggies reasonably quick)

Catch YA

Peterg
squidge
04-18-2003, 06:06 AM
I've had a look at it, and seems it requires SSL and Crypto support, which are external libraries, so will not compile under dos. It would compile quite happily under Linux however, as these libraries are normally installed by default.

I'll see if I can find win32 versions of these libraries.
peterg70
04-23-2003, 10:52 PM
Anyone gotten this to compile under windows or DOS.

A nice GUI would also be nice. ;-)

Peterg70
peterg70
05-03-2003, 08:27 AM
Anyone able to help??
beej
05-03-2003, 03:02 PM
If it works or not I really don't know, but it compiles and has an option for your salt :-)
Iwarez
05-03-2003, 05:41 PM
Looking into the source the only thing it does is saveing an encrypted pdf as an unencrypted and if that's the only thing you want to do then why do you want this code? There are better decrypters around the net. Just curious :)


have you noticed tsehp.cjb redirect to krosoft ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > have you noticed tsehp.cjb redirect to krosoft ?
PDA

View Full Version : have you noticed tsehp.cjb redirect to krosoft ?

timy
04-18-2003, 09:57 AM
tsehp.cjb.net or fraviamb.cjb.net send you to the microsoft page ... I guess it is a dirty joke ....
but woodmann.cjb works nicely ...
Manko
04-18-2003, 10:05 AM
It's actually happened before... this messageboard getting redirected to microsoft... Hmm...

/Manko
dELTA
04-19-2003, 05:33 PM
Those old redirectors are not used anymore.

The new redirector (as listed in the "link box" at the bottom of each forum page) is now:

http://woodmann.cjb.net/

Please update your bookmarks and spread the word to everyone that might not have heard about this.

dELTA


Dll Crunched...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dll Crunched...
PDA

View Full Version : Dll Crunched...

[UAZ]
04-18-2003, 02:02 PM
Hum I am a newbie in unpacking so I would ask you where could I find some tutorials about Crunch, but here it is a dll packed with the 4.0.0 version of Bit-Arts Crunch... Or if someone could help me... It is a 3DsMAX plugin called Power Booleans. There is no direct link on the web to find it, if you want it to take a look just ask me by PM.
S3ri@l CoDe9x
04-18-2003, 02:29 PM
..U see this tutorial?:

hxxp://www.woodmann.net/fravia/kilby_Crunch2.htm <-- remember change http

u can have one idea of since this protection works..:p..

Best Regards :rolleyes:
skyjacker
04-21-2003, 11:21 AM
if someone else have more informations, like how to hide softice with this fuckin cruncher 4.00 ... cause frogice and ice dump failled


conditional breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > conditional breakpoints
PDA

View Full Version : conditional breakpoints

fg-eal
04-19-2003, 04:48 AM
is it possible with softice or another tool to set a conditional breakpoint on the data within the current instruction as in *(eip).. so I'd like to say break on a CMPXCHG, etc. or something else which exists in a few thousand possible places within the execution path.. is placing int3s at each instruction my only option? because that will get messy

thanks!
Kayaker
04-21-2003, 02:45 PM
Hi

Yes, you should be able to. In a recent thread on conditional breakpoints in 16bit apps we found it was a problem, but in regular 32bit code you can set these opcode type of breakpoints. As an example say you wanted to break over the range of a program whenever you got the opcodes which defined the start of a regular call:

8BEC MOV EBP, ESP
83ECxx SUB ESP, xx

A conditional breakpoint which should break each time this code is used is

BPRW <modulename> R if *eip == EC83EC8Bh

note the reversed dword.

Apply it to your own situation and you should be able to do what you want, hope this helps.

Kayaker

See Using SoftICE.pdf chapter 6 for more on conditional breakpoints.
BPRW may fail on some AMD processors.
JMI
04-21-2003, 05:26 PM
A truely great article on this subject is titled:

Rhayader's SoftICE conditional breakpoints

You could put that in google, or your favorite search engine and find many copies around. There is also one on the Fravia site here, but there may be some problems there at the moment.
Just gave it a test and this one works:

hxxp://www.woodmann.net/fravia/rhayader.htm <-- change "hxxp" to "http".

Everyone who uses Softice should read this article and try it's techniques.

Regards.
fg-eal
06-01-2003, 05:46 AM
hello again,

I had previously read Rhayader's tutorial.. but thanks for your replies.. do you know of a manner of doing this with NTICE or any way under NT5?
Aimless
06-04-2003, 12:07 AM
BPR(x) commands no longer work in anything that is above Windows 98 (specially systems with NT as the base, that includes NT4, 2k Pro, 2K server, XP home, XP Pro and 2003 Servers)

As of yet, there is no known way to perform the actions that you require with Softice on NT based systems.

You will have to put an INT 03 (messy, but no choice) either physically or in memory.

A better (depending on your requirements) idea would be to:

1. Download Ollydbg
2. Trace and log the traces (do not trace system calls! turn on the option to jump over system calls in the Ollydbg -> Options menu)
3. Save the log file on the hard disk (its a simple text file)
4. Use findstr.exe (since you are using NT based systems) and get the lines which possess your instructions.

To do it in softice you would have to:

1. Increase the buffer size in winice.dat
2. Close the Code window
3. Trace or P-trace manually (the code, as it executes is automatically put in the command window)
4. Save the command window to a log file using the Softice loader
5. Use findstr.exe on it again.

Alternatively,

You may also use microsoft WINDBG to perform the same actions...

Bottom line is, NT based systems are not that easy to reverse-engineer with Softice. Lets see what Numega does next...

Have Phun
dELTA
06-04-2003, 06:12 AM
Driver Studio 3.0 is currently in beta testing. Does anyone know if it's got any of the long awaited features to bring it closer to Win9x power, like that one for example?

dELTA
Paul333
06-06-2003, 06:30 PM
Originally posted by JMI
A truely great article on this subject is titled:

Rhayader's SoftICE conditional breakpoints

hxxp://www.woodmann.net/fravia/rhayader.htm <-- change "hxxp" to "http".

Everyone who uses Softice should read this article and try it's techniques.

Regards.

JMI theres no need to change the hxxp to http ..its just a straight copy n paste as the browser will change it automatically :)..

at least ie 5 n over does :)

paul333
the_analyst
06-08-2003, 07:36 AM
Originally posted by dELTA
Driver Studio 3.0 is currently in beta testing. Does anyone know if it's got any of the long awaited features to bring it closer to Win9x power, like that one for example?

dELTA

Hello,

Actually, DS 3 won't offer BPM on 2K/XP systems.
Though, there are some nice features in it :)
XP is well supporter now as well.

Enjoy.

Analyst


MFC VC question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MFC VC question
PDA

View Full Version : MFC VC question

LaptoniC
04-19-2003, 09:44 PM
I am workiing on Sheriff Licence System Lately.In the staticlibrary there are a lot of usefull function.However I cant make use of it.
function name is
GetSecrets@@YAPAU_SLS_SECRET@@PBDAAH@Z

according to IDA it

want char,pointer to int and return value is pointer to SLS_SECRET structure.How can I link this function to my ap.I have Visual Studio 6.Thanks and sorry I am not familiar with VC and MFC :(
squidge
04-20-2003, 03:26 AM
Looks like standard C++ name mangling to me, so if you extern a reference to the function name GetSecrets and use exactly the same return value and parameters, the compiler should generate the same name and be able to link to it.
_Servil_
04-20-2003, 05:57 AM
Hi Laptinic,

If your project in C,

just make a prototype,

like this

SLS_SECRET * __cdecl GetSecrets(char, int *);

in linker put extra /defaultlib:<the_static_library.lib> switch to cmdline, if arguments you stated rite the importdef of ur app should be same as the exportdef.
LaptoniC
04-20-2003, 09:12 AM
I tried below

_SLS_SECRET * __cdecl GetSecrets(char const *,int &);

int test1;
GetSecrets("5328-8301-2929-7640-5794"",&test1);

or
SLS_SECRET * __cdecl GetSecrets(char, int *);
GetSecrets("5328-8301-2929-7640-5794"",&test1);

In the dissambly usage is like this

.data
sSize dd 0
pId db "5328-8301-2929-7640-5794"

push offset sSize
push offset pId
call GetSecrets

If you want I can upload my project or send to you.Thanks.

error message is
error C2664: GetSecrets' : cannot convert parameter 1 from 'char [25]' to 'char' This conversion requires a reinterpret_cast, a C-style cast or function-style cast
LaptoniC
04-20-2003, 10:42 AM
Finallly below one worked
_SLS_SECRET * __cdecl GetSecrets(char const *,int &);

typedef struct _SLS_SECRET
{
unsigned char Secret[32]; //null-terminate string
} SLS_SECRET;

char * pId="1234-5678-9012-3456-7890";

SLS_SECRET *mysecret;
strcpy(pId,"5328-8301-2929-7640-5794");
mysecret=GetSecrets(pId,sSize);

However I cant show mysecret with messagebox etc.
squidge
04-20-2003, 10:51 AM
Have you tried searching for the SDK? It's bound to have been uploaded somewhere public, probably with weak password protection.
LaptoniC
04-20-2003, 11:12 AM
I have the sdk it is freely distributed from their website.I finally made it work but given serial number doesnt works.Anyway I guess I will find secret codes with my tool and uses slsgen.exe to make keys.

Thanks
cyberheg
04-20-2003, 11:33 AM
Originally posted by LaptoniC
Finallly below one worked
_SLS_SECRET * __cdecl GetSecrets(char const *,int &);

typedef struct _SLS_SECRET
{
unsigned char Secret[32]; //null-terminate string
} SLS_SECRET;

char * pId="1234-5678-9012-3456-7890";

SLS_SECRET *mysecret;
strcpy(pId,"5328-8301-2929-7640-5794");
mysecret=GetSecrets(pId,sSize);

However I cant show mysecret with messagebox etc.

You might want to learn programming C++ a bit better before diving into such as this.

I downloaded the sdk though and studied the static library as you said the function would be in.

The prototype of the function should be SLS_SECRET * GetSecrets(const char *, int *);

I don't think you want to use cdecl spec because that would conflict with C++ name mangling. Also the file you have your code in must be named *.cpp and not *.c to make sure you activate the C++ compiler.

From the prototype we see that parameter 1 is not modified by the function and should be zero terminated. For the second parameter you used reference instead of pointer but from the code I found:

.text:00000168 mov ecx, [ebp+arg_4]
.text:0000016B mov dword ptr [ecx], 4

So by using a pointer you make sure you get the correct code generated by the compiler.

So to call it you should do:

SLS_SECRET *pMysecret;
int nSize;
pMysecret = GetSecrets("5328-8301-2929-7640-5794", &nSize);

Now you state that you can't display the SLS_SECRET variable to a messagebox. Why doesn't that not surprise me?
What you really want is not to feed the messagebox with the SLS_SECRET structure but the char string inside it.

Try with something like:

MessageBox(NULL, pMysecret->Secret, "Secret data...!?", MB_OK);

// CyberHeg
LaptoniC
04-20-2003, 07:54 PM
I have already writen asm equivalent of GetSecret function and it works quite well.However licence generetion routine of sdk have a lot of C class function and it will took a lot of time to convert.So I thought if I can use GetSecretFunction from lib and with the help of SLS_GenerateLicenceKey function I may genereate licence key.However GenerateLicenceKey function gaves wrong serial number.Anyway if you want interested here is my code

_SLS_SECRET * __cdecl GetSecrets(char const *,int &);

char * pId="1234-5678-9012-3456-7890";
char LicKey [64];

void CSheriffDlg::OnButton1()
{

int sSize;
char RefCode[30];

SLS_LICENCE LicencePolicy;
SLS_SECRET *mysecret;
GetDlgItemText(IDC_EDIT1,pId,25);
GetDlgItemText(IDC_EDIT2,RefCode,30);
mysecret=GetSecrets(pId,sSize);
LicencePolicy.Type=SLS_TYPE_STANDALONE;
LicencePolicy.CoUsers=1;
SLS_GenerateLicenceKey(pId,mysecret,4,RefCode,&LicencePolicy,LicKey);
SetDlgItemText(IDC_EDIT3,LicKey);

}

Thanks everyone.


Serial fishing with Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Serial fishing with Softice
PDA

View Full Version : Serial fishing with Softice

newbcrk
04-20-2003, 10:27 AM
Hello ,

Need help of course .Could you read this

: wr
:bpx getwindowtextA
Break due to BPX USER32!GetWindowTextA (ET=1.73 seconds)
Break due to BPX USER32!GetWindowTextA (ET=.53 microseconds)
Break due to BPX USER32!GetWindowTextA (ET=.54 microseconds)

:bpm 00AC6020 ;I have type this because 00AC6020 contains my false serial number
(I have choose 123456789 and do d ECX wich answer 0023:00AC6020 and 123456789 in my wd)
-I can't use bpr because I am under NT
-I am under a file of my target wich is a file .dll

Break due to BPMB #0010:00AC6020 RW DR3 (ET=336.36 microseconds)
MSR LastBranchFromIp=77F9102A
MSR LastBranchToIp=77F91139
Break due to BPMB #0010:00AC6020 RW DR3 (ET=227.88 microseconds)
MSR LastBranchFromIp=1000764D
MSR LastBranchToIp=1000E2F0
:U 1000E320 L FF
001B:1000E320 8BC8 MOV ECX,EAX
001B:1000E322 83E103 AND ECX,03
001B:1000E325 F3A4 REPZ MOVSB
001B:1000E327 8BAC24B8010000 MOV EBP,[ESP+000001B8]
001B:1000E32E B9FFFFFFFF MOV ECX,FFFFFFFF
001B:1000E333 8BFD MOV EDI,EBP
001B:1000E335 2BC0 SUB EAX,EAX

001B:1000E337 F2AE REPNZ SCASB ; I HAVE BREAK HERE in my target Repeat not zero and scan the string 123456789 perhaps ? Not easy for me to trace the false code after thi instruction

.i have lost here the false value of my serial .
I don't understand how the false value is manipulated,pushed,proved ,how to find the value wih has probably be pushed in another register....So that I can't see where the false serial is compared with the rigt serial .
I have try too s 0 l ffffffff '123456789' same problem .Idon't understnad the ASM code .

001B:1000E339 F7D1 NOT ECX

001B:1000E33B 2BF9 SUB EDI,ECX
001B:1000E33D 8BC1 MOV EAX,ECX
001B:1000E33F C1E902 SHR ECX,02
001B:1000E342 8BF7 MOV ESI,EDI
001B:1000E344 8DBC24AC000000 LEA EDI,[ESP+000000AC]
001B:1000E34B F3A5 REPZ MOVSD
001B:1000E34D 8BC8 MOV ECX,EAX
001B:1000E34F 83E103 AND ECX,03
001B:1000E352 F3A4 REPZ MOVSB
001B:1000E354 8D8C242C010000 LEA ECX,[ESP+0000012C]
001B:1000E35B 8B35DC8A0110 MOV ESI,[10018ADC]
001B:1000E361 51 PUSH ECX
001B:1000E362 FFD6 CALL ESI
001B:1000E364 8D8C24B0000000 LEA ECX,[ESP+000000B0]
001B:1000E36B 83C404 ADD ESP,04
001B:1000E36E 8BFB MOV EDI,EBX
001B:1000E370 51 PUSH ECX
001B:1000E371 FFD6 CALL ESI
001B:1000E373 83C404 ADD ESP,04
001B:1000E376 B9FFFFFFFF MOV ECX,FFFFFFFF
001B:1000E37B 2BC0 SUB EAX,EAX
001B:1000E37D F2AE REPNZ SCASB
001B:1000E37F F7D1 NOT ECX
001B:1000E381 49 DEC ECX
001B:1000E382 0F84FB030000 JZ 1000E783
001B:1000E388 8BFD MOV EDI,EBP
001B:1000E38A B9FFFFFFFF MOV ECX,FFFFFFFF
001B:1000E38F 2BC0 SUB EAX,EAX
001B:1000E391 F2AE REPNZ SCASB
001B:1000E393 F7D1 NOT ECX
001B:1000E395 49 DEC ECX
001B:1000E396 0F84E7030000 JZ 1000E783
001B:1000E39C 8D84242C010000 LEA EAX,[ESP+0000012C]
001B:1000E3A3 50 PUSH EAX
001B:1000E3A4 E887FEFFFF CALL 1000E230
001B:1000E3A9 8D8424B0000000 LEA EAX,[ESP+000000B0]
001B:1000E3B0 83C404 ADD ESP,04
001B:1000E3B3 50 PUSH EAX
001B:1000E3B4 E877FEFFFF CALL 1000E230
001B:1000E3B9 8DBC2430010000 LEA EDI,[ESP+00000130]
001B:1000E3C0 83C404 ADD ESP,04
001B:1000E3C3 B9FFFFFFFF MOV ECX,FFFFFFFF
001B:1000E3C8 2BC0 SUB EAX,EAX
001B:1000E3CA F2AE REPNZ SCASB
001B:1000E3CC F7D1 NOT ECX
001B:1000E3CE 8DBC24AC000000 LEA EDI,[ESP+000000AC]
001B:1000E3D5 2BC0 SUB EAX,EAX
001B:1000E3D7 8D51FF LEA EDX,[ECX-01]
001B:1000E3DA B9FFFFFFFF MOV ECX,FFFFFFFF
001B:1000E3DF F2AE REPNZ SCASB
001B:1000E3E1 F7D1 NOT ECX
001B:1000E3E3 49 DEC ECX
001B:1000E3E4 4A DEC EDX
001B:1000E3E5 83FA09 CMP EDX,09
001B:1000E3E8 8BC2 MOV EAX,EDX
001B:1000E3EA 894C241C MOV [ESP+1C],ECX
001B:1000E3EE 7C05 JL 1000E3F5
001B:1000E3F0 B809000000 MOV EAX,00000009
001B:1000E3F5 89442424 MOV [ESP+24],EAX
001B:1000E3F9 83FA04 CMP EDX,04
001B:1000E3FC 8BC2 MOV EAX,EDX
001B:1000E3FE 7C05 JL 1000E405
001B:1000E400 B804000000 MOV EAX,00000004
001B:1000E405 89442410 MOV [ESP+10],EAX
001B:1000E409 83FA07 CMP EDX,07
001B:1000E40C 7C05 JL 1000E413
001B:1000E40E BA07000000 MOV EDX,00000007
001B:1000E413 8B44241C MOV EAX,[ESP+1C]
001B:1000E417 89542428 MOV [ESP+28],EDX
001B:1000E41B 48 DEC EAX
001B:1000E41C 83F808 CMP EAX,08
:confused:
dELTA
04-20-2003, 01:52 PM
It's quite unlikely that anyone here would like to be your personal decompiler of a dump of uncommented ASM code. As you say yourself, the biggest problem is that you don't understand ASM code.

A very good advice would be to study some ASM code, and then really trying to understand what this code is doing. You would be surprised to see how much code you can fully understand by only learning the functionality of the simple instructions mov, lea, add, sub, push, pop, cmp, test, jmp, jxx, and possible a couple more (e.g. the repxx prefixes).

Just take a look in the Intel command reference, and then analyze and comment the code above, step by step. I assure you that it will be a very instructive experience, and not at all as hard as it might seem.

dELTA


where to get best tutotrial on serial/unpacking,etc?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > where to get best tutotrial on serial/unpacking,etc?
PDA

View Full Version : where to get best tutotrial on serial/unpacking,etc?

thematrix
04-20-2003, 10:43 AM
where to get a handsome amount of good cracking tutorial on serial fishing,patching,unpacking,etc i have got some tutotial from krobar but ethy r very old and dont describe new cracking techniques
thanks
dELTA
04-20-2003, 01:44 PM
All those techniques you mention, except unpacking, hardly evolves over time at all, so a little old tutorials is no problem. As for the question anout where to find good tutorials, the links at the bottom of this page (and the sites they link to and so on) should be quite enough. In the unlikely case that you for some reason wouldn't be satisfied with these, google should get you the rest of the way.

dELTA
thematrix
04-21-2003, 04:42 AM
thanks delta but where to get help the email described in the tutorial r not working as they r year back old?
Shoob
04-21-2003, 05:45 AM
Sure the most tutorials are old but if you combine good old tuts and the new Tools then you get a good result :D. You must learn by doing. Especially for new unpacking tuts you can use the search button above, you will find some in this forum. Get infos from every tut you find and you will be soon better. Follow the white rabbit ;)
dELTA
04-21-2003, 06:01 AM
thematrix, if you get stuck while studying a tutorial, and really have tried to solve it yourself and find info about it, but still without no luck, then you ask a good question about your problem in here, and you will most likely get some help.

dELTA


Dillodumper 2.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dillodumper 2.3
PDA

View Full Version : Dillodumper 2.3

gnog
04-20-2003, 11:04 AM
i couldn't get the new version of dillodumper to make a working .exe of any armadillo protected app i tested. i've tried 5 different ones.

here is a sample of what it prompted when i tried unpacking an app:

Loading victim process..
Examining .....
Executing...
Preparing....
Starting normally
Scanning....Please wait..
Acquired...
Acquired...
Syncing .....
Attempting dump, please be patient...
OEP : 40A44Ch
Program dumped..
Header fixed..
Dump Successfully fixed !
Building IAT....
Loading Modules and DLL forwards in process .. :
Forwards complete.
IAT rebuild complete.
Server process terminated
Client process terminated
Done !
Press key to continue

but when trying to launch dumped.exe, it gave me an error saying: "dumped.exe is not a valid Win32 application."

it gave this error also on all the other apps, any ideas ?
Lunar_Dust
04-20-2003, 01:17 PM
I find it hard to believe it would not work on up to 5 programs, but I did find a bug in the IAT rebuild engine and built a new version.

There is still another bug somewhere in my import rebuild code, rebuilding imports is quite a complex task, and I fear I may have released this version too soon (although it worked on all my arma targets)

The new version of dumper allows you to skip the IAT rebuild part and just use ImpREC for it if you wish.

The biggest reason for development of the tool was to make dumping easier against copymemII and expiration restrictions. Rebuilding Imports is still something being debugged, as I get reports from various people.

If you'd like to send me an email with a specific target, it would help me track down the problems better.

DO NOT POST ANY SPECIFIC TARGET IN THIS THREAD!

lunardust20@
yahoo.com

Once again I apologize for the problems, but please understand that imports can be highly complex (ordinals, names, forwards, etc). I am basically trying to do what ImpREC does, so I'm emulating an entire other program. It's going to have some instabilities for a little while...

-Lunar_Dust
mpossible
04-21-2003, 06:45 AM
When I was trying to unpack a armadilled file with dillodumer v.2.34 and others , it shows only....

Loading victim process..

and then nothing happens.
nikolatesla20
04-21-2003, 09:00 AM
If the file is protected with Arma 3.0 or 3.0a, it will not run on a machine that has SoftICE installed and not hidden correctly.

This dumper only removes "Advanced detection" in which they search for the NTICE service. There is still an UnhandledExceptionFilter check which will cause the arma executable to appear to just not do anything if it finds a breakpoint on UnhandledExceptionFilter (which softice sets when it's installed). The arma executable will sit in an endless loop of error, without reporting anything, and without crashing. You have to kill it from the Task Manager.

See the Tools of Trade forum on how to remove this breakpoint that SoftICE sets.

-nt20
mpossible
04-24-2003, 12:05 AM
Sorry, The file is protected by Armadillo 2.65 or before released .
And also I have not installed SICE.

So I am worried about that.
fuzzy_seacow
04-27-2003, 09:27 PM
This proggie works like a charm for me. Thanks :)
Hopcode
04-28-2003, 06:49 AM
They updated Armadillo.. their beta version breaks dillodumper :(
Hope to see an update soon.
thematrix
04-28-2003, 11:35 AM
which version of imprec works with this i have 1.3 ? a new release is out but confused where i can get it checked protools in vain
JMI
04-28-2003, 12:02 PM
thematrix:

Please re-read the statement contained under the Tools of the Trade Forum, which state clearly:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

Now that you have been reminded of the rules, let me also remind you that most of what you need in RCE can be found if you learn how to search the net. Imprec 1.4.2+ is out there, but was not released in the "general" channels. Use your search engine. Here's a BIG hint. Remember that the program"s name is not actually "imprec".
Regards.
esther
04-28-2003, 12:39 PM
Hi thematrix,
google dot com the program name + the authors name

Good Luck
nikolatesla20
04-28-2003, 01:35 PM
I've informed Lunar_Dust of this new update, and his response right now was that he isn't going to be looking at this for a while now, he's busy with other things at the moment..

Here's a quote from him:

"Sorry guys right now I'm distracted with some other tasks, it's good they are finally improving their protection, for 89 bucks it should be better than what it was....I laugh however that I am most likely increasing their revenue by forcing older customers to want to upgrade to escape the dumper :cool: , for now, I don't have any updates yet, and maybe not for a long while. I found some more info tho on some detection schemes Arma 3.0 is using, for example, it detects superBPM by its driver name, similar to softice. "\\.\SuperBPMDev0". This should help some of you out there ..Chad and his buds are actually on top of things, looks like I'm making them work hard LOL. I will more likely wait until their new version is in wide distribution before I release another unpacker for it."

So Lunar is kinda pre-occupied, sorry...

-nt20
Hopcode
04-28-2003, 04:06 PM
Heh.

Now that "i informed him" thing was funny, but smart people got the idea ;-)

About Armadillo, i think they rely on the int 3, which isn't likely to be broken with some easy code fixer as before.
At least i could not do it, im working on some tool right now.

As for the SuperBPM detection code, there are one other on 9x system in the loader but those checks are just "toys" because they aren't useful at all.

Even without those detections you won't use Super BPM because they use debug registers to compute some keys to decrypt some code .. So If you they aren't zeroed out, it will crash. No matter how well you hide your SuperBPM. i experienced that :)

I am not sure that you will make a new unpacker that soon too :)
Having studied the new beta version, i found a lot of changes that will stop you from doing what you were doing.

Sorry i reversed your dumper too ;-)

In any case, if you need some helps on your dumper, just say it, i will gladly help you.

Im bored lately, Asprotect isn't of any fun at all.

Regards and Respect,

HopCode.
crUsAdEr
04-28-2003, 05:11 PM
LOL... sorry couldnt resist to post something...

Nice work there, Lunar_Dust (though i still advocate source code)... :) while some people try to keep their identity private... others cant wait to display theirs... was just musing over this 1ST guy, yes, his nick was "1ST" who claims to be unpacking god after releasing 2 unpacked exe of Aspr and Arma 2.51 on TNT forum... wonder when did Deamon recruits this new member :)?

Now that "i informed him" thing was funny, but smart people got the idea ;-)

heh, Hopcode :)... saying u r smart heh :)... ???
just joking... informed ppl got the idea sounds more like it :-)
Lunar_Dust
04-28-2003, 08:21 PM
ok...

I may have the source for you soon. Of course, would it do much good anymore? I don't know. I was simply trying to keep the Arma guys from knowing TOO much.

Source is ugly, but functional, and has plenty of comments.

-Lunar_Dust (Group LUNAR)
Hopcode
04-29-2003, 06:56 AM
> his nick was "1ST" who claims to be unpacking god after >releasing 2 unpacked exe of Aspr and Arma 2.51 on TNT forum... >wonder when did Deamon recruits this new member :)?

I didn't claim anything :)

>heh, Hopcode :)... saying u r smart heh :)... ???
>just joking... informed ppl got the idea sounds more like it :-) [/B]

heh. Well no. i used smart to mean something like "not gullible"
But you got the idea ;-)

I was just saying i could help Lunar Dust if he wanted.

Have fun and enjoy the day ;)

HopCode
Lunar_Dust
04-29-2003, 09:31 AM
Hopcode...

do I have your email?

-LD
Hopcode
04-29-2003, 10:44 AM
Nop.
lemme send it to you in private message.
crUsAdEr
04-29-2003, 11:26 AM
Hopcode :)... was just joking :)... no offense i hope :>
Hopcode
04-29-2003, 02:35 PM
hehe
I know you were kidding me.
No problem mate! :)


Hacking a keyboard driver...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hacking a keyboard driver...
PDA

View Full Version : Hacking a keyboard driver...

squidge
04-20-2003, 03:38 PM
I've gone and purchased a Logitech Navigator keyboard. Mainly because it was black and suited the rest of my setup.

It comes with several special added function keys along the top, labeled with things like "Email", "Messenger", "Webcam", "Shopping", etc, and also contains some multi media type buttons in the middle for volume control, volume mute/etc.

I figured I could use some of these buttons for something of more use, like frequently accessed webpages and programs. This is fine as the keyboard comes with a configuration program that allows you to redefine these keys.

However, the response to these keys is very sluggish, and the program itself also turns my function keys into annoying "enhanced keys" by giving them commands like "My Documents folder", "My Pictures Folder". This I hate.

So my first idea was to write a keyboard hook routine that would give me the scan codes of these keys so I can modify them in the hook to do what I want and get rid of the utility program. One small snag with this is that even with the WH_KEYBOARD_LL (lowlevel) keyboard hooks, no scan codes are reported for these keys.

I'm now thinking that these keys must either be filtered off by the driver and passed to the utility program in some other method (perhaps windows messages or events). So my best cause of action would be to hack up the driver to add scan codes for these keys so my keyboard hook routine can parse them.

Now, I've never hacked a keyboard driver before, so just wondering if anyone has any clues as to how they work, or possibly any URL's of websites that may help?
disavowed
04-20-2003, 06:31 PM
Originally posted by squidge
I'm now thinking that these keys must either be filtered off by the driver...
why not try disabling the driver, rebooting, and then trying your keyboard hook w/o the driver running? :)
squidge
04-21-2003, 04:12 AM
Tried that, but then I don't get any codes whatsoever. Considering it's a USB keyboard I decided on a different approach. I connected the USB->PS2 converter, and then rebooted, and since it's no more USB it's not plug&play, so told Windows it was a standard 103 key keyboard.

Now a lot of the keys don't work anymore, but I do get the scan codes of these keys in my keyboard hook, so can change them to whatever I want. It's also a LOT faster than it was.

How come Logitech always make great hardware products and really crap drivers ? It's the same with there mice - the MX700 for example.
disavowed
04-21-2003, 08:15 AM
i had to reformat a few years ago after logitech's mouse drivers rendered my keyboard useless (yes, keyboard) under win2k

/me no longer buys logitech products
Dedec0
04-27-2003, 08:38 PM
disavowed, I am very curious to know how a program fucked up a piece of hardware... would you give us some details?

squidge, I am a beginner at this, so I can't tell you much anyway, but should get you started (if you didn't by now).
To directly control anyhardware from Windoze, you need a "ring0" program (aka VXD, and some others, I think). Normal EXEs are NOT alowed to direct access any hardware what so ever. So you may try searching for these things on google, win32asm, etc...

I am curious about reversing my mouse/ keyboard/ etc. specialy because I have some extra hardware (circuits, cables, etc.) that are no in use because some shitty mechanical plastic parts that were broken... most for a thing so stupid... :( Reusing that would be cool: imagine you have 2 mice, 1 normal and another one you use for "special tasks", with slight modification... or something. hehe...

Regards,
fuzzy_seacow
04-27-2003, 09:39 PM
I've also been thinking of hacking the usb-keyboard driver (or writing a new one). I would like to use two usb-keyboards, one for ordinary typing and the other as programmable hotkeys. Sofar I've not found any program or driver that lets me do this. Have anyone else found a driver/util that lets you do this in 2000/XP?
tgodd
04-27-2003, 09:58 PM
Sorry do not have a driver for you....

If you are interested in having a look at the usb, then
you should have a look at this:

hxxp://sourceforge.net/projects/usbsnoop/

and as usual xx must be changed to tt.

Hope that this helps.

Regards,

tgodd
fuzzy_seacow
04-27-2003, 10:17 PM
Thanks for the hint about the sf project. Looks like a great starting point. Shouldn't be to hard to modify it for my needs. Wouldn't it be great to use one of thoose numeric usb-keyboards as a programmable hotkey board?

/seacow
UrgeOverKill
05-03-2003, 10:10 PM
Hey Squidge,

take a look at 'C:Windows\Inf\Keyboard.inf' and I think you might find what you are looking for there. If your good at decrypting....... the other file is "C:Windows\Inf\Keyboard.PNF'
squidge
05-04-2003, 05:55 AM
Thanks UrgeOverKill, however my keyboard hook is working very well - lets me intercept all the special keys and seems to be quite reliable (certainly better than Logitech's offering anyway).

Source attached for anyone interested (18kb).

Note that this only works whilst in the PS2 port (USB is too laggy anyway).
kfw
05-07-2003, 12:16 PM
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwui/html/wm_appcmd.asp


problem pl..... help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > problem pl..... help
PDA

View Full Version : problem pl..... help

thematrix
04-21-2003, 10:39 AM
i am a newbie here
i tried my 1st victim a software named PCmedik, after checking the serial protection by softice i come to know that the final check of serial check is done at this address:-
0047a570 0F857000000 jne 0047A61D
which i have changed to je 0047A61D
i even tried to see the serial by this "d eax,ebxecx,edi,esi" which result in vain

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A499(C)
|
:0047A508 E8DBD0FDFF call 004575E8
:0047A50D 837DFC00 cmp dword ptr [ebp-04], 00000000
:0047A511 0F843C010000 je 0047A653
:0047A517 8D55F8 lea edx, dword ptr [ebp-08]
:0047A51A 8B8324030000 mov eax, dword ptr [ebx+00000324]
:0047A520 E8C3D0FDFF call 004575E8
:0047A525 837DF800 cmp dword ptr [ebp-08], 00000000
:0047A529 0F8424010000 je 0047A653
:0047A52F 8D55F0 lea edx, dword ptr [ebp-10]
:0047A532 8B8324030000 mov eax, dword ptr [ebx+00000324]
:0047A538 E8ABD0FDFF call 004575E8
:0047A53D 8B45F0 mov eax, dword ptr [ebp-10]
:0047A540 8D55F4 lea edx, dword ptr [ebp-0C]
:0047A543 E8A0DBF8FF call 004080E8
:0047A548 8B45F4 mov eax, dword ptr [ebp-0C]
:0047A54B 50 push eax
:0047A54C 8D55E8 lea edx, dword ptr [ebp-18]
:0047A54F 8B832C030000 mov eax, dword ptr [ebx+0000032C]
:0047A555 E88ED0FDFF call 004575E8
:0047A55A 8B45E8 mov eax, dword ptr [ebp-18]
:0047A55D 8D55EC lea edx, dword ptr [ebp-14]
:0047A560 E883DBF8FF call 004080E8
:0047A565 8B45EC mov eax, dword ptr [ebp-14]
:0047A568 5A pop edx
:0047A569 E8B63D0000 call 0047E324
:0047A56E 3C01 cmp al, 01
:0047A570 0F85A7000000 jne 0047A61D
:0047A576 A1E03C4800 mov eax, dword ptr [00483CE0]
:0047A57B 8B00 mov eax, dword ptr [eax]
:0047A57D 8B805C030000 mov eax, dword ptr [eax+0000035C]
:0047A583 33D2 xor edx, edx
:0047A585 E87ECFFDFF call 00457508

BUT AFTER THANKS MESSAGE ALSO the disabled function is still there
and in the about box also it still point to unregistered.whats this?
there is also a key in registry
"\Software\PGWARE\PcMedik"

* Possible StringData Ref from Code Obj ->"\Software\PGWARE\PcMedik"
|
:00481AB9 BAFC1D4800 mov edx, 00481DFC
:00481ABE 8BC3 mov eax, ebx
:00481AC0 E82F01FAFF call 00421BF4
:00481AC5 8D4DE8 lea ecx, dword ptr [ebp-18]

* Possible StringData Ref from Code Obj ->"Name"
|
:00481AC8 BA201E4800 mov edx, 00481E20
:00481ACD 8BC3 mov eax, ebx
:00481ACF E8E802FAFF call 00421DBC
:00481AD4 8B55E8 mov edx, dword ptr [ebp-18]
:00481AD7 B86C4F4800 mov eax, 00484F6C
:00481ADC E83326F8FF call 00404114
:00481AE1 8D4DE4 lea ecx, dword ptr [ebp-1C]

* Possible StringData Ref from Code Obj ->"Serial"
|
:00481AE4 BA301E4800 mov edx, 00481E30
:00481AE9 8BC3 mov eax, ebx
:00481AEB E8CC02FAFF call 00421DBC
:00481AF0 8B55E4 mov edx, dword ptr [ebp-1C]
:00481AF3 B8684F4800 mov eax, 00484F68
:00481AF8 E81726F8FF call 00404114
:00481AFD 8D45DC lea eax, dword ptr [ebp-24]
:00481B00 50 push eax
:00481B01 8B15684F4800 mov edx, dword ptr [00484F68]

AN ALSO HERE

* Possible StringData Ref from Code Obj ->"\Software\PGWARE\PCMedik"
|
:0047E387 BAECE64700 mov edx, 0047E6EC
:0047E38C 8B45EC mov eax, dword ptr [ebp-14]
:0047E38F E86038FAFF call 00421BF4
:0047E394 837DFC00 cmp dword ptr [ebp-04], 00000000
:0047E398 7428 je 0047E3C2
:0047E39A 837DF800 cmp dword ptr [ebp-08], 00000000
:0047E39E 7422 je 0047E3C2
:0047E3A0 8B4DFC mov ecx, dword ptr [ebp-04]

* Possible StringData Ref from Code Obj ->"Name"
|
:0047E3A3 BA10E74700 mov edx, 0047E710
:0047E3A8 8B45EC mov eax, dword ptr [ebp-14]
:0047E3AB E8E039FAFF call 00421D90
:0047E3B0 8B4DF8 mov ecx, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"Serial"
|
:0047E3B3 BA20E74700 mov edx, 0047E720
:0047E3B8 8B45EC mov eax, dword ptr [ebp-14]
:0047E3BB E8D039FAFF call 00421D90
:0047E3C0 EB20 jmp 0047E3E2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E398(C), :0047E39E(C)
|
:0047E3C2 8D4DFC lea ecx, dword ptr [ebp-04]

* Possible StringData Ref from Code Obj ->"Name"
|
:0047E3C5 BA10E74700 mov edx, 0047E710
:0047E3CA 8B45EC mov eax, dword ptr [ebp-14]
:0047E3CD E8EA39FAFF call 00421DBC
:0047E3D2 8D4DF8 lea ecx, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"Serial"
|
:0047E3D5 BA20E74700 mov edx, 0047E720
:0047E3DA 8B45EC mov eax, dword ptr [ebp-14]
:0047E3DD E8DA39FAFF call 00421DBC

where the serial and name r stored,
i put a breakpoint

bpx RegQueryValueExa If (*edi>='Name') do "dd *edi"

which i have read from a tutorial (Windows95 registry cracking by: Epic Lord on krobar) which shows the s/n and name, the breakpoint breaks softice when the software is loaded but in vain as there is so s/n which is shown in softice but after some F10 also nothing showed up.

and this software is worth using
pl help me(newbie) in serial sniffing and also patching it
thanks in advance
naides
04-21-2003, 03:20 PM
Originally posted by thematrix
i am a newbie here
i tried my 1st victim a software named PCmedik, after checking the serial protection by softice i come to know that the final check of serial check is done at this address:-
0047a570 0F857000000 jne 0047A61D

You killed the messanger but did not reversed the app. by inverting this jump you only changed a message box

which i have changed to je 0047A61D
i even tried to see the serial by this "d eax,ebxecx,edi,esi" which result in vain

The Serial may not even get placed in the CPU registers. d eax d ebx etc may only work if you are lucky and perform it at the right place, at the right time

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0047A499(C)
|
:0047A508 E8DBD0FDFF call 004575E8
:0047A50D 837DFC00 cmp dword ptr [ebp-04], 00000000
:0047A511 0F843C010000 je 0047A653
:0047A517 8D55F8 lea edx, dword ptr [ebp-08]
:0047A51A 8B8324030000 mov eax, dword ptr [ebx+00000324]
:0047A520 E8C3D0FDFF call 004575E8
:0047A525 837DF800 cmp dword ptr [ebp-08], 00000000
:0047A529 0F8424010000 je 0047A653
:0047A52F 8D55F0 lea edx, dword ptr [ebp-10]
:0047A532 8B8324030000 mov eax, dword ptr [ebx+00000324]
:0047A538 E8ABD0FDFF call 004575E8
:0047A53D 8B45F0 mov eax, dword ptr [ebp-10]
:0047A540 8D55F4 lea edx, dword ptr [ebp-0C]
:0047A543 E8A0DBF8FF call 004080E8
:0047A548 8B45F4 mov eax, dword ptr [ebp-0C]
:0047A54B 50 push eax
:0047A54C 8D55E8 lea edx, dword ptr [ebp-18]
:0047A54F 8B832C030000 mov eax, dword ptr [ebx+0000032C]
:0047A555 E88ED0FDFF call 004575E8
:0047A55A 8B45E8 mov eax, dword ptr [ebp-18]
:0047A55D 8D55EC lea edx, dword ptr [ebp-14]
:0047A560 E883DBF8FF call 004080E8
:0047A565 8B45EC mov eax, dword ptr [ebp-14]
:0047A568 5A pop edx
:0047A569 E8B63D0000

call 0047E324 I would trace into this call, which appears to return 01 in al when you are not registered

:0047A56E 3C01 cmp al, 01
:0047A570 0F85A7000000 jne 0047A61D
:0047A576 A1E03C4800 mov eax, dword ptr [00483CE0]
:0047A57B 8B00 mov eax, dword ptr [eax]
:0047A57D 8B805C030000 mov eax, dword ptr [eax+0000035C]
:0047A583 33D2 xor edx, edx
:0047A585 E87ECFFDFF call 00457508

BUT AFTER THANKS MESSAGE ALSO the disabled function is still there
and in the about box also it still point to unregistered.whats this?
there is also a key in registry
"\Software\PGWARE\PcMedik"

* Possible StringData Ref from Code Obj ->"\Software\PGWARE\PcMedik"
|
:00481AB9 BAFC1D4800 mov edx, 00481DFC
:00481ABE 8BC3 mov eax, ebx
:00481AC0 E82F01FAFF call 00421BF4
:00481AC5 8D4DE8 lea ecx, dword ptr [ebp-18]

* Possible StringData Ref from Code Obj ->"Name"
|
:00481AC8 BA201E4800 mov edx, 00481E20
:00481ACD 8BC3 mov eax, ebx
:00481ACF E8E802FAFF call 00421DBC
:00481AD4 8B55E8 mov edx, dword ptr [ebp-18]
:00481AD7 B86C4F4800 mov eax, 00484F6C
:00481ADC E83326F8FF call 00404114
:00481AE1 8D4DE4 lea ecx, dword ptr [ebp-1C]

* Possible StringData Ref from Code Obj ->"Serial"
|
:00481AE4 BA301E4800 mov edx, 00481E30
:00481AE9 8BC3 mov eax, ebx
:00481AEB E8CC02FAFF call 00421DBC
:00481AF0 8B55E4 mov edx, dword ptr [ebp-1C]
:00481AF3 B8684F4800 mov eax, 00484F68
:00481AF8 E81726F8FF call 00404114
:00481AFD 8D45DC lea eax, dword ptr [ebp-24]
:00481B00 50 push eax
:00481B01 8B15684F4800 mov edx, dword ptr [00484F68]

AN ALSO HERE

* Possible StringData Ref from Code Obj ->"\Software\PGWARE\PCMedik"
|
:0047E387 BAECE64700 mov edx, 0047E6EC
:0047E38C 8B45EC mov eax, dword ptr [ebp-14]
:0047E38F E86038FAFF call 00421BF4
:0047E394 837DFC00 cmp dword ptr [ebp-04], 00000000
:0047E398 7428 je 0047E3C2
:0047E39A 837DF800 cmp dword ptr [ebp-08], 00000000
:0047E39E 7422 je 0047E3C2
:0047E3A0 8B4DFC mov ecx, dword ptr [ebp-04]

* Possible StringData Ref from Code Obj ->"Name"
|
:0047E3A3 BA10E74700 mov edx, 0047E710

Now do a d edx here to see what "name: means

:0047E3A8 8B45EC mov eax, dword ptr [ebp-14]
:0047E3AB E8E039FAFF call 00421D90
:0047E3B0 8B4DF8 mov ecx, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"Serial"
|
:0047E3B3 BA20E74700 mov edx, 0047E720

Now do an d edx here, to see the contents of 47e720, called serial
:0047E3B8 8B45EC mov eax, dword ptr [ebp-14]
:0047E3BB E8D039FAFF call 00421D90

Trace into this call
:0047E3C0 EB20 jmp 0047E3E2

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0047E398(C), :0047E39E(C)
|
:0047E3C2 8D4DFC lea ecx, dword ptr [ebp-04]

* Possible StringData Ref from Code Obj ->"Name"
|
:0047E3C5 BA10E74700 mov edx, 0047E710
:0047E3CA 8B45EC mov eax, dword ptr [ebp-14]
:0047E3CD E8EA39FAFF call 00421DBC
:0047E3D2 8D4DF8 lea ecx, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"Serial"
|
:0047E3D5 BA20E74700 mov edx, 0047E720
:0047E3DA 8B45EC mov eax, dword ptr [ebp-14]
:0047E3DD E8DA39FAFF call 00421DBC

where the serial and name r stored,
i put a breakpoint

bpx RegQueryValueExa If (*edi>='Name') do "dd *edi"

which i have read from a tutorial (Windows95 registry cracking by: Epic Lord on krobar) which shows the s/n and name, the breakpoint breaks softice when the software is loaded but in vain as there is so s/n which is shown in softice but after some F10 also nothing showed up.

and this software is worth using
pl help me(newbie) in serial sniffing and also patching it
thanks in advance

Do not follow the tutors to the line. try to understand what the authors trying to do and apply it to your current situation
esther
04-21-2003, 08:49 PM
Hi naides,
Don't be too hard on him ;p

thematrix:Think you should start reading Art of Assembly Language http://webster.cs.ucr.edu/Page_asm/0_ArtOfAsm.html
and then come back to the program.like naids said you have to understand the codes.Good luck
JMI
04-21-2003, 11:29 PM
thematrix:

The first and primary tool of a reverse engineer is the brain. You have to use it to THINK about what you are seeing when you attempt to run the program and then you need to THINK about what you are seeing when you look at the code. So let's take a step back and THINK about what appears to be happening and that will give you a better concept of how to attack what you find in the Code. Keep in mind that this is an approach which you should make, as I do, even without looking at the code.

First, you have a "box" of some sort that comes up on your screen with a place for you to enter information. In this case it is at least "Name" and "Serial". This much you discovered. So what you should be considering is how you find out how this "box" is put on the screen and what happens after information is input into the "box."

As a reverse engineer, you need to discover how the "box" is drawn on the screen so you can find that place in the code, so you can examine what's happening BEFORE and AFTER the box is drawn. So you need to know how to intercept this type of "box". There are certain API's which will help you do this which you should know, and maybe you already do, because you found a place in the code where "something" is checked and, if that "something" doesn't exist, a jump is made to the "box".

So what it appears you did was not THINK about what was happening before the jump to the "box" and simply eliminated the posting of the box. But, THINKING would, perhaps, have suggested to you that the program wants your name and serial number and then is going to DO SOMETHING with them (i.e., put them somewhere and use them for something.) In this case, it appears that what it is going to do is create Registry Keys with the name and the Serial Number (either crypted or not).

Now, if you THINK about it, would it not make sense that the program would check to see if it is ALREADY registered BEFORE it puts up the "box"? If it didn't, it would ALWAYS put up the "box" even if the registration "name" and "serial" keys already existed. A waste of time for the user. So, assuming this is true, it would need to check these Keys BEFORE calling the "box" and IF it finds what it believes are correct entries, it skips calling the "box'.

So finding the "box" is good, because it gives you clues to what happened BEFORE it was called. REMOVING the call to the "box" does NOTHING to convince the program that it has ALREADY been registered. WHAT will convince the program that it is already registered? Somewhere it has to find WHATEVER it is that it checks and see if what it finds passes WHATEVER test has been included in the program. Does it check what you entered against a "hard coded" entry? Not to common, but possible. Does it contain some "Hash" of your serial which, when run through some code, comes out the other end with the "expected" result so that when a "compare" against the "expected result" is met, the jump to the "is registered code" takes place? More likely.

So what is a would-be reverse engineer to do when the program is unwilling to be a "victim" to those who have not taken the time to THINK? Take that time and try to THINK like a Reverse engineer. The "serial" is entered for a reason. What does the program DO with what you entered? (You did enter something, didn't you??) Do you know how to intercept your entry of the serial in the debugger? A necessary first step.

OK. If we assume you know how to catch the imput of "your" serial" and you have found where the code starts to analyze whether you have entered the correct serial or not, you will have to recognize what it is doing and, if you're luck, you will come to that mystical place where the code decides whether you are a "bad boy" or a "good cracker" and skips the "box" ON ITS OWN. Things get tougher, however, if you have to have a "correct" serial for the program to decrypt some other part of the code, but that's "another story."

So take that step back and think about HOW THINGS WORK. If you don't understand that concept, read some more, and this time, THINK about how the issue was approached, not just what code was printed in the tutorial. Code most ofter changes, fewer "general principles" change. If your own study doesn't make it clear to you, then ask questions here.

Regards.
LOUZEW
04-22-2003, 01:00 PM
Hi, thematrix

above your jne, you have this call 0047E324.

With a disassembler, eg: Wdasm or IDA, go to the line 0047E324, i think this function is called more than one time ( at program start ).

If this function check the serial validation, simply try this :

0047E324 B801 00 00 00 mov eax,1
0047E329 C3 ret

NOTE : Check the stack, maybe you have to realign !
Manko
04-22-2003, 05:36 PM
Hi!

Since he tried to reverse the jump... and it didn't do any good.
That will not work either.
The reason is probably that some flag gets set in that routine if serial passes, and the result of that call is only for which message to show. :)

So again, check out that call! ;)

/Manko
thematrix
04-24-2003, 08:50 AM
thanks u all guys i will try again
bl00dk@
04-27-2003, 08:54 AM
You should also create the "Name & Serial" stringvalues in the registry and put in some fake info, cause somtimes it's enough if the app finds a fake serial/name and then is forced to accept it, but far from often.

JohnWho.
thematrix
04-28-2003, 11:29 AM
thanks all
LOUZEW i have done according to u but the proggie gets registered but it restart the pc without informaing means we have done something wrong there


Windoze XP updates and Sice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Windoze XP updates and Sice
PDA

View Full Version : Windoze XP updates and Sice

naides
04-21-2003, 08:00 PM
I just wanted to place a comment here, in case other ppl run into the same problem.

WinXP automatically downloads and installs 'fixes'.
The last one was called Windows hotfix (SP1) Q810893

when it installed itself the computer started having problems loading Sice, because windows placed internal int 3 instructions in the NTskol module.
Disabling Sice allows windows to boot, and uninstalling the hotfix fixes the problem. I am unsure if this incompatibility is an oddity of my system, or if it is more pervasive among WinXP and Sice users
LOUZEW
04-22-2003, 01:05 PM
Hi, naides
give me your email addy, i'll send you a patch and a little help file to configure correctly SI under XP SP1.

Yes there is some things to know for Softice driver suite 2.7 with XP SP1 !
Tacman
04-22-2003, 01:30 PM
hey please check your pm
dELTA
04-22-2003, 02:05 PM
LOUZEW, if you have a nice summary/description of patches to fix problems and make Softice run better under Windows XP, you are very welcome to share it with everyone else here in the forum too, just so you know. :)

dELTA
LOUZEW
04-23-2003, 04:49 PM
OK guys, you'll find in attachment a patch and a little tutorial to be able to break at entry point under XP SP1 when using DS 2.7 !
dELTA
04-23-2003, 06:45 PM
Thanks for sharing LOUZEW, I'm quite sure a lot of people will have much use for this!

dELTA


How to get IDA sig files quickly for lots of Delphi units
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to get IDA sig files quickly for lots of Delphi units
PDA

View Full Version : How to get IDA sig files quickly for lots of Delphi units

Solomon
04-21-2003, 10:09 PM
Hi,

Currently I want to make some IDA sig files for some crypto libs. These libs are written in Delphi, with source code. I have to compile the project and get lots of obj files, then make sig for each obj manually and apply each sig in IDA. It's a tedious task.

Is there a quick way to get all the sig in one file? thx

BTW: Is there a way to make sig from Delphi DCU files(no source code/no obj/no lib)?
Solomon
04-21-2003, 10:19 PM
Ooops, I think I found the answer to the 1st question: just use tlib.exe to merge all the obj files into one lib file.

But how about the 2nd question? What can I do if I have no source for DCU? for example, SLockPK.
banshee
04-22-2003, 07:30 AM
I think this may help:

Delphi Resource Inspector v.5.21 C 2277 Kb 21 Oct 2001
By Ashley Godfrey. The Delphi Resource Inspector is an advanced Delphi expert, or plug-in designed to accelerate development times through resource management.
The Delphi Resource Inspector embeds itself within the Delphi IDE provides features such as:
The type library viewer, allowing registered type libraries to be browsed in native Object Pascal
Web browsing and Internet and newsgroup metasearching
Borland Community interface
DCU Decompiler for Delphi 2-5 DCU's
File and project history tracking
Component source tracking
Component type and hierarchy information
Delphi IDE component tree, type and hierarchy information for Opentools API developers
Win32-SDK style interface of Delphi's on-line help for instant indexing and query capabilities
Code editor integration
Evaluation (time-limit)
Source: None
Price: $25

Link for download: h**p://www.torry.net/vcl/experts/ide/dvide_d5.zip
May be there is something for Delphi 6-7, I just found it in google ;)
Solomon
04-22-2003, 08:36 AM
thx for the info.

It's not easy to manually identify the crypto routines if they(DCUs) are statically linked into exe.
banshee
04-25-2003, 03:37 PM
One more thing:

IDA Loader for Delphi/Builder 32-bit units (.DCU) by RedPlait with source

it v3.85b plugin (pretty old), but if you really need such thing you could recompile it.


Super Pro Lesson Learnt!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Super Pro Lesson Learnt!
PDA

View Full Version : Super Pro Lesson Learnt!

sope
04-22-2003, 02:56 AM
I learnt a lesson & would like to share with all of you.

Some months back i did got stuck badly on a Sentinel Super Pro Enveloped Target. (http://www.woodmann.net/forum/showthread.php?threadid=4256). I learnt the hard-way of brute forceing the 12 MB Monster File. To find the Good Response took me 9 days on my single machine.
Yesterday, i was browsing the same post on the forum & my head struck an idea in mind after reading CyberHeg & CrackZ post. I have riped it below
CyberHeg: Your task is now to start guessing the first 4 bytes of plaintext and code a program to verify your guess.
CrackZ: Addendum - You did get it in the end by brute force, response is 0xD53B03F3, general point here really was that you got just 1 .exe so guessing any sort of plaintext was never going to be easy
What, struck my head was let me d/l the Demo copy of that soft & i did it. Now i had 2 files 1 which is encrypted & 1 demo.

From the first section (demo copy) which is not enveloped, i noted the 4 bytes it was 0xCCCCCCCC & then i riped 4 bytes from the enveloped target
it was 0x78C363B0 made some minor changes in the Brut Force program to check for noted 4 bytes (i.e. 0xCCCCCCCC) after getting pass the riped
algorithm.

What i got is the same good response in less then 3 minutes this time. For which i had to spent 9 days earlier.

Lesson learnt!
Suppose You have a Target size 12 to 15 MB (Sentinel Pro Enveloped) & You are trying to brut force for Good Response. i'll advise you to
get a demo copy if available & note down the first four bytes of the demo & then brute force the 4 bytes from enveloped target for that value.
You might save some good time!

Modifying the source code from above link is kept as an exercise for newbies like me.

Regards
Sope!
nikolatesla20
04-22-2003, 06:36 AM
Cool!

Good job, thanks for sharing :)

-nt20
cyberheg
04-22-2003, 12:55 PM
Well done!

As you see the time spent on research can pay off.
I like the fact that you were able to think for yourself and not just believe/rely on facts written in some stupid post/tutorial.

Also I am sure you learned alot more by having your hands down in the dirty stuff then just following others results.

// CyberHeg
sope
04-23-2003, 01:08 AM
Hello nikolatesla20 / CyberHeg

Thanks for your nice words :)

CyberHeg:
You are correct, one surely learns a lot more by having hands down in the dirty stuff. Nicely drafted :)

Regards
Sope!


reordering of forums?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > reordering of forums?
PDA

View Full Version : reordering of forums?

disavowed
04-22-2003, 08:35 AM
woodmann, why were the forums re-ordered?
Woodmann
04-22-2003, 12:27 PM
Howdy,

We are in the process of changeing somethings.

Some forums will change direction, others will re-focus
on the original intent. Some new forums may be started.

It is an effort to re-new interests in different areas
of RCE :)

Woodmann
LOUZEW
04-22-2003, 01:09 PM
Hi, Woodman
i've noticed some trouble with the forum, icons appearing anywhere and more things like this.
Eg : The Vbulletin logo appearing sometimes in the posts, some smiley appearing at top of screen .....
JMI
04-22-2003, 01:45 PM
LOUZEW:

We are in the process of fixing some problems with our back-ups and when that is completed, these issues will hopefully be resolved.

Regards.
banshee
04-23-2003, 02:35 PM
Guys what's going on? I wanted to find some thread about asprotect entered *spr* and search gives only FOUR recent threads. :confused:
I've got almost crazy. May be it's time to give up with RCE...
JMI
04-23-2003, 03:26 PM
There are some issues with our back-ups and we are working on them. Until these are fixed, we have not updated the counters and that is screwing up the search function. Have a bit more patience and we believe we will have everything back in working order soon.

Regards.


Another nice hacking/cracking challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Another nice hacking/cracking challenge
PDA

View Full Version : Another nice hacking/cracking challenge

dELTA
04-22-2003, 03:21 PM
Yet another nice hacking/cracking challenge:

http://www.mod-x.co.uk/main.php

You will also find a few familiar names in the ranking list. :)

dELTA
nikolatesla20
04-22-2003, 06:55 PM
cool..

I'm at level2 now..

:)

had to pull out commview to help me a bit..oh well.

-nt20
disavowed
04-23-2003, 07:23 AM
the archives from disavowed.net are hosted on that site, but you have to get past level 8 to access them ;)
dELTA
04-23-2003, 06:37 PM
Cool. :)
nikolatesla20
04-24-2003, 04:54 PM
Level 6,... finally.

That FTP hacking stuff was quite complex..

-nt20


haspms32.dll && Target, need help pleaz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > haspms32.dll && Target, need help pleaz
PDA

View Full Version : haspms32.dll && Target, need help pleaz

OHPen
04-22-2003, 07:20 PM
Hi,

i'm workin' on a target which is protected by HASP-Dongle.
It uses haspms32.dll.

After short analyzing in IDA i got some information:

.text:0056B4EC hasp proc near ; CODE XREF: sub_446D10+76p
.text:0056B4EC ; sub_446DD0+82p ...
.text:0056B4EC jmp ds:__imp_hasp
.text:0056B4EC hasp endp

hasp()-funktion is only called two times by X-Refs.

sub_446D10+76p

.text:00446D86 call hasp
.text:00446D8B mov eax, [ebp+var_8]
.text:00446D8E add eax, [ebp+var_C]
.text:00446D91 cmp eax, [ebx+6Ch]
.text:00446D94 jz short loc_446D9A
.text:00446D96 xor eax, eax
.text:00446D98 jmp short Bad_Boy
.text:00446D9A ; ---------------------------------------------------------------------------
.text:00446D9A
.text:00446D9A loc_446D9A: ; CODE XREF: sub_446D10+84j
.text:00446D9A mov edx, dword_5C7B7C[esi*4]
.text:00446DA1 mov eax, [edx+8]
.text:00446DA4 sub eax, [ebp+var_4]
.text:00446DA7 cmp edi, [ebx+68h]
.text:00446DAA jnz short loc_446DB0
.text:00446DAC xor eax, eax
.text:00446DAE jmp short Bad_Boy
.text:00446DB0 ; ---------------------------------------------------------------------------
.text:00446DB0
.text:00446DB0 loc_446DB0: ; CODE XREF: sub_446D10+9Aj
.text:00446DB0 lea edx, [eax+edi]
.text:00446DB3 cmp edx, [ebx+68h]
.text:00446DB6 jle short loc_446DBC
.text:00446DB8 xor eax, eax
.text:00446DBA jmp short Bad_Boy
.text:00446DBC ; ---------------------------------------------------------------------------
.text:00446DBC
.text:00446DBC loc_446DBC: ; CODE XREF: sub_446D10+A6j
.text:00446DBC add edi, eax
.text:00446DBE cmp edi, [ebx+68h]
.text:00446DC1 jz short loc_446DC7
.text:00446DC3 xor eax, eax
.text:00446DC5 jmp short Bad_Boy
.text:00446DC7 ; ---------------------------------------------------------------------------
.text:00446DC7
.text:00446DC7 loc_446DC7: ; CODE XREF: sub_446D10+B1j
.text:00446DC7 mov al, 1
.text:00446DC9
.text:00446DC9 Bad_Boy: ; CODE XREF: sub_446D10+88j
.text:00446DC9 ; sub_446D10+9Ej ...
.text:00446DC9 pop edi
.text:00446DCA pop esi
.text:00446DCB pop ebx
.text:00446DCC mov esp, ebp
.text:00446DCE pop ebp
.text:00446DCF retn
.text:00446DCF sub_446D10 endp

sub_446DD0+82p

.text:00446E52 call hasp
.text:00446E57 mov eax, [ebx]
.text:00446E59 add eax, 70h
.text:00446E5C push eax
.text:00446E5D mov edx, [ebx]
.text:00446E5F add edx, 6Ch
.text:00446E62 push edx
.text:00446E63 mov ecx, [ebx]
.text:00446E65 add ecx, 68h
.text:00446E68 push ecx
.text:00446E69 mov eax, [ebx]
.text:00446E6B add eax, 64h
.text:00446E6E push eax
.text:00446E6F mov edx, [ebx]
.text:00446E71 push dword ptr [edx+58h]
.text:00446E74 mov ecx, [ebx]
.text:00446E76 push dword ptr [ecx+54h]
.text:00446E79 mov eax, [ebx]
.text:00446E7B push dword ptr [eax+8Ch]
.text:00446E81 mov edx, [ebx]
.text:00446E83 push dword ptr [edx+60h]
.text:00446E86 push 5
.text:00446E88 call hasp
.text:00446E8D mov ecx, [ebx]
.text:00446E8F mov word ptr [ecx+0Eh], 0
.text:00446E95 mov dword ptr [esi], offset unk_57F4CC
.text:00446E9B mov dword ptr [esi+4], offset unk_5AEA3C
.text:00446EA2 mov dword ptr [esi+8], offset unk_57F4E0
.text:00446EA9 mov dword ptr [esi+0Ch], offset unk_57F4F4
.text:00446EB0 mov dword ptr [esi+10h], offset unk_57F508
.text:00446EB7 mov dword ptr [esi+14h], offset unk_5AEA50
.text:00446EBE mov dword ptr [esi+18h], offset unk_5AEA64
.text:00446EC5 mov dword ptr [esi+1Ch], offset unk_5AEA78
.text:00446ECC mov dword ptr [esi+20h], offset unk_57F51C
.text:00446ED3 mov dword ptr [esi+24h], offset unk_57F530
.text:00446EDA mov dword ptr [esi+28h], offset unk_57F544
.text:00446EE1 mov dword ptr [esi+2Ch], offset unk_57F558
.text:00446EE8 mov eax, [ebp+var_24]
.text:00446EEB mov large fs:0, eax
.text:00446EF1 mov eax, [ebx]
.text:00446EF3 pop esi
.text:00446EF4 pop ebx
.text:00446EF5 mov esp, ebp
.text:00446EF7 pop ebp
.text:00446EF8 retn
.text:00446EF8 sub_446DD0 endp

These are the locations hasp() is called from.

Then i tried to patch it, like it is described in Defilers & CrackZ Essay but i wasn't able to reconstruct the way they beat't up on my target.

I tried to break with sice on this location:

.text:00446D94 jz short loc_446D9A

but sice doesn't. I don't know why !????

Other Question:

.text:00446D82 push dword ptr [edx]
.text:00446D84 push 2
.text:00446D86 call hasp
.text:00446D8B mov eax, [ebp+var_8]

is there hasp service 2 called, i think so, but actually i'm not sure.

Hope someone can help me to understand this target,

thx in advance,

OHPen
naides
04-23-2003, 07:45 AM
Originally posted by OHPen
Hi,

i'm workin' on a target which is protected by HASP-Dongle.
It uses haspms32.dll.

After short analyzing in IDA i got some information:

.text:0056B4EC hasp proc near ; CODE XREF: sub_446D10+76p
.text:0056B4EC ; sub_446DD0+82p ...
.text:0056B4EC jmp ds:__imp_hasp
.text:0056B4EC hasp endp

hasp()-funktion is only called two times by X-Refs.

sub_446D10+76p

.text:00446D86 call hasp
.text:00446D8B mov eax, [ebp+var_8]
.text:00446D8E add eax, [ebp+var_C]
.text:00446D91 cmp eax, [ebx+6Ch]
.text:00446D94 jz short loc_446D9A
.text:00446D96 xor eax, eax
.text:00446D98 jmp short Bad_Boy
.text:00446D9A ; ---------------------------------------------------------------------------
.text:00446D9A
.text:00446D9A loc_446D9A: ; CODE XREF: sub_446D10+84j
.text:00446D9A mov edx, dword_5C7B7C[esi*4]
.text:00446DA1 mov eax, [edx+8]
.text:00446DA4 sub eax, [ebp+var_4]
.text:00446DA7 cmp edi, [ebx+68h]
.text:00446DAA jnz short loc_446DB0
.text:00446DAC xor eax, eax
.text:00446DAE jmp short Bad_Boy
.text:00446DB0 ; ---------------------------------------------------------------------------
.text:00446DB0
.text:00446DB0 loc_446DB0: ; CODE XREF: sub_446D10+9Aj
.text:00446DB0 lea edx, [eax+edi]
.text:00446DB3 cmp edx, [ebx+68h]
.text:00446DB6 jle short loc_446DBC
.text:00446DB8 xor eax, eax
.text:00446DBA jmp short Bad_Boy
.text:00446DBC ; ---------------------------------------------------------------------------
.text:00446DBC
.text:00446DBC loc_446DBC: ; CODE XREF: sub_446D10+A6j
.text:00446DBC add edi, eax
.text:00446DBE cmp edi, [ebx+68h]
.text:00446DC1 jz short loc_446DC7
.text:00446DC3 xor eax, eax
.text:00446DC5 jmp short Bad_Boy
.text:00446DC7 ; ---------------------------------------------------------------------------
.text:00446DC7
.text:00446DC7 loc_446DC7: ; CODE XREF: sub_446D10+B1j
.text:00446DC7 mov al, 1
.text:00446DC9
.text:00446DC9 Bad_Boy: ; CODE XREF: sub_446D10+88j
.text:00446DC9 ; sub_446D10+9Ej ...
.text:00446DC9 pop edi
.text:00446DCA pop esi
.text:00446DCB pop ebx
.text:00446DCC mov esp, ebp
.text:00446DCE pop ebp
.text:00446DCF retn
.text:00446DCF sub_446D10 endp

Appears to be checking the HASP call return values, present in the STACK (EBP+C, EBP+8 , EBP+4) with some simple math manipulations against values present in a table pointed by EBP+68, EBP+C, etc. The funxtion itself does not set up flags outside its own code, and patching it to always return 01 in eax, Should suffice.

sub_446DD0+82p

You need to analyse the setup of addresses that happen before HASP function is called

.text:00446E52 call hasp
.text:00446E57 mov eax, [ebx]

does [ebx] point to a value returned form the HASP call?

.text:00446E59 add eax, 70h

It is pushing inot the stack values contained in a table pointed by ebx

.text:00446E5C push eax
.text:00446E5D mov edx, [ebx]
.text:00446E5F add edx, 6Ch
.text:00446E62 push edx
.text:00446E63 mov ecx, [ebx]
.text:00446E65 add ecx, 68h
.text:00446E68 push ecx
.text:00446E69 mov eax, [ebx]
.text:00446E6B add eax, 64h
.text:00446E6E push eax
.text:00446E6F mov edx, [ebx]
.text:00446E71 push dword ptr [edx+58h]
.text:00446E74 mov ecx, [ebx]
.text:00446E76 push dword ptr [ecx+54h]
.text:00446E79 mov eax, [ebx]
.text:00446E7B push dword ptr [eax+8Ch]
.text:00446E81 mov edx, [ebx]
.text:00446E83 push dword ptr [edx+60h]
.text:00446E86 push 5

HASP service 5

.text:00446E88 call hasp
.text:00446E8D mov ecx, [ebx]
.text:00446E8F mov word ptr [ecx+0Eh], 0

It is setting up a flag as 0

.text:00446E95 mov dword ptr [esi], offset unk_57F4CC
.text:00446E9B mov dword ptr [esi+4], offset unk_5AEA3C
.text:00446EA2 mov dword ptr [esi+8], offset unk_57F4E0
.text:00446EA9 mov dword ptr [esi+0Ch], offset unk_57F4F4
.text:00446EB0 mov dword ptr [esi+10h], offset unk_57F508
.text:00446EB7 mov dword ptr [esi+14h], offset unk_5AEA50
.text:00446EBE mov dword ptr [esi+18h], offset unk_5AEA64
.text:00446EC5 mov dword ptr [esi+1Ch], offset unk_5AEA78
.text:00446ECC mov dword ptr [esi+20h], offset unk_57F51C
.text:00446ED3 mov dword ptr [esi+24h], offset unk_57F530
.text:00446EDA mov dword ptr [esi+28h], offset unk_57F544
.text:00446EE1 mov dword ptr [esi+2Ch], offset unk_57F558

You need to know where the return values of the HASP call get stored. I suspect they are at the offsets 57f30 etc and get moved to a table pointed by esi (+0c, +12, etc) and get validated later in the code. Now you need to find out how and where

.text:00446EE8 mov eax, [ebp+var_24]
.text:00446EEB mov large fs:0, eax
.text:00446EF1 mov eax, [ebx]
.text:00446EF3 pop esi
.text:00446EF4 pop ebx
.text:00446EF5 mov esp, ebp
.text:00446EF7 pop ebp
.text:00446EF8 retn
.text:00446EF8 sub_446DD0 endp

These are the locations hasp() is called from.

Then i tried to patch it, like it is described in Defilers & CrackZ Essay but i wasn't able to reconstruct the way they beat't up on my target.

I tried to break with sice on this location:

.text:00446D94 jz short loc_446D9A

Maybe you already failed a check and this code is never run through the CPU, so the BPX does not break

but sice doesn't. I don't know why !????

Other Question:

.text:00446D82 push dword ptr [edx]
.text:00446D84 push 2
.text:00446D86 call hasp
.text:00446D8B mov eax, [ebp+var_8]

is there hasp service 2 called, i think so, but actually i'm not sure.

YES service call 2

Hope someone can help me to understand this target,

thx in advance,

OHPen
OHPen
04-23-2003, 11:28 AM
First naides, thx for your help ;)

But i still have questions unfortunally, you know i'm newbie and that's the point ;(

Okay let's start:

NAIDES :> Appears to be checking the HASP call return values, present in the STACK (EBP+C, EBP+8 , EBP+4) with some simple math manipulations against values present in a table pointed by EBP+68, EBP+C, etc.

Where in the code is that indicated ? I can't find any (EBP+C, EBP+8 , EBP+4) in this part of the code !? Am i blind !? I hope not...

NAIDES :> You need to analyse the setup of addresses that happen before HASP function is called

.text:00446DE5 call @__InitExceptBlockLDTC
.text:00446DEA mov [ebp+var_14], 8
.text:00446DF0 mov edx, [ebx]
.text:00446DF2 mov dword ptr [edx+54h], 2611h
.text:00446DF9 mov ecx, [ebx]
.text:00446DFB mov dword ptr [ecx+58h], 4B21h
.text:00446E02 mov eax, [ebx]
.text:00446E04 mov dword ptr [eax+60h], 64h
.text:00446E0B mov edx, [ebx]
.text:00446E0D mov dword ptr [edx+5Ch], 1
.text:00446E14 mov ecx, [ebx]
.text:00446E16 xor eax, eax
.text:00446E18 mov [ecx+8Ch], eax
.text:00446E1E mov edx, [ebx]
.text:00446E20 add edx, 70h
.text:00446E23 push edx
.text:00446E24 mov ecx, [ebx]
.text:00446E26 add ecx, 6Ch
.text:00446E29 push ecx
.text:00446E2A mov eax, [ebx]
.text:00446E2C add eax, 68h
.text:00446E2F push eax
.text:00446E30 mov edx, [ebx]
.text:00446E32 add edx, 88h
.text:00446E38 push edx
.text:00446E39 mov ecx, [ebx]
.text:00446E3B push dword ptr [ecx+58h]
.text:00446E3E mov eax, [ebx]
.text:00446E40 push dword ptr [eax+54h]
.text:00446E43 mov edx, [ebx]
.text:00446E45 push dword ptr [edx+8Ch]
.text:00446E4B mov ecx, [ebx]
.text:00446E4D push dword ptr [ecx+60h]
.text:00446E50 push 1
.text:00446E52 call hasp > hasp() called
.text:00446E57 mov eax, [ebx]
.text:00446E59 add eax, 70h
.text:00446E5C push eax
.text:00446E5D mov edx, [ebx]
.text:00446E5F add edx, 6Ch
.text:00446E62 push edx
.text:00446E63 mov ecx, [ebx]
.text:00446E65 add ecx, 68h
.text:00446E68 push ecx
.text:00446E69 mov eax, [ebx]
.text:00446E6B add eax, 64h
.text:00446E6E push eax
.text:00446E6F mov edx, [ebx]
.text:00446E71 push dword ptr [edx+58h]
.text:00446E74 mov ecx, [ebx]
.text:00446E76 push dword ptr [ecx+54h]
.text:00446E79 mov eax, [ebx]
.text:00446E7B push dword ptr [eax+8Ch]
.text:00446E81 mov edx, [ebx]
.text:00446E83 push dword ptr [edx+60h]
.text:00446E86 push 5
.text:00446E88 call hasp > hasp() called
.text:00446E8D mov ecx, [ebx]

So that's the code before the hasp()-routine is called but i don't come along with the code. I only see hasp service 1 and 5 is called, but what about the params before ? What do they excatly do ?

NAIDES :> does [ebx] point to a value returned form the HASP call?

I don't think so, maybe it points so some kind of a table !? I'm not sure atm.

look at this:

.text:00446E39 mov ecx, [ebx]
.text:00446E3B push dword ptr [ecx+58h]
.text:00446E3E mov eax, [ebx]
.text:00446E40 push dword ptr [eax+54h]
.text:00446E43 mov edx, [ebx]
.text:00446E45 push dword ptr [edx+8Ch]
.text:00446E4B mov ecx, [ebx]
.text:00446E4D push dword ptr [ecx+60h]

these value are pushed before Service 1 and Service 5. I know Service 1 is run for checking whether dongle is connected or not, but what about Service 5 ?

NAIDES :> It is setting up a flag as 0

But what is this flag for ? Dongle returned false values ?

NAIDES :> You need to know where the return values of the HASP call get stored. I suspect they are at the offsets 57f30 etc and get moved to a table pointed by esi (+0c, +12, etc) and get validated later in the code. Now you need to find out how and where

Where have you found the offset 57f30 in here ?

.text:00446E95 mov dword ptr [esi], offset unk_57F4CC
.text:00446E9B mov dword ptr [esi+4], offset unk_5AEA3C
.text:00446EA2 mov dword ptr [esi+8], offset unk_57F4E0
.text:00446EA9 mov dword ptr [esi+0Ch], offset unk_57F4F4
.text:00446EB0 mov dword ptr [esi+10h], offset unk_57F508
.text:00446EB7 mov dword ptr [esi+14h], offset unk_5AEA50
.text:00446EBE mov dword ptr [esi+18h], offset unk_5AEA64
.text:00446EC5 mov dword ptr [esi+1Ch], offset unk_5AEA78
.text:00446ECC mov dword ptr [esi+20h], offset unk_57F51C
.text:00446ED3 mov dword ptr [esi+24h], offset unk_57F530
.text:00446EDA mov dword ptr [esi+28h], offset unk_57F544
.text:00446EE1 mov dword ptr [esi+2Ch], offset unk_57F558

??? I can't see it here. The values you suspect to be at this offset , are these the correct return values ? or my fake values ?

NAIDES :> Maybe you already failed a check and this code is never run through the CPU, so the BPX does not break

I'm sure you are right. Maybe i have forgotten something before, i will check this.

Yeah man, i know, lot's of questions, but the day i have learned it i will never ask again, i promise ;)

THX

OHPen
Hopcode
04-23-2003, 12:56 PM
Hey:)

Where in the code is that indicated ? I can't find any (EBP+C, EBP+8 , EBP+4) in this part of the code !? Am i blind !? I hope not...

you are not blind, but i guess he meant :

.text:00446D8B mov eax, [ebp+var_8] ; EBP+8

.text:00446D8E add eax, [ebp+var_C] ; EBP+C

.text:00446DA4 sub eax, [ebp+var_4] ; EBP+4

Those var_ If you look in your function start, you will find
what those values are equal too..
It that case at least, its pretty clear.

these value are pushed before Service 1 and Service 5. I know Service 1 is run for checking whether dongle is connected or not, but what about Service 5 ?

I suggest your to grab the files that describes each services..
did you look at CrackZ's site ?

Hasp service 5 is : HaspStatus.

his parameters are, the service number, the port number, the password 1 and password 2.. search for more infos.

Where have you found the offset 57f30 in here ?

I suspect he did a typo..

text:00446ED3 mov dword ptr [esi+24h], offset unk_57F530

57F30 and 57F530 are looking a lot equals..
Think a bit please..

I let the other replies to naides.
I didn't play with hasp for some times now.

HopCode
CrackZ
04-23-2003, 05:15 PM
Hiya,

As a suggestion I would advise tracing below the hasp() export you have and finding the haspreg() code, this might give you a better idea of i). where your return codes are on the stack and ii). all of the HASP service parameters.

Regards

CrackZ.
OHPen
04-23-2003, 05:23 PM
THX CrackZ,

but is the function you are talking about always called haspreg() ?

'Cause i haven't found any other imports used by this app.

greets,

OHPen


Asprotect Debugger v0.99b
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Asprotect Debugger v0.99b
PDA

View Full Version : Asprotect Debugger v0.99b

Manko
04-23-2003, 05:00 AM
Hi!

Back when everybody started making debuggers of all kinds, pretty recently, I decided it was time to start programming on the PC, and asm was the natural choice, since I have my nose down in it as soon as I have time... :)

I decided to rellease my small proggy with commented source, so some of you will have a chance to learn, or improve the proggy...
Actually You can do whatever you wich with it. :)
It's not so nicely coded, since this is my first app, and commenting source was a pain, though I'm glad someone persuaded me to do it... Besides, how could I rellease source otherwise?
I hope this will be interesting to both RCE and Alexey, since I think it's time for him to know some of the tricks we use... Though these are far from all, I still look forward to getting some new code in aspr to play with. ;)
I suspect though, we'll only see changes to signatures, - if anything - :rolleyes:, not true inovations...

When you have tested my app, you will realise it'll work perfectly with sice and other apps. Actually I hope you will do it that way, since I don't handle dips or stolen bytes, in any way... It was never my intention to do everything, since I like to have my hands in the code. (Though this could easily be converted into a simple unpacker...)
(Besides, dips can never be handled ok, in an unpacker, since it is custom code by author, though most are lazy and use alexeys old example code, or whatever... I'm guessing his new advice is far better, but not used by stupid authors...)
(ANyway it's the encryption of crucial code, that is what they should use... but don't...)

I suggest to anyone interested in building any debugging apps to visit [Yates] and Iczelion's pages as they have some pretty good stuff on these and other things...

Snipped from the presentation in my source...; It's just a small proggy to mainly show some important info for un-
; packing asprotect_ed apps. It will ofcourse do some other minor tasks...
;
; Features:
;
; 1. Put EAX=12121212h in place after GetSystemTime to stop pre-OEP-
; code from moving with every execution... Also same for IAT. (Rare)
;
; 2. It will show IATstart, end, length and ask to clean out some
; redirection, resolve emulated APIs and remove trashbytes, sometimes
; put between real IATentries.
; It will not yet resolve DialogBoxParamA + that visual-basic API...
;
; 3. It will show Dip-Table, pause and let you erase entries if wanted,
; making aspr-code skip those dips... Remember (!), some entries
; in the Dip-table are just "dip-data", not actual dips...
;
; 4. It will singlestep to oep and record occurance of some signatures
; such as stolenbyteserase, oepjumpsetup and stolenbytes(sometimes).
; It will ofcourse pause at all these and at OEP, where it also will
; show last address executed before reaching OEP.
;
; 5. Show any access violation exceptions caused by the debuggee after
; OEP... My thinking is, we might catch some tricks testing if API's
; are writeable.
;
; 6. Now if debugged prog is not aspred but dynamically loads dll that is,
; my proggy manage this as well.

edit:
!!! Look for updated version further down! !!!
(This was downloaded 162 time(s).)

edit:
Just go to this stupid page, to download...

http://www.kommunicera.umea.se/hemma/mawiklund/

/Manko
Hopcode
04-23-2003, 11:16 AM
Hello!

Congratulations for your sweet tool.
Im pretty sure a lot of ppl will learn from its source.
Me included for sure.

I gave it a try, and it works pretty fine.
i might modify it a little like inserting int 3 at the place of the
OEP (to allow /PEDUMP to dump directly from entry point), i might also modify a bit the bytes you display for the stolen bytes. on my target, it misses like 4 or 6 bytes and we have the complete "listing" needed to insert them.
might also insert an int 3 around that place, so i can make a screen dump etc..

Thanks again for sharing your work.

HopCode
banshee
04-23-2003, 01:54 PM
Great tool!
Thanks for sharing!
Tested it a little, all works fine except the OEP. On my target it reports 005474e0 instead of 00546ea0 which I think is true (I found it manually). Anyway great tool to make life easier ;)
Manko
04-23-2003, 02:11 PM
Hi!

Hopcode:
Yeah, that's the idea! Change this to you're liking and you'll probably learn something from that too... :)

You're welcome! :)

banshee:
I'd sure like to know what target my OEP-seeker-routine, bummed out on. Could you tell me? Though I don't quite believe you... :p Sure it wasn't one of the dips or something?
(Though I know I altered one thing that could make it fail, and I haven't tested with older versions...)

Thanks for the kind words! :)

/Manko
Zilot
04-24-2003, 03:33 AM
http://www.skola-crepaja.edu.yu/Laza/wile3.gif

No more comments
banshee
04-24-2003, 09:06 AM
Manko:

h**p://www.mailnavigator.com/MNavi15.exe

I'm not 100% sure cos I'm only newbie :) Anyway will be thankful if you would check it.;)
Manko
04-24-2003, 02:18 PM
Hi, banshee!

I just noticed a misstake... the value shown as dip-table-adress never get's filled so it displays a 0. (Though the diptable is displayed correctly. Easily fixed... but it's pretty unnecessary...)

I'm dead sure about the OEP my proggy display. If you could PM me how you got your OEP, It'd be great! :)

Nice target you got there! Especially this:IATentry 569430 = EB1450 was not resolved...I'v never seen that emulation before... gonna check it out when I have time. :)

/Manko
Iwarez
04-24-2003, 04:17 PM
The OEP the program reports is right. Except offcourse that the OEP should be corrected with the stolen bytes.
Manko
04-24-2003, 05:52 PM
Hi!

sigh!

I looked at the wrong adress... Much more interesting code on wróng adress...

This was only yet another sig for prestoredresultsemulatedAPI, will include it, if I make a new version... Well atleast in my own...

Originally posted by Manko
IATentry 569430 = EB1450 was not resolved...

Nighti night!

/Manko
sv
04-25-2003, 04:34 AM
Hi Manko

Nice works !

...
GetCPInfo KERNEL32.DLL 56942c d9abd4
FreeResource KERNEL32.DLL 569430 bff92f43
FreeLibrary KERNEL32.DLL 569434 d9abec
...

Your FreeResource pattern
'cmp ebx, 05dec8b55h ; sig: 558bec5dc20400 is FreeResource'

This one is 558bec8b humm! Perhaps another one !

Regards

SV
Manko
04-25-2003, 07:36 AM
Hi, sv!

Thanks! Could you pm target to me?

I'm aware my proggy don't handle all emul API variants yet.
But most things are easy to fix... You could even do it yourself.

Don't feel like updating proggy, unless I add something good, or I have to correct many errors...

Two thoughts of mine are:
1. Auto skip erase of stolen bytes. (easy)
2. Make it put stolen bytes to real OEP and report it. (Little more work, and might be fragile... Haven't looked...)

Have only received few suggestions.... (One realy good, but sorta wasted on a lazy noob like me... But I will look at it...)

Anyone have more ideas, thoughts or questions on proggy or source?

/Manko
Hopcode
04-25-2003, 11:04 AM
>This one is 558bec8b humm! Perhaps another one !

Yes, i also noticed that.
It is indeed FreeResource.

Woops, i forgot one API slot!
No wonder it was failing :)

File is unpacked and runs fine :-)
I prefer to do it by hand to be sure im still able to do it ;)
But Your tool is very handy Manko and the best is the source :)
I will modify it a bit later so it suits me even better ;)

Regards,

HopCode
banshee
04-25-2003, 03:28 PM
Manko:
I'm sorry. Now I think I said the wrong oep. Does the start code looks like this?

.text:005474C8 public start
.text:005474C8 start proc near
.text:005474C8
.text:005474C8 var_18 = dword ptr -18h
.text:005474C8 var_14 = dword ptr -14h
.text:005474C8 var_10 = dword ptr -10h
.text:005474C8
.text:005474C8 push ebp
.text:005474C9 mov ebp, esp
.text:005474CB add esp, 0FFFFFFE8h
.text:005474CE push ebx
.text:005474CF push esi
.text:005474D0 xor eax, eax
.text:005474D2 mov [ebp+var_18], eax
.text:005474D5 mov [ebp+var_10], eax
.text:005474D8 mov [ebp+var_14], eax
.text:005474DB mov eax, offset dword_547008
.text:005474E0 call sub_4075DC
.text:005474E5 mov esi, dword_55028C
.text:005474EB xor eax, eax
.text:005474ED push ebp
.text:005474EE push offset loc_547683
.text:005474F3 push dword ptr fs:[eax]
.text:005474F6 mov fs:[eax], esp
.text:005474F9 call sub_402AA4
.text:005474FE test eax, eax
.text:00547500 jle loc_547594
.text:00547506 mov eax, dword_55025C
.text:0054750B mov eax, [eax]
.text:0054750D call sub_40A078
.text:00547512 mov ecx, eax
.text:00547514 mov edx, dword_55025C
.text:0054751A mov edx, [edx]
.text:0054751C mov eax, offset dword_5680A0
.text:00547521 call sub_404070
.text:00547526 jmp short loc_54752F
Manko
04-25-2003, 07:50 PM
Hi!

Minor update of my proggy...

1. 2 new sigs for IAT resolv.
2. It skips erase of stolen bytes.
3. It display ebx on OEP, since this often contain number of stolen bytes...

BUGFIX: NOW it CAN skip dips... :D (Stupid me. I never let it know which address the table was at... That is, the part that does the erase, to skip dips...)

banshee:

That is completely correct! :)

sv, hopcode:

Yup it was freeresource...
(Stupid me. Was too lazy to really look at it...)
What he did was put in code to return getcommandline-result, just to screw with resolving... :)

edit:
!!! Look for updated version further down! !!!
(Was donwloaded about 50(?) times...)

/Manko
Manko
04-26-2003, 05:50 PM
Hi!

Now proggy show info on stolen bytes and real OEP when reach temp OEP, and ask to copy stolen bytes to real OEP.
(It only work with newer versions for now. Would be easy to do older, but I don't have em...)

Older donwloads in this thread was erased, so's not to cause unnecessary downloads and/or confusion... :p

Look far later in thread to find new version of tool! :)

/Manko

Attachment: asprdbgr.zip
This has been downloaded 401 time(s).
S3ri@l CoDe9x
05-03-2003, 06:09 AM
Great Update! :D

Works Good!!! :p

Best Regards! :rolleyes:
Paul333
05-05-2003, 08:12 PM
Hello Manko

WOW!!..Some great reviews here .

Well done and thanks Manko :)

..errm how does it work? :)

Hope noone thinks im daft but nothing happens when i run it?..it loads a file then just sits there ,when i close the file im running asprdebugger asks "HUH? Finished".I dont know how to use this .do i have to use switches i dont see any in your infos?..Do i have to run it within softice or something?..Please help

Thanks

paul333
Manko
05-06-2003, 12:21 PM
Hi, Paul333!

I am guessing you compiled this yourself, and forgot to compile it with "console"-switch?
(Because that is the only earlier reported case where proggy just sit without doing anything.)

If not. What target are you trying?? (You can PM.)

/Manko
Paul333
05-08-2003, 06:20 PM
It happens with any target....I did not compile it ,i know the source is there and its possible but i didnt have to ,im using the exe thats already there

AsprDbgr.exe "AsprDbgr v0.99beta (:P) Made by me... Manko."

Lol dont tell me.thats not the main program then is it?? :)

paul333
Manko
05-09-2003, 11:35 AM
Hi!

Since it is working for most anyone else (?), I think it would be best to continue this by PMing... :)

Only thought I have on this is that maybe you are using it on an unsupported OP... Maybe some other prob? I didn't bother to have this proggy do much fail-checking...

btw, If you really want it to work, you could debug it... :p
...and have more meaningful info, on which to arrive at a sollution/explanation to this problem...

...or you could compile it and see what happens... :p

/Manko
Paul333
05-09-2003, 07:24 PM
Hi Manko

I can debug it if i know some facts :)

Is AsprDbgr.exe .the main exe?

If so ...when i double click it it asks for a file to open then does nothing...WHY?.....Do i need to do more than simply double click it and open a file packed with asprotect...ie..do i have to use switches?......if so theres no switches in any of the info;s you supplied

Only files in your zip are

AsprDbgr.txt
AsprDbgr.asm
AsprDbgr.exe

Manko NONE of these hAve info on how to use the program with switches........your.asm file has references to possible switches hardcoded but if i use any of them from that file nothing happens

So i assumed just double click it to rum ??

Help me out here.Explain how your program is ran? :)

Im being serious here ..Is this just a wind up?..does it actually work?...if so accept my apoligies :)

Thanks its appreciated

paul333
Manko
05-10-2003, 02:43 AM
Hi, Paul!

Hmm... You don't like PM? :p

Anyway... It is THAT simple... Run it, choose an aspred exe and follow the movements...

But something is obviously wrong. Why wont you tell me which OP you're running? That MIGHT help. (I'll probably say; - It's not supported... :p)
And why don't you check for yourself what your puter is doing to my fine program? (You have tools. You even have source. And the bug is on YOUR setup. Sadly not mine, or it would be easy to fix...)
Most likely some API-call is not working/hanging...? Maybe syminitialize...? THAT I can fix... easy...

I need more info. :)

btw, you're not helped by hinting it's a fake... :(

/Manko
Paul333
05-11-2003, 07:35 AM
Originally posted by Manko
Hi, Paul!

btw, you're not helped by hinting it's a fake... :(

/Manko

I know , sorry ,accept my apoligies Manko:(

Im using windows 98 ..if its not supported then thats that ...if it is supported then ill give you peace and leave it for a while :)

thanks for patience

paul333
Manko
05-11-2003, 08:26 AM
Hi, Paul!

Originally posted by Paul333
/.../
Im using windows 98 ..if its not supported then thats that
/.../
paul333
That's that... :p

I did it on w2k, for w2k, since that is what I work with...
W9X is MUCH too buggy for my taste. ;)

/Manko
Paul333
05-11-2003, 05:21 PM
Lol i should have said what OS from the start Manko.sorry :)

Thats that then...., same as aspstripperXP too , no one builds for win987 anymore...... i have win 2000 ,win 98 SE and win XP sitting on my comp waiting to be installed sometime in the future so i can use your debugger and the other fine tools

Not at the mo though :)

Cheers

paul333
Feisu
07-31-2003, 11:17 PM
Hi,Manko

New version of ASProtect can found it,Can't debug.Can you have a see?

hxxp://www.gelosoft.com/synchro.exe

This Software is pack by new version of ASProtect,When I use your tool to debug it, It show
http://feisu.hanzify.org/pic/debug.png
Manko
08-08-2003, 07:16 PM
Hi, Feisu!

Actually I had noticed this too, and sollution was not so much work... Problem is, I have very little time these days for RE... :(

So here goes: New version, at last...

(Read the included .txt...)

deleted... downloaded 62 times...

/Manko
Feisu
08-08-2003, 10:36 PM
Originally posted by Manko
Hi, Feisu!

Actually I had noticed this too, and sollution was not so much work... Problem is, I have very little time these days for RE... :(

So here goes: New version, at last...

(Read the included .txt...)

/Manko

great tools!

great job!

thanks very much.
Manko
08-19-2003, 08:51 AM
Hi!

Did a small update...

STupid page for AsprDbgr1b... (http://www.kommunicera.umea.se/hemma/mawiklund/)

now IAT is fully cleaned again... (I, hope...) :)
some other small changes...

I have done nothing about stolen bytes, or the faulty reported "(temp)OEP" in newest targets...

It's not so hard to find them both...

When paused at right place, fire up sice, use 'addr' command, set bpx, continue execution, when it break, trace till you know what's what... repeat till you're satisfied...

/Manko
aka
08-19-2003, 05:35 PM
Thanks, and I am waiting for your tutorials.
seven
08-20-2003, 04:19 AM
what is ( stolen bytes ) means ?
can some1 plz explain ?
thx
Manko
08-20-2003, 06:32 AM
Hi!

Stolen bytes:
When aspr packs a program he will strip it of the first few instructions and put them in it's own space and run them there and then jump to following instruction in proggies space...
This is done to complicate things for us...
It was too simple, so NOW he has put lots of crapcode in ther to confuse us and he has changed the code a bit totrick us and also he emulates part of code that is after those stolen bytes, so we end up inside some procedure, complicating things further... blabla...

btw, I did stupid dirty update to proggy to get tempOEP on new aspr, it will break if variations occur, but I had no time to make proper code...

http://www.kommunicera.umea.se/hemma/mawiklund/

/Manko
Feisu
08-22-2003, 12:21 AM
thanks:)but have one app packed by aspr.detected it.plz you have a see:P

SpeedCommander 9

hxxp://www.sp-download.de/sc9/sc9.exe
Manko
08-22-2003, 01:40 AM
Hi!

Hehe, I had forgotten about aspr-packed dlls... :)

Actually they run before the proggy, so I just put my patching routine when process was created...

I also left it where it is because apps switch context as they are being loaded... hmm...

Still, asprdbgr, doesn't debug the target as it should. It stops before it has displayed resolved api... hmm...

I'm working on it. :)

/Manko
Manko
08-22-2003, 02:51 AM
Hehe... stupid me. I had "SuperBPM" (a variant...) on so my app couldn't do BPM's...

Anyway, had to do some other things...

Go get it! :)

http://www.kommunicera.umea.se/hemma/mawiklund/

/Manko
Manko
08-22-2003, 03:39 AM
Ehrm... I accidentally killed my app... Had to do stupid sollution... :(
(If I have time, I'll try and fix this...) (Could do a msgbox-question, but that feels wrong...) (Hmm.... or maybe just check exe... :) (Will fix later!

/Manko
Computer_Angel
08-22-2003, 10:52 PM
Can anyone explain to me:

What is the dip-table, and what is it used for ?
While using the aspr debugger, the console show:

Dip-Table at adress: BF7AB4
0 5771B8 0 0 5771CC 0 0 5771E8 5775E0 577614 0 0 0 0

Is there any tuts for aspr debugger ? I try to use it but don't know how to unpack :-D
JMI
08-23-2003, 02:40 AM
Come on guy:

This is why we have a "search" function on the Board. Press the search button at the top of the Forum, go to the left hand side and enter "aspr + dip" and you will find several interesting entries. Also try "asprotect + dip" and anything by +Spl/\j and aspr and/or asprotect. There's lots of material here, just go do some of the work of actually looking yourself. Then, after you read up, then ask questions.

Regards.


Unpacking ZoomPlayerPro (UPX) w/o SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking ZoomPlayerPro (UPX) w/o SI
PDA

View Full Version : Unpacking ZoomPlayerPro (UPX) w/o SI

TheDutchJewel
04-23-2003, 07:13 AM
Zoom Player Professional v3.00 is packed with UPX and scrambled. So I used jmp eip command in SI to froze the .EXE on the OEP, after which I dumped it and fixed the OEP. The dumped .EXE would however only run when I run SI in the background. Strange! No difference if I dump it with ProcDump v1.6.2 or LordPE Deluxe v1.41.

When I start Win98SE or WinXP without SI in the background, the unpacked EXE terminates after entering. In Win98SE I get this error message after termination:
Runtime error 216 at C01A2349.

So I tried to debug it with OllyDbg v1.09, but there I can't give in the jmp eip command. I tried it with the assemble command, but then it says something about an Unrecognized operand.

Someone has any idea to solve this?

TIA
Manko
04-23-2003, 08:00 AM
Hi!

When you are at OEP in Olly the program IS paused. So you can just go ahead and dump it. ;)
(No need to insert any code.)

/Manko
Shoob
04-23-2003, 08:23 AM
i had a look at the oep, right after them is call to an well known anti debugger api.. think
TheDutchJewel
04-23-2003, 08:35 AM
Originally posted by Manko
Hi!

When you are at OEP in Olly the program IS paused. So you can just go ahead and dump it. ;)
(No need to insert any code.)

/Manko

Forgot to tell I tried this already with Olly, but than ProcDump wasn't able to dump... :( I'll try it with LordPE now.

Yep, dumped .EXE by LordPE is is right! :)

Also tried again with ProcDump, but EXE still not good. No prob, I'll use the good dumped .EXE. ;)

Thanks
TheDutchJewel
04-23-2003, 09:21 AM
After restarting my pc, again w/o SI, the unpacked .EXE still crashes when I start it... :eek:
TheDutchJewel
04-23-2003, 09:27 AM
Originally posted by Shoob
i had a look at the oep, right after them is call to an well known anti debugger api.. think

Dunno which call you mean, but I'll try to find it.
Manko
04-23-2003, 09:41 AM
Hi!

You said this was scrambled UPX. Dunno exactly, but does this mean it has destroied IAT? Maybe you have to rebuild IAT, ala ImpREC? :)

Though, I don't know that it would work even WITH sice, if that was the case...

Exactly what errormessage do you get when it crashes and have you disassembled and looked at the adress in which this occurs?
If you don't know the adress it can be found with for example faults off in sice if you haven't patched it, dr.watson or probably olly... Though, if you use olly, that antidebug api will kick in... I guess probably it is IsDebuggerPresent?

Let me know if this helps, or if you have aditional questions... ?

/Manko
TheDutchJewel
04-23-2003, 12:37 PM
What I mean with scramble is that UPX itself can't unpack the .EXE. But the .EXE runs if I start SI in background. So it seems clear that there must be SI check, but

And I found the IsDebuggerPresent call (0054CC43), but first error occurs at 0054CC30.
I can simply remove the crash by nopping the call to it, and jumping after the debugger check, but that's not enough. It seems I overlook something. Again any idea?

Btw here's the asembling list for the unpacked .EXE, where I noted the crashed and the debugger check.

---

//******************** Program Entry Point ********
:0054CC18 55 push ebp
:0054CC19 8BEC mov ebp, esp
:0054CC1B B909000000 mov ecx, 00000009

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0054CC25(C)
|
:0054CC20 6A00 push 00000000
:0054CC22 6A00 push 00000000
:0054CC24 49 dec ecx
:0054CC25 75F9 jne 0054CC20
:0054CC27 51 push ecx
:0054CC28 53 push ebx
:0054CC29 56 push esi
:0054CC2A 57 push edi
:0054CC2B B828C75400 mov eax, 0054C728
:0054CC30 E843A6EBFF call 00407278 // <- crash
:0054CC35 33C0 xor eax, eax
:0054CC37 55 push ebp
:0054CC38 680CD35400 push 0054D30C
:0054CC3D 64FF30 push dword ptr fs:[eax]
:0054CC40 648920 mov dword ptr fs:[eax], esp
:0054CC43 E8B0FAFFFF call 0054C6F8 // <- IsDebuggerPresent?
:0054CC48 3C01 cmp al, 01
:0054CC4A 0F848C060000 je 0054D2DC
:0054CC50 B8C0015600 mov eax, 005601C0

* Possible StringData Ref from Code Obj ->"OUJdf/tzt"
|
:0054CC55 BA24D35400 mov edx, 0054D324
:0054CC5A E8C981EBFF call 00404E28
:0054CC5F A1C0015600 mov eax, dword ptr [005601C0]
:0054CC64 E85784EBFF call 004050C0
:0054CC69 8BF0 mov esi, eax
:0054CC6B 85F6 test esi, esi
:0054CC6D 7E23 jle 0054CC92
:0054CC6F BF01000000 mov edi, 00000001

---

* Referenced by a CALL at Address:
|:0054CC30
|
:00407278 53 push ebx
:00407279 8BD8 mov ebx, eax
:0040727B 33C0 xor eax, eax
:0040727D A3C4E05400 mov dword ptr [0054E0C4], eax
:00407282 6A00 push 00000000
:00407284 E82BFFFFFF call 004071B4
:00407289 A368965500 mov dword ptr [00559668], eax
:0040728E A168965500 mov eax, dword ptr [00559668]
:00407293 A3D0E05400 mov dword ptr [0054E0D0], eax
:00407298 33C0 xor eax, eax
:0040729A A3D4E05400 mov dword ptr [0054E0D4], eax
:0040729F 33C0 xor eax, eax
:004072A1 A3D8E05400 mov dword ptr [0054E0D8], eax
:004072A6 E8C1FFFFFF call 0040726C
:004072AB BACCE05400 mov edx, 0054E0CC
:004072B0 8BC3 mov eax, ebx
:004072B2 E8A5D7FFFF call 00404A5C // <- crash
:004072B7 5B pop ebx
:004072B8 C3 ret

--

* Referenced by a CALL at Address:
|:004072B2
|
:00404A5C C70514905500CC124000 mov dword ptr [00559014], 004012CC
:00404A66 C70518905500DC124000 mov dword ptr [00559018], 004012DC
:00404A70 A340965500 mov dword ptr [00559640], eax
:00404A75 33C0 xor eax, eax
:00404A77 A344965500 mov dword ptr [00559644], eax
:00404A7C 891548965500 mov dword ptr [00559648], edx
:00404A82 8B4204 mov eax, dword ptr [edx+04]
:00404A85 A330905500 mov dword ptr [00559030], eax
:00404A8A E8C5FEFFFF call 00404954
:00404A8F C6053890550000 mov byte ptr [00559038], 00
:00404A96 E861FFFFFF call 004049FC // <- crash
:00404A9B C3 ret

---

* Referenced by a CALL at Address:
|:00404A96
|
:004049FC 55 push ebp
:004049FD 8BEC mov ebp, esp
:004049FF 53 push ebx
:00404A00 56 push esi
:00404A01 57 push edi
:00404A02 A140965500 mov eax, dword ptr [00559640]
:00404A07 85C0 test eax, eax
:00404A09 744B je 00404A56
:00404A0B 8B30 mov esi, dword ptr [eax]
:00404A0D 33DB xor ebx, ebx
:00404A0F 8B7804 mov edi, dword ptr [eax+04]
:00404A12 33D2 xor edx, edx
:00404A14 55 push ebp
:00404A15 68424A4000 push 00404A42
:00404A1A 64FF32 push dword ptr fs:[edx]
:00404A1D 648922 mov dword ptr fs:[edx], esp
:00404A20 3BF3 cmp esi, ebx
:00404A22 7E14 jle 00404A38

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A36(C)
|
:00404A24 8B04DF mov eax, dword ptr [edi+8*ebx]
:00404A27 43 inc ebx
:00404A28 891D44965500 mov dword ptr [00559644], ebx
:00404A2E 85C0 test eax, eax
:00404A30 7402 je 00404A34
:00404A32 FFD0 call eax <- crash the eightest time when EAX=40FFEC

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A30(C)
|
:00404A34 3BF3 cmp esi, ebx
:00404A36 7FEC jg 00404A24

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00404A22(C)
|
:00404A38 33C0 xor eax, eax
:00404A3A 5A pop edx
:00404A3B 59 pop ecx
:00404A3C 59 pop ecx
:00404A3D 648910 mov dword ptr fs:[eax], edx
:00404A40 EB14 jmp 00404A56
:00404A42 E91DFAFFFF jmp 00404464
:00404A47 E850FFFFFF call 0040499C
:00404A4C E827FDFFFF call 00404778
:00404A51 E876FDFFFF call 004047CC

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00404A09(C), :00404A40(U)
|
:00404A56 5F pop edi
:00404A57 5E pop esi
:00404A58 5B pop ebx
:00404A59 5D pop ebp
:00404A5A C3 ret

---

and so on...
Shoob
04-23-2003, 01:43 PM
Ok go in you call eax, look around you will see some jumps to apis

I bet one APi is wrong or maybe not imported in the IAT. Trace your code with F7 in sice or other debuggers. Step IN the calls and not over and mark where exactly your app crashes.

/away to look some ManchesterUnited game :D
Iwarez
04-23-2003, 02:25 PM
I just paused with ollydbg on oep and dumped it with lordpe. After that I fixed the IAT with imprec and everything ran fine. Offcourse the isdebuggerpresent test must be patched but then it's a piece of cake...
Solomon
04-23-2003, 08:55 PM
Off topic:

This baby uses the DCPcrypt(free with Delphi source code, hyyp://www.cityinthesky.co.uk/cryptography.html) to do the keyfile check. The algorithm includes RC4, blowfish, twofish etc. according to TMG's nfo. Actually, we can search for "TDCP_" in its exe to locate the algorithm name or use IDA sig to identify it.
ZaiRoN
04-24-2003, 04:30 AM
Hi,

like Shoob and Iwarez told you, the only anti-debugger is the one you mentioned (IsDebuggerPresent). I think (correct me if I am wrong) your problem is related with the IAT. You can follow the method used by Iwarez or you can simply copy the original IAT above the IAT of the dumped file. If you want you can only copy all the thunkRVAs...

ZaiRoN
TheDutchJewel
04-24-2003, 04:55 AM
Originally posted by Iwarez
I just paused with ollydbg on oep and dumped it with lordpe. After that I fixed the IAT with imprec and everything ran fine. Offcourse the isdebuggerpresent test must be patched but then it's a piece of cake...

After I did this, it works in WinXP, but not in Win98SE. In Win98SE I get a error message that the unpacked .EXE file is linked to missing export KERNEL32.DLL:RestoreLastError.

If I try same procedure in Win98SE (Olly - ProcDump or LordPE - ImpREC) IAT is not completely restored (3 "invalid" addresses). I tried Tracer Level 1 on the first invalid adress, and now there are no invalid addresses anymore and I could fix the dumped .EXE. :)

However, after restarting my pc, the unpacked .EXE crashed again. Does this mean that it's not possible to make a good unpacked .EXE which can run in Win98SE?
Manko
04-24-2003, 05:12 AM
Hi!

Have you checked what the author says about compatibility, or maybe you even downloaded a w2k/xp version? :p

/Manko
TheDutchJewel
04-24-2003, 06:14 AM
I did, but nothing about that. Also the uncracked worked in Win98SE even as the cracked one EAT and with the right keyfile made by TMG keygen. So I think it's only the dump/IAT process that causes the prob.
JMI
04-24-2003, 10:56 AM
Did you by any chance LOOK at the unresolved IAT addresses with a debugger? +Spl/\j has written several small threads about how to follow the address back to the "true" API or eliminate it altogether. I also remember some threads where it was reported that after a rebuilding, the "repaired" exe would not work on other OSs.

If it works without your fixes, it should work AFTER your work, IF you fix it correctly. I don't have time this morning to find those threads for you, but if you can't find them yourself or someone else doesn't post the method for you, I'll find them and post again after I get some real world work done.

Regards.
TheDutchJewel
04-25-2003, 02:24 PM
No, I didn't look at the unresolved IAT addresses with a debugger. And also I can't find +Spl/\j threads. Would be great if someone can help to work this out. Very interesting...
JMI
04-25-2003, 03:08 PM
Why do I have to do all the work? I know we are having some problems with the search function, but if you put "+Splaj" in the right hand button you will get all the threads in which he posted. I just took a quick look as some and found this comment:
*****
The public release of ASPR1.2x plugin that fits Imprec/RV worked for a long time.

This is a delphi 'bloatware' dll , but a packed version. Currently it does NOT resolve the latest Alexey trick to shake off API tracers :-

001F3500 kernel32.dll 01DC GetVersion <-WRONG should be GetCommandLineA

If you un-assemble that redirector call in SI you'll see wtf gives
*****

What he is suggesting is that you LOOK at the address given in the IAT and use the "U" command to see what the address is pointing to and go there and examing the code there and maybe "U" a new address shown there. These "re-directions" are usually together in a section of code and you need to study it. Eventually it will "re-direct" back to the proper API.

This is all I have time to do for you at the moment, but again if you "follow" the code, by which I mean go to the address, at the IAT, it has to eventually lead to the correct API, even if the ready made "tools" don't find it for you on autopilot. This is what your brain and a debugger are intended for.

[Edit: Here's one of the thread I had in mind which explains how you go from the address in the IAT to the re-directed API:
http://www.woodmann.net/forum/showthread.php?threadid=2603]

Regards.
hobferret
04-25-2003, 03:11 PM
Hi

This looked very interesting so I had a go at it.:)

Found the same OEP and then run our old friend TRW, broke and suspended the program, dumped with LordPE and changed the EP.

Ran it again with no debugger present and found all the API's with revirgin, generated the BIN and all worked fine. Then ran the "dumped" program and did the same with Imprec and it runs on ME 98[2] & 2000!;)

If you change section flags look at it with WDASM and you will soon find the rest!:D

/hobferret
SpeKKeL
05-23-2003, 08:59 AM
Ajo,

Normally i didn't encounter problems with upx-ed files till i tried
to unpack on w XP.
On w 98 i unpacked it the prob without any difficulties but on XP my dumped.exe simply refused to load in si.(safety of XP??)
I rebuilded the import table pasted and quess,,,it runs smooth.... .
Strange i thought upx didn't scramble the imports...

:confused:

SpeKK.
Kayaker
05-23-2003, 12:15 PM
Originally posted by SpeKKeL

Strange i thought upx didn't scramble the imports...
SpeKK.

No, but I think it does affect the IMAGE_IMPORT_DESCRIPTOR structure in some way, if you look at a dumped upx file in a PE editor the imports don't usually show up correctly. The file runs fine, presumably because the import addresses are now hardcoded in since the PE loader has already done the job of that before dumping, but their identification is still wrong. It's a matter of aesthetics if you want to fix it. Maybe on XP this is a factor, or the upx version is modified.

Kayaker
dELTA
05-24-2003, 05:44 AM
The NT/2000/XP loader is much more picky with having correct PE-structure in the exe files it approves of loading, so this is probably it, yes. But you probably still don't want to have a file with hard-coded API addresses. As soon as you change computer, or even just apply a service pack or update some components in your current computer, it might stop working anyway.

dELTA


Unpacker for FSG wrote
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Unpacker for FSG wrote
PDA

View Full Version : Unpacker for FSG wrote

evaluator
04-23-2003, 03:08 PM
Yah, I'm started learn prgrmng
& wrote unpacker for FSG133.

Where to upload or sent?
squidge
04-23-2003, 03:20 PM
If it's small, why not upload it as an attachment to this board?
evaluator
04-23-2003, 03:34 PM
Can I here sent?
master@protools.cjb.net

Here uploading..
OK,
squidge
04-23-2003, 03:43 PM
Yup, that's fine. I think the limit is 195Kb.
evaluator
04-24-2003, 01:22 AM
ye, but this is aviable for MB users.

But protools, exetools.. are special sites for dlding.
JMI, tell me something..where to sent..
squidge
04-24-2003, 02:24 AM
I just emailed protools (address on the site) with the url of my proggy and a simple description, and it was added to the site quite soon afterwards.
JMI
04-24-2003, 02:27 AM
Hello our Musician Friend:

Why not send it to both and spread it far and wide??

Always good to have something from you on RCE, but we are also waiting for some music!

Regards.
esther
04-24-2003, 04:27 AM
I'm uploading commview keygen

OMG :D
(edited by woodmann)

I deleted my post below
(edited by arseter :D )
the_analyst
04-24-2003, 05:52 AM
Originally posted by esther
I'm uploading commview keygen

Heh.
I downloaded it , knowing it would be something special coming from you ;) (bastard moderator from hell eh)

Bet 80% were expecting something real :)
bart
04-24-2003, 06:09 AM
evaluator, hey this is great, but it doesnt work with the new version ;)

it does work with earlier versions, but after i use your dumper i get 1.2MB file from 50kb (original exe) :)
evaluator
04-24-2003, 12:23 PM
after todays fight with Delpih, I finally managed,
how need code GetOpenFileName under Delpih-CONSOLEapp.
Duh!!

So now our app is littlest:) I remove TFrm variant &
upload this console.. Delpih is GrAet!!

..
Bart, file dumped will so big as in memory..
(learn, learn..)
I not hear about new version, where, when..
Do you need unpukzer for it!???!!
bart
04-24-2003, 12:55 PM
learn yourself about virtual section size ;), 1MB of 0x00 in exe is cool anyway :)

i dont need an unpacker, since i have all src code of fsg on my hdd :)
evaluator
04-24-2003, 04:09 PM
such like garbage is from HDD.
So was in teribl-vxd crackme..
evaluator
04-26-2003, 03:01 AM
yei,

why exactly yesterday i recieved AHA worm..??
esther, you did?
evaluator
05-01-2003, 01:53 PM
Woah!

my unpakzer published on Protools!!
I'm very gladd..

Now I plane make unpackzer for PCGuard..
But I want know, already exists or no other unpacker for it,
except ^Daemons old?

JMI, have you info about it?


SoftICE on a Laptop
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE on a Laptop
PDA

View Full Version : SoftICE on a Laptop

nikolatesla20
04-23-2003, 09:37 PM
I'm looking into getting a laptop computer very very soon, it's primary use will be for programming and RCE tasks. So naturally I want to load all my latest tools on it.

My question is, has anyone ever loaded SoftICE on a laptop? I mean, it should still work, but will there be any problems with the video ?

The laptop I'm looking at is the Toshiba Satellite S225, it's a pentium 4 2.4Ghz with 512megs ram, and an Nvidia GeForce4 420 Go (32meg) video card.

Has anyone else here used their laptop for this purpose - and were there any troubles?

-nt20
doug
04-23-2003, 11:10 PM
I use it all the time on mine.

The only problem i have is when i get to debug games.. As soon as it steps into 3D, my breakpoint tend to give me bluescreens.
Generally faulting into the ATI drivers.. (the card is an ATI radeon mobility, 16megs)

I didn't bother trying to fix it, when I absolutely need to debug gfx intensive stuff (which is not very frequent), I just use my desktop (geforce2 btw)

Another thing I was wondering was if softice affected in any way the power management scheme of my laptop... when the fan should be started, etc...
Zero
04-24-2003, 01:24 AM
SI 4.05 works fine for me on a win2k system (Windowed).
DS 2.6 / 2.7 do not work due the gfx card (Trident Cyberblade i1) causes several problems. The system freezes.
I use a Gericom 1 Ghz Notebook.
ZaiRoN
04-24-2003, 03:48 AM
Hi,

DS2.7 works fine for me. My video card is ATI Mobility Radeon 9000 64 Mb. This type of video card is not allowed to work in full screen mode; using 'universal video driver', softice works well in windowed mode. Your video card is not in the list, you will need to run sice in windowed mode.

ZaiRoN
nikolatesla20
04-24-2003, 07:19 AM
I prefer Windowed mode by far anyway !

-nt20
ZaiRoN
04-24-2003, 07:49 AM
I prefer Windowed mode by far anyway !Me too :D
naides
04-24-2003, 08:58 AM
I have it on a Winbook with Windows XP.

One sticky problem I did found was the mouse.

Sice ( DS2.7) Does not understand very well the touch pad or the mouse stick.

For a while I had to re-learn to use Sice with Keyboard commands only. Then I found that Sice has no problems with a USB connected Optical Mouse.


Computer Made from DNA Enzymes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Computer Made from DNA Enzymes
PDA

View Full Version : Computer Made from DNA Enzymes

Zero
04-24-2003, 09:02 AM
taken from http://science.box.sk/

"Israeli scientists have devised a computer that can perform 330 trillion operations per second, more than 100,000 times the speed of the fastest PC. The secret: It runs on DNA."

http://news.nationalgeographic.com/news/2003/02/0224_030224_DNAcomputer.html

So this is my serious question:

HOW to debug this ?
disavowed
04-24-2003, 10:16 AM
kinda gives a new meaning to "computer viruses"
JMI
04-24-2003, 11:03 AM
Well first you probably need to download the human genome project into your computer and begin "mapping" your "source code". :D But, hey, it dosent' make much sense that they could wirte "code" for such a computer without also inventing some method to debug it. :p

Regards.
naides
04-24-2003, 06:46 PM
Ahhh, that way journalists have to spin news about hopes and hypotheses as facts.

The only computers that indeed work with DNA and Enzymes are called living cells. We are getting the raw code right now, and have very rudimentary ideas about their assembly language and the operating system API's and house keeping chores.

It will be a few decades until we learn how to debug.
Woodmann
04-24-2003, 09:01 PM
Howdy,

I beleive that you will need something to get
you to ring -3.

If you cant hook the process at the lowest level......
I mean, you could try to hook it later but then
there would be way to much code to look at.

Someone needs to write a cerebral unpacker first.
I dont think this will be as easy as Aspr :eek:

Maybe Splaj has an answer :)

Woodmann
Zero
04-25-2003, 02:14 PM
I have another horrible idea:

Imagine you code your app with DNA.

We all know that one fact of DNA is "spontanous mutation"

Now go, code your module Number 10 and suddenly the code modules 9 and 5 mutate to a better or ugly code....

But DNA does "evolving" (mutation), so if you code a bad app.... just wait and you get a cool program :D
Woodmann
04-25-2003, 04:18 PM
BWAHAHAHAHAHAHAHHAHAHAAAA

I bet you could make a ton of money selling
that stuff. No more need to know what your doing ;)

Woodmann
disavowed
04-26-2003, 06:35 AM
Are you implying that application programmers know what they're doing now? :)
Woodmann
04-26-2003, 02:22 PM
:)

I would never say such a thing.

Woodmann
sirius
05-01-2003, 05:50 PM
I think that cloning some good tools in this new system will be a good idea, just imagine that Ilfak has developed his genius tool for this system, cloning it and ameliorating it will give another powerful tool, and it my do many extra task that the old version couldn't ;)


aspr oep..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > aspr oep..
PDA

View Full Version : aspr oep..

SpeKKeL
04-25-2003, 06:52 AM
Ajo,

H''mmm just a nice option to try...,after loading an aspr target and breaking on the first instuction:try setting a bpm at or around the "esp">>dd esp >put a bpm on esp, esp+4, esp+8 or esp-4.
(set /pbpm on or maybe superbpm will work allso)

Well it doesn't work for all targets but some will land exactly on
the "pre"-oep !!

Hehe alex should thank the community for improving his tool:cool:

Ciao,

SpeKK


Small New Tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Small New Tool
PDA

View Full Version : Small New Tool

Polaris
04-25-2003, 07:53 AM
Hi there!

I have just completed some small tool that could interest some of you :)

LA2C is a Local Assembler To (pseudo)C Translator: it is meant to help the process of source code recovery from assembler. It something like a small decompiler for subroutines. I think that maybe some of you will be interested.
It is composed of a small IDC for IDA which produces the input for LA2C.exe... But everything is explained in the docs!

Some features:
- 1-2-1 translation
- jump rebuilding
- stdcall rebuilder
- fastcall rebuilder(with some small data-flow analisys)

Byeezz!

:D
S3ri@l CoDe9x
05-03-2003, 06:25 AM
Great! Tuto :p

and good work....:D

thnkx for the tuto!... ;)

Best Regards!:rolleyes:
3axap
05-08-2003, 10:04 AM
thanks :)
Polaris
05-12-2003, 02:36 PM
LA2C has been updated again! You can found the new version (version 3.5) of LA2C on my website:

hxxp://polaris.kcmo.net

Please note that this is also the official website for the IDA Pro INQUISITION Plugin (LA2C porting to plugin) which will be soon released. ;)

Byeezzz
dreamweavermx
05-16-2003, 10:44 PM
many thanks for the very useful tool
Polaris
05-18-2003, 08:18 AM
LA2C v3.5 is released. It features the new PostTranslation Step which kills all the PUSHES & POPS that have survived the call rebuilding step.

Download at:
hxxp://polaris.kcmo.net

Also, INQUISITION IDA Pro plugin is in beta test. Please check the same website for news.
;)
B2kguga
01-14-2004, 06:36 PM
Where is the link to LA2C v3.5 ?

How can i download it or even a newer version ?

Best Regards

Beyond2000!
disavowed
01-14-2004, 11:05 PM
try reading the f***'ing site: "Strangely enough, INQUISITION users are really a vast number: I keep getting request for it, even if I announced that the project has officially been discontinued."

admins: can we ban ppl in the future who don't use google or don't try reading before asking questions?
B2kguga
01-14-2004, 11:47 PM
Hey

sorry for that.

But on the site (polaris.kcmo.net), there is no link or no news from inquisition...and no reference that the project was discontinued.
disavowed
01-15-2004, 10:29 AM
and no reference that the project was discontinued.http://polaris.kcmo.net/ice_age.htm
Polaris
01-15-2004, 03:32 PM
Where is the link to LA2C v3.5 ?

How can i download it or even a newer version ?

Best Regards

Beyond2000!
Dear B2kguga,

LA2C was finally removed from the website mostly for renewing needs (had cleaned up the website - they said it was horrible! :( ) and never thought to re-upload LA2C archive...

So, just drop me a mail and I will manage to send the latest version to you.

Polaris
JMI
01-15-2004, 10:06 PM
Whoa disavowed: Drop by Polaris' frozen wastes for a while and chill out. :D
If we started "banning" people for failing to read what's in front of them or failing to use a search engine, we would be spend way too much time doing that. :rolleyes:

Usually it is sufficient if we simply beat them to a bloody pulp and leave then to crawl home through the snow. After their initial wounds heal, they usually do better the next time. :)

Regards,
disavowed
01-15-2004, 10:11 PM
sorry, that was just after i had replied to like 3 other ppl asking questions that could have been answerred by googling/reading

B2kguga (http://www.woodmann.net/forum/member.php?u=6302): sorry for losing my temper. thanks for not flaming me back
JMI
01-15-2004, 10:24 PM
You should have my job. And I try to maintain some small level of discipline over on the exetools forum also. Both a thankless job, usually. :rolleyes: But control of that "delete" button makes up for a life, or the absence of one, without any other real power. :D

Regards,
B2kguga
01-16-2004, 01:10 AM
Hi Disavowed

No problem :p

I don't come here on the board for a long time, and i just made a quick read on the thread, after testing Polaris app old version.

Best Regards,

Beyond2000!


Attacking DSA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Attacking DSA
PDA

View Full Version : Attacking DSA

Pyrae
04-25-2003, 11:18 AM
Hi there,
I've got some (plenty to be honest :)) questions regarding DSA-based protection schemes,
where p (1024 bit), g, y, and q (160 bit) are known.

1. Forging
In some earlier thread someone mentioned that forging a valid
signature might have been possible in a similar case.
What does "forging" in this context mean?
Is it trying to brute-force x by trying values below q or is it
something about more sophisticated cryptanalysis?

2. Solving the DLP
Is solving the DLP in such cases feasible or will the sun burn out
prior to a getting a result?
If it is, which algos would be most promising (Pollard-Rho, Index-Calculus)?
Are there any public sources (might be maple, mathematica etc. aswell)
for those (it's no fun spending a month writing the whole stuff yourself
just for probably achieving no result :() or are the gurus keeping that code for themselves?

'nuff questions for now and thanks for reading,
Pyrae
mike
04-27-2003, 05:40 PM
"Forging a signature" means pretty much the same thing it does with normal signatures: that someone other than the holder of the private key generates a message that appears to have been signed by the private key. The method of forging depends entirely on the context, and is usually infeasible, especially for the size of numbers you're talking about. (Else what would be the point of the crypto in the first place?)

"Solving the DLP" isn't something you do just once (unless you find a new algorithm for it that will make you rich & famous). You need to solve it for each instance you're trying to attack. The time it takes to solve depends on the size of the parameters. You can solve the DLP mod 5 in your head :D But here, p would have to be a prime with a special form in order to use any of the known attacks.

And yes, the sun would burn out first...

I'll refer you to Woodmann's searching thread for finding packages that do this stuff.

You'll learn a lot more if you implement it yourself, though. To get you started, here's a link:
http://www-math.cudenver.edu/~wcherowi/courses/m5410/phexam.html

Index calculus usually runs faster than Pollig-Hellman. Here's a link:
http://www.cacr.math.uwaterloo.ca/conferences/1998/ecc98/silverman.ps.zip
Pyrae
04-28-2003, 09:14 PM
Thanks very much, Mike!
Sorry for not having informed myself a bit more before asking some of these
(pretty naive, looking at them now) questions...
I read up some stuff in the HAC meanwhile and found that in my particular case
none of the seven attacks mentioned - except index calculus perhaps, which I
have not been able to check until now - seems to be usable.
Guess next month's project will be to implement index calculus with some decent algo
for finding relations (hoping my school math is up to the task)...;)
Anyway, one last naive question:
Can one possibly choose (i.e. patch in) different p,g and x which would lead to the same
public key y and make your own generated signatures pass the verification algo?
And, of course, thanks for the links, especially the first one
(actually I found some pretty good explanation on index calculus in my native language).

Back to the books,
Pyrae
mike
04-28-2003, 10:30 PM
Yeah, sure, you can patch it no problem most of the time. In fact, usually, they do something like

input name, serial
hash it with sha to get x'
compute y'=g^x' mod p
compare y,y'
je goodkey
messagebox (bad key!)
ret
goodkey:
messagebox (yay!)
...

And you just change je to jne. Unless they're using DLP for encryption (ElGamal), then patching will knock it dead--it's only good for preventing keygens.

Can you give any more details of how the DLP is used in your context?
Pyrae
04-29-2003, 01:12 AM
Yes, of course.
Basically it's the classical DSA verification procedure.
The registration name is first hashed using a modified SHA-1.
The serial is a composite of 2 160 bit integers (r and s).

The following computation is done:

w=(2nd160bitofserial ^ -1) mod q
u1=(namehash * w) mod q
u2=(1st160bitofserial * w) mod q
v=((g^u1 * y^u2) mod p) mod q

If v=1st160bitofserial (i.e. 'r') you're a good guy.
(p is 1024 bit, q is 160 bit)

The problem is that the public key y is crippled inside the target and is for certain reasons near to intractable (see PM for details).
Actually I didn't mean a jz/jnz kind of patch, as this is for the same reasons not applicable. My hope was, that modifying only the p, y, g and/or q parameters, which are easily exchangable in the code, might be some way to tackle this target. But now I guess, this can't be a solution as only y is called the "public key" in the literature. :(
I'm not sure, whether it would be a wise choice to post the exact parameters here, so I sent you a PM with some details...

Thanks again,
Pyrae

/edit: Oops, just saw that your inbox is full. The PM will be sent immediately when your account is reachable again...

Pyrae
mike
04-29-2003, 03:58 AM
Try setting p=q. Then you only have to solve discrete log mod q, which is doable.
mike
04-29-2003, 04:16 AM
Another way that isn't guaranteed to work but which makes everything easier if it does:

set g=1
then
v=((g^u1 * y^u2)mod p)mod q
=((1*y^u2)mod p)mod q
=(y^u2 mod p) mod q

Then start trying different numbers for p to see if you can get
r = y^u2 mod p
If you can't, try to find p such that
r+q = y^u2 mod p
and then
r+2q = y^u2 mod p
Pyrae
04-29-2003, 04:26 AM
Wow, I realize again, you're eating this for breakfast. :)
As soon as I wake up, I'll immediately try your suggestions. But for now my mind is urging me to go to bed (about 40 hours without sleep until now)...

P.S. The PM has now been sent...

Thanks No. 4,
Pyrae
Pyrae
04-29-2003, 11:42 AM
Phew, can't get this out of my head. ;)
As for the 1st method, I told maple to do some number crunching (it's already eating up half of my ram).
The second way is what gives me a hard time.
Doesn't r always turn out to be 1, if you're setting g=1?
What should I choose for u2 in the final equation?
Isn't this actually dependent on s and therefore on x?
Should x=1 and k=1 be used for that?
Sorry, if I didn't get the point, but this one really gives me a headache...

Nearly wiser than before,
Pyrae
mike
04-30-2003, 03:29 AM
What method in mathematica? ECM to factor q-1?

I assumed r is first 160-bit hash, s is second. If so, r isn't always going to be 1. Put in whatever serial you want, find r,s, and calculate u1 and u2 from it.

Here's another one, probably even faster.
set p to a prime r<p<=q

Then to make it work we need
v=r=(g^u1 * y^u2)mod p
r * y^(-u2) = g^u1 mod p
g = u1th root of (r * y^(-u2)) mod p

Since it's easy (Mathematica will do it for you) to take roots mod primes, then if there's a solution we can find a value for g (as above) that will satisfy the equation directly. If there's no solution, we can still play with it; set p to any prime between r and q and try again.

Of course, all this assumes you can tweak any value except y.
mike
04-30-2003, 03:31 AM
Oops! I mean maple, not mathematica. :rolleyes:
mike
04-30-2003, 03:34 AM
Is the final comparison between v and r done mod anything, or is it a direct equality check?
Pyrae
04-30-2003, 04:01 PM
What method in mathematica? ECM to factor q-1?

Actually, I told Maple to solve mlog(y, g, q), but realized that this probably isn't the way to do it, as the calculation still lasts. ;)
Well, factoring q-1 using lenstra or pollard was a matter of seconds, but of what use is this?
Seems I didn't get the point again...;)

I assumed r is first 160-bit hash, s is second. If so, r isn't always going to be 1. Put in whatever serial you want, find r,s, and calculate u1 and u2 from it.

Erm, r is the first part of the serial and s is the second, so there
actually isn't anything to put in besides the registration name and the two signature parameters r and s.

Is the final comparison between v and r done mod anything, or is it a direct equality check?

The latter. It's actually a simple string comparison.

Here's another one, probably even faster.

Thanks, gonna try it immediately.
Didn't think, that there are so many ways to accomplish this...

But there's also a little success I had. :)
Using your second suggestion of making g=1, and setting k=1 and x=1 myself, it solves to the following:

r = (g ^ k mod p) mod q
=(1^1 mod p) mod q
=1

s=(k^-1 * (namehash + xr)) mod q
=1 * (namehash + 1) mod q
= namehash + 1 (for namehash+1 < q)

Then using any p with y^((namehash+1)^-1 mod q) mod p = 1 makes the verification work.

Btw, does Mathematica implement better algorithms for factoring and discrete logs than Maple (at least you seem t like it better ;))?

Slowly becoming smarter,
Pyrae
mike
04-30-2003, 06:09 PM
Great! Yeah, when there's only one constraint and (r,s,g,p,q) five parameters, you can play with it in a lot of different ways. I understood that r and s were outputs of SHA-1 when I made my suggestions, rather than some power of g.

Good on ya' for figuring out how to do it!

Factoring modulus-1 is the first step in pohlig-hellman. If you only changed p=q, then you could have solved the discrete log problem that way.
mike
04-30-2003, 06:14 PM
Oh, and no preference between maple & mathematica, it's just that I happen to have the latter and not the former.


appforge 3.5 serial fishing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > appforge 3.5 serial fishing
PDA

View Full Version : appforge 3.5 serial fishing

NLZ
04-25-2003, 11:55 AM
hello everibody im trying abaout one week to guet a serial to appforge mobilevb 3.5 its a visualbasic pluguin (run inside visual basic 6) if anyone can help plzz.

thanks

you can found at hxxp://www.appforge.com

its a big file about 29 Mo and you need to ave visual basic 6 installed but plz help :)

ps : sorry for my english
JMI
04-25-2003, 12:09 PM
NLZ:

You need to read the FAQ. At the moment, your post looks like a cr*ck request, and that is not permitted here. If you want help, you need to follow the posting guidelines. You need to explain what you have already attempted to help yourself and where you are stuck. Also you need to include some information about your OS and which tools you are using. These are all explained in the FAQ.

Generally you need to know how to catch the entry of "your" serial in the dialogbox or where ever you input it. You need to know the API's that do that and how to "break" at this location in the debugger. Have you actually read anything about how to do this? Have you looked around here and actually read any other threads? Since your target is a vb program, do you know about vb debugging, which is different, to some extent ? Is it in vb code or p-code ? All things you need to identify.

Regards.
NLZ
04-25-2003, 12:33 PM
sorry

im using win98 se
softice 4.0.5
smartcheck 6.20 rc 2
windasm vb patched
i ave loged it smartcheck i see my wrong serial but nothing
i ave oppened it windasm i see all strings i tryed to redirect to good boy but ave bad boy all time
i ave tryed to follow step by step all the reg process it softice
and i dont understand

and the prog is not p-code protect, simple vb6
but is launched by the visualstudio 6 like a VS project
i d'ont want the crack or serial but just help how to find it

excuse for the short description but it mi poor english its hard to explain
and sorry again :)
JMI
04-25-2003, 01:00 PM
NLZ:

No need to be sorry. Just trying to have you give the information needed for someone here to actually help you. Perhaps you could post some of the code from the area where it checks if your serial is correct or incorrect and someone here can probably give you better directions on where to look next.

Regards.
bl00dk@
04-27-2003, 08:37 AM
With VisualBasic coded apps you could try breaking on MultiByteToWideChar. VB handle the serial in wide char, that means that if you search for your fake entered serial, let's say 12121212, you'll have to search on "31 00 32 00 31 00 32 00 31 00 32 00 31 00 32".

Also if the app gives you "Bad Serial" message, then break on it with MessageBoxIndirectA or RCTMsgBox(i can't remember if "rctmsgbox" is correct). When you break on the message, then return to apps code and scroll back in code window and set breakpoints on all suspecious CALL's like _VbaCmpStr and similiars, and then trace into them. Often you'll have to look far back in code.

JohnWho.


CyberHeg's sentinel crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > CyberHeg's sentinel crackme
PDA

View Full Version : CyberHeg's sentinel crackme

Rackmount
04-25-2003, 04:00 PM
Ok...I am working on Cyberhedge's sentinel crackme and so far have done the first trivial patch on SProFindFirstUnit. Now as I am reading several tut's on sentinel emulation, they seem to indicate that I need to set up an area of the program to read simulated dongle memory to emulate SProRead function. This gives me a few questions...
#1 It does not appear that the emulation patch occurs at the beginning on the sproread function , but actually is initiated after several lines of the function have already been executed. To me, the sproread code in the crackme seems very similar to what Goatass shows in his FlexiSIGN PRO tut, so I believe that my patch would begin at:

004079c0 mov word ptr [esi+30h], 0Ah

The other tut's seem to initiate patch at a jump which is either nop'd or made to jump to following instruction. Question: why are the starting locations of these emulations different (or are they different)? I dont have the code preceding the patchs for Crackz tut's so I cant compare what is done before patch insertion. In Goatass' tut he seems to do patch after a buffer has been set up in EDI to hold returned WORD from the dongle.

#2 Simulated dongle memory. OH you mean in order to simulate the dongle I need to know what in in its memory so I can simulate it? Not really sure what information I need to hardcode in order to get this done.

#3 Where to hardcode simulated dongle memory. In past experience with adding code I have always used whatever space I can find that will fit what is needed. I believe that as long as I can find a space, I can redirect the routine there and back...no problems...right?

It could be that once the above questions are explained I will once again be using the hammer of knowledge adjustment on my brain (or computer) This is interesting and I am having fun...no really...I am...I swear...lol Ok...I may need a bit of hand holding through this...but eh, that is why this is a newbies forum right?
ZaiRoN
04-25-2003, 06:14 PM
Hi Rackmount,

I moved your thread in this area because it could be an interesting project. It could be an occasion in order to learn something on the dongle. I am not so confident with dongle but I think these tutorials can help:

http://www.woodmann.net/fravia/cyberheg_lm_dongle.htm
http://www.woodmann.net/fravia/goatass_flexitut.htm
http://www.woodmann.net/crackz/Tutorials/Cyberheg4.htm

If you have other useful tutorials/resources (or something else) for this kind of application feel free to tells us:-)
I will try this crackme in the next days and I hope other guys will help you :-)

Regards,
ZaiRoN
CrackZ
04-27-2003, 07:06 AM
Hiya,

I attach my solution plus the original source code to the CrackMe purely for reference ;-).

Regards

CrackZ.
ZaiRoN
04-27-2003, 11:03 AM
Hi Rackmount,

#1.
You can patch the function wherever you want, no need to start exactly at 4079C0. It depends on the code you want to add. Pay attention to the stack...

#2.
Yes, if you want to simulate the dongle you need to understand what the crackme wants to read from the dongle data (or packet record). Take a look at the messages displayed by crackme (i.e. 'Dongle not found') and try to understand the reason why these messages are showed.

#3.
you are right, you can put the dongle data inside one of the free spaces of the file.

Regards,
ZaiRoN
cyberheg
04-27-2003, 02:22 PM
It's funny. My crackme never got so much attention as now. I am wondering why it took 2 years for people to find it.

Even though CrackZ posted my source code I think you should better try without reading it to not spoil the fun.
The only difference between the code posted and my original code is my solution which I had to rip out to not expose my real dongle data (yes, I bought a dongle devkit).

If you need the most recent sdk (manual etc.) you can get it from http://www.perico.no/downloads/SSP631CD.zip
It's a 160 mb whopper though since it's a complete iso cd image.

Another thing... My nick is not CyberHedge !?

// CyberHeg
Rackmount
04-28-2003, 09:53 AM
Zairon: A wonderful idea to make this a group effort....now I can share my growing pains...lol

CyberHeg: I appologize...musta had the dang name mangler on in my head.

I will post my progeress as it occurs along this thread..(don't hold your breath though as it could be slow) As previously mentioned I am at the point of emulating the SProread function now....so far I just crash the proggie...but hey what's a little page fault between friends right? If I get too hung up...I will post my replacement code for those of you in the know to disect and discuss. Until next we meet again..fair the well.

Rackmount
ZaiRoN
04-28-2003, 01:32 PM
Hi Rackmount,
As previously mentioned I am at the point of emulating the SProread function now....so far I just crash the proggieFeel free to post your code, we will try to help you :)
It's funny. My crackme never got so much attention as now. I am wondering why it took 2 years for people to find it.LOL! It's a very nice crackme; I had a lot of fun in solving it!

ZaiRoN
Rackmount
05-01-2003, 11:25 AM
Ok....so far I have "fixed" the SProFindFirstUnit and now the SProRead function. Initially when the program was run, it would only say "Dongle not found" Now, it actually says something like:
Program feature item 1, not enabled
Program feature item 2, not enabled
Program feature item 3, not enabled
Program feature item 4, not enabled
Wow...I am doin' good!!! I have more information to work with now...4 features...woo hoo! but they are not enabled...bummer...this need to be fixed ASAP! (so I can dance and sing in celebration!) OK here is what I am doing now to gather the required info...opened a beer, and then another...oops...you guys don't need this much information...lol

Now really... I have set SICE to break on all calls to SProRead and am noting what cells are trying to be read. IDA has nicely indicated my SProQuery function so I will need to see if I can break on that...why? because I can! Oh, am I getting ahead of myself? Maybe another beer will help (sure can't hurt...lol). Ok what I have seen from the tut's at this point is trace the functions to see what is being done with the read WORDs. So, a tracing I will go (I hear it can be very scarey in those cold and dark code woods this time of year...better pack a debugger just in case).

Narration: So once again our brave (would-be) hero marches off into the cold and dark and slightly damp (ok not really damp, but it just seemed to fit) code woods. Will he need his debugger? What mysterious code creatures await him in this journey? Stay tuned for the next episode...

Rackmount
ZaiRoN
05-02-2003, 12:43 PM
Hi Rackmount,

before replying to you I will write a little summary of my initial approach to the crackme and an example to use map and sym files.

Reading the tutorials mentioned before, I downloaded IDA's "Sentinel Superpro lib" signature:
http://www.woodmann.net/crackz/Tools/Dongles/Dongsigs.zip
I recommend to download this file because it will help you in recognizing the function used by the dongle.

Load the file into IDA and then, when the initial autoanalysis is finished, apply the new signature; click on: 'File/Load File/Flirt Signature File'. In the new window you have to choose the right signature; scroll down until you reach Sentinel Super Pro. There are 2 different signatures for the spro, I chose the one written by CyberHeg only because I suppose is the most recent version of the signature (CyberHeg, is it right?) Well, apply the sig! As you can see, all the functions used by the crackme are clearly visible. Now, it's more easy to study the disassembled
file.

------------------------------
An example for Rackmount's thread in the 'tools of the trade' section: Map file.
what about to see the name of these new functions -I mean sproinitialize, sproread... and also the renamed variables (and so on)- in Softice's code window? This is possible using map file produced by IDA.
I don't think many people uses map file but (imho) it's a very useful feature! We will see how to create the map file with ida and how to apply it to softice.

In IDA, click on 'File/Produce/Create Map File' and create the file. Now, look for msym.exe; it's a simple 16-bit application located inside 'Softice\util16' directory. This utility converts .map file into .sym file; this convertion is necessary because .sym is the extension needed by symbol loader. When the .sym file is been created you have to run Symbol Loder. 'File/Open' to open the .sym file created before. Load it using 'Module/Load'. If everything is gone fine you will see the message:
----- '<Drive>:\<Path>\SPRO.SYM' symbols loaded -----

Well, we have almost complete the job; infact, the initialization is done and we need to load the file sprocrackme.exe. Open the exe file but don't load it yet; you need to know how to relocate the symbol base. This last task of our job is not done by default, you need to tell softice how to relocate the symbols. 'Symloc' is the command that we will use. The most generic form is:
symloc <section-number> <selector> <linear-address>
where:
<section-number> is the number of the section where to apply the symbols, the first section is '1', the second is '2' and so on
<selector> is the... selector
<linear-address> is the base address of the section.
As you can see, you can't relocate all the symbols into the entire file but you have to relocate every single section.
Now, you can load the file and when sice breaks you can use the symloc command. In this specific case I used:
symloc 1 1b 401000
where:
1 is the first section
1b is the selector, the value of CS register
401000 the base address of the .code section

No need to use symloc on other sections. If you have forgotten to recover the section and his base address do not despair because you can do it inside Softice using the 'Map32 Sprocrackme' command.

Ok, we have finished! Now you can step your code viewing all the names you need :)
------------------------------

Ok, back to the crackme.
Running the crackme you will see a messagebox showing this message: "General error! Status code is 12". Our first task is to kill this nag. Looking through the code you will find where the message box is called from:.text:004010E7 push offset packetRecord ; the packet record
.text:004010EC call _RNBOsproInitialize@4 ; initialize sentinel system driver
.text:004010F1 push eax ; eax = the status code
.text:004010F2 mov word_4112BC, ax
.text:004010F8 call sub_401230 ; display the message if ax!=0
...
.text:00401230 mov eax, [esp+arg_0]
.text:00401234 sub esp, 400h
.text:0040123A test ax, ax ; eax != 0 then messagebox
.text:0040123D jz short loc_40126BWe must have ax=0 at 4010F1. We need to patch RNBOsproInitialize! This task is very simple..text:004075B5 mov edi, [esp+0Ch+arg_0]
.text:004075B9 or edi, edi
.text:004075BB jnz short loc_4075C9 ; to modify
.text:004075BD mov ax, 2 ; to modify
.text:004075C1 pop edi
.text:004075C2 pop esi
.text:004075C3 add esp, 4
.text:004075C6 retn 4I changed the two instructions in:

xor eax, eax
nop
nop
nop
nop

There are infinite manners to solve this problem, choosing one is enough :)

First problem solved! Now we need to take care of the message 'Dongle not found'.A simple search inside the code will reveal:.text:00401400 mov eax, dword_410E0C
.text:00401405 test eax, eax
.text:00401407 jnz short loc_40141D
.text:00401409 push offset aDongleNotFound ; "Dongle not found\n"
.text:0040140E call _printf ; display the errorThe error message is shown if dword_410E0C==0. We need to locate where the proggie changes this dword. I use IDA's xrefs to perform this kind of operations. Click above the dword_410E0c and hit 'x', a dialog will appear and will show:

w _main+13D mov dword_410E0C, esi ; w: something is written in the dword
r sub_401400 mov eax, dword_410E0C ; r: the dword value is readed

Obviously, the one we are looking for is the first line. Double click on the line:.text:00401105 mov ax, word_40E036
.text:0040110B push offset unk_40E040 ; word_40E040 will contain the word
readed by the function
.text:00401110 push eax ; cell to read at address 3Fh
.text:00401111 push offset packetRecord
.text:00401116 call _RNBOsproRead@12 ; RNBOsproRead(x,x,x)
.text:0040111B and eax, 0FFFFh
.text:00401120 mov dword_410E60, eax
.text:00401125 call sub_401390
.text:0040112A mov eax, dword_410E54
.text:0040112F xor esi, esi ; esi = 0
.text:00401131 cmp eax, esi
.text:00401133 jnz short loc_40113D
.text:00401135 cmp dword_410E60, esi
.text:0040113B jz short loc_401145
.text:0040113D
.text:0040113D loc_40113D: ; CODE XREF: _main+133j
.text:0040113D mov dword_410E0C, esi ; mov 0 in 410E0C
.text:00401143 jmp short loc_401161Tracing the proggie I have found that the word pointed by 410E0C is initialized to 63h, a simple bpm will show you the address where the word is initialized. Ok, we know that the instruction at 40113D must be avoided, how is it possible (Remember that you can patch only superpro functions)? Simple:
1. 410E54 must be 0
2. 410E60 must be 0

1.
Using xrefs you will arrive where the dword is changed:.text:0040161C call _RNBOsproFindFirstUnit@8 ; RNBOsproFindFirstUnit(x,x)
.text:00401621 and eax, 0FFFFh ; return value is ax=0039
.text:00401626 mov dword_410E54, eax
.text:0040162B retnIs it possible to mov 0 in 410E54? Sure, patching the sproFindFirstUnit function. As before, there are many ways to patch this function, here is mine:.text:004077C6 mov word ptr [esi+6], 0B39h
.text:004077CC mov ax, 39h ; change in 'mov ax,0'
.text:004077D0 pop esi
.text:004077D1 pop ebx
.text:004077D2 retn 82.
410E60 contains the value returned from sproRead function. In particular, the value is taken from the dongle's cell at address 3Fh. The idea is to emulate the dongle patching the sproRead function to make it return zero when the cell to be read is the number 3Fh. If you have readed the tutorials linked above you should already know how to emulate the dongle :)

Rackmount, I can't fully understand your problem.
You have passed this task and, I suppose you have patched the sproRead function. How have you changed the function? Have you putted 0 to eax at the end of the function or, have you emulated the dongle?

ZaiRoN
Rackmount
05-02-2003, 01:26 PM
ZaiRon:

I am by no means a graceful programmer. I hit things with a sledgehammer to fix them. For me on my system, I did not even get the first error message you show. This crackme runs as a DOS box...no messagebox breaks...as of yet. The first patch I did was on the FindFirstUnit in which I patched as follows:

00407790 push ebx
00407791 push esi
00407792 mov eax, [esp+arg_0]
00407796 xor eax, eax ; was: or eax,eax
00407798 jz short loc_40779E ; always jumps now
0040779A mov ax, 2 ; ignored
0040779E pop esi
0040779F pop ebx
004077A0 retn 8

The second patch is at SProRead function and is almost identical to the code in Cyberheg's Sentinel License Manager Cracking tut starting right after the validate packet record line in this function. So far, all I have are zeros in the emulated dongle memory space. After I gain some insights from tracing I will place "stuff" in the memory area.

Your approach is far better at understanding the why aspects...mine is simply hitting the functions with a hammer without respect for the reasons...of course, I wouldn't want to bet that the hammer will work beyond where I am now. At this point, I believe that I will have to start paying attention to my surroundings and actually follow what is going on...and why (as you have done).

Thank you for the example on the SYMLOC function. I found it to be exactly what I needed to get it working.

Rackmount
ZaiRoN
05-02-2003, 03:08 PM
Hi,For me on my system, I did not even get the first error message you show.This message is dependent by the os; inside sproInitialize there is a call to GetVersion... For me, the message is showed in winxp but not in w98.

ZaiRoN
Rackmount
05-02-2003, 04:07 PM
ZaiRon...Hola amigo:

So....now you know my OS...lol. Hey, the SYMLOC is not quite right...I made the sym file as described and opened and loaded with loader. I then opened sprocrackme.exe with loader, but didn't load, broke into SICE with Ctrl-D and entered SYMLOC 1 1b 401000, F-5'd back to loader and loaded the exe...looked around and....no symbols! Did I miss something?

I have noticed that when the prog first starts it is in the 408000 range and then after a bit of initialization routines it heads south to 401000. This affected my breaks on the SProRead calls which was rectified once I stepped up tp the code that began in 401000. i.e. When I initially set a break on 401116 it said something like "out of range", but once I got to the 401000 section it broke just fine....could this be affecting the symbol loading?

Rackmount
ZaiRoN
05-02-2003, 04:39 PM
Hi Rackmount,

I think it's my fault, sorry. I forgot to tell you when to use the symloc command. I added a new line in my previous post (the one in italic form):
"As you can see, you can't relocate all the symbols into the entire file but you have to relocate every single section.
Now, you can load the file and when sice breaks you can use the symloc command.
In this specific case I used:
symloc 1 1b 401000"

Using sym command you can see if you have loaded symbols.
I hope this will solve your problem.

ZaiRoN
cyberheg
05-03-2003, 01:37 AM
Originally posted by ZaiRoN
Hi,This message is dependent by the os; inside sproInitialize there is a call to GetVersion... For me, the message is showed in winxp but not in w98.

ZaiRoN

The error message usually just happens because you're not having the Sentinel Super Pro driver installed, not because of the OS you're using. Lots of software installs all kinda drivers without you knowing it so I guess you just had the driver installed by luck on one OS while not on the other.

// CyberHeg
sope
05-03-2003, 03:23 AM
Hello ZaiRoN

Thanks for the info provided on map to symbol file & its importance :) I did not knew about the method you described above.

Methods i knew were are below:

Method (1) :
Create a Map from IDA file then i run a utility "mapsym.exe" which creates .sym file for the respective map file. Next i run "nmsym.exe" inside softice folder on the created .sym file which outputs a ".nms" file which i load editing the winice.dat file
putting below line

LOAD=G:\SIW405\sig.nms <--- and then reboot the machine.

Method (2):
Since i normally play with 10 to 15 MB file size sometimes while converting the .sym file from the map file using the utility "mapsym.exe" i get some errors "string not found". So in that case i use great IDA Plugin from Mostek to create ".nms" file.

Regards
Sope!
Rackmount
05-05-2003, 09:38 AM
Well...I have achieved success on at least one issue. The SYMLOC function is now workingh quite well thanks to ZaiRoN and sope. Now I have options...woo hoo! My problem was blindly inputting what ZaiRoN indicated without following what was going on with my computer. In my case the CS register was 016f and not 1b. By checking the SYM function I was able to see where my symbols had loaded, then doing a MAP32 <progname> I saw where my program was located. Once the correction was made to bring the symbols in line with the correct CS, I had a roadmap to my programs code in SICE....nice.

A nice "trick?" I noticed in the crackme...some calls to SProRead use EAX for key cell, others use EDX. I noticed this after marking down all EAX values during my SICE breaks to this function. Some of the values didn't look to be within possible cell ranges...according to the Sentinel manual, each key has 128 bytes of memory organized as 64 cells with addresses of 00 to 3F, yet I had a value of 102h in EAX in four calls. Stepping out of the read function confirmed that in several calls the key cell address was pushed in EDX instead of EAX. OK so now I know what cells are being read, it is time to follow the store addresses to follow changes to feel what must go in my emulated dongle memory. (Side note: at this point, without the imposed rules, the proggie might be owned by changing the last few conditional jumps in the feature enabled/disabled check routine. This is inelegant and could work on some proggies, but may also leave you very "buggy" cracks....err I mean "fixes")

Hey...this isn't a timed test is it? lol Maybe not, as in the text of the crackme it says this is a time consuming effort. Anyway...this is my current status on the crackme.

(Oh...on a side note...I have applied these same sentinel emulations to my own personal target...and man did it get pissed...lol. It could be self checking...or maybe it is because I haven't fed its emulated memory yet. But on one side, the initial splash screen doesn't come up saying DEMO, but the proggie crashes shortly past the splash screen routine. An interesting thing I have seen on my target from an IDA disassembly, there appear to be no xrefs to the SProQuery function. Could it be that this company did not even use its dongle properly? But, if this were the case, wouldn't my forcing the SProRead function to return SP_Success have "fixed" this program?)

Rackmount
cah
05-27-2003, 01:43 AM
Hi cyberheg!

I downloaded SSP631CD.ZIP, but unable to unzip & CRC fail in & file corrupt.

Please rezip into sizable volumes (~10 mb) for ease of downloading.

Please check your PM
CaH
FoxB
05-27-2003, 07:18 AM
Hi!

Direct link:
ftp://ftp.rtcs.ru/Pub/drm/sx/6.3.1/sx-6.3.1-image.zip

FoxB
JMI
05-27-2003, 10:31 AM
FoxB:

There's nothing in this directory.

cah:

The file is an "iso" file. Try unpacking it with winrar. Mine seems to work fine. You need a cd burning program to burn the iso to disk and the software to do that.

Regards,
FoxB
05-27-2003, 10:06 PM
To JMI,

Work link:
http://www.pericosecurity.com/downloads/SSP631CD.zip

FoxB
ramin_rad2000
02-26-2004, 02:58 AM
dsadHi ,I am working on cyberhege sentinel spro crackme but i am really lost in the darkness and i need help!(sorry for my bad english cause it is not my mothers language)
i used softice and ida
this is the first call to sproread,i need to know which words are dongle expected?

.text:00401105 mov ax, word_0_40E036
.text:0040110b push offset unk_0_40E040 ---->bpm on this loc
.text:00401110 push eax
.text:00401111 push offset unk_0_410EB8 --->packet record
.text:00401116 call _RNBOsproRead@12

in sice i used bpmw-d-b(all of them) 016f:(ds register)0040E040 r
but i didn't work.

.text:0040111B and eax, 0FFFFh
.text:00401120 mov dword_0_410E60, eax
.text:00401125 call sub_0_401390

.text:00401390 mov eax, word_0_40E03A
.text:00401396 push offset word_0_40E042 --->bpm(like above)
.text:0040139B push eax
.text:0040139C push offset unk_0_410EB8
.text:004013A1 call _RNBOsproRead@12
.text:004013A6 mov cx, word_0_40E03C
.text:004013AD push offset dword_0_40E044 --->bpm(like above)
.text:004013B2 and eax, 0FFFFh
.text:004013B7 push ecx
.text:004013B8 push offset unk_0_410EB8
.text:004013BD mov dword_0_410E64, eax
.text:004013C2 call _RNBOsproRead@12
.text:004013C7 mov dx, word_0_40E03E
.text:004013CE push offset dword_0_4112C0 --->bpm(like above)
.text:004013D3 and eax, 0FFFFh
.text:004013D8 push edx
.text:004013D9 push offset unk_0_410EB8
.text:004013DE mov dword_0_410E68, eax
.text:004013E3 call _RNBOsproRead@12

and here is emulated sproread(part of):

.text:004079C0 push ebp
.text:004079C1 lea edx, ds:410EFFh ---->store dongle code here?
.text:004079C7 shl ecx, 1
.text:004079C9 mov ebp, ecx
.text:004079CB add ebp, edx
.text:004079CD mov eax, [ebp+0]
.text:004079D0 pop ebp
.text:004079D1 mov dx, 400h
.text:004079D5 mov [esi+6], dx
.text:004079D9 nop
.text:004079DA nop
.text:004079DB nop
.text:004079DC nop
.text:004079DD mov [edi], ax
.text:004079E0
.text:004079E0 loc_0_4079E0: ; CODE XREF: .text:004079FE j
.text:004079E0 mov ax, [esi+6]
.text:004079E4 push eax
.text:004079E5 call sub_0_406F90 ; _I386SPRO500MSFTCIE@4
.text:004079EA pop edi
.text:004079EB pop esi
.text:004079EC retn 0Ch

I didn't calculate the delta offset cause i didn't understand it in other tutorials about sentinel,i thought i can simply put dongle words some where sutiable at the end of rdata or data(i can extend sections right?) this emulate function always return 0000 in ax,and i patched the sprofindfirstunit
correctly(simple)
cyberheg
04-02-2004, 01:17 AM
I havn't been following the discussion too closely but didn't any of you beat it yet? :)
I must say I am surprised people first caught attention on it now when its 2 years since I made the crackme. :rolleyes:

Another thing is my nick is CyberHeg not cyberhedge or whatever people calls me :mad:

-- CyberHeg


Softice and the clock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice and the clock
PDA

View Full Version : Softice and the clock

Fluxo
04-25-2003, 07:37 PM
I feel rather silly asking this, but here goes:

When I'm in softice, the clock stops also. So if I'm in softice for 5 minutes, when I come out of it then it will still be the same time on my pc clock as when I went into softice. Therefore I lose 5 minutes and have to re-set the clock again.

Is this meant to happen? I understand that breaking into softice stops everything, but I always thought the clock was a hardware thing and not software run. Am I missing an option or something?
naides
04-26-2003, 12:16 AM
I feel rather silly asking this, but here goes:

When I'm in softice, the clock stops also. So if I'm in softice for 5 minutes, when I come out of it then it will still be the same time on my pc clock as when I went into softice. Therefore I lose 5 minutes and have to re-set the clock again.

This question has been asked before. You may search back in the board, I even remember that some body upload a small app that would re-update the clock for you

Is this meant to happen? I understand that breaking into softice stops everything, but I always thought the clock was a hardware thing and not software run. Am I missing an option or something?

I do not think there is a sice option that prevents this problem. The CMOS clock keeps going, but the OS clock is updated by a hardware interrupt, which is not allowed while Sice is running.

It
Kayaker
04-26-2003, 02:46 AM
"But I searched the freaking board and found diddly-squat!", some might say.

Yes you're right, "Softice + clock" *should* find the thread Naides mentions, but the Search function isn't at 100% right now it seems and doesn't pick up the months-old thread. Sucks, so we'll have be even-handed towards search problems for a while.

Some people seem to have problems with this, others don't, it seems somewhat dependant on your system. You either ignore the problem, use it as a game and try to beat your old record of spending time in Softice (Woohoo, I lost 16 hours today!), reboot your system, or for fun write an app that reads the RTC real time CMOS clock via Ports 70-71 and updates the system clock.

Kayaker
ZaiRoN
04-26-2003, 04:59 AM
Hi,

for those who have problems in finding the right thread, here is the thread:
http://www.woodmann.net/forum/showthread.php?threadid=2554

ZaiRoN
dELTA
04-26-2003, 05:16 AM
The tool TimeFix 1.01 (http://www.woodmann.net/protools/files/debuggers/timefix.zip) from the Protools site should supposedly fix this problem too. Didn't try it myself though.

dELTA
beowl
04-27-2003, 12:51 AM
yeah softice always freezes ur system clock. maybe the fixer plugin works

years ago when I started reversing, I quickly learned that softice was like a quicksand where I fall in and never return. Time stops... Why is the sun rising? it's only 2 AM.........................OH.


disassembling a console app
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > disassembling a console app
PDA

View Full Version : disassembling a console app

sirdan
04-26-2003, 01:35 PM
Hello. I want to disassemble a small win32 console app and be able to re-assemble it with masm so i can use its functions from within my own app. Will any disassemblers do this? Are there any better ways to achieve this? I am basically building a front end for a console utillity, but would like it to be one file instead of two. Hook me up bruthas!

SD
squidge
04-26-2003, 03:32 PM
IDA Pro / Code Snippet Creator.


Bashing ARC Render v9.0 - Strange HASP_Prot
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Bashing ARC Render v9.0 - Strange HASP_Prot
PDA

View Full Version : Bashing ARC Render v9.0 - Strange HASP_Prot

OHPen
04-26-2003, 04:44 PM
Hi,

it's me OHPen, man doesn't come along with HASP ;(

I have found a new target, after i have finished the last HASP-Project.

But this one is interesting as well...

You can take a look here:

ftp://63.249.181.10/pub/ARCRenderPro9/ArcRender.zip

This target does't use any HASP-DLL for its protection. Does it be possible that HASP is kinda "statically linked" into the target ?

After installing and starting it the first time you got a message "No protection device is conneted...."

After siceing a bit i found an interesting DLL called GwGenFrm.dll
which seems to be the one from which the HASP is called from.
Only this DLL is used to do the common HASP-Checks.

I found several Ex-Function of interest:

Exported fn(): ?IsHaspPluged@CGRenderFrame@@QAEHXZ - Ord:047Eh
Exported fn(): ?IsRealHaspPluged@CGRenderFrame@@QAEHXZ - Ord:0480h
Exported fn(): ?IsSameHaspConnected@CGRenderFrame@@QAEHXZ - Ord:0481hExported fn(): ?LimitHaspPermission@CGRenderFrame@@QAEHKKK@Z - Ord:0482h

etc...

?IsHaspPluged@CGRenderFrame@@QAEHXZ

this func is called on startup to check for hasp dongle pluged.

Exported fn(): ?IsHaspPluged@CGRenderFrame@@QAEHXZ - Ord:047Eh
:10017900 56 push esi
:10017901 8BF1 mov esi, ecx
* Reference To: GWGENFRM.?HaspInDemoMode@CGRenderFrame@@QAEHXZ
|
:10017903 E8880A0000 call 10018390
:10017908 85C0 test eax, eax
:1001790A 7407 je 10017913

* Possible Reference to String Resource ID=00001: "The application key numbers are Illegal.
Please try again or"
|
:1001790C B801000000 mov eax, 00000001
:10017911 5E pop esi
:10017912 C3 ret

After patch :1001790A 7407 je 10017913 the app believe a dongle is pluged.

Okay very well,
but after patching i have to enter some user information.

HASP S/N:

etc.

Maybe these is a very interesting implemention of hasp, maybe not.

Hope there is someone who can give me some advise.

Thx in advance.

OHPen_Learning HASP ;)
CrackZ
04-27-2003, 06:58 AM
Hiya,

Theres nothing special about ArcRender as an HASP implementation, its straight HASP API in GwGenFrm.dll, actually you'll find a new style HASP API in eusys.dll too, but you won't need to patch it unless you use its functions.

The insert serial number dialog won't appear if you get the contents of the dongles memory correct, as I remember its a few DWORDS read, maths including the serial number to check validity then a read of another word for the expiry. I know a LOT about this program since I remember reversing the dongles contents, this isn't for the faint hearted.

Regards

CrackZ.
OHPen
04-27-2003, 07:56 AM
Thx for your replay CrackZ,

you mean i should stop trying this target 'cause it's a very advanced one ?

Maybe you are right...

I will try another target,

OHPen
scorpie
05-02-2003, 07:57 AM
Hello OHPen,

As CrackZ mentioned, have a look the file GwGenFrm.dll, and check the contents of the dongle cells: 00, 01, 05, 06, 07, 08, 0B, and 0C. Cells 00, 01 form the Serial numbers, while the others are checked with some "math functions" (partly check the HASP ID).

Good Luck.

Scorpie


How to find Offset
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to find Offset
PDA

View Full Version : How to find Offset

Zkhan13
04-26-2003, 08:25 PM
I am trying to patch a CD-ROM check of a Telephone directory CD.
I almost done it through Soft Ice.But i cant make it a Permanent One.Next time when i starts. it was again as Old.
How i will find the Offset of that code in Soft Ice it self, so that i could Use HIEW and Goto that Offset then patch my program..
How i could find the offset of that code in Soft Ice.
naides
04-26-2003, 10:56 PM
Originally posted by Zkhan13
I am trying to patch a CD-ROM check of a Telephone directory CD.
I almost done it through Soft Ice.But i cant make it a Permanent One.Next time when i starts. it was again as Old.
How i will find the Offset of that code in Soft Ice it self, so that i could Use HIEW and Goto that Offset then patch my program..
How i could find the offset of that code in Soft Ice.

Simple Way:

Make sure you have CODE ON in SoftIce

Write down 10 to 20 bytes around the area you want to patch. try to include bytes corresponding to stuff that is unique (call to an discreet address in your program, read an absolute reference in memory), not repetitive( the push ebp, mov ebp, esp stuff wich occurs 1000's of times inside the code).

Then in Hiew use the search (F7) command and type in the bytes you noted around your key instruction. Remeber to have HIEW in decode mode, so you will recognize your asm code.

More convoluted way:

Learn the concept of ImageBase, physical offset versus memory offset and the PE header structure. you will find that the address you see in Sice MINUS the ImageBase is usually the address you have to GOTO (F5) in HIEW.

There are other solutions to this minor problem, but my favorite is 'Simple Way '
above
bl00dk@
04-27-2003, 08:11 AM
You could also use a tool like "RVA to offset" which is attached to this post. Push the button "File" and select the file you want the offset from, and put the address you got from sice into the "Memory Address" text field and press "Do it". If the target is packed, "RVA to offset" won't help you.

Personally i use the search method in Hview, which i edit almost everything in, great tool.

JohnWho.
diz
04-27-2003, 05:56 PM
and the Simplest Way:

press F5 in Hiew and put address from SICE preceeded with dot; like .480064
Zkhan13
04-28-2003, 12:40 AM
Wow!!..Great...
This was my first Post to this forum.I thought everybody will ignore me...B'cze i have no answer if somebody would come and say "Hey Dood u don't even know how to Find an Offset and u trying to Reverse Engineer"?!!..
But the Posts are Excellent..
Thanx a Lot


CDQ and IDIV Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > CDQ and IDIV Help
PDA

View Full Version : CDQ and IDIV Help

TRACER
04-27-2003, 02:30 AM
1)What is the problem....
I am trying to find out what a program is doing to get the next number in a serial. I do not fully understand these lines:

mov eax, dword ptr (ebp-04)
cdq
push 0000001F
pop esi
idiv esi
mov al, byte ptr (ebp+edx-24)

I know that it is taking the number in EAX and divides it by 1F, but my problem is I can not figure out, the number in EDX.

IE EAX = 317 and the number in EDX is A.

2)What is the protection.....
SERIAL
3)What tools are you using....
W32DSM, ULTRAEDIT32, SOFTICE
4)What tutorials have you read....
ALOT
5)Show your output listing WITH comments....
?
6)NOW ask your question....
What the heck is going on with EDX.
squidge
04-27-2003, 03:48 AM
the CDQ will convert your 32-bit EAX into 64-bit by using EAX:EDX

idiv will put the quotient of the division in EAX, and the remainder in EDX.
banshee
04-27-2003, 02:52 PM
To continue squidge I'd suggest that there is some array at ebp-24 address which lenght = 1e bytes and finally you have at al some value from that array.

(But as meant by squidge you had to guess it yourself :D )
squidge
04-27-2003, 04:30 PM
Heh, damn right :D

TRACER asked what was going on with EDX, so I told him. Nothing more, nothing less :)
Dedec0
04-27-2003, 06:29 PM
:) This remembered me when I was analising the code of SplishSplash... I didn't know about these two instructions too, but I keep an Opcode reference with me always... you should do the same. :)

Regards,
TRACER
04-28-2003, 04:22 AM
Thank you for your assistance. I have found that if I take the hex value and convert it to decimal then divide that by 31 (1F) then divide the remainder by 31 again I get the value that is in EDX in decimal form. Problem now is rounding. I already have figured out how to patch the program and the actual serial, but I am trying to write a keygenerator. The program uses the machine code to create a serial.
banshee
04-28-2003, 01:28 PM
I already have figured out how to patch the program and the actual serial,

if the true serial appears in the program the most simple way is to make keygenerator inside the main application. Usually there is msgbox saying "you're bad guy bla bla". By changing address of that annoying string to address where the true serial is stored you'll get working keygen. Such programs make me crying.:(
:D :D :D
TRACER
04-30-2003, 11:01 PM
Thank you Banshee for the tip. I do not know how to perform that task that you have explained above. Could you possibly tell me where I might find a tutorial on that subject? Not to repeat myself in another forum on this site, but I have successfully written the keygenerators for the programs. I would like to improve them by automatically getting the "Machine Code" of the computer ie("3355794638"), but I don't know were it is located. Heck I don't even know were the programs are getting that number. Help on that subject would be great.
dELTA
05-01-2003, 11:52 AM
See my reply in the advanced forum.

dELTA


VB p-code IDA plugin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > VB p-code IDA plugin
PDA

View Full Version : VB p-code IDA plugin

banshee
04-27-2003, 05:08 PM
Anybody ever heard about plugin for IDA to decompile Visual Basic p-code? On that page Ilfak says that such thing is impossible because "its format and descriptions are not available".

h**p://www.datarescue.com/cgi-local/ultimatebb.cgi?ubb=get_topic&f=1&t=000406&p=

But there is WKTVBDE - that allows to debug p-code vb apps. And I assume the authors of that tool have complete definition of all opcodes. What would they say? (If they're here).
disavowed
04-27-2003, 07:07 PM
as impressive a tool as wktvbde is, i don't think the authors have complete definition of all the pcode "opcodes" (this is by no means meant to take away from the program or the authors.. i think it's an outstanding piece of work). i think ilfak might mean that microsoft hasn't publicly published the format and descriptions, and if ida were to support pcode, it would have to rely on information gathered through illegal reverse engineering (i say illegal because it of course is illegal to reverse engineer most any piece of microsoft code). i don't think ilfak wants any kind of legal trouble.

note that this is all based on assumptions, and i don't know for sure that these are the facts :)
mrsilver
04-28-2003, 01:27 PM
Hi all! First of all, we (mr silver and mr snow) gathered the opcode information trought reverse engineering methods, if you check the help file that comes with WKTVBDebugger you'll see that we've included all the opcode tables including the name of each opcode and their size. We know that IDA it's a comercial product so it's clear that Ilfak don't want any kind of trouble with M$. Any experienced C programmer could build that plugin you mention here be working with the info provided either by wktvbdebugger or exdec and of course never forget the debugging symbols of the vb virtual machine :), you can download them from M$. If any of you is interested i wrote some papers (only in spanish) talking about how we get all this info and put them together to build the debugger so just let me know and i'll drop it here :)

Mr. Silver
dELTA
04-28-2003, 06:18 PM
Thanks for the info mrsilver, you are very welcome to share your papers here.

dELTA
naides
04-28-2003, 08:21 PM
I volunteer to do the translations if more than 5 ppl are interested

PM me
mrsilver
04-29-2003, 02:52 AM
Here it is , it was posted in a spanish mailing list some time ago. I don't have the time to translate it cos i wrote this paper from my own notes and from a scracth.
Misteriously M$ has removed some links that i'm pointing here I don't know the reason :D

If you need more info just let me know and i'll try to do my best.
dELTA
04-29-2003, 01:45 PM
Thanks mrsilver, now all I have to do is learn spanish, and I'm all set to go. ;)

Naides, I'm sure more than 5 people are interested, it would be great if you could translate it!

Ok, come on people, put your signatures below, we need 5 of them.

dELTA

PS.
Everyone not signing this will be kicked/banned from the board. :D
JMI
04-29-2003, 01:57 PM
Well then allow me to add the ubiquitous: ME TOO (he said shouting). If you want, I'll sign in as some other people and post their names also... :D

Regards (from the mySQL wanabe expert with much to learn),
LOUZEW
04-29-2003, 02:38 PM
OK naides, Delta, JMI and maybe other.
you can count me too !
I'm waiting for a translation, cause i can understand nothing (wrong : only 3 or 4 words in Spanish).

Thank's for your help !
Hopcode
04-29-2003, 02:49 PM
hey hey

im also insterrested by pcode informations!
Count me in :)
mrsilver
04-29-2003, 03:17 PM
Hi all again, seems that people is interested in the info, as I said before i'm busy these days (mainly finishing BDASM and it's web page and all the stuff that involves it), I don't know when I'll be able to translate this papers, i'll try to ask some of my spanish friends to translate them to english. By the way if anyboy that is reading this and understands spanish please if you have the time translate them :).

While the papers are waiting for translation i could point all of you to the following forum about vb decompilation:

http://www.decompiler.com

There you'll find some VB internal specifications published recently by other fellows :D

Keep the good work friends :D
dELTA
04-29-2003, 03:50 PM
mrsilver, I understand that you are busy and don't have time for translations (thanks for the forum link btw). If you look above in this thread, naides has already volunteered to do the translation if more than 5 people were interested, that's why I was asking for people to show their interest, not to pressure you. :)

Anyway, two signatures to go people...
*hovering mouse over mass-ban button* :D

Btw, I saw someone called "golem" was a moderator back at that forum, I wonder if it's our old friend... :)

dELTA
naides
04-29-2003, 05:33 PM
OK guys I am working on it. Gimme 24 hours
disavowed
04-29-2003, 07:16 PM
Originally posted by dELTA
Btw, I saw someone called "golem" was a moderator back at that forum, I wonder if it's our old friend... :)
hah.. the troll :)
JMI
04-30-2003, 01:56 AM
Didn't he get a job on "Lord of the Rings"? ;)

Regards,
mrsilver
04-30-2003, 02:15 AM
Hey naides, after you translate it, it will be good if you could send me a copy to mrsilver@softhome.net and i'll do a quick look to it before you post it here just to increase the correctnes with the original one. :)

Mr. Silver
Polaris
04-30-2003, 06:14 AM
Really a good idea!

I was thinking about writing some IDA plugin... So let's do this!! :)
Seems to be really interesting ! ! :D

Just awaiting some doc (in english) to start development.

Byeezzz ;)
naides
04-30-2003, 07:52 AM
Originally posted by mrsilver
Hey naides, after you translate it, it will be good if you could send me a copy to mrsilver@softhome.net and i'll do a quick look to it before you post it here just to increase the correctnes with the original one. :)

Mr. Silver

I was planning to do that.
naides
04-30-2003, 08:57 PM
OK i sent my translation to Mr Silver for proof-reading and corrections. Either he will post it here or I will when he gives me the green light
mrsilver
04-30-2003, 10:28 PM
Ok naides I've got the translation but it's to late here now 5:16 gonna go to sleep now, i'll check it tomorrow and post the corrections directly here during the morning to avoid delaying it (if you don't mind) :)

Nites ... xD
mrsilver
05-01-2003, 11:48 AM
Here it is the translation, let me now if you need more help :)
xixiaolou
05-01-2003, 10:43 PM
to mrsilver:

Sir:
I also study the decompile of vb6 app.
Though I can do as well as VBDE, I find your knowledge of vb decompile is advanced so far than mine. Especially pcode app structure shown in wkt vb debugger "advanced info" and your recognization of IDispatch Vptr used in pcode, such as
402780: 80 VCallAd: crackme1.text

I wonder how can you do it? Is just deassembled the msvbvm60.dll or see in vb6.olb?
Also I find some vptrs are losed in Idispatch or in vb6.olb, do you know the reason?

As you know,the structures of both of native and pcode vb6 app are same. May I suggest you extracting the function "advanced info" in wkt vb debugger as a single software?

I think for developping ida plunin, it is difficult in recognize the start of pcode data and what's name of this event , not the pcode opcode. Do you think so?

my mail: xixiaolou(at)hotmail(dot)com
I mail you last week, but mo reply.
mrsilver
05-02-2003, 03:40 AM
About the information shown by wktvbdebugger in the advanced info it's all documented in the link i've posted days ago (http://www.decompiler.com), about how to recognize methods called by objects, it a bit weird i've got to re-read my own code cos i don't remember very well how i did it. As far as i remember part of the opcode is and index (well you need to divide it by 4 to get the real index) after that you use should that index in the method table of that specific table to get the name of the method. That method table is hardcoded in wktvbdebugger because it's not located in the VM. ¿How you get the table of each object?, It's fairly easy there is .tbl file (these kind of files that you register inside VB compiler to make your controls to work, vb5???.tbl maybe don't have the file on my pc to check it) that contains the names and propierties of the objects. I was able to extract these tables and hardcode it inside wktvbdebugger. I've used a program that comes with VB wich showns you the hierarchy and structure of every object (also i don't remember the name and i don't have VB installed on my machine know to verify it :( )
This is and example of the table for a timer object that I've xtracted:

VB5Sym_Tab VB5Symb_Timer[39]= {
"QueryInterface",
"__stdcallAddRef",
"__stdcallRelease",
"GetTypeInfoCount",
"GetTypeInfo",
"GetIDsOfNames",
"Invoke",
"HctlDemandLoad",
"ChkProp",
"SetPropA",
"GetPropA",
"GetPropHsz",
"LoadProp",
"SaveProp",
"GetPalette",
"Reset",
"get_DefaultProp",
"put_DefaultProp",
"get__ipropCTLNAMETIMER",
"put__ipropCTLNAMETIMER",
"get__ipropINDEXTIMER",
"put__ipropINDEXTIMER",
"get__ipropENABLEDTIMER",
"put__ipropENABLEDTIMER",
"get__ipropINTERVALTIMER",
"put__ipropINTERVALTIMER",
"get__ipropPARENTTIMER",
"put__ipropPARENTTIMER",
"get__ipropTAGTIMER",
"put__ipropTAGTIMER",
"get__ipropLOCATIONTIMER",
"put__ipropLOCATIONTIMER",
"get__ipropLEFTNORUNTIMER",
"put__ipropLEFTNORUNTIMER",
"get__ipropTOPNORUNTIMER",
"put__ipropTOPNORUNTIMER",
"meth__imethADDITEM",
"meth__imethREMOVEITEM",
"meth__imethCLEAR"
};

get__* means you can retrieve the info for this propiertie

put__* means you can set the value of the propiertie

meth__* means that it's a method

and there are other commond methods for every object like the QueryInterface

How these gives you some clues :)
dELTA
05-02-2003, 06:34 AM
Thanks for the translation naides, and thanks for the proof-reading and original document mrsilver!

dELTA
banshee
05-02-2003, 12:02 PM
naides & mrsilver:
Thanks for translation and sharing the information.

mrsilver:
Do you have p-code instructions explaination? I mean, what this or that command does. I understand that such reference won't be full (I actually think it can't be full), but at least the most common opcodes? As far as I understand the structure of some mnemonics is slightly similar to x86 floating-point instructions and could be understood with a little assumption. But the others make a problem. I have two papers explaining that thing - one from John Chamberlain who wrote an article at Programmer's Heaven site (you should know, because you added comments there) and the other one is from h**p://www.decompiler.theautomaters.com. Both papers is not full. I'm trying to merge it and if you share some information (of course, if you have it) I'd add it to result file too. I think nowadays it's exciting topic :D and some people would be interested in such thing.
xixiaolou
05-02-2003, 10:28 PM
dear mrsilver:
Thanks for your apply.
2 Questions:

(1)you defined the IDispatch table of timer
VB5Sym_Tab VB5Symb_Timer[39]= {
"QueryInterface",
"__stdcallAddRef",
"__stdcallRelease",
"GetTypeInfoCount",
"GetTypeInfo",
"GetIDsOfNames",
"Invoke",
"HctlDemandLoad",
"ChkProp",
"SetPropA",
"GetPropA",
"GetPropHsz",
"LoadProp",
"SaveProp",
"GetPalette",
"Reset",
......

From first to seventh vptr are the standard beginning of IDispatch table, but how do you know other vptr names, such as "HctlDemandLoad", which is not index in the vb6.olb

(2)in textbox control, we can define the IDispatch table
......
Property Get _Default() As String ' call DWORD PTR [IDispatch+0x0040]
Property Let _Default(RHS As String)
Property Get Name() As String ' call DWORD PTR [IDispatch+0x0048]
Property Get Index() As Integer ' call DWORD PTR [IDispatch+0x0050]l
......

but after the vptr:
Property Get OLEDropMode() As Integer ' call DWORD PTR [IDispatch+0x01F0]
Is
Property Get CausesValidation() As Boolean ' call DWORD PTR [IDispatch+0x0230]
That means some vptrs are lost, do you know why?
mrsilver
05-03-2003, 07:55 PM
wich program r you using to see the object info?
xixiaolou
05-03-2003, 08:32 PM
There are some apps can do it, Such as MS ole viewer with vb6 installed. tlbviewer, even you can write a tiny program to use tlbinf32.dll to see the objects in activex and olb.

About the question 2, I see in the vb6.olb, index the order of vptr. try to write demo in vb6. So I find some vptr are lost in it ,the reason id some index of vptr are not continued.
mrsilver
05-03-2003, 08:36 PM
I've documented few opcodes of the VM just to give you and example:

04 FLdRfVar -> Loads a reference to a variable into the stack. Usually references to local variables of the
current routime.

VB6:
Size: (3 bytes)
Format: 04h / SIGNED WORD Offset

Offset: Signed displacement to add to the current stack address (EBP). The result
points to and address containing a number to add to the computed address (EBP+Offset).
The result is a pointer to a local variable.

1c BranchF -> Branch if False, Jumps if the word pointed by ESP is equal to 0

VB6:
Size: (3 bytes)
Format: 1Ch / WORD Size

Size: A word indicating the number of bytes to add to the address of the
current routine or function where the BranchF is located. To obtain the
jump address you must add the relative address and the size.

To get the relative address of the current routine you must get the dword
placed on (EBP-58h)

23 FStStrNoPop : Stores a pointer to a widechar string into the stack.

Size: (3 bytes)
Format: 23h / SIGNED WORD Stack Offset

StrOffset: A signed WORD to add to EBP. The result is and address
containing the pointer to the widechar string.

On ESP you'll find the pointer to the WideChar stored in StrOffset.

64 NextI2:
VB6:
Size (5 bytes)

Format: 64h / SIGNED WORD Unknow WORD jump Offset

Jump Offset: Displacement to add to the the entry point of the current routine.
This entry point is stored in EBP-58h. ESP points to a signed word containing the
current loop counter.

These are few of the opcodes that we've documented most of them work on similars ways i think is not hard to find what each opcode does, it's simply a matter of tracing the routiine that interprets the opcode and also looking at the death listing of the vm. I leave the door open for you guys to try to figure out some of the opcodes :-)

Important thing to note is that always the interpreted use the stack to manage everything so it's very important you dig inside the values pointed by ESP, as a clue this values contains always the following:

ebp-58 -> contains a pointer to the current running routine or procedure.

ebp-50 -> a pointer to the current Form (the form object structure is defined on the www.decompiler.com forum)

ebp-54 -> pointer to a table to pointers of wide char strings (these are the string references if you prefer :) )

This information is quite useful and gives you a lot of clues on how to figure out the rest of things, so go ahead the point of all this is learning :)

Mr. Silver
banshee
05-04-2003, 02:26 AM
Thanks mrsilver, I supposed something like that. ;)

OK, it's time to get hands dirty :D
sarge
05-31-2003, 07:42 AM
Well, it has been a long time since I was here last. An I am very excited to see a thread about VB decompilation. I am expecially excited to see that Mr. Silver (and, presumably, Mr. Snow) are "real" people! Gentlemen, you have no idea how much your program has helped me in my quest to understand the internals of VB. Incidently, I was the one who pointed out a small problem you had with file overwritting on the install; you probably don't recall it, as it was a long time ago.

For those of you who are sincerely interested in VB RE, here's a couple of items fo interest...

The extensive discussions on the decompiler.com MB are no more. Due to "space restrictions", months and months of work, discussions, and secrets are gone. However, an very good (but not perfect) source of info can be found at "decompiler.theautomaters.com". Yes, you will see me there too, as an avid contributer.

(Con't next msg)
sarge
05-31-2003, 07:51 AM
Although there are a few errors in the structure hierarchies, for the most part, it's good stuff. It includes structure info for each type of object/project/form, etc, with offsets and pointers to flags, child structures, etc,....right down to finding the PCode/NCode for each event and function! Make use of this, guys! And, please feel free to post any thoughs, comments, corrections, etc.

As for a start in actually decompiling stuff, may I offer two contributions...at decompiler.com, in the EXTRAs section, are two programs RACE and SKELETON (both are mine, I take responsibility for them). RACE will analyze many VB6 exe's and give you some interesting output; SKELETON, which includes source code, will show you have to analyze a PE file to determine if it IS a VB6 file, and how to find the reference pointers that are used as the starting point in the previously mentioned structures.

Now, having all this info (and it IS a lot), and a few VERY interested parties that I know, can we put together something? How about that IDA plugin? How about a really good VB decompiler? How about....???

Enjoy!

Sarge
sarge
05-31-2003, 08:06 AM
Hmm, it seems I haven't mentioned the very subject that prompted me to write, opcodes. There are somewhere in the vicinity of 1000 of them by number, but not all are active. And, don't get caught up in the "illegal opcode" trap. Many times you will see such an opcode in the pcode symbols of an exe, and wonder why/how the program could possibly have been compiled in that manner. You should be aware that (oh, oh, here comes a VB "secret") the exe contains more info in it's code than just the symbols for the source code equivalents. The "illegal opcodes" are that extra info, and have no effect on the actual step-by-step opcode functions.

But I think that's getting too far ahead, although granted I don't know the extent of the knowledge of VB that is available on this board. I do know, from my long tenure here, that there are some very intelligent people here, and that we could make a lot of progress very fast.

And, IMHO, it is not difficult to make a PCode decompiler that can give me near-English decoding of the PCodes. If you look at the output file from RACE, you can see that it is only one more step to get there.

Mr. Silver & Mr. Snow, please keep yourselves available here. I know that it may be difficult to draw the line between having the knowledge to create such a program as yours, and at the same time giving that knowledge away in a forum like this. Further, you are (and you know you are) only one step away from such a decompiler yourselves. But, man, if we work together, we can blow MS VB out of the water!

Thanks, all, for you time. In the future, I'll try not to hog the thread.

Sarge
sarge
05-31-2003, 08:08 AM
Ok, it should be "h??p://decompiler.theautomaters.com"

Sarge

---------------
Um, I posted this before I figured out how to edit. I guess you moderators can remove this post if you like, now that I've edited the original posts.
Polaris
06-01-2003, 07:13 AM
After having collected some experience in IDA pro plugin development, I would like to point out that a "plugin" will not be enough for this project. :(

The problem is solvable in 2 ways:

- developing an ida-pro processor module
- developing a standalone p-code disassembler

In my opinion, we would have to go standalone (dealing with IDA deep internals is not the most relaxing thing to do...) :)
dreamwalker509
06-06-2004, 06:37 PM
Will Mr Silver ever release a decompiler?
Impressive paper Mr Silver.... you must've stayed up late many nites

Just wondering...


Keygenerator,patching, etc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Keygenerator,patching, etc
PDA

View Full Version : Keygenerator,patching, etc

uezguere
04-27-2003, 11:42 PM
First of all I've to say that woodman.com is the best site I've found regarded to reverse engineering and something like that.
You have to know that I'm a newbie on this huge and very interesting sector of programming.

At the time I only want to find serials for 2 programs. I have already searched the web for a crack, serial or a keygenerator but I didn't find anything. Of course it's very hard to get something for such unpopular (but for me very usefull!) programs.

So I said to myself, if there's nothing out there, I will have to help my own.

Helping on my own means reading, reading and reading again. This process costs a lot of time that I don't have or don't want to spend on.

That's the way I got the idea to post this message.
Would it be possible that someone who is an real expert on this topic can help me and only tell me how to solve my problem?
I hope so! Perhaps there's somebody out there who really loves such a challenge.

There's my problem in detail:
The programs are simliar in their regestration form.
The form looks like:

Name:_______________________
Serial:_____________________

If I give "Name" and "Serial" several random inputs and then say ok - a message window pops up with the following text: "invalid registration" or something like that.

What is the fastest way to registrate this program?
I think programming a keygenerator would surely be the finest method but not the fastest if you are a newbie and don't have the time of the world.

I am able to start following software tools:
HIEW, SoftICE, WDASM32

I already read through a hand full of tutorials about this topic and there I think I've learned that solving such a problem the fastest way is to patch the registration process.

Something like saying "JNE" instead if "JE". The registration form will then accept any wrong name/serial, isn't it.

Further on I have read something about encryption and packed programs. I think I'm able to understand this problem basically but of course not more. I only hope that this registration-handler don't use such crypton-techniques which can be probably a really hard challenge for our revere engineeres today.

I would be glad if somebody fell now compassion to me and can invest a few minutes in writing an email to me or giving an serious answer to this short posting.

Thank you!
FoolFox
04-28-2003, 01:25 AM
Hi,

What is the fastest way to registrate this program?

Buy it.

If I give "Name" and "Serial" several random inputs and then say ok - a message window pops up with the following text: "invalid registration" or something like that

At this point, you can already try to find if the correct
serial is echoed in memory.... if it's the case...could be the
fastest way.... (try.. WINHEX)

Regards
FoolFox
Stilgar
04-28-2003, 10:44 AM
Being myself a newbie, I felt some identification with your post. ;)

FoolFox already give you the right and short answers. However, maybe they aren't the answers you wanted.

Like FoolFox said, possibly the fastest way of find the correct serial is to follow this "invalid registration" message.

I would start with a dead list in wdasm. Try to find the strings mentioned in the Name/Serial request message and in the "invalid serial" message. Probably the serial checking routine is near to or referenced by this code sections.

In softice you could put a bpx GetDlgItemTextA, or maybe other function that is reading the Name/Serial. You can see these functions in the start of the dead list of the proggie in wdasm. Try to follow the code after this reading and see what the proggie do with Name/Serial.

I hope this helps you. Of course, I'm a newbie and I know almost nothig myself. If you want to learn, don't give up. Everybody here start knowing the same things that you know right now.
:D
dELTA
04-28-2003, 06:14 PM
Just so you know uezguere, your post is dangerously close to a crack request, and if any of the moderators would have felt a little more grumpy today it would already be deleted.

This is also the reason why you most likely won't get any more serious answers (as if the lack of information in the question wouldn't be enough).

We help to teach reverse engineering, not to "solve specific problems in the fastest way".

dELTA
Woodmann
04-28-2003, 08:10 PM
:)
naides
04-28-2003, 09:18 PM
You need to be more sympathetic with people that are in dire need of help!!!

The answer to your problem is:

name: uezguere newbie

Serial: 03EC453E-456DCA8F-3C
Woodmann
04-28-2003, 09:30 PM
Howdy,

naides, you make me laugh :D

OBC
uezguere
04-29-2003, 01:27 AM
Thanks to the admin who deleted my foolish 2nd posting. Now I really know what you mean!

Sometimes I have to put some lack into information...
Woodmann
04-29-2003, 04:06 PM
Your doing fine.........:)

Woodmann
mythical
05-25-2003, 11:49 PM
Would like to know more about you target...You will need to PM me....I will NOT crack this for anyone, but I may be able to help you out on a good starting point......*I will not send a name or serial so don't ask ;) I will simlpy help you better understand the code if I can.....
Jon
05-26-2003, 03:00 AM
If you can PM me also with the apps name or a place where can i download them... maybe ill be able to understand the code and explain you what to do like in the tuts.

Regards, Jon
Fake51
05-26-2003, 07:32 AM
Newbie considerations in cracking a serial reg scheme:

Wrap your brain around the fact that:
- if the program will actually let itself get regged with a valid username/serial combo (or just a valid serial, consider this too), then it needs to check the input given to it.

Possible approaches:
- Locate the input routine, and follow the data from there. Millions of tuts on the web will show you how to set a bpx on getwindowtexta, getdlgitemtexta (if I remember correctly, been a while), a bmsg on wm_gettext etc.etc. Find the relevant api, and track the data from there on. Practice, practice, practice.
- Locate the "wrong serial" routine and work your way backwards. If you're lucky, the dimwit coding the scheme put the check for right reg close to the output box. If you're unlucky, you're lost in the socalled codewoods. A perfect place to learn some asm code, and the virtue of patience.
- Locate an api that is called in between the input routine and the output routine, and break on that. Next, find the memory echo of your input. Then bpm on that, and start over.

Each approach will wreck open any normal serial scheme. Work with sice or olly, using w32dasm for inspiration. Don't forget to look for suspicious strings, they typically mark the spot.

Practice makes perfect, and gives you a hint whether to keep up or drop cracking altogether. Unless your two targets are out of the ordinary (and they'd have to be way out of the ordinary) all the info you need is up for grabs, here and in the tuts on the net.

Fake
uezguere
05-27-2003, 06:34 AM
The programs are written in C++ and they are protected with "PE-compact".

What is this protection good for? Who knows?
There is a useful program out there: UnPECompact 1.32 by yoda/FReAK2FReAK

What do the options "Force full IA T rebuilding" and "Optimize Filesize" in UnPECompact do?
Fake51
05-27-2003, 03:04 PM
Hmmmm ....
Just telling you would be too easy, how bout you search a bit, then offer an educated guess, and we'll tell you if you hit the spot, or how close you came?

Sounds more like fun to me.

Fake
Woodmann
05-27-2003, 06:18 PM
Sounds more like fun to me

I agree :D

Woodmann


Adobe Acrobat Not Working After SICE !!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Adobe Acrobat Not Working After SICE !!
PDA

View Full Version : Adobe Acrobat Not Working After SICE !!

Zkhan13
04-28-2003, 03:35 AM
After installing Soft Ice, The Adobe Acrobat is not Working.
After the Initial screen it just disappears ..
Is there any SICE detection is going on?
Or How to Challenege this..
The SICE documentations are in .PDF Format.So i couldn't do
Any thing Now..
Please Help
Shoob
04-28-2003, 03:55 AM
Try it with Scansoft PDFConverter for Word, but i dont know any sice detection from adobe sorry...
ZaiRoN
04-28-2003, 04:10 AM
Hi,
Is there any SICE detection is going on?Yes! This message is included in the readme.html file:
"Debugging with Acrobat Reader 5.0
If you need to use a debugger while Acrobat Reader 5.0 is running, to enable debugging remove the InterTrust directory and DocBox.api plug-in contained within it from the Acrobat 5.0/Reader/Plug_ins directory. [416341]"

If I recall correctly, adobe used two easy methods to check if debugger is loaded:
- IDT method
- meltice method

You can patch the file or simply remove the InterTrust directory and the plug-in!

ZaiRoN

ps. don't post the same message in two sections!
Zkhan13
04-30-2003, 08:42 PM
The Problem has been Suucessfully Resolved.
Thanx Everybody for considering me.
Mambo
05-01-2003, 05:09 AM
How can you hide SoftIce4.05NT, working in Xp? :confused: :)
ZaiRoN
05-01-2003, 06:46 AM
Hi Mambo,

Which is exactly your problem? Have you tried one of the two methods I told before?

On my xp machine I installed Acrobat Reader v5.1.0; with this new version I am able to run Acrobat with sice enabled without any problem, also the message in the readme.html file is been removed.
Install this new version :D

ZaiRoN


Lost thread?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Lost thread?
PDA

View Full Version : Lost thread?

cHeCksUm
04-28-2003, 04:00 AM
Hello,
Was looking over some of my old targets and one used inno setup. Unfortunatly I have lost my own documentation about it but remebered there was a thread on this board before about inno-setup. Anyone know what happened to it? Did a couple of searches but cannot seem to find the thread.

// cHeCksUm
JMI
04-28-2003, 10:12 AM
As I've reported in several threads, there are some problems with our Board regarding deletions of some limited number of posts, which we are in the process of attempting to restore from a prior backup. As a result of these issues we have not updated the counters which index the words in the posts and I believe that is the principle reason that the search function is not working as it should. As far as we can tell only the posts of one individual need to be restored completely and they exist in the backup. So far we have not discovered any deletions of subject matters. Give us a little more time and the issues should be cleared up.

Looking at the backup in a text editor, I find reference to a post by fizzik, which didn't appear to have a response. I kept searching and came up with the name of "thewd" associated with a thread on inno-setup and came up with this thread doing a search for his name here with the search by author function. It is:

http://www.woodmann.net/forum/showthread.php?threadid=2705

I believe you will find your solution there.

Regards.


Great piece of Software, Great Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Great piece of Software, Great Protection
PDA

View Full Version : Great piece of Software, Great Protection

dipeshrestha
04-28-2003, 11:32 PM
Hi everybody,

Ya, just downloaded a small program that will reveal Network and dial-up password in Win platform from rixler(dot)com. it's shareware, packed, can detect breakpoints and check checksum of program. When i put bpx on some point it will show messagebox saying PROTECTION ERROR: 1.
I have tried my best to find the OEiP of that program but cannot. and i think it is protected and coded by NOT LAZY programmer... :) .
Need small hint for manual unpacking of that program.

dipeshrestha
Still Newbie :mad: :mad:
Iwarez
04-29-2003, 12:49 AM
It's just an asprotected program. Search the board for asprotect and you'll find more on finding the OEP.
Manko
04-29-2003, 06:49 AM
Hi!

Seems they are using an older version of Aspr...
Wonder if they got a discount? :p

/Manko
bedrock
04-29-2003, 07:59 AM
I didn't want to start a new thread just for a similar question, but i have been looking at an ftp client from hxxp://www.smartftp.com. Now it looks likes it's packed but i cant identify what with with the usual tools such as PEiD and pe-scan.

It also has a .sig file (not sure what generates this and cant find any info on it) and when ever the prog is modified or even view in PE section editor next time i try and run it it just quits saying 'self signature check failed'

I've managed to bpx on GetLocalTime and find where it pop's up it's nag, but without being able to get past this signature check then i'm not sure what i can actually achieve.

Version i am working with is 1.0 build 974.39 from the forums/anouncements/daily build section.

GetLocalTime is called at 40B1C9 and the call to the nag is at 40B1C2. (Nag is only display sometimes, randomly between 8am and 5pm monday to friday)

I would just like some idea on what protection scheme is being used and ideas on how to start unpacking and find OEP.

Thanks

--
bedrock
Zilot
04-29-2003, 08:57 AM
Manko !

Have you tried to get rid of <evaluation copy> ?
Seems they put money on that, Alx stayed without salary in this case. Maybe they used cracked version of Aspr
bedrock
04-29-2003, 11:07 AM
Ok, i thought i would take a look at the password target also, i found OEP and unpacked, but i still haven't got past <evaluation copy> yet.
Manko
04-29-2003, 11:41 AM
Hi, Soldat!

Nahh... I'm too lazy... when I get the urge I'll look at Chameleon clock again... still haven't cracked that old thing... :p

/Manko
Zilot
04-29-2003, 11:59 AM
to bedrock

I would just like some idea on what protection scheme is being used and ideas on how to start unpacking and find OEP

Ok quick tutorial about unpacking

OEP----------> 4D39AE

IATstart-----> 14BFF8 (IAT Rva) About that

IATLength -> put 1000 hex and then cut invalide thunks

there is after that check on 4A86F3, put jmp instead jz

after that everything works

to Manko

Nahh... I'm too lazy...

You lazy bum !!!!
JMI
04-29-2003, 02:21 PM
bedrock :

Congratulations. You have adopted the correct attitude for becoming a reverse engineer. Learning how, not being given the answer is the only way to go.

[Edit: seems bedrock deleted his post while I was writing mine. He had said he wanted to learn how to find the OEP, not have someone give it to him. That is the proper attitude for learning.]

Assuming you are using Softice, I extract an excerpt from asterix, posted over at the exetools Board which may help with that search. The thread is here: http://www.exetools.com/forum/showthread.php?s=&threadid=2108

The discussion is about inline patching a dll, but, generally, unpacking is unpacking. Here are his comments:
[Quote]
You can not find OEP?
Try to make something such as it.

-It is necessary to remember value ESP on EP in DLL.
-Then to put "bpx GetProcAddress"
or "bpx (GetProcAddress+3)"(on especially spiteful protectors)
and press "F5".
-When will stop do it "bc *"

-Then to put "bpr esp-4 esp+4"(if you in win98) or
bpm esp-4
bpm esp-3
bpm esp-2
bpm esp-1 (if you in win2k/XP).
[End Quote]

Check out that thread.

Regards.
bedrock
04-29-2003, 02:41 PM
Thanks for the encoragement JMI,

I was re-reading my post and being only a newbie i didn't want to appear arrogant after Soldat had given me the solution to my problem. Thats why i deleted my post, but after your kind encoragement i will continue with my efforts.

--
bedrock
JMI
04-29-2003, 02:52 PM
bedrock:

You were completely correct. No one is truely helped by being given the answer, at least not if they are not taught how to find it themselves. It is the teaching of how to find the answer which leads to the skills which help one become better at anything having to do with learning. The "correct answer" to the specific issue is only useful as a way to check whether one has learned how to solve the problem, on one's own. You will then know if you are getting to that same place or conclusion by applying the proper method.

Stick with learning how. It's very much more important. It's something Soldat learned before he could give you the specific locations.

Regards.
dipeshrestha
04-30-2003, 05:03 AM
Hi again,

I have been studying some tuts about asprotect apps, they actually are quite application oriented i.e. they simply says goto address XXXXXX then look for certail pattern especially

CALL 00******
POP EDI
POP ESI
POP EBX
POP ECX
POP ECX
POP EBP
RET 0004

This doesnt mean they will be equally true for all application. I want to know how i can learn about unpacking asprotected apps so that i can do it with any other apps.

dipeshrestha
Still Newbie :mad: :mad:
Iwarez
04-30-2003, 07:43 AM
@Bedrock:
The smartFTP program is indeed funny protected. The loader doesn't look like any other I've seen. However, the protection it uses is lame. After you break on OEP (which you can find by breaking on getversion and looking a few bytes up) you can dump it with lordpe to get a dump. If you change the OEP then in the header the program should run. After that fixing the signature messagebox should be easy. (Ps. You might wanna patch the isdebuggerpresent call the protector uses.)

@Anyone:
Does anyone know which protector this is?
bedrock
04-30-2003, 08:17 AM
@ Iwarez,

I have found that the protector used is Exe32Pak V1.40 (the lastest eval version awailable from hxxp://www.steelbytes.com website is 1.38 which is a couple of years old.

If you take a look at the target with a PE editor and look just at the end of the .rsrc section you will find the string saying protected with exe32pak (c) 2003 or something similar.

I have disabled signature check fine and i found OEP using post mentioned by JMI, and placing breakpoints around esp (thanks for the link).

My unpacked exe is working fine now, but i have continued further and i am trying to create an inline patch, as the unpacked file is over 2.5MB, but it seems to me that the place in code where it jumps to OEP is part of what is decrypted by the protector, so i cant hijack that jump and jump into my own code.
Iwarez
04-30-2003, 12:29 PM
What's in a filesize ;)

If you really care about the filesize then use upx or something alike to compress it back.
bedrock
04-30-2003, 01:21 PM
Actually i tried that already, but UPX failed with a 'not compressable exception', but like you say the file size doesn't really matter :)
Iwarez
04-30-2003, 04:47 PM
Most of the time the executable gets so screwed up by the protectors, and after that, by us, the unprotectors, that a great honest exe packer like UPX can't make anything of it. You wonder how the heck Windows is able to run the file :D
Kilby
05-02-2003, 04:35 AM
I have found when recompressing asprotected files (a couple of years ago) that the section names can cause both UPX and telock to refuse to repack an app.

Kilby...
evaluator
05-05-2003, 01:38 AM
IF UPX FAILED for pack then...

then there is another packers around! OK?
Try AsPuck, it is freeware for reversers:)


Sentinel Super Pro Need Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Sentinel Super Pro Need Help
PDA

View Full Version : Sentinel Super Pro Need Help

sope
04-29-2003, 08:56 AM
Hello Everybody

I am working on a Sentinel Super Pro Target, I don't have access to the Dongle. If any body who can look at this target, & tell me if its really possible without dongle because after tracing, logging i see that the programmer never compares the return value which is read from the dongle.

It reads the words, copies word to different places then joins the 3 words from different cell & pass that as parameters to a dll file. Which copies, to some other address does something then pushes BADNUM offset & then compares it & again we r in some dlls its such a confusion i just can't put it on paper.

Hope to get atleast hints so that i keep moving & learning + shareing too :)

Regards
Sope!

Below is the things which i have already noted on this target.

(1) sprofindfirstunit 0x7745E0
(2) SproRead 0x7747B0
(3) SproActivate 0x774920
(4) SproExtentedRead 0x774860
(5) SproDecrement 0x766FB3
(6) SproQuery 0x774BA0

:00766C70 push 0CB46h <--- Developer ID.
:00766C75 push edi <--- rnbo handle
:00766C76 call sproFindFirstUnit
(1) Trival emulation for sprofindfirstunit and it's done.

Before we reach SproRead(), diged this part of the program

Now this is wired stuff i haven't see anything like this there is approx. 427 parameters pushed & calls a function some manipulation goes there in that function. i did not understood whats going in there.

:00768100 mov eax, dword_B745BC ; <--- move Flag check variable
:00768105 test eax, eax
:00768107 jnz short locret_76813B
:00768109 mov dword_B745BC, 1 ; <--- move 1 to the Flag

Below functions pushes 427 times some values & calls 1 functions.

:00768113 call sub_7D2D10 ; After the call eax=0x30E0480
:00768118 call sub_7C56D0 ; eax=0x30E4280
:0076811D call sub_7B7FC0 ; eax=0x30E8080
:00768122 call sub_7AA7D0 ; eax=0x30EDE00
:00768127 call sub_79D2F0 ; eax=0x30F1C00
:0076812C call sub_78FB40 ; eax=0x30F5A00
:00768131 call sub_782480 ; eax=0x30F9800
:00768136 jmp loc_774E50 ; eax=0x30FD600
I noted the eax value from the functions returned & only thing i understood was if we subtract we get exactly 0x3E00 bytes. So that much chunks of bytes manipulated or initialized.

0x30EDE00 - 0x30E8080 - 0x3E00 bytes similarly for the rest of it.
Now i reach SproRead(). I don't rip any code here for it.

:00413CD3 Call 414290 <--- reads Cell 0 & Cell 1 stores in EAX.

Cell 1 is recovered from sproFindFirstUnit() & Cell 0 dongle id i put 0x1111 so in EAX i had 0x1111CB46 which is stored at 0x2FAF8D8. Delayed checking it gets XOR with static value 0x42FCE52A then stored.

Next i reach below code

:00413D33 call sub_4142F0 <--- this call Reads Cell 1F, 22, 25, 20, 23, 26, 21, 24, 27

:00413D38 push offset aBadnum ; "BADNUM"
:00413D3D lea ecx, [esp+32]
:00413D41 mov [esp+230h], ebx
:00413D48 call sub_411330

I don't rip any code here. What i does i'll explain here in short.

It takes 2 parameters first is the Address where the word from the Cell Read
will be stored, second the Cell number.

-----------------------------------------------------------------
Address Cell No. Address Cell No. Address Cell No.
-----------------------------------------------------------------
0x2FAF88A 0x1F 0x2FAF88A 0x20 0x2FAF88A 0x21
0x2FAF890 0x22 0x2FAF890 0x23 0x2FAF890 0x24
0x2FAF888 0x25 0x2FAF888 0x26 0x2FAF888 0x27

Note: Address 0x2FAF88A stores for 1F / 20 / 21
0x2FAF890 stores for 22 / 23 / 24
0x2FAF888 stores for 25 / 26 / 27
sub_414110 which calls sproread is been cross reference from 22 different location. Cell: 1E, 2B, 2C, 32, 33, 34, 35, 36, 2D, 2E i never reach this part of the program.

Next i reach. as name suggest BADNUM. Till here there is no checking what word it read from the dongle.

:00413D38 push offset aBadnum ; "BADNUM"
:00413D3D lea ecx, [esp+32]
:00413D41 mov [esp+230h], ebx
:00413D48 call sub_411330 <--- Copy Words from dongle read to some location.

Then call again routines of reading Cell 0 & Cell 1 & then again Cell 1F, 22, 25, 20, 23, 26, 21, 24, 27. Its difficult to put on paper now where things gets copied, read manipulated etc...

Assumption:
While going through the string reference i also see some license file which i guess is required for proper execution. Ref to file with ".sec" is suspicious. 0xB0EA34 is the ref to some file with ".sec" extension.
scorpie
04-30-2003, 04:49 AM
Hello Sope,

Could you kindly inform us about your target clearly. Curtail information is not informative enough.

Bye,
Scorpie
sope
04-30-2003, 06:09 AM
Hello scorpie

Thanks for your interest. Please check your PM.

Regards
Sope!
scorpie
04-30-2003, 11:50 PM
Hello Sope,

Thank you for the reply.

Kindly check your PM.

Regards,
Scorpie
Rackmount
05-01-2003, 11:36 AM
Hey guys:

I am really interested in Sentinel dongle protections as well. Any chance I can follow your progress on this to maybe give me some additional insights into these type dongles? I can't say that "see your PM" is very helpful to me. I do understand the reason behind it though, and will leave off if that is your choice. I can't say that I will be able to offer any assistance on your project Sope, but I would love to eat some of the brain matter being offered by others to assist you.

Rackmount
sope
05-02-2003, 08:27 AM
Not possible without some ".sec" security files

Hello scorpie, rackmount

Below is the full details of things that i have noted down. After emulating SproFindFirstUnit we land below.
00413CD1 loc_413CD1:
00413CD1 mov ecx, esi ; ecx is some sort of table
00413CD3 call Read_Cell01 ; Call to Read Cell 0 & Cell 1
00413CD8 cmp eax, 0FFFFFFFFh ; we have eax=0x1111CB46
00413CDB mov [esp+18h], eax ; save it at 0x2FAF8D8
00413CDF jnz short loc_413CE8 ; carry on from here
00413CE1 or eax, eax
00413CE3 jmp loc_4140EB

00414290 Read_Cell01 proc near
00414290 var_8= dword ptr -8
00414290 var_4= dword ptr -4

00414290 sub esp, 8
00414293 lea eax, [esp+0]
00414297 push esi
00414298 push eax ; EAX=0x2FAF8B4
00414299 mov esi, ecx
0041429B push 0 ; push cell to read = 0
0041429D call sproread_called
004142A2 test eax, eax
004142A4 jz short loc_4142AE ; if zero go & read cell 1
004142A6 or eax, 0FFFFFFFFh
004142A9 pop esi
004142AA add esp, 8
004142AD retn

004142AE loc_4142AE:

004142AE lea ecx, [esp+8] ; Get Store Address in ecx
004142B2 push ecx ; push on stack
004142B3 push 1 ; push cell to read = 1
004142B5 mov ecx, esi ; esi is some form of a table
004142B7 call sproread_called
004142BC test eax, eax
004142BE jz short loc_4142C8 ; if zero go here loc_4142C8
004142C0 or eax, 0FFFFFFFFh
004142C3 pop esi
004142C4 add esp, 8
004142C7 retn

004142C8 loc_4142C8:
004142C8 mov eax, [esp+4] ; Get WORD read from Cell 0 address in edx=0x1111
004142CC mov edx, [esp+8] ; Get WORD read from Cell 1 address in edx=0xCB46
004142D0 and eax, 0FFFFh ; Preserve Lower bytes
004142D5 and edx, 0FFFFh
004142DB shl eax, 10h ; ShiftLeft Low Word to High Word
004142DE or eax, edx ; EAX = 0x1111CB46
004142E0 pop esi
004142E1 add esp, 8
004142E4 retn
004142E4 Read_Cell01 endp

Note: Word read from Cell 0 is stored at 0x2FAF8B4 = 0x1111
Word read from Cell 1 is stored at 0x2FAF8B8 = 0xCB46
which gets stored in 0x2FAF8D8

After some compares with 0 we land below.

00413D2C loc_413D2C:
00413D2C lea ecx, [esp+16]
00413D30 push ecx ; ecx = 0x2FAF8D0
00413D31 mov ecx, esi ; ecx = esi = 0x30FC050

00413D33 call Read_Cell_1f_27 Call to Read Cell 1F to 27

004142F0 Read_Cell_1f_27 proc near ; CODE XREF: sub_412490+87p
004142F0 ; sub_413890+6Dp
004142F0 ; sub_413B00+233p
004142F0
004142F0 var_C= dword ptr -0Ch
004142F0 var_8= dword ptr -8
004142F0 var_4= dword ptr -4
004142F0 arg_0= dword ptr 4
004142F0
004142F0 sub esp, 0Ch
004142F3 push ebx ; ebx = 0
004142F4 push esi ; esi = 0x30FC050
004142F5 lea eax, [esp+10h] ; eax = 0x2FAF8B4 Address of Cell 0
004142F9 push edi ; edi = 0
004142FA push eax ; push Cell 0 address
004142FB push 25h ; Push cell 0x25
004142FD push 22h ; Push cell 0x22
004142FF mov esi, ecx ; esi = ecx = 0x30FC050
00414301 push 1Fh ; Push cell 0x1F
00414303 mov dword ptr [esp+24h], 0 ; Moves 0 to address of Cell 0

0041430B call sub_4144E0 ; Call SproRead

Lets Examine this call sub_4144E0

004144E0 sub_4144E0 proc near ; CODE XREF: Read_Cell_1f_27+1Bp
004144E0 ; Read_Cell_1f_27+2Fp
004144E0 ; Read_Cell_1f_27+43p
004144E0 ; call_to_read_Cell_3b+20p
004144E0
004144E0 push ecx ; ECX = 0x30FC050
004144E1 push ebx ; EBX = 0
004144E2 push esi ; ESI = 0x30FC050
004144E3 mov esi, ecx ; esi = ecx = 0x30FC050
004144E5 lea eax, [esp+0Ah] ; EAX = 0x2FAF88A Store Address of Cell 0x1F
004144E9 mov ecx, [esp+10h] ; Get Cell to Read ecx = 0x1F
004144ED push edi ; edi = 0
004144EE push eax ; push eax = 0x2FAF88A
004144EF push ecx ; push ecx = Cell 0x01F
004144F0 mov ecx, esi ; esi = ecx = 0x30FC050
004144F2 call sproread_called

ok, sproread_called is = sub_414110 which reads word from the respective cell
and stores in the address pushed above. Similarly it calls for Cell 22 & 25.
Check the table above in my first post about it.

We reach the below code now

0041451D test ebx, ebx
0041451F jz short loc_414565 ; jump will be taken
00414521 test edi, edi
00414523 jz short loc_41454C
00414525 test eax, eax
00414527 jz short loc_414533

sooner we will reach the below code

continues in next post ......
sope
05-02-2003, 08:28 AM
00414582 loc_414582:

00414582 mov dx, [esp+14h] ; dx = word from cell 22 stored address
00414587 mov si, [esp+0Ch] ; si = word from cell 25 stored address
0041458C test ebx, ebx
0041458E jz short loc_4145A5 ; jump will be taken
00414590 cmp dx, si
00414593 jnz short loc_4145A5
00414595 mov eax, [esp+20h]
00414599 pop edi
0041459A pop esi
0041459B pop ebx
0041459C mov [eax], dx
0041459F xor eax, eax
004145A1 pop ecx
004145A2 retn 10h
004145A5
004145A5 loc_4145A5:
004145A5
004145A5 mov cx, [esp+0Eh] ; cx = word from cell 1F stored address
004145AA test edi, edi
004145AC jz short loc_4145C3 ; jump will be taken

004145C3 loc_4145C3:
004145C3 test eax, eax
004145C5 jz short loc_4145DC ; jump will be taken
004145C7 cmp cx, dx
004145CA jnz short loc_4145DC ; jump will be taken

004145DC loc_4145DC:
004145DC test ebx, ebx
004145DE jnz short loc_414631
004145E0 test edi, edi
004145E2 jnz short loc_414631
004145E4 test eax, eax
004145E6 jnz short loc_414631
004145E8 cmp cx, dx ;<-- compare word from cell 0x1F with cell 0x22
004145EB jnz short loc_4145FB ; if not next compare
004145ED mov edx, [esp+20h]

004145FB loc_4145FB:
004145FB cmp cx, si ;<--- compare word from cell 0x1F with cell 0x25
004145FE jnz short loc_414610 ; if not next compare
00414600 mov eax, [esp+20h]

00414610 loc_414610:
00414610 cmp dx, si ; <--- compare word from cell 0x22 with cell 0x25
00414613 jnz short loc_414625 ; if not mov in eax=0xFFFFFFFD
00414615 mov ecx, [esp+20h] ; or get Cell 0 address & store word of cell 0x22
00414619 pop edi
0041461A pop esi
0041461B xor eax, eax
0041461D mov [ecx], dx ; <--- here save the word from cell 0x22
00414620 pop ebx
00414621 pop ecx
00414622 retn 10h

00414625 loc_414625: ; CODE XREF: sub_4144E0+133j
00414625 pop edi
00414626 pop esi
00414627 mov eax, 0FFFFFFFDh
0041462C pop ebx
0041462D pop ecx
0041462E retn 10h
0041463A sub_4144E0 endp

004145E8 cmp cx, dx ;<-- compare word from cell 0x1F with cell 0x22
004145FB cmp cx, si ;<-- compare word from cell 0x1F with cell 0x25
00414610 cmp dx, si ;<-- compare word from cell 0x22 with cell 0x25

what happens is if at 0x4145E8 cx = dx then cx word is stored, similarly if at 0x4145Fb cx = si then cx word is stored, if at 0x414610 dx = si dx word is stored.
if it does not match eax=0xFFFFFFFFFD & ret.

Next we reach here

00414338 test edi, edi
0041433A jnz short loc_414369
0041433C test ebx, ebx
0041433E jnz short loc_414369
00414340 test eax, eax
00414342 jnz short loc_414369
00414344 mov eax, [esp+0Ch] ; get in eax= word from cell24
00414348 mov ecx, [esp+10h] ; get in ecx= word from cell23
0041434C mov edx, [esp+14h] ; get in edx= word from cell23
00414350 mov esi, [esp+1Ch] ; get address to copy
00414354 push eax
00414355 push ecx
00414356 push edx
00414357 mov ecx, esi ; ecx=0x2FAF8D0 address where 3 cell words read will be stored
00414359 call ECX_3Cell_Words_stored
0041435E mov eax, esi
00414360 pop edi
00414361 pop esi
00414362 pop ebx
00414363 add esp, 0Ch
00414366 retn 4

After this we land here

00413D38 push offset aBadnum ; "BADNUM"
00413D3D lea ecx, [esp+32] ; ecx=2FAF8DC
00413D41 mov [esp+230h], ebx
00413D48 call is_strcopy ; copies in ecx address BADNUM
00413D4D push eax ; eax=2FAF8DC
00413D4E lea ecx, [esp+20] ; ecx=2faF8D0
00413D52 call sub_412630 ; compare it with 3 cell words stored
00413D57 lea ecx, [esp+28]
00413D5B mov edi, eax
00413D5D call unknown_libname_18 ; compare each bytes with BADNUM if not edi = 0 otherwise 1
00413D62 cmp edi, ebx
00413D64 jz short loc_413D94 ; if zero it ties to open a file rb attribute
00413D66 mov ecx, esi ; prepared for same stuff again
00413D68 mov [esi+14h], ebx
00413D6B call sub_413890 ; Reads Cell 0_1

ok the below compare is important. If edi = 0 we take the jump loc_413D94
otherwise we are back in the same old routines Read Cell 0 then 1 etc...

00413D62 cmp edi, ebx
00413D64 jz short loc_413D94 ; if zero it ties to open a file rb attribute

Let see what it does

00413D94 loc_413D94:
00413D94 sub esp, 8
00413D97 lea edx, [esp+18h]
00413D9B mov ecx, esp
00413D9D mov [esp+24h], esp
00413DA1 push edx
00413DA2 call is_strncpy ; copies to different address
00413DA7 lea eax, [esp+2Ch]
00413DAB push 200h
00413DB0 push eax ; eax = address of 3 cell words read
00413DB1 mov ecx, esi ; esi = some table
00413DB3 call sub_413A20 ; perform some maths & we get some file name in ecx

00413DB8 lea ecx, [esp+24h]
00413DBC push 0B0EA40h ; "rb" read binary mode
00413DC1 push ecx ; which file for me c:\-1.sec
00413DC2 call ds:fopen ; Open it
00413DC8 mov ebp, eax
00413DCA add esp, 8
00413DCD cmp ebp, ebx

ok, so its confirmed there is some ".sec" (security) file which is opend in "rb" mode & some good info is stored in it. So the assumptions was correct.

Regards
Sope!


Hardlock packed exe (for CrackZ and others :p)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hardlock packed exe (for CrackZ and others :p)
PDA

View Full Version : Hardlock packed exe (for CrackZ and others :p)

plopzz
04-29-2003, 06:37 PM
Hi all
I had writted 1 dll who emulate functions of hlvdd.dll ... All exe 's works fine with it ... all ... except 1 !

This exe are packed (with internal packer, maybe HL-CRYPT ?)...
I had removed all (i hope) anti softice ... Now i only have the error code 7 (not dongle).

1) First strange stuff : all bpio does nothing (anti softice ???) .. So where he check dongle ???
2) The app look for an UDP server .. He send 2 bytes (3 times)...

So my question are :
- How i can unpack this exe ??
- And if the exe are crypted and need a key, i can use bruteforce ?

Thanks
(ps : i have prb searching on this board, eg : i type hardlock in search but return 0 result... There are a lot of topic who speak about hardlock .. bug ?)
(ps2 : yes, i have looked on the web, read a lot of tuts, i didn't found any tutz of how unpack harlock protec :p)
Woodmann
04-29-2003, 06:46 PM
Hi,

You are correct, the search function is not working.

We will be working to restore this as soon as possible.

Woodmann
tgodd
04-29-2003, 10:37 PM
Both hardlock vxd and sys have code (encrypted), which disables many of softices debugging capabilities.

The hardlock code is not for the faint hearted to decrypt.
It is encrypted with a type of state machine.

As for unpacking, that is not my gig.

There are comercial emulators available for Hardlocks...

Regards,

tgodd
plopzz
04-30-2003, 08:05 AM
Originally posted by tgodd
The hardlock code is not for the faint hearted to decrypt.
It is encrypted with a type of state machine.

Humm, if i understand (because my english suxx :p) i can unpack this exe without the real dongle ??

My main problem are to found where to bypass the dongle check in the packed exe (checked in the .protect section)
sope
04-30-2003, 11:18 AM
Hello plopzz

Below link will keep you moving further till the search button is restored.
hardlock envelope without dongle (http://www.woodmann.net/forum/showthread.php?threadid=2209)

Good Luck.
Sope!
plopzz
04-30-2003, 12:34 PM
Hi sope,

Thanks for the link

As i understand, i can use bruteforce on it ...

i "just" have to found where he get key(s) and bruteforce it ...
(damned, i'm finished :p)


Search not working??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Search not working??
PDA

View Full Version : Search not working??

asd
04-30-2003, 01:02 AM
I searched for PECOMPACT with no results.

Is it true or some prob with search??:confused:
JMI
04-30-2003, 01:54 AM
It's a temporary problem with the search function. As reported in several threads already, there are some deleted posts we are attempting to restore and we need to do that before we re-index the database and restore the correct search results. Patience please.

If you are desparate, I can do a text search of the database and probably lead you to some threads.

Regards.
asd
04-30-2003, 09:42 PM
thanx for the info.
I am new to this forum hence did not know this fact.

I will wait for the search to be fixed.


Opera naughty? ( -> Hybris virus)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Opera naughty? ( -> Hybris virus)
PDA

View Full Version : Opera naughty? ( -> Hybris virus)

Dedec0
04-30-2003, 04:19 AM
Hi,

yesterday for unknown reasons I decided to run filemon, just to resee its face. :)
I was expecting the usual explorer's farts, but this time I was surprised: non-MS farts!!
Well, I had Opera running in the bg (512), doing nothing: no js pages, no nothing. I wasn't online either.
This program was examining the names of EVERY files in hidden dirs (id est, those we DON'T see NEVER in graphic mode, as Temp internet, recycled, ...) and also seemed to be ANALISING zip's contents!! I have always been suspicious about that "zip.dll" it has, but don't use it for the .zip we download... maybe this is it? :\

Anyway, it wasn't a brute read either. It "knows" we would see the HDD activity led blinking, so it does about 2/3 accesses per second. What about that? If it was a urgent thing (like one we ask) it wouldn't make those HUGE delays... nor I think it takes a whole second to process stuff - the processor is idle!

And a little detail I don't know anything about, is that is accessed some "files" (I dunno) with the path "0x3??". This is what filemon told me, and I haven't found anything on win32api ref, but its there... some of those were: 0x31d, 0x29c and 0x3d2.
It seemed to give as results the content of temporaty int files. The recycled contents are a normal path (as "disk:\path\file)".... it also looked through some normal dirs (but that has nothing to do with nothing of its bee's knees :(
The resume of the accesses were to get "Attributes", then do a "FindOpen" and then "FindNext"s as needed. And it SEEK/READ zip files!!

I have tried something (reversing) on Opera6, but it is MUCH beyond my knowledge now. Opera 5 I saw that it seem not to be packed, but I haven't check it yet...

If someone has anything to say. :)

Regards,
Dedec0
05-03-2003, 11:51 PM
Ok,

It is a little disappointing there be no answers, but anyway.
I have found the reason that filemon gives numbers for some paths: the file was opened before it was started, so it doesn't know the path of the file. For the files opened after it is launched, it keeps a hash table that it uses to show us the paths.

BUT that still doesn't make my thread a mistake - I don't see why Opera would be accessing several directories on my disk, and even more my RECYCLED folders (it access files NOT shown ANYMORE for me, normally with WindozeExplorer), and my Temporary Internet Files/index.dat (cookies too) ... as it has its own cache folder, and its own history file and even its own cookie storage file.

Until later,

Dedec0
dELTA
05-04-2003, 07:42 AM
Could it be part of some time trial scheme (or other protection information hiding)? I don't know what kind of limitations it has, but it is quite common to spread out files with time trial information all over the computer anyway, so that people should not be able to reset the trial period easily.

dELTA
squidge
05-04-2003, 08:48 AM
I thought of that also, but I'm sure Opera uses adverts rather than time trials.
Woodmann
05-04-2003, 08:10 PM
Howdy,

I ran the same thing on my rig and got nothing.
Opera 7.01 ad laiden free version.

I tried all different types of tests and did not
see one example of Opera doing anything wrong.

Because Opera is so configurable, I dont think
it was a "fair" comparison. I have just about
everything shut-off.

I dont know what to tell you, check your ports?
It may be some mal-ware.....

Woodmann
evlncrn8
05-04-2003, 11:56 PM
could it possibly be some anti virus scan from opera itself? (just a guess, i dont use opera myself)
banshee
05-05-2003, 06:59 AM
Why don't you ask Opera developers?
If you don't trust their answers then don't trust their soft :D
Dedec0
05-06-2003, 04:38 AM
dELTA, squidge>
I don't think also this could be it, as I see that Opera is banner based. But looking from here you can't know... :(
It bugs me, Opera reading a whole zip file's contents, wich has content related to nothing, as I saw in my zip archiver. (some I checked were old files I created for me and then deleted... they still there! :-o reaaally old)

Woodmann>
Hello, I have a fair amount of Opera's "features" turned of too. Plenty servers bugs me about \me not using this or that. But I can't think of some of these features being related to sparse file reading... :\ And I still use Opera5 (I like Opera 6.04, wich I also have, but it has some weird bug that no one else claimed to have.)
What do you mean "check my ports"?
I think I don't have any viruzes on my PC now, but really need to clean it up one of these days...

evlncrn8>
I don't have this kind of program running together. The only programs that start automatically in my computer are my sound boards' drivers and modem driver's. I have that windoze's TaskAgenda (or something) completely shut off. It seems to me now, unprobable that this is another program's fault.

banshee>
Yeah, right. Opera development. :-p ... I am a member of their forums, and they even bothered to help me with that serious bug I mentioned, I imagine whatthey do with "\me reversing their software's hidden 'features' ". :rolleyes:
What the "bug" is about: a MESSAGE box with an error message EVERY time I start Opera ("Your history list file is corrupted and will be cleared") and I have trying install/uninstall, manually deletage of all files that contains information created after opera is installed, some registry cleaning... I am kinda out of what to guess.
About trusting their software: I don't trust M$' more than theirs. And their thing is light (even with this great amount of protectio! :-o ).

ALL>

I will try to examine (and maybe reverse) some of Opera5 in a little time. Later versions of Opera seem to be packed (at least Opera 6.04 is packed, wich is the one I started to disasm while ago; Opera 5 I could sucessfully do some Resource editing with a tool, I assume now it isn't packed) and I don't know how to unpack things yet. I think about a thread with my results in Opera...
But my hopes with this thread were to find an explanation for the file accesses or to find someone else experiencing it. I will try to get Opera doing it again, and maybe find something that TRIGGER the process...

Regards,
Dedec0
05-10-2003, 04:09 PM
Hi,

I just found out. I had some friends over, and it seems like we got a Hybris virus. :\

Well, I will look how to get rid of it (manually =). Do you think this could be a nice thing to put on a thread, or is it not that much, after all..?

But it bugs me, because I didn't catch anyother program doing the accesses. Only when Opera was working. So the virus "moved" or got installed on opera's executable?... wild guess. What anyone think?

Regards,
Woodmann
05-10-2003, 06:58 PM
Hi,

If you are using opera mail, change to another
email client after you get it cleaned up.

Else use an online virus scan to make sure
you have removed all infected files.

Woodmann
Dedec0
05-10-2003, 07:35 PM
:)

I am not using any pop3 clients lately. Only my webmail accounts. So I think the virus isn't going anywhere easily. I said it is a Hybris virus because there is this string in its "install" file (checked on hexeditor); I have read that somewhere, but I can't recall WHERE now.

Anyway, I noted a few hours ago that my zipfiles are getting corrupted, most old are now (you might have seen it before: the .exe's inside the zips get renamed to ".ex$" and a file with the old name is created, with size of 23040 bytes).

I am re-searching about this and I couldn't confirm the Hybris' fault completely - the size of Hybris-B matches, but about the zip-corrupting... Comercial crep gets in the way... :(

It doesn't seem like a "urgent" problem for me. I might rename my new zip files with another extension, and change the registry too... this may work as a temporary patch for me. I am really not in the mood for running bloatware VSs neither to reinstall my PC now...

See you around...

Ps: I will search what is an "online virus scan" but the name isn't attractive for me. There are really free ones, though.

This PS reads stupdier now. :( I meant that I would search how it works, etc...
dELTA
05-12-2003, 06:37 PM
Just note that the hybris worm can alter its code and functionality by downloading new code from the net, so be careful. Whichever virus I would possibly have, I would try to kill it immediately, you never know what damage it can do, intentionally or unintentionally. :(

dELTA
Dedec0
05-13-2003, 04:32 AM
dELTA> Hello. I tried to find all information about the virus, but the best there seem to be exposed out there is that the virus used registry "run once" to install itself replacing the "wsock32.dll". No more details about other files it uses (there is a (random 8 letter in CAPS) in the windir that the virus creates, but I don't know what it does... :\
I restored my winsock32 today, and I will check the virus activities in just a few minutes... will it be gone? =) I will tell the board tomorrow.

--------

Is it a good idea for me to reverse this virus? Could I do this in this board? I searched but I found nothing about that being done (neither on other places, where the subject is usually censored :-(

:)
dELTA
05-13-2003, 01:46 PM
I would still recommend you to get an antivirus program to make sure the virus is removed completely. Very often there are many tricks of the viruses that are not mentioned in the common online descriptions of them.

And sure, if you want to reverse the virus yourself to understand what it does, you are welcome to post about it in the advanced reversing/programming forum at this board. It can actually be quite interesting and educating to reverse viruses, even though many of the worms of today are written in higher level languages, not containing equally cool stunts and tricks as in the good old days. :) Many of them still contain really cool stuff though. ;)

dELTA
Dedec0
05-22-2003, 03:16 AM
Hi, dELTA and all,

I didn't know about that, I am laughing now: viruses in HLLs... LOL =D
But I am conviced, for the time being, that the virus is gone. I have kept the "sick" wsock32.dll" and I checked some other system DLLs to make sure they are not modified. I am also keeping, with a different name, the files the virus created, checking that others are not being created.

I know the risk I am in, doing this.

Ps: How do I change the thread's title? I tried, but it changed the title of my FIRST MESSAGE! :confused:
dELTA
05-22-2003, 05:42 AM
Yes, I saw the other day that Symantec had even started to classify high-level language viruses separately, like e.g. "W32.HLLW.Mankx" (HLLW = High Level Language Worm). What is the world coming too, people vriting viruses in Visual Basic... :p

All of a sudden now I'm sure I'll get a message on my screen saying:

"Please download the latest VB runtimes, update your IE Scripting host to the latest version, download this and that OCX file, and update your MDAC components to the current version, otherwise this virus won't run."

:rolleyes:

And about changing the thread titles, normal users cannot do that. Seems like some nice moderator already fixed it for you though. ;)

dELTA
evaluator
05-22-2003, 11:49 AM
I yesterday ricieved 'microsift update'..

You, guys, sent it me??
Or how it happens, why virus(or worm) comes to me??

PS, i unpacked it using UPXfix..
there is some 'crypted' strings, who want decrypt!?
JMI
05-22-2003, 12:01 PM
evaluator:

It's most likely the palyh worm. You can read about it here:

http://anticrack.p15106404.pureserver.info/modules.php?op=modload&name=News&file=article&sid=4093&mode=&order=0&thold=0

It is an email worm that reads other peoples email lists and then send itself out with a tag line "from" m$.

Do a search on you machine for "MSCCN32.EXE" especially in the windows directory and in the registry autorun key.

It is packed with UPX.

Regards.
evaluator
05-22-2003, 02:20 PM
hi, JMI!

I know what worm it is, because yohoo has anti-virus check, so..

OK, I debugged this worm now & those seem great m$ crypto used ~:0

So as I understand, this kind crypto is embeded in msvc compiler??
(Because decrypted in EXE's initialisation?)

these are decrypted texts
-http://www.geocities.com/dnggobhytc/nbvhf.txt
-http://www.geocities.com/lfhcpsnfs/mdero.txt
-http://www.geocities.com/fjgoplsnjs/jane.txt
-www.geocities.com/dnggobhytc/nbvhf.txt
-www.geocities.com/dnggobhytc/nbvhf.txt
your_details.pif
ref-394755.pif
approved.pif
password.pif
doc_details.pif
screen_temp.pif
screen_doc.pif
movie28.pif
application.pif
Your detailsApproved (Ref: 38446-263) 467)
Your password
Re: My details
Screensaver
Cool screensaver
Re: Movie

now I will look for this files on web..

JMI!
>Do a search on you machine for "MSCCN32.EXE...
:) JMI, I have NOT any ANTI-vir & never been infected from InterNato:)
evaluator
05-22-2003, 02:23 PM
yah, pages killed..
JMI
05-22-2003, 02:30 PM
evaluator:

Your decrypted info is right out of the palyh worm. This thread I gave includes this info:

Messages contain the following attributes:

From:

support@microsoft.com
Subject:
[one of the following]

Re: My application
Re: Movie
Cool screensaver
Screensaver
Re: My details
Your password
Re: Approved (Ref: 3394-65467)
Approved (Ref: 38446-263)
Your details
Message Body:

All information is in the attached file.
Attached file name:

your_details.pif
ref-394755.pif
approved.pif
password.pif
doc_details.pif
screen_temp.pif
screen_doc.pif
movie28.pif
application.pif

The worm also creates a file named "hnks.ini" in the Windows directory and writes to this file the email addresses that were found on an infected machine.

**************

So it appears it got your address from someone else's computer or maybe the Yahoo Directory.

Regards.


Anticrash patch for WKTVBDE v1.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Anticrash patch for WKTVBDE v1.3
PDA

View Full Version : Anticrash patch for WKTVBDE v1.3

banshee
04-30-2003, 09:20 AM
I basically solved my problem with WKTVBDE. It was suddenly crashing at address 0x0040aa5a with STATUS_ACCESS_VIOLATION exception (0xC000005). This patch injects small routine that check address to be in the valid range. May be authors of that great tool will fix that thing in the future, but right now Mr.Silver says that he is very busy. I solved my problem and hope it could be useful for somebody else who experienced such errors.
dELTA
04-30-2003, 07:03 PM
Cool, thanks banshee. :)

dELTA


Need help with Soft-Ice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Need help with Soft-Ice
PDA

View Full Version : Need help with Soft-Ice

Mambo
04-30-2003, 07:09 PM
Hello. :)
In some cases when you first for example call
BPX GetWindowTextA
and press F11 it takes me straight to user32.dll. So how can I get Soft-Ice to the address from where this function has been called? (module&address).
naides
04-30-2003, 07:48 PM
Well F11 does exactly that. What its happening is GetWindowTextA was not directly called by your app but indirectly through user32.dll and perhaps other intermediary burocracy.

One solution is to keep pressing F12 (pRET) until you land in the code of your application, which should not be far from the call that produced the GetWindowsTextA call.

Other situation may arise when your application uses an interpreter or virtual machine like java and VB. In this situtation the normal Windows API calls are not called diectly and you have to use another way to break into the code.
Mambo
05-01-2003, 05:07 AM
I see...thanks.

F12 works well, but with this it just quits softi-ice when I press F12. What´s another way to break into this code, please? :(
naides
05-01-2003, 05:26 AM
Originally posted by Mambo
I see...thanks.

F12 works well, but with this it just quits sofi-ice when I press F12. What´s another way to break into this code, please? :(

Well this is sorta of wide open, and thorny question, which lies at the heart of software cracking, none the less: Breaking in the right area of the code is close to 50% of the RE endeavor. . .

Without knowing anything about your target I would suggest:

Disassemble the app and look at the import table. There you willl see a list of the APIs that are indeed directly called by your app, and you may have better luck in setting breakpoints.

Some people may disagree with me but Cracking in NT based systems like W2000 and XP adds unnecessary complexity to the task. Given the choice, do your carcking in a win98 system. There I have found that using F12 sooner or later takes me back to the app code. With WinXP you might have landed into a truly independent thread and once you go through the call-stack, Sice just quits and the sytem continues the flow of the programs.

Explore methods using BMSG Break on wm_destroy or wm_lbuttonup outlined in tutors else where (try the Cracker's Notes, still a newbie classic) and open your reperoire of braking inside the code methods.

By the way, I just read another post you placed in a different thread. If you are using Sice 4.05 NT in a windows XP system, you are bound to problems:

Only Sice 4.27 or Driversrudio 2.7 performs half decent with winXP, and that is after applying Kayaker's patch, available somewhere in this board.
Mambo
05-01-2003, 05:39 AM
Thank you. :)
I will try that.


How to Trace Our Module
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to Trace Our Module
PDA

View Full Version : How to Trace Our Module

Zkhan13
04-30-2003, 08:52 PM
I tried to patch a CD protection and it works pretty well.But i can't
Make it a Permanent One with 'Hiew'.The techniques described in this post is also not helping me very much.
I doubt the patch i had made in memory was on a DLL?!!!
How i could kow that while tracing Soft Ice traces on My Target EXE
it self (By seeing the name in Bottom right Corner Right.)
If i am wrong please tell me more about it
Thanx in Advance
naides
04-30-2003, 10:32 PM
Try to rephrase your questions, and what you have tried in a list of short sentences. I can only glimpse what your problems are.
Zkhan13
05-02-2003, 11:32 PM
Well.I patched on an Offset 6b809264.But it is not found on 'HIEW".
So i thought the patched code would be a DLL, where i can run the program. But after re-starting i can't Run it...

That is why i could n't find that address in HIEW.

my question was how to find out that we are still working on that target EXE, not a dll outside the code.
banshee
05-03-2003, 06:20 AM
Try to look at your target in any petool like procdump or lordpe. Choose your target from a list of processes and examine what dll's it uses. Also you'll see there base addresses of each dll. If the address is close to your patched offset you can treat it as dll you that need, i.e. 6b800000 or 6b700000 base address would satisfy your search. Than simply patch that dll :)

The other way to make loader for your target that will patch your app not permanently (only in memory). I'd suggest to use R!SC's PROCESS PATCHER. It's a bit old, but I like it very much.

my question was how to find out that we are still working on that target EXE, not a dll outside the code.

About your question. You can simply calculate range of the addresses of your exe. Use any peeditor.


Machine Code.... Where do I find it.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Machine Code.... Where do I find it.
PDA

View Full Version : Machine Code.... Where do I find it.

TRACER
04-30-2003, 10:51 PM
I am writting some keygenerators for some programs that I have aquired, and reversed the algorithms for the serial. The program presents some numbers "3355796438" and calls it "Machine Code". I have looked high and low for where these numbers come from. The only thing I can think of it is used for quening in messaging to identify the computer being used. Can anyone point me in the correct direction? Please.:confused:
tgodd
04-30-2003, 11:17 PM
Could come from many different places.

For example :

Your Network cards MAC address (unique).
IDE harddrive serial number (unique).
Master Boot record serial number.

etc.etc.

Do a search on the net for Machine ID or CPU ID.
You should find references to many possibilities.

regards,

tgodd
TRACER
04-30-2003, 11:19 PM
Thank you for your reply I will do that.
dELTA
05-01-2003, 11:51 AM
What you are talking about is most likely a "hardware ID", and it can be implemented in a number of ways. Basically you can say that it's a hash of one or more system-dependent properties (like e.g. the ones tgodd mention above). Your best bet is to locate the procedure in the program that calculates this number and then rip that algo.

dELTA
TRACER
05-01-2003, 06:05 PM
Thank you for the information. I will revist my little friends and find out how they are coming up with that number.
FoxB
05-20-2003, 07:12 AM
...skip

For example :

Your Network cards MAC address (unique).
IDE harddrive serial number (unique).
Master Boot record serial number.

...skip

MAC address, HDD serial, MBR serial - not unique!
I made different, if me need.

FoxB
tgodd
05-20-2003, 08:33 AM
Yes ...
The tools are out there to do this.
However some of these things were not meant to be changed.

Every machine 'IS' truely unique.
You could even create a hash on the entire registry so the registry
would have to be identical at the time of installation.

Hardware Could be different.

There are just to many things to say :

"I made different, if me need."

In reality it is not as simple as that.

tgodd
FoxB
05-20-2003, 10:44 PM
Hi!

"There are just to many things to say :"

""I made different, if me need.""

Hash in registry - only for MAC address.
HDD and MBR - directl by small program.

FoxB


Waiting for the translation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Waiting for the translation
PDA

View Full Version : Waiting for the translation

sirius
05-01-2003, 08:14 AM
it is packed with Pcguard v3.xx how could I unpack it, I Mean what is the best and the fast way to do that
regards
disavowed
05-01-2003, 09:15 AM
http://www.woodmann.net/protools/files/unpackers/dpcgd.zip
dELTA
05-01-2003, 12:02 PM
Sirius, next time you post, please try to get it into the correct forum, ok? It's just a wild guess, but I think the "unpacking forum" might have been more appropriate for that post, or the newbie forum.

dELTA


softice DS2.7 Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice DS2.7 Problem
PDA

View Full Version : softice DS2.7 Problem

sirius
05-01-2003, 08:46 AM
Hi all,
I have some trouble with Softice (Drivers Studio 2.7),
I've install it on WinMe, and when loading my exe files, and setting SI to break at WinMai, no thing happens (the exe runs whithout breaking at winamin!!!), if any one had encouter that problem please let me know, note that I've try it also under win 98.
Thanx
nikolatesla20
05-01-2003, 09:55 AM
DId you try using the Search button at the top of the forum?

Plus, I'd like to take this opportunity to ask all ppl out there, - WHY DOES EVERYONE WANT TO BREAK ON WIN FREAKING MAIN?

There's so many other better ways to do things ! Learn how to use your tools.

-nt20
Kayaker
05-01-2003, 10:10 AM
Originally posted by sirius
(the exe runs whithout breaking at winamin!!!)

Hi, try this patch of nmtrans.dll and see if it works.

http://www.woodmann.net/forum/showthread.php?threadid=3982

Kayaker
naides
05-01-2003, 11:08 AM
Originally posted by nikolatesla20
DId you try using the Search button at the top of the forum?

Plus, I'd like to take this opportunity to ask all ppl out there, - WHY DOES EVERYONE WANT TO BREAK ON WIN FREAKING MAIN?

There's so many other better ways to do things ! Learn how to use your tools.

-nt20

For the same reason I like to see the begining of every movie I watch :D
nikolatesla20
05-01-2003, 12:01 PM
I have never used the symbol loader ONCE in my entire cracking career, I just don't think it's necessary. If you want to break into the program, just use break 'n enter or bpx on some other API IMHO.

-nt20
sirius
05-01-2003, 04:52 PM
Originally posted by naides
For the same reason I like to see the begining of every movie I watch :D

That's right man :)
I know how to break in using API's, but I only want to "KNOW" what's wrong in my case.
Regards
Lunar_Dust
05-01-2003, 06:14 PM
What's wrong is you did not use the Search button. This question has been asked many many many many times.
Aimless
05-01-2003, 11:47 PM
Either of the 2 problems:

1. WinME and DS 2.7 is slightly "odd" combo for cracking purposes. As it is, Win2k and WinXP give ICE a hard time. To use Win ME will, well, make the system unpredictable.

2. However, it could also be that you need to change the code section attributes. You can get a PE File Header Editor and make the necessary section changes.

But if NEITHER of them solve the issue, its time to get dirty. Here are the steps:

1. Turbo Dump the executable (just to find out its entry-point. If you can get the entry point using some other tools, no probs)

2. Convert that RVA/VA into a physical address. Understand how the conversion works, or get a converter. You will find a flood of them on

www.programmerstools.org

3. Hex edit the file and go to the physical address that represents the entry point

4. Put in opcode "CC" (without quotes) over there. This stands for "INT 03". Make sure you put the CC in the HEX part and not the ASCII part

5. Save the file (a good idea is to copy the original file as backup)

6. Change to softice and type command "INT03 HERE".

7. Run your program. From explorer, from RUN menu, from basically anywhere, you WILL stop at the winmain/entry-point.

8. Hope that when you changed the code in the file to CC, you also noted the code that was already existing there.

9. Use the E command to edit the memory and put the opcode there.

10. You can then carry on as required.


Solid concept
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Solid concept
PDA

View Full Version : Solid concept

sirius
05-01-2003, 05:24 PM
Hi my friends ;)
I've some trouble with Solid Concept French version (V3), it is packed by PcGuard V3.xx, I've try unpacking it using dpcgd (a tool from protools.cjb.net) but it crashes, this means that it couldn't be unpacked by this version, I'm not experienced with manual unpacking yet, and I think that it requires a deep knowledge,
any help please ;)

Note : Thanks dELTA for the help ;), and sorry for not posting in the right place for my recent thread.
S3ri@l CoDe9x
05-03-2003, 06:50 AM
...If you do not know unpacking ... what help search with this?

u search unpacking soft?...:o

it's bad board to find :p

Best Regards! :rolleyes:
thE Cur!ouZ
05-04-2003, 01:07 PM
Hi sirius,

there is a good tut by Macilaci, in Woodman tuts.

http://www.woodmann.net/fravia/Cracking_PCGuard.pdf

and u can see a good one also by ByteCop en french to how unpack PCGuard 3.01D.

Bon chance,

Good luck.
sirius
05-11-2003, 06:11 PM
Oh thankx thats a very intersting :)
merci encore une fois :D


Softice SYMLOC function
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice SYMLOC function
PDA

View Full Version : Softice SYMLOC function

Rackmount
05-02-2003, 10:30 AM
Hi people:

I have read about the SYMLOC function to adjust the symbol file location loaded into SICE. The manual is kinda vague on actual implementation. Could some kind soul explain it a little better with an example of maybe...notepad? i.e. Create map file of notepad with IDA and convert to sym file using msym.exe located in SICE\util16 folder...load sym file into SICE using loader....then? It seems that there are a few different types of adjustments (parameters for SYMLOC function) that could be used depending on file type? Does the SYMLOC function need to be used whenever a sym file is loaded? I appologize if this is simplistic, but I have yet to see my created symbols in SICE, so must be doin' something wrong. Any help is appreciated.

Rackmount
ZaiRoN
05-02-2003, 12:53 PM
Hi,
Could some kind soul explain it a little better with an example of maybe...notepad? You will find an example in this thread:
http://www.woodmann.net/forum/showthread.php?threadid=4718

ZaiRoN


api getwindowtextA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > api getwindowtextA
PDA

View Full Version : api getwindowtextA

newbcrk
05-02-2003, 11:26 AM
'llo
Humm ...
i am using the breakpoint getwindowtextA

00401533 E866030000 CALL 0040189E 1er buffer
:00401538 8B4DE0 MOV ECX,[EBP-20]
:0040153B 81C1E4000000 ADD ECX,000000E4
:00401541 51 PUSH ECX > D * ECX = "name"
:00401542 8B4DE0 MOV ECX,[EBP-20]
:00401545 83C160 ADD ECX,60
:00401548 E851030000 CALL 0040189E >2nd buffer
:0040154D 8B55E0 MOV EDX,[EBP-20]
:00401550 81C2E0000000 ADD EDX,000000E0
:0040154D 8B55E0 MOV EDX,[EBP-20]
:00401550 81C2E0000000 ADD EDX,000000E0
:00401556 52 PUSH EDX > D * EDX = "sérial"
:00401557 8D4DE4 LEA ECX,[EBP-1C] > [EBP-1C]= nom -> ECX
:0040155A E839030000 CALL 00401898 > call MFC42
:0040155F 8B45E0 MOV EAX,[EBP-20]

1/I know this

MOV EDI,[ESP+00000220] ; Get Handle of dialog box in EDI
PUSH 00000100 ; PUSH (4) Max size of string
PUSH 00406130 ; PUSH (3) Address of buffer for text
PUSH 00000405 ; PUSH (2) Identifier of control
PUSH EDI ; PUSH (1) Handle of dialog box
CALL GetWindowText ; CALL the function

2/ I see the call and I m waiting at the parameters push 1-2-3-4
Why don't they appear above my 2 call ?

Thanks

:confused:
Rackmount
05-02-2003, 04:25 PM
Hi:

Is this where you arrived in the break, or where you landed after you hit F-12 to return from called function? If the first, then you will need to return from inside the function (hit F-12) to see the parameters passed to the function from outside. I see no reference in your code snippet to getwindowtext function...you may be in a few layers from the call in your proggie. It seems that when SICE breaks for me I usually see the API I am breaking on referenced somewhere in SICE window, if not, hitting F-12 will usually bring it around within a few tries. Hope this helps more than confuses (heck I got confused writing this...or maybe I just was born this way...who knows..lol)

Rackmount
newbcrk
05-03-2003, 05:36 AM
Well ,
I landed after I hit F-12 to return from called function and quit the user32 and MFC42.dll of windows .Finnaly I landed in my target
I hit d ecx and find my false code with a memory adresse in my wd but I don't understand the correspondance between the adresse of the wd and the lot of adresse of ecx in the wc .
:confused:


Quick ASPRed Q
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Quick ASPRed Q
PDA

View Full Version : Quick ASPRed Q

kyrios
05-02-2003, 12:35 PM
Hi,

Recently i tried to unpack this target ().
But somehow, ASPRStripper doesn't work, so i tried it manually.
What i found :
Stolen bytes : x07 bytes (558BEC83C4F453)
OEP : 5495D4
RVA : 16112C
Size: 750

Unresolved APIs
00161160 = GetModuleHandleA
0016116C = GetCommandLineA
00161658 = LockResource
0016169C = GetVersion
001616C4 = GetProcAddress
001616D4 = GetModuleHandleA
001616FC = GetCurrentProcessId
00161700 = GetCurrentProcess
00161704 = GetModuleHandleA

Fixing "no menu/right click on tray" trick.

:00519D9E B8C8F15400 mov eax, 0054F1C8
:00519DA3 FFD0 call eax <<<< NOP
:00519DA5 6A01 push 00000001

* Possible StringData Ref from Data Obj ->"ShowTipOfDay"
|
:00519DA7 B938A25100 mov ecx, 0051A238

* Possible StringData Ref from Data Obj ->"Global Options"
|
:00519DAC BA50A25100 mov edx, 0051A250

Another error caused by CALL EAX. but i don't know the effect.

:00518593 6808544000 push 00405408
:00518598 B8C8F15400 mov eax, 0054F1C8
:0051859D FFD0 call eax <<< NOP
:0051859F A108FA5500 mov eax, dword ptr [0055FA08]
:005185A4 85C0 test eax, eax
:005185A6 0F8CF0030000 jl 0051899C
:005185AC 40 inc eax

Now my dumped file run fine.

Now patching the nag screen :
:00519FE2 8B80D8010000 mov eax, dword ptr [eax+000001D8]
:00519FE8 E89BDCF8FF call 004A7C88 <<<< Step into this CALL
:00519FED 50 push eax

* Possible StringData Ref from Data Obj ->"Global Options"
|
:00519FEE BA50A25100 mov edx, 0051A250

* Possible StringData Ref from Data Obj ->"ShowTipOfDay"
|
:00519FF3 B938A25100 mov ecx, 0051A238

====================================
* Referenced by a CALL at Addresses:
|:005052FF , :0050ED00 , :00519FE8
|
:004A7C88 55 push ebp
:004A7C89 8BEC mov ebp, esp
:004A7C8B 83C4C8 add esp, FFFFFFC8
:004A7C8E 53 push ebx

--------------------SNIP---------------------------

:004A7FC0 8A5361 mov dl, byte ptr [ebx+61]
:004A7FC3 8B45F8 mov eax, dword ptr [ebp-08]
:004A7FC6 8B80D0010000 mov eax, dword ptr [eax+000001D0]
:004A7FCC E80B27F7FF call 0041A6DC
:004A7FD1 807B6100 cmp byte ptr [ebx+61], 00
:004A7FD5 750C jne 004A7FE3

In 004A7FC0, just make dl=1 will enable (not grayed) the thickbox "Show tip at startup....".
But if i do that, the shutdown process of pstrip.exe is not perfect.
because if perfect, pstrip will write these lines to the ini file before it quit.

ShowTipOfDay=1
Threshold=20
IconManagement=0
RecallColor=0
HKmodifier=0
HardwareID=

But if we patch enabling the thickbox, those lines above is not added into the ini file. Moreover,
it will delete all the [Global Options] section (of ini file).
So everytime we run the patched version, it will always scan for the VGACard.

Some1 please tell me how to fix this problem.

TIA,
kyrios
Manko
05-02-2003, 02:17 PM
Hi!

I actually did this target (Though a newer version) some days ago. (again)
Only reason was for testing my asprotect debugger app...

Anyway. I solved the problem differently...
Since I don't have exactly the same version I'm gonna have to guess, that Call EAX goes to usual trick for testing if API's are writeable, ie if they are emulated in aspr-space... These tricks sometimes also do important calls/jmps, so it would be a bad idea, just nopping them out. Try instead to understand the code inside them, and patch THAT to suit your needs...

Second.... Sometimes the dips contain important info/clues. Stupidly put there by authors of proggies. (Actually NOT so stupid since most newbies hardly know or care about them...)
It is so in this case. The first dip contains an important clue, you need to make the most of! :)

Hope this helps some! :D

/Manko
kyrios
05-03-2003, 12:08 PM
Hi manko,
thx for the hint. :-)

here's the code :
:00519D9E B8C8F15400 mov eax, 0054F1C8
:00519DA3 FFD0 call eax <<<< NOP
:00519DA5 6A01 push 00000001

You said no nopping. Then i go to 0054F1C8 to see what was going on there.
I saw this :
:0054F1C8 5C pop esp
:0054F1C9 59 pop ecx
:0054F1CA 8C4103 mov [ecx+03], es
:0054F1CD 8C01 mov [ecx], es
:0054F1CF 0031 add byte ptr [ecx], dh
:0054F1D1 90 nop
:0054F1D2 0100 add dword ptr [eax], eax
:0054F1D4 E48D in al, 8D

Strange code. Ok, i bpx on :00519DA3 FFD0 CALL EAX to see what this call doing.
Surprise i saw this :

0054F1C8 5B POP EBX
0054F1C9 58 POP EAX
0054F1CA 8B40 02 MOV EAX,DWORD PTR DS:[EAX+2]
0054F1CD 8B00 MOV EAX,DWORD PTR DS:[EAX]
0054F1CF FF30 PUSH DWORD PTR DS:[EAX] <<<< push dword from "Exitprocess"
0054F1D1 8F00 POP DWORD PTR DS:[EAX]
0054F1D3 FFE3 JMP EBX

Look like the codes has changed. When used, the codes are DEC.
NOPPing 0054F1CD, crash won't happen anymore. Is it ok nopping like this? (I nopped by changin' 8C01 to 9191).
Cause i did that but my problem is not solved yet (still scan for VGAcard) everytime i run it.

TIA,
kyrios
Manko
05-03-2003, 03:32 PM
Hi!

Cool!

It's nice to see you could find and fix this trick in a way that'll let you understand it better. This way, you'll be better at spotting other variants...

And, yes, ofcourse you may nop. ;)

No, it's not finnished. Cause you have yet to think about the clue I mentioned. Look in the first dip... :p

/Manko
kyrios
05-04-2003, 06:17 AM
Hi manko,

Bad news, my keyboard is broke right now. i can't buy new one till monday. you must be wondering why now i can post something, right?
i never had internet connection at home. i'm always accessing internet at cybercafe. Well, in here, having internet conn is much more expensive than having cell phone. even for 2MB VSAT conn, we have to pay 500 USD each month! i heard in europe, for 2MB VSAT conn, we only have to pay 15 Euro each month. Wonder it is true or not

Anwyay, for 1st dip you was talking about, is it something code where i land before reach the OEP? you mean i must do something with 1st dip then later at OEP i dump it again? sorry, i really really have poor english. i just wanna make sure i got your point.

TIA,
kyrios
Manko
05-04-2003, 01:22 PM
Hi!

Dips are those instances that aspr calls into original app, before OEP, to setup "days used", and any number of other interesting stuff.

Actually, the different dips get different info from aspr, but authors of protected proggie can also put in whatever other code they choose.

Like in this instance, they choose to do something in the first dip, that gives their "unpacked-checking" away... If you examine it closely, and get to understand it...

I hope, you will do the work required now, and beat this thing! :)

/Manko
kyrios
05-06-2003, 02:42 PM
Hi manko,

I'm afraid i didn't understand what i should do with the codes, i've tried to bypass the 1st dip but it doesn't work.
Would you like to tell me how? and few comments would also be appreciated.

1st dip
:0051E3C4 PUSH EBP
:0051E3C5 MOV EBP,ESP
:0051E3C7 MOV BYTE PTR [0054F1C4],00
:0051E3CE MOV EAX,[EBP+08]
:0051E3D1 MOV [0054F194],EAX
:0051E3D6 POP EBP
:0051E3D7 RET 0004

2nd dip
:0051E3DC PUSH EBP
:0051E3DD MOV EBP,ESP
:0051E3DF MOV EAX,[EBP+08]
:0051E3E2 MOV [0054F198],EAX
:0051E3E7 MOV EAX,[EBP+0C]
:0051E3EA MOV [0054F19C],EAX
:0051E3EF POP EBP
:0051E3F0 RET 0008

TIA,
kyrios
Manko
05-07-2003, 03:59 PM
Hi, Kyrios!

I can't give you too much! :p

It's not a matter of skipping or not...

You have to understand what the first dip does. Also see what happens later when proggy is running... You need to do some honest RCE. :p (Though it's really much too simple to be called RCE...) (But it is like many things. Really simple WHEN you know them...)

/Manko
nikolatesla20
05-07-2003, 11:05 PM
kurious,

It's also very useful to download a protection and read its help files as to how it can be used. This can give you very important clues as to what might be going on.

Try to think like a "hacker", or a "cracker", or anyone for that matter that wants to figure out something. Get as much data as you can first, and then brainstorm. Getting a protection and reading up on how to actually use it are key steps in defeating it.

-nt20
kyrios
05-08-2003, 10:42 AM
HI manko,
I really really want to understand the code. But look likes IDA doesn't allow me to see the code. Cause in most offset i just saw db bla.. bla.. bla.. where the codes i supposed to see?
meanwhile i left pstrip for awhile, i did my prevous homework about int3 fixing. Wow... big surprise (for me), now i can dump the whole tables. :)
Cause you know.. lot ppl still doesn't understand how to catch those tables. But in (maybe latest?) some target, it doesn't allow me any debugger active eventhough i already use icedump. (read access error. bla..bla..bla..) So i tried to use winhex. but i can't see where the table 4 lies. i can see table1, 2, and 3.

bbl,
kyrios
Manko
05-08-2003, 11:51 AM
Hi!

Actually. You should really focus on the part where I said:

"Also see what happens later when proggy is running..."

You can't do that with IDA, can you? :P

/Manko
dELTA
05-08-2003, 06:04 PM
Yes you can, in IDA 4.5. :D

dELTA
Manko
05-09-2003, 11:38 AM
HI!

Hehe... I was waiting for that. :p

Yup, if you are paying, registered user...
Which I took for granted, he was not...

(Ooops! Maybe I am wrong again!)

to Kyrios:

actually, I guess you should be able to see that code, without too much trouble.

Position marker at address of dip.

Press 'c', as in 'c'ode, to make it into code...

Repeat for next dip...

So why weren't it made into code automatically?
Don't know exactly, but it might be because, aspr has it surrounded by signatures or somthing... atleast it is not executed by the dumped proggy, so that might also be it... :)

/Manko
Manko
05-14-2003, 03:41 AM
Hi, Kyrios!

Actually I find out a while back, one or two days after I posted last in this thread, that I was wrong. No matter how much you looked at that first dip, you can't solve the problem YOU found.

I should have tried it myself, and maybe I would have found that it didn't really work... Hrm... (You had the part of the dip patched in your own way, which also worked.)

Anyway, I got to work on it and soon tracked it down to something to do with the nag... ;)

I won't say moore now...

(But NOW I have it patched and running perfectly!)

/Manko
kyrios
05-14-2003, 11:11 AM
manko, you are such a lier! :)
the 1st dip you were talking about will only fix :
1. Can't detect proper CPU clock & RAM clock
2. Advanced Timing Option
3. etc

if i fix it, those problems are gone away. :)
written from 1st dip :

:0051E3C4 PUSH EBP
:0051E3C5 MOV EBP,ESP
:0051E3C7 MOV BYTE PTR [0054F1C4],00
:0051E3CE MOV EAX,[EBP+08]
:0051E3D1 MOV [0054F194],EAX
:0051E3D6 POP EBP
:0051E3D7 RET 0004

Make sure [0054F1C4] always return 00 while program running no matter what.

And for my problem, i already solved.
It's all about [0054F1A0]. The offset is wrong. The correct one should be just pointing to a RET. :)
A way how to find [0054F1A0] is just look at the 2nd dip.

2nd dip
:0051E3DC PUSH EBP
:0051E3DD MOV EBP,ESP
:0051E3DF MOV EAX,[EBP+08]
:0051E3E2 MOV [0054F198],EAX
:0051E3E7 MOV EAX,[EBP+0C]
:0051E3EA MOV [0054F19C],EAX <<< Add 4 bytes = [0054F1A0]
:0051E3EF POP EBP
:0051E3F0 RET 0008

I must say thx you Manko. Without your "false" clue, i couldn't fix this target. But if you just told me the correct one, hey... where's the fun? Thx again :)

later,
kyrios
Manko
05-14-2003, 02:09 PM
Hi, Kyrios!

Hehe... Sometimes I just get confused, and often I'm either too lazy or too rash...

Besides, some confusion could also be blamed on us doing different versions... That is, my confusion... :)

Glad you got something out of it!
That was always what I hoped for.

btw, how did you find and fix the problem with "global"-somethingorother? I fiddled around with things, being too lazy to document anything, getting lost... When I said to myself, "hey this is Delphi and someone left the info on the procs of that nag in the exe." I played with this a bit but got bored and did something else...

I dumped the proggy when nag was shown and again when it was destroyed... *snigger*

I would probably have found it anyway if I weren't so undisciplined... hrm... :)

But actually, I quite liked the method I used... It was amazingly effective with this target. :D
Can't wait to try it again some other time... :)

/Manko
kyrios
05-15-2003, 12:18 PM
The way i found it :
From 1st dip [0054F1C4], a few bytes after it you will see the "no right click trick" (if you already fix it, you'll meet 9191). And a few line up, you will see [A] and [B] from 2nd dip.
ripped from 2nd dip :
:0051E3DC PUSH EBP
:0051E3DD MOV EBP,ESP
:0051E3DF MOV EAX,[EBP+08]
:0051E3E2 MOV [A],EAX
:0051E3E7 MOV EAX,[EBP+0C]
:0051E3EA MOV [B],EAX
:0051E3EF POP EBP
:0051E3F0 RET 0008

I'm wondering myself could it be the central of the trick lies here?
If you take a look closer, [A-4] and [B+4] look likes offset to me.
So i put bpmb on [A-4], [A], [B], and [B+4]. Then when i close the target, surprise... it breaks on [B+4]. Well, this must be the trick i said to myself. The offset could be wrong. Cause i found (many) the same trick on other ASPRed target which won't load on beginning start (like CALL dword ptr [eax+50]).
my next experiment is patching the nag to fool the program that i'm registered user. and well , the target reacted different. When i close it, i break on different offset but still on [B+4].

The code is similar like this :
cmp bla.. bla..
jnz yyyyyyyy
mov [B+4], 00xxxxxxxxx

Could it be this 00xxxxxx is the correct offset for [B+4]? So i change it. and you know what? it works.... :)
This 00xxxxxx is only a RET. You could even seek any RET you found and point [B+4] to it.

I also found the way i patching the nag(i describe it be4) is still showing the nag eventhough the "show startup......" is not grayed anymore. The correct one is go to the parent CALL, then a few line up you could insert your code to any space you found, inject your code, and then jump back. That's what i did but i'm pretty sure there are plenty ways to trip to rome.

later,
kyrios


PECOMPACT packed dll(1.6 - 84)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PECOMPACT packed dll(1.6 - 84)
PDA

View Full Version : PECOMPACT packed dll(1.6 - 84)

asd
05-02-2003, 01:05 PM
I was trying to unpack/inline patch a dll treated as above.

I found the oep and suspended the dll at OEP in SICE using IECEXT. I tried to rebuild the import table with Imprec.

Now the dll is working in certain environment like if it is the first dll called from the prog. It doesnot work on different comptuer or diff OS(win 98) or its 3rdc alled dll etc.. I worked in Xp.

what could be cause. Relocs ?

Plz help me with suggestions.

____________________________________________
Edit : exetools forum wass down:( ; I had discussed about this there earlier. Please tell me if I violated rules I'll correct myself:)
S3ri@l CoDe9x
05-03-2003, 05:54 AM
.. The IAT redirection in Win 98/ME ... It´s diferent to 2k/XP :p

I had this problem to the cracking a program with aspr.. (DzSoft PHP Editor 1.2)

It was simple only i Nop one call and this work wonderful in
win 9x/Me :p

But i have 2 .EXE's ..One for XP /2K and One for 9x/ME

If your problem is that the program remains in memory or simply it doesn't work :(

U need to rebuild the IAT directly in one win 9x/ME :p

i hope help u :p

Best Regards! :rolleyes:
asd
05-03-2003, 10:34 PM
yes it remains in memory and doesnt work- somrtimes error messges. I see that 98 dumped vesion works only in 98.
building IAT on Xp dumped version in 98 doesnt help.

further the problem is if the dll calling order is different it wont work.

Can i not modify the unpacked dll such that it works all platforms - else unpacking would be sort of incomplete.
any clues -- I will explore
S3ri@l CoDe9x
05-04-2003, 03:03 AM
"It doesnot work on different comptuer "

i read again your past post .. for this i only have one question..

U verified if your method for dumped it's correct? :confused:

We go!!..Pe Compact it's not complicated...:p ..

Maybe .. rebuild IAT it's not the problem ;)

Best Regards! :rolleyes:
asd
05-05-2003, 01:20 AM
Sorry it didnt work intially i dont know what was wrong.
i chacked the last dump at same oep works on any computer (3) checked but with same os.(98/me or xp) not checked 2000.
asd
05-06-2003, 02:51 AM
I changed the image base from 00400000 to image base when it works in one situation inside IDE. Now it works in all envirinments in a Single OS but not across different OS.
Looks like the OEP is correct because all the functions of the dll are working and no errrors occur once the dll is loaded.

I tried relox - relocation fixer by mact but then it crashes.
dont know how to do it manually Yet. ... have to learn.


Stuck with C-dilla Safecast protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Stuck with C-dilla Safecast protection
PDA

View Full Version : Stuck with C-dilla Safecast protection

dee
05-04-2003, 01:06 AM
The program is 16 bit program protected
with C-dillas Safecast, there is no trial, tryout or something...
just you've got to put the unlock code to register the program;)

I have patched the program (the exe) it wont asking the code and starts with
the list of the cars and etc. but when i'm trying to go to the detailed
description by presing OK or clicking on the car model or engine or ...
the program displays error messagebox, of course i cant take out that
messagebox, but the problem is:
i'm not getting any detailed description, and the toolbar at the top
stays disabled

i've tried everything can't find how to make that toolbars and
detailed description to work ok

i have patched in the past some Safecast protections like
Autodesk Map by reseting license, and have reversed it with no need
of reseting licenses to make it work. But I really really:)
stuck with this 16bit Autodata program, maybe I am doing something
not in the right way, i've attached screenshots, because the program is
huge can't upload it, anyway any suggestions, other solutions or help would be apreashiated:)

thanx

Best Regards
Kayaker
05-05-2003, 05:02 PM
Hi

I edited your post slightly on a 'Report this post' request (which are appreciated for any posts people find inappropriate (or more so than usual anyway). The question shouldn't be target specific other than to supply the name of the program IF it's necessary in providing an answer. A general reversing approach to any target is usually the best in any case.

You seem to be approaching this from a patching perspective, so C-Dilla and its registration scheme may or may not be involved. You've got a disabled toolbar and a message box with a GPF address as clues. Usual approach would be - input from the OK button can be traced with button notification messages, and the mouse clicks from a listbox or listview, or whatever Windows control your cars are listed in that you click on are, can (should) also be caught with specific WM_COMMAND or WM_NOTIFY message BMSG breakpoints. Also, during creation of the toolbar there must be a check whether to enable it or not.

Hands on tracing and use of the Softice Backtrace feature if you've got it should narrow down the code somewhat. There are several ways you could get into the code, but the real question here is if you can do this in 16 bit code as easily. The backtrace should work, just pay attention to the segments, but I've not tried BMSG breakpoints in 16 bit code. Just convert to the 16bit API's for whatever ones you might need and you should be able to break in somewhere.

Beyond that, there's not much answer to what the program might be doing until you explore it yourself. A little more detail on what you've tried might help.

Regards,
Kayaker
evlncrn8
05-05-2003, 05:27 PM
could also be safecast licence thingie, a kinda hybrid of flexlm that cdilla seem to use.. the disabled toolbad kinda implies that, because if it was normal safecast, once its removed all should work as normal, considering its more or less just exe crypt+api reroute
dee
05-06-2003, 06:50 AM
how do i get rided of that registration form:

loaded the program from the entry point and traced down:)
i found the call there the registration box outputs and just changed conditional jump, then i found some check whitch are checking to exit or not if that box was not displayed, i made them go to the right way too, the second call was checking is license expired (if registration box not displayed it puts msg that license expired) i made that go the right way too:)
thats all the main part loaded everything is working engines cars and ... just the toolbar disaibled, i think it must be disaibled in this first stage...
so i tried to see detailed description of cars and boom i got that error msg,
i backtraced it with softice easily by putting bpx on messagebox
found the check where it is jumping to the sendmessage
to display error, and just backtraced back to the call i
found the call like this (dont know how to say it in english so giving you an example, sorry):
call far xxx [bx] - somethng like this
and thats all, i think this call is jumping to the right place if
program licensed if not to that message, but i cant find that place where that license is checking, and putting the right value to make the right call,
oh and i put the preakpoint on that call and i saw that everything goes thru it:)
it may be that i'm wrong about this call, because inside the function this call calls it is a check to jump thru that messagebox or display it, i've traced down but with no success, i did not made the program to display the toolbar and description right:(

i hope you understood what i tryed to say here (sorry for my english) :)

help if you can

Regards
Kayaker
05-07-2003, 06:18 PM
Hi

Might as well continue with this. To start with, offering to upload a 650Mb file so someone else can help you crack it... is a crack request pure and simple (extravagant) and is not tolerated.

But I understand what you've done, and you can go further. You've traced back from the 16bit Messagebox and found an indirect far call referenced by the bx register. Many calls the program uses may funnel through this one call, so what you should be able to find is a table of jump addresses. If there aren't too many of them you may be able to view them in a disassembler and see if one of the procedures looks like the path you want the program to follow. Somewhere in code before the main indirect call will be code which sets the value of bx, seeing how it's set will also give you clues.

You've worked backwards and found what may be a pivotal point in the program, we'll go with that assumption for now. Now you need to work forwards to that same point and understand the code. What I was getting at above is that another approach is to follow the input of the buttons or a left click on a listbox and find the message handling routine for the program. After Windows processes the notification message it will pass it to the handling code if it's been written. In there will be the check of whether to proceed to the Messagebox or elsewhere. It might be a simple flag or it might lead to a full blown registration check.

If you can't set an appropriate BMSG message breakpoint, any one will do to find what is the main message handling routine or you might be able to recognize it in a disassembly if you understand how they are structured. Then you can set a regular breakpoint and figure out which hex number being handled from the stack (i.e. wm_command == 111h) belongs to the message you want to trace further, other parameters indicate the details of the message. If you can find your way through the codewoods this way you'll make progress, good luck.

Kayaker


Please confirm this rumour about Code-Lock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Please confirm this rumour about Code-Lock
PDA

View Full Version : Please confirm this rumour about Code-Lock

Mambo
05-04-2003, 12:43 PM
Is this true that no cracker in the world has yet cracked Code-Lock? :)
What famous programs use this protection, so I can check if it´s true?
squidge
05-04-2003, 12:57 PM
Why not type it into google or similar search engine and find out? If it's so good, they are going to be using it on there own products...
Manko
05-04-2003, 01:13 PM
Hi!

Hehe... Has Ryan gotten himself a new nick?! :P

No, it probably hasn't been beaten. But that is mostly due to its obscurity, I think... Go look at the forums at the main site... Kinda dead... and, have you ever heard of a target, using it? No... ?

Actually it was quite some time since the author asked a couple of newbies here to take a look at it. They did so out of the kindness of their hearts... And they beat it, down to one last feature... There was a lot of bullshit around that feature... Author saying they could test it and crackers saying it wasn't implemented... author saying, do it yourself if you are good crackers... Hrm... ?? :(
And I guess they thought it was pretty ok... ...or they just got bored. But I don't remember so good...

That thread can still be found on fraviaMB.

The thing that puzzles me though, is, why haven't we seen ANYTHING since then? Hmm... Maybe vb-appers don't care, don't wanna spend their money or it's not ALL that?

I guess it might be hard to establish new protectors on the market? Especially if they are made in VB... However good it may be, it will still be looked down upon... ?

/Manko
Mambo
05-04-2003, 01:45 PM
Yes, that was my problem. I couldn´t find any programs using it, but it says that it´s been uncrackable over three years so of course was I curious.

I´m a total newbie ( and will always be ) in cracking but these never cracked- things are very interesting.
When The SentinelSuperPro dongle was attached to 3D Studio Max 2.0, it took only seven days that some mysterious cracker, calling himself ForceKill, cracked it in seven days after five leading crackers gave up. I don´t know if it was hard to crack that time, but they say that never have they been so close of an effective copy protection. :cool:
squidge
05-04-2003, 03:02 PM
Well, I've downloaded it. Notice that it's an OCX, seems to be for vb progs only, and that the main data creating prog seems to be protected by telock. At that point, I got bored.
Shoob
05-04-2003, 05:14 PM
dito vb and telock...
ryan
05-04-2003, 11:27 PM
First, I have not used another nick.

Second, I am surprised my software is being mentioned again.

Now, why is it still not cracked?
To crack it, you must be able to crack a demo program. A demo program is a demo program. It simply does not have the functions in them. Have not heard of inserting functions/routines into VB apps yet, have you?

Secondly, it is not easy to break into an established market. I am slowly getting more customers but most prefer to stick to aspack/asprotect/armadillo.

Thirdly, the method of protection, demo-based, is not popular among software authors. Most prefer trial-based. This discourages users.

Also, it is more trouble to implement Code-Lock into a app compared to the 3 "protections" above. This discourages users.

Lastly, because I think like a cracker ;) , I build my protection according to that. Just look at the comments above.
...main data creating prog seems to be protected by telock. At that point, I got bored.
A part of my protection. Not the packer per se as the protection but the reason why I use it.

dito vb and telock
My advantage that not a lot of crackers like cracking VB. I was one of the few previously. :D

To crack Code-Lock, you have to find a program, buy it, get the full version which is also protected and crack that. Most crackers stop at the first step. ;)

For those interested, another program of mine called Slice-n-Save was converted to a demoware just for crackers to crack. Try it if you will. Of course, you will most probably think that it is not worth cracking a vb app. :D

Best regards to all the newbies
Ryan
evlncrn8
05-04-2003, 11:50 PM
>>>...main data creating prog seems to be protected by telock. >>> At that point, I got bored

>> A part of my protection. Not the packer per se as the
>> protection but the reason why I use it.

i'd personally say it shows a lack of faith in your own protection scheme, and using someone elses protection hardly makes it 'yours' now does it.. infact you could well have some legal issues from that.

>> dito vb and telock
>> My advantage that not a lot of crackers like cracking VB. I was >> one of the few previously.

thats hardly something i would be proud of

>> For those interested, another program of mine called Slice-n-
>> Save was converted to a demoware just for crackers to crack.
>> Try it if you will. Of course, you will most probably think that it
>> is not worth cracking a vb app.

who the hell is going to bother downloading a demo (presumably crippled) program, its a pointless exercise.. if you want people to crack (or try as you prefer to say) then give them something useful to crack as a reward, if the protection is so hard as you claim then you have nothing to lose have you?

as for breaking into the protection market, i would suggest that you use a language that is more accommodating to other programming languages, and possibly other operating systems.
CrackZ
05-05-2003, 01:16 AM
Ah (/me gives a *deep sigh*).

I remember this 'ryan' thread from a long time ago ;-).

A thought from my good self to the community (don't flame me
for this one ;-) ).

Can we PLEASE stop all of the <VB is junk/crap/overbloated> ad nauseam kind of remarks, no-one is compelled to program in it / use it / sell your relatives for a copy, its irrelevant in the copy protection game anyway ..... besides which I'd wager a small amount of $ that most of the "VB is crap" rhetoric is from people who've never used it in their lives ;-), (forgive me if this is not the case since I'm not singling anyone out here) :P.

However, to repeat what I said before, to ryan :

1. I'm quite unclear what is so revolutionary about your protection system, if its only functionality is to remove functionality I frankly don't see the point of using it. Or I don't see what it offers people above the competition. Or I don't see how it helps you when the credit card fraudsters get themselves a
copy .....

2. I think the 'challenge' of asking people to crack unknown functionality in your own custom application is unlikely to float here and is unrealistic, in any reasonable application the time to completely reverse engineer and discover the intrinsics would equate to something less than 3rd world per hour labour.

3. Putting things like 'uncrackable' or 'uncracked after 3 years' kind of won't help you much imho ;-), I view copy protection as something like 'fence building', you erect them, but ultimately someone tunnels under, jumps over, or cuts through the middle, but perhaps that is your intention in order to battle harden your product.

Anyway, please give some of this your consideration.

Regards

CrackZ.
ryan
05-05-2003, 02:47 AM
evlncrn8: You will never get it, so I won't bother explaining anymore.

CrackZ: Why are you always around when it comes to talking about this Code-Lock? :p

Originally posted by CrackZ
Can we PLEASE stop all of the <VB is junk/crap/overbloated> ad nauseam kind of remarks, no-one is compelled to program in it / use it / sell your relatives for a copy, its irrelevant in the copy protection game anyway ..... besides which I'd wager a small amount of $ that most of the "VB is crap" rhetoric is from people who've never used it in their lives ;-), (forgive me if this is not the case since I'm not singling anyone out here) :P.

I agree.

1. I'm quite unclear what is so revolutionary about your protection system, if its only functionality is to remove functionality I frankly don't see the point of using it. Or I don't see what it offers people above the competition. Or I don't see how it helps you when the credit card fraudsters get themselves a copy .....

It does more than removing functionality. I do not have to post a roadmap for all crackers right? ;) When a fraudster gets a copy of the protected software, they will not be able to distribute it since it will not run on other computers.

3. Putting things like 'uncrackable' or 'uncracked after 3 years' kind of won't help you much imho ;-), I view copy protection as something like 'fence building', you erect them, but ultimately someone tunnels under, jumps over, or cuts through the middle, but perhaps that is your intention in order to battle harden your product.

Putting "uncracked for 3 years" etc is an exercise for my php skills, a marketing scheme, and a challenge to interested crackers.

As I mentioned previously, I will be extremely happy if someone can crack Code-Lock. :o

Best regards
Ryan

Append:
I think this thread should be closed/locked since no matter what is posted, no one will ever try cracking Code-Lock. In case anyone thinks this is another method of mine trying to get people to crack it, it is not.
evlncrn8
05-05-2003, 02:58 AM
It does more than removing functionality. I do not have to post a roadmap for all crackers right? When a fraudster gets a copy of the protected software, they will not be able to distribute it since it will not run on other computers.

....

so what if i registered the program, then wanted to uninstall it and install it on another pc?

as for not getting it. i do get it.. i just dont think much of it

i decided not to start a the 'vb is crap' thing .. (however i myself started icoding in vb 0vbdos at that time), then moved to vb windows, and i do consider vb as crap after seeing its limitations)
banshee
05-05-2003, 07:08 AM
Anybody heard a story about John-difficult-to-catch?
(Because nobody wants to catch him ;) )
esther
05-05-2003, 07:20 AM
>so what if i registerd the program, then wanted to uninstall it and install it on another pc?

If you think if its crap,don't buy or cracked it coz you are wasting your time and you are coding vb LOL
Mambo
05-05-2003, 08:55 AM
You guys made things clear. :D
nikolatesla20
05-05-2003, 09:16 AM
So this comes up again ? :)

Here is the thing: I support Ryan with this protection, who cares if it's written in VB - that's the reason, because most crackers are too "righteous" to attack it. I'm sure when the first piece of high priced software comes out protected with it, you will change your tune. When that will happen of course, is another question.

As ryan mentioned, the main drawback to this protection is that it's demo only. To unlock the full version (which is actually in the same folder, but encrypted), you have to have the correct decryption key. So unless you are some crypto god that knows how to factor large primes instantaneously, you are screwed, no full version for you. I had no problem unpacking Code-Lock itself, and stepping thru the WTK debugger with it (it's written in p-code). Even was able to defeat anti-smartcheck, etc. But in the end it doesn't matter because the program that is protected is still only a demo. AND this is how it should be, most shareware authors need to learn a time trial is just not going to cut it, it's too easily defeated. A demo can never be defeated, unless you are so bored and cheap (more time than money) you use CodeSnippetCreator to add the functionality yourself (which really wouldn't be all that hard IMHO for some functions). So kudos to Ryan about this feature from me.

The real weakness however, of this protection, is that it's a DLL. (OCX), so once you get one good registered full version, you simply make a fake OCX that feeds the exe with the info it wants, and you are free to distribute. This defeats any checks, including computer ID, etc.

-nt20
CrackZ
05-05-2003, 06:56 PM
A quick follow up from me, based on nikolatesla's post, comments cc to ryan.

If all CodeLock does is keep a locked copy of the program with some effectively irreversible encryption, then it boils down to a very simple conclusion in my eyes.

Either you are distributing a locked version of an application which CodeLock has a facility to 'unlock'/

Or you are distributing a demo which might as well not have CodeLock period since it truly is a demo.

If the former is the case (which by all my logical reckoning it ought
to be), then CodeLock offers nothing new.

In reply also :

"I do not have to post a roadmap for all crackers right? When a fraudster gets a copy of the protected software, they will not be able to distribute it since it will not run on other computers."

Sure you don't, but if you expect or wan't people to give of their
time to attack it you've got to have some goal indicating success or failure, if the challenge is 'go reverse md5' then you've proved nothing. I'll be quite terse on the 2nd point, there just isn't a way your code can run and not be defeated, however you think you've locked it to a specific computer.

Regards

CrackZ
Woodmann
05-05-2003, 08:53 PM
Howdy,

So its Vb, big woop. Why does everyone keep bringing up this point ?

The really real deal with this code-lock is it has potential but,
me thinks someone is just trying to improve his image at the expense of all of you who respond to this.

Until it is provided with a "full" version, dont waste your time.
All you are doing is reversing demoware which is redundant.

We have been through this before, and we found no answer,
ever wonder why ?

CrackZ already told you.

OBC
ryan
05-05-2003, 09:31 PM
Originally posted by nikolatesla20
The real weakness however, of this protection, is that it's a DLL. (OCX), so once you get one good registered full version, you simply make a fake OCX that feeds the exe with the info it wants, and you are free to distribute. This defeats any checks, including computer ID, etc.
-nt20

I initially do not want to post any replies after my first post. However, after reading the reply from Crackz and Woodmann, I changed my mind.

I now offer Slice-n-Save free-of-charge to a few individuals who are interested in cracking Code-Lock.

As Slice-n-Save is protected by the full version of Code-Lock, just download it (for those who do not want vb apps on your computer, don't bother), install it (for those who do not want vb apps on your computer, don't bother), tell me the UserData based on your computer (it is shown when you click on upgrade).

I will give you the registration code free-of-charge. We can do this using the PM functions here, so you do not have to worry about me tracing back to you. Once you get the full version of Slice-n-Save, try cracking it.

There are many ways of doing so:
1) Code a Keygen for it (I have helped you by giving you a serial)
2) Make the full version run on all computers (I have helped you by getting you the full version)

If this still does not show you my sincerest wish to have you crack Code-Lock successfully, there is nothing I can do.

And to evlncrn8: Yes, I am very proud that I can crack VB very well, so well that at one point of time, some crackers think of me when they want to crack vb.
JMI
05-05-2003, 09:51 PM
Sounds a bit like the the PACE system of challenge-response where you call them and give them something which pops up on your screen and they put that into their SDK or whatever one wants to call it (license generator perhaph is as good as any), it runs through the hash and out pops the rabbit, err, I mean the license.

I don't know much about vb, yet. Been spending way too much time with mySQL and php at the moment, as well as trying to make a living, but would give it a shot if your program can withstand the abuse of a noob. So unless you are holding this out for the l33TO, of which there are many here, count me in. Worst I can do is break my computer.

REgards.
ryan
05-05-2003, 10:05 PM
Originally posted by JMI
but would give it a shot if your program can withstand the abuse of a noob. So unless you are holding this out for the l33TO, of which there are many here, count me in. Worst I can do is break my computer.

REgards.

Just go to my website and download Slice-n-Save. Do what I wrote above and PM me with your UserData. This is for everyone who is interested.
JMI
05-05-2003, 10:12 PM
ATTENTION! ATTENTION!

DO YOU WISH TO INITIATE THERMONUCLEAR DESTRUCTION??

CONFIRM?? or DELETE??

Well gollyee, I'm game fur a try. Will download and PM, but don't know exactly when I'll get "cracking" so to speak.

Thanks. Learning new stuff is always good.

Damn your page loads alot of crap. I know you have to pay for your webpage, but geeeeeeezzzzzz.

Regards.
evlncrn8
05-06-2003, 12:02 AM
.........
tell me the UserData based on your computer (it is shown when you click on upgrade
..............

hmm somehow i dont want to do that, as im not sure what information you would be able to derive from said data.. call me paranoid but i aint sticking my head in a lions mouth without knowing what size its teeth are.
ryan
05-06-2003, 01:09 AM
Originally posted by evlncrn8
.........
tell me the UserData based on your computer (it is shown when you click on upgrade
..............

hmm somehow i dont want to do that, as im not sure what information you would be able to derive from said data.. call me paranoid but i aint sticking my head in a lions mouth without knowing what size its teeth are.

That's what you, as a cracker, should do. Find out what the UserData is. If you need the software author to tell you what is in the UserData, you might as well not crack it.
JMI
05-06-2003, 01:23 AM
Just because he's paranoid, doesn't mean they're not out to get him. :D

Regards.
evlncrn8
05-06-2003, 02:18 AM
no perhaps i didnt make myself clear.. what i am asking is... are you able to obtain information about myself form said user data, like my name, information about my pc, my windows serial number, my hdd serial number and / or other personal information stored on my pc, because if so you are on VERY dodgy legal ground..

i will not enter into this little 'crack' my program due to the fact that you want me to run a program (yours) on my pc and then obtain a code from you so i can continue cracking it simply because i think your reasons are somewhat suspect..
ryan
05-06-2003, 02:20 AM
Originally posted by evlncrn8
no perhaps i didnt make myself clear.. what i am asking is...
i will not enter into this little 'crack' my program due to the fact that you want me to run a program (yours) on my pc and then obtain a code from you so i can continue cracking it simply because i think your reasons are somewhat suspect..

Forget it then. Like I said after I read your first post. You will never get it.
evlncrn8
05-06-2003, 02:22 AM
nope like i said, i do get it i just cant see the point, problem being is why cant you make a 'crack test' version where it uses a geneic id/code/whatever for this test.
ryan
05-06-2003, 02:55 AM
Originally posted by evlncrn8
nope like i said, i do get it i just cant see the point, problem being is why cant you make a 'crack test' version where it uses a geneic id/code/whatever for this test.

Reason is simple. I shall put it simply so that you can hopefully understand.

Code-Lock's protection is like that. A user who wants to register a Code-Lock protection app has to tell the author the UserData shown based on his computer. From there, the author can generate a serial that will only work on the user's computer.

If you want to crack Code-Lock (I am giving you the chance by giving you the serial that actually cost USD 10, and no cracker would actually pay for it), you should try out the REAL situation.

That is, you, give me the UserData, and I, will give you the registration code that will work on YOUR computer. Without the UserData, I will not be able to give YOU the serial since I have nothing to start with.

Understand?
Hopcode
05-06-2003, 06:01 AM
Drop it Ryan, he has some troubles to understand ;=)
A shit load of protections does this, its usually called hardware
locking feature, but oh well.

If he is stupid enough to put his real name and shits on his puter, that's his problem..

As for your contest, im going to give it a try.
Will message you later.

Regards,

HopCode
Mambo
05-06-2003, 07:10 AM
Remember to write a tutorial then. ;)
It sounds very hard, you will be honoured. :p
squidge
05-06-2003, 07:40 AM
Can you answer a simple question of whether or not Codelock contains any malicious code whatsoever ?
ryan
05-06-2003, 11:41 AM
It does not format/fdisk your harddisk. :eek:

Edit: It does not send data to anywhere else. :p
esther
05-06-2003, 11:58 AM
He meant like some programs sending personal data to certain server
ryan
05-06-2003, 09:22 PM
Interesting observation...

After all the whinging about not getting a full version to test/crack, I have offered my software (full version) free-of-charge for crackers to try.

Yet, there are no takers now.
Woodmann
05-06-2003, 09:39 PM
Relax Francis,

There have been some of us who have downloaded.

I have a question..........

What will you do when your protection has
been broken ?
We know that if it is difficult enough no one will
bother with it but, what if it really can be keygenned?

Have you thought about the ramifications of this ?

OBC
ryan
05-06-2003, 09:59 PM
Originally posted by Woodmann
Relax Francis,
What will you do when your protection has
been broken ?
We know that if it is difficult enough no one will
bother with it but, what if it really can be keygenned?

Have you thought about the ramifications of this ?

OBC

My name is Ryan. :p

Anyway, the purpose of me approaching this forum as an author a long time ago is because I do not wish to sell snakeoil like bi-tarts, asprotect etc. My aim was to see if it can be cracked at all with the current technology and tools. (Don't tell me everything can be cracked, I know that too.)

So, if my protection can really be cracked, I will:
1) stop sales until it is improved
2) improved it, think of better ways etc.
3) Improve my own cracking skills. ;)

It is always a race between the author and the cracker to see who is laughing at the moment.
esther
05-06-2003, 11:33 PM
what about the price? lower maybe ppl would consider especially code-lock :D
ryan
05-06-2003, 11:39 PM
Hi, ;)
the price is set at $200. However, it is virtually selling at $99 most of the time. Occasionally, it gets to $50 like this month. Reason is because I found that with a sharp drop in price, you will get people buying. If the price is always the same, no one is interested. If I were to keep it at $50, I would not get the same number of sales as I would have if I drop it to $50 occasionally. Some sort of marketing scheme. :p

Ryan
nikolatesla20
05-07-2003, 07:27 AM
Reminds me of the constant race between Lunar_Dust and the makers of Armadillo , regarding DilloDumper...

-nt20
cyberheg
05-07-2003, 08:16 AM
Originally posted by ryan

Anyway, the purpose of me approaching this forum as an author a long time ago is because I do not wish to sell snakeoil like bi-tarts, asprotect etc.

No snake oil you say? So when are you posting all the documents on design an implementation details?
Maybe you should learn what snakeoil means before telling crap like this. Ofcourse it's snakeoil, nothing more.

The only feature that goes against it is the use of some cryptographic keys large enough to stop forging/bruteforce attacks which I assume you use that will be used for decryption when making demo's into full.
If you really mean that your product is not snakeoil then you are not worried that people know how it works down to smallest detail because it won't affect security. Do you also claim your product security is the same whether or not people know everything about how it works?

Comming with such statement are just as brainless as the ones from the Armadillo guys who says one of the most important things about protection is debugger protection (which unfortunatly lasts no more then 5 min for any fairly experienced crackers).
This is just foolish and you are making a fool out of yourself by saying such.

What makes your product non-snakeoil?

// CyberHeg
esther
05-07-2003, 09:02 AM
Cyberheg:

You didn't even look at it and assume you know its snake oil
snakeoil or not thats the final judgement.

>So when are you posting all the documents on design an
implementation details

Its a cracker's job to find out ;)

Ps:Ryan didn't claim that its uncrackable
cyberheg
05-07-2003, 09:53 AM
Originally posted by esther
Cyberheg:

You didn't even look at it and assume you know its snake oil
snakeoil or not thats the final judgement.

>So when are you posting all the documents on design an
implementation details

Its a cracker's job to find out ;)

Ps:Ryan didn't claim that its uncrackable

No, you're right I didn't bother look at it. It was enough for me to read his website, download his program and read the docs and see what other people say about it.
I've done enough research on this topic to know what the real deal is. But I don't say more then this since I don't want to tip people in what direction to go. In my research I went in directions currently not seen in software protection and it surprises me time by time that protection developers follows each others footsteps and choose the same path to fall over the cliff.

Somehow this reminds me of Joe cartoon:
http://www.joecartoon.com/pages/livenletdive/
:rolleyes:

// CyberHeg
esther
05-07-2003, 10:19 AM
sigh,you only read the book cover and juge it.just like when you claim I delete some ppls accounts LOL
ryan
05-07-2003, 11:35 AM
Originally posted by cyberheg
No snake oil you say? So when are you posting all the documents on design an implementation details?
Maybe you should learn what snakeoil means before telling crap like this. Ofcourse it's snakeoil, nothing more.

Design and implementation details are on my website and in the help file if you have bothered to read with your eyes open. Maybe when I say RTFM, you will understand?

I am not designing a cryptographic algorithm such that it must be open to the public for scrutiny.

Snakeoil to me is if I claim that it is uncrackable. It is not. However, it has not been cracked yet.

The only feature that goes against it is the use of some cryptographic keys large enough to stop forging/bruteforce attacks which I assume you use that will be used for decryption when making demo's into full.
If you really mean that your product is not snakeoil then you are not worried that people know how it works down to smallest detail because it won't affect security. Do you also claim your product security is the same whether or not people know everything about how it works?

Read above. I am not designing a cryptographic algorithm. I am not worried about people knowing how it works. In fact, I invite you to try cracking it and find out for yourself, a job that a cracker should do. If I were worried, the product would not be in the market at all. The safest network system is the one that is never up.

Comming with such statement are just as brainless as the ones from the Armadillo guys who says one of the most important things about protection is debugger protection (which unfortunatly lasts no more then 5 min for any fairly experienced crackers).
This is just foolish and you are making a fool out of yourself by saying such.

I did not say such. If you are interested in personal attacks go to other places. Or go to armadillo forum, not here. I have been stressing that the most important thing about protection, in the case of Code-Lock, is that the demo version of the protected software does not have all the functions.

What makes your product non-snakeoil?

Simple. I claim that it has not been cracked. Note: I did not say it cannot be cracked. Now, as long as you can't crack it, it is not snake oil and you are talking crap. :rolleyes:
Paul333
06-07-2003, 07:15 PM
Hmmm so its just like any other app then...theres a place where i can add a serial to unlock it ?..

paul333
Aimless
06-09-2003, 12:36 AM
Ryan,

To confirm, you will consider Codelock cracked if:

1. A keygen (or serial generator algorithm) is understood and made

2. It is possible to install Slice-n-Save on multiple computers

3. If a serial is found to unlock the full version, WITHOUT subscribing to your PM?

Let me know of the same.

Have Phun
ryan
06-09-2003, 11:57 AM
hmmm... thought this thread is forgotten. Damn...

To confirm, you will consider Codelock cracked if:

1. A keygen (or serial generator algorithm) is understood and made

Yes and no. You still have to find out the individual program's program code to generate a serial.

2. It is possible to install Slice-n-Save on multiple computers

Yes, if you are talking about the full version of Slice-n-Save.

3. If a serial is found to unlock the full version, WITHOUT subscribing to your PM?

If you "find" the serial using a fake cc, it doesn't count.
LaBBa
08-21-2003, 06:50 PM
hi nikolatesla20

"you simply make a fake OCX that feeds the exe with the info it
wants, and you are free to distribute. This defeats any checks,
including computer ID, etc."

at the first time that u have try/Unpacked that app i saied :

"Actually sandworm, this is the approach I was taking. I was
creating a Code-Lock.ocx emulator. I wrote my own ocx which
responds with the appropriate answers"

Well Lets say that i have found a Serial (i didn't so dont ask how;)

can u share that OCX source ?

About the protection it self :

i asked around a lil about this protection (tnx Vag).
well ..its nice now that there is a good protection that can protect from Serial KeyGen, since it Encrypt the file in a Zlib !! it's like Cracking WinRAR Protected file with a paasword!!!
it's impossible but brout force it ..

But still there is no UnCrackable Packer i.e : ASPR , Armadill , SD2
etc....

so if there is someone that is Crazy about File Encryptions this is a target for u ..

Regards , LaBBa.

(P.S - just sharing what i know .. nothing more nothing less ;)


Add .res to exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Add .res to exe
PDA

View Full Version : Add .res to exe

QuickeneR
05-05-2003, 03:43 AM
I'm looking for a tool that can paste the resources from a .res file into a dumped pe executable (the exe has no resources). A surpsingly big number of reseditors can not do this. Right now I'm using ResHacker + MSVS.NET but it is still too much mouse clicking.

What is preferred way of doing this?
disavowed
05-05-2003, 08:16 AM
you could use lordpe to add a res sections by "load[ing] section from disk" on your target
QuickeneR
05-06-2003, 04:50 AM
Thanks disavowed!
Your advice helped. There is really no need to translate the resources to and from the .res format if I can cut and paste them into exe directly.


Total time used
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Total time used
PDA

View Full Version : Total time used

newbie41083
05-05-2003, 03:17 PM
Hi,
This prog is one where it says you can use it for a total of 60 minutes. It checks for debuggers and regmon as well. It starts up with a browser window(its own) with buttons that say Play or Buy. I restored the registry that i had saved when i had 50 minutes, but the game still says 43 minutes. so it doesn't find the time from the registry. how do i start off with this thing??

thankx.
dELTA
05-05-2003, 03:47 PM
It might very well use both the registry and the file system to hide its data. Some programs even use non-filesystem harddisk space for such things, but it's not very common.

You should try to use a stealthed regmon/filemon and possibly also debugger to check it out some more.

Also, you say it uses a browser window. Does it require you to be online while running it? In that case it might manage the time limit via a remote server. In that case I would hook the networking API:s and track the communicated data to the actual check in the program and then patch it.

dELTA


Autodesk Visual Lisp Decompilation...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Autodesk Visual Lisp Decompilation...
PDA

View Full Version : Autodesk Visual Lisp Decompilation...

gadget
05-05-2003, 06:13 PM
Autodesk Visual Lisp Decompilation...

I know this is a bit off topic, ie non asm but I was wonderin if ne one outhere know of any proggie to do this, any sources, or anything related to the bytecodes etc used in vital/visual lisp *.fas files. Has ne1 looked into this?

regards

Gadget
Rackmount
05-06-2003, 01:30 PM
Hi:

I am a CAD user and have done some work with LISP. I am currently studying a application based on the ARX file format. ARX is nice in that it is usually coded in C/C++ and so is easily decompiled into the ASM we all love so much. As for decompiling LISP....hmmm.... haven't ever tried it, but I am game on following this line of study as well. I will begin my search for background material to assist the dissection of LISP...surely others have trod this road ahead of us and left their footprints for us to follow...let's go!

Rackmount.... but wait...there's more!!

Found this info already(slightly edited) from site hxxp://xarch.tu-graz.ac.at/autocad/bi4/#ViLL (replace x's -->http):
"It could be possible (so far only theoretically) to retrieve some symbol values (esp. strings) from BI4 or FAS files, if you hack the internal encryption scheme, but it is impossible(?) to get lisp source code. (as hard as getting complete C source code from .EXE files). As far as is currently known, there is no FAS decoder out yet.
Compiled Lisps usually have the extension .BI2, .BI4 or .FAS
Compiled Lisps are not decryptable nor readable.
Compiled Lisps load and run faster than plain AutoLisp, but need a special environment. BI4 files need a special ACADL.EXP/ACADL.EXE, FAS files in Vill 1.0 an external Run-Time System. Vill from version 2.0 on creates single ARX files."

Hmmmm...this could be quite a chore to create a decompiler seems like you would need to
1) decrypt ---> I am only beginning to do cryptography (just reached lvl 1 on Mallatia's site)
2) pattern recognition ---> identify native LISP functions

One thing to test...if you can compile a simple function a few times and compare what it looks like in encrypted form. Is it the same with each compilation? Is it the same when compiled on a different computer? Does this even help...dunno...Im a newbie...why you askin me?...lol

Rackmount
Dead_Loop
06-15-2004, 10:15 PM
Hmmmm...this could be quite a chore to create a decompiler
So you want to write a fas-Decompiler. :yay:
You're welcome to take part in the Lisp Decompiler Project (LDP).
Take a look at:
hxxp://lisp-decompiler-project.cjb.net
Most of the reverse engineering work(decrypting the Fasstream and getting format of the Bytecode commands) is already done.
Now it's up to analyse the data from the fas-disassembler and retransform it to real Lisp commands. :sneaky:


WinHEX 10.8 - Specialist version - Here
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > WinHEX 10.8 - Specialist version - Here
PDA

View Full Version : WinHEX 10.8 - Specialist version - Here

Paul333
05-05-2003, 07:29 PM
This is just out..

Ive enabled it to accept a previous licence

To check YOUR licence validity..

Try and save a file larger than 1 to 2 mb's.

It will not save it if licence expired..you will get the nag

"Invalid User.txt"

Ive only made it available to friends & Crack friends @ Exetools & RCE

Note..WinHex pack was too big to attach so ive uploaded a Patch for Latest Winhex v8 :)

Enjoy

paul333 (Bunions_carboot)
JMI
05-05-2003, 08:55 PM
Paul333:

HEAR THIS LOUD AND CLEAR!

Regardless of your intent, the posting of cracked commercial software, or cracks for commercial software is NOT permitted here. If you have read the Forum Rules you would know this already. If you haven't read the rules, please do so now.

Further transgression of this rule will, at the least, get you banned. These kinds of events threatens the entire viability of this Board. We get enough flack just "talking" about the subject of reverse code engineering without anyone attempting to make this Board a condiut for the distribution of programs which have been reversed. If we are to resist effort to shut this Board down we can not permit such events to occur.

Please acknowledge that you have clearly understood this message.

Regards.
esther
05-05-2003, 09:31 PM
then this post should be deleted :D
JMI
05-05-2003, 09:42 PM
Left it as a WARNING!!!

Regards.
esther
05-05-2003, 09:44 PM
They are nerds warning doesn't help :p
JMI
05-05-2003, 10:01 PM
esther:

I know your insane :D but take a few deep breaths and consider:

Paul333 is apparently a fine Scotish lad and a few blows across the noggen with a lagre crudgel is sometimes necessary to carry the message home, now don't ya know. :D Give the poor lad half a chance.

Regards. :cool:
Paul333
05-05-2003, 10:08 PM
Ouch!! Message read , felt , and UNDERSTOOD.

Please accept my apoligees JMI.

I WONT DO IT AGAIN!!..

paul333
JMI
05-05-2003, 10:16 PM
And NUFF SAID.

I know your heart was in the right place, but "they're" watching and looking for excuses because they don't have a life. :p

Regards.
esther
05-05-2003, 10:25 PM
JMI thanks for downloading my "crackme" definately you learn something from it muhahahahhaha
JMI
05-05-2003, 10:30 PM
esther:

I've tried to explain this to you several times. I'll try it again
r e a l l y s l o w l y. :D You don't have, or need a "crackme". You are already "cracked." :p You need a "repairme" or a long vacation in the south of France, err Freedom as we say here now. :D :D If you need to "get a grip, " try superglue. :p

Regards.
esther
05-05-2003, 10:39 PM
JMI:
Thats a gift for the board :D :D :D

>You need a "repairme" or a long vacation in the south of France
Gimme money and I'll go muhahaha

>If you need to "get a grip, " try superglue
probably you really need it :p


Exctracting Debug Mode Exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Exctracting Debug Mode Exe
PDA

View Full Version : Exctracting Debug Mode Exe

Bengaly
05-06-2003, 05:36 AM
i'v wondered if someone knows a good article / example
on extracting symbols & source code from debug mode exes created by a linker (Masm / VC..etc).
i'v seen the exes are refering to *.pdb (Programm database) files which are built with the exe.
mabye there are other files which holds the source code.
cuz i would like to load the source code with my disasm.
any ideas wil be welcomed. :)


xxx.reversing.net?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > xxx.reversing.net?
PDA

View Full Version : xxx.reversing.net?

gadget
05-06-2003, 03:29 PM
ne1 know what happened to this board? (russian btw)
also where's maimach's site gone

regards

gadget
flotsam@newsguy.com
S3ri@l CoDe9x
05-07-2003, 12:05 AM
If u find one board in russian language :p

enter here:

hxxp://www.xtin.org <--- remember change http

Best Regards! :rolleyes:


Pseudo-HMEMCPY in OllyDbg?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Pseudo-HMEMCPY in OllyDbg?
PDA

View Full Version : Pseudo-HMEMCPY in OllyDbg?

Aquatic
05-06-2003, 05:16 PM
Can someone plz clarify what these ppl are talking about?: http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=206

Some Spanish guy said he wrote a tut on "POINT HMEMCPY" or something for Olly in XP.
esther
05-06-2003, 09:07 PM
Read this you will understand
http://biw.rult.at/tuts/ollyguide2.rar
Aquatic
05-06-2003, 10:48 PM
Thanks :)

got any more Olly tuts?
esther
05-06-2003, 11:21 PM
google has a lot
JMI
05-07-2003, 12:15 PM
Well then, why doesn't google share them?? Hoarding them for itself??? :D :p :cool:

Regards.
esther
05-07-2003, 12:23 PM
Its not why they don't share.You have to find the treasure yourselve ;)
mythical
05-19-2003, 09:55 PM
I followed the tut, and it didn't work. It may be because I use Windows XP....Oh Well
Tacman
05-20-2003, 01:27 AM
Read it again it works. I have WinXP Pro sp1 and it works fine.
mythical
05-20-2003, 02:57 PM
I will try this again, but I think my problem is when I have to type "MSG==201" or "MSG==202". I will let you know how it goes on my next atempt.
Ricardo Narvaja
05-20-2003, 05:49 PM
I write this tute (i,m some spanish guy jeje), and the tut is for NT/2000/XP and XP mas sp1 works well all members of crackslatinos, works well with point h, is a seudo hmemcpy, with 80 or 90 per cent de efectivity, and is very useful.

Ricardo


revirgin probs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > revirgin probs
PDA

View Full Version : revirgin probs

asd
05-07-2003, 11:12 AM
I tried using revirgin - 1.5 public/private bulid on win xp no Sp1.
when i enter the oep and ask to 'fetch IAT' it says nothing found.
using the IAT resolver i get only 000's ain all columns not even asingle useful entry, this happens with all compressed IAT destroyed appz. with unprotectd it displays all imports neatly.

Imprec 1.42+ gives import in many cases using same OEP and the app works with IAT fix.
where could I be going wrong? :confused: Any problem wwith this particular version?
Plz help
esther
05-07-2003, 12:38 PM
Did you search the board for clues?
asd
05-07-2003, 10:22 PM
yes I do have searched.:D
I even know that the author himself has said that the tool has not been maintained since long now.
My problem unlilke most others is that it is always failing on compressed exes on both 9x/XP which has made me think i am doing something wrong :confused:
esther
05-07-2003, 10:50 PM
You didn't search the forum throughly enough ;).Remember the tool does not do everything for ya ;)

don't change the oep in revirgin leave it as 401000 try again
Hopes it helps.
asd
05-11-2003, 12:26 AM
OK this does work at times to get imports. But not changing to correct value before fixing the executable will screw the exe;)


Armadillo + UPX = (any good ?)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo + UPX = (any good ?)
PDA

View Full Version : Armadillo + UPX = (any good ?)

ssb
05-07-2003, 11:40 AM
I wonder what kind of protection scheme is better.
The program alone + Arm3 or the program UPXed + Arm3 ?
Beside some incompatibilities i've already noticed, is it better to Arm a upxed program ? I've heard that it's easier to dump a non upxed program than a compressed one.
Any experience ?

thanks
Shoob
05-07-2003, 12:55 PM
Almost every protector out now is crackable so do yourself an favour and compress your exe only to save traffic costs. I would propose you upx. I doesn't matter what is "easyer", when its illegal cracked, it will be soon attainable to every dumb warez kid.
ssb
05-07-2003, 01:22 PM
I know that Shoob, this is a fact.
Anyway anybody has any experience using upx + Arm ?

regards
S3ri@l CoDe9x
05-09-2003, 06:28 PM
Armadillo and upx? .. I never see a program packed with both :p ..

..u cann't protected a program with upx, aspack .. etc .. and armadillo in his modality of copymem 2.. u need use a standar option.. Logically this diminishes the protection degree.. the standar option it's really easy to unpack ....

I Unpack Easy Screen Capture ( Armadillo + Aspack protection) .. And it was very simple .. :p

Upx modified it's not a protection ... the only thing that it achieves on an upx having been modified is that not unwrapping automatic.....

Try protect with Pex..or using Aspack and Asprotect :p..

Best Regards! :rolleyes:
ssb
05-10-2003, 01:42 AM
Thanks a lot S3ri@l CoDe9x
cRk
05-13-2003, 12:28 AM
keep in mind that such exe protectors that gets fame as "armadillo" are only for developers with Poor brain to make their own protection scheme. makes the programs to take longer to load and takes much memory in the system.. i've used couple of trial with the newest armadillo and i could say in couple of time they crashed my system to make it reboot , example: HypersnapDX.. on some program armadillo dosen't work at all so i suggest to test your applications after wrapping them or packing them with any exe compressor... note that armadillo has been keyggened many times .. i could say he is the winner of been keygened more than asprotect ever was.. :cool:

about UPX.. the best PE format, exe, dinamic library compressor ever made.. it is free, makes your application smaller.. what else i'm missing ? :p note that UPX is not a protector it could be a protector for some kids but the idea for UPX is to compress and not to protect... btw UPX is the best. good luck
ssb
05-13-2003, 02:32 AM
Well cRk i know what you mean. I just have a "vertical market" application that need a form of protection. The problem is that i just want to distribute (legaly) this app so i don't have the source.
Just looking for some .exe protection and arm is the only one i know it protects quite well.
Of course it's crackable as everything. In my case a "vertical market" app is not such an interesting piece of code for most of us :)
I don't know if it's better to protect such an .exe using Copymem II (arm itself) or simple Arm protection over the upxed file.

thanks


Api Spy & Api Mon Terminate Process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Api Spy & Api Mon Terminate Process
PDA

View Full Version : Api Spy & Api Mon Terminate Process

Aquatic
05-07-2003, 09:13 PM
When I try to monitor the process with either of these programs the process terminates as if it is detecting that it is being watched.

Is this common, or am I just not using them correctly?
esther
05-07-2003, 09:22 PM
Plz search the board FIRST before you post anything
Your question has been answer.
Aquatic
05-07-2003, 10:08 PM
API Mon seems to be working ok now, it was displaying too much information so it must of crashed.

I am getting information overload with API Mon though, even when I filter it down to just one process, and just one type of API-type i.e "File I/O", I am still getting what seems to be an infinitesimal amount of information. There is no way I can make sense of 1000s of APIs listed every second.
dELTA
05-08-2003, 05:35 AM
There are usually filters in this type of programs, to let you remove any irrelevant items from the log list.

And yes, many programs/protections do actively check if they are being spied on. Some detect if certain other software products are running (like regmon, filemon, softice and so on) and some use more generic techniques.

dELTA


How
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How
PDA

View Full Version : How

Zkhan13
05-08-2003, 06:05 AM
How will I come to know that any EXE has been packed.?
Using Symbol loader!!
Tell me more about it
nikolatesla20
05-08-2003, 07:21 AM
First off you can use a PE Scanner, I use pe-scan myself a lot, but the best method I use is manually - I open the file up in PE editor program (such as PEditor or LordPE) and examine the section tables. A packed executable always has more sections than an unpacked one (usually), or the names of the sections will give away that it is packed.

This is how I do it in 99.9% of cases. After you become more familiar with different packers, you will recognize which packer it is usually by these two techniques, rather quickly. Experience is key.

Another way is to open it up in a basic disassembler, like WinDASM. If all you get is junk codes or it doesn't open in WinDASM, you have a protected file of some kind.

And one other way is to run the program, and then try to look at its imports with ImpREC. If you are missing imports and have lots of invalid "thunks", then the program is most definitely protected (packed too, usually).

There's a lot of techniques you can use.

-nt20
squidge
05-08-2003, 07:40 AM
With a lot of packed / protected files, you can usually recognise the assembler code using a debugger such as Ollydbg without actually running any of it. Sequences such as "PUSHFD ; PUSHAD" near the start of the code normally give away the fact that's it been packed/protected also, as do things like "PUSH EAX ; RET" and obvious looking self-modifying code.

However, you can never be 100% sure, but combining the above with other techniques such as examining the sections table can give you a pretty good guess.
Zkhan13
05-08-2003, 09:09 AM
I use Symbol Loader to open that exe.It displays an error like "Debug information is not found".Is it b'cze it has benn packed.
ProcDump is with me...Whether that s/w any use of this matter.?
squidge
05-08-2003, 09:25 AM
Nope. It means the file is a retail release (final version, etc). Since Softice is a debugger for your own applications, when you debug them, you include debugging information. When you upload them to the net/etc, you remove this information.


How I see the crack file source
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How I see the crack file source
PDA

View Full Version : How I see the crack file source

itsme_tun
05-08-2003, 12:07 PM
hi all ! ITs the best forum of cracking.allover the net ... i want to ask that ...if the file123.exe is the trial (mean original 1 ) and 1 is crack 1 eg crack123.exe of the file123.exe then how i see the crack123.exe resource ..that wat thing is cracker change from the original file............tell the software which tell me different b/w them of explain me ..................thanx allot to ready my message
Tc
asd
05-08-2003, 12:52 PM
Originally posted by itsme_tun
hi all ! ITs the best forum of cracking.allover the net ...
Tc

I may be wrong but it is a Reverse Software Engineering forum.
you probably may need correction before the moderators flame.

You can use many file compare utilities which show u the differences between the original and patched file. File compare, compare. you can search this board, exetools, protools etc and also google to find many.
Some patchers also show U the differences before they patch.
You can even use a good hex editor and open both files and compare.
Hope this helps :)


Terminal Dogma: "the whole crackme is ANTI trace!"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Terminal Dogma: "the whole crackme is ANTI trace!"
PDA

View Full Version : Terminal Dogma: "the whole crackme is ANTI trace!"

ZaiRoN
05-08-2003, 01:38 PM
Hi ALL!
For those who they are not interested in the sentinel's project I would like to suggest this interesting crackme. Here is the readme file:

--------- Terminal Dogma -----------

Brought to you by AndreaGeddon
www.andreageddon.8m.com
andreageddon@hotmail.com

BEFORE YOU RUN IT: THIS CRACKME IS XP ONLY (AND A BIT 2K)!
I coded this crackme aiming to all-win-compatibility, that is, i wanted it
to run on every win (9x-me-nt-2k-xp). Due to several bugs in the interface
i use (three bugs among all os versions) this crackme runs ONLY ON XP!
Writing and testing this crackme was really hard, so i didnt try to fix it
(elicz words: "hey, you know whom to bug" :) )
However, you can try to run it on 2K (some versions are compatible), it
could have some little problem, but at least you can trace it (and that is
just what i want!). I advise NOT to run it on 9x/me, it may crash the
system :(.

Dont worry, i didnt put in the crackme ring0 stuff or other dangerous code
to intentionally crash the system, on nt/2k/xp there are not system problems,
only crackme problems! However if you experience undesired crash i'm sorry,
it's not intentional

HOW IT WORKS: AIM OF THE CRACKME
When you launch the crackme you should see three textboxes with text inside
and a button, pressing the button you should see a messagebox telling "not
registered". The aim of the crackme is to patch it so it will appear the
messagebox telling "you are registered". Simple!
Note: YOU ARE ALLOWED TO PATCH ONLY ONE BYTE
Its really easy, there is only a jump to patch. Its in a crypted section, but
the crypting function is only a xor, so you dont have to face layers on layers
of decription!
Why am i telling you all this? Because you just have to figure out how the
crackme works! Once you understand it, patching requires only one minute!
However, i think that you will have to think a while before understanding the
engine of this crackme, i hope you'll find it interesting!
Note: if you run on 2k it will not display the messagebox, also if you can hear
the relative "ding". Thats a problem of winsta, when you understand the crackme
you also should understand the problem :) However you can still try to trace
the crackme!

FEATURES
-What you can use:
All the tools of the world!
-What tools are useful:
Only softice (and ida)

The crackme has:
- Anti debug/anti trace (not tricks, the whole crackme is ANTI trace!)
- A cripted section (the decript function is only a xor
and the xorkey is given, however decrypting the whole
block is NOT simple as you could think!) I called the encryption
system "selective crypting" :)
uhm thats all! As i told you, use just softice and ida, other tools
arent useful

ps. normally after 3 seconds of inactivity the crackme closes, its normal!

Enjoy it!
AndreaGeddon

--------- Terminal Dogma -----------

Good luck :D
ZaiRoN

ps. The crackme is solvable even if you have win9x (only using ida), trust me ;)
sv
05-09-2003, 06:54 AM
Hi zairon

Thanks, it was a very interesting one!
Good work AndreaGeddon

regards
ZaiRoN
05-09-2003, 03:44 PM
Hi sv,
it was a very interesting one!Nice to see your words. Yes, the idea is VERY interesting!

How have you solved the crackme? I wrote a little idc script. Have you stepped all the code (instruction by instruction ;)) ? Have you used a strange and original way? :D

ZaiRoN
sv
05-10-2003, 02:53 AM
Hi ZaiRoN

I have coded a little asm proggy to decrypt code section and i have used OllyDbg to found 'the byte' ;)

idc script is a nice way !

sv
evaluator
05-15-2003, 04:11 PM
i like unpacking..don't know ida..
ZaiRoN
05-16-2003, 11:22 AM
Hi ALL!

Ok, maybe it's time to start with some explanation of what the crackme does.

The file is not packed and/or encrypted but the first part of the crackme seems to be a loader, that's strange :-)
004010B9 mov esi, ds:LoadLibraryA
004010BF push edi
004010C0 push offset aUser32_dll ; lpLibFileName = user32.dll
004010C5 mov [esp+39Ch+var_381], 0
004010CA xor ebp, ebp
004010CC call esi ; call LoadLibraryA
004010CE push offset aKernel32_dll ; lpLibFileName = kernel32.dll
004010D3 mov dword_4086B0, eax
004010D8 call esi ; call LoadLibraryA
004010DA mov edi, ds:GetProcAddress
004010E0 mov dword_4086B4, eax
004010E5 xor esi, esi

004010E7 mov ecx, dword_406108[esi] ; select the handle to DLL module: user32 or kernel32
004010ED mov eax, dword_408720[esi] ; eax points to the name of the current function
004010F3 push eax ; lpProcName
004010F4 mov edx, [ecx]
004010F6 push edx ; hModule
004010F7 call edi ; GetProcAddress
004010F9 mov dword_4086B8[esi], eax ; it saves the addresses starting from 4086B8
004010FF add esi, 4
00401102 cmp esi, 38h
00401105 jl short loc_4010E7 ; this cycle is executed 14 timesThis snippet is used to retrieve 10 functions's address. These functions are:

GetModuleHandleA
LoadCursorA
RegisterClassA
CreateWindowExA (5 times)
DefWindowProcA
GetMessageA
TranslateMessage
DispatchMessageA
ExitProcess
MessageBoxA

Some of these functions are already imported by the crackme and we really don't know the reason for which the crackme has gone to the search of these functions.

After that, the crackme creates a new file named akira.exe and fills it with 3072 bytes; these bytes are taken from the crackme itself, starting from 405278. The new file (an executable) has 3 sections: "code", "data" and ".idata"; no resource section. The only instructions in the file are:
CODE:00401000 push 0
CODE:00401002 call $+5
CODE:00401007 jmp ds:ExitProcessNothing interesting for the moment.
When the file is fully created we found the first interesting function, CreateProcess:
004011A2 lea eax, [esp+398h+hProcess]
004011A6 lea ecx, [esp+154h]
004011AD push eax ; lpProcessInformation
004011AE push ecx ; lpStartupInfo
004011AF push 0 ; lpCurrentDirectory
004011B1 push 0 ; lpEnvironment
004011B3 push 5 ; dwCreationFlags: DEBUG_PROCESS & CREATE_SUSPENDED
004011B5 push 1 ; bInheritHandles
004011B7 push 0 ; lpThreadAttributes
004011B9 push 0 ; lpProcessAttributes
004011BB lea edx, [esp+1B8h]
004011C2 push 0 ; lpCommandLine
004011C4 push edx ; lpApplicationName: "...\Akira.exe"
004011C5 call ds:CreateProcessAThis function creates a new process and the new process is the file Akira.exe. The interesting things is represented by the two creation flags:
- DEBUG_PROCESS: the calling process is treated as a debugger and the new process is a process being debugged
- CREATE_SUSPENDED: the primary thread of the new process is created in a suspended state, and does not run until the ResumeThread function is called.

Well, TerminalDogma is the debugger and Akira is the launched process!

The first part of the crackme is ended. It's also ended my little initial explanation, I hope to see someone else interested to discover how the debugger will work and how akira.exe will be changed...

best regards,
ZaiRoN
evaluator
05-16-2003, 01:18 PM
If you need help, ask questions..
ZaiRoN
05-16-2003, 03:43 PM
Hi evaluator,

are you talking to me? No thanks :D
I have written the message to try to animate the conversation; I did not want to attach my idc script without giving explanations because this area is been created to learn something new and I am sure it might help someone out there. I know that many people does not post messages for *fear*, I only took the initiative :)
Everything here...

ciao,
ZaiRoN
evaluator
05-17-2003, 12:12 PM
that was joke..
I forgot smile:)
ZaiRoN
05-30-2003, 12:53 PM
It's time to go on!
As I said before, "TerminalDogma is the debugger and Akira is the launched process!", ok.

Akira is resumed using ResumeThread and, after that, the *infinite* loop used by TerminalDogma to debug Akira will start:
.text:00401223 push 0BB8h ; dwMilliseconds: 3 seconds
.text:00401228 push edx ; lpDebugEvent
.text:00401229 call ds:WaitForDebugEvent ; WaitForDebugEvent
.text:0040122F test eax, eax
.text:00401231 jz loc_401680
.text:00401237 mov eax, [esp+0F4h] ; eax = dwDebugEventCode
.text:0040123E dec eax
.text:0040123F jz short loc_401254
.text:00401241 sub eax, 4
...This is the initial part of the debug loop. The function WaitForDebugEvent waits for debug events; the crackme will close itself whether nothing will happen in the next 3 seconds.
BOOL WaitForDebugEvent(
LPDEBUG_EVENT lpDebugEvent, // address structure DEBUG_EVENT for event information
DWORD dwMilliseconds // number of milliseconds to wait for event
);

typedef struct _DEBUG_EVENT {
DWORD dwDebugEventCode; // Specifies a debugging event code that identifies the type
of debugging event
DWORD dwProcessId; // Specifies the identifier of the process in which the
debugging event occurred
DWORD dwThreadId; // Specifies the identifier of the thread in which the
debugging event occurred
union {
; additional information relating to the debugging event
} u;
} DEBUG_EVENT;At 401237, TerminalDogma retrieves the debugging event code received. The programs is only interested in two types of event:
- EXCEPTION_DEBUG_EVENT (= 1): this is received when an exception occurs in the debuggee process (Akira). If this event is received we will jump at 401254
- EXIT_PROCESS_DEBUG_EVENT (=5): a thread in the debugee process exits...

The interesting exception is the first one: EXCEPTION_DEBUG_EVENT. When this type of exception is received, the crackme checks the exact type of the exception:
.text:00401254 mov eax, [esp+100h]
.text:0040125B cmp eax, 80000003h ; 80000003=STATUS_BREAKPOINT=EXCEPTION_BREAKPOINT
.text:00401260 jz loc_401580
.text:00401266 mov ecx, [esp+1Ch]
.text:0040126A cmp eax, 80000004h ;80000004=STATUS_SINGLE_STEP=EXCEPTION_SINGLE_STEP
.text:0040126F lea eax, [esp+398h+lpBaseAddress]
.text:00401273 mov [esp+398h+lpBaseAddress], 10007h
.text:0040127B push eax
.text:0040127C push ecx
.text:0040127D jz loc_4013B5The crackme checks for these types:
EXCEPTION_BREAKPOINT: a breakpoint was encountered (int3...)
EXCEPTION_SINGLE_STEP: we will have this exception after the execution of each instruction.

I won't put all the crackme's instructions but, I will only tell you what will happen whether EXCEPTION_BREAKPOINT or EXCEPTION_SINGLE_STEP has been received.

The first exception received by TerminalDogma is EXCEPTION_BREAKPOINT; it's only a debug break (int 3), it occurs before Akira executes its first instruction. In this case, TerminalDogma will perform a ContinueDebugEvent and the "core of the crackme" begins.
From now to the end of the program, TerminalDogma receives this sequence of exceptions: singlestep, breakpoint, singlestep, breakpoint, singlestep...and so on.
- As I said before, single step exception is received after the execution of a single Akira's instruction. SingleStep handler, using WriteProcessMemory, writes an CCCCCCCCh dword inside Akira at address 401000h (the address of the next instruction that Akira will execute); as you can understand, TerminalDogma places an int3! After that, TerminalDogma calls ContinueDebugEvent and another instruction from Akira will be executed.
- This will raise an exception_breakpoint caught by the other handler that starts at 401580. This handler decrypts a single instruction, using the simple xor-decryption scheme mentioned by AndreaGeddon, and writes (using WriteProcessMemory) the new instruction inside Akira at address 401000h (the address of the next instruction that Akira will execute). After that, ContinueDebugEvent is called.

Every instruction is decrypted at runtime and executed at the same address: 401000h. The crackme is all here, I think it's interesting, don't you think?
Now that you know, how is it possible to solve the crackme? :-)

Ciao,
ZaiRoN


Some IDA Sdk help...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Some IDA Sdk help...
PDA

View Full Version : Some IDA Sdk help...

Polaris
05-09-2003, 06:40 AM
Hi there...

I am just making my first steps into IDA Plugin development, and I am already stuck :(
I am just trying to do the following: given a line of disasm like

...
loc_401235:
mov eax, ebx
...
I would like to have access to the string representation of all the line components (label, instruction, op1,op2).
While for retrieving names there's no problem (by using the GetName function) for retrieving ins and operands I am having no luck. I tried to use the fields of the insn_t built-in IDA type like
msg("Instruction code is %i",current.itype);
but the results are not correct. For 2 pushes I get 2 different values!
The same applies with the op_t field type.

Any help?
Mostek
05-09-2003, 06:43 PM
Can you please explain a little better what exactly you want to do?

A test for you to do:
Make simple assembly program:

push eax
push ebx
call RetRightAway
exitProcess

And check it's binary values in Hiew.
Now check what you get in return to cmd->itype,cmd->size, cmd->ea,...

Check the info you get against the binary values in Hiew.
Just for a notice:
Be carefull as cmd->itype is instruction code of IDA representatives (ins.hpp ->if I understood corectly) and not the right binary code.

2nd:
For op_t check if offb and offo values have the right offset to command start->it could happen that you are not at the right address or some register in IDA is not at the right address??? You never know.

Check also op_t->type if you got the right type,....

Report what you'll find.

Just a small idea(it helped me many times)->if you can't get the reason why the things aren't right reverse
IDA.wll check in sice what values does idaImport procedure get ->...F8s...->you'll soon discover what is wrong.

Peace
Mostek
Polaris
05-10-2003, 11:58 AM
Hi there Mostek!

thanks for your help! I resolved my problem by using the two functions:

idaman int ida_export ua_outop(ulong ea,char *buf,int n);
idaman const char *ida_export ua_mnem(ea_t ea, char *buf, size_t bufsize);

that return the string representation of instruction & operands.
It took only some "careful" reading of hpp files :rolleyes:
Polaris
05-16-2003, 01:00 PM
Does anybody know how to debug IDA Pro plugins? I am using VC6.0 sample skeleton.

I tried the classical way:
Shift-F5 in VC++ (Start Debug)
Locate IDA main executable (idag.exe)
Load an old database
Execute Plugin
The Plugin runs, causes an error and the VC debugger don't even break!!!

Any help? Mostek?
Mostek
05-16-2003, 04:14 PM
I use over lovely SoftIce. :)

Build a bat file that converts and loads the nms file to Sice after successful build (check post linking commands).
(Well it copies the file to IDA plugIn dir also.)

That is it.
bpx and here you go.

Peace
Mostek
Polaris
05-18-2003, 08:10 AM
Again ... Thanks! ;)

I really don't know why I wanted to use the VC debugger even if I had SoftICE... Maybe Microsoft is injecting into my little brain ! :D :eek:


New Mutant is OUT !!!!!!!!!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New Mutant is OUT !!!!!!!!!!!!
PDA

View Full Version : New Mutant is OUT !!!!!!!!!!!!

Zilot
05-09-2003, 10:47 AM
Hi !!

This one seems to be for optimists, dont know how protected files look, but demo version of this protector seems very atractive for those who hasn't what to do everal days

hxxp://www.anticracking.szm.sk/svkp_setup.exe

Just one example how he executes APIS

call [xxxxxxxx] ; xxxxxxxx=004xxxxx

then goes in high memory, there he emulates everal first instructions of almost each API, and after that continues in real API there where he stops in emulating (this do with jmp 7xxxxxxx)

wish you luck :D
nikolatesla20
05-09-2003, 01:22 PM
*yawn*

NO more new ideas on protectors any more....

Latest Arma uses boring Fusion trick: they decrypt code in security DLL in certain places just before it executes, then run it, then re-encrypt it. Easy to fix...

*yawn*

-nt20
Shoob
05-09-2003, 04:09 PM
I think not the unpacking is the hard thing, the catching of the imports seems hard. But at all the protection is easy to defeat.
squidge
05-09-2003, 04:59 PM
I'm not so sure it would be. Sure, emulating the first few bytes of most API's will cause current import recovery utilities to stop working, but if every import still calls the original code via a JMP, then it will not be that difficult to write a plugin to resolve the table as the addresses will still be quite unique. What protectors should be doing now is copying entire functions from the system into some of there own memory and running it entirely from there. This will then mean we'll have to use IDA-style signatures to start recognising the imports and will be much more fun to decode.
eSn-mIn
05-09-2003, 05:17 PM
I wrote this with a very old version of svkp.. (packed sepp)
It uses this routine to get VirtualAlloc's address and then it allocates some memory in order to paste this routine there, if I remember well..

Hope it helps.

Api emulation:
--------------

This "disassembles" some part of executed api, it emulates it until
it finds an opcode not-identifyed, then it lanunches the api normally.
To launch it, writes api's destiny address at the code (next to a byte 0xE9 that
is a far jump), then restores registers that are in a table and executes the jump.

First it checks for an "int 3" (0xCC breakpoint)

Checks structure is like this:

; Being ESI a pointer to the api..

; SEH

inicio+6759 CMP AL,64 ;opcode uses fs: ?
JNZ sigue
MOV AX,[ESI] ;esi points to next byte of the api
cmp1: CMP AL,FF ;there is a push dword fs:[reg] (FF indicates that
is a dword)
JZ op1
cmp2: CMP AX,2289 ;648922 mov fs:[edx],esp
JZ op2
cmp3: CMP AL,A1 ;there is mov eax, fs:[address]
JZ op3
cmp4: CMP AX,2589 ;there is mov fs:[address], esp
JZ op4

jmp next

op1: jmp cmp3 ;- not implemented -
op2: MOV FS:[00000000],ESP and emulates next instruction
op3: if address == 0 -> MOV EAX, FS:[0] stores eax and jumps
to next emulation
op4: MOV FS:[00000000],ESP and next emulation..
next:

; NOP

inicio+6773 CMP AL,90 ;there is a nop?
JZ begin

; PUSH REG

inicio+6794 CMP AL,50 ;from 50 to 57 are pushed regs
JB sigue ;look if the byte is inside the range
inicio+67A5 CMP AL,57
JA sigue

inicio+67B9 SUB AL,50
PUSH DWORD PTR [EAX*4+EBX+00000A1C] ;here are the registers
;stored by a pushad
JMP begin
sigue:

; PUSH DWORD

inicio+6947 CMP AL,68 ;there is a push dword?
;if there is: PUSH [ESI] add 4 to esi and begin
;another time

; CALL

inicio+6976 CMP AL,E8 ;- not implemented -

; MOV EBP, ESP

inicio+698D CMP WORD PTR [ESI-01],EC8B

; SUB EDX, EDX

inicio+69C4 CMP WORD PTR [ESI-01],D22B

; PUSH BYTE

inicio+69FE CMP AL,6A ;pushes the byte and follows..
Snatch
05-09-2003, 10:54 PM
What bad protectors will start doing rather is emulating entire API calls. The point of having DLLs is so each version of Windows can have independent libraries with calls that do the same thing with different code. The protectionists would have to have every single version of that API call Microsoft ever wrote and compiled and distributed and have a way of identifing which one to use. This API emulation makes too many assumptions and is dangerous and will start causing more problems not to mention with signatures its still defeatable!

Snatch
nikolatesla20
05-10-2003, 01:54 AM
I think we can say that import redirection is does nothing to really hinder an experienced cracker.

-nt20
evaluator
05-10-2003, 03:46 AM
Hey!

I downloded that file, & it says SVKPv1.11

Am wrong??

this version we know since published, Soldat seems not knows about svkp??
squidge
05-10-2003, 05:01 AM
I was thinking more along the lines of loading the system dll in the unpacking phase and grabbing some of the routines that way - so you don't need to even store one version of the dll as you'll be pulling it all from the system. This is not perfect, as experienced crackers can see what is being copied where, but it's certainly stops Mr Average with his copy of ImpRec and LordPE.

Originally posted by Snatch
What bad protectors will start doing rather is emulating entire API calls. The point of having DLLs is so each version of Windows can have independent libraries with calls that do the same thing with different code. The protectionists would have to have every single version of that API call Microsoft ever wrote and compiled and distributed and have a way of identifing which one to use. This API emulation makes too many assumptions and is dangerous and will start causing more problems not to mention with signatures its still defeatable!

Snatch
Zilot
05-10-2003, 05:26 AM
I'm here for a year, and since then I haven't seen it was discussed about svkt (I didn't search) , this one was newsis on anticrack. Maybe is improved, I don't think is older than one year.

Have any one realized that ImpRec can't recognize svkp process?? or that's only with me.
bart
05-10-2003, 07:43 AM
well they finally added api redirecting :), oh boy, i must buy it ;)

PS. Do you know any application protected with svkp (except svkp :)
Zilot
05-10-2003, 07:56 AM
As far I did with protected demo is to make this dump. But this is just for nag screen appearing, maybe funny, but gave to me some conclusions about working (will crach after that).
He has one routine that reaches E8 (call) and after that erases previous executed part. But set further.

Here it is, if one find interesting to try. Any one has something another ??????
Gaia
05-10-2003, 09:29 AM
Have any one realized that ImpRec can't recognize svkp process?? or that's only with me.

Select "Enable Debug Privilege" in Imprec options and restart Imprec

Apiwrapper is poor. Only inserts garbage jumps into know opcodes of api code. With "Trace Level1" and my plugin all api calls are resolved except GetModuleHandleA, GetCommandLineA and Exitprocess that are intercepted by Svkp

Gaia
Zilot
05-10-2003, 12:56 PM
Yes you are right about redirecting, ASPr has better redirection

Thanks for Plug-In
Shoob
05-10-2003, 07:21 PM
interest is maybe that after msg box the code is not unpacked and the unpacking process (or jmping to apis?) continues looking at attached..

http://www.geocities.com/attached_pic/
evaluator
05-11-2003, 03:16 AM
Soldat, SVKP.EXE's date stamp & you will know, when it released.
So then you can agree, "NEW" is incorrect to word for ws_printf..

Now some my findings about SVKP.
The Hardest version of SVKP is(was) V1.051.
It conteins quite interesting drivers(VXD & SYS),
which also must be reversed, so very interesting game is..

But soon after V1.051 came V1.11,
which conteins same fake drivers, as SEPP!

I THINK, author sad to himself:
"shit, why I published my hardest work in demo, which can used for protect??"
..& he removed V1.051.
***

By the way, that hard version of SVKP.VXD did crash W98se.
(so firstly I unpacked on XP)
I notified about crash also from one other guy.

After I also recovered crash-place on W98se & corrected VXD!
(so unpacker also can correct protector & force it to work:)
But(2) after some time I reinstalled W98se & this crash now NOT happens!
Very interesting fact! Someone also had such problem?
Zilot
05-11-2003, 06:30 AM
Hi Evaluator

Can you give some explanations. I'm not armadillo man, but realized that this one works in armadillo spirit. He has one encrypt/decrypt procedure, and each time when he wants to execute some part of the code he asks for its service, but before he decrypts he checks for its encryption. After decryption he encrypts it again

I tried to play little, to prevent again encryption but was caught with encryption checking. Was difficult to manage for short time. Did you know something about this or you managed for this time everything with dll

Is dll really necessary ?

Thanks for replay
Shoob
05-11-2003, 09:26 AM
I think the dll is not needed cause i packed my notepad with the encrypter and successfully unpacking it - runs without any dll. Im stucking with the way finding the OEP.
Zilot
05-11-2003, 10:43 AM
I didn't think it was needed for every file proteceted with this packer.

Just for svkpdumped.exe. For its functioning. Of course is not needed for files produced by packer.
evaluator
05-11-2003, 03:43 PM
As I can remember, I did following:

1.Go to encrypted-section start;
2.decript it & when execution returns to code,
3.Go to next encrypted-section. etc,etc..

yah, maybe I remember wrong..

DLL i done just for be clear.
This function in original SVKP copies from higher memory
registration string in data section:"Unregistered Demo Version!"
and sets eax to 1.
However, dump already conteins that string, i done only
mov eax,1

of course, you can do anything you want(patch..)
sope
05-12-2003, 07:11 AM
Hello Everyone,

First i need to thank Gaia for shareing the dll plugin with all of us.

How i find oep for svkp v.1.11 packed apps. Open winhex & select the target. Search for below bytes.

EB 0A 58 EB 01 48 40 EB 01 35 FF E0 61 EB 7C EB 02

On FIRST occurance notedown the offset, for my protected "notepad.exe" it was 0x10720378 we add 0x1AFA (0x10720378 + 0x1AFA) = 0x10721E72. Close all things.

Load the traget back set a bpm 10721E72 x let it run. On the break F8, F8, F8 [3 times] now check EAX = OEP :)

Now, in case of "svkp.exe" the protector itself we take the FIRST occurance of the above pattern outside the code section range. i.e. map32 svkp we know it starts 0x401000 + 0x389F0 size = 0x4399F0 take first occurance after 4399F0. On my machine it was 0xD7C03B0. So i added 0xD7C03B0 + 1AFA = 0xD7C1EAA. After bpm on it we reach & then F8, F8, F8 we get oep = 0x401000 which can be confirmed from evaluators excellent work. Thanks evaluator for shareing the file :)

There can be different ways of finding it. If u have better method of finding it please share it with all of us.

Regards
Sope!
Zilot
05-12-2003, 09:48 AM
There can be different ways of finding it. If u have better method of finding it please share it with all of us

1. i3here on
2. In Syd's loader Open, then Execute
3. Bpmb esp-4 w (esp was 12ffc4)
4. Breaks until reach 401000

This was discussed by Crusader, and was his trick
Shoob
05-12-2003, 04:27 PM
nice thx for sharing your knowledge

in olly use mw 401000,401004 for example works perfect with gaias great plugin. Break at the second access on REP. and go further with F7 until u reach 401030

of course :D when you break at mw 4011AB,4011AC you will sooner find the oep at 401192 after the nasty nag :D finally i need some unresolved Api entrys.. :(
cRk
05-13-2003, 01:11 AM
targets with this baby injected...

Newsbin Pro & TweakXp Pro both latest version

if i'll find more i'll tell you :D
Gaia
05-13-2003, 02:49 PM
NewsBin 4.1, 99% rebuilded

nbpro.exe - 1.187.840 bytes

OEP - 46A907h

All thunks resolved except:

4A41B8h, 4A41BCh, 4A427Ch, 4A42E4h, 4A43C0h, 4A43D4h

With Sice and Zen:

4A41B8h - GetCommandLineA
4A41BCh - ExitProcess
4A427Ch - GetModuleHandleA
4A42E4h - unknow (is an api related with TerminateProcess)
4A43C0h - GetVersionExA
4A43D4h - GetVersion

I need more study to get true api of 4A42E4h....

Gaia
evaluator
05-13-2003, 03:11 PM
ok, today i DLD that NewsBin4.1.
So again I see strange useless VXD & SYS.
??

If hard-type drivers discarded(probably for incomatibility),
why is need to keep this fake drivers?

Oke, whats new here:
1. program's CODE is compressed (JC).
2. from OEP (lets be 46AA28) ripped 58h length CODE & converted to PSEUDO_CODE!
heh! big workz done, my congatululus to SVKP Author:)
i repaired 57h.. (eh, one NOP..), but prog workz anyway.
Also this PSEUDO_CODE can be attached at free space and repair not need.
(but i'm crazy PPG).
3. SVKP api not used
4. there are 7 crypted sections, which u can decrypt as i suggested.
5. 6 Kernel's api are quite emulated:

107 000A41B8 03502A04 0000 KERNEL32.dll GetCommandLineA
108 000A41BC 03502070 0000 KERNEL32.dll ExitProcess
156 000A427C 035033DD 0000 KERNEL32.dll GetModuleHandleA
182 000A42E4 03503058 0000 KERNEL32.dll GetCurrentProcess
237 000A43C0 0350B832 0000 KERNEL32.dll GetVersionExA
242 000A43D4 0350B4AD 0000 KERNEL32.dll GetVersion
evaluator
05-13-2003, 03:28 PM
hey, GAIA!

what file you have??
I DLD today, nbpro.exe is 861184 byte.
installer nb410.exe is 944321 byte.
Gaia
05-13-2003, 03:46 PM
Hi Evaluator

nb410S.exe (setup) - 1.253.431 bytes
nbpro.exe (main exe) - 1.187.840 bytes - File version: 4.0.0.4

Different sizes that your files, but emulated apis are at the same address....my OEP (46A907h) are 100% OK, no ripped code in my version...STRANGE! :mad: I download the file today but I will do again now

Gaia
Gaia
05-13-2003, 05:55 PM
I redownloaded NewsBin......now file have lastest SVKP ;) (same sizes as evaluator)

"bpm esp-4 w" trick to find OEP is not valid in this version

Ripped instructions at OEP are junked and muted (xor edx, edx to sub edx, edx for example). Good work in this aspect Pavol

Gaia
sope
05-14-2003, 06:13 AM
Hello evaluator

Can you please clarify my small doubts. Target nbpro.exe 861184 bytes.

1. Go to encrypted-section start;
2. decript it & when execution returns to code,
3. Go to next encrypted-section. etc,etc.Is the below decryption routine you mentioned as decript ?
:0320BEEE PUSH EBP
:0320BEEF CALL 0320BEF4
:0320BEF4 POP EBP
:0320BEF5 SUB EBP,0000470D
:0320BEFB MOV CL,[EBP+00000350] ; get byte in cl after some maths
:0320BF01 POP EBP
:0320BF02 XOR AL,CL ; decrypted bytes
:0320BF04 MOV [EDI-01],AL ; store it back
:0320BF07 MOV EAX,EBP
:0320BF09 DEC EBP ; ebp=counter
:0320BF0A TEST EAX,EAX
:0320BF0C JNZ 0320BEB2
:0320BF0E XOR EAX,EAX
:0320BF10 POP EBP ; i guess we can dump here
:0320BF11 POP EDI
:0320BF12 POP ESI
:0320BF13 POP EBX
:0320BF14 RET 00142. from OEP (lets be 46AA28) ripped 58h length CODE & converted to PSEUDO_CODE!
heh! big workz done, my congatululus to SVKP Author:)
i repaired 57h.. (eh, one NOP..), but prog workz anyway.In my case from 0x46AA28 to 0x46AA80 i have 0x90. You hinted for repaire it i just want to clarify is the bytes missing or stored somewhere or we have to understand something. I set different types of brk pt but it does not seems to get read even after the program executes.

Regards
Sope!
nikolatesla20
05-14-2003, 09:45 AM
More OEP code ripping?

Do all protector authors just copy each other now?

-nt20
Zilot
05-14-2003, 11:04 AM
Hi Evaluator, Gaia and others

I found the same as you about IAT, and unresolved 6 APIs, but couldnt find them.

Can you explain the method you did that. My method to find other APIs was to patch API redirection procedure

I did the next

3332F3E JMP 46AA27 (FIRST NOP)

46AA27 MOVE DWORD PTR [EDI], EAX
46AA29 JMP 3330ECD (THIS IS WHERE JMP 3332F3E) Should be.

After this IAT was clean except six mentioned APIs. But with tracing them I was seems caught though exceptions.

Last API was 000A47C8 oledlg.dll 0008 OleUIBusyA

So I'm asking for 6 unresolved APIs
Zilot
05-14-2003, 11:13 AM
In my case from 0x46AA28 to 0x46AA80 i have 0x90. You hinted for repaire it i just want to clarify is the bytes missing or stored somewhere or we have to understand something. I set different types of brk pt but it does not seems to get read even after the program executes

They are ripped, there is some stack acrobation before reaching 46AA80, but I don't see too what's going on before

So appeal for clarifying
squidge
05-14-2003, 06:07 PM
Originally posted by nikolatesla20
More OEP code ripping?

Do all protector authors just copy each other now?

-nt20

It certainly seems that way. One author comes up with a new and interesting way of protection, and as soon as other people (eg. us) find out how it works, the other authors lurking in these forums quickly add it to there own protection software and release an update, rename the feature, call it "unique" and then offer a discount "for a limited period only" in an attempt to bag a few more sales.
evaluator
05-15-2003, 05:12 AM
yah, guys, seems you want force me for force explanation..
OKee.

1. you can find info
about SVKP's encryption block Start&End in SVKP's pacage!
(or use your eyes).

BLOCK start is 21 bytes long:

near call E800000000;
far jump FF25[address of decryptor];
blockID-byte + empty bytes: 10 byte long;

then is block himself;

BLOCK end is 16 bytes long:

near call E800000000;
far jump FF25[address of cryptor];
blockID-byte + empty bytes: 5 byte long;
***

So you will first analyse dump & determine all crypted sections & their start address;
[Very helps you, if you make first dump directly after SVKP decrypts exe,
[& second dump on OEP, so using some comparision tool, You easy find start addresses]

Now we again go in debugger, stoped at OEp, & change EIP to 1st start address;
Then you can:
A. trace into code, while it decrypts & then returns execution to decrypted code;
B. or for lasy guys: BPM EIP+15 X, so debugger breaks on decrypted code.
C. dont go into decrypted code, but now change EIP ti NEXT crypted-block's start address;
so do until you decrypt all sections & then dump happy proggie:)

END of 1.

2. seems SOLDAT has problem with SVKP's RDTSC future;
Here is descryption of it:

1st RDTSC;
save EDX in EBX(or ECX);
junk code;
2nd RDTSC;
SUB EDX, oldEDX;
SUB EDX, 2;
now if EDX > 0, you are catched;

e.g. IF after executing two nearest RDTSC(Read processor's TimeStampCounter),
newest RDTSC's EDX will +2 greater then old EDX, SVKP catches you.

So you need correct 2nd RDTSC's EDX to match with old EDX. OK?
(or use predefined EDX each time after RDTSC)(or do anything..);

END of 2.

3. PSEUDO_CODE

I had read about PSEUDO_CODE in STARFORCE-CDprotection, but not meet until now.

PSEUDO_CODE is method of doing same job as real code, but with other group of instuction.
Purpose: so you can't easy identify code.
(e.g.is ripped code of imported function as in STARFORCE, or is ripped OEP code).

But PSEUDO_CODE is normal working code, so if it is PSEUDO-OEP-code,
you can just attach it at free space & set EIP there.
Of course, you need some-how understand it's start.
For SVKP case, original ESP is restored & you can think, somewhere there is Start.

Better will for your skills, to understand & rebuild real code.
Also very helps us this: look at other EXE compiled with same compiler &....
I just looked at ________'s start code & recovered that last missed instruction!

So now I can say, OEIP is at 46AA27 & all ripped 59h byte code is
absolutely ________'s identical(except direct addresses)!!!

END of 3.
*********

EXERSIZE:
paste(replace) attachment in fixed dump of nbpro at .svkp section start(VA 00119000h)
& set EIP 0011B9F7.

Now rebuild true code> Length 59h

PS. maybe I will make PSEUDO_CODE crackme!?
Zilot
05-15-2003, 09:29 AM
yah, guys, seems you want force me for force explanation..

Thanks for your replay. I caught decryption routine and after that found routine that erases with nops previously decrypted part.

I don't know if you thought on this when said about encryption.? Its start was on 3456201

Never mind, if there is another one will find it.

But did you notice that packer doesn't work as should. Try to press Register nbpro ....or what is exactly. And then do it again, he will crash. It is because he erased some previously decrypted part, and after he backs on that.

seems SOLDAT has problem with SVKP's RDTSC future

Soldat has problem with many things.....

regards
evaluator
05-15-2003, 04:25 PM
don't care about erasing..
Zilot
05-16-2003, 08:05 AM
Hi

I found seven pairs of places where decrypt/encrypt procedures are being called.

Several first bytes have to be replaced with nops, in decryption case 16 of them and in encryption case 10 of them.

How do you explain that holes.

They must be marked during program compilation with some signs so after when Svkp did his job (when exe is made by copiler) he could erect the obstacles on that places.

I saw that in Ultra Protect. But dunno if here Svkp has option for their automatic setting or you have to do that manually.
nikola
05-14-2004, 10:10 AM
Hi,
i've been trying to unpack certain SVKP protected app for 2 days now but unsucessfully :/ Since i'm very much of a newbie in unpacking bussiness i think i done a good job so far but i need some help now :/ I searched high and low but didnt find answer to my question becouse all information i could find is outdated. Seems noone has messed with SVKP and wrote about it. So, here is test i posted on exetools board (but didnt get a reply)
---------------------------------------------------------
Hi,
I'm having trouble with imports too :/
I've been trying to unpack certain app for whole day now. I got dump, eop, i think stolen bytes are good but program crashes. Tracing through exe that crashes i noticed that i didnt resolve one (for now) import correctly. Now i attempt to resolve it correctly by debugging packed app. I run packed app, break on place where this function is called and trace into it. It was very weird. Seems that whole function is in packer code. It never jumps/calls real dll. Btw this is kernel32 function. When function is executed only eax changes and before function executes eax is address inside code section (something like 4xxxxx). BUT result doesnt seem to be parameter dependent. Here is some code (this is some really obfuscated shit):

00C69B75 9C PUSHFD
00C69B76 55 PUSH EBP
00C69B77 E8 00000000 CALL 00C69B7C
00C69B7C 5D POP EBP
00C69B7D 81ED 7C9B0100 SUB EBP,19B7C
00C69B83 50 PUSH EAX
00C69B84 60 PUSHAD
00C69B85 8BEC MOV EBP,ESP
00C69B87 55 PUSH EBP
00C69B88 29F6 SUB ESI,ESI
00C69B8A 0FBDF6 BSR ESI,ESI
00C69B8D B9 6E990020 MOV ECX,2000996E
00C69B92 31D2 XOR EDX,EDX
00C69B94 D1C1 ROL ECX,1
00C69B96 29DB SUB EBX,EBX
00C69B98 D1CE ROR ESI,1
00C69B9A 29C0 SUB EAX,EAX
00C69B9C 29C3 SUB EBX,EAX
00C69B9E 81EB 9942F43E SUB EBX,3EF44299
00C69BA4 C1C3 03 ROL EBX,3
.
.
.
and goes on like that.... and then:
00C69BF3 89E1 MOV ECX,ESP
00C69BF5 81F0 FFFFA262 XOR EAX,62A2FFFF
00C69BFB 01C8 ADD EAX,ECX
00C69BFD 39F3 CMP EBX,ESI
00C69BFF 7E 01 JLE SHORT 00C69C02
00C69C01 F7DB NEG EBX
00C69C03 FFD0 CALL EAX

where EAX is address in other part of packer code :/ This is all that happens there:
0012FEC4 8BE5 MOV ESP,EBP
0012FEC6 61 POPAD
0012FEC7 58 POP EAX
0012FEC8 8B85 87AB0100 MOV EAX,DWORD PTR SS:[EBP+1AB87]
0012FECE 5D POP EBP
0012FECF 9D POPFD
0012FED0 C3 RETN

So eax gets value of [EBP+1AB87]. What API could this be? It's really annoying :/
nikola
05-14-2004, 05:42 PM
I answered my own question today. I found a better place to hook to api table and resolved this one. Now i have another API entry problem :/ I'm gonna try to sove this on my own but if someone has a quick answer please post it here. This is user32 function. I tried resolving it in several ways and ended up with two possible (but in the end wrong) results: MessageBoxA and RegisterWindowMessageA :/
nikola
05-15-2004, 10:19 AM
Me again :/
Still struggling with same import problem :/ Here is how it looks:

When packer decrypts IAT i see MessageBoxA in place where correct import name is written for other imports but when i run it this import is called 2 times.
First time program runs this import it works like a charm but second time program crashes. So, what do I do? Well, i debug packed app and check this import out. Both times packed program calls this import and both times it works but here is a weird thing. I break on import, put breakpoint on User32 code section and i get in RegisterWindowMessageA. Second time program calls this import I do the same. Put bp on User32 code section and, see this, program DOESNT break ANYWHERE in User32? :confused: How is this possible?
Boards seems to be empty last days. Weird

btw. this is Borland C++ program. I'm also having trouble with one VB prog but i'm having a few more ideas i want to try with this
gook
05-21-2004, 12:45 PM
Hello Nikola and others,

You might find this program i wrote useful. Since i've only worked on 1 svk_p target, i'm not sure how well it works on others, but it should point you in the right direction.
Please pm me any svk_p targets you find!
I've also included a sample dumped, crippled iat.

Have fun!


crucnher v4.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > crucnher v4.0
PDA

View Full Version : crucnher v4.0

skyjacker
05-09-2003, 06:46 PM
I searching a solution to dump a dll packed with cruncher v4.0, this packer detects softice even frogice activation .... if someone have informations about it ... thanks
S3ri@l CoDe9x
05-09-2003, 07:04 PM
I know a tutorial for unpacking this version .. but it is in Spanish if it serves u say it to me :p

Best Regards! :rolleyes:
skyjacker
05-10-2003, 08:23 PM
yes i am interested , i will try to translate it by a friend ...
i lete you my e-mail : skyjacker_up7@hotmail.com
mega thanks
S3ri@l CoDe9x
05-10-2003, 08:51 PM
.. OK.. i attach in this post :p .. It's in OllyDbg & it's of my friend
Ricardo Narvaja .. he has a brilliant cracking course ..:p

Best Regards! :rolleyes:
skyjacker
05-11-2003, 09:55 AM
Thanks, its very great from you .....
dELTA
05-12-2003, 06:42 PM
What do you mean by "cracking course"?

dELTA
S3ri@l CoDe9x
05-13-2003, 12:20 AM
I not understand :confused: !

This tutorial is a part of a course of cracking that gives..:p

Best Regads! :rolleyes:
skyjacker
05-13-2003, 11:32 AM
well i read it but theres a little problem, i search how to decompress a dll not an exe, i know its exactly the same problem, but .... this dll is a 3dsmax plugin, and you know you cant open 3dsmax in olly cause ...... so ollydebugger is not really the most appropriate debugger .... but thanks even
dELTA
05-13-2003, 02:40 PM
You can make a simple skeleton program and attach to the DLL yourself. The unpacking will most likely occur directly on the attach, or otherwise most likely on the calls of each functions. Then you can easily trace it yourself, without any need to run 3DSMAX. :p

dELTA
squidge
05-13-2003, 05:40 PM
With most packers, just using LoadLibrary is enough as the unpacking is done from DLLEntryPoint.
S3ri@l CoDe9x
05-13-2003, 06:25 PM
Give me the program... and i send to my friend Ricardo Narvaja .. and post a tutorial about it... in english of course :p

Best Regards! :rolleyes:
hobferret
05-16-2003, 07:50 AM
Good Morning All

I am trying to post this tut in English, but come on everybody, there is a much easier way to do this. Just think about pe identifiers!!:)

/hobferret

Maybe it's too early in the morning but I can't seem to upload the file!!!!!!!!!!!!!
S3ri@l CoDe9x
05-17-2003, 04:15 AM
Stop speaking and put the tutorial in English :p

or only put the text in English and put the images in another file ;)

Best Regards! :rolleyes:
hobferret
05-17-2003, 12:32 PM
Bueno Dia Sr S3ri@l CoDe9x

Stop speaking and put the tutorial in English

OK I will try to upload it again!!:mad:
S3ri@l CoDe9x
05-17-2003, 06:10 PM
Thank u :p

Best Regards! :rolleyes:
sha_k
11-17-2003, 10:07 AM
well i read it but theres a little problem, i search how to decompress a dll not an exe, i know its exactly the same problem, but .... this dll is a 3dsmax plugin, and you know you cant open 3dsmax in olly cause ...... so ollydebugger is not really the most appropriate debugger .... but thanks even

What's that? Of course you can run 3DSMAX with OllyDbg, or in worst case you can always attach it after the program started... I debuged a few MAX plugins with version 5 and 6 without any major problems.


Problem with win32dasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Problem with win32dasm
PDA

View Full Version : Problem with win32dasm

itsme_tun
05-10-2003, 04:27 PM
HI all .....its the best site i ...I heard from all ..............i want to ask that whenever I use win32dasm on its debug section....there is a code window ...remember naa ...go0d.......on them when i press F8 for (step over it) when i on any call ..it disappeard.....win32dasm closed automatically....any kind of call it was ....when i come over it ....the win32dasm automatically close ...I want to ask that the problem with win32dasm ....or my setting the not correct ...plz reply me fast Im waiting .......or when i press F8 7 or 8 times ...then also the same problem happens ...it close ....whole the win32dasm closed ...not only the debugger of win32dasm ...all the win32dasm ....ok tell me ...ASAP....bye..TC....
JMI
05-10-2003, 04:34 PM
tun:

win32dasm hasn't been updated for a very long time and doesn't work very well as a debugger. You need to try Ollydbg and/or Softice. Don't ask here where to get them.

Regards.
Aquatic
05-11-2003, 02:52 AM
I recommend IDA Pro 4.5, it has an integrated debugger.
Paul333
05-12-2003, 08:50 AM
Hello itsme_tun

I dont think its your settings ..more likely its the application that your debugging..

Whenever i use F8 or F7 buttons it works perfectly

paul333
cRk
05-13-2003, 12:15 AM
i know about some program that close them automatically if detects any of them( regmonitor....W32dasm...) try hex editing the text caption where says W32dasm at the top of the program........ for something else ot just blank text.. then try it ;)
dELTA
05-13-2003, 01:37 PM
And patch the window class string too while you're at it, it's quite commonly used to detect other software like this.

dELTA


Would it be possible? (way to post/reply threads)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Would it be possible? (way to post/reply threads)
PDA

View Full Version : Would it be possible? (way to post/reply threads)

Dedec0
05-10-2003, 06:10 PM
Hi,

I go through a problem several times when I post/reply to a thread.

When we click the reply/post new thread we are given a login page if we are not logged, and then we go to the form page where we enter our text. BUT if you take to long to write it all, when you click on submit||preview, you will get an error like "no thread specified" or something, because you took too long and the server thought you wouldn't reply anymore.
This might happen because I use no cookies to be logged, but I think there can be a "cookie-free" way to it.
2 solutions I quickly thought were:
-show the form page even if the user isn't logged, and add the login and PW fields to that same page, so the user can take a day (or what) to elaborate its reply, without worring about that;
-just ask for the user's name/PW WITHOUT discarding what he just typed. I use Opera most of time, but sometimes IE's (when not at home, for example) "security" features blocks me from hitting "back" and I lose all text... :(

Could the admins make this change to the forum's scripts?
If anyone else would like that, please say too, so I won't be all alone... =D

Regards,
squidge
05-10-2003, 06:32 PM
I just allow cookies for this domain and so don't have the problems you are having. I can understand you not liking cookies, but why not use them on a "only when I say they are ok" type of basis ?
Woodmann
05-10-2003, 06:53 PM
Howdy,

I dont look at the cookie files :) I have too much
other stuff to do.

They are only enabled for all of the users so they
dont have to repeat stuff time after time.

Woodmann
Dedec0
05-10-2003, 07:09 PM
Hi, Woodmann,

It is ok (kinda). If it could be done it would be better, but its ok. This forum is a great place. :)
I thought it were open source, like the admins could fiddle with it - just found out that it is comercial.

squidge> I could do that, but I really have a "thing" with cookies. I am not happy either with the way the browsers work with them or the sites work with it (kinda hate PHP/ASP session cookies) - I try my best avoiding them. :-d

Regards,
Woodmann
05-10-2003, 09:50 PM
Howdy,

You can kill your cookies, you will just have to type faster :)

Woodmann
Dedec0
05-11-2003, 03:35 AM
You can kill your cookies,

I am a serial cookie killer! (obs: the COOKIE is serial ;-)
By the way, have you ever seen a webmail service that doesn't use cookies or javascript? :( Please tell me, because I don't.

you will just have to type faster

Nononononono.... I don't have to type faster, in fact I have good typeing skills.
I have to think faster! :p
JMI
05-11-2003, 04:11 AM
Or, you might try thinking before you begin to type. :D

Regards.
Dedec0
05-11-2003, 05:26 AM
Or, you might try thinking before you begin to type.

Yes, in fact I do - or at least I think I am doing it.

Tell me: what is your average time when writing a new thread? Plus the time to make necessary corrections? And what is the time the form page expires, when no unnecessary cookie is accepted?

:)
JMI
05-11-2003, 11:54 AM
Dedec0:

Here's a thought. :) Write your post in a text editor and edit it until it is exactly how you want it, then copy it (usually by using the "control" + "C" keys), then open your thread (or reply) and simply "paste" (usually the "control" key + "p") your message into the box and press the "submit" button. No time delay and no "timeout." Saves alot of problems, especially if your post is long. Give it a try. ;)

Regards.
squidge
05-11-2003, 01:37 PM
The way I normally do posts is to hit reply, write a load of complete rubbish, and then go back and edit the post multiple times until it resembles something comprehensible.

Unfortunately, this method does fail every so often though and just leaves a pile of complete crap in a post, but hey, no ones perfect ;)
Woodmann
05-11-2003, 08:01 PM
Howdy,

The time set to reply is 10 minutes.
Editing is a different story. I am not sure
of the time out with that function.

Woodmann
esther
05-11-2003, 08:07 PM
hey all ;)

find a stable anon proxy
Dedec0
05-13-2003, 03:59 AM
JMI> Hi, JMI, fun is that I always feel a little harshness in your replies... maybe just me, but that is not the way I posted this thread nor my replies to it.
If you think my suggestion isn't worth, ok, but you don't need to give me a reply that won't help much, neither add any knowledge to anyone who might read this thread.

squidge> :biggrin: I did that once too, in another forum: I got replies WHILE I was editing the thread (lol) making a lot of confusion... I had to find another trick. ;)

Woodmann> Howdy. :)
Do you have access to the vBulletin's PHP sources that make the board, or is it packaged as a executable program?
<offtopic>
I don't know about US-ian language local variations, but I used to watch a cartoon (sponge bob square pants) where a character (the squirrel, Sally, if I remember right) says "howdy" too, she were from Texas...
</offtopic>

esther> Hello, I really should... oh, lazy! But I don't get the connection of this with the discussion :redface: - is there one?
JMI
05-13-2003, 04:38 AM
Dedec0:

Humour is often measured by the listener, but listener's response does not determine the intent of the author. You made a joke of "thinking faster". I made one about "thinking first". That was the intent of the big grin.

squidge then made a comment, also I believe intended in humour, about his technique. I then posted about a technique I often use of composing a long reply in a text editor ahead of time. Those comments were intended as a possible solution for avoiding the problems both you and squidge described. If you found this too harsh, I can only suggest that you were reading with too much seriousness, and perhaps a little defensiveness. You were apparently attempting to avoid a timeout, or the demand of signing in again, if you weren't using cookies. The method I suggested was intended to, and would avoid that problem.

You have gone to so much personal trouble to aviod using cookies that you have suggested that someone re-write the code for the operation of the vBulletin program just so you won't have to be worried by something that doesn't trouble in the least the majority of those visiting here. To request that things be changed just to conform to your personal preference is, itself, not an entirely reasonable request. You were offered solutions which do not seem to meet your personal criterial.

Free advise is worth what you pay for it. You are, of course, free to do with it as you will. Choosing to live with the consequences of your personal preferences for no cookies, is simply part the the learning process called life. More often than not, the world will not choose to conform to ones own personal preference. How you deal with that simple fact is also your choice.

Regards.
Dedec0
05-13-2003, 04:56 AM
JMI,

...That was the intent of the big grin.

Sorry. I wouldn't have thought that if I saw the smiley. My fault - Opera doesn't give me any hint about existance of some images that don't have an ALT string set, when images are turned off. :( By your words I couldn't really decide if it was humor or not...

You have gone to so much personal trouble to aviod using cookies that you have suggested that someone re-write the code

I haven't gone through all this trouble. I just thought it is a thing that could be ammeliorated in the board, that's all. I suppose most of people just don't care about it.

To request that things be changed just to conform to your personal preference is, itself, not an entirely reasonable request.

Its ok, I wasn't very much expecting it to be the board developers' priority of the year... :p

---

And I use the text editor technique too... hehe...

Kind regards and my appologies,
esther
05-13-2003, 06:23 AM
Hi,
Dunno about Opera,in IE you have to put your proxy in the proxy server settings.

JMI:
Humour is often measured by the listener, but listener's response does not determine the intent of the author. You made a joke of "thinking faster". I made one about "thinking first". That was the intent of the big grin.

It always happens when you are serious :p

eg:Use your brain

:p :D


New Disassembler - Spasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New Disassembler - Spasm
PDA

View Full Version : New Disassembler - Spasm

Aquatic
05-11-2003, 03:04 AM
I found the info about it on the exetools forums: http://www.exetools.com/forum/showthread.php?s=&threadid=2150

Spasm homepage: http://betov.free.fr/SpAsm.html

It sounds ambitious to say the least.


hide softice on XP :( sorry
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > hide softice on XP :( sorry
PDA

View Full Version : hide softice on XP :( sorry

3axap
05-13-2003, 02:46 PM
hi,
firstly, i searched for this topic- there are some topics with the same prob. but no result.
i am new on XP :), i tried frogice but no luck,
what do you advice.

thanks.
JMI
05-13-2003, 03:01 PM
Where did you search? You could have used "softice + hiding" and come up with many entries from here. Give these a try.

http://www.woodmann.net/forum/show...p?threadid=4701

http://www.woodmann.net/forum/show...p?threadid=3982

http://www.woodmann.net/forum/show...p?threadid=4419

Regards.
squidge
05-13-2003, 05:42 PM
Wot, no sarcasm? ;) :D
JMI
05-13-2003, 06:52 PM
My pacemaker battery was low and in for recharging, so I lacked the strength necessary. :D :cool:

Regards,
3axap
05-14-2003, 01:28 AM
Thanks for the replias.
You are really very kind :(


wibu
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > wibu
PDA

View Full Version : wibu

kissg
05-14-2003, 02:52 AM
hi!

i have a wibu key 2.31 protected dos application
is it possible to get unprotected app without the original wibu box ?

regards

g
squidge
05-14-2003, 07:29 AM
depends how it's protected - read the faq, post your results and maybe someone will help.


recover RSA primes p and q if we have n,d,e
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > recover RSA primes p and q if we have n,d,e
PDA

View Full Version : recover RSA primes p and q if we have n,d,e

Solomon
05-14-2003, 03:20 AM
If we have n, d and e of RSA, we can encrypt/decrypt without any problems.

But just for curiousness, is it possible to recover p and q from n, d and e?

for RSA, we have the following 4 equations:
n = pq
f = (p-1)(q-1)
gcd(e, f) = 1
de = 1(mod f)

We can factorize (de - 1) to get f, then solve the following equations to get p and q:
pq = n
p+q = n+1- f

But to factorize (de-1) is quite difficult though it has some small factors. Any idea?
mike
05-14-2003, 05:55 PM
Yes, it's possible. Remeber that the usual way to factor n is to choose a kth order (k>1) polynomial g(x) and find x,y such that g(x) = g(y). Then gcd(x-y,n) has a high probability of being a factor. Usually they choose g(x) = x^2 mod n.

Consider n=35. If g(x) = x^2 mod n then g(1)=g(29), and 29-1 is a multiple of 7, a factor.

de-1 = phi(n) (f in your post), and *any number k but zero* gives k^phi(n) = 1 mod n. (de-1) = c*phi(n), so k^(de-1) = 1^c = 1 mod n as well.

Since phi(n) = (p-1)(q-1), and p and q are both odd, it's divisible by 4. Calculate m for a few different k:

m=k^((de-1)/4)

m will often be a number other than +/- 1. If you raise one of those m to the 4th power, you know you have to get 1. So in this case, g(x) is x^4 mod n and we have

m^4 = 1^4 mod n

and m-1 is a multiple of p or q. Use gcd(m-1,n) to find the factor.
Solomon
05-14-2003, 09:30 PM
Thx mike for your explanation.

I still have a few questions.

Where does the conclusion "k^phi(n) = 1 mod n" come from?
and why (m-1) is a multiple of p or q?

Thx:D
mike
05-15-2003, 06:21 PM
Where does the conclusion "k^phi(n) = 1 mod n" come from?That's how RSA works. Let f=phi(n).

ed=1 mod f, right? So choose a message k, and compute

c=k^e mod n.

c is the ciphertext. Then to decrypt, compute

c^d = k^ed = k^1 = k mod n

since

ed=1 mod f,
ed-1 = 0 mod f,

and

k^(ed-1) = k^0 = 1 mod n

I explained why m-1 is a multiple of a factor in the last post, but here's another try:

1 will have four quartic roots mod p, and four quartic roots mod q. A quartic root is a number r such that r^4 = 1. For example, 6 is a quartic root of 1 mod 35: 6^4 = 1 mod 35.

There will be exactly 4*4=16 different quartic roots of 1 mod n, four from p times four from q.

Since k^(ed-1) = 1, then m=k^((ed-1)/4) has to be one of those 16 numbers, because

m^4 = k^(((ed-1)/4)*4) = k^(ed-1) =1.

Then m^4-1 = (m-1)(m^3+m^2+m+1) = 0 mod n. So either (m-1) or (m^3+m^2+m+1) are multiples of n, and you gain no information about the factors, or one term is a multiple of p and the other is a multiple of q. Using gcd(m-1,n) will pick out the common factor.
Aquatic
09-18-2003, 02:57 AM
Wow, I never knew "phi" was involved in RSA. Very interesting.
mike
09-18-2003, 07:56 PM
"Phi" is a symbol used for different things in different places. Here it means Euler's totient function; one other place you may have seen the symbol is referring to the constant (1+sqrt(5))/2, the "golden ratio". When you have a rectangle L x W such that

(L + W) / L = L / W

then L / W = (1 + sqrt(5)) / 2 = phi.

Phi is also often used as a symbol for phase (3 guesses why :D)
Aquatic
09-18-2003, 07:58 PM
So "Euler's totient function" has nothing to do with 1.618 (The golden ratio)? Or is there some connection?
mike
09-19-2003, 12:24 AM
Euler's totient function has no direct relation to the golden ratio that I know of, although you can get totient-like behavior if you consider quadratic recurrence relations modulo composites.

The LUC cryptosystem calculates the nth term in a Lucas sequence (a sequence in which the ratio of consecutive terms approaches the golden ratio) rather than raising to the nth power. Since the sequence grows exponentially, it's essentially the same thing.

See
http://math.boisestate.edu/~marion/teaching/crypto2s03/luc_rsa.htm

or

http://www.funet.fi/pub/crypt/old/ghost/LUC/luc_vs_rsa
Aquatic
10-02-2003, 01:20 PM
Euler's totient function has no direct relation to the golden ratio that I know of, although you can get totient-like behavior if you consider quadratic recurrence relations modulo composites.

The LUC cryptosystem calculates the nth term in a Lucas sequence (a sequence in which the ratio of consecutive terms approaches the golden ratio) rather than raising to the nth power. Since the sequence grows exponentially, it's essentially the same thing.

See
http://math.boisestate.edu/~marion/teaching/crypto2s03/luc_rsa.htm

or

http://www.funet.fi/pub/crypt/old/ghost/LUC/luc_vs_rsa

edit: ok, I understand.


Softice4.05/Install/Won't Run
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice4.05/Install/Won't Run
PDA

View Full Version : Softice4.05/Install/Won't Run

adrianjake
05-14-2003, 08:44 AM
Hey Guyz
I'm a newbie and I'm having the foolowing problem..
I've installed softice v 4.05 but can't get to square one.

After I install and reboot, softice comes up wit "break due to Page fault (OEh) Fault = 0000"

Press "C" to continue or "R" to return to Softice.

I read the manual which states I should press R to return then "C" to send error to windows error handling.
I tried this, but it keeps giving me a syntax error.

I've changed the relevant settings in winice.dat

I've searched you're database but just can't find an answer

I'm running windows 98

Cheers

adrianjake
LOUZEW
05-14-2003, 12:46 PM
Type faults=off under softice or better in the winice.dat file !


New unknown anti-debug packer out.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New unknown anti-debug packer out.
PDA

View Full Version : New unknown anti-debug packer out.

billqiu
05-14-2003, 12:47 PM
Hey guys,
I spent more hours trying to unpack this exe file,but failed.
this new unknown packer can detect all the known debugger then
exit.could someone help me unpacking the file.
This file can be download from

Best regards,
billqiu
Shoob
05-14-2003, 01:58 PM
brings to me

0012FF94 00949721 ASCII " Error (4): File CRC Error, Abort!"

and the program crash.

normal? I have no debugger installed and the program reboots my pc for 2 times. I have no desire that my hd crashes so to every developer out there, dont use this scheme of Protection, if you have any bug in your app, i don't talk from the protector itself (could also have nasty bugs..) your pc will restart and you have an angry customer ;)
Iwarez
05-14-2003, 03:04 PM
My Windows XP doesn't even run the file. What I could see is that it starts a service and tries to start it, but with or without debugger the program doesn't run. No message, nothing.
nikolatesla20
05-14-2003, 04:08 PM
PE-Scan identifies section 1 as being telock

-nt20
billqiu
05-14-2003, 04:43 PM
Hi,
please ATTENTION,this exe file must run on win2k.
because of missing two file in the zip file,i reuploaded the zip file,
please redownload it and unpack it.

nikolatesla20,thank for your help.
I'm sure the packer isn't telock,it's new packer.this packer can detect the softice,trw2000,filemon,after i study the memory dump file made by loadpe,i guess the protected program is delphi progrom,but i can't find oep using dede.

Best regards,
billqiu
JMI
05-14-2003, 05:20 PM
billqiu:

It is apparent that you did not read the FAQ or the posting guidelines. The posting of links to commercial software on your own site, is NOT PERMITTED on this Forum. Although most of the program's start-up dialog appears to be in Chinese, it certainly appears to be a commercial product.

Secondly, the posting guidelines require that you post some of your own work, to demonstrate that your request is something more that a crack request. Here, you are asking someone else to unpack this for you, and that also is not permitted.

To sum up, at the least, you post is about to be deleted. Further failures to comply with the posting guidelines will result in your being banned from the Board.

It is time for you to go read the posting guidelines.

Regards.
Shoob
05-15-2003, 09:15 AM
modified Upx file - np


Pseudo_code Exersize
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Pseudo_code Exersize
PDA

View Full Version : Pseudo_code Exersize

evaluator
05-15-2003, 07:32 AM
for newbies practice,
I ripped & rearanged little snippet of PSEUDO_CODE,
because original target will not exist after some time..
Gaia
05-15-2003, 11:11 AM
Hi evaluator!

I am sure that my rebuild is 99% your "original" exe, I am wrong? ;)

Is not difficult if you look at correct ESP

Gaia
evaluator
05-15-2003, 04:24 PM
yep, you have 2 NOP!

HINT:
before "and ecx,0000000FF"..
Gaia
05-15-2003, 05:35 PM
Uppss, I forgot the "mov ecx, eax" ;)

Gaia
sope
05-16-2003, 02:35 AM
Hello evaluator / Gaia

Thanks evaluator for the exercise & Gaia for the solution.
I need to ask how u knew

(1) @401003 it should be 6AFF (4) @401021 it should be 0x57
(2) @401005 it should be 0x68 (5) @40102C it should be 0x2BD2
(3) @40100A it should be 0x68 (6) @401057 it should be 0x6A01

In below code the one in dark black i was not able to find. Rest i did saw in the code were recovered from execution of program & some from stack manipulaion.
Does it mean we have to reconstruct it with

->> trial & error ?
->> or we have to know which compiler is used & then reconstruct it appropriately
->> or i am failing to understand the concept behind it.

Also how u knew this recovered bytes will fit at this particular offset ? I might sound lame but i need to understand it.

Two thing i definately learnt from this exercise is we have to be very careful while pressing F8 or F10 one or two quick press we might loose important DWORDS from stack which we need to note down. Second important thing is recovering of code from stack manipulation.

Regards

Sope!:00401000 55 push ebp
:00401001 8B EC mov ebp, esp
:00401003 6A FF push 0FFFFFFFFh
:00401005 68 A8 2F 4B 00 push 4B2FA8h ; 0x40312F
:0040100A 68 90 10 40 00 push (offset aDl+5)
:0040100F 64 FF 35 00 00 00 00 push large dword ptr fs:0 ; 0x4039C0
:00401016 64 89 25 00 00 00 00 mov large fs:0, esp ; 0x403587
:0040101D 83 EC 58 sub esp, 58h
:00401020 53 push ebx ; either from 403CE5 / 403C83 / 403A8E / 402AF2 / 4027F8 ?
:00401021 56 push esi ; 0x4032D6 ?
:00401022 57 push edi ; ?
:00401023 89 65 E8 mov [ebp+var_18], esp ; 0x402238
:00401026 FF 15 54 40 40 00 call ds:GetVersio
:0040102C 2B D2 sub edx, edx
:0040102E 88 E2 mov dl, ah ; 0x401F63
:00401030 89 15 C8 41 40 00 mov ds:4041C8h, edx
:00401036 8B C8 mov ecx, eax
:00401038 81 E1 FF 00 00 00 and ecx, 0FFh ; 0x401F6D
:0040103E 89 0D C4 41 40 00 mov ds:4041C4h, ecx ; 0x40334B
:00401044 C1 E1 08 shl ecx, 8
:00401047 01 D1 add ecx, edx
:00401049 89 0D C0 41 40 00 mov ds:4041C0h, ecx ; 0x402DA6
:0040104F C1 E8 10 shr eax, 10h
:00401052 A3 BC 41 40 00 mov ds:4041BCh, eax
:00401057 6A 01 push 1 ; i got 01 but 6A = ?
:00401059 E8 2C 00 00 00 call nullsub_1 ; 0x401059
:0040105E 59 pop ecx
:0040105F 6A 00 push 0
:00401061 68 00 11 40 00 push offset aFinish
:00401066 68 00 11 40 00 push offset aFinish
:0040106B 6A 00 push 0
:0040106D FF 15 70 40 40 00 call ds:MessageBoxA
:00401073 64 8B 25 00 00 00 00 mov esp, large fs:0
:0040107A 64 8F 05 00 00 00 00 pop large dword ptr fs:0
:00401081 C9 leave
:00401082 6A 00 push 0
:00401084 FF 15 50 40 40 00 call ds:ExitProcess
evaluator
05-16-2003, 03:22 AM
so Finish comes to us..

1. So, "THIS IS A QUESTION", 6Ah or 68h for push.
I'm sure, all-1 compilers uses 6Ah, when it does adequate result.
& also: if you will use 68h anyway, then code size will another, OK?

2. & on 6AFFh SVKP sux! It makes 000000FFh. (or it is trick?)
In my case I corrected this situation.

3. yes, MOV ECX,EAX is correct, BUT!
Compiler does:
PUSH EAX;
POP ECX;
!!heh??
But We know, this is no matter.(as SUB EDX,EDX or XOR EDX,EDX)

EnjoE

For final move, prog that I copmared, is game DYNOMITE:)
sope
05-16-2003, 07:59 AM
Hello evaluator

Thanks for your explanation & thanks for BLOCK start is 21 bytes long hint. Now i do understand what u mean by it. :)

Regard
Sope!
Dedec0
08-16-2003, 11:02 PM
Hello all,

I can't figure the contents of that first attachment in this thread. Is it correct? Any guess of what may be wrong then?

Thank you.

Dedec0
sope
08-17-2003, 02:46 AM
Hello Dedec0

I d/l the zip file u mentioned & i don't see any problems with it. Its perfect. OR

If you are talking about the pseudo_code.exe itself then i guess you need to read this thread first (http://www.woodmann.net/forum/showthread.php?threadid=4786) for better understanding of what it does & for what purpose it was made for us to learn.

Regards, Sope.
Dedec0
08-17-2003, 05:29 AM
Thank you very much, sope, :)

I was talking about the attachment (first "pseudo_code.zip"). I just found out what the problem was. I now can see the file's contents.

Read further, curious... ;) (http://www.woodmann.net/forum/showthread.php?postid=28718#post28718)

Regards,

Dedec0


Win32dasm hasn't been updated in a while...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Win32dasm hasn't been updated in a while...
PDA

View Full Version : Win32dasm hasn't been updated in a while...

onebitshort
05-15-2003, 01:36 PM
Win32dasm is an excellent, easy-to-use disassembler, but it hasn't been updated in soooo long (since the late 90s) ... does anyone here know why? or what happened to the author?
JMI
05-15-2003, 03:38 PM
It hasn't been updated because nobody, including probably you, paid for it and it was extensively warez and the authors probably got tired of working for nothing. Then again maybe it was always "fee" and they just got tired of working on it.

Regards.
squidge
05-15-2003, 05:49 PM
onebitshort: If your searching for a replacement, I can recommend IDA. You can download the free version from many websites. Datarescue used to host it themselves, but I think the bandwidth it was taking up eventually got too much for them.

Sure, it's not got everything the latest retail version has, but it's adequate for most people.
evaluator
05-17-2003, 12:23 PM
onebitshort,
& what version you have?
th_snake
05-18-2003, 01:30 PM
Hi people
Maybe the author didn't do any more work about it, but go to
protools.cjb.net and get the patches and other files that Harlequin, Lazarus, Cold Coder and Death made for w32dasm.
It worth to try them !!
You can find them neerby the link to w32dasm home(broken link), at the Decompilers section.

Regards
the snake
mythical
05-19-2003, 07:52 PM
I heard in is no longer be produced.
whoda
06-02-2003, 03:50 AM
What patches are people using on w32dasm? I found so many patches, but it was hard to find one that did it all. So far I've liked the w32dism++ , but it seems it really doesn't have support for VB 5,6 like I've seen on other patches. I'm just looking if there's a patch that does it all.
artik
06-02-2003, 05:58 AM
check out hxxp://kickme.to/wdasmpatch


upx1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > upx1
PDA

View Full Version : upx1

whoda
05-15-2003, 03:44 PM
I'm a newbie and tried to unpack something that pe told me has upx1. I tried running the upx124w with -d and it gave me an error. I found the program brat_upxunp and it unpacked and saved. Then when I run it without doing anything else it says "The procedure entry point SysFreeString could not be located in the dynamic link library ole32.dll"

I'm trying to unpack the program
artik
05-15-2003, 04:47 PM
i had no problems with unpacking the app, since it's not modified/scrambled. so no manual unpacking is needed ;)

anyway, i unpacked it using this tool:
http://iont.virtualave.net/upxshell.html

btw. its coded in Borland Delphi 4.0 - 5.0
enjoy cracking!
whoda
05-16-2003, 01:26 AM
thanks so much
unpacked it just fine


flexlm on solaris
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flexlm on solaris
PDA

View Full Version : flexlm on solaris

hsym
05-15-2003, 07:54 PM
I can get correct flexlm seed1 & seed2 on windows.
but I don't get seed1 & seed2 on solaris.My daemon
is ODS.I can find l_sg, but I don't find lm_new.
On l_Sg, I get seed1&2,key1-key5.
but, license key incorrect.
Please help me!
How to find correct seed.

seed1 0xc5b41454
seed2 0x34451454

key1 0x08d6a844
key2 0xf4d63291
key3 0x830d4aca
key4 0x564fd629

key5 0x1852BFCD
allenzhu
05-30-2003, 12:07 PM
try to read them in memory
hsym
06-11-2003, 12:10 AM
how to read memory?


Armadillo for dummies (vol 1) english
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo for dummies (vol 1) english
PDA

View Full Version : Armadillo for dummies (vol 1) english

S3ri@l CoDe9x
05-15-2003, 11:56 PM
Hi All!!

Really I hope that you can see this tutoriales of armadillo :p
they are grand .. it 's unpacking in ollydbg ..In another method different from that of the unpacker CrUsAdEr :rolleyes:

They are of my great friend Ricardo Narvaja [CraCks Latinos].. his list of
cracking in Spanish .. thinks that it is good to translate in
English for the delight of you ;)

I only share this great knowledge :p

Best Regards ! :rolleyes:

The first part added to this message :)

Cracks Latinos 2003
corado
05-19-2003, 01:15 AM
Does this system works if the soft protected by Armadillo needs Username and Key to run?

Thanks
Corado


Armadillo for dummies (vol 2) english
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo for dummies (vol 2) english
PDA

View Full Version : Armadillo for dummies (vol 2) english

S3ri@l CoDe9x
05-16-2003, 12:05 AM
U can download the second part of here :

hxxp://add4.netfirms.com/70-armadillo for dummies getright 5 (vol 2) english.zip <--- remember change http :p

Really thank u :D to my friend and great CraCker Ricardo Narvaja

Best Regards! :rolleyes:

Cracks Latinos 2003
Ricardo Narvaja
05-16-2003, 04:32 AM
In wrote two tuts more of nanomites protection in armadillo, the part 1 is of function of this protection, and the part 2 in how to resolve automatically in ollydbg with a little inject of code to resolve, are in spanish but are translating now for my friend Imanol.

And the method for dump is different of the Crusader method and is in OLLYDBG, but i'm inspired in the great tute of Crusader, is a necessary guide for all Armadillo tutorials, if i haven't the Crusader tut in my desk i,m can't wrote this tutorials.

Thanks Serial Codex

Ricardo Narvaja
Artifex
05-16-2003, 04:33 AM
U can download the second part of here :...

I downloaded it, but I got an error when I tried to unzip the .zip file.

Artifex
Ricardo Narvaja
05-16-2003, 04:43 AM
Ths tuts in english are the final version of getright 5, the great Crusader tut is the beta version of GetRight 5 and is a bit different, in the final version not have nanomites, for this reason i wrote other 2 tutorial in the program eStop for the nanomites protection with the exclusive atention at this point and the automatic reparation of this program.

Ricardo Narvaja
Ricardo Narvaja
05-16-2003, 05:00 AM
My FTP is

fxp://curso:curso@ricnar456.no-ip.org/
user:curso
pass:curso

]
replace fxp for ftp and be patient is full very parts of the day try more later if is this case.

in the carpet NUEVO CURSO-TEORIAS

the tus 69 and 70 are the tuts in english for getright 5 final.

Ricardo Narvaja
squidge
05-16-2003, 05:03 AM
Just in case other people do not know about it, more ollydbg stuff can be found on the ollydbg forum at ollydbg.win32asmcommunity.net
S3ri@l CoDe9x
05-18-2003, 04:59 PM
If u have problems to download ..

hxxp://www.anticrack.de/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=3873 <-- remember change http

Best Regards ! :rolleyes:
diz
05-19-2003, 08:14 PM
Tutorial is very nice, I learned a lot not only about arm but some usefull Olly features I didn't know before.

Anyway, did someone had a problem with crashing even after modifying all conditional jumps after GetEnvironmentVariableA? It happens here when I exit getrght, Olly shows me that int3 caused crash so it seems to be related to that jnz's. I'm thinking that there could be similar trick with some other API because all jumps after GetEnivronment... are already modified.

It's posibble that I did something wrong too ;)
Ricardo Narvaja
05-20-2003, 03:12 AM
Well i think if is a INT3 error is a possible nanomite, in the tute of nanomites you could learn how trpair this, but is a extrange thing tha autor not put a nanomite in the part of function of the program, and put one when you close the program, well lo see if is a nanomite in the father process, right click bynary search and put in hexa 03 00 00 80 and search you stop in the line how this.

CMP DWORD PTR DS:[EDX+C],80000003
JNZ WealthLa.00XXXXXX
XOR EAX,EAX

put a BPX in the line of xor eax,eax is the enter of nanomite process, run the program and reach the point of the error, if are exiting the son, make this if stops in the line of the BPX there is a nanomite and could be repaired with the method of the next tute, armadillo and nanomites part 1 and 2, maybe is only one nanomite, is possible repair by hand with only read the part 1.
If is the only nanomite and the program are exiting replace the INT3 to a jmp to exitprocess and is ready and more easy jeje.
Ricardo Narvaja
diz
05-20-2003, 07:59 AM
Thanks Ricardo for help.

Yes it seems that there are nanomites in GR5 Final, I found the jump tables and thanks to your new tutorial I should be able to recover jumps by myself :).

And by the way, these are used not only when exiting, when I open GR window, then launch GR Browser, then close it and close the GR window it should hide to tray but it crashes. So nanomites are definitly used in this.
Ricardo Narvaja
05-20-2003, 01:25 PM
The second part of tute of nanomites is ready sure my friend Serail Codex put a direct link to download in a short time.

Ricardo Narvaja
diz
05-20-2003, 07:55 PM
The first part of your tutorial is enough for me to replace all those THREE nanomites in Getright ;) Now I'm sure, these are executed only on exit (mayber after longer period it would expose some others).

After fixing, program exits nicely but there's another protection. Open Getright window, launch Browser from toolbar, close both windows and app will quit silently. I traced it and it goes to the nanomites that are executed when choosing exit from tray. In original (father) it goes some other route.

I just can't find conditional jump that leads to this code so I could change it. Traced code without results, I think I will give up with this.

Beta 0 to 4 does not containt this additional protection, b5,b6 and Final does.
Ricardo Narvaja
05-20-2003, 08:47 PM
The tute use GetRight 5 for demostration a method how to dump in OLLYDBG, and in the tuts of nanomites use ESTOP to demostrate a methode for repair nanomites semiautomatically in OLLYDBG, is not a complete cracking of two programs,is a unpack tutes, the complete cracking cuestion is secondary, and any can complete after unpack.
A new tut in one part of dumping and repair nanomites i am writing at this moment with the experiences of this tutes and the sugerences i hear.
Ricardo Narvaja
diz
05-20-2003, 08:59 PM
Yes, your tuts are great and I understand that these are not about cracking specific target but about dealing with armadillo and they fullfill they task in 100% procent.

I didn't mean to change this topic into 'how to crack getright', probably it would be better if I start another one. Whatever, I will stop working at this for now, maybe someone will give me some hint which will encourage me, if not then ok.

bye for now :)
Ricardo Narvaja
05-21-2003, 06:53 PM
I made a best inject to work better with long jumps in an tute anexo of nanomites i write tomorrow, i write this.

With this in estop i could found with the inject 6 long jumps in ths estop, and if you pass the mejorated inject can view if in getright there are more long jumps.

The inject now not repair long jump but list all in the log and the dates for repair all.

Ricardo
Hopcode
05-22-2003, 04:39 AM
Nice, but it won't work on Armadillo V3 i guess, will it ?
Ricardo Narvaja
05-22-2003, 06:12 AM
I have a tut of a crackme packed with armadillo 3 and method of dumping works well, the only difference is the ofuscation of the code, in my tute the ofuscated code are cleared but are the same , is the same method for dumping, with nanobytes i have not a program for try, but i think is the some thing only with code ofuscated, when i have an armadillo 3 with nanomites i try and tell you.

Ricardo Narvaja
diz
05-22-2003, 07:28 AM
Originally posted by Ricardo Narvaja
when i have an armadillo 3 with nanomites i try and tell you.

Maybe getright 5.01 ;) It seems to be using arm3 but I'm not sure.

Btw, I fixed my problem with 5.0. It was another GetEnvVarA but called by 'call edi' so in Olly 'bpx' type breakpoint didn't catch that one. 'Bp' breakpoint did :)
It still crashes sometime, but it seems that there could be some wrong entries in IT or sth. Will look at it sometime.
Ricardo Narvaja
05-22-2003, 07:39 AM
I think is armadillo 2.85 GetRight 5.
Armadillo 3, i see in a crackme i make a tute, ofuscate the code of the bad and good calls in the father, and this not, but if you look this tute is very similar the dumping part, i don´t know the nanomites part.

Ricardo
Hopcode
05-22-2003, 08:34 AM
Well, nanomites changed in Armadillo 3.
its not as easy as it used to be.
As for a target, unpack armadillo itself, it uses nanomites of course.
i failed so far :(
nikolatesla20
05-23-2003, 07:31 AM
Here's what I have so far for GetRight 5.0.1 (Released May 20, 2003)

1. Unpacked with DilloDumper / ImpREC first.
2. Program has no nanomites on startup.

3. When clicking on "Schedule download start" I get:

nano: 004F5A73 Jmp type : 0E (JMP) Location: 004F5A78
nano: 004F5A7E Jmp type : 0C (JZ) Location: 004F5AF6
nano: 004F5AF6 Jmp type : 0E (JMP) Location: 004F5AFB

And then the dialog for scheduling comes up.

There's one or two nanos on exit too, haven't traced them yet.

This Arma still does nanos same, except now you have to deal with code obfuscation (only a small annoyance) and the address table is not "next" to the Jump type and length tables. Also, the jump length is "encrypted".

Snippet - Address table search...

005F9957 MOV DWORD PTR SS:[EBP-FFC],ECX
005F995D MOV EDX,DWORD PTR SS:[EBP-FFC]
005F9963 MOV EAX,DWORD PTR DS:[623A70] <-- find address table.
005F9968 MOV ECX,DWORD PTR SS:[EBP-FF4]
005F996E CMP ECX,DWORD PTR DS:[EAX+EDX*4]
005F9971 JBE SHORT getright.005F9984 <--- part of binary search..
005F9973 MOV EDX,DWORD PTR SS:[EBP-FFC]
005F9979 ADD EDX,1
005F997C MOV DWORD PTR SS:[EBP-FF8],EDX
005F9982 JMP SHORT getright.005F9990
005F9984 MOV EAX,DWORD PTR SS:[EBP-FFC]
005F998A MOV DWORD PTR SS:[EBP-D20],EAX
005F9990 JMP SHORT getright.005F9930
005F9992 PUSHAD <-- start of another code obfuscation..
When we get here, we've found the
address in the address table, and have
its offset to use in jump type table.

Snippet - Jump type:

005F9A12 LEA ECX,DWORD PTR SS:[EBP-FF0] <- offset ..?
005F9A18 PUSH ECX
005F9A19 MOV EDX,DWORD PTR DS:[623A7C] <-- Jump type table..
005F9A1F ADD EDX,DWORD PTR SS:[EBP-FF8]
005F9A25 MOV AL,BYTE PTR DS:[EDX] <-- get jump type
005F9A27 PUSH EAX
005F9A28 CALL getright.005FC23F <--- check whether to jump
005F9A2D ADD ESP,8
005F9A30 AND EAX,0FF

Snippet: Jump length...

005F9A69 XOR EDX,EDX
005F9A6B MOV ECX,10
005F9A70 DIV ECX
005F9A72 MOV EAX,DWORD PTR SS:[EBP-FF8]
005F9A78 MOV ECX,DWORD PTR DS:[623A6C] <- Jump length table
005F9A7E MOV EAX,DWORD PTR DS:[ECX+EAX*4]
005F9A81 XOR EAX,DWORD PTR SS:[EBP+EDX*4-D0C] <- get real value...
005F9A88 MOV ECX,DWORD PTR SS:[EBP-F38] <- Load nano address.
005F9A8E ADD ECX,EAX <-- add to where nano was..
005F9A90 MOV DWORD PTR SS:[EBP-F38],ECX

I've noticed there seem to be very few actual nanos in this target, so I'm walking thru it manually for now

-nt20
diz
05-25-2003, 03:14 PM
Originally posted by nikolatesla20

This Arma still does nanos same, except now you have to deal with code obfuscation (only a small annoyance)

Is there some special way to deal with code obfuscation? For me it seems to be a BIG problem when I can't see the code I'm tracing.
Lunar_Dust
05-25-2003, 03:27 PM
It's not really too bad, you can simply step thru the "fake" code in the debugger until you get to the good code blocks. In fact , even in new Arma you can set breakpoints on the good code areas with not problem, which allows you to completely skip the obfuscation blocks anyway.

-Lunar_Dust
diz
05-25-2003, 04:33 PM
But it seems that Olly is not handling obfuscation very well. Tried manual reanalizing (ctrl-A) and it worked well in one place but failed at the more important place (after WaitForDebugEvent). Guess I need to switch to 9x and try SICE
squidge
05-25-2003, 05:31 PM
Are you sure it's obfuscation you are having trouble with and not some SEH? If I remember correctly, Arma uses SEH after WaitForDebugEvent to do the processing. If you simply place a breakpoint at the exception code address (search the stack, or use the FS segment) and press F9 directly after the WaitForDebugEvent, you land in the debug event parsing routine.
diz
05-25-2003, 06:50 PM
Sorry, I didn't make myself clear. Saying 'after WaitForDebugEvent', I was meaning: after returning from a call (alt-F9). After that, I just see a few instructions and rest is just a bunch of bytes, certainly not an instructions.
Ricardo Narvaja
05-25-2003, 06:56 PM
I offer you a tute in spanish but is easy understand of a crackme packed with armadillo 3, in the tute you can view how dump the same method and how the ofuscation isn't a trouble at all, the crackme has no nanomites is a dumping only but you can view the form of work with ofuscation, the rar gives with the crackme, if you mail me to

ricnar22@millic.com.ar

i send to you

Ricardo Narvaja
JMI
05-25-2003, 10:06 PM
Ricardo Navarja:

If it's "76-CRACKME DE BLASITO EN OLLYDBG" you can post it here. Its a crackme tut and shouldn't be a problem to attach.

If this isn't the correct one, just attache the correct one to your post .

Regards.
Ricardo Narvaja
05-26-2003, 03:41 AM
the tut 76 is a crackme in FOX, with a serial, in OLLYDBG, not is armadillo, not is on unpacking, only catch a serial with OLLYDBG in a fox program.

the tut of armadillo 3 is more old is a 54-ARMADILLO 3 with copymem2, and is a end os a saga os armadillos crackmes (tuts 52-53 and 54), but all are in spanish, and are previous to the tut of GETRIGHT 5.

Ricardo Narvaja
Ricardo Narvaja
05-26-2003, 03:45 AM
the tut 76 is the same crackme in fox, tut 73, only in tut 73, is solved by Profesor X and using REFOX, and in a tut 76 i use only OLLYDBG for solve and catch the serial.

Ricardo Narvaja
diz
05-26-2003, 08:40 AM
Thanks for tutorial. I have some problem with one thing so I think that better will be if I attach it here. I converted it from word to html and included translation from babelfish (weak but can be understood). If You don't like what I did, say a word and it will be removed.

Can we expect 'good' translation of this one (maybe TeN$HiN)?

Too big to attach.

LINK: http://rep.republika.pl/54-ARMADILLO_3_CON_COPYMEM_2_(SPANISH_AND_ENGL(F)ISH)_-_HTML.zip
Ricardo Narvaja
05-26-2003, 08:58 AM
In nexts tutes will be a complete unpacking and rebuild IAT + nanomites repair of a program with armadillo 3 or 3.01, only i writing other tuts in this time, when i finish with this i write a complete unpack o a program with armadillo 3

Ricardo Narvaja
Hopcode
05-27-2003, 06:16 AM
to be sure , you should use last Armadillo.exe as the target.
sometimes, the sharewares autors are stupid and use it badly.
hobferret
05-30-2003, 05:08 PM
Yo everyone

This is for Ricardo Narvaja and/or diz

Link to tute - English mods;)
It is to big to put into HTML so these bits are seperated by ----'s
Hope JMI don't delete it!!!!!!!!!
E&OE!!!
Armadillo 3: The same method some variants.

Good in the case of armadillo 3 we will use the associated armadillo.exe that in this case this packed with armadillo 3 that works of the same form that previous the difference is to the antidebugger and that this has the code obfuscated, for that reason this new tute to see as handle to us with both differences (for this tute it is essential to read parts 1 and 2 of tute on armadillo since we will not explain everything again)

Antidebugger is similar to where he made PELOCK run in his corresponding tute, is necessary to find the byte of where api IsDebuggerPresent reads and makes EAX=1 and instead of changing it to EAX we must directly change the byte in the memory before taking the program, in my machne this in 7FFDF000
------------------------------------------------------------------------------------
There we encounter the 1 in the DUMP
------------------------------------------------------------------------------------
So we change it to zero
------------------------------------------------------------------------------------
I place the Bp WriteProcessMemory as in previous tute(part 2) and RUN it
------------------------------------------------------------------------------------
Here is where he tries to copy first block 425000 to the process SON.

We watched in the Call Stack of where it is called in the feasible one
------------------------------------------------------------------------------------
We see that the api is called from 43afbc but the decrypter call is following that and is CALLED FROM 439d2f so we go there.
------------------------------------------------------------------------------------
There we have the decrypter call as we cannot go downwards to look for similar call since the code this obfuscated, we were placed upon call good, and do click FOLLOW straight, and there where we fall do click FIND REFERENCES TO SELECTED straight COMMAND and it leaves this to us
------------------------------------------------------------------------------------
the location of both call the decrypter and the encrypter, we go to the bad one that is the encrypter
------------------------------------------------------------------------------------
There we put the nop's the same as we did in tute part 2.
------------------------------------------------------------------------------------
Now just as in the previous tute we put a BPX where it returns from api and we RUN it and it stops here
------------------------------------------------------------------------------------
I place a BP WaitForDebugEvent as we see in the image below.
------------------------------------------------------------------------------------
Now Run it and it stops in the Bp that it places and in the second line of stack I see the direction where this the report 12eff4 in my machine I look for it in the dump and this marked entry there to it point as we explained in tute part 2 (4251d0)
------------------------------------------------------------------------------------
I am now going to place an infinite loop at the entry point, for it I go to cases out attach and I pay attention handle of the process Son to this case is 9a4 (the one that not this in red) of both armadillo3
------------------------------------------------------------------------------------
We opened pupe and we looked for the process son according to handle, soon it frame and I am going to patch and in entry point 4251d0 change the first byte by EB and the second by FE (I do loop infinitely)
------------------------------------------------------------------------------------
Once fact that is necessary to nop the call to WaitForDebugEvent we see in the image the obfuscacion that does not allow to see push nor nothing else (nor the same call)
------------------------------------------------------------------------------------
So when it happens that is necessary to prove here in the listing from the position in which we are at 44776e, we are making GOTO EXPRESSION backwards of a a byte, until we arrived at GOTO EXPRESSION=437768 where appears the call well written as it is seen in the image
------------------------------------------------------------------------------------
There already we can nop it along with previous PUSH EDX it has now left a PUSH but the one of the time if we followed backwards with GOTO EXPRESSION we will arrive at 43775c where we see PUSH nop this.
------------------------------------------------------------------------------------
We see the other PUSH 3e8 that there is to nop that is is possible to be said that there is to nop from here 43775c to the test eax, eax.

Good stuff this obfuscation, I am already tiring (he he)

We sent the jump at 43776E to 401000
------------------------------------------------------------------------------------
Here this the graph for when it comes to decrypt zone 425000 and again it stops.
------------------------------------------------------------------------------------
The memory positions are not the same ones of tute previous where is keeping the 400000 etc so I correct the graph so that it modifies that. I need the initial conditions of the report
------------------------------------------------------------------------------------
I put 400000 so that it takes like initial value that added 1000 to it and will be then the first block from 401000 the one that it will decrypted.

RUN it and we see in the LOG as all the blocks were decrypted up to 424000 we go well now we must skip the block of 425000 and follow until the end of the first section, here is not necessary then 425000 is I complete the block of the first section but if not outside thus and it was necessary to decrypt but we changed limits of the comparison 1 complete block to decrypt and we published the report so that it continues from 426000, this serious example if there were to continue decrypting up to 428000 for example (it is not necessary here I show it like the example)
------------------------------------------------------------------------------------
There it changes the maximum limits of the comparison 429000 so that it stops before it decrypts this block and it publishes the report so that (he he) it follows from 426000.

Let us return to our case, we already have everything in the decrypted memory and run all the blocks.
------------------------------------------------------------------------------------
Good now I write the two lines to uncouple the father from the son
------------------------------------------------------------------------------------
I execute them with F8 and I pay attention after executing the api, that eax is 1 what means that all is well and unhooked correctly. If eax is 0 is an error has occured.

here it attaches to the son and slows it down and it clears loop infinitely to him
------------------------------------------------------------------------------------
Dump with LORDPE with INTELLIDUMP change entry point to the correct one
------------------------------------------------------------------------------------
Good dump this ready and correct one, although we must fix the table with revirgin then when running it gives us an error in the table of the dump but the error is not here
------------------------------------------------------------------------------------
We see that the table is complete except for that reason it does not run is the jump at 40128C we have not determined this api so once we repair it with revirgin, and the table this correct one will perfectly run (he he) dump the this correct and complete one.

Ricardo Narvaja /hobferret

:cool:
diz
05-30-2003, 05:21 PM
Originally posted by hobferret
---------------------------------------------------------------------------------
So when it happens that is necessary to prove here in the listing from the position in which we are at 44776e, we are making GOTO EXPRESSION backwards of a a byte, until we arrived at GOTO EXPRESSION=437768 where appears the call well written as it is seen in the image
------------------------------------------------------------------------------------

That's the place where it just doesn't seem to work. Moving back to 437768 by one byte does not reveal instructions for me.

BTW. there's error here and in oryginal tutorial too. Both addresses should start at 43xxxx. Probably everybody noticed that but anyway..
Ricardo Narvaja
05-30-2003, 05:54 PM
You can place in the first CALL , the decriptor or good call, and right click FOLLOW, in the line you appear RIGHT CLICK and FOUND REFERENCES TO SELECTED COMAND and you can view in the list the 2 CALLS the good and the bad CALL, only confuse a little for the ofuscation but if you search you found IT.

Ricardo
hobferret
05-31-2003, 02:55 PM
Hi Ricardo Narvaja ;)

I just thought i had better explain your "FAITH" in the english version!

When you said make the first byte EB and the second FAITH you were getting mixed up!!

OK so 55 becomes EB and 8B becomes FE.

The state capital is Santa Fe (FE) that Fe is faith!;)

Keep up the good work:D

/hobferret
Ricardo Narvaja
05-31-2003, 04:52 PM
I dont speak spanish and i not translate the tute a friend make the translation sorry.

Ricardo
Ricardo Narvaja
05-31-2003, 05:54 PM
i look mi tuts in english translated for mi friend Imanol and not there are FAITH for FE, my tut of armadillo 3, is not translated for Imanol, i heve only in spanish, the translation and posting are realized by a member of this forum with a program and this is always not so good how a manual translation.

Ricardo
diz
05-31-2003, 05:59 PM
Yes, I posted engl(f)ish version of this tutorial. It's was translated at Altavista's babelfish translator. Of course there are errors in this, this is just a machine's translation.
thematrix
11-06-2003, 03:45 AM
S3ri@l CoDe9x where to get pupe(tool) used in yur 1st vol?
i am not able to find it google.com
diz
11-06-2003, 08:18 AM
http://rep.republika.pl/rce/pupe2002.zip
This is the newest PUPE (version 2000). There is source code included and compiled exe too but in spanish.

I translated a small part of this app to english. Partially translated exe can be found here:
http://rep.republika.pl/rce/pupe.exe
Spec0p
05-01-2004, 12:26 AM
Hi guys this is my first post, and iam starting with a question :rolleyes:
But 1st off all i want to congratulate Ricardo, on those armadillo tutorials, and to thank all of u guys who have the knowledegment and are allways sharing it with people like me, hope i will be able to do the same one off this days :) .

Now my doubt, hope someone can help, well i have been unpacking some arma app's without probs, but this time i got nanomites... Its arma v3 and it has obfuscated code, so i read all the tuts i could find and gather the maximum of information, and i advanced well until calculate the jump table. I couldnt get how u guys could get tose AND EAX, 40 = JZ by checking the flags, then after some struggle i found that if we have all flags 0'ed and also EFL, if we start changing flags we get values like on those AND's like 0C, 80, 800 etc... i didnt we could do that, if i knew it would have saved me a lot of thinking and time, but iam happy i getted there by my one, now actually the problem is i cant get on all the jumps. I am able to get on magic jmp and reach the snipets of code to the 8, 10, C, D type jumps, but not the others, i tryed all options i can think of on app and still i only get to those 4, so i though that maybe app was using nanomites for those 4 jmps, then i downloaded an app unpacked by Ricardo eStop! and when i reached the magic jmp i got the same problem, i can only find nanos that go to 3 or 4 diferent jmps and i tried all the options i could find on app, but on Ricardo tutorial he has the values for them all, so am i missing some options off the app or is there other way go get those jmps?
Other thing that bothers me is this:

JMP DWORD PTR DS:[ECX*4+5FFC0E] <--- Magic Jump
........
........
MOV EDX,DWORD PTR SS:[EBP+C] ; Type of jump 9
MOV EAX,DWORD PTR DS:[EDX+C0]
AND EAX,40 <-- Check Z flag
NEG EAX
SBB EAX,EAX
NEG EAX
JMP FileMoti.005FFC07 <-- Here ZF=0 AND EAX=1 so its JNZ
......
......
MOV EDX,DWORD PTR SS:[EBP+C] ; Type of jump 5
MOV EAX,DWORD PTR DS:[EDX+C0]
AND EAX,40 <-- Checks Z flag
TEST EAX,EAX
JNZ SHORT FileMoti.005FFB38 <---Here it allways jumps
MOV ECX,DWORD PTR SS:[EBP+C]
MOV EDX,DWORD PTR DS:[ECX+C0]
AND EDX,80
NEG EDX
SBB EDX,EDX
INC EDX
MOV EAX,DWORD PTR SS:[EBP+C]
MOV ECX,DWORD PTR DS:[EAX+C0]
AND ECX,800
NEG ECX
SBB ECX,ECX
INC ECX
CMP EDX,ECX
JNZ SHORT FileMoti.005FFB38
MOV DWORD PTR SS:[EBP-14],0
JMP SHORT FileMoti.005FFB3F
MOV DWORD PTR SS:[EBP-14],1 <---- Lands here
MOV AL,BYTE PTR SS:[EBP-14]
JMP FileMoti.005FFC07 <----- Here Z=0 and EAX=1 so its JNZ (again???)

So my question is is it possible to have diferent ID jmps with the same kind of jump or iam i doing something wrong?
Hope u guys understand what i explained..... If not, well at least u have read it so thx anyway :)
nikolatesla20
05-01-2004, 02:24 PM
last I remember I never found any identical jump types. It's tough, those jump types. But once you figure them out the code for each is the same all the time. Now if only I could find my notes.

Anyway, it most likely is another type of jump, like a sign bit jump or something (JS or JNS).

-nt20
Spec0p
05-01-2004, 02:55 PM
last I remember I never found any identical jump types. It's tough, those jump types. But once you figure them out the code for each is the same all the time. Now if only I could find my notes.

Anyway, it most likely is another type of jump, like a sign bit jump or something (JS or JNS).

-nt20

Thx 4 answering nikolatesla20. As u say and i agree, it must be another kind of jmp, since in all the information i read, never an jmp type has 2 diferent ID's, but this is weird because on two snippets of code EAX is AND'ed with 0x40, and this means that those jmps gonna depend on Z flag only, since there is no other flag check, and on the last line both get Z = 0 and EAX = 1, that means that it must be a jmp that will jump (sry about allways writing jumps but i dont remember any other way :\) when Z flag its not set, the only jmp i know is JNZ.
btw on my way to try understand all this i wrote a table on paper with all types of jmps i remembered, op codes to short and long distance jmp, and the flags that being set or not, make them jmp. So since Z flag is checked it could be JZ/JNZ(ZF), JBE/JA(CF,ZF), JLE/JG(ZF,SF,OF). U said above JS/JNS(SF), but has SF is never checked i think thats prolly not it... or then my theory of guessing those jmp types its wrong... :confused:

Anyway do u remember/know how we can get to the rest of jmp types snipets??

Regards,
sPeC!
Hopcode
05-03-2004, 05:31 AM
last I remember I never found any identical jump types. It's tough, those jump types. But once you figure them out the code for each is the same all the time. Now if only I could find my notes.

Anyway, it most likely is another type of jump, like a sign bit jump or something (JS or JNS).

-nt20

Well latest version is completely different now.

- Each customers have different code of jump handlers apparently. (or it is polymorphe, i doubt it though)
- The handlers are heavily obfuscated, no more 3 clear lines to handle
a jump.
- The jmp handlers aren't in the same order anymore, for different customers (or polymorphe too, i doubt it again)
- And there are some weird calculus to find out which jump is beeing emulated. they have their own values they test etc.

Im working on 3.70a right now.

Cheers!

Hopcode
Ricardo Narvaja
05-03-2004, 12:59 PM
I made tuts 203-204-205-206-207 and 208 (six parts) for this nightmare armadillo with total destruction of table version 3.70 witout copymem2 but with total destruction of the table antidumps and all the parafernalia of armadillo, is really terrible ( 6 parts)

hxxp://www.ricnar456.no-ip.org/NUEVO%20CURSO/TEORIAS/

203 to 208

is a terrible experience jeje

Ricardo Narvaja
Hopcode
05-03-2004, 02:09 PM
I made tuts 203-204-205-206-207 and 208 (six parts) for this nightmare armadillo with total destruction of table version 3.70 witout copymem2 but with total destruction of the table antidumps and all the parafernalia of armadillo, is really terrible ( 6 parts)

hxxp://www.ricnar456.no-ip.org/NUEVO%20CURSO/TEORIAS/

203 to 208

is a terrible experience jeje

Ricardo Narvaja

Well done !
Why don't you write the tutorial in english directly ?
you would have more readers that way.

Did you try new nanomites?

Cheers!

Hopcode
Ricardo Narvaja
05-03-2004, 02:20 PM
for write a simple post in this forum i'm working 15 minutes, i not speak in english well, the tuts in english in my ftp are translated by friends but they are busy with studies, and i was without sleep days for make a tut in spanish if i write in my poor english, i don't sleep by months jeje.

Give me a name or a link to a program with the new nanomites i try

if you don't want put a link here mail me to ricnar22@millic.com.ar with the link and the name, and i try (when rest a couple of days jeje) my brain is exploding.

Thanks
Ricardo Narvaja
Spec0p
05-03-2004, 02:29 PM
Hi Ricardo, i was hopping u would be the one being able to answer my question :(
didnt u read my post? or just not having the time? :confused:
love ur tuts, i had already part 5, now i can complete the reading :p

Reagrds
sPeC!
nikolatesla20
05-03-2004, 04:05 PM
I worked on 2 nano targets back at 3.50, and from what I found the only "difference" between customers is the "jump offset table".

The jump code was the same, then handlers ARE always in the same order, but the it's the offset , the special "customer jump offset address table" that changes. Since this changes, it makes it look like the handlers were in a different order, when they were not. Remember, the jump is calculated from a JMP [EBX+<blah>*4] type of instruction. It's looking up an offset from a table. From my own examination back at 3.50, it was only this table that changed between customers, not the actual code.

LOL it made me laugh because I highly doubt that SiliconRealms actually "compiled" a new version for each and every customer. All they did was randomize this jump offset lookup table and then tell their JMP instruction scanner the new order. But the actual code inside stays the same. Yea, right, like they are going to go to the trouble of compiling a whole new program..hehe

-nt20
Ricardo Narvaja
05-03-2004, 04:07 PM
well i'm investigating the new armas and have not time, i'm married, my wife say she is widow, jeje. I don't sleep for investigate new armas and is very difficult to me go back to older versions there are a lot of tuts of this versions, but i don't understand, you are with the same program of my tut of other program, in the programs of my tuts the jumps are very clear and is very easy to find.

Tell me more and i see what can i do, snif

Ricardo
Hopcode
05-03-2004, 04:19 PM
I worked on 2 nano targets back at 3.50, and from what I found the only "difference" between customers is the "jump offset table".

The jump code was the same, then handlers ARE always in the same order, but the it's the offset , the special "customer jump offset address table" that changes. Since this changes, it makes it look like the handlers were in a different order, when they were not. Remember, the jump is calculated from a JMP [EBX+<blah>*4] type of instruction. It's looking up an offset from a table. From my own examination back at 3.50, it was only this table that changed between customers, not the actual code.

LOL it made me laugh because I highly doubt that SiliconRealms actually "compiled" a new version for each and every customer. All they did was randomize this jump offset lookup table and then tell their JMP instruction scanner the new order. But the actual code inside stays the same. Yea, right, like they are going to go to the trouble of compiling a whole new program..hehe

-nt20

hello :)

Well they DO recompile new programs for each customers :) (since 3.70 at least)
Have a look at current 3.70a and you will see that :

the order of the handlers for each customers is NEVER the same.
the handlers themselves are more than 15 lines, sometimes more than 30 lines of WEIRD assembly (compared to the 3 lines shit like AND EAX, 41h) and each customers have different handlers!
The two applications i compared, are completely different, and use the same version of Armadillo.

Ie: for a given jump, you have a different obfuscated crap handler.
And they added some other shit to test the flags used too. (and this is different for each customer apparently)

Its a lot different now, not as easy as a simple "Case" using a jmp [register*4+table] :)
This is just a High Level construct, you know "Select Case" crap.

They have added all those new shits to break N-REC.

Cheers!

Hopcode

PS: Im still analysing those handlers and seeing how it work.
Spec0p
05-03-2004, 04:35 PM
Well Ricardo ur wife is like my girlfriend :p , thx a lot 4 answering!
U see iam working on other app, but since i was not able to access all the jmps, and i had already read ur tutorial on eStop, i thougth well prolly iam missing something, so i downloaded app from ur ftp, and started following the tut, everything prtty easy to follow. Now when i get to the calculation routine, i stop on magic jmp, something like JMP [ECX *4+ XXXXX], so i set ECX to zero start incrementing it and see were jmp goes, then i comment every beggining of code snipet with the ID of jmp, thats the ECX value. Ok now i have the routine all comented with all ID (0 to 11) jmps, so i set breakpoint on each one of them and run the app, eventually it will break for example on ID jmp 9, where he AND's EAX with 0x40, so its checking Z flag, i trace until last line Z flag isnt set and EAX=1, so jmp type must JNZ. ok the same thing happens to more 2 or 3 ID jmp like the C, and 10. The problem is i run all options on the app and it never breaks on the remaining ID jmps, so i cant guess what they are. But on ur tutorial u calculated them all (keep in mind iam doing same app u did on ur tutorial), so how did u do, did u just runned all options, some hidden i cant find, or did u use other way?

dont know if u read my post donne before on page 3 of this topic so i write again.

Other thing that bothers me is this (this is not the app on ur tut):

JMP DWORD PTR DS:[ECX*4+5FFC0E] <--- Magic Jump
........
........
MOV EDX,DWORD PTR SS:[EBP+C] ; Type of jump 9
MOV EAX,DWORD PTR DS:[EDX+C0]
AND EAX,40 <-- Check Z flag
NEG EAX
SBB EAX,EAX
NEG EAX
JMP FileMoti.005FFC07 <-- Here ZF=0 AND EAX=1 so its JNZ
......
......
MOV EDX,DWORD PTR SS:[EBP+C] ; Type of jump 5
MOV EAX,DWORD PTR DS:[EDX+C0]
AND EAX,40 <-- Checks Z flag
TEST EAX,EAX
JNZ SHORT FileMoti.005FFB38 <---Here it allways jumps
MOV ECX,DWORD PTR SS:[EBP+C]
MOV EDX,DWORD PTR DS:[ECX+C0]
AND EDX,80
NEG EDX
SBB EDX,EDX
INC EDX
MOV EAX,DWORD PTR SS:[EBP+C]
MOV ECX,DWORD PTR DS:[EAX+C0]
AND ECX,800
NEG ECX
SBB ECX,ECX
INC ECX
CMP EDX,ECX
JNZ SHORT FileMoti.005FFB38
MOV DWORD PTR SS:[EBP-14],0
JMP SHORT FileMoti.005FFB3F
MOV DWORD PTR SS:[EBP-14],1 <---- Lands here
MOV AL,BYTE PTR SS:[EBP-14]
JMP FileMoti.005FFC07 <----- Here Z=0 and EAX=1 so its JNZ (again???)

So my question is is it possible to have diferent ID jmps with the same kind of jump or iam i doing something wrong?

Sry for such a long writting and post, hope u can answer me when u got the time.
Respect,
sPeC!
Ricardo Narvaja
05-03-2004, 05:20 PM
i try on the tut complete the table of jumps only for understand if i make a unpack of arma i use only the jumps utilized no more. For the operation they make with the flags in bynary i go deducing the complete table and the inverses of each jump,if i don't bad remember this go long time ago jeje.Analizing the AND in bynary in each jump you can deduce what flag are affected, but for the practical question i make a tut, you use only the jumps utilized and no more, is not necesary.

Ricardo
Spec0p
05-04-2004, 03:17 PM
thx a lot Ricardo, i will then try to fix it with only those ID's

Regars
sPeC!
BlackRose
12-21-2004, 12:41 AM
I made tuts 203-204-205-206-207 and 208 (six parts) for this nightmare armadillo with total destruction of table version 3.70 witout copymem2 but with total destruction of the table antidumps and all the parafernalia of armadillo, is really terrible ( 6 parts)

hxxp://www.ricnar456.no-ip.org/NUEVO%20CURSO/TEORIAS/

203 to 208

is a terrible experience jeje

Ricardo Narvaja

Hello Ricardo,

I'v tried to find out tutorials 203-208 but it's not possible. This link does not work and I'm not able to connect to your FTP. Can You give me actual/functional link, please? Or is possible to get these files via e-mail?

BlackRose
Ricardo Narvaja
12-21-2004, 05:45 AM
mail me to ricnar456@yahoo.com.ar and i send you the ftp user and pass and the new host.

Ricardo Narvaja
MEPHiST0
12-21-2004, 05:51 AM
ive noticed after a while armadillos features usually always seem go in order

1(a) debug blocker (if any)
1(b) copymem ? i think this order
1(c) nanomites.. not sure about this yet, havent made a fix for it
1: code splicing
2: import elimination

the import elimination tutorial by ricardo.. kinda hard to understand cause i do not understand spanish :)

but still it helped me, a friend and i were doing some research and he found some code to just redirect all the real import addresses to the destructed table.. seems to work perfectly in most cases, i havent tried the latest armadillo versions yet.
FrankRizzo
12-29-2004, 12:46 AM
I'm working with Armadillo 3.30 C.

On my system, when I try to execute the target with NO debuggers loaded, I get the "for security reasons, blah blah system debuggers.." message.

If I load up Olly, and change the 01 to a 00 in the IsDebuggerPresent step, I STILL get it. Now here's where it gets weird.. If I start Soft-Ice, and then run it, I get "Error while unpacking program, code 2. Please report to the author".

Anyone have any ideas as to why this is?
Ricardo Narvaja
12-29-2004, 07:17 AM
the new armadillos detect softice installed, if you have softice installed, parheps not run the program refuses to run.

Ollydbg is more easy to use, use hidebebugger 1.2 and the program run prefect in ollydbg,don´t use bp use hardware breakpoints and work perfect, only armadillo 4 has a special feature for protect against ollydbg is a known and documented buffer underrun, she pass to the buffer a large string for make ollydbg crash

The OutputDebugString function sends a string to the debugger for the current application.

VOID OutputDebugString(

LPCTSTR lpOutputString // pointer to string to be displayed
);

to this api is pased a large string and make ollydbg crash, but is easy intercept knowing how it work jeje.

Ricardo Narvaja
FrankRizzo
12-29-2004, 10:11 AM
OK, I DO have softice installed, do I need to rename it, or move it or something?

I downloaded hidedebugger 1.2, and used the "Detatch" option of it to "hide" olly, and I still get the "For security purposes" messagebox. Also, I have NO breakpoints set, I'm just trying to get the program to run AT ALL under olly.
naides
12-29-2004, 10:53 AM
OK, I DO have softice installed, do I need to rename it, or move it or something?

Try IceExt first. Read the instructions: IceExt does not HIDE Sice automatically, you need to explicitly type the !protect command in sice
FrankRizzo
12-29-2004, 11:57 AM
OK, I got IceExt 0.65, installed it, and did a "!protect on", and it listed all the items as "ON". Loaded olly, "detached" the debugger, and ran it. Same response.. :-\
Timbo
12-29-2004, 12:57 PM
chad always likes to play but try evals hint:

at start of ntice's INT0E handler you will meet instuction:
8164240CFFFFFEFF = AND dword[esp+0C],0FFFEFFFF
so try change byte FE to FF, which avoids RF removal.

metioned here:
http://www.woodmann.net/forum/showthread.php?t=5514
FrankRizzo
12-29-2004, 01:54 PM
I read the message you linked to, but have NO idea how to do that in Soft-Ice. Any links on how to do that? (I assume that when you edit it manually you have to adjust some sorta checksum, as I made the change in ntice.sys, and it refused to load after that).
JMI
12-29-2004, 02:12 PM
Did you perhaps notice in the thread referenced above, that at that time, ARMA was also checking the registry for the presence of IceExt????? :cry:

Regards,
FrankRizzo
12-29-2004, 02:36 PM
Yeah, thanks JMI.. I just tried that also..

Guys, I promise, I'm not a newbie idiot, I'm just having a hard time with this.
JMI
12-29-2004, 04:05 PM
THAT is what keeps it interesting. :yay: If it were all easy, no one would do it. ;)

Regards,
FrankRizzo
12-29-2004, 04:12 PM
I agree! I tend to lose interest in things that are TOO simple.. My problem with this, is that I have been "lead" so far into it, that I'm not sure where I am.
JMI
12-29-2004, 05:34 PM
As +Orc would have said: "You are in the dark codewoods." ;)

Regards,
FrankRizzo
12-29-2004, 05:44 PM
Absolutely! I'm trying to FEEL the code now, "Zen-like" as he would have also suggested, but I'm getting no where.
JMI
12-29-2004, 05:51 PM
Have you considered looking at your program in IDA and trying to find where the message is coming from and then trying to break on the part of the code which invokes this message to see what it is choking on? :idea:

Regards,
Kayaker
12-29-2004, 07:16 PM
(I assume that when you edit it manually you have to adjust some sorta checksum, as I made the change in ntice.sys, and it refused to load after that).
Hi, Yes you do have to adjust the checksum. Use LordPE. ntice.sys should load.

Kayaker
FrankRizzo
12-30-2004, 12:20 AM
Tried IDA, LOTS of trash.. Leading me to believe that I have to stop it somewhere along the way, dump it out, and THEN disassemble it.. (Is there some sorta IDA plug-in that makes this it do a better job of disassembling this?) I get VERY little code, and large blobs of data. I changed the sections from data to code that were obvious, 58, 59, and the like.. Also, I looked for strings, and the strings are either encrypted, or built on the fly..
nikolatesla20
12-30-2004, 08:58 AM
You can't open anything in arma into IDA. The code is all obfuscated. You gotta step thru it. (Unless someone has written a de-obfuscator plug in)

-nt20
crUsAdEr
12-30-2004, 01:15 PM
Tried IDA, LOTS of trash.. Leading me to believe that I have to stop it somewhere along the way, dump it out, and THEN disassemble it.. (Is there some sorta IDA plug-in that makes this it do a better job of disassembling this?) I get VERY little code, and large blobs of data. I changed the sections from data to code that were obvious, 58, 59, and the like.. Also, I looked for strings, and the strings are either encrypted, or built on the fly..

All strings in Armadillo are encrypted... but you can handle all those string decryption & code obfuscation with a simple idc script :)

As for anti debugger check... remember IceExt doesnt fix SetUnhandledExceptionFilter so you have to manuall unpatch it in sice...

Keep it simple, most of Arma tricks are mundane so just stay simple, filter 1 by 1... what error did you get?
FrankRizzo
12-30-2004, 02:21 PM
Thanks for the responses guys!

I didn't THINK that I could just simply disassemble this crap and get anywhere! (This obfuscation technique that they're using looks ALOT like the old SuperLock technique from about 15 years ago).

As for the message that I'm getting, it's the classic "For security purposes, this program will not run while system debuggers are active." message. I do have Soft-ice installed, but it is not active. (I.E. Ctrl-D does nothing). I get the same message if I load it into Olly, and fix the return value from IsDebuggerPresent. Now, the WEIRD thing is, if I enable Soft-Ice, the message changes to unpack error, or some such. I typed it in exactly a few messages back.

Now, crUsAdEr, what idc script do you speak of?
crUsAdEr
12-30-2004, 06:22 PM
Now, crUsAdEr, what idc script do you speak of?

Lol your own :)...
FrankRizzo
01-02-2005, 10:02 PM
OK, I edited the names of the Soft-Ice "services" in the registry, and cleaned up some other stuff, rebooted, and NOW it runs!

But is of the infamous "Hardware fingerprint" type of armadillo..
Nico
01-03-2005, 07:27 AM
Happy new year and i hope 2005 will be a fun year :-)

Wish you a lot of fun guys.

Nico
Spec0p
01-03-2005, 07:39 AM
Hi there Nico,
you seem to be a nice guy, i wish you a fun year also. Now that i think of it :idea: , tell me something, why dont you join the fun?? What do you say about joinning our playground and help us to fully reverse armadillo :devil: ?? There is fun enought for everyone :D .

Since we are on the matter, i wish a very good new year to everyone outhere, and i hope i can say the same thing in one year from now... :loveu: guys !
Nico
01-03-2005, 07:48 AM
Hey,

If time permits, i will try to create the fun :-)
For now, i will try to recover from booze ;-)


replacing hiew
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > replacing hiew
PDA

View Full Version : replacing hiew

whoda
05-18-2003, 06:13 AM
I don't know much about cracking, but I've been able to crack some programs using windasm finding the jump points and then changing them in hiew. I can get to the address line fast by just typing in a dot before the address that's shown in windasm, but I was wondering if there's any gui app out there that I can use instead of hiew. I tried winhex, but really didn't know how to get to the line I wanted and didn't understand it well. Any suggestions is appreicated.
Manko
05-18-2003, 06:56 AM
Hi!

You tried Squidge's RTA? :)
Not exactly what you were asking for, but it'll do the job!
(That is, if you're gonna change machine-code instructions in a exe file, using memory-addresses from sice or windasm...)

/Manko
Shoob
05-18-2003, 07:06 AM
Hex Workshop
whoda
05-18-2003, 01:20 PM
thanks for the reply. I tried Hex Workshop and it seems to be similar to winhex and I couldn't find Squidge's RTA while searching for it.
Winhex and Hex Workshop I didn't see the decode option that hview has. I found this compare list from hackman and it says that winhex has a simple decoder. I'm just looking for when I run hview and press F4 and select the decode option. here's the list I saw
http://www.technologismiki.com/hackman/info/compete.php
squidge
05-18-2003, 01:35 PM
<plug> http://www.ibiblio.org/paulc/rta/ </plug>

:)
whoda
05-18-2003, 04:15 PM
thank you all for taking time to help me I apprecate it.
got exactly what I was looking for.


ARMADILLO & NANOMITES (part 1)ENGLISH
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ARMADILLO & NANOMITES (part 1)ENGLISH
PDA

View Full Version : ARMADILLO & NANOMITES (part 1)ENGLISH

S3ri@l CoDe9x
05-18-2003, 05:26 PM
..by Ricardo Narvaja

New tutorial !! i hope that it can help u with the problem of Nanomites:o

For the persons who asked for the course they can subscribe here:

crackslatinos-subscribe@gruposyahoo.com.ar

the second part soon... :p

Best Regards! :rolleyes:
corado
05-19-2003, 01:16 AM
Does this system work, if the soft protected by Armadillo needs Username and Key to run?

Thanks
Corado
squidge
05-19-2003, 02:45 AM
No, the software needs to be running first. If the software is protected with an armadillo encryption certificate which it requires the key to run, then your not going to bypass it without some serious work (eg. finding the decryption key).

Once you have a valid username/key however, then yes, you can apply this to get rid of any nanomites.

This tut is for programs that run already, but you want to get a working unpacked version to hack.
corado
05-19-2003, 03:03 AM
Thank you Squidge for your reply!

However here is the list what I did with the Armadillo protected soft, which requires the Username & Key to run:

1. I could bypass the Username & Key screen
2. or even more I could insert the wrong Username and Key and the soft reports that the Key is Valid and has been stored in the system.
3. I could also Tranfer Key to another machine using its new fingerprint.

But the problem is, after all this operations at the final stage of unpacking programm reports - "Insufficient memory". This happens usually after the failure of HEAPALLOC function, it fails to allocate memory.

Any idea would be appreciated.

WBR
Corado
squidge
05-19-2003, 05:02 AM
I'd say the best way of dealing with this would be to attempt to unpack either manually or via an automated method such as Dillodumper. If both methods fail, then your dealing with an encryption certificate that you will need a decryption key for, so may as well forget about it.

However, if you manage to dump the program and it still asks for this username and password, then it's obviously nothing to do with armadillo, so may be able to hack around the box.

The only other way I can think of at the moment is use some kind of process dumper (eg. LordPE) and dump the child process of the armadillo'd app, and then see if the entire text section is zeroed when the username request dialog box is present. If so, then it's the unpacker process doing the dialog, else it will be the program itself.
corado
05-19-2003, 05:28 AM
squidge thank you again for your post!

Dillodumper doesn't help, it runs only with programs which do not require Username & Key to run.

But I have dumped the both SERVER and CLIENT part of the soft using memory dumper. The problem is that client part is not completely dumped I suppose. I know some key words from the target soft, when I search it in the dumped files they do not exist, but I could see some other information i.e. certificate name, registry key names etc., but not for instance the TEMPLATE itself, if this could be possible I would easily generate new key, since I know the certificate name and machine fingerprint.

One question: Is it possible to trace after executing USERNAME & KEY window the KEY string comparison routine with the valid KEY, in order to get it? I found already this CALL. Is the real KEY encrypted somehow in the programme?

WBR
Corado
squidge
05-19-2003, 07:03 AM
No, the entire secure section is encrypted with the key in that case. Attempting a bruteforce attack is also a definite no, as they are simply far too many combinations.


EIP of the program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > EIP of the program
PDA

View Full Version : EIP of the program

whoda
05-18-2003, 06:45 PM
I've been trying to search for as any ollydbg tutorials as I can and I was studying this solution and wasn't sure whta EIP means. Sorry for my ignorance here is what it said

Now work of ours must find true serial? It's simple :)
EIP of program is being 004078A4, you move above aleast and set breakpoint
at address 00407868 (begin of 1 procedure :) (Set breakpoint by F2)
next we press Shift+F9 (run over Exeception... :)

here is the full link any help is appreicated

http://www.anticrack.de/modules.php?op=modload&name=News&file=article&sid=3731&mode=&order=0&thold=0
JMI
05-18-2003, 11:15 PM
whoda:

Here's the definition:

The registers that contain the address for the current instruction
waiting to be executed are the CS:EIP registers (code segment and instruction pointer).

Translation is, I believe: The Executing Instruction
Pointer. It generally is the address in the program of the "next" instruction which will be executed by the program.

It appears that he is saying that after passing the SEH exception of the program by using "Shift+F7/F8/F9 to pass exeption to program' the next instruction to be executed would be "004078A4". I must confess the article is none too clear. Hope that helps.

Regards.
Iwarez
05-19-2003, 01:05 AM
I thought EIP was Extended Instruction Pointer. As the 'E' stands for extended also in EAX and EBX.
whoda
05-19-2003, 02:08 AM
thank you both
if it's confusing to more advance members than myself. I'll just search for a better tutorial, but thanks for the def


SERIAL FISHING Problems!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SERIAL FISHING Problems!!
PDA

View Full Version : SERIAL FISHING Problems!!

Zkhan13
05-19-2003, 01:46 AM
I tried for Serial No. ‘Fishing’ on a Word File Password Recovery Prgm Called “aw2000pr.exe" from ElcomSoft. When I put BPX on GetDlg ItemTextA DO “D esp->C”, and enter a Dummy Serial, I could see it sits neatly on top of Data Window. But I was unable to find a Real ‘CHECK’, there on wards. It really has a TEST al, 03, and then some Encryption…. that I couldn’t understand.
I found some strings in DataWindow as “MD5 Algorithm…”.Is it so hard to beat ..
Is it a special kind of protection, where I could find an unprotection technique?

OR, SOME BODY PLEASE TELL ME HOW I COULD USE SoftIce Commands
Like, “BPR” in these kinds of Situations (Serial Number Catching)….
Please Pour Your experience & Ideas.
dELTA
05-19-2003, 06:53 AM
The Elcomsoft guys are quite handy both with crypto and with coding in general, so I would seriously doubt that there would be any point in the program at which you could fish a valid serial from the memory. Judging from your post you would probably need to understand the assemlby code a bit better, rather than just using generic Softice commands, before being able to crack their products. Then disassemble it and try to understand the deadlisting, it's the only way for such better-than-trivial protections.

dELTA
comrade
05-20-2003, 05:19 PM
Do not underestimate Russian IT resources. :)
Zkhan13
05-21-2003, 06:27 AM
It is not a question of Russians or Indians....
It is a Question of Knowledge. & Ignorance...
When ignorance is Bye passed, there is no question of Russians ...INDIANS or US......
It is purely the Question of Knowledge....

I am optimistic , one day i will attain that knowledge where i could laugh on .......
newbcrk
05-29-2003, 09:12 AM
1/Use the command s 0 l ffffffff 'false code you type'
2/read the adresse that SOFTICE gives don't keep the adresse beginning by C0 or 800
3/Put a bpr with a adresse of 2/
such as bpr adresse adresse+length of your false code RW
4/Press F5 even as often as necessary and even if your windows "wronG serial appear" continue to press F5


reversing a dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > reversing a dll
PDA

View Full Version : reversing a dll

4oh4
05-19-2003, 04:42 PM
I know that we're not supposed to mention specific targets, but this isn't exactly illegal I don't think. I'm also not sure if this belongs in the advanced section, but it is programming related so....

I use Procomm Plus (symantec app) at work. It's a terminal emulator with it's own scripting language for advanced (and not so advanced) macros and such.

It has a very limited set of dialog controls that you can use, but it does let you call functions in specifically coded dll's. So I wrote a small example that lets me use a listview (which I've grown to really like recently). Everything works fine, except I'm stuck at passing data back to the script from the library. Of course, I can pass a return value back, but I mean at arbitrary times, like in response to a window message and the like.

I can use dde, but really really really don't want to cause I really really really dislike dde. I can't use window messages the normal way, since any exernal function calls have to reside in specifically coded dll's. I also can't use atoms for the same reason.

One of my coworkers pointed me to a website with (non-official) support for Aspect (the scripting language in question). I sent the webmaster an email asking what the best method for doing this would be. He promptly replied that he'd never written any custom dll's for use with Aspect, but if I wanted, he would forward my question to a friend.

His friend turns out to be one of the original developers of Aspect which is great. That guy promptly replied that he no longer works with Symantec, but does do contracting work developing custom scripting solutions. He also said that he doesn't mind answering the occasional question. However he hasn't replied back (after the 1st email) yet so I'm not sure how willing he is to answer my question. He did hint that there are a few undocumented variables for use with Aspect that can be used with one of the included libraries that allow you to create and respond to custom messages. He wasn't specific, but the exported functions in that dll are named fairly explicitly so I can narrow down those functions that sound relevant.

My question is this:

I know that if I call one or more functions within a specific library from my aspect script, I will be able to do some interprocess communication via window messages. I have no examples of doing this and there is no documentation. This is going to require a ton of trial and error if this guy doesn't provide an example snippet.

So is this something that is feasible for me to reverse engineer? ....or will I likely be spending a ton of time on this with no reasonable likelihood of accomplishing anything?

If it is feasible, are there any similar tuts or essays floating around that will be of help?

thanks,
will

(sorry for the long post)
4oh4
05-19-2003, 04:47 PM
Also, in the email from the developer guy, he stated that variable data is passed by ref to the dll functions, so I could modify that data from the dll which could be useful. However, I couldn't seem to get that to work from my dll. It might be because of my poor masm programming skills, but I'm certain that it can't be done.
squidge
05-19-2003, 06:02 PM
This may be useful for you. Take a look.
dELTA
05-19-2003, 06:34 PM
It is very hard to answer the general question if it's possible to do this in reasonable time or not. It very much depends on exactly how much knowledge you have about what these undocumented functions are supposed to do, how good you can read assemly code, how big the DLL is, how the DLL is written and so on.

My approach would be to find good "pinpointing targets" based on the knowledge I already might have about the functions. E.g. if you know that one of the functions might send a window message when called with the message number and target window handles as parameter, I would set my debugger to break on a certain message, and then try to call all functions with parameters including the number of this specific message and so on. If the debugger breaks, you can go from there. I would also start by taking a quick glance at the dead-listing of all the dll-exports in IDA, to see if there are any apparent hints. E.g. is the SendMessage/PostMessage functions referenced at many points in the DLL? If there are only a few references, you can concentrate on reversing the exported functions that contains these references, and go from there.

In any way, you can often reverse much more complex things than you initially think, if you just use some clever techniques that make the most out of your initial knowledge.

dELTA
4oh4
05-19-2003, 07:22 PM
Thanks to both of you for the quick replies!

squidge:
That example may be an alternate method that I hadn't even considered. It looks at first glance that it does pretty much exactly what I want to do, although it does it by using predefined global variables. Those variables are documented, although the techniques used in the example that you posted are not. Very nice!

delta:
I didn't have the first real intelligent clue on where to start with this whole mess, but you've definitely provided me a good zen starting point. If squidge's method doesn't get me where I need to be and that aspect guy doesn't have the time, then I'll have no real alternative then diving in head first with the real reversing.

Oh, and squidge? I didn't come across that example in my googling. Did you write that? If not, and you found it on the web, would you care to share the address? There may be other goodies.

cheers,
will

Doh! If I had read the comments then I'd know that you didn't code it.
squidge
05-20-2003, 02:46 AM
I found it on google some time ago, and so just attached it here straight from my downloads dir. Hopefully it'll help you out.
dELTA
05-20-2003, 06:17 AM
So, what is the address to your downloads dir then? :D

dELTA
squidge
05-20-2003, 07:31 AM
FILE:\\F:\www-ftp-downloads

Does not share very well across the internet though unfortunately :( :D
4oh4
05-20-2003, 11:14 AM
Well thanks for sharing.

So do you work with procomm much? The only reversing I've done so far with it is patching aspect32.dll to get rid of that damn 'are you sure you want to close with active scripts' messagebox. Then I found a script command to turn off that prompt. It was still fun though. ;)
4oh4
05-21-2003, 09:31 AM
I'd appreciate it if someone could verify my code. The aspect guy emailed me back confirming the script does pass variables byref so they can be changed in the dll.

aspecttest proc uses esi edi ecx hProcomm:DWORD,hPInstance:DWORD,varArgs:DWORD,lpBytes:DWORD,argcnt:BYTE

;the varArgs param is a far array of far pointers to arguments passed
;for this example the other params are irrelevant

mov eax,[varArgs]
mov eax,[eax + 4]
mov byte ptr[eax],'A'

;this moves the letter 'A' into the 1st byte of that string
;but when I print that string from the script after
;returning from the dll function call
;that string doesn't change

Could someone tell me what's wrong with my code?

thanks,
will
dELTA
05-21-2003, 02:47 PM
Have you verified that the pointer you pick out of the parameter array is really the right one?

Are you sure that it's a C-style string pointer? (otherwise you could e.g. be writing into the size field of a Pascal type string, or whatever)

Anyway, it should be very easy to verify in a debugger that the address you are writing to is actually inside the correct string, right?

dELTA
squidge
05-21-2003, 05:06 PM
Rather than trying to change strings via a dll, when not pass a string to the DLL and see how it is represented first? Borland's Ansistring gives you a pointer, but the first dword at the position is another pointer which gives you the actual string. Make sure your's is not the same kind of thing.
4oh4
05-21-2003, 05:15 PM
I finally figured it out. In the script's event handler code, under one button I put the dll call code, and under another button I put the code to print the variable again to show that it'd been changed. When I cut/pasted the single line that printed the variable's contents to the screen from the other button to the line immediately following the dll call it worked fine. It's really quite strange.
w00tz
06-16-2003, 10:02 AM
i think you're missing the point, i've had the similar problem with my c++ code, but i figured out that since its reference you're not modifying the actual thing because you're returning a pointer. i believe the easiest way is to declare some type of that same object but with an updated string like you're doing, instead of adding the output to the bottom of the call, that should be the easiest way.

notice that with your way, your string is still unchanged.
4oh4
06-16-2003, 04:22 PM
The reason that it wasn't working is because in the aspect script's message loop I was leaving the stack, so the contents of that variable was getting reset. Once I realized that, the script was fixed.

It does pass variables by ref to the dll, so I can just change it and return back to the script. There are also some memory functions availabe in the scripting lang, so I've been using those as well.

thanks,
will


Anti-Olly
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Anti-Olly
PDA

View Full Version : Anti-Olly

mythical
05-19-2003, 08:57 PM
I'm working with a program called Flax v1.5.
My problem:..I can not get olly to break on a breakpoint (ex. getwindowtexta ), but if I set a the breakpoint in softice it will break on it everytime.
Any Ideas?

BTW: I am new to "cracking"
ZaiRoN
05-20-2003, 10:06 AM
Hi mythical,
nice target you have found.
From what I have seen (a quick glance...), the program creates another instance of himself using CreateProcess function. The main program, the one you loaded with olly, closes himself but the new program will run normally. That is the reason why you can't put breakpoint in olly.

Regards,
ZaiRoN
mythical
05-20-2003, 02:45 PM
Thanks alot ZaiRoN,

Looks like I'll have to dothis in SoftIce
squidge
05-20-2003, 05:47 PM
Why? Force the process that's using CreateProcess to add the suspended flag to the call, and then overwrite the entry point with an infinite jump. Then allow it to continue, load up another ollydbg and attach to the new process.

Easy :)


INQUISITION IDA Pro plugin is released!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > INQUISITION IDA Pro plugin is released!
PDA

View Full Version : INQUISITION IDA Pro plugin is released!

Polaris
05-20-2003, 08:16 AM
After some weeks of hard work in understanding IDA Pro sdk, I finally managed to finish the INQUISITION Plugin.

INQUISITION is a complex plugin which will translate the assembler listing of a subroutine into it's pseudoC equivalent.

Current features:

- 1-2-1 translation for most opcodes
- Jump rebuilder

Download site:

http://polaris.kcmo.net

Byeez
ZaiRoN
05-20-2003, 09:42 AM
Hi Polaris,
thx for this nice plugin.

I tried your new plugin and I found a bug for you. The plugin seems to have problems with mul instructions. Here are the instructions I tried:
imul eax
mul eax
imul eax, edx

Another little thing; we suppose to have:
push 17h
xor ecx, ecx
pop ecx
add ebx, ecx

Your plugin shows (correctly):
( 17h );
ecx = 0;
) ecx (;
ebx = (ebx + ecx);

Is it possible to have: ebx = ebx + 17h ?
This type of substitution may be useful (even if not easy to implement I suppose...)

Thx again,
ZaiRoN
Polaris
05-21-2003, 08:09 AM
Hi there ZaiRoN,

the *mul family of instruction is still unsupported (basicly because INQUISITION analizer need to know operand's size). Don't fear.... Next release will support *mul & *div families.

Please note that the "// Please report me to the author" message means that the current ins is not supported: bug messages are really more SCARY than this! Try to find them out! ;)

For your request: recovering ebx = ebx + 17h is possible, but requires DATA FLOW analisys on the current basic block. It will be (hopely) implemented in future versions of INQUISITION.

Next features will (probably) be:
- GUI (INQUISITION sends data to a new window with save capability)
- IDIOM RECOGNIZER ENGINE/DB (Before translating, INQUISITION checks for IDIOM existence)
- Operands will be cleaned (no more 406123loc_406123) :)

However, to suggest new features/point out bugs :( just drop me a line!

Byeeez
volodya
05-28-2003, 08:23 AM
Has anyone of you guys have ever heard about Desquirr - decompilation plugin for IDA 4.3/4.5?
Polaris
05-28-2003, 03:11 PM
INQUISITION for IDA Pro 4.30 had finally have been updated :eek:

New features:
- Killed an enormous bug list
- Added the idiom recognizer engine (with 4 idiom known)
- more support for instruction (mul/imul...)

If anybody is interested, download at: http://polaris.kcmo.net

Byyezzz ;)

Polaris

Note: If anybody does know about idioms, just drop me a line: I will add soon to INQUISITION "database".
Polaris
06-11-2003, 02:23 PM
Hi there!! :D

INQUISITION v2.0 beta has been released...

INQUISITION v2.0 beta
INQUISITION has been heavily improved, by adding the
Call Decompiler Engine, for both functions & external
symbols (_dllcalls).

Now, plugin output will produce this:

; int __stdcall sub_401203(int nWidth,int nHeight)
sub_401203 proc near ; CODE XREF: sub_401C74+137p

nWidth = dword ptr 4
nHeight = dword ptr 8

push 1 ; bErase
mov eax, hWnd
push 0 ; lpRect
push eax ; hWnd
call ds:InvalidateRect
push 1 ; bRepaint
push [esp+4+nHeight] ; nHeight
push [esp+8+nWidth] ; nWidth
push 0 ; Y
push 0 ; X
push hWnd ; hWnd
call ds:MoveWindow
retn 8

sub_401203 endp

/**
* This is the translated output for subroutine sub_401203
* Generated AUTOMATICALLY by the INQUISITION plugin by Polaris
*/

sub_401203:
eax = hWnd;
ds:004064E8InvalidateRect(eax,0,1);
ds:004064ECMoveWindow(hWnd,0,0,[esp+8+nWidth],
[esp+4+nHeight],1);
return;

I hope you will like it!!!

News:
- INQUISITION decompiles correctly nested call statements,
by stack emulation
- Now you don't have to go to function's first instruction,
just invoke INQUISITION anywhere inside the sub :)
- Idiom engine has been updated. Some idioms were
taken from David Eriksson's thesis on decompilation
(desquirr Master Thesis). Thanks David!
- Another horde of bugs was corrected.

As ever, download site at: http://polaris.kcmo.net

Byeeezzz

Polaris
gordon_freeman
06-16-2003, 10:06 AM
Hi Polaris,

I've tried you plugin and it seems that it does not handle 'if then else'.

As an example take this code (from Qt 3.1.2 trial) :

39D1F267 cmp word_3A200B2C, 0
39D1F26E jnz short loc_39D1F27A
39D1F270 mov dword_3A200B2C, 3C25h

39D1F27A loc_39D1F27A:

39D1F27A mov eax, dword_3A200B2C

this can be translated to :
if (dword_3A200B2C ==0) dword_3A200B2C = 0x3C25;

The plugin output is :

if( dword_3A200B2C != 0 ) goto loc_39D1F27A;
dword_3A200B2C = 3C25h;
loc_39D1F27A:
eax = dword_3A200B2C;

bravo and good luck.
Polaris
06-16-2003, 11:17 AM
Hi there!

I am sorry, but INQUISITION is not intended to perform control flow analisys. What it does is backward analisys for CC killing. I think that you should re-structure assembler by hand.

But maybe in the future... :)

Byeeezzzz


interesting target(s)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > interesting target(s)?
PDA

View Full Version : interesting target(s)?

Rackmount
05-20-2003, 05:03 PM
I have been toying with a couple of proggies that have a bunch of embeded protections that could interest a few of the "newbies" in here. To start, they will all default to demo versions with the option to enable being presented on run (ok this doesn't sound interesting..I know). What is interesting is that the proggies can be enabled by a variety of options...password, hardware lock, or network lock. Another wonderful feature of the developer is that they will give you a temp password to enable these proggies for a limited time. The main protection is disabled menu function. You cannot save or print in demo mode. The programs are gui interfaces to fortran modules (these are all freeware and are not really of importance to our study). In the enable screen we see that all modules are initially listed as "disabled" with some or all changing to "enabled" depending on your level of access. The hardware protection is sentinel (imagine that...lol) as is the network protection. I have followed through a few versions and noted a few improvements by the authors on the protection schemes (gone are the messageboxes and messagebeeps that used to yell at you when you tried to save or print in demo mode). The password option brings up an enable screen which presents you with a unique identifier (based on comp hardware most likely). Serial fishing is not an option as the actual password check routine seems to be well coded (oh...perhaps we shouldn't go there...there is a connection to DoD and we DONT want to break their codes eh? (secondary note: the DoD is most likely the old fortran proggies)) So to make a long story short, I have approached this from the point of menu reversing...who care if its demo if I can save and print right? For menu reversing, my favorite BP in SICE is courtesy of +Spath:

bpx Enablemenuitem if((@(ss:(esp+0c))&1)==1)

Gotta love that one! So, unfortunately at this point after all the hard work they put into their protection I found that I could change a push 01 to push 00 and re-enable the two functions in one of the proggies (this no longer works in current version...ah an old dog learns new tricks) For the others, I was following the initial splash dialog to see what triggered it to know that I wasn't enabled..this led to other interesting places. So to summarize, in each one of the proggies we have :
1) Splash screen
2) Disabled menus
3) Password protections
4) Time restrictions (password can enable for varying periods)
5) Hardware protections (time restrictions again here)
6) Network protections (again time restrictions)

A downside to these programs are their size, most are larger than what newbies like to deal with as the disassembly can take a bit of time even on fast machines, but as the old ones used to say...take the opportunity to have a nice sip of your fav bevvie as you wait...eh?

If nothing else is gained by this rather long babbling...take to heart the above breakpoint as it is wonderful in menu reversing. As for the identities of the proggies...I would bet if you searched for hydraulic modeling software and watershed you would in turn know the answer.

Until my next ramble,

Rackmount
dELTA
05-21-2003, 05:52 AM
No more smiley. :)

(You can edit your own posts to fix that)

dELTA
JMI
05-22-2003, 11:40 AM
This Thread was inadvertantly deleted and now it's restored.

Regards.
Rackmount
05-22-2003, 01:12 PM
I have noticed in one of these targets that deals with groundwater...durring the password check routine there is an area where we can change a conditional jump to always jump. The results are a bit strange...The jump is to set two flags, one to zero the other to 1. Once this is patched, some of the modules will be enabled regardless of the password you enter (empty will not get this far) however, which modules are enabled will change periodically. No permanent flag is set, so each time the proggie starts it will say...Hey buddy, you need to enable this in order to play (or something of a similar nature...eh) So as you enter the password and hit enable, it is a toss of the dice to see what modules become enabled. Without restarting, you can reset by simply choosing to go from normal mode back to demo mode. Now, I wonder...the same flags are set, but the enabled modules keep changing...seems like the path traveled is not carved in stone? This occurs even if you repeat the same password entry, as my first thought was that I had inadvertantly gotton some part of the password correct such as the string length or beginning character(s). My second thought is that this behavior could be due to the flag variable being stored in something similar to ebx+117 rather than a fixed address (ie. ebx can be different depending on how we get to this point).

Enough said, one of these days I need to really take the time to follow this password routine completely to understand fully rather than just poking needles into it to see how it twitches. (I have always loved the voodoo approach...) Combine voodoo with zen and then add some actual knowledge...wow!

Cya

Rackmount


Armadillo & nanomites (2º part) english
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo & nanomites (2º part) english
PDA

View Full Version : Armadillo & nanomites (2º part) english

S3ri@l CoDe9x
05-20-2003, 05:36 PM
..by Ricardo Narvaja

.. Hi all! :p Ook .. The second part is here :D!!

Tnkx Narvaja! ;) ...

Best Regards! :rolleyes:
diz
05-20-2003, 07:33 PM
Please remove regional and special chars from file inside archive. After extracting doc file it is not possible to open nor delete it. I think, now I am forced to run DOS with NTFSPRO to rename the file (hate to do this ;))
crUsAdEr
05-20-2003, 07:57 PM
Hi Ricardo,

Well done on the tutorial :)... explained to details... i am really busy nowadays so only had a brief look through... hope these comments are constructive :)...

1. I think there can be quite a few long jumps in other programs, so we should try to automate patching long jump as well instead of doing manually...

2. The patch code seems a bit too long isnt it? I have not used Olly extensively to be honest but i feel that coding a short asm program to patch and fix nanomites gives you something to keep and recycle instead of typing out the patch code on the fly each time you unpack a new proggy... of course you dont have to dump Tables when you patch on the fly but then again you can code some simple search to find those nanomites table in memory anyway...

3. This is just a personal opinion :)... but i hate reading stuff on Word doc... the images sometimes does not display properly.. and gosh it is so slow.. so maybe try to convert to PDF or HTML so i dont have to run M$ Word all the time...

cheers,
keep up the good work and i hope to see more of your tuts :)
crUsAdEr
Ricardo Narvaja
05-20-2003, 08:34 PM
One opinion of a master how you, is a very especial for me.

The inject of the armadillo is a first aproach of an idea , i think how a first aproach, and i think a program based on this and better is possibly, but i try explain a first aproach and in crackslatinos our mail list there are very good programmers and any can be a program with this idea and better sure.
Ths long jumps are a bit trouble if you have and enter in a table 1 and say for example 00 00 ff EB, this can be a long jump or a CC in a middle of a instruccion how

MOV eax, [ebp+CC]

and is very difficult for my recognize the difference in a program the two cases has a value in table 1 and can be similar, if a CC are in a middle of an instruccion the value on a table one is a trash value and is not a nanomite, and can be confused with a long jump in a real nanomite, for this reason in this first aproach i try a conservative inject to help with a hard work, but this can be better in a future with the study of others armadillos.

For the inject i noy type the code, i have the code in a program and BINARY COPY, and BYNARY PASTE to the new project and change the necesary constants.
I'm not a genius in this, i'm a medium cracker with much faults and questions too, but i work hard in my mail list to try to resolve with my limited knowledge and my tuts are 66 in old curse and 78 in a new curse, i am a hard worker and continue working for my mail list.

Ricardo Narvaja
crUsAdEr
05-20-2003, 08:57 PM
Ah, I see... I remember this thread here where eSn-min posted a fix for the problem of fake entries though i had not tested it admittedly... do take a look to see it would help resolving the long jump prob...

http://www.woodmann.net/forum/showthread.php?s=&threadid=4611

For the inject i noy type the code, i have the code in a program and BINARY COPY, and BYNARY PASTE to the new project and change the necesary constants.

I see you are pretty in much in love with Olly :)... it is a nice tool anyway, prolly the best ring-3 debugger... though honestly IDA Pro would help you a great deal :)...

Finally... you should reverse Dillo Dumper and Armpa, the best way round all this protection is actually inline patching protector... it eliminates need to fix nanomite, loader check etc... gl0bal has done a pretty good job on this with his tools already... if i ever have time i will document all this and publish it though i cant claim much credits as much ideas were given to me by gl0bal...

Cheers,
crUsAdEr
Ricardo Narvaja
05-20-2003, 09:37 PM
Well an error in my post, the table 1 have the position of nanomites, table 3 have the distance of the jumps , in table 1 are fakes nanomites, and the distance can be similar to the real long jump nanomites.
Thanks for the idea i download the esmin patch and study this for better patch.
The online patching i not try, but not are checksums and the code can be injected-modified perfectly is other way i study thanks.

A very thanks
Cheers
Ricardo
JMI
05-21-2003, 01:02 AM
Ricardo Narvaja:

I deleted your partial duplicate post and am simply advising you, and anyone else this may happen to, what to do if it happens to you. If you make an error and want to remove one of your own posts, you just press the "edit" button, then look at the very top of edit window. There you will see a checkbox to "delete" your post. This will let you delete a partial post, a post that gets posted before you are finished, or a double post when the "submit reply" button is hit more than once.

Or you can simply "fix" anything you want and add or delete only part of the post. This is just for everyone's general knowledge who is not familiar with how vBulletin works.

Good job on the tuts. Keep them coming.

Regards.
Lunar_Dust
05-23-2003, 12:28 PM
Inline patch sounds like a great idea, this will work very well ..

Once a program is dumped with dillodumper (or other new tools :D ) you can study its code to find out how to "register" it.

Then can make dillo loader hook in and apply these inline patches...good concept, I will experiment with this. No more needing to defeat nanomites :)

-[Lunar_Dust]
qdlsy
08-25-2003, 04:19 AM
The file is bad,Please check it.
Ricardo Narvaja
08-25-2003, 04:42 AM
Download this and the continuation os the saga, till armadillo 3.10 ...

in my FTP

write me to ricnar22@millic.com.ar

and i send the direction.

Ricardo


New VBOX 4.6.2 tutorial..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New VBOX 4.6.2 tutorial..
PDA

View Full Version : New VBOX 4.6.2 tutorial..

nikolatesla20
05-21-2003, 09:56 PM
[Lunar_Dust] passed this tutorial on to me today - not too many VBOX tutorials out there that are up to date, so maybe some will find this useful.... :)

Nice tho that it uses OllyDbg, seems that debugger is really becoming the focus around here lately :)

I've uploaded it to my web space on behalf of Lunar_Dust, since the file is too big to post. (It's 500K)

hxxp://webpages.charter.net/nikolatesla20/FreeHandMXVBox.zip

Hope someone finds it useful / entertaining!

-nt20
codeinject
05-21-2003, 11:03 PM
maybe use OD fix IAT is more rapid.
Lunar_Dust
05-21-2003, 11:19 PM
I'm thinking of also making a tool to make IAT rebuild more automated, after already dumping the VBOX file.

I know VBOX isn't very "popular" of a packer for unpacker authors to look at, but no tools exist for this packer yet that I see yet..so it interests me very much.

-[Lunar_Dust]


Who will help the commander of the ESS Stargoose?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Who will help the commander of the ESS Stargoose?
PDA

View Full Version : Who will help the commander of the ESS Stargoose?

mythical
05-21-2003, 10:52 PM
I am currently working on a crackme and I have to find the HOTKEY in order to "crack it".

My question is what does getkeynametexta do????...and is this a good starting point?

btw....I'm a newbie
ZaiRoN
05-22-2003, 04:08 AM
Hi,

getkeynametext: I have never used this function before, but I have read on the documentation that is used in order to retrieve a string that represents the name of the key.
Maybe, it's not the function you need in order to solve your crackme. You would have to try to identify when and where the crackme defines the key; RegisterHotKey may be a good starting point because it defines an hotkey.

Can you attach the crackme? It may be the best way to help you :-)

Ciao,
ZaiRoN
mythical
05-22-2003, 12:47 PM
Thanks for the help, here is the target file. I would get like to get started in the right direction.I could not attach the .nfo files because it said the file was then too big to be posted, the current file size is 159kb
ZaiRoN
05-22-2003, 01:02 PM
Hi,

I moved the thread, now, another mini project can begin :-).
It seems to be a very unusual crackme :-)
I could not attach the .nfo files Can you post the rules and/or what we have to do in order to solve the crackme?

Thx,
ZaiRoN
mythical
05-22-2003, 01:08 PM
This is what all that was included in the crackme.It's a text file I left the nfo out cause all it is it a text pic of his name "Marchare".Any way here is the story and rules.

MarchHaRe's 2nd crackme ..

Storyline:
You are the commander of the ESS Stargoose and flying
through space as you suddenly realize you forgot how
to activate the worm-hole device which could open
up a "tunnel" for you to escape to another world ...

Hint: You only have a few tries before the worm-hole devices destroyes itself

Your Mission:
Find the key to open the wormhole and send the solution
and how ya got to it to:
marchhare@woodydrn.com

Bruteforcing it by pressing all keys does not count as a solution ;-)
ZaiRoN
05-23-2003, 09:36 AM
Hi, I have to find the HOTKEY in order to "crack it".Hotkey, are you sure? Seems like the program wants only a sequence of simple keys to be pressed.

I don't passed too much time on this target but (maybe) these informations will help you. The program is written in delphi and Dede is the tool that will help us. This is a amazing tool, it will help you to easily identify the way for the final goal.
Load the crackme and take a look at the 'Forms' section. In this section you will find all the info related to tForm1 class (the main window of the crackme). In particular, you can see all the procedures called by the crackme:

OnClose = FormClose ; called when the window is closed
OnCreate = FormCreate ; called when the window is created
OnDestroy = FormDestroy ; called when the window is destroyed
OnKeyDown = FormKeyDown ; called when a key is pressed
OnPaint = FormPaint ; called when the window is redrawed
OnResize = FormResize ; called when the window is resized

Due to the fact that we need to find a sequence of keys, OnKeyDown seems to be the procedures we are looking for.
Ok, you go on the procedures section, where you can find all the procedures, and double click on OnKeyDown. You have all the code of the procedure in front of you.

Now, I suggest you to use your preferred debugger and try to understand what will happen when a key is pressed :-)

Regards,
ZaiRoN
mythical
05-24-2003, 01:37 AM
I trted the method, and ran it in Olly and found a referance to "K"
and then soon got lost in the code.I will keep trying and thanks for the help.
Manko
05-24-2003, 01:20 PM
Hi!

No need to go beyond the RET of this proc...
Also, what you had found is good, but not enough...

You might have gotten stuck or lost, but it is not that difficult, so don't dig too deep. On the other hand, maybe you have already solved this?

/Manko
mythical
05-24-2003, 11:34 PM
I have found that I have to press K in order to even goto the check. So I press "K" .After that I get lost but have figured away to make BL=02 an by just pressing "K" I will goto the wormhole.
Here is how..

0043C46C 55 push ebp
0043C46D 8BEC mov ebp, esp
0043C46F 53 push ebx
0043C470 56 push esi
0043C471 8BF1 mov esi, ecx --move ecx wich is "k" to ESI
0043C473 8B5D08 mov ebx, [ebp+$08]

* Reference to Form1
|
0043C476 A114F04300 mov eax, dword ptr [$43F014]

* Reference to field Form1.OFFS_000C
|
0043C47B 8B400C mov eax, [eax+$0C]

* Reference to GlobalVar_0043F020
|
0043C47E A320F04300 mov dword ptr [$43F020], eax --move the number of times I have pressed a key to EAX
0043C483 833D20F0430005 cmp dword ptr [$43F020], +$05 -- Have I pressed 5 keys?
0043C48A 750C jnz 0043C498 -- If so End Process, End Program
0043C48C C60534F0430001 mov byte ptr [$43F034], $01

|
0043C493 E84872FCFF call 004036E0
0043C498 66833E4B cmp word ptr [esi], +$4B -- Compare the key I pressed to "K"
0043C49C 751A jnz 0043C4B8 -- If so do not jump
0043C49E F6C301 test bl, $01 -- change this to "mov BL,02"
0043C4A1 7415 jz 0043C4B8 --"NOP" this
0043C4A3 F6C302 test bl, $02
0043C4A6 7410 jz 0043C4B8
0043C4A8 803D2CF0430000 cmp byte ptr [$43F02C], $00
0043C4AF 7507 jnz 0043C4B8
0043C4B1 C6052CF0430001 mov byte ptr [$43F02C], $01
0043C4B8 FF0520F04300 inc dword ptr [$43F020]

* Reference to Form1
|
0043C4BE A114F04300 mov eax, dword ptr [$43F014]
0043C4C3 8B1520F04300 mov edx, [$43F020]

* Reference to field Form1.OFFS_000C
|
0043C4C9 89500C mov [eax+$0C], edx
0043C4CC 5E pop esi
0043C4CD 5B pop ebx
0043C4CE 5D pop ebp
0043C4CF C204 ret $04

if some one can find out where BL is changed in the code it would be of some help..But this way works.

Thanks for everyones help.
ZaiRoN
05-25-2003, 07:49 AM
Hi,

You have solved the crackme, well done! But, we can solve the crackme without patching :-)

This is the syntax of FormKeyDown function: TForm1.FormKeyDown(Sender: TObject; var Key: Word; Shift: TShiftState);
we are interested in the last two parameters:
- Key, the key that is been pressed
- Shift, it can take many values but the more interesting are: ssShift, ssAlt and ssCtrl.
where BL is changed in the codeThe value of bl is related to 'shift' parameter, in particular you have:
bl = 1 if shift is pressed (ssShift)
bl = 2 if alt is pressed (ssAlt)
bl = 3 if shift+alt is pressed
bl = 4 if ctrl is pressed (ssCtrl)
bl = 5 if shift+ctrl is pressed
and so on...

We have to pass these two checks:

CODE:0043C49E test bl, 1 ; checks if the first bit of bl is setted
CODE:0043C4A1 jz short loc_43C4B8 ; jump if it's not setted
CODE:0043C4A3 test bl, 2 ; checks if the second bit of bl is setted
CODE:0043C4A6 jz short loc_43C4B8 ; jump if it's not setted

The 'test' instruction performs a logical 'and' between the two operands, so, bl must have both first and second bit setted to 1: bl=00000011=03. If bl=03 and 'k' is pressed the crackme is solved :-)

ZaiRoN


Win32 PE File - GUI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Win32 PE File - GUI
PDA

View Full Version : Win32 PE File - GUI

whoda
05-22-2003, 04:22 PM
I was trying to change the jump points in WaveStation 3.0. I always thought that if I could see the strings in dasm that there wasn't a packer on it. I used PEiDentifier v0.8 (is this the best?) and it said it was Win32 PE File - GUI.

I tried to change the jump points, but when I run it I get an error "unable to initialize audio device". It doesn't matter what jump point I change I'll get this message. So I'm guessing it's the packer? How would I go about unpacking it? As I tired a few utilities and none of them worked and gave me an error about opening the file.
Manko
05-22-2003, 04:35 PM
Hi!

I doubt very much it is packed. It sounds more like the program is checksummed (crc) so if you change ANYTHING it will complain. :P

The message you get is a trick. Or a trick causes it... hrm... :)

(btw, PeID doesn't show all packers... not that I think it matters here...)

/Manko
whoda
05-22-2003, 07:31 PM
thanks for the help. Is there a better utility other than PeID?

Also is the trigger going because I'm changing the wrong jump point or if I change anything? I've tried about 8 or more different locations and I keep getting the same results.

Also I tried to run the program with ollydbg and it would never come up when pressing F9. That's why I thought it could be a packer

thanks again
mythical
05-25-2003, 12:52 AM
It may not run in Olly if id .debuggerpresent is in the api
Manko
05-25-2003, 09:57 AM
Hi, whoda!

Better util? Nah, dunno. It's probably more a matter of them complementing each other... Or something like that...

If it's a checksum, it'll go off no matter what you change. You need to find and disable it, before you can patch other stuff. :)

You might set memory-breakpoints on the stuff you tried to patch, and when they break, you will have found part of the checksum, if we are lucky... You need to do some work with IDA to map out the checksumming...

As said, olly could be detected... Doesn't have to be packed for that... :)

btw, olly normally tells you if the file is packed... Dunno if it uses some statistical analysis or whatever... hmm... I'm guessing it didn't say it was packed?

/Manko
dELTA
05-25-2003, 04:57 PM
According to some own experiments, Olly's "packed file" detection seems to be very simple. If the entrypoint is not in the first code section, it assumes it is packed (and tells you this in a box), otherwise (i.e. if the entrypoint is in the first code section) it assumes that the file is non-packed. So don't depend on it too much.

dELTA


about dillodumper...2.5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > about dillodumper...2.5
PDA

View Full Version : about dillodumper...2.5

hrco
05-23-2003, 08:15 AM
I try and works on 2.85 but when I try on higher version whit dillodumper 2.5 then I get message
Attempting dump, please be patient...
OEP : 4A300Ch
Program dumped...
Header fixed..
Dump Successfully fixed !
Building IAT....
WAITING HERE FOR IMPORT REBUILDING
You may rebuild the imports with ImpREC.
The process ID is 298h
Import table is at: CD000h
Trim bad thunks off the end of the table by 'delete thunks'
Press any key when done to exit

Then I do like sw say...finde process whit ID 298, finde thunks for delete, press any key...I get some dump but not working....
Have any body solution for this...thanx!
Lunar_Dust
05-23-2003, 09:31 AM
Your message is pretty cryptic. From what I understand you dumped fine (it seems) and you rebuilt the IAT with ImpREC right? I possible that the program has nanomites ? If you could give me a better description of the actual error, that would be good. Any type of exception 0x80000003 is a nanomite (DilloDumper doesn't fix those for you )

ONE very important point to remember is if you use ImpREC to fix the dump, you HAVE to correct the OEP that ImpREC reports before doing so, or it pastes the wrong OEP in on you, behind your back. Take your fixed dump and make sure it's OEP is actually correct (use LordPE or PEditor to check it). It should be what DilloDumper reports the OEP as (minus ImageBase).

DD 2.5, I've found, still has a few small bugs which I haven't resolved yet as well. Remember DilloDump is only a tool, not a full unpacker, so it can't do everything for you....

Feel free to PM me about which program it is so I can double check for you. Always good to test another target.

-[unar_Dust]
hrco
05-24-2003, 02:39 PM
Mail me...
hrco007@yahoo.com
hobferret
05-24-2003, 03:56 PM
Yo Hrco & Lunar_Dust

Had something similar the other day:(

Turned out to be a prob with the exit thread:rolleyes:

It may help but you are not giving a decent discription of your problem:mad:

Give more info to receive more info OK

/hobferret

S3ri@l CoDe9x
BTW S3ri@l CoDe9x if you are in Mexico why do you want things in English????????
JMI
05-24-2003, 04:22 PM
hobferret:

S3ri@l CoDe9x doesn't "want" things in English, he's getting them translated for those who can not understand Spanish.

Regards.
hrco
05-25-2003, 03:03 AM
I don't know much about cracking arm, I just trying,.....and I read on the internet about this thing on internet and try to experiment!
So I know hot to set my fingerprint if I have one working finger print and working key, but rebuilding dump or other thing only whit shooting in dust!
So after milion time I never get working exe whit rebuilding dump...I try all solution but nevere get working exe.....
So I try to finde process whit ID which give me dillodumper!But other thing I don't explain becouse I don't know!
Oki I check OEP is right...other thing pleas explain!

Thanx!
nikolatesla20
05-25-2003, 07:36 AM
I don't want to sound heartless, but if you don't know much about unpacking...then you shouldn't be using DilloDumper...it still requires some expertise to be used effectively. My advice is to start on some easier targets to learn how to unpack first....

On the other hand, maybe it would be good for Lunar_Dust to at least demonstrate how to use ImpREC correctly with DilloDumper.

I also know of a bug in DilloDumper, where sometimes when it's finished, the protected app has exited - so when you try to find it's process, it's not there (instead of going into an infinite loop like it should). Lunar_Dust hasn't gotten around to tracking down why it does that, however. I was told that it wasn't the protection doing it, it was simply a bug in DilloDumper code, but he hasn't tracked the issue down yet, and was not planning on doing a fix release for it at this time.

-nt20
squidge
05-25-2003, 09:31 AM
I've had the same thing happen when unpacking Armadillo'd applications using Ollydbg. Sometimes the protected app exits before you can grab the import table with Imprec. It seems the reason for this is because the child process (the protected program) generates an unhandled exception, and so gets terminated by the master (Armadillo). This doesn't happen everytime however, so it's quite difficult to find out why.

In my experience, this has always been an access violation, although I don't know if this is the same kind of problem that Dillodumper has, as I don't know how the dumper works.
diz
05-25-2003, 10:48 AM
The 2.34 version does not have this bug.
Of course it does not support as new versions as 2.5 but it's worth a try if 2.5 can't put target in loop.
Current version of eStop seems to have this problem with 2.5 while doing well with 2.34.
squidge
05-25-2003, 11:33 AM
I seem to remember Estop being the perfect target for nanomites, so I wonder if this is the problem?
hobferret
05-25-2003, 12:36 PM
hrco - ¡Yo lo siento!:)

OK so you live in México, I could not at first understand. I have seen your posts referring to Ricards Narvaja and his work, and yes you are trying to get things put into English!

My mistake! I did translate 1 of them for you!

May I suggest that as nikolatesla20 says and try simple things first - or - use the tut by Ricards Narvaja on Armadillo. At least by doing that you will have more understanding of Armadillo and it's redirected IAT. There are usually around 6 of them which are a tad difficult to resolve, but keep at it ang you will learn.

Remember you will need XP to do it on

/hobferret
squidge
05-25-2003, 01:32 PM
If your going to play with Armadillo, I'd suggest you look at 2.85 first, before progressing onto 3.01a, and it's much easier to examine and play around with. Later versions of Armadillo have more encrypted code and SEH-based functions. Also, I've noticed that with each version of Arma, there are more and more redirected functions.
Lunar_Dust
05-25-2003, 03:02 PM
The reason version 2.5 doesn't work correct all the time is a nt20 said, it sometimes exits instead of putting in the infinite loop. I haven't tracked the real problem down yet. I can say that the the cause however is due to my adding more "protection" to my dumper to prevent its easy reversal. I added a little more protections to the end of the dumping process, and I know the one of these seems to be unstable on some arma'd programs, but I haven't found why yet. I didn't catch it at first because it worked correct on most of my test targets, then I started noticing it. It could be due to an access violation in the long run but as I said I have not investigated in detail, since the majority of larger targets I tested seemed to work. At the time it seemed to only fail on very small target files.

Nanomites are not the cause of the bug - like I said , after I added my new idea, I started noticing problems, but it was too late. I guess I need better QA next time.

Try unpacking the program a few times, it might work - seems it may be a timing issue.

-[Lunar_Dust]
hrco
05-26-2003, 03:10 AM
Thanx for many replay's....so...
As I write...I test dillodumper 2.3 and 2.5 on ARM v2.85 and working perfect, but the problem is on new version...!
And quastion is can I remove ARM protection for example version 3.01a whit dillodumper and Imprec....????
If not whit which one sw I can?
About trying, I try million times to unpack and in mosut casses I get this error....
Attempting dump, please be patient...
OEP : 4A300Ch
Program dumped...
Header fixed..
Dump Successfully fixed !
Building IAT....
WAITING HERE FOR IMPORT REBUILDING
You may rebuild the imports with ImpREC.
The process ID is 298h
Import table is at: CD000h
Trim bad thunks off the end of the table by 'delete thunks'
Press any key when done to exit
So can I rebuild tabele in imprec or I need only delet thunks and dillodumper do rest?
Little confusion in my head...!
Thanx....
P.S.
If you have any easest sw for unpacking ARM pleas tell me so I can try...
Lunar_Dust
05-26-2003, 09:48 AM
DilloDumper 2.5 will dump Arma 3.01a apps no problem, except as I said before, sometimes the program exits, it's a bug in my dumper code.

You rebuild the imports using ImpREC only. DilloDumper only guesses at their location, and disables their redirection, so basically in ImpREC all you need to do is find where they are, and clean any bad thunks off the beginning and end of the table, if there are any. Then you simply change the OEP in ImpREC to the correct OEP of the program, and press "Fix DUmp", and select the dumped file that DilloDumper has just made.

I've included a small tutorial..

-[Lunar_Dust]
Paul333
05-26-2003, 10:13 AM
Thanks for fine tut Lunar_dust..Ill certainly give it a go

Thanks again for dillodumper tool :)

paul333
hrco
05-26-2003, 08:03 PM
Lunar plase mail me on hrco007@yahoo.com
hrco
05-27-2003, 08:35 AM
When I change oep in right one which I get from dillodumper, and press....IAT Autosearch...get this message...

Could not finde anything good at this OEP!:-(
So what I can do....
??
Lunar_Dust
05-27-2003, 09:13 AM
You don't need to to IAT autosearch. Just type in the IAT address that DilloDumper gives you directly. Then you press "Get Imports" just at the tutorial says. The only reason to type in the OEP is to make sure the dump doesnt get screwed when you "Fix Dump".

In the case that this number that DilloDumper gives you doesn't work, and ALSO the IAT autosearch won't work, then you will have to find the IAT on your own, and that I'm afraid, is when you will need unpacking experience to get the job done. There's no other way around that.

-[Lunar_Dust]
hrco
05-27-2003, 09:18 AM
I will try...can you mali me...becouse I send you mail by link which you give as on tutorial but...mali is returned..as error!
Thanx....
hrco
05-27-2003, 09:49 AM
JEAHHH...
Great........ufff...
When I get imports...(at adress which give me dillodumper CD000) I get 45 unresolved pinters....I try all option...delet thunks...all 45 ...only at the end....but nor result!
After this I press fix dump...and pick dumped file which is creat dillodumper...and after this coles imprec, peass any key on dillodumper...and try to start dumped_.exe which is create by imerec ....
Get same error...?
Where I'm wrong:(?
Lunar_Dust
05-27-2003, 09:51 AM
lunardust20@
yahoo.com

if you can get screenshots it would be better as well, or even target name.

-Lunar
sarge
06-05-2003, 12:22 PM
Here's my error:

Loading victim process..
Examining .....
Executing...
Preparing....
Starting normally
Scanning....Please wait..
Acquired...
Syncing .....
Attempting dump, please be patient...
OEP : 401AD0h
Program dumped...
Header fixed..
Dump Successfully fixed !
Building IAT....
ERROR 4444

I have to Control_C to exit.

The new program "Dumped.exe" is created, but won't run, which is kinda what you would expect.

I've looked at a number of tuts on dillodump, but have not seen any that list errors. Is there one, and I have missed it?

Do you need more details? I'm not afraid to do the work, I just need a bit of direction. Also, I will Email you any details you feel are not proper to present is this public forum.

Thanks
Sarge
Lunar_Dust
06-06-2003, 07:19 AM
Well, the "dumped.exe" will definitely not run at all until you rebuild the imports, and like I've said, D Dumper does not do this automatically any more, you have to use ImpREC. ALso, if the program has nanomites you are still screwed.

Error messages do exist in DilloDumper, I chose to use only random codes to keep prying eyes from knowing what is going on too much.

I have found the error you refer to in the code, it is in the IAT fixer area. The dumped.exe will still be fine, and you should still be able to rebuild the IAT if you look for it. Send me an email if you need more details. The error message you see is when DilloDumper scans the IAT to remove bad thunks between DLL's that the new Armadillo puts in. It should be backwards compatible with older versions as well, but I don't know why it isn't working for you.

-Lunar
sarge
06-06-2003, 11:58 AM
I was hesitant to rebuild since DildoDumper never gave me the go-ahead, having hit the error.

I'll email you tonight with the details.

Thanks for your response.

Sarge
sarge
06-06-2003, 09:47 PM
LunarDust, please check your private messages.
Thanks
Sarge
donneraza
06-07-2003, 11:53 AM
Hello,
Some advices on unpacking an arma-protected progr.
I've learned all of Ricardo 's tutorial ( thanks a lot for your good job sir!).
I try to apply it on another sample (a demo prog from ://www.photomodeler.com ).
1 - Break point on WriteProcessMemory :
BytesToWrites = 2 ( very very different from 1000 )
Adress & Buffer seem OK
2 - Perhaps,It is the same case of eStop in the 71- .. nanomites lesson, i wondered .
( I' ve the 2 process runing )
So I search for binary string 03000080 - But no string found.

What kind of protect is applied on this one ?

3 - Applying dillodumper 2.3 on the prog. ( The progr. displays that "It needs a key" ).
And continue dumping. Launching Dumped.exe prog it run but only to display that it need a key
and exit. Mrs Lunar, is it possible that a demo prog. that work normaly without key in it
original version modify its behavoir in its dumped version Or Is it possible that the father
process hold the key ?

Thanks for your reply !
squidge
06-07-2003, 12:10 PM
A 2 byte write is just the Armadillo father process placing an infiinite loop into the child, before setting up it's internal structures and doing another 2 byte write to remove the infinite loop to allow the child to continue.

If you keep on searching, you'll notice the second 2 byte write. If it's protected by CopyMem-II, then you'll get 1000 byte writes shortly afterwards (the first at OEP). If you get none, then it's just Debug Blocker protection, which I don't think can be unpacked with dillodumper (but very easy to do manually).
donneraza
06-08-2003, 09:42 AM
Thank squidge for the explanation of the 2 bytes writes.
But I have only 2 calls to WriteProcessoryMemory.
Then I've a lot of one byte line code like:
A1Cxx1 C7
A1Cxx2 45
A1Cxx3 FC
A1Cxx4 00
and so on.
And after a lot of shift-F9 on Olly , to force the program to by pass the exption break , the program run. No call to the
third WriteProcessMemory.

What is a matter ?
nikolatesla20
06-08-2003, 12:44 PM
All you have to do is run the program and then:

1. Look in your list of processes. Are there two intances of the program listed? If so, it is copymem protected.

2. Fire up LordPE or ProcDump and try to dump the program from memory. Do you get a message about not being able to grab process memory? If so, it's protected with Copymem.

IF the program isn't protected with CopyMem, DilloDumper will not help you, it is designed specfically for CopyMem programs only, since they are more "difficult".

Haven't you done any research on this subject at all? There's lots of threads about Armadillo and how it works and what it does. How do you think Lunar_Dust gained the knowledge needed to write the unpacker in the first place? It's not rocket science, it's not magic, it's not some cute undocumented feature. It's computer programming. It's not that hard.

-nt20
squidge
06-08-2003, 02:03 PM
Niko:

It's not just Copymem programs that have two processes running, it's the standard protection ones that have "Debug Blocker" enabled. This multi process thing stops you from debugging the second process, which is the protected application.

donneraza:

Just two WriteProcessMemory calls means "standard protection + Debug Blocker". You should be able to dump the second process easily enough as long as you can pause it on OEP.

I think Ricardo has done a tut about standard protection - try searching his ftp site.
donneraza
06-08-2003, 04:02 PM
Thank you very mutch! Niko

I search for the Ricardo Tut.

But , Is it mean that I have to by pass first the CopyMem protection and after the Debug Blocker ?

By Dillodumper I can take the OEP, is it the same ? And what can
I do with if I just have, most of time, a one byte assemble line code ? Problem !!!
squidge
06-08-2003, 04:36 PM
If there is no 1000 byte WriteProcessMemory calls, then there is no Copymem - just DebugBlocker.

As for your disassembly problem, I think you'll find it's obfuscated code (eg. meaningless bytes to confuse a disassembler, but does not execute them). You'll also find a lot of encrypted code that is decrypted right before use.

Note: Whether the program is "Standard protection + Debug Blocker" or "Debug Blocker + CopyMem-II", there's still only one protection to defeat. Copymem incorporates DebugBlocker internally, so bypass that and you've bypassed debug blocker also. Hmm, hopefully that explanation wasn't too confusing :rolleyes:
donneraza
06-09-2003, 03:06 AM
In his "71-hard rock armadillo & nanomites" tut, Ricardo says about a likely case on "eSTOP SE 3.21 prog" where if he try to stop it with WriteProcessMemory it was not stop but if he did look the attach window he saw Father and soon processess.
And he did concluded that it was protected only with nanomites .

Applying this approche, I run my protected prog and I search where does the father start working with the nanomites.Stop at the entry point and look for hex value 03000080 , nothing ????

With the presence of lot of "obfuscated code " how to continue to find where are the key to de-blocked the Debug Blocker or CopyMem ?

Any suggestion is welcome !!!
nikolatesla20
06-09-2003, 10:35 AM
You'll see a lot of this "one byte codes" until you go into OllyDbg menu --- "Options->Debugging Options" Then click the "Exceptions" tab, and Check the checkbox labeled "Single-Step break", so Olly ignores single-step exceptions.

-nt20
donneraza
06-09-2003, 02:23 PM
Thanks nt20 , I 'll try it !
donneraza
06-09-2003, 02:37 PM
nt20, I still have the "one byte code" on the OllyDB de-assembled
code. Nothing changed !!!

In softice thing goes differently. More readble !! Is there any other option to activate on Olly ?
thematrix
11-05-2003, 05:07 AM
lunar_dust pmed u i get 4404 error 5-6 and corrupted dumped.exe file
crusher
11-29-2003, 07:51 PM
You don't need to to IAT autosearch. Just type in the IAT address that DilloDumper gives you directly. Then you press "Get Imports" just at the tutorial says. The only reason to type in the OEP is to make sure the dump doesnt get screwed when you "Fix Dump".

In the case that this number that DilloDumper gives you doesn't work, and ALSO the IAT autosearch won't work, then you will have to find the IAT on your own, and that I'm afraid, is when you will need unpacking experience to get the job done. There's no other way around that.
-[Lunar_Dust]

hello!

I found out that if your "educated guess" fails, sometimes you can still use "IAT AutoSearch" function. also if one has invalid thunks between valid thunks :)
although something is confusing.

AFAIK "modern" development environments/compilers reduce the use of IAT (by using LoadLibraryA and GetProcAddress and the like). also know that the OEP given by PE header (from memory) is the Armadillo EP, not the original code's one.
here comes the confusion.
Armadillo also has its own import table, with its two imported libraries (at this time).

questions:
how can it "emulate" import assignment and relocation?
in other words, how the holy hell does CreateProcess* (the OS itself) actually load and fix up these functions?
I believe the answer for the two questions should be similar.
or Arma simply creates another process via API with correct import table?

it would be very important for me to understand this mechanism, since I believe that as like ImpRec is able to locate the functions literally, one should be able to reconstruct IAT *from scratch* using a module map snapshot which is created while protected EXE is running, the library files themselves and a loader/disassembler engine which traces the code and finds invalid called subroutines that consists of a single trampoline (JMP FAR). this method is only suitable although if the engine can also handle the mechanism mentioned 2 paragraphs before at modern compilers (if it ever existed).
this is needed to almost genericly unpack systems like Xprotector.

also tell me what actually nanomites consist of.

yeah, I know I can use SI for this, but I have no NTICE for my XP now, and I believe you could help me with this. you can also point me to information on Win32 executable/module loading/relocating mechanism. I'd be so thankful.

regards
squidge
11-29-2003, 08:15 PM
questions:
how can it "emulate" import assignment and relocation?
in other words, how the holy hell does CreateProcess* (the OS itself) actually load and fix up these functions?
I believe the answer for the two questions should be similar.

May I suggest you read "Inside Windows 2000 Third Edition". It covers things like this in detail.

or Arma simply creates another process via API with correct import table?

Bingo! However, you'll find that a lot of the routines are to Arma itself to prevent programs such as Imprec from working properly. After a bit of calculation, it will call the original OS routine however, but it's not exactly easy to find...

also tell me what actually nanomites consist of.

Quickly: Arma installs an exception handler into program. Unpacks program, runs, program encounters a nanomites (INT 3 instruction). Arma gets notified of this and calculates original jump address and condition and sets program pointer to appropriate position and continues program execution.

believe you could help me with this. you can also point me to information on Win32 executable/module loading/relocating mechanism. I'd be so thankful.

See "Inside Windows 2000 Third Edition". Much more detailed than could ever be described here.
crusher
11-29-2003, 08:53 PM
ok, well..

any online editions for this book?

also if armadillo inserts nanomites, this means as you explained that it jumps to an other address within a function.

how it physically achieves this? I mean it needs original functions to be splitted this way, thus completely rearranging the code.
or it replaces only originally jump (74/75/EB for short and the like) instructions to INT 3?

this is the only way in order to keep original code flow integrity...
squidge
11-30-2003, 05:28 AM
Yes, there are online editions for this book, and some can be found by using a search engine such as Google.

As for the documentation on Armadillo's Nanomites - I've give you the basics, more indepth information can be found by using search engines such as the one on this board and Google.
crusher
01-20-2004, 08:14 PM
Lunar_Dust:
hey folk! did you work out something? I have a target which causes this mentioned automatic exit :) as it does not wait for IAT rebuilding.
erm, my file is 208896 bytes originally (is 425some finally)


Armadillo expiration check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo expiration check
PDA

View Full Version : Armadillo expiration check

volodya
05-23-2003, 12:22 PM
Hi guys!
First of all - I know there already was such post in this forum - crk is starter if I'm not mistaken. BUT - in that post there was a discussion about 2.xx version ONLY and they didn't figure out how to protect RegMon from Armadillo. Second. I know about GetProgramInfo function hidden in tmp-Arma-file. I also noticed multiple CompareFileTime when Arma is scanning WINDIR. DilloDumper can fix this but I really wonder how to do it MANUALLY! As far as I noticed noone has talked about it due to 3.xx version. May be anyone can help?
volodya
05-24-2003, 06:06 PM
:( Nobody likes me here :( Or nobody knows?
dELTA
05-25-2003, 04:50 PM
A good suggestion about how to get more replies around here is to show what work you have done yourself to solve a certain problem, and where you got stuck. Show people that you made an effort to try to solve it yourself. Then you are much more likely to get the help you want.

I would have told you if I knew the answer to this one, but I don't, so I guess you have to get the Armadillo-experts around here more interested.

dELTA


79-armadillo & Nanomites Annex
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > 79-armadillo & Nanomites Annex
PDA

View Full Version : 79-armadillo & Nanomites Annex

S3ri@l CoDe9x
05-24-2003, 08:04 AM
Ok.. well .. more nanomites .. it is Ricardo annexe to improve the graft of the long jumps :p

Enjoy!

Best Regards! :rolleyes:

PD: Nikolastela.. good job in Vbox ;) ..Great Tuto!!


System Driver Linking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > System Driver Linking
PDA

View Full Version : System Driver Linking

kolina
05-24-2003, 07:39 PM
Hi everybody,

I tried to compile the UCL HASP Emulator for a valid HaspNT.sys. But my problem is how to link the .obj files correctly. With the DDK I can compile the .cpp files and with TASM the .asm files, but I can't figure out the correct switches for link to get them together. Always some entry point error or something else. Any help would be greatly appreciated! I'd also like to try out CrackZ HASP Driver Pack, but his download is suspended at the moment. Maybe somebody else can give me a link or send the file?

Thank you very much for your help!
--kolina
Mostek
05-25-2003, 05:14 PM
1st if you are using borland then there is a utility that will convert exe(if I remember right) to sys->I forgot the name of the utility but I know there is one as I had the same problem.

2nd I know that everybody is used to his tools, but I would recomend you to start using M$ Visual C/C++ and MASM.
Why?
Most of the examples and documentation solutions references VC directly->so you don't have to read/search on how borland solve this problem.

Sum: Borland is nice and I still use it sometimes, but for programming drivers (for win machines) the best solution is to go with M$ stuff.
I didn't want to use M$ stuff at the begining also, but found that it works quite nice.

Just a notice: If you'll install 'VisualStudio Net' be carefull not to uncheck to much stuff from installation options, as you will land into problems->the best is to leave everything what is already checked and maybe check even something extra that you need.

I hope this helped.

Peace
Mostek
kolina
05-26-2003, 03:31 AM
Thanks Mostek! Normally I hate Borland, but in this case the source is for Turbo Assembler and can't be compiled with Masm. In the meantime I even managed to link all the OBJ files together (cpp compiled with VC XP DDK, asm files with TASM) with the following linker switches if I remember right:
link *.obj (some lib) /driver /subsystem:native /entry:DriverEntry /out:HaspNT.sys
And the driver is linked, but then I get a blue screen when running it. As I didn't change the source files at all I think it's a matter of the link switches.
Any hints???
Thanks!
Mostek
05-26-2003, 06:39 AM
Sorry non what so ever. :(

Use SIce and debug->so you'll see what is wrong->maybe that will give you a hint.

Peace
Mostek
g_g
05-28-2003, 07:47 AM
There are several checks performed by the operating system (my memory is rusty at best, so i'll skip attempting to specify wich - you can debug the loading process, if you wan't this info) before a driver can be loaded.

Once loaded, there are certain rules wich must be followed, mainly regarding the memory attributes of the various sections of the driver image. Certain functions must be located in non-pageable sections, as paging won't be possible when the functions are called.

Obviously, none of the above is really going to help you with your problem, sorry, but that's as specific i can get without reading up on the subject.

Here's the link argument's i've used when building masm based drivers:

link /STACK:0x40000,0x1000 /MERGE:_PAGE=PAGE /MERGE:_TEXT=.text /MERGE:.rdata=INIT /SECTION:INIT,d /DRIVER /ALIGN:0x20 /SUBSYSTEM:NATIVE /BASE:0x10000 /LIBPATH:[ddk libpath] [object files] /OUT:[driver binary]

the /merge arguments will most likely have to be changed to reflect the section names of your object files.

Hope you'll be able to dig out a solution to your problem.


essay
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > essay
PDA

View Full Version : essay

LOUZEW
05-25-2003, 10:43 AM
It's just a test after installing a new HD, the ols one died !
dELTA
05-25-2003, 05:00 PM
If your harddisk isn't located in the woodmann.com server (which it isn't, I just checked :)), I have very hard to see what this test message would accomplish? :p

dELTA
Woodmann
05-25-2003, 08:17 PM
Maybe he saves the threads ?

Woodmann
JMI
05-25-2003, 10:17 PM
He's just used to the exetools Forum where they have a "Test" Forum to do these things.:)

Regards.
esther
05-26-2003, 12:30 PM
probably he thought he is running Woodmann's server
muhahhha
Woodmann
05-26-2003, 06:03 PM
esther, you are INSANE ;)

Woodmann
esther
05-28-2003, 01:39 AM
Woodmann,Thats old news :D :p


SICE Detection on 'GETRIGHT'
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SICE Detection on 'GETRIGHT'
PDA

View Full Version : SICE Detection on 'GETRIGHT'

Zkhan13
05-25-2003, 12:04 PM
When i tried to install GetRight-A wonderful downLoader...It tells some debugger is there, so you should startit without SICE.
'Active Registry Monitor' another one is also had the same problem 'Debugger Detection'

Is there any way to Patch these problems......
Whether SICE Add-ins would work...
Pls help
JMI
05-25-2003, 12:38 PM
Zkhan:

You need to do some searching here before you post questions. One of the reasons for this is that often you will find that the same question has been asked before or information about the subject has been provided before.

There are two issues here:
1. Learning how a program detects that a debugger is running. 2. learning how to "hide" the debugger from detection.

Both these subjects have been discussed in some detail before and using "detect + debugger" and/or "hide + softice" should get several good threads with information. (for example this one from just a few days ago: http://www.woodmann.net/forum/showthread.php?threadid=4796&highlight=hide+softice

Particularly with Armadillo, have you taken the time to read the tutorials posted in the Packing and Unpacking Forum of this protection? If you had read the one titled "Armadillo for Dummies GetRight 5 (vol) 1" you would/will find this specific issue discussed including the use of "Bp IsDebuggerPresent."

It is a good thing to do some work on your own, rather than simply having a problem and immediately asking someone else to do the work for you. If you do some work and do not find an answer, that is the time to seek help, and when you do, explain what you have already tried. Failing to find the answer is not a problem, failing to make an effort is not a good thing. I'm trying to teach people to think about problems first, search for the answer first and then ask questions.

Regards,
Zkhan13
05-26-2003, 12:12 AM
Sorry for my Ignorance
JMI
05-26-2003, 01:39 AM
Zkhan13:

No one raised an issue of "ignorance" and no one ask you to be sorry. I only asked you to show some EFFORT to help yourself before you asked a question.

I attempted to demonstrate what you could find with just a "little" effort and I gave you the answer to your question. Did you do the searches I suggested? Did you read about hiding softice? Did you read the tuts on Armadillo? This is how you learn new things.

Regards.
Zkhan13
05-26-2003, 09:15 AM
Of course... I really gone thru all those web pages and downloaded that precious Web Pages and Tutorials...

But i have to go home to study those.B'cze i am working in a Quality Management Consultancy Group.

Any way it was my dream to become a reverse engineer, who will be beneficial to the Humans... rather than just Patching and Serial Fishing.
Is it would be NICE idea, TO ADD MORE FUNCTIONS, those redmond giant, has not yet Dreamt of. But i know

have to go A Thousand Miles Before i Sleep..
A Thousand Miles Before i Sleep..............
Nitrus
11-11-2003, 09:37 PM
Armadillo for Dummies GetRight 5 (vol) 1 says nothing about hiding softice from Armadillo. It only talks about unpacking and hiding Olly under XP.


Question about RCE_CD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question about RCE_CD
PDA

View Full Version : Question about RCE_CD

Torque
05-26-2003, 02:51 PM
Hey guys,

I read about this cd somewhere, dont remember where exactly, but I was wondering if it is still available anywhere. I searched these forums but the search results are pretty old so I do not know if the cd is around anymore.

If it is, can any one direct me to it? If not, just ignore this post :)

Thanx a lot,

-Torque
JMI
05-26-2003, 03:06 PM
Yo Torque:

Are you familiar with the saying:

"They have eyes, but can not see"?

Look all the way down at the bottom of the first page of the Forums. There you will find a list of Links.

One of them has a catchy title of:

"RCE CD Contents."

You might just want to give it a try.:)

Regards.
Torque
05-26-2003, 03:42 PM
Ooops, missed that one :)

Thanx for your help!


Olly tuts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Olly tuts
PDA

View Full Version : Olly tuts

Omaster
05-27-2003, 05:09 AM
im a total cracking newbie, i'd like to learn how to crack using olly, but i cant find too many tuts (3 so far), anyone knows a site that has lots of olly tuts? or at least good ones i havent read yet? ;)
Shoob
05-27-2003, 05:36 AM
Olly Tuts (http://www.woodmann.net/forum/search.php?s=) take some hours on google and SEARCH like others do.
Aimless
05-27-2003, 11:51 PM
Better yet...

Join the Ollydbg forum. You can interactively post queries and get replies. And yes, you can also get the tutorials over there if you ask nicely enough.

Have Phun
Omaster
05-27-2003, 11:53 PM
got a url bro?
esther
05-28-2003, 01:48 AM
here (http://www.woodmann.net/krobar/upyours.html)
Omaster
05-28-2003, 02:26 AM
cute
JMI
05-28-2003, 02:38 AM
How about you try something really, really easy, like typing

"Ollydbg forum"

in your favorite search engine. You just can't miss it. You do know how to search don't you??

And remember that esther did warn you that he was "insane.":D

Regards.
esther
05-28-2003, 05:27 AM
The only comes to my mind is this guy is lazy

JMI:
Read the off topic anwser you didn't search do you :D
JMI
05-28-2003, 09:19 AM
esther:

Of course I read your post in the off topic, and Woodmann's reply. That WHY I made my comment here. :)

Regards.
Woodmann
05-28-2003, 04:32 PM
People,

Go easy in this forum. The user only has 3 posts so I would
be a little more kind :)

http://ollydbg.win32asmcommunity.net/index.php?

Woodmann
nofurs
05-29-2003, 12:49 AM
Hi Woodmann,

Why Chainie's post has been deleted!? He has the reason to flame this guy afaik.Many ppl has helped him but he ignored advices here or in irc.

Regards
JMI
05-29-2003, 01:11 AM
I'm the one who deleted that post. I did it because we really aren't supposed to "flame" eachother here. We are supposed to try to "educate" people on how to do it the correct way. Some teasing is, at times, appropriate, but comments about the "person" rather than about the "effort" are generally not useful, and not to be encouraged.

Even though Omaster showed little effort, I tried to give him, and others, an answer which would have them actually do it the correct way, by using their search engine. If they learned something from that effort, that is all that is hoped for or expected.

Regards.
nofurs
05-29-2003, 01:18 AM
"educate " is good but its kinda waste of time and effort he doesn't appreciate .warnings given in irc and so forth....

Flaming's is necessary when needed if he doesn't care

You can't push a cow to drink if it doesn't want to ;)
JMI
05-29-2003, 02:42 AM
Actually the better paraphrase is a derivation of "you can lead a horse to water, but you can't make it drink". It is:

"You can lead a whore to culture, but you can't make her think."

And how, pray tell, are we all supposed to know what omaster may have done on IRC? This was his 1st, 2nd, and 3rd post here. We did not share the history of which you speak, and even if we had, this is not the place for flames. If he doesn't care, he won't care about flames, but WE do care and that is sufficient reason to delete such posts and will be so in the future. The more appropriate punishment for ordinary offenders is that their questions get what they deserve, ignored.

Regards.
nofurs
05-29-2003, 03:48 AM
Well as you wished but you're not helping him at all.This will initially makes him thinks that "I can ask tutes without searching,I can ask in any forums or irc".I think this is not they way
And searching is the key for cracking.He can't even do that how can he learn anything....

spoon feeding will kill a pro becomes a lamer
chainie
05-29-2003, 04:04 AM
I said, what i had to say because he emailed me just 15 minutes before the post made in here. I felt that his emails were demanding of me and also very disrespectful, yeah i could of handled it better sure but at the same time i then come across this post just minutes after reading my email from him and i was like hmmm L**er and L**mer came to my mind as i posted he had joined our channel which is #biw efnet and he was not only bothering me but others there as well thats all i will say about it peace.....
esther
05-29-2003, 12:28 PM
JMI:
My post is flaming too why didn't delete it :D :p
JMI
05-29-2003, 12:51 PM
Because esther dear, we make some special dispensation because of your "self confessed" and "confirmed" metal illness. In other words, because of your "condition" you are not responsible for your conduct. :D :p

Regards.
Woodmann
05-29-2003, 06:01 PM
esther,

BWHAHAAHHAHAHAHAHAHAHAHAAA

Dont you know we let you hang around here so you dont lose your 1 hour of computer time in the "house". :D

As for lamers, he has gotten his reply. If he chooses not
to make any effort, his posts will just be deleted.

Woodmann
esther
05-29-2003, 10:19 PM
->we make some special dispensation because of your "self confessed" and "confirmed" metal illness.

metal illness?! muhahaha


Loop to get key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Loop to get key
PDA

View Full Version : Loop to get key

kolina
05-27-2003, 01:17 PM
Hi all!

In the following code snippet a long double is read from a file, that's the required key. Then a checking function is called which performs a number of calculations. As I don't want to write a keygen (that's too complicated for me at the moment) I thought I could wrap a loop around the checking function to test all keys until a valid one is found. If a correct key is found I'd like to notice it somehow with the help of the check of the result (if this is the correct one ;-) below. I know that the correct key will be smaller than 2^40, so the loop might take some hours I think but that wouldn't be a problem. Can somebody give me some tips how to do this?

Thank you very much!
kolina

10013BAC lea ecx, [esp+5F0h+var_550]
10013BB3 push offset aR ; "r"
10013BB8 push ecx
10013BB9 call ds:fopen
10013BBF mov esi, eax
10013BC1 add esp, 8
10013BC4 test esi, esi
10013BC6 jz loc_10013C53
10013BCC lea edx, [esp+5F0h+var_5D8]
10013BD0 push edx
10013BD1 push offset aLf ; "%lf"
10013BD6 push esi
10013BD7 call ds:fscanf ; <--- READ LONG DOUBLE FROM FILE
10013BDD push esi
10013BDE call ds:fclose
10013BE4 lea eax, [esp+600h+var_5DD]
10013BE8 lea ecx, [esp+600h+var_5DA]
10013BEC push eax
10013BED mov eax, [esp+604h+var_5D4]
10013BF1 lea edx, [esp+604h+var_5DC]
10013BF5 push ecx
10013BF6 mov ecx, [esp+608h+var_5D8]
10013BFA push edx
10013BFB push eax
10013BFC push ecx
10013BFD call sub_100139E0 ; <--- THE CHECKING FUNCTION
10013C02 mov al, [esp+614h+var_5DD]
10013C06 add esp, 24h
10013C09 test al, al ; <--- CHECK IF RETURN IS CORRECT (?)
10013C0B jz short loc_10013C2E
10013C0D call dword_1001F9AC
10013C13 cmp ax, [esp+5F0h+var_5DC]
10013C18 jnz short loc_10013C2E
10013C1A mov dx, [ebp+arg_4]
10013C1E cmp [esp+5F0h+var_5DA], dx
10013C23 jnz short loc_10013C2E
10013C25 mov al, 1
10013C27 pop edi
10013C28 pop esi
10013C29 pop ebx
10013C2A mov esp, ebp
10013C2C pop ebp
10013C2D retn
evlncrn8
05-27-2003, 08:40 PM
10013BFD call sub_100139E0

disasemble that subroutine, see what it does, it sets a value on the stack for success as you noted, so trace it, see what the params passed are, worst case you can brute force it, best case, you'll find where it does a comparison to the 'valid' key and can grab the valid key from there... keep debuggin
naides
05-27-2003, 10:28 PM
10013BAC lea ecx, [esp+5F0h+var_550] ;ALL THIS CODE OPENS AND READS FROM FILE
10013BB3 push offset aR ; "r" ;REPLACE IT WITH CODE THAT INITIALIZES
10013BB8 push ecx ;THE KEY CONTAINED IN esp+600h+var_5DD
10013BB9 call ds:fopen ;TO ZERO AND INCREMENT IT AFTER EACH LOOP
10013BBF mov esi, eax ;IF THE SPACE IS NOT ENOUGH, MAKE A JUMP
10013BC1 add esp, 8 ;TO A ZERO ISLAND IN THE CODE AND PUT YOUR GENERATOR/INCREMENTING CODE
10013BC4 test esi, esi ;THERE, THEN JUMP BACK TO THE PALCE WHERE
10013BC6 jz loc_10013C53 ;THE KEY IS PUSHED TO THE STACK TO BE VALIDATED
10013BCC lea edx, [esp+5F0h+var_5D8] ; I.E. 10013BE4
10013BD0 push edx ;IF VALIDATION AT 10013BFD FAILS, LOOP TO THE GENERATOR
10013BD1 push offset aLf ; "%lf" ; INCREMENT THE KEY
10013BD6 push esi
10013BD7 call ds:fscanf ; <--- READ LONG DOUBLE FROM FILE
10013BDD push esi
10013BDE call ds:fclose
10013BE4 lea eax, [esp+600h+var_5DD]
10013BE8 lea ecx, [esp+600h+var_5DA]
10013BEC push eax
10013BED mov eax, [esp+604h+var_5D4]
10013BF1 lea edx, [esp+604h+var_5DC]
10013BF5 push ecx
10013BF6 mov ecx, [esp+608h+var_5D8]
10013BFA push edx
10013BFB push eax
10013BFC push ecx
10013BFD call sub_100139E0 ; <--- THE CHECKING FUNCTION
10013C02 mov al, [esp+614h+var_5DD]
10013C06 add esp, 24h
10013C09 test al, al ; <--- CHECK IF RETURN IS CORRECT (?); IF AL,AL IS TRUE, JUMP TO A CODE THAT REPORT
10013C0B jz short loc_10013C2E ;THE CONTENTS OF THE KEY, OR EVEN SIMPLY BREAK
10013C0D call dword_1001F9AC ;SOFTICE, AND YOU CAN RETRIEVE THE CONTENTS OF THE
10013C13 cmp ax, [esp+5F0h+var_5DC] ; KEY MANUALLY.
10013C18 jnz short loc_10013C2E ;OTHERWISE, CHANGE THE INSTRUCTION IN 10013COD TO
10013C1A mov dx, [ebp+arg_4] ;JMP TO THE GENERATOR, CLOSING THE LOOP.
10013C1E cmp [esp+5F0h+var_5DA], dx
10013C23 jnz short loc_10013C2E
10013C25 mov al, 1
10013C27 pop edi
10013C28 pop esi
10013C29 pop ebx
10013C2A mov esp, ebp
10013C2C pop ebp
10013C2D retn

HOPE THIS HELPS
kolina
05-28-2003, 03:26 AM
Yeah, thanks, that helped a lot! :)

BTW, is there a convenient way of reporting some register content with a few ops? OK, I could call an int 3 and use SICE, but writing it to a file or something similar (MessageBox) would be very nice.

Any ideas?
naides
05-28-2003, 02:58 PM
Not in a few ops.

the convoluted part is to change a double into a null terminated string, which is the data type that a messagebox wants. Writing to a file will also involve creating, then writing then closing, which may require more than a few push and calls.

It can be done, of course, but IMHO would require too much coding and debugging for a quicky brute force project.


new PCGuard Unpacker/Dumper
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new PCGuard Unpacker/Dumper
PDA

View Full Version : new PCGuard Unpacker/Dumper

sirius
05-27-2003, 02:00 PM
Dumper for PCGuard 3.05-4.10.
Author: just Evaluator

h**p://www.anticrack.de/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=3871

thanks i really appreciate it


How to write a keygen ripping the original asm code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > How to write a keygen ripping the original asm code
PDA

View Full Version : How to write a keygen ripping the original asm code

achi
05-27-2003, 06:15 PM
i'd like to know , if there anyone have a source for win32asm keygen with comments 4 newbies.
i think that best way to learn is get some good example.
FoolFox
05-28-2003, 01:29 AM
Hello,

Here's one skeleton for, I've removed the serial generation as
it was part of the rea course. I've just post the asm, other
files are those generted by RadASM, don't think I added something
in those.....the basic template is a dialogbox.
Anyway, let me know if you need further details:

I'm using the Masm8 Hutch's package for win32 and Ketilo
RadASM as IDE.

;===========================================================================
; KeyGen by etherlord
; Compiled with RadASM/MASM32
;===========================================================================
.386
.model flat, stdcall ;32 bit memory model
option casemap :none ;case sensitive

include REAKEYG1.inc

.code

start:

invoke GetModuleHandle,NULL
mov hInstance,eax

invoke InitCommonControls
invoke DialogBoxParam,hInstance,IDD_DIALOG1,NULL,addr DlgProc,NULL
invoke ExitProcess,0

;########################################################################

DlgProc proc hWin:HWND,uMsg:UINT,wParam:WPARAM,lParam:LPARAM

mov eax,uMsg
.if eax==WM_INITDIALOG

.elseif eax==WM_COMMAND ; user press the generate button
mov eax,wParam
.IF ax==IDC_BTN1
; getting the handle of the Crackme window with FindWindow
invoke FindWindow, addr lpClassName, addr lpWindowName
.if eax!=NULL
; we have found a handle
mov hwndParent,eax
; now we have to get the handle of the subwindow with FindWindowsEx
invoke FindWindowEx,hwndParent,hwndChildAfter, addr ClWindn, NULL
; if we get a handle, time to retrieve the info
.if eax!=NULL
mov hwindfirst,eax
; we are now seeking the second textbox
invoke FindWindowEx,hwndParent,hwind, addr ClWindn, NULL
.if eax!=NULL
mov hwind,eax
invoke SendMessage,hwind,WM_GETTEXT,wParam,addr TexBuf
.if eax!=NULL
;we got some chars in the buffer, placing them back
; to our windows,
invoke SetDlgItemTextA,hWin,IDC_EDT1,addr TexBuf
; Now, we have to build the correct serial from it
pushad
; code removed from here... just serial generation
; then we print out the result
invoke SetDlgItemTextA,hWin,IDC_EDT2,addr HrdCodStr
popad
.endif
.endif
.endif
;invoke MessageBox,NULL,addr MsgBoxText, addr MsgBoxCaption, MB_OK
.endif
.endif
.elseif eax==WM_CLOSE
invoke EndDialog,hWin,0
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret

DlgProc endp

end start
ZaiRoN
05-29-2003, 06:52 AM
Hi achi,
I agree with you about the fact that the best way to learn is to start from some good example but we also need a bit of theory. To learn how to keygen a program, you have only to understand how the name/serial routine works. After that, when you know how the routine works, if you want to write a keygenerator you have to know how to write a simple program, in assembly or c or in the language you like.
The source posted by FoolFox is correct but if you want to learn how to write a program, take a look at Iczelion's site: http://win32asm.cjb.net/
The tutorial section contains interesting tutorials on how to write win32 applications.

Tell us if to write a win32 application is really what you want to learn, we could leave this thread for all those whom want to learn how to write a simple application (or a keygenerator template ;-))

ZaiRoN
FoolFox
06-02-2003, 03:31 AM
Hello,

Yeah, Zairon is right, maybe I was a little bit straightforward on
this one :)

just in case, here's some details on the keygen I'had made
a while ago for a friend, it's just some notes on why the
sample is done this way :

So, step by step :

- Find the handle of the application.
- Find the handle of the textbox where the name lie.
- Retrieve the content of the username textbox.
- Compute the correct serial.
- Either show the user the correct serial or inject it directly in the
application.

To find the handle of the application, I use WinSpector, there is
many tools of that kind floating around, any that'll show you the handle,
class, and such info will do the job. What we need to find the handle
of the application is the window name and the class name. Once found we
are ready to start our keygen.

To find the handle of the application windows, we'll use the FindWindow
API. The FindWindow API need the following params:

Syntax

HWND FindWindow(
LPCTSTR lpClassName,
LPCTSTR lpWindowName
);

Parameters

lpClassName
-----------
[in] Pointer to a null-terminated string that specifies the
class name or a class atom created by a previous call to the
RegisterClass or RegisterClassEx function. The atom must be
in the low-order word of lpClassName; the high-order word
must be zero.

If lpClassName points to a string, it specifies the window
class name. The class name can be any name registered with
RegisterClass or RegisterClassEx, or any of the predefined
control-class names.

If lpClassName is NULL, it finds any window whose title matches
the lpWindowName parameter.

lpWindowName
------------
[in] Pointer to a null-terminated string that specifies the
window name (the window's title). If this parameter is NULL,
all window names match.

Return Value
------------
If the function succeeds, the return value is a handle to the
window that has the specified class name and window name.

If the function fails, the return value is NULL. To get extended
error information, call GetLastError.

So, to get the handle, we'll use the function the following way :

includelib user32.lib

FindWindow PROTO lpClassName:HWND,lpWindowName:HWND

.data
lpClassName db "<ClassName>",0
lpWindowName db "<WindowName>",0
hwndParent dd ?

.code
......
.IF ax==IDC_BTN1
; getting the handle of the window with FindWindow
invoke FindWindow, addr lpClassName, addr lpWindowName
.if eax!=NULL
; if we get a result, store the result handle
mov hwndParent,eax

We have now the window handle stored in hwndParent. From there, we must
find the child window, the one wich handle the textbox. In case we have
several textbox, we may need to enumerate them until we got the good one.
Those objects are declared in ressources, kind of static object, once
you got a value about them this value should not change.

To find the handle of the child window, we can use the FindWindowsEx
function.

Syntax

HWND FindWindowEx(
HWND hwndParent,
HWND hwndChildAfter,
LPCTSTR lpszClass,
LPCTSTR lpszWindow
);

Parameters

hwndParent
----------
[in] Handle to the parent window whose child windows are
to be searched. If hwndParent is NULL, the function uses
the desktop window as the parent window. The function searches
among windows that are child windows of the desktop.

hwndChildAfter
--------------
[in] Handle to a child window. The search begins with the
next child window in the Z order. The child window must be
a direct child window of hwndParent, not just a descendant
window. If hwndChildAfter is NULL, the search begins with
the first child window of hwndParent.

Note that if both hwndParent and hwndChildAfter are NULL, the
function searches all top-level and message-only windows.

lpszClass
---------
[in] Pointer to a null-terminated string that specifies the
class name or a class atom created by a previous call to the
RegisterClass or RegisterClassEx function. The atom must be
placed in the low-order word of lpszClass; the high-order word
must be zero.

If lpszClass is a string, it specifies the window class name.
The class name can be any name registered with RegisterClass
or RegisterClassEx, or any of the predefined control-class names,
or it can be MAKEINTATOM(0x800). In this latter case, 0x8000 is
the atom for a menu class. For more information, see the Remarks
section of this topic.

lpszWindow
----------
[in] Pointer to a null-terminated string that specifies the
window name (the window's title). If this parameter is NULL, all
window names match.

Return Value
------------
If the function succeeds, the return value is a handle to the
window that has the specified class and window names.

If the function fails, the return value is NULL. To get extended
error information, call GetLastError.

If we consider a standard username/serial combo, the first subwindow is
usually the username textbox, the one we want to catch. If we wanted to
also grab a second textbox (company, or anything...), then we would have
to call the function a second time. This function is called the followin
way (we are assuming here that we got the hwndParent from previous call):

includelib user32.lib

FindWindowEx PROTO hwndParent:DWORD, hwndChildAfter:DWORD,
lpszClass:HWND, lpszWindow:HWND

.data
ClWindn db "<TextBoxName>",0
hwndChildAfter dd ?
hwindfirst dd ?

.code
......
; now we have to get the handle of the subwindow with FindWindowsEx
invoke FindWindowEx,hwndParent,hwndChildAfter, addr ClWindn, NULL
.if eax!=NULL
; if we get a result, store the handle
mov hwindfirst,eax

Ok, we have now the handle we need to retrieve the info we want. But, how
could we do that ? If we where in the application, a simple WM_GETEXT would
have done the job. But we are seeking the info from an external application.
So we need to use Windows MESSAGES to send the command to the right
application.

Syntax

LRESULT SendMessage(
HWND hWnd,
UINT Msg,
WPARAM wParam,
LPARAM lParam
);

Parameters

hWnd
----
[in] Handle to the window whose window procedure will
receive the message. If this parameter is HWND_BROADCAST,
the message is sent to all top-level windows in the system,
including disabled or invisible unowned windows, overlapped
windows, and pop-up windows; but the message is not sent
to child windows.

Msg
---
[in] Specifies the message to be sent.

wParam
------
[in] Specifies additional message-specific information.

lParam
------
[in] Specifies additional message-specific information.

Return Value
------------
The return value specifies the result of the message
processing; it depends on the message sent.

To send the WM_GETTEXT command and retrieve the result, we'll use the
following snippet :

includelib user32.lib

.data
TexBuf db "00000000000000000",0

.code
......
; here we are getting the handle of the textbox
.if eax!=NULL
; we save the handle of the textbox
mov hwind,eax
; we send the WM_GETTEXT message to the textbox
; wParam is a parameter passed to/from DlgProc
invoke SendMessage,hwind,WM_GETTEXT,wParam,addr TexBuf
.if eax!=NULL
; here we deal with the result found

And we have now the username stored in TexBuf, ready for any kind of
processing. From them, insert your algo computation and show the result
to the user. We are just showing a textbox here, but we could have as
well send a WM_SETTEXT command to the second textbox to fill the serial
in place of the user. Just a thing to remember, before messing with
register in your function, it's a good thing to save the registers. You
can choose to save only those you play with, I find it easier to user the
PUSHAD/POPAD function (push all 32 bits register in the stack) :

.if eax!=NULL
; here we deal with the result found
pushad
....
your func here
....
popad

But the main point, is the one shown by Zairon, that you need
first to understand the algo used in the prog you want to
keygen.

Hope this help to clear it a little bit.

Regards
FoolFox
ZaiRoN
06-05-2003, 10:13 AM
Hi All,
thx for the explanation FoolFox :-)

To join theory and practice I will add a simple crackme to this thread. This is a simple crackme and, to keygen it, you only need to rip the original code. I decided to attach this type of crackme because I wanted to join this thread with the thread in the newbies forum named "Copying keymaker ASM from Win32Dasm" (http://www.woodmann.net/forum/showthread.php?s=&threadid=4877) (read it, you will find a little hint :-)).
In this way the project is complete and it gives you the possibility to:
- learn to write a win32asm keygen
- learn to rip code from a program

I thought it could be an interesting idea, what do you think?
Let the discussion begin :-)

Good luck,
ZaiRoN
Fahr
06-05-2003, 02:26 PM
Originally posted by FoolFox
Hello,

Here's one skeleton for, I've removed the serial generation as
it was part of the rea course. I've just post the asm, other
files are those generted by RadASM, don't think I added something
in those.....the basic template is a dialogbox.
Anyway, let me know if you need further details:

I'm using the Masm8 Hutch's package for win32 and Ketilo
RadASM as IDE.

<--snip-->

Hmm, interesting; can you let RadASM generate the code for loading the form and handling it automatically? Or do you still have to do it by hand? (If so, I'd rather stick with raw MASM).

- Fahr
evaluator
06-05-2003, 02:44 PM
hello ZaiRoN & others..

this thread seems to me too iLLegalz!

2 little tech questions I inject here:
I have dlded masm8 & about 2 month fight with it..

Q1: So Masm can't MMX? or can(where to read how?)?
//
Q2: Can't force Masm to Immediate memory R/W..
e.g.
if I wrote:
mov eax, dword ptr[00402000]..

this will anyway:
mov eax, 00402000..

So not supported?

*********
DEPIH is Greyt!
ZaiRoN
06-05-2003, 05:04 PM
Hi evaluator!

>Q1: So Masm can't MMX? or can(where to read how?)?
You can but you have to use .MMX directive.

>Q2: Can't force Masm to Immediate memory R/W..
I am not totally sure but I don't think you can work directly with virtual address... Delphi can?

For specific masm questions you can take a look at these two boards:
http://www.masmforum.com/
http://board.win32asmcommunity.net/

ZaiRoN
evaluator
06-06-2003, 04:06 AM
ye, Delpih can
mayb, better you switch from masm!?:)

"I am to old" for inject in other forums:(
Please, can you describe how put this .MMX
directive or make for me header..
(but no big prob, do DB..)
FoolFox
06-06-2003, 06:35 AM
Hello,

Originally posted by Fahr
Hmm, interesting; can you let RadASM generate the code for loading the form and handling it automatically? Or do you still have to do it by hand? (If so, I'd rather stick with raw MASM).

- Fahr

Yeah, RadASM come with basic templates, such as dialoggbox,
window squeletton, and the code work as is.

Of course, depending on what you want to achieve, you may
have to add some extra functionnality, handling message, and
so on. If you add a button on the ressource, you'll have to
deal accordingly in your source...

But for little projects, RadASM let you quickly do some windows
stuff...

@evaluator:

you can write the .mmx directive just before the .code directive.

Regards
FoolFox
evaluator
06-06-2003, 02:10 PM
thanx you very match!
this works, also .XMM works

I searched in HLP files about MMX but nothing found.
judge me..

"RTFM or NOT RTFM <- thiS waS a queStion!" (W.FoolFox)
Fahr
06-08-2003, 08:46 AM
Originally posted by ZaiRoN
Hi All,
thx for the explanation FoolFox :-)

To join theory and practice I will add a simple crackme to this thread. This is a simple crackme and, to keygen it, you only need to rip the original code. I decided to attach this type of crackme because I wanted to join this thread with the thread in the newbies forum named "Copying keymaker ASM from Win32Dasm" (http://www.woodmann.net/forum/showthread.php?s=&threadid=4877) (read it, you will find a little hint :-)).
In this way the project is complete and it gives you the possibility to:
- learn to write a win32asm keygen
- learn to rip code from a program

I thought it could be an interesting idea, what do you think?
Let the discussion begin :-)

Good luck,
ZaiRoN

Ok, I did your keygen and it came out nice :)
Except for one little detail :(
For some reason, the wsprintfa doesn't produce a nice 8 digit number, instead it produces the correct serial (first 8 digits) and then keeps repeating the last 5 digits of the serial for numerous times. Anyone care to enlighten me as to what is wrong?

Here is my code and exe:
http://dump.lycantrope.com:5000/keymaker.asm
http://dump.lycantrope.com:5000/keymaker.exe

I know the name is still hardcoded, but this is only a tryout for getting the code. Once it works ok, I'll make it into a nice dialog.

- Fahr
squidge
06-08-2003, 09:12 AM
Try changing this line:

@Buffer db 0

To this:

@Buffer db 20 dup (0h)

That way you have 20 bytes to store the serial, instead of just one :)
diz
06-08-2003, 09:15 AM
First, you are defining buffer which is only 1 byte big:
@Buffer db 0
255 bytes will be more than enough:
@Buffer db 255

Second, this variable will be used for MessageBox which needs string terminated with 0 so you need to initialize this var with zero's:
@Buffer db 255 dup(0)

Now, it will work
Fahr
06-08-2003, 09:16 AM
Well, that worked :P

Guess I need some lessons on reservations still.

Tho, why 20?
Fahr
06-08-2003, 09:17 AM
Originally posted by diz
First, you are defining buffer which is only 1 byte big:
@Buffer db 0
255 bytes will be more than enough:
@Buffer db 255

Second, this variable will be used for MessageBox which needs string terminated with 0 so you need to initialize this var with zero's:
@Buffer db 255 dup(0)

Now, it will work

Ah, so the 20 is not significant. The best thing for memory would be then to make it 8, since the serial is always 8 long...
ZaiRoN
06-08-2003, 12:15 PM
Hi Fahr, The best thing for memory would be then to make it 8, since the serial is always 8 long...Ok, the serial is 8 chars long but you have to remember what diz told you about MessageBox function: the serial must be followed by NULL char (00h).
When you know the size of a buffer, it's better to terminate it with a 00h byte, like you have done for @Name and @Format:
@Buffer db 9 dup(0) ; 9 bytes setted to 00h

ZaiRoN
Fahr
06-08-2003, 12:40 PM
Originally posted by ZaiRoN
Hi Fahr,Ok, the serial is 8 chars long but you have to remember what diz told you about MessageBox function: the serial must be followed by NULL char (00h).
When you know the size of a buffer, it's better to terminate it with a 00h byte, like you have done for @Name and @Format:
@Buffer db 9 dup(0) ; 9 bytes setted to 00h

ZaiRoN

Hmm, isn't it so that 8 in fact MEANS 9? I thought the count starts at 0, see some other ppls remarks on how when it's 0, the size is 1. Makes me think that when it's 8, the size is 9 :P

- Fahr
Fahr
06-08-2003, 01:03 PM
ok, another small thing; how can I check if the string I have in @Name actually is longer than 0? I assume I could copy it to eax and then test eax, eax, but that doesn't seem to work...

- Fahr
squidge
06-08-2003, 02:08 PM
8 will give you 8 bytes, where go from 0 - 7. 9 will give you 9 bytes, 0 - 8.

To make sure the name length is greater than zero bytes, just check the first byte, like so :

mov eax, @name
mov bl, [eax]
cmp bl, 0
je lengthiszero

You may not need the "cmp", but it's best to leave it in there for now.
Fahr
06-08-2003, 02:14 PM
I knew it (about the bytes)

also, on

mov eax, @Serial

it gives the following error:

Keymaker.asm(191) : error A2070: invalid instruction operands

I tried it with offset @Serial en addr @Serial, but both don't seem to work... (no errors, but it doesn't work as it's supposed to (always triggers))

- Fahr
diz
06-08-2003, 03:00 PM
mov eax, dword ptr @Name
mov bl, [eax]
cmp bl,0
..

or the other way:

mov bl, byte ptr @Name
cmp bl,0
..

Like someone proposed to you, you should read some book, you'r smart, you'll get it fast.
Fahr
06-08-2003, 03:08 PM
Thanks that works.

Except for the fact that bl doesn't actually contain the LENGTH of the string (of course). Do I have to loop it till 0 to fetch the length or is there a simpler way (I need to check it against 8)

As for reading books, I'm on it. Reading Krobar's tuts right now, hope it'll provide me with some insight.

- Fahr
diz
06-08-2003, 03:29 PM
Yes, you should compare every character against 0h. If you have text in a editbox (like you final keygen will have, I think) the GetDlgItemText function will return number of characters so you can easily check string lenght while retriving it from editbox.
Fahr
06-08-2003, 03:34 PM
That's not the problem. I know I can read the length from EAX.

The problem is that after generation when it pushes it through a wsprintfA, any zero's in front get cut off. So I want to know the length of the output, if it's less than 8, I have to paste the missing 0s back in front.

- Fahr
diz
06-08-2003, 03:51 PM
Look at wsprintf lpFmt parameter. It will do the job automaticly if you specify right formating.
squidge
06-08-2003, 04:47 PM
To get the length of a string does require a loop, but it's quite simple:

MOV EDI, @buffer
XOR ECX, ECX
DEC ECX
XOR AL, AL
REPNE SCAS BYTE PTR [EDI]
NOT ECX
DEC ECX

Most likely not the most optimised piece of code, but it should work :)

If you just want to pad a hex string with zeroes however, just tell the printf call that you want to do that. Eg:

Instead of %X which will give you (say) 123456
Use %8X which will give you 00123456
Fahr
06-09-2003, 06:01 AM
duh, I should have thought of the %8X (eventhough it's %.8X, otherwise it fills with [spaces] instead of 0s :P)

Anyways, I guess my keymaker is ready.

For the sake of others following this thread, I will post it here, with source and all. Enjoy.

And thanks to all those who helped me put it together :)

- Fahr
squidge
06-09-2003, 07:22 AM
doh! I meant %08X, not %8X otherwise it pads with spaces, like you say. Don't know how %.8X works, but hey, who cares as long as it works :)
Fahr
06-09-2003, 07:51 AM
Hmm, I dunno about %08X, but %.8X works for sure :P

The only thing I'd like to add now is that it generates the serial when you enter something in the box, instead of clicking the 'Generate' button.
A friend of mine told me that I would have to subclass the editbox and write its own message handler... seems a bit too much to me. Any simpler ways?

- Fahr
Fahr
06-09-2003, 08:29 AM
here's a repost of the, slightly altered, keymaker. Previous one was removed because of certain references that I could not include.
squidge
06-09-2003, 09:09 AM
There's a change event from the edit box you should be able to obtain that'll send you a message just like the generate button does when you click it.
ZaiRoN
06-09-2003, 09:11 AM
Hi Fahr, I'd like to add now is that it generates the serial when you enter something in the box, instead of clicking the 'Generate' button.You can use EN_CHANGE message, this message is sent when the user has taken an action that may have altered text in an edit control. Take a look at this snippet:mov eax,uMsg
.IF eax==WM_COMMAND ; wm_command is been received?
mov eax, wParam
.IF ax == IDC_NAME ; IDC_NAME is the name of the edit control
shr eax, 16
.IF ax == EN_CHANGE ; EN_CHANGE is been received?
<the registration name is changed, find the new right serial>
.ENDIF
.ENDIF
.ENDIF
ZaiRoN
Fahr
06-09-2003, 09:57 AM
Cool, that worked :)

I am fully satisfied with the results now :P

Also, does this mean that 'ax' is by default the HIWORD of eax?
And if so, then why shr eax, 16? Why not just read the LOWORD register (al, isn't it?).

Hmm, and I thought it was eax -> ah, al... not ax...

confused yet again :S
diz
06-09-2003, 11:28 AM
------ EAX (32bit) -----
| |
| -------- -AX(16)- |
| | __ __ | | __ __ | |
| ||__||__|| ||AH||AL|| |
| |________| |________| |
|________________________|

well, something like this ;)

there is no direct access to high word of eax, you need to shr it 16 bits (move 16 bits to the right) to move high word to the LOWORD and then read it from ax
Fahr
06-09-2003, 11:58 AM
Hmm, I see. Thanks for the little picture, it makes a lot of things more clear :P

Learned another thing again :)

On learning; I've been digging through some ASM references, books etc. now, but I notice that most of them are AT LEAST 6 years old. On top of that, even more only talk of DOS...

The best I could find so far is:
http://www.arl.wustl.edu/~lockwood/class/cs306/books/artofasm/toc.html

but even that one is 6 years old. Is there nothing more recent?

- Fahr
bart
06-09-2003, 12:18 PM
achi ty utajony satanisto :)
Fahr
06-09-2003, 12:35 PM
Originally posted by bart
achi ty utajony satanisto :)

wtf?
diz
06-09-2003, 12:58 PM
Originally posted by bart
achi ty utajony satanisto :)

nie mow ze ten gosc to achi.. chyba ze mowisz o mnie, jezeli tak to pudlo :)

sorry for non english, it's the last time :P
squidge
06-09-2003, 01:12 PM
Ab ceboyrzf z8, jul qba'g jr whfg gnyx ebg13 vafgrnq - ng yrnfg rirelbar (nyzbfg) haqrefgnaqf vg ;)
Kayaker
06-09-2003, 01:30 PM
Originally posted by squidge
Ab ceboyrzf z8, jul qba'g jr whfg gnyx ebg13 vafgrnq - ng yrnfg rirelbar (nyzbfg) haqrefgnaqf vg ;)

V qba\'g. Bu jnvg n zvahgr... ;)
squidge
06-09-2003, 02:58 PM
:D
diz
06-09-2003, 04:16 PM
BRCRTEUABSTSEOATESXFEAAIE

http://www.randomhouse.com/doubleday/davinci/
pass second riddle to decipher ;)
JMI
06-09-2003, 04:44 PM
et tu Brute?

Regards.
Fahr
06-09-2003, 05:41 PM
A cesar box, very funny

but what is the rest? Gibberish? Or actual encodings?
Fahr
06-10-2003, 04:45 PM
ok, as a going on of this little project, I decided to dig into another program closely related to the original target. I managed to fish out a serial without any problems, I was also able to locate the Keygen call in IDA and name it, etc. etc.

However, putting it to ASM is hell. The entire keygen is full of what seem to be external references (like _strcpy and __isctype, which I can't find in any of the MASM includes (even searched w/o the __)). The most weird things are calls to _malloc and _free. Why on earth would a keygen want to reserve memory? It seems all too weird.

Then there's also calls to things like MulyiByteToWideChar. It seems to me like it's converting from Unicode to Ascii and back...

Anyways, is there any way to include all these functions in MASM, cuz I don't feel like retyping them all when they are probably available in some lib... and is it even NEEDED?

Thanks,
- Fahr
dELTA
06-10-2003, 06:05 PM
MultiByteToWideChar is a normal Win32 API function, and you can thus import it easily from MASM (as with any other API/DLL-call), even without knowing at all what the hell it does if you so please. :p Those string and memory management functions are really easy to emulate, and they should be in every keygenners asm-toolbox anyway, so just start typing (either in your asm editor or in google, both methods will yield complete results quite shortly I'm certain :)). Paste their code here then if you write/download them, it would be a nice contribution to this project anyway. ;)

dELTA
Fahr
06-11-2003, 11:40 AM
Ok, thanks for the suggestions :)

So far I've been able to find _strcpy, that MultiByte thing was a typo on my side... sorry.

malloc and free both appear in HLA Library, but that's a whole other assembler it seems... I don't want to let go of MASM... so I guess I'll type them all over.

Results will be posted here, when done.

- Fahr
Fahr
06-11-2003, 01:41 PM
I'm now more or less copying the code from IDA ASM output 1 on 1, this works ok, except for the fact that one function wants to jump to a label inside another function...

It doesn't seem like MASM understands this too well... so what to do about that?

- Fahr
Fahr
06-11-2003, 03:04 PM
ok, I'm giving up... it's prolly A LOT easier to rewrite this one in a HLL instead of ripping ASM.

I got it running (more or less), but the output is only 000252 (on my name), I traced the problem to some dword var that triggers a jump in the target program, but not in my keymaker. It points to the offset of some __ctype, which is a HUGE var, starting with

unicode 0, < ((((((( H>

and then a buttload of other crap. I don't know where this strange unicode string came from, but it seems totally irrelevant to the actual process. As is 90% of the other crap I ripped, yet it wont run w/o all of it...

So I'm going for HLL, if anyone wants my code so far, just ask and I'll post it.

- Fahr
Fahr
06-11-2003, 03:37 PM
Disregard the above 3 posts;

I DID IT! (woohoo, cheer, cheer). Turns out that unicode string was not a unicode string, but more like some kind of encryption key. Playing around with IDA, I found the option to rightclick it and click 'Data', which turned it into a nice, non-unicode array :)

Pasting that array instead of what I had fixed the problem, just like that :D it gives out fine serials now :D

I will spend the next day or 2 cleaning up my code (it's a terrible, terrible mess, all direct rips from IDA output, etc. etc.) and comment it. Expect it here soonish :)

- Fahr
squidge
06-11-2003, 04:27 PM
Well done :)
dELTA
06-11-2003, 04:47 PM
Ok, nice, but I actually meant to write those functions yourself, not shamelessly ripping the asm code. :D Most of them have really simple functionality, which you can emulate very easily with own functions. You can then use these home-made functions for any keygens having algos referencing them, nice and clean.

dELTA
Fahr
06-12-2003, 02:09 AM
I will polish up those functions and comment them, so I don't see what's wrong with copying them from IDA. I mean; how on earth am I supposed to figure out myself what _malloc is? Especially since that one calls upon many others, like __sbh_page_alloc (or something like that).

Anyways, the functions as I have them work, so I'll seperate them in an includable ASM file for everyone here to use.

- Fahr
dELTA
06-12-2003, 06:26 AM
If you ever made a single C program, you will most likely know what malloc is, believe me. ;) Otherwise you can easily look it up in any C reference (and the same goes for the other functions you mentioned). And as soon as you know what it is, you don't have to care about their underlying implementation anymore (and whatever internal calls it might make).

In the case of malloc, I'd emulate it with a three line wrapper to GlobalAlloc or VirtualAlloc and be done with it. How many lines of code is your ripped _malloc? I would suspect it's more than three lines anyway. ;)

dELTA
Fahr
06-12-2003, 10:46 AM
heh, you're probably right, of course. I might as well mention that I work fulltime as a VC++/PHP programmer, but we mainly do DBase stuff and it's all MFC, so I never actually work with stuff like VirtualAlloc (tho I used it in Delphi in some project a while ago... can't remember what, tho).

Anyways, I'll be sure to figure its works and try to make that wrapper (the calls as IDA ripped them eventually also call VirtualAlloc), as I will with the other calls.

Wish me luck!

- Fahr
ZaiRoN
06-12-2003, 11:28 AM
Good luck :D

Btw, you are doing a great job! Congratulations :-)

ZaiRoN
Fahr
06-12-2003, 11:50 AM
Thanks :)

However, new research shows that that whole _malloc stuff seems totally unneeded. While testing I commented the entire _malloc proc out leaving only this:

_malloc proc
retn
_malloc endp

and it works fine... what to conclude? Am I simply lucky this time? Or is there really actually no need for _malloc (I tried with several names and lengths)?

- Fahr
ZaiRoN
06-12-2003, 12:01 PM
Hi Fahr,
what to conclude? Simple, the program does not use malloc in the name/serial algo, nothing more...

ZaiRoN
Fahr
06-12-2003, 03:03 PM
OK! I figured it. All the Alloc stuff has to do with support for Unicode. Since I have no desire at all to make a unicode keymaker, I will rip out all the unneeded code now (already made my program 3 times smaller in code, with all the IDA crap I didn't need anymore).

Anyways, still working on it, stay tuned!

- Fahr
Fahr
06-15-2003, 01:27 PM
It's finished! :D

Should I strip it of all references to any actual program before posting it? Or can I post it as-is on my own server and link it here?

- Fahr
dELTA
06-15-2003, 01:34 PM
You probably should not post a (link to) working keygen to a specific program here, no.

It's not the end result that matters anyway, it's the journey, and we believe you anyway. ;)

dELTA
Fahr
06-15-2003, 01:37 PM
Of course, I get that. But it's more or less part of this thread. Many people helped me build it.

So is it ok if I just kill off all the official names in it? Or can I post it elsewhere and link here to an external server with a page containing it or what not?

Or what?

- Fahr
dELTA
06-15-2003, 01:40 PM
I guess you can post a link saying "here is a link to my personal server, where you can find further documentation about this project". ;)

But you are of course welcome to share any technical details of cool and useful stuff that you may have learned and/or discovered during this project here, it's just that a working keygen is not really necessary for anything.

And it is of course up to you what kind of PMs you send to people. ;)

dELTA
Fahr
06-15-2003, 01:47 PM
heh, fair enough :P

Well then, here is a link to my personal server containing further documentation on this project, which covers completely fictional programs and their keygenerators.

http://dump.lycantrope.com:5000/keymaker.html

Enjoy,

- Fahr
aerosmith
01-09-2004, 12:37 PM
heh, fair enough :P

Well then, here is a link to my personal server containing further documentation on this project, which covers completely fictional programs and their keygenerators.

http://dump.lycantrope.com:5000/keymaker.html

Enjoy,

- Fahr

Anyone have Farhr work im interested in looking at it all. but the link no longer works.
monguz
01-12-2004, 07:32 AM
The right URL is: hxxp://dump.lycantrope.com/keymaker.html

CU


des modified algo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > des modified algo
PDA

View Full Version : des modified algo

LiSa
05-28-2003, 06:21 AM
hello crypto reversers,

I currently reversing a licencing manager system using dongle/token number scheme

Dongle query give 32 bits hostid : rnbosentinelpro static library
A token (16 hex digit) is asked to the user
hi, crypto reversers,
I currently investigating a custom licence manager scheme using sspro dongle and key (named token) registration
but I am stuck understanding which algo is used....

In the registration process, the token and hostid is passed through Is_token_valid_sub_404070
this procedure call sub_402910 which control that hostid/token pairs are valid
in sub_402910
key1 = set_keys_4028A0(hostid, buffer)
key2 = set_keys_4028A0(81040100, buffer)

hostid is expanded to 64 bits value and submitted to parity checking and return key1
an harcoded value 81040100 is also expanded the same way and key 2 is nreturned

then bool sub_decrypt_and_check_402730 (key1, key2, buffer, token) is called
in these sub are called :

sub_unknown_algo_403DD0 (key2,token, 8, switch=1, product name)
operations on modified token
sub_unknown_algo_403DD0 ((key1,token,8,0, switch=0, productname)
operation on modified token
return good or bad in esi

Is_token_valid_ and rnbo fct can easely be patched to enable the whole stuff but,
I want to understand the inner behavior of sub_403DD0. This procedure use mainly two calls, in
which there are unrolled loop with tons of round which look like a custom DES implementation.
Can you have a look at this stuff

program removed...
LiSa
05-30-2003, 03:01 AM
hello,
...Snatch, Sorry for posting a prg, I won't do it any more...

My problem is now solved : the decrypt and check routine first decrypt at run time the DES S and P tables which are used later to decrypt the token. Dumping these tables, building a correct xor reverse table, including this in rnbo* emulator and a correct tokenlicgenerator for **ilm lic manager is born.

Thanks
LiSa


need help,use SoftIce under win 2003
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > need help,use SoftIce under win 2003
PDA

View Full Version : need help,use SoftIce under win 2003

pLayAr
05-28-2003, 09:28 AM
I use si in win 2003,when si boot, it tell me hook HalpBiosDisplayReset failure, and when a type "addr" & "thread", i can't see which process here (sorry my english is poor), but i found this API in hal.dll

how do i deal with it ? thanks very much
evlncrn8
05-28-2003, 02:10 PM
simple.. wait until a version of softice comes out that is win2003 compatable


Faq forum ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Faq forum ...
PDA

View Full Version : Faq forum ...

Fake51
05-28-2003, 04:56 PM
Just wondering, has the subject of a faq forum been up? I know the "read the faq" part is rather viewable, but seems to me it would be easier to update a faq running, by just moving relevant threads to a faq forum. Noted it, coz of some of the q's in the newbie forum: could be kinda easy to kick em over to a faq forum, and it might be easier for people to figure out.

Flame on, partyppl.

Fake
JMI
05-28-2003, 05:29 PM
Actually we've been kicking around the idea of collecting instructive threads for placement in another Forum, sort of an instructional place and directing people with repeative questions there. Really mostly what you are suggesting, but more an attempt to complie good lessons, rather than simply collecting threads in one place.

Regards.
Fake51
05-28-2003, 06:12 PM
Yeah, that's pretty much what I was thinking about. You've got my thumbs up on that one. Is it gonna happen, or is the idea in the bin?

Fake
JMI
05-28-2003, 06:25 PM
It's going to happen. Someone or several someones simply have to find the time to make the compilations of the "good" stuff. One of the thoughts I had was a compilation of the "Teachings on Asprotect" which would attempt to pull together a collection of the discoveries regarding this protector over time. It would show the evolution of the protection and the schemes used to defeat attempts to discover its secrets. This could be brought forward to the latest discoveries and then those who are new to unpacking and/or this protector would/could be referred to the collection and, only after they have studied what has come before, should they be offered specific help on a particular problem.

The general idea of this approach would be "teaching" how to discover and then to deal with what they find in the code, rather than being provided canned solutions for some specific version of the protector. In this manner the "student" will be encouraged to actually learn how to do it themselves and helped when they actually try and come up against specific problems they don't understand. As the protection evolves, the newer discoveries could be added to the "Teachings" and not have to be set out again and again.

Regards,


qustion with Obsidium
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > qustion with Obsidium
PDA

View Full Version : qustion with Obsidium

Information
05-28-2003, 11:34 PM
this protect is a new one but most interesting!

the code encrypt and import encrypt is very useful and hard to broken.

code: it separate origin code to several small piece code.
import table:scan string and not use the GetProcaddress Api.

my qustion is that bpm breakpoint (hardware breakpoint)and memory breakpoint (cc)is can be detected .

how can i trace such things?

i hope not overrun the rules of the forum
Zilot
05-29-2003, 02:25 AM
What program ?
be more precise.
Information
05-29-2003, 02:43 AM
you will find this interesting protecter!
JMI
05-29-2003, 02:49 AM
The author states:

"Obsidium is a software protection system that was designed as an affordable and easy to implement yet reliable way to protect your software applications from unauthorized modifications (i.e. "cracking"). It is mainly aimed at shareware programmers and companies who would like to provide evaluation versions of their applications. Key features include encryption and compression of application code and data, counter-measures against common attacks, protection SDK, public key licensing system."

There is a download version to play with.

Regards,
Shoob
05-29-2003, 05:40 AM
Seems like it works with the keygen.dll (which is packed which upx) and the tmlib.dll which is needed for the API's?

For the Protector and packed exe files, he only access one time at main code from the ole32.dll then not more. The whole process is processed by the tmlib.dll hook dll <-> goto main but in packed programs you can easily access after some bytes on the main code. example:

Normal :

01012420 > $ 55 PUSH EBP
01012421 . 8BEC MOV EBP,ESP
01012423 . 6A FF PUSH -1
01012425 . 68 20160001 PUSH calc.01001620
0101242A . 68 80270101 PUSH <JMP.&MSVCRT._except_handler3> ; SE handler installation
0101242F . 64:A1 0000000>MOV EAX,DWORD PTR FS:[0]
01012435 . 50 PUSH EAX
01012436 . 64:8925 00000>MOV DWORD PTR FS:[0],ESP
0101243D . 83C4 98 ADD ESP,-68
01012440 . 53 PUSH EBX
01012441 . 56 PUSH ESI
01012442 . 57 PUSH EDI
01012443 . 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
01012446 . C745 FC 00000>MOV DWORD PTR SS:[EBP-4],0
0101244D . 6A 02 PUSH 2
0101244F . FF15 B8100001 CALL DWORD PTR DS:[<&MSVCRT.__set_app_ty>; msvcrt.__set_app_type

Decrypted:

01012420 4F DEC EDI
01012421 94 XCHG EAX,ESP
01012422 96 XCHG EAX,ESI
01012423 49 DEC ECX
01012424 5E POP ESI
01012425 99 CDQ
01012426 F0:8325 A5ABC4D>LOCK AND DWORD PTR DS:[DAC4ABA5],32
0101242E C7C1 0C611232 MOV ECX,3212610C
01012434 6382 FAF525F7 ARPL DWORD PTR DS:[EDX+F725F5FA],EAX
0101243A 6365 63 ARPL DWORD PTR SS:[EBP+63],ESP
0101243D FF21 JMP DWORD PTR DS:[ECX]
0101243F E7 16 OUT 16,EAX
01012441 98 CWDE
01012442 78 47 JS SHORT kalk.0101248B
01012444 A2 0933E288 MOV BYTE PTR DS:[88E23309],AL
01012449 AD LODS DWORD PTR DS:[ESI]
0101244A A5 MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ES>
0101244B EB 2A JMP SHORT kalk.01012477
0101244D C5CC LDS ECX,ESP ; Illegal use of register
0101244F FF15 B8100001 CALL DWORD PTR DS:[10010B8]

<- first real access on main code !
...
...

So Only Problems are:

1. Find OEP
2. Replace first 2Fh bytes of OEP
3. Restore IAT (Seems the hard way cause they are stored in tmlib.dll
Zilot
05-29-2003, 05:44 AM
google search "Obsidium"

you will find this interesting protecter!

:mad: :mad: :mad: :mad: :mad:

my qustion is that bpm breakpoint (hardware breakpoint)and memory breakpoint (cc)is can be detected .
how can i trace such things?

google search:

--->how can i trace such things?<------
Gaia
05-29-2003, 11:15 AM
Obsidium uses stolen techniques (without credits) from Daemon page. Bad idea Martin :D

Gaia
Information
05-29-2003, 07:54 PM
to Soldat:

:D sorry for the google search "XXX" but the forum don't allow direct link so i did it in this way.maybe make you angry.

can you tell me how you trace the app use si?a small piece note is enough.

thanks.

to gaia:
have you unpacked the app?
can you give me some hints?
Zilot
05-30-2003, 04:42 AM
I have no time these days to play with this, but to give you a hint about bpmb.

1. Switch on SuperBpmb and try to run program
2. Close SuperBpmb and notice the difference
Information
06-01-2003, 10:01 PM
i have unpacked one.
evaluator
06-04-2003, 12:27 AM
2 QUESTIONS
to CAIA:
point me, which one of "stolen techniques" you mean? something newest?

to Information:
>>have unpacked one.
??
So after Soldat suggested you "use SUPERBPMB", you quickly unpacked Obsidium?
Or you unpacked NOTEPAD!?
Information
06-04-2003, 01:23 AM
i unpacked the notepad,nice protecter.

before i post this question i have unpacked notepad,for post this thread i want to find a rapid way to unpacked it.
at all,there is many advance reversers on this forum.
Gaia
06-04-2003, 04:26 AM
Hi Evaluator,

"Stole" (in quotation marks) --> use techniques/tricks of others without credits

Gaia
evaluator
06-04-2003, 05:00 PM
to Information:
thanx for answer.

Major thing i like in this Obsidium is image relocating.
Did you try to unpack relocated exe!? enjoe..

to Gaia:
1. I not asked you, what is "stolen".
I asked: which of "stolen techniques" you meet(mean).

2. Harder Question: how you detect TRUE, ORIGIN AUTHOR of some "technique"??
USA PATENT!?
Zilot
06-05-2003, 05:35 AM
Hi !

Nice see you Eval you are interested about this.

So far I concluded next:

1. superBPM are detected and program will not run (that is what I suggetsted to Information)

2. He uses same technics like Aspr to rip OEP and to make code where is jump to EOP everytime on different place. But the bad thing is that I can't catch him how he does that. I tried GetSystemTime, GetLocalTime but nothing. So I'm wondering what is his way to achive such random managing

3. He uses "Ilegal Instruction" UD2 (in this case is 0f,0b) but can be any, to hit his own exception handler. That must be because bpm preserving, I'm not sure. But seems that in exceprion routine he erases bpm set on the beginning and that is why I couldn't catch the ripped OEP.

If you have (Eval) something or anybody some idea about OEP catching say

regards
Zilot
06-05-2003, 07:16 AM
In the mean time I found the way how to locate OEP.

1. Seems that he sets first his own breakpoints and after checks for them, so if there is superBpm switched on he will refuse to run after checking.

2. After checking he erases your bpmb set after that so they thought there was no way to avoid that.

But there is a way, little messy but works. My tactics was next:

1. Load program with Syd's loader and put bpx on ret in VirtualFree. Remember the esp value, with me it was
12ffc4

2. Wait until he breaks on ret in VirtualFree (when he does that it means that own bpmb check out passed and that after that he just erases bpmb)

3. After ret he will be in code and there is 2 bytes jmp
there I locked program with jmp eip and then switch on SuperBmb

4. Then put bpmb 12ffc0 w and SI poped at OEP in ripped code, so there is no need for stoping code jumping
evaluator
06-05-2003, 02:22 PM
blah!

I located "after-OEP" using my tracer..
& I YET NOT located that stolen bytes(i was lazy)!
I set OEP on that continued instruction & my unpacked prog runs.
Curious!?
Nop.

GUYS! BIG PLEASE!
Don't be mystified by future called "OEP ripping".
Because this rip for most compilers does nothing.
You MUST activate your pHuntasy & that will di all..

1. Not found ripped code?
Try without it, maybe will run!

2. Not runs? look at same compilered prog..
3. Write you own code ..
etc..etc..etc..

bE happi!

So for remember for future, ripped OEP is not your main Enemy

Work on this target further, there is many another
things beside OEp..
Gaia
06-05-2003, 06:52 PM
Evaluator, about stolen tricks:

hxxp://www.obsidium.de/phpbb/viewtopic.php?t=4

And some interesting information: (unpacker)

hxxp://disc.server.com/discussion.cgi?id=203830;article=84

I am making a Imprec plugin for wrappeds apis...

Regards,
Gaia
evaluator
06-06-2003, 03:39 AM
GAIA,
there is in german lang, translate..
Zilot
06-06-2003, 04:03 AM
I located "after-OEP" using my tracer..
& I YET NOT located that stolen bytes(i was lazy)!
I set OEP on that continued instruction & my unpacked prog runs.

Nice, but can you send me your tracer to check for it capabilities, I don't remember I've seen that before.

You had luck with stolen bytes because there were I think just two instruction

I'm not quite sure (don't remember well) but think they were

push edx
push 00

maybe some more, but just few of them

And OEP was 9b144a in Obsidium packer, and first Api seems is GetModuleHandle, did you get the same Evaluator ?

So for remember for future, ripped OEP is not your main Enemy

Not at all, but can be very usefull friend, because you can know by that where OEP suppose to be

If you want to send me your tracer
evaluator
06-06-2003, 10:35 AM
SOLDAT,

I see, you not trust in my words, when I recommend something???

>>I think just two instruction

NOP! I AM SURE, there must be more!!
Why?
Because I already recommended you(& other):

DETERMINE COMPILER,
FIND SOME EXE,
COMPILED BY SAME COMPILER,
&&& LOOK AT ITS EIP.

Did I sad before or no?? Look just 3 replay upper!

Now I ADVISE(!) to you this EXERSIZE:
1. DETERMINE COMPILER
2. FIND SOME EXE, COMPILED BY SAME COMPILER
3. LOOK AT ITS EIP & tell me where was true OEP offset+how many instructions ripped

//ye, continued OEP is at XXXX144A

***
about tracer,
OBSIDIUM checks RV by device name..
so if you rename every strings "RvtracerDevice0"
in REVIRGIN.EXE, in TRACER.DLL, in Rvtracer.SYS(here also rename UNICODE string),
you will able use RV for trace, & you will found some tricks..
Gaia
06-06-2003, 12:35 PM
Here a Imprec plugin for Obsidium. Only few apis continue invalid after my plugin. This apis are hooked by obsidium and need manual fix

Evaluator, use a translator (altavista)

Yes, Obsidium checks for \\.\RvtracerDevice0 (win2k) in a thread every 1500 ms

Gaia
Zilot
06-07-2003, 03:37 AM
Evaluator

I see, you not trust in my words, when I recommend something???

I trust you, and you are right that there are more instruction, but I haven't seen yet such compiled by official compilers. Here they are

mov eax, [00a7208b] (in eax will be 0000000)
shl eax,2
mov [00a7208f],eax ( again nothing--> useless)
push edx
push 00

if you don't believe me try to do what I did.

1. Lock the program after reaching code after ret in VirtualFree
2. Switch on SuperBPM
3. Return in SI and put bpmb 12ffc0 r

you will hit mov eax, [00a7208b], and the rest of code is similar like in other cases packed exes, so I'm 90% sure that is the point where he goes on OEP= 9b144a (after some trace you will reach OEP continued)

Why is not possible they wrote first several bytes in their packer just to look different as usual ?

Thank for the tracer hint, will try to manage that.
Will that work with any packer after that ?
evaluator
06-07-2003, 05:28 AM
SOLDAT,

until you not finished YOUR EXERSIZE(in all 3 steps),
I am closed for you:)

PS:
I know, in your PC is at least 1 EXE, same compiler compiled..
bart
06-07-2003, 05:37 AM
standard oep from bcc (builder)

.00401012: A1C3734900 mov eax,[004973C3]
.00401017: C1E002 shl eax,002 ;""
.0040101A: A3C7734900 mov [004973C7],eax
.0040101F: 52 push edx
.00401020: 6A00 push 000
.00401022: E82B490900 call GetModuleHandleA

am i rite? :rolleyes:
Zilot
06-07-2003, 06:58 AM
Evaluator, don't be angry.http://images.bravenet.com/brpics/smilie/wave1.gif

Seems Bart has overcome me in my exercise. You must give then to me something more to make you open for further coperation.

Seems I lack expirience with compilers, is that so bad ?

I know, in your PC is at least 1 EXE, same compiler compiled..

Hmm, I'm wondering how many files form Winnt dir I have to load to find out that. http://images.bravenet.com/brpics/smilie/28_spin.gif
bart
06-07-2003, 08:02 AM
Hmm, I'm wondering how many files form Winnt dir I have to load to find out that

you wont find any bcc file in your winnt directory, guess why ;) (except uninstallers)
JMI
06-07-2003, 02:23 PM
I believe what our Musician Friend is trying to tell you is that the different compilers for Windows programs have "patterns" at OEP which can be "recognized" for RCE purposes. Many of the "automatic pilot" OEP finder- Dumper programs search for these "patterns" to find the "OEP."

Protection Programers, recognizing that RCE's use these "patterns" to locate the "OEP" try different methods to "confuse" or "disguise" that code so "dumpers" and the unschooled can't locate this point as easily. If you've read some of +Spl/\j's discussions you will recall discussion of "signature bytes." These are "patterns" that identify the "protector" is about to, or has jumped to the OEP.

Ripping, generally means that the protector has taken a piece of the compiler specific code that represents "OEP" and had moved part of it somewhere else to confuse the "innocent." But the "fact" remains that the program, compiled by a specific compiler" needs that piece of code to "hit the starter button," to use an automotive analogy.

The protector can "steal" a few of the bytes of this "starter" and move it somewhere else in its own code (or maybe even an attached dll) and jump back to the "target" or it could execute the entire "starter" and jump back to the following code. Maybe they get really clever and write some different "looking" code that does the same thing as the "original."

Now if you have studied various compiler-specific code for OEP and are looking at a “target” and see “part” of the code for a specific compiler’s OEP, do you not then “already” know what the “missing” bytes need to be? So Eval suggests you might “write your own” as in “jump somewhere” create your own damn OEP code, filing in your own knowledge of the “missing” bytes” and then “jump back” to the code that comes next.

Now, granted, this may be a hell of a lot of more work in the beginning than having someone else “tell” you, here, or in a dumper,” where the OEP is and what it needs to contain(i.e. “missing bytes”), but then, when the protector changes the technique again “you”are screwed again and "once again" you do not know “Mr. Jack Sh*t.) :confused:

Eval suggests that there should be other “execs” (i.e. other programs) on your machine that have been compiled by the same compiler, for your studying pleasure. “These” programs are usually NOT protected and you can “look” at the OEP to your heart’s content, (i.e., study them). :D

“Impatience” leads to only wanting to solve “this” program “right now.” “Patience” leads to acquiring the skills to solve “this” program and, most “others,” in the future. “Your” choice. :)

Regards.
Zilot
06-08-2003, 10:29 AM
http://images.bravenet.com/brpics/smilie/surprise.gif
evaluator
06-08-2003, 03:27 PM
SOLDAT,

don't look at bart, yet you have chanse!
search for that one EXE, >1mb..(why in \winnt??)
Zilot
06-09-2003, 04:10 AM
Now I'm serious

Don't have time two days more because faculty obligations http://images.bravenet.com/brpics/smilie/17_wink.gif

But as soon as I finish with that will contue to play with this http://images.bravenet.com/brpics/smilie/user.gif

I started to rebiuld IAT and in first try found about 49 APIs, patch I wrote in memory didn't handle calls through memory so I lacked to catch all of them. But will continue to play around.
Especialy am interested because code relocation and almost whole exe rebulding manually http://images.bravenet.com/brpics/smilie/bouncer.gif

So will ask for help if fail somewhere http://images.bravenet.com/brpics/smilie/banghead.gif
Zilot
06-09-2003, 10:28 AM
Gaia !

Your plug doesn't work on win2K (with unpacking obs packer). Did you plane it in that direction or ........
^DAEMON^
06-10-2003, 04:04 AM
quite nice discussion you started here... i like it :)

probably (when i feel it's time to... (this can take a few months (years ?))) we'll release the unpacker for it...

obsidium is a quite cool protection system, the author deserves the money (guess he invested really much time in this project it)

^DAEMON^
Gaia
06-10-2003, 09:48 AM
Hi Soldat

My SO is win2k(SP3) and the plugin works perfectly. Have you indicated the IAT RVA in Imprec correctly?

Gaia
Zilot
06-11-2003, 09:26 AM
I'm pretty sure about IAT

was on A85000 (685000 RVA) . And now I'm confused a bit. http://smilies.sofrayt.com/%5E/_950/upset.gif
When I wrote a patch as I said I found only several APIs, will improve my patch.

If you wanna see here is semi-resolved IAT
Zilot
06-11-2003, 11:54 AM
Gaia !
I was wrong about your plug http://smilies.sofrayt.com/%5E/q/rotz.gif

It works (I realized it later) but should be used one by one entry in IAT

I don't know how did you manage that, but there are enries when you use plug, program will terminate.
And that's why thought it doesn't work, firstly I selected all invalids and then, because there is one "uresolvable" API on the beginning, I conluded wrong.

What's with that APIs, some of them I found through patching (will attach that patch when solve calls through memory, now it manages only direct calls and half of redirected ALPis are resloved after this)

Do you force calls in IAT and in that way find APIs, or you do different. If you want send me source.
In regular work he overwrites calls with redirecting jumps addresses with original ones, maybe this was problem with several uresolved APIS, and program blokade after plugging
Gaia
06-11-2003, 05:08 PM
See your pm Soldat

Gaia
evaluator
06-12-2003, 01:13 AM
every last thunk in each DLL imports is..
debug it..
Zilot
06-13-2003, 05:59 AM
Gaia I improved your resolver http://smilies.sofrayt.com/%5E/r/bigstar.gif
with several emulated APIs, and the rest of them (1 or 2 ) are emulated too, but it didn't match the concept previously adopted so they can't be resolved yet (I sent you a source and hope you don't mind because I attached this dll here, without your permission)

one of them in Kernel32 is FreeResource (easy to be caught by name)

xor eax, eax
ret4

and the other one is emulated too, but I didn't trace for it http://fool.exler.ru/sm/bud.gif

I didn't undedstand you well about hooikng by Obsidium several unresolved APIs. What did you mean? http://smilies.sofrayt.com/%5E/_950/upset.gif

Evaluator http://fool.exler.ru/sm/git.gif

I'm waiting for your opinion or critics. I hope now I don't have to do my execrise about compiler, but if you are still unsatisfied then must do
http://fool.exler.ru/sm/kngt.gif
Zilot
06-17-2003, 10:07 AM
Evaluator !

I have question for you. Till now I haven't buckled with unpacking Obsidium, just with API redirection.

How did you solve IAT rebuilding

I attached Region009B0000-00A88000.dmp (I'm not sure if this was the only section to be attached, but just to try out)
From last dumped section in OBsDumped.exe to RVA 6B0000 I added zero filled section, after that I attached Region009B0000-00A88000.dmp. Then tried to add in usual way with ImpRec resolved IAT, but he didn't want to correct jmps to last added section by ImpRec.

All jumps stayed as before, to previous IAT generated by Obsidium.

Then tried just to replace redirected bytes like 7exxxx in
correct bytes (API pointers) with option in ImpRec "Create New Iat " disabled, and RVA 685000 as you have when file is packed.

But he did something well, but some locations were full of junks. ??? Also screwed dll names in names part ?
evaluator
07-31-2003, 08:41 PM
mostly i'm not imprec user.
sometimes, for be more sure in correctness,
i use it for compare results.

yep, attacments not works. later..
Zilot
07-31-2003, 09:26 PM
Long time has passed !!
Thanks friend for replay. After my question I succeeded to fix everything, IAT and to solve problem with relocation.
I can send to you fixed version, I secceeded to remove ugly message on every packed program about packed with Demo Version of Obsidium.

If you want mail me on , of course if you hadn't time to fix it by yourself.

Regards
evaluator
07-31-2003, 09:41 PM
congratz!

But in all aspects you solve?

Test this:
produse some key in Obsi, then open
it's registration form, paste key here.

Look what happens.
Shoob
07-31-2003, 11:29 PM
wb guys

00686268 55 PUSH EBP
00686269 EB 02 JMP SHORT 0068626D
0068626D 8BEC MOV EBP,ESP
0068626F EB 02 JMP SHORT 00686273
00686273 6A FF PUSH -1
00686275 /EB 02 JMP SHORT 00686279
00686279 68 88180001 PUSH 1001888
0068627E EB 02 JMP SHORT 00686282
00686282 68 D0650001 PUSH 10065D0
00686287 EB 04 JMP SHORT 0068628D
0068628D 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00686293 EB 01 JMP SHORT 00686296
00686296 50 PUSH EAX
00686297 EB 01 JMP SHORT 0068629A
0068629A 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
006862A1 EB 03 JMP SHORT 006862A6
006862A6 83C4 98 ADD ESP,-68
006862A9 EB 03 JMP SHORT 006862AE
006862AE 53 PUSH EBX
006862AF EB 01 JMP SHORT 006862B2
006862B2 56 PUSH ESI
006862B3 EB 03 JMP SHORT 006862B8
006862B8 57 PUSH EDI
006862B9 EB 04 JMP SHORT 006862BF
006862BF 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
006862C2 EB 04 JMP SHORT 006862C8
006862C8 C745 FC 0000000>MOV DWORD PTR SS:[EBP-4],0
006862CF EB 03 JMP SHORT 006862D4
006862D4 6A 02 PUSH 2
006862D6 EB 04 JMP SHORT 006862DC

after tracing my protected app some bit i saw that the "stolen bytes" are processed before returning to oep (like old aspr) so if you subract from EP 2f bytes and insert stolen without jmps you have your OEP ;) not new news for everbody but cheers
Zilot
08-01-2003, 06:43 AM
But in all aspects you solve? Test this:produse some key in Obsi, then open it's registration form, paste key here.

No I didn't try anything with keys. What happends there with that.?
My version of Obsidium was attached on www.wasm.ru, and I signed as Zilot there. Dunno if is still there.
evaluator
08-01-2003, 08:19 AM
> What happends there with that?

Do that & you will see.

PS. seems search function not works in that forum, so not found your..
make direct link to thread.
Zilot
08-02-2003, 01:41 AM
NO there wasn't thread. It was attached in tools section. But seems Volodya has deleted it. If you want leave me your mail will send to you ( don't afraid I'm not virus or spam man )

And you want to torture me a little bit request to try key functionality. Have no time to play with, so that's why I asked to tell me.

Is there some new packer, last I dealt with was ACProtect packer, but again I didn't resolve key managing. Interesting stuff, he has some code ripping liike BitArt, but I wrote patch (code) in memory to back old bytes. And he ripped only 5 bytes instructions, and then had table resembles IAT redirection table.
Try interesting........
nikolatesla20
08-27-2003, 07:45 PM
nice one, ACProtector. I found the 5 byte ripper and wrote an external program to fix my dump. Easy :) IAT is simple to recover with ImpREC 1.6. I've unpacked the ACProtect application itself now too.

I DO have to say the byte ripper is a cool idea, but its been done everywhere already (SafeDisc, etc.)

-nt20
Zilot
08-29-2003, 03:58 AM
Tesla, you are right about 5 bytes ripper. I didn't fix dump, but I wrote code into memory before OEP reaching to do that for me. To recover original bytes. So had clear dump.

Attach your program in case to find some application packed with this.

Zilot
nikolatesla20
08-29-2003, 11:04 AM
I would rather send it to you privately. Don't need to be helping out protection authors by giving them my information.

-niko20
nikolatesla20
08-29-2003, 03:02 PM
You may find this screenshot of information interesting.

Just look at this for a little while and think, and you can probably come up with a way to fix these ripped bytes. My Auto-Fixer was based off of this info.

http://webpages.charter.net/nikolatesla20/ACProtectNotes.gif

-niko20
Zilot
08-30-2003, 04:33 AM
Yes that is exactly the way how I managed bytes ripping. I searched for calls and after checking for ff25 I was sure it was right place . I should've saved my asm lines. Anyway you can send me your fixer

And your excuse for not attaching your tool is more than good. For Long time I haven't visited forum, and almost forgotten about curious eyes of protector maker.
nikolatesla20
08-30-2003, 10:07 AM
Its written in Visual C, will that be useful to you ? I don't use ASM as much because there is no real size/speed increase over plain C code, and C is easier to read.

I'll try and send it soon.

-niko20
Zilot
08-30-2003, 11:43 AM
Of Course will be interesting,
do you make your programs in Object Oriented manner, or in procedural?
nikolatesla20
08-30-2003, 01:44 PM
for projects such as this, I use procedural.
nikolatesla20
08-30-2003, 03:32 PM
Here's the code

This is all manually set up. In my unpacker its ALL automatic now, using code similar to this.

You have to enter hardcoded values and recompile for now, this was my test project (although it does work)

-nt20
Shoob
08-30-2003, 04:38 PM
Works very good :) after i got no answer from you i thought you was gone ;) thanks for sharing your source makes life easyer.
Zilot
09-01-2003, 12:43 PM
Thanks Tesla.

Will see it later http://smilies.sofrayt.com/%5E/r/happy.gif
volodya
09-01-2003, 09:23 PM
Zilot, my friend, glad to see you and thanks for your help with linked lists. Concerning your question about Obsidium on wasm. It is still there, I didn't remove it. You are able to find it at
hxxp://www.wasm.ru/toollist.php?list=12

BTW, interesting topic. I'm watching it with pleasure.
Zilot
09-03-2003, 02:44 AM
Batchushka ? http://smilies.sofrayt.com/%5E/y/kiss.gif
volodya
09-03-2003, 10:14 AM
Exactly, the beleiver in aliens :)
Zilot
09-04-2003, 04:17 AM
http://smilies.sofrayt.com/%5E/u/grdmartien.gif http://smilies.sofrayt.com/%5E/u/alieneyesa.gif http://smilies.sofrayt.com/%5E/u/faga.gif http://smilies.sofrayt.com/%5E/u/ptitmartien.gif
dELTA
09-04-2003, 07:16 AM
Ok guys, get a room... Or at least take it to the off-topic forum or PM. :D

dELTA


Searching the windows “wrong serial” under softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Searching the windows “wrong serial” under softice
PDA

View Full Version : Searching the windows “wrong serial” under softice

newbcrk
05-29-2003, 09:15 AM
Searching the windows “wrong serial” under softice
Hello I do this to my messagebox

1/press F12 and put breakpoint on each call
2/Last F12 "wrong serial"-window pops up. At 0042D615 so breakpoint
3/Trace with F10 ; "wrong serial"-window pops up at 0042D674
4/Step into the call (F8)at 0042D674
5/ Delete or disable the breakpoint 0042D674
6/ trace on with F10 ; put breakpoint on each call
7/Lot of call so breakpoint
8/at 44FE73 windows pops but brieffly only so F8 in this call and trace with F10 all the time I return 44E73
9/meet a loop do beginning in 44E73 at 44FBE1 that I can’t leave .
Finally the window “wrong serial” never , never appears
How to find the last line wich pops the nag-screen ?

:U 0044FE73 L FF

017F:0044FE73 E8E4300000 CALL 00452F5C ;; step in with F8
;; I find 2 Calls and a call user32SeekmessageA and that's all ;my message box don’t pops

017F:0044FE78 8B03 MOV EAX,[EBX]
017F:0044FE7A 80B89C00000000 CMP BYTE PTR [EAX+0000009C],00
017F:0044FE81 740F JZ 0044FE92
017F:0044FE83 8B45FC MOV EAX,[EBP-04]
017F:0044FE86 C7804C02000002000000MOV DWORD PTR [EAX+0000024C],000000
017F:0044FE90 EB14 JMP 0044FEA6
017F:0044FE92 8B45FC MOV EAX,[EBP-04]
017F:0044FE95 83B84C02000000 CMP DWORD PTR [EAX+0000024C],00
017F:0044FE9C 7408 JZ 0044FEA6
017F:0044FE9E 8B45FC MOV EAX,[EBP-04]
017F:0044FEA1 E836FDFFFF CALL 0044FBDC ;; can't access without
; r fl z

017F:0044FEA6 8B45FC MOV EAX,[EBP-04]
017F:0044FEA9 8B804C020000 MOV EAX,[EAX+0000024C]
017F:0044FEAF 85C0 TEST EAX,EAX
017F:0044FEB1 74BE JZ 0044FE71
;; jump above all the time (loop do )
017F:0044FEB3 8945F8 MOV [EBP-08],EAX
017F:0044FEB6 6A00 PUSH 00
Fake51
05-29-2003, 11:05 AM
Have you checked what kind of window it is? Is it a message box? A dialog? Normal window?

Try breaking on the call to create it instead. Try messagebox calls first (if it's a messagebox) then go for createwindowex and check the stack for the title. You just might find the exact call that creates your nag window. From there trace out and get an overview of the code.

Fake
newbcrk
05-30-2003, 03:43 AM
In WINDASM , the menu function/import gives me user32.messageboxA
but
under Softice bpx messageboxA don't break ,strange otherwise bpx sendmessageboxA breakes .
I have try too hwnd wich says TmessageForm
I do bmsg CF4 wm_destroy wich breakes but without clicking on the "OK" button .Strange too .
How was I be able to find the kind of my window ?
The crackme is given in attachement , it is packed with upx


to understand a break and a API
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > to understand a break and a API
PDA

View Full Version : to understand a break and a API

newbcrk
05-30-2003, 03:59 AM
Hello , could you explain what I have done with this crackme .

The crackme is given in the post "searching wrong serail under softice"

, it is packed with upx

I do this

Bpx getwindowtextA

017F:00452C3C 80BBA400000000 CMP BYTE PTR [EBX+000000A4],00
017F:00452C43 7420 JZ 00452C65
017F:00452C45 6800010000 PUSH 00000100
017F:00452C4A 8D442404 LEA EAX,[ESP+04]
017F:00452C4E 50 PUSH EAX ;;don’t understand EAX = 21 = maximum numbers of characters but I can type more than 21 characters in my buffers and wich buffer I have got three buffers

017F:00452C4F 8B4330 MOV EAX,[EBX+30]; don’t understand
;; I am waiting at a string by typing d eax or d ebx+30
017F:00452C52 50 PUSH EAX ;; EAX = 21 strange handle isn’t it ?
017F:00452C53 E83C41FBFF CALL USER32!GetWindowTextA I land here
;; I have enter in this call nothing interest I land in a file user32 , I type F12 a JMP and I land after the call ; This could why the parmeters are not useful
;;

int GetWindowText(
HWND hWnd, // handle of window or control with text
LPTSTR lpString, // address of buffer for text
int nMaxCount // maximum number of characters to copy
);

017F:00452C58 8BC8 MOV ECX,EAX
017F:00452C5A 8BD4 MOV EDX,ESP ;; d edx = name of my window ; strange I am waiting a text buffer not a text window
017F:00452C5C 8BC6 MOV EAX,ESI ;;EAX = adresse of a handle ?
017F:00452C5E E8D516FBFF CALL 00404338
017F:00452C63 EB0D JMP 00452C72
017F:00452C65 8BC6 MOV EAX,ESI
017F:00452C67 8B938C000000 MOV EDX,[EBX+0000008C]
017F:00452C6D E82A16FBFF CALL 0040429C
naides
05-30-2003, 09:53 AM
Originally posted by newbcrk
Hello , could you explain what I have done with this crackme .

The crackme is given in the post "searching wrong serail under softice"

Bpx getwindowtextA

017F:00452C3C 80BBA400000000 CMP BYTE PTR [EBX+000000A4],00
017F:00452C43 7420 JZ 00452C65
017F:00452C45 6800010000 PUSH 00000100 FIRST PUSH, AND LAST PARAMETER FOR GetWindowText : Maxcount == 100h
017F:00452C4A 8D442404 LEA EAX,[ESP+04]
017F:00452C4E 50 PUSH EAX ;;don’t understand EAX = 21 = maximum numbers of characters but I can type more than 21 characters in my buffers and wich buffer I have got three buffers

ARE YOU SURE EAX HOLDS 21 AT THIS PARTICULAR MOMENT?? I THINK IT HOLDS THE VALUE STORED IN ESP+4 WHICH IS THE SECOND PUSH, SECOND PARAMENTER == address of text buffer

017F:00452C4F 8B4330 MOV EAX,[EBX+30]; don’t understand
;; I am waiting at a string by typing d eax or d ebx+30

NOW THE FIRST PARAMETER GETS MOVed TO EAX, THE handle

017F:00452C52 50 PUSH EAX ;; EAX = 21 strange handle isn’t it ?

AND GETS PUSHED. REMEMBER THAT THE PARAMETERS ARE PUSHED IN REVERSE ORDER AS THE DECLARATION

017F:00452C53 E83C41FBFF CALL USER32!GetWindowTextA I land here
;; I have enter in this call nothing interest I land in a file user32 , I type F12 a JMP and I land after the call ; This could why the parmeters are not useful
;;

YOU ARE RIGHT, THRE IS NOTHING FOR US INSIDE THE SYSTEM DLLS

int GetWindowText(
HWND hWnd, // handle of window or control with text
LPTSTR lpString, // address of buffer for text
int nMaxCount // maximum number of characters to copy
);

017F:00452C58 8BC8 MOV ECX,EAX
017F:00452C5A 8BD4 MOV EDX,ESP ;; d edx = name of my window ; strange I am waiting a text buffer not a text window
017F:00452C5C 8BC6 MOV EAX,ESI ;;EAX = adresse of a handle ?
017F:00452C5E E8D516FBFF CALL 00404338
017F:00452C63 EB0D JMP 00452C72
017F:00452C65 8BC6 MOV EAX,ESI
017F:00452C67 8B938C000000 MOV EDX,[EBX+0000008C]
017F:00452C6D E82A16FBFF CALL 0040429C

I THINK YOU NEED TO PLACE A BPX AT 017F:00452C3C THEN SEE THE PARAMETERS THAT INDEED GET PUSHED INTO THE STACK BEFORE THE getwindowtextA CALL AND YOU WILL REALIZE THE ADDRESS FOR YOUR KEY IS PUSHED INTO THE STACK AT 017F:00452C4A

I USED UPPERCASE BECAUSE I AM KINDA DEAF AND I LIKE TO SCREAM
newbcrk
05-30-2003, 12:56 PM
Keep cool .Thanks


frogsice documentation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > frogsice documentation
PDA

View Full Version : frogsice documentation

nino
05-30-2003, 03:17 PM
I've done an extensive search in this forum and on the net before making this post so plz don't tell me to continue searching. ;)
I've never used frogsice before but it has come the time. Unfortunately the zip does not include any documentation on its use; just the loader, vxd and a readme of what has been fixed.
I already know it has been outdated. Its home page turns to be a forum from the author. Any info on its options is welcome. Only found 1 page but don't understand chinese. :(
Kayaker
05-30-2003, 03:33 PM
Hi

Here's the normally included frogsice documentation files v1.08.8, for future reference.

Kayaker
nino
05-30-2003, 09:03 PM
Hi
Thanks. That is what I was looking for. Strange it was not included in the latest version most sites carry.
Thanks again


Removing useless code from dumped exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Removing useless code from dumped exe
PDA

View Full Version : Removing useless code from dumped exe

diz
05-30-2003, 05:35 PM
I think this is somewhat related to unpacking so I post here.

I would like to remove code from dumped exe, which after unwraping is no longer needed (armadillo junk).
Now, I don't know what to do to change all references to data which is AFTER this sections. I can remove .text1, .data1, .pdata which I suspect are armadillos sections. Unfortunetly the last is followed by .rsrc and of course I would like to keep it ;).

Are there any tools to find all references to this section and substract given value or something?
doug
05-30-2003, 06:00 PM
a quick work around for this that doesn't require any knowledge about the rsrc would be to add the virtual size of the section u wish to remove to the section right before. Strip this section & modify raw offsets of the sections that follow the stripped one..

I might be missing a couple details.. but that should give u a general idea.
diz
05-30-2003, 06:28 PM
Thanks, it will do.

However it still takes memory space.
Further improving of this exe would be nice but that's better than nothing :)
Dr.Golova
06-04-2003, 09:25 AM
Originally posted by diz
Thanks, it will do.

However it still takes memory space.
Further improving of this exe would be nice but that's better than nothing :)

hxxp://www.reversing.net.ru/tools/062002/resrebld.zip
Mmm, resources rebuilder by me =)
can move resources to new rva, no english doc, sorry
use: resrebld.exe my_dump.exe new_res.bin -a:0x2000 -r:0xA000
-a:0x2000 - align output data to 0x2000 bytes, just for easy paste to dump
-r:0xA000 - recalc all rva in resource section to 0xA000 (new .rsrc section rva)
and you get new_res.bin with coagulated resources section prepaired for attaching to dump as new section with rva==a000h
diz
06-04-2003, 11:55 AM
Thanks, now it's fully optimised ;) Uses 1.5MB less of virtual memory on startup :)
JMI
06-04-2003, 12:20 PM
With each year that passes, my brain seems to use 1.5 mb less virtual memory on startup. :D Only now I can't remember why that happens. What were we talking about? :p

Regards,


Help me Unpack this Packer!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Help me Unpack this Packer!!!
PDA

View Full Version : Help me Unpack this Packer!!!

AntiCrk
05-30-2003, 09:06 PM
Hi!

I'm new member in this forrum.

Please help to to Unpack this Unpackme.

Thank!

Best regard.
artik
05-31-2003, 06:30 AM
hehe, it's just
UPX 0.89.6 - 1.02 / 1.05 - 1.22 (Delphi) stub -> Markus & Lazlo
so don't worry there are many tutorials about unpacking UPX

i think you can find what you need at hxxp://new2cracking.cjb.net or hxxp://zor.org/krobar

good luck! ;)
r4g3
05-31-2003, 07:05 AM
CALL Unpackme.00463CD6: in - edi points to function name, on return its addr in eax.

00463C9D FF95 80744000 CALL DWORD PTR SS:[EBP+407480] ; kernel32.CreateThread

at this point go to stack window:

0012FF94 00462370 Unpackme.00462370

its a callback function for new thread, bpx on it. Then run the target with F9. Once u land on new bpx you are at the start of unpacking code.
IAT is constructed at the end:

00462492 LEA EDI,DWORD PTR DS:[ESI+5F000] import table
00462498 MOV EAX,DWORD PTR DS:[EDI]
0046249A OR EAX,EAX
0046249C JE SHORT Unpackme.004624DA
0046249E MOV EBX,DWORD PTR DS:[EDI+4]
004624A1 LEA EAX,DWORD PTR DS:[EAX+ESI+62A04]
004624A8 ADD EBX,ESI
004624AA PUSH EAX
004624AB ADD EDI,8
004624AE CALL DWORD PTR DS:[ESI+62AA4] ; kernel32.LoadLibraryA
004624B4 XCHG EAX,EBP
004624B5 MOV AL,BYTE PTR DS:[EDI]
004624B7 INC EDI
004624B8 OR AL,AL
004624BA JE SHORT Unpackme.00462498
004624BC MOV ECX,EDI
004624BE PUSH EDI
004624BF DEC EAX
004624C REPNE SCAS BYTE PTR ES:[EDI]
004624C2 PUSH EBP
004624C3 CALL DWORD PTR DS:[ESI+62AA8] ; kernel32.GetProcAddress
004624C9 OR EAX,EAX
004624CB JE SHORT Unpackme.004624D4
004624CD MOV DWORD PTR DS:[EBX],EAX Write function addr
004624CF ADD EBX,4
004624D2 JMP SHORT Unpackme.004624B5
004624D4 CALL DWORD PTR DS:[ESI+62AAC]
004624DA POPAD
004624DB JMP Unpackme.0044DD50 jmp to OEP

dump it on oep. reconstruct imports. thats all.
nothing special, but is it really upx as hardcore peid scan says ?
ZaiRoN
05-31-2003, 07:57 AM
Hi!

AntiCrk, you have found a very interesting target, it would represent a nice project on 'manual unpacking for newbies'. :-)

Rage has conceptually said all but I would like to encourage newbies to ask questions about:
1. tools to be used
2. how to find oep
3. how to dump the exe
4. how to reconstruct imports
and so on...

Ciao,
ZaiRoN
hobferret
05-31-2003, 02:45 PM
Hi AntiCrk

A useful suggestion for this, having read what others have said about it, would be to "bpx GetModuleHandleA". When it breaks press F12 2 or 3 times to return to the program thread. There should be a call above where you land!

The OEP is usually 10h to 15h above where you are, if you can't see it by scrolling up do a u [address-10h] e.t.c and you should find it.

The reason for you not being able to see it directly is because the code gets obfuscated i.e. the address you look at is not necessarily the correct instruction!:mad:

/hobferret
AntiCrk
06-02-2003, 07:58 PM
Hi There!

That's a good Idea!
I tried it very long time, I Unpacked it but it not run.

I think after unpack this unpackme We must patch some where in the CODE section.
Can you help me? If you Unpacked it, Please upload to the forum

Thank very much!

I'm Vietnamese so I speak English not well, I'm sorry!!!

Best regard!

;) :rolleyes: :rolleyes:
sv
06-03-2003, 02:18 AM
Hi all

'I think after unpack this unpackme We must patch some where in the CODE section.
'
Look at :
0044DB1B A1 44ED4400 MOV EAX, DWORD PTR [44ED44]
0044DB20 66:8338 03 CMP WORD PTR [EAX], 3
0044DB24 75 1B JNZ SHORT 0044DB41
0044DB26 A1 48ED4400 MOV EAX, DWORD PTR [44ED48]
0044DB2B 8138 043C0600 CMP DWORD PTR [EAX], 63C04
0044DB31 75 0E JNZ SHORT 0044DB41
0044DB33 EB 02 JMP SHORT 0044DB37

Try to find what is checked ;)
Regards

SV
AntiCrk
06-04-2003, 07:39 PM
Hi!
Great!!!!!!!!!!.
It's run very cool.

Thank!
Best regard!
;) :( :(


AsProtect 1.2x [New Strain]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AsProtect 1.2x [New Strain]
PDA

View Full Version : AsProtect 1.2x [New Strain]

ByteL0rd
05-31-2003, 08:37 AM
Hi,
I've got a file which is packed with AsProtect 1.2x [New Strain] ,with what progg can I unpack it? I tried it with caspr but this always said: failed!! fuile not packed with .... .
Can someone help?
nikolatesla20
05-31-2003, 08:45 AM
*ahem* use the search button on the top of the forum and search "asprotect" and "unpacking", and you will find it what you need. Doing a little work will only help you grow in your own knowledge, which is never a bad thing.

-nt20
P0001
05-31-2003, 09:13 AM
You can use Sourcer 7.0 which i am not bit sure can unpack it
but The Best one can do The "TRON".

Best of Luck!!!
ByteL0rd
06-01-2003, 10:58 AM
thanks P0001 but Sourcer 7.0 and TRON didn't succeed.

@nikolatesla20: I never did manual unpacking and I'm a total newb in cracking and don't have any idea to break this packer without a program,which does this.
dELTA
06-01-2003, 11:06 AM
Then I'd say now is a good time to start reading... ;)

dELTA
squidge
06-01-2003, 03:41 PM
ByteL0rd : then may I suggest you download UPX, compress a small file, and unpack it with something like Ollydbg ? This is one of the easiest packers to unpack. Once you are done with that, gradually move on to the more complex packers, such as ASProtect (Funky rebasing code), Armadillo (Nanomite fun), etc.
ZaiRoN
06-02-2003, 05:57 AM
Hi!
squidge is right!
ByteL0rd, maybe you have not noticed it yet but in the mini project area there is a little thread designed for those who have not unpacked a single file in their life. It could be a way to learn from basic target.
http://www.woodmann.net/forum/showthread.php?threadid=4860

ZaiRoN
ByteL0rd
06-02-2003, 11:42 AM
thanks mates! I'll try this unpackme!


Strange HASP check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Strange HASP check
PDA

View Full Version : Strange HASP check

GaBOSS
05-31-2003, 02:36 PM
verry strange part of program who InstallShield use to check for hasp dongle.
if detect Soft-ice in memory - exit from program. I try to use FrogIce and IceDump to hide Soft-Ice, but when try to start program, Windows freeze.
can some help me
sope
06-01-2003, 06:09 AM
Hello GaBOSS

Set bpx on FreeEnvironmentStringsA return F8 F8 EAX should be 1 check what happens next.

How about doing the required groundwork of studying/searching more before posting & showing your efforts on target.

Regards
Sope!
dee
10-05-2003, 10:45 AM
you are trying to crack [TARGET NAME DELETED by JMI] right?:)

do not waste your time if you have no original dongle:) becasue there are some files after instaliation crypted with Alladdin HASP/Hardlock crypter;) and cannot be unpacked without original dongle.

And to bypass this check just return eax=1 from at the IsHasp() check;) but there will be more checks after:)

Best Regards


Audio plugin (VST)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Audio plugin (VST)
PDA

View Full Version : Audio plugin (VST)

kyrios
05-31-2003, 02:38 PM
Hi,

recently i tried VST plugin. Almost all of them use these scenes for the DEMO product.
1. adding noise, and/or
2. mute the playback sound for 1/2 second(s) for every 10-60 seconds.

My question is simple, what API i should use? More APIs are welcome :)

kyrios
naides
05-31-2003, 04:57 PM
GetTickCount

GetSystemTime
Kayaker
05-31-2003, 05:39 PM
I take it these are digital audio plugins? One I looked at was a dll built with an SDK and seemed to be "plugged in" via some debugger interface exported functions. There seems to be dozens of plugins that add acoustic effects to whatever the main program is playing.

I only looked at one but there were no multimedia api's, so parameters like Hz, Sweep, Pan, Mix, Delay, etc. seem to be the constants the plugins pass to the main program. If these plugins are all created around a skeleton and the effects coding is minimal, a little study comparing them with freeware versions should draw out the protection scheme code if it exists.

Kayaker
disavowed
06-01-2003, 03:16 PM
sorry i'm not familiar with vst (hence these comments may not apply). if this is a real-time audio plugin, then yes, the two api's above may be useful. if, however, this plugin does pre-processing on audio files, then you'd have to research how time frames are indexed in the audio file :(
cr.ap
06-02-2003, 09:59 AM
get the vst sdk witch is freely avaible from steinberg. study it and u will find the places where to look for soon...

most "mute" protections simply count the sampleframes processed so the function to look for are process and processreplacing

noise protection can also be found in the process methods. on some occasions they can be easily spotted by rand() calls.

cr.ap
kyrios
06-03-2003, 01:31 PM
@cr.ap : judging from you knew a lot about steinberg, i bet you are familiar with VST thingy. Talio? arctic?
So basically is just seeking suspicious CALL which is responsible for adding the noise/mute.

i also appreciated comments from disavowed, kayaker, and naides. thx guys!

kyrios


Hiew and a tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hiew and a tutorial
PDA

View Full Version : Hiew and a tutorial

Fahr
05-31-2003, 02:53 PM
Hello people,

first of all let me state that I am a complete newbie to reverse engineering. I can program, some ASM too, but I never tried reverse engineering before. Please don't be angry with me because of my probable stupidity.

That being said, here is my question;

I am trying to follow the following tutorial on bypassing SoftWrap:
http://www.woodmann.net/fravia/blackb_softwrap.html

Since I don't have all (or any) of the tools, I thought it impossible. But then I noted in the bottom of part 1 he states:

"When you made all the changes in Hiew..."

I have Hiew; oh happy, oh joy.

Thus I fire up Hiew, load the exe, set the viewing mode to decode and am completely lost.

I don't know if the code snippets he gives out in the tutorial actually came from Hiew or from a disasm output, but in Hiew I can't seem to find them. Not the texts like '_WinMain@16', which I can more or less understand, but also not the given calls, jumps, etc.

So asuming he DID use Hiew to do it all, how did he do it? And if not (I assume it's a disasm output), how did he use Hiew to work on his disasm output? Or did he just change the asm code and re-asm it?

Thank you,
- Fahr
naides
05-31-2003, 04:56 PM
It is not my intention to sound harsh or harangue a newcomer, so I apologize in advance.

1.Tools: Your cracking is only as good as your tools. Spend time in finding them, learning their use and eventually making them. THEY ARE NOT THAT HARD TO GET. pm and I may give you hints, look down in protools and other sites and get equipped before trying to understand a cracking tutorial .

2. Start simple: the tut you point to is not at newbie level. Cut your teeth in simple, not necessarily trivial tuts and cracks, hot linked in this board by the dozen, then get into more complex stuff.
ZaiRoN
06-01-2003, 04:42 AM
Hi,

in Hview, the "decode" mode is used to view the disasm of the file. If you want to change one or more instructions you have, firstly, to move to the instruction you want to change. Press F5 and type the offset of the instruction you want to change; remember, the offset and not the Virtual Address! After that, F3 and you can change the instruction working directly on the bytes or specifying the new instruction (F2).

Hiew, imho, is not proper for newbies and I suggest you to start with a simple hex editor.

Regards,
ZaiRoN
evlncrn8
06-01-2003, 05:23 AM
actually, if you press f5 and put a . infront of the number you enter, hiew takes your entry as a va.. so the offset -> va and va-> offset is quite simple ;), also read the hiew manual.. great little tool
ZaiRoN
06-01-2003, 05:27 AM
Hi evlncrn8,

thx for the info, I don't use too much this tool... I have to read the manual :D

ZaiRoN
Fahr
06-01-2003, 06:30 AM
Originally posted by naides
It is not my intention to sound harsh or harangue a newcomer, so I apologize in advance.

1.Tools: Your cracking is only as good as your tools. Spend time in finding them, learning their use and eventually making them. THEY ARE NOT THAT HARD TO GET. pm and I may give you hints, look down in protools and other sites and get equipped before trying to understand a cracking tutorial .

2. Start simple: the tut you point to is not at newbie level. Cut your teeth in simple, not necessarily trivial tuts and cracks, hot linked in this board by the dozen, then get into more complex stuff.

You're right, so no appologies needed.
I know tools are easy to find, since that post (yesterday) I managed to 'obtain' SoftICE and IDA Pro. I guess that'll help a bunch (still gotta try them out, tho, just awake).

As for your note on starting with newbie tuts, I agree. But I would like to think I am not a complete newbie, since I do have basic understanding of ASM and the works of all the stuff. That is; I understand the tutorial, I understand WHAT he does, WHY he does it and WHY it works. I just don't get HOW.

But still, I guess you're right. I'll try to find some tutorials on general use of the tools. But if anyone is still willing to help me on this one (as in: how did he get the ASM dump and how did he translate it into Hiew), please do so.

- Fahr
naides
06-01-2003, 08:20 AM
I don't know if the code snippets he gives out in the tutorial actually came from Hiew or from a disasm output, but in Hiew I can't seem to find them. Not the texts like '_WinMain@16', which I can more or less understand, but also not the given calls, jumps, etc.

Sure.

The code you see in the tut with annotations like _WinMain@16 etc is produced by IDA. The disassembly produced by HIEW, while remarkable for such small tool is just a literal byte to ops translation, and will not annotate or de-tangle the code flow as IDA does, that is why the hiew disassembly listing is useful only to find where you are in the raw file and change a byte or two, while looking at the immediate result of your maneuver.

evlncrn8 described a method to FIND a stretch of code inside HIEW. F5 (goto) then . followed by the virtual address that IDA listing provided ie .0045C4D5
P0001
06-01-2003, 08:45 AM
Hi ! Fahr

After loading the proggy in Hiew you first hit F4 then F2 and u r in the asm listing.

Then if u want 2 make changes u hit F3 and it is in the edit mode.

after making the changes in the proggy u hit F9 to save ur changes to it.

best of Luck !!!
P0001 :D
Fahr
06-01-2003, 08:54 AM
Originally posted by naides
Sure.

The code you see in the tut with annotations like _WinMain@16 etc is produced by IDA. The disassembly produced by HIEW, while remarkable for such small tool is just a literal byte to ops translation, and will not annotate or de-tangle the code flow as IDA does, that is why the hiew disassembly listing is useful only to find where you are in the raw file and change a byte or two, while looking at the immediate result of your maneuver.

evlncrn8 described a method to FIND a stretch of code inside HIEW. F5 (goto) then . followed by the virtual address that IDA listing provided ie .0045C4D5

OK, thanks for that info. It seems tho that this program is packed with some new version of softpack and is also really 'packed' (IDA says: "The import segment seems to be destroyed, this may mean blah blah blah")

Guess that makes it more or less impossible to crack :(

Thanks anyway for your help.
- Fahr
Iwarez
06-01-2003, 09:51 AM
Nothing is impossible to crack. The new softwrap versions are BTW protected with xlok. I must say that xlok is protecting well. I ended up with making a debugger loader to do the dumping (for .locked files, it makes a working exe without softwrap) and making a debugger patcher/loader for the new protected softwrap programs (protected with xlok and softwrap.dll). It requires some research but softwrap ends up to be not so protecting at all. It's xlok that makes it harder to crack.
Fahr
06-01-2003, 10:56 AM
Originally posted by Iwarez
Nothing is impossible to crack. The new softwrap versions are BTW protected with xlok. I must say that xlok is protecting well. I ended up with making a debugger loader to do the dumping (for .locked files, it makes a working exe without softwrap) and making a debugger patcher/loader for the new protected softwrap programs (protected with xlok and softwrap.dll). It requires some research but softwrap ends up to be not so protecting at all. It's xlok that makes it harder to crack.

Yeah, I already figured that. And I know everything can be cracked, but not by a newbie like me using a tutorial for an older softwrap version. I'm learning though! (got some good crackme's, reinstalling Win98 to work with hmemcpy etc.)

Thanks,
- Fahr
Iwarez
06-01-2003, 03:01 PM
A good point to start with is a breakpoint on the dialogboxparama function, and putting a breakpoint on the retn. Or on the classic writeprocessmemory api. Be sure not to place the breakpoint straight on the api itself as newer softwraps (with the help of xlok) check for breakpoints on api's. You can then decide to dump (if you breaked on writeprocessmemory) the contents of the buffer (check your api guide here on help on where the buffer is located) and paste this into the .locked file. Another approach is to let softwrap write the contents into memory and dump the program before it's resumed by softwrap.
Fahr
06-02-2003, 02:06 AM
Originally posted by Iwarez
A good point to start with is a breakpoint on the dialogboxparama function, and putting a breakpoint on the retn. Or on the classic writeprocessmemory api. Be sure not to place the breakpoint straight on the api itself as newer softwraps (with the help of xlok) check for breakpoints on api's. You can then decide to dump (if you breaked on writeprocessmemory) the contents of the buffer (check your api guide here on help on where the buffer is located) and paste this into the .locked file. Another approach is to let softwrap write the contents into memory and dump the program before it's resumed by softwrap.

Sounds good, except for the fact that I can't run it with SoftICE present. It results in some XLok message.

And on top of that; I already started the program too many times, so I can't run it anymore without ordering it (or so says SoftWrap)

So now what?

- Fahr
Iwarez
06-02-2003, 01:41 PM
No sweat, you just need to:

1. get another softwrapped program to test the normal flow with
2. patch your softice to prevent it from being found or/
unload softice and use ollydbg (it not found by xlok)
3. after analysis you'll find that a softwrapped program can be started after trial with ease.
Fahr
06-02-2003, 03:10 PM
Interesting, I'll get my own copy of SoftWrap then to test with.

As for OllyDBG, I tried it once, but I really don't get it... I can't even make API breakpoints it seems :S

Which leads to another 2 questions;
1) how to use OllyDBG as SoftICE (most ppl say it's easier)
2) how to crack SoftICE so it's not detected

And last but not least; I do want to do this myself, cuz I think I will learn a lot, but I will need some pointers and help here and there, would you be able to provide that?

Thanks,
- Fahr
Rackmount
06-02-2003, 04:03 PM
Hello....

I can see that you are interested in learning so I will offer a few simple responses to your last post...

As for learning olly...go here: http://ollydbg.win32asmcommunity.net/

As for hiding SICE...there are a few approaches...

1.) You can patch your program to not search for IsDebuggerPresent api (winNT api ...not sure if this is in other newer versions i.e XP, ME etc. (prolly so)), or make it think it isn't found even if it is...

2.) You can hide SICE using secondary proggie like Frogsice

And as to offering assistance...I have noticed that if you make an effort to first do it yourself and describe what you have tried...others will be happy to assist and offer helpful hints...but, be careful of not trying it yourself first and lamely asking help...if you make no effort...you will most likely be flamed...this is a newbies forum...it is here to support learning efforts

Have fun in your RE learning adventure...

Rackmount
Iwarez
06-02-2003, 04:31 PM
Good reply rackmount.

Concerning breaking on API's with olly. That's most certainly possible but it requires w2k or higher.

Concerning hiding softice, well that has been discussed here over and over and a search on the board will help you a lot. I would take this as second step and not as required as softwrap can be done complete and solely with ollydbg.

And yes, offcourse you can ask questions. :) Especially about softwrap. It has been my special interest now for a while and I'am getting good at ripping it apart in thousand several ways :D
Paul333
06-06-2003, 07:08 PM
I know the tutorial your on about fahl and ive used it myself..I used W32DASM to follow the code in the tut..surprised no-one mentioned W32DSAM to you ?..thats by far thew best and easiest disassembler of a programs code for a newbie to follow

I found like you because the tutorial was old (but still relevant and a great tutorial..thanks blackbird:) ) it didnt resemble the Softwrap code i was looking word for word but i still was able to follow it by picking out the main parts

I went straight to the unwrapping part of the tut because i was using frogsice to hide softice i didnt need the tut beginning

Although the code of the app i had was completely diff from the code in the tut i found 3 major similarities and it so happened they where the most important ...These where

call ds:CreateProcessA

call ds:WriteProcessMemory

call ds:ResumeThread

once id located these in my app's code i could begin to notice very small simarities with the tuts code and my current apps code .very very small but nonethe less large enough for me to work out my position

Once i was confident of where i was i bpx'ed on

CreateProcessA

and slowly traced from there keeping a sharp eye out for thew other 2 ie..

call ds:WriteProcessMemory

call ds:ResumeThread

once i finally got to land on

call ds:ResumeThread

i stopped like Blackbird said and froze the program with a

a eip

then

jmp eip

I then ctrl d'd out of softice and ran processdump and dumped the app..it was virgin and ran sweet...lol that was one of the first apps i cracked and got a good buzz out of it

I know your will be slightly different now that softwrap is packed with that packer u mentioned but id still persevere with it and im sure you,ll manage just fine :0

Good luck

paul333
Fahr
06-07-2003, 10:39 AM
That sounds like a good tip, thanks, Paul 333 :)

The only problem is that I can't actually RUN the program anymore, since the tryout time is over :S

I guess I'll try it on another PC then, thanks a lot :)

- Fahr
Fahr
06-09-2003, 03:30 PM
ok, here is the next problem;

As said by Iwarez, I can't bpx on ResumeThread, so I decided to go with OllyDBG. Problem is, I can't even EXECUTE the program with OllyDBG, it keeps giving me errors and never shows the actual screen I get when just running it (the one saying: please reg this software blah blah, only 3 tries blah blah).

I could run it with SoftICE present, using NTAll (FrogsICE clone for NT/2K), but if I bpx the ResumeThread it still wont run...

Any hints as to what to do now?

- Fahr


RTA 1.20 source code release
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RTA 1.20 source code release
PDA

View Full Version : RTA 1.20 source code release

squidge
06-01-2003, 05:52 AM
Well, it's been a while now since the last version, I don't plan on releasing a new version in the next few weeks, but I am working on a complete redesign and rewrite. However the rewrite is coming on quite slowly due to other tasks and projects.

So, I've decided to release the source code of the 1.2 version for anyone who wishes to modify it's workings :)

RTA 1.2 was written using C++ Builder 6.0. The compiler is available on various FTP sites if you don't have it (I'm not going to put site names here for obvious reasons, but it shouldn't be too difficult to find....)

Have fun, as I must admit some of the code is terrible (which is the reason for the complete rewrite).
Js
06-02-2003, 05:15 PM
very nice of you to release the source for this excellent tool.
cheers
rnd
12-26-2003, 05:00 AM
did you create your opcode tables yourself? if yes, how? using the intel docs?

you know, creating those tables was for me always the reason NOT to write a (dis)assembler, since it appears to be a boring work for me :)
squidge
12-26-2003, 05:56 AM
It was boring work for me too, that's why I used the disassembler/assembler from Ollydbg :)


Softice nt setup questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Softice nt setup questions
PDA

View Full Version : Softice nt setup questions

Diabolus
06-01-2003, 03:48 PM
Hi,

first post here, go easy on me.

I've installed soft ice 4.05 for windows nt (I have win2k pro SP2)
Everything went fine. I can load SICE manually no problem.
I choose universal video driver with standard VGA card. (My ATI radeon 9000 isn't listed)

I read about setting SICE up on various places for about 4 hours now. Depending on the version of SICE, the options that need to be tweaked vary and most tutorials I found were under win98.
So far, the only thing I could manage to change were the exports where I added a bunch of dlls from system32 (user32, kernel32, etc)
Now I was wondering how i could get nms files for the symbol section. From what I could gather by searching these boards is that I need debug dlls to convert. I don't know which ones and how to differ a normall dll from a debug dll. I'm pretty sure I have some debug one since I think they are installed with MSVS6 but I dont know whcih ones i need to convert to nms or even where to find them in my system.
SoftIce pdfs completely ignore this topic. So I went along

For a start, I thought I would toy around with minesweeper in order to get familiar with SICE. I tried loading the MSweeper exe into the symbol loader. I get an error and am asked if i want to continue. I choose to continue, get the game window to open then ctrl-d to debug it. Sytem freezes but nothing comes up. I ctrl-d again to regain control of windows. I change video settings as i've seen in these boards, but nothing makes the SICE window to pop.

So, I've been wondering if this might not be all inter-related. Since I didn't load nms files, I might get this error when loading the exe and hence SICE can't break on a symbol since it can't find any.

I read about 50 posts here of people with similar problems but replies are inconclusive. I would appreciate any help.
Sorry if I put you to sleep with my long post.

Ð.
evlncrn8
06-01-2003, 04:21 PM
use softice from driver studio 2.7, i had the same problems you described, and it turned out to be dodgy video card drivers, and the /nofastrgui switch being required.. read the softice readme.txt for more info.. but well i'd recommend u just get softice from driver studio 2.7 which is softice 4.2.7 (build 62) works here on 2k+sp3 no problems
nikolatesla20
06-01-2003, 07:18 PM
If you use DriverStudio 2.7, you can get NMS files right from Microsoft for all the system DLL's , using the tool that comes with DS 2.7, it's called "Symbol Retriever", and it works very very well.

Just load in the DLL you want into Symbol Retriever and click "Get Symbols", and also make sure the box labeled "convert to NMS" is checked and it'll do it for you after downloading. THen just go into SoftICE settings and tell it to load those NMS symbol files on startup.

You might also have to go into the "Advanced" settings and add the line "NTSYMBOLS = YES"

-nt20
Aster!x
06-01-2003, 08:40 PM
May be "NTSYMBOLS=ON" ;)
JMI
06-01-2003, 09:35 PM
That too. :D

Regards.
Diabolus
06-01-2003, 09:56 PM
I managed to get my hands on a rip of SICE from Driver suite 2.7 but I don't want to use it since it's a rip and it's probably not coming with that symbol loader I need.

Wading through dead links in russian and czeck, I got a full 2.6 driver suite,but I read here that there's some bug with it. Not sure if it's only under XP, so I might go on with it if I don't find better.

I also had an error uninstalling SICE 4.05. No idea why. I got a leftover isu and ini file, prolly some reg keys too.
Great day. . .
Thanks for your input guys, I just hope to get this s**t working.

Ð
aka
06-01-2003, 10:04 PM
Hi nt20,

I use SoftIce 2.7, Win 2k sp3, i run your patch, but it's always display :

IntService1 Fail, GetLast Error return 2.

how can i use this patch to patch Int1 ?

and How can i patch registry and rename ntice.sys as Mokan said ?

( i search in registry only two places have information about ntice.sys )

That's all.

Thanks
nikolatesla20
06-02-2003, 07:12 AM
For the first question, search the board for "Hiding INT1 softice", there is a huge thread about it. Basically what it boils down to is this:...

go into softice
do an IDT command
notice the "IDT base" write down that address
do a "db <idt base address>"
change the 16th byte (I THINK, check the thread I was talking about) to 0x8E. Softice sets it to 0xEE, we don't want that.

That should do it.

About the second question, I don't know.

-nt20


cracking xp, 98............
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > cracking xp, 98............
PDA

View Full Version : cracking xp, 98............

whoda
06-02-2003, 03:44 AM
I have been slowly trying to pick up cracking. I have been doing decent with w32dasm and a hex editor. But I haven't had much with anything besides patching.
Most of the tutorials I"ve seen use softice and have old software to crack which is almost impossible to find. Second a person told me cracking and XP don't go together. I had trouble following a lot of tutorials that use softice, I guess because some functions on 98 aren't on XP. So my question is do I really need to run 98? I mean do the majority of peole woh crack software run windows 98? I was considering installing a virtual machine of 98, becuase I don't want to give up my XP.

I do like using ollydbg, but I feel there aren't enough tutorials out there. I'll learn something or how to crack some target and when I try it on another target what I've learned didn't work. Maybe I'm a slow learner and like a thousand examples.
squidge
06-02-2003, 04:46 AM
I run WindowsXP as os and don't even have Windows98 installed any more. Tool wise, I'm a pretty much IDA Pro / OllyDbg man myself, and find it makes a pretty good combination for the vast majority of reversing tasks. I don't have SoftIce installed as I've never needed it under XP (I had it installed under Win98, but never really found a real use for it where Ollydbg didn't handle the job as well).
whoda
06-03-2003, 10:13 AM
thanks for the reply. I guess I'm just not finding enough tutorials for ollydbg, even though it seems more of the newer tutorials are for ollydbg. thanks again
artik
06-03-2003, 12:39 PM
i think ollydbg is a very good solution for debugger-newbies. anyway if you're interested in ollydbg, check out hxxp://biw.rult.at for some good introduction-stuff for ollydbg.
have a nice day! ;)
JMI
06-03-2003, 01:32 PM
And don't forget the "obvious."

Put "Ollydbg forum" and/or "Ollydbg + tut" in your favorite search engine. You'll be amazed what you can actually find on the net.

There's actually an Olly Forum where people can trade information and "ask questions."

Regards.
squidge
06-03-2003, 03:01 PM
Don't forget that a debugger is simply a debugger. They mostly do the same kinda job. So a tut on using Softice to break an app can normally be converted to Ollydbg without too much trouble. The same the other way around.

You don't need Ollydbg specific tuts - grabs tuts for SoftIce etc and convert them yourself - it's the best way to get to grips with the debugger!
Fake51
06-03-2003, 03:31 PM
There is ofcourse the obvious problem of newbie tut-writers publishing the typical "then f5 till you hit the xxx then f12" trite. Then again, those tuts typically aren't worth spending much time on.
It's a lot more interesting to learn the basics of debugging, which are exactly the same in softice and olly, as Squidge pointed out.

So, do yourself a favor, debug notepad and/or a small asm program that doesn't really do much (preferably written by yourself) and get the hang of it. Having learned only the basics, you'll be able to do alot.

Fake
whoda
06-04-2003, 01:28 AM
The problem was that most of the tutorials that were for softice I couldn't even run in XP. There wre commands that were for 98 that won't work in XP, but you can do it another way I've been told. I have softice, but older crackers tell me that I should crack with 98 if I want to run softice.
It's hard for me to follow a tutorial if when I get to a part and I cannot do it becuase of my OS.

I'll check out the tutorils listed on Ollydbg, thanks everybody
Fake51
06-04-2003, 04:34 AM
Driverstudio 2.7 with softice works nice on XP. Haven't had problems there.

As for the things that don't work under xp - I should think that to be mainly additional tools, like icedump and such. And altho they make for some easy cracking, they aren't essential.

Ofcourse, there are some differences when reversing on XP. Like the lack of hmemcpy, but then again, there's always another way.

Fake
evaluator
06-06-2003, 04:35 PM
>>The problem was that most of the tutorials..
So install W98se..& XP..&&&&&&&&&&&
basta!


WINZIP Archive decrypt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > WINZIP Archive decrypt
PDA

View Full Version : WINZIP Archive decrypt

corado
06-02-2003, 08:04 AM
Hi,

I have WINZIP archive with one password protected file.

I found 3 keys using pkcrack soft. I calculated the password using these 3 keys. But when I want to extract the file WINZIP says:

Error: invalid compressed data to inflate

Using the PKUNZIP I receive the message:

CRC error.

Please could somebody explain me why the password is not correct if the 3 keys are OK. Is there a way to use these 3 keys to calculate the correct password (It seems the password is more then 9 characters long, no reason to use brute force attack)

WBR
Corado
mike
06-02-2003, 05:51 PM
If there's a CRC error, the keys are wrong. You said you used pkcrack. That's Conrad's implementation, right? Did you send him a postcard? :D

Conrad implements the Biham-Kocher attack, which requires known plaintext.I have WINZIP archive with one password protected file.If there's only one password protected file, and you already have the plaintext, why do you care about decrypting it?
corado
06-03-2003, 12:36 AM
Hi Mike,

Thank you for your reply. The problem is that I do not have plaintext. "Guaranteed WinZIP Recovery" in ARCHPR doesn't work in my case, since there is only one file in the archive.

But when I use ARCHPR "Password from keys" option and indicate these 3 keys, then it finds the 9 character long password. When I try to unzip the archive with these password the winzip reports on CRC error.

I believe that real password is much longer then 9 characters.

Is there any other way to unzip the file using these pseudo 3 key information and pseudo password?

Thank you and best regards,
Corado
mike
06-05-2003, 09:18 PM
Huh? Where did you get the keys? If you got them from Conrad's pkcrack, then you had to use plaintext--that's what pkcrack is all about.


"INT 3" modify problem in safedisc 2.90.....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > "INT 3" modify problem in safedisc 2.90.....
PDA

View Full Version : "INT 3" modify problem in safedisc 2.90.....

plusgenkim
06-03-2003, 10:38 PM
Hi.

First of all, i need your understanding for my very poor english...:)

I have read Peex's Safedisc 2.70 tut and try it in Safedisc 2.90..

I have spent almost 20days for this and almost done.

But i still can't modfy "CC INT 3" Instructions.....:(

"CC" instruction modify routine was work correctly several times.

Like this....
01AF:004B0E59 890DEC2C9000 MOV [00902CEC],ECX
01AF:004B0E5F CC INT 3
01AF:004B0E60 088A08880C02 OR [EDX+020C8808],CL
| | | | | |
01AF:004B0E59 890DEC2C9000 MOV [00902CEC],ECX
01AF:004B0E5F 2BD0 SUB EDX,EAX
01AF:004B0E61 8A08 MOV CL,[EAX]

But after specific address, it was don't work anymore.

And I can't find any rules of this stop working.

SGDT, SIDT and etc instructions modified normaly.

Please give me some Hints.

If i can resolve this problem, my "SD2" challange will be finished.

Have a nice day. Bye....:)

PS) For me, it is always hard working to use english.
And perhaps for you, it will be hard too to understand my poor english .:D
Sorry.....
evaluator
06-04-2003, 12:28 AM
just(!in generalissimo!),
you must DEBUG original program & see how it works;
then DEBUG your unpacked one & compare differences;
plusgenkim
06-04-2003, 01:06 AM
Hi. evaluator.
I have alreay DEBUG so many time.
If i just launching the program, it is not problem.
But all codes(not modified) in .text section must be modified forcedly by calling decrypt routine....
Although i can run program several days, i can't confirm whether all codes be modified.
This is problem........:)
evlncrn8
06-04-2003, 06:03 AM
psssst... r eip to the cc opcode.. set a breakpoint on writeprocessmemory... i3here off in softice.. g
it'll break when he writes the proper instruction.. backtrace the proc and figure out what its doing...
plusgenkim
06-04-2003, 07:35 AM
Hi. evlncrn8.
Probably, I will give up this SD2 unpacking....
But I will try again once more from your way.....
Thanks. :)

PS) Hmmm..... Difficult.... I give up.
I shold find another EASY bait....
Thanks for reply. evlncrn8 and evaluator.
Have a nice day....:)
thenewguy
04-11-2004, 12:04 PM
hey plusgenkim im working on something similiar to what you are :) is there anyway i can talk on irc or something? would love to pick your brain on this topic :p
evlncrn8
04-11-2004, 06:00 PM
hey plusgenkim im working on something similiar to what you are :) is there anyway i can talk on irc or something? would love to pick your brain on this topic :p

safedisc2 is kinda dead now..there isnt really any point working on sd2 now that sd3 is out
SiNTAX
04-24-2004, 11:42 AM
safedisc2 is kinda dead now..there isnt really any point working on sd2 now that sd3 is out

Curious.. is it any different.. apart from the version number?! Or is it all marketing hype?


IAT rebuilding (Asprotect)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IAT rebuilding (Asprotect)
PDA

View Full Version : IAT rebuilding (Asprotect)

Artifex
06-04-2003, 03:36 AM
With ImpRec I get :
FThunk : 00095148 Nb Func : 8B valid : No
rva : 00095418 mod : kernel32.dll ord : 01B5 name : GetProcessVersion
etc.... etc...
but 5 unidentified ptrs.
-----------------
I got 3 of them resolved (using Trace Level 1 and Asp.1.2x plugin) :

rva 00095264 ptr : 011f13b4 GetCurrentProcess
rva 000952b4 ptr : 011f1360 invalid
rva 00095328 ptr : 011f1388 Getversion
rva 00095338 ptr : 011f13e4 invalid
rva 00095368 ptr : 011f13cc GetVersion
--------------------

I traced manually the remaining two and I am unable to link them to any API. Stuck there I would appreciate some help.

TIA
Artifex
sv
06-04-2003, 05:06 AM
Hi

There is a lot of thread about this.
AS Pre-processed api are :
GetVersion
GetVersionExA
GetCurrentProcess
GetCurrentProcessId
GetCommandLineA
FreeResource
LockResource

SV
hobferret
06-04-2003, 07:54 AM
Artifex

There is loads of info on this subject but to save you the TROUBLE of searching here are some tips;

FreeResource
LockResource
GlobalUnlock

There are others but it's too early in the morning so I can't think!:)

/hobferret


Project idea with safedisc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Project idea with safedisc
PDA

View Full Version : Project idea with safedisc

kade
06-04-2003, 08:36 AM
Hi,

I am interested in opening a project idea on safedisc. At the moment I am trying to fully reverse engineer safedisc to sharpen my skills and to learn the tools. I have already progressed a lot and I am looking if there are more people interested in this to work together. The version I am working on is v2.80.11.

PM me if you are interested and if there are a few people then we kan kick off and elongate this thread a bit.
evlncrn8
06-04-2003, 09:25 AM
search button.. use it
i woiuld also recommend that you start from 2.70.30 instead of jumping to 2.80.1x you'll understand more that way
kade
06-04-2003, 10:05 AM
Hi,

I have used the search button :). I already reverse engineered the appended sections to the main exe, the ~e5d141.tmp and a great deal of the ~def394b.tmp file, expecially the anti-debugging tricks inside it. I know almost what every function does in those files. The ones I still have to do are ~efe.tmp (shared data), ~defd6a.tmp, drvmgt.dll, secdrv.sys (here I found some dr checks), and a part of ~def394b.tmp. I am looking at this for over 2 months now and it seems interesting to learn about anti-debugging tricks, obfuscationcode, calling dll's, using threads, hidden applicationwindows to call other processes (~e5d141.tmp does that), encrypted string which get decrypted on the fly, strange things in peheaders, calling sys drivers and so on. In the end I am interested in unwrapping this version of safedisc but to get more used to the tools (I use ida, softice and pe explorer) and to safedisc I want to know what every function does and alone it takes a lot of time, I experienced that. But if you think I should remove this project idea, I will do just that and keep on going on my own with a small question on the newbie board once in a while when I am stuck.

Your idea to first look at an older version is interesting, if I can find a target protected with it I will look at it, thanks.
evlncrn8
06-04-2003, 10:22 AM
~efe.tmp aka cleanup - only important for invalid opcodes
i didnt say u should remove the project idea, its just i cant see a lot of people helping you (mainly for the same reason that there are no public safedisc tools for 2.80.xx) i'd suggest you work from riscs existing public tools (think they did up to 2.5x.xx), from that you will probably see the same procs in the dlls that you've spotted in your 2.80.xx target.. good luck, oh for finding targets, try looking for game patches.. thats what i usually work from.. ;)
kade
06-04-2003, 10:38 AM
Thank you for your reply. And you are right, there are no public tools available protected by my version. I will do what you suggested and start looking at riscs public tools and learn more from there on.
SiNTAX
06-05-2003, 04:07 AM
First thing you should do is write something to deobfuscate the code. This is really easy to do (200 lines IDC script) and will save you heaps of time when working in IDA!
kade
06-05-2003, 08:25 AM
At the moment I have met 3 kinds of obfuscationcode.

1) nullsub
2) push parameters onto the stack as follows

push arg4
push arg4
push arg0
call function1(arg0,arg4)
push arg0
call function2(arg0,arg4)

this should be :

push arg4
push arg0
call function1(arg0,arg4)
push arg4
push arg0
call function2(arg0,arg4)

3) The third one is probably the one you are referring about :

0056B5F0 loc_56B5F0: ; CODE XREF: 0056B60Bj
0056B5F0 ; 0056B615j ...
0056B5F0 jg short near ptr loc_56B5FE+3
0056B5F2 mov ds:8B000000h, esp
0056B5F8 rol byte ptr [edi+729090F6h], cl
0056B5FE
0056B5FE loc_56B5FE: ; CODE XREF: :0056B5F0j
0056B5FE sbb eax, 197CC987h
0056B603 nop
0056B604 nop
0056B605
0056B605 loc_56B605: ; CODE REF: :0056B5E6j
0056B605 js short near ptr loc_56B61B+1
0056B607 xchg edx, edx
0056B609 mov esi, esi
0056B60B jg short near ptr loc_56B5F0+1
0056B60D mov ebp, ebp
0056B60F xchg eax, eax
0056B611 xchg eax, eax
0056B613 mov edi, edi
0056B615 jnz short near ptr loc_56B5F0+1
0056B617 mov ebx, ebx
0056B619 jle short near ptr loc_56B5F0+1
0056B61B

which translates to this with some editing

0056B5F0 db 7Fh ; 
0056B5F1 ; --------------------------------------------------------------------
0056B5F1
0056B5F1 loc_56B5F1: ; CODE XREF: :0056B60Bj
0056B5F1 ; 0056B615j ...
0056B5F1 jns loc_56B61C
0056B5F7 mov edx, edx
0056B5F9 xchg esi, esi
0056B5FB nop
0056B5FC nop
0056B5FD jb short loc_56B61C
0056B5FF xchg ecx, ecx
0056B601 jl short loc_56B61C
0056B603 nop
0056B604 nop
0056B605
0056B605 loc_56B605: ; CODE XREF: :0056B5E6j
0056B605 js short loc_56B61C
0056B607 xchg edx, edx
0056B609 mov esi, esi
0056B60B jg short loc_56B5F1
0056B60D mov ebp, ebp
0056B60F xchg eax, eax
0056B611 xchg eax, eax
0056B613 mov edi, edi
0056B615 jnz short loc_56B5F1
0056B617 mov ebx, ebx
0056B619 jle short loc_56B5F1
0056B619 ; ---------------------------------------------------------------------------
stxt371:0056B61B db 0DFh ;

There are a lot of junk functions in here which do nothing and jumps which just lead to obfuscation.

Until now I always did it manually, but I am now trying to follow your advice SiNTaX and write an idc script for this. One script for the conversion to the right code (as seen in the snippets) and one for the extraction of the relevant operations, skipping xchg eax,eax and trivial jumps, and so on.

Is this the obfuscation that you were thinking of SiNTaX or are there more methods of obfuscation I overlooked?
SiNTAX
06-06-2003, 03:46 AM
Those are the ones..

The 2nd one you mention, I didn't see in the version I worked on.. so it might be new. The other 2 are easy to deal with.

I would suggest that you mark them as data (MakeArray), instead of replacing them with NOP's (then you don't loose any information, if your script f's up :p )
kade
06-06-2003, 09:34 AM
Ok, I have a problem with my idc script. I want to make is go through the list of problems and then pick out the problems which say ALREADY, those are the ones where the obfuscation occurs. But I cannot find any idc function that supplies me with a list of problems so I can iterate it and jump to them. Do you know if there is such a function?

The second approach would be to search the file for occurrences of +1, +2 or +3 so I would detect "js short near ptr loc_56B61B+1" and then it is straightforward to fix it.
SiNTAX
06-10-2003, 05:00 AM
Well why not start of with a manual action, ie you position over the start of an obfuscated code piece, start your script and it does the actions that you normally would do.
kade
06-11-2003, 05:29 AM
I made a script that should work, but it doesn't.

I have to put the cursor to the instruction "jg short near ptr loc__txt2_10004618+1" and then it should fix the problem. But for some strange reason, the script makes it unknown, but it does not make the code afterwards. And that is strange because I can make the code manually. I checked the address realoperand and that one is ok. Where am I going wrong?

Here is the script :

////////////////////////////////////////

#include <idc.idc>

static main()
{

auto start, jumpoperand,realoperand;

start = ScreenEA();

// calculate the address of the operand of the jump instruction
jumpoperand = Rfirst0(start);

// calculate the address of the beginning of the instruction where the jumpoperand points to
realoperand = NextNotTail(jumpoperand);
realoperand = PrevNotTail(realoperand);
// if these two are not the same we have obfuscation
if(jumpoperand != realoperand)
{
// First make the piece of code unknown
MakeUnkn(realoperand,1);
// Then make code
MakeCode(jumpoperand);
}

}

////////////////////////////////////
kade
06-11-2003, 08:00 AM
////////////////////////////////////////

#include <idc.idc>

static main()
{

auto start, jumpoperand,realoperand;

start = ScreenEA();

// calculate the address of the operand of the jump instruction
jumpoperand = Rfirst0(start);

// calculate the address of the beginning of the instruction where the jumpoperand points to
realoperand = PrevHead(jumpoperand,0);
realoperand = NextNotTail(realoperand);

// if realoperand exists and these two are not the same we have obfuscation
if(realoperand)
{
if(jumpoperand != realoperand)
{
// First make the piece of code unknown
MakeUnkn(realoperand,1);
// Then make code
MakeCode(jumpoperand);
MakeCode(jumpoperand);
}
}
}

////////////////////////////////////
SiNTAX
06-12-2003, 03:46 AM
Well I did something like:

for( l = strt; l < ea; l++ ) {
MakeUnkn(l, 1);
}
MakeArray(strt, ea-strt);
Analysis(1); Wait();
MakeCode(ea); Wait();

My IDC script finds the start and end of the obfuscated code snippet and then marks it all as Unknown, then marks it as an array so it takes up less screen space. The data after the array is set to code.
dELTA
06-12-2003, 06:28 AM
What are the Wait() calls for?
SiNTAX
06-15-2003, 07:43 AM
They w8 till the auto-analysis is done.


Copying keymaker ASM from Win32Dasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Copying keymaker ASM from Win32Dasm
PDA

View Full Version : Copying keymaker ASM from Win32Dasm

Fahr
06-04-2003, 10:30 AM
Hello people,

as some of you may know by now, I am trying to learn how to succesfully reverse engineer stuff.

Currently I am practising on a program of a friend of mine, QMacro. I already managed to fish a serial using SoftICE, but now I want to build a keymaker, based on the code I got out of Win32Dasm. I know where the key is generated and what it needs etc., but I can't figure out a few things; for instance; push 0048D50C. That apparently refers to some other address, which immidiately does 2 jumps and then it's all a madhouse.

I looked at some tutorials who rip ASM code to build an own keymaker, but none of them pick very hard programs. This one appears to be quite difficult, at least, to me.

The original encryption used for it is a combination of Base64 and MD5. Knowing that, I could easily produce a keymaker in any non-ASM language, but I want to learn this.

Is there anyone who is willing to offer me some assistance on this one? If possible live (thru MSN or ICQ or IRC or what-not).

Thank you,
- Fahr
naides
06-04-2003, 11:51 AM
Do not place links to comercial software in your posts, because web-crawlers, spiders and other minor pests pick them up and point the software companies back to the board. Then they give shit to the host, and the owner of this board.
Fahr
06-04-2003, 11:57 AM
Noted and fixed, sorry for the inconvenience
JMI
06-04-2003, 12:14 PM
Thanks naides:

If you keep helping out with my Mod duties, I'm going to have to start sharing my salary with you. :D No wait, I don't get a salary. :rolleyes: Maybe you could put in a word with Woodmann about that. :p

Regards.
Fahr
06-04-2003, 01:53 PM
For easier stuff I decided to start with Winzip. Using a tutorial I managed to extract all of the vital code (I think), but it keeps coming up with access violations. Apparently, when I want to messagebox the eax, it's NULL...

I really don't get what I'm doing wrong, I'll link the source here, any help will be highly appreciated

http://dump.lycantrope.com:5000/wzkey.asm

Thanks,
- Fahr

P.S.
it might be handy to note that this is MASM32 work.
and it might also be handy to note that I used THIS: http://www.woodmann.net/krobar/tutlist/tutlist1797.txt tutorial to more or less figure out what is what.
I know he concludes in a C code for the keygen, but I want to rip the ASM... I can do it in C any day...
squidge
06-04-2003, 02:53 PM
MessageBoxA requires a pointer to a null terminated string. You are passing it an integer (well, dword). It doesn't know this and so takes it as a memory address, can't read it, and throws up an access violation.

Use a small buffer and convert the values in the EAX and ECX to ascii first, and then pass that to MessageBoxA.
naides
06-04-2003, 08:44 PM
Originally posted by Fahr
Hello people,

as some of you may know by now, I am trying to learn how to succesfully reverse engineer stuff.

Currently I am practising on a program of a friend of mine, QMacro. I already managed to fish a serial using SoftICE, but now I want to build a keymaker, based on the code I got out of Win32Dasm. I know where the key is generated and what it needs etc., but I can't figure out a few things; for instance; push 0048D50C. That apparently refers to some other address, which immidiately does 2 jumps and then it's all a madhouse.

I looked at some tutorials who rip ASM code to build an own keymaker, but none of them pick very hard programs. This one appears to be quite difficult, at least, to me.

The original encryption used for it is a combination of Base64 and MD5. Knowing that, I could easily produce a keymaker in any non-ASM language, but I want to learn this.

Is there anyone who is willing to offer me some assistance on this one? If possible live (thru MSN or ICQ or IRC or what-not).

Thank you,
- Fahr

There is a reason for those tuts to pick those simple programs to rip the code generating calls: because they were easy.

There is a practical limit for this method: when ripping a key generating code entails more work in finding dependencies, tracking the input and output buffers etc, than writing the code from scratch, you should opt for other options, like: writing the code from scratch.

Also keep in mind that the modularity of structured programming, in which every function and object has unambiguous input parameters, clear methods and defined outputs does not necessarily translate like so into the raw code after compilation, code optimization and linking. Raw code, where crackers do our trade, is not structured and often spaguetti like, with references and depedencies scattered all over the place, as you have seen.

Unless the call or calls that perform the key generation are very well self contained, and the external dependencies are few and explicitly defined, ripping code is a futile or unecessarily arduous endeavor.

By the way, IDA may help you better in those chores.
Fahr
06-05-2003, 02:24 AM
I see your point. But as described above; the code generation of this particular program is so endlessly complex that rewriting it in C is not much of an option. I don't intend to do this program directly, that's why I started with Winzip.

On another note; how is it that IDA can offer me better assistance in this? I mean; a disassembler is a disassembler... what is the difference? (I don't know IDA too well... so bear with me here). Does IDA have something to extract a complete call with subcalls or something?

Thanks,
- Fahr
Fahr
06-05-2003, 02:26 AM
Originally posted by squidge
MessageBoxA requires a pointer to a null terminated string. You are passing it an integer (well, dword). It doesn't know this and so takes it as a memory address, can't read it, and throws up an access violation.

Use a small buffer and convert the values in the EAX and ECX to ascii first, and then pass that to MessageBoxA.

A valid point. Tho I have no idea how to do that (maybe use offset eax?), there is another problem, too. At the point where it actually calls the messageboxes, both EAX and ECX are NULL. So they're neither pointers, nor strings. They're nothing.

- Fahr
naides
06-05-2003, 08:38 AM
Originally posted by Fahr
I see your point. But as described above; the code generation of this particular program is so endlessly complex that rewriting it in C is not much of an option. I don't intend to do this program directly, that's why I started with Winzip.

On another note; how is it that IDA can offer me better assistance in this? I mean; a disassembler is a disassembler... what is the difference? (I don't know IDA too well... so bear with me here). Does IDA have something to extract a complete call with subcalls or something?

Thanks,
- Fahr

IDA has a feature in which you can reannotate the code and rename the variables from some meningless while technically correct name
to a more intuitive meaningful name

i.e.

push [esp+arg_0]

TO

push My_user_name

or

call 00452367

TO

call _MD5_routine

and IDA will figure out all the instances in which the variable( data segment:memory address) is used
or the subroutine (codesegment: memory address) is called and replace it with your renamed symbol.
After a while, code that looked like a laberinth of meaningless numbers and register names starts to look like human written code.
ZaiRoN
06-05-2003, 10:29 AM
Hi All!

Fahr, don't know if you have take a look at the mini project area but, there was a thread named "keygenin!" designed for those whom want to write a win32asm keygen. I thought to join it with this thread but, we can't develop an explicit keygen for a shareware program so, I decided to write a little crackme. The algo I have used in the crackme is very similar to the winzip's name/serial algo (who has said that they are equal? :-;)).
The thread I am referring to is:How to write a keygen ripping the original asm code (http://www.woodmann.net/forum/showthread.php?threadid=4848).

It's not my intention to stop this thread, I wrote the crackme only because we will speak freely about how to create a complete keygen....

Regards,
ZaiRoN
Fahr
06-05-2003, 10:57 AM
Originally posted by naides
IDA has a feature in which you can reannotate the code and rename the variables from some meningless while technically correct name
to a more intuitive meaningful name

i.e.

push [esp+arg_0]

TO

push My_user_name

or

call 00452367

TO

call _MD5_routine

and IDA will figure out all the instances in which the variable( data segment:memory address) is used
or the subroutine (codesegment: memory address) is called and replace it with your renamed symbol.
After a while, code that looked like a laberinth of meaningless numbers and register names starts to look like human written code.

That sounds EXACTLY like what I need. Any pointers as to how I can manage that (don't know IDA too well).
Fahr
06-05-2003, 10:58 AM
Originally posted by ZaiRoN
Hi All!

Fahr, don't know if you have take a look at the mini project area but, there was a thread named "keygenin!" designed for those whom want to write a win32asm keygen. I thought to join it with this thread but, we can't develop an explicit keygen for a shareware program so, I decided to write a little crackme. The algo I have used in the crackme is very similar to the winzip's name/serial algo (who has said that they are equal? :-;)).
The thread I am referring to is:How to write a keygen ripping the original asm code (http://www.woodmann.net/forum/showthread.php?threadid=4848).

It's not my intention to stop this thread, I wrote the crackme only because we will speak freely about how to create a complete keygen....

Regards,
ZaiRoN

Thanks! I'll be sure to check it out :)

I already found a link under the 'Some useful places' at the bottom of this board. I guess I will check out both.

- Fahr
Fahr
06-05-2003, 02:15 PM
OK, since this has been called out to be one of the keygenning threads, I guess I'll dump all my questions here (of nobody objects, of course).

As suggested I fired up IDA Pro and I'm getting the hang of it, except for 2 things;

1) I can't seem to rename a var that's like this: [ebp+var_4]
I can rename var_4, I can also rename ebp, but I can't seem to rename the combination of the 2...
2) Is it just me, or is it impossible to actually DEBUG with IDA Pro? If it is, it's a function I'm missing dearly. It would be so nice to just be able to name the registers while running thru them and seeing their vars. This way I have to rebreak in SoftICE every time I want to know a new var. (or maybe I can break out of SoftICE without letting the debugged program resume, if so, please enlighten me)

And last, I am trying to get the hang of that piece of code of QMacro. I am gettin thru most of it, but I think my ASM knowledge is still too small :(
Could someone please explain me what this snippet of code does?

CODE:00403FA4 sub_403FA4 proc near ; CODE XREF: sub_41D144+16p
CODE:00403FA4 ; sub_422934+11p ...
CODE:00403FA4 test eax, eax ; Eax=0?
CODE:00403FA6 jz short EndSub ; If so, go to end sub
CODE:00403FA8 mov edx, [eax-8]
CODE:00403FAB inc edx
CODE:00403FAC jle short EndSub
CODE:00403FAE lock inc dword ptr [eax-8]
CODE:00403FB2
CODE:00403FB2 EndSub: ; CODE XREF: sub_403FA4+2j
CODE:00403FB2 ; sub_403FA4+8j
CODE:00403FB2 retn ; Return
CODE:00403FB2 sub_403FA4 endp

In this case, EAX contains the username (or offset to, whichever). First it checks if eax = 0 (maybe length?), if it's NOT, it does some rather twisted stuff. Starting from the line under 'jz short EndSub', I'm lost...
It goes back 8 chars? And then increases it again? I don't get it

If I'm being too anoying, please tell me and I'll seek my answers elsewhere.

Thanks,
- Fahr
sna
06-07-2003, 05:25 AM
The subroutine you pasted is part of a standard DMA (Dynamic Memory Allocation) scheme. It takes a pointer (linear address) to a string, where it's layed out as:

dw[refcount],dw[strlen],string

at [eax-8] you'll find the reference count i believe, and at [eax-4] you'll find the string length.

If you havn't yet, you might want to try debugging with OllyDebug. It let's you debug and name variables at the same time. Don't think there's any olly <-> IDA plugin that will synchronize databases but that's another project completely ;)

regards, sna
squidge
06-07-2003, 07:39 AM
There a IDA to Ollydbg converter, but I've never seen anything that'll do the other way around. At least the IDA converter prevents you from accidentally tracing into routines like strcpy etc :)
naides
06-07-2003, 08:06 AM
Originally posted by Fahr
OK, since this has been called out to be one of the keygenning threads, I guess I'll dump all my questions here (of nobody objects, of course).

As suggested I fired up IDA Pro and I'm getting the hang of it, except for 2 things;

1) I can't seem to rename a var that's like this: [ebp+var_4]
I can rename var_4, I can also rename ebp, but I can't seem to rename the combination of the 2...

2) Is it just me, or is it impossible to actually DEBUG with IDA Pro? If it is, it's a function I'm missing dearly. It would be so nice to just be able to name the registers while running thru them and seeing their vars. This way I have to rebreak in SoftICE every time I want to know a new var. (or maybe I can break out of SoftICE without letting the debugged program resume, if so, please enlighten me)

IDA 4.5, released this year, includes a live debugger. Previous versions are only disassemblers, so yes, if you need to see the actual contents of variables in real time, you need to have Sice running in the background. I have not seen IDA 4.5 debugger in action, so I cannot comment on its use and quality.

And last, I am trying to get the hang of that piece of code of QMacro. I am gettin thru most of it, but I think my ASM knowledge is still too small :(
Could someone please explain me what this snippet of code does?

CODE:00403FA4 sub_403FA4 proc near ; CODE XREF: sub_41D144+16 p
CODE:00403FA4 ; sub_422934+11 p ...

Notice that the address 0043FA4 does not advance, so what you are seeing are comments added by IDA. This is a subroutine called from 41D144 and 422934, below.

CODE:00403FA4 test eax, eax ; Eax=0?

Notice that eax is used as a pointer in 403FA8. so in this step it is checking if the pointer is NULL. If so, we simply return by performing the conditional jump to EndSub at instruction 403FA6

CODE:00403FA6 jz short EndSub ; If so, go to end sub
CODE:00403FA8 mov edx, [eax-8]

The dword pointed by eax-8 is loaded into edx

CODE:00403FAB inc edx

Then incremented

CODE:00403FAC jle short EndSub

If the contents of edx was FFFFFFFF, and gets incremented, turns into 00000000 which sets the Zero flag, and the carry flag. In such case, the conditional jump at 403FAC happens, meaning we do nothing else and jump to the end of the suroutine

CODE:00403FAE lock inc dword ptr [eax-8]

Now, the increment we did at 403FAB happened to A COPY of the variable pointed by eax-8, which temporarily stored in edx. Once we make sure the increment will not wrap around and make it zero, we perform the increment operation on the actual variable

CODE:00403FB2
CODE:00403FB2 EndSub: ; CODE XREF: sub_403FA4+2 j
CODE:00403FB2 ; sub_403FA4+8 j
CODE:00403FB2 retn

And we are out of here

; Return
CODE:00403FB2 sub_403FA4 endp

In this case, EAX contains the username (or offset to, whichever). First it checks if eax = 0 (maybe length?)
EAX is a pointer.

, if it's NOT, it does some rather twisted stuff. Starting from the line under 'jz short EndSub', I'm lost...

It is working on a variable 8 bytes below the position pointed by EAX.

Review the significance of brackets, which is the assembly way to work with pointers and references

It goes back 8 chars? And then increases it again? I don't get it

If I'm being too anoying, please tell me and I'll seek my answers elsewhere.

Thanks,
- Fahr
Fahr
06-07-2003, 10:48 AM
Ok! Thanks for the explanation :)

So what it basically does is increase a dword that [eax-8] is the pointer to?

Or to put it in C:

DWORD* MyDWORD = NULL;
*MyDWORD++;

or am I wrong?
Fahr
06-07-2003, 03:56 PM
Originally posted by naides
IDA 4.5, released this year, includes a live debugger. Previous versions are only disassemblers, so yes, if you need to see the actual contents of variables in real time, you need to have Sice running in the background. I have not seen IDA 4.5 debugger in action, so I cannot comment on its use and quality.

I got IDA 4.5 now, according to help it contains a debugger, but the actual debugger menu is not present :(

so much for that idea...

- Fahr
JMI
06-07-2003, 03:59 PM
That's because, if you've been reading about the copy you found, it is a modified "demo version" and never contained the "debugger" portion of the code.

Regards.
naides
06-07-2003, 09:52 PM
Originally posted by Fahr
Ok! Thanks for the explanation :)

So what it basically does is increase a dword that [eax-8] is the pointer to?

Or to put it in C:

DWORD* MyDWORD = NULL;
*MyDWORD++;

or am I wrong?

Not exactly. It only increases the variable pointed by MyDWORD if MyDWORD is not NULL
Fahr
06-08-2003, 06:22 AM
Originally posted by naides
Not exactly. It only increases the variable pointed by MyDWORD if MyDWORD is not NULL

And what does that mean if the DWORD points to a string? That it goes 1 char further?

Also, I think this code is bogus, cuz it writes in EAX and then modifies it, but after it's done to Name, Email and Serial, it does a xor eax, eax...
Whatever it is, I think it was generated by the compiler for some weird reason, but it doesn't seem to have any actual meaning...

- Fahr
naides
06-08-2003, 02:22 PM
Originally posted by Fahr
And what does that mean if the DWORD points to a string? That it goes 1 char further?

Also, I think this code is bogus, cuz it writes in EAX and then modifies it, but after it's done to Name, Email and Serial, it does a xor eax, eax...
Whatever it is, I think it was generated by the compiler for some weird reason, but it doesn't seem to have any actual meaning...

- Fahr

I actually downloaded the app we are talking about and traced with softIce around the code you are interested in.

Number One, as far as I can tell this code does not get called during serial validation, but I may be wrong, because I did not dig too much into the serial validation key generation routines.

At start up this subroutine gets call repeatedly from position sub_422934+11

eax points to a structure that contains, at eax, a null terminated string which corresponds to the name of a windows API, like 'CreateMutexA' etc. before it, at position [eax-04] there is a dword containing the length of the string pointed by eax.
at [eax-08] there is a dword flag which at live tracing almost invariably contained 'FFFFFFFF' or -1, which is a rather common flag. every time your little subroutine got called, the 'FFFFFFF' at [eax-08] was moved to edx, edx was incremented and it wrapped around to zero, so the actual flag at [eax-08] was not incremented and left with the value 'FFFFFFFF'

you can see all this action if you type in SoftIce: dd eax-08, while you are tracing through the code. in the data window you will see the structure I am talking about.

Second point, this code, appears to me, has to do with Import symbols, IAT decoding etc, general housekeeping of a Win32 PE app, and not so much into the specifics of key validation; but I may be wrong, because I never saw this subroutine called from the other location at sub_41D144+16.

Third Point:

Your questions are naive, but they are smart. that is why I take some time into digging some answers, but, you need to read 'The Art of Assembly' as you trace trough code, so you learn to get a feel of what it is going on. By definition, computer code may be cryptic, but it is NOT ambiguous. if a CPU can figure outl what it is going on, you certainly can.

Fourth, The code in Qmacro does not seem to me as heavily guarded and full of traps to a cracker, if they at some point echoed the right key in memory.
Fahr
06-08-2003, 02:32 PM
Thanks for the info, I'll be sure to look into it.

So far I have been able to create a keymaker for it in Delphi, knowing what I know. Tracing through the code, I was able to grab a serial from memory. Retracing it I found some interesting things;

First it pastes together your Name, Email and some key he hardcoded into it (QM-26092001-1637-MarkvanRenswoude), that's the date, time and name of the author (pretty stupid to hardcode it)
This new 'key' it then generates gets put through some kind of introcate process and produces an output of 32 charachters HEX. With my knowledge of PHP, I was able to define it as an actual MD5 hash of the exact string it created. Comparing this MD5 hash to the actual code, it became clear that he creates the actual serial as follows:

QM- + HASH chars 5 - 15 + - + HASH chars 1 - 3

in Delphi:

GenerationKey := Name + Email + 'QM-26092001-1637-MarkvanRenswoude';

// MD5
GenerationKey := MD5Print(MD5String(GenerationKey));

// Generate FinalKey
EdtSerial.Text := 'QM-' + Copy(GenerationKey, 5, 10) + '-' + Copy(GenerationKey, 1, 3);

Eventhough this works like a charm, I am still not satisfied. This program uses a very wellknown hash that I was accidentally able to recognize, but other programs don't. So my quest for dumping this keymaker to ASM still continues.

What is this 'The Art of Assembly' you speak of? Sounds good.
I am also digging through the assembly tuts at Krobar. I hope they're good.

Thanks,
- Fahr
naides
06-08-2003, 05:26 PM
The Art of Assembly is one of several OnLine, for-free assembly reference E-books, which you may easily find by typing 'the art of assembly' in google. one version is at hxxp://www.arl.wustl.edu/~lockwood/class/cs306/books/artofasm/toc.html

nothing to it, it is just a handy reference for obscure and not so obscure asm opcodes, variable formats, and so on. you may also find it as .pdf file for local printing, and off-line browsing.
Fahr
06-09-2003, 06:14 AM
heh, I am never offline, so I'll stick with this one :)

Looks like a nice book, I'll read it through, thanks :)

- Fahr


windows 9x/nt system call stop/restart (int 2E/int 30)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > windows 9x/nt system call stop/restart (int 2E/int 30)
PDA

View Full Version : windows 9x/nt system call stop/restart (int 2E/int 30)

pasha
06-05-2003, 11:17 AM
greetz all

well, i was trying a normal approach in injecting a dll into an active process space under windows 98SE. i was able to whip up code to do that and it worked fine for most processes that were already executing.

my approach is to enumerate all the threads of the target process, and then open one of those threads using OpenProcess (of course i patched it to be able to open threads as well).

then i suspend the thread, set its context to point to a small routine on that thread stack to call loadlibrary and then jump to the original EIP of the thread by restoring all the register values.

then i issue a resumethread call and it loads the dll and then goes back to the EIP of that thread where it was before.

however, i came across this problem, some processes like services are idling in the kernel waiting for an event, for such processes, my load routine is called only after the system call returns from the kernel to the user mode.

i was thinking if there would be a way to load my DLL imeediately into the process instead of waiting for it to return from the kernel call. then i looked into elicz's ELIRt library, and he is able to do it !!!! kudos elicz. however, he messes around with some undocumented kernel32 ordinals which i am not sure about.

i tried the approach of QueueUserAPC which will add a callback to the idling thread APC queue, but then that is only if the thread enters by specifying TRUE for the alertable state for any idling calls.

i would like to know if anyone has experimented with elicz's method ? or any other method to resolve this issue.

thanking you and awaiting a reply

best regards
pasha


stripper v2.01 (public release)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > stripper v2.01 (public release)
PDA

View Full Version : stripper v2.01 (public release)

artik
06-06-2003, 01:30 PM
i've just detected the new version of (aspr)stripper on the net.

some infos:

-------------------------
stripper 2.01 - unpacker for some packers/protectors.

* features:

- unpacking asprotected`ed programs (exe, dll, ocx);
- unpacking aspacked`ed programs (exe, dll, ocx);
- rebuilding resources section;
- cleaning up the victim program (deleting aspr sections);
- doing some researching of packed program;

* requirements:

- stripper works only under 2k and XP, also you must have
administrator's rights;
- there will be no win9x version;
- SoftIce with "i3here on" for using reversing tool and loader;
-------------------------
get it at: hxxp://www.is.svitonline.com/syd


Key- GeneRaToR HELP!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Key- GeneRaToR HELP!!!!
PDA

View Full Version : Key- GeneRaToR HELP!!!!

Zkhan13
06-07-2003, 05:13 AM
Key- GeneRaToR HELP??

I am trying to make a Key-Generator, though I am not an expert in Reverse Engineering..
Here, I am playing around with some dummy programs, which I found from web…
I found a Routine, which POSSIBLY makes the right Serial from our given Text…Here it Is..

lstrcmp is called Here………
…………………………………………………………………….
--------- EAX, 0000001
:401309 MOV EDX,[403038] -> Here our Given Text is Stored.
:40130F MOV DL,[EAX,403037] -> Takes the first Character…?
:401315 AND EDX, 00000FF -> WHAT IS THIS…???
:40131B MOV EBX,EDX
:….31D IMUL EBX,EDX ->Multiplying each other & store in EBX
…...320 ADD ESI,EBX ->
… ..322 MOV EBX, EDX
……324 SAR EBX,1 -> What is this SAR ????
……326 ADD ESI,EBX ->
……328 SUB ESI,EDX
……32A INC EAX ->Increment EAX by 1
……32B DEC ECX -> Decrement ECX by 1
……32C JNZ 401309-> Loop until (EAX or EDX) is Non Zero.??

Whether the comments I made it were Right ones? And also, those SAR, & when AND with a number, how it is coded in a C++ programme. I know little bit C++(Not experienced.).But I never coded in C++, by studying an ASM instructions…So please help me …B’cze in ASM Those ESI stands for STACK relative work.. Is there any use of this in C++ code for a Key-Generator?. Any kind of information, that would harness my ‘Understanding’ about ‘Keygenerator ‘ will be appreciated..

Or please give me some URLs, which speaks the same.
“How to code in C++, by studying Assembly instructions”-

I will also try myself and will return, if any thing found useful for us.

Thanx In Advance
evlncrn8
06-07-2003, 05:39 AM
401315 AND EDX, 00000FF -> WHAT IS THIS…???

makes edx 000000xx ie: strips it to a byte (dl) where xx = number

324 SAR EBX,1 -> What is this SAR ????

shift right 1 place (multiply by 2)

Those ESI stands for STACK relative work

wrong.. esi is just another register usually used as a pointer

i suggest you use google, search for "helppc21", download it and install it and use the asm reference to learn the asm commands
its an old tool but still very useful

MOV EDX,[403038] ; load pointer to serial
MOV DL,[EAX,403037] ; load character
AND EDX, 00000FF ; strip register to 8 bit component (dl)
MOV EBX,EDX ; store edx in ebx
IMUL EBX,EDX ; -> Multiplying each other & store in EBX
ADD ESI,EBX ; add value to esi
MOV EBX, EDX ; store value
SAR EBX,1 ; multiply ebx by 2
ADD ESI,EBX ; add value to esi
SUB ESI,EDX ; sub edx from esi
INC EAX ; advance pointer
DEC ECX ; -> Decrement ECX by 1
JNZ 401309 ; repeat until ecx is zero
ZaiRoN
06-07-2003, 05:50 AM
Hi,
and EDX, 000000FFhthis instruction performs a logical and between edx and FFh; this and is used to leave only Text's char inside edx. Infact::401309 MOV EDX,[403038] ; suppose: edx=404000, and Text is "example"
:40130F MOV DL,[EAX,403037] ; dl=65h ("e") but edx=00404065
:401315 AND EDX, 00000FF ; edx=00000065, only the char from Text
SAR EBX,1SAR: Shift Arithmetis Right, shifts ebx by 1 bit. It's used to do a signed division, in your case its a signed division by 2. evlncrn8, division and not multiply :-)

DEC ECX ; Decrement ECX by 1
JNZ 401309 ; Loop until (EAX or EDX) is Non Zero.??There is a little error. The cycle is repeated ecx times and I suppose ecx is the length of your Text.
DEC instruction can modify Zero Flag. When ecx is>1 the dec instruction does not set ZeroFlag and you will jump at 401309; otherwise, if ecx=1, dec instruction sets ZeroFlag to 1 and you won't jump.

evlncrn8: sorry me. I repeated what you has just told, I have not noticed your last added comments.

ZaiRoN
evlncrn8
06-07-2003, 06:51 AM
/me cant tell his right from his left ;)
JMI
06-07-2003, 01:30 PM
It's easy. The LEFT is the one on the OTHER side. :D

Regards.


Tut Rqst, Please Read b4 Flame
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Tut Rqst, Please Read b4 Flame
PDA

View Full Version : Tut Rqst, Please Read b4 Flame

Jasker
06-07-2003, 10:49 PM
Iam request a tutorial if somebody has time, on how to possibly unpack UPX in ollydbg, i find a lot of tuts are the usual places, but there all for softice and i find them hard to follow, all say

do this then do that, and not every helpfull, if somebody has time to write up a tutorial on UPX unpacking with OLLY that would be great.

Many Thnx :)

-Jasker
JMI
06-07-2003, 11:59 PM
Jasker:

You are attempting to go about this backwards and to take the lazy way out. What you need to learn to do "first," is learn how to use a debugger, I don't care which one. There are several threads here about learning how to use Olly and/or Softice. There are also references on where one goes to learn more about how to use these tools.

What you appear to want is someone to simply tell you (in a tut) if you have a upx packed exec, do step 1, 2, 3, 4, 5, and 6 and it's unpacked. What would you actually learn from that?

If, instead, you spent your time learning how to "use" the debugger and read up on how upx "actually works," then you wouldn't need a "tut." Do you know that most of the time upx can be "unpacked" with the -d command? Are you really dealing with something "packed" with upx and "something else"? This illustrates that you have not provided enough detail for someone to actually help you, short of making you a complete road map.

It clearly appears that you did not read the FAQ. If you had, and had used the "search" button" at the top of the Forums and, on the left side entered "unpack + upx" you would have found 37 threads with some discussion of unpacking of this packer. There's even one titled "Un-packing UPX packed exes" which not only tells you how to do some of it, it tells you where more tuts are located. There's also a thread on a combination Armadillo + upx packed exec.

Now go read those threads I told you how to find and then come back with questions that shows that you have actually done some of your own work and where you are stuck, as the FAQ tells you you should do. We are here to try to help, not do "all" the work for you.

Don't take this "lesson" too hard. Many have heard it because they came here the first time and began with this same error. The "lesson" is only meant to teach you "what to do first." All that is expected of you is that you make the effort to help yourself first, and then show that you have. After you do that, you might discover that you no longer even "need" help and can begin teaching others what you have learned. If not, that's when we try to help.

Regards.
Jasker
06-08-2003, 01:41 AM
I think you got my post all wrong, iam not here to tell people to hold my hand, iam very able with olly dbg, and i know all about the -d, but doing -d doent learn me jack , iam simply asking and i have read all posts on this board belive me, about Manually unpacking UPX, thats why i made the simple request of a tutorial if somebody HAD time :)

I fully understand your words, and i appologise that i didnt make my self more clear :)

- Jasker
squidge
06-08-2003, 02:48 AM
So if you have read all the posts on the board, then please tell us where you are stuck and where you have managed to get. With UPX being one of the most easiest packers to unpack, the information on this board should be enough when pieced together - there is no need for a tutorial.

However, if you are struggling, post what you have done so far, and we will try to help.
Jasker
06-08-2003, 04:40 AM
hehe sorry again.

okay :)

i managed to get like 90% of it done

at a lot of targets i can fully dump, and rebuild them very easy.

but at some targets after i dump, and rebuild, it seems fine
but i will double click the file and it will not do anything
just like it terminates.

hxxp://exetools.com/files/protectors/win/upxs306.zip

this is the target i was working on, upx scrambler, packed and scrambled by its own program :)

OEP: 405BE8

Attached: IAT Table

Rebuilds fine, but like i said, clicking just does nothing.

thnx for any help :)
Clandestiny
06-09-2003, 09:11 AM
Hiya,

Couple of possiblities...

1) Let me preface this by saying, I find this 1st possiblity to be highly unlikely unless upx has been significantly revamped since I saw it last, heh, heh... But consider the fact that some packers will initialize some data in the decryptor which is later used in the unpacked program. Once unpacked, that data is no longer initialized and may crash, exit in a SEH, ect.

(Assuming your rebuild is ok)...
2) Have you checked for the presence of a CRC check? Exiting would be a common behavior for an app which has failed a CRC check.

Cheers,
Clandestiny
Clandestiny
06-09-2003, 11:11 PM
Hiya,

I guess I've been semi-retired for a while, but I'm back :D I've actually been helping a friend learn how to reverse lately and we just went over the details of upx so I decided to have a look at your target. I replied cursorily to your post earlier, but have since downloaded and sucessfully rebuilt upx scrambler. First off, your entry point and IAT are correct. In fact, if you scrambled another target you would have observed that it rebuilt perfectly. It's really just "boiler plate" upx unpacking. Consequently, UPX scrambler itself must have a little trick up its sleeve ;) You're quite right in saying that it won't run... And as I said earlier, the 2 most likely scenarios are 1) that the program initializes some data in the decryptor which it checks later in the main program or 2) there is a CRC check. Depending on how you look it it, its not really either one of these scenarios or it's a little of both ;) Did you trace the prog at the OEP to see *why* it fails?

push ebp
code:00405BE9 mov ebp, esp
code:00405BEB add esp, 0FFFFFFF4h
code:00405BEE push ebx
code:00405BEF push esi
code:00405BF0 push edi
code:00405BF1 call sub_0_402988
code:00405BF6 call sub_0_4036BC
code:00405BFB xor eax, eax
code:00405BFD push ebp
code:00405BFE push offset unk_0_405C73
code:00405C03 push dword ptr fs:[eax]
code:00405C06 mov fs:[eax], esp
code:00405C09 call sub_0_4055B4
code:00405C0E call sub_0_4055E4 ;this function fails
code:00405C13 mov ds:dword_0_407738, eax
code:00405C18 cmp ds:dword_0_407738, 0FFFFFFFFh
code:00405C1F jnz short loc_0_405C26

You'll find that the 4th call down fails. My first step was run the packed application and find out what this function *should* return. It returned C000 in the packed app. Patching in C000 as a return value for that function in my unpacked application didn't work and caused subsequent functions to fail so I had to dig a little deeper. You can clearly see in the above code, that the app is saving this value. I wanted to see how many other references to this value there were so I set a bpm on 407738. After SI broke, I traced a little and found that the value was being passed into a call to SetFilePointer as the "distance to move" parameter. This let me know that the C000 value must be a file offset. From the other parameters passed into SetFilePointer, I now had the file handle so I could set a breakpoint on CreateFileA and extract the name of the file that this offset was being calculated for. Sure enough, the file that was being opened was none other than Upx Scrambler itself. I suspected a CRC check. Now with this knowledge, I traced into the call 004055e4 to determine how this offset was being calculated and used.

push ebp
code:004055E5 mov ebp, esp
code:004055E7 add esp, 0FFFFFEA4h
code:004055ED push ebx
code:004055EE push esi
code:004055EF push edi
code:004055F0 xor eax, eax
code:004055F2 mov [ebp+var_15C], eax
code:004055F8 xor eax, eax
code:004055FA push ebp
code:004055FB push offset unk_0_4056CC
code:00405600 push dword ptr fs:[eax]
code:00405603 mov fs:[eax], esp
code:00405606 or edi, 0FFFFFFFFh
code:00405609 mov ds:byte_0_40702B, 0
code:00405610 lea edx, [ebp+var_15C]
code:00405616 xor eax, eax
code:00405618 call sub_0_402578
code:0040561D mov edx, [ebp+var_15C]
code:00405623 lea eax, [ebp+var_14C]
code:00405629 call sub_0_403021
code:0040562E mov edx, 1
code:00405633 lea eax, [ebp+var_14C]
code:00405639 call sub_0_4034B4 ;open upx scrambler
code:0040563E lea eax, [ebp+var_14C]
code:00405644 call sub_0_40320C ;get file size
code:00405649 mov ebx, eax
code:0040564B mov eax, ebx
code:0040564D call sub_0_4023B8 ; allocate buffer
code:00405652 mov esi, eax
code:00405654 push 0
code:00405656 mov edx, esi
code:00405658 mov ecx, ebx
code:0040565A lea eax, [ebp+var_14C]
code:00405660 call sub_0_4030C4 ; app reads itself into buffer
code:00405665 sub ebx, 0Ch
code:00405668 cmp ebx, 0
code:0040566B jl short loc_0_4056A1
code:0040566D

Here you can clearly see that Upx Scrambler opens itself, calculates it's file size, allocates a memory buffer and maps a PE image of itself into memory via a ReadFile call.

code:0040566D lea edx, [ebp+var_158]
code:00405673 lea eax, [esi+ebx]
code:00405676 mov ecx, 0Ch
code:0040567B call sub_0_4024CC
code:00405680 lea eax, [ebp+var_158]
code:00405686 mov edx, offset unk_0_407484
code:0040568B mov ecx, 0Ch
code:00405690 call sub_0_4025D8
code:00405695 jnz short loc_0_40569B
code:00405697 mov edi, ebx
code:00405699 jmp short loc_0_4056A1
code:0040569B ;

---------------------------------------------------------------------------
code:0040569B
code:0040569B loc_0_40569B: ; CODE XREF: sub_0_4055E4+B1j
code:0040569B dec ebx
code:0040569C cmp ebx, 0FFFFFFFFh
code:0040569F jnz short loc_0_40566D

The next loop starts at the end of the file and scans backwards for byte sequence 505f2e40. In the packed application, it will find this sequence at offset c000 and return this value. In the unpacked program, this value will not be found. Looking at this area in more detail you can see that 505f2eo marks the start of a section of data shortly after the import table. Apparently, the function of call 004055E4 is to locate this data and return an offset to it. This data will presumably be accessed and used later on in the program. Interestingly, this data section is not found in our dumped file. Indeed, it is never mapped into memory at all (hence it isn't dumped). Presumably this is because the program is only loaded according to its PE header specification and the import table size stops just above this data. Consequently, this data is in effect "hidden" from being loaded in memory and thus "hidden" from being dumped. Of course, when the original packed program opens itself and reads itself from disk into memory it will copy this data section, and will be able to scan for it's pointer. For the unpacked program which was dumped from memory, this data section simply doesn't exist and the call attempting to locate its offset will fail resulting in the program exiting as we saw happen. Based on this knowledge, you simply need to copy this data section from the packed program into your unpacked .exe. It really doesn't matter where you place it as the program will scan the entire image for it. I placed mine at the end of the new section I created for UPX Scrambler's rebuilt import table.

Well, this got kinda long... Hope its clear...

Cheers,
Clandestiny
Jasker
06-10-2003, 10:32 PM
Clandestiny: i cant thank you enough, thanks so much, this is the unthteen time i have seen this and i managed to rebuild 2 of em now acording to what u said :) thank you very much.

Great info there.
Clandestiny
06-11-2003, 08:52 PM
Hiya,

You're quite welcome... Glad I could help :)

Cheers,
Clandestiny


New ASPR Anti Si and IceDump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New ASPR Anti Si and IceDump
PDA

View Full Version : New ASPR Anti Si and IceDump

LaBBa
06-08-2003, 03:15 AM
hi all ...

no tut this time (Yet...;) but just an update about the new
aspr that i saw..

SystemCleaner.com

so far i seen it detect OllyDbg and Si and at my win98.fe crash
when runing IceDump and on winXP pro with the Si 2.7 with NtIceDump it Detect it too...
AsprStripper v2.01 Can't unpack it ..

Real Good Work....(almost)

well it didn't detected just 1 thing tho...
TRW2000 my favorite Win9x Debugger tool

well .. when i will finish see all the new features i hope that i will
have time to write a tut about it...
pLayAr
06-08-2003, 04:01 AM
i need help with new aspr too, i watches CreateFile, OpenService, int 3, int 41, int 68,UnhandledExceptionfilter, but it still detect my SoftIce, i use softice in win2000 server

is there any other method to detect si, i'm puzzled
Viper Zx
06-08-2003, 05:00 AM
http://www.woodmann.net/forum/showthread.php?s=&threadid=4031
AND
http://www.woodmann.net/forum/showthread.php?s=&threadid=4419

Tschau

Viper Zx
Shoob
06-08-2003, 06:20 AM
think its only this IsDebuggerPresent thing or more?

Disable all breaking on new.. bla and set it to System Breakpoint. Works well.

First Access on data at 407278, jumps to dword from 56F32C. than at 16A1528 he returns to main Code (40734D) -> retn -> call 5608F0 what looks like the OEP. Will look at it again after work.

nothing new so...
LaBBa
06-08-2003, 04:56 PM
hmmm Well at win98 i couldn't find a solusion for

Why my win crash when IceDump is loaded and i run the pack file

Why i can't set a Bp on IsdebuggerPresent at OllyDbg ...
(could be just me....)
squidge
06-08-2003, 05:38 PM
ALT+F1 in Ollydbg, type "bp IsDebuggerPresent" and the breakpoint is set.
LaBBa
06-08-2003, 07:01 PM
man i know that ... but as i say : i can't set bp

it give me a msgbox that say : "Unable to Set BreakPoint"

so.... any sogestions ?

and BTW... i wanted to Use the Gr8 tool call : IcePatch
i think it can bypass any AntiSoftIce Shit...

but i don't have any idea about how to configure it...

so if any1 that know how to use this it will be real help
if u will tell me what to write in eatch text box
(just to make sure that i won't do stupid things)
TNX

PS...
did any1 found how to make that When IceDump Loaded it won't Crash the computer ?
Ricardo Narvaja
06-09-2003, 04:19 AM
OLLY in XP you can put BPX in apis, in 98 if IsDebuggerPresent olly don't find in Imported Functions you can put a BPX in a reference but there is no reference, for this cases use olly in XP you can put in apis bpxs directly easily.

Ricardo
hobferret
06-09-2003, 10:29 AM
LaBBa

Do as Ricardo suggests - but you can set breakpoints in ME & 98 if you use BPX IsDebuggerPresent, the thing you can't do is step into the function - it does, however, work much better in XP;)

/hobferret
Shoob
06-09-2003, 12:41 PM
use 2k and kick XP nuts please
LaBBa
06-09-2003, 02:28 PM
well i didn't had time yet to check on winXP but i can tell u this

if i do on win98 bpx IsDebuggerPresent
it set all the bpx ;)
BUT !
when i run the packed prog (ie F9/Shift+F9)
it doesn't break

BTW.. none still knows why does the packed app crash windows
if IceDump is loaded ?
and if u do know plz share the information about how to fix it...

TNX
Ricardo Narvaja
06-09-2003, 02:39 PM
This isnt a competiton XP versus 2000, but in OLLY is better XP, there are a thing you can make in 2K not posiible in XP? NOT,
There are a thing you can make in XP in 2K not, YES, read tuts of armadillo in OLLYDBG and look in XP you can detach the child process, and this process detached continue working, and in 2K this is not posible, this feature is only in XP included.

And if you have not this feature can not unpack armadillo with copymem2 in ollydbg.

Ricardo
hobferret
06-09-2003, 03:51 PM
LaBBa

You are getting me confused, you talk about aspr and you use TRW and you say you don't have a problem.

So why all the talk about olly??:mad:

If you intend to go with olly then you really need xp!;)

However, if you can't set IsDebbugerPresent, or it wont stop, try using the kernel address instead - i.e. BPX XXXXXXXX whatever it is in 98!

/hobferret
sv
06-10-2003, 02:24 AM
Hi all

Anyone have comment about this new version ?

Is there stolen code ?
Where it is ?
Entrypoint just before (first ?) API ?
What do this new obfuscated code ?
Stack and some registers at entry point ?

Regards

SV
sha_k
06-10-2003, 04:00 AM
Originally posted by squidge
ALT+F1 in Ollydbg, type "bp IsDebuggerPresent" and the breakpoint is set.

Sorry for for the dumb question but why this shortcut is not working for me? I have OllyDbg 1.09b. I'd really like to be able to set BP this way (cmd line style). Am I missing somekind of special configuration or plugins?
Ricardo Narvaja
06-10-2003, 04:08 AM
Download the comandbar plugin and is always visible the box for write the commands.

hxxp://dd.x-eye.net/ollyplugin.html

Is only more easy to write but the impossibility of put bpx directly in the apis in W98 is the same, with or without cmndbar.

If you consider cracks all with OLLYDBG like i did and forget SICE, change to XP, and OLLY is better and you can put BPX is apis directly.

Ricardo
sha_k
06-10-2003, 04:19 AM
Thanks you for the quick answer. Looks like an handy tool for quick manipulation :)

Yes I'm using XP already, coz I can't really use Win9x for my job.

Thanks again ;)

EDIT: Woot! I confirm this is SO cool :)
evaluator
06-10-2003, 10:50 AM
blah, here dump of this new asp.dll..

& it now conteins many known tricks for detect debugger..
for example:

1. at offset 00412122h I see 90% exact INT01 checking code,
as Daemon's written example..

2. at offset 00411FF4h is SICE, NTICE, SIWVID check by CreateFileA

3. at offset 00412078h resides INT68 check &
IDT check for distance between INT01-INT03 handlers,
1Eh distance means: SICE is here.. eh?

4. at offset 00412314h NtQuerySystemInformation..

so on..

Great findings, author.. are you plan obtein US Patent for this tricks & they will no more stolen..

***
BTW, what is SRV.SYS (this name is in DLL)?
GlObAl
06-11-2003, 09:58 AM
thank you evaluator,

good work.
iam not sure but i think he use the SRV.SYS to lock the ctrl+d button like the example from

hXXp://spiff.tripnet.se/~iczelion/files/killsice.zip

if you replace the 90h, 90h -> 0e4h,060h softice will popup again.
it seems that Alexy use a lot of tricks by other authors without greetings :)
anyway he make good work and he knows how to steal things :)
LaBBa
06-11-2003, 01:23 PM
nice job !!!
evaluator
06-11-2003, 01:39 PM
Global, you kill me..

As I understand from your words, aspr now conteins SYS driver??

I became crazy & expressly debugged this exe under XP &
none of driver burned..
uh..

Did you joke or what happens!?

BTW, what is nice job??
JMI
06-11-2003, 01:54 PM
Hi Eval:

"nice job" means the same as "good work." :cool:

Regards.
evaluator
06-12-2003, 01:36 AM
JMI,
bleh!
I know thet eNglich..
I not see something Gr8 in dumping some memory..
Do you also think, that is Gr8?
JMI
06-12-2003, 02:30 AM
Not necessarily. But I think YOU are great. :D

When are you going to send us some Music? :cool:

Regards.
evaluator
06-12-2003, 12:41 PM
iLLegal mp3 request!??

hey-hey, JMI!

what exact you need-love?
JMI
06-12-2003, 01:09 PM
Love is all we need. ;)

But if you were serious, I was speaking of something you might have written.

Regards.
evaluator
06-12-2003, 01:12 PM
my writeen is modern_classic, dissonances etc.

so you mostly not need it
Iwarez
06-12-2003, 04:21 PM
I have a question about the new "stolen bytes" technique this Asprotect uses. It seems to run a lot of obfuscated code before the OEP. I traced this stuff but got lost recovering the stolen bytes this way. I tracked the stolen bytes by looking at another delphi program and a little guessing. Does anyone have a better idea to recover the stolen bytes?

What I also found strange was that asprotect seemed to have executed a lot of instructions already while the EIP had never been there. When asprotect hands over execution to the main program it just jumps in in a call that has not been executed.

I wonder if asprotect does actually execute the original functions or does emulate them.

Any insight in this would help me much. The obfuscation code seems to be hot these days and I want to be prepared :D
crUsAdEr
06-16-2003, 04:39 PM
wow.. did i hear new aspr :)?
or am i dreaming? where where is the new beast? :)
JMI
06-16-2003, 06:13 PM
Identification of the beast is in the first post. It was hidden in plain sight to confuse those in a hurry or who might have dropped in at the tail end of the discussion. :D Hopefully Alex isn't reading this. I'm sure he missed it the first time through. :p

Regards.
crUsAdEr
06-16-2003, 06:46 PM
yep.. thanx JMI... pardon my quick joy of hastily posting just for the heck of it.. havent touched sice for a while and here come new arma and aspr i heard :).. time to dig into codewood again.. :)
so many new packers seem to surface as well :)?
like woodmann said.. now packing is the the most common practise then!


CrapKey 6.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > CrapKey 6.0
PDA

View Full Version : CrapKey 6.0

peterg70
06-08-2003, 05:37 AM
Anyone seen a product protected with Version 6.0.

Haven't seen much discussion about this version for a while.

Catch ya
peterg


securom new
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > securom new
PDA

View Full Version : securom new

Timbo
06-08-2003, 03:44 PM
i'm playing with hitman2 securom2 new v4.83.11.0014 and i have removed crc check and time check but if i try tu rebuild the api's it end in nothing . i can't find any more check so if anybody could help me please. i'm not interested in any crack, i only have to know how to defeat this tricky thing. if anyone have done it please let me know

thanks
evlncrn8
06-08-2003, 05:50 PM
hitman2 had triggers.. good luck cos even after u get a good dump u still gotta fix them.. theres also multiple timer checks on the api handler, and other nasties

also its just 4.83.11 i have no idea why other ppl comment with the extra number, if you actually look its 00 terminated after the .11
Timbo
06-09-2003, 02:00 PM
o.k it checks the differnt parts
i'm able to rebuid all except 2 (4182ed/5e5e1a) API imports
it's playing with QueryPerformanceQaunter&PostMessageA)
and second with SetEvent.
does nobody have a tip for me ???
evlncrn8
06-09-2003, 04:30 PM
a tip eh.. okie api handler 80387 code
trace it
Kilby
06-10-2003, 05:57 AM
Just to please you folks.

There was a pretty major update in securom a couple of weeks ago.

Much of the 'loader' has been rewritten, and the api redirection is fairly different too.

In addition certain api's are nolonger in the import table, and are resolved via getprocaddress.

Have fun.
evlncrn8
06-10-2003, 12:24 PM
im well aware of that kilby.. the 'metamorphosis' and crap.. boring aint it ;)
Timbo
06-10-2003, 02:22 PM
o.k it's possible to make all imports (even those are marked with 01 in a special table) but game would not start because
'inside' the game itself (not the cms sections !!) there must be a check(s?) that i could not find and voila game itself loops !!!
if (in this case) i rebuild all imports except 9 special Api Calls
(RegisterClassExA,QueryPerformanceCounter, SetEvent) and let protection alive everything is fine. in those special cases the code of securom makes a jump to a code sequence that looks to me
normal (any tip ???) and then jumps to the real api.
could it be that securom now compiled
with main exe (watermark or ???)

well after about 10 hours of playing with this
s*ny protection i won't give up.
any tips or hints are welcome

thanks
evlncrn8
06-10-2003, 02:59 PM
i told you already.. triggers


Printing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Printing
PDA

View Full Version : Printing

disavowed
06-08-2003, 07:30 PM
I'm running Windows XP, but my printer (NEC Superscript 870) isn't really supported under XP (90% of the time I print, I get jumbled/corrupted print-outs, even though I've tried a dozen different drivers for it). No, it's not the printer or the parallel port cable, since printing works fine under Win95/98 (with the respecitve OS drivers).

One of my options is of course to just use VMware with Win95/98 as the guest OS, and print from XP to a shared printer on VMware. However, I'd rather not have VMware running all the time just to print stuff (it eats up at least 32 megs of RAM).

I was wondering if anyone had any advice on what I could do. I looked into making a printer miniport driver, but it seems like a steep learning curve for something that I'm not even sure would help. I'm relatively sure that the problem lies in the driver, and not the spooler (no problems printing to .PDF files). Any advice on how to troubleshoot this, even if it does require programming a "filter" for the existing drivers? (Of course, NEC doesn't provide any help)
sarge
06-09-2003, 07:41 AM
I have the same problem with XP and a WinWriter 150c, by Lexmark. Contacted the manf and all they will say is "no driver available". I am pretty sure this means that my printer is so old that they don't consider it worth supporting under XP. But it's a nice printer and I am fond of it.

I was/am hesitant to tell XP to go ahead and use it anyway, given the GarbagePrint and/or SystemMalfunction warnings.

Any help on this would be appreciated.

(Maybe we need a new forum here on resolving old stuff....nah, then we'd pick up a lot of DOS stuff.)

Sarge
Woodmann
06-09-2003, 06:37 PM
Hi,

Since I have been a victim of the "no updated drivers" problem,
I would just start trying them all until I found one that would work better then the default driver that windows installs.

After searching I have found 2 suggestions to your problem.
Use minolta OMS 8L or, HP laserjet IIP printer drivers.

Good Luck,

Woodmann
disavowed
06-09-2003, 07:56 PM
thanks woodmann. yes, google gave me the link to that page too. those were two of the drivers that were included in the dozen or so i've tried, to no avail.
peterg70
06-10-2003, 05:22 AM
@disavowed

I found with my old printer that I could tell it to emulate a different standard IE HP Design jet or Postscript etc.

Anyway just a thought
disavowed
06-11-2003, 09:49 PM
thanks for the reply, but no luck with either:
i tried every deskjet printer driver bundled with xp, none of them worked.
i tried postscript, but all it printed out was the ascii postscript commands (i guess my printer's not postscript compatible??)

looks like i may have to use vmware after all.. ughhhh

anyone else have any ideas?
Woodmann
06-12-2003, 09:34 PM
Errrrrrrrrrrrr..............

Dont hate me ;)

WinXP DDK perhaps ?
peterg70
06-13-2003, 06:21 AM
I assume you tried
http://www.computergripes.com/NecSuperScript870.html
(At the bottom)

It seems to emulate the HP LaserJet IIP protocol. So install the HP Laserjet IIP driver and try that.

Catch Ya
disavowed
06-14-2003, 09:28 AM
yeah, i went to that site awhile ago. as i said to woodmann, that driver didn't work for me.
disavowed
06-15-2003, 09:01 AM
Originally posted by Woodmann
WinXP DDK perhaps ?
i would think that coding a printer driver would require proprietary knowledge of the printer's internals. pretty much the reason why there's no such thing as a generic (non-postscript) printer driver for windows!!
if i'm wrong here in my understanding, please let me know


Aspacking an manually UnAspacked file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspacking an manually UnAspacked file
PDA

View Full Version : Aspacking an manually UnAspacked file

mark_E
06-09-2003, 12:09 AM
Aspacking a manually UnAspacked file

I have a wee project. I am trying to Aspack an application which was initially Aspacked. I manually unpacked it, patched it, and am now trying to repack it.

The completed unpacked and patched file runs fine - I have removed the original .ASPR and .RSRC sections - relocating relevant 'bits' to other parts of the program. Relocation section has been removed as the pointers pointed nowhere.

I have, with some difficulty managed to repack it, but when attempting to run it it displays an APPLICATION (i.e. not a system error) message box EACCESSVIOLATION. I believe it has trouble accessing some of it's DLLs.

It seems strange to me that the unpacked file runs but the packed one doesn't. I can only assume that I've made an error in my import table somewhere, the system is able to relocate successfully for the unpacked file but not for my packed one.

I don't know which version of AsPack it was originally packed with however expect it to be about the latest version available. I am packing it with AsPack 1.04b (believe it or not).

I'm just wondering if anyone has done similar work and I if might be missing something obvious?

Further details:

Close inspection of my (manually dumped part way through the unpack - table at end of unpack had been overwritten) import table reveals possibly some areas for concern.

The AsPack version I have adds a .DATA section.

Prior to my relocating the original TLS data (from the original .ASPR section) the file would pack but I would get system error messages when attempting to run it.

I have many more details on the steps I have gone through to get to this point. If anyone is interested in helping me I'll give further infos. I guess this is just 'testing the water' so to speak.

Any help appreciated

mark_E
GlObAl
06-11-2003, 12:15 PM
hello mark_E,

are you sure that you handle with Aspack or is it maybe ASprotect?
use PEiD or FileInfo to find out wich one is used.
mark_E
06-14-2003, 02:19 PM
Hi GlObAl,

Apologies for the delay in replying . . . I've just got back to work after 4 days off.

. . . thought someone might ask the question you've just asked! Please read .ASPR as .aspack

At the end of the day, however, I don't care what it's packed with as I now know it's definitely unpacked O.K. and my 'mods' are all sound.

Interestingly enough, when I pack the newly dumped file, I get the exception messages mentioned. If I then unpack this file it runs O.K. Go figure . . .

It seems that the packed program, when attempting to run, calls a routine a number of times and retrieves a value from [FS:2C]. The first time it calls this routine a value is returned which the program doesn't like, subsequent calls return a value the program can live with. I can change this value and get the program to run, everything SEEMS to work O.K. I don't, as yet, know what this routine is checking . . .

I am reluctant to patch this without knowing what it does.

I feel I'm still making progress here , albeit slow.

Any suggestions appreciated.

mark_E
mark_E
06-14-2003, 09:55 PM
After packing with 1.04b, .tls section contained data - previously it was all 0000s. Proggy was getting data from here but unable to clear the data without crashing the program.

Have resolved, NOT solved, the problem by downloading AsPack 2.12 and packing my dump with that.

All is sweet! . . . but real frustrated that I couldn't solve the problem.

Can anyone shed any light on what happened here? Has anyone got any info on tls and threads? - I don't quite follow what was happening here!
sna
06-15-2003, 06:23 AM
the routine you were talking about, is it a part of the application or was it one of the Tlsxxx API functions?

to my knowledge, FS:[2Ch] points to the TLS array for the current thread and references to it will be seen whenever one of the TLS slots are being accessed.

Prior to my relocating the original TLS data... is that the IMAGE_TLS_DIRECTORY itself or the data it points to?
you will need to make sure that the data pointed to by the structure is in order...

most likely this is where you have failed.

edit:
perhaps the sections involved were not given the correct access flags when you relocated the TLS data?

regards, sna
squidge
06-15-2003, 06:51 AM
I would think this would be a section access problem too. Perhaps one of the sections were readwrite, but made readonly by the loader before you managed to dump the process?
mark_E
06-16-2003, 12:41 AM
Hi sna, squidge

Thanks for the reply!

I started to write this and the post just got longer and longer and longer and more and more hard to follow - to answer your queries CORRECTLY I would need to retrace my steps to ensure accuracy. If you are interested I will do this.

So the short answers are:

sna

the routine you were talking about, is it a part of the application or was it one of the Tlsxxx API functions?

. . . part of the application

is that the IMAGE_TLS_DIRECTORY itself or the data it points to?

the IMAGE_TLS_DIRECTORY - just the offset. The correct data was already in the .rdata section (originally this offset pointed to the .aspack section)

sna and squidge

I stuffed around with various section characteristics quite a bit in attempting to work out what was happening - quite probably overlooked something!

Summary:

I expect that you guys are right as I don't really know much about all this but . . .

. . . it seems strange to me that the resultant application packed with Aspack 1.04b wouldn't run and yet packing the exact same file with 2.12 would. I would think that if there was a problem with the dumped file it would show up irrespective of the AsPack version it was being packed with. The only thing I can think of is that the 'b' in 1.04b does stand for beta.( It also seems strange that the file packed with 1.04b, when dumped, would run fine.)

mark_E
GlObAl
06-16-2003, 04:28 AM
hello,

you really need to repack it? i mean have you thinking about inlinepatching your target?

for aspack its really easy to inlinepatch it...
mark_E
06-17-2003, 01:15 PM
Yes! I did think of inline patching this but in the end there were such a large number of changes that I thought it would be easier to just repack it.

mark_E


FAO nikolatesla
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FAO nikolatesla
PDA

View Full Version : FAO nikolatesla

hobferret
06-09-2003, 10:17 AM
Hiya nikolatesla:)

I have put the Vbox 4.6.2 tutorial into a htm format, is it OK to upload it to your site?? - I got nowhere to put it!!!!

Makes better reading - easier on the eyes - with all respect to Lunar_Dust!
;)

/hobferret
nikolatesla20
06-09-2003, 10:32 AM
Sounds good, you can email me at

nikolatesla20
@yahoo.com
and I can upload it to the site and post a link here, or whatever else works.

-nt20
hobferret
06-09-2003, 10:36 AM
Hiya nikolatesla

It's on it's way shortly!

Thanx

/hobferret;)
hobgoblin
08-04-2003, 05:30 PM
Hi Nikolatesla,
Where is your site? Is the url open for public?

regards,
hobgoblin
sope
08-05-2003, 12:29 AM
Here you go will find all his good work hxxp://webpages.charter.net/nikolatesla20/

Sope.
nikolatesla20
08-05-2003, 02:02 AM
heh, perhaps eventually I will actually make a "page"....

good news,l if you search yahoo for "nikolatesla20", the first hit is my angelfire site :) - but it's all reversing unrelated right now.

-nt20
hobgoblin
08-05-2003, 08:46 AM
Thanks a lot guys.:-)

regards,
hobgoblin
evaluator
08-05-2003, 09:53 AM
i DLD & view that tutor.. not bad design.

but there are screenshots of prog with logos.
you should obtain license from owner for display them.
[thiz iz iLLegaLL]:)
hobferret
08-05-2003, 10:23 AM
hi evaluator

You state

"i DLD & view that tutor.. not bad design.

but there are screenshots of prog with logos.
you should obtain license from owner for display them."
"[thiz iz iLLegaLL]"

Now I don't know if you are talking about the vbox tut but if you are I don't understand why it has "logos" - it is a licensed copy of Dreamweaver not a cracked one! Allbeit a copy of the College one it still should not show any "logos" ;)

/hobferret
evaluator
08-05-2003, 02:57 PM
i wrote it kindly..

but seriously, what is purpose of image004.jpg & image046.jpg??
advertising?

If somebody have FH, s-he already knows how it looks..
hobferret
08-05-2003, 03:19 PM
Hi again evaluator:)

Still not on your track - the only place I goten image***.jpg etc is in the subfolder - and that was the way Dreamweaver ripped them off when a word.doc was loaded. It was easier and faster to use the names given rather than mess aroumd changing them - just a matter of dropping the right one in the right place:D

Hope this clears matters up;)

/hobferret
evaluator
08-05-2003, 03:30 PM
yah!

those images are simple screenshots of program & VBox nag.

i JUST recommend, remove them..

regards
hobferret
08-05-2003, 03:45 PM
yah!

Sure my musician friend - remove them and you just get a page of text - no images!!:(

Not of much use to anyone is it???

/hobferret
evaluator
08-05-2003, 06:41 PM
you play with me..

last time i explane:
that 2 images IMHO are useless.

bye.
hobferret
08-06-2003, 05:30 AM
Yo evaluator:)

Don't take the hump - I ain't playing with you!

This tut was by Lunar Dust, all I did was to transform it to html so it was easier to follow. Being as he produced it I do not feel it right to change it in any way whatsoever. So if you don't like the "advertising" blame him not me!:cool:

/hobferret - still on vacation;)
evaluator
08-06-2003, 09:26 AM
ah, sorry!

I thought, it was your tutor.
ok.
Lunar_Dust
08-06-2003, 11:20 AM
good point evaluator, I never thought of that - I'll try and make time to edit the tutorial and remove those bitmap images.

-Lunar
nikolatesla20
08-18-2003, 01:51 PM
OK I fixed the tutorial , removed copyrighted images. Thanks for the input guys.

Once again, unpacking VBOX 4.6.2

hxxp://webpages.charter.net/nikolatesla20/MXVbox_htm.zip

-niko
evaluator
08-18-2003, 02:20 PM
okey, thanks for accepting my suggestions..
would you like that squidge's lost prize, so you can enjoe with
my unpuking technique of MMDWMX!?
~:)
hobferret
08-18-2003, 04:16 PM
Hi Lunar Dust -nikolatesla20 - evaluator :)

God I don't believe it:D

This thing still dragging on - I just hope Lunar Dust removed it being as it was all his work in the first place - I did notice it evaluator, however, you got me confused when you spoke of logos I thoughy you meant Dreamweaver was putting up logos; but did not feel right to remove them being as it was not my project - all credit goes to our nite time hero Lunar Dust!!

/hobferret - - now back home;)
nikolatesla20
08-18-2003, 04:29 PM
eval: huh ? :)

Actually think I'm going to make an Armadillo tutorial soon, for protected DLL's, CopyMem, blah, blah, etc. However, don't know if I want to give away all my "secret techniques" to Chad and friends.

-nt20


VBOX 4.6.2 tutorial, HTML format
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VBOX 4.6.2 tutorial, HTML format
PDA

View Full Version : VBOX 4.6.2 tutorial, HTML format

nikolatesla20
06-09-2003, 02:00 PM
Here's the VBOX tutorial, nicely translated to HTML by hobferret. Thanks! It's a lot easier to read now !

hxxp://webpages.charter.net/nikolatesla20/MXVbox_htm.zip

-nt20


New ASPR Tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New ASPR Tool
PDA

View Full Version : New ASPR Tool

LaBBa
06-09-2003, 02:33 PM
asdoctor 1.00 - small tool for lazy boys. now you have no need to unpack
aspr`ed program. to make patch folow the next steps.

* steps:

- register aspr`ed program with stolen or not stolen yet key;
- run asdoctor, it will extract from key only information needed to
decrypt encrypted blocks and save it to bat file;
! - (no private information will be extracted);
- delete key from registry (this is not principle, I only want to say you
don`t need it anymore);
- run bat file in the program dir (it will work like registered);
- move program anywhere you want (of course with bat and asdoctor);
! - this tool will work not with all asprs.

* requirements:

- asdoctor works only under 2k and XP, also you must have
administrator's rights;
- there will be no win9x version;

syd@svitonline.com
http://www.is.svitonline.com/syd
http://www.is.svitonline.com/syd/asdoctor_v100.rar


how to....make a buffer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > how to....make a buffer
PDA

View Full Version : how to....make a buffer

jcsn
06-10-2003, 01:58 PM
Ok, this should be the most confusing post ever..:)

Basically, I have a mail program which sends "HELO (your_host_name)" to the mail server, and I'm trying to get it to send "HELO (random_string)."

I was able to change it and make it send a static string like "HELO yahoo.com," but my main problem with having it send a random string is converting the integer to a string. To get the "random" number, I'm calling GetTickCount, which (I think) sets EAX to it's return value.

I've read the other posts on this board about converting integers to string by using _wsprintfA. That isn't available in my target, but I found sprintf which seems to be the same, so that's what I've been using instead. NOW! :) my problem (I think) is how I'm setting aside a buffer for sprintf to use. I tried opening the program in Hiew and finding a bunch of free space (bunch of 0's) and changing them to 20's for spaces, then passing the address of that for the buffer and it errors (well, freezes Olly). I also tried just pointing it to an address with a bunch of zero's and it errors, as it probably should.

I hope you understand what the hell I'm talking about. :)

Here's the sprintf changes I've made:

I changed (this is right after it gets "your_host_name" with gethostname, and the hostname is in EAX)
00464CFE . E8 B5FCF9FF CALL advanced.004049B8
to
00464CFE /E9 B94D0800 JMP advanced.004E9ABA

So this jumps to the extra sprintf code I'm putting in. Then..

004E9ABA E8 6FCE9977 CALL KERNEL32.GetTickCount
004E9ABF 50 PUSH EAX ; GetTickCount return value?
004E9AC0 68 EE9A4E00 PUSH advanced.004E9AEE ; ASCII "%X"
004E9AC5 68 F19A4E00 PUSH advanced.004E9AF1 ; ASCII " " (there's more spaces, only shows one on messageboard)
004E9ACA E8 F0DCAA77 CALL ntdll.sprintf
004E9ACF A1 F19A4E00 MOV EAX,DWORD PTR DS:[4E9AF1] ; replace EAX, which has "my_host_name" with the GetTickCount output
004E9AD4 E8 DFAEF1FF CALL advanced.004049B8
004E9AD9 ^ E9 25B2F7FF JMP advanced.00464D03

Is this at all salvagable, or is it completely wrong? I know for sure it's at least a little bit wrong hehe :)
Lunar_Dust
06-10-2003, 02:12 PM
Just a question -

Did you look at the memory area and make sure the string was there right after the call to sprintf? If that works, then at least you know your code snippet is doing its job, and the problem lies elsewhere (like, for example, it may expect a unicode string)

-Lunar
jcsn
06-10-2003, 02:17 PM
Hmm...I saw the string in one of the registers I think. I've changed it around so many times I don't remember when. I'll go look now 8u)

Thanks for quick reply

Edit:

Ok, I think when I saw the string in one of the registers it was when I was using an alternate method I saw posted on here, which used a loop. I just tried:

004E9ABA E8 6FCE9977 CALL KERNEL32.GetTickCount
004E9ABF 50 PUSH EAX
004E9AC0 68 EE9A4E00 PUSH advanced.004E9AEE ; ASCII "%X"
004E9AC5 68 F19A4E00 PUSH advanced.004E9AF1 ; ASCII " "
004E9ACA E8 F0DCAA77 CALL ntdll.sprintf
004E9ACF A1 F19A4E00 MOV EAX,DWORD PTR DS:[4E9AF1]
004E9AD4 E8 DFAEF1FF CALL advanced.004049B8
004E9AD9 ^ E9 25B2F7FF JMP advanced.00464D03

I set a breakpoint on 004E9ACF and it never got there, so I assume the call to sprintf is erroring and the program's catching it.

Edit2: And I set a breakpoint on 004E9ABA just to make sure my code was being run. :) (it is)
diz
06-10-2003, 02:23 PM
Originally posted by jcsn
program in Hiew and finding a bunch of free space (bunch of 0's) and changing them to 20's for spaces, then passing the

don't change to 20h, leave 00h's there

004E9ACF A1 F19A4E00 MOV EAX,DWORD PTR DS:[4E9AF1]

maybe "mov eax, offset 4E9AF1"? If eax oryginally had host name then it was a pointer to the string. You want to make it a pointer too.
jcsn
06-10-2003, 02:31 PM
Ok, I changed them back to 00's and I get the same problem. Olly says it's running, but the target program's frozen and the code after the sprintf call doesn't get executed. Be nice if it gave me some sort of error 8-T

Edit: This brings me to another question. :) To find buffer space, I'm just scrolling around in Olly looking for a bunch of 00's. Is the entire file fair game or is there only certain places you can put a buffer?
diz
06-10-2003, 03:14 PM
If it's data section then you should not take this space because it can be used by program. Better make a new section and place data there.

I just compiled some program in vc++ with sprintf function and actually this whole function was hardcoded in this exe. In your's snippet I see that it's imported from ntdll, hm... I'm confused :confused:

The best way would be IMO for you to write your own proc which will convert dword to string. If you don't know how, you can go here http://m4sh.atpa.eu.org/~bart/asmpak.php3 (hi bart :)) and try asmpack. The descriptions are in polish but you should be able to work it out.
jcsn
06-10-2003, 03:29 PM
Alright, thanks. So maybe I should use Snippet Creator with bart_dword2hexstr.inc? I'll see how that works out. :)

Thanks fellas
jcsn
06-10-2003, 04:27 PM
One more question. :)

If it's data section then you should not take this space because it can be used by program.

Would the CODE section be ok or should I just make a new section no matter what? I ask because I'm not sure how to make a new section and would have to find out first. 8-p

Edit: To clarify, I'm asking if it's ok to put extra code in some free space in the code section. :)
diz
06-10-2003, 04:43 PM
Originally posted by jcsn
One more question. :)
dit: To clarify, I'm asking if it's ok to put extra code in some free space in the code section. :)

yes, if there are 00's than it's ok to use it but you need to put variables somewhere. They can't be placed in code section unless you change it's characteristics to allow writing to it (the code section is only readable by default). Use any PE editor (ProcDump, LordPE or PEEditor) to do it. U can use them to add new section, too.

Or use CodeSnipperCreator, select appropriate option and it will create new section with your own code automagiclly ;)
squidge
06-10-2003, 04:54 PM
Way I normally do it is this:

Load executable into PE editor (eg. LordPE). Get the raw size of the section, load the hex editor, and go from the end backwards and try and squeeze you code in there. Try and keep your code on a 16 byte align (use LordPE to convert the file offset to VA, and make sure last hex char is 0 - so for example 401990 is aligned ok).

Or.... (bit more complex)

View sections. Looks at RawSize/VirtualSize.

If raw size is smaller than virtual size, then subtract them, and you have at least this many bytes to play with :) Add your required number of bytes to rawsize, and realign the file. After realigning, you have space to play with.

Or...

Add a new section.

BTW, I hope this is a learning exercise, as you do know your ISP will completely ignore anything you put after the HELO command apart from placing into remarks of mail bounces, etc? For tracing purposes, your ISP itself will add an extra header to each of your emails with your IP address (sometimes encoded). So by giving HELO a random number instead of your host name doesn't really accomplish anything.
jcsn
06-10-2003, 05:00 PM
So by giving HELO a random number instead of your host name doesn't really accomplish anything.

Heh, yeah. The person who wants me to change it just doesn't want their host name showing up in the helo part of the header for some reason. 8-T

I didn't know about that aligning thing (add that to the huge pile of stuff I don't know)...I'll change mine so it's aligned properly. :)

Thanks fellas
dELTA
06-10-2003, 06:18 PM
It seems to me like your solution is very overkill just in general, and it's getting worse by the minute, so I feel urged to intervene here before it goes completely out of hand. :D

First of all, why not just send a hardcoded bogus string after the HELO if all you want to do is to prevent the original string from being sent? Why the random integer?

Second of all, if you necessarily want to write a random integer string, you don't even have to write a generic integer to string function, just do it with some simple inline code like:

mov [string_char], (rand_int mod 10) + 48

(repeat for each digit you want)

dELTA

PS.
Yes, that is pseudo-code, but you get the picture. :)
jcsn
06-10-2003, 06:38 PM
First of all, why not just send a hardcoded bogus string after the HELO if all you want to do is to prevent the original string from being sent? Why the random integer?
Quick answer: my friend asked "Could you make it do HELO (rand) instead of HELO blah?" lol

mov [string_char], (rand_int mod 10) + 48

Thanks, gave me the genius idea of just using the last number from GetTickCount, since that's random enough, hehe. :)
doug
06-11-2003, 02:07 PM
just one comment..
I thought that, due to its variable number of parameters, the sprintf function was part of another calling convention (_cdel i believe), where the caller has to fix the stack.
That's the case in C & for the win32 wsprintf. Therefore, you would have to add 12 to esp (if you pushed 3 dwords) after calling sprintf. It might not always be noticed, but not fixing esp for these functions is definately going to cause your problems at some point.

Btw, the free space you found in the exe (for your buffer).. that wasn't in any code section, right?

Also, if you are careful with what you are doing, you can place your buffer on the stack.
Substract esp to make space & call sprintf, do everything with u need with your buffer, add to esp to shrink it (and clear the buffer).

--
doug


TryMedia Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > TryMedia Question
PDA

View Full Version : TryMedia Question

CuTedEvil
06-11-2003, 02:21 AM
Hi all,

I'm new to packing/unpackin stuff, just wanted 2 know sth (i think i've already asked the question somewhere but no reply :confused: ) anyway..

my question: IS there any way to unpack a TryMedia packed file?? is it <unpackable>??

Any1, knows any info about this packer?? (only 1 russian tut about it)..

thanks in advance..
cya
CuTedEvil
squidge
06-11-2003, 03:03 AM
Yes, it's unpackable. Anything that can be run, can be unpacked :)

I've only unpacked one file with TryMedia however, and I did that with ollydbg, so can't really hold your hand through the process.
CuTedEvil
06-11-2003, 05:22 AM
Hi squidge =)
1st, thx 4 the reply..
I've only unpacked one file with TryMedia however, and I did that with ollydbg
So can u excuse me being a newbie in unpacking, can u tell me plz, the most important things i should know about, when trying 2 unpack (TryMedia) ??

wut should i do 1st? Wut tutz should i read?? most of tutz, are about a specific packer, does that really help me in TryMedia??

umm.. n don't u think about writing a tutorial for unpacking TryMedia?? :p ;) there's no such tut in the web..

Thanks again, n hope 2 get more info =)

cya
CuTedEvil
CuTedEvil
06-14-2003, 01:13 AM
I could dump the file (correctly as i think) then i rebuilt the IAT using Import REConstructor, the file then disassembled correctly, but it crash when it run.. wut's possibly the problem??

cya
CuTedEvil
hobferret
06-14-2003, 04:32 AM
CuTedEvil

could dump the file (correctly as i think) then i rebuilt the IAT using Import REConstructor, the file then disassembled correctly, but it crash when it run.. wut's possibly the problem??

You don't have to look far - obviously 1 or more of the IAT calls are wrong - there are load's of info on this subject on this site, just search for it and how to overcome the problem!:rolleyes:

/hobferret


is this new cryptor?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > is this new cryptor?
PDA

View Full Version : is this new cryptor?

kyrios
06-11-2003, 01:53 PM
Accidentally, i found this new doll. Sorry if this is old. But the site told me it's brand new one.
name : AntiCrack Protector (in Short term: ACProtect)

ACProtect is an application that allows you to protect Windows executable files against piracy,using public keys encryption algorithms (RSA) to create and verify the registration keys and unlock some RSA key locked code,it has embedded cryptor against dump and unpacker.it also has many anti debug tricks. And you can use it to create evaluation and trial application versions. with specialized API system, mutual communication between loader and application is also can be achieved.

Key Features

RSA1024 - With RSA keys system,cracker can not write a KeyGen(or KeyMaker) of your production without the RSA private key(the RSA private key only in the author's hand).And your can specify some code to be locked by the RSA keys,so is the cracker have not the proper key.dat on the proper machine,the code protected can not decrypt.
Polymorph - Polymorph decryption routines and several encrypted layers. The code being protected varied every time your protect your application.

Embedded cryptor - You can specify the place in your application to embed the inner cryptor. With the embedded cryptor,your application can not be cracked even though the cracker know the original entry point(OEP) and rebuild your Import table.
Mutual Communication - API system which allows communication between application and loader,loader can call some of the application's export function ,and the application can call the function the protected system provided.

Anti patch/loader - Protects your files against patching/modifications and disassembling
Anti-Soft ice - Numega Softice(tm) detection and Frogsice detection
Anti debug,dump,trace...Anti-debugger&Monitor like W32Dasm, SoftIce, TRW 2000, Turbo Debugger, Sourcer, Filemon, ExeSpy, ResSpy, RegMon, Memory Monitor etc.
Runtime code encryption Important parts of your code can be protected individually, providing extra protection against memory patches.

System-specific licenses License keys may be locked to a specific system by checking the computer's unique fingerprint(such as hard disk id,CPU Id etc.)
Stolen keys keeping of the database and checkup of "stolen" (illegal) registration keys
Trial setting possibility to create evaluation (trial) versions, that limit application functions based on the number of runs left

You curios? siskinsoft.com
I'm currently downloding right now

kyrios
Lunar_Dust
06-11-2003, 03:10 PM
What do you bet that some of these "new" protectors are simply ASProtect, or such programs, that have been simply ASM ripped, and have a new UI attached (Along with a couple more small additions)

Looks to me a strong possibility, given the seemingly quick and large release of so many "new" programs.

In fact, I see very little difference between this and ASProtect. They even look the same.

-Lunar
Shoob
06-11-2003, 04:31 PM
hm its some asprotect thing.. OEP is 4B6A3C trying the resolve to unretrieved entries manually.. nice protector only for thereself protector. Results for Notepad.exe:

Compression1 -> protect! -> test -> crash! -> running normally ? -no
Compression2 -> protect! -> test -> crash! -> running normally ? -no

"Use no Compression" :p
Tola
06-11-2003, 04:42 PM
mh, let's see... the features description on their homepage is a copy/paste from aspack.com, they're not even listed on those sites they claim to have gotten awards from and they want 149$ for a single license...:rolleyes:
squidge
06-11-2003, 05:23 PM
Hmmm, "perplex". I'm sure I've heard that name before on Exetools when someone asked to test there protector. I remember they used a dll to do the compression.

Strangely enough, the exact same dll is still being used, and is simply attached to the program being protected :

perplex.dll :
zcf_createPQEM
zcf_decrypt
zcf_encrypt
zcf_getP
zcf_putP

Interesting thing is, my hello world masm test program that I put all packers/protectors through comes out at 49kb. Decompressing the perplex.dll (upx compressed) and reprotecting my file, I find out that the size drops down to 29kb.

From a quick check at the asm, it seems to have the usual debugger checks, but also manages to bomb out Ollydbg, which is a first. Easy enough to get around though.

Unpacking a ACProtected program, I can see the following strings in the loader:

EXESPY
WXR95
REGMON
FILE MONITOR
REGMONEX
WINDOW DETECTIVE
DEBUGVIEW
RESSPY
ADVANCED REGISTRY TRACER
REGSNAP
MEMSPY
MEMORY DOCTOR
PROCDUMP32
MEMORY EDITOR
FROGSICE
SMU
WINSPECTOR
MEMORY DUMPER
MEMORYMONITOR
NUMEGA SOFTICE LOADER
URSOFT W32DASM
GENERIC_WKTTELOCKDUMPER
-=CHINA CRACKING GROUP=-
OllyDbg
TRW2000

However, other than that, it's pretty much bare. No OEP bytes missing, no fancy dipping that I can see. Managed to dump the program and fix import table within 10 minutes (!!!). Definitely no ASProtect - maybe ASProtect Lite :D
lownoise
06-12-2003, 01:36 AM
It's just a rename of ultraprotect:p
You only have to look at the registar info of the domainnames:D

The loader code is full off smc and some debugger tricks.
IsdebuggerPresent
Detecting debugger by PEB, thanks to ^DAEMON^
Checks for BP on api
Detecting of parent thread and killing (nice one for detecting olly:p)

As squidge already said unpacking this baby will cost you only 10 minutes.
evaluator
06-12-2003, 01:38 AM
why not listed LordPe?

seem author very much likes it:)
Gaia
06-12-2003, 04:59 AM
GENERIC_WKTTELOCKDUMPER !!!? :confused:

You can get virgin ImportTable with "bpx LoadLibrary+1", then dump IT section.....very primitive packer...

Gaia
bart
06-12-2003, 06:49 AM
from the /example/vc/test2Dlg.cpp

void CTest2Dlg::OnButton1()
{
//example of embedded protect,

//Ultraprotect will embedd a cryptor(include anti-debug,anti-trace,encrypt,decrypt fucntions etc.)here.
//The Cryptor encrypt the codes between the embedded lock header and embedded lock tail ,then communicate with the loader;
//After checking,then decrypt the codes,and run the decrypted code .

it seems this guy is selling the same software with 2 different names :)
squidge
06-12-2003, 07:14 AM
Must work in marketing ;)

Sell same product under two completely different names and hope to get more sales, or perhaps the same person buying both...
Lunar_Dust
06-12-2003, 08:57 AM
That detecting of parent thread is a good one - or are you sure it's just not using GetWindowText(). Parent thread detection would require more low level NT functions..I've thought this is what some protections should do, but maybe the CREATE_NEW_PROCESS_GROUP prevents it parent from being detected? (was my theory)

Besides, you could probably just rename the olly EXE then anyway.

-Lunar
Information
06-12-2003, 08:15 PM
the utralprotect is rename to acprotect after 1.08,see the help file.

some thing interesting,after unpack the exe still have ability to antidebug.maybe use some ticks from pelock?
nikolatesla20
08-26-2003, 08:57 PM
Looks like the new version on asprotect does do some OEP trix. After I protect an application, the first 6 bytes are garbage (after memory dump)

Also, debugger detection seems to work pretty well, or maybe it's just 'cause my brain is fried from working on Arma for so long - Arma is just too easy methinks..

IAT protection still weak ass tho.

-nt20
nikolatesla20
08-27-2003, 01:51 PM
Steals the first 6 bytes of original program..

I've found the nice embedded cryptor codes the protection talks about. Even if you have an application in which you don't "activate" these, you still get them.

They're not so hard. Just a lot of them....behavior similar to the protection on Fusion by BiTarts.

-nt20


What is it doing?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > What is it doing?
PDA

View Full Version : What is it doing?

neemous
06-11-2003, 11:26 PM
I'm not quite understanding what this function
does. It seems to be doing alot of math to me,
but it seems to have no context. Its in a dongle
protected program. It gets called many times,
sometimes before and after calls to the dongle
other times seem unrelated to the dongle apis.
Its input is usually a large number, not always.
The input isnt any return from the dongle/emulator
as far as I can tell, and when it returns, it
sets a flag (I think) but no real decisions are
made. The program just continues on its way,
checking the dongle more. :

MOV EAX,[ECX+04]-usually a big number like: A03982E0
MOV ECX,EAX
MOV EDX,EAX
XOR ECX,00016000
XOR EDX,00000680
SAR ECX,0C =FFFA038E..I dont really understand shift instructions
AND ECX,3F
SAR EDX,06
SHL ECX,06
AND EDX,3F
ADD ECX,EDX
MOV EDX,EAX
XOR EDX,-13
XOR EAX,00700000
SHL ECX,06
AND EDX,3F
SAR EAX,12
ADD ECX,EDX
AND EAX,3F
SHL ECX,06
NEG EAX
SUB EAX,ECX
AND EAX,00FFFFFF
RET

Then it will return to something like:

SUB EAX,EDI- in this case EAX is now 00C6ECAE
MOV ECX,[ESP+14]
MOV [ESI+1C],EAX
XOR EAX,EAX
CMP EDI,EBP
MOV [ESI+14],EBP
SETZ AL
MOV [ESI+10],EAX
MOV EAX,ESI
POP EDI
POP ESI
POP EBP
POP EBX
MOV FS:[00000000],ECX -what is this?
ADD ESP,10
RET 0004

Can anyone give me a clue what this program is doing
and why it does it so many times?

Thanks, n
naides
06-12-2003, 09:09 AM
[QUOTE]Originally posted by neemous
I'm not quite understanding what this function
does. It seems to be doing alot of math to me,
but it seems to have no context. Its in a dongle
protected program. It gets called many times,
sometimes before and after calls to the dongle
other times seem unrelated to the dongle apis.
Its input is usually a large number, not always.
The input isnt any return from the dongle/emulator
as far as I can tell, and when it returns, it
sets a flag (I think) but no real decisions are
made. The program just continues on its way,
checking the dongle more. :

] I MAY NOT BE ABLE TO TELL YOU EXACTLY WHAT IS GOING ON, BUT I MAY TAKE YOU CLOSER. MIKE, FORM CRYPTO BOARD, MAY HAVE A BETTER IDEA WHAT ALL THIS MEANS

MOV EAX,[ECX+04]-usually a big number like: A03982E0
MOV ECX,EAX ;MAKE COPIES OF YOUR NUMBER HEREON N TO ECX
MOV EDX,EAX ; AND EDX
XOR ECX,00016000 ; NOW PROCESS N WITH A XOR INSTRUCTION
XOR EDX,00000680
SAR ECX,0C =FFFA038E..I dont really understand shift instructions ; BITWISE SHIFTS TO THE RIGHT h0C TIMES KEEPING THE SIGN BIT
AND ECX,3F ;LOOK UP THIS OPS IN A ASSMBLE REFERENCE SITE
SAR EDX,06
SHL ECX,06
AND EDX,3F
ADD ECX,EDX
MOV EDX,EAX
XOR EDX,-13
XOR EAX,00700000
SHL ECX,06
AND EDX,3F
SAR EAX,12
ADD ECX,EDX
AND EAX,3F
SHL ECX,06
NEG EAX
SUB EAX,ECX
AND EAX,00FFFFFF
RET

WHAT I THINK IS GOING ON IS THAT THE PROGRAM IS CALCULATING A HASH OF THE NUMBER N, WHICH WAS PASSED IN [ECX+04] AND RETURNS IT IN THE EAX REGISTER

Then it will return to something like:

SUB EAX,EDI- in this case EAX is now 00C6ECAE
MOV ECX,[ESP+14]
MOV [ESI+1C],EAX ; HERE! A COPY OF THE HASH (AFTER BEING SUBSTRACTED FROM EDI, ABOVE) IS SAVED IN [ESI+1C] PUT A BPM ON THIS ADDRESS AN CATCH WHO READS THE PROCESSED HASH
XOR EAX,EAX
CMP EDI,EBP
MOV [ESI+14],EBP
SETZ AL ;THIS FLAG HAS LITTLE TO DO WITH THE RESULT OF YOUR HASHING PROCEDURE
MOV [ESI+10],EAX ; BUT THE FLAG GETS STORED NEAR THE PLACE WHERE THE HASH GOT STORED
MOV EAX,ESI
POP EDI
POP ESI
POP EBP
POP EBX
MOV FS:[00000000],ECX -what is this? ; THIS IS TIPICAL SEH (STRUCTURED EXCEPTION HANDLING) CODE. IN C++ SEH IS USED WHEN YOU try AND catch CODE, LOOK IT UP.
ADD ESP,10
RET 0004

Can anyone give me a clue what this program is doing
and why it does it so many times?

IT IS MY IMPRESSION THAT IT IS HASHING THE DWORD VALUES PASSED TO THE SUBROUTINE i.e CALCULATING, GIVEN N,

hash== f(N) WHERE f IS THE HASHING FUNCTION, WHICH IS A NON-REVERISBLE BITWISE SERIES OF OPERATIONS.

Thanks, n [/QUOTE
neemous
06-12-2003, 07:04 PM
Thanks naides, informative as always.
Not really what I wanted to hear though,
thought this program might be a
good one to learn with as it only
calls a few basic dongle apis. I will
look into whats checking the return
values of the function, I dont
think im ready for any crypto adventures
though..
Thanks, n


this is true new protecter!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > this is true new protecter!
PDA

View Full Version : this is true new protecter!

Information
06-13-2003, 04:31 AM
a bit hard

hXXp://www.softdefender.com/index.htm
Shoob
06-13-2003, 05:20 PM
you know what he use to detect olly?
evaluator
06-15-2003, 09:32 AM
hm!

I tested this packer & found:
WinACE can compress better!
for example I packed some dump from memory
and get size: 220 859 byte;
while original EXE is 328 192 byte...

Eh! unfotunatelly, limit here is 204000 byte,
so I fail for upload magic dump(:(

I THINK! this packer probably can FAIL for run on AMD!!
[INCORRECT TRICK]
Hey! Somebody have here AMD for test!?
Shoob
06-15-2003, 10:22 AM
i have AMD and packer work.
evaluator
06-16-2003, 01:14 AM
hm, but once I mastered such like trick,
& AMD user notified me about crash..

I will build some AMD test prog.

BTW, what AMD you have
Hopcode
06-16-2003, 05:48 AM
The packer doesn't run on my computer, except if i use Soft ice.
Then it detects it but i can bypass that.

Maybe you should try on your AMD without Sice loaded and see if it crash or not?

Im using an AMD here, and without Sice, it crashes.
i experienced such behaviors before, when i was coding some test apps. Could be a bug in the detection or something.
Shoob
06-16-2003, 07:30 AM
AMD XP 2000+ used.
dreamer
06-16-2003, 11:42 AM
Originally posted by evaluator
I THINK! this packer probably can FAIL for run on AMD!!
[INCORRECT TRICK]

Which trick is incorrect? Can you give us some codes or details?
Hopcode
06-16-2003, 01:13 PM
Originally posted by dreamer
Which trick is incorrect? Can you give us some codes or details?

Are you working for them ? ;-)
new user asking for this he he.

Anyway, i protected some files with that protector and unpacked them without problems.
There isn't much to say about that protector.
It's another clone :)
evaluator
06-16-2003, 03:37 PM
Hopcode!

Clear for me one thing: with SICE you bypass detection & then
it no more crashes??

What type is your AMD?

then we continue.. even if Dreamer is saddAMD:)
bart
06-17-2003, 07:18 AM
it isnt amd's fault it doesnt work without si disabled (rem in autoexec.bat), disable si from its control panel and try again :)
evaluator
08-03-2003, 05:09 AM
ya, back to this thread.

INCORRECT is to use undocumented
trick with self-overwriting REPE instructions.

remove it.
loman
08-03-2003, 07:13 AM
anyone sprotected it? i worked a month ago but was unable to understand crc calculations....... I saw it uses anti-stepping tecnique and it's easy to bypass... the one for olly and/or softice I was unable......thanks


does someone know how the altera ip encryption core work?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > does someone know how the altera ip encryption core work?
PDA

View Full Version : does someone know how the altera ip encryption core work?

ic_ray
06-13-2003, 07:32 AM
It use the encryption method to encrypt the IP cores .Does someone knows its encryption tool and its seeds?
FoxB
06-14-2003, 06:58 AM
Old IP cores - DES, decrypt no problem.
New IP cores - TripleDES, may be decrypted if you have VENDOR_STRING from license.

PM me if need.

FoxB


OCX unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > OCX unpacking
PDA

View Full Version : OCX unpacking

tazmanian
06-13-2003, 10:34 AM
This is a very strange thing, that i'll explain...

I'm unpacking an ocx file, packed with not comercial packer, a selfmade one...

Each time the program (VB5) loads the OCX in a especific memory address range....see this:

OCX file info:
ImageBase: 1830000
Size : 410000

Each time the program loads the ocx in 1BC0000 or 1BE0000, not 1830000 address, so, the unpacking only will work here, not in other PC's...

Cause the "jmp dword [APIAddress]" will point to 183xxxx, not the right address, resulting a fault.

2 app uses the same ocx, but one loads at 1830000 addres (correct one) and the other loads at 1BC0000 address (wrong :()

Like this:
Correct one:
1825415 jmp dword ptr [183xxxx] <-- same range address

Wrong one:
1BC5415 jmp dword ptr [183xxxx] <-- different, causing a GPF, cause jumps out of file =\

How can i make a OCX to work in any memory range?

Thank you!
evlncrn8
06-13-2003, 04:23 PM
make new reloc info, an ocx is essentially a dll if im not mistaken, so for those addresses to be updated, you would have to apply some reloc info to the dump, lots of work tho heheh
sope
06-14-2003, 12:02 AM
Hello tazmanian

For Relocation fixup give it a try to Mackt's Relocation rebuilder "ReloX" (http://www.woodmann.net/crackz/Tools/Relox.zip)

Good Luck.
Sope!


ResFixer v1.0 beta 1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ResFixer v1.0 beta 1
PDA

View Full Version : ResFixer v1.0 beta 1

mr. seeQ
06-14-2003, 03:42 AM
This programm resolve a situation when you want to remove unnecessary code from dumped exe, which after unwraping is no longer needed. ResFixer - is a resources rebuilder which trying to restore.rsrc (resources) section. As you know many protectors/packers moving some of resources(Icon, Icon Group, Version inf) to it's own section. In this case you can't remove protectors/packers section(s) after dumping.


IceExt 0.30
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceExt 0.30
PDA

View Full Version : IceExt 0.30

volodya
06-14-2003, 10:52 AM
Guys, new version of plugin which now can work with 3.0 beta and has some more tricks. Author announced beta-testing period. So we all are interested in making it our best.
You may download it from
hxxp://www.wasm.ru/toollist.php?list=10
or from Sten site.
THEN, PLZ, make you comments either here, or at exetools.com, or at wasm.ru ("link "Êîììåíòàðèåâ"") or writing directly to Sten.
bedrock
06-14-2003, 12:38 PM
Sounds good, just what i've been looking for, but the download on wasm.ru and also Sten's homepage still only seem to be version 0.25. :(

Hopefully new version will be available soon.
SpeKKeL
06-14-2003, 01:07 PM
Downloaded and using it on xp (driversuite 2.7).

Hides si well :D (must say it tells it's version 2.5 ??)

(SSssttt... before alex adds it to his new aspr version)

SpeKK.
volodya
06-14-2003, 03:33 PM
Sorry, guys!!!!
I corrected everything. Download it again! Sorry!
Zilot
06-15-2003, 03:47 AM
volodya !

Did you improve BPR! instruction with IceExt, when I last time spoke to Sten he said he wasn't satisfied with that, and that should be corrected.
bedrock
06-15-2003, 05:11 AM
Thanks for the updated link it now downloads version 0.30, i installed this and run it ok on softice 4.3.0 build 1126, but after leaving softice and using os for a few mins i got another KeBugCheck, what is best way for me to catch these and report info back, i have turned FAULTS ON command in softice and will add info if this happens again.

Thanks for all your efforts

--
bedrock
Kayaker
06-15-2003, 04:44 PM
Hi All

Thanks for the update and this has been impressive ongoing work by Sten. The BPR command looks to be a work in progress still, but the basic functions seem to be there. A working BPR command raises some interesting possibilities to log all instructions executed within a range of code, similar to the Backtrace feature in Win9x.

The Int 0E page fault handler for the BPR function currently emulates the faulting instruction then pops up Softice and outputs CR2 (linear address that caused the page fault) and CR3 (page directory base address) to DbgPrint, before returning control.

If the function had a "T(race)" flag the handler could instead dump the cs:eip address of the faulting instruction to a file for example with the NT Kernel equivalent of IFSMgr_Ring0_FileIO. This dump file of addresses could later be disassembled in the same memory context as the program to provide a text output of the executed instructions. This is essentially how the Backtrace feature works, each traced instruction is dumped as 7 byte addresses (ring, cs, eip) to memory and disassembled later by Softice when you type SHOW.

This could even be done outside of IceExt by a small loader/disassembler application. If a duplicatable CRC check was done on the PE header or small section of the OEP code of the program being run, and written to the start of the file by a small procedure when the BPR "T" breakpoint was set, it could act as a check on the file when being opened by the external loader/disassembler app.

Ideally you'd like to record the opcodes at the instruction instead of the address, because this would ensure any code overwritten later by the program would not be lost during the (static) disassembly of the addresses from the file by the loader application, and you would get a true run-time disassembly of execution. But this implies having the disassembler function within the interrupt handler, which is far from ideal, or at the minimum recording irrelevant opcodes.

Instead of popping up Softice the handler would have to quietly emulate the instruction and return control flow to the program, after writing the address to file of course. If the BPR is still active it should break on the next intruction if it's also in the breakpoint range set, and the cycle continues. There would still need to be a way to popup softice so you could turn off the BPR trace manually and this would have to be handled by the user with a regular BPX breakpoint, which is the "end-point" of your Backtrace.

Having written a similar app with Clandestiny to disassemble the Win9x Backtrace output I feel this is a *very* viable option to be integrated into IceExt perhaps as a plugin, once the BPR command is confirmed working well. It will be interesting to see the development of this nice Softice extension..

Regards,
Kayaker
volodya
06-15-2003, 10:09 PM
Well, thank you for the brilliant explanation.
I told to Sten about this topic, so when he has time, hopefully he will take a look at it.
pLayAr
06-16-2003, 12:50 AM
thanks your great tool,it helps me a lot,but it still some mistake here
1 . dumpscreen error in my computer because of
if (sscanf(args, "%s", FileName) != 1)
{
// invalid parameter, display help
help_DUMPSCREEN();
return;
}
when i type !dumpscreen \??\c:\dump.bin, it always show me the help, and i just change it to
sscanf(args, "%s", FileName)
then all is ok

2 . still int 3 error here
BackDoor:
jmp [OsInt3] ; call ntoskrnl!Trap03 // we can't jump to there!!!

All_ok:
jmp [OldInt3] ; call ntice handler

if we jump to ntoskrnl!trap03, we will aways crach when we put a bpm on esp ( f7,then bpm esp, g, then system crash),and some time the bpr will crash too, so i changed si,di or ebp to fake the program,then jmp to ntice int3 handler
pLayAr
06-16-2003, 12:56 AM
u can just use dillodump (v 2.50 or 2.55) to test int 3, when stop on EntryPoint ( if we already BPINT 3 ), just single step"t",then "bpm esp",then "g","g", serverial times later, we will met a system crash, it always happen
pLayAr
06-16-2003, 01:08 AM
i don't know why, maybe because i modified others code cause this happen, but i still like to use !unhook to hide softice from UnhandledExceptionFilter check :)

thanks for you and your great tool, it help me a lot
Sten
06-16-2003, 11:15 AM
Kayaker wrote:
The Int 0E page fault handler for the BPR function currently emulates the faulting instruction then pops up Softice

If you are speaking about IceExt Int 0E page fault handler - currently it set the TF flag, turn some flag in SoftICE so debugger thinks it's tracing the faulting instruction and then returns control.
Faulting instructions is actually traced and SoftICE popups AFTER that instruction.

The only reason SoftICE popup is nessesary after every faulting instruction - SoftICE activates it's breakpoints when you are leaving the debugger. So I am able to activate BPR's again.

Your ideas are very interesting but at this point I am conserned about a method to skip the faulting instruction. The only working idea seems to write good ring-0 tracer that will deactivate BPR's, execute instruction then activate them again.

The _Emulate branch in int 0E handler currently never executes.

2pLayAr:
Thanks for your remaks.
I wrote
-----------
if (sscanf(args, "%s", FileName) != 1)
-----------
because new M$ super tool PREfast barked I must check the value returned by sscanf. Frankly speaking NuMega has an awful implementation of sscanf (yes sscanf located in ntice.sys).
I also had some problems with !dumpscreen.
I'll fix bugs your mentioned as soon as possible.

!unhook command does not intented to hide SoftICE. It removes almost every SoftICE hooks on system api. So you'd better use !protect command.
SilSaLaMaTa
08-26-2003, 11:26 AM
Hi,
I'm using WinXP pro and DS 2.7 .
I got blue screen when I tried to load IceExt v0.41 :(

DRIVER_IRQL_NOT_LESS_OR_EQUAL

eax=ffffffc0 ebx=00000000 ecx=f5c846b1 edx=00000037 esi=f5c874bc edi=f5c87893
eip=f5c84760 esp=f9e78c4c ebp=f9e78c64 iopl=0 nv up di ng nz na po nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00000086
IceExt+0x1760:
f5c84760 c600e9 mov byte ptr [eax],0xe9 ds:0023:ffffffc0=??

STACK_TEXT:
frames may be wrong.
f9e78c64 f5e0b14c f5c83000 f9e78c84 f5e0af72 IceExt+0x1760
f9e78c70 f5e0af72 f5c83000 81967198 e20bd09e NTice_f5d95000!ui64toa+0x15986
f9e78c84 f5ec75ce f5ec75c0 81967198 805acfe9 NTice_f5d95000!ui64toa+0x157ac
f9e78ce4 00000000 ffb3b4c0 ffffffff 01000100 NTice_f5d95000!adjust_fdiv+0x21cf6
Tacman
08-26-2003, 11:48 AM
The latest is 0.42. Maybe that will fix your problem
SilSaLaMaTa
08-26-2003, 12:23 PM
Same happend with v0.42 :(
SilSaLaMaTa
08-26-2003, 04:17 PM
Hi,
I have changed my boot logo and my kernel filename is Logo.exe instead of ntoskrnl.exe . IceExt can't find the kernel , when I changed the kernel back to ntoskrnl.exe it worked . it should try another way to find kernel ...
Sten
08-29-2003, 08:13 AM
I have changed my boot logo and my kernel filename is Logo.exe instead of ntoskrnl.exe . IceExt can't find the kernel , when I changed the kernel back to ntoskrnl.exe it worked . it should try another way to find kernel ...

Thanks, I do aware of this bug.

It seems BSOD occures when IceExt hooks something. But I cann't say where exactly error is (in fact I have no IceExt 0.41 anymore, so your report is useless :). I decided to publish debug symbols with IceExt to help in debugging.


Backwards disassembling
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Backwards disassembling
PDA

View Full Version : Backwards disassembling

squidge
06-15-2003, 05:00 PM
Anyone know a good way to disassemble in reverse, as in, from (say) 402000 backwards, but keeping as close to the intended disassembly as possible ?

I've tried a few methods, but none of them are particularly brilliant and almost always get out of sync very easily.

The first approach I've tried is going back from the current address by 16 bytes (max instruction size), and then coming forwards, attempting to disassemble, until I get a valid disassembly which is the same size as the number of bytes I've gone back to try and find it. Eg. I go back 16 bytes, don't find a 16 byte opcode, so go back 15 bytes instead. Keep going until I eventually go 2 bytes back and find a two byte opcode. However, this can get out of sync easily as a trailing null on one instruction can screw up a push that comes after it for example.

The second method was to go 16 bytes back and try and disassemble from there, keeping a list of all the addresses seen up until the current address, and then simply take the last seen address as the previous address. Doesn't work too well, as if the instruction 16-bytes back is some data from a command, then the last disassemble is likely to be bad too. It gradually gets insync as you go further up, but it does look ugly as it does so.

Does anyone have any alternatives to these ?
Thigo
06-15-2003, 06:34 PM
I think I remember an article on www.codeproject.com about the stack. It did backwards diassembly to find the 1st instruction of the current call. You can find it easily I think.
tgodd
06-15-2003, 11:15 PM
In order to get the return address then fetch the called address from the disassembly from before the return address would be ideal only if you knew the stack adjustment size.

How can you tell parameters (ie. Pointers) from return addresses?

Sorry squidge.

I do not know that there is any truely reliable way to do what it would appear that you are trying to do.

You will notice that even softice has it's problems with this when you page up several times.

However.

Assembly language is like any other.
There are patterns.

If you check back 1 byte you may or may not have a valid opcode, go back 2 bytes again the same may or may not be valid.
Let's say you went back 16 bytes. Not all 16 possible opcodes would be valid, and out of the ones which are valid some may have a greater likelyhood of being the correct opcode based upon the preceding known opcodes.

This would require a statistical study of opcode pairing and combinations, and writing alot of code to accomplish what still may not be 100%.

Processors where never designed to be clocked backwards.

Let me know what you turn up on this one.

Good Luck!

tgodd
Maldoror
06-16-2003, 02:33 AM
Yes, Thigo is right
I remember the article too.
Here it is:
http://www.codeproject.com/tips/stackdumper.asp

Greetings!
Maldoror
dELTA
06-16-2003, 11:46 AM
Can you tell us more exactly what the situation is squidge? Maybe we'd be able to help you better then.

Is this in the code section of an executable? One little trick could be to search backwards for the typical signature of a function prologue, and then disassemble forward from this one until you (hopefully) reach the target address. This will of course only work if the code is located inside a function with such a prologue.

I would think that searching backwards for common instruction opcodes like different kinds of jumps, xor reg,reg and similar and then disassembling forward from these to the target address will be quite a simple but yet very efficient method, which will work most of the time. If at some point the disassembly doesn't make sense, go back to the next such opcode, and try the same with that one. The statistical chance of getting two such subsequent opcodes that are really just operators to another instruction is not big at all I'd say, and it should be fairly easy to see if the disassembly makes sense or not too.

dELTA
squidge
06-16-2003, 02:15 PM
Thanks for the replies. The code at CodeProject is almost identical to my own, but they don't go back as far, so more mistakes.

The code is required so that the user may view a disassembled listing on screen and be able to scroll backwards and forwards through that listing.

I've got a reply from bitrake over at the Win32asm forums, and his suggestion just going back further and letting it synchronize itself seems to work quite well.

Here's what he said for anyone interested:

Given a long enough string of bytes to disassemble the algo will stablize to actual instructions, but this is assuming all the bytes are to instructions. A simple way is what you are already doing, but I'd back up further. Assuming the average instruction length is 8 bytes (pessimistic on purpose) then your only backing up 2-3 instructions -- not enough room for mis-alignment to syncronize. Go back 64 bytes. Begin disassembling and if the bytes at the present position is not an instruction then increment the pointer and try again. This will syncronize to the instruction boundaries.

It certainly seems to work, and since it's a user viewable thing, I've just added some keyboard shortcuts for inc/decrementing the instruction pointer by one byte just incase the result looks garbage.
dELTA
06-16-2003, 06:13 PM
Cool, what kind of program is this for anyway? Any tool you will publish later?

dELTA
squidge
06-17-2003, 02:28 AM
It's for the much redesigned version of RTA, and will certainly be released through this board later.
sgdt
10-18-2003, 07:53 PM
Here's my 2 cents, coming from a complete newbie. YMMV.

Most compilers start functions on 0x10 boundries, and have a lot of jump targets at least on 4 byte boundries. It might pay off to do a quick check for push opcodes in those areas.

Second, you can easily do a scan for numbers that represent addresses in processes space, keeping a list of them. do a quick trace for jump/ret termination of each number, tossing ones that would generate bad opcodes in the trace. If the programs '.reloc' section is in tact, you can pull this list from here. Anyway, this gives tons of good positions for code starts, and from there, when you rip a function, add any branch/call/jump targets you find.

With this approach, there are two keys to speed:
1. How fast you can add a target to a list. Sounds simple, no? Lots of potential target addresses mean you don't ever want to "realloc" your list, or if you do, make it for like a 1000 or so address target at a time. What *I* did was process the file twice: First, to get an approximate number, and then the real deal.

2. How fast you can trace a routine. The most expensive, for me, part was looking at the SID byte. For me, I found a look-up-table worked best. Again, YMMV.

Anyway, MMX compare byte will allow you to instantly detect potential striings and their lengths, if you decide to add that functionality. Agner Fog has a very nice article on the subject, albeit dated.

Another thing to look at is IDA. The 'DOS' version isn't that big. Running Intels VTune against it (in sampling mode) will point out all the cool parts almost instantly.

Oh well, it's just a thought. Sorry for butting into the conversation.

EDIT: SID is typo, should be SIB. www.sandpile.org for invaluable info.
Aimless
10-20-2003, 11:46 PM
You might try reading the source code for BORG, by Cronos.

Have Phun
Zwyzum
10-31-2003, 06:35 PM
Hi. I'm pretty new here.

I guess the problem should be seen from an user view.

As a user I would like to view the disassembled code from the address I choose. I'm sure we're all intelligent enough to understand if the first instruction we see on the screen makes sense or not. Also, should the first instruction be disassembled the wrong way or not disassembled at all, the rest of the code would be completely silly and any decent reverser will scroll the code up a bit (or better a byte).

I know this is not a solution, but I think you shouldn't neglect this opportunity.

Bye
Zwyzum


.rsrc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > .rsrc
PDA

View Full Version : .rsrc

volodya
06-15-2003, 10:12 PM
Hello.

Now I have a small question. Can anyone briefly explain me how come that ALL packers are afraid to touch .rsrc section? What is so special in it? As far as I know only some of them are actually taking icons or some other shit into their own sections. So what stops them from taking EVERYTHING from the .rsrc section elsewhere or change the name of the section?

Thanks in advance.
mark_E
06-16-2003, 01:07 AM
There's nothing special about the resource section!

As far as I know most packers PACK the resource section. There are packers which merge sections, rename sections, leave unnamed sections etc etc etc. and you can do this too with a hexeditor as long as you fix the header to suit.

The packers take the icon and version info, or whatever they want, into their own sections solely so that this data is available (i.e. uncompressed) to the O/S. i.e A squashed icon looks like crap in explorer.

At the end of the day it's only unsquashing squashed data.

. . . but don't quote me!

mark_E
volodya
06-16-2003, 08:31 AM
Thank you. Now I will try to dig it a little bit by myself.
Nebob
06-16-2003, 01:06 PM
The reason you never see .rsrc renamed, is because a MS programmer once used a string compare to identify the section when loading a PE, meaning an executable with a renamed .rsrc would not load!

I think this has been fixed since, but the convention remains for the sake of backwards compatibility.
volodya
06-16-2003, 01:51 PM
Well, I renamed the section and explorer.exe was still able to show everything correctly.
But thanks for the nice answer :)
Aster!x
06-16-2003, 04:10 PM
Nebob wrote:The reason you never see .rsrc renamed, is because a MS programmer once used a string compare to identify the section when loading a PE, meaning an executable with a renamed .rsrc would not load!

I think this has been fixed since, but the convention remains for the sake of backwards compatibility.

Very incorrect statement.
You need to look a format of PE files. :D
cyberheg
06-17-2003, 06:31 AM
It's true.

I had a exe file not so long ago which had this problem. If I remember correctly I tracked down the problem down to a ole32 dll file from the standard Win 2k distribution. So while it might be fixed I don't trust it enough. The problem was that a set of typelibs refused to load when the section was renamed hence making the program act weird.

// CyberHeg
bart
06-17-2003, 08:08 AM
oleaut32.dll from Win9x

7FE91E08 lea eax, [ebp+lpNextSection]
7FE91E0B push 40 ; uBytes
7FE91E0D push eax ; lpBuffer
7FE91E0E push [ebp+hFile] ; hFile
7FE91E11 call edi ; _lread
7FE91E13 inc eax
7FE91E14 neg eax
7FE91E16 sbb eax, eax
7FE91E18 and eax, ebx
7FE91E1A add eax, esi
7FE91E1C js short loc_7FE91E99
7FE91E1E lea eax, [ebp+lpNextSection]
7FE91E21 push offset a_rsrc ; '.rsrc',0
7FE91E26 push eax ; lpString1
7FE91E27 call ds:lstrcmpiA
7FE91E2D test eax, eax
7FE91E2F jnz short process_next_section

its called from oleaut's LoadTypeLibEx()
volodya
06-17-2003, 02:13 PM
Thank you, man. Excellent answer.
But for now I guess it is not supported any more. Am I right?
Well, let me check it in Win2k. OK, here we go:

.text:77A078C9 lea eax, [ebp+String1]
.text:77A078CC push offset a_rsrc ; lpString2
.text:77A078D1 push eax ; lpString1
.text:77A078D2 call ds:lstrcmpiA
.text:77A078D8 test eax, eax
.text:77A078DA jz short loc_77A078F3

The situation is the same!!! It means that if I'm going to write a packer and if I really worry about compatibility, I shouldn't touch it! Correct?
evaluator
07-31-2003, 09:03 PM
while so hardly disassembling m$DLL,
why you not try quick DIRECT test?

make copy of some EXE, rename .rsrc
@ see what happens.

I just tested 2 EXEs under W98se,
all works OK.

Later I will reboot to XP..i'm lasy


DriverStudio 3 b2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DriverStudio 3 b2
PDA

View Full Version : DriverStudio 3 b2

sGreener
06-15-2003, 11:58 PM
bad news for those of you who are waiting for numega to fix sice problems on XP machines.

It freezes up so much, making the system unusable!.
(using universal video driver)

You dont have to use XP symbol file to make it break on Win32 API (export just works fine).

Olly seems to be the only choice for now.


dll unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > dll unpacking
PDA

View Full Version : dll unpacking

w00tz
06-16-2003, 10:30 AM
hmm,

i have this dll thats packed with upx, upx -d doesn't work on it, im really stumped on this part of the dll too, i just need it unpacked, any ideas on maybe how i can unpack it?
Aster!x
06-16-2003, 04:29 PM
It is a question for The Newbie Forum.
Replace the first byte in yours dll on CCh,
put break in a debugger bpint 3,
run your executable file, then when will stopped
replace the first byte on original,
further continue as with a usual executable file. :D
squidge
06-16-2003, 05:22 PM
Or just search the forum where the same question has been asked many times before, and with many answers :)
JMI
06-16-2003, 06:19 PM
I've moved this post here where it perhaps belongs.

And another way of saying the advise you've already received wOOtz, is that you should read the FAQ first, then use the search function, and then follow the posting guidelines about what to include in your post.

Regards.


Question on some code.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question on some code.
PDA

View Full Version : Question on some code.

Torque
06-16-2003, 11:33 PM
Hello,

I was following a tut for a crackme I found and there is something on the tut that I have a question on.

Here is the code:

:0040324F 55 push ebp
:00403250 8BEC mov ebp, esp
:00403252 83C4FC add esp, FFFFFFFC
:00403255 817D0C02010000 cmp dword ptr [ebp+0C], 00000102 ;focus on editbox.
:0040325C 0F859D000000 jne 004032FF

We follow the jne at 40325c:

:004032FF 817D0C00010000 cmp dword ptr [ebp+0C], 00000100 ;focus on editbox.
:00403306 0F85F4000000 jne 00403400
:0040330C 8B4510 mov eax, dword ptr [ebp+10] ; Getting the char.
:0040330F 3C0D cmp al, 0D ;0D = press Enter button
:00403311 7573 jne 00403386 ; getting the char of the editbox
:00403313 833D1560400001 cmp dword ptr [00406015], 00000001
:0040331A 7514 jne 00403330 ; BAD jump!
:0040331C 6A40 push 00000040

Now, my question is how does one figure out that the cmp's at 00403255 and 004032FF are checking if the editbox has focus? Its not explained in the tut and I dont know how I would have figured that out.

Also, the cmp at 0040330F. How can you tell if that is comparing al to 0D to check which key was pressed or if it is comparing for some other purpose? How do you tell when it is checking which key was pressed?

And at 0040330C, it gets the next char. Is the only way to figure out that it is actually getting the char you typed to look at EAX and see if it is a match or are there other clues?

Sorry if these questions are too vague or anything. Just looking for some pointers :)

Any help is greatly appreciated.

-Torque

P.S. If you need any additional info on the program being discussed plz let me know
ArC
06-17-2003, 04:36 AM
the cmp's at 00403255 and 004032FF:
I suppose the the sub-routine 0040324F expects four (or more) parameters whereas one of these parameters is expected to be the handle to the window which is currently focused. So the code which calls the sub-routine 0040324F could look like this:

call GetFocus;<-- get current focus (Win API)
push xxxx; push other stuff
push eax ;<-- push focus
push xxxx ; push other stuff
push xxxx ; push other stuff
call 0040324F

In this little code example the second parameter contains the handle to the currently focused window. This means that the following command in the sub-routine 0040324F compares the content of the second parameter (the handle to the currently focused window) with 102 (I think the 102 is the ID of the Edit-Box)

cmp dword ptr [ebp+0C], 00000102 ; ebp+0C = address of second parameter

cmp at 0040330F:
0D is in decimal 13 which is the char for ENTER.

I hope this was a little aid for you (?) ;)
sna
06-17-2003, 05:17 AM
edit:

after reading the previous posts more thoroughly it became rather apparent that the code is part of the application's message handling.

where [ebp+0Ch] is the notification code and -

100h = WM_KEYDOWN
102h = WM_CHAR

the character code is sent in wParam ( [ebp+10h] )

second edit:

godamnit.. that doesn't fully hold up either..
my first post was probably more correct ;)

in which case it is indeed checking the second parameter to see which window to deal with. it is, however, not using GetFocus but rather GetDlgItem.

Using a resource viewer you can in most cases determine which control has what ID.

regards, sna
ArC
06-17-2003, 06:23 AM
Torque:

Mayb you post the code snippet which is calling 0040324F?
Torque
06-17-2003, 11:12 AM
Hey guys. Thanks for the help.

As for the code that calls 0040324F, I opened up the program in W32Dasm and got this code:

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004031CE(U), :004031F5(U), :004031FB(C), :00403214(U), :0040322E(U)
|
:00403247 33C0 xor eax, eax
:00403249 5F pop edi
:0040324A 5B pop ebx
:0040324B C9 leave
:0040324C C21000 ret 0010

:0040324F 55 push ebp

I dont see anywhere a direct call to :0040324F. The only other reference I can find to :0040324F (when I searched the disasembly) was at 00403150:

* Possible StringData Ref from Data Obj ->"EDIT"
|
:0040313B 687D604000 push 0040607D
:00403140 6A00 push 00000000
:00403142 E8DDDEFFFF call 00401024
:00403147 FF75D8 push [ebp-28]
:0040314A 8F05E4604000 pop dword ptr [004060E4]
:00403150 C745D84F324000 mov [ebp-28], 0040324F
:00403157 FF35D8604000 push dword ptr [004060D8]
:0040315D 8F45E4 pop [ebp-1C]

Also, the author of the tut says "The program uses a Thread. The CreateThread function creates a thread to execute within the virtual address space of the calling process. And is repeating all over the time. It runs thru this piece of code:", and then he shows the same code I posted in my original post. Maybe when the thread is created it calls 0040324F directly.

Im sorry I cannot be of more help. I still new to most of this stuff. Anyway, if you need more info, or can tell me how to better figure out what calls 0040324F, that would be great.

Thanx for the help guys,

-Torque
naides
06-17-2003, 01:38 PM
Originally posted by Torque
Hey guys. Thanks for the help.

As for the code that calls 0040324F, I opened up the program in W32Dasm and got this code:

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:004031CE(U), :004031F5(U), :004031FB(C), :00403214(U), :0040322E(U)
|
:00403247 33C0 xor eax, eax
:00403249 5F pop edi
:0040324A 5B pop ebx
:0040324B C9 leave
:0040324C C21000 ret 0010

:0040324F 55 push ebp

I dont see anywhere a direct call to :0040324F. The only other reference I can find to :0040324F (when I searched the disasembly) was at 00403150:

* Possible StringData Ref from Data Obj ->"EDIT"
|
:0040313B 687D604000 push 0040607D
:00403140 6A00 push 00000000
:00403142 E8DDDEFFFF call 00401024
:00403147 FF75D8 push [ebp-28]
:0040314A 8F05E4604000 pop dword ptr [004060E4]
:00403150 C745D84F324000 mov [ebp-28], 0040324F
:00403157 FF35D8604000 push dword ptr [004060D8]
:0040315D 8F45E4 pop [ebp-1C]

Also, the author of the tut says "The program uses a Thread. The CreateThread function creates a thread to execute within the virtual address space of the calling process. And is repeating all over the time. It runs thru this piece of code:", and then he shows the same code I posted in my original post. Maybe when the thread is created it calls 0040324F directly.

Im sorry I cannot be of more help. I still new to most of this stuff. Anyway, if you need more info, or can tell me how to better figure out what calls 0040324F, that would be great.

Thanx for the help guys,

-Torque

One method to find out who calls 0040324F is to trace it live and direct in SoftIce.

1- Oper the crackme in symbol loader, 2- place a bpx on 40324F

3- when Sice Breaks, type in Sice: WS meaning 'window stack'. A small window will open in SoftIce called the call stack. The first address in there is the place in the code which called 40324F, which I would not be surprisedif it contained code like

call EAX

or

call [ebp+08]

which corresponds to a dynamically assigned code branching.

If you click the address on the Stack window itself, the code window in softIce will scroll you all the way to the area where the famous 40324F call was originated, THIS TIME AROUND.

the function may get called from other areas of the code, depending on the program flow.


Welcome back everyone!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Welcome back everyone!
PDA

View Full Version : Welcome back everyone!

dELTA
07-31-2003, 12:45 PM
Welcome back people.

After more than our fair share of unfortunate circumstances, bad luck and a bunch of other crap, we are finally back!

We hope to see all familiar faces back here now (and new ones of course), posting like crazy and sharing your wonderful skills and knowledge.

It should be noted though, that the bad behavior observed on the temp-board recently will NOT be tolerated here!

dELTA
esther
07-31-2003, 01:09 PM
welcome back guys!

>It should be noted though, that the bad behavior observed on the temp-board recently will NOT be tolerated here!

;)
naides
07-31-2003, 01:14 PM
As Above :cool:
disavowed
07-31-2003, 04:00 PM
woooooooohoooooooooooooooo!

congratulations and thanks to woodmann and everyone else responsible for keeping this board up and running! (too many names to list, but you know who you are, and we appreciate your work!)
sope
07-31-2003, 05:11 PM
Greetings Everybody

Board's Crew: Thanks for the good work you have done. Best Wishes & Happy learning & shareing your knowledge everybody.

Regards, Sope
squidge
07-31-2003, 07:10 PM
Good work !
evaluator
07-31-2003, 07:22 PM
What a great surprise!

now is good time for contr-attack.
Or better will if forget it?
evaluator
07-31-2003, 07:44 PM
BTW, when -www.wooma.com opened,
I teleported it's VBULLETIN content.

Q : someone who knows how it works,
can successfully use this content for
run MB?
sope
07-31-2003, 08:35 PM
Greetings evaluator

There was a thread on Teleporting the Board. Please visit this link (http://www.woodmann.net/forum/showthread.php?s=&threadid=2572) hope it helps clear your doubts.

Regards, Sope.
evaluator
07-31-2003, 09:08 PM
sope, you not understand me.

I'm about content of NOT working MB.
e.g. there are PHP-files,(MB-kernel)
S3ri@l CoDe9x
07-31-2003, 11:51 PM
jejejejej :p !!.. Really i missing this site ...well i hope read again topics about Crusader, Nikolatesla , evaluator,squidge etc..etc.. And now with grand knowledges of sKAMER!.. :D

I hope that this guy post ..since he does it in picasso ;)

Regards! :rolleyes:
esther
08-01-2003, 12:20 AM
Hi Moderators,

Requesting about the post on Manko's thread or some others in the temp forum is it possible to retrive and put it here

Regards
sarge
08-01-2003, 12:22 AM
Yay.

Yay, yay, yay.

Yay,yay,yay,yay...yay,yay,YAY!

Sarge
evaluator
08-01-2003, 01:28 AM
I tryed upload attachment, but failed.
DELETE0admins that test posts, please.

& notify us when attach will work.
sope
08-01-2003, 01:40 AM
Hello esther

Just wanted to ask do you want me to zip yabb stuff. My temp folder still have it. If yes just let me know & i'll do it for you. OR Paste here systamatically what others had said. Let me know.

Regards, Sope.
evaluator
08-01-2003, 01:48 AM
no i not need yabb.
yabb still exists there!
esther
08-01-2003, 01:49 AM
Hi Sope,
Thanks for the input. Just hope everyone can read it in the board .of coz not those trolls ;p

thanks and best regards :)

Evaluator:
yes sirrrrrrrrrrrr
evaluator
08-01-2003, 02:29 AM
esther, correct IP in your signature..
mike
08-01-2003, 02:31 AM
Huzzah! I was getting really worried... It's been what, a month and a half? Great to be back!
bedrock
08-01-2003, 02:35 AM
Wow, the excellent message boards are back.

Thank you Woodman and JMI and everyone else who has helped.

--
bedrock
UrgeOverKill
08-01-2003, 03:05 AM
Welcome back everybody!!!

I'm getting too old for this........
UrgeOverKill
08-01-2003, 03:07 AM
also........I would like to thank JMI and Aarons forum for keeping us in the loop !!

kudos to you guys!!
Bengaly
08-01-2003, 05:43 AM
Welcome back all :D
/me waves
JMI
08-01-2003, 05:52 AM
evaluator:

The attachment.php files from the "old" server are installed and appear to be working correctly. After further review, the problem was that the "file_upload" permission in the php.ini file was set to Off, rather than "On." It should work once the Apache server is restarted. I probably can do that, but am reluctant to do that on my own. I'm sending an e-mail to Woodmann about the issue.

Regards.
evaluator
08-01-2003, 06:24 AM
Hello, JMI!

"Since you took the time to write what you did,
I figured I may as well respond to it...."

amm..
that YABB seems has this:

$guestaccess = 1;
# Set to 0 to disallow guests from doing anything but login or register

So changing this also requires reboot?
JMI
08-01-2003, 06:36 AM
Hello our Musician Friend:

I'm not an admin on the YaBB Board and have no access to the necessary panels to make Admin changes, But I'll pass your suggestions on to Woodmann. I have only visited there a couple of time and could never successfully register. :p

I have downloaded a copy of that Board, however, and will attempt to rescue the very few informative posts into vBulletin, even if I have to simply copy and paste them into a thread. I will not be able, unless I manipulate the database directly, to credit those poster's accounts here in vB, but it should be easy to get the information posted. I am assuming that Woodmann will simply turn that Board off soon, but we haven't discussed the issue and it's his decision. I don't think changing parameters in the AdminCP requires a reboot of the server.

Regards.
JMI
08-01-2003, 07:06 AM
OK:

Attachments seem to be working now. Attach away. That Burp we had, must have been Woodmann resetting Apache. :D
nikolatesla20
08-01-2003, 07:13 AM
I was worried that the community might die a little bit if the board was gone for good...it's nice to have around to help everyone keep in the loop on all the latest stuff...

-nt20
Manko
08-01-2003, 08:04 AM
Hiya!

Great work! :)
Nice to FINALLY have you back! :D

/Manko
Solomon
08-01-2003, 02:18 PM
:D :D :D :D
hobferret
08-01-2003, 04:29 PM
GR8

Thanks for all your effort JMI and for keeping everyone updated on Arron's site:)

/hobferret
dELTA
08-01-2003, 05:18 PM
Thank you Woodman and JMI and everyone else who has helped.
also........I would like to thank JMI and Aarons forum for keeping us in the loop !!
Thanks for all your effort JMI and for keeping everyone updated on Arron's site

Yeah, by all means, don't mention me anyone... :p

*mumble* ...ungrateful bastards... *mumble*... :D

dELTA
squidge
08-01-2003, 06:54 PM
Oh, and thanks to dELTA as well as all the people already mentioned :)
JMI
08-01-2003, 08:26 PM
dELTA who???:D
Woodmann
08-01-2003, 10:25 PM
delta ???

Ungrateful bastard ;)
dELTA
08-02-2003, 06:37 PM
Grrr... :p
kugi
08-03-2003, 02:23 AM
Hi All,

Great work to get the rce messageboard's regroupment back up. Thanks much.

Regards, kugi
banshee
08-03-2003, 06:25 AM
I missed this MB so much. Really glad it is alive again.
:D :D :D
vgb
08-04-2003, 12:23 PM
Adding my thanx to Woodmann and all ( including DELTA ) who keep this board going. It's nice to see some of the old crowd still posting.

Way to go!

vgb


triky Qvaschion:) "unknown api"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > triky Qvaschion:) "unknown api"
PDA

View Full Version : triky Qvaschion:) "unknown api"

Woodmann
07-31-2003, 07:05 PM
evaluator
08-01-2003, 04:46 AM
"Hello, friends!"
"I'm very tired for find proper answer for this little prob:

"from what library is export- GrowWindow?

"Any help appreciated!"
squidge
08-01-2003, 07:25 AM
I've never heard of that function under Windows, so it must be a third party library. However, I remember that GrowWindow API does exist in OS of Mac for changing window size.
evaluator
08-01-2003, 07:43 AM
You WIN!

what you want as prize?
MMDWMX unpucked?~~:0
squidge
08-01-2003, 09:16 AM
:)
Woodmann
08-01-2003, 03:40 PM
How did my reply get to the top of this thread ?
evaluator
08-01-2003, 04:21 PM
incorrect MB-time(GMT)
dELTA
08-01-2003, 05:12 PM
When the server dates were being messed around with yesterday (by a certain gentleman having a handle starting with a "W" :p), there was a lapse where a few messages were posted into "the future" before the date was pulled back again, and this is what caused it. It should not happen again now.

And eval, in that other thread where you asked me to fix the order of the messages I tried to do that, but when I removed my post the entire thread was removed just because it was "the first post" in that thread, stupid vBulletin, so it seems you have to post the "depli keigelme" again, sorry about that. ;)

dELTA
evaluator
08-02-2003, 08:05 AM
thanks, deTLa!

hey, squidge, you wont passw for prize??
Or you bruteforced!?
squidge
08-02-2003, 10:51 AM
To be honest, I've only just noticed it, never mind downloaded... What is prize?
evaluator
08-02-2003, 01:37 PM
already wrote:
>MMDWMX unpucked
squidge
08-02-2003, 03:13 PM
and whats MMDWMX ?
evaluator
08-03-2003, 01:53 AM
ok, you lost prize, forget it..
squidge
08-03-2003, 04:35 AM
:p


Hardlock question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hardlock question
PDA

View Full Version : Hardlock question

prt
08-01-2003, 05:30 AM
How can I emulate the HL_CODE of hardlock dongle?
tgodd
08-01-2003, 07:26 AM
In order to emulate the HL_Code you must :

1) create a table of responses from the lock device.

2) emulate the logic of the device.

the first possibility is more likely the only way to go for almost anyone.

The second possibility is only possible if you can read out the 48Bit Algo Seed. The technology to read these seeds is still quite well protected by the authors.

So build a logger and generate a response table.
sapu
12-12-2003, 02:03 PM
Using a table of responses from the lock device could be easy to implement for older wrappers only.
Newer wapper versions have protections against this techniques, like scrambling the data exchanged with the driver, and sending some 'random' decrypt queries and comparing the answers with an hardcoded 256-values table or just sending a 'fake' decrypt query without checking the answer.
Of course, the sad of all this kind of new protections is than there could be easily bypassed also without needing to known anything about the scrambling mechanism used, and without recording the real/fake 'random' decrypt queries.
I already made a something like it working: just replacing a dll name on the target program with mine, and running the program once with the original key (to create the response table); from now, the program starts without any more no-key problem...
sope
12-13-2003, 01:39 AM
Hello sapu,

I am interested in knowing how you create response table for hardlock.

Also i would like to get myself clarified response table does it mean good values from the dongle memory or good values from hardlock algorithm which is stored somewhere in memory which you log it down & then emulate it via your own .dll Is that the way of logging or its something else.

Can you give example of table logging or some part of the code where the table is and what part you think is good for logging.

Hope its not too much...

Regards, Sope.
sapu
12-17-2003, 03:34 AM
To use a response table, you'll need the intercept the DeviceIoControl call, check the function code, and replace the data with the espected values on the answer.
About how to check if the data to decrypt is from the initial hardcoded table, a random value, or from the program to decrypt, just do a memory scan:
- if the data is in the .protect section, the answer 2Kb below (the table is a 256x8 requests followed by a 256x8 answers, and is stored unencrypted).
- if the data is in the .code section (typically starting from address 0x00401008, with a fixed 2Kb increment on next messages), it's the program to decrypt (and you'll need to put back the right saved values)
- if no data found, it's a random value (return what you want, the answer is ignored)
Of course, to do it you'll need first to find a way to access the 'unscrambled' api data structure (just follow the stack until the data is unencrypted from the low-level drive access functions).
I'll send you more info to your private email address: if you find them useful, let me known...
cRk
03-03-2004, 12:29 AM
sope & sapu aren't you family? ;) would you please send me this info. on private message as well.. i'm insterested about this too...

Regards
nikita@work
03-26-2004, 05:48 PM
- if the data is in the .protect section, the answer 2Kb below (the table is a 256x8 requests followed by a 256x8 answers, and is stored unencrypted).

you are wrong a little ;)
there is a "magic" dword in envelope....
the way how to check each 8 bytes depends on this dword.

it can be set to value so all checks will be software only

see hlcwin32.exe utility option
souz
03-20-2005, 12:25 AM
you are wrong a little ;)
there is a "magic" dword in envelope....
the way how to check each 8 bytes depends on this dword.

but how can i find the starting offset of the table, and i need to determine it's size before searching...
is some fixed offes is used?
souz
04-01-2005, 01:12 AM
Can anyone tell me something about the ADP - Automatic Data Protection in envelope.
How can i pass it's checks? All other functions is working correctly. Please help.
kooolguy
04-24-2005, 12:25 AM
hi,
Even I am looking for Hardlock Emulator or duplicate hardlock (USB). Can anyone help me out?
Thanx in advance
JMI
04-24-2005, 02:21 AM
What you NEED is to read the damn FAQ, particularily the section about NOT asking for the Tools of the Trade. Pay attention or go away. :idea:

Regards,


Thinstall
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Thinstall
PDA

View Full Version : Thinstall

Pyrae
07-31-2003, 07:39 PM
However, before I continue, I'm just wondering if anyone else has messed with Thinstall before? Are all the juicy parts of the code remote executed, or downloaded? or perhaps is it a simple data transfer? If someone else already knows they are remote executed for sure, then it'll pointless wasting time on this and I'll go find something else to play with

The critical parts (packing routines) are certainly not executed remotely as there's only very little traffic during the execution.
What I noticed at a quick glance I took at this target some time ago was that the dumped main exe has grown about 20kb after executing the protected functions. So it seems like this code has been transfered for usage. Maybe checking the network traffic with an appropriate tool while debugging might lead somewhere.

I know that nobody on this board releases his/her stuff,:D
but be aware that there might be some info (e.g. your ip) transfered and "integrated" into your dump that could make it possible to identify you.

regards,
Pyrae
squidge
08-01-2003, 07:37 AM
It seems that this exe/dll/data bundler has not be talked about at all. Any reason why? It seems like an interesting program.

Now, I've taken a look at this program, unpacked the support DLLs and EXE from the main program using Ollydbg, and are interested in this "remote execution" that they are talking about in the help file. I'm wondering if this is a bluff or for real, so trying to reverse the app to find out.

Thinstall itself (when unbundled) seems to be protected using HASP (haspms32.dll, HASPUT16.DLL, HASP95DL.VXD if it matters) and fetches data from HTTPS (yup, secure web). The PE headers of the executables contained in the bundled file all have there headers zeroed, but it doesn't take more than 5 minutes to hand craft new ones. They protect against reading the process memory by other applications, but by launching the file via CreateProcess with the debug flags, I can access all the memory that way and dump it.

However, before I continue, I'm just wondering if anyone else has messed with Thinstall before? Are all the juicy parts of the code remote executed, or downloaded? or perhaps is it a simple data transfer? If someone else already knows they are remote executed for sure, then it'll pointless wasting time on this and I'll go find something else to play with :)
evaluator
08-01-2003, 07:51 AM
mean it has dongle, so we also need it
for unpuk(so no help), or no?
squidge
08-01-2003, 09:15 AM
Will run in demo version if you are connected to the net, so dongle isn't required for demo version (which does everything the full version does, apart from limit you to 14 days and show nag-screen).
evaluator
08-01-2003, 02:36 PM
as i tested, this prot is very poor: It not strips IT at least..
so don't trash time on it..


ASPR not full tut
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR not full tut
PDA

View Full Version : ASPR not full tut

LaBBa
08-01-2003, 10:44 AM
hi all

i have tried again and again so many time to unpack
this new version of ASPR but no luck all the time it crashes

so i made this tut about the new aspr ..

this tut is yet not fully working so if anyone else wishes to
finish this tut and fix my errors..
evaluator
08-01-2003, 11:08 AM
yei, LaBBa!

Why you wrote this TRAGEDIE-tut?
ASS just waits for this, & then he will say:
"look here, what a stangest pucker i wrote.."

Ok, I will look at this..wait..
evaluator
08-01-2003, 11:21 AM
I just tried for DLD it, but it not exists!

seems, ASS sad:"why i make so bad puker, Labba very tired.."
LaBBa
08-01-2003, 11:22 AM
hehe ... it's just i wroted this when i was tierd..
sorry about the bad english at this stupid tut..

i think there is somthing wrong at my dump still havn't got it yet..
evaluator
08-01-2003, 11:45 AM
no probs!

Lets wait for new release & together unpuk newest ..
LaBBa
08-01-2003, 11:55 AM
have u took a look yet about the tut ?
evaluator
08-01-2003, 12:04 PM
i look only, but i not play with OLLY, so for me there is nothing:(
Zilot
08-02-2003, 01:48 AM
What kind of SADIST you use to be................:D
Bengaly
08-02-2003, 06:37 AM
lol eval, ur engl is so weird that it takes dictionary to decode it :D
/me ment in a good way ;)
evaluator
08-02-2003, 08:00 AM
seriously, if you can't decode my iNgLich
just re_ask me.

Don't worry LaBBa, we will..we will..
LaBBa
08-02-2003, 03:53 PM
well all that i have found out more about the Crashes of the App
is this :

00402262 . 83C0 03 ADD EAX,3
00402265 > C1F8 02 SAR EAX,2
00402268 . 8B15 24E65600 MOV EDX,DWORD PTR DS:[56E624]
0040226E . 8B5482 F4 MOV EDX,DWORD PTR DS:[EDX+EAX*4-C]
00402272 . 85D2 TEST EDX,EDX
00402274 . 74 79 JE SHORT Dump_.004022EF
00402276 . 8BF2 MOV ESI,EDX
00402278 . 8BC6 MOV EAX,ESI

at : MOV EDX,DWORD PTR DS:[EDX+EAX*4-C]
with an error of Read Access Violation
and ther is more of those
some with an Error of Write Access Violation..

at the Packed file at Olly u can see that

DWORD PTR DS:[EDX+EAX*4-C] = 00000000

and at the unpacked file u can see that :

DWORD PTR DS:[EDX+EAX*4-C] = ?????????

realy wierd ! all other places are like that ..

well at ASPR Stripper i saw it doing somtimes those lines at some other unpacked apps : i.e :

ApiEntry RVA :0001e984 *esp = (00a738fd, 00a63861, 0012ffe0)
ApiEntry RVA :000181dc *esp = (00a739f1, 00000010, 00000010)
ApiEntry RVA :000012cc *esp = (00a73b2f, 004012c8, 0012ffe0)

what those lines are for ??? i think this could help to solve this thing...
squidge
08-02-2003, 05:23 PM
why u double post onto exetools?

Anyway, sounds like the app is verifying registration status or something like that using structure from asprotect. Since asprotect is no more, structure is invalid, hence the read access violations.
LaBBa
08-02-2003, 05:31 PM
well i post there because some other ppl over there could help too ...

about u'r answer abuot ASPR .. is there a way to fix that so it will work ?
Shoob
08-02-2003, 07:04 PM
Man please use

PUSH EBP
MOV EBP,ESP
ADD ESP,-10
PUSH EBX
MOV EAX, XXXXXXX

this structure thx you see oep ist 5C7F40 please use it and work with real structures thx.
evaluator
08-03-2003, 02:52 AM
OK, I DLD now setup.exe size 1080445 byte.
Is it, LaBBa?
evaluator
08-03-2003, 04:57 AM
hemm!

I'm little curious.
ass_dll's code now less then previous dll(uploaded by me).
it not conteins INT68 check.

Now I more debug this dll & found some crazy things,
like grand checking VMM space for service instructions
(this check is also in previous dll)...

Or ASS became crazy doing such shameless tricks,
Or this is experimental one.

So my opinion is:
Lets dedicate this strange SystemCleaner to ASS's experimental studio
& don't trush time on it.

Better find wellknown software,
which regularly uses updated ASSpr & reverse it..

later I will look more for LaBBa
evaluator
08-03-2003, 02:15 PM
yah, LaBBa, I look at it.
In DATA section(2nd) ASSpr puts pointer to ass_dll in memory.
then many times checks it.
then this pointer changes to point text "Unregistered Version"
for "About" dialog.

so you need somewhere in free space write "xregistered Version"
& correct that pointer.
LaBBa
08-03-2003, 05:07 PM
tnx evaluator ...
can u add this part of fixing to the text file ? so we could all have a nice tut about F**king ASPR ?
evaluator
08-03-2003, 06:00 PM
seems my exe is newer then you have.
redownload it. then I will upload for you my unpacked.
so you can then compare & write new tup.
LaBBa
08-04-2003, 06:17 AM
that would be great !! tnx..
evaluator
08-04-2003, 12:51 PM
i already done this quite time ago, check your PM.
britedream
08-05-2003, 11:21 AM
Hi Labba
Please, recheck your IT, I have unpacked and it is running ,
except minor error on closing which can be corrected .
Britedream
britedream
08-05-2003, 12:33 PM
Hi LaBBa !
now I have it runnig correctly.
LaBBa
08-05-2003, 04:27 PM
well .. thats weird..
can u tell me all the info ?

RVA , IT , Size etc... ??
britedream
08-05-2003, 05:40 PM
Here some of the info:

IatRVA=17221c
IATSIZE=1000
the actual size is slightly less than 1000

britedream


To Woodmann
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > To Woodmann
PDA

View Full Version : To Woodmann

naides
08-01-2003, 06:13 PM
Hi Boss.

The redirector you had in the temporary and very trolly board stopped working, giving:

Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, rce@planetwave.net and inform them of the time the error occurred, and anything you might have done that may have caused the error.

The old redirector at woodmann.cjb.net ain't working either, so I had some deja vú
and a little trouble getting back to the RCE board.

If this is the way you intended, cool.
Otherwise some people may have a little dificulty finding the board.
squidge
08-01-2003, 06:52 PM
woodmann.cjb.net works fine now, so I assume it must be a temp glitch?
banshee
08-03-2003, 06:30 AM
woodmann.cjb.net works fine now, so I assume it must be a temp glitch?
It doesn't works for me. :( Came here through IP posted on exetools forum.

Oh, I'm sorry, now it works fine. :)


Driver Studio 3.0beta2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driver Studio 3.0beta2
PDA

View Full Version : Driver Studio 3.0beta2

OHPen
08-02-2003, 06:26 AM
Hi,

atm I'm using driver.studio v3.0beta2 (ROR-Release) on Win2k-System + SP3.

I searchin for ICEDUMP support but i wasn't able to find somethin'. Only IceEXT is work on this new version.

Second problem is SP4. After installation of it, i got a bluescreen on reboot.

do someone have some solutions for me ;)

thx

OHPen
esther
08-02-2003, 08:15 AM
please report to compuware & ms ... >:D
OHPen
08-02-2003, 08:56 AM
done
evaluator
08-02-2003, 10:38 AM
maybe, if you try accelerate your Logic_bus...

>after inst.. SP4
so how about back to SP3..

or you like BIGGER numbers!?
OHPen
08-03-2003, 02:00 PM
You are right,

only way to solve this Prob on my hardware seems to downgrade to SP3. Have intalled it yet and system works well.

shame on me,

ohpen
OHPen
08-18-2003, 06:34 PM
After i used the beta quite a while i can't recommend it to be installed on your computer.

The different probs with the service-packs, the failing support of Icedump and IceExt....

I now using 2.7 again, cause it's workin more stable in my case.

the 3.0beta2 is not worth to work with, maybe until some of you coding gods decide to code the needed support ;)

OHPen aka forsaken aka PiTcH_SiLoW


trickie Depli Keigelme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > trickie Depli Keigelme
PDA

View Full Version : trickie Depli Keigelme

evaluator
08-02-2003, 07:55 AM
Zairon tells me something like:
"if you are playing with Depli, will be not bad,
"if you crap something for newbies, so they learn better about reversing Depli.

Here Zairon means compiled exe, so newbies then will it disasm etc.
(full mazohizm, ee?)
But for this first joke, I think more good will playing with source,
because newbie will download Depli, tries compile this or other sources
& then s-he more easy understand, what is Depli's programs.
(Depli is free compiler, find it's web, register & download ~70MB)

Now about this trikie source:
<1> your solve MUST be again only Depli source(with NO asm statments!).

When you done, notify here, yet not upload.
So then I will look at it, etc..
i hope, i will also learn something..

last wordz:
it is trikie because I have no idea about keigelming,
so I feel Wooma will punish me..

http://homepages.shu.ac.uk/~awblack/i/spank.gif
squidge
08-02-2003, 10:50 AM
Are you on drugs? ;)
Bengaly
08-02-2003, 01:09 PM
i haven't been able to understand what do u want from us eval ;D
my babylon can't translate it :D
evaluator
08-02-2003, 01:33 PM
>my babylon can't translate it

quote what you not understand..
esther
08-02-2003, 01:43 PM
evaluator wants you guys to crack his crackme
write a keygen using delphi

He has no idea whether Woodmann would punished him for requesting the keygen source.

I have no translator but I guessing what he says.
evaluator
08-02-2003, 01:58 PM
esther, they attack me:)

trick is something more, but this is another thing.
So don't worry about yet.
squidge
08-02-2003, 03:14 PM
:confused: :confused: :confused:

I no understand what you say, nevermind what you ask for.
evaluator
08-03-2003, 02:54 AM
when somewhere I nothing understand, I usually leave that place
squidge
08-03-2003, 04:34 AM
see ya !
ZaiRoN
08-03-2003, 08:28 AM
Hi ALL,
from what I understood, this is a project designed for those who wants to learn how to use Delphi.
Your tasks are:
1. solve the crackme only using the sources eval gave you.
2. write a keygen using Delphi compiler

In order to solve the crackme, first of all you have to understand the meaning of each file of the project. The attached zip file contains a Delphi project; there are some files in it:
- sexybabe.dpr : .dpr extension is used for the "project" file.
- sexybabe.dof : .dof is the extension of the project options file. It contains informations such as the compiler and the linker options and other infos...
- sexybabe.res : .res is the classical resource file.
- sexybabe.cfg : .cfg is the project configuration file.
- oo.pas : .pas extension is used for the "unit" file, the source. This file contains the source code of the proggie. A Delphi project could be divided in more than one module and so, you can find a project with more than one .pas file.
- oo.dfm : .dfm extension is used for the "form" file. dfm file contains the definition of the program's dialog (or the window or the form if you prefer...). From here, you can see all the controls used in the dialog with all the characteristics and all the procedures's name used to manage some particular event...
- oo.ddp : .ddp stands for Delphi Diagram Portfolio but, in my ignorance, I really don't know which is the use of this file :-)

Now, where can I start to study the source? All the source code used by the crackme is in oo.pas but as you can see, there are some procedures: decode, extract, tests, serial and TForm1.Edit1Change
Obviously, from this file only, you can understand from where you should start but, basing your work upon another file, you will surely find the right procedure from where to start. Which is this file? :-)

Regards,
ZaiRoN
r4g3
08-03-2003, 11:47 AM
this serial sheme looks so similar to that of opera 7.x ;)
different mod constants, no preceding os char, prolly not the same prng, but the idea remains the same :)

nah, the prng seems to be unaltered ;p
evaluator
08-03-2003, 01:56 PM
shit:)
now wooma will punish me..


Shockwave
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Shockwave
PDA

View Full Version : Shockwave

Devine9
08-02-2003, 10:38 PM
Anyone here know much about shockwave format files?

I was looking into a shockwave game on the net the other day.. Looked somewhat packed as there were no cleartext string references.. never the less IDA and any other disassembler I tried wouldn't touch it.. and there was nothing readable inside..

Only way I can think of is to run it inside a browser and break in the shockwave player itself.. there seems to be outside url's being referenced from the file..
Its a .dir file that I have here.. and seems to play fine standalone.. haven't bothered with breaking in the player yet.

Devine Right [RET]
naides
08-03-2003, 08:43 AM
There was a thread with some posts from disavawed and some mine around 6 months ago. Then we discussed a shockwave app. I remember he mentioned a shockwave decompiler, which PERHAPS may work in your files. Give it a search.

PS: My memory failed me again. sorry
evaluator
08-03-2003, 01:54 PM
to Newbies Forum>
disavowed
08-03-2003, 09:09 PM
Originally posted by naides
There was a thread with some posts from disavawed and some mine around 6 months ago. Then we discussed a shockwave app. I remember he mentioned a shockwave decompiler, which PERHAPS may work in your files. Give it a search.

nope, if memory serves, that was flash, not shockwave.

dev9: afaik, there aren't currently any reversing tools for shockwave. if you do find any, post here and let us know! :)
esther
08-03-2003, 09:14 PM
Hi all,

http://www.woodmann.net/forum/showthread.php?threadid=947&highlight=shockwave

Not sure if you helps ya ;)
disavowed
08-03-2003, 10:23 PM
nope.. openswf is for flash ONLY, and suddendischarge hasn't been around for quite awhile (and even if they were around, they wouldn't have any shockwave tools because none exist)
fcjohn
08-05-2003, 03:12 AM
dirOpener might be along the lines of what you're looking for. I believe it handles Shockwave.

www.j-roen.net/diropener/

You'll might need a copy of Director for it to be useful, though...
disavowed
08-05-2003, 08:47 PM
yep, looks like you need director to open the output. i'd be interested to hear from anyone who has director and can try that tool out if it works well. great link, fcjohn!
zhas
11-02-2003, 06:33 AM
if you want just to take a look at the
flash resources like Graphic, Movie Clip,
Buttons, Action Scripts(script language for flash files) you may use
Action Script viewer
also there is a utility to convert from projector exe file
to original swf


Asprotect mR Gandalf (.ar)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect mR Gandalf (.ar)
PDA

View Full Version : Asprotect mR Gandalf (.ar)

hobferret
08-03-2003, 05:14 AM
Hi everyone - nice to be back:)

I posted this on Aarons site while RCE was down - so for anyone who didn't see it I am leaving it here!;)

I found this in Spanish on Gandalf's site in Argentina

Being as so many newbies ask about ASPR I put it into English and HTML!

/hobferret - ON VACATION
dELTA
08-04-2003, 06:45 PM
Thanks hobferret, such translation efforts are always appreciated.

dELTA
hobferret
08-06-2003, 03:05 PM
Cheers dELTA:)

It's nice to know someone appreciates it!

I will try and do more when I get back home - if I get the time!

/hobferret
yaa
08-15-2003, 07:58 AM
hobferret, would you be so kind to post also the original essay for www.hackemate.com seems to be down

yaa
hobferret
08-15-2003, 03:48 PM
yaa - lo siento amigo mio :)

I am sorry but I do not have it any more, in fact I don't even have the translation locally any more:cool:

/hobferret
yaa
08-15-2003, 04:58 PM
I read your translation and had a hard time undestanding a few sentences ... I wanted to take a look at the original in an attempt to clarify them.

Would you like to share with us the part on the stolen bytes that you felt missing in the original?

Regards,
yaa
hobferret
08-16-2003, 03:43 PM
Hiya yaa :)

There is a very easy way of doing this, in fact it has been mentioned on this forum a few times;)

Look at http://www.woodmann.net/forum/showthread.php?threadid=4936&perpage=15&pagenumber=2

hobgoblin reminded me of an easier way of doing this!!:)

/hobferret


Toolbar bitmap explorer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Toolbar bitmap explorer
PDA

View Full Version : Toolbar bitmap explorer

squidge
08-03-2003, 06:29 PM
I'm looking for a small add-in tool for MS VC++ .net, in which it can take a bitmap of my choice, split it up into multiple icons, and then number each one and present this icon + number relationship in a dropdown box in the IDE so I can simply type the numbers into my TBButton array without staring at the screen and counting each icon.

Has anyone done anything like this, or do I need to write this myself? I noticed the editor goes some way with this, but can't get it to number the icons, so have to always end up counting them to find the toolbar icon I want (which is a complete git when you've got 64 icons per bitmap).


REQ: SLK symbplic link file format
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > REQ: SLK symbplic link file format
PDA

View Full Version : REQ: SLK symbplic link file format

dreamweavermx
08-03-2003, 10:03 PM
Where can I find it ? I tried myformat.com but their website seems has problem.
Bengaly
08-04-2003, 02:23 AM
try and see if this is the one u need:
http://www.wotsit.org/download.asp?f=sylksum
dreamweavermx
08-04-2003, 08:00 AM
wow , thank you very much !


I'm bitching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > I'm bitching
PDA

View Full Version : I'm bitching

esther
08-05-2003, 04:16 AM
Hi all,

I was wonderding what happen to protools.
The download links are dead :confused:
I have email to the admin but no reponse.

Regards
Zero
08-05-2003, 08:48 AM
If anybody has the mail of the protools admin, please send me a PM. I can offer a stable host for the site.
JMI
08-05-2003, 11:27 AM
esther:

I'm not clear if you are speaking of the programmer's tools site hosted at http://pham.bulhosting.com/protools/ and/or the one hosted here. As far as I know, all the files listed on the links shown on the link listed at the bottem of this Forum were uploaded to the server and the links should be good. I only checked a few and did get a 404 on some of them, but have not had time to check the server yet. Maybe something happened during the upload, but they should work otherwise. Which program were you trying to download?

I've checked and all the files are still on Woodmann's server, but the main link has been set to refer to the "new" Programmer's Tools site listed above and they are apparently having problems. Maybe they will discuss the situation with Woodmann and he might chose to re-open their site on his server. That's not within my job description. :cool:

Regards.
esther
08-05-2003, 01:17 PM
Hi JMI,

Yeah I'm referring to the link below.Before we came back to this vbulletin the link to protools is connected to this server. I guess I
have to wait patiently :cool:

Thanks for the input

Regards
evaluator
08-05-2003, 01:56 PM
>I guess I have to wait patiently

if you want some prog, ask.
esther
08-05-2003, 09:30 PM
Evaluator:
if you want some prog, ask.

I want a unpuck asprotect :D /joke

Nothing at the moment thanks :)

regards
Woodmann
08-05-2003, 11:00 PM
esther you lie.................

You want to unpack some VB shit dont you :eek:
esther
08-05-2003, 11:08 PM
Woodmann,

VB ain't shit,the programmers are lol

I'm not unpacking for some time,only birthday presents :p
evaluator
08-06-2003, 04:53 AM
how easy you speek with Don Wooma!?
:( :p
Woodmann
08-06-2003, 06:51 PM
eval...........

Drop the don crap........

please forgive my butchering of this language....

contraffazione di persona umile :)

esther, you are still a bastard ;)

Woodmann
esther
08-06-2003, 10:53 PM
We are same :p
evaluator
08-07-2003, 12:30 AM
trolling, luring, ESTHERING
:)


calculation under softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > calculation under softice
PDA

View Full Version : calculation under softice

newbcrk
08-05-2003, 05:43 AM
lol

017F:00418D25 59 POP ECX
017F:00418D26 EB0F JMP 00418D37
017F:00418D28 0FB607 MOVZX EAX,BYTE PTR [EDI]
017F:00418D2B 8B0D10AE4200 MOV ECX,[0042AE10];; here I press F10 Before I have done d 42AE10
017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

:d 42ae10
:0030:0042AE10 1A AE 42 00 1A AE 42 00-00 00 20 00 20 00 20 00 ..B...B... . . .

After F10 I watch in my WR
And I find
:ECX=0042AE1A why ? It should be ECX = 0042AE10

Here I have some difficulties too

017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

I have EAX = 37h
I do 37*2+ 1A = 88 but in my wr EAX = 84 = AL

I try too 37*2 + 20 = 8E if I considere that ECX= 0042E1A And sotice gives another one EAX = 84 = AL
If I do d eax*2+ecx then the result gives 84
ArC
08-05-2003, 07:01 AM
:ECX=0042AE1A why ? It should be ECX = 0042AE10

8B0D10AE4200 MOV ECX,[0042AE10]
This opcode causes that the contents of 0042ae10 will be copied
to ecx. ;)
esther
08-05-2003, 07:09 AM
After F10 I watch in my WR
And I find
:ECX=0042AE1A why ? It should be ECX = 0042AE10

cuz you do F10 it will step into next instruction

Regards
naides
08-05-2003, 09:49 AM
Originally posted by newbcrk
lol

017F:00418D25 59 POP ECX
017F:00418D26 EB0F JMP 00418D37
017F:00418D28 0FB607 MOVZX EAX,BYTE PTR [EDI]
017F:00418D2B 8B0D10AE4200 MOV ECX,[0042AE10];; here I press F10 Before I have done d 42AE10
017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

:d 42ae10
:0030:0042AE10 1A AE 42 00 1A AE 42 00-00 00 20 00 20 00 20 00 ..B...B... . . .

After F10 I watch in my WR
And I find
:ECX=0042AE1A why ? It should be ECX = 0042AE10

Here I have some difficulties too

017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

I have EAX = 37h
I do 37*2+ 1A = 88 but in my wr EAX = 84 = AL

I try too 37*2 + 20 = 8E if I considere that ECX= 0042E1A And sotice gives another one EAX = 84 = AL
If I do d eax*2+ecx then the result gives 84

You problem lays in understanding the significance of brackets: They provide the Assembly equivalent of C pointers

017F:00418D31 8A0441 MOV AL,[EAX*2+ECX]

in this instruction, what gets moved to AL is the byte contained at the address ds:EAX*2+ECX

not the result of the EAX*2+ECX operation, 84 in your particular example

Such instruction would be:

017F:00418D31 8A0441 MOV AL,EAX*2+ECX

Hope this makes it clear
newbcrk
08-05-2003, 01:12 PM
Yes I don’t know the significance of the brackets .
I believed that it was in the memory of the stack ,only .Right or false?
And is the contents of the brackets always pointed by the ds register ?
:)
evaluator
08-05-2003, 02:26 PM
if no other prefix done, usualy from DS
newbcrk
08-06-2003, 03:07 AM
thanks


Aspack unpacked dll relocations ignored
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspack unpacked dll relocations ignored
PDA

View Full Version : Aspack unpacked dll relocations ignored

djpaul1963
08-05-2003, 07:35 AM
Hello,

I unpacked with Aspackdie 1.4 a dll packed with Aspack 1.12 and I fixed the base relocation directory address and size because they were wrong. Now I can see the relocs from inside PE Tools but when the dll is loaded from the program it seems the relocations are ignored from the PE loader (win2000). All relative address remain at their original linked values (1000000 is the image base but the dll is loaded at 46C000 usually). I don't have win 98 installed to see if it's a Win 2000 problem only, but maybe someone of you may have the answer already?

Thanks in advance :D

Dj
djpaul1963
08-05-2003, 12:24 PM
Well,

After tracing inside ntdll i discovered that relocations fixup was indeed taking place but somehow the image base of the dll was set to an invalid value (FFFFFFFF) and therefore all thins got messed up!
I don't know how this happened but now it's fixed and the dll is loading just fine :p

Thanks,

Dj


Hi guys,
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hi guys,
PDA

View Full Version : Hi guys,

hobgoblin
08-05-2003, 04:33 PM
Hi guys,
Greetings on the board.
It's been a long time since I was here. Haven't been doing reversing for along time either.:-) I have been caught up in the DVD and DivX scene for quite some tim enow. But after seing that it seems like ASPR have been renewed, I got interested. I'm reading and trying out things. A small question: Have anybody managed to seek out the "stolen bytes" in System Cleaner (the proggie mentioned in a thread from the other day)? I have tried to search (using softice) after the common bytes that usually can be find among these bytes, but have no success. And some of the ideas I read about in an earlier thread didn't work either.
Interesting thing, though, the newest aspr. After going over the dissassembled body of the aspr.stub, I saw that there are several sice checks now (as evaluator mentioned). I seem to have found a way around it. I put a bpint 01, and when sice breaks, I just jump the int 01. Then the program starts normally,and can be debugged as usual. The IAT problem can be solved as before. (I'm on XP SP1).
I tried using Ollydbg according to Labbe's tutorial, but this didn't work on my machine. Olly doesn't break at Isdebuggerpresent as he describes.
I must say it is nice to learn something new again. I see some of you guys are really catching on in your reversing endeveauors. Seems like some of you are becoming good coders too.:)

Well, enough ranting for now....
But what about those stolen bytes? Any good ideas?

regards,
hobgoblin
Shoob
08-05-2003, 04:43 PM
they are

00565CA0 > 55 PUSH EBP
00565CA1 8BEC MOV EBP,ESP
00565CA3 83C4 F4 ADD ESP,-0C
00565CA6 B8 90555600 MOV EAX,dumped_.00565590

in 4.91e but im going more probs with iat atm.. greetz

Seems like some of you are becoming good coders too.

lol
hobgoblin
08-05-2003, 05:05 PM
Thanks for a speedy reply. But how did you find it? I know that in most programs there will be 11 or more bytes missing, and that they mostly looks the same. I'm more curious about you find it, what kind of search methods you use (if you use any).

regards,
hobgoblin
Iwarez
08-05-2003, 05:15 PM
These instructions are not really in clear text in the code. Aspr does emulate the instructions with other instructions that do the same. You will have to break before Aspr starts executing the emulation and you'll have to watch the stack and registers carefully. Also I recommend to note down the program execution flow. As systemcleaner is a Delphi app (If I remember well) you will know the stolen bytes and you only have to check the value of EAX to know what the MOV EAX, xxx line must read.
Shoob
08-06-2003, 09:12 AM
First you should look at older versions of the same program, it mostly used the same way.
evaluator
08-06-2003, 09:44 AM
hi assp-maniacos!

as I can remember, we played with SVKP-protector & I done
pseudo-code exersize.
So seem Ass also dedicate himself to learn this technique..

so if you first time see that simulated code, use that
pseudo-code exersize for better understanding.

Also I mentioned alternative way for it:
just attach this code to dump & set EIP...
hobferret
08-06-2003, 02:58 PM
Hi hobgoblin

Long time no see;)

The way I find them is simply by looking at the previous versions and then search in high memory for the byte pattern - excluding any push address - Usually you can find it but I must admit I am on vacation and have not looked at aspr for a month or so:cool:

/hobferret
hobgoblin
08-06-2003, 03:33 PM
Hi hobferret,
Yes, I do use that method myself. But this time I was wondering if there was possible to find a more generic way to do this. Another method i use is to check the registers when I have arrived at the OEP. Sometimes one or two of the registers gives up an address to the higher memory. When you check that, and scroll a little bit upwards, you will eventually see the stolen bytes.

Anyway, I usually manage to find it.:-)

To those interested in exception handling, take a look at this proggie:
Synchromagic from xxx.gelosoft.com

Now do this: find the adress of the int 01 instruction. After that, activate SuperBpm for NT (I'm on XP). Enter the program via a bpx getversion or something. After breaking and disabling this bpx, try put a bpm right before the int 01 address.
Let me know if you succeed in continuing debugging this program. I don't...
When tracing and checking I found 3 places where exception handling is taking place, and where the program exits. But I can't seem to find more. When I modify the 3 places, the progam still exits quietly....

Regards,
hobgoblin
hobferret
08-06-2003, 03:50 PM
Hi again hobgoblin;)

Which version are you talking about - pro or home:confused:

Will have a look when I know which one!

/hobferret
hobgoblin
08-06-2003, 06:27 PM
Pro 3.5 build 557
britedream
08-07-2003, 05:49 AM
Hi shoob
Please find the correct oep and stolen bytes as:
oep= 56609c
push ebp
mov ebp,esp
add esp,-10
mov eax,0056598c

I have it running perfect on this info.
error in the last version 4.91d is corrected in 4.91e where
it took out the time limit on unpacking.

britedream.
Shoob
08-07-2003, 07:03 AM
i have yesterday some talking to a friend, he had also unpacked the same proggy (4.91e). Then i've got his IAT (cause my dont even works) and fixed my dump, the program dont even work for me thats very strange cause i using the same program /same dump and my program belongs to another dword at 005660AC CALL DWORD PTR DS:[56F1A4] so it crashes (his works and belongs to another dword). Anyway maybe a 2k prob?.

OEP:_ 467757

01407D2B 55 PUSH EBP
01407D2C 8BEC MOV EBP,ESP
01407D2E 6A FF PUSH -1
01407D30 68 A8384A00 PUSH 4A38A8
01407D35 68 6CC54600 PUSH 46C56C
01407D3A 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
01407D44 50 PUSH EAX
01407D45 64:8925 0000000>MOV DWORD PTR FS:[0],ESP
01407D4C 83EC 58 SUB ESP,58
01407D53 53 PUSH EBX
01407D58 56 PUSH ESI
01407D5D 57 PUSH EDI
01407D5E 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
if you already searching for bytes in synchromagic/my dump works perfectly (stored in unpacking process! short before returns to Restore the code (pushad, rep [edi] etc..)
britedream
08-07-2003, 08:26 AM
Hi
synhmagic info:
real oep= 4544fc
stolen bytes:
push ebp
mov ebp,esp
push -1
push 48b1e0
push 45827c
mov eax, Dword ptr Fs:[0]
push eax
mov Dword Ptr fs:[0],esp
add esp,-58
push ebx
push esi
push edi
mov Dword ptr ss:[ebp-18],esp

I have the program running on this info.

Britedream
hobgoblin
08-07-2003, 09:08 AM
Hi britedream,
About Synchromagic:
Did you manage to unpack (halt the program at OEP, then dump it) by using Softice on WinXP?
When I try to do this, I first put a bpint 01 in Sice, and when Sice breaks, I jump the int 01 instruction, remove the bpint. But when I try to continue, the program just quits without any messages.
Doesn't this happens to you?

hobgoblin

:) Never mind. I found a way around my problems.:)
evaluator
08-07-2003, 11:30 AM
long time in this world done solution for INT01 detection under NTsystem..
britedream
08-07-2003, 11:49 AM
Hi hobgoblin!.
I am sorry I was unpacking the home edition but the pro
is the same except for the following:
oep 467757
the two address pushes
push 4a38a8
push 46c56c

I have the pro running perfect, If you wish I can send
you my IT , so u compare it with yours.

britedream
Shoob
08-07-2003, 11:51 AM
as i said one page before already ;)
britedream
08-07-2003, 12:47 PM
Hi shoob
I was wrong, you are right , I was thinking of something else.

so I edited my post.

britedream
hobgoblin
08-07-2003, 03:14 PM
Britedream, please check a PM I send you.

regards,
hobgoblin
hobferret
08-08-2003, 11:16 AM
Yo hobgoblin;)

Looks like most of it has been done - so there is no need for me to take a look when I return:cool:

/hobferret
hobgoblin
08-08-2003, 01:24 PM
No.:-)
I found out what to do. In the process I found out how to find the stolen bytes in a rather eaasy way too. The program is unpacked and up and running.

Thanks for offering help, though... :)

hobgoblin
dELTA
08-08-2003, 02:25 PM
Well, why don't you share this "rather easy way" with the rest of us then... ;)

dELTA
hobgoblin
08-08-2003, 03:27 PM
Okey. This is what I did.
After finding the OEP, I haltet the program there while running Sice. By checking what the code looked like at the addresses stored in ecx/edx, I found it to be a lot of "loopnz" instructions. (I have used this method in the past also. Sometimes though, the registers don't give up this information. Then you have to search for bytes that are a part of the code I describe in the next sentence).By scrolling upwards a little bit I found the code that manages the writing of the "stolen bytes" and also manages the code that overwrites the section where the "stolen bytes" are stored. (After the "stolen bytes" are used, they are overwritten). One of the instructions you will see are a jmp instruction (the first one you get to when you scroll upwards). The trick now is to halt the program by a bp in Sice the next time you run the program. When you first run the program, bpx on Getsystemtime. When Sice break in the aspr-code, step down to the end of the routine and write down the value you see is pushed from eax to an address. Then go to the OEP and make a note of the address for the jmp instruction. The next time you run the program, bpx on Getsystemtime, and then write in eax the same value you found the first time. By doing this you make sure the address for the jmp instruction is the same. (If you don't do this, the code will be placed somewhere else). When Sice breaks at the jmp instruction, start singlestepping from there, while you carefully notice the code you see listed and executed in Sice while stepping. Soon you will see the stolen bytes be listed between jumps.
Just try this a couple of times, and you'll see how you can find out what the stolen bytes are.

As I have written this, let me point out that this is not an original idea from me. I have merely given input I got from evaluator an extra thought, then tried it out in practice a few times. I'm just passing on information.:)

hobgoblin
hobferret
08-08-2003, 04:57 PM
Hi hobgoblin :)

You have just triggered my last remaining brain cell into operation! I now remember exactly what you have done but I had forgotten all about locking the code location by using an API.

There was mention of this on this forum maybe a year or more past - it's amazing how easy it is to forget the simple things;)

Thanks for reminding me:cool:

/hobferret


Need some help with DeDe plz
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Need some help with DeDe plz
PDA

View Full Version : Need some help with DeDe plz

Torque
08-05-2003, 11:15 PM
Hey guys,

Im working on this Delphi app (PE Explorer 1.93) and decided to try DeDe (first time).

I've never used DeDe and I seem to be doing something wrong.

I load the target and process it. However, when I click on the "Forms" button nothing is there. I found a tut that works on an earlier version of the program and in that tut all of the forms are displayed, the "Forms" section is full.

Can anyone tell me why my "Forms" section is empty (along with my "Procedures" section)? What am I missing?

The target isnt packed or anything. Is there some anti-dede stuff I should be looking for?

If I wasnt clear please let me know.

Any help is greatly appreciated :D

-Torque
evaluator
08-06-2003, 03:30 AM
error404
www.heaventools.com

later i will look, can be some resource protection added.

Did you tried some other Rsrc-viewer?
Torque
08-06-2003, 11:10 AM
I have not tried any other rsrc viewer yet.

I wanted to use DeDe so that I can follow the tutorial somewhat (even though it talks about an older version).

Anyway, if DeDe wont work, can you suggest some other good rsrc viewers?

Thanx for the help,

-Torque
evaluator
08-06-2003, 01:17 PM
ResHacker is freeware tool,
search for other tools.. & then tell me..

look here,
if i tape

http://www.heaventools.com/index.html

then i'm redirected to chinese(?) page. interesting, e?
Torque
08-06-2003, 02:13 PM
Here is a link to PE Explorer 1.93:

http://www.heaventools.com/download/pexsetup.exe

Thats where I got mine.

If you could check it out with DeDe that would be great.

-Torque
Kayaker
08-06-2003, 02:52 PM
Hi

Sort of sounds like the trick of removing the "TPF0" identifier at the start of every Rcdata resource. TPF0.TForm1.Form can be replaced with i.e. 1234.TForm1.Form and this gets DeDe's shorts twisted in a knot. There is a second reference that gives the address to the form that can also be changed, so the app works fine but the Forms and Procedures sections in DeDe are blank as I remember.

See if you can find standard TPF0 identifiers with a hex editor, if not this may be deliberate anti-DeDe, maybe picked up from an Asp trick originally discussed here...

http://www.woodmann.net/forum/showthread.php?threadid=3440&perpage=10&highlight=dede%20asprotect&pagenumber=1

Kayaker
Feisu
08-06-2003, 09:10 PM
Originally posted by evaluator
ResHacker is freeware tool,
search for other tools.. & then tell me..

look here,
if i tape

http://www.heaventools.com/index.html

then i'm redirected to chinese(?) page. interesting, e?

Please use Proxy to visit it
evaluator
08-07-2003, 05:15 AM
explane, why need proxy?
Feisu
08-07-2003, 05:52 AM
Originally posted by evaluator
explane, why need proxy?

I use proxy can visit its homg page,If don't use.then go o that chinese page
evaluator
08-07-2003, 06:26 AM
HQ explanation..~8-)
ZaiRoN
08-07-2003, 11:48 AM
Hi ALL,
I am able to download the file with or without proxy, no redirect for me...


Obsidium.exe doubts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Obsidium.exe doubts
PDA

View Full Version : Obsidium.exe doubts

sope
08-06-2003, 10:27 AM
Greetings Everybody

After reading a nice thread on obsidium i decided to give it a try & for me its an ocean of new things. Nevercome across such stuff. I mean its difficult to put all the things here, so i'll straight way ask where i have doubts.

Ok, using the info provided in the thread already i did reached 0x9B144A, F8 & i see a jmp table. Noted the values which were required for ImportRec.

RVA = 68B100 Size = 0xCD0

I used Gaia's plugins first but after 3 api resolving it closed the obsidium.exe file. So next i used Soldat's plugin but it failed to resolve anything. Ok after re-reading the thread again Soldat did told we have to select each & every api manually & Voila it found the address.

Faster way: Use Soldat's plugin first & then use Gaia's plugin it will find as much api as it can.

After this i had following below stuff invalid

FThunk: 00685120 NbFunc: 00000004
0 00685120 ? 0000 007E3E90
0 00685124 ? 0000 007E3E9C
0 00685128 ? 0000 007E3EA8
0 0068512C ? 0000 007E3EB4

0 0068514C ? 0000 007E3EE4
0 0068535C ? 0000 007E3FE0
0 006854A0 ? 0000 007E43AC
0 006855AC ? 0000 007E459B
0 006857FC ? 0000 007E4913
0 0068580C ? 0000 007E492B

Bpx 0x9E0B79 in search for the remaining can sombody cofirm if my guess is correct ?

FThunk: 00685120 NbFunc: 00000004
1 00685120 user32.dll 0133 GetMonitorInfoA
1 00685124 user32.dll 014A GetSystemMetrics
1 00685128 user32.dll 00C7 EnumDisplayMonitors
1 0068512C user32.dll 0006 AnimateWindow

Also bpx 0x9F7C08 i see few from oleaut32.dll like VariantChangeTypeEx, VarNet, VarNot, VarAdd etc...etc.. api address are
saved in 0xA7E820 to 0xA7E874. I want to ask do we have to consider this api tooo ?

& for the remaining i mean 68514C to 68580C i am just digging.

Hope people already builded the obsidium.exe understand my question. I am on w2k.

Regards
Sope.


LINK: Three Ways to Inject Your Code into Another Process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > LINK: Three Ways to Inject Your Code into Another Process
PDA

View Full Version : LINK: Three Ways to Inject Your Code into Another Process

Kayaker
08-09-2003, 02:19 AM
A new link to a very interesting topic, discussions to follow?

Three Ways to Inject Your Code into Another Process
By Robert Kuster

How to inject code into another processes address space, and then execute it in the context of this process.

http://www.thecodeproject.com/useritems/winspy.asp

Cheers,
Kayaker
nikolatesla20
08-09-2003, 01:07 PM
Great article, thanks for the link

For DilloDumper, I used WriteProcessMemory, but I didn't bother with CreateRemoteThread - I simply SuspendProcess and move the EIP to where I want it.

I notice the author talks about interprocess communication, in that if you inject a DLL, you will need to get info back from it somehow, for example, a password. The solution I use is a Mutex. I create a Mutex and flag it, then inject the DLL or WriteProcessMemory code, and then when it's done doing its work it triggers the Mutex. I then know that the variable I want is valid, and can simply do a ReadProcessMemory (especially with the WriteProcessMemory injection, since I'll know the exact location of the variable I wish to look at).

However, in some ways I disagree with the author that the WriteProcessMemory method is more flexible. It IS more "flexible" in terms that you can be more under control where it goes in memory, but it's a bitch if you have to recode it somehow. Writing alternate code versions is much easier to do with an injected DLL. Of course, using an injected DLL makes it hard to grab values you want. You could always use a shared file map of course ;)

I like the "pop ecx" after a function call to get the EIP. I never though of doing it that way. I've learned a new thing :)

Just my 2 cents

-nt20
disavowed
08-10-2003, 12:55 AM
Originally posted by nikolatesla20
I like the "pop ecx" after a function call to get the EIP. I never though of doing it that way. I've learned a new thing :)
same here. i don't do much coding these days, but i thought it was a clever trick. good link, kayaker.
doug
08-10-2003, 11:13 AM
this trick has been used for a long time; it is particularly effective when you want your code relocatable.

Same idea applies when u try this:

call dummy
db "kernel32.dll",0
dummy:
call _LoadLibraryA

return address for dummy is pushed on stack.. it also happens to be the address for the kernel32 string. (of course that example still isn't relocatable, some more code would be needed to resolve LoadLibraryA..)
nikolatesla20
08-10-2003, 10:19 PM
I would like to see more posts here about making code relocatable - virus writers have been doing those tricks for a long time. Maybe it should be a new thread.

-nt20
squidge
08-11-2003, 03:29 AM
I have used this trick before in attacking a sentinel license manager. Rather than create a valid license, I attacked the weakest point - the license manager itself, which was statically linked to the program. Since the program itself used the challenge response of the library, I had to create a good page-full of assembler to ensure that the response is faked perfectly, as parts of the response from the challenge are used throughout the program. Having little space to code, I used a POP EAX/PUSH EAX to find out where I was in memory before trying to access my lookup tables (since the patch was inside a DLL).

The fun part was jumping over the parts of the code which are pointed to by the relocation section - I didn't want to modify the relocation section, but didn't want my own code modified. I did this by hand, but I think it would be a useful addition to my RTA project to point out these fixup addresses for this kind of code modifying.

Now, is there any tools for directly modifying a targets relocation section in a dll?
nikolatesla20
08-11-2003, 08:10 AM
Thats a similar problem I am going to have soon. I wish to patch , at runtime, a DLL of a game, to inject my own code to add more "functionality" (i.e., options). The issue here with DLL's becomes the relocation factor. Now, on one particular computer the addresses will usually remain the same every time, (very rare they will change) so I can code the whole thing to work on this PC only but I lose portablility of course.

I will end up with some Jump instructions of course, and as long as these are local jumps I'm ok, but I WILL need to somehow get to my new code, and to do that I'll have to do some sort of CALL of PUSH RET, which means I'll need to know the relocation.

Here is the thing: if my entire code blocks are injected at run time, this is not a big problem, since my injector can calculate most differences (get a list of modules in the process, and their base addresses, and then allocate some memory, calculate differences, work from there). But I wish to add this code statically eventually. In other words, as a permanent part of the DLL package. So in this case I will either need to edit the relocations section to add my new variables and calls and jumps, or I can use some smart techniques of avoiding non relocatable code.

Just like squidge asked, a relocation editor might be the only tool that I don't believe exists right now...haven't seen one off the top of my head anyway.

-nt20
doug
08-11-2003, 12:15 PM
the main problem I have with injected code that must be executed from anywhere is the source can easily can unreadable.

- Something I have used against some protections & that I have seen in some viriis:

some_data db "blablah",0

call delta
delta:
pop ecx

; after this point, all offsets are calculated from delta.
; for example, to reference some_data, you would do something like
lea eax, [ecx+offset some_data - offset delta]

There are a few guildelines to follow, but essentially you want your code to have as few absolute addresses as possible. Therefore you must avoid some addressing modes and all instructions using them.
with some equ's you can probably make it a lot more readable.
lea eax, [ecx+SOME_DATA]
so you see, this really isn't doing much more than setting up another 'frame' pointer (ecx). call dword ptr [ecx+SOME_API] isn't impossible either.

Or if your code is big,

- To your injected code, include a small loader that will relocate the rest of your code (parse the .reloc, build yourself a reloc table, use the call/pop trick, ...), that way only a small part of the actual injected code will have to be coded using special techniques.
doug
08-11-2003, 12:24 PM
forget last comment,
I didn't get that you two were looking for ways to change the relocation table to avoid your code being incorrectly relocated by the pe loader.
nikolatesla20
08-11-2003, 12:38 PM
No, it's ok, that was the kinda of info I was looking for as well, thank you :) However, it would be nice to get more relocation info too, but I know I've read about it and actually walked thru a relocation table before, so I could probably do it manually, it's just that I'm surprised there's not a tool in existence for it yet.

Actually, now that I look at my DLL hook project, the entire code sequence that I wish to inject happens to be code based off all register offsets (i.e., call dword ptr [ebx + 0x174]), hence it will not need to be relocated. However, the PUSH RET will need to be, which calls to it. Looks like for now I may be better off to inject the code live, since I can calculate the correct offsets then. Otherwise I would need to add entries to the relocation table. Reason is I am getting to my new code block with a "PUSH XXXXXXXX, RET", which leaves more flexibility. Of course, if I can find a nice cave closer, I could use a local JMP which would also not need relocating, but I don't think I'll find such a cave in this DLL.

So far, I've always used the loader method, and for now I might need to continue using it for this project.

-nt20
evaluator
08-11-2003, 01:53 PM
nikolatesla20

of course, DLL-inject is normal-good way.

>>using an injected DLL makes it hard to grab values you want.
why?

in simple, DLL is also somewhere allocated memory..
when you inject it with loadlibrary, you then have base.
so from control process you will calculate adresses via this base.
nikolatesla20
08-11-2003, 02:09 PM
You are correct evaluator, in that you will get the base from LoadLibrary. However, when you inject the process, you normally would use "CreateRemoteThread" WITH "LoadLibrary" API to inject the DLL into the other process. Well then, this doesn't help you much because the return from LoadLibrary will be in the other process, not yours (Since the thread is in the other process). Hence, you still have a hard time getting the Loaded Base address. But yes, if you had the base you could calculate everything from there. Using the above technique however, will not allow you to easily get the base. You'd still have to use "Module32Next" on the processId to get it...which is what I'm going to end up doing I think for my little project...

-nt20
evaluator
08-11-2003, 02:16 PM
I don't learn, how works this "CreateRemoteThread".

way I know:
1. Create suspended.
2. VirtualAllocEx
3. WriteProcessMemory on VirtualAllocEx-ed:
little code call loadlibrarya & save base here (on VirtualAllocEx-ed)
4. ReadProcessMemory for saved base, so we know base.
doug
08-11-2003, 02:46 PM
. However, the PUSH RET will need to be, which calls to it. Looks like for now I may be better off to inject the code live, since I can calculate the correct offsets then

Ok, so you are interested in statically patching your code into the new DLL, while not modifying the reloc table. I.e you are trying to avoid to use an external loader to do the dirty work & inject your code, right?

In that case, why not include a new section in the DLL add your code and modify the entrypoint, and from there do the same job your external loader would do.

Or, if you have space at the injected location to add a couple more lines of code.. you could get your PUSH/ret sequence to call the right place in memory without having to push the absolute (VA) location.
doug
08-11-2003, 02:49 PM
you could use a 4bytes memory mapped file with a name both process know, where you would store the DLL loaded base.

Synchronize both things with a event maybe.

(edit: I meant event, not mutex)
Pyrae
06-29-2004, 01:54 AM
It's even easier:
Simply use the exit value of your remote thread to hand over the base to the control process. :)


a stupid question !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > a stupid question !
PDA

View Full Version : a stupid question !

dreamweavermx
08-10-2003, 01:04 AM
Please forgive my terrible English
When I scan DLL or decompile them
Some DLL have export their function name clearly such as DoIt , GetIt etc but some just export funcname like number such as 478 , 216 etc ...
So what makes the DLL just generate funcname like 478 or just because it is the original name of them ????
squidge
08-10-2003, 03:31 AM
It's up to the programmer of the DLL whether he wishes to export functions by name or ordinal.


Hacking 16lvls, mostly reversing. :) fun!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Hacking 16lvls, mostly reversing. :) fun!
PDA

View Full Version : Hacking 16lvls, mostly reversing. :) fun!

Manko
08-10-2003, 03:45 AM
Hi!

I saw this at TNTforum:

webadvisor
TNT!forum Guest

Registered: Aug 2003
Location:
Posts: 8
Little Test for PRO HACKERS
This is a test to see if you are a Pro of Hacking (15 level)

Do you think you are a Pro Hackers ?

Go here To begin the test : hxxp://scifi.pages.at/hackits/

I am on level 15
Any question : ICQ 218728184

Not so hard... I'm stuck with lvl 15 because I have to read up on some things, I believe... will look at it later...

Actually it's important to know that I have never worked html or jawa, and that is not a problem for these puzzles... So even if you feel un-knowledgable, if you have the reversing spirit, you will catch on... :)

/Manko
squidge
08-10-2003, 01:22 PM
I got bored of looking at the source code by the time I did level 8. Does it get any more challenging later on?
Manko
08-10-2003, 06:43 PM
Hi!

Hehe... I don't think I ought to be saying this but if you got stuck on lvl 8 it's because you ARE staring at source... :P
(or did you make it? it's easy when one approaches it in the right way...)

Well it doesn't really get hard until lvl 15 and that is only because I don't know about .htaccess and .htpasswd... how to extract them...

There were maybe a couple lvls that had something extra for me... not being difficult... But, anyway...

These are fun because you can do them quite quickly and for me it is something new... Still stuck on lvl 15... (Haven't tried more to be honest...)

edit: Fin! :D
the 16th and last lvl was really quite pathetic... and nr 15 was easy when I realized my misstake...

/Manko
disavowed
08-11-2003, 10:02 PM
john the ripper will crack .htpasswd's
Snatch
08-15-2003, 04:38 PM
Well I finished the 16 level challenge was pretty easy easier than some other hacking contest sites I have tried but it was fun nonetheless. Try hxxp://www.try2hack.nl it is a fun little challenge also though level 9 and up are down for now (hack into an IRC bot) should be back up soon. At least I hope they are because I am waiting to crack them :).

Snatch
Aquatic
09-23-2003, 09:00 PM
Originally posted by Snatch
Try hxxp://www.try2hack.nl it is a fun little challenge also though level 9 and up are down for now (hack into an IRC bot) should be back up soon. At least I hope they are because I am waiting to crack them :).

Snatch

I "cracked" that one by searching google. (The answers are posted on various sites). :p
Manko
09-24-2003, 03:15 AM
hi!

...and you're proud of it too... ? ;P

/Manko


CrossWord puzzle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > CrossWord puzzle
PDA

View Full Version : CrossWord puzzle

ZaiRoN
08-12-2003, 12:59 PM
Hi ALL,
I finally find the time to finish this project. It's nothing special but as we discussed in an old thread it might be a good way for to learn something new having a little bit of fun. All the definitions are inherent to the normal functions used by windows: api.

Feel free to ask your questions whether you don't understand something or if you are not able to solve the entire scheme.

If you like it, I could write others (obviously, if you want you can write your personal scheme :))

Good luck!
ZaiRoN
FoolFox
08-14-2003, 06:58 AM
Nice one ! I like it :)

Regards
FoolFox
ZaiRoN
08-14-2003, 10:33 AM
Thx FoolFox :D
Have you completed all the scheme?

ZaiRoN
FoolFox
08-14-2003, 10:36 AM
Not full yet.

I'm doing that at job-time, u see, so, God know why
all these people keep disturbing me of real interesting material ;)

Regards
FoolFox


Java bytecode debugger?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Java bytecode debugger?
PDA

View Full Version : Java bytecode debugger?

crassy
08-12-2003, 08:48 PM
Hello all!

I was wondering if there is any tool that allows you to debug Java bytecode?

I know you'll probably say "decompile it". Well, when you've got
obfuscated Java code with a couple of thousand classes named stuff like acbv.class and ba.class with encrypted text string it's kinda time-consuming to find just the one that handles serial generation...

So is there any way to debug bytecodes or at least see which classes are loaded into the JVM? If not, whats YOUR usual approach when dealing with obfuscated Java apps?

Thanks!
Kayaker
08-12-2003, 09:11 PM
Hi

I hate to say this but are any of the other java threads on this board of any use? Try a search for java and clandestiny and see if they help. good luck.

Kayaker
disavowed
08-12-2003, 09:45 PM
i still have yet to find a java debugger (other than softice, kayaker!), although i haven't really looked in about a year. i'd be interested to hear if you come across anything

oh, and btw, yes, i realize you can decompile a java target, and then use an ide to recompile and step through the source code, line-by-line with the ide's source debugger.
ArC
08-13-2003, 06:56 AM
If you got crippled java code,
you should try to decompile it with
Bit-Arts JavaBite (I think it's spelled this way)
In the documentation they write that it can
handle crippled java code as well.

Try it out ;)
naides
08-13-2003, 10:41 AM
I have to admit I am in a similar corner as crassy.

The obfuscated java code makes using a decompiled classes not very friendly. I have tried to locate the serial validation routines by using grep and finding the error messages with limited success.

There are some java debuggers. I d/l one called Jswat, which requires the bulky 80 Mb J2SDK from Sun microsystems.

At face value, it tells you that, in order to debug, one has to have compiled the classes with -d directive, so some debug info is available ( Theoretically, the same should be true with SoftIce). I have not have the time to tweek it aorund and see if it provides any helpful info that allows us to narrow down to the right serial validation code.

I hate to say this, but Kayaker showed us his incisive use of Sice to catch java loading classes. Could you, Kayaker, think of some way to use softIce to narrow down the class doing the serial validation? or generating the error message?

I think a possible solution would be in the lines of understanding the JAVA VM and placing BPX on the routines that generates message boxes, then try to extract out the name of the class that called the routine at the particular instance in which the "bad serial number" message box is generated.
martin
08-13-2003, 11:52 AM
I came across the beginnings of a java based bytecode debugger that used Apaches BCEL (Byte Code Engineering Library) to analyse compiled class files.

Haven't really tried it in anger yet (it's incredibly slow) but it appears to let you step through bytecode and set breakpoints. It's called JBCD.

the java classloader has a private store of loaded classes, i'm not sure how you can easily get that information out without subclassing ClassLoader. I seem to remember the java-plugin console letting you do it.

I've always ended up decompiling/deobfuscating by hand and then trying to work out what's going on :(
Kayaker
08-13-2003, 08:24 PM
WeEeell..., if I knew dick-all about Java 2 years ago, I'm no better endowed in that category now than I was then. They say it's how you use it though right? ;p

The gist of it is that any MS Java app has to parse the class files through msjava.dll (or as someone mentioned in another thread, java.dll for Sun JVM), which of course makes it open to traditional debugging in Softice. If an encrypted class file(s) are used they must be decrypted with a loader class, but eventually also make it to java_lang_ClassLoader_defineClass() in msjava.dll as well.

At this point in the dll you have the filename and any decrypted code for each class file in the app as it executes. I'm not sure if you can change how a java app loads and executes, but at this api you can make a Class file dumper by inserting an inline patch to dump each decrypted class file to disk.

I think you're right naides, you could probably modify the code so you can "catch" which class file is being executed before the nag box comes up. Basically everything should stop there awaiting user input before the rest of the GUI comes up, unless the app protects itself in a more secure way. The patch could probably check for a new control Classname that indicated the nag window or something, (post-mortem by 1 class file). I had no problem cycling through the api manually until the nag came up, the correct buffer address and breakpoint displayed each class file name string as it was run.

For those too lazy to search..

http://www.woodmann.net/forum/showthread.php?threadid=1692&highlight=java+clandestiny

Kayaker
crassy
08-14-2003, 07:49 AM
Thanks Kayaker & Co. I really didn't even consider SIce as a tool for working with Java. =) Now I know better. You've been a great help!
chitech
09-03-2003, 01:09 PM
I have tried to make a bpx on i.e. _java_java_awt_button_initIds@8 (awt.dll from sun) to get information about the button in my java application. When I try to execute my program I get this error:

java.lang.UnsatisfiedLinkError: D:\j2sdk1.4.2\jre\bin\awt.dll: The process cannot access the file because it is being used by another process
at java.lang.ClassLoader$NativeLibrary.load(Native Method)
at java.lang.ClassLoader.loadLibrary0(ClassLoader.java:1560)
at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1477)
at java.lang.Runtime.loadLibrary0(Runtime.java:788)
at java.lang.System.loadLibrary(System.java:834)
at sun.security.action.LoadLibraryAction.run(LoadLibraryAction.java:50)
at java.security.AccessController.doPrivileged(Native Method)
at sun.awt.NativeLibLoader.loadLibraries(NativeLibLoader.java:38)
at sun.awt.DebugHelper.<clinit>(DebugHelper.java:29)
at java.awt.Component.<clinit>(Component.java:506)

How do I solve this problem? Thx

when I bpx on _java_java_lang_classloader_defineclass0@28 it's working (dump class files)


Armadillo 2.85 with Visual basic 6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 2.85 with Visual basic 6
PDA

View Full Version : Armadillo 2.85 with Visual basic 6

lownoise
08-13-2003, 09:18 AM
hi guys,

Yesterday i was trying to unpack a proggie witch was protected with armadillo.
Finding the oep and the import table isn't a problem.
if you run the packed exe in the debugger you can see the vb6 runtime dll is loaded.
The problem is when you load the dumped file in the debugger ( in my case olly) the vb6 runtime dll isn't loaded.
Does somebody had the same problem with a vb packed armadillo prog or someone knows a solution for this.
[Target specific information deleted by JMI]

lownoise
JMI
08-13-2003, 11:20 AM
lownoise:

Here is a quote from the FAQ that you MUST follow:

DO NOT POST TARGET SPECIFIC CODE THAT INCLUDES THE NAME OF THE TARGET

Please make sure that you follow this rule in the future.

Regards.
Kayaker
08-13-2003, 11:41 AM
You beat me to it JMI ;-)

Target name + OEP + blah blah addresses and we start getting an endless stream of 'I can't crack this Arma/Asphole' posts (not specifically meaning this one). Keeping it generic and keeping it technical keeps it interesting.

regards,
Kayaker
esther
08-13-2003, 12:11 PM
You beat me to it JMI ;-)

um naughty JMI :p

>I can't crack this Arma/Asphole' posts (not specifically meaning this one

ah-ma/ashhole post lol
keep up the good work Mods :cool:
evaluator
08-13-2003, 01:49 PM
hi, lownoise

if DLL not loaded with dump, so there can be one reason:
import table not restored correctly.

**
here i uploaded in zipped attachment "resolved_import.txt".

ATTACHMENT REMOVED BY ESTHER
JMI
08-13-2003, 02:29 PM
evaluator:

You gave lownoise the "generic" answer to his question, his import table was not correct. That should be sufficient at this point.

We do not want nor need "cookie-cutter" materials that can be used to make cracks for specific targets posted as attachments. Lownoise has not posted any part of his import table and we don't want anyone cutting and pasting all the information you provided after he has violated the rules by posting the name of the specific software he was attacking, along with target specific code.

Such information will only draw attacks from software manufactures and lead to further problems with server providers. Lownoise can post part of his own import table, without identifying the software, and then you can tell him if he is still missing something.

Regards.
esther
08-14-2003, 01:15 AM
ATTACHMENT REMOVED BY ESTHER

When did I became mod again :eek:
lownoise
08-14-2003, 05:11 AM
The only thing i wanted to know was where i was going wrong.
I didn't downloaded the import table of evaluator

I maked a vb app en protected with arm and reversed it so see what arm was doing with the import table. In my import table the __vbaEnd was incorrect.
So fixing this in the import table solved my problem.

For the people who are interested here some code snippets

as you can see on line 004012fc the reference is missing

004012EC MP DWORD PTR DS:[4010E4] ;MSVBVM60.__vbaVarTstNe
004012F2 JMP DWORD PTR DS:[401024] :mad:
004012F8 JMP DWORD PTR DS:[4010B8] ;MSVBVM60.rtcCurrentDirBstr

ds:[401024] points so memory location 00a26345

here's the code snippet of 00a25345 :)

PUSH EBP
MOV EBP,ESP
PUSH -1
PUSH 0A3B3B0
PUSH 0A3539C
MOV EAX,DWORD PTR FS:[0]
PUSH EAX
MOV DWORD PTR FS:[0],ESP
SUB ESP,10
PUSH EBX
PUSH ESI
PUSH EDI
MOV DWORD PTR SS:[EBP-18],ESP
AND DWORD PTR SS:[EBP-4],0
PUSH 0A3D808 ; ASCII "MSVBVM60.DLL"
CALL DWORD PTR DS:[A3B0A4] ;kernel32.GetModuleHandleA
MOV DWORD PTR SS:[EBP-1C],EAX
TEST EAX,EAX
JE SHORT 00A263AE
PUSH 0A3D834 ; ASCII "__vbaEnd" :D
PUSH EAX
CALL DWORD PTR DS:[A3B0C8] ; kernel32.GetProcAddress
MOV DWORD PTR SS:[EBP-20],EAX
TEST EAX,EAX
JE SHORT 00A263AE
CALL EAX

Thanks for reminding me the forum rules, and thanks to evaluator for putting me in the right direction.
I'm almost a shame that i didn't see this wrong api in the first place!
evaluator
08-14-2003, 06:24 AM
>I didn't downloaded the import table of evaluator

yeah, how you can dld something which not exists:)

that was joke & JMI eats it.
JMI
08-14-2003, 11:41 AM
Hi evaluator:

And a mighty tasty bite it was indeed. :D

Actually I didn't know who had done what or if anything was done. I just wrote "generic comments" for others to read so they would know why the posting of such material would not be permitted. Although we all know that our Musician Friend likes to make jokes, often they "lose something in the (lack of) translation."

A really good project for the Forum would be to review and study a group of evaluator's posts and try to determine if we could identify just which encryption method he is actually using to make them "just barely" understandable to those of us in the English speaking world. This would be of great benefit to all because, although they are often difficult to "decrypt," they usually have very useful information. :D

Regards,
esther
08-14-2003, 12:14 PM
probably Kayaker and JMI both share their bite lol
Kayaker
08-14-2003, 12:41 PM
Name this fish :D
squidge
08-14-2003, 01:19 PM
er, Mr Blank? :)
esther
08-14-2003, 01:28 PM
armafish lol

another name I can think of is fishoff(piss off) lol
Woodmann
08-14-2003, 04:34 PM
BWAHAHAHAHAHAHAHHAHAHAHAHA

Is it a blowfish ?

Oh wait, I know, it's a large mouth ass:eek:
evaluator
08-14-2003, 05:21 PM
something wrong with you, guys!

newbie very seriously works on target & what you do?

fill topic with flame!?

**
I'm strong PPGirl
wbe
08-14-2003, 05:59 PM
A really good project for the Forum would be to review and study a group of evaluator's posts and try to determine if we could identify just which encryption method he is actually using to make them "just barely" understandable to those of us in the English speaking world. This would be of great benefit to all because, although they are often difficult to "decrypt," they usually have very useful information.

heh he... I buy that :p
Kayaker
08-15-2003, 02:49 AM
Originally posted by squidge
er, Mr Blank? :)

He's just shy...

Something weird about this animated gif, it doesn't show well in VBull unless you refresh the image (i.e scroll page up/down). I changed it's properties so it was loopable and as a gif file is handled fine by Opera, just not within the context of an image attachment I guess.

a lot of clown fish around here too I see...:p
squidge
08-15-2003, 03:22 AM
Ah, thanks. I can see it now.


As a matter of question...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > As a matter of question...
PDA

View Full Version : As a matter of question...

Aimless
08-15-2003, 09:40 AM
Does anyone know of a utility that converts Borland .map files into VC++ .map files? I know, I know, I can do it by hand, but just in case there is something out there already for me?

Have Phun


Tutes on HMEMCPY
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Tutes on HMEMCPY
PDA

View Full Version : Tutes on HMEMCPY

cah
08-16-2003, 07:17 AM
I want more tutes on HMEMCPY by OLLYDBG for serial fishing.
Can any have have these tutes or links for download?
Help is appreciated

CaH
esther
08-16-2003, 07:28 AM
Hi,
If ya know how to use point.h,you don't need extra tutes.

hxxxxxxp:biw.rult.at/tuts/ollyguide2.rar
nofurs
08-26-2003, 09:41 PM
Sorry for spamming :p

h**p://biw.rult.at/tuts/Searching.rar

Please give critcics,comments,flames whatever :)
nofurs
08-28-2003, 08:15 AM
Hmm no feedbacks at all? Are newbies becomes advanced?

Com'on flames critcics!
evlncrn8
08-28-2003, 08:26 AM
i dont think hmemcpy is available on win2k/xp/nt, so its a pretty lame method to use, using the general ones like bpx getwindowtexta, bpx lstrlen, etc etc all the ones that could be used for strings etc is a far better approach i think
naides
08-28-2003, 10:19 AM
Originally posted by cluesurf
Hmm no feedbacks at all? Are newbies becomes advanced?

Com'on flames critcics!

How do you dare spending my time in long and content-less tut blah blah blah

You did not even addressed Hmemcpy blah blah blah

you suck blah blah blah

my tut is bigger than yours blah blah blah
and I piss even farther blah blah blah

Consider yourself flamed.
nofurs
08-28-2003, 11:18 AM
Hi evlncrn8,

>i dont think hmemcpy is available on win2k/xp/nt, so its a pretty lame method to use, using the general ones like bpx getwindowtexta, bpx lstrlen, etc etc all the ones that could be used for strings etc is a far better approach i think

You have not read my "guide" thorough.Its about searching strings,I put point.h in my guide cuz searching strings is needed.Point.h is not hmemcpy, its an option that you can use in Ollydbg.

naides:

>How do you dare spending my time in long and content-less tut blah blah blah

Thanks for the time.its a guide not tute ;).Hopefull it will entertained your boring nite ;)

>You did not even addressed Hmemcpy blah blah blah

I have explained above

>my tut is bigger than yours blah blah blah
>and I piss even farther blah blah blah

I have not seen your tute.keep on pissing LOL

>Consider yourself flamed.

LOL I'm glad thanks ;)

Please more feedbacks :)
nofurs
08-29-2003, 01:51 PM
Thank you evlncrn8,naides for sharing their thoughts on my little "guide" even tho only 2 comments :D

Regards to all

:)
evaluator
08-29-2003, 03:34 PM
okei,

I not read your tut at all, but I feel:
it is not useful & not informative for newbies.

enjoe
nofurs
08-30-2003, 07:23 AM
You are not an Olly user so it's not informative to you :)
Ricardo Narvaja
08-30-2003, 09:41 AM
POINT H is a good form to enter in programs quickly in OLLYDBG and is very similar to HMEMCPY for this reason the name, stops in 90 per cent of cases, and is quickly and fast, if you have your POINT H of your machine, only typing
BP {VALUE OF POINT H}
you stops in the point of entering the dates in memory and you can with a BPM follow the operations of the program.
In many programs stops if you put before type the fake serial, in the moment you press a letter and stop when is entered too, is a good help, and is very quick.

Ricardo Narvaja
evaluator
08-30-2003, 10:50 AM
seems my joke failed..

i sad: "i not read your tut.."
Ricardo Narvaja
08-30-2003, 11:29 AM
I don't understand your jokes i speak spanish and not english only try to write a little very bad.I think you make jokes with words, but i not understand well english to laugh jeje, now in spanish i make very good jokes.
If you make my tut for point H in my FTP is in english (not translated for me jeje) for download

ftp://curso:curso@ricnar456.no-ip.org/

user:curso
pass:curso

carpeta NUEVO CURSO-TEORIAS

But all my tuts are en spanish (only 3 or 4 are translated)
and are for OLLYDBG (all 124 tuts) and you use softice maybe you are not interested, well i send the FTP equal for anybody.

Ricardo Narvaja
hobferret
08-30-2003, 03:35 PM
Hi Ricardo Narvaja

Do not take any notice of evals jokes - yo no entiendo las bromas tambien y soy ingles

Just keep up your good work amigo mio you deserve better;)

/hobferret
Bengaly
08-30-2003, 07:32 PM
"I not read your tut at all, but I feel: "
LOL @ Eval, u crack me up with ur english :D
esther
08-30-2003, 10:54 PM
Hi cluesurf,

I have read your tute,overall its a real nice guide for newbies using Ollydbg.I have not seen any tute that discuss about searching strings using Olldbg :) .Write more tutes you have time :p

hobferret:

>Just keep up your good work amigo mio you deserve better

All authors who write tutorials deserve credits

evaluator:

I think you should stop your sacarstic remarks since you are not even a Ollydbg user is not funny at all :rolleyes:
evaluator
09-01-2003, 10:58 AM
hey-hey!

cluesurf wrote:
>Please give critcics,comments,flames whatever

so i mastered little joke. that is.
strange, why it is hard to understand.

seems only Bengaly can understand it?

cluesurf!
Big Please! Piont me, where fail my inglese?

esther! Don't call my jokes sacarstic, or..or..or..
dELTA
09-01-2003, 12:02 PM
strange, why it is hard to understand
No, not really. ;)

Piont me, where fail my inglese?
Right about... everywhere? ;)

Eval, as mentioned earlier, sarcastic jokes are often inflammatory enough in the first place, often highly dependent on exact wording and such. If they are written in eval-encrypted English it is practically guaranteed that 90% of the people reading them will misunderstand them in at least one way, believe me. ;) So please, for the sake of the board atmosphere, drop the irony/sarcasm (possibly except for when it is directed to members who know you really well), no matter your original intentions, ok?

dELTA
esther
09-01-2003, 12:34 PM
Evaluator:

>esther! Don't call my jokes sacarstic, or..or..or..

I don't understand your joke but you inglish is funny as ever with sarcasm lol.

Like delta said improve your inglish or get "flame" by me lol.
hobferret
09-01-2003, 02:47 PM
Hi everyone:)

Let's all stop taking the p**s and get down to what this board is all about reversing :mad:

Eval and esther take note of what dELTA says or you may end up in big trouble!

/hobferret

Out of the darkness cometh light;)
dELTA
09-01-2003, 03:06 PM
Thanks for the support hobferret (esther was actually agreeing with me though). :)

But you are otherwise correct, it is non-reversing related discussions like this that can be very easily avoided if everyone just respects each other (and takes it easy with any sarcastic "jokes" that can be easily misunderstood), that's all I ask. Let's stop discussing this now, and get some real work done instead, like e.g. some serious driver reversing (http://www.woodmann.net/forum/showthread.php?s=&threadid=4986) to make sure that the protectors aren't having too much fun without us. :)

dELTA
nofurs
09-02-2003, 10:34 AM
Hi everyone,

Searching strings is important for beginers,newbies otherwise

Woodmann won't emphazie on that :-)

Thanks for all comments :-)

over and out :P
esther
09-02-2003, 10:48 AM
>Eval and esther take note of what dELTA says or you may end up in big trouble!

We like BIG TROUBLE :p

cu :)
Woodmann
09-02-2003, 07:03 PM
Errrrrrrrrrrr..............

I think it is funny watching Eval and est trying
to make jokes in broken English:eek:

I think this thread is pretty much
played out.

Woodmann


starforce3 and ntice under 2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > starforce3 and ntice under 2k
PDA

View Full Version : starforce3 and ntice under 2k

pasha
08-16-2003, 06:48 PM
greetz all

well, sometime back i was trying to get ntice working with sd2 and thanks to the constant egging of people here (sintax, yates, manko, nikola etc) i finally managed to get it done :)

well now i was trying to look at a new target namely *starforce 3*. i had heard of its powerful anti-debugging code, but didnt belive it until i saw it. i have been trying sometime to try and trace starforce code with ntice under 2k but to no avail :(

seems like sf3 replaces int1/int3 using its drivers. so if i load the sf3 game after loading ntice **boom** reboot. now i tried another approach of loading ntice after reaching oep, then i got into ntice, replaed int1/int3 vectors and when i quit ntice...**boom** hang again. third approach was i got into ntice after oep, replace int1/int3, but now since i was in different process context, it was responding to F8 (trace), but when i switch bak to my target process using ADDR comand, and try F8 (boom reboot) even when the idt entries are still pointing to ntice int1/int3 handlers. its very wierd and hence i thought i would ask for some opinion.

would be glad to receive any response.

best regards
pasha
LaBBa
08-16-2003, 06:55 PM
i was looking a target of StarForce 3 .. can u tell me what target u are working on ? maybe i could help a lil ..
pasha
08-16-2003, 07:02 PM
greetz labba

was workin on cycling manager 3.

best regards
pasha
pasha
08-16-2003, 09:05 PM
greetz all

hmmm, found out the culprit i think. sf3 has some system thread running which keeps restoring the idt values back. hmmmm. time to find out what and where this thread is :D

best regards
pasha
pasha
08-20-2003, 06:11 PM
greetz all

a week of work, but all in vain :(. i am still unable to get sf3 working with ntice.

has anyone gotten sf3 to work with softice under 9x or 2k/xp at all ? or is it virtually imposssible to get softice and starforce3 running together ? :((

best regards
pasha
nikolatesla20
08-20-2003, 06:42 PM
SO they are using this to their advantage, blue screening your computer by having a driver crash.

What about the actual Starforce driver code? They must have a sys driver of some sort. Is the code encrypted? Hard to believe it would be if it's a sys driver. Very dangerous to do such a thing.

So in other words, they have to be calling into the system somehow. If you can find the sys file you could probably try editing it so it doesn't even try that IAT stuff at all.
(if you edit the sys, make sure to use LordPE and recalc the checksum) But you know this already, having worked with sd2.

Oh, and also, is it possible to debug using OllyDbg?

-nt20
pasha
08-20-2003, 10:56 PM
greezt nikola

i have tried with sf3 under 9x and 2k/xp. but in both sytems its really tough to get sice working with sf3. under 9x, there is not a problem as in 2k (replacing int3 causing system crash), but then under 9x, they somehow detect my sice, dunno how and display msg. and yes, i ahve trired icedump, no good :D.

lemme describe scenario under 2k (since i have tried every shit possible in that environment). am working now to try under 9x.

1) starforce uses drivers, yes, prohlp02.sys, prosync.sys. the driver code is encrypted. yes. they have a decrypting routine which decrypts the code as and when its executed. plus, they have loads of rdtsc to track single stepping.i found bout 200 of them for a single procedure :(. its crazy to be noping all rdtsc.

2) i tried ollydbg too. i stalled the target at oep (after sf3 has done its job of deteciting cd etc). then launched ollydbg and attached to active process. but when i hit F7/F8. bang. exception and eip points to some area in invalid region :(. guess their int1/int3 handler is global. u cant run *ANY* debugger when u have sf3.

well, i know one thing for sure. if some one can get sice working with sf3, then he can get it working with *ANY* protection there can ever be. i have never seen such a superb anti-debugging so far. hats off to the russians.

well, am trying now under 9x, since it doesnt haev that stupid int3 problem as under 2k/xp. i somehow must get sf3 not to detect sice. if someone has any suggestions, i am all ears :). if everyone can throw in the detection shcemes possible under 9x :). coz icedump really doesnt hide all as is evident from starforce3 detecting sice :)

thanks

best regards
pasha
doug
08-21-2003, 01:07 PM
Hats off.. maybe..
But I really don't think s-f should be considered a good protection solution.. especially when they start using undocumented tricks.

Example: (last game I checked in ~ feb 2003)
s-f script was decrypted in the protect.dll, when calls to some API functions were performed, you could see a:
mov eax,##
INT 2E
getting executed..

Now, it may be perfectly working, but on every update to your Windows nt/2k/xp machine, there is a risk that the protection stops working.. Big deal they are quick to update star-force? The game makers still have to issue a patch, which may or may not happen depending on the game. In the long run, you won't be able to play your own games like you want.

Another issue that I find annoying is the general widespread of system drivers in new protections. Star-force has 3+ sitting in your system dirs, safedisc 1, tages 2.. not the count every exe protector around.. I really think this will cause problem where drivers start competing against each others for access on low-level system resources (idt for instance).

/rant>

Back to debugging star-force, if you want insights on how it works, I suggest you get an older target (something using prodrv04), and debug the fu** out of it w/ softice.

Besides a) changing your debugging strategy
or b) reimplementing the driver without the evil-checks (that might be a while considering the amount of code that gets decrypted into memory buffers)
I don't see what you can do.
nikolatesla20
08-21-2003, 02:30 PM
So, are the sys drivers decrypted BEFORE they get loaded, or do they decrypt themselves once loaded into mem? (Self- decrypting native system ring 0 code, hmm that would be extremely dangerous !!)

Perhaps , since they have to call the system drivers in some fashion, (DeviceIOControl, for example), you could create your own driver which emulates the correct return codes...

-niko
dELTA
08-21-2003, 03:51 PM
I don't see why self-modifying code would be so much harder or more dangerous to implement in ring 0 that in ring 3? Sure, if there is a bug in the decryption code you are likely to shoot down the operating system rather than a single process, but as long as the decryption code is not buggy I cannot see any problem? And it shouldn't be _that_ hard to write a non-buggy decryption routine, right? Please explain further nikola.

dELTA
doug
08-21-2003, 04:21 PM
iirc,
there is a "decrypt_code" function that is used when the authentification start, like a devio request saying "i'll start verification".. which then starts up decryption process, etc... when verification is over, the code probably gets encrypted back (or freed from memory, as I think they are now simply decrypting it in a buffer)

it is an interesting target to analyze, you should check it out, there are plenty of game patches around from which u can extract almost everything u need.

@delta:
I don't think self modification code is dangerous in drivers, but I do think crypted/decrypted code can be if not used correctly, mostly because the environment is multi-threaded. Since you never know when your threads will get cpu-time, the encryption/decryption mechanism could be stopped in the middle of it's execution while another thread that makes usage of the decrypted code starts to run.. you get to execute through half-decrypted code.. blue-screen.

However, I'm quite sure they have implemented a locking mechanism that prevents that.
dELTA
08-22-2003, 07:08 PM
Yep, that's what I meant, it wouldn't really be too hard to do.

dELTA
pasha
08-22-2003, 11:41 PM
greetz gang

hmm, i just found yet another way to detect sice under 9x. well without sice, idt entry 41h dpl is 0 (0x8E), whereas with sice it becomes (0xEE).

the wierd part now is, if i set the dpl back to 0, under 9x, it causes a fault :(. but under 2k/xp this worx ok if i set dpl=0. this is crazy !!!

any idea, why it should fault on making int41 dpl=0 ? well it dies somewhere inside VMM

best regards
pasha
sope
08-23-2003, 01:17 AM
Hello pasha,

Well, somedays back i was reading about seh & all handling related stuffs. I did come across a very nice thread about 0x8E & 0xEE. Hope this thread (http://www.woodmann.net/forum/showthread.php?s=&threadid=3876&perpage=15&highlight=seh&pagenumber=3) helps understanding things much better about 0x8E & 0xEE .

Regards, sope.
pasha
08-23-2003, 01:36 AM
greetz sope

thanks for the link. patching int1 dpl from 3 (0xEE) to 0 (0x8E) does not pose any problems. system remains stable.

but its only that if i patch int 41h from dpl 3 to dpl 0, the system crashes. also this is the case only under 9x, coz under 2k/xp this patch is stable.

best regards
pasha
SiNTAX
08-24-2003, 05:50 PM
Originally posted by doug

Another issue that I find annoying is the general widespread of system drivers in new protections. Star-force has 3+ sitting in your system dirs, safedisc 1, tages 2.. not the count every exe protector around.. I really think this will cause problem where drivers start competing against each others for access on low-level system resources (idt for instance).

Euhm well this is understandable, no? Without some ring-0 code, it would be too easy to defeat the protections.

I see a bigger problem with them tho.. some of these drivers give a user way too much access to the system (e.g. safedisc allowing you to grab pieces of protected memory).. I wonder how hard it would be to abuse these drivers to raise your priviledge on the machine!

But then.. windows security is already a joke, so I guess this is mood..
doug
08-26-2003, 02:58 PM
I just mentionned that in the long run, this is worth nothing.. crackers will just start developping their own drivers too..
-> more buggy protection drivers -> more blue screens

But just to show i'm not bullshitting:

quoted from the changelog of a s-f game:

File: wwii_fix_2ksp4.exe
Date: 21.August.2003

This file contains a program to fix a conflict between the copy
protection system used by World War II : Frontline Command and
systems running Windows 2000.

The issue only occurs with Windows 2000 systems which have been
upgraded to Service Pack 4.

--
you find that's normal and acceptable?
evaluator
08-27-2003, 03:21 PM
hello, nikolatesla20.

dld this attachment & enjoe learning R0 loading technique;)


To admins
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > To admins
PDA

View Full Version : To admins

Dedec0
08-17-2003, 05:29 AM
Admins:

I think at least one of the folowing bugs with the board could be fixed:
- when the link on the thread's page I am doesn't have an active section ID, and I "Save Link Doc" I don't receive any waring about having to be logged for being able to download. The docs I received isn't plain text either, like it happens with 404 errors, or when the link trigger a simple any web page. I can upoad you one, if you think relevance in it. OTOH, when simply click on the link, I receive a NewWindowPage that logs me (if needed) and works correctly (though I would prefer it would never open new windows)
- I always receive, when clicking/DLing atts from the board, a "attachment.php" as the document's name, instead of the correct one.
- may the atts become DLable even for ppl unlogged?

Regards,

Dedec0
ZaiRoN
08-17-2003, 06:47 AM
when simply click on the link, I receive a NewWindowPage that logs me (if needed) and works correctly (though I would prefer it would never open new windows)Personally, I like the NewWindowPage. Btw, which browser are you using? Opera lets you to open the new link in the same page.

- I always receive, when clicking/DLing atts from the board, a "attachment.php" as the document's name, instead of the correct one.Hmmm, that is an old problem and it should be solved. Is there someone else with this problem?

ZaiRoN
Dedec0
08-17-2003, 07:09 AM
I am using Opera 5... I don't KNOW how to open a link wich defaults to open in new windows in the same window ! :\ ('<a target="_blank"...')

I know the opposite only (both in IE and Opera): to open links on new windows you shift+click on them || right click for the menu.
ZaiRoN
08-17-2003, 12:58 PM
Right click on the link and then click on "Open link" (at least on Opera 6...)
Dedec0
08-18-2003, 04:43 AM
Bizarre... 80

This is the same with Opera 5, but I never found out. If you asked, I would say that it is the same as a single click.

BTW, how did you discovered? I have read Opera's help (both 5's and 6's) mostly, but that didn't shine.

Regards,

Dedec0


PEiD 0.9 available
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PEiD 0.9 available
PDA

View Full Version : PEiD 0.9 available

bedrock
08-17-2003, 11:22 AM
Anyone who's already been over to exetools site will have seen this already, but for those that haven't PEiD 0.9 is now available

h**p://www.mesa-sys.com/~snaker/peid

--
bedrock
OHPen
08-18-2003, 06:29 PM
The new KANAL-Plugin in Peid is quite excellent.

It identfies many Crypto-Signatures.

THX to Snaker & Co ;)

You created the best Identifiying-Tool.
profesorx
08-25-2003, 04:20 PM
i hope Peid Nalizer stay here for much time.


ASPR \ ASprotect 1.23 Tut !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR \ ASprotect 1.23 Tut !
PDA

View Full Version : ASPR \ ASprotect 1.23 Tut !

LaBBa
08-18-2003, 03:49 AM
Hi all !!

as i told u all .. when i will fix my tut about the new ASPR i will publish it .. well here we go ... i found what was wrong with
my unpacked file why it crashed ..

so Read the "Read Me First " and then enjoy another
"Step-By-Step" tut about ASPR :D
evaluator
08-18-2003, 08:05 AM
LaBBa,

sorry, but this tutor shows:
1. yet you know very little about PE-structure.(it is not so hard)
2. you not read our disscussions about Asspr.

also I can step by step explane, why is your tut not informative..

but, can you explane: why so hard you want to write tutor?

***
"Tutor or Stupor - this is the Qvaschion!"
W. LaBBa. Shakespeare
LaBBa
08-18-2003, 09:23 AM
Well i'm sorry about my Lame Ass Tut ...
but to be True .. i'm the only one that did somthing so other ppl could lern .. so u can't tell me that it's not good enough .. because no one else done anything like so ..
If u don't like it Don't use it ..
If u know better teach us including me ..
i konw that i'm still lame in the hole PE thing ..
but i do my best to share all i know with others by
Writing tuts..

Well i just share what i have lern about unpacking this app

if more ppl like evaluator want to respond about this tut and
to add or Reject some things about it plz do ! so we all could lern

evaluator : tnx for beeing honest and comment about my knolage about PE file .. i hope to make it better when i will have time ..
LaBBa
08-18-2003, 02:15 PM
hmm.. BTW ..

"2. you not read our disscussions about Asspr. "

witch one ? i try to read all i can about Unpacking not only aspr
it u can show me exacly what u mean .. i think i have missed somthing..
Shoob
08-18-2003, 03:41 PM
I think this tut is good for nothing anyway this thread is maybe meant where all is complained in details. After all nothing great changed between 1.2 as evaluator said.. I remember they were also some (maybe) deleted posts where this new bla gets discussed. Use search button.. At least make it looked like im not just a flame asshole i will give you some tips to future tuts. Btw i see you are half knewn on unpacking asprotect. If its true dont put your fingers on a tut please (e.g "so it could be or LockResource or FreeResource").

1.) Write about New Techniqs (Dont compress other informations)

2.) Use Pictures (almost important to higher the Understanding for novice's)

3.) Use sometimes other type styles e.g Bold, Cursiv.

4.) Use paragraphs, Stood offs

5.) Update your tut thread, dont make new

http://www.woodmann.net/forum/showthread.php?threadid=4936
dELTA
08-18-2003, 04:53 PM
Ok, some people around here really need to tone down the arrogant and condescending comments and flames right now! :mad:

If someone writes a tut, it is completely ok to give constructive criticism about it, but for christ sakes will everyone drop the "I'm a leeto and you suck" attitude (irrespective of throwing in a few constructive details at the end of the post or not)!?!

Anyone who wants is more than welcome to write a tutorial and post it for others to read. There's always someone who will gain knowledge from it, even though there might already exist more advanced tutorials about it somewhere (if the tutorial writer greatly exaggerates his knowledge and skills about the topic, a scolding might of course be suitable, but that's another story and mostly not the case). When writing such a tutorial, the author should indeed be prepared for constructive criticism, and handle such gracefully (just like LaBBa does in this case) without starting any flamewars , but no one has the right to disrespect the tutorial writer just because they think they already know everything that's in the tutorial, and that they are better and more l33t!

Even though some of you might not mean any harm (yes, I'm talking to you eval), this kind of behavior still produces an overall bad atmosphere on the board, and it discourages people from contributing with their knowledge because they are afraid that some self-proclaimed leeto will flame them.

So if you'd like more threads where things are "explained in detail" rather than "complained in details" (and also fancy keeping your board accounts for that sake), stop this kind of behavior immediately, it will not be tolerated! :mad:

dELTA
esther
08-18-2003, 11:27 PM
Hi LaBBa,

The only thing I would like to coment is brushup your english
keep up the good work :cool:

>I think this tut is good for nothing anyway this thread is maybe meant where all is complained in details

You should write a tutorial and shared your knowlege :rolleyes:
LaBBa
08-19-2003, 08:13 AM
Well just wanted to repond on all the reponds ..

1) i will never Write a tut with pictures !! i hate it .. i like plain txt

2) i know that my english is need of impovment..(nothing i can Do)

3) i'm know that many Exprianced Crackers/Unpackers realy don't
like "Step-By-Step" tuts .. but for some ppl it does needed

4) i just hope that more ppl will wirte a Step-by-step tuts so not
only an expriance Cracker/Unpacker could lern but also a
newbie could lern .. (like the ArmaDillo Tuts...)

well i gess its time to move on a lil .. so i will start working on
somthing else but ASPR .. done that for a long time now.. but i will now will look for another nice Packer/Encrypter to lern and yes to explain about..

Any REQ ? :D
evaluator
08-19-2003, 04:15 PM
LaBBa,
I disagree with you.
You not collected enough knowledge about asspr & now want jump
to another protector.

I want recommend you to collect more general knowledge about PE,
then re-arrange & update your approach about asspr..

..you decide..

PS.
I uploaded for you unpacked EXE,
but you nothing tell me..
LaBBa
08-19-2003, 07:35 PM
well i didn't say i was going to leave and not lern or keep updated with new aspr versions i just say that no more need of aspr tut for now and i will now try to do the same for some other Packer..

Btw.. i didn't needed that Unpacked file u gave me because if u have read my tut (the not full) u would have just told me that i dumped the file at the wrong place ... the new tut is just fixing that .. but tnx anyway..
evaluator
08-20-2003, 07:02 AM
yop, my fault..

Ok, for you I remember some clue asspr target, which more interesting
uses asspr futures.
Find "ArtIcons Pro" latest build & write tut about.
However, asspr version here is not latest, but anyway.
LaBBa
08-20-2003, 08:30 PM
well i downloaded the latest version but didn't had much time to look at ...

The Stolen bytes are not beeing eares ... (don't know why)
the Dump is crashing becuase of a call checking of ASPR

hope to have more time and find out more about it..
Manko
08-21-2003, 01:51 AM
Hi!

As eval said, this is an earlier version of aspr.
At that time, he didn't use to erase stolen bytes. :)

/Manko
evaluator
08-21-2003, 03:04 AM
also I did search for asspred & found interesting one:
"G-Lock EasyMail Professional".

this have kiddie asspr.dll with error reporting to Email.

bugs@aspack.com
168.144.78.112
From: some@user.com
To: support@aspack.com
BCC: vitaliy@aspack.com
Subject: Application error
Sender: some@user.com

I can't say how newest is this, but quite new is.
britedream
08-21-2003, 07:16 AM
Thanks, its very nice software you came up with, but as far as
unpacking,it it is exactly the same as systemcleaner.

britedream
koderz
08-21-2003, 07:03 PM
Hi all, im new to the forums :) Ok well, due to an update I tried applying the same techniques to the new version [Target deleted]. Everything works as planned except I am confused on what to do with the stolen bytes on this update. Heres a look at what the new version looks like:

0057825B 0000 ADD BYTE PTR DS:[EAX],AL
0057825D E6 54 OUT 54,AL ; I/O command
0057825F 0074F7 54 ADD BYTE PTR DS:[EDI+ESI*8+54],DH
00578263 0044F7 54 ADD BYTE PTR DS:[EDI+ESI*8+54],AL
00578267 006450 53 ADD BYTE PTR DS:[EAX+EDX*2+53],AH
0057826B 003450 ADD BYTE PTR DS:[EAX+EDX*2],DH
0057826E 53 PUSH EBX
0057826F 009C3A 53006C3A ADD BYTE PTR DS:[EDX+EDI+3A6C0053],BL
00578276 53 PUSH EBX
00578277 0018 ADD BYTE PTR DS:[EAX],BL
00578279 3A53 00 CMP DL,BYTE PTR DS:[EBX]
0057827C E8 395300FC CALL FC57D5BA
00578281 6C INS BYTE PTR ES:[EDI],DX ; I/O command
00578282 57 PUSH EDI
00578283 00A0 6C5700C0 ADD BYTE PTR DS:[EAX+C000576C],AH
00578289 6F OUTS DX,DWORD PTR ES:[EDI] ; I/O command
0057828A 57 PUSH EDI
0057828B 0090 6F570054 ADD BYTE PTR DS:[EAX+5400576F],DL
00578291 74 57 JE SHORT xxx.005782EA
00578293 002474 ADD BYTE PTR SS:[ESP+ESI*2],AH
00578296 57 PUSH EDI
00578297 0000 ADD BYTE PTR DS:[EAX],AL
00578299 0000 ADD BYTE PTR DS:[EAX],AL
0057829B 0010 ADD BYTE PTR DS:[EAX],DL
0057829D 7B 57 JPO SHORT xxx.005782F6
0057829F 0000 ADD BYTE PTR DS:[EAX],AL
005782A1 0000 ADD BYTE PTR DS:[EAX],AL
005782A3 0000 ADD BYTE PTR DS:[EAX],AL
005782A5 0000 ADD BYTE PTR DS:[EAX],AL
005782A7 0000 ADD BYTE PTR DS:[EAX],AL
005782A9 0000 ADD BYTE PTR DS:[EAX],AL
005782AB E8 ACF1E8FF CALL xxx.0040745C
005782B0 FF15 3C385800 CALL DWORD PTR DS:[58383C] ; xxx.00577498
005782B6 E8 09CBE8FF CALL xxx.00404DC4
005782BB 90 NOP

I am not exactly sure where to start counting the bytes and where to end? Any clarification on this would be great. Btw, I broke on 005782B0 when i came into this section.

Thanks
LaBBa
08-21-2003, 07:44 PM
hi

well i saw u'r Q and i will try to answer as well as i can ..

if u used my way of finding the OEP then after u done
TC EIP<900000

u should be here :

00407398 -FF25 40A35800 JMP DWORD PTR DS:[58A340]
0040739E 8BC0 MOV EAX,EAX

then trace one time with F8 u will get back to packer code :

01031C64 55 PUSH EBP
01031C65 8BEC MOV EBP,ESP
01031C67 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
01031C6A 85C0 TEST EAX,EAX
01031C6C 75 13 JNZ SHORT 01031C81
01031C6E 813D A47A0301 00>CMP DWORD PTR DS:[1037AA4],400000 ; ASCII "MZP"

well set again the trace command (alt+f1) and when Olly will Break u should be here :

0040746D A3 68565800 MOV DWORD PTR DS:[585668],EAX ; 00400000
00407472 A1 68565800 MOV EAX,DWORD PTR DS:[585668]
00407477 A3 D8905700 MOV DWORD PTR DS:[5790D8],EAX
0040747C 33C0 XOR EAX,EAX
0040747E A3 DC905700 MOV DWORD PTR DS:[5790DC],EAX
00407483 33C0 XOR EAX,EAX
00407485 A3 E0905700 MOV DWORD PTR DS:[5790E0],EAX
0040748A E8 C1FFFFFF CALL 00407450
0040748F BA D4905700 MOV EDX,005790D4
00407494 8BC3 MOV EAX,EBX
00407496 E8 61D7FFFF CALL 00404BFC
0040749B 5B POP EBX
0040749C C3 RETN

here u should make the Dump of the Process..

continue trace till u will be at :
00407494 8BC3 MOV EAX,EBX

this value u will need for the Stolen Bytes for EAX value
in this case : EAX = 00577B38

if u will trace (with 8) after the RET u should be here :

005782B0 FF15 3C385800 CALL DWORD PTR DS:[58383C] ; 00577ACC
005782B6 E8 09CBE8FF CALL 00404DC4
005782BB 90 NOP

now scroll up a lil and u will see all of this :

0057829D 7B 57 JPO SHORT 005782F6
0057829F 0000 ADD BYTE PTR DS:[EAX],AL
005782A1 0000 ADD BYTE PTR DS:[EAX],AL
005782A3 0000 ADD BYTE PTR DS:[EAX],AL
005782A5 0000 ADD BYTE PTR DS:[EAX],AL
005782A7 0000 ADD BYTE PTR DS:[EAX],AL
005782A9 0000 ADD BYTE PTR DS:[EAX],AL
005782AB E8 ACF1E8FF CALL 0040745C
005782B0 FF15 3C385800 CALL DWORD PTR DS:[58383C] ; 00577ACC
005782B6 E8 09CBE8FF CALL 00404DC4
005782BB 90 NOP

Well.. all of this :
0057829F 0000 ADD BYTE PTR DS:[EAX],AL
005782A1 0000 ADD BYTE PTR DS:[EAX],AL
005782A3 0000 ADD BYTE PTR DS:[EAX],AL
005782A5 0000 ADD BYTE PTR DS:[EAX],AL
005782A7 0000 ADD BYTE PTR DS:[EAX],AL
005782A9 0000 ADD BYTE PTR DS:[EAX],AL

is the stolen byte From address : 005782A0
this means that u have 11 stolen bytes :

PUSH EBP
MOV ESP,EBP
ADD ESP, -010
MOV EAX , 00577B38

that is in byte :
55,8B,EC,83,C4,F0,B8,38,7B,57,00

Write those over all of those "00" with an HexEditor
then fix the OEP to : 1782A0 with Pe-Editor
(thats because 5782A0-ImageBase =5782A0-400000 )

Fix the IAT with ImpRec and thats all .. it will work just fine..
well.. it does for me ..

Regards , LaBBa.

(PS - i just Share what i know.. nothing more nothing less)
Computer_Angel
08-22-2003, 02:18 AM
I try to unpack the [Target deleted]
after trace using your technique i land here

00577DA8 74715700 DD 00577174
00577DAC 0000 ADD BYTE PTR DS:[EAX],AL
00577DAE 0000 ADD BYTE PTR DS:[EAX],AL
00577DB0 24 76 AND AL,76
00577DB2 57 PUSH EDI
00577DB3 0000 ADD BYTE PTR DS:[EAX],AL
00577DB5 0000 ADD BYTE PTR DS:[EAX],AL
00577DB7 0000 ADD BYTE PTR DS:[EAX],AL
00577DB9 0000 ADD BYTE PTR DS:[EAX],AL
00577DBB 0000 ADD BYTE PTR DS:[EAX],AL
00577DBD 0000 ADD BYTE PTR DS:[EAX],AL
00577DBF E8 98F6E8FF CALL 0040745C
00577DC4 FF15 3C285800 CALL DWORD PTR DS:[58283C] ; 005771E8
00577DCA E8 F5CFE8FF CALL 00404DC4
00577DCF 90 NOP
00577DD0 00 DB 00
00577DD1 00 DB 00
00577DD2 00 DB 00
00577DD3 00 DB 00
00577DD4 00 DB 00
00577DD5 00 DB 00
00577DD6 00 DB 00
00577DD7 00 DB 00
00577DD8 00 DB 00
00577DD9 00 DB 00
00577DDA 00 DB 00

I figure out the oep is 577DB4 (the stolen byte for EAX is 57764C)
so I use the hview to edit the unpack file:
Push ebp
mov ebp,esp
add esp,-10
mov eax,0057764c

and use the pe editor to change my current oep of dumped file to 577db4-400000=177db4
(I allready fix the unpack file using Imprec).
Now I run the unpack file, it run and nothing happen :-D
Can you tell me why it not succcessfull
LaBBa
08-22-2003, 04:55 AM
Well if u Dumped the file where u should (look real good where u should Dump the file) and fix like u said ... u probobly have fixed not fully the IAT ... i know that because that have happend to me
so look closer at the IAT u might have Cut 1 more wrong thunk or somthing like that..

i will attach the IAT file tree of ImpRec of the last version on thire app : 4.92c

NO MORE IAT!!!
esther
08-22-2003, 05:53 AM
how many times got ppl to tell you no full iats can be upload here!!!!!!
LaBBa
08-22-2003, 09:17 AM
Sorry forgoted..
camcorder
09-29-2003, 08:21 AM
First of all thanks for such a tutorial, it's really one of the best recent tutorials i ever seen. However it lacks in some cases. First of all, it does not include *full* version of aspr 1.23 .. is it demo ? registered ? rc ? beta... I swear i even saw beta 31 of that lame aspr. Secondly, it's not generic. Even though I use the same tools as you do, i didn't get same jump points you got. For example :

After that trace 'tc eip<900000' thing, I'm on :
004065D1 . A3 68E65A00 MOV DWORD PTR DS:[5AE668],EAX

i trace w/ f8 and on
004065F8 . 8BC3 MOV EAX,EBX
i got the dump w/ lordpe .. i even tried OllyDump .. but same things happened.
and I keep tracing .. on
00406600 . C3 RETN
i press f8 last time and i'm on :
0059BC11 ? A1 DCD45A00 MOV EAX,DWORD PTR DS:[5AD4DC]
, however u said in your tut that i should have landed on :
00564BEC FF15 A4D15600 CALL DWORD PTR DS:[56D1A4]

or something like that .. but it's definitely not a call. Besided, when i look 'lil upward' all i can see it some db blah , db blah ... lines.. despite my usin analyse option.

And the tool i'm looking for is also packed w/ aspr 1.23 demo ..

Some other thing. I didn't care that jump after ret, and keep getting IAT ... your fixing iat explaination is really vague.. even though i fix all the iats and the list said 'valid' i couldn't make it run. Windows gave "Send error" messages. Can u plz explain how did u fix those unresolved entries ? i did write something in tut, but how do you trace ? where do you tace ? how did u know those apis are the ones we need ? i think they need better explanation.

But whatever it is, it's a great step , and really thanks for that contribution. I'll be waiting for your answer on list.
Billy[23]
09-29-2003, 07:46 PM
I also have a question for you LaBBa, its a great tutorial iam just wondering about this part:

(BTW iam using [a different version]) <-- No idea if i can put real name :)

i get to:

004075D1 |. A3 68665800 MOV DWORD PTR DS:[586668],EAX ; XXX.00400000
004075D6 |. A1 68665800 MOV EAX,DWORD PTR DS:[586668]
004075DB |. A3 D8A05700 MOV DWORD PTR DS:[57A0D8],EAX
004075E0 |. 33C0 XOR EAX,EAX
004075E2 |. A3 DCA05700 MOV DWORD PTR DS:[57A0DC],EAX
004075E7 |. 33C0 XOR EAX,EAX
004075E9 |. A3 E0A05700 MOV DWORD PTR DS:[57A0E0],EAX
004075EE |. E8 C1FFFFFF CALL XXX.004075B4
004075F3 |. BA D4A05700 MOV EDX,XXX.0057A0D4
004075F8 |. 8BC3 MOV EAX,EBX
004075FA |. E8 61D7FFFF CALL XXX.00404D60
004075FF |. 5B POP EBX
00407600 \. C3 RETN

Now you say F8 over it, and F8 onto the Return and i should see

CALL
CALL DWORD PTR DS:[X]
CALL
NOP

actually i See

00579D10 . E8 ABD8E8FF CALL XXX.004075C0
00579D15 . 33C0 XOR EAX,EAX ;EIP Here
00579D17 . 55 PUSH EBP
00579D18 . 68 769D5700 PUSH XXX.00579D76

Any Ideas mate(s) ?
Billy[23]
09-30-2003, 11:08 AM
Nevermind that last post, ill leave it as a refernce just incase somebody has the same problem, its fine because i downloaded the v4.91d and it just the same so continue with the tut :) now i work on fixing the IAT.

You Say, Start IMpREC and choose the Process, now at this time should we be still PAUSED in olly or should it be a active process ?

Also u mention to click on IAT AutoSearch, and then change RVA to 1000, i did this and iam left with 2 Thunks

One of 46 Dec, and 1 of 3 Dec, oviously this isn't correct, because they are all pointing to CreatFileA, and SetPointer when i Disam them, any ideas ?

Thnx as Always

-Billy
LaBBa
09-30-2003, 12:55 PM
hi all i'm happy that u are doing this target of ASPR .. but if i will answer u
u will never lern :( ...

so plz do try it more and more like i did.. i didn't had it easy too.. but i continued till i made it...

about the last tut i made.. just 1 thing that billy said ...

after we dumped the file and got the OEP we need to EXIT the app and Olly
now run the app normaly and let it load and then open ImpRec and fix the rest

i'm not going to do ASPR till it will have more new featurs ..

i think that all that in this board and other tuts and my own tuts have inought info to let u unpack ASPR in 2-3 min .. and i realy do mean it .. its too easy..

best regards , LaBBa.
Shoob
09-30-2003, 06:10 PM
hrm im not going to understand what you are trying to tell us Labba :confused: writing your half-an-tutorial playing the big guy was one thing but keeping no recalls to questions from newbies behind an other. One thing is you are able to unpack it in 2 min but you have no time to help some people on your own tut for 2 min? Thats what making me sick. :(
LaBBa
10-01-2003, 12:48 PM
i'm realy SAD that u realy think that .. but if u will ask those two ppl
( Billy and camcorder ) u would have know that i did help them as i could maybe not on this board.. but in PM or at the mIRC ..

so plz don't rush to conclusions..

i love to help other ppl to lern .. but as u know (if u know) somtimes when u try so hard to crack an app u forget to do the lil things .. and instad of finding the error u have made u go to the easy solotion .. post here a Q and wait for an answer ..

in our case all the answer are already given .. and ppl missed that .. when reading tuts etc.. when i forgoted to add a instraction in the tut and i know it important i did post it..

so plz .. calm down with the : "Make me Seek" thingy and get a lil perspective about this..

if i only could have told u how many ppl asking me the same Q many times at the mIRC and i DO answer all of them as best as i can \ know .. i would be amazed ...

so i hope u wond be so Hard on me the next time.... :)

best regards , LaBBa .
britedream
10-02-2003, 11:15 AM
To Billy
for the code you wrote above ,I will not be able to help u, I don't follow
the tut u refer to, however, I will give u the info I have the [target deleted]running on
as follow:
oep= 579d00
stolen bytes:
push ebp
mov ebp,esp
add esp,-14
xor eax,eax
mov dword ptr ss:[ebp-14],eax
mov eax,00579590

IatRVA=18b230 iatsize~a10
make sure that u correct imporTrec finding at 18b540 to read FreeResource

this is will help u to unpack the prog.
Billy[23]
10-02-2003, 12:18 PM
britedream i finally got it !!! Thanks :) thats what confused me that IAT part, i guess he ment change the Size to 1000, not the RVA, anyways i kept getting crashes then i Read that part bout the Free Resources :) Thank you very much and thanks to all :), now i just gota learn to dump it at windows98 seen as the dump here at xp dont work there :)

Thnx Again.
britedream
10-02-2003, 12:32 PM
The info I gave u is running on xp .
Billy[23]
10-09-2003, 11:09 AM
Just got back from working out of state and tried it , works great i even manged to fiddle with some of the api's and get it working at windows 9x also.

Very many thanks to all especialy britedream for explaining that last part :)
MEPHiST0
11-10-2003, 04:44 AM
I must say..
People you need to rape labba's tute for what it can teach you about aspr.. Labba, i think your tutorial is excellent! keep up the good werk.. ;p
LOUZEW
12-23-2003, 05:06 PM
Hi, LaBBa
I have to say that you've done a good tutorial on this Aspr version, it's really helpfull for some guys.
Used your approch on an other App (target name deleted), some differences but unpacking done !

Please, don't ear sad comment at topof this thread and write again tuts if you like, i'm sure a lot of members like that !

Thank's again LaBBa
klumpi
05-20-2004, 05:27 PM
actually i See

00579D10 . E8 ABD8E8FF CALL XXX.004075C0
00579D15 . 33C0 XOR EAX,EAX ;EIP Here
00579D17 . 55 PUSH EBP
00579D18 . 68 769D5700 PUSH XXX.00579D76

What did i do wrong ?

greetings klumpi
jingjang
05-29-2004, 06:08 AM
00564BE9 . 40 INC EAX
00564BEA ? 56 PUSH ESI
00564BEB . 0000 ADD BYTE PTR DS:[EAX],AL
00564BED . 0000 ADD BYTE PTR DS:[EAX],AL
00564BEF . 00BC44 5600000>ADD BYTE PTR SS:[ESP+EAX*2+56],BH
00564BF6 ? 0000 ADD BYTE PTR DS:[EAX],AL
00564BF8 ? 0000 ADD BYTE PTR DS:[EAX],AL
00564BFA ? 0000 ADD BYTE PTR DS:[EAX],AL
00564BFC ? 0000 ADD BYTE PTR DS:[EAX],AL
00564BFE ? 00E8 ADD AL,CH
00564C00 ? 3827 CMP BYTE PTR DS:[EDI],AH
00564C02 ? EA FFFF15A4 D1>JMP FAR 56D1:A415FFFF ; Far jump

This is where im stuck in ur tutorial..the address are diffrent tho..in your tutorial u said ther real OEP is 00564BDC. how do you get this? im really new at this so can u guide me step by step as ur tutorial does except for this part.

U say say that this part will tell us too..
0040734D ? A3 68E65600 MOV DWORD PTR DS:[56E668],EAX ; .00400000

How does it relate im really confused at this part. :hmm:
%UNDEFINED%
05-29-2004, 07:35 AM
Run the prog SHIFT+F9 through the exceptions, counting them.

When the prog loads, restart it.

Goto the last exception, the one before the prog loads.

Open the memory window,

http://d-jester1.tripod.com/images/image.gif

Select the code section, usually the second section.

Right Click->Set Break on Access

Then press SHIFT+F9

Boom Your at the OEP

Thats how you find the OEP, read LaBBa's tut's for finding the stolen bytes.
klumpi
05-29-2004, 08:41 AM
00564BE9 . 40 INC EAX
00564BEA ? 56 PUSH ESI
00564BEB . 0000 ADD BYTE PTR DS:[EAX],AL
00564BED . 0000 ADD BYTE PTR DS:[EAX],AL
00564BEF . 00BC44 5600000>ADD BYTE PTR SS:[ESP+EAX*2+56],BH
00564BF6 ? 0000 ADD BYTE PTR DS:[EAX],AL
00564BF8 ? 0000 ADD BYTE PTR DS:[EAX],AL
00564BFA ? 0000 ADD BYTE PTR DS:[EAX],AL
00564BFC ? 0000 ADD BYTE PTR DS:[EAX],AL
00564BFE ? 00E8 ADD AL,CH
00564C00 ? 3827 CMP BYTE PTR DS:[EDI],AH
00564C02 ? EA FFFF15A4 D1>JMP FAR 56D1:A415FFFF ; Far jump

the 00 Code above the BP - thats the stolen Bytes (now i understand this)
but attention ! the 00 from 00564BDB is not the OEP

00564BD8 A4 <- from here
00564BD9 44
00564BDA 56
00564BDB 00 -> to here its a Adress from other code
00564BDC 00 <- here is the OEP

Now, you must find the stolen Bytes and paste this in the empty code.

greetz Klumpi
jingjang
05-29-2004, 09:58 AM
Run the prog SHIFT+F9 through the exceptions, counting them.

Then press SHIFT+F9

Boom Your at the OEP

Thats how you find the OEP, read LaBBa's tut's for finding the stolen bytes.

I tried as u said...then Boom i was here :

77F8E110 . 66:393E CMP WORD PTR DS:[ESI],DI
77F8E113 . 0F84 D2020000 JE ntdll.77F8E3EB
77F8E119 . EB 12 JMP SHORT ntdll.77F8E12D
77F8E11B > E8 D8B8FCFF CALL ntdll.RtlAcquirePebLock
77F8E120 . C645 E7 01 MOV BYTE PTR SS:[EBP-19],1
77F8E124 . 8B43 10 MOV EAX,DWORD PTR DS:[EBX+10]
77F8E127 . 8B70 48 MOV ESI,DWORD PTR DS:[EAX+48]
77F8E12A . 8975 D8 MOV DWORD PTR SS:[EBP-28],ESI
77F8E12D > 803D 784AFC77 >CMP BYTE PTR DS:[77FC4A78],0
77F8E134 . 74 7C JE SHORT ntdll.77F8E1B2

:confused:
JMI
05-29-2004, 12:36 PM
jingjang:

The major problem you seem to be having is with understanding written English. Look at these two sentences:

"Run the prog SHIFT+F9 through the exceptions, counting them.
Then press SHIFT+F9
Boom Your at the OEP
Thats how you find the OEP, read LaBBa's tut's for finding the stolen bytes. "

and

"Run the prog SHIFT+F9 through the exceptions, counting them.
When the prog loads, restart it.
Goto the last exception, the one before the prog loads.
Open the memory window,
Select the code section, usually the second section.
Right Click->Set Break on Access
Then press SHIFT+F9
Boom Your at the OEP"

What you said you did is not what you were told to do. Did you count the exceptions and then, after restarting the program, if the program had 25 exceptions (as an example) did you count 24 SHIFT+F9s and then

Open the memory window,
Select the code section, usually the second section.
Right Click->Set Break on Access
Then press SHIFT+F9
Boom Your at the OEP???

If not it will NOT work. It also may not work if you are using a program which has a different version of the protector than LaBBa was talking about.

Regards,
jingjang
05-30-2004, 06:14 AM
yes i think its difrent version or someting coz...the adress is abit diffrent. i tried Labba's way step by step and runing the tc command...it worked but the address is slightly diffrent.

By the way...i tried Labba's tutorial on another progrrame (prog X). When i used ImpRec, and click the IAT autosearch button it says 'Nothing usefull found on this OEP'

I tried imprec on various other ASPR progs. and click IAT search button it works like a charm. Only this prog X it doesnt work and give me the error msg.
So i tried using AHTeam Tool just for checking on the programme X, it seem to analyze it..i leave it for 3 hours + still the same. Runs perfect also on other protected prog wif ASPR only with this prog X it seems to have problem.
Double check and it says it is protected by ASPR 1.23 :hmm:


An act of God?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > An act of God?
PDA

View Full Version : An act of God?

yaa
08-18-2003, 08:24 AM
Why are posts disappearing in this forum? Please mods explain.

Regards,
yaa
esther
08-18-2003, 09:05 AM
Hi,
first you have post it in the wrong forum this post should be off topic.
second coz the postings are not worth reading and waste ppl's bandwith and got deleted
Tola
08-18-2003, 11:40 AM
by default, only threads from the last x days are shown.
JMI
08-18-2003, 12:01 PM
When a post violates several of the Forum Rules and containes no information worth saving, they get deleted. When posters feel the need to start flame wars with other members, they get deleted. There have not been that many which fall into these categories.

Regards.
yaa
08-18-2003, 05:44 PM
esther I posted in one of the forums that have experienced these phenomena lately. The posts I'm talking of are not old post, they have just been deleted Tola. Those I'm thinking of are recent ... no wars in them ...
Honestly when I come back here and can't find a post I was following I get confused .. I often have to go around several forums thinking that it was somewhere else and in the end I understand ... too bad.
yaa
dELTA
08-18-2003, 05:51 PM
There has been flamewars popping up in quite the number of threads recently, so maybe that was the case in the threads you are talking about too, and you just didn't come back in time to see it?

Anyway, if you remember the details of the contents of any such thread that you think has disappeared without a reason, please tell us and we will look into it.

Anyway, we will start taking measures to stop this trend of flaming from now on, so hopefully this will soon not be a problem anymore in any case.

dELTA
JMI
08-18-2003, 06:49 PM
Yaa:

Only four threads have been deleted since the return of the Message Board. Three of them were all by the same individual and about armadillo, contained no useful information and were simply a bragging effort and flame war. They were appropriately deleted.

The only deleted thread you posted in was by Tortuga and included a link to a specific target and target specific code. Both are violations of the posting rules here. Your only contribution was to state: "What kind of a newbie forum is this if no one helps out newbies? " Yours was the only response and it hardely amounted to a useful discussion of RCE subject matter, and in light of the specific violations it was proper to delet it.

Regards.
yaa
08-19-2003, 09:09 AM
JMI, ok for the target specific code in the armadillo thread .. but my post in the answered thread was only meant to somehow launch again the post in the hope that someone would see it ... I don't see valid reasons why it was deleted.

No wondering why these forums are deserted by people and empty of posts ...

yaa
esther
08-19-2003, 01:46 PM
Hi,
I'm not the admin here,I do know the rules here.As you can see the arm* post is nothing but a troll.And most of the post are worthless and the mods deleted it,delta,JMI had already explained.

if ya still asking something that is worthless,this post might be deleted.... as usual its worthless


Is this packer New ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is this packer New ??
PDA

View Full Version : Is this packer New ??

Zilot
08-18-2003, 11:22 AM
I don't know if this packer is old.

PeId cann't recognize it. I never dealt before with it. I posted it because there is some try to avoid OEP finding with stack overloading by infinite calling loop.

Then he generates some kind of exception.
I found OEP, but earlier methods for it falied. After that everyhting was easy,
if one wants to try by himself here is info

EventHelix.com/EventStudio

This should be event charter, but is almost useless comparing to competition
Tola
08-18-2003, 11:49 AM
click the 'buy' button and see what happens.
Shoob
08-18-2003, 12:47 PM
Looks like a Vbox clones Oep is 432E54 as you know so whats actually your problem? set a breakpoint on the 2 crypted thunks (first kernel32, sec user32.dll) in olly and follow them (go into jmp eax) they are stored there uncrypted. Or set an breakpoint on where the apis (stored in dword) get moved to eax thats much easier. I have attached IAT so you can have a compare.

Not anymore you haven't...

anyone is interested in iat pm me ....
Zilot
08-19-2003, 03:59 AM
I have no problem, just wanted to know what this is. Your OEP is good.

set a breakpoint on the 2 crypted thunks (first kernel32, sec user32.dll) in olly and follow them (go into jmp eax) they are stored there uncrypted. Or set an breakpoint on where the apis (stored in dword) get moved to eax thats much easier.

Have you ever tried to use TrapFlag option in ImpRec ? Inspect for that in the future !
Shoob
08-19-2003, 10:35 AM
no cause my os crashed when i use it.
Zilot
08-19-2003, 11:23 AM
What is your OS. And which version if ImpRec you use.

I tried to identify this packer with new PeId 0.9 but it lacked to do it. This must be something really tough, maybe we should write to PeId makers to introduce them into our new discovered packer. Or maybe they considered this packer is to stupid to put it into database, I don't think so.
Zilot
08-19-2003, 11:28 AM
Esther http://smilies.sofrayt.com/%5E/u/cop.gif!?

Is this your work ------> Not anymore you haven't... and this ------>pm me
dELTA
08-19-2003, 01:41 PM
I removed the iat, and Shoob added the "pm me" when he saw that it was deleted.

Esther cannot edit other people's posts, since he's not a moderator.

dELTA
hobferret
08-19-2003, 02:52 PM
Hi all:)

Zilot you state "tried to identify this packer with new PeId 0.9 but it lacked to do it. This must be something really tough, maybe we should write to PeId makers to introduce them into our new discovered packer. Or maybe they considered this packer is to stupid to put it into database, I don't think so."

You don't think so eh?

Well I D/L this prog and it took only 5mins to remove encryption.

IMHO It is pretty useless let's just wait and see what the "old boys" think of this protection!

/hobferret
seven
08-20-2003, 04:05 AM
i think this progge packed .
with wat , i dont know .


Official PE specification, download here
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Official PE specification, download here
PDA

View Full Version : Official PE specification, download here

dELTA
08-18-2003, 07:54 PM
During all the years of discussions regarding finding information about the PE format, and during all my own searching efforts for it in the past, I cannot recall ever seeing any mention about the following official PE format specification document from Microsoft:

http://www.microsoft.com/whdc/hwdev/download/hardware/pecoff.pdf

It is 77 pages stuffed with detailed information of very high quality about the PE format. I don't think I ever saw a document of equal quality regarding the PE file format (not really sensational since it is after all the official specification, but anyway :)).

Even though it is dated 1999, I doubt that it has been publicly available all the way since then, due to the lack of widespread knowledge of its existence.

Anyway, I recommend any reverser with self respect to download and study it. ;)

dELTA
esther
08-18-2003, 09:36 PM
Thanks fors the link

ps: you've forgot the hxxp :p
JimmyClif
08-18-2003, 09:40 PM
Thanks for the link. :cool:
OHPen
08-19-2003, 10:30 AM
Hi all,

delta you are right, the document is accessable since 1999, i downed it for about two years.

It helped me to make the biggest steps on coding my own PE-Tool. All the time i used only this one to increase my knowledge in the PE-Field.

Very good essay, READ IT guy's, ;)

OHPen aka forsaken aka PiTcH_SiLoW
JimmyClif
08-22-2003, 11:38 PM
This is just a shot in the blue but you don't know where to find the 'official' COFF Library Archive format ( .lib ) specs besides:

http://giscenter.icc.ru:8082/scripts/WWWBinV.dll/ShowR?COFF_LIB.rfi

and

http://www.microsoft.com/msj/0498/hood0498.aspx
dELTA
08-23-2003, 08:23 PM
I've got no idea, sorry. :( Anyone else?
hobferret
09-15-2003, 10:27 AM
Good morning everyone :)

Just found this topic but could not get it via dELTA's link - so if anyone is interested it now resides at:-

http://www.microsoft.com/whdc/hwdev/hardware/PECOFF.mspx

:D

/hobferret
cyberheg
09-16-2003, 03:04 AM
I'm pretty sure it's the same document that I've used for years which is availble in MSDN.

It it dated v6.0 which I'm sure matches with MS VC++ 6.0 becuase that was also released around that time. The msdn I have is also from 1999.

// CyberHeg


armadillo + aspro 1.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > armadillo + aspro 1.2
PDA

View Full Version : armadillo + aspro 1.2

seven
08-19-2003, 08:14 PM
hi
how to unpack proggez packed
with armadillo or aspro 1.2 , both
r so hard to unpack ?
thx
Woodmann
08-19-2003, 08:58 PM
Press the search button, upper right.
Type in armadillo or whatever you desire.
Press the enter button on your keyboard.

Read the FAQ, there is no excuse.
seven
08-20-2003, 04:03 AM
thx 4 reply .


Debugging RPCRT & OpenSC Manager
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Debugging RPCRT & OpenSC Manager
PDA

View Full Version : Debugging RPCRT & OpenSC Manager

doug
08-19-2003, 10:11 PM
Hi,
I had a post on the temp. msgboard about debugging Remote Procedure Calls (RPC) on Windows.
Since it appears to have died with the temp board, I will post again here. (nb: this has nothing to do with the recent msblaster issue)

I was debugging functions relative to the Open SC Manager on 2K/XP, to see how they were handled internally, and quickly realized the code in advapi was just a stub that called an RPCRT4 function (NdrClientCall2). Now the tricky part is inside rpcrt4... the NdrClientCall2 ends up sending its request and just turns into a "listen mode", waiting for the reply to arrive. When it gets the reply, it copies the result into the user supplied buffer, and returns back into advapi.

Does anyone have ideas/suggestions/docs/tricks/tools that I could use to make my debugging easier? I don't know how to monitor the other side of the rpc calls, i.e: the one processing the request. Any info would be appreciated.

Furthermore, does anyone here have experience in debugging Open SC Manager's internals?

--
dougg
Aimless
08-22-2003, 01:49 AM
Doug,

Could you tell just between what and what are you waiting for a response from? For example, could you inform what is on the other side of the RPC call?

For e.g.: Are you trying to converse with a Web Server on the other side? A news server? A chat server?

You see, there is software involved at both ends. one that sends the RPC and other that processes the rpc and replies back. Could you provide more information on what softwares are being used at both ends?

have Phun
doug
08-22-2003, 11:25 AM
This is essentially what I am trying to find out when I trace Open SC Manager- related functions..

A concrete example:

a call to EnumServiceStatus follows approximately that route on my XP system:

my_code
_EnumServicesStatusA@32 (ADVAPI32)
-> _REnumServicesStatusA@32 (ADVAPI32)
->->_NdrClientCall2 - (RPCRT4)
->->->[...] and eventually
->->->OSF_CCALL__FastSendReceive (RPCRT4)
->->->->OSF_CCALL__ReceiveReply (RPCRT4)

This is why i'm looking forward to get advice on how to debug rpcrt4, because I would like to know where my request is _really_ handled (i.e: "the other side").
doug
08-28-2003, 12:34 AM
Well after looking around, I can confirm this is a windows interprocess/user<->subsystem communication system..

The Local Procedure Call (LPC), which is yet another undocumented windows element.

I've had the online version of "Undocumented Windows NT" by Dabak, Phadke, Borate for quite some time here (there is an online (free) html version available on a publisher's website.. that I mirrored on my hdd:P), and I only noticed today that it dedicates a whole chapter to the LPC.

I'll do some reading & post more info in here if I find any.

--
Thanks to kayaker for sharing his ideas with me on that subject.
doug
08-28-2003, 03:25 PM
I should have found this earlier I guess, but here is how the communication is done:

When debugging EnumServicesStatus, all the way down in rpcrt4.dll, there is a call to "NMP_SyncSendRecv"

(send-recv because it expects data to return)

which finally does:
[...]
push dword ptr [esi+18h] ; handle to NamedPiPe
call ds:__imp__TransactNamedPipe@28

on the Named Pipe:
\Pipe\svcctl

after googling a little..
i found: "... \SvcCtl named pipe (the Service Control Manager)".. exactly what I'm looking for.

Then I tried to find what created this named pipe.. no luck searching through my whole hdd for "svcctl" (but then, it could be in unicode format in some file...)

I tried the registry, SYSTEM\CurrentControlSet\Services\Npfs\Aliases : there's a string called "ntsvcs" which has to following values "eventlog svcctl".

To make sure I was dealing with the right .sys driver, i checked what the entrypoint of ntfs looked like..

well, In DriverEntry, there is a call to "NpInitializeAliases", which reads the registry and creates the aliases that i just stated above... got it;)

--
doug
dELTA
08-28-2003, 06:24 PM
Cool, always fun with yet another part of low-level Windows unraveled. Keep up the digging... ;)
doug
08-29-2003, 01:24 AM
hehe, well

i may have reacted too soon, I'm still not 100% sure that this is the driver handling the sc manager, it just looks like it handles the namedpipes.. If so, I'll just have to dig a little bit more, and I'll be out of town for the next couple days :/
dELTA
08-29-2003, 08:21 AM
No hurry. :) But we'll be glad to hear how the story unfolds, whenever it does.
doug
09-14-2003, 12:16 AM
hey, well since the board went down the day I posted this, I will upload the file again:

doug


Another "trick"...(packer)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Another "trick"...(packer)
PDA

View Full Version : Another "trick"...(packer)

nikolatesla20
08-20-2003, 06:14 AM
Another quick and dirty armadillo trick.

If you want to use the latest public demo armadillo on your project (be it an unpacker or whatever), and you don't want the "unregistered" messagebox coming up here is what to do:

Used to be in older versions of Arma they stupidly put Security DLL in the Arma EXE, and it wasnt even compressed. AND, you could find the unregistered string and change the jump so it wouldn't show up. Well, they finally woke up from their dork trip and compressed the DLL, and also put layer upon layer of self-decrypting code around the area where the messagebox comes up. However, I still found this workaround. Just make the program call another API instead of MessageBoxA that takes 4 DWORD parameters, and won't crash. I found GetMessageA. Then edit the DLL's import table hehehe :)

Now, when Arma is running in memory (the protection program itself), it has already decompressed its resources. You'll see the resource section is at 00539000 when it's running. That's the latest 3.20 Arma public. I found Security DLL in here for you already and thru calculations arrived at offset 00615A06 for the string "MessageBoxA". This will be the offset always for anyone out there, trust me. Open up the Arma process using TSearch or another memory editor (make sure you get the right process), and simply overwrite this string with the string "GetMessageA", and now when you protect your program its gets a new import table with this substituted API.

And now, you won't get an unregistered message, either :D

One other thing, if the protected file is modified (like if someone edits its section characteristics, for example), you also won't get warning messageboxes, but the program will still exit due to protection, so who cares?

Yes, there's more than one way to solve a problem....:)

I'd also like to say that some out there would deem this trick useless, but I only do what I do to prove to myself that I can think creatively and for the challenge. I just find it interesting, even if no one else might like my methods.

-nt20
Manko
08-20-2003, 06:36 AM
I like it. :)

/Manko
evaluator
08-20-2003, 07:05 AM
but why "we" anyway need to kill that MessageBox?
Are "we" TerribLe iLLegalZ!?
;)
nikolatesla20
08-20-2003, 07:31 AM
I like to keep Chad awake at night :) and also just an exercise in creative thinking...

-nt20
evaluator
08-20-2003, 10:28 AM
hm, so you are NOT TerribLe iLLegaLz..("we" remember;)

>>..they stupidly..

Question is: what prot "we" want, strong or stupid!?
nikolatesla20
08-20-2003, 11:06 AM
Is simply just sharing information illegal?

-nt20
hobferret
08-20-2003, 11:42 AM
Yo everyone:)

I agree with Manko - it's Good

Nice one nikolatesla20;)

Keep it going we need to share as much info as possible - take no notice of eval he's always going on about the sick bird i.e.illegal:rolleyes:

BTW nt are you any relation to the real Nikola Tesla??

Just wondering

/hobferret
nikolatesla20
08-20-2003, 12:15 PM
Originally posted by hobferret
Yo everyone:)

BTW nt are you any relation to the real Nikola Tesla??

Just wondering

/hobferret

hehe nope, he was my favorite inventor, so I use his name.

I got some more Arma trix for later.

-niko


Internet Popups accessing systems' Client Server Runtime Process?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Internet Popups accessing systems' Client Server Runtime Process?
PDA

View Full Version : Internet Popups accessing systems' Client Server Runtime Process?

Kayaker
08-20-2003, 07:55 PM
Hi all,

I connected to the 'Net a couple of times recently and forgot to enable my personal firewall and got a popup from some kind of scam advertising for of all things a popup filter! Using TaskManager I found that the nag box was running under a thread of the Client Server Runtime Process (process csrss.exe/csrsrv.dll). I also found that Win2K's Event Viewer logged these 2 internet popups as Application Popup events, the same kind of event recorded when you get a regular application error popup. The nag process ran under the name of Messenger Service.

I was wondering if anyone has looked into how these popups actually manifest themselves? Are they initiated from standard Javascript that accesses CSRSS in some way to popup the stupid message, or is this a different kind of penetration?

I'm not sure of *where* I got this from both times, I had several sites open at the time and it just 'appeared' while quietly browsing. Would this kind of thing come from a site directly, say in a linked advertising banner running a spamware script, or whether this is some other kind of internet attack bot combing the net for open ports or something to spew its message?

I haven't found much in the way of info on Csrss.exe or the function it imports from csrsrv.dll, CsrServerInitialization, but the code does look like it might be used to generate a popup nagbox (posing as an application error message), there is an interesting set of (mostly undocumented) ntdll functions it uses, including NtSetInformationProcess and NtRaiseHardError in the exe, and NtSetDefaultHardErrorPort in the dll.

I suppose a clue would lay in how a popup filter works and see what it hooks to prevent the popups in the first place, but I have no experience with that. Any thoughts?

Cheers,
Kayaker

Here is the Event log in case anyone else has been attacked.

----------------------
Application popup: Messenger Service : Message from Admin to You on 8/20/2003

~-~-~-~-~-~~-~-~-~- How To Disable These Popups -~-~-~-~-~-~~-~-

A new wave in Internet advertising is coming. Its called the Messenger
service and its built directly into your Windows operating system.
It is only a matter of time before the email spammers that fill your inbox
learn about this and flood you with porn and pyramid scam popups that
monopolize your screen. Fix this today!

VISIT : www.MessageStop.net
-------------------------

...The message in the earlier popup was a little different, heh, maybe I should buy into this complete crap and go to the site?

-------------------------
Application popup: Messenger Service : Message from ALERT to You on 7/25/2003

* * * * * * * MAKE THIS YOUR LAST POP-UP EVER! * * * * * * *

Destroy these pop-ups for a fraction of the price of our competitors!!!

Go to: www.MessageDestroyer.net
-------------------------
nikolatesla20
08-20-2003, 08:11 PM
NOthing too complicated here - just a pop up randomly sent to your I.P. using the "net send" command, which talks to the 2K /XP Messenger Service.

Also, there's special version of "net send" which allow you to fake the source name. Easy to get...

Just turn off the Messenger Service in Services, you don't need it anyway...

-nt20
Kayaker
08-21-2003, 12:07 AM
Aha thanks, I only recently switched to 2K and am still figuring things out. I see what this Messenger service is now, even MS itself mentions this form of spam, though interestingly they DON'T mention disabling the service because "Instant messages should not be blocked", so want you to rely on a firewall instead.

Good to know about this, that net send command makes it too easy to for anyone to access a service on your machine -
net send {Name | * | /domain[:Name] | /users} message
You can send a message only to a name that is active on the network. If you send the message to a user name, that user must be logged on and running the Messenger service to receive the message.

K.
UrgeOverKill
08-23-2003, 07:50 AM
M$ really doesn't want you to disable the Messenger Service, even tho you try to delete it. So instead try this, you can uninstall Windows Messenger by opening the sysoc.inf file in the \windows\inf folder and finding the line

msmsgs=msgrocm.dll,0cEntry,msmsgs.inf,hide,7

Delete the word 'hide' from the line, then save the file. An option to remove Windows Messenger will then be available in the Control Panel Add/Remove Windows Components applet. This works on XP and should work on 2K.
squidge
08-23-2003, 01:58 PM
I got rid of it by terminating messenger (via task manager) and then deleting it's directory. Luckily, Messenger isn't part of windows file protection, unlike Microsoft Outlook, which is only other part I'd like to delete permanently.
yaa
08-23-2003, 02:59 PM
The messenger service can even let people know who is the currently logged on user on a w2k/XP/.NET machine ... this way only the password needs to be found :D ....
If I recall well it's because when you have the service running and you logon on a network your machine tries to register a few services with the local wins server ...

I scratch my desktop often and I'm always impressed when I access the internet with a fresh machine having forgotten to put in manual or disable the service ... I get that popup in a matter of a few seconds ... I wonder what makes these people do these things ... exactly as when I get garbage spam mail ... why??? I mean if you want to sell me something I may even understand your intent ... but garbage mail goes beyond my capacity of understanding.

Anyway there is a tool on MS site called "Microsoft Baseline Security Analyzer" that will analyze your machine and identify all security weaknesses in your machine (like short passwords, guest user enabled, SQL Server sa account missing a password, etc) ... I think it's a useful tool ...

yaa
4oh4
08-25-2003, 01:02 PM
You can also just type 'net stop messenger' at a cmd prompt. Also, use the services control panel to stop the service and change it's automatic loading.

cheers,
will


Some INQUISITION news
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Some INQUISITION news
PDA

View Full Version : Some INQUISITION news

Polaris
08-21-2003, 03:53 PM
Hi there!!

After some needed holidays, working on the INQUISITION plugin has restarted. Another programmer joined me in the project, focusing on the GUI.

Next release (3.0) will feature mainly a cool (!) GUI, which will allow you to see, copy & paste outputs directly. No more resizing the screen to see the message window... :)

Other features:
+ INQUISITION handles subs prolog & epilog in a better way, letting you forget about them
+ Some correct type casts have been inserted (thanks to Zheng Tao)

The search for a skilled artist is over. We are proud to announce... (Trumpet :) ) that DYNIO has joined the INQUISITION development team as the guy behind the artwork. Maybe the website will look less crappy with his help!!!!

As ever, next release will soon appear at hxxp://polaris.kcmo.net ...

Byeeeezzz

Polaris
Aimless
08-22-2003, 01:07 AM
I have to admit.

I have seen a lot of good tools and bad tools. But yours is different. Pretty original. It does help to see your code "visually".

Good work Polaris.

Have Phun,
volodya
08-27-2003, 02:35 PM
Thanks. I will mirror it on wasm when you release it. Pretty nice, though, to my opinion, http://desquirr.sourceforge.net/ which is also mirrored on wasm does it job a little bit better... But you are developing your app and desquirr does not, so good luck!
Polaris
09-20-2003, 09:50 AM
Hi there,

after some tremendous ;) work, INQUISITION version 3.1 did see the light on this morning.

So, just go http://polaris.kcmo.net and download. :cool:

Next plans are:
- build a 4.5 version (due to heavy requests)
- insert dataflow analisys

As ever, feedback at masterofnebulahfrost@hotmail.com

Byyyeeezzz

Polaris :D
Polaris
09-24-2003, 10:42 AM
Hi there! :D

Bugfix version of INQUISITION (v3.11) is released. As ever, download at hxxp://polaris.kcmo.net.

Also, INQUISITION has been built for IDA Pro 4.5... It did execute correctly on my cracked-demo-version,until the demo-version crashed. Hopely you will see INQUISITION for IDA 4.5!! :D

Byyyezzzzzz,

Polaris
Polaris
10-03-2003, 10:54 AM
Inquisition IDA Pro plugin has been finally released in version 3.12 for both IDA Pro 4.5 & 4.3.

Download & info at: hxxp://polaris.kcmo.net

Byyezzz

Polaris
Polaris
10-11-2003, 05:59 AM
INQUISITION GUI has been updated. Download the new package (INQUISITION v.3.12 & GUI v.1.1) at hxxp://polaris.kcmo.net .

Byyyezzz

Polaris
libertine
12-22-2003, 07:43 PM
why don't you publish its sourcecode ? or at least compile it for ida4.60 ?
Aimless
12-23-2003, 01:32 AM
AARrrghhhh!!!!

I've just been blinded!!

Guys, I've heard of going overboard with the background designs, but please! this is ridiculous. I take more time finding what is written on the site rather than reading. Good thing I use Opera with user mode on...

Simple request. Why don't you turn the background off on your website? Of course, you can simply ignore my request. After all, its your website. But give us poor guys a chance to atleast read the site without a headache?

Have Phun
doug
12-23-2003, 01:52 AM
In the month of NOVEMBER 2003, the INQUISITION Technology has been acquired by an international company. Therefore, there will be no more public releases of INQUISITION.

The INQUISITION development team wanna thank everybody who helped us in this project with their insults, bug reports and feedback.

as for the source code question:

Source Code Of INQUISITION?

INQUISITION is now a copyrighted work. Since I am no more the owner of its source, I cannot release INQUISITION source code (and I don't think that present owners will).

all on http://polaris.kcmo.net
Polaris
12-23-2003, 03:32 AM
AARrrghhhh!!!!

I've just been blinded!!

Guys, I've heard of going overboard with the background designs, but please! this is ridiculous. I take more time finding what is written on the site rather than reading. Good thing I use Opera with user mode on...

Simple request. Why don't you turn the background off on your website? Of course, you can simply ignore my request. After all, its your website. But give us poor guys a chance to atleast read the site without a headache?

Have Phun

Touche, my friend!

I have to admit that I am not the most skilled graphician/web-designer (well, actually I am really scandalous)... I will soon re-design website to let you save an headache :D


Using original .idata instead of creating new section
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Using original .idata instead of creating new section
PDA

View Full Version : Using original .idata instead of creating new section

doctorow
08-22-2003, 08:57 AM
Hello,

I have successfully unpacked a svkp protected application, including working imports etc. I used ImpRec 1.6 Final to do the import job.

Now, when I select to add the import infos to a new section, the unpacked target runs fine.

On the other hand, when I select to add the import infos to the existing .idata section of my unpacked target file (I made sure that idata is big enough (physical+virtual) to hold the data, the file cannot be started in windows (0xc00000005).

I also made sure that characteristics of .idata is set to e0000020.

Any suggestions what I am doing wrong here?

Appreciate your help.
nikolatesla20
08-22-2003, 09:53 AM
Even though you told ImpREC to add the data into an already existing section, did you check to make sure it changes the Import Table RVA in the header to the right value?

Also, a good way to check things out is to use LordPE or PEditor (my preference) to look at the import table. Does it look ok? Or are there screwy characters - which would mean some offsets got messed up. Another thing, you DO NOT want to insert the import table where the FIRST THUNKS are going to be, because it will get all hosed up by trying to overwrite itself. In short, it's very risky to insert the table ImpREC builds for you into the orginal .idata section because you might not be sure where the first thunks are. These are the DWORDS that get overwritten by the windows loader with addresses. If you accidentally insert the IAT table in the same area, you'll corrupt your own table. You would have look at it more deeply, to make sure where the first thunks begin and end, so you can insert the new IAT somewhere where it won't screw them up. Not sure if this is what's happening to you, but it's an idea to check for.

A good thing to do is to open it up in LordPE or PEditor like I said, or even Visual C++'s Dependency Walker, to make sure the table works statically (that other programs see it as valid)

-niko


windev crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > windev crackme
PDA

View Full Version : windev crackme

newbcrk
08-22-2003, 11:36 AM
lol

I have any difficulties with target wich has been written with windev .
I have find only one tuto with windev .It si poor althougth
windev target don't miss .Was somebody be able to give me any crack windev tutos ?

I want to crack this windev crackme
If somebody is interrested he should to download the two missing .dll (WD553EXE.dll , WD553WDW.dll) at http://www.alltheweb.com in the ftp part . Otherwise the crackme is bigger to attach .

I will Softice and windasm .

:o
newbcrk
08-24-2003, 07:25 AM
I have done this

bpx sendmessageA

hwnd crackme1
Window Handle hQueue SZ QOwner Class Name Window Procedure
03C8(1) 2E27 32 CRACKME1 WDRBF 1427:00000BE8
03CC(2) 2E27 32 CRACKME1 Button 1427:00000B7A
03D4(2) 2E27 32 CRACKME1 Button 1427:00000B7A
03D8(2) 2E27 32 CRACKME1 Static 1427:00000BA6
03DC(2) 2E27 32 CRACKME1 Edit 1427:00000BD2
03C4(1) 2E27 32 CRACKME1 WDRBF 1427:00000AB4
03C0(1) 2E27 32 CRACKME1 WDBULLE00520EDE 1427:00000A88

bmsg 3c8 wm_gettext
bmsg 3cc 202 ;; 202 code when I press the button

Then , what have I to do ?
Sometimes bpr breakes .
ZaiRoN
08-24-2003, 11:08 AM
Hi newbcrk,
to catch wm_gettext seems to be one of the best ways to approach the target. Then , what have I to do ? Then, you have to step each line! From what I have seen, the interesting code is all inside WD553EXE.dll but I can be wrong. I solved this crackme in a different way, using SoftIce's 's' command. Look around for some interesting texts, you will find your serial :D

Best regards,
ZaiRoN
newbcrk
08-24-2003, 02:49 PM
lol
before and after this call 100CCF84 call 10124580 there is a loop .
There is the bad way .

It seems to be around (or inside) this call .Right ? (So I can begin a analyse)
A bpr lands inside this code .But yet I fail to put my bpr .Strange isn’t it ?

If I am right .Could you tell me which methods you have used to compare with mine ?

:)
ZaiRoN
08-24-2003, 05:27 PM
Hi,
I started with bmsg on wm_settext and, as I said before, after that I have not putted breakpoint...

Sorry but I stepped only few lines and I don't know whether the addresses you gave me are good or bad. I don't have the crackme on this machine and I can't check but if I recall correctly the serial is not visible in the files but its only visible at runtime...

ZaiRoN
newbcrk
08-25-2003, 03:27 PM
Thanks (I will find)
newbcrk
08-25-2003, 05:03 PM
I have found .Mos tof time I find without understanding the code
I have use only bpx sendmessageA and F10-F12
I will try with the bmsg in the purpose to understand

d eax
:u 100F9A38 L FF
0167:100F9A38 EBD2 JMP 100F9A0C
0167:100F9A3A 8B4111 MOV EAX,[ECX+11] ;;HERE d EAX give the serial number 123456ABCEF
0167:100F9A3D 33D2 XOR EDX,EDX
0167:100F9A3F 40 INC EAX
0167:100F9A40 51 PUSH ECX
0167:100F9A41 894111 MOV [ECX+11],EAX
0167:100F9A44 8A50FF MOV DL,[EAX-01]
0167:100F9A47 FF149538EA1310 CALL [EDX*4+1013EA38]
0167:100F9A4E 83C404 ADD ESP,04
0167:100F9A51 8B4D08 MOV ECX,[EBP+08]
0167:100F9A54 EBE4 JMP 100F9A3A
0167:100F9A56 8BFF MOV EDI,EDI
0167:100F9A58 009A0F10CD99 ADD [EDX+99CD100F],BL
0167:100F9A5E 0F10CD MOVUPS XMM1,XMM5
0167:100F9A61 99 CDQ
0167:100F9A62 0F1000 MOVUPS XMM0,[EAX]
0167:100F9A65 9A0F109E990F10 CALL

Bye
ZaiRoN
08-25-2003, 06:14 PM
Well done! ;-)

Btw, to play with a program written with windev is not so unusual, you have used the same approaches and the same SoftIce's commands that you use with another program written with something different from WinDev. Am I wrong?

ZaiRoN
newbcrk
08-28-2003, 03:46 PM
You are right .I have used bpx sendmessageA looking in the user 32.hlp .
The most important is to understand the hwnd command and what she gives .
I watch the handle , do F5 to make a breake .As soon as I have seen the handle number of edit BOX (hwnd gives it) , I have begin to trace with F10 .
I have understand too why my bpr refuses to breake .I had to localise before the sendmessageA API of the edit then I could to put a breaking bpr .
I can't explain this but it's breakes .Memory reasons ?

you have used the same approaches and the same SoftIce's commands

Realy I have learn , find a rational approach .I am only newbie
DalKiT
09-03-2003, 08:39 AM
Hello everybody

If you have difficulties to find serial for windev crackme, thalos wrote a tutorial. You find it on my web site.

Bye

DalKiT


Hasp4 Flash utility
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hasp4 Flash utility
PDA

View Full Version : Hasp4 Flash utility

cah
08-23-2003, 04:35 AM
To,

I want hasp3/4 Flash utility for changing /editing hasp id.

Do any one konws how to change/edit of hasp4/3 locks?

Help is highly appreciated
CaH
CrackZ
08-23-2003, 07:42 AM
Hiya,

In HASP 3, the ID was stored in reserved memory, addresses 0/1 (Aladdin kept 16 bytes for themselves), this remains the case today for HASP 4.

In terms of writing to these addresses, HASP 3 writers exist, or at least HASP 3 dumpers which 'dump' the full memory range do (you can reverse engineer one of those to see how its read out and therefore write it too, see Bajunny's essay #3 I think which describes the protocol in more detail).

I don't think this remains for HASP 4 since the public HASP 3 dumpers don't work, one possibility is to reverse engineer the drivers (like I have) and see how normal words are read there (then try and read out 0/1 since I doubt this has changed).

Regards

CrackZ.
cah
08-24-2003, 07:01 AM
Thanks for your reply
Do you have any utility to edit/changing hasp id for hasp4 locks?

Help me if you can
CaH


PortTunnel v1.6.14.211 - Keyfile protection & Packer $ Unkeygenable ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PortTunnel v1.6.14.211 - Keyfile protection & Packer $ Unkeygenable ???
PDA

View Full Version : PortTunnel v1.6.14.211 - Keyfile protection & Packer $ Unkeygenable ???

OHPen
08-23-2003, 03:38 PM
http://www.steelbytes.com

The PortTunnel Programm uses Serial which is stored in a keyfile.
It's protected with exepak32 v1.3-Packer, but it's no problem to unpack manually.

OEP = 412190

I tried to keygen it, but i have probs.

I can't find the check routine. Maybe someone can give me a hint ?

THX

OHPen

Abbreviated version:
Please give me a crack for PortTunnel v1.6.14.211
KSA
08-23-2003, 03:50 PM
Hi,

Forget it to make a keygen for it because it uses 512-bits RSA Encryption. So, You have to find the private which is impossible.

I just change one byte and allowed an expired key to register :)

KSA
Bengaly
08-23-2003, 05:45 PM
just patch the E to 1 or someting and have ur self an keygen (kinda ugly but heck..) :)
OHPen
08-24-2003, 07:47 AM
Hi,

I'm the last one who calls itself RSA-Expert.
But isn't ther a chance to make a Keygen if RSA isn't implemented well ?

I haven't check this, but maybe it's a possibility ;)

greets

OHPen
dELTA
08-24-2003, 12:48 PM
The practically only chance you have to keygen an RSA protection is if the randomization algorithm for the original private/public key-generator is known and weak. This was the case when they broke the RSA keys in Asprotect before. But it is very unlikely that you'll get this kind of information if it's not a widespread protection that you can study the randomization code for, and of course it doesn't have to be weak in the first place even then, and then you're screwed anyway. And even if you DO have the randomization code for the original private/public key-generator and it IS indeed weak, it is still quite advanced crypto/math stuff to break it.

If it is "not implemented well" in any other way, it has to be implemented so bad that it's not RSA anymore if you should have a chance. :) The keylength can be ridiculously short of course, as have been known to happen in some other protections, but if it's 512 bit keys in this one, like KSA said, you can pretty much forget it (and revert to your original question about to which address you should apply a nop-patch to crack it). ;)

dELTA


RTA 2.00 Beta 2 Release
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RTA 2.00 Beta 2 Release
PDA

View Full Version : RTA 2.00 Beta 2 Release

squidge
08-23-2003, 06:50 PM
RTA2 allows you to edit both the hex and assembler version of the output by simply positioning the cursor over what you would like to edit and start typing. Errors in your assembly editing are immediately shown in the bottom status bar as you edit the assembly - this can be useful to see what instructions will take what arguments for example without having to load up the intel instruction set reference.

By editing the hex, the disassembly is automatically updated as you change the hex bytes.

If you have any bug reports, please send them to paulc@ibiblio.org stating the version you are using, what file the fault occurs on, what OS and anything else you think it relevent.

Suggestions for new features should be sent to the same address.

=====

Changes in b2: Configuration file has made an appearance, file analysys (A pe sniffer using data from PE Tools), support for the SAL instruction, faster editor and lots more.

Changes in b2.1: Bug fixes + option to have shell extension added (now you can just right click an exe/dll/etc and "Open in RTA")

Note however that this is still beta and under development, so not everything works perfect, but the basics seem to work quite well now. I'd like to hear about any problems however.

Features waiting to be added:

"Find" function will be improved to allow wildcards & multiple statement searching, as well as searching for more than just assembler.

"Paste" will allow you to relocate the addresses used in the pasted instructions to the new address.

"Print" function.

PE Editor (via external program).

etc, etc... :)

Download and screenshots:

hxxp://ibiblio.org/paulc/rta
dELTA
08-23-2003, 08:36 PM
Cool, seems to be growing into quite the nice/advanced/useful tool. :)

Keep up the good work. :cool:
nikolatesla20
08-23-2003, 09:55 PM
Squidge, I was wondering, do you like to use Visual C , or do you usually stick with Borland mostly? I'm getting better and better at throwing together small VC++ apps finally lol, but still project organization is always a complicated matter blah balh

Anyway, keep up the good work, man!!

-nt20
squidge
08-24-2003, 07:49 AM
I prefer Borland for most things, simply because it takes all the effort of the GUI of you and lets you concentrate on the main program design and operation. Visual C++ still has far too much messing around with windows messages, and so takes far longer to create a similar sized project to one in Borland. VC++ does however have far more power behind the gui, but thats only because you do everything yourself. Borland indeed does it all for you, but your kind off restricted to the way they want you to do things, rather than how you want to do things.

Visual C++ does however have the "Industry standard" mark on it, so it's always worth being able to write windows apps using it.

When I get some time, I may attempt to convert RTA over to VC++, it'll be a good learning exercise me thinks :)
squidge
08-25-2003, 03:18 PM
Update: There were a few bugs I've found in beta 2 that have now been solved. You can download the updated program from the same URL as before. I've also added a "Register as shell extension" option into the program to make it easier to edit things.
Bengaly
08-25-2003, 04:05 PM
hi squidge, it is a nice tool,
but it is unfair not to mention olleh in ur about window...
u do use his disasm engine you know.
unless u wrote ur own :)

speaking of bugs:
RTA will not let me click on a JMP unless u move it with keys.
squidge
08-25-2003, 04:56 PM
Yes, although Olly's disassembler engine has now been heavily modified, I should really thank him still.

Doubleclicking an address to follow it is still something on the to-do list - until then you have to press return (or whatever key you have configured) to follow the address.
changes
08-26-2003, 07:16 PM
Hi Squidge,
Nice work, just a few suggestions to make RTA a little bit more user friendly for a novice like myself:

1: When you write a line of asm code and then jump to another line with the mouse, it seems that, if you haven't "terminated" the previous line with an "up" or "down" arrow key, then, although you seem to be on another line, mousewise, you are actually still editing the previous line and strange complications arise!

2: The program seems to be permanently in "insert " mode as shown on the status bar, but any chance of being able to use the insert key to toggle to "overwrite" mode?

3: The "enter" key seems to lack any function. Perhaps you could also use it to "terminate" a line of code and move onto the next.

4: "Delete" key does not function. The only way to erase at present seems to be "backspace" key. What are the chances?

Just a few cosmetics but enough to be getting on with if you're interested.
Thanks for your time.
Cheers.
squidge
08-27-2003, 05:55 AM
Thanks for the suggestions,

1. Yes, that's a problem. Most likely caused by my "mostly keyboard" attitude when writing and debugging programs. I tend to use the keyboard more than anything and use the mouse very little (I find I'm far faster if my fingers leave the keyboard as little as possible).

2. The insert key should toggle between insert and overwrite mode when the cursor is positioned over assembler code (not hex as the program can't insert new bytes into the program as it would just corrupt it). However, this seems to have been broken in one of the later releases.

3. The enter key's only current function is to follow an address specified in an instruction. I agree however that it could be useful to terminate a lin editing session with it.

4. Most likely the same problem as No. 2. It did work before!
squidge
09-06-2003, 04:25 PM
Just a small note to say that 2.00 Beta 2.2 now contains the fixes and additions that "changes" & "Bengaly" suggests at the usual place. This version was upped 31/Aug/03, but I forgot to change website page.
Iwarez
09-06-2003, 06:14 PM
I tested your program and have a small question.

When patching programs I sometimes have to write inline code. Most of the time I write the code from scratch which means that I have to insert/delete code a lot. Is it possible to make a function to shift the code up and down? Or to say that I want to insert an instruction or delete an instruction and that the program automatically rearranges the code?

Thanks for your time and efforts for this tool. I hope you can help me.

I-Warez
squidge
09-06-2003, 06:38 PM
At times, I have the same problem and I do want to be able to do the things you describe. It's just a matter of finding the best way to do them at the moment. If anyone has ideas on how to do this efficiently, then I'm all ears :)

At the moment, the only way I can think of is to disassemble the code, replace all direct references by adding/subtracting an offset, and then re-assembling.
squidge
09-16-2003, 06:33 PM
Hmmm, seems like this thread has lost a few articles since the restore.

So, Iwarez, your request was implemented and is available for download from the normal address.
Iwarez
09-17-2003, 11:55 AM
Thanks! You're super! I'll try it.
Iwarez
09-17-2003, 12:04 PM
It works. Great!

I have another question... When using olly I can make selections for the clipboard with the mouse. There is no way I can make selections with the mouse in your program. Is it possible to click the mouse, drag it, and release the mouse at the point until I want the selection? Also, Can I then select the option paste?

Another nice feature would be to select the complete text of a disassembled text so when you type something it gets erased.

And last but not least, an option to fill the remaining bytes with a NOP instruction and to fill a selected area with NOP's would be cool to.

I you'll implement this. Thanks for your investment and time.

I-Warez
squidge
09-17-2003, 03:54 PM
Do you have a three button mouse? If so, you can make selections with the middle mouse button - click once to mark the start of the block, click again to mark the end, and it'll be all highlighted. Clicking a third time will "abort" the block.

Once a block is highlighted, you can click "Copy" to copy the block to the clipboard and deselect the block, and then click "Paste" later on, or, you can just click "Copy + Paste" to do both in one go.

To fill an selected area with NOPs, just select the area and select "Cut" rather than "Copy".

For the rest of your suggestions, I'll place them on my todo list.
changes
09-17-2003, 08:57 PM
Hi Squidge,
I must just say that you really have your finger on the pulse of "must have" software with RTA. It really is becoming a very intelligent piece of kit! What does RTA stand for? Reversing Tool for Assembler?

I'm eager to beta-test your latest version but can't find it in the usual place. This is still beta 2.4 dated 7th Sept.

Thanks for sharing your talents with us Squidge. Keep up the good work. I love the configurability and only wish I could help with the GUI you envisage for it, but I'm just a mere novice as yet. With it's inbuilt intelligence RTA is a good teacher and point of reference.
Iwarez
09-18-2003, 01:38 AM
Thanks squidge, didn't know that.
squidge
09-18-2003, 03:28 AM
changes: 2.4 is still currently the latest version and contains everything described in this thread. However, since the board died on the 7th, the posts here vanished, so I reposted after the board came back.

RTA originally stood for RealTime Assembler, as it could assemble single lines simply and easily. However, it's much more than that now, but changing the name is probably not a good idea.
changes
09-18-2003, 10:52 AM
Hi Squidge,
Sorry about the confusion, my main concern was to investigate how you'd implemented the cut and paste function suggested by Iwarez, and I didn't see it functioning at all when I only tried to cut a one byte instruction!
On checking with 2, 3 and 4 byte instructions, however, the reason is that the last byte of the instruction is not cut!

I'm sure you'll put it right in the next release. Noping the cut bytes was really the only way to go.
squidge
09-18-2003, 06:31 PM
Thanks, this is certainly a bug, and it will be fixed in the next version.
squidge
11-12-2003, 07:19 AM
RTA 2.0 Beta 2.5 is now released at the usual place. Still as unfinished as the previous versions, but we are slowly getting there as and when I find the free time to work on it.
disavowed
11-12-2003, 12:55 PM
squidge, great work and all, but isn't it getting to the point where it would just be easier to write a quick plugin for ida to do all of this?
squidge
11-12-2003, 02:31 PM
squidge, great work and all, but isn't it getting to the point where it would just be easier to write a quick plugin for ida to do all of this?

Now, where would the fun be in that? ;)

Besides, I don't know how to write plugins for IDA, and don't have the SDK anyway.
disavowed
11-12-2003, 07:55 PM
Now, where would the fun be in that? ;)
Besides, I don't know how to write plugins for IDA
then i suppose the fun would be in learning how to write plugins for ida ;)

and i don't think you'd need the sdk (although it is easy enough to find). idc should suffice


Function as References
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Function as References
PDA

View Full Version : Function as References

Bengaly
08-24-2003, 08:22 AM
here is a small text i wrote in order to get a function as a reference to CALL XXXXXXXX or JMP DWORD PTR [XXXXXXXX] in a disassembler engine.
if anyone seen some missing information / or some wrong informative text please fix & reUpload (if u want ofcourse)
have fun.
squidge
08-24-2003, 10:38 AM
Not bad :)

However, the two bytes before the API function name is the hint, and not the Ordinal -

Offset
Size
Field
Description

0
2
Hint
Index into the Export Name Pointer Table. A match is attempted first with this value. If it fails, a binary search is performed on the DLL's Export Name Pointer Table.

2
variable
Name
ASCII string containing name to import. This is the string that must be matched to the public name in the DLL. This string is case sensitive and terminated by a null byte.

*
0 or 1
Pad
A trailing zero pad byte appears after the trailing null byte, if necessary, to align the next entry on an even boundary.

Other than that, it seems ok. I've only had a quick glance at it tho'

In RTA, I load the IAT into memory and go through each DLL, making a note of all the addresses of functions in a mapped array, so that if I see a direct (or in-direct jump), I can immediately display the api name and function name without doing a lot of searching.
Bengaly
08-24-2003, 06:15 PM
thnx, i wrote that text at 5 am ...
i know there are some need of midifications .


[Question] About C-Dilla SafeCast. Help!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > [Question] About C-Dilla SafeCast. Help!
PDA

View Full Version : [Question] About C-Dilla SafeCast. Help!

mikelong
08-24-2003, 09:07 AM
I`m trying to reverse c-dilla safecast these days. But the protecting system is so strong that I can`t even reset its installation time.
The size of the execution file is 8M. When executed for the first time, it will extract more than 10 files: CDAC11BA.EXE, CdaC13BA.EXE, CdaC14BA.DLL, CdaC15BA.sys, cdilla52.dll, IDE.csa, S0010409.cfg, Shell001.dll( version 2.11.60.0 ), drvmgt.dll, ~efe2.tmp, ~df394b.tmp, ~de7492.tmp, etc. (In fact, the tmp files are dll) then it`ll start a service named C-DillaCdaC11BA, and put a hidden dat file in C:\C_DILLA\SafeCast Product Licences\. Further more, the service will read sector 0 of physical_drive_0 and read/write the sector at the offset 4000h of physical_drive_0.
As to clear its installation flag, I deleted all(not sure) the relative key value in registry, renamed the .dat file in C:\C_DILLA\SafeCast Product Licences\, but how should I clear the flags at the offset 4000h sector of physical_drive_0?
Is there anyone experienced in c-dilla safecast protection system?
Could you tell me some info about how the protection system works?
Thanks!
evlncrn8
08-24-2003, 09:56 AM
licenses stored in hidden directory c:\cdilla
delete it
license stored on sector 3xh of the hard disk (the first hard disk i think .. it was c:\ for me)
erase the sector to all zeros (use a program like hex workshop to do it).. backup the sector before hand (on my pc it was sector 31h)
if it worked the time will be reset , if it doesnt work, restore the sector data you blanked and try erasing the next sector (you only have 9 max to do).. trial and error

from there you should have enough time to dump it and rebuild the imports (very similar method to safedisc2.. not surprising tho)

risc did a tool for an earlier version of safecast, you sould try checking that as well

have fun
mikelong
08-25-2003, 12:10 AM
I don`t know what is stored on that sector before I install the prog.
Does safecast search for an unused sector to store license?
I`m not familiar with the disk format, so I wonder if I erase that sector, there may be something important to my system lost.
Thank you very much for your info.
Any more about the tool of risc? No result at google :(
evlncrn8
08-25-2003, 01:32 AM
the sector is typically all zeros (thats why cdilla use it) ;)

as for riscs tool, try searching for his safedisc suite, inside that is his safecast tool.. try looking harder

and like i said, backup the sector, so that you wont lose anything
mikelong
08-25-2003, 01:57 AM
Yes, the installation flags are cleared. Thanks!
still several entries of IAT not fixed.
searching the riscs suite harderly
;)


problem with firmware on dsl route
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > problem with firmware on dsl route
PDA

View Full Version : problem with firmware on dsl route

4oh4
08-25-2003, 01:09 PM
My isp has locked down the dsl router that they sold me and refuses to give me the username and password to access the advanced config pages on the embedded web server. The manufacturer does not respond to voicemail or email, and googling shows me that other users have had this problem but nobody has posted a solution. BTW, I will not be violating their tos by gaining access to the router functionality of that modem/router.

Here's what I know so far:

The modem is made by Broadmax. It's a Linkmax HSA300A-2 dsl modem/router. It has an embedded web server with a browser user interface. It also has a telnet interface which is disabled, and according to my googling, the rs232 port connector was just snapped off at the solder point. My last resort will be to re-solder the connector and try accessing the equipment that way.

There is an http authentication on the page in question (username/password). Per the product manual, the username is arbitrary and the password is 'broadmax'. That doesn't work. I've contacted a couple of ex-employees of my isp and they don't know the username and password. There's no point in brute forcing, because I don't have a fixed username, or even know if there is a username for that matter.

There is also an option to upgrade the firmware from one of the config pages. Before doing so, you're prompted to download a 'recovery.exe' file, which is a rar'ed executable with several gif's and web pages, as well as several text-based config files and a couple of binary looking files. There is a copy of MS's tftp.exe renamed broadmax.exe. Then there is a batch file that tftp's all of the files to the modem.

I don't know much about tftp, except that it's used to read/write to upgradeable firmware. There are only two functions (get and put), and sadly no directory listing function. The instructions for the recovery files say to change the ip to '172.16.0.253', and then run the batch file. I guess I should note that the modem's ip (for all customers) is 172.16.0.254. I'm not sure if the ip change is necessary though, because I'm not sure if the tftp service can be locked down to only accept connections from a specific ip.

Anyways, from looking at the batch file I see that it first tries to 'PUT tfptlock.key', then 'PUT tfptupdt.beg', then PUT all other files, then finishes off with 'PUT tftpupdt.rbt' and 'PUT tftpupdt.end'. The tftplock.key contains 'broadmax' with a crlf. The other tftpupdt.xxx files are empty files that apparently just signify the beginning and end of the firmware upgrade.

I made a sample batch file that just put the .key, .beg, .rbt, and .end files with nothing else. I get an error saying that the authentication to the server failed after the .key put statement and then an error saying that the server wasn't unlocked for write after the other ones. So, what I was thinking was coding a brute force program that wrote the .key file, ran the tftp PUT .key and tested the return, and so on. It wouldn't be that difficult to code, and I wouldn't think that the password would be longer than 8 characters (26 letters, 10 numbers -- 36 to the 8th right?). What I'd like to be certain of before I try it though is does the ip of the connecting system matter? If it doesn't then this is looks like my best shot at brute forcing that password. Granted it wouldn't be nearly as good as unlocking the browser user interface, but I think I've figured out the file format of the nat config file in the recovery files, and if that works then I can just tftp that file everytime that I make changes which would be very rare once I get it up and working. I could also fish around blindly by get'ing various files. I know it doesn't sound like much, but I'm shooting blind here.

If anyone else has some ideas, I'm all ears.

cheers,
will

(I posted this on the RET board before I discovered that woodmann's board was back online. Good job on that btw!)
squidge
08-25-2003, 03:12 PM
Well, my first attempt would be to resolder that RS232 connector back on. Normally with equipment like that, should disaster strike (eg. it loses it's configuration completely, or the configuration gets corrupted), then the RS232 port is the only thing left that you can connect to. I've no idea on the protocol to talk to the type of router you mention, but there should be some kind of recovery software or "restore to manufacturer default" kind of software you should be able to run. Passwords for the serial interface are usually either non-existant, or whatever it states in the book and not changable (which would explain why they removed the plug).

As for your IP question, the connecting system doesn't matter, but they normally ask you to change the router to a specific IP so that there upgrade software talks to the correct box without asking you for the IP first, and prevents interruptions from other sources (personally, I think it's lazyness on there part, but hey...)

If you feel confident to setup the router from a manufactuer default setting, then I'd go with the serial port option, otherwise you can certainly try the TFTP option.

BTW, I don't know if this will apply to you, but on the routers i've played with, the web password has always been the same as the tftp password - so if you can break the tftp password, try and access the web interface using that same password and leave the username blank.
4oh4
08-25-2003, 04:10 PM
Squidge,

Maybe I should resolder the serial connector back on there. I myself haven't cracked the case to verify yet, but I found a post on another forum dated about a year ago that someone else was planning on trying that. I'll head over to radio shack after work. That's a ray of sunshine though! If it doesn't require a password, or if the default password of 'broadmax' cannot be changed, then that would explain why they were scared to leave it there.

Unfortunately, a hard reset will only restore the after-market firmware defaults (my isp). However, the default password for the browser user interface is the same as the tftplock.key password, so if I can brute that, maybe it'll work for the bui password as well. It would make sense.

Does anyone have any asm brute force algo (preferably masm)? If not, I'll just code my own.

thanks,
will
dELTA
08-26-2003, 08:18 PM
I might have misunderstood something here, but it seems like a lot of the questions in your original post could be answered quite easily by simply analyzing the traffic generated by a "normal" successful firmware upgrade, especially the authentication part. Or doesn't a "normal" firmware upgrade work either, is that what you're saying?

dELTA
4oh4
08-27-2003, 09:40 AM
No that works fine, but upgrades are run from an upgrade page on the embedded web server, and download files directly to the modem.
qweasdzxc
08-30-2003, 08:47 PM
In my general area our phone company was passing out ADSL modems with routers built in. The routers were disabled, and the modem was missing an RJ45 port. But we could access the modems diagnostic pages and change a couple of obscure settings. This would add a few pages to the diagnostics, then we were able to see the settings for the router and firewall.
4oh4
09-02-2003, 04:49 PM
My router was missing an ethernet (rj45) connector as well for the rs232 interface (db9 to rj45). This weekend I soldered the missing connector back on, but I'm still working on the pinouts for the cable. From looking through the product manuals I can't find any software setting to disable the rs232 port, so that's a plus anyways. I got about half finished with the brute force program before I realized that figuring out the pinouts for that cable was a better plan of attack.

qweasdzxc,
The page with the advanced settings is password protected unfortunately.

When I get the pinouts I'll be posting all of the info somewhere so everybody else will have an easier time with this stuff.

will
squidge
09-02-2003, 06:04 PM
I would have thought it would be standard serial comms - ie. pins 2 & 3 for data and 5 for ground. Maybe a full for handshaking, but most seem to be null modem type connection.
4oh4
09-06-2003, 09:21 PM
I've found the pinout, and can now access the console port cli. I've enabled telnet, and figured out some of the nat commands. The cli reference pdf on the manufacturer's website is seriously lacking. Fortunately, a lot of standard router commands (which aren't documented) work on this one. The good news is that I've also found (through muddying around in the router) the password for accessing the bui setup page. It's the same password used for telnet, and tftp. There's no built-in tftp authentication method, but in order to 'unlock' it for read/write access, you have to do a 'tftp put ip.ip.ip.ip tftplock.key'. That plaintext file has to have the correct password in it, or tftp returns an error. Oh, and after entering the corret password in the http authentication dialog for the setup page, it just kicks you back to the main page. Those assholes took out the bui interface for some of the advanced stuff. Luckily, I've now got the console and telnet interfaces working now.

cheers and thanks for the replies,
will


For all NEwbies Spècialy Spanish Crackers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > For all NEwbies Spècialy Spanish Crackers
PDA

View Full Version : For all NEwbies Spècialy Spanish Crackers

profesorx
08-25-2003, 04:24 PM
i have my webpage whit many many interesting tools and tutorials about 1000 tutoriasl and tools too

if you want to sedn me your new tools for publicate this in my webpage como on

i waiting for you.
Aimless
08-26-2003, 12:38 AM
Amigo,

Are you sure you not related to Aaron?

By the way, its a real bad idea to have Ida 4.30 zipped for download on your site. Pierre is not in a good mood these days, and will probably take your site and you down. Of course, it could be legal in Spain/South America. Then Pierre will have to drag you to international court....:)

Have Phun


this one is a tuff 1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > this one is a tuff 1
PDA

View Full Version : this one is a tuff 1

King L
08-26-2003, 04:25 AM
hey, i went to a practice cracking site the other nite and passed some of thier tests. but wen i went up a lwvel, i was stumped. i dunno how to get pass a password protected executable. i'm using pe explorer 1.93, hex workshop 4.1 and ultra edit 3.2. these are the onluy programs who's interface is easy to comprehend. what should i do to get pass the password? i thought i found it but i didnt. i used a tutorial i found on neworder.box.sk but that just rendered the archive unreadable. if you can help, feel free. if you want a oprogram, i have aqbout 9 or 10 of these. email me andf maybe we can co-op on these program's arses!!
evlncrn8
08-26-2003, 07:40 AM
using softice and debugging it might be a good idea


Armadillo Hardware ID
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Hardware ID
PDA

View Full Version : Armadillo Hardware ID

squidge
08-27-2003, 02:44 PM
Does anyone know anything about how Armadillo calculates this ID? I know the various components that make up the ID, but I don't know how the hardware id itself is actually calculated.

What I'm trying to do is this - I have an Armadillo protection application that has no default certificate, so can only run by entering a valid registration code. I have a valid registration code, and the program itself, and the original hardware ID (fingerprint). I trying to find out how to get the program to run on a different machine without paying out another £800 for another license. The authors of the software refuse to transfer the license to another machine, and the old machine is no longer operational.

So my guess is that since I have all the ingrediants (software, hardware fingerprint, registration name & code), I should be able to fool the loader into generating the same fingerprint to allow the registration code to be used on the new computer.

Any ideas?
squidge
08-28-2003, 12:10 PM
Well i've now fixed the problem - I've faked the hardware id so Armadillo thought it was the original computer and then to prevent it reoccuring, I've removed the program completely from it's Armadillo shell, and then reprotected it with Armadillo, but with my own key so I can easily generate more keys if necessary :D :)
volodya
08-28-2003, 02:36 PM
I feel you ought to send this info on my email. You know me as "volodya" on exetools forum and you now my email address %)
dELTA
08-28-2003, 06:19 PM
I feel you ought to send such personal messages in PMs. :)
squidge
08-28-2003, 06:37 PM
Volodya :

Really there's not much to say. It was only easy because I just butchered up a version of my Armadillo unpacker, and modify it to change the value of particular processor register at a certain place in the unpacking phase, so the hardware id would always be the same. It was then registered with the original registration information and unpacked like a normal program by my unpacker. I then packed it back up using Armadillo again, but using my key this time instead of the authors :)

It would be a lot more involved without my unpacker, and since I'd rather keep the unpacker private, there is really not much more to say about it. The method is not generic in any shape or form, but since I only wanted to do this to one program, it was very easy as I was using direct memory addresses. It would be a lot more complicated if I tried to make it generic.


PE Tools by NEOx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PE Tools by NEOx
PDA

View Full Version : PE Tools by NEOx

volodya
08-28-2003, 02:34 PM
The tool stands for process dumper. Very new, very cool - import rebuilding, relocations rebuilding (crazy algorithm), resources rebuilding and so on, so on. I put it on my site - wasm.ru - as usual. Main official site is uinc.ru. Also has some other unofficial pages...
Any comments, bug reports or suggestions of improvement to be posted here :)
pLayAr
08-28-2003, 04:47 PM
but i would like to see that it display "eb eip xxx" in softice too (break & enter) just like lordpe does,:)
volodya
08-28-2003, 05:14 PM
Will do it.


Shirt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Shirt
PDA

View Full Version : Shirt

disavowed
08-28-2003, 05:35 PM
Hahaha..

I wore this shirt around campus today for the first time:
http://www.thinkgeek.com/images/products/front/lg-reverse-engineer.jpg
(http://www.thinkgeek.com/tshirts/coder/31fc)

I never got so many funny looks in one day!!
squidge
08-28-2003, 06:23 PM
I'm not suprised :eek:
Kythen
08-28-2003, 06:39 PM
Hehe, it's one of my favorite shirts! :D

Though when I wear mine, it usually takes people a while to figure out what the hell it even says :P
Kayaker
08-28-2003, 06:57 PM
Lol, I'm wearing mine now!
Js
08-29-2003, 01:20 AM
I went out with mine on inside out and nobody gave me a second glance. funny, it looked ok in the mirror.
drunkenmaster
08-29-2003, 01:12 PM
>> Though when I wear mine, it usually takes people a while to figure out what the hell it even says :P

I wore my re shirt once on a party ... most drunken people failed to figure out what it means ;)

Greetings
drunkenmaster


Race 2.9
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Race 2.9
PDA

View Full Version : Race 2.9

sarge
08-29-2003, 04:06 PM
All (who are interested)
I have been getting a lot of requests for RACE, apparently because of discussions of it on other MB's. Currently, my system is down due to the Blaster virus, but should be up again this weekend. Please be patient, your requests will be honored ASAP.

(Note that some of you own me your email addresses before I can send it to you)

Thanks
Sarge
dELTA
08-29-2003, 04:58 PM
For the people who don't read these other messageboards, what is this "Race"?
sarge
08-29-2003, 05:04 PM
It's a VB6 investigation program. It analyzes a VB6 program and extracts the graphics elements (BMP, GIF, ICO, etc), and some control info (control type, colors, position, etc) and shows the events and libraries and etc.

The "other" MB was originally decompiler.com, but that site has died and I have no home for RACE yet.

Sarge
asmworkshop
10-20-2003, 11:56 AM
Check your PM please.
dELTA
10-20-2003, 02:30 PM
Ok, I just checked my PM, and there was nothing new there?! What kind of scam are you running here? :D
asmworkshop
10-20-2003, 03:54 PM
Ok, I just checked my PM, and there was nothing new there?! What kind of scam are you running here? :D

No scam. Message was for sarge :D
sarge
10-20-2003, 03:57 PM
No scam. Message was for sarge :D

Checked and replied. Thanks
sarge
asmworkshop
10-20-2003, 04:08 PM
Thank You
JMI
10-20-2003, 04:12 PM
And dELTA knew that all along and was just having some fun (and padding his post count. Heck no, I wouldn't do that.) :D

Regards.
asmworkshop
10-20-2003, 04:56 PM
I know :-D


About Stolen Bytes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > About Stolen Bytes
PDA

View Full Version : About Stolen Bytes

cyclotron
08-30-2003, 10:06 AM
Hello!I'm a newcomer to ASProtect.
Recently I've been trying to unpack some asprotected programs.After reading some of the tuts about unpacking here I still found it difficult to understand how the tricks of stolen bytes works(Probably for my incompetence),in which case I decided to make a test by myself by asprotecting the notepad program from win98,but I wasn't able to make ASProtect v1.23RC1 generate some so-called stolen bytes.I really wonder how I should configure the options to do that.Maybe you can help me...
Thanks in advance.

cyclotron
2003.8.31
sonkite
09-06-2003, 09:56 AM
I think only the registered version of aspr does 'stolen-byte'
cyclotron
09-06-2003, 10:29 AM
thanks.
Then how can I proceed with that test?
Hope someone would be kind enough to provide me with such a notepad copy...^_^


interlok protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > interlok protection
PDA

View Full Version : interlok protection

LiSa
08-30-2003, 11:01 AM
hello, I am currently working on an application protected with latest pace interlok protection.
Debbugger detection is made by a device driver TKpd.sys which currently detect softice, ollydbg and windbg and as soon as action is taken reboots the computer.
I read tshep essay about installshield 6 but his approach don't work now.
the TKpd.sys also perform runtime crc to prevent patching.
has someone a clue to help me bypass debugger detection ?
thanks+
LiSa
naides
09-01-2003, 08:28 AM
Originally posted by LiSa
hello, I am currently working on an application protected with latest pace interlok protection.
Debbugger detection is made by a device driver TKpd.sys which currently detect softice, ollydbg and windbg and as soon as action is taken reboots the computer.
I read tshep essay about installshield 6 but his approach don't work now.
the TKpd.sys also perform runtime crc to prevent patching.
has someone a clue to help me bypass debugger detection ?
thanks+
LiSa

LiSa or some one else.
Could you PM the name and/or URL of this InterLok and TKpd.sys protected app?

Thank you.
OHPen
09-01-2003, 01:32 PM
me too , pleaz,

OHPen@gmx.de
dELTA
09-02-2003, 07:01 AM
For everyone wondering where the driver reversing posts in this thread went, I just started a new mini-project about this subject, and moved them to that thread. It can be found here (http://www.woodmann.net/forum/showthread.php?s=&threadid=4992). You are all very welcome to follow, join and contribute to this project!

dELTA
maintain
09-05-2003, 02:43 AM
set only one bpx at a time , and unset immediately after it breaks, then set new bpx and so on

do this until app is unpacked in mem then dump, sort reloc, and sort out any api stuff still remaining

demo stuff is done via a checktoken pace api which returns true/false, sometimes the pace uses the resources of the paced file to decrypt at runtime im sure you can figure a way around this
:)

alternatively u can hook kernel api and use this to dump without even using debugger
maintain
09-05-2003, 02:50 AM
i forgot to add

DONT TRACE THROUGH THE APP !!! one bpx, unset, next bpx, unset

no F7,F8 etc
LibX
09-28-2003, 09:00 AM
Check astalavista.box.sk 4 my patch ;)
After u apply the patch first start softice otherwise the program will give u a bleu screen
LiSa
09-28-2003, 02:14 PM
Hey LibX,
A patch??, for the TPkd.sys ?? for an application ? tell me more...
I don't want the pace protected application (You can use UCF unpaker to remove pace shield then easely
patch the paceuilui calls and restore limitation.=)

What I want is control and emulate the Tpkd.sys as we already do for dongles.

I explain now my tpkd.sys trace results. does someone experienced with such a protection?

i quickely found the TPkd_internal_dispatcher and put a bpx on it.

the tpkd.sys is first called by the pace dll with deviceiocontrol with 70060 as control code
After browsing this control code ([irpstack+38h])dipatcher lead us to sub_10A32.

starting from this point we enter a massive call imbrication where each call leads to an another call
with a good control flow obfuscation, look a this sample:

.text:00011286 sub_11286 proc near ; CODE XREF: sub_11276+8p
.text:00011286 55 push ebp
.text:00011287 8B EC mov ebp, esp
.text:00011289 68 7C 25 01 00 push offset sub_1257C This will be the call n+1 location
.text:0001128E 6A 01 push 1
.text:00011290 B9 10 C2 01 00 mov ecx, offset Tpkd_Control_Object_unk_1C210
.text:00011295 E8 02 F6 FF FF call Hide1_sub_1089C
.text:0001129A E8 1B 06 00 00 call MACILACI_sub_118BA
.text:0001129F 5D pop ebp
.text:000112A0 C3 retn
.text:000112A0 sub_11286 endp

then, at the end of MACILACI_sub_118BA :

text:000119E2 6A 01 push 1
.text:000119E4 B9 10 C2 01 00 mov ecx, offset Tpkd_Object_unk_1C210
.text:000119E9 E8 0C EF FF FF call show_from_hide1_sub_108FA show the n call location
.text:000119EE 89 45 FC mov [ebp+var_4], eax
.text:000119F1 68 3C 1E 01 00 push offset sub_11E3C this will be the n+1 call location
.text:000119F6 6A 01 push 1
.text:000119F8 B9 10 C2 01 00 mov ecx, offset Tpkd_Control_Object_unk_1C210
.text:000119FD E8 9A EE FF FF call Hide1_sub_1089C
.text:00011A02 FF 55 FC call [ebp+var_4] : offset sub_1257C !!!!!
.text:00011A05 5F pop edi
.text:00011A06 5E pop esi
.text:00011A07 5B pop ebx
.text:00011A08 C9 leave
.text:00011A09 C3 retn

at the end of the whole call chain is the last call [ebp+var_4] :

.text:00010994 Finish&go_back_sub_10994 proc near ; DATA XREF: sub_11E3C+89o
.text:00010994 ; .text:0001850Bo
.text:00010994 55 push ebp
.text:00010995 8B EC mov ebp, esp
.text:00010997 5D pop ebp
.text:00010998 C3 retn
.text:00010998 Finish&go_back_sub_10994 endp

during this call call lot of weird things are done prodected by simple SMC or
push code on stack_loc / call stack_loc

basically

out 70,80
in ah,71
out 70,0
which means retrieve RTC second (RTC1) in al with NMI disabled (Am I right???)
then
in al, 21
which means retrieve PICW1 status in al w (Am I right???)
after that a new TPkd_control_object is created
an sidt retrieve IDT base
the int 1 and int 3 are patched by a crude jump to tpkd code at their beginning :
8:80465A96 jmp sub_11252 !!!

after that again :

out 70,80
in ah,71
out 70,0 to retrieve a second RTC : RTC2

then RTC2 and RTC1 are compared and accordinglely one of the following is pushed for call n+1
sub_118FE (endless loop, freeze application) or sub_11FFA (mysterious) or sub_11ac2..

with softice on (so we are detected..) we take sub_11ac2
basically this sub
out 70,80
in ah,71
out 70,0 to retrieve a third RTC : RTC3
int1 handler is putted in dr0
int3 handler is putted in dr1
dr2 received 1f85c unknown loc
dr3 receive RTC1RTC2RTC3
and dr7 is put to 70703 wgich is not good : break on int1!!, doing that burn softice to death

What I did is :
confuse TPkd with int1 and int3 handler and clean dr7 to protect my softice
then.... I falled into endless_loop_sub_12500
I patched it to Finish&go_back_sub_10994 and I land again in deviceiocontrol with 70080 as service code
the Tpkd dispatcher then go through a dummy proc which lead to a page fault
I redirected the flow to the tpkd_int1_handler_sub_11252 but I crash my computer again (maybe the stack
was not clear or an important flag was not set)

can someone tell me if I am on the right way with this intersting drivers

bye
LiSa
LiSa
09-29-2003, 12:23 PM
Hello Libx,
your patch is for TPkd.vxd (A345 size) ie version 2, now the Tpkd driver is .sys and version 4 or 5 (DBB1 size).
So your patch can not apply
Also this patcher Nop the call [ebp+var4] inside macillaci_sub and RET the keyboard reset subroutine. Things have changed, this is not enough now....


Fetch text from RichEdit control
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Fetch text from RichEdit control
PDA

View Full Version : Fetch text from RichEdit control

emidge
09-01-2003, 07:56 AM
Hello!

Getting text from anothers app via clipboard is easy. See e.g.
h**p://www.codeproject.com/cpp/msnchattext.asp?target=msn

The fun starts here.

How can one *continuoulsy* grab the text *without* clipboard?

Using EM_STREAMOUT and a callback functions would be fine but doesnt work. Why?

But how can this be done?

Your suggestions and source code appreciated :-)
I prefer simple solutions ;->

emidge
dELTA
09-01-2003, 11:48 AM
Do you only want to grab the text from the clipboard, or rather grab all keyboard input? In the latter case you can create a keylogger with e.g. a Windows hook.

dELTA
disavowed
09-01-2003, 12:31 PM
Originally posted by emidge
Using EM_STREAMOUT and a callback functions would be fine but doesnt work. Why?

Assuming your code is correct, this probably means that Windows requires that the parent (of the RichEdit window) process sends EM_STREAMOUT and/or the callback function is in that process's address space. In this case, you would need to do remote process/code injection.
emidge
09-02-2003, 03:29 AM
Thanx for your answers.

To clarify things
..) the app steadily adds new lines to its RichEdit Control and purges the old ones.
..) the data is received from the net.
..) there is no need for a keylogger.

OK. One could directly patch the app, or poll the clipboard each and every second and merge the new lines with the previous ones.
But I would like to do it more elegantly. :)

So I came across the streaming functionality, which works perfect for my own app that uses a RichEdit control, but crashes the other app.

I also had the idea of code injection.
I read e.g. the recently published article on codeproject mentioned here on the board.
But I can not put the pieces together.

Any (other) ideas how to grab the text are appreciated.
Also working example code :D
disavowed
09-02-2003, 10:01 AM
Originally posted by emidge
..) the data is received from the net.
...Any (other) ideas how to grab the text are appreciated.packet sniffer


Multiple data-windows in SoftICE/Video problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Multiple data-windows in SoftICE/Video problem
PDA

View Full Version : Multiple data-windows in SoftICE/Video problem

bFro
09-01-2003, 09:49 AM
I got the SICE 4.30 from the new DS. Using it a some time, I found out that you can have now up to five data windows instead of just one. You must simply append the number to the command WD[.0-.5] (ex. "WD.2" -> show/hide data window #2)

But the EB,EW,ED,... and DB,DW,DD,... commands don't have this extension, so everytime when I edit or show a address, it is always done in the first window (WD.0). Its no use to have five data-windows if four of them always show 00000000h as address. And pressing PgDown millions times is no good.

The manual doesn't tell you anything about it. It doesn't even tell that the WD command was extended. (maybe they didn't update it yet) I did search here but found nothing about it. (I read FAQ!!!)

Can any body here tell me if I missed something or if this is a error from Numega?

The other question is when I use SICE on W2K with the universal video driver, the installation disables the boot logo. SoftICE works fine this way, but I cant see anything which normally happens on the boot screen (ex. CHKDSK, boot time defragmenter, press a key to continue,...).

When I enable the boot logo again, I will see what going on at booting, but when I switch to SICE from my desktop, the SICE window will have a totally damaged font and I only see black and blue points. If I have a command line running, this font will be also damaged. I have SP3 of W2K and the SICE video patch for SP4 doesnt fix this too.

Can any body help me here too?
bFro
09-03-2003, 05:35 AM
Hello...?
I dont know what I did wrong. After the FAQ I should search first. I did search here and now did it again with no results. I did not post any target code. I used the name, but it is not a "target", but a "tool", like on the home page "Questions concerning tools only. SI". I think SI is SoftICE. I didn't mail or private message a moderator and ask for warez.
I explained my problem, there is no protection, I said what tool I use, I did not read any tutorial for the reason that I found non and since this is a new SICE function with the multiple windows and it is not in the manual, I dont think that there are tutorials at this time. There is no output listing to show or comment, so I followed all the FAQ (most links there are very out of date or work not). I also think I didn't ask a stupid question.

So why did nobody answer me?????
dELTA
09-03-2003, 07:08 AM
One reason might be that very few people have had the time to install this new version of Softice yet.

Another reason might be that the few people that actually have done it cannot magically find features that are (allegedly) not in the manual more than you can, and are not willing to read through the whole manual looking for it just to help you.

A third reason might be that Softice has indeed supported multiple data windows since at least version 3.x (although not simultaneously displayable, but anyway), and that people think you should have found the "DATA" command in the manual yourself before asking. :)

As a rule of thumb, you can always assume that if you get no answer to a question, it was either too stupid or too hard (or both :)). If you break the rules in the FAQ, there will normally be at least some kind of flame from someone as a reply. :D

dELTA
ZaiRoN
09-04-2003, 08:22 AM
Hi bFro,
are you able to use the mouse under Softice? You can switch from a data-window to another data-window selecting the data-window with the mouse...

Best regards,
ZaiRoN
bFro
09-04-2003, 09:11 AM
@dELTA:
What about you install the new SICE before telling me some shit?
Then you would not tell me about allegedly not existing things. The manual (DriverStudio 3.0.0, PDF, March 2003) clearly says:

Toogle the Data window open or closed; and set the size of the Data window.
WD [+ | -] [window-size]

You see? It says not "WD[.0-.5] [+ |-] [window-size]". And it also says "the Data window", which is not plural, so it only knows one data window.
I did not ask people to read manual for me since I did this myself and have no answer for my problem.

Your information about the DATA command is also not right. The manual says "Only one Data window is visible at any time". But this is wrong, the same way as the missing WD parametrers. SICE 4.30 can show up to 5 data windows and all at the same time. Using DATA will switch to the window with the number you used and keep the other windows on screen, so I can use Alt-D to switch to this window, but a "D 407000" will always change the showing of the first window.

So that you can not answer my first question and do not answer my secound and no flames are here I think the question is too hard and not too stupid at least for you. So if you have a newer manual than show it to me. For somebody who is moderator and names himself administrator you show not much knowledge!

@ZaiRoN:
Yes, I can use the mouse to switch between the windows. I did it all the time because it is faster then the DATA command. But the problem is the same. Four windows show always the address 00000000h and the only way to change this is by pressing PgUp and PgDown when having this windows active. This is not practical to get from 00000000h to 00407000h as example. I know of the DEX command but it is a pain to handle with it without macros.
ZaiRoN
09-04-2003, 09:37 AM
but a "D 407000" will always change the showing of the first window. Not for me... 'd xxxxxxx' changes the contents of the data window with the focus and not the first window...

ZaiRoN
bFro
09-04-2003, 10:00 AM
That is strange... I can have highlighted every window I want (with DATA or with mouse), but "D" and "E" always end in the window with number "0" and the other one still keep the focus.

I just downloaded the official DS 3.0 command reference from May 2003 from the official homepage and it still has no mention of the changed WD command and DATA still only shows one window at a time they say.

But you can see more then one data window not like dELTA says?
ZaiRoN
09-04-2003, 04:24 PM
But you can see more then one data windowSure!
dELTA
09-04-2003, 08:27 PM
What about you install the new SICE before telling me some shit?
That is exactly what everyone else did (i.e. not tell you shit before installing that version), and that was exactly what I tried to explain to you as one of the reasons for the lack of replies.

But you can see more then one data window not like dELTA says?
Err, I'm not really sure what this is supposed to mean, but I'm quite certain it's just some lame attempt to put words in my mouth and shift the focus from the fact that I was right and you were wrong about the DATA command (yeah, sure, it's only in your copy of Softice that it won't work).

So that you can not answer my first question and do not answer my secound and no flames are here I think the question is too hard and not too stupid
Well, that would still be completely in accordance with my boolean statement about when a post will get no replies. Btw, asking "hard" questions is not necessarily a good thing.

For somebody who is moderator and names himself administrator you show not much knowledge!
Please look up the words "moderator" and "administrator" in your thesaurus. I'm quite sure that there will be no mention of having to know the Softice manual by heart to earn those titles, but probably rather something about explaining to stupid people why nobody replies to their posts, and keeping the board safe from people with too much attitude and too little own contributions.

dELTA
sope
09-05-2003, 01:14 AM
bFro
For somebody who is moderator and names himself administrator you show not much knowledge!Show us your much much knowledge. we all will like it for sure. Frankly members of this board reversed tough targets using single data window why you require 5 data windows just bcos they have it in new version of softice ? can't you live with the one or R u a beta tester for them ?

Also before making your *funny* statements towards any moderators or rather any members who are gems of this forums, please take your time read & understand their posting. If you have common sense (which is lacking in many of them) ask your self who has more knowledge, you'll get the answer.

sope.
esther
09-05-2003, 01:39 AM
>The manual doesn't tell you anything about it. It doesn't even tell that the WD command was extended.

So you can only see the only edit data window.The manual is straight forward.B]5 DATA WINDOWS[/B] IS A NEED OR WANT?
bFro
09-05-2003, 06:38 AM
@dELTA:
Why did you not tell me that you did not have the new Softice? You did not tell that you have it but I thinked it since your answer looked like it, so this was a missunderstandment.

You said that the DATA command can only show one window at the same time. The manual said the same. You and the manual are wrong. The DATA command opens the window if needed, but can not close it again.

Then it was a hard question but where must I ask hard questions then? The other forum is named "advanced reversing and programming", not about tools.

The main page says that you are moderator for this forum so you should know something about Softice or else it is not only wrong forum but wrong messageboard. And the administrator job is to look after the computer and not the posts.

And what you want with "own contributions"? You want to see how a Softice disassembled looks or what?

@sope:
Tell me what knowledge you want to know and I will if I can! I am not beta tester for them and I lived with one data window all the time but its more easy with more windows so you can put one for to see when code is decrypted and one for the IAT and one for the data section and one to follow the protector memory moving and the other one if you need it and using BPM on them help you much with only affect that your code window is small.

And what you mean with "funny statements"? I know that my english is not good but I went to school when it was not possible to take english as language there. And who are the gems of the forum here? Just take a look a the member list and the first ten. Where are Kayaker, DakienDX, tsehp, evaluator, squidge, JMI, Woodmann, crUsAdEr, foxthree and nikolatesla20? Did they answer me anything? Do they know the answer?

I think I have common sense, but the people without have a different definitition of it so that they have it also. How can I answer who has more knowledge if I dont know them?

@esther:
The manual says you can only see one window at the same time. But the new Softice 4.30 has a new WD command so you can have up to five windows (even if the command help only shows you up to four). The problem is that you can see five windows on the screen, but you (or at least my version) only changes the address of the first window when using the "D" or "E" commands.
naides
09-05-2003, 07:27 AM
Two steps back.
Look at the contents of the postings
Looking at the mood.

Let us not get into another pissing contest. This thread should be moved to the Numega support board for the short fused/emotionally unstable,

and stop feeding the troll.
dELTA
09-05-2003, 07:38 AM
1.
I most certainly did not say that "the DATA command can only show one window at the same time", you really should read my post again.

2.
And where should you ask "too hard" questions? The answer is: nowhere. A question being "too hard" probably means that people would have to spend too much time doing research for you to answer it, research which you should instead do yourself. Another good tip is not to start whining about people not answering your questions, but instead think about what's wrong with the question, do the research yourself, and then possibly return with a rephrased set of questions. It's probably a pretty bad idea to start offending people who just gave you the correct answer too.

3.
Please look up the words "moderator" and "administrator" in your thesaurus again. If necessary, look up the word "thesaurus" in your dictionary first.

4.
To prevent any further "missunderstandments" or flamewars, this thread is now closed. If you still want to get kicked from the board really badly, you can PM me. :D

dELTA


OpenSCManager Controller PseudoTool (+ KMD Programming Example Package)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > OpenSCManager Controller PseudoTool (+ KMD Programming Example Package)
PDA

View Full Version : OpenSCManager Controller PseudoTool (+ KMD Programming Example Package)

Kayaker
09-02-2003, 01:05 AM
Hi all,

As was mentioned, there seems to be an increased interest in the topics of Win2K system services and driver programming in general, and I've been working on some stuff that might be of some use. Doug has discussed debugging the OpenSCManager via EnumServiceStatus and its tortuous path to NdrClientCall2, only to disappear into oblivion...

I wanted to look a little closer at the associated ENUM_SERVICE_STATUS_PROCESS structure which contains the name and information about a service and its status, to see what might be uncovered. So I developed a test app which enumerates all the Win32 and Driver Services running on a system and returns each field with descriptive flags from the two Service Control Manager structures, ENUM_SERVICE_STATUS_PROCESS and SERVICE_STATUS_PROCESS.

A right click menu on the listview allows for starting or stopping a service. This is not meant to be a full fledged Service Control Manager, just an exploration into the code required to handle the SCM and an informational package. Starting or stopping some services may produce unpredictable results, but DeleteService is never called so important registry entries are not removed.

There is an included file JunkTest.exe which loads a kernel KMD driver I wrote for testing. These files are a complete example of writing and debugging a KMD in MASM that might be useful to some. All commented source code and notes is included for both projects and the programs are compiled with debug information and include the NMS files. While the KMD code is a distillation from several sources of information, the MASM KmdKit1.2 from Four-F and much study is required for anyone interested in programming KMDs.

There still needs to be study in how SERVICE_WIN32 services are handled differently from kernel SERVICE_DRIVER services, and how other system calls such as NdrClientCall2 are used to gather the information returned in the SERVICE_STATUS_PROCESS structure, as part of the
user<->subsystem communication system. Lol, for now it was just a funky project ;)

Have fun with it and let me know if there are any problems.

------------------------

I'm happy to include an unpublished KMD tutorial from Clandestiny around which I initially based my KMD development and shamelessly ripped code. It's a nice summary of what you need to know to get started along with many linked function descriptions ripped from the DDK for those without. I will up the attachment in the next post.
Kernel Mode Driver Tutorial: Part I: “The Skeleton KMD”
by Clandestiny

Anyone familiar with VxD programming will find that many of the basic concepts are similar and carry over to KMD writing, the main difference being the rash of new and often undocumented functions. To go beyond the basics and the DDK there are these 3 books and newsgroups that are indispensible.

Programming the Microsoft Windows Driver Model 2nd - WalterOney
Prentice Hall - The Windows 2000 Device Driver Book - Guide For Programmers 2Ed
Undocumented WinNT - Prasad Dabak et al.

microsoft.public.win32.programmer.kernel
microsoft.public.development.device.drivers
comp.os.ms-windows.programmer.vxd

Good luck,
Kayaker

attached OpenSCM_Controller.zip w/ KMD example source 250K
Kayaker
09-02-2003, 01:06 AM
And thanks to Clandestiny for sharing, and a home for a wayward tut...

Kernel Mode Driver Tutorial: Part I: “The Skeleton KMD”
100K
esther
09-02-2003, 01:42 AM
the kmdtute rar is corrupted or only me? ;)
bbbsl
09-02-2003, 01:59 AM
thank you ...but .uh..
It seems that the kmdtutorial's package was corrupted...:(
Kayaker
09-02-2003, 03:11 AM
Oops, Don't know what happened, I rezipped and reuploaded the file, it seems OK now.
dELTA
09-02-2003, 07:04 AM
For everyone following this subject, please continue your discussions in this new mini project (http://www.woodmann.net/forum/showthread.php?s=&threadid=4992) that I just started for driver reversing.

It's really about time we went deeper into this subject to keep up with the protectors, I hope many people will join and follow this one!

dELTA


Driver reversing and defeating (WDM, not VXD)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Driver reversing and defeating (WDM, not VXD)
PDA

View Full Version : Driver reversing and defeating (WDM, not VXD)

dELTA
08-30-2003, 07:34 PM
As mentioned recently in several other threads on this board, device drivers like this really seems to be quickly becoming very popular in protections, and give lots of people around here major trouble. I.e., a new interesting field of protections that needs to be explored and conquered. :) Seems like we will need to breed some new talents who will be to driver reversing what Splaj and the gang was/is to unpacking... :D

How about some more serious driver protection technique projects, e.g. in the Mini Project forum? Do we have any people who are driver knowledgeable enough and willing to submit crackmes and similar teaching material to get such a thing started? Kayaker? ZaiRoN? Anyone? What do you all think of this?

Just a thought anyway, but it seems to become more and more clear what the future of advanced protections is going to be...

dELTA
sope
08-31-2003, 03:11 AM
Hello Everybody

Four-F tuts on how to write device driver is *worth* reading. Here's the link
http://www.masmforum.com/website/tutorials/kmdtute/index.html
for those who don't know After reading & understanding i guess we know how a driver is loaded, its working & how to set break point on driver called proc. In short its an excellent stuff for reading & understanding about drivers.

Regards, Sope.
dELTA
09-01-2003, 06:14 AM
Seems like a very good start, thanks for the link sope!

Now go read them, all of you. :)

dELTA
hobferret
09-01-2003, 02:53 PM
Very interesting stuff:)

It will take a while to read, study and inwardly digest:confused:

I am sure we will get to grips with it sooner rather than later:cool:

great link sope thanks for that!

/hobferret
JMI
09-01-2003, 03:50 PM
Seems to be down at the moment. Hope their back up soon.

Regards,
dELTA
09-01-2003, 04:28 PM
Fear not, here they are. :cool:
dELTA
09-02-2003, 06:54 AM
Kayaker just posted a nice example project (including source) in this thread (http://www.woodmann.net/forum/showthread.php?s=&threadid=4991). It deals with Windows 2k/XP services and kernel mode drivers (that is, WDM drivers, contrary to the older VXD drivers that at least a few more people are knowledgeable about, but which are practically dead today).

An unpublished driver tutorial by Clandestiny is also included in that thread. So what are you waiting for, go get it (http://www.woodmann.net/forum/showthread.php?s=&threadid=4991)! :)

It would be good to initially use this thread (i.e. the one I'm writing in right now) as the center of all ideas, questions, projects and such regarding driver reversing and programming, so that it would be easy to follow for everyone interested. As mentioned in my original post in this thread, driver reversing is becoming more and more essential in todays protections, so it should be quite interesting for many serious reversers. Let's try to make this a fun and educational project!

dELTA
squidge
09-02-2003, 08:37 AM
Well, I'm certainly interested as I want to write my own driver-based memory dumper :)
doug
09-02-2003, 06:54 PM
I'd like to point out the following link:

hxxp://www.orgon.com/w2k_internals/cd.html

It contains various utils and source code related to Windows Internals.. such as:
- SC Manager functions, listing services, etc.
- an hooking device driver that allows to spy on kernel APIs.
- debugging interface: pdb, psapi, imghlp stuff
- a memory spy device, to read from any address you like.
[...]

It comes with a book, but the utils are available for download from the website. Some utils (those using undocumented functions) might not work "out of the box", but with a few fixes, they work again.

It is interesting because:
- Source code is included
- Includes a driver skeleton for ms vc++
- It contains both kernel and user mode software.
- They are tools mainly aimed at reverse-engineering.

An excellent learning utility.
dELTA
09-02-2003, 07:29 PM
I might very well just be blind, but where did you find the source code on that page? I can only find the binaries in downloadable form, and then some text saying that the source is available on the actual CD?

Seems like very interesting stuff though, especially the API-spying/hooking part, and some of the other things too, so it would be very nice indeed to have the source for it.
doug
09-02-2003, 07:39 PM
oh, my bad.. I did not actually test the thing..
I own the book.. and it ships with source on the CD..

I assumed it was the same deal on the website.

Besides it's usefulness, I guess it can be used as a RE target =D
nino
09-04-2003, 02:23 PM
well doug
don't you feel committed to up the CD to the ftp site? :)
(You gave the link after all)
Kayaker
09-04-2003, 04:03 PM
We'll take that last comment as a joke, better to reverse the exes, learn more, steal less ;)
[yAtEs]
09-05-2003, 08:54 AM
perhapes a new forum section on the subject of system coding etc
would be greatly welcomed by some :-)

im soon to publish some of my own stuff and beginner templates
on my site in the forth coming weekend,

regards,
yates.
dELTA
09-05-2003, 09:02 AM
The "Advanced reversing and programming" forum is meant for such things, but if this subject grows big we can eventually give it a completely own forum, sure. A thread like this in the mini-project forum is a good way to organize a smaller subject until it grows into its own forum though. :)

Sounds great with your upcoming publications, looking foward to them! Please announce in this thread when they are released.

dELTA
[yAtEs]
09-14-2003, 01:12 AM
okey dokey,
updated* http://www.yates2k.net/syscode.htm

yates.
dELTA
09-14-2003, 11:59 AM
Looks very nice and useful, thanks yAtEs!

dELTA
dELTA
09-14-2003, 12:03 PM
Also make sure to check out these great resources (http://www.woodmann.net/forum/showthread.php?s=&threadid=5005), just contributed by Kayaker!

dELTA
dELTA
09-21-2003, 07:56 AM
yAtEs just added another really cool creation to his syscode page (http://www.yates2k.net/syscode.htm). You can read more about it here (http://www.woodmann.net/forum/showthread.php?s=&threadid=5022).

Enjoy!

dELTA
dELTA
09-25-2003, 06:10 AM
More good resources from Kayaker, check 'em out here (http://www.woodmann.net/forum/showthread.php?s=&threadid=5030).

dELTA
LiSa
10-13-2003, 03:45 AM
hello reversers,
debugging and live dumping wdm drivers is very difficult especially
when they handle int3 and int1 and uses DRx to store values and
self instaure bpm to redirect control flow.
Attempt to emulate drx or harware bpm in softice often messes with the
stack and tend to reboot the computer.
One way to study safely these malicious driver is maybe to convert them to
win32 dos real mode program and use our old debuuging and tunneling tools.
What is your opinion about that?
LiSa
[yAtEs]
01-08-2004, 05:14 PM
hello reversers,
debugging and live dumping wdm drivers is very difficult especially
when they handle int3 and int1 and uses DRx to store values and
self instaure bpm to redirect control flow.
Attempt to emulate drx or harware bpm in softice often messes with the
stack and tend to reboot the computer.
One way to study safely these malicious driver is maybe to convert them to
win32 dos real mode program and use our old debuuging and tunneling tools.
What is your opinion about that?
LiSa

perhapes you would like to expand on this a bit, have you ever done
this and what are the limits?
evaluator
01-09-2004, 05:25 AM
well, guys, i'm watching this topic & mostly TITLE is wrong!?

So this is not about reversing but about learning - how-to code driver.
Okey?
Very good thing.

Now I "remember", that I wrote tracer code-snipet,
which traces all-1 R3 protectors.

Terribl-History:
1. Firstly I coded my tracer in HIEW - on BEEP.SYS ~:0
each time i reassembled jumps,calls..poor i ~:(

2. Then I decided to dld MASM, compile code as DLL and again inject in BEEP.SYS
(good, no more reassembling~:)

3. last days i found in sources, that MASM can do command /DRIVER ~:0
so i did some experiments, look in Hello.sys source,
created custom NTOSKRNL.INC & LIB with few functions needed.
So my driver loads on XP.

**

Ok, today I dld from yates "basic.rar" & found inside iNTOSKRNL.LIB;
I became happy, but soon less happy,
because there is not NTOSKRNL.INC, & l2INC.EXE can't create INC from it.
Suggestions? ok it's not so important, just luxury.

Well, if you like, we can together help me() for better write driver:),
because i'm mega-lazy guy..so?
sope
01-09-2004, 06:56 AM
Greetings evaluator,

Can this help you, d/l Four-F's kmdkit1.4 has ntoskrnl.inc + many more inc's to get started. Here's the url hxxp://wasm.ru/tools/11/kmdkit14.zip OR I understood wrongly as usual.

Regards, Sope.
[yAtEs]
01-09-2004, 08:47 AM
Well, if you like, we can together help me() for better write driver:),
because i'm mega-lazy guy..so?

it would be simpler if you just copy
http://www.yates2k.net/syscode/ring0.asm

into the same folder as the syskit1 then all you need do is
hit compile, it couldnt be simpler ;) then just alter ring0.asm
to add your code in.

yates.
dELTA
01-09-2004, 09:01 AM
So this is not about reversing but about learning - how-to code driver. Okey? Very good thing.

Like with most cracking, it is best done when you are well acquainted with the underlying technology, so yes, very good thing. :)

And thanks as always [yAtEs] (and everyone else) for your great contributions!
evaluator
01-09-2004, 10:44 AM
woah!

very enjoed, when in KmdKit i found NTOSKRNL,NTDLL & others INCs.
thanksus!

now i'm rearanging to invoke.
LiSa
01-09-2004, 04:34 PM
']perhapes you would like to expand on this a bit, have you ever done
this and what are the limits?
hello Yates,

What I do with thes fucking drivers is cutting the service dispatcher code (often obfuscated) and
then paste it into a masm dos program which feed first a fake IRP structure and then
call the pasted dispatcher with all services and buffers I previously found
using my deviceiocontrol hook.
Doing this, I collect a table service code - jmp code or call.
After that I cut the e code I want to explore in the driver and run it in dos controled condition.
What I mean is that I scan first for macros (Mow's), sidt, dro and cro instructions,
if needed I emulate or use a buffer as fake idt or variable and change freely code in my new test program
(as an sidt sequence by a mov reg,my_fake_idt).Then I watch what's happening.,
If exception occurs in code it is catched by softice and I will insert in my dos prg a jmp to new handler
Doing this is like building an unpacker as I think others do.

This technic is long but was very helpful for me to investigate a t*k*.sys 70060 service code.
Finely cuting-pasting-running-nopping-emulating three "layers" lead me
to final decrypting routine which is protected by int1 and int3 handler hooking
and bpm redirection for code flow.
if debugged reboot with keyborard or other, and also check rtc CMOS clock to eventually fuck off
decryption key.
DOS 32 was useful because you can use in al, dl and out functions easilly, even reboot
and test malicious code without waiting hours that scandisk finishes his job.
One year ago, I even use old Tron on a dos 32 program I wrote with pieces of win32 virii to have acces
to decrypted very intesting layers.

I hope this clarify a bit what I am doing

Regards
LiSa
dELTA
01-09-2004, 05:36 PM
Hehe, now that's cool. :cool: It's just great having guys like you all hanging around here. :)


Other messageboards with similar subjects?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Other messageboards with similar subjects?
PDA

View Full Version : Other messageboards with similar subjects?

dELTA
09-03-2003, 11:15 AM
I'm just curious, which other messageboards related to reversing/cracking or similar subjects do all the people on this board visit?

Don't be shy, I want to know about all of them. :) Please include a link and a short description about the board (like what you think is "the best part" about that particular messageboard, pros and cons, and other general info).

Here's an example from me, to get you started:

The Win32ASM community (http://board.win32asmcommunity.net)
Main topic is Win32 assembly programming of all kinds. Originally started in connection to Iczelion's win32asm website I think. It contains the "Official support forums" for several great win32asm products like Hutch's MASM32 package, FASM and the RadASM IDE. Frequented by many very skilled and knowledgeable people. They don't allow anything remotely related to cracking, viruses and such though, but as long as you put the questions in a neutral and purely technical way it's an incredibly good resource anyway.

EXETools forum (http://www.exetools.com/forum)
Centered around cracking, but with main purpose of informing about and distributing reversing tools/software/tutorials. Not very picky about legal issues, because they are located in China :p (still English language on the board though, except for some single Chinese subforum I think). Frequented by many people from this board, and JMI is a moderator there too.

Something like that, now please submit your own tips and recommendations!

dELTA
squidge
09-03-2003, 11:40 AM
http://board.anticrack.de/

RCE board, wide range of topics, my favourite being the Crypto´s Cocktail Lounge. I don't visit it very often, although it does seem to have some frequent posters. I don't know why, but I just prefer this board and Exetools. Maybe it's a time related thing - I never do have enough time for board browsing.
JimmyClif
09-03-2003, 05:38 PM
http://www.masmforum.com/

Hutch--'s Win32asm Forum. Same rules as the Win32asmboard mostly all the same same same... Except different names for the forums and a special forum for Powerbasic.

http://disc.server.com/Indices/37.html

Carpathia's and Mammons board... Home of the REKML Reverse Engineering Knowledge Mailing List. Board is still being visited. Haven't heard of any recent REKML.

Well, besides my email and http://www.reallifecomics.com all my daily checkup pages are listed now ;)
artik
09-03-2003, 06:25 PM
hoop://tnp.gepimpert.de/board/main.php (GERMAN)

tHE nEWBIEZ PROJECT - a german board about reverse-engineering; very good! :)
nikolatesla20
09-03-2003, 11:43 PM
Originally posted by squidge
http://board.anticrack.de/

RCE board, wide range of topics, my favourite being the Crypto´s Cocktail Lounge. I don't visit it very often, although it does seem to have some frequent posters. I don't know why, but I just prefer this board and Exetools. Maybe it's a time related thing - I never do have enough time for board browsing.

I have to say, that whole board, seems full of newbies..much smarter and more knowlegable people on this board.

-niko
sope
09-04-2003, 02:32 AM
Hello Everybody

I like russian forums tooo. Though i don't understand much in Russian but i still visit the below site & use web translators for interesting topic.

hxxp://www.reversing.net/board/
I generally use search button & find many info on hasp, sentinel, etc...etc...

Wasm Forum:
hxxp://www.wasm.ru/forum/index.php?
I found some good things on obsidium after translating things.

^daemon^
hxxp://disc.server.com/Indices/203830.html
Nice one. Its in english.

Regards, Sope.
esther
09-04-2003, 07:02 AM
hxxp://woodmann.cjb.net

h**p://disc.server.com/Indices/37.html

exetools

*hxxp://biw.rult.at/vbb/upload/index.php

*This forum is one year old.This forum reminds me the old Sandman's forum full of newbies but delgated to help :)
evaluator
09-04-2003, 11:41 AM
I remember -www.woodmann.com, but it no more exists, without explanations.

esther, want you, we togather go over these forums?
interesting, ee?
Zero
09-04-2003, 02:28 PM
@nikolatesla20:
I have to say, that whole board, seems full of newbies..much smarter and more knowlegable people on this board.
correct. The board started with some very good ppl, now it starts to fill with off-topic and newbies. We will change this within the next months. More quality, better ppl.
But it was never meant to be a concurrence for this board. It was thought only to be a help for the crackmes site and REA. No excuse, only some explanations ;)
evaluator
09-04-2003, 02:46 PM
Zero!

i disagree with your statment:
> More quality, better ppl
squidge
09-04-2003, 05:38 PM
Does the "better people" thing mean that new registers will have to pass a test before being alllowed to post?
Bengaly
09-05-2003, 06:08 AM
http://reteam.org/board/index.php
Zero
09-05-2003, 02:33 PM
@evaluator:

misunderstanding. With quality I mean more RCE posts than useless OffTopic posts (we made a statistics and we saw that most posts are offtopic). And we will clean redundant posts which discuss always the same and answer always the same topic. better ppl stands for more interested ppl in RCE and fewer ppl just registering to ask "I need crack for...".
Bengaly
09-05-2003, 02:52 PM
@Zero: you don't have to defend/justify your MessageBoard,
whoEver wants to use/discuss in it will.
my guess is that they (elite? ...) will not participate in your MB since it does not have as stated above (elite :rolleyes: ...) members, but than in other hand the board is used to aid/help beginners at REA so why would they? ;)

buttom line, use what you like & gives you knowledge or mabye fun but that aint the main point of the board ;)


Visual SoftIce?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Visual SoftIce?
PDA

View Full Version : Visual SoftIce?

crassy
09-03-2003, 03:35 PM
Hello everyone!

Has anyone succeeded in installing visual softice and using it for remote debugging? I tried to install target components on a win2k sp4 machine and add a virtual nic to enable the machine to be debugged remotely but the driver didnt seem to work... Any exeriences?
Aimless
09-04-2003, 01:49 AM
Softice: YES

Softice for remote debugging: NO

Visual Softice: wuzzat??

Have Phun
crassy
09-04-2003, 12:16 PM
Originally posted by Aimless
Visual Softice: wuzzat??

Visual softice is inluded in Driver Studio 3 and is used for remote debugging.
dgr
09-23-2003, 08:23 AM
I can't even get the normal softice to work on XP SP1... Installs fine and I can enter softice and set breakpoints but they NEVER trigger. That is breakpoints set on the windows api (showwindow, destroywindow, getwindowtext). When loading a program in the symbol loader and starting it it breaks nicely at the start of the program and when I set a bp on a memorylocation in there it DOES trigger.

Downloaded symbol files, used the osinfo.dat from the numega site as they mentioned but nothing seems to help. What am I missing?

I'll install Service pack 1a now... hope that that will help but if anyone has an idea please say so.

Btw, it's Driverstudio 3.0 with Softice 4.3.0 (build 1268)... tia
Manko
09-23-2003, 11:21 AM
Hi!

for bpx.es you have to be in context of debugee...
this is done with addr command or attach...

if this is no good for you, one can make it work as of old by:
- Using symbolretriever (part of the softice package) to down symbols for ntoskrnl.exe and convert them to nms then load them with symbol loader... This will make bpx work with all contexts...

personaly I think that sucks, since we don't want it to break on the wrong app/context... but it's a matter of taste or if one can relearn... I was very surprised when I went to DS2.7 and discovered this...

then again... Your problem may be something worse...?

/Manko
dgr
09-23-2003, 12:37 PM
Thanx for the reply Manko.

I never knew of this addr/attach nessecity... is it new since 3.0 or specific for xp sp1? Since I used 2.7 (and previous versions) for a long time and never needed to do this.

So the 'global' breakpoints on things like getwindowtext don't work anymore (after exporting the nessecary dll's)? I did try the symbol retriever but without any luck. I am going to read into those commands some more and see if I can get it to work like that...

Though I'd prefer the old way of simply starting softice and setting the nessecary breakpoints :)
nikolatesla20
09-23-2003, 01:55 PM
Is everyone on crack? Just Kidding :p

DS 2.7 still sets global breakpoints! For BPM's tho you DO need to be in debugee's context, but not for BPX

-nt20
Manko
09-24-2003, 03:21 AM
Hi!

Originally posted by nikolatesla20
Is everyone on crack? Just Kidding :p

DS 2.7 still sets global breakpoints! For BPM's tho you DO need to be in debugee's context, but not for BPX

-nt20

Sorry Nico, such is not the case with my DS2.7. :)
...for bpx on api i must be in context... hmm...

...also... I never needed to be in context for BPM on API... is this also case in DS30?

/Manko
dgr
09-24-2003, 05:06 AM
Allrighty, got it to work... so the method is now to load the app into symbol loader, then set the address (ADDR processname) en set breakpoints from there on...

Does it also break in dll's used by the process/program then? And is this really THE way to do it? It seems to work fine now and I must say it's quite an advantage that it now only breaks on the relevant process and not EVERY occurance of the api even though that means a few more steps before being able to set the breakpoints....
Manko
09-24-2003, 07:42 AM
Hi!

You can also use
BPM <address/api> x
instead of bpx.

That will also give you info on from where the proc was called.

Also, instead of the symbolloader you can use other tools like LordPE Break'N'Enter.

Also, if you have time, just start the app you're gonna debug, CTRL-d into ntice, addr, addr <name>, now put BPX where you want them, for example on getdlgitemtexta before you press the ok-button to let proggy get reginfo... now it will break...

or, first bpm on some API that is always run first in any app, then do bpx.es with addr and stuff...

To be honest, I usually only do bpx on addresses in the app... Maybe I should use them more... ? Hmm...

There are tricks against both methods, so it's try and see...

btw, if you use symbolloader, the app breaks automatically, so you don't need addr to get into correct context, you're there already. :) (Attach on the other hand might be good. :) ATTACH: Will make it so that sice issues a addr <appname> everytime you do CTRL-D)

/Manko
dgr
09-25-2003, 07:49 AM
aaaaah, like that... things are quite clear now finally hehe. Been a while since I meddled with softice on my puter, the problems with xp have been to big for a while for me to keep calm while using it :)

Tnx for the help Manko
dgr
09-26-2003, 04:27 AM
Hmmm, here I am again...

I wonder how you can best do this in the case of an installer (like .msi) instead of a normal app. For this one creates new temporary files from which the code is executed and loading the main setup.exe through the symbolloader doesn't seem to work, that is... breakpoints don't trigger.

Also when doing an "ADDR" when in the setup I see multiple instances of MSIEXEC, how to get into the address context of a specific one? Or would the only solution in this case be setting global breakpoints (by downloading the symbol files). Are there other ways to do global breakpoints?

I tried the "bpm 'api' x" but that one also only seems to work after an ADDR/ATTACH... Sorry for all the questions but I can't seem to find the right information to answer them myself :/ Tia.


IDA and HASP SIGNATURE FILES
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IDA and HASP SIGNATURE FILES
PDA

View Full Version : IDA and HASP SIGNATURE FILES

Ricardo Narvaja
09-03-2003, 06:17 PM
I have Ida 4.30 and 4.50 and i need analice a file Hasp protected and i have the hasp signatures files for IDA, but when i charge the signatures are put in the queue and say when analisis finish, ida will use the signatures.
The analisis of the exe (6 megas) is running till 12 hours and continue and continue uff.
There are a form (a configuration maybe) for speed the analisis and make IDA use the signature file now or more quickly?

Thanks
Ricardo
Ricardo Narvaja
09-03-2003, 09:39 PM
I think IDA is analising in a infinite loop.
Is analizing now and not stop, is the 3 try and never end analisyng.

Is possible bypass the part of this infinite loop in analisis?

Ricardo
Iwarez
09-04-2003, 02:06 AM
You can analyse yourself by not using the auto-analysis IDA has. But keep in mind that very big projects just take a hell of a time to disassemble, especially with slow PC's. I don't know about your's but with my old PIII 550 it was sometimes very very slow.
sope
09-04-2003, 02:48 AM
Hello Ricardo Narvaja

Just my guess can you lower down the version of ida to 4.15 & then try it might work. OR if you are already tired upload on your ftp & i;'ll d/l it for you & check it. I am used to keep machine running under ida. :)

Regards, Sope.
Ricardo Narvaja
09-04-2003, 05:02 AM
But if i stop the ida analisis , if not end not begin with the signatures snif snif.

Thanks
Ricardo
Ricardo Narvaja
09-04-2003, 05:27 AM
In kernel Options i disable 3 marks and continue analizing but now is advancing and goes out of the infinite loop, well is ending now thanks.

Ricardo
thomasfreedy
04-15-2004, 04:44 PM
was the program writen in Delphi?
condzero
04-16-2004, 07:43 AM
One thing you might try is to bump up your virtual memory max paging file size in Windows control panel. This may speed things up a bit with IDA. I am using the 4.50 also.
gook
04-16-2004, 12:38 PM
Hello Ricardo,

What sometimes works for me, when IDA seems to be looping, is to save the database, close IDA and reopen it.

Greetings


Unpacked prog. does not run on different OS.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacked prog. does not run on different OS.
PDA

View Full Version : Unpacked prog. does not run on different OS.

Harding
09-04-2003, 01:37 PM
Hello everyone!

I'm a newbie in unpacking but I have manually unpacked a program protected by TeLock 0.99 and rebuilt the IAT with ImpRec 1.6 and it runs fine on my machine (W2K SP4) but when I tried it on XP then it crashed when I opened it.

How do I fix this problem?

/Harding
evaluator
09-04-2003, 02:44 PM
Now try unpack on XP.
hobferret
09-04-2003, 05:00 PM
Hiya Harding :)

Try doing it with revirgin, when you have goten that working run it and make another dump then fix the new dump with imprec with the revirgin one is running, it works most of the time anyways;)

Worth a try at least!

/hobferret
squidge
09-04-2003, 05:35 PM
You'll normally find it's either the SizeOfImage, SectionAlignment, or FileAlignment thats wrong (or a combination). You can correct the SOI by using a PE Editor, but it's best to realign the file to correct the other two as the header is normally correct, but the section headers need altering and the file rebuilding to match.
Harding
09-05-2003, 07:42 AM
Thanks for the answers everyone!

I did it the "hard" way, I manually unpacked it again but this time on the other machine.

I will try your ways and see if I can get it correct in the future.

/Harding
separator
09-05-2003, 10:09 PM
There is another way. PESHEiLD has one option for rebuilding EXE. You can try rebuild your EXE with it and I think it will work fine.


VB help file?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VB help file?
PDA

View Full Version : VB help file?

MrSmith
09-05-2003, 04:25 AM
Hi everybody,

I'm looking for the help file of Visual Basic, the one that describes all the functions. I did a google search, but couldn't find it. Any idea where to get it from?

MrSmith

P.S. I think this questions is legal enough to be asked :-)
dELTA
09-05-2003, 07:03 AM
hxxp://msdn.microsoft.com

The entire MSDN is also available on CD:s
asmworkshop
10-21-2003, 03:22 PM
Hi everybody,

I'm looking for the help file of Visual Basic, the one that describes all the functions. I did a google search, but couldn't find it. Any idea where to get it from?

MrSmith

P.S. I think this questions is legal enough to be asked :-)

WinMX will do it 2 ...
Aimless
10-22-2003, 12:53 AM
Hmmm....

Last time I looked at the MSDN site on microsoft.com or with the Visual Studio, the MSVBVM60.DLL functions were definitely not explained. Maybe now they are...

I think that most of the VB functions are undocumented and that Microsoft would typically keep it that way. The only way I generally find details about these functions, is information that is already generated by other people. Try google and search for rtcMessageBox and you will see what I mean.

Dunno if Microsoft has released the documents for VB7 (msvbvm70.dll). But my bets are on the fact that even if they have, they would release only a FEW of them, not all.

So best is to search for google.

Have Phun


Another riddle page
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Another riddle page
PDA

View Full Version : Another riddle page

ZaiRoN
09-05-2003, 05:58 AM
Hi All,
for those who are interested in riddle(s), here is a nice link: http://riddle.quequero.org/

Good luck,
ZaiRoN


elliptic distribution
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > elliptic distribution
PDA

View Full Version : elliptic distribution

nikolatesla20
09-05-2003, 09:58 PM
Maybe if Mike is around he could answer this, or some of you other Crypto experts:

Say you have a algo like RSA public key. Now, I know if the key size is large bruteforcing would take forever and a day no matter what you do, but my question is - even if you wrote a bruteforcer, why would you actually start at the beginning and scan. I would tend to think the chances of the required value would very rarely be on the ends of the spectrum. Also very rare would be in the exact middle. I would think the best places to scan would be the lower and upper 2/3 of the number distribution.

Am I on any kind of right track of thinking here? This is how I've always thought about any type of algorithm that ppl use to lock away code, in the case of writing a bruteforcer. Wouldn't the distro be similar to the normal "chaotic" bell curve?

-niko
naides
09-05-2003, 10:11 PM
Originally posted by nikolatesla20
Maybe if Mike is around he could answer this, or some of you other Crypto experts:

Say you have a algo like RSA public key. Now, I know if the key size is large bruteforcing would take forever and a day no matter what you do, but my question is - even if you wrote a bruteforcer, why would you actually start at the beginning and scan. I would tend to think the chances of the required value would very rarely be on the ends of the spectrum. Also very rare would be in the exact middle. I would think the best places to scan would be the lower and upper 2/3 of the number distribution.

Am I on any kind of right track of thinking here? This is how I've always thought about any type of algorithm that ppl use to lock away code, in the case of writing a bruteforcer. Wouldn't the distro be similar to the normal "chaotic" bell curve?

-niko

I am hardly an expert in the field, but I here is my answer:

The overhead of writing a key generator with chaotic functions, and keeping track of the already tested keys for not repeating too many of them would quickly neutralize any time saving advantage you might get by generating "random looking" keys.
mike
09-14-2003, 05:10 PM
The best way to factor large numbers (above a few hundred bits) is the Number Field Sieve. It works by finding a lot of relationships between numbers mod n and algebraic complex numbers. Algebraic numbers are those that you can get by using + - * / ^.

For example, when n=2501 then you can say 50 = i since

50^2 = 2500 = -1 mod n and i^2 = -1 in complex numbers.

You'd try to factor every number a+bi in a certain "small" range, then factor a+b*50. You put a 1 in the matrix if the exponent on a prime factor is odd, and a zero if even.

Finally, you try to find a set of rows that add to zero mod 2. With good probability, this will give you one factor.

So the brute-force part is trying every a,b in a range, but it's not testing them as potential factors of n.


Reversing our M$ game: Minesweeper
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Reversing our M$ game: Minesweeper
PDA

View Full Version : Reversing our M$ game: Minesweeper

ZaiRoN
09-06-2003, 06:35 PM
Hi All,
I would like to present something unusual for this area, a game reversing (a M$ game reversing :p).
In my mind I was thinking to modify the program in order to show where the bombs are. This is not the classical "game cheating" but something a little bit hard, that will imply not only a reverse approach but also a programming aspect.

Talking with Kayaker, he suggeted some tasks:
1. Give option to user to use the "cheat" feature. Add a new menu item or an hotkey (or why not both of them), something that will let you to switch from the normal to the cheat mode and viceversa.
2. Try to understand how (and where) the program stores the position of the bombs.
3. Show where the bombs are as a *mouse-over* effect as the cursor moves over each grid square. How does the program unhide the grid windows? Show them briefly as the mouse cursor passes by. Or use a tooltip or other way of signifying there's a hidden mine down there.
4. Package your cheat in a dll module, and add the new functionality patch in memory with only the code that will call the export function(s).

More or less it's all here. We will use the standard 2k/XP (english) version of the game as a target but everyone can play with his own version. I take a look at different versions of this game, they are similar and you should not have problems :-)

Before leaving you, I would like to suggest these two tutorials as a support for the beginning of the project:
http://www.woodmann.net/fravia/menusspa.htm
http://www.woodmann.net/fravia/TracePlus_MenuPatch.html

There are some interesting aspects involved in this project so, don't be shy and don't hesitate to ask something; there are many people willing to help you :D

Regards,
ZaiRoN
Bengaly
09-14-2003, 02:04 PM
http://codeproject.com/csharp/minememoryreader.asp?target=minesweeper
ZaiRoN
09-14-2003, 02:26 PM
Hi Bengaly,
I know this article and would have post the link in the future . It's a nice article but it's only a simple process memory reader :-p

Ciao,
ZaiRoN
Bengaly
09-14-2003, 06:03 PM
Hi ZaiRon,
hehe yeah i know =)
you challenge is very good practice, was just reffering to this article of some will want to know stuff faster :)
ughugh
09-15-2003, 04:10 AM
I used to play Minesweeper quite a lot in the Windows 3.1 days (I did the expert on ~100 seconds), so forgive me for remembering this cheat..:

http://www.eeggs.com/items/470.html
Kayaker
09-15-2003, 02:00 PM
Originally posted by ughugh
forgive me for remembering this cheat..:
http://www.eeggs.com/items/470.html

Lol, that's a good one. Sure enough there's this stupid little pixel at 0,0 on your desktop which blinks on and off as you pass over a mine. Start up a winmine game, type 'xyzzy' and press Enter, then press one of the Shift buttons and if you squint really hard you can see it working.

Now try setting a breakpoint on SetPixel and do the same and you can see which code is called to perform this amazing MS trick, heh. If you have the Windows Debug symbols installed, under ..\symbols\exe is the winmine dbg version which can be loaded into Softice and it's a bit easier to follow the 'xyzzy' Eegg. I always wondered how people found Easter eggs...

Well this is great, but has anyone except ZaiRoN given a go at reversing this thing or is the challenge to find how many cheats already exist on the net? :p

Kayaker
Bengaly
09-15-2003, 05:00 PM
but has anyone except ZaiRoN given a go at reversing this thing or is the challenge to find how many cheats already exist on the net?

hi Kayaker,
yeah i give it a shot, for now i found a useless function in minesweeper and removed it's code to inject the caller code of the dll, it works ok, i guess i now need to play with the app and see how things works in order to hook it up with the dll.
dunno how much time it will take me.
ttl
ZaiRoN
09-20-2003, 12:07 PM
Hi All,

I did take a glance at the target starting from the easy part, the new menu item. In this post I will explain the way I used to add the new menu item, find the part of the window procedure where menu items are processed and finally write the first dll function.

Add new menu item
As always happens, this is the most easy part of the reversing session. Load the file into your preferred resource editor and add the new item under the menu section. You have to assign an identifier (a number...) to the new item, remember that it must be a number that is not used by the other items.

Find the point where the program checks whether a menu item is been pressed
This task is useful because we need to add/manage the new menu item, the special mode option. If you check the 'special mode', the game will show you the bomb, otherwise the game will remain the same.
There are many ways to solve this second point.
- You can use Spy++, a little application that gives you a view of many informations about a process that is running on your system. Run Minesweeper and then run Spy++. You will see a list of the running processes, find Minesweeper process and double click on it. A dialog will show you some informations about the game, one of them is the window procedure.
- Another way to locate the window procedure is to use Ida. This is more or less the way explained by +Spath in his tutorial.
Load the file into ida and press ctrl-p; a dialog appears. This dialog contains the functions used by the program and, we are interested in WinMain function, the one used to define the window class. This is useful because from here you can understand where the window procedure is. The program uses RegisterClassW function to register the window class:

ATOM RegisterClass(
CONST WNDCLASS *lpWndClass // address of structure with class data
);

and:

typedef struct _WNDCLASS {
UINT style;
WNDPROC lpfnWndProc;
int cbClsExtra;
int cbWndExtra;
HANDLE hInstance;
HICON hIcon;
HCURSOR hCursor;
HBRUSH hbrBackground;
LPCTSTR lpszMenuName;
LPCTSTR lpszClassName;
} WNDCLASS;

This structure contains the window attributes; we are interested in lpfnWndProc because it points to the window procedure. Look at the disasm Ida gave you and take the address we were looking for.

Ok, we now know where the window procedure is.
It's time to use a debugger, Ollydbg. Load the program and jump to the window procedure, we need to set a breakpoint. Remembering that we are trying to find the part of the procedure which check whether a menu item is clicked, we need to break if and only if a menu item is clicked. When an item is clicked, a specific WM_COMMAND message is sent to the procedure. This specific message contains the menu item identifier in the loworder word of the wParam parameter.
Take a look at the first part of the window procedure:
0100180A PUSH EBP
0100180B MOV EBP,ESP
0100180D SUB ESP,40
01001810 MOV ECX,DWORD PTR SS:[EBP+C] <-- ecx is the message (i.e. WM_COMMAND)
01001813 PUSH EBX
If we want to catch the click over one of the menu item we need to set a conditional breakpoint (Shift+F2) at 1001810. The condition I have used is:
[EBP+0Ch]==111H && [EBP+10H]==209H
where '[EBP+0Ch]==111H' checks for the WM_COMMAND message and '[EBP+10H]==209H' checks whether the 'Beginner' menu item is been clicked (you can use your preferred menu item :-)). Run the program and click on the chosen item, Olly breaks. Steps a little and you will surely find the place where the program checks which menu items is been pressed. This piece of code is what we were looking for; later on we will add a new cmp with the id of the new item when we will patch the program in memory.

Write the first dll function
Now that we know all these informations, we can easily write the first function of the dll, I will call it changeItemStatus.
This function will check/uncheck the menuitem enabling or disabling the special mode, nothing more. To check/uncheck the item I will use CheckMenuItem function:

DWORD CheckMenuItem(
HMENU hmenu, // handle to menu
UINT uIDCheckItem, // menu item to check or uncheck
UINT uCheck // menu item flags
);

An easy function to use. It needs:
1. the handle of the menu. We don't have the handle but since the function is imported and since some of the items of the menu could be checked/unchecked, the easiest way to retrieve the handle is to put a breakpoint on this function and hit one of the checked items, for example the 'sound' item. Perfect, Olly will break showing us where the handle is stored.
2. the id of the menu. It's the number we gave to our new item
3. we are interested in two values:
MF_CHECKED (08h): sets the check-mark attribute to the checked state.
MF_UNCHECKED (00h): sets the check-mark attribute to the unchecked state.

I did write the dll in asm but no one will stop you from writing it in other languages. Here is my partial dll:

.386
.model flat,stdcall
option casemap:none

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
include \masm32\include\gdi32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\gdi32.lib

.data

.code
DllEntry proc hInstance:HINSTANCE, reason:DWORD, reserved1:DWORD
mov eax, TRUE
ret
DllEntry Endp

; Change the status of the new item
changeItemStatus proc
.IF word ptr [ebp+10h] == 212h ; 212h is the id I used for the new item
mov ebx, 10049A2h ; byte [10049A2] stores the state of the menu item
xor byte ptr [ebx], 08h
movzx eax, byte ptr [ebx]
mov ebx, 10052BCh ; address where the menu handle is stored
invoke CheckMenuItem, dword ptr [ebx], 212h, eax
.ENDIF
ret
changeItemStatus endp

End DllEntryThe only thing that requires an explanation is the value stored at 10049A2. This byte is:
00h if the item is unchecked
08h if the item is checked

This is the first function and in my mind I was thinking to add only another function that will unhide a single cell if the special mode in on. We will see later, for the moment it's all...

ciao,
ZaiRoN
Aquatic
09-20-2003, 05:53 PM
Gamehacking was a good way of learning reversing (for me). Cracks alone can be very one-dimensional, but gamehacking forces you to learn a bit of everything.

... my 2 cents
ZaiRoN
09-27-2003, 07:01 AM
We need to find a way to break when a cell is clicked. Exploiting the work we have done in the previous task, I will use another conditional breakpoint at 1001810; the idea is to break when the left mouse button is pressed (and then released).
When this button is released, a WM_LBUTTONUP (202h) message is posted and so, the new condition will be: [ebp+0Ch]==202h
Set the new breakpoint and click on a cell; Olly breaks, steps a little until Olly will tell you that you have found the place:
01001C30 XOR EDI,EDI ; Cases 202 (WM_LBUTTONUP) <-- thx to Olly :-D
01001C32 CMP DWORD PTR DS:[1005160],EDI
01001C38 JE winmine.01001D4C
01001C3E MOV DWORD PTR DS:[1005160],EDI
01001C44 CALL DWORD PTR DS:[<&USER32.ReleaseCaptu> ; ReleaseCapture
01001C4A TEST BYTE PTR DS:[1005010],BL
01001C50 JE SHORT winmine.01001C5C
01001C52 CALL winmine.0100373E ; hmmm...
01001C57 JMP winmine.01001D4C ; jump at the end of the procedureThis is the code that manage the WM_LBUTTONUP command; as you can see there is a call to ReleaseCapture, a jump at the end of the procedure and a suspicious call. Maybe it's the call that will show us where the bombs are...

At this point I should tell you where the bombs are but, I prefer to signal an interesting article (thx Kayaker) because it is useless to write the same things two times.... The author shows you how to locate the code I posted above and after that, he shows where the bombs are. You can find the article at:
http://www.codeguru.com/mfc/comments/50642.shtml

See you on the next step...

ZaiRoN
ZaiRoN
10-07-2003, 12:26 PM
In this post we will see how to play with the new dll; as support, I would like to add a new tutorial:
http://www.woodmann.net/fravia/kayaker_RegmonPlus.htm
Read it, it's full of interesting informations ;-)

Now that we know almost everything about the program, we have to show these damned bombs. I will try to explain you how to show them when the mouse pass over a cell; the bombs will remain showed until the end of the game.

We need to show the bombs when the mouse passes over a cell (that hide a bomb) so, we need to find where the program checks for WM_MOUSEMOVE message. Now, if you read the previous messages, you should not have problems to find the location; as you can see this type of message is not so useful for the original program, it makes a simple jump to the end of the routine.

When we will patch the program in memory we will need to change this jump into a jump to our code.
Which are the runtime modifications to apply at the program?
- a new compare instruction for the new itemmenu (remember the old message...)
- the jumps to the new code (one for the item menu and one for the wm_mousemove)
- the code necessary in order to call the dll functions
I will only speak about the last modification, the other two are very easy; if you have problem do not hesitate to ask.

How to call a dll? Practically you have to call 3 simple functions: LoadLibrary, GetProcAddress and FreeLibrary.

LoadLibrary: it's the first function to use and it maps the dll module into the address space of the calling process.
HINSTANCE LoadLibrary(
LPCTSTR lpLibFileName // address of the string that names the executable module
);
The function returns a handle that can be used in GetProcAddress to get the address of a dll function.

GetProcAddress: returns the address of the exported dll function.
FARPROC GetProcAddress(
HMODULE hModule, // handle to DLL module (the value returned by LoadLibrary)
LPCSTR lpProcName // address of the string that names the function
);

FreeLibrary: unmaps the dll module fro the address space of the calling process
BOOL FreeLibrary(
HMODULE hLibModule // handle to DLL module (the value returned by LoadLibrary)
);

This is the code I used to call the dll and it's the code you have to inject into a cave of the original program:

010049A2: ; Initial address
specialMode BYTE 1h dup(0) ; specialMode=08h if specialMode is enable
; otherwise specialMode=00h
dllName db "zaiWinmine.dll",0 ; The name of the new DLL
; The name of the 2 exported functions:
changeItemStatus db "changeItemStatus",0 ; Changes the status of the itemmenu
revealCell db "revealCell", 0 ; Reveal a bomb under a cell

; From 'specialMode' item clicked (10018C4)
push 10019ADh ; Address from where to return to
pushad
push offset changeItemStatus ; Used by GetProcAddress
jmp @go

; From WM_MOUSEMOVE event (1001b50)
push 1001DD5h ; Address from where to return to
.IF [specialMode] == 00h ; Is the special mode enable?
pop eax ; specialMode is disable, no need to show the bomb
jmp eax
.ENDIF
pushad
push offset revealCell ; Used by GetProcAddress
jmp @go

@go:
push offset dllName ; The name of the dll
call LoadLibrary
mov esi, eax
push eax ; Handle to dll module
call GetProcAddress
call eax ; call the exported function
push esi ; Handle to dll module
call FreeLibrary
popad
pop eax
jmp eax ; Jump back to the original code
I think there is nothing to add.

Now we can write the other function of the dll, the one I called revealCell. What this function is supposed to do? Remembering that the function will be called on every single movement of the mouse (and let's suppose specialMode is enable), we have this scheme:

1. Is the pointer inside the grid?
No: quit from the function
Yes: jump to 2

2. Is the cell hiding a bomb?
No: quit from the function
Yes: reveal the bomb

The point number 1 is necessary because the bombs can not be outside the grid while the point number 2 is the final check.
The first cell (upper left corner) starts from coordinates 0x0C,0x37 and each cell is 0x10,0x10. Now that we know this information, we are able to implement the point number 1: a simple 'if' based on the coordinates of the point where the mouse has been pressed. How did you know the x and the y coordinates where the mouse has been pressed? WM_MOUSEMOVE will tell you; infact:
WM_MOUSEMOVE
fwKeys = wParam; // key flags
xPos = LOWORD(lParam); // horizontal position of cursor
yPos = HIWORD(lParam); // vertical position of cursor
Here is all that you need :-D

Point number 2: first of all, we have to check whether a cell hides a bomb; this is not a problem because we know where the program stores the grid in memory and, we will easily perform this check but... how can I reveal a bomb under a cell? The answer is inside Graphics Device Interface (GDI) library; in this specific case we will use GDI to display a bitmap. My new version of the game displays the image that has the bomb on the red background (open the program with a resource editor, you will find the image I am talking about under "Bitmap-410-1033"). You can display the image you prefer taken from the proggie or created by you. To display this image I use these functions: GetDC, BitBlt, ReleaseDC.

GetDC: retrieves a handle of a display Device Context (DC) for the client area of the specified window.
HDC GetDC(
HWND hWnd // handle of window
);
This is the first function we have to call and it takes a single parameter. How do we know the handle of the window? Simple, these 3 functions are used by MineSweeper and so, the best way to understand how to use them is to bpx them and to look how they are used. This time, put a bpx on GetDC and run again the program. Ollydbg will surely break and the only thing you have to do is to take note of the address that contains the handle...

BitBlt: it clips an image from a source DC to a destination DC.
BOOL BitBlt(
HDC hdcDest,// handle to destination DC, the GetDC returned address
int nXDest, // x-coordinate of destination rectangle's upper-left corner
int nYDest, // y-coordinate of destination rectangle's upper-left corner
int nWidth, // width of destination rectangle
int nHeight,// height of destination rectangle
HDC hdcSrc, // handle to source device context
int nXSrc, // x-coordinate of source rectangle's upper-left corner
int nYSrc, // y-coordinate of source rectangle's upper-left corner
DWORD dwRop // raster operation code
);
As before, the best way for to understand how to use the function is to bpx it on Ollydbg. If you want to display another image you have to change the 6° parameter: hdcSrc.

ReleaseDC: the ReleaseDC function releases a device context
int ReleaseDC(
HWND hWnd, // handle of window
HDC hDC // handle of device context
);

Ok, it's time to past the source of the revealCell procedure (add it to the code I gave you before):.data
oldRow db "01004998"
oldColumn db "0100499C"

; Display the image under a cell
revealCell proc
pushad

; Is the mouse pointer inside the grid ?
.IF word ptr [ebp+14h] < 0Ch || word ptr [ebp+16h] < 37h
jmp @exitRevealCell
.endif

xor eax, eax
mov ax, word ptr [ebp+14h] ; The x-coord of the mouse
sub eax, 0Ch
shr eax, 4
add eax, 1 ; The number of the column -inside the grid- where the mouse is pressed

xor ebx, ebx
mov bx, word ptr [ebp+16h] ; The y-coord of the mouse
sub ebx, 37h
shr ebx, 4
add ebx, 1 ; The number of the row where the mouse is pressed

mov edi, 1004998h
.IF ax == word ptr [edi] && bx == word ptr [edi+4]
; It's in the same cell than before, no need to display the same image again
jmp @exitRevealCell
.ENDIF

mov ecx, ebx
mov edx, ecx
shl edx, 5
mov ebx, 1005700h
add ebx, eax
add ebx,edx
; Reveal the cell if and only if there is an hidden bomb
.IF byte ptr [ebx] == 8Fh
mov edi, 1004998h
mov dword ptr [edi], eax ; Save the column
mov dword ptr [edi+4], ecx ; Save the row
push eax
push ecx
mov esi, 10052A8h ; Pointer to handle of window
push [esi] ; Handle of window
call GetDC
mov esi, eax
pop ecx
pop eax
shl ecx, 4
add ecx, 27h
shl eax, 4
sub eax, 4
mov ebx, 1005AE0h
push 0CC0020h ; SRCCOPY flag
push 0
push 0
push [ebx+48] ; Source DC, the image to display
push 10h ; Height of the rectangle
push 10h ; Width of the rectangle
push ecx ; y coord
push eax ; x coord
push esi ; Handle to destination DC
call BitBlt
mov ebx, 10052A8h
push esi ; Handle of DC
push dword ptr [ebx] ; Handle of window
call ReleaseDC
.ELSE
mov dword ptr [edi], 0
mov dword ptr [edi+4], 0
.ENDIF

@exitRevealCell:
popad
ret
revealCell endpI think that's all...

Ciao,
ZaiRoN
evaluator
10-08-2003, 02:57 AM
because of your good tries for newbies, i done gift for you.
advant
01-28-2004, 11:44 AM
What is a good tutorial on learning how to add the DLL into the import table and how to add code to an exe without corrupting the image and static references to code already there?
advant
01-28-2004, 12:36 PM
Also, how do you patch the memory to add a new compare for the WM_COMMAND.

thanks
Foreigner
01-29-2004, 07:49 AM
There is a final tutorial for this project at http://66.98.132.48/fravia/what_new.htm
Another tutorial that may help you is http://66.98.132.48/fravia/kayaker_RegmonPlus.htm

Foreigner


Waheyy, it's back !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Waheyy, it's back !
PDA

View Full Version : Waheyy, it's back !

squidge
09-13-2003, 07:45 PM
Well done everyone who helped get the board back so quickly to a September restoration :)
Woodmann
09-13-2003, 08:22 PM
Ya'll ready for a board upgrade :eek:
squidge
09-13-2003, 08:30 PM
You wouldn't dare ;)

(Hmmm, is that actually how you spell that word? Seems kinda odd)
JMI
09-13-2003, 08:39 PM
Oh wouldn't we??????:D

Regards,
Kayaker
09-13-2003, 10:06 PM
Now that's a stable board, even with shakedowns and breakdowns and against all odds, not a single significant post or archive has been lost in 3+ years!! Lol, nice ;)

Do your worst.
JMI
09-13-2003, 11:15 PM
Well, Hopefully we can do better than our "worst." :D

I've already installed a running copy of 3.0.0 in a test location and am about to install another copy of the 2.xx version and try to upgrade to 3.0.0 and see what happens. I'd like to get the DDX modified version running again and upgrade from there and maybe that will work this time, now that I know how to accomplish a "restore" using linux.

Sing the mantra along with me: "backup, backup, backup, backup." Feel the energy? :p

Regards.
squidge
09-14-2003, 04:55 AM
Hey JMI, ever heard of the phrase "If it aint broke, don't fix it" ? :D ;)
naides
09-14-2003, 08:54 AM
I am taking to the word, the advice of my spiritual guide, JMI.

'grasshopper' , Life is a series of backups. . .

but master, I replied, I have tried to teleport the whole board, and never have I got anything remotely working.

master said, directing his eyes to a different direction,

'treacherous technology is. Do not think tao is contained within this pages'

but master, I replied, it is not Tao what I pursue in here, is the amusement of its postings.

'In that case, little grasshopper, ask the lords of this place to make available on-line a copy of the boards' database. '

I meditated around the obscure message contained in my master's words and became one with the idea that zen is obscure, but simple, indeed.
dELTA
09-14-2003, 12:12 PM
One reason that the lords haven't made available such a database copy might be that it would require a bunch of sensitive data to be edited out of the database dump before it was published (like password hashes, user contact information, private messages and other non-public data), which would first of all be quite time consuming to do, and second of all make the database unable to run standalone anyway. :(

dELTA
JMI
09-14-2003, 01:25 PM
And the reason that a teleport doesn't work is that there are just too many objects associated with each page and, at least in my own experience, teleport stops functioning long before it has anything near to a workable copy of the board.

The new 3.0.0 version is even worse. I made a backup of the test board last night which, uncompressed, is over 87 meg., although a good portion of that is the word index and search data, which can be eliminated from the backup if desired. The new version also has a function to store attachments as files, rather than as part of the board's database. That should eventually reduce the backup also.

Part of the problem we were having was that our back-ups were created with modified code which the standard "mysql" restore instruction did not uncompress. This meant it wasn't a click and go to restore the backup on anything other than the modified version of 2.2.9 we had been running and there were some problems getting it running again, which eventually were solved. But the "public" board is running the 2.3.2 code and I haven't had time to attempt to incorporate our previous modifications and I'm not sure they would work with the new code of 3.0.0 anyway.

To work on the current public version, the backups needed to be "uncompressed" locally and uploaded, or someone , like me, needed to figure out the proper path for mysql instructions on a linux box. All my previous practice was from a windows command line. While downloads from the board seem to run at 150kb/s, uploads of the backup seem to only run about 15 kb/s. Makes getting an uncompressed backup "back up" to the board, rather slow. :p On top of that, real life was again intruding on time here and the work had to get done.

Regards,
Woodmann
09-14-2003, 06:04 PM
Hey JMI, ever heard of the phrase "If it aint broke, don't fix it" ?

Squidgy......... I broke it :eek:

Sadly, the new version of the back up script is still sucking ass big time.
It is sad that when you have a backup problem, they tell you not to use the "packaged" script.

I will see if I can make a public version of the board available once a month. I dont think you will like the size of the file :rolleyes:

Woodmann
JMI
09-14-2003, 06:22 PM
I'm not sure a "public version" of the Board is a practical solution at the moment. Assuming we can remove the private data, i.e. private messages, user identification information, etc., and still present a useable database, what would we have? To be useful, the data needs to be searchable, i.e. one needs to have the correct version of vBull to actually "run" the database at home. The newer versions require a customer number to install (which might bring another project for our intrepid reversers).

Assuming the database was still in version 2.xx format, that would not be as much of a problem, but otherwise the "database" is really just a flat file system with a bunch of post and thread numbers connected through the database program. In the backup, unless properly sorted beforehand, the entries aren't necessarily near eachother and it can become a not too trivial exercise to put them in order, unless you have a mySQL database management program of some flavor.

In short, the data, without the board, it not a very workable proposition. Also, if one saves space by removing the word and search indexes, it kind of defeats the purpose of having the database in the first place. Unless one can recreate the indexes, searching would be very difficult. Unless one has setup one's own board and has access to the AdminCP, you can't re-index the counters to make searching work.

There might be some other way to do it, but at the moment, I don't know what that might be.

Regards.

JMI
squidge
09-15-2003, 05:54 AM
I'd say we need some custom Teleport-like software, written specially for the board and rip the html pages directly. With such a html database, I'm sure it could be a lot easier to search.

Now, I think I could develope such an application, as long as the admins don't mind the hammer the board would take with such a dump. Also, I'm not sure how the database would be updated with new threads, but I'm sure we could sort something out.
Mfriend
09-15-2003, 07:02 AM
Just to gain the raw data, I have used this one:

#!/bin/sh
export i=1
while true; do wget "http://www.woodmann.net/forum/printthread.php?s=&threadid=$i&perpage=1000"; i=`expr $i + 1`; done

of course there are a lot of "wrong" threads - but those can be easily filtered when you start making a browsable html "offline" board, where you need to parse every html page anyway. ( Currently we have around 5000 threads to "check" )

I will write this parser somewhen, if nobody writes it first, I only was glad to see the board up and sucked every thread as fast as I could ( don't worry, "only" 36 Mb traffic ). Of course there aren't any attachements - because they are not thread specific but message specific. You could download them too by this way ( you need to check about 25 000+ Urls ) but the problem is: I don't see a way to reassign the attachements to threads or even single messages ( that's way I haven't downloaded them ).

Another way would be - if the board admins make a db dump by some clever sql statement (e.g. only threadtitle+threadid, messagetitle+messageid, message, author+authorid, attachementifany) available - it would be a lot easier to parse the raw data and even have the attachements in the right places.

-mfriend
SiNTAX
09-15-2003, 06:03 PM
Originally posted by JMI
The newer versions require a customer number to install (which might bring another project for our intrepid reversers).

Just curious... how many seconds does it take to bypass?! :)
Kayaker
09-16-2003, 12:05 AM
Originally posted by Woodmann

Sadly, the new version of the back up script is still sucking ass big time.

Hiya, I just stumbled on this, any chance we could make use of it?

MySQL Backup Watcher
Program MySQL Backup Watcher is intended for making database backups of the MySQL server. Archiving can be done on the local computer as well as using the remote server in the
Internet. The program has the built – in and easily customized scheduler, thanks to which it is now possible not only to carry out "manual" backup but also to customize the scheduler so that
the program would automatically carry out the backup of the specified databases daily, weekly,
monthly or once on the established time.

hxxp://www.afreego.com/Categories/Business_and_Productivity/Database_Management/007916.php

Kayaker
Woodmann
09-16-2003, 06:55 PM
Howdy,

I think a scheduled backup is a good idea.

Woodmann
[yAtEs]
09-17-2003, 08:26 AM
backing up is for wussies eh woodmann ;)
Woodmann
09-17-2003, 06:22 PM
I hate you [yAtEs] :p


Undocumented NT Kernel Technique and Header files Collection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Undocumented NT Kernel Technique and Header files Collection
PDA

View Full Version : Undocumented NT Kernel Technique and Header files Collection

Kayaker
09-14-2003, 02:47 AM
Hi All,

This is an excellent collection of NT kernel header files and semi-documented system programming example code. I wish I knew which site I downloaded it from to give the deserved credit, I can only keep the original filename intact.

There are dozens of C examples which show many, many interesting techniques, a few of the gems:

blowfish.c
defense.c (antitrojan?)
Hook Drive
Interrupt hooks
SystemServiceTable / NT kernel function hooking
NT Memory Manager
NT Object Manager
Routing Routines
NT Security Functions
Process manager routines
packet I/O operations
NT io manager/filesystems
HookKeyboard
Command functions
NT Thread manipulation
Process context work items
Exec related code

I hope that we can continue to expand the amount of system programming and driver techniques information on this board, as well as receiving more contributions on reversing in the undocumented kernel playground. 'Til then, there's reading to do...enjoy.

Cheers,
Kayaker

253Kb
user
09-14-2003, 08:09 AM
Originally posted by Kayaker
This is an excellent collection of NT kernel header files and semi-documented system programming example code. I wish I knew which site I downloaded it from to give the deserved credit, I can only keep the original filename intact.http://rootkit.com/
Clandestiny
09-16-2003, 02:54 PM
Hiya :D

Thanks for posting this!

Cheers,
Clandestiny
volodya
09-17-2003, 01:17 PM
I'd be extremely happy if anyone can explain how can we get to that server... If it is possible, I'll be able to download most of its content and put it on wasm to be available to public. Cause it is extremely nice to have such things somewhere near when necessary.
volodya
09-17-2003, 03:36 PM
First of all I'd like to thank you for the truly informative posts in this forum. I had a lot of enjoynment while reading them. Thanks a lot. Secondly... Pity but the link is dead :(
ZaiRoN
09-17-2003, 03:46 PM
Another interesting url :-) :
http://www.ntkernel.com/resources.shtml

ZaiRoN
JMI
09-17-2003, 04:03 PM
volodya:

Why not go to the source of the program and SET UP YOUR OWN ACCOUNT. Then you should have access to the ftp to your heart's content. Check out the instructions at http://www.rootkit.com/. They state:

Welcome to ROOTKIT.COM. New users need to [ Login ] and sign up for an account.
Note: Current users of rootkit.com have had their accounts ported to the BBS. You should be able to login normally.
You may transfer files via the BBS, or use your account to login to the FTP server.

It certainly appears that if you create an account you can gain access to all the files available.

Regards,
Kayaker
09-17-2003, 04:55 PM
Originally posted by vladimir
First of all I'd like to thank you for the truly informative posts in this forum. I had a lot of enjoynment while reading them. Thanks a lot. Secondly... Pity but the link is dead :(

Thank you Vladimir, I enjoy browsing your site much as well, pity my Russian is limited to toasts ;-) We'd like to expand this to maybe a separate page/forum where people could contribute NT Kernel / driver related topics/links/discussions, etc., even code examples in MASM or C of common driver procedures would be useful, just to keep it all in one place and not have it disappear after a few weeks in a thread. Any ideas are welcomed. As for the site, it was fine before I posted....

Regards,
Kayaker
volodya
09-18-2003, 11:05 AM
Glad to see you, glorious moderator :)
The only problem with your suggestion is I CANNOT telnet to it. It is ALWAYS busy and asking me to come later. Therefore...

Kayaker
Yes. It is not that easy for us to switch to English because it will require A LOT of the resources and our free time. But there are some articles translated indeed. For example, Four-F has translated his 5 articles about creating device drivers for Windows 2000. They already exist in English. May be in future I will translate my articles about packers to English... Who knows?
Quen sabe?


adding functionality
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > adding functionality
PDA

View Full Version : adding functionality

qweasdzxc
09-15-2003, 01:08 PM
NTE's QUICKCrossTM is a freeware program released by NTE electronics, It cross-references industry part numbers (for semiconductors) to NTE part numbers, It also passes as a cataloge for the company. I use this program at work and had to crack my copy to quit displaying a nag screen (about age of program, and possibilty of updates) after it was a year old.

I find this program very usefull, but it wastes a lot of my time... For instance, The bad part I just took out of a tv is a 2SD1555, it crosses to a NTE2331, But I don't have one of those.... But maybe another common part crosses to the NTE number, like a 2SD1879... As it is, I have to remember a list of other numbers, and try one at a time to find a match.

I want to be able to enter an NTE number, and find industry numbers that cross; not just the NTE descriptions.

Has anyone here done anything similar to this? Or do you guys know of any tutes dealing with adding search abilities to a database?

Also, Where the hell would I start?
squidge
09-15-2003, 05:57 PM
Is this all in a single file, or does it use a database, etc? Also, is there a place to download this from?
ZaiRoN
09-15-2003, 06:16 PM
Hi,
qweasdzxc: squidge is right, we need mch more information about the program. Tell us all the information you have about the database.

squidge: you have the name of the program...
qweasdzxc
09-15-2003, 11:06 PM
I did have a link up here, some one deleted the post! any way, it's a single file download.

The program installs an NTE.DAT file in it's dir. I figure that the database is inside the .Dat I have found the section of code inside nte.exe that reads the MessageBoxA ... its a loop at 00455EC8.

If you look up a partial number like 1543 you might get a list like

131543 crosses to NTE161
1543-00 crosses to NTE519
1N1543 crosses to NTE5840

If you look up an NTE161 you get a list like this...

NTE161 crosses to NTE161
NTE1610 crosses to NTE1610
NTE1611 crosses to NTE1611

I order alot of NTE parts, but sometimes I may be out of something by the NTE number, but have it in an industry number. I really need a way to do a reverse lookup and get the equipment fixed now, rather than wait a week for me to have enough parts for a minimum order. I waste about 3-4 hours a week on these reverse searches.

I don't know where to start... this is above my head, but I need something like this to work.
peterg70
09-16-2003, 02:59 AM
I know this sounds silly but what you need to do is the following.

Find the data storage system and try to decipher it.

If its a DBF/MDB etc then you can edit it directly and make mods.

If the data is stored inside an dat file try to read the file in a HEX editor to see if its visible. Or else it might be stored in binary. Then disassemble the file and look for references for reading the file. Use Filemon to examine how the file is read in by your program.

Once you have found the database all you need to do is copy all the data and reverse it. Then add it back to the database.

Assume that currently you have
131543 = NTE161

Then if you reverse the line and add it back to the database.
NTE161 = 131543

Then when you type NTE161 it will find all matching info.

Just a thought.
qweasdzxc
09-16-2003, 10:38 AM
Originally posted by peterg70
I know this sounds silly but what you need to do is the following.

Find the data storage system and try to decipher it.

This makes sense to me, But if I reverse the database, wouldn't that ruin any forward lookups?

I looked at the .dat file last night, it's about 4.5 megs of gibberish! I see part numbers all lumped together, I can't make heads or tails of it right now. I'll try filemon on it after work today.
naides
09-16-2003, 03:14 PM
The extension .DAT
corresponds to

Btrieve Database

Which might be the database format used by your freeware app.

Search for Btrieve applications and see if it can open and read your database files.
Iwarez
09-16-2003, 05:29 PM
Maybe you can attach the first 100 bytes of the file. I work everyday with btrieve databases and can tell you wheter it's one or not. BTW .Dat is not the standard extension for btrieve databases. It's MKD, commonly renamed to BTV or BTR.
naides
09-16-2003, 07:30 PM
I looked for database related software which uses .dat extensions and found Btrieve at

hxxp://www.uktsupport.co.uk/reference/fext/fextd.htm

which may be or not useful.

I did not intend to mislead qw, just giving him a lead to try. I have not worked with Btrieve databases
qweasdzxc
09-16-2003, 08:06 PM
NTE.DAT the main datebase I'm interested in, it's the list of industry numbers... But some of the entries start with -'s part numbers don't normaly start with -. but the format I have seen so far is partnumber.partnumber.partnumber.ect...

NTELNK.DAT is about 110KB it looks like a list of NTE numbers crossed to .pdf files, in this program you can download pdf files for indepth part descriptions, and conveniently, the program gives you a direct link for all parts that have a pdf available.
format is .^/specs/100to199/pdf/nte116.^.^/specs/1100to1199/pdf/nte1161.^/specs/1100to1199/pdf/nte1162.^/specs/1100to1...........

NTE.CMT is full of short descriptions for the parts, these descriptions are displayed when you do a search and select a part. ie. T-NPN,SIHI VLTG HORIZ SWITCH W/ DAMPER

I looked into btrieve, but I don't think that it's the case in this prog. In all of the programing I've ever done .dat was just a data file, It could be anything, These lists, like naides link are really inaccurate, but helpfull in figuring out what files you might need to backup, or get rid of.

I used filemon on this. I found that both NTE.DAT and NTELNK.DAT are read into memory upon the start of the program, I didn't see anything unusual though. I found out more with a Hex editor and the various NTE*.* files.

Iwarez, Here is the first section of the Dat file. I included up to the first part numbers in the table.
qweasdzxc
09-16-2003, 08:15 PM
I think this is the important section in the exe. This section is responsible for program I/O flow. The error message you get if your search crosses to over 200 parts, is apperantly prompted by checking a few bits (flags?). Depending on which bits are set, this section of code will display search results, or different error messages.

00455EC8 /$ 53 PUSH EBX
00455EC9 |. 56 PUSH ESI
00455ECA |. 57 PUSH EDI
00455ECB |. 51 PUSH ECX
00455ECC |. 8BFA MOV EDI,EDX
00455ECE |. 8BF0 MOV ESI,EAX
00455ED0 |. 33DB XOR EBX,EBX
00455ED2 |. 6A 01 PUSH 1 ; /RemoveMsg = PM_REMOVE
00455ED4 |. 6A 00 PUSH 0 ; |MsgFilterMax = WM_NULL
00455ED6 |. 6A 00 PUSH 0 ; |MsgFilterMin = WM_NULL
00455ED8 |. 6A 00 PUSH 0 ; |hWnd = NULL
00455EDA |. 57 PUSH EDI ; |pMsg = 0012FF74
00455EDB |. E8 1029FBFF CALL <JMP.&user32.PeekMessageA> ; \PeekMessageA
00455EE0 |. 85C0 TEST EAX,EAX ; checks MessageBoxA for user input.
00455EE2 |. 74 75 JE SHORT nte02.00455F59
00455EE4 |. B3 01 MOV BL,1
00455EE6 |. 837F 04 12 CMP DWORD PTR DS:[EDI+4],12
00455EEA |. 74 66 JE SHORT nte02.00455F52
00455EEC |. C60424 00 MOV BYTE PTR SS:[ESP],0
00455EF0 |. 66:83BE C2000>CMP WORD PTR DS:[ESI+C2],0
00455EF8 |. 74 10 JE SHORT nte02.00455F0A
00455EFA |. 8BCC MOV ECX,ESP
00455EFC |. 8BD7 MOV EDX,EDI
00455EFE |. 8B86 C4000000 MOV EAX,DWORD PTR DS:[ESI+C4]
00455F04 |. FF96 C0000000 CALL NEAR DWORD PTR DS:[ESI+C0]
00455F0A |. 8BD7 MOV EDX,EDI
00455F0C |. 8BC6 MOV EAX,ESI
00455F0E |. E8 19FFFFFF CALL nte02.00455E2C
00455F13 |. 84C0 TEST AL,AL
00455F15 |. 75 42 JNZ SHORT nte02.00455F59
00455F17 |. 803C24 00 CMP BYTE PTR SS:[ESP],0
00455F1B |. 75 3C JNZ SHORT nte02.00455F59
00455F1D |. 8BD7 MOV EDX,EDI
00455F1F |. 8BC6 MOV EAX,ESI
00455F21 |. E8 FEFDFFFF CALL nte02.00455D24
00455F26 |. 84C0 TEST AL,AL
00455F28 |. 75 2F JNZ SHORT nte02.00455F59
00455F2A |. 8BD7 MOV EDX,EDI
00455F2C |. 8BC6 MOV EAX,ESI
00455F2E |. E8 41FEFFFF CALL nte02.00455D74
00455F33 |. 84C0 TEST AL,AL
00455F35 |. 75 22 JNZ SHORT nte02.00455F59
00455F37 |. 8BD7 MOV EDX,EDI
00455F39 |. 8BC6 MOV EAX,ESI
00455F3B |. E8 C0FDFFFF CALL nte02.00455D00
00455F40 |. 84C0 TEST AL,AL
00455F42 |. 75 15 JNZ SHORT nte02.00455F59
00455F44 |. 57 PUSH EDI ; /pMsg = WM_QUIT ExitCode = 0
00455F45 |. E8 362AFBFF CALL <JMP.&user32.TranslateMessage> ; \TranslateMessage
00455F4A |. 57 PUSH EDI ; /pMsg = WM_QUIT ExitCode = 0
00455F4B |. E8 5825FBFF CALL <JMP.&user32.DispatchMessageA> ; \DispatchMessageA
00455F50 |. EB 07 JMP SHORT nte02.00455F59
00455F52 |> C686 8C000000>MOV BYTE PTR DS:[ESI+8C],1
00455F59 |> 8BC3 MOV EAX,EBX
00455F5B |. 5A POP EDX ;user32.D016F1
00455F5C |. 5F POP EDI ;user32.D016F1
00455F5D |. 5E POP ESI ;user32.D016F1
00455F5E |. 5B POP EBX ;user32.D016F1
00455F5F \. C3 RETN


Screensavers special
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Screensavers special
PDA

View Full Version : Screensavers special

nikolatesla20
09-15-2003, 06:33 PM
Anyone watch TechTV ScreenSavers? It's a cool show.

ANyway, Sept 19, Wednesday - Software Piracy Special

Figured it should be fairly interesting.

Dark Tip: Cracked software
Kevin talks about methods used to crack serial numbers and other software copyright protection schemes.

Hm. Wonder if he'll know what he's talking about :p

-niko
disavowed
09-15-2003, 07:23 PM
heh, i used to watch that show when i still had satellite. anyone want to record that session and post it somewhere?
nikolatesla20
09-15-2003, 10:13 PM
congrats on 100 posts, disadvowed !

:D

-niko
evaluator
09-16-2003, 01:33 PM
nikolatesla20!

How about arm-unpacking tut from you in ScreenSaver!?
squidge
09-16-2003, 04:34 PM
Don't do it Niko, they just want to steal your secrets and pass them onto Chad ;)
qweasdzxc
09-16-2003, 05:03 PM
A majority of what they report will probably prove to be outdated. Kinda like the special they did on direct tv hacking. People were using HU loaders When the screensavers showed an old battery card for the F series. The F card had been out of the data stream for nearly 3 years, when they reported it!


A New Tool...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A New Tool...
PDA

View Full Version : A New Tool...

Aimless
09-16-2003, 05:49 AM
"DebugApiSpy" on

http://liangs99.myetang.com/pengchunhua/en/

The important thing here is not that is spies on APIs, that's old hat.

The important thing is it will ALSO SPY ON FUNCTIONS FROM a MAP file (from any disassembled file)

It brings so many things to mind now, does it not?

Have Phun
Aquatic
09-18-2003, 02:44 AM
Yes, it's an awesome program. I have the full version, and it's great.

I have v2.0, and I'm not sure if it supports the map files.
Zilot
09-18-2003, 06:30 AM
message is deleted..................................
Aquatic
09-18-2003, 05:29 PM
^ what?
Zilot
09-19-2003, 06:19 AM
http://smilies.sofrayt.com/%5E/9/confangry.gif
Zilot
09-19-2003, 06:43 AM
FoxB ?? http://smilies.sofrayt.com/%5E/3/dont.gif
your PM-Box is full, how to send you anything ?
leave me your mail.


VXD vagaries
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VXD vagaries
PDA

View Full Version : VXD vagaries

LaptoniC
09-16-2003, 06:05 PM
I am trying to remove time limit protection of brstudio's hasp emulator w9x version.VXD code is harder to follow because it jmps or call function with below type of code

push ebp
call $+5
pop ebp
lea ebp,[ebp+12h] ;
call ebp

or
push offset xxxxxxx
push ebp
push eax
call $+5
pop ebp
lea ebp, [ebp-15h]

call ebp

etc..

After 30 minutes VXD disables itself and emulator do not works.I have found 3 time functions in the vxd

C00105C5:
VMMCall Get_System_Time

patched to mov eax,0

C0006A84:
Int21 ah=2Ah Exec_VXD_Int ;GET SYSTEM DATE
patched to

xor ecx,ecx
xor edx,edx

C00067E:
Int21h ah= 2Ch Exec_VXD_Int ;GET SYSTEM TIME
same as above

Emulator exe always show 29 minutes remaining in the about box however after 29-30 minutes vxd disables itself.Could you help me on this subject.

ps:I have some problems about bpx on vxd.I have tried bpx hasp95dll+xxxxx but it doesnt break.

Thanks.
qweasdzxc
09-16-2003, 09:42 PM
it sounds like you have disabled the display of the time changing, but the clock is still running somewhere else.

look for amounts of time, milliseconds, seconds, minutes.
Or look for gettickcount, you might find a section of code that counts down/up to your limit.
CrackZ
09-19-2003, 03:22 PM
Hiya,

1. There is a release (so say time de-limited) of this emulator out there, so you can do a simple fc /b listing to find out what has been patched, sounds like you are hunting around the right areas though.

2. Don't use bpx style breakpoints. You need to use bpmb <address> x style ones instead, find the control_proc address in SoftICE with the command vxd hasp95dl and bpmb there or set your bpmb's once you reach there.

3. A requirement of any HASP emulator (old style) is that they take over the INT 6 handler, depending on how the emulator is implemented, certain functions that call the invalid opcode handler disable breakpoints, can be VERY tedious.

4. I'll probably have a trace sometime of the code and post a little more. In the interim, if you can set i3here on in SoftICE drop me an e-mail and I'll send you my drivers to *play with*. As far as I know mine are now the only ones supporting the new style hardlock communication routines ;-).

Regards

CrackZ.
LaptoniC
09-19-2003, 08:57 PM
Hi Crackz;
Thanks for replying.My real interest isnt hasp3 protection as we know it is dead.I just want to learn how to reverse vxds how to put breakpoints and want to learn how good its protection.

Someone(thanks) from board send me that cracked version.I looked and saw that it only patches VMMCall Get_System_Time I tried that one and it doesnt works after 30 minutes :)
I will try your bpm tip

I have your old version of emulator+src before you took out from web saying that it had a bug.

I appreciate your answer if you find how this program knows time please letme know I really wonder.

Best Regards
separator
09-20-2003, 12:17 AM
CrackZ: Did you check thier web page? I found something like this: "For October, 1, 2003 it is planned to first reliase HASP Emulator Professional Edition V 2.33.A001
The emulator will support completely all functions HASP4 dongle, including 3C-HaspEncodeData and 3D-HaspDecodeData, and complete support HASP to HARDLOCK driver."

I think its pretty interesting. If its true then I think HASP is dead :)
CrackZ
09-20-2003, 07:37 AM
Hiya separator et al,

I hadn't seen this post, so just checked it out, looks like Glasha also has released his previous emulators (minus the time restriction) for public download (not verified this though since I never needed anyone elses emulator ;-) ). LaptoniC, I guess this reduces studying his time trial protection to a trivial / interesting pasttime.

It will be interesting to see what actually materialises. From what I can see this guy is looking to make money off his HASP emulator, doesn't take a rocket scientist to figure out that by disclosing the encode/decode services he effectively is giving away everything of value. I'll be one of the first just to plug in the algorithms to my current Hardlock/HASP emulator and make them public, the scene will be hot on my tails I'm sure.

As a background, about 18 months ago I heard from a guy that said these services had been broken, no enquiry since then has ever received a reply or anything plausible in details, thats unusual (at least in my experience), so I'm maintaining a little scepticism about all of this.

These guys could save themselves much work if they just disclosed the algorithm, I'm assuming they must have it, I'd happily share then the code I'm using for the hardlock emu (since they are probably doing lots of tedious tracing to uncover what in reality is a very simple decryption).

Regards

CrackZ.

PS - I received a few e-mails from Glasha a while back, but he never really came out and asked me for anything, struck me as odd, almost as if he didn't think I'd know who he was ;-).
LaptoniC
09-20-2003, 11:14 AM
CrackZ time limit exists.I dont know where did you get impression of"minus time limit". I like the gui of this program and the small utilty inside called secret table finder.AFAIK, hasp4 uses same algo but it has secret tabe different than hasp3 so with enough seed and return values one can get the secret table.After we got secret table we can emulate except 3c and 3d.Please correct me if I am wrong.
CrackZ
09-20-2003, 02:27 PM
LaptoniC,

I'll download and take a look, when I'd looked before Glasha had always *advertised* the time limit and when I checked today, it was no longer present, hence the assumption ;-).

Your theory is correct for the HaspCode() implementation. HASP4 = HASP3 (different secret table), exefoliator published a paper a while back regarding utilising some known HaspCode() responses to recover it, 2 or 3 is usually sufficient. There are afaik no direct secret table readers for HASP 4, actually that might be incorrect since I remember someone telling me HASPGrab could do it, but it never worked for me.

All this is kind of irrelevant since the target is the HASP 4 envelope, and that requires knowledge of encrypt/decrypt services which look to me to be very simple block ciphers.

Regards

CrackZ.
separator
09-22-2003, 12:09 PM
CrackZ: We will see very soon. They will release thier new 1st. October. If they know how to emulate these functions, then i think envelope will be breaked too. But I don't know if they will release public trial version, because i think many other people then will create emulators :) If they will, then someone will publish HASP's enc/dec algo and HASP is really dead (until new version).
Btw: I heard some time ago, some people in Russia can create fake HASP4 dongles. You just send them one dongle and they will create fake dongles. Of course for money. I didn't believe it until two weeks ago, because then I have one of these fake dongles and it worked nice (with envelope too).
Goudurix
03-04-2004, 04:36 AM
hi,

i visit the site of glasha
http://www.brstudio.com/Keys/eFAQ.htm
look at this
The emulator supports only calls to HASP dongle through HARDLOCK the driver.
this is my need , i think, my emulator doesnt work since new release of the soft i use (Windev)
and after my research, i find that it was the calls through hardlock who dont work

i mailed glasha to get his emulator, huhu , here is his answer :rolleyes:
HASP Emulator Professional Edition not have Demo or Trial versions!
Now, in the new emulator the policy(politics) of registration is changed.
The emulator is adhered (attached) to the computer, i.e. works only
on that computer on which registration is received.

Costs:
1 license ( one computer) - $250
5 license - $500
10 license - $900

this guy is nice, but at this price, i buy another dongle :D

@CrakZ: need help to develop a free emu ? i can spend my time on this, but my knowledge in device driver are limited...

scuse for my english, im french ^^
CrackZ
03-04-2004, 06:42 PM
Hiya Goudurix,

I posted a long time ago, actually about 9 months maybe about new HASP communication routines, sparing you the nitty gritty details, it went something like this. A few years back Aladdin set about "merging" the HASP & Hardlock technologies, remember a few old posts asking why hardlock.* got installed by the HASP drivers?, well thats when they probably had the idea (conveniently it would break most of the HASP emulators too ;-) ).

The first implementation of this merging had a really bad weakness, only a structure got passed in by the HASP side to the Hardlock driver, so one could still emulate on the HASP side and / or call Hardlock for original routines.

In API 12.0 (June 2003) or so Aladdin finally merged everything into Hardlock, the HASP drivers now exist solely to support backwards compatibility (old INT 6 handler), even these routines end up inside Hardlock (but can still be emulated in the old manner).

The Hardlock drivers are heavily obfuscated, in fact I think Glasha has probably borrowed a trick or 2 from them; I can't say much publically about the contents of his commercial emulator in public on this board ;-).

I undertook a project to de-obfuscate the Hardlock drivers a long time ago, the API encryption they use is amazingly simple, I actually still have very good IDA listings for them now, without any of the junking/anti-disassembling/stupid tricks.

Favourites of mine include :

xor eax, eax
jb _some_stupid_location (obviously never happens)

Masses of :

jnz _location
jz+4
junk opcodes in here
jz _location

And yet more fabulous anti-hacking technology :

xchg eax, ebx
xchg ebx, eax
shl ebx, 40h
shr edx, 20h

Ad nauseam .....

I don't think much of this 'security by junk' but I've found really effective ways to remove 90-95% of it in one go ;-).

Back to the plot, I posted a month or 2 ago asking if anyone was really interested in going forward with this, I'm actually pretty much there now and may get a release of a free emulator out in the next month or 2, but don't bank on it happening for sure. For obvious reasons, like the month of work or so, not many have replied to help since a lot of the final analysis stuff is just tedious IDA work.

Regards

CrackZ.
tgodd
03-04-2004, 11:27 PM
Hasp 3C/3D is being emulated by safekey.
As is Sentinels Superpro Enhanced Algo.
Goudurix
03-05-2004, 04:32 AM
hi CrackZ,

well it's good to see you working on this project :)

i dunno if there are many interested people with this, but me, i'm very very interested ^^

if i can help you in one way or another, just ask me...
I am ready to invest me in this project , and share this experiment ...

I have some concepts of ASM , and littles experiments about cracking...

bye

Goudurix


Why the DMCA ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Why the DMCA ...
PDA

View Full Version : Why the DMCA ...

nikolatesla20
09-18-2003, 08:25 PM
Sucks.

It's illegal to copy music and other digital media, but spammers are free to fill my inbox, cram internet bandwidth, and use fake email accounts.

-niko
Aquatic
09-18-2003, 08:54 PM
Move to Canada.
Woodmann
09-18-2003, 10:36 PM
Howdy,

The RIAA only cares about money.
The DMCA is the RIAA.

The bottom line is that ISP's will not make an effort to stop spam.
Unless they start losing a large amount of subscribers.
They wont stop spam because it takes time and money to stop it.

It's always about money.
nikolatesla20
09-18-2003, 11:52 PM
Exactly. Once again those with the money make the rules.
naides
09-19-2003, 05:31 AM
Well,

The sad reality ,that it is unlikely to win a frontal battle with the spammers because they are backed by money and powerful interests, a twisted sense of free enterprise (If it makes money, then it is ok), does not mean that they cannot be beaten on their own game.

A team of savvy individuals, with some loose cooperation from self learned experts in network traffic (i.e. Hackers) can set up a campaig n of spam the spammers, clog their bandwidth, flood their mail servers. . . Guess what: The heroes doing such an act of poetic justice will be treated as criminals! But hey, it is a good idea.
nikolatesla20
09-19-2003, 08:10 AM
Originally posted by naides
Well,

The sad reality ,that it is unlikely to win a frontal battle with the spammers because they are backed by money and powerful interests, a twisted sense of free enterprise (If it makes money, then it is ok), does not mean that they cannot be beaten on their own game.

I'm agreeing with you on this one, naides. The only reason spammers now get away with what they do is they hide under the title of "capitalism". In Europe they just passed a law that will fine spammers.

I've often gotten spam and the return address is not correct, so I could not unsubscribe. I also agree with you on beating them at their own game. Which actually brings me to a short blurb :

Just as it is not illegal to sell guns, but it IS illegal to shoot someone with one, I believe the DMCA has overstepped its boundaries by A LOT. For example, they have prevented numerous individuals from even just sharing information about DVD decryption algorithms the Elcomsoft E-Book format, etc. The point here being that information in itself SHOULD NOT be illegal. If they wanted to enforce a "law" then it should be the USE of the information. Even creating a software product that uses the information is still not enough, it should be seen and proven that the software is actually being used.

This leads me to my concluding argument. Would it be illegal to write an unpacker and sell it? I'm sure everyone would sound a yes to that one. Especially since one of the rules of the DMCA is to "prevent any device used to circumvent digitial protection". Even if it's only our thoughts! But that's a tangent. Really, just as any author can come up with a protection scheme, I see myself nothing wrong with another author coming up with a way to break it. Let us look at the real world again. Most doors and cars use keys. In that case, Locksmithing should be illegal. I know, I know, the locksmith only works on stuff that people already own, but hey some people might not want their program packed even though they've bought it. Once again, it's not the selling of the program (or the keys of the Locksmith, or the sale of a gun), which make something illegal. It's the USE of the foresaid product by the end user, the customer. Also, this rule of "preventing circumvention" does not follow capitalism. C'mon, how many great products out there are the result of some sort of reverse engineering? I'd say quite a few. Even reversing a fighter jet from another country during a war. Going against such a spirit prevents any improvement in the current schemes of protection, and can keep competition low. After all, if your product is truly good it should be able to stand up the crackers, right? Don't let the DMCA whine for you when your product sucks.

Elcomsoft themselves write ZIP and RAR password crackers. Isn't this a violation of DMCA? I still think that if a cracker feels the need, and has the time to invest, there would be nothing wrong with writing unpackers, for example, and selling them. It's a digitial product just like any other digitial product. It took time to write and test, etc. I'm not saying that there is any practicality to a cracker (*cough*, entreprenuer) in selling his works in the first place, but I'm just making the case of why creating such works is so deemed as "illegal". I think that is B.S. Why should the author of a protecter be deemed "God" compared to the writer of an de-protector? It's all a capitalistic venture. For those of you concerned with the moral ground, I again repeat that you can sell a gun which really has no other use but for shooting a person. You can't go hunting with a 9MM. The sale of the gun in itself is not illegal.

One last thing, the Blaster Worm eats up lots of internet bandwidth. So do spammers. Why is one illegal and the other not (or at least regulated in some manner).

-niko20
evaluator
09-19-2003, 08:16 AM
nikolatesla20,

Too many iNglish..
while i'm translating, 1 Question:

Sounds you want to support DMCA!?
nikolatesla20
09-19-2003, 08:20 AM
lol, no I do not support it in its current form

-niko
evaluator
09-19-2003, 09:43 AM
okey, I RESOLVED from this thread following subjects:

1. Why the DMCA ... Sucks.
{But who cares about it!? Ok, you will support DMCA in its BETTER form..}

2. Why spammers can fill your mail-box.
{..}

3. Will it BAD or GOOD or ILLEGAL, if you will sell your unpacker.

I feel, this is main subject of your interests, but you started with another Title.
But feels are not args, so sorry.

LETS: make another thread(can be poll) with following title:
"Your opinions about selling unpackers(Good-Bad-iLLegal)"

& discuss subject there. I think, it will interesting.
nikolatesla20
09-19-2003, 09:57 AM
good job evaluator , you found the question I was also asking, but since this IS the off-topic forum, I just wanted to debate the DMCA's entire principle, not just my own interests.

-niko
qweasdzxc
09-19-2003, 11:08 PM
Originally posted by nikolatesla20
Sucks.

It's illegal to copy music and other digital media,

-niko

What about VCR's, TIVO, Video capture cards, and Settop box DVD recorders? What about recording songs from radio?

What about trademark/copyrighted graphics/text? Could DMCA eventually affect photocopiers, scanners, or cameras?

As I have always understood, recording a televised event with any device is OK; provided that the copy is for personal home use. So, logicaly, I could record MTV, VH1, or MUCH; and have not only the song, but the video as well!

So, inside of the gray areas of DMCA, is the real issue here the fact that it's EASIER (just a few clicks) for the average joe to make his copy? Someone can argue that people are downloading movies before they are released... So what? I can wait for the movie to premier on HBO, then make my copy. If they want to stop me from doing that they would ultimatly have to go after the manufactures of any recording equipment, including computers.

DMCA has crybaby written all over it. RIAA is still earning money everytime a song is played on both TV and Radio, not to mention movies, and concerts.

Has anyone noticed that when a character on TV has a birthday, they don't sing "Happy Birthday" like they used to? Happy Birthday is copyrighted now too!
tgodd
09-21-2003, 12:27 AM
Try reading the precidance of universal studios vs. Sony.
Over the beta max.

Although the majority of use could be considered "illegal", the fact that there was even a small chance of legal use, made the beta legal for sale.

tgodd
qweasdzxc
09-22-2003, 05:02 PM
Originally posted by tgodd
Although the majority of use could be considered "illegal", the fact that there was even a small chance of legal use, made the beta legal for sale.
tgodd

Yeah, which ties into the case of CBS vs. the democratic national committee.

Columbia Broadcasting System, Inc. v. Democratic National Committee, 412 U.S. 94, 102." Id., at 454. n8 Even when an entire copyrighted work was recorded, the District Court regarded the copying as fair use "because there is no accompanying reduction in the market for 'plaintiff's original work.'" Ibid.

I was trying to point out what a daunting task it would be to stop pirate copies. I still say that DMCA is a law formed by the government to protect the intrests of their best friend, big business. Big business is just pissed because it's so damn easy to find/make copies with the help of the internet.
UrgeOverKill
09-22-2003, 06:57 PM
simple solution: change you MAC address to DMCA's and emulate their IP address and enjoy! ;)


A Haiku
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > A Haiku
PDA

View Full Version : A Haiku

nikolatesla20
09-18-2003, 11:56 PM
Here's some Haikus I came up with tonight, based on 5-7-5 syllable format.

Cracker's Haikus
-----
Headache

Scanning through the code,
O Where is the magic jump?
My mind turns to stone.

-----
Success

Patch the file again-
My face breaks into a smile.
No fatal errors.

-----
Simplicity

In the deadlisting,
I find a Reg based offset.
Need a debugger.

-----
Jerks

My System goes dark,
In the middle of my work.
Blaster worm again.

-----
Skill

I massage the bits
Of my downloaded demo.
Full version I have.

Let's see if we can add some more to this thread??

-niko20
Kayaker
09-19-2003, 03:38 PM
It was interesting reading the thoughts behind Haiku, figured it deserved a try. We'll open a Haiku forum ;)

Undocumented NT

Hungry for knowledge,
I chew the hard Kernel coat.
Ahh, sweet pulp revealed!

Kayaker
disavowed
09-19-2003, 06:23 PM
Not a Haiku, but I like the sound of it:

I control the one.
I control the zero.
I am a Reverser.
dELTA
09-19-2003, 07:50 PM
Disavowed, here's your "poem", patched into true haiku syllable format:

I control the one.
I control the zero too.
I'm a Reverser.

:p
nikolatesla20
09-19-2003, 09:48 PM
LoL
disavowed
09-20-2003, 11:35 AM
Delta, I think I'll have to patch that back to my way:

I control the one.
I control the zero NOP.
JMP j
I'm a Reverser.
j:
I am a Reverser.

:D
dELTA
09-20-2003, 01:36 PM
:p
You should have tested that patched haiku more carefully before releasing it, there was a hidden CRC check. Now your haiku is actually the following if you try to execute it (i.e. read it out loud):

CRC check failed
Please register this haiku
Bluescreen, bugcheck, crash

:D


Ok, what do you think about selling unpackers or other de-protection schemes?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Ok, what do you think about selling unpackers or other de-protection schemes?
PDA

View Full Version : Ok, what do you think about selling unpackers or other de-protection schemes?

nikolatesla20
09-19-2003, 09:59 AM
Evaluator pointer out that my main agrument in the DMCA thread was the opinion of selling unpackers, or other de-protection schemes.
sope
09-19-2003, 10:31 AM
At some point of time in life everybody has to think about it. Language of Money is Universal. Unpacker authors deserves more money then the Packer authors. There is nothing wrong with that at all.

Regards, Sope.
esther
09-19-2003, 01:06 PM
Hmm,
I felt that selling unpackers is a wrong motive because it ain't legal.If they want to sell something they should code a better packer or wrapper rather than unpacker.

my 2 sense ;)
Woodmann
09-19-2003, 06:54 PM
Howdy,

You should be able to produce and sell unpackers.
Why should it be any different from anything else.
The big name/s in debuggers dont hear any shit about their product.

Reverse-engineering is a way of life.
It is part of product development for the most part.

What is the law that says I cant take my tv apart to see how it works ?
What about trying to duplicate a food item ? You buy one, look at the ingredients, use your sense of taste and smell and have at it.

These things also need to be "unpacked"

Is it cheaper and easier to buy cake mix ? It sure is but, if you decide to make your own, should Betty Crocker be able to sue you ?

The answer is no, they dont own the exclusive rights to flour egg's and milk.

What is software ? It's code, letters and numbers. Who owns the exclusive rights to letters and numbers ? No-one. So why cant I look at the letters and numbers ? After all, I paid for the product.

Dont get me all riled up :D
disavowed
09-20-2003, 11:38 AM
Originally posted by Woodmann
What is the law that says I cant take my tv apart to see how it works ?
What about trying to duplicate a food item ?
True, there are no laws against taking apart a TV or a food item. However, as much as we don't like it, there are laws against reverse engineering software (in the United States, anyway).
ryan
09-30-2003, 09:00 AM
I do not see the reason why not. When I was a cracker, I spend hours learning and learning. When it is time to write my CV for my job application, I realised that I could not write the following line: "Accomplished reverse engineer with a few years of experience and keen to teach".

So, what's left from that? Well, I write my own stuff to sell. ;)
evaluator
09-30-2003, 03:42 PM
>>After all, I paid for the product
Nops! You paid for license, where you agree not look inside &..&..&..
nikolatesla20
09-30-2003, 05:29 PM
Well, when I write unpackers, I will simply distribute my own license which states also that you cannot look inside or disassemble it.

Then, if anyone starts to complain about the unpacker's functioning on their protection, or they break it with a specific change, I'll know they looked inside. Two wrongs don't make a right do they?

-nt20
Woodmann
09-30-2003, 05:45 PM
OK,

You need to look at those who lobby for software.
They lick political ass to get them to pass laws.
Why ?

Because "they" need protection.
This is not a matter of who bought what software.
Everyone knows that if your buddy has the latest version
of "mycoolvirusscan", he will "lend" it out so his pal can
copy it onto his own comp.
We all know that this is "the" single largest form of theft
that software companies suffer.

Somehow, some braniac decided that reverse engineering
was a threat to the software business. He did not do
his research and in some totally ignorant ephipany, declared
crackers, hackers, geners, serial freaks and wares all the same.

Back to the topic.....

How many "commercial" unpackers are out there ?
Wait, substitute another word for unpacker.

You write a software using protection "A"
I write an unpacker for protection "A"
I sell my unpacker for protection "A"
You change your protection to "A MODIFIED"
I change my unpacker to "A MODIFIED"

You see the trend here ?
It never ends, just like it is now.
Are crackers destroying the software industry ? No
Even if you bought an unpacker, you still have a lot
of work to do.(unless it is lame)

So, what is the harm ? It's not like you are selling reg codes
for a .99 cents.

Is selling unpackers worth it ? I have no idea.
I can see no way it can be illegal. If you want to play
by "their" rules, it is intellectual property. It's only letters
and numbers that make up code. Anyone can "assemble"
letters and numbers.

Here's another example of foolishness....

I build my own satellite receiver, the people who
broadcast via satellite have a law that says I am
not allowed to receive their signal without paying for it.

Why does that not apply to radio ?
evaluator
10-01-2003, 04:00 AM
D Wooma,

as I know, commercial-satellite-chanels are coded..
If there are not-coded chanels & they want $, looks stupidly from them.
Does it happens realy!?
FoolFox
10-01-2003, 07:53 AM
I do not see the reason why not. When I was a cracker, I spend hours learning and learning. When it is time to write my CV for my job application, I realised that I could not write the following line: "Accomplished reverse engineer with a few years of experience and keen to teach".

I've added reverse-engineering in my CV.

And that's precisely the point that make me the winner for the
job where I'm actually. Against 30 experienced security people.

When you work on the system security field, you have sometimes
to deal with wild binaries.

Only reverse-engineering can help you at this stage.

So you should add this point. Without speaking "cracking related",
there is still some legal field where that can be applied.

Regards
FoolFox
nikolatesla20
10-01-2003, 08:24 AM
I would like to remind everyone that this also refers to deprotection schemes as well, which is a similar thing to unpacking.

For example, Elcomsoft sells ZIP and RAR password crackers. To create such devices, they would have had to disassemble ZIP algorithms.

What about DVDXCOPY, and DVD2ONE, etc, which also are being sold, and remove CSS protection. (Which I find strange, CSS decryption has been outlawed, then how could these programs continue to be "legal")

It still continues to appear the creation and sale of the product isn't the "problem", but rather the use of said product. Of course, until some one whines and gets a law passed about it (like we need more laws...)

DVDXCOPY can hide under the term of the rights of an individual to make a backup copy. An unpacker can follow the same rules. What if the protector code does not seem to work properly? FOr example, it triggers my AV protector, or it simply crashes when I upgrade my O.S.? Yes, I COULD write to the author to ask for a fix. But if I already have a tool (unpacker) to fix it, why should that be wrong to use?

-nt20
sarge
10-01-2003, 09:28 AM
What burden of responsibility is placed on the author of the cracker/decompiler/hacker proggie to maintain and support his work if someone complains that it has a verified bug? Certainly a fix, generally as a prog upgrade, must be generated. How then do the other "customers" get their upgrade? Must the author provide a phone number? Maybe an address? Maybe a web-site? And how do they know that their existing version is flawed? Having taken on the "plus side" of getting money, shouldn't he be obligated to take on the "minus side" of support? Just what obligation does the author owe to his customers? Is the money worth the effort?

I suppose this is typical when you go into or start a new business. Does the selling the program constitute a "business", thus requiring the above-mentioned burden of support?

To date, I continue to provide RACE for free, for this reason. (But you can bet your balogna that I'm keeping my eyes open!)

Sarge
evaluator
10-01-2003, 10:01 AM
nt20,

before we continue discussion, lets clear one simple thing:

Is MONEY default reason for you?
(or you more like fight with law? etc.)
nikolatesla20
10-01-2003, 10:18 AM
evaluator, no, this is not about money. I have a day job :)

I'm really only bringing up the issue because even writing an unpacker it looked upon as so hush-hush and no-no by the software industry. My argument is that an unpacker author's work has as much right to exist as any other, even if it is to be on the market for sale. Since, basically, no one would take it "seriously" unless it was on the market, no? I mean it would not attract legal attention. So in some ways, I am asking people how they think unpackers and deprotection programs stand legally.

As I've stated already, programs like ZIP and RAR password crackers exist. DVD2ONE exists. But "supposedly" there are "laws" that are supposed to, in reality, prevent these tools from existing. But yet they do exist and are on the market as well. I find it hard to understand the fact that, when it's against "EULA" to disasm and such, that these tools exist without any penalty. One could conclude then, that such "license agreements" are a puff of hot air and smoke.

I don't think I would personally at this time want to "sell" any tool, mainly for the reason that I think it's good just to get knowledge out, but also for the support reasons. Just release something and watch how many emails you get :) However, one has to admit that a monetary compensation, in any form, allows you to pursue goals with much more vigor and effectiveness. In other words, the product "should" usually improve. (Not that it always happens, though).

The main purpose of the thread is for discussion, not only for my pointing out my viewpoint. I just want to hear other's thoughts about these issues.

-nt20
ryan
10-01-2003, 11:00 AM
I've added reverse-engineering in my CV.

And that's precisely the point that make me the winner for the
job where I'm actually. Against 30 experienced security people.

When you work on the system security field, you have sometimes
to deal with wild binaries.

Only reverse-engineering can help you at this stage.

So you should add this point. Without speaking "cracking related",
there is still some legal field where that can be applied.

Regards
FoolFox

Sigh, my field of work does not involve software/security. It doesn't even need computers! Just the professional know-how is required.
evaluator
10-01-2003, 12:13 PM
well,

So if not for money, let's say shortly:
-Selling unpacker is Wrong Business Idea.

Now we can mark this interest as theoretical.
But what is theory without practice? Practice should be first.
(& more time no theory need..)

Really, only for interest,
try to sell publicly(via web) one non-generic unpacker for little $(5-10)
& you will have big practice in few days!
Probably you will be under attack of law or ethic etc.. Cool!

after will be possible to build some theory based on this practice.
If not a theory, then maybe cool Story.
nikolatesla20
10-01-2003, 12:28 PM
Point taken.

But remember, this poll was your idea :)

-nt20
evaluator
10-01-2003, 12:58 PM
but i thought, you was about only $.
sarge
10-01-2003, 02:16 PM
Are there degrees of unpacking/decompiling? If you do half the job, have you really reversed the prog, from a legal point of view? Or maybe you are only half-illegal? What about VBREZQ, that gives you forms, control, declarations, graphics, and sub and functions, but without the source code? Is he half-legal? Maybe his price is only half-price!!?? At what point have you crossed the line?

Sarge
Aquatic
10-02-2003, 01:14 PM
Even if you did sell unpackers... who would buy them?


heuristic scanning
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > heuristic scanning
PDA

View Full Version : heuristic scanning

nikolatesla20
09-19-2003, 10:11 AM
I've searched the net, and haven't really found much info on how to actually implement heuristic scanning...

Um, the reason - I want to build an advanced scanner for unpacking purposes.

Does anyone know of some good sites by chance? Is heuristic scanning based off of genetic algorithms, or neural network programming, etc?.

-nt20
volodya
09-19-2003, 11:15 AM
There are several opportunities as to the implementation.
Lets say you have some sort of signature of the packer. Now you can do the following:
For exact match:
1) Right from the EntryPoint - byte-by-byte comparison - extremely slow and stupid
2) Using binary tree algorithm or Boyer-Moor fast search though the WHOLE file
3) Using syntax analyzer after the event has been triggered and decide if it is true hit or the false one
For heuristic scan:
1) Use some of bioinformatics ideas (e.g. BLAST engine)
2) Train NN. But you have to provide it with the FIXED-LENGTH(!!!) input all the time. E.g. you have to have all the signatures of the SAME number of bytes. And you have to have single binary output NN for each and every packer. The speed of processing will be fast but the idea is not that easy to implement...
3) Your genetic algorithms... Mmm... Never thought about it!
Anyway, we will try to implement sth like this in the PE Sniffer new version (ships with PE Tools).
nikolatesla20
09-19-2003, 11:44 AM
Hi volodya,

Thanks for the answers, nice to see some good ideas going into PESniffer.

The whole reason for my query is I have a basic OEP detection tool, but I wish to improve upon it, to make it more robust , i.e, reliable and accurate.

Most PE tools out there right now only scan for packer detection, my tool will scan a program in memory for it's OEP code, to aid in unpacking tasks. It works quite well already but there will be some small things that will need to be addressed.

what I'd like to do is create this program and a method by which I can simply feed a whole directory of EXE's to the program for analysis, and it would gather an analysis of all the EXE entrypoints code, and "learn" or build a best-match type of database for when it scans an unknown target in memory (or a program that has been dumped to disk)

So in actuality, it isn't signatures of packers I am looking for, it's signatures of programs written with common compilers. (this should be much easier). I was actually thinking a set of regular expressions might work just as well, although they require some manual labor at creating..

ALso, "stolen bytes" packers are not a problem, I'm taking the signatures from around 32 to 50 bytes down from entry (on normal programs that aren't packed, I grab the entrypoint signatures)

So basically doing a type of FLIRT like IDA does..having byte sequences with wildcard entries. What is your opinion of this idea? Just as a side note, I've created a very basic tool already and used it a couple of times, and it's worked :)

-niko
volodya
09-19-2003, 02:13 PM
Idea is pretty interesting, but not that simple. First of all, IDA uses not only byte-sequenses but CRC16 and the control byte in addition. And you should take into account relocatable bytes as well. The problem will arise when playing with dll.
Therefore some really good heuristic algorithm needed. The problem is not to search for OEP in memory, it is pretty trivial, the problem as I see it is to CORRECTLY detect the packer. Let me read about BLAST engine a little bit more and we discuss it a little bit wider.
nikolatesla20
09-19-2003, 02:59 PM
regarding relocatable bytes:

In some targets, yes, you can't get around these. I would simply comment these out as wildcards, hence the scan engine would simply ignore them. I'm only looking for a sequence of some type. Most compilers I've seen use the exact same startup code every time they compile except for maybe one or 2 bytes or so.

Also, I was only picking segments of code that didn't contain relocatable offsets, for example, making sure there were only reg based offsets in the whole block if there were offsets at all.

Yes, I read about IDA's flirt, I'm just not sure you'd have to go to the same level when only searching for OEP since entrypoint code is usually simpler, and doesn't contain duplicates. At least, in most of my tests, I haven't found any. (for example, scanning the whole file only will return with 1 result, the OEP area)

Yes, I see perhaps you are correct in detecting OEP in memory is rather trivial..but I think it's a good tool for a user to quickly find
OEP without needing to do anything else special.

I would however like to say hats off to the authors of PEScan and PETools, very nice work. :) Keep it up, we need people like u.

-nt20
volodya
09-19-2003, 03:26 PM
First of all - thanks for the kind words.
As to the startup code. Consider the following. Suppose one recompiled crt0.c with some asm shit like:

_asm
{
xchg eax,eax;
mov eax, ebx;
nop;
mov ebx, eax;
xchg ebx, ebx;
}

you got the idea. Tell me - will you search engine be able to recognise such shit? BTW, there are several utilities which are able to do sth like this automatically. Consider, for example, Stealth PE 1.01/Hide PE 1.0 - you may download them from wasm or from hxxp://bgcorp.narod.ru/download.htm.
nikolatesla20
09-19-2003, 04:19 PM
Great, I'll take a look at them when I have time, thank you :)

-niko
SiNTAX
09-19-2003, 04:32 PM
Don't know if it's of any use to you, so I'll just post it and let you figure it out :)

Description of Scan engine of ClamAV (open source anti virus):
hxxp://clamav.elektrapro.com/doc/html/node41.html
Clandestiny
09-19-2003, 06:53 PM
Hiya,

This is an interesting topic... You mentioned not being able to find a lot of information on heuristics... I would like to suggest an interesting avenue for research... Have you considered researching heuristic techniques as they relate to anti-viral cleaning? Incidentally, I'm considering exploring this topic for a project in a graduate course I'm taking and have just started some research into it. In doing this research, I came upon the realization that the obstacles faced in attempting to design a program to heurstically clean infected viral files bears a striking similiarity to the obstacles faced in attempting to design a heuristic OEP locator. Essentially, it is the same problem, albeit with a different objective (ie. ridding an .exe of a "protector" as compared to ridding an .exe of a "virus"). Indeed, when you think about it, "protectors" behave similarly to many virii, albeit without the feature of "replication". They append themselves to PE files, redirect the OEP of the original program, encrypt and decrypt themselves dynamically during run-time, and ultimately often return control to their target so that it runs without alerting the user that there's a problem. A good heuristic viral cleaner then, would essentially be a very good generic unpacker and it would necessitate solving the same difficulties of locating the OEP, which may or may not be obsfucted by the virus. For example, no doubt, a good virus would attempt anti-anti techniques similar to the "stolen bytes" trick used in some packers.

As I understand it, heuristics, involves defining a solution based on probablities associated with a "rule-set" and it is this feature which makes it "generic" as opposed to non-heuristic methods which would attempt to identify the OEP with a specific "byte sequence". Each rule would be assigned a certain weight and the sum of the weights at the end of the analsyis would define a probability which may or may not cross a minimum threshold value. Consider the simple case of determining weather or not a program is "packed"... One may look it in a PE editor and observe that the entry point of an .exe is located in the last section in the file. From experience, one would know that this could indicate that the program might be "packed", but it's not enough to make a 100% definate conclusion. One may then note that the section names are not consistent with those generated by common compilers. This would lend a little more weight to the hypothesis that the program is "packed". Finally one might load it up in a debugger and note the absence of common APIs called during the startup of a normal windows program. Once again, this lends more weight. Finally, one may begin tracing and note the presence of self-modifying code and conclude that the program is almost certainly packed. Taking this thought process, we have some rules that we tend to apply when determining weather a program is packed.

1. Location of the entry point at end of PE file
2. non standard section names
3. absence of common APIS called during windows startup
4. presence of SMC

Clearly, some of the rules would hold more weight than others. The presence of SMC would probably hold a very high weight as opposed to the simple presence of non standard section names. Taken by itself, the weight of a single rule may not be enough to determine that a program is packed (or infected with a virus as the case may be), but taken together we may conclude with a high probablity that the program is packed (or infected).

So, as I understand it, the goal is to attempt to generically define common behaviors of how encryptors return control to their targets and then attempt to define a set of rules that will be used to locate potential OEPs. The OEP with the highest weight would then be the one returned as the highest *probable* location of the entry point. Of course, since you are doing an OEP locator and not a full unpacker, if you found more than 1 potential OEP, you could return them all sorted in order of likelihood. Using the signatures of common compilers is a great idea to use for the design of these rules.

Like I said, I just started researching this topic so I don't have any definitive answers. Your post just happened to catch my eye so I thought I would suggest the heuristic AV cleaners as an avenue of research.

Here are a couple of links I found so far:

vx.netlux.org/lib/static/vdat/tumisc72.htm
vx.netlux.org/lib/static/vdat/epheurs1.htm
www.extremetech.com/article2/0,3973,367051,00.asp
www.extremetech.com/article2/0,3973,1166167,00.asp
www.extremetech.com/article2/0,3973,1166168,00.asp

Who would've thought that "crackers" and AV people are working on the same side of the fence, ;)

Cheers,
Clandestiny
nikolatesla20
09-19-2003, 07:38 PM
Thank you very much for the links Clandestiny!

Actually yes I was researching all the information about AV scanners, but as you might have found they guard their secrets closely :)

I will use your links as further research, and glad this topic is of interest to some!

I would have to say the only downside is that many of the higher level authorties on virus scanning think the heiuristics doesn't work at all. (yet)

-nt20
UrgeOverKill
09-23-2003, 07:49 AM
I do believe the Mac Afee already has this built into their products already and its a function you can use automatically.
v0kram
09-26-2003, 10:57 AM
Hi,

Isn't that exactly what GenOEP does ?? It scans for pattern bytes of the compilers and tries to guess at the OEP, though it's not very heuristic.

It supports most possible packers, but the new ones with the byte ripping technique can avoid the detection as they rip most of the common bytes.

I doubt whether looking much below the OEP for the common bytes would help in most cases, though again I maybe wrong.

Also, if the bytes are ripped, their is no way to confirm your detection...
nikolatesla20
09-26-2003, 11:26 AM
Hi,

Isn't that exactly what GenOEP does ?? It scans for pattern bytes of the compilers and tries to guess at the OEP, though it's not very heuristic.

It supports most possible packers, but the new ones with the byte ripping technique can avoid the detection as they rip most of the common bytes.

I doubt whether looking much below the OEP for the common bytes would help in most cases, though again I maybe wrong.

Also, if the bytes are ripped, their is no way to confirm your detection...

Any unpacker I've worked on only rips at maximum the first 14 or so bytes. Compiler OEP code is much longer than that - all you need to do is a pattern match on the byte sequences farther down. It works - my test program covers VC++ EXE and DLL's, but I can't do delphi yet because I need a better pattern match algo - I.E., I need to get regular expressions to work on binary data. For now I haven't yet figured out how to get regex++ library to work on binary data (data with embedded nulls) properly yet.

GenOEP? I've never heard of it. But that's what the whole point of this thread was, to see if there was already a tool out there to find OEP in a program running in memory.

Just as an example, even on packed programs, DeDe usually always finds the OEP of a Delphi program running in memory.

Packers can't rip too much code from OEP since they would also have to start making too many assumptions. But using a regular expresssion you should be able to easily detect common sequences, in a manner similar to IDA (and yes, you could add checksums too I suppose)

Regarding confirmation: We're not looking for a positive ID of the compiler here (although it still is handy), we are only looking for a byte sequence that is a possible OEP. In my tests so far, with my current pattern matches, you'll never get more than one match. So basically it's a strong pointer to the OEP AREA. NOtice I said AREA. You may still have to find the OEP manually from there, but it puts you right on top of it. Besides, I think many would agree with me, and I"ve done this as well, you can usually ignore ripped OEP bytes and simply place the program's entry point on beginning of the detected area, and the program will still run fine. I can verify for sure that it works on ACProtected apps. In that packer's case- Ripped bytes? who cares, you don't need em.

-niko20
v0kram
09-26-2003, 12:20 PM
Hey,

GenOEP comes with PEiD as a plugin...

As for detecting Delphi OEP, its got a bit of different method, GenOEP, PEiD and DeDe all use the same method to both detect Delphi versions and in the former case identify and point to the OEP (Area).

Like you said, getting an approximate area is a good area as it helps out a lot, and yeah, I'd like to see some nice tools for heuristic scanning as well... ;)


email tracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > email tracking
PDA

View Full Version : email tracking

vgb
09-19-2003, 06:48 PM
I have someone who is trashing a newsgroup I frequent. Are there any sites that have good info on tracking someone back from their email posts? He uses many different free email addys but always seems to post through one or two servers.

I'm not up on that kind of stalking ( right word?) techniques. Any help appreciated.

Thanx,

vgb
dELTA
09-19-2003, 07:54 PM
You might find some useful stuff here (http://www.woodmann.net/fravia/noanon.htm), on the Fravia mirror that we're hosting.
vgb
09-19-2003, 09:20 PM
Thanx Delta - I completely forgot about Fravia <blush>
nikolatesla20
09-20-2003, 12:52 AM
Ya know, seems like the 80's were such good times for reversers....I feel like I missed out...

Oh well at least we have lots better tools now, and more challenges, right?

Thanks also for the link, Delta, I forgot about those pages. I especially like the "Scarecrow license agreement" pages.

-nt20
dELTA
09-20-2003, 07:53 AM
Yep, there was definitely something special about the good old Fravia days... It surely brings back some nice memories browsing through that old site... *sigh*

Oh well, today isn't total crap either after all, but anyway. :p


Log any DRX Access - srcs now available
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Log any DRX Access - srcs now available
PDA

View Full Version : Log any DRX Access - srcs now available

[yAtEs]
09-21-2003, 01:49 AM
some of you maybe interested in my latest source code on my
site,

http://www.yates2k.net/syscode.htm

I'll paste the readme here

This is a fully working example of using Intels GD(General Detection) bit,
to invoke debug exceptions upon any access to a debug register.

Currently, the provided source will lock down any drx access to only
NTICE, a hardcoded base for my NTICE is in the src, you may need to
modify this for you own, search the source for the keyword ACCESS_RIGHTS.

Any attempt of a MOV REG, DRX will be 'faked' by placing a default value
into the reg to fool the calling app into thinking no BPMs are set.
Any attempt of a MOV DRX, REG will be totally ignored, or emulated if
NTICE is the caller.

All output is given via debug msgs which have been formatted to be read
by sysinternals debugview(included) with force linefeed on.

Example data below:

-- I SET MY BPM TO CATCH CODE WRITTING --

00000548 1.99602408 Alert: MOV DR3, ESI ADDR: B666917B
00000549 1.99604000 004010DC < - contents of esi
00000550 1.99604894 DRX Updated

00000551 1.99606207 Alert: MOV DR7, EBX ADDR: B666917E
00000552 1.99607911 100004C0
00000553 1.99608777 DRX Updated

--- ASPROTECT SEH TRIES TO OVERWRITE, KERNEL IS DENIED ----

00000557 6.80938862 Alert: MOV DR0, ESI ADDR: 80465362
00000558 6.80940343 00000000
00000559 6.80941293 [o] Ignored MOV DRX, REG

00000560 6.80943025 Alert: MOV DR1, EDI ADDR: 80465368
00000561 6.80944506 00000000
00000562 6.80945427 [o] Ignored MOV DRX, REG

00000563 6.80947159 Alert: MOV DR2, EBX ADDR: 8046536B
00000564 6.80948640 00000000
00000565 6.80949590 [o] Ignored MOV DRX, REG

00000566 6.80951182 Alert: MOV DR3, ESI ADDR: 80465377
00000567 6.80952775 00000000
00000568 6.80953725 [o] Ignored MOV DRX, REG

00000569 6.80955317 Alert: MOV DR6, EDI ADDR: 8046537A
00000570 6.80956965 0000A005
00000571 6.80957915 [o] Ignored MOV DRX, REG

00000572 6.80959535 Alert: MOV DR7, EBX ADDR: 8046537D
00000573 6.80961156 00000155
00000574 6.80962133 [o] Ignored MOV DRX, REG

***************************

--- Running a SafeDisc EXE -------

Me setting a BPM, NTICE in action

00000566 3.91877124 Alert: MOV DR3, ESI ADDR: B666917B
00000567 3.91878856 00405273
00000568 3.91879750 DRX Updated

00000569 3.91881063 Alert: MOV DR7, EBX ADDR: B666917E
00000570 3.91882655 100004C0
00000571 3.91883522 DRX Updated

---

some memory doing checks, turns out to be SECDRV safediscs driver
drx requests are faked.

00000932 9.08994774 Alert: MOV EAX, DR1 ADDR: B707593A
00000933 9.08998239 00000000
00000934 9.08999216 [o] Faked MOV REG, DRX

00000935 9.09002122 Alert: MOV EAX, DR7 ADDR: B7075950
00000936 9.09003658 00000400 <- fake value placed in reg
00000937 9.09004608 [o] Faked MOV REG, DRX

00001154 9.60005839 Alert: MOV EAX, DR7 ADDR: B70759DA
00001155 9.60010811 00000400
00001156 9.60011817 [o] Faked MOV REG, DRX

00001157 9.60336942 Alert: MOV EAX, DR7 ADDR: B70759DA
00001158 9.60341161 00000400
00001159 9.60342138 [o] Faked MOV REG, DRX

00001160 9.61938878 Alert: MOV EAX, DR7 ADDR: B70759DA
00001161 9.61943180 00000400
00001162 9.61944716 [o] Faked MOV REG, DRX

00001163 9.62103089 Alert: MOV EAX, DR7 ADDR: B70759DA
00001164 9.62106245 00000400
00001165 9.62107279 [o] Faked MOV REG, DRX

--

and for interest heres ntice operating my bc* request

00000575 8.94788583 Alert: MOV ECX, DR7 ADDR: B66691C4
00000576 8.94790343 100004C0
00000577 8.94791321 [o] Emulated MOV REG, DRX

00000578 8.94792914 Alert: MOV DR7, ECX ADDR: B66691C9
00000579 8.94794478 10000400
00000580 8.94795344 DRX Updated

comments, bug reports to yates@reverse-engineering.info
dELTA
09-21-2003, 07:50 AM
Hehe, very nice! :)
nikolatesla20
09-26-2003, 01:22 PM
Excellent. I was wondering why nobody had ever tried using the General Detection flag before, since it IS there :)

Good work and thanks for sharing

-nt20
volodya
09-27-2003, 12:51 AM
BTW, guys, I have one funny question due to the point.
Dr. Golova showed you the NtContinue trick (if someone needs I can share pseudocode for NtContinue which I disassembled from ntoskrnl) and, basically, with the help of [yAtEs]'s tools and NtContinue trick it is not that hard to destroy ANY application that will fill DR-registers with garbage... But I can't imagine for now how one can protect from the application that USES DR-regs, e.g. for tracing itself... May be some restoring... Detecting access to DR, saving the value, restoring it back in sometime... Your ideas if any?
evaluator
09-27-2003, 03:15 AM
to NT20,

this flag (as describied in manuals) is mostly for emulation-system use.
it is not big matter using for restrict change via SEH.

& always remember, there is 2 kind SEH use:
1. passive (as in asspr), when it just tries clear DRx.
2. active (as in telock), when it setups DRx for real break.
(3. fake values for not break, but for checking in next seh)
volodya
09-27-2003, 09:40 PM
What to do in this case?
evaluator
09-28-2003, 04:51 AM
for "active" case there is no way for blocking.
Either DRx will be setuped for break or there will NO-break.

This case in fact shows weakness of SEH-blocking method.
BUT in other hand, I not meet "active" method in most protectors.

So, seems, "active" method is not much correct!?

okey, I can imagine only following fact against "active" method:

W9x(at least my W98SE) Kernel NOT DIVIDES DRx context for processes.
So DRx setuped in one process is global & CAN cause break-crash in
other process, if accidentally will executed same address.
(Winice probably checks process-thread for own DRx..)

In W2k-XP systems Kernel DIVIDES DRx context, so here no prob.
(curious: NTICE breaks this enhansements!)
nikolatesla20
09-28-2003, 10:08 AM
All you really need to do the, is if the active doesn't set up a "real" break, but only for checking values, is to emulate the instructions, and keep an internal table of DR's to Processes in your own driver.

For example, when TeLock tries to set a DR register, we catch it and set up an internal variable instead to emulate that it worked. When the same process again tries to read the register, simply return the value stored in the variable.

Not sure if this method would work for real breakpoints or not, but suspecting it might since it would emulate for the process...(including kernel32, etc)

is this perhaps a workable idea?

-nt20
volodya
09-28-2003, 12:12 PM
evaluator, thanks for the explanation!
nikolatesla20, I'll talk to Sten, perhaps it may be possible to implement sth like this in NT+ due to context specific nature of DR-regs there :)
volodya
10-02-2003, 09:53 AM
nikolatesla20

seems like in general case it is impossible to do sth :( :( :(
Yes, indeed, we can emulate the content of DR-regs, but we cannot make the program to BREAK on it. It is the hardware feature....
[yAtEs]
10-02-2003, 12:00 PM
nikolatesla20

seems like in general case it is impossible to do sth :( :( :(
Yes, indeed, we can emulate the content of DR-regs, but we cannot make the program to BREAK on it. It is the hardware feature....

nothing generically is really possible, you can always program things to help
you find checks etc, using internals vars as nt20 said to keep a constant
set of drx free for ur own bpms is fine apart from the if the program is
checking to make sure its bpm is called then it wont work, or maybe it
will just read drx later to make they are still there, then ur ok, if it only does
one breakpoint, your handler could mov it to dr3 then just use 0->2 for ur
own bpms, if the handler is just a simpler handler which counts then you can
fake the bpms by changing dr6 to say a certain bpm has occured and passing
it off to the original int 1 handler, or hm you can simply debugger the handlers

either way, having simple access reports will help debug a protection at least
:)

yates.
volodya
10-02-2003, 12:27 PM
']

either way, having simple access reports will help debug a protection at least
:)
yates.

Yes, you are right. I've played with your driver. It is pretty nice. The only thing I wish it would have is it can watch for SPECIFIC thread only. I don't need complete system report. It contains to many unneccessary information for me, but for the specific thread it would be fine.


retool v1.04 - first public release
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > retool v1.04 - first public release
PDA

View Full Version : retool v1.04 - first public release

OHPen
09-21-2003, 10:07 PM
Lo,

this is the first time i release my retool v1.04.
It's an scanner for packer/crypter. Atm it supports only Aspack but others will be supported soon...

It's completly written in Java.
In future a internal PE-Editor and some unpacking routines should be add. PE-Editor is nearly finished.

It's based on a plugin structur so you can develope retool too.
In the next weeks i will a guide of "How to write a retool-plugin".

Visit the page and download retool v1.04 here:

hxxp://retool.cjb.net]offcial retool homepage

Hope you give it a try and give me response.

regards,

OHPen

PS: Don't forget it's a first betaversion, with minor capabilities.
So don't be to hard ;D
OHPen
09-23-2003, 10:47 PM
New retool version is out.

retool v1.05a

- new signatures added. Now armadillo is supported.
- some minor bugs in old signatures fixed.
- signature search is now more comfortable

Check the page for Crypter/Packer-List

hxxp://retool.cjb.net

regards OHPen

PS: Still coded in Java ;D


Invitation to participate in research survey
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Invitation to participate in research survey
PDA

View Full Version : Invitation to participate in research survey

samtheozzy
09-22-2003, 04:02 AM
Hi all, sorry if this is a bit off-topic.

My name is Sam Davids and i'm an honours student at the Australian National University. I am writing a research paper into the motivations of people who crack and release commercial software. When i was an active member of the scene i always wondered what drove these people to spend hours of their own time removing copy protections and then releasing the software for ostensibly no reward.

With that in mind I would like to invite the crackers on this board to participate in a brief, anonymous survey. The survey consists of 24 multiple choice questions followed by 18 long answer questions. After this there are 5 optional demographic questions. The survey will only take 15-20 minutes to complete and should prove to be quite fun.

I stress that no personal or group information will be collected and no information that could be damaging to the scene will be published. I am only interested in information regarding motivations and a quick read of the example questions below should assure you of that fact.

If you are interested there is the opportunity to sign-up for an online followup interview at the end of the survey.

If you know of any other crackers could you please inform them that they can participate by emailing me at sam.davids@anu.edu.au .

If you would like to participate or if you have any questions please contact me at the details below and i will mail you a survey.

If you so desire i can give you my public key to encrypt your response.

Sincerely,

Sam Davids
email: sam.davids@anu.edu.au
ICQ: 3859373

ps Here are two sample questions so you know the kind of questions that will be asked:

Short example: I would crack software even if I had to do it anonymously
1[ ] 2[ ] 3[ ] 4[ ] 5[ ] 6[ ] 7[ ]

Long example: Do you find the difficulty of cracking software a compelling reason to continue the activity due to the challenge involved? Please explain your answer.
evlncrn8
09-22-2003, 09:05 AM
most of us do it for the fun / challenge
squidge
09-22-2003, 10:04 AM
I also do it for the challenge, and often learn something new whilst doing it. Hacked versions of the programs that I remove the protection on are almost never distributed (I've only uploaded one app to an ftp site in the last 2 years). Normally, once I've cracked a program and it's working fully, the fun has gone, and the program gets deleted.
dELTA
09-22-2003, 12:06 PM
Sam, you should note that there are different kinds of crackers though. The majority of (active) members of this board are more of the kind that e.g. squidge describes, technically interested for the knowledge and challenge. But there are also indeed lots of crackers out there of the "other kind", who are members of leeto cracker groups, pumping out cracks to the masses, and doing it in large part for recognition, respect, sense of belonging and so on. You should probably mention these differences in your paper, and not only categorize "crackers" as one single kind.

dELTA
samtheozzy
09-23-2003, 03:02 AM
Thanks for the info delta. I have noticed evidence of these two distinct groups in the responses that i have looked at so far and i shall definately make mention of their existence in my paper.

BTW I'm still in need of more participants so if you are interested pls email me on here (sam.davids@anu.edu.au)
FoolFox
09-23-2003, 08:04 AM
why all thoses research papers (yeah, you are not the
first one to ask about the subject) have to be dealt by
e-mail ??

Why don't you post your questions on the board and see
who response to which question ?

Regards
FoolFox
evlncrn8
09-23-2003, 09:04 AM
Originally posted by FoolFox
why all thoses research papers (yeah, you are not the
first one to ask about the subject) have to be dealt by
e-mail ??

Why don't you post your questions on the board and see
who response to which question ?

Regards
FoolFox

yup, that'd keep in line with the 'anonymous survey' considering the vast majority of us dont use our real names as our nicks ;)
samtheozzy
09-25-2003, 03:18 AM
K all...this is my final call for participants. A big thanks to those who have already taken the time to fill in the survey. There has been a good deal of interest in the results of this survey but I would like to remind you that the more participants I can get the more representative the results will be. Remember i am singularly uninterested in any specific instances of cracking, I am just curious as to why people do it. So if you are interested please email me here (sam.davids@anu.edu.au) and I will get a survey out to you ASAP.
FoolFox
09-25-2003, 03:35 AM
I would like to remind you that the more participants I can get the more representative the results will be

and what about YOU posting an answer to MY question ?
dELTA
09-25-2003, 06:17 AM
Sam, as mentioned above you would probably get much more replies to your survey if it was more easily anonymously accessible. Having to send you an email will make many people reluctant, since they will often have to go through some trouble to email you from an untraceable email address (for all people know, you could be Mr DMCA trying to track down crackers by their emails).

If you would instead post the survey on a website (or even better, on a third party website/messageboard) all that would be needed to visit it anonymously is at most a public webproxy, which would indeed be much more easy and quick to arrange.

Just a thought anyway.
nofurs
09-25-2003, 01:14 PM
If you would instead post the survey on a website (or even better, on a third party website/messageboard) all that would be needed to visit it anonymously is at most a public webproxy, which would indeed be much more easy and quick to arrange.

you can run but you can't hide :p
evaluator
09-25-2003, 01:21 PM
Sorry, guys,
my inglish works not good, so I have problem for understand this:

in HIS first post:
>>I am writing a research paper into the motivations of people who crack

in HIS second post:
>>I am just curious as to why people do it..

They contradict or only it seems to me!?

*******
"The Art of Mentality-Unpacking"
r4g3
09-25-2003, 02:33 PM
wouldnt be the first 'research paper' written by a clueless student ;p
squidge
09-25-2003, 03:07 PM
r4g3: That's not nice. True, but not nice.

samtheozzy: Throw one of your papers in my PM box and I'll have a look at it.
naides
09-25-2003, 11:20 PM
I doubt TheOzzy is a clueless student.
He is listed as 'faculty and staff' at the ANU web site, which puts him at least at the level of graduate student.
If he is a DMCA agent, he got a University to be part of his cover
samtheozzy
09-26-2003, 01:41 AM
and what about YOU posting an answer to MY question ?

Apologies FF...I haven't posted the survey in its entirety for a couple of reasons. Firstly Doing so just encourages people to discuss it on the messageboard rather than actually replying to the questions. Secondly people could be influenced by the responses of other people if the questions are available in an open forum which, as any academic will tell you, is a big methodology error. Finally the survey takes up a couple of pages and i think i've spammed enough :).
samtheozzy
09-26-2003, 01:55 AM
Hi ppl. I apologise for not answering these queries sooner.

Sam, as mentioned above you would probably get much more replies to your survey if it was more easily anonymously accessible. Having to send you an email will make many people reluctant, since they will often have to go through some trouble to email you from an untraceable email address (for all people know, you could be Mr DMCA trying to track down crackers by their emails).

If you would instead post the survey on a website (or even better, on a third party website/messageboard) all that would be needed to visit it anonymously is at most a public webproxy, which would indeed be much more easy and quick to arrange.

Just a thought anyway

Hey i agree but for the reasons above i absolutely cannot just post it publicly. Initially i had an online, PHP version of the survey but, because it was based on one of our servers here at the ANU, people were even more reluctant to use it then reply via email. At some stage i have to transmit the survey and you (by which i mean the respondant) has to send it back to me. Now i am happy to do this via the personal messaging feature of this web board which you all seem quite willing to use anyway. Or if you are worried about anyone else gaining access to the data i am happy to provide my public key. Other than that i am short of ideas (and time, submission date is not far away :/)

my inglish works not good, so I have problem for understand this:

in HIS first post:
>>I am writing a research paper into the motivations of people who crack

in HIS second post:
>>I am just curious as to why people do it..

They contradict or only it seems to me!?

Sorry i guess i didn't make this clear. My choice of topic for this paper was driven by my curiosity which developed when i was an active member of the scene. At the start of this year i was struggling to come up with a topic that would keep me interested for the whole year and i suggested the motivation for cracking to my supervisor who loved it. So you can see it's not really contradictory.
samtheozzy
09-26-2003, 02:13 AM
Apologies for posting in 3 different messages. Just kind of scattered at the moment.

There is not ONE question in the survey that would require you to mention a specific instance of pirating/cracking software. There is no way for you to possibly incriminate yourselves unless you go out of your way to mention it in the survey (which incidentally not one respondant has done so far). This is all about motivation and that will become obvious once you have seen the survey. I am happy to PM the survey to people if they are interested (although the board's character length means the survey will come in three parts) in responding or if only to put their minds at ease.
evaluator
09-26-2003, 08:07 AM
okey,

for_just_curiuos you decide to write a research paper.[;]

Bigger Curious in research is: cracking is mostly for fun & hobbie.
Less-accidentally for $$.

Easy idea:
while sending in PM, can you make just one Web-Page of your survey?
samtheozzy
09-30-2003, 01:28 AM
Thanks everyone for your help. I have just about finished collecting data for my paper so if there are any oustanding surveys could people pls turn them in. I'd like to thank everyone who participated or offered advice. Rest assured i will be posting the results online and i will post a notification here when they are available. Thanks again.
squidge
09-30-2003, 03:29 AM
I'll be interested to see the results of your survey.
qweasdzxc
09-30-2003, 07:34 PM
Sorry i guess i didn't make this clear. My choice of topic for this paper was driven by my curiosity which developed when i was an active member of the scene. At the start of this year i was struggling to come up with a topic that would keep me interested for the whole year and i suggested the motivation for cracking to my supervisor who loved it. So you can see it's not really contradictory.

For a project that is supposed to keep you busy for a year; wasn't this a very short interview period?

This in itself is enough to make people suspicious....


Crossroads Call for Ethics Articles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Crossroads Call for Ethics Articles
PDA

View Full Version : Crossroads Call for Ethics Articles

disavowed
09-22-2003, 08:20 PM
Thought some of you might be interested in this, especially "Digital rights management and fair use" and "Copyright laws for the programmer":

--- BEGIN PASTE ---

Date: Sat, 20 Sep 2003 18:20:18 -0400
From: William Stevenson <westeven@cse.psu.edu>
Subject: Crossroads Call for Ethics Articles
To: XRDS-ANNOUNCE@acm.org

Call For Articles
Crossroads, the Association for Computing Machinery Student Magazine
Ethics and Computer Science (Spring 2004)
DUE DATE: 29 September 2003
SUBMISSION ADDRESS: hxxp://www.acm.org/crossroads/submit/
INFORMATION: crossroads@acm.org
hxxp://www.acm.org/crossroads/doc/cfas/ethics.html

The Crossroads editorial staff invites authors to submit articles dealing with topics drawn from several areas pertaining to ethics and computer science. The following partial list of topics is provided to give prospective authors ideas for articles and is by no means exhaustive; other relevant topics will be considered. Papers that draw connections between two or more of these areas are especially welcome.

* Social consequences of technology
* Surveillance and privacy post-September 11th
* Professional ethics in software development
* Information stewardship
* Computer crimes and hackers
* Censorship on the Internet
* International perspectives on ethics in computer science
* Digital rights management and fair use
* Copyright laws for the programmer
* Internet filtering in schools and libraries
* Supporting civil society with the Internet
* The ethical consequences of the use of Open Source software

Articles should include a basic description of the kinds of problems being worked on, the state of the art of research, the state of the art of commercial applications, open problems, or future research/commercial development trends. Interviews with researchers; reviews of related books, software, videos, or conferences; and opinion columns on related issues are also welcome. We especially encourage both undergraduate and graduate students to submit articles. However, articles written or coauthored by professionals will also be considered.

Crossroads articles should be written for a broad audience. They should be easily understandable by someone who has had only the most basic computer science instruction, and yet still be interesting to the advanced computer enthusiast. Articles longer than 6000 words will generally not be considered for publication. Feature articles should be between 1500 and 6000 words; reviews should be between 800 and 2000 words; and opinion columns should be between 800 and 3000 words. Articles should be written in a magazine style rather than a research paper style. In consideration of our diverse readership, authors should try to use language that is inclusive of people regardless of their gender, race, religion, nationality, or field of study. Additional writing guidelines and submission information are available online at the Crossroads web site hxxp://www.acm.org/crossroads/doc/information/writing.html).

Crossroads is published both online and in print. We have a print circulation of about 20,000. All back issues are available for free on our website. Authors that have an article printed in Crossroads can receive complementary copies of the issue they were published in.

All submissions should be formatted in HTML or plain text format and submitted via hxxp://www.acm.org/crossroads/submit/

Submissions are due 29 September 2003. They will be reviewed shortly thereafter and authors of accepted submissions will be notified within two to three weeks of the deadline.

Prospective authors are invited to send email to the editors of Crossroads (crossroads@acm.org) indicating their intention to submit an article. In this way we can keep everyone informed of any changes in deadlines or formats and to make sure we have a good variety of articles. General questions should also be sent to the Crossroads editors.

--
William Stevenson
Editor in Chief
ACM Crossroads Magazine
hxxp://www.acm.org/crossroads
hxxp://www.billstevenson.org
Calendar: hxxp://ical.mac.com/billstevenson/Calendar

--- END PASTE ---


Keygen makes front page of The Register
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Keygen makes front page of The Register
PDA

View Full Version : Keygen makes front page of The Register

disavowed
09-22-2003, 08:32 PM
hxxp://www.theregister.co.uk/content/4/32955.html

Do they have any idea how many keygens are made everyday for thousands of different applications?
Aquatic
09-23-2003, 08:03 PM
The key generator won't work with the trial versions, only with the full program which we located on a murky Russian website.

lol
dELTA
09-25-2003, 06:04 AM
I guess they mention it because it's such a "high profile" system that has been keygenned, just like the fuss about when they broke the MS activation system.

Anyway, I can't understand how a company as skilled and resourceful as Symantec can produce an activation system that can be keygenned at all. Since most of their high-profile applications are dependent on constant updates over the internet, they could easily make a completely waterproof system, safe from both keygenning and key-leakage.

Oh well, I shouldn't be complaining I guess, I really like their products, so I'll gladly be using the 2004 versions of them too. :D


auto.search.msn.com/response.asp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > auto.search.msn.com/response.asp
PDA

View Full Version : auto.search.msn.com/response.asp

mike
09-22-2003, 10:17 PM
Under IE6, this URL is hardcoded somewhere (it's not in the registry). If you set up Google as your default search engine, it still sends the query to msn first, no doubt for data mining.

EASY Mini-project: find the URL and replace it!
just
10-04-2003, 05:44 PM
It is in SHDOCLC.DLL which contains only resources. It contains all the cute IE 6 icons, dialogs, popup menus, etc.

The url you are looking for can be found with a resource editor and changed. It is a String, with resource name 76, and it has number 1211 or 1214 depending on which one you want.
ZaiRoN
10-05-2003, 12:26 PM
Hi just,
unfortunately (or fortunately :-p) I do not use Internet Explorer and I can not try this project. How do you discovered this dll? Can you tell us what you have done? Your explanation can help someone else.
And you Mike, how did you solve the problem?

Best regards,
ZaiRoN
squidge
10-05-2003, 05:34 PM
I don't know about just, but I found the URL easily by doing a simple search through the files in the windows directory, and can see it there.

Now that's it cured my curiousity, I'm back to my normal browser - Opera :)
mike
10-05-2003, 06:21 PM
And you Mike, how did you solve the problem?I posted it here and waited for just to post his results :D
just
10-13-2003, 04:43 AM
Hi just,
unfortunately (or fortunately :-p) I do not use Internet Explorer and I can not try this project. How do you discovered this dll? Can you tell us what you have done? Your explanation can help someone else.
And you Mike, how did you solve the problem?

Best regards,
ZaiRoN
I did ascii then unicode string search in \windows\system\shdoc*.dll

I knew shdocvw.dll file was related to IE because I used IE automation once for work and wondered about the weird filename it uses, so I remembered it. As there are more shdoc*.dll files in \windows\system\ I assumed they are related to IE as well.

(just is also a happy Opera user :cool: )
sirius
05-06-2004, 04:51 PM
Mallatia had spokes (explains) about that, and there is a riddle about the shdoclc.dll :)
naides
05-06-2004, 07:16 PM
Mallatia had spokes (explains) about that, and there is a riddle about the shdoclc.dll :)

DELTA: Another Right_On_Time post for your collection
:rolleyes:
dELTA
05-07-2004, 01:58 PM
Yep, I guess I can take at least some comfort in the fact that it contained something else than "thanks" though... :rolleyes:
JMI
05-07-2004, 02:30 PM
Maybe he's referring to this essay, posted by +mala in 2003:

http://www.reteam.org/essay.viewer?type=stegano&short=st1&short2=st2&id=3

It was the only hit I got with "malatia + shdoclc.dll" but doesn't seem to be addressing a "riddle."

Regards,
naides
05-07-2004, 06:28 PM
Maybe he's referring to this essay, posted by +mala in 2003:

http://www.reteam.org/essay.viewer?type=stegano&short=st1&short2=st2&id=3

It was the only hit I got with "malatia + shdoclc.dll" but doesn't seem to be addressing a "riddle."

Regards,

What sirius is talking about is a cracking/cryptography challenge was/is going on in malathia site. you need to solve riddles to advance to each, progressively more difficult stage.

Inside the shdoclc.dll there is an easter egg that malathia found and, as part of the challenge you have to locate, resverse and solve a question he posted.
sirius
07-06-2004, 02:09 PM
What sirius is talking about is a cracking/cryptography challenge was/is going on in malathia site. you need to solve riddles to advance to each, progressively more difficult stage.

Inside the shdoclc.dll there is an easter egg that malathia found and, as part of the challenge you have to locate, resverse and solve a question he posted.

yeah :),
if you wanna get more go to :
3564020356.org
proof that you deserve it! and if you pass the 3rd riddle you'll find all the stuff

see ya


Neolite 2.0 Questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Neolite 2.0 Questions
PDA

View Full Version : Neolite 2.0 Questions

Billy[23]
09-23-2003, 01:58 AM
Hi i recently download the b*so* tests Program for to check out the neolite from the Tutorials from:

Eternal Bliss and CoDe_InSiDe

i can follow them perfectly and find the oep and dump fine,

The program runs great, however i want to get rid of the neolite section and fully rebuild it, so i can get a perfect text listing, i do this by deleting the .neolit section and clicking on rebuild PE in lord pe (<-- i guess it aint the best way) when i reload it into the olly debugger i get it has a entry point outside the code section blah blah and it doesnt show much strings :(

Anybody has some clues for me ? iam not asking for the full info.

Thnx

- Billy
Ricardo Narvaja
09-23-2003, 05:34 AM
The mark in DEBUGGING OPTIONS-DEBUG-SEARCH FOR REFERENCES IN

MEMORY BLOCK CURRENTLY SELECTED IN DISSASSEMBLER

here go the mark

with this OLLY search for references in the block of memory you have in the CPU window, if not only show the code section and in the packed programs this has not the string of the program.

Change this mark and go to ths section GO TO EXPRESSION = 401000 for display the section of the program in the dissasembler and SEARCH FOR STRINGS now.

Ricardo
Billy[23]
09-23-2003, 08:09 AM
Ricardo: it was a pleasure to wake up and read this response, was just what i was looking for :)

Many thnx.


tELock plugin for imprec
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > tELock plugin for imprec
PDA

View Full Version : tELock plugin for imprec

prejker
09-23-2003, 02:01 PM
Hey guys,

I've done a plugin for imprec to fix tElock scrambled apis, i'll put it here, maybe it'll be useful for someone.

btw. i dunno for whitch version it is but prolly for the newest one... enjoy ;)


Windows NT IDA scripts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Windows NT IDA scripts
PDA

View Full Version : Windows NT IDA scripts

Kayaker
09-24-2003, 05:36 PM
These IDC files are likely of interest to those trying to map out their own NTOSKRNL. Perhaps [Yates] can find a home for them for us in his collection :)

Windows NT Status Codes
Windows NT Bug Codes
Windows NT IRQ Levels (IRQL)
MSVC Exception Record
Definition of EPROCESS
Definition of ETHREAD

other NT articles of interest:
NT4.H (Revision 005)
Flushing VDM memory
Enumerating Pseudo-FS objects (mailslots, pipes, etc)

http://www.alkor.ru/~00077500/kb/winnt.htm

Kayaker
[yAtEs]
09-25-2003, 07:37 AM
oh cool, these are of great interest to me :) , i'll also take in these
files, feed and clothe them, im sure they will have a happy
life on my site.

yates.
volodya
09-25-2003, 01:14 PM
Excellent. I also have some add-ons. Be prepared to check them out from wasm. Thanks, Kayaker - you are as informative as usual :)
doug
09-25-2003, 10:33 PM
here's an updated ntstatus.idc that I created from the xp sp1 ddk. it contains around 350 more lines/definitions

the parsing code was under 30 lines of C.

-doug

edit:
"Sorry, your attachment could not be accepted because your administrator's attachment quota would be exceeded by 17124364 bytes. He/She has been notified of this."
Kayaker
09-25-2003, 11:48 PM
Thanks for the updated script doug. I'm not sure what the attachment problem is, the current size limit is set at 1,048,576 bytes, so from the error message you got you must have been trying to upload an 18MB file?

Lol, OK we'll assume not, so there must be some other problem. The board has just been updated to VBulletin 3.0.0 Beta 7 (cheers and/or jeers to Woodmann/JMI), so there *may* be some problem with the attachments. We can run a few tests and bugcheck on that.

Cheers to all,
Kayaker
doug
09-26-2003, 02:50 PM
the mention about "administrator's" quota... or is that just a generic error message..

anyone able to attach file(s)?

this file is a 13kb .zip
Kayaker
09-26-2003, 03:02 PM
anyone able to attach file(s)?

No attachments of any size seem possible right now, things look OK on the surface though so there's a buggy floating around somewhere... hang in there.
doug
09-27-2003, 06:12 PM
attachments are fixed, so here's the file.

-doug


Sentinel emulation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Sentinel emulation
PDA

View Full Version : Sentinel emulation

Gmc
09-25-2003, 03:44 AM
I need help emulating sentinel super pro dongle. Can anybody send me driver source code as an example, functions like read findfirstunit etc. i have successfully emulated patching the driver but i havet yet finished spQuery, anybody has experience? (Sentinel shell 6.0, no dongle available)
Rackmount
10-01-2003, 04:12 PM
Gmc:

If you use the search feature at the top of this page and enter "sentinel" as keyword, you will be pleased with the results. There has been much discussion over the sentinel protections. Also, take a look at the crackme we did a project on (CyberHeg's). There is much information to aid in your learning adventure at this site. Once you have read as much as you feel you need, try it out, and describe what you did and what happened as a result so we may further assist you and so others may learn as well. Just remember to use generic code as examples rather than straight rips that reveal commercial software identities (at least when using public forums).

Rackmount
Gmc
10-02-2003, 07:02 AM
Thank you very much for the detailed answer and your recommendations.
I am keep studiying dongles and will post the results here.


Ok, who changed the board?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Ok, who changed the board?
PDA

View Full Version : Ok, who changed the board?

squidge
09-26-2003, 07:27 AM
It's horrid. Much preferred the older one. Yeuck.
dELTA
09-26-2003, 10:10 AM
The board was just updated to vBulletin version 3.0, and the default layout is a bit crappy. We will try to fix it as soon as possible anyway.

The new version has a bunch of new cool features though. For example, all of you people who have asked for an easier way to download the board contents as an archive, check out the "Archive" link at the bottom of this page...
JimmyClif
09-26-2003, 01:28 PM
Heh... I like it... Please don't throw the quick reply thing out. <not that I'm writing much anyways lately... ;)>
Kayaker
09-26-2003, 01:46 PM
It's horrid. Much preferred the older one. Yeuck.

Please don't throw the quick reply thing out.

Only Dissenters will be thrown out...:D
JMI
09-26-2003, 05:51 PM
Wait. I thought we had agreed to shoot dissenters. :D Did I sleep through the last revision of the proposed rules? :p

Regards.
squidge
09-26-2003, 07:51 PM
Yup, like the new features, but don't like the new style much. I can live with it though whilst you figure out how to change it :)
esther
09-26-2003, 10:54 PM
Hi,

I just don't like the login on top of the right hand corner its ugly :p
squidge
09-27-2003, 07:13 AM
Trying out the quick reply thingy wotsit, and why is there 5 button in the top right all the same looking, marked "Temporary button" ?
ZaiRoN
09-27-2003, 07:21 AM
why is there 5 button in the top right all the same looking, marked "Temporary button" ?The five buttons are (from left to right):
1. Open buddy list
2. View new posts
3. Mark all forums read
4. Log out
5 Simple search

They are comfortable, don't you think? :-D

ZaiRoN
squidge
09-27-2003, 07:34 AM
They would be more comfortable if they looked different, rather than all the same, yes :)

Also, It seems like the Opera forums are running the latest version of vB too, but in those forums the "Quick message" is always enabled - you don't have to click a message button first. Anyway of doing this here to? It certainly makes it easier and faster to reply...
ZaiRoN
09-27-2003, 07:42 AM
They would be more comfortable if they looked different, rather than all the same, yes :)I agree with you. Another things for the to-do list :D

ZaiRoN
dELTA
09-27-2003, 08:39 AM
Also, It seems like the Opera forums are running the latest version of vB too, but in those forums the "Quick message" is always enabled - you don't have to click a message button first. Anyway of doing this here to? It certainly makes it easier and faster to reply...

The reason that the quick reply isn't enabled from the start is that it would mess up the new "hybrid" and "threaded" display modes for posts. These will need to know which specific post you are replying to, to be able to display the thread tree correctly. For example, right now I'm replying directly to your post squidge, and not just to the whole thread, take a look at it in threaded/hybrid mode and you'll see what I mean.

But then again, maybe everyone prefers the good ol' way to the threaded mode anyway, and the benefits of an "even quicker quick reply" overweighs the disadvantage of messing up the thread tree structure? What does eveyone think?
squidge
09-27-2003, 10:44 AM
Thanks, I didn't even know it could do that, but I do agree that it could be a useful feature to see which reply is to which post without having to use the "Quote the original message" method. I shall have a play :)
disavowed
09-27-2003, 01:56 PM
For example, all of you people who have asked for an easier way to download the board contents as an archive, check out the "Archive" link at the bottom of this page...

nice!

(i'll be sure to backup the board once per hour, of course :)
esther
09-27-2003, 03:15 PM
Hi all,

There are cons using web spiders like JMI said
It also rips unwanted postings like "newreply" "members" etc

And it doesn't download attachments :rolleyes: :mad:

regards
squidge
09-27-2003, 06:31 PM
esther: The archive link doesn't give you the "newreply" etc, but just the raw info :) :)


Crypto Library Help Please!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Crypto Library Help Please!
PDA

View Full Version : Crypto Library Help Please!

Clandestiny
09-26-2003, 09:54 PM
Hi guys,

This is probably a lame question, but I swear I'm near my wits end here. I'm looking for a well documented library in C that has the algorithms DES, Triple DES, and Blowfish...And let me re-emphasize *WELL* documented and preferably basic! So far I have attempted to use both crypto++ and cryptlib without success. My C++ skills are limited and trying to use crypto++ was hopeless for me as it seemed to be heavily object oriented with very poor documentation, IMHO. Cryptlib struck me as much better as it is thankfully in plain C, however, the documentation was somewhat lacking as well and I'm having a devil of a time figuring out wtf I'm doing. I'm such a crypto newbie, I had to even look up what the difference between the CBC and CFB modes :o . I'm trying to encrypt an ascii string so I assume that the CFB would be most appropriate as its more of a stream cipher.

Here is some code that I have trying to use the cryptLib. Unfortunately, I doesn't work at all.
//set up initialization vector variables
char iv[CRYPT_MAX_IVSIZE] = {0};
CRYPT_CONTEXT cryptContext = {0};
memset(iv, '0', CRYPT_MAX_IVSIZE);

//create the encryption context for the DES algorithm
cryptCreateContext(&cryptContext, CRYPT_UNUSED,CRYPT_ALGO_DES);
//set up the initialization vector
cryptSetAttributeString(cryptContext,CRYPT_CTXINFO_IV,iv,8);
//insert the key into the context
cryptSetAttributeString(cryptContext, CRYPT_CTXINFO_KEY,password, 8 );
//set as a stream cipher
cryptSetAttribute( cryptContext, CRYPT_CTXINFO_MODE, CRYPT_MODE_CFB );
//encrypt the plaintext
cryptEncrypt(cryptContext,cryptarray,1);
cryptDestroyContext(cryptContext);
return cryptarray;

Also, I was wondering about the best way to hash a password string into a key. For example, Blowfish has a 448 bit key. What is the best way to convert a string into this giant key? I know these questions belong on a crypto-forum-for-newbies ;), but I'll appreciate any help I can get :)

Thanks,
Clandestiny
dELTA
09-26-2003, 11:29 PM
Blowfish has a variable length key, it does not have to be e.g. 448 bits (which is not the maximum keylength either, if I'm not mistaken). Simply use the password itself as key. If you necessarily want to expand it, you could for example simply repeat the password until it fills up the desired length. Since the entropy of the key will not increase no matter what kind of hashing function you use, this is just as good as any other method.
mike
09-27-2003, 04:41 AM
Well, lucky you! I work with Peter Gutmann on cryptlib, and wrote the java interface for it.

First thing--did you call cryptInit? If not, nothing else will work.

Second, what do you need it to do? If you're just looking to do basic password-based encryption, use the enveloping api.

Third, I know the manual needs someone to reorganize it. However, there's a great mailing list with an archive, explaining lots of stuff with example code.

Fourth, if you can wait until Monday morning New Zealand time, I can post some very simple source code that illustrates the steps you need.
Clandestiny
09-28-2003, 09:55 PM
Thanks for the advice dELTA and Mike :)

Mike, it was my lucky day :). Thanks for the info. I think I got some basic password based encryption to work using the cryptEncrypt function. As I understand it, this is the low-level interface. I would be interested in how the higher level eneloping API works, but IMHO the documentation wasn't too clear on the matter and I was just happy to finally get *something* to work. Can you specify a specific encryption algorithm to be used in the eveloping API or does it just assign it automatically?

Bearing in mind that this is coming from a crypto newbie ;)
I'd like to make a few suggestions regarding the documentation...

1. I realize there are several modes for the block ciphers including the CBC, CFB, and OFB. I didn't feel that the documention was really clear in indicating which modes are supported for which algorithms. Likewise, it would have been helpful to have some more documentation about restrictions on the function parameters based on which mode you're operating in.

2. It would have been very helpful to have a listing of error codes that can be potentially returned for each function. The documentation simply defines each function as returning an int and I had to actually look in the header files to realize that it was a status value being returned.

3. Some example code comparing / contrasting a basic implementation at both the high level and the low level interfaces.

Thanks,
Clandestiny
mike
09-29-2003, 12:42 AM
The docs are written for someone who knows what they're doing; I agree that it's very hard for a newbie to figure it out.

Archives:
ftp://ftp.franken.de/pub/crypt/cryptlib/archives/

1. The mode and the cipher are orthogonal. If it's a block cipher, it supports all the block cipher modes.

2. Error codes: p.212 in my version of the PDF. Try a text search for "error codes"

3. Here's some Java code illustrating the enveloping api with public/private keys. It's not exactly what you're trying to do, but it shows all the steps (one of the big failings of the docs IMO). If there's something about it you can't figure out, write back and I'll explain.

See p.47 "Password-based enveloping" and p. 202 "Working with Configuration Options" for choosing the underlying cipher for more info on doing what you want.

import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.PrintStream;
import java.io.UnsupportedEncodingException;

import com.cryptlib.*;

class Demo implements CryptLibConstants
{
public static void main(String[] args)
{
CryptLib cl=CryptLib.getInstance();
int[] cryptEnvelope = new int[1];
int[] bytesCopied = new int[1];
int[] keys = new int[1];
byte[] buffer = new byte[10000];
int [] cert = new int[1];
int [] sigContext = new int[1];
int [] cryptContext = new int[1];
PrintStream stdout = System.out;
String bob = new String("Bob");
String paul = new String("Paul");

int result = CRYPT_OK;
int len=0;

// C equivalent of "try {" where "break out" replaces "throw"
out: do
{
try {
stdout.println("Initializing...");
if ((result = cl.cryptInit()) != CRYPT_OK) break out;

stdout.println("Generating keys...");
if ((result = cl.cryptKeysetOpen(keys, CRYPT_UNUSED, CRYPT_KEYSET_FILE, "SampleKeys", CRYPT_KEYOPT_CREATE)) != CRYPT_OK) break out;

if ((result = cl.cryptCreateContext(cryptContext,CRYPT_UNUSED,CRYPT_ALGO_RSA))!=CRYPT_OK)break out;
if ((result = cl.cryptSetAttributeString(cryptContext[0],CRYPT_CTXINFO_LABEL,bob.getBytes("UTF8"),bob.length()))!=CRYPT_OK)break out;
if ((result = cl.cryptGenerateKey(cryptContext[0]))!=CRYPT_OK)break out;
if ((result = cl.cryptAddPrivateKey(keys[0],cryptContext[0],"test-bob"))!=CRYPT_OK)break out;
if ((result = cl.cryptDestroyContext(cryptContext[0]))!=CRYPT_OK)break out;

if ((result = cl.cryptCreateContext(cryptContext,CRYPT_UNUSED,CRYPT_ALGO_RSA))!=CRYPT_OK)break out;
if ((result = cl.cryptSetAttributeString(cryptContext[0],CRYPT_CTXINFO_LABEL,paul.getBytes("UTF8"),paul.length()))!=CRYPT_OK)break out;
if ((result = cl.cryptGenerateKey(cryptContext[0]))!=CRYPT_OK)break out;
if ((result = cl.cryptAddPrivateKey(keys[0],cryptContext[0],"test-paul"))!=CRYPT_OK)break out;
if ((result = cl.cryptDestroyContext(cryptContext[0]))!=CRYPT_OK)break out;

if ((result = cl.cryptKeysetClose(keys[0])) != CRYPT_OK) break out;

// SIGN

stdout.println("Creating signature envelope...");
if ((result = cl.cryptCreateEnvelope( cryptEnvelope, CRYPT_UNUSED, CRYPT_FORMAT_CRYPTLIB )) != CRYPT_OK) break out;

stdout.println("Setting data size...");
if ((result = cl.cryptSetAttribute( cryptEnvelope[0], CRYPT_ENVINFO_DATASIZE, 11 )) != CRYPT_OK) break out;

stdout.println("Setting signing key...");
if ((result = cl.cryptKeysetOpen(keys, CRYPT_UNUSED, CRYPT_KEYSET_FILE, "SampleKeys", CRYPT_KEYOPT_READONLY)) != CRYPT_OK) break out;

if ((result = cl.cryptCreateContext(sigContext,CRYPT_UNUSED,CRYPT_ALGO_RSA))!=CRYPT_OK)break out;
if ((result = cl.cryptGetPrivateKey(keys[0], sigContext, CRYPT_KEYID_NAME, bob, "test-bob" )) != CRYPT_OK) break out;
if ((result = cl.cryptSetAttribute(cryptEnvelope[0], CRYPT_ENVINFO_SIGNATURE, sigContext[0] )) != CRYPT_OK) break out;

if ((result = cl.cryptKeysetClose(keys[0])) != CRYPT_OK) break out;

stdout.println("Pushing data...");
if ((result = cl.cryptPushData( cryptEnvelope[0], "Hello world".getBytes("UTF8"), 11, bytesCopied )) != CRYPT_OK) break out;

stdout.println("Flushing data...");
if ((result = cl.cryptFlushData( cryptEnvelope[0] )) != CRYPT_OK) break out;

stdout.println("Popping data...");
if ((result = cl.cryptPopData( cryptEnvelope[0], buffer, 1000, bytesCopied )) != CRYPT_OK) break out;

stdout.println(bytesCopied[0]+" bytes out");
stdout.println("Destroying envelope...");
if ((result = cl.cryptDestroyEnvelope( cryptEnvelope[0] )) != CRYPT_OK) break out;
if ((result = cl.cryptDestroyContext( sigContext[0] )) != CRYPT_OK) break out;

// ENCRYPT

stdout.println("Creating encryption envelope...");
if ((result = cl.cryptCreateEnvelope( cryptEnvelope, CRYPT_UNUSED, CRYPT_FORMAT_CRYPTLIB )) != CRYPT_OK) break out;

stdout.println("Setting data size...");
if ((result = cl.cryptSetAttribute( cryptEnvelope[0], CRYPT_ENVINFO_DATASIZE, bytesCopied[0] )) != CRYPT_OK) break out;

stdout.println("Setting encryption key...");
if ((result = cl.cryptKeysetOpen(keys, CRYPT_UNUSED, CRYPT_KEYSET_FILE, "SampleKeys", CRYPT_KEYOPT_READONLY)) != CRYPT_OK) break out;

if ((result = cl.cryptCreateContext(cryptContext,CRYPT_UNUSED,CRYPT_ALGO_RSA))!=CRYPT_OK)break out;
if ((result = cl.cryptGetPublicKey(keys[0], cryptContext, CRYPT_KEYID_NAME, paul)) != CRYPT_OK) break out;
if ((result = cl.cryptSetAttribute(cryptEnvelope[0], CRYPT_ENVINFO_PUBLICKEY, cryptContext[0] )) != CRYPT_OK) break out;

if ((result = cl.cryptKeysetClose(keys[0])) != CRYPT_OK) break out;

stdout.println("Pushing data...");
if ((result = cl.cryptPushData( cryptEnvelope[0], buffer, bytesCopied[0], bytesCopied )) != CRYPT_OK) break out;

stdout.println("Flushing data...");
if ((result = cl.cryptFlushData( cryptEnvelope[0] )) != CRYPT_OK) break out;

stdout.println("Popping data...");
if ((result = cl.cryptPopData( cryptEnvelope[0], buffer, 1000, bytesCopied )) != CRYPT_OK) break out;

stdout.println(bytesCopied[0]+" bytes out");
for (int i=0; i<bytesCopied[0]; ++i)
{
stdout.print(buffer[i]+" ");
}
stdout.println("");

stdout.println("Destroying encryption envelope...");
if ((result = cl.cryptDestroyEnvelope( cryptEnvelope[0] )) != CRYPT_OK) break out;
if ((result = cl.cryptDestroyContext( cryptContext[0] )) != CRYPT_OK) break out;

// Now do everything in reverse...

// DECRYPT

stdout.println("Creating decryption envelope...");
if ((result = cl.cryptCreateEnvelope( cryptEnvelope, CRYPT_UNUSED, CRYPT_FORMAT_AUTO )) != CRYPT_OK) break out;

stdout.println("Pushing data...");
if ((result = cl.cryptPushData( cryptEnvelope[0], buffer, bytesCopied[0], bytesCopied )) != CRYPT_OK)
{
if (result != CRYPT_ENVELOPE_RESOURCE) { break out; }
}

stdout.println("Setting decryption key...");
if ((result = cl.cryptKeysetOpen(keys, CRYPT_UNUSED, CRYPT_KEYSET_FILE, "SampleKeys", CRYPT_KEYOPT_READONLY)) != CRYPT_OK) break out;

if ((result = cl.cryptCreateContext(cryptContext,CRYPT_UNUSED,CRYPT_ALGO_RSA))!=CRYPT_OK)break out;
if ((result = cl.cryptGetPrivateKey( keys[0], cryptContext, CRYPT_KEYID_NAME, paul, "test-paul" )) != CRYPT_OK) break out;
if ((result = cl.cryptSetAttribute( cryptEnvelope[0], CRYPT_ENVINFO_PRIVATEKEY, cryptContext[0] )) != CRYPT_OK) break out;

if ((result = cl.cryptKeysetClose(keys[0])) != CRYPT_OK) break out;

stdout.println("Flushing data...");
if ((result = cl.cryptFlushData( cryptEnvelope[0] )) != CRYPT_OK) break out;

stdout.println("Popping data...");
if ((result = cl.cryptPopData( cryptEnvelope[0], buffer, 1000, bytesCopied )) != CRYPT_OK) break out;

stdout.println(bytesCopied[0]+" bytes out");

stdout.println("Destroying decryption envelope...");
if ((result = cl.cryptDestroyEnvelope( cryptEnvelope[0] )) != CRYPT_OK) break out;
if ((result = cl.cryptDestroyContext( cryptContext[0] )) != CRYPT_OK) break out;

// VERIFY

stdout.println("Creating verification envelope...");
if ((result = cl.cryptCreateEnvelope( cryptEnvelope, CRYPT_UNUSED, CRYPT_FORMAT_AUTO )) != CRYPT_OK) break out;

stdout.println("Pushing data...");
if ((result = cl.cryptPushData( cryptEnvelope[0], buffer, bytesCopied[0], bytesCopied )) != CRYPT_OK)
{
if (result != CRYPT_ENVELOPE_RESOURCE) { break out; }
}

stdout.println("Setting verifying key...");
if ((result = cl.cryptKeysetOpen(keys, CRYPT_UNUSED, CRYPT_KEYSET_FILE, "SampleKeys", CRYPT_KEYOPT_READONLY)) != CRYPT_OK) break out;

if ((result = cl.cryptCreateContext(sigContext,CRYPT_UNUSED,CRYPT_ALGO_RSA))!=CRYPT_OK)break out;
if ((result = cl.cryptGetPublicKey( keys[0], sigContext, CRYPT_KEYID_NAME, bob )) != CRYPT_OK) break out;
if ((result = cl.cryptSetAttribute( cryptEnvelope[0], CRYPT_ENVINFO_SIGNATURE, sigContext[0] )) != CRYPT_OK) break out;

if ((result = cl.cryptKeysetClose(keys[0])) != CRYPT_OK) break out;

stdout.println("Flushing data...");
if ((result = cl.cryptFlushData( cryptEnvelope[0] )) != CRYPT_OK) break out;

stdout.println("Popping data...");
if ((result = cl.cryptPopData( cryptEnvelope[0], buffer, 1000, bytesCopied )) != CRYPT_OK) break out;

byte[] message = new byte[bytesCopied[0]];
stdout.println(bytesCopied[0]+" bytes out");

for (int i=0; i<bytesCopied[0]; ++i)
{
stdout.print(buffer[i]+" ");
message[i] = buffer[i];
}
// End-of-line
stdout.println("");

stdout.println("As string:");
stdout.println(new String(message,"UTF8"));

stdout.println("Destroying verification envelope...");
if ((result = cl.cryptDestroyEnvelope( cryptEnvelope[0] )) != CRYPT_OK) break out;
if ((result = cl.cryptDestroyContext( sigContext[0] )) != CRYPT_OK) break out;

}
catch (UnsupportedEncodingException e)
{
stdout.println("Bad encoding?");
break out;
}
} while (false);

// C "catch"
if (result != CRYPT_OK)
{
stdout.println("Couldn't proceed: "+result);
}
stdout.println("Shutting down...");
cl.cryptEnd();
}
}


exe32pack unpacker/dumper with source
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > exe32pack unpacker/dumper with source
PDA

View Full Version : exe32pack unpacker/dumper with source

bedrock
09-27-2003, 07:44 AM
I hope this little tool i wrote will be useful to some, probably not many though. This has mostly just been a learning exercise for me. I have read and learnt much informations from this board, i have especially learnt much information from the boards regulars such as squidge and nikolatesla20. This thread in particular was a great help:

http://www.woodmann.net/forum/showthread.php?t=4512 (wasn't sure if i could make it clicky back to board)

I am sharing source with my little tool to help others develop, i found it very difficult to find example sources for developing this little unpacker/dumper so hopefully this will be useful to others. My source isn't brilliant, but it seems to be functional (at least for me).

Now exe32pack isn't a particularly complex packer, but i have a couple of targets that use this packer so i thought i would write my tool for it. A brilliant tutorial by snyper helped in the initial stages, and allowed me to programatically read OEP from within the packed file. Essentially all i have done is automate the manual unpacking process for this packer.

I use the Win32 debugging API's to create a debugger loop, and then use the debug registers (DRx) to set a hardware breakpoint on execute at the OEP address, from here, it's simple ReadProcessMemory and dump the target to disk, a simple fix correct EP and RA = VA in the header and there you go.

One thing i would like to do in the furture of this tool is to remove the exe32pack section from the dump (this will make it significantly smaller), but doing this will mean that i need to fixup IAT, or require external use of ImpREC, i still need to learn more about IAT and first thunks etc...

Hope this is useful to someone...

Hmm, dont seem to be able to add as attachement, only 45k :(
I'll find some webspace and upload it and post link back here soon

edit: as attachments are now working on the board, and my bandwidth is steadily being consumed, i've added file to this thread.

ps. Should've also mentioned i've only tested this on WinXP SP1, would imagine it would work on other NT based systems though

--
bedrock
dELTA
09-27-2003, 08:44 AM
There is some strange problem with attachments since the board was upgraded, hopefully it will be resolved soon anyway.
squidge
09-27-2003, 08:46 AM
Nice work. I normally cheat when removing packer sections from a dump however. Instead of removing the chunk completely, I just set the rawsize to 0 & realign the file. It makes the file a lot smaller, but still takes up the same amount of memory. Yes, I know this is not the best way, but I had already written an align function, and really didn't want to start modifying all sections that could come after the packer section (as I like my code to be generic so I can use it elsewhere)
Hellraiser
11-25-2003, 04:29 PM
thanks for this tool, dude! I appreciate your work
rnd
12-26-2003, 04:35 AM
I found it very interesting. I didn't know that the winapi would allow you to handle hardware breakpoints. What I didn't understand was how you place the BPM. changing the DRx registers, okay, but why are you able to read a CONTEXT structure from (ctx.esp+4) in your SetBreakpoint function? Is it undocumented, or do I miss something?

I tried to write my own BPM handler in C++, without the esp+4 readprocessmemory stuff, so only by modifying DR0 and DR7, but it didn't work at all :(
doug
12-26-2003, 12:29 PM
typedef struct _EXCEPTION_POINTERS { // exp
PEXCEPTION_RECORD ExceptionRecord;
PCONTEXT ContextRecord;
} EXCEPTION_POINTERS;

ContextRecord

Points to a CONTEXT structure that contains a processor-specific description of the state of the processor at the time of the exception.

--
(SetBreakPoint is called from a function that waits for a DebugEvent.)
rnd
12-27-2003, 12:20 PM
this is what I make of it:

void CE32UnpackDlg::SetBreakPoint(PROCESS_INFORMATION* pi, DWORD dwBreakPointAddress)
{
CONTEXT ctx;
CONTEXT ntctx;
DWORD ctxptr;

ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;

//place the debug registers from the debuggee in ctx
GetThreadContext(pi->hThread, &ctx);

ctx.Dr0 = dwBreakPointAddress;
ctx.Dr7 |= 0x00000001;

//read the dword at ctx.esp + 4 into ctxptr
ReadProcessMemory(pi->hProcess,
(void*)(ctx.Esp + 0x4),
&ctxptr,
4,
0);

//read from ctxptr into ntctx
ReadProcessMemory(pi->hProcess,
(void*)(ctxptr),
&ntctx,
sizeof(ntctx),
0);

//etc... }

the comments were added by me. so if i am right, he obtains the place where ESP in the debuggee points to, adds 4 to it, and read a dword from there. that dword is the address of a debugging registers context.

i think there are 3 possibilities:

1. i am wrong and don't understand a ... of it :)
2. it is something undocumented :confused:
3. or the SetBreakPoint should only be called when the debuggee is halted on a very special address where the conditions needed to work (*(esp+4)=context thing) are true...

i don't know if i should pick 1,2 or 3, but 1 or 2 seem to be the most likely to me :D
LouisSolomon
02-09-2004, 07:33 PM
cute :-)

I should write a defeat for this one day :-)
but not worth my time.

Louis
www.SteelBytes.com
bedrock
02-11-2004, 02:46 PM
cute :-)

I should write a defeat for this one day :-)
but not worth my time.

Louis
www.SteelBytes.com

Thanks Louis,

Funny thing is all the effort i put into this for one particular program being protected by your exe32pack, and in recent builds of that particular program they seem to have not bothered protecting anymore :(

--
bedrock
LouisSolomon
02-11-2004, 09:00 PM
:-)

the reason I ended up here was a did a google for ollydbg + PEiD after a user told me that it was apparently easy to unpack exe32pack using said tools.

the user also asked me if I could improve exe32pack so as to make it unpackable, I replied with:

> I would also like that, but it is unlikely to ever happen.
> it currently stops newbies, but it is not worth my time to make it much better.
> anything worth cracking will be cracked.
> if it runs, it can be cracked.
dELTA
02-11-2004, 09:03 PM
Hehe, true, honest and to the point. :)
JMI
02-11-2004, 09:29 PM
A rare thing to find in protection software authors these days. :D

Regards,


softice windows 2000/sp3 boot mode problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice windows 2000/sp3 boot mode problem
PDA

View Full Version : softice windows 2000/sp3 boot mode problem

pasha
09-27-2003, 01:18 PM
greetz all

oki, i always used to have my softice (DS 2.7) under w2k/sp3 in manual mode with my ATI Radeon 7500 64MB. and it worked absolutely fine without a glitch. today i wanted to be able to debug some drivers and put softice to load in boot mode. there were no problems, it loaded SIWVID, NTICE and went into my w2k desktop as usual. but voila, when i press Ctrl+D no reaction, then i find that the service ntice has started but there is no trace that softice is alive. i even tried a small proggie which GPFs so i thought i could bring up the ntice popup on faults, but nothing, normal windows error came up. so i guess ntice is not being loaded, but there were no error messages during bootup.

i am confused. has anyone experienced this kinda problem before ? or any solutions :) ?

awaiting a reply..

best regards
pasha
pasha
09-29-2003, 10:42 AM
greetz all

i got it working. it was my service pack and ds 2.7 could not handle sp3.

best regards
pasha
naides
09-29-2003, 07:30 PM
greetz all

i got it working. it was my service pack and ds 2.7 could not handle sp3.

best regards
pasha

Glad we were able to help you with your problem.
Please fly with us next time. . .
:D :D
Rummy
09-30-2003, 03:31 PM
pasha, did you find that anywhere in the docs or on the SI website? I just spent 2 days unsuccessfully trying to get 2.7 to work on W2K SP3 under vmware. Finally I moved to visual SI 3.0.1, but I want to know if I could have saved a day of problems. Did I miss something in the docs that tells you 2.7 won't work with SP3?
tom324
10-01-2003, 03:18 AM
h**p://frontline.compuware.com/nashua/patches/

Tom
Rummy
10-03-2003, 06:35 PM
thx, tom324, i actually went to that page before to get the vsi updates and completely didn't see the 2.7 ones.


Splaj,.....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Splaj,.....
PDA

View Full Version : Splaj,.....

SpeKKeL
09-27-2003, 06:09 PM
Nothing heard about my buddy,......no posts....no nothing.....
Anyone knows..?
:mad:

Spekk.
Woodmann
09-27-2003, 08:32 PM
Hi,

I have sent him mail but I have not gotten a reply.

Woodmann
sv
09-28-2003, 05:27 AM
Last mail from he was April :((
Js
10-25-2003, 09:15 AM
wearing dark glasses and a raincoat, browsing the board 25-10-2003 .
Solomon
10-25-2003, 11:24 PM
hehe............. :D
+SplAj
10-26-2003, 01:08 AM
Damn Walmart spies r everywhere.....leave me alone i'm sleeeping.........
SpeKKeL
10-26-2003, 01:21 AM
Damn Walmart spies r everywhere.....leave me alone i'm sleeeping.........

Glad you're still there (where ever that may be) okee, sleep well............

SpeKK.
evaluator
10-26-2003, 02:26 AM
i can imagine following shits about SPLAJ:

1. he leaves us because of political protest against us-Ira_;
2. he joins saddAMD for fight with earth;
3. he is hardly working on killer-apps & soon all m$-PCs will crash;
4. CIA tries to liquidate him, (group supervised by W);
etc
.
.
.

*
who can more dirti!?
*


About ocx unpacking.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > About ocx unpacking.
PDA

View Full Version : About ocx unpacking.

cnbroken
09-28-2003, 06:28 AM
Some one can tell me how to unpack a OCX file which Protected by unkown Protector.
dELTA
09-28-2003, 09:48 AM
Use a packer identification tool (like PEiD) to identify the packer (or do it manually, by looking at section names and so on). Then learn as much as you can about this specific packer, from tutorials and messageboards, and then unpack it. Not many more tips can be given when so little info is provided.
squidge
09-28-2003, 12:21 PM
Yup, delta's pretty much covered it!


cock sucking: pros&cons - 2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > cock sucking: pros&cons - 2
PDA

View Full Version : cock sucking: pros&cons - 2

wanc0ck
09-29-2003, 04:38 PM
i had to post this after seeing that beautiful poll regarding selling unpackers for $$ ... what the fuck is all that about ? can anyone explain me what is this "cracking spirit" which would be lost when smbd deals w/ $ ? ;\
every single bit of fucking lame coded wankware cost money, there always comes someone who steals ppl ideas for they new clone of asprotect (hey acprotect must be a kewl piece of shit!)
in other words as the 'whitehat' (morons) 'idealogy' is profitable for security industry thus is general audience is stuffed w/ shit like 'hackproof yer arse in 21 second' and alike. definetly the same thing is w/ reversing as it is here on this board - why the fuck you should give out everything you know for mofos who'll use it to earn yet another buck ? ;\
Sso kidz plz be nice and cause as much chaos and havoc as u can, or at least do not slurp.

no need of cenzorship plz, enuf of it out there ....
Woodmann
09-29-2003, 04:58 PM
I have a novel idea.........

Put up or shutup.
Drop the leeto typing shit.

Who the fuck are you ?
Kayaker
09-29-2003, 05:41 PM
yawn, I'm going to go read my junk email box
evaluator
09-30-2003, 04:27 PM
In general, (wo)man should be more consecutive in life.

Step 1:
>what the fuck is all that about?

Step 2:
>definetly the same thing .. here on this board - why the fuck you..

So NEXT Step should be:
"what the fuck I'm doing here!?"

& after..just..FuckAway..(GoAway)..
dELTA
09-30-2003, 04:37 PM
:)


An self-made packer - Part 1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > An self-made packer - Part 1
PDA

View Full Version : An self-made packer - Part 1

tazmanian
09-29-2003, 09:03 PM
Well, i unpacked a version before of this program, but now they put something that detects softice or icedump =\

Before i used the basics things

1) hide softice with icedump
2) uses /tracex to get OEP
3) /dump the file
4) fix idata...
But now i cant hide softice =\

While debugging, the dammed C3 reboot my pc all the time...this is a trace detection, but it only works if you go tracing with F8...with /tracex it doens't happen...

I wanna know how to discover which thing it detects, there is like 10 sections in PE header...

Can u guys help me?

Thx! :)

<Please, no direct link>
evaluator
10-03-2003, 08:27 AM
hemm, I am very interesting about this cool reboot.
Where it is?
Manko
10-03-2003, 01:04 PM
Hi!

I'd like a PM with link, please! :)

/Manko
tazmanian
10-09-2003, 03:12 PM
First i would like to thank you for trying to unpack this program.
It's a Brazilian app and with this you can add a shareware code to any app writen in VB or Delphi.

Web: send me a pm
Download: send me a pm

Cracking info:

The compiler is Visual Basic 5.0.
Pe Header with sections named .DRD00 to .DRD09
I unpacked the 2.0d version like this:

1) Hide softice with icedump
2) I found the OEP with /tracex comand (VB's OEP is always after the jmp __vbApis)
3) Dumped and fixed the idata with imprec.

But with 2.0e i can't hide softice, if softice is loaded and icedump too, the app doesn't load =\ i think that it looks for icedump, i'm not sure...

If i can run the app with softice loaded i think that i can unpack it...but the problem is to hide totally softice.

If you have any question send me a PM...

I think that if we can hide softice, the unpacking is bullshit..... ;P

thx in advance


damned bloody SI modules....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > damned bloody SI modules....
PDA

View Full Version : damned bloody SI modules....

Nexcess
09-30-2003, 02:53 AM
Okay Im sick of messing with it so im just going to ask. I tried running SI on win98 so many times it was sad and always had issues because win 9x is unstable as... something bad heh... I dunno anyways to the point

I uncommented the lines in my winice.dat file and while i can bpx on memory addresses i cant bpx API's I get a message saying 'symbol not defined'
ive tried a bunch of the common api's including Getdlgitemtext and Getwindowtext(bpx hmemcopy doesnt work cause of winxp....sux :( but it gave me that msg too ) and always the same silly message, I ran a search but no one seems to have covered this one. Personally im ready to uninstall the bloody program and stick with olly/w32dasm/hiew but in the spirit of learning something new/self-improvement im begging desperatly for help here first :)

TIA,
-Nexy
Ricardo Narvaja
09-30-2003, 04:48 AM
Not only quit the (;) before the modules you use in winice.dat, verify the path are in the winice.dat of each module are correct, winice.dat come with a general path but if your system (bah really the location where you have your system dll are different of C:/windows/system) you can modify all paths to the correct locations.

Ricardo

Okay Im sick of messing with it so im just going to ask. I tried running SI on win98 so many times it was sad and always had issues because win 9x is unstable as... something bad heh... I dunno anyways to the point

I uncommented the lines in my winice.dat file and while i can bpx on memory addresses i cant bpx API's I get a message saying 'symbol not defined'
ive tried a bunch of the common api's including Getdlgitemtext and Getwindowtext(bpx hmemcopy doesnt work cause of winxp....sux :( but it gave me that msg too ) and always the same silly message, I ran a search but no one seems to have covered this one. Personally im ready to uninstall the bloody program and stick with olly/w32dasm/hiew but in the spirit of learning something new/self-improvement im begging desperatly for help here first :)

TIA,
-Nexy
hobferret
10-01-2003, 03:03 PM
Nexcess :)

What version of SI are you using here??

/hobferret
Aimless
10-06-2003, 12:00 AM
There could be the following reasons:

1. You may have uncommented the lines for only the 16-bit dlls and not the 32-bit ones. Look for lines with the 32 behind them, such as user32.dll, gdi32.dll, kernel32.dll & advapi32.dll. Uncomment them.

2. Though you may have ensured that the 32-bit ones are uncommented, it could be possible that their paths are different. For example, if you have installed windows in D: as opposed to the normal C:, then you need to give the correct path as D:\Windows\System, or alternatively, it could be installed on the C:, but the windows directory is different, so maybe it looks like C:\Win98\system. A good idea is to open explorer and check.

3. You also need to reboot windows for the changes to work (though I am sure the same will not be missed by you)

4. If it still does not work, pop into softice (Ctrl-D) and type in the command EXP. Check the symbols and the files for which the same have been located. It could be possible that you may have not included the dll for the API which you are trying to breakpoint on in the WINICE.DAT file.

5. If that is also taken care of, then ensure that your CASE-SENSITIVE symbols are off. If they are on, then bpx messageboxa will NOT work, instead you will have to type bpx MessageBoxA.

6. If all else fails, you can always re-install softice

7. If that fails, guess its time to reinstall WIndows 98. But I assume that won't be necessary.

Have Phun


Signature Scanning & Packers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Signature Scanning & Packers
PDA

View Full Version : Signature Scanning & Packers

Clandestiny
09-30-2003, 09:59 AM
Hiya guys,

I am working on a very simplistic heuristic anti-virus scanner for a graduate course I'm taking. At present my focus is on static and statistical analysis of PE structure rather than dynamic analysis using emulation. As you all know, many packers make modifications to the PE structure similarly to viruses and there is a good possiblity for false positives from the packed / encrypted targets using only static analysis. I am thinking to incorporate a basic signature scanner for ruling out the false positives for packed programs. I realize that there are a number of packer identifiers out there and I was curious if there is a repository of packer "signatures" somewhere? I have to admit that its not particularly thrilling to me to contemplate d/ling and disasembling hundreds of packed programs looking for signature byte sequences ;)

Thanks,
Clandestiny
volodya
09-30-2003, 03:10 PM
Clandestiny

PE Sniffer contains all signatures in plain text format. You are allowed to use it (download the tool from wasm.ru - package is called PE Tools) but be nice and provide me with the YOUR source code for studying then :)
Nat
09-30-2003, 03:35 PM
Hi Clandestiny,

Unfortunately, I do not know much about reverse engineering. I do know, however, that coding a good unpacking engine is quite difficult.

Let me show you an example:

Even Kaspersky AV (one of the most highly respected AV scanners) seems to use a static unpacking engine (i.e., there is apparently no emulation or, alternatively, the generic unpacking engine is not switched on before a compressor is statically identified). I am not 100% sure whether Kaspersky uses signatures or checksums in order to identify compressor/crypters.

However, VX guys & gals know quite well how to outfox Kaspersky"s detection algorithm. It is sufficient to slightly modify the unpacking stub of a well-known packer like UPX or Petite in order to prevent KAV from detecting a compressed malware sample.

Two methods are frequently used in order to camouflage well-known malware:

(a) Adding NOPs

For instance, a UPX-packed malware sample (e.g., a trojan) can be modified in the following way: Firstly, a few NOPs (90) are inserted with a
hex editor in front of the first jump (starting from the OEP).
Secondly, the first jump is corrected by subtracting a number of
bytes equal to the included NOPs.

//******************** Program Entry Point ********
:004C27F0 60 pushad
:004C27F1 90 nop
:004C27F2 90 nop
:004C27F3 BE00E04700 mov esi, 0047E000
:004C27F8 8DBE0030F8FF lea edi, dword ptr [esi+FFF83000]
:004C27FE C787D0240A00881C4006 mov dword ptr [edi+000A24D0], 06401C88
:004C2808 57 push edi
:004C2809 83CDFF or ebp, FFFFFFFF
:004C280C EB0C jmp 004C281A

... (the listing shows the stub of UPX-compressed Bionet 3.18 trojan)

Thirdly, two NOPs, which are located shortly after the first
jump, must be deleted.

(b) OEP Redirection

Another way to confuse the Kaspersky unpacking engine is to change the OEP of a malware sample which is, let's say, packed with PKLite. The OEP is simply changed with a hex editor. At the new OEP a jump to the original OEP is included.

**************
Program Entry Point = 004BB028

:004BB000 6880B04B00 push 004BB080
:004BB005 68B7685100 push 005168B7
:004BB00A 6800000000 push 00000000
:004BB00F E8A3B80500 call 005168B7
:004BB014 E9B742FEFF jmp 0049F2D0
:004BB019 40 inc eax
:004BB01A 2823 sub byte ptr [ebx], ah
:004BB01C 295067 sub dword ptr [eax+67], edx
:004BB01F 4C dec esp
:004BB020 49 dec ecx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004BB090(C)
|
:004BB021 6745 inc ebp
:004BB023 3332 xor esi, dword ptr [edx]
:004BB025 20436F and byte ptr [ebx+6F], al

//******************** Program Entry Point ********
:004BB028 EBD6 jmp 004BB000

... (this is again a Bionet 3.18 trojan)

Since KAV is unable to detect the above trojan samples I conclude that it uses a strict, static unpacking routine (i.e., a minor modification of the OEP area will keep KAV from unpacking a known packer). Kaspersky has been notified about this issue.

If you want to code a better static unpacking engine you need to include an opcode filter which not merely analyzes the unpacking stub of a compressor but also detects such "dirty" tricks like OEP redirection or inclusion of NOPs.

I am not aware of any public signature databases for compressors/crypters but this does not have to mean anything. (You may want to start with procdump.)

Btw: Other scanners like McAfee do not need to unpack each and every compressed malware sample since they (additionally) use signatures from the .resc section of a file. The resource section is frequently not compressed at all. However, this detection method comes at a bitter price. Signatures taken from the resource section can be easily modified (e.g., with a tool like resource hacker) and are therefore not secure. For example, it frequently suffices to change the icon of a trojan in order to keep McAfee from detecting it. By contrast, KAV uses "strong" signatures taken from the code section of a malware sample. (Therefore, the Kaspersky signature database was "cracked" by SennaSpy...)

In summary, I feel that a person equipped with the knowledge of an experienced reverse engineer has the power to significantly damage the reputation of any AV/AT scanner. On the other hand, a reverse engineer who supports the development of unpacking routines can be extremely helpful to any AV/AT software producer (and their customers of course). It is really a matter of using or abusing knowledge.

Cheers,

Nat
Clandestiny
10-02-2003, 10:29 PM
Volodya:
A BIG thanks to you for those signatures :D There seem to have been some problems with the site for the past couple of days, but I finally got em' today :) The PE Tools package looks very nice. Let me just clarify my interpretation of the signature database though...

For example: [Crunch/PE=55E8000000005D83ED068BC5556089AD::::::::2B85]

Am I correctly interpreting the "::::" as representing "wild card" bytes?

BTW, I'll be happy to share my source with ya when its done although I'm not too sure you'll learn much new since this is going to be a very basic scanner. It has to be completed by the end of the course I'm taking in 2.5 months and has to be fit in with homework from several other graduate classes... Needless to say, the possiblites are limited by my time ;) I am, however, interested in this area and have plans to continue research with the eventual goal to gain some understanding of AV emulation systems.

Nat:
Also, I wanted to thank you for your very thoughtful and informative reply. I understand that OEP obsfucation is a big issue, however, my present efforts are going to be in the basic realm and will most likely not address this complex issue. I am curious, however, if the OEP obsfucation problem can be handled with emulation? Say, you locate the general area of the OEP and then systematically run an emulator from potential OEP addresses. Could you trap the resulting faults from incorrect OEP guesses and restart the emulator systematically until it ran a significant ways without crashing and then based on that conclude the true OEP value???

Cheers,
Clandestiny
Nat
10-03-2003, 06:08 AM
I am curious, however, if the OEP obsfucation problem can be handled with emulation? Say, you locate the general area of the OEP and then systematically run an emulator from potential OEP addresses. Could you trap the resulting faults from incorrect OEP guesses and restart the emulator systematically until it ran a significant ways without crashing and then based on that conclude the true OEP value???

@Clandestiny

(a)
In theory, I believe that an emulation can indeed handle "unknown" compressors or manipulated "known" compressors. However, generic unpacking is difficult to implement and very slow. For example, you need to make sure that an emulation is not outfoxed by a wait loop which takes advantage of the speed difference between a real computer and a virtual emulation.

There are only a few AV scanners which permanently use an emulation for detecting non-viral malware. One of them is NOD32 version 2. I understand that NOD32 supports static unpacking only for UPX and ASPack. Therefore, I believe that NOD32 is a good example for studying the modus operandi of an emulation (you need to enable "advanced heuristic" to activate the emu):

If you scan OEP obfuscated, non-viral malware with NOD32 you will see that some samples can be unpacked and correctly identified. Other samples cannot be unpacked at all (depending on the obfuscation method). Moreover, the NOD32 heuristic will frequently - but not always - detect an OEP obfuscated malware sample as an unknown virus.

In summary, you will see that an emulation is nice but not necessarily the ideal way to detect protected malware.

(b)
I am unable to explain the exact details of an emulation since I have not coded one. I believe that one of main problems connected with your suggestion ("restart the emulator systematically") is the speed penalty caused by an emulation.

(c)
You may be interested in the following links (unless you already know them):

http://www.extremetech.com/article2/0,3973,325439,00.asp

http://online.securityfocus.com/infocus/1552

http://www.nai.com/common/media/vil/pdf/imuttik_VB_%20conf_2000.pdf

http://www.sophos.com/virusinfo/whitepapers/savdetection.html

http://www.norman.com/documents/nvc5_sandbox_technology.pdf

http://securityresponse.symantec.com/avcenter/reference/heuristc.pdf

Cheers,

Nat
volodya
10-03-2003, 09:55 AM
Am I correctly interpreting the "::::" as representing "wild card" bytes?

Yes. Absolutely.
disavowed
10-03-2003, 03:37 PM
You may be interested in the following links (unless you already know them):

http://www.extremetech.com/article2/0,3973,325439,00.asp

http://online.securityfocus.com/infocus/1552

http://www.nai.com/common/media/vil/pdf/imuttik_VB_%20conf_2000.pdf

http://www.sophos.com/virusinfo/whitepapers/savdetection.html

http://www.norman.com/documents/nvc5_sandbox_technology.pdf

http://securityresponse.symantec.com/avcenter/reference/heuristc.pdf
thanks for posting those great links!
v0kram
10-04-2003, 05:33 AM
Hi Clandestiny,

If you are just going for static analysis which is more appropriate coz of your shortage of time, it is best to follow just the simple signature scanning techniques as most identifiers use nowadays. Use a list of most common packer/compiler signatures (given a short time again, using Mr. Volodoya's infamous list :o would be fine) Also in the course try finding out which bytes/ares are being scanned for the packers concerned. Most of the time it is the EntryPoint which is being scanned, but sometimes it might be wiser to scan other areas. For example some simple polymorphic code detection can be still be analysed by signature scanning instead of dynamic analysis, just look at the right places ;)

Also you might like building up your own, semi-heuristic scanner by analysing other parts other than executable code. Some packers subtly change headers/import tables/section info.

All these can together give you a powerful scanner using just signature scanning with some extra tricks ( Two of the best PE detectors currently use this technique and are quite reliable IMHO )

I myself have been developing a similar scanner for sometime and would be happy to see more work in the area.

Also thanks to Nat for the wonderful links :)

Good luck
Clandestiny
10-04-2003, 11:04 PM
Thanks Nat for the info and excellent links and thanks v0kram for the advice... The "building an AV engine" article was very helpful and definately gave me some insight into desigining my little scanner with modularity in mind. Also, the "sandbox" article was particularly intriguing, albeit shocking to realize the complex techniques some of these scanners use! :eek:

Currently, my plans are for a *basic* PE scanner that will use both simple heuristics and a traditional signature scan. (I found a reasonably up to date database of virus signatures from Clam Antivirus, an open source *nix antivirus package). I am thinking to use heuristics based on PE structural abnormalities that normally would occur in either packed or infected executables (ie. abnormal entry point position, raw and virtual section size inconsistancies, ect) to identify "suspicious" files and then send those files identified as "suspcious" into the signature scanner for a positive identification as "infected". That way, the scan would be faster as it would not have to waste time doing an entire signature scan on a file that had no other abnormal characteristics. However, I'm not actually certain if it would be possible to obtain positive identification of an infected file in the event it didn't match a known signature because it doesn't seem like simple heuristics based on structural abnormalities could give you enough data to make a reasonable elimination of "false positives".

Most of the time it is the EntryPoint which is being scanned, but sometimes it might be wiser to scan other areas. For example some simple polymorphic code detection can be still be analysed by signature scanning instead of dynamic analysis, just look at the right places.

I'll admit that I don't know a whole heck of a lot about viral infection as I'm just coming from a general knowledge of the PE format as it relates to manual unpacking, but off hand I can see 3 routes of infection:

1. Code is appended to .exe in new section and entry point redirected to that last section where the code was appended. This case shouldn't be too hard to identify and it would make sense that you would scan the entry point containing section. I can see, however, that the real entry point might just be modified with a far jump or call to point to the appended malicious code so then it might make sense to disassemble the first few instructions looking at jmp and call instructions to identify the best area to scan.

2. I can also see where the virus might not want to change the file size and might just insert its code into some empty space at the end of an existing section. Neverthless, it seems this area to scan could be identified same as in the first scenario.

3. Inline patch scenario - the virus could insert a call at some arbitrary point in the file and redirect code flow to the inserted viral section. I don't know how many viruses might actually do this, but it seems this would make it quite difficult to narrow down a specific section to scan. I guess you would just scan the whole file in this case?

Am I missing any ;) BTW v0kram, are you using "heuristics" in your scanner in the sense of regular "wild card" signature strings or are you actually trying to define generic "behaviors" with generic signatures... as in, say, identify a decryption loop by using generic signatures that could indicate the behavioral components of a decryption like initializing a memory pointer, initializing a counter, moving some memory, ect.

Clandestiny
v0kram
11-13-2003, 12:15 AM
Hi Clan and the others, sorry for the late reply, was busy coding something ;)

Anyways, what I meant by saying scanning other areas has been slightly misinterpreted by you...

Scanning code in PE files is always not the only way in signature scanning...Consider the case of any good/decent polymorphic code, I assume its obvious one would be lost with signature scanning. But some other aspects might remain the same( the Import Table would be a nice option I guess? ;) )

I admit scanning PE headers etc. is usually a bad thing to rely on, but if you base your results partly on them and then do the other scans (whatever you have in mind) the results might be quite accurate...

Building a good heuristic engine is quite some work I'm sure, and getting ideas is probably the toughest part in it...

Hope your project is coming along good.

Peace


Generating DBG files for COM DLL/OCX's.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Generating DBG files for COM DLL/OCX's.
PDA

View Full Version : Generating DBG files for COM DLL/OCX's.

nikolatesla20
09-30-2003, 05:23 PM
I've always wanted to make a tool to find the RVA of a COM procedure, and figured the only way to do it effectively would be to use the type library, so I started researching how to read type libraries, and I happened upon this....

Lo and behold I finally found an article by that genius Matt at Compuware, who's already did it...I've looked for this info a long time ago and never found anything...must be new?

Anyway, here is the source files AND EXE's/ DLL's to do this. Just run the CoClassSyms.exe from the command line, passing in the path to the DLL/OCX you wish to extract from. It will generate a DBG file containing all the CoClass members (functions) which you can then load into IDA (or SoftICE). Wallah! Now you know exactly where the member functions are. :)

Enjoy

-nt20
mambox
11-12-2003, 02:16 PM
thanks!!

much appreciated!


Beginner's Visual SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Beginner's Visual SoftICE
PDA

View Full Version : Beginner's Visual SoftICE

Rummy
09-30-2003, 10:27 PM
I'm using VMware to run a guest OS. Both host and guest are Win2K SP3. Traditional SoftICE doesn't work very well on a VMware guest: you can only run it in full-screen VGA mode, and that's a show stopper for my reversing. So.... I installed Visual SoftICE with the "target" piece on the guest and the "host" piece on the host. I added a second network adapter to the guest (dedicated to SoftICE) and this arrangement seems to be working OK.

Visual SI is like the old SI in many ways, but in many other ways it is very different. Getting used to the different windows takes a while. I managed to set my first breakpoint that actually worked in a process context for CreateFileA. When it breaks I typed in "d ss:esp->4" like I used to do on the old SI to display the memory where the file name is. It doesn't work. The old '->' notation for indirect addressing no longer works at all. I'm reading both manuals for VSI (Visual SoftICE) - the user's guide and the reference - and how to do what I want is unclear. I tried 'd *(dword)(esp+4)' but it interpreted the data at esp+4 as a 64-bit address and gave an error that the huge 8-byte address was invalid.

Can anyone tell me how to do a good old-fashioned d ss:esp->4 ? There's not a lot of VSI information yet on this or any other board. Some tutorials are needed very badly. I hope that more people will install and start to use VSI so we can pool our knowledge and make the learning curve shorter. VSI is the wave of the future so we all better get used to it IMO :eek:
Rummy
10-04-2003, 11:33 AM
VSI (Win2K) Tip #1:
Get your network cards in order BEFORE configuring your remote target VSI core connection!

When VSI grabs one of your NICs to use (they recommend to dedicate one to VSI and leave another for general network usage) it updates the driver for the card. In doing this it manages to completely remove all traces of the old driver! From that moment on you will not be able to install a same-type network card (or re-install one) ever again without completely re-installing Windows 2000. Whenever you try to (re)install a NIC your Win2K box will insist on configuring it as a SICE network controller. This will happen even if you completely remove VSI from your system; the VSI drivers remain forever bound to that type of NIC. So make sure you already have both NICs configured and working BEFORE you install a VSI driver on top of one of them. This is almost definitely a VSI bug, but there are no Compuware forums or newsgroups where any of this is discussed. (NuMega, where oh where have you gone?) Compuware's website sucks.

VSI (Win2K) Tip #1a:
When you select the NIC that you want VSI to use, WAIT FOR THE DRIVER TO COMPLETE its installation. As the driver installs it appears to hang the system. I interrupted the process at this point and re-booted 5 or 6 times and was totally bummed out. Then as I was doing it one more time I got called away for something. When I returned about 15 min. later the damn thing had finished installing and I had control of my system back with a 'success' message waiting for me. Just wait for it to finish. It's not unusual to wait 5 minutes or more and see NO disk or CPU activity while it goes about its business.
nikolatesla20
10-04-2003, 01:15 PM
As far as the driver not being removed, try simply going into windows 2000 Safe Mode, and then going to Device Manager and removing the driver from there. A lot of times, you'll even find old drivers just laying around, since SafeMode will show you ALL drivers, and not just the active ones. This is really only the TRUE way to make sure a driver is every completely gone from your system.

-nt20
Rummy
10-04-2003, 09:02 PM
Thanks for that tip. I will try that the next time I am ready to re-install.... the way I'm going that should be in another hour or two :D


DES 40bit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > DES 40bit
PDA

View Full Version : DES 40bit

prt
10-01-2003, 05:28 AM
how to brute force DES 40bit cipher text?
mike
10-01-2003, 10:33 PM
how to brute force DES 40bit cipher text?

__int64 key,keymax=1;
keymax<<=40;
for (key=0; key<keymax; ++keymax)
if (!memcmp(DESdecrypt(message, key),knownplaintext,messagelen))
break;
print(key);


ASPR New Feature
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR New Feature
PDA

View Full Version : ASPR New Feature

LaBBa
10-01-2003, 04:17 PM
Hi all !!

i talked to CyberHeg about this and he told me this :

<CyberHeg> LaBBa: it's nothing new
<CyberHeg> aspr was the first one to do it
<CyberHeg> armadillo and the others copied it from asprotect
<LaBBa> realy ?
<LaBBa> didn't know that ..
<CyberHeg> yes it has worked since like v1.1
<CyberHeg> or so
<CyberHeg> for more then a few years
<CyberHeg> it's not not too common to use
<LaBBa> i unpacked many versions and that is the first time i ever saw ASPR do that ..
<CyberHeg> mostly because there are a ton of problems when you use it

but i never saw a post about it so i post it here now..

i got this app : <url deleted>
from Billy to check this Registered ASPR use ..

well i found this info :

Real OEP : 443ec4

stolen Byte = 38 bytes

Stolen byte where found by setting a Trace till this command is shows :
REP STOS BYTE PTR ES:[EDI]

00A36354 55 PUSH EBP -> 1
00A36355 8BEC MOV EBP,ESP -> 2
00A36357 6A FF PUSH -1 -> 2
00A36359 68 30284700 PUSH 472830 -> 5
00A3635E 68 E4234400 PUSH 4423E4 -> 5
00A36363 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] -> 6
00A3636E 50 PUSH EAX -> 1
00A3636F 64:8925 00000000 MOV DWORD PTR FS:[0],ESP -> 7
00A36376 83EC 58 SUB ESP,58 -> 3
00A3637E 53 PUSH EBX -> 1
00A36384 56 PUSH ESI -> 1
00A3638A 57 PUSH EDI -> 1
00A3638B 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP ->3

sum of : 38 bytes

well i fixed the IAT real easy with ImpRec (MackT/UCF)
and when i try to run it crashed ..
hehe ..

well i traced till i found that ASPR is getting to this part of code :

how it look befor the 2 calls of aspr (after Ctrl+A):

0040DF1C . FF15 08FF4700 CALL DWORD PTR DS:[47FF08] -> call ASPR Code
0040DF22 . FF15 00FF4700 CALL DWORD PTR DS:[47FF00] -> call ASPR Code
0040DF28 . E9 27000000 JMP RepairVi.0040DF54
0040DF2D D5 DB D5
0040DF2E 24 DB 24 ; CHAR '$'
0040DF2F 2D DB 2D ; CHAR '-'
0040DF30 81 DB 81
0040DF31 F4 DB F4
0040DF32 2C DB 2C ; CHAR ','
0040DF33 54 DB 54 ; CHAR 'T'
0040DF34 3D DB 3D ; CHAR '='
0040DF35 46 DB 46 ; CHAR 'F'
0040DF36 3D DB 3D ; CHAR '='
0040DF37 . A9 743938EC TEST EAX,EC383974
0040DF3C . 9B WAIT
0040DF3D . 872A XCHG DWORD PTR DS:[EDX],EBP
0040DF3F . C2 44D6 RETN 0D644
0040DF42 . 92 XCHG EAX,EDX
0040DF43 . 08DF OR BH,BL
0040DF45 . A9 1EF9B175 TEST EAX,75B1F91E
0040DF4A . 45 INC EBP
0040DF4B . D9CA FXCH ST(2)
0040DF4D . 05 44530606 ADD EAX,6065344
0040DF52 . 5E POP ESI
0040DF53 . F1 INT1
0040DF54 > FF15 04FF4700 CALL DWORD PTR DS:[47FF04]
0040DF5A . 8D86 F43A0000 LEA EAX,DWORD PTR DS:[ESI+3AF4]
0040DF60 . 50 PUSH EAX
0040DF61 . FF15 5C834600 CALL DWORD PTR DS:[46835C]
0040DF67 . 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
0040DF6B . 8BC6 MOV EAX,ESI
0040DF6D . 5F POP EDI
0040DF6E . 5E POP ESI
0040DF6F . 5B POP EBX
0040DF70 . 64:890D 000000>MOV DWORD PTR FS:[0],ECX
0040DF77 . 83C4 10 ADD ESP,10
0040DF7A . C2 0400 RETN 4

well i just pressed F8 (Trace Over) on the two calls and i got this wierd thing ...

how it looks after the 2 calles of aspr (after pressing Ctrl+A):

0040DF1C |. FF15 08FF4700 CALL DWORD PTR DS:[47FF08]
0040DF22 |. FF15 00FF4700 CALL DWORD PTR DS:[47FF00] ->> This Was and Decrypte Code call !!
0040DF28 |. E9 01000000 JMP RepairVi.0040DF2E ->> NOT THE SAME JMP !! and more new bytes..
0040DF2D | ED DB ED
0040DF2E |> 391D 4CDA4700 CMP DWORD PTR DS:[47DA4C],EBX
0040DF34 |. 7F 05 JG SHORT RepairVi.0040DF3B
0040DF36 |. E8 05EDFFFF CALL RepairVi.0040CC40
0040DF3B |> E8 70ECFFFF CALL RepairVi.0040CBB0 ->> it uses this call !!
0040DF40 |. 85C0 TEST EAX,EAX
0040DF42 |. 77 0A JA SHORT RepairVi.0040DF4E
0040DF44 |. C786 E0380000 >MOV DWORD PTR DS:[ESI+38E0],19720203
0040DF4E |> EB 04 JMP SHORT RepairVi.0040DF54
0040DF50 | EA DB EA
0040DF51 | 54 DB 54 ; CHAR 'T'
0040DF52 | F9 DB F9
0040DF53 | 78 DB 78 ; CHAR 'x'
0040DF54 |> FF15 04FF4700 CALL DWORD PTR DS:[47FF04] ->> Another ASPR Encrypte Call!!
0040DF5A |. 8D86 F43A0000 LEA EAX,DWORD PTR DS:[ESI+3AF4]
0040DF60 |. 50 PUSH EAX
0040DF61 |. FF15 5C834600 CALL DWORD PTR DS:[46835C] ->> InitializeCriticalSection API
0040DF67 |. 8B4C24 10 MOV ECX,DWORD PTR SS:[ESP+10]
0040DF6B |. 8BC6 MOV EAX,ESI
0040DF6D |. 5F POP EDI
0040DF6E |. 5E POP ESI
0040DF6F |. 5B POP EBX
0040DF70 |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
0040DF77 |. 83C4 10 ADD ESP,10
0040DF7A \. C2 0400 RETN 4

After the 0040DF54 aspr call the code that was changed to return to be the same !!

i havn't complited the Fixing and understanding what ASPR does ... but i thought that i will show u all
this first so we could all start working on it .. :D

Best Regards , LaBBa .
nikolatesla20
10-01-2003, 04:39 PM
Don't mean to burst ur bubble, but I don't think this is a new thing. Reget Deluxe, for example, did this same thing about a year ago - what they basically do is create a default "key" which is used to decrypt a couple of important code sections before the program runs. The decryption is called BY the program - this has always been part of Asprotect's features, it's in Asrpo's API. It's just the normally it's used to limit code blocks until you have a registered version. But some apps use it to decrypt some code blocks even in the demo version, to keep you from just dumping the program out.

Good job finding the encryption blocks. Just dump out the decrypted code and paste it into your already unpacked dump to fix it. ;)

-nt20
LaBBa
10-01-2003, 04:48 PM
well to tell u the true nikolatesla20 .. i don't know how to do it ..

every time i had to do 2 dumps and use them togther never worked for me

i'm still realy lame in PE file things.. :(
Js
10-01-2003, 09:51 PM
well to tell u the true nikolatesla20 .. i don't know how to do it ..

every time i had to do 2 dumps and use them togther never worked for me

i'm still realy lame in PE file things.. :(

I haven't looked at aspr in a while so could be wrong, have a look for +splaj Awave (if I remember correctly) tutorial should give you a good idea what I think niko is talking about when he says cut&paste decrypted block/s.
regards


Newbie, how to remove Armadillo protection...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Newbie, how to remove Armadillo protection...
PDA

View Full Version : Newbie, how to remove Armadillo protection...

mikeli
10-02-2003, 10:30 AM
Can somebody help me?
I need to remove protection, UnArmadillo v1.1 by [therain/uCF] give me this message:

++Target is [D:\Documents and Settings\Mikeli\Desktop\xxx .exe]++
++Armadillo 1.0 detected...++
>>Currently unsupported version!<<

Any link with tutorial?

Mikeli
mikeli
10-07-2003, 11:07 AM
Nobody wants to help me?

Mikeli

Can somebody help me?
I need to remove protection, UnArmadillo v1.1 by [therain/uCF] give me this message:

++Target is [D:\Documents and Settings\Mikeli\Desktop\xxx .exe]++
++Armadillo 1.0 detected...++
>>Currently unsupported version!<<

Any link with tutorial?

Mikeli
LaBBa
10-07-2003, 11:24 AM
Nobody wants to help me?

Mikeli

Use the search for tuts of Narvaja
doug
10-07-2003, 01:39 PM
generally you shouldn't expect an answer to questions like "how do you crack X", and the fact you unsuccesfully tried an automated tool combined with your posts count tells me you're looking for a crack to one of your "appz"
squidge
10-07-2003, 03:58 PM
Show us some code (WITHOUT identifying the original target application) and where you are stuck and we'll help. However, don't expect us to help if you are not willing to do some work yourself (and that doesn't mean trying different automated tools!)
JMI
10-07-2003, 08:57 PM
What you need to do FIRST, is READ the FAQ. There is a link at the bottom of the Forum. It will tell you how and what you shoud do BEFORE you post a question and then WHAT you should include in that question. We aren't here to do your basic research for you. We try to help those who have done some of there own work and show that they have done some work and THEN ask for some guidance.

In the solution to ANY problem, the first tool you want to use is your brain. You want to use it first to SEARCH for answers to your own problem, on your own. If you don't know how to search, there is also a link at the bottom of the Forums to another Forum devoted strictly to learning how to search. It's called Fravia's Searchlores, and was started by the founder of this Forum.

There is also a "search" button on the TOP of this Forum. If you use it and type in "Armadillo" as your search criterial, you will find alot of information here.

You should be advised you have chosen a more complicated protection scheme than many and, since you appear only used to using someone else's "tool," you will have a great deal to learn BEFORE you are ready to attack this protector yourself.

If you only want someone to help you crack this particular program, you have truely come to the wrong place, and complaining that no one has help you do that, with the little, or no effort you have shown. is not a good start.

Regards.


How to avoid AVS-detection @ packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to avoid AVS-detection @ packer
PDA

View Full Version : How to avoid AVS-detection @ packer

forwarder
10-02-2003, 03:27 PM
hi, i am implementing some sort of upx like executable packer but i got some probs with it - sometimes the compressed executables are detected as unknown virii by some well known avs (nod32 and norton for example) - i think its my loader which does not do things in their normal way. any general suggestions how i can avoid such false detection alarms? i noticed that changing a simple signature check from

if(e_magic == IMAGE_DOS_SIGNATURE)
if(Signature+1 == IMAGE_NT_SIGNATURE+1)

to

if(e_magic+1 == IMAGE_DOS_SIGNATURE+1)
if(Signature+1 == IMAGE_NT_SIGNATURE+1)

seems to help a little bit @nod32 (not @norton tho) but if i change my entry point from f.ex VA 0x1000 to 0x1010 it does yell again.
dELTA
10-02-2003, 08:52 PM
I would just perform some more complex arithmetic operations on those numbers than +1, and it should most likely not be a problem anymore. They can't emulate code of higher complexity just to see if it does an exe header signature check. Anyway, is it really on the normal heuristic setting of those AV-programs (contrary to the non-recommended highest setting) that this happens? Sounds quite strange.
forwarder
10-02-2003, 09:37 PM
i have got some success now.

in previous versions i have compressed the sections and copied 5 bytes (necessary space for a long jump) from oep's location to the loader. then i have written a long jump to the beginning of the loader to avoid changing that EP entry in the pe header. after decompression there was just a jump back and everything was fine except that it seems that some av's think its a little too virii like. now i changed my mind and now the loader's address = EP in pe header. no alerts so far.

btw, thanks for replying. thought i was alone :)


CrackZ Archives ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > CrackZ Archives ?
PDA

View Full Version : CrackZ Archives ?

tom324
10-03-2003, 12:12 PM
http://www.woodmann.net/crackz/index.html does not work. What happened?

Tom
CrackZ
10-03-2003, 03:54 PM
I know the answer to this one ;-).

But I'll leave it to Woodmann, pity really I have a lot of updates but oh well.....such is life.

Regards

CrackZ.
Woodmann
10-03-2003, 04:33 PM
Howdy,

I dont see anything wrong with it ;)
roli_bark
10-07-2003, 07:37 AM
Link works now.
But, CrackZ, where are your updates [last ones dated 23/3/3] ?


Little simple doubt in Handbook of Applied Cryptography...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Little simple doubt in Handbook of Applied Cryptography...
PDA

View Full Version : Little simple doubt in Handbook of Applied Cryptography...

acoder
10-03-2003, 04:00 PM
In Page 7 there's an example (1.4) that says:
"Take X = {1,2,3,...,10} and let f be the rule that for
each x E X, f(x)=rx where rx is the remainder when x^2 is divided
by 11. Explicitly then

f(1)=1 , f(2)=4 , f(3)=9 , f(4)=5 , f(5)=3
f(6)=3 , f(7)=5 , f(8)=9 , f(9)=4 , f(10)=1
"

f(x)=remainder_of(x^2/11) right?

f(3)=remainder_of(3^2/11)
then f(3) would be equal to 0.82 which the remainder is 8 and not 9,
the same happens in f(8). I dont know much this cryptography maths
but I still have interest in learn cryptography..

cya
sarge
10-03-2003, 05:02 PM
I read it differently....

f(3)=remainder_of(3^2/11)
f(3)=remainder_of(9/11)

9/11 = 0, with remainder of 9
That is, 11 "goes into" 9, 0 times (that is, it won't go at all), then there is 9 more to add back in = remainder of 9.

There aren't any fractional parts (.82) in remainders.

?????

Sarge
acoder
10-04-2003, 08:09 AM
mmh

f(3)=remainder_of(3^2/11)
f(3)=remainder_of(9/11)
9/11 = 0, with remainder of 9

I agree :) , however 9/11 (on my TI-83) is 0.81818...

which rounded to one decimal digit is 0.8 and not 0.9
(from what I know)

Hoppe u understand now what I mean :)
sarge
10-04-2003, 12:15 PM
so what?

the fact that 9/11 is a decimal number that can be rounded is nothing special; ANY fraction is actually a decimal number that can be rounded.

the question was: What is the remainder of 9/11...the answer is 9. This has NOTHING to do with the decimal number .818, or the fact that is can be rounded to .8....and nobody said that it was supposed to be rounded to .9 anyway!

Just check the MOD function.

Sarge
acoder
10-04-2003, 07:52 PM
so what?

the fact that 9/11 is a decimal number that can be rounded is nothing special; ANY fraction is actually a decimal number that can be rounded.

the question was: What is the remainder of 9/11...the answer is 9. This has NOTHING to do with the decimal number .818, or the fact that is can be rounded to .8....and nobody said that it was supposed to be rounded to .9 anyway!

Just check the MOD function.

Sarge

I will :)

thanks for the answers ;)
doug
10-05-2003, 02:14 AM
all scientific calculators have an [a b/c] button.

say 145 Modulo 11
145 [a b/c] 11 [=]

will give you-> 13/2/11 (a=13, b=2, c=11)
modulo is b, i.e: 2

anyhow, i'm not quite sure what you are doing with a crypto book if you don't know what modulo is ...
mike
10-05-2003, 06:14 PM
anyhow, i'm not quite sure what you are doing with a crypto book if you don't know what modulo is ...He's *learning*! Don't dis him for that...
acoder
10-07-2003, 01:30 PM
I've understood what was wrong when I calc the f(x)....

anyhow, i'm not quite sure what you are doing with a crypto book if you don't know what modulo is ...

Well, is it possible to learn crypto with this crypto book
just having 11 grade (no algebra and other stuff) ?

Its not the first time it happens the requirement of knowledge about
stuff I havent learnt on school..not meaning that I was successfuly
in all
mike
10-07-2003, 06:12 PM
Well, is it possible to learn crypto with this crypto book
just having 11 grade (no algebra and other stuff) ?No algebra? How do you write code without variables? You're going to have to learn algebra to understand anything on this site, and that's especially true for crypto. (Whether you learn it in school or not is irrelevant, though.)
Woodmann
10-07-2003, 08:45 PM
Hi,

I know almost nothing about crypto and its workings.

Perhaps acoder does not know the word algebra ?
Maybe he knows Trig or Calc.
Anyway, if he can understand page 7, he MUST have
more then remedial math skills. Else he likes to view crypto
sites and quote other peoples observations. :eek:

This is just my observation.

Woodmann
mike
10-07-2003, 10:56 PM
Hi,

I know almost nothing about crypto and its workings.

Perhaps acoder does not know the word algebra ?
Maybe he knows Trig or Calc.
Anyway, if he can understand page 7, he MUST have
more then remedial math skills. Else he likes to view crypto
sites and quote other peoples observations. :eek:

This is just my observation.

WoodmannI agree. I think acoder must know some algebra, or like you said, he wouldn't be here or reading a book on crypto. I just meant to say that it's a necessary skill for everything on this site.
acoder
10-08-2003, 04:19 PM
heya

I know the word algebra but I dont know what it exacly is,
and from what I've saw its a very different thing of Bool Algebra ;)
Anyway, sometimes I dont know the name ppl give to stuff I
already know/used.

I saw things on this book which I understood and/or seen seemed
to programming stuff, but in algebra have different names and 'look'
like permutations,etc. I've understood what involutions is, but didn't knew
it had that name :)

Also founded interesting the Vigenère cipher, to lower char frequencies.
Until now I've understood most of the stuff(I havent read much
tho), (the topic which sounded more confusing was the digital signatures), I know its probably
basic stuff, but important to continue (?)..
I read it slowly...depeding on my free time :)

"Else he likes to view crypto
sites and quote other peoples observations."
Nah, anyway I respect others opinion's ;)

Thanks for answering :D
Woodmann
10-08-2003, 05:12 PM
No,

Thank you :D

Woodmann


Optloader - who knows this Packer ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Optloader - who knows this Packer ??
PDA

View Full Version : Optloader - who knows this Packer ??

wrxcv3
10-03-2003, 11:43 PM
Hi,
I got a 16-bit Windows (NE) .exe
FileInfo 2.45a indicates that it is packed with:

Optloader (SLR Systems) [1993]

There is a copyright text in the exe:

OPTLOADER - Copyright (C) 1993-95 Symantec Corporation.All Rights Reserved

who knows details about this packer and how to unpack?

thx in advance
Woodmann
10-04-2003, 10:30 PM
Howdy,

Are you sure it is even packed ?
That prog is pretty old.

Woodmann
wrxcv3
10-06-2003, 12:20 PM
Howdy,

Are you sure it is even packed ?
That prog is pretty old.

Woodmann
Yes, I am quite sure.
I did not know that exepackers even existed in those prehistoric times ;)
I attach the file.

thx
esther
10-06-2003, 12:37 PM
why you ppl always did not read the FAQ!!!!!!!!!!!!!!!!!!!

NO SHAREWARES,COMMERCIALWARES SHOULD UPLOAD HERE!
wrxcv3
10-06-2003, 01:30 PM
sorry, excuse me ...
won't happen again.
Kayaker
10-06-2003, 03:46 PM
Just when you think it's safe to come out again...THWACK :p

Looks like you're stuck digging through this one yourself or posting some relevant code. There seems to be about a grand total of 2 Google hits on this and the SLR Optloader packer seems to be related to PKLite v 2.00 and perhaps WinLite. Both of these are more likely to have info floating around about.

Windows Source version 8 (an oooold disassembler...) is supposed to handle Optloader specifically - "provides the ability to decompress and disassemble self-loading Windows 16 bit executables compressed with PKLite v 2.00 and SLR Optloader".

From a Babelfish-stuck-in-your-ear translated .ru site:
At present by the only samozagruzhayushchimisya programs are Microsoft Word 1..x, Microsoft Fortran, the early versions Microsoft Excel, and also programs packed with the aid of WinLite by Rosenthal Engineering and OPTloader by OPTlink software. The distinguishing feature of the samozagruzhayushchegosya application is that advanced into 1 11 bits of flags (on mask 800h). In addition to this in the samozagruzhayushchemsya file it must be provided function BootApp(), ExitApp(), LoadAppSeg(). With call BootApp() is assumed that it it will place selectors for each segment, that are contained in Ne- file itself will correct the table of segments. Each of these functions has in KERNEL the appropriate shell: BootAppl(), ExitAppl(), LoadApplSeg().

If you can figure out what a samozagruzhayushchimisya program is it might help (self-loading?). Then there's always the question of is it worth it...?

Kayaker
wrxcv3
10-07-2003, 04:52 AM
yep, it is rare that you get so few search results (without making a typo) ;)
btw, you get 2 (!!) more hits to russian newsgroups, when you search for symantec optloader :)
but they all only deal with selfloading apps in general.
The other programs you mentioned seem to have no specific relation to optloader except for using the same selfloading mechanism.
I found a text describing selfloading apps, I will attach it.
I tried Windows Source 8, but it cannot decompress it.
I will try to let it decompress some pklite file, perhaps I am doing something wrong...
Kayaker
10-07-2003, 04:02 PM
Hi

I had read that document on Self-Loading Windows Applications Overview (3.1) some time ago and never really understood what "self-loading" implied. It appears to be a special set of entry, exit and segment setup procedures that needed to be made if you were going to make any modifications to how an NE app started up, such as applying a wrapper or packer around it from the looks of it. Nowadays the parallel would seem to be, change the OEP and the PE program will load in any case, damn the torpedoes I'm taking over.

It looks like a horrid way to have to code an NE startup procedure! Somewhere in the NE header you specify the file should be loaded with your own private loader code with a flag of 0x0800 (bit 11 must be set). Then there's 6 required loader functions, 3 kernel and 3 user-defined which needed to be properly set up and used, and interestingly, special Exit code.

I can't think of any modern packer/protector that uses "Exit" code per se, unless some of the trickier ones detects/hooks application shutdown and traps that to make some checks/changes away from where a cracker might normally look, behind the scenes, after the window disappears from the desktop but before the controls/data are really destroyed, in an injected system thread separate from the main packer..., that kind of thing ;-) ...

Good luck unpacking this little monster, at least there's those 6 proc addresses in the header file which might give some info, post that Loader Data Table in the header file for fun if you find it.

Kayaker


ASProtect 1.23 RC4 Demo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect 1.23 RC4 Demo
PDA

View Full Version : ASProtect 1.23 RC4 Demo

squidge
10-04-2003, 10:31 AM
I've just taken another look at the latest version of one of my rarely used proggies now it's increased by a few versions, and found that PEID states its now protected with the above.

Strange thing is, it has the "Debugger detected, please remove" blah blah etc, so it's clearly a new version, but I found it much easier to unpack than the old version?!

Loaded the program into Ollydbg, patched the byte in FS to avoid debugger detection, told Olly to ignore certain exceptions and let the program run as normal. Finding nothing fancy there, I told Olly to pause the program, and then dumped it to disk. Not wanting to trace through the code looking for the iat and oep, I just looked for a IAT signature, zeroed the obvious bogus entries in between the iat thunks, and imprec fixed it with no problems. Found the OEP within 5 minutes using IDA (by looking for a code sequence). Fixed OEP and it ran.

Now, I never found any stolen oep bytes, but the program runs the same as the packed one, which I find strange. I expected to at least replace the bytes by the normal ones found in the compiler startup stub. In the old version of the program, there was both bytes missing and multiple dips into the code from aspr itself before oep. Now there seems to be nothing?!

Anyone else played with this version of ASPR?
hobferret
10-04-2003, 04:09 PM
I've just taken another look at the latest version of one of my rarely used proggies now it's increased by a few versions, and found that PEID states its now protected with the above.

Hi Squidge

What rarely used program are you talking about?? :confused:

/hobferret :)
squidge
10-04-2003, 05:02 PM
Well, I prefer not to state the name of the target unless someone asks, but since your asking :)

[Edit by JMI: Name of Target deleted because of following post with target specific code. Bother Squide or LaBBA by PM if you want it, not because Squidge did something specifically wrong, but because of what Labba did which follows.]
LaBBa
10-04-2003, 08:23 PM
well i saw that its kinda nice..

in my way of finding the OEP by setting an TC i got to here :

0040C5D2 |. 74 2B JE SHORT 0040C5FF
0040C5D4 |. 8038 5C CMP BYTE PTR DS:[EAX],5C
0040C5D7 |. 75 02 JNZ SHORT 0040C5DB
0040C5D9 |. 40 INC EAX
0040C5DA |. C3 RETN

so i traced and after the RET i got to here :

0040C79D |. 53 PUSH EBX ; /pHandle
0040C79E |. 6A 01 PUSH 1 ; |Access = KEY_QUERY_VALUE
0040C7A0 |. 6A 00 PUSH 0 ; |Reserved = 0
0040C7A2 |. 50 PUSH EAX ; |Subkey
0040C7A3 |. 68 01000080 PUSH 80000001 ; |hKey = HKEY_CURRENT_USER
0040C7A8 |. 2E:FF15 000241>CALL DWORD PTR CS:[410200] ; \RegOpenKeyExA
0040C7AF |. 89C3 MOV EBX,EAX
0040C7B1 |. 85C0 TEST EAX,EAX
0040C7B3 |. 74 10 JE SHORT 0040C7C5
0040C7B5 |. 85DB TEST EBX,EBX
0040C7B7 |. 75 47 JNZ SHORT 0040C800
0040C7B9 |. B8 01000000 MOV EAX,1
0040C7BE |. 83C4 08 ADD ESP,8
0040C7C1 |. 5F POP EDI
0040C7C2 |. 5E POP ESI
0040C7C3 |. 59 POP ECX
0040C7C4 |. C3 RETN
0040C7C5 |> 8D4424 04 LEA EAX,DWORD PTR SS:[ESP+4]
0040C7C9 |. 50 PUSH EAX ; /pBufSize
0040C7CA |. 56 PUSH ESI ; |Buffer
0040C7CB |. 53 PUSH EBX ; |pValueType
0040C7CC |. 53 PUSH EBX ; |Reserved
0040C7CD |. 57 PUSH EDI ; |ValueName
0040C7CE |. 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14] ; |
0040C7D2 |. BA 04000000 MOV EDX,4 ; |
0040C7D7 |. 51 PUSH ECX ; |hKey
0040C7D8 |. 895424 1C MOV DWORD PTR SS:[ESP+1C],EDX ; |
0040C7DC |. 2E:FF15 040241>CALL DWORD PTR CS:[410204] ; \RegQueryValueExA
0040C7E3 |. 8B3424 MOV ESI,DWORD PTR SS:[ESP]
0040C7E6 |. 56 PUSH ESI ; /hKey
0040C7E7 |. 89C3 MOV EBX,EAX ; |
0040C7E9 |. 2E:FF15 F40141>CALL DWORD PTR CS:[4101F4] ; \RegCloseKey
0040C7F0 |. 85DB TEST EBX,EBX
0040C7F2 |. 75 0C JNZ SHORT 0040C800
0040C7F4 |. B8 01000000 MOV EAX,1
0040C7F9 |. 83C4 08 ADD ESP,8
0040C7FC |. 5F POP EDI
0040C7FD |. 5E POP ESI
0040C7FE |. 59 POP ECX
0040C7FF |. C3 RETN

again i traced after the RET i got to here :

0040733C 00 DB 00
0040733D 00 DB 00
0040733E 00 DB 00
0040733F 00 DB 00
00407340 00 DB 00
00407341 00 DB 00
00407342 00 DB 00
00407343 00 DB 00
00407344 00 DB 00
00407345 00 DB 00
00407346 00 DB 00
00407347 00 DB 00
00407348 00 DB 00
00407349 00 DB 00
0040734A 00 DB 00
0040734B 00 DB 00
0040734C 00 DB 00
0040734D . E8 3A540000 CALL 0040C78C
00407352 . 85C0 TEST EAX,EAX
00407354 . 0F84 9F000000 JE 004073F9
0040735A > 6A 00 PUSH 0

i got to : 00407352 . 85C0 TEST EAX,EAX
but if u scroll up u will see where is all the missing bytes should be ..

so the REAL OEP should be at : 0040733C

now we can see that we have : 17 stolen bytes ..

where are the stolen bytes ?? well in this board it was already spoken about ..
u can reload the Olly and instad of putting an TC command we can set a trace on a command :
REP STOS BYTE PTR ES:[EDI]

this command clears the stolen bytes before it make the jump to the fake OEP

by pressing Ctrl+T (in menu its : Debug->Set Condition)
there is and options : "Command is one of"

and then after pressing ok we need to press Ctrl+F11 to start tracing .. we will stop at more then 1 place that has this commad but we need this kind of structure :

009D575B F3:AA REP STOS BYTE PTR ES:[EDI]
009D575D 9D POPFD
009D575E 5F POP EDI
009D575F 59 POP ECX
009D5760 C3 RETN

now.. if u will look at the : "Run Trace" window u could see :

009D5C9F 68 D2C54000 PUSH 40C5D2
009D5CA4 68 4A579D00 PUSH 9D574A
009D5CA9 C3 RETN
009D574A EB 01 JMP SHORT 009D574D
009D574D 51 PUSH ECX
009D574E 57 PUSH EDI
009D574F 9C PUSHFD
009D5750 FC CLD
009D5751 BF 8E579D00 MOV EDI,9D578E
009D5756 B9 5E140000 MOV ECX,145E
009D575B F3:AA REP STOS BYTE PTR ES:[EDI]
009D575D 9D POPFD
009D575E 5F POP EDI
009D575F 59 POP ECX
009D5760 C3 RETN

those two line :
009D5C9F 68 D2C54000 PUSH 40C5D2 <-- The Fake OEP
009D5CA4 68 4A579D00 PUSH 9D574A<-- To return to clears the bytes
009D5CA9 C3 RETN

all the code that is responsible for excuting/emulating the real Stolen Bytes is attached to this post

all that i know about those lil thing is this :

when u see :
MOV DWORD PTR SS:[ESP+4],EAX

it's realy like : PUSH EAX
i'm sure that there are alot of other things like so .. but didn't have time to take a deeper look.. (no time..)

hope that some one will continue this ..

Best Regards , LaBBa
JMI
10-04-2003, 09:08 PM
Labba:

You have violated the rules against posting target specifically identified code. It was problem enough when Squidge posted the name of the program in his response to hobferret, but he posted no code at all and only described a generic issue with a possible new version of the protector.

You, however, not only posted target specific code, you also left it laced with the actual name of the program within your posted code snippet. This was a clear violation of our rules here and COMPLETELY UNNECESSARY. I have edited both your and Squidge's posts to remove all references to the name of the target.

Your presentation of the material would have been just as informative an explaination of the tracing process WITHOUT including the name of the target in front of each of your "jump" instructions. Without the target specific information, it serves as a generic approach to the protection, rather than a step by step method of "cracking" this particular software.

This is EXACTLY the type of posting that draws complaints to our host about our Forum and threatens our continued existence. We simply can not tolerate these types of problems. You know better. Make sure that you follow this rule in the future so we do not have to take any other action.

Regards.
LaBBa
10-05-2003, 03:28 AM
hmm ..

well .. we always do post here parts of codes .. it's strange to me that as u say "broken the rules" ..

i know that posting a way of how To Crack and app is not ok .. but posting parts of code that only talking about how to Unpack the APP and not Cracking it ... i don't see anything wrong with it ..

but if u say that we need not to do this then ok .. this won't happen again..

best regards , LaBBa .
squidge
10-05-2003, 07:10 AM
Strange, the OEP is obtained using IDA Pro on the target was 4073F9, but the program works just as well as the packed version. However, looking at the 33C address, I see the 17 stolen bytes, so obviously these bytes are not critical in this application, but they are stolen by the protector.

Aha, I see the difference now. In the packed version, they setup a timer and disable the "Start" button, and this is done in the original OEP. In the OEP I found using IDA, this timer is not setup, so the buttons are enabled instantly.

Ah well, I prefer it this way :)

Still wondering why they are using "RC4 Demo" though, surely a demo is something that is not registered?!
nikolatesla20
10-05-2003, 09:33 AM
My continuing theory is that, although most seem to freak out about stolen bytes,....they are not necessary at all. It's a worthless trick because most programs will run without those bytes anyway.

Basically, it's a feature that should have gotten more testing as to its effectiveness. Hi Alexy :p

-nt20
britedream
10-05-2003, 10:55 AM
Greetings!
Forget about the stolen bytes and tell me about the call at 40734d
that has been bypassed and nothing happened??
JMI
10-05-2003, 01:38 PM
LaBBA:

Since you did not seem to get the point of my message, I'll try one more time. The issue is not that you posted CODE. You notice that I did not delete your post, which still contails CODE. The POINT is that it no longer identifies a specific TARGET, which is commercial software.

Squidge stated that the "unpacked" TARGET runs fine and gave generic instructions for fixing the IAT and bypassing some of the protections tricks. Therefore, with THIS TARGET, unpacking and finding the "real" OEP equals essentially removing the protection and having an operating commercial TARGET.

With the NAME of the TARGET and Squidge's statements, anyone would have had an almost cookie-cutter method of circumventing the protection on that specific TARGET by unpacking it using the steps you outlined. That is what we want to avoid.

It is the simple difference between stating "here is what this version of the PROTECTOR is doing with stolen bytes," which doesn't identify ANY TARGET and "you can follow these steps and you will get to the REAL OEP of THIS TARGET." One focuses on the "methods" of the protector and the other appears to focus on the "TARGET."

Generic analysis of protection systems does not seem to draw attacks made to our host and TARGET SPECIFIC CODE DOES. It's that simple.

If you identify a specific TARGET, you should not post code that will allow someone else to make that TARGET operate without the protector. If you want to identify a version of the protector and describe what the code is doing, anyone wishing to apply that method to a commercial TARGET still has to determine that the TARGET uses that version of the protector and apply the generic approach themselves. There is a difference and I hope you see it now.

Regards,
squidge
10-05-2003, 05:31 PM
My continuing theory is that, although most seem to freak out about stolen bytes,....they are not necessary at all. It's a worthless trick because most programs will run without those bytes anyway.

Basically, it's a feature that should have gotten more testing as to its effectiveness. Hi Alexy :p

-nt20

Niko,

I usually find in Aspr'd proggies that the original program was compiled with MSVC++ or other such compiler, and so the first bytes that are stolen are part of the compiler stub that is the same on every compiled app anyway, so just replace those bytes and see if it works, rather than run around trying to find them. This seems to work in at least 90% of cases. In other cases, you find the stolen bytes equal to not much more than "GetModuleHandleA" and a bit of error checking :)
jojojo
10-11-2003, 07:26 PM
hello everybody,

i am examine a aspro protected app. peid identifies it as "ASprotect 1.23 RC4 Demo", so i assume iam in the right thread :o)

Iam trying to recover the stolen bytes and got really frustrated, because none on the known technics lead me to the right spot.

heres a trace :

004E7E64 0000 ADD BYTE PTR DS:[EAX],AL
004E7E66 0000 ADD BYTE PTR DS:[EAX],AL
004E7E68 0000 ADD BYTE PTR DS:[EAX],AL
004E7E6A 0000 ADD BYTE PTR DS:[EAX],AL
004E7E6C 0000 ADD BYTE PTR DS:[EAX],AL
004E7E6E 0000 ADD BYTE PTR DS:[EAX],AL
004E7E70 E8 F3EBF1FF CALL xxxx.00406A68
...

00406A68 53 PUSH EBX
00406A69 8BD8 MOV EBX,EAX
00406A6B 33C0 XOR EAX,EAX
00406A6D A3 10274F00 MOV DWORD PTR DS:[4F2710],EAX
00406A72 6A 00 PUSH 0
00406A74 E8 2BFFFFFF CALL xxxx.004069A4

...

004069A4 -FF25 B0424F00 JMP DWORD PTR DS:[4F42B0]

...

00DD1C64 55 PUSH EBP
00DD1C65 8BEC MOV EBP,ESP
00DD1C67 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00DD1C6A 85C0 TEST EAX,EAX
00DD1C6C 75 13 JNZ SHORT 00DD1C81
00DD1C6E 813D A47ADD00 00>CMP DWORD PTR DS:[DD7AA4],400000 ; ASCII "MZP"
00DD1C78 75 07 JNZ SHORT 00DD1C81
00DD1C7A A1 A47ADD00 MOV EAX,DWORD PTR DS:[DD7AA4]
00DD1C7F EB 06 JMP SHORT 00DD1C87
00DD1C81 50 PUSH EAX
00DD1C82 E8 3135FFFF CALL 00DC51B8 ; JMP to kernel32.GetModuleHandleA
00DD1C87 5D POP EBP
00DD1C88 C2 0400 RETN 4

...

00406A79 A3 18274F00 MOV DWORD PTR DS:[4F2718],EAX
00406A7E A1 18274F00 MOV EAX,DWORD PTR DS:[4F2718]
00406A83 A3 94804E00 MOV DWORD PTR DS:[4E8094],EAX
00406A88 33C0 XOR EAX,EAX
00406A8A A3 98804E00 MOV DWORD PTR DS:[4E8098],EAX
00406A8F 33C0 XOR EAX,EAX
00406A91 A3 9C804E00 MOV DWORD PTR DS:[4E809C],EAX
00406A96 E8 C1FFFFFF CALL xxxx.00406A5C
00406A9B BA 90804E00 MOV EDX,xxxxx.004E8090
00406AA0 8BC3 MOV EAX,EBX ; EAX == 004E7B7C
00406AA2 E8 91D8FFFF CALL xxxxx.00404338
00406AA7 5B POP EBX
00406AA8 C3 RETN

...

004E7E75 8B1D 7C144F00 MOV EBX,DWORD PTR DS:[4F147C] ; xxxxx.004F2C3C
004E7E7B 8B03 MOV EAX,DWORD PTR DS:[EBX]
004E7E7D E8 EA15F8FF CALL xxxxx.0046946C
004E7E82 8B03 MOV EAX,DWORD PTR DS:[EBX]

...

so, oep should be somewhere in the "zeroed area" around 4E7E68.
hmm, i thought about setting a memory bp on write access there, restart the app and examine when it writes the data there and secondly overwrites the original "staring bytes".
i breaked here:

....
00DC262B F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
00DC262D 89C1 MOV ECX,EAX
00DC262F 83E1 03 AND ECX,3
00DC2632 F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
00DC2634 5F POP EDI
00DC2635 5E POP ESI
00DC2636 C3 RETN

memory at esi:

004E7E68 00 00 00 00 00 00 00 00 ........
004E7E70 E8 F3 EB F1 FF 8B 1D 7C èóëñÿ‹|
004E7E78 14 4F 00 8B 03 E8 EA 15 O.‹èê
004E7E80 F8 FF 8B 03 BA 0C 7F 4E øÿ‹º.N
004E7E88 00 E8 EA 11 F8 FF 8B 03 .èêøÿ‹
004E7E90 83 C0 50 E8 B8 C7 F1 FF ƒÀPè¸Çñÿ
004E7E98 8B 0D 7C 13 4F 00 8B 03 ‹.|O.‹

surprisingly there was no other write access to that memory location.
this means that the opcodes from 004E7E70, E8F3EBF1FF
(or CALL xxxx.00406A68) are not modified anymore....

...?? could this be? is there nothing overwritten, no real stolen bytes?

anymore any ideas? i got crazy ;)
Zilot
10-12-2003, 12:18 PM
Leave me your URL. I played recently with something that PeId identify as ASPR1.23 Demo. That has stolen-mutated bytes, and I think it is the same version as you all described here.

Here is URL if you wanna see:
hxxp://www.3planesoft.com/files/castle.exe

Manko's debugger handles it (enough to be done manualy in shortest time).
It is not enough to find stolen-mutated bytes, there is another trick to reconstruct those bytes. I mean not to reconstruct them literaly, but to make application working.

Zilot


retool v1.06 released - sourcecode now availible too...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > retool v1.06 released - sourcecode now availible too...
PDA

View Full Version : retool v1.06 released - sourcecode now availible too...

OHPen
10-05-2003, 11:44 PM
Hi,

i have released a new version of retool (v1.06 atm).

Atm it's only a file scanner but more abilities added soon.

Sourcecode is now availible atm the official homepage:
I have written retool in eclipse, which is a professional and free development enviroment for java. Whole project source included...

FEEDBACK for IMPROVEMENT IS MOST IMPORTANT TO ME !!!!! PLEAZE !!!!!

hxxp://retool.cjb.net

Some changes to former versions:
________________________________

10/06/03

retool v1.06 is out now. Major changes in the internal structure have taken place...

1. wildcard signature scan implemented (known scan for any byte pattern is plugable...)
2. boyer-moore algorithm finds his use in the discovery-plugin
3. dynamic signature loader implemented by using directory parsing technique
4. retool supports now skin GUI, possible to make your own skin for retool (using LAF-Structur)
5. discovery-plugin redesign (nothin' special but now it looks little nicer...
6. retool is now startable with a EXE-File, but JVM already needed...

6. last but not least - major changes in the interal structure - retool is now more abstract organised and more easier accessable to upgrade, to improve and to change.

I hope you will help me to improve the tool with a detailed bug report. Use the retool-board to post your suggestion

If you are interested to contribute something to retool, contact me.

thx and

regards,

OHPen


anyone has tried LiveKD?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > anyone has tried LiveKD?
PDA

View Full Version : anyone has tried LiveKD?

dion
10-06-2003, 07:01 AM
any? how is it looks like? great/good/bad? true/fake?

thanks
dELTA
10-06-2003, 06:12 PM
I haven't tried it myself, but I'm sure it's pretty cool, because Mark Russinovich is quite the mean mother******. ;) What do you mean "true/fake"? And why don't you try it yourself, it's free you know?

hxxp://www.sysinternals.com/ntw2k/freeware/livekd.shtml
dion
10-06-2003, 09:40 PM
that's why i ask it here, because i dont have any "home" computer to try :(
dELTA
10-07-2003, 06:27 AM
I would guess that the program is of little use to you if you don't have any computer. But that's just an educated guess. :D
doug
10-07-2003, 01:35 PM
Isn't livekd just an util to use to debug code on your own computer... before you had to debug a machine using another connected to it.

in any case, it's an util that works on top of windows' debugging tools. I don't think it offers much more than what the std debugging tools given away for free by microsoft.
acoder
10-08-2003, 04:43 PM
KD and windbg from debugging tools and NTDDK,
Its useful to know about nt kernel symbols, like 'undocumented'
structures or variable addresses, proc names, ...
anyway importing some system modules dbg files (like ntoskrnl)
into sice will let u do the same as KD (windbg from what I know is
the same as KD but with GUI), however sice is in ring0 as we know ;)

To use KD u would need two machines as doug said...
"Isn't livekd just an util to use to debug code on your own computer... before you had to debug a machine using another connected to it."

I add, u also need the symbols installed dl from m$ debugging site:
hxxp://www.microsoft.com/whdc/ddk/debugging/symbols.mspx
doug
10-09-2003, 04:13 PM
Another important to mention is the symbols you download from the website are more often than not outdated.. especially if you're the type of user that likes to keep his system up-to-date.

I found these symbols to be near-useless... However, microsoft has implemented a symbol server from which you can download the right symbols, for the right Executable image - when you need it. There really isn't another choice when there's 2-3 patches/week :p

Numega's symbol retriever works well with that.. gives you both pdb's and nms.


Which linux do you prefer?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Which linux do you prefer?
PDA

View Full Version : Which linux do you prefer?

nikolatesla20
10-06-2003, 09:51 AM
Most of us work with windows primarily, but I'm also interested in people's opinion of which version of Linux they prefer to use, or which one is easier to program and get programs for.

So far, my preference has been Mandrake Linux.

-nt20
esther
10-06-2003, 10:15 AM
I prefered freebsd (<---coz its free and easy to install) or red hat.
dELTA
10-06-2003, 06:16 PM
Sorry, couldn't help myself. :D
nikolatesla20
10-06-2003, 07:16 PM
lol

nice.
disavowed
10-06-2003, 11:05 PM
Sorry, couldn't help myself. :D
dELTA, how many did you add? cause one of 'em is from me :P
dELTA
10-07-2003, 06:28 AM
I added 5, the rest must be genuine. ;)
nikolatesla20
10-07-2003, 06:58 AM
lies....

it was 618
nikolatesla20
10-11-2003, 01:44 PM
OH YEAH, well I just posted this post while running Suse Linux's Live Eval...which is cool 'cause its just a bootable CD which runs full fledged linux ! No installing required. Cool, no? Might be handy for those custom hacking jobs, and also possibly hacking into someone's system - I have XP and I can see all my hard drives....neat.

-niko20
beej
10-12-2003, 05:53 PM
>OH YEAH, well I just posted this post while running Suse
>Linux's Live Eval...which is cool 'cause its just a bootable CD

Check out Knoppix bootable CD, quite impressive.
Otherwise I prefer Debian, so I am one of those 0.63 % that voted other :-)
qweasdzxc
10-18-2003, 01:42 PM
>OH YEAH, well I just posted this post while running Suse
>Linux's Live Eval...which is cool 'cause its just a bootable CD

Check out Knoppix bootable CD, quite impressive.
Otherwise I prefer Debian, so I am one of those 0.63 % that voted other :-)

I like the Knoppix CD, I have been using it to work on windows box's that won't boot properly.
nikolatesla20
10-18-2003, 02:34 PM
Well, I've loaded Mandrake on some unused space on my hard drive on my windows machine, and I can actually run IDA Pro and Hex Workshop and resource editors under Wine just fine :) However, I think I like the SuSe linux the best, but so far this has been working really nice. I like how Konqueror browser gives you a lot of control.

Even got Yahoo Messenger for Linux to work, so Im getting more used to this now, in fact, this post was made thru Konqueror.

-nt20
SiNTAX
10-23-2003, 03:41 PM
Well if you like wine that much.. why not add support for some protections :)
I had a go at this a while ago.. sorta got SD to pass some checks, but never really finished it (short attention span).

Anyways.. I prefer Red Hat up to now.. probably because I have been using it for ages (ever since v4 or something)

BTW: if you want a messenger.. try Kopete from KDE (it will be part of 3.2). Supports most messenger formats.

Posted on Konqueror 3.1.92
SiNTAX
10-23-2003, 03:45 PM
BTW: if you like boot cd's.. check your local usenet mirror.. WinPE (Windows Preinstallation Environment) + alot of extra's (Ghost, Commander, ...) should be available.. so they tell me :rolleyes:


CD protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > CD protection
PDA

View Full Version : CD protection

Dr. Soup
10-06-2003, 10:38 AM
I have an application that I want to be able to run without the CD, but cannot.

The program does not use the GetDriveTypeA function, or any GetVolumeInfo type calls.
I've run RegMon and FileMon with it and it doesn't access anything in the registry and none of the file accesses raise any flags. It installs no .ini-s or .dll-s.
I can't find the error message in the string or dialog references in WDasm32.
The program is installed on the computer, but requires the CD to run.

I'm basically only using WDasm32 for this, because SoftIce isn't working on my computer, and I am doing this at work, so i don't have a whole lot of time to screw around with trying to get SoftIce running properly.

I've done some basic reversing so I do have some idea of what to look for, but here I am just drawing total blanks. It looks like I am on the completely wrong track. Can anybody give me any ideas of where to start with this one?
Woodmann
10-06-2003, 05:21 PM
Howdy,

Prolly a protected disc. You dont say if you have the reg code/serial so,
we may need that to continue.

What kind of app's need to have the CD ? Map softwares ? Phone listings ?

Woodmann
dELTA
10-06-2003, 06:22 PM
Current CD-protections are eons beyond the good old GetDriveTypeA/GetVolumeInfo ones (aah, those were the days...). Today they're right up there with the meanest packers, if not even worse... :eek:

Of course there might still exist easier ones today too, like on some low-budget titles like e.g. such ones as Woodmann mentions, but just so you are prepared for the worst... ;)
Aimless
10-07-2003, 12:09 AM
Hi,

Welcome to the messageboard. You'll learn a lot of tricks here, so I hope you keep coming back for more.

I am going to address only the lack of error messages that you have encountered while using the protected application.

1. Some History: Originally, windows was 16 bit. All messages were stored in the executable or external files in normal ASCII. Then came the OS expansion, where ASCII was not enough. Therefore, UNICODE came into picture (you need to understand the difference between UNICODE and ASCII - look up some documentation). Wdasm32 belongs to pre-UNICODE era. It will not be successfully able to read unicode strings (in fact, they do not even exist as far as Wdasm32 is concerned). You can try loading some plugins for wdasm32 from www.programmertools.org, but I doubt they will assist very much.
Solution: Go to www.sysinternals.com and grab the small programs called strings.exe. It will list all unicode and ascii strings in all files in all subdirectories (useful, because you do not know where the protection lies)

2. Some Tricks:
2.a. Trick No. 1: Instead of putting an error message in the initial program, the ascii values in hex are there. So, even if you search the files, you will not find it. An example:

OLD STYLE (easily searchable)
if bad_guy
then messagebox "Put CD rom"
endif

NEW STYLE (difficult)
m1 = ASCII(36) // which is actually 'P'
m1 = m1 + ASCII(67) // which is actually 'u'
....
m90 = m89 + ASCII(6F) //which is 'm'
if bad_guy
then messagebox m90
endif

2.b Trick No. 2: Instead of putting an error string in unicode or ascii, its encrypted. Difficult, but not impossible. (Requires you to pinpoint the decryting routine - of course there is one, else no one would be able to read the messagebox)

3. Some Protections: If I were a big shot gaming/application organization, I would simply go out and purchase for big bucks programs like CD-Cop, Safedisc, Laserlok, etc. Tough to break, but once broken, can be used endlessly on any CD protected with this program. The most difficult to break.

As you see, these are but some of the tricks used to protect the CD-ROM. And oh yes, just because a file (using filemon) is not called .INI or .CFG does not mean its unimportant. Sometimes even the .TMP files are protections (like in older versions of Wdasm32).

And yes, get SoftICE to work. You will benefit a lot from it. I'd suggest you concentrate more on learning and mastering the tools, then crack. And yes, its really a good idea to break older protections first (though not absolute necessary)

Have Phun


Armadillo help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo help
PDA

View Full Version : Armadillo help

bedrock
10-07-2003, 05:03 AM
I'm trying to unpack a target which is protected with Armadillo 2.60 beta 1 according to peid.

First off i ran target through dillodumper, it creates a dump and i fix IAT with imprec, but target does not run. so now i am at point where i must learn why it's not working.

I have gotten hold off Ricardo tutes and following them through, now i find a strange thing. I set bp WriteProcessMemory and according to Ricardo i expect to land where arma is about to copy a decrpted block to child process, but instead of block that is 1000h bytes in size, aram is only copying 2 bytes, it is writing to entry point of protected file (not OEP of unpacked child), but to child process, it is writing EB FE, ie jmp eip.

So i tihnk, i will run till next break on WriteProcessMemory, next break is writing back 55 8B to where it had just written EB FE, so it must start writing decrypted data soom, but next time i run, i no longer hit anymore breaks on WriteProcessMemory. This is strange, i look at protected target in IDA, and i clearly see 3 references to WriteProcessMemory, 2 ref's only write 2 bytes, the 3rd is the one i want, which writes 1000h bytes, but i can not break on this?

--
bedrock
nikolatesla20
10-07-2003, 07:02 AM
hmm.

Does the program create two seperate processes when it runs? If so, then it's protected by CopyMEM and will act as you describe..so make sure it is.

Dillodumper really only works on 2.65 (I think) or 2.75 (for sure!) to 3.01a.

You said the program wont run - what exactly happens? Do you get a clean IAT? How about OEP? Does it look correct?

One more thing: Is the program written in VB?

-nt20
bedrock
10-07-2003, 08:28 AM
nt20,

Yes there are 2 seperate processes when it runs.

The dump fails to run by crashing with an 'unhandled exception in dumped_.exe (NTDLL.DLL): 0xc0000005: Access Violation'

OEP and IAT look correct as far as i can tell, app if an MFC dialog app, not VB.

--
bedrock
squidge
10-07-2003, 03:56 PM
nt20,

Yes there are 2 seperate processes when it runs.

The dump fails to run by crashing with an 'unhandled exception in dumped_.exe (NTDLL.DLL): 0xc0000005: Access Violation'

OEP and IAT look correct as far as i can tell, app if an MFC dialog app, not VB.

--
bedrock

It may be that the app is simply protected by Debug Blocker (which only calls WriteProcessMemory twice), and not CopyMem-II (which calls WriteProcessMemory for each 4096-byte chunk requested by the protected application).
bedrock
10-08-2003, 10:43 AM
Exactly as Squidge has hinted here and talked about quite a bit on this other thread (sorry i didn't find this before)

http://www.woodmann.net/forum/showthread.php?t=4836&highlight=armadillo+debug+blocker

I have read ricardo's tut's but I am still having problems. My target does indeed only appear to be protected with Debug Blocker and not Copymem II, i would of thought that this would of made it easier for me to get a working dump, but still no joy :(

Also there doesn't seem to be any sign of nanomites, but my dump crashs with unhandled exception when trying to access invalid memory location.

I have packed some known apps with Arm 2.60c (closest i can find to 2.60 beta1 at the moment) and verified that i have correct OEP (also same OEP as dillodumper finds) and i have gone through IAT but cant find problems.

Anybody got any more ideas on what i can try to get a working dump?

--
bedrock
nikolatesla20
10-08-2003, 01:29 PM
One other thing I can think of is to perhaps check the IAT Section itself, in the PE header, to make sure it has write permissions. YOu can do this with LordPE or PEditor, just look at the section's characteristics. Being that the crash appears in NTDLL.DLL this could be the problem (the windows PE loader tries to access the IAT and doesn't have write permission) The easiest thing to do is just set characteristics for all sections to be writable, since you may not know for sure which is the IAT section.

The other thing also, is that the program is most likely dumped fine, but it tries to use one of Armadillo's environment variables, and since it's not there anymore, the program crashes.

Can you disassemble the program ok with windasm? If so, it means the PE file structure is correct and should work. Then search for any string references the might be armadillo environment variables, such as DAYSINSTALLED, etc.

"Unpacking", or dumping, the program, is really only the first step. Some targets still need some work afterwards. If you know the OEP is good, and the IAT looks right in ImpREC, then the problem is most likely something like I stated above.

-nt20
bedrock
10-09-2003, 02:45 AM
I check the PE header section characteristics, cant find any problems?

I can disassemble the dump using IDA fine and there are references to arma environment vars, but my dump never get's this far. My target comes as a 10 use trial version, as a temory solution i have tracked down the relavent registry and .tmp files to remove to reset the trial.

When i execute my dump and step through with olly, i get past the normal stuff at OEP, like GetVersion and GetCommandLineA etc... and eventually get to this code:

00417188 56 PUSH ESI
00417189 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
0041718D 3B7424 0C CMP ESI,DWORD PTR SS:[ESP+C]
00417191 73 0D JNB SHORT Dumped_.004171A0
00417193 8B06 MOV EAX,DWORD PTR DS:[ESI]
00417195 85C0 TEST EAX,EAX
00417197 74 02 JE SHORT Dumped_.0041719B
00417199 FFD0 CALL EAX ;Dumped_.00415C95
0041719B 83C6 04 ADD ESI,4
0041719E ^EB ED JMP SHORT Dumped_.0041718D
004171A0 5E POP ESI
004171A1 C3 RETN

My assembler isn't brilliant and i don't really know what this is doing, each time round EAX contains a valid adress within the dump, i thought it might be something like the MFC message map possibly, but eventually it will execute a CALL EAX and land here:

0043261F E8 72A50000 CALL Dumped_.0043CB96
00432624 8B4C24 04 MOV ECX,DWORD PTR SS:[ESP+4]
00432628 85C9 TEST ECX,ECX
0043262A 8848 14 MOV BYTE PTR DS:[EAX+14],CL <---- CRASH
0043262D 75 08 JNZ SHORT Dumped_.00432637
0043262F 6A FD PUSH -3
00432631 E8 E255FEFF CALL Dumped_.00417C18
00432636 59 POP ECX
00432637 6A 01 PUSH 1
00432639 58 POP EAX
0043263A C2 0800 RETN 8

At the point above i've marked CRASH, CL contain 0 and EAX contains a memory address we cant write to, game over.

--
bedrock
bedrock
10-09-2003, 10:35 AM
Hmmm, well i have some news to report, i have now got a working dump, but i still dont understand why? I am hoping someone can help my learn why.

First off, i must say a big thanks to Lunar_Dust (and nt20 ;) ) I have gone back to older dillodumper (2.34 i think, a version that has lunars own IAT rebuilding code) with this version i have made a working dump, so all along dump was good and OEP was good, but the difference is the IAT, all function pointers in Lunar's IAT and ImpREC's IAT are same? but difference seems to be to do with Original First Thunk's, this is something i am still learning about.

If i look at import directories in lordPE, my non working dump (IAT fixed with ImpREC) has Original First Thunk as 0x00000000, and Thunk RVA as 0x41000 (this is address dillo told me to enter in ImpREC)

If i look at import directories for working dump i see Original First Thunk as 0x001045f1, i dont know this address, but obviously Lunar does?

I had looks at nt20 First Thunk Rebuilder program long ago, but i tried download link this afternoon and it wasn't working, i need to do some more searching, but i wanted to report what i was finding.

--
bedrock
nikolatesla20
10-09-2003, 12:59 PM
Hmmm, well i have some news to report, i have now got a working dump, but i still dont understand why? I am hoping someone can help my learn why.

First off, i must say a big thanks to Lunar_Dust (and nt20 ;) ) I have gone back to older dillodumper (2.34 i think, a version that has lunars own IAT rebuilding code) with this version i have made a working dump, so all along dump was good and OEP was good, but the difference is the IAT, all function pointers in Lunar's IAT and ImpREC's IAT are same? but difference seems to be to do with Original First Thunk's, this is something i am still learning about.

If i look at import directories in lordPE, my non working dump (IAT fixed with ImpREC) has Original First Thunk as 0x00000000, and Thunk RVA as 0x41000 (this is address dillo told me to enter in ImpREC)

If i look at import directories for working dump i see Original First Thunk as 0x001045f1, i dont know this address, but obviously Lunar does?

I had looks at nt20 First Thunk Rebuilder program long ago, but i tried download link this afternoon and it wasn't working, i need to do some more searching, but i wanted to report what i was finding.

--
bedrock

Ah, I have some info. Firstly , whenever I've used ImpREC, its actually rebuilds the FirstThunk table, and not the OriginalFirstThunk table. The "FirstThunks" are the actual thunk RVA's that will be used by the PE loader. The "Original First Thunks" is a backup copy that the loader will use first if it sees an entry. Dillodumper's IAT engine, at its time, rebuilt the "Original First Thunks", and would leave the FirstThunks table alone.

So here this might be a problem however, the dump will work, since the FirstThunks are valid (since DilloDumper disables Import Redirection), so when the program is dumped from memory all the FirstThunks are actually hard addresses to the API functions already. Which means the program will run, but it might not be portable to other windows boxes. However, if the Original First Thunk table is there, the PE loader will usually load that first, so if the file's working now, it's probably correct...

Well, anyway, funny how an older version of DilloDumper actually worked better - haha..the IAT support was pretty good, it just had some bugs that would crop up now and then and hose everything. Basically, Lunar told me that the biggest problem was handling all the nuances that imports can have, for example, forwarded imports, import by ordinal, etc. Forwards were the biggest problem. So the IAT engine usually would work fine on most common files, but still had some problems with small files, or files that used special DLL's.

Another note: The FirstThunk rebuilder will only work if you have an OriginalFirstThunk table present (like, for example, a program fixed with Revirgin or with DilloDumper). It won't work on ImpREC'd programs, because ImpREC already fixes the FirstThunk table itself.

-nt20
evaluator
10-10-2003, 02:22 PM
I describe this problem so:
Under Xp(or w2k?),
Even if OrigFirstThunk presents, FirstThunks must NOT be Null;
or NTDLL will crush.


Crack for $
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Crack for $
PDA

View Full Version : Crack for $

mike
10-07-2003, 05:57 PM
At least $250:
http://www.hackerwargame.org/
Zero
10-07-2003, 11:32 PM
I really think this is not crack for $. It is more hack for $. A small difference but a difference...


CrapKey new version
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CrapKey new version
PDA

View Full Version : CrapKey new version

peterg70
10-08-2003, 05:26 AM
Anyone have something protected by crapkey latest version?

Haven't seen much of this since v5.7.

Too easy or just not much out there.

Peterg70
JMI
10-13-2003, 10:18 PM
Link to warez commercial software has been deleted and was a clear violation of the Rules.:mad:

You should have noticed that peterg70 asked for a link to "something protected" by the software, not the software itself.

tulipfan: Make sure that this does NOT happen again.

Regards
esther
10-13-2003, 10:21 PM
Thanks ;)

This is not the first time he post this kind of shits

cya ;)
JMI
10-13-2003, 10:21 PM
It WILL be the last.

Regards.
peterg70
10-14-2003, 07:44 AM
@JMI
You were right I wasn't after the SDK and thanks for deleting it. I think people should use some knowledge to find things on the Web. Although I did give out some hints last time people were begging for the SDK. Plus the link was to the old version anyway since 6.1 is out now.

Anyway I see that no-one has yet to see an implementation of crapkey. Could they be loosing business. Even the software I had protected with crapkey has changed to a new encryption system (homegrown) rather than upgrade.


DilloDumper error?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DilloDumper error?
PDA

View Full Version : DilloDumper error?

dlt_
10-08-2003, 06:31 PM
I have a target file and when I run DilloDumper, I get this:

Loading victim process...
Error 3200

What does this mean? Can this target file still be dumped? If so, how?
JMI
10-08-2003, 07:23 PM
READ the FAQ, linked at the bottom, then do some of your own homework, such as searching this Forum for information on Armadillo and THEN come back, show some of your OWN work and ask a question that shows something other than than you want someone to GIVE you a way to remove the protection from your TARGET.

Regards.
Lunar_Dust
10-09-2003, 01:17 PM
JMI: While I agree with you that ppl should search the board and learn on their own, I think this is a valid question....

First off, I put numerous error codes throughout DilloDumper, instead of using error strings, to help keep Chad and his buddies from figuring out what DilloDumper was doing. The error codes are completely random and have no pattern. When I encounter an error, I simply look thru the source code to find it.

Error 3200 means DilloDumper had a problem with it's CreateProcess hook for some reason. Chances could be that the file is not protected with CopyMemII or Debug-Blocker (in other words, its just standard protection). Best way to check is if the program has two instances running in the Task Manager. If so, it IS using Debug-Block at least.

Other than that, I don't know what else would create this failure, except an incorrect IAT table read, etc, etc.

I am hesistant to release error codes for DilloDumper since it reveals DilloDumper's method of gaining access to the protected application.

-Lunar
Hopcode
10-15-2003, 05:55 AM
JMI: While I agree with you that ppl should search the board and learn on their own, I think this is a valid question....

First off, I put numerous error codes throughout DilloDumper, instead of using error strings, to help keep Chad and his buddies from figuring out what DilloDumper was doing. The error codes are completely random and have no pattern. When I encounter an error, I simply look thru the source code to find it.

Error 3200 means DilloDumper had a problem with it's CreateProcess hook for some reason. Chances could be that the file is not protected with CopyMemII or Debug-Blocker (in other words, its just standard protection). Best way to check is if the program has two instances running in the Task Manager. If so, it IS using Debug-Block at least.

Other than that, I don't know what else would create this failure, except an incorrect IAT table read, etc, etc.

I am hesistant to release error codes for DilloDumper since it reveals DilloDumper's method of gaining access to the protected application.
-Lunar

Hi lunar ! ;o)

I suspect they can reverse engineer it as well if they really need to.
I don't see much problems of releasing such error codes.

just my 2 cents.

HopCode.

btw, answer my email please :>
thematrix
11-05-2003, 04:28 AM
whats the error code 4404 in dillodumper means and why is it displayed 5-6 times on every target.exe win win xp?
nikolatesla20
11-05-2003, 07:59 PM
whats the error code 4404 in dillodumper means and why is it displayed 5-6 times on every target.exe win win xp?

Are you sure it's not error 4444?

error 4444 means that DilloDumper couldn't repair the bad thunks in the IAT table. What it means is you should use ImpREC to look at the IAT, just as usual, and then cut out the bad thunks yourself using ImpREC. The whole IAT will be correct, it will just have bad thunks in between DLL's.

-nt20
thematrix
11-06-2003, 03:47 AM
here is the screenshot with dillodumper 2.55(i have got this version onyl but looking hard to get 2.80 after reading on the forum. but till now no success)
http://www.geocities.com/thematrixzone2002/dillo
and click these images
dillodumper.jpg
imprecdillodumper.jpg(screenshot of imprec)
imprecdillodumper2.jpg(screenshot of imprec)

and with dillodumper 1.8 more promissing but still the dump.exe after using imprec was corrput(errors) even after on errors in imprec

http://www.geocities.com/thematrixzone2002/dillo/dillo18
nikolatesla20
11-06-2003, 11:08 AM
here is the screenshot with dillodumper 2.55(i have got this version onyl but looking hard to get 2.80 after reading on the forum. but till now no success)
http://www.geocities.com/thematrixzone2002/dillo
and click these images
dillodumper.jpg
imprecdillodumper.jpg(screenshot of imprec)
imprecdillodumper2.jpg(screenshot of imprec)

and with dillodumper 1.8 more promissing but still the dump.exe after using imprec was corrput(errors) even after on errors in imprec

http://www.geocities.com/thematrixzone2002/dillo/dillo18

Sure enough, those first screenshots in ImpREC with 2.55 look like what will happen when you get a 4444 error. What you need to do is expand each of those trees until you find some valid imports. Once you find them, you'll see that all the imports are there but every so often there's a bad thunk. All you need to do is trim this bad thunk out by using "Cut thunks". Then ImpREC will see the whole DLL correctly. Normally DilloDumper tries to clean these thunks.

However, I think I see the REAL problem: DilloDumper doesn't know where your IAT table is! See it says in the output window that the location is zero. So my guess is that this is either a VB program, or a delphi program. VB programs ALWAYS give dillodumper problems with the IAT.

If it is a VB program, be assured that the IAT is CORRECT AND VALID in memory, you just have to find it! That's why DIllodumper is giving 4444 errors, it's trying to access bad memory locations since it doesn't know the right location of the import table to begin with. You'll have to find it manually. If it's VB you'll have to do some more work. If it's another type of program just open it up in LordPE or PEditor and note where the ".rdata" or ".idata" section is, and start from there in ImpREC...

As mentioned before, sorry for the problems but even using DilloDumper you usually still have to do a few things by hand, it mainly dumps the program, building the IAT can still always be a tricky process hence it lets you have more manual intervention ...

One more thing, I see the program you are trying to unpack - I've tried this one as well and I've never gotten it work either. Haven't traced down why tho.

-nt20


ASProtect 1.23
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect 1.23
PDA

View Full Version : ASProtect 1.23

dlt_
10-08-2003, 10:07 PM
guys, i am new to this, have an target file that is protected by ASProtect 1.23. Is there an unpacker/decryptor public that works with this protection? Not sure if I could pull it off manaully, but if no public unpacker is available, is there a good tuturial for this version of ASProtect?
JMI
10-08-2003, 11:58 PM
It seems I'm writing this same message over and over the last couple of days to people who want someone to do their work for them before they have really tried to help themselves.

As I said to the others, what you need to do FIRST, is READ the FAQ to learn what you should do BEFORE you ask a question and then DO what you can to try to help yourself BEFORE you think about asking someone here to do your basic work for YOU.

The first question is what have you done to investigate YOURSELF, whether there are any unpackers or tutorials relating to this version of the protector? Have YOU done any searching here or anywhere for the answers to YOUR question, or have you just dropped in here hoping someone would help you not have to do ANY work yourself??? For example did you even notice and perhaps investigate that there is a thread down just a few lines from your own titled: "ASProtect 1.23 RC4 Demo." Do you recognize that it might have some information that might help you?

Learning to search is one of the most important skills you can master IF you are really interested in learning about reverse code engineering. Read my response to Mikeli in this thread: http://www.woodmann.net/forum/showthread.php?t=5051 and then substitute the word "Asprotect" for "armadillo" and you will find, yourself, more information than you will know what to do with.

You could also go to exetools forum and read up on the subject there.

You need to SHOW some thought, some effort, and some results of those two things, THEN ask a question and you will find people here ready and able to assist you. There is no one here who wants to simply do it for you. This is not a short or a simple journey. You shouldn't start down the path through the dark codewoods, unless you are serious and willing to work at it.

Regards.
Kayaker
10-08-2003, 11:58 PM
A little hint, the same advice given for your Armadillo question applies to Asprotect. Really, you'll learn a lot by searching on this board first, you'll be able to accomplish NOTHING without at least getting some background on it. Even if you don't understand everything people have been saying for all the uncountable previous posts, you'll at least get a feel for the scope of the problem.

And no, there are no magic pills or automagic unpackers and even if there were (are) you'd still learn nothing by pushing buttons blindly. Please, at least read and learn a bit first, then rethink what questions you really need to be asking. Don't worry, we've all been "new to this" at one time or another and if people are telling you to search and read and learn then there's a good reason for it, and is an important part of the answer you seek.

Kayaker

EDIT - lol, JMI and I posted the exact same sentiments at the exact same time. Hmm, we're either both full of shit or there's something to this searching business after all... ;)
JMI
10-09-2003, 12:03 AM
Or maybe BOTH!! :D

Regards.
Kayaker
10-09-2003, 12:06 AM
Or maybe BOTH!! :D

Regards.

THAT was taken for granted :p
dlt_
10-09-2003, 12:35 AM
sorry, i did find a tutorial for this, but had zero luck. i am just lost on this. maybe i can figure more out later. iwhat does EAccessVioaltion mean on an unpacked exe? I am just stuck...
squidge
10-09-2003, 03:16 AM
That error means that the unpacked program is trying to access some memory that is only available in the packed program, so is most likely tied to the packer code in some way - you'll have to find out where and remove the references and/or emulate the results (depending on what the program is looking for)

A quick search would have told you this...
dlt_
10-09-2003, 08:07 PM
i found and followed a tutorial, but still no luck on my end. i reran pe-id, and i get it is protected with: ASProtect 1.22 - 1.23 Beta 21 -> Alexey Solodovnikov. So, I would like to do this on my own, but can not find a tutorial I can follow, as some of this just seems like a foreign language. I am using OllyDbg, so if there is a tutorial with this, please help me finding it. I tried one intended for 1.23, not sure if this is more based on 1.2 or what. I am just having probelms deciding what the OEP is I guess.
Woodmann
10-09-2003, 08:48 PM
Hi,

You are having more problems beside finding OEP.
You need to go to Krobar's site (link below) and find
some beginner tutorials concerning Aspro.

Woodmann
dlt_
10-09-2003, 09:02 PM
will this method work? i scanned file in studpe and came up with asprotect 1.2x [new strain] let me know what you guys think.
Manko
10-12-2003, 07:11 AM
Hi!

That tut deals with apps protected with older version of asprotect...
(Though most info is good for something and will get you nearer the goal.)
There are better tut's if you want to deal with old aspr.

And searching this forum, you will find MUCH info on aspr... Even some
suggested targets that I think still uses old version... All info combined here, though old, will be of much help I think...

Also... It might be, You also need more experience with simpler things?

You could PM me, and I'll take a look at the target...

/Manko

will this method work? i scanned file in studpe and came up with asprotect 1.2x [new strain] let me know what you guys think.
dlt_
10-15-2003, 11:05 PM
manko, i pm'd you, please get back wit me..

Hi!

That tut deals with apps protected with older version of asprotect...
(Though most info is good for something and will get you nearer the goal.)
There are better tut's if you want to deal with old aspr.

And searching this forum, you will find MUCH info on aspr... Even some
suggested targets that I think still uses old version... All info combined here, though old, will be of much help I think...

Also... It might be, You also need more experience with simpler things?

You could PM me, and I'll take a look at the target...

/Manko


"SunnComm to sue 'Shift key' student for $10m"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > "SunnComm to sue 'Shift key' student for $10m"
PDA

View Full Version : "SunnComm to sue 'Shift key' student for $10m"

disavowed
10-09-2003, 04:14 PM
http://www.theregister.co.uk/content/6/33322.html
asmworkshop
10-20-2003, 11:43 AM
http://www.theregister.co.uk/content/6/33322.html

..... company said today it will take legal action

*legal actions* yeah right


Be Back
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Be Back
PDA

View Full Version : Be Back

ECO
10-09-2003, 04:50 PM
Hello!
Thanks all Admins for help.
I be Back Thank You
MFG
ECO
dELTA
10-10-2003, 05:25 AM
Wtf? :)
naides
10-10-2003, 06:39 AM
Sounds like a cryptic threat to me
dELTA
10-10-2003, 06:50 AM
Yeah, I agree, when something doesn't make sense (or just has bad grammar :)) it's always safest to assume it's a threat, and act accordingly. ;)
esther
10-10-2003, 12:38 PM
Yeah, I agree, when something doesn't make sense (or just has bad grammar :)) it's always safest to assume it's a threat, and act accordingly. ;)

Another Evaluator :D
Woodmann
10-10-2003, 04:10 PM
Another Evaluator :D

BAHAHAHAHAHAHAA

Ya'll need to stop smoking the weed.
Your getting paranoid.

Woodmann
JMI
10-10-2003, 05:07 PM
Just because we're paranoid, doesn't mean that they are NOT out to get us. :D

Regards.
dELTA
10-11-2003, 02:56 PM
You seem to know an awful lot about this whole "out to get us" business JMI, just a _little_ too much I'd say... I can only conclude that you're an evil spy, sent out to infiltrate us and execute ECO's insidious masterplan! Everyone, get him! :D

(and for christ sakes will everyone stop these ridiculous accusations about us being paranoid :p)
JMI
10-11-2003, 04:04 PM
Memo to self:

1.) Add dELTA to list of those WE have to get. !!!!
1b.) Remove dELTA from list of those we have to get [to fool those already suspecting us].
1c.) Send candy and flowers to dELTA [filled with undetectable deadly potions].
1d.) Expose all my undercover fellow spies [as having worked for dELTA].
1e.) Dance naked through city streets [again to bolster my insanity defense].
1f.) GOTO 2.).
2.) Get dELTA.!!!!
3.) Deny we are trying to get or got dELTA!
4.) Get all those who took dELTA's advise about getting me!!!
5.) Deny any knowledge about any plot to get them.
6.) Deny I wrote this, use disappearing ink!!!
7.) Business as usual here at the funny farm.

Regards. :cool:
dELTA
10-11-2003, 06:14 PM
Memo to self:

1.) Send fan mail to the guy who implemented the feature for admins to be able to edit all posts, which was JMI, so he could get EVEN.
2.) Encourage more people to write memos to themselves in places where I can edit them.so they can edit my responses as well
3.) Execute full scale cover-up of the fact that super moderators can also edit all posts, [oops, too late, gasp, those candies were poisoned ....... [dying last words removed due to lack of interest.]

:D
Woodmann
10-11-2003, 06:29 PM
That is just shameless :D Apparently, I have no other choice but to fire dELTA :p
dELTA
10-12-2003, 07:38 AM
You've made the right choice boss I don't even know the difference between megabytes and gigabytes. :D
esther
10-12-2003, 12:41 PM
Fired JMI
Fired Zairon
Fired Woodmann
Fired delta
Fired KayaKer
Fired Mike

:rolleyes:

Thanks for reminding me delta :p
dELTA
10-12-2003, 02:38 PM
So, Mike and Kayaker get to stay huh? I think this makes it pretty apparent that esther, Mike and Kayaker are the real undercover evil spies, and that JMI's and mine act was successful in exposing them! Everyone, get them! :D
JMI
10-12-2003, 03:27 PM
Ssshhh:

They don't know that they are really working for me. Don't breath a word. ;)

Regards.
evaluator
10-13-2003, 05:05 AM
JMI,

little Q:
Are you married?
dELTA
10-13-2003, 07:18 AM
Wtf, seems we've been infiltrated by agents from a dating service too! :D

(Why would you want to know that?)
nikolatesla20
10-13-2003, 07:34 AM
I've just now inserted a I.E. exploit javascript into this message, and stole your cookie. Now I can log on as you. So, who really now is the real dELTA? Or JMI? hehehe.

Oh yeah, and I'm celebrating my 400 post anniversary :D

-niko
dELTA
10-13-2003, 08:11 AM
Congrats on the anniversary niko. :)

PS.
Javascript and HTML is filtered away in board posts. :cool:
nikolatesla20
10-13-2003, 10:43 AM
Usually filtered out. But I found an exploit in the VBulletin code which allows me to get around it :P

-nt20
JMI
10-13-2003, 11:30 AM
Why evaluator is this a proposal? :p This is so sudden. We hardly know eachother. We've never even dated. :confused:

Would it make any difference if I've been married longer than you've been alive?

dELTA, Have you noticed that I can even posting as nikolatesla20 now. :D

Regards,
dELTA
10-13-2003, 11:42 AM
None of eval's dates ever understand a word of what he's saying anyway, so he's been skipping that phase lately to make the process a little bit more efficient. :D

And JMI, maybe it was me who posted as eval to ask about your marital status? :p (even though I'm already quite familiar with it, and of course also already engaged to a certain other girl ;))
esther
10-13-2003, 11:49 AM
Fire all trolling ppl :eek: :p
evaluator
10-13-2003, 03:02 PM
ok, i'm opening source..

am interesting about JMI s_x-orient.
So are you norm?
dELTA
10-13-2003, 04:01 PM
What the hell?! :p This is just getting more and more weird... With risk of repeating myself, why the hell would you want to ask THAT? :confused:
JMI
10-13-2003, 04:34 PM
I personally left the "Orient" in 1972, but the war went on without me for three more years. We still lost, no matter how many times I tell the story.

Maybe Eval is interested in starting a private club for like minded people? Who can tell? So Eval are you "looking" for someone? I am advised that there are places on the Net where one can meet people of almost any "orient." Try searching, although I'm not sure "s_x-orient" would be helpful in that effort. Would you like us to start a "Personals" Forum here for you, so you could meet someone you would find is "norm"?

Maybe you should define what you mean by "norm." It's definately "not-norm" in this country and at this point in time that I could have been married longer than you have been alive. And although both parts of that statement are true, it doesn't really answer you question, does it. :cool:

Regards,
Woodmann
10-13-2003, 04:47 PM
This is a most entertaining thread :D
dELTA
10-13-2003, 05:45 PM
If only ECO would have known what his questionable english grammar would lead to one day, I'm sure he would have studied much harder back in school... :D
evaluator
10-14-2003, 08:42 AM
The fact of need in a definition of norm., settles my question.
And please, do not hang up your dreams (clubs & etc.) on me.

***The A-of-D!***
dELTA
10-14-2003, 10:25 AM
Eval, if the need for definition of words in your posts would have similar implications regarding sexuality for all members of this board, we'd all be prancing around holding hands a loooong time ago I can tell you... :D

And I still can't understand where you're going with this, or why?
JMI
10-14-2003, 01:20 PM
Why Eval, I have not "hung up my dreams on you." I don't dream about you at all. :p Whether or not you presume to answer your own question based upon speculation and assumption is of no importance to me and your privilege.

I asked you what "your" definition of "norm" is because you asked if "I" was "norm." "Norm" in that context is a subjective word based upon the questioner's point of view. To answer that question "I" need to know how "you" define "norm."

After all, you are the one who has chosen an avatar which is a little girl in pigtailes and a dress,watering flowers. Is this "your norm"? Should we "assume" from this that you are:

a: A little girl who likes to water flowers.
b: A young man whose "orient" is confused.
c: That you have poor taste in avatars.
d: That you have good taste in avatars.
e. Fond of the picture.

Or should we assume nothing at all, until we have "evidence" upon which to form a reasoned conclusion? What we can already conclude from the "evidence" is that "you" have some "issues" with "orient." That also is your privilege and your problem. :)

Regards.
evaluator
10-14-2003, 01:48 PM
JMI,

With each post you look worse, increasing suspicions!
Now you (old man!?) try to interpret the little girl in sexual aspect!!
Hm!?????

deLTa,
wait little..
JMI
10-14-2003, 02:28 PM
Eval:

Again you "project" your views on to others.

Where is the "sexual aspect" of describing the picture as "a little girl in pigtails and a dress, watering flowers?" I demonstrated "assumptions" that could (improperly) be made about "your" choice of the picture. Only "b." has a sexual aspect, but it was about “you,” not the “little girl.” That “sexual aspect” was that “you” (might be) "A young man whose "orient" is confused." That I suggest one could make (unsupported) assumptions that "you" might wish to be a little girl watering flowers has no “sexual aspect.” That I suggest one could make (unsupported) assumptions that "you" might like to think about wearing dresses, or have doubts about your masculinity does not relate to the little girl, other than “it was your choice” to “identify” yourself with that particular picture.

Your move. Assume some more and project what you will. Answering unfounded assumptions and allegations is what I do for a living. If you can call this living. :cool:

Regards.
evaluator
10-14-2003, 03:02 PM
deLTa!

>>And I still can't understand where you're going with this, or why?

this happens, more then 500 views for this thread!
Would you like up to 600.. ~:0
mike
10-14-2003, 03:04 PM
You mean eval wasn't asking about the normalised eigenvalue of spin when measured in the x direction?!

I can never understand what he's talking about...
Woodmann
10-14-2003, 03:13 PM
I am scared,

I DO understand him :eek:
JMI
10-14-2003, 03:38 PM
I can report, based on reliable "evidence", that Woodmann is "oriented" on the east coast and rides a bike when he can (no, no, the kind with a motor.) (Shameless effort to get my post count back even with his.) :D

Come on Eval, let's keep those views coming. Whip me, hurt me, make me write bad checks. :cool:

Regards.
dELTA
10-14-2003, 04:15 PM
Damn you blabbering bastards, I'll never get any closer to your postcount if you keep this up, not even with mindless talk about motorcycles. ;)
evaluator
10-15-2003, 07:08 AM
deLTa,

please, explain, when you wrote:
>Damn you blabbering bastards..

you include me in this term?

---
JMI,

because I do not feel any entertainment from game with 'those',
I advise you to declare your s_x-orient;
indirectly you done, but I dislike to make indirect conclusions.
dELTA
10-15-2003, 07:35 AM
>> Damn you blabbering bastards..
>
>you include me in this term?

I include everyone with a higher postcount than me, and then some. :p

(and for further explanation, if needed: it was a joke :rolleyes: )
JMI
10-15-2003, 01:30 PM
Eval:

Thank you so much for your advise. It helped me alot. :) However, I've already told you that your conclusions on this subject, direct or indirect, are of no importance to me. You are free to conclude anything you wish and it will not change the world, here or in the "orient," in any manner at all.

While I am happy to debate any "evidence" you may think you have, I have no need nor penchant to "kiss and tell" and consider it an exceedingly impolite and immature action for people of any "orient."

It's also not my job to entertain you, but merely to attempt to point out the errors of your logic. :D

Regards.
evaluator
10-15-2003, 03:43 PM
mon JMI,

As I cannot find any Logic in my puzzy sarcasms,
I am pleasantly surprised with Logic-Errors found by you :)

"It is difficult to catch a black cat in a dark room,
"especially if that is absent!"

but you did it :)

For final lesson:
at least try to identify girl..

Bye.
UrgeOverKill
10-15-2003, 05:42 PM
this is a most entertaining thread........(gettin me some popcorn for this)
nikolatesla20
10-15-2003, 06:57 PM
It's Bubbles from PowerPuff Girls.

PowerPuff Girls ROCK!!!

-nt20
JMI
10-15-2003, 07:12 PM
Well looks like I'm too late to win the prize. Today was the last day for those of use in the good old US of A to complete our Tax forms and pay our Taxes, so that our government could share the meager fruits of my labors with those around the world. Nikolatesla20 posted the answer just before I got back from the post office, waving good-by to my hard earned money. :p

Bubbles, it is and we still do not have the answer from Eval as to why she was chosen as his avatar, which is a totally different question than whatever his "orient" might be. :D Heck, we don't even know why he prefers to compose dissonance music. Could he not be in "tune" with himself? Or is "he" a "she"?

Questions, Questions, no one can tell the "orient" without a program guide. Get your programs here, only one unpacked PE for a program. :cool:

Regards.
Woodmann
10-15-2003, 08:29 PM
Errrrrrrrrrrrr........

So we seem to have a few things in play here.

JMI's "orient" Oh shit.......I'll just say it, his sexual orientation.

Eval's choice of avatar.

Now, for some reason Eval questions JMI's sexual orientation
while JMI seems to have some kind of a "thing" for Eval's avatar.

I have no friggen idea how this thread wound up at this point.
I do know that JMI is married (to a woman), and a crusty old bastard.
I also know he loves his child/children. I know other things but
I do not think they have any bearing on his orientation.

Eval on the other hand, I know nothing about. I had heard a rumor
a few years ago that there was a very capable female reverser that
was a "regular" on the messageboard.
I am fairly confident it is NOT esther. Although I do not recall esther
ever offering an explanation as to that choice of a name, only that he
kept asking why everyone thought he was female :rolleyes:

So, with that being said, this still makes no fucking sense :D

Woodmann
mike
10-15-2003, 08:45 PM
Woot! I've got a lower post count than dELTA!
dELTA
10-15-2003, 09:29 PM
And just exactly what the hell is that supposed to mean mike?! You want a piece of me, huh? :p

Btw, Woodmann, thanks for the recap of the thread (and the board history) so far, and for introducing several new and controversial potential subjects for conflict in this our new favorite RCE-board soap thread. :)
nikolatesla20
10-15-2003, 09:56 PM
Hail to the female reversers !!!!
JMI
10-16-2003, 12:05 AM
Well! Apparently I've been "outted" by Woodmann. I feel so "disoriented." :D I was beginning to fear Eval was about to label me homophobic. :p After all, I do live near San Francisco, where being married to a woman doesn't mean what it used to. :p And esther did have a motto which read "I'm a bitch" until I pointed out that implied "esther" WAS female. :cool:

And I don't have a "thing" for Eval's avatar, I only pointed out that it was an unusual choice for someone who might question someone else's "orient." Mostly I would assume it was age inappropriate.

I actually enjoy and admire Eval's cryptic efforts at humour in another language. My own in German and Vietnamese are not nearly as understandable. Mastery of the idiom is the most difficult part of language skills. Much of the time, if one only looks at the literal words, they make little sense.

I am reminded of a song from the movie "South Pacific," (from before most of you were born, when they actually had movies that were filled with singing) that illustrates that concept and fits with the general tenor of this silly thread. :) It was titled: "I'm gonna wash that man right out of my hair." (No it was sung by a woman.) Literally, the words make no logical sense, but English speaking people understand what it means. The same is true for all languages. The difficulty is in the translation from one to another.

Regardless what language Eval speaks, there is no question that Eval's skills at unpacking are definately "oriented." This take both skill and patience. Just like getting flowers to grow. :D

Regards.

P.S. to Wood: I have a copy of my parient's marriage license, and it was issued more than three years BEFORE I was born. nanner, nanner. :p
mike
10-16-2003, 12:07 AM
For final lesson:
at least try to identify girl..Does eval mean "at least try to identify [which reverser is a] girl"? "Bubbles" seems like too easy an answer (or at least an answer that won't keep the thread and paranoia going).
And just exactly what the hell is that supposed to mean mike?!It means that I do not qualify, under that particular definition, as an outspoken illegitimate child--though I have no doubt that others have me pegged as such under other criteria. :D
JMI
10-16-2003, 12:18 AM
One of the advantages that Eval has at concealment of gender is the cryptic nature (and length) of Eval's posts. Since there is no entended comments, it is easier not to slip in what might tend to be gender identifying usage. It also helps that Eval is writing in a foreign language. At least to most of us. :D

Regards.
evaluator
10-16-2003, 05:26 AM
nt20,

you guess PPG only using avatar or you look at another place?

ok, now for you another question:
Who is author of that phrase about cat?
(in my stupid re-re-transliation)

Q is for only nikolatesla20.
dELTA
10-16-2003, 07:38 AM
Since Nikola answered the question to JMI, it seems only fair that I answer the question to him. :p

The phrase "It is difficult to catch a black cat in a dark room. Especially if there is no cat there." is said to originate from the philosopher Confucius. There is also a very known quote from Charles Darwin related to the same thing, but he stole the main idea from Confusius: "A mathematician is a blind man in a dark room looking for a black cat which isn't there".

After that the quote strealing got completely crazy, and people started to use this phrase to compare whatever professions they could think of, here follows some examples:

- Psychology is trying to find a black cat in a black room.
- Philosophy is trying to find a black cat in a black room where there is no cat.
- Psychoanalysis is finding a black cat in a black room where there is no cat.

- Definition of a scientist: Someone who looks for a black cat in a dark room.
- Definition of a philosopher: Someone who looks for a black cat in a dark room where there is no black cat.

- Software engineering is like looking for a black cat in a dark room.
- Systems engineering is like looking for a black cat in a dark room in which there is no cat.
- Knowledge engineering is like looking for a black cat in a dark room where there is no cat and someone yells, "I got it!".

:)

PS to JMI:
Sorry for the miscategorization of you, I must have read the dates wrong on your parents' marriage license. I'd still appreciate if you could stop the babbling though, so I can catch up in postcount. :D
nikolatesla20
10-16-2003, 11:32 AM
I only had to look at the avatar, I watch powerpuff girls all the time, I like that cartoon..

As to other questions, I don't know myself, but Delta answered it nicely.

-nt20
esther
10-16-2003, 11:46 AM
LIAR LIAR

Um Wootmann :P

: only that he kept asking why everyone thought he was female

I never said why everyone thought I was coz I don't know

Only 2 guys were in doubt one PM me and the other was Hopblah can't remember his name and I remember you told him I'm not a Wotmann :DDDDDD

Why I choose this nick um its just a nick well who cares if its a male or female :eek:

I think you are referring nn :)

If my nick is Administrator does that mean I am? :p
JMI
10-16-2003, 12:17 PM
dELTA:

Brooks babble. I merely elucidate. :p And you wont catch up that easily. :D

Regards.
dELTA
10-16-2003, 12:58 PM
esther, you could always try to set your nick (or title) to administrator and see what happens... :) So yes, if your nick is administrator you probably are. :p
JMI
10-16-2003, 01:04 PM
Maybe we should get someone to identify dELTA's cartoon character, just to make the process complete. :D

Regards.
dELTA
10-16-2003, 01:31 PM
Yeah, to make sure I'm not oriented in the wrong direction without knowing it, or something like that. :)

But seriously, I think my avatar is just someone's freehand drawing, not being any official figure of any kind, but if anyone could prove me wrong it would just be interesting to know. :)
esther
10-16-2003, 01:31 PM
delta:
You ppl have done great jobs,no need an insane administrator :) :p
evaluator
10-16-2003, 01:32 PM
by looking at deLTa's avatar,
it is easy to guess that owner is dirti one..

***
1000 coming soon
...
dELTA
10-16-2003, 01:36 PM
delta:
You ppl have done great jobs,no need an insane administrator :) :p

Hmm, a compliment... Does that mean that you are really female and are coming on to me esther, or maybe even male, "unusually oriented" and coming on to me? :D (or maybe it just means that we're actually doing a great job, but that alternative isn't at all as interesting as the other two, so I refuse to believe it :p)
esther
10-16-2003, 01:38 PM
You=All moderators ;)
dELTA
10-16-2003, 01:42 PM
So, you're coming on to all of us, huh? Oh, you naughty bigamous boy (or was that girl?)... :D
esther
10-16-2003, 01:44 PM
LOL keep on dreaming :eek:
So, you're coming on to all of us, huh? Oh you naughty bigamous boy (or was that girl?)... :D
JMI
10-16-2003, 02:15 PM
dELTA:

Just what is that where the legs are supposed to be? And do you really think you can pad your post count this easily? You need serious posts.. like mine. :D

Regards.
esther
10-16-2003, 02:18 PM
JMI:

When a joke is beyond its not a joke at all :)
dELTA
10-16-2003, 02:40 PM
He doesn't have any legs because he's a magic cracker genie you know (and yes, it's a he, and he's straight as an arrow if anyone would happen to be in doubt). :D
Kayaker
10-16-2003, 02:55 PM
Funny how so much of the following description seems to fit so much of this thread and the people involved in it... (in a slightly different context)...:p
nikolatesla20
10-16-2003, 03:04 PM
This post is only here to get one post closer to Kayaker's post count.

Oh, and PowerPuff Girlz Rock!

-nt20
dELTA
10-16-2003, 03:41 PM
So Kayaker, you're accusing all us "regulars" of having "serious personal issues", huh? That seems to fit the description of a troll better than anything else said in this thread (ok, maybe except the stuff posted by eval :p)... :D
Woodmann
10-16-2003, 03:55 PM
When a joke is beyond its not a joke at all

Yep, and they pay you cash, which is just like money.
(Yogi Bera- AFLAC commercial)

:confused: :eek: :D
SpeKKeL
10-16-2003, 04:50 PM
Sjit,

I was expecting a thread about Arnold !!
(I'll be Back)
But they are talking about eval-things....

Spekk.
JMI
10-16-2003, 05:36 PM
Yogi Bera also said: "When you come to a fork in the road, take it." And a whole bunch of other memorable quotes. :cool:

And we know Kayaker is all wet, and doesn't know squat about Trolls, because dELTA has assured me that the Trolls he knows don't even like to hang out near water, which is the only place Kayaker ever goes. :D

Regards.
esther
10-16-2003, 08:19 PM
JMI:

*And we know Kayaker is all wet...

We don't,You make him wet.Thanks for telling us LOL :) :p
Regards.[/QUOTE]
Kayaker
10-16-2003, 08:20 PM
Darn lawyers and their inescapable double logic, you can't slip anything past them!
(I'm going to remember this thread if I ever end up on a witness stand ;)

I don't know, some wise trollmaster or perhaps Confuscious herself spoke those words once, and the parallels are frightening.

TRO**S disrupt, destroy or change newsgroups by -

Flooding by excessive posting
What's this, a race for 2nd place? :rolleyes: :D

Spreading rumours
More than a few, sadly all unsupported without pictures

Posting under many aliases...disguising their headers...disrupt, destroy or change to fit their own agendas
Only to the harmless few with the power to do so, the rest are repelled as vermin

Violating newsgroup policies
That's not even in the ballpark, but the damn fineprint will probably get you every time

As for attempting to divide and conquer...threaten and attack and all the rest, applicable to human nature on a daily basis and seen at all levels, moot point. The Ranting is not however...

...often have serious personal issues...

I wouldn't touch that one with any length pole :p
JMI
10-16-2003, 09:12 PM
Well. Not only has esther forgotten his/her old motto, (s)he has forgotten that Kayaker's old motto was "happy when wet." And if I remember my physiology correctly, only the females of the human species are described as being made "wet" in the manner that esther is apparently describing. Hum. esther!

Kayaker, on the other hand, is all wet from his chosen recreational activity, paddling upstream against a torrant of government B.S. :D I guess if I want to catch Kayaker's post count, I'll just have to change his in the back-up and then do a restore. Afterall, rewriting history is also what I do for a living. :rolleyes:

And Kayaker, let's not start raising issues about the length of one's pole. :D

Regards.
evaluator
10-17-2003, 07:44 AM
Kayaker, you attack me!?
Kayaker
10-17-2003, 03:04 PM
Kayaker, you attack me!?

No of course not Evaluator. Why on earth would you think that from anything I have ever posted ???
evaluator
10-18-2003, 05:04 AM
>>I don't know, some wise trollmaster or perhaps Confuscious
>>herself spoke those words once, and the parallels are frightening.

i thought "wise trollmaster" is written about me.
So?
dELTA
10-18-2003, 06:28 AM
That's good eval, just like I said at the beginning of this thread, if something doesn't make complete sense, it's always safest to assume it's a threat or an insult, and act accordingly. :p

PS.
Not to be rude or anything, but you ARE the wise trollmaster, sorta. :D
esther
10-18-2003, 08:27 AM
*trollmaster or perhaps Confuscious herself spoke those words once

You have "castrated" Confucious? LOL
JMI
10-18-2003, 12:06 PM
I understand that is was also Confucious who is credited with saying: "Woman who put man in dog house, probably find him in cat house." But I was out of town when he/she was supposed to have said it, so I can't confirm on personal knowledge. :D

Regards.
Kayaker
10-18-2003, 01:05 PM
>>I don't know, some wise trollmaster or perhaps Confuscious
>>herself spoke those words once, and the parallels are frightening.

>i thought "wise trollmaster" is written about me.
>So?

Nah, the whole thing was meant as a joke and nothing more, the cartoon itself is amusing and it was directed at nobody. I have no interest in or reason for attacking you or anyone else. That you think that anyone here is, I would tend to give people the benefit of the doubt before making assumptions, especially in a light-hearted thread.

Castrated Confucious? Now why couldn't Conphucious have been a female? We all know they're wise, warm and wonderful (uh, and wet..). Maybe the grizzled old man with the fumanchu mustache that everyone pictures had a wife who was the brains behind the operation...
evaluator
10-19-2003, 04:53 AM
Kay, your explanations looks very poor.

Now You try to hide your wide and far-reaching attacking plans,
which you have developed together with deLTa.

>some wise trollmaster .. spoke those words once.
I spoke it here, so.. try better explanation!

***The A-of-D!***

Click here for subscribe to wise-trolling courses!
Bengaly
10-19-2003, 09:17 AM
eval, how about signing a english course? ...
JMI
10-19-2003, 11:56 AM
I think Eval is just trying to get the view count up to 2000. :D

Maybe we could start wildly speculating as to the "real" meaning of the
***The A-of-D!*** Eval uses. I'll start off the first one:
***The Angel of Doom!*** :cool:

Regards.
esther
10-19-2003, 12:29 PM
***The A-of-D!***

the art of decryption? :)

or the arse of decryption :D

or the anger deepens :rolleyes:
JMI
10-19-2003, 01:59 PM
***The A-of-D!***

The Architect of Deception :p

The Archdeacon of Disassembly ;)

The Author of Dis-information :D

Keep those cards and letters coming.

Regards.
evaluator
10-19-2003, 01:59 PM
***The A-of-D!!!***
(The Aod :)

ya, not bad idea.
also I can support this competition with prizes like unpacked MMDWMX or other..

So for start we need some restrictions:
1. one user can 1 try.
2. user must be well-known.
{x. user must be NOTEPAD!!! ;}

So, JMI & esther failed.
"A" means art, so one word you need to guess.
JMI
10-19-2003, 02:05 PM
Now who said that Eval gets to make the rule of this contest. :rolleyes: I specified that there should be "wild speculation" and there was no requirement that we actually figure out the "real" meaning. That would be contrary to the whole concept of "speculation." :D

But since Eval wants to play also I will add:

The Art of Deception! :p

and

The Art of Dissonance!! :D

Ignore Eval and his stinking rules. :D Try as often as you'd like. :p

Regards.
evaluator
10-19-2003, 02:31 PM
rules I defined for prize.(;DOT;)
Also I will NOT confirm, if rules-breaker guess!!
JMI
10-19-2003, 03:11 PM
Well we aren't playing for your prize. We are playing for the love of the game. :D

And we also do not NEED you to confirm. WE will decide what it means. You will just have to live with OUR conclusion. :D

The Act of Defiance. :cool:

Regards.
evaluator
10-19-2003, 03:29 PM
just now I view Kayaker's attachment. Rocks!

Especially:
TROLLs
.trying to impress others with thier knowledge (ok, many word yet is not knowledge~:0)

.often have personal issues that lead them to try to control others

& on picture is very similar old one..

***The A-of-D!***
JMI
10-19-2003, 03:51 PM
It would certainly appear that Eval is feeling the "heat" and that while Eval can dish it out, Eval just can't take it. :p

So we wll have to add two more.

The Act of Desperation

And

The Articulation of Defeat. :D

Regards.
Woodmann
10-19-2003, 06:02 PM
It is.........

The Art of Deceit :p :cool:
JMI
10-19-2003, 07:06 PM
A worthy effort. Keep'um coming. :cool:

(No esther, there is NO sexual connotation intended in that remark. :D )

Regards.
mike
10-19-2003, 11:25 PM
You might say that AOD was DOA... :D
mike
10-19-2003, 11:33 PM
esther, you could always try to set your nick (or title) to administrator and see what happens... :) So yes, if your nick is administrator you probably are. :pI can't find where to change that on the new user cp pages. Which one is it on?
JMI
10-19-2003, 11:40 PM
Definately a useful, and humorous transposition, but not truely within the "spirit" of the game. :D

For Eval, DOA= Dead On Arrival :rolleyes:

And this is number "500." :cool:

Quote the Bard: "... Filled with sound and fury, signifying nothing!"

Regards.
mike
10-19-2003, 11:54 PM
Definately a useful, and humorous transposition, but not truely within the "spirit" of the game. :D

For Eval, DOA= Dead On Arrival :rolleyes:

Regards.I think you just need a few more shots of "spirits"!

A for 'Orses
B for Mutton
C for Yourself
D for Mation
E for Brick
F for Vescence
G for Police
H for Consent
I for Lutin
J for Orange
K for Teria
L for Leather
M for Sis
N for Mation
O for A Muse of Fire
P for Ate
Q for A Song
S for Something Else
T for Two
U for Mism
V for La France
W for Mism
X for Breakfast
Y for Lover
Z (zee) for yourself

We could guess that eval's a swimmer:
http://www.topsellingbrands.com/shopping/asinsearch_B00004XSTC.html
Or is sour:
http://www.aod-instagib.de/php/news/index.php
Or of course the obvious http://aod.anticrack.de/
JMI
10-20-2003, 12:09 AM
Although I did think of "The Art of Disassembly" at the start, it didn't qualify as "wild speculation." :D Too ordinary. :cool:

I loved the "Drowning" one though :D but it does have that extra letter "M" on the end.

And I would highly doubt that Eval could be German and a member of the Army of Darkness. He displays none of the teutonic traits I associate with family members sharing that ancestry and is much too imprecise to qualify anyway. :D
And it doesn't fit with Bubbles watering flowers. :D

Regards.
esther
10-20-2003, 09:46 AM
The ALL of Dumbmers :D :D :D :D :D :D :D
evaluator
10-20-2003, 10:30 AM
I shamed from MM, they updated DW (now 65mb).
So if you, guys, guess it,
I will forced to DLD this(or another) 65mb new shit for unpuking:(
.
keep me from guessing.
.
nikolatesla20
10-24-2003, 07:30 AM
*bump*

hm, big deal, MM always easy to unpack -using "Privilege Client" (old VBOX) last I knew, on all their products. Lunar's tute works on FMX, FHNDMX, etc, even used it on DIRMX, so should work on DMX...? Maybe no?

-nt20
evaluator
10-30-2003, 03:03 PM
Niko, I'm crying..
just finishied 25mb FW_MX2004 dld for unpuking &..
can't it unpuk because not puked :-(

hemm, but in other hand, here is atclib.dll crypted(?)
and "M*********_Licensing_Installer.dll", wich is SafeCast2.
Inside this dll I see also VXD. Is it interesting or it's old?

-
shit, what if another newest MMs also no more protected?


Ring -1 (Palladium/NGSCB/LaGrande)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Ring -1 (Palladium/NGSCB/LaGrande)
PDA

View Full Version : Ring -1 (Palladium/NGSCB/LaGrande)

dELTA
10-10-2003, 05:40 AM
Some new recent info about Palladium/NGSCB/LaGrande:

hxxp://www.extremetech.com/print_article/0,3998,a=107418,00.asp

They are actually considering officially naming the new most priveleged execution level "Ring -1", cool. :p

dELTA


telock 0.98 again :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > telock 0.98 again :(
PDA

View Full Version : telock 0.98 again :(

volodya
10-10-2003, 09:10 AM
Guys, first of all - I READ EVERYTHING on this forum and played a LOT with it. I know about int 1/int 3 tricks - I've read evaluator/nikolastela posts, I know DR-tricks - I've read Solomon's post. So two questions left. Pretty hard...

1) Still cannot understand DPL stuff with int 1. WHY SOFT-ICE changes it?
2) Solomon, when describing SEH-handler with DR-self tracing didn't mention other path which is doing

xor eax,eax
dr0 <- 0
dr1-3 <-0
and putting the mask to dr6-7.

So, for example, suppose I bypassed the handler (unfortunately I'm not really sure how to bypass it CORRECTLY - I mean not int 3/1 but DR-stuff...) but later on program start complaining about CRC-error! I know for sure that it is NOT int 3/int 1 check - I didn't press F8 or sth like this.... The only thing that immediately comes to mind is the DR-stuff again. But I didn't find anything around that damn MessageBoxA... The code is really crazy around, but no SEH-frames, no CONTEXT access... BTW, I need to check for the GetThreadContext/SetThreadContext...
May be someone can enlighten the situation for me?
volodya
10-10-2003, 11:16 PM
Sorry, CRC error was the part of my stupidity, I know what to do with it now. The only thing left is the DPL stuff....
volodya
10-12-2003, 09:31 PM
OK, gentlemen, thank you for the answers.
Fortunatly, I was able to figure everything by myself.
Russian-speaking visitors will be able to read my second chapter on wasm.ru in one week.
evaluator
10-13-2003, 04:07 AM
noThanks for Thanks.

Can you explain, what is:
"DPL stuff"?
ZaiRoN
10-13-2003, 04:27 AM
Hi,
directly from Intel manual volume 3, System Programming Guide:

DPL (descriptor privilege level) field
Specifies the privilege level of the segment (descriptor). The privilege level can range from 0 to 3, with 0 being the most privileged level. The DPL is used to control access to the segment. See Section 4.5., "Privilege Levels", for a description of the relationship of the DPL to the CPL (Current privilege level) of the executing code segment and the RPL of a segment selector.
evaluator
10-13-2003, 05:12 AM
Zairon, "thanks for.." ??

I'm interesting, why Volodya talks about DPL when subj is tElock!?
ZaiRoN
10-13-2003, 06:11 AM
Sorry evaluator, I misunderstand you :rolleyes:
volodya
10-13-2003, 11:39 AM
evaluator

Indeed, there was no need to speak about DPL here, because telock uses int 3. In case of int 1, DPL is right what you need - I was able to find your brilliant explanations about KiTrap0D and priviledge level changes and access violation. I wrote the small program:

EXCEPTION_DISPOSITION
__cdecl
_except_handler(
struct _EXCEPTION_RECORD *ExceptionRecord,
void * EstablisherFrame,
struct _CONTEXT *ContextRecord,
void * DispatcherContext )
{
printf("STATUS: %x\n", ExceptionRecord->ExceptionCode);
ContextRecord->Eip++;
return ExceptionContinueExecution;
}

int main(void)
{
DWORD handler = (DWORD)_except_handler;

__asm
{
push handler
push FS:[0]
mov FS:[0],ESP
int 1
mov eax,[ESP]
mov FS:[0], EAX
add esp, 8
}

return 0;

}

and it has proved what's happening indeed. So now I have clear understanding of what's going on. Thanks, evaluator
evaluator
10-13-2003, 02:55 PM
ok,
so for final move, DPL is important for INTxx instructions.
however tElock uses F1h opcode(against single step),
which is not affected by DPL rule for Intel's P.

>WHY SOFT-ICE changes it?
Probably authors have some ideas about it.. Try to ask them!


IDC Help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IDC Help
PDA

View Full Version : IDC Help

LaptoniC
10-10-2003, 09:40 AM
I have came accross interesting target.It has SMC inside.Before running "critical" functions it decrypts code blocks like below.

loc_5A3ADE:
mov ebx, offset unk_5A3C46
mov eax, 5A7A5067h
mov ecx, 138h

loc_5A3AF0:
xor [ebx], al
ror eax, 2
dec ebx
xor eax, 0EA92B810h
add eax, 4A87A691h
xor eax, 4AF2A30Dh
add eax, 2FBAA063h
rol eax, 12h
loop loc_5A3AF0

I have decrypted by simple program and pasted to dissambly; but I gone further and tried to make idc script.
I am not familiar with IDC scripting.I have searched the board and found some examples.Here is what I did but it didnt worked
My error I guess related to rol and ror.

#include <idc.idc>
#define ROTL(x,s) ((x)<<(s) | (x)>>(32-(s)))
#define ROTR(x,s) ((x)>>(s) | (x)<<(32-(s)))

static main(void) {
auto from,i,size,Key,temp;
size=0x138;
Key=0x5A7A5067;
from =0x5A3C46;

for (i=0;i<size;i++)
{
temp = (Byte(from) ^ Key);
PatchByte(from,temp);
Key=ROTR(Key,2);
from=from-1;
Key=Key ^ 0xEA92B810;
Key=Key + 0x4A87A691;
Key=Key ^ 0x4AF2A30D;
Key=Key + 0x2FBAA063;
Key=ROTL(Key,0x12);
//Message("Decrypted %x \n",temp);
}
}
ZaiRoN
10-10-2003, 04:26 PM
Hi LaptoniC,
your script seems to be ok and also the rol and ror functions are ok...

ZaiRoN
LaptoniC
10-11-2003, 05:16 AM
Script gives wrongly calculates some values.I have made simple package to show this.Download httx://mrstop.host.sk/idctest.zip It includes this routine,my idc script and correctly decrypted code block.If some one shows my error I will appreciate.Thanks
ZaiRoN
10-11-2003, 12:49 PM
Hi LaptoniC,
the problem was related to Ror and Rol functions, exactly with '>>' operator that fills the new left bits with value 1.
These Ror and Rol procedures should work for you:
static ROTL(x, s)
{
auto i, cf;

for (i=0;i<s;i++)
{
cf = x & 0x80000000; // cf takes the most left bit
x = x << 1; // it fills the new right bit with value 0
if (cf) x = x | 1; // if cf is 1 I have to insert it on the most right bit
}
return x;
}

static ROTR(x, s)
{
auto i, cf;

for (i=0;i<s;i++)
{
cf = x & 0x00000001; // cf takes the most right bit
x = x >> 1; // it fills the new left bit with value 1
if (cf) x = x | 0x80000000; // you can remove this because it's already 1
else x = x & 0x7FFFFFFF; // if cf is 0 I have to insert it on the most left bit
}
return x;
}

Ciao,
ZaiRoN
LaptoniC
10-12-2003, 06:41 AM
Thanks for the fix and detailed explanation.Best Regards


DriverStudio 3.0 BreakPoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DriverStudio 3.0 BreakPoints
PDA

View Full Version : DriverStudio 3.0 BreakPoints

naides
10-10-2003, 11:01 PM
More than a question,
I wish to share the experiences I have had with DS 3.0 and see if other ppl have had the same problems and perhaps provide suggestions.

I was working on an app in which the status 'registered' versus 'demo' is stored in a global dword flag in in memory so that:

cmp dword ptr [00543221], 00
jz good guy, full capabilities
. . . Else Nag Screen: program in demo mode

Nothing out of the ordinary.
I was using DS 2.7 (I had no reason to update to 3.0 if it did the job)

So the logical next step was to catch the code when it sets the flag at [00543221] to something different than 00. No problem, I placed a memory access breakpoint: bpmd 00543221 w.

No rocket science here.

Now, the bloody bp did not break. I was double, triple sure that the flag had been modified: I manually changed to 00000000 at the program entry point, and later when Sice broke in a bpx point I had placed somewhere later in the code, the contents at 00543221 would be changed to 00000001 (demo mode) at some point, but SoftIce did not catch it. ???

It happened in two different computers, an Athlon and a Pentium 4, both running WinXP.
It was puzzling. I tested similar bpm with notepad, for instance, and it did break, so this phenomenon appeared to be an idiosincrasy of the particular app I was debugging.

I remembered that DS2.7 had bad reputation with WinXP. We had to apply Kayaker's patch to allow apps to break at WinMain etc.

Looking in the Numega website they claimed that DS3.0 was fully compatible with WinXP so I decided to give it a try.

After a somwhat rocky installation (It kept detecting DS2.7 despite I had already uninstalled, so I had to manually remove all registry traces) DS 3.0 was up and running.

The new version appeared to behave better than 2.7: If one loads a module onto the Symbol Loader it indeed stops at the entry point without need for a patch (I guess they copied it from Kayaker :p ). Also the memory breakpoints behaved as expected.

BUT small problem: breakpoints to system DLL API ie: BPX messageboxA worked very erratically. Even when I know for a fact that the API is called by the app, Sice refuses to break. I have noticed that if I manually traced in the code near the vicinity where the API is called, then it suddenly 'sticks' and starts working from that moment on.

Anybody with similar experiences?
Is this a bug?
Is this intended?
Is this Documented? (Yes, I RTFM and found no references to the issue, but I know dick about memory mapping and other obscure lingo, so I may have been looking in the wrong places)

Ideas?

Add on:
I do set the bpm while I am in the memory space of the debugee, more specifically when the program breaks at entry point. For extra caution I also set the API bpxS while in the memory context of the debugee at entry point.
dELTA
10-11-2003, 03:10 PM
And there's no possibility that the program has anti-bp tricks? Asprotect for example has both anti-bpx and anti-bpm tricks, and other programmers might very well use them too. This sounds especially probable when you say that the breakpoints works when you set them while tracing just before the code that accesses the breakpoint location (because then it is a low probability that any anti-bp code will be execute between the two points).

Maybe you can try out the anti-anti-BPM tool and DRX operation detector from Yates (http://www.woodmann.net/yates/syscode.htm)?
naides
10-11-2003, 03:58 PM
Thanks for the lead, Delta, I will take a look.
I had not expected the program to have antidebug tricks because most of the protection schemes seemed to be rather primitive. I had worked a pevious version of the program and it has not changed dramatically.
What has changed between then and now are the OS (Before I traced in W98, now in WXP) and the debugger version (Before Sice 4.05, now DS 2.7 and 3.0), so I thought the problem might be more in the OS-Debugger side of the equation,

BUT: I have not tried to trace the program im my ole win98/Sice 4.05 puter (Is put away for now).
I did try to trace it using ollyDbg, but it crashes my system.

Anyway, thank you again.
SpeKKeL
10-17-2003, 09:37 AM
Yep,

I discovered allso some prob's(in ds 3.0) with breaking on setted bpx's..
It seems it breaks only if its breakpoint is set within the prog itself...
So putting a bpx on messagebox will only break if you set it when the prog is loaded in softice.

So back to ds 2.7 with all patches...

Spekk.
volodya
10-17-2003, 09:48 AM
All bpx's now are context sensitive.
whyIII
10-17-2003, 09:13 PM
That's the point, I think.
naides
10-18-2003, 09:20 AM
That's the point, I think.

WhyIII an volodya,
1)can you elaborate a little?
2) is this new behavoir of the debugger documented or commented somewhere?
I saw nothing about the subject in Compuware.
Rummy
10-19-2003, 06:33 PM
It's both a bug and a feature . :confused: The Using SICE manual says breakpoints set in the upper 2GB address range will break globally and breakpoints in the lower 2 GB address space will break only if the address context is the same in which the BP was set. It goes on to say that SI will pop up if the BP is set in a shared code module like kernel32.dll. I've yet to see that happen. In fact, I have had to modify several progs and insert INT 3 so that I can be in the proper context to set a BP that will pop up. Even for the so-called "shared modules".

My experience has been that the Compuware website is useless. There are a few pointers in the FAQs but there are no official web boards, forums or newsgroups where people share their experiences. Ever since NuMega sold the farm to Compuware it seems like support has gone downhill. No wonder more and more people are abandoning SICE and using tools like OllyDbg. I have not used OllyDbg myself so I can't comment on your problems there.

Please let everyone here know if you find out any secret tricks with DS 3.0. I think it does have bugs you won't find mentioned on the CW website and is woefully under-documented in general. Used to be you only needed the Using guide and the Reference but that's no longer the case. They took out a few commands that used to work just fine and added new stuff that doesn't work as advertised. I bought a ferw older versions of SICE over the years but there's no way I would pay for their current software. IMO SICE used to be a 10 on a scale of 1 to 10 but ever since Compuware took over I would give it only a 6 or a 7.
naides
10-19-2003, 07:12 PM
Well I did a little digging by simultaneously running SoftIce 4.30 (DS 3.0), boot mode and Ollydbg

I set a bpx to GetVersion while standing in one memory context ie Notepad

In OllyDbg I load a different module i.e wordpad. While in Olly I use "Goto -> Expression" and ask it to go to GetVersion in Kernel32. Olly goes there and indeed, the first instruction of GetVersion is changed to 'CC': Int3

So the Breakpoints of Sice ARE placed inside the common code of the system modules, but, for one reason or another, Sice does not break.
What the hell, Sice 4.27, with patches and inconsistencies seems to do the job better,

I am going to have to learn OllyDbg. At my Age!
volodya
10-19-2003, 09:28 PM
My guess it is made intentionally to prevent using Soft-Ice by pirates. May be. Cause, indeed, pointless to use 3.0 release. I myself prefer to use 3.0 beta 2 - still good bpx's. But time is coming, new MS OS are releasing and inevitably we will have to switch to 3.0 or 4.0 or whatever...
xfze
10-24-2003, 10:05 AM
I have the same problem and i just found this russian site with patches for this problem (link and see)

http://www.translate.ru/url/tran_url.asp?lang=en&direction=re&template=General&cp1=NO&cp2=NO&autotranslate=on&transliterate=on&referrer=&first=1&url=http%3A%2F%2Freversing.kulichki.com%2Ffiles%2Fdebug%2Fdebug.htm
(version translated to english)

http://reversing.kulichki.com/files/debug/debug.htm
(original link)

I found it just a couple of minutes ago, so i will now test it and then i'll reply and say if it worked.
volodya
10-24-2003, 10:47 AM
xfze

Man, don't be naive. First of all, these guys invented NOTHING new. Everything is on NuMega public http/ftp server for a long-long-long time already. Secondly - it is not working with DS 3.0.
xfze
10-24-2003, 01:43 PM
Ok
I had seen already the patches in frontline.compuware but these were different...

But anyway there are some strange things...
In Win98SE SI3.2 i set a bpx SendDlgItemMessageA and i run a program where i know exactly were the break should work...and i press the magic button and...voila.
In WinXP_Pro DS3.0 i set the same bpx SendDlgItemMessageA, i run the same program, i click the same button...and...nothing no break! WHY? I'm beginning to loose it! XD
Just for fun i set a bpx CreateWindowExA i open almost everything i have installed...and still no popup! This way SoftIce is almost as useful as a broken watch...

Does anyone got DS3.0 under XPSp1..2 wathever running like it should? Should I downgrade SI? HELP!
naides
10-24-2003, 06:00 PM
See Above
DS 2.7 (Sice 4.27) has its wrinkles but it DOES break in Windows API even when they are set from a different memory context.
By the way: I never paid much attention to the .t and .p
modifiers for bpx, but in Sice 4.3 .p (Break only if the brakpoint is within the current process) appears to be on by default.


Dos fun
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dos fun
PDA

View Full Version : Dos fun

Fake51
10-12-2003, 04:28 AM
Haven't been around this place in ages ... thought it was gone actually. Funny. Hadn't tried my hand at any targets in a long time, either. But then my gf gave me Cannon Fodder (the old dos game) which had a doc-protection. Figured I'd have a few laughs doing that. Was a nice excercise, actually. The hard part was figuring out how to get hands dirty debugging - the rest was pretty easy, IDA had given a lot away.
Anyway, should anyone ever feel like doing dos targets for fun, I recommend Cannon Fodder - as most other targets there are several ways to do it, so there's a thing or two to be learned.
Oh well, guess I just couldn't help myself - felt like posting something here once more ;)

Fake
dELTA
10-12-2003, 07:45 AM
Always nice to see a familiar face back in the forum Fake51, keep up the good work. :)
Fake51
10-12-2003, 11:42 AM
Heh, cheers. Don't have much time for stuff like reversing, but it was nice to know I hadn't totally lost the touch.

Fake


PVDasm 1.03b
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PVDasm 1.03b
PDA

View Full Version : PVDasm 1.03b

Bengaly
10-12-2003, 02:02 PM
Enjoy this release.
Bad or Good Comments will be well respected.
Gaia
10-14-2003, 02:56 AM
Really fast!
Ricardo Narvaja
10-14-2003, 02:26 PM
the about window in windows XP sp1 not close, only ctrl alt + del, and this close all process of the program for exit of this about window.

Ricardo

Enjoy this release.
Bad or Good Comments will be well respected.
Bengaly
10-14-2003, 02:43 PM
Press Esc to close the about box.

in next version i will add a button.
jojojo
10-14-2003, 05:57 PM
...this somehow reminds me of another software??? *think*

hehehe....cant remember *g*

nice looking, clean gui!

regards
squidge
10-15-2003, 02:02 PM
Nice job! I'm impressed :)

Would be nice if you could add "find" command for hex/assembler code.
Bengaly
10-15-2003, 05:13 PM
heya,
thnx, yeah i will add search in the near future, first i would like to add xref.
thank to all who tried it out.
artik
10-16-2003, 07:43 AM
damnit! PVDasm is pretty fast! congrats, it absolutely rocks! :D
just one thing, maybe some kind of highlighting like we have it in ollydbg or the patched w32dasm would be cool.
squidge
10-16-2003, 09:12 AM
Can I ask where you got the icons from for PVDasm? I'm constantly looking for icons, but can never find a decent selection :(
LaBBa
10-17-2003, 03:39 AM
Bengaly :)
hi bro .. long time since i saw u ...

cool app!!!

can u share the source code as well ??
Bengaly
10-17-2003, 11:54 AM
hi squidge,
i Draw my Icons alone in Visual Studio icon editor and export it as gif/bmp.

artik: yeah, i will add highlighting, w32dasm has a word to word highlight, i will highlight only the bk/fg of the text (user defined.)

laBBa, sthe disassembler engine? or whole PV? err ;)

i'll upload new version soon, some disasm fixes, xreferences..bugs fix..etc

thank you all of the kind words.
-Bengaly
squidge
10-17-2003, 12:13 PM
hmmm, I wonder if you'll do me some icons for my own proggies, or whether I can pinch your or not without you cursing me ? :)
Bengaly
10-17-2003, 12:16 PM
hehe sure, on free time i will help you make the icons ;)
my icon style of drawing is like you see on pv, i guess spending too much time on a single icon can make ya crazy :P
squidge
10-17-2003, 06:52 PM
Cool, expect a PM shortly :)

hehe sure, on free time i will help you make the icons ;)
my icon style of drawing is like you see on pv, i guess spending too much time on a single icon can make ya crazy :P


Problem with SoftICE 4.05 and Win2000 (Softice isn't breaking with F12 or F11)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problem with SoftICE 4.05 and Win2000 (Softice isn't breaking with F12 or F11)
PDA

View Full Version : Problem with SoftICE 4.05 and Win2000 (Softice isn't breaking with F12 or F11)

axle
10-13-2003, 01:24 AM
Hi

I recently upgraded from my old computer running win98SE and I'm now running windows 2000 Pro. With win98SE I had SoftICE 3.25 and never had any problems using it. I'm now using SoftICE 4.05 (NTICE), and I'm having problems with both F12 (p ret) and F11 functions. With F12, after I set a breakpoint (bpx GetDlgItemTextA for instance), SoftICE breaks normally, but once I'm in SoftICE and I press F12, it seems that SoftICE isn't breaking on the "ret" part of "p ret". After I hit F12 I'm simply taken back into windows but SoftICE doesn't break again (on the "ret" part). F11 is doing a similar thing.

Does anybody have any idea what's going on?
dELTA
10-13-2003, 07:14 AM
Have you tried it on several different targets (preferably at least one you have written yourself), to eliminate the possibility of anti-breakpoint protections?
Aimless
10-14-2003, 01:08 AM
If my hunch is correct, you are using the STANDALONE version of Softice (latest I reckon is 4.05 NT). Unfortunately, it will perform exactly as you have mentioned. To avoid this behaviour you will HAVE to install softice from the Driver Studio rather than go in for 4.05 standalone. 4.05 standalone is dead. RIP.

Have Phun
axle
10-14-2003, 11:36 PM
Hi

Delta, Yes, I was actually testing it on a target I wrote myself....Aimless thanks...I downloaded SoftICE 4.27 and it works fine!


Protectors for other Operating Systems.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Protectors for other Operating Systems.
PDA

View Full Version : Protectors for other Operating Systems.

nikolatesla20
10-14-2003, 09:07 AM
Well, I know this board is mostly dedicated to Windows, and I'm as big a Windows user as anybody - I've tried Linux versions over the past and never really liked them much. HOwever, the new versions of Linux are coming along pretty good finally, basically you can do everything now in Linux that you can do in WIndows, except for play games (most are DirectX) and write code (like system drivers and reversing). The writing code thing is because file formats are different, system API's are different, etc.

Just wondering, granted, most programs for Linux may be Open Source themselves, but has anyone seen packers for ELF executables? Or other forms of "protection" used in *nix sytems...

I know this is a boring question and most aren't interested in this *nix stuff, but I'm just curious, and that's the mark of every reverse engineer, isn't it.

-nt20
nikolatesla20
10-14-2003, 09:12 AM
Um,,,

DUH to me...I just did a search and found UPX can do ELF's, and some other program called exepak (why the hell would it be called exepak if it's for ELF's ? That is more stupid than I am for not searching)

Well, if UPX is the only "big" name for compressors in linux...they I guess there won't be much of a challenge for a while ..

-nt20
ancev
10-14-2003, 09:27 AM
hi,

i coded once a elf encryptor. it only work with 'special' elf files, and its in h**p://coderz.net/vecna/linux.htm

the UPX packer create a loader, with your ELF as a packed overlay... when run, it unpack and save it to disk, and run.

ancev
Hopcode
10-15-2003, 05:13 AM
Hi,

I think the most famous ELF protector is burneye. (used to protect 0days sploits)

You can find it there:

h**p://teso.scene.at/releases.php

Even if it has been defeated now, it is still nice. Sources are published.
A new version exists and is by far harder..

Edit: Apparently there is a burneye 2 on the site, but it doesn't look like the one i thought.

Have fun :)
cyberheg
10-17-2003, 02:31 AM
Why not enumerate all protections while you're at it.

If other people know some comercial protections I suggest they add it to the list aswell.

FLEXlm:
http://www.macrovision.com/products/flexlm/tech_specs.shtml

HASP:
http://www.ealaddin.com/support/hasp/vendor.asp#api

There also exist hasp envelope for linux. So far I remember the binaries are not stripped so there are alot of useful information when you put it into ida.

Sentinel SuperPro:
http://www.rainbow.com/products/sentinel/superpro_specs.asp

Sentinel LM:
http://www.rainbow.com/products/sentinel/lm_specs.asp

IBM LUM:
http://www-3.ibm.com/software/awdtools/lum/sysrequirements.html

Cloackware:
http://206.191.60.52/products/transcoder.html

Supposedly platform independent. However I am not sure how much marketing there is in this product and how much fact. Still it's limited success in my eyes because it only works with C code. This is more like a obfuscater then a real protection. If anyone knows more about this product I'd like to hear about it either here or in private because I find it more interesting then most others.

Any other contributions?

Most of these protections I havn't seen beeing used in software though.
I suspect though that it's not worth making a elf encryptor for most companies. The amount of work and maintaince will mostlikely be large. My understanding is that it's not so easy to protect all kinds of binaries like it is with PE files. Both vecna's and Hasp envelope says that they only work on some files.

// CyberHeg


softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > softice
PDA

View Full Version : softice

jan
10-14-2003, 06:04 PM
Hello
After working with win32dasm for a little while , i thought the moment was right to start with softice.
But if i use the symbol loader there is always a message that say's that there was an eror during translation.
I've got also the message that no debuging information was found
In the winice.dat file i removed the ; 's
My dat file is placed on winnt\system32\drivers (i read also that it is placed in the same directory as softice?)
In softice's dat file the path's to the drivers are called:EXP=\SystemRoot\System32\ntoskrnl.exe (i.e)

Is that the right path if you read above? , ore shall i specify the exact path?

Maybe can someone help me!

Greetings

Jan.
jojojo
10-14-2003, 06:18 PM
hi,

may i guide you here:

h**p://www.woodmann.net/forum/showthread.php?t=5043&highlight=modules

h**p://202.114.22.131/mirrors/www_litespeed_org/Siceinst.htm

some more nice comments can be found by searching this forum, eg. for 'winice.dat'

you can ignore the "no debug info" message. not many releases contain such debug-information, its ripped out after testing it.

good luck!
jojojo
10-14-2003, 06:39 PM
hehe, i have to add one ressource..browse OZ COZ krobars archive!!
url see below!

on krobar site: tutlist/s/SOFTICE STUFF...a number of tuts & guides

have fun!
naides
10-15-2003, 04:53 PM
Hello
After working with win32dasm for a little while , i thought the moment was right to start with softice.
But if i use the symbol loader there is always a message that say's that there was an eror during translation.
I've got also the message that no debuging information was found
In the winice.dat file i removed the ; 's
My dat file is placed on winnt\system32\drivers (i read also that it is placed in the same directory as softice?)
In softice's dat file the path's to the drivers are called:EXP=\SystemRoot\System32\ntoskrnl.exe (i.e)

Is that the right path if you read above? , ore shall i specify the exact path?

Maybe can someone help me!

Greetings

Jan.

Do not worry about those Warnings.
If you are doing reverse engineering, you usually DON'T have the application symbols table (Unless you wrote the application yourself, and you are using Symbol loader to debug it, which is the intended use of Sice in the first place)

Also, the target applications are compiled without debugging information, once they are released to the public. That is the reason for the second warning MessageBox. Just ignore them.

The Symbols you do possess are the ones of the Operating System API dll, which are pointed by the EXP=SystemRoot\System32\ntoskrnl.exe kind of statements in winice.dat

You NEED to change them to the ACTUAL addresses of the system DLLs, which in a typical WinXP system will be

EXP=c:\windows\System32\ntoskrnl.dll (this is the kernel dll) and so on

for a Win2000

EXP=c:\WINNT\System32\ntoskrnl.dll (this is the kernel dll) and so on.
jan
10-17-2003, 03:56 PM
Thankz jojojo/naides for advise!

Working with softice i tried the often named command (bpx)"hmemcpy"
It won't work so far (unknown command)
Who's got an idea wath i do wrong?

Greetings

Jan.
JMI
10-17-2003, 05:00 PM
jan:

We have a tradition here, repeated all too ofter. One should endevour to help themselves before they ask for help. One of the things you were supposed to do before you began to post is to read the FAQ. You will find a link at the bottom of the Forums. They will tell you what you should do before you post and how you should post. That's why the title of the Forum includes the statement: "Please use the search function to see if your question has already been answered. ."

Although your first question is borderline OK, is suggests that you did not search the forums for information on your topic BEFORE you asked. Your second question confirms that you essentially have done none of your own research and simply want someone else to do that basic work for you.

To put it directly, did you perhaps use the search function, found at the top of each page and enter "hmemcpy"? Had you done so you would have found all the information you would need to answer the question yourself. That answer is that "hmemcpy" does not exist in NT based systems and you will not find it in Win2K or XP. Other breakpoints are necessary in those systems and you will find the discussions there.

My purpose here is not to be too hard on you, but to point our that there is already a great deal of information available to you here, that we shouldn't have to repeat, simply because you do not take the time to look FIRST. Learning to use Softice, especially with WinXP, takes some study and effort. Use the resources here to acquaint yourself with its operation in that context. You can use the search function and review the Tools of the Trade Forum where those subjects are generally found. AFTER you have studied on your own, and reach a problem you searched for, but did not find, THEN ask for help, indicating you did search, but didn't find the answer.

Regards.


Runtime patching...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Runtime patching...
PDA

View Full Version : Runtime patching...

dipeshrestha
10-15-2003, 01:29 AM
Hi all,

i have read lots of article regarding patching, unpacking etc etc. but i want to know real about runtime patching. i have also download some software like lgen.exe that create runtime patch. but how do they do. Can anyone help me with that...

dipesh
:mad: Still newbie
Fake51
10-15-2003, 07:21 AM
Ummmmm .... have you tried searching for runtime patching? Or API hooking? Hooking in general?
What sort of help are you looking for? Points to resources? Or a general walkthru of the subject?
Runtime patching can be done in many ways - there is no ONE technique, there are many different ones. Perhaps the only instructive way to divide them is in loaders and non-loaders. And even that won't tell you much without me going deeped into the subject, which I don't have the time to do right now.
There are many resources at Fravia's ... and quite a few threads on the board, if memory and the db serves me right. So what kind of help are you looking for, again?

Fake
dipeshrestha
10-15-2003, 11:01 PM
Hi Fake,

Basically i want to know about something like loader that when executed, will run our target program and then patch a target programs code (say JZ -> JNZ) in memory. There r almost no tutorial for such patching. Can u and all other crackers help me with that?

dipesh
:mad: Still newbie
Aimless
10-16-2003, 01:29 AM
Process patchers...find the source code of different process patchers to build your own...maybe it will help.

www.programmerstools.org->patchers.

PROCESS PATCHERS:

1. PrincessSandy
2. Yoda's process patcher

Have Phun,
dipeshrestha
10-16-2003, 04:05 AM
Hi,

These patcher is all about 32-bit application. What if i need one 16-bit process patcher? Can someone...

dipesh
Fake51
10-16-2003, 07:35 AM
Never dealt with 16-bit process patching - are you talking 16-bit process patching in w9x/2k/xp? Or in 3.1? I'm assuming the first.
Well, you'd have to look into how windows handles running 16-bit code, you'll probably be able to find some resources here, and perhaps at win32asmboard.cjb.net.

Fake
dipeshrestha
10-16-2003, 10:49 PM
Hi Fake,

thanks for ur valuable advice. will be hanging on win32asmboard_cjb_net.

dipesh


Imprec Plugin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Imprec Plugin
PDA

View Full Version : Imprec Plugin

bedrock
10-15-2003, 08:42 AM
I'm trying to write an ImpRec plugin, but when i try and run one of my unresolved address' through my plugin, ImpRec just returns: 200 Failed!

Here is the situation:

ImpRec shows me an unresolved entry: rva: 00533280 ptr: 00A6E000

I go look at a6e000 in softice after already attach to the correct process and i see code like this:

a6e000 push 8a5f5c6f
a6e005 xor dword ptr[esp], fdb8fbb0
a6e00c ret

so easily enough i just need to xor 8a5f5c6f with fdb8fbb0 to get 77e7a7df, which when i goto softice and do: u 77e7a7df i land at kernel32!GetCurrentThreadId <- this is what shuold go into my IAT

This is all fairly simple, i could do it by hand if there were just a couple, but my target has 300+ entries all like this, so i thought i'd create a plugin for ImpRec, loaded up the tELock src example into msdev and started hacking, ending up with this:

DLLEXPORT DWORD Trace(DWORD hFileMap, DWORD dwSizeMap, DWORD dwTimeOut, DWORD dwToTrace,
DWORD dwExactCall)
{
char temp[260] = {0};
DeleteLogFile();

WriteLogLine("Starting trace");

WriteLogLine("b4 MapViewOfFile");
// Map the view of the file
DWORD* dwPtrOutput = (DWORD*)MapViewOfFile((HANDLE)hFileMap, FILE_MAP_READ | FILE_MAP_WRITE, 0, 0, 0);

if (!dwPtrOutput)
{
WriteLogLine("MapViewOfFile failed");
// Can't map view
return (201);
}

WriteLogLine("b4 check size of mapfile");
// Check the size of the map file
if (dwSizeMap < 4)
{
WriteLogLine("mapfile < 4");

// Invalid map size
UnmapViewOfFile((LPCVOID)dwPtrOutput);
CloseHandle((HANDLE)hFileMap);
return (203);
}

WriteLogLine("Check for bad ptr");
if (IsBadReadPtr((VOID*)dwToTrace, 4))
{
WriteLogLine("ptr is bad");

// Bad pointer!
UnmapViewOfFile((LPCVOID)dwPtrOutput);
CloseHandle((HANDLE)hFileMap);
return (205);
}

WriteLogLine("begin tracing");

BYTE *to_trace = (BYTE*)dwToTrace;

sprintf(temp, "Byte to trace: 0x%02X", *to_trace);
WriteLogLine(temp);

// We must have a "push XXXXXXX"
if(to_trace[0] == 0x68)
{
// Get the value in the "push XXXXXXX"
DWORD value1 = *((DWORD*)(to_trace+1));

// Get the value in the xor dword ptr[xxxxxxxx], XXXXXXXX
DWORD value2 = *((DWORD*)(to_trace+8));

sprintf(temp, "value1: 0x%08X", value1);
WriteLogLine(temp);

sprintf(temp, "value2: 0x%08X", value2);
WriteLogLine(temp);

// Do the xor internally rather than executing the real code
DWORD address = value1 ^ value2;

sprintf(temp, "xor: 0x%08X", address);
WriteLogLine(temp);

// Get the value in XXXXXX and write it to the mapped file
*dwPtrOutput = *((DWORD*)address);
}

// OK
UnmapViewOfFile((LPCVOID)dwPtrOutput);
CloseHandle((HANDLE)hFileMap);
return (200);
}

As far as i can see i am setting *dwPtrOutput when i have calced the correct address to go into IAT, but ImpRec just keep saying 200 Failed!

I'm sure i've just done something braindead, but wondered if someone else out there could take a quick look over.

Thanks

--
bedrock
bedrock
10-15-2003, 08:58 AM
DOH!, Okay i was braindead, damn pointer indirection :(

All fixed now

--
bedrock
jojojo
10-15-2003, 11:04 AM
to articulate your problems to others may be the best way to find the solution by your own, said my psychologist ;)
squidge
10-15-2003, 01:59 PM
to articulate your problems to others may be the best way to find the solution by your own, said my psychologist ;)

I have the same problem !

Sometimes, I just can't find whats wrong with my program, so I talk someone else through how my program works and before I've finished, I'm slapping my head going "doh!!!" :)
bedrock
10-15-2003, 02:17 PM
to articulate your problems to others may be the best way to find the solution by your own, said my psychologist ;)

I should talk with psychologist more often ;)

--
bedrock


TMG Dead?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > TMG Dead?
PDA

View Full Version : TMG Dead?

asmworkshop
10-15-2003, 09:43 AM
I been told on IRC in some chn that TMG is dead. How much of it is true?

Tnank You
nofurs
10-15-2003, 10:38 AM
I heard a friend told me its alive


i wanna change this thing... please help !!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > i wanna change this thing... please help !!
PDA

View Full Version : i wanna change this thing... please help !!

Arbitor
10-16-2003, 07:07 AM
this is about expired date... only 14 day, so i wanna change
mov eax, dword ptr epb[-0C] with something fix see address 1006397E.

can anyone tell me ??
so when eax compare with 00000001 the program will jump

i don't wanna change the other .. becouse that procedure call many time....

1005D60A E84D630000 call 1006395C
1005D60F 83F801 cmp eax, 00000001
1005D612 8945EC mov dword ptr [ebp-14], eax
1005D615 7D0F jge 1005D626 <<-- good jump
.
. << bad statment here>>>
.

-------------------------------------------------------------

1006395C 55 push ebp
.
.
.
1006397E 8B55F8 mov edx, dword ptr [ebp-08] <- here
1006397B 8B45F4 mov eax, dword ptr [ebp-0C] <- and here
10063981 C9 leave
10063982 C3 ret

Thank's for help...
dELTA
10-16-2003, 07:24 AM
So, what is the actual question, which opcodes to use?

How about:

xor eax, eax
inc eax

or

mov eax, 1

or only

inc eax
(i.e. if eax == 0 before that position in the code, else just nop the original mov)
Arbitor
10-17-2003, 03:21 AM
Thank's .. it work..i change with Heiw 33C0 and 40
the nag always show "1 day more will expired"...even i change the current date..

but the new problem come.. the program show error message, the idtell.dll not loaded and program stop... :(

maybe idtell.dll do some check like this
if not expared date then
load.
else
not load
end.

i already try using win32dasm and softice, i do some bpx but failed, coz that statment too far before showing error message.
the question is :
1. can anyone tell how i reach that statment ???.
2. what the name of other debugger-program,so i can do live-debug and save the trace log. .. or can sofice do save the trace log, if can how i do that ???

Thank's and sorry about my english is bad..
jojojo
10-17-2003, 03:48 AM
hmm....why not searching for the check BEFORE your day-trial-check?

sometimes apps look like this:

if not registered
- { if no_days_left
---- { expired! show nag! close! }
- else
---- { show nag! run in demo mode}
- }
else
{run full!}

this may be a better approach? is there a serial check, a keyfile check..?

regards
Arbitor
10-17-2003, 04:17 AM
i think not like that... coz i see this statment

procedure ShowNag
call time and get result in eax
if eax >= 1
string1 = xx + "day's more will expired"
else
string1 = "already expired"
endif

show then nag with string1...

return.

-------- and maybe up before that statment, have this statment
check the expired date
if the expride date > 1
load the dll
else
do not load dll
endif

call ShowNag procedure << see
runnig normal

(but if the dll not load, i will get that error message, coz the program searching the dll and not loaded.)

i don't know this is key check, or register check, i can use and read the result of Regmon and filemon.. can anyone teach me or where can i get tutorial for regmon and filemon ???..
but this is not serial number check..., but this dll is component for VB6, i already try wiht smartcheck but only give me my self program (project1.exe)..

thank's
evaluator
10-17-2003, 10:28 AM
>> if the expride date > 1

so maybe you need
MOV EAX, 2


how i can save my trace in softice ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > how i can save my trace in softice ???
PDA

View Full Version : how i can save my trace in softice ???

Arbitor
10-17-2003, 06:06 AM
my question is :
1. how i can save my trace in softice ???
2. what i need ???...

3. [Edit by JMI: The instructions for the Forum state very clearly NOT to ask where to find Tools of the Trade. Read the FAQ. Do not ask for such information again.!]

Thanks' and sorry about my english is bad.
jojojo
10-17-2003, 10:08 AM
hmm...iam not a softice user anymore, but i remember some "trick" with the "File / Save SoftICE History As" menu from Symbol Loader.
it will contain the last instruction traced...sorry, but i cant remember how to enlarge that trace log...but theres a way. :o)

besides that, isnt icedump (etc) capable to do that?

hehe...as mentioned before, iam used to olly! ;)

regards
naides
10-18-2003, 12:26 PM
my question is :
1. how i can save my trace in softice ???
2. what i need ???...

3. [Edit by JMI: The instructions for the Forum state very clearly NOT to ask where to find Tools of the Trade. Read the FAQ. Do not ask for such information again.!]

Thanks' and sorry about my english is bad.

Look into this board, Kayaker et al coded a Sice tracer.

Also in Anticrack site, linked below, look for the tutorial

Reverse-Engineering: Cracking 99% of all Time Trials - Written by Mushy.

He provides a method to save the traces, which is rather handy
Aimless
10-20-2003, 12:52 AM
1. Go to the position where you want to start the trace.

2. Turn the code window off

3. Start tracing. You should now see the instructions in the command window

4. After you reach where you want to be, exit from softice

5. Go to program loader and save the command window to a log file of your choice.

6. BTW, in simple traces, its far better to use Ollydbg.

Have Phun


New apple software :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New apple software :)
PDA

View Full Version : New apple software :)

nikolatesla20
10-17-2003, 12:04 PM
The new apple software for music, that used to only be on the Mac, now has a Windows version.

It detects my SoftIce install at work and will simply exit - (don't think it will work at home but I have to test it...my home SoftICE is well hidden).

Not sure which "protector" it may be using, if at all, but it does install some system drivers, so it may just use the same tricks as SecureROM or SafeDisc in that case (detecting debug register settings, etc.)

Just throwing a note out there for others that may be interested in taking a look.

-nt20
evaluator
10-17-2003, 01:08 PM
okey, i became interested;
printf indirect link.
nikolatesla20
10-17-2003, 02:45 PM
DO a google search for itunes
doug
10-17-2003, 08:29 PM
MeltICE & IsDebuggerPresent (0x612370)

oh, and it uses nmtrans.dll's NmSymIsSoftIceLoaded exported Dll entry.

function decrypting the strings appears to be at 0x611EB0
evaluator
10-18-2003, 05:02 AM
thanks to DOUG! prevents me from 19mb dld.
nt20, it not looks comercial software. OK!?


Features, pros and cons of Palladium / NGSCB
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Features, pros and cons of Palladium / NGSCB
PDA

View Full Version : Features, pros and cons of Palladium / NGSCB

dELTA
10-19-2003, 05:47 AM
Quite nice article:

hxxp://www.eff.org/Infra/trusted_computing/20031001_tc.php

dELTA
Aquatic
10-19-2003, 06:20 PM
1. Memory curtaining
Memory curtaining refers to a strong, hardware-enforced memory isolation feature to prevent programs from being able to read or write one another's memory. Today, an intruder or malicious code can often read or alter sensitive data in a PC's memory. In the trusted computing design, even the operating system should not have access to curtained memory, so an intruder who gains control of the very operating system would not be able to interfere with programs' secure memory.

Although memory isolation can be achieved in software, this requires some combination of rewriting operating systems, device drivers, and possibly even application software. Implementing this feature in hardware instead permits greater backwards compatibility with existing software and reduces the quantity of software which must be rewritten. (In general, many of the security benefits of trusted computing could be achieved in some form simply by rewriting software, but this appears impractical to some.).

hxxp://www.eff.org/Infra/trusted_computing/20031001_tc.php

Does this mean no more debuggers?

I think that the Ram itself will somehow be physically separated on the motherboard.
dELTA
10-19-2003, 06:26 PM
It sure sounds like it might have a bunch of boring consequences for people with hobbies similar to ours in any case... :( That is, if there's no cool way we can go around it anyway. :)
Aquatic
10-19-2003, 06:31 PM
It sure sounds like it might have a bunch of boring consequences for people with hobbys similar to ours in any case... :( That is, if there's no cool way we can go around it anyway. :)

People could always use custom hardware :cool:

People will be selling black-market Ram that will replace the Palladium ram.

Just my prediction.
dELTA
10-19-2003, 06:46 PM
Yep, hopefully, but it will most likely not be widely available to any newbie though. :( This is quite sad compared to today's situation, when all you need to do to get started practically is to download some free tools and some good reading material and off you go...
JMI
10-19-2003, 07:12 PM
Well, if I may state what also appears obvious, some provision HAS to be made to debug programs, or they never get written correctly. If there is NO provision to examine memory, not even the owner of the box, attempting to develop software, could view the operation of their code to find where it all went wrong.

Of course, I haven't read the article yet and it may discuss this issue.

Regards.
Aquatic
10-19-2003, 07:18 PM
Remember that Palladium is still just a pipe-dream.
dELTA
10-20-2003, 06:36 AM
JMI, there will of course be a way to debug your own programs, but it might very well be that they then have to be compiled into a special "debug mode" (which will of course require the source code), or something like that. Some of my best hopes about us being able to "go around this in a cool way" would be some tools that would analyze and patch/rebuild the static executables to fool them into using such a debug mode even in the production version. This is of course just wild speculations until we have any specific details about how they would implement such a thing, but it's the first thing that enters my mind when thinking about it anyway.

In general, I think modification of the target executable itself will be one big thing when all this happens. Since the application itself must be able to read it's own memory, I guess we could always inject an entire debugger into the executable, virus style. ;) There might be attempts to cryptographically prevent such a thing too, but I think it would be hard to do such a thing in a secure way, seeing that all software developers cannot have their own keys integrated into the hardware...


Aspr 1.23 (Stolen Bytes)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspr 1.23 (Stolen Bytes)
PDA

View Full Version : Aspr 1.23 (Stolen Bytes)

Billy[23]
10-19-2003, 11:33 PM
I searched the forums and i couldnt find a solid post on how to locate the stolen bytes taken by Aspr, anybody has some tricks to find them easy in ollydbg ? or can point me to a post with some ?

Thnx
-Bill
JMI
10-19-2003, 11:55 PM
You don't get off that easily. :p

I just entered "stolen bytes" into the "search by keyword box" and got 19 threads containing that combination. Are you trying to tell us you found NOTHING in those threads to help you? Not even in the three other threads shown on this same page with titles nearly identical to yours???? Also where is the statement of what you have already tried? It certainly appears you just want someone to give you an "easy" and "foolproof" method to do work you should learn how to do your self. Actually READ those threads.

The stolen bytes are not that difficult to find. LaBBa has a tut very close to your thread and several others discussed how to locate the stolen bytes and some even argued they are not even needed.

Regards.
Billy[23]
10-20-2003, 06:09 AM
Yea i shoulda been more descriptive sorry :))

Well yea i searched and after wading thru them all i found only the one by LaBBa dealing with Olly Debugger, and also a post by Manko dealing with his debugger but i found it doesnt save the stolen bytes in aspr 1.23, LaBBa's method also doesnt work for me no more.

I Should say i know that from LaBBa's post that it happens witha repnz, and so i break on the repnz like he states, but i cant go from there hehe :)

Looks like iam blind if there still is a post i missed :P
Manko
10-20-2003, 01:30 PM
hi!

no, it doesn't save... but it pauses shortly before stolen bytes, wich (and i mentioned this in the readme) gives you the possibility to take over with sice and trace through it, deducing what the stolen bytes were...

/Manko

']Yea i shoulda been more descriptive sorry :))

Well yea i searched and after wading thru them all i found only the one by LaBBa dealing with Olly Debugger, and also a post by Manko dealing with his debugger but i found it doesnt save the stolen bytes in aspr 1.23, LaBBa's method also doesnt work for me no more.

I Should say i know that from LaBBa's post that it happens witha repnz, and so i break on the repnz like he states, but i cant go from there hehe :)

Looks like iam blind if there still is a post i missed :P
Billy[23]
10-20-2003, 06:04 PM
Thnx Manco but i also stated for Ollydbg, as i cannot use Softice at this PC :)

Sorry for the trouble i caused you :)


Unidentified packer?!?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unidentified packer?!?
PDA

View Full Version : Unidentified packer?!?

Nexcess
10-20-2003, 09:19 AM
Ive tried analysing this file a couple times:
hxxp://dl.filekicker.com/send/file/131127-M823/proxychain.exe
(thats the shareware version) and nothing seems to even be able to tell me what its packed with. I'm wondering if maybe someone here could open it up and see if you recognise it. It maybe a new packer we havent dealt with before.
TIA for your time.
-Nexy
bedrock
10-20-2003, 09:48 AM
Hmm, interesting, this is 'Not a valid Win32 Application' on my Windows XP SP1 box

--
bedrock
neviens
10-21-2003, 08:55 AM
It's a .NET application. IDA dizassembled it well, but this
greek texts I don't understand at all. Seems, good old assembler
is gone.
Neviens.
Woodmann
10-21-2003, 05:22 PM
Hi,

I was smacking that prog around the other night.
I got back crap for an answer. It has been awhile :)
The only scanner I could get to work returned
just about every packer made.

If I recall, the entry point looked kind of funky.
I haven't tried diassembly yet.

Woodmann
evaluator
10-22-2003, 04:57 AM
okei, Nexcess, I will not downld it for only identify packer.
What magic thing will happen, when you find name of packer?

If you are sure, it is packed, so Just unpack it manually.
Basic unpacking skills required Just.


Cracking DES book online
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Cracking DES book online
PDA

View Full Version : Cracking DES book online

asmworkshop
10-20-2003, 10:59 AM
hxxp://cryptome.org/cracking-des.htm


DialCops Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DialCops Protection
PDA

View Full Version : DialCops Protection

THORAC
10-20-2003, 01:06 PM
Hi all

The file that is protected by DialCops is an Access mde file. The protection basic is time limitation and serial. The mde file has a module that is directly connected with the protection exe. With my finding on the protection i found 3 files took place on the protection. 1 of the file is a exe and it is programmed by Turbo pascal and it is 16bit. This exe connected by an 16 bit dll file and this 16 bit dll file connected to an 32bit dll file. These two dlls are programmed in delphi. These both 3 files have import and export functions.
Finally the last 32 bit dll tells the program if the serial is correct or not. I have been trying to solve the protection algo for a week but i still have nothing. Becuase for me it is too complex to understand.
I found a function in both 3 protection files called CheckAccessCode. I try to “nop” the the calls of this function but unfortunatelly the program return an error that “Protection check not approved”.
These are my findings so,
Finally I need information about this protection algo. If some of you success in DialCops cracking please let me know. Any information will be fine. Thanks a lot.

THORAC
dELTA
10-20-2003, 02:33 PM
I've heard it's used to protect software, but that's just a rumour...

Any1 know something about the FAQ?

:D
JMI
10-20-2003, 02:49 PM
Isn't that there thing something folks is supposed to read BEFORE they post? :rolleyes: Or at least I think I read that somewhere. :D

You don't suppose he might have actually put "dialcops" into his favorite search engine and actually have done a little of his own research do you? And if he did, tell us what HE learned??? Nah. Too hard. :cool:

Regards.
nikolatesla20
10-20-2003, 08:38 PM
Um, actually, the board used to say at the top "Please read the FAQ", but it doesn't say anything anymore. You should put that back in there.

-nt20
Woodmann
10-20-2003, 10:54 PM
Oh Yes...........

I will put it back up on the main page...............
It will be a very plain and simple, to the point FAQ.

Love, Woodmann :cool:
naides
10-21-2003, 09:42 AM
Hi all

The file that is protected by DialCops is an Access mde file. The protection basic is time limitation and serial. The mde file has a module that is directly connected with the protection exe. With my finding on the protection i found 3 files took place on the protection. 1 of the file is a exe and it is programmed by Turbo pascal and it is 16bit. This exe connected by an 16 bit dll file and this 16 bit dll file connected to an 32bit dll file. These two dlls are programmed in delphi. These both 3 files have import and export functions. Weird :p

Finally the last 32 bit dll tells the program if the serial is correct or not. I have been trying to solve the protection algo for a week but i still have nothing. Becuase for me it is too complex to understand.

This is where you need to concentrate: if you know where the serial validation is taking place, but cannot figure out the algo, at least find out 1) Who asks if the serial is correct, and 2)how does the program report that the serial is correct, and 3)fake the "correct" answer
I found a function in both 3 protection files called CheckAccessCode. I try to “nop” the the calls of this function but unfortunatelly the program return an error that “Protection check not approved”.

Nopping may be not enough. The function may return some magic value, perhaps in EAX, perhaps in the stack. Look what happens after the CheckAccessCode function is called and you may learn what the program expects from it (some magic value)

Also, take advantage of the nag screen: “Protection check not approved” when the program decides to place a MessageboxA saying “Protection check not approved”, it looked somewhere to find out that the damn protection check did not fly. Trace back where the decision to make that complaint is made and learn from it

These are my findings so,
Finally I need information about this protection algo. If some of you success in DialCops cracking please let me know. Any information will be fine. Thanks a lot.

THORAC
:p :p :p
THORAC
10-21-2003, 02:03 PM
Thx naides
I think this protection is not like serial fishing. It is more complex. I think the check is done in the mde file.
Forexample like hasp reversing. It has a different algo. Lots of services and functions.
I think this protection is like flexlm because it is generting a seed.
I will do your suggestions.

thx again
Aimless
10-22-2003, 01:57 AM
Maybe this would help you understand the basics of this protection?

http://www.woodmann.com/fravia/cdromcla.htm

Have Phun
THORAC
10-22-2003, 09:02 AM
Thx for your reply. Yes few functions look like that but not all of them. This protection is a bit far from CD-Cops.


TryMedia
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > TryMedia
PDA

View Full Version : TryMedia

Hopcode
10-20-2003, 06:33 PM
Hello guys,

I have downloaded a game from Trygames dot com and it uses TryMedia protection system. (i did this on purpose to test the protector).

I took m*n*p*ly because its the smallest one. It has interresting code.
I have been able to dump at OEP, and rebuild IAT..

a quick searh on the forum tells me it might emulates API as well..
hmm apparently some code is missing in my dump too..

If anyone wanna check it out, we could work on this as a mini project or something :)

Me is tired of Asprotect :)

Regards,

Hopcode

Ps: i read the FAQ and all the thing, its not a request, its just some informations, and why not, some cooperative work.
Hopcode
10-24-2003, 02:50 PM
Noone cares about a PE wrapper which hasn't been taken apart yet ?
you can grab a smaller game from the site tho.
protection has interresting features.

HopCode
dELTA
10-24-2003, 09:39 PM
People would most likely be much more interested if you started off the whole "apart-taking" with some nice facts from your own analysis...
JMI
10-24-2003, 11:09 PM
As in "Here's where I've gotten with the project" likely would be a good start.

Regards.
Iwarez
10-25-2003, 12:05 PM
What I discovered this far is that when I run the program with a commandline, in my case --MPRMMGVA-- the program yells I'am using a debugger whatever I do. How it detects my debugger is still unclear for me.
Iwarez
10-25-2003, 06:02 PM
Ok, this is sick... This protector reads the import table by itself effectively bypassing the getprocaddress. It just walks the importtable of kernel32 until it finds what it needs (WinExec). I still haven't found out though how it finds my debugger.
Hopcode
10-25-2003, 08:17 PM
Ok, this is sick... This protector reads the import table by itself effectively bypassing the getprocaddress. It just walks the importtable of kernel32 until it finds what it needs (WinExec). I still haven't found out though how it finds my debugger.

Yes, he actually runs itself using WinExec..
you can't put a bpx on it because it copies bytes at this API entry point to some place and add a jmp to the rest of the api after..
if you bpx it, it will copies your int 3 ;)

Anyway, he runs itself with the new commandline (like you mentionned) and close the first process. Then starts the anti debugging code.
Use IceExt to hide SICE.

Finding its entry point and rebuilding IAT is not much of a problem.
Then you will notice that he does FF25 / FF15 mangling.

ie: rather than doing a FF15 to call an API, the protected app will call
a subroutine in the protector which has some obfuscations and will end up
calling the good IAT slot.. but the code has been patched..

So once you have rebuilded your IAT, you have to find a way to patch the calls back to FF15

FF15 becomes 90E8 addy protector. (nop call )

Im stuck there for now. i need to find a way to rebuild that.

Btw, unlike safedisc, there is a protector addy per API.. its not just one address handling every mangled call.. so you can't just patch it and make it do all the job for you.. there are too much of those to make it by hand.

Hope this lil infos make you guys want to look at it.

Regards,

Hopcode
evaluator
10-26-2003, 01:10 AM
Far_Call & Far_Jump mangling is old cool thing.
for example Yado's Krypton does it;
(i tried contest for it, but nobody responds).
also XTreamLok i can remember here;
Now asSpr decides to include this "newest" technics.

as about restoring, all is simple.
you need to write some snippet of code for restoring calls..
activate your Phantasy..

ps
i have some bad remembrance on you?
Iwarez
10-26-2003, 02:17 AM
Do you say that when I run the app with the commandline already attached that I can bypass the debugger detecting by hand? I was thinking the wrong way then, because I thought the app would not execute winexec when there was no debugger.
Hopcode
10-26-2003, 08:18 AM
Far_Call & Far_Jump mangling is old cool thing.
for example Yado's Krypton does it;
(i tried contest for it, but nobody responds).
also XTreamLok i can remember here;
Now asSpr decides to include this "newest" technics.

as about restoring, all is simple.
you need to write some snippet of code for restoring calls..
activate your Phantasy..

ps
i have some bad remembrance on you?

Howdy,

I know that it is not new at all.
Safedisc uses this too. This is the "good" way to do if you redirect IAT, because
even with tools such as ImpRec your app is still not ready.
Anyway, while some protectors will mangle those to always call the same
subroutine that will land to the good API (and where you can patch it easily to your own code to rebuild everything in a single run) there, each API is called from a different subroutine inside the protector.
-not- all FF15/FF25 are mangled though.

here is some sample:

90E814119500 (one bogus example)

at 951114 you will find some obfuscations, that uses a lot of jmps to jmp
around the protector code, and you will enventually end up to
the real FF15 IAT slot. but then you will have other obfuscation and apparently
that's where it crashes.. maybe there are some initialised shit that get tested
and as it is a dump, it detects it and crashes. no idea yet.

so once you have found it, you just have to copy that to the location of the
90E8 etc

Then you have rebuilded the API..

But you have to do this for every mangled ones.
And more over, you have to be able to track where it will have to be patched
and with the right bytes.. while there is some crap obfuscations..

How would you attack this ? write a simple tool that browses the dump to
find the mangled calls and jmp to the protector, looking for FF15 bytes?
might be dodgy, because you might find some other redirected API before the good one.
Maybe an IDA script could do the trick, im not sure.
Its not like the mangled one where already calling the good places..
you would just have to find them and patch them back with the good calling stuff.

Any idea on this matter? i mean, a killer idea ;)

For the bad remembrance on me, i think its because we never actually talked together. I used to look on Asprotect back in the days though.

See you guys later,

HopCode
Hopcode
10-26-2003, 08:23 AM
Do you say that when I run the app with the commandline already attached that I can bypass the debugger detecting by hand? I was thinking the wrong way then, because I thought the app would not execute winexec when there was no debugger.

I don't think you will bypass the debugger detecting.
It actually uses winexec to run itself a second times and _then_ inside the new process, he checks for the command line (ie: am i first or second process) and then he starts the debugger checks..
Maybe its to break some debuggers, like Olly. dunno.

Use IceExt on NTice and you will be well hidden.
Hopcode
10-26-2003, 08:29 AM
Far_Call & Far_Jump mangling is old cool thing.
ps
i have some bad remembrance on you?

Why don't you grab Lem*nade Tyc*on on TryG*mes dot com.
Its a 4 mb game and has the protection it it.
The protection is about the same in every games, its just to analyse the Packer and have fun with "new" materials.

Enjoy musicboy ;)
evaluator
10-26-2003, 11:45 AM
I DLDed from there game "Ch*** **omp Safari" (2mb) &..
LOL, it is UPX-packed & then protected.

are you sure, your Lem*nade is not also UPX-ed?
Hopcode
10-26-2003, 01:51 PM
I DLDed from there game "Ch*** **omp Safari" (2mb) &..
LOL, it is UPX-packed & then protected.

are you sure, your Lem*nade is not also UPX-ed?

I didn't notice it myself, but i heard they all do.
Anything so far on your side ?
I didn't look at it since then.. i will look the game you grabbed and see if it looks
like monopoly.

Let us know if you found a way to rebuild it intelligently.

sir hopcode
evaluator
10-27-2003, 09:00 AM
eh, this stupid L******* is also UPX-ed:(
i unprotected my Chopm** on UPX level.
IAT is absolutely normal;

That code in original rdata section
should be protector's module [ampestub.exe],
which probably contains some functions required for program.
(this can be trial functions, can be some util functions..)
you must analyze each func, if you decide to remove.
mostly not need.
Better try replace junk instructions with NOPs
for easy disasm, analy, crk..

*****
>>Let us know if you found a way to rebuild it intelligently.
Yes-Yes!
sure, it is my life's main dream
to find intelligent ways for you ~8-)
.
evaluator
10-27-2003, 09:45 AM
Hey!
Main code is FlashPlayer~:0
only now just viewed resources..
So this prog is UPX-ed FlashPla.exe+ampestub.exe
[ampe ~ Active Mark Protection Engine!?]

yep, so attached at the end row data shoud be flash!?
& TryMedia games are jusT flash games!?

it's terrible..if so, we need extract flash as final unprotecting.
.
.
Hopcode
10-27-2003, 02:05 PM
>eh, this stupid L******* is also UPX-ed:(
>i unprotected my Chopm** on UPX level.
>IAT is absolutely normal;

Yes, this is no problem.

>That code in original rdata section
>should be protector's module [ampestub.exe],
>which probably contains some functions required for program.
>(this can be trial functions, can be some util functions..)
>you must analyze each func, if you decide to remove.
>mostly not need.
>Better try replace junk instructions with NOPs
>for easy disasm, analy, crk..

Well, if you looked well, you will see that those subs
are called from inside the program, and places where you should have seen
a CALL API (FF15).. Rather they will just nop call sub in the section
and there they will call the real api..

>Yes-Yes!
>sure, it is my life's main dream
>to find intelligent ways for you ~8-)

hahaha how funny ;)
i knew you were dedicated to me, but i didn't know it was your main dream ;-)
Hopcode
10-27-2003, 02:09 PM
Hey!
Main code is FlashPlayer~:0
only now just viewed resources..
So this prog is UPX-ed FlashPla.exe+ampestub.exe
[ampe ~ Active Mark Protection Engine!?]

yep, so attached at the end row data shoud be flash!?
& TryMedia games are jusT flash games!?

it's terrible..if so, we need extract flash as final unprotecting.
.
.

No TryMedia games can be anything.
the one you choose is a flash game, but lemonade isn't.
Monopoly , Worms Armaggedon aren't either.
Its a wrapper to protect any kind of executables..

So they use UPX to compress the files.. interresting.
Where did you see reference to "ampe" inside the protected exe ?

And yes, its gotta be Active Mark Protection Engine.
We have to find a way to remove this piece of crap.
the upx part is not a problem at all.
hmm what did they really do ?
Add anti debugger code above UPX ?

Hopcode
buntus
10-28-2003, 03:21 PM
hmm what did they really do ?
Add anti debugger code above UPX ?

Hopcode

Afaik they compress their shit with UPX. ampestub.exe string u can find if u dump the process. the original PE header is as well in the file. I already posted all of this month ago, you can even find in memory the list of API they will "protect" and some translation table. Check back : http://66.98.132.48/forum/showthread.php?t=4639&highlight=trymedia .


Patch...!? Debugger approach...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Patch...!? Debugger approach...
PDA

View Full Version : Patch...!? Debugger approach...

exctlong
10-21-2003, 04:30 AM
Hi!

Please help me, show me show to patch this crackme, thanks!

The right password is : nttl

Let's patch its,make it accept with any password.

it's very cool!
r4g3
10-21-2003, 02:48 PM
1. unpack
2. patch:
0x12424: 301C0100
0x11A9c: BC
3. goto sleep;
ZaiRoN
10-22-2003, 09:44 AM
Hi Rage,
I think it would be useful if you show us how to solve the crackme :p
For example, have you used a specific unpacker or, have you unpacked the file manually? Why did you patch the offset at 0x12424?

Ciao,
ZaiRoN
r4g3
10-22-2003, 10:54 AM
;)

1. unpacked with aspackdie 1.41

2.
its a delphi vlc app, but w/o a standart startup routines. the window is created using RegisterClassA/CreateWindowExA

CODE:00411CA1 push ebx ; lpWndClass
CODE:00411CA2 call RegisterClassA

its a (lpWndClass) ebx;
a few lines above is

mov dword ptr [ebx+4], offset sub_411B68

the WindowProc. So finaly we get to sub_411A2C - the OK btn handler.
The problem here is that the MessageBox is never called w/ an unpacked app. Running the packed one again reveals that

CODE:00411AC9 call Listactns@TListActionLink@AddItem

nonsense ir overwriten w/ a jmp xxxxx to some showmessage routine.
So again with the unpacked one i traced the xrefs starting from the one at the start of that stupid vcl function. that brings us back to the WinMain:

CODE:00411E00 mov eax, ds:dword_4138A4
CODE:00411E05 cmp eax, ds:dword_412424
CODE:00411E0B jnz short loc_411E4B
CODE:00411E0D push offset loc_4118E0

the followed xref is push'ed after a cmp of actuall EP w/ a saved one. So the first patch at 12424 is to replace it with the new EP of the unpacked app.
The second one makes MessageBox always show "registered". It modifies
a push'ed constant back in ok btn handler.
The routine jmp'ed instead of that vcl call checks for serial validity in some perverted way and accordingly to its results calls [ebp-4] is all is ok or [ebp+8] otherwise. [ebp-4] is that push'ed constant - a ptr to routine placing "serial ok" string ptr to a public variable.

3. no additional comments here :P
britedream
10-23-2003, 10:35 AM
dump at 411c30
iat=140c8 size = 19c
nop jnz at 411e0b to make prog display message
change jmp at 410b3a to 410b3d
done
ZaiRoN
10-23-2003, 10:46 AM
Hi rage,
0x11A9c: BC
It does not work for me. I have not understand the reason why you have changed the code with this particular byte, indeed.
The instruction at 411A9A moves the pointer to your serial into eax and, to always show the registered message you can simply change the instruction into this one: mov eax, 411B60 (411B60 points to the right serial)

Hi exctlong,
which was your problem exactly?

Ciao,
ZaiRoN
r4g3
10-23-2003, 11:06 AM
:P
should have been 0x11A92
Foreigner
10-25-2003, 06:34 AM
should have been 0x11A92r4g3, are you sure? This does not work...

Regards
r4g3
10-25-2003, 10:20 AM
>fc /B unpacked.exe patched.exe
Comparing files unpacked.ExE and PATCHED.EXE
00011A93: E4 BC
00012424: 01 30
00012425: A0 1C
0001B093: E3 6C
0001B094: D5 A9
0001B0B3: 12 2F
0001B0B4: 8B BC

hmmm it seems that i patched in 4 locations, dont remember anything about the last 2 ;) anyways fc doesnt lie, so this is it finaly :P
bl00dk@
10-27-2003, 01:03 PM
Patch here:

Old -> 4060C2 0FB657FF
New -> 4060C2 0FB656FF

bl00dk@
ZaiRoN
10-29-2003, 05:21 PM
Hi,
here is another way to solve the crackme, a simple loader. I did write this as a support for this thread:

http://www.woodmann.net/forum/showthread.php?t=5123

Ciao,
ZaiRoN


Just another problem with sice in XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Just another problem with sice in XP
PDA

View Full Version : Just another problem with sice in XP

-K0K-
10-21-2003, 12:47 PM
Hi everybody...

mi Driver Studio 2.7 wont go back in the code with F12 when I put a brakepoint and activate them. I could not find a solution to this, the strange thing is that DS has no other problem than that one... F12 doesn't work in my computer.
I have configured my sice adding most of this dlls:

hal.dll
ntoskrnl.exe
ntdll.dll
kernel32.dll
user32.dll
csrsrv.dll
basesrv.dll
winsrv.dll

Any suggestions?
naides
10-21-2003, 01:55 PM
1)Look at the contents of winice.dat and find out if F12 is equal to ^p RET.

2) Normally, F12 does not take you back to your code, it only traces until the next RET instruction is executed. You may be several calls deep into the code woods and need to press F12 several times to return to your code.

F11 usually equal to ^G @SS:ESP a macro that USUALLY, but not always, gets you back to the calling code, your application, provided you press it before anything has been pushed into the stack, ie as soon as Sice breaks.
Hope this makes sense
Aimless
10-22-2003, 12:46 AM
First of all, make sure that you are not using the standalone version of SoftICE 4.05 (NT) - some warez sites also call it the standalone softice from Driver Studio. It is not.

If that is all out of the way, you might try upgrading your system to SP1.

If that does not seem to work too, the best tool for testing is already present. Notepad.exe. Copy the file to a temporary directory, run it, breakpoint on CreateWindowExA and when you hit it, press F12 (but check that F12 is actually ^p RET).

If that also does not work, then open the command prompt and type in: SFC /SCANNOW. Keep your Windows XP CD ready. This will replace all files in virgin condition from the CD (.DLLs generally get corrupted because some lousy applications install their own versions of the same dlls.) Try the F12 bit again.

If that does not work, you may try re-installing Windows XP. If it works this time around, you can be pretty sure some app is messing with the softice. And yes, make sure you have disabled the anti-virus before you have tried any of this stuff.

If you really do not want to to go through all this trouble, you may try to put a breakpoint (normal, anywhere you prefer). Subsequently, scroll down and find a RET instruction. Breakpoint that instruction too. This will ALWAYS work.

A better deal would be to upgrade to Driver Studio 3.

Have Phun


Winamp 5 - how hard is this?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Winamp 5 - how hard is this?
PDA

View Full Version : Winamp 5 - how hard is this?

diz
10-21-2003, 03:45 PM
I would like to know how hard is to reverse the key generation procedure on newest version of this popular player (currently in beta stage). I'm a newbie when it comes to creating keygens. I would like to know if this is good target for someone like me.

As I already said the program name, I would not want to talk about specific code snippets etc. I would just like to know if this is not too hard for newbie. I saw somewhere in key generating function, that it uses 5 hardcoded dwords for something. Does it mean that it uses some advanced cryptographic ciphers to do key generating? Like for example RSA, or hashing function like MD5?
I'm confused, I would like to try to create my first keygen but it seems, from first look at code, that it is not best suited target for me? Am I right?
jojojo
10-21-2003, 05:58 PM
hmm...
never heard of winamp 5 before, isnt winamp 3 latest version?

however, you could use peid v0.9 for analysing your applications. within peid theres a nice crypto-analyser plugin, which may give you a hint of used crypto mechanism.
diz
10-21-2003, 06:08 PM
winamp 5 claims to be winamp 2 speed with winamp3 features and it looks very nice. Even at this beta stage. Can be downloaded here: hxxp://board.iexbeta.com/ibf10/index.php?showtopic=32132.

and thanks for suggestion, PeID showed SHA. Will look for some documents on this topic.
Zwyzum
10-31-2003, 06:53 PM
Hi!

I guess old QCD 1.27 is a nice target for creating a key gen. It's simple and now it's even freeware, so you don't break the law. And it's my favourite cd player no less. It's from quinnware.

Bye
Zwyzum
MaRKuS-DJM
11-02-2003, 10:48 AM
i think it's a easy target, you'll find registration flag less than 5 minutes
diz
11-02-2003, 10:59 AM
That's true but I was looking at it from keygen creating side. Try this and tell us if it's easy. I've given up, it's not good for me.
Kythen
11-02-2003, 06:34 PM
After a brief look, it appears to just be a SHA hash. Shouldn't be too difficult to keygen.
MaRKuS-DJM
11-03-2003, 09:30 AM
yes, SHA Hash @ 4419B9 :-)
Nitrus
11-12-2003, 02:46 AM
If someone decides to do it out of boredom and make a tutorial for it, pls foward the tutorial to my box. fruityjunkie@hotmail.com... cheers.


is there any tutor about unpack safedisc ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > is there any tutor about unpack safedisc ?
PDA

View Full Version : is there any tutor about unpack safedisc ?

dreamweavermx
10-22-2003, 04:20 AM
Is there any tutorial about unpacking exe file which protected by Safedisc ver 2.x ?????
ZaiRoN
10-22-2003, 10:03 AM
Hi
there are some tutorials here: http://woodmann.net/fravia/what_new.htm
You can also use the board search function, you will find many threads about safedisc.

Good luck,
ZaiRoN
dreamweavermx
10-22-2003, 11:07 PM
Great Thanks !
I've read the tutor and feel it's good. I've found a tutorial from Deex for Safedisc 2.7 but in France . Please does anyone give me an Eng tutorial of Deex .
Great Thanks !
dreamweavermx
11-01-2003, 12:12 AM
I've receive Safedisc 2.7 tutor and after read it , they told that Safedisc 2.7 and upper has encrypt anti-debug code so the only way to disable it is using a tool which hide debugger . The tool I know , FrogsIce for SICE is not support Win 2K . So I've used OllyDbg to unpack Safedisc 2.9 . With all tutor I read , I disable IsDebuggerPresent easily but OllyDbg still enable under Safedisc 2.9 .
Please does anyone used unpack SD 2.9 please advise me , which anti-debug tricks is SD 2.9 using ???
evlncrn8
11-01-2003, 01:00 AM
I've receive Safedisc 2.7 tutor and after read it , they told that Safedisc 2.7 and upper has encrypt anti-debug code so the only way to disable it is using a tool which hide debugger . The tool I know , FrogsIce for SICE is not support Win 2K . So I've used OllyDbg to unpack Safedisc 2.9 . With all tutor I read , I disable IsDebuggerPresent easily but OllyDbg still enable under Safedisc 2.9 .
Please does anyone used unpack SD 2.9 please advise me , which anti-debug tricks is SD 2.9 using ???

use the search button, theres a lot of information about safedisc anti debug


BoundsChecker Easter Egg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > BoundsChecker Easter Egg
PDA

View Full Version : BoundsChecker Easter Egg

disavowed
10-22-2003, 09:38 AM
http://frontline.compuware.com/nashua/papers/EasterEgg.html


SI and XP and no KB...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI and XP and no KB...
PDA

View Full Version : SI and XP and no KB...

freddyk
10-22-2003, 07:54 PM
Using SI 3.0 and XP Pro sp1 and installs and configs fine. BUT when a bp is activated (i just use MessageBox from a prog i wrote to test) sice kb locks - the mouse still works (which i disabled afterwards for testing the kb prob) - yet you can CTRL-D prior to the bp activating and type away no prob. I also disabled the different kb advanced options trying to fix but made no difference.

Any ideas?

FK


stupid question about IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > stupid question about IDA
PDA

View Full Version : stupid question about IDA

dreamweavermx
10-23-2003, 02:00 AM
How to edit string in IDA when disassembled?

Please help me !
Great Thanks !
nofurs
10-23-2003, 08:27 AM
>How to edit string in IDA when disassembled?

Put the cursor where you want to,backspace and edit
dreamweavermx
10-23-2003, 11:16 PM
No I can't ! The only one I can do is moving cursor .
Though ,thanks for reply .
Perhap I must create myself a searching-first habit when post .
GREAT THANKS !
nofurs
10-24-2003, 09:16 AM
click the Edit menu,strings,acsii.....

please rtfm....


Loader how-to: a few questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Loader how-to: a few questions
PDA

View Full Version : Loader how-to: a few questions

yaa
10-23-2003, 12:51 PM
Hello,

playing around with an aspack protected application after unpacking it I've found that the application at a certain point generates the correct regcode for the provided name and compares it with the user's one. I'd like to write a "keygen" that takes advantage of this fact (in fact I read sometime ago a post about someone that did the same thing but I just can't manage to find it anywhere) to obtain the correct regcode directly from the application.

I was thinking of writing a loader that:
1) requests a name from the user
2) writes it in the registry where the target application places the name and regcode to verify them at startup
3) loads the target application
4) patches it so that the correct regcode once calculated by the application will be sent to my "keygen"
5) displays the correct regcode on the "keygen" (or directly write it to the registry value used by the application)

What I'm missing are the following:
1) how to block the application as soon as it has been unpacked so that I can patch it before it runs???
2) what interprocess communication mechanism???

About the interprocess communication I was thinking that I should use APIs that the application already uses (I admit I wouldn't know how to add one or more functions to the target's IAT).

Any contribution is appreciated.

yaa
dELTA
10-23-2003, 02:11 PM
To make the program stop "after unpacking" you should probably use some kind of tracer (not necessarily tracing every instruction, but possibly just using a series of breakpoints from a debug loop). If you can find some API that is used closely before the point you would like to stop the program at, you can hook this API and break into the execution flow this way instead.

As for "interprocess communication", I suggest that you simply stop the program with a breakpoint (not from a third party debugger, but using a debug loop in your loader) at the right point just after the serial is calculated, and then simply read it directly out of the memory of the target process (traverse the stack based on ESP if needed).

Having come that far, you could most likely make it a generic aspack loader instead, patching the serial check code at the same point as you would read the calculated serial from memory, but I can see that a keygen might be more fun. Hell, why don't do both as a fun exercise. :)

dELTA
yaa
10-23-2003, 02:50 PM
dELTA hooking an API near the regcode generation algo is something I did not think about and it is in fact a good idea (although it is not a generic solution requiring having to adapt the keygen to each specific aspack protected target).
But I'd like to ask you if you could say something more about "traversing the stack based on ESP". Could you please provide some hints on what that would typically involve or be accomplished? As you may have understood I'm not a master on these subjects although I'm trying hard to understand and learn .... :rolleyes:

yaa
dELTA
10-23-2003, 02:58 PM
I meant that if the serial is located on a stack/heap address that will for some reason be different on different executions or between different instances of packed programs, this memory location (or a pointer to it) will most likely be located at a fixed distance from the current value of the ESP register (i.e. the stack pointer, which you will read from the target process context after getting the break on your desired code location).
yaa
10-23-2003, 03:44 PM
I've always known I should have read that "Debugging Applications" book I bought time ago. Unfortunately, I believe "stack walking" is a little bit too far of what is reasonably in my reach. :(

yaa
dELTA
10-23-2003, 04:45 PM
Nah, it's not really hard at all, it's just like accessing local variables, but in another process. If you are not familiar with the concepts of registers, stack, heap and basic assembly programming, I understand it could be hard, but in that case I'd recommend something else than writing a loader in any case. :)

You will really benefit from learning some basic assembly programming before doing any cracking. After that this should not be an impossible project at all, and you will most likely learn a lot of useful things from it.

For info regarding how to debug processes in Win32, the following tutorials over at Iczelion's site is a very nice start:

hxxp://spiff.tripnet.se/~iczelion/tut28.html
hxxp://spiff.tripnet.se/~iczelion/tut29.html
hxxp://spiff.tripnet.se/~iczelion/tut30.html

The other tutorials at Iczelion's page are very good too, but they discuss Windows API (assembly) programming rather than general assembly programming, and you will need the general parts first for it to be really useful. But you should indeed look at all the Win32 assembly tutorials at Iczelion's after that:

hxxp://spiff.tripnet.se/~iczelion/tutorials.html

Anyway, come back when you are ready, and we'll continue with your project then, no hurry. :)
yaa
10-23-2003, 05:01 PM
dELTA I'm no master, but I'm no novice either. Still it is true that I'm no expert of all those topics that matt pietrek or john robbins used to deal with in their articles. I will start coding this thing and will try out all of these ideas. When I get stuck I'll search around for reference material and help.

Thank you for the encouragement, the info and the pointers.

yaa
ZaiRoN
10-29-2003, 05:20 PM
Hi,
I did write a little loader for the crackme discussed in this thread: http://www.woodmann.net/forum/showthread.php?t=5107
It involves some of the things you need to write your loader.. maybe, it could help you a little.

Ciao,
ZaiRoN
yaa
10-30-2003, 01:55 PM
Molto gentile ZaiRoN.

But I do have a small question: you first say that 0x0041A001 is the OEP and then you say that 411C30 is the entry point of the unpacked crackme. Looking at you code it seems that 411C30 is the OEP while 41A001 is the packed crackme EP. Am I right?

yaa
ZaiRoN
10-31-2003, 10:17 AM
But I do have a small question: you first say that 0x0041A001 is the OEP and then you say that 411C30 is the entry point of the unpacked crackme. Looking at you code it seems that 411C30 is the OEP while 41A001 is the packed crackme EP. Am I right?Yes, it's my fault, sorry.
File updated.

ZaiRoN
dee
11-04-2003, 11:56 AM
what about a loader whitch joins the already runing program and changes the bytes in memmory:) i had done it on win98 but still working on winxp
ZaiRoN
11-06-2003, 04:16 AM
Hi dee.
Yes, you are right but this works if and only if the code you want to patch is not been executed yet ;-)

ZaiRoN
dee
11-06-2003, 12:28 PM
the code can be executed but it must be in a cycle or program must go thru the same code you are trying to change again,
lets say it is looking for something (Dongle) untill it will be insterted and the loader joins the process returns the good values,
or just loader waiting till the process will execute and then will join the process and patch the code,
you will ask why not to patch directly in the file - well this kind of loader can be used on instaliation then on setup start it is looking for dongle, program extracts some exe files in Temp and executes them (you cant replace them there becase they are used).
And to make the patch for user for this kind of instalaition is difficult, you need to rebuild the setup files, so this kind of the loader i think is a good solution, what do you think?;)
ZaiRoN
11-06-2003, 01:19 PM
the code can be executed but it must be in a cycle or program must go thru the same code you are trying to change againOh yes, I thought you will have understood this from what I wrote :D

ciao,
ZaiRoN
yaa
11-06-2003, 05:59 PM
Hello dee, how would you code a loader such as the one you are describing???

yaa
Zaza
11-06-2003, 08:13 PM
just an idea......... but why not use a program to dump the program from memory to disk when loaded and unpacked - then use ida to dissasemble - then identify and rip out the routine that generates the serial (and its support routines), fix it up so that it assembles properly and then use somewhen else's keygen routine for all the window crap.

Zaza
dee
11-07-2003, 05:40 AM
2 Zaza:

for serial protection it is easy, just need to find where it checks it.

and if setup is looking for dongle? keygen wont help you:)

2 yaa:

i had already done the loader like i described before but it works only on win98 i'm still wotking to make it work on winxp

it works like this
CreateToolhelp32Snapshot
Process32First
Process32Next
ReadProcessMemory - to find the processs i'm looking for by original bytes
WriteProcessMemory - to change the bytes
Zaza
11-07-2003, 09:09 AM
2 Zaza:

for serial protection it is easy, just need to find where it checks it.

and if setup is looking for dongle? keygen wont help you:)

true but i think its neater to generate a valid serial and enter it into the program rather than patch the app on every execution. (im talkin' about yaa's original target rather than the crackme)

which i was under the impression wasnt looking for a dongle :)
dee
11-07-2003, 11:36 AM
2 Zaza

yes you are right ofcourse if it is a serial only protection there is no need of loader you need just find the right serial:)
yaa
11-10-2003, 09:00 AM
zaza what you are proposing (dump the program from memory to disk when loaded and unpacked - then use ida to dissasemble - then identify and rip out the routine that generates the serial and its support routines, fix it up so that it assembles properly and then use somewhen else's keygen routine for all the window crap) isn't THAT EASY!!!

Honestly having found where the application generates the correct serial for the provided name, it seems much easier to try to make a loader-keygen as I thought it.

dee ok for the CreateToolhelp32Snapshot, but if you have snapshoted the correct process why the need for the Process32First, Process32Next???
ZaiRoN
11-11-2003, 10:37 AM
Hi!if you have snapshoted the correct process why the need for the Process32First, Process32Next???CreateToolhelp32Snapshot takes a snapshot of the specified processes in the system, as well as the heaps, modules, and threads used by these processes.After that, if you want to find a specific process, you have to walk through the processes list using Process32Next function (no need to use Process32First).

As an example, if you want to change some bytes from a running process you can follow this simple scheme:
hSnapShot = CreateToolhelp32Snapshot(...)
while (Process32Next(hSnapShot,...))
begin
Is this the process I am looking for?
Yes: begin
handle = OpenProcess(...)
WriteProcessMemory(handle,...) // to patch the file
CloseHandle(handle)
quit...
end
No: try with the next process
end
CloseHandle(hSnapShot)

ZaiRoN


return
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > return
PDA

View Full Version : return

frankmay
10-23-2003, 06:33 PM
glad to be back.........thanks for the support all..............am learning the hard way
Woodmann
10-23-2003, 06:45 PM
Hi Frank,

How can we help you ?

Woodmann
dELTA
10-23-2003, 07:27 PM
Next hard lesson Frank:

Don't post stuff like this in new threads anywhere else than in the Off-topic forum, or you might get flamed. :)
frankmay
10-24-2003, 06:08 PM
thanks woodman and delta for all your help.really appreciated OK


problem with nt all (frogsice clone)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > problem with nt all (frogsice clone)
PDA

View Full Version : problem with nt all (frogsice clone)

axle
10-24-2003, 06:26 PM
Hi

I just downloaded the program "nt all" (frogsice clone) and I can't seem to get it to work...It seems to always be disabled. (there's a red "X" through the icon in the toolbar) whenever I load it. When I right-click on the icon it says "sorry but for now NTIce must be loaded". But I DO have SOFTICE loaded...Has anyone else had this problem or know what's going on?

Also a second question...What other tools are out there to hide Softice when you're using windows 2000? It seems like almost all the tools out there for hiding Softice are only for win9x.
Aster!x
10-24-2003, 07:06 PM
Try to use IceExt.
doug
10-24-2003, 08:21 PM
there are also many many ways to hide your softice..
tons of utils & tricks have been posted on this forum.. use that secret search button:)


Help me have a luck !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help me have a luck !
PDA

View Full Version : Help me have a luck !

+SplAj
10-26-2003, 01:23 AM
Damn,

now you woke me I have a Q....I have this target that uses some obscure antique protection to thwart me: 'ElanLM' ...

!<Elan-License-Manager-Key>
# DO NOT EDIT/COPY/MOVE/TOUCH THIS FILE!
# DOING SO WILL INVALIDATE THE KEY!
6842721878264599036911473884276592573
WebWanker
H
1 SplAj-is-well-hung
0151213687018652211224094312641679155583433861368853540716
9104832777804657858139519273774055359562731037847194132111
6378652027222660678058297732291358

I did some searches and all leads point back to some guy called 'Crackz' ;)
1 tut on Sentinel to be exact.
His archive contains a pwd protected SDK.
He says I must join the 'other-side'. Sorry but I support Man City.

Now I also got the API guide and can start reading. Thats a nice present thanks.

Now the Q :-

Does anyone know a guy that knows if the SentinelLM SDK that is part of Crackz Archive beholds the answer to creating Elan Licenses ?
evaluator
10-26-2003, 05:24 AM
A: i don't know anything around this subj;

Q:~ what means "Man City"!? {where only men, without woomen?}
.
jojojo
10-26-2003, 05:31 AM
hello,

with the sdks you are able to generate valid licenses like you were the vendor of protected app. BUT you will have to find some seeds and stuff first, to use the sdk for license-generating.

regards
jo^3
CrackZ
10-26-2003, 12:46 PM
Hiya +SplAj,

I'm surprised you can't contribute *something* to support my other team ;-).

However, you need to find Winadmin.exe (the Wlcsgen of ElanLM) plus the API guide elm_API.hlp to generate some licenses.

Feel free to continue this in private or via e-mail ;P.

Regards

CrackZ.
+SplAj
10-26-2003, 03:41 PM
Hi CrackZ

I was searching my Pr0n archive for some sassy pics of yer fave bird Shani so I could zip them up and trade .... but got a bit distracted searching 3 gigs of jpegs....

ok I'll have a look for that winadmin.exe and carry on ;) studying that API guide for now. It's quite comprehensive with lots of code snippets, nice...can that be for real ?

later
hobferret
10-27-2003, 04:22 PM
Hi +SplAj :)

I remember something of this try looking at http://www.woodmann.com/fravia/pilgrim_elanlm_spps.htm

It's a couple of years old but may be of some use ;)

What's evaluator on about again - SplAj playing jokes on him now - what means Man City {where only men, without woomen?}

I dunno what planet you live on but even I know that Man City are BLUE and Man Utd are RED - eval they are football teams you plonker! :eek:

/hobferret
Aquatic
10-28-2003, 03:10 AM
Haha,

I didn't understand one word of this thread.
Erior
10-29-2003, 01:48 PM
Hi

I used only the API guide for a target since the license generator was
present in the dll.
Had a demo license that I checked in, changed some structures
( expire date etc ) and then called some generate func and all worked.

Don't know what I did with my program though, probebly deleted it
since my problem was solved. ( shame really )

Anyway. that could be one way to solve your problem.

/Erior


new arma tricks ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new arma tricks ?
PDA

View Full Version : new arma tricks ?

BenJ
10-26-2003, 04:17 AM
Hello board,

well, i'd been used to arma with the great! healp of Ricardo and others, but i'm now facing a problem.

I hav a prog, which used to be packed with arma 2.85, so I could deal with it. I have got a new version of the prog, wich now behave in a weird way : the process of copymem seems to be as usual (decrypt/encrypt per 1000b and so on). The problem is that in ollydbg, it's impossible to read the father's code when disassembling : many parts seem corrupted, so very difficult to put bp.

Is it smthing new in V3 of armadillo, and has smbdy already experienced it ?

Ben
BenJ
10-26-2003, 05:11 AM
As an exemple, here is the code I get around the call Waitfordebugevent in the father :

0083CC50 FF DB FF
0083CC51 15 DB 15
0083CC52 . A0408600 DD <&KERNEL32.WaitForDebugEvent> <- here is the call to waitfordebugevent !!
0083CC56 85 DB 85 <- should be the test eax, eax !!
0083CC57 C0 DB C0
0083CC58 0F DB 0F
0083CC59 84 DB 84
0083CC5A > B1 23 MOV CL,23
0083CC5C . 0000 ADD BYTE PTR DS:[EAX],AL
0083CC5E . 60 PUSHAD
0083CC5F . 33C0 XOR EAX,EAX
0083CC61 . 75 02 JNZ SHORT xxxx.0083CC65
0083CC63 . EB 15 JMP SHORT xxxx.0083CC7A
0083CC65 > EB 33 JMP SHORT xxxx.0083CC9A
0083CC67 C0 DB C0
0083CC68 75 DB 75 ; CHAR 'u'
0083CC69 18 DB 18
0083CC6A 7A DB 7A ; CHAR 'z'
0083CC6B 0C DB 0C
0083CC6C > 70 0E JO SHORT xxxx.0083CC7C
0083CC6E . EB 0D JMP SHORT xxxx.0083CC7D
0083CC70 E8 DB E8
0083CC71 72 DB 72 ; CHAR 'r'
0083CC72 0E DB 0E
0083CC73 79 DB 79 ; CHAR 'y'
0083CC74 F1 DB F1
0083CC75 FF DB FF
0083CC76 15 DB 15

does not look like valid code, but when tracing, ollydbg seems to be ok with instructions.
nikolatesla20
10-26-2003, 08:35 AM
Armadillo now uses obfuscated code mostly, in the father. What I mean by obfuscated is that it's not encrypted: It's just code that doesn't line up properly in a disassembler until it's run. For example, it jumps around a little and pretty much does nothing.

There's a lot of these blocks in new Arma versions, but you get used to seeing them after a bit. Just keep stepping thru the obfuscated block until you hit valid code, then you'll know where to put the breakpoint. The obfuscated block does not do anything special, it's only there to trip you.

-nt20
BenJ
10-26-2003, 10:21 AM
Thx for the info NT, but I'm a little bit confused...

If I BP WaitForDebugEvent, when olly breaks, it says that the call comes from 83CC52, and after processing, it returns to 83CC56.

Do you mean that the real code is not the one that appears in olly ? How does it work ? Are there articles around about this ?
QuickeneR
10-26-2003, 03:12 PM
Hi BenJ,
if WaitForDebugEvent returned to the same piece of code that it was called from, it would loop forever. In your code sample this function was called from 0083CC50 and it will return to ..C56. The reason for OllyDbg saying ..C52 is the fact that only the return address is stored on the stack. To show the called-from address, Olly must disassemble one instruction up - which is done incorrectly.

Armadillo's "obfuscation" was mentioned in 88-ARMADILLO 3 SUPEREXPLICADO LYDIA NANOMITES por CODE RAPTOR (parte3) on Ricardo's ftp (and probably elsewhere on the net). Basically, there are two blocks of useless jumps scattered throughout the code. They start with PUSHAD/PUSHFD and end with POPAD/POPFD - easy to identify for both humans and computers alike. They can be nopped out for better code readability.
Ricardo Narvaja
10-26-2003, 03:34 PM
In miy FTP i have tuts with the same method of unpacking, but on armadillos 3 or more, and the ofuscation is not a trouble, is the same thing, if you have troubles read the tuts on new armas, and you see is the same method, and the other trick, the encription of the tables is only a xor, if you look this is always the same, and the same method for unpack.

Ricardo

Hi BenJ,
if WaitForDebugEvent returned to the same piece of code that it was called from, it would loop forever. In your code sample this function was called from 0083CC50 and it will return to ..C56. The reason for OllyDbg saying ..C52 is the fact that only the return address is stored on the stack. To show the called-from address, Olly must disassemble one instruction up - which is done incorrectly.

Armadillo's "obfuscation" was mentioned in 88-ARMADILLO 3 SUPEREXPLICADO LYDIA NANOMITES por CODE RAPTOR (parte3) on Ricardo's ftp (and probably elsewhere on the net). Basically, there are two blocks of useless jumps scattered throughout the code. They start with PUSHAD/PUSHFD and end with POPAD/POPFD - easy to identify for both humans and computers alike. They can be nopped out for better code readability.
BenJ
10-26-2003, 03:40 PM
Hehe, ok it's much more clear now. I should have read the latest tuts ! :o

Thx for all.
mr.x
10-31-2003, 10:06 AM
I have an application was protected by Armadillo 3, but I can not unpack it. Any suggestion?
BenJ
10-31-2003, 10:26 AM
I have an application was protected by Armadillo 3, but I can not unpack it. Any suggestion?

well...... if you do like me you should come to a result :

- search and read all the topics about arma to understand how it works
- search the forum or google for ricardo navaja's ftp
- download his tutz
- translate some with a good translator if you don't speak spanish
- apply the tutz

Personnally I'm close to a result after some days, but I was used to former versions of arma...

Goog luck !


Diffie Hellman Key Agreement - Cryptlib???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Diffie Hellman Key Agreement - Cryptlib???
PDA

View Full Version : Diffie Hellman Key Agreement - Cryptlib???

Clandestiny
10-26-2003, 10:29 PM
Hiya,

I am attempting to perform a Diffie Hellman key agreement between a client and server using the CryptLib library. According to CryptLib documentation, Diffie Hellman has been implemented according to PKCS-3. I looked up PKCS-3 and think I understand the basic sequence of steps:

1. Each of the 2 parties need a prime number and a base

It seems there is some protocol called SKIP (Simple Key Mangement for Internet Protocols). I'm not quite sure how or if I can use this with cryptlib, however...

2. The parties generate a private number

Which function does this in cryptlib?

3. The parties generate public keys

Once again, I can't figure out which cryptlib function does this.

4. The 2 parties exchage keys and convert the exchanged numbers into a secret key.

I know this is probably something really basic. If only I could locate a piece of example code for crypt lib using Diffie Hellman. Alas, all of my searches have turned up nothing on this topic. I thought about using the cryptEncrypt function with the identifier CRYPT_ALGO_DH, but it didn't quite seem to fit and I couldn't figure out where the prime number or base should come from. I'm a desparate newbie looking for a pointer in the right direction :)

Thanks,
Clandestiny
Clandestiny
10-27-2003, 02:04 PM
Is it just me or is there absolutely NO documentation on this? I have searched the manual over and over looking for some information. Heaven forbid there should be an actual piece of example code lying around somewhere :rolleyes: . Finally, I resorted to looking at the source code and found *something* that looks like what I need, but it appears that these are all internal functions and not listed in the main cryptlib.h header that I've used previously.

This is what I found listed below though I can't get the damn thing to include without errors to save my life :( :mad:
The following functions are located in lib_dh.c in case anyone knows anything about the cryptlib library.

I am going to *assume* the first step will be to call dhInitKey... Can't vouch for that though as I can't get everything to compile w/o linker errors.

BTW, I don't really care what library I'm using... Feel free to suggest another one that has Diffie Hellman (with better documentation) if you know of one. At this point, ANY suggestions will be appreciated.

int dhInitKey( CRYPT_INFO *cryptInfo, const void *key, const int keyLength );
int dhEncrypt( CRYPT_INFO *cryptInfo, BYTE *buffer, int noBytes );
int dhDecrypt( CRYPT_INFO *cryptInfo, BYTE *buffer, int noBytes );

/****************************************************************************
* *
* Diffie-Hellman Key Exchange Routines *
* *
****************************************************************************/

/* Perform phase 1 of Diffie-Hellman ("export") */

int dhEncrypt( CRYPT_INFO *cryptInfo, BYTE *buffer, int noBytes )
{
KEYAGREE_PARAMS *keyAgreeParams = ( KEYAGREE_PARAMS * ) buffer;
BN_CTX *bnCTX;
int status = CRYPT_OK;

UNUSED( noBytes );

/* Usually y is generated as a side-effect of the implicit generation of
the x value, so if y is already set we just return its value */
if( !BN_is_zero( cryptInfo->ctxPKC.dlpParam_y ) )
{
keyAgreeParams->publicValueLen = \
BN_bn2bin( cryptInfo->ctxPKC.dlpParam_y,
keyAgreeParams->publicValue );
return( CRYPT_OK );
}

if( ( bnCTX = BN_CTX_new() ) == NULL )
return( CRYPT_ERROR_MEMORY );

/* Export y = g^x mod p. There is no input data since x was set when the
DH values were loaded */
BN_mod_exp( cryptInfo->ctxPKC.dlpParam_y, cryptInfo->ctxPKC.dlpParam_g,
cryptInfo->ctxPKC.dlpParam_x, cryptInfo->ctxPKC.dlpParam_p,
bnCTX );
keyAgreeParams->publicValueLen = \
BN_bn2bin( cryptInfo->ctxPKC.dlpParam_y,
keyAgreeParams->publicValue );
BN_CTX_free( bnCTX );

return( ( status == -1 ) ? CRYPT_ERROR_FAILED : status );
}

/* Perform phase 2 of Diffie-Hellman ("import") */

int dhDecrypt( CRYPT_INFO *cryptInfo, BYTE *buffer, int noBytes )
{
KEYAGREE_PARAMS *keyAgreeParams = ( KEYAGREE_PARAMS * ) buffer;
BN_CTX *bnCTX;
BIGNUM *z;
const int length = bitsToBytes( cryptInfo->ctxPKC.keySizeBits );
int i, status = CRYPT_OK;

/* Make sure we're not being fed suspiciously short data quantities */
for( i = 0; i < length; i++ )
if( keyAgreeParams->publicValue[ i ] )
break;
if( length - i < 56 )
return( CRYPT_ERROR_BADDATA );

if( ( bnCTX = BN_CTX_new() ) == NULL )
return( CRYPT_ERROR_MEMORY );

/* The other parties y value will be stored with the key agreement info
rather than having been read in when we read the DH public key */
BN_bin2bn( keyAgreeParams->publicValue, keyAgreeParams->publicValueLen,
cryptInfo->ctxPKC.dhParam_yPrime );

/* Export z = y^x mod p. We need to use separate y and z values because
the bignum code can't handle modexp with the first two parameters the
same */
z = BN_new();
BN_mod_exp( z, cryptInfo->ctxPKC.dhParam_yPrime,
cryptInfo->ctxPKC.dlpParam_x, cryptInfo->ctxPKC.dlpParam_p,
bnCTX );
keyAgreeParams->wrappedKeyLen = BN_bn2bin( z, keyAgreeParams->wrappedKey );
BN_clear_free( z );

#if 0
y = BN_new();
BN_bin2bn( buffer, length, y );
zeroise( buffer, length ); /* Clear buffer while data is in bignum */
BN_mod_exp( y, y, cryptInfo->ctxPKC.dlpParam_x,
cryptInfo->ctxPKC.dlpParam_p, bnCTX );
length = BN_bn2bin( y, buffer );
BN_clear_free( y );
#endif

BN_CTX_free( bnCTX );

return( ( status == -1 ) ? CRYPT_ERROR_FAILED : status );
}

/****************************************************************************
* *
* Diffie-Hellman Key Management Routines *
* *
****************************************************************************/

/* Load DH public key components into an encryption context */

int dhInitKey( CRYPT_INFO *cryptInfo, const void *key, const int keyLength )
{
CRYPT_PKCINFO_DLP *dhKey = ( CRYPT_PKCINFO_DLP * ) key;
int status;

/* Load the key component from the external representation into the
internal BigNums unless we're doing an internal load */
if( keyLength != sizeof( PKCINFO_LOADINTERNAL ) )
{
cryptInfo->ctxPKC.isPublicKey = dhKey->isPublicKey;

BN_bin2bn( dhKey->p, bitsToBytes( dhKey->pLen ),
cryptInfo->ctxPKC.dlpParam_p );
BN_bin2bn( dhKey->g, bitsToBytes( dhKey->gLen ),
cryptInfo->ctxPKC.dlpParam_g );
BN_bin2bn( dhKey->q, bitsToBytes( dhKey->qLen ),
cryptInfo->ctxPKC.dlpParam_q );
BN_bin2bn( dhKey->y, bitsToBytes( dhKey->yLen ),
cryptInfo->ctxPKC.dlpParam_y );
if( !dhKey->isPublicKey )
BN_bin2bn( dhKey->x, bitsToBytes( dhKey->xLen ),
cryptInfo->ctxPKC.dlpParam_x );
else
{
/* If there's no x value present, generate one implicitly. This
is needed because all DH keys are effectively private keys */
status = generateDLPKey( cryptInfo, CRYPT_UNUSED, CRYPT_UNUSED,
FALSE );
if( cryptStatusError( status ) )
return( status );
}
}

/* Check the parameters and calculate the key ID */
status = checkDLParams( cryptInfo, TRUE );
if( cryptStatusError( status ) )
return( status );
cryptInfo->ctxPKC.keySizeBits = BN_num_bits( cryptInfo->ctxPKC.dlpParam_p );
return( calculateKeyID( cryptInfo ) );
}

/* Generate a Diffie-Hellman key into an encryption context */

int dhGenerateKey( CRYPT_INFO *cryptInfo, const int keySizeBits )
{
int status;

status = generateDLPKey( cryptInfo, keySizeBits, CRYPT_USE_DEFAULT,
TRUE );
if( cryptStatusError( status ) )
return( status );
return( calculateKeyID( cryptInfo ) );
}

Thanks,
--an extremely frustrated,
Clandestiny
mike
10-27-2003, 04:40 PM
1. You always call cryptInit ifrst, otherwise nothing works
2. You only include cryptlib.h. Everything you need is there.
3. Link with the library.

Cryptlib expects you to use the high level interface rather than know how to do any particular algorithm.

Here's some Delphi code that shows how to create a key pair and export the public key to a cert file. The only change in your case would be to use CRYPT_ALGO_DSA rather than CRYPT_ALGO_RSA.

procedure TKGForm.OnBtnOKClick(Sender: TObject);
var
ret: Integer;
keyset: Integer;
context: Integer;
certlabel: String;
cert: Integer;
buf: PChar;
len: Integer;
memFlag: boolean;

certFile: Integer;
fileFlag: boolean;
begin
memFlag := false;
fileFlag := false;
certFile := -1;
certlabel := 'Shuttle Server';
try
ret := cryptInit;
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not init Cryptlib.',[ret]);

ret := cryptKeysetOpen(keyset, CRYPT_UNUSED, CRYPT_KEYSET_FILE,
'shuttleserver.keyset', CRYPT_KEYOPT_CREATE);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not create the keyset file "shuttleserver.keyset"',[ret]);

ret := cryptCreateContext(context, CRYPT_UNUSED, CRYPT_ALGO_RSA);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not create context',[ret]);

ret := cryptSetAttributeString(context, CRYPT_CTXINFO_LABEL,
PChar(certlabel), length(certlabel));
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not set cert label',[ret]);

ret := cryptGenerateKey(context);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not generate key',[ret]);

ret := cryptAddPrivateKey(keyset, context, PChar(Edit2.Text));
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not set password',[ret]);

ret := cryptCreateCert(cert, CRYPT_UNUSED, CRYPT_CERTTYPE_CERTIFICATE);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not create certificate',[ret]);

ret := cryptSetAttribute(cert, CRYPT_CERTINFO_XYZZY, 1);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not set XYZZY attribute',[ret]);

ret := cryptSetAttribute(cert, CRYPT_CERTINFO_SUBJECTPUBLICKEYINFO, context);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not set cert''s public key',[ret]);

ret := cryptSetAttributeString(cert, CRYPT_CERTINFO_COMMONNAME,
PChar(certlabel), length(certlabel));
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not set common name',[ret]);

ret := cryptSignCert(cert, context);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not self-sign certificate',[ret]);

len := 0;
buf := nil;
ret := cryptExportCert(buf, len, CRYPT_CERTFORMAT_CERTIFICATE, cert);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not get cert size',[ret]);

GetMem(buf, len); memFlag := true;
ret := cryptExportCert(buf, len, CRYPT_CERTFORMAT_CERTIFICATE, cert);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not get export cert',[ret]);

certFile := FileCreate('shuttleserver.p15');
fileFlag := true;
if certFile = -1 then
raise Ex.CreateFmt('File error: could not create "shuttleserver.p15"',[ret]);

FileWrite(certFile, buf^, len);
FileClose(certFile); fileFlag :=false;

FreeMem(buf); memFlag := false;

ret := cryptDestroyCert(cert);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not destroy cert',[ret]);

ret := cryptDestroyContext(context);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not destroy context',[ret]);

ret := cryptKeysetClose(keyset);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could close keyset',[ret]);

ret := cryptEnd;
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: error on shutdown',[ret]);
except
on E:Ex do begin
Application.MessageBox(PChar(E.Message),'Fatal Error',MB_OK);
if fileFlag then FileClose(certFile);
if memFlag then FreeMem(buf);
Halt;
end;
end;

Application.MessageBox('Keys generated successfully!','Success!',MB_OK);
Halt;
end;

Once you've created the cert, you can import it like this:

{ Allocate a buffer to hold the cert object. }
GetMem(buf,searchRec.Size+1);
memFlag := True;

{ Open the file. }
f := FileOpen(certFileName, fmOpenRead);
if f=-1 then
raise Ex.CreateFmt('File error: could not open ShuttleServer''s certificate! (%s)',[certFileName]);

{ Load the cert buffer. }
FileSeek(f,0,0);
bytes := FileRead(f, buf^, searchRec.Size);

{ Close the file. }
FileClose(f);

{ Create the cert object. }
ret := cryptImportCert(buf, bytes, CRYPT_UNUSED, cert);
if ret <> CRYPT_OK then
raise Ex.CreateFmt('Cryptlib error %d: could not import cert buffer.', [ret]);

{ Free the cert-sized buffer. }
FreeMem(buf); memFlag := False;

Finally, encrypt files using the enveloping API.
mike
10-28-2003, 03:40 PM
P.S. You should really subscribe to the mailing list if you want to work with cryptlib. EVERYONE needs lots of help trying to figure it out.
Clandestiny
10-28-2003, 11:32 PM
P.S. You should really subscribe to the mailing list if you want to work with cryptlib. EVERYONE needs lots of help trying to figure it out.

You're not kidding there :eek: ! In case you can't tell, I'm about the newest newbie there is when it comes to crypto ;).

Thank you very much for the example code :) I really appreciate it. I finally got a key exchange working after so MUCH effort it's almost embarassing to admit ;). In that previous post, I was *really* heading down the wrong path.

Cryptlib expects you to use the high level interface rather than know how to do any particular algorithm.

Yeah, thats what I meant about heading down the wrong path... After finally thinking I had a *little* bit of understanding of Diffie Hellman key exchange, I was looking for actual functions that would load the prime # and base and generate each of the public and private keys. I guess I didn't quite understand that these things were "encapsulated" into higher level interfaces for key exchanging. It seems obvious now that I got it working, but I wandered around in the dark for quite a while about the mysteries of encryption contexts, certificates, and initialization vectors.

Thanks again :)
Clandestiny


InstallShield ComponentValidate
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > InstallShield ComponentValidate
PDA

View Full Version : InstallShield ComponentValidate

zhanzixin
10-27-2003, 10:07 PM
Hi all:
I have a question maybe easy to you.
When I discompile some setup.inx file of installshield 6.x I found
scripts like below:
result = componentValidate( Media , "" , password" )
which password is entered from Asktext dialog box as other application.
If I patch the setup.inx to skip the validating , an error -142 will occur ,that
means I cannot move component before validate it. I think it a very common and
simply method the installshield would take,but i don't know why no any man
cover this topic.
i6comp can unpack these cab like data1.cab,but without real password some
regester table action in the inx file will be skip.


HASP4 envelope problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HASP4 envelope problems
PDA

View Full Version : HASP4 envelope problems

begemott
10-28-2003, 10:21 AM
Hi,

I have an application protected with HASP4 (and I have the dongle).
There are .protect and _TEXT_HA sections.
I thought that since I have the dongle it will be easy to remove the envelope but...

1. Softice doesn't break - bpx, bpm aaaa X don't work.
This seems strange to me. In the essays regarding HASP4 it is decribed that bpm should work on CreateFileA, FreeEnvironmentStringsA etc. Any ideas?

Windbg didn't help me too(the program doesn't run at all).
Olly works...

First I noticed that the runnung program uses msvcrt.dll
To my way of thinking this means that the entry point of original(unpacked) exe will look like WinMainCRTStartup. So I created something like signature of WinMainCRTStartup and searched the process memory. I found two instances of the signature - one in the .text section and one in the .protect section.
I decided that the oep is where I found (what I think is)WinMainCRTStartup code in the .text section.
Next I dumped the running exe, removed the .protect section, correct the ep in a pe editor.
Next I used ImpRec to fix the imports.
And finally...my exe doesn't run.

(I also tried to dump the exe when the debugger breaks at the oep with no success)

Is this the right way to deal with the HASP4 envelope?
What to do further?

Regards!
separator
10-29-2003, 07:45 AM
Hello,
HASP envelope is very easy for unpacking. Your breakpoints don't work because you set them to start address of API and HASP envelope emulates some instructions from start of every API call. Try to use bpmb GetModuleHandleA+7 x I think it will work fine. You can try use /tracex command from IceDump for find EOP or You can use some breakpoints to APIs (GetModuleHandleA works fine most times).
When you find EOP then just dump application and use ImpRec for resolving import table. You will have three not resolved API calls. Two of them have same address and one is different. These two are GetProcAddress and last is ExitProcess.
begemott
10-30-2003, 04:44 AM
Thank you for your reply!

Dongle removed!

Greetings!
separator
10-31-2003, 02:26 PM
One thing I don't understand. They didn't update thier envelope very long time. I don't understand why, because its not problem remove it. Maybe they didn't update it because its free :)
sope
10-31-2003, 11:42 PM
Hello separator

Just in case if you are interested in the new flavour of hasp4 envelope get it from below url fxp://fxp.ealaddin.com/pub/hasp/new_releases/docseal/DocSeal.zip

Also the favourite brk pt technique to reach the highest level is gone. Its slightly different.

Regards, Sope.
TOTEU
11-07-2003, 03:11 PM
Having a quick look on newest hasp4 envelope, just
having some notepads enveloped for study :D
-> a win2K notepad with size 1MB, that's pretty hefty..:D

1. code around HASP entry is now something like this:

cmp eax, 09
push edi
jnz smth

2. iceext 0.53 will manage the sice checks...

3. the flow of (crazy options set, prolly the hardest) envelope is like this:

FN 01/02(1st_seed)/3C(len 0x08)/02/02(2nd_seed)/
/many 3D (len 0x0E) (some of them random -that means no right answer needed)
(some of them are needed and stored in a 2 indexed tables with IN data and OUT data
- space between arrays is 0x800 in my case -this reminds me of the spro envelope
and their random sproqueries indexed as well...:D) (a cmp eax, edx in a loop
will compare byte by byte the answers stored in the 2nd indexed table)
/then follows 3D with a few blocks needed for restoring the encrypted PE
in my case blocks were with len: 6*0xFFE + 0x4c3 for decrypting/then again 3D with a block
with len 0x5EE/

4. background hasp checks: 01/02/twice fixed 3C blocks

If anyone willing to contact me for new tricks found in HASP newest envelope
please feel free to PM or post them here..:D
sope
11-08-2003, 12:45 AM
Hello TOTEU,

Also will like to add we can also see service 3, 5, 6 depending on the options used.

One thing i like in these envelop is the Decrypting of important files at runtimes, seen only one implementation of it yet, but waiting for many to come. Also unpacking of such envelope will not be a solution of it. Check the above link given once u unpack it run it & try open the crypted files see what happens. Carry on the fantasy....

Regards, Sope.
neemous
11-08-2003, 12:17 PM
hi all,

Dont if this should be in newbies or unpacking...
I have a hasp envelope program here w/the dongle
it has several enveloped dll. Easy to find oep with tracex or
bpx on redirected api: bpx getversion+5, etc. Here
is what i tried:
dump exe twice, one w/procdump, one w/lordpe, lordpe options
paste header, fix header.
Fix oep, Lordpe dump runs, Procdump one does not.
Just curiosity, compare them, differences were
raw offset and size. Manually entered ro&rs to match
va&vs in procdump, still crashes. One other difference
lordpe one now has value in pointer to symbol & number
of symbols, procdump one doesn't(what does this mean?)
So i abandon procdump one...curiosity again load exe
in imprec, one unresolved api, seems to be getprocaddress.
So, let imprec rebuild imports, and try to run, crash
page fault "module unknown" with wierd value in eax like
a6a6a6a6. Back to one without rebuilt iat. Run dumped
exe and dump first dll(is this correct, should dump dll
w/dumped exe running or original exe running, or does it
matter?) w/lordpe same options, fix oep and run, crash
in kernel32. Rebuild iat of dll w/imprec, 2 unresolved
getprocaddress & exitprocess. now it runs. but...reboot
without softice, and exe almost load, splash screen, then
page fault user32, seems to point to destroycursor. Reboot
w/softice+icedump, runs fine, ...what? What is going on
here? Unload icedump, hasp driver(or exe?) detects softice,
no run. reboot, no softice, page fault user32. Suspect
reloc problem w/dll, so attempt to load dumped dll at different
addresses w/b&e, no, even four of them at once all load
at same image base(?). so try with original dll, won't load
at all, suspect some shit in .protect section pulls the
plug. Would like to try compile dll loading source code posted
here by cyberheg some time ago, but will have to wait
until i can borrow copy of vc++.......so i have:
dumped exe+dumped dll-run if softice & icedump are loaded
original exe+dumped dll-run in any case...with 4or5 dlls still
to be dumped(ugh)
what is going on here? Last question: the iats for these dlls
seem to be in .rdata. When i look at them in softice using
loadlibrary they look strange compared to what ive read
about, the iid follow the ascii, is this possible, or am i
looking at the wrong thing?

any ideas, hints appreciated
thanks, n
dee
11-09-2003, 06:11 AM
they where are talking about the newest Alladin HASP envelope whitch one is quite different from the previous, did you are talking about the newest or previous?;)
neemous
11-09-2003, 12:28 PM
hi dee,
v. 10 or 11 i think.
Guess my main question from the chaotic post above
is can the iat have different format than what is
usual:can the iid follow the ascii, or am i looking
at a *really* trashed iat?
I still think i have reloc problem here, but am unable
to get these dlls to load at different image bases to
compare and rebuild.
n
Dimdas
11-15-2003, 02:11 PM
Hi All,
I think that new version of HASP - HASP4 has 2 new API functions
- 0x3C and 0x3D for crypting and decripting of a string. This API fn is used in protecting schemes of HASP envelope.
I don't know that anybody was able till now to find the working algorithm for this functions!!!

Any idea to solve the problem !?

Dimdas
tgodd
11-23-2003, 01:07 PM
It has been cracked.

tgodd
sope
11-24-2003, 01:03 AM
Hello tgodd

Thanks for the info. Can we know how it works or its not good to talk over it in public ? I would be interested since i use hasp4 sometimes for my own.

Regards, Sope.
TOTEU
11-24-2003, 06:54 AM
Hello tgodd
Thanks for the info. Can we know how it works or its not good to talk over it in public ?

At least two russian sites claim that they can emulate 3C/3D (polnaia emulatzia -> complete emulation).This is true because since 2001 a .by site (byelorus site) provides true hardware based copies of HASP4.
Searching through russian based forums will give you more.
(the only problem now seems it's to keep up to date with deviceiocontrol encryption flow (the so called internal API) updated with new releases of the HASP/Hardlock (mixed driver code by now).
Seems it's also a quest(..:D) because some russians know to emulate Hardlock's HL_CODE and the other team knows to emulate HASP's HaspEncodeData/HaspDecodeData and they are not willing to XCHG the routines...:D

SSPRO's sproQuery it's 100% emulated by tgodd (great work man..:D, sometimes I wish I'd know a little bit more from hardware engineer's view point, not only from the software engineer's view point, but I also know that having 10-15 years (maybe more) of dealing with HW based devices, speaks by itself ).
Also Rainbow introduced new high-level functions since 6.2 release.

Bottom line:
Dongles are not so secure as marketed, however the companies that uses them keep a good balance between legal use and illegal use, a special proportion giving them wider chances of winning market paradoxically( in other words software piracy isn't that bad as they are trying to show us).
sope
11-24-2003, 09:55 AM
Hello TOTEU

Thanks for the info. Surely Russian's are miles ahead in RE field. I do visit few forums & do came to know about what you said above. Well lets hope sooner or later we all will know the algorithm used for 3C/3D & including the hardlock HL_Code. Till then we will require the original dongle for our emulation.

Small update for people reading with interest.

The feature of Decrypting of important files at runtimes is killed itself by the maker of it. Please d/l the below file fxp://fxp.ealaddin.com/pub/hasp/new_releases/docseal/HASP_DScrypt.zip

Usage is pretty straight forward. Only important to know now is -k option which is not at all hard to find & original dongle. Now we can decrypt the files as well.

Regards, Sope.
tgodd
11-24-2003, 04:39 PM
Hello TOTEU

Thanks for the info. Surely Russian's are miles ahead in RE field. I do visit few forums & do came to know about what you said above. Well lets hope sooner or later we all will know the algorithm used for 3C/3D & including the hardlock HL_Code. Till then we will require the original dongle for our emulation.

Small update for people reading with interest.

The feature of Decrypting of important files at runtimes is killed itself by the maker of it. Please d/l the below file fxp://fxp.ealaddin.com/pub/hasp/new_releases/docseal/HASP_DScrypt.zip

Usage is pretty straight forward. Only important to know now is -k option which is not at all hard to find & original dongle. Now we can decrypt the files as well.

Regards, Sope.

I happen to know both.
Hasp4 as well as HL_Code.
Unfortuneately I am unable to share this knowledge due to Non-disclosure.

tgodd
P.S. Canuks are #1 in RE
Kayaker
11-24-2003, 11:36 PM
P.S. Canuks are #1 in RE

Lol, Oh yeah, it's a hotbed for sure. World renowned for Reverse Engineers, hockey players, lumberjacks and igloos. We keep the RCMP running in circles, eh? ;-))
sope
11-25-2003, 12:15 AM
Hello tgodd

One question a bit off topic from the subject line of this topic if you don't mind. It's regarding HL_Code. I have read on this forum that we require some 8K bytes of data from the dongle for successfully emulating it.

1. Do you rip some code then put the dongle data (8k) + crypted data & you get back the good data ? i.e. Brute Force it.

OR

2. You take the dongle data (8k) + crypted data & put in the known algorithm to get back the good data ?

OR its something else ?

I guess the answer will be second but i just want to clarify my doubts.

Regards, Sope.
tgodd
11-25-2003, 01:24 AM
Actually first off Dongle cracking started in canada back in the 80's

Now that that is off my chest.

You have to use the algorythm, or at least what is known of the algorythm to
Back calculate the 48 bits, from the encrypted access table generated by accessing the algorythm.

The Memory contents does NOT come into play.

And Kayaker Super Pro Enhanced algo is also cracked.

:)

tgodd
sope
11-25-2003, 01:49 AM
Hello tgodd,

Thank you for clarification of doubts & for the info provided.

Regards, Sope.
rozsa
12-02-2003, 02:20 PM
Hi all...

i have a similar Problem as described in this thread...
since 1 month ago i have an prog which is protected with Hasp...after reading so much tutorials and following the tips from CrackZ
downloading all the stuff from Hasp...reading and learning...i worked out the hasp routine and patched 8 files of this prog...but now i have an dll which is protected with the hasp envelope...

after reading this thread i've decided to do the same...but i can't get the OEP/EOP...

this is were i land if i bp GetModuleHandleA:

05A6A23A 0000 ADD BYTE PTR DS:[EAX],AL
05A6A23C 0000 ADD BYTE PTR DS:[EAX],AL
05A6A23E 0000 ADD BYTE PTR DS:[EAX],AL
05A6A240 > 55 PUSH EBP <----- Is this the real OEP?
05A6A241 8BEC MOV EBP,ESP
05A6A243 53 PUSH EBX
05A6A244 56 PUSH ESI
05A6A245 57 PUSH EDI
05A6A246 60 PUSHAD
05A6A247 8BC4 MOV EAX,ESP
05A6A249 A3 D4A4A605 MOV DWORD PTR DS:[5A6A4D4],EAX
05A6A24E B8 00AFA605 MOV EAX, 05A6AF00
05A6A253 2B05 20AFA605 SUB EAX,DWORD PTR DS:[5A6AF20]
05A6A259 A3 20AFA605 MOV DWORD PTR DS:[5A6AF20],EAX
05A6A25E 833D D0A4A605 00 CMP DWORD PTR DS:[5A6A4D0],0
05A6A265 0F84 14000000 JE 05A6A27F
05A6A26B A1 D4A4A605 MOV EAX,DWORD PTR DS:[5A6A4D4]
05A6A270 50 PUSH EAX
05A6A271 FF15 D0A4A605 CALL DWORD PTR DS:[5A6A4D0]
05A6A277 83C4 04 ADD ESP,4
05A6A27A E9 A3000000 JMP 05A6A322
05A6A27F 68 24AFA605 PUSH mgui.05A6AF24 ; ASCII "kernel32"
05A6A284 FF15 90AFA605 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; kernel32.GetModuleHandleA
05A6A28A A3 D8A4A605 MOV DWORD PTR DS:[5A6A4D8],EAX ; kernel32.77E40000
05A6A28F 68 30AFA605 PUSH mgui.05A6AF30 ; ASCII "user32"
05A6A294 FF15 90AFA605 CALL DWORD PTR DS:[<&KERNEL32.GetModuleHandleA>] ; kernel32.GetModuleHandleA
05A6A29A A3 DCA4A605 MOV DWORD PTR DS:[5A6A4DC],EAX
05A6A29F A1 94AFA605 MOV EAX,DWORD PTR DS:[<&KERNEL32.GetProcAddress>]
05A6A2A4 A3 E0A4A605 MOV DWORD PTR DS:[5A6A4E0],EAX
05A6A2A9 A1 9CAFA605 MOV EAX,DWORD PTR DS:[<&USER32.MessageBoxA>]
05A6A2AE A3 E4A4A605 MOV DWORD PTR DS:[5A6A4E4],EAX
05A6A2B3 C705 E8A4A605 00>MOV DWORD PTR DS:[5A6A4E8],0
05A6A2BD C705 ECA4A605 00>MOV DWORD PTR DS:[5A6A4EC],0
05A6A2C7 A1 20AFA605 MOV EAX,DWORD PTR DS:[5A6AF20]
05A6A2CC 0305 ECAEA605 ADD EAX,DWORD PTR DS:[5A6AEEC]
05A6A2D2 A3 D0A4A605 MOV DWORD PTR DS:[5A6A4D0],EAX
05A6A2D7 A1 00AFA605 MOV EAX,DWORD PTR DS:[5A6AF00]
05A6A2DC 50 PUSH EAX
05A6A2DD A1 F8AEA605 MOV EAX,DWORD PTR DS:[5A6AEF8]
05A6A2E2 50 PUSH EAX
05A6A2E3 A1 20AFA605 MOV EAX,DWORD PTR DS:[5A6AF20]
05A6A2E8 0305 F4AEA605 ADD EAX,DWORD PTR DS:[5A6AEF4]
05A6A2EE 50 PUSH EAX
05A6A2EF E8 2B010000 CALL 05A6A41F
05A6A2F4 83C4 0C ADD ESP,0C
05A6A2F7 E8 2B000000 CALL 05A6A327
05A6A2FC BE D8A4A605 MOV ESI, 05A6A4D8
05A6A301 8B3D 08AFA605 MOV EDI,DWORD PTR DS:[5A6AF08] ; 05A6B6F8
05A6A307 B9 06000000 MOV ECX,6
05A6A30C F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI]
05A6A30E A1 D4A4A605 MOV EAX,DWORD PTR DS:[5A6A4D4]
05A6A313 50 PUSH EAX
05A6A314 FF15 D0A4A605 CALL DWORD PTR DS:[5A6A4D0]
05A6A31A 83C4 04 ADD ESP,4
05A6A31D E9 00000000 JMP 05A6A322
05A6A322 5F POP EDI
05A6A323 5E POP ESI
05A6A324 5B POP EBX
05A6A325 C9 LEAVE
05A6A326 C3 RETN
05A6A327 55 PUSH EBP <----- Look similar for me to the first OEP!
05A6A328 8BEC MOV EBP,ESP
05A6A32A 83EC 14 SUB ESP,14
05A6A32D 53 PUSH EBX
05A6A32E 56 PUSH ESI
05A6A32F 57 PUSH EDI
05A6A330 A1 20AFA605 MOV EAX,DWORD PTR DS:[5A6AF20]
05A6A335 0305 E8AEA605 ADD EAX,DWORD PTR DS:[5A6AEE8]
05A6A33B 8945 F0 MOV DWORD PTR SS:[EBP-10],EAX
05A6A33E 8B45 F0 MOV EAX,DWORD PTR SS:[EBP-10]
05A6A341 8378 04 00 CMP DWORD PTR DS:[EAX+4],0

hope someone can help...and yes i searched in google and at this board :D

p.s: sorry for my english...it's very long ago since i had it in school :)
MeteO
07-22-2004, 12:32 AM
For succesfull remove hasp4 envelope set bpm esp-4 and dump all sections at 2nd breakpoint stop. Next step: set breakpoint on access to memory at import data, which points to first entry of list of used dll's. when you stop at this breakpoint, a few jumps before it you will see mov eax, [ebp+0ch], set bpm here. When you run program again you'll see Import offset.

After it, restore fixups and do not forget to remove .protect section. thats all.

Sorry for my poor language, cause english is not my native.
HarmEr
07-22-2004, 03:00 AM
For information:

Atm not need have orignal dongle, or use any Dumper tools.
Exist private tools for restore all secret data of Hasp4 dongle from envelope, and unpack it. For remove enveloppe on Celeron 1200 Tualatin need not more 20minutes.

For devellopers of sw i not recomend use Envelope, becouse it give back all secret data of H4 dongle.
MeteO
07-22-2004, 03:17 AM
Atm not need have orignal dongle, or use any Dumper tools.
Exist private tools for restore all secret data of Hasp4 dongle from envelope, and unpack it. For remove enveloppe on Celeron 1200 Tualatin need not more 20minutes.

For devellopers of sw i not recomend use Envelope, becouse it give back all secret data of H4 dongle.

alladdin always make weak dongles. I've see it at 1999 when hasp3 was complete recovered by me & Fixit.

wait for hasp5... :devil:
tgodd
07-22-2004, 01:16 PM
Hasp Emulatuion has been around since 1994.

Just stating the facts.....
MeteO
07-23-2004, 09:03 AM
But in public h3 became only at 1999, since bajunny (also russian as me) publish his research at fravia


syncronizing problem with daylight-saving-time
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > syncronizing problem with daylight-saving-time
PDA

View Full Version : syncronizing problem with daylight-saving-time

xLord
10-28-2003, 04:52 PM
Hello!!!

I want to say that its nice to be here. I have a problem which I got last weekend. You know last weekend was the switch from the day-light-saving time to normal time so this means setting clock back 1 hour.

I have 4 computers running Windows 98 on FAT32 and 2 running Windows 2000 on NTFS. When the daylight-saving-change came, all computers switched to the right time. But the problem here is that I use a syncronizing program to make sure all computers have the same versions of some files. On the FAT32 all the file times stayed the same but on NTFS all the times got back one hour. So all file times are false and I can not see which files have been changed or which one is newer in this time.

If I make a full syncronizing it will need to transfer 22GB from each computer to each other which is not very nice. I dont want to wait to next spring and setting the BIOS time different was detected by Windows 2000 and all files keeped the wrong date.

Who can help me?
Woodmann
10-28-2003, 07:02 PM
Howdy,

All the FAT32 files did not change....Hmmmmmmm
Look for a DOS command to change the file times.
I dont know if this will do what you want but there is
such a feature.
You will need to stop all actions on all the boxes so that
nothing changes while you do this.

If the DOS command doesnt work, you could also search
for a little prog to do this for you.
I am sure you are not the only person this has happened to.

Woodmann

Hold on....
Did you check to see if your version of 98 has the daylight
saving time option in the control panel ?
xLord
10-29-2003, 01:36 AM
Thank you for the answer!

My Windows 98 and 2000 computers all have the day-light-saving enabled (else they would not all switched the time when the change was). Can it be that FAT32 stores dates as hh:mm:ss and NTFS as seconds in UNIX time? Or does NTFS use no daylight-saving internal and only read configuration and show 1 more hour? All the files where modified at the time FAT32 says and not 1 hour before. This way you have 1 double hour here and one missing in spring, but I think it is more logical (to me).

I have some DOS and Windows tools to change the times but the problem is that that you can only say "hh:mm:ss" and not "one 1 back". The only programming I know from school is gw-basic (DOS 3.3), but it is long ago and Visual Basic looks so much different and gives me always syntax errors when I enter something which was acepted in gw-basic.

Is there any program out there which can change the time to be 1 hour more or less?
naides
10-29-2003, 06:21 AM
Is there any program out there which can change the time to be 1 hour more or less?

I propose an experiment:

In the Windows 2000 machines, manually adjust the system time to be one hour more (As it was during daylight savings time, and you will be reversing the change that happened last week). See if the time stamps of the files in question now look correct. If they do, then, synchronize.

Also, find out about other synchronizing software that is able to handle time changes or has options regarding time stamps.
xLord
10-29-2003, 08:22 AM
Hello and also thank you, but that did not work and should not work from my point of view. It would be bad if you had your computer off a some weeks and switch it back on and notice that the time is false by some minutes and set it correct that all files will be changed the modify time by some minutes.

I also set off the day-light-saving or changed the time zones to GMT+0 or GMT+2 but on Windows 98 it does not make any difference and on Windows 2000 it really changes (or only display?) the file times, but it then also displays the time zone on the network shares so that every file has a time 1 hour back and nothing is different in result.

My syncronizing sftware can ignore the file time, but then it only works with file size which is not aceptable since there are database files which change not the size if you delete something and the full compare will need to transfer 22GB between all computers which will mean 660GB over a 100mbit network.

Or is there a way to create checksums on all computers without transfering all over network and have them syncronized in a way? (I have a addition to Veritas Backup Exec component called SyncroGuard, which does not have this checksum or ignore 1 hour option) I find many programs which tell a program that there is a different system time but I find no one for file times. Is there such thing?
evaluator
10-29-2003, 01:14 PM
"there is time" for put 'your' {syncronizing} in trash..
Woodmann
10-29-2003, 04:55 PM
Howdy,

I will look around tonight for something to help you.

Did you check out Micro for any problems
concerning FAT32 not changing time at daylight saving time ?

Woodmann

hxxp://www.attributemagic.com/files/am_std.zip
xLord
10-29-2003, 06:21 PM
Thank you for the link Woodmann! It looks like it is just what I look for. I will also look at Microsoft to find the problem, but this program should fix my current problem now and not after a Microsoft update.

"there is time" for put 'your' {syncronizing} in trash..
I don't understand this. Do you want me to delete the old files? How do I know which files are old and which not?
naides
10-29-2003, 07:54 PM
Evaluator is pulling your leg :)


problem extract resources from exe created by meta card?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > problem extract resources from exe created by meta card?
PDA

View Full Version : problem extract resources from exe created by meta card?

thematrix
10-29-2003, 01:38 AM
how to extract resources from exe created by meta card?
i try to extract by the followwing program with no results
exescope
reshack
pe explorer
EZ Extract resources
the porgram which created is located here
hxxp://www.metacard.com
its a cross plat form multimedia creating tool i.e. its run on linux as well as windows according to the company

when i tried to extract resources i only get some icons only but i want to edit the images,string in the exe
help me
dELTA
10-29-2003, 08:20 AM
Are you sure that the images and strings are stored as PE resources? This is not the case with all compilers/linkers.

Anyway, if the exe is packed (this does also seem quite likely if you can only see some icons as resources) you will most likely be able to dump the program from memory, and then take the resources directly from the dumped exe with the tools you mention earlier (even though it might not run due to messed up IAT and so on), but there is of course ways to prevent that too if they would like to. You might have to fiddle with some PE header flags to make the tools look in the correct PE section of the dump too.
thematrix
10-29-2003, 11:18 AM
thanks for yur help

Are you sure that the images and strings are stored as PE resources? This is not the case with all compilers/linkers.
yes i am sure that resources r in exe only i checked it moving th exe from the folders it comes with

Anyway, if the exe is packed (this does also seem quite likely if you can only see some icons as resources) you will most likely be able to dump the program from memory, and then take the resources directly from the dumped exe with the tools you mention earlier (even though it might not run due to messed up IAT and so on), but there is of course ways to prevent that too if they would like to. You might have to fiddle with some PE header flags to make the tools look in the correct PE section of the dump too.
i checked the exe with peid 0.9 and it prompts it is a VC++ exe so i dont think its of use to dump it as its not packed with any protector according to peid and other tools to do scanning
resources in the exe r images,text and some resources r taken from folders it come with i am able to modify only the resources that r in the folder and able to modify those that r in the exe
pl. help me :confused:
volodya
10-29-2003, 02:04 PM
The answer might sound pretty easy.
As you might know, MOST of the packers are afraid to touch .rsrc section. This is because of the code inside oleaut32.dll - thx to M$. Therefore we may assume that resource DIRECTORY SHOULD be in resource SECTION named ".rsrc". BUT. Some packers are there to steal for example the icon from the exe-file. In this case it is a little bit harder to play around. There are some russian utilities to solve the problem. You can find them on wasm. Rebuild (recalculate) resources and your editors will be able to see them.
thematrix
10-30-2003, 11:10 AM
but i am able to see the icons and version of the exe(actuaaly it comes with a presentation CD)
then how could it be packed with a packer?
and which tool u r talking of(pl. be specific)
thanks for yur help
volodya
10-30-2003, 11:19 AM
hxxp://wxw.wasm.ru/tools/6/resrblds.zip
dELTA
10-30-2003, 07:26 PM
Packers that process the resource section mostly lift out the icons and other externally important resources to a new resource section, which might be the case for your program too.
thematrix
10-31-2003, 03:42 AM
dELTA i have looked the exe is not packed and is around 5MB
volodya i will try to work with that tool and let u know if it worked with my exe
by the way can any1 explain why tools like reshack,exescope not working with this exe(VC++) and is not pcked with any packer?
thematrix
10-31-2003, 04:22 AM
pm send to delta and vladmir
thematrix
11-01-2003, 04:15 AM
volodya i downloaded the file and it contain 3 tools i used all and all did not solve my problem all just create rsrc section to hd which i opened to see the contents i am looing which did not helped me
i of the program create a rsrc.bin which i am attaching and i did pmed u with the exe link did u see the exe?
sgdt
11-01-2003, 12:11 PM
vladimir i downloaded the file and it contain 3 tools i used all and all did not solve my problem all just create rsrc section to hd which i opened to see the contents i am looing which did not helped me
i of the program create a rsrc.bin which i am attaching and i did pmed u with the exe link did u see the exe?

Using PE Tools (or simular), what is the size of the resource section? Is it even big enough to hold these images? Have you tried looking in the section to see if the images might be in there? (using a hex editor.)

Have you tried doing an X-Ref for the blit routines, to see where they are getting their source images from? Perhaps they are just stored in a dedicated section or data section.

Even if the images are encrypted in the data section, you can trap the bit blit routines, and patch them to dump the uncompressed bitmaps to disk. Do a search for bit map routines.
thematrix
11-02-2003, 03:25 AM
i have done that but was not able to find any text i want to change.
i first open the exe in 2 programs 1 by 1
first in hiew and search for the text by pressing the F7 key with no result
then in winhex the same way but with no result
is this what u want me to do?

here is the images of some the resources i have seen by pe tools

http://www.geocities.com/thematrixzone2002/z/
thematrix
11-12-2003, 03:31 AM
here is somescreenshot which can help me more and pl.. help me
http://www.geocities.com/thematrixzone2002/1/
http://www.geocities.com/thematrixzone2002/myexe/
http://www.geocities.com/thematrixzone2002/screenshot/

pl.. help me
cuPegasus
11-12-2003, 08:17 AM
@thematrix:
... as i told you before @ board.anticrack.de, the resource section contains only RT_ICON, RT_GOUPICON and RT_VERSIONINFO. the size is fixed to CA0h in metacard files. The section alignment is 1000h. In case of that, you can use whatever tool you want, you see only this resource types...

Also i told you that the resources are QuickTime format! By showing a screenshot with ultraedit without these informations an answer is hard to find...
thematrix
11-13-2003, 04:10 AM
cuPegasus then how to edit the quicktime resources then?
i wasted 4-5 days to solve this problem and i am very irritated/confused with this problem
i opened the exe as told by u but there i dont think i can do much
how to edit quicktime resources then?


JMI, fire near you?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > JMI, fire near you?
PDA

View Full Version : JMI, fire near you?

evaluator
10-29-2003, 01:10 PM
How are you, as forests near you?
JMI
10-29-2003, 04:56 PM
Eval:

Thank you for your concern, :) but I'm several hundred miles north of where the fires are burning. California is a long state and the fires are close to the bottom, in San Diego County and east of the Los Angeles Area. We had a much closer major fire in 1992 that burned over 2000 homes east of San Francisco, in and around Oakland, California.

Regards.


sproQuery emulation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > sproQuery emulation
PDA

View Full Version : sproQuery emulation

tom
10-29-2003, 08:28 PM
Hi,

I'm quite new to cracking programs but i've read most of crack's tutorials and other stuff available on the net. After some time I succeded to crack most of the program but i'm having difficulties with one thing. The program is an mp3 player and we receive a new cd of mp3's every month. The mp3's are encrypted and the challenge is stored in the mp3, the response is suppose to come from the sproQuery command. The response is then used to decrypt the file. One advantage is that i haven't found any chalanges greater than 16 bits and the responses are 32bits. So it is possible to query all posibilities from the key and store them in a reasonable space (256K). I can't store this inside the program for the simple reason i dont have enough space for it. My idea is to store this data in a file and access it if necessary. I've written a routine and patched it into the program but softice and the current thread crash when OpenFileA is called. I'll attach the patch for sproQuery, note that only if 4 bytes are requested the read from disk happens, if 8 bytes are requested a constant is returned (this is the initialisation of the program).
Kayaker
10-29-2003, 11:21 PM
Hi

Forgive my confusion, but I'm a little confused. You mention the program crashes when OpenFileA is called, but there is no OpenFileA in your patch, did you mean when CreateFileA (or maybe ReadFile) is called, (OpenFileA is supposedly to be used for 16 bit apps only) or is there an OpenFileA call later in the program which crashes?

There are a few dongle essays by Cyberheg etc. which discuss emulating the generic sproQuery function, you may have seen them already but they might help in setting up the query/response that is apparently the purpose of this algorithm function.

For the ReadFile, you say it seems to work when requesting 4 bytes, but with 8 bytes it returns a constant or something. lpBuffer should be large enough to hold the received byte data, and in your code is defined by [ebp+arg_10]). Is this a pointer to a larger data structure or mem location defined before the call to sproQuery or just a dword variable? The same applies to [ebp+arg_C] which seems to get 2 dwords at some point. If I'm reading your code wrong I apologize. Also check if the return value in EAX from ReadFile is zero, if so the function failed but you can get more information by then calling GetLastError.

Not sure if any of this helps. Make sure the stack position in ESP is the same before and after your sproQuery function patch as well ;)

Cheers,
Kayaker
peterg70
10-29-2003, 11:43 PM
The program is an mp3 player and we receive a new cd of mp3's every month.

Who does this sort of thing? Anymore info on the software PM me the details please.

peterg70
cyberheg
10-30-2003, 02:25 AM
How about doing it the cool way?

A few years ago I got a cool idea which I just had to implement.
Since it's possible with large probability to detect all the public rnbo* functions available from their api I wrote a generic patcher which finds each of them and redirects their functionality to a dll. This was done by patching the import table to include my dll and replace the functions with jump instructions to the corresponding function offered by the dll.

After this step I built a dll which had the apropriate function prototypes and I had free hands to code my dll in whatever language (in my case C) with no restrictions on available space.

It didn't take more then a few days to make this and the nice thing is that it's generic to any app.

// CyberHeg
tom
10-30-2003, 04:59 AM
Forgive my confusion, but I'm a little confused. You mention the program crashes when OpenFileA is called, but there is no OpenFileA in your patch, did you mean when CreateFileA (or maybe ReadFile) is called, (OpenFileA is supposedly to be used for 16 bit apps only) or is there an OpenFileA call later in the program which crashes?

I'm sorry for the confusion i meant CreateFileA

Not sure if any of this helps. Make sure the stack position in ESP is the same before and after your sproQuery function patch as well

When the program starts it also runs sproQuery (returning the constant) and ESP is stays thesame.

Since it's possible with large probability to detect all the public rnbo* functions available from their api I wrote a generic patcher which finds each of them and redirects their functionality to a dll. This was done by patching the import table to include my dll and replace the functions with jump instructions to the corresponding function offered by the dll.

This really sounds like a good idea, this way it also wil be far more easy to patch a new version of the program. Are you willing to share your code?
cyberheg
10-30-2003, 12:20 PM
This really sounds like a good idea, this way it also wil be far more easy to patch a new version of the program. Are you willing to share your code?

No, why would I be? Make it a exercise for yourself. If you're serious about your work then you can't expect everyone else to do the job for you.
My code was cheaply hacked together from other projects I did in past so it's not beautiful nor bugfree. I see no reason for posting it only to get people write me mails afterwards on how to use the damn thing or report bugs which I don't care about anyway.
There are more advantages about this one and I did similar projects for other protections. Most of them I never talked to anyone about because they are really too good for "avarage joe cwacker" to use and abuse.
The word of advice is that if you want something done properly you must do it yourself.

// CyberHeg
tom
10-30-2003, 05:19 PM
No, why would I be? Make it a exercise for yourself.

Your're right it certainly wil be a good excercise, it's kind of a hobby project anyway. I've read some things about import tables after your post and although it's not really easy it should be doable. (it just takes some time)
Zaza
11-05-2003, 12:13 AM
How about doing it the cool way?

A few years ago I got a cool idea which I just had to implement.
Since it's possible with large probability to detect all the public rnbo* functions available from their api I wrote a generic patcher which finds each of them and redirects their functionality to a dll. This was done by patching the import table to include my dll and replace the functions with jump instructions to the corresponding function offered by the dll.

After this step I built a dll which had the apropriate function prototypes and I had free hands to code my dll in whatever language (in my case C) with no restrictions on available space.

It didn't take more then a few days to make this and the nice thing is that it's generic to any app.

// CyberHeg

how did you search for the library functions? did you use ida's .pat files - this is the approach im thinking of using.

My only slight concern is that i have noticed some sup3rpr0 sig files getting the library identification wrong and im wondering if rainb0w has started doing clever stuff to screw up the flirt algorithm.

Zaza

p.s. does anyone know how ida identifies variable bytes?
sope
11-05-2003, 02:12 AM
Hello Zaza

Well, if the sig file fails to recognise the function, binary search in ida for the world famous 7242 bytes & carry on the fantasy...

Regards Sope!
Zaza
11-05-2003, 07:13 AM
Hello Zaza

Well, if the sig file fails to recognise the function, binary search in ida for the world famous 7242 bytes & carry on the fantasy...

Regards Sope!
thats how i have done it manually in the past but im hoping to automate the process. Its fairly easy to recognise the functions with a bit of zen!
cyberheg
11-05-2003, 02:09 PM
how did you search for the library functions? did you use ida's .pat files - this is the approach im thinking of using.

My only slight concern is that i have noticed some sup3rpr0 sig files getting the library identification wrong and im wondering if rainb0w has started doing clever stuff to screw up the flirt algorithm.

Zaza

p.s. does anyone know how ida identifies variable bytes?

About how ida does it's stuff I think there is a document published on some of their methods. I know it has something to do with taking some bytes out and using crc16 for the rest.

My method for finding the functions was very easy. Just take a few bytes from the start of the function. How many bytes to search for depends on the api but Rainbow Tech has done nothing to obfuscate the functions.
Some sig files were wrong but thats only because they weren't generated in a valid way. I remember that I reported a bug about Killer3k's or whatever his nick is but it was just ignored and never updated. I released some files though for version 6.0 which has worked many times for me.

// CyberHeg


Who knows Anonymous Remailers!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Who knows Anonymous Remailers!
PDA

View Full Version : Who knows Anonymous Remailers!

hongker
10-30-2003, 06:19 AM
Who knows Anonymous Remailers!
Can find it there?
hongker
10-30-2003, 07:38 AM
Users who has studied Oracle encrypt the mechanism!
I find password of SYS, user of Oracle, from system form user$ already.
A section of value of word is :1B083759B6A60025
How could I solve out the password proclaimed in writing?
oracle8.0.5.0.0
help!!
Aimless
10-30-2003, 09:30 AM
Could you be a bit more specific please? Just what do you seek? If it is anonymous remailers, you are better off at:

www.searchlores.org

If you want to break Oracle, you need to ask what you want to break very clearly (or maybe its just me :()

Have Phun
disavowed
10-30-2003, 09:33 AM
Users who has studied Oracle encrypt the mechanism!
I find password of SYS, user of Oracle, from system form user$ already.
A section of value of word is :1B083759B6A60025
How could I solve out the password proclaimed in writing?
oracle8.0.5.0.0
help!!
wtf?
naides
10-30-2003, 09:40 AM
Users who has studied Oracle encrypt the mechanism!
I find password of SYS, user of Oracle, from system form user$ already.
A section of value of word is :1B083759B6A60025
How could I solve out the password proclaimed in writing?
oracle8.0.5.0.0
help!!

This is a true reverse engineer challenge.
One has to figure out WTF hongker is talking about,
then decide if you want to help him/her with an answer.
(Hope this time my post is crystal clear :))
disavowed
10-30-2003, 09:45 AM
after tracing through his nonsensical verbage several times, the zen finally hit me. i think he wants to decrypt user's SYS's oracle password.

hongker, try this: http://www.trantechnologies.com/pass_cracker.zip
Woodmann
10-30-2003, 06:05 PM
Ummmmmmmmmm.......

I dont understand the association of hacking
an Oracle password to an anon email service.

Woodmann
dELTA
10-30-2003, 07:42 PM
Come on now you negative bastards, be grateful instead, this is the first post from hongker that consists of anything else than a pure hex dump or assembler dump without any additional text at all, at least he's making progress. :D
Fake51
10-31-2003, 08:41 AM
Come on now you negative bastards, be grateful instead, this is the first post from hongker that consists of anything else than a pure hex dump or assembler dump without any additional text at all, at least he's making progress. :D

Actually, I think I kinda liked the hex dump better ... at least then, I could fool myself into believing Hongker isn't a total schmuck. Maybe next time, he will ask for hotmail pass-cracker apps ... or advice on installing keyloggers on friends computers.

Fake
Woodmann
10-31-2003, 07:26 PM
BWAHAHAHAHAHAHHAAHAHHAHAAAA.........

We all know you just sneak into your friends house
and slip that CD into the drive and have at it.
When you have finished dont forget to rename
it something kewl so he wont find out.
I like to rename my key-loggers "emkcuf.dll"

I am such a witty fucker :D

TA TA........
dELTA
10-31-2003, 07:34 PM
Any one crack help hotmail password please?

TARGET SPECIFIC CODE DELETED by JMI :p :D

dELTA - Even wittier... :D
JMI
10-31-2003, 09:39 PM
dELTA:

Sorry my half witty friend. I was FORCED to delete your target specific code as a major "hongkin" violation of them there rules. :D :D :D :cool:

Regards.
hongker
11-01-2003, 07:21 AM
If you want to break Oracle, you need to ask what you want to break very clearly (or maybe its just me )

Have Phun

I only want to understand users' materials! :p :p
hongker
11-01-2003, 07:45 AM
Actually, I think I kinda liked the hex dump better ... at least then, I could fool myself into believing Hongker isn't a total schmuck. Maybe next time, he will ask for hotmail pass-cracker apps ... or advice on installing keyloggers on friends computers.

Technology is neutral.

I hope to study what I am interested in .

But hacker rule want and observe. :cool: :cool:


help me about microdog (dongle)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > help me about microdog (dongle)
PDA

View Full Version : help me about microdog (dongle)

indian
10-30-2003, 10:00 AM
hi this is indian
can somebody please help me & guide me on how to get on the top of microdog or refer me some of great essays that explain functioning of microdog. I have come accross a local software that uses microdog(rainbow china). I am so confused that i do not understand where to start with. please help..........
Woodmann
10-30-2003, 06:18 PM
Howdy,

Find the link below for crackz site.
It will give you some information as to how/where
to start working on a rainbow dongle.

Woodmann
indian
11-02-2003, 05:09 AM
Howdy,

Find the link below for crackz site.
It will give you some information as to how/where
to start working on a rainbow dongle.

Woodmann
thank you very much sir for the help, but actually i want to know is how different i t is from sentinel ones as it uses a totally different approach
and i was not able to find any specific reference about it
Kythen
11-02-2003, 06:45 PM
thank you very much sir for the help, but actually i want to know is how different i t is from sentinel ones as it uses a totally different approach
and i was not able to find any specific reference about it

I would suggest downloading the SDK from Rainbow China's website and looking around the documentation. The process of cracking it should be pretty much the same as with any other dongle. The problem here is identifying the dongle functions inside your target, since the object files and executables in the SDK are encrypted. If you can find a way to do that, you should be just fine.
Sab
11-03-2003, 03:04 AM
O. Hm.... any other things of note about this d@nl3 kyth?
FoxB
12-18-2004, 08:08 AM
...skip... , since the object files and executables in the SDK are encrypted. ...skip...

4Kythen: May be you decrypt it? :-)
Post here MHWIN32C.OBJ, Diagnose.exe, DogEdt32.exe and GetVer.exe files.

WBR
FoxB
04-19-2005, 02:46 AM
Nothing?
naides
04-19-2005, 05:03 AM
Now, that's a patient Fox!
Woodmann
04-19-2005, 06:59 PM
No doubt about that :D

Woodmann


Pm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Pm
PDA

View Full Version : Pm

tom
10-30-2003, 10:11 AM
Is it me or a feature of the board that i get kicked out when trying to send a PM?

It also happens when i try to subscribe to a thread or post a message.
tom
10-30-2003, 11:28 AM
I got it solved, had to do with cookies coming from another host.
esther
10-30-2003, 11:29 AM
eat the cookies!!!!!!!!!!!!!!!!!!!!!!!!!

what's your fav :p
Aquatic
10-30-2003, 03:39 PM
Ginger snaps dunked in earl grey tea.


Sice detection/Unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sice detection/Unpacking
PDA

View Full Version : Sice detection/Unpacking

naides
10-30-2003, 08:15 PM
I am trying to understand and manually unpack ceratain app.
Before sending me to search the board, please read:

The application's executables are encrypted and packed to a certain extent. I explain, if I dissasemble them with IDA or Windasm, I can still see most of the resources, dialogs, which do exist inside the app, but no import or export functions and the code looks like garbage.

I have scanned the .exe with all the file analyzers I have been able to find and, while they report the file is packed, do not find typical signatures of commercial packers, so I may assume it was crypted/packed by the coders. I have nil expirience with packed programs (so far I never needed one) so I cannot recognize code patterns.

The big problem with trying to manually unpack is debugger detection.
The program quits silently when Sice is active, or is loaded to Olly, or pretty much all the debuggers I have tried.
I systematically tried all of the Sice hiding tools that one time or another have been mentioned here, including the Sice 4.27 patch that Nikola posted, and have come out empty handed.

I eventually moved the application to a Win98 machine and used FrogIce to catch at least some of the Sice detection tricks. FrogsIce reports:

Code 07
=======

Method of detection of the WinICE handler in the int68h (V86)

mov ah,43h
int 68h
cmp ax,0F386h
jz SoftICE_Detected

My question to a good soul in here is, how can I use this information to bypass the Sice detection?

I have traced with Sice from the entry point, and the code is a mess: Self generating, obfuscated with a bunch of jmps and conditional jmps into the middle an instruction bytes, which changes the meaning of the dissassembled code on the flight, etc, so I stand little chance of finding in the dead listing some int 68 call or a pettern of bytes consistent with the code snippet above.

a BPint 68h does not work in Sice.

The solution may be obvious to someone by I don't get it.

Thanks
Manko
10-30-2003, 11:58 PM
Hi!

You tried iceext? (I haven't but they say it is good...)

/Manko
naides
10-31-2003, 01:20 PM
Hi!

You tried iceext? (I haven't but they say it is good...)

/Manko

I tried Iceext. It hides Sice as long as I do not break inside the program.
As soon as I break and try to trace, it "realizes" Sice is up it goes towards "quit" procedure.

Sounds familiar to anyone?
evaluator
10-31-2003, 03:03 PM
well, your solution can be: unhide protector for us.
naides
11-01-2003, 07:32 PM
well, your solution can be: unhide protector for us.
By looking at the files it wrote on the disk, it looks like C-dilla.
What has me out of a fighting chance is my inability to use a debugger, or even when the debugger is hidden, tracing.
What I want to do is defeat this sucker, because it Fucked up my system. I been trying to restore my Double boot all day long!!!!.

This thing wrote to my partition/boot record and messed up every thing, and I, trying to fixing it, fucked up what good things were left.
SO IT IS PERSONAL

I don't care about the software that much. Only get those suckers exposed!!!
nikolatesla20
11-01-2003, 10:12 PM
There are only a few more checks a process can really do to detect a user mode debugger -

The one to look for that might be being used against Olly is NtQueryProcessInformation(), when you pass in a 7, I think, it's PROCESS_DEBUG_INFO..which will return the process debug port. This value will be nonzero if the process is being debugged. So check into that function. I don't have the details since it's been so long since I've played with that..

Also, some programs check for a parent process that is running them. Check for functions which list processes. NtQueryInformationProcess() for example. (Or the toolhelp functions Process32Next, etc). Other programs will check for Olly's window.

SoftICE can still be detected via int3 on UnhandledExceptionFilter even with my patches I don't think I patched that since it leaves trace messages everywhere...

If the protector uses a system driver, it can look at the debug registers and check if they are set a certain way, this detects SoftICE as well then. ALso you HAVE to patch INT1 in the IDT table by resetting its Privilege level back to normal (SoftICE sets the level for itself).

You can find info on how to both of the above items by searching the board. I'd tell you here but it's seriously been too long for me - I've been working on compilers and virtual machines lately...

-nt20
evaluator
11-02-2003, 02:40 AM
hey, you are about MM program!?
(i just say about it in offtop)
Kayaker
11-02-2003, 03:04 AM
Hiya,

You're right nikola that one can check the parent process to see if it's a debugger running you. One way is to check the InheritedFromUniqueProcessId field of the PROCESS_BASIC_INFORMATION structure.

I've got an unfinished project where, if I detect Olly or other Win32 debugger, I create a remote thread in the debugger with PsCreateSystemThread, then use a shared Kernel/User Named Event (using IoCreateNotificationEvent) to signal the thread from usermode (after cleaning up and closing my own driver) to terminate Olly (the remote kill thread is waiting indefinitely on a KeWaitForSingleObject).

I was going to publish this in a "stupid driver tricks" post at some point, but I don't mind discussing anti-cwacker tricks, so here's a few snippets (without what should rightfully be a full explanation), just for fun ;-)

;========DebuggerCheck=================
DebuggerCheck proc

lea edi, pEventObject_ATTRIBUTES
lea esi, pCLIENT_ID

; initialize OBJECT_ATTRIBUTES and CLIENT_ID structures
assume edi:ptr OBJECT_ATTRIBUTES
mov [edi].dwLength, sizeof OBJECT_ATTRIBUTES
mov [edi].RootDirectory, 0
mov [edi].ObjectName, 0 ; can set to object name if
; ClientID.UniqueProcess not used
mov [edi].Attributes, 0
mov [edi].SecurityDescriptor, 0
mov [edi].SecurityQualityOfService, 0

assume esi:ptr CLIENT_ID
invoke PsGetCurrentProcessId ; This is OUR PID
mov [esi].UniqueProcess, eax
mov [esi].UniqueThread, 0

invoke ZwOpenProcess, offset hProcess,\ ; OUT PHANDLE phProcess
PROCESS_ALL_ACCESS,\ ; IN ACCESS_MASK AccessMask
edi,\ ; IN pEventObject_ATTRIBUTES ObjectAttributes
esi ; IN PCLIENT_ID pClientId

invoke ZwQueryInformationProcess, hProcess,\
ProcessBasicInformation,\ ; ntddk.inc ; enum _PROCESSINFOCLASS
offset pPROCESS_BASIC_INFORMATION,\
SIZEOF pPROCESS_BASIC_INFORMATION,\
offset ReturnLength

;=======================================
; CHECK 1
;--------------------------------------------------

mov eax, pPROCESS_BASIC_INFORMATION.PebBaseAddress
bt dword ptr [eax], 16
; Bit Test to see if BeingDebugged flag is at byte 002 of PEB
jc @F
jmp nodebugger
@@:

;=========================================
; CHECK 2
;-----------------------------------------------------

mov eax, pPROCESS_BASIC_INFORMATION.InheritedFromUniqueProcessId
; If being debugged, this will be the Debugger PID,
; if not, this will be a non-valid system PID
; (unless this is a child process)
; the trick now is how best to confirm this
; (ZwQueryInformationProcess or ZwOpenProcess
; could be used..)

; left as an exercise ;-)

; If PID confirmed as belonging to debugger:

mov [esi].UniqueProcess, eax
; redefine CLIENT_ID to that of the debugger PID

invoke ZwOpenProcess, offset hDebuggerProcess,\
PROCESS_ALL_ACCESS,\
edi,\
esi

;--------------------------------------
; Now that we have the handle to the Process (in this case the Debugger)
; create a remote kill thread in the (suspended) target
; with PsCreateSystemThread.
; This thread will be signalled with an Event once we return
; to Usermode and clean up and unload our driver.
;--------------------------------------------------------

nodebugger:

assume esi:nothing
assume edi:nothing

mov eax, STATUS_SUCCESS

ret
DebuggerCheck endp
;================End DebuggerCheck==================

In User mode you can also use RtlQueryProcessDebugInformation with the PDI_MODULES flag to some advantage to get at the very least the ImageName of a process (via the DEBUG_MODULE_INFORMATION aka SYSTEM_MODULE_INFORMATION structure) to confirm the presence of known debuggers.

'nuff for now.

Kayaker
Zwyzum
11-02-2003, 07:37 AM
Hi.

<commercial>

I usually avoid dealing with anti debugging tricks as I am not interested in countermeasures. I'm presenting a different solution in the thread I started a couple of days ago.

</commercial>

Bye
Zwyzum
naides
11-02-2003, 08:17 AM
hey, you are about MM program!?
(i just say about it in offtop)

I f I understand you correctly, MM is not the program I am trying to break.
I think it is against THE RULES to mention my target here, but if you are interested, I can PM you a link.
Notice that I am not asking any one to take a look or crack it for me. . .

Nikola, Kayaker, evaluator and Zwyzum, thank you for your answers, you ceratainly give me quite a bit of leads to explore.

I will post it if I find any thing interesting.
JMI
11-02-2003, 12:22 PM
naides:

It's not against the rules to "identify" your target. It's against the rules to post target specific code "after" identifying, or which "identifies," the target.

The general point of the rule is to attempt to prevent the posting of target specific code which would permit others to take that code and make a specific target work without its protection system, whatever that may be. It is such posts that tend to draw accusations of permitting the posting of "cwacked" software or "cwacks" and lead to complaints to our host seeking to have the Board taken off the host.

In your case, posting a piece of code which seems to detect a debugger, would not seem to provide anyone else a method of simply plugging in your code and getting a working verson of the software. Identifying the target for others to look at still would not provide a working program. Even identifying "how" the software detected the debugger would not, itself, give that solution. One would still have to use the debugger themselves to work through whatever is protecting the code.

This is intended to be generic, rather than specific. Hope it makes it somewhat more clear.

Regards.
evaluator
11-02-2003, 01:54 PM
I did some tests.
Seems it detects debuger(ntice) by driver name, but not CreateFileA.
(maybe CreateFileW or NtCreateFile?)
tommorow will look closer..

On my Xp I had renamed 4 drivers names, so it not detects.
evaluator
11-02-2003, 03:47 PM
nop, i found only \\.\Ntice detection via CreateFileA, not other..

MM means Macr0Media, then it's products are DW, FW, FH, AW..
currently I'm on FW.
SiNTAX
11-03-2003, 08:10 AM
There are only a few more checks a process can really do to detect a user mode debugger -

The one to look for that might be being used against Olly is NtQueryProcessInformation(), when you pass in a 7, I think, it's PROCESS_DEBUG_INFO..which will return the process debug port. This value will be nonzero if the process is being debugged. So check into that function. I don't have the details since it's been so long since I've played with that..
...
-nt20

SD uses secdrv.sys to pass the clock back to the main exe.. so you have to fix that check too. Don't know about safecast, but I heard it's pretty much the same as the SD targets. (NOTE: you only need to fix this one if you want to use Olly as this has no effect on NTICE)
doug
11-03-2003, 11:20 PM
By looking at the files it wrote on the disk, it looks like C-dilla.
What has me out of a fighting chance is my inability to use a debugger, or even when the debugger is hidden, tracing.
What I want to do is defeat this sucker, because it Fucked up my system. I been trying to restore my Double boot all day long!!!!.

This thing wrote to my partition/boot record and messed up every thing, and I, trying to fixing it, fucked up what good things were left.
SO IT IS PERSONAL

I don't care about the software that much. Only get those suckers exposed!!!

c:\C-Dilla + writting to boot record? that sounds very much like safecast (or safedisc hd). And I think their main license checking exe file is protected by safedisc. Check your temp dir.. clean it up, then launch the program, check what's unpacked in there.


RegClean craps out on Win2K?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > RegClean craps out on Win2K?
PDA

View Full Version : RegClean craps out on Win2K?

Kayaker
10-31-2003, 02:13 AM
This is a bit of a long shot, but...

I've been running Win2K sp3 for a while and figured it was finally time to run Microsoft's RegClean 4.1a on my system. Knowing M$ is so well renowned for its wonderful, stable, bug-free software (tongue firmly implanted in cheek), I wasn't expecting any problems. You can imagine my surprise then when it continually crashed part way through its analysis.

No problem, Dr. Watson to the rescue (now that *is* a handy util). It reliably told me that RegClean had crashed (duh) and gave a nice stack dump and faulting address.

0043c578 8b7c240c mov edi,[esp+0xc]
0043c57c 8bf1 mov esi,ecx
0043c57e 8b07 mov eax,[edi] <--FAULT

This code is called continually, edi being various address pointers to string values from the registry. Using an IF statement in Softice I was able to break just before the crash and found that [esp+0xc], instead of containing an address pointer held the value "4". Of course this caused a C0000005 access violation.

With the error being tied so closely to ESP, and the fact it occurs after many, many iterations of the above code, though always at the same point with the same stack dump values, I sense it's a stack buffer overflow thingy kind of problem. Something you can see in your own code if you don't balance the stack, it will run OK for a while then inevitably crap out on you.

I'm not really expecting a solution, it's probably just my dumb luck it's happening, this is more of a misery-loves-company kind of post. The only wild thought I could come up with was that having the Win2K Debug symbols installed somehow affected the Regclean operation, but I suppose it could be anything. Regclean comes with an OLE library update for early OS systems, but I'm averse to running these 1996/97 dll files.

Has anyone experienced any problems running RegClean on Win2K? (No, of course not you sap :rolleyes:

Kayaker
Aimless
10-31-2003, 02:25 AM
This is so bitter of nature. Some lucky people get to see only a stack dump.

I tried the regclean and it crashed my OS. Huh? That's right. Crashed. The remote recovery would'nt work.

Some guys have all the luck. *Mumble*

Have Phun
Woodmann
10-31-2003, 07:15 PM
So you just have to learn the hard way :eek:

From what I have experienced, MS system utilities
either dont work/lame or they surprise you with some
random lovely gift you get to play with while praying
the whole damn thing doesnt implode.

I would imagine this happens because of certain
programs running in the background ????

Woodmann
JMI
10-31-2003, 09:34 PM
Kayaker:

You may vaguely recall you wrote a program to parse regmon for us, inspired in part by my wining about having to review 20,000 lines of regmon code to find where ASPR was putting its registration information in a particular target. At the time it was hiding it inside the CSID of other programs and searching through nearly the whole damn registry to find a suitable candidate.

You may, or may not also recall that I reported that RegClean would successfully remove that registration information, where ever ASPR had hidden it. The point here is that, at the time I was also running Win2K sp3 and had no problems at all with RegClean on my system. I can't duplicate that condition at the moment, because I'm now running XP Pro, Sp1, but, as Woodmann suggested, I would concur that it is most likely the result of something else running in the background, rather than Win2K sp3 vs. RegClean itself. Don't expect that is any comfort, :rolleyes: but it might suggest looking for something other than the OS as the point of conflict.

Regards.
Kayaker
11-01-2003, 01:35 AM
Well, thanks for the feedback, I tried various options such as disabling every service/process I could, running in Safemode, using the command line switches (regclean /?) etc, etc. No dice.

There is of course a KB article with the disclaimer:

Microsoft Knowledge Base Article: 172575 - When you run RegClean version 4.1 in Windows NT 4.0, you may receive the following error message: Application Error RegClean.exe Exception: access violation(0xc0000005), address:0x00414053 This error message occurs because RegClean version 4.1 is not compatible with Windows NT 4.0.

This should maybe be changed to include "may or may not run on any particular computer depending on the phase of the moon, imminent solar flares, or other whims of nature or system configuration, nor do we care diddly squat". I guess I join Aimless in the ranks of the screwed and tatooed when it comes to Regclean... oh well. Not sure if it's worth the effort to reverse it further if it's a stack issue.

Btw, to JMI and other XP users, there was a mention about Regclean working OK on XP, if you boot in "Win98 compatibility mode". (?) This option seems to be missing on Win2K methinks.

Regards,
Kayaker
esther
11-01-2003, 01:27 PM
Hi Kayaker,

It works perfectly on my win2k pro sp2

no errors

Regards
Kayaker
11-01-2003, 02:55 PM
Hi Kayaker,

It works perfectly on my win2k pro sp2

no errors

Regards

Phthfffth...

I think that's how you spell it :D
JackD
11-01-2003, 06:18 PM
Phthfffth...

I think that's how you spell it :D

Kayaker,

Runs fine for me on W2k SP3 & SP4, & XP. I had the same problem on my W2K SP3 machine and discovered it was due to some Reg entry that was too long or contained code RegCleaner didn't like. Resplendent Registrar ran fine on that machine, cleaning the offending Reg entry, and then RegCleaner would run just fine again.

JackD
Kayaker
11-02-2003, 01:25 AM
Bingo! Thanks for the heads up JackD. Taking another look at things, I had previously run Regclean with the command line option /L (log activity to file), but hadn't realized that it actually creates the logfile runtime, so even with the crash there was a record of all the reg entries it had looked at, the last being the crash culprit...

As it turns out there were 9 reg entries which referenced an icon file in C:\WINNT\Installer\ {7FC0D670-057F-4D50-A7B8-2CA291360708}\, i.e.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AWFile\DefaultIcon]
@="misc.exe,6"

There are 2 problems with this. One is that the icon file is not called 'misc.exe', for some reason it's stupidly named misc.exe.D0DF3458_A845_11D3_8D0A_0050046416B9.exe. The second problem is that the full path to the icon wasn't given, and for some reason this also made Regclean choke on each reference to it. Editing each reg entry string "misc.exe" to the full path/filename was enough to allow Regclean to continue.

This doesn't mean the problems stopped though. There were 3 other faulty reg entries, and in each case it was because the file didn't exist or the pathname was incorrect. This is kind of weird though, I thought the whole point of Regclean was to pick up and/or fix these faulty entries, not crash on a mere syntax error. For the record, here are the other entries, the reason for the crash, and the solution:

----------------------------------------------------
[HKEY_CLASSES_ROOT\CLSID\{42071714-76d4-11d1-8b24-00a0c9068ff3}]
@="Display Panning CPL Extension"

[HKEY_CLASSES_ROOT\CLSID\{42071714-76d4-11d1-8b24-00a0c9068ff3}\InProcServer32]
@="deskpan.dll"

PROBLEM: deskpan.dll didn't exist on harddrive
SOLUTION: change Default value to @=""
----------------------------------------------------

----------------------------------------------------
[HKEY_CLASSES_ROOT\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}]
@="BDA Device Control Plug-in"

[HKEY_CLASSES_ROOT\CLSID\{B0693766-5278-4ec6-B9E1-3CE40560EF5A}\InprocServer32]
@="CaPlgin.ax"

PROBLEM: CaPlgin.ax didn't exist on harddrive
SOLUTION: change Default value to @=""
----------------------------------------------------

----------------------------------------------------
[HKEY_CLASSES_ROOT\CLSID\{D61A27C6-8F53-11D0-BFA0-00A024151983}\LocalServer32]
@="%SystemRoot%\\system32\\regsvr32.exe"

PROBLEM: The phrase %SystemRoot% not recognized by Regclean
SOLUTION: change Default value to @="C:\WINNT\system32\regsvr32.exe"
----------------------------------------------------

This last one really gets me - an MS app doesn't recognize what the hell "%SystemRoot%" is??
Gimme a break Bill, lol.

After manually making these syntax changes, Regclean ran without crashing and fixed up a bunch of things. I'm a little dubious about the results though because now when I run it on the "clean" registry it picks up the same 154 "faulty" entries each time (mostly CLSID and TypeLib entries), but doesn't make any hard changes to the registry.

What I'd recommend then to anyone experiencing similar problems is to run Regclean with the /L option, check the last entry in the log and fix it manually until Regclean runs without crashing - then delete the program and go out and buy some other Reg cleaner :D

Thanks for the help.

Cheers,
Kayaker
esther
11-02-2003, 09:29 AM
Phthfffth...

I think that's how you spell it :D

yakerKa thats the correct spelling :p


A - maybe - new approach to Import Section Rebuilding
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A - maybe - new approach to Import Section Rebuilding
PDA

View Full Version : A - maybe - new approach to Import Section Rebuilding

Zwyzum
10-31-2003, 10:43 AM
Hi everybody.

I'm a new member of this forum, though I've been reading essays on Fravia's old site for a while. I'm quite interested in unpacking techniques and in import section rebuilding especially.

Last year I built a tool who was able to almost fully reconstruct import sections packed by Asprotect (which I explicitly chose as my target). I know it's not a great deal, but I think the technique I used might be interesting to somebody. Briefly, I used a post-mortem approach together with a peculiar environment replication - that's the way I call it - technique.
I suppose somebody would like to know why I didn't release my tool: well, it required a whole lotta manual text files formatting to get it to work properly.

I'm working on a usable version now, and I'll be glad to give further details if somebody find it interesting.

Thanks
Zwyzum
dELTA
10-31-2003, 10:59 AM
Yeah, sure, new ideas are always fun to hear, feel free to post more info about it here.
Manko
10-31-2003, 11:35 AM
I agree! Wanna hear more! :)

/Manko

Yeah, sure, new ideas are always fun to hear, feel free to post more info about it here.
LOUZEW
10-31-2003, 11:59 AM
Welcome !
I'm waiting for these new infos and techniques ! !
Zwyzum
10-31-2003, 06:07 PM
Hi there. I promised I would have given details on demand (thanks dELTA).

I hate messing with running stuff. I always preferred a more relaxed way of doing things and also I hate that time when I blissfully debugged for 10 hours in the night because damn-ICE stopped my clock.

The approach I am to show may seem unnecessarily complex, but it gives you
the chance to experiment without constraints, and I believe this to be its most pleasant advantage.

I talked about something I called environment replication. The main idea is to artificially build an environment which is theoretically identical to the one the target really lives in, and use it to the purpose. Really, this replicated environment would be identical to its original one to the extent which is needed.

For instance, when I used this approach against ASProtect in order to rebuild the import sections it had destroyed my environment was made of a few memory dumps from the running target, as follows:

* dump of what I called (import) thunks array: it's an array of pointers (well, an array of consecutive zero-separated arrays of pointers) to the thunks of code ASProtect uses for redirecting the API calls made by the target application to the true API implementations. I found this array was always located in the PE section following the code section, maybe where the original import section lay. Also, it resembles the standard IAT of a bound PE file.

* dump of the thunks of code pointed by the entries of the import thunks array. These thunks were always contained in two or three larger chunks of memory, which base addresses could be trivially identified by looking at the array entries themselves. This even allowed me to dump both the array and the thunks in a single run of my favourite debugger, thus gathering all I needed.

* dlls loaded by the target. I'm sure everybody knows how to get a list.

Once these elements are gathered, they can be loaded at their original addresses in a dummy process to obtain the replicated environment.

I think this message is long enough for any messageboard, so I'm to talk more diffusely about the structure of this dummy process next time. Please let me know what you think.

See you
Zwyzum

To Manko: I didn't know about your tool, so I'm to study it now.
dELTA
10-31-2003, 07:26 PM
Sounds like an interesting method, and it will be even more interesting to hear the next part. :) Tools like Revirgin also had a quite advanced semi-generic emulation of the redirect code I think, but it will still be nice to hear about the pecularities of your method, I'm sure it differs in many interesting ways, judging from what you have told already.
Bengaly
11-01-2003, 04:53 AM
actually the Idea it self is not new at all.
while we Don't use it, Some AV Softwares does.
They create an isolated Enviorment Load the target and play with it, while the target thinks it's damaging the host computer, the AV still analyze it and kick it, it may fail, may succede depend on what you analyze ;)
i guess mabye some AVs tries the same on identifying a aspx protected viruses.
Zwyzum
11-01-2003, 05:39 AM
Hi.

I really appreciate your statement about AV software using this environment replication approach. As I wasn't sure it was my invention I wrote maybe in the title of this thread.
However, you say these AV tools let virii think they're running in a true environment. But as we are concerned in import table rebuilding this is unnecessary. In fact, we don't need the real target at all. I love to keep things simple: the proper stub - together with a debugger - will make the trick.

Bye
Zwyzum
Zwyzum
11-02-2003, 10:57 AM
Hi.

Here's the continuation.

After I decided to replicate the environment the target lives in and discovered
that the technique could be applied to my ASProtected target, I stumbled upon
the problem of how I should execute the import thunks. I admit my first thought
- please notice it was just a thought - was to build an x86 emulator. I still
remember that with laughter. Luckily I am the lazy type, so I didn't started to
code what could only have been a disaster.
Rather it came to me the idea to use a simple stub to simulate the real target, then let it execute the thunks. This way I would have used the x86 itself as an emulator, though it meant I had to control the execution using a debugger. However, provided you have a decent knowledge of how code execution takes place on the x86 and you - as I did - haven't sophisticated debugging needs, Win32 API set makes this task relatively easy.

The stub I needed was to accomplish the following tasks:

* to load dlls used by the target process
* to map every memory block I dumped from the target process
* to execute an import thunk in single stepping mode, so the debugger could catch exceptions and perform analysis

I think the only interesting step is the last one, for which I used the
following rough approach:

1) the debugger notifies the stub of the address to which transfer execution
2) the stub enters single stepping mode, allowing the debugger to know where to return execution after processing
3) the debugger processes debug events until eip lies inside the address space of some module
4) the debugger resolves the import at that address using a heuristic technique
5) the debugger makes the stub return at the address following the API call

Some particular cases must be considered:

* it may happen that eip never steps in the address space of a module: this
means the API call is being emulated by the protector. I decided to ignore the
problem since it is limited to a handful of simple property accessors that I
could fix by hand. I must note that the emulation of GetProcAddress made by
ASProtect is a funny exception.

* some APIs may be redirected: in this case my tool would return the entry
point of the real implementation. Just a few functions behave this way (like
the Rtl* ones in NTDLL.DLL redirected by KERNEL32.DLL), and this thing is not
depending from the protector at all. I ignored this harmless case for laziness.

* some thunk can use a countermeasure consisting in emitting a call to a
different API function before the call to the real one; ASProtect uses
GetModuleHandle to this purpose. Since my algorithm stopped at the first API
call it met, it could have been fooled. I've got two sound reasons to ignore
this case, too: the former is that it's easy to detect and fix since you see a
lot of GetModuleHandle's; the latter is that ASProtect randomizes the code in
its thunks so bad that in most cases they are plain vanilla ones. So, rather
than prepare a counter-countermeasure I preferred waiting for a case my code
could handle.

Two of these special cases can be solved using simple exact or heuristic
techniques. The latter is difficult since it requires the ability to bypass
API calls before getting to the right one. Breakpoints can be a solution.

All I wrote till now is related to the experience I made one year ago, and my
tool provided me almost complete solutions to ASProtected imports. However,
since I downloaded Manko's AsprDbgr I'm wondering if it would be still valid
now. Manko's code - besides being a bit spaghetti - seems to be some MUCH
more complex than mine.

Can anybody tell which tricks I'm unaware of?

Bye
Zwyzum


PVDasm v1.04
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PVDasm v1.04
PDA

View Full Version : PVDasm v1.04

Bengaly
11-01-2003, 10:51 AM
Heya Guys,

Here is a newer Release like i suggested ;)
No Matter if you like it or not, please feel free to Speak whatever on your mind.

New Stuff (From ReadMe)

* Debug Window is now Dock-able (Via ToolBar or Menu).

* Searching Withing the Disassembled code is no availble (be sure to check 'Match Case').

* XReferences is not supported, if an address is being Refferences from another,
ToolBar Control will be availble, or a message will be writetn in the DebugWindow.
Press Ctrl+Space, ToolBar Control or double click the Address to view XReferences to selected line,
The Window of xreferences will be opened accouring to your Mouse Pointer Position!,
idea came from the intellicase window, I kinda like it ;).

* HexEditor - AddIn Created for RadASM (By KetilO) Has Been 'Converted' By Me to,
be Used Inside VisualC++ (For VC Example Check: hxxp://radasm.visualassembler.com/projects/CustDemo.zip).
If AddIn Dll is not found in the AddIns\ Directory, you will not be able to access it via Proview (Run-Time).

* String Refferences & Import Refferences Dialogs has been Changed, now you can perform,
Better Search Within Them, and view 'more' Information rather than using a simple ListBox ;).

* Disasm Bugs Fixes (Those who has been reported.)

* Added Few More Seh Frames to avoid Crashes.

* CodePatcher - Added Inline code patcher with Assembly Preview (After Patch) in same window.
After Patch has been complete you can or not ReDisassemble your Project in order to see,
Changes, iv done it beccause i want to avoid MisData information when patching new bytes,
So better keep stuff linear insted of curved ;) (PV is pretty fast to do ReDisassemble anyway hehe).
Access it by Double Click on Opcodes Culumn, ToolBar or Menu.

* Gui Fixes/Edits (also fixed the bug in the disassembly appearance for the background color)

Click on the www image of my profile to download latest PVDasm - Thnx

-Bengaly 2003
Polaris
11-01-2003, 12:24 PM
Thanks mate, your project seems to grow really the right way! Keep working!
Bengaly
11-15-2003, 03:49 PM
hi,

new stuff added, check it out.
here is the official page for PVDasm: hxxp://pvdasm.anticrack.de/
enjoy.
squidge
11-16-2003, 06:11 AM
Seems to be coming on quite well, although sometimes EP is not shown as you regard it as being in the middle of an instruction, and the same with a lot of the calls, jmps in the program which are really perfectly valid - they just been disassembled wrong.

Maybe you need to adopt an IDA-style of disassembling, by running the code virtually to see what is code and what is data, and allowing the user to override?
Bengaly
11-16-2003, 11:19 AM
hi squidge,

Yes i know his problem well,
thats why i added a 'force disasm' xx bytes before EP.
the default is to stop 1 instruction before the EP.
increasing this value will give a better result on invalid with 1 distance.
just to keep disasm bit aligned.
Bengaly
11-17-2003, 04:04 PM
Maybe you need to adopt an IDA-style of disassembling, by running the code virtually to see what is code and what is data, and allowing the user to override?

this is definately a problem arises.
coding a good&fast algorithm for code blocks isn't that easy.
1 way is jxx tracing and isn't very safe.
i am currently looking for some ideas, if u got some plz write it down,
mabye other members know some info.

for those who dunno what we talk about really, this will give ya the idea:

The assembler fills in these gaps by some random (or irrelevant) value since these locations are never executed. The problem is that there is no way to distinguish data from gaps within instructions. If the normal process of disassembly is allowed to take its own course by treating these gaps as genuine code, the opcode alignment may be destroyed. Once misaligned, there is no way to recover and we may get unreliable disassembly. Thus it is absolutely essential to prevent the processing of such gaps. We do this by identifying the basic blocks in the code section. Each basic block constitutes a valid address range in the .text section. This is achieved by making one extra pass of code analysis on the .text section. Thus our disassembler is a two pass disassembler.


question about rebuilding IT of dumped program (finding/fixing unresolved)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > question about rebuilding IT of dumped program (finding/fixing unresolved)
PDA

View Full Version : question about rebuilding IT of dumped program (finding/fixing unresolved)

axle
11-01-2003, 09:25 PM
Hi

I wonder if anyone could answer a question for me.
After you've dumped a program that you're trying to crack, and now you're using ReVirgin or ImportREConstructor to rebuild the import table, how exactly do you go about fixing any unresolved import functions? I've tried to find an answer to this question but have been unable to. (At least one I could understand).

thanks for any help anyone can give me.
nikolatesla20
11-02-2003, 09:38 AM
What I usually do is note down the address that ImpREC says the import is in the table.

Now, run the program again, and go into SoftICE. Switch to the program's context using the ADDR command in softice (ADDR <processname>). Then go to the address that ImpREC reported (DD <address>). The value you now see in the data window at the first location on the top left is the value stored at the location ImpREC reported. This is ANOTHER address, which points the the "imported" function. However, it probably points to a protector routine instead.

So, just go to THIS address now, so you can see what the code looks like. If it's not being resolved, it's obviously another type of routine in the protector, right? Well, you can just look at the code and figure out where it goes eventually !

Do a (U <address from import table>). Now you're looking at the code thats gets called when this import runs. How does it look? Does it jump somewhere else? Does it simply move in a value from another memory location and return? Having some knowledge of ASM is necessary for this work. If it's moving a value in from another location you can sometimes just (DD <location>) to see what the value is. From that you can extrapolate what the routine should be, most windows API's, like GetCurrentThreadId(), return a specific value. For example, suppose you see a weird value. It COULD be a value from GetCurrentThreadId(). Well, you can type the PROC command in SoftICE and it will list all processes and their thread ID's - so you can see what your program's thread ID is and compare it with that value you saw to see if that's what it is! That's just one example. To find out if it's the GetCommandLine(), simply follow the value one more time like it's an address (cause GetCommandLine returns a pointer). Type in (DD <value found again>) and see if you land in a text string for the command line. If so, the API should be GetCommandLineA(), etc.

Note the above examples are for when the "Import" is simply a register or memory value being moved into EAX and then returning. If not, you can look at the ASM and figure out what it's doing before the routine does a RET. Some routines, you can simply look at the last API called before the RET. Others calculate where to go, so you have to grab a hex calculator and figure out where it's gonna land.

Those are the techniques I use all the time for unresolved imports.

-nt20
axle
11-03-2003, 02:51 PM
hey nt20

Thanks alot for the help....I'll try out your suggestions
forwarder
11-03-2003, 11:41 PM
@nikolatesla20: thanks for the very informative reply to axle's question, i just added it to my FAQ snippets - i never read any better explanation for that topic.


help in unpacking asprotect(alomst completed but hanged in between)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > help in unpacking asprotect(alomst completed but hanged in between)
PDA

View Full Version : help in unpacking asprotect(alomst completed but hanged in between)

thematrix
11-02-2003, 11:39 AM
i am using Asprotect Debugger v1b, stripper 2.03 and Import REConstructor v1.4.2+ to unpack a file packed with (ASProtect 1.23 RC4 Registered -> Alexey Solodovnikov)

1st i started Asprotect Debugger v1b and run the target.exe in it it ask for the following message which i Ok'ed everyone

DO you wish to resolve/clean IAT?Yes
Undipped condition.(Dump?)Wish to some dips?Yes
Erase dip: 423A1C?Yes
Erase dip: 423A0C?Yes
Erase dip: 423A2C?Yes

after these message the program loads and debugger said application paused! twice and then

2nd.I fired up the Import REConstructor v1.4.2+ and choose the target.exe them click on IAT Autosearch,then get imports and then Imported Functions where all valid and then i click on fix dump and choose the dump.exe file which i created by stripper 2.03 and Import REConstructor v1.4.2+ said succesfully created dump_.exe
i was joyed that the exe is unpacked but on starting the dump_.exe file it did nothing on Win XP and in Win98 it prompt the following error

linked to missing export KERNEL32.DLL:RestoreLastError.

is it fine if i give the program name and link which i am unpacking?

here is some images of the exe in IR,debugger to see the detailed info
it will show a directory with images
http://www.geocities.com/thematrixzone2002/asp/

thanks
diz
11-02-2003, 05:47 PM
i was joyed that the exe is unpacked but on starting the dump_.exe file it did nothing on Win XP and in Win98 it prompt the following error

linked to missing export KERNEL32.DLL:RestoreLastError.

I remember that when I was doing some target I replaced this function with SetLastError. This program is working good till now :)

I searched then (when I was doing this target) for some info on RestoreLastError and found almost nothing. Like on MS site stands: "RestoreLastError is an enigma. It's code is identical to SetLastError. It's unclear to me why it was made into a separate API."
Manko
11-02-2003, 11:53 PM
Hi!

You should use the info given by asprdbgr in ImpREC:

IAT start: 57313c (RVA 17313c)
...
Length: 1060

When you autosearched it found too little... RVA=173358 Length=200.
Not good! :)

Hope this fixes it! :)

/Manko

1st i started Asprotect Debugger v1b and run the target.exe in it

2nd.I fired up the Import REConstructor v1.4.2+ and choose the target.exe them click on IAT Autosearch,then get imports and then Imported Functions where all is valid...

thanks
Zilot
11-04-2003, 03:22 AM
Thematrix !!

This program is terrible easy to be unpacked. There are no stolen bytes, and you needn't stripper at all to unpack it. OEP is inside low memory code. There is no OEP ripping.

Manko's debugger will resolve all APIs, you'll have only 2 invalid entries, and that's because Manko failed to include case with 77xxxxxx addresses where 77xxxxxx is not valid API address.

But if you still can't find solution mail me, will send you unpacked/fixed version.
thematrix
11-04-2003, 04:01 AM
actually i confused as this is my first unpacking of exe(to learn unpacking by heart) before it i use tools to unpack files

1st i did the way diz as it was the easy but that give me this error
DUMP_ caused an invalid page fault in
module KERNEL32.DLL at 0197:bff7b9a6.
Registers:
EAX=00000000 CS=0197 EIP=bff7b9a6 EFLGS=00000246
EBX=00000100 SS=019f ESP=0083fd84 EBP=0083fdb0
ECX=00000000 DS=019f ESI=0056d0c8 FS=48a7
EDX=005317a0 ES=019f EDI=00555000 GS=0000
Bytes at CS:EIP:
ff 76 04 e8 13 89 ff ff 5e c2 04 00 56 8b 74 24
Stack dump:
00000002 005312ec 0056d0c8 0083fe28 00531418 0083fdb0 00555000 00000002 00000100 81792b4c 00000000 0083fdc8 00535ab7 00555066 005312a4 0053142c

here is the image of it
http://www.geocities.com/thematrixzone2002/dz

then i tried the manko way
that also did not solve my problem
here is the info
http://www.geocities.com/thematrixzone2002/asp2/manko/

Zilot i tries stripper to unpack but it prompted unable to pack(no files unpacked)
Manko
11-04-2003, 06:43 AM
Hi, thematrix!

Actually my way would have been:

when you reach this:

Dip from pre-OEP: XXXXXX (Reached from: XXXXXX)

Don't push OK to let it run, but let it stay paused.
Now dump with LordPE and then rebuild with ImpREC.
It found some invalid adresses.
Those you could just erase, but just for you I have corrected the misstake in my app and now it erases those too. :)

Follow the link in my sig!

/Manko

then i tried the manko way
that also did not solve my problem
here is the info
http://www.geocities.com/thematrixzone2002/asp2/manko/

Zilot i tries stripper to unpack but it prompted unable to pack(no files unpacked)
thematrix
11-04-2003, 10:44 AM
thanks Manko i will give it a try
thematrix
11-05-2003, 04:23 AM
thanks manko for modifying the yur cool debugger
its working perfectly win win xp but in win 98 i have to change the function name from RestoreLastError to SetLastError thanks to
diz
thanks all guys who helped me with unpacking my first unpacking proceudre


retool v1.06a - new version released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > retool v1.06a - new version released
PDA

View Full Version : retool v1.06a - new version released

OHPen
11-02-2003, 09:49 PM
ok retool v1.06a unlasting out.

retool supports now scanning for over 100 different packer/crypter. It's the first time a tool is able differ between the newer versions of armadillo and identifying them exactly (only works for the public releases ).

signature database is now converted to xml-base. by this change retool have won lots of speed ;D

new infoPExtractor plugin v1.00 first time in use. It's just a simple PEViewer. Improvements following soon.

Documentation is now provided as well as error loging and source.

Check the new version, and report bugs to us...

As you can see the homepage completely changed. Thx a lot to tr@sh for his nice work.

hxxp://retool.cjb.net or hxxp://retool.6x.to

regards,

OHPen
thematrix
11-05-2003, 05:00 AM
i get this erro on loading retool
hxxp://www.geocities.com/thematrixzone2002/retool/
and after it seems to be in loop of displaying this error again and again
OHPen
11-05-2003, 07:26 PM
i get this erro on loading retool
hxxp://www.geocities.com/thematrixzone2002/retool/
and after it seems to be in loop of displaying this error again and again

I now this exception well...

have you change something in retools directory structur ??
Maybe you tried to change the skin ?

It would be helpfull to take a look at "your" version of retool. Can you upload it somewhere ?

But it seems to me that it's not an imprortant problem, just try to download retool again, maybe it works this time. If the exception is still thrown, i will take a brief look at it.

regards,
OHPen


HowTo Enable Text/Field Box
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HowTo Enable Text/Field Box
PDA

View Full Version : HowTo Enable Text/Field Box

Arbitor
11-02-2003, 11:20 PM
How i can enable the text/Field Box ???

I wanna input the serial number, but since the program is trial they
disableb input box and put text "Trial - Trial - Trial - Trial"

Dialog Box Like This :

--[Register Box]--------------------------------------
Your Name : [ Arbitor ] <<-- this isText Box
Serial Number : [ Trial - Trial - Trial - Trial ] <<-- this is textbox

[Register] [Cancel] << -- this is Button
------------------------------------------------------

This is under window'98 program and NOT create by VB program.
i wanna Enable that Text Box, so i can input the serial number,
i already have the serial number (from DeluxeSerial Site).

I am using Win32Dasm and already found the Dialog Box (StringRef), but dunno how-to enable that text box.

Thank's and sorry if my english is bad :)
ZaiRoN
11-03-2003, 05:06 AM
Hi Arbitor.
Probably the program disables the editbox at runtime whether the program is not registered. You have to try to find the point of the code where this operation is done. Try to set a breakpoint on these functions:
EnableWindow: disables a control
SetDlgItemText: sets the text of a control, in your case it (probably) sets the text "Trial - Trial ..."

Start with this simple method and tell us what will happen.

ZaiRoN
0xf0001
12-15-2003, 08:58 AM
heLLo!

a different way that will help you is to send the dialogbox (the window where
you want to enable sthg) messages via sendmessage/postmessage w32 api
function.
with that you can enable, resize, blablabla everything with your buttons /
inputs.

but: therefor you need window handles. use ollydbg (FREE and cool!:) to
enumerate the window list of your proggy at runtime. incl handles.

voila!

greetz, da 0xf0001
evaluator
12-15-2003, 03:49 PM
hehe!

Don Wooma also very likes DeluxeSerial site ~:0
& he vary likes to help people for better input serialz;)

In According:
Now, there are also tools, so then can enable disabled things.
(for example: Customiser)
But if your prog is Delpi-prog, visually enabled control will
n0t work anyway..(incl. sendmessage/postmessage)..
etc..etc..

***
"ANY HELP APPRECIATED"
disavowed
12-15-2003, 05:24 PM
Now, there are also tools, so then can enable disabled things.
(for example: Customiser)i love how the customiser is 5 years old and still incredibly useful. not too many tools like that :cool:
dELTA
12-15-2003, 07:11 PM
The get/set text feature of Customiser doesn't work well anymore though, but for that you can use SnadBoy's tool instead.
Aimless
12-16-2003, 12:38 AM
You may also try to:

1. Get a resource editor (find many of www.programmerstools.org) and try to enable the same.

2. You may try to trap the windows messages that are sent to that control. Try using Microsoft Spy++ or Borland Winsight

3. Find out the code that actually disables the same. A good thing to do is BPX on Createwindowexa in softice with condition that it breaks on the creation of the textbox window (yes, EVERYTHING in windows is a window ;))
From there on, trace the necessary. You may even find that the window attributes that you can manipulate to your approval.

Have Phun


Question of BigInteger ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Question of BigInteger ...
PDA

View Full Version : Question of BigInteger ...

gordon_freeman
11-03-2003, 02:52 PM
Hi,
I'm trying to make a keygenerator for an application that use the following code to valiate the license informations :

public static ProductDescriber check ( String username , String key ) throws
InvalidKeyException
{
// A key form is : xxxxx-xxxxx-xxxxx-xxxxx-xxxxx-xxxxx

BigInteger modulus = new BigInteger ( "86f71688cdd2612ca117d1f54bdae029" , 16 ) ;
BigInteger exponent = new BigInteger ( "10001" , 16 ) ;

ProductDescriber e1 = new ProductDescriber () ;
e1.m_sUserName = username ;
int i = 0 ;
for ( int j = 0 ; j < key.length () ; j++ )
{
if ( key.charAt ( j ) == '-' )
i++ ;
}
// i = number of dashes in the key

if ( i != 5 && i != 4 )
throw new InvalidKeyException () ;
if ( i == 5 )
{
int k = key.indexOf ( '-' ) ;
try
{
e1.m_iCustomerId = Integer.parseInt ( key.substring ( 0 , k ) ) ;
key = key.substring ( k + 1 ) ;
}
catch ( NumberFormatException numberformatexception )
{
throw new InvalidKeyException () ;
}
}
else
{
e1.m_iCustomerId = -1 ;
}
BigInteger biginteger = Util.getBigInteger ( key ) ;

BigInteger biginteger1 = biginteger.modPow ( exponent , modulus ) ;

byte buffer[] = biginteger1.toByteArray () ;
if ( buffer.length != 12 )
if ( buffer.length == 13 )
{
if ( buffer[ 0 ] == 0 )
{
byte abyte1[] = new byte[ 12 ] ;
System.arraycopy ( buffer , 1 , abyte1 , 0 , 12 ) ;
buffer = abyte1 ;
}
else
{
throw new InvalidKeyException () ;
}
}
else
if ( buffer.length < 12 )
{
byte abyte2[] = new byte[ 12 ] ;
System.arraycopy ( buffer , 0 , abyte2 , 12 - buffer.length
, buffer.length ) ;
buffer = abyte2 ;
}
else
{
throw new InvalidKeyException () ;
}
if ( username != null )
{
short crc32 = Util.getChecksum ( username , e1.m_iCustomerId , buffer ) ;
if ( buffer[ 10 ] != ( byte ) ( crc32 & 0xff ) )
throw new InvalidKeyException () ;
if ( buffer[ 11 ] != ( byte ) ( crc32 >> 8 & 0xff ) )
throw new InvalidKeyException () ;
}
e1.m_iLicenseType = buffer[ 0 ] >> 4 ;
e1.m_iProductId = buffer[ 0 ] & 0xf ;
e1.m_iLicenseNumber = ( buffer[ 8 ] & 0xff ) + ( ( buffer[ 9 ] & 0xff ) << 8 ) ;
e1.m_iMinorVersion = buffer[ 1 ] >> 4 ;
e1.m_iMajorVersion = buffer[ 1 ] & 0xf ;
long l = ( ( ( long ) buffer[ 2 ] & 255L ) )
+ ( ( ( long ) buffer[ 3 ] & 255L ) << 8 )
+ ( ( ( long ) buffer[ 4 ] & 255L ) << 16 )
+ ( ( ( long ) buffer[ 5 ] & 255L ) << 24 ) << 16 ;

e1.m_dGenerationDate = new Date ( l ) ;
int i1 = ( buffer[ 6 ] & 0xff ) + ( ( buffer[ 7 ] & 0xff ) << 8 ) ;

if ( i1 != 0 )
e1.m_dExpirationDate = new Date ( l
+ ( long ) i1 * 24L * 60L * 60L * 1000L ) ;
return e1 ;
}

// Methods required from Class Util

public static short getChecksum ( String username , int customerId
, byte bigIntegerBuffer[] )
{
CRC32 crc32 = new CRC32 () ;
if ( username != null )
{
for ( int j = 0 ; j < username.length () ; j++ )
crc32.update ( username.charAt ( j ) ) ;
}
crc32.update ( customerId ) ;
crc32.update ( customerId >> 8 ) ;
crc32.update ( customerId >> 16 ) ;
crc32.update ( customerId >> 24 ) ;
for ( int k = 0 ; k < bigIntegerBuffer.length - 2 ; k++ )
crc32.update ( bigIntegerBuffer[ k ] ) ;

return ( short ) ( int ) crc32.getValue () ;
}

public static BigInteger getBigInteger(String key)
throws InvalidKeyException{
BigInteger biginteger = BigInteger.ZERO;
int i = key.length();
BigInteger biginteger1 = BigInteger.valueOf(0x39aa400L);
int j;
for(; i >= 0; i = j - 1)
{
j = key.lastIndexOf('-', i - 1) + 1;
String s1 = key.substring(j, i);
int k = b(s1);
biginteger = biginteger.multiply(biginteger1);
biginteger = biginteger.add(BigInteger.valueOf(k));
}

return biginteger;
}

public static int b(String s)
throws InvalidKeyException{
if(s.length() != 5)
throw new InvalidKeyException();
int i = 0;
for(int j = s.length() - 1; j >= 0; j--)
{
char c = s.charAt(j);
int k;
if('0' <= c && c <= '9')
k = c - 48;
else
if('A' <= c && c <= 'Z')
k = (c - 65) + 10;
else
throw new InvalidKeyException();
i *= 36;
i += k;
}
return i;
}

// Class ProductDescriber
public class ProductDescriber {
.....
public String m_sUserName ;
public int m_iCustomerId ;
public int m_iProductId ;
public int m_iLicenseType ;
public int m_iLicenseNumber ;
public int m_iMajorVersion ;
public int m_iMinorVersion ;
public Date m_dGenerationDate ;
public Date m_dExpirationDate ;
}

My question is how to make a keygenerator for this ?
I don't have a good knowledge about BigInteger and the modulus operations.
I am especially interested in the mathematical background of reversing this.

Thank you.
Solomon
11-03-2003, 07:53 PM
It's RSA algo and CRC32.
N = 86f71688cdd2612ca117d1f54bdae029,
E = 10001

It's not difficult to factor N. The class ProductDescriber gives us the details of the license bits. If you are familiar with Java and some RSA concept, you can keygen it.
gordon_freeman
11-05-2003, 05:15 PM
Hi,
Thank you Solomon for your help.

Using the extended Euclidean algorithm : gcd( e, phi), i finally found that :
d = 430d187de8bb3f18fb0a986e6b7163bd :p

Thank you.


Cast Lighting Wysiwyg, sentinel protected
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Cast Lighting Wysiwyg, sentinel protected
PDA

View Full Version : Cast Lighting Wysiwyg, sentinel protected

sneeze
11-04-2003, 03:23 AM
Hi there !

I wanna say hi to Woodmann cuz you ROCK ! I've read a couple of things and you're always right ! Good work !

Well, i try to figure out, for school, the dongle protection of sentinel superpro. I know a couple of things has been already written about this but i still can't get my way around with the Wysiwyg Release 6 software. I tried to compare with passed version but they rebuilt the whole thing.

Here's the link, if it can help:
Link removed by Woodmann

Thanks for your help
Kayaker
11-04-2003, 10:58 AM
Ahem. We all love Woodmann but what do you want him to do - crack it for you?

C'mon, if you've spent more than 5 minutes lurking here you'd know this isn't the way we do things. Forgive me but there's more than a couple of holes in your story. You expect us to believe this is a school project? Or that you've done any reasonable amount of "homework" on it in the past? So they rebuilt the whole thing. So what. How do YOU see that past versions are different from this one?

This is a school too, show your work, some background research, something!, else how can anyone grade this as anything more than a crack request?

Kayaker
dee
11-04-2003, 11:43 AM
Hi to all:)

i had cracked earlier Release 5 in the past and this Release 6 of the program you are talking (read the FAQ and do not post program name first of all) ;)
it is sentinel and some license protection for me it was easy to undongle it, i think it must be easy for you too just spend more time on it:)

good luck:)
Woodmann
11-04-2003, 05:39 PM
Howdy,

You have clearly mistaken me for someone else.

While it is true, I do rock, I am almost never right
about anything.
It was a nice try to schmooze me but it has failed.

Woodmann
sneeze
11-04-2003, 08:31 PM
I'm sorry, i didn't want it to go that way.

You'r right, it's not for school. I have version 3.5c and compared the .exe with the one from the site. I took the changes in note and looked a the release 6 and it doesn't seem to be the same thing at all.

I don't want you to do it for me, i would just appreciate some cues to get my way around.

And sorry Woodmann for my mistake.

I hope it clear things out.

Thanks
Woodmann
11-04-2003, 08:44 PM
Hi,

Thanks for your honesty :)

Now, on to your current project.

You need to tell us what you think/know about this new version.
If you can provide something that shows you have even a basic
understanding of this target, people will help you.

Woodmann
JMI
11-04-2003, 09:55 PM
And don't forget Rule #1:

If you want to schmooze Woodmann, you HAVE to say you LOVE him. Really, He said it in one of his posts. :D

Honest!

I wouldn't make something like that up, would I? :rolleyes:

:D ;)

Regards,
Zaza
11-04-2003, 11:17 PM
my advice would be to redirect all dongle api calls to an emulator dll.

the following code embeded into the emulated api might be useful as it would reveal the return address on the call stack - and hence tell you where the api call was made from.

a little poking around the callee address should reveal useful info :)

DWORD callee;
__asm {
mov eax, dword ptr [ebp+4]
mov callee, eax
}
dee
11-05-2003, 05:29 AM
2Zaza:

if you do not have an original dongle it may be useles or long time waisting for hunting responses from dongle
maybe you can give an example of such a code.
Zaza
11-05-2003, 07:25 AM
hunting for responses can take some time but then life isnt easy is it!

it is only useless searching for responses if the code is actually encrypted using the dongle, which seems to be a rare thing.

if you have an original d0ngle then it can speed up the emulation of a sp0read function as you could simply dump the cells - however even witht the original dongle you would have problems with spr0query.

in most cases the challenge/response values for spr0query will be very close to where the api is called.
sneeze
11-05-2003, 04:03 PM
Hey thanks guys

I'm glad it turns out good finally !

I think i need to do some more tutorial and read how to emulate DLL. I'll do my "homework" and i'll get back to you on that.

Thanks !
MaddMaxx
03-07-2004, 06:29 AM
I only more recently begin to reversing SentinelSuper Pro.
Now I am engaged in program Name and URL to Target Removed. I read the Cyberheg tutorials and many other authors , but I can not understand as me to find in the program a place where correct values "cell" are checked.
Do not prompt me as me to be, and what law and check?
JMI
03-07-2004, 01:22 PM
MaddMaxx:

Apparently you didn't learn anything by reading the previous posts in this thread. Go back and read the Big Red Letters at the top of the Forums and read the FAQ and then tell us what YOU have already done to solve your own problem. So far it looks like you want someone to take you by the hand and lead you through the dark codewoods. If you read the FAQ (or the contents of this thread) you would already know you are not supposed to post the name or URL of your target.

Regards,
Rackmount
03-12-2004, 02:20 PM
I seem to recall that we did a little project on sentinel which included a small crackme...I got pretty far with the crackme until I got distracted with a different....well...ok... I got stuck on the last bit ;-P Still, it would be a good thing for those interested to check it out and see where you can go...If it is still active...I will add my thoughts and ideas up to as far as I got with that crackme to questions posed regarding its intricacies. Maybe together we can polish it off once and for all ;-)
MaddMaxx
03-13-2004, 06:19 PM
Iam now reversing version 1.08. I found only 4 cell's:

00 - need any number, not zer (0)
3a - products expire date (iam write for emule sproread function 0048 - expired juny 2006)
3c - product ID (iam write for emule sproread function 2800 - version Perform)

but the program uses still
3b; 3e; 09; 34; 38

Earlier, when has been written old tutorials, checks were open and did not make work to find both values, and sites of a code.
Now they have learned to programmming and find not so simply.
The program at the first start at me at all does not see systems cell (3C), and repeatedly correctly all reads.
And so until I shall not jam a site of memory, with what she it worked. Then again sees nothing.
Likely any cell's should be identical
And everywhere, after checks, I see what code

lea ecx, [ebp+var_14]
.text:004B9E7E push ecx
.text:004B9E7F push eax
.text:004B9E80 push offset unk_912A20
.text:004B9E85 call sproRead - dongle function
.text:004B9E8A test ax, ax
.text:004B9E8D jz short loc_4B9EDB - if not zero

This code:

.text:004B9E8F mov eax, dword_912E48
.text:004B9E94 dec eax
.text:004B9E95 mov dword_912E48, eax
.text:004B9E9A jnz short loc_4B9ECB
.text:004B9E9C push 20h ; dwPriorityClass
.text:004B9E9E call ds:GetCurrentProcess
.text:004B9EA4 push eax ; hProcess
.text:004B9EA5 call ebx ; SetPriorityClass
.text:004B9EA7 mov eax, nPriority
.text:004B9EAC cmp eax, 0FFFFFFFFh
.text:004B9EAF jz short loc_4B9ECB
.text:004B9EB1 push eax ; nPriority
.text:004B9EB2 call ?AfxGetThread@@YGPAVCWinThread@@XZ ; AfxGetThread(void)
.text:004B9EB7 mov edx, [eax+2Ch]
.text:004B9EBA push edx ; hThread
.text:004B9EBB call ds:SetThreadPriority
.text:004B9EC1 mov nPriority, 0FFFFFFFFh
.text:004B9ECB
.text:004B9ECB loc_4B9ECB: ; CODE XREF: sub_4B8FC0+EDAj
.text:004B9ECB ; sub_4B8FC0+EEFj
.text:004B9ECB push offset unk_912E28 ; lpCriticalSection
.text:004B9ED0 call ds:LeaveCriticalSection
.text:004B9ED6 or eax, 0FFFFFFFFh
.text:004B9ED9 jmp short loc_4B9EED
.text:004B9EDB ; ---------------------------------------------------------------------------
.text:004B9EDB
.text:004B9EDB loc_4B9EDB: ; CODE XREF: sub_4B8FC0+ECDj
.text:004B9EDB mov ecx, offset unk_912E90
.text:004B9EE0 call sub_758D20
.text:004B9EE5 mov eax, [ebp+var_14]
.text:004B9EE8 and eax, 0FFFFh
.text:004B9EED
.text:004B9EED loc_4B9EED: ; CODE XREF: sub_4B8FC0+F19j
.text:004B9EED test eax, eax
.text:004B9EEF mov dword_951638, eax
.text:004B9EF4 jle short loc_4B9F02
.text:004B9EF6 mov dword_95163C, 1
.text:004B9F00 jmp short loc_4B9F0C

Ask me please - what is it?

I found crack Dee for version 1.06/ I down this release, patching file & see, why Dee released in progs emulations functions dongle.
This patch only changes many JZ - JMP
Emulation this patch does not have.
But me interesting only good emulation dongle fuctions code.

TNX ALL !
dee
03-25-2004, 08:19 PM
return in sproFindFirstUnit eax=0
return in sproRead cell 2 and 3 some bytes (they are used as request code) and eax=0
this is all emulation
now you need to find right response serial to request code and unlock Report or Design or Perform....

bye;)
MaddMaxx
03-26-2004, 04:03 PM
Dee

Big big thank you
I looking this

but you ask me

"now you need to find right response serial to request code and unlock Report or Design or Perform...."

this is the crypt code ?
when i can found it ?

From what to start a search i know one address - 70b0c0 (in version 1.08.241)
Function returns in "eax" a code of a product (5 - Perform)
In you patch for version 1.06 you write in this function code - mov al, 05
You speak about it ?
dee
03-26-2004, 08:44 PM
I mean to unlock one of the options you need to find right serial.
If then dongle emulation is done right - you should get window with ID (from dongle) and field for response code.
Enter any code...
bpx GetWindowTextA this should work as i remeber...
bpm on adress where your input code is and start serial fishing...

in previous patches i just patched one function to return eax=5
so it unlocked Perform 5000

bye:)
MaddMaxx
03-27-2004, 03:49 AM
Big thanks!
i look it ....

bye:)
Zaza
05-14-2004, 06:38 PM
and then theres just the little matter of sproquery.......


This is Hard to Believe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > This is Hard to Believe
PDA

View Full Version : This is Hard to Believe

naides
11-04-2003, 09:43 PM
Well, I am going to post the name of a target and some specific info.
If this is improper, please remove it. And no, for a change, I don't need help.

I was playing with Mcafee Uninstaller, which is a Time limited, useful app, worth its $19.00 price.

All the protection is contained in RECAPI.DLL, which checks the time and licensed status. Now the curious thing:This code SENDS TEXT to the SoftIce command line, some thing like this:

-----------------11/01/03---------Entering License Validation Module-----------

All the Licensing parameters and variables in English, neat and formatted plain text.

Later on

-------------License Module Finished --------------------------

And indeed the code between these "brackets" performs all or most of the time and license validation.

Now, are these people as nice as to give crackers clear hints o where to crack?
Are they setting a trap for less than proficient crackers like me?

This is more than leaving debug information in the module, this seems to be wide open, flag waving Here crack me.

Any body has an idea what is this all about?
Kayaker
11-04-2003, 10:05 PM
Hi,

I'm not sure since I've never used the function, but would this be output from the DbgPrint function?
naides
11-04-2003, 11:39 PM
Hi,

I'm not sure since I've never used the function, but would this be output from the DbgPrint function?

Now that you mention it I traced into it and the API is :
Kernel32!OutputDebugStringA

But the question still remains. . .
Why?
Zaza
11-04-2003, 11:46 PM
Now that you mention it I traced into it and the API is :
Kernel32!OutputDebugStringA

But the question still remains. . .
Why?

cause they were stupid and released a debug build, not a release version that had been stripped of all debugging content :)
just
11-05-2003, 06:57 AM
I saw something similar once in a game, it detailed many things about what the game engine was doing, and when data was sent in multiplayer environment, etc. All very useful for gamehacking :)

The only thing different was that they probably used something like

function debugprint(...) {
#IFDEF DEBUG
OutputDebugString(sprintf(...));
#ENDIF
}
And called this function when they wanted to show info for themselves.

So all the strings were still in the game, I just had to rewrite the debug function.
Tola
11-05-2003, 07:14 AM
I once saw an app that wrote the correct serial via OutputDebugString when you entered a name in the registration dialog... :rolleyes:
I wonder if they noticed :p


Unpacking ASPack, Neolite, Pe-Pack, Petite, andUPX tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking ASPack, Neolite, Pe-Pack, Petite, andUPX tutorial
PDA

View Full Version : Unpacking ASPack, Neolite, Pe-Pack, Petite, andUPX tutorial

mmhckb
11-05-2003, 06:18 PM
I found this old file that I wrote up quite awhile ago. It may be of use to someone:

How to Unpack Various EXE Packers using OllyDBG
In fucking alphabetic order even!

------------------------------------------------------------------------
ASPack 2.12:

Load the exe, you will have to Shift+F9 several times. Upwards of 50
times is normal. Use Ctrl+G ESP BP technique. You'll land on a JNZ.
Trace into jump, it is pushing the oep. Trace into the ret. This
is the OEP. Dump then fix IAT. Fix dump. done.

------------------------------------------------------------------------
EZIP 1.0:

You start out on a JMP, trace into it. Ctrl+F9 (exec til ret). Scroll
down and you should find a large loop. Past that, there is a JMP EAX.
Trace into this JMP, this is the OEP. Dump, fix IAT, fix dump.

------------------------------------------------------------------------
Neolite 2.0:

Scroll down until you see JMP EAX. Put BP here. Step into
JMP. You're at the OEP. Dump and rebuild just as you would
with UPX.

------------------------------------------------------------------------
PE-PaCK 1.0:

You start on a JE with JMP right below it. Trace into the JMP. Now
you're on a PUSHAD. Use the Dump window Ctrl+G esp bp. You stop on
a JMP EAX. Trace into the JMP and you're at the OEP. Dump, rebuild
IAT, fix dump. Done.

------------------------------------------------------------------------
Petite 2.2:

Trace until you go over the PUSHAD. Click in dump window. Ctrl+G.
Type ESP. Select first two bytes in dump, set breakpoint on memory
access -> word. Back in CPU window, hit F9. Shift+F9 until you
reach POPAD/POPFW. There should be a JMP soon after the POP. Trace
into the JMP, this is the OEP. Dump process with LordPE. Open process
with imprec. Set correct OEP/IAT autotrace. Hit show invalid. Right
click and do a level 1. Fix the dump.

------------------------------------------------------------------------
UPX:

Scroll down until you reach something that looks like this:

004142C7 > 61 POPAD
004142C8 .-E9 BE6CFFFF JMP wrap.0040AF8B
004142CD 00 DB 00
004142CE 00 DB 00

Set a breakpoint on the JMP and run. Step into the JMP.
You're at the OEP. Dump with LordPE. Open process
with impRec. Set OEP with the one you just found.
Hit IAT AutoSearch. Hit Get Imports. Delete the bad
thunks. Fix the dump. Done.

------------------------------------------------------------------------

------------------------------------------------------------------------

OEP Finding Techniques

#1 is just scroll down till u see
0040E23F .-E9 A479FFFF JMP upxs306.00405BE8
0040E244 5CE24000 DD upxs306.0040E25C
0040E248 60E24000 DD upxs306.0040E260
0040E24C C8734000 DD upxs306.004073C8

JMP and some shit with a bunch of 0's.

#2
F7 on the PUSHAD
goto the dump
CTRL + G
goto ESP
Set a hardware Breakpoint on WORD
that will take u straight to the jump

#3
F7 onto the PUSHAD
ctrl + T
COMMAND is one of the following "POPAD"
then CTRL + F11
seven
11-25-2003, 08:08 AM
hi mmhckb :
[Name and URL of target deleted by JMI because post contains target specific code]
upx 1.24 packer .
http://members.lycos.co.uk/sssevennn/upx.jpg
Set a breakpoint on the JMP and run. Step into the JMP.
You're at the OEP
can u explain this point plz , thx .
mmhckb
11-25-2003, 10:33 PM
That doesn't appear to be a normal OEP... generally they start with

PUSH EBP
MOV EBP, ESP

Nonetheless, you could try dumping from there and rebuilding. I'm not very good with start up routeins and that could just be some weird ass one... but, well, shit, i dunno.

Sorry bud.
seven
11-25-2003, 11:23 PM
u know , cracking itself is so hard
they dont need 4 another hard
method called packing , anyway
mmhckb thx 4 reply .


Lame email I often receive.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Lame email I often receive.
PDA

View Full Version : Lame email I often receive.

Woodmann
11-05-2003, 09:17 PM
Howdy,

This is the kind of shit I get in my email.
I usually dont post this stuff but, this person
has been persistant with his/her request yet does
not feel the need to explain why these posts should
be removed.

How would you reply to this ?

Received: from woodmann.net ([66.98.132.48])
by rwcrmxc12.comcast.net (rwcrmxc12) with ESMTP
id <20031105083959r12008ac8pe>; Wed, 5 Nov 2003 08:39:59 +0000
Received: from spf13.us4.outblaze.com (205-158-62-67.outblaze.com [205.158.62.67])
by woodmann.net (8.11.6/8.11.6) with ESMTP id hA59gCC32211
for me<at>woodmann.net>; Wed, 5 Nov 2003 03:42:12 -0600
Received: from 205-158-62-68.outblaze.com (205-158-62-68.outblaze.com [205.158.62.68])
by spf13.us4.outblaze.com (Postfix) with QMQP id D0098180129F
for <me>at<woodmann.net>; Wed, 5 Nov 2003 08:39:53 +0000 (GMT)
Received: (qmail 45971 invoked from network); 5 Nov 2003 08:39:46 -0000
Received: from unknown (HELO ws5-2.us4.outblaze.com) (205.158.62.132)
by 205-158-62-153.outblaze.com with SMTP; 5 Nov 2003 08:39:46 -0000
Received: (qmail 32602 invoked by uid 1001); 5 Nov 2003 08:39:44 -0000
Message-ID: <20031105083944.32601.qmail@linuxmail.org>
Content-Type: text/plain; charset="iso-8859-1"
Content-Disposition: inline
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-Mailer: MIME-tools 5.41 (Entity 5.404)
Received: from [81.240.253.137] by ws5-2.us4.outblaze.com with http for
cicp@linuxmail.org; Wed, 05 Nov 2003 16:39:44 +0800
From: "Cybercrime Investigation & Prevention" <cicp@linuxmail.org>
To: noc@ev1.net
Date: Wed, 05 Nov 2003 16:39:44 +0800
Subject: Copyright infringement
X-Originating-Ip: 81.240.253.137
X-Originating-Server: ws5-2.us4.outblaze.com

To keep your site in accordance with the International Copyright Law, you are required to immediately delete the following links
from the corresponding messages in your forum.

From:
http://www.woodmann.net/forum/showpost.php?p=8143&postcount=1
Delete:
http://www14.brinkster.com/ccct/Tiger.zip
http://161.58.237.201/download/f6demo.zip
http://161.58.237.201/download/fritz6e.zip

From:
http://www.woodmann.net/forum/showpost.php?p=18668&postcount=5
Delete:
http://www.searchlores.org/paris/paris6.htm

From:
http://www.woodmann.net/forum/showpost.php?p=18677&postcount=7
Delete:
http://www.geocities.com/ccctournament/Opera.zip

From:
http://www.woodmann.net/forum/showpost.php?p=18132&postcount=1
Delete:
http://www.exetools.com/forum/attachment.php?s=&postid=3248

This notice of copyright infringement was forwarded further to complaints by the owners of a legal copyright that is infringed by your forum.
--
______________________________________________
Check out the latest SMS services @ http://www.linuxmail.org
This allows you to send and receive SMS through your mailbox.

Powered by Outblaze

Now, what do we see that is lame in this email ?

Woodmann
JMI
11-05-2003, 09:41 PM
Perhaps we should "out" ccct so the entire world will know his real name and the very stupid things he has been doing to attempt to force us to remove things which HE posted HIMSELF. Maybe he DOESN'T YET KNOW WE KNOW WHO HE REALLY IS. Maybe he's just TOO STUPID to realize the trail he is leaving across the net. :rolleyes: :rolleyes:

Regards.
dELTA
11-05-2003, 09:48 PM
Yeah, I agree, if he wants to play hardball, go ahead. :)
FoolFox
11-06-2003, 05:04 AM
Hello,

you can simply ask linuxmail.org to kill this account which
is in violation of linuxmail.org usage policy :

You agree to not use the Services to:

(a) upload, post or otherwise transmit any Content that is unlawful, harmful, threatening, abusive, harassing, tortious, defamatory, vulgar, obscene, libelous, invasive of another's privacy, hateful, or racially, ethnically or otherwise objectionable;

...
(g) upload, post or otherwise transmit any unsolicited or unauthorized advertising, promotional materials, "junk mail," "Spam," "chain letters," "pyramid schemes," or any other form of solicitation, except in those areas of the Service that are designated for such purpose;
...
(l) "stalk" or otherwise harass another;

Regards
FoolFox
disavowed
11-06-2003, 09:17 AM
woodmann, it is possible that he meant he wanted you to "delete" (remove) the links from the posts, not the actual files they link to
Woodmann
11-06-2003, 06:45 PM
He has made it quite clear in the past....

He wants any and all references to his name removed.
All of it, links, nics, blood evidence.........

Good idea FF :D

Woodmann
Zero
11-07-2003, 02:38 AM
I had yesterday some kind of the same contact.
But there was a small difference: the author of the mail named himself, told who he is and blah blah and asked be very polite to remove his copyrighted contents.

In your mail there is nothing which shows WHO wrote the mail (I only see From: "Cybercrime Investigation & Prevention" <cicp@linuxmail.org>)
Google gives nothing about this.

I would throw this into thrash/bin

and:
you are required to immediately delete the following links
from the corresponding messages in your forum.

Absolutely clear: forced to delete links (!) from the forum (!). And nothing else.
Kayaker
11-07-2003, 03:05 AM
I had yesterday some kind of the same contact.
But there was a small difference: the author of the mail named himself, told who he is and blah blah and asked be very polite to remove his copyrighted contents.

Hmm, at least he's being polite now. A modicum of honesty and no BS tricks for a change might be nice...
Zero
11-07-2003, 12:42 PM
Small correction of a (maybe) misunderstanding:
The guy from the mail above and my guys are definitly not the same.
asmworkshop
11-07-2003, 12:44 PM
..... accordance with the International Copyright Law .....

what accordance ? %)
Kayaker
11-07-2003, 02:36 PM
Small correction of a (maybe) misunderstanding:
The guy from the mail above and my guys are definitly not the same.

My mistake. At least your guy was aboveboard in his request, no problem there.
Woodmann
11-07-2003, 06:19 PM
Howdy,

He tried the "nice way". He tried 2 different "legal" threats.
Then he just sends me that email.

I have asked him for a reason and the only one he gave
me did not seem truthful.
I have also asked for his legal representitive to contact
me and all I got was more bullshit from his "lawyer",
the lawyer didnt even sign his name.
All I asked was for a truthful answer and I got none.

I pose to all of you............

If you post something in a public forum,
what right do you have to demand it be removed ?
Oh yes, remember where the server is located.

Woodmann
JMI
11-07-2003, 07:25 PM
If one "publishes" his, or her, comments in a public forum, one has no expectation of privacy and has no "ownership" rights over the comments. They are not "owned" by the author and, particularily when there is no "copyright" notice attached, they become part of the "public domain." The "author" has NO right to demand that their words later be removed from the forum, any more than they could demand that words they spoke in public not be recorded, repeated, or printed somewhere in the media.

"The Moving Finger writes; and, having writ, Moves on:
nor all your Piety nor Wit shall lure it back to cancel half a Line,
Nor all your Tears wash out a Word of it."

Regards.
Zaza
11-08-2003, 11:50 AM
all comments made by Zaza are the sole property of Zaza, Zaza reserves the right to have all comments removed as per international copyright law and in accordace with current data protection laws

(c) Zaza 2003

:D
esther
11-08-2003, 12:44 PM
all comments made by Zaza are the sole property of Zaza, Zaza reserves the right to have all comments removed as per international copyright law and in accordace with current data protection laws

it will be deleted in no time! my post hahahhahahaha


Copycontrol Information
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Copycontrol Information
PDA

View Full Version : Copycontrol Information

peterg70
11-06-2003, 05:06 AM
Looking for some information on Copycontrol.

Seems a abit hard to find useful information.

Looking for a method to authorise the UNLOCK-IT Feature of the copycontrol.
I have downloaded the Documentation from the website but I see the Keygen also needs to be authorised.

Need some info on if it is possible to generate a valid key for this.
I have no keydisk so all the tutorials I have found so far are all related to the Disk format.

Also not much on a search here.

Regards
Peterg70
squidge
11-06-2003, 05:47 AM
I was also struggling for information too, but the program I was looking at had a 30 day version available and luckily had all the copy control stuff in a DLL. So I wrote a small application that called the "cc32" function in this, and it gave me all the information I needed in the CCMB block Copy-control uses (and is also nicley documented in there demo downloads). Wrote my own dll that gives this block regardless of the protection allowed me to use whatever expiry date I wanted.

There's a field in there that states what type of protection has been found (eg. unlock-it trial, unlock-it activated copy, etc), but changing this field didn't seem to do anything interesting - the program still sat in demo mode.

Key's can be generated using a debugger, but they are then specific to a single installation - I don't know how to make a keygen.

In the end, I just settled for an unlimited trial version.

Looking for some information on Copycontrol.

Seems a abit hard to find useful information.

Looking for a method to authorise the UNLOCK-IT Feature of the copycontrol.
I have downloaded the Documentation from the website but I see the Keygen also needs to be authorised.

Need some info on if it is possible to generate a valid key for this.
I have no keydisk so all the tutorials I have found so far are all related to the Disk format.

Also not much on a search here.

Regards
Peterg70
peterg70
11-06-2003, 08:49 AM
I did a bit more digging and found that it dumps the activation code into a file in the temp directory and dumps the following files.

CCMV32AA.EXE <-- Main exe.
CCMV32AA.CMD <-- Batch File for executing the string
CCMV32AA.DAT <-- Output from EXE
CCD3C.TMP <-- Contains activation code cleaned from spaces etc

I assume this CCMV32AA program takes the activation code and checks to see if its a valid code and reports the error. If this true is it possible to generate all possible codes and check the error results until it comes out correct.

I wouldn't mind being able to generate an unlimited license for a single installation or else replace the appropriate DLL so that it responds correctly.

Peterg70
Hopcode
11-07-2003, 05:47 PM
Why don't you just unpack the darn file ?
If im not wrong, i have experienced with CopyControl and its really lame.

The encryption algo is like 10 instructions long.
they have the OEP and import address RVA in clear in the protected
file also..

I did a bit more digging and found that it dumps the activation code into a file in the temp directory and dumps the following files.

CCMV32AA.EXE <-- Main exe.
CCMV32AA.CMD <-- Batch File for executing the string
CCMV32AA.DAT <-- Output from EXE
CCD3C.TMP <-- Contains activation code cleaned from spaces etc

I assume this CCMV32AA program takes the activation code and checks to see if its a valid code and reports the error. If this true is it possible to generate all possible codes and check the error results until it comes out correct.

I wouldn't mind being able to generate an unlimited license for a single installation or else replace the appropriate DLL so that it responds correctly.

Peterg70
peterg70
11-07-2003, 06:07 PM
The program I am trying to "debug" is an excel addin. So the DLL is used to check the license. I would rather just license the bloody thing than patching alot of it.

Plus they may have used the licensing tool to generate errors in the results from the DLL addin and I can't take the chance.

The CCMV32AA.exe is a 16it program which irritates me since I can't debug it.

I wonder if it is possible to use the copycontrol development platform to generate valid codes for the software.

hmm but I still need to register the development platform.

peterg70
squidge
11-07-2003, 07:04 PM
Yes, files protected with the Copy Control shell are really lame, but the targets I've played around with recently no longer use this method. They either have the copy control library statically linked to them (which normally means patching), or via an external dll which is checked by some kind of hash function.

The last target I did used SHA on the DLL to check for modifications - but they did a silly thing by doing the final compare as a string compare, with the hex string they were looking for in plain view in the main file, so it was easy to make up my own DLL and change the message digest in the main code.

Why don't you just unpack the darn file ?
If im not wrong, i have experienced with CopyControl and its really lame.

The encryption algo is like 10 instructions long.
they have the OEP and import address RVA in clear in the protected
file also..
jsteed
11-08-2003, 10:27 AM
I looked at this protection sometime ago and as I recall, CControl is not to difficult to 'register'. The part of the program that checks for a valid license is encrypted, (prog byte xor 4). Just search the disassembly for a section of 'junk code', decrypt it with a hex editor and paste it back. You will also have to remove the SEH that performs the original decryption.
peterg70
11-12-2003, 06:02 AM
Okay I have further investigated Copycontrol Un-Lockit and here are the results

Nothing

i.e. there is nothing out there that has information regarding Un-Lockit.

So I need some pointers
What API is used to activate Buttons etc on a form.
The CControl software seems to do alot of INT3 and Exception operations. I have activated all the options on Ollydbg 1.09 to return control to the program but every so often it seems to create and unhandled exception. Any thoughts?

Any pointers on self registering CControl version 3.8. What Do I need to look for?

PS there are no keydisks with this software.
Peterg70
akimp3
11-18-2003, 01:36 PM
Hi

an Iranian group called ICA(iranian cracker assosiation) has
completely cracked all the microcosm protection.
and they had published unsheller for the shell version
the file for copy control was something like ccica
or ccduica. the cracker unforgiven had also release a
copy control FAQ named ccfaq.doc thas completely
show the way to manually remove shell or object protection of
copy control.
the ICA group is not working anymore(financial problem i think).
try google and if you don't find let me know i will search in my 2001
backup and i will find it for you

good luck

akimp3
peterg70
11-18-2003, 05:51 PM
Thank you for the information.

But I have to disagree with you that microcosm protection has been completely cracked. Because if that was true then a licensing program to license any ccontrol software would have been released.

I have seen the ICA software but these don't apply to what i am doing.

I would be interested in seeing the ccfaq.doc which hopefully may contain more data on the method of licensing software without having to modifiy the original exe etc. i.e. keygen it.

peterg70
Kayaker
11-18-2003, 08:15 PM
Hi peterg70

>What API is used to activate Buttons etc on a form.
>The program I am trying to "debug" is an excel addin.

Suggestion. API's are often a weak link, an API spy and Message spy should answer your first question I would think, probably SendMessage, or if the Excel addin subclasses then CallWindowProcA might be used.

In either case a well chosen breakpoint on the hWnd will stop any activity regarding a control. Then interpret the Msg params being cycled through, using logical NOTs to filter out any excessive breakpoints. If a keyfile is being read or whatever, a little analysis of the API will locate what memory location it's being read into.. Then a BPM breakpoint on the forthcoming memory read(s) and you're away.

LRESULT CallWindowProc(
WNDPROC lpPrevWndFunc,
HWND hWnd,
UINT Msg,
WPARAM wParam,
LPARAM lParam
);

I'm sure you know what I mean, but as an example, Delphi app subclasses its TEdit control, Password goes into TEdit control. There are 2 Msg param values of interest, x0E and x0D, the first returns the length of the string, the second both the length plus lParam will contain the address of the copied edit string (substitute the Msg param for some kind of read notification function for a (key)file).

BPX USER32!CALLWINDOWPROCA IF (ESP.8 == <hWnd of control> ) && (ESP.C == 0D) do "dd ESP.14"

A quick trace in the API and the string is in lParam memory location ESP+14.

Kayaker
akimp3
11-19-2003, 08:15 AM
Hi

here i find it for you:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
-+= Iranian Crackers Association =+-
[I.C.A]
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Oh, Yes , Here it is ...
Answers to the most questions you may ask about CopyControl. This Text is
Writen to decrease mailed questions which we recieve about CopyControl ..
The People Replied Me some Funny things after the first release of this
text. These Show that I am not a Good Author on describing some technical
or even lame (Based On Who is Reading) subjects. If you think so , Please
forget reading Below Texts .

-------------------------------------------------------------------------

Changes in This Review :
17. How About Object Method - Changed From the GroundUp.
23. Generic Way for CopyControl Under Windows , Shell or Object ? - New
24. I have an Older Version Than 1.59 , How to Unlock ? - New
25. Changes on Version 3.02 and later - New
26. Is there anything to modify CC parameters - Introducing a new tool

-------------------------------------------------------------------------

Questions Answered here :

01. How can i detect my program is protected using CopyControl ?
02. What is Major , Minor and Build Number ?
03. How detect version of CopyControl which used to protect software ?
04. Is there any way to find CopyControl Build|Review number ?
05. What is Product Code ?
06. How can I detect Product Code ?
07. What is CopyControl Serial Number ?
08. How to Access CopyControl Serial Number ?
09. What is Product Serial Number ?
10. Where Product serial number is stored ?
11. Where is CopyControl Key Track on floppy ?
12. What is Master Track Specification ?
13. I have a program without its master disk . How can i detect its PCODE
14. What is CCUICA ?
15. How can I change my CopyControl Serial Number to the same used with
Developer ?
16. I know protection specification , I got it from CCLOOK or inside EXE
file , May i create a new copy of MaterDisk ?
17. How about Object Method ?
18. What is CCICA?
19. I have a 720KB MasterDisk which CCICA can't copy that , What can i do?
20. I have a protected program with version 1.72 but Currently I have just
CopyControl Version 1.71 , Is there any Solution ?
21. My Program is using NE or PE shell Protection , Any solution ?
22. The code that i have created using CCREMOTE wont works correctly .
23. Generic Way for CopyControl Under Windows , Shell or Object ?
24. I have an Older Version Than 1.59 , How to Unlock ?
25. Changes on Version 3.02 and later ?
26. Is there anything to modify CC parameters ?
27. I could not found my question here .. ?!

-------------------------------------------------------------------------

Q : How can i detect my program is protected using CopyControl ?
A : Every protected program needs a couple of files to run . these files
are ccontrol.sys and xxxxxxxx.ccc . Depend on the type of protection
This files may be found in floppy disk which you have as keydisk or
may be with your program files. In most cause these files are hidden
and may be place in a hidden directory.

Q : What is Major , Minor and Build Number ?
A : These topics refer to CopyControl Version . In Version 1.71.12 , 1 is
Major Version , 71 is minor version and 12 is build number.

Q : How detect version of CopyControl which used to protect software ?
A : A couple of ways are Available here. You may use Microcosm CCLOOK.EXE
to extract protection specifications or opening ccontrol.sys in a HEX
editor . If you preafer the second way , So First byte of this file
contains Major Version number and Second contains minor one .
Example : 01 42 in the first two bytes of ccontrol.sys means v1.66 is
used to protect the application .

Q : Is there any way to find CopyControl Build|Review number ?
A : You may be interest to know the build number of CopyControl Version ,
I mean in file , not using CCLOOK , So you can see offset 0x7C of sys
file to retrive this information .

Q : What is Product Code ?
A : Product code is a unique 8 chracter code that developer considers for
his product. In protection check process that is important that PCODE
be the same as saved somewhere in protected program . In this way one
developer can give you two diffrent program with two diffrent PCODE
and you will not be able to use their keydisks instead each other ...

Q : How can I detect Product Code ?
A : That's very easy, just see name section of file which has .CCC
extension .
Example : I have misc.ccc in my files , So PCODE is : MISC

Q : What is CopyControl Serial Number ?
A : Each CopyControl has ( had ) a unique serial number . Every protected
program will check this serial number , In this way other licenced
CopyControl users can't create a MasterDisk as another because there
is diffrence between their CopyControl Serial Number .

Q : How to Access CopyControl Serial Number ?
A : Refer to a WORD in offset 0x4 of .CCC file . The Serial number stored
here in protection time .

Q : What is Product Serial Number ?
A : Each protected program has a PCODE and each master disk may have a
unique serial number . In this way two diffrent key-disk with same
PCODE and CopyControl Serial Number can not be used instead each
other because they are diffrent in Product Serial Number Field .

Q : Where Product serial number is stored ?
A : This field can be retrived as a WORD from offset 0x6 of .CCC file .
The Lower Byte is used to crypt protected files in some cause , This
is not general and can't be retrived from this offset safely.

Q : Where is CopyControl Key Track on floppy ?
A : Ok, We can use Product serial number to get exact key track number on
floppy disk . ( Product Serial Number & 0x000F ) + 20 is track number
which used as key by copycontrol on floppy disk .
In Version 3.0? and Higher if CCADD fail on making signature track on
its old place then will retry on next tracks and Mark OLD failed one
as Bad Track in the disk FAT section.

Q : What is Master Track Specification ?
A : Protected track has a 8092 sectore with sector id 18. The contents of
This track can't be read and will generate CRC error becuase of the
method they used to write this sector .

Q : I have a program without its master disk . How can i detect its PCODE
serial number and CopyControl Serial Number ?
A : Look at this table , I extracted it from CopyControl CCADD.EXE

00| 0A 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
10| 00 00 4D 7A 3A 73 4A 61-4E 63 50 69 03 01 02 03 ..Mz:sJaNcPi....
20| 04 3F 28 43 43 4F 4E 54-52 4F 4C 00 43 43 41 44 .?(CCONTROL.CCAD
30| 44 2E 45 58 45 00 00 00-00 80 5A 0F 52 75 6E 20 D.EXE.....Z.Run
40| 53 65 74 75 70 20 6F 72-20 43 43 4D 4F 56 45 20 Setup or CCMOVE
50| 74 6F 20 69 6E 73 74 61-6C 6C 20 61 20 70 72 6F to install a pro
60| 74 65 63 74 69 6F 6E 20-74 6F 6B 65 6E 2E 00 20 tection token..
70| 20 20 20 20 20 20 20 20-20 20 20 20 20 20 20 20

Mz:sJaNcPi is CopyControl signature here . CCONTROL is product code
which used to protect this program . CCADD.EXE is the name of program
which Shell method used on it . Look at address 21h in the dump , you
can find 283F as product serial number here. This means Your program
is protected by this serial no . This Serial is diffrent with serial
which master disk is created with . The CopyControl Serial Number can
be extracted from offset 3Ah . This means the Serial No of developer's
CopyControl Was 0x0F5A .
So Here we have introduced a couple of key fileds :

1- Word Before PCODE means Product Serial Number. Was 283Fh in Example.
2- Word Before Fault message Means CopyContorl Serial Number , in our
Example that was 0F5Ah .

Note :
Another Key Field is Byte before CopyControl Serial Number in offset 39
of dump . This Fields Means "Action to Take when Protection not Found"
*10h + "Display error Code?" in protection process using Ccontorl.

Q : What is CCUICA ?
A : CCUICA is one of [I.C.A] products to manage CopyControl Unshelling.
Because of cool shell protcetion on PE and NE files , this utility
just supports MZ files . This utility can be downloaded from [I.C.A]
download site which currently is located on http://ids01.cjb.net .

Q : How can I change my CopyControl Serial Number to the same used with
Developer ?
Although that is possible changing serial number directly using your
protected CopyControl , but we don't want to make it more technical in
operation , so use CCUICA to unshell CCADD.EXE file at first . Then
copy ccontrol.ccc and ccontrol.sys files from hidden directory to the
root directory. Run unshelled ccadd.exe and create a new master disk
using below specifications :

PCODE : CCONTROL
SERIAL : every thing you wish .
Run From Master : No
Programs to protect :
CCADD.EXE Shell
CCREMOTE.EXE Object

After creating new masterdisk , copy its ccontrol.sys and ccontrol.ccc
files to the root directory again . Now the new serial number will be
placed in every product which you protect using unshelled ccadd.exe .

Q : I know protection specification , I got it from CCLOOK or inside EXE
file , May i create a new copy of MaterDisk ?
A : of course , you should follow these steps :
1- Create a new CopyControl with serial which you have extracted from
file .
2- Use that CopyControl to create a new MasterDisk of you program. Now
use new master disk for protected program .

Q : How about Object Method ?
A : There are several ways for object protected programs . The first is
tracing protected program and jumping over conditional jumps . in this
form you should have an intermediate knowledge on cracking filed.

Second way is replacing CC32.DLL on some protected programs . If you
read the manual of CopyControl , you will find all the things you need
about DLL replacing . In Short you have to create a new CC Master Disk
with your required Serial Number , The Extract Protection Parameters
using CCLOOK , if that is a protection over CopyControl DLL then you
may reprotect a RAW CC32.DLL (DLL which is on CC pack) and replace it
on the program Directory.

Third is replacing that DLL with yours which Exports required function
and ignore all the protections checks , This is Depend on the way they
have used to protect their programs.

Another way is Creating a new MasterDisk for protected program, if you
have not the master disk then you can extract informations from files.

Refering to CopyControl Developers manual may help you too . While I
was patching CCADD.EXE v3.03 , I found a protection check which was
checking protection internally with function 0. ( Full Check ) Then I
Changed Function Number to 3 :) (Get Parameters Only) . You may have
Some Problems here , But I am Sure My Friends (DISKEDIT Masters) will
Find What I am Talking ABout :)

Here I found a Generic Way too , Which will answers when you have a
working copy . Read About Generic Ways

Q : What is CCICA?
A : CCICA is another utility by [I.C.A] to manage copying CopyControl
created master disks. This utility knows all 1.44MB floppy disks which
are protected using CC v1.59 to v3.01 .

Q : I have a 720KB MasterDisk which CCICA can't copy that , What can i do?
Q : I have a protected EXE which can not be unshelled using CCUICA ...

A : Try to create the same MasterDisk using a CopyControl.

Q : I have a protected program with version 1.72 but Currently I have just
CopyControl Version 1.71 , Is there any Solution ?
A : Yes , Try to create a new master disk using version 1.71 , then edit
version fields in .ccc and .sys files on master disk . Use CCLOOK on
modified disk . if there is no error so you can use this disk instead
original. If the application used ccmove.dll or ccmove.exe or ccchange
to manage protection , you should replace that files with the version
you modified else you will see Version incompatibility error .

Q : My Program is using NE or PE shell Protection , Any solution ?
A : Try to load it in your prefeared HEX file editor . Find below codes :
3D 00 00 75 12 , or 75 12 3D 00 00 and change them to :
33 C0 90 75 12 , or 90 90 33 C0 90

Remember "Action to Take when Protection not Found" and "Display error
Code?" keyfiled . Change that to 00 . Now shell will be ignored .
If this trick didn't worked and program still shows Error before Run ,
find below code exactly a few bytes before previous patch location :
00 74 1A 50 ... and change it to :
00 EB 1A 50 .
In this form , Shell will be Ignored .
This trick may not work on some versions, so you should run your tracer
and try to BPX MessageBox .
After Program Break , Trace to go back to your program and find compare
instruction Yourself .
No More Hint for GooD Reversers ..

Q : The code that i have created using CCREMOTE wont works correctly .
A : The problem may be diffrence between your CopyControl Serial Number
with developer's one . You should create a new CopyControl with the
same Serial number . If CCREMOTE didn't worked , Try to change serial
number in the CCREMOTE file . This KeyField Described in previous
Questions ...

Q : Generic Way for CopyControl Under Windows , Shell or Object ?
A : It's long so let me describe it more detailed in comming days
Here I have hint for Crackers ...

Start Your FrogsIce .
Load SymbolLoader and Import Kernel32.dll.
CTRL-D
G DeleteFileA
Now Run protected Program ...
When you saw that lovely BLACK screen again ...
P
G DeleteFileA again
When you saw that lovely BLACK screen again ...
Step 4 ..5 Instructions
E EDI to know which file is removing , Edit the name to ignore deletion
G
and Exit the program .

A file with the name CC3216XX.DAT will remain on your windows temp dir.
Write a windows 3.1 (NE) exe which makes this DAT file .
replace it inside the CC object , and you never need that CCC and SYS
files again .

Q : I have an Older Version Than 1.59 , How to Unlock ?
A : Sorry I sugget you deadly to put that software into the trash and use
newer version . I have no answer to this , because I may never find
that older version of CopyControl. If Microcosm Send me a Copy I will
Help you then :)

Q : Changes on Version 3.02 and later ?
A : Its Depend on who you ask about news, Right Now there is a FUN frame
on the Microcosm official site, talking about new changes on winter.
Looks ICE ! But I will tell you the changes ...

1- CopyControl Signature on Floppy !
I guess they add some extra if-then-fuck-customers to their sources!
the signature is as before , just some checks are changed. this made
the must uncompatible new versions ... 01 , 02 , 03 and 04 even .

2- Where Master Track will be created !
Yes they found sometime,it is impossible to make a correct signature
with their new checks ! So they tried to retry this process on next
tracks and Mark Previous one as BAD in the FAT ! Backward Progress.

3- Making some Bugs on Diffrent Systems !
Yes , Your CopyControlled Disk May never work on My Intel - PIII ,
Because the FDC of my MotherBorads wont reply CC what it needs :)
Or You may See Some Blank Black Screen when pressing P or M keys in
CCLOOK.EXE Or Your AMDK6II may create incorrect KeyDisk SomeTimes.
Or Your Athelon may never accept Active-It Codes :)

4- Extra object Checking for CCADD.EXE .
Yes," This is very important to stop users , creating new MasterDisk
with an Unshelled version of CC. So We Put CCONTROL exception in our
Product Code field, We Will Ignore CCADD.EXE working with our serial
and we will ask for a fucking CCMB while unshelled program runs..."
Microcosm Developer Said for Himself .

5- New Story Made - "LOLOTNOTYPOT"
I was talking to zanadu on my MSN, Then i made a new story ...
Un4giv3N was too young , he was not able to tell CopyControl , Then
he told it topytontolol , Sometimes Later He added his ages with
add Un4giv3N'SAge,BonousAges assembly command and reversed the app.
So He told his new build "lolotnotypot" ...
Pay 100 USD to get full story at your home . Visa , Checks are not
accepted.

Q : Is there anything to modify CC parameters ?
A : I have to ask , is there any problem ? If there is , Here is a New tool
made by I.C.A called CCEICA . This is a Generic CopyControl MasterDisk
or Active-It Master modifier which make it possible for you to modify
protection parameters visually . This Utility is writen by Un4giv3N and
works in Win32 platform . But As you know none of Un4giv3N's programs
dont work correctly . ( For SCICA users specially :) , So this utility
will be published as soon with too many BUGS BUNNY !
With CCEICA you dont need any special information about CopyControl .
Before patching CCADD.EXE , I was creating working CopyControls with an
special build of this program .

Q : I could not found my question here .. ?!
A : Feel Free Sending that to Me using Mail. You may be answered Very Soon
Or May your question be added to the FAQ . If you didn't Get Answer
After 2 Week , Then You wont be answered .

Last Update : 31th July 2001

To Contact I.C.A:

WEB : http://www.icagrp.com or http://ica.cjb.net or http://ica.is-online.net
E-Mail: icagrp@bigfoot.com , CCProblem@icagrp.com
FAX : +1-435-3309235
Forum : http://icaf.cjb.net , forums.icagrp.com
Mailling List: http://icagrp.listbot.com , yahoogroups.com/icagrp

--UnforgiveN
[I.C.A]
ucomservices
05-23-2004, 06:48 AM
Hi!

Just going thru all the info given out by everyone. sure is interesting, but the way i see it, the easiest way out is what i do.

1. Take a mug of Coffee in my hand.
2. Sit down on my computer, which is installed with Copy2Pc Option
Board Card.
3. Run the software for the Copy2Pc Option Board Card.
4. Within 2 minutes you have another copy of the Copycontrol Master Disk.
5. Enjoy the Coffee ..................

ucomservices
mr.x
05-24-2004, 11:40 AM
Hi!

Just going thru all the info given out by everyone. sure is interesting, but the way i see it, the easiest way out is what i do.

1. Take a mug of Coffee in my hand.
2. Sit down on my computer, which is installed with Copy2Pc Option
Board Card.
3. Run the software for the Copy2Pc Option Board Card.
4. Within 2 minutes you have another copy of the Copycontrol Master Disk.
5. Enjoy the Coffee ..................

ucomservices

hey, what do you mean about Copy2Pc Option Board Card while we do not have C.M.D?! :whoops:
ucomservices
05-25-2004, 12:45 AM
mr x.

please clarify what u mean by C.M.D.?????

ucomservices
dELTA
05-25-2004, 05:45 AM
May I guess "Copycontrol Master Disk"? :)
Aimless
05-25-2004, 11:52 PM
I am really interested in these EXCEL addin protections which are protected by commercial protecters. I am currently breaking an excel addin that's got FLEXLM v9 for its protection (damn tough, no breakthrough yet, though).

Can you PM me and tell me what EXCEL addin this is? (or am I missing something?)

Have Phun
mr.x
05-26-2004, 12:55 AM
Hello ucomservices,

C.M.D means Copycontrol Master Disk.
basomad
07-24-2004, 09:32 AM
Hi people, this is my first post. I am new to this cracking-stuff. Got into it 3 days ago when I noticed a certain program wouldnt start anymore after the 6th of july, 2004. I searched the web a little, read some tutorials, found the needed tools and tried it out.

And gues what, within half an hour I had succesfully removed the 'protection'. Just a mather of changing a conditional jump into a normal jump. Pretty easy ;)

But now I am facing harder problem with the same program. This program basicly is a collection of little programs. It has little tests that can help you chosing what education or job to do. Most of them work fine, but it has 4 modules (tests) that are protected with copy control. It allows you to do the tests, but when you want to see the outcome, it says that the module Im using hasnt been activated yet and that I need to call some helpdesk and give the 9 digit serialnumber (200012426) and another 1 digit number (wich is 0) that are presented on the screen. They will give me password, wich I have to put in the password field and then it will be activated. Problem is: that helpdesk doesnt answer their phone. So now Im trying to find a way to get around it, untill I manage to get in contact with the helpdesk.

Right now, Im only interested in 1 of the tests. I have done 21 pages of questions and cant see the outcome now :S The module has it's own DLL's wich are loaded when you click the test's name and have made choice between looking at outcome or making questions. After some tracing with ollydbg, I found out that the outcome-DLL uses another DLL called ccchng32.dll. (copy control change?) This DLL somehow makes and starts a CCMV32AA.exe in the windows-folder and puts outcome in a dat-file. It uses this (I saw this in 1 of the registers): C:\WINDOWS>CCMV32AA.exe C:\PROGRA~1\PATHOFPROGRAM\ <ENTERED_PASSWORD> <Relative path to the hidden .ccc and .sys-files> /DC:\WINDOWS\CCMV32AA.dat

I tried running this program in cmd (without the /DC:\WINDOWS\CCMV32AA.dat) and it returned the exact error wich I see in a little pop-up when I enter a incorrect password.

Copy protection parameter changing.
Version: 2.01, Product code: XXX, Serial no.: 200012426, Update number 1.
Invalid code entered.

I have already tried editting the DLL, so that it would jump passed the error-message, but that only results in not getting an error message, and nothing happening.

I decided to do a search on "CCMV32AA.exe" and this forumtopic was only result. I was glad there was some info in it. Especially that faq.doc. Problem is, that FAQ is not easy to understand, the english in it is bad and it's a bit too advanced for me I think.

Therefor, I wanted to ask if someone on this forum understands it all well and wants to help me solving my problem.

Thanks in advance

Edit: Ok, if found the developers version of the program (demo of version 3.8), wich has CCLOOK and CCChange etc in it.
JMI
07-24-2004, 10:26 AM
This, essentially, is a crack request and we don't do that here. It is obvious that you have not read our FAQ posted in the BIG RED LETTERS at the top of the Forums.

Here, you are required to do your own work, show that you have done that work and then ask questions. You are just starting out, have a great deal of further basic study needed to even begin and you want someone else to "solve" your problem with lack of basic knowledge for you. We can't and don't do that. Blindly nopping jumps or skipping them, without understanding what is going on, is not a way to LEARN how to reverse engineer. :whoops: There is no shortcut to acquiring such knowledge. It is acquired by long and continual study of the basic principles of how things work and how they can be watched and how they can be changed. :idea:

Regards,
basomad
07-24-2004, 10:44 AM
Ye okay, I see your point and actually did read the FAQ, and thats why I tried not to make it a crack-request, wich I failed at then I gues.

And you are probably right. I was hoping I could learn this fast and quick, but I gues I realy have to learn it slowly.

Im sorry for trouble I have caused and will try to do more research on my own.


Windows API
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Windows API
PDA

View Full Version : Windows API

Stilgar
11-06-2003, 10:52 AM
I have a Win32 API in hlp format in my computer, but I'm looking for a list of returned values (in assembly) by the various APIs.

By searching the net, I can found the return values of specific APIs. Does anyone knows of a downloadable version of the Win32 API that list the functions and their return value?

Example:
MessageBox
What it does...
blah blah blah

Return Values
OK - 1
Cancel - 2
Abort - 3
Retry - 4
Ignore - 5
Yes - 6
No - 7

Thanks in advance!
Fake51
11-06-2003, 12:12 PM
I have a Win32 API in hlp format in my computer, but I'm looking for a list of returned values (in assembly) by the various APIs.

By searching the net, I can found the return values of specific APIs. Does anyone knows of a downloadable version of the Win32 API that list the functions and their return value?

Example:
MessageBox
What it does...
blah blah blah

Return Values
OK - 1
Cancel - 2
Abort - 3
Retry - 4
Ignore - 5
Yes - 6
No - 7

Thanks in advance!

If I were you I'd just check with windows.inc from, say, the masm package. The win32.hlp will list the main results from the api's, and you can get the specific values in windows.inc

Fake
Zwyzum
11-06-2003, 03:44 PM
Hi

Fake51 is right. Also the win*.h files you can find in any C/C++ compiler will do.

Zwyzum
Stilgar
11-07-2003, 10:25 AM
I'm downloading masm and tasm. I'll look at the win*.inc and try to use the info here.

Thanks to Fake51 and Zwyzum for the quick answers.


IDE or editor for Intel C++???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDE or editor for Intel C++???
PDA

View Full Version : IDE or editor for Intel C++???

yaa
11-06-2003, 05:19 PM
Hello,

is there an ide or editor that can be used with Intel C++ 7.x???
Also, does Intel C++ require MS VC++ or not to work?

Thx.

yaa
Bengaly
11-07-2003, 05:32 AM
no ide required (it is optional), you can use the command line .
Intel C++ can be integrated into VisualC++.
with that ability you can switch between the standard VC Compiler, or use the Intel Compiler.
VC7/VC6 supported.


armadillo "magic jump"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > armadillo "magic jump"
PDA

View Full Version : armadillo "magic jump"

hwti
11-06-2003, 07:46 PM
Is there any tutorial newer than Ricardo Narvaja 's one ?

I had no problem for the dump, but in the second part, I can't find the "magic jump"
I found the function which should contain it (the code is a bit different than the tutorial), but the function is different inside, I tried every jump in the function, and I don't find any which works
JMI
11-06-2003, 08:45 PM
This just illustrates the problem with trying to follow a tut "exactly." You have to realize that the protection makers read them also and try to make changes in their code to avoid what is shown in the tut. You have to use your brain to find out where to go next.

Regards.
Ricardo Narvaja
11-07-2003, 04:03 AM
if you can more examples in all the tutes of armadillos has differents cases of magic jumps.

65-66-67-68-69-70-71-72-74-77-78-79-80-81-82-83-84-86-88-150

are all tuts on armadillo in differents versions and types and any has different magic jumps, if you put a BP in the line the program write the bad values to the iat and RUN TRACE till stop again in the same line, look in the run trace window, and the magic jump are there in the run trace list, trying a little you find a magic jump easily.

Ricardo

This just illustrates the problem with trying to follow a tut "exactly." You have to realize that the protection makers read them also and try to make changes in their code to avoid what is shown in the tut. You have to use your brain to find out where to go next.

Regards.
Ricardo Narvaja
11-07-2003, 04:07 AM
Ths page of crackslatinos when you find the tuts is

hxxp://www.crackslatinos.hispadominio.net/

and in my FTP are the programs to practice

Ricardo

if you can more examples in all the tutes of armadillos has differents cases of magic jumps.

65-66-67-68-69-70-71-72-74-77-78-79-80-81-82-83-84-86-88-150

are all tuts on armadillo in differents versions and types and any has different magic jumps, if you put a BP in the line the program write the bad values to the iat and RUN TRACE till stop again in the same line, look in the run trace window, and the magic jump are there in the run trace list, trying a little you find a magic jump easily.

Ricardo
hobferret
11-07-2003, 03:22 PM
Ths page of crackslatinos when ypu find the tuts is

hxxp://www.crackslatinos.hispadominio.net/

and in my FTP are the programs to practice

Ricardo

Ricardo :)

I have just been looking at your site - on the home page you say; this is the english version - "Now I have also learned that today I am not so bad a cracker as before, hehe." + "I hope to be able to continue with this teaching what I go on learning in this world of cracking, making good friends......"

Well [B]amigo mio [B] you have so far done extremly well and passed much knowledge onto us all - thank you. :cool:

/hobferret
Ricardo Narvaja
11-07-2003, 03:37 PM
thanks, is the true.

Ricardo

Ricardo :)

I have just been looking at your site - on the home page you say; this is the english version - "Now I have also learned that today I am not so bad a cracker as before, hehe." + "I hope to be able to continue with this teaching what I go on learning in this world of cracking, making good friends......"

Well [B]amigo mio [B] you have so far done extremly well and passed much knowledge onto us all - thank you. :cool:

/hobferret


Yet another trymedia thread
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Yet another trymedia thread
PDA

View Full Version : Yet another trymedia thread

bloodypriest
11-06-2003, 10:33 PM
Hello there,

I've been trying to unpack activemark packed executables for a while and after seeing I'm not the only one who's interested in this protection, I've decided to start a thread about it.

First, I must say that I'm a lazy guy so I searched for a tutorial before trying to do the job myself. Found one in russian. The guy used TRW2000 as a debugger but when I tried, I wasn't able to unpack anything using that debugger. So I started working on it myself.

I started SoftICE. What a surprise! The game wouldn't even start up. So I searched on forums if I could find any info about any anti-debugger tricks it used (still lazy guy tendencies)

What I got now is this :

1. It uses MeltICE as it's primary SoftICE detection trick.
2. Next, it tries to find SoftICE using INT3.
3. It also uses the "Crush the Frog" variant of MeltICE to prevent FrogSICE from working.

(Thanks Buntus for the info).

So I fired up ICEDump. BTW, I never was able to get ICEDump to work until I installed Driverstudio 2.6 . Don't ask me why, it just wouldn't hook up with prior versions while it magically hooked up with Driverstudio 2.6 .

I tried again starting the game. Seemed to start but BOOM! Page Fault. I killed the process in SoftICE then GPF in Ring 0 so I did continue and YESSS, BSOD! But this BSOD was kind of harmless so I continued my debugging session.

What was the problem. SoftICE was well hidden. Why did it crash? So I searched and searched and searched. And then I found on hxxp://www.reverse-engineering.net a nice little proggie named BANG! And right in the readme were these lines :

another program i found uses the offset between int1 & int3 during small
parts of unpacking itself . thus, if winice is running, or in your version
of windows this figure is different to 10h, it crashes . . (ask webmasta :)

Fusion & Softlocx v4 use this method.. hxxp://www.bit-arts.com/
And guess what : Activemark is using this kind of trick too. So I tried firing up BANG! but it wouldn't work with ICEDump already hiding SoftICE; so I unloaded ICEDump first and then I fired up BANG! and YESSS, the game started.

So what was left to do was to make a version of BANG! which wouldn't check whether SoftICE was loaded or not and would do it's trick anyway (in order to start BANG! on top of ICEDump).

The modification is fairly trivial since the source code is included and I leave that up as an exercise to you. Oh yeah, this program is for Win9x only. WinNT and Win2k users you're on your own (but I read on another topic that IceExt works). And WinXP users, what are you waiting to ditch that CrapOS :)

WARNING : The modification I suggested in the previous paragraph is dangerous and not fully tested. For instance, if you start BANG! two (or more) times in a row and then start an ActiveMark protected executable, there's a high chance your computer is gonna freeze (at least mine did). Fortunately, starting BANG! on top of ICEDump seems to work fine.

Oh yeah, I almost forgot : a great many thanks to r!sc for his program and his info about int01 and int03 displacement.
bloodypriest
11-07-2003, 12:34 PM
It seems I celebrated too fast about being able to run the sucker through SoftICE. Trymedia seems to have included some code that corrupts SoftICE. Just try setting a breakpoint and single-stepping, you'll end up in some code in VMM. This behavior occurs even when you set a breakpoint on a windows API. Shut down the Trymedia protected app and SoftICE works Ok again. Start another and whoops.

Nevertheless my previous post remains valid with one exception, Activemark doesn't use the INT3 return value to detect SI, it merely uses the displacement between INT1 and INT3 (in addition to MeltICE).

Does anyone have a solution which would allow to single step in SI while a Trymedia application is active?
Hopcode
11-09-2003, 04:32 PM
It seems I celebrated too fast about being able to run the sucker through SoftICE. Trymedia seems to have included some code that corrupts SoftICE. Just try setting a breakpoint and single-stepping, you'll end up in some code in VMM. This behavior occurs even when you set a breakpoint on a windows API. Shut down the Trymedia protected app and SoftICE works Ok again. Start another and whoops.

Nevertheless my previous post remains valid with one exception, Activemark doesn't use the INT3 return value to detect SI, it merely uses the displacement between INT1 and INT3 (in addition to MeltICE).

Does anyone have a solution which would allow to single step in SI while a Trymedia application is active?

Install windows 2K. use IceExt
and concentrate on the real part of the protection.

FF15 / FF25 mangling.

I didn't look at it since the other day, but noone apparently did either.
evaluator, giving up ? :-)
bl00dk@
11-22-2003, 04:51 PM
IcePatch v2 + Bang! will hide Sice on Win9x, works fine for me.


SoftICE Driver Suite 3.0.1 (StinkyD) problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE Driver Suite 3.0.1 (StinkyD) problem
PDA

View Full Version : SoftICE Driver Suite 3.0.1 (StinkyD) problem

theCaller
11-07-2003, 04:24 AM
Hi,
I've installed the SoftICE Driver Suite 3.0.1 and a problem has come out....

After the installation and uninstallation (that's gone good) I cannot install my ethernet adapter (D-Link 538TX 10/100) drivers anymore.... as a matter of fact the Driver Installation Wizard camplains about not finding some file (not one from the adapter CD distributon driver because at first installation the drivers was ok) ..... any idea????

My OS is Win2K SP3

another question:

why the visual SoftICE needs to hook a network endpoint (say COMx ...USB something or ethernet card) if I only need to do debugging locally?
Bengaly
11-07-2003, 05:35 AM
if you'd buy SoftIce / DSx you could call compuware support..but i guess you didn't. :o
theCaller
11-07-2003, 05:40 AM
if you'd buy SoftIce / DSx you could call compuware support..but i guess you didn't. :o

thanks, Bengaly .. useful observation. Now i'm confident the adapter can install succesfully. :rolleyes:
Woodmann
11-07-2003, 06:21 PM
Have you solved your problem ?

Woodmann
naides
11-07-2003, 07:06 PM
Hi,
I've installed the SoftICE Driver Suite 3.0.1 and a problem has come out....

After the installation and uninstallation (that's gone good) I cannot install my ethernet adapter (D-Link 538TX 10/100) drivers anymore.... as a matter of fact the Driver Installation Wizard camplains about not finding some file (not one from the adapter CD distributon driver because at first installation the drivers was ok) ..... any idea????

My OS is Win2K SP3

another question:

why the visual SoftICE needs to hook a network endpoint (say COMx ...USB something or ethernet card) if I only need to do debugging locally?

1-Visual SoftIce Is conceived for debugging of a client computer through some network connection. For local debugging, you do not need visual Sice. RTFM.
Perhaps skipping the Visual Sice option may help with your problem.

2- Chances are the file that your D-Link installer is complaining about was part of Windows, or Sice Driver installed an updated version, look up the name of the file in Google, and you may find some info, description, and perhaps D/L the file from M$.

3- I Have had rather bad experiences with DS 3.0. If you want to use it for RCE purposes read other threads about it in this board.
theCaller
11-10-2003, 04:50 AM
well guys
thanks for the feedback :) ... yes the problem was that the SIDS 3.0.1 installation (my fault in installing Visual SI without knowing what exactly I was doing .. sob) dropped some Win files ... dunno exactly which ones; say one I could check out was the RTL8139.sys driver for the realtek chipset of the adapter ... replaced by one I had as a backup but with no relevant changes: the Installation Wizard went on complaing about missing files (damn)... so ... I had to make a win2k installation repair procedure ... but I'm no satisfied of this kind of behaviours ... so maybe the win2k I've on needs al cleaning up ... dunno really ....

so I'm planning passing to win 2003 server enterprise ... I heard such good things about it.

However, what has happened to me is kind of strange and event thorugh searches around the web I could not find anyone having the same problem as me ... neither none of you so I think it could be something strange in my OS.

What do u think? :)

Thanks again for feedback.
naides
11-10-2003, 09:26 AM
I had to make a win2k installation repair procedure ... but I'm no satisfied of this kind of behaviours ... so maybe the win2k I've on needs al cleaning up ... dunno really ....

so I'm planning passing to win 2003 server enterprise ... I heard such good things about it.

However, what has happened to me is kind of strange and event thorugh searches around the web I could not find anyone having the same problem as me ... neither none of you so I think it could be something strange in my OS.

What do u think? :)

Thanks again for feedback.

Do not be surprised by inconsistent and unexpected behavoir from Microsoft Windows, particularly with third party hardware drivers. It is the rule, not the exception.

Win 2003 may work wonders, i don't know, but I can tell you one thing: For SoftIce and cracking purposes, you will be on your own.

For me The move from Win98 to Win2000 was rather smooth, as Win NT have been around for a while, and there was plenty of experience out there with NTIce.
WinXP was so painful that I opted to keep a computer with win98 intalled and use it for RCE stuff. I don't know if I talk for everyone in here, but RCE is simple in win98, and, with some well known exceptions (Unpacking, IAT reconstruction), what you crack in W98 works
in XP.
Win2003 server may have its own wrinkles that you will have to Iron without the luxury of accumulated knowledge or tutorials.
In other words, if you are relatively new to RCE, stick to the known path.
theCaller
11-10-2003, 09:45 AM
thanks naides,
that's a good point .. I'm not far new in RCE ... I've done some little stuff on my own .. nothing particularly difficult ... but I can tell you I'm definitely not that skilled as I would like to ... hope to grow :).
however, It's a really good idea to keep a win98 inst. somewhere, instead of brainstorming on why some breakpoint does not work here or there ....

What got me really surprised is that a microsoft partner product (in particular a kernel mode debbugger working close and with MS internals) fucked up so 'simple' stuff like network adapter drivers without a documentation on that particular situation or drawback consequences of installation failures... but maybe it was of a bad configuration of my OS, who knows ..

I'd better set up win98 somewhere on my second machine then :)

Thanx for supporting :)
Rummy
11-10-2003, 11:23 PM
There's a thread not so long ago called "Beginner's Visual SoftICE" where I described a similar problem. Look at the second message in that thread and you'll see that I had network driver problems as well after installing VSI. The help I got on how to cleanly remove the unwanted driver worked. Saved me from yet another re-install of Win2K (also SP3).
theCaller
11-11-2003, 04:48 AM
There's a thread not so long ago called "Beginner's Visual SoftICE" where I described a similar problem. Look at the second message in that thread and you'll see that I had network driver problems as well after installing VSI. The help I got on how to cleanly remove the unwanted driver worked. Saved me from yet another re-install of Win2K (also SP3).

Thanx Rummy,
yau've clearly exposed that the VSICE messes with the NICs drivers to the point it removes every driver installed before with no easy recovering proc. Nice, really nice ... compuware has done a really good job :D .... sad .. so sad.

Anyway my only fault was I did not get enough information about VSICE and the suite it comes with before installing it .. now I got experience ;) ...

Thanx for supporting :)


Could I ask u how to fix the problem in the mentioned keygenRSA.asm?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Could I ask u how to fix the problem in the mentioned keygenRSA.asm?
PDA

View Full Version : Could I ask u how to fix the problem in the mentioned keygenRSA.asm?

hongker
11-07-2003, 07:12 AM
In my case, N=B80A90BF53C6C979; D=2492F4F0BA859F9; E=10001

c=cryptograph
m=plaintext

c=m^e%n
m=c^d%n

Assumes the initialization of the bignum N,D in the following bignum form of

D dw 02
db 00,01,00,01

N dw 04
db 0b8h,0ah,090h,0bfh,053h,0c6h,0c9h,079h

M (source buffer/plaintext) = 39 ascii(9)

then the RSA_PRIVATE_ENCRYPT will return the correct values 9DC42A4223FD011D
in the bignum form of DB 04,00,9d,c4,2a,42,23,fd,01,1d,00,00

the problem is in the related reversing process :

Assume:

N dw 04
db 0b8h,0ah,090h,0bfh,053h,0c6h,0c9h,079h

D dw 04
db 02h,049h,02fh,04fh,0bh,0a8h,059h,0f9h

then invoke the process of RSA_PRIVATE_ENCRYPT, it won't return the correct values

e.g. 39 in the bignum form of db 01,00,39.

it return a 4*16bit wrong value, like the following
db 04,00,xx,xx,xx,xx,xx,xx,xx,xx

or m=CADE4E832627B4F6 return c=32F9776EF8F0F9E6
but if u calculate the m with c u will get a wrong result
such as
expmod(0x32F9776EF8F0F9E6,0x10001,0xB80A90BF53C6C979)=12D3BDC3D260EB7D

I don't know what caused this obvious wrong result in the procedure of RSA_PRIVATE_ENCRYPT.

Could I ask u how to fix the problem in the mentioned keygenRSA.asm?
If it is prossable Please give me some guides with simple demo/example. Thanks a lot. :eek: :eek:
mike
11-09-2003, 11:36 PM
In my case, N=B80A90BF53C6C979; D=2492F4F0BA859F9; E=10001According to http://www.alpertron.com.ar/ECM.HTM

N = 13261571204164536697 = 3533507051 * 3753090347 = p * q, so

phi(N) = (p-1)*(q-1) = 3533507050 x 3753090346 = 13261571196877939300

D = E ^ -1 mod phi(N) = 65537 ^ -1 mod phi(N)
= 164714877920238073
= 0x2492F4F0BA859F9

So you got that right. Take the plaintext you're trying to produce, raise it to the D power mod N, and use that as the ciphertext. Then when the serial checker raises it to the E power, you get your plaintext back.

If that's not working for you, it must be a bug in your code or a typo or something.
hongker
11-10-2003, 07:32 AM
thanks


Can't start softice in winxp sp1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Can't start softice in winxp sp1
PDA

View Full Version : Can't start softice in winxp sp1

happyboy
11-07-2003, 05:24 PM
Hello everyone...
please help me in this problem with SoftICE v4.05 for WinNT/2k.
I use WinXP SP1 and I made SoftICE start in manual mode. When I try to start it from the start menu I see a quick flash of a command window but SoftICE never starts.
Then I opened a command window and typed "net start ntice".
It reports an error as shown in the follwing picture:
http://www.shohra.com/happyboy/error.jpg
Please tell me what to do??
if information about my computer's software/hardware is needed, I will provide you with them...
Thank you very much.
naides
11-08-2003, 07:22 AM
Only the later versions of Sice, 4.26 4.27 and 4.30 say they have WinXP support. While some people claimed to have fixed 4.05 with a patch, it never worked for me. There were tons of posts about the issue in this forum 18-24 months ago. Please search.
happyboy
11-08-2003, 12:57 PM
thank u.I'll search for a newer version then...


Need help changing an email addy in a packed library
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help changing an email addy in a packed library
PDA

View Full Version : Need help changing an email addy in a packed library

dramatiker
11-09-2003, 06:06 AM
hello community

ive a problem changing an email addy in 2 libraries
infos will be send to these email addys, so i want to change them

i have two libraries (1.dll and 2.dll)
1.dll is packed with pe compact 1.8x
i dumped this library with procdump to get the mail address its
email1@email.com

2.dll is packed with exe32pak 1.38
i dumped this library too and saw the mail addy: email2@email.com

both libraries do the same
the difference between these files is the protection and the email addy

i tried a lot of unpack tools but no unpacker works with pe compact 1.8x and/or exe32pak 1.38
i also tried the tool from bedrock (member in this forum)

is there a way to change the mailaddress
ex. email1@mail.com in email1@email.net
(only switching/changing one letter)
so that the infos which will be send never arrived the original address

thx for infos
drama

ps:
if somebody can help me to change the email and the result is working
i will give him a present =)
LoST
11-11-2003, 06:45 PM
hello community

is there a way to change the mailaddress
ex. email1@mail.com in email1@email.net
(only switching/changing one letter)
so that the infos which will be send never arrived the original address

thx for infos
drama

ps:
if somebody can help me to change the email and the result is working
i will give him a present =)

What about hooking LoadLibraryA from the program that use these libs and doing something like :

if dllloaded='1.dll' or '2.dll' then
{
loadlibraryA(dllloaded)
mempatch the strings
}
else loadlibraryA(dllloaded)


Stuck with an App
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Stuck with an App
PDA

View Full Version : Stuck with an App

LOUZEW
11-11-2003, 11:03 AM
Hi, guys

I'm stuck with a protected App called "PlanningPME"
(Link deleted by Kayaker, and moved from "Advanced Reversing and Programming")

i've found the 30 uses limit an bypassed it, but there is a date limit to use this prog ( 2003 december 31) and i can't find how to do.

I'm not requesting a crack, i want only to learn this kind of protection and how to find the good place in the proggy to solve this problem !

If somebody can help, please PM me for the link to Download this App and i'll tell you what i've found !

Thank's
MaRKuS-DJM
11-11-2003, 11:44 AM
what about "GetSystemDate" or "GetSystemTime" -API? but i don't know
LOUZEW
11-11-2003, 04:25 PM
Yes, tryed them but there is too much calls to these Functions ! unable to locate anything

Thank's
naides
11-12-2003, 02:59 PM
Yes, tryed them but there is too much calls to these Functions ! unable to locate anything

Thank's

Are all the calls coming from your APP?
If you have some stuff in the system tray, like real player, schedulling apps, some FireWall apps etc, they all fire GetSystemTime constantly, and you miss the call from your app.

Try dead listing your app. Look for the time-related functions and the context they are used.
Just a suggestion.
LOUZEW
11-13-2003, 04:40 PM
Thank's for your Help, but i'm sure these API calls are done in my App (checked under SoftIce), and no App running else.
This App is a planning one, then calling times Api seem to be a normal thing.
It seem to be hard to find an entry to learn this protection.

You can find this APP at h**p://www.planningpme.com, or PM me for a direct link !
Thank's

Are all the calls coming from your APP?
If you have some stuff in the system tray, like real player, schedulling apps, some FireWall apps etc, they all fire GetSystemTime constantly, and you miss the call from your app.

Try dead listing your app. Look for the time-related functions and the context they are used.
Just a suggestion.
naides
11-13-2003, 10:37 PM
Thank's for your Help, but i'm sure these API calls are done in my App (checked under SoftIce), and no App running else.
This App is a planning one, then calling times Api seem to be a normal thing.
It seem to be hard to find an entry to learn this protection.

You can find this APP at h**p://www.planningpme.com, or PM me for a direct link !
Thank's
Oh well. I am not going to D/L the 10 Mb this app brings on, but I am going to continue my favorite pass-time: come up with outlandish strategies for difficult problems: I do this for a living in Real Life.

Bet you most of the time API calls the app makes come from the same area in the code: Perhaps a message handler. Filter it out. Make the BPX GetSystemTime IF ESP != [The address of the code that calls GetSystemTime relentlessly]

This way only when the Time API is called from somewhere else Sice breaks, decreasing your false call rate.

what about using nag screens? what kind of message would you get if you advance the clock to beyond the time limit?
Even if it quits silently you may break on PostQuitMessage API.
Aimless
11-14-2003, 01:41 AM
The idea is very simple.

In order for the program to note that dates are being changed, it has to store the date somewhere. There are only 4 candidates possible:

1. Mucking around in the registry (favourite)
2. Mucking around in the files (next best-of-line)
3. Modifying the binary or its dependents (dlls) somewhere.
4. Modifying certain HDD sectors.

For each, find the solution:

1. Regmon
2. Filemon
3. FC /B (binary mode)
4. WHoops.

Chances are, 98% of the time, it will be the first two options.

BTW, just because the key accessed in the Regmon is CLSID, does not mean that the date will not be stored there ;)

Have Phun
Aimless
11-14-2003, 01:44 AM
And, I almost forgot...

Here's a small trick if you are running Windows XP to ensure that you are not coming under a really commercial protection.

1. Before installation of app, create a system restore point (learn it if you do not in the windows XP documentation)
2. Install the application
3. Muck it up
4. Uninstall the application
5. Restore the system restore point
6. Re-install the application

If the application works after re-installation again, then you know for SURE that the protection is either 1 or 2.

Have Phun
LOUZEW
11-19-2003, 04:18 PM
Hi,
Thank's Aimless and Naides for your Help
I've tryed your tips and i can't found anything interesting.
Traced this App with Bounchecker and the only thing i can locate is a whole sequence of :
GetMessage
PeekMessage

just before the App exit !

I don't know how to use these infos, if somebody can help ?
LOUZEW
11-22-2003, 07:05 AM
Many thank's Naides for your help !
PM sent
naides
11-22-2003, 10:39 AM
The idea is very simple.

In order for the program to note that dates are being changed, it has to store the date somewhere. There are only 4 candidates possible:

1. Mucking around in the registry (favourite)
2. Mucking around in the files (next best-of-line)
3. Modifying the binary or its dependents (dlls) somewhere.
4. Modifying certain HDD sectors.

For each, find the solution:

1. Regmon
2. Filemon
3. FC /B (binary mode)
4. WHoops.

Chances are, 98% of the time, it will be the first two options.

BTW, just because the key accessed in the Regmon is CLSID, does not mean that the date will not be stored there ;)

Have Phun

This app had yet another place to store the time limit (12/31/03): It was hard coded in the program!
if current year > x07D3h (2003 ) then quit.

Who would think of such a thing?


String refs for a VB prog in IDA?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > String refs for a VB prog in IDA?
PDA

View Full Version : String refs for a VB prog in IDA?

crassy
11-11-2003, 11:25 AM
Hello,

Trying to disassemble a VB app. Ive set string type to "Pascal 2 byte length" in "Options / ASCII String style" and the strings come up in the Strings window.... But IDA doesnt show where the strings are referenced like it does in all C programs... Is there any way to make it show xrefs to strings?

Thanks!


Writing RSA keys to keyset - permission errors
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Writing RSA keys to keyset - permission errors
PDA

View Full Version : Writing RSA keys to keyset - permission errors

BassPlayer
11-11-2003, 03:53 PM
I'm trying to use cryptlib for a course that won't allow me to use the encapsulation functions.

My Steps

Program 1
Create Context - RSA
Set Context Label
Generate Keys
Open Keyset file (create)
AddPrivateKey
- no errors at runtime -

Program 2
Open Keyset file (read only)
GetPublicKey from key set file
Encrypt
- permission error

Are there some attributes I can use to allow this to work? I've email Peter but his answers havn't helped me to find the problem.

Thanks
mike
11-11-2003, 04:34 PM
I'm trying to use cryptlib for a course that won't allow me to use the encapsulation functions.If you're doing RSA & you can't use high level stuff, then you're much better off with a simple big integer library.I've email Peter but his answers havn't helped me to find the problemDon't email Peter directly, email the support mailing list.

If you still want help with your code, you'll have to post it. I suggest you first look at http://www.woodmann.net/forum/showpost.php?p=30122&postcount=3 for an example of how to create the keyset properly.
BassPlayer
11-11-2003, 05:18 PM
Thanks, Mike. I looked at your post, and I suppose I should have asked about certificates before I posted. Is it imperative to use certificates? I'm trying to keep this simple (and the project requires that I create my own certificate class, so it'll just be more confusing that way.)

Once I've created the RSA keys in certificates, can I then use the cryptEncrypt function with the certificate? I've used the cryptEncrypt function with RSA keys with no problems, it's writing them out and reading them in that cause the permission error.

I'll try to post the code, if you don't mind helping.

Thanks!

If you're doing RSA & you can't use high level stuff, then you're much better off with a simple big integer library.Don't email Peter directly, email the support mailing list.

If you still want help with your code, you'll have to post it. I suggest you first look at http://www.woodmann.net/forum/showpost.php?p=30122&postcount=3 for an example of how to create the keyset properly.
BassPlayer
11-11-2003, 05:36 PM
http://home.earthlink.net/~rhamann/key.c
http://home.earthlink.net/~rhamann/test.c

key.c creates the key and saves it to a keyset file
test.c reads the key then tries to encrypt with it.

Should these stubs work, or do I have to use a certificate?
mike
11-12-2003, 04:05 AM
the project requires that I create my own certificate classUm, what project? If it's homework and you're expected to understand the math of RSA, then cryptlib is the WRONG way to go about it. If it's paying work, why would they require you to write your own cert class?

First let's talk about the system you need to build, then we can talk about how crypto comes into it, and then decide if cryptlib has anything to offer.
BassPlayer
11-12-2003, 12:44 PM
It's homework, but not at the level of RSA internals, just at the implementation level.

We're recreating a SET system piecemeal, so I'm allowed to link in other encryption protocols, but not to used the encapsulated objects (signature functions, envelopes, etc.)

I'm just trying to get access to the encrypt and decrypt functions of AES and RSA. We're using onetime keys for AES, then encrypting that key with RSA, so all I have to do is export the AES in a method that can be imported, which cryptlib should provide to me. As far as RSA goes, I need to be able to save and share public keys.
He specifically wants us to build our own envelopes and certificates according to his specification.

Thanks, and if my comment about Peter's email not helping was offensive, I truly apologize. I looked at it again after posting and I think it looks rude and I should have used different wording
mike
11-16-2003, 06:35 PM
It's homework, but not at the level of RSA internals, just at the implementation level.

We're recreating a SET system piecemeal, so I'm allowed to link in other encryption protocols, but not to used the encapsulated objects (signature functions, envelopes, etc.)

I'm just trying to get access to the encrypt and decrypt functions of AES and RSA. We're using onetime keys for AES, then encrypting that key with RSA, so all I have to do is export the AES in a method that can be imported, which cryptlib should provide to me. As far as RSA goes, I need to be able to save and share public keys.
He specifically wants us to build our own envelopes and certificates according to his specification.
OK. Cryptlib purposely makes it hard to work with key material directly. You cannot ever get a handle to the bytes in the RSA private key, for instance. You don't seem to need that, though, so look at page 118 "Encryption and Decryption" for details about the low-level interface.

Looking at your code, you're doing some wierd stuff: why are you calling cryptEncrypt and cryptDecrypt in the middle of your key generation?

If I were in your place, I'd get a different crypto library that was designed at a lower level, like one of the early versions of Wei Dai's Crypto++ library. It's hard enough to learn cryptography without having to learn cryptlib's object model.

Thanks, and if my comment about Peter's email not helping was offensive, I truly apologize. I looked at it again after posting and I think it looks rude and I should have used different wordingNo, I didn't think it rude, it's just that Peter ignores most of those requests and you'll have better luck on the mailinglist.


Need help in this crackme (delphi project)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Need help in this crackme (delphi project)
PDA

View Full Version : Need help in this crackme (delphi project)

happyboy
11-12-2003, 05:21 AM
Hello...
I am a newbie and I am trying to crack the "Crackme" in the attachments but because I'm using WinXP I can't put a breakpoint 4 "hmemcpy" and I can't also use any vb calls (such as __vbastrcomp" cuz it's not a vb program...
actually this crackme contains many parts 2 crack (nag-serial-name and serial) so tell what calls should I put a breakpoint 4 4 each part...
thanx alot...
cuPegasus
11-12-2003, 09:16 AM
hi happyboy,

This CrackMe isn't that hard. It's written in Delphi. You can reverse it by using OllyDbg only...

Hint: set a "bpx MessageBoxA", this will help you alot in finding the correct codeparts for each protection (look at the stack, there's the caller stored)

The "serial only" is a hardcoded string...
The "serial-name" is funny. The layout for serial cintains hardcoded parts. It looks like "??-????-???????"...

work well,
Pegasus
happyboy
11-12-2003, 02:21 PM
actually I don't know how 2 use ollydbg and I couldn't find good tuts about it...so if u don't mind please tell me how 2 set the breakpoint u mentioned...
cuPegasus
11-12-2003, 03:06 PM
setting breakpoints in OllyDbg is familiar to SI. You need an PlugIn called CommandBar. Then you're able to handle OllyDbg such as SI.

The most important breakpoint is @ 42A1A9 (call MessageBoxA)
The application will break during startup (to show the entry MessageBox you have to delete).
If you went to Name/serial, press "check it baby!", you'll break again @ 42A1A9. Take a look at the stack: there is an entry who called this messagebox (42FB37). Trace back to the beginning of this routine (42F998) and reverse the algo. The procedure for hardcoded serial is the same....
happyboy
11-13-2003, 07:53 AM
thank u very much...actually I think that OllyDbg is more useful than SICE...so i'm goin' 2 use it from now on thoough there's no enough tuts about it...
MaRKuS-DJM
11-13-2003, 11:18 AM
you aren't right... softice is more effective because it's an system debugger and olly only an app debugger... but it's much easier to handle olly!
bl00dk@
11-14-2003, 01:57 AM
The Serial/Name part:

This is very easy just break on messageboxa and when back in crackme's code then search for your fake serial, on the 2nd found instance you'll see the real serial right above.

The Serial part:

Break on messageboxa and when back in crackme's code then search for your fake serial, put a breakpoint on the 2nd found instance(bpm xxxxxx r). Leave SI & Click on "Check it Baby!" and when SI breaks press F11 twice, EDI now contains the right Serial.
Foreigner
11-14-2003, 02:13 PM
Hi all,
the crackme is written in Delphi and I was wondering why no one speaks about Dede... It's very easy to solve delphi crackme using this great tool, don't you think?

Regards,
foreigner
cuPegasus
11-14-2003, 03:51 PM
maybe... But i don't use it. Analyzing this File in DeDe takes longer than cracking it with SI/Olly .... and the disassembled text is the same...
happyboy
11-14-2003, 07:12 PM
hello everyone...
I cracked it but I am trying 2 make a keygen for the name-serial part of the crackme...wish me luck.
ZaiRoN
11-15-2003, 04:26 AM
Hi,
the three tools mentioned (Olly, SI and Dede) are valid for solving this challenge, it depends on your personal attitude.
Personally, I prefer to use all the available tools (combining them, why not).

Happyboy: good luck :D

It could be great to see two final tutorials for this challenge, one using Olly/SI approach and one using Dede...

ZaiRoN
cuPegasus
11-15-2003, 09:35 AM
Tutor with OllyDbg...
cRk
11-15-2003, 10:23 AM
great tut cuPegagus! but i think you used many bytes to kill that nag/messageboxa you see this delphi form begin at 0042F784 and the rest of those bytes are not needed... so is better to kill it clean with just a C3

6A/C3 :cool:

Best Regards!
cuPegasus
11-15-2003, 10:41 AM
This technique works, too.
But by NOPPING the 6 relevated bytes the code keeps readable. Also i'm not a friend of "1byte patching". The patched areas are fast to find with the used technique...
It's a "clean" way, just my two cents...
ZaiRoN
11-23-2003, 11:19 AM
Hi All,
first of all I would like to thank cuPegasus for his tutorial.
I did write this simple txt file to describe how to approach the crackme using Dede. The minimini tutorial is based upon cuPegasus's tutorial because for solving the crackme with only Dede it is not so easy. Why? Well, mainly because you works only with the dead list. Dede will help you to locate all the informations you will need in order to solve the crackme but the use of a debugger is needed and this is the reason why I will use some parts from the other tutorial. I hope these notes will help you to take familiarity with this tool.
I also hope cuPegasus does not mind me for stealing some parts from his tutorial :D

Ciao,
ZaiRoN
cRk
11-25-2003, 12:24 AM
cuPegasus your comment make me thing you did reply in some arrogant way. i never said your way was wrong and it will do the same job.. but i'm always open minded to share knowledge + new ideas :)

ZaiRoN this is how Dede get the info about the Forms.. and where begins, where Ends..

on 0042F784 (6A00) begin the form of the messageboxa....

look in reverse order with your hex editor, in this case i used HexWorkshop in hex value, look for 84F74200

and you'll find --->

636B110084F742000A466F726D437265
ck....B..FormCreate

means that's the RVA for the begin of that form.....

to kill the form we can change or point the rva of the form/begin to other RVA where indicated other function like exit.. or C3 or something else

with your hex editor you should see something like this also

636B10007CF742000965786974436C69
ck..|.B..exitClick

7CF74200 = 42F77C00 and gives the exit command when you have pressed the Exit button ;)

just change 84F74200 for 9CF74200 and see what happends!

9CF74200 = 42F79C00 (C3) = End/Return of Form

Best Regards!
ZaiRoN
11-26-2003, 03:55 AM
Hi cRk,
hmmm, maybe I misunderstood you but what do you mean by 'form'? The initial nag it's not a form, it's only a simple message box.on 0042F784 (6A00) begin the form of the messageboxa....42F784 is the initial address of the routine that is called when the FormCreate event happens...

ciao,
ZaiRoN
cRk
11-26-2003, 11:54 AM
Hi cRk,
hmmm, maybe I misunderstood you but what do you mean by 'form'? The initial nag it's not a form, it's only a simple message box.42F784 is the initial address of the routine that is called when the FormCreate event happens...

ciao,
ZaiRoN

Sure! :p but usually delphi app. call/make Form in this way and not just the main Form, in this case it is a messageboxa


Nice bug in Acrobat Reader 6.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Nice bug in Acrobat Reader 6.0
PDA

View Full Version : Nice bug in Acrobat Reader 6.0

Harding
11-12-2003, 06:20 AM
Most people know that you can protect your PDF file so the user can't copy the text or the images but there is a small bug that is really great that lets you copy whatever you want.

1. Open the PDF in a hexeditor.
2. In the first 10 bytes you something like PDF-1.3 (just an exempel) This is the version of the pdf
3. Change the version into something high (why not 9.9 ?)
4. Save and open the document in Acrobat Reader. It will now say that this document have a version the program not know of. Click OK.

Try the edit --> copy menu ;-)
dELTA
11-12-2003, 07:20 AM
Heh, cool. :cool:
Tola
11-12-2003, 11:29 AM
whatever is was, it seems to be fixed in my version (6.0.0.19.05.2003)


Hardlock Envelope Question...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hardlock Envelope Question...
PDA

View Full Version : Hardlock Envelope Question...

sope
11-12-2003, 07:22 AM
Hello Everybody,

I have a target for which i don't have the dongle. It's Hardlock enveloped.

The main files is packed & the depending .dll's & .ocx's are also packed. Tracing slowly & noting the values down i was able to reach a point were i found the below structure & its values written below.API_Version : 0351
API_Flags : 0000 0000
MOdID : 0000
HARDWARE : xxxx 0000 0000 0000 0000
Data Pointer : 0000 0000
Bcnt : 0000
Function : 0000 <-- HL_Login
Status : 0700 <--- No Dongle
Remote : 0100
Port : 7803 <-- Lpt1
Speed : 0200
NetUsers : 0000
ID_Ref : xxxxxxxxxxxxxxxx
ID_Verfiy : xxxxxxxxxxxxxxxx
Task_ID : 08FFB9A9
MaxUsers : 0000
TimeOut : 0000 0000
ShortLife : 0000
Application : 0000
Protocol : 0000
PM_Host : 0000After searching the board & some more site came to know the we need to dump some 8K bytes from the original dongle to decrypt the packed exe files.

My Question : Even if i would have the 8k of dongle data how does one emulate it ? which portion of code to rip out & then put the dongle data etc... any-body familiar with such type of things please show some light or hint.

Learn't so far for our community:

Earlier i did not knew how does one find in the .protect section when will the hl_login function is called. Now how i find it is like this.
Once we get an error messagebox i dump the target & search for the below bytes in hex editor 3D 07 00 i.e. cmp ax, 0007 <--- finding the error code & note down the address & set a break point on all which were found. one of them will trigger for you.

If u know better please don't hesitate to post it here.

Regards, Sope.


Linux FlexLM....starting from the past...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Linux FlexLM....starting from the past...
PDA

View Full Version : Linux FlexLM....starting from the past...

fiber7
11-12-2003, 10:34 AM
Hi guys.

I'm starting to learn FlexLM (...I know...I'm not original.... :) ....).

Since I'm a newbie I'm here to ask you some hints.

I would like to start from old FlexLM versions (...no ECC for now....) on Linux.

My target is built with FlexLM 6.1g.

My question is : could someone provide me IDA 6.1g Flair signature?
(I would like also Linux 6.1g SDK but....I think that nobody has it right?..... ;) ....)

Thanks a lot!

Cheers.

Fib.
nofurs
11-12-2003, 12:15 PM
I think that nobody has it right?..... ;) ....)

YEAH! WE DON'T HAVE IT!
tom324
11-12-2003, 01:29 PM
My target is built with FlexLM 6.1g.

My question is : could someone provide me IDA 6.1g Flair signature?

Most FlexLM functions are not hard to recognize. Just compare a Linux SDK function with its Windows counterpart. And there is no need to recognize all of them but just a few important ones. Once functions have been renamed to lc_* use idb2sig plugin and create signature file from IDA database. That would save you some time in the future. The process of creating signature file is slow and painful but necessary - if SDK is not available.

Tom


Italian Tears
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Italian Tears
PDA

View Full Version : Italian Tears

Polaris
11-12-2003, 01:37 PM
Today seventeen Italian soldiers have been murdered while carrying out their duty by vile terrorists.
Our heart is crying for them.
Their memory will last forever in us, giving even more strength to our proud flag.
Kayaker
11-12-2003, 04:32 PM
The tears are Global my friend. For a situation which only gets worse. Regards.
bart
11-13-2003, 06:14 PM
and what do they look for in iraq anyway? peace for the rest of the world or maybe reconstruction contracts and oil?
dELTA
11-13-2003, 07:10 PM
Ok, this thread is hereby officially under flamewar watch... :eek:

*finger hovering over delete button*
naides
11-13-2003, 07:14 PM
Suggestion:
Search in Google the key words 'iraq' and 'war' and 'messageboard' and post your comments there.
It is not that I don't care, far from it. but political discussion can be quite divisive and perturb or ruin this very good and useful message board about RCE

Don't you think?
dELTA
11-13-2003, 07:17 PM
That's also a way of putting what I just said. :D
Aimless
11-14-2003, 01:32 AM
It is really sad indeed about the deeds.

However, I advise to keep the off-topics subjects limited to the technology world only. Else we risk becoming a general free-for-all kind of a board.

Have Phun


Reversing an unknown image format?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Reversing an unknown image format?
PDA

View Full Version : Reversing an unknown image format?

sporadic
11-12-2003, 02:57 PM
Heyas,
Never posted here, but always enjoy browsing the site. I usually find my answers via search, so haven't had a need to post. And I'm not even sure if this is the right place to ask this, but I'm sure you all will have ideas :)

I'm currently working on reversing a texture file format for a game. The file format seems pretty easy to parse and supports both 32bit and Indexed images. The 32bit images are read in bottom-to-top like a DIB and render perfectly in my utility. The Indexed images have a color table, followed by 1byte per pixel that represents an offset in the color table. The problem though, is that the scan for indexed images doesn't seem sequential and the rendering is all jumbled. The color lookups seem to be correct though (by ratio of colors in the output). I've noticed a few patterns in the final rendering, but none that will clue me in on the scan order. Any clues on why the pixels wouldn't be represented in a linear fashion or has anyone exprienced something like this w/ another graphics files format? Below are my notes on the format (.img) and links to 2 jpg's that show the correct texture and my parsed texture - right and wrong (the correct one was taken from an older version of the game, when they used .png's). I've yet to figure out any use for the 4 unknown DWORD's listed below. Both 32 bit and Indexed images usually have a value < 0x0F in them.

right: hxxp://linux.wku.edu/~sporadic/gfx/right.jpg
wrong: hxxp://linux.wku.edu/~sporadic/gfx/wrong.jpg

// note: non-indexed pixel data is last scanline first (read reverse)
// -- still unsure on scan order of indexed pixel data

-= IMG header =-
0x00: 02 00 00 00
0x04: 30 02 41 00 (IMG file type)
0x08: Unkown 4 Byte field
0x0C: Unkown 4 Byte field
0x10: Unkown 4 Byte field
0x14: Unkown 4 Byte field
0x18: 2 Byte Width
0x1A: 2 Byte Height
0x1C: 4 Byte Color Table Size / Offset of Pixel Data
-- end of IMG header

if file is indexed (0x1C > 0) {
-= Color Table =-
0x20: 4 Byte RGBA Quad
... repeats for 0x1C / 4 (# of colors)
-- end of Color Table
-= Begin Pixel Data =-
0x??: 1 Byte Index (points to RGBA Quad in Color Table)
... repeats for 0x18*0x1A (width*height)
-- end of Pixel Data
} else {
-= Begin Pixel Data =-
0x20: 4 Byte RGBA Quad
... repeats for 0x18*0x1A (width*height)
-- end of Pixel Data
}
-- end of file

i'm looking for help on this, as it's kinda kicking my arse atm :)
thanks!,
-sporadic
dELTA
11-13-2003, 07:15 PM
And you are sure it's not compressed in any way? If you do a statistical analysis of the raw data, does it have more random characteristics than non-compressed images? In that case it might very well be compressed, which might explain your failed attempts to reverse it "by hand". :)
JH1979
12-11-2003, 06:54 PM
Just a suggestion, but how about debugging the game to see how what it does (i.e. how it processes and stores) the image on loading it? Or, how about replacing some image files in the game directory with ones you create yourself, this will give you clue if it is some weird non-linear scan. e.g. what you think is a simple image with a horizontal line gets mapped to...? personally, i think delta is on the right track and that the data is compressed somehow.

JH

p.s. and another thing - you mention an older version of the game using pngs, are there are graphics (logos etc) that are the same as in the new version? if so, you should be able to compare these to determine the scan.
evn
12-20-2003, 07:54 AM
I would think that using compression on the image would somehow alter the color table, unless the before and after color similarities are coincidental.

Have you checked the other data files for anything that may be of any help (there may be encode/decode information in other files, such as byte order or build pattern).

If you think that it is just the pixel order that is incorrect, try coding a small app to count the number of each pixel of each color in the image. If they're equal then its likely not that huge of a problem to correct, else everything takes a turn for the worse ;)

Compression normally involves the reduction of data size (or at least an alteration in data size), and from what you've posted, the image looks to have dimensions in-tact. And the fact that the data stretches to the extremities of the image show pretty conclusively that the algorithm (if any) hasn't padded the data to keep size.

I cant really help without seeing the raw data, but i'm not sure if posting that is permitted (no posting of target file). This is an image rather than a reversing problem though, so i don't see why it would be disallowed.
dELTA
12-20-2003, 05:37 PM
You can post data from sample images here, no problem.


How does it control for multiple installation on different computers.?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How does it control for multiple installation on different computers.?
PDA

View Full Version : How does it control for multiple installation on different computers.?

akn
11-13-2003, 12:30 AM
Hi All,

I bought one Software which can install only on one computer (Stand alone). When I tried to install on different Hardisk, not the same size with
same OS,
Same user name,
Same computer,
Same volume name,
I could not use the old authorization code.

When I use the Ghost copy, I works.
Please let me know how this software control for multiple installation on different computers.

Thanks

akn
dELTA
11-13-2003, 05:25 AM
Probably some hardware ID (did you have to send some kind of code generated in the program before getting your authorization code?).

Also, some programs do a check on the local network for other copies with the same license, so make sure not to have both computers on the same network when installing.
disavowed
11-13-2003, 08:56 AM
Also, some programs do a check on the local network for other copies with the same license, so make sure not to have both computers on the same network when installing.

and some programs do a check on the non-local network (they contact a server with some system information each time the app is run)
Woodmann
11-13-2003, 06:38 PM
Howdy,

I will assume you have a ghost copy of your hard drive.
When you turn the hard drive back you are able to install
the program again ?

How does the disc know that it has already been installed ?
Why should a ghost copy make any difference ?

Try this :
Fire up some tools like regmon and filemon and watch what
the install prog does.
After you get that info, ghost back to pre-install and see
if that info is still there.
If it is still there, manually remove all entries and restart to
see if it writes back again on its own.
If the reg info is gone and you can re-install it on the same
hard drive, it has written something to the disk.
akn
11-13-2003, 09:21 PM
Thank you!!
(1) Where can I get the regmon and filemon for Win98.
(2) Could you explain about GetdrivetypeA, how to get which OS in both ASM and API.

Regards

akn
Woodmann
11-13-2003, 09:50 PM
Oh the shame........ :(

Search and find. These are basic things.
Ask no more until you have done some work
to help yourself.

Woodmann


New Exe Stealth
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New Exe Stealth
PDA

View Full Version : New Exe Stealth

Zilot
11-13-2003, 02:24 AM
New Exe Stealth

<link removed by Kayaker - unpacked and fixed commercial software? - that's a No-No ;-)

unpacked/fixed

what to think about protector, when it is protected by another. Do they steal complete protection procedures one from another, or they cooperate for money. Nothing new here, nothing more then average protector.

Can be toy for beginners teaching.
esther
11-13-2003, 12:12 PM
Can be toy for beginners teaching.[/QUOTE]

yeah with direct links?
Zilot
11-14-2003, 03:03 AM
This link is not to official site of ExeStealth, this is unpacked/fixed version on hacker's site.
SpeKKeL
11-14-2003, 08:49 AM
Mwhaha....

Peid sais after scanning: ASPack / ASProtect x.xx -> Alexey Solodovnikov !!! :p

What about stealing..!

Spekk.
cRk
11-14-2003, 11:04 AM
everyone should remember that nag message... belongs to custom aspr. protection then it is packed by its own protection... stoled protection from Yoda crypter and use aspr to help it... = Not a Good protection!
v0kram
11-14-2003, 11:57 AM
It's actually a rip off of y0da's cryptor, and he's added some stuff which I doubt adds any security or so, PEiD says ASPack / ASProtect since it modifies the PE Header in a similar way, dont think it's got anything in common to AlexeyWare yet.

Those ASPack / ASProtect x.xx and tELock x.xx are heuristic checks, dont trust them a lot, just a lil is fine ;)
MEPHiST0
11-14-2003, 02:40 PM
New Exe Stealth

what to think about protector, when it is protected by another. Do they steal complete protection procedures one from another, or they cooperate for money. Nothing new here, nothing more then average protector.

ASProtect v1.23 RC4 Trial download is even protected with ASPack..
i thought alexy would have more faith then that in his AlexeySolodovnikovProtect ;p


ECC questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > ECC questions
PDA

View Full Version : ECC questions

BetterWang
11-14-2003, 09:42 AM
ECC curve E(Fp) y^2 = x^3 + a x + b (mod p)
a point G on the curve.
n points on the the curvie.
private key q and k, with
q*G=0 infinite; k*G=K

first question: is q == n ?
2nd : how to generate q after i choose a b p & G
enctypt and decrypt has the same compute work to do?
3rd : what different with calculate q and k
they both calculate from G, can bruteforce q and k in the same time?
mike
11-16-2003, 06:38 PM
Frankly, I know almost nothing about ECC. The best I can do is refer you to Certicom's ECC tutorial pages:
http://www.certicom.com/resources/ecc_tutorial/ecc_tutorial.html
BetterWang
11-17-2003, 08:54 AM
finally, you replied, thanks anyway!~
Kythen
11-17-2003, 05:52 PM
I would also recommend check out this book if you can. It helped me out a lot when I was learning about ECC in my number theory class!

Implementing Elliptic Curve Cryptography
by Michael Rosing

source code, etc. available at hxxp://www.manning.com/Rosing
nathan
11-18-2003, 04:36 PM
Certicom link has changed:

http://download.certicom.com/resources/ecc_tutorial/ecc_tutorial.html

nathan


trace calls
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > trace calls
PDA

View Full Version : trace calls

mayapt
11-15-2003, 07:37 AM
HI!

first sorry if the question makes no sense as i'm quite a newbbie, i did some things in XP using Win32dasm and it was a great app it tells what lines of code call or jmp to another line of code, that information is precious to me, now my problem is that i'm working on linux and i was wondering if there is any app that will do the same for me, give me call and jmp origins so i can trace something back. thanks for all yur help.
Polaris
11-15-2003, 08:32 AM
HI!

first sorry if the question makes no sense as i'm quite a newbbie, i did some things in XP using Win32dasm and it was a great app it tells what lines of code call or jmp to another line of code, that information is precious to me, now my problem is that i'm working on linux and i was wondering if there is any app that will do the same for me, give me call and jmp origins so i can trace something back. thanks for all yur help.

Although I did not understand fully your needs, try the HTEditor: it's free, it comes with source code and displays xrefs (but it lacks debugger). if you are interested in a good "live" analisys tool, try out fenris, that is really wonderful. Also, check IDA Free under wine (but I didn't try it).

Byyyezzz

Polaris
mayapt
11-15-2003, 10:52 AM
What i was needing was an app that could disassemble a linux app and show me it's asm code but with infos on calls and jmps, this is, when looking at the asm code have info on what lines of code jump or call the lines of asm code displayed. i'm sorry if i can't express myself better but english is not my language so...
dELTA
11-15-2003, 12:15 PM
Like Polaris says, IDA will be (more than) perfect for this.
Polaris
11-16-2003, 09:30 AM
What i was needing was an app that could disassemble a linux app and show me it's asm code but with infos on calls and jmps, this is, when looking at the asm code have info on what lines of code jump or call the lines of asm code displayed. i'm sorry if i can't express myself better but english is not my language so...

Then I understood right: I recommend IDA Pro (its dos version coming from the widespread Zenith release should work correctly under dosemu). Also, you could cross disassemble using IDA on a win32 platform to enhance your work using GUI, Graphing & my INQUISITION plugin (hehe :) :) :) :D )

However, if you prefer a "lighter" disassembler, just try the HT editor at:

hxxp://hte.sourceforge.net/screenshots.htm

Byyyezzz,

Polaris


SoftICE Driver Suite
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE Driver Suite
PDA

View Full Version : SoftICE Driver Suite

MiniMind
11-15-2003, 05:12 PM
thread just died...
squidge
11-15-2003, 06:11 PM
Let me guess, your not in the correct context?
dELTA
11-15-2003, 07:15 PM
Let me guess too, you didn't search the board? :rolleyes:
JMI
11-16-2003, 10:53 AM
Now dELTA, that wasn't much of a guess, now was it?? ;)

Regards,
squidge
11-16-2003, 11:53 AM
You can always tell the simple jump reversers from the proper reversers now, due to this new version of Softice. The jump reversers just b**ch about the latest one and ask for the previous version, whilst the rest consider it a useful new feature.

Ho hum :)


Bad address references in a dumped encrypted dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Bad address references in a dumped encrypted dll
PDA

View Full Version : Bad address references in a dumped encrypted dll

theraptureback
11-16-2003, 05:19 AM
Hi all.
i'm trying to reverse a PACE INTERLOK protected dll.
When i dump it (with procdump) the offset of import fuctions seems corrupted :(

original code:
call [GobalAlloc]
dump code:
call [bb3ee100]

and maybe the global vars too...

I try rebuilt the IT with ImportREC but no luck.

any1 can say me whats is the problem and how i can resolve it :D

very thnx and nice to meet all :)

the^rapture
dELTA
11-16-2003, 05:23 AM
Rebuilding the IAT of a dumped exe/dll is often a little more work than just a single click in one of those auto-rebuilding programs. You will find lots of info about it by searching this board anyway.
prejker
11-17-2003, 10:05 AM
u prolly have bad relocations. use mact's awesome ReLoX to fix them, its on his site
Liquid
11-18-2003, 08:23 AM
u prolly have bad relocations. use mact's awesome ReLoX to fix them, its on his site

Jeeeez, prejker. So you're still alive ;-)
prejker
11-23-2003, 03:14 PM
Jeeeez, prejker. So you're still alive ;-)

yea... alive and kickin' ;)
Woodmann
11-23-2003, 08:47 PM
Jeeeez, prejker. So you're still alive ;-)

It is nice to see you active again :)

Woodmann


Some info about USB
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Some info about USB
PDA

View Full Version : Some info about USB

Polaris
11-16-2003, 09:40 AM
Hi there,

I am currently being asked to develop a software to control a device thats connected to the USB port (the task is just activating and deactivating it at the user command).
I was wondering if anybody here has already seen something like this and could point me to some documentation.

Cheers,

Polaris
Kayaker
11-16-2003, 12:51 PM
Hi

I've always liked this place, you could check out their USB Central link.

http://www.lvr.com/index.html

The developer's resource for computer interfacing, especially Ethernet and Internet communications for embedded systems, USB, parallel port, and RS-232 and RS-485 serial communications. Plus info about 8052-Basic microcontrollers and making printed-circuit boards.

Kayaker
dELTA
11-16-2003, 03:12 PM
My first thought was that there are most likely lots of ready-made components for ring-3 USB access functionality, and google quickly proved me right...

Here are two that seem quite good (but there are many more out there):

hxxp://www.jungo.com/wdusb_nt.html
hxxp://www.delphi-gems.com/controls.php (look for "HID Controller")

And here are some nice info pages, out of the thousands that exist:

hxxp://www.beyondlogic.org/index.htm#USB
hxxp://www.lvr.com/usb.htm

Hope it helps.
dELTA
11-16-2003, 03:17 PM
Oops, just noticed that one of my info links was the one that Kayaker submitted above. Well, I guess it comes highly recommended from both google and Kayaker then... :p
Polaris
11-17-2003, 04:13 PM
Oops, just noticed that one of my info links was the one that Kayaker submitted above. Well, I guess it comes highly recommended from both google and Kayaker then... :p

Thanks guys, I will spend some time studying :)

By the way, I guessed right when I decided to ask here for help... :) hehe! :D

Byyyezzz
Polaris


PEiD v0.91
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PEiD v0.91
PDA

View Full Version : PEiD v0.91

v0kram
11-16-2003, 10:40 AM
Hi,

Just noticed new PEiD v0.91 is out

hxxp://www.mesa-sys.com/~snaker/peid

Peace
theCaller
11-17-2003, 08:18 AM
hi,
as a must on my shell menu :) ... I have to report that it seems to be some problems in downloading the tool from the site ... could you please post it in the board please ? :)

thanx
MiniMind
11-17-2003, 11:58 AM
hi,
as a must on my shell menu :) ... I have to report that it seems to be some problems in downloading the tool from the site ... could you please post it in the board please ? :)

thanx

try Unpacking Gods Homepage :D hxxp://www.absolutelock.de/construction/files/releases/PEiD.zip

Greetings MiniMind
theCaller
11-17-2003, 01:13 PM
try Unpacking Gods Homepage :D hxxp://www.absolutelock.de/construction/files/releases/PEiD.zip

Greetings MiniMind

yo the link is the same from the snaker's site .. it does not work for me ... don't ask me why ... instead of this link you could attach the program itself without this ping-pong posting annoyance :D ... nevermind I've just got the file from another guy ... seeya :D
MiniMind
11-18-2003, 09:44 AM
yo the link is the same from the snaker's site .. it does not work for me ... don't ask me why ... instead of this link you could attach the program itself without this ping-pong posting annoyance :D ... nevermind I've just got the file from another guy ... seeya :D

(Sorry but it's always good to promote The Unpacking gods website)

There's is a program "MetaProducts Download Express" it's
a nice program I use when I've got downloading problems...
You can try it... If you're running windows...

Greetinx
MiniMind
yaa
11-18-2003, 03:57 PM
Here it is.

yaa
Oloron
12-18-2003, 05:03 AM
couple of new packers added in this new build ( thinstall and an exe packer by a grp named PERPLEX )

hxxp://www.absolutelock.de/construction/files/releases/PEiD.zip


Armadillo 3.x Unpack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 3.x Unpack
PDA

View Full Version : Armadillo 3.x Unpack

mr.x
11-17-2003, 01:06 AM
Hello,

Has anybody done on unpack Armadillo v3.x?
dELTA
11-17-2003, 05:56 AM
No, all the gazillions of tutorials and posts about it on this board are just plain lies, noone ever did it.
Harding
11-17-2003, 06:12 AM
No, all the gazillions of tutorials and posts about it on this board are just plain lies, noone ever did it.

Is gazillion really a word? ;-)

/Harding
squidge
11-17-2003, 08:22 AM
Is gazillion really a word? ;-)

/Harding

Million, billion, trillion, quadrillion, quintillion, sextillion, septillion, octillion, novillion, decillion . . . lessee, a decillion is:

1,000,000,000,000,000,000,000,000,000,000,000

. . . so there ain't no gazillion, it's right up there with zillion, bijillion, and uncountabillion . . . a made-up term.

Just so you know, here's the list of "named illions":

Billion has 9 zeros
Trillion has 12 zeros
Quadrillion has 15 zeros
Quintillion has 18 zeros
Sextillion has 21 zeros
Septillion has 24 zeros
Octillion has 27 zeros
Nonillion has 30 zeros
Decillion has 33 zeros
Undecillion has 36 zeros
Duodecillion has 39 zeros
Tredecillion has 42 zeros
Quattuordecillion has 45 zeros
Quindecillion has 48 zeros
Sexdecillion has 51 zeros
Septendecillion has 54 zeros
Octodecillion has 57 zeros
Novemdecillion has 60 zeros
Vigintillion has 63 zeros
Googol has 100 zeros.
Centillion has 303 zeros (except in Britain, where it has 600 zeros)
Googolplex has a googol of zeros

Sorry, I'm bored at the mo :)
JMI
11-17-2003, 11:04 AM
What dELTA was suggesting, Mr. X, is that you read the FAQ and then learn how to use the search button at the top of every page to search for your topic BEFORE you post a question. But then we've said this a "gazillion" times already. ;)

Regards,
Ricardo Narvaja
11-17-2003, 12:46 PM
I have written several tutorials about armadillo with copymem2, using ollydbg. The same method is applied to ver 3.10 with little differences (appart from ofuscated code easy to discover and the encrypted table 3 - nop the crypting xor - very similar to 2.85). In my ftp or the crackslatinos web is the tutorial of a soft called Lydia or the Tutorial of GetRight , wich is an example of this.

Ricardo Narvaja

What dELTA was suggesting, Mr. X, is that you read the FAQ and then learn how to use the search button at the top of every page to search for your topic BEFORE you post a question. But then we've said this a "gazillion" times already. ;)

Regards,
Woodmann
11-17-2003, 08:00 PM
Hold up,

Gazillion is not a word but Bazillion is used in some sort
of slang way.
Bazillion is used to express "way to many" in a non-scientific way
because we all dont know the whole *.zillion in real notation. ;)

Woodmann
cRk
11-17-2003, 10:19 PM
maybe he means that there's not a working unpacker for it.. and maybe will not exist by now... :) i would like to see his answer.. thanks GOD still exist the possibility of manual unpacking.. but looks hard to remove this new arm SICE detection that just freeze up/crash the system while using Frogice or icedump :confused:
dELTA
11-18-2003, 05:35 AM
I had an american lecturer once, and he used the word gazillion all the time (in the way you describe "bazillion" to be used), so either both words exist and mean the same, or he was just a CIA agent sent out to spread misinformation I guess. ;)
evaluator
11-18-2003, 09:18 AM
If NOT FAQ
then MoveToOFFTopic or DeleteThread
else will Flamme;
mr.x
11-18-2003, 10:19 AM
If NOT FAQ
then MoveToOFFTopic or DeleteThread
else will Flamme;

I have tried to unpack it, but I was not success and I need the help!
JMI
11-18-2003, 10:23 AM
You still haven't read the FAQ or you would know that you need to show some of your own work , not just say you need help. This is not a place to come to request someone else do the work for you. You need to read the other threads on this topic and then explain where you are stuck. At the moment, we only know that you report you don't know how to do it. This doesn't tell anyone if you know what you are doing at all.

Regards.
dreambuddy
11-18-2003, 01:37 PM
I have written several tutorials about armadillo with copymem2, using ollydbg.
Hi Ricardo,
Are your tutes is in English or in Spanish ???I need the one in English.
JMI
11-18-2003, 02:33 PM
dreambuddy:

You also have failed to read the FAQ. The forum is equipped with search buttons which will allow you to do your own research. Use the search button an try various combinations of "Ricardo Narvaja, armadillo and/or copymem2" and you should find what you seek. Don't be so lazy. Do some of your own work FIRST.

Regards.
cRk
11-18-2003, 06:10 PM
"Don't be so lazy. Do some of your own work FIRST." :D
Ricardo Narvaja
11-18-2003, 06:42 PM
Well my initial tut was written for armadillo 2.85 version and is in spanish and in english.
69-ARMADILLO FOR DUMMIES GETRIGHT 5 (vol I) ENGLISH.rar
70-ARMADILLO FOR DUMMIES GETRIGHT 5 (vol 2) ENGLISH.rar
74-ARMADILLO & NANOMITES (part 1)ENGLISH.rar
77-armadillo & nanomites (2 part) english.rar
79-ARMADILLO & NANOMITES ANNEX(ENGLISH).rar

My tut of armadillo 3.10 are in spanish only.
83-ARMADILLO 3 SUPEREXPLICADO LYDIA DESEMPACADO (parte1).rar
84-ARMADILLO 3 SUPEREXPLICADO LYDIA REDIRECCION DE IAT (parte2).rar

the part of the inject of LYDIA was write for CODE RAPTOR using the same method

88-ARMADILLO_3_SUPEREXPLICADO_LYDIA_NANOMITES_por_CODE_RAPTOR(parte3).rar

and my friend CODE RAPTOR are writing a new tut with the same method aplicated to the last armadillo, and this will be write in spanish and english he say.
The changes in the method are minimal, and the inject are slightly different, but is the same concept and method.

Ricardo Narvaja

"Don't be so lazy. Do some of your own work FIRST." :D
dreambuddy
11-19-2003, 01:17 AM
Thanks Richardo for the reply and @JMI.. I have read the FAQs but didn't made the search.My mistake... :)
cRk
11-19-2003, 03:44 AM
Ricardo Narvaja would you please tell me which file has those tutos you mentioned.. i can't download all because my slow connection. i was searching days ago for those tutos and i can only see the words concurso,curso and some others...

Best Regards!
Ricardo Narvaja
11-19-2003, 03:56 AM
In my FTP in NUEVO CURSO\TEORIAS

69-ARMADILLO FOR DUMMIES GETRIGHT 5 (vol I) ENGLISH.rar
70-ARMADILLO FOR DUMMIES GETRIGHT 5 (vol 2) ENGLISH.rar
74-ARMADILLO & NANOMITES (part 1)ENGLISH.rar
77-armadillo & nanomites (2 part) english.rar
79-ARMADILLO & NANOMITES ANNEX(ENGLISH).rar
83-ARMADILLO 3 SUPEREXPLICADO LYDIA DESEMPACADO (parte1).rar
84-ARMADILLO 3 SUPEREXPLICADO LYDIA REDIRECCION DE IAT (parte2).rar
88-ARMADILLO_3_SUPEREXPLICADO_LYDIA_NANOMITES_por_COD E_RAPTOR(parte3).rar

Are in my FTP

ricnar456.no-ip.prg

user:curso
pass:curso

in \NUEVO CURSO\TEORIAS

Ricardo
cRk
11-19-2003, 04:12 AM
once again thanks for all you do.. for your time and pacience Ricardo ;)

btw i think this is funny... --> hxxp://www.siliconrealms.com/hackers.shtml

i think they add more info. for the "hackers" :p
seven
11-25-2003, 08:17 AM
Is gazillion really a word
gazillion comez after vazillion and b4 petrozillion ,
they all numbers > 1000 $$ .


"SETI Hacker" hypothesis: Keeping Watch for Interstellar Computer Viruses
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > "SETI Hacker" hypothesis: Keeping Watch for Interstellar Computer Viruses
PDA

View Full Version : "SETI Hacker" hypothesis: Keeping Watch for Interstellar Computer Viruses

Kayaker
11-17-2003, 01:01 PM
"SETI Hacker" hypothesis: Keeping Watch for Interstellar Computer Viruses

Could a signal from the stars broadcast by an alien intelligence also carry harmful information, in the spirit of a computer virus?

Get your space condoms ready and find out here:

http://www.space.com/scienceastronomy/space_hackers_031111.html

:p
naides
11-17-2003, 04:36 PM
We say in Spanish (Probably loses most of its pun in the translation):
"No body is more jealous than an unfaithful husband"

That paranoid fear of ill intent only reflects the evil in their souls.
Bengaly
11-18-2003, 11:30 AM
hehe broadcasted viruses :P
i hardly think aliens uses PE structure as thier pirmary executable image hehe :P
deldav
11-18-2003, 06:27 PM
Why wouldn't they use PE ? When you see that in Independance Day they're using TCP-IP for managing the mothership's intranet ...
Woodmann
11-18-2003, 08:20 PM
Errrrrrrrr.......

If they are broadcasting/using some kind of prog
it has to be open source.
Then again, even if it is open source, Billy will sue them :o

Woodmann
JMI
11-18-2003, 08:56 PM
To sue them, Billy has to get personal jurisdiction over them, which requires that they be "personally served' with legal process. :rolleyes: So Billy will first have to invent a space vehicle fast enough to catch one of the "intruders" and then force entry and have the papers handed (assuming they have hands, of course) to one of them. No wait. Billy IS an alien. :D Maybe that house he had built into the mountain side really IS his space ship! ;) :D

Regards.


ATI macrovision
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ATI macrovision
PDA

View Full Version : ATI macrovision

racerxnet
11-17-2003, 09:26 PM
Hi to all at this forum,

I am going to try to reverse engineer the code from the ATI drivers to remove the macrovision protection. I'm using IDA Pro to look at the driver files. In particular it is the file ATIvmdxx.sys. What are some suggestions to disable this feature? There is a patch which disables a portion of the code, but does not go far enough to disable the dark/light effects from the AGC circuitry on the 8500DV card. With no information to work from, what are some suggestions in disabling this macrocrap.
sgdt
11-19-2003, 12:09 PM
Hi to all at this forum,

I am going to try to reverse engineer the code from the ATI drivers to remove the macrovision protection. I'm using IDA Pro to look at the driver files. In particular it is the file ATIvmdxx.sys. What are some suggestions to disable this feature? There is a patch which disables a portion of the code, but does not go far enough to disable the dark/light effects from the AGC circuitry on the 8500DV card. With no information to work from, what are some suggestions in disabling this macrocrap.

Have you tried to find the IOCTL parser (should be very close to driver entry)? It might be just that simple.

Attacking the I2C routines would be tough. You'll need the manuals for their chips. Nasty stuff, lots of work.

I think the best plan of attack would be the IOCTL first (if it was done that way), and second would be the stream. The bit that enables macrovision could be disabled there. The last would be to go after the hardware interface code, meaning a LOT of work.
racerxnet
11-22-2003, 07:47 PM
Have you tried to find the IOCTL parser (should be very close to driver entry)? It might be just that simple.

Attacking the I2C routines would be tough. You'll need the manuals for their chips. Nasty stuff, lots of work.

I think the best plan of attack would be the IOCTL first (if it was done that way), and second would be the stream. The bit that enables macrovision could be disabled there. The last would be to go after the hardware interface code, meaning a LOT of work.

Hi SGDT,

I tried looking for the parser and had no luck so far. I was looking to set up a strMiniReceiveStreamDataPacket, but find very little doing a google search. So I am serching for material regarding how to accomplish this. If you have any information regarding this application feel free to help. And I Thank You for the response I recieved.

MAK


retool v1.07
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > retool v1.07
PDA

View Full Version : retool v1.07

OHPen
11-17-2003, 09:40 PM
retool v1.07 availible. listen it's tooltime ;D

signature database extended up to 165 different packer/crypter. FlexLM, SVKP,XtremeProtector,tElock, etc,

improved infoPExtractor plugin out...

First time SeQUencEE plugin by vaterduncan is availible. IT THE BEST SEQUENCE Extractor ever released, check it immediatly.

report bugs to us,

regards,

OHPen

PS: hxxp://retool.6x.to
whyIII
11-27-2003, 09:57 PM
I have tried to use SeQUencEE plugin to compare two different size files. However, when it is finished, I can't save the result? Is it general or just special case on my computer?
ZaiRoN
11-28-2003, 04:13 AM
whyIII, I am able to save the result.
whyIII
11-28-2003, 04:56 AM
whyIII, I am able to save the result.

In my case, when the comparison is finished, I click the "save result" button, and the save window is out. I can also type the file name . Then after long time waiting, the save window disppear. However, the result file can't be found on the given location. So what's happen. By the way, the size of the file compared is about 400kb.

Any hints?
OHPen
11-30-2003, 07:01 PM
Hi,

sorry for my late answer. 'Cause my less amount of time blabla....

It doesn't matter how big the files are you try to compare(okay it doesn't matter if you have enough time ;)). It's is actually just limited by the size the a byte[] java is able to handle.
I don't know what the problem is in your case...
First time i heard that, so
please send me your SystemConfiguration(OS, JVM, etc).
and the error.log in /log - dir

BTW you can use retool board to post problems concerning retool.

retool.cjb.net

In the next release there are some fixes in sequencee-plugin and the peviewer
is fiinally finished i hope. Maybe in v1.075 first appearance of native code will happen ;)

Hope you will enjoy next verision a bit more,

regards OHPen

BTW:

LITTLE QUESTIONGAME...

HAVE SOMEONE NOTICED THE DIFFERNCE BETWEEN trID AND SEQUENCEE-PLUGIN ;) ?
I HOPE SO ;D
cya
seven
12-01-2003, 01:50 AM
ur retool need rebuild
can,t run on win98se.
doug
12-01-2003, 11:40 AM
nice website & app design..

a few questions though, does it do anything beyond being a PE-signature scanner (there are already a ton of them on the web)

Also, is it normal that it took around 20-25 secs at 100% cpu to scan a 3 mb file?

My last comment, and that's not just related to this app.. why do people coding tools _for reversers_ use pe-packers on their tools.. do they think it's not going to get unpacked if someone really wants to?
cRk
12-02-2003, 11:07 PM
can't run it as well on Win98 SE i got an strange message like the file is corrupt or something else
OHPen
12-03-2003, 01:30 PM
@ seven & cRK

thx for you bugreport i will solve this till next release...
i can't imagin' that it's an OS depending problem, but more people have
emailed me problems on 98se. I will install win98se on my second pc this weekend to get this prob in order to solve it.

@ doug

your post indicated to me that you haven't take any look at the source code of retool 'cause all your questions are answered in here.

1. YES THERE IS SOMETHING BEHIND ( if you want to know exactly: im organising my search in the file with BM-Alogrithm, free availible on the net, it's a modfied version im using (thx vaterduncan) so there is not faster way to scan through a HOLE file... really. But my kind of search isn't the best yet. There are many optimzations to do, such as are done in snaker PeID v.091 (in my eyes the best tool atm...). But i don't want to copy his work, i want get it run in my own way, in order to create some a day a tool which can compete with snakers.
This will take his time. But time is all have...
ATM i workin on different ways for unique identifing byte sequence. But the effects of this improvement will not be visible in the next v1.075. First you can use this new technique in v1.08 final.

If retool is to slow for your purposes i recommend to use another tool or code one by your self...
But you can make sure that im not qloryfin' PeID or other tools. There are features in retool other tools can't provide atm, and that's why im proude of...

"Also, is it normal that it took around 20-25 secs at 100% cpu to scan a 3 mb file?" by doug

YES it's normal if you take a look at retool. ATM the hole byte is searched for each signature in the signature database ( atm about 160 different/packer crypters). So if you can code some faster tool using the SAME method to do this i very interested in your source code...

Anyway thx you all for testing retool and providing me with some good comments,

regards,

OHPen
Bengaly
12-03-2003, 01:54 PM
Hi OHPen,

if you want to enchance your signature search, you can use XML, or a mix with the way IDA uses for thier FLIRT engine algorithm.
OHPen
12-04-2003, 11:22 AM
@bengaly

i don't know what you mean exactly, im already reading my signatures from xml files ;)
I saw this first time in trID and i find it's a very good idea...
Maybe you haven't taken a look at the source or have you discovered another of using xml for my signature search ?

regards,

OHPen
QuickeneR
09-02-2004, 02:23 PM
Does anyone know where to get retool source/binary these days? The official sites - retool.cjb.net and retool.6x.to - do not seem to work anymore. Google does not help.

Edit: found it.


Driver Suite 3.0.0 Problem?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driver Suite 3.0.0 Problem?
PDA

View Full Version : Driver Suite 3.0.0 Problem?

cRk
11-17-2003, 10:07 PM
ok guys... i searched many stuff about it.. and came to the conclution that this answer did not apply to any thread already done... maybe?? ;) but i did search without results!

yesterday i installed Driver Suite 3.0, used to have 2.7 in other machine and the same happends except that this new driver suite don't freeze up my system and looks like running ok. the only think don't work is the mouse which dosen't do nothing at all.. and other stuff is that i set any bpx, even having many exported system .dll set, i can't get any bpx to work in WinXP

the real problem, which i consider, is that after installing it i can't longer see the Scandisk progress when i scheduled a check for Disk C:/ or D:/

i can't longer see the progress window while scandisk is running.. i know is running because windows takes longer to load but just a dark screen stay there reading

used to be blue.. :( looks like Driversuite modify some of the WinXP boot files.. i wonder if someone has experienced this problem before and how i can resolve this... i really don't want to install XP for this.. i'm short of time for that.. and still i would like to have Driver suite running and working....

this never happend with any application except with driversuite

anyone please? :confused:
Aimless
11-18-2003, 12:06 AM
1. Open Windows Explorer
2. See boot.ini
3. Right click and remove the read-only permissions
4. Open it in notepad
5. Remove the /nogui option
6. Right click and put the read-only permission again
7. Reboot
Now you can see everything.

Have Phun
cRk
11-19-2003, 12:04 AM
yeap! that did the job!! :cool: anyone would tell me how to get the bpx's to work and break? is there something i should set up as additional option or something to download as additional component to make Driversuite work Under WinXP?

i really apreciated your help Aimless

Best regards!
Aimless
11-19-2003, 12:17 AM
In older versions of SoftICE:

bpx MessageBoxA

would allow softice to popup whenever ANY program calls the MessageBoxA API

In newer versions of Driver Studio/SICE Studio:

bpx MessageBoxA will NOT work. You will have to:

1. addr notepad (Assuming notepad is where you want to capture the breakpoint)
2. Bpx MessageBoxA

Intentionally or unintentionally, the bpx will work only and only when they are triggered in the CONTEXT where they were set. So you will routinely have to change context to your application using ADDR command and supsequently place the breakpoint.

Have Phun
cRk
11-19-2003, 01:16 AM
you mean to set a Bpx under WinXP using Driver Suite 3.0

i'll have to write in SICE

addr "the program name"

then

bpx "some API function"

is this correct?

Best regards!
Aimless
11-19-2003, 01:28 AM
Yes.

A good idea is to let the SYMBOL LOADER load the application, stop at the ENTRYPOINT (it does all this automatically) and then put in your breakpoints.

Alternatively:

ADDR <your_application_name>
BPX <whatever...>

Have Phun
cRk
11-19-2003, 03:10 AM
:D
JMI
11-19-2003, 10:36 AM
cRk: This has also already been discussed several times here. Had you actually read the threads on the latest versions of SICE you would have already known this requirement.

Regards.
cRk
11-19-2003, 11:40 AM
sorry brother and thanks for all your efforts to make everyone go in the right way but i didn't found it. excuseme for mi mistake if i did a wrong step by making this thread ;)
JMI
11-19-2003, 01:26 PM
In addition to the ADDR command there are also the ATTACH and DETACH commands. The ATTACH command lets you set the default address context and symbol table to change to when SoftICE pops up. This avoids the necessity of having to set the ADDR each time you want to define the context in which breakpoints are to operate.

You will find a discussion of these issues here:

http://www.exetools.com/forum/showthread.php?s=&threadid=2548&highlight=sice

Regards.
compuboy_r
03-30-2004, 01:01 PM
To solve the mouse problem just goto the troubleshooting options in the softice settings and select

1. Disable num lock and caps lock programming
2. Do not patch keyboard driver
3. Disable USB mouse patching

compuboy_r


Newbie needs help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Newbie needs help
PDA

View Full Version : Newbie needs help

oh12vn
11-18-2003, 01:56 PM
I spent two days hopelessly unpack this stupid program Chronograph 3.1 from {hxxp://www.altrixsoft.com/} but cant find it OEP.

PE ID says that it was packed by Asprotect 1.23 RC4 Demo.
Image Base 00400000, EP : 1000.
But when I traced the prog using Olly , addresses change from 007xxxxx to 003xxxxx. I dont know where the OEP is.

I supposed that there are some probs with the PE header ,but when I tried to modify it. PE editor tools keep saying that the file (or the PE header) is read only.

Can anybody help me? Since I'm new here. If any probs , just tell me and I'll fix it.

Please answer ASAP , I really want to see the solution (or hint) of this prog.
squidge
11-19-2003, 05:47 AM
Try the "Search" button
JackD
11-19-2003, 08:20 AM
Wow! OK - ASAP!
The OEP is 00401990.
Now what?
oh12vn
11-19-2003, 08:22 AM
of course I have searched before ask , but all I can find are tuts which metion about ASProtect , and how to unpack it by the normal way. No tut has covered the thing I want to ask.

The thing here is so different. I traced the whole program but cant find its OEP. Like I said in the last post, it changes the EIP from 7xxxxxx to 3xxxxxxx, I already tried to dump, but unsuccessful. When I used Olly Dump plugin , EIP is 3xxxxxx , but in EIP to OEP , it displays like FBxxxx.

I hope any of you can help me with this.
oh12vn
11-19-2003, 08:27 AM
I bet that JackD used PE ID , that prog told me the same thing but you can never reach 401990 before the whole program load. And in fact, I've never reached that EIP. That's exactly what I want to ask.

Is 401990 the real OEP ? How to reach there ?
stanley white
11-19-2003, 09:17 AM
Yes.... OEP is 401990

If you use Labba's tut and ImpRec you can unpack this baby in 10 min or so ... I just unpacked it to check, and theres nothing new to this ASPR as far as I can see...

The only hurdle I see for newbie's is that the plugin for ImpRec doesn't support ASPR 1.23 RC4... I might do a plugin for 1.23 RC4 if I get the time !!

Read Labba's tut. It answers most of the basic questions about ASPR ... It also answers your question on how to reach OEP !!

Stan
hobferret
11-21-2003, 03:39 PM
Yo oh12vn

Saw this on Wednesday and had a go - as Stanley White says it's easy although I used SI and then another go with TRW - cos I ain't got XP any more HDD crashed!

In both SI and TRW break on any API then set BPX 00401990 and guess what it stops :cool:

The IAT is simple too - as said on this forum many times B4 the IAT is mostly alphabetical. However 4 the lazy I will put the sequence here:

wininet.dll
InternetCrackUrlA

advapi32.dll
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegConnectRegistryA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegOpenKeyA
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA

kernel32.dll
CloseHandle
CompareStringA
CreateDirectoryA
CreateEventA
CreateFileA
CreateMutexA
CreateProcessA
CreateThread
DeleteCriticalSection
DeleteFileA
DosDateTimeToFileTime
EnterCriticalSection
EnumCalendarInfoA
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToDosDateTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
FlushFileBuffers
FormatMessageA
FreeLibrary
FreeResource
GetACP
GetCPInfo
GetCommandLineA
GetComputerNameA
GetCurrentDirectoryA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatA
GetDiskFreeSpaceA
GetDriveTypeA
GetEnvironmentStrings
GetEnvironmentVariableA
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetFileTime
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetPriorityClass
GetPrivateProfileStringA
GetProcAddress
GetProcessHeap
GetProfileStringA
GetShortPathNameA
GetStartupInfoA
GetStdHandle
GetStringTypeExA
GetStringTypeW
GetSystemDirectoryA
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetThreadLocale
GetThreadPriority
GetTickCount
GetTimeFormatA
GetTimeZoneInformation
GetVersion
GetVersionExA
GetWindowsDirectoryA
GlobalAddAtomA
GlobalAlloc
GlobalDeleteAtom
GlobalFindAtomA
GlobalFree
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
InitializeCriticalSection
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadResource
LocalAlloc
LocalFree
LockResource
MulDiv
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
RemoveDirectoryA
ResetEvent
ResumeThread
RtlUnwind
SetConsoleCtrlHandler
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetErrorMode
SetEvent
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
SetPriorityClass
SetSystemTime
SetThreadLocale
SetThreadPriority
SizeofResource
Sleep
SleepEx
SuspendThread
SystemTimeToFileTime
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
WinExec
WriteFile
WritePrivateProfileStringA
lstrcmpA
lstrcpyA
lstrcpynA
lstrlenA

version.dll
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wsock32.dll
WSAAsyncGetHostByName
WSAAsyncGetServByName
WSAAsyncSelect
WSACancelAsyncRequest
WSACancelBlockingCall
WSACleanup
WSAGetLastError
WSAIsBlocking
WSAStartup
accept
closesocket
connect
gethostbyname
gethostname
getservbyname
getsockopt
htons
inet_addr
inet_ntoa
ioctlsocket
listen
ntohs
recv
select
send
setsockopt
socket
bind

winspool.drv
ClosePrinter
DocumentPropertiesA
EnumPrintersA
OpenPrinterA

comctl32.dll
ImageList_Add
ImageList_BeginDrag
ImageList_Create
ImageList_Destroy
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_Draw
ImageList_DrawEx
ImageList_EndDrag
ImageList_GetBkColor
ImageList_GetDragImage
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Read
ImageList_Remove
ImageList_Replace
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_SetDragCursorImage
ImageList_SetIconSize
ImageList_SetOverlayImage
ImageList_Write
InitCommonControls

gdi32.dll
Arc
BitBlt
CombineRgn
CopyEnhMetaFileA
CreateBitmap
CreateBrushIndirect
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCA
CreateDIBSection
CreateDIBitmap
CreateFontIndirectA
CreateHalftonePalette
CreateICA
CreatePalette
CreatePatternBrush
CreatePen
CreatePenIndirect
CreatePolygonRgn
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
DeleteEnhMetaFile
DeleteObject
Ellipse
EndDoc
EndPage
ExcludeClipRect
ExtCreatePen
ExtCreateRegion
ExtFloodFill
ExtTextOutA
ExtTextOutW
FillRgn
GdiFlush
GetBitmapBits
GetBkColor
GetBrushOrgEx
GetCharacterPlacementW
GetClipBox
GetCurrentPositionEx
GetDCOrgEx
GetDIBColorTable
GetDIBits
GetDeviceCaps
GetEnhMetaFileBits
GetEnhMetaFileHeader
GetEnhMetaFilePaletteEntries
GetMapMode
GetNearestColor
GetObjectA
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetSystemPaletteEntries
GetTextColor
GetTextExtentExPointW
GetTextExtentPoint32A
GetTextExtentPoint32W
GetTextMetricsA
GetWinMetaFileBits
GetWindowOrgEx
IntersectClipRect
LineTo
MaskBlt
MoveToEx
PatBlt
Pie
PlayEnhMetaFile
PolyPolyline
Polygon
Polyline
RealizePalette
RectVisible
Rectangle
RestoreDC
SaveDC
SelectClipRgn
SelectObject
SelectPalette
SetAbortProc
SetBkColor
SetBkMode
SetBrushOrgEx
SetDIBColorTable
SetDIBits
SetEnhMetaFileBits
SetMapMode
SetPixel
SetROP2
SetStretchBltMode
SetTextAlign
SetTextColor
SetViewportExtEx
SetViewportOrgEx
SetWinMetaFileBits
SetWindowExtEx
SetWindowOrgEx
StartDocA
StartPage
StretchBlt
TextOutA
TextOutW
UnrealizeObject

shell32.dll
DragAcceptFiles
DragQueryFile
DragQueryPoint
SHGetDesktopFolder
SHGetFileInfo
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteA
ShellExecuteEx
Shell_NotifyIcon
SHGetPathFromIDList

user32.dll
ActivateKeyboardLayout
AdjustWindowRectEx
AppendMenuA
BeginDeferWindowPos
BeginPaint
CallNextHookEx
CallWindowProcA
CharLowerA
CharLowerBuffA
CharNextA
CharToOemA
CharUpperA
CharUpperBuffA
CheckMenuItem
ChildWindowFromPoint
ClientToScreen
ClipCursor
CloseClipboard
CopyIcon
CreateCaret
CreateIcon
CreateMenu
CreatePopupMenu
CreateWindowExA
DefFrameProcA
DefMDIChildProcA
DefWindowProcA
DeferWindowPos
DeleteMenu
DestroyCaret
DestroyCursor
DestroyIcon
DestroyMenu
DestroyWindow
DispatchMessageA
DrawEdge
DrawFocusRect
DrawFrameControl
DrawIcon
DrawIconEx
DrawMenuBar
DrawTextA
DrawTextExA
DrawTextW
EmptyClipboard
EnableMenuItem
EnableScrollBar
EnableWindow
EndDeferWindowPos
EndPaint
EnumChildWindows
EnumClipboardFormats
EnumThreadWindows
EnumWindow
EqualRect
FillRect
FindWindowA
FindWindowExA
FrameRect
GetActiveWindow
GetAsyncKeyState
GetCapture
GetCaretPos
GetClassInfoA
GetClassNameA
GetClientRect
GetClipboardData
GetCursor
GetCursorPos
GetDC
GetDCEx
GetDesktopWindow
GetDoubleClickTime
GetFocus
GetForegroundWindow
GetIconInfo
GetKeyNameTextA
GetKeyState
GetKeyboardLayout
GetKeyboardLayoutList
GetKeyboardState
GetKeyboardType
GetLastActivePopup
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuItemInfoA
GetMenuState
GetMenuStringA
GetMessagePos
GetMessageTime
GetParent
GetPropA
GetScrollInfo
GetScrollPos
GetScrollRange
GetSubMenu
GetSysColorBrush
GetSystemMenu
GetSystemMetrics
GetTabbedTextExtentA
GetTopWindow
GetUpdateRect
GetWindow
GetWindowDC
GetWindowLongA
GetWindowPlacement
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
HideCaret
InflateRect
InsertMenuA
InsertMenuItemA
IntersectRect
InvalidateRect
InvalidateRgn
InvertRect
IsCharAlphaA
IsCharAlphaNumericA
IsChild
IsClipboardFormatAvailable
IsDialogMessageA
IsIconic
IsRectEmpty
IsWindow
IsWindowEnabled
IsWindowVisible
IsZoomed
KillTimer
LoadBitmapA
LoadCursorA
LoadIconA
LoadImageA
LoadKeyboardLayoutA
LoadMenuA
LoadStringA
MapVirtualKeyA
MapWindowPoints
MessageBeep
MessageBoxA
MsgWaitForMultipleObjects
OemToCharA
OffsetRect
OpenClipboard
PeekMessageA
PostMessageA
PostQuitMessage
PtInRect
RedrawWindow
RegisterClassA
RegisterClipboardFormatA
RegisterWindowMessageA
ReleaseCapture
ReleaseDC
RemoveMenu
RemovePropA
ScreenToClient
ScrollWindow
ScrollWindowEx
SendMessageA
SendMessageTimeoutA
SetActiveWindow
SetCapture
SetCaretPos
SetClassLongA
SetClipboardData
SetCursor
SetFocus
SetForegroundWindow
SetKeyboardState
SetMenu
SetMenuItemInfoA
SetParent
SetPropA
SetRect
SetRectEmpty
SetScrollInfo
SetScrollPos
SetScrollRange
SetTimer
SetWindowLongA
SetWindowPlacement
SetWindowPos
SetWindowRgn
SetWindowTextA
SetWindowsHookExA
ShowCaret
ShowCursor
ShowOwnedPopups
ShowScrollBar
ShowWindow
SystemParametersInfoA
TrackPopupMenu
TranslateMDISysAccel
TranslateMessage
UnhookWindowsHookEx
UnionRect
UnregisterClassA
UpdateWindow
ValidateRect
WaitMessage
WinHelpA
WindowFromPoint
keybd_event
wsprintfA
GetSysColor

winmm.dll
PlaySoundA
sndPlaySoundA
timeGetTime
timeKillEvent
timeSetEvent

imm32.dll
ImmGetCompositionStringA
ImmGetContext
ImmReleaseContext
ImmSetCompositionFontA
ImmSetCompositionWindow

ole32.dll
CoCreateGuid
CoInitialize
CoTaskMemFree
CoUninitialize
StringFromGUID2

oleaut32.dll
GetErrorInfo
SafeArrayCreate
SafeArrayGetElement
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayRedim
SysAllocStringLen
SysFreeString
SysReAllocStringLen
SysStringLen
VarBoolFromStr
VarBstrFromBool
VarBstrFromCy
VarBstrFromDate
VarCyFromStr
VarDateFromStr
VarI4FromStr
VarNeg
VarNot
VarR8FromStr
VariantChangeTypeEx
VariantClear
VariantCopy
VariantCopyInd
VariantInit

Hope this helps you !!!!!

/hobferret
drizz
11-21-2003, 04:19 PM
hello to all!

my first post here.

i'm learning asprotect these days (i've been using using automatic removers until none worked)
i've made this plugin for imprec 1.6 last night (very hasty) surely has bugs and flaws
but maybe someone can improve it (for ASProtect 1.23 RC4 - 1.3.08.24 only)

i'm also coding some debugger/loader like Manko's but it sucks

:rolleyes:
hobferret
11-21-2003, 04:36 PM
hello to all!

my first post here.

i'm learning asprotect these days (i've been using using automatic removers until none worked)
i've made this plugin for imprec 1.6 last night (very hasty) surely has bugs and flaws
but maybe someone can improve it (for ASProtect 1.23 RC4 - 1.3.08.24 only)

i'm also coding some debugger/loader like Manko's but it sucks

:rolleyes:

Hi drizz welcome to the board :)

Don't wanna sound sarcastic but it would help if you attached your file so we may take a look at what you have done ;)

/hobferret

Thanx for the attachment! :cool:

/hobferret 11/21/03
drizz
11-21-2003, 04:47 PM
Hi drizz welcome to the board :)

Don't wanna sound sarcastic but it would help if you attached your file so we may take a look at what you have done ;)

/hobferret

hi hobferret, damn im new and i was using opera with "refuse popup windows"
and when i clicked alldone, the page just closed......

:oops:


E-license 4.0 unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > E-license 4.0 unpacking
PDA

View Full Version : E-license 4.0 unpacking

DeCryptoniTe
11-18-2003, 03:55 PM
Hi !

I'm trying unpack zmud 6.62, which is protected by e-license 4.0, but i failed.
I read som tutorials about unpacking, but i'm unable to recreate IAT.
In encrypted zmud.exe (.idata section) is only one export cyb to elicen40.dll, which resolve exports and encrypt its in memory (?).
Anyone has some experience with e-license 4.0 and how to recreate sections ?
Please help me. Thanx.

DeCryptoniTe.
Billy[23]
11-29-2003, 07:57 PM
e-license is silly, just start the program till u get the e-license nag screen, bpx on freelibrary, hit free trial, and execute the api till the user code, look for.

JMP DWORD PTR DS:[249F85C] <--This Jumps to OEP

Of Course 249F85C will be differnt in most programs thats what i got for Zmud
just look for a "JMP DWORD PTR [XXXXXXX]

The OEP has a funny startup code i think some of the instructions like

PUSH EBP
MOV EBP, ESP

are emulated b4 the JMP DWORD PTR [XXXXXXX]

Should be simple enough to fix :)

Api's are also Simple from what i saw they are like:

000674B6 push eax
000674B7 mov eax,[67510] // DWORD value: 1DAED479
000674BC xor eax,[67530] // DWORD value: 6A4973A6
000674C2 mov [47098],eax
000674C7 pop eax
000674C8 jmp [47098]

So 1DAED479 XOR 6A4973A6 = 77E7A7DF
77E7A7DF = Kernel32.GetCurrentThreadId

On my Pc at least, its easy enough to fix all imports by hand, just takes a while
maybe somebody with experience can write a simple plugin for imprec ? :P

Have fun

-Billy
Billy[23]
11-29-2003, 10:12 PM
Nevermind about the plugn its not even needed, i was playing and i found this.

Find the First Invalid IAT Entry.

Mine was:

RVA: 0038C230 (0078C230 <-- in Memory)

Start the Program till u are at the Nag Screen, goto that rva in the dump window.

Set a Hardware Breakpoint on the 4 Bytes (Write)

Click FreeTrial

You will break here.
02537CD3 MOV DWORD PTR DS:[ECX],EAX ;Eax Contains Fake Api
02537CD5 MOV EDX,DWORD PTR SS:[EBP-2AC]

Scrolling up u will see this code.

02537C13 8B85 2CFDFFFF MOV EAX,DWORD PTR SS:[EBP-2D4]
02537C19 8930 MOV DWORD PTR DS:[EAX],ESI
02537C1B 8B8D 2CFDFFFF MOV ECX,DWORD PTR SS:[EBP-2D4]
02537C21 8B95 4CFDFFFF MOV EDX,DWORD PTR SS:[EBP-2B4] ; Contains Real API
02537C27 3311 XOR EDX,DWORD PTR DS:[ECX]
02537C29 8B85 30FDFFFF MOV EAX,DWORD PTR SS:[EBP-2D0]
02537C2F 8910 MOV DWORD PTR DS:[EAX],EDX
02537C31 8B8D 34FDFFFF MOV ECX,DWORD PTR SS:[EBP-2CC]
02537C37 8B95 38FDFFFF MOV EDX,DWORD PTR SS:[EBP-2C8]
02537C3D 8D440A 02 LEA EAX,DWORD PTR DS:[EDX+ECX+2]
02537C41 8985 3CFDFFFF MOV DWORD PTR SS:[EBP-2C4],EAX
02537C47 8B8D 3CFDFFFF MOV ECX,DWORD PTR SS:[EBP-2C4]
02537C4D 8B95 30FDFFFF MOV EDX,DWORD PTR SS:[EBP-2D0]
02537C53 8911 MOV DWORD PTR DS:[ECX],EDX
02537C55 8B85 34FDFFFF MOV EAX,DWORD PTR SS:[EBP-2CC]
02537C5B 8B8D 38FDFFFF MOV ECX,DWORD PTR SS:[EBP-2C8]
02537C61 8D5401 08 LEA EDX,DWORD PTR DS:[ECX+EAX+8]
02537C65 8995 3CFDFFFF MOV DWORD PTR SS:[EBP-2C4],EDX
02537C6B 8B85 3CFDFFFF MOV EAX,DWORD PTR SS:[EBP-2C4]
02537C71 8B8D 2CFDFFFF MOV ECX,DWORD PTR SS:[EBP-2D4]
02537C77 8908 MOV DWORD PTR DS:[EAX],ECX
02537C79 8B95 34FDFFFF MOV EDX,DWORD PTR SS:[EBP-2CC]
02537C7F 8B85 38FDFFFF MOV EAX,DWORD PTR SS:[EBP-2C8]
02537C85 8D4C10 0D LEA ECX,DWORD PTR DS:[EAX+EDX+D]
02537C89 898D 3CFDFFFF MOV DWORD PTR SS:[EBP-2C4],ECX
02537C8F 8B95 3CFDFFFF MOV EDX,DWORD PTR SS:[EBP-2C4]
02537C95 8B85 ACFDFFFF MOV EAX,DWORD PTR SS:[EBP-254]
02537C9B 8902 MOV DWORD PTR DS:[EDX],EAX
02537C9D 8B8D 34FDFFFF MOV ECX,DWORD PTR SS:[EBP-2CC]
02537CA3 8B95 38FDFFFF MOV EDX,DWORD PTR SS:[EBP-2C8]
02537CA9 8D440A 14 LEA EAX,DWORD PTR DS:[EDX+ECX+14]
02537CAD 8985 3CFDFFFF MOV DWORD PTR SS:[EBP-2C4],EAX
02537CB3 8B8D 3CFDFFFF MOV ECX,DWORD PTR SS:[EBP-2C4]
02537CB9 8B95 ACFDFFFF MOV EDX,DWORD PTR SS:[EBP-254]
02537CBF 8911 MOV DWORD PTR DS:[ECX],EDX
02537CC1 8B85 38FDFFFF MOV EAX,DWORD PTR SS:[EBP-2C8] ; Start Faking Api
02537CC7 0385 34FDFFFF ADD EAX,DWORD PTR SS:[EBP-2CC] ; Finish Faking Api
02537CCD 8B8D 54FDFFFF MOV ECX,DWORD PTR SS:[EBP-2AC]
02537CD3 8901 MOV DWORD PTR DS:[ECX],EAX ; Mov Fake Api into IAT
02537CD5 8B95 54FDFFFF MOV EDX,DWORD PTR SS:[EBP-2AC]

Simply Change

02537CC1 8B85 38FDFFFF MOV EAX,DWORD PTR SS:[EBP-2C8] ; Start Faking Api
02537CC7 0385 34FDFFFF ADD EAX,DWORD PTR SS:[EBP-2CC] ; Finish Faking Api
02537CCD 8B8D 54FDFFFF MOV ECX,DWORD PTR SS:[EBP-2AC]
02537CD3 8901 MOV DWORD PTR DS:[ECX],EAX ; Mov Fake Api into IAT

to

02537CC1 8B85 4CFDFFFF MOV EAX,DWORD PTR SS:[EBP-2B4]
02537CC7 90 NOP
02537CC8 90 NOP
02537CC9 90 NOP
02537CCA 90 NOP
02537CCB 90 NOP
02537CCC 90 NOP
02537CCD 8B8D 54FDFFFF MOV ECX,DWORD PTR SS:[EBP-2AC]
02537CD3 8901 MOV DWORD PTR DS:[ECX],EAX

That will replace all fake entires with Real ones, just let it will stop on a exception, then just fire up imprec and imports are 100% correct.

Sorry for the Previous Post i just discovered this :)

Hmm After Fixing the Dump and running Dumped_.exe , lots of crashes
No idea how to fix this, anybody want to have a look and shed some light ? iam way too busy to be getting into this :( but would like to see how to resolve it.

-Billy
DeCryptoniTe
12-05-2003, 02:43 PM
First ! Thanks for your Reply, but I already unpack my target. :)

Yes, E-license is silly. OEP is EP of packed exe.
My first problem was, that E-license (EL) used anti-dump tricks, so you can't
dump program with ProcDump or IceDump (If you don't believe me, try dump .idata section from elicen40.dll. It creates 2,2 GB file.).
So better is used LordPE for dumping exe.
Second, this is was my first attempt to manually unpack (without unpacker) packed file, so i never heard about tools like revirgin or Import Reconstructor.
Never mind.

You don't need decrypt IAT with NOPing xor and add instruction.
Use Trace Level 3 (trap flag) and ImpRec resolve unresolved imports.
Than fix dump and dumped_.exe works fine on my Computer.
But I heard, that on other system (Win2k oftenly), it crash sometimes with message
"Access violation on adrex 0x0....., Read of Address FFFFFFFF".
So, there is still some unresolved pointers or maybe .reloc table is invalid for
dumped file ? I don't know.
jolopez
01-28-2004, 03:15 PM
i am trying to do it with ollydbg. is it possible? when i hit free trial the program goes out and turns off my computer. any help?
(thx for all your information)
jolopez
02-02-2004, 09:09 AM
well i have unpacked zmud follow the post that is more down, and i have the executable that runs well, but when i connect to server the program products a segment fault or something. any help? plis....
SlantNGo
02-15-2004, 03:47 PM
How do I dump the EXE with Import Reconstructor? I'm trying to unpack Total Pro Football URL Removed) and have never manually unpacked before.

Thanks,

Kevin
JMI
02-15-2004, 04:15 PM
SlantNGo:

It certainly appears that you ignored the BIG RED LETTERS at the top of the Forums. Time to go back there, read the message and then review the FAQ. Then use the "search" button and do some of your own research on how one may "dump with import Reconstructor." Then do a search of "manual unpacking" and read a whole bunch of threads on that subject, then make an attempt on your own to do these things and report back when you have a "specific" question about how far you got and where you are stuck.

No one here has the time or the energy to attempt to take you by the hand and lead to through the entire process of learning how to dump or manually unpack exes of your current favorite target. The short answer to your question is that you have to learn how to crawl before you can walk and you have given no indication you yet know how to crawl. There is already plenty of information here for you to review on "learning how to crawl."

Regards,
SlantNGo
02-16-2004, 03:58 PM
I apologize JMI. I have been reading and following tutorials and other forum posts, from Muad'dib's eLicense 2.4 tutorial to the posts in this thread. I am using OllyDbg, setting a breakpoint on FreeLibrary as in Billy's post and on GetModuleHandleA as in Muad's tutorial, but it never makes it to either of the two breakpoints. I am supposed to be setting a hardware breakpoint, right?

I suspect it's because I'm having to set back my clock in order to get the Trial button on the splash screen (my 3-day trial has expired). I think it performs the system clock check before it gets to my breakpoints. I was looking for a possible "quick fix" using ImpRec to fix up the invalid imports. Is anyone familiar with eLicense 4.0 as in what traces it leaves on the hard drive that I could get rid of? If not, I'll probably have to save my system to a ghost, then pull back an old one w/o Total Pro Football, reinstall it and do my debugging from there.
jolopez
02-16-2004, 04:25 PM
I apologize JMI. I have been reading and following tutorials and other forum posts, from Muad'dib's eLicense 2.4 tutorial to the posts in this thread. I am using OllyDbg, setting a breakpoint on FreeLibrary as in Billy's post and on GetModuleHandleA as in Muad's tutorial, but it never makes it to either of the two breakpoints. I am supposed to be setting a hardware breakpoint, right?

i think that the bpx is bpx Kernel32.FreeLibrary in the nag window With zmud is.

I suspect it's because I'm having to set back my clock in order to get the Trial button on the splash screen (my 3-day trial has expired). I think it performs the system clock check before it gets to my breakpoints. I was looking for a possible "quick fix" using ImpRec to fix up the invalid imports. Is anyone familiar with eLicense 4.0 as in what traces it leaves on the hard drive that I could get rid of? If not, I'll probably have to save my system to a ghost, then pull back an old one w/o Total Pro Football, reinstall it and do my debugging from there.
well, i think the elicense has a removal tool in order to do this, see the main page of elicnse to download it. another way is to search into the elicense to do this by hand, there are some tutorials tehre to do this. i don t try them but i think there should work. the elicense has two files lmmc and other i dont remember that are blocked by the system control. if yo remove this files you remove elicense.
SlantNGo
02-16-2004, 05:21 PM
Yea, I removed Elicense using the removal tool, uninstalled the game, and checked to make sure lmmcfu.cpl and mmfs.dll were gone, reinstall the game... still can detect my trial has expired. I'm sure there's something else hidden that's gotta be removed. How were you able to get around this? Or is your trial still active?
hobferret
02-17-2004, 07:12 AM
Yea, I removed Elicense using the removal tool, uninstalled the game, and checked to make sure lmmcfu.cpl and mmfs.dll were gone, reinstall the game... still can detect my trial has expired. I'm sure there's something else hidden that's gotta be removed. How were you able to get around this? Or is your trial still active?

Hiya :D

Look for what I posted on this site about a month back :confused:

Elicense40 - It is really easy if you have expired "not literally" just read it - if you had done a search you would have found it - try not to be lazy!

/hobferret
SlantNGo
02-17-2004, 08:39 AM
Hi hobferret,

I saw that post, couldn't follow your instructions, couldn't find the byte sequence 83BDE0F0FFFF02 you referred to. Is that program specific? Or is it common to the elicen40.dll? Also mine is different size/date than yours, 69 KB and July 2002 I believe, I'll double-check that when I get home.
hobferret
02-17-2004, 10:55 AM
Hi hobferret,

I saw that post, couldn't follow your instructions, couldn't find the byte sequence 83BDE0F0FFFF02 you referred to. Is that program specific? Or is it common to the elicen40.dll? Also mine is different size/date than yours, 69 KB and July 2002 I believe, I'll double-check that when I get home.

Hiya SlantNGo ;)

That sequence is specific to elicense40.dll or at least every one I have seen:D

If you can't find it try running the prog again, when you arrive at the nag search again and you will most likely find it - had the same prob here a couple of times - it's there you just need to persevere :)

If all else fails, get the window handle then try a BMSG Wm_Destroy and you will eventually end up in the right code area :D

One other thing someone posted something about finding the correct IAT reference, in this version you need to subtract 4 from the address you are looking for because the prog then adds +4 to the byte. i.e if you are looking for 0078C230 the break on 0078C22C - OK! ;)

/hobferret
Test2000
02-18-2004, 09:27 AM
SlantNGo, I am also trying to do the same programme and have run into a few problems myself. I am just starting out though and admit perhaps I am trying to run before I can walk. My main problem is when I try to start up my SoftIce loader nothing happens the sequence goes like this:

(1) Load up SoftIce lite

(2) Load up TPF.exe

(3) Get the Trial Expired screen with no option but to exit.

Thats it I get nothing after that the only thing I can do is just exit, no breakpoints no SoftIce pop up nothing.

Whats interesting for me is the mmfs file. Now I uninstalled the e-license control but mmfs.dll was still in my windows folder after destorying nearly all processes in task manager I finally was allowed to delete it (before that I got the stupid "read-write protection bla bla" message). For me that leads me to believe that mmfs is connected to the connection protocal for registering. More on that in a few seconds. You may also notice that mmfs.dll and elicense.dll are wrapped. This is obvious by examining a hex editor which has tons of information and the .dll in a diassmbler like WDASM. Now my question to hobferret is in the programme that you used were the mmfs and e-license files both wrapped? If not then this is the difference between TPF and what ever programme you were reversing and maybe why the byte routine can't be found in TPF.

Back to the mmfs.dll file now I've partially examined the file in HEdit. In between all the "gunk" bytes you discover certian calls such as GetModuleHandleA and a call made to a connection process. This makes me think that mmfs is the major connection file along with lmmcfu.cpl. For TPF there is also another file but I have uninstalled it so can't look at the minute (may look later on) that may also have some bearing. All of these seem to interlink with the elicense file to form the overall wrapper. Note I could be way off target here but this is the gut feeling I am getting.

Really e-license is a very tricky programme for newbies like myself and maybe something I come back to once I've done some more reading on the subject. Some people seem to be focusing on the whole unpacking of the actual programme but I think three other areas would be of more interest:

(1) Finding the actual full routine that makes the call to e-license.com and port 80. Kill this routine so no call is made and the user can just type in anything and continue (difficult perhaps impossible). Redirect the routine so that it goes to another site e.g. a virtual machine, IIS or L2L Proxy. This site would then hold a simple file that is called and feed back. Again this would require finding out what type of file is stored by the e-license servers and then building your own. However something as simple as a .asp file might be able to do the trick. To better cement that idea:

current web-site address: http://www.elicense.com
new address: http://www.whatever.com

Current: Programme makes call to elicense.com with input data. elicense.com comes back and feeds a response back (most likely no).

Edited: Programme makes call to newsite.com with input data. newsite.com feedsback data from already uploaded fake file data is then valid.

Problem: Still need to find out the way in which elicense holds the files on there server.

Possible solution: Create a simple .asp with something like:

ProductId = $WhatEver|True
VendorId = $WhatEver2|True
OrderNumber = 123456789|True

Difficulty rating: Very.

(2) Find ProductId and VendorID. This one may not be to tricky for someone with good reversing skills. Basically as we all know the ProductID and VendorID are both stored within the .exe file. However as of yet I am not able to find either within the code. Some may ask whats the point because I still don't have a valid order number but there is already some software out there for that process. This may well be good as a tutorial especially for newbies who may find it easier to search for two processes which is a similar device to serial sniffing (one of the first things you learn). However I must say I've tried replecating a serial sniffing type procedure and it turns up nothing.

Difficulty rating: Intermediate.

(3) Creation of an unpacking tool for e-license. I think hobferret was going to think about doing this one personally I'd prefer a ProductID/Vendor finder but hopefully your still going to continue with this as I believe e-license is one of the biggest firms now without a pre-made unpacker which is kind of weird.

Overall e-license is quite a tricky tool for newbies but is becoming a massive tool used by commercial companies. I hope someone who has better skills may think about any of the above ideas I've suggested either for interests sakes or just to design a tutorial on (again another area that is severly lacking on e-license).

To SlantNGo let me know how you get on with TPF.exe and I'll do the same if I can work it out. Like I said I've got a bit more reading to do on unpacking and rebuilding and trying to work out why the hell SoftIce does nothing when TPF.exe is staryed (Maybe someone here can shed some light on that??).

Cheers

T2000

P.S. SlantNGo if you want to do some reading I recommend Krobars page it has shed loads of tutorials on unpacking. Some of the other stuff is a little outdated though as its mainly from the late 90's and some from around two years ago. The link is somewhere on the front page of the forum I think.
SlantNGo
02-19-2004, 12:32 AM
Have you tried Damn's eLicense proxy? I downloaded it and read through the documentation but didn't really fiddle with it. I think that was designed for eLicense 3.3 but you can give that a shot too.

I'm going at the EXE with Ollydbg, and it's not reaching my breakpoints either. I think the process was written for programs where the trial is still active, hence you can click Trial and it will get to your breakpoint. If the trial has expired, you have to do what hobferret did... however I haven't had any success.
hobferret
02-19-2004, 07:59 AM
Hiya all ;)

Elicen40.dll and its temp file. 69Kb 06/25/2002 .

Just had a look at your proggie take note!

TPF
@ 02224B54 CALL 0227CBED
@ 02224B5E MOV[EBP+XXXXXXXX],EAX
@ 02224B64 MOV EAX,[XXXXXXXX]
@ 02224B6A MOV[EBP+XXXXXXXX],EAX
@ 02224B70 CMP DWORD PTR[EBP+XXXXXXXX],02 (83BDE0F0FFFF02) SO IT'S THERE :D
@ 02224B77 JNZ 02224E57

You can work the rest out for yourself including the "must register" piece - SIMPLE OR WHAT :confused:

Obviously addresses will be different on your machine :p
/hobferret
Test2000
02-19-2004, 12:49 PM
Thanks for that hobferret I may have a look at it some more once I've done some more reading around packing/unpacking and rebuilding the import tables. Its good to know that the byte sequence in the file is there but as I said in my last message I don't want to jump the gun on this as I am just starting out. I'll have a look into it again in the next few days and report back how I went/if I ran into trouble etc. One question though is what debugger are you using? I have assumed from your message it is OllyDbg(???).

SlantNGo the DAMN proxy is what I was talking about earlier when I referred to "other software". It will allow you to do all e-license programmes and works for 4.0 the trick is to find the actual Vendor ID/Product ID which I believe are encrypted using the RC5 protocal and CBC. Once again this is another area I am going to explore once I've done more reading.

To Mods: Any moderator/admin reading this you may want to think about making this topic sticky. It seems to be the main topic of discussion in regards to e-license and would also prevent other users from coming back in a few months time and asking the same questions when we could just direct them to a few pages back. Also perhaps moving the older topics on e-license into here would be helpful.

Hiya all ;)

Elicen40.dll and its temp file. 69Kb 06/25/2002 .

Just had a look at your proggie take note!

TPF
@ 02224B54 CALL 0227CBED
@ 02224B5E MOV[EBP+XXXXXXXX],EAX
@ 02224B64 MOV EAX,[XXXXXXXX]
@ 02224B6A MOV[EBP+XXXXXXXX],EAX
@ 02224B70 CMP DWORD PTR[EBP+XXXXXXXX],02 (83BDE0F0FFFF02) SO IT'S THERE :D
@ 02224B77 JNZ 02224E57

You can work the rest out for yourself including the "must register" piece - SIMPLE OR WHAT :confused:

Obviously addresses will be different on your machine :p
/hobferret
SlantNGo
02-19-2004, 02:13 PM
Wow I'm an idiot... found the byte sequence in the temp file and put a bpx 3 lines above it like you said. What are you doing to trigger the bpx? Right now, I'm exiting the program, it breaks there, I change EAX to 1, it takes the jump, and if I resume the program, I get password expired error 24.

So, adding 14AB like you said, I put another bpx there. Never makes it to that line... still exits with password expired. I'll give it another shot later. What were you using to unpack?
JMI
02-19-2004, 02:22 PM
Test2000:

The FAQ and the BIG RED LETTERS tell posters that they are supposed to SEARCH before posting. Assuming they DO that, there would be no need to create a series of "sticky" threads or to attempt to merge all threads on e-license (or any other subject) into one big, incoherent mass. For example, a merge would probably re-order all the posts by date and then one wouldn't be able to tell which posts went with which topic or sub-topic. Not a very good plan.

Regards,
hobferret
02-19-2004, 03:00 PM
SlantNGo

I'm exiting the program, it breaks there, I change EAX to 1, it takes the jump, and if I resume the program, I get password expired error 24.

Like I said b4 if you get any errors just keep a record of where you have jumped from and then make sure you don't repeat that jump :D

Trace thru the whole bloody lot :D
Be patient you will get there in the end :p

BTW Don't ask for any more info coz I have deleted the thing, not my cup of tea :)
The IAT is simple coz it's in VB :(

/hobferret
Test2000
02-19-2004, 03:55 PM
Test2000:

The FAQ and the BIG RED LETTERS tell posters that they are supposed to SEARCH before posting. Assuming they DO that, there would be no need to create a series of "sticky" threads or to attempt to merge all threads on e-license (or any other subject) into one big, incoherent mass. For example, a merge would probably re-order all the posts by date and then one wouldn't be able to tell which posts went with which topic or sub-topic. Not a very good plan.

Regards,

True but the thing is most people don't do that. Maybe its just me but I'd like to have an active topic where by people can talk about the latest developments with that type of protection or have people go into that thread who maybe having problems. It also means you don't have the same question come up again as theres always a thread on hand for someone to post that question or check the previous pages. Having a search function is fine but most of the topics end up dead anyway and result in a new post ala this one because other people have other questions. Anyway I won't get into board semantics I have some more very easy crackmes to play with.
Test2000
02-19-2004, 04:12 PM
Hobferret,

I nearly forgot to ask you something. Did you find what you were looking for last time you were playing with e-license? I remember you asked for the VTCyber unwrapper which was used before it became the e-license.dll. Just wondering did you find it because I've got a link for you? Will PM you if you haven't if you have no point.
hobferret
02-20-2004, 06:00 AM
Hobferret,

I nearly forgot to ask you something. Did you find what you were looking for last time you were playing with e-license? I remember you asked for the VTCyber unwrapper which was used before it became the e-license.dll. Just wondering did you find it because I've got a link for you? Will PM you if you haven't if you have no point.

Hiya ;)

No I have found nothing, if it is an active link then please PM with details :)

Thanx

/hobferret
Test2000
02-20-2004, 02:56 PM
I've PM'd you the link to the file now hobferret hope it helps with what you are trying to do. If the link goes down between now and the time you read the PM give me a PM back with an e-mail (just set up a casual hotmail one if you don't want to give me a permanent address) and I'll attach it and send as I have downloaded it already for my own reference.
hobferret
02-20-2004, 03:58 PM
I've PM'd you the link to the file now hobferret hope it helps with what you are trying to do. If the link goes down between now and the time you read the PM give me a PM back with an e-mail (just set up a casual hotmail one if you don't want to give me a permanent address) and I'll attach it and send as I have downloaded it already for my own reference.

Thanx ;)

I found that prog for the VTCyber unwrapper too, but it's not what I am after. What I need is the vtcpak.exe to create a vtcpacked prog. Or better still the elicense SDK :D

Regarding the temp file I think if I remember correctly its something like XXXXXXXX.2xcp and is located in the WINDOWS\TEMP directory, almost sure it ends with 2xcp. And the byte sequence is in this temp file, remember what I said B4 if you get message boxes showing errors keep a log of where you are coming from & going to. Might sound a pain in the butt but you will get there in the end M8 :D

Thanx

/hobferret
Test2000
02-20-2004, 04:32 PM
Cheers for that hobferret I'll have a look once I feel I've got myself up to a good level of understanding cracking concepts I felt I was weak on I feel thats going to take a good week maybe two.

Sorry that wasn't what you were looking for in terms of the vtcpak.exe I can say it no longer exists in any shape or format. I feel whatever was vtcpak has either been deleted or turned into what became the e-license SDK. Now in terms of that you might want to check out a company called HeyNow.com they specialised in porting the e-license SDK to Macintosh compatibility so they should have good understanding. You might be able to feel them out and see if they will give you any help in understanding how the processes work better or even give you a working version. Remember be savy about this if you go that route something like "I am a developer looking into making a programme with similar or identical protocal/API calls to the e-license mechniasm, I believed you worked on this and was wondering if you could me either some guidelines or a working SDK if you have time. The reason I am contacting you is because I feel that I may need such procedures porting over to Macintosh comptability which is what you have dealt with for the ViaTech company according to your resume". Could work might not but worth a shot.

I've also attempted to get the SDK for you on another route but I'll see how that goes.

[Edit: The SDK is definitely not online either it seems the route for obtaining this is similar to what Numega use e.g. ring up ask for copy to evaluate etc. As a side note some more interesting information is that ViaTech are looking into going into movies using the e-license protection.

Edit 2: Hobferret just realised you may want to check the DAMN proxy source code if you haven't already that may or may not contain some useful information suppose you have the link for the DAMN site?]
hobferret
02-21-2004, 06:08 AM
Thanx for the info Test2000 ;)

But perhaps you should have sent that via a PM, no doubt VIATECH keep an eye on these sites :D

Let me know how you get on with your proggie :cool:

/hobferret
Test2000
02-23-2004, 05:03 PM
This is just a very slight update on ViaTech in terms of two areas. The first is that they've now upgrade there systems (again) in terms of cryptography they are now using there own custom cryptography mixed in with some basic RSA stuff. I think they may also have a third encrypter as well but I believe there custom one and the old RC5 key is what they are using at the minute.

The other update comes in the form of perhaps the trial system. Some people have said they can't seem to get the trial back. This is because just deleting the mmfs file now does jack shit. On some exes and I use the term very loosely when I say sum you need to delete the following files:

lcmmfu.cpl
mmfs.dll/sys
mmfs.dss
ViaTech Keys in Registry
[AppName] Key in Registry
LicCtrl (this is impossible to delete it does not remove itself from the registry the last two files refuse to be removed even when the runservice.exe in task manager is killed).

Even then its no guarantee as the main exe now usually runs a GetLocalTime to GetSystemTime to GetFileTime to Kernel32 which is just a pain in the backside to kill (and even if you NOP or dump it the exe goes crazy with errors). In terms of LicCtrl I am in the process of e-mailing ViaTech and may actually sue them as its a violation of and corruption of my computer system as I cannot remove the file. You may also notice that in nearly all protections protected by E-License there is no license agreement or pre-warning that such systems will be installed upon your computer. In terms of computer law this may fall under the same classification as trojan horses and viruses. As these people can be prosecuted for not asking the user permission to run programmes and also for harmful acts (but with some wording it counts as invasion of privacy or possessions) the same action maybe able to be taken against ViaTech. Don't know depends how they reply to there e-mail if they are snobbish and rather "Not our problem" attitude I might sue them. Now thats irony :D.
seven
02-24-2004, 06:27 AM
i think itz eazy but tricky + boring
the proggy packed with neolite 2.0
http://members.lycos.co.uk/sssevennn/z.gif
hobferret
02-24-2004, 08:03 AM
Hiya Test2000 :)

Sent email on TPF, understand your point on answers and will oblige if necessary :D

BTW The prog you mentioned is more or less exactly the same as what is explained in the link you provided. If you are stuck the actual image size is 26C800h, I'm sure you can work the rest out, I got it working in about 10 mins when I realized what was going on and it's another written in VB ;)

Regards

/hobferret

Also to seven :)

Interesting stuff you have on lycos :D

/hobferret
jolopez
02-24-2004, 10:04 PM
well i think i have unpacked zmud and run it whithout elicense, but when the trial cames out the program has gone with the trial. i think i have unpacked it because he runned without the nag screen of elicense. but now the prgrams trys to run but fails somewhere any help plis?

and another thing i have been tryin to unpcak it now, without trial mode, and only i have catch is a passs has failed 24 or something like this

<quote>
When at TRY BUY EXIT LICENSE screen open debugger and search for this byte sequence:-
83BDE0F0FFFF02
When found use the second string occurance, i.e. the one after the call.
But set BPX 3 instructions above the CMP.
EAX must equal 1 and the following memory compare must also equal 1.
It will then JMP at the CMP DWORD PTR [EBP+FFFFF0E0] to the unpacker.
If any errors like INVALID PASSWORD occur check these:-
After the JMP above note code location i.e. 02563B75 add 14AB and you should be at a TEST EAX,EAX following </quote>
the things i meet are the cmp and comparitions if take eax to 1 the jnz brings to something and in this something there isnt cmp and 14ab more there arent test eax. so so how can i take out a license from now to never?
hobferret
02-25-2004, 04:37 AM
jolopez :eek:

I am not flaming you but READ STUDY AND INWARDLY DIGEST, I said before if you are having problems trace thru the whole thing from the CMP,02 and keep a note of where you are jumping to and jumping from. If you hit an error you know not to jump or converesly to jump depending upon what has happened. :D

It really is easy but it's down to you to sort it out else how will you learn if I or someone else does it for you. :cool:

/hobferret
jolopez
02-25-2004, 04:58 PM
jolopez :eek:

I am not flaming you but READ STUDY AND INWARDLY DIGEST

sorry, my message is not in intention o tell me how to do. In this forum i have learn to unpack the zmud. my zmud is unpacked i did it in trial mode, it is easy, but now when the trial is out my executable goes out to. :< so i am trying to do it whithout trial (i can try to in trial in another windows ;->) buti don´t think it would be elicense, i think zmud has another thing in the program that checks something (in where???¿?¿ elicense ? registry?) and makes it to not to run when no is in trial mode. For example i take my system in 2020 the trial is out, so the zmud original doesn run. my unpacked zmud (tracing until the oep dump with lordpe and fixing imports with imprec) dows run to :/, but if i put it on trial (when the elicense thinks it is in trial both programs runs well. how can my unpacked program check elicense? what must i nop? this is why i ask help.
sgdt
02-26-2004, 12:18 AM
A prior message I had written had gone missing. I don't believe I had any clickable links or code refs, so I don't know why.

Anyway, to zap LicCtrl files, the LicCtrl service must be stopped, then the DLLs, etc., can be deleted. One of the EXEs that wasn't mentioned was c:\WinNT\RunService.exe (please verify first, but the one on mine was from eLicense).

There are some VERY strange registery entries, though. They used the SysInternals trick of placing a NUL character in the midle of the keyname to prevent things like RegEdit from being able to see the contents of it or search it.

They begin at HKLM\Software\LicCtrl\LicCtrl\LicCtrl. That's as far as you get with standard RegOpenKey and the like.

However, with NtOpenKey, NtEnumerateKey, and NtEnumerateValueKey, some VERY interesting things happen... :) There seems to be quite a bit of interesting stuff stored in there.

For me, I have a new found hatered of UNICODE.
8 bits should be enough for any character... :)
hobferret
02-26-2004, 06:43 AM
sorry, my message is not in intention o tell me how to do. In this forum i have learn to unpack the zmud. my zmud is unpacked i did it in trial mode, it is easy, but now when the trial is out my executable goes out to. :< so i am trying to do it whithout trial (i can try to in trial in another windows ;->) buti don´t think it would be elicense, i think zmud has another thing in the program that checks something (in where???¿?¿ elicense ? registry?) and makes it to not to run when no is in trial mode. For example i take my system in 2020 the trial is out, so the zmud original doesn run. my unpacked zmud (tracing until the oep dump with lordpe and fixing imports with imprec) dows run to :/, but if i put it on trial (when the elicense thinks it is in trial both programs runs well. how can my unpacked program check elicense? what must i nop? this is why i ask help.

jolopez :)

I am finding it difficult to understand what you are trying to say. :confused:

By your use of "¿?¿" I am assuming you native language is Spanish, if that is so send me a PM in Spanish and I will try and help you. I am not Spanish but was raised in New Mexico and spent some years in Panamá. So Spanish is not a "foreign" language to me :cool:

/hobferret
pinkomat
02-28-2004, 06:08 AM
There are some VERY strange registery entries, though. They used the SysInternals trick of placing a NUL character in the midle of the keyname to prevent things like RegEdit from being able to see the contents of it or search it.

They begin at HKLM\Software\LicCtrl\LicCtrl\LicCtrl. That's as far as you get with standard RegOpenKey and the like.

Yes, that is a problem. Are there any ways to remove that keys from the Registry? .. I played a little bit with permissions but I couldnt delete the key. It seems to be another trick like the one you mentioned above.
Is there a registry editing tool that can handle that kind of RegKeys?

There must be a workaround that one can remove elicence and reinstall ist without formatting the harddisk. Well, I haven't found it yet. :(
Test2000
02-28-2004, 08:48 AM
sgdt what type of registration/OS are you using? I think you maybe using either NT or ME from what you've said as I don't seem to have those options (NtOpenKey) in my regedit. If your using an external programme to access the registry would you mind PMing the URL to me?

Pinkomat I don't think there is a way to get rid of the LicCtrl. I am looking into this to see if it is an invasion upon ones private property. Electronic law is very tricky though especially when your talking about something which doesn't really harm your computer. However it is essentially the owners property and in many ways it can be likend to me letting a sales man into my house to give me a demonstration and then leaving a giant slab of glass in my room. It may not be doing me any harm but it is still annoying and I want to throw it away but the sales man has bolted it to the floor.

I have e-mailed ViaTech but there fantastic response was:

Dear XXXX,

You just delete the file.

Thanks

XXXX

Really helpful huh? Anyway I am now looking on the net to find anything about electronic law and permissions given to software. If I can find anything the next e-mail I send ViaTech will be informing them of court proceedings. If anybody wants to then join those proceedings dependent on whether I can find the legal interpretation of these actions then feel free.
sgdt
02-28-2004, 02:53 PM
I included a zip file that includes source code and executable. It will find these keys, and ask on each one if you want to delete.

The RegEdit program can't do it, as RegEdit uses regular registry calls. What eLicense did was use a trick discovered by SysInternals (I *think* they discovered it, they were the first to publish) where you have a NUL (0x00) character inside your keyname, and then regular programs can't snoop.

Although you could (and SHOULD) follow in the code, what we do to find them is call "NtOpenKey", and use "NtEnumerateKey" to enumerate thru subkeys. We are looking for keys that look "weird" (i.e. they have a 0x00 in them which would freek out regular ring 0 programs). When we find one, we print out the name and values and ask if we should delete the key.

I would run this at least once saying NO to each delete, preferably in a debugger. There are a lot of REALLY interesting values placed there, some of which might be worth looking into.

If you have any questions, feel free to ask.
sgdt
02-28-2004, 03:12 PM
I should probably explain a bit.

void *LoadEntryPoint (HMODULE hModule, char *szFunction)
{
void *pResult_;

if ((pResult_ = GetProcAddress (hModule, szFunction)) == NULL)
{
printf ("Could not find %s entry point.\n", szFunction);
exit (1);
}
return (pResult_);
}

//
// Loads and finds the entry points we need in NTDLL.DLL
//
VOID LocateNTDLLEntryPoints ()
{
HMODULE hLib_;

if ((hLib_ = GetModuleHandle ("ntdll.dll")) != NULL)
{
NtOpenKey = LoadEntryPoint (hLib_, "NtOpenKey");
NtCreateKey = LoadEntryPoint (hLib_, "NtCreateKey");
NtEnumerateValueKey = LoadEntryPoint (hLib_, "NtEnumerateValueKey");
NtEnumerateKey = LoadEntryPoint (hLib_, "NtEnumerateKey");
NtSetValueKey = LoadEntryPoint (hLib_, "NtSetValueKey");
NtQueryValueKey = LoadEntryPoint (hLib_, "NtQueryValueKey");
NtDeleteKey = LoadEntryPoint (hLib_, "NtDeleteKey");
}
else
{
printf("Could not get handle for NTDLL.DLL\n");
exit (1);
}
return;
}

This allows us to use the undocumented registry calls. I emphasize the word undocumented, because they are documented quite well by everyone but Microsoft...

Coding using these functions is a little bit harder than the regular registry functions. There's the obvious mater of UNICODE, but additionally the way names and values is handled may seem a little alien if you've never written any driver code. One might say Life is too easy for the Win32 coders... :)

Please look into hxxp://undocumented.ntinternals.net for more information.

Anyway, here's a little more code from it...

BOOL RecurseKey (PUNICODE_STRING pKeyName, HANDLE hPrior)
{
OBJECT_ATTRIBUTES ObjectAttributes_;
UNICODE_STRING TmpKeyName_;
NTSTATUS ntStatus_;
KEY_NODE_INFORMATION *pknInfo_;
char *szKey_;
HANDLE hKey_;
WCHAR wTmpKey_ [MaxKeySize * 2], wBuffer_ [MaxKeySize * 2];
int ch_;
DWORD dwSize_, dwKeyLen_, dwIndex_, dwChrIdx_;
BOOL Result_;

InitializeObjectAttributes (&ObjectAttributes_, pKeyName, OBJ_CASE_INSENSITIVE, hPrior, NULL);

ntStatus_ = NtOpenKey (&hKey_, KEY_ALL_ACCESS, &ObjectAttributes_);

dwIndex_ = 0;
dwSize_ = (MaxKeySize + 1) * sizeof (WCHAR);
ntStatus_ = NtEnumerateKey (hKey_, dwIndex_, KeyNodeInformation, (char *)wBuffer_, dwSize_, &dwSize_);

while (ntStatus_ == 0)
{
pknInfo_ = (KEY_NODE_INFORMATION *) wBuffer_;
dwKeyLen_ = WideCharToMultiByte (CP_ACP, 0, pknInfo_->Name, pknInfo_->NameLength/sizeof(WCHAR), NULL, 0, NULL, NULL);

szKey_ = (char *) wTmpKey_;
memcpy (szKey_, pKeyName->Buffer, pKeyName->Length);
szKey_ += pKeyName->Length;
*szKey_++ = '\\';
*szKey_++ = 0;
memcpy (szKey_, pknInfo_->Name, pknInfo_->NameLength);

TmpKeyName_.Buffer = wTmpKey_;
TmpKeyName_.Length = pKeyName->Length + 2 + pknInfo_->NameLength;

if (RecurseKey (&TmpKeyName_, NULL) == FALSE)
dwIndex_++;

dwSize_ = (MaxKeySize + 1) * sizeof (WCHAR);
ntStatus_ = NtEnumerateKey (hKey_, dwIndex_, KeyNodeInformation, (char *)wBuffer_, dwSize_, &dwSize_);
}
Result_ = FALSE;

for (dwChrIdx_ = 0; dwChrIdx_ < (pKeyName->Length >> 1); dwChrIdx_++)
{
if (pKeyName->Buffer [dwChrIdx_] == 0)
Result_ = TRUE;
}
if (Result_)
{
// We have a KEY with a NUL imbedded. Print it out.
for (dwChrIdx_ = 0; dwChrIdx_ < (pKeyName->Length >> 1); dwChrIdx_++)
{
if (pKeyName->Buffer [dwChrIdx_] == 0)
printf ("Û");
else
printf ("%c", pKeyName->Buffer [dwChrIdx_]);
}
printf ("\n");
PrintValues (hKey_);

printf ("Kill this key? (y/n) ");

ch_ = getchar ();

while (ch_ != 'y' && ch_ != 'n')
ch_ = getchar ();

if (ch_ == 'y')
NtDeleteKey (hKey_);
else
Result_ = FALSE;
}
return (Result_);
}

int main (int arg_cn, char *arg_pa [])
{
UNICODE_STRING KeyName_;
PWCHAR pwKeyName_;

LocateNTDLLEntryPoints ();

pwKeyName_ = L"\\Registry\\Machine\\SOFTWARE\\LicCtrl";

KeyName_.Buffer = pwKeyName_;
KeyName_.Length = wcslen (pwKeyName_) * sizeof(WCHAR);

RecurseKey (&KeyName_, NULL);

return (0);
}

Ran from a command prompt, it will display the 0x00 characters as a solid block for easy identification.

You can modify main() to call from a different root key if you like.

\Registry\Machine\SOFTWARE\LibCtrl

is the equiv of Win32's

HKEY_LOCAL_MACHINE\Software\LibCtrl

Hope this helps...
SlantNGo
03-01-2004, 05:09 PM
Jeez what do I have to do to get eLicense off my system? Ran the eLicense uninstaller, deleted all the files Test mentioned if any were left over, deleted ViaTech and TPF registry entries, zapped hidden LicCtrl entries, then deleted the remaining LicCtrl entries, reboot, start TPF, and still says Trial Expired?!?
pinkomat
03-02-2004, 03:50 AM
Jeez what do I have to do to get eLicense off my system? Ran the eLicense uninstaller, deleted all the files Test mentioned if any were left over, deleted ViaTech and TPF registry entries, zapped hidden LicCtrl entries, then deleted the remaining LicCtrl entries, reboot, start TPF, and still says Trial Expired?!?

Yes! :D
Test2000
03-02-2004, 07:50 AM
As Pinkomat said it will most likely still be trial expired. I believe this is due to the system clock check that it runs and dumps in memory before you can kill it. If you try changing this check or the values of it the entire programme freaks and crashes out.
hobferret
03-03-2004, 03:10 PM
Good afternoon all :)

I have just been trying to get rid of all this elicense crap from my PC :confused:

After purging the registry and the known files, I found these 4 remaining in the \Windows folder:-
ELMENV.EXE - ALSO REFERRED TO IN STARTUP
ELMGUI.DLL
ELMHX.DLL
ELMLCMM.DLL

There may be more elsewhere but I have not found any :mad:

Just wanna get rid of the rubbish and I made a decision that I ain't gonna install any more elecense rubbish on my PC!!!!!!

/hobferret
sgdt
03-03-2004, 03:58 PM
RegShot not only allows you to take s snapshot of the registry before and after installing and running a target application, it also allows you to take a snapshot of a directory so you can see which files were added.

I wouldn't say "I ain't gonna install any more elicense rubbish on my PC!!!!!!". The reason is simple, if by using mass qty of nasty tricks and inconviences is all they have to do to keep their software protected, they will do even more of it. The "average" computer user doesn't know what those files are, and probably assume they are there because some thoughtful company put them there. (The "average" computer user seems to think everything is written by Microsoft).

Using tools like RegShot take quite a bit of the mystery out of what a target is doing to your poor computer. Using these tools will force the protectors to come up with different (and maybe more entertaining) methods to annoy us, hopefully methods that won't fill up our hard disks...
hobferret
03-03-2004, 04:39 PM
RegShot not only allows you to take s snapshot of the registry before and after installing and running a target application, it also allows you to take a snapshot of a directory so you can see which files were added.

I wouldn't say "I ain't gonna install any more elicense rubbish on my PC!!!!!!". The reason is simple, if by using mass qty of nasty tricks and inconviences is all they have to do to keep their software protected, they will do even more of it. The "average" computer user doesn't know what those files are, and probably assume they are there because some thoughtful company put them there. (The "average" computer user seems to think everything is written by Microsoft).

Using tools like RegShot take quite a bit of the mystery out of what a target is doing to your poor computer. Using these tools will force the protectors to come up with different (and maybe more entertaining) methods to annoy us, hopefully methods that won't fill up our hard disks...

Hi sgdt :)

Good point, however, I expect most people using this forum are not "average computer users". :D

As for Regshot most people have the utility as it's been around for 2 years or more ;)

Before you reply I ain't getting at you just stating facts :D

/hobferret
jolopez
03-03-2004, 10:51 PM
wop!
i dunoow how but i have reset my trial on zmud.
i were trying to patch the zmapi instead of do this in the zmud because the read of addres 14 error or something like this and i have reset the trial how? i dont know :<
sgdt
03-03-2004, 11:30 PM
Look on the positive side!

I mean, if it takes TOO long to crack, eventually the times got to wrap, right? :rolleyes:

I'm patient... (/me whips out calculator to determine exact year of wrap).

OK, I'm back. Waiting isn't a good idea.

Did I ever mention there is this company that stores there registration info as numbers in the registry, and by resetting them to strings EVERY one of their games suddenly became REGISTERED? Yup, they have a silly bug where if they can open the key, it sets goodguy, and then they reset it after they read it and determine it is bogus. Only thing is, they hurl on strings leaving goodguy set to true... :)

My point is bugs are usually exploitable. It would be very interesting to know HOW to exploit THIS bug.

OK, no more booze for me...

hmmm....
Test2000
03-05-2004, 08:44 AM
Hobferret,

I think those files must have come from the ZMud programme or possibly the TTT one. I can't find them within my system though and the only one I have not installed which you have is ZMud so those must have something to do with the way that is protected.

I also believe there is already a ZMud dumped exe of 7.01 on some newsgroups. It could be a useful thing to look at to see how they've patched the .exe and what are the key differences between this and the original .exe.

Furthermore as e-license users server checking tricks I am not to sure whether or the standard way around server calls would be a way to kill the programme. I believe there is some problem with this due to the RC5 encryption key being used which they may now have scrapped to start using there own version. Either that or they are using a modified eliptical curve cryptography.
jolopez
03-05-2004, 11:48 AM
Hobferret,

I also believe there is already a ZMud dumped exe of 7.01 on some newsgroups. It could be a useful thing to look at to see how they've patched the .exe and what are the key differences between this and the original .exe.

the crack is only the undump of the program (i think) this the same i have made with my hands and the help of the forum
this dasent run it ahs some tricks inside. this crack only works when you are in trial mode when it gets out the dumpprogram too.
zmud has anotehr module that ne frien has say it is vtprotect :/
i think that with patch this and making it t make always the same will do, but no, it does some tricks inside because the program reads from another memory and crashes out.
thx people ;->
hobferret
03-05-2004, 05:12 PM
Hobferret,

I think those files must have come from the ZMud programme or possibly the TTT one. I can't find them within my system though and the only one I have not installed which you have is ZMud so those must have something to do with the way that is protected.

I also believe there is already a ZMud dumped exe of 7.01 on some newsgroups. It could be a useful thing to look at to see how they've patched the .exe and what are the key differences between this and the original .exe.

Furthermore as e-license users server checking tricks I am not to sure whether or the standard way around server calls would be a way to kill the programme. I believe there is some problem with this due to the RC5 encryption key being used which they may now have scrapped to start using there own version. Either that or they are using a modified eliptical curve cryptography.

Hi again Test2000 :)

Quite possibly they have come from Zmud but I was also playing around with one of their ebooks, same idea of protection, so you can easily open an ebook and print the thing :D

But like I said B4 I ain't gonna bother anymore with their bulls**t, just cleared the whole bloody mess out :cool:

Also to Jolopez, I will reply to your recent email but I dunno where you live I guess in Spain by your email address but your Spanish is as bad as your English - quote from yr email "fue un amigo kien ablo con el i komo dice ke" I assume that should read "fue un amigo quien hablo con el y como dice que" - ¿si o no?

/hobferret
jolopez
03-05-2004, 09:59 PM
Hi again Test2000 :)

Also to Jolopez, I will reply to your recent email but I dunno where you live I guess in Spain by your email address but your Spanish is as bad as your English - quote from yr email "fue un amigo kien ablo con el i komo dice ke" I assume that should read "fue un amigo quien hablo con el y como dice que" - ¿si o no?

/hobferret
i agree with you.
Es mi asquerosa forma de hablar considerada vaga y fea. hablo mal, me explico peor. pero bueno espero que esto no influya en mis conocimientos. siento haber heridos algunos sentimientos linguistas, pero es que suelo pasar de esas cosas y saltarmelas a la torera(a lo bruto a lo bestia).
Asi que perdon e intentare hablar mejor.
Ah y por cierto..
I live in Basque Country in Spain yes. ;->
hobferret
03-06-2004, 06:57 AM
i agree with you.
Es mi asquerosa forma de hablar considerada vaga y fea. hablo mal, me explico peor. pero bueno espero que esto no influya en mis conocimientos. siento haber heridos algunos sentimientos linguistas, pero es que suelo pasar de esas cosas y saltarmelas a la torera(a lo bruto a lo bestia).
Asi que perdon e intentare hablar mejor.
Ah y por cierto..
I live in Basque Country in Spain yes. ;->

Hi jolopez :)

For those who do not understand what he says it is:-

My disgusting form of speaking is considered vague and ugly. I speak badly, I explain myself worse. but I hope this doesn't influence my knowledge.

So pardon me and I will try to speak better.
Ah and by the way..
I live in Basque Country in Spain :cool:

Your knowledge is obviously good else you would not have gotten as far as you have ;)

I have removed all elicense softs from my PC but when I was messing with your Version 7.03 it was not necessary to patch any of the dll's, however, when it connected with a site it crashed and I really don't have the time to play around with it any more. You are right when you say it works fine while it's still in the TRIAL period, even the patched version :D

Regards

/hobferret
Test2000
03-13-2004, 09:23 PM
Well after having a nice long rest and trying a few other things I decided to have a look at e-license again. I am still kind of surprised that no-one from the reversing scene has really done anything on the unpacking side or the tutorial side of this programme. Its fast gaining on the top spot of being the packer that is hard to defeat especially with these new problems I am hearing people are having with the new Zmud. That could be down to not much interest in it though so end of rant here.

Anyway I'd tried a few trial programmes fairly easy most of them were using the old system that allowed the trial dump.exe to work fine (this is a problem in the new Zmud as mentioned earlier). After that I went back to the expired programme I had. Was having multiple problems either with the byte sequence or strange jumps. Having not being able to go down the reverser route I went down a more avaliable programme and after much trial and error it worked fine. I kind of hit the Hobferret attitude then and no longer wanted any e-license crap on my system so deleted it all.

Today though I found some old files stored namely the temp files and the e-license.dll all of which I had stored in a folder called Elicreverse. I'd unfortunately forgotten about that folder when deleting. Cutting the story short I basically unpacked the .dll and the .temp file. If anyone is still interested in playing with e-license I'd go this route first as more experienced reversers might find a few of the calls that are made by these unpacked files interesting (especially the temp file) and maybe able to patch the .dll without even having to go down the whole route of dumping and fixing the dumped IAT etc which I believe is causing trouble for a lot of people with trying to dump the new Zmud.

To summarise this thread in its current state and the state of the e-license protection scheme:

Unpackers: None

Tutorials: None as such

General Guide: This Thread

Tools Guide: For trial version you can most likely do it with any debugger and simple IAT rebuilder. For Hobferrets expired version guide it is recommended to use TRW2000 or SoftIce, using OllyDbg can be rather tedious especially when tracing. You may also be able to use another programme out there but you may need either a VMWare or a friend within the reversing circle.

Reading Guide: BEFORE you even attempt looking at e-license I would recommend reading up on manual unpacking, IAT rebuilding, dumping in Ollydbg and general newbie reading altogether. Most people when getting stuck with e-license seem to be newbies and reading this material will aid those who are more experienced to be able to give you better advice that you understand.

Well thats me out if anyone wants the .dll or the .temp versions unpacked feel free to PM me I've kept them on my computer for reference only, though please note I will ask you to explain to me why exactly you couldn't unpack it yourself as it is not very hard. Oh and "I couldn't be bothered" doesn't qualify.

T2000
hobferret
03-14-2004, 05:16 AM
Hi Test2000 :)

Just as a point you can quite easily get into the temp file using Olydebug if you set a breakpoint on USER32.dll (view names) DestroyWindow :D

After a few RET's you are right in there and if I remember correctly just another 1 or 2 and you hit that byte sequence following the call :cool:

From then on it's much the same as TRW & SICE, although I must admit I found it easier with the latter. Quite likely coz I am a relative newcomer to Olly :o

However, Test2000 suggested in the past that we get together and write a tut based on all debuggers mentioned above. Maybe we should go ahead even if I have to reinstall their CRAP once more!

BTW you could always set a restore point prior to install, then go back and reinstall again. If I am right you dont lose all your data when you do that - only the executables :D

/hobferret
SlantNGo
03-14-2004, 02:46 PM
I think that's a great idea, to have a tutorial for eLicense 4.0 since it seems to be such a mess... I've been really busy lately, and with exams coming up, I put attempting to unpack TPF on hold until probably mid-April or so.

Test, you said you unpacked the elicen40.dll and the temp file, and got the program working w/o touching the EXE? Isn't the temp file generated and named randomly each time?
hobferret
03-14-2004, 04:57 PM
I think that's a great idea, to have a tutorial for eLicense 4.0 since it seems to be such a mess... I've been really busy lately, and with exams coming up, I put attempting to unpack TPF on hold until probably mid-April or so.

Test, you said you unpacked the elicen40.dll and the temp file, and got the program working w/o touching the EXE? Isn't the temp file generated and named randomly each time?

SlantNGo :)

Don't bother putting TPF off, if you have not expired you can do the whole lot including rebuilding the IAT in <10mins - the IAT is a piece of cake coz it's written in VB :D

You must have already read that the EIP remains constant :D

/hobferret
SlantNGo
03-14-2004, 07:27 PM
Unfortunately, it's expired. The trial period for that was 3 days, and I didn't even try to unpack it until it was on the last day already. I followed your steps for the expired trial, found the byte sequence, at the end I get a "Password expired" error. Didn't quite understand what you meant by tracing the jumps... did you mean step into the jump and going line by line? That I don't have time for at this point unfortunately. If you can show me any shortcuts that I can get it done in <10 mins with, I'd greatly appreciate it!
Test2000
03-15-2004, 12:03 PM
Hobferret,

Don't know how much use I would be in terms of tutorials you seem to be more experienced than me anyway :D. I'll put here what I know in terms of how to destroy the protection using OllyDbg when the trial is active. I'll set it out like a tutorial so if you want you can use it and if not you don't have to (note I am going off the top of my head from what I remember here so apologies if it is a little hazy in parts, segments of code is obviously not included):

E-License Tutorial

By

Test2000

-------------------------------------------------------------------------

Tools Required

OllyDbg 1.09+
ImpRec, ReVirgin or knowledge of manual IAT rebuilding
OllyDump or LordPE

--------------------------------------------------------------------------

What This Tutorial Does

Not much really I am still learning myself but as someone once said to me "We are all really learning in this world". This will only show you the basic steps to unpack E-License 4.0 protection trial versions using OllyDbg. It will not show you how to rebuild the IAT step by step nor will it show you how to use OllyDbg step by step. There are other better guides out there for this purpose and it is suggested you read these materials before you try to unpack this protection. This guide should only be used for research purposes it is the users own choice what he/she use the purposes for and I can't be held responsible in anyway.
-------------------------------------------------------------------------

(1) Open up your .exe file with OllyDbg.

(2) Select the main executable file of your programme and place a hardware breakpoint on it (right click > Breakpoint > Hardware on execution)

(3) Click Trial on the pop up window.

(4) You should now have jumped back to OllyDbg dump the data using either OllyDump or LordPE

(5) Now rebuild the IAT either using ReVirigin, ImpRec or by hand (quite a few of the E-Licenses I played with required by hand rebuilding). As stated earlier I can't teach you IAT rebuilding each .exe that I have played with which has been protected requires having the IAT rebuilt differently. It is Your job to read about IAT rebuilding it is not a hard subject but does require time effort and patience if you don't have any of these your best bet is to hope that ImpRec or ReVirgin can rebuild for you correctly. E-License can be a real pain As a slight tip if you do run into trouble look at where the cyb import is before trial and then see what happens after you hit trial to see which addresses have imports. Furthermore I believe there is a plugin designed for either ImpRec or ReVirgin of an older version of the e-license protection that solves some of the tracing problems.

On another note some more recently released versions (as of March 2004) are using some new features of the e-license SDK. This has resulted in a remarkably high increase in terms of files that are having problems with the IAT rebuilding. Even when the IAT seems to be correct the programme still seems to drop out and no-one can work out why at this moment.

--------------------------------------------------------------------------

As for the trial expired version with OllyDbg I constantly had a problem with this. Its interesting what you said earlier Hobferret about going into the User32 module and setting a breakpoint on WinDestroy. I think I chatted with a friend on MSN about this and did do something similar. I believe I copied out the problem I was having in that convo it was something to do with finding the actual point of reference to the .temp I'll check later to see if I saved it as I think I did because the convo was largely to do with a work related project.

SlantNGo I may be able to help you with TPF. I've tried out a programme that was mentioned earlier in this thread on an expired programme and it seemed to work out okay. I deleted TPF as it was around this point I got hacked off with e-license plus I'd tried it on a friends computer already and although I liked it I wasn't going to load it up again to discover it may not work with this programme. I digress if you live in a similar time zone to me I might be able to help. So post which country you live in and if its a not to distant one from mine then I'll PM you with the details.

Finally in terms of e-license tutorials I was actually mistaken. There is one from two years ago that does appear on this very board. It was done in SICE I believe and written by +Spl/\j who I think may still be on this board but am not sure. Hobferret I think +Spl/\j might be a good source of reference for the unpacker if you ever wanted to go down that route again. He seems to have some exprience in writing that type of stuff but to be honest from what you've said you seem to be of the same mind set as me when it comes to e-license (never want to touch it again unless I have to).
SlantNGo
03-15-2004, 03:25 PM
Hey Test,

I'm in Canada, Eastern Standard Time. Good job on the tut! Even if I can get this working now, I'll probably give the trial another shot whenever I decide to re-ghost my machine... seems much easier to do when the trial is still active. As for e-License tutorials, the only one I found was for eLicense 2.4, and that one required using PEDump, which doesn't work with 4.0.
hobferret
03-16-2004, 08:31 AM
Hi again :)

Like Test2000 I ain't gonna reinstall this pile of junk again, thanks for reminding me mate! :cool:

Using Test's quote "This guide should only be used for research purposes it is the users own choice what he/she use the purposes for and I can't be held responsible in anyway".

Somewhere on this board I posted the stuff about the byte sequence, and what to do if it's expired. You need to find that in TRW and SICE purely because it makes it easier. Like I said before if you use Oly break on DestroyWindow and a few RET's later you will be there, the instruction following the call!

You must JUMP at the instruction CMP DWORD PTR [EBP+FFFFF0E0] so you get to the unpacker. Again it is most important to trace thru this temp file because you will get error messages. If you get a MSGBOX saying whatever you must keep notes of how you got there in the first place. i.e.if you arrived from a jump then don't jump the next time, conversely if you got it by not taking a jump then next time make the jump. I can't say any more than that coz like Test it's a bit fuzzy now, you just have to have patience or else you will fail.

If I remember correctly sometimes you get a registration screen pop up, if you get that just click on Start Over assuming that box appears in all versions, I really don't know!

To be perfectly honest I have not found a program yet protected by this mess that has been of any use, anyways most times I usually delete the progs I have cracked coz if it's any good then buy the bloody thing!

BTW Test I don't agree with you when you say I am more experienced than you, remember I had to ask you about Ollyscripts coz Olly is NEW to me! Pls send me what you mentioned about them I would appreciate it coz I really ain't got my head properly round it yet!

Sorry I gotta edit this - it wasn't Test and Olly but R@dier :o

/hobferret
BrazilianGuy
03-16-2004, 02:38 PM
Hi guys,
I'm newba in Reserve Engineering. Yesterday i download <deleted> I obtain the license for trial.
So, after this, i find your forum. What i do for "crack" the TPB ? please, help me point-to-point and with the download links (if necessary).

thanks guys
:)
hobferret
03-16-2004, 04:27 PM
Hi guys,
I'm newba in Reserve Engineering. Yesterday i download <deleted again> I obtain the license for trial.
So, after this, i find your forum. What i do for "crack" the TPB ? please, help me point-to-point and with the download links (if necessary).

thanks guys
:)

Hi don't wanna flame you but read this thread and serach the site for more clues, there is enough here to get you sorted out :)

/hobferret
dELTA
03-16-2004, 06:31 PM
And while you're at it, read the FAQ... *sigh*
BrazilianGuy
03-17-2004, 11:32 AM
Thanks guys.. I will see the thread.. but ONLY one question: do i the same thing for the trial version than for expired trial version ?
hobferret
03-18-2004, 07:32 AM
Thanks guys.. I will see the thread.. but ONLY one question: do i the same thing for the trial version than for expired trial version ?

Hmmmm.....

One question CAN YOU READ :)

/hobferret
jolopez
03-19-2004, 08:53 PM
a solution from dakkor from damn.to to reset the trial in elicenses
this a .bat i have made
@echo off
zaphidden.exe
net stop "licctrl service"
attrib -s -r -h c:\windows\system32\mmf.sys
del c:\windows\system32\mmf.sys
pause

have a nice day
SlantNGo
03-19-2004, 09:16 PM
Genius!!! I totally forgot about mmf.sys
I guess we found everything except that file... Great work man! I just reset my trial, and now looking to unpack the EXE.
Test2000
03-19-2004, 09:39 PM
Apparently ViaTechs e-license isn't as secure as they actually think it is lol. I just got done talking to someone on the net about this (we were discussing various things) apparently the main holes within the license are:

(1) You can reset your trial over and over and over and over (I was about to post a message about mmf.sys but jolopez beat me to it).

(2) The proxy has numerous holes and if someone updates a couple of things then such programmes as the DAMN server could be customised to work forever.

(3) The way that the programme is munged means you can dump the file easily with some little reversing knowledge (both expired and trial versions).

(4) Apparently there is some interesting information in lcmmfu.cpl this file apparently controls the main part of the e-license control. Manipulation of this could allow you a registered version even when you don't essentially have one (note don't ask me about this as I don't know though I do have an unpacked .cpl file this is something I missed off my list).

Also to jolopez would you mind uploading the .bat file. The reason for this is that I believe it would really be the only actual tool out there for e-license even though it isn't necessarily a definite tool as such. There is nothing else plus it would save me some time of going over notes etc if I ever come back to this protection (doubtful but you never know) :D.

Just click "Manage Attachments" in additional options before you post. If you don't want to upload it to the board for fear of ViaTech or someone watching or whatever PM me and I'll give you my e-mail so you can send it there and I'll upload it.

Good work by the way with your detective skills (Oh and thanks to DAMN's Ivanapulo I think Ivan is Dakkor but might be wrong?).
jolopez
03-19-2004, 09:47 PM
o i didn t mind anithing about elicense and thx for all in the forum specially to hobferret and dakkor in damn.to
in the file there are the .bat and zaphidden.exe
not tested in 98 but yes on 2000 and xp
hobferret
03-20-2004, 05:52 AM
Hi jolopez

Glad to hear you got there in the end!!

Like I said before you are obviously good else you would not have gotten as far as you have!

/hobferret

recuerde el laza de luto en España
BrazilianGuy
03-20-2004, 06:56 AM
Guys,
i have one problem with this .bat :
when i execute this appear this messages:
Could not get handle ntdll.dll

Error 2185 (the message is in portugue but i try to put this in english): The service name is invalid. Verify if is specify a service name valid and, try again.

File doesn't exist - c:\windows\system32\mmf.sys
File doesn't exist
Press any key to continue
jolopez
03-20-2004, 08:09 AM
well, if it is in portuguese, the name of the service can change so you must go to control panel and in services search for the licctrl service or something like this, you must stop this. you can see the services started with
net start
the services will be show.
after you stop the service you can change mmf.sys.
and i dont try this in 98 or NT 4, so be sure that you are in 2000 or XP. i will try the bat in windows some day ;->

to hobferret, it is Lazo negro

===
// \\
|| ||
\\ //
\\//
/\
//\\
// \\
BrazilianGuy
03-20-2004, 10:56 AM
well, if it is in portuguese, the name of the service can change so you must go to control panel and in services search for the licctrl service or something like this, you must stop this. you can see the services started with
net start
the services will be show.
after you stop the service you can change mmf.sys.
and i dont try this in 98 or NT 4, so be sure that you are in 2000 or XP. i will try the bat in windows some day ;->

to hobferret, it is Lazo negro

===
// \\
|| ||
\\ //
\\//
/\
//\\
// \\

JOLopez,
try to help me ;)
but my win is win98 and unhappy, i don't have mmf.sys :(
Kayaker
03-20-2004, 01:52 PM
JOLopez,
try to help me ;)
but my win is win98 and unhappy, i don't have mmf.sys :(

I think you need to help yourself at this point, have you even tried filemon to see what alternate file it may be using?

You've gotten plenty of help already and your first post in this thread was a crack request, which clearly shows you never even *read* the earlier posts warning against exactly this, or even worse chose to ignore them.

You seem more interested in getting this cracked than in studying how the protection works, which has already been discussed in great detail in this thread, so forget it, that's not what we're here for nor what we encourage at all.

C'mon, let's raise the bar a little bit? (maybe a lottle bit?)

Kayaker
BrazilianGuy
03-20-2004, 02:02 PM
I think you need to help yourself at this point, have you even tried filemon to see what alternate file it may be using?

You've gotten plenty of help already and your first post in this thread was essentially a crack request, which clearly shows you never even *read* the earlier posts warning against exactly this, or even worse chose to ignore them.

You seem more interested in getting this cracked than in studying how the protection works, which has already been discussed in great detail in this thread, so forget it, that's not what we're here for nor what we encourage at all.

C'mon, let's raise the bar a little bit?

Kayaker
Sorry, i say it again. I don't want to do fights. Some guys think that brazilian people is kiddie hackers... Maybe, you think that about me, ya ? I already buy a game in eLicense system. I'm newba in Reverse Engineeering. I only post many posts because i don't find a objective tutorial. I download many programs like SoftIce, ASpack, RegEditX and some more programs in a attempt to learn some thing or do something.

After the read the FAQ and the topic, i know that isn't a crack forum or any things like this.

I will continue to try to know how eLicense system works.

I apologize.

Bye,
Filipe Melo
SlantNGo
03-20-2004, 02:14 PM
I don't think the problem is with mmf.sys, although that is also a problem. If you're on Win98, the NTEnumerateKey, NTOpenKey, etc. API functions that the ZapHidden.exe file are calling more then likely won't work because they exist only in an NT operating system.
Kayaker
03-20-2004, 02:23 PM
Filipe, You don't need to apologize or defend yourself, nor is anyone trying to be newbie-question unfriendly. I'm just trying to set the tone for the types of questions allowed on this forum, and encourage people to think for themselves. This is an ongoing job of the moderators and others that unfortunately seems to require reenforcing every few days or few weeks.

If your interest is learning, then great, best of luck, learn, ask questions when you are truely stuck and contribute your knowledge when you can.

K.
BrazilianGuy
03-20-2004, 02:36 PM
I don't think the problem is with mmf.sys, although that is also a problem. If you're on Win98, the NTEnumerateKey, NTOpenKey, etc. API functions that the ZapHidden.exe file are calling more then likely won't work because they exist only in an NT operating system.

SlantNGo (if you know) do you know any functions/system files/keys like NTEnumerateKey, NTOpenKey or mmf.sys ?
jolopez
03-20-2004, 08:06 PM
well i am in a fucked 98 (all things doesn run, i have to format this) and i cant run regedit.exe so i can see the entrades in the registry, in my windows 98 only i have do is
attrib -s -h c:\windows\system\mmf.sys
del c:\windows\system\mmf.sys
without stopping any thing or run zaphidden.
Before to delete mmf.sys i have delete mmfs.dll booting in dos mode only. i think it isnt necesary.
i have use to view the process in windows the process explorer from sysinternals and when i run zmud it runs the licctrl service with runservice. after i kill zmud the runservice goes to another site. so be sure to kill the runservice before deleting mmf.sys. it is in the system not system32
i am not sure that the reset in win2k needs zaphidden i am going to try now. i need anotehr reboot :<
jolopez
03-21-2004, 09:02 AM
from dakkor:
Test2000 wrote: "Oh and thanks to DAMN's Ivanapulo I think Ivan is Dakkor but might be wrong?"

I don't really want to go through all the hassle of signing up there, but could you just mention that I accept the compliment, but I'm not actually Ivan .
BrazilianGuy
03-21-2004, 10:51 AM
1 problem now:
i haven't mmf.sys. I don't know why (i have some eLicense games installed) but i haven't it.

I search in Search File and Folders and i don't find.
In MS-DOS in folder system, i find with *.sys : ndiswmi.sys - poet95.sys - compbatt.sys - acpi.sys - battc.sys - sisnic.sys - dxapi.sys

So, thanks for try to help us and congratulations for your work!
jolopez
03-21-2004, 11:43 AM
1 problem now:
i haven't mmf.sys. I don't know why (i have some eLicense games installed) but i haven't it.

You have it.
But it is hidden and with system attributes
from console
cd windows\system
attrib -s -h mmf.sys
and delete it
BrazilianGuy
03-21-2004, 12:15 PM
It's me again JOLopez:

When i digit "attrib -s -h mmf.sys" in MS-DOS appear it:

"Compartment Rap reading C:\"
Annul, Repeat or Fail

Again i say: it's in portuguese, i'm trying to translate it for english

A hug for you,
Filipe!
Fahr
04-02-2004, 09:14 AM
Hello people,

I am trying to unpack a similar program - TEW - of the same producers. I followed the tutorial on page 4 of this thread and I indeed break into Olly at some point, but it doesn't look like an entrypoint at all...
I dumped the exe nontheless, it had no icon, but who cares. I fixed the IAT using ImpRec, which said the process was all ok and all that. Then, when I run my dumped exe, it opens a DOS box, does nothing and just terminates.

I don't know WHERE I am going wrong, but any help is appreciated. I tried continuing the run in Olly, but after the hardware break, it gives some exceptions. When I pass them to the program, it says 'program was unable to process exception' and eventually it exits with code 0x80.

What am I missing here?

Thanks,
- Fahr
Fahr
04-02-2004, 09:27 AM
Disregard that last comment - using LordPE to dump it DOES produce a somewhat valid result. At least it now 'runs'.

When I run dumped_.exe, I get the following:
"The application failed to initialize properly (0xc00000ba). Click on OK to terminate the application."

I dumped it on Windows 2000, someone mentioned there's glitches on Win2K... will I have more luck attempting the dump in Win9xME? Or is it something else?

Thanks,
- Fahr
thetakerfan
04-02-2004, 07:13 PM
Fahr, I'm trying to get in to TEW too, but when I try running dumped_.exe I get

"This application has failed to start because .dll was not found. Re-installing the application may fix this problem."

I admit this is the first thing I've ever tried to "crack", so I'm a compelte noob, but if anyone has any hints I'd greatly appreciate it.

I'm on XP Pro, used OllyDbg, LordPE, and ImpRec
hobferret
04-03-2004, 01:52 AM
Fahr, I'm trying to get in to TEW too, but when I try running dumped_.exe I get

"This application has failed to start because .dll was not found. Re-installing the application may fix this problem."

I admit this is the first thing I've ever tried to "crack", so I'm a compelte noob, but if anyone has any hints I'd greatly appreciate it.

I'm on XP Pro, used OllyDbg, LordPE, and ImpRec

Hi thetakerfan :)

Have you tried renaming the dumped_.exe to the name of the original file :confused:

Worth a shot :eek:

/hobferret
Fahr
04-03-2004, 02:49 AM
Fahr, I'm trying to get in to TEW too, but when I try running dumped_.exe I get

"This application has failed to start because .dll was not found. Re-installing the application may fix this problem."

I admit this is the first thing I've ever tried to "crack", so I'm a compelte noob, but if anyone has any hints I'd greatly appreciate it.

I'm on XP Pro, used OllyDbg, LordPE, and ImpRec

Well, then you're having more luck than me - my dumped_.exe just crashes, no normal errors, not 'missing DLLs', no nothing :S
What exactly did you do? You DID use the same tools...

Thanks,
- Fahr
thetakerfan
04-03-2004, 04:27 PM
yes hobferrett, I did try that, but it had teh same error

HOWEVER, I just opened the main exe, and it still says I have 24 hours on my trial, which is what it said late last night, so I clicked Trial and and went straight to the game, no having to reregister.

I have no idea what happened to it, but the folder int he start menu is gone, freaky
Test2000
04-03-2004, 06:22 PM
This is mainly to the two new users asking in this thread. For starters I think you might have just read the guide I posted and are following that. This is not the way to defeat the e-license programme. You need to start reading about it first. It took me nearly three weeks to understand most of the basics and I say basics because thats what they are and I've still not got to grips with everything. The main issue you seem to be having and I know this from experience is that you are either not hitting the OEP (you might be hitting the fake API), your dumping it but have not bothered to rebuild the IAT by hand or even looked at the IAT's in general, your rebuilding it with ImpRec but are forgetting that e-license uses anti-tracing. You may also not have read any documentation on OllyDbg because if your using the latest version your going to hit a snag when trying to set a Hardware breakpoint.

The listed problems above are what I expect is causing the .exe to not work. You can also use the SoftIce method in OllyDbg if you know what your doing so this system can be defeated IF you read up before you attempt it. What your doing is diving into the swimming pool before you've even got the arm bands off.

There are also more ways to get around the protection system than just reversing it but you need to use your heads, work out what your doing and then try again and again and again and again. This protection has been covered in as much detail as it really needs to be in this topic already. The rest is up to you to LEARN and if you can't do that then buy the thing.
Fahr
04-04-2004, 03:59 AM
I already figured the other ways to bypass the protection and built 2 working bypass programs - 1 for NT/2K/XP and 1 for 9x/ME... Unlimited licenses are nice, but I'd still like to get rid of that nag screen and the registration procedure...

On top of that; you made a guide which should at least allow us to DUMP it correctly. I am ready to learn all about manual IAT rebuilding to do the IAT, but what good is it if you basically say the dump made by following your guide is faulty to begin with? No offence intended at all, but could you at least tell us if you YOURSELF were able to unpack this eLicense?

Thanks,
- Fahr
Test2000
04-04-2004, 09:24 PM
I already figured the other ways to bypass the protection and built 2 working bypass programs - 1 for NT/2K/XP and 1 for 9x/ME... Unlimited licenses are nice, but I'd still like to get rid of that nag screen and the registration procedure...

On top of that; you made a guide which should at least allow us to DUMP it correctly. I am ready to learn all about manual IAT rebuilding to do the IAT, but what good is it if you basically say the dump made by following your guide is faulty to begin with? No offence intended at all, but could you at least tell us if you YOURSELF were able to unpack this eLicense?

Thanks,
- Fahr

Did you even bother to read this entire thread or just skip to the last god damn page? If you would have read it you would have known that it wasn't a proper tutorial and it also states that it won't teach you IAT building at the start which is a major part of dumping exe's. This isn't the place for someone to hold your hand and go right this is how you do this, this, this and this. Sorry but this forum does not work like that and if you thought that it did your in the wrong place. Read most rough guides like the one I posted by people and they will not tell you how to rebuild IATs because you need to read it and understand it yourself, simple protections allow you to have a working dump straight away most require you to rebuild it so stating that I gave you a guide which doesn't teach you how to rebuild the dump is kind of stupid as most rough guides do this. It didn't used to be like that and there was a lot smarter people than I who would create useful plugins to do most of the work for you. These days its a lot of building by hand if there has not been a nice plugin created for ImpRec or ReVirgin. E-License can sometimes be even tricker because of the way it sometimes disguises the API's, I think its this protection that uses the hidden API routine but quite a few wrappers I've played with do that. Like I said I am going off memory here so please excuse me if I everything I say isn't correct.

In answer to your question of whether I got e-license to unwrap. Yes I did and I did it through a variety of ways. There are multiple options either you can reset the trial and reverse from there, forward the trial to an expired point and reverse from there, patch certain points of the .cpl (I only tried this once as by this point e-license was annoying me), learn some cryptography and delphi and work on something something that I won't mention or direct link to because thats not how things work.

Someone also sent me a PM asking if I would "crack" there e-license programme. If anyone PM's me like that again the only thing I will be sending is the message forwarded to a mod who can ban you for asking for stupid things. This is a place for reversing not for cracking.

Fahr I apologise if I can't be of anymore help than the above but I have no interest in the e-license protection anymore. None of the products they protect really interest me and if I like something that much and its not overtly priced I usually buy it anyway. E-License was just something fun for me to expand my knowledge on a little and I enjoyed learning about the reversing scene again. As it is I've found something new to amuse my time now, its called fatherhood and I recommend it to anyone with a stable job and who doesn't hate kids, though to be fair I once hated kids still do but I can't take my eyes off my son, so reversing is kind of low on my priorities as I am sure you can see.
Kayaker
04-04-2004, 09:52 PM
Someone also sent me a PM asking if I would "crack" there e-license programme. If anyone PM's me like that again the only thing I will be sending is the message forwarded to a mod who can ban you for asking for stupid things. This is a place for reversing not for cracking.

Just say the word ;)
Fahr
04-05-2004, 01:22 AM
Did you even bother to read this entire thread or just skip to the last god damn page? If you would have read it you would have known that it wasn't a proper tutorial and it also states that it won't teach you IAT building at the start which is a major part of dumping exe's.

I DID read the entire thread, don't take me for a noob here. I'm also not concerned about the IAT, I think ImpRec provides valid results (TEW is written in VB, ImpRec generates a complete import table for the VB 6 runtime). I would just like to know if my DUMP is correct before I spend hours trying to rebuild something faulty... that's all.

In answer to your question of whether I got e-license to unwrap. Yes I did and I did it through a variety of ways. There are multiple options either you can reset the trial and reverse from there, forward the trial to an expired point and reverse from there, patch certain points of the .cpl (I only tried this once as by this point e-license was annoying me), learn some cryptography and delphi and work on something something that I won't mention or direct link to because thats not how things work.

I am mainly interested in unpacking it, as it is an area quite new to me. I am not looking to 'crack' this particular program for any reason other than the learning experience.
I do know Delphi, in fact, I am employed as a programmer for Delphi and some other programming languages, so I think I'll manage in that area. I also know a fair share about applied cryptography. If you refer to building a generic unpacker of sorts, I think that's a bit above me, I never managed to reverse a crypto alogrithm, leave alone reversing, dumping and IAT rebuilding in one program...

Fahr I apologise if I can't be of anymore help than the above but I have no interest in the e-license protection anymore. None of the products they protect really interest me and if I like something that much and its not overtly priced I usually buy it anyway. E-License was just something fun for me to expand my knowledge on a little and I enjoyed learning about the reversing scene again. As it is I've found something new to amuse my time now, its called fatherhood and I recommend it to anyone with a stable job and who doesn't hate kids, though to be fair I once hated kids still do but I can't take my eyes off my son, so reversing is kind of low on my priorities as I am sure you can see.

As I said before; I don't want to reverse it because I can't buy it, or because it interests me; I simply want to reverse it because it is possible and I can learn from it.
As for fatherhood; I am married, but I don't think there will be any kids for the coming few years :p
I'd say; enjoy your son and have fun :)

And finally - can anyone please tell me if my dump is correct? Because I don't think it is...
Kayaker
04-05-2004, 02:05 AM
And finally - can anyone please tell me if my dump is correct? Because I don't think it is...

Hi

I have no idea or interest in the details of this thread, but from your earlier quote:

"I dumped the exe nontheless, it had no icon, but who cares?"

I think you should care, this likely indicates your resource section is corrupt/misaligned/incomplete/still packed. A way to avoid this would be to do a RAW dump instead of an "optimized" LordPE or whatever dump that does section realigning.

I have always preferred dumps where raw size=virtual size and raw offset=virtual offset. It makes reconstruction SO much simpler, to the point where you can do much of it semi-manually rather than relying on automagic tools.

Generally, once you fixed up the sizes/offsets and OEP the icon should show if you've got a good workable dump. THEN you can start rebuilding the IAT.

Kayaker
Fahr
04-05-2004, 02:44 AM
Hi

I have no idea or interest in the details of this thread, but from your earlier quote:

"I dumped the exe nontheless, it had no icon, but who cares?"

I think you should care, this likely indicates your resource section is corrupt/misaligned/incomplete/still packed. A way to avoid this would be to do a RAW dump instead of an "optimized" LordPE or whatever dump that does section realigning.

I have always preferred dumps where raw size=virtual size and raw offset=virtual offset. It makes reconstruction SO much simpler, to the point where you can do much of it semi-manually rather than relying on automagic tools.

Generally, once you fixed up the sizes/offsets and OEP the icon should show if you've got a good workable dump. THEN you can start rebuilding the IAT.

Kayaker

In the message after that, I stated that a full dump with LordPE DID produce an icon. The dump that did not produce an icon was done with OllyDump.

My main concern is not the icon, my main concern is dumping the right way on the right spot... I THINK I am on the right spot, but I'm not quite sure... and seeing how I am rather new to this dumping stuff, it would help a lot to know if my dump is in fact valid. I produced more dumps which had a nice icon, but that doesn't seem to be the factor on which to decide its correctness at all...

- Fahr
jolopez
04-05-2004, 06:23 AM
after dump you must fix the dump with imports. i did it with imprec, and it work fine, to do this well, you muts run the original program and get imports and auto trace. i do it normally in 98 because in xp they make somethings extranges.

to test2000 have you register the elicense patching the libraryes?
thx
Fahr
04-05-2004, 06:33 AM
after dump you must fix the dump with imports. i did it with imprec, and it work fine, to do this well, you muts run the original program and get imports and auto trace. i do it normally in 98 because in xp they make somethings extranges.

to test2000 have you register the elicense patching the libraryes?
thx

That sounds interesting, I'm working on 2000 - also an NT... it could be the cause of some problems...
I'll try it on Win98 then and see if I have better results with ImpRec.

What did you use to create the initial dump?

Thanks,
- Fahr
Kayaker
04-05-2004, 12:07 PM
In the message after that, I stated that a full dump with LordPE DID produce an icon.

Hi

Not to split hairs, but sticking with the facts, what you stated was that you were able to produce a 'somewhat valid result', there was no specific mention of the icon, as insignificant as that might sound. All I was trying to get across was that the *non-presence* of an icon after dumping is a detail that shouldn't be ignored, yet still might 'run' to a certain degree.

K.
Fahr
04-05-2004, 12:55 PM
Hi

Not to split hairs, but sticking with the facts, what you stated was that you were able to produce a 'somewhat valid result', there was no specific mention of the icon, as insignificant as that might sound. All I was trying to get across was that the *non-presence* of an icon after dumping is a detail that shouldn't be ignored, yet still might 'run' to a certain degree.

K.

Ok, my bad then. Facts are: I have an exe with an icon, it does not run.
I guess that's it then :p
Kayaker
04-05-2004, 01:05 PM
>I have an exe with an icon, it does not run.

Heheh, well at least it looks good now :p
SlantNGo
04-05-2004, 09:11 PM
For reference, the "Trial Expired" method posted by hobferret is in an older thread, and involves searching for a certain byte sequence (can't remember at the top of my head) in the temp file that is created each time you launch the program. From there, follow hobferret's instructions and slowly trace through jumps and eventually you should be able to unlock the program, although I haven't quite gotten here myself.

I had problems dumping the EXE myself, could never hit the OEP. Haven't touched this for a couple weeks now so my memory is shaky too.
Fahr
04-06-2004, 01:47 AM
For reference, the "Trial Expired" method posted by hobferret is in an older thread, and involves searching for a certain byte sequence (can't remember at the top of my head) in the temp file that is created each time you launch the program. From there, follow hobferret's instructions and slowly trace through jumps and eventually you should be able to unlock the program, although I haven't quite gotten here myself.

I had problems dumping the EXE myself, could never hit the OEP. Haven't touched this for a couple weeks now so my memory is shaky too.

Same problem here - hitting the OEP appears to be troublesome using that hardware breakpoint. But according to the other thread you refer to, Hobferret was able to unpack Elicense 4 using that byte sequence (and apparently SoftICE).

I'll check it out,
- Fahr
SlantNGo
04-06-2004, 10:50 AM
I tried it with a very recent software, the elicen40.dll is still 6/25/2002 though and I found that byte sequence in the temp file. By changing that first EAX, I get a password expired error... see if you can get that far, then if you can, it's just about following that jump and seeing which jump(s) to avoid.
Fahr
04-06-2004, 11:39 AM
I tried it with a very recent software, the elicen40.dll is still 6/25/2002 though and I found that byte sequence in the temp file. By changing that first EAX, I get a password expired error... see if you can get that far, then if you can, it's just about following that jump and seeing which jump(s) to avoid.

But I am not looking to REGISTER it - I am looking to UNPACK it... I'm not sure we're after the same thing here...

- Fahr
SlantNGo
04-06-2004, 11:53 AM
It can be unpacked using this method. From hobferret's other post:

"When at TRY BUY EXIT LICENSE screen open debugger and search for this byte sequence:-
83BDE0F0FFFF02
When found use the second string occurance, i.e. the one after the call.
But set BPX 3 instructions above the CMP.
EAX must equal 1 and the following memory compare must also equal 1.
It will then JMP at the CMP DWORD PTR [EBP+FFFFF0E0] to the unpacker.
If any errors like INVALID PASSWORD occur check these:-
After the JMP above note code location i.e. 02563B75 add 14AB and you should be at a TEST EAX,EAX following a CALL to 026501B - EAX should equal 1 here and JUMP.
Again at 02563B75+1DDD there is another TEST EAX,EAX this also should be EAX=1.
Eventually 4 RET instructions you should arrive back in the elicen40.dll, the EP is just a little way down at 02483CCF FF255CF84902 JMP NEAR[0249F85C].

Actual address may be different but the method will be the same"
Fahr
04-06-2004, 12:02 PM
It can be unpacked using this method. From hobferret's other post:

<--snip-->

Ok, I must have missed that part (or overlooked it), thanks a lot :)

Can I also do this kind of things with OllyDBG? Or do I really need SoftICE? It looks rather SoftICE specific, but I have some bad experiences with installing SoftICE on my system... :S

- Fahr
SlantNGo
04-06-2004, 12:14 PM
Should be able to do it with Olly but I probably know less than you about this. Search for binary string to find that byte sequence, just toggle breakpoint 3 instructions above the second occurence like he says. When it stops there, change EAX to 1, it will then take the jump... from there I haven't had any success.
thetakerfan
04-06-2004, 06:33 PM
I THINK I may have gotten this thing working, but I tried so many things I'm not exactly sure what I did, so if I can figure it out again I'll let you guys know
thetakerfan
04-06-2004, 06:58 PM
ok, I've done it a few times successfully, but this wouldn't work for any other programs I don't think, just the one that Fahr and I were trying to crack.

I don't exactly remember HOW I got to where I did, but the end result works, or atleast it seems like it does. I havne't tested to see if it crashes after awhile, but here's what I did, and it's in Olly.

1) Open the CPU window for the elicen40.dll, and right click, search for binary string, and enter:
FF25 5CF84902
You should be at: JMP DWORD PTR DS:[XXXXX]; TEW.<ModuleEntryPoint>
Set a breakpoint here, and click the trial button.

2) Once the program pauses, go to LordPE, right click on tew.exe, and do a full dump

3) Open the normal TEW.exe, Go to ImpRec, and click "get imports", then fix dump, and select dumped.exe

4) Back in LordPE, click Rebuild PE, and select dumped_.exe

5) Open dumped_.exe, it should go straight to the game now.
SlantNGo
04-06-2004, 07:08 PM
So you didn't have to manually rebuilt the IAT? I just tried this for TPF (same company product) and the program crashes when I run the dumped EXE so I think it needs to be rebuilt by hand. Keep testing yours and let me know if you get any crashes... I'd be very surprised if your EXE ends up fully stable, I'd think that if it works on TEW it should work on TPF/TPB/etc. as well...
thetakerfan
04-06-2004, 07:32 PM
I just DLed the latest patch for TEW, and tried to do it following the same steps, but it doesn't work anymore, so it's back to the drawing board
SlantNGo
04-06-2004, 07:42 PM
Well, first of all, I don't think you're hitting the OEP, and after you do, then you'll need to re-build the import table by hand I believe. Not back to the drawing board, just keep at it... I'll give it a try this weekend, in the middle of final exams right now.
Fahr
04-07-2004, 04:09 AM
ok, I've done it a few times successfully, but this wouldn't work for any other programs I don't think, just the one that Fahr and I were trying to crack.

I don't exactly remember HOW I got to where I did, but the end result works, or atleast it seems like it does. I havne't tested to see if it crashes after awhile, but here's what I did, and it's in Olly.

1) Open the CPU window for the elicen40.dll, and right click, search for binary string, and enter:
FF25 5CF84902
You should be at: JMP DWORD PTR DS:[XXXXX]; TEW.<ModuleEntryPoint>
Set a breakpoint here, and click the trial button.

2) Once the program pauses, go to LordPE, right click on tew.exe, and do a full dump

3) Open the normal TEW.exe, Go to ImpRec, and click "get imports", then fix dump, and select dumped.exe

4) Back in LordPE, click Rebuild PE, and select dumped_.exe

5) Open dumped_.exe, it should go straight to the game now.

I still have an unpatched version of TEW, tried exactly this and it doesn't run - NULL pointer exception...
Which OS were you on when you tried this? Some people said it's kind of impossible to dump it on NT/2K/XP. I'm on 2K.

- Fahr
kiesel_lunaris
04-07-2004, 01:41 PM
o i didn t mind anithing about elicense and thx for all in the forum specially to hobferret and dakkor in damn.to
in the file there are the .bat and zaphidden.exe
not tested in 98 but yes on 2000 and xp

I'm confused about jolopez' post. I've never unpacked anything in my entire life, but I'm just tryin to figure out how to bypass the ELicense password requirement thingy for zMUD :p . Post a reply if you know how to do this.

P.S. I'm just using this so I can use zMUD for playing Dragonstone (http://www.dragonstone.org). :p
thetakerfan
04-07-2004, 02:04 PM
Fahr, I had the first patch installed when I got it to work, and I'm on XP
Fahr
04-07-2004, 03:29 PM
Fahr, I had the first patch installed when I got it to work, and I'm on XP

Odd... but either way; with this 4th patch it doesn't seem to work anymore... or without it, for that matter.

I'll install Win98 some day and try it there, some people suggested that it's easier, since some NT-specific 'tricks' don't apply there.

Keep posting your progress! For now, you're the only one with valid results :p

- Fahr
thetakerfan
04-07-2004, 03:39 PM
well school is wniding down for me, last couple weeks, so I probably won't have much time to mess around with it for now.

Better off anyway since there's a new "patch" for this stupid game every couple days anyway.
Fahr
04-08-2004, 01:17 AM
well school is wniding down for me, last couple weeks, so I probably won't have much time to mess around with it for now.

Better off anyway since there's a new "patch" for this stupid game every couple days anyway.

Once we figured out a way to unpack eLicense 4, we can do it every few days, why not :p

- Fahr
hobferret
04-08-2004, 04:42 AM
I'm confused about jolopez' post. I've never unpacked anything in my entire life, but I'm just tryin to figure out how to bypass the ELicense password requirement thingy for zMUD :p . Post a reply if you know how to do this.

P.S. I'm just using this so I can use zMUD for playing Dragonstone (http://www.dragonstone.org). :p

Hey kiesel_lunaris :rolleyes:

Have you read the FAQS, you will get no help here unless you make some sort of effort yourself and DONT ASK FOR SOMEONE TO DO THE WORK FOR YOU :D

/hobferret
Night_wolf2040
04-09-2004, 04:14 AM
hi im new here but i just found out that if you just turn back the system clock before playing TEW you can use the trail version forever so to speak sorry if its a little off topic but its just a loop hole in this particular e-liecense or maybe the program itself I hope it works on everyone elses copy too
Fahr
04-09-2004, 04:17 AM
hi im new here but i just found out that if you just turn back the system clock before playing TEW you can use the trail version forever so to speak sorry if its a little off topic but its just a loop hole in this particular e-liecense or maybe the program itself I hope it works on everyone elses copy too

Doesn't work always, but methods to completely reset the trial have been posted here. PM me if you want the prog for Win9x/ME (ZapHidden doesn't work on 9x/ME)

- Fahr
Cariv
04-19-2004, 04:16 PM
Thanks very much to Jolopez, his file was a great help to me, and I'm sure a lot of others. I have no idea how he did it, cause I'm sort of an idiot when it comes to this stuff, but I recognize a good job when it works for me. :D

-Cariv Ermack.
witphg
03-29-2005, 10:41 PM
Огромное спасибо jolopez за триал рестартер для zmud7.05a !!!
Всем привет из России!!!

EDIT Kayaker:
Or as worldlingo.com would say,

Enormous thanks jolopez for trial of restarter for zmud7.05a!!!
To all regards from Russia!!!


Who was Teshp?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Who was Teshp?
PDA

View Full Version : Who was Teshp?

qweasdzxc
11-18-2003, 10:49 PM
About 2 days after I registered on this forum I got an email from teshp,

In this email teshp quoted a message from woodman, and said that he (teshp) would be gone from here for good.

I just stumbled upon this

http://tsehp.cjb.net/

I assume it's a redirect, but it goes to microsoft.com

Who was teshp? and why would he email me?
Kayaker
11-18-2003, 11:53 PM
Tsehp was a previous landlord of this place, yes the board's old address does redirect to MS. You joined in Mar '03 which is when Tsehp left, so he may have received a registration notice with your email addy on it, which he deigned to reply to at the time.

Kayaker
cRk
11-19-2003, 12:11 AM
Tsehp isn't the one who wrote Revirgin ?
qweasdzxc
11-19-2003, 12:12 AM
OK, I always wondered about that email. Then I saw his name in the URL; Plus the redirect to microsoft. I got curious again. Thanks kayaker.
disavowed
11-19-2003, 12:18 AM
Tsehp isn't the one who wrote Revirgin ?

yes, it's the same guy
cRk
11-19-2003, 12:20 AM
maybe no revirgin updates will be done i guess... he left the scene? :(


"Writing Your Own Packer"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > "Writing Your Own Packer"
PDA

View Full Version : "Writing Your Own Packer"

disavowed
11-19-2003, 01:36 AM
haven't had a chance to read this yet, but looks like it will be a good read:
http://www.anticrack.de/modules.php?op=modload&name=News&file=article&sid=4402
theCaller
11-19-2003, 08:21 AM
haven't had a chance to read this yet, but looks like it will be a good read:
http://www.anticrack.de/modules.php?op=modload&name=News&file=article&sid=4402

cool man, thanx :)


Print without the symbol loader
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Print without the symbol loader
PDA

View Full Version : Print without the symbol loader

thalos
11-20-2003, 02:43 PM
lol

I want to print without using the symbol loader and without the print screen key .

I want to print without breaking my debugging cession .Print the history file and after tracing immediatly and write my comments on the paper .

I have try the prn command but nothing happened .What is the utility of this command ?

I do this
1/ cls 2/U adresses L FF 3/wish to print the text unassembly 4/Trace F8 F10
5/And recommence to print if I need something

Have somebody the solution ? Thanks
naides
11-20-2003, 09:12 PM
May be this tutorial can give you some inspiration:

http://www.anticrack.de/modules.php?op=modload&name=News&file=article&sid=1865

It allows you to get the trace history dissasembly in printable form.

The backtrace buffer Disassembler that Kayaker posted 12/18 months ago is another alternative.
Kayaker
11-20-2003, 11:15 PM
May be this tutorial can give you some inspiration:

http://www.anticrack.de/modules.php?op=modload&name=News&file=article&sid=1865

It allows you to get the trace history dissasembly in printable form.

The backtrace buffer Disassembler that Kayaker posted 12/18 months ago is another alternative.

Heheh, we'll be sending you your well deserved advertising royalties cheque soon Naides :-)

Re the PrintScreen, I'm not sure if I ever got that to work myself (or tried too hard), maybe it only works with certain keyboards/luck. The other option might be to - maximize the SI code window by toggling off the data/register windows (wd, wr), Unassemble the code you want, then /SCREENDUMP (Icedump) or !DUMPSCREEN (IceExt) to a text file. Now you still want to access that from your harddrive without breaking from SI, but you can always suspend execution by inserting the bytes EBFE at the current eip
(or typing in the command window:
a eip
jmp eip

Now you should be able to open the screendump text file, print it if you want, then CTRL-D back to SI and replace the EBFE bytes you changed and resume execution. A bit of a pain, but...

If no one minds a slight sidetrack.. this is sort of within the realms of what the old Tracedump can still do in Win2k (maybe XP), and I'm wondering if there might be any interest in this capability. There are so many good RE tools around now it seems with disassembler functions built in and such, and there are always other ways of doing the same thing. I don't really use 'tools' per se other than my own or Softice/IDA, that I don't really know if this might be unique enough to be useful to anyone else.

The Win9x app whos memory Naides kindly keeps alive is Tracedump, meant to work interactively with the Softice Backtrace command, written with the help of Clandestiny. I still use it in Win2K (without the vxd and backtrace feature) as a loader/disassembler/cum dumper. What it *can* still do is much as I described above - you can suspend execution at any time (from SI) with the 'jmp eip' trick and *disassemble* any section of user/kernel code into a listview for closer analysis/ jump/call tracing / import listing / saving to text.

A side benefit to this is that you can halt encryption/decryption sequences and get a printout of the code as it exists before it might be overwritten later. Unfortunately, the full deobfuscation of SMC code that the *Backtrace* feature of SI provided in Win9x is of course missing in Win2K without the funky BPR command.

So what I'm trying to say is - is there another app/trick capable of
- tracing in SI as usual
- suspending execution at any time (jmp eip), and then
- having a disassembler dll/listview/save function available to disassemble, in context, user or system code?
- then return to SI and continue execution, repeat as required

Note that once an app is loaded, a button click will break SI in the dll (I1HERE ON required), which is also in the context of the app itself so new breakpoints/memory changes etc. will always be made in the correct context. I also use it to dump memory for PE rebuilding, but IceExt or LordPE could be used for that, my implementation is pretty basic at the moment.

Again, there's nothing particularly remarkable about Tracedump without the old Backtrace feature, other than you can jump from ring0 -> ring3 and disassemble live code in a suspended state. Does this sound useful at all? If there doesn't *seem* to be a similar feature around, I might press on and work with the code again. If not, I'll go back to playing UnReal... :p

Regards,
Kayaker
Aimless
11-21-2003, 12:17 AM
Recommended not possible.

Unless:

1. You have a printer attached on LPT1:
2. You have good knowledge of writing VXDs
3. You have good knowledge of internals of ICE.

I always use the SoftICE loader to print.

Or am I missing something....?

Have Phun
naides
11-21-2003, 12:57 AM
TraceDump, I suck as an Advertiser if I can't even remember the Catchy Name of the Product!!!

In Win98 this tool can save quite a bit of live tracing, if one gets the hang of it.

Two comments questions for Thalos:

Why don't you want to use the Symbol Loader, and need to do this while Sice window is still up?

While Sice has control, the computer has rather limited capabilities for printing, formatting, saving files, etc, it has the feel of an old DOS machine. No multitasking.

Perhaps,( I have not tried this, just read about it ), if you have two computers in a network and use Visual SoftIce, Compuware claims that the Client in the debugger computer runs in GUI, full Windows environment, with all the bells, lights, whistles that we became spoiled about using. The program you are tracing will be in the server, on a different machine. At least is worth taking a look.
thalos
11-21-2003, 04:49 PM
Trace dump is a good tool .Thanks to Kayaker and Clandestiny .
This tool does what I want by suspending execution ;return and continue execution but between Trace dump can’t print his dump .
I hope this a constructive suggestion for this tool .(if I can help … translate this tool? At my low level , I ‘m not coder)

To answer to Aimless and Naides .

What I do most of the time
1/bpx hmemcpy
1.1/F12 bd hmemcpy
2/Search the kernel of the call « bad boy »
(easy if it is a messagebox)
2.1/Use « ws » between hmemcpy and the kernel of the call « bad boy »
2.2/Print the way , a kind of « call flow » (I have read the link Naides thanks) with the symbol loader of course .I try to print only the code wich has been traced .Here I waste time to cut the text
3/be hmemcpy + F12
4/begin to trace as soon as I see a kind of push ; push push containing my name false code and a call
4.1/I Enter in this call (a bpr is more quick to reach this kind of call ) ; put a bpx on this call bd this call
4.2/Print this call until I reach his ret by using the Symbol loader .I try to do something properly ; that why I don’t like screenn Dump a lot of lines will miss
5/be the call
Most of the time I will enter in a second , a third …. Call , I will print each to understand what my paramameters will become .(a call to uppercase , a call to calculate the lenght of false serial , a call to calculate the lenght of my name , a call to encrypt the false serial , a call where the comparaison is really do , a call to verif y)
Waste , waste , waste some time to cut the text , to print instead of to analyse and understand .
If the code is short to analyse I will find the solution in the second case Thalos = KO ….

Comments :

Printing and writting my comments is really a problem for me morever I don’t like dissasembler like windasm or IDA .Why ? Because in dead listing if I do a mistake in my analyse I see nothing(but I can print and comment) with Softice if I do mistake I see it because Softice is a better calculator than me .(but I can’t print and comment argggh !!!!!)
Finaly I become totaly stupid especially when I heard any crackers who say that they crack in few minutes .
Kayaker
11-21-2003, 06:48 PM
Hi Thalos,

I'm glad you found Tracedump of some use, the hardest part was trying to make its operation and interface somewhat understandable. The underlying problem was that I don't think many people really used the normal Backtrace feature of SI much, mostly because it was a pain to analyze in the SI window.

This of course was the concept behind our app - to be able to output a hard copy of the backtrace buffer disassembly, but I always joked to Clandestiny that it was a monster that kept growing, as we played with new ideas and added features. It was simply a pet project we used to learn ASM coding, and neither of us mind any comments, constructive or otherwise.

Re the printing, uh, no, I never added that because I figured saving to a text file/binary dump was good enough? That part works OK for you? OK, so I didn't mention you need Notepad as well.. ;-)

By 'translate' the tool did you mean to add some feature like the printing, or in the language sense? I would think the source code is available to anyone who wants it, I've always been a fan of open source and if someone can learn something from it I think that would be great. Except for this app I've always provided source, because I've always appreciated it when other people do the same, that's how we learn.

The main reason I didn't release the source originally was out of respect for Iczelion (I reversed and made use of his Iczdump loader code but I knew he himself wasn't releasing it from a request someone once made to him), and for Tsehp who helped me with the NASM disassembler C code, also used in Revirgin, and asked that I not release it. I credited both of them and more than admire their work. (Thx to SV also - I reversed *his* reversal of Iczdump too ;)

Except for Clandestiny's vxd code, little of the huge amount of code is particulary innovative mind you, and most of the basic ideas can be gleaned from the Win32asm forum or a bit of reversing. The most interesting part was the discoveries made in the dark codewoods of Softice, but it helps to be a bit crazy to go in there ;-)

Cheers,
Kayaker
thalos
11-22-2003, 08:29 AM
By translate I mean tranlate in another language sense .I haven't the level to add the printing function .

I think I need 4 years to really understand the cracking +
2 years to begin to do any ASM programms inside Softice .
Bye


can't load softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > can't load softice
PDA

View Full Version : can't load softice

onehin
11-21-2003, 11:23 AM
i have installed softice and changed the autoexec.bat...
but when i boot the computer, it says

"invalid VxD dynamic link call to device numer 17, service 8.
Your windows configuration is invalid.
Run the windows setup program again to correct this problem.

Press any key to continue..."

Then my computer hang up...

any solutions to this problem ?
naides
11-21-2003, 11:44 AM
i have installed softice and changed the autoexec.bat...
but when i boot the computer, it says

"invalid VxD dynamic link call to device numer 17, service 8.
Your windows configuration is invalid.
Run the windows setup program again to correct this problem.

Press any key to continue..."

Then my computer hang up...

any solutions to this problem ?

What is your Operating System?
Which version of Sice are you installing?

VxD based Sice is geared for Win9x and WinME

WinNT, Win2K and win XP use a driver (.sys) based format, and require a specific, NTIce version of Sice.
onehin
11-22-2003, 12:07 AM
i'm using windows 98..
and i installed softice 4.0 ....

wat its mean by number 17 and service 8?

i have tried to reinstall softice, but the problem still the same..
any solution?
naides
11-22-2003, 08:21 AM
i'm using windows 98..
and i installed softice 4.0 ....

wat its mean by number 17 and service 8?

i have tried to reinstall softice, but the problem still the same..
any solution?

Device Number 17 and Service 8 Have a unique meaning to your computer, BUT
under this context, this is likely to be related to your Video Card, perhaps your mouse.
Try
- uninstalling and reinstalling Sice and pay attention to the video drive installation, choose 'universal' drive if you did not do it before.

-Try installing Sice without mouse.

-Get Sice Version 4.05 for Win9x, and see if it is more compatible with your computer. Certain video cards just don't fly.


Art Of Disassembly
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Art Of Disassembly
PDA

View Full Version : Art Of Disassembly

CuTedEvil
11-21-2003, 11:59 AM
Hi all,

Check this, it might be interesting: hxxp://aod.anticrack.de
It would be gr8 to share you opinions here. :)

CuTedEvil
volodya
11-21-2003, 01:22 PM
I realise I might be banned after this, but I really don't care in this case. With all posible respect to the site and the forum (it is simply brilliant!) I have to say that you, CuTedEvil, is noone but A THIEF!
You so called book is nothing more but just "preprocessed" The Svin's essays and explanations. You took his sources, his ideas and NEVER even said trivial "thanks" to him! So, ANY russian-speaking person WILL NEVER THINK IT IS YOUR BOOK. The best possible option will be to think about you as the editor, NOT the author.
volodya
11-21-2003, 04:23 PM
Well, just another few cents of criticism. I didn't check the parts you've stolen from The Svin's code - they should be OK, but it is obvious you know nothing about PE structure and verification. Let me be more concrete.

Quote:
If you remember well AddressOfEntryPoint member is located at the Optional
Header. Which is actually the RVA of the Entry Point.

Once again, wrong, my friend. You should practice more. Learn StarForce protection. EP contains VA! At least you should mention it as a special case.

Quote:

Actually, the import table is an array of IMAGE_IMPORT_DESCRIPTOR
structures, each of these structures has information about a DLL that the PE is
importing symbols from."

The statement is totally wrong. An array of IMAGE_IMPORT_DESCRIPTORs should be called Import DIRECTORY. Import table is nothing but IMAGE_THUNK_DATA!

Quote:

What should we do
to get a list of all the imports in a specific PE ?
Basically what we should is:
• Go to the the first IMAGE_IMPORT_DESCRIPTOR structure

Excellent logic! This technique is a little bit old, actually! What are you going to do if there are NO IMAGE_IMPORT_DESCRIPTORs structures and file is still valid, ah? What about IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT? Have you ever heard of LdrpWalkImportDescriptor inside ntdll.dll?

The rest is more or less OK. And I know why. You were using Iczelion's tutorials. But at least you said thanks to him. Not to The Svin.
So, my dear lamer, bye for now.
Bengaly
11-21-2003, 05:16 PM
The Svin's lessons are free to read from, and no, AOD's sources or text was not taken from svin's but inspired from probably.
so volodya My friend you are wrong here.

i'v read all TheSvin's essays btw ;) i liked them.
CuTedEvil
11-21-2003, 06:23 PM
@vladimir : I do not really care about your critisim. About what you said about (The Svin) I don't deny they are gr8 tutorials and I learned from them.

Not mentionning the sources I took from was a mistake (The e-book was supposed to be published after 15 chapters, the last one would contain all the (Thanks Fly To ...) but for lack of time, we deleted the last chapter)

About being a lamer or theif, I'd rather not to comment. I'm better than that :cool:

About your second post, you're trying to look smart, showing some knowledge. but again, I really do not care. maybe that will make u sad, but, sorry, I just do not care. :cool:

Have a nice time.
CuTedEvil
cuPegasus
11-21-2003, 07:51 PM
hmmm.....

RVA + ImageBase = VA .....

We take a HexEditor, open a PE-file, jump to OptionalHeader.AddressOfEntryPoint (which we know is a DWORD), and see: 1000h.
Now we jump to OptionalHeader.ImageBase (again a DWORD) and see: 400000h. If the theory rocks, the result will be 401000h as VA.

But we don't trust it. Better take a prof. dissassembler (like PEExplorer 1.94)which is able to proove this... Oops, our VA is correct...

Conclusion: "Once again, wrong, my friend... vladimir"

"Import table is nothing but IMAGE_THUNK_DATA!"
I don't know how your PE files look like, but mine have IAT and ImportTable. Please don't misunderstand me, but: where is IMAGE_THUNK_DATA??

... and finaly the last one: did you know what "Basically what we should is:" means? In this causal connection "basically" means "the normal way".
"Normaly, you open your car with a key! And if you don't find it, you smash the window..."

"Only who is innocent is able to throw the first stone"...
esther
11-21-2003, 09:24 PM
Hi,

I do agree with volodya writing greetings and thanks is not hard anyway.It is a a respect to previous authors.I think any one can do it . ;)

>Not mentionning the sources I took from was a mistake (The e-book was supposed to be published after 15 chapters, the last one would contain all the (Thanks Fly To ...) but for lack of time, we deleted the last chapter)

You have time to post something here and don't have time to write greetings(thanks to..)?

I remember your nick... Sandman's+Lazarus projects :)

sidenote:I think I make a mistake :( its evilteach not cuteevil my apology :O

Regards
CuTedEvil
11-22-2003, 07:12 AM
You have time to post something here and don't have time to write greetings(thanks to..)?

hxxp://board.anticrack.de/viewtopic.php?p=18925#18925

Hope this is OK.

CuTedEvil
volodya
11-22-2003, 12:34 PM
Much better, cuteDevil, much better. Sorry, but I also don't care if you don't care. It is not my problem. Now to the knowledge. Once again.

cuPegasus
Conclusion: "Once again, wrong, my friend... vladimir"

you were listening to me inattentively, my friend. I mentioned SPECIAL CASE. Obviously, EP will contain RVA in 98% of cases, but you never took a look on StarForce protection. Code section is NOT present in the PE file ON DISK, but takes some virtual memory! Therefore, EP MUST be VA.
Conclusion: "Once again, wrong, my friend... cuPegasus" :D

I don't know how your PE files look like, but mine have IAT and ImportTable

cuPegasus, if I am a teacher, I will NOT give you 10 :p
Once again, CAREFULLY read PE spec:
1) The array of IMAGE_IMPORT_DESCRIPTORS is IMPORT DIRECTORY!
2) IAT and import table are the SAME words! The both refer to IMAGE_THUNK_DATA. The are TWO IMAGE_THUNK_DATA's in the PE. ANY pe, except the one produced with watcom compiler. One IMAGE_THUNK_DATA is being patched at run time with the ntdll.dll - windows loader so it is called FirstThunk. The another one is left intact - so it is called import lookup table (import name table).
For more on the subject - please, read PE spec, see some diagrams in my article and read Osterlund's article about ntdll.dll.
Links are:

hxxp://www.wasm.ru/article.php?article=packlast01
my article - it is in Russian, sorry, but you'll be able to carefully study the diagrams at least!

"Windows 2000 Loader: What Happens Inside Windows 2000: Solving the Mysteries of the Loader" - Russell Osterlund - http://www.smidgeonsoft.com

PE Spec is available on my wasm site or on MSDN.

Normaly, you open your car with a key! And if you don't find it, you smash the window...
are you a native language speaker?
cuPegasus
11-22-2003, 02:26 PM
"IAT and ImportTable are the SAME words"
... so we have been very stupid while developing the PE-Fileformat...
... or did the Import section contain both? IAT in the beginning, followed by ImportTable? ...

But perhaps there is a difference between ImportAddressTable and ImportTable. Otherwise there is no need - if your words are correct - to enter BOTH into DataDirectory's of OptionalHeader :D

You think you are a PE hero? Ok, fine. So this question must be simple for you:
A default PE file (lets assume a dialog application created with asm) contains NO IAT AND ImportTable (creation is very simple using stack during startup). Both entrys in OptionalHeader.DataDirectory's are Zero, it's size is Zero too. Which named OS is able to run this application: Win9X, Win2K, WinXP? AND WHY? What did you have to do to run this application on all OS?

If you can't answer this questions (which explains also the difference between IAT and ImportTable), YOU'LL better read the tutors...

... your article is written russian, so i don't read it.
volodya
11-22-2003, 05:23 PM
You think you are a PE hero?

Hm, cuPegasus. There are many MUCH more difficult things than this one. :D

A default PE file (lets assume a dialog application created with asm) contains NO IAT AND ImportTable (creation is very simple using stack during startup). Both entrys in OptionalHeader.DataDirectory's are Zero, it's size is Zero too. Which named OS is able to run this application: Win9X, Win2K, WinXP? AND WHY?

1. I don't know such OS as Win 9x :D
2. Win 2k/Win XP/Win 2003.

Hopefully you know that PE file is checked TWO times. 1 one is when the OS creates the context of the process, i.e. the region of the virtual adresses. For Win2k the function is called MiVerifyImageHeader. The pseudocode is here:

NTSTATUS MiVerifyImageHeader(PIMAGE_NT_HEADERS pPE, ...)
{
DWORD FileAlign;

if(pPE->Signature != IMAGE_NT_SIGNATURE)
{
if(pPE->Signature != IMAGE_OS2_SIGNATURE)
return STATUS_INVALID_IMAGE_PROTECT; //0C0000130h
else
{
/*...code for NE-checking...*/
if (NE is invalid)
return STATUS_INVALID_IMAGE_WIN_16; //0C0000131
}
}
if (!pPE->FileHeader.Machine)
{
if(!pPE->FileHeader.SizeOfOptionalHeader)
return STATUS_INVALID_IMAGE_PROTECT;
}
//IMAGE_FILE_EXECUTABLE_IMAGE
if (!(pPE->FileHeader.Characteristics & 2))
return STATUS_INVALID_IMAGE_FORMAT; //0C000007Bh
if(!(pPE & 3))
return STATUS_INVALID_IMAGE_FORMAT;
if (pPE->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR32_MAGIC)
return STATUS_INVALID_IMAGE_FORMAT;
FileAlign = pPE->OptionalHeader.FileAlignment;
if (!(FileAlign & 0x1FF))
{
if(FileAlign != pPE->OptionalHeader.SectionAlignment)
return STATUS_INVALID_IMAGE_FORMAT;
}
if (!FileAlign)
return STATUS_INVALID_IMAGE_FORMAT;
if (!(FileAlign & (FileAlign-1)))
return STATUS_INVALID_IMAGE_FORMAT;
if (pPE->OptionalHeader.SectionAlignment < FileAlign)
return STATUS_INVALID_IMAGE_FORMAT;
if (pPE->OptionalHeader.SizeOfImage > 0x77000000)
return STATUS_INVALID_IMAGE_FORMAT;
return
(pPE->FileHeader.NumberOfSections > 0x60) ?
(STATUS_INVALID_IMAGE_FORMAT):(0);
}

There are several more check in hyperspace... But I omit them for now :D

This was the FIRST time. Second time the PE is checked with ntdll.dll. There are several tricks here. At first, it is OS specific and Win2k WON'T LOAD the file without Bound imports and imports directory. If bound imports are present, no need in imports directory and loader safely ignores it. bound imports directory is outside of the PE file sections, it is located in pseudosection. If no bound imports are present and there is NO import directory - the file won't be loaded. For the XP situation is a little bit softer. I don't have this OS installed, so I cannot check it ;) But several people were telling me it is POSSIBLE to run such file under this OS.

Does this suticfy you, cuPegasus? :D
cuPegasus
11-23-2003, 05:18 AM
- The application is able to run on W9X and WinXP.
- It is not executable on W2K.
->(OptionalHeader.DataDirectory 1,11,12)

If you want to modify portable executable files which are able to run on all OS, you have to overlay the checking routines of W9X,W2K,WinXP... The file format is always the same, only the routines differs.

It was an interesting conversation. :D

cu,
Pegasus
Jon
11-24-2003, 08:03 AM
Can any of you guys please show me or send me where can i get TheSvin's essays?
volodya
11-24-2003, 09:43 AM
I'm glad TheSvin becomes popular.
First of all, TheSvin is in mine group. Our site is wasm.ru. Go there. Go to the tools section and download all his educational programs and one article. Later on there will be more. Then go to asm community board - forum.
esther
11-24-2003, 10:27 AM
* TheSvin is in mine group.
Go there. Go to the tools section and download all his educational programs and one article. Later on there will be more. Then go to asm community board - forum.

Well I'm not glad when its all russian as some ppl has mention.Pls don't adverstise your group here we aren't interested
volodya
11-24-2003, 10:34 AM
I'm not going to advertise anything. I don't care!
The guy asked for info, I gave it to him. That's it and that's all. Do not put your personal offences here - we aren't interested :D
esther
11-24-2003, 10:40 AM
*Do not put your personal offences here - we aren't interested :D

If you aren't interested you shouldn't post the reply at the first place !!! :rolleyes:
Bengaly
11-24-2003, 01:10 PM
here is my formated version of TheSvin's opcode essays 'book'
it can be found on the asm forum (TheSvin's approval for those who really wanna give the finger :D)
probably there are new essays, so they are not included.
i can't remember what was the last chapter in his essays, around 8-11 prolly.
volodya
11-24-2003, 01:18 PM
I remember TheSvin was looking for it. Will you inform him about it or should I do it?
Bengaly
11-24-2003, 05:13 PM
I remember TheSvin was looking for it. Will you inform him about it or should I do it?

the attachment above is still at the win32 asm forum..
quick search for 'opcode book' will probably reveal it.
you can inform him if you wish to...
JMI
11-26-2003, 01:59 PM
It would appear that volodya and CuTedEvil have now kissed and made up because a copy of this effort has been posted by volodya on the wasm.ru site.
:D I love a happy ending. :p It happens so rarely in real life. ;)

Regards.


Compuware SoftICE 4.3.0 Lite Edition
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Compuware SoftICE 4.3.0 Lite Edition
PDA

View Full Version : Compuware SoftICE 4.3.0 Lite Edition

Ricardo Narvaja
11-22-2003, 08:56 AM
I download this Compuware SoftICE 4.3.0 Lite Edition, is the new and has only softice and no other things, and install, reboot and works well, only one thing for me this package hasn't and is a worry.

Dont have the wldr.exe for work with 16 bits files, i have downloaded the Compuware.SoftICE.Driver.Suite.3.0.1.StinkyD complete but i not wish install all the package, there are a form to extract the wldr.exe and other files if are necesary to work with 16 bits aplications?

Ricardo Narvaja
naides
11-22-2003, 09:32 AM
I download this Compuware SoftICE 4.3.0 Lite Edition, is the new and has only softice and no other things, and install, reboot and works well, only one thing for me this package hasn't and is a worry.

Dont have the wldr.exe for work with 16 bits files, i have downloaded the Compuware.SoftICE.Driver.Suite.3.0.1.StinkyD complete but i not wish install all the package, there are a form to extract the wldr.exe and other files if are necesary to work with 16 bits aplications?

Ricardo Narvaja
Those files are compressed inside the Huge file data.cab
WinRAR and other compression utils can read *.cab format and extract those files for you. But I am not sure if this was your question.
Ricardo Narvaja
11-22-2003, 10:53 AM
yes i try this but the files are type .ex_ , etcfor this reason i stop the process when i look this, i try again and see the complete files .

Ricardo

Those files are compressed inside the Huge file data.cab
WinRAR and other compression utils can read *.cab format and extract those files for you. But I am not sure if this was your question.
Ricardo Narvaja
11-22-2003, 11:30 AM
And all files are in the cab thanks only i need is the list of the files and the name and ubication of the carpet with the wldr.exe,
for extract the files needed to function properly, you have a list of a files of the carpet for softice in 16 bits i don't know if are many files, or few.

Sorry for my bad english

Ricardo

yes i try this but the files are type .ex_ , etcfor this reason i stop the process when i look this, i try again and see the complete files .

Ricardo
naides
11-22-2003, 12:40 PM
And all files are in the cab thanks only i need is the list of the files and the name and ubication of the carpet with the wldr.exe,
for extract the files needed to function properly, you have a list of a files of the carpet for softice in 16 bits i don't know if are many files, or few.

Sorry for my bad english

Ricardo

PM in spanish if you need

Is this what you are looking for?

Directory of D:\Program Files\Compuware\DriverStudio\SoftICE\Util16

11/22/2003 12:32 PM <DIR> .
11/22/2003 12:32 PM <DIR> ..
06/20/2002 11:49 AM 156,160 DBG2MAP.EXE
06/20/2002 11:49 AM 18,909 DLDR.EXE
06/20/2002 11:49 AM 1,763 DLOG.EXE
06/20/2002 11:49 AM 4,972 MSYM.EXE
06/20/2002 11:49 AM 16,529 Serial.exe
06/20/2002 11:49 AM 4,111 Util16.txt
06/20/2002 11:49 AM 116,272 WLDR.EXE
06/20/2002 11:49 AM 12,409 WLDR.HLP
9 File(s) 331,125 bytes
2 Dir(s) 58,501,451,776 bytes free
Ricardo Narvaja
11-22-2003, 12:54 PM
yes thanks.

Ricardo

PM in spanish if you need

Is this what you are looking for?

Directory of D:\Program Files\Compuware\DriverStudio\SoftICE\Util16

11/22/2003 12:32 PM <DIR> .
11/22/2003 12:32 PM <DIR> ..
06/20/2002 11:49 AM 156,160 DBG2MAP.EXE
06/20/2002 11:49 AM 18,909 DLDR.EXE
06/20/2002 11:49 AM 1,763 DLOG.EXE
06/20/2002 11:49 AM 4,972 MSYM.EXE
06/20/2002 11:49 AM 16,529 Serial.exe
06/20/2002 11:49 AM 4,111 Util16.txt
06/20/2002 11:49 AM 116,272 WLDR.EXE
06/20/2002 11:49 AM 12,409 WLDR.HLP
9 File(s) 331,125 bytes
2 Dir(s) 58,501,451,776 bytes free
Ray
12-17-2003, 07:50 AM
just a quick question,

i have installed softice driversuite 3 on my winxp and it turns out thats it does not get detected by the progs :) does this happens to you as well??

Also, have you checked visual softice !?!?!
naides
12-17-2003, 09:13 AM
just a quick question,

i have installed softice driversuite 3 on my winxp and it turns out thats it does not get detected by the progs :) does this happens to you as well??

Also, have you checked visual softice !?!?!

The answers are no and no, but could you expand a little on the not detected part? Which apps was iceExt used before and was it ineffective etc.
Ray
12-17-2003, 10:02 AM
Gladly,

IceExt was not used at all !

Well, after installing driversuite 3, i started softice you know, played a bit with it, etc. Then i fired the docs, which in turn opened Acrobat reader 5 !
Funny, it worked! I remembered that my Softice 4 was detected by this app!
I run a few other programs that have some anti-ice, and none of them detected my debugger.

And no, i have not done any hex editing;

weird, i will check better when i get some free time :)

if you have any comments, please post.
evlncrn8
12-17-2003, 03:23 PM
softice 3 basically automatically defeats the meltice trick, however softice 3 is also kinda crap as it cant do global breakpoints (only process sensitive ones)
dELTA
12-17-2003, 09:26 PM
What are the most common situations in which you need process-global breakponts?

(I'm sure there are some, I just can't think of any really good ones right now, so it would be interesting to hear)
JMI
12-17-2003, 10:36 PM
War is the only one I can think of at the moment. You always need to have "process-global breakpoints" in the event of war, or wasn't that what you were talking about? :D

Regards,
evlncrn8
12-17-2003, 11:02 PM
i use global breakpoints all the time, expecially for such things like safedisc, where the opcode handler and stuff is handled in a completely different process, to me its important, so i dont use sice3
Rummy
12-28-2003, 10:53 PM
What are the most common situations in which you need process-global breakponts?

(I'm sure there are some, I just can't think of any really good ones right now, so it would be interesting to hear)
If you're playing around with CreateProcess, CreateProcessAsUser or CreateRemoteThread and you know those new threads of execution are going to call something it really sucks to try and set a BP on a process that doesn't even exist yet!

How about network data? Often one process will recv() the data and another will process it. You ask yourself "Where did that data come from? Who wrote it there?" With global BPM you could just let 'er rip and see who was writing the data. If you don't know ahead of time which process is writing it, it takes HOURS to figure it out.

Using older versions of SICE there were a few times when I wanted to restrict a BP to a particular process or thread. It wasn't easy to do despite the old CSIP that never seemed to work right. But in just a couple of months I've cursed the lack of global breakpoints many more times than I ever did the inability to restrict them. It's a major pain in the a55 to not have global breakpoints.

All in all version 3 is an inferior product IMO.


give some advice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > give some advice
PDA

View Full Version : give some advice

cooper
11-22-2003, 09:48 AM
Hi!
I need some experienced guys to correct me or give some advice.
Its all about unpacking files packed with FSG 1.33
as a target I took this crackme coded in Asm http://biw.rult.at/crackmes/magic.zip?PHPSESSID=97b76669a143df580a19484e66e8737c
so i first i packed it with FSG 1.33
open packed file with Ollydbg and stop at 459F1F
here I sipmly scrolled down and found cond jump above at 00459FC1
je 00401000 it is OEP for sure

so 1st querstion is there a better way 2 find this jump
then scrolling down and looking for it?

breakpoint at this line and run program until jump is taken
then step into and at this moment full dump eith LordPe
change dump EP to RVA 1000
next fixing Import - I used ImportREC
change OEP 2 1000 =>IAT AutoSearch=>Get Imports
It found all functions with No problems
I dont like creating new section so unchecked this option
looking at dump with Lordpe Import Table at RVA 00059FE5
but its almost the end of file - not enough space for import

i decided to change RVA of Import table to 00002280(where I found empty space)
and size to 23C

now the import is fixed!
But..
is there smth I ve done wrong or lets say smth that could b done better?
Btw what is the better way to make size of dump less?
What bout making dump cleaner and neater - like it was bfore packing?
Thank You.
Liquid
11-27-2003, 05:13 AM
Btw what is the better way to make size of dump less?
What bout making dump cleaner and neater - like it was bfore packing?

I wrote an unpacker for FSG some time ago, and for me it still works fine, just need to change one jump by myself, coz i was too lazy to remove one version checking. This little tool i made is loading target into memory and using my own 'unpacking' routine on it. I wrote code to full rebuilt of imports using those FSG's tables, and It rebuilts resources too. I was trying to 'guess' where the original imports were before packing, but it didnt worked everytime. If youre interested, i can show you source for it so you can few, maybe usefull for you ideas...
cooper
11-27-2003, 09:25 AM
yeah
sure you are welcome
Liquid
11-29-2003, 01:21 PM
hxxp://crks.sytes.net/~liquid/fsgunpacker/unpacker.rar

To decompile files packed with new versions of fsg remove line 201/202:
cmp dword ptr [eax], 0000000AE8h
jnz _return_1

Any comments would be nice.


am back :D
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > am back :D
PDA

View Full Version : am back :D

pasha
11-23-2003, 03:33 PM
greetz all

phew, finally i was reconstructed and am back now :). dunno what happened to me for 3 months. i dont remember, guess i locked myself in my room or something like that. anyways, back to work now. so thought would msg you guyz out there. missed a lot of nice threads, time to read them all :D

best regards
pasha
bart
11-23-2003, 04:57 PM
greetz all

phew, finally i was reconstructed and am back now :). dunno what happened to ...
pasha

are you one of these vodka competition contestants? ;)
Woodmann
11-23-2003, 08:42 PM
BWAHAHAHAHAHAHAHAA.....

I read that vodka story in the paper this morn.

In case no one wants to look into the story, the guy
who won this vodka drinking contest in russia, he managed to
consume a litre and a half in 40 minutes.
He won the contest then died from alcohol poisoning :eek:

Woodmann
nofurs
11-25-2003, 10:38 AM
heard that song? I started a joke? ;)


microsoft drm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > microsoft drm
PDA

View Full Version : microsoft drm

disavowed
11-24-2003, 12:20 AM
granted, this is two years old, but i just saw it for the first time today:
http://nanocrew.net/software/FreeMe/
mike
11-26-2003, 11:14 PM
I deleted the responses because they didn't mention crypto, just whether MS would care about the link on this board.
I'll restore them if anyone cares.


Programs In Xp With Ntvdm.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Programs In Xp With Ntvdm.exe
PDA

View Full Version : Programs In Xp With Ntvdm.exe

Ricardo Narvaja
11-24-2003, 04:26 AM
I see various new programs, this use a loader EXE of 32 bits and CreateProcess of 16 bits for work only with virtual machine of NT.
If you can run this program of 16 bits in a DOS BOX don't RUN and don't work with turbo debugger and any DOS DEBUGGER.
If you dissasemble de 16 bits file with IDA, you look very easy the part to patch, but you need some values provided for a debugger in this point.
How i can work with this type of files, if i enter in softice and type
ADDR ntvdm.exe, the point for work is not clear for me, how i see in IDA.

Any work with a file of this type?

Ricardo
doug
11-26-2003, 04:47 PM
This is actually an interesting topic; debugging apps running in ntvdm that is..

There's
hxxp://www.microsoft.com/msj/0199/nerd/nerd0199.aspx

which says:

If the process name is NTVDM.EXE, PrintProcessName will then try to enumerate each 16-bit Windows task by calling VDMEnumTaskWOWEx (located in VDMDBG.DLL).

There's more info in that article, but analysing vdmdbg.dll & ntvdm.exe will probably give you a lot of information. They both export lot of interesting functions.
I suppose your 16-bit code is being interpreted by ntvdm, so I doubt you'll be able to have a nice live-debugging session.

Another article, by Matt Pietrek:
hxxp://www.microsoft.com/msj/0898/hood0898.aspx (also talks about the VDMDBG API)

Let us know if u find more info.
Ricardo Narvaja
11-27-2003, 04:53 AM
Thanks for the info

Ricardo

This is actually an interesting topic; debugging apps running in ntvdm that is..

There's
hxxp://www.microsoft.com/msj/0199/nerd/nerd0199.aspx

which says:

There's more info in that article, but analysing vdmdbg.dll & ntvdm.exe will probably give you a lot of information. They both export lot of interesting functions.
I suppose your 16-bit code is being interpreted by ntvdm, so I doubt you'll be able to have a nice live-debugging session.

Another article, by Matt Pietrek:
hxxp://www.microsoft.com/msj/0898/hood0898.aspx (also talks about the VDMDBG API)

Let us know if u find more info.


anyone have any information on User32InitializeImmEntryTable export from user32.dll ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > anyone have any information on User32InitializeImmEntryTable export from user32.dll ?
PDA

View Full Version : anyone have any information on User32InitializeImmEntryTable export from user32.dll ?

evlncrn8
11-24-2003, 12:00 PM
hi, i came across this export (User32InitializeImmEntryTable) being used in a program i am currently playing with and cant find any information on this export at all, any info appreciated.. thx
Kayaker
11-24-2003, 07:03 PM
Hi

Not a lot it seems, it appears to be used with imm32.dll, which is apparently used to support Asian characters. You can see User32InitializeImmEntryTable is one of the User32 imports required by imm32.dll, along with a bunch of keyboard, char and unicode imports. There is some info around about programming IMM, including the MSDN I think.

The IME (Input Method Editor) is a driver to input double-byte (or unicode) characters specific to the Asian languages.

The system provides the common interface called IMM (Input Method Manager) to control IMEs. It enables applications to give some commands to the IME or get the messages from the IME. IMM APIs are exported by IMM32.DLL in the system folder.
To use IMM APIs, you should #include <imm.h> and link imm32.lib (or load IMM32.DLL dynamically).

So, You've either got a funny app or this has something to do with language support. If you're wondering, Google Groups gave me the imm32.dll lead, Input Method Editor should yield more info, if you care anymore ;-)

Kayaker
evlncrn8
11-25-2003, 02:20 AM
thanks, its an import starforce used and i was curious as to what it does ;)


Icon in taskbar
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Icon in taskbar
PDA

View Full Version : Icon in taskbar

AllzLoZT
11-24-2003, 10:00 PM
Im using a program (I purchased it) that for the most part runs invisibly. However it has an icon in the Notification area of the taskbar. I would like to reverse this so that it runs normally without the icon appearing.

If anyone could point me to a tut or a decent starting point it would be much appreciated.

thanks in advance
Woodmann
11-24-2003, 10:45 PM
Howdy,

Are you sure there is no option to run in hide mode ?
Send me a PM with the link if you still need help.

Woodmann
Kayaker
11-25-2003, 12:00 AM
Hi,

Woodmann may be right, especially if it's *supposed* to run invisibly (saw a keylogger once with a notif. icon!), if not you may be able to find a Shell_NotifyIcon call, which is the usual way of creating those icons.

A quick patch might be as easy as replacing a call similar to

invoke Shell_NotifyIcon, NIM_ADD, ADDR nid
(Adds an icon to the taskbar status area)

to
invoke Shell_NotifyIcon, NIM_DELETE, ADDR nid
(Deletes an icon from the taskbar status area)

You'll have to find out the hex values for NIM_ADD, so you can recognize it as such, and NIM_DELETE. (ADDR nid is a pointer to a NOTIFYICONDATA structure which will have already been initialized).

You might have to mess with it a bit more depending on how and where it's used. If the app cleans up after itself, it *should* use NIM_DELETE on closing (some don't and that's why you get "ghost" icons with some poorly programmed apps).

Kayaker


RVA to file offset in C++??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > RVA to file offset in C++??
PDA

View Full Version : RVA to file offset in C++??

Leeoniya
11-25-2003, 01:07 AM
need help converting RVA to file offset in C++, i am relatively new to c++ so code snippets and explanations would help.

thanx
Leon
Leeoniya
11-25-2003, 03:19 AM
trying to use PElib.dll, except the functions it exports are not __stdcall, as declared in the provided header. looking at the exports in Depends, shows the function name, but not @<# of args>. like you would see in a typical dll. the dll source is all asm, and i dunno how to rebuild it to make it work.

i also read about pushing the stack pointer by tallying up the size of each arg with __cdecl, but i'm not sure how to make that work either.

if anyone can help me rebuild it to useable format, that would be cool.

u can find the dll, header and asm source on

http://win32assembly.online.fr/source1.html

thanks.
cyberheg
11-25-2003, 03:21 AM
Here is some code I wrote a few years ago.
It's a part of a class and some of the variables used in the code are member data of the class.
To use it you will need to do a bit of editing but it should be possible to fix in like 10 min (atleast it would be like that for me :) ).
The code needs windows.h included.

If you don't understand something then either go read a C++ book, msdn or a PE document. After that you can ask for questions :)

Note that the webforum removed all ident so it makes it a little harder to read.

-- CyberHeg

/*----------------------------------------------------------*
*
* RVAToOffset: Convert value from RVA to file offset.
*----------------------------------------------------------*/
DWORD CPE::RVAToOffset(DWORD dwRVA)
{
int i;
WORD wSections;
PIMAGE_SECTION_HEADER pSectionHdr;

/* Map first section */
pSectionHdr = IMAGE_FIRST_SECTION(m_pNtHdr);
wSections = GetNumberOfSections();

for (i = 0; i < wSections; i++)
{
if (pSectionHdr->VirtualAddress <= dwRVA)
if ((pSectionHdr->VirtualAddress + pSectionHdr->Misc.VirtualSize) > dwRVA)
{
dwRVA -= pSectionHdr->VirtualAddress;
dwRVA += pSectionHdr->PointerToRawData;
return (dwRVA);
}
pSectionHdr++;
}
return (-1);
}

/*----------------------------------------------------------*
*
* OffsetToRVA: Convert value from file offset to RVA.
*----------------------------------------------------------*/
DWORD CPE::OffsetToRVA(DWORD dwOffset)
{
int i;
WORD wSections;
PIMAGE_SECTION_HEADER pSectionHdr;

/* Map first section */
pSectionHdr = IMAGE_FIRST_SECTION(m_pNtHdr);
wSections = GetNumberOfSections();

for (i = 0; i < wSections; i++)
{
if (pSectionHdr->PointerToRawData <= dwOffset)
if ((pSectionHdr->PointerToRawData + pSectionHdr->SizeOfRawData) > dwOffset)
{
dwOffset -= pSectionHdr->PointerToRawData;
dwOffset += pSectionHdr->VirtualAddress;
return (dwOffset);
}

pSectionHdr++;
}
return (-1);
}


BUG-Win32Dasm-EXEscope-Str Table
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > BUG-Win32Dasm-EXEscope-Str Table
PDA

View Full Version : BUG-Win32Dasm-EXEscope-Str Table

Meteor
11-25-2003, 02:24 AM
Maybe ..
please read carfully...sorry for bad english ...

one day i try to crack an OCX protected by lock .. i try to install int as an component n delphi but i was received an error message saying LOCK SN Error:305

ok then i disassembled it by W32dsm and look at string table the string not found and other string of lock error was there like this
LOCK ... ERROR:303
LOCK ... ERROR:304

BUT error number 305 not found ... ooooh
then i was opened my OCX in EXEscope WOW
it Extract All Strings from file include all lock errors ... such as Lock sn Error:305
:rolleyes:
may W32dsm have a bug ...
Note : Hiew Was tested too and no more string extracted (like w32dasm)

Tanx to all
Kayaker
11-25-2003, 02:44 AM
Hi

I'm not sure if this answers your question, but if I remember correctly, Win32Dasm is *known* not to recognize all Delphi strings. Not really a bug, but not unusual either. Try DeDe for Delphi apps, you'll find strings not listed in Win32Dasm.

Kayaker
Meteor
11-25-2003, 02:51 AM
Please remember it is an OCX and not a delphi program.. I want to add it into components of delphi .. but tanx for your assist . i wil try it and anwer soon ..
Kayaker
11-25-2003, 06:24 AM
Sorry my mistake, I guess I misunderstood. Good luck.
disavowed
11-25-2003, 07:38 AM
the string is probably referenced indirectly in the code, so w32dasm won't "see" it. use ida instead (granted, if this is the case, then ida won't automatically decode it either, but at least you can manually decode it with ida if you know the offset)
LOUZEW
11-25-2003, 05:14 PM
Hi,
Like Disavowed said, use IDA you can configure strings type using the option menu :

\OPtions
\ASCII Strings Style ( Alt+A)

If IDA still don't recognize the string, locate it with an hex editor and try to find a string ID (usually some bytes before) and then search in the disassembly anything like : PUSH String_ID.
Aimless
11-27-2003, 01:30 AM
Maybe because W32dasm does not read Unicode strings.

Have Phun
Meteor
11-28-2003, 01:28 AM
i have problem with this file ...
please verify it and tell me how it work .. :rolleyes: :confused:

attachment deleted...
ZaiRoN
11-28-2003, 04:43 AM
Hi Meteor,
don't attach target specific file! You are new here and maybe you have not yet read the faq, please read the faq!!!
Meteor
11-28-2003, 09:44 AM
Hi Meteor,
don't attach target specific file! You are new here and maybe you have not yet read the faq, please read the faq!!!

Yes Sure Sorry .. :p


how to unpack the shell of svkp 1.3x
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > how to unpack the shell of svkp 1.3x
PDA

View Full Version : how to unpack the shell of svkp 1.3x

seee
11-25-2003, 11:18 PM
how to unpack the shell of svkp 1.3x
JMI
11-26-2003, 02:43 AM
First, read the FAQ. It will tell you what you should do before you ask a question. Then use the search function for the board. Then do some of your own work and tell us where you are stuck. We don't do all the work for you. We are only here to help after you make some effort on your own and show us what you have done.

Regards.
SvensK
11-26-2003, 03:47 PM
I told you how to find the OEP on the other forum, now go fiddle with it.
JMI
11-26-2003, 03:55 PM
For those of you who are not following this "facinating" thread :rolleyes: everywhere, the "other Forum" SvensK refers to is his response to the identical post by seee in the General Discussion Forum on the Exetools Forum. Upps. :D That'll teach me to make assumptions. Apparently Seee posted his question in yet a third (or more) Forums. SvensK's reply is NOT in the exetools forum. :confused:

Regards.
dELTA
11-26-2003, 07:34 PM
That is, if SvensK isn't in reality an evil agent sent out to make us all go mad, and embark on neverending quests to find the "lost forum", of course. :D

Btw JMI, do you by any chance see anything peculiar about the username of this evil agent, which perhaps in certain frost covered countries would imply something about say... nationality? :cool:
SvensK
11-26-2003, 07:40 PM
Frost covered eh?

Not for another week or so :)

Edit: I don't know what JMI has been smoking, coz it's in the exetools forum :D
dELTA
11-26-2003, 07:49 PM
Yeah, yeah, there was some snow last week at least, ok? ;) We don't want to ruin the reputation of this nice country to the world, now do we? Now smile and tell the crowd that you just saw a pack of penguins chase a polar bear outside your window. :p
SvensK
11-26-2003, 07:50 PM
Well, at least the northern parts have gotten their share of snow. :)
JMI
11-27-2003, 09:10 PM
Perhaps I was not quite as clear as I had intended. Seee posted the identical post here: http://www.exetools.com/forum/showthread.php?s=&threadid=3004, which was the one I "assumed" SevesK was indicating was the one he had answered. There is still NO answer to that thread on exetools. :rolleyes: So the "other" thread must be this one: http://www.exetools.com/forum/showthread.php?s=&threadid=2994

By the way, since dELTA has been tutoring me on improving my Swedish, I know that SvensK means a male Swede. :D

Regards.
SvensK
11-27-2003, 09:14 PM
At least we got that sorted out, maybe time to close the topic? :)
dELTA
11-27-2003, 09:17 PM
Here's some more tutoring JMI, this time on Swedish-related English words: It's "Swede". :D

And SvensK:
We don't close topics around here, we just kill them with off-topic babble. :D
JMI
11-27-2003, 09:19 PM
And just to set the record completely straight, I gave up smoking when I was 8 years old. :D Too much coughing. :rolleyes: And dELTA is down in the south where the penguins are much better behaved. Or so he says. :cool:

Regards.
JMI
11-27-2003, 09:33 PM
Sorry coach, didn't look far enough down on my list of descriptive phrases. And after spending the day stuffing myself with Turkey and Ham and pie I can't remember how to spell. :D

Regards.
Woodmann
11-27-2003, 11:05 PM
I know that SvensK means a male Swede.

Here's some more tutoring JMI, this time on Swedish-related English words: It's "Swede".

... Turkey and Ham and pie I can't remember how to spell.

I just thought I would continue to re-direct this thread a little more.

Swede looks like it is spelled correctly.

Woodmann
dELTA
11-28-2003, 07:22 AM
Well, seems like someone has edited it by now, it used to spell "Swed" in that message. To avoid any further confusion I just restored it to the original spelling anyway. :D
JMI
11-28-2003, 01:16 PM
This used to say something really clever, but dELTA was sooo jealous that he changed it into something stupid. It was a reminder that he had blown his English grammar while correcting my Swedish grammar, but he was sooo embarassed that he tried to hide his mistake by editing my post. But three can play this game. :cool: (For the benefit of the historical record and Woodmann's strained sanity, I did change the spelling again.)

Regards.
esther
11-28-2003, 01:25 PM
Nothing but a troll :eek:
JMI
11-28-2003, 01:33 PM
Actually, I'm still a wise old wizard, even if dELTA keeps trying to change my posts. After all, I can edit them back. :cool:

Regards.
dELTA
11-28-2003, 02:06 PM
Actually, spelling is often learned before grammar (which is the correct spelling of that word btw :p), so I'll wave to you from the class above then. :D
SvensK
11-28-2003, 03:59 PM
omg


N-Rec - armadillo nanomites recover tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > N-Rec - armadillo nanomites recover tool
PDA

View Full Version : N-Rec - armadillo nanomites recover tool

sope
11-26-2003, 09:32 AM
Hello Everybody,

Just browsing some other forum found this new tools & hence posting it here in the tools section. Hope its useful to somebody.

hxxp://www.hackersrussia.ru/Cells/filez/altruistic_cracks/N-Rec/n-rec.rar

Regards, Sope.
cRk
11-26-2003, 12:03 PM
what about an english translation for armadillo.htm ;)

Regards!
JMI
11-26-2003, 01:51 PM
It's also available at: hxxp://www.wasm.ru/toollist.php?list=6#220 along with many other useful tools. And no, the manual is only in Russian there also. :cool:

Regards.


Lost and confused in INT 30
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Lost and confused in INT 30
PDA

View Full Version : Lost and confused in INT 30

lenwuk
11-26-2003, 05:14 PM
I'm working on a program that appears to be packed with AsPack, but none of the unpackers work sucessfully.
So, I've tried working through it a little at a time.
It has some fairly good SoftIce detection that I've not been able to find - it either just halts the machine with a totally blank, black screen (if I3HERE ON) or causes a page fault in the kernel (if I3HERE OFF).
However, it runs OK under TRW2000.
Well, I've been single stepping through all the disguised JMPs, relocated encrypted code, and other crap, and I eventually end up at an INT 30 which seems to execute the program if I let it go ahead. If I trace into the INT 30 I never seem to reach the actual program code. In truth there's actually EIGHTEEN INT 30 calls which seem to involve stepping into FindClose (!!) and Kernel32!ORD_0001.
I confess to being at the limit of my technical ability on this one and would appreciate any help that you'd care to offer.

PS the general structure of the program is -
start executing around 5BE000-setting up code in high memory, then pass control to 1270000 which contains more code relocation and all the "tricky bits".
Then finally the program itself which executes in the normal 400000 area.
dELTA
11-26-2003, 07:43 PM
Even though a post like this, having any resemblance of the poster actually having read the FAQ, would be quite an unheard of thread-starter in the unpacking forum, you might have more luck with this subject among all the unpacking freaks there. :) Not that most people don't actually read all the forums, but anyway, you never know. Not that it's not welcome in this forum too, I'm just saying... :)
SvensK
11-26-2003, 07:46 PM
Even though a post like this, having any resemblance of the poster actually having read the FAQ, would be quite an unheard of thread-starter in the unpacking forum, you might have more luck with this subject among all the unpacking freaks there. :) Not that most people don't actually read all the forums, but anyway, you never know. :) Not that it's not welcome in this forum too, I'm just saying... :)

Nice reply, so much.. and yet so little. :D
dELTA
11-26-2003, 07:52 PM
Getting a bit cocky just because you have to fight the same polar bears as one of the admins when getting to work in the morning, are we? Stay on topic! :D
cRk
11-26-2003, 11:16 PM
maybe this is a new aspr. trick and it's not aspack... PM the target.. i would like to see it ;)
lenwuk
11-27-2003, 12:38 AM
maybe this is a new aspr. trick and it's not aspack... PM the target.. i would like to see it ;)

Oooops......sorry.........I meant asprotect.
cRk, I've PM'd the target to you.

Regards, Len
Harding
11-27-2003, 06:42 AM
Delta: There are no poalrebears in Sweden! Why does eveyone think that?

lenwuk: Have you tried asprDebugger? It might help you on your way.
SvensK
11-27-2003, 06:44 AM
Delta: There are no poalrebears in Sweden! Why does eveyone think that?

lol, calm down dude.. he was just kidding :)
dELTA
11-27-2003, 07:35 AM
Harding:
Kanske för att plikttrogna svenskar som jag och SvensK gör vårt bästa för att hålla liv i dessa rykten, så att vi inte ska bli invaderade av galna amerikaner om de väl skulle märka hur fint och fridfullt det faktiskt är här... eller nått. :D Btw, svara inte något på svenska i detta forum, man får bara prata engelska, och det är bara admins som får bryta mot reglerna. :p

Btw, asprDebugger is a fine product of Sweden too... :)
Manko
11-27-2003, 08:13 AM
Hi!

Don't believe a word they're saying, I definitely have polarbears in my backyard! I can see them now, chasing my neighbour up a tree... :)

btw, asprdbgr, was pretty ok :D , but I have done some stupid untested changes to it, from lack of time, and also alexey has finally made some interresting changes to his packer, that ruins my app completely...

It would require some time reversing/beating/testing that I don't have...
(Though it might not be SO hard...)

In fact I'm completely off cracking/reversing now, though I can't resist lurking here, from time to time...

/Manko
Zilot
11-27-2003, 10:23 AM
Manko ?

Are you serious about bears, can you make some photos and send me. I'd like to see them.

Have you tried that I sent you (no IAT with ASPR)

Download next

Post Smile

from w.w.w.PostSmile.com , same trick there.

Zilot
dELTA
11-27-2003, 12:06 PM
Of course he's serious about the bears, here's a picture I just took in my back yard (they can get kinda lazy sometimes after eating a neighbor or two, and that's when you sneak out to work). :D
Zilot
11-28-2003, 03:50 AM
This is one of the best thing I saw on this forum...................

Thanks Delta for this remarkable picture, excellent !!!!!!!!!!

Now I have what to show to my neighbours, they will be surprised how situation can be serious when they don't pay attention when go out to get some wood for fire....

How life can be weird........but always brings some new excitings, you are meeting new friends (white ones in this case) with lot of weird stories....
Harding
11-30-2003, 08:26 AM
Så jag kommer bli "flammad" (?) för detta då? ;-)

So there are some swedes out there who know about RE. I thought it was just
russians and spaniards that did that :-)
dELTA
11-30-2003, 09:34 AM
Shhh, that's what we _want_ them to think... ;)
Shoob
12-03-2003, 12:25 PM
im not thinking its a feature, its a bug nothing more compatibility error from Aspr to software. out
evaluator
12-04-2003, 04:15 AM
lenwuk!!!

I read you post & remember myself as newbie! (:)
Because same thing was happend with me..

OK, that happens, because you are going from
assprs Exception Handler & then code goes into VMM..

You need: learn, how works Exception Handling in Win,
so then you will now, where continues program execution.

***
& upper of my post resides 1T helpfull reversing info!?


Softice issues. Reboots PC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice issues. Reboots PC
PDA

View Full Version : Softice issues. Reboots PC

TheVirus
11-26-2003, 10:21 PM
I have Win2k, ATI 9800 Pro, and SoftIce DriverSuite 3.0...

When i switched to my 9800 pro from a geforce3ti500 it would reboot when i would drop into softice. I have tried everything i could possibly think of to fix this. It is either driver or video related since it worked fine with my old card. Ive formatted 3 times and tried WinXP as well... Nothing i did fixed this problem and i am out of resources. Please help. Thanks

The search is broken and I really dont want to manually search. I have looked everywhere and using anything and everything i can to fix this problem. I may have posted here before, but i cant remember.
dELTA
11-27-2003, 07:20 AM
In what way is the search broken? I just searched for "softice video" and got a lot of nice hits.

Anyway, have you tried both the universal vga mode and the mode specific to your graphics card in Softice?
nofurs
11-27-2003, 01:06 PM
Maybe his IE is fucked .it works for me ;)
TheVirus
11-27-2003, 06:47 PM
Maybe his IE is fucked .it works for me ;)

Searching works, but i didnt find anything relevant to my issue. And if i did it was unanswered. Believe me i looked everywhere... im getting no where with this..

Yes i tried universal and standard vga.. VGA doesnt even work, reboots my pc.

If i use softice in windows it works fine. If i use it in full-screen games it reboots my pc...
TheVirus
11-27-2003, 06:50 PM
In what way is the search broken? I just searched for "softice video" and got a lot of nice hits.

Anyway, have you tried both the universal vga mode and the mode specific to your graphics card in Softice?

Be more specific how, what do you need to know?

I have an ATI 9800 Pro. Ive used the 3.6 to 3.9 drivers to no avail.

I also had 2 motherboard/chips too. P4 and AMD... didnt work on either (On AMD right now)
doug
11-27-2003, 07:54 PM
If i use softice in windows it works fine. If i use it in full-screen games it reboots my pc...

I have the same problem with my radeon 7500 (mobility). Using driver studio 2.7

The only viable solution I found was to debug full-screen games on another computer (which has a geforce2).

I'm almost certain that the problem is related to ati cards.. so unless better support is offered for those cards, there is little you can do..
TheVirus
11-27-2003, 08:06 PM
I have the same problem with my radeon 7500 (mobility). Using driver studio 2.7

The only viable solution I found was to debug full-screen games on another computer (which has a geforce2).

I'm almost certain that the problem is related to ati cards.. so unless better support is offered for those cards, there is little you can do..

I cant debug on another PC cus i dont have 2 PCs at my disposal. This really pisses me off =\
Aimless
11-28-2003, 12:36 AM
There are 3 things to understand to understand that SoftICE runs correctly in the order of importance:

1. SoftICE version
2. Video Driver
3. Processor version
4. Video Memory

1. SoftICE version
-----------------
If you are using standalone versions of Softice (such as softice for winnt 4.05 etc) you will find that its a hit and miss affair. If it runs it runs, else it may not. No one can determine the reason why. My suggestions is to move over to DriverStudio 3.0. Use that in conjunction with Windows XP Professional and it will work just good

2. Video Version
---------------
While the supported video cards may run, its always a good point to run in Universal mode. And remember, softice PATCHES the video drivers so:

THE WRONG PROCEDURE:
1. Machine with GeoForce
2. Softice installed and working fine
3. GeoForce removed
4. ATI plugged in
5. Machine screwed

THE CORRECT PROCEDURE:
1. Machine with GeoForce
2. Softice installed and working fine
<HERE:: Uninstall Softice and remove all registry keys related to Numega or Compuware>
3. GeoForce removed
4. ATI plugged in
5. SoftICE reinstalled
6. Everything OK

3. Processor Version
--------------------
Can't really say whether the ICE will work on AMDs. I've seen lots of people with AMD who have some problem or the other with ICE. But worthwhile trying to install the same in a Intel based machine.

4. Video Memory
---------------
Wuh?? Yup I know. Go to Symbol Loader and open initialization settings. See the video memory there? INCREASE it. The box that is drawn on your screen is taken from the video memory. So if you are rebooted in the full screen mode, its not able to find enough memory to draw the screen. Increase the memory to about x4 times and you should be fine.

Have Phun
TheVirus
11-28-2003, 12:49 AM
There are 3 things to understand to understand that SoftICE runs correctly in the order of importance:

1. SoftICE version
2. Video Driver
3. Processor version
4. Video Memory

1. SoftICE version
-----------------
If you are using standalone versions of Softice (such as softice for winnt 4.05 etc) you will find that its a hit and miss affair. If it runs it runs, else it may not. No one can determine the reason why. My suggestions is to move over to DriverStudio 3.0. Use that in conjunction with Windows XP Professional and it will work just good

2. Video Version
---------------
While the supported video cards may run, its always a good point to run in Universal mode. And remember, softice PATCHES the video drivers so:

THE WRONG PROCEDURE:
1. Machine with GeoForce
2. Softice installed and working fine
3. GeoForce removed
4. ATI plugged in
5. Machine screwed

THE CORRECT PROCEDURE:
1. Machine with GeoForce
2. Softice installed and working fine
<HERE:: Uninstall Softice and remove all registry keys related to Numega or Compuware>
3. GeoForce removed
4. ATI plugged in
5. SoftICE reinstalled
6. Everything OK

3. Processor Version
--------------------
Can't really say whether the ICE will work on AMDs. I've seen lots of people with AMD who have some problem or the other with ICE. But worthwhile trying to install the same in a Intel based machine.

4. Video Memory
---------------
Wuh?? Yup I know. Go to Symbol Loader and open initialization settings. See the video memory there? INCREASE it. The box that is drawn on your screen is taken from the video memory. So if you are rebooted in the full screen mode, its not able to find enough memory to draw the screen. Increase the memory to about x4 times and you should be fine.

Have Phun

Ive used Driver Studio 2.7 and 3.0

Ive formatted 3 times. Installed 2k, XP, then 2k.

Tried it on a P4 as well.

Havent tried it, will do now. Thanks.
TheVirus
11-28-2003, 12:50 AM
Ive used Driver Studio 2.7 and 3.0

Ive formatted 3 times. Installed 2k, XP, then 2k.

Tried it on a P4 as well.

Havent tried it, will do now. Thanks.

Mind you the ATI 9800 Pro has 128mb of RAM, and the GF3 had 64 or 32 i believe.
TheVirus
11-28-2003, 01:22 AM
I changed the vid ram from 2048 to 8196 or whatever the exact value is. Didnt work. I then took off Trap NMI... didnt work either.
tanis
12-10-2003, 07:50 AM
I have a similar problem. Whenever i start the ntice service (DriverStudio 3.0.1) my machine freezes.

This box is running with an AMD and a GeForce 3. It's the first installation of any compuware tools I do on this exact box, so it's probably not an issue due to changed hardware.

The OS is WinXP Pro just in case you're wondering.

I have tried using the Universal Video Driver and the nvidia one, but the nvidia automagically reboots my PC even before starting windows (just when the softice video driver is loaded). The Universal video driver simply lets me start WinXP but when I run the ntice service it freezes the whole box and I have to turn my PC off and on again.

Any idea if there's any workaround?
Woodmann
12-10-2003, 09:23 PM
My 2 cents worth.......

In my travels I have found problems with SI on any
home built comp that I have ever had with any kind
of video card that was not the most minimal.
Someone said it best-- it's a run or no run situation.
Unless you want to spend a rather large amount of
time trying fix it, get a cheap old slow piece of shit
and work on that. I wish I could show you the
2 video cards and one motherB I smashed in a fit of RAGE.
(no pun intended) :eek:

Woodmann
JMI
12-10-2003, 09:33 PM
I have the film, if anyone wants to see it. :o

It is rather funny to see an OBC, attempting to yank out what hair his has left, red in the face, wearing heavy boots, and jumping up and down on a poor video card and motherboard that have "refused" his instructions to "work" as he had wished. As an added bonus, if you order now, you can also learn some great curse words, if your vocabulary is limited in that area. :D

Available for a nonimal fee and the usual, exorbidant, "shipping and handling." :cool:

Regards.
Woodmann
12-10-2003, 10:07 PM
Ummmmm..........

I see I am the target of the moderators vitrol (oh look another big word) ;)

SI is sometimes so touchy, if you look at it wrong
it has a tantrum and goes all funky.
Everyone has a story about it. Lets hear them.

Woodmann
tanis
12-12-2003, 06:25 AM
Hell yeah!

SI is a bitch when it comes to running it on rather recent configurations. The best I could do was to have it running on an AMD box with the same GeForce 3 card but with Windows 2000 Pro. I was using DriverSuite 2.7 at that time.

I guess that the biggest problem is Win XP as always. There's something that is happily freezing my box under that OS.

I've also tried patching with the latest OS datafiles from Compuware but this has not solved my issues at all. I'm going to try installing 3.0 on another box with a P3 and a Matrox card.. let's see if this works.. but even if it does it's still a problem since I cannot use my home machine to debug and that's a real pain in the arse.
tanis
12-12-2003, 06:31 AM
BTW this could also be a problem due to the fact that DS 3.0.1 is supporting Win XP SP1 and not SP2 which is the one running on my boxes.
LOUZEW
12-12-2003, 02:23 PM
Hi, guys
There is a long time now (in fact when i upgrade to XP for the first time), i had this prob. Sometimes PC froze, Sometimes it reboot !

At this time i was using DS 2.7 on an AMD ATHLON 1.7Ghz with an NVIDIA GF2 CARD, motherboard was MSI MS-6380 (yes a VIA chipset based one).

I've found the problem trying and truing again:

The problem was the VIA 4IN1 driver, exactly the AGP Driver, then in order to work with SI and XP SP1, i had to remove this patch driver from my system.

After removing this nasty patch (provided by VIA), i never had any problem !

I'm now using an AMD ATHLON XP 2800+, MSI motherboard too and i have DS 3.01 under XP SP1 (i've not used the nasty patch driver) and all work like a charm.

Hope this help !
TheVirus
12-13-2003, 01:29 AM
I dont have VIA on my mobo. Its nforce2. The thing is i had 2 mobos.

1 was a p4 with via i believe
this one is amd with nforce2. If theres a way to uninstall the AGP thing on this nforce2 board lemme know

MSI K7N2.
LOUZEW
12-13-2003, 01:50 PM
OK, MSI K7N2 you can try to reinstall XP and never install the AGP patch !
TheVirus
12-13-2003, 07:56 PM
Ill try to find an nforce2 uninstaller program, no need to format and reinstall windows 2000, i hate XP.
tanis
12-16-2003, 06:28 AM
I never installed the VIA AGP drivers, too.. but it could be that they got installed during a Win XP patch or seomthing like that. I'll have a better look at that issue when I get back home.
tanis
12-16-2003, 12:43 PM
For statistical purpouses:

- My PC at the office which is a P3 on an Intel-based mobo works fine with SoftIce v3.x
- The same version on my home PC (AMD Athlon) does not work.

And I have not installed any VIA driver at all. No traces anywhere in my system directory.
rnd
12-26-2003, 04:40 AM
I run s-ice (ds. 2.7) on a ati 9800-blabla too. I used to run it on a p2 + viper550 + win98/win2k/winxp, where it ran fine. but on the pc of my brother it didn't work on his athlon + viper770. and on a friend of me it ran on a P3 + viper770...

maybe this illustrates that running and finding out what goes wrong with sice isn't a trivial job :)
socram
02-04-2004, 11:03 AM
Hi..

I have win 98 (yeap.. still), AMD Athlon 2.600, Ati Radeon 7500

I can't change SO yet because so progs of mine just work under 98.

SIce 4.05, so it was working at older pc, P III Gforce 2 MMX

Now i got problem... when i pressed Ctrl+D Sice doesn't pop up. I run Loader32 and it show me that Sice was loaded, but it's not pop up
esther
02-04-2004, 11:11 AM
Try older pci cards or the one it works in your older pc.Please use the search button before posting anyhing and READ THE FAQ
socram
02-04-2004, 11:36 AM
Dude... i read everything that i found in this forum....

I've tryied almost all...

So i asking to get hlep...

And I ca'tn get older pci video
esther
02-04-2004, 11:39 AM
what about changing the settings of vga using Universal in softice?

Searching the forum gives you many hits!!!!!
socram
02-04-2004, 11:52 AM
I tryied this...

Universal vga and ATI drivers

in the winice.dat
PENTIUM=OFF

Uninstall all drivers of ATI and just install Ati video card.

i think that's all
esther
02-04-2004, 11:57 AM
change the display settings in the control panel to 256 or 16 colors
give a try
socram
02-04-2004, 12:02 PM
ok... but i'm working now...
At soon as possible i'll give a try

tkz for all, ans sorry for something..
but but today is a long a week trying to do this working...

Do you think that i install another OS like W2K is better?
esther
02-04-2004, 12:05 PM
Well as far as I know win98se is the best for using softice(for myself :p ).Anyway good luck
:)
socram
02-04-2004, 12:27 PM
sooo.... ehhehe

I'm here boring you again...

When i load Sice at the boot up... 2 process of Sice must be in memory, right? (i don't know if it is processes, programs....)

it's something like NTSice and another one that i can't remember now...

My doubt is, if i press Ctrl+alt+del (win98) must i see that 2 guys?
Timbo
02-04-2004, 04:12 PM
sooo.... ehhehe

I'm here boring you again...

When i load Sice at the boot up... 2 process of Sice must be in memory, right? (i don't know if it is processes, programs....)

it's something like NTSice and another one that i can't remember now...

My doubt is, if i press Ctrl+alt+del (win98) must i see that 2 guys?

no processes you mean VXD'S right should be 3 ( long time useing Tux) if i remember right-> SICE,SIWVID, if a third could'n remember
enter sice type vxd
socram
02-04-2004, 06:54 PM
Holy Sh#!@#!!!!

I still angry with my softice... so i discovered in manuals of numega.. that it doesn't support keyboard/mouse USB.... someone could confirm?

I think my pc is against SoftIce...

Ok.. I'll keeping relating my probs here... :(

if someone got keyboard or mouse USB and SICE working... please warning me....

I'm run after a keyboard and mouse ps2 now...
naides
02-04-2004, 09:26 PM
Holy Sh#!@#!!!!

I still angry with my softice... so i discovered in manuals of numega.. that it doesn't support keyboard/mouse USB.... someone could confirm?

I think my pc is against SoftIce...

Ok.. I'll keeping relating my probs here... :(

if someone got keyboard or mouse USB and SICE working... please warning me....

I'm run after a keyboard and mouse ps2 now...

I have DS 2.7 in windows XP. Laptop. It works with a USB mouse, 90% of the time.
when it gets bad, starts showing like crazy that bloody right button context menu of Sice.

Ergo: it CAN work with USB mouse (Mice?) at least. dunno KB
socram
02-04-2004, 11:22 PM
ok man...

Tkz for tell me. (but i think i'll try to change my keyboard and mouse, just to test)

:p

:( Unhapply my SICE is down yet.
ufff uffff i'm tired for today...
socram
02-05-2004, 05:28 AM
News!!

Well it still not working but unless, it appears, Yesterday when i got close IE, SICE pop up and freeze all.
esther
02-05-2004, 11:42 AM
I think you should use a clean installation of windows before installing softice

Many programs might affect in the background.You MUST BE SURE that your
softice is for win98,I know there's a NTversion 4.05

I think that's the least we can help

Regards
socram
02-05-2004, 11:57 AM
:p

Gochtaaaaaaa!!!!

Finally, sotfice pop up... and with out errors... ehehhehe

I just discovery the problem... and i so angry my problem is not Video card, AGP, 4in1, nothing like that it's more bizarre... it was my Keyboard USB, today i got a keyboard ps2 and i change and reboot... so Softice Popup

I dont know if is my model of keyboard or wht.. but just to know it is a Keyboard multimedia (portuguese, unhapply but i never use its driver), Black, manufacture = Dr. Hank

Ok.. Tkz for all and everybody.

Now my doubt will be about how to use SICE.... hehehehe, but i have a lot of stuff to read and learn...

Tkz..


Armadillo !!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo !!!!
PDA

View Full Version : Armadillo !!!!

Zilot
11-27-2003, 07:55 AM
New Armadillo tut I wrote yesterday. Maybe will help someone to find out the best way to unpack this protector protected files.

http://members.fortunecity.com/zilot/Tutorial/armadillo.htm<---- Web version

http://members.fortunecity.com/zilot/Tutorial/Tutorial.zip<----- For download

I'll upload installation of Trojan Remover because in the meantime there is new version

Also will upload dumped.exe and fixed.exe files

Tomorrow

Zilot
mr.x
11-27-2003, 12:54 PM
Thanks Zilot;)
seven
11-27-2003, 03:51 PM
thx
volodya
11-27-2003, 04:14 PM
Zilot, you are not that bad :D
dreambuddy
11-27-2003, 04:34 PM
Thanks Zilot for this nice and helpful tutorial. :)
Zilot
11-28-2003, 06:22 AM
Zilot, you are not that bad .

Yesta Kapitan !!!!
esther
11-30-2003, 08:45 PM
Woah!!! post dissapeared!?! :eek: :rolleyes:
Zilot
12-01-2003, 10:25 AM
Hey +SplAj

did you mean this :

http://www.postsmile.com/img/default/0520.gif
siba
12-10-2003, 08:41 AM
Nice Tut
Thanks for Sharing
volodya
12-10-2003, 01:10 PM
Hey, Mr. ZILOT. Everything is on wasm now and the links were modified.
Waiting for zipped target.

Offtop to forum admins:
Guys, you've done brilliant job and the forum looks really nice. The only thing which upsets me is avatar. I cannot change it to my custom one :(
dELTA
12-10-2003, 02:19 PM
Ok, try now.
volodya
12-10-2003, 02:27 PM
Much, much better :p
Delta, thank a lot. Good job!
JMI
12-10-2003, 04:44 PM
There are a whole bunch of settings in the new AdminCP which we have to check and make sure are properly set and we are still learning the new styles and the new adminCP. However, we wanted to get the Board back open as quickly as possible and, so far, it appears that we didn't lose anything too important along the way. :cool: Once I deleted 2,600,00 entries in the backup from the searchindex and word index, we were finally able to get the "restore" to work properly. We're still working on a better backup script, but time has been short for "playing" of late. Hopefully, soon it will be a litter better automated. :D

Regards.
+SplAj
12-14-2003, 09:50 AM
Hi Zilot

NO :(

That was not the icon. Unfortunately 'someone' with a detached sense of humor deleted my post with my chosen icon, which was VERY appropriate for the way the topic of conversation was developing IMHO.......a picture says a thousand words.

BTW thanks for that link to nice graphical icons site I enjoyed browsing them :)

:p

ciao
Zilot
12-17-2003, 05:41 AM
Hi Zilot

NO :(

That was not the icon.

I didn't see that, just RCE MSG replay with link. But seems replay works excellent http://www.postsmile.com/img/default/0654.gif, I even couldn't access to this forum via cjb.net. I thought it was down. Then Volodya told me he replayed, fortunately I had in my browser magic number
66.98.132.48.

Changes always cause frustrations http://www.postsmile.com/img/default/0524.gif
nikolatesla20
12-18-2003, 03:55 PM
Good tutorial Zilot.

Armadillo continues to "advance" in its complexity. One side effect is it actually becomes easier to make an unpacker for it (disregarding nanomites), since they are bound to forget something. This is one reason Lunar_Dust was able to keep up with versions without much trouble.

I like your handling of nanomites, you found the encrypted jump length table, good work ! :) Lunar_Dust came up with the int3 loader as you suggested, for GetRight 5.0 beta, and it worked very effectively. (Trademarked "NanoWrap"). SImply make a program to act as a debugger, and decode the jump tables just as armadillo does it, and then plop in the jump table codes and compile (jump tables as c arrays). Worked like a charm. With little modification such a tool could easily auto-extract the jump tables and build itself into a wrapper. I used OllyDbg since its easy to track down tables with it.

But alas, other hobbies hold interest at this time :)

Seems Armadillo becomes popular lately ?

-nt20
Zilot
12-20-2003, 04:04 AM
Thanks Tesla

Maybe I'm dumb, but are Lunar Dust and NT20 same person. As far I've seen, same style, same icon.......

But alas, other hobbies hold interest at this time

Games ?
nikolatesla20
12-20-2003, 10:49 AM
Lunar_Dust and I both work together on some RCE projects, that's why we have the same icon.

Other hobbies include metalworking, (I'm getting into metalcasting, starting with aluminum.) and some electronics work again.

Just wanna say keep up the good work !

-nt20


Poker-Winner problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Poker-Winner problem
PDA

View Full Version : Poker-Winner problem

swordie
11-27-2003, 08:50 AM
Hi..I have just downloaded a program called "I Haven't Read The FAQ" from www.i.havent.read.the.faq.com. this program has 2 protection..a time limit and a functionality limit.I have been trying to crack this prog for 3 days now.I tried the messageboxa breakpoint with softice but could not figure out the called to the messageboxa routine.After being diappointed I changed my PC's time to 01/01/2010 to see if i can do anything when the trial limit is over..I am not able to do it here too..a messagebox will appear saying thanks for trying..blablabla..
in win32dasm you have the strings:
1. holdem winner registerd version
2. thanks for trying...
my question is where should i find a place in the code wehre i will add a call method to the first string above(registered)
and how should i write that call?
by the way have a problem with hiew too..it loads the prog but without being able to goto or do anything else.
thanks
swordie
11-27-2003, 09:28 AM
also i tried the APIs getsystemtime getlocaltime and others..
MaRKuS-DJM
11-27-2003, 10:34 AM
also i tried the APIs getsystemtime getlocaltime and others..

System Locate 32...

:0040351C 68ECF24200 push 0042F2EC

* Possible StringData Ref from Data Obj ->"System Locate 32"
|
:00403521 68D8F24200 push 0042F2D8
:00403526 8D8C24A0050000 lea ecx, dword ptr [esp+000005A0]
:0040352D E8CEDAFFFF call 00401000
:00403532 8D8C2490050000 lea ecx, dword ptr [esp+00000590]
:00403539 C78424B807000000000000 mov dword ptr [esp+000007B8], 00000000
:00403544 E867E1FFFF call 004016B0
:00403549 84C0 test al, al
:0040354B 7413 je 00403560 <<< to JMP
:0040354D 6A00 push 00000000
:0040354F 6A00 push 00000000

* Possible Reference to Dialog:
|
:00403551 686CF24200 push 0042F26C
:00403556 E817EE0100 call 00422372
:0040355B E9AF010000 jmp 0040370F

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040354B(C)
|
:00403560 8D8C2490050000 lea ecx, dword ptr [esp+00000590]
:00403567 E8F4E1FFFF call 00401760
:0040356C 83F816 cmp eax, 00000016
:0040356F 7542 jne 004035B3 <<< to JMP
:00403571 A154FC4200 mov eax, dword ptr [0042FC54]
:00403576 89442404 mov dword ptr [esp+04], eax
:0040357A 8D4C2404 lea ecx, dword ptr [esp+04]

functionality limit:

:0040BCFD 6A30 push 00000030

* Reference To: USER32.MessageBeep, Ord:01BDh
|
:0040BCFF FF1580734200 Call dword ptr [00427380]
:0040BD05 E909030000 jmp 0040C013

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040BB75(C)
|
:0040BD0A 6683FB04 cmp bx, 0004
:0040BD0E 0F85DD020000 jne 0040BFF1 <<< NOP
:0040BD14 8BCE mov ecx, esi
:0040BD16 E872370100 call 0041F48D
:0040BD1B 8B8674050000 mov eax, dword ptr [esi+00000574]
:0040BD21 6A00 push 00000000
:0040BD23 668B8820DD0000 mov cx, word ptr [eax+0000DD20]
:0040BD2A 51 push ecx
swordie
11-27-2003, 03:06 PM
OK i am sorry coz of not reading the faq..secondly thank you..it is clear now
MaRKuS-DJM
11-27-2003, 03:37 PM
OK i am sorry coz of not reading the faq..secondly thank you..it is clear now

oh, there's one more problem... the title of the window... just overwrite trial-strings with spaces in hex
swordie
11-27-2003, 05:45 PM
I think there is another problem here..the time limit is done well..but when the functionality one causes the prog to crash after you choose the first card
I have a question here..how can i trace back a code?
for example if i have this offset 00405654 push -----, how can i know the caller to this line?
newbie Qs i know
thanks
Aimless
11-28-2003, 12:19 AM
Kid, You really need to read the softice tutorials. You;re loading your gun, going to war, and do not know how to reload in case your bullets are over.

My hunch is:

1. Keep cracking aside for some time.
2. Learn SoftICE, IDA and W32SAsm (you can learn Ollydbg and Windbg if you are adventerous)
3. Then start cracking.

Too deep too soon will leave you frustrated. Resist the temptation to dive straight in.

BTW, it takes only a week or so to understand all the tools.

Have Phun
Aimless
11-28-2003, 12:23 AM
Oh yes, almost forgot:

1. ADDR <your_app_name_as_seen_in_softice>
2. BPM 00405654 X
3. Run
4. When breakpoint occurs, type STACK or open the stack window using WS
5. You will see your caller

Alternatively:

6. Press the F11 Key it will take you to the caller

OR:

7. Press the F12 key and finish what you were doing and return back to the caller

So you see, I routinely read softice tutorials. ;)

Have Phun


Hiew and XP SP1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hiew and XP SP1
PDA

View Full Version : Hiew and XP SP1

swordie
11-27-2003, 05:49 PM
Hi..Hiew will load progs but will not be able to have anything done like goto or edit or anything..is there is any know bug like this..or it a bug in my mind?
thanks
evlncrn8
11-27-2003, 06:00 PM
Hi..Hiew will load progs but will not be able to have anything done like goto or edit or anything..is there is any know bug like this..or it a bug in my mind?
thanks

read the doc's and press f1
f5 takes you to a va
f4 hex mode/textmode/disasm mode
amongst many others
Aimless
11-28-2003, 12:39 AM
Also read HIEW tutorials, if required ;)

1. Check file is not read only
2. Check you don't open file in HIEW in read only mode

<note: point 1 and 2 are different>

3. You just cannot start editing in HIEW. You will have to press a key to enable editing. See those bars in the bottom? Try something there (I'll not give away what)

Have Phun


Armadillo Nanomites - Help (Please)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Nanomites - Help (Please)
PDA

View Full Version : Armadillo Nanomites - Help (Please)

Billy[23]
11-28-2003, 02:48 AM
Hi again :)

Iam working at removing Armadillo 3 at a Program!

Program is written in Visual Basic, i have it dumped and Rebuiled (IAT) that is, and now i work at the Nanomites, iam guessing the Armadillo version is Recent due to i having the new Crypted Table and the the crappy pushad / popad stuff.

Iam able to find All 4 Tables but iam stuck with what to do with them :) , i read Ricardo's tut about eStOP and followed same patch but i didnt get nothing, from Reading Code Raptors Tutorial about Lydia Email Agent, i got the following Patch

006CD000 60 PUSHAD
006CD001 33F6 XOR ESI,ESI
006CD003 33C9 XOR ECX,ECX
006CD005 8B048D 00E06C00 MOV EAX,DWORD PTR DS:[ECX*4+6CE000]
006CD00C 0FB691 44126D00 MOVZX EDX,BYTE PTR DS:[ECX+6D1244]
006CD013 8B1C8D D81E6D00 MOV EBX,DWORD PTR DS:[ECX*4+6D1ED8]
006CD01A 0FB6B9 1C516D00 MOVZX EDI,BYTE PTR DS:[ECX+6D511C]
006CD021 48 DEC EAX
006CD022 41 INC ECX
006CD023 83FA 05 CMP EDX,5
006CD026 75 0B JNZ SHORT Dumped.006CD033
006CD028 83FF 04 CMP EDI,4
006CD02B 75 06 JNZ SHORT Dumped.006CD033
006CD02D 83FB 04 CMP EBX,4
006CD030 75 01 JNZ SHORT Dumped.006CD033
006CD032 46 INC ESI
006CD033 83FE 01 CMP ESI,1
006CD036 72 2A JB SHORT Dumped.006CD062
006CD038 81FB FF000000 CMP EBX,0FF
006CD03E 7F 30 JG SHORT Dumped.006CD070
006CD040 81FB 01FFFFFF CMP EBX,-0FF
006CD046 7C 28 JL SHORT Dumped.006CD070
006CD048 83FF 04 CMP EDI,4
006CD04B 7D 23 JGE SHORT Dumped.006CD070
006CD04D 66:4B DEC BX
006CD04F 0FB692 DAD06C00 MOVZX EDX,BYTE PTR DS:[EDX+6CD0DA]
006CD056 8810 MOV BYTE PTR DS:[EAX],DL
006CD058 8858 01 MOV BYTE PTR DS:[EAX+1],BL
006CD05B 83FE 02 CMP ESI,2
006CD05E 75 02 JNZ SHORT Dumped.006CD062
006CD060 33F6 XOR ESI,ESI
006CD062 3D 5C945C00 CMP EAX,Dumped.005C945C
006CD067 ^75 9C JNZ SHORT Dumped.006CD005
006CD069 CC INT3
006CD06A 61 POPAD
006CD06B -E9 B88FD3FF JMP Dumped.<ModuleEntryPoint>
006CD070 03D8 ADD EBX,EAX
006CD072 43 INC EBX
006CD073 81FB 00104000 CMP EBX,401000
006CD079 ^7C E7 JL SHORT Dumped.006CD062
006CD07B 81FB FFFF4304 CMP EBX,443FFFF
006CD081 ^7F DF JG SHORT Dumped.006CD062
006CD083 2BD8 SUB EBX,EAX
006CD085 83FF 04 CMP EDI,4
006CD088 75 18 JNZ SHORT Dumped.006CD0A2
006CD08A 3E:0FB61455 00D1>MOVZX EDX,BYTE PTR DS:[EDX*2+6CD100]
006CD093 80FA 0F CMP DL,0F
006CD096 ^74 CA JE SHORT Dumped.006CD062
006CD098 83EB 05 SUB EBX,5
006CD09B 8810 MOV BYTE PTR DS:[EAX],DL
006CD09D 8958 01 MOV DWORD PTR DS:[EAX+1],EBX
006CD0A0 ^EB B9 JMP SHORT Dumped.006CD05B
006CD0A2 3E:0FB71455 00D1>MOVZX EDX,WORD PTR DS:[EDX*2+6CD100]
006CD0AB 80FA 0F CMP DL,0F
006CD0AE ^75 B2 JNZ SHORT Dumped.006CD062
006CD0B0 83EB 06 SUB EBX,6
006CD0B3 66:8910 MOV WORD PTR DS:[EAX],DX
006CD0B6 8958 02 MOV DWORD PTR DS:[EAX+2],EBX
006CD0B9 ^EB A7 JMP SHORT Dumped.006CD062

Program Always Loops to:

006CD062 3D 5C945C00 CMP EAX,Dumped.005C945C
006CD067 ^75 9C JNZ SHORT Dumped.006CD005

So it never checks really anything.

Maybe a messed up Table ?

Any idea to kick me in the right direction would be great.

-Billy
Billy[23]
12-01-2003, 01:51 AM
Nobody ? :P
dELTA
12-01-2003, 07:57 AM
Take a look at that google search result, and you might understand why... :D

No target specific code, and yes, communicating the name of the app by routing it through google still counts.
Billy[23]
12-01-2003, 10:13 AM
Sorry again :) msg is edited and iam sure all traces of program name is removed :)

Anybody can help with this *Generic* approach to the nanomites ?
kyrios
12-01-2003, 11:29 AM
Program Always Loops to:

006CD062 3D 5C945C00 CMP EAX,Dumped.005C945C <== Last offset from tabel1 - 1
006CD067 ^75 9C JNZ SHORT Dumped.006CD005

You must replace the offset with your last tabel1 - 1.
Billy[23]
12-01-2003, 10:02 PM
Yep, last table is 005C945D, so that is correct, i think where iam going wrong is the JUMP Table, like

1 - JMP
2 - JE

not in that order of course but iam reading some more about em now :)

maybe thats where i went wrong.


Very hard To crack eeeeeeeeeeee
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Very hard To crack eeeeeeeeeeee
PDA

View Full Version : Very hard To crack eeeeeeeeeeee

Meteor
11-28-2003, 04:09 AM
hello
i found this program usefull..
but when i want to run it after taking while it shows a error becoz of debugger detected(Soft ice) so I decided to use W32dasm but ....
W32dasm cant find any program entry point(p.e.p Icon disabled)
IDA can not do any thing .. (strings in C format(visual c#))
you can download this yahoo!bot from this (DELETED) location ..
if any one can crack this tell me ..

Tanx :( :confused:
ZaiRoN
11-28-2003, 04:48 AM
Hi again Meteor,
this seems to be an explicit crack request (read the faq...). No one will help you if you continue to ask things like that. Tell us more about the protection, tell us what you have done and which are exactly your problems; soemone will help you...
Woodmann
11-28-2003, 07:51 PM
Lets see how hard it is to get some help..................

First we scan through the post for some "key" words........

I see "softice", "detected".
How do we make softice to NOT be detected ? Surely there must be someone else who has had this problem :confused:

I also see that it also has other tricks to prevent naughty
people from peeking inside ;)
"WDASM" cant find "program entry point". What else do we call PEP ?
Hmmmmm, the "PEP icon" is "disabled" Imagine that :eek:

"IDA" does not work because it is written in "visual c#", you dont say :rolleyes:
(what is c# ?)

SEARCH and you shall find. The world really isnt flat.

Woodmann
JMI
11-28-2003, 07:52 PM
I Know... I know!!! If you uninstall softice, it won't be detected. :D And c# is close, but not the same as D flat. (no symbol available).

And here's not a bad place for our venerable leader to become acquainted with the c# programming language: http://www.c-sharpcorner.com/ :cool:

"C# ( pronounced as C-sharp ) is a new Java like language from Microsoft. Microsoft says that C# is a language with the power of C++ and simplicity of Visual Basic. C# supposed to be the best language for Microsoft's .NET programming."

I dont recall this post from you to be this detailed from the first time I viewed it :eek:
Woodmann

Regards
seven
11-30-2003, 06:33 AM
Microsoft says that C# is a language with the power of C++ :confused:

there iz no language called C++ , it,z F++ , am sure .

Meteor:
did u ment zbrush or ringtone converter , anyway
if i can cracke,m then every 1 can coz am the worst
cracker on planet E++ .
dELTA
11-30-2003, 08:10 AM
Err, ok, time to start having random drug tests around here I see... :p
Polaris
11-30-2003, 08:20 AM
Whoa! This is really an ACID thread!!! :P
seven
11-30-2003, 08:46 AM
time to start having random drug tests
:)
evaluator
11-30-2003, 02:33 PM
JMI,
>>And c# is close, but not the same as D flat. (no symbol available).

for newbies: use b
(Db, Ab)
JMI
11-30-2003, 03:24 PM
Evaluator: You are, again, correct. Don't know what I was looking for in the symbol table. :confused: The "b" is indeed the correct symbol to use and I was visualizing the "natural" symbol. That's what comes from playing music by ear and without written music. :D

Regards.


another dongle (serial) question::
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > another dongle (serial) question::
PDA

View Full Version : another dongle (serial) question::

3axap
11-28-2003, 04:51 AM
Hi,

Is there a soft like WKPE to emulate serial (not parallel or usb) dongle.

Thanks.


End of Unpacking/Decrypting Routine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > End of Unpacking/Decrypting Routine
PDA

View Full Version : End of Unpacking/Decrypting Routine

cRk
11-28-2003, 12:49 PM
i was playing for a while with some targets packed with Pecompact/Packer , aspack 2.11, Old UPX versions and some others. not really hard to defeat but my question is.. is there an special command to avoid/skip the loops while the program is decrypting itself.. Pecompact targets and the Packer itselft looks for me very easy to crack and to find OEP but really kill my time while tracing in SICE with F10 or F8 if i press F12 then the program just load without getting the end of routine where should i dump at OEP the same happends when i press F11 and some other times it will just freeze my PC and have to manually reboot

with SICE loader or LordPe Deluxe b ( Break & Enter) all works OK. my problem is while tracing with all those loops that takes many time to pass them :( :confused: any ideas/tips?

Regards!
MaRKuS-DJM
11-28-2003, 01:40 PM
i was playing for a while with some targets packed with Pecompact/Packer , aspack 2.11, Old UPX versions and some others. not really hard to defeat but my question is.. is there an special command to avoid/skip the loops while the program is decrypting itself.. Pecompact targets and the Packer itselft looks for me very easy to crack and to find OEP but really kill my time while tracing in SICE with F10 or F8 if i press F12 then the program just load without getting the end of routine where should i dump at OEP the same happends when i press F11 and some other times it will just freeze my PC and have to manually reboot

with SICE loader or LordPe Deluxe b ( Break & Enter) all works OK. my problem is while tracing with all those loops that takes many time to pass them :( :confused: any ideas/tips?

Regards!

yes, execute the pushad at start of the file and then set a Hardware-BP on ESP, press F9 and you are on the OEP-jump :) (this is for olly)
cRk
11-29-2003, 11:50 PM
i don't use Olly.. just SICE by now

but thanks for the reply.. any other person would like to give an advice or hints?

Regards!
dELTA
11-30-2003, 08:05 AM
Errrr, how about the exact same thing, except you replace the word "Olly" with "Softice"? :eek:
cRk
11-30-2003, 10:09 AM
LOL as he said this is for olly i thought it was only for only?

i will try it with SICE then :)

Regards!
yaa
12-13-2003, 07:19 PM
Hello,

I'm very new to packing/unpacking, is anyone willing to say something more about this:

yes, execute the pushad at start of the file and then set a Hardware-BP on ESP, press F9 and you are on the OEP-jump (this is for olly)

Execute the PUSHAD at the start of the file??? :confused: :confused: :confused:
Is there always a PUSHAD at the start of a packed file???
I know UPX has a PUSHAD just before the OEP but do I have to expect one even in the other packers???

Thx.

yaa
cRk
12-14-2003, 01:50 AM
Hello,

I'm very new to packing/unpacking, is anyone willing to say something more about this:

Execute the PUSHAD at the start of the file??? :confused: :confused: :confused:
Is there always a PUSHAD at the start of a packed file???
I know UPX has a PUSHAD just before the EOP but do I have to expect one even in the other packers???

Thx.

yaa

i see a pushad or many of them in many packers but not just at the beggining...i think there are other tricks for harder packers/protectors like Asprotect or Armadillo ... anyone would like to share more info. about this? ;)

Regards.


Cryptlib - setting IV's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Cryptlib - setting IV's
PDA

View Full Version : Cryptlib - setting IV's

BassPlayer
11-28-2003, 10:09 PM
I'm trying to set a custom IV for AES encryption. When I try either a 16 or 8 byte IV string it fails with param4 error. But when I let it generate one it creates a 16 byte IV. Are there any special parameters I need to pay attention to when creating an IV
cyberheg
11-29-2003, 07:42 AM
I'm trying to set a custom IV for AES encryption. When I try either a 16 or 8 byte IV string it fails with param4 error. But when I let it generate one it creates a 16 byte IV. Are there any special parameters I need to pay attention to when creating an IV

I don't know cryptlib myself so I can't really help you on the question.
But what I do know is that you left out a few interesting details such as:

Which encryption-scheme are you using? Since you need IV's it can't be ECB. My best guess is you use CBC or CTR.

Why did you try 8 byte IV's? It sounds to me you are not really knowing what you are doing?
If you use AES with 128 bit keys and 128 bit blocklength (minimum) you will need a 128 bit IV also. If you choose less then 128 bit IV (you mentioned 64 bit IV's) you won't make use of the full possible keyspace.

Why not include some specific code which demonstrates your problem?
If you're not experienced in programming then maybe it's just a trivial bug. How should anyone be able to guess what param4 error means UNLESS they actually tried to do the exact same thing you're doing?

// CyberHeg
BassPlayer
11-29-2003, 08:56 PM
Ok, if you don't know cryptlib, then why even respond? Insulting people that ask for help is not 'leet'. I posted here because there are people on this board that do know the library. It's not incredibly well documented, so I asked.

I actually forgot that AES used the 128 bit blocks, so I did make the mistake of trying a 64 bit IV. When it generates its own, it uses 128, so I tried a 16, which still didn'y work. Param4 is the parameter that states IV length. By default cryptlib uses CBC.
Aimless
12-02-2003, 08:32 AM
Relax Guys.

Hey, where are the admins?

Having Phun?
cyberheg
12-02-2003, 11:51 AM
I am relaxed, thanks :cool:

I did not mean to insult anyone. However it's always easier to help someone when you got something to work with.
Even though I don't know cryptlib itself I have enough experience with other libraries and programming in general so eventually I could help if I had some code to look at.

I never found out where it gives you a param4 error. Is it the compiler?, the runtime? or maybe some other thing?
Posting some code which demonstrates the problem makes it easier.
But If you rather want this hide and seek thing, then it's your call.

// CyberHeg
mike
12-02-2003, 05:56 PM
Sorry, I missed this thread somehow!

First rule of cryptlib is "Use the mailing list". That's what it's there for, and they know a lot more about it than I do.

Param4 is the 4th (1-based indexing) parameter in whatever call you're using. I assume you're creating an encryption context and then setting the iv attribute, right? Under "Working with initialization vectors" in the manual:

cryptSetAttributeString( cryptContext, CRYPT_CTXINFO_IV, iv, ivSize );

ivSize is the 4th parameter, the size of the IV in bytes. So ivSize has to be 16 for AES.

More than that I can't say without you posting code.


Defeating PCGuard v5.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Defeating PCGuard v5.0
PDA

View Full Version : Defeating PCGuard v5.0

SvensK
11-29-2003, 06:39 AM
Thought I'd whip up a few quick notes on how to unpack PCGuard v5.0.

1. Load PCGuad protected exe in PEiD (v0.91) and use the Generic OEP Finder to locate the OEP, write it down.
2. Load the exe in Olly.
3. Right-click the value in ECX and Follow in Dump.
4. Right-click the 01 at 7FFDF002 and fill with 00's.
5. Press Ctrl-G while still in the Dump window and fill in the OEP found in PEiD.
6. Right-click the first byte and Breakpoint Memory, on write.
7. Press Shift-F9 a few times until you break at the BP you just set.
8. Press F8 once and notice how the first byte in the dump changes to 55.
9. Remove the current BPM and set a new one on Breakpoint Hardware, on execution at the 55 (push ebp).
10. A few more Shift-F9's and you're at the OEP.
11. Dump with OllyDump plugin and make sure Rebuild Imports - Method 1 is selected.
12. That's it, enjoy.
CrYpT
03-17-2004, 08:08 AM
I tried this way you say, but after I have unpacked it, then it won't start the unpacked exe. I think it is Ollydump there do something wrong, don't you have any problems?
SvensK
03-17-2004, 05:02 PM
Nope. Try dumping with LordPE and rebuild IAT with ImpRec instead then.
LibX
03-26-2004, 04:54 AM
Try the PEiD generic unpacker works in some cases (NOT ALL!!)

regards
LibX
ChaosLord
06-04-2004, 07:48 PM
Any other way to find the OEP, Svensk?

;)
SvensK
06-14-2004, 04:20 PM
Ages since I played with it. Don't even remember what target that was for.
I hope you find what you're looking for elsewhere.


Mind Challenge...(or not?!)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Mind Challenge...(or not?!)
PDA

View Full Version : Mind Challenge...(or not?!)

xfze
11-29-2003, 08:30 PM
I would apreciate all answers, speculation, etc

Well...

Data:

>>we have an 8 digit key
>>we have to get an 8 digit serial that belongs to the key

>>example: the key: RXYW3R55 has the serial (one of them): 4MS2JB9A

>>the generation of the serials is somehow done by the string:
NAX8B9TY3ZCRQF2GSWVH4J7EDK5LM6PU

Clues:

>>as i said a key may have more than one serial, but i think that don't mind right now(does it?)

>>as we can see in the example the last 2 digits of the key are the same (5), but in the serial they´re not (9 and A). so a single alfabet comparison won't work, maybe a multiple table like i did once with 8 strings (one for each digit) taking the example as a start point(something like: 1st digit R equals 4; 2nd digit X equals M;...and so on)

>>the generation string gave above contains the characters for the key, the key can only have 8 among those characters. and as you can see there aren´t any I;O;1;0; so neither the alfabet or the ten decimal digits are complete (wich makes dificult the making of the tables i mentioned)

So...does anyone can figure out who the serials are made?
if yes say how.

you can try to guess the serial for the key: AGYQTULM
report it to me and then i can tell if your solution is right or wrong

good luck;)
dELTA
11-30-2003, 07:59 AM
Damn, people have become quite creative trying to find loop-holes in the FAQ rules and concealing their crack requests lately... :rolleyes:

How about tracing the damned app? :)
ZaiRoN
11-30-2003, 09:54 AM
Damn, people have become quite creative trying to find loop-holes in the FAQ rules and concealing their crack requests lately...LoL :D
xfze
11-30-2003, 01:55 PM
LoL...
yeah...sorry about that :)
I'll try to trace it, but there are people who like beating challenges anyway :)
mike
12-02-2003, 05:58 PM
LoL...
yeah...sorry about that :)
I'll try to trace it, but there are people who like beating challenges anyway :)

But attacking an unknown cryptosystem with a single ciphertext is pretty futile...
xfze
12-02-2003, 07:33 PM
But attacking an unknown cryptosystem with a single ciphertext is pretty futile...

no...i know now two sets of keys...so it´s more easy (although i didn´t get to it yet:) )
with the generation key (NAX8B9TY3ZCRQF2GSWVH4J7EDK5LM6PU)
and these two matches:
(RXYW3R55 <-> 4MS2JB9A)
(UWW4Y6ZG <-> NGTR5V74)

I think it isn't impossible to check it out just with pencil and paper ;) (thus a little tracing would speed up the process, no doubt about it.)( i'm almost sure this cryptosystem is very basic so time is all we need :) )
yousky
12-03-2003, 10:21 PM
The generation key (NAX8B9TY3ZCRQF2GSWVH4J7EDK5LM6PU) seems to be a MD5 string generated with the other informations you've post because all MD5 code have a length of 32 and it is for your example. Perhaps it's a way to search an answer.

bye bye
yousky
mike
12-04-2003, 11:13 PM
The generation key (NAX8B9TY3ZCRQF2GSWVH4J7EDK5LM6PU) seems to be a MD5 string generated with the other informations you've post because all MD5 code have a length of 32 and it is for your example. Perhaps it's a way to search an answer.

bye bye
youskyWhile the string is 32 bytes long, it's almost certainly NOT an MD5. The upper two bits are all zeros. There's a 1/2^64 = 1 in 10 quintillion chance of that happening by accident.


armadillo 2.85
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > armadillo 2.85
PDA

View Full Version : armadillo 2.85

seven
11-30-2003, 03:29 PM
win98se

i did everything right not even 1 mistake ,
but still getting this msg .

http://members.lycos.co.uk/sssevennn/armad.jpg

plz , forget search (bttn ) .
Billy[23]
11-30-2003, 06:33 PM
Why not click that little button called "Details" then repost :) that can help us a lot.

-Billy
seven
12-01-2003, 01:40 AM
3 thingz make me creazy
armadillo , asprotect and britny spearz .
seven
12-03-2003, 11:08 AM
ok billy this iz repost with Details :

am trying to unpack asprotect 1.2
dumped the file ( LordPE )
validate all modulez ( Revirgin + importREC )
rezult : dumped file wont run . :)

http://members.lycos.co.uk/sssevennn/aspro1.jpg

http://members.lycos.co.uk/sssevennn/aspro2.jpg

http://members.lycos.co.uk/sssevennn/aspro3.jpg
Billy[23]
12-04-2003, 05:29 AM
Asprotect , Protected with Armadilo ? weird

but i ment click on the "Details" button in the error to see where / why it crashed :)
seven
12-04-2003, 08:00 AM
Asprotect , Protected with Armadilo ? weird
and no 1 protect seven :(

http://members.lycos.co.uk/sssevennn/msg.jpg
cRk
12-04-2003, 08:45 PM
Imprec won't write the right OEP for you.. are you sure you wrote the right OEP?

;)
seven
12-04-2003, 08:53 PM
are you sure you wrote the right OEP?
i didn,t even think about it , i thought imprec
will take care of the OEP. :)


heard of Glasswall
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > heard of Glasswall
PDA

View Full Version : heard of Glasswall

2nEw
12-02-2003, 09:15 AM
Just heard about this on BBC radio this AM

from http://www.vnunet.com/Features/1141408
Case study: Avecho
Here's a brash statement from a UK start-up only 15-months-old, with 14 people based in Colchester, which will not be in profit until the second quarter of 2004: Avecho's GlassWall software will provide 'absolute' protection from email viruses and hacking attempts.
But co-founder, chief executive and chief technology officer Nick Scales, co-founder and sales director Paul Ridge, and marketing director Chris Dye are not the latest version of snake-oil salesmen, the vendors of the perpetual motion machine. Avecho has patents for its core technology.
It does not tell people how the software works. And it wouldn't want to fight three years in a patent court at £1m a month to defend its intellectual property, says Scales.
It is careful not to divulge the inner working of GlassWall until it has firm non-disclosure agreements.

they also mentioned a £10,000 reward to anyone who can get a virus past it. It reportedly does not use virus definitions or analyze for virus-like behavior and needs no updates. It would be very interesting to see how this code works. Text mail only? LOL

2nEw
disavowed
12-02-2003, 03:27 PM
"The downside, says Twiss, is that about one per cent of legitimate emails may be quarantined, held back rather than let through."

That's quite poor.

I'm interested to know what they're doing though since it's not based on signatures or heuristics.
Woodmann
12-02-2003, 06:53 PM
I'm interested to know what they're doing though since it's not based on signatures or heuristics.

I was wondering the same thing. It is probable that they are not being honest.
Who can blame them, they want the money before they tell anyone anything.

What happens if you sign a confidentiality agreement with some company and they disect your software and decide they dont like it ?

I'm just wondering aloud :)

Woodmann
peterg70
12-02-2003, 11:59 PM
It could be a setup as follows

When you launch an email client it actually runs a emulator that thinks that it is the only software running on that machine. Any infections etc will not harm the main machine and you can secure the main machine by not allowing any networking / internet via the main machine.

Internet browser would also run in a emulator mode thereby protecting the main system again.

Then all you are doing is looking into emulator (similar to terminal servers)

Ok I'm bored
peterg70
sgdt
12-03-2003, 01:49 PM
Here's a thought...

A proposed addition to the USA PATRIOT act would require publicly traded companies to work with regulatory companies to ensure compliance in prevention of "cyber attacks".

This is, of course, put in to benefit a few consulting firms (some of which owned by people in very high places).

So, if you had a company that had a "solution" for all these consulting firms to install, voila!

Now lets say you had NO solution, but you still wanted money. You could SAY you had a solution that every rich company was going to be needing real soon (for compliance), and voila, you'll have venture capitalists clamoring at their brokerage houses for a piece of the action. And you never have to deliver anything.

As people who know the insides of software and hardware, we KNOW there is no true black box solution. But they say "a fool and his money are soon parted", and I think that really applies here.

It's the "American way". It seems everyone wants to "Get in on the ground floor" for the next Perpetual Motion Machine. The UnCrackable program. The EVIL bit.

Seriously, the best way to do it is either go back to old paper based mail (oh no! it's ANTHRAX!!!) or solely ASCII based E-Mail with fixed lengths to avoid any chance of buffer overruns.

Or delete JScript and VB Script, and teach people not to double click on stuff...
MiniMind
12-03-2003, 03:44 PM
Here's a thought...

Seriously, the best way to do it is either go back to old paper based mail (oh no! it's ANTHRAX!!!) or solely ASCII based E-Mail with fixed lengths to avoid any chance of buffer overruns.

Or delete JScript and VB Script, and teach people not to double click on stuff...

Nice thoughts, but some people can't resist to double click ...

(I can... but others :mad: )

I think I'm gonna write some letters on the old good paper...
... sounds wonderfull, but didn't you use a pen or something for that ?
It's such a time ago ... (btw where do you have to put the powder ?)

MiniMind
disavowed
12-03-2003, 05:32 PM
It could be a setup as follows

When you launch an email client it actually runs a emulator that thinks that it is the only software running on that machine. Any infections etc will not harm the main machine and you can secure the main machine by not allowing any networking / internet via the main machine.

Internet browser would also run in a emulator mode thereby protecting the main system again.

Then all you are doing is looking into emulator (similar to terminal servers)

Ok I'm bored
peterg70

good idea, but then you can't send/save email attachments from/to your host system
naides
12-03-2003, 07:52 PM
good idea, but then you can't send/save email attachments from/to your host system

What if you place the attachments in some Demilitarized Zone, where both the system and the emulator have access?
peterg70
12-03-2003, 09:18 PM
good idea, but then you can't send/save email attachments from/to your host system

Ahh but if you stored everything on an exchange server etc you wouldn't need anything on the host machine. And you wouldn't be able to execute programs on the server.
disavowed
12-04-2003, 09:04 AM
What if you place the attachments in some Demilitarized Zone, where both the system and the emulator have access?

then you're not really stopping viruses, are you? :)

besides, guys, it doesn't work this way. the creators said that it does quarantining, which wouldn't come into play with this emulation idea


A few queries
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A few queries
PDA

View Full Version : A few queries

dreambuddy
12-02-2003, 03:05 PM
Hi everybody,

I searched the board with all possible combination on the following questions... but no clue.So here are my queries
While going through Crusader's Asprotect tute I didn't get the following things: Seniors Plz help.
1) What is Solomon's Trick( bpx 80464c50)
2)Asprotect Signature bytes "61 FF E0". What are these... means how come one tells these.. and how they helps in unpacking.

Regards.
Woodmann
12-02-2003, 07:19 PM
Howdy,

I searched the board with all possible combination on the following questions... but no clue.

I think you missed a few combos :rolleyes:

Try this one: "61 ff eo" <---use the quotation marks

Try this one: solomons trick <-----NO quotation marks

Heres a nifty little tip for all of you search gurus ;)
Try actually using the search function. I came up with a few more
results that I dont care to reveal.

Woodmann
JMI
12-02-2003, 08:20 PM
Also try: Signature bytes asprotect <--- no quotes.

As Wood says, there are others.

Generally, the Signature Bytes issue for ASPR is no longer current and you are more likely to be dealing with Stolen Bytes. Now there's another subject to search. :D

Regards.
seven
12-03-2003, 02:08 AM
and never let aspro cheat u coz sometimez u will thing
u r inside the proggy but u will discover later that u r
outside if u didn,t find the ( OEP ) , now there,z a third
subject to search :D
dreambuddy
12-03-2003, 07:41 AM
First of all thanks for helping me out on my queries and secondly for the tips on refining the search.
Woodmann
12-03-2003, 05:52 PM
First of all thanks for helping me out on my queries and secondly for the tips on refining the search.

Thanks for not taking it the wrong way :)

Next step is to show us where you are stuck with some
code snippets.
It is ok to ask a newbie question, just so long as you
tried to find an answer on your own.

Woodmann


logging calls to a particular function in ollydbg or softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > logging calls to a particular function in ollydbg or softice
PDA

View Full Version : logging calls to a particular function in ollydbg or softice

JH1979
12-03-2003, 08:37 AM
Hi,

I am using Ollydbg. I would like to be able to view a log of all calls together with parameters to a particular function. What is the best way to go about this...can I achieve it with trace? I occasionally get an access violation in my prog and have narrowed it down to a particular function, I do not want to log anything else, just calls to this function.

Thanks in advance

JH

P.S. Softice solutions also welcome
disavowed
12-03-2003, 05:33 PM
use autodebug: http://liangs99.myetang.com/pengchunhua/en/index.htm
racerxnet
12-10-2003, 07:24 PM
Thanks for the link to the API interface. Great tool to have.

MAK


Handling PUSH DWORD PTR SS:[REG+CONST] in OllyDBG.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Handling PUSH DWORD PTR SS:[REG+CONST] in OllyDBG.
PDA

View Full Version : Handling PUSH DWORD PTR SS:[REG+CONST] in OllyDBG.

JH1979
12-04-2003, 11:38 AM
Hi,

I am writing an OllyDBG plugin to parse arguments to a given function, essentially by locating calls to the function then disassembling back, looking for PUSH instructions. I can handle simple instances of PUSH contant or PUSH register but I am not sure how to decode instructions such as: PUSH DWORD PTR SS:[EBP+8]. What fields of t_disasm will indicate this is happening? I can't find any that indicate EBP is the register involved.

Cheers

J
dELTA
12-04-2003, 12:42 PM
I was about to recommend the OllyDbg forum for better luck getting an answer to this, but I just saw you posted there too. :)

For anyone else interested:

hxxp://ollydbg.win32asmcommunity.net/

dELTA
JH1979
12-04-2003, 12:52 PM
As far as I can tell OllyDBG tries to calculate the memory address from the reg + offset which is obviously ok at a breakpoint but is meaningless when the program isn't actually running and the reg values are unknown. I just want to check where arguments are coming from (specifically if its from the stack, e.g. is it a PUSH DWORD PTR SS:[EBP +/- offset]).

JH


Private Messages
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Private Messages
PDA

View Full Version : Private Messages

peterg70
12-04-2003, 07:20 PM
Any chance of increasing the Number of private messages on the system from 10 to 15 or something similar.

Or is it possible in this new board to have the body of the message sent to the registered email and provide a link back to the board to allow people to reply to the private message.

I keep getting inbox full and such a user tried to send you a private message.

Peterg70
Woodmann
12-04-2003, 07:57 PM
Howdy,

Give me a few/20 minutes to check things out.

Woodmann
peterg70
12-10-2003, 06:50 PM
Woodmann

Nice look to the board

But I still see this??
Sent Items contains 3 messages.
You have 5 messages stored, of a total 10 allowed. :( :( :(
dELTA
12-10-2003, 09:12 PM
For christ sakes, didn't you learn anything from the last time you asked woodmann to "take a look" at the board settings?! :D

Wood, should we increase it you think? To what limit in that case?
JMI
12-10-2003, 09:38 PM
Mine says I have 5 saved messages and 1000 allowed. :D Well aren't I "special." Of course, no one wants to talk to me, so I'll never use up my allottment. :(

Regards.
Woodmann
12-10-2003, 10:00 PM
For christ sakes, didn't you learn anything from the last time you asked woodmann to "take a look" at the board settings?!

We cant blame pg for my incredible ineptitude. (look at the big word :p )
For some reason mods and admin have a 1000 limit.
I was looking around at what other boards set their PM's at and
10 seems to be a little low.

If we set it at 20 I dont want to hear no complaining. ;)
You must understand that we have PM's limited because
of the amount of space they take up when doing a back-up
of the database.

OK, 20 it shall be.
Will the moderators make the needed changes please
(I am no longer allowed to change forum settings :eek: )

Woodmann
UrgeOverKill
12-10-2003, 10:12 PM
(I am no longer allowed to change forum settings :eek: )

Woodmann[/QUOTE]

hehe...
JMI
12-11-2003, 12:22 AM
I haven't found where the limit is actually set. :confused:
Found it: Usergroups > Usergroup Manager -> [Edit Usergroup] > and there's an option Private Message Permissions -> Maximum Stored Messages. Now set to 20. :D

Wood, were you kidding about not being able to access the AdminCP?? Your user number is identified as an administrator in all the necessary listings of the config file, so there is no reason I can think of why you shouldn't have all the access you need.

I know I had cookie problems with the forum display until I actually logged out and logged back in to get a new cookie. Maybe you are having the same issue. :D

Regards.
peterg70
12-11-2003, 05:56 AM
Thanks for the extra messages slots. I try to keep it to 3 but sometimes you get a flux of PM's.

Peterg70
dELTA
12-11-2003, 08:09 AM
JMI, Woodmann probably just meant that he's encouraged by the other admins/mods not to go near the settings due to the horrible events that usually follow such an encounter. :D
JMI
12-11-2003, 10:23 AM
As we learn our way through many of the new provisions and settings, I noticed that the private message feature has the capability to download your PM's in various formats, so there really shouldn't be the need to keep that many around on the Board. There has also been a significant savings in the size of the backup in the Gamma version vs. the Beta versions, mostly by some change in how the search indexes are kept. :rolleyes:

As for Woodmann's "modifications", we are trying to conceal from him that new feature which asks:

Would you like to initiate total thermonuclear destruction?
Confirm or Delete? :D

Regards.
dELTA
12-11-2003, 01:56 PM
Only amateurs would need an explicit feature for that. Woodmann's a pro, he could nuke the server by just looking at it, even if the options page was completely empty. :D
Woodmann
12-11-2003, 06:51 PM
You guys suck ;)

I can access the admin settings.
This new board has so many settings it's getting silly.

Woodmann
Woodmann
12-11-2003, 09:19 PM
Everyone's private message's capacity has been increased to 20 :)

Woodmann


Where to Start
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Where to Start
PDA

View Full Version : Where to Start

InFiNiTeX
12-05-2003, 12:11 PM
I have a program that i need to find a multiuser license serial, I currently have a 5 user license and would like to change it 50 users, I have been using softice but no success, Being that i can not use the hmemcpy function, I have tried using the API monitor, But about 5000 API Msg come up on that program. When you enter a invalid serial a window comes up "The Serial number you entered in invalid or incomplete. blah..."

Any suggestions on how i should approach this

Windows XP
Softice Driver Studio 3
evlncrn8
12-05-2003, 01:51 PM
I have a program that i need to find a multiuser license serial, I currently have a 5 user license and would like to change it 50 users, I have been using softice but no success, Being that i can not use the hmemcpy function, I have tried using the API monitor, But about 5000 API Msg come up on that program. When you enter a invalid serial a window comes up "The Serial number you entered in invalid or incomplete. blah..."

Any suggestions on how i should approach this

Windows XP
Softice Driver Studio 3

bpx messageboxa or whatever it uses for the nag, backtrace and see where the conditional is, back trace from that....

also softice driver studio 3 if im not mistaken can only do process context breakpoints, i'd revert back to 2.7 or so if i were you
hobferret
12-05-2003, 04:16 PM
Hi

Try these to get info you have entered

GetDlgItemTextA or GetWindowTextA

Should stop before any comps are made then BPX on memory where your data has been placed :)

/hobferret


Remove NagZo!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Remove NagZo!
PDA

View Full Version : Remove NagZo!

evaluator
12-05-2003, 06:16 PM
Well, here is my depli-NagScreen cr0ck-me.

Zairon, your opinions?
JimmyClif
12-10-2003, 07:00 PM
Damn. The NagScreen is the best thing about this app... How do I remove the damn app and extract the Nag?

;) (j/k)
evaluator
12-11-2003, 04:02 AM
hem!
You think, that will be good idea selling Nags!?
cRk
12-11-2003, 08:07 PM
i have done some advance with it.. but i've been out of time for it to complete defeated...

004781FF EC/DC --->> removes closing/end Program nag

00478BB6 23/00 --->> Kill delay of the nag/splash

00478F92 75/EB ---->> gives the End of the Splash and gives the Program Main window

00478FA1 66/00 --->> prevent the skipping main Form and simule we pressed the Start button ?

00478FBB 4c/00 -->> same as previous descripcion

one stuff left to kill it is that the main program window won't be displayed if the mouse pointer is not near where the start text is displayed.. if the mouse pointer is not near there then a messagebox appears saying unable to launch window or something like that.... any tips or help?

i know this could be better but time is killing me ;)

please someone gives tips or finish it and report your results here

i'm always hungry for knowledge
evaluator
12-12-2003, 09:32 AM
what means:'time is killing me'?

you are going to dead?
cRk
12-12-2003, 09:15 PM
LOL.. mean i need more time to live to do many stuff i would like.. is killing me because i'm missing to Do some things :p
ZaiRoN
12-16-2003, 03:50 PM
Hi all,
sorry for my silence but, I have been caught by real life...

Anyway, I have taken a little glance about the program and it seems to be a nice delphi challenge; I have a little question for you Evaluator: the 'That is ...' closing message seems to be obtained at runtime, do we have to make it showing the correct phrase or can we simply remove the dialog

cRk, can you show us the way you have used to solve this challenge? It could help some people here ;)

Later,
ZaiRoN
evaluator
12-17-2003, 03:57 AM
Only remove Nag-screen. All other must be same functional as with nag.
Best will, if you so change code, that control sum will same!
cRk
12-17-2003, 12:41 PM
there's a crc check to remove? i see after modifing the exe the text displayed on the exit dialog Nag is changed...

to ZaiRoN with a little time tomorrow i'll write how i get there ;)

Regards!
yaa
12-27-2003, 06:51 AM
there's a crc check to remove? i see after modifing the exe the text displayed on the exit dialog Nag is changed...

to ZaiRoN with a little time tomorrow i'll write how i get there ;)

Regards!

cRk, if you did have time to write it?

yaa
cRk
01-13-2004, 11:16 AM
sorry for delay but i've been out of the scene for a while....

here's the simple tut for the research i have done so far for this crkme

forgive me for any mistakes if found any... :)

i gave many details as i could...

Regards
evaluator
01-13-2004, 01:03 PM
CrK,

i was confused by size of your zip.
if you decrease colors to 16 & then compress it as GIF,
package will much little ~40kb.

As about tut, too many inglish.

For me, please, just create patch, so then i will test.


EICAR sample virus implementation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > EICAR sample virus implementation
PDA

View Full Version : EICAR sample virus implementation

dELTA
12-10-2003, 11:03 AM
All large antivirus products have agreed to detect a sample "virus" called EICAR (http://www.eicar.org/anti_virus_test_file.htm), and respond to it as if it was a real virus. This is so that people should be able to test certain functionality without risking playing around with live viruses.

Anyway, the implementation of this "virus" is pretty cool, as it consists only of printable characters (to be easily copy/pasted, emailed and such) but it is still perfectly valid executable code.

Here it is in text format:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

When you save this string into a file and give it a .com extension (e.g. "eicar.com") it will constitute an executable program which will print "EICAR-STANDARD-ANTIVIRUS-TEST-FILE!" on the screen and exit when you run it.

I disassembled it just for fun, and it goes like this:

seg000:0100 public start
seg000:0100 start proc near
seg000:0100 pop ax
seg000:0101 xor ax, 214Fh
seg000:0104 push ax
seg000:0105 and ax, 4140h
seg000:0108 push ax
seg000:0109 pop bx
seg000:010A xor al, 5Ch
seg000:010C push ax
seg000:010D pop dx
seg000:010E pop ax
seg000:010F xor ax, 2834h
seg000:0112 push ax
seg000:0113 pop si
seg000:0114 sub [bx], si
seg000:0116 inc bx
seg000:0117 inc bx
seg000:0118 sub [bx], si
seg000:011A jge some_jump
seg000:011A ; ----------------------------------------------------------
seg000:011C aEicarStandardA db 'EICAR-STANDARD-ANTIVIRUS-TEST-FILE!'
seg000:013F db 24h ; $ (DOS string terminator)
seg000:0140 ; ----------------------------------------------------------
seg000:0140
seg000:0140 some_jump: ; CODE XREF: start+1Aj
seg000:0140 dec ax
seg000:0141 sub cx, [bx+si+2Ah]
seg000:0141 start endp

What caught my interest is that I'm not quite sure how this program can print something on the screen?

Since I'm not very familiar with the initial registry values of DOS com-files, I cannot really "trace it in my head", but one thing I can see is that except for two instructions (114 and 118) it only modifies registries and values on the stack, and this should not be able to print out anything on the screen in DOS as far as I know.

My guess is that the instructions at 114 and 118 are some kind of self-modifying code, which produces the correct interrupt instructions at some other point in the code, or that they are writing to some magic operating system addresses, which in turn produces the output of the text, but I'm not sure.

So, are there any old DOS wizards around who'd care to shed some light on it and milden my curiosity? :)

dELTA
disavowed
12-10-2003, 12:45 PM
Normally, I'd point you to:
http://www.geocities.com/thestarman3/asm/eicar/eicarcom.html

But since Geocities is currently saying, "The web site you are trying to access has exceeded its allocated data transfer," you can look at Google's cache at:
http://216.239.41.104/search?q=cache:wPkM-ayROM8J:www.geocities.com/thestarman3/asm/eicar/eicarcom.html
dELTA
12-10-2003, 02:12 PM
:D
Aw, come on, I just wanted to share some little interesting thingy with the rest of you guys, there's been so few posts in the off-topic forum lately. :p

Anyway, seems like my guess about the self-modifying, interrupt instruction producing code was correct. :)
nofurs
12-10-2003, 02:21 PM
hxxp://www.absolutelock.de/construction/infobase.html

There are some infos about dos unpacking maybe you will be interested
disavowed
12-10-2003, 07:17 PM
:D Aw, come on...
i had wanted to put a smiley or something after the picture so as to not offend you too much, but evidently you can't put text after an attached image :)
dELTA
12-10-2003, 09:13 PM
That's what they all say... :p
JMI
12-10-2003, 09:39 PM
Especially if it violates some poor fellow's copyright. :D

Regards.


MFC42 problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MFC42 problem
PDA

View Full Version : MFC42 problem

naides
12-10-2003, 01:03 PM
I am working on an application that has grayed-out menu 'save' options.
I can locate when the app is graying out the disabled options by using the API EnableMenuItem deep inside MFC42 code.
My problem is that I cannot trace my way back into the App code, where the decision enabled or disabled is made.
The Call Stack does not show when my App called MFC42.
If I trace forward from inside MFC42 I never return back to my App code.
The "flag" that signals my menu option as disabled (0x0403)is pushed into the MF42 stack by another MFC42 function, an that one from anther MFC42 and so on to at least 7 layers so BPM on that flags is not useful, unless I wish to reverse all the MFC menu handling routines.

I have found very little documentation on MFC42 internal structure,
so trying to figure out what for instance ordinal 0763 means or does is not helping, nor wich ordinals are used for menu handling routines

Clandestiny wrote a tutorial in which he mentions backtracing from MFC back into the app code, but he did not mention how.

As a side note, I know that ungraying a menu item 'save' is not enough to activating it, but I have already found the code that does the saving, I just need to ungray it, then I can direct it to the right routine.

If anybody has any information about: How MFC and the App comunicate.

Any links to documentation on MFC menu API or MFC in general. Most links I found are not very RCE informative.

Thanks a lot.
esther
12-10-2003, 02:05 PM
Well even msdn lacks of information on these ordinals....

I assume you have read Spath's tutoria on enable menu items....
Kayaker
12-10-2003, 02:56 PM
Hiya

You could check out the search hits for AFX_MSGMAP_ENTRY, both Zairon and Clandestiny wrote something about the structure and it might help. AfxFindMessageEntry function is used to retrieve where MFC messages are checked.

You should also check out the Menu Enabling Project we had, there was one piece of advice - the decision to enable or disable a menu item in a drop down list is usually made when the main menu item is clicked on. So this is why a BMSG on wm_command on the hwnd of the main menu bar is a good message to track...

If your mfc app behaves in a normal manner, when you click on a menu item this should send a wm_command message where wParam is the Menu item ID (any one will do to start with). From this you should be able to find the main (or subclassed) message handling routine, and from there you should find where your 'disabling' routine is *started* from, which is probably what you're looking for, the first 'signpost'. Just set a conditional breakpoint somewhere near the start of the msg handler with the menu item id (wparam) of interest. From the msg handler is where EnableMenuItem is likely called from before it disappears into MFC-land, and you can probably tweak the parameters to your preference right there...

Check out that project and see if the technique might work for you.
http://66.98.132.48/forum/showthread.php?t=126&highlight=menu+enabling

Cheers,
Kayaker
Kayaker
12-10-2003, 04:41 PM
Now that I have a bit more time.. The tricky part with using BMSG messages like this is actually breaking into the apps code, in Win98 I had found that for most apps SI broke into some intermediate system code where the jump address was mysteriously hard coded. It did this presumably through (but not directly part of) the K32Thk1632Prolog/Epilog sequence, which was another way to trace back into application code. This is discussed further in the mini project.

For Win2K I have found a similar thing, for example a BMSG (wm_command, wm_timer, wm_gettext) that I was using with a Delphi app, Softice broke into the short sequence:
Call CF0F8
jmp 41B448 -> exact start of main message handling routine.

This is the same pattern I noticed in Win98. There is likely a similar prolog (system code) -> call to appl. code -> return to epilog (system code) setup in Win2K/XP behind all this as well. The K32Thk1632Prolog/Epilog route was originally mentioned by Lord Soth. At some point I was hoping to find if a comparable Win2K code sequence which jumps from kernel->user is being used, but SI breaking in this manner on BMSG bp's is sort of a 'shortcut' to the msg handler. This should make sense once you've experienced it.

K.
Solomon
12-10-2003, 09:42 PM
It will be easier to trace MFC applications by making a MFC42.NMS from MFC42.PDB which can be got from VC++ 6 installation.

Load MFC42.NMS into SoftICE, then you can read all the symbols in MFC. Be sure that MFC42.DLL matches MFC42.PDB. This also works for MFC70/MFC71 DLLs using MFC70.PDB/MFC71.PDB.
cRk
12-10-2003, 10:53 PM
just set your break point as usual you'll be on the .dll code but after hitting couple of time F8 you'll be on the program code after C3 ;) then you'll see the call in the program code which used the mfc...dll

Regards!
naides
12-11-2003, 04:18 PM
Thank you all for the good will and time. While I am not done with it, I am certainly getting closer to solve the mistery.
Solomon suggestion was particularly helpful. I d/l MFC42.pdb and applied to Sice, and more importantly IDA, along with the VC++ FLIRT, and now most MFC42 ordinal calls have quite explicit names, which I can search in the MSDN site and have a clearer idea about the code.
The miniproject thread also contains some pointers that I was not able to find in Clandestiny and +spath's tuts.
Gr8, Thanks
N
naides
12-22-2003, 02:58 PM
An it did it.
Clandestiny Tut is a gem.

The way I was able to get out of the MFC code woods was by using the Backtrace device and catching the fleeting moments in which the code comes back from MFC42 into the App code. I compared the backtrace when a menu item was enabled with the trace when the menu item was grayed and forced towards the enabled path.

Note on the side: BPR does not work in Athlon AMD CPU (Old News ) and did not work in a Pentium 4. (Using windows 98 of course) Has anybody tried BPR in a P4?


Again Offtopic but related to this new board format.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Again Offtopic but related to this new board format.
PDA

View Full Version : Again Offtopic but related to this new board format.

peterg70
12-11-2003, 06:00 AM
Does this version of vbulletin have an option to display the last 10 active posts etc.

I use Last posts alot to keep upto date and then mark the forums complete so i don't tend to look at which forum the message is in.

Then I want to find it again because I might have done some work for a quick reply and the new posts has been cleared either automatically or by me.

Just thought listing the Last 10 Threads that have had posts would be nice feature.

Another query how does one turn off the Re-directing screen so that it just does it without waiting for a few seconds? I get impatient and have to press the proceed button.

Also Do you mean to allow up to 2MB attachments?? Thought it was alot less.

Attach Files
Maximum file size: 2.00 MB
Valid file extensions: bmp doc gif jpe jpeg jpg pdf png psd txt zip

Peterg70
JMI
12-18-2003, 11:35 PM
peterg70:

There are two options you might try. The first is the link to New Posts on the navbar at the top of the Forums. Second you might save this as a link, which will get you all the days posts, up to the time of your check-in to review: http://www.woodmann.com/forum/search.php?do=getdaily


Winxp & dumping
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Winxp & dumping
PDA

View Full Version : Winxp & dumping

Ray
12-11-2003, 08:03 AM
Hi,
winxp is indeed picky with its dumps. The attachment is just notepad compressed with UPX. it should be an easy job, but winxp refuses to complete it!

After dumping the file, I tried rebuilding the file, but lordPE reports a Non-complete import table. of course the prog does not run.

The only way to make the dump to work is to use revirgin or something similar to recreate the import table.

Is this problem common to all WinXp users here? or am i just messing up?

Thanks.
:confused:
Ray
12-11-2003, 08:07 AM
Oopps:)
nikolatesla20
12-11-2003, 12:32 PM
WinXP is no more picky really than Win2K. But I would try another target other than NOtePad. Notepad is highly specialized for Windows, and uses some esoteric features such as bound imports, blah etc. It's a pain.

-nt20
Ray
12-11-2003, 01:26 PM
nikolatesla20,
thats great.

waiting for your comments.
Ray
12-12-2003, 04:32 PM
Evaluator,
Maybe i wasnt clear.
Upx supposly does not mess up the import. So, a pure dump at EOP will be enough. At least it works on win98 !

But on XP it does not work. Your dump is fine! But you used ImpRec to recreate the import table!
So my question goes again : Why!? is this common?
evaluator
12-13-2003, 03:17 AM
Ah!
So your question is:"Always I must recreate import or no?"
!?

Yes, always.

****
DELE
Ray
12-13-2003, 03:28 AM
thanks for clearing things.


Data file extractors?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Data file extractors?
PDA

View Full Version : Data file extractors?

Aquatic
12-11-2003, 06:30 PM
Is MultiEx the best program for extracting/importing for large data files?

say you want to extract a song, but it is packed in a huge .dat file
dELTA
12-11-2003, 06:41 PM
From known game formats, yes, that would be my guess (I would also guess that XeNTaX is a member of or affiliated with at least one game cracking group :p). Keep an eye on the two spin-off projects Mexcom and OpenMex though (from the same guy), they might be taking over in the future.

You can also use their published multiex.dll file to implement MultiEx's functionality in your own programs.
disavowed
12-11-2003, 06:55 PM
i'm surprised starcraft isn't supported
Aquatic
12-12-2003, 05:34 PM
Writing your own extraction script isn't that hard, it varies depending on the game though.

Extracting images, and media is usually pretty straightforward. The problem comes when you try to understand small extracted data files. Normally they are just a garbled collection of ASCII characters parsed to a file. How are you supposed to make sense of files like this?


RSA 576 factored
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > RSA 576 factored
PDA

View Full Version : RSA 576 factored

mike
12-12-2003, 02:24 AM
In case you hadn't heard, the 576-bit RSA challenge number was factored.

see
http://groups.google.com/groups?selm=87wu9cdtdp.fsf%40nonospaz.fatphil.org
Woodmann
12-12-2003, 08:03 PM
Howdy,

A day or 2 ago, the largest prime number was found.

2 big milestones in the same week :)

Woodmann
JMI
12-12-2003, 10:00 PM
And don't forget that big Millstone, that was lifted off your neck, when the Forum was back up and running. :D

Regards.


Exestealth 2.73 problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Exestealth 2.73 problem
PDA

View Full Version : Exestealth 2.73 problem

thegeek
12-12-2003, 07:56 AM
Hi, first of all I would just like to say that I am forever grateful to the creators and admins of this forum.

Now, to my problem. Lately I've been playing around with some unpacking, and I must confess that I am still very much inexperienced at this great art.
I would however like to learn, and thus I have been playing around with some really simple packers, like upx. Just recently I came across an app packed with Exestealth 2.73, i was initially at a complete loss of how to approach it.
After some research(google ;) ) I managed to discover that the packer is more or less a complete rip of yodas crypter.
With this information I proceeded to attempt unpacking, aided with a great howto by CoDe_InSiDe.
It is however for v. 1.1 of yoda's crypter, and I suspect that exestealth is based on 1.2.
In the howto the following code is mentioned:

xor al, al - al = 00
lea edi, [ebp+00401C84] - Point edi to the beginning of the Decryption Routine.
mov ecx, 0000063E - Move 0000063E in ecx
stosb - And remove...
loop 0040D69E - 1598 (63E) Bytes (He could also use "repz stosb" ;).
lea edi, [ebp+004022DE] - Point edi to the end of the Decryption Routine.
mov ecx, 000002E8 - Move 000002E8 in ecx
stosb - And remove...
loop 0040D6AC - 744 (2E8) Bytes (He could also use "repz stosb" ;).
popad - Pop all Registers back.
mov eax, FFFFFFFF - Move FFFFFFFF (It'll be the OEP) in eax.
push eax - Push eax onto the Stack.
jmp 0040D6B9 - Jump to 0040D6B9 (Skip the Junk Byte ;).
Junk Byte (87)
ret - And go to the OEP.
I have successfully located this code, and hopefully bypassed all the checks that are located earlier in the code.
However
In my target, the code in question is different:
0048C7C7 32C0 XOR AL,AL
0048C7C9 8DBD B6274000 LEA EDI,DWORD PTR SS:[EBP+4027B6]
0048C7CF B9 35070000 MOV ECX,735
0048C7D4 AA STOS BYTE PTR ES:[EDI]
0048C7D5 ^E2 FD LOOPD SHORT winupdat.0048C7D4
0048C7D7 8DBD 482F4000 LEA EDI,DWORD PTR SS:[EBP+402F48]
0048C7DD B9 90050000 MOV ECX,590
0048C7E2 AA STOS BYTE PTR ES:[EDI]
0048C7E3 ^E2 FD LOOPD SHORT winupdat.0048C7E2
0048C7E5 61 POPAD
0048C7E6 50 PUSH EAX
0048C7E7 33C0 XOR EAX,EAX
0048C7E9 64:FF30 PUSH DWORD PTR FS:[EAX]
0048C7EC 64:8920 MOV DWORD PTR FS:[EAX],ESP
0048C7EF EB 01 JMP SHORT winupdat.0048C7F2
0048C7F1 8700 XCHG DWORD PTR DS:[EAX],EAX

As you can see there is no ret, and the code is a bit different.
I have tried inserting a ret, but the mem adress is clearly just filled with junk.
What have I done wrong, is this just some attempt to divert me?
I can monitor the memory area where I know the file will be unpacked, and then break there, but the code that writes it is seemingly unconnected to this part of the app.

Please, help a noob :rolleyes:

The howto I have been following is : MUP_Yoda's_Crypter_v1.1.zip
A simple search on google will immediatly locate a location to download it
:)
naides
12-12-2003, 09:42 AM
0048C7C7 32C0 XOR AL,AL
0048C7C9 8DBD B6274000 LEA EDI,DWORD PTR SS:[EBP+4027B6]
0048C7CF B9 35070000 MOV ECX,735
0048C7D4 AA STOS BYTE PTR ES:[EDI]
0048C7D5 ^E2 FD LOOPD SHORT winupdat.0048C7D4
0048C7D7 8DBD 482F4000 LEA EDI,DWORD PTR SS:[EBP+402F48]
0048C7DD B9 90050000 MOV ECX,590
0048C7E2 AA STOS BYTE PTR ES:[EDI]
0048C7E3 ^E2 FD LOOPD SHORT winupdat.0048C7E2
0048C7E5 61 POPAD
0048C7E6 50 PUSH EAX
0048C7E7 33C0 XOR EAX,EAX ; EAX is now 00
0048C7E9 64:FF30 PUSH DWORD PTR FS:[EAX] ; Sets a typical SEH frame
0048C7EC 64:8920 MOV DWORD PTR FS:[EAX],ESP ;
0048C7EF EB 01 JMP SHORT winupdat.0048C7F2; Jump to the middle of next isntruction.
0048C7F1 8700 XCHG DWORD PTR DS:[EAX],EAX ; now the code reading frame is different.

I think the unconditional JMPS at 48C7EF is the beginging of obfuscated code: The next instruction starts with the 00 byte after 87, while in Yoda's code, it was C3 (ret).
I also suspect, but cannot tell for sure from the Info you provide, that the protector sets up a SEH, further down this code raises an exception, and the SEHandler continues the Execution of the code at the OEP.
thegeek
12-12-2003, 10:28 AM
ah, thank you, that might be of some help :)
lownoise
12-12-2003, 02:40 PM
It's indeed what naides said. It's setting up a SEH frame and when the code raises the exception it will continue at the OEP.
This packer is a nice example to learn the basic of unpacking a file. the code is good to follow. If you success in unpacking the file maybe a nice protect is to code a unpacker for it. I know there's a nice unpacker available for it (with masm sourcecode) where you can learn from.
Good luck
yaa
12-13-2003, 06:49 PM
I've found an unpacker for ExeStealth 2.73 (by Smoke) but no source code is provider :o :o :o

yaa
lownoise
12-14-2003, 07:20 AM
Google is you best friend :D
search and you'll find the unpacker with masm sourcecode :)
yaa
12-14-2003, 07:59 AM
Google is always my friend ... it was my friend also yesterday when I search and did not find anything (apart Smoke's source-less unpacker). Today I have found an unpacker for ExeStealth with source code but it is for the 2.82 version.

yaa


OllDbg: Memory Log
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > OllDbg: Memory Log
PDA

View Full Version : OllDbg: Memory Log

nexus
12-12-2003, 07:07 PM
I'm debugging a fullscreen directx application. I want to log memory writes on a particular location. I can't set a mem write breakpoint because I can't swap screens. How can I do? Will Ollydbg ever support network debugging? or will log memory access?

Thanks.
Aimless
12-13-2003, 07:13 AM
So what's wrong with using softice??

Have Phun
nexus
12-13-2003, 12:24 PM
So what's wrong with using softice??

Only if everithing else will fail.


Impossible to Dump??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Impossible to Dump??
PDA

View Full Version : Impossible to Dump??

cRk
12-13-2003, 09:59 PM
i have tried all Best Dumpers, Pe Editors or tools available on the net...i haven't been able to use SoftiCE + icedump neither... is it this Xtreme Protector really Impossible to do Anything with it? :confused: at least i want to full dump this ....

Program Name: Jazler XP

all dumpers fail/crash!

Protection Done by Old Latin Crackers ?? i see their Purpose was learning to crack not to help the scene at all.. now they're making money with this Protector :mad:

i assume some good Coders are doing something at this moment to beat this Beast/Devil that betray God like Judas did :mad:
yaa
12-14-2003, 07:03 AM
I found this whitepaper on it: h**p://utenti.lycos.it/lucevirtuale/xprotectorwhitepaper.pdf

Since it is written by xprotector's own makers it won't probably contain anything "useful" but maybe it can give someone an idea or two ;) ;) ;)

yaa
cRk
12-14-2003, 10:34 AM
thanks for editing Woodmann . i thought was right by giving indirect link for the app. here. note i'm not writing any specify code for it here! :)

Anyone who would like to check it out please.. PM me

Regards!


Memory Breakpoint In Execution Only?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Memory Breakpoint In Execution Only?
PDA

View Full Version : Memory Breakpoint In Execution Only?

Ricardo Narvaja
12-14-2003, 05:44 PM
Sorry for my bad english, i try to explain.

When i question to OLEH, the author of OLLYDBG, why OLLYDBG not have the posibility of put a MEMORY BREAKPOINT in EXECUTION ONLY, in a section to easy reach the OEP, with no stop in read and write access to the section, he tell me this possiblity is only for XP, and he not want more differences between version of 98/ ME and NT/2000/XP.

I try investigate this posibility of memory breakpoint on execution only in a section, and in all web pages i see, tell if a program has READ permision is imposible NOT HAVE EXECUTION PERMISSION TOO.

But in armadillo without copymem2 if you put a breakpoint memory on acess, the program not stop in read or write access and stop in the OEP when execute acess is triggered.

How is possible armadillo make this if WEB PAGES SAY IS IMPOSSIBLE,
i think maybe is possible use this for make a plugin for ollydbg for make memory breakpoint on execution only?
Anybody know more of this topic?

Ricardo Narvaja
evaluator
12-15-2003, 05:43 AM
Are you about DRx registers execution break,
Or about page_guard acess?
Ricardo Narvaja
12-15-2003, 12:36 PM
if you go to VIEW-MEMORY in the sections you can pu a MEMORY BREAKPOINT ON ACCESS, MEMORY BREAKPOINT ON WRITE, but yo cannot put a MEMORY BREAKPOINT ON EXECUTION ONLY in a section, for reach the OEP and stop without stop in read and write access.

I'm NOT talking about hardware breakpoints (DRX), only the possibility of MEMORY BREAKPOINTS ON EXECUTION.

Bah my english is terrible forget the question :-(

Ricardo

xp://ftp.ti.com/pub/graph-ti/sw-apps/derive/setup.exefxp://ftp.ti.com/pub/graph-ti/sw-apps/derive/setup.exe

Are you about DRx registers execution break,
Or about page_guard acess?
evaluator
12-15-2003, 03:05 PM
As I know, you are NT-based_OS user.
If you take time, look, how works BPR on W9x;
it can help you.
volodya
12-16-2003, 11:34 AM
evaluator

I guess, it won't be THAT easy to help. As far as I know Intel Architecture, there is no such bit as EXECUTE in PTE. Only read or write. The execution option can only be set for the whole segment using GDT. Which is NOT acceptable! So, seems there is no way.
Ricardo Narvaja
12-16-2003, 12:32 PM
Thanks

Ricardo

evaluator

I guess, it won't be THAT easy to help. As far as I know Intel Architecture, there is no such bit as EXECUTE in PTE. Only read or write. The execution option can only be set for the whole segment using GDT. Which is NOT acceptable! So, seems there is no way.
volodya
12-16-2003, 12:44 PM
Ricardo, read this
http://www.anticracking.sk/EliCZ/import/Vx86.txt
Ricardo Narvaja
12-16-2003, 01:36 PM
Yes seems very interesting thanks.

Ricardo

Ricardo, read this
http://www.anticracking.sk/EliCZ/import/Vx86.txt
dELTA
12-16-2003, 02:28 PM
What I think evaluator might be meaning is to use a page guard on the entire page of the desired execution breakpoint, and then in the page fault handler check if the EIP is on the breakpoint position. If it's not, just reset the page guard and continue as if nothing happened, but if it is, break. You will effectively be tracing every instruction in the 4k page of the breakpointed instruction, but if it does not contain any heavy loops you should not notice the slowdown very much.

Am I wrong?
volodya
12-16-2003, 02:48 PM
There is a lot of information about it. I would advise to study the source code of IceExt developed by Sten. You all are, perhaps, still using icedump. So IceExt is better. Try.
It contains experimental bpr command.
As to your remarks, dELTA. Intel Manual #3. Chapter "PAGE-LEVEL PROTECTION". For example, WinXP uses CR to prevent the access to SDT/SST tables. It is possible to get rid of the protection, using

mov ebx,cr0
push ebx
and ebx, not 010000h
mov сr0,ebx
;
;here we do what we need
;
pop ebx
mov cr0,ebx

It is also possible to watch the content of the CR-register from ring-3 using smsw assembly command. Here I'm attaching THE SVIN's program which explains you the content of the CR0 register


Tool to find caves into an app to add extra code???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tool to find caves into an app to add extra code???
PDA

View Full Version : Tool to find caves into an app to add extra code???

yaa
12-14-2003, 06:06 PM
Hello,

I remember once having found a tool (that I lost or anyhow can't find anymore) that could identify caves to add code inside an application. Does anyone know/use one??? Knowing it's name would be enough.

yaa
Ricardo Narvaja
12-14-2003, 06:29 PM
TOPO
SNIPPET CREATOR

are in my FTP in Herramientas

Ricardo Narvaja
JMI
12-14-2003, 06:32 PM
The search button will find some discussion of this issue here. For example;

http://66.98.132.48/forum/showthread.php?t=4589&highlight=empty+space.

One such tool, but probably not the automated tool you might be looking for, is a hex viewing tool. Looking at the sections of the pe file, will show you where all the empty space is located. :cool:

Code Snippet is also available from the author, here:
http://win32assembly.online.fr/source1.html

Topo may also be found here, along with a couple of other useful tools: http://f0dder.schwump.net/tools.htm

Regards.
dELTA
12-14-2003, 09:12 PM
A couple of years ago I wrote my own exe analyzer just for fun, while looking into the MZ and PE format. I never released it to anyone, but since it contains quite cool cave finding and cave analysis abilities, which I have never seen in any other program, I'll upload it here now for anyone to play with. You can also feel free to distribute it to anyone or upload it anywhere, I don't care.

But note that the program is just my own little ugly dirty hack, so I won't support it, the GUI isn't exactly the most beautiful, and I won't guarantee it won't crash and so on, but it has been quite stable while I have played around with it anyway.

It analyzes quite many aspects of the executable file, but the one feature you would be interested in for this particular situation is the bunch of tools under "Extended executable info (PE)" ---> "File anatomy & offsets". It will give you details of all section padding areas (caves), and it will also automatically find any area inside the executable file which does not belong to any section (I actually found an alignment bug in a compiler/linker with this tool, which left a 512 byte block of null-bytes between two sections in the middle of the compiled file, ready to be exploited as a megasize-cave :)), including any data which is appended after the last section of the file. Quite useful sometimes. But the really juicy stuff will be found when you select a section in the box to the right and click "Show detailed map". It will the give you a graphical overview on the screen, of each and every single byte in that section. You can even click inside the graphic map to select any area and see what it is (click and hold down the mouse button and drag the mouse over the map for extra fun). This is very cool for "getting a feel" for how a certain linker/packer/whatever builds its sections, and also for finding "micro caves", consisting only of a few bytes, in the middle of a section! You can choose to display an analysis map of the free space or the used space of the selected section by clicking the radiobuttons on the upper right of the map.

Take a look and see if it's any helpful, I hope someone will find it useful anyway.

dELTA
disavowed
12-14-2003, 09:59 PM
neat

and it distracted my girlfriend with the colors ;)
Kayaker
12-15-2003, 03:57 AM
What a strange and interesting feature - a program pixelator! Yeah, neat ;)
JMI
12-15-2003, 04:10 AM
That's because nearly everything is white up where dELTA lives. :D He needs to play with the colors and got a 60 inch TV to add more color to his interior landscape. :cool:

Regards.
+SplAj
12-15-2003, 07:44 AM
I remember something called 'topo' useful for such tasks......I think it was WKT release ???
SpeKKeL
12-15-2003, 08:12 AM
I remember something called 'topo' useful for such tasks......I think it was WKT release ???

yep,..have it on my HD > topo 1.2 by Mr.Crimson/[WkT!2000].

SpeKK.
dELTA
12-15-2003, 08:19 AM
Wasn't there also some tool called "topo" that could do this? :D

(see posts above to understand this utterly funny joke :p)
+SplAj
12-15-2003, 09:30 AM
nope , just 'topo' :p
evaluator
12-15-2003, 03:31 PM
delta,
I dld your prog & found, that you are(or was) crasy depli coderz..

Little kiddi fact:
I loaded into your program itself.
then >section data anatomy - Entry code section data.

It prints warning: "(Warning, file might be virus infected!)"

shit, you infect me!? (:)

**
try pack with RAR or WINACE before zip..save The Server;)
dELTA
12-15-2003, 04:01 PM
Yeah, I know, if the entry point is within 512 bytes (or something like that) of the end of the section, it gives that warning. I guess I thought it was a funny feature, maybe because I was experimenting some with viruses myself at the time, or because there are so little colors and other features in the analysis map of the code section compared to the other type of sections. :p Anyway, after doing this I noticed that Delphi itself likes to put the entry point of its exes very far back in the code section, but at that point I couldn't be bothered removing the feature anyway, especially since I didn't ever count on releasing the program to anyone else. :)

Also, thanks for your consideration for the board server disk space, if the board ever goes down due to lack of disk space you can blame me. :)
Kayaker
12-15-2003, 04:37 PM
...I was experimenting some with viruses myself at the time...

I had a feeling that's why someone might be so interested in "micro" caves... Who TF normally cares about 2-10 byte caves in the rsrc or import section anyway? :p
dELTA
12-15-2003, 05:02 PM
Actually, this feature was originally created to verify that I had a complete understanding of the PE format section layouts and hadn't missed anything, but sure, it can be useful for some other cool stuff too... :D
Ricardo Narvaja
12-15-2003, 05:32 PM
In my FTP i have TWO TOPO.

TOPO1.2 what trigger a false warning of virus, and TOPO REPARADO, this version have noy trouble with antivirus.

Ricardo

Yeah, I know, if the entry point is within 512 bytes (or something like that) of the end of the section, it gives that warning. I guess I thought it was a funny feature, maybe because I was experimenting some with viruses myself at the time, or because there are so little colors and other features in the analysis map of the code section compared to the other type of sections. :p Anyway, after doing this I noticed that Delphi itself likes to put the entry point of its exes very far back in the code section, but at that point I couldn't be bothered removing the feature anyway, especially since I didn't ever count on releasing the program to anyone else. :)

Also, thanks for your consideration for the board server disk space, if the board ever goes down due to lack of disk space you can blame me. :)
yaa
12-15-2003, 07:29 PM
Thank you all people, you have been very helpful.

Ricardo, I remember having tried topo in the past .... strangely its interface did not show properly on w2k. The last corrected version works fine however.

JMI, thank you for the links.

dELTA, my compliments for your very nice and complete tool. Most useful for sure.

yaa
evn
12-19-2003, 05:42 AM
Ah thats the name i was looking for, topo.

yaa, you don't happen to have a link to where you found the 'fixed for 2k' version do you? I tried Ricardo's ftp (found in a prev. post), but failed to connect. Any help would be appreciated.

-evn
JMI
12-19-2003, 07:24 AM
evn:

I believe if you do a search on this forum, you will find the passwords for Ricardo Narvaja's ftp. They are also listed over on the exetools forum. His' nick over there is ricnar456.

Regards,
evn
12-19-2003, 10:34 AM
@JMI
I wouldn't have posted unless i'd already searched; which i had. I found the ftp, but its either down or changed, as it doesn't get further than:

[R] Connecting to ricardo -> IP=xxx.xx.xxx.xxx PORT=21
[R] Connection failed (Connection timed out)

I'm sure that it'll come back up in time, i was just looking for a quick way out ;)

I checked exetools, that nick doesn't exist, and no posts with his site in it were found.

Ah, back to google :)

-evn
JMI
12-19-2003, 01:16 PM
evn:

There are indeed posts on the exetools site with the nick "ricnav456." See:

http://www.exetools.com/forum/search.php?s=&action=showresults&searchid=194953&sortby=lastpost&sortorder=descending

I did not check them to see if the ftp and password were posted over there because I knew it was posted here:

http://66.98.132.48/forum/showthread.php?t=4810

Using that information and FlashFXP I am logged into his FTP as I write this response. It doesn't work from IE, at least it doesn't for me, but I have no problem, other than a deficiency in Spanish language skills from accessing his site. :cool: Although I did not see the TOPO REPARADO with the TOPO and the TOPT 1.2. Maybe he'll tell us exactly where that one is. :D

Regards,
Ricardo Narvaja
12-19-2003, 04:04 PM
is working and in the carpet HERRAMIENTAS is

topo12CORREGIDO.rar

mi FTP is

ftp://curso:curso@ricnar456.no-ip.org/

user:curso
pass:curso

carpeta NUEVO CURSO-TEORIAS

Ricardo Narvaja

evn:

There are indeed posts on the exetools site with the nick "ricnav456." See:

http://www.exetools.com/forum/search.php?s=&action=showresults&searchid=194953&sortby=lastpost&sortorder=descending

I did not check them to see if the ftp and password were posted over there because I knew it was posted here:

http://66.98.132.48/forum/showthread.php?t=4810

Using that information and FlashFXP I am logged into his FTP as I write this response. It doesn't work from IE, at least it doesn't for me, but I have no problem, other than a deficiency in Spanish language skills from accessing his site. :cool: Although I did not see the TOPO REPARADO with the TOPO and the TOPT 1.2. Maybe he'll tell us exactly where that one is. :D

Regards,
Ricardo Narvaja
12-19-2003, 04:09 PM
well is topocorregido, sorry
I haven't windows 2000, but this topo don't trigger antivirus, and if you say work in w2000 better.

Ricardo
JMI
12-19-2003, 04:30 PM
That was the other one I downloaded, but hadn't opened it yet. Thanks. ;)

Regards,
evn
12-20-2003, 02:18 AM
Ah yes, the ftp is working this time i tried. Im not sure if it was me or the server, but all's well now ;)

oh, and btw, following the link JMI posted to the exetools search page, i get:

vBulletin Message
Sorry - no matches. Please try some different terms.

I probably needed to be logged in, but im getting no results from the search ;)

Thanks for the help.

-evn
JMI
12-20-2003, 03:02 AM
evn:

I did notice some bumping, or timeout with the ftp, but it reconnected right away. Maybe there was a heavy user load when you tried.

I did go to the Forum and log out and tried the search function and it did not work. Logged in it works from there, or from the browser with the link I gave you. So it is a cookie issue.

Regards,
yaa
12-22-2003, 02:20 PM
evn,

if you still haven't got it, here it is bundled with a few other sample files.

yaa
cRk
12-23-2003, 09:13 PM
i've seen topo is very useful but also noted that almost noone knows about this little one? very useful as well to add a .new section :)

it is called zeroadd

Regards


Crypto crackme: MD5 + DES
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crypto crackme: MD5 + DES
PDA

View Full Version : Crypto crackme: MD5 + DES

lordor
12-15-2003, 01:36 AM
this is Nuke's teaching crackme,here is No.1
please provide serial or keygen.

lordor
03.12

update again,had translate into english,and don't packed the program.

12.16
evaluator
12-15-2003, 10:10 AM
I decided to translate crackme's rsrc to inglesh using PExplorer.
I hope, I correctly guess chinese!?
but there are also chinese strings in .data for MessageBoxes..
Hey, Solomon..
lordor
12-15-2003, 09:05 PM
I decided to translate crackme's rsrc to inglesh using PExplorer.
I hope, I correctly guess chinese!?
but there are also chinese strings in .data for MessageBoxes..
Hey, Solomon..

sorry,this is my first time to release here,I had updated again,had translate into english,and don't packed the program.
please down load again.
Kayaker
12-15-2003, 09:29 PM
Hi lordor,

If you're having problems uploading that file again, there could be 2 reasons. VBulletin uses kind of a funny system for uploading files, your original file called 'crackme1.zip' actually still exists on the database under your name, even though you think you've deleted it.

This doesn't allow you to upload a new file of the same name, you may have gotten a "attachment already exists" error. The file needs to be physically deleted from the database by one of our kind moderators in that case... which I just did. So you can try once again to upload the file (or you could have changed the name).

Anyway, since I saw you online updating the post but without an attachment, I thought you might be having this problem, so please try again. The crackme looked good so I transferred your post here to the Project forum.

The other issue is that I think popups need to be enabled since VBulletin uses a separate window for uploading attachments, I usually forget and get kicked out of the posting page and then there's no attachment, then I'm forced to swear repeatedly because I have to go and physically delete the attachment from the database before I can try again...

Kayaker
Solomon
12-15-2003, 11:36 PM
Hi eval,

I seldom browse this section(Mini project area) of this forum.

To lordor:
please re-compile your keygen using English strings.
lordor
12-16-2003, 12:01 AM
Hi eval,

I seldom browse this section(Mini project area) of this forum.

To lordor:
please re-compile your keygen using English strings.

ok,had re-compile again.
ZaiRoN
12-20-2003, 01:35 PM
Hi lordor.
Thx for your crackme! It seems to be very interesting and it represents something unusual for this area; infact, if you want to solve it, you have to know something about crypto-stuff.

When you run the crackme, it shows two boxes, the 'serial' and the 'key' boxes. The first one contains a number and the second box is empty. Due to the fact that the crackme wants a valid Serial/Key combination to be registered, first of all we have to find what is the number written in the Serial box.

The Serial is a number obtained by the xor between the volume serial number and the value 0xABCDE123. How did I found this information? Which are the possible functions capable to set the text of an edit box? SetDlgItemText and SetDlgItemInt for example; a simple observation of the disasm reveals that the function is SetDlgItemInt...

The protection routine starts with the GetDlgITemInt function at 40240F. The protection routine uses two different algorithms: MD5 and Des.
I am sure about the MD5; it is applied to the 'Serial' (in his *signed* version). I am not totally sure about Des; I think that 'key' is used at the same time like key and plaintext of the Des algorithm... can someone confirm this?

Later,
ZaiRoN
lordor
12-22-2003, 04:17 AM
hi,ZaiRoN

I think you are the first one to find out DES in this crackme.yes,It used standard DES algorithms.and DES's key is in the program.

lordor
0xf0001
01-18-2004, 01:09 AM
hi,ZaiRoN

I think you are the first one to find out DES in this crackme.yes,It used standard DES algorithms.and DES's key is in the program.

lordor

The cryptoanalyzer plugin for PEid does a good job ;)
just want to recommend it hereby for those asking how the h... to figure out as a starting point... (it also tells us about the crc32 :cool: )
Foreigner
01-18-2004, 01:18 PM
The cryptoanalyzer plugin for PEid does a good jobI think these types of tools are useless if you can't deal with the crypto algo. Does it show you the key?

foreigner
0xf0001
01-19-2004, 09:22 AM
hi!

no it does not, and it cant. thats clear. but: it gives you quickly the information where to start. and that you see it might be a standard algo so you know which docz you have to download that will help you. if i for example do not know it and cant discover that algo type myself i was helped by this plugin because i can have much information about the used algo type on the web. and i know i am helped on this topic by many researchers that have worked on it before.

nobody has to use this tool. and nobody has to like it :) for experienced guys maybe u can say it is useless.

i only wanted to give the hint for those who read this thread and are not so experienced - hey they can try it out and - for example i did not see anybody to mention fo example in the codelock issue that blowfish is used. only talking about what it could be some this or that... once you know you can read about blowfish implementations and understand better or lets say faster what is going on in the pcode.

i didnt wanted this topic to be discussed so much, just wanted to give the hint. it is not because i want to say / hey i am cool i know the plugin. no. this should be a hint on this topic for unexperienced guys that maybe get scared because they cant figure out such info theirselfes. and there i think are a lot of guys who start here, read and include this into their toolset. thats good i think.

i mean you can say for example every posting about pe headers is useless here just because you are an expert on this. thats ok, and you need not read it.

last to say it is my attitude to say information is power - so why not help people to get information. and it fits to this topic i think. so sorry that i bothered you maybe with this posting. maybe someone was helped by it - maybe not.

i for example use this plugin sometimes for a starting point to have a quick (but not 100% sure) info what i will have to deal with. does it do crc, ...? i know i will see it in the deadlisting anyway. yes. but thats not the point. got me?

[edit] yes here it is shown in the subject what algo is used so my posting indeed was useless for _this_ crackme :)

regards, 0xf001
ZaiRoN
01-19-2004, 02:12 PM
Hi 0xf001,
i only wanted to give the hint...I like to see this kind of post, thx 0xf001.yes here it is shown in the subject what algo is used so my posting indeed was useless for _this_ crackmeIt's not useless, you gave a way to discover the algo ;)
Have you solved the crackme?

Best regards,
Zai
0xf0001
01-19-2004, 03:09 PM
hi zai! thats a rime and what rimes is good we learned some years ago .... :)

sorry to myself, but i did not work on this crackme _yet_. i have big amounts of work to do (my own fault ggg) and as i registered on ryans site to try to crack codelock i have another project, too now and a deadline in about 30 days yup :) but i find this one interresting and scheduled it.
so my posting was too early :)

i mean i do not really like that because i also want to work on it and discuss the progress and exchange memory :) so i think i will reconfigure the task scheduler tonight ... (btw. red bull figured out to also go into my toolset :))

greetz, da 0xf001
elooo
06-17-2004, 03:41 PM
I am not totally sure about Des; I think that 'key' is used at the same time like key and plaintext of the Des algorithm... can someone confirm this?

Later,
ZaiRoN

I think the same thing but only for the first part of encryption.
I saw this if I give 1234567890123456 for the "key" :
- First part of Des encryption will use :
0012F938 12 34 56 78 90 12 34 56 4Vx?4V
to crypt the first part of the "key" I've done.
- Second part of Des encryption will use :
0012F940 F0 EE 5E 00 01 00 00 00 ðî^....
to crypt the second part of the "key" I've done.
F0EE5E0001000000 is a constant.

The serial is the volume serial number of our C:\ xor ABCDE123h and converted in decimal (in "unsigned" version).

If the first part (16 chars) of the hash (md5) of the "signed" version of serial number = encrypt_DES (key_des, "key") we are registered.
But the key_des is different (cf above) for the encryption of the first part of the "key" (8 chars) and for the second part (the last 8 chars).
For the second part of encryption the key_des is always F0EE5E0001000000 but for the 1rst part the key_des is the "key" we've done (value put in a buffer like a hexadecimal value).

But it is possible I've done some mistakes... What do you think about it ?

Sorry for my very bad english :cry:
And sorry to answer to this old post.

Regards,

elooo


Hasp4 ID
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hasp4 ID
PDA

View Full Version : Hasp4 ID

cah
12-15-2003, 12:54 PM
How to edit/change hasp4 id parameter of hasp4 lock?
Is any flash utility to change hasp id for hasp4 lock?

Is there any tool like haspgrab.exe for hasp4 locl? if not how to code it?
any help is highly appreciated

CaH


remove HASP4 at customise app.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > remove HASP4 at customise app.
PDA

View Full Version : remove HASP4 at customise app.

nalsur8
12-16-2003, 08:25 PM
i have i application customise routine (VLX,ARX,LSP file running with
AutoCAD)the file is protect and using the HASP4 dongle, i try to find
HASP file but only i found is

hasp95.dll
hasp95dl.vxd
hasp.dll

how to remove the dongle or put the emulator
and i can run w/out HASP dongle, any body out there
can help me step-by-step how to remove it using
W32dsm or softice (but softice im not very good)
naides
12-16-2003, 10:26 PM
i have i application customise routine (VLX,ARX,LSP file running with
AutoCAD)the file is protect and using the HASP4 dongle, i try to find
HASP file but only i found is

hasp95.dll
hasp95dl.vxd
hasp.dll

how to remove the dongle or put the emulator
and i can run w/out HASP dongle, any body out there
can help me step-by-step how to remove it using
W32dsm or softice (but softice im not very good)

Start by looking down in this page: CrackZ archives. You will find rather extensive docs and tutorials about Dongles, and HASP in particular.
That should take you closer to what you want to do.

Once you get into some interesting code, or have more specific questions you may post again, and some one will give you some pointers
CrackZ
12-17-2003, 07:19 PM
Hiya,

You won't do much with the HASP drivers (unless you are going to rewrite them), this sounds like a job you aren't prepared for ;-). This leaves you with the option of patching the high level HASP API (eminently possible), although the interface has changed somewhat from the old API described on my site.

Shortly I will write a brief documentation of the new API convention (registers) and description of a simple way to once again find an easy place to include ones HASP emulator code.

Digressing once again, if anyone out there is SERIOUSLY interested in collaborating (moreover analysing / bug-testing Hardlock/HASP latest vagaries), drop me an e-mail. Without revealing vast amounts of details, I have spent nearly 9 months constructing various working hardlock drivers from the kludge that Aladdin now provides (some 600k of complete and utter junk at last count of v4.95), including all the previous versions too ;P.

Regards

CrackZ.
dELTA
12-17-2003, 09:29 PM
That sounds pretty hardcore to me, aren't you supposed to be retired? :p


Someone feed me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Someone feed me
PDA

View Full Version : Someone feed me

kataklismic
12-16-2003, 08:58 PM
:confused: Man I have just been trying to learn bruteforceing for the last year and a half and i still can't get in ANYWHERE. Probably my lame wordlist though. But now I've been learning a LITTLE about the cgi-bin and it seems fun. I just want one of them to show theirself. can i get some love?

be gentle :D


Need help on P-Code.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help on P-Code.
PDA

View Full Version : Need help on P-Code.

mr.x
12-17-2003, 11:11 AM
Hello,

Does anybody here have knowledge in P-Code. I need help.

Thanks
JMI
12-17-2003, 11:54 AM
You obviously have not read the FAQ linked at the bottom of the Forums. Put "P-Code" in the search drop down menu found at the top of the Forums and you will find many threads about P-Code. Read those and then come back and ask a more specific question.

Regards,
disavowed
12-17-2003, 12:38 PM
http://vbdebug.cjb.net/
mr.x
12-18-2003, 09:32 AM
http://vbdebug.cjb.net/

Thanks!
mr.x
12-18-2003, 12:28 PM
I just can download P-Code Loader only... how is the next?! I do not get anything as the screenshot.
cRk
12-19-2003, 01:28 AM
take JMI advice.....

and check this -->

tool --> hxxp://jbduc.iespana.es/jbduc/downloads/tools/betaexdec.zip

some info -> hxxp://www.caesum.com/handbook/rev.htm

Tuto ---> hxxp://www.learn2crack.com/218.zip

now learn & enjoy :)
JMI
12-19-2003, 07:04 AM
Learning how to search IS one of the most important functions of reverse engineering. :D In a folder labeled P-Code on my HD, I have a small program called JumpGen, which appears to generate a P-Code jump instruction from one addres to another. I've never used it, so I can't confirm if it works or if it will do what you want. Search for "jumpgen.exe" on the net. If you can't find it after some searching on your own, I'll attach it here. :cool:

Regards,
mr.x
12-20-2003, 12:27 AM
Thanks to all reply


Anti-Smartcheck Code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Anti-Smartcheck Code
PDA

View Full Version : Anti-Smartcheck Code

Oloron
12-18-2003, 04:54 AM
hey ppl, just a quick question here, looking for input on anti-smartcheck routines in Visual Basic, my target , upon loading into smartcheck produces the following error:

The Instruction at 0X73DD1351 referenced memory at 0x00000004. the memory could not be 'read'

does anyone have any suggestions on what method(s) are being used to prevent me from loadin the app in Smartcheck?
nikolatesla20
12-18-2003, 10:41 AM
hey ppl, just a quick question here, looking for input on anti-smartcheck routines in Visual Basic, my target , upon loading into smartcheck produces the following error:

The Instruction at 0X73DD1351 referenced memory at 0x00000004. the memory could not be 'read'

does anyone have any suggestions on what method(s) are being used to prevent me from loadin the app in Smartcheck?

Usually they will look for the SmartCheck window, or the SmartCheck window class. ALso they could check for SmartCheck's exe running in the process list, or even to see if they are being run by a "parent" process.

All of these items can be defeated.

-nt20
yaa
12-18-2003, 05:25 PM
ok, for the window class and ok for the running process ... but nikolatesla20 what do you mean by the window or the parent process (you mean that the application is being run by a parent process or is the same context)???
Once you change the application's name and the name of the window class that gets registered I believe there should be no other way to detect it

yaa
Oloron
12-18-2003, 05:50 PM
i've hacked my smartcheck to make a window class of Booyah00 and the title of the app is Oloron, i even changed the exe's filename so process watchers would not see it, but still no luck, this program was previously packed/crypted by y0da cryptor 1.2, i uncrypted it with a tool from the web , and rebuilt the iat with imprec 1.6 to get it to run again, but still no luck running in sc, is this residue from the packer? if so how can i find/remove it?
dELTA
12-18-2003, 06:50 PM
Why don't you try tracing the app in a normal debugger and see what it does just before it exits? If it's a residue from some packer, the detection will most likely be done in pure asm and also be executed before any messy VB djungle.

Also, you can easily see if uses any "parent detection tricks" by executing it standalone, while Smartcheck is running in the background. Will it still exit in this case? If not, it's probably using some parent detection trick or debugger API for the detection.
zacdac
12-18-2003, 06:57 PM
Smartcheck can be detected with a call to IsDebuggerPresent or the equivalent asm code ...

But there may be no anti smartcheck stuff at all. Smartcheck is easily confused. Use OllyDbg to see if it will run under an application debugger.

ZD
dELTA
12-18-2003, 07:03 PM
Yep, that's what I meant with debugger API...
Oloron
12-18-2003, 10:22 PM
ran under olly, the program ran just fine, no breaks on IsDebuggerPresent ;) that was ruled out a while back, ran the program on its own with smartcheck running as a seperate process, nothing, the app ran fine. i'm at a loss.
Oloron
12-18-2003, 10:28 PM
its hard for me to figure out how to get teh program to jump into its 'defensive' mode, where this anti-sc code is at, i can't reproduce the situation in a debugger as it only happens in smartcheck, i have come across problems with rebuilt apps before, mostly the first section has C0000040 characteristics, but in this its E0000020 , so all is good as far as a debugger is concerned..
cRk
12-19-2003, 01:52 AM
which smartcheck version you got??? try to handle the settings /configuration maybe you're missing something

to permanently kill Isdebugger present you can also patch the kernel32.dll

at the ordinal export call at the beggining of the code in my Win98SE i patched with 90 from BFF946F6 to BFF94701 the rest will be 33C0C3 which tell the system no debugger is present... means return eax with value=0

if you can handle it, go and patch but only if you're sure how to do it.

Regards
Oloron
12-19-2003, 03:13 AM
smartcheck 6.03 1103 is my build of sc, there is no IsDebuggerPresent as i have run it through Olly and no break on that api
Ricardo Narvaja
12-19-2003, 03:40 AM
i have the same trouble the original app runs well in smart check, but the unpacked app, don't run in smart check, and run in olly and run alone perfectly, I think is a trouble with the header of the unpacked file.

Try the packed app if run in smartcheck, if there are isdebugpresent check, you can activate the error report and when stops if you are in XP, use PUPE and in the process put the byte of 7FFDF002 from 1 to 0, and run, if the original app run well, is a trouble with the unpacked app only (header trouble i think)

Ricardo
yaa
12-22-2003, 03:13 PM
Try the packed app if run in smartcheck, if there are isdebugpresent check, you can activate the error report and when stops if you are in XP, use PUPE and in the process put the byte of 7FFDF002 from 1 to 0, and run, if the original app run well, is a trouble with the unpacked app only (header trouble i think)

Ricardo, could you please explain better. Also, what does PUPE do?

yaa
Ricardo Narvaja
12-22-2003, 04:30 PM
My english is very bad sorry

the fact is this

i have original programs running well in smart check, but the unpacked program not run in smart check, after the manual unpacking process, the dumped not run in smart check, out of smart check runs well.

PUPE is a tool for patch execution process.

With this tool you can open the original program in smart check, and when stop in and error, open pupe and change the byte 7ffdf002 from 1 to 0, this is the byte checked in the api IsDebugPresent, and with this the program can run in Smart check if not run for this byte.
And not only with the api is checked this byte, the program can check directly this byte, with no access to the api, for this reason is better change in memory directly with pupe.

Ricardo

Ricardo, could you please explain better. Also, what does PUPE do?

yaa


How to change far Jump in P-Code ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to change far Jump in P-Code ??
PDA

View Full Version : How to change far Jump in P-Code ??

brainstorm44
12-18-2003, 01:44 PM
Ì would like to change a long distance jump ,and don't know how to calculate it.
There are a few tools out for changing short branch jumps . But i never read something about long jumps . For example:

763CE1: 00 LargeBos
763CE3: 0a ImpAdCallFPR4: 575738
763CE8: 00 LargeBos
763CEA: Lead1/c8 End
763CEC: 00 LargeBos
763CEE: 04 FLdRfVar local_0148

i like to change the jump at 763ce3 to another location.
Please Help !!
thanx
dELTA
12-18-2003, 04:08 PM
If you look at the raw opcodes you will either find an offset or a virtual address for the jump. Simply patch this one to your liking.

Btw, I think one of the other forums are better suited for this question... ;)
cRk
12-19-2003, 01:33 AM
read this tuto --> hxxp://www.learn2crack.com/218.zip

explain how to change jumps for P-code , long jmp in pcode are 1E

please read and post any comments about ;)

regards!
brainstorm44
12-19-2003, 06:55 AM
Hi Delta, you wrote:
>If you look at the raw opcodes you will either find an offset or a virtual address for the jump. Simply patch this one to your liking.

This doesn't work . There's no jump to patch.

Hi Crk
I know this tut , but there's only explained to jump inside a proc.
I need to jump from one procedure to another (far Jump) , and i don't think that i can use branch ( 1E) for it.

thanx guys!
cRk
12-19-2003, 08:31 AM
as josephco Explains -->>

"Here I need to explain how jumps work in pcode. The beginning of the procedure is the BASE of all jump operations. Lets say you have 0x1C 0x02 0x00 in this procedure. 0x1C = Branch if False, and 0x0002 is the distance from the start of the procedure to jump... NOT the distance from the current location (unlike ASM). So when we want to make our own jumps, we need to calculate the distance to jump ourselves (which isn't very hard). We just take the destination and stubract the starting point from it.. and we get our distance :)
1C = BranchF
1D = BranchT
1E = Branch"

P-code is the same everywhere.. maybe you're missing something?? isn't this telling you how to do it? :cool:

Regards
JMI
12-19-2003, 12:57 PM
Brainstorm:

Here's a copy of the response I posted in the other current thread about P-Code.

Learning how to search IS one of the most important functions of reverse engineering. In a folder labeled P-Code on my HD, I have a small program called JumpGen, which appears to generate a P-Code jump instruction from one address to another. I've never used it, so I can't confirm if it works or if it will do what you want. Search for "jumpgen.exe" on the net. If you can't find it after some searching on your own, I'll attach it here.

Regards,
brainstorm44
12-19-2003, 01:24 PM
Hi JMI
i know this program called Jumpgen, but you can only calculate near jumps
like brancht, branchf and so on , but i like to jump from one proc to another
and l read a lot of p-code tuts , but theres no answer to MY question.
I played around with wktdbg but i don't understand the function:
763CE3: 0a ImpAdCallFPR4: 575738
I changed the bytes after the 0A function , but it screwed up the hole program. So again the question: How to calculate LONG JUMPS !
thanx
cRk
12-20-2003, 10:01 AM
ok... now i know what you mean.. but i'm not sure if that is possible in P-code

try this --> hxxp://www.vb-decompiler.com

and see the attached file from some of the P-code instructions/descripcion like ASM way

btw 0A is not a jump .. i think you're wrong by trying to make this a jump
1A is a jump but not 0A
sarge
12-22-2003, 02:47 PM
0A is not a jump, it's a call. Think "gosub".

Sarge


Powerstrip 3.47 Build 425 => ASProtect 1.23
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Powerstrip 3.47 Build 425 => ASProtect 1.23
PDA

View Full Version : Powerstrip 3.47 Build 425 => ASProtect 1.23

Shiro
12-18-2003, 11:47 PM
hi,

im working since a week on this unpacking. i have no idea. can you help me?

my last step was at 003D3A29 on RET.

TargetDownload: <deleted - irrelevant - post implies crack request - K.>

ThX
cRk
12-19-2003, 01:37 AM
did you read faq/rulez?

please show your efforts or post your question because this post looks like a cra.... request. :eek:
JMI
12-19-2003, 07:08 AM
Hey cRk, if you keep doing part of our Moderator's duties, we will have to start giving you part of our humongous salary. :D Thanks for the assist. :cool:

Shiro: Did you, by any chance, read any of the threads here about ASPR 1.23? Wakarimas-ka?

Regards,
cRk
12-19-2003, 08:20 AM
:D
Shiro
12-19-2003, 09:49 AM
sry, this is no request. i need help for unpacking. and yes, i´ve readed the posts with Asprotect, but the posts cant help me directly. can you plz help me?
dELTA
12-19-2003, 10:44 AM
Oh, now we feel really stupid... Here we are, thinking that it's a request, but then it turns out that all you want is for us to unpack it for you since the exact offsets for your application could not be found in the other threads... :o Oh, the humiliation... :D

*sigh*
Shiro
12-19-2003, 10:50 AM
no, i need HELP and not the unpacked program.
dELTA
12-19-2003, 10:58 AM
Well, if you would have read the FAQ you would know that we don't help people to unpack specific programs, but rather help them learn how to do general unpacking. You would also know that you have to specify in detail what you have done yourself so far, and exactly where you're stuck, otherwise we cannot help you in any way, period.
Shiro
12-19-2003, 11:02 AM
ok, i understand.

can you help me for general unpacking asprotect 1.23?
dELTA
12-19-2003, 12:42 PM
Yes, sure I can:

Search for "Asprotect" on this board, and then read all these threads. Then implement this knowledge on your current target. If you get stuck, write a detailed question about exactly what you have done so far, and exactly where and why you are stuck. Then you will be helped to get further.
JMI
12-19-2003, 12:51 PM
And make sure that if you post parts of the code that it does not identify the target. If people are interested in downloading the specific target and looking at it, after you have shown some of your own work and where you are stuck, they can contact you by PM and/or email to get that information. This is all explained in the Forum FAQ listed at the bottom of the Forums.
The point for you to realize is that people here if "help" you after you show your efforts. They will not "do" the work for you.

Regards,


Dialcops
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dialcops
PDA

View Full Version : Dialcops

THORAC
12-19-2003, 04:34 AM
Hi all

The file that is protected by DialCops is an Access mde file. The protection basic is time limitation and serial. The mde file has a module that is directly connected with the protection exe. With my findings on the protection i found 3 files took place on the protection. 1 of the file is a exe and it is programmed by Turbo pascal and it is 16bit. This exe connected by an 16 bit dll file and this 16 bit dll file connected to an 32bit dll file. These two dlls are programmed in delphi. These both 3 files have import and export functions.
Finally the last 32 bit dll tells the program if the serial is correct or not.
I found a function in both 3 protection files called CheckAccessCode. I try to “nop” the the calls of this function but unfortunatelly the program return an error that “Protection check not approved”.
These are my findings so,
Finally I need information about this protection algo. If some of you success in DialCops cracking please let me know. Any information will be fine. Thanks a lot.

THORAC
Uradox
12-19-2003, 05:26 AM
interesting never seen this protection tho its made by same mob as cdcops which wasnt that secure.
Decryption of the app would most likly be dependant on the serial you entered so if u defeated the error it would likly crash.
Seems acording to the web site this protection was intended for fairly large corp shit not really so much public licensing.
I take it you dont have a valid serial to peep ;\


New at this...Can someone help please ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > New at this...Can someone help please ?
PDA

View Full Version : New at this...Can someone help please ?

zeus
12-19-2003, 04:00 PM
I have this program called PowerPat Plus from h**p://www.pat-services.co.uk/ It is a program For Portable Appliance Testing Equipment. When you install this program there is a 14 day limit and then the program ceases and your data is destroyed. I would like to remove this time limit need to be pointed into the right direction on what to use and what to look for to do it.

Thanks for your help
Zeus
JMI
12-19-2003, 04:38 PM
zeus:

Not a good start for your first post. Go to the bottom of the Forums and click on and read the "Read the FAQ" link. We don't do all the work for you. Yours looks like a simple crack request. You need to do some study on your own, then investigate your target, make some effort and THEN show where you have become stuck. Also do not post target specific code now that you have identified the target.

There is a search button in the top banner, you should use it. You are dealing with a "time limit" of some form and that is a good place to start searching. Read up on that topic. The program has to keep track of the passage of time in some manner and there are tools available to attempt to record where it has hidden its information which allows it to do that. There are programs which attempt to determine if its using some identifiable commercial protection system. Have you used any of those? Have you looked at the code at all? Do you have the slightest idea how to do that?

Nothing in your question suggests you have attempted any of these things or know anything about what you are doing. You may be experienced, I'm only pointing out that you post does not indicate that you are. Reversing is a learning curve which requires the imput of time and effort. Progress is dependent, to a large part on the investment of those two things.

Regards,
zeus
12-19-2003, 04:46 PM
thats why i posted that i need to pointed in the right direction...i am looking at this app for a friend and i have no idea of what i am doing or how to do it. i am willing to read and learn and i am not asking that someone else do it for me. Just what to read, use, and where to go from here.

Zeus
Woodmann
12-19-2003, 05:32 PM
$574.00 in US Dollars. And that was the cheapest I could find.

You would have to have the top choice rig back in the day to run that software.

486 DX2-66 Processor or better, 12Mb RAM, 30Mb Free Hard Disk space, VGA Graphics, CD and floppy disc drives, Windows 3.1 or later (with DOS 5.0 or later) Compatible mouse, Windows supported printer.

They must be the only ones who make such software and feel the need to "rape" people.

Woodmann
naides
12-19-2003, 09:46 PM
thats why i posted that i need to pointed in the right direction...i am looking at this app for a friend and i have no idea of what i am doing or how to do it. i am willing to read and learn and i am not asking that someone else do it for me. Just what to read, use, and where to go from here.

Zeus

1 In Exe tools, find a copy of Win32Dsm and download it. Learn to use it.
A Copy of SoftIce or Olly debuger. Learn to use it.
A copy of HIEW, learn to use it.

Download the Crack Notes from Tornado. Visit Krobar Tutorial site and start from the basic tutorials.

A time limit usually can be attacked by catching the computer asking the CMOS: What date and time is it?
I think I gave you a fair general direction of where you need to go.


Crackin.NET Applications
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Crackin.NET Applications
PDA

View Full Version : Crackin.NET Applications

swordie
12-19-2003, 04:05 PM
Hi..I just wondered if there is any place where i can find info about cracking applications written for the .net framework using VS.NET or others.Regular disassemblers do not work.
thanks
JMI
12-19-2003, 04:50 PM
Well swordie:

Your question points out why the Deity created internet search engines. You have heard of them, haven't you?? :rolleyes:

Did you, by any chance, pick one and enter "VS.NET + cracking" and press enter? How about "VS.NET + debugger." These are good places to start. The Deity, and those here, tend to help those who have actually tried to help themselves.

Regards,
dELTA
12-20-2003, 06:49 AM
On a slow day, the Deity also created IDA Pro, which can disassemble .NET files. ;)
JMI
12-20-2003, 02:28 PM
Well that simply means that IDA Pro is not "regular." :D

Regards,
cRk
12-22-2003, 05:37 PM
JMI do you have ftx://ftx.dei.uc.pt/.raid1/MSVisualStudio.NET/program%20files/microsoft%20visual%20studio%20.net/frameworksdk/bin/ildasm.exe

? i tried to get it but i think is gone.. i looked hard in many sites but just comments and comments... but i just need the .exe disassembler ;)

is it in your hard drive? :)

Regards
JMI
12-22-2003, 06:06 PM
cRk:

1.) The FAQ will tell you you should NOT ask for the tools of the trade here. That is a "request" you should inquire about at exetools. :o

2.) Why not download it directly from M$. My understanding is that it is part of the ".NET Framework SDK Version 1.1" which is free from their site.
http://www.microsoft.com/downloads/details.aspx?FamilyId=9B3A2CA6-3647-4070-9F41-A333C6B9181D&displaylang=en

They also have a multipart downloadable version with a setup exe and 9 cabs. If someone can tell you which cab it is in you wouldn't need to down load the entire thing, which is 106 Mg. :rolleyes:

Regards,
cRk
12-22-2003, 06:10 PM
sorry for my mistake but i did this way since i saw you offer to someone the jumpgen :p

Regards
JMI
12-22-2003, 06:19 PM
Yes, but jumpgen is not a commercial product, nor 106 Mg and I don't want to become a target for M$ net police by attaching one of their products in a public forum. In a minute I'll post which cab it's in, if I can make that determination without too much time. (I do work for a living, if you can call this living. :D )

Regards,
JMI
12-22-2003, 06:54 PM
Well I wasn't able to get the cab's to open easily, but I installed the program and it one you seek is definitely in there. ;)

Regards,
cRk
12-22-2003, 07:49 PM
thanks for taking part of your time to look at this. the special reason i asked you is because i'm on slow 56k and as far as i remember i got on my hands a package like 27 MB about this .Net Framework stuff that a program needed and i had to get it to make the program work.. i remember too i couldn't look too much into the code becuase i was missing the right tools for this app. but i never saw any file like disassemblers or tools.. i guess i was missing the big package you mentioned..... ;)

Regards.
cRk
12-25-2003, 12:27 AM
i just found out this great info. about this C# language/.net Framework

hxxp://www.andymcm.com/dotnetfaq.htm#1.1

hxxp://www.c-sharpcorner.com/vsnet/IldasmTool.asp

hxxp://www.macadamian.com/column/assemblies.html

i'll hope everyone like it :)

Regards.


Is mammon_ back?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Is mammon_ back?
PDA

View Full Version : Is mammon_ back?

yaa
12-19-2003, 05:41 PM
Hello,

today I visited mammon_'s old site .. I was surprised to see it updated.
I've always considered him one of the "fathers" ... it is nice to see that not all of them have vanished ...

yaa
disavowed
12-20-2003, 02:30 AM
he's more into linux reversing now, afaik


Mega Newbie needs help. Enabled Save button but cant save
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Mega Newbie needs help. Enabled Save button but cant save
PDA

View Full Version : Mega Newbie needs help. Enabled Save button but cant save

bobmaster
12-19-2003, 10:33 PM
I am trying to enable the save feature on "2D design" by TechSoft
h**p://www.techsoftuk.co.uk/2ddem.exe -9MB approx

I used this guide www.woodmann.com/fravia/menusspa.htm and
So far i have been able to enable the file menu "Save" and "Save As" options
"un-gray" them. I did this using a hex editor and changing the file as follows:

Original File:
002697d0: 00 00 02 e1 26 00 43 00 6c 00 6f 00 73 00 65 00 :: ..á&.C.l.o.s.e.
002697d0: 00 00 00 00 03 e1 26 00 53 00 61 00 76 00 65 00 :: ....á&.S.a.v.e.
002697d0: 09 00 43 00 74 00 72 00 6c 00 2b 00 53 00 00 00 :: ..C.t.r.l.+.S...
002697d0: 00 00 04 e1 53 00 61 00 76 00 65 00 20 00 26 00 :: ..áS.a.v.e...&.
002697d0: 41 00 73 00 2e 00 2e 00 2e 00 00 00 00 00 00 00 :: A.s.............

Changed File:
002697d0: 00 00 02 e1 26 00 43 00 6c 00 6f 00 73 00 65 00 :: ..á&.C.l.o.s.e.
002697d0: 00 00 00 00 01 e1 26 00 53 00 61 00 76 00 65 00 :: ....á&.S.a.v.e.
002697d0: 09 00 43 00 74 00 72 00 6c 00 2b 00 53 00 00 00 :: ..C.t.r.l.+.S...
002697d0: 00 00 01 e1 53 00 61 00 76 00 65 00 20 00 26 00 :: ..áS.a.v.e...&.
002697d0: 41 00 73 00 2e 00 2e 00 2e 00 00 00 00 00 00 00 :: A.s.............

This enables (un-grays) the "Save" and "Save As" but if i select them using
the mouse i get a "Open" dialog rather than a "Save"/"Save As" one. if i press
the shortcut key (Ctrl+S) the "Save As" dialog is displayed but after pressing
OK i get the message "Cannot save from demo version". I get the same
message if u use the "Export" function, witch isnt "grayed out" in the first
place.

I opened the file in W32dsm ver8.93. and found this string refrence
String Resource ID=01070: "Cannot save from demo version".

Also Found the Imported Function
comdlg32.GetSaveFileNameA
and the string refrence
String Resource ID=20102: "Saving. Please Wait...".

So i think the save function is someware still in the program but i donno
how i would enable it, or make the save buttons point to the correct bit
of save code. I dont realy know how to use W32dsm peoperly as i am a
newbie. I would appreciate any help anyone can give. Point me in the
correct direction or to some appropriate guides remember i am a mega-noob
so nothing too complex.

Thanks. :D

BTW this is the first thing i have ever tried to Reverse Engineer
Why? Because the £195 price is about £194 to expensive for me
i need this software for school work, they have the software at
school but i need to get some work done at home. The comp staff
are bastards :mad: and said i cant have a copy to take home even though
whilst i was google-ing i found other high schools giving copys to there
students for £5.
JMI
12-20-2003, 02:42 AM
bobmaster:

Time for a little concept thinking about the issue. You had a button that was "greyed out" and you "un-greyed" it and you wonder why it still doesn't work. Maybe a better question would be:

"Why did you believe that simply manually 'un-greying' the button would make the program work?"

Now I know absolutely nothing about your program, but I can make certain educated guesses about what's happening, simply because I've read alot of things about reversing. First, you have an expensive commercial cad/cam product that has some form of protection system. From your description, it appears to have some form of "demo" mode to permit you to see how it operates, but it won't allow you to save your work, so its functionality it severly limited. You noticed that the "save" button was disabled and you figured if you simply turned the button color to the "on" position, it would save. Why?

You need to think about what may, or probably is going on. One can assume (often a mistake :) ) that there is a registration dialogue box, chosen from one of the menu's, more often than not, the "help" menu, with a "register" choice. But what would you think might be going on behind the scenes? Here's just a hypothesis of what it might be.

You have to enter a serial number of some sort. The program then performs some form of check on the number, to determine whether it is "valid." IF the number passes that check, the program branches to a line of code that enables the program features of "saving" and turns on/activates the save button.

Now you did not mention entering a serial number, so one can assume that the program did NOT run a check on the number, and did not branch to that part of the code which activates the save function and turns on the "save" button. You come along and figure out how to make the save button appear to be "on," but, because there has been no passing of the registration check, the code is not accessing the save function itself, whether or not the button is lit. Cad/Cam programs are usually expensive and often well protected in their demo versions.

So, in short, you have approached the problem from the wrong end. You have manually "lit" the button, but you, obviously, have no "save" code enabled to respond when the button is pushed. It would appear that you need to start with the registration code, itself, and see if it has a "good boy-bad cracker switch" which you can force to the "good-boy" branch.

Another alternative is to attempt to trace more of the code to look for the code that actually does the work of saving, after the button is pushed. You might have something like an event mask which waits for things to happen and then branches to the area of the code designed to respond to that event. One of those events would be pressing the "save" button and then the event code would branch off to do that task.

There is also another possibility, though less likely. That would be that the demo code is not actually a full program, because it does not actually have the code in it to save. This is less likely, because most programmers are too lazy to want to make two versions or take part of the code out, but it is the most effective way of preventing reverse engineering. You can't make the program do what it's code does not contain, unless you write it your self.

An actual good clue might have been to actually READ the information on the company's website. Did you notice the part for the 2D Demo that it states:
"In order to avoid software theft, the software is encrypted with the name of the licensed user, typically the name of a person, or the name of an individual establishment." Now they do not explain what THEY mean by encrypted, but it is more likely, from your description, that without passing the registration test, certain parts of the code, like "saving" remain encrypted and are NOT available. Looking at the program in a dissassembler would give you a better clue. If that's the case and they have used proper encryption, you are essentially screwed. If, on the other hand, their encryption is weak, you might have a chance. One thing to check is whether the demo exe and the exe on the schools machines are the same size. Can you guess why?

So, you obviously have much more work to do other than just turning on a button. Judging from your own description of your skill level in this endevour, it does not appear likely that you are capable of "reversing" this project on your own and actually want someone here to "reverse it for you. Of course, you could prove me wrong, but due to your stated need for course completion convenience, the obvious time limit that imposes on your ability to get yourself up to speed, I doubt you will be able, or patient enough to learn enough to accomplish the task in the time avialable. So what are you going to do if the answer is that you need to read a great deal more before you are really ready to start?

Regards,
nikolatesla20
12-20-2003, 02:45 AM
Another viable option is to find a different target. There's lots of CAD programs out there.

-nt20
JMI
12-20-2003, 02:54 AM
And, of course, that is another option You CAN learn how to work the program from the demo, even if you can't save. You could use some other cad/cam program to get homework done for submission to the prof.

Of course they don't actually expect you to be doing the work outside of the classroom or lab, or they would have made the program available for your use. So this, really is an issue of personal conveniency, not in itself bad, but a motivation which does not bode well for your potential willingness to buckle down and do the hard work yourself.

Regards,


how to remove Alt+tab protection ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > how to remove Alt+tab protection ?
PDA

View Full Version : how to remove Alt+tab protection ?

highfly
12-21-2003, 04:36 AM
hi

i got a game which has alt+tab key protection,how to remove?

thanks
Kayaker
12-21-2003, 05:19 AM
Hi

You'll first need to determine how it's being done. From what I've read this can be done via a keyboard hook, but is also something specific to DirectX programming, Alt-Tab can be disabled apparently using the DX api SetCooperativeMode. There are even a couple of OS-specific hack ways to do it, but likely aren't used in a game.

Examples of a SetWindowsHookEx keyboard hook to disable Alt-Tab are easy to find, compare the pattern of API's and constants used with your code. I'm sure it could be done via a driver as well so check for that, then there's the DX method if your game uses it.

A little googling research on how such a thing can be accomplished in code should give enough background on the kind of things to look for in your own code. Once you've found the method(s) used then you can think about removing it.

Kayaker
Aquatic
12-21-2003, 05:21 AM
Try this: http://dlh.net/getfile.php?66:/gamehacking/misctools/mhtv12.zip
Kayaker
12-21-2003, 05:34 AM
Don't take this wrong, I find it slightly amusing, but...

Oh, a game hacking tool. Bah, what's the point of trying to figure it out for yourself? Here I am wasting my time thinking people want to learn...
Aquatic
12-21-2003, 05:41 AM
Don't take this wrong, I find it slightly amusing, but...

Oh, a game hacking tool. Bah, what's the point of trying to figure it out for yourself? Here I am wasting my time thinking people want to learn...

We do want to learn, ...but we can't learn it all overnight.
Kayaker
12-21-2003, 05:52 AM
True. And sometimes studying a tool *is* a good way to learn, often the best. Some wouldn't bother if there's an easy way out, but hopefully some dig a bit deeper and do learn.

K.


LoginBox
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > LoginBox
PDA

View Full Version : LoginBox

kP^
12-21-2003, 04:45 AM
Hello !

Using a tiny RTL for Borland's Delphi environment, a few Windows API's and some of my school-time, i wrote this Loginbox, for those who want to test their reversing skills.

The username is very common, and the password not longer than 5 characters.
Anyone ?
mark0x
12-21-2003, 09:37 AM
I'm a relative 'noob' but am having a look - seems interesting thus far :)
kP^
12-29-2003, 08:01 PM
the solution is not hard to trace.
login information isn't longer than 8 characters, so one callpatch and a few lines of backtracking code could do it.
ZaiRoN
12-30-2003, 05:13 PM
Hi All,
is mark0x the only one that is working on this nice target? I did take a glance at the target and I found that MD5 is used. Seems like MD5 is becoming very popular in this days :D
Iirc is not proper the classical md5... kP^ has changed the initialization constants, here is the new values:
0040872D MOV DWORD PTR DS:[EBX],17452301
00408733 MOV DWORD PTR DS:[EBX+4],2FCDAB89
0040873A MOV DWORD PTR DS:[EBX+8],38BADCFE
00408741 MOV DWORD PTR DS:[EBX+C],40325476It's not much but maybe could break the ice...

Best regards,
ZaiRoN
mark0x
12-30-2003, 08:34 PM
I've been sidetracked with other things recently but will have another look soon.. I recall the app did something like execute itself with some command line params depending on what you entered (or I could be going insane).. and yeah I noticed that it was using md5 from running peid on it (also said something about twofish).. IIRC this prompted me to download a load of crypto ebooks so I could look into how they worked

Hopefully won't be too long before I can revisit it again
JMI
12-31-2003, 01:33 AM
Maybe it has MD5 because the net is full of scripts for writing login pages that use MD5 as part of their cookie construction for intersession surfing. :D

Regards,
kP^
12-31-2003, 08:47 AM
Indeed ZaiRoN, you got that right.
Later on, i've also nonstandardly intialized Twofish.

I'm not good at reversing, so i only used asm programming for protecting my code.
I have chosed not to pack/scramble the PE in any way (although i have my own personal protector) because i think this tehneek aims to keep exe-snoopers away and it's useless against anyone persistent enough to find the original entry point and do a plain memory dump.

Also, i've tryed to "escape" Ollydbg by creating another instance of my process and running external code; results are passed as exitcode to the exitprocess function. Thread's priority explains the delay.

If a reverser understands that the password's edit-box has not been 'touched' (read) to this point, he could guess that until this phase, just the username is validated.

The password is later (if username's hash corespunds) checked by initing new hashes to decrypt a block of code in Twofish (e.g the 'good boy' procedure). If the unlocked code turned good, the call is made. If he'd revers the jumps (invalid code ahead), the application would call junk code and crash.

That's pretty much the esential information reversing could give him: password encrypted code.


VB Keygen-me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > VB Keygen-me
PDA

View Full Version : VB Keygen-me

Oloron
12-21-2003, 06:45 AM
hey VB reversers :) i know u are out there
just a little keygen-me here i wrote to test a person's abilities in reversing VB and dealing with obfuscation. its not overly difficult but it should be half challenging imho
sonkite
02-13-2004, 03:37 PM
hey VB reversers :) i know u are out there
just a little keygen-me here i wrote to test a person's abilities in reversing VB and dealing with obfuscation. its not overly difficult but it should be half challenging imho

pcode sux, but here is a valid serial

name: sonkite
code: 756B6863617766222820
evlncrn8
02-13-2004, 06:20 PM
pcode sux, but here is a valid serial

name: sonkite
code: 756B6863617766222820

heh neat.. hi sonkite ;)
ZaiRoN
02-13-2004, 06:55 PM
Hi sonkite,pcode suxpcode... this is not pcode :confused:
Btw, your combination is not correct, and it's valid for your computer only. iirc, the name/serial protection routine is based over some specific values taken from the machine. Have you sniffed the right serial for your name?

ZaiRoN
sonkite
02-14-2004, 09:24 AM
Yeah it was not pcode, here is what i got so far:

take lpTotalNumberOfBytes from C:\ (static?) using GetDiskFreeSpaceExA
in my case 81929000h (2173865984.0) put into fpu and add it with 4294967296.0 (static?) == 6468833280.0

then

20h ' ' xor 6 == 26h
73h 's' xor 6 == 75h

20h ' ' xor 4 == 24h
6Fh 'o' xor 4 == 6Bh

20h ' ' xor 6 == 26h
6Fh 'n' xor 6 == 68h

20h ' ' xor 8 == 28h
6Bh 'k' xor 8 == 63h

20h ' ' xor 8 == 28h
69h 'i' xor 8 == 61h

20h ' ' xor 3 == 23h
74h 't' xor 3 == 77h

20h ' ' xor 3 == 23h
65 'e' xor 3 == 66h

20h ' ' xor 2 == 22h
20h ' ' xor 8 == 28h
20h ' ' xor 0 == 20h

which equals = 75 6B 68 63 61 77 66 & 26 24 26 28 28 23 23 22 28 20

compare entered serial against 756B6863617766 222820
Foreigner
02-14-2004, 06:43 PM
Hi people,
I am new to Visual Basic, can you help me?
I am not able to find all the informations sonkite gave us; in particular, how did you find the value 4294967296 and where did you find the call to GetDiskFreeSpaceExa? I am using Ollydbg without success... any hint!?!

f.
sonkite
02-15-2004, 06:10 AM
Hi people,
I am new to Visual Basic, can you help me?
I am not able to find all the informations sonkite gave us; in particular, how did you find the value 4294967296 and where did you find the call to GetDiskFreeSpaceExa? I am using Ollydbg without success... any hint!?!

f.

If you follow this call (at startup of crackme):

0043C539 CALL DWORD PTR [EDX+38]
.....
73577C78 CALL DWORD PTR [7358977C] ; GetDiskFreeSpaceExA
.....
735743A1 FILD QWORD PTR [ESP+4]
735743A5 POP ESI
735743A6 FSTP QWORD PTR [ESP]
735743A9 FLD QWORD PTR [ESP]
735743AC FMUL QWORD PTR [73587830]
735743B2 MOV DWORD PTR [ESP],EAX
735743B5 MOV DWORD PTR [ESP+4],EDX
735743B9 FILD QWORD PTR [ESP]
735743BC XOR EAX,EAX
735743BE FSTP QWORD PTR [ESP]
735743C1 FADD QWORD PTR [ESP]
735743C4 FSTP QWORD PTR [ECX+8]

There it calculates the values.


ASprotect 1.23 rc4 & crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASprotect 1.23 rc4 & crackme
PDA

View Full Version : ASprotect 1.23 rc4 & crackme

Ray
12-21-2003, 09:06 AM
Is there a crackme that is packed with the above protector to practice on?

thanks.
JMI
12-21-2003, 03:18 PM
Not a crackme, but a program which apparently has this version of the protector:

hxxp://www.webtoolmaster.com/download/cdprot.exe

You can download the product and give it a try. A member on the exetools forum has posted a loader which he claims removes the copy protection. Do a search there for "WTM CD Protect v1.51 loader" and study his exe file and maybe you can learn something usefull about the protection and the creation of loaders. The member has not posted his source, however. :cool:

Regards,
Zilot
12-22-2003, 02:58 AM
I tried that loader and it works. But there are still nag messages like shareware.
This file is only packed with ASPR not protected. He has its internal time protection (3o DAYS), so if you unpack it, it will be still protected. Protection is not hard, so you will easily find the way to defeat. So JMI gave you real crackme. Nothing better than this he could find for some new guy. ;)
Ray
12-22-2003, 07:39 AM
thanks for the link,
i will give it a go, and realy hope its not overbloaded with useless dlls, ocx's and whatever. Those are the virtues of a crackme :p

;)
LaptoniC
12-22-2003, 10:42 AM
You can try avi/mpeg/rn/wmv joiner from hxxp://boilsoft.com Stolen bytes isnt problem but a lot of calls are redirected to aspr code.
yaa
12-22-2003, 05:02 PM
JMI,

I searched for the post you suggested (I even browsed the pages for the main forum) but exetool's search engine doesn't seem to return anything for any word one may supply. Could you post a link to the topic?

yaa
dELTA
12-22-2003, 07:01 PM
It was concluded in another thread a few days ago that the search engine for the exetools forum doesn't seem to work propely if you are not logged in as a registered user over there...

Is it supposed to be like that JMI? Otherwise maybe you (or some other admin over there) would want to take a look at this problem?
JMI
12-23-2003, 08:28 AM
Unfortunately, I am only a Moderator and do not, at least at the moment have access to the adminCP to update the counters and such. :( Maybe after Aaron and Beverly get back from there honeymoon, it will get taken care of. :p Or maybe they will deside to give me access to do it myself. :cool:

Regards,
Ray
12-23-2003, 10:10 AM
JMI,

i have started playing with your suggested app..I was wondering if you have worked with it as well. I have reached somewhere where is think its the oep. of course the stolen bytes are missing..
here is some code:
......
Stolen bytes!??
....
436d41: MOV EBX,DWORD PTR [000437A90h]
MOV EAX,DWORD PTR [EBX]
CALL LOC_004294B4
MOV ECX,DWORD PTR [000437B0Ch]
MOV EAX,DWORD PTR [EBX]
MOV EDX,DWORD PTR [000433710h]
CALL LOC_004294CC
MOV ECX,DWORD PTR [000437A70h]
MOV EAX,DWORD PTR [EBX]
MOV EDX,DWORD PTR [0004327C0h]
CALL LOC_004294CC
MOV ECX,DWORD PTR [000437A04h]
MOV EAX,DWORD PTR [EBX]
MOV EDX,DWORD PTR [0004332DCh]
CALL LOC_004294CC
MOV ECX,DWORD PTR [000437ABCh]
MOV EAX,DWORD PTR [EBX]
MOV EDX,DWORD PTR [000433528h]
CALL LOC_004294CC
MOV EAX,DWORD PTR [EBX]
CALL LOC_00429558
POP EBX
CALL LOC_00403558
NOP
ADD BYTE PTR [EAX],AL
ADD BYTE PTR [EAX],AL
ADD BYTE PTR [EAX],AL
....
......

am i in the right place or just waisting my time?
thanks.
JMI
12-23-2003, 02:12 PM
Sorry, I haven't had time to look at it myself. But from all the reports I've read, stolen bytes tend to be from startup code found at the beginning of the program and which tend to be particular for individual compilers. Do a search here for "stolen bytes" and look at the code they have identified. Usually it is some form of initialization code, different from what you have identified. Remember, however, I have not looked at this one at all. :D

Regards,
Uradox
12-23-2003, 11:10 PM
Forgive my post in advanced its not to flame anyone here.
Seems a fair few people on efnet latly have been asking me how to unpack aspr. I suggest to these people the following
Protection structures are simular in many ways, Dont use/follow a tutorial on unpacking these are VERY specific and will tend to leave you scratching your head when its changed in next version or so.
Basicly a protection loader is going to decrypt/uncompress code/data/resources and fix relocations/imports. Use these things to your advantage. To decrypt the shit its gotta read it from the sections where the crypted stuff is stored so bpm on access is very handy. For fixing imports and such well chances are its going to use getprocaddress but dont set a BP on the first instruction in that call, rather the 3rd or beyond. Also some protections now scan the export table of a library instead of using getprocaddress and in this case bpm on the export data is fine too (its most likly still going to loadlibrary)
Dips in aspr can be used against it easily too by working out how many there are and (using bpm x) trace out of the last one then through a SEH and shortly around there is stolen bytes if there is any else ul be on the OEP with next bpmx.
Theres some very cool features coming in aspr soonish that are very interesting :) i dont post much but when these new features pop up i will post some very detailed stuff for those here interested.

p.s this post is not a tutorial pls pls pls dont ask me how ;\
Uradox
12-23-2003, 11:12 PM
oh and ray, dont quote me on this but that looks like some borland entry bytes you pasted so maybe your stolen ones cept its missing a bit at the top, probely 12 bytes that are fairly generic throughout borland compiliers
britedream
12-24-2003, 04:44 AM
Hi;
stolen bytes:

00436E9C > $ 55 PUSH EBP
00436E9D . 8BEC MOV EBP,ESP
00436E9F . 83C4 F4 ADD ESP,-0C
00436EA2 . 53 PUSH EBX
00436EA3 . B8 9C6D4300 MOV EAX,dd_.00436D9C

oep as above

iat 39104 size 55c

biretdream
dreambuddy
12-24-2003, 07:33 AM
Is there a crackme that is packed with the above protector to practice on?

thanks.

you can try your handa at Dvd2one 1.4 from dvd2one.com

Regards.
britedream
12-24-2003, 09:08 AM
if the protection is time limit, then the program is packed and protected by asprotect, I did unpack it , and forward
the time one year a head , and still working fine,so it is protected by aspr.
neviens
12-28-2003, 03:43 PM
So far I found only two:

Some timing checks (RTDSC?) in protector's code with silent exit, if there
were breakings in SICE,

BSOD, if bpm esp-4 or in near OEP region.

Also, seems, stack is misaligned @OEP now, at least for half a dozen unpacked
delphi exes. I can't believe that these are only improvements of protection-
this don't make unpacking considerably more difficult!
Neviens.
Ray
12-28-2003, 06:27 PM
btw,
can someone point to me the correct code that handles the missing bytes is this app? i cant seem to locate the exact code that erases them, or at least their location!
britedream
12-29-2003, 12:34 AM
btw,
can someone point to me the correct code that handles the missing bytes is this app? i cant seem to locate the exact code that erases them, or at least their location!

the location changes with each run, but for this program when you are at the final exception set your debuger to
stop when ecx is 145e , you will be right on the location erasing the stolen bytes
Ray
12-29-2003, 04:41 AM
the location changes with each run, but for this program when you are at the final exception set your debuger to
stop when ecx is 145e , you will be right on the location erasing the stolen bytes

thanks brite,
i'll give it a try, and hopefully that last exception wont be difficult to spot since oep is known!
later.
Ray.
zyou
01-20-2004, 02:24 PM
h**p://ems-hitech.com/pgmanager/download.phtml ;)
Ray
01-31-2004, 01:53 PM
h**p://ems-hitech.com/pgmanager/download.phtml ;)

thanks zyou.
if anybody else is kind enough to post some more & more links of apps packed with this packer ?

here is a very nice resource editor :))
hxxp://www.sicomponents.com/rbldr.html
babar0ga
02-01-2004, 06:55 PM
CommView v4.1.340(latest)
hxxp://www.tamos.com/products/commview/

PEiD
ASProtect 1.23 RC4 Registered

p.s.
CommView gathers information about data passing through your dial-up connection or Ethernet card and decodes the analyzed data. Loop-back is also supported.
neviens
02-04-2004, 02:31 PM
>CommView v4.1.340(latest)
>

Can't believe, MD5 checksums of CODE section with resources trashing are gone?!
Neviens.
Blinky
02-12-2004, 12:12 PM
This exe from elcomsoft.com came up as ASprotect v1.23 RC4 with PEiD.

I am just a beginner but will attempt to follow Labba's guide with this target.
evaluator
02-12-2004, 03:50 PM
voo-ha-ha!

so finally Tamos was bored by .rsrc_crypting & tried newer asspr for
ripping OEP's...3 instuction. L000000LLLLLLLL..

solomon, slpaj, spekkel, all.. letz LAUGH-LAUGH-LAUGH-LAUGH


Delayed import table?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Delayed import table?
PDA

View Full Version : Delayed import table?

dELTA
12-21-2003, 10:17 AM
In the latest release if IDA Pro (4.60), Datarescue boasts some new features related to "Delayed import tables":

hxxp://www.datarescue.com/idabase/idanew451.htm
hxxp://www.datarescue.com/idabase/10reasons.htm

I have never heard about this term before, and apparently this is the case for most other people too, since google only gives one single hit on the term "delayed import table" in addition to the IDA pages, and that page seems to be about some custom hack to delay recursive loading of DLLs.

So, does anyone know what these "delayed import tables" are? Sounds like fun. :)
volodya
12-21-2003, 12:50 PM
dELTA, it is not a custom hack. It is the pretty widespread thing in PE file.
Here is the link:

http://www.microsoft.com/msj/1298/hood/hood1298.aspx

here is the define:

#define IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT 13
//MS linker can assemble the code!!!!
bart
12-21-2003, 06:37 PM
but it isnt used widely, if i remember MyIE uses delayed import table (http://www.myie2.com/html_en/home.htm)
dELTA
12-21-2003, 07:27 PM
Cool, thanks. :)
A little unfortunate for Datarescue though that they use a term to describe this that no one else on the entire google-indexed part of the Internet uses (ok, except one single guy in one single post in the Wine developer mailing list back in 2000 :)). But then again, as we learn every day, not too many people use google to look up things anyway. :p


64 bit CPU
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > 64 bit CPU
PDA

View Full Version : 64 bit CPU

naides
12-21-2003, 01:30 PM
I have been thinkining about buying a new computer.
It is possible to buy a 64 bit CPU box for a reasonable price these days.
(Why would you need a 64 bit computer you ask?, for the same reason people buy SUVs in a country where 99% of the roads are flat and paved. It's a testosterone thing, you know).
My question to the public is: How different is RCE in these new CPU?
Any experiences?
evaluator
12-21-2003, 04:27 PM
your experiences will first.
buy it, if it has 32bit mode (I don't know)
dELTA
12-21-2003, 07:17 PM
The low level strucutre of IA64 programs are completely different from programs on IA32. The IA64 programs can be explicitly parallelized by the compiler at build time (this is normally done at runtime by the super scalar IA32 processors), and thus the programs consist of "slots" in which you can fill in a different number of instructions of different types (using different parts of the processor) in each slot. Because of this pre-parallellization, I would guess that the code will be harder to follow "by hand" in most cases. :(

Anyway, all old programs and operating systems will still run in 32 bit mode on the processor, which should be identical to old processors (but on these low levels you can of course never really know if there are some small details that necessitate some smaller updates of at least the ring 0 debuggers for them to work correctly), but it should hopefully work without any bigger problems anyway.
SiNTAX
12-27-2003, 05:04 PM
The low level strucutre of IA64 programs are completely different from programs on IA32.

That's true for IA-64 which uses an EPIC instruction set (Explicit Parallell Instruction C... something :).. Not really made to directly program in assembler.. the compiler is responsible for scheduling the instructions, instead of the CPU.. the idea was that this made the circuitry simpler.. but I believe it didn't really work out and the 2nd generation is already smarter.. but don't take my word for it :)

The original poster didn't mention what 64-bit processor he was aiming for, but I guess he wanted an Athlon64 box. An Athlon64 is compatible with IA32, so no nasty emulation hacks as on IA-64. It can run in pure 64 bit mode or a mixed 32/64 bit mode. In pure 64 bit mode, it is still very similar to IA-32 (same instructions, but 64 bit registers and a bigger register file.. ie 16 General purpose registers). Anyway it's still a CISC instruction set.

Or.. maybe he wanted to buy a Mac with a 64-bit PowerPC processor.. In which case it would be a RISC instruction set.

(guess we got all the major sets now :)
LaBBa
12-28-2003, 06:55 AM
"the compiler is responsible for scheduling the instructions, instead of the CPU.. the idea was that this made the circuitry simpler"

well i realy don't know why the world hasn't advanced to the next gen of 64bit cpu ... all we need to do is compile our application in new compiler so it will changed all of it to 64bit way....

so the realy Q is :

how does the SoftWare companies will convert their apps to 64bit ?
i.e : PhotoShop / Maya / 3D.Studio Max etc..

???
SiNTAX
12-28-2003, 03:22 PM
"the compiler is responsible for scheduling the instructions, instead of the CPU.. the idea was that this made the circuitry simpler"

well i realy don't know why the world hasn't advanced to the next gen of 64bit cpu ... all we need to do is compile our application in new compiler so it will changed all of it to 64bit way....

That's only true if the code was written cleanly, without assumptions of how big an int or any other variable is..

Also.. some of the examples you gave, probably use assembler to get more performance out of their code.. so using a 64 bit compiler won't help there as you need to rewrite the asm code.

Another reason: 64 bit is not always faster (in many cases it's slower, as you need to fetch more data.. ie 64 bit = 2x 32 bit.. so you need to get twice as much data from your memory).
The only reason you need 64 bit, is if 4Gb isn't enough.. until recently that meant only big databases needed 64 bit.

The Athlon64 offsets the performance decrease, by having more general purpose registers, so that you need to hit memory less frequently.

Unless your current PC needs >4Gb memory, I'd stick with a 32 bit CPU .. that is.. if you don't account for the testosterone :)
(NOTE: IA-32 can also address more than 4Gb memory, using Page Address Extensions - PAE - but that is scaringly similar to the DOS days with memory banks :( )
cyberheg
12-30-2003, 05:13 AM
so the realy Q is :

how does the SoftWare companies will convert their apps to 64bit ?
i.e : PhotoShop / Maya / 3D.Studio Max etc..

???

This is easy to answer. They all use C or C++ for their development (naturally). Microsoft already released VC++ for IA64 so it's just a matter of recompiling and fix portability related bugs.

// CyberHeg
JMI
12-31-2003, 01:35 AM
Isn't the real issue that there needs to be a sufficient base of 64 bit compliant software to actually use to justify the extra cost of such systems? It's kind of like putting a supercharged engine in a golf cart and then putting aroung the course, wondering when and where you will find a use for all that potential speed.

Regards,
dELTA
12-31-2003, 07:38 AM
If it wasn't for the testosterone issue, that would be the case, yes. :p
JMI
12-31-2003, 06:19 PM
I'm not familiar with that "testosterone program." Memory fades, the lights dim. Where can I get a copy for my machine? :D

Regards,
Woodmann
12-31-2003, 08:45 PM
Howdy,

64 is nice but, like bus speed, it's just for talking about.
The cost is sort of scary.

I would hold off until you find that your regular app's are ready
to utilize the increased speed. Of course you will need new ram and
a 150,000 RPM hard disk and a bus speed of about 9.3 gig.
OK, I exagerate but, you know what I mean. :D

Woodmann

Why not mess around with over clocking, just get
some app's to monitor and go for it. :D
evaluator
01-02-2004, 11:35 AM
Hem! Let me upgrade my Question..

I already know, that AMD have 32bit mode, but Question is:
this 32bit mode for 32bit program is accesible directly in 64bit OS?
Or user must restart PC & load 32bit OS?
sope
01-04-2004, 02:09 AM
Hello naides,

Just read the below interesting thread on asm forum. It discusses how asm will be on 64 bit cpu box. Though its not part of your question but still interesting info provided.

hxxp://board.win32asmcommunity.net/showthread.php?threadid=16630

Regards, Sope.
SiNTAX
01-04-2004, 06:57 AM
Hem! Let me upgrade my Question..

I already know, that AMD have 32bit mode, but Question is:
this 32bit mode for 32bit program is accesible directly in 64bit OS?
Or user must restart PC & load 32bit OS?

The Athlon64 has a mixed 32/64 mode. So a 64-bit OS can run 32-bit programs without emulation.
evaluator
01-04-2004, 05:13 PM
well, thanks for info.

naides, how about MACos reversing=)


symbol not defined - Why?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > symbol not defined - Why?
PDA

View Full Version : symbol not defined - Why?

5aLIVE
12-21-2003, 02:08 PM
Hi this is my first post to this excellent reversing resource.
I have a Delphi app I am hoping to patch.
I have loaded the app into IDA Pro to create a MAP file and have tried DeDe too. I loaded converted a .DCU file to a DSF file and loaded the newly created DSF file. I then created and export MAP file.

I manually created .SYM and .NMS files in DOS (Dede didn't detect my SICE - DS3 w/ XP SP1 - no tricks) and loaded them into Soft Ice symbol loader, these were translated and loaded sucessfully.

Typing SYM in SICE shows Dialogs::ShowMessage(System::AnsiString),
which is the name of the Delphi function I want to set a BP for (it is used to handle strings read from a separate file to be displayed in a message box).

After attaching to the app and typing:
BPX ShowMessage, or
BPX Dialogs::ShowMessage(System::AnsiString)

Gives the "symbol not defined message" :confused:

Can someone tell me where I'm going wrong?
dELTA
12-21-2003, 07:02 PM
The best and easiest tool for converting IDA symbols to Softice symbols is Mostek's IDA to Softice plugin, you can find it at:

hxxp://mostek.subcultural.com

Try that one and see if it works any better.
Aimless
12-21-2003, 11:54 PM
Simple thing to remember is when name is complicated, you use quotes around it. Therefore, you should try:

bpx "Dialogs::ShowMessage(System::AnsiString)"

If that does not work:

1. Open your map file
2. Select the function (it'll be in the format of <addr> <name>) where <name> will be your [Dialogs::ShowMessage(System::AnsiString)]
3. Rename the function to say: MyHack
4. Create the SYM file again.
5. Off you go...

Have Phun
Aimless
12-21-2003, 11:56 PM
And before I forget:

Make sure you are in the correct CONTEXT before you do anything else. You can do that by:

1. ADDR (this will give name of all apps. Select your app. If nothing, use the PROC command)
2. ADDR <myapp>
3. Now, BPX "Dialogs::ShowMessage(System::AnsiString)" or BPX MyHack (if you've changed the name in MAP file)
4. Have Phun...;)
5aLIVE
12-22-2003, 09:01 AM
Thanks guys with you help I got SIce breaking exactly were I wanted.

dETLA - I tried MOSTEK's IDA PlugIn, it works well, saves having to mess about at the command prompt - very convenient :) . At this point in time I don't fully appreciate the power of the pligin but so far it has served me well.

Aimless - I tried placing the function in quotes but it doesn't like them I tried the @ symbole too.
Changing the name to "MyHack" or similar would do the job nicely, thanks.

I learned from Mostek's manual that breakpoints cannot be set since the function name is mangled and SIce doesn't like these characters '(' ',' or ')'.

If you go to Options:Demangled Names and press 'Setup Short Names' a dBox will open, select the first item 'Inhibit everything except the main name' and press OK.

BPX Dialogs::ShowMessage :D

I see the stack has a value of 133, now I think I need to use this value to find the calling subroutine? Am I on the right track?

Thanks again.
5Alive
dELTA
12-22-2003, 10:05 AM
What do you mean with "the stack has a value of 133"? Is 133 the value that is on the top of the stack when your Dialogs::ShowMessage breakpoint breaks, or what? The return address of a function is pushed before the parameters (Delphi uses this calling convention too, right, at least I think so, anyone?), and since the Dialogs::ShowMessage function in Delphi only has one parameter, the return address should most likely be located on the second dword stack slot, not the first. But just single-step or "p ret" out of the function and you will be in the calling code anyway, if you can't make any sense of the stack values.
5aLIVE
12-23-2003, 04:54 AM
Yes, I meant ESI has 133 as soon as Dialogs::ShowMessage breaks, my question was based on a hazy recollection on how the stack works. Your reply has helped refresh my memory of their general workings.

The Dialogs::ShowMessage is the "good guy" message, from my reading the "bad guy message" should use Dialogs::ShowMessage to draw a Error MB. I can find no reference to this in the symbols or dead listing.

I've tried setting BPs on every symbol that contains ShowMessage and MessageBox and I can't get the damn thing to break (I'm attached to the context).

I thought if I tried Olly it would maybe give me a clue, the problem is the app loads a splash screen exe before calling the main program. :confused:
If I were to attach to the main code I can't do it before the MB is displayed. Olly did show the Application class call the MessageForm class used to display the box/button. I set A BP for Dialogs::TMessageForm - still nothing.

I wonder if using HWND Dialogs::TMessageForm would help? I'll try that next. Can anyone offer some suggestions.

5Alive.
5aLIVE
12-23-2003, 05:00 AM
Sorry, In the abov, I meant the "bad guy" message box should use Dialogs::IvMessageBox, not Dialologs::ShowMesssage, it is still an OK MB, the only differences are that it displays Error in the title and has a graphic in it.
dELTA
12-23-2003, 07:15 AM
In this situation I would probably modify the main exe with a "spinning jump" (a jump directed at itself, hence just "spinning" forever) at OEP. This way you can attach to the new process with your debugger as soon as it's started by that other process, then set any breakpoints and restore it to running state. Then you should be able to break on your messageboxes.
5aLIVE
12-23-2003, 08:22 AM
Hmmm, a spinning jump eh? That sounds like a good idea, I'll give it a go.
It just seems strange that I can break on the "good guy" and not on the "bad guy" when they both occur at soon after the main exe is called, but then what do I know as I'm on a fairly steep learning curve at the moment?

A spinning jump would take the form OEP address: JMP OEP address? Is this corrrect?

Regards 5Alive.
dELTA
12-24-2003, 07:22 AM
Yep, that's correct.
5aLIVE
12-24-2003, 11:13 AM
Okay, I gave it a go, I used both PEiD and DeDe to find that OEP, this was
found at $002D9D9C, with the first bytes being 55 8B EC 83 (push EBP).
I changed these bytes to E9 9C 9D 2D (JMP $002D9D9C).

I loaded softice and then the app, when the main exe is called by the spash screen SoftICE breaks due to an unhandled exception which reads NTSTATUS = STATUS_ACCESS_VIOLATION
MSR Last ExceptionFromIP = 006D9D9C
MSR LastExceptionToIP = C49B3B3D

As I am fairly new to all this, this error is caused because the the JMP is outside the memory range of the process. So I looked at the OEP info again from PEiD and DeDe. It has an RVA OEP of 006D9D9C, so I changed the last byte from 2D to 6D to give E9 9C 9D 2D (JMP $006D9D9C).

I ran the app again only to get the same type of error. I'm now thoroughly confused, what am I doing wrong?

Thanks,
5Alive
naides
12-24-2003, 12:05 PM
Okay, I gave it a go, I used both PEiD and DeDe to find that OEP, this was
found at $002D9D9C, with the first bytes being 55 8B EC 83 (push EBP).
I changed these bytes to E9 9C 9D 2D (JMP $002D9D9C).

I loaded softice and then the app, when the main exe is called by the spash screen SoftICE breaks due to an unhandled exception which reads NTSTATUS = STATUS_ACCESS_VIOLATION
MSR Last ExceptionFromIP = 006D9D9C
MSR LastExceptionToIP = C49B3B3D

As I am fairly new to all this, this error is caused because the the JMP is outside the memory range of the process. So I looked at the OEP info again from PEiD and DeDe. It has an RVA OEP of 006D9D9C, so I changed the last byte from 2D to 6D to give E9 9C 9D 2D (JMP $006D9D9C).

I ran the app again only to get the same type of error. I'm now thoroughly confused, what am I doing wrong?

Thanks,
5Alive

If I may step in:

you are using the long jump (explicit jump) assembly code. Try a short jump $EBFE meaning : JMPS -2, two bytes back, to the begining of the JMPS instruction again, and see if it works.
5aLIVE
12-24-2003, 12:19 PM
By all means, I'll try as you suggest. Thanks for your help. :)
5Alive
dELTA
12-24-2003, 05:53 PM
Just like Naides say, use the short jump version instead (it is safe in case of relocation, and just in general less prone to mistakes). Also, if the program is packed, the OEP (Original Entry Point) is not the same as the EP (Entry Point). You must set the jump at the EP in this case, not the OEP (wrong terminology from my side earlier, sorry), and the EP address can always be acquired directly from the PE header of the exe file. Further, if the exe is packed, it might have anti-debugger tricks making life hard for you.
JMI
12-24-2003, 08:16 PM
Please excuse any possible mis-cues by dELTA tonight. He has already confessed he's had too much eggnog with his Christmas celebrating. :D

Regards,
5aLIVE
12-26-2003, 08:18 AM
The short/spinning jump worked nicely, I can now single-step to my hearts content.
Having said that, I am still unable to break on a specific message box, though I can break on others in the app. You mention that the if the OEP differs from that of the EP, then then program is packed.

PEiD gives an EP of 002D9D9C and a OEP of 006D9D9C which suggests that it is packed, though in my limited experience I would say that it is not packed (~3.5Mb) as I can readily view the exes resources and view strings in clear text. Any file analyser I have used reports it as a Delphi 4/5 binary.

I can't remember if I set the spinning jump at OEP or EP, I'll need to check on that again. I can't really say with any certainty if the app has anti-debugger tricks, although I would be inclined to think it is trick-free.

Can you suggest anything else I might try to help solve this?

5aLIVE
dELTA
12-26-2003, 09:58 AM
I have not used PEiD enough to say why it might do that, but the large exe and correct identfication as a Delphi binary in other programs could theoretically be because it is using a crypter instead of a packer, which might also be so rudimentary as to only crypt the code section and not the data sections (not very likely though, anyone else have any idea why PEiD would report a different EP and OEP in a non-packed executable?). If you disassemble it in e.g. IDA, does the disassembly of the entire code section make sense? (it is often quite easy to recognize crypted code, not to menton that IDA will most likely mark large parts of it as "unknown" if it's crypted) Does it seem to have more than one section containing executable code or unknown "data"?

Anyway, the breakpointing problem might have several reasons. First, it might not be a real messagebox that you're seeing, but a window designed to mimic a messagebox. Second, there is more than one messagebox api that can be used, have you tried to breakpoint them all? Third, a common anti-breakpoint trick is to emulate the first few bytes of such apis inside the own program code, try to put the breakpoint say 10-30 bytes into the api's code in user32.dll instead (only possible in 2000/XP if you're using a ring3 debugger).

Also, if you say that you can see all the strings in plaintext, try to put a memory breakpoont on the string of the "unbreakable" messagebox instead, that should work.

And if all else fails, auto-trace (e.g. in Olly) or single step until the messagebox appears, then you should be able to see exactly where it is located in the code, no matter in which way it is rendered.
5aLIVE
12-26-2003, 03:25 PM
Thanks for taking the time to reply again, I hope you don't mind me asking all this stuff.

I've noticed that when I use EP finder in DeDe it shows the Raw EP offset and the PE Header value to be the same(002D919C) and the RVA entry point to be 006D9D9C. Which I see happens to be the image base (00400000) + the RVA entry point. I need to read up on PE headers to understand this properly, do you agree from this that the EP and OEP are in fact the same?
Can I conclude that the binary would not appear to be crypted/packed although it does use symmetric block cipher elsewhere within the program for passwords.

Dissasembling with IDA appears to give a wholly intelligible output, as I haven't come across any parts marked as "unknown". I don't recall seeing more than one section containing code in the data section or unknown "data", though I need to verify this to be certain.

I had wondered about the possibility of it being a fake message box, would a CreateWindow call be used for this purpose or is there another API cal used for this?

I have tried setting BPs for all entries that the command SYM *MessageB* returns to no avail. Are the other Win32 API calls that I may have overlooked?

I'll try setting a BP 10-30 btyes into the use32 dll to see what this brings up (neat little trick). I'm using SI and Olly - can I use either in this case as I'm running XP?

Although I can see the strings in plaintext, the particular MB string has been extracted to a spearate file to allow for multi lingual support. This shouldn't stop me from using the BPM cmd though.

Once again, thanks for all your help and best wishes for the new year.

5Alive.
dELTA
12-26-2003, 05:53 PM
I need to read up on PE headers to understand this properly, do you agree from this that the EP and OEP are in fact the same?

Yes, that is of course the case (I assume that the differing third-last hex digit in your last post is only a typo, especially since they are equal in your earlier post), I really should have seen that one of them was the VA and the other was the RVA of the same address in your earlier post, have to blame the eggnog again... :rolleyes:

I had wondered about the possibility of it being a fake message box, would a CreateWindow call be used for this purpose or is there another API cal used for this?

Some of the normal window apis should be used in the end, yes, but this will most likely be deep inside Delphi library code, and might also appear at a much earlier point in time, since all windows in a Delphi application are by default created at program start. I haven't played much with this specific kind of breakpoints lately, does anyone else know this better maybe, with more detailed info?

I have tried setting BPs for all entries that the command SYM *MessageB* returns to no avail. Are the other Win32 API calls that I may have overlooked?

That should cover all normal messagebox apis if I'm not mistaken, yes.

I'll try setting a BP 10-30 btyes into the use32 dll to see what this brings up (neat little trick). I'm using SI and Olly - can I use either in this case as I'm running XP?

Just to make sure you understood me correctly, this breakpoint should be set 10-30 bytes after the entrypoint of the exported function you want to break on (i.e. not after the entrypoint of the dll itself or something like that), and you must also align it to an instruction (i.e. set the breakpoint on the first byte of some instruction in the code, which in turn can easily be done by viewing the code of the function in the debugger).
5aLIVE
12-28-2003, 09:00 AM
After much searching I eventually found the call, its a function called "CreateMessageDialog". I wouldn't have found this without the use of a Delphi ref manual.

I set a BPX on this in SIce and I now know the calling address, looking at the IDA dissassembly reveals that there are lots of calls before it to set up the box, I followed this so far but gave up as it seemed never ending.

I loaded attached to the app with olly and set a BP on the known call address, and sure enough I can see the message box string in EAX when it breaks. I am not familiar with Olly, I thought that by running trace-over (Ctrl-F12) to the call I could back trace the stack to find the test subroutine.

I have a few questions :

1. Is my approach correct? Or is there some way of doing this more easily?
2. I have searched the manual and the web to see how to load a VCL and
SYM files to make my dump more readable, however I cannot seem to
find an answer. How can this be done?

Thanks again for any help.
5aLIVE
12-28-2003, 11:40 AM
Aha! I've found the ollydbg.win32asmcommunity.net, it looks like I need to try the MapConv 1.4 plugin to help me on my way. SYM files are not supported from what I read.

Shame I did'y find this earlier :o
5Alive
dELTA
12-28-2003, 06:39 PM
You could also disassemble it in IDA, using the Delphi FLIRT library, and then export all the symbols to Softice with Mostek's great "IDA to Softice" plugin. This is a generic solution that works very well with programs from most compilers, since IDA's FLIRT support is so extensive. Very efficient and very useful.

You can find Mostek's plugin at:

hxxp://mostek.subcultural.com


CheckRemoteDebuggerPresent
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > CheckRemoteDebuggerPresent
PDA

View Full Version : CheckRemoteDebuggerPresent

LowF
12-21-2003, 04:00 PM
"CheckRemoteDebuggerPresent"

I know name says mostly what it is for but anyone seen it in any program?

and is it worth patching? , this export is inside kernel32.dll, same as "IsDebuggerPresent", what i know not many out there doing "Remote" session of Debugging hehe, but anyway just wanna know :P
Woodmann
12-21-2003, 06:06 PM
Howdy,

The word remote does not mean that a debugger is running from another machine. View it as any other debugger detection scheme.

Woodmann


zero knowledge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > zero knowledge
PDA

View Full Version : zero knowledge

Jera
12-21-2003, 10:21 PM
I am interested in learning about reverse engineering. I started 2 days ago to read some of the things that people recommended (when I used the search looking for learning cracking I found some posts and read them) They seem to recommend different things and I was wondering if some of you could get together and make a post saying if you want to start from scratch look here... then have the list of things to do basically in order that you all agree on.

Now on to my question. Please post for me some of the books, tools, programs, and programming languages that you would recommend.

My info to give you a perspective of where/what to tell me to get.
I am using windows xp - is this okay? if not what OS should I be using?
I am learning VBscript - started this yesterday because I want to use it on windows platform.
I love to read - please give me some book titles that will help me as I always get gift cards to the local book store.
I do go to college full time (14 credit hours) and work full time job. So I realize it will take me time to learn so that is not a problem I am more than willing to work the years it will take so that I can achive my goals.

That is about all, hope that gives you an idea of where I am coming from.

Thanks,

Jera
Woodmann
12-21-2003, 11:09 PM
You are too good to be true :D

You can look below for Krobars site for tutorials to start with.
His beginner tuts should tell you the tools that you need.
Make sure you get tutorials that have the program included.
Most times tutorials dont include the program and the latest version
available will not help the new learner.

Patience is a must. This is not easy.
If you are willing to do the work, there are many here who will help you :)

Peace, Woodmann
Kayaker
12-22-2003, 12:25 AM
Hi

Indeed, there are many, many good resources linked at the bottom of the page, any and all are worth exploring. If I had to mention only two as a starting point I might suggest the following at Crackz:

Reverse Engineering - Getting Started Guide
http://66.98.132.48/crackz/Getstart.htm

cRACKER's nOTES by TORN@DO
http://66.98.132.48/crackz/Archives/Crknotes.zip

Best of luck,
Kayaker
naides
12-22-2003, 08:09 AM
I am interested in learning about reverse engineering. I started 2 days ago to read some of the things that people recommended (when I used the search looking for learning cracking I found some posts and read them) They seem to recommend different things and I was wondering if some of you could get together and make a post saying if you want to start from scratch look here... then have the list of things to do basically in order that you all agree on.

Now on to my question. Please post for me some of the books, tools, programs, and programming languages that you would recommend.

My info to give you a perspective of where/what to tell me to get.
I am using windows xp - is this okay? if not what OS should I be using?

Personally, I would start with Win98. Most tutorials assume you are in that OS, and WinXP is not very friendly

I am learning VBscript - started this yesterday because I want to use it on windows platform.

You need a minimal working knowledge of Assembly, and Perhaps C or C++ Windows API and internals are written in C++ type languages

I love to read - please give me some book titles that will help me as I always get gift cards to the local book store.
I do go to college full time (14 credit hours) and work full time job. So I realize it will take me time to learn so that is not a problem I am more than willing to work the years it will take so that I can achive my goals.

RCE is an obsession, and a Vice. Soon it will take all your waking hours. Quit your Job and Cancel your College. No Kidding :D

That is about all, hope that gives you an idea of where I am coming from.

Thanks,

Jera

PS

http://66.98.132.48/fravia/spaia20020530_2.pdf
Is a well organized and zero knowledge assuming introduction to RCE.
I may provide a global vision

Naides
JMI
12-22-2003, 02:23 PM
And welcome aboard. It is, indeed, refreshing to find someone who recognizes that this is an adventure that is about the journey. It is the process of learning, itself, that makes the trip worthwhile. :cool: Several of the suggestions you have already been given will make clear to you that one of the foundations you will need is an understanding of the basics of assembly language, at least to start, so that you will understand what you are looking at when you begin to use the "tools of the trade." There are, of course, some "other" languages, but assembly will be what you see iin most of the things you have been directed to so far. Here is just one, of many sources which has a wealth of information on this subject, including an online and downloadable pdf series called, The Art of Assembly language.":

http://webster.cs.ucr.edu/index.html

Regards,
Jera
12-22-2003, 04:51 PM
Thank you all. I believe that you have given me enough information to keep me busy for the next month or so. These appear to be great directions and I will do my best to make you proud! Well, time to fuel up (get some food) and start this learning experience (read a lot). Hope I can talk with you all some time in the near future, but fear not if you do not see me because that means that I am learning with minor difficulty.

Thanks,

Jera

P.S. I still would like to know a title of a book or three to purchase. Seeing as how you have told me to learn C/C++ I suppose a book on that subject would be in order along with a book on assembly (any specific titles?).
JMI
12-22-2003, 05:37 PM
You certainly do not need to "buy" a book on assembly language. The link I gave you had more than enough to get you well started with assembly language. This link will get you even more information and compilers, tutorials, etc on the subject:
http://www.geocities.com/SiliconValley/Lab/1563/assembly.html

One of my favorite repeated phrases is that "learning to search is one of the most important skills for a reverse code engineer to learn."

There are large resources available on the net in the form of ebooks and although many of them started out life af paid offerings, they, nevertheless, tend to get posted around the net, where they can be "acquired" without cost. One of the things you need to learn about searching is the use of additional conditional phrases to narrow the focus of your search. The founder of this Forum +Fravia went on to devote his time to an entire website devoted to the art of searching. You will find a link to his site in the links at the bottom. It is searchlores.

In the mean time, try doing a search in your favorite search engine with the phrase: "any_subject_you_want + ebook," i.e. "assembly language programing + ebooks" and you will find alot of information. There are entire websites devoted to ebooks for the reverser's with usefull offerings for those who are willing to study.

What you want to keep in mind is the while the subject of "programming" and "reversing" are obviously inter-related, you don't have to know how to actually write programs to learn how to take them apart, but it certainly has it's advantages. But most of the tools that are used in reversing do not show the code in the language of the programmer, but more usually in assembly language, although there are exceptions.

But at the start, most of the things you will use will be showing you assembly language, and you need to at least learn how to recognize what you are looking at in terms of what the code symbols tell you is happening. Later you can learn that you are, for instance watching the program push parameters on the stack for a call to a routine, etc, but that can come latter. There is a whole lot to grasp at the start. Patience and effort are required and rewarded. ;)

Regards,

Regards,
Kayaker
12-22-2003, 05:51 PM
If you're really looking to spend the gift card you get from Santa, on the shelf now is a new book you could browse through at least. Nothing you couldn't learn elsewhere over time as JMI mentions, but it looked to be well written and interesting enough by a more than competent author.

Hacker Disassembling Uncovered by Kris Kaspersky

http://www.amazon.com/exec/obidos/tg/detail/-/1931769222/qid=1072132116//ref=sr_8_xs_ap_i0_xgl14/104-7567910-4090337?v=glance&s=books&n=507846
cRk
12-22-2003, 06:04 PM
this is what i call a Super Moderator JMI always guiding people to get the right step. sure you got many pacience ;)

One of my favorite repeated phrases is that "learning to search is one of the most important skills for a reverse code engineer to learn."

as JMI says and that's the Best to start with

anyway here's a good one too... there are many good tuts there.... check the ones made by Bengaly... very good for newbies.

hxxp://www.learn2crack.com/cracking4newbies.htm

this is not my site neither any relation i have with.. i'll hope some words from the site don't ofend anyone here ;) i will prefer as name learn2reverse.com but this is not the case

Regards!


ida plugins
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ida plugins
PDA

View Full Version : ida plugins

libertine
12-23-2003, 11:47 AM
Good evening,

I'd love to see more plugins for the Interactive Disassembler (IDA)
including sourcecode and tutorials in order to learn from them and/or
to build a basis for people new to programming plugins for IDA.
Since datarescue decided not to sell support plans anymore,
I'd appreciate it if people would rely more on their programming-skills
instead of waiting for another warezed version or trying to scratch together their pocket money to be able to buy another update.
IDA itself is pretty complete in its functionality, so why not add your own ideas?
Let me know what you think.

I can add your plugins to my website, where you can find already some of mine (www.backtrace.de/ida).

greetings,

libertine
tom324
12-23-2003, 01:51 PM
h**p://groups.yahoo.com/group/idaextensions/files/Plugins/

Tom
libertine
12-23-2003, 03:22 PM
I'm aware of that group. what i meant was building an additional website
dedicated to writing plugins and publishing them
AzynchriX
01-02-2004, 11:06 PM
I'd love to see more plugins for the Interactive Disassembler (IDA)
including sourcecode and tutorials in order to learn from them and/or
to build a basis for people new to programming plugins for IDA.
libertine

Just do a search. Papers will be there for you.
libertine
01-03-2004, 07:56 AM
O.K. let me rephrase:

My idea is to set up a webpage dedicated to writing and publishing plugins (i.e. papers on that). read: "a collection of ida plugins" (whether they are
useful or not). I just wanted feedback on that.

libertine
libertine
01-03-2004, 12:23 PM
Something like this:

www.backtrace.de

;)
doug
01-03-2004, 06:17 PM
I have reversed a few drivers recently and I've had a hard time finding the DDK object/structures definitions that I could load in IDA.

I have a few idc scripts for the structs/enums, I'm sure others also do.. merging them into a common project might be something interesting...

In the best case they can be 'automatically' parsed straight from the header files, in the worst case they are entered by hand (or they are unknown).
sope
01-04-2004, 12:52 AM
Hello libertine

(whether they are useful or not). I just wanted feedback on that.Ofcourse they are useful. Keep-up the good work http://masmforum.com/images/smiles/Thmbsup.gif

Regards, Sope.
libertine
01-04-2004, 04:03 AM
sope: thanks for the positive feedback :)

doug: would be cool if you could share your stuff, i can put it up
on the page ASAP.

regards,

libertine
Mostek
01-04-2004, 10:53 AM
Yeah Doug you are right the DDK lib in IDA is really poor.
Ok it has the most used structures and EQUs, but not any specific ones.
So there is no other way than adding them manually.
Now you can copy the requested structures to a separate header file and load it to IDA, but that works only on common C things. :(

I was thinking of creating a real header(C++) parser/loader for a long time, but as I'm writing the soundCard driver I have really little spare time left.

If you come up with anything, you'll definitely get my thanks. :)

Peace and good luck
Mostek

I have reversed a few drivers recently and I've had a hard time finding the DDK object/structures definitions that I could load in IDA.

I have a few idc scripts for the structs/enums, I'm sure others also do.. merging them into a common project might be something interesting...

In the best case they can be 'automatically' parsed straight from the header files, in the worst case they are entered by hand (or they are unknown).


Thanks to you all !!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Thanks to you all !!
PDA

View Full Version : Thanks to you all !!

Woodmann
12-23-2003, 09:08 PM
Hi,

I would like to give my thanks to all of you who have contributed
to this place. My thanks to the Mods who put up with my 'leet
server skills and, my thanks to those who own sites that I host.

Most important is my thanks to all the people who stick with us despite
the times we have to move the server. Your support is what makes me keep this place going.

I know this is a bit dated but, for us old guys (me and JMI), this audio file was an underground classic and I hope it still is.

www.woodmann.net/forum/cheechandchongxmas.mp3

Best wishes to you during the holiday season.

Woodmann
JMI
12-23-2003, 09:38 PM
Hey! I resemble that remark! I am not "old," I'm ancient. And I thought Cheech was most known for getting busted for selling "Paraphanilia" recently and Chong, for his participation in Nash Bridges. :D Or was it the other way around?? There's so much smoke in here from all that weed, man, I just can't tell any more. Uh, Dude, what were we talking about, Oh yah. Happy Holidays. :p :D

Regards,
Kayaker
12-23-2003, 11:18 PM
And to think I spent my formative years listening to the latest LP's of Cheech & Chong and George Carlin, fresh out their cardboard sleeves, getting high on, uh, the second hand smoke from my friends, yeah, I think that was it.., I tried not to inhale. For those who have never seen one, LP's were these wobbly black vinyl things that sometimes made music without skipping. If you could still place the needle exactly at the start of a song, then you weren't high enough.

The real thanks go to you who have spent the bucks, the inordinate amount of time, and the aggravation to keep the server and funky new board interface up and running this past year, the rest of us will take the lump of coal in our stockings and try to make your efforts worthwhile. Somehow, someway, we're still here. And they say miracles never happen :)

Best Wishes to all,
Kayaker
JMI
12-24-2003, 01:05 AM
Hey, I actually got a package with a "lump of coal" from my daughter last year. :D Cute little can with a Santa on it and everything. :D Ah what a blessed commercial shopping event the holidays have become. :p Just picked her up from the airport. She just flew in from New York and boy were her arms tired. (Really old joke. Vintage Marx.)

Kayaker, lets go out to the garage and crank up the old eight track. To heck with this new fangled digital stuff. :D

I still have my turntable and some old 78's. I even have a 4 channel, reel to reel tape deck and one of the "original" surround sound receivers, circa 1972, that are just coming back into style in the last few years. You ought to hear the four channel sound track from the movie Grand Prix with the Forumla One cars racing around the room. You can almost smell the fuel and tires buring up. :cool:

Regards,
Solomon
12-24-2003, 05:20 AM
Best wishes for XMAS! :D :D
ZaiRoN
12-24-2003, 05:53 AM
For those who have never seen one, LP's were these wobbly black vinyl things that sometimes made music without skippingKayaker, don't remember to me how old I am :D

Happy Holidays to all of you!!!

Ciao,
ZaiRoN
dELTA
12-24-2003, 07:31 AM
Hey, even I owned a couple of LPs once. Can't remember too many details about those early years of my life though, but I think my dad got mad at me for drewling all over them and trying to eat them. :D

Happy holidays to all of you guys, and special thanks to Woodmann for keeping this wonderful place funded and running!
kugi
12-26-2003, 04:39 AM
Hi All,

Thank you Woodmann. You do fine work.

Happy Holidays to all.

Ya I'm still around here somewhere.

Regards, Kugi


About this board...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > About this board...
PDA

View Full Version : About this board...

Biaaatch
12-24-2003, 07:32 AM
Hi people,
i've been lurking around this board some time already and finally managed to register today.
I just felt like saying,that this board is somehow special compared to other RE boards out there in the world wide web. It's small and handsome. The mods and admins are doing great work. Let's see what i'll be able to contribute to this place of unlimited wisdom ;)

So far,
happy christmas and don't eat too much turkey

Your
Biaaatch
dreambuddy
12-24-2003, 07:49 AM
and moreover we can find here the Great and Respected names of the community.

Regards.
dELTA
12-24-2003, 08:34 AM
I'm glad to hear you find it to be a special place too, welcome as a registered user, we're looking forward to your contributions. :)

And again, happy holidays to everyone!


Seasons greetings Alexy, Chad, ..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Seasons greetings Alexy, Chad, ..
PDA

View Full Version : Seasons greetings Alexy, Chad, ..

Js
12-24-2003, 07:49 PM
all the guys that keep this game interesting, best wishes to you.
JMI
12-24-2003, 08:05 PM
Yep. Without their efforts, the game would be much more boring. :D

Regards,


cracking licence files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > cracking licence files
PDA

View Full Version : cracking licence files

llsnr76
12-25-2003, 10:26 AM
Hi.. I have this software for which i recieved a validation key which has the number of licences encoded in it. An executable is run using this validation key which generates a licence file stored in the system folder in encrypted format. Another executable loads the validation details from the licence files. Can anyone tell me how i could go about altering the licence file so that i can use any number of licences.
naides
12-25-2003, 11:26 AM
Hi.. I have this software for which i recieved a validation key which has the number of licences encoded in it. An executable is run using this validation key which generates a licence file stored in the system folder in encrypted format. Another executable loads the validation details from the licence files. Can anyone tell me how i could go about altering the licence file so that i can use any number of licences.

You would have to go backwards.
Disassemble the last executable and find strings like ' not enough licences' or so. It might be comparing the licence number to a limit, store into some variable in the memory (lets call it Max_license_Number).
Now track where the contents of that Max_license_Number) is generated, so you can reverse the license file encoding. With this in hand you need to dissemble/debug the executable that generate the licenses from the key and reverse the key generating device.

Lateral solution or lazy boy approach would be just patch the license_limit routine and save yourself a trip in crypto analysis.

All this is easier said than done, but It is the best answer to your less than specific question I could come up with. Ho Ho HOoooh Merry Christmas!!
llsnr76
12-26-2003, 12:17 AM
Hi.. thanks for the reply. The executable that checks for licences loads into memory as a service and then listens to all requests for licences coming from clients. Can anyone tell me what breakpoint i should set on Softice so that i can know what communication is taking place between the licence deamon and the client executable that requests for the licence.
evlncrn8
12-26-2003, 02:03 AM
Hi.. thanks for the reply. The executable that checks for licences loads into memory as a service and then listens to all requests for licences coming from clients. Can anyone tell me what breakpoint i should set on Softice so that i can know what communication is taking place between the licence deamon and the client executable that requests for the licence.

why not disassemble the service, see what imports it uses and then pick which ones to bpx
llsnr76
12-26-2003, 04:22 PM
Hi guys, thats for the replies. I am a newbie so still struggling with this. Here is some details about the Licence Server so i hope someone could give me a clue how to go about it.

Licence Server listens to licence requests issued by running BSHELL's.
When first launched, a bshell issues an initial request to the Licence Server. A TCP socket is created at each request, and deleted when request is served.
These sockets stay in ESTABLISHED status not more than a few microseconds, they then fall into TIME_WAIT status for several minutes.
At initial request, the Licence Server substracts one to the licence counter.
The licence server listens to port 6003 for requests. The licence Server reads all information from an encrypted licence file stored in the system root directory. I have a valid key for 15 users. So obviously it is comparing licence counter with 15.

What break points should i set to know what happens when a licence request is being made or which register is storing this 15 for comparision.
dELTA
12-26-2003, 05:30 PM
A funny method that might work is to use a game trainer tool on the license server process, tracking the memory address where the number of remaining licenses is stored. Once you track this address (if the program is not protected from such a simple trick, for example by some elementary in-memory encryption, which is of course quite possible) you have several alternatives. You could create an external loader/attacher that patches this address directly in memory (a trick for which there might of course also be countermeasures). An even better approach, although requiring a little more effort, would be to attach to the license server process and put a memory breakpoint on this address, then tracing, analyzing and patching the code that manipulates it, preferably directly in the static exe.

This is of course just a few out of the hundreds of possible methods to proceed, but they are quite straightforward and efficient if they succeed.
Woodmann
12-26-2003, 09:57 PM
Licence Server listens to licence requests issued by running BSHELL's.
When first launched, a bshell issues an initial request to the Licence Server. A TCP socket is created at each request, and deleted when request is served.
These sockets stay in ESTABLISHED status not more than a few microseconds, they then fall into TIME_WAIT status for several minutes.
At initial request, the Licence Server substracts one to the licence counter.
The licence server listens to port 6003 for requests. The licence Server reads all information from an encrypted licence file stored in the system root directory. I have a valid key for 15 users. So obviously it is comparing licence counter with 15.

It seems to me that if you can follow everything this program is doing you should be able to figure out how to patch it yourself.
Why are you so hung up on a softice breakpoint ? Not everything is as simple as setting a magic BP and getting your answer.
If the routine is encrypted, how will you proceed after you find the magic breakpoint ?

Woodmann
JMI
12-26-2003, 10:04 PM
Wood:

He has the secret decoder ring for that. :D

Regards,
llsnr76
12-27-2003, 07:40 AM
Hi guys

Thanks to all of you guys for the help. Cracked it inside out today. Really made my day. One licence costs a bloddy $3000.

Delta, thanks for your advice. Could get hold of a memory address that easily but managed to get into some other place that really helped.

Wood, didnt find any magical breakpoints but i didnt feel like getting back to the board until i cracked the nut. Thanks for the push.

JMI :)


ultimate unwrap3d reversing :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ultimate unwrap3d reversing :(
PDA

View Full Version : ultimate unwrap3d reversing :(

highfly
12-25-2003, 01:33 PM
Hi

can someone tell how to reverse this program "ultimate unwrap3d",it has file-saving lock,packed with asprotect.

the demo can be downloaded from... LINK REMOVED

thanks
naides
12-25-2003, 01:40 PM
Hi

can someone tell how to reverse this program "ultimate unwrap3d",it has file-saving lock,packed with asprotect.

thanks

You have to unpack it, then patch it.
Or, setup a loader, and patch it in memory.
For more information go to www.google.com

PS: I have a horrid hangover, or better, it is still alive. . .
disavowed
12-25-2003, 04:26 PM
PS: I have a horrid hangover, or better, it is still alive. . .try "alkaseltzer morning relief".. works like a charm at getting rid of hangovers
naides
12-25-2003, 05:28 PM
try "alkaseltzer morning relief".. works like a charm at getting rid of hangovers

What is the SoftIce command to have it get you an Alkaseltzer (or two)?
seven
12-25-2003, 06:54 PM
setup a loader

can u please explain more ?
Merry Christmas :)
naides
12-25-2003, 08:02 PM
can u please explain more ?
Merry Christmas :)
http://www.woodmann.com/fravia/stone1.htm
JMI
12-25-2003, 09:15 PM
Actually, the only effective remedy if to not overindulge the night before, but that does take the "merry" our of Merry Christmas for some. :D

Regards,
seven
12-26-2003, 06:37 AM
naides :
thx so much .

JMI :
Merry x-mas


Aspr "Super tut"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspr "Super tut"
PDA

View Full Version : Aspr "Super tut"

LaBBa
12-26-2003, 06:50 AM
First i would to tnx u all ..

your responds of my tuts .. (good or bad) has been very helpful

Well i saw many deffrent responds about my tuts...
many of the nagativ responds are correct .. i'm truly sorry about the way i write the the tuts and i will try (when i will have time) to write a new tut

For all the positive responds i would like to tnx for showing other ppl that:
u can lern from my tuts how to unpack other version of aspr and more..

all i got to say now is that i will now try to find a good target that have a good ASPR protections so i could Write a "Super Tut" that will have as many
features as i can explain so if u know a good target that have those fallowing features plz share it with me (pm me) :

1) anti debugger
2) New IAT unResolved API's
3) New Nanomites for ASPR (i heard that this is one out there) (Uradox ??)
4) ASPR modified calls to aspr (or somthing like that..)
or any other featurs u saw ..

i will try my best to do a 100% (or at least 90% ) understandable tut
so ppl won't need to ask Q like :

1) How did u do this
2) How Do i do that
3) How do i know where ......
etc..

this is for the Unpakcing Master of this MessageBoard :
For geting a good tut i will need all your help with more responds when this tut will be out .. so all of the ppl that will have more answers about other Q that ppl will have , plz try to give a full explanation ! and not just to give an general answer like i saw many times ..

i will try also to make this Thread as the main ASPR unpacking that will have all the answers to your Q about aspr..

and again tnx for all about your support (good or bad) .
best regards ,
LaBBa .
peterg70
12-26-2003, 08:20 AM
Labba

Keep up the good work and expand your knowledge but also remember to share it as well.

Catch Ya
Peterg70
dELTA
12-26-2003, 09:44 AM
...but also remember to share it as well.
Isn't that exactly what he's talking about doing, and also has been doing in the past? :)

Anyway, sounds like a really nice tut coming upp LaBBa, keep up the good work!
JMI
12-26-2003, 01:16 PM
And keep in mind that the best tuts are directed at the technique of defeating a particular aspect of the protection, rather that at defeating the protection of a particular target. The target is really only the example of how the protection was used. The technique of the protection is really what you want to address.

Too many people write/read tutes for a specific program and others attempt to follow it "exactly" on some newer (or older) version of the target or a different target althogether and then complain that it didn't work, which is not suprising, if what one is looking for is a specific piece of code at location "xxxxxx." It is substantially more helpful to discuss what the protection is doing with particular techniques and somewhat generic methods of attempting to then find out where it is doing that. Then the reader has learned "what" to look for, more than where, and should gain a better understanding of what the code is attempting to do, rather than, simply, where it did it in that target.

Keep up your efforts and don't be afraid to seek help from others at "polishing" your tut if you have problems with English. Most of us are not proficient in writing more than one language and that is just the "detail" part of the tut. The important part is the knowledge of the discoveries which are revealed. Keep up your good efforts.

Regards,
Uradox
12-27-2003, 10:45 AM
3) New Nanomites for ASPR (i heard that this is one out there) (Uradox ??)
:P almost finished exception rebuilder buuut i seem to think latly alexy has abadoned these and relised it can be very unstable maybe. The idea is good but what if the app is multi threading alexey :)
api emulation you probely looking for isnt anything to worry about, just emulates first few instructions then jumps into the function just after em.
LaBBa iv also read internal aspr tutorials that basicly are the same as yours :P so there isnt really any better tutorial out there but if someones gonna make a tutorial they need to do a better job than just say Trace till *** and set a bp on ****. As soon as a newer version comes out and all this has been totlay changed many people havnt learnt nothing and relied on that tutorial too much - and are now stuck. Maybe u should recover relocation rebuilding as well as aspr can fiddle with this too.
LaBBa
12-28-2003, 07:38 PM
hi all ..

just wanted to keep u all updated about my progress..

the tut is 70%-80% done...

i added a new explaination about the stolen bytes and an "how to" find them and all there is to know about them..

the other 30%-20% is for the redirected calls...
to tell the truth.. i'm kinda stuk with this.. so if i see that i can't find a good way about how to fix it i will leave this tut open to the others leet unpackers to finish it..
i hope this won't happen , and i will finish the tut....

the only tut i have found about fixing a redircted call

was of : +Spl/\j
target : Awave Studio 7.3

thats kinda wierd that no one else has done it since then... :confused:

best regards,
LaBBa.
zee-bub-zee
12-30-2003, 10:17 PM
Please, please, please consider working with someone to make the tutorial comply with English grammar and punctuation. It's just that I read over your tutorial several times, yet still had trouble understanding it the way it evidently was intended to be understood.

Now, if you have time to answer questions I have and to better explain yourself, I might have time to help you translate the tutorial into something anybody can read.

My email address is six(underscore)black(underscore)roses(at)hotmail(dot)com, but I prefer to be contacted through MSN Messenger if possible.
Six Black Roses
12-30-2003, 10:41 PM
This is zee-bub-zee (test name) signing in as Six Black Roses (usual alias).
esther
12-30-2003, 11:16 PM
The major thing,you can't cover everything in a tutorial,if ya emphasize the important parts of unpacking it is good enough.The most important thing is try to expore it yourself.
JMI
12-31-2003, 01:22 AM
LaBBa:

There are several of us here who would be glad to help with your English composition. You should not take this as any form of criticism. We know that English is not your native language and you do a credible job writing in a "foreign" language and do it better than most of us can write some "other" language besides our own. Working with someone on how it is written will make the language clearer for others and their questions might help you clarify areas where your intent or explaination is not clear. Keep up your efforts. We appreciate it and it's much easier to understand than some of what our Musician Friend writes. :D

Regards,
Uradox
12-31-2003, 06:28 AM
The major thing,you can't cover everything in a tutorial,if ya emphasize the important parts of unpacking it is good enough.The most important thing is try to expore it yourself.

That is precisly correct :)
LaBBa
01-06-2004, 12:01 PM
That is precisly correct :)

you are both right.. when i try to explain the stolen bytes i couldn't use just one Target for explanation .. i had to do now 2-3 deffrent apps and give explenation about those .. so .. this is taking me alot of time.. :(

but i will add an NOTE for the Readers that they should lern also how to analize them self more aspr protection .. and just not possible to know it all by reading a single tut ..

so i gess all my targets will be without redircted calls and will later make a Part tut II for that ..

LaBBa
dELTA
01-06-2004, 12:35 PM
Sounds great LaBBa, any chance we will get to see part one soon? Sounds like it has potential to be a very good tutorial anyway. :)
LaBBa
01-07-2004, 10:20 AM
Sounds great LaBBa, any chance we will get to see part one soon? Sounds like it has potential to be a very good tutorial anyway. :)

well i hope that next week i will finish it ...

its just that i have lil time to do this tut because of Uni school but i will finish it and send first the tut to ppl that i know that can tell me if its a good tut or not .. or if there is anything that need to be change or add .. then i will post this .. :)
cerb
01-07-2004, 04:23 PM
Hi,

its a great TUT LaBBa. I`am trying to unpack the new version of [Name removed because of the posting of target specific code] after a lot of shift+F9 Olly will break at the following position:

012D39EE 64:8F05 00000000 POP DWORD PTR FS:[0] ; 0012FFE0
012D39F5 58 POP EAX
012D39F6 833D B07E2D01 00 CMP DWORD PTR DS:[12D7EB0],0
012D39FD 74 14 JE SHORT 012D3A13
012D39FF 6A 0C PUSH 0C
012D3A01 B9 B07E2D01 MOV ECX,12D7EB0
012D3A06 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
012D3A09 BA 04000000 MOV EDX,4
012D3A0E E8 2DD1FFFF CALL 012D0B40
012D3A13 FF75 FC PUSH DWORD PTR SS:[EBP-4]
012D3A16 FF75 F8 PUSH DWORD PTR SS:[EBP-8]
012D3A19 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
012D3A1C 8338 00 CMP DWORD PTR DS:[EAX],0
012D3A1F 74 02 JE SHORT 012D3A23
012D3A21 FF30 PUSH DWORD PTR DS:[EAX]
012D3A23 FF75 F0 PUSH DWORD PTR SS:[EBP-10]
012D3A26 FF75 EC PUSH DWORD PTR SS:[EBP-14]
012D3A29 C3 RETN

after the step 012D39EE 64:8F05 00000000 POP DWORD PTR FS:[0] i start the first trace with:
TC EIP < 900000

after this step i was here:

004073A8 FF DB FF
004073A9 25 DB 25 ; CHAR '%'
004073AA 40 DB 40 ; CHAR '@'
004073AB 13 DB 13
004073AC 59 DB 59 ; CHAR 'Y'
004073AD 00 DB 00
004073AE 8B DB 8B
004073AF C0 DB C0
004073B0 FF DB FF
004073B1 25 DB 25 ; CHAR '%'
004073B2 3C DB 3C ; CHAR '<'
004073B3 13 DB 13
004073B4 59 DB 59 ; CHAR 'Y'
004073B5 00 DB 00
004073B6 8B DB 8B
004073B7 C0 DB C0
004073B8 FF DB FF
004073B9 25 DB 25 ; CHAR '%'
004073BA 38 DB 38 ; CHAR '8'
004073BB 13 DB 13
004073BC 59 DB 59 ; CHAR 'Y'
004073BD 00 DB 00
004073BE 8B DB 8B
004073BF C0 DB C0
004073C0 FF DB FF
004073C1 25 DB 25 ; CHAR '%'
004073C2 34 DB 34 ; CHAR '4'
004073C3 13 DB 13
004073C4 59 DB 59 ; CHAR 'Y'
004073C5 00 DB 00
004073C6 8B DB 8B
004073C7 C0 DB C0
004073C8 50 DB 50 ; CHAR 'P'
004073C9 6A DB 6A ; CHAR 'j'
004073CA 40 DB 40 ; CHAR '@'
004073CB E8 DB E8
004073CC E0 DB E0
004073CD FF DB FF
004073CE FF DB FF
004073CF FF DB FF
004073D0 C3 DB C3
004073D1 8D DB 8D
004073D2 40 DB 40 ; CHAR '@'

after this i press once F8 and i see this:

012D1C64 55 PUSH EBP
012D1C65 8BEC MOV EBP,ESP
012D1C67 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
012D1C6A 85C0 TEST EAX,EAX
012D1C6C 75 13 JNZ SHORT 012D1C81
012D1C6E 813D A47A2D01 00>CMP DWORD PTR DS:[12D7AA4],400000 ; ASCII "MZP"
012D1C78 75 07 JNZ SHORT 012D1C81
012D1C7A A1 A47A2D01 MOV EAX,DWORD PTR DS:[12D7AA4]
012D1C7F EB 06 JMP SHORT 012D1C87
012D1C81 50 PUSH EAX
012D1C82 E8 3135FFFF CALL 012C51B8 ; JMP to kernel32.GetModuleHandleA
012D1C87 5D POP EBP
012D1C88 C2 0400 RETN 4

and now i didnt know how to find oep and the stolen byte

Sorry for my bad english :-)
LOUZEW
01-07-2004, 05:06 PM
You have to read more effeciently the ASPR 1.23 LaBBa tut on [name removed because of the posting of target specific code], you have the same shame ! !
LaBBa
01-07-2004, 05:36 PM
You have to read more effeciently the ASPR 1.23 LaBBa tut on COLOR=DarkRed][name removed because of the posting of target specific code][/COLOR],, you have the same shame ! !

heheh :p .. yea i remember that... and trust me... there isn't going to be those king of explnation in the final tut..

( lol... i don't know what i was thinking to my self in that tut.. :confused: )
cerb
01-08-2004, 06:40 AM
You have to read more effeciently the ASPR 1.23 LaBBa tut on [name removed because of the posting of target specific code], you have the same shame ! !

Hi,

Ok i'am a shame possible. I will only try to explain my problems in unpack apsprotect. Possible other people's have the same problems.
An assistance would be better than so a remark.
LOUZEW
01-08-2004, 01:01 PM
OK guys ! :mad: :confused: :rolleyes:

First of all, Cerb, it seem you don't read ( or cannot understand maybe) this tut from Labba, so i explain :

After your last F8, when you are here :
012D1C82 E8 3135FFFF CALL 012C51B8 ; JMP to kernel32.GetModuleHandleA
012D1C87 5D POP EBP
012D1C88 C2 0400 RETN 4

You are in the ASPR Code again, so run the trace command again you'll fall in App code at OEP (or near real OEP depending of Stolen bytes or no).

heheh .. yea i remember that... and trust me... there isn't going to be those king of explnation in the final tut..

( lol... i don't know what i was thinking to my self in that tut.. )

He ! Labba Why ? ? ? it's a good start ! !
cerb
01-08-2004, 01:36 PM
Thx for the short help. I run the trace command again and now i`am at the following position:
0040747D A3 DB A3
0040747E 68 DB 68 ; CHAR 'h'
0040747F C6 DB C6
00407480 58 DB 58 ; CHAR 'X'
00407481 00 DB 00
00407482 A1 DB A1
00407483 68 DB 68 ; CHAR 'h'
00407484 C6 DB C6
00407485 58 DB 58 ; CHAR 'X'
00407486 00 DB 00
00407487 A3 DB A3
00407488 D8 DB D8
00407489 00 DB 00
0040748A 58 DB 58 ; CHAR 'X'
0040748B 00 DB 00
0040748C 33 DB 33 ; CHAR '3'
0040748D C0 DB C0
0040748E A3 DB A3
0040748F DC DB DC
00407490 00 DB 00
00407491 58 DB 58 ; CHAR 'X'

and now i dont know the next steps.
LOUZEW
01-08-2004, 03:40 PM
:mad: :mad: :mad: :mad: :mad:
Hi, cerb, follow THIS LINK (http://66.98.132.48/forum/showthread.php?t=4958&highlight=ASPR+1.23) , D/L the zip file and read the tut, i don't want to rewrite the same thing LaBBa does ! !
cerb
01-09-2004, 12:43 PM
Hi,

thx LOUZEW i tried it today but with no success. It´s possible the diffrent versions of the software. I use a higher version.
AndreaGeddon
01-10-2004, 10:09 AM
nice tut! solving aspr is not an easy task :)
I too made a tutorial on aspr, i was wondering for some feedback, i made my best to explain all the things i had to solve, the tutorial is quite long but i hope you will find it interesting :) you can find it at www.reteam.org in the essays section. I was planning to write an unpacker, but actually i have not much time to spend on it :(
Greets!
AndreaGeddon
LaBBa
01-11-2004, 03:59 AM
Wow !! :eek:
AndreaGeddon u R g00d !!

Here u go ppl .. u got the "ASPR Super Tut" that we all wanted so much
this tut have it all !!!

i gess that my tut will not be needed now .. but i will still post it later on...
after i will check AndreaGeddon Stolen Byte way ...

To :AndreaGeddon
realy good work !
What took u so long to do this ?! :D
i hope (and i'm sure all others too ) that u will continue doing more of those for others Packers that Exist out there ..
Manko
01-11-2004, 10:27 AM
Hi, LaBBa!

Yeah, he seems to be very good, but you're tuts are still needed since he doesn't deal with much new aspr-trouble...

Anyway, If you need another GOOD summary of the old aspr look for crusaders tutorial, or better yet he posted his commented dissassembly of aspr here once. It's worth gold for anybody that's interested.

ps. To my good friend soldat: I'm writing a letter. Been of the net for a while. ds.

/Manko

Wow !! :eek:
AndreaGeddon u R g00d !!

Here u go ppl .. u got the "ASPR Super Tut" that we all wanted so much
this tut have it all !!!

i gess that my tut will not be needed now .. but i will still post it later on...
after i will check AndreaGeddon Stolen Byte way ...
Zilot
01-12-2004, 03:23 AM
ps. To my good friend zilot: I'm writing a letter. Been of the net for a while. ds.

/Manko

http://www.postsmile.com/img/default/0529.gif

Was wondering, had white bears eaten you ???
Uradox
01-12-2004, 07:49 AM
http://www.postsmile.com/img/default/0529.gif

Was wondering, had white bears eaten you ???

Pink Panthers!!!
LaBBa
01-12-2004, 03:48 PM
....i gess that my tut will not be needed now .. but i will still post it later on...
after i will check AndreaGeddon Stolen Byte way ...

hmm .. i read all the tut now.. and it is gr8 and all but it doesn't explain how today we can find in new versions of aspr the stolen bytes that are deleted like in the new version of the target tut 1.8.7 ..

so now i know that my tut is still needed.. i hope to finish it till this end of week ..
LOUZEW
01-13-2004, 01:41 PM
Hi, LabbA
I'm sure it will be very helpfull.
Your 2 first tuts gave me some ideas and with them, like a guideline, i've been able to unpack many targets.
Be sure you have here some guys (including some advanced unpackers) still waiting for your work.

hmm .. i read all the tut now.. and it is gr8 and all but it doesn't explain how today we can find in new versions of aspr the stolen bytes that are deleted like in the new version of the target tut 1.8.7 ..

so now i know that my tut is still needed.. i hope to finish it till this end of week ..
JMI
01-14-2004, 12:33 AM
And we might also point out that those who have never put themselves out there, by writing their own tuts, have very little room for criticism. Constructive comment should always be encouraged, because they help one improve their writing and analytical skills. Then you need to keep in mind the difference between the things you "understand" and the things you "write" and try to make sure that you have actually "written" the things you have learned in your adventures, and not simply passed over them because you already 'understand" then yourself. Remember you are writing for andience of different skill levels and you need to make a decision on the level of experience you want to address, and then make your discussion "speak" to that level of experience.

Regards,
LaBBa
01-14-2004, 07:42 PM
This is it ..
the final tut..
i just hope that more ppl will start writing tuts in a good old : "Step by Step"

I just hope that ppl that wont appreciate this tut at least will appreciate the time it took me to write it..

Best Regard to all ,

LaBBa
R@dier
01-14-2004, 11:03 PM
Thanks LaBBa

I appreciate all you hard work that has gone into your tutes

Best Wishes

R@dier
cerb
01-15-2004, 04:16 AM
Hello Labba,

great work!!!!!!!!!!!!!!!!!!!!!

Thanks

cerb

This is it ..
the final tut..
i just hope that more ppl will start writing tuts in a good old : "Step by Step"

I just hope that ppl that wont appreciate this tut at least will appreciate the time it took me to write it..

Best Regard to all ,

LaBBa
cerb
01-15-2004, 01:54 PM
Hello LaBBa,

i tried the first App in your Tut, I found one difference in the OEP. My OEP is
437589
00437589 8B1D 908A4300 MOV EBX,DWORD PTR DS:[438A90] ; .004396E8
0043758F 8B03 MOV EAX,DWORD PTR DS:[EBX]
00437591 E8 1E1FFFFF CALL .004294B4
00437596 8B0D 0C8B4300 MOV ECX,DWORD PTR DS:[438B0C] ; .00439774
0043759C 8B03 MOV EAX,DWORD PTR DS:[EBX]
0043759E 8B15 10374300 MOV EDX,DWORD PTR DS:[433710] ; .00433750
004375A4 E8 231FFFFF CALL .004294CC
004375A9 8B0D 708A4300 MOV ECX,DWORD PTR DS:[438A70] ; .00439750
004375AF 8B03 MOV EAX,DWORD PTR DS:[EBX]
004375B1 8B15 C0274300 MOV EDX,DWORD PTR DS:[4327C0] ; .00432800
004375B7 E8 101FFFFF CALL .004294CC
004375BC 8B0D 048A4300 MOV ECX,DWORD PTR DS:[438A04] ; .00439764
004375C2 8B03 MOV EAX,DWORD PTR DS:[EBX]
004375C4 8B15 DC324300 MOV EDX,DWORD PTR DS:[4332DC] ; .0043331C
004375CA E8 FD1EFFFF CALL .004294CC
004375CF 8B0D BC8A4300 MOV ECX,DWORD PTR DS:[438ABC] ; .0043976C
004375D5 8B03 MOV EAX,DWORD PTR DS:[EBX]
004375D7 8B15 28354300 MOV EDX,DWORD PTR DS:[433528] ; .00433568
004375DD E8 EA1EFFFF CALL .004294CC
004375E2 8B03 MOV EAX,DWORD PTR DS:[EBX]
004375E4 E8 6F1FFFFF CALL .00429558
004375E9 5B POP EBX
004375EA E8 69BFFCFF CALL .00403558

Is the problem I use win2k? or is another Problem?

Thx for you help

cerb

Hello Labba,

great work!!!!!!!!!!!!!!!!!!!!!

Thanks

cerb
Moonbaby
01-16-2004, 02:22 AM
Thanx LaBBa,

Your tut is very clear. But when I app it I have a trouble :

At Step #4 : Finding Stolen Bytes and re-insert them :

when I choose Debug ==> Set Condition ===> click Ok ===> I press F11 =============> but not happen ??????

Could you tell me why .

Thank you very much.

I love your tuts
cerb
01-16-2004, 04:25 AM
Hi Moonbaby,

press ctrl+F11 for Trace into.

Best Regards
cerb

Thanx LaBBa,

Your tut is very clear. But when I app it I have a trouble :

At Step #4 : Finding Stolen Bytes and re-insert them :

when I choose Debug ==> Set Condition ===> click Ok ===> I press F11 =============> but not happen ??????

Could you tell me why .

Thank you very much.

I love your tuts
LaBBa
01-16-2004, 05:27 AM
Hello LaBBa,
i tried the first App in your Tut, I found one difference in the OEP. My OEP is
437589
Is the problem I use win2k? or is another Problem?
Thx for you help
cerb

well if u are talking about the first app :
00436EAD MOV EBX,DWORD PTR DS:[437A90] ; - this is the Fake OEP
00436EB3 MOV EAX,DWORD PTR DS:[EBX]

but as u say .. u used Win2K ... i Used WinXP (look at tools for this tut)
but the Wierd thing is .. i don't thik there should be any deffrents between the address .. and the more wierd thing is .. that u have got to the same code.. ???

So .. i don't realy know how thats happend.. but we got to the same code..
:confused:
i don't have Win2K to test is my self.. sorry..
LaBBa
01-16-2004, 05:32 AM
Thanx LaBBa,
At Step #4 : Finding Stolen Bytes and re-insert them :
when I choose Debug ==> Set Condition ===> click Ok ===> I press F11 =============> but not happen ??????
I love your tuts

Check u'r steps again.. i think that u didn't done somthing right .. because i know that many ppl had no probs with it ..
Scarabee
01-16-2004, 12:24 PM
first off all, Labba thanx for all the great work and efford you put into this protector.

i have a small question though...
following your tut i arrive at setting breakpoint at IsDebuggerPresent. Olly however doesnt allow me. gives message: Unable to set breakpoint.
Any idea how to solve? thanx in advance!!
dELTA
01-16-2004, 02:31 PM
Are you using Windows 9X/ME? In that case you cannot directly breakpoint APIs Olly, it only works on Windows 2000/XP.
Scarabee
01-16-2004, 03:10 PM
Thanx for the reply.

That'll be the problem i guess. at this moment i'm running win98se. Any alternative idea how to solve this problem perhaps?
Shoob
01-16-2004, 03:54 PM
Thanx for the reply.

That'll be the problem i guess. at this moment i'm running win98se. Any alternative idea how to solve this problem perhaps?

its not prob of win98se [hxxp://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/isdebuggerpresent.asp] but i think you are on some place where Olly dont know these command cause it isnt yet in the import list of some code section :rolleyes: i sometimes have these problem or you just wrote isdebuggerpresent like "isdebuggerpresent"? dont forget large and small letters, so write "IsDebuggerPresent". After all you can for lazy guys also search for Auto IsDebuggerPresent plugin by SV and hide it permantly.
Uradox
01-17-2004, 01:55 AM
All that complicated isdebugger.. stuff at the start labba :P
Just CTRL+G and enter IsDebuggerPresent
;)
Shoob
01-17-2004, 03:33 AM
know your ;)
LaBBa
01-17-2004, 10:56 AM
All that complicated isdebugger.. stuff at the start labba :P
Just CTRL+G and enter IsDebuggerPresent
;)

yea i know that Ura .. i just wanted that other ppl will know how to set BP no only at that kind of approch .. but i forgote to put this also .. tnx for reminding us.. :D
LaBBa
01-17-2004, 11:47 AM
hi britedream
i saw many posts by u about u finding with easy way the Stolen bytes .. can u show us (expanded explnation if u can .. ) about u'r mathod of finding the Stolen bytes ?
MaRKuS-DJM
01-17-2004, 01:31 PM
hi britedream
i saw many posts by u about u finding with easy way the Stolen bytes .. can u show us (expanded explnation if u can .. ) about u'r mathod of finding the Stolen bytes ?

did you saw his post @extools, LaBBa?

Hi Markus
asprotect dosn't need that long tut, eventhough we appreciate the effort now and always that labba is doing, I thing long tut tend to be hard to follow at least for me,here is the way that britedream might do it:
1- stack hard breakpoint on the first push, takes you to pushad, do the same for the pushad takes you to the stolen bytes.
2- memory breakpiont on code section, look at the stack for the oep.
3- fix your iat- done.

and it's working very good! :)
LOUZEW
01-17-2004, 01:38 PM
:confused: :confused: :confused:
Hi, LaBBa
First of all, thank you for writing this tut !, you know i'd appreciated the last ones.

Following you approach (the first App), i meet the same thing that cerb.
I'm under Win XP SP1 and found that :

My OEP without stolen bytes is 437589

00437589 8B1D 908A4300 MOV EBX,DWORD PTR DS:[438A90] ; ACopy.004396E8
0043758F 8B03 MOV EAX,DWORD PTR DS:[EBX]

Well, not very important, let's go. Fixing IAT, some difference too but done now.
THE MOST IMPORTAT PROBLEM IS :

Finding Stolen Bytes (step #4), i have some difference in Addresses again (not important), but After the REP STOS BYTE PTR ES:[EDI], replaced by JMP EDI, tracing with F8, all is OK untill :

PUSH ECX
PUSH EAX
CALL 00A63C0B
POPAD

After that it's different, I have a JMP and then all is different, a few lines after, a CALL drive me out of memory and nothing else displayed under OLLY, the only way, restarting with CTRL+F2 !
MaRKuS-DJM
01-17-2004, 04:46 PM
After that it's different, I have a JMP and then all is different, a few lines after, a CALL drive me out of memory and nothing else displayed under OLLY, the only way, restarting with CTRL+F2 !

i know this problem, you have to nop this call. it isn't neccessary for finding stolen bytes. then you can go on with searching them.
LaBBa
01-17-2004, 07:54 PM
to follow at least for me,here is the way that britedream might do it:
1- stack hard breakpoint on the first push, takes you to pushad, do the same for the pushad takes you to the stolen bytes.
2- memory breakpiont on code section, look at the stack for the oep.

Hmm.. but where ? when ? what i will see at the memory break point ?
thats was i saied earlyer about not full explanation .. and just throwing an answer without realy explaining to all ppl .. even i didn't understand this answer.. :) -> (yes this is a smile now a cry)
LaBBa
01-17-2004, 08:00 PM
After that it's different, I have a JMP and then all is different, a few lines after, a CALL drive me out of memory and nothing else displayed under OLLY, the only way, restarting with CTRL+F2 !

ok .. now that u goted to that call .. look down left of Olly Screen and it will say somthing like : "..Access Violation..."
this is what i mean ... when u get to an "..Access Violation..."
just nop it and continue tracing again and agian till u will get to a line that is : PUSH EBP or simulate that..
("MOV DWORD PTR SS:[ESP+4],EBP – same as Push EBP")
there its starts its stolen bytes.. and from there its all the same.. (i gess)
MaRKuS-DJM
01-18-2004, 04:48 AM
ok .. now that u goted to that call .. look down left of Olly Screen and it will say somthing like : "..Access Violation..."
this is what i mean ... when u get to an "..Access Violation..."
just nop it and continue tracing again and agian till u will get to a line that is : PUSH EBP or simulate that..
("MOV DWORD PTR SS:[ESP+4],EBP ? same as Push EBP")
there its starts its stolen bytes.. and from there its all the same.. (i gess)

i hope this will clear the thing...
you execute the first push, follow ESP-Value in dump, set a hardware-breakpoint, on access > dword. Press F9. you will stop at a pushad-command (Hardware-Breakpoint)
execute this pushad, follow ESP-Value again and set again a hardware breakpoint, on access > dword. now skip all the exeptions as normal and set @the last exception breakpoint (F2) @the ret. now press F9 and you are at the beginning of stolen bytes (i think you stop at the same place as you with the trace till this command "REP STOS BYTE PTR ES:[EDI]"). but the difference: aspr hasn't executed this code before like with your trace, it executes it now. this means there is no exception or access violation like your method.
britedream
01-18-2004, 08:29 AM
thanks markus for the clarifications :)
to dear labba, :
I am glad that you saw my only post as too many, that means , you must have read it many times :) ( just teasing), if you have a point that you don't understand,please state it I will be more than happy to clarify it, I only mentioned
the setting of two breakpoints, and my feeling that anyone lacks the knowledge
of setting a breakpoint ,shouldn't try to unpack asprotect in the first place.

regards.
p.s.
it was to my surprise that you didn't post where you have read my explanation, you would have gotten the reply much sooner. ;)
LOUZEW
01-18-2004, 09:56 AM
Hi, guys
Many thank's for the time you took helping us.

LaBBa, i've now unpacked the first App. and it run fine, thank's to MaRKuS-DJM and britedream for their explanation. I still have 1 or 2 questions :

1 - Searching for stolen bytes, tracing with F8 etc..., how did you determine when solen bytes are OVER ? ? ? it's not so easy ! ! !

2 - I've tried to apply this method to an other Asprotected target (PEID give me the same asprotect ver), but it's really different (i think). Is there many packing methods with the same Asprotect version ? ? if you are interested i can give you the App name !

Britedream, tried your method, OK too but a little more explanations will help those ppl who are dealing with Aspr from a short time ! (thank's even though, it's a good thing to know many methods !).

LaBBa, i'll try your second App now ! and again many thank's for your effort, i know it's not so easy to write a tut that anybody can understand, especially if our mother's languages are different !
Computer_Angel
01-18-2004, 12:15 PM
:D i unpack many asprotect prog, i found that the stolen bytes for the prog is depend on the type of compiler you use. So just make it easy:

case 1:
38 bytes:

0066B131 55 PUSH EBP
0066B132 8BEC MOV EBP,ESP
0066B134 6A FF PUSH -1
0066B136 68 C0716C00 PUSH .006C71C0
0066B13B 68 D8B96600 PUSH .0066B9D8
0066B140 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0066B146 50 PUSH EAX
0066B147 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
0066B14E 83EC 58 SUB ESP,58
0066B151 53 PUSH EBX
0066B152 56 PUSH ESI
0066B153 57 PUSH EDI
0066B154 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP

so you just only to find the real value of 2 push command in
0066B136 68 C0716C00 PUSH xxxxx
0066B13B 68 D8B96600 PUSH xxxxx

case 2:
11 bytes:

005008BC <Module> $ 55 PUSH EBP
005008BD . 8BEC MOV EBP,ESP
005008BF . B8 5C055000 MOV EAX,dumped_1.0050055C
005008C4 . 83C4 F4 ADD ESP,-0C

just need to know the EAX value

case 3:
22 bytes:

0057B0F8 <Module> $ 55 PUSH EBP
0057B0F9 . 8BEC MOV EBP,ESP
0057B0FB . 83EC 18 SUB ESP,18
0057B0FE . 53 PUSH EBX
0057B0FF . 56 PUSH ESI
0057B100 . 57 PUSH EDI
0057B101 . 33C0 XOR EAX,EAX
0057B103 . 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX
0057B106 . 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
0057B109 . B8 78A95700 MOV EAX,a.0057A978

just need to know the EAX value

case 4:
16 bytes:

004FF904 <Module>/$ 55 PUSH EBP
004FF905 |. 8BEC MOV EBP,ESP
004FF907 |. 83EC 14 SUB ESP,14
004FF90A |. 33C0 XOR EAX,EAX
004FF90C |. 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
004FF90F |. B8 54F34F00 MOV EAX,dumped_1.004FF354

just need to know the EAX value

case 5:
8 bytes:

005B8F74 <Module>/$ 55 PUSH EBP
005B8F75 |. 8BEC MOV EBP,ESP
005B8F77 |. B9 06000000 MOV ECX,6

just need to know the ECX value

case 6:
12 bytes:

004B38C0 > $ 55 PUSH EBP
004B38C1 . 8BEC MOV EBP,ESP
004B38C3 . 83C4 F4 ADD ESP,-0C
004B38C6 . 53 PUSH EBX
004B38C7 . B8 58334B00 MOV EAX,dumped_.004B3358

just need to know the EAX value

case 7:
00553710 00 DB 00
00553711 00 DB 00
00553712 00 DB 00
00553713 00 DB 00
00553714 00 DB 00
00553715 >/$ 55 PUSH EBP
00553716 |. 8BEC MOV EBP,ESP
00553718 |. 51 PUSH ECX
00553719 |. 52 PUSH EDX
0055371A |. 53 PUSH EBX
0055371B |. 50 PUSH EAX
0055371C |. 6A 00 PUSH 0
0055371E |. 53 PUSH EBX
0055371F |. B8 A0305500 MOV EAX,.005530A0

need the EAX value. It's the special case, i just see it only one time.

case 8:
25 bytes:

005BC558 55 PUSH EBP
005BC559 8BEC MOV EBP,ESP
005BC55B 83C4 E4 ADD ESP,-1C
005BC55E 53 PUSH EBX
005BC55F 56 PUSH ESI
005BC560 57 PUSH EDI
005BC561 33C0 XOR EAX,EAX
005BC563 8945 E4 MOV DWORD PTR SS:[EBP-1C],EAX
005BC566 8945 E8 MOV DWORD PTR SS:[EBP-18],EAX
005BC569 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
005BC56C B8 68BE5B00 MOV EAX,005BBE68

just need the EAX value.

----------------------------------------------------------
So, if the stolen bytes case is just need an EAX or ECX value. It's easy for us to find this value.
If the stolen bytes is case 1: you must use the conditional breakpoint
on the command:
PUSH EBP
MOV EBP,ESP
PUSH -1

and ctrl-f11 until you find these stolen bytes, and at that point, you will see two push command below with the value you need :D

----------------------------------------------------------
about finding the real OEP, you can use the techique of Ricardo, it more easier than the step labba has done (opps sorry :D )
cRk
01-18-2004, 05:59 PM
i personally don't see any knowledge with your comments Computer_angel.. we want the good theory then to go and practice. what exactly we have to do with the info. you gave? how to know the compiler used? how to get the stolen bytes? you haven't answer at all . also there are some other delphi app which the OEP start dosen't begin with 558BEC..... which case we have then?

Regards
LaBBa
01-24-2004, 06:09 PM
Hi all ..
i just finished to review all the posts here ..
and i'm glad to see that most ppl got there answers.. and most of aspr problem are now clear..

so i think that we have done all we can about this protection.. and its now time to move on to another protection..

i just hope i will have more spare time to do this kind of "Super Threads"..
that most of all kind of Q will be in 1 Thread ..
(like i saw at Xtream protector.. )

so ppl please remember .. when u got an answer to a Q please try to explain as much as u can about the prob (where ? when? how? why?)

what will be my next Protection tut ?

well .. i even don't know.. i'm thinking about somthing more hard like FlexLM or HASP things..

i havn't found, not even 1 tut about those for advance newbies ..
only the ones in this board and at CrackZ page that are both for advanced ppl that already know how to deal with those kind of protection..

so i'm thinking those kind should be next..

and even if i won't do it.. i hope that some one will do it..

again tnx all ..

Best regards ,
LaBBa.
init
01-24-2004, 07:02 PM
hi, im having problems on the last section on step#2, after you dump the file with proc dump, you press f8 and you say it should bring me to the fake oep, but it isn't taking me to the same place you are after RETN, i get this:

00437589 8B DB 8B
0043758A 1D DB 1D
0043758B 90 NOP
0043758C 8A DB 8A
0043758D 43 DB 43 ; CHAR 'C'
0043758E 00 DB 00
0043758F 8B DB 8B
00437590 03 DB 03
00437591 E8 DB E8
00437592 1E DB 1E
00437593 1F DB 1F
00437594 FF DB FF
00437595 FF DB FF
00437596 8B DB 8B
00437597 0D DB 0D
00437598 0C8B4300 DD .00438B0C
0043759C 8B DB 8B
0043759D 03 DB 03
0043759E 8B DB 8B
0043759F 15 DB 15
004375A0 10374300 DD
.00433710 ; ASCII "P7C"
004375A4 E8 DB E8
004375A5 23 DB 23 ; CHAR '#'
004375A6 1F DB 1F
004375A7 FF DB FF
004375A8 FF DB FF
004375A9 8B DB 8B
004375AA 0D DB 0D
004375AB 708A4300 DD .00438A70
004375AF 8B DB 8B
004375B0 03 DB 03
004375B1 8B DB 8B
004375B2 15 DB 15
004375B3 C0274300 DD .004327C0
004375B7 E8 DB E8
004375B8 10 DB 10
004375B9 1F DB 1F
004375BA FF DB FF

and if i press ctrl + a it does nothing
R@dier
01-25-2004, 04:06 AM
hi, im having problems on the last section on step#2, after you dump the file with proc dump, you press f8 and you say it should bring me to the fake oep, but it isn't taking me to the same place you are after RETN, i get this:

00437589 8B DB 8B

This is the fake OEP of the version you are now dealing with.
I also had this version as did a few others, if you read some of the posts in this thread you will see.

use the tut as a method for dealing with the problem,
the steps are the same just some of the adresses will be different.

Best Wishes

R@dier
Asmodeus
01-25-2004, 11:05 PM
After that it's different, I have a JMP and then all is different, a few lines after, a CALL drive me out of memory and nothing else displayed under OLLY, the only way, restarting with CTRL+F2 !

I´m having the same trouble, and I AM noping at every stop, just as the tut sayz? :confused:
Otherwise everything works like charm, but this seems a little strange.
Anyway, I will try again tomorrow :o
And Thanx for the great tut! I´m actually in a bit over my head here, but with a little luck... :D
cerb
01-26-2004, 05:25 AM
Hi Asmodeus and Init,

the fake ope = 00437589 is right. At this step click the right button in the code section -> Analysis > Remove Analysis and you should now see the code.

Best regards
cerb

I´m having the same trouble, and I AM noping at every stop, just as the tut sayz? :confused:
Otherwise everything works like charm, but this seems a little strange.
Anyway, I will try again tomorrow :o
And Thanx for the great tut! I´m actually in a bit over my head here, but with a little luck... :D
LOUZEW
01-26-2004, 06:43 AM
I´m having the same trouble, and I AM noping at every stop, just as the tut sayz? :confused:
Otherwise everything works like charm, but this seems a little strange.
Anyway, I will try again tomorrow :o
And Thanx for the great tut! I´m actually in a bit over my head here, but with a little luck... :D

OK, Asmodeus i can help you !

The problem is the last call before you stay with a blank window under olly and the only thing to do is a CTRL+F2, you don't have any access violation message, but this call has to be NOPed.
So, restart Olly (CTRL+F2), and do all the job until the line just above this call, then NOP it and follow the tut. (Except this Call, all is clear in the tut !).
Asmodeus
01-27-2004, 01:15 AM
Hi and thanks for your answers!
I will try this as soon as I can!
Louzew, you must be right. It´s logical that it must be the instruction "last-before" that is throwing me into "No-whereland"! If I nop this, everything should probably work well.
Actually, my target is a slightly newer build than the one in the tut, but this far everything seems the same, just some of the actual adresses are different. But all the instructions are matching, so I think this will work well in the end. :D
thanx again!
LOUZEW
01-27-2004, 10:07 AM
Hi, LaBBa
First of all, many thank's for this nice tut and the help you gave me (and all other).
Following your tuts, i've now unpacked these 2 Apps. I've been able to apply your method to an other app too.

But now, i'm dealing with some other apps, trying to see if your methods work too, I choose some Elcomsoft Apps (All their apps seem to be packed with Asprotect, different versions and differents methods).

The 1 St one i worked on was APDFPRP ( Advanced PDF password recovery pro) and it was a little bit different, i've now fully unpacked this target but it was hard, i've finished it with help from DGrojo help (hard to translate Spanish for me) and i expect to write a little English tut for this type of protection (hope i can do it).

The second one is AOXPPRP (Advanced Office Password Recovery Pro), seem very easy in a first approch but i'm not able to find how to resolve the prob, I've found an oep to 401000 and no stolen bytes but the app crash !

( oh, yes, i've resolved some other apps from Elcomsoft like Advance Registry Tracer and Advanced Disk Catalog)

Can you take a look to their apps (Aoxpprp particulary) and tell me if i'm an idiot or if it'e really different ? ?

You can find their site at http://www.elcomsoft.com

Many thank's LaBBa ! !
LaBBa
01-27-2004, 01:42 PM
Hi, LaBBa

The second one is AOXPPRP (Advanced Office Password Recovery Pro), seem very easy in a first approch but i'm not able to find how to resolve the prob, I've found an oep to 401000 and no stolen bytes but the app crash !
...... and tell me if i'm an idiot or if it'e really different ? ?

AOXPPRP well i checked only this app realy quickly..
its realy look like its going to be easy but .. some of the resource after unpacking the app became to have an access violation ..

well .. yea its differnt .. like i saied in my unpacking tut..

i can't explain the fixing of redirected calls

and it could be an version with nanomites (Uradox told me they are some out there..)

i don't have time to look at this to make sure witch one is it .. sorry..
but only 1 thing .. u may have done wrong the fixing of the IAT because my app doesn't crashes after the unpacking.. only lame messagebox that can be bypass and then it runs ok (with some errors in the resource..)

again... sorry i don't have much time to look into it..
i will be happy if u will continue and update us all about what u will find..

Best regards ,
LaBBa
LOUZEW
01-27-2004, 03:12 PM
AOXPPRP well i checked only this app realy quickly..
its realy look like its going to be easy but .. some of the resource after unpacking the app became to have an access violation ..

well .. yea its differnt .. like i saied in my unpacking tut..

i can't explain the fixing of redirected calls

and it could be an version with nanomites (Uradox told me they are some out there..)

i don't have time to look at this to make sure witch one is it .. sorry..
but only 1 thing .. u may have done wrong the fixing of the IAT because my app doesn't crashes after the unpacking.. only lame messagebox that can be bypass and then it runs ok (with some errors in the resource..)

again... sorry i don't have much time to look into it..
i will be happy if u will continue and update us all about what u will find..

Best regards ,
LaBBa

OK, thank's
I can understand you are busy, i'm in this state the most of the time.
Your response is good enough for now, i know i've done something wrong resolving IAT.
I'll try again in a few days !
cerb
01-27-2004, 03:13 PM
[Post contents deleted by JMI for violation of the rule prohibiting posting "target specifically identified code."]

Best regards
cerb
LaBBa
01-27-2004, 03:33 PM
At the position you can do with ImpRec Fix the IAT:
Size: 1000
OEP : 401000
and you can run the app.
cerb
yea.. but now press on the dialog to register and see what will happend .. an access voilation.. :D
cerb
01-27-2004, 04:10 PM
hi LaBBa,

i didnt get a acces voilation

cerb

yea.. but now press on the dialog to register and see what will happend .. an access voilation.. :D
JMI
01-27-2004, 06:01 PM
cerb:

I have deleted the contents of your previous post because you have several times violated our rule against posting code from a specifically identified target. If you want to post code, make sure that you do NOT specifically identify the target (do NOT state its name) and that you REMOVE the name of the target from all portions of the code you do post. If you want to discuss a specifically identified target, do so ONLY by PM or private email.

Regards,
nikolatesla20
01-27-2004, 07:09 PM
JMI, I have a question - how can I write a tutorial without referring to any specific target?....along with that, all the tutorials on fravia's site refer to specific files. Are tutorials allowed to do such or what is the best option?

I have no problems with the board rules, I can understand removing links but why so strict in target specifics. Of course we don't want to hold anyone's hand thru a reversing session, but even to show a general reverse there almost has to be a target...otherwise the one going thru the tutorial won't even know how to begin. So how do I balance these ideas?

-nt20
JMI
01-27-2004, 08:24 PM
nikolatesla20:

You have raised a good question and I'll attempt to make a distinction between the contents of tutorials and the active posts here on the Forum.

Generally, whenever a tutorial is written the author is discussing the methods and techniques used by a particular version of some specific software and that may appear to be a conflict with the rule against the posting of target specific code on the Forum, but actually is not. Generally, by the time that any tutorial gets even moderate distribution and consideration, the software vendors get wind of the publication and, particularly with regard to protection software, makes greater or lesser changes in their protection scheme and/or software to attempt to avoid the described methods of defeating their protection. In that sense one could argue that we are actually helping the protectionist actually improve their products and increase their revenue, by selling newer versions of their software to anyone who may not be entitled to free updates.

However, the general purpose of this Forum is the study of and analysis of the reverse engineering techniques, not the distribution of means and methods of the free use of commercial software. I believe you will find in the vast majority of the tutorials found on the +Fravia archive that the tutorials are for analysis purposes and study and they contain the direct statement that if one intends to continue using the specific product, one should actually purchase it.

This goes to the issue of why we had to enforce the end of people posting IAT's and such. We are not interested in making this a place where one comes to find the specific code which could be pasted into someone else’s dump which would make a specific piece of software available for use without compensation to its author. If we permitted the posting of specific code with which one could "convert" a specific piece of software, software vendors would, and do attack our sever hosts, complaining we are distributing "crackz" and "Warez" and that is not were want to be happening here.

We want people to come here to learn how reverse code engineering works and the methods and techniques one uses to study and determine how various systems and components of operating systems attempt to do or attempt to prevent the doing of various things. It is the mental challenge of figuring out what is happening and how to defeat it that sustains those of us who have been at this for an extended period of time. While this may give those who study these techniques the ability to do things which may be argued by others to be infringing on their intellectual property rights, we do not advocate that they use them in such a manner or for such a purpose.

Therefore, a tutorial which merely described how to remove the protection of target x would not have very high value in the sense of "reverse engineering." However, a tutorial that simply uses a target as the basis for analysis of what a protection system is attempting to do is of much interest, not because it provides a solution for that specific piece of software, but because it provides a basis of analysis of a methodology of what one can do to attempt to protect software and what one can do to attempt to defeat those efforts.

In this sense, the specific software is essentially irrelevant, except it is the “vehicle” through which the analysis is presented. The object is hoped not to be the "solution" of that piece of software, but the analysis of whatever new technique is being discussed.

So if one posts here code which say do step one, two, and three and you will have a working version of software WWW, we can anticipate attack on our ability to maintain this Forum on the net. Therefore, we can not allow someone to post code for what is identified as software WWW and identify exactly where software WWW may be patched to make a ‘working” version.

So the difference is between a “generic” discussion, which maybe discusses stolen bytes or anti-debugger methods and might even include code which does not identify a specific target and one which is ‘specific” to those issues in software WWW. In the former circumstance one may know how to reverse a protection, but they, themselves, have to go out and find a specific piece of software which uses that technique and reverse it themselves. Then what they decide to do with it is their problem, and not ours. I hope I have made the distinction more clear. As I stated in the post above, one can always post code which doesn't specifically identify a target and exchange more detailed information with those who feel the need to attempt to follow along by PM and/or private email.

Regards,
esther
01-27-2004, 08:59 PM
Well I think specify a target when posting in the forum does not really affect anything.We are not god we can't guess what the target is and its "hard" to help them even they post specific codes here.Of coz reversers here ONLY HELP them to analysis certain areas but not to help them to crack the hole.

My 2 cents :)

Regards
nikolatesla20
01-27-2004, 11:34 PM
Thank you for the clarification JMI. I agree with you completely on the fact that we want to preserve this place, and to post target specifics turns it more into a "warez" type forum. I tend to think that this would also lower the quality of the community as well, since those coming here would only want the quick crack. Thank you for helping me re-realize that :)

I still want to construct a tutorial on my latest project, however, which believe it or not, isn't about unpacking, but it's about attacking a VST instrument. It would be about unpacking, but this particular target wasn't packed. I got into the project simply because I wanted to know if I could find and remove the offensive code and how do I even find how to get to it, so I have come up with some cool info on how to get into these programs (VST plug-ins for audio apps) which can be used as a generic method of attack. But I'm still unsure how to really "publish" it....I'm also sure there are others out there that may have heavy experience in this realm already, but I haven't seen any real info on them and just thought it was a cool little project. (Remember Radium? where are they?...).

Anyway this discussion turns the theme of this thread in another direction. I should probably post in a new thread about any further concerns.

-nt20
JMI
01-28-2004, 02:57 AM
To repeat an old phrase, "I know where you're coming from." I got into reversing when trying to learn how to remove pace copy protection from earily Mac music programs. I simply started in with MacNosy and began taking the progams apart without knowing anything about what I was doing or what to be looking for. That lead to reading about assembly language programming and learning how to prevent the protection from blowing up the debugger. That taught me that if you can prevent them from removing the functionality of the debugger, with enough patience, you can eventually solve almost any reversing problem. You would not believe how many hours I would trace code in single step mode before learning more about what was going on. The general rule was simple: "if the code was going to run, the code had to decrypt itself" and if you could watch it long enough, you could eventually see that happen.

Eventually I learned not only what they were doing, but how to circumvent what they had done. I wasn't interested in distributing cracks to software protected by their system, I was a legitimate purchaser of all of it. It was simply the challenge of learning how to understand what they had done and how to work around it and then waiting for the next version and refusing to let the damn machine get the better of me. :rolleyes:

Eventually I even discussed some of the programs shortcomings, like using the same phrase to start their hash of the code sections (good old BEEFABAD) with company representatives at one of the local MacWorld Conventions. Boy were they surprised I could tell them in detail how their program worked and what its weaknesses were. Then I waited for them to fix it again, and started again taking it apart.

Then I began moving into the windows world and had to start back at square one. There is always more to learn and read and that helps keep the mind active and gives one something to focus on besides the issues of real life. The only problem is that real life, as opposed to school life, leaves so little time for such hobbies and so many other responsibilities. But the mental challenge remains. Who's going to win tonight, the person in front of the machine or the person behind the software. It would all be just much less interesting, if they didn't also work hard to try to stay ahead of all of you.

And the games go on. :p

Regards,
cerb
01-28-2004, 03:49 AM
Hi JMI,

no problem with the rules. Whe anyone would the code snippset should privte message me to get it.

best regards
cerb
LOUZEW
01-28-2004, 05:54 AM
Hi, JMI, Nikolatesla, cerb, esther and all other
I agree totally with these rules, if somebody want to write about specific target code, we can do that by PM or mail!
Cerb, thank's for your help, but what you wrote (and JMI delete) was not necessary, this was well know since LaBBa write his Super tut ! (and a little bit early).
I've done the job now, it was a mistake resolving IAT. Like said our friend LaBBa, unpacking this target is now done, but there is some trouble with resources (a msgbox about resource decryption error, and all displayed strings are quotes with "%").
I'll try to find something on later, cause i'm now busy on an other job !

Thank's to you ALL !
LaBBa
01-28-2004, 06:08 AM
.....(and a little bit early).
.......but there is some trouble with resources (a msgbox about resource decryption error, and all displayed strings are quotes with "%")......

Hmm.. somtimes i don't know if ppl realy read the posts or just comes here and write what ever they want .. :p

LOUZEW.. if u will read some thread back u will see that this is exactly what i wrote about this ..
about the IAT rebuilding .. nothing has changed..... please recheck u'r self.. and pleas read early posts that are here ..

.....(and a little bit early)...

:confused: i don't understand ..

..it was a mistake resolving IAT. Like said our friend LaBBa...

hmm.. so please share with us the info about your way .. i did share already what i have found .. so be kind and share the info u found with us .. ;)

Best regards ,
LaBBa
nikolatesla20
01-28-2004, 07:29 AM
Well...that resource has to be loaded at some point in time, why not try loading the actual resource in question and trying to dump the program again while it's loaded? Then find the resource code and re-paste the particular resource back into the original file..

-nt20
LaBBa
01-28-2004, 08:25 AM
Well...that resource has to be loaded at some point in time, why not try loading the actual resource in question and trying to dump the program again while it's loaded? Then find the resource code and re-paste the particular resource back into the original file..
-nt20

Yea.. i know it .. but didn't had time to look if this is realy the problem or not...

i just unpacked it and rebuild and i saw it runing and thats it ..
i hope that some one else will show us all how it should be done
"Step by Step" .. :)
Manko
01-28-2004, 01:31 PM
Hi!

I don't know why, but I couldn't get to their page, so I'll just speculate...

I think cerb got it right, and his steps are "necessary". (I guess there are numerous ways to get it done, but his way was probably the simplest and adequately effective.
I am guessing that what he did, was to dump it after the resources had been decrypted, and set the new EP directly after the decrypting routine. This place probably is the REAL "OEP" before the added crypting and aspr and decrypting...
Also, I am guessing that if you dump it at what WE THINK is the OEP it will decrypt wrong when aspr is not there...

Just speculation, but it might be true...

Furthermore, to LABBA:

About LOUZEW; I don't think he meant there was anything wrong with your method of fixing IAT, rather he didn't apply your theory correctly, and that is what he is saying, plus he's accknowledging that you mentioned he might have got it wrong.

bla, bla... Hope I guessed correctly! :D

/Manko
R@dier
01-29-2004, 05:57 AM
Hi,

I tried this proggy and managed to unpack it successfully,
there was a problem with the way imprec had identified some of the imports,
I ended up correcting it by hand when I saw a couple of the imports had the same name.

all seems to be working fine.

Regards

R@dier

PM me if you need a working Iat (hope thats not against the rules ;) hehehe)
Uradox
01-30-2004, 10:50 PM
AOXPPRP well i checked only this app realy quickly..
its realy look like its going to be easy but .. some of the resource after unpacking the app became to have an access violation ..

This could possibly be another feature in aspr that redirects *delphi* resources.. Basicly aspr handles some of them and the real pointers are redirected and thus when u unpack access violations occuring. However iv only ever seen this once in a target, mind you i dont really look at aspr anymore. Solution is simular to the dead exception handeling emulation idea, inject some code to scan for these redirected pointers read table and patch new.
But it may not be it because i think when its protected it does every possible resource it can redirect. who knows :P i dun even know what app u guys talking bout i check here bout once a week if that :)
cRk
01-30-2004, 11:05 PM
elcomsoft isn't delphi app. so far i know ;) isn't them Microsoft Visual C++ 6 ?

Regards
Uradox
01-31-2004, 05:48 AM
elcomsoft isn't delphi app. so far i know ;) isn't them Microsoft Visual C++ 6 ?

Regards
sorry :P i didnt really pay any attention to whatever target you guys are looking at, only skimmed through :)
/me slaps himself around with a large trout
LOUZEW
01-31-2004, 05:53 AM
Hi, Crk
only for infos :

Elcomsoft release many apps, some are Delphi ones (like ART), some other are MSVC++, BC++(AOXPPRP), Watcom C/C++ (APDFPRP) etc..
LOUZEW
01-31-2004, 06:01 AM
Hi!

About LOUZEW; I don't think he meant there was anything wrong with your method of fixing IAT, rather he didn't apply your theory correctly, and that is what he is saying, plus he's accknowledging that you mentioned he might have got it wrong.

bla, bla... Hope I guessed correctly! :D

/Manko

You're right Manko, i'm not blaming LaBBa, he done a good job with his Super tut ! I'm only reporting here what i've done and confirming LaBBa tips on AOXPPRP resources !
I think he had trouble with my posts, due to my bad English.
Sorry !
hobferret
01-31-2004, 04:53 PM
Hi guys :)

I need a little help with LaBBa aspr tut and a weird proggie

After tracing for stolen bytes i.e. REP STOS BYTE PTR ES:[EDI]

I end up at an address which holds ADD EAX,EDX, POPS the fake EP address then jumps thru rubbish - eventually arriving at CALL DWORD PTR SS:[EBP+1C] which is an access violation

The next instruction is a JMP 6A48C2FD which obviously does not exist

So I set a new origin on the next JMP just below and then come across this

55 PUSH EBP
8BEC MOV EBP,ESP
83EC 14 SUB ESP,14
33C0 XOR EAX,EAX
8945 EC MOV DWORD PTR SS:[EBP-14],EAX

But nowhere can I find the next instruction which should be MOV EAX, BLAH

I would really appreciate some help on this coz i've been thru it time and time again with no success :mad:

/hobferret
LaBBa
01-31-2004, 05:48 PM
Hi guys :)

I need a little help with LaBBa aspr tut and a weird proggie...
........
........
But nowhere can I find the next instruction which should be MOV EAX, BLAH
/hobferret

Well dud.. u need to read again how to find the EAX value... i don't think u understand it at all ..

the eax value u get :

00A51C64 55 PUSH EBP - > here look at the EAX value
00A51C65 8BEC MOV EBP,ESP
00A51C67 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]
00A51C6A 85C0 TEST EAX,EAX
00A51C6C 75 13 JNZ SHORT 00A51C81
00A51C6E 813D A47AA500 00>CMP DWORD PTR
DS:[A57AA4],400000 ; ASCII "MZP"
00A51C78 75 07 JNZ SHORT 00A51C81
00A51C7A A1 A47AA500 MOV EAX,DWORD PTR DS:[A57AA4]
00A51C7F EB 06 JMP SHORT 00A51C87
00A51C81 50 PUSH EAX
00A51C82 E8 3135FFFF CALL
00A451B8 ; JMP to kernel32.GetModuleHandleA
00A51C87 5D POP EBP
00A51C88 C2 0400 RETN 4

or when before u dump at this code :

0040531C BA 9C704300 MOV EDX,.0043709C
00405321 52 PUSH EDX
00405322 8905 B8844300 MOV DWORD PTR DS:[4384B8],EAX
00405328 8942 04 MOV DWORD PTR DS:[EDX+4],EAX
0040532B E8 98FFFFFF CALL .004052C8
00405330 5A POP EDX
00405331 58 POP EAX - > after the pop the value of eax will show...
00405332 E8 15E1FFFF CALL .0040344C
00405337 C3 RETN

please.. read more carefuly... and post those kind of Q at the same Tread and dont open a new one... i hope that admins of this board will move this to where it should be...

[Edit by JMI: Threads merged, as they appear to belong together, as LaBBa suggested.]

Regards ,
LaBBa.
LaBBa
01-31-2004, 06:02 PM
Hi all ..

I saw some post about my bad way of fixing IAT with imprec...

well i know why they probably say that... Imprec have somtimes a problem that it fixes 2 times the same api..

all i got to say is ... i already wrote about that long time ago in some old tut.. just use the search and u will find about 3-4 more tuts i done... that includes old tricks and till now the new...

there is no way that i can put into 1 tut all the tricks of aspr... sorry.. just

Use the search about aspr and i can tell u this....

U WILL FIND ALL THERE IS TO KNOW ABOUT ASPR LAME PROTECTION

Regards ,

LaBBa .
hobferret
02-01-2004, 07:52 AM
LaBBa, I am not saying you are wrong and I have read your VERY GOOD tut over and over, however, there is something weird about this prog. I am not going to mention it's name or else JMI will flame me!. ;)

I do understand what you are saying and have tried it on other progs to try and clarify what is going on. The others have been completed with complete success, but not this one!

Sorry about posting a NEW thread but I just thought that probably no one would read it if I stuck it on the end of your thread and I needed someone to read it - OK.

THIS WEIRD PROG
First part

00A51C64 55 PUSH EBP -> EAX==0
............
............
RETN 4

To here
004070F9 |. A3 68C64F00 MOV DWORD PTR DS:[4FC668],EAX ;
004070FE |. A1 68C64F00 MOV EAX,DWORD PTR DS:[4FC668]
00407103 |. A3 D8604F00 MOV DWORD PTR DS:[4F60D8],EAX
00407108 |. 33C0 XOR EAX,EAX
0040710A |. A3 DC604F00 MOV DWORD PTR DS:[4F60DC],EAX
0040710F |. 33C0 XOR EAX,EAX
00407111 |. A3 E0604F00 MOV DWORD PTR DS:[4F60E0],EAX
00407116 |. E8 C1FFFFFF CALL Prog.004070DC
0040711B |. BA D4604F00 MOV EDX,Prog.004F60D4
00407120 |. 8BC3 MOV EAX,EBX
00407122 |. E8 81D7FFFF CALL Prog.004048A8
00407127 |. 5B POP EBX
00407128 \. C3 RETN

Scrolling up I get this:-
004070E8 /$ 53 PUSH EBX
004070E9 |. 8BD8 MOV EBX,EAX
004070EB |. 33C0 XOR EAX,EAX
004070ED |. A3 CC604F00 MOV DWORD PTR DS:[4F60CC],EAX
004070F2 |. 6A 00 PUSH 0
004070F4 |. E8 2BFFFFFF CALL Prog.00407024

So I am assuming that it must be EBX that holds the info not EAX as there is no instruction PUSH EAX - only PUSH EBX followed by MOV EBX,EAX - but when EBX is popped the value is 7FFDF000

So things just do not follow and like I said there is nothing like MOV EAX,XXXXXXXX [B8XXXXXXXX] in the stolen bytes area!

Following the RETN @ 00407128 we get to the fake entry point so somewhere we are across purposes mate else I am just THICK!

Help would be appreciated - thanx ;)

/hobferret
LaBBa
02-01-2004, 11:46 AM
LaBBa, I am not saying you are wrong .....
.....
......
So I am assuming that it must be EBX that holds the info not EAX as there is no instruction PUSH EAX - only PUSH EBX followed by MOV EBX,EAX - but when EBX is popped the value is 7FFDF000
.......
Help would be appreciated - thanx ;)
/hobferret

the early post about the fixing the AIT wasn't for u.. so ... i know u didn't say i was wrong... and even if i was.. it's ok..

the post i did gave u was about the EAX value who was with POP EAX ..
U ARE Right !! .. but in the tut befor this one i already said that some version of aspr uses like u said here :

004070F9 |. A3 68C64F00 MOV DWORD PTR DS:[4FC668],EAX ;
004070FE |. A1 68C64F00 MOV EAX,DWORD PTR DS:[4FC668]
00407103 |. A3 D8604F00 MOV DWORD PTR DS:[4F60D8],EAX
00407108 |. 33C0 XOR EAX,EAX
0040710A |. A3 DC604F00 MOV DWORD PTR DS:[4F60DC],EAX
0040710F |. 33C0 XOR EAX,EAX
00407111 |. A3 E0604F00 MOV DWORD PTR DS:[4F60E0],EAX
00407116 |. E8 C1FFFFFF CALL Prog.004070DC
0040711B |. BA D4604F00 MOV EDX,Prog.004F60D4
00407120 |. 8BC3 MOV EAX,EBX - > HERE EAX GET ITS VALUE BACK !!!
00407122 |. E8 81D7FFFF CALL Prog.004048A8
00407127 |. 5B POP EBX
00407128 \. C3 RETN

so :
00407120 |. 8BC3 MOV EAX,EBX - > HERE EAX GET ITS VALUE BACK !!!

is the value..

and its already was talked about .. please.. just use the search and u will find some of my tuts here.. and all of the tricks are over there.. and if not in my tuts.. there is many more that other ppl also have done..

Regurds ,

LaBBa .
D-Jester
02-01-2004, 02:50 PM
I will not give a target name but while attempting to unpack this target Protected by Asprotect 1.2x, target crashes at this instruction, while being Debugged by Olly 1.9d

LEA ESP, DWORD PTR SS:[ESP+EBP+D] (I have no idea what 'D' is.)

Here is a screen dump of the crash...

hxxp://d-jester1.tripod.com/images/ThisError.png

I am guessing that Olly is crashing the target, but I am not sure.
Or that Olly has been detected, and the program is crashing itself.

I have ended up at this error a dozen times even when I 'TC EIP<900000'
as suggested by LaBBa.

My Kernel32.dll is patched so I know IsDebuggerPresent is not giving me away.

That still leaves FS:[20](Debug Context), I may have missed that instruction.

I make it to where LaBBa said to trace, and instead of tracing (which crashes) I single step, and I still crash...the prog runs fine without Olly.

Any suggestions?
LaBBa
02-01-2004, 04:06 PM
I will not give a target name ....
....
I single step, and I still crash...the prog runs fine without Olly.
Any suggestions?

Well.. it's going to be hard to help u like this.. so i will ask a few Q first..
1. What OS u use ?
i use winXP pro...

2. Olly and u'r computer are not alwes working well ... did u try restarting the computer and then try again ?
i found that very helpful somtimes.. :D

if all u'r answers are still the same.. please.. PM me.. with app name..
and i will try to help..

Regards ,

LaBBa .
hobferret
02-01-2004, 07:00 PM
Thanx LaBBa for your reply :)

Will give it a go b4 I go to the land of nod :D

BTW did not read your other tuts have been rather busy of late - good nite

/hobferret
cRk
02-01-2004, 11:24 PM
I am not going to mention it's name or else JMI will flame me!.

does helping someone and guiding him trought the right trails/steps mean flaming to you? :mad:

also you should think before that exist what's called Private MEssage or Email to tell the target!
D-Jester
02-02-2004, 12:53 AM
1. What OS u use ?

Currently WinME
I was using Win2k had to replace that install after a bad SICE install made it un bootable, so I reverted.
Thinking of Dual booting XP Pro/ ME

2. Olly and u'r computer are not alwes working well ... did u try restarting the computer and then try again ?

Yeah its a Clean install. Less Than 2 months old.

(I have no idea what 'D' is.)

Sorry had a brain fart, too much caffeine not enough sleep.

I think I will try something different, my resume only has UPX and UPX Scrambler on it, thought I would try to ride with big dogs, but think I need to get back on the porch anc bark for awhile.
JMI
02-02-2004, 02:26 AM
cRk remember that hobferret added a smilie face at the end of the comment which generally signals an attempt at humor. And I believe the difference between a "flame" and an "constructive criticism" is that a "flame" is directed at an individual on a personal level. A "constructive criticism" is aimed at a behavior.

I do not direct my comments as criticism of a person, but as an effort to teach what I view as a better approach to issues of learning and helping oneself. Failing to search or to help oneself does not make a person "bad" or "lesser" but it does tend to reduce the value of the lesson. It simply means they have settled for a way that provides less rewards and fewer chance of meaningful learning. I view my role as attempting to steer people back to a path not only called for by our rules, but one which is truely the path to greater learning.

hobferret clearly was demonstrating that he was following the rules, and for that no other "guidance" is really needed. ;)

Regards,
R@dier
02-02-2004, 05:27 AM
@hobferret
when you execute
MOV EAX,EBX ; EAX = 004F57C0
this is the value you need to fix your stolen bytes

here are your stolen bytes
OEP :004F5DB8

004F5DB8 55 PUSH EBP
004F5DB9 8BEC MOV EBP,ESP
004F5DBB 83EC 14 SUB ESP,14
004F5DBE 33C0 XOR EAX,EAX
004F5DC0 8945 EC MOV DWORD PTR SS:[EBP-14],EAX
004F5DC3 B8 C0574F00 MOV EAX,dumped_.004F57C0

Best Wishes

R@dier

program runs fine
hobferret
02-02-2004, 05:03 PM
Cheers R@dier :cool:

Managed to smell the coffee last nite but still have a small prob, have sent a PM

Cheers and thanx for your help

/hobferret

Just tried to send you an email to yr address but it failed :confused:
R@dier
02-02-2004, 07:12 PM
@hobferret.
Hi,

email is up and running again :D

R@dier

PM sent
hobferret
02-03-2004, 08:46 AM
@hobferret.
Hi,

email is up and running again :D

R@dier

PM sent

Hi R@dier :D

Sorry about being a pain in the a**e but I just got up and decided to have a go at V2 of prog - and did the whole lot in a few minutes, running perfectly. So basically I am "stunned", god only knows what was going wrong with V1.5. :D

Off 2 work soon - thanks 4 your help - much appreciated ;)

/hobferret
nikolatesla20
02-03-2004, 11:43 AM
hobferret all it is, is experience :) You're just getting better.

-niko
hobferret
02-03-2004, 12:27 PM
hobferret all it is, is experience :) You're just getting better.

-niko

Hiya nt :cool:

I could not understand it, it's the first aspr'd prog I ever had trouble with although these are the first with the "stolen" bytes erased - all the oldies had them in high memory :D

It must have been something with the way it was being dumped because it was trying to move addresses that did not exist into registers :confused:

But you are right everything is experience one never stops learning :cool:

/hobferret


Asprotect ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Asprotect ;-)
PDA

View Full Version : Asprotect ;-)

peterg70
12-26-2003, 08:25 AM
Sorry for the title but I thought I would ask first

Target is protected with asprotect 1.23 RC4 demo. Unpacking and hacking isn't a problem as I am sure JMI can attest to using the search function :D

What I would like to know is the following. The target pops up a box saying
Trial 1 of 30 days with Register/Unlock/Quit/I Agree buttons.

Is this standard to asprotect or not. I have traced the Unlock function and found goodguy/badguy routine for popping up the 'Bad Code' messagebox.
What I want to know is the following. Does asprotect perform the unlocking function or should I be able to keygen the target?

peterg70
Uradox
12-27-2003, 11:24 AM
Sorry for the title but I thought I would ask first

Target is protected with asprotect 1.23 RC4 demo. Unpacking and hacking isn't a problem as I am sure JMI can attest to using the search function :D

What I would like to know is the following. The target pops up a box saying
Trial 1 of 30 days with Register/Unlock/Quit/I Agree buttons.

Is this standard to asprotect or not. I have traced the Unlock function and found goodguy/badguy routine for popping up the 'Bad Code' messagebox.
What I want to know is the following. Does asprotect perform the unlocking function or should I be able to keygen the target?

peterg70

this is offtopic for the 'offtopic' section? :P


app similar to hiew
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > app similar to hiew
PDA

View Full Version : app similar to hiew

Ray
12-27-2003, 08:31 AM
Does anybody knows if there is any win program available that has the asm decode/encode capabilities like hiew? I say again, windows program, not dos.

thanks.
disavowed
12-27-2003, 09:12 AM
rta. search the board for it
Ray
12-27-2003, 09:24 AM
rta. search the board for it

thanks. gonna search for it.
dELTA
12-27-2003, 03:45 PM
In IDA Pro you can patch the code directly, binary or with asm (if you have unhidden that menu alternative anyway). It will not patch the executable file directly though, but you can easily export a dif-file that can be easily used as input to a patcher.

In the most recent versions though (e.g. 4.50), I have noticed that all my exported dif-files come out empty, even if I have indeed patched the database, but this used to work perfectly before?!

Does anyone know what might cause this, or have at least noticed the same thing?
tom324
12-27-2003, 04:44 PM
> Does anyone know what might cause this, or have at least noticed the same thing?

AFAIK, it is a bug in IDA. Use pe_write.idc to create new exe from modified IDA database.

Tom


edit a gfx ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > edit a gfx ?
PDA

View Full Version : edit a gfx ?

SpeKKeL
12-28-2003, 07:59 AM
Ajo,

I want to edit some gfx's used by a game.
Problem > i can't find a prog which can do that...Is it possible?
:confused:

(just want to erase some nag's (that's easier than removing the call to the nag)

Surched on the web but only i got some prog's to make gfx's, but i can't load mine in that prog's...

Thanks,

SpeKK.
rnd
12-28-2003, 08:21 AM
well, i guess there is no such program, at least not a program made to 'edit game gfx'.

you need to locate the gfx (in resource section, seperate file or (custom) pak file).

and then paint will do the job :)

the first 2 options (res. section or file) are easy to modify. if the file resides in a pak file, try to find some unpacker, and if it is in an unknown format, reverse the structure of it, write an unpacker, modify the gfx, write a packer, and voila.
SpeKKeL
12-28-2003, 08:27 AM
Well the file is just a separeted file : xxx.gfx but paint nor paint shop regcognise it.,.

SpeKK.
rnd
12-28-2003, 08:47 AM
erhhh... imho it is naturual for a reverser to check the header with hiew to identify the filetype?
SpeKKeL
12-28-2003, 09:19 AM
Yep, you could be right...... :p

But i thought .gfx was an extension like gif or bmp but i am wrong ?? :confused:

SpeKK.
JMI
12-28-2003, 01:25 PM
SpeKKeL:

Time for me to harp on my favorite subject: "searching." :rolleyes:

A few moments with Mr. Google netted many .gfx viewers and editors. I believe that the most expensive would be Photoshop but if you search for ".gfx viewers" and ".gfx editors" you will find many. Here are two reference sites which have sever of each, most of them are "free," no reversing required. :D

hxxp://zpixel.by.ru/soft/g_editors.html

hxxp://members.tripod.com/Prick9/ge.html

Regards,
SpeKKeL
12-28-2003, 05:08 PM
Okee,

Jmi thanks for the "well done"surch......

Your first url points to a zx-spectrum site..... :p

Your second ........I really can't find an editor which can load a .gfx file and edit it, can you ?? ;)

Maybe i'am to early with my request and didn't do a good surch but isn,t .gfx an extension like bmp or are i missing something?
Sorry if i am wrong,

SpeKK.
JMI
12-28-2003, 07:27 PM
SpeKKeL:

Here you will find a list of "All" file extensions for the letter "G":

hxxp://www.filext.com/alphalist.php?extstart=^G

And here you will find a listing of all those companies that are apparently using the ".gfx" extension.

File Extension Details for .GFX:
hxxp://www.filext.com/detaillist.php?extdetail=GFX

I note one of them is for a a program called "The Games Factory Extension" which apparently is used for making games. It has a trial download. :rolleyes: It's also used by WarCraft II Image Files. There are other's there that might do the job, but why do I have to do ALL the work?? :cool:

Regards,
SpeKKeL
12-29-2003, 04:46 AM
Well,

Thanks again, but did you really thought i didn't surch that links before posting here? :p
I really appreciate(h'mm did i spell that correct) your "hard"work but looking
to the replies, none of the reversers ever editted a gfx...
I only wondered if it could be done and in what way cause i could't find it my
self..

It looks like there is no such prog. I installed a dozen of game makers, image editors end so on but none of them could do the job.

SpeKK.
tanis
12-30-2003, 01:53 PM
It's probably because it's a proprietary format like it happens very often with games. You've got to find out the format by yourself with trial and error.


Interesting Docs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Interesting Docs
PDA

View Full Version : Interesting Docs

yaa
12-28-2003, 08:42 AM
h**p://www.comms.engg.susx.ac.uk/fft/

yaa
mike
12-29-2003, 04:27 PM
h**p://www.comms.engg.susx.ac.uk/fft/

yaaThat's going into my bookmarks. Thanks!
LibX
01-18-2004, 08:24 AM
Verry nice site lots of info thx bro :)


Cracking a game
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Cracking a game
PDA

View Full Version : Cracking a game

Hatem Al-Naggar
12-28-2003, 10:32 AM
I want to crack a game that uses directx
bpx getwindowtexta and getdlgitemtexta don't work
I don't know what files to export symbols in winice.dat
I don't know what functions to break point on
Can any 1 help?
Biaaatch
12-28-2003, 01:07 PM
Evening Hatem,
i don't think there are any games out there these days,that you could crack with a simple bpx getdrivetypea,search the jmp and nop it out or change it. Your game possibly uses some more advanced protection system like SafeDisc or Securom,whatever. There are enough tutorials,websites out there covering these topics. Just go and google a bit or search on this board.

Yours sincerely,
biaaatch


SoftICE on win2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE on win2000
PDA

View Full Version : SoftICE on win2000

Joe_Coolish
12-28-2003, 03:14 PM
Well, finally I got SoftICE to work, I had to load it on my laptop and it has win2000 on it and my father wouldn't let me load 98 on it, so I'm stuck wif NTIce. Now, the problem comes when I set up a BPX at a function. I was just testing it out, and set a BPX at GetSystemTime and f5'd and went over to the clock, double clicked, and nothing. Softice didn't break. So I assume that it is because 2000 (or NT for that matter) has different function names for all these things, or I thought that it could be that I haven't loaded the proper files, so that could be a solution. Other than that, I'm stuck. Any help would be wonderful. thanks!
dELTA
12-28-2003, 06:42 PM
Which version of Softice is it? Search the board for info about context sensitive breakpoints in recent Softice versions...
Rummy
12-28-2003, 10:37 PM
Yep, Context Sensitive Breakpoints. The names of the functions have not changed. You're in for a real treat :(
Joe_Coolish
12-28-2003, 10:49 PM
It's the driver suite, and it's the latest version. 3.0.2. context sensitive breakpoints eh? Dang. well, I'll search. Thanks fo' the help! :)


Shockwave games
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Shockwave games
PDA

View Full Version : Shockwave games

peterg70
12-28-2003, 11:41 PM
I was looking at a game from Shockwave and these seem to have interesting protection..

Bypassing the basic isdebuggerpresent I get the usual enter name/key. Interestingly it seems that the main exec (which is loaded in Ollydbg) loads a new thread which is the main name/key checking routine but this routine seems to stop any sort of debugging in the program.

I can't attach to it with ollydbg

W32Dasm simple tries to load and does nothing Doesn't crash or anything.

So the question becomes if the main program creates a new thread under attaches to it as if it is a debugger this would stop me from doing anything..

Ways around this? anyone

I tried to dump the new thread with LordPE but no luck. The New thread doesn't appear in the Memory listing in ollydbg

As a side issue I have also downloaded a java applet game from the same site and found the point where it checks if the game has been purchased. Did a bytecode change to set the flag to true and repacked the CAB file. Now I get errors but the main concern is the cab file originally was 112kb and now is 137kb.
Do java programs have a checksum built in or do I look for a checksum routine?

peterg70
dELTA
12-29-2003, 08:59 AM
Are you sure that it's a separate thread and not a separate process that is created? Otherwise the thread really should show up in Olly. And you mention that this "thread" attached to the original thread as a debugger? As far as I know threads in the same program cannot debug each other, you can only attach to other processes as a debugger.

If it's a thread, try to find the exact point where the thread is created (break on CreateThread), and see what funny business it performs on startup by tracing it. If it has any debug tricks they will probably be performed relatively near the start of the thread's code.

If it's a process, put a spinning jump at the EP of the target exe, and trace from there to find any anti-debug tricks.

About the java file, what tool did you use to change it? If you used anything else that a raw bytecode patch (e.g. something involving recompilation of the class file), the size of the class file might very well change. Also, if the cab-file uses any compression it is quite likely that the size will change when you repack it, since you might not be using the same algo and/or compression factor when repacking it as was originally used. Any change in the compressed data might of course also change the size even if all compression settings are the same, but a small patch should not change the size as much as you describe if the compression settings are identical though.

And no, there is no "built in" checksum in class files, but cab-files have built-in checksums, so you cannot patch them directly (they are mostly not compressed, so you can see the raw data of the class files inside them with a hex editor and be tempted to patch them directly) because they have checksums on all the data inside them, like most archive programs. Should be a simple CRC32 though, which should be easy enough to patch, but there is no real reason for this since a manual repack of the cab will set all checksums correctly, and if there is any external checksumming, either method will be caught anyway. In that case you must find and neutralize this external checksumming test.


FlexLM protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > FlexLM protection
PDA

View Full Version : FlexLM protection

dipeshrestha
12-29-2003, 02:00 AM
These days my interest has changed from serial and other based protection system to individual host based protection such as FlexLM. First of all can i have links that explains Flexlm from basic, tutorials, examples...? Also how can i know that which version of flexlm is used by the particular program.

dipesh
:mad: :mad: Still Newbie
Kayaker
12-29-2003, 03:58 AM
Hi dipeshrestha

I don't know how much help these are in terms of basics, but there seem to be at least 7 FlexLM essays on the main tut page, not even including the older database.

http://66.98.132.48/fravia/what_new.htm

I also get about 150 hits in previous threads going back 3 years on a search for FlexLM, though only some are probably truly informative. And then of course there's Crackz site.

Seems like that should keep you busy for a few hours?

Cheers,
Kayaker


How to use really s 0 l ffffffff ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to use really s 0 l ffffffff ?
PDA

View Full Version : How to use really s 0 l ffffffff ?

thalos
12-29-2003, 06:13 AM
Lol

Need any hints on s 0 l ffffffff ‘x’

Example
What I have done

Break due to BPX KERNEL!HMEMCPY (ET=647.67 milliseconds)+ F12
:BD *
:S 0 L FFFFFFFF '11223344'
Pattern found at 0030:015AC754 (015AC754)
:BPR 15AC754 15AC754+8 RW
:S
Pattern found at 0030:80D18472 (80D18472)
:BPR 80D18472 80D18472+8 RW
:S
Pattern found at 0030:C24BDA25 (C24BDA25)

Break due to BPR #0030:015AC754 #0030:015AC75C RW
At 017F:00405470

+ F5
Break sometimes and finally the bab boy screen pops .

But the break has never land in the good place .Ihave 13 calls I break near the 3 rd call With the trick s 0 l ffffffff ‘x’ + bpr but the solution is in the 13 call (I have found the serial).

Why land I never in the good call with this process ? After the bpx hmemcpy , there was only 13 calls to see and an analyse .In another case it could be 50 or 100 calls to analyse .If s 0 l ffffffff ‘11223344’ can’t help me in a more efficient way how to find the generator of the serial?.Otherwise , I don’t really understand how to use the s 0 l ffffffff
naides
12-29-2003, 10:04 AM
As above.

What S 0 l ffffffff 'your_fake_serial' does is to help you locate where in memory your serial got stored. It may get copied somewhere else, checked in its length, analysed by the serial validation routine etc, and it is up to you to understand what is going on.
It may happen soon or later in the program.
Moreover, the memory site you put a BPR on may be recylcled and used for other purposes, giving you false breaks.

Point is: S(earch) memory is one, among many, pathways for serial fishing. Depending on the implementation of the protection, may take you there right away, or may lose you in the code woods. It is up to you to use it wisely.
thalos
12-29-2003, 11:00 AM
What are the other pathways for serial fishing ?

Don't say to work on the buffer parameters of a API as getwindowtextA ,getdlgitemtextA ,lstrcmpiA .Why ? Because the most of the time the buffer concern the title bar and not the edit control of the fake serial .
Don't say to put bmsg handle wm_gettext .(the break where I land is not interressant)
and not s 0 l ffffffff 'fake serial' of course

I need another tricks on serial fishing particulary with a target which has been wrotten in Visual c++ 6.0.

The problem to crack is not to understand the serial routine but to find the serial routine .
That's all
naides
12-29-2003, 11:41 AM
The quickest way to a crack is begining near the end. Always skip to the end.

You have a bad boy mesage box, right?
Start there and work your way backwards to the place where the decision to show it is made.
Then analyze who make that decision: the serial validation routine(s).

Again, don't get all flustered at me, and don't challenge me to give you a solution to your problem. I was giving you a general tip: A protection is a problem not meant to be solved, and you have to invent a solution as you go along. There is no ready made up recipe or fool proof technique, just a handful of approaches that you learn by doing and reading.
thalos
12-29-2003, 03:43 PM
Thank you for your patience Naides .

I hope that I haven’t irritated you , I know you do a good work . Bye


Mup Upx 1.24
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Mup Upx 1.24
PDA

View Full Version : Mup Upx 1.24

MiniMind
12-29-2003, 04:22 PM
I've just started manual unpacking some files,
I started with nice tutorial from AmoN about
UPX v1.07...

I tried to do the same with file packed with UPX 1.24,
but after dumping and changing EP it will not run...

(translated) error wrong initialisation 0xc0000005

Is there more to do then just dumping and fixing the EP ?
(I know you have to rebuild IAT for many crypters... but
UPX is not a crypter at all ???)

btw

-> PEiD gives same EP
-> I used packed notepad.exe

Thanks
MiniMind
Biaaatch
12-29-2003, 05:47 PM
I suppose you're running Windows XP or NT. Whatever, Win98 doesn't seem to be so strict, but under XP you certainly have to do some more things: Change the SectionOffsets(rawsize,virtualsize,rawoffset,virtualoffset),change the SizeOfImageSize, and fix the IAT.
Rebuilding or fixing the IAT has nothing to do with cryptors.If something is packed, crypted or not, you'll have to rebuild the IAT. However,that's just my humble opinion and maybe i'm dead wrong :P

biaaatch
MiniMind
12-29-2003, 07:51 PM
I suppose you're running Windows XP or NT. Whatever, Win98 doesn't seem to be so strict, but under XP you certainly have to do some more things: Change the SectionOffsets(rawsize,virtualsize,rawoffset,
virtualoffset),change the SizeOfImageSize, and fix the IAT.

Rebuilding or fixing the IAT has nothing to do with cryptors.If something is packed, crypted or not, you'll have to rebuild the IAT. However,that's just my humble opinion and maybe i'm dead wrong :P

Thank for responding (Running Win XP latest), but should I know how UPX work to find SectionOffsets and IAT ??? (If I have to use some tools : what are the best ???)

(I saw that Import Address Table has RVA 00000000 and size 00000000 in directories, doesn't seem me right ???)

greetings
MiniMind
Biaaatch
12-30-2003, 06:29 AM
I'll just quote Bratalarm here,cause he already told me once what to do and i think i can't top that ;)

Unpack UPX

1. Dump
2. Set new Entry Point
3. For each Section change RawSize in VirtualSize and RawOffset in VirtualOffset, so that this is for valid for each section:
RawSize = VirtualSize und RawOffset = VirtualOffset
4. Set the Size of "SizeOfImage" to the size of the whole memorymapp (watch the alignements!)
5. Repair the Imports

You can repair the imports either manually (and there are some tuts out there,just google for them) or you can use Revirgin and/or ImpRec (ImpRect?).
For unpacking it's of course not the worst to know how packers work in general.There's a great tut out there (don't remember who wrote it ;)) on "how to write your own packer". Should supply you with some hints!

Go out and learn now ;P
biaaatch
MiniMind
12-30-2003, 06:09 PM
I'll just quote Bratalarm here,cause he already told me once what to do and i think i can't top that ;)

Unpack UPX

1. Dump
2. Set new Entry Point
3. For each Section change RawSize in VirtualSize and RawOffset in VirtualOffset, so that this is for valid for each section:
RawSize = VirtualSize und RawOffset = VirtualOffset
4. Set the Size of "SizeOfImage" to the size of the whole memorymapp (watch the alignements!)
5. Repair the Imports

You can repair the imports either manually (and there are some tuts out there,just google for them) or you can use Revirgin and/or ImpRec (ImpRect?).
For unpacking it's of course not the worst to know how packers work in general.There's a great tut out there (don't remember who wrote it ;)) on "how to write your own packer". Should supply you with some hints!

Go out and learn now ;P
biaaatch

Thanks that all I want to know, I'm gonna work on it, if I have some time.
And looking for some more tuts.

Happy Newyear
MiniMind
JMI
12-31-2003, 01:12 AM
Don't forget to use that search button for more information on this Forum. There are also interesting threads over at the exetools forum on upx unpacking you might find interesting to review.

Regards,
MiniMind
12-31-2003, 05:45 AM
Don't forget to use that search button for more information on this Forum. There are also interesting threads over at the exetools forum on upx unpacking you might find interesting to review.

found nice tuts at hxxp://new2cracking.cjb.net,
exetools forum wasn't much fun (couldn't search
for UPX ,cause it has 3 chars )...

I manually couldn't find much help about UPX on exetools forum...
... this forum looks much better arranged ;) !!!

Thanks
MiniMind
JMI
12-31-2003, 05:47 PM
And people wonder why I keep harping on learning how to search. :rolleyes:

You should not be detered by the three letter limit. Just use "UPX*" and then you have four letters and at exetools you would have found this:

http://www.exetools.com/forum/search.php?s=&action=showresults&searchid=196166&sortby=lastpost&sortorder=descending

Regards, :D
MiniMind
01-01-2004, 09:24 AM
And people wonder why I keep harping on learning how to search. :rolleyes:

You should not be detered by the three letter limit. Just use "UPX*" and then you have four letters and at exetools you would have found this:
s=&action=showresults&searchid=196166&sortby=lastpost&sortorder=descending

exactly and when I open your link, it says "Sorry - no matches. Please try some different terms."

I think it's, cause I'm not a member ???

So thanks for your learning proposals, but I already had search with 'UPX*' and (I can read) it's pretty clear on that searching page :)

Advanced query: Join words with AND, OR and NOT to control your search in more detail.
Add asterisks (*) to use wild cards in your search (*bullet* matches vBulletin etc.)

What I tried to say: Not very smart that three-letter-limit function...

Happy NewYear :D
JMI
01-01-2004, 12:51 PM
MiniMind:

As you suspected, the issue is not the three letter limit, it is that you are not a registered user on exetools. If you attempt to use the search function on ANY vBulletin Board which has not enabled searching for guests in the AdminCP, you simply will not be able to use the search function, no matter how now many letters you use. So the solution to your problem is that you need to register on that board and you can then use the search function I gave you and you will find 27 threads which reference "upx."

Many vBulletin forums do not permit non-registered "guests" to post replies and many do not even permit non-registered "guests" to even view the threads. Perhaps the real issue is vBulleting's response, which should, more properly, informed the viewer that searching is disabled for non-registered and non-logged-in users. If you had tried searching with any word longer than three letters, you still would have gotten the "Sorry no matches" response, which should have prompted you to assume, as you did, that registration might be the issue. However, it appears you did not follow through and actually register and try it again. :)

Since there are no restriction on registering, other than a valid email address, also a requirement here, the real issue then is not a "Not very smart ... three-letter-limit function," but perhaps just a "not very observant, or at least a not very experimental user." :D

Happy New Year. ;)
Regards,
MiniMind
01-01-2004, 04:00 PM
I registered on exetools, so no negative sounds, lot of info out there... :)

What I should have said :D : He better could warn that unregistered users can't search on the forum...

MiniMind
JMI
01-01-2004, 04:55 PM
I agree that the vBulletin statement could be more informative. For us to change it, we would have to edit the vBulletin templates and risk some changes coming with future releases. Even the default listings in "Why I should register" provided by the vBulletin FAQ does not spell out that one can not seach unless registered. :(

Regards,


Emulate a fast-eye dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Emulate a fast-eye dongle
PDA

View Full Version : Emulate a fast-eye dongle

grep
12-29-2003, 06:47 PM
There is a little tool (fastread.com) to read out and create a logfile from the fast-eye dongle.
Does anyone know if there is a "low-budget" solution to use this logfile to emulate the hardlock.

from Austria
grep
sope
01-02-2004, 02:06 AM
Hello grep,

Now what i have ranted here is everything that i know about it.

Well for low-budget you need to do it yourself. If you have the original dongle its trival to dump the program, rebuild it & then emulate the api calls if used by the program.

This might not (probably wont) solve the problem if you don't know how to do the trival part, but Im doing my part.

But if you don't have the dongle then it would not at all be easy, bcos the algo is still safe with few individuals of planet earth they are planning to carry with them whole of their life...

Regards, Sope.


WriteProcessMemory on XP services
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > WriteProcessMemory on XP services
PDA

View Full Version : WriteProcessMemory on XP services

kP^
12-29-2003, 08:22 PM
Hi!

i wrote this little tool, wrapper for the WriteProcessMemory API, but i can't use it on system services.

Why ?
dELTA
12-29-2003, 09:11 PM
Most services run as the "LocalSystem" user, and "normal programs" (e.g. those run as the administrator user) do not have debug or write privileges for these. Either change the user of the service or make your program run as LocalSystem too, and it should work fine.
Kayaker
12-29-2003, 09:40 PM
Hi

I'm not sure how your app is implemented, but I suspect it may be due to the service tables being write protected in XP. Take a look at Windows NT System Service Table Hooking
http://www.wiretapped.net/~fyre/sst.html

--------------------------------------
In order to discourage people from using these undocumented interfaces, Microsoft attempted to write-protect the service tables in Windows XP. Writing to them causes a blue screen of death, unless the pages are somehow made writeable first.

The simplest method is to disable the WP bit in the i386's CR0 register before modifying the table. For example:

MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
; modify table
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX

Another method is to modify the PTE's for the pages that the service table resides in so that the supervisor (executive/kernel) may write to them.
---------------------------

I'm curious about your approach, there's no source but if you're trying to manipulate the ServiceDescriptorTable in order to access the services, I'd be interested if one of the above solutions works for XP. I wrote some code which adds new user defined services by modifying the KeServiceDescriptorTableShadow, it works fine for Win2K but as I don't have XP I can't test this write protection issue.

Kayaker
kP^
12-29-2003, 09:59 PM
well, let me be honest with you ...

i know i shouldn't give names, but i'm trying to patch deep freeze.
maybe you're not familiar with this app, it's a nice security solution from HyperTechnologies Inc.
while taking a look at it, i encountered this unique situation where the only vulnerable part of a system is its memory, so the only way to melt deepfreeze's protection i found was to modify the running service (not the ring 0 driver, but the ring3 usermode exe).

while on 9x i solved it with dede and my procpatch tool and units for getting a service's -process- handle and using the writeprocmem api on it, on nt platforms things are a little more complicated: i could not 'Openprocess' a Windows XP process with the PROCESS_VM_OPERATION flag for later VirtualProtectEx and WriteProcessMemory usage.

any suggestions ?
my softice won't bpx :(
kP^
12-29-2003, 10:03 PM
i'll try this out the as soon as possible.
thanks!
doug
12-29-2003, 11:18 PM
Hello, part of this code is from the Platform SDK, the rest is from something I wrote a few months ago,
http://www.woodmann.net/forum/showpost.php?p=29119&postcount=9

/* straight from sdk */
BOOL AdjustPrivilege(
HANDLE hToken, // access token handle
LPCTSTR lpszPrivilege, // name of privilege to enable/disable
BOOL bEnablePrivilege // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;

if ( !LookupPrivilegeValue(
NULL, // lookup privilege on local system
lpszPrivilege, // privilege to lookup
&luid ) ) // receives LUID of privilege
{
printf("LookupPrivilegeValue error: %u\n", GetLastError() );
return FALSE;
}

tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if (bEnablePrivilege)
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;

// Enable the privilege or disable all privileges.

if ( !AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES) NULL,
(PDWORD) NULL) )
{
printf("AdjustTokenPrivileges error: %u\n", GetLastError() );
return FALSE;
}

return TRUE;
}

/*
Request debug privilege for the current process
otherwise it's not possible to get PROCESS_ALl_ACCESS on services.exe
*/
BOOL SetDebugPrivilege()
{
HANDLE TokHand;
BOOL retval;

if (OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &TokHand)==0)
return FALSE;

retval= AdjustPrivilege(TokHand, SE_DEBUG_NAME, TRUE);
CloseHandle(TokHand);
return retval;
}

/* gets handle to services.exe */
HANDLE getServicesProcessHandle(DWORD pid)
{
if (SetDebugPrivilege())
{
return OpenProcess( PROCESS_ALL_ACCESS, FALSE, pid );
}
else
return NULL;
}

Get the service's processID, then use:

services_hand=getServicesProcessHandle(services_pid)

I can assure you that method works, as I was injecting code into services.exe with an on/off switch to enable/disable the hook.
JMI
12-31-2003, 01:10 AM
Ah wonderfully devious methods you all are using. Wish I had more time to study and play with these deeper issues. Working for a living is seriously impacting my play time. :D

Regards,


Trial Doctor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Trial Doctor
PDA

View Full Version : Trial Doctor

JohnWho
12-30-2003, 07:20 AM
A little tool i made.

It will restore trial periods in programs protected with ASProtect and Armadillo.

h**p://www.angelfire.com/scary/trialdoctor/td.htm

JohnWho.
yaa
12-31-2003, 01:40 PM
Very useful tool JohnWho, it worked perfectly well with a ASProtect 1.2c protected application. It gives infinite time to attempt to break an app to us slow reversers. :D :D :D

yaa
JMI
12-31-2003, 06:15 PM
There is some discussion here about using M$ regclean to remove the ASPR timelimits information as well. I recall searching through 20,000 lines of code to determine what was happening and Kayaker wrote a filter to make that searching easier. :D If you are interested, you can find the thread here:

http://66.98.132.48/forum/showthread.php?t=4000
JohnWho
12-31-2003, 07:17 PM
There is some discussion here about using M$ regclean to remove the ASPR timelimits information as well. I recall searching through 20,000 lines of code to determine what was happening and Kayaker wrote a filter to make that searching easier. :D If you are interested, you can find the thread here:

http://66.98.132.48/forum/showthread.php?t=4000

Thanks, did read there.

JohnWho.
hitman_crk
01-01-2004, 07:46 AM
Thank you very much to JohnWho. Your tool very good
LibX
01-17-2004, 06:29 PM
Nice tool only 1 problem u also remove registration information from registered ASProtect and Armadillo programs so ur back in trial
JohnWho
01-18-2004, 05:27 AM
Nice tool only 1 problem u also remove registration information from registered ASProtect and Armadillo programs so ur back in trial

It removes registration information in some Armadillo'ed apps not all. It doesn't remove registration info in ASProtected apps, not what i know of anyway!

JohnWho.
LibX
01-18-2004, 08:15 AM
I'am sorry but my registered version of ASProtect v1.3 is not longer registered ;)
LibX
01-18-2004, 08:34 AM
And its not a registery problem :S its removing some "temp" files and after the removal ASProtect is back it unregistered mode
I hope u fix the problem then u have a verry good tool and maby you could add some other protectors ;)
JohnWho
01-18-2004, 11:47 AM
And its not a registery problem :S its removing some "temp" files and after the removal ASProtect is back it unregistered mode

Thats a weird way ASProtect keeps it registration info,,, in a temp file in the temp directory!!!
+SplAj
01-20-2004, 02:10 AM
greetz JohnWho

.....it appears Alexey made an 'angelfire' remover 4 U :rolleyes:
JohnWho
01-20-2004, 06:40 AM
greetz JohnWho

.....it appears Alexey made an 'angelfire' remover 4 U :rolleyes:

LOL,,,, the site survived 2 month, thats not bad!!

JohnWho.
JMI
01-20-2004, 01:45 PM
JohnWho:

Send a PM to volodya. Maybe he will post your TrialDoctor on Warm.ru. And there is still at least one place on the net where it is available. ;)

Regards,
cRk
01-30-2004, 11:28 PM
JohnWho:

Send a PM to vladimir. Maybe he will post your TrialDoctor on Warm.ru. And there is still at least one place on the net where it is available. ;)

Regards,

site dead! , can't find it on Warm.ru! John...... where is your project. dead already? :confused:
Kayaker
01-31-2004, 12:43 AM
site dead! , can't find it on Warm.ru! John...... where is your project. dead already? :confused:

Remember, JMI has a spelling problem :p

Try wasm.ru (which has been sporadic lately)
D-Jester
01-31-2004, 07:48 AM
Might be a bug, or not. But after I used it, my MS Excel XP needed to reinstall a feature. Though you should know.

Later,
D
JMI
01-31-2004, 03:30 PM
The spelling problem is both generic, as in brain disconnect from proper finger and/or proper spelling :p , and optical, as in tired eyes from spending way too many hours sitting at this darn machine working at things other than reverse engineering. :rolleyes: Sorry for the misdirection. I did just check wasm.ru and did not find it there.

Regards,
JohnWho
02-01-2004, 05:15 AM
h**p://www.azconsult.cz/TlusnocZA/tlusnocza.htm

The project ain't dead, just don't have the time for it atm.

JohnWho.
volodya
02-01-2004, 01:43 PM
Thank you all for reffering my name :rolleyes:
Of course, I'll put his app onto my site. Currently we are experiencing some DDoS problems. Soon our provider and our FBI :) will find them and make their life funny. So far, you just wait a little bit. Thanks to everyone once again.
gordon_freeman
02-01-2004, 04:29 PM
Hi,
If someone missed this exellent utility, he can grab a copy from exetools ftp site.
JMI
02-01-2004, 05:30 PM
Do you mean if they missed it from the author's, JohnWho's site, he listed two posts above your own? :eek:

Regards,
nokia
02-18-2004, 07:06 PM
h**p://www.azconsult.cz/TlusnocZA/tlusnocza.htm

The project ain't dead, just don't have the time for it atm.

JohnWho.

Very nice stuff ;-)) thxx


MD5 + some bit math
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > MD5 + some bit math
PDA

View Full Version : MD5 + some bit math

Donan
12-30-2003, 10:58 AM
Hi all =] I got a program with a nice MD5 cripto. But I dont think its keygennable... It does some other stuff before MD5Init & MD5Update.
First the program is coded in C++ using VC 6 and I think it is a serial only protection. I think because it asks for more stuff, but I dont see it getting used yet. I also got a valid key. It came with the soft when I bought it :)

So... as you can see, there are a lot of SHL, SHR, AND in the code. And thats the part that makes a keymaker impossible, right?

.text:004CF26B mov al, [esp+0C0h+var_A7] ; 2nd char
.text:004CF26F mov cl, [esp+0C0h+var_A8] ; 1st char
.text:004CF273 mov dl, al
.text:004CF275 and al, 3
.text:004CF277 shr dl, 2
.text:004CF27A shl cl, 3
.text:004CF27D add dl, cl
.text:004CF27F mov cl, [esp+0C0h+var_A6] ; 3rd char
.text:004CF283 shl al, 5
.text:004CF286 add al, cl
.text:004CF288 mov cl, [esp+0C0h+var_A5] ; 4th char
.text:004CF28C mov [esp+0C0h+var_B4], dl
.text:004CF290 mov dl, cl
.text:004CF292 shr dl, 4
.text:004CF295 shl al, 1
.text:004CF297 and dl, 1
.text:004CF29A and cl, 0Fh
.text:004CF29D add al, dl
.text:004CF29F mov bl, [esp+0C0h+var_99]
.text:004CF2A3 mov [esp+0C0h+var_B3], al
.text:004CF2A7 mov al, [esp+0C0h+var_A4]
.text:004CF2AB mov dl, al
.text:004CF2AD and al, 1
.text:004CF2AF shl cl, 4
.text:004CF2B2 shr dl, 1
.text:004CF2B4 add cl, dl
.text:004CF2B6 mov dl, [esp+0C0h+var_A3]
.text:004CF2BA mov [esp+0C0h+var_B2], cl
.text:004CF2BE mov cl, [esp+0C0h+var_A2]
.text:004CF2C2 shl al, 5
.text:004CF2C5 add al, dl
.text:004CF2C7 mov dl, cl
.text:004CF2C9 shr dl, 3
.text:004CF2CC shl al, 2
.text:004CF2CF and dl, 3
.text:004CF2D2 and cl, 7
.text:004CF2D5 add al, dl
.text:004CF2D7 mov dl, [esp+0C0h+var_A0]
.text:004CF2DB mov [esp+0C0h+var_B1], al
.text:004CF2DF mov al, [esp+0C0h+var_A1]
.text:004CF2E3 shl cl, 5
.text:004CF2E6 add cl, al
.text:004CF2E8 mov al, [esp+0C0h+var_9F]
.text:004CF2EC mov [esp+0C0h+var_B0], cl
.text:004CF2F0 mov cl, al
.text:004CF2F2 shr cl, 2
.text:004CF2F5 shl dl, 3
.text:004CF2F8 add cl, dl
.text:004CF2FA and al, 3
.text:004CF2FC mov [esp+0C0h+var_AF], cl
.text:004CF300 mov cl, [esp+0C0h+var_9E]
.text:004CF304 shl al, 5
.text:004CF307 add al, cl
.text:004CF309 mov cl, [esp+0C0h+var_9D]
.text:004CF30D mov dl, cl
.text:004CF30F and cl, 0Fh
.text:004CF312 shr dl, 4
.text:004CF315 shl al, 1
.text:004CF317 and dl, 1
.text:004CF31A add al, dl
.text:004CF31C mov [esp+0C0h+var_AE], al
.text:004CF320 mov al, [esp+0C0h+var_9C]
.text:004CF324 mov dl, al
.text:004CF326 and al, 1
.text:004CF328 shl cl, 4
.text:004CF32B shr dl, 1
.text:004CF32D add cl, dl
.text:004CF32F mov [esp+0C0h+var_AD], cl
.text:004CF333 mov cl, [esp+0C0h+var_9B]
.text:004CF337 shl al, 5
.text:004CF33A add al, cl
.text:004CF33C mov cl, [esp+0C0h+var_9A]
.text:004CF340 mov dl, cl
.text:004CF342 and cl, 7
.text:004CF345 shr dl, 3
.text:004CF348 shl al, 2
.text:004CF34B and dl, 3
.text:004CF34E add al, dl
.text:004CF350 shl cl, 5
.text:004CF353 mov [esp+0C0h+var_AC], al
.text:004CF357 add cl, bl
.text:004CF359 lea eax, [esp+0C0h+var_68]
.text:004CF35D mov [esp+0C0h+var_AB], cl
.text:004CF361 push eax
.text:004CF362 call sub_4D0610 ; MD5Init !!!!!!!!
mike
12-30-2003, 04:50 PM
So... as you can see, there are a lot of SHL, SHR, AND in the code. And thats the part that makes a keymaker impossible, right?
Not necessarily; this part could very well be reversible. See if you can come up with a more concise way of representing the code--that will help you understand it.

What are the first thru 4th chars you're talking about above? And what are in the other variables? At a glance, it looks to me like it's doing some roll-your-own crypto on a string before hashing it.

In order to tell whether it can be keygenned, find out where the comparison is done--what is being compared?
ZaiRoN
12-30-2003, 04:56 PM
Hi Donan,
as you can see, there are a lot of SHL, SHR, AND in the code. And thats the part that makes a keymaker impossible, right?There are lot of shl/shr/and instructions but I don't think they will stop you to write a keygen... it depends.
You have to tell us more details like:
- is it really a serial protection only?
- the md5 algo is applied to what? is it applied to a value obtained by the code between 4CF26B and 4CF35D? what is '[esp+0C0h+var_68]'?
- is the value returned by md5 algo compared with something?
and so on...

Best regards,
ZaiRoN
ZaiRoN
12-30-2003, 04:58 PM
Ooops, sorry Mike. I did not see your post.
Donan
02-10-2004, 09:40 PM
Thanks Mike and Zairon! I just got back from my vacation... Ill take a deeper look and post again =D


Newbie question: why aren't hardware breakpoints breaking???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Newbie question: why aren't hardware breakpoints breaking???
PDA

View Full Version : Newbie question: why aren't hardware breakpoints breaking???

IGOR
12-30-2003, 12:39 PM
Hello,

This is my very first post. I'm new to RE so often simple things can get me lost.
I have been playing with an application that PEiD identifies as being protected by ASProtect 1.2 / 1.2c. I did not unpack it (I would not know where to start from) and I have only been letting the application run under the control of a debugger and once unpacked and running I have taken a look at its code. In one of the experiments I have done I have identified interesting code and wanting to know when that code is generated by the unpacking routines I have placed hardware breakpoints on the bytes where that code should "appear" ... well, those breakpoints never break. The same exact thing works as I would expect under an UPX protected application but not under this asprotected application. I expect that asprotect must be "blamed" for this behavior. Is anyone willing to provide me a hint on how this is accomplished and how I could stop it?

IGOR
Ricardo Narvaja
12-30-2003, 05:33 PM
Asprotect, erase the hardware bpx, i made a tut of how erase asprotect and acprotect the hardware bpx and how you can mantain working.

Is in spanish in my ftp

Ricardo narvaja

Hello,

This is my very first post. I'm new to RE so often simple things can get me lost.
I have been playing with an application that PEiD identifies as being protected by ASProtect 1.2 / 1.2c. I did not unpack it (I would not know where to start from) and I have only been letting the application run under the control of a debugger and once unpacked and running I have taken a look at its code. In one of the experiments I have done I have identified interesting code and wanting to know when that code is generated by the unpacking routines I have placed hardware breakpoints on the bytes where that code should "appear" ... well, those breakpoints never break. The same exact thing works as I would expect under an UPX protected application but not under this asprotected application. I expect that asprotect must be "blamed" for this behavior. Is anyone willing to provide me a hint on how this is accomplished and how I could stop it?

IGOR
IGOR
12-30-2003, 05:45 PM
Ricardo,

I can attempt to read spanish (my native language isn't too different). Please let me know the title of your tutorial. I should have the coordinates to get to your FTP repo.

IGOR
Ricardo Narvaja
12-30-2003, 06:12 PM
165-Como borra el ACPROTECT 1.10 y el ASPROTECT nuestros queridos hardware breakpoints.rar

the tut is explained in acprotect 1.10 but in asprotect is the same method.

ftp://curso:curso@ricnar456.no-ip.org/

user:curso
pass:curso

carpeta NUEVO CURSO-TEORIAS

in

NUEVO CURSO\TEORIAS-PROGRAMAS\165-PROGRAMA TEORIA 165

is the program acprotect 1.10.

Ricardo Narvaja

Ricardo,

I can attempt to read spanish (my native language isn't too different). Please let me know the title of your tutorial. I should have the coordinates to get to your FTP repo.

IGOR
JMI
12-31-2003, 01:16 AM
You also would benefit from use of the "search" key at the top of the Forums. You will find a wealth of threads on the subject of asprotect and its evolution over the last year. You really should study all these threads and begin making your own notes of things like "stolen bytes" and relocating parts of the protection to a different address each time the program starts. These things will become more clear to you as a study of the techniques of ASPR, even if they do not help you always with a specific target.

Regards.
IGOR
12-31-2003, 10:09 AM
JMI,

I understand and agree with you, that should be the correct approach, and in fact that IS my usual approach to things, but you see JMI exactly because that is my normal approach to any problem I ALSO know that it tends to get me lost. I sometimes find more useful to skip a few steps and go ahead trying to solve a problem eventhough I'm not fully prepared and then, once solved, I usually get back and redo the entire process as it should have been done at first. I have seen that by adopting this problem solving process I usually learn more because when I afterwards study things I fully understand their importance and how they fit in to explain all those missing pieces.
Hope you undestand.

IGOR
JMI
12-31-2003, 05:58 PM
I highly recommend that you do NOT adopt this approach to the subject of landmine removal. :D Once you start screwing with the detionator, there IS NO GOING BACK to learn how to do it the right way. There the "missing pieces" will be parts of YOU. :rolleyes:

In all seriousness, it is always easy to jump in and muck around in the program and learn everything from scratch yourself. But if that is your REAL attitude, you shouldn't be asking for any help. You should just do it your own damn self. :D However, if your object is actual learning, without having to re-invent the wheel, then a general subject review it always the wisest approach. The principle point of my post was that the subject of your question had been discussed here before you posted your question and I was simply reminding you, and others reading the thread, that it is policy here that one is supposed to search BEFORE asking a question. ;)

Regards,
IGOR
01-01-2004, 09:09 AM
JMI, I already said I agree with you. Still I wanted to explain the rationale behind my approach. I could have avoided it. You already have all your answers.

IGOR
________________________________________
You should just do it your own damn self.


Low-level (not necessarily process specific) memory editor for Windows XP?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Low-level (not necessarily process specific) memory editor for Windows XP?
PDA

View Full Version : Low-level (not necessarily process specific) memory editor for Windows XP?

Six Black Roses
12-31-2003, 06:41 AM
I've searched a bit, but there are too many vague results on Google. This forum doesn't seem to have the thread I'd look for.

Basically I want to be able to view and edit physical memory. Maybe I'm asking the wrong question, but would Windows XP launch such program? Perhaps there's something a bit on a higher level.

I want to be able to view memory that's not specific to processes. As a matter of fact, if there's a utility that'd allow me to see the BIOS shadow (not sure of the proper term), I'd prefer that.

In other words, I want as low-level a memory editor as will run under Windows XP. SoftICE, even if applicable, is not an option. My USB keyboard doesn't work with it, no matter which settings I've tried, etc.

Thanks
dELTA
12-31-2003, 07:59 AM
This would require some kind of ring 0 application (i.e. kernel driver), to break through the virtual memory layer.

Why do you want to read physical addresses instead of the virtual addresses that the applications use? Are you familiar with the virtual memory model of Windows?

For reading the virtual memory space of any process (which is still all the memory that any specific process can access), WinHex is pretty good anyway.
MaRKuS-DJM
12-31-2003, 08:26 AM
very good decision, Delta :) i'm using winhex for years
disavowed
12-31-2003, 12:34 PM
this should be exactly what you're looking for (along with source code):
http://www.sysinternals.com/ntw2k/info/tips.shtml#kmem

if you want a more detailed write-up on how it works, read
http://www.phrack.org/phrack/59/p59-0x10.txt
JMI
12-31-2003, 06:07 PM
You just got to love this place. Ask a good and/or interesting question, and ye shall receive a relevant URL. :cool:
The whole darn page is filled with information that is useful.
http://www.sysinternals.com/ntw2k/info/tips.shtml

Regards,
UrgeOverKill
12-31-2003, 06:56 PM
You might also consider Davory as well. You can sample this on Stephen site too.
dELTA
01-01-2004, 06:33 PM
Cool, I wasn't aware of that "backdoor" to the physical memory. :o


ok, huppy nuv birzdey, NotePads!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > ok, huppy nuv birzdey, NotePads!
PDA

View Full Version : ok, huppy nuv birzdey, NotePads!

evaluator
12-31-2003, 11:40 AM
+SPLUJ, you are australian aborigen, so you meet nev yer first.

maybi, for nuv yer, not bad will nagscren-crakme
with cool girl-popi in santa's coat.
Who have good photo-graphie!?
JMI
12-31-2003, 06:21 PM
Say what??? :p

Regards,
UrgeOverKill
12-31-2003, 06:48 PM
always interesting reading Evals notes..........
http://www.woodmann.net/forum/newreply.php?do=newreply&noquote=1&p=31515#
Kayaker
12-31-2003, 07:11 PM
I think New Years has already reached Eval, sort of like the little guy on the right :p (login with images)
Woodmann
12-31-2003, 10:01 PM
Ho9i nuV ,

I just cant believe my "esteemed mate" can not find this
wonderful link: world.altavista.com/

As for your request, here is a no nag poppy with
a christmas theme. It's up to you to perform the "crack-me"
esther
12-31-2003, 11:14 PM
Huppy Noot Yer everyone :p
Shoob
01-01-2004, 09:00 AM
good reversing 2004
sope
01-01-2004, 10:35 AM
Hello Everybody,

Wish You all A Very Happy Reversing Year 2004.

EnjoY, Sope.
nikolatesla20
01-01-2004, 10:55 AM
Ho9i nuV ,

I just cant believe my "esteemed mate" can not find this
wonderful link: world.altavista.com/

As for your request, here is a no nag poppy with
a christmas theme. It's up to you to perform the "crack-me"

Woodmann, I'm guessing you've used steganography to hide a message inside that image? Otherwise I'd say you are hiding other *things* inside it :p

-nt20
esther
01-01-2004, 10:26 PM
dickie or pussie? You crack it? :D :p
evaluator
01-02-2004, 01:35 PM
Don Wooma,

i very shamed from that photo;
firstly, it does not deserve to be here,
And then to be on a Nag-screen..
I hope, that you will remove it..

I will try once again:
I need photo of the girl in Santa's coat.
Better, if coat ends where poppy starts or near :0
{Better, if in vertical state}

It should meet at least the requirements of taste- above the average!
Woodmann
01-02-2004, 08:55 PM
Hola,

I am sorry my esteemed mate, my girlfriend would like
to know why you dont like the photo.
Is it her hairy backside ?

TA TA
evaluator
01-03-2004, 06:08 AM
but i thought, she is your relative (cousin, etc)
whom you try to advertise on WorldWideWeb ~;)

well, this pHoto is of very low taste.
(i'm firstly about photo, not about man there~:)
But as everyone has the personal taste,
then pseudo-correct solvage in similar situations is voting, poll..

"esteemed mate" sounds aggressively ~~
Woodmann
01-03-2004, 07:34 PM
Howdy,

Nothing aggressive intended my "esteemed mate". A theasarus may be of help to you :p

I must admit , I am now confused about your request.
Do you desire a man dressed like santa?
Do you desire a female dressed like santa ?
What do you find offensive about the photo I posted ?

You may reply VIA private message if you like.

Woodmann
UrgeOverKill
01-03-2004, 10:59 PM
:d
evaluator
01-04-2004, 04:49 AM
cun't beleve, that nuv yer for me became so dirti at it's start..~~
i'm pissed on..~~

--------

Hey, esther!
i uploaded here our foto; how we was fun..~~
dELTA
01-04-2004, 08:34 AM
My eval-translator just crashed, there are just too many potential meanings of this post. :D
disavowed
01-04-2004, 01:23 PM
i'm pissed on..~~ohh.. i think he wants a photo of a female santa pissing on a male santa :p
evaluator
01-04-2004, 02:08 PM
>>My eval-translator just crashed

wuha!
delta, Your joke rockz! thanks for fun!

Realy, i trash hours for find such like photo,wallpaper, & with bad result..

these looks normal, but not in my pose

http://www.desktopmodel.de/desk04.htm
http://www.desktopmodel.de/desk06.htm

what keyword is best for use in search!?
dELTA
01-04-2004, 02:40 PM
So exactly what pose are you after if we might ask? :)

Will any of these do?

hxxp://www.costumeworld.com/images/shop/sexysantahelper.jpg
hxxp://www.globaldomain.com/encore/images/sxmissst.gif
hxxp://www.partydomain.co.uk/d-commerce/media/fdladiessexmisssanta.gif
hxxp://www.funfolly.com/g/c/csan2cct.gif
hxxp://www.joaf.co.jp/x-christmas/santa-huku/huku15-lady-e/lady-e-sexy-.jpg

:D
JMI
01-04-2004, 02:42 PM
Proving, once again, we can always depend on dELTA to have a ready collection of "controversial" photos to display on his new big screen "monitor." :D Those svensk really know how to have a christmas party don't they? :p These are the ones he displays when there are guests around. :cool:

Regards,
dELTA
01-04-2004, 02:50 PM
Ok, that's the last time you ever come to my christmas party JMI (ok, maybe not, and you know why). :D
JMI
01-04-2004, 02:58 PM
And we also know why you show this type of choices when you have guests. :D

Regards,
dELTA
01-04-2004, 03:03 PM
Yes, but in the future when the guests have left, I might just dress up a certain someone in a santa suite and take some pictures of my own... :D :D :D
JMI
01-04-2004, 03:07 PM
Just don't forget that someone else has your apartment, and that window overlooking the polar bears, under constant video, infrared, thernmal, and video surveillance. :D Damn, you got to love that goverment paid training. :p Did you realize that that new big screen TV is also watching YOU.

Regards,
dELTA
01-04-2004, 03:15 PM
I guess that will cause this certain someone's sexy santa show to be all the more famous and widespread then, the only sexy santa show filmed with 10 cameras, showing in Omnimax theatres and having screenshots of it plastered on the walls of CIA offices. :D
JMI
01-04-2004, 04:44 PM
Didn't you get tickets? It's there NOW. Check you local listings for times and locations. :D

Regards,
evaluator
01-04-2004, 05:17 PM
delta,
your pics are not so sexy, as previos white bears..
pose I asked above..
+SplAj
01-06-2004, 05:03 AM
R U seeking my WMD ?

If so....

http://newsimg.bbc.co.uk/media/images/39665000/jpg/_39665801_gaddafiap2003.jpg

Happy New Year Evubulator
evaluator
01-06-2004, 03:58 PM
+SPLUJ!

Big, please, if you have xmas-girls cool photo, give me..
my eyes are damaged for searching..
+SplAj
01-07-2004, 02:20 AM
Evubulator

Get yer hand working .........

http://www.westword.com/extra/art/puj1.jpg
JMI
01-07-2004, 03:46 AM
+Spla/\:

Damn it's good to have your humour back on these pages. :D

Regards,
evaluator
01-07-2004, 04:36 AM
+SLAJ,

both your pics are too much porn..
IF you will really enjoe with such nag,
i will code exclusive crakma for you, as nev yer peshcash.

BTW, I'm interesting about roket-masturbating-hand over Kddfi's head:
Is it your hand!? ~8-) (so now u'r doing it on men ~:0..)
+SplAj
01-07-2004, 07:18 AM
Healthy Masturbation Skills

For your sex life, your mental health and for a less stressful life you will find that masturbation fits this bill. All of the feelings that you have been missing in your sex life, when you don't have a sex life, and when you just want a little bit more in your sex life, masturbation brings this happiness to your life easily, in just a few seconds, and in the privacy of your own home.

What makes masturbation healthy? Lowering your stress levels for one, keeping you disease free and away from telling aids partners is another good reason in itself. Sometimes the self-satisfaction that you can get from masturbating gives you the confidence you need to get through your day, as you feel fulfilled once again

http://www.allaboutmasturbation.com/healthymasturbationskills/

Healthy Cracking Skills

For your sex life, your mental health and for a less stressful life you will find that cracking software fits this bill. All of the feelings that you have been missing in your sex life, when you don't have a sex life, and when you just want a little bit more in your sex life, carcking software brings this happiness to your life easily, in just a few seconds, and in the privacy of your own home.

What makes cracking healthy? Lowering your stress levels for one, keeping you disease free and away from telling aids partners is another good reason in itself. Sometimes the self-satisfaction that you can get from cracking gives you the confidence you need to get through your day, as you feel fulfilled once again

http://www.cracks4u.com/download/newcam/ASPack_v2.12_by_Evaluator.zip.html
evaluator
01-07-2004, 03:47 PM
+SPLUJ, i guess, that you copy-paste some inglish,
but not understood jokes idea.
explain in details:) i'm waiting

BTW, Don Wooma loves linking to crak!?
Woodmann
01-07-2004, 06:06 PM
Howdy,

I have no problem with links to craks, so long as they are womens craks :D
esther
01-07-2004, 08:09 PM
Yea especially showing the SPREADING oep HAHAHAHAHAHAHAHAHAHAHAHAHA
Woodmann
01-07-2004, 09:47 PM
BWAHAHAHAHAHHAAHHAHAAAAAA......

esther, you are such a witty bastard :D

Woodmann
JMI
01-07-2004, 11:58 PM
It is my fondest wish that, someday, I can be "half the wit" that Wood and esther are. :D

Regards,
evaluator
01-08-2004, 03:02 PM
Don Wooma, but i'm not Wooman. You are missused by yourself:)

Interesting thing happens with my cracks:
once craker-site stopped for pubish them.
(probably because i repacked aspr & maybe some anti-virus did false alarm?)

so i stopped doing "carks". But if you point me to some good crak-site,
i will send my pending-craks.

What crak-site you recommend!? Or maybe direct here upld!? ~;0


Need help reversing string-to-key routine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help reversing string-to-key routine
PDA

View Full Version : Need help reversing string-to-key routine

philpem
12-31-2003, 03:12 PM
Hi,
I'm currently trying to write my first "real" keygen. The algorithm - FWICT - takes the username, produces an intermediate code (i-code). Next, it generates another i-code based on the key (a 4-character Base 18 code) and compares the two i-codes. If both i-codes match, the key is considered to be valid.
Now - this is no real problem - I've converted the code to C and it works fine for code checking. What I'd like to do is convert the i-code from the username into the 4-character key. The code that generates the i-code for the key is as follows:

unsigned int StrToWord(char *inp)
{
const char conversion[] = "BCDFGJKLMPQRSTVWXZ";
char input[10];
int loop;
signed long r0;
unsigned long r1, r5;
char *pdest;

strcpy(input, inp);
r5 = 0;

for (loop = 4; loop>0; loop--)
{
pdest = strchr(conversion, inp[loop-1]);
r0 = pdest - conversion;
r1 = (unsigned long) ((loop << 3) - loop);
r0 = r0 - r1;
while (r0 < 0) r0 += 0x12;

r1 = r5 + (r5 << 3);
r5 = r0 + (r1 << 1);
}
return (unsigned int)(r5 & 0xFFFF);
}

Can anyone tell me how I might be able to reverse this part of the algorithm into an "i-code to key" routine? Code would be nice, but I'd prefer some form of "OK, this does [x], so turn it into [y] because [z]" type text, i.e. a basic tutorial.
I suppose I could write a brute-force key generator, but I'm not too keen on that idea (the quickest way is not always the best - bruteforcers are too slow IMO).

Thanks.
mmk
01-01-2004, 01:42 AM
First thing I noticed was that there's a bug in your loop. If the character inp[loop-1] is not in the set {BCDFGJKLMPQRSTVWXZ} strchr() will return NULL. This will make the i-code depend on the offset of conversion[] which is most likely not a thing you would want or each new compile of the keygen could generate different i-codes. I assume that was a bug and assume that inp only contains characters in conversion[].

First thing to do is to write the algorithm in the least amount of operations to make it easier to understand. The main loop has been re-written:

#define asc2bas18(c) indexof("BCD..", c) // Returns 0-17
for (int i = 4; i > 0; i--)
r5 = 18*r5 + ((asc2bas18(inp[i-1]) - i*7) % 18);

What this loop does is converting a 4-digit base 18 number in ASCII to binary in reverse order and subtracting each base 18 digit. Change base to 18 and you have a ASCII hex to bin (in reverse order with subtraction of each digit) conversion loop. Nothing special. Each base 18 digit occupies log2(18) ~= 4.17 bits, so 4 of them occupy 16.7 bits.

Assume that r5 = BQGZ(base18) & 0xffff. How do we reverse this? It's simple really. If you can write bin to base 16 ASCII then you can reverse this. Since your function ends with masking off the highest 16 bits, the last 0.7 bits can be anything, so assume they're zero.

for (int i = 1; i <= 4; i++)
{
// We have r5 = 18*r5 + ((asc2bas18(inp[i-1]) - i*7) % 18) and want to get rid of 18*r5. Use modulo
outp[i-1] = r5 % 18;
// We have (asc2bas18(inp[i-1]) - i*7) % 18) and want to get rid of i*7
outp[i-1] = (outp[i-1] + i*7) % 18;
// We have asc2bas18(inp[i-1]) and want to get rid of asc2bas18()
outp[i-1] = base18_to_ascii(outp[i-1]);
r5 /= 18;
}

Hope this helps. It's possible that there's a small mistake someplace because I didn't check this code. Fixing the bugs is an exercise to the reader. :-)

And why do you even bother making such a small hash, and not even a particularly good one? Use MD5, SHA1 or some other real hash and no-one can reverse your password except by brute-force.
philpem
01-03-2004, 03:12 PM
The main loop has been re-written:

#define asc2bas18(c) indexof("BCD..", c) // Returns 0-17
for (int i = 4; i > 0; i--)
r5 = 18*r5 + ((asc2bas18(inp[i-1]) - i*7) % 18);

The logic looks good, but for some reason the code won't work. Maybe it's just my compiler being strange (what's new?)

for (int i = 1; i <= 4; i++)
{
// We have r5 = 18*r5 + ((asc2bas18(inp[i-1]) - i*7) % 18) and want to get rid of 18*r5. Use modulo
outp[i-1] = r5 % 18;
// We have (asc2bas18(inp[i-1]) - i*7) % 18) and want to get rid of i*7
outp[i-1] = (outp[i-1] + i*7) % 18;
// We have asc2bas18(inp[i-1]) and want to get rid of asc2bas18()
outp[i-1] = base18_to_ascii(outp[i-1]);
r5 /= 18;
}

Hope this helps. It's possible that there's a small mistake someplace because I didn't check this code. Fixing the bugs is an exercise to the reader. :-)

Wow - that works great - thanks, mmk :)

And why do you even bother making such a small hash, and not even a particularly good one? Use MD5, SHA1 or some other real hash and no-one can reverse your password except by brute-force.

This isn't from my code - I bought a computer program second-hand, but it had someone else's name on it. I just wanted it to have my name on it, as opposed to the previous owner's name. I contacted the author before doing this - he gave me the go-ahead and said something about losing the keygenerator and having to resurrect his computer.
Anyway, I've been using an SHA1 key with 1024-bit RSA crypto, with the result stored in a keyfile with plenty of checksums and redundant bytes (which aren't really redundant but are a total pig to calculate if you don't know the algorithm). Take a look at CDRWIN's protection - one of the checks fails and it writes bad CDRs - if another one fails, you get an antipiracy warning - etc.
Anyway - must go now - don't want to reveal too many of my secrets :)

Later.


Help: Writing your own dumper/fixer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help: Writing your own dumper/fixer
PDA

View Full Version : Help: Writing your own dumper/fixer

Biaaatch
01-01-2004, 11:33 AM
Evening guys,
as i want to get a little bit "more" familiar with PE Structures,IATs,Dumpers etc, i personally think it would be great to code such a programm for myself,or whatever.
I searched the board and the web for usefull information and i only came up with some really interesting threads about tsehp's revirgin.
Now i wanted to know if anyone got sources or websites,handling this type of stuff (how dumping works etc) I know that writing such programms will be a tough task,but i don't set myself any timelines,i'm here to learn and that's it.If it'll take a year,it'll take a year.
Anyone got some usefull information?any help will be appreciated
thanks in advance :)
Shoob
01-01-2004, 03:27 PM
Evening guys,
as i want to get a little bit "more" familiar with PE Structures,IATs,Dumpers etc, i personally think it would be great to code such a programm for myself,or whatever.
I searched the board and the web for usefull information and i only came up with some really interesting threads about tsehp's revirgin.
Now i wanted to know if anyone got sources or websites,handling this type of stuff (how dumping works etc) I know that writing such programms will be a tough task,but i don't set myself any timelines,i'm here to learn and that's it.If it'll take a year,it'll take a year.
Anyone got some usefull information?any help will be appreciated
thanks in advance :)

a good source of a reversing tool for Asprotect is descripted in this forum from Manko. Go and search the search button. You can read here for some very few pe infos hxxp://www.xbdev.net/fileformats/pe/pe.php
gook
01-08-2004, 05:12 AM
Here's an unpacker for a small packer, including C++ (MFC) source:

http://www.woodmann.net/forum/showthread.php?t=5035

use search next time ;)


Most reliable break points
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Most reliable break points
PDA

View Full Version : Most reliable break points

cbri123
01-01-2004, 01:59 PM
Hi, I searched around a bit but haven't found any one document that is very helpful. I'm wondering what you pro's consider to be the most reliable or useful breakpoints to use.

I'm trying to crack a nag screen / registration box and tried the 2 most popular but neither break on anything useful.

Thanks for any info..

cbri :eek:
Kayaker
01-01-2004, 03:44 PM
Hi

The Win32API Programmers Reference (or PSDK if you can handle the download) should be your constant reference in any case, but check out this one for your immediate question.

cRACKER's nOTES by TORN@DO
http://66.98.132.48/crackz/Archives/Crknotes.zip

Kayaker
cbri123
01-01-2004, 05:18 PM
Thanks Kayaker this is really helpful (just downloaded and installed).. I'll get the psdk asap as well..


What do you think
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > What do you think
PDA

View Full Version : What do you think

Jera
01-01-2004, 09:20 PM
I am considering purchasing two books the titles are: Code Reading & Crackproof your Software. The first said that it has a lot of good code in it (600 or so) and said it is a fact that you become better by reading good code (this being true? can someone tell me where to go to get good code to study cause I know I dont want to study any code by MS). The second book tells the ways that a programmer can protect their software and how crackers (their words not mine) go about cracking it and how to defeat them from cracking it. Your input to my purchase (weather yes or no) accompanied by an explanation would be most appreciated.

Thanks,

Jera

P.S. Happy New Year and good Reversing to All!
UrgeOverKill
01-01-2004, 09:38 PM
Probably to start with, a book called 'Assembly Language step by step' by Dauntemann can be had at any bookstore for a reasonable price. Following that I would searching this site for tuts as they are abound. This place has tuts for direct targets, so make sure you know what you want to find out. As for the second book, imho its ok, but only to get your feet wet.

Good Luck and visit us here often for stimulated discussions. ;)
doug
01-01-2004, 10:29 PM
I wouldn't recommend crackproof your software, as it merely provides comments to code+ideas that are all freely available on the net. Doesn't bring anything new.

I don't know if Code Reading is good or not.

Another book in the same subject-line is Hacker Disassembling Uncovered
by Kris Kaspersky, if you are a new at reverse-engineering, the chapters on understanding code patterns will probably be useful (it's also giving a few IDA tips).. but if you are already an intermediate user.. There won't be many things you don't know/couldn't have guessed easily. (except maybe the comments on object oriented programming)

imho, books on reverse-engineering are rarely worth buying.. especially with what's available online, for free (and up-to-date).
Jera
01-01-2004, 10:56 PM
I would say I agree if and only if you are well versed in searching on the Internet. I have taken a class at college on it and still do not seem to be very good at it. I began looking for some information on finding information on the net but so far nothing seemed to be that good. I know you all recommend the one link about it and I have been reading it but nothing that significant to helping me so far.

Thanks,

Jera
esther
01-01-2004, 11:12 PM
This online book is recommended by some guy.Its a good start if you want to learn asm
hxxp://www.drpaulcarter.com/pcasm/

crackproof your* is worth reading but for advanced reversers ;)
Aimless
01-02-2004, 12:06 AM
can someone tell me where to go to get good code to study cause I know I dont want to study any code by MS).

Maybe you should'nt be knocking around MS till you actually try it. But then again, I guess you need to read my signature.

Have Phun
sope
01-02-2004, 01:14 AM
Hello Jera,

There had been a discussion on crackproof book. Here the link hxxp://woodmann.com/forum/showthread.php?t=4244. I personally liked the book all information at one place.

Regards, Sope.
JMI
01-02-2004, 04:32 PM
And searching the net, my most repeated subject, for books is not all that difficult if you understant that you can use combinations of words to find what you are looking for. In this effort, your keyword would be "ebook" because that is what they are called.

So you could construct a query with combination of "list your subject here + ebook" and you will eventually find many options, both paid and "free." I have a great many ebooks of current software titles I have downloaded. I simply don't have time to read them all. :p

Regards,


Rainbow Sentinel Protocol confusion?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Rainbow Sentinel Protocol confusion?
PDA

View Full Version : Rainbow Sentinel Protocol confusion?

korvak
01-02-2004, 01:21 PM
Hello all,

I have been looking at the Rainbow Sentinel Super Pro dongle and have not seen mentioned/confirmed the protocol used between the LPT port and the actual key, i have seen and found information about the pins used:

(Quoted from the Sentinel Super Pro 6.1 Dev Guide)
power - several pins
output - Data is returned on the key pin 11 (lpt: BUSY)
input - The key uses the DATA lines on the printer port for input
Reset - The key is placed in a reset state after a pulse on the STROBE (lpt: pin 1) line.

now i have seen on LPT pins 6 & 7 data pulses by using a digital scope.

i have also been searching the net for informaiton and ran across "Rainbow I2C Analysis Project" ( http://www.woodmann.net/crackz/Tools/Dongles/Rnboi2c.zip )

and this is showing an I2C data stream in this article and references the Sentinel dongle. and only talks about pin 6, 7, & 1, nowhere does it show anything about output data on the busy line (pin 11) like mentioned in the DEV guide.

so here is where the confusion is:

Is the protocol between the sentinel superpro and the LPT port a "true" I2C protocol (that is 1 SDA and 1 SCL only)? or are they spliting the input and output data lines, but still using the same clock signals?

if so what about the reference from the DEV guide to Pin 11 for "output" ? for those of you that have not brushed up on the I2C protocol... there are two lines... data (SDA) and a clock (SCL), and the data (SDA) is used for both the input and output data between the master and slave devices.

also:
if it is I2C? is it using 7-bit or 10-bit addressing... i am assuming 7-Bit.
if it is I2C? what slew rate am i looking for? 100khz, 400khz, 1mhz? again i am assuming 100khz due to the speed limitations of the LPT port.

i am not looking for a software hack/solution but rather more detail on the communication between the computer and the device and how to record/watch/emulate the device.

or could this be a totally different protocol like SMBus or 1-wire (not likely)?

any help will be greatly appreciated....

Thank You,

Korvak :)
squidge
01-02-2004, 01:42 PM
I would have thought that since you have a digital scope, that you would be able to figure out whether or not it was I2C, and the speed if it is, yourself ?

However, I've had a brief look at some sentinel dongles, and they don't seem to talk the same way. Maybe the protocol is different depending on what kind of dongle we are talking about.

Personally, since the data is being transmitted and sent to the dongle by the PC, I'd start my logging attempts there - by looking at the drivers/etc. Communication between PC and dongle is no doub't encrypted, and the protocol itself is not going to get the algorithm, so my analysys was little more than "data format looks different on each of these dongles". I suppose the fact I didn't want to mess up a dongle which costs £1800 to replace may have been a factor as well...
korvak
01-02-2004, 02:06 PM
DOH!... tunnel vision, yes you confirmed i am an idiot... i have my scope set wrong (100mv/div) and was seeing "stray" signals.... i will get back to you on what i find, after i do a little more waking up and smelling the bits..hehe..

sorry for the jumping the gun and looking like a moron.

thanks,

korvak
korvak
01-05-2004, 11:15 AM
squidge or anyone else that might have input,
a while back i seemed to run across a dis-assembled .dll of the encryption routine for a dongle, the problem is i can not find it again and do not remember if it was the sentinel, hasp, hardlock, or one of the many other dongles out there.... i am not a programmer so attempting to go after the .dll or what ever it is would take me forever. so what i am looking for is if you have or know of where i can get the sentinel superpro dis-assembled communication routine... if not how can i find what file it would be and then what could i do with it? it is true that a patch to the software would probably be much easier, unfortunitely my background is on the hardware side, and secondly the dongle attaches to medical equipment running a unix variation which i would not even know where to start looking for the files. so i am looking to emulate the hardware key. i am hoping that if there has been a dis-assembly of the communication/encryption routines, i could possible figure out the traffic that is being passed.

also you noted that you had a look at the dongle awhile back and noted that it did not appear to follow the same structure, are you saying the lines used where different? the protocol looks different? and if it is the protocol... how was it different?

eagerly awaiting your response to this fun and challanging project that i got myself into.

korvak

P.S. still have not gotten the chance to look at those signals again... as soon as i do (today or tomorrow at the latest) i will let you know what i find on what pins.
korvak
01-07-2004, 04:41 PM
squidge, kind of expected a reply but figured that my posts did not require one or you where too busy.... anyways looking at the signals again and doing a little more digging.... i am beginning to think that the protocol is a form of "SPI" and not "I2C".... here is why... i found that pin 7 was showing the charateristics of a "CLK" signal... pin 6 showing charateristics of "data" from the computer to the dongle and pin 11 showing the charateristics of "data" from the dongle to the computer. So i really started looking in this new direction and the more i find on the SPI protocol specifications the more this looks like the same...

i did notice that this is mostly a software forum.... and if these post are in the wrong place let me know and i shall go elsewhere... for those that are interested, (and i am not told to go elsewhere) i will continue to post my findings.

thanks.

korvak
korvak
12-15-2004, 12:46 PM
i figured out what was going on at the physical level between the PC and the Dongle a while back and thought i would mention it, if any one even remotely cared, what i was confused about... and now that i look back at the whole process, all i can think is DOH!....

well in a prior post in this thread, i stated "i have also been searching the net for informaiton and ran across "Rainbow I2C Analysis Project" ( http://www.woodmann.net/crackz/Tools/Dongles/Rnboi2c.zip )"... well if i had read my own statement... it says "Rainbow" no where does it say "rainbow sentinel superpro"... anywhere.... so i filled in the missing information to include rainbow sentinel "superpro"... and this started the entire "tunnel vision effect"

well after a couple of months a messing with this animal " very little time permitted" it dawned on me... the sentinel and the sentinel super pro use entirely different pins and protocols...

sentinel - I2C standard
sentinel super pro - its own standard

i want to thank tgodd for the one message he did give me about what direction to look.

the sentinel super pro uses its own timing standard, its own hand shaking standard, and its own command and response standard... so if you are thinking you are going to do a search on the net for the physical standards... i wish you better luck then i had... even the SDK does not mention anything other than the pins used...

i know i did not go into great detail... i simple whated to put an end to this open ended question about being confused about the "rainbow sentinel protocol confusion" that might have been in someone elses mind besides me... and if you already knew this... thanks for nothing....

korvak


Stopping Scumware?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Stopping Scumware?
PDA

View Full Version : Stopping Scumware?

Aquatic
01-02-2004, 09:46 PM
I was browsing an unscrupulous site, and the next thing I know is that my homepage has been changed to some porn site. Not only that, but the scumware had somehow made a entry into my gpedit.msc on XP to disable me from changing the homepage back to normal. I had to go into gpedit to change it back.

Now, how the feck can a webpage make changes to my gpedit.msc?

That is some nasty scumware.
Woodmann
01-02-2004, 10:39 PM
Howdy,

This is a big drawback using IE. I never really looked into the problem but I think it is tied into whatever download you may just run. That is the conservative thought. Nasty java or activex can do the same shit.
I am forever removing gator or some other bookmark crap that my wonderful girlfriend manages to pick up while using java games or some other file type crap that needs to be loaded. You know you really have the "BROWSER HERPES" when you cant access your preferences/options to change it back.
(you can change it back, it just takes some effort)

I use spybot to remove all the mal-shit. You can also try ad-aware or whatever it is called.
Aquatic
01-03-2004, 03:06 AM
One good thing about Palladium may be that is stops scumware.

Think about it.
dELTA
01-03-2004, 08:37 AM
Aquatic, if you did not answer yes to installing or running anything, it did most likely exploit an IE vulnerability to accomplish what it did. Normally, the IE security model will not allow any such changes without proper user confirmation.
Aquatic
01-03-2004, 04:12 PM
I never click 'yes' on those things, so I think you are correct.
UrgeOverKill
01-03-2004, 05:44 PM
May I suggest to d/l that latest security fixes for IE. There has been a number of sploits around the net these days.
comrade
01-03-2004, 06:49 PM
Try Mozilla Firebird...


Armadillo - AntiDebug
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo - AntiDebug
PDA

View Full Version : Armadillo - AntiDebug

Artifex
01-03-2004, 03:53 AM
Artifex
Zilot
01-03-2004, 08:05 AM
This appears to be job for JMI
I mean replay on above message
MaRKuS-DJM
01-03-2004, 08:57 AM
this seems to be a crack-request *lol*
Zilot
01-03-2004, 11:14 AM
Interesting software, tell me are more options for testing disabled in unregistered version only ?

You say you can use software unfinitely, but how to explain students that. My dear students we are using shareware software, and we know how to cheat. Doesnt go.

So if you want unpacked (maybe fixed will see, no nags etc..) maybe we can make deal. What do you say about that, this is no third type humor. Serious offer for deal ??
MaRKuS-DJM
01-03-2004, 11:28 AM
I could use this evaluation software as many times as I might want because we know now what clsid to delete (see EVA Cleaner v1.2 by BLiND PRoPHET).

Artifex

I didn't know that. without this information, it looks like a crack-request.
Zilot
01-04-2004, 09:13 AM
Hey electronic man !!!

I unpacked and fixed your simulator (fully functional). If you want we can make deal. My price is 0 $, and I can't get below that. Think for a while and if you want we can start negotiations.

This is evidence I really did it.

http://members.fortunecity.com/zilot/PS0064.jpg
JMI
01-04-2004, 01:59 PM
OK, now you kids play nice in the sandbox or we will have to send you to your rooms without supper. :rolleyes:

Artifex: You have a common problem. You are "investigating" a target which detects your debugger. Therefore you need to review the subject of debugger detection and the associated breakpoints on API's relating to those issues. That's why we have a search button on the Forum. So that most issues, previously discussed, do not have to be re-invented each time someone new has that same issue. It could have detection of the windows for and/or exe names of SICE and/or detect it by API calls.

First you need to review those threads and try the breakpoints they suggest and then report back which ones you tried and whether any of them worked to intercept the "test" for the debugger's presence. Only after you have made those attempts, should you report back that you have tried (list the breakpoints you tried) without success and, then, ask for further suggestions.

There are anti-debugger articles all over the net as well. You could also try a google search with subjects such as : "anti-debugger + Armadillo" and "anti-debugger + breakpoints" as a good start. Another one is "debugger detection code." Using that one quickly, for example, I got this reference, among many:
http://www.woodmann.com/crackz/Tutorials/Armadillo.htm

Regards,
Artifex
01-04-2004, 02:20 PM
OK, now you kids play nice in the sandbox or we will have to send you to your rooms without supper. :rolleyes:

Artifex: You have a common problem. You are "investigating" a target which detects your debugger. Therefore you need to review the subject of debugger detection and the associated breakpoints on API's relating to those issues.

Of course, I did that. All articles say that Icedump or FrogSice hide the debugger to Armadillo.
In that case they do very well, Armadillo doesn't display its message box about debugger's presence.
But it doesn't unpack itself correctly.
That is the problem for me, and I have no clue about that.

Anyway, forget me as I forget you, JMI. I won't miss you.

Bye Bye.
Artifex.
JMI
01-04-2004, 02:38 PM
Whatever your name was, I have already forgotten, you have missed the point entirely. It doesen't matter whether the software displays a dialog box to "tell" you it had detected your debugger, it is obvioulsy doing something "after" it discovers your debugger.

And contrary to your assertion, not "all" article say "Icedump or FrogSice hide the debugger to Armadillo," they work mostly on those issues related to detection of the presence of the software through createfile calls. What have you tried to detect calls to API which detect the presence of your debugger. It would appear that you have a branch call after your debugger is detected, that you would prefer your program not to take.

So take your marbles and go home in a huff if you wish. Information posted here is intended for the assistance of a wider audience than your personal issue.

Regards,


Stolen Bytes to the Extreme ? (Armadillo)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Stolen Bytes to the Extreme ? (Armadillo)
PDA

View Full Version : Stolen Bytes to the Extreme ? (Armadillo)

Billy[23]
01-03-2004, 04:22 AM
Introduced in v3.50, Armadillo now has the option:

"Strategic Code Splicing"

No idea if you guys managed to get a hold of a .exe protected with it, but seen as iam a Registered User of Armadillo
No Iam not a Shareware Author ... :D :D

I present to you a Small Program in Three Parts:

Hello_Armadillo.exe
Hello_Original.exe
Hello_Dumped.exe

And a Quick Analasis of what i managed to dig up.
Lets Begin:

Armadillo Used: v3.50a.xxxx (Custom Build)

No iDea if Chad can Trace My Build with the xxxx's so i leave em out.

Options i Used to Protect are:

[Project]
BitmapSeconds=0
CertificateCount=1
Compression=0
IniStyle=ArmadilloV3
InterceptLibsOption=0
Name=helloworld
NoInfo=1
NoMonitorThread=1
NoRegister=1
NoReportClockBack=1
NoReportClockForward=1
NoStandardProtections=1
ProtectDataAfter=0
ShowLoading=0
SoftICEDetect=0
TargetFile=C:\masm32\Hello.exe
UseCodeSplicing=1
Version=100

So basically a No Debug Blocker Program, with Code Splicing.

I dump and Fix IAT like any Armadillo.
(Too long to put full Steps, but view Ricardos FTP for *GREAT* tutorials)

Any my analasis begins:

Orginal Code:

Function: RandomSerial (Taken from a old Keygen :D )

00401106 /$ 60 PUSHAD
00401107 |. 6A 00 PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
00401109 |. 68 13304000 PUSH Hello.00403013 ; |Title = "Error"
0040110E |. 68 19304000 PUSH Hello.00403019 ; |Text = "Hello World!"
00401113 |. 6A 00 PUSH 0 ; |hOwner = NULL
00401115 |. E8 20000000 CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
0040111A |. 61 POPAD
0040111B \. C3 RETN

Dumped Code:

Function: RandomSerial

00401106 $-E9 F5EE2D02 JMP 021D0000
0040110B ? 0FCB BSWAP EBX
0040110D ? 66:93 XCHG AX,BX
0040110F . 93 XCHG EAX,EBX ; |
00401110 . 93 XCHG EAX,EBX ; |
00401111 . 66:93 XCHG AX,BX ; |
00401113 . 0FCB BSWAP EBX ; |
00401115 . E8 20000000 CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
0040111A . 61 POPAD
0040111B . C3 RETN

Address: 021D0000

021D0000 60 PUSHAD
021D0001 6A 00 PUSH 0
021D0003 68 13304000 PUSH 403013 ; ASCII "Error"
021D0008 F7D0 NOT EAX
021D000A 0FCB BSWAP EBX
021D000C 53 PUSH EBX
021D000D 66:93 XCHG AX,BX
021D000F 87DB XCHG EBX,EBX
021D0011 66:93 XCHG AX,BX
021D0013 8BF6 MOV ESI,ESI
021D0015 5B POP EBX
021D0016 0FCB BSWAP EBX
021D0018 F7D0 NOT EAX
021D001A 68 19304000 PUSH 403019 ; ASCII "Hello World!"
021D001F 6A 00 PUSH 0
021D0021 -E9 E51023FE JMP Hello_Ar.0040110B

So from the Orginal Code We can Tell:

021D0008 F7D0 NOT EAX
021D000A 0FCB BSWAP EBX
021D000C 53 PUSH EBX
021D000D 66:93 XCHG AX,BX
021D000F 87DB XCHG EBX,EBX
021D0011 66:93 XCHG AX,BX
021D0013 8BF6 MOV ESI,ESI
021D0015 5B POP EBX
021D0016 0FCB BSWAP EBX
021D0018 F7D0 NOT EAX

Is the code that needs Removing, Nothing Special, but at
least he implemented it in a differnt way, than the Asprotect Clones
Going around.

Maybe in a real application it is more fun to play with the Code Splicing
but maybe its not :)

Sorry about any Spelling / Grammer (English is not my First Language)

-Billy
dELTA
01-03-2004, 08:41 AM
Cool, thanks for sharing your analysis. :)
rnd
01-03-2004, 08:50 AM
it seems that the author has written a kind of polymorphic engine? i don't see really the benefit of this feature. it would have been better if he made something to hide the adresses of your "hello world" and "error" strings.

like a translation of

push address_helloworld

to

mov eax,(address_helloworld XOR 0x12345678)
xor eax,0x12345678
push eax

that would make cracking shareware apps a little harder...
Billy[23]
01-03-2004, 10:47 AM
Yep, only benifit i can find from using this option is the amount of times it does it, my code was just 1 function , with 1 call, imgine a entire shareware app ?

could get awfully boring copying and pasting all them bytes :)

THen again i didnt even look if there is another way to fix em.
nikolatesla20
01-03-2004, 06:55 PM
Once again, big DEAL. All you really have to do is look for JMP instructions that jump outside the original code section. Then grab all that code an remap it to a new section, and edit the original jump. Just leave all the junk code in there, it doesn't hurt anything after all.

-nt20
dELTA
01-03-2004, 07:42 PM
It might be at least tedious to do this, and it would require automated tools specifically for this purpose (i.e. no more simple manual dump + IAT fix, but then again, the same goes for nanomites and friends, I'm just saying) not to mention if the jump code itself was obfuscated/encrypted and/or the relocated code was mutated in a context (address) sensititive manner.

Oops, probably shouldn't have said that, guess we'll see it in the next Armadillo version... :D
nikolatesla20
01-06-2004, 01:03 PM
I don't think creating a context sensitive code would help hide much - you'd have to have a look up table somewhere, and look at the nanomites and the tables they use. One only has to find the tables and decrypt one of them and you now have the nanos by the balls.

This "code splicing" is a feature taken not from ASprotect, but from DilloDumper itself :D DilloDumper would allocate virtual memory space in the other process, inject new code, and then modify key original instructions in the packed program to jump to the new code. Although it used CALL instructions, it was the same effect. Legal action is pending :p

*Note this is sarcasm, this type of "protection" has been used all over the place, most likely beginning with SafeDisc*

Also, ACProtect uses this same style technique to break code up into smaller blocks. My ACProtect unpacker cleanly repairs these flaws with ease.

There's ALWAYS a pattern.

-nt20


Adding new PE sections
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Adding new PE sections
PDA

View Full Version : Adding new PE sections

Zaza
01-03-2004, 06:25 AM
Ive been having trying to add a new section to a PE file, the section seems to add correctly but when i load the resultant file and look with softice the section doesnt seem to have been mapped into memory - softice just shows a load of "invalids" at the memory location of the new section.

PLEASE help!

Zaza
Zaza
01-03-2004, 08:19 AM
i have also tried increasing the size of the .rsrc section which causes XP to claim the file is not a valid executable.

I dont know if its important but the file im experimenting on was origianlly compressed with upx
dELTA
01-03-2004, 08:48 AM
There are additional fields in the PE header that must be adjusted to correctly add/resize a section, e.g. the ImageSize field etc. Get hold of a PE format specification and study it. Try the docs at Iczelion's site for example.
Zaza
01-03-2004, 08:52 AM
ive actually been using various utilities to try and add the sections -namely LordPE and SaDD which automatically update the ImageSize field.

ill have a look at the PE specs in case i need to update a field specific to XP which the utilities miss.
rnd
01-03-2004, 08:57 AM
adding a section is not always 100% safe. better enlarge the last section (but check for overlays!).

if there is no code that tried to access your new section, the memory might not be 'present', and softice will show ?? ?? ??'s indeed.
Zaza
01-03-2004, 09:02 AM
if there is no code that tried to access your new section, the memory might not be 'present'

i assumed the win32 loader blindly mapped the file into memory, not taking into account whether the code was actually being referenced from anywhere.

as to enlarging the last section - i tried that as a fallback plan and that didnt work either - enlarging the .rsrc section (which is the last section in the file) caused XP to claim it wasnt a valid win32 executable - i wondered if perhaps this was because the .rsrc section was parsed for errors or something.

(i cant really see the .rsrc section being overlayed)

p.s. as far as i can tell it is safe to add a new section as there is plenty of space to add a new section header (unlike notepad :( )
bart
01-03-2004, 09:46 AM
you can easily extend rsrc section size, just remember to update ImageSize value = align(lastSection.VirtualSize + lastSection.RVA, sectionAlignment)
rnd
01-03-2004, 12:13 PM
you can easily extend rsrc section size, just remember to update ImageSize value = align(lastSection.VirtualSize + lastSection.RVA, sectionAlignment)

indeed, that should do the job. winxp loader doesn't verify the resource structs or something, i successfully made last section increasers in this way before.
dELTA
01-03-2004, 01:30 PM
i assumed the win32 loader blindly mapped the file into memory, not taking into account whether the code was actually being referenced from anywhere.

Map the memory: Yes

Page in the contents of the memory: No, not necessarily
LOUZEW
01-04-2004, 01:08 PM
Y use TOPO, it work well ! ! !
MrBarby
01-16-2004, 02:01 PM
um...

have u tried a program called zeroadd?

adds a new section to ur file.

hxxp://biw.rult.at/tools/zeroadd.zip
nikolatesla20
01-20-2004, 04:29 PM
Windows 2000 and Windows XP WON't show any new memory sections until a part of that memory section is actually used. Remember, Windows uses PAGED memory. The sections load in as 4K pages. Which means usually your new section will get its own page, and if that part of the file is never used, it will never be paged in. Even though the program is run and "loaded", the windows loader does not load the entire file, it only loads pieces which are needed to execute. If a page fault occurs, which would happen when your program goes to address something in that new section of yours, then windows will load that section from the disk file.

You can force SoftICE to load the section anyway, if you know where it is supposed to be in memory, by using the PAGEIN command.

PAGEIN <address>

-nt20


Cracker "She"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Cracker "She"
PDA

View Full Version : Cracker "She"

Zilot
01-03-2004, 08:09 AM
I was always wondering are there female crackers/hackers. I havent meet any of them, anyone has ??
Zero
01-03-2004, 11:55 AM
Sure there are some...

One example is:
Woman In Action - Ruins (http://nfotemple.free.fr/index2.html)
_ColdMind
01-06-2004, 07:13 AM
Some craskers use female id to cover their trax.
Zero
01-06-2004, 05:57 PM
Maybe... but in this case I don´t think so :rolleyes:


Unusual tests for DRx registers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Unusual tests for DRx registers
PDA

View Full Version : Unusual tests for DRx registers

evaluator
01-03-2004, 12:08 PM
Well, I did some unusual tests for DRx registers & found interesting Facts;
In Intel's manuals I not found explanation, very can be - because of my Inglese.
So help me, guys:)

This fact is about instruction-tape DRx-breaking,
when flag for appropriate DRx in DR7 is NOT set,
but debug exception is still generated.

If you have any info about this, write here.

If no, I will upload test-program & we'll test together.


Newbie Dongle Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Newbie Dongle Problem
PDA

View Full Version : Newbie Dongle Problem

wreck27
01-03-2004, 07:27 PM
OK, to keep from getting flamed I'll start with the facts. Trying to remove the dongle from a program calledI will not name my target . My first time really trying to crack anything, especially a dongle. It's a _hasp() but no envelope, well as far as I can tell. I'm using IDA Pro to dump the code and WDasm to step through with debugger. Downloaded all info manuals for Hasp API and found a couple of could signature files for hasp. :o

So, I found the _hasp() routine but cannot tell where it's checking for the return code from _hasp(). If anyone has had any experience with Accubid products or could tell me the next step in finding a way around the dongle. I have lost all patience at this point. I've manually altered every conditional jmp I could find and still no luck. :(

P.S. tried using SfTice as debugger and ended up just confusing myself more. Next project learn how to use SfTice.

Thanks in advance for any insight you might have.
AzynchriX
01-03-2004, 08:45 PM
So, I found the _hasp() routine but cannot tell where it's checking for the return code from _hasp(). If anyone has had any experience with Accubid products or could tell me the next step in finding a way around the dongle.
Additional reading and searching will help.

GL to you.
naides
01-03-2004, 08:45 PM
OK, to keep from getting flamed I'll start with the facts. Trying to remove the dongle from a program calledI will not name my target . My first time really trying to crack anything, especially a dongle. It's a _hasp() but no envelope, well as far as I can tell. I'm using IDA Pro to dump the code and WDasm to step through with debugger. Downloaded all info manuals for Hasp API and found a couple of could signature files for hasp. :o

So, I found the _hasp() routine but cannot tell where it's checking for the return code from _hasp(). If anyone has had any experience with Accubid products or could tell me the next step in finding a way around the dongle. I have lost all patience at this point. I've manually altered every conditional jmp I could find and still no luck. :(

P.S. tried using SfTice as debugger and ended up just confusing myself more. Next project learn how to use SfTice.

Thanks in advance for any insight you might have.

Do not take this the wrong way, but if this is your first shot at cracking, Dongles and Hasp are not the best Place to start. Also, using WDasm as debugger is not a great idea, specially when you are tracing a protection that uses DLL and services.
Take it from somebody that did exactly what you are doing, when I started cracking. I would keep the Hasp protection in the backburner, as a pet project, and become proficient in using Sice, and general cracking first.

But, at Age five, Mozart sat himself for the first time at the Piano and composed a sonata.

So, may be you'll do it Wolfang. . .


SoftIce + XP one big, or 3 small probs..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce + XP one big, or 3 small probs..
PDA

View Full Version : SoftIce + XP one big, or 3 small probs..

quetzalcoatl
01-03-2004, 11:06 PM
ok, i have searched, tried, pathced, edited, read, thought and god-oly knows what else i did during last 48h. i searched through this forum for last 5h, and it did have faaar more materials about SI that all others i have found..

many ideas, different ideas, all the same problems, but NOTHING works...

Duron 1.2G, 256MB, mainb: K7S5a, hell knows whever SIS or VIA..
GF2MX400 64MB on detonators 53.03
WXPpro without SP1/SP2, with several hotfixes

from the beggining: i have tried a month ago to installl SIv4.05 - failed, patching with allmighty 3 files didn't do the trick. next i tried installing 4.27, failed again, 3 files failed again. so, after 2 weeks of searching/blah/ i obtained DS3.0.1, tried to install, FAILED. And Compuware tells it supports XP heh. I've digged through the whole Knowledgebase in search for solution. I have found many, but none worked. OK, i thought, i have tons of trash in the system, maybe it is it??

now, after reistalling WXP, few progs, hotfixes, and drivers, i have tried to install directly DS301 and .. failed. But from the beggining - DS have installed, i have set it up to boot. WXP didn't start, so i ESC'ed the drivers, got to the desktop, switched to system, voil'a, WXP now runs clear. But SI doesn't (hangs on C+D, doesnt resume on C+D or f5). ok, i searched deeper, and somehow digged out patch DS30SP2.exe from compuwaer, which i somehow missed earlier. i have applied it, and from now on, SI displays the window correctly (WOW it managed to display it self at least..)

but there is different issue that need solving - keyboard. after SI patches it, the keyboard (apparently key table) gets messed, and in the very best case, behavies erratically, sometimes just right, sometimes a little wrong (mouse on USB works all the time ok). but in many cases keyb just gets into such lets say "code page" :) that i can in no way guess where that ** key is that now is that ** (different) key OR everything is OK for a time - after etting into SI, i have 3..5s before hangup, from which i can get out with CAD (!)(commented later). my esarching led me to some ideas, some from this forum, some from compuware..
*)i HAVE found (not here, on other site, dunno which one now) something said to be keytable changer. it can overwrtie keytable ie. in keyboard drivers like that in ntice.sys. in package i found 3 tables - deutche (dk.map), ??(dk.map) and USA(us.map). usa one seemed to contain just the same what i have in my ntice.sys, so i assume the ntce.sys has correct table. (yes, i have tried later overwriting with us.map - no change)
*)swapping i8042prt.sys - files from compuw.'s w2ktest.zip doesnt work.
w2k!=wxp
*)swapping -,,--,,--,,-- - file from SP1 didn't work (my idea) ...
*)[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice]
"KbdMethod"=dword:67416E5A - from this forum, worked in a way. as long as it is in registry i can write in SI for about 5..20s.

in that small time SI work correctly, an if i manage to switch out of SI before it hangs, the switchin out seems to reset the time counter. but it is haaard to guess when would it want to hung today :D [ok, that was meant as a joke connected to "where do you want to go today" but after writing one more screen of this post, i realised that it can be too hard :) ]

next thing: after running command "net start ntice" or "net start iceext" (iceext gave me additional 0..10s :))) and waiting abut 30s, console window informs me about success, SI window flashes, and the sh** with keyboard happens. whats more that console window DOESNT close. the NET command hangs after printing message. Console doesnt hang. I sometimes can force closing NET (Ctrl+C, if keyboard works..). after running SI, any tries to run NET-related command (net view, net stop etc) end in NET's hangup either right on start, or at the end.
SI seems also to block any other process terminating, or worse - hangs up computer on attempts to close/terminate whatever. Computer with SI running slows down constantly (ab. 10% in 2..4 minutes). I managed however to close notepad two times in a row before hangup :D
*) i have my little brain and some memory, and tried to apply incidentially found patch described in issue
[ frontline.compuware.com/nashua/kb/doc/1348.asp ]
after 3 hangups (hey, i have to write in SI...) i obtained address:
8058DC32, while SI in it window shows all the time
NtTerminataProcess found out at: 805A5246
either with my corrections, or without them. SI seems to ignore the Addr.NtTerminateProcess key.

what next.. god, i'm completely tired.. (location: poland, time: GM+1, local time: 4 a.m.) forgive me any grammar/etc mistakes :)

ahh, i also obtained txt from the SIwindow, by I:\SoftICE\SoftICE\nmsym /log:log.txt
but as long i have only 2 logs, 'cause every such a call results in hangup after or before writing file.. if BEFORE, im popped out into SI *with instant hangup* and i can see that SI halted at NTSTATUS:STATUS_ACCESS_VIOLATION
if AFTER writing - i have luck, and brand new log. in this log i see maany things more or less interesting. i think this part is most important, but i can also send you even whole two logs :) so the part is:

NTICE: Load32 START=71B40000 SIZE=2C000 KPEB=80F6F768 MOD=netmsg
001
Int0E Fault in SoftICE at address F54C0053 offset 00092D8F
Fault Code=00000000
DS=0010 ES=0023 FS=0030 GS=0000 ESI=00000000 EDI=F6295D64 ESP=F6295CFC
EAX=00000000 EBX=F9DB2E20 ECX=00000000 EDX=00000000 EBP=F6295D64

FrameEBP RetEIP Symbol
F6295D64 00000000 NTice!.text+00094CD3

and after it, ntice loads several MOD's successfully (or omits them successfylly, i dont know, just no further errors). it seems NTICE have a problem with netmsg.dll - i checked it, i cant get any symbols from microsotf, and any exports (checked by EXT= and ICEPACK - icepack throw out error on reching this file). so, i thought "maybe it is my goddam sygate firewall". enabling/disabling/uninstalling does nothing to IS ofcourse. SI still reports the same error in the same place.

ok, now, in shorter form, about winice.dat options:
Option turned on or off, SI doesnt find USB mouse.
Disabling keyb. pathing results in disabling keyb driver on loading SI.
Disabling NUMlock progr. seems to disable keyboard
Enabling keyb. pathing and NUM programming results in that issues described above
Disabling/Enabling Pentium supprt really doen't nothing
The DSControlPanel setts walue ECHOKEYS=[ON|OFF] on turning keyb. pathing on/off respectively. Strange. Older SI's seemed to use KBD name instead. I tried KBD - no reaction.
I thought that dealyed hangups may be seaprated from keyboard issue, and be just a result from i-thought-repaired video problem. i treid changing VidMemory with such results:
2048kb..65536kb - all the same (mind that i have 64mb on GF2MX400)
over 65536kb - on entering SI, screen screws into "out of frequency" and if im lucky 0 the keyboard is ok- i can switch off SI and work on desktop again.
mouse on/of - nothing, mouse isnt present, as the SI doenst find any USB devices.. (BUF when SI runs, mouse work correctly, maybe with some slowdowns..)

And one more thing with the keyboard - since SI uses (i think) direct keyboard (sheeesh what was the word for it?????) gr.. cant recall. ok lets say: since it uses "direct keyboard sniffing", it should make any difference, what keyboard layout i use under WXP? OR MAYBE that is the thing - and i must either simply switch to US-KeybLauout, so the i8042prt will be automatically exchanged for the US-i8042.sys or obtain/make somehow file "pl.map"?
(as you could notice form "location: poland", i'm in poland, i speak polish and i think in polish, so it is easier for me to have polish layout, even it it has just
the same characters on the same positions.. strange? not :) we have some national-specific characters not found in roman alphabet, added under ie. alt+a, alt+e, alt+s etc. computer maniacs like me are a bit more flexible, and for us "myslenie" is the same as "myślenie" [thinking] but for other it is just "killing our beautiful language", so at least for theirs sake, i need those extra characters :| )

ok, EOF

PS.i pasted this post into notepad - wow, i wrote "just" 8.06KB!!
PS2. thanks for help!
PS3 (thanks for reading)^2 :)
quetzalcoatl
01-04-2004, 05:29 AM
Nice for the post to be viewed at least :)
I write now because i've noticed i'd forgot the almost most important thing:

"please HEEEEEEEEEEEEEELPPPPP" :)
Kayaker
01-04-2004, 07:00 AM
Hi

I have no idea how to help you, wouldn't know where to start, but just thought I'd mention a thread by Czerno where he patched TRW's keyboard tables to handle a foreign keyboard. If you really think that the keyboard mapping may be part of your problem, you might consider a similar idea with Softice.

http://66.98.132.48/forum/showthread.php?t=4296&highlight=czerno

Other than that all I can say is good luck, and I'm sure glad I don't have XP...

Kayaker
quetzalcoatl
01-04-2004, 07:29 AM
(...)
http://66.98.132.48/forum/showthread.php?t=4296&highlight=czerno
(...)

thanks for hint, i haven't read this post earlier. however, i have already found out few things that i think close the keyboard-key-map-table-etc ides.

first one: as i write, i tried to patch ntice.sys with us.map table (which was the same as found in ntice.sys) - no result. strange. [nmfilter was INSTALLED manually, it didnt install into the system with SI installation]

second one: later i tried once again to patch it [nmfilter REMOVED - i backed to 'clean' SI installation..] and ... net start ntice said "error-blah service coudnt start blah corrupt file blah" or something close to it

third: i tried switching in WXP to US-layout, just for fun. Ofcourse i8042prt, keybdrv, key01 etc files werent even touched by the system - so no change for SI

fourth, the dumbiest: just before realising "fifth" i got stuck at:
ok, i have us-table, i need polish-table. how do i know which codes on polish keyboard match which ASCII? how do i know the scan codes for polish keyboard?

fifth, the best one: after seeing that error in "second" and getting stuck in "fourth" i realised that i misunderstood word "foreign keyboard". I have Standard Keyboard, with standard key layout, with nothing polish, or even non-english on it (ok, except for dirt, which is completely local :) ). Key table converts scan codes into key codes, right? so, i'm almost sure that my keyboard has just the same scan codes as yours; why would it need to have different, if it works with 100% non-national-specific devices and have no-national-specific keys???
------------------------------------------------------------
[updated later] oh, i've forgotten, there was also sixth:
sometimes the keboard, after launching SI , have a delay of exactly 2..3 chars (in different windows session it changes, but during session it is constant). ie in notepad:
i press in sequence: abcdefghijkl
ntpd gets: [nothing][nothing]abcdefghij
then i press: 012345
and ntp cathes: kl0123
and so on.
seems just like SI screwed sth in the keyb's ring buffer [static buffer, two pointers to its elemets indicating start and end, reading element by *(buf
+element%bufsize). 'ring buffer' was that the english name for it?]
Ari Benta
01-04-2004, 04:47 PM
Do you use Kaspersky Antivirus? If so, try changing the registry key "Start" at
"HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Klif" and "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\KAVMonitorService" to 3 (manual load).

(Erm, no, there shouldn't be a space between "Servic" and "es"..)
quetzalcoatl
01-04-2004, 05:05 PM
nope, i don't have any antivirus. however this thingies i have starting with the system:
DStrayicon, SygatePers.FirewallPro, DAP, DaemonToold3.43+ShellSuite, VCD5.0 (yes yes, two different virt.cd drives, i just have old cd images for VCD), C-Media Audio Configuration (shitsoft automatically installed with drivers onboard soundcard), 2 programs from Detonators (nwiz.exe and NvCpl), and the last - CreativePlayerDetector (came with Jukebox3).
and any services those programs need, and ofcourse system-critical services :)

need more info on something? need some blog? just name the topic :D

PS. i'll repeat myself, but previous is hard to find..

Please Heeeeeeeeeeelppppppp!
JMI
01-04-2004, 05:49 PM
Just as a wildass guess suggestion, have you tried turning off your other running programs and/or tasks in the task manager?
First step: turn off all or most other running, non-critical not related applications. Try again to make it run.

Step two: Begin turning off other running processes, one by one, and seeing if doing so has any effect on your condition?

Step three: Turn off the first suspect running process and then add a second, in sequence, i.e. tasks 1 & task 2, then task 1 & task 3 and so on. You can repeat these sequencing event such as task 2 & task 3, task 2 & task 4, and so on. That way you will eliminate the running processes as the culprit. Of course this will possibly identify the culprit, but not the cause or cure, unless you can make it run correctly without whatever you identify.

Step four: If you have an extra HD, do a clean install of xp and necessary drivers and updates to match your hardware configuration. Install SICE and see if it works without any of your other software. If so, you could start installing them one at a time until it breaks again and then you would have identified at least one of the programs which is causing the issues.

All you need is time to burn to try all these things. By the way, have you tried Olly?

Regards,
Ari Benta
01-04-2004, 05:56 PM
Well, I had the same problem.. after I started SIce, the dos box stayed open, everything was super slow and hell instable.. and I also tried everything I found on the web, but nothing helped, until I changed those kaspersky services to manual.. but as you don't have that installed, I don't really know what might be the cause for your problem. However, it might be some other driver on your system which interferes witch SIce, so maybe if you disable one driver after another, you can find the faulty one..
good luck!
JMI
01-04-2004, 06:06 PM
Hum. That sounds kind of familiar. :D See previous post. :cool:

Regards,
quetzalcoatl
01-04-2004, 06:08 PM
...wildass... steps..

Funny named, no offence, i didn't know that word :p

That was the first, no sorry, the third thing i've tried. First: reboot, Second: try to patch SI as i read many times (3 files..) Third: Check for conflicts with progs. ??th: reinstalling SI :) Now i suspect that i't maybe sth with the Syg'sFirewall, but i've tried turning it off/etc and still with no effect.

What really bothers me is that strange message
NTICE: Load32 START=71B40000 SIZE=2C000 KPEB=8122EDA8 MOD=netmsg
Int0E Fault in SftICE at addrss F3497053 offst 00092D8F FaultCode=00000000

maybe its just because netmsg.dll has no debuginfo, but it's quite dumb idea, as many files doesn't have them and SI runs somehow somewhere else...

what more suspicious i've never found any references to "softice netmsg" anywhere and nothing interensting with "softice load32"... :(

aaa and one more thing - i did try befrore and after reinstallin wxppro... i really have now wxp at minimum. i don't even have office yet :))
kao
01-05-2004, 02:15 PM
Hi,
you did not mention what kind of keyboard it is: PS2 or USB. SI sometimes has problems with USB keyboards, so maybe this is the case. Try switching to PS2 keyboard or use an USB-to-PS2 adaptor.

Hope this helps,
kao.
naides
01-05-2004, 02:22 PM
I guess you would not contact compuware for Costumer service help, right :D ?

Some Display cards and Keyboard Drivers just won't cut it with SoftIce. Perhaps the Duron CPU may have its own wrinkles.
Consider installing either Win2000 or Win98 (as dual boot OS) and see if Sice runs in those OS. I mean try to isolate if the the problem is in your hardware, versus your Operating System, versus your Drivers.
quetzalcoatl
01-05-2004, 02:41 PM
Keyboard: PS/2 Mouse: USB, i have tried with keyboard w/o mouse nad vice vera, no effect.
to be honest i'm a bit of tired now. no blog today :D in the schedule i have now trying with different releases of SI, i have tried now ROR's full DriverStudio3.0.1 (cdimage) 125mb, ROR's DriverSuite3.0 (that is just SI and the closest programs cut from that cd) 61.5mb, and in next 15mins i'll try SoftIce Lite 4.30...

shit. i've just unpacked the archive "softice_lite4.30.rar" and found inside "DriveCrypt+", gosh,
GOD ONLY KNOWS HOW MUCH I DO HATE THOSE FCKD FAKEEEEEEES :mad:
Woodmann
01-05-2004, 05:41 PM
Hi,

I think you have too many things going on at the same time.
Too many install's/patches/winice.dat

The only practical way to solve this problem is to install a clean OS,
No extra app's should be installed, no firewall/antiV/realP etc;
From the task manager shut off any extra crap that XP has running.

Install SI. Does it work ?
Change video adapter and drivers to "generic" and reduce the display to 640.
Change the keyboard drivers to "standard" and make sure the layout is set to US. Not us dvorak or whatever the other options are.

If this does not work, dont add any patches etc; Go to Sysinternals and download some tools and watch what is happening. If this fails to provide an answer then you can try 2000 or get a new rig without a duron processor :p

You are just one of those lucky people running XP and can't get SI to run properly for some strange reason.

Keep us updated please.

Woodmann
quetzalcoatl
01-05-2004, 08:24 PM
1) I think you have too many things going on at the same time
2) No extra app's should be installed, no firewall/antiV/realP etc
3) Go to Sysinternals and download some tools
4) Get a new rig without a duron processor
5) can't run SI for some strange reason
6) Keep us updated please.
Woodmann

1,2 - in fact, yes that was one of the problems
3 - you mean filemon & regmon? i know them well :p indeed, really good tools..
4 - low on cash and don't want to downgrade hardware :|
5 - reason weren't as strange as it seemed before..
6 - why, of course i will :) after writing such a essay about problems with SI how could i not write how i did solve them? more, with so many keywords those post will catch any query about problems with SI ROTFL

i have solved the problem just before reading you post, but thanks for reply anyway, there weren't many of them :)

---------------------------------------------

hereby i report that 99% percent of problems with instalation of the SoftIce are closed.

we have a saying "najciemniej pod latarnia" [ "the darkest place is just under the lantern" ] meaning that it is hard to find something lying just on sight..

i have pasted earlier that fragment of log from SI window:

NTICE: Load32 START=71B40000 SIZE=2C000 KPEB=80F6F768 MOD=netmsg
Int0E Fault in SoftICE at address F54C0053 offset 00092D8F

so, there was an error in NETMSG.DLL. but what is it? well, after little thinking, one can say that it has something with network messages, right?
so i tried turning off firewall-de-sygate, with no effect. tried to disable it at startup - no effect. at last i've got completely mad it constantly asking me about something, despite turning off every 'ask me' option, and i uninstalled it. after reboot i started SI, and ... console window closed after finishing.

hey. it never did close. ... aaaaarrrrgggghhh
i opened the notepad. i closed the notepad - no crash...
so i opened it again, closed, opened, closed.
wooow closing doesn't crash anymore. :)

ctrl-D, and i saw exactly this at the top of SI history:

NTICE: Load32 START=71B40000 SIZE=2C000 KPEB=812134C8 MOD=netmsg
NTICE: Exit32 PID=9C MOD=net1
NTICE: Unload32 MOD=net1
NTICE: Unload32 MOD=netrap
NTICE: Unload32 MOD=netmsg
NTICE: Exit32 PID=94 MOD=net
NTICE: Unload32 MOD=net
NTICE: Exit32 PID=7F4 MOD=cmd
NTICE: Unload32 MOD=cmd

first note - no error at mod=netmsg!!!
second note - just look what were unloaded just after that netmsg..
NET1:exit, NET:ext, CMD:exit
so, firewall blocked somehow Exit32 when it was about to close NET1...

but i wasn't happy for long. i exited SI, nad checked keyboard in notepad. well.. eh, it still had that strange 'delay' . so just to be sure i entered SI once more played awhile, bumped the mouse, and saw SI freezing again.

having that netmsg issue in mind (trivial net-msg <-> firewall), could be that bumping the mouse related to halting SI (usb mouse instead usb keyboard)? lets try some unpluggin'

so, i unplugged the mouse receiver, rebooted, started SI, waited 5minutes.. and nothing, no crashes, no freezes. what's better - with out mouse, keyboard also seemed to work correctly.

...thinking...
bump_the_mouse()==>freeze_the_SI(). ok. but why waste_time(time)==>freeze_the_SI()...
shit... ofcourse... keepalives... just that you don't touch your wireless mouse, doesn't mean that the mouse won't send anything... so the true 'equation' was: receive_msg_form_mouse()==>freeze_the_SI().

so, just for a test, with SI runing, i plugged the mouse, keyboard still ok, SI still ok. what the hell? hmm.. i opened confing panel, troubleshooting tab, and i see that i still have mouse-disabled, usb-mouse patching disabled. hmmm. i left the mouse connected, rebooted, started SI. everything works. so the alst thing - i enabled mouse support, enabled usb-mouse, rebooted - keyboard ok, mouse behaves on the desktop as if there is CTRL pressed and the most strange: SI doesn't crash on mouse movements! heh, still it must be disabled for the keyboard..

the last thing - why when previously i turned off the mouse support and patching, SI still freezed overtime because of the 'pings' from mouse?
some time ago i tried to sniff packets exchanged between computer and Jukebox3 via Firewire (IEE1394 port), downloaded some strange tools for universal port sniffing, and got suprised that i could set up an IP address not only for connection through network card and via Firewire (that was ok) but also for USB. at that time i thought it was just bug - someone used the same dialog template for different ports, but now it makes som sense..
it seems that the reason why turning off usb support didn't work earlier was.. again firewall. turning it on/off started working just after unintalling it, right? SI also stopped crashing on mouse movements then.. it's all as if the firewall messed not only with network and it interface, but also with USB. this and that strange IP setting in sniffer... does it mean that USB controllers are also seend by the system (or used) as network adapters? i knew that Firewire (IEEE1394) is, but to be honest i've never heard such a thing about USB :confused:

ok, EOF

now in reeeally short form:
*) problem with thread killing was solved by uninstaling completely Sygate's Firewall.
*) problem with no reaction on changing DisableMouseSupport and DisableUSBMousePatchnig was also solved then
*) erratic keyboard seemed to be solved by solving USB issue.
*) Wireless USB Mouse (M$ design..) is still erratic when SI is running with 'mouse enabled', but SI doesn't hang anymore on receiving signals from mouse
*) so the compuware's "USB mices won't work with SI" isn't 100% true. my mouse works, but sometimes -only for the mouse- ctrl key gets 'locked'. ie.on the desktop, clicking will select multiple items all the time (unless you pess ctrl, or unlock it by repeatedly presing both ctrl's and having some luck:) )

[added] *) and i forgot about one thing (again...)
i have also found file OSINFO.DAT.. yes, yes, yes i know that it should be updated whenever possible. BUT as i searched (even on compuware's site) i have found bunch of osinfo's of size: 290kb, 298kb, another two between it, and one OSINFO_XPSP1.dat NOW i'm saying about osinfo.dat of size 310kb, from 29August2003. i don't have an idea where guys got it, as even osinfos in my DS3.0.1 (the newest version i know about) were smaller. ok not allways smaller!=older but here's database about system versions, so it is probable :D file is available at: (i hope it's not against rules to post a link to small patch..?)

http://reversing.kulichki.com/files/debug/osinfo.rar
Woodmann
01-06-2004, 12:18 AM
Wow............

All you need to do is cut and paste all your posts and some
extra explanation will probably yield a good work concerning
XP and SI. If you go through and add some other words from
authors who have written about XP and SI, you will have the most
complete works to date.
(of course you will ask authors for permission :)

Woodmann
quetzalcoatl
01-06-2004, 01:33 PM
yes, that would be something :) in fact, i have found quite many fragmented data concerning different problems.. i'll think about it, and post link here if i manage to make something..

...
hey, i think it is not a so idea to ask compuware for permission? :D
[ for JMI below - ok, that was another failed joke :P ]
JMI
01-07-2004, 03:50 AM
I believe Woodmann was referring to acknowledging the contributions of others who have discussed how to fix problems with XP and SI, not seeking permission from compuware. :D

Regards,
Woodmann
01-07-2004, 06:08 PM
Hi,

JMI has a poor sense of european humor :p

Woodmann
dELTA
01-07-2004, 07:23 PM
Don't worry, I'm tutoring him on that too, along with the Swedish lessons. :D
JMI
01-07-2004, 09:40 PM
Yumpin Yimmny, Dose Svedish lessons is hard verk, you betcha.

And maybe someone simply didn't understand "Califonia" humor expressed in the reply. The post does include, afterall, it's own " :D ".

And will someone please give dELTA some history-geography lessons. Sweden has, NEVER, lowered its expectations to view itself as part of those lowly "europeans." They have a "higher" view, probably brought on by their being actually "above" most of Europe. ;)

http://www.historylearningsite.co.uk/north_europe_30YW.htm

http://www.sverigeturism.se/smorgasbord/smorgasbord/society/history/power-period.html

Yes, I know that Finland, Sweden and Austria join the EU group in 1995. but I'm sure that the Svenskar have always viewed it as Europe actually, finally, joining them. :cool: Tachsa mycket. :)

Regards,
dELTA
01-07-2004, 10:10 PM
Who said anything about being part of them, we just understand their inferior humour. :D
JMI
01-07-2004, 11:56 PM
Well I need to fix my keyboard so it can properly do the accent marks. :(

So dELTA, when can we look forward to your Tut on European humor? I hope you are going to run it by Evaluator for grammer, spelling and content. :p

Regards,
quetzalcoatl
01-09-2004, 05:38 AM
subject: understanding specific homour
crack-me's: Monty Python's films (ie. "MP's Flying Circus")
solved when: you understand every single joke in at least one film :D
JMI
01-09-2004, 06:54 AM
Ah! But I'm old enough to have been an adult when I watched those shows when they were aired for the first time. :p I also grew up in the household of a foreign born English father and had an Aunt born of British civil servants in India. (You know its frightfully hot in Deli in the Summer, and everyone that could took the train to the mountains for the summer.) I grew up with stories of Africa and India and all that, and my father never did learn how to speak "American." So, except for the "sticky bits," I believe I have a fair grasp (or is it gasp) of "British humour," and/or the lack thereof. :D So frightfully sorry, old bean. :cool:

Regards,
quetzalcoatl
01-12-2004, 07:25 PM
whoa.. i didn't know :) i just wanted to say, i'm astonished by what those guys could do and still "get aired" :)))
btw. remember knights who say nee? or rabbit? heh..
btw2. offtopics seem to be growin here quite well lately.. don't you think? :)


How to fix nulls in dumped exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to fix nulls in dumped exe
PDA

View Full Version : How to fix nulls in dumped exe

MiniMind
01-04-2004, 08:19 AM
Yes administrator I searched the board found: "PE Rebuilding Topic"...
but I didn't find the info I needed.

I dumped a file and fixed the IAT all fine... but the dumped exe is over 1 MB and the packed file was only 33 kB. So I found empty spaces.
(Also dumped file works fine on Win XP)

My question is : How to remove that zero and create a valid exe...

I think (but isn't working or I did something wrong):

- remove bytes with Hex Editor
- change Raw Size (??? and Virtual Size ???) of section
- ??? change Size Of Image ???

If you know a good tutorial or if you want to tell me how to do it
thank you

MiniMind
dELTA
01-04-2004, 08:51 AM
If the zero bytes are at the end of some section, it is likely that you can remove them with a hex editor from the exe file. There will be a bunch of values to adjust in the PE header after this though, like e.g. the offsets pointing to all sections after the edited section, the raw size of the section (NOT the virtual size if these null bytes are used in any way by the program during runtime), all image size related values in the PE header etc. If you are lucky you can use some ready made "realigner" or "realignment" tool for PE files to perform most of these things though.
bart
01-04-2004, 08:52 AM
My question is : How to remove that zero and create a valid exe...

try to pack it with UPX, then unpack it with -d option :P, or use LordPE realign option, if you want to do it manually, look at the attached source
MiniMind
01-04-2004, 11:25 AM
Thanks

try to pack it with UPX, then unpack it with -d option :P

Didn't work... but seems to be a nice trick ;)

I wil try to understand c++ (usually programming Delphi, but nevermind)
code seems nice...

I'm working on it ->
Holiday is over :mad: and I'll have less time...

thanks dELTA for "confirming" and "improving" my thoughts


Tool to edit imported functions???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tool to edit imported functions???
PDA

View Full Version : Tool to edit imported functions???

yaa
01-04-2004, 02:56 PM
Hello,

is there a tool that allows editing of a PE file imported functions??? Specifically I'd need to be able to add missing functions.
Thx.

yaa
Kayaker
01-04-2004, 03:35 PM
IIDKing and Iczelion's Snippet Creator come to mind if I'm not mistaken.
UrgeOverKill
01-05-2004, 09:31 PM
check out hxxp:\\www.heaventools.com
disavowed
01-06-2004, 10:38 AM
check out hxxp:\\www.heaventools.com
seems like ida, resource hacker, and lordpe rolled into one, but much worse for the functionality of each :(


Change setting in application from external app.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Change setting in application from external app.
PDA

View Full Version : Change setting in application from external app.

Sunrise
01-04-2004, 05:37 PM
I'd like to be able to change a setting in an specific application without using the options dialog in which you'd normally change the setting. (I'd like to do it e.g. by sending a message to the application from my own program, or patching the code somehow or injecting a dll which calls the code or whatever)

How can I find the code that handles the processing of that setting/option (when it's set/changed through the options dialog)? And once I've found that code, how could I call and run that code? (wouldn't just simply want to change the eip would you? :D)

My observations so far: I've noticed that the option that I'm aiming at is read out by sending an WM_GETTEXT to the Editbox in the options dialog (no big surprise) But I couldn't find the processing routing by bpx'ing the WM_GETTEXT and then tracing through the code. (btw: who has sent that WM_GETTEXT message? was is the options dialog or the main window?)

Any tips for finding the code which retrieves the editbox contents and handles the further processing?

Thanks
JMI
01-04-2004, 06:02 PM
Sunrise: Perhaps you are being a bit vague/obtuse to conceal your real purpose and perhaps you simply haven't described it clearly. One would wonder WHY you might want to change a 'specific setting in an option dialog" from another program and/or inject code into it from another program, UNLESS you did not have access to the "option dialog" while in the program itself, because, if you had access, you could simply change it there, right? :p
So maybe you are approaching the problem from the wrong direction, or not describing that approach.

Assuming my assumption may be accurate, call it a leap of faith, have you considered approaching the problem from the side of whatever is preventing you from accessing the "options dialog" in the first place? Have you considered the likelihood that if the "option dialog" is not available for changing that simply "turning on" one of the options in the box itself, may not have the desired effect of activating that portion of the code, because the program itself never reaches it because it didn't make the branch at the "is registered" or "activate those options" portion of the main code?

Just food for thought. :cool:

Regards,
Sunrise
01-04-2004, 06:14 PM
Probably I have been vague. Since it it has nothing to do with registering an crippled program whatsoever. And I do have access to the options dialog. (In fact my first approach was find the application windowhandle (findwindow()), open the dialog (sendmessage), change the value in the editbox (settext) and press the OK button (wm_command). That worked, but I don't like it that way. The window popped up and I want to do it the 'hard and neat' way (read: lowlevel))

I just want to change that option (a text string) and have the program act as is normally would. What i'm trying to do may be considered as writing a plugin for a program. (program is free and not crippled) In fact, it IS a plugin! (it's only that the application doesn't support plugins, got it?) I try to take control over the application from the outside. Hope this makes it clear.
JMI
01-04-2004, 11:42 PM
Well that is more clear. ;)

I know it might not be elegant, but, have you considered a DOS .bat file? Your discussion suggests the program will be already running, so the bat file simply has to identify the proper program to effect, open the dialogue box and insert string and save. Or is that too "high tech" ?

Is your object simply to learn how to inject the code for general learning and future use or to simply get the change in this program in any way you can, with the least effort? Your responses will probably help some of our coders to help you accomplish your task because, on the surface, it doesn't sound too different from other code injection tasks.

That setting has to be stored in the program in some memory location and there has to be a routine for saving it in memory and for changing it and re-storing it. Have you search the code in memory to see if you can find your code in clear text? Have you searched for the strings from the dialog box in a disassembler to find the routines that operate the box? Seems that the approach would be similar to serial fishing efforts described in these forums. You want to catch the entry of new text in the input window and that should identify for you the where, in the code this is happening. So you run the debugger on the program whose option you want to change, set breakpoints on your text reading API's and make a change and see where the program breaks to get your text and where it puts it. That should help you figure out how to then replace that string in memory with your "new" information.
Then you can read up on injection of your own string into the memory space of the running program.

Hope this is helpful. It's all very generic at this point.

Regards,
Kayaker
01-04-2004, 11:58 PM
Hi

I think you've got the right idea, you just need to follow it a bit further. You say you can trace WM_GETTEXT up to a point then get lost as to what it's doing? That's probably exactly what you need to explore further, you need to get into and through the message handling routine and see what changes are being made. If the program writes something to the registry say or to an internal variable, then once you've figured out the precise changes to make you may be able to do that directly, say from an injected dll.

If you set a 'BMSG <hwnd> wm_gettext' you should be able to find the main message handler you'll need to trace through. The hwnd you need should be the main dialog window, though you may need to experiment in case it's subclassed or something. In Win2K, BMSG should break in kernel code which may look something like this:
Call CF0F8
jmp 41B448 -> exact start of main message handling routine.

In Win98 it's similar, BMSG should break in KernelAlloc at a PUSH statement, the address PUSHed again should be the start of the main message handling routine you're interested in.

If the BMSG trick doesn't work, you may also be able to find the message handler in a static disassembly, look for the presence of 111h (wm_command) or 0Dh (wm_gettext), etc. (it may not be that obvious). Once you find the start of the message handler (remember, this is the whole point!), you can set a conditional breakpoint so you will ONLY break on wm_gettext with your hwnd. Then you can carefully trace to see what the program does exactly on that message, and hopefully figure out a way to do it directly yourself.

Heh, I always seem to preach in these cases to "Find the main message handler and trace your message!", but in the majority of cases it's the easiest and most direct route, the 'front door'. Until you're comfortable doing this it's easy to get lost, but almost always it's straightforward if you keep watch for your parameters of hWnd, wParam, lParam and msg being handled. You should be able to find a single statement which says essentially "if msg = wm_gettext jump here", and you can analyze what the program does then to your hearts extent.

If you need more help, say so.

Kayaker

EDIT: I see JMI alluded to an API monitor. That's my second favorite preach :D Chances are that may be even more direct than tracing through the message handler. Pause the monitor until you press OK with the new text in your dialog box. That should be enough to give an indication what the program is eventually doing, plus give a few addresses to break on.
CluelessNoob
01-05-2004, 12:05 AM
Much like what JMI suggested, if the text is in plain view then probably the easiest way to modify it externally is using the WriteProcessMemory function.

It becomes almost trivial if the text is not encrypted and always in the same location. :D
Sunrise
01-05-2004, 11:11 AM
Thanks for your replies. Using the BMSG WM_SETTEXT method and tracing back to the caller, and some more tracing I have finally found a call which does all the processing/handling for that setting. The call accepts 2 parameters, one of those is the text read from the editbox. (pretty cool huh?) :) (the call contains large portions of code, don't even think about rewriting it! (As what you might do for e.g. a keygen)

So, what I'm going to try is to inject a DLL to the process which calls the call I just mentioned (with the proper params obviousely). It might take some time, but I think I'll manage to do that (never done something like injecting a dll). Anyway, any hints or info on this subject is always welcome). (I haven't searched this board yet, but I will do that soon. I might find all the info I need).
sope
01-06-2004, 01:16 AM
So, what I'm going to try is to inject a DLL to the process which calls the call I just mentioned (with the proper params obviousely). It might take some time, but I think I'll manage to do that (never done something like injecting a dll). Anyway, any hints or info on this subject is always welcome). (I haven't searched this board yet, but I will do that soon. I might find all the info I need).Try elicz's apihooks. hxxp://www.anticracking.sk/EliCZ/ has functions that will hook api's, inject dlls into another process space, call functions of injected dlls, etc.. etc..

Yoda also has a similiar library called forcelib you can get it at hxxp://y0da.cjb.net/

Lastly real stuff *worth* understanding by Yates hxxp://www.woodmann.net/yates/import.html

There are other ways to do this as well, but EliCZ and Y0das libs does a fine job.

Regards, Sope.


LINK: Windows Forensics: Have I been Hacked?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > LINK: Windows Forensics: Have I been Hacked?
PDA

View Full Version : LINK: Windows Forensics: Have I been Hacked?

Kayaker
01-05-2004, 11:49 PM
I thought this might be of interest to some

Windows Forensics: Have I been Hacked?
how to determine if your Windows NT, XP, or 2000 box is hacked and how you can go about cleaning up the files they may have left behind

http://www.snausage.com/tutorials/hibh.html

K.


Display Driver Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Display Driver Problem
PDA

View Full Version : Display Driver Problem

muzunnass
01-06-2004, 04:47 AM
I have setup on my pc Compuware SoftICE Driver Suite 3.0. My operating sytem is WinXP, Display driver Intel 82845G/GL and monitor is Compaq TFT.

Softice is starting, but after CTRL+D, there is a very image on upper left corner on the screen. How should set up video driver?

Thx in advance
UrgeOverKill
01-06-2004, 08:43 PM
Depending on your chipset, your card might not be compatible with XP. This particular card can be a bugger to set up. Contact the web site for the latest upgrade.
esther
01-06-2004, 10:12 PM
Try using older cards like s3. Softice likes older gfx cards :p
quetzalcoatl
01-07-2004, 10:45 AM
Sorry for asking, but what do you mean by 'very image'? I'm not native english speaker. small ? distorted? maybe just you have lines=xx/columns=yy in winice.dat set for too low values? :>

If its not that, jump at once to www.compuware.com, go to section support->knowledgebase or support->whitepapers and search there for 'intel'.
there were several things about Intel cards, and if i remember well 90% of them were about simply adding dword "DoInt2DPatch"=1 value in the registry.
that is, in the HKLM\System\Services\NTice. but check there, because there were also other values that could be set like "Int2DLocation" or "Int2DRVA" and now i don't remember for what card they were (i think for ATI Rage, but they also refer to video problems, and may work somehow:) ).


FlexLm Vendor Deamon Cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLm Vendor Deamon Cracking
PDA

View Full Version : FlexLm Vendor Deamon Cracking

+g3x
01-06-2004, 09:07 AM
Hi,
I have one program named Euclid. This program is protected with FlexLm V 6.0. I cracked this program in one different from all described way. I just foud all the checks inside vendor deamon and disabled them all. And now the vendor deamon is working just fine with all my fake license keys. The only now is the key must be 20 digits long. Whatever i type in the license file is working perfect. For example FEATURE My_Feature pleased inside the license file is accepted by vendor deamon. Offcourse this feature is not needed by euclid, but if i found other program using FlexLm, and I edit the license file, so it points to my vendor deamon, will this mean that the licensed program will work ?
I'm asking because I don't have other programs licensed with FlexLM to make experiments and I'm vary curious to check that.
Nebob
02-05-2004, 06:08 PM
No, each program has its own vendor daemon.


IncrediMail Upgrade Message
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > IncrediMail Upgrade Message
PDA

View Full Version : IncrediMail Upgrade Message

MaRKuS-DJM
01-06-2004, 02:32 PM
My target is IncrediMail for month now. i've successfully killed the license-checking, the illegal use message & the other limitations. but there's still this upgrade message (upgrading can't be disabled and must! be done by the program). i know which code it is executing & what it does. but there's no way to find the caller!!!

all dll's from incredimail communicates within the program, and debugging doesn't work (i don't know why, breakpoints in dlls doesn't work)

the main window is freezed by GetImActiveWindow and then the message appears.

for the upgrade message, use this imsl.dat file

i tried it for month with no success


Help! Random reboot using SoftICE for WinXP!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Help! Random reboot using SoftICE for WinXP!
PDA

View Full Version : Help! Random reboot using SoftICE for WinXP!

Moddie
01-06-2004, 02:32 PM
Im using SoftICE v4.2.7 (DriverStudio 2.7) and im using WinXP SP1.
SoftICE works ok, breakpoints works etc, but sometimes my computer just reboots, showing a bluescreen very fast and then just reboots.

I have also tried to use SoftICE v4.05 for WinNT with WinXP with the XP patches and I have the same problem with that version.

Also the same problem appears when i use WinXP without SP1.

I have set up so i have to load SoftICE manually when i want to use it, but even if i have not loaded softice it can reboot my computer. but i guess it's becuase SIWVID is loaded during startup of the pc.

Anyway, is there someone who have the same problem or have a clue what's going on because i don't want to switch to Win98 to be able to use SoftICE.

Some specs about my computer:

OS: Windows XP SP1 Swedish
GFX: Nvidia GeForce2 MX-400
CPU: AMD Athlon XP 2400

Regards
Moddie
MiniMind
01-06-2004, 02:59 PM
Im using SoftICE v4.2.7 (DriverStudio 2.7) and im using WinXP SP1.

I don't know anything about your problem, but you can try to buy or get DriverStudio 3.0. It works fine on XP newest... :)

MiniMind
Moddie
01-06-2004, 03:28 PM
I have tried that one too... same problem.
quetzalcoatl
01-06-2004, 04:21 PM
eh.. SIWVID MUST be loaded at startup, if you ever plan to see SI on the screen. this driver is meant to copy and manage screen while SI is displayed (that is, catch the screen, remember it, and display on it whatever SI wants)

if you do see BSoD for only an instant, that possibly means that you didn't turn off "restart on critical fairlue" option in XP. go to MyComputer->Properties->Advanced->Startup&Recovery and deselect the "Automatically restart" option. Now if you see BSoD, try to remember/or write what significant it does say.

Also, if you please, tell us what 'artifacts' in system behaviour you notice, if any ie. erratic mouse, keyboard misinterpreting keys, applications closing with error or not closing at all even if you order it etc.

You could read my thread about 3small or 1big problem with SI, also. There are some (my) problems described, and in the end it turned out that SI did'nt like one driver installed with software firewall, which just like SI was loaded at startup and strange things did happen :D

If you still have DS3.0 install it. Usually new software is less buggy :P Once you install it, obtain service pack v2 for DSthree-zero's. It is the file DS30SP2 available for free (!) in the support->DS/Softice->patches panel at www.compuware.com. and install it ofcourse :)

There is also biiig knowledgebase sections above 'patches', which you could read and try to find something near (however i digged through it completely back then, and now i don;t recall anything similar).

Next thing - maybe just you have set up, or didn't set up at all the VideoMemory setting, hm? as i said, SI backs up whole screen, and therefore it must have place allocated to do it.. it must be AT LEAST your_horiz_res*vert_res*4B ie. for 1024x768 it will be around 3.5MB. it is good to have a little above, but NO above your available video memory at your graphic board. [4B cames from 32bit colours. if you have less, you can lower the 4B ...but what for..]

you can also try disconnecting USB devices...

if you manage to start SI , get out of it at once and run:
I:\SoftICE\nmsym /log:log.txt
(change the path, leave filename :P )
this will dump SI's history log. open it, and search for any errors, ie i have had an error during loading NETMSG module.. blah.. you can read more about it in my thread, i don't want to write it all once again :P

well, that's for now.
peterg70
01-06-2004, 04:23 PM
There is an option in WindowsXP to pause of BSOD rather than rebooting. Find it change it and see what sort of error you are getting.

That should point you to the culprit

To disable this feature, open System Properties by right clicking on My Computer and selecting Properties. Alternatively you can hold down the Windows key on your keyboard and press Pause/Break.

Once you have System Properties open click on the Advanced tab, then click on the Startup and Recovery button at the bottom. When the Startup and Recovery panel opens simply uncheck Automatically Reboot.

Then Read this to help out
http://www.microsoft.com/technet/treeview/default.asp?url=/TechNet/prodtechnol/winntas/tips/techrep/bsod.asp

peterg70
dELTA
01-06-2004, 06:15 PM
Here is a link to the thread that quetzalcoatl mentions above, for the people who are too lazy to go look for it themselves:

http://www.woodmann.net/forum/showthread.php?t=5335

:rolleyes:
Moddie
01-06-2004, 06:23 PM
Thanks all for trying to help me, i will try out all stuff you told me.

I got no probs to load softice at all, it runs fine, but after some debugging windows just reboots when im in windows (not in softice).

Oh and no other apps behave strange or so.
I have attached a little pic of the BSOD now, well, the text is in swedish and it doesn't give much info except maybe one thing, well check it out.

Will also try to update with the SP2 and see if it does the trick... i bet not ;(
Moddie
01-06-2004, 07:28 PM
Oh and where it says IRQL_NOT_LESS_OR_EQUAL it also say: PAGE_FAULT_IN_NONPAGED_AREA sometimes, it did right now when i had faults on in softice.

If i have faults on in softice i can see softice displays:

Break due to KeBugCheckEx (Unhandled kernel mode exception)
Error=50 (PAGE_FAULT_IN_NONPAGED_AREA) P1=FFAF7ECC P2=0 P3=F433FB94 P4=0

Dunno if this will help me anything tho...
dELTA
01-06-2004, 07:56 PM
Are you completely sure it has anything to do with Softice at all? The specific error type on your bluescreen is common e.g. when there is something wrong with the ram memory of the computer. I got bluescreens exactly like that (even in the same language actually :p) just after I had bought my new computer. It is a dual DDR400 bus rig, and these are very sensitive for timing issues with the ram memories, the makers of the motherboards often even have lists of approved memories for each of their motherboards on their websites. I had to switch from Kingston memories to original Samsung memories, and after that these errors disappeared, just like expected. If this is the problem for you, the bluescreens could come up at any time, but still quite rarely, just enough to make you suspect other sources of error (like e.g. the good old patsy Softice :)).

I'd suggest you uninstall softice completely, and then use the computer for a week or so, to see if you get any blue screen anyway, and after that we can start slapping Softice around again if the bluescreens seem to have completely disappeared. :D

If anyone has any deeper insterest in what the bluescreen says, here's a brief translation of it:

An error occurred and Windows has been shut down to prevent problems with your computer.

IRQL_NOT_LESS_OR_EQUAL

<lots of crap about verifying the correct installation and functionality of any new hardware in the computer, and trying to remove any new hardware to see if it helps>

Technical information:

*** STOP: 0x0000000A (0x20E100F0, 0x000000FF, 0x00000000, 0x804ECA4D)

Beginning dumping of physical memory.
Dumping complete. Please contact your system administrator or your local reversing messageboard. If all else fails, blame Softice. :D
JMI
01-07-2004, 03:54 AM
Well thank God there is finally someone here who can actually speak dELTA's language. dELTA, you should show him a picture of your print screen shots, just to make everybody enviousl. :D :cool: Yes, he, dELTA, does have one humongous "monitor" to view his vBulletin. ;)

Regards,
TQN
01-07-2004, 05:45 AM
Hi Moddie !
Sorry for my bad English skill. You can try this way. Open DriverStudio Configuration program, at SoftIce Initialization sub key, General - uncheck "Trap NMI", Troubleshooting - uncheck "Disable mapping of non-present pages".
Hope this way will help you to solve your problem
Good luck !
TQN
quetzalcoatl
01-07-2004, 11:23 AM
Hi Moddie !
uncheck "Trap NMI", Troubleshooting - uncheck "Disable mapping of non-TQN

Disabling NMI trapping will solve one thing - if the error occurs SI won't catch it just before system crash :P

Disabling mapping on non-paged.. well i think it could have some effect, and i would try it :) but if it doesn't work, and computer will still be crashing, well..

irq_not_less_or_equal - i have seen this error on my comp twice. first time when sound card driver was in conflict with modem's sound driver (i don't know neither why nor how it could happen. non-plug&play maybe they were..)
the second time was when my disk 'catched' some new bad sectors, right in the place occupied by some very_important_system_file, and at each reboot i saw either this error, or that about fault_in_non_paged.
due to M$ that last error may occur only (heh) in two cases: damaged virtual memory (swap file built on bad sectors) or damaged ram.

so i would try this if SI config fails:
[after each point, rebooot and check before next. each next point is more 'radical' and will more interfere with things you have on the system, therefore i suggest that you try any other thing before removing/uninstalling etc and try it only when you are desperate enough]
*) the very first thing is to obtain valid OSINFO.DAT and put it into windows\sytem32\driver directory. checkout last posts in the thread 3SmallProblemsOr1BigProblemWithSoftice - there is a link to the file i have found to be the newest.
*) reboot, go into BIOS setting, turn off "Disable RAM checking" or "FastBoot" or whatever - just force the BIOS to do a full test of ram. if after the test there will be an error or the amount of available ram will not be qual to what should be (ie. you have 256MB and BIOS says that you have 262128KB - 16KB missing) - remove the damaged unit.
*) remove all the RAM from computer. for each unit, insert only one not checked yet and try out if system fails again. if system fails ON ALL OF THEM, that means that is not the source of problem OR all of them are damaged (not probable, unless you have kicked the mainboard or have heavy spikes in the power..)
if it's not the ram you can try to scan your system and cache partitions for bad sectors, but due to that new, beautiful scandisk in XP you won't get any msg even if it finds any...
*) being in windows, DONT start SI (that would also mean you will have to disable its startup modes: 'boot', 'automatically' and 'system') simply LEAVE the WinXP running for ie. 6h. if it'll crash again - well.. you will have to proceed to next point or try uninstalling everything what could have installed a system service or driver..
*) try unplugging (not just disabling!) or removing one-by-one each not critical device you have. that is: sound cards, modems, network cards, and anything different that VideoBoard and HDD with OS.
*) if it won't run on minimal hardware configuration, and you have uninstaled everything that would have more that 0.1% chance of including a driver or system service, the only thing is to format system and cache partions, and make CLEAN OS installation. without ANYTHING. run it. if it crashes before installation is complete ie. during one of the several reboots needed, that means the hardrive has badsectors in vital places, sorry to say but it has to be replaced. if it crashes after successful instalation - try again that thing with removing devices - by that you will either isolate the 'bad' device, or you will remove everything .. then either disk, Bios, ram or CPU are damaged.
if it will run witout any error though, install SI, reboot and check again. pray that it wont crash :) if it does, forget at least about that version (DS3.0), and also probably earlier...

[edited: only fixed some grammar/spelling mistakes :) ]
dELTA
01-07-2004, 11:30 AM
*) reboot, go into BIOS setting, turn off "Disable RAM checking" or "FastBoot" or whatever - just force the BIOS to do a full test of ram. if after testing there will be an error or the amount of available ram will not be qual to what should be (ie. you have 256MB and BIOS says that you have 262128KB - 16KB missing) - remove the damaged unit.
*) remove all the RAM from computer. for each unit, insert only one not checked yet and try out if system fails again. if system fails ON ALL OF THEM, that means that is not the source of problem OR all of them are damaged (not probable, unless you have kicked the mainboard or have heavy spikes in the power..)
if it's not ther ram you can try to scan your system and cache partitions for bad sectors, but due to that new, beautiful scandisk in XP you won't get any msg even if it founds any...

Also, again, consider the memory timing problem possibility I mentioned above. Memory/motherboard combinations with this problem might very well pass a memory test just fine, but then at seldom occasions there might still be an unfortunate bit error that will bluescreen your computer with just that error message. Try to get info about approved memory modules for your motherboard model, from your motherboard manufacturer's website.
Moddie
01-09-2004, 08:06 PM
Tried most stuff of what you guys told me, except for the memory, will remove one and see if it still crashes...

I think something is fucked with them acually...
The Osinfo.dat from the other post just fucked it up more, now my computer crashes ad displays a BSOD as soon as i load softice (manually) ... softice displays API Hooking Error and the other KeBugCheckEx error...

Moddie
Woodmann
01-09-2004, 11:20 PM
Howdy,

I wish I could be the only person on this place to understand
the Swedish language :p
I shall say no more :D

Woodmann
esther
01-10-2004, 11:56 AM
It could anything that causes reboot,check your hardware before blaming softice.

Regarding about language I think theres's no communication error :D
chlankboot
01-12-2004, 12:17 PM
hi all,
i had the same problem with my machine, i tried all the versions availables of ice, and i can tell u that i was in the wrong way because the cause (of my problem) was a toooo stupid.
in fact, one day, norton diagnose tool alerted me that i have a problem with some address in memory, after many tries to find a soft solution i decided to remove and replce the 128Mb barette off my mothercard and BINGO i've never encountred that problem.
so i suggest u to make a try, it may be physical
JMI
01-12-2004, 01:00 PM
Hum...... Isn't that what dELTA suggested??? :cool:

Regards,
quetzalcoatl
01-12-2004, 08:14 PM
dELTA ? hmm... well it seems that he was faster than me :)

KeBugCheckEx, i belive stands for Kernel(De)BugCheckEx so you do have a problem if SI cannot hook into it Mwaaahahaha... (sorry..)

if removing damaged-could-be units won't do the trick, play awhile with SI settings (video driver, video memory, USB on/off, mouse on/off) still having 'newer' OSINFO. it could also help to obtain 'newer' OSINFOB.dat (it is somewhere at compuware's knowledgeb.) and play again with settings..

well.. as you see my ideas are near to be depleted.. its quite hard to guess without 'seeing' it and trying myself :)


Crypto crackme: Rijndael
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Crypto crackme: Rijndael
PDA

View Full Version : Crypto crackme: Rijndael

lordor
01-07-2004, 04:12 AM
This is very simple crackme,use some cryptography arihmetic.I hope you can learn something from this crackme.If you register succeeded,you will see a picture.

lordor
1.7
ZaiRoN
01-08-2004, 02:54 PM
Hi lordor,
nice to see another crackme from you, thx :-)

The crackme wants a code/serial combination to be registered. The code box is already filled with a value obtained by this simple operation:
(Volume_Serial_Number xor 0xABCDE123) / 4

The serial box is not filled and it's another story...
I don't have solved it yet but, stepping a little through the program I notice that Rijndael algo is used. You can found a lot of informations about this block cipher at http://www.esat.kuleuven.ac.be/~rijmen/rijndael/
There are also some threads in this forum speaking about Rijndael, a simple search will lead you to this threads.

Back to the crackme. The code and the serial are both read at the beginning of the protection routine; after that there is a suspicious call:
00401286 PUSH crackme.0040E304 ; Arg2 = 0040E304 -> empty buffer
0040128B PUSH crackme.0040E374 ; Arg1 = 0040E374 -> the serial you have typed
00401290 LEA ECX,DWORD PTR SS:[ESP+24]
00401294 CALL crackme.004023B0
This call fills the buffer pointed by 40E304 with 16 bytes. The call encrypts the serial using Rijndael algo with 128 bit Key equals to:
0x01 0x03 0x05 0x07 0x09 0x01 0x02 0x06 0x07 0x08 0x09 0x00 0x07 0x03 0x07 0x08
How can I understand this fact? Well, there is not a specific rule to understand which algo is used but there are some facts that can guide you through the identification process. I.e. the initial xor between the key and the serial that produces 4 dword, the fact that these dword are used and changed in the next 9 rounds cycle, the 128 bit return value and so on...; little things all together.
Obviously, to be sure about the use of the rijndael algo I have tested the serial/key with my own rijndael simulation program, trying to verify my idea. If you are too lazy to write some lines in c (or in your preferred language) you can use a nice tool called CrypTool available from http://www.cryptool.com/
It does contains the implementations of the most common algos and it might help you in these cases.

After this algo and before the final check there is another call:
004012B9 PUSH crackme.0040E374 ; 40E374 points to an empty buffer
004012BE PUSH crackme.0040E304 ; 40E304 points to a string obtained from the mix
; of the serial and the rijndael returned bytes
004012C3 LEA ECX,DWORD PTR SS:[ESP+24]
004012C7 STOS WORD PTR ES:[EDI]
004012C9 CALL crackme.004026B0
Even this call seems to be another Rijndael algo; the call is *very* similar to the previous one and the key should be:
0x53 0xDD 0xFA 0x1A 0x2B 0x11 0xC5 0x75 0x38 0xC1 0xAE 0x8D 0xA5 0x0D 0x58 0x11
Unfortunately, this is not true or (maybe) I drown in a inch of water...

Is there someone that is working on this crackme that can help me?

ciao,
ZaiRoN
NeO
01-12-2004, 08:41 AM
All what you found out is right as alwasy...:P
The crypto calls are the same only the key is different.

But the main problem is how to get pass this :

.text:004012DB jnz short loc_4012D6
.text:004012DD mov cl, byte_40E374
.text:004012E3 sub eax, edx
.text:004012E5 cmp cl, 30h
.text:004012E8 jnz loc_4013B1
.text:004012EE cmp byte_40E373[eax], 3Dh
.text:004012F5 jnz loc_4013B1
.text:004012FB cmp eax, 10h
.text:004012FE jnz loc_4013B1
.text:00401304 mov edx, dword_40E379

bye NeO
ZaiRoN
01-13-2004, 05:55 AM
Hi NeO,The crypto calls are the same only the key is different.Ok, you are right but it's not totally true. The call implements Rijndael algo but this time it decrypts the text using the same key used in the previous Rijndael call.
This is the structure of the main protection routine:
key = 0x01 0x03 0x05 0x07 0x09 0x01 0x02 0x06 0x07 0x08 0x09 0x00 0x07 0x03 0x07 0x08

Rijndael_encrypt(serial, key) = r1
r1 and serial are mixed using the call at 4012A3; rm1 is the result
Rijndael_decrypt(rm1, key) = r2
final_check...Part of the final check was posted by Ne0; as you can see the first byte of r2 must be 0x30 and the last byte (the 16°) must be 0x03D. r2 has to satisfy another rule:
00401304 MOV EDX,DWORD PTR DS:[40E379] <-- edx takes char number 6,7,8 and 9 from r2
...
00401325 MOV DWORD PTR DS:[40E308],EDX <-- move them
0040132B MOV DL,BYTE PTR DS:[40E340] <-- dl = the first char of the code in hex format
...
00401336 CMP DL,BYTE PTR DS:[40E308] <-- char number 6 from r2 must be equal to dl
...
00401350 JNZ SHORT crackme.004013B1 <-- jump to error if not equals, otherwise: registered

That's all! Who wants to write the keygen? ;-)

ZaiRoN
NeO
01-13-2004, 05:15 PM
Hello all ..

I think you need to write bruter for this...if there is any other way let me know :P

Hint:use serial_lenght 16 bytes(32letters)

Bye NeO
ZaiRoN
01-14-2004, 05:08 PM
Hi Ne0,
you should be right, at the moment I can only see the brute force approach.

For those whom wants to try, here is one of the many implementations that I found on the net:
ftp://ftp.compapp.dcu.ie/pub/crypto/rijndael.c
In order to use it, you only need to modify the 'main' procedure, in particular to apply Rijndael you need to call these functions:
gentables(); // No params...
gkey(int,int,char *); // For Rijndael 128bit you have to pass 4 and 4 as
// for the first 2 params; the 3° param is the key
and then one of:
encrypt(char *); // Encrypts text passed as (char *)
decrypt(char *); // Decrypts text passed as (char *)

Good luck!

ZaiRoN
yaa
05-14-2004, 05:23 PM
Has anyone still got this crackme. The link points nowhere.

yaa
klier
05-15-2004, 10:17 AM
link works for me
Regards,
lordor
05-16-2004, 11:09 PM
I have update the attaching file
schar
05-17-2004, 12:05 AM
I have update the attaching file
Code: 299068997
Key:9610BE12D6E4132827705794F435CF8C

pop up a box but no pics.
lordor
05-17-2004, 12:15 AM
Code: 299068997
Key:9610BE12D6E4132827705794F435CF8C

pop up a box but no pics.

please see the showing pics's code again
or bpm the reg code,that will take some byte to cmp
schar
05-17-2004, 12:39 AM
please see the showing pics's code again
or bpm the reg code,that will take some byte to cmp

this one works:
Code: 299068997
Key: 10F8C2C958F2076FD2C46F67D89FB319

lots of milk :p


tElock 0.98b1 -> tE! Unpack Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > tElock 0.98b1 -> tE! Unpack Problem
PDA

View Full Version : tElock 0.98b1 -> tE! Unpack Problem

evn
01-07-2004, 08:17 AM
PEiD tells me that the target is (definately) "tElock 0.98b1 -> tE!", and as such i have, for a while now, been trying to unpack it.

From what i've seen, it doesn't look like it is telock at all, and is a pain-in-the-ass to dump, and just as difficult to debug.

Before the unpacking code goes into play, the assembly looks like this:

00401000 06 DB 06
00401001 15 DB 15
00401002 43 DB 43 ; CHAR 'C'
00401003 33 DB 33 ; CHAR '3'
00401004 56 DB 56 ; CHAR 'V'
00401005 B9 DB B9
00401006 05 DB 05
00401007 05 DB 05
00401008 BC DB BC
00401009 F3 DB F3
0040100A 53 DB 53 ; CHAR 'S'

With scattered code throughout.

And once the unpacking is complete, it is completly replaced with working code and all strings and references are complete.

The entrypoint is: 11BD6

It has anti-debug, anti breakpoint and crc checking, which makes a lot of it a pain. When loading it in ollydbg, 2 'unpassable' commands are executed, which can be stepped into with the 'step into' command. The application then loads fine.

Dumping the file with ollydump (latest version has IAT rebuilding, not sure if it works with telock) leaves me with a corrupt PE file, which cannot be repaired with anything. Im assuming that i have the OEP completely wrong, as without breakpoints i can't easily find it.

The checks for the CRC and Softice are executed after (non-original application) code has been unpacked, so patching is a huge problem here. Any patch that is applied is overwritten by the code itself, and any changes to the unpacking code cause problems with the entire application.

At the end of the (unpacked) application are hundreds of DB 00 lines, which i've searched for in an attempt to discover if the file is legitimately telock, which hit no results.

The question(s) i have are short, and the above information may help in answering them.

1) Does the file <look> like it is telock? I haven't had any experience with anything from 0.98+ and can't find any documentation which conclusively proves if it is or is not.

2) Is there a way to mask the exe protector used? ie. Make scanners detect asprotect as upx, or otherwise?

3) Are there any tools that detect anti-softice tricks that work with windows 2000? I checked and the only results were old tools for 9x systems.

4) Any suggestions as to how i would unpack telock 0.98b1 and rebuild the IAT? I read here that telock scrambles parts and they need to be repaired, but as of yet no tool has worked and that may be the reason my dumps are incomplete.

5) Are there any tools that can find the OEP of a packed executable (telock) without using softice? I can't skip the softice protection at this time so i can't use tools that require it.

Thanks in advance.
MaRKuS-DJM
01-07-2004, 08:46 AM
hm... analysis of packed code is not good :( have you tried the OEP-finder from peid? and for imports, there's a plugin for telock. which program is it?

i attached it
evn
01-07-2004, 09:28 AM
have you tried the OEP-finder from peid?

Never knew that existed. Thanks.

Just tried, no OEP found.

and for imports, there's a plugin for telock.

What is this plugin for? PEiD doesn't load it, so ?

which program is it?

I was under the impression that target specific questions were off limits, but eh, i'm not doing this to try to crack a program, merely to get a better understanding of how more advanced packing techniques function.

The application is @ hxxp://www.mousepad-d2.com

I'm trying to unpack the loader (d2maphack.exe) and not the dll that contains all of the functionality. I was referred to it because apparantly the author claimed that it took him months to get it as secure as possible, and it sounded like a dare to me ;)

Also, the section names change on a per-version basis, so im thinking that maybe he is trying to (or has) masked the protection. PEiD always detects it as telock, though.
MaRKuS-DJM
01-07-2004, 09:38 AM
oh sorry! that plugin is for ImportRec. forgot it to say. should fix all imports.
evn
01-07-2004, 09:49 AM
Tried the dll with imprec just after i posted, all i get is 'FAILED' repeatedly. Maybe i was right about this file not being telock.

EDIT: When using trace level3, without telock dll, it successfully resolves some of the imports, others hang imprec, crash the application im scanning, and require you to restart the scan. If i understand correctly telock files wouldn't resolve any without the dll?
MaRKuS-DJM
01-07-2004, 10:54 AM
If i understand correctly telock files wouldn't resolve any without the dll?

yes, you are right... but if this dll doesn't work... maybe it's newer version of telock? retool also says it's telock. i tried to skip the window who says crc-error... but then it doesn't unpack
evn
01-07-2004, 11:15 AM
I don't think its telock at all, it might well be a homemade creation by the author and friends (who happen to know more than enough about cracking themselves).

I tried to step through the unpacking code but it gets painful after a few repetitions, seems like it writes its code on-the-fly, then jumps to the newly written code and overwrites the original, unpacking a few proper lines per pass. Even tracing it proved fruitless as the code changes so often that commenting an address is only valid *at that moment*. Commenting and reading through later just ends up with overwritten comments and only documentation of the final pass.

In the end i think every single line was changed at least once.
MaRKuS-DJM
01-07-2004, 11:19 AM
i tried it long time and i came to no result. if you change in olly the code (i tried to kill the message-box which shows crc-error) the unpacking-routine completely changes (all red in olly) and it doesn't unpack correct. i think this is a target for an unpacking-expert like britedream (exetools forum)
evn
01-07-2004, 06:49 PM
I definately set my sights higher than i could reach with this one. Guess i'll have to read up on it a bit more or find some ways to modify the code without corrupting the dependant algorithms.

Thanks for the help.
evaluator
01-08-2004, 02:39 PM
well, guys, i downloaded d2maphack_61b.zip & EXEs are packed by tElock.
So, somewhere here I wrote easy way for MANUAL dumping-unpaking tElock.
...
using automating-rebuilders not upgrades your knowlidge.
So i recommend you: learn howto manually doing all.
...
if you very need this prog unpaked(for better future of world),
i can do it for you.
evn
01-09-2004, 06:37 AM
I tried following your 'easy' telock unpack method, but i didn't understand parts of it (might be my lack of competant debugger knowledge, or some dubious wording, i'm not sure).

Anyway, i managed to unpack it a lot easier than i first expected it to be.

Steps i took were:

1. Use ollydump to dump the file after the program had fully loaded.
2. Used imprec with the following settings:
- Creat new IAT
- Level 3 (Dumb Mode)

This repaired the IAT to working condition.

4. Modified the OEP to a value that ollydbg broke on second (no bp's set).

00411BD6 > $^E9 25E4FFFF JMP d2maphac.00410000

All unpacked and runs fine.

I'm still not convinced this was a telock file, as the telock plugin for imprec failed totally at repairing (or even finding) the imports. If anyone else has a telock .98 file they need to unpack (or have before?) that you know for certain is a telock file, can you please try what i tried and report back on its success?

Thanks for all the help.
evaluator
01-09-2004, 09:24 AM
on what point you have truble, when tried in my way?
evn
01-09-2004, 12:12 PM
I assume that this is the easy method that you posted, it is the only complete one i could find on the forum:

Quick tutor for tElock dumping:
1. Load program in debugger
2. tape in debugger:
"U VirtualFree"
3. set BPX on 2-3 instruction below "VirtualFree"
4. each time debugger breaks, dump prog.
5. in one dump SURE you will have original ImportTable.
6. you need to determine in dump Address & SIZE of IT & enter it in LordPE.
7. OEP you can determine by JUMP instruction at loader section start in dumped image from running task.
8. LordpPE using: Always use "Correct Image Size" option before dumping.

I've never been an avid user of softice, so a lot of this is foreign to me.

I'm assuming that to load the executable into softice i use the symbol loader, because just running the app doesn't give a chance to debug it's startup ;P

Have the commands for doing this changed in ds 2.7 and 3.0, because no matter what i try i always end up with problems.

Step 4, what method should i use to dump? I'm on windows2k so icedump doesn't work, should i "a; jmp eip" then dump using lordpe? I tried using iceext but that was only partially dumping no matter what settings i used.
[edit] yes, a; jmp eip is a stupid idea, as it would lock the kernel.

Step 6, enter it where in lordpe? What exactly am i doing at this stage?

Step 7, i'm not sure what you mean by 'loader section start'.

On second glance, its more my misunderstanding of softice technicalities than your description, but of course any pointers would be helpful to me. Im about to grab some total beginners softice docs and check through them.

-evn
evaluator
01-09-2004, 05:31 PM
well:(

maybe if you will firstly try learn LordPE,
so it quick enlarges your knowlidge about many things!?
evn
01-10-2004, 01:53 AM
I actually know how to use LordPE, my query was more of a "ok so i've dumped the import table, but haven't dumped the unpacked code yet. What exactly am i editing in LordPE". I didn't know that it would dump both the original IT and the unpacked code, if this is what it does? In that case, i'd be editing the IT values of the dump i made?

I thought the import table would need to be fixed after a complete dump, but the steps you outlined omit some parts i thought would be critical.


OSX cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > OSX cracking
PDA

View Full Version : OSX cracking

theraptureback
01-07-2004, 06:23 PM
can any1 show me a good way to MAC OSX cracking ?
what debugger,dissasembler...etc can i use...?
any link?
thnx in advance :DD

/// 8 \\\
THe_RaPTURe__
/// 8 \\\_____
___________________
AzynchriX
01-07-2004, 08:50 PM
IDA pro will open [pef] (Mac OS) and in your case [mach-o] for OSX + check developers tools that come with OSX.
Thigo
01-11-2004, 08:30 AM
Unfortunately, ida < 4.51 is buggy and sometimes (90%) crashes on OSX files ...


laserlok
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > laserlok
PDA

View Full Version : laserlok

Hatem Al-Naggar
01-08-2004, 01:12 PM
I have a game that uses laserlok
The CD must be present
Does any 1 know where can I find a program to remove the protection
And if there is no such program where can I find a tutorial to teach me
Thanks
JMI
01-08-2004, 02:19 PM
How about you follow the forum rules and use the search function before you ask a question. There is a search button on the top of each of the forums. Use that box and write "laserlok" and you will find threads to review. Also try your favorite search engine and try "laserlok + cracking" and you should find turotials. You need to do some of the work yourself. Do your homework and then come back with a specific question.

Regards,
krkr
01-24-2004, 10:40 AM
well mr hatem a quick answer from egypt try using daemon tools ver 3.41
make a copy of hte disk using clonecd then activate daemon tools laserlock emulation and run ur cd
krkr
01-24-2004, 10:50 AM
also try this
http://66.79.189.75//games/f5588/ll32ica.zip

http://66.79.179.15//games/f5588/ucflli01.zip
[NtSC]
01-25-2004, 05:57 PM
also try this
http://66.79.189.75//games/f5588/ll32ica.zip

http://66.79.179.15//games/f5588/ucflli01.zip

wont work on newest laserlock marathon ;-)
evlncrn8
01-25-2004, 11:26 PM
']wont work on newest laserlock marathon ;-)

newest laserlok marathon isnt that much of a change from the old one ;)
[NtSC]
01-26-2004, 05:06 AM
Obviously the Tools are for LaserLock v5 Versions and not for the SPEenc Packed ones,so using the Tools may not work anyway.

Would be interesting to know wich Game he has,thus a rough guess on the used Version can be made ;-)
evlncrn8
01-26-2004, 02:48 PM
']Obviously the Tools are for LaserLock v5 Versions and not for the SPEenc Packed ones,so using the Tools may not work anyway.

Would be interesting to know wich Game he has,thus a rough guess on the used Version can be made ;-)

isnt the speenc shit part of laserlok?
doug
01-26-2004, 07:11 PM
hasn't always been there.

and I believe the tools pointed out by krkr were coded when there was no speenc.
[NtSC]
01-27-2004, 07:30 AM
hasn't always been there.

and I believe the tools pointed out by krkr were coded when there was no speenc.

Indeed,Doug is right.
The Tools were done for very old Versions that had just Calls/Jumps redirect to the Laserlock Dll. The Code Section wasnt touched beside the Opcode mangeling of those 2 Instructions.

With SPeenc v1,v2,v3 they invented also partly packing&crypting (beside some new Addons on each new Version)

Question is.. What Version is used on his Game :P

Usually theres some Info placed in the Pe, that shows atleast the SPEenc Version
sLayer
02-20-2004, 01:56 AM
Dissassemble the file.
Search for "getdrivetypea"Must be somewhere in kernel 32 functions
Then do u see a call and a cmp with 0005.
0005 refers to cd drive and 0003 refers to hard drive.
So change 0005 to 0003 and the prog will run without any
cd check.
Or another solution would be to just change a "Je" "jne" "call"

Hope this helps
Laterz
:D
evlncrn8
02-20-2004, 02:18 AM
Dissassemble the file.
Search for "getdrivetypea"Must be somewhere in kernel 32 functions
Then do u see a call and a cmp with 0005.
0005 refers to cd drive and 0003 refers to hard drive.
So change 0005 to 0003 and the prog will run without any
cd check.
Or another solution would be to just change a "Je" "jne" "call"

Hope this helps
Laterz
:D

in laserlok... ? really.. something tells me you dont know wtf we're talking about
[NtSC]
02-20-2004, 12:52 PM
in laserlok... ? really.. something tells me you dont know wtf we're talking about

Indeed evlncrn8!
If it would be that easy,it would be a nice thing :p
sLayer
02-22-2004, 01:28 PM
Thanx for reminding me evlncrn8
I thought we were discussing about removing cd checks
Laterz
:p :D


VB hex values for jumps and thier functions please?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VB hex values for jumps and thier functions please?
PDA

View Full Version : VB hex values for jumps and thier functions please?

CrAcKaHoLiC
01-08-2004, 08:36 PM
Yes, I am a newbie and I am unsure of the exact terminology but the values 90, E9 and others are what I am asking about. I would like to get a table of all useable values and thier functions or explanation of proper usage guidelines. Does anyone have a link to such information or could you share your knowlege?

I am using W32dasm and a hex editor to get past registration and nag screens. I find the proper MOVs, CMPs and Jumps but I am unsure of the values to use in the offset to force the jump always. Thanks
naides
01-08-2004, 09:57 PM
Several options:

Find HIEW, which is a hex editor. It has an assemble option, so what you write in assembly, i.e jmp 00456789 gets translated into the proper bytes E9 89 67 45 00

SoftIce also has an assembly option:
A 00456789
then you type the correct mnemonics nop,
jmp 44444444 etc and the bytes at position 00456789 get replaced by the correct code. to be able to see the bytesyou have to have CODE ON command.

The W32dsm89 debug has a patch code option, which works as above.
CrAcKaHoLiC
01-08-2004, 11:42 PM
Several options:

Find HIEW, which is a hex editor. It has an assemble option, so what you write in assembly, i.e jmp 00456789 gets translated into the proper bytes E9 89 67 45 00

SoftIce also has an assembly option:
A 00456789
then you type the correct mnemonics nop,
jmp 44444444 etc and the bytes at position 00456789 get replaced by the correct code. to be able to see the bytesyou have to have CODE ON command.

The W32dsm89 debug has a patch code option, which works as above.
At Offset 00082f9d these are the bytes which is at the jne that needs to be modified; ce 00 00 00 0f bf 15 c8 82 4d 00 85 d2 75 10 c7 .....75 is where the "go to" offset takes me. I change it to eb and nothing happens so I dont know where to go from there. I dont know what to put there and why.

The W32dasm patch option gives original bytes of 75 10 C7 45 FC CF 00 00 00 66 C7 05 E8 80 4D 00 01 00 C7 45 the patch bytes are the same.

The only info I have to help is below

.:Hex:. .:ASM:. .:MEANING:.

75,0f85 jne jump if not equal
74,0f84 je jump is equal
eb jmp jump directly to
90 nop no operation
77,0f87 ja jump if above
0f86 jna jump if not above
0f83 jae jump if above or equal to
0f82 jnae jump if not above or equal
0f82 jb jump if below
0f83 jnb jump is not below
of86 jbe jump if below or equal
0f87 jnbe jump if not below or equal
0f8f jg jump if greater
0f8e jng jump if not greater
0f8d jge jump if greater or equal
0f8c jnge jump if not greater or equal
0f8c jl jump if less
0f8d jnl jump if not less
0f8e jle jump if less or equal
0f8f jnle jump if not less or equal
Kythen
01-09-2004, 12:24 AM
You might want to check out the Intel P4 reference manuals, the IA32 instruction set reference in particular. Or you could get AMD's manuals... they have fewer typos. :D
nikolatesla20
01-09-2004, 10:14 AM
Just get a copy of MASM32.

hxxp://www.movsd.com/masmdl.htm

Then run the main program, and go to Help. It has an nice opcodes reference, which I've used a LOT.

-nt20
CrAcKaHoLiC
01-09-2004, 12:30 PM
You might want to check out the Intel P4 reference manuals, the IA32 instruction set reference in particular. Or you could get AMD's manuals... they have fewer typos. :D
I downloaded IA32 instruction set reference volume 2, it is quite extensive with 800 plus pages. I have ADD but will try to make sense of it but what a brain load! :eek:
CrAcKaHoLiC
01-09-2004, 12:38 PM
Just get a copy of MASM32.

hxxp://www.movsd.com/masmdl.htm

Then run the main program, and go to Help. It has an nice opcodes reference, which I've used a LOT.

-nt20
Thanks for the suggestion, I will do that as I simply want to crack a couple of programs for personal use. I am more of a hands on learner and don't absorb much through reading unless it is need specific. :cool:
CrAcKaHoLiC
01-09-2004, 12:53 PM
Several options:

Find HIEW, which is a hex editor. It has an assemble option, so what you write in assembly, i.e jmp 00456789 gets translated into the proper bytes E9 89 67 45 00

SoftIce also has an assembly option:
A 00456789
then you type the correct mnemonics nop,
jmp 44444444 etc and the bytes at position 00456789 get replaced by the correct code. to be able to see the bytesyou have to have CODE ON command.

The W32dsm89 debug has a patch code option, which works as above.
I fired up Hiew and It works fine useing assemble mode. I changed the jne to jmp but have not cracked it. I am still looking through the strings refering to "registration" though. Thanks
naides
01-09-2004, 01:18 PM
What you describe suggest that changing that jump was not enough to crack the application.
Perhaps more checks are performed somewhere else in the program.
LOUZEW
01-09-2004, 01:40 PM
Hi,CrAcKaHoLiC
I've seen the same post on an other board, i think you have now enough responses no ? ?
I fired up Hiew and It works fine useing assemble mode. I changed the jne to jmp but have not cracked it. I am still looking through the strings refering to "registration" though. Thanks
CrAcKaHoLiC
01-09-2004, 01:52 PM
Hi,CrAcKaHoLiC
I've seen the same post on an other board, i think you have now enough responses no ? ? Yes I do and I have cracked the prog with all the help from the guys who replied to this post. If you are suggesting that I should not have posted the same question on another site you are mistaken and I consider your post to be spam. BTW I did not get any response from the other site or at least I did not receive email notifcation of such.

Thanks to all the people who answered this post, you were all a great help to me! There were three jumps to change and crack this baby.
LOUZEW
01-09-2004, 04:00 PM
You have 3 responses on the other board, and YOU reply ? ?
Maybe your post title no such close to your real needs ! !

Yes I do and I have cracked the prog with all the help from the guys who replied to this post. If you are suggesting that I should not have posted the same question on another site you are mistaken and I consider your post to be spam. BTW I did not get any response from the other site or at least I did not receive email notifcation of such.

Thanks to all the people who answered this post, you were all a great help to me! There were three jumps to change and crack this baby.
dELTA
01-09-2004, 05:33 PM
There is nothing terrible about asking the same thing on different boards. Pointless flames are worse, take it outside.
LOUZEW
01-10-2004, 06:09 AM
I'm not saying it's forbiden to ask on different boards, I understand that very well, it's just he ask only for assembly "jump" Hex Codes on the other board and it had just responses concerning that. Here he is asking more (How to crack . . .).
It's not critical, it's just a remark !

Peace !

There is nothing terrible about asking the same thing on different boards. Pointless flames are worse, take it outside.


Uh, quite off-topic; it's about the stock market. I want you to compete with me!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Uh, quite off-topic; it's about the stock market. I want you to compete with me!
PDA

View Full Version : Uh, quite off-topic; it's about the stock market. I want you to compete with me!

Six Black Roses
01-10-2004, 12:31 AM
http://game.marketwatch.com/Competitions/CompetitionRules.asp?ShortName=PublicButRealistic5K

Well, this probably is the wrong place to post such thing. I'm not sure there are too many people here interested in the stock market. Anyway, I hope this won't be considered annoying spam.

Basically you start out with a fake $5,000.00 and play the stock market. The prices are real, of course, and trades can be executed through even shorts, stops, limits, and market open orders. So far there are 4 people in this competition, and I'm simply trying to at least double the number just so that it'd be more comptetitive.

Note: If you don't know anything about the stock market, it wouldn't make sense for you to join.

On the other hand, you can use this competition to see how well you'd perform on the stock market if you used real money.
evaluator
01-10-2004, 03:27 AM
open first DEMO with BUY without stop-loss,
open second DEMO with SELL without stop-loss;

some time after on one of them you will winner;
then you will show successfull account to your parents,wife,boss,
& you will get money for real-account.
dELTA
01-10-2004, 06:03 AM
Hehe, spoken like a true reverser. :D
mike
01-15-2004, 05:11 PM
There's the attack where you send out 1024 different letters to random people and make predictions about who wins the next ten football games. Then you contact the 55 people that got letters predicting eight or more of the games correctly and say, "Send me some money for my next prediction" (purely for recreational purposes, of course).

You can double the number of people for the last step if you mark one group blue and the other green, without specifying beforehand which one means winner & which means loser--that way you can claim the most convenient color meant "winner" when you contact them the second time.
dELTA
01-15-2004, 07:20 PM
Hehe, spoken like a true evil mathematician/cryptographer. :D :D
JMI
01-15-2004, 10:19 PM
Now all we have to "reverse" is whether "football" means "football" or "soccer." :D And then why we bloody Americans can't tell the difference. :eek: And if it's "football" is it Aussi Rules? :confused:

Regards,
peterg70
01-16-2004, 03:51 AM
Aussie Rules Football is the the Rightful owner of the title Football.

Soccer is not football. Bunch of pansies and actors that hollywood could actually use.
Pay people millions of dollars for single score. And games without any result.

American Football is not Football but Gridiron. A bunch of morons that have to wear padding to crash into each other. Then when defence gets the ball they stop and swap with the offence team. Bloody Slow Game.

If anyone is interested in a real game have a look at the website afl.com.au

Peterg70
dELTA
01-16-2004, 07:23 AM
Actually, it's just another issue of context sensitive breakpoints. If you break in the context of Europe, football = soccer, if you break in the context of US it means american football, and if you break in the context of Australia, football = some other manly activity where they make a point out of not wearing any protection. :D
JMI
01-16-2004, 02:25 PM
And I suppose we would have to throw Rugby into the mix. Of course they are all "ladies" games to the ancient game of South America Indian which was sort of a combination of football and basketball. One team won by putting the "ball" in a hoop at the end of the field. The "losing" team was sacrificed to their gods. :rolleyes: A strong incentive to be on the winning team. But before this digresses into a "heated" debate over which version of the current games is the "better," perhaps we ought to leave that discussion to the hundreds of boards already devoted to the fans of each. :cool:

Regards,
dELTA
01-16-2004, 02:38 PM
Yep, for anyone feeling that they get all too little hate mail, please go here:

http://www.standingsplus.com/discuss/index.cfm

and say that soccer is for ladies, and then go here:

http://pub13.ezboard.com/fnorthwesternwildcatfanboardfrm2

and say that football is for morons (and especially the Wildcats).

Tada, your loneliness and lack of mail will only be a memory. :D
JMI
01-16-2004, 05:38 PM
dELTA, on the other hand, already gets his fair share of hate mail, by crackie. :D

Regards,
mike
01-18-2004, 04:54 PM
next ten football gamesI'm an American living in New Zealand who spent two years in Guatemala, so I'm well aware of all the variants. I chose football as a catch-all sport, since some game with the name "football" is popular everywhere.
evaluator
01-19-2004, 02:25 AM
this 'problem' can be easily unpacked.

Wich of sport was founded firstly, that is owner of name.
just
01-19-2004, 07:33 AM
From Encarta:
The official name of the sport is association football. The word soccer is a slang corruption of the abbreviation assoc.
The modern game of soccer began in the 19th century in England, when a variety of football games developed, all of which involved both handling and kicking the ball. The first laws of the modern game were supposedly drafted in 1862 by J. C. Thring of the Uppingham School. At a meeting of the London Football Association (FA) in 1863, the game was split into rugby football (the parent sport of American football), which permitted handling and carrying the ball, and association football, or soccer, which banned the use of the hands.
So Euro Football wins :D
Woodmann
01-19-2004, 09:20 PM
Howdy,

What do you call NFL Europe in Europe ????
After all, it is sanctioned by the NFL, you know,
the National Football League.

Woodmann
dELTA
01-19-2004, 10:39 PM
Just what the hell is "NFL Europe"? :confused: That's about what we call it... :D


new HASP envelope
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new HASP envelope
PDA

View Full Version : new HASP envelope

separator
01-10-2004, 12:57 AM
Hello,
two-three weeks ago gave me my friend about six programs for unpack. They were protected with HASP envelope. I did it 2-3 times before and never had any problems. But these new programs are not protected with very well known HASP envelope. I think they are protected with something new. It was not problem unpack normal HASP envelope because they have only 3 redirected API calls to thier own procedures. This new version has redirected many other calls and they are redirected to very long procedure which calculate real API address. I think its possible rebuild them manually without problems. But I don't have time (I have other things to do too :) ) and there is my question:

Do you know anyone some automatic way how rebuild imports for this new envelope?

Before was not problem rebuild it with ImpRec, but now many imports are not rebuilded.

I don't post any code from targets, because I think people who know answers to this problem they don't need it.

Thanks you very much,
Separator

(I am sorry for my bad English, I still learn it :) )


Hard Lock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hard Lock
PDA

View Full Version : Hard Lock

THORAC
01-10-2004, 04:12 AM
Hi all,
I am trying to undongle a a program complied by vb. The protection is hardlock. When i createfilea, i land in hwlock.dll and start to trace but unfortunately i can't reach the main program. bpio 378 is not working.
I am running softice on xp, but i think softice works fine on xp. I checked the hardlock tutorials but i think i need more information about this protection. Please write your suggestions about this protection.

Thx
THORAC


port stuff
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > port stuff
PDA

View Full Version : port stuff

naides
01-10-2004, 07:54 AM
This is of course off topic, and has to do with network and security.
I ran a port scanner on my own computer and found 2 to three ports open with numbers between 1000 and 2000 (they change more or less randomly every time I restart the machine). I am unclear about who and why opened them.
The question to you is:

How can I find out which thread, file, service, virus, trojan etc opened and is listening to the ports?
The portscanner reports some info about well known and legitimate ports, but nothing about them.
the antivirus and firewall (Norton) report nothing out of the ordinary.
Symantec Security test site says every thing is fine, but I still don't know what those bloody ports are doing.
Thanks
disavowed
01-10-2004, 10:15 AM
http://www.codeproject.com/internet/enetstatasp.asp#xx668954xx

There are GUI versions of this too. Next time use Google :\
Kayaker
01-10-2004, 04:24 PM
Yeah that's it, thrash him soundly in and around the nether regions with a wet towel for not searching :D

I still have to test this myself, but there's a utility linked within a link to the link I gave in the Windows Forensics: Have I been Hacked? post that might do the job - Vision v1.0.

http://www.foundstone.com/index.htm?subnav=resources/navigation.htm&subcontent=/resources/freetools.htm

-------------------------
Vision v1.0
Reports all open TCP and UDP ports and maps them to the owning process or application.

Vision, a host based Forensic Utility is the GUI successor to the well-known freeware tool, Fport. This innovative new product from Foundstone shows all of the open TCP and UDP ports on a machine, displays the service that is active on each port, and maps the ports to their respective applications. Vision allows users to access a large amount of supplementary information that is useful for determining host status by displaying detailed system information, applications running, as well as processes and ports in use.

Key Features

Interrogate ports and identify potential "Trojan" services by using the "Port Probe" command in the port mapper. Using "Port Probe", Vision will enable you to send a customized string of information to the port. Based on the response from the port, a determination can be made to either kill the port, using the "Kill" command, or leave it as is.

View system events by sorting by application, process, service, port, remote IP, and device drivers in ascending or descending order.

Identify and review detailed information about Services and Devices to determine if they are Running or Stopped.
---------------------------------

(Oh, and a little bit of cold cream will reduce the red welts...:p)

Cheers,
Kayaker
Woodmann
01-10-2004, 05:42 PM
Will not netstat show the same information ?

Woodmann
nikolatesla20
01-10-2004, 07:20 PM
netstat only shows open ports and port types, not which process they belong to
UrgeOverKill
01-10-2004, 08:35 PM
check out this site....hxxp://www.networksorcery.com/enp/protocol/ip/ports00000.htm
naides
01-10-2004, 09:19 PM
http://www.codeproject.com/internet/enetstatasp.asp#xx668954xx

There are GUI versions of this too. Next time use Google :\

Auuch!!!

Next time, instead of seeing a doctor, I will read an Internal Medicine (Geriatric Internal Medicine in my case) textbook instead.
esther
01-10-2004, 09:31 PM
Yeah flame him :D . Hmm strange,they should delete disavowed posts >:D

Auuch!!!

Next time, instead of seeing a doctor, I will read an Internal Medicine (Geriatric Internal Medicine in my case) textbook instead.
dELTA
01-10-2004, 11:06 PM
The following is another excellent free tool from our friends at sysinternals too:

http://www.sysinternals.com/ntw2k/source/tcpview.shtml
Kayaker
01-10-2004, 11:57 PM
This is of course off topic, and has to do with network and security.

Need this be off topic? I wouldn't mind seeing more network and security discussions, like RCE it's all part of a total understanding of computer software, hardware and operating issues. There seem to be a number of people here with at least some knowledge of network operations, and a few lively discussions of some aspect of things we don't usually discuss might make for interesting reading. (What, you don't find unpacking Asprotect interesting enough, you treasonous bastid!!?)

dELTA had mentioned at one point about starting a Networking forum, might there be enough interest to make something like that viable? Just thought I'd bring that up for discussion...

Kayaker
+SplAj
01-11-2004, 03:10 AM
Need this be off topic? I wouldn't mind seeing more network and security discussions, like RCE it's all part of a total understanding of computer software, hardware and operating issues. There seem to be a number of people here with at least some knowledge of network operations, and a few lively discussions of some aspect of things we don't usually discuss might make for interesting reading. (What, you don't find unpacking Asprotect interesting enough, you treasonous bastid!!?)

dELTA had mentioned at one point about starting a Networking forum, might there be enough interest to make something like that viable? Just thought I'd bring that up for discussion...

Kayaker

Kayaker

the perfect solution :-

EssentialNetTools from Tamos........ is protected by ASP....... :p
disavowed
01-11-2004, 10:00 AM
dELTA had mentioned at one point about starting a Networking forum, might there be enough interest to make something like that viable?networking does not fall under the topic of reverse software engineering (the theme of this set of forums), so i would not add it as a new forum
dELTA
01-11-2004, 06:47 PM
Any posts regarding networking and security are welcome in the Advanced Reversing/Programming forum anyway (except for crypto stuff which will fit better in the cryptographics forum off course).

And there are many aspects of networking and security that are related to both reverse code engineering and even more reverse engineering in general, so if the post count of such related topics ever rise high enough in the Advanced R/P forum or the Off Topic forum we might very well consider starting a separate forum for these things.
evaluator
01-12-2004, 06:09 AM
i'm against that forum.
dELTA
01-12-2004, 11:08 AM
It feels good to hear your well-founded reasons for your opinion eval. :p
evaluator
01-12-2004, 12:13 PM
because reason very simple, i not wrote nothing.
i think, that is not RCE-related.

your move, show if that is.

***
hot Q of day:
is as_ reversing RCE-related!? ~8-0
Fake51
01-13-2004, 03:35 AM
AAtools and Kerio personal firewall will both do the trick. First is a target, second is free. Oh, and did I mention the added bonus of running a firewall?

Heh, and flames for not searching on this. The answer "firewall" should have been in your thoughts even before considering asking people around here.

Fake
dELTA
01-13-2004, 07:31 AM
Yes, but it is often more appealing to have a light-weight tool to do such a thing, rather than the driver mess of a personal firewall, affecting a thousand other things in the system. Especially if you are perhaps already running another firewall without this feature.
Fake51
01-13-2004, 10:58 AM
Yes, but it is often more appealing to have a light-weight tool to do such a thing, rather than the driver mess of a personal firewall, affecting a thousand other things in the system. Especially if you are perhaps already running another firewall without this feature.

A firewall that won't tell you what processes are running and doing net-stuff? Not worth running.
Anyway, thinking firewall should have set off a search that should easily bring up plenty tools alongside. Sure, just posting here is easier, but come on, this one is so easy.

Fake
naides
01-13-2004, 11:32 AM
A firewall that won't tell you what processes are running and doing net-stuff? Not worth running.
Anyway, thinking firewall should have set off a search that should easily bring up plenty tools alongside. Sure, just posting here is easier, but come on, this one is so easy.

Fake

OK guys. Enough. My post was not completely clear, and I did not think it was important, so I let it go but:
I do have a firewall. Norton, in one computer, zone alert in others. They do list the processes, but the ports I was nervous about, did not show in Norton's list.
The Norton site was less than helpful. Their detector said everything was OK, but I am behind several layers of firewalls. I also know that a firewall, particularly a personal (cracked) one is not impenetrable, particularly if you have malicious code working from inside your computer

Posts like UrgeOverkill did point me in the right direction, explaining which ports are supposed to be open, which are exploits, and which are both.

I recognize I could have searched more thoroughly, an I give my apologies to anybody I importunated. My ignorance in networking and hacking is even greater than RCE, so I asked for some guidance.
evaluator
01-13-2004, 12:20 PM
naides, +SPLAJ already pointed you to -www.tamos products,
keygened by him, kraked by mim?
disavowed
01-13-2004, 12:56 PM
I give my apologies to anybody I importunated.
apology accepted :p
TOTEU
01-28-2004, 10:36 PM
On a side note:

How about netsh ?

cmd
netsh
netsh>interface ip show

and for more see netsh on technet


SDK for C-dilla SafeCast.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SDK for C-dilla SafeCast.
PDA

View Full Version : SDK for C-dilla SafeCast.

Andy
01-11-2004, 09:42 AM
I've problem with programme safe C-dilla safecast - AutoData - hxxp://cookiecrk.org/~andy/autodata.tar
the bases of data of programme be coded on serial number basis generated with library cdains32.dll, does someone some SDK have can to this dll? Greet

Andy
Woodmann
01-11-2004, 04:15 PM
Damn............

I wish I had the Evaluator Translator Plug-in :eek:

Woodmann
Andy
01-15-2004, 12:11 PM
I have a problem with a program secured with a C-dilla Safecast packet -
hxxp://cookiecrk.org/~andy/autodata.tar, during the start of the program I have to put a serial, with which the data bases of the program are decrypted. That is why the patch is not a solution. The serial is generated based on CDAAPP16.DLL library. Does anyone have any SDK to that library? Thanks for help. Greetings Andy

[Woodman : better? ;)]


question from a pre-n00b :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > question from a pre-n00b :)
PDA

View Full Version : question from a pre-n00b :)

SirSnuggleBunny
01-11-2004, 10:34 AM
question from a pre-n00b :)

Howdy all, this is my first post here, so hi there :)

I'm not even a n00b yet, more like a nuuuuw- or just a nnnnnnnnnnhhh. but I'll ask anyway...
my background is lingo, java, perl, and what ever else I end up needing. so finally I ended up here.
this whole reversing thing has me fascinated, I love a puzzle! I've been reading through this forum, and a bunch of other sites for the last week... I'm hooked!

I have searched this forum, and the web for a great BEGINNER tutorial on how (where) to start reverse engineering,
I am overwhelmed, I must have read over a hundred by now, some I fully understood, and some that were way beyond me.
however, most "beginner" tuts are, well, not really for the beginner.

i.e.. before I can walk, I must learn how to crawl. before I can crawl, I need to know what my legs and hands are, and how to use them.

so what I'm looking for are suggestions on where to start. links to tutorials for the real beginner.
In fact I'm mentioning tutorials and tuts, and beginner a few times, so in the future any one searching this forum may find a great list of tuts on where to start:)

my first attempt/ project I have picked for myself, is a time limited (yet fully functional ) demo. from what I've read, this should be easy.
In fact, even as a pre-n00b, I have already found where it needs to be changed! and the protection seems so lame that if I turn back my clock, it works! so this is my first project.

I have:
NuMega SoftICE Driver Suite ( I run XP for music stuff, so softice 4.05 won't work for me)
W32Dasm Version 8.x Series,
Debuggy By Vanja Fuckar ( to play with 'till I found softice)
various coctails
do I need anything else?

Any suggestions, comments on where to start would be greatly appreciated
thanks in advance,
cheers!
Sir SnuggleBunny

edit/ oops, just found this thread.... http://66.98.132.48/forum/showthread.php?t=5297
embarrassed.... sorry... /edit
SirSnuggleBunny
01-11-2004, 10:54 AM
PS I forgot to mention, stuff like this is VEERRRYYY HELPFULL!!!

Assembly Programming Language Quick Reference
by Nicholas Janzen

Instructions
AAA - Ascii Adjust for Addition
AAD - Ascii Adjust for Division
AAM - Ascii Adjust for Multiplication
AAS - Ascii Adjust for Subtraction
ADC - Add With Carry
ADD - Arithmetic Addition
AND - Logical And
ARPL - Adjusted Requested Privilege Level of Selector (286+ PM)
BOUND - Array Index Bound Check (80188+)
BSF - Bit Scan Forward (386+)
BSR - Bit Scan Reverse (386+)
BSWAP - Byte Swap (486+)
BT - Bit Test (386+) BTC - Bit Test with Compliment (386+
BTR - Bit Test with Reset (386+)
BTS - Bit Test and Set (386+)
CALL - Procedure Call
CBW - Convert Byte to Word
CDQ - Convert Double to Quad (386+)
CLC - Clear Carry
CLD - Clear Direction Flag
CLI - Clear Interrupt Flag (disable)
CLTS - Clear Task Switched Flag (286+ privileged).
CMC - Complement Carry Flag
CMP - Compare
CMPS - Compare String (Byte, Word or Doubleword)
CMPXCHG - Compare and Exchange
CWD - Convert Word to Doubleword
CWDE - Convert Word to Extended Doubleword (386+)
DAA - Decimal Adjust for Addition
DAS - Decimal Adjust for Subtraction
DEC - Decrement.
DIV - Divide
ENTER - Make Stack Frame (80188+)
ESC - Escape
HLT - Halt CPU
IDIV - Signed Integer Division
IMUL - Signed Multiply
IN - Input Byte or Word From Port
INC - Increment
INS - Input String from Port (80188+)
INT - Interrupt
INTO - Interrupt on Overflow
INVD - Invalidate Cache (486+)
INVLPG - Invalidate Translation Look-Aside Buffer Entry (486+)
IRET/IRETD - Interrupt Return.
Jxx - Jump Instructions Table.
JCXZ/JECXZ - Jump if Register (E)CX is Zero
JMP - Unconditional Jump
LAHF - Load Register AH From Flags
LAR - Load Access Rights (286+ protected)
LDS - Load Pointer Using DS
LEA - Load Effective Address
LEAVE - Restore Stack for Procedure Exit (80188+)
LES - Load Pointer Using ES
LFS - Load Pointer Using FS (386+)
LGDT - Load Global Descriptor Table (286+ privileged)
LIDT - Load Interrupt Descriptor Table (286+ privileged)
LGS - Load Pointer Using GS (386+)
LLDT - Load Local Descriptor Table (286+ privileged)
LMSW - Load Machine Status Word (286+ privileged)
LOCK - Lock Bus
LODS - Load String (Byte, Word or Double)
LOOP - Decrement CX and Loop if CX Not Zero
LOOPE/LOOPZ - Loop While Equal / Loop While Zero
LOOPNZ/LOOPNE - Loop While Not Zero / Loop While Not Equal
LSL - Load Segment Limit (286+ protected)
LSS - Load Pointer Using SS (386+)
LTR - Load Task Register (286+ privileged)
MOV - Move Byte or Word
MOVS - Move String (Byte or Word)
MOVSX - Move with Sign Extend (386+)
MOVZX - Move with Zero Extend (386+)
MUL - Unsigned Multiply
NEG - Two's Complement Negation
NOP - No Operation (90h)
NOT - One's Compliment Negation (Logical NOT)
OR - Inclusive Logical OR
OUT - Output Data to Port.
OUTS - Output String to Port (80188+)
POP - Pop Word off Stack
POPA/POPAD - Pop All Registers onto Stack (80188+)
POPF/POPFD - Pop Flags off Stack
PUSH - Push Word onto Stack
PUSHA/PUSHAD - Push All Registers onto Stack (80188+)
PUSHF/PUSHFD - Push Flags onto Stack
RCL - Rotate Through Carry Left.
RCR - Rotate Through Carry Right
REP - Repeat String Operation
REPE/REPZ - Repeat Equal / Repeat Zero
REPNE/REPNZ - Repeat Not Equal / Repeat Not Zero
RET/RETF - Return From Procedure
ROL - Rotate Left.
ROR - Rotate Right
SAHF - Store AH Register into FLAGS
SAL - Shift Arithmetic Left / Shift Logical Left
SAR - Shift Arithmetic Right
SBB - Subtract with Borrow/Carry
SCAS - Scan String (Byte, Word or Doubleword)
SETAE/SETNB - Set if Above or Equal / Set if Not Below (386+)
SETB/SETNAE - Set if Below / Set if Not Above or Equal (386+)
SETBE/SETNA - Set if Below or Equal / Set if Not Above (386+)
SETE/SETZ - Set if Equal / Set if Zero (386+)
SETNE/SETNZ - Set if Not Equal / Set if Not Zero (386+)
SETL/SETNGE - Set if Less / Set if Not Greater or Equal (386+)
SETGE/SETNL - Set if Greater or Equal / Set if Not Less (386+)
SETLE/SETNG - Set if Less or Equal / Set if Not greater or Equal (386+)
SETG/SETNLE - Set if Greater / Set if Not Less or Equal (386+)
SETS - Set if Signed (386+)
SETNS - Set if Not Signed (386+)
SETC - Set if Carry (386+)
SETNC - Set if Not Carry (386+)
SETO - Set if Overflow (386+)
SETNO - Set if Not Overflow (386+)
SETP/SETPE - Set if Parity / Set if Parity Even (386+)
SETNP/SETPO - Set if No Parity / Set if Parity Odd (386+)
SGDT - Store Global Descriptor Table (286+ privileged)
SIDT - Store Interrupt Descriptor Table (286+ privileged)
SHL - Shift Logical Left
SHR - Shift Logical Right
SHLD/SHRD - Double Precision Shift (386+)
SLDT - Store Local Descriptor Table (286+ privileged)
SMSW - Store Machine Status Word (286+ privileged)
STC - Set Carry
STD - Set Direction Flag
STI - Set Interrupt Flag (Enable Interrupts)
STOS - Store String (Byte, Word or Doubleword)
STR - Store Task Register (286+ privileged)
SUB - Subtract
TEST - Test For Bit Pattern
VERR - Verify Read (286+ protected)
VERW - Verify Write (286+ protected)
WAIT/FWAIT - Event Wait
WBINVD - Write-Back and Invalidate Cache (486+)
XCHG - Exchange
XLAT/XLATB - Translate
XOR - Exclusive OR

--------------------------------------------------------------------------------

Jump on Condition Instructions
JA Jumps if the first number was above the second number
JAE same as above, but will also jump if they are equal
JB jumps if the first number was below the second
JBE Same as above, but will also jump if they are equal
JNA jumps if the first number was NOT above (JBE)
JNAE jumps if TDe first number was NOT above or TDe same as (JNB)
JNB jumps if the first number was NOT below (JAE)
JNBE jumps if the first number was NOT below or the same as (JA)
JZ jumps if the two numbers were equal
JE same as JZ, just a different name
JNZ jumps if the two numbers are NOT equal
JNE same as above
JC jump if carry flag is set

Note: the jump can only be a maximum of 127 bytes in either direction.

Data Types in Assembly
bit - smallest type that can be two values ex. 1, 2

nibble - four bits has 16 values ex. 0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F

byte - Most important data type - 8 bits - smallest addresable data item, bit inside are numbered from 7 - 0, 0 being low order bit and least significant, 1 being the high order bit and the most significant, contains 2 nibbles upper and lower, require 2 hex values, rages from 0 - 255.

word - contains 16 bits 0 - 15, 0 low order, 15 being high order, contains 2 bytes (low and high). Used for integer, offsets, segment values. The range is from 0 - 65,536 or signed -32,768 to 32,767.

dword - or double word, 2 words, 32bit, used maily for segmented adresses, but can also be used for 32bit integer ranging from 0 - 4,294,967,295 or signed -2,147,483,648 to 2,147,483,647, can also be used for 32bit floating point values.

Definitions
Monadic operation - means it accepts only one operand.

Signed numbers are - and +.

Thanks for reading my quick ref, please don't sell it, but it is for you for nothing, I encourage you to give it away. Hope it helped.
r4g3
01-11-2004, 05:03 PM
*g* thanks this asm reference (backup?) copy here is truly useful
uhm but i think ill sell it anyways (for big $$$!) hope u dont mind ?
hm how about 250$ for soft version and 800$ for 1 hardcopy, everything distributed with enterprise licenses using rsa-17
anyone dont even think of stealing my business plan !
Aquatic
01-11-2004, 10:09 PM
Before you get into RE, you should learn programming.

Then at least you have an idea of what you are reversing.
Aimless
01-12-2004, 12:39 AM
You might want to also try and break:

1. Version5/6/7 of Winzip (freely available on the net)
2. Version 5/6 of MIRC (freely available on the net)

to check your readiness on proceeding further. You must also learn to use:

1. w32dasm (there is a vast difference between having the software and using the software)
2. Freeware version of IDA Pro.
3. A good hex editor (Ultraedit/HexWorkshop will do)
4. Smartcheck (try cracking VB based programs with it)
5. Ollydbg
6. Microsoft Debugger (for the time being, forget being leet and not using any Microsoft products)

Do not bother too much about learning to program in assembly. It is just important to be able to "read" assembly. Neverthless, its good to be able to know what chunk of assembly code is resulted from what codes.

Once you are through with the serial cracking, try breaking some time based programs. By this time, you will know what to look for when you are stuck up in something, or the targets that will possess the best challenge for your level of skills.

Do not forget, apart from all tools mentioned above, do not underestimate GOOGLE (yup!)

Have Phun,
SirSnuggleBunny
01-12-2004, 09:07 PM
Thanks Aimless, for your suggestions, I'm already having fun!

Aquatic, well I think that's what I've been doing. I've learned things as I need them, or just out of pure curiosity. it's a small step from html to java. then from there, actionscript aint to hard, and lingo is... well almost like english. so learning another language(s) is just part of the process. it's fun.

I posted here in a noob forum, hoping to hear something like good luck, or I started by doing this, or try this tutorial...

oh well... I'll just keep reading.

P.S. and r4g3, too late, I already have it up for sale at my ultra secrete wares site for $666.66 [hard copy only] :p
Woodmann
01-12-2004, 09:28 PM
Howdy,

Try this : http://66.98.132.48/krobar/tutlist/tutlist1745.html

Good Luck

Woodmann
SirSnuggleBunny
01-14-2004, 03:09 PM
Howdy,

Try this : http://66.98.132.48/krobar/tutlist/tutlist1745.html

Good Luck

Woodmann

Thanks Woodman, I got em all :)

soft ice is still a bit (ha! allot!) beyond me, but I'm getting the hang of W32Dasm and HIEW.
in fact, I just cracked my first program :D !
I'm still in shock! it works!

In trying to learn what makes things work, I had a look at several programmes on my box, and I came across one that quits when it sees a debugger.

How do you people reverse engineer a program like that?

just wondering... cheers,
SirSnuggleBunny
dELTA
01-15-2004, 07:04 PM
How do you people reverse engineer a program like that?

You have to begin with reverse engineering and defeating the anti-debug tricks. Two possible methods are by stepping the program from the entry-point or analyzing its deadlisting in a disassembler.
JMI
01-15-2004, 09:49 PM
And there are several threads here which discuss debugger detection methods used again SICE. Try the Search button above and use "debugger detection" and check some of those out. Generally, programs can check for the presence of SICE's name (for its windows or exe, etc.) in various locations or as a running process and there are windows API that check for the presence of a debugger.

Regards,


Hardware-based read-only memory
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hardware-based read-only memory
PDA

View Full Version : Hardware-based read-only memory

disavowed
01-11-2004, 06:38 PM
It will be interesting to see how this technology will be used to hinder reverse-engineering:

http://news.com.com/2100-7355_3-5137832.html
evn
01-12-2004, 02:21 AM
From the Article:

A number of damaging worms from last year relied on buffer overflows. Around 50 percent of the Windows security updates from Microsoft in the last two years may have been rendered unnecessary if the technology existed then, according to an analysis by AMD and Microsoft.

I don't know about anyone else, but i find it irresponsible for a software company (or programmer) to write code that relies on the underlying systems security to function as securely as possible. Just because the CPU can prevent attack doesn't mean that everybody is using that CPU, or an operating system that takes advantage of it.

I don't think that technology like this will (or can) be used as a reverse-engineering hindrance at the moment, due to the nature of the technology and the current state of difference between computer systems worldwide. To use the technology would require the company to target a specific hardware and software configuration, which commercial companies often cannot (or won't) support due to complications with other hardware or software (very important in fields of animation and media, CGI, etc.).

The article doesn't really tell much about the hardware except that it read-only's the buffer memory. If the hardware was changed to read-only the entire application, packers and self-modifying code would become unusable and would (probably) leave the software less protected than it originally was.

CPU emulation software (such as VMWare) could always be used to bypass it on systems that support the technology, which i'm sure would be done.
elfz
01-12-2004, 07:31 AM
Hmm, of course that's nice how marketing presents this ("will prevent buffer overflows, blah blah blah"). The thing changing is that i386 page protection don't have "read, but don't execute" kind of flag. Now, starting with XP SP2 on supported platforms (currently currently AMD K8, Itanium, and AMD64) stack and heap won't be executable anymore (until you call VirtualProtectEx of course).

Sure enough, some of the protections will die because of this.

http://msdn.microsoft.com/library/en-us/dnwxp/html/securityinxpsp2.asp
Mr. Blue
01-12-2004, 09:44 AM
OpenBSD and Linux (a patch should be applied) currently have the ability to disable code execution on the stack without any hardware-specific changes. So I guess this new feature is not as simple as a new memory protection bit. Unfortunately the article doesn't give any technical details :(
elfz
01-12-2004, 11:56 AM
From the information found on the net, it seems that really, that is only NX flag for the memory page, that means "No eXecution".
A little more information can be found on The Register http://www.theregister.co.uk/content/4/33729.html but there's much junk information too.
disavowed
01-12-2004, 06:03 PM
Hmm, of course that's nice how marketing presents this ("will prevent buffer overflows, blah blah blah").
yes, especially because it won't prevent buffer overflows. it will prevent exploitation (arbitrary code execution) by means of buffer overflows. however, i would expect buffer overflows could still be used to crash the process (denial of service)
doug
01-12-2004, 08:57 PM
however, i would expect buffer overflows could still be used to crash the process (denial of service)

yes in fact, one of the article mentionned this.
It would crash the process, but it would no longer replicate itself... yielding a much smaller (and slower) distribution of the worm.


rtcMsgBox breakpoint doesn't work
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > rtcMsgBox breakpoint doesn't work
PDA

View Full Version : rtcMsgBox breakpoint doesn't work

id6262
01-12-2004, 09:25 AM
Hi,
I trying to crack VB5 application, but stuck with breakpoints.
So i made simple VB5 application for investigation with one button which calls dialog. Steps I made:
1. run simple program
2. call (ctrl+d) SoftIce
3. set breakpoint (bpx rtcMsgBox)
4. close (ctrl+d) SoftIce
5. press button which calls dialog
According to bunch of cracking tutorials I have read on step 5 SoftIce must popup - but it doesn't!!!!

I use SoftIce 4.05
Also I have line "EXP=C:\WINNT\system32\msvbvm50.dll" in Winice.dat file.
I attached Winace.dat file.

Any clues, what I am doing wrong?
disavowed
01-12-2004, 09:43 AM
rtcMsgBox is used for the vb function MessageBox, not for a general dialog box
id6262
01-12-2004, 09:56 AM
My VB5 button code:
"Private Sub Command1_Click()
MsgBox "Hello World!"
End Sub"

Then I open this program with W32Dasm, i see in import section:
"Addr: xxxxxxxx hint(0253) Name: rtcMsgBox"

If I delete code above and compile my program, W32Dasm doesn't show anything like 'rtcMsgBox' anymore.
So I comming to conclusion that "MsgBox 'Hello World!'" is related to rtcMsgBox.

Anyway, this only my thoughts...
If "bpx rtcMsgBox" wrong break point, which breakpoint is valid for catching this "MsgBox"?
disavowed
01-12-2004, 06:01 PM
nevermind, i misunderstood. i thought you were trying to break on rtcmsgbox when opening a normal dialog box.

as for why the breakpoint isn't working, there are dozens of possibilities. search the board for advice


MUP bpx int3 - all done - - cant' find real OEP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MUP bpx int3 - all done - - cant' find real OEP
PDA

View Full Version : MUP bpx int3 - all done - - cant' find real OEP

Dr.Bizar
01-12-2004, 11:40 AM
Hi all i'm a newb to all this MUP buisness - but gotta start somewhere right ?
Realy hope someone are able to help.

My target: h***://***.opm-2.c**

What i did so far:
1) I found the OEP using procdum PEeditor - 0023fc01
2) I've replaced the byte at OEP with CC (int3)
Now SI breaks on bpint 3

Next I changed the bits back to it's org. and tryed to step through the code
and as expected theres a call to the unpacking routine and this is followed by a jump to the real OEP - i guess

My problem: SI wont break after the call executed - the program just launches - How do i find the real EOP :confused:

Thx in advance

Kind Regards Dr.Bizar
dELTA
01-13-2004, 07:13 AM
Why do you expect SI to break after the OEP-call in the first place? Have you put some kind of breakpoint there, or what?
JMI
01-14-2004, 12:11 AM
It was a matter of "will." He wanted it to break "there" so he "expected" to to do so. :p

Regards,
infinity+
01-19-2004, 05:10 PM
Why do you need to jump to the oep if you know what it is?
Fake51
01-19-2004, 05:24 PM
It was a matter of "will." He wanted it to break "there" so he "expected" to to do so. :p

Regards,

Read the post guys. He states that he located an unpacking routine, and after that a jump to the real oep. Legend has it that sice has the capability to step over calls. What the young lad is mistaken about is one of two things:
1) softice doesn't always behave well - some versions with some os's are NOT able to step over calls.
2) the REAL jump to the REAL oep might be located inside the unpacking function - and not after the call. Thus trying to step over the call would lead to the execution of the app.

Hmmmm ... long time since I last found myself telling others to go easy on newbies. Odds are I misunderstood something - apologies upfront.

Fake


unknown packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unknown packer
PDA

View Full Version : unknown packer

chlankboot
01-12-2004, 11:46 AM
hi,
i have suxessfully reversed a packed proggy using sice driver suite 2.6 under xp (seems that this version is undetectable, i tried on another machine under win98 and sice V4 : the proggy simply exits without any message).
the problem is not about reversing itself : my question is this : does anyone know the packer used in this file ? i have searched about 1 month over the net (file analyzers, unpackers,...) without any result.
note that in the exe file i found the string "exestealth" (may be fake) but in the sections i found .upx00, .upx01, .., coban2k (which is the guy that made an unpacker for upx (is it 2 fool the unpacker ???)
i dont think also that the packing routine was made by the developpers since the proggy was coded in the lazy VB :D
i forgot 2 tell u that peid sais : ASPack / ASProtect x.xx -> Alexey Solodovnikov, and there i'm really lost ...
thank u for replies :p
Zilot
01-12-2004, 12:15 PM
Hmmm.... Maybe you unpacked Xtreme protector !!!
Woodmann
01-12-2004, 06:39 PM
Howdy,

Tell us how you unpacked it.
Maybe some code snippet to explain what you did.

Woodmann
doug
01-12-2004, 09:04 PM
using sice driver suite 2.6 under xp (seems that this version is undetectable

could you expand on this ? what makes it different than any other version before and after?
chlankboot
01-13-2004, 01:53 AM
Howdy,

Tell us how you unpacked it.
Maybe some code snippet to explain what you did.

Woodmann

I did not actually unpacked it, all that i did is dump it with procdump, set a bpx on callprocaddress and then step executilng till i found the oep (popad, jmp xxx), after that i changed the ep in the dumped file and disasm it with ida, this enabled me to analyse the code and found where i can apply the patch, finally i used +dza patcher to patch the file (adding a new section to the original exe)
note that i am still learning the pe format and trying 2 find out what this patcher did exactly
the unpacker unpacks great part of its own code at runtime that's why debugging was a little bit difficult and that's why a loader don't work (timing)
if u want i can mail u the idb file.
thx.
chlankboot
01-13-2004, 02:07 AM
could you expand on this ? what makes it different than any other version before and after?

all i know are simple observations, (i have 2 machines at home and in office)under win98 and ice v4 (home) the proggy simply quits without any message, even procdump craches if trying to dump the file, under xp and sids 2.7 it runs (the program) perfectly and it is possible to debug it as any other program.
this is not the only case, i have seen this on many others programs that (i suppose have routines to detect a debugger) : a common example is a_c_r_o_b_a_t (writer) that behaves exactly the same.
i can't explain it, so it will be cool if anyone can explain us what is supposed to happen and what is the difference between the versions.
chlankboot
01-13-2004, 07:08 AM
Hmmm.... Maybe you unpacked Xtreme protector !!!
sorry guy it is not Xtreme protector!
i downloaded the trial version and packed a vb exe with, the differences are :

Xtreme protector does not corrupt the original import table (imports are visible in the packed file)
it replaces the original .text section with CODE section
it adds a XPROT section

as u can see ther's no .upx0, .upx1 and coban2k sections in the packed file.
(and i did not unpacked it :( ) not yet :D
Zilot
01-13-2004, 07:59 AM
sorry guy it is not Xtreme protector!

Really !!!!!?????? http://www.postsmile.com/img/default/0568.gif
evaluator
01-13-2004, 08:14 AM
well, if you see:
POPAD, JMP xxx

so you had unpacked UPX.
If section-names are others, probably they are changed.

Thats all folks.

**
Zilot, you use wrong method with newbies.
chlankboot
01-13-2004, 08:36 AM
Really !!!!!??????
yes
chlankboot
01-13-2004, 09:03 AM
evaluator u r great

things became clearer about renaming the last section (coban2k)

but as i know the (poad, jmp xxx) is common 2 most packer/protectors such as ASprotect not only upx, dont u think so ?
lownoise
01-13-2004, 10:04 AM
maybee the exe file you've got was origanly packed with upx and exestealth. but exestealth has been removed with the unpacker coban2k created ;)
google for exestealth unpacker ;)
Zilot
01-13-2004, 10:18 AM
Zilot, you use wrong method with newbies.

Man !!!
just a little joke, do you mind it as a joke ?
esther
01-13-2004, 10:44 AM
I see nobody laughing :eek:
Zilot
01-13-2004, 11:49 AM
So if anybody does, he must write down it ?
+SplAj
01-13-2004, 12:13 PM
google at your service :-

http://www.cobans.net/unstealth.php

:D
evaluator
01-13-2004, 12:16 PM
don't fight.
JMI
01-14-2004, 12:26 AM
I was enjoying the joking Zilot, and of course esther can't "see" anyone laughing because this is a written medium, not a video one. :D If you listen veerrrryyyy carefully, you will, occasionally, hear someone laughing. :cool:

You will "usually" hear that sound when +Spla/\ makes one of his offerings, because they usually include some very witty and/or humorous comments or transformation of language. Quite unlike our Musician friend, who speaks an entirely "personal" dialect of English, that we all need source code to understand fully. :D

Regards,
esther
01-17-2004, 11:04 AM
coz Peter Sellers died long ago :eek:
chlankboot
01-19-2004, 04:33 AM
Before, would to thank all of u, ur posts have been very helpful.

it is ASPROTECT, and some garbage have been added to the packed file to fool newbies (like me :p), how i found it out ? listen :
(jove.prohosting.com/~predat0r/aspr_mem.doc) old doc but precious.
(reteam.org/essay.viewer?type=essay&short='e'&id=51) excellent essay about unpaking the last version of ASPROTECT (1.23) by AndreaGeddon (a must read), my proggy behaves exactly the same !
2 confirm that i simply tried 2 pack the packed file with ASPROTECT, and guess, it recognizes itself :D

thank u again.


MUP Upx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MUP Upx
PDA

View Full Version : MUP Upx

infinity+
01-12-2004, 05:37 PM
I have unpacked a program that was packed with upx. Do I need to do anything to correct the string references?..... Right now, the only way to break on them is with an int3 bp.
dELTA
01-13-2004, 07:16 AM
Huh? How do you break on string references with an int3 breakpoint?
infinity+
01-13-2004, 08:22 AM
After unpacking I have string references but...

When trying to set a bp on the string references in ollydbg i get the message...

--------------------
Suspicious breakpoint
--------------------
You want to place a bp outside the code section. INT3 bp set on data will not execute and may have disastrous influence on the debugged program. Do you really want to set a bp here?

004011F8 68 74644000 PUSH 00000000.00406474 ; ASCII "

Should i just disable/ignore this message? or should i do something else to correct the string references?
Mr. Blue
01-13-2004, 09:15 AM
My guess (a wild one) is that you want to make the debugger break when the code references the
string. To do so, you can place a memory breakpoint (Read, Write or both) at the first byte of the string or even all bytes of the string.

In Olly you should select the Dump view, then using "Go to expression" you can navigate to the desired address (start of the string) . Now mark the bytes (in the Dump) that you want to be monitored and using the context menu select Breakpoint and put a memory breakpoint.
Mr. Blue
01-13-2004, 09:25 AM
Uh-oh, I was too quick in posting the previous reply. I apologize for that.

Now to answer your question - yes, you can safely ignore this message. I think it can be disabled from the options dialog - I don't have Olly on this machine to confirm it. You will see this message almost each time when you are working with packed executables.
infinity+
01-13-2004, 04:19 PM
Thanks Mr. Blue

This was the first time that I unpacked upx and was just curious if i forgot something
dELTA
01-13-2004, 05:06 PM
But still, since you are after all talking about string references I think Mr Blue's first reply was quite to the point, I was just going to reply something similar myself. I.e. you cannot use int3 breakpoints on strings to break when they are accessed, you must use memory breakpoints.

But just as Mr Blue also says, even when setting normal int3 breakpoints on normal code in packed programs, Olly might indeed issue this warning (due to issues having to do with section characteristics and entrypoint section location), and in THAT case you can safely ignore it.


"Crackers Matrix" book
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > "Crackers Matrix" book
PDA

View Full Version : "Crackers Matrix" book

disavowed
01-12-2004, 11:39 PM
http://www.hackerhut.net/catalog/product_info.php?products_id=619

I haven't downloaded it yet. Has anyone taken a look already and can confirm that it's useless? :)
Kayaker
01-13-2004, 12:19 AM
I'm sure you're right about it being useless, the tools and tuts no doubt scammed from the sites we all know about. What really got me in the description was this:

Thousands of cracks for the latest software: As an added bonus, researchers will share their resources, providing you with thousands of cracks for the latest games and software.

So those who release cracks are now known as "researchers", what a laugh. I think that is what is known as marketing spin.
Aquatic
01-13-2004, 05:01 AM
http://www.222clan.com/up-down/whoa.jpg
[NtSC]
01-13-2004, 06:00 AM
Found it somewhere, mounted it for a nap...
And it really looked boring.. It seems some stuff must be downloaded first before you can watch it..

Years ago it was already a buissness to sell so called good tools for crackers/hackers but in the end it wasnt very usefull stuff.

Its all about making some $$$ with other peoples work, or do u think you will find any interesting higher attitude in there?

/me doubts it

Since most stuff is done by scene people anyway... someone should set the whole thing for download...
the jgtiso release was unpacked (bin/cue) about 115 mb..
disavowed
01-14-2004, 04:11 PM
just took a look at the release. looks like someone scavenged some old sites for like a dozen very unimpressive tutorials and made a frontend to read them with. seems like all "tutorials" are from before the year 2000. it also includes a bunch of "crackers tools" (mostly bios password modifiers, ftp password decryptors, etc.), hardly any of which have descriptions. again, looks like someone just went around downloading such tools and made a frontend for them

don't waste the download


Try to Create a Patcher
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Try to Create a Patcher
PDA

View Full Version : Try to Create a Patcher

_ColdMind
01-13-2004, 03:00 AM
I have tried to compare two files: the original and the patched one, character by character and store the offset and the patched code using the following C sequence, but it shows me strange things, not my patch:

FILE *f1,*f2;
f1=fopen(argv[1],"r");
f2=fopen(argv[2],"r");
int ch1, ch2, j=0;
unsigned long int i=0;
do {
ch1=fgetc(f1);
ch2=fgetc(f2);
if(ch1!=ch2) printf("\n %08X: %X", i, ch2);
i++;
if(i%25==0) {
printf("\n -- page %d -- more --",++j);
getch();
}
} while(ch2!=EOF);
printf("\n -- end --");
return;
}

Then I have triend to patch a file using the following C code, but this time I gived up and remember about woodmann... Would you like to help me ?
FoolFox
01-13-2004, 05:41 AM
And what is the trouble ?

as far as I've seen by quickly look at the code, it should work
as intended....

what are the strange things you talk about ?

Regards
FoolFox
chlankboot
01-13-2004, 05:57 AM
i think ur code is correct,
tip : try to debug it step by step within the ide
good luck
naides
01-13-2004, 08:15 AM
Are the files open as binary or text mode?
_ColdMind
01-14-2004, 01:41 AM
I get the same result in both text or binary. When it try to compare that two files the original and the craked one I see a lot of pages filled with zeros. Maybe Hiew (the hex-editor I have used to patch that file) recalculates the crc32 (cyclic redundancy checksum).

Do you say it must works.
ZaiRoN
01-14-2004, 03:48 AM
Do you say it must works.I tried your snippet on both text and binary files and it works.
Don't know if the problem is related with the hex editor you have used (hiew in your case), try to use another one and retry...
TQN
01-14-2004, 10:10 PM
Hi _ColdMind !
Base on your code, I revise, debug and rewrite it. The code works fine. I compiled with BCC 5.5.

// Compare.cpp
#include <stdio.h>
#include <stdlib.h>
#include <conio.h>

void main(int argc, char *argv[])
{
if (argc != 3)
{
printf("Invalid command line.\n");
return;
}

FILE *f1 = fopen(argv[1], "rb");
if (NULL == f1)
{
printf("Could not open first file %s\n", argv[1]);
return;
}

FILE *f2 = fopen(argv[2], "rb");
if (NULL == f2)
{
printf("Could not open second file %s\n", argv[2]);
return;
}

int ch1, ch2, j = 0;
unsigned long int i = 0;

do {
ch1 = fgetc(f1);
ch2 = fgetc(f2);
if (ch1 != ch2)
{
printf("\n%08X:\t%02X\t%02X", i, ch1, ch2);
if (0 == (++j % 24))
{
printf("\n -- page %d -- more --", j / 25);
getch();
}
}
i++;
} while ((EOF != ch1) && (EOF != ch2));

fclose(f1);
fclose(f2);

printf("\n-- end --\n");
}

Hope you will test it.
Best regards!
TQN
elfz
01-15-2004, 09:14 AM
} while ((EOF != ch1) && (EOF != ch2));

maybe I'm wrong, but shouldn't you use "while (!feof(f1) && !feof(f2))"
instead? If you're working with binary files, it's very likely that you'll encounter "EOF" (1ah ASCII, if i remember correctly) in the contents of the file, and the comparison will end there.
ZaiRoN
01-15-2004, 09:59 AM
Hi elfz,
but shouldn't you use "while (!feof(f1) && !feof(f2))"You can use both; EOF is -1
_ColdMind
01-16-2004, 04:04 AM
Thanks a lot TQN. Your code works.
Yes, both (!feof and !=EOF) can be used but I like EOF more.
There is a little problem: %X print short int I sould use %lX
---
The topic is about a patcher. I have used fseek to seek to the given offset and fputc to put the given opcode. File is patched but it runs like unpatched.
ZaiRoN
01-16-2004, 04:09 AM
I have used fseek to seek to the given offset and fputc to put the given opcode. File is patched but it runs like unpatched.Can you post your code?

ZaiRoN
_ColdMind
01-16-2004, 04:37 AM
This is the code

#include <stdio.h>

char *file="pstudio.exe";

int patch(long offset, int opcode);

main() {
patch(0x00439F9B,0x74);
patch(0x00439FA5,0x74);
patch(0x004830DC,0x84);
patch(0x0048AAFB,0x84);
patch(0x0048E0D5,0x85);
patch(0x00497D04,0x75);
patch(0x004BA952,0x75);
patch(0x004BA977,0x90);
return 0;
}

int patch(long offset, int opcode) {
FILE *f=fopen(file,"r+");
printf("%X %X", offset, opcode);
fseek(f,offset,SEEK_SET);
fputc(opcode,f);
return 0;
}

Maybe the prototype should be:

int patch(unsigned long offset, int opcode) ;
ZaiRoN
01-16-2004, 05:26 AM
Hi _ColdMind,
Your error resides in this line: fseek(f,offset,SEEK_SET);
int fseek(
FILE *stream, ; Pointer to FILE structure.
long offset, ; Number of bytes from origin.
int origin ; Initial position.
);The 'offset' parameter represents the number of bytes from origin (the classical definition of 'offset') and not the Virtual Address of the instruction to patch. You have to convert all the VA into offset and then pass them to your 'patch' function.

Another little thing: the file is opened every time you need to patch a byte but it's not closed, you should close the file using fclose function: fclose(FILE *);
You can open the file at the beginning of the main procedure, apply all the patch you need, and then close the file (at the end of the main procedure).

Maybe the prototype should be...No...

Best regards,
ZaiRoN
doug
01-17-2004, 10:53 AM
you should also considering using some error checking code.
i.e: return values of the functions you called..

In most cases, that can help you pinpoint the location of your bug rapidely. and well, it's generally a good thing to do:)
_ColdMind
01-18-2004, 04:48 AM
Hi all.
Thanks a lot for help. I am so inattendive sometimes. All the problemes were solved. I know that I must close every opened stream and handle errors but it was happened because I wrote the entire code on the flow at school once I have posted the message. The original source file on my home computer is great. I used a bidimensional array to store patch offset on the first line and the patch opcode on the second line and parse it in the main function, so this program is faster. I have discovered that the file offset is not the same thing as that address showed by my disassembler after I have posted. Thanks and forgive my absent-mindedness.


SoftIce stopped breaking at all
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SoftIce stopped breaking at all
PDA

View Full Version : SoftIce stopped breaking at all

id6262
01-13-2004, 08:51 AM
Hi,
First it wasn't breaking only with msvbvm50.dll API. But after some time it stopped breaking even with kernel32.dll API.
Then I type "bpx GetSystemTime" and then "bl", I see "00) BPX #00FE:000069F9". Earlier this behaviour was only with msvbvm50.dll API - kernel32.dll API was displayed correctly "00) BPX GetSystemTime".
Even in code window I cannot see "call GetSystemTime", etc. anymore - I only see "call 12345678" instead :(
Any clues?
evaluator
01-13-2004, 03:28 PM
00FE happens on XP, ye?

mostly, to avoid this, start NTICE manually, soon after desktop starts.

also, you can get back exports, if you will unload-reload them in Loader32.
id6262
01-14-2004, 02:45 AM
I have Windows 2000.
You are right - if I start SoftIce then system starts, I cannot see kernel32 symbols, but if I start SoftIce manually, kernel32 sybmols are visible.
But problem with msvbvm50 still remains :rolleyes:
I also noticed, if i reboot machine, start VB program and only after start SoftIce - msvbvm50 symbols are visible!!! But this works only one time after machine reboot :( If I close vb program and run it again - msvbvm50 symbols not visible anymor
id6262
01-14-2004, 02:51 AM
00FE happens on XP, ye?

mostly, to avoid this, start NTICE manually, soon after desktop starts.

also, you can get back exports, if you will unload-reload them in Loader32.

What do you mean by "also, you can get back exports, if you will unload-reload them in Loader32"?
evaluator
01-14-2004, 03:37 AM
:-

well, when you start Numuga's program Loader32 (NTICE is active),
then it shows list of DLLs, which's exports are loaded.

Then_IF some DLL's exports looks bad, you can remove & load again..
id6262
01-14-2004, 04:15 AM
If you are talking about [Loader32 menu] -> [Edit] -> [SoftICE Initialization Settings...] -> [Exports], this wouldn't help, because these settings are only interface to Winace.dat file. After changing setting it is needed to reboot machine to apply them.
evaluator
01-14-2004, 04:43 AM
:--

maybe you try better read what i wrote??
id6262
01-14-2004, 05:03 AM
I am sorry. I started working with SoftICE, assembler instructions and other cracking stuff 2 days ago :confused:. Could you explain me in more details?
evaluator
01-14-2004, 05:22 AM
well, if you are 2-day old newbie, read&read tutorials for newbies.
Read included Softice DOCUMENTATION,
ask quetions after about 1-2 month.
Aimless
01-14-2004, 05:52 AM
Ok,

Since you are supposed to be learning on your own, I won't spell it out explicitly, but do some research and its going to be OK.

1. You have to be in the correct context to break.
2. msvbvm50.dll is for OLD versions of visual basic. So its probably best to include the dll into your exports.
3. Then do what Evaluator told you to. If exports are bad (prolly corrupt), reimport the entire dll. If same problem persists, search google for bundles of vb runtime dlls for v5.

But in any case it still does not work then:

1. Disassemble msvbvm50.dll using IDA
2. Get a list of functions marked (EXPORTED) by outputting a map file
3. Use IDASYM.exe to get the SYM and convert to NMS
4. Import table into Loader. You're done.

Maybe you also need to try and use Smartcheck ya? (ya? = Cameron Diaz in Charlie's angels, initial bullwhacker scene) YA!

Have Phun
id6262
01-14-2004, 06:51 AM
Thanks, for hints :). I definitely will follow them.
But first I am going to install newer version of SoftICE - in russian forum I found that this could be some kind of SoftICE bug.

P.S.
Smartcheck doesn't help much me in this case. It shows code, but I can't find what I need in this code. Maybe after 2 months of RTFM I will take a look at this code from different angle and will find what I need :).
id6262
01-14-2004, 09:08 AM
Finally it works!!! :)
I installed SoftICE 4.2.7.
Loader32 from this version allows to load/unload exports.
So each time I run my VB program, reload msvbvm50 and see symbols clear.
With my older SoftICE 4.0.5 version loader32 I was able to load, but I was UNABLE to unload exports...


The bios
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > The bios
PDA

View Full Version : The bios

Hatem Al-Naggar
01-13-2004, 11:54 AM
I'm trying to disassemble the bios of my PC using IDA
I don't know what offset to consider the code start
Does any 1 know this?
Can any 1 tell me what words should I use for searching at search engine
My searches didn't get any results
disavowed
01-13-2004, 12:53 PM
http://www.dogukancanakkale.com/other_rom.asp


SVKP for Developers USE ???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SVKP for Developers USE ???
PDA

View Full Version : SVKP for Developers USE ???

OHPen
01-13-2004, 12:11 PM
Lo folks,

atm i workin' on an interesting target. Main_App is protected by PCShielh which is not the problem. But programm provides also many different dgb checks. I have IceExt installed and the programm is able to detect sice installed, running or not...
Intersing tho is that there is an app called antidbg.dll which is managing all thoses debug checks. After examin the file i found some interesting string - > " Anticracking.sk" i tried PEiD to idetify whether its svkp but it doesn't detected it.
So i ask you whether there is a SVKP-DevelopersKit zu implement SVKP from soucecode on.... ?

regards,

OHPen
evaluator
01-13-2004, 03:33 PM
maybe you will find info about it on SVKP's web-site!???
or contact author by e-mail!???
doug
01-13-2004, 05:49 PM
there is indeed an svkp SDK, you can get the files + sample src code from the Trial version..

Afaik, the svkp api functions are done as follow:
- you write your app using a "dummy" svkp dll that exports all the functions (but the code in that dll is just a 'ret' really)
- compile, test, etc.
- when you protect your file, the dummy dll is removed from the import table (so its not actually distributed with the protected file), but the array of pointers in the import table is kept in place (which are still referenced by code)
- when you run the app, the guard module patches those values to code that was unpacked in memory (before the oep was reached).

SVKP author also wrote a book, something like "Crackproof your software", so they might have used some of his source code.
OHPen
01-14-2004, 09:04 AM
@doug

thx for your answer, maybe i will play a bit with this SDK in order to understand the protection a bit better.

regards,

OHPen
separator
01-14-2004, 04:10 PM
I think you can check anticracking.sk for AntiCracking’s Anti-Debugging Library.


Some respond to this one. Don't just view my ignorance
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Some respond to this one. Don't just view my ignorance
PDA

View Full Version : Some respond to this one. Don't just view my ignorance

kataklismic
01-13-2004, 12:47 PM
How do you get servers to reviel or how do you get into servers cgi's?

be gentle.
Mr. Blue
01-13-2004, 01:34 PM
You don't.
dELTA
01-13-2004, 04:50 PM
Since this would in most cases be prevented by design, you would have to hack the server in question, or at least exploit some web server vulnerability or similar to view the source of cgi and other web scripts.

And Mr. Blue, we can do quite well without replies like that...
Mr. Blue
01-13-2004, 06:03 PM
Sorry, I meant no offence. This was the short version of what you've said above. And then, this is not a place where we discuss this kind of stuff...
Woodmann
01-13-2004, 07:01 PM
Howdy,

I agree with Mr. Blue for the most part. I dont feel comfortable having
that question asked here without some further explanation. Plus it should be in off topic <where it magically re-appears :)

Are we trying to exploit some CGI script ?
Is this purpose a part of a challenge that will not harm anyone ?

Do tell us ;)

Woodmann
UrgeOverKill
01-13-2004, 11:10 PM
I believe this is the classic grey area between cracking and hacking. :D
Aimless
01-14-2004, 12:36 AM
Either kataklismic wants to leech porno images for free (hey Kat, there are soooo many other ways to do it than to simply hack passwords/cgi. Go to www.searchlores.org to se how to do the same)

OR

He is really trying to exploit vurnebility in one of the newfangled web servers, in which case, you have to let us know what exactly are you planning to do and how much progress you have done so far.

One-liner questions are good in Arnold Schwarzenegger movies. They are not, on a RCE board.

Have Phun
JMI
01-14-2004, 12:42 AM
Speaking of one-liners: "Go ahead, make my day." :cool:

I agree we should not encourage people on this Board to discuss breaking into other people's servers, although I conceed it is a definite "grey area" to distinguish between hacking someone's code and there server, but it somehow "feels" different.

Regards,
evaluator
01-14-2004, 04:51 AM
TURBO sarcasm:

It will good idea to dedicate for HACKING NEW FORUM!!
All other posts regardless hacking will go to Advanced,Nuwb..-forums
UrgeOverKill
01-14-2004, 08:58 AM
Actually, it's not all that difficult to hack ones server to get to the vital areas. Although IMHO I view this board more on the programming side of things, this discussion should really be elsewhere. There are tools out there for this, and if your handy, you can make them yourself. Extensive knowledge is required of networking and systems architechure, something you cannot just learn quickly. Of course IT managers set up there systems differently, so fingerprinting is a must and be prepared to spend alot of time, uh learning. ;)
disavowed
01-14-2004, 02:35 PM
I believe this is the classic grey area between cracking and hacking. :Ddoesn't seem grey to me. seems like hacking

and evubulat0r, very funny :D
JMI
01-14-2004, 08:23 PM
I see +Spla/\ has coined a new nickname for our Musician Friend. :D I hope it is "self gratifying." You would have to have read the other thread, where this name first appeared to get the "reference." :cool:

Regards


Dll protection with Digital Signature
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dll protection with Digital Signature
PDA

View Full Version : Dll protection with Digital Signature

peterg70
01-13-2004, 07:49 PM
I have a DLL that is used as part of webpage (ASP code). This DLL now shows a Expired Now please purchase information. So I thought bring out trusty debugger and have a look see.

The following Information I have found out.
1) the DLL is called when required by the webpage via Inetinfo (Personal Webserver). No significant registry checks are conducted.
2) Filemon shows no weird activity License file etc
3) DLL is digitally signed by Verisign. Sign Algo md5RSA RSA (512bits)
It has a 'Valid from' and 'Valid to' date
Also a 'Signing Time'
4) DLL is written In Visual Basic 6.0 (PEid)
5) Found expiration Date after installing today is 1 March So more than 30 Days. (moving Date forward Produces 'Please Register Me Option'. Moving Date back clears the Please Register Me.)

So question is what method of attack is going to work.
Can the Dll use the Digital Signature Date Information to check for expiration.
Can the Digital Signature be removed.
What information is entered into the registry when you regsvr32 the DLL.
Is an installation date stored anywhere in the system???
How do you patch a digitally signed DLL?? (no loaders to path memory)

Actually debugging is also interesting. What method of investigation will lead me down the path

Peterg70

Edit: Does anyone have a listing of the Functions contained inside the MSVBVM60.DLL file. Something Like an API reference file. Name,ShortDescr,Arguements,Return
disavowed
01-14-2004, 02:38 PM
why not just disassemble and trace back from the string reference to "Expired Now..." to see what caused the app to reach that point in code?

Edit: Does anyone have a listing of the Functions contained inside the MSVBVM60.DLL file. Something Like an API reference file. Name,ShortDescr,Arguements,Return
use google
zacdac
01-14-2004, 10:30 PM
g'day peterg70

>> Can the Dll use the Digital Signature Date Information to check for expiration.
Yes.. you can programmatically check for and retrieve information from a digital signature/certificate.

>> Can the Digital Signature be removed.
Yes.. but it depends on the implementation.

>> What information is entered into the registry when you regsvr32 the DLL.
The dll is implemented as a COM object. regsvr32 registers (makes available) the COM object to windows. Basically a class id (clisd) is entered into the registry with the location of the object, its name, threading mode, program id etc. Other data can be found here, but it depends on the object..

>>Is an installation date stored anywhere in the system???
Not sure what you mean, but the dll probably implements its own date check scheme.

>>How do you patch a digitally signed DLL?? (no loaders to path memory)
Depends on the implementation..

>>So question is what method of attack is going to work.
>>Actually debugging is also interesting. What method of investigation will lead me down the path

As it is a COM object, you use the dll in any development environment that allows access to COM objects.. for example VB.. This will allow you to load the object and access/call its properties and methods.. You can also make an executable that calls the dll to debug it.. However not all methods may be accessible/triggered because it wants a webpage.

Zac


:( SoftICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > :( SoftICE
PDA

View Full Version : :( SoftICE

Dav
01-14-2004, 12:58 PM
I'm a beginner in the assembly language. I have softice 4.05 NT installed on Windows Xp Pro.
The softice has all the patches and fixes but still when i use BPX HMEMCPY i get an error "Symbol not defined". And the address of the memory always starts from 806.. instead of 040..

Please, Help me :( :( :(
LOUZEW
01-14-2004, 01:08 PM
Hi, Dav

HMEMCPY Don't exist under XP ! ! ! !
Dav
01-14-2004, 02:37 PM
What about addresses that always starts from 806.. instead of 040..?
Can you help me?

Thank you. :)
naides
01-14-2004, 03:23 PM
What about addresses that always starts from 806.. instead of 040..?
Can you help me?

Thank you. :)

code window addresses starting with 80....(Like 80637B3B) are high in the OS reserved memory and dlls. Look into the lower right corner of Sice window and you will see which mod you are in. more than often it is Idle or something like Kernel32 USER32, something like that.
To see addresses 040. . . which belong to the application memory space you need to break inside the application, or trace until you are back into the application space (use F11 or F12 in Sice). Another way to set your feet into the application space and code is to use the Sice symbol loader, select your app, and select the option to break at the application entry point(WinMain). Read the Sice manual and look inside this board.
JMI
01-14-2004, 08:17 PM
And Softice NT 4.05 is a little old for Win XP Pro. There are plenty of threads to read here about Softice and XP. Check some of them out before you make a switch.

Regards,
Aimless
01-15-2004, 12:46 AM
Softice 4.0.5 + Windows XP = Nitro + Glycirine

Be careful, it'll go boom

Best bet is to leech driver studio 3 from somewhere...

Have Phun
Aquatic
01-15-2004, 02:01 AM
Or just get Ollydbg.


problem with hasp4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > problem with hasp4
PDA

View Full Version : problem with hasp4

nalsur8
01-15-2004, 03:42 AM
i have one program using HASP4 M1 white color
but is not *.exe file it's running with autocad
is't can make emulator or crack the program??
and how to start basically..
ZaiRoN
01-15-2004, 05:36 AM
Hi nalsur8,
this *request* seems to be equal to the one you have made in your previous post:
http://www.woodmann.net/forum/showthread.php?t=5270

Have you read some tutorials about hasp? Which are the info you gained from this protected program? If you want to see some replies you need to give more and more details...

best regards,
ZaiRoN


Unpacking Skype...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Skype...
PDA

View Full Version : Unpacking Skype...

roibm
01-15-2004, 03:27 PM
Hi guys,

does anyone know what packer is Skype(wxw.skype.com) using?
I can dump on it, but the exe has to be rebuilt or something, because I get an error as soon as I start the dumped exe.
Also, it looks like it has a pretty good anti-sice scheme(al least too good for me)

Could someone help with the matter?

thanks...
JMI
01-15-2004, 10:01 PM
Have you attempted to use any of the many PE identifiers on the program to determine if one of them can identify the packer? If you unpacked it, did you fix the import table? Generally, that step is necessary is it is using a commercial packing program designed to prevent unpacking.

Regards,
doug
01-15-2004, 11:56 PM
i looked briefly, it didn't seem to have anything else than MeltICE tricks (but using CreateFileW)... checks are executed twice on startup.

for a 1-click solution, try iceExt.
Shoob
01-16-2004, 11:57 AM
I think its a small homemade which cosists of some standard produces like ice check like doug said (No Compression). API's aren't crypted so after all its crap example:

0063718A 74 05 JE SHORT XXX.00637191 ; je after decryption
0063718C 83C2 04 ADD EDX,4
0063718F ^ EB D0 JMP SHORT XXX.00637161
00637191 E8 1E010000 CALL XXX.006372B4 ; debug check
00637196 84C0 TEST AL,AL
00637198 74 1C JE SHORT XXX.006371B6 ; je to MEP or die
0063719A 6A 00 PUSH 0
0063719C FF35 D4FF9100 PUSH DWORD PTR DS:[91FFD4] ; Skype.006370F4
006371A2 FF35 D8FF9100 PUSH DWORD PTR DS:[91FFD8] ; Skype.006370FC
006371A8 6A 00 PUSH 0
006371AA E8 1110DDFF CALL <JMP.&user32.MessageBoxA>
006371AF 6A 01 PUSH 1
006371B1 E8 BA04DDFF CALL <JMP.&kernel32.ExitProcess>
006371B6 BA 011E1600 MOV EDX,161E01
006371BB 81C2 D39A7B00 ADD EDX,XXX.007B9AD3
006371C1 52 PUSH EDX
006371C2 BF 3C716300 MOV EDI,XXX.<ModuleEntryPoint>
006371C7 B9 D2716300 MOV ECX,XXX.006371D2
006371CC 29F9 SUB ECX,EDI
006371CE 31C0 XOR EAX,EAX
006371D0 F3:AA REP STOS BYTE PTR ES:[EDI] ; rep. 185byte
006371D2 E8 113F0100 CALL XXX.0064B0E8 ; xor eax
006371D7 C3 RETN ; retn to OEP


newbies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > newbies
PDA

View Full Version : newbies

doug
01-15-2004, 05:34 PM
Did anyone else notice the board is getting crowded with a lot of newbies recently? Did some newbie board close and they all end up here?

Recently, I've noticed the board got more than its share of:
- softice install problems
- softice "won't break" type of question. (and more similar Q's on v3.0)
- anti-ntice questions
- does anyone know the packer on this
- does someone know how to unpack this: <name of app>/<name of packer>?
- dumped exe crashes/invalid exe format (ie trying to run a dumped-straight-from mem exe)

There is a very strong correlation between the post count (usually 1) of those users and the chance the user posts on one of the 6 topics listed above.

I realize we've all been there, but I also do realize that there's a search button with answers to _ALL_ of those questions (and more).

I believe this board has a lot of skilled contributers, and an overall positive attitude (no flame wars, etc..) ... better than any public board i've seen so far... I feel that too many of those newbies post might kill 'the spirit' :P

any thoughts on that? anyone else feels this way?
disavowed
01-15-2004, 06:25 PM
i agree. we should program a new rule into the board so that you can't post until you've already posted at least 10 times or so. oh wait, that wouldn't work...

seriously though, i agree that this has been a problem of late. however, i'm not sure how to fix it. maybe program in a delay, so that you have to wait 2 weeks after you register before you can make your first post? maybe that will force newbies to search for their answers instead of asking others at the first sign of "trouble".

perhaps this would be a good thread for people to post such suggestions on how to mitigate this problem
sgdt
01-15-2004, 07:01 PM
I have a solution.

Move the "Post Message" button to the "Search Forums" dialog!

Problem solved... :)
JMI
01-15-2004, 10:15 PM
We do not want to completely discourage the new users from making their attmepts. Those of us who have the responsibility of reminding these folks about our rules try to do so in such a way that it reinforces their habits for the better.

Many of the first timers who come here believe their need for the answer to their question outweighs all other consideration. Only a few take much effort to even look around before the begin to post, but many of them are also very very young and have alot to learn about patience and the denial of instant gratification.

We attempt to push them in the right direction, without a complete frontal lobotomy. Only after repeated failure to observe the rules do we apply more drastic measures. Many of you don't even see many posts which are removed shortly after they are posted because they have no "redeeming usefulness" or are openly crack requests.

Regards,
Fake51
01-19-2004, 05:29 PM
Whoa?!?!?! WTF happened?? COMPLETELY DISCOURAGE?!?! Seriously, wtf is wrong with you guys? Get off your shitty high horses and realize no new blood = inbreeding. As if the board isn't dead enough as it is.

Fake
Note: people that don't search are a nuisance, agreed - but wanting to discourage newbies?? Come on.
sgdt
01-19-2004, 07:00 PM
Ack! I don't think ANYONE wants to discourage inexperianced users from posting, and I believe everyone wants there to be more people on the forum.

The original issue was the same questions being posted over and over again, with the poster taking no time to research if they were experiancing a common problem.

I had (jokingly) posted that moving the Post Button to the Search Forums dialog would prevent such posts. The logic being that people who are phobic about the search button would never even see the post button, while people who of a more Google'ish nature would feel right at home...

It can be frustrating when you see an entire page of new subjects that all read pretty much the same things... Kind of like kids screaming "Are we there yet?!?!?" when you haven't even left the city.

But again, I don't think anyone is intentionally discouraging new people.
JMI
01-19-2004, 07:09 PM
It would appear Fake51 that you are applying to others. character traits which you, yourself are exhibiting. I have no high hourse and was referring to "discouraging" newbies who attempt to make a first post without reviewing our rules and in obvious violation of them.

I have no interest in or penchant for "discouraging newbies" as a group. I do have an interest in having them, and everyone. attempt to help themselves before they ask for help, and in getting people to attempt to find their own answers before they ask. But those are the rules here, which, although I did not create them, I fully support.

And if you find the board "dead enough as it is" I simply remind you that you are under no complusion to make an appearance here and are always free to journey elsewhere where you might find things more to your preferences.

Regards,
Woodmann
01-19-2004, 09:38 PM
Howdy,

I think the bigger problem is that most of these age old questions
are not asked in the newbie forum but asked in the tools forum.

I think that most people understand that your post needs to be in the correct forum but, if you can get Si to work and get your prog to load,
you should be able to press the search button.

The newbie forum even says to search first before you post.
This should apply to each and every forum.

The newbies forum is for new learners. Perhaps I should further explain that new learners are people who have zero knowledge in RCE. The intent is to search, read, then ask your question.
For me it has gotten to the point where I dont even read past the first line of most of the unpacking post's. I am quite sure there are many who have their favorite forums and cannot stand some of the others. Redundancy sucks.

The rules are pretty much universal, the lamest posts get the bash.
This place is no different.

As a matter of fact, I hate people who post in the newbies forum with more then 25 posts to their name. If you have been here long enough to have 25 posts then you should know how this place works.

I beg that each and every one of you who are new to RCE do just one thing,
quote at least one reference that you researched in regards to your problem.
It really would make your life easier when posting.

Woodmann
Fake51
01-20-2004, 07:13 AM
Guess I was a bit tired when reading+replying. I'll be the first to admit how annoying it is when people don't take the time to search for obvious answers. Reading "We do not want to completely discourage the new users from making their attmepts." got my blood going, however. It seemed a bit broader than "We want them to learn how to search". Anyway, my apologies, got it wrong, I guess.

Oh, and as for: "And if you find the board "dead enough as it is" I simply remind you that you are under no complusion to make an appearance here and are always free to journey elsewhere where you might find things more to your preferences. " Spare me the crap. I've been here long enough to remember what a lot of RE activity means. Woodmann's forum is a good place, and it's a friggin shame that the amount of activity isn't bigger.

Oh well, nuff blunders for one day. Apologies offered.

Fake
disavowed
01-20-2004, 09:25 AM
fake51, congratulations on your 100th post
Fake51
01-20-2004, 10:00 AM
fake51, congratulations on your 100th post

Cheers.

Fake
JMI
01-20-2004, 01:28 PM
No apology was needed and the offer was more than sufficient.

My own response to which you originally replied was part of a series of similar responses to criticisms of newbie posts, such as this one:

http://66.98.132.48/forum/showthread.php?p=31988#post31988

where I was actually attempting to dampen some of the impatience with the tendency of first time and/or younger posters to not pay attention or review the rules or try to help themselves.

In both the previous thread and in this one some of the same members were suggesting drastic measures against these posters and it was in that "context" that my comment was framed. Just so it is clear, I do encourage as broad a base of contributors as possible and actually spend a fair amount of time trying to "encourage" the newbies towards the proper path of searching and thinking first and then posting, rather than that they just go away. To the extent that my comments left an impression that I was advocating something else, then the error was my own.

Regards,
esther
01-20-2004, 10:35 PM
This has been discussed since many years ago.New comers should recieve forum rules after the registered here(if I'm not outdated hahahaha).
They should read it before posting anything here.I can't see any good solutions,what can we do is the remind,flame,delete the post if necessary.

I dunno if its possible to "make" them read the faq everytime they login(new comers) for at least 3 months.Crusader & I has suggested in the past but dunno if its workable?

Regards
Woodmann
01-20-2004, 10:59 PM
Howdy,

We have already done as much as we can. The posts are
far better then they were 2 years ago. This is a good thing. :)

Woodmann


VOB ProtectCD V5
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VOB ProtectCD V5
PDA

View Full Version : VOB ProtectCD V5

swoop
01-16-2004, 04:38 AM
Hi,

does anyone has a tutorial or infos about this "new" version?
The only tut i can find is the old one done by r!sc and this
is a bit outdated :rolleyes:

I only want to collect some informations before i start a
reverse session :D

swoop
disavowed
01-16-2004, 09:32 AM
i know this is not what you were looking for (it's v3 instead of v5), but it's another essay other than the one by r!sc: http://216.239.39.104/search?q=cache:Q6rAKTOxnYUJ:rooy.webcindario.com/ECD/vob3.htm

maybe it will help a tiny drop
swoop
01-18-2004, 02:26 PM
i know this one...well my spanish is not that good :)
but anyway thx :)

swoop
swoop
01-29-2004, 09:45 AM
ok I had a deeper look into this protection, it seems ProtectCD v5 uses the fameous stolen byte technique. I have some trouble finding the oep or to be more precise the end
of the protection. I found something which could be the oep
but a bpm didn't work.
Does anyone have any experience with this new version?

Btw. the traget is Castle Strike.

swoop
nikolatesla20
01-29-2004, 03:13 PM
Why don't you dump the proggie and attach to it the best IAT rebuilt you can. Even if you can't rebuild the entire import table you can usually rebuild enough of it to allow you to see where the normal startup code for most programs is.

Most programs start with GetVersion, or __set_app_type (for MFC apps), or VB starts with a "VB5!" string, and suchlike.

If you become more familiar with the startup code for most common compilers out there you should be able to find a very good guess at the correct OEP location using this method. (Rebuild IAT as best you can, dump program from memory, attach IAT with revirgin or ImpREC, disassemble and examine for typical entry codes).

If you suspect stolen bytes, once you've found the oep area, try just pointing the program entry point to the beginning of the oep area and forget about the stolen bytes. 90% of the time it will run fine anyway.

-nt20
ajron
02-01-2004, 03:53 PM
ok I had a deeper look into this protection, it seems ProtectCD v5 uses the fameous stolen byte technique. I have some trouble finding the oep or to be more precise the end
of the protection. I found something which could be the oep
but a bpm didn't work.
Does anyone have any experience with this new version?

Some months ago I had removed this protection from skijump2003, but unfortunately I hate to take notes ;). What I remember is (it's true for the win9x):

1. Protection create second instance with CreateProcess(), which is the right one. You can catch this by bpm GetVersion.

2. OEP has stolen bytes, but most of programs has standard stub at OEP ;)

3. I found OEP with my favourite macro ;) break = "bpr %1 %2 rw if(eip>=%1 && eip<=%2)" with %1 equal to imagebase and %2 below protection section. ProtectCD has some code to fool this (in 1 or 2 places - I don't remeber) which is executed in real program range, so you must skip this.

4. Protection use API redirection and emulation

5. Protection has anti-debug tricks which is no problem whith icedump ;). int 3 handler checks debug registers.

Maybe it is useful information or maybe not ;). I hope you can understand me, because I know that my english is horrible ;).

--
Pozdrawiam,
Ajron.
swoop
02-01-2004, 05:41 PM
thx for the replies...
right now i have dumped the prog but i stuck in rebuilding the iat and
fixing the pe header.
this is what i have done so far:

1. bpm getversion
which pops up several times i clear this bp after the protection has
checked the cd
2. bpm createthread
at the first break on this function i returned immediately so the thread
wasn't started
3. used icedump's tracer to find oep at 0x6826CC
4. set a jmp eip ( proctedcd's antidumper thread isn't active now :)
5. dump the whole process with lordpe or any other dumper
6. try to fix iat with importrec
7. fixed some imports manually

so far so good...but if i try to load the fixed dump.exe e.g. in ollydbg
i directly jump into some kernel32 function (maybe getVersion)
the imagebase and ep are correct...
any ideas?
swoop
02-03-2004, 02:39 PM
doh :)
import tables weren't correct fixed that and now it's working...

anyway thanks for the hints


Marx Cryptobox dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Marx Cryptobox dongle
PDA

View Full Version : Marx Cryptobox dongle

balauru
01-16-2004, 08:46 AM
Hi guys,

I have a program protected by this dongle. Dongle driver name is mpiwin32.dll, it have stupid exports like "No Marx device attached", and so on. The problem is that this mpiwin32.dll is created somehow by the main exe of the program. I have deleted all mpiwin32.dll from my computer, but when i launch the exe, it's creating in Documents and Settings\Administrator\Local Settings\Temp this dll. Created file name is not mpiwin32.dll, it's something like 985464687879454.tmp (every time it have a different number).

Any ideea how can I see if this dll is embeded in the main exe file? and if it is, how can I replace it with a cracked one?

Thanks for your help
balauru
OHPen
01-16-2004, 11:12 AM
You can do it like that...

First delete all m*.dll from your system
Start the app
Crack the dll created in the temp dir
and change attribute in the way that it can't be overwritten and thats it...
If you expect that the dll is IN the app it have to be joined together with it.
And then there is need to dump the files from memory in order to create a workin one...

regards,

OHPen

PS PM me your target please, i will take a look at it...
Mr. Blue
01-16-2004, 11:16 AM
Well, you can try setting a breakpoint on CreateFileA. When your debugger breaks check the arguments passed to the CreateFile api (the first argument is the file name) - then when you find the call that creates the dll file you can trace back to the caller and see whats going on there.

Once you have found the code that writes the dll you can try to disable it so it wont extract the
dll each time it is run. Then you need patch the prog so that it will load your cracked dll.
CluelessNoob
01-16-2004, 01:30 PM
Hi guys,

Any ideea how can I see if this dll is embeded in the main exe file? and if it is, how can I replace it with a cracked one?

balauru

One (simple) possibility is that the DLL is stored in the resources section.

If the main EXE is not protected, try using a resourse editor (Resource Hacker) and see if you can find the DLL.

If its a resource, and you can extract/replace resources the finished product might be easy to re-assemble.

Removing the protection is a different matter.

Good Luck.


"Cleanest" way to add DLL functions? Looking for an imports editor.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > "Cleanest" way to add DLL functions? Looking for an imports editor.
PDA

View Full Version : "Cleanest" way to add DLL functions? Looking for an imports editor.

Six Black Roses
01-17-2004, 11:53 AM
I have an executable that I want to add a DLL function to. If the executable doesn't already have an import table, I want to create one. I want the addition to be as native as possible--which means I'm not interested in any LoadLibrary schemes.

The machine code for a function call, MessageBoxA for example, is like this:

00402000 PUSH lastParam
00402001 PUSH secondParam
00402002 PUSH firstParam
; Call to MessageBoxA
00402003 CALL 00403000
...
; Call to MessageBoxA
00403000 JMP dword prt [87654321]

What happens when Windows load the executable is that the DLL, in this case User32.dll, is loaded into the virtual space of the executable, and the address at 00403000 is patched to jump to the correct location in User32.dll.

What I'm looking for is a utility that will do nothing more than look for an existing import table, and if one doesn't exist create it, then add the proper information to the PE header and import table to accommodate for the newly added function. Then I want it to place an instruction like at 00403000 somewhere in the executable and then tell me where it is. All that is to be set up so that the Windows loader will patch that instruction to jump to the correct place in the DLL.

After I add the function to the executable, I'll be able to call it by simply pushing the parameters and CALLing the JMP instruction that jumps to the correct place in the DLL.

I hope I was clear enough. So is there a utility out there like it already? What is it?
disavowed
01-17-2004, 05:32 PM
lordpe allows you to add imports to a pe


PE Format HTML
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PE Format HTML
PDA

View Full Version : PE Format HTML

D-Jester
01-17-2004, 01:34 PM
I converted some of the various PE Tuts to HTML with a TOC. I use it, maybe someone else can get some good out of it. If you have something that you think should be included, please email it to me d-jester(at)execs(dot)com
Js
01-17-2004, 09:41 PM
appreciate you sharing it, thanks.
Kayaker
01-17-2004, 10:51 PM
Nice one D-Jester, thanks for the contribution.

I noticed in the attachment of [yAtEs] Understanding Import Tables, you mention that there is supposed to be an included file but the link referenced in the orginal essay is broken. If you are interested the file is here in the Board's archives at:

http://www.woodmann.net/IDArchive/ID-RIP/database/essays/yates/blah.EXE

Another file you might consider including, a nice summary by FatboyJoe I've always found useful is this one,

Exe file format with offsets rather than explanations
http://www.woodmann.net/IDArchive/ID-RIP/database/essays/fboyjoe/exe_hdr.html

In the same general area, this one by TiTi is also very useful,

PE Files Import Table Rebuilding
http://www.woodmann.net/yates/rebuild.txt

Cheers,
Kayaker


Its me again :) SoftIce prob
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Its me again :) SoftIce prob
PDA

View Full Version : Its me again :) SoftIce prob

quetzalcoatl
01-17-2004, 02:57 PM
a week after "solving" "3 small or 1 big prob" i managed somehow to ... well, lets say i have almost just the same problem as back then.

almost because: now i dont have a firewall and SI's log shows no errors
the same 'cause: the keyboard hangs up when mouse is moved, or when mouse sends a 'ping' to the motherboard /or windows, whatever../

history:
it seemed quite strange to me that uninstalling firewall solved the problem, earlier but i didn't investigate as the SI worked just as it should (even breakpoints were ok without applying anything). i have installed something completely harmless (i have checked later), uninstalled it, then after a few days tried to launch SI - bang, keyboard got crazy again.

found:
EVEN with USB mouse unplugged, keyboard driver gets damaged on SI startup. EVEN with USB mouse unplugged and uninstalled form the system.
SoftIce all the time claims in the log to have found "PS/2 Mouse"
[NTICE: PS/2 Mouse Detected]
It finds it even when the mouse is unplugged.
Ideas that it has something to do with option Mouse=PS/2_or_USB (either enchanced or not) or MouseSupportEnable or DisableUSBMousePathcing or DisableUSBKeyboardPatching or DisableNumlockProgramming - spare me. I have really tried every possible combination (there are exactly 64 combinations).

Whats more funny, on PS/2 i have .. keyboard. So its obvious that once SI detects mouse on PS/2, and theres keyboard, and mouse is on USB, something must crash on mouse movement. without mouse, keyboard works well until numlock, or one of several other keys are pressed - then it hangs.

I can operate in wins without mouse and without that keys, but isn't it ridiculous that IT DETECTS KEYBOARD AS A MOUSE?????

I thought that all of that shit happens because of NMFILTER driver, but having it installed/uninstalled really have no impact neither on system nor on SI.

I tried again all the tricks, including 3 separate "secret keys" in the registry (they're quite HARD to find over internet, but somehow i found them :P ) - no effect.

*HKLM\system\services\ntice\"KbdMethod"=dword:67416E5A
- 'Secret':normally there is nothing like that - value is zero
- so SI says in the log: without value/with val. added
[NTICE: Patching Keyboard using method 0 / 67416E5A]
- i have no idea what the value means. any one seen different val?
- any one knows what is 67416E5A ? :)

*HKLM\system\services\ntice\"MouseType"=dword:0000xxxx
- here is mouse type stored. 0001 for COM1, 0002 for COM2, 0003 for PS/2/USB;
- xxxx+=0100 for EnchancedMouse (everything in hex)
- 'secret' is that there is at least one more modifier, normally not documented nor written to registry by SIoptions: "set bit 15 of the value to disable usb mouse detection, as SoftIce tries to detect it even if MouseSupport is disabled" 15bit is +=4000. of course doesn't work.

*the 2 'secrets' above i have found somewhere at compuware's but in last days i have tried to find them and they seem to be missing now

- there also is MouseType value in siwvid key. it was set to 0003 by installer and nothing seems to be able to change it. i tried changing it to 0103 and 4003 and 4103 and nothing happened at all. Compuware says nothing about that doubled entry.

so, do you have any ideas left? :D

----------------------------------------------
compuware's text about something similar in BC:
http://frontline.compuware.com/nashua/kb/doc/720.asp
* it OLD, about PSmouse and BC for dos, but still similar

something for better moods:
1) go to http://frontline.compuware.com/nashua/kb/doc/si_index.asp
*) rememer the link :)
2) scroll down to "FAQID934 - SoftIce support for Power Managament including hibernate and suspend modes"
3) enter and say WOW :D
Woodmann
01-17-2004, 03:35 PM
Howdy,

Tell us again what kind of rig you have. Plus video card, MB, OS,
you know, all the particulars.
Give us an output from your task manager with running processes.

Woodmann
quetzalcoatl
01-17-2004, 04:29 PM
huh... ok, reply first:

Duron 1.2GHz 256M Ram (2xSIMM 128m 133mhz)
board K7S5A, LAN & sound integrated
GF2MX400 64MB, producent? dont remember.. i'll check later
HDD 40G
WinXP SP0
Mouse: Microsoft Wireless Intellimouse Explorer 1.0A, USB
Keyboard: "SuperPower" Win98 Standard Keyboard, PS/2

Procs, non vital:
i/u - installing/uninstalling - no efect

ctfmon (system)
daemon (DaemonTools 3.43)
DAP (download accelerator plus, i/u)
DASVCNT |
DPConfig |
NCS |
DSTrayAPP | (files from DriverSuite and DevPartner, DevPartner installed after SI rolled back)
mdm.exe (system something)
msiexec (ms installer)
netdde (std sys service, i/u)
nvsvc32 (nvidia helper service, from detonators i think)
point32 (ffrom mouse's driver. installed after rollback)
rundll32 (dunno what it did started and keeps running)
svchost x 5
vc5play |
vc5secs |
vc5tray | from VirtualCD v5, i/u
winampa (winamp agent, from winamp5.01, i/u)

thats all. as you see, everything is either system' or checked....

now, some good news..
i have tricked windows to accept "the one 1000% supported i8042prt.sys", available at compuware's KB (somewhere not in package w2ktest.zip!) - ftp://ftp.compuware.com/pub/driverstudio/outgoing/Keyboard/i8042prt.sys.
[tricked, because this file comes from W2000 SP-sth. well.. it shouldn't work at all, but it does a little good] now, SOFTICE at last stopped being USB-mouse-vulnerable. not only keboard doesn't hang when mouse is moved, but even SI doesn't hang when moved with SI window (however, there's no SI's mouse cursor..)! that is an achievement...

however there is still one thing. keyb doesnt hang on u-m-movement, but it now hangs on pressing NUMLOCK/CAPSLOCK/SCROLLOCK.
YES, i know about the option DisableNumProgramming aka NOLEDS=ON :)
That doesn't work. Its obvious that that is the very problem, but how to switch it off when it doesn't switch off? i know it ignores options, because if DoNotPathKeyboardDriver is checked, SI also ignores it, and patches it (at least it claims to have done it in SI log..)
(also i have tried the rest of the options, of course)
(and tried to i/u nmfilter.. )
next strange thing - the keyboard hangs, i log off (->welcome screen), log in, and the keyboard is unlocked. press num lock, keyb gets locked again, i can still logoff and unlock keyboard. hey. that would point to the users' services, right? wrooong. when i press numlock/etc on welcome screen it still hangs, also at the very first login, just after restart (of course if SI is in boot or automatic mode)..

its getting better :) now i have a mouse hehhe.
oh, and its also interesting that INSIDE SI, Num/Caps/Scroll/Lock are working just right...
quetzalcoatl
01-17-2004, 07:54 PM
hmm.. i've found one VERY useful for me thing:
once the keyboard hangs, lets say because i've pressed CAPS, i can still (by mouse) launch OnScreenKeyb there press CAPS (to turn it off) and ... keyboard unlocks.

as for now it seems weird :D
evn
01-17-2004, 09:58 PM
Keyboard: "SuperPower" Win98 Standard Keyboard, PS/2

I had this keyboard and problems with it, i think it was because it installed some crappy keyboard manager software (unnecessary unless you legitimately use the media buttons).

When softice loads it halts all processes, so the keyboard manager dies until you can flush it (by using the onscreen display, or restarting the keyboard app).

Im pretty sure i got it working by disabling it, but i can't remember for sure, it was a while ago.
quetzalcoatl
01-18-2004, 11:52 AM
it installed some crappy keyboard manager software (unnecessary unless you legitimately use the media buttons).

well.. in fact that could be it, but i believe you mistook my KB for some its newer version :)) its plain, standard keyboard. alfanumerics, std keys like tab, caps etc, numpad, F1...F12.
...and keys 2x'Win',1x'DropLst', power,sleep,wake. i dont think they would mess with anything, as they're almost in any keyboard you can find now..
and i haven't installed any extra software, or drivers for it (it didn't have any). its running as "Std 101/102-Key or Ms Natural PS/2 Keyboard".
Woodmann
01-18-2004, 04:58 PM
Howdy,

I had a hard time finding any quality info about "superpower" keyboards.
This could be a bad thing.

Procs, non vital:
i/u - installing/uninstalling - no efect <------says who ?

ctfmon (system) <-----shut this off
daemon (DaemonTools 3.43)
DAP (download accelerator plus, i/u) <-----shut this off
DASVCNT | <-----what is this ?
DPConfig | <-----shut this off
NCS | <----this could be anything
DSTrayAPP | (files from DriverSuite and DevPartner, DevPartner installed after SI rolled back)
mdm.exe (system something) <----I hope you are not using this
msiexec (ms installer)
netdde (std sys service, i/u) <-----You will know what this does if someone hacks your box. <----shut this off
nvsvc32 (nvidia helper service, from detonators i think)
point32 (ffrom mouse's driver. installed after rollback) <----shut this off
rundll32 (dunno what it did started and keeps running) <-----C'mon man!!! this runs a dll as an app
svchost x 5 <-----5 things that are running and you dont know what they are ?
vc5play | <-----shut this off
vc5secs | <----shut this off
vc5tray | from VirtualCD v5, i/u <-----shut this off
winampa (winamp agent, from winamp5.01, i/u) <----shut this off

www.blackviper.com
This place will help you to understand what is running and what/how to shut off the things you dont need.
Else you can keep on guessing and hope to get lucky.
If you want to keep guessing, go buy a 2 dollar used MS keyboard.

OBC
quetzalcoatl
01-18-2004, 06:31 PM
DASVCNT |
DPConfig |
NCS |
DSTrayAPP | (files from DriverSuite and DevPartner, DevPartner installed after SI rolled back)

rundll32 (dunno what it did started and keeps running) <-----C'mon man!!! this runs a dll as an app

it seems that you didn't notice that small strange "|"
all four are from DriverSuite and DevPartner..
and I DO know what rundll23 does. i meant i dont know WHAT IT LAUNCHED

svchost x 5 <-----5 things that are running and you dont know what they are ?

in fact, i know that they're just next 5 system services, that i turned on later. none of them are virus/trojan.

netdde (std sys service, i/u) <-----You will know what this does if someone hacks your box. <----shut this off
vc5play | <-----shut this off
vc5secs | <----shut this off
vc5tray | from VirtualCD v5, i/u <-----shut this off
winampa (winamp agent, from winamp5.01, i/u) <----shut this off

well, i have tried already.

point32 (ffrom mouse's driver. installed after rollback) <----shut this off

all that program does is obtaining battery status from mouse, and maybe it adds few more configs to wins.. and maybe you didn't notice - i have installed it AFTER SI got crazy. now SI is a little better :P

www.blackviper.com

is there anyone that doesn't know this site? why would it be me? <rotfl>

If you want to keep guessing, go buy a 2 dollar used MS keyboard.

well, that keyboard is old as... i don't know what.. dinosaures? it is really PLAIN keyboard. "SuperPower" is its manufacturer, not super-duper-commercial-name-for-just-a-next-newest-gadget-on-the-market...

mdm (.....)

as i have checked, it came with MSVC++6.0 i have installed.
as i have read through much blahblahblah at compuware's SI should be 101% compatible and non-conflicting with this. i'll check it once again, but i don;t give it much chance to be the reason.

i/u - installing/uninstalling - no efect <------says who ?

tough question. maybe me? if i say it doesn't have any, then it didn't have any effect when i removed it. i have removed things incrementally, so there is no way that several things could be conflicting with SI parrarelly.
Woodmann
01-18-2004, 09:24 PM
Howdy,

rundll32,<--- I am glad you know what it is, what you dont know is what it is running.

svchost x 5, <--- they make progs that will tell you what is running.

www.blackviper.com : /snip/ <rotfl> <-----I dont see whats so funny. So you know about this place, /snip my bad thoughts/

i have read through much blahblahblah at compuware's SI should be 101% compatible and non-conflicting <----- I wish they had to pay me a dollar for every person who found this to be bullshit.

A lot of people have posted their thoughts about what may be happening and you seem unwilling to try most of them. --> | <-- means nothing in the realm of SI and the problems of getting it to work with XP.

Go get olly.

OBC
0xf0001
01-19-2004, 03:23 PM
hi there.

if it is still the problem with XP and SI 4.x just wanted to say (not too loud, but since it works - it works) i also have one machine with XP (need it, but cant live without sice, even at work ggg) and sice 4.05 for eg with a lil patch that made it run perfectly. if you want i can have a look which one it is ... as there is soooo much written here i must admit i did just read the start of your 1st topic. if it is about paricular win/keyb problem please gently "forget" my posting :)

greetz, 0xf001
quetzalcoatl
01-19-2004, 08:07 PM
0xf0001 - well.. it would be great if you would :) but dont bother if its the 3-files-patch, as i have tried it already a few times.. oh, and i have SI 4.30, so that probably won't work, but i'll try whatever you have..

woodman - there really were quite many ideas, i don't deny that. but you see, most of them i either tried already, or they were very similar to what i have done. or they were usual 'turn off xxx'/'uninstal xxx' while i either dont have 'xxx' at all, or tried to run SI earlier when i didn't have 'xxx' on the computer. and if you think i'm unwilling to try something, that would only mean that either i have tried it already and so i left the idea unreplyed, or i have tried it, it had no effect, and i have forgot about it (or accidentially posted the reply on another forum, but it is less likely).

one more thing: for me, you seem to be just as stubborn as i must look for you :) i can't understand, why do you stuck on those apps i have commented.. i know that earlier i've had a problem with firewall, but the firewall was the very thirst thing i have installed on the system, and if i remember well next was msdev, ACDSee, Winamp and SI :) DevPartner for example, came later, faar later. After solving problem with process termination (->firewall conflict) and after SI got crazy again. i believe i have written that.. i believe that i also said that i have treid turning off everything that is not vital for things i have to leave. and if you can trace back to the previous post - the problem with the keyboard have been there from the very beggining. so just after reinstalling wxp, installing 3..5 progz and installing SI, there were 2 problems. i/we have solved one, and the second (this) is now the target..

so if you still think, that any soft could be in conflict with SI, tell me, how it could be that:
i had X programs installed and Firewall => SI was malfunctioning in 2 matters. i uninstalled firewall => SI got cured. then i installed one or two programs, now i don't remember what => SI started to fuss with keyboard and mouse again. so i uninstalled them => no effect. so i searched for orphaned files/regkeys/blah an uninstaller could leave and removed that few i have found => no effect on SI. then i started installing/uninstalling different versions of SI again, tried with DevPartner (which was supposed to have it own debugger, also SI, as i have read somewhere), tried with OS/dat's, with registry, with (paste here all my posts at this forum about tried methods), and at last with swapping i8042prt.sys from W2000 SP4 which took the case to the present state....

to say it again (present state):
pressing numlock/capslock/scrolllock hang the keyboard, if SI is working in the background. if it is in fore- everything works fine. if keyboard hangs, i can de-hang it by turning OnScreenKeyboard and pressing num/caps/scroll (to turn off their function). DisableNumProgramming is not working. DisableKeyboardPatching turns off the keyboard at all. Other Troubleshooting options have no significant effect in ANY combination. My first question posted in this thread is still open :
*)how can i disable NUMLOCK (LED) PROGRAMMING when neither SoftIce's Options app, nor correcting the settings in winice.dat seem to have any effect? it seems just like SI is ignoring them completely.
*)maybe via registry? what key i need to change? hklm->service->nmfilter->i8042prt.sys? it has dword value of "1". what are other possible? if nmfilter is important, why SI works even with it uninstaled?
*)maybe via winince.dat? there is a great number of obsolete variables. NOLEDS that are set by the installer could be also obsolete, then it would be nothing strange if SI ignores it. but it being obsolete would be strange, because the SI OptionsApp sets it..
0xf0001
01-21-2004, 08:31 PM
hi quetzalcoatl!
it is actually a patch that povides you with new siwvid.sys and ntice.sys
i remember i also tried a few - this finally worked for me. starting PN mode ...
think it should not be a file sharing board...

greetz, 0xf001
quetzalcoatl
01-22-2004, 11:34 AM
hey, i didn't ask you to post any file here :) i only asked what did you use :) but is like i thought, that was just that 3files-patch, which didn't work for me. well i have no idea how many versions of the patch are there, but i didn't find any for SI4.30 :)

well.. thanks everyone for replys& ideas, but seasonal exams are close, and probably i will not have much time to keep on fighting with SI. fortunatelly i can use it if i don't touch several keys, but its rather a nuisance that serious problem.

SUMMARY (for this problem):
the 0.5-final solution was to overwrite the system32/drivers/i8042prt.sys with older wersion from W2K SP4. the file you can obtain at Compuware's KB or for friend :P

see ya later :)
0xf0001
01-24-2004, 12:40 PM
aehm quetzalcoatl: 1 + 1 = ? :) or do you also count the zip file container ggg ... ok stop this now...

greetz, 0xf001
quetzalcoatl
01-24-2004, 08:29 PM
aehm quetzalcoatl: 1 + 1 = ? :) or do you also count the zip file container ggg ... ok stop this now...

greetz, 0xf001

heh.. i thought it obvious :P 3filespatch is a collection of ntice.sys, siwvid.sys and siwsym.sys. however, if person who packed that files is a bit smarter than others, he/she could have noticed that siwsym.sys can be manually re-generated by user by using icepack.exe, so he/she didn'e include the file in the package, making it smaller and easier to distribute :D

:cool:


help,Need all the asm references
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > help,Need all the asm references
PDA

View Full Version : help,Need all the asm references

highfly
01-17-2004, 04:59 PM
hi

i am learning asm,i need all the asm references like cmp,jmp,mov, i need all :)

thanks
evlncrn8
01-17-2004, 05:03 PM
hi

i am learning asm,i need all the asm references like cmp,jmp,mov, i need all :)

thanks

use google.. search for 'helppc21' download it, handy little utility
Bengaly
01-17-2004, 05:32 PM
http://www.clipx.net/ng/iapx86/index.php
evn
01-28-2004, 09:47 PM
hxxp://www.iro.umontreal.ca/~feeley/cours/ift2240/doc/assembly/

This is an assembly reference for some computing course, has references for most aspects of assembly, though it doesn't have detailed information on how to use them.

Also includes interrupt lists, and a bunch of floating point and mathematical references.


Better hiding of Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Better hiding of Softice
PDA

View Full Version : Better hiding of Softice

Pepone
01-17-2004, 10:11 PM
I like W98, I don't want to use W2k or WinXP. I use SICE 4.01, but I can't hide it from lastest packers, like ASPR 1.23 RC4 or ARM 3.00 and higher. Frogice & Icedump won't help here, so I grab some IcePatch from net. It changed VXD ID & name of Winice, Winice module name, VXD ID & name of Siwvid, vxd name for Siwdebug and INT3, INT41, INT68 signature. But still no full work with ARM 3.0. I get some message about enter some security key at app startup :( . I enter incorrect of course, and app quit. Isn't there something more to change/hide, so can I can use SICE 4.01 undetected ? I search forum some info and found something about splaj tutor. But searching for spalj tut, splaj detect, winice internals essay won't help. Any idea where to get that Splaj tut for hiding SICE ? Any else tips/tut/help how to hide it better ? Or is better to get some Driver Studio 2.7 or 3.0 and use it with IceExt for hiding ? But I dunno os Driver Studio works under Win98SE :rolleyes:
evn
01-18-2004, 02:16 AM
Or is better to get some Driver Studio 2.7 or 3.0 and use it with IceExt for hiding

IceExt is a Windows NT plugin for SofticeNT. You won't be able to use it on windows 98. I'm not sure if it hides itself from these packers anyway.

You *should*be able to dump and remove the softice checks (almost 100% of the time the author relies on the packer for the anti-debug protection) by following previous versions tutorials. You could try using ollydbg to get around this, but its not the best for what you want.
Pepone
01-19-2004, 07:09 AM
Evn, thanx for reply. I'm unable to find "previous versions tutorials". Any tips ?
evn
01-19-2004, 09:07 AM
There are a few links in the FAQ and list at the bottom of each page, and the unpacking forum is full of tutorials. Do a search and you'll probably come up with answers, possibly even for the newer versions.
rnd
01-20-2004, 04:05 PM
something else, don't be too affraid for changes. don't be so conservative ;)

for myself i always thought that i was going to keep on using DOS forever. for 98 it took me also some time to switch to XP, but i'm glad i did it ;)
nikolatesla20
01-20-2004, 04:37 PM
How do you know your SoftIce isn't hidden?

The security key thing you talk about in Armadillo has nothing to do with detecting SoftIce. It's a key you have to enter to decrypt the program so it will run. Some protected programs use this method - i.e., they don't have a "default certificate" in Armadillo speak. If you don't know what that is, you need to download Arma and study it for yourself...

-nt20
Pepone
01-20-2004, 07:23 PM
2nikolatesla20: If SICE isn't enabled, ARM runs without problems. If pached SICE loaded, ARM give me that sec.key message. So it must detect some way SICE, or maybe it's NOT SICE exactly, but some check which doesn't pass and so ask for some sec.key. :rolleyes:
nikolatesla20
01-21-2004, 03:34 PM
Ok, well that makes sense then :)

Unfortunately I don't use W98 anymore, only 2K / XP, cause it's easier to write drivers, etc, hack drivers, etc. in 2K, so I can't be of much help.

-nt20
evaluator
01-21-2004, 04:05 PM
well, if you properly patched SICE, arma also look at INT01-03 handlers in IDT. trace & catch


Armadillo Goblin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Armadillo Goblin
PDA

View Full Version : Armadillo Goblin

Zilot
01-18-2004, 04:23 AM
Hi !!

This tool I made in several last days should remove Armadillo copy mem protection. It will do only that. IAT and OEP you must find by yourself. I tested this on versions 2.40 to 3.50 and worked with all of them.

So this is only very beta version. Try this, test and replay if it works or not. Load your process with "Load button".
If you got message "You can dump now", dont close this box (otherwise youll terminate process). After this message run LordPE, or PeTools and dump second process (younger of two of your started program).

I expect some comments !!

Zilot
LibX
01-18-2004, 08:19 AM
F*cking nice tool dupe :D :D :D
Thigo
01-18-2004, 03:05 PM
ASProtect v.[0/1"AFPE%gsokc(81'8>]

ExceptionFlags: 00000000
ExceptionCode: 80000004
Exception address:00000000
StackCurrent: 0012FF28
StackTop: 00130000
ImageBase: 00C00000

Registers:
EBP: 0012FF58
ESP: 0012FF28
EAX: 00000000
ECX: 00000000
EDX: 00000000
EBX: 00C1A684
ESI: 00BD0000
EDI: 00C00000

Stack list:
000C17C2Eh,00800C17Ch,07D0800C1h,0C17D0800h,000C17D08h
06000C17Dh,0FF6000C1h,012FF6000h,00012FF60h,0F60012FFh
07CF60012h,0C17CF600h,000C17CF6h,05800C17Ch,0FF5800C1h
012FF5800h,00012FF58h,0000012FFh,000000012h,0C0000000h

Stack (functions) list:
00019684
000170A1
00019684
00017754
000185C4
00017E8C
00019770
0000A5DC

Code list:

would you please not protect your app with crappy ASPR ? :)
Zilot
01-19-2004, 02:33 AM
would you please not protect your app with crappy ASPR ? :)

Must complain to Alexey :D

Seems you are win 98 user ? Sorry

Try this one
evaluator
01-19-2004, 05:31 AM
>>ESP: 0012FF28

Zilot, little exersize, is Thigo "win 98 user"!?
Zilot
01-19-2004, 06:05 AM
I think you owe one anwer to me. Silently avoid to answer in PM

Zilot, little exersize, is Thigo "win 98 user"!?

Dunno, maybe is maybe not. Dont have win98 since 2 years ago, and then I didnt memorize.
ZaiRoN
01-19-2004, 06:14 AM
is Thigo "win 98 user"!?No...
Thigo
01-19-2004, 10:30 AM
This one works better :)
And no i'm not using Win98. I use win2k SP4, no debugger running.
Zilot
01-19-2004, 12:42 PM
This one works better :)
And no i'm not using Win98. I use win2k SP4, no debugger running.

Strange, I use win2k too, and it worked fine. Anyway I'm glad it works.

Evaluator, I'm still waiting. I'm wondering what I have to do, to get answer.
evaluator
01-19-2004, 05:56 PM
ok, i unpacked it from Obsidium, as you want.
What version of Obsidium you use?

pending answer is +995
Zilot
01-20-2004, 02:39 AM
ok, i unpacked it from Obsidium, as you want.
What version of Obsidium you use?

You did great job for Chad, now he can seat back and enjoy your work. Why do you think I packed this ??

pending answer is +995

Thanks for answer, exactly what I got in that crackmes on address 54AC34, after call to 43B256, I mean +995 was value in eax, after return from 43B256
evaluator
01-20-2004, 04:55 AM
yei!

seems i wrongly translated your request(:
>>Evaluator, I'm still waiting

ok, by default: Unpacker forces protectors to be better.
so You are helping author of arma, not i.(ask ni20 also)

why you think, that author will unable unpack aspr or obsi?
Have you true info, that hi is so lamer in unpacking?

**
that is realy answer! if you can't solve, ask Zairon;)
maybe hi can solve!? but privately.
Zilot
01-20-2004, 07:16 AM
yei!

seems i wrongly translated your request(:
>>Evaluator, I'm still waiting .

Man !!!!
You translated it well. And I understood your answer. But have I to say everytnhing literally :mad: . You didnt understand what I wanted to say with last sentence ? Does anybody else know our story from PM ? What would he conclude ?

why you think, that author will unable unpack aspr or obsi?
Have you true info, that hi is so lamer in unpacking?.

Do you think they pack files, make protectors because they think we wont be able to defeat them??
They are just stealing our time. Why to have fair play with them, when they play as more dirty as they can. They even (especailly Chad) threaten to some of us with law. Let them spend some time in thinking what we have done.
evaluator
01-20-2004, 12:16 PM
there is only 1 way, if you dON'T WANT help protecrots-authors:
DO NOT publish your unpacking tools.

keep your tools for you, yor friends.
also don't sell, it's stupid. [seems for money will best- unpacking targets for 1-5$ etc.]

if you want to make VENDETTA, unpack&spread protected targets widely,
so this will mutch harder damage protector's honor.
volodya
01-20-2004, 12:18 PM
evaluator, my high skilled body, Zilot is absolutely right. If you are going to hide your knowledge - OK, be happy with it. For the rest of us it is garbage. There is NOTHING special in armadillo indeed! Indeed! The whole principal of this proggy is to use DebugAPI. If you know, how ANY Win32-tracer works - you can crack it. These rdtsc and other shit are shit indeed!
Chad is not that cool, my friend. I myself know far more sophisticated software then the one Zilot did. That software is able to restore nanomities in automate mode, decrypt the code section and do a dump correctly. And this software is distributed absolutely freely with the tutorials! So in Russia almost everyone now can hack Arma.
If you are going to play hide and seek - you lost from the very beginning. If you are going to share your knowledge (BTW, REALLY strong - I've read your posts) - we will all win.
The principal of Arma is known long ago. For Chad to rewrite it completely from the sratch using another principal - he-he, he won't be able to do it. If he does, then we crack it again.
JMI
01-20-2004, 01:56 PM
So volodya:

Would you be referring to "Armadillo nanomites recoverer 1.4 + dumper"? :D Or some other?

Regards,
evaluator
01-20-2004, 02:11 PM
vladimir,
because you wrote: "Zilot is absolutely right"

i have 1 question:
how about me?
Am i right some-where in my previous post(or totally wrong)?
volodya
01-20-2004, 02:35 PM
Who am I to judge if you are totally wrong or not? To my opinion, you were NOT right when you unpacked ZILOT's dumper - Chad should have more work. I hate packers - they SLOW the program!
For the rest, I can only say it again - you are VERY skilled! That's true. But for some reason you don't want to share your skills as to some packers. I can't really understand why. So, if you take armadillo - WaitForDebugEvent is the key to everything. They may play in detection of 0xCC or sth else, but the PRINCIPAL is the SAME in each and every version of it - fucking SLOW ring-3 tracer!

JMI
Mainly, yes. We have one brilliant tutorial by dragon. Another one I'm going to write. infern0 (the author of N-rec 1.4) is talking to me often. But for sure this is not the only one utility. They all have the same principal - CreateRemoteThread inside. Chad may add even more shit into his idiotic tool - it won't help - the PRINCIPAL is the same :)
:p
evaluator
01-20-2004, 02:58 PM
volodya,
once again, i think:

publishing unpacker forces protector's author to upgrade his protector,
so better is NOT publish unpacker.

Please, judge it.
volodya
01-20-2004, 03:44 PM
The development cycle of any commercial product assumes it MUST be a new version each half of the year. Otherwise the project will be shut down.

evaluator, you are trying to raise a philosophical question here. I'm sorry, but I definitely do NOT have enough time to argue with you here and go into sophistic questions. The one should decide for themselves. But let me give you the situation - you may ignore MS, you may hate it, but, despite of the fact, MS is developing and will be developing more and more ugly software and there is nothing you can do with it.
The same is with the progress concept in general. One may hate it, one may love it, but in the long run it DOES NOT matter! English people have a nice proverb here: "Dogs bark but caravan goes on".
JMI
01-20-2004, 05:35 PM
volodya: Allow me to anticipate Eval's response. "Too much inglish." ;)

Remember we need an unpacker just to get the jist of most of Eval's comments. :D

And as a complete aside, "English people" aren't generally known to have caravans. We/they, as a group, are not that good at riding camels, one or two humps. :D That proverb is probably just an English translation of a saying of more qualified camel pilots, who know better the dessert sands and the way of caravans and barking dogs. :cool:

I'll look for the tut you mentioned in the same place I found the tool and trust my luck to a machine translation. The general drift can usually be found in their very rough translations. :)

Regards,
nikolatesla20
01-20-2004, 07:47 PM
And you can find the OEP of any copymem arma program in like 2 seconds by simply hooking ContinueDebugEvent.

-nt20
volodya
01-20-2004, 11:17 PM
Exactly, my friend. THE PRINCIPAL! ring-3 tracer!

For the rest - perhaps, someday I'm going to translate my tutorials to English if anyone needs it...
As to the camels - most likely you are right :p
I'm not a native speaker, therefore...
+SplAj
01-21-2004, 01:57 AM
Ev@l

Now U must make a tut on unpacking Obsidium....... :D
evaluator
01-21-2004, 03:16 AM
volodya,
I am very much upset with your cold position.

for last words, i decide to correct 2 thing for you:

1.
>evaluator, my high skilled body
i'm musician, unpacking is my hobbie,
i'm not high skilled in programming or in computer relative knowlidge.

just i (& all:) can (but yet) enjoy with my trickie mind & phuntasi.

2.
i'm not hiding my knowlidge. (& btw, unpacker is not knowlidge)

**
+SPLAJ, unpacking is my hobbie, but writing tuts won't to be
+SplAj
01-21-2004, 09:37 AM
Ev@l

U R hobbie is being a pain in the ass.

You would freely help assole protectionist by posting unpacked tool. Then REFUSE to help us.

I say no more to U and in your native tongue 'merda' ciao :mad:
volodya
01-21-2004, 10:18 AM
unpacker is not knowlidge

If you are just telling what button to push, indeed, it is not. If you are showing some concepts and really demonstrate some theory along with the practice - allow me to disagree.
evaluator
01-21-2004, 11:39 AM
+SPLAJ, i not understood, maybe you will try easy english?
volodya
01-21-2004, 02:53 PM
evaluator, my friend, +SPLAJ is slightly more rude then necessary, but, in general, he is right. So, would you please delete your attachment of the unpacked Zilot's tool.
evaluator
01-21-2004, 03:05 PM
volodya,
because i already sad "last words" to you, so that was last words
between as. ok?
(means: forget about me)

as about attachment, i forward rights to delete[or not] to Woodmann:)
nikolatesla20
01-21-2004, 03:23 PM
This isn't my thread, but I agree with +Splaj. It looks as tho Zilot requested through PM about the unpacking. Hence the unpacked file does not belong here. Although it's probably too late anyway, that attachment should be removed. It does not show a proper community spirit if one user wishes to work with another via PM and then the other user party makes the private issues public without knowledge or permission of the requesting party.

Even more so when the knowledge of the unpacking of that particular attachment does not accompany it. In essence it is then a crack and should be removed.

-nt20
evaluator
01-21-2004, 03:58 PM
niko, too many decisions?

maybe easier is ask, if he request?

**
EDIT: niko, too much assumptions??
+SplAj
01-22-2004, 01:21 AM
evaluator, my friend, +SPLAJ is slightly more rude then necessary, but, in general, he is right. So, would you please delete your attachment of the unpacked Zilot's tool.

Yes I was a bit rude. I apologise to the protectionist assholes. They are really very nice ppl with good ideas and r willing to share their work with others for such little money.
esther
01-22-2004, 02:50 AM
>you were NOT right when you unpacked ZILOT's dumper

What right you can unpack other packers!?

Unpackers are useful source ppl can learn from them.Unpackers are knowlege if you provide source codes.Well did you ppl SHARE YOUR KNOWLEGE? Really doubt that.

Evibrator :p

Writing a tute is sharing knowlege,I totally agree with Splaj
nikolatesla20
01-22-2004, 09:41 AM
I know I've waited a while before sharing this, please forgive me.

Here is the source code for DilloDumper 2.30. It's fairly messy, but its got a lot of comments that should help someone to understand what is going on. Some of the trix used I still use today in my new unpacker code for Arm. One of the reasons it's hard to share this is mainly because I developed it on 3 computers at the same time, so I hope this is the latest rendition ;) , in other words, I'm not sure anymore which computer contains the latest code. But it looks like this was 2.30. 2.30 added "auto IAT" rebuild, so you'll find lots of functions related to doing that.

The source is NOT clean or very organized, in fact, it's all in ONE file. I know this is bad practice but this was my first unpacker/dumper and my only goal was to learn how to do some things. I've since improved my structures.

I hope ppl can learn something from this, even tho many already know how to manually unpack and are very skilled, information on writing an unpacker just doesn't exist on the web, it's one of those things you just have to do. Also, most examples of unpackers source on the web are in ASM. There's no real purpose to do this is asm, C is just as fast nowadays. So here is some C code for you MSVC users out there...

-nt20
esther
01-22-2004, 10:01 AM
Thank you for sharing your source

with respects :cool:
mr.x
01-24-2004, 01:18 PM
Zilot,

Your tool does not work with the file protected by Armadillo require id and code. I tested.
JMI
01-24-2004, 02:12 PM
Mr. x:

Perhaps you should read from the start of the thread where Zilot described what the tool would do and would not do. He advised it would remove the copy mem portion, nothing more. Why would you even suspect it would solve the problem with versions requiring id and activation code? It was not offered as a "solve all" solution or as a one click solution for those who do not want to do any of their own work.

Regards,
R@dier
01-25-2004, 04:17 AM
nikolatesla20 Thanks for sharing your source code
I lookforward to learning from it

Best Wishes

R@dier
Zilot
01-25-2004, 11:03 AM
Zilot,
Your tool does not work with the file protected by Armadillo require id and code. I tested.

Yup, doesnt work. You have to find out the way to bypass id check. So if you have file with nag generated by Armadillo, you have to press 'continue trial' or whatever to make my tool working.
equinoxe
02-03-2004, 10:42 AM
Yup, doesnt work. You have to find out the way to bypass id check. So if you have file with nag generated by Armadillo, you have to press 'continue trial' or whatever to make my tool working.

Is there a way to bypass the id check or is there a tut for (arm v 3.40)?
I am working on a prog with no continue trail posibilities..
tenketsu
02-27-2004, 06:44 PM
Coding WorkShop update their protecctions ALWAYS

The AGoblin Loads the Program &..... nothing!!

The app load, work and exit; the Agoblin not response.
Zilot
02-28-2004, 06:42 AM
Coding WorkShop update their protecctions ALWAYS

The AGoblin Loads the Program &..... nothing!!

The app load, work and exit; the Agoblin not response.

Agoblin works even with newest armadillo (3.61) downloaded from siliconrealms.com. Dont believe they protected it with older armadillo.

Two reasons why you can't get working application:

1. Shareware authors of Coding WorkShop change protection type
2. It is not copy-mem protection

Have you reversed older versions of Coding WorkShop. Once upon a time when I did it, there wasnt copy-mem protection.
tenketsu
02-28-2004, 01:20 PM
I have unpacked 6 versions of Ringtone Converter & ALWAYS use the COPYMEM II protection.

I dont know why this version 4.8.2 is different in many ways :eek: ; download, analize & later say something.
Zilot
02-29-2004, 03:47 AM
download, analize & later say something.

You think I have nothing to do but to reverse Ringtone Converter ?

As I see you are expert for this software (you revesed 6 versions), so it wouldn't be hard to review what you did in previous versions and to apply all of that to this one.

JMI would say "There is a search button here, and if you doubt to someone use it"
tenketsu
02-29-2004, 10:58 AM
My post is only a comment, i really like your job. :)

& i have found the trick in Ring.Conv. 4.8.2

So.. let's dump
Zilot
03-01-2004, 04:18 AM
Ok :)

I'm glad you found solution.
Baron Gede
05-01-2004, 04:16 AM
Народ.

Когда реально сломаете Армадиллу ебучую - стукните мне на мыло.
dELTA
05-01-2004, 08:01 AM
Hey, watch your language young man! :D
Baron Gede
05-01-2004, 08:22 AM
Hey, watch your language young man! :D
No, I speak only for russian. :D
Sorry.

Do hack last vesion of Armadillo.... :) Dumper of Zilot is not workable on w2003.
friedo
06-22-2004, 12:42 PM
Do hack last vesion of Armadillo.... :) Dumper of Zilot is not workable on w2003.
On my exe it´s not working too! (3.0-3.6)
(Think it has to do with the fact that the application runs in endless loop if debug breakpoint is set.) => goblin hangs...


No Point Of Attack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > No Point Of Attack
PDA

View Full Version : No Point Of Attack

cisco
01-18-2004, 09:27 PM
XXX For Windows
http://xxx.yyy.com

I am having a problem with this programs trying to find a point of attack, and also some problems with understanding the rules of this forum.

The only registration screen is when you first install the programme that is generated from the setup.exe file

Once the programme has been in stalled there is no options to register, upgrade or remove demo status

There are some interesting reg quarries upon start up but have had no luck with them

I am a newbie at this game and I realise that this programme is probably well out of my deep but all I am asking is if someone can point me at a tut that has a similar coding or a small tip a on how to proceed, or just a crack would be fine too.

Thanks in advance

Cisco :confused:
cisco
01-18-2004, 11:56 PM
I apologize for the breach of rules

And a crack is the last thing I want

This is an enigma that I want to solve my self
And with my limited knowledge of this type of
protection any assistance will be greatly appreciated
bflash2k
01-19-2004, 05:22 AM
So, it means that Setup do the job !!! First, have a look at setup files to see what installer is used (IShield, or....). Then, reverse the setup to see if:
- There's some specific files that are not installed
- There's some serial stored in registry
- Some files that are unpacked
- etc...

good work ;)
cisco
02-09-2004, 11:54 PM
So, it means that Setup do the job !!! First, have a look at setup files to see what installer is used (IShield, or....). Then, reverse the setup to see if:
- There's some specific files that are not installed
- There's some serial stored in registry
- Some files that are unpacked
- etc...

good work ;)

thanks for the help

I managed to work this one out it realy was'nt that hard

just needed time and a new attach angle
Softice wins again


PE Files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PE Files
PDA

View Full Version : PE Files

infinity+
01-18-2004, 09:46 PM
Please could someone provide some links to tuts in which a section is added to pe header, section is edited, PE info is changed, and adding functions to files. I want to really understand this. 'Editing pe files'

I have read the Microsoft COFF document and Iczelions pe tut.

Thanks
dELTA
01-18-2004, 10:09 PM
Check out some tools like Lord PE, and also take a look at the collected PE info html document that was the subject of a recent thread around here.

For further info you have to be more specific and tell us what you have tried and failed with.
infinity+
01-18-2004, 10:44 PM
Right now I am confused on how to make a section bigger...

Say I wanted to extend a rsrc section..I know that I would have to change the flags to make it executable but I am still confused on what else I need to change & the limits of change.

Alright, suppose the last section in a pe file is .rsrc

.rsrc
VSize(Size in memory?): 000004E8 RVA(Starting addr in mem?): 00004000
RawSize(Size on disk?): 00000600 Offset(File offset on disk?): 00000C00

Starting address=base address+imagebase ;is this right?

Confused on how to use this: SizeofImage: 00005000

If I wanted to add some code at the end of the file what would I change?

Section characteristics 40000040 change to E0000060

im a little :confused:
infinity+
01-19-2004, 12:14 AM
VSize(Size in memory?): 000004E8 RVA(Starting addr in mem?): 00004000
RawSize(Size on disk?): 00000600 Offset(File offset on disk?): 00000C00

I changed vsize to 900 and Rsize to 900 and I get an error :(

The application failed to initialize properly (0xc0000005). Click OK to terminate...

:confused:
evaluator
01-19-2004, 02:48 AM
in PE there is also alignment field. so 900 not matchs with 200h or 1000h
for W32PE
infinity+
01-19-2004, 03:11 AM
Are you saying that I can only add multiples of 200h or 1000h to the file??

Here is the file:
evaluator
01-19-2004, 05:41 AM
must be multiplier of that value of alignment, wich must be multiplier of 200h..
infinity+
01-19-2004, 11:39 AM
Thanks evaluater, I finally got it to work ;)

600h is the most I can extend the section to. Is there something else I need to change to extend the section >600h ?
ZaiRoN
01-19-2004, 02:20 PM
Hi infinity+,
Is there something else I need to change to extend the section >600h ?You have only to add all the bytes you need to the file, save it and then adjust VirtualSize and RawSize values.

ZaiRoN
doug
01-19-2004, 04:48 PM
Confused on how to use this: SizeofImage: 00005000

in your case, sizeofimage is .rsrc voffset + vsize, rounded up (ceiling) to the higher alignment value.

If you use lordPE to make those changes, it'll take care of that for you.

ex: Change .rsrc size to 0x2000

4. item:
Name: .rsrc
VirtualSize: 0x00002000
VirtualAddress: 0x00004000
SizeOfRawData: 0x00002000
PointerToRawData: 0x00000C00
PointerToRelocations: 0x00000000
PointerToLinenumbers: 0x00000000
NumberOfRelocations: 0x0000
NumberOfLinenumbers: 0x0000
Characteristics: 0xE0000060
(CODE, INITIALIZED_DATA, EXECUTE, READ, WRITE)

SizeOfImage: 0x00006000
SizeOfHeaders: 0x00000400

& add 0x1A00 bytes at the end of the file.
infinity+
01-19-2004, 04:54 PM
I did all that except........ & add 0x1A00 bytes at the end of the file.

How is this done?

Without changing that I get 'Not valid pe file'......

ZaiRoN
The virtual size and raw size are automatically done by LordPE. When I add more than 600h to the rsrc section the program displays the error 'Not valid pe file'......

The header gets screwed up I guess..... :confused:

When I rebuild the file RawSize(4000) changes to 4E7 and there is absolutely no space at the end of the file....
ZaiRoN
01-19-2004, 06:00 PM
add 0x1A00 bytes at the end of the fileHave you ever used an hex editor? Sorry but I suspect that your problem resides in it.
To add all these bytes you have to edit (phisically) the file using this kind of tool (hexworkshop, ultraedit and so on...).
You can do all the work by hand with a simple hexeditor; add the bytes and then change some pe-values... nothing more.

Sorry if I misunderstand you...

Best regards,
ZaiRoN
doug
01-19-2004, 11:59 PM
add 0x1A00 bytes at the end of the file

If you just want to test your enlarged file (before pasting code in it), just insert nulls.. Hex workshop: Edit->Insert

WinHex: Edit->Paste Zero bytes

Your problem is you are telling windows (via the pe header) that your exe is "_that_" large, when it really isn't (because you forgot to physically enlarge the file on disk)

If you only want your file to have a larger section in memory, then you only enlarge the virtual size.

When I rebuild the file RawSize(4000) changes to 4E7 and there is absolutely no space at the end of the file....

You only need to "save", a "Rebuild PE" option will _most likely_ try to optimize the file structure thus destroying the extra space you have allowed.
infinity+
01-20-2004, 04:18 PM
thanks, ill try it


Sentinel Super Pro (16-bit)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel Super Pro (16-bit)
PDA

View Full Version : Sentinel Super Pro (16-bit)

Ziggy
01-19-2004, 02:12 AM
Hellao, all!

Could anyone helpme with sentinel super pro protected target, whitch is written on 16-bit Windows. How to define sentinel funtions (read,write,query, etc.) on 16-bi application?

Thanks.
gb_B
02-09-2004, 02:37 PM
Have a look at Sentinel Developer's Guide Appendix D Win 16 Api Functions Summary
JMI
02-09-2004, 03:47 PM
And then you might try following the direction for this Forum by reading the FAQ and then searching among the 95 threads here that mention sentinel to determine whether your question has been asked and, possibly answered before. Or course, it certainly is a novel idea to actually think you might have thought to read the manual before you ask questions. :rolleyes:

If you did any of those things, or at least had read the FAQ, you would not only know to do these things first, you would know to report that you had done them and not found what you needed, and none of my comments would have been needed. :eek:

Regards,


If you had to choose?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > If you had to choose?
PDA

View Full Version : If you had to choose?

milman
01-19-2004, 02:18 AM
Ok, I am about to be in a place where I cant access the internet with any degree of reliability As a new cracker, what should I have for dissassemblers? I have reserached quite a buit but nothing has quite covered this.....I have softice freeware versiion (avaiilable on simtel) and ollydbg. Whcih should I start out with? Sorry for the bad typing, I have had quite a few beers tonightl. For those who might not think I am serious, I realize what sort of pursuit I am getting into and I dont think I haVve asked anything unreasonable. I am merely in a time crunch and need some advice....

Thanks,
milman
dELTA
01-19-2004, 08:34 AM
I don't know what kind of tutorials you have found that don't mention any disassembler, but the following two are the ones mainly used: IDA Pro and WDASM.
milman
01-19-2004, 11:25 AM
I don't know what kind of tutorials you have found that don't mention any disassembler, but the following two are the ones mainly used: IDA Pro and WDASM.

Im sorry I didnt phrase my question very well. Let me try again I was a bit intoxicated when I wrote that. I have downloaded the freeware version of IDA Pro and I have WDASM as well. My question was actually in regards to debuggers. I have been reading the posts here where Softice has problems with win xp and was wondering if I should try a different debugger or stick with softice.Like I said I downloaded the ollydbg but havent seen a lot about that app.

Thanks
sgdt
01-19-2004, 12:31 PM
OllyDbg is where the fun is, followed closely by SoftIce. You'll want both.

If you go against something that is using drivers (ring 0), SoftIce is the way to go. I would also use SoftIce from time to time just to keep your skills sharp.

For everything else, I'd just use Olly. With Olly, you still have access to the rest of your computer while a process is stopped, and that is even more handy than it sounds. When you have the plug-ins installed, you can do most everything you can do in SI (with very similar commands).

After dumping in Olly, unless the protection is simple, I go directly to IDA for any of the mental work. Then, I dump the map to Olly, and use Olly for the final tests.

IDA can make even complex protections obvious. Plus, given decent symbol names, it makes the debugging process in Olly go much faster.

It took about 3 days of using Olly to fathom the fact I would never again use W32DASM. Even with that said, I still find myself learning new ways to use Olly almost daily. It's a very powerful debugger, without having to give up ring 3. It's also has fewer quirks than SI... :)
yaa
01-25-2004, 03:41 PM
sgdt, would you develop further on what you were saying about how a parallel use of IDA and OllyDbg could further "enhance our debugging experience" (ahhhhhhh, I'm talking like a MS spot!!!! :rolleyes: :D ).

yaa
sgdt
01-25-2004, 08:24 PM
I use Olly (and sometimes SoftIce) to remove encryption wrappers should they exist. I will then usually run in Olly just to see what I'm up against. If it takes more than a couple minutes, I then close it and load it into IDA.

IDA gives you, with almost no exaggeration, more information than the original coders had. You can even find coding mistakes quite easily (more on this in a minute).

You can graph out a registration check, even one that is very complex, with little effort. Nearly all convolution can be overcome with judicious use of code/data keys, and you visually see any place that could possibly be referencing data or code (or checking to see code is in-tact). It has an amazingly easy ability to have the program be exponentially easier to read as you work with it, by using named functions, named and typed parameters, and stack or global variables. As you work with the target, it becomes easier and easier to visually understand what is happening at a high level.

How does this help in Olly? Glad you asked! Because IDA allows you to navigate and name things so quickly (after initial disasm time), these names can be easily exported to Olly. Then, when your down in the code and a break suddenly fires, you get nice names as to where you are. You could do this in Olly alone, but it probably wouldn't be as fast or detailed.

Coding mistakes... Got to love 'em. I have a friend that had a plethora of shareware games from the same company loaded on her computer. They were all expired, and she asked if I could do anything about it. I only had a half an hour of free time, and there were like 30 games. There was no way I could fix them all.

I brought up Olly, and was able to correct the first game in about 5 minutes or so, but when I loaded one up in IDA, I discovered it had a flaw... By using it's graph function, I could visually see that it would set good guy to true if it opened the registry entry, but would never set it back to false if it couldn't deal with the data it was reading. It expected a number. (The root key was based on the serial number of the hard disk, all games were sub-keys of this).

So I wrote a program to enumerate through all the keys from all the games, and set them to Alpha values. Voila, all the expired games were no longer expired. They weren't technically registered, but they didn't pop nag screens or keep track of how long they were used. They were "as good as" registered. Total time was well within the 30 minutes I had.

IDA is incredibly powerfull. So is Olly. Using the maps for exports allow you to take advantage of both's strengths. I don't always bring up IDA, but when something gets complex, it's nice to have a tool that can tackle it easily.
Aquatic
01-25-2004, 08:52 PM
You must be very familiar with ASM.

I would use IDA more, but it just takes so long to load anything.
yaa
01-28-2004, 05:01 AM
sgdt, I'd like to ask you more about Olly-IDA interactions .... what can you export from one and import in the other??? You seem to talk of some kind of symbols file that IDA can generate and be imported into Olly. What else??? Can Olly generate something that can clarify code once imported into IDA???

yaa
sgdt
01-28-2004, 08:21 AM
In IDA, I just export a MAP file.

As I mentioned, I use it only when I'm going against something thats at least a little complex. I name interesting functions, these go into the map. (I load the map into Olly).

Olly is great, but sometimes you don't get 'pointed to' saying 'hey, that's interesting'.

Take a (semi-)popular text editor. I could have found it's check routine in Olly very easy. However, there was another routine that would call the check routine with known good/bad values, ensuring it's integrety. If it failed, it would memset (zap) something that wouldn't show up for a while (if I remember, it was the class for saving your document) and cause an exception when you tried to save.

That would have been very difficult to find in Olly alone, but the additional references showed up in IDA like a glowing beacon to sleepy crackers.

It's almost synergy...
nikolatesla20
01-28-2004, 09:41 AM
good idea, I've never thought of doing that yet, exporting from IDA into Olly. That should make even more effective work, like you said, synergy...:)

Thanks for the tip :)

-nt20
yaa
01-28-2004, 12:05 PM
Any good (and recent) tutorial around to start using IDA???

BTW what scares me about using tools such as IDA is the dead listing approach I expect instrinsic in them ...
Algorithms are often complex, expecially if they intentionally try to obfuscate what really gets done. How can a dead listing approach be of any use in such a world???

yaa
sgdt
01-30-2004, 07:49 PM
Any good (and recent) tutorial around to start using IDA???

BTW what scares me about using tools such as IDA is the dead listing approach I expect instrinsic in them ...
Algorithms are often complex, expecially if they intentionally try to obfuscate what really gets done. How can a dead listing approach be of any use in such a world???

yaa

Actually, there are a lot of tutorials out there. Google turns up a number of them, especially when you combine "softice" as a keyword.

Anyway, I think your inverting the point. Obfuscation is a LOT easier to get around in IDA than anything else I can think of. And being able to have a program draw up a chart of potential flows of code? It makes short work of most key check routines. You VISUALLY see the flow, it almost makes things TOO EASY!

There are, however, three downsides.

First, is that for complex polymorphic code (comlex packers and the like), it would be impractical to do an IDC script to unpack. So, dumping is nearly always done in OllyDbg or SoftIce *prior* to bringing up IDA. Simple XOR or the like, yeah, no problem. But IDC script wouldn't stand up to the likes of ASProtect. Dump first.

The second downside of IDA is initial load time. It can take many minutes to rip a meg EXE on my P2 laptop. A four meg exe can take a lot longer (it loves memory, and my lowly laptop hasn't got much).

The third downside is that it's not intuitive about programs created in Delphi. There are a few, and it would be nice if IDA handled Delphi targets the same way PE Explorer does. (If you ever run into a Delphi target, use PE Explorer!!!).

OK, back to good stuff. You run W32Param.IDC after loading, and now you have sensible variable names for all that code making Win32 calls. Variables that you can look at visually and see what set them, you click on a variable that got assigned someplace else, and you can see all the places that set or referenced it. It's Way Cool.

Enumerations and structures, including almost everything in the Win32 SDK, it's all there. A *FOLDING* editor!!! God, did DataRescue think of everything?

You almost don't need a debugger.

In case you didn't sense my happiness, IDA is PERFECT at reversing code. Yeah, you can crack stuff, but it is GREAT for reversing to! You have a feature you want in your program, and a program that does it nicely? It's damn close to cut and past to source code. Or you want to add a feature to someones EXE, and you want to make sure there won't be any ill effects caused by dependancies that aren't obvious? I mean, it's nearly impossible to hide stuf from IDA.

Bring up Google, find some recent tutorials, and then head to your favorite server to download (or, buy it. Wish I could right now, but I'm broke. God has BPX'd me..).
Aquatic
01-31-2004, 01:48 AM
I think sgdt should make us a tut for all this advanced stuff. :)


Elicense Software
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Elicense Software
PDA

View Full Version : Elicense Software

hobferret
01-19-2004, 09:40 AM
Hi everyone :cool:

I am in the process of trying to write an unpacker for this prog - I know the EIP is the EIP but wanna try to do it automatically without bothering with the IAT, however, what I really need is a copy of the vtcpak.exe :mad:

Does anyone out there know where one can be found, any version would do, I would appreciate any replies even if they come via a PM ;)

Thanx in advance

/hobferret
[NtSC]
01-26-2004, 02:37 PM
Hi everyone :cool:

I am in the process of trying to write an unpacker for this prog - I know the EIP is the EIP but wanna try to do it automatically without bothering with the IAT, however, what I really need is a copy of the vtcpak.exe :mad:

Does anyone out there know where one can be found, any version would do, I would appreciate any replies even if they come via a PM ;)

Thanx in advance

/hobferret

Hmm..
Is there still a Website that offers Shareware with ELicense?
I know about 2 Years ago there was one..

Would be nice if you could gimme an Address (xx/pm)
hobferret
01-26-2004, 05:31 PM
']Hmm..
Is there still a Website that offers Shareware with ELicense?
I know about 2 Years ago there was one..

Would be nice if you could gimme an Address (xx/pm)

[NtSC] you got PM but only link for prog protected with elicense, NOT the vtcpak prog :)

/hobferret
[NtSC]
01-27-2004, 07:33 AM
Thx!
Well,what i recall from ages back is:

- Start your eLicense Protected Application
( there should be a vtcpak24.dll in that dir )
- Wait till Nag-Screen appears..

- Bpx on FreeLibrary.. x - to get out
- Press the ´Try´-Button in that Dialog
- when SoftIce pops up press F12 to get the Caller
- about 25 Lines below you should find a jump..
- Set a Breakpoint on that jmp..
- When Soft-Ice pops up,trace in the Jump-Instruction with F8

- now u are at the OEP!

Days back i used Icedumps Pedump to rebuild the Iat,until i met i guess
newer protected Apps... Those had some reads in the original File (if i recall it right those were Appz).. I never investigated more on them, but could also have been a new Method to check if its still the original,unmodified File :)
hobferret
01-27-2004, 08:56 AM
']Thx!
Well,what i recall from ages back is:

- Start your eLicense Protected Application
( there should be a vtcpak24.dll in that dir )
- Wait till Nag-Screen appears..

- Bpx on FreeLibrary.. x - to get out
- Press the ´Try´-Button in that Dialog
- when SoftIce pops up press F12 to get the Caller
- about 25 Lines below you should find a jump..
- Set a Breakpoint on that jmp..
- When Soft-Ice pops up,trace in the Jump-Instruction with F8

- now u are at the OEP!

Days back i used Icedumps Pedump to rebuild the Iat,until i met i guess
newer protected Apps... Those had some reads in the original File (if i recall it right those were Appz).. I never investigated more on them, but could also have been a new Method to check if its still the original,unmodified File :)

[NtSC] Note they now use Elicen40.dll and a temp file, same idea as 24.dll :cool:

If app has expired do the following:-
Elicen40.dll and its temp file. 70Kb 09/17/2002 .

When at TRY BUY EXIT LICENSE screen open debugger and search for this byte sequence:-
83BDE0F0FFFF02
When found use the second string occurance, i.e. the one after the call.
But set BPX 3 instructions above the CMP.
EAX must equal 1 and the following memory compare must also equal 1.
It will then JMP at the CMP DWORD PTR [EBP+FFFFF0E0] to the unpacker.
If any errors like INVALID PASSWORD occur check these:-
After the JMP above note code location i.e. 02563B75 add 14AB and you should be at a TEST EAX,EAX following a CALL to 026501B - EAX should equal 1 here and JUMP.
Again at 02563B75+1DDD there is another TEST EAX,EAX this also should be EAX=1.
Eventually 4 RET instructions you should arrive back in the elicen40.dll, the EP is just a little way down at 02483CCF FF255CF84902 JMP NEAR[0249F85C].

Actual address may be different but the method will be the same :D

/hobferret


cracking FlexLM based program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > cracking FlexLM based program
PDA

View Full Version : cracking FlexLM based program

fafel
01-19-2004, 05:28 PM
Hi, I'm trying to crack a FlexLM v7.2a-based program. When debugging the target exe with SoftICEI could not set bpx lc_init - it is not among imported functions. Therefore, I cannot procede with searching for encryption seeds, as it is discussed in several fravia essays. Does anybody know what should I do? Thnx
OHPen
01-21-2004, 08:54 AM
Lo fafel,

i cant help you much but i can give you some hints...
First your work shouldn't start with with Sice, it should start with IDA.
You have to get the FlexLM SDK of the adequate version your target is using.
As you mentioned in your case it's the 7.2a.
Without the proper SDK there is no simple way of crackin' this protection.

You will later need it to create a valid license file.

After you have got the SDK make signatures( i hope you are familiar with it, if not search the board or google) of the *.lib file in order to apply it to IDA to identify the common FlexLM funktions.

This will make your work MUCH easier in order to get realitic change to crack it ;D
Maybe your are the opinion of that the old fravia tuts on FlexLM are not very appealing for newbies: I agree. When i started FlexLM stuff they didn't helped me a lot...but listen i mean at the beginning ;D Later your are happy about those rare ones ;D

There is one tut out with is very good to read and understand for newbiez.
It show FlexLM protection on DevPartnerStudio from Numega.
You can find it on searchin the exetools board for FlexLM...

Maybe this is a little help for you...

So don't dismiss ;D It's worth to learn ;)

Regards,

OHPen
JMI
01-21-2004, 12:29 PM
You also might want to check out the CrackZ Archive linked at the bottom of the Forums. It contains a great deal of information about FlexLM systems and reversing and has many of the tools you would need to reverse such systems. Just a hint. :D

Regards,
fafel
01-25-2004, 09:11 AM
To OHpen: Thanx, I had read the fravia essays before, they gave me good overview about flexlm cracking methods. I have followed the Nolan Blender's "Zendenc FLEXlm 7.2 cracking information". I found data[0] and data[1] (prior to l_sg call). The thing is, I could not find the pointers to the job structure at that point - values of job+8, job+c, job+10 were all null. Another curious fact: data[0] and data[1] were always the same during every execution of the prohram. What the hell is this?? Another unknown protection?


Adobe DRM (Digital Right Management)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Adobe DRM (Digital Right Management)
PDA

View Full Version : Adobe DRM (Digital Right Management)

kepeto
01-19-2004, 07:36 PM
ok guys, how to decrypt this Adobe DRM (Acrobat 6.xx).
you can find this protection in many ebooks that
sold in (ex: digitalmediastore.adobe.com)
it seems all decryptor like passware or another pdf
recovery failed to decrypt, ok maybe you have any clue or
resource(recovery) about this Adobe DRM ?
many thanks
dELTA
01-19-2004, 10:54 PM
Send a mail to Dmitry Skylarov and ask him, I've heard he knows the answer to that question... :D
kepeto
01-21-2004, 07:51 PM
Send a mail to Dmitry Skylarov and ask him, I've heard he knows the answer to that question... :D

hehehehee funny...(is he still in jail????)
i heard for some discussions, he released one software
(i don't know what is the name of...maybe you know guys share!!!)
thx
dELTA
01-21-2004, 07:56 PM
He was released, and he works (or at least worked, not sure now) at Elcomsoft, who sell lots of password cracker software (http://www.elcomsoft.com).
JMI
01-21-2004, 09:08 PM
Or, maybe, he's just marking time before he has to go back to jail. :p

Regards,
disavowed
01-21-2004, 09:26 PM
the tool he wrote is called "Advanced eBook Processor" (by Elcomsoft)

i feel 1337 cause i have dmitry's personal e-mail address ;)
kepeto
01-21-2004, 11:58 PM
i have 8 books that protected by this method (i have accounts in digitalmediastore.adobe.com) smaller size is about 2.3megs (Ace_the_IT_Job_Interview_.PDF).
whole 8 books need activation before we can read in different computer, so we must ONLINE!!!.
some guys in other forum(i forget) install something about plugins to fake the security checking

ps: if you guys interesting, where i can upload this BOOKS???...any open ftp maybe...
oh....you need acrobat reader 6.x.x at least...
- i think the progie is not "Advanced eBook Processor", it realeased last year(maybe), but stopped before dmitry get jailed
Kayaker
01-22-2004, 12:30 AM
ps: if you guys interesting, where i can upload this BOOKS???...any open ftp maybe...

Let's not get into any uploading discussions about any commercial software/ebooks that are in any way modified on this forum OK?

Kayaker
mike
01-25-2004, 08:37 PM
Yeah, nothing typically abbreviated with a 'z' is allowed here: cracks, serials, apps, wares.

And by the way, I was all the reverse-engineering AccessData had for four years: I wrote all but ten or so of the fifty password crackers on their site. So you can all count yourselves as 31337 :D
disavowed
01-26-2004, 10:28 PM
i think the progie is not "Advanced eBook Processor", it realeased last year(maybe), but stopped before dmitry get jailed
i assure you, "Advanced eBook Processor" is the app that got dmitry arrested


Trap exceptions 0E in NTVDM.exe without being a debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Trap exceptions 0E in NTVDM.exe without being a debugger
PDA

View Full Version : Trap exceptions 0E in NTVDM.exe without being a debugger

Japheth
01-20-2004, 06:53 AM
Hi,

I would like to trap exceptions 0E caused by protected mode DOS programs (DPMI) in the NTVDM.EXE process.
The DPMI app itself doesnt get noticed of 0Es by the server as it should be. So I wrote a VDD which places a handler at FS:[0], but this doesnt work either.

Any ideas appreciated

Japheth
sope
01-20-2004, 09:12 AM
Hello Japheth

I don't know if this below url will help you pls have a look hope it helps...

hxxp://scifi.pages.at/yoda9k/snippets/KiExctHook.zip

Regards, Sope.
volodya
01-20-2004, 12:08 PM
I would like to trap exceptions 0E caused by protected mode DOS programs (DPMI) in the NTVDM.EXE process.

Write a device driver. Hook IDT. Check if the process is a VDM one. If it is - do what you want. If it is not - pass it to the windows.
Japheth
01-20-2004, 01:03 PM
Thanks volodya, but I would prefer a not so "brute force" method.

Thanks sope for the link. Will check it.

Japheth
sna
01-21-2004, 10:09 AM
Have you thought about installing a handler in the Vectored Exception Handler (VEH) chain?
The VEH callbacks are executed before the SEH callbacks so that guarantees that you get first chance on all exceptions.
And if you hook the functions that modify the chain, you can handle the chaining yourself and further
guarantee that you'll be given the first chance to handle exceptions. You would of course need to be in
the context of NTVDM for this to work... Ooh, and it's only supported on XP/2K3 Server

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/structured_exception_handling_functions.asp

cheers, sna
Japheth
01-22-2004, 02:00 AM
Thanks sna,

I heard about this only recently. I currently consider to give it a try, but since it works for XP only and isnt sure to work for the constellation in question I'm hesitating a bit.
user
01-24-2004, 04:29 PM
Hi,

I would like to trap exceptions 0E caused by protected mode DOS programs (DPMI) in the NTVDM.EXE process.
The DPMI app itself doesnt get noticed of 0Es by the server as it should be. So I wrote a VDD which places a handler at FS:[0], but this doesnt work either.why don't you use the DPMI API to hook exception vectors?
Japheth
01-25-2004, 04:40 AM
why don't you use the DPMI API to hook exception vectors?

because in NT/2K/XP
>>>>>>>>>>>>>>>>>>>>>>>>>>>
The DPMI app itself doesnt get noticed of 0Es by the server
>>>>>>>>>>>>>>>>>>>>>>>>>>>
which means, if you install an exception handler by DPMI function ax=0203h, bl=0Eh, it wont be called ever.
user
01-30-2004, 06:42 PM
because in NT/2K/XP
>>>>>>>>>>>>>>>>>>>>>>>>>>>
The DPMI app itself doesnt get noticed of 0Es by the server
>>>>>>>>>>>>>>>>>>>>>>>>>>>
which means, if you install an exception handler by DPMI function ax=0203h, bl=0Eh, it wont be called ever.
how do DJGPP/CWSDPMI do it then?
Japheth
01-31-2004, 04:38 AM
how do DJGPP/CWSDPMI do it then?

CWSDPMI is a DPMI server executed when no other server is running. This is NOT the case when opening a DOS box in win9x or winnt. The problem I'm describing only applies to the build-in winnt/xp DPMI "server" NTVDM/DOSX


Windows File Protection Story with happy ending
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Windows File Protection Story with happy ending
PDA

View Full Version : Windows File Protection Story with happy ending

doug
01-21-2004, 12:26 AM
Hello, here's something that happened to me today:

As I was learning on the "Rich"-stuff that ms link.exe adds on exe files (and tips on shrinking exes size), I downloaded a STUB.exe to use with the LINK's /STUB switch.

I did the following:
Extract file to desktop, hex edit file.. etc.. Close hex editor
When I try to delete it, Windows tells me a sharing error ("... In use in some other program?")..

Buggy hex editor I thought..
reboot
try to delete file, still windows file protection problem.. (wtf!)

The file is locked but I can still edit/save change to it..
Every monitoring tool I tried from sysinternals failed to tell me which process had an handle to the file (see later)

Bit annoying to have these files laying around the desktop permanently. To remove the file, I hex edited the file(s) and I pasted the code from a 'normal' PE exe. Rebooted, file can now be deleted!

Seems like a weird thing to me.. Does windows assume old dos files shouldnt be deleted?
Since no tool could report an opened handle, I'm guessing there is some kind of check performed on the file before it's given the okay to be deleted?

Os: Windows XP SP1.

Is this a documented issue? did anyone else have that problem?
Kayaker
01-21-2004, 02:24 AM
Hi

Seems very odd, can you duplicate what occurred? Just curious where you got the stub from, you might know this article, you could try the stub here:

http://its.mine.nu/html/coding/essays/stub.html
evaluator
01-21-2004, 04:13 AM
if you want delete, how about deleting in Dos?
Fake51
01-21-2004, 08:25 AM
Every once in a while I get similar problems when trying to delete files. It's typically when burning some data to a cd - after the burn is done (using Nero), I try to delete the data and pop, messagebox in my face telling me the file is in use. Funny thing is that loading Nero and deleting it FROM Nero works (loading Nero in itself is not enough, I have to use Nero to delete the file). This behaviour is on XP as well - ticks me off it does. Haven't bothered to see what exactly Nero does when opening files to burn - don't make backup copies that often.

Fake
disavowed
01-21-2004, 09:17 AM
but with nero it's just a sharing problem afaik (sysinternals tools will show that nero owns a handle to the file)

doug, i would be very interested if you could post the appropriate info so that we can try to duplicate the problem, as kayaker said
dELTA
01-21-2004, 10:11 AM
Sounds interesting indeed, please keep us updated with any info you find about this.

Also, doug, did you learn anything interesting about the "Rich" stuff while looking into it? I have always been curious about what that data after the stub code is (most of the time seemingly containing the word "Rich"), but never managed to get any good info about it.

See for example this old thread of mine in the Win32asm forum:

http://board.win32asmcommunity.net/showthread.php?s=&threadid=11182
doug
01-21-2004, 10:39 AM
@kayaker: the stub on that site didn't raise the issue. I included one as attachment.

Ok, I tested an another computer, same issue. (also windows XP).

@delta:
Yes, in fact, I found the information from that board:)
http://board.win32asmcommunity.net/showthread.php?threadid=14699&highlight=Rich+Link

The "garbage" is "encrypted" MS internal codes about the components you used:
Example:
the second dword before hard coded "Rich" is "@comp.id" variable i.e.
MS unique(hard coded) compiler ID number XORed with the key(see bellow)

MS ML.EXE Ver.6.14.8444 -> comp.id is 1220FC
(You can search: FC2012)
MS ML.EXE Ver.7.00.9466 -> comp.id is 4024FA
(search: FA2440)
MS ML.EXE Ver.7.10.2179 -> comp.id is 0F0883
(search: 83080F)
MS ML.EXE Ver.7.10.3077-> comp.id is 0F0C05
(search: 050C0F)

MS C/C++ Optimizing Compiler Version 12.00.8804 for 80x86 ->comp.id is 0B2306

and on wasm.ru (+ babelfish), there's a small article by someone named S.T.A.S (also attached, as I write this, wasm.ru is down).

Выбираем самое похожее (для Version 5.12.8078 ):

:0044510C E86FABFFFF call 0043FC80
:00445111 8B8DE0010000 mov ecx, dword ptr [ebp+000001E0]
:00445117 89442410 mov dword ptr [esp+10], eax
:0044511B 03C8 add ecx,eax <---
:0044511D 898DE4010000 mov dword ptr [ebp+000001E4], ecx
:00445123 FF1510114000 call _tzset

I'm using MASM32 for my asm projects, and stas' article points out how to patch your linker so that this "Rich" stuff isn't included. WASM' website pointed out more things in the file description of this document, but the translation was very poor. What I managed to understand was that it was a bunch of unique IDs.. they had a statement like "you write viruses and release it (built with this linker) .."..
dELTA
01-21-2004, 10:54 AM
Cool, thanks! Especially cool is that it actually WAS some encrypted potentially identifying information, just like my conspiratorial imagination initially suspected (and that they referenced my thread in that thread). :p
disavowed
01-21-2004, 04:57 PM
yep, it's a bug in explorer.exe...
if you do something with it via the windows shell, explorer.exe never closes the handle as it's supposed to. this can be solved with sysinteral's process explorer (find the handle and close it with process explorer). once all handles are closed thusly, it can be deleted

don't know the details of why this bug exists. i guess explorer.exe considers it an invalid pe file?
dELTA
01-21-2004, 06:14 PM
Is this really the same issue as doug mentions? He couldn't delete it even after a reboot it seems (without correcting the header first), and also, in his case the sysinternal tools couldn't see which process had the handle?
r4g3
01-21-2004, 06:47 PM
this is not necesserity with PE files. happened for me with .avi's :) again rebooting wouldnt work, but FAR manager erased them without any problems. they were first opened with winmedia player 9 ... so it is not pe-only issue.
dELTA
01-21-2004, 07:46 PM
The avi problem is another thing, it is caused by a bug in shmedia.dll, and can be fixed fixed with the attached inf-file (modifies a single registry value to prevent auto-loading this dll in explorer).

Also, in this case it is not the simple matter that some module always opens a certain file type and forgets to close it, but the peculiar thing is that when certain modifications were done to the executable header, the file was locked, but if the changes were undone, it was unlocked again.
disavowed
01-21-2004, 09:28 PM
Is this really the same issue as doug mentions? He couldn't delete it even after a reboot it seems (without correcting the header first), and also, in his case the sysinternal tools couldn't see which process had the handle?
if he was trying to delete it with explorer.exe after rebooting by dragging it to the recycle bin, or clicking on it and pressing delete, or whatever, then chances are that the bug could still arise. so, i think it is the same issue. but, i don't mind getting proven wrong ;)
Fake51
01-22-2004, 08:05 AM
but with nero it's just a sharing problem afaik (sysinternals tools will show that nero owns a handle to the file)

Just might be - just have a memory of rebooting the machine and still not being able to delete the file, in which case it wouldn't just be a sharing problem (as the file wouldn't be open). Not sure though - been a while since I had the problem last.

Fake
Woodmann
01-22-2004, 07:19 PM
Hi,

once all handles are closed thusly,

Look at that big 5 dollar word---thusly.

Henceforth and forthwith, the word "thusly" shall't
be useth from this point on. :p

Disa, I just couldnt resist :D

Woodmann
JMI
01-22-2004, 08:52 PM
Thus sayeth the Wood. :p

Regards,
disavowed
01-22-2004, 11:13 PM
Look at that big 5 dollar word---thusly... Disa, I just couldnt resist :D
"benefits of a classical education" :p

(+1 rce point to anyone who can name what movie that's from)
Kayaker
01-22-2004, 11:56 PM
Wut's this, Woodmann's search games revisited?

"When Alexander saw the breadth of his domain he wept, for there were no more worlds to conquer. Benefits of a classical education."

The same movie which featured this famous line:
"Yippee-ki-yay, motherf***er!

OK, +2 RCE points for this one :p

"There's something in the atmosphere that makes it impossible to POP A BONER!"
JMI
01-23-2004, 12:06 PM
As Kayaker noted:

John McClane: Yippee-ki-yay, motherf**ker= Die Hard (the first one.) :D

Hans Gruber: "When Alexander saw the breadth of his domain he wept, for there were no more worlds to conquer. Benefits of a classical education."
Same Movie.

Hans Gruber Quotes:

"What idiot put you in charge?"

" I wanted this to be professional. Efficient, adroit, cooperative, not a lot to ask. Alas, your Mr. Takagi did not see it that way, so he won't be joining us for the rest of his life."

"You ask for miracles, Theo. I give you the F.B.I."

"Mr. Takagi, I could talk about industrialization and men's fashions all day, but I'm afraid work must intrude."

As to the last quote, I simply offer another line from Hans: "I must have missed that episode of 60 minutes." :D

Regards,


Softice: Hide and Seek
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Softice: Hide and Seek
PDA

View Full Version : Softice: Hide and Seek

dipeshrestha
01-21-2004, 01:07 AM
Hi all,

Manual unpacking is of quiet interesting. But aspr is one of the best. While tracing the packed code with the softice the opcodes just change while tracing. Like

xxxx:345677 JMP 345679
xxxx:345681 POP ESI

if the code look like this where this jump takes me? they r hiding there codes from softice. how can we tackle such problem.

Dipesh
:mad: Still Newbie
chlankboot
01-21-2004, 04:10 AM
this appears in the entry point (right?), try 2 change eip to 345679.
doug
01-21-2004, 10:49 AM
While tracing the packed code with the softice the opcodes just change while tracing

they appear to be changing, they are not, the obfuscation tricks like that have been discussed many many times before.
type CODE ON in sice, the code is always the same.

xxxx:345677 JMP 345679
xxxx:345681 POP ESI

hum.. is pop esi directly after the jmp? (didn't know of a 0xA jump opcode)
You posted so little information, that I'm not even sure what your problem is.

Do as chlankboot said, or just trace into (f8), you'll realize what's happening.

Dipesh
Still Newbie

then use the newbie section ;)
naides
01-21-2004, 01:58 PM
Hi all,

Manual unpacking is of quiet interesting. But aspr is one of the best. While tracing the packed code with the softice the opcodes just change while tracing. Like

xxxx:345677 JMP 345679
xxxx:345681 POP ESI

if the code look like this where this jump takes me? they r hiding there codes from softice. how can we tackle such problem.

Dipesh
:mad: Still Newbie

As doug said below it is typical obfuscated code. The trick here is that the instruction xxxx:345677 JMP 345679 jumps to the middle of some instruction so it changes the assembler reading frame, meaining the next instruction it will execute is NOT POP ESI but wahtever instruction happens to be at position xxxx:345679. when you trace it with F8 or F10, you see the code window of Sice automagically change to the new instruction frame.

Read here.
hxxp://www.cs.arizona.edu/solar/papers/CCS2003.pdf
JMI
01-21-2004, 09:23 PM
dipeshrestha:

You may also try entering "obfuscation" in the search window at the top of the Forums and you will find a number of threads, going back to the last two years discussing this issue here.

Regards,
Kayaker
01-21-2004, 09:42 PM
Simply stated, it is sagacious to eschew obfuscation.
- Norman Augustine
JMI
01-21-2004, 09:43 PM
And if you will enter "code obfuscation" in your favorite search engine, you will find many. many articles and discussion about obfuscation issue for a great many languages.

Regards,
dipeshrestha
01-21-2004, 11:15 PM
thank you all for giving me idea about code obfuscation. will be learning about it now...

thank you
dipesh
chlankboot
01-22-2004, 04:23 AM
most packers/encrypters use obfuscation, so that it is not possible for disassemblers to do their job correclty even IDA shows invalid instructions (in red) due to the linear treatment it uses to disassemble the file).
if the obfuscated code appears in the beginng u can trace with ice till u reach the real begenning of code, note the adress and change the entry point of your program to that address.
doing so u can disassemble great part of the file until the next obfuscated block, trace it with ice again, find out exit address, patch the file so that u bypass or nopp it. i know this seems to be so theorical but it works, sometimes u have to correct CRC ...
finally u'll be able 2 disassemble the file and analyse the effective code.
hope this will help.

still newbie toooo :p
dipeshrestha
02-03-2004, 01:08 AM
Dear All,

i have just got a new tool 'TRACEDUMP' which remove code obsucation. it is really nice program that remove code obscufation and work in junction with softice.

But still learning to work with it.
naides
02-03-2004, 06:43 AM
Dear All,

i have just got a new tool 'TRACEDUMP' which remove code obsucation. it is really nice program that remove code obscufation and work in junction with softice.

But still learning to work with it.

Is that Kayaker's TraceDump?

In that case you are in trouble because I have exclusive rights for Advertisement and marketing, see here: http://66.98.132.48/forum/showthread.php?t=5201&highlight=Tracedump

:) :)

So that is the real use for Kker tool! that is remarkable.


FlexLM7.2 -invalid pointer to the job structure
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM7.2 -invalid pointer to the job structure
PDA

View Full Version : FlexLM7.2 -invalid pointer to the job structure

fafel
01-21-2004, 06:11 AM
Hi. I am stuck in digging correct seeds out of my flexlm 7.2 protected program. Applying Nolan Blender's "Zendenc FLEXlm 7.2 cracking information." essay on my target, I found all _l_sg calls inside the program. Examining the stack at that point (dd esp) I found these values for pointers:
esp = 00EE3300
esp+4= 00EE344C
esp+8= 0012FAE8
Doing dd (12FAE8+4) revealed me the data[0] and [1], but the pointer to the job structure (EE3300) did not yield anything! Value in 00EE3300+8 is 00000000,
as well as in EE330C and EE3310 --> the XOR value is 0.
That's pretty wierd and obviously something's wrong. I put data[O] and [1] into lm_code.h - you bet it was invalid. What I did wrong? Is there some another protection used in te flexlm 7.2a?
Thanks for any suggests!


Process Patching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Process Patching
PDA

View Full Version : Process Patching

evn
01-21-2004, 11:19 AM
For the past week or so i've been focussing on cracking a particular software application, and the method that is least intrusive to the application is to edit the third party dll's it uses to verify registration.

I've created a chunk of assembly code and *can* patch the process directly on the disk, but this raises a problem that i can't seem to overcome. If you edit the dll, when you try to perform a certain action it brings up the 'unable to verify software version' message (it connects to a server, its a server-based application). I know that its only because ive patched it on disk that is causing the problem, as if i don't connect to the server the patch runs fine in local mode. It sends a CRC and i don't particularly want to edit more than i have to, and optimally i want to be able to patch and revert on-the-fly.

Basically, i need to be able to patch the process after its already started running. I've searched the forum and google/yahoo, and come up with nothing. In particular i was looking for an application similar to the generic patchers, only it patched an already running process.

ie. You compare original and modified files to create a patch, then the patch can be executed and not affect the hard-copy of the file at all.

I saw something on a forum a while back, but im not sure if it went as far as to discuss how it would work to patch dll files in memory, which is my main goal (connect to the server, then patch, i know for certain the check is only on login).

Does anybody know of a tool that can do this, or a tutorial/sample source code for a patcher or for just plain patching of this type?

Thanks in advance.
dELTA
01-21-2004, 03:44 PM
Check out the Win32API commands CreateProcess/OpenProcess and WriteProcessMemory (and possibly also SuspendThread/ResumeThread if you want to be really fancy :)), that should be enough to get you started.
LibX
01-22-2004, 01:16 PM
Use the DzA Patcher:
http://protools.anticrack.de/files/patchers/dzapatcher.zip


bpx bug in WKTVBDE 1.4 found+fixed+tutorial :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > bpx bug in WKTVBDE 1.4 found+fixed+tutorial :)
PDA

View Full Version : bpx bug in WKTVBDE 1.4 found+fixed+tutorial :)

0xf0001
01-21-2004, 07:09 PM
hi there!

I am currently looking at a kinda famous "old" protection that deals with pcode and therefor started using the WKTVBDEbug. since this protection uses an OCX i shortly ran into this bug when debugging this OCX (yes, i try the hardcore approach on this gggg)

so why not put on top of beeing somehow in the very dark with this topic - come to the conclusion that i have NO tool that does what I need. cause also WKTVBDE that would be it has such an annoying limitation that you cannot BPX into an address that you can not currently doubleclick in your small code window.

that is very bad, because you can always start from the beginning and not just jmp where you already were. you have to trace it everytime. kinda new game new luck thing ggg

fortunately WKTVBDE was very gently written for reversing and it turned out to be quite easy to change the thing:

when you <ctrl-e> and enter an address for your breakpoint and it has 8 characters (the OCX for sure ALWAYS has) the last character will be cut off (lowest nibble) but hey you get an extra "0" in front of it (highest nibble)
making from my input eg 1100eebf -> 01100eeb. ups.

i have written also a short tutorial about how to patch it that i think fits quite good for a newbie/beginners "reversing" tutorial - since it is very basic.

have phun!

greetz, da 0xf001
dELTA
01-21-2004, 07:56 PM
Hehe, nice work. :)
JMI
01-21-2004, 09:04 PM
Always happy to see more tools for p-code. There are not alot of them out there.

Regards,
disavowed
01-21-2004, 09:34 PM
very simple patch, but i'm really glad you went to the effort of writing it up and posting it here. nice work!
0xf0001
01-21-2004, 10:05 PM
thank you people for the positive feedback!

yes, i was also curious that it was _so_ simple.
and so it came in to my mind why not write it down and people can have 2 values out of it.
first the people like me that want to do something very specific and sit in front of a general tool that gives them everything, but suddenly a limitation comes up that brings everything to fall. and i remember the pain when you just have to accept that you cant go further although you got the full taste of it :) and it helped me personally a lot.
second i talked a little in a general approach how can you do such thing? you see you need not be scared of a lowlevel tool like a debugger. and that everything breaks down to simple questions and there is no magic. ok this is a very easy case. and so you get a taste and maybe want to understand more and more .... :)
finally you have to do the work yourself gggg and feel a little like the experts.
so i think could be a good starting point although its so simple.
it is not to impress or so - and i say it is easy but my intention was to maybe put it to any beginners or newbies tut collection. you can read out names of tools, types of tools and so on. and that it could be maybe good to have an api reference and so on. small peaces that should make them happy who search for it :)

thx, 0xf001


5 minutes of fun
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > 5 minutes of fun
PDA

View Full Version : 5 minutes of fun

ZaiRoN
01-22-2004, 01:40 PM
Hi All,
if you are bored or if you are not able to reverse a proggie, take a break:
http://1337-face.dk/pingvin.htm

My record is 323,4... can you beat me? :D

Zairon
JMI
01-22-2004, 02:10 PM
And how can one tell if the poster is telling the truth?? :D

Regards,
doug
01-22-2004, 04:41 PM
I've found that you get the optimal results when you bat < 190 (but as close to it as possible)
dELTA
01-22-2004, 05:31 PM
Let's just say you were a bit off with that optimal angle doug... :p
ZaiRoN
01-22-2004, 05:49 PM
Delta,
Adobe Photoshop 7.0.2004:01:22 23:27:02hmmm... seems like you made some fine changes to the picture :D

For all: do you think its possible to reverse the game and to obtain a very long jump? ;)

ZaiRoN
JMI
01-22-2004, 06:06 PM
See. I told you you couldn't trust the "results." And I had dELTA in mind when I made that conclusion. :D

Regards,
dELTA
01-22-2004, 06:43 PM
Delta,
> Adobe Photoshop 7.0.2004:01:22 23:27:02

hmmm... seems like you made some fine changes to the picture :D
Hey, I just saved my screenshot in Photoshop, is that a crime?!? Ok, ok, I'll rephrase the question: Is that a crime (if I would actually own a license of the aforementioned program)?!? :D

For all: do you think its possible to reverse the game and to obtain a very long jump? ;)
Yep, there was actually a version of this exact game online at the following address a few days ago, where you could hit much harder (of course, they might have had access to the "source" too, but anyway):

http://ogc.ath.cx/files/tmp/pingu.htm

Sadly, it seems to be down right now though... :(
Manko
01-22-2004, 07:59 PM
Mmm...

I got 567.9 at this address... :)

http://www.art-pack.pl/trash/pinguin.swf

/Manko

Yep, there was actually a version of this exact game online at the following address a few days ago, where you could hit much harder (of course, they might have had access to the "source" too, but anyway):

http://ogc.ath.cx/files/tmp/pingu.htm

Sadly, it seems to be down right now though... :(
Woodmann
01-22-2004, 08:32 PM
Howdy,

Put me down for 587.1
I got bored after 10 minutes.

Woodmann
JMI
01-22-2004, 08:36 PM
Whoa. You guys is good. There are several major league baseball teams which could use your services. I hear they pay better than the salaries here. :D With Marko's site I managed 587.6 with about 10 swings, but I couldn't do nearly that well with Zai's. :rolleyes:

Regards,
dELTA
01-22-2004, 08:56 PM
593,5 - and I don't even have a fake screenshot to prove it, so you just have to believe me. :p No, but really.
disavowed
01-23-2004, 08:54 AM
i get:

Forbidden
You don't have permission to access /pingvin.htm on this server.
Apache/1.3.27 Server at www.1337-face.dk Port 80
dELTA
01-28-2004, 01:16 PM
Sometimes penguins just get enough... :D
JMI
01-28-2004, 01:20 PM
Whoa, there's a violation. Don't you know that the Yeti are on the endangered species list, world wide?? That penguin is in BIG trouble. And the phrase would be: "Sometimes the penguins just get even" or "Sometimes the penguins have just had enough." :D

Regards,
dELTA
01-28-2004, 01:28 PM
I wouldn't pick on that penguin's grammar if I was you... :)

Anyway, since the penguin has ended all the fun in the other game, here's a new way to help us measure who's the alpha male among us:

http://www.beust.com/dodge.html

My record on the few times I tried it was 35,387 seconds...
JMI
01-28-2004, 02:02 PM
And I wouldn't pick on the penguin's grammer if I were you. :p

Regards,
dELTA
01-28-2004, 03:35 PM
And I would try to spell "grammar" correctly at least once when criticizing it in someone's post. :D

At least, the penguin and I can blame the fact that we're not native English speakers (not to mention that we both have to type really fast to prevent our fingers/wings/claws to fall off from frost-bite, where we come from). :p
Aquatic
01-28-2004, 04:57 PM
If you want to cheat at this game.

Just download Tsearch and search for value type: float.

Almost all flash games use doubles for values, but this uses floats.

Yes, I'm lame.
JMI
01-28-2004, 05:15 PM
Fortunately, I've NEVER claimed that I could SPELL and, therefore, have NEVER been sensitive about spellings errors and accept corrections when they are reported. ;) And I did "try" to spelled "grammar" correctly only once, because I used it only once. :D Had I used it more than once, I would have "tried" to spell it correctly each time, and probably would have failed each time. :D That's the curse of not being able to spell. It generally happens every time. :rolleyes:

However, under circumstances you well understand, I do, occasionally, attempt to assist you with your idomatic use of this polyglot language we call American English and also freely concede that your English is way, way better than my Swedish, which is limited to a few words, without proper accent marks.

Oh, and in that spirit, it should be "to prevent our fingers/wings/claws from falling off from frost-bite" :D And, fortunately, I don't have 35,387 seconds to devote to you new offering. Were those metric seconds?? That's nearly 10 hours in American English. :cool: Silly Svensk. :p

Regards,
Woodmann
01-28-2004, 06:56 PM
If you want to cheat at this game.

Just download Tsearch and search for value type: float.

Almost all flash games use doubles for values, but this uses floats.

Yes, I'm lame.

Lame ? No way, that is "thinking" like a reverser :D

As for grammer/grammar, it depends on where you live and dialects.
I call her gramma :p

Woodmann
evaluator
01-29-2004, 04:15 AM
in cache i found pinguin's flash.
if you want i can unload
dELTA
01-31-2004, 12:58 PM
Sure eval, you may proceed unloading that flash app from your memory. :) In the meantime, I'm uploading a personal version of it here (I got tired of manipulating my record screenshots in Photoshop, so I patched it to get longer results directly :)). Enjoy! (click the attachment to play it directly) :p
JMI
01-31-2004, 01:18 PM
I liked the one where the penguin won better. :D But 913.6 on the first hit is more ego satisfying that the first hit on the original. :rolleyes:

Regards,
esther
01-31-2004, 01:32 PM
This thread has been post for many dayz since 01-22-2004, 03:10 PM

Its more than 5 minutes hahahahha
>As for grammer/grammar, it depends on where you live and dialects.
I call her gramma

what!? You call her grandma? LOL
dELTA
02-27-2004, 09:36 PM
The yetis strike back... :D

http://www.8ung.at/peacekeeper/index.html


KANAL Sources
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > KANAL Sources
PDA

View Full Version : KANAL Sources

v0kram
01-22-2004, 02:58 PM
hxxp://www.secretashell.com/PEiD/viewtopic.php?t=21

Enjoy
0xf0001
01-23-2004, 11:02 PM
hxxp://www.secretashell.com/PEiD/viewtopic.php?t=21

Enjoy

the link doesnt work :(
doug
01-24-2004, 12:48 AM
the link doesnt work

you're kidding right?

so if http stands for hypertext transfer protocol
what does hxxp stand for?
esther
01-24-2004, 02:49 AM
Is that so important? The link is dead
you're kidding right?

so if http stands for hypertext transfer protocol
what does hxxp stand for?
Kayaker
01-24-2004, 03:56 AM
> Is that so important?

Yes it is

> The link is dead

No it's not

:)
0xf0001
01-24-2004, 06:42 AM
aha now it works! :) tried for 2 hours before posting...
and thanks for the special tip about the x-files protocol
btw echo hxxp 80 TCP >> %SYSTEMROOT%\system32\drivers\etc\protocol
helps gggggggggggg
(but opera doesnt care about it)
esther
01-24-2004, 10:33 AM
Even half the second makes the difference LOL

>what does hxxp stands for?

It stands for no direxct links are allowed to post in here


iceext screendump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > iceext screendump
PDA

View Full Version : iceext screendump

Ray
01-22-2004, 03:26 PM
i always get a wrong input file size, check ini file..
can someone explain how to set up correctly?
thanks.
Ray
01-24-2004, 07:06 AM
got it,
just a stupid mistake by me.
:o


Error´s unpacking Dillo 3.x
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Error´s unpacking Dillo 3.x
PDA

View Full Version : Error´s unpacking Dillo 3.x

iCEByTes
01-22-2004, 03:50 PM
hi , this is my first post , :rolleyes: :p

i work in proggy packed by dillo.. and i found problemn Dillo is 3.x

:eek: ... i try use DilloDump

and i found this error see atach fileZ

thanks for Read , and See ya
nikolatesla20
01-22-2004, 05:14 PM
Thats looks like a win98 error box to me.

Dillodump only works in 2K / XP. Not in any Win9X (including winME), and it only works up to Arma 3.01a.

-nt20
evaluator
01-23-2004, 09:13 AM
iCEByTes,

your first post is not so good.
1. for tool-relative posts, there is Tools forum.
2. while uploading in BMP-format, try pack-compress images
iCEByTes
01-25-2004, 06:41 AM
thanks from Reply , Ok Dont work in Win98Se :( Ok , But Thanks From reply and in next time i post in correct place , sorry to all


Armadillo unpack problem ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo unpack problem ?
PDA

View Full Version : Armadillo unpack problem ?

Computer_Angel
01-22-2004, 10:26 PM
I followed these steps to unpack it manually, but stoped in the step:
PUSH (handle of the son)
Call DebugActiveProcessStop

because olly did not find the procedure DebugActiveProcessStop in the iat.
arz
01-23-2004, 07:40 AM
hXXp://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/debugactiveprocessstop.asp

I would hazard a guess your not on WINXP/2003
Computer_Angel
01-29-2004, 01:35 PM
hXXp://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/debugactiveprocessstop.asp

I would hazard a guess your not on WINXP/2003

yep :eek: i use win 2000 :D


Looks like something really NEW !!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Looks like something really NEW !!!!!
PDA

View Full Version : Looks like something really NEW !!!!!

Zilot
01-23-2004, 08:06 AM
Hi !!!!!

This kind of protection I've never seen before. Making temporary files, then executing them, after all cleaning all of them. And plus debugging of main process, looks like something pretty new. Peid says nothing more than common C++. Do you believe, maybe it is.

First I thought it was Armadillo, but could Armadillo evolve for such short time, dont believe. One file in directory is protected with Armadillo, actually it is not protected just packed (there is no copy mem).

Try yourself with this bone. I needed several hours to domesticate him. If anyone has problem I can attach my files. Maybe they will work only under win2k, dont know.

Program is BulletProofSoft.com's SpywareRemover, really challange.

lmth.ndrs\moc.tfosoorptellub.www\\: ptth

Zilot
arz
01-23-2004, 08:43 AM
If I remember correctly they use (not Softwrap) Trialmaster. Dump it after the nag and it should be a fully working app.

Plenty of tuts on the web :)

Sorry for the wrong 1st infos, just found my old notes on CD...
arz
01-23-2004, 10:29 AM
Just tested it, still the same...

Nothing to learn doing it this way but then tis a pretty lame protection if can be unpacked quicker than some take to load.

UNWRAPPING:
Start Target.exe
At the Trialmaster nag screen, enter SI and BPX WriteProcessMemory
F5 out of SI
Click the 'Continue Trial' button on the nag
F5 seven times (after each break in SI)
At the next break(final) F12 to return to the 45r343e8.dll thread
Replace the TEST EAX,EAX with JMP EIP (ie A EIP, JMP EIP)
F5 and full dump the process (something like 45r343e8.dll)with LordPE as dump.exe
Back in SI put back the TEST EAX,EAX
F5 to exit SI

No need to rebuild the imports as the OriginalFirstThunk is intact and valid, only the FirstThunk points to memory (MSVBVM60)

dump.exe should now run as it's the full unwrapped prog
Zilot
01-23-2004, 11:08 AM
Shit :mad: Pe id screwed me up. Shit :mad: again.
I had to find out my own way to defeat this, instead of reading tut of 2 min.

Anyway thanks for replay. ;)
Zilot
01-23-2004, 11:40 AM
This one is from prehistorical age (1 min for fixing), even OEP is valid in dumped.exe. And I though it was something new :mad: and spent a lot of time in completelly another approach.
However the idea is very good, and with the little work coulde be excellent protector. Thanks to God they didnt realise that :p
nikolatesla20
01-23-2004, 12:17 PM
hehe, sorry it didn't work out for you :D

It's a hard lesson to learn - trying not to overthink or overestimate the protection, but over time you get more conservative and more methodical in approach to a new target. Especially after you learn most of the "tricks" protections use.

Usually the IAT is step one for me, to see how advanced the protector is. First I just but a BPX anywhere on a usual entry API (GetVersion, etc.) and when it breaks I look around in memory for a IAT structure...then I just dump the proggie anyway and paste in any IAT I was able to find, so I disAsm it with WinDasm, this can lead me to the OEP.....sorta like a test dump.

ANyway, you can usually tell by the IAT how "good" a protector is.

-nt20
evaluator
01-23-2004, 12:48 PM
bleh, so should i put direct in trash this 7MB?
or this prog is somehow usefull??
arz
01-23-2004, 01:51 PM
"And I though it was something new and spent a lot of time in completelly another approach."

heh, I feel a little guilty now....


upx unpack error
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > upx unpack error
PDA

View Full Version : upx unpack error

resuraha
01-23-2004, 09:17 AM
link.dll upx unpack error help!!!
Kayaker
01-23-2004, 01:53 PM
Hi

How about giving some information for people to base an answer on, or this kind of non-technical post goes in the garbage.

Kayaker


Are your ears burning?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Are your ears burning?
PDA

View Full Version : Are your ears burning?

disavowed
01-23-2004, 10:42 AM
From a new O'Reilly book entitled "Security Warrior" (http://www.oreilly.com/catalog/swarrior/chapter/ch02.pdf):

"Modern" RCE started with programmers who circumvented copy protection on
classic computer games, such as those written for the Apple II in the early 1980s.
Although this trend quickly became a way to distribute pirated computer software, a
core of experts remained who developed the RCE field purely for academic reasons.
One of the legendary figures of those heady days was the Old Red Cracker, (+ORC).
Not only was +ORC a genius software reverser, he was a prolific author and teacher of
the subject. His classic texts are still considered mandatory reading for RCE students.
In order to further RCE research, +ORC founded the High Cracking University, or
+HCU. The "+" sign next to a nickname, or "handle," designated members of the
+HCU. The +HCU students included the most elite Windows reversers in the world.
Each year the +HCU published a new reverse engineering challenge, and the authors of
a handful of the best written responses were invited as students for the new school year.
One of the professors, known as +Fravia, maintained a motley web site known as
"+Fravia’s Pages of Reverse Engineering." In this forum +Fravia not only challenged
programmers, but society itself to "reverse engineer" the brainwashing of a corrupt
and rampant materialism. At one point +Fravia’s site was receiving millions of traffic
hits per year, and its influence was widespread.
Today, most of the old +HCU has left Windows for the less occult Linux platform;
only a few, such as +Tsehp, have remained to reverse Windows software. A new generation
of reversers has rediscovered the ancient texts and begun to advance the science
once again. Meanwhile, +Fravia himself can still be found wandering his
endless library at http://www.searchlores.org.
nikolatesla20
01-23-2004, 12:20 PM
awesome. Old rce'rs never die, they just unpack :P

-nt20


How to get a DirectPlay bug fixed?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > How to get a DirectPlay bug fixed?
PDA

View Full Version : How to get a DirectPlay bug fixed?

Snatch
01-23-2004, 11:36 AM
I recently discovered all of this due to extensive debugging to discover why several games have stopped working. The question is how do I get Microsoft to release a patch about this and how do I inform them of the bug. If I go to their site their support is all crap and they want you to use up incidents or pay for support which is crap. I submitted it to the wish list thing but I doubt that goes anywhere. I want to talk to someone who actually knows what they are doing on the DirectX development team. Maybe you guys know more about this thanks :).

There exists a flaw in the old Directplay(up to 4a) interfaces supported in DirectX 9.0+. In the library file dpwsockx.dll with debugging symbols on the flaw is found in the FastReceive routine. If you try to receive more than 1000h bytes of user data it will not allow it and in fact errors fatally. The following code snippit from dpwsockx.dll from the latest DirectX 9.0b illustrates the problem

.text:5DF03564 and eax, 0FFFFFh ; trim off flags to get number of bytes to receive
.text:5DF03569 mov edi, eax ; put it in the edi as well
.text:5DF0356B jz short loc_5DF03596 ; if 0 bytes then okay
.text:5DF0356D cmp edi, 1000h ; should not be hardcoded at 1000h should be set to buffer size and compared with that
.text:5DF03573 mov [esi+4Ch], edi
.text:5DF03576 jbe short loc_5DF03596 ; if less than or equal to 1000h bytes
.text:5DF03578 cmp dword ptr [esi+54h], 0 ; some sort of flag that cannot be set...
.text:5DF0357C jz short loc_5DF0350D ; if the flag is 0 then fail!
.text:5DF0357E push edi
.text:5DF0357F call _SP_MemAlloc ; do what we should do...

This is from the routine FastReceive in dpwsockx.dll. FastReceive is always used if you have valid Winsock2 DLL library function handles as selected here: FastStreamReceiveThreadProc is what calls FastReceive to do its work.

.text:5DF063C7 push offset _FastStreamReceiveThreadProc@4 ; FastStreamReceiveThreadProc(x)
.text:5DF063CC jmp short loc_5DF063D3
.text:5DF063CE ; ---------------------------------------------------------------------------
.text:5DF063CE
.text:5DF063CE loc_5DF063CE: ; CODE XREF: StartPlayerListenThreads(x,x,x)+58j
.text:5DF063CE push offset _StreamReceiveThreadProc@4 ; lpStartAddress
.text:5DF063D3

Those are the two different options but since the old StreamReceiveThreadProc is never used even though it does not have the 1000h byte limit glitch. This is a confirmed DirectX 9.0+ glitch that affects all interfaces of Directplay from 4a and prior. How can this be reported to Microsoft so a patch can be issued? This has actually taken down a whole game from working.

Snatch
dELTA
01-23-2004, 07:32 PM
If I understand it correctly, the data in question is received over a network connection? It sounds like a textbook buffer overflow, which could even possibly be used to take over people's computers (I didn't examine the posted code, just read your description briefly, but anyway). If this is the case, you will be sure to get all the attention you want if you publish it. My recommendation would be to post it to e.g. the BugTraq mailing list, as a buffer overflow in a Microsoft network API. This way Microsoft will be guaranteed to notice and act upon it very quickly, and you might even be credited in one of Microsofts high-profile security patches if you're lucky.

I know Microsoft do have some easy accessible email address for reporting such serious security vulnerabilities though, I just don't have it in my head at the moment.

BugTraq might not want to post it if you haven't spoken to Microsoft first, but in that case you should easily be able to find other similar mailing lists with more "full disclosure" like policies. Just hurry before someone takes the glory from you after reading this post. :)

But remember, if I have misunderstood, and it is after all not a problem related to reading data over the network, it might not be a security vulnerability of nearly the same magnitude, just so you know.
dELTA
01-23-2004, 07:37 PM
Hmm, after looking at your code it seems I misinterpreted the term "errors fatally". I thought that you meant a program crash, but it seems you only meant that the application/function issues a fatal error code. In this case it can most likely not be exploited by buffer-overrun, and you can forget the publicity and easy attention from MS. :(
nikolatesla20
01-23-2004, 07:47 PM
hxxp://www.governmentsecurity.org

-nt20


Need some helps(newbie)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need some helps(newbie)
PDA

View Full Version : Need some helps(newbie)

flyingshadow
01-23-2004, 01:57 PM
1)---> WinDASM 8.9 : I'm using XP SP1 and WinDASM still run correctly,but I can't use patches for windasm 8.9 in programmerstools (http://www.programmerstools.org/)
When i was patching windasm,It's had an error and automatically closed :(

Do you give me the full patching version of windasm (included hex editor) :D ?

2)---> Hiew : when i was open a *.exe file using hiew,the font is displayed incorrect. I don't know what's happened?

3)---> Using SoftICE 4.05 for NT Patched for XP:
It's allright,but sometimes my PC auto restarted
And i can't use "exit" command :(

I'm using this command for Softice,is it correct :D :

INIT="wl;code on; altscr off; lines 57; wc 32; wd 8; wr; faults off;"

Thanks all for your help :D!
JMI
01-23-2004, 04:02 PM
flyingshadow:

Please go to the link at the bottom of the Forums and click on the link there which reads: "Read the FAQ." One of the things it will tell you is that you are NOT to ask for the "Tools of the Trade" on this forum. Those are things you are to look for elsewhere and ask for elsewhere.

Also use the search button at the top of the Forum to search for answers already given for problems with WinDASM. Just put that in the "search" box and you will find alot of information.

There is already a great deal of information here also about how to set up your version of SICE. Do a search for "winice.dat" and come back when you have a more specific question.

Regards,
nofurs
01-23-2004, 10:46 PM
Find the latest softice

driverstudio 3.0 or 3.1 the patched won't help anyway
hitman_crk
01-24-2004, 01:00 AM
2)---> Hiew : when i was open a *.exe file using hiew,the font is displayed incorrect. I don't know what's happened?

Try use : F4 --> Decode
some infor : use F1
flyingshadow
01-24-2004, 01:20 PM
Sorry,i've read faq :(

Thanks JMI :D
sLayer
02-20-2004, 02:11 AM
The w32dasm u r using is a different version it aint the 8.93.
Even i used to get same problems none of the patches worked.

The only solution is to download the right w32dasm.
From here on u r on ur own.Cause the faq say no urls baby.

But i will give u a small hint on how to make a patch for making string
data refs available for visual basic apps in w32dasm {ur version will do}

Search for something called "Code"
Then look here and there for the riight code and change it to enable
the sdr for vb appz

This credit goes to Duelist/Dread99

Laterz :D


Software Memory Breakpoints ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Software Memory Breakpoints ??
PDA

View Full Version : Software Memory Breakpoints ??

Emerson
01-23-2004, 02:24 PM
Hi guys,

I'm trying to find the technique used to detect memory access and I've not
found much by googling. I have written code for using the dbg regs but it's
limited to 4 BPM's. Are guard pages the way to go ?? Granularity of 4k means
I'll get alot of hits with the number of vars likely to be in a 4k block, and
quite a bit of overhead I guess !!

Any help or idea's at all would be cool :)

Cheerz,
Emerson
comrade
01-23-2004, 02:32 PM
That's only way I think...
AndreaGeddon
01-24-2004, 06:58 AM
if you need ranged breakpoints (like bpr on 9x) you can emulate them changing page protections. Page_guard could be useful, but it is turned off every time the status_guard_page is raised, so if you need a harder control you can launch the process with debug_process flag and set the type of access you want to check with VirtualProtect, and trap every fault resulting by a memory access you want to check :) In this way for example being a debugger you can set a bp on a little range and filter with your exception_access_violation handler the faults that occur in the same page where the range is but that you are not interested on. For example if you want a bp on range 00401000 - 00401010, due to page boundary you will be notified at every access in the page 00401000 00402000 but your handler can filter unwanted > 00401010 accesses. You could also use conditional breakpoints! You should have to set page protection at every fault notify :( so this is *really* slow, however it works :) The page_guard is too limited i think, its useful only in few cases, when you dont need a deep control of memory ranges.
Having a hardware support like in 9x would be great!
Bye!!!
AndreaGeddon


More product activation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > More product activation
PDA

View Full Version : More product activation

nikolatesla20
01-23-2004, 03:35 PM
New adobe products require this fancy activation now...found this on the faqs about activation and thought it was pretty funny:

--------------------------

Q: What about customers who have more than one computer at home? Will Adobe be offering a "family license"?

A: Adobe is committed to offering the most flexible user options. Product activation opens the door for Adobe to offer more tailored terms to our customers, and we will be evaluating all possibilities going forward.
--------------------------

LOL. Did that answer have anything to do with the question? What a line of bull....

So I guess no more easily unwrapping with Olly then? :P

-niko
volodya
01-23-2004, 03:42 PM
It has been already cracked. I can PM you the activator if needed
nikolatesla20
01-23-2004, 04:01 PM
Just out of curiosity, the mentioned they used a third party activation kit. Do you know who the third party was? I'm sure the party was someone that is common knowledge around here..(for example, flexLM, ARmadillo, etc).

-nt20
volodya
01-23-2004, 04:22 PM
Activation is implemented in Photoshop only and I have no idea about any implementation - no curiosity at all. My guess - they have invented their own crap. The same as MS did for the Windows activation. But at least MS used some cryptography - hyperelliptic curves etc...
Woodmann
01-23-2004, 10:20 PM
Q: What about customers who have more than one computer at home? Will Adobe be offering a "family license"?

What they didnt want to say.............

"we currently do not have a "family license" plan in effect because everyone know's that you can just do what you want."

Am I being to negative ??

Woodmann
Billy[23]
01-24-2004, 01:31 PM
If i remember correctly they used Safecast for activation, it was keygenned not long after :)

*edit*
yep:
ADOBE_PHOTOSHOP_CS_SAFECAST_KEYGEN-MIDNIGHT
evaluator
01-24-2004, 02:34 PM
well, niko, but i SEE answer there! (in one word)

**
"Who want, those will see.."

++
Don Wooma, you strangeosely become positive;)


Armadillo: something new!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo: something new!
PDA

View Full Version : Armadillo: something new!

none1899
01-24-2004, 02:53 AM
Hi all. While unpacking something which according to PEiD v0.91 is Armadillo 1.xx - 2.xx I crashed into something new. After dumping and fixing IAT this is what I see in the middle of the prog: It looks like aspr?s stolen bytes, but aspr steals only from OEP and here I see a lot of stuff like this:
00401145 -E9 B6EE3103 JMP 03720000
0040114A 87FA XCHG EDX,EDI
0040114C 87FA XCHG EDX,EDI
03720000 of course is an invalid address.

Did anyone see this before?
Please help if you did.
evaluator
01-24-2004, 07:19 AM
maybe that address is "invalid" for dumped file,
but mostly it exist in process memory!?

also it can be junk code, which will restored, when will need.

in once: debug or.. you will debug after.
Billy[23]
01-24-2004, 01:33 PM
Try the search button :) i posted some info on this not long ago.
none1899
01-24-2004, 04:51 PM
tnx! Billy[23]


Cracking Oxford Advanced Learner’s Dictionary
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Cracking Oxford Advanced Learner’s Dictionary
PDA

View Full Version : Cracking Oxford Advanced Learner’s Dictionary

Javi
01-24-2004, 12:02 PM
hello,

it might be not the right place, but im not sure about that. Anyway, I am posting because i have seen a paper by Macillaci regarding the procedure to follow in order to crack the above cited dictionary. I am a newbie and I am affraid I am unable to follow the path that Macillaci is suggesting. As he says, the dictionary is an educational tool so it's being not plane sailing to put it to work onto my computer. I would be grateful if someone could help me about that.

Thank you so much.

PS) This is the link to Macillaci's paper:
http://66.98.132.48/fravia/CDCOPS18.pdf
JMI
01-24-2004, 01:45 PM
Go to the link at the bottom of the Forums and click on the one that says "Read the FAQ." That link will tell you what you should do before you post a question. Essentially, you have given no information from which someone could help you. We have no idea what your problem is, what you have tried, and what type of system you are operating on and what tools you might have attempted to use. Read those instructions and then try a more focused question.

Regards,


modify the PIB? (Hey squidge)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > modify the PIB? (Hey squidge)
PDA

View Full Version : modify the PIB? (Hey squidge)

Aquatic
01-24-2004, 06:08 PM
I saw this post about hiding Olly by modifying the PIB: http://www.exetools.com/forum/showthread.php?s=&threadid=3164

Can you elaborate on the PIB method? What is the PIB?

Many thanks!
0xf0001
01-24-2004, 07:53 PM
Hi!
Have a look at the Win32 API CreateProcess().

BOOL CreateProcess(
LPCTSTR lpApplicationName, // pointer to name of executable module
LPTSTR lpCommandLine, // pointer to command line string
LPSECURITY_ATTRIBUTES lpProcessAttributes, // pointer to process security attributes
LPSECURITY_ATTRIBUTES lpThreadAttributes, // pointer to thread security attributes
BOOL bInheritHandles, // handle inheritance flag
DWORD dwCreationFlags, // creation flags
LPVOID lpEnvironment, // pointer to new environment block
LPCTSTR lpCurrentDirectory, // pointer to current directory name
LPSTARTUPINFO lpStartupInfo, // pointer to STARTUPINFO
LPPROCESS_INFORMATION lpProcessInformation // pointer to PROCESS_INFORMATION
);

When a process is spawned by the debugger - the debugger sets the DEBUG_PROCESS flag in the dwCreationFlags. It is about how to modify the
information so the process does not see the debugger.

Anyway the _Process information structure_ that fits in the PiB is defined also here:

typedef struct _PROCESS_INFORMATION { // pi
HANDLE hProcess;
HANDLE hThread;
DWORD dwProcessId;
DWORD dwThreadId;
} PROCESS_INFORMATION;

Members

hProcess

Returns a handle to the newly created process. The handle is used to specify the process in all functions that perform operations on the process object.

hThread

Returns a handle to the primary thread of the newly created process. The handle is used to specify the thread in all functions that perform operations on the thread object.

dwProcessId

Returns a global process identifier that can be used to identify a process. The value is valid from the time the process is created until the time the process is terminated.

dwThreadId

Returns a global thread identifiers that can be used to identify a thread. The value is valid from the time the thread is created until the time the thread is terminated.

greetz, 0xf001
JMI
01-24-2004, 08:01 PM
I believe the reference is to the "Process Identification Block." You will find some information about it here:
Process identification block
Abbr: PIB. An area of virtual memory which holds the information relating to each process. The term is also used to mean a port

http://www.rainingdata.com/support/techpubs2/1722head.html

and by searching, using your favorite search engine.

Regards,
0xf0001
01-24-2004, 08:53 PM
uups, better to read before posting .... and to sleep befor reading :) and ...
i can remember in xine3 this came up under win95 it was fs:[20] anyway,
sorry - you may forget my posting :)

0xf001
Kayaker
01-24-2004, 10:17 PM
Hi

Erm, Actually it's a PEB, Process Environment Block, not a PIB, whatever that is. In user mode it is located at 7FFDF000h and is pointed to by fs:[30].

The IsDebuggerPresent code in question was this:

77E72740 mov eax, dword ptr fs:[00000018]
77E72746 mov eax, dword ptr [eax+30]
77E72749 movzx eax, byte ptr [eax+02]
77E7274D C3 ret

change the movzx eax, byte ptr [eax+02]
to
XOR EAX, EAX
then fill the rest with nops

The fs:[00000018] is a pointer to the per-thread data structure TEB (Thread Environment Block), this is it's partial structure in Win2K:

TEB STRUCT
Tib NT_TIB <> ; 000h
EnvironmentPointer PVOID ? ; 01Ch
Cid CLIENT_ID <> ; 020h
ActiveRpcInfo PVOID ? ; 028h
ThreadLocalStoragePointer PVOID ? ; 02Ch
Peb PVOID ? ; 030h PTR PEB
...

You can see that the next line, dword ptr [eax+30] points to the PEB, and byte ptr [eax+02] points to the BeingDebugged flag:

PEB STRUCT ; sizeof = 1E8h
InheritedAddressSpace BYTE ? ; 0000h
ReadImageFileExecOptions BYTE ? ; 0001h
BeingDebugged BYTE ? ; 0002h
...

Now what's a PIB? Dunno, but it might be a bit of confusion due to the fact you can also get to this byte flag through the PROCESS_BASIC_INFORMATION structure. I've also seen it referred to as PDB (Process DataBase).

Here's the same trick more or less as IsDebuggerPresent incorporated in a kernel mode driver as antidebug code:

.data?
hProcess HANDLE ?
hDebuggerProcess HANDLE ?
ReturnLength DWORD ?
pCLIENT_ID CLIENT_ID <>
pEventObject_ATTRIBUTES OBJECT_ATTRIBUTES <>
pPROCESS_BASIC_INFORMATION PROCESS_BASIC_INFORMATION <>

.code
lea edi, pEventObject_ATTRIBUTES
lea esi, pCLIENT_ID

assume edi:ptr OBJECT_ATTRIBUTES
mov [edi].dwLength, sizeof OBJECT_ATTRIBUTES
mov [edi].RootDirectory, 0
mov [edi].ObjectName, 0
; can set to object name if ClientID.UniqueProcess not used
mov [edi].Attributes, 0
mov [edi].SecurityDescriptor, 0
mov [edi].SecurityQualityOfService, 0

assume esi:ptr CLIENT_ID
invoke PsGetCurrentProcessId ; check if our own app is being debugged
mov [esi].UniqueProcess, eax
mov [esi].UniqueThread, 0

invoke ZwOpenProcess, offset hProcess,\ ; OUT PHANDLE phProcess
PROCESS_ALL_ACCESS,\ ; IN ACCESS_MASK AccessMask
edi,\ ; IN pEventObject_ATTRIBUTES ObjectAttributes
esi ; IN PCLIENT_ID pClientId

invoke ZwQueryInformationProcess, hProcess,\
ProcessBasicInformation,\ ; ntddk.inc ; enum _PROCESSINFOCLASS
offset pPROCESS_BASIC_INFORMATION,\
SIZEOF pPROCESS_BASIC_INFORMATION,\
offset ReturnLength
; invoke ZwClose, hProcess ; can delete now useless thread handle

;--------------------------------------------------------
mov eax, pPROCESS_BASIC_INFORMATION.PebBaseAddress
bt dword ptr [eax], 16
; Bit Test to see if BeingDebugged flag is at byte 002 of PEB
jc @F
jmp nodebugger
@@:

;===================================================
; Let's get the handle of the debugger so we can kill it:
mov eax, pPROCESS_BASIC_INFORMATION.InheritedFromUniqueProcessId ; Debugger PID

; redefine CLIENT_ID to that of the remote process
mov [esi].UniqueProcess, eax

invoke ZwOpenProcess, offset hDebuggerProcess,\ ; OUT PHANDLE phProcess
PROCESS_ALL_ACCESS,\ ; IN ACCESS_MASK AccessMask
edi,\ ; IN pEventObject_ATTRIBUTES ObjectAttributes
esi ; IN PCLIENT_ID pClientId

; Debugger handle is now in hDebuggerProcess,
; exit driver, clean up and kill the process
;...

nodebugger:
assume esi:nothing
assume edi:nothing

Have fun,
Kayaker
nikolatesla20
01-25-2004, 12:01 AM
ALso, a ring 3 debugger can be detected by calling NtQueryInformationProcess in ntdll.dll from another ring3 app with the constant ProcessDebugPort (0x07h). This function takes a pointer also as an argument, to store its return value. If it returns anything other than a zero, it means that process in question is operating as a debugger.

This trick is used in SoftProtect. Of course you can easily defeat it by hooking NtQueryInformationProcess and returning a zero in [esp+8].

-nt20
AndreaGeddon
01-25-2004, 05:58 AM
i think that thread refers to "process information block" with pib, that is (if i remember good)
struct pib { /* PIB Process Information Block */
ULONG pib_ulpid; /* Process I.D. */
ULONG pib_ulppid; /* Parent process I.D. */
ULONG pib_hmte; /* Program (.EXE) module handle */
PCHAR pib_pchcmd; /* Command line pointer */
PCHAR pib_pchenv; /* Environment pointer */
ULONG pib_flstatus; /* Process' status bits */
ULONG pib_ultype; /* Process' type code */
}
this as TIB (and PDB & TDB) is used on consumer win, its different from nt systems where you have TEB/PEB and TIB has a different meaning (NT_TIB), so the implementation of IsDebuggerPresent is different in the two systems, on nt its like Kayaker explained, on 9x/me it reads the PDB.DebugeeCB field to determine if process is debugged or not :) quite similiar to PEB.BeingDebugged ;)
Bye!
AndreaGeddon
Aquatic
01-25-2004, 04:33 PM
Thanks for the replies.

Too bad there isn't an Olly plugin for the PIB/PEB.


newibe problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > newibe problem
PDA

View Full Version : newibe problem

krkr
01-25-2004, 01:02 AM
sorry i didnt follow the rules the last post anyhow here is a program that annoyed me as a newbie taking my first steps anyhow here is the code

i bpx getwindowtexta i landed here in code line 0043099E
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043090E(C)
|
:00430983 3D11010000 cmp eax, 00000111
:00430988 0F85CE000000 jne 00430A5C
:0043098E 8B4510 mov eax, dword ptr [ebp+10]
:00430991 663D0100 cmp ax, 0001
:00430995 0F8598000000 jne 00430A33
:0043099B 8B4B1C mov ecx, dword ptr [ebx+1C]

* Reference To: USER32.GetWindowTextA, Ord:0177h
|
:0043099E 8B3DDCF34400 mov edi, dword ptr [0044F3DC]
:004309A4 6A21 push 00000021
:004309A6 8D45DC lea eax, dword ptr [ebp-24] (username)
:004309A9 50 push eax
:004309AA 51 push ecx
:004309AB FFD7 call edi (getwindowtext)

* Reference To: KERNEL32.lstrlenA, Ord:03BFh
|
:004309AD 8B3540F24400 mov esi, dword ptr [0044F240]
:004309B3 8D55DC lea edx, dword ptr [ebp-24] (username)
:004309B6 52 push edx
:004309B7 8D45DC lea eax, dword ptr [ebp-24] (username again ??)
:004309BA 50 push eax
:004309BB FFD6 call esi (strlen)
:004309BD 50 push eax
:004309BE 8D4B24 lea ecx, dword ptr [ebx+24]
:004309C1 E83A56FFFF call 00426000 (bogus call)
:004309C6 8B5320 mov edx, dword ptr [ebx+20]
:004309C9 6A21 push 00000021
:004309CB 8D4DDC lea ecx, dword ptr [ebp-24] (serial)
:004309CE 51 push ecx
:004309CF 52 push edx
:004309D0 FFD7 call edi (getwindowtext)
:004309D2 8D45DC lea eax, dword ptr [ebp-24] (serial)
:004309D5 50 push eax
:004309D6 8D7B28 lea edi, dword ptr [ebx+28]
:004309D9 FFD6 call esi (strlen)
:004309DB 8BF0 mov esi, eax
:004309DD 56 push esi
:004309DE 8BCF mov ecx, edi
:004309E0 89751C mov dword ptr [ebp+1C], esi
:004309E3 E8D8D0FFFF call 0042DAC0 (checking rotuine ??)
:004309E8 85C0 test eax, eax
:004309EA 7424 je 00430A10

i thought this call to 004309E3 is the checking rotuine so i nooped the lines after it and i tried reversing the je 00430A10 after it to jne but all this not working

if u guys need any more info to help pls tell me i can get it for u
ur help r appreicated alot

p.s. ama newbie so dont mind if i make mistakes big ones try to help
as +orc said:

"If you give a man a crack he'll be hungry again
tomorrow, but if you teach him how to crack, he'll
never be hungry again"
Kayaker
01-25-2004, 04:02 AM
Hi

Definitely better, rather than just posting a link and questioning how to crack it, you are now questioning the code.

> call 0042DAC0 (checking rotuine ??)

You might be on track here, you'll have to explore this call closer. The return value (test eax, eax) may mean very little, few protections nowadays are this simple that changing a jump after an obvious call will defeat the protection. You'll need to find where the Name is being handled and try to understand what is happening to the characters, which are undoubtedly undergoing some algorithm in order to compare with the serial number. You'll also need to follow any manipulation of the serial number itself in case it is being modified, then you need to find where the comparison is actually being made.

While tracing every bit of possible code is always instructive, the actual checking may be much deeper than even within this one call. Generally what you'd want to do is set 'BPM R' breakpoints on the address locations that your name and s/n are copied into by the GetWindowText calls, and carefully note where they may be being transferred into other memory locations (either whole or in pieces). Then you need to reset your BPM R bp's to these new locations to continue following their path.

Notice that the same buffer (dword ptr [ebp-24]) is being used for both of the GetWindowText calls. Well, after the first one the program must be transferring the name into another buffer for storage and further processing else it would be overwritten. It seems to me like this would be in the call 00426000 that you call bogus (why so?). Notice the offset pattern of PUSHes here, from the looks of the code, the ones I capitalized are the PUSHes for the CALL 00426000, the middle 'push eax' is for lstrlen. Nested or offset push-es like this are not uncommon.

:004309B3 lea edx, dword ptr [ebp-24]
:004309B6 PUSH EDX ; PUSH USERNAME

:004309B7 lea eax, dword ptr [ebp-24]
:004309BA push eax ; push username
:004309BB call esi (lstrlen) ; only takes 1 param

:004309BD PUSH EAX ; PUSH STRING LENGTH
:004309BE lea ecx, dword ptr [ebx+24] ; ?
:004309C1 CALL 00426000 ; username and stringlength are what's pushed for this call

I would guess that within this call is a check of each letter in the Name to see if they are valid ascii characters (a common check), as well as copying the entire buffer to another memory location. This is a guess mind you, but the code seems to imply that. Not sure what the dword ptr [ebx+24] might be. [ebx+1C] and [ebx+20] contain the hwnd's of the two edit controls that are used with GetWindowText, [ebx+24] could be anything I suppose but will be used in the CALL 00426000.

What I'd do first is examine these calls closer and post any code you're unsure of.

Kayaker
krkr
01-25-2004, 04:50 AM
thx alot man will examine this call and tell u what i have found
krkr
01-25-2004, 02:46 PM
well at last i managed it but not a perfect keygen or somethign just a newbie crack well mr Kayaker

i found after tons of memory jumping the serial number
here is the real compare happens

:00435E24 lea eax, dword ptr [ebp-58] (good serial)
:00435E27 50 push eax
:00435E28 81C14D080000 add ecx, 0000084D
:00435E2E 51 push ecx (my bad serial)
* Reference To: SHLWAPI.StrCmpNA, Ord:00DEh
|
:00435E2F FF15D8F24400 Call dword ptr [0044F2D8] (the compare)

i manged to figure 2 solutions one is to push my bad serial twice so it check itself
or after the call of the cmp it returns eax=ffffffff
so u can xor eax,eax (make it =0 i.e. good guy) and continue working ok but the strange thing is that this program uses this rotuine on startup so after applying my patch u dont hav to enter a serial adn click ok and get registerd using any serial no!!
it just starts now registered to nobody and working perfectly
hmm kind statisfacting to me now as a newbie next step is a keygen but i have to follow tons of code iam so tired right now so later maybe
naides
01-25-2004, 02:50 PM
well at last i managed it but not a perfect keygen or somethign just a newbie crack well mr Kayaker

i found after tons of memory jumping the serial number
here is the real compare happens

i manged to figure 2 solutions one is to push my bad serial twice so it check itself
or after the call of the cmp it returns eax=ffffffff
so u can xor eax,eax (make it =0 i.e. good guy) and continue working ok but the strange thing is that this program uses this rotuine on startup so after applying my patch u dont hav to enter a serial adn click ok and get registerd using any serial no!!
it just starts now registered to nobody and working perfectly
hmm kind statisfacting to me now as a newbie next step is a keygen but i have to follow tons of code iam so tired right now so later maybe

Welcome to RCE.
This shit is addictive, You have been warned.
krkr
01-25-2004, 02:58 PM
yeah addictive i can c but good learning man :)


Programming Journal Articles by Rheingold
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Programming Journal Articles by Rheingold
PDA

View Full Version : Programming Journal Articles by Rheingold

Kayaker
01-25-2004, 06:01 AM
I dredged these up from my harddrive for someone and thought I'd post them here as well, a few nice articles from an old dead site, pretty much all that was there as I remember.

Programming Journal Articles by Rheingold:

Introduction to the IAT by coding an Imports Viewer + src

Locating API function offsets in memory + src

Converting virtual offsets to raw offsets and vice versa

Parsing the .rsrc section to locate icons.htm

Source snippets from questions that were asked on IRC
- How can I replace a part of a string with another one using Win32 API in C/C++?
- How can I set a link to my website in my program?
- Getting TASM to work for Inline ASM in BC

Enjoy,
Kayaker
yaa
01-25-2004, 04:34 PM
thx Kayaker.

yaa
Kayaker
03-02-2004, 04:57 PM
What a pleasant surprise... While doing spring cleaning on another hard drive I found a few more items from Rheingold, the first one being the one I was looking for in the first place. Who knows what might turn up next...

All with ASM source

- Coding a small PE wrapper - A small program which encrypts the code of a PE-EXE file and displays a dialog where you can enter a password when you start the program after it has been wrapped + written source

- ImportsAdding Tool + source

- Parsing the .rsrc section to locate icons (+ source this time)
MarcElBichon
03-05-2004, 04:23 PM
mammon_'s contributions to APJ : http://www.eccentrix.com/members/mammon/

APJ Issues : http://cvs.sourceforge.net/viewcvs.py/bastard/apj/issues/

MarcElBichon


FlexLM 7.2a - wierd license format
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM 7.2a - wierd license format
PDA

View Full Version : FlexLM 7.2a - wierd license format

fafel
01-25-2004, 11:52 AM
Hi folkz. I got a node-locked license for my target but locked to some other machine . It looks a bit wierd:
---------------
PACKAGE xxx yyyyyyyy 1.00 0572CE9A500D COMPONENTS=".... ..... ..... \
... ...." OPTIONS=SUITE
FEATURE xxx yyyyyyyy 1.00 07-apr-2004 uncounted CF180AABFD1C \
HOSTID=00b0d02b8b20
------------------------

(xxx=package name, yyyyyyyy=vendor name, ....=features)
In both lines (FEATURE and PACKAGE) there's no SIGN= at the end. Instead a 12-digit number occurs. Is this the signature? Could I use instead this format the one below?

--------------
PACKAGE xxx yyyyyyyy 1.00 0572CE9A500D COMPONENTS=".... ..... ..... \
... ...." OPTIONS=SUITE
FEATURE xxx yyyyyyyy 1.00 07-apr-2004 uncounted \
HOSTID=00b0d02b8b20 SIGN=CF180AABFD1C
-----------------

I searched in the flexLm SDK manual - I failed. Genlic generates only licenses with SIGN=.... at the end, but they don't work. So I can't judge, whether I have bad encryption seeds, or the problem is in the license format. Thnx for any suggestions. :)
tom324
01-25-2004, 12:09 PM
If the original license is without SIGN that means application is using old style license key (LM_STRENGTH_LICENSE_KEY set for LM_STRENGTH) eg. Pre-v7.1. NB:Application usually complains if SIGN is requested but missing from license file.

Without error code returned it is hard to tell what is problem. And "RTFM more carefully" could help in this case ;)

Tom


Alternative way of finding OEP for AsProtect?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Alternative way of finding OEP for AsProtect?
PDA

View Full Version : Alternative way of finding OEP for AsProtect?

Harding
01-25-2004, 06:03 PM
Hello everyone!

First let me say that I have searched both this forum and with google and found nothing that I find useful.

What I usually do: Run the ASPR-prog and count the exceptions. Then reload it and run it lastExceptionsCount-1 times. Then but a break-on-access on the section that is marked code in Olly (I have tried the other sections too.)
Then trace until Olly stops.

Why I can't do it with this program: The packed program throws alot of exceptions itself when it starts (atleast I suspect it does) and I can't really find the end of the ASPR and the beginning of the program.

Other alternatives 1: I have tried to run the program and just stop it. Write down the VA and then reload it, put a HBP on memory write on that VA to get where the ASPR writes to the file. Nothing useful found. It writes alot of times to the code and I don't seems to find where the OEP is written.

Other alternatives 2: I have tried to use the BPX GetVersion trick but I can't get any good code from it.

Other alternatives 3: I even tried some ASPR-unpackers but they all failed (AsprDbgr, Stripper,Caspr)

So my question is this: Does anyone know any other alternative to find the OEP of ASPR?

PS. I'm a newbie and I have only used Olly so far. DS
PS2. I'm not asking anyone to unpack it for me, this is NOT an unpack-request DS2.
disavowed
01-25-2004, 06:17 PM
try peid
nikolatesla20
01-25-2004, 08:26 PM
Just put a BPX after about 25 exceptions. Then put the breakpoint on the memory access. Thru experimentation, asprotect jumps to OEP after 25 or 26 exceptions (at least it used to). You can at least dump after 25 exceptions.

-nt20
hobferret
01-26-2004, 05:40 PM
Just put a BPX after about 25 exceptions. Then put the breakpoint on the memory access. Thru experimentation, asprotect jumps to OEP after 25 or 26 exceptions (at least it used to). You can at least dump after 25 exceptions.

-nt20

Hi nt20 :)

I have been messing around with aspr and found some progs that will not dump correctly - they run @ addresses in range of 138XXXX - you can't find the hex values anywhere in the dump - I'm assumin the base is 400000 and the offset F8XXXX but still can't find anything - anyone any ideas :confused:

/hobferret
evaluator
01-26-2004, 06:24 PM
guys, long time not played with asspr.
who knows, where is newest?
lenwuk
01-26-2004, 11:18 PM
Hi nt20 :)

. . . they run @ addresses in range of 138XXXX . . .

/hobferret

I have a similar situation that doesn't seem to be covered in any of the tuts (or I'm not understanding them).
In my case the main, unpacked program is based at 400000 but these high addresses are ASPR's redirected calls into Kernel32 functions - eg GetVersionA, EnterCriticalSection.
I started "fixing" these by manually altering the JMPS into these routines ( held at 4xxxxx) into the appropriate BFxxxxxx addresses that corresponded to the desired Kernel32 function.
This worked well for a while, but then I came up against a problem that I couldn't resolve - the program starts to reference values in ASPR'd gotton storage at addresses around 8xxxxxx that contained values critical to execution that had been set BEFORE control is passed to the OEP.
I'm speaking as a newbie, and only recounting my own experiences, so please don't shoot me for my ignorance.
Regards, Len
nikolatesla20
01-27-2004, 12:52 AM
It really would be beneficial for you to read ASPR's user manual. It can give you valuable insights as to what it is doing. For example, a software author can choose to give ASPR some callback functions, which are similar to what you describe, functions in which ASPR will call before running your program. Also, functions can be encrypted and then the program can call to ASPR to decrypt them on the fly.

One thing that is good to remember with reversing is to gather as much information about your target (in this case, the protection), BEFORE starting to truly reverse it. For example, are there any documentations for that protector on the app? Or is there an SDK for the app, or for the protection? These can all give you valuable clues as to a good point of attack. You must think laterally, not linearly.

-nt20
Harding
01-28-2004, 01:47 PM
nikolatesla20: Nop, after 25 exceptions I'm still in ASPR and alot och Access violations.

I have tied Peid and I manged to unpack it (it said so) but the file is not unpacked.

But thanks to all who answered, I will keep on working on this one.
Computer_Angel
01-30-2004, 12:28 AM
Here some important points:
1. Run the prog in Olly and ignore all the exception. You found that:
_ The check debugger routine (IsDebuggerPresent)
_ The prog can't run smoothly in olly because of some exceptions.

How to unpack:
1. Use plugin IsDebuggerPresent to hide from the check routine. After several Shift-F9, you'll stop here:
01343EE4 3100 XOR DWORD PTR DS:[EAX],EAX <--- stop here
01343EE6 64:8F05 00000000 POP DWORD PTR FS:[0]
01343EED 58 POP EAX
01343EEE 833D B47E3401 00 CMP DWORD PTR DS:[1347EB4],0
01343EF5 74 14 JE SHORT 01343F0B
01343EF7 6A 0C PUSH 0C
01343EF9 B9 B47E3401 MOV ECX,1347EB4
01343EFE 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
01343F01 BA 04000000 MOV EDX,4
01343F06 E8 0DD1FFFF CALL 01341018
01343F0B FF75 FC PUSH DWORD PTR SS:[EBP-4]
01343F0E FF75 F8 PUSH DWORD PTR SS:[EBP-8]
01343F11 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
01343F14 8338 00 CMP DWORD PTR DS:[EAX],0
01343F17 74 02 JE SHORT 01343F1B
01343F19 FF30 PUSH DWORD PTR DS:[EAX]
01343F1B FF75 F0 PUSH DWORD PTR SS:[EBP-10]
01343F1E FF75 EC PUSH DWORD PTR SS:[EBP-14]
01343F21 C3 RETN

Press Shift-F7 and now use the method of ricardo, set breakpoint on memory access at the code section. Press F9..and boom you will be at the OEP:

006833BA FF15 1C737F00 CALL DWORD PTR DS:[7F731C] <---- stop here
006833C0 33D2 XOR EDX,EDX
006833C2 8AD4 MOV DL,AH
006833C4 8915 18F39300 MOV DWORD PTR DS:[93F318],EDX
006833CA 8BC8 MOV ECX,EAX
006833CC 81E1 FF000000 AND ECX,0FF
006833D2 890D 14F39300 MOV DWORD PTR DS:[93F314],ECX
006833D8 C1E1 08 SHL ECX,8
006833DB 03CA ADD ECX,EDX

So 006833BA will be the Temp OEP. Now you can dump and fix IAT for it.

2. Stolen bytes:
Look above a little, you'll see alot of 0 bytes:
00683393 C3 RETN
00683394 0000 ADD BYTE PTR DS:[EAX],AL
00683396 0000 ADD BYTE PTR DS:[EAX],AL
00683398 0000 ADD BYTE PTR DS:[EAX],AL
0068339A 0000 ADD BYTE PTR DS:[EAX],AL
0068339C 0000 ADD BYTE PTR DS:[EAX],AL
0068339E 0000 ADD BYTE PTR DS:[EAX],AL
006833A0 0000 ADD BYTE PTR DS:[EAX],AL
006833A2 0000 ADD BYTE PTR DS:[EAX],AL
006833A4 0000 ADD BYTE PTR DS:[EAX],AL
006833A6 0000 ADD BYTE PTR DS:[EAX],AL
006833A8 0000 ADD BYTE PTR DS:[EAX],AL
006833AA 0000 ADD BYTE PTR DS:[EAX],AL
006833AC 0000 ADD BYTE PTR DS:[EAX],AL
006833AE 0000 ADD BYTE PTR DS:[EAX],AL
006833B0 0000 ADD BYTE PTR DS:[EAX],AL
006833B2 0000 ADD BYTE PTR DS:[EAX],AL
006833B4 0000 ADD BYTE PTR DS:[EAX],AL
006833B6 0000 ADD BYTE PTR DS:[EAX],AL
006833B8 0000 ADD BYTE PTR DS:[EAX],AL

with a little trick, you 'll find that stolen bytes is:
00683394 > 55 PUSH EBP
00683395 8BEC MOV EBP,ESP
00683397 6A FF PUSH -1
00683399 68 D8858900 PUSH dumped_1.008985D8
0068339E 68 84BD6800 PUSH dumped_1.0068BD84
006833A3 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
006833A9 50 PUSH EAX
006833AA 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
006833B1 83EC 58 SUB ESP,58
006833B4 53 PUSH EBX
006833B5 56 PUSH ESI
006833B6 57 PUSH EDI
006833B7 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP

fixed it, and run, now it done.

you can contact me via Y!M: Computer_Angel_viruses
Shoob
01-30-2004, 04:33 AM
this trick was discussed a long time ago in another thread...
PS. I'm a newbie and I have only used Olly so far. DS
read faq+manu
Harding
01-30-2004, 08:18 AM
Thanks everyone for your answers!

I now know what I did wrong, I pushed Shift + F9 to many times, I thought I was in the ASPR code and missed the OEP. But I have now corrected everything and my baby is up and running! The only ploblem now is that I couldn't find the stolen bytes manually and had to use BiteDreams (excellent) script for Olly.

/Harding
evaluator
01-30-2004, 09:39 AM
this DivxPlayer seems protected with not last asspr;
here i did for you some job:

exceptions count: 1Dh(29)
first instruction in code_seg: 6833BAh
ripped bytes: 26h;
ripped+pseudo-ed OEP bytes dump;

after last exception trace manually until POPAD restores start state;
then soon stats ripped oep;

Now you: restore OEP bytes. (home work)
Harding
01-30-2004, 11:55 AM
Thanks Eval but I have already got it up and running.
But I didn't know about the POPAD trick, I will try that.

/Harding


old dos keydisk
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > old dos keydisk
PDA

View Full Version : old dos keydisk

krkr
01-26-2004, 05:54 AM
am facing a problem in this old dos program am trying to crack as far as i know according to +ORC the way to access disks is through int 13 in dos i used softice VERSION 2.8 for dos and BPINT 13

i got some several disk reads to the HD
then i got (protected interrupt call) error and the program hangs
any idea if there is another way to read the keydisk using int 13?

or any way to bypass this error???

as a hint there is 2 TSRs that load b4 this program
and the keydisk is unreadable
thx alot 4 ur help guys
Fake51
01-26-2004, 07:47 PM
It's been quite a while since I mucked around in dos. All I have to offer are a few methodological considerations:
- Will the app run when s-ice is not running? Or does the same error present itself.
- Does it work with s-ice running, without any bp's set? Or does the presence of s-ice throw everything off.
- Is the error from within int 13 or from somewhere else in the app - or elsewhere?
- have you looked at the tsr's? Are they perhaps detecting soft-ice?
- have you considered using Turbo debugger? Just to see if the same errors occur.

Hope this is of some assistance.

Fake
Aimless
01-26-2004, 11:17 PM
You might try reading RAW sectors using DEBUG.exe or SYMDEB.exe

Have Phun
krkr
01-27-2004, 12:21 AM
hmmm thx fake 4 ur help

1- the app runs ok without s-ice running
2- will try to c if it runs normally with no bp's set on s-ice
3-the error is within the app
4- didnt look in the tsr's
5- the app runs fine with turbo debugger

now i get the same error when starting my pc in dos 6.22 using sice 2.8 or even 2.62 for dos

it did work fine b4 dunno what changed!!!
will check again and tell u thx alot 4 ur help guys
krkr
01-27-2004, 06:35 AM
during my search i found this question and answer
Q: Can I use SoftICE for DOS to debug my protected mode DOS application?

A: SoftICE for DOS cannot be used to debug any protected mode DOS applications. The reason for this is that SoftICE is a protected mode application itself and thus has no visibility to other protected mode apps.

To debug a protected mode DOS application, you can only use SoftICE v3.2+ for NT on a NT OS.

so i will try on sotfice 4.05 for NT
krkr
01-27-2004, 11:08 AM
using softice for NT i traced this strange program to this call
int 61 with ax=0201 bx=0000

it return ax=0001 when i inserted the keydisk whiich is unreadable
and ax=0200 when i inserted a wrong disk

would any1 pls tell me whats int 61 i read it on ralf brown interrupt list but didnt understand!!!

will continue debugging under win 2000 to c
guys btw anway to dump my code window in softice into a file????


RVAToOffset
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > RVAToOffset
PDA

View Full Version : RVAToOffset

_ColdMind
01-26-2004, 06:37 AM
Could somebody tell me how to convert RVA to file offset and viceversa ?
AndreaGeddon
01-26-2004, 07:19 AM
the formula is:

file_offset = (RVA - SectionVirtualOffset) + SectionRawOffset

SectionVirtualOffset is the base address of the section that contains your RVA, SectionRowOffset is the file offset of the section that contains the RVA. You can obtain both Virtual/Row offset from the section table.
In practice you calculate the distance of the rva from the beginning of its virtual section and use this distance in the file raw address of the section itself
Bye! :)
AndreaGeddon
ZaiRoN
01-26-2004, 07:37 AM
Hi _ColdMind,
this question has been asked many times before and, I would like to suggest to use the search function. The function is accessible from any page (look at the top) or, for an advanced search, from this page: http://www.woodmann.net/forum/search.php?

Andrea, what are you doing here? :p

Best regards,
ZaiRoN
_ColdMind
02-04-2004, 01:32 AM
Thanks a lot AndreaGeddon - this is my key up to search and discover more information discussed on this forum and web. Also Je remerci to ZaiRon.
Kayaker
02-04-2004, 02:08 AM
Could somebody tell me how to convert RVA to file offset and viceversa ?

Hi

I'm sure you've found this already, I hope, but in this thread I posted almost exactly 24 hours before yours are some programming articles and a nice explanation of that called

Converting virtual offsets to raw offsets and vice versa

http://66.98.132.48/forum/showthread.php?t=5423

Kind of ironic, even the vice versa is there :p

Cheers,
Kayaker
_ColdMind
02-16-2004, 07:28 AM
Thanks a lot Kayaker.


Proofing a crackme-solve
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Proofing a crackme-solve
PDA

View Full Version : Proofing a crackme-solve

Fake51
01-26-2004, 09:59 AM
Hi

Did a crackme and thought I'd do a solution essay for it. However, haven't done any of those before, so wondered if anyone would be bothered to read the solve-essay and give it thumbs up or down? The crackme is located at crackmes.de:

http://www.crackmes.de/download.php/cronosp3.zip?Crackme=342

Regards
Fake
Fake51
01-29-2004, 06:25 AM
Hmmmm, hope the no replies means nobody had the time to go through it, and not that the essay is pure bs. Thanx for taking the time to view it, anyway.

Fake
evaluator
01-29-2004, 06:59 AM
don't warry, i read your tut.
lots of HQ master englich. no much i understood, but enjoed anyway.
seems you are also from New Zeland?
Fake51
01-29-2004, 04:54 PM
don't warry, i read your tut.
lots of HQ master englich. no much i understood, but enjoed anyway.
seems you are also from New Zeland?

Cheers for taking the time.

New Zealand?!?! What gave you that idea? The other side of the globe is more like it ;)

Blue skies
Fake
evaluator
01-30-2004, 02:07 AM
that Mike(crypto-mod) also uses such clear ingish, so diceded that u are also
from New Zeland:)
Fake51
01-30-2004, 06:12 AM
that Mike(crypto-mod) also uses such clear ingish, so diceded that u are also
from New Zeland:)

Heh, like your way of infering. New Zealand ... pretty place. Wouldn't mind living there.

Fake


Hi!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hi!
PDA

View Full Version : Hi!

Dav
01-26-2004, 02:40 PM
I'd like to know where can i have a copy of software that make INF files, or just a name?
There's someone can help me?
sgdt
01-26-2004, 03:15 PM
file://c:\WinNT\NotePad.exe is a good tool for INF generation, although I personally prefer TextPad from Helios.

The Win32 SDK is contains all the documentation you'll need to use these tools for INF generation for Installs, and the Win32 DDK documentation for writing INF files for drivers.

Although it is usually a hidden directory, examples (which you can load using the INF tool NotePad) are probably already located in your c:\WinNT\INF directory. They can also be found on a supprising number of installation disks.

Due to the success and ease of use of file://c:\WinNT\NotePad.exe and coupled with its low price and wide availability, few commercial vendors have ventured to compete with it for INF generation and maintenance.

In addition to INF files, both NotePad and TextPad have the ability to edit BAT files, INI files, C files, H files, ASM files, and even TXT files.

If you are REALLY careful with your ALT-### sequences, you can even edit EXE files, but this is not for the faint of heart.
Dav
01-26-2004, 05:09 PM
When i downloaded files from sharing programs, usually there are NFO files in,
I open them with 'DAMN NFO Viewer' And some of NFOs are look like drawing.

How can i make files with drawing?...
JMI
01-26-2004, 05:36 PM
If you look at a few of the NFO files, you will come to notice that they are not actually "drawings" in any traditional sense. They are, usually, simply "patterns" created using various letters and symbols generated by your keyboard. They are simply chosen to give whatever look the "artist" wants and then spaced to create the visual effect that they want.

Take a blank page in any text editor, think of a design that you want to create and then start using "letters" and/or "symbols" from your keyboard for the "pen" with which you "draw" your design. That's all there is to it. The rest is the creative process of thinking of a design and the "keys" to use as your "pen."

Regards,
Kayaker
01-26-2004, 05:40 PM
Due to the success and ease of use of file://c:\WinNT\NotePad.exe and coupled with its low price and wide availability, few commercial vendors have ventured to compete with it for INF generation and maintenance.

That's funny ;-)
Dav
01-26-2004, 05:57 PM
I thought that made by software...
I'll try to make some nice picture with my keyboard.
Sorry about my bad english.
evaluator
01-26-2004, 06:41 PM
i can remember program "NFO-maker"..
r4g3
01-26-2004, 07:02 PM
ACiDDraw is the tool. just google for it
Woodmann
01-26-2004, 07:46 PM
Damn,

And I though people spent hours making those files :p

Woodmann
dELTA
01-26-2004, 07:46 PM
One of the biggest "ASCII painters" back in the day was called "The Draw", try searching for it. And for your own sake, try to keep apart INF files from NFO files... :rolleyes:


Im Like The Little Train That Could But Ive Just Run Out Of Tracks.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Im Like The Little Train That Could But Ive Just Run Out Of Tracks.
PDA

View Full Version : Im Like The Little Train That Could But Ive Just Run Out Of Tracks.

seletik
01-26-2004, 08:09 PM
Hello everyone

Well this is my first post and im new at this reverse engineering thing, And well ive been reading different tuts and i can basically follow what im reading. Ive got windows XP and softice driver suite 2.6. Now ive tried to apply my "Craftsmenship" and give it a go. The tuts that im using have referenced newer versions of softice (for example v3.2). Now im using a driver suite for xp so im not sure if that changes anything. I use the exact version program that is specified to be "reversed" and follow the steps religiously. Now MY PROBLEM IS that i dont end up at the addresses that is Should. I end up with the correct code sometimes, but at a different address, and when i try to input another function i dont get the correct result. Basically nothing is coresponding to the tutorials and my opinoin is that it probally isnt the tutorial but maybe the program version has not changed but the "copy
protection" has been modified by the author. Keep in mind that im only trying to break name/password nag screens.

I've givin this a honest effort and could use some guidance cause im not going to let this bog me down. IM LIKE THE LITTLE TRAIN THAT COULD BUT IVE JUST RUN OUT OF TRACKS.
If anyone can possibly throw in some advice for a very new newbie i would so very much appreciate it. If i havent been clear i can explain whatever is
not understood. Even a tutorial link for a somewhat computer ignorant person.

Thanks, Seletik
Woodmann
01-26-2004, 08:46 PM
Howdy,

Try this first :http://66.98.132.48/krobar/beginner/crackme1.zip

Woodmann
Aimless
01-26-2004, 11:05 PM
If you mean that the addresses shown in the tutorials do not match what you see in your machine, that is perfectly normal, as long as the code you see is correct.

As far as not seeing the correct code is concerned, it may also depend on the versions of softice you are using.

Write more about your issues. We are all here to help.

Have Phun
Aimless
01-26-2004, 11:09 PM
Furthermore, here's an analogy to the tutorials and addresses...

1. Imagine you are going to the most hot and happening disco in the city with your girlfriend.
2. You read the rule book for the disco. It says that a jacket is compulsory.

What do you do? You wear a jacket and go.

The point is: You are more interested in wearing a jacket to gain entry into the disco, not the COLOR of the jacket (it can be white, black, navy blue, biege etc.)

Its the same in cracking: The tutorial is the rule book. The jacked is the code. The color is the address codes. Address codes are not important as long as your code is correct.

Of course, if you consistently find code not being the same as one mentioned in the tutorials (as opposed to the address), then write specifically about the problem and everyone here will help you take it further.

Have Phun
seletik
01-27-2004, 01:27 AM
Furthermore, here's an analogy to the tutorials and addresses...

1. Imagine you are going to the most hot and happening disco in the city with your girlfriend.
2. You read the rule book for the disco. It says that a jacket is compulsory.

What do you do? You wear a jacket and go.

The point is: You are more interested in wearing a jacket to gain entry into the disco, not the COLOR of the jacket (it can be white, black, navy blue, biege etc.)

Its the same in cracking: The tutorial is the rule book. The jacked is the code. The color is the address codes. Address codes are not important as long as your code is correct.

Of course, if you consistently find code not being the same as one mentioned in the tutorials (as opposed to the address), then write specifically about the problem and everyone here will help you take it further.

Have Phun

Okay that makes perfect sense as to what i am constantly seeing ... :D Thanks for the help guys
dELTA
01-27-2004, 12:06 PM
The tutorial is the rule book. The jacked is the code. The color is the address codes.
Ok, what did we say about posting here while being high? Don't let it happen again Aimless. :D
JMI
01-27-2004, 12:15 PM
Hey, the difference between "jacked" and "jacket" is just the improper use of the first finger versus the middle finger and I suspect that aimless may be "improperly" using that "middle finger" again to waive at you after he reads your relpy. :D

Regards,
esther
01-27-2004, 12:25 PM
Aimless will showed neither the "first" or "middle" finger.Probably the "fist" using lifting his elbow :p
naides
01-27-2004, 12:38 PM
Furthermore, here's an analogy to the tutorials and addresses...

Its the same in cracking: The tutorial is the rule book. The jacked is the code. The color is the address codes. Address codes are not important as long as your code is correct.

Have Phun

Ok, what did we say about posting here while being high? Don't let it happen again Aimless.

You guys have no Poetic Sensibility. . .
dELTA
01-27-2004, 12:45 PM
Aimless will showed neither the "first" or "middle" finger.Probably the "fist" using lifting his elbow :p
What the hell, is everyone on drugs here or what? :p

Anyway, since you forgot to tell the whole story I'll fill in some blanks:
The stubborn-and-drunk-with-power guard at the door to the disco is the anti-debug trick collection (and when he asks to see your ID it's the CRC check). Using your fake ID to get past him is the reading of the step-by-step tutorial without understanding what the hell you're doing, the annoying woman who tries to sell you a flower to give to your girlfriend is all the crap you have to get past to get Softice to work on your XP system, the pretty-boy in the corner who tries to steal your girlfriend is Alexey Solodovnikov. Taking those drugs with your girlfriend is like messing with the IDT to get past the ring 0 protection (it can turn out quite nice, but it can also go straight to hell without you ever knowing what happened), the drinks in the bar are the "unpackers" for your girlfriend's clothes, and your girlfriend's father who comes to beat you up after he finds out what you tried to do with her is the BSA. :D

I hope the world of cracking is much more clear to you now, son. :p

PS.
How's that for poetic sensibility naides? :D
evaluator
01-27-2004, 03:46 PM
LOL, Aimless!

if lazy-newbie will simply ask:"where to find something..",
then we will strongly point him to search, & that's ok!

but if lazy-newbie will arrange same Q in poetry form,
should we rush into poetic embraces?

seems, you like an art word:)
esther
01-27-2004, 08:23 PM
>What the hell, is everyone on drugs here or what?

JMI,Wotmann and I smoke weed hahahahhahahahha

>your girlfriend's father who comes to beat you up after he finds out what you tried to do with her is the BSA. :D

You mean OEP hahahahhahahha

Hmm its loots leik a james bong movies to em. YOU HAVE VIOLATE THE COPYRIGHT OF IAN FLEEMIGS!!!!!
Woodmann
01-27-2004, 08:37 PM
You all are amazing.......

You make me laugh with your incredible humor.
I bet you could all make a visit to the porcelin throne funny.

(the toilet paper is like the wrapper............. :D

Woodmann
JMI
01-27-2004, 08:57 PM
IF I smoked "weed," I would only do so on doctor's advise to assist with my "medical condition." Which would then be "legal" here in California, at least according to the State law. The Feds are still resisting the medical use of the hemp. :D

So Wood, we are now descending to bathroom humor? When you visit the throne do you "exude" brilliant thoughts??? Do you use various outdates computer manuals to wipe away needless subroutines?? Ah, nevermind. :rolleyes:

Regards,
Woodmann
01-27-2004, 09:18 PM
Howdy,

Whats so wrong with toilet humor ???? :p

The last thing I want to be is grown up :D

OEP=Original Exit Point ??

TA TA, Woodmann
Aimless
01-28-2004, 01:45 AM
But you gotta admit...It *really* cleared up all doubts about address in tutorial and address in softice issues that a fledgling first-timer usually has.

I'm thinking maybe I should write an essay on this kind of thing for the first-timer, with the story as an analogy.

*Critical Chain* anyone?

Have Phun,
evaluator
01-28-2004, 02:17 AM
>with the story as an analogy.

NO MORE ANALORGY! NO MORE ANALORGY!
:)
dELTA
01-28-2004, 01:21 PM
I'd be glad to fill in the blanks of that story too, Aimless. ;)


Safecast is driving me crazy Help needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Safecast is driving me crazy Help needed
PDA

View Full Version : Safecast is driving me crazy Help needed

eclipse2k2
01-27-2004, 10:00 AM
I'm still blocked on Debugger detection under win2k. I've tryed using Iceext and still sucks. I found a detection routine that checks all first byte of kernel apis to detect breakpoints.
Please help needed.
lenwuk
01-27-2004, 10:24 AM
I'm still blocked on Debugger detection under win2k. I've tryed using Iceext and still sucks. I found a detection routine that checks all first byte of kernel apis to detect breakpoints.
Please help needed.

You don't say what debugger you're using, but with Softice you can set a memory-location execution breakpoint which doesn't modify the code.
e.g "bpm GetWindowItemTextA x"
eclipse2k2
01-27-2004, 10:33 AM
Sorry, I'm using Softice, but even without any breakpoint and having IceExt activated Sice is still detected. I have no more ideas to bypass the checks.
Any help is apreciated.

Thank you in advance
Mr. Blue
01-27-2004, 11:35 AM
I never dealt with Safecast, but I have certain experience with Safedisc. Soon after the application starts it calls into one of several Safedisc dlls. Then there is a massive antidebug routine called which tries to detect a debugger using various antidebug tricks. As far as I remember the first trick it uses is IsDebuggerPresent, then it continues with more advanced tricks. This is one way to detect
where the antidebug starts. Put a breakpoint on IsDebuggerPresent, on its return zero EAX and trace back to the caller. Then trace until the next RET, you'll end up in the big antidebug routine. Now I found something interesting - this routine was controlled by a WORD pushed as an argument on the stack. The WORD seem to act like a bitmask which the big anti debug routine uses to determine
which anti debugger checks to execute. I found out that zeroing the WORD being pushed at the routine entry point lets you safely pass the checks. Of course this is just me :)

I hope this helps.
eclipse2k2
01-27-2004, 12:47 PM
I tryed seting a bpm on isdebuggerpresent and it breaks, Then I'm able to detect a battery of sice checks that I bypass, but the code, enters in an ofuscated zone that I cant continue tracing and finally the program exit without any error message.

I'm working on a flexlm licence for a famous 3D program (it's latest version) cause I can't deploy to various PCs If the program is regged with the keygen so the best solution is to generate a flexlm license, but I'm not able even to load the program with softice loaded so imagine how fustrated am i...

Thanks for your fast replys and support.
doug
01-27-2004, 01:32 PM
Sorry, I'm using Softice, but even without any breakpoint and having IceExt activated Sice is still detected. I have no more ideas to bypass the checks.

what else have you tried besides installing iceext?

-----
Read the threads on hiding softice on this board & the ones on safedisc.. If you want to bypass the checks manually each time:

This also applies to the most recent safedisc version:

bpm ExitProcess X;
dd esp

tell us the little hex value sitting there (hint: starts with F).

Then search where this value comes from. (push xxxxxxxx/Jmp ExitProcess)
Then find the beginning of that procedure. (lets call this proc "SilentExit")

And bpm on SilentExit too, everytime it breaks, check esp to see where the check originated from.

iirc, there were 3 of those checks, executed several times each.. on startup.
evlncrn8
01-27-2004, 04:49 PM
try iceext, you might also have to modify your ntice.sys, basically safecast uses the exact same code for anti debug as safedisc.. same company and essentially the same product (just cut down a little)
Pyrae
01-27-2004, 10:50 PM
I remember lots of driver-based timing traps, which used the exported kernel symbol KeTickCount. Those are probably the culprits, if your app doesn't start up after debugging some SafeCast code...

regards,
Pyrae
evlncrn8
01-27-2004, 11:32 PM
int 1 -> int 3 distance check
meltice
ntquerysysteminformation (0bh)
drx checks
checking of kernel32/user32 exports 1st byte = 0cch (int 3) = bad boy
isdebuggerpresent (useless if using ntice)

thats more or less what you're up against, oh and anti bpm, same as safedisc like i said
eclipse2k2
01-28-2004, 08:03 AM
Thank you for your help, I've been able to run the program so the fun is just about to start but I think now it will be easier.
Long time out of the scene without working on hard protections, hopely there are people with great level ready to help others. Many thanks to everybody.
ecl
dELTA
01-28-2004, 01:31 PM
In what way is "ntquerysysteminformation" used for anti-debug purposes?
Kayaker
01-28-2004, 03:40 PM
That would give the ImageName of all .sys files running, ntice, siwvid, iceext...

ZwQuerySystemInformation (or NtQuerySystemInformation) gives you a raft of information depending on the SystemInformationClass you set in the call, there are 53 different classes, defined in ntifs.h. Most handy are probably SystemProcessesAndThreadsInformation (class 5) and SystemModuleInformation (class 11) (which is the one which returns ntice.sys etc.) Both of these are used by the PSAPI functions to get process and device driver info about the system.

Programatically you have to handle the returned info from these 2 classes slightly differently, it's necessary to determine the exact size of the buffer required before you can successfully retrieve it all. Unless the protection decides to take a "guess" on the size of the buffer needed the scenario is probably like this - In the case of SystemModuleInformation, there would likely be 2 calls to NtQuerySystemInformation, the first one is set with a '0' return buffer size and will fault (STATUS_INFO_LENGTH_MISMATCH) but give you the required size, then there will be a dynamic memory buffer created of that size, then a repeat call to NtQuerySystemInformation which will successfully retrieve an array of SYSTEM_MODULE_INFORMATION structures for each module in the system. While most of the modules returned are .sys drivers, they also include ntoskrnl.exe, hal.dll and ntdll.dll.

; SystemModuleInformation - Information Class 11
SYSTEM_MODULE_INFORMATION STRUC ; sizeof = 120h
Reserved DWORD 2 dup(?) ; 00h
Base DWORD ? ; 08h
_Size DWORD ? ; 0Ch
Flags DWORD ? ; 10h
Index WORD ? ; 14h
Unknown WORD ? ; 16h
LoadCount WORD ? ; 18h
ModuleNameOffset WORD ? ; 1Ch
ImageName BYTE 256 dup(?) ; 20h
SYSTEM_MODULE_INFORMATION ENDS

Oh, and there's a SystemKernelDebuggerInformation class too, but it doesn't work for Softice :p

; SystemKernelDebuggerInformation - Information Class 35
SYSTEM_KERNEL_DEBUGGER_INFORMATION STRUC
DebuggerEnabled BYTE ? ; BOOLEAN
DebuggerNotPresent BYTE ? ; BOOLEAN
SYSTEM_KERNEL_DEBUGGER_INFORMATION ENDS

TMI?
Kayaker
JMI
01-28-2004, 03:50 PM
Well, he did ask, didn't he?? And now he has been told. Ahmen. :p
Damn Kayaker, that's good stuff. :D Guess I need to spend more time in my windows NT/2000 Native API Reference. :cool:

Regards,
dELTA
01-28-2004, 04:04 PM
You can always trust good old Kayaker for nice answers on the low-level stuff, thanks as always. :)
Kythen
01-29-2004, 12:16 AM
Just another little note... I don't remember offhand, but I think it might use NtQueryProcessInformation as well to look for a debugger. It definitely uses TIB and PEB checks though. Look for references to fs:[18h] to find those.
JMI
01-29-2004, 02:33 AM
And if you don't know what the heck a TIB or PIB is, check this thread:

http://66.98.132.48/forum/showthread.php?t=5420

Regards,


Problems with the board again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Problems with the board again
PDA

View Full Version : Problems with the board again

LOUZEW
01-27-2004, 10:38 AM
Hin guys
I'm having problems with the board one time more.

Each time i'll try to do anything (like post a PM, go to my control panel etc...), the board is asking for a log/pwd , even if i'm allready logged.
So, i can't PM and so on ....
I've noticed that no cookies are present on my computer.

If someone can help !
esther
01-27-2004, 11:33 AM
You should search beofre you post....

http://www.woodmann.net/forum/showthread.php?t=4481&highlight=cookies
http://www.woodmann.net/forum/showthread.php?t=5139&highlight=cookies

If above doesn't work,check your internet settings.I'm using default settings

Tools,Internet Options.Privacy.Advanced

The last option is to put your proxy settings in the proxy server section

Proxy server,bypass proxy settings are tick
LOUZEW
01-27-2004, 03:07 PM
You should search beofre you post....

http://www.woodmann.net/forum/showthread.php?t=4481&highlight=cookies
http://www.woodmann.net/forum/showthread.php?t=5139&highlight=cookies

If above doesn't work,check your internet settings.I'm using default settings

Tools,Internet Options.Privacy.Advanced

The last option is to put your proxy settings in the proxy server section

Proxy server,bypass proxy settings are tick

It was Privacy setting, many thank's !


LINK- ".. instead read this."
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > LINK- ".. instead read this."
PDA

View Full Version : LINK- ".. instead read this."

evaluator
01-27-2004, 03:20 PM
today i first time decide to click on that last link,
loads google page &..
first result in google is cool P2P-program from warez.com!
whish is announced in download.com.com at 25jan.

curious, ye!?

btw, somebody tried it? really can we dld warez, or mostly viri-troji??
Woodmann
01-27-2004, 08:14 PM
BWAHAHAHAHAHAAHAQHAHAHAHAHA........

I only check that link about once a year just to make sure
it returns about 1 bazillion links to warez top 10 top 25 top 50 top 100 you must click on the first banner then click ok then click........blah blah blah....

Sorry, I got carried away :p

I wonder just what they have to offer :rolleyes:

Woodmann
evaluator
02-04-2004, 07:25 AM
today i decided to check "CNET User Opinions" about this prog:

http://download.com.com/3302-2196_4-10259337.html
Woodmann
02-04-2004, 04:26 PM
Some "select" user opinions :

my ad-aware diciverd 8 new spy wares after the instal.
rm [guess who?]looked for icons and there were (NONE SHOWING) looked inside zonealarm and warez was downloading my computer and warez was still cut off!no mistakes!,
When i installed this, my files started dissapearing. Now ive lost 3 months of work, all because of this pile of ***t. DO NOT DOWNLOAD IT.
tried to uninstal it and when it did uninstal it took some dil files with it

I find it funny that the good opinions are the exact opposite.
"Great software with no bugs or spyware"

I guess I will download it and see what it really does.

Woodmann
Woodmann
02-04-2004, 06:30 PM
Well,

I tried it and had no problems with it.
I didnt see it upload anything. It did automatically find
my mp3 files and offer them up for the taking but there
are settings to shut off what you share.

It aint that bad as far as being malicious.
It is no better then any other "gimme free shit" software.

You can live without it.

Woodmann
dELTA
02-04-2004, 08:07 PM
It aint that bad as far as being malicious.
Maybe that's the problem, it was just so good that you didn't notice it deleting the porn collection and secretly sending out the credit card numbers past the firewall. :D
evaluator
02-05-2004, 01:28 AM
yah, I can point, what is bad there(but same is in most P2P)

This(& others) had integrated IE as browser:(
So those, who never touch IE, probabaly will also not touch these.

& also those most bad "facts" can simply happens with IE.
also as it is new prog, it can fail in security, of course.


Armadillo (i think.. )
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo (i think.. )
PDA

View Full Version : Armadillo (i think.. )

LaBBa
01-28-2004, 11:33 AM
Hi all..
i was looking on an app that looks like its normal VB and even PeId verify this but when i strart debugging it i saw that for lic it uses Arm lisence dll and then i noticed that all the code section is encrypted..
please take a look on this.. its realy wierd...

polarinstruments.com/software_archive/Si8000/Si8QS12_V2_30.EXE

JMI i hope u won't delete this.. :D
JMI
01-28-2004, 12:43 PM
That depends entirely on what is later posted, now that you have identified a specific target. At the moment you've only asked that others look at the target. If no one posts code from that specific target, but only discusses general issues, it should not be a problem. Again remember that you can get into specifics with eachother by PM and/or email. If someone merely confirms your observations that it is ARMA and the sections are encrypted, again that is no problem. Problems arise if someone starts now describing in detail how to remove the protection from this particular target.

You did, of course, READ the material available on their site, didn't you, like the part on Si8Web.html which states: "The Product ID / (Hardware ID) is a unique number generated when you install the [product name]" and viewed the nice pictures of the "product key, activation key, and hardware key" they provided????? Hint: you get there by clicking on the "50% discount off hourly price in January your coupon here" link, followed by another "click here" link on the page the first one sends you to, and then view the "examples".

Regards,
SheepShagger
01-28-2004, 03:30 PM
:D ROFLMAO :D

That's what I call a fine example of cyber-social engineering!

Has anyone tried the activation key?
nikolatesla20
01-28-2004, 04:04 PM
Ok this is bullcrap.

First off, the app is Armadillo, and a new version at that. I can tell becuase the dialog about being unregistered is their new version of dialog. True reverse engineers notice things like that, Chad.

And the *.zip file is pretty stupid, there's no software here, only a test? WTFlip?

HEh, don't tell me they accidentally put the reg key gen up too LOL.

-nt20
nikolatesla20
01-28-2004, 04:40 PM
*Yawn...*

new Armadillo detects patched softICE. No doubt as a result of their using info from this board.

Chad I expect proper payment for my services....for the ntice patch information you apparently aquired from my posts. That is copyrighted material and I will take legal action. :D

*Yawn..."...hm well this slows me down by three seconds....

-nt20
LaBBa
01-28-2004, 05:49 PM
Ok this is bullcrap.

First off, the app is Armadillo, and a new version at that. I can tell becuase the dialog about being unregistered is their new version of dialog

well then .. i was right .. i didn't do much of armadillo and all i needed is some one like u nikolatesla20 to vrify this .. ;)

well .. i hate Armadillo .. i won't tuch this no more.. :D

Regads ,
LaBBa
nikolatesla20
01-28-2004, 06:25 PM
Wait Labba,

I was talking about the little EXE that does "code generation" on the page that JMI referred to. It actually comes up with a Armadillo unregistered message, like they are testing using Arma. Looks like version 3.50.

Anyway, the main exe seems a little big to be packed, It doesn't look packed at all - there is a file , webbem.dll, that appears to be packed with Arma, but it is going to be weak since dll's cant have copymem...doesn't even look like imports are redirected , but I have to look closer. But main app doesn't look packed.

Labba, got an email? I have a present for u...

-nt20
LaBBa
01-29-2004, 03:20 AM
Wait Labba,
Labba, got an email? I have a present for u...
-nt20
i love presents... :D

labbala@hotmail.com

tnx
crassy
01-29-2004, 08:15 PM
nikolatesla20: Could you please explain something about import rebuilding
in an armadilloed dll? I've made an dll and armadilloed it with v3.60 so I'm sure the
OEP is right. Still, ImpRec is unable to locate all the imports.. Whats the trick?
nikolatesla20
01-30-2004, 09:57 AM
I haven't experimented much yet with version 3.60, so if you send me the DLL file I can test to see if my techniques still work before trying to explain them :P

The "trick" to Arma imports is revealed by that very fact, that ImpREC recovers some of the imports but not all of them. Think: Why should ImpREC even be able to recover ANY of the imports? Some get redirected and some don't that's why. Now think: can you make the connection? :)

-nt20
D-Jester
02-01-2004, 09:02 AM
According to SR support forum the "new dialog version" may be altogether different.
Quote:
Added a new anti-dumping defense, Import Table Elimination, another defense that does not require the Debugger Blocker setting.

The Reminder, Expiration, and Warning messages can now all be set to use a plain-text message, an HTML message, or a bitmap. In addition, the Expiration and Warning messages now have a Visit Website/Buy Now button, if you've defined a website in your project for the current certificate.

You can now store multiple Armadillo languages in a single EXE file, by request.

Added the FIRSTRUN environment variable, by request.

The splash screen bitmap is no longer shown when QUIETREGISTER is used, by request.

Added a new API function, ShowReminderMessage, by request.
End Quote

FIRSTRUN variable could put a wrench in BLiND_PRoPHET's tool.

Even though the dialog and reminder messages will change, StudPE and PEiD still report it as version 3.5x -> 3.6x


InstallShield inx files again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > InstallShield inx files again
PDA

View Full Version : InstallShield inx files again

volodya
01-28-2004, 02:18 PM
Hello, everyone.
I'm curious about the format of the inx file.
I've read everything on the forum concerning IS and I'm hardly satisfied. Does anyone know the structure of the inx-file?
Should I dig the InstDev Studio or IDriver/ISRT/IScript7 etc...? Has anyone done it before?
gook
01-28-2004, 04:00 PM
Hello volodya,

There is a decompiler for inx files made by a certain "Nekosuki".
It's output can be useful to patch these inx files.
volodya
01-28-2004, 05:05 PM
I know. Thanks.
As I told I'm interested to go a little bit more deeply!
I need the structure of the inx file itself.
One way is o reverse NEKOSUKI tool or sid by sn00pe. It is a really BAD idea.
The another way is to reverse engineer InstDev Studio or IDriver/ISRT.dll - but they are COM-methods which complicates my life a little bit...
That's why I'm asking...
JMI
01-28-2004, 05:22 PM
Ah, volodya, remember that it is such "complications" that make life interesting. You know you have been putting off learning about COMs, now's your time to jump in there with both feet. Then you can teach the rest of us, who have also been avoiding COMs. what's important, and then WE won't have to learn it from scratch. Seems like a good plan for the rest of us. :D

Regards,
volodya
01-28-2004, 05:28 PM
Seems like a good plan for the rest of us.

It is. :)
But painful for me... :p
JMI
01-28-2004, 05:50 PM
Well the only proper reply would be; "I feel your pain ..... now get to work." :D

Regards,
volodya
02-17-2004, 12:11 PM
Well, I tried my best - useless so far.
The task is - how can one find virtual address for a given COM method. Via VTBL or anyhow. I don't care. What did I try? Well, I read Matt Pietrek's example with CoCreateInstance - tried to apply - useless. Well, then I studied some russian articles and quickly read through available Win-sources :D - useless too, but I'm attaching the sources anyway. May be they will be useful for someone one day...

#include <windows.h>
#include <ole2.h>
#include <iostream>
using namespace::std;

int main( int argc, LPCTSTR * argv )
{
ITypeInfo *ptInfo = 0;
TYPEATTR *lpTypeAttr = 0;
ITypeLib *pITypeLib = 0;

CoInitialize( 0 );

HRESULT hr = LoadTypeLib( L"IScript7.dll", &pITypeLib );
UINT tiCount = pITypeLib->GetTypeInfoCount();

for ( UINT i = 0; i < tiCount; i++ )
{

if ( LOWORD(pITypeLib->GetTypeInfo(i, &ptInfo)) )
{
wcerr << "Bad TypeInfo!" << endl;
}
else
{
if ( LOWORD(ptInfo->GetTypeAttr(&lpTypeAttr)) )
{
wcerr << "Bad TypeAttr!" << endl;
}
else
{
switch (lpTypeAttr->typekind)
{
case TKIND_MODULE:
case TKIND_INTERFACE:
case TKIND_DISPATCH:
FUNCDESC FAR *ptFuncDesc;
for (UINT n = 0 ; n < lpTypeAttr->cFuncs; n++)
{
if ( LOWORD(ptInfo->GetFuncDesc(n, &ptFuncDesc)) )
{
wcerr << "Bad FuncDesc!" << endl;
}
else
{
BSTR bstrName; // name of member
BSTR bstrDoc; // file string
DWORD hContext; // help context

if ( LOWORD(ptInfo->GetDocumentation(ptFuncDesc->memid, &bstrName, &bstrDoc, &hContext, NULL)) )
{
wcerr << "Bad GetDocumentation!" << endl;
}
else
{

wcout << "function name: " << bstrName << endl;

BSTR bstrDllName;
BSTR bstrEntryName;
WORD wOrdinal;

if(!LOWORD(ptInfo->GetDllEntry(ptFuncDesc->memid,
ptFuncDesc->invkind,
&bstrDllName,
&bstrEntryName,
&wOrdinal)))
{
VOID *lpVoid;
ptInfo->AddressOfMember(ptFuncDesc->memid,
ptFuncDesc->invkind,
&lpVoid);

wcout << "function address: " << lpVoid << endl;

SysFreeString(bstrDllName);
SysFreeString(bstrEntryName);
}

SysFreeString(bstrName);
SysFreeString(bstrDoc);
}
}
ptInfo->ReleaseFuncDesc(ptFuncDesc) ;
ptFuncDesc = 0;
}
break;
default:
break;
}
}
ptInfo->ReleaseTypeAttr(lpTypeAttr);
}
ptInfo->Release();
}

CoUninitialize();

return 0;
}
volodya
02-17-2004, 12:58 PM
One more thing embarasses me. If you go to the IScript7.dll file, strip out TLB information from there into IDL file. Preprocess it then with MIDL compiler like
midl /header "IScript_h.h" IScript7.IDL
and then

HRESULT result = CoCreateInstance(CLSID_SetupScriptEngine, NULL, CLSCTX_ALL, IID_ISetupScriptEngine, &isse);
((ISetupScriptEngine*)isse)->Open(L"somefile.inx");

Everything is working!
WTF...
volodya
02-17-2004, 07:16 PM
OK, problem is partially solved...
Now using CoCreateInstance. Sources will be here soon...

The output example:

D:\com_va\Debug>com_va IScript7.dll
****** Object name: SetupScriptEngine
{777C89DF-5C36-11D5-ABAF-00B0D02332EB}
****** Object name: ISetupScriptEngine
name: Open
VA is: 1000c0db
offset from vtbl is: c
name: Close
VA is: 1000c192
offset from vtbl is: 10
name: AttachToDebugger
VA is: 1000c261
offset from vtbl is: 14
name: Controller
VA is: 1000c6be
offset from vtbl is: 18
nikolatesla20
02-17-2004, 08:19 PM
Hey volodya, I did all this work for you already :)

http://www.woodmann.net/forum/showthread.php?t=5046&highlight=matt

Heh, and I agree, there hasn't been much research into COM reversing. This was an area I started to open up for myself, hence the thread above. I've already reversed one COM dll before this too.

-nt20
volodya
02-17-2004, 08:32 PM
No, my dear nikolatesla20. Not that easy, my friend. I also know about this utility and have extensively read Pietrek article, BUT... For general case his utility does NOT work :( Therefore I have to go through the same shit again. To persuade me I'm wrong, would you, please, run his utility against two files - IDriver.exe and IScript7.dll - these are main InstallShield files located in C:\Program Files\Common Files\InstallShield\Driver\7\Intel 32. Thanks in advance. If succesful - please, let me know!
nikolatesla20
02-17-2004, 10:30 PM
what im most afraid of is COM objects with dual interfaces, in other words, a COM object doesn't always need to have a type library in it, it could choose to only support the GetNamesOfIDs() and Invoke() routines *blech*.

-nt20
nikolatesla20
02-17-2004, 10:51 PM
It works fine for me, I get a 1K file with the interface functions just fine. Just drop the outputted DBG file in the same directory as the DLL, and then open up IDA and disasm the file. IDA will load the DBG file and now you'll get symbol information for all the interface functions (only the vtable functions tho, not dispatch interface functions)

check it - this is from IScript7.dll. Doesn't look like anything too complex.

.text:1000C0D9 ISetupScriptEngine__Close proc near ; CODE XREF: sub_1000BFD4+19p
.text:1000C0D9 ; DATA XREF: .rdata:10027CCCo ...
.text:1000C0D9 mov eax, offset loc_10024864
.text:1000C0DE call __EH_prolog
.text:1000C0E3 sub esp, 0Ch
.text:1000C0E6 push ebx
.text:1000C0E7 push esi
.text:1000C0E8 mov esi, [ebp+8]
.text:1000C0EB push edi
.text:1000C0EC xor ebx, ebx
.text:1000C0EE mov [ebp-10h], esp
.text:1000C0F1 cmp [esi+18h], ebx
.text:1000C0F4 lea edi, [esi+18h]
.text:1000C0F7 mov [ebp-4], ebx
.text:1000C0FA jz short loc_1000C133
.text:1000C0FC push ebx ; lParam
.text:1000C0FD push ebx ; wParam
.text:1000C0FE push 12h ; Msg
.text:1000C100 push dword ptr [esi+10h] ; idThread
.text:1000C103 call ds:PostThreadMessageA
.text:1000C109 mov eax, [esi+14h]
.text:1000C10C push 2710h ; dwMilliseconds
.text:1000C111 push eax ; hHandle
.text:1000C112 call ds:WaitForSingleObject
.text:1000C118 push ebx
.text:1000C119 push edi
.text:1000C11A call sub_10006922
.text:1000C11F mov [esi+10h], ebx
.text:1000C122 mov eax, [esi+14h]
.text:1000C125 cmp eax, ebx
.text:1000C127 jz short loc_1000C133
.text:1000C129 push eax ; hObject
.text:1000C12A call ds:CloseHandle
.text:1000C130 mov [esi+14h], ebx
.text:1000C133
.text:1000C133 loc_1000C133: ; CODE XREF: ISetupScriptEngine__Close+21j
.text:1000C133 ; ISetupScriptEngine__Close+4Ej
.text:1000C133

more:

.text:1000C020 leave
.text:1000C021 retn
.text:1000C021 sub_1000BFD4 endp ; sp = 4
.text:1000C021
.text:1000C021 ; ---------------------------------------------------------------------------
.text:1000C022 ISetupScriptEngine__Open db 0B8h ; DATA XREF: .rdata:10027CC8o
.text:1000C022 ; .rdata:10027D44o
.text:1000C023 ; ---------------------------------------------------------------------------
.text:1000C023 pop eax
.text:1000C024 dec eax
.text:1000C025 add dl, [eax]
.text:1000C027 call __EH_prolog
.text:1000C02C sub esp, 3Ch
.text:1000C02F and dword ptr [ebp-14h], 0
.text:1000C033 and dword ptr [ebp-4], 0
.text:1000C037 push ebx
.text:1000C038 push esi
.text:1000C039 push edi
.text:1000C03A lea eax, [ebp-18h]
.text:1000C03D mov [ebp-10h], esp
.text:1000C040 push eax
.text:1000C041 call sub_1000C958
.text:1000C046

You have to have the COM object DLL registered on the system before the tool will work.

These files are not standard anyhow, if you look at the embedded type library, it doesn't start with the "MSFT" header, instead it's some other weird text, and it looks encrypted, like it's compressed or something. I'm going to see how it looks in memory.

Also, IDriver.exe has 90% of it functions as dispatch interface only. So no vtable offsets for those. It crashes when I run the tool on it (most likely cause it's an exe and not a DLL). I'll play with it some more.

If you new code works on EXE's it would be cool if you would be kind and post if for us ;)

-nt20
volodya
02-18-2004, 10:42 AM
nikolatesla20
I'm having some more questions for you.
OK, indeed, I was able to go through your way and obtain DBG file for the DLL, but not for an exe! So, I'm going to continue my business and write my own tool. I'm half of my way on it.
Therefore, I'd like to ask two more questions to you. Sorry :rolleyes:

You have to have the COM object DLL registered on the system before the tool will work

Also, IDriver.exe has 90% of it functions as dispatch interface only. So no vtable offsets for those.

These two phrases... I'd like to get more information! As to the first one, do you mean that there should be CLSID in registry? Therefore, should one MANUALLY go get typelib from dll/exe, check typelib GUID and check it in the registry?

The second one is about dispatch interface. Where can I read more about it? As far as I know now ANY COM object MUST inherit IUnknown. I know nothing about IDispatch so far. Would you enlight me, please?
nikolatesla20
02-18-2004, 01:40 PM
well, the COM registration is only because the tool needs to do a CoCreateInstance to grab its type library (I believe it does, anyway - haven't looked at the code in a while), and to do that, the DLL has to be registered.

The second part is about IDispatch interface. Yes, an object has to support IUnknown, but this is only three methods - AddRef, Release, and QueryInterface. YOu can use QueryInterface to ask the object if it supports another interface. For example say you have a box object. The box object could support the IBox interface. This is only an "interface" in respects that it's represented by a GUID. So you can call IUnknown's QueryInterface (a common GUID that all objects support) and ask it for the the IBox interface using the GUID for the IBox interface. The GUID identifies it as the IBox interface ! If the IBox interface is supported, you'll get back a pointer to a pointer to that interface (blech pointers to pointers).

Ok, so now you have a grab of the IBox interface. Now the problem is calling methods inside it. How do you know the order of the methods in the vtable? For "early binding", in which you use the vtable, that is what the type library helps you with. It gives you the vtable offsets of each member function. When you compile code to talk to this object the compiler uses its type library info to determine the offset within the vtable to call. So on the call to QueryInterface you get "ObjectPointer". Now you dereference this to get the "Vtable Pointer" you then move an offset in the vtable (since the first three entries are the functions AddRef, Release, QueryInterface , remember, all interfaces must support IUnknown), then you call this function. SO if you have vtable entries like so, you can do what is called "early binding", you can make a direct call into the DLL, and it is very fast. This also allows you to track down the location of the code easily too, using a type library tool. You use the type library to get the function offsets. Then you create the object, get a pointer to its vtable, and then mark the address of each vtable entry as its function name, using the offsets. This is what Matt's tool does.

A problem arises when you find an object that supports a "dual interface", in other words, it also supports the IDispatch interface. IDispatch is NOT a vtable of each function on the object. It's a set of functions you can use to call object member functions by asking for them.

For example, say IBox supported Open and Close methods. Now also say the box supports the IDispatch interface as well. If I wanted to use IDispatch, instead of IBox, I would do a IUnknown QueryInterface with the GUID for IDispatch (a common GUID). Once I got that, I could then use IDispatch to call methods like so:

QueryInterface checks whether the object supports IDispatch. (As with any call to QueryInterface,
the returned pointer must be released when it is no longer needed.)

// Call QueryInterface to see if object supports IDispatch.
hresult = punk->QueryInterface(IID_IDispatch, &pdisp);
GetIDsOfNames retrieves the DISPID for the indicated method or property, in this case, szMember.

// Retrieve the dispatch identifier for the SayHello method.
// Use defaults where possible.
hresult = pdisp->GetIDsOfNames(
IID_NULL,
&szMember,
1,
LOCALE_USER_DEFAULT,
&dispid);
In the following call to Invoke, the DISPID indicates the property or method
to invoke. The SayHello method does not take any parameters, so the fifth
argument (&dispparamsNoArgs), contains a Null and 0, as initialized at
declaration.

To invoke a property or method that requires parameters, supply the
parameters in the DISPPARAMS structure.

// Invoke the method. Use defaults where possible.
hresult = pdisp->Invoke(
dispid,
IID_NULL,
LOCALE_SYSTEM_DEFAULT,
DISPATCH_METHOD,
&dispparamsNoArgs,
NULL,
NULL,
NULL);

As you can see, you get the ID of the method using the method's name. YOu then call the method USING INVOKE(). Not only that, but you don't even call invoke with the name, you use a function ID. In other words, you never call the method directly. This is called "Late binding". Scripting languages use this since it allows them to not have to know anything about the object ahead of time. They can get the list of methods from the type library and use the IDispatch interface to call them by name (also passing in the approriate args). Know what a VARIANT is? A VARIANT was created for this type of thing.

So the problem is, the "magic" of calling the actual routine in code is done by Invoke(). I suppose you might be able to make some tool that could find the IDispatch -> Invoke() function, and then see which routines invoke calls based on function ID's, and map this to the function ID's found from GetIDsOfNames(). Maybe that would work. But that's the reason you just can't load up an object with this tool and gets function offsets if the object only has dispatch entries.

-nt20
volodya
02-18-2004, 04:28 PM
Thanks. Thanks again.
reverser
02-18-2004, 07:39 PM
Here's some stuff I wrote several years ago. I didn't get very far :)
Hope it will be of some help.
reverser
02-18-2004, 07:48 PM
Some more stuff. I've run tlviewer.exe on IS7 and 8 engine files. Among other things, it shows vtable offsets for methods.
volodya
02-18-2004, 07:49 PM
reverser

first of all - my biggest thanks to you, sir. Sources open... Good!
secondly - I'd prefer not to have the tool, honestly, I don't need it. What I'd prefer to have is a METHODOLOGY of how to obtain the structure of the given inx file and how to decompile the higher versions inx files.
That's why I'm digging COM IS files now. That's why I'm playing with InstDev now.

BTW, nikolastela, the utility has been finished. It is better then Pietrek's one :) For each CoClass we are enumerating through the list of methods and fulfilling them with VAs. The sources are open:

//copyright flankerx and volodya 2004

#include <windows.h>
#include <ole2.h>
#include <iostream>
using namespace::std;

char* lpFuncType[] = {
"FUNC_VIRTUAL",
"FUNC_PUREVIRTUAL",
"FUNC_NONVIRTUAL",
"FUNC_STATIC",
"FUNC_DISPATCH"
};

char* lpTypeKind[] = {
"enum",
"struct",
"module",
"interface",
"dispinterface",
"coclass",
"typedef",
"union"
};

int wmain(int argc, wchar_t *argv[ ], wchar_t *envp[ ])
{
ITypeLib *pITypeLib = 0;
ITypeLib *pTL = 0;
ITypeInfo *ptInfo = 0;
ITypeInfo *pInfo = 0;
TYPEATTR *lpTypeAttr = 0;
TYPEATTR *lpIntAttr = 0;
VARDESC *lpVarDesc = 0;
BSTR bstrGUID = 0;
BSTR bstrName = 0;
GUID clsid;
GUID iid;

CoInitialize( 0 );

if( argc != 2)
{
wcerr << "Usage: com_va filename" << endl;
return -1;
}

if ((LoadTypeLib(argv[1], &pITypeLib )) != S_OK)
{
wcerr << "LoadTypeLib failed for file: " << argv[1] << endl;
return -1;
}

unsigned tiCount = pITypeLib->GetTypeInfoCount();

/* procedure outline:
foreach typeinfo
if typekind == TKIND_COCLASS
foreach member interface
print_interface_info(clsid, iid)
end foreach
end if
end foreach
*/

for ( unsigned i = 0; i < tiCount; i++ )
{
if (!LOWORD(pITypeLib->GetTypeInfo(i, &ptInfo)))
{
if(!LOWORD(ptInfo->GetTypeAttr(&lpTypeAttr)))
{
if(lpTypeAttr->typekind != TKIND_COCLASS)
continue;

clsid = lpTypeAttr->guid;
StringFromCLSID(clsid, &bstrGUID);
pITypeLib->GetDocumentation(i, &bstrName, 0, 0, 0);

wcout << "coclass " << bstrName << " GUID: " << bstrGUID << endl;

SysFreeString(bstrName);
SysFreeString(bstrGUID);

unsigned mCount = lpTypeAttr->cImplTypes;
//foreach member interface
for(unsigned j = 0; j < mCount; j++)
{
HREFTYPE ref = 0;
ptInfo->GetRefTypeOfImplType(j, &ref);
if(!LOWORD(ptInfo->GetRefTypeInfo(ref, &pInfo)))
{
// get index in typelib
UINT index = 0;
pInfo->GetContainingTypeLib(&pTL, &index);
pTL->GetDocumentation(index, &bstrName, 0, 0, 0);
pInfo->GetTypeAttr(&lpIntAttr);
iid = lpIntAttr->guid;
StringFromCLSID(iid, &bstrGUID);

wcout << "\t" << lpTypeKind[lpIntAttr->typekind] << " " << bstrName << "GUID: " << bstrGUID << endl;

SysFreeString(bstrName);
SysFreeString(bstrGUID);

unsigned fCount = lpIntAttr->cFuncs;
for(unsigned k = 0; k < fCount; k++)
{
FUNCDESC* fdesc = 0;
pInfo->GetFuncDesc(k, &fdesc);

pInfo->GetDocumentation(fdesc->memid, &bstrName, 0, 0, 0);

LPVOID iUnk = 0;
if (!LOWORD(CoCreateInstance(clsid, 0, CLSCTX_ALL, iid, &iUnk)))
{
BYTE* pVTable = (BYTE*)*(DWORD*)(iUnk);
DWORD pFunction = *(DWORD*)(pVTable + fdesc->oVft);

wcout.unsetf( ios_base::dec );
wcout.setf( ios_base::hex );
wcout << "\t\t" << lpFuncType[fdesc->funckind] << " " << bstrName << " VA: " << pFunction << " Offset: " << fdesc->oVft << endl;
}

SysFreeString(bstrName);
pInfo->ReleaseFuncDesc(fdesc);
}
pInfo->ReleaseTypeAttr(lpIntAttr);
pInfo->Release();
}//if(!LOWORD(ptInfo->GetRefTypeInfo(ref, &pInfo)))
}//for(UINT j = 0; j < mCount; j++)
ptInfo->ReleaseTypeAttr(lpTypeAttr);
}//if(!LOWORD(ptInfo->GetTypeAttr(&lpTypeAttr)))
ptInfo->Release();
}//if (!LOWORD(pITypeLib->GetTypeInfo(i, &ptInfo)))
}//for ( UINT i = 0; i < tiCount; i++ )

CoUninitialize();
return 0;
}
reverser
02-18-2004, 09:07 PM
reverser

first of all - my biggest thanks to you, sir. Sources open... Good!
secondly - I'd prefer not to have the tool, honestly, I don't need it. What I'd prefer to have is a METHODOLOGY of how to obtain the structure of the given inx file and how to decompile the higher versions inx files.

I would gladly help you if I remembered how :) It was quite long ago. And you can learn from the sources about some structures... You can also try to reach sn00pee and/or nekosuki, I'm sure they know much more about inx :)
Solomon
02-18-2004, 11:45 PM
This tool may help a little.
hxxp://www.ddevel.com
volodya
02-19-2004, 10:08 AM
Solomon

Wow! I'm impressed! I'll give it a try.
Meanwhile the new pre-release :D version of my COM/VA tools.
Made by me and flankerx. Big thanks to nikolastela and kolam.


PC ROM debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PC ROM debugger
PDA

View Full Version : PC ROM debugger

nino
01-28-2004, 05:36 PM
Does anybody know of a debugger for ROM code?
dELTA
01-28-2004, 06:18 PM
I guess that would depend on which kind of ROM you are talking about, but if you are e.g. talking about the PC BIOS it should as far as I know use normal x86 code, which should be handled well by e.g. IDA (you can save it as a com file first if it is only linear x86 code not contained in any executable file, which is most likely the case).
nino
01-28-2004, 07:17 PM
Yes indeed PC BIOS uses mostly real-time 16-bit x86 code. The problem is that it can't be debugged as a COM file since ROM code would initialize the device (in this case disk) and standard debuggers won't go further. The intended debugger should just require the screen and keyboard (and maybe mouse) so that the ROM code could be debugged as in real-time. Also it must hook the boot code in such a way that it would take control when the ROM code is called at boot time.
Maybe I'm asking too much but I would feel happy if it could just work. Since this is an UDMA controller BIOS that will manipulate the mass storage devices on my computer it won't work. Probably with 2 controller's it would but I first want to exhaust the possibility that there would exist a debugger specially targeted for ROM code.
disavowed
01-28-2004, 08:52 PM
i looked for one of these a year or two ago and came up empty-handed. there are hardware-based bios debuggers, though
Aimless
01-29-2004, 12:20 AM
Three ways to do it:

I. The Assembly Way
================
1. Get a ROM dumper utility
2. Dump the ROM
3. Use IDA Advanced
4. Disassemble
5. Make changes as required using a hex editor
6. Reload the dumps
7. (If you cannot think of any ROM dumper utility, the same is available in your HDD. Its called debug.com)

II. The Hardware Debugger Way
========================
1. Get a h/w debugger
2. Plug it into the board
3. Hit it to insert breaks at ROM instruction sequence streams
4. Quite messy, I belive.

III. The Software Emulator Way
========================
Your best bet:
1. Get Bocsh (NOT Bosch, unless you like drills)
2. Take a look at the SOURCE code of the BIOS code
3. See if you can learn something there
4. Better yet, get SIMICS (there is a Flexlm key also floating around, its gotta be the server method rather than plain key method)
5. Start the virtual machine
6. Close down the virtual machine
7. Grab all instructions till date (called tracing)
8. Debug to heart's content if required as it also supports debug options besides tracing instructions (Note: Not for the faint of heart. And oh yes, you gotta learn python before that. And that's more than just a passing knowledge of it)

Have Phun
nino
01-29-2004, 08:45 AM
Well, the picture seems clear now.
Looks like the best way to go is the hardware debugger but since I have none within my reach, it must be discarded.
The assembly way is not applicable here since I don't have the board's datasheet and can't figure out the required changes from a static listing. Besides (for other people that may read this), don't dump your ROM code from within Windows (i.e. from a cmd prompt). Some drivers (as this one) shadow the ROM code, modify it in RAM and map the resulting code into the original ROM's page.
So let's try the emulator way. It's going to be a looong and painful attempt to gather the tools, find a crack, learn python and in the end it may not work :{
Thanks for your tips guys!


About forum Archive
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > About forum Archive
PDA

View Full Version : About forum Archive

doug
01-28-2004, 07:20 PM
Hi,
I just tested the .chm forum archive,
One small remark, the [.quote.] blocks are being displayed as normal text (as if they were written by the poster), it can be a bit confusing..

Other than that though, looks great.
Kayaker
01-28-2004, 08:32 PM
I see what you mean doug. Unfortunately the same thing occurs in the "real" Archives feature, which is from what I created the .chm file. That archives feature is actually a php script which displays the forum threads in a slightly different format, and I guess the 'quote' notation is lost.

I'll look into that, maybe the script can be modified, or maybe I can generate the .chm file from the original threads instead. If I can figure out a way to autogenerate a .chm index file from the original search index built into the database, I may try to incorporate a search feature as well. (It's my first .chm file ;)

Thanks for the feedback
JimmyClif
01-28-2004, 10:48 PM
Nice work, Kayaker... this must be the best thing since ..erm.. maybe.. the invention of a 'soft ice cream' machine?

http://www.kinglake.com.cn/image/show-oceanpower.JPG

for the ones who don't know what a soft-ice-cream machine is :)
dELTA
01-29-2004, 01:08 PM
Unfortunately the same thing occurs in the "real" Archives feature, which is from what I created the .chm file.
It would probably be a good idea to whine about it to vBulletin themselves, and they might just fix it. Does anyone in possession of the vBulletin support forum credentials feel up to it? :)
Kayaker
01-29-2004, 06:27 PM
I searched that forum last night and surprisingly there was no mention of the no-quote problem at all in any regard to the Archives feature. Nor of any sort of ice cream maker... :p
dELTA
01-29-2004, 06:29 PM
I guess it's time someone told them about both then... :p


Execryptor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Execryptor
PDA

View Full Version : Execryptor

Scarabee
01-29-2004, 04:49 AM
Hello..

Lately i ran into a program which seemed to be packed with EXECRYPTOR 1.5.3 (PEID 0.91 scanned)

Is anyone familiar with unpacking this protector? I have searched the net and this forum but have found nothing on this subject.

Any help about this would be very nice!

thanx.
britedream
01-29-2004, 05:26 AM
Can you pm me with the program name , please.
Scarabee
01-30-2004, 12:26 PM
Not much response so it seems. Is it just that unknown or quite a hard protector?
dELTA
01-30-2004, 12:44 PM
If you would have checked this protection's own website (hxxp://www.strongbit.com/execryptor.asp) you would have seen that it is not a packer at all, but is used to encrypt selected code snippets in programs, which can then be protected with any other packer etc. Downloading the trial and using it on your own test files will probably be very instructive, especially since it does not apparently pack the entire file, which makes comparative analysis of the protected areas much easier.

Also, you would most likely get much more help if you would show any own effort to analyze this protection, and be more specific about exactly where you're stuck.
Zilot
01-30-2004, 01:19 PM
Hi Scarabee

I took a look after your replay. Downloaded trial (packer) and almost reversed it. I found OEP, and found trick in which way he encrypts/decrypts code. My problem is that I couldnt make good dump of program because he has some advanced way to detect SI (I bypassed it in his code). I made semi working application, some options will not work.

I suppose with some time of reversing I could make all function working. Will see tomorrow.

For example in that trial OEP was 4b58e4. IAT is not crypted/redirected. He will never work if you have Super BPM on. So you have to find out way to bypass place where he checks for DRXs.

Zilot
Scarabee
01-30-2004, 02:21 PM
Thanx for the help and info.
I did actually look at the Execryptor site and did realize that it only crypt snippets of code. i just used the word protector wrongly i guess. maybe i should have formulated it differently.

anyways.. i stumbled into that strange SI detection and was not able to circumvent. with icedump loaded it runs fine but when using it with loader it still will crash. so there i already am stuck.

thanx for all the efford!!!
evaluator
02-01-2004, 04:37 PM
replace in your dump last section with it, set OEP 000FD000 & try..
seven
02-22-2004, 04:28 PM
what iz that thing -------> execryptor 1.5.1 :confused:

cant be dumped
b4 dump the proggy size waz : 1.32 MB
after dump i got 12kb :confused:

cant be debugged
used ollydbg
took 2 hours to bypass exceptionz
check
hxxp://members.lycos.co.uk/sssevennn/cryptvideo.rar
so
what iz that thing -------> execryptor 1.5.1 :confused:


Unpacking SVKP 1.3X
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking SVKP 1.3X
PDA

View Full Version : Unpacking SVKP 1.3X

mmhckb
01-29-2004, 03:20 PM
I'm attempting to unpack a program packed with SVKP 1.3X. I'll walk you through as far as I've gotten. If anyone can make it further, plz lemme know :) . If you wanna know the target, say here, and i'll give in pm.

Load up in Olly.
From OEP of the packed exe, trace until you reach the first LOOPD.
Several lines below, there should be:

00619051 75 3C JNZ SHORT .0061908F
00619053 803E 00 CMP BYTE PTR DS:[ESI],0
00619056 74 03 JE SHORT .0061905B
00619058 46 INC ESI
00619059 ^EB F8 JMP SHORT .00619053
0061905B 46 INC ESI
0061905C ^E2 E3 LOOPD SHORT .00619041

As you can see, it is testing for the common cracking tools, so NOP out the JNZ.

Go to Options -> Debugging Options -> Events Tab and check
break on new module

Allow the program to run. Continue hitting F9 until another Entry Point Alert
box pops up. Hit OK. Then hit the Memory Map button ( M ). Find the target
and on the section below the PE HEADER of your target, put a breakpoint on
memory access. F9 again and you should break at or near the OEP. Locate your
OEP, write its address down and restart the app in Olly. Bypass the debug
check again and make it to the Entry Point Alert popup window. Hit ok, and
go to View -> Executable Modules . Double click on your targets exe name
and go to the address for your OEP and set a break point (F2). Hit F9 and you
should break on your OEP. Write down what the first opcode is at your OEP.

Load up LordPE and dump. You will have to use the IntelliDump instead of
the standard LordPE dumper. When I did this, a box popped up and said that
4000h of the 22d000h bytes could not be dumped and would be padded with zeros.
Anyways, I dont think this is a problem... but maybe :/

Start up imprec, enter the OEP, iat autosearch, get imports, show invalid,
trace level 1, show invalid, cut thunks, fix dump.

The intellidump left an int3 at my OEP, so, replace that with the opcode you
wrote down. Now, the program should appears fully unpacked, but it still
crashes, this is where I'm stuck. If anyone has any ideas, please get back
to me.

thanks,
mMhCkB
Shoob
01-29-2004, 03:25 PM
[Unnecesary personal comment deleted by JMI] :rolleyes: read some ricardo tuts like everyone must who can't go on with it.
JMI
01-29-2004, 04:32 PM
mmhckb:

There are several things you need to do. First, go to the Links at the bottom of the page and click on the one which states: "Read the FAQ." That will tell you what you are supposed to do before you jump in with a post here.

Second, you are NOT supposed to post target specifically identified code here. You may not have "named" the target, but you, evertheless "identified" the target by leaving it's "name" in the code you posted. I have removed the name of the target from that part of your post. If you want to identify the target, do so in PM and/or email with people who may ask, as you offered, but also make sure you don't leave it showing in your code snippet.

Third, had you read the FAQ, you would know that one of the things you are supposed to do before you post is to do a search for your topic and determine whether your topic may have been discussed before. There is a search button at the top of all the Forums. Although you may have actually done this, there is no way to determine that you have.

Had you put "SVKP" in it you would have found a number of threads discussing that topic, including one titled "how to unpack the shell of svkp 1.3x." That thread would have also referred you to a thread on the exetools forum which also discussed in some detail approaches to this protection system.

The point of this is that it should not be necessary for someone to reinvent the wheel for you because you didn't take the time to do some initial work on your own about your question. If you take that time, you can then ask a more pointed question and include the type of information described in the FAQ about your OS and tools used, although these last were identified.

You were obviously following some tutorial, or at least it appears so. If you successfully unpacked the protected exe and it still crashes, there is a good chance there is an error in your rebuilt IAT. One helpful bit of information for those familiar with this protection would be more information about the "crash." Details about that might help identify the problem. Did you, by any chance, attempt to trace the program in your debugger to the point where it crashed? Or did you just click on it, it crashed, and you gave up the investigation?

For example, one of the exetools threads, hxxp://www.exetools.com/forum/showthread.php?s=&threadid=3088
reported a crash after fixing and dumping and reported that person actually traced the program and found a call to:

Managed to Track where the Dump is Crashing, its because of this:

code:--------------------------------------------------------------------------------
004402C4 A1 682B6200 MOV EAX,DWORD PTR DS:[622B68]
004402C9 . 0BC0 OR EAX,EAX
004402CB . 74 02 JE SHORT dumped1_.004402CF
004402CD . FFE0 JMP EAX
004402CF > 68 AC024400 PUSH dumped1_.004402AC
004402D4 . B8 60114000 MOV EAX,<JMP.&msvbvm60.DllFunctionCall>
004402D9 . FFD0 CALL EAX
004402DB . FFE0 JMP EAX
--------------------------------------------------------------------------------

the function and dll its trying to call ?

non other than ---->

SVKP_Killdebugger
SPECIAL.DLL
--------------------------------------------
You might want to see if this is the issue with your program. Again, simply suggesting that you try to help yourself before you ask others to help you.

Regards,
MEPHiST0
02-11-2004, 10:48 PM
i think his attempt is very good...
so... :P

keep up the good work mmhckb! ;-)
D-Jester
02-12-2004, 12:54 AM
[Unnecesary personal comment deleted by JMI]

JMI,
Exactly what constitues an Unnecesary Personal Comment? I have a habit of making sarcastic remarks, and would like to know for my personal reference.

:-)

Peace,
JMI
02-12-2004, 02:51 AM
Sorry, in this case I don't specifically recall, but it was a comment of a personal nature, directed at the individual, rather than the situation and that is not appropriate, nor generally tolerated here. We generally attempt to tell folks what they should have done, rather than just "carve them a new one", if you catch my drift. :rolleyes:

It generally isn't necessary to point out to someone that they have "no excuse for living and should stop sucking up the good air" to make a, hopefully, useful point that will educate them on how we want them to do what is expected of them here. :D

Regards,


Asprotect Debugger ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect Debugger ...
PDA

View Full Version : Asprotect Debugger ...

Manko
01-29-2004, 07:22 PM
Hi, guys!

I'm really sorry to come draging with this old piece of shit again...
But due to demand, and since that site won't host it anymore...

I won't post source since it's become such a tangled web...
Maybe if I rewrote it again...
Anyway, if you're after my "secrets" I'd be glad to share anyway...

This is "latest" asprdbgr... We will call it asprdbgr_build_100,
though it's not... ehrm...

It hasn't been tested too good, so I might regret posting it. :)

101:
Fixed major bug to do with diphandling, that would crash targets...
Added commandline handling.

102:
Fixed bug in commandlinehandling...
Now you can load .dll with asprdbgr. (It will load it through the LoadDLL.exe)
(Droppping dlls work too, ofcourse.)

103:
Fixed bug in stolenmutatedbytes-handling... (Thanks, SideSwipe!)
Fixed several bugs trying to get a mysterious target working, didn't work but fixed a couple of other targets. :)

104:
Some more targets will work now. (That it LordWays?)

105:
Sigh! Major fuckup! My lack of time and therefore testing is responsible.
App would erase almost all IAT sometimes. It won't now, hopefully!

106:
Had to improve IAT handling since it still erased valid entries sometimes.
Now it seems to be a thing of the past. It'd better be! :mad:

/Manko
Js
01-29-2004, 09:16 PM
Hiya,
A lazy man's tool, I like it a lot :).
cheers
Manko
01-30-2004, 07:19 PM
Hi!

It seems I had broken some of the functionality doodling with the source, after my site downed... all fixed now!
(A whole line of aspr targets would crash...)

I have also added commandline parsing so I and anyone else can drop files on it, or put it in "SendTo" or similar. :)

Next build I hope to have added the ability to load .dll's directly in asprdbgr.
It's not hard, only I'm pressed for time, or lazy, at times...

Look at first post for download!

/Manko
hitman_crk
01-30-2004, 08:28 PM
Thank you bro
Tool very good
Manko
01-31-2004, 08:18 PM
Ooops! Fucked up with the commandlinehandling...
fixed. Also, if you should want you can now load dlls...

I'm working on finding a few bugs that stops asprdbgr from doing it's job on some few (I hope) targets, even old ones...

l8er...

/Manko
sinker
01-31-2004, 08:26 PM
Nice work~ :p Manko

/sinker
lordways
01-31-2004, 10:36 PM
it is nice tool
xiangxue
02-02-2004, 08:47 AM
thanks
Manko
02-03-2004, 07:18 PM
Hi!

103:
Fixed bug in stolenmutatedbytes-handling... (Thanks, SideSwipe!)
Fixed several bugs trying to get a mysterious target working, didn't work but fixed a couple of other targets. :) (Thanks Harding?! Hmm... deleted mail, so I'm not sure who to thank!)

Please feel free to bug me about bugs! ;)

/Manko
ZZZ
02-03-2004, 07:19 PM
Very good tool!

But i have a last problem with stolen bytes.

Please write, how find stolen bytes with AsprDbg.

Thanks!!!!
esther
02-04-2004, 11:02 AM
I have already flush it in the toilet with wrappers :rolleyes:
evaluator
02-04-2004, 11:33 AM
how about Tools Forum?
esther
02-04-2004, 11:36 AM
how about using the search button on the top of the forum
SpeKKeL
02-04-2004, 02:29 PM
how about using the search button on the top of the forum

Archh..., my browser kills yellow Search-buttons... :p

Spekk.
lordways
02-05-2004, 05:41 AM
I think asprdbgr1b is better than asprdbgr1.03.
dELTA
02-05-2004, 09:18 AM
Thanks for that extremely useful piece of information lordways, you wouldn't by any chance want to elaborate a little? :rolleyes:
esther
02-05-2004, 11:15 AM
>>Archh..., my browser kills yellow Search-buttons...

how about changing you spectacles LOL
Manko
02-05-2004, 03:49 PM
Hi, LordWays!

U might be right about that, to atleast some extent. After some of the 1b versions, the source was fucked pretty badly by some idiot (It was me...) and I've now been working to get it on track again.
Some targets that works with 1b won't work on 103, but then again 103 actually can do some that no version 1b could do properly...

(I do have a nagging suspicion that I still have some broken functionality to take care of that I havn't yet thought of...)

I have been strugling with a couple of hard cases recently and can't seem to get them to work the way I'd like it so I decided to do it the easy way... It might slow the app a little on those targets, but might still be exactly be what you're looking for...

If it isn't I'd like to know what you think I have screwed up and example of which target(s) will demonstrate this... also, I don't have the version you're using anymore, so that might be something I'd like to have too...

104: More targets work now... See above... (Within the hour...)

/Manko

I think asprdbgr1b is better than asprdbgr1.03.
JMI
02-05-2004, 03:58 PM
Manko:

Many wish we had the time and the skill to mess up even half as badly as you may have possibly inadvertantly done with some versions of this tool. :D Remember that those who aren't satisfied with your efforts should better spend their time and effort in writing their own damn tools, then complaining about something into which they put no effort other than pressing a couple of buttons. ;)

Regards,
Manko
02-05-2004, 04:11 PM
Hi, ZZZ!

Very good tool!

But i have a last problem with stolen bytes.

Please write, how find stolen bytes with AsprDbg.

Thanks!!!!

Ya, there's one very ugly method and then there's other methods...

The Uglyyyy:
Copy a large chunk of memory, starting well before and weeell after the address stated in asprdbgr. (Experiment...)
Copy it as new section into dumped and IAT-fixed exe, remembering to correct PE, particularly we want this new section to occupy the same memory are as it did in original, also you need to make the section above very large in virtual... hrm...
Use address stated in asprdbgr as new entrypoint.
If you have fixed all other things that don't have anything with stolen bytes to do, it will hopefully work.
This could be automated... :)

Other methods:

use softice alongside asprdbgr to look at or sometimes follow mutated code to find stolen bytes.
It can be done live or after it's been done already... Doesn't matter much...
Labba has tut for this and the whole manual way...
Also some just try and figure out afterwards looking at registers and stack, what code might make them this way, and stick it in there...

Remember, you don't really need to place the code at the original entry point, as long as you jump to the right place after executing whatever code you like... (There's always plenty of places to put code in a exe...)

/Manko
sonkite
02-06-2004, 04:56 PM
How come sometargets unpack fine and others crash what other tricks does aspr use other than stolenbyte? Would be nice with some info on this.
Manko
02-06-2004, 05:24 PM
Hi, Sonkite!

How come sometargets unpack fine and others crash what other tricks does aspr use other than stolenbyte? Would be nice with some info on this.

There are numerous possibilities, but they can be sorted in few categories:

1. Traps made in dips.
2. Tests inside main app to see if aspr is still there.
3. Faulty unpacking...

Back in the days, when I learnt aspr it was quite common for authors to use dips to set up flags, asprcalls or initialize variables, so the unwary dumper would be fooled...

Also it was and is possible to now and then see functions in the protected app the try and write to one of the emulated API's. This will work with aspr, but will crash the unpacked app, since you aren't allowed to write in kernel-space.

Faulty unpacking? Many possibilities... Mainly badly resolved IAT, bad OEP or as you said stolen bytes not resolved right...

There's probably more to be said and explained about this... .. .

/Manko
Manko
02-06-2004, 05:38 PM
Hi, JMI!

Thanks! You have given me new resolve to continue with messing up these new versions as well. :p
Pitty I've now taken to actually giving different builds different names... :)

(PS Thanks! DS)

/Manko
regor
02-10-2004, 04:13 PM
Hi Manko,

I appreciate your work and i would like to thank you for this update. Are you still providing the source of your tool ?

RegoR.
Manko
02-10-2004, 06:00 PM
Hi!

Thanks!

I might be persuaded to give out my increasingly tangled and poorly commented source... Get back to me more privately! :)

/Manko

Hi Manko,

I appreciate your work and i would like to thank you for this update. Are you still providing the source of your tool ?

RegoR.
Manko
02-13-2004, 07:22 PM
Hi, all!

Thanks! You have given me new resolve to continue with messing up these new versions as well. :p
/Manko

Ehr... I did it...

105:
Sigh! Major fuckup! My lack of time and therefore testing is responsible.
App would erase almost all IAT sometimes. It won't now, hopefully!

Actually it was pretty strange... I had problems with syminitialize...
It would not initialize correctly if I chosed debugee with getopenfilename...
If i got name from commandline it WOULD work... Really crazy!

I had to solve it by again running syminitialize in same thread as the rest of the app. Sadly that means that if syminitialize hangs my whole app will hang...

aparently symbol_handling is sensitive to wich thread it is run in according to more than one source on the web... but why then did it work when i got name from commandline? It was still run in different thread!? :(

GetOpenFileName does something... hmm...

Never mind...

New build is above, sorry to those who were affected...

/Manko
evaluator
02-14-2004, 06:26 AM
GetOpenFileNameA on XP, first-time mostly does RaiseException inside
LiKuS
02-15-2004, 10:34 AM
Build 105

sprDbgr v1.0beta (:P) Made by me... Manko.

iEP=401000 (Name of Target Removed- Identify Target Specific Code Only by PM.)

IAT Start: 4DB000
End: 4DB76C
Length: 76C
IATentry 4DB1F8 = 19D1CD8 resolved as GetCommandLineA
IATentry 4DB294 = 19D1CB8 resolved as GetCurrentProcess
IATentry 4DB2D0 = 19D1C64 resolved as GetModuleHandleA
IATentry 4DB324 = 19D1C8C resolved as GetVersion
IATentry 4DB364 = 19D1CC8 resolved as LockResource
IATentry 4DB390 = 19D17A4 resolved as GetProcAddress
12 invalid entries erased.
Dip-Table at adress: 19D7AB4
0 4091E0 0 409210 4091F0 0 0 409220 409230 409C80 0 0 0 0
Last SEH passed. (19D39EE) Searching for signatures. Singlestepping to OEP!
Call + OEP-jump-setup at: 19E7088 ( Code: E8000000 5D81ED )
Mutated, stolen bytes at: 19E70D4 ( Code: 64EB0169 EB01E856 )
Erase of stolen bytes at: 19E7037 ( Code: 9CFCBF76 709E01B9 )
Repz ... found. Skipping erase of stolen bytes. ;)
possible (temp)OEP: 4A0469 (Reached from preOEP: 19E7048)
possible (temp)OEP: 49E140 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E141 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E146 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E14A (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E14C (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E152 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E157 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E159 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E15E (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E160 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E162 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E164 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E166 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E168 (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E16A (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E16D (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E16E (Reached from preOEP: 4A4697)
possible (temp)OEP: 49E73A (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E73B (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E73D (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E73F (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E744 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E749 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E74F (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E750 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E757 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E75A (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E75B (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E75C (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E75D (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E760 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E764 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E767 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E76A (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E76D (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E76F (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E771 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E773 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E778 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E77B (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E77E (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E781 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E785 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E788 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E78B (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E791 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E796 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E799 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E7DC (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E7DF (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E822 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E825 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E827 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E828 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E82A (Reached from preOEP: 4A2C76)
possible (temp)OEP: 49E830 (Reached from preOEP: 4A2C76)
possible (temp)OEP: 4A2C7B (Reached from preOEP: 49E876)
......
dELTA
02-15-2004, 05:42 PM
And the point of that post is what exactly? :confused:
JMI
02-15-2004, 06:04 PM
I believe it is a non-expressive complaint that he never actually reached the "final" OEP. But then Eval tells me I suck at interpreting the "obscure" posts of others. :rolleyes:

Regards,
Manko
02-17-2004, 05:55 PM
Hi!

Thanks to sonkite, I finally fixed the dbgr so it wont fuck up the IAT.
Damn stupid symbolhandling shit... hrm... :)

106:
Had to improve IAT handling since it still erased valid entries sometimes.
Now it seems to be a thing of the past. It'd better be! :mad:

/Manko


FADE Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > FADE Protection
PDA

View Full Version : FADE Protection

Kayaker
01-30-2004, 01:25 AM
Hi all,

Some may have heard of this protection before, apparently it's been around for a few years though there seem to be a few more recent press releases, I was just wondering if anyone has looked into the mechanics of it closer. There has been a small mention of it at club.cdfreaks.com and the Codemasters site for example, but little discussion on the details.

Here is a relatively recent article from
http://www.newscientist.com/news/news.jsp?id=ns99994248

--------------------------------
'Subversive' code could kill off software piracy

Software pirates who make illegal copies of a particular computer game are finding the games companies are coming up with a radical new anti-copying strategy.

Illegally copied games protected by the system work properly at first, but start to fall apart after the player has had just enough time to get hooked. As a result, the pirated discs actually encourage people to buy the genuine software, the developers say.

The new protection system, called Fade, is being introduced by Macrovision, a company in
Santa Clara, California, that specialises in digital rights management, and the British games developer Codemasters, based in Leamington Spa. It makes unauthorised copies of games slowly degrade, so that cars no long steer, guns cannot be aimed and footballs fly away into space. But by that time the player has become addicted to the game.

Fade exploits the systems for error correction that computers use to cope with CD-ROMs or DVDs that have become scratched. Software protected by Fade contains fragments of "subversive" code designed to seem like scratches. The bogus scratches are arranged on the disc in a subtle pattern that the game's master program looks for. If it finds them, the game plays as usual.

When someone tries to copy the disc on a PC, however, the error-correcting routines built into the computer attempt to fix the bogus scratches. When the copied disc is played, the master program then cannot find the pattern it is looking for, so it knows the disc is a copy.

Promotion tool

What happens next turns the usual rules of software protection on their head. Instead of switching off the game and preventing it from playing at all, the master program begins to disable it. In the game Operation Flashpoint, which has been the proving ground for Fade, players soon find that their guns shoot off target and run out of bullets.

"The beauty of this is that the degrading copy becomes a sales promotion tool. People go out and buy an original version," claims Bruce Everiss of Codemasters.

The idea intrigues Alistair Kelman, an independent lawyer who specialises in copyright: "Fade is entirely in keeping with the spirit and great traditions of copyright." He points out that books tend to deteriorate with use and this prevents the secondhand market from competing with the market for new books. Why not the same for software?

Following its success with Operation Flashpoint, Codemasters is also using Fade with a new snooker game. Copies play normally for a while, but after a predetermined number of potshots, gravity is progressively turned off so the balls start behaving oddly and end up floating over the table.

Fade was devised by Richard Darling, who founded Codemasters 16 years ago, and has now been included in Macrovision's SafeDisc anti-piracy system. Next year, Macrovision plans to release a DVD movie protection system called SafeDVD, which will use a similar technique to make copied discs stop playing at a key point in the movie's plot.
--------------------------

I had heard about this idea of "fake" CD scratches before, but to be able to create code which fools the systems natural error correction routines which compensate for scratched CDs sounds very intriguing. It also reflects a high degree of understanding of just what these correction mechanisms are and how they work. From the description this sounds like the mechanism is built into the OS as opposed to being part of the CD burners software?

Does anyone have any idea of how this is implemented or what the code that emulates a "scratch" might look like? CD protections aren't really my forte, my interest is more from the hardware/OS code/programming side of how the protection might work.

I like the "confuse-a-cracker" aspect of the protection too, instead of the "you have Softice installed therefore you are bad and I will not run at all" strategy :)

Kayaker
evlncrn8
01-30-2004, 02:26 AM
fade was used by codemasters on operation flashpoint, it turned out that the 'fade' protection wasnt quite what it was made out to be, infact it was more or less a glorified cdkey check, however i believe that on playstations etc fade does exist, however for the pc, (esp. in the cases of op. flashpoint)it was one big spoof.. it would seem the protectionists are trying to marry their protections with the games at source code level, making it (in theory) harder to crack
naides
01-30-2004, 07:47 AM
Hi Kayaker:

This commentary is made out of my absolute ignorance in this theme.
If what they claim is true, and that is a big IF, the spirit of the protection is the same as Safe-Disc, which has been defeated with raw-mode CD burners, which copy everything, mistakes included, into the New CD.
To defeat it at a software level, I presume a point of attack would involve isolating the routines that access the disk data in low level mode to detect the disk mistakes, then deactivating those routines.

This protection is probably intended for the copy and share kid, rather than a more academic cracker. It is only a cleverly modified form of a nag screen.
dELTA
01-30-2004, 12:49 PM
This same "degradation type protection" was mentioned in a "new revolutionary CD protection" a couple of years ago I remember. I think its name was Fo... something, and judging by history it did not succeed very well. :) But like naides say, sure, it might be good for kids, but for pros there's always just the question of pinpointing, analyzing and tracing the correct functions, and it's toast.
doug
01-30-2004, 04:23 PM
Securom's "trigger functions" is another example of fade protection (without the (c) name)...

http://www.securom.com/solution_disc.asp#trigger
http://www.securom.com/news.asp?id=13

It did confuse people for a few months, when it was introduced. Right now though, it's completely reversed & generically cracked.

Basically it's just a fancy name for saying: checks that run after the application has started (so that a cracker has to do more than simply removing the protection shell & fixing apis) ...


vbox 4.6.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vbox 4.6.2
PDA

View Full Version : vbox 4.6.2

arieri
01-30-2004, 09:46 AM
hi,

I have been working on a new target that are protected with vbox 4.6.2
I have done this a couple of times earlier with success

I have done as follows

Put a break on getstartupinfoa and push the try button
F12 and back in the original program: Scroll some lines up and find the push ebp etc..
Have dunped the program and fixed the iat with imprec. There where 91 unresolved
Two of them where the getmessage and peekmessagea that I had to locate with softice, the
rest where fixed with imprec.
When I start my dumped exe it runs without the vbox screen and everything looks perfect
I wanted to test so I turned my clock forward so the program did expire, then I started
my dumped exe and where very suprised to see the vbox appear on my screen expired. hehe
Well I`m lost from here so if anyone could help it would be nice

regards,
arieri
nikolatesla20
01-30-2004, 09:52 AM
Check the OEP of the file again. ImpREC is stupid with OEP - when you use it to paste the new IAT into the file, it will sneak in its OEP value, so make sure that you entered the correct OEP into ImpREC as well! Anyway, have you checked the OEP of the unpacked file yet to make sure it is still the one you found? If it's not the you are still running the vbox code first :P

Also, are u sure you opened the right file the second time :P I know it's a lame question but it never hurts to check. hehe.

One more thing, VBOX might have an API so you should look into the possibility that the program imports some VBOX DLL and calls into it. Check that possibility out.

-nt20
sars-serum
01-30-2004, 10:58 AM
Hello folks,

Since you now employed with VBOX.

I think Adobe Encore DVD be protected with VBOX 4.6.

I have one question:

Why cannot remove VBOX protection with the Vbox Cleaner 1.0?

About VBox Cleaner:
This tool is able to detect and remove Vbox files and Registry entries which are NOT removed during or after the uninstall procedure of a Vbox protected software product.

Thanks for help
evaluator
01-30-2004, 11:03 AM
your both 2 questons in your first post are against rules!
nikolatesla20
01-30-2004, 11:03 AM
Oh oh....I sense JMI standing nearby...

sars_senum: Please do not post specific targets in this forum. Not only have you posted a specific target, but then you posted along with it a tool to automatically remove protection on that target. This doesn't teach anyone anything. The whole point of this board is to learn on your own, not to distribute cracks. Please remove at least the references to specific software (and the link), to obey the forum rules. If you are unfamiliar with forum rules, you can find them in the FAQ link at the bottom of the forum.

As JMI has stated before, if you wish to share such specific information, you can readily send an email or a PM to the user with which you want to share it.

-nt20 *wonders how well he did for JMI :)*
arieri
01-30-2004, 12:13 PM
Thanks for the advice nikolatesla20

I have checked everything you said
Strange when the program are within the 30 days trial my dumped exe start
without the vbox nagscreen. Maybe this is an upgraded version of vbox
I could not find the oep when breaking on the getversion api. as I usually have done earlier with vbox 4.6.2

regards
arieri
JMI
01-30-2004, 12:50 PM
nt20: Thanks for the assist, but I point out a few fine distinctions with sars-serum post. First, he did "identify" a target, but he did not post any code from his identified target.

Second he posted a "tool" and asked why it cannot remove the protection from the target. I'm am not sure we actually have a "don't post any tools" rule that applies to non-commercial "Tools of the Trade." Generally, however, such tools are not posted here.

Third, his tool is actually a very old verson of the "cleaner" from early 2001 and is not actually a self contained working version. It has to be complied to run, as it contains the C source (at least I think that is what it is) for the program and not an exe file. Fourth, he already reported that the program would not make his target work, so, again, nothing to this point would assist anyone in making a working version of the target.

All that aside, you are absolutely correct that we do not want people to come here asking how to remove the protection from specific targets.

sars-serum this is not how we want things to be approached here. You are only trying to use an automatic tool to do your reverse engineering and, when it failed, you want someone to fix it for you. That's not what we do here. This is the place where you come if you want to learn how to do the reversing yourself. You are supposed to study on your own and make your own attempt at reversing your target and ask for assistance with your approach to solving the problem, not a solution to a specific target. Time for you to rethink what you are doing and if you do not actually want to learn how to do these things yourself, you will find plenty of other places on the net where they answer the type of question you have asked.

Regards,
nikolatesla20
01-30-2004, 12:51 PM
Does the application import any MSVCRT imports? If so, if could be written in MFC. In that case, you should bpx on an API called __set_app_type. If you bpx on getversion or on getmodulefilename or anything else you might end up still in vbox code. My theory for now is that you might not have the correct OEP...or the program is calling a DLL that does some stuff with VBOX, like show dialogs, etc...

to JMI: I can never say it as well as you can. I hope it didn't offend u sans_serum, If I misconstrued your intentions sorry man.

-nt20
MaRKuS-DJM
01-30-2004, 12:59 PM
maybe this trick helps... in imprec, delete all calls to VBOX-dlls. then open your target in debugger and find the call where vbox-expection happens
arieri
01-30-2004, 05:27 PM
yes the target import MSVCRT. I did break on getstartupinfoa and it gives the
same oep as msvcrt __set-app-type. It must be some call back to vboxtb.dll/vboxat.dll

regards
arieri
cRk
01-30-2004, 09:02 PM
this tells me you're dealing with Expired program that has a nag like Vbox used to have.. your unpacking job is done so you need to study program code and defeat time limit

Regards.
arieri
02-01-2004, 10:13 AM
When I run my "unnpacked exe" before the trial has expired it starts without the vbox screen,
but when I run my"unnpacked exe" after the trial period is over the program starts just
like the original program loading all the vbox stuff first and never reach/load the
original program codes. It never reach to the real oep. When I push the exit button
I got a messagea box saying "could not start cooltype.dll"

regards
arieri
esther
02-01-2004, 10:24 AM
Some guy uploaded a dlltester in armadicko thread .Well its regarding on a commercial protection .Did you notice that? Does it violate the forum rules?
JMI
02-01-2004, 01:45 PM
Yes, I saw that and wonder why you are posting your comment in THIS thread. As far as I can tell it is directed at a protection system and does not, itself, provide a "solution" to that system, but is just an analysis tool. But I haven't had time to try to test it myself, so am not sure exactly what it might really do.

Regards,
esther
02-01-2004, 10:02 PM
>>we actually have a "don't post any tools" rule that applies to non-commercial "Tools of the Trade." Generally, however, such tools are not posted here.

If I'm not wrong there is a rule here that tools should not post here(any forums).They should send it to protools ;)

Regards
JMI
02-01-2004, 10:55 PM
There are many places where tools could ultimately be posted, but I do not recall an express: "Do Not Post Tools Here" directive from the management. The express rule is "Do Not Ask for the Tools of the Trade."

Regards,
esther
02-01-2004, 10:59 PM
Well thats was discussed in the admin forum when I was a mod here.Btw I'm not sure if this rules stills stands.

Regards


Is it OK to link to this forum?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Is it OK to link to this forum?
PDA

View Full Version : Is it OK to link to this forum?

Harding
01-30-2004, 05:37 PM
I have read though the FAQ and I didn't find anything about it.
I'm writing a RE page (in swedish) and wonder if it's ok to place a link to this forum?

/Harding
Kayaker
01-30-2004, 06:04 PM
Hi

We've already got several search bots roaming over this site at any one time, I don't think the big boss would mind another link at an RE site. Post your link here if you wish, as long as it's RE and not warez/crack related.
JMI
01-30-2004, 07:21 PM
And you can always discuss it with dELTA here, as you share a common language, but I should warn you he has a thing about penguins and polar bears. Something about the view from his new apartment window. :p
Oh and if you want to get off to a very good start, ask him about his houmongous "monitor" :D and drop a hint that "JAG" is one of your favorite TV series. :cool:

Regards,
dELTA
01-30-2004, 07:56 PM
Harding, what's the address of your site? Jag kan ju alltid kolla om den är värdig att länka till oss eller inte... :)

And aah, actually, I'm just getting ready to watch a freshly taped hour of Catherine Bell... err, I mean JAG. :D

(and no, don't ask more specifically what this "getting ready" involves, you dirty bastards :D)
Harding
01-30-2004, 08:20 PM
Right now the site is nothing but I'm working on it, I will publish it here when there is atleast something to show. I take it as an "ok" to link to the forum.

/Harding

PS. Delta: Har du fått jänkarna att tro att du har pingviner och isbjörnar utanför ditt fönster? Påminner mig om när jag va i U.S.A. en sommar och de frågade om jag åkte bussen dit... DS.
dELTA
01-30-2004, 08:33 PM
Typ enklare att bara nicka och le än att försöka motbevisa alla förutfattade meningar angående polardjur och dylikt. :D (btw, skriv inget mer på svenska här, folk kan bli irriterade, och då blir jag tvungen att kicka dem, eh, eller nått... :p)
JMI
01-30-2004, 08:37 PM
What he said. :D And dELTA, we already know what "getting ready" means. :cool:

Regards,
Harding
01-30-2004, 09:20 PM
It's kinda funny that my question was a simple yes or no question and still I have got a large discussion about some of the Admins habbits.
Woodmann
01-30-2004, 10:29 PM
So whats next ?

You 2 start hanging out and talking Swede smack just to
piss of those who dont know the language ? :eek:

Facia baccalaro, Machellaio de codice :p

TA TA, Woodmann
Harding
01-31-2004, 06:47 AM
Sorry Woodmann, we won't do it again (ateleast not me).

Take care!

/Harding
hobgoblin
01-31-2004, 08:53 AM
Ser man det. Vi har et par svensker her.... :)
Harding, ser frem til websiden din. Det kan ofte være okey med en RC side på et kjent språk.
To the rest of you guys: this is just a remark to Harding and Delta

regards,
hobgoblin
esther
01-31-2004, 09:29 AM
>>(btw, skriv inget

I know this word btw which is english hahahhahahhahah
Manko
01-31-2004, 09:43 AM
Hehe!

Ser man det. Vi har et par svensker her.... :)
regards,
hobgoblin

Det visste du väl redan hobgoblin?! :)

Sorry for that!

I'd like a link too, harding!

/Manko
Harding
01-31-2004, 06:13 PM
For all who can Swedish:
hxxp://hres.harding.mine.nu

I would like comments and suggestions.

/Harding
Woodmann
01-31-2004, 07:09 PM
Harding,

It is fine to talk Swedish smack :)

Since I have no uh moral qualities? I would like to see
more profanity.

Woodmann
JMI
01-31-2004, 07:42 PM
But Woodmann DOES have 'redeeming social value" to make up for his self-professed "lack of couth". :D And thank the diety, that he also has the wherewithall and the patience to host all this fun we're having. :cool:

Regards,
dELTA
02-01-2004, 07:34 AM
It's probably a good thing Woodmann can't talk Swedish smack, otherwise he would see that you had described this forum with "Main topic: Unpacking" on your page, and he probably wouldn't like that. :D (you might want to change that, because the main topic is general reverse engineering)

Sorry Woodmann, we won't do it again (ateleast not me)
Your mother called me and said that you had broken your promise and spoken Swedish with her, you bad boy. ;)
Harding
02-02-2004, 06:09 AM
woops! My mistake! I have fixed the topic of RCE Board. But to honest guys, when I think of RCE Forum I think unpacking programs. Maybe it's just me... maybe not.

To Delta: I haven't talked to my mother in atleast a week so she can't have told you that. That leaves me with something I don't want to belive: you lied to me! ;)
And Delta, I only promised to not WRITE in Swedish. (Which I have when I wrote the page...)

/Harding


Very Newbie Question - How to translate addresses from IDA to SoftICE?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Very Newbie Question - How to translate addresses from IDA to SoftICE?
PDA

View Full Version : Very Newbie Question - How to translate addresses from IDA to SoftICE?

Cumulous
01-30-2004, 06:46 PM
I have a very Newbie question...

When you dissassemble a program in IDA Pro, and you find a code line of interest... How do you translate that address so that when the App is running, and you're in SoftICE - you can find and/or break on that line?

Thanks to all who would have the patience to answer! :)
doug
01-30-2004, 08:35 PM
the address should be the same, _unless_ it gets relocated.

in that case:

1. Find the (default) ImageBase of the file. (check that in IDA or lordpe)
2. Find the new imageBase (in softice: "what module_name" for example)
3. new_address = Your_address - Default_Image_Base + New_Image_Base

new_address : address "in softice"
your_address : address "in ida"

you can find the module_name using sice command "proc" and cycle through the list (generally it's just the filename without the extension)

Also check
http://www.woodmann.net/forum/showthread.php?t=3864&highlight=relocation

and all other search results on "reloc".
sgdt
01-31-2004, 01:50 AM
I have a very Newbie question...

When you dissassemble a program in IDA Pro, and you find a code line of interest... How do you translate that address so that when the App is running, and you're in SoftICE - you can find and/or break on that line?

Thanks to all who would have the patience to answer! :)

If the issue is constant relocation, and you have MSVC, you can rebase the image with the rebase program. Not that I recomend this, as it alters the image, but it sure beats always having to do math...

However, I think the issue is a little more SoftIce Centric...

You can, on small applications, use ida2sice3i.rar to load everything into SoftIce directly from IDA. A hint when using this is to "hide" stuff you don't and won't need with the '-' on the num key pad. It speeds things up and shrinks the size of the of the symbol table (too big and it can crash even if you configure SoftIce for obscenely large symbol room).

Alternatively, you can generate a map from IDA, and use one of the "MAP to SoftIce" utilities. You don't get the IDA disasm, variables, and comments, but at least the function names are there.

Then, you'll be able to break by symbol name, instead of always having to remember the module name and address's and context.
Cumulous
01-31-2004, 12:56 PM
1. Find the (default) ImageBase of the file. (check that in IDA or lordpe)
2. Find the new imageBase (in softice: "what module_name" for example)
3. new_address = Your_address - Default_Image_Base + New_Image_Base

Thank you, Doug - I'm sure that will help immensely. However, one followup question - if you don't mind...

While I had no problems determining the ImageBase in SoftICE, I am new to IDA, and I am uncertain where to determine the default ImageBase there. I am using IDA Pro 4.5. There was no information in the program's Help system - and looking elsewhere usually yielded "Use a PE Editor to look at the PE Header".

Where can I find this information in IDA Pro 4.5?
Cumulous
01-31-2004, 12:58 PM
You can, on small applications, use ida2sice3i.rar to load everything into SoftIce directly from IDA. A hint when using this is to "hide" stuff you don't and won't need with the '-' on the num key pad. It speeds things up and shrinks the size of the of the symbol table (too big and it can crash even if you configure SoftIce for obscenely large symbol room).

Alternatively, you can generate a map from IDA, and use one of the "MAP to SoftIce" utilities. You don't get the IDA disasm, variables, and comments, but at least the function names are there.

Do the utilities you reference work on IDA Pro 4.5 and SoftICE Driver Suite 3.0? Many of the "extras" I've run across were designed for older versions - which is why I'm asking. :)
dELTA
01-31-2004, 01:04 PM
Mostek's IDA2Softice plugin at least, which is referenced above, works for all versions of IDA (and Softice).


GetWindowTexta and GetDLGItemTextA don't work!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > GetWindowTexta and GetDLGItemTextA don't work!
PDA

View Full Version : GetWindowTexta and GetDLGItemTextA don't work!

Cumulous
01-30-2004, 07:04 PM
Using SoftICE on an XP machine - I have yet to see a bpx on GetWindowTexta and GetDlgItemTexta work!

I'm trying various crackme's - and even when the solution indicates that one of them should do it, it doesn't!

I can't even use Hmemcpy - since XP doesn't support it, so I'm finding a whole lot of tutorials that I can't do anything with. :)

Can anyone tell me why I'm having this problem and how to solve it?

Thanks! :)
JMI
01-30-2004, 07:10 PM
Here's one consideration. With the new SI versions, the breakpoints are context sensitive, meaning they only work in the context in which they are set.

Do what you probably should have done first, which is to use the search button at the top of the forums and try with "softice and breakpoints" and you should find alot of discussion of these issues. Particular attention should be paid to the discussion in the one titled "DriverStudio 3.0 BreakPoints. "

I don't recall reading any suggestion that those specific API's don't work on XP, so it is more likely that you are not getting them set in the correct context to break.

Regards,
dELTA
01-30-2004, 07:47 PM
Many applications (e.g. Delphi applications and other) don't use these APIs at all though, but when the crackme solution mentions it, it is of course most likely something else wrong too.
Cumulous
01-31-2004, 11:27 AM
Do what you probably should have done first, which is to use the search button at the top of the forums and try with "softice and breakpoints" and you should find alot of discussion of these issues.
Regards,

JMI, thank you for your suggestion - but you should not assume. As it happens, I *did* do a search - several, in fact. But I never did that particular search, as it seemed too generic.

So, while I appreciate the help, I don't appreciate the condescension. :)
JMI
01-31-2004, 01:13 PM
Cumulous:

Perhaps you failed to notice the phrase included the word "probably" with "should have done first" because you did not indicate that you had searched for the answer and I could not determine whether or not you had already done so. Perhaps you also failed to notice that encouraging people to search before they ask questions is what I do and "condescension" has nothing to do with it.

Had I wished to be "condescending," I could merely have told you that the answer is available by searching this forum. Instead, I gave you the answer to your question, not only by helping with search terms, but with a specific thread which I believed would answer your question. The "object lesson" regarding searching was intended for a wider audience.

I simply do not have the time or energy to engage in ego evaluative analysis of posters or to attempt qualitative ratings of their skill set verses my own skills or lack thereof. I do tend to encourage everyone to try to help themselves before asking for help. And I have found that, more often than not, the more "generic" the search terms, the greater the probability of success.

Regards,
dee
01-31-2004, 03:03 PM
Hi,

Well i see this discussion - like many others - is more about how to search or read FAQ, but not how to slove the problem ;)

I had the same problems with 3.0 in the past too. The problem is that you must specify the program you are debugging, only then breakpoints will work. This was not aceptable to me - so i'm using 2.7 and it works ok - just like i want.

Regards
JMI
01-31-2004, 03:18 PM
dee:

If you have read the thread I identified for cumulous you will discover that saying "The problem is that you must specify the program you are debugging, only then breakpoints will work" is the same thing as saying "the breakpoints are context sensitive, meaning they only work in the context in which they are set.

This is explained in detail in the thread I identified and it describes how to accomplish setting the "context." So your suggestion that the answer given was "not about how to slove the problem" is simply incorrect.

Regards,
evaluator
02-01-2004, 03:37 AM
ok, here is "Z-Method" for breaking SICE anywhere:

YOU must do debugger's work by your hands, e.g.
1. go to specified address(where you need BP)

1a. if this address is NOT in memory(you see> ????),
then load it with SICE command > PAGEIN

2. execute in SICE command > BPINT3

3. now write down (or remember) first byte of instruction,
then change (in memory) this instrucion to CC(hex) & go..

4. IF this command will executed, then SICE will break;
here restore your original byte in instruction & press F8 once;

4a. IF you again want break here, put again CC..
(& on finish always restore all original bytes)

x. such like CC can break also in other processes;
dELTA
02-01-2004, 07:19 AM
Eval, I guess the problem is that you have to be in the correct context to be able to set that int3 at the correct place (the same virtual address can be mapped to different places in different processes, as you know), so it seems to me that it is the exact same problem anyway?
JMI
02-01-2004, 01:27 PM
Seems that DriverStudio 3.1 has escaped into the wild. Maybe there will be some improvement with the new Softice version. Anyone "tested" it yet?

Regards,
nikolatesla20
02-01-2004, 02:40 PM
I don't know why you guys are arguing about the context thing. ONLY BPMS are context sensitive. BPX's are not. BPXs are global. At least in DS 2.7. Why bother using 3.0 anyway, I say good choice going back to 2.7. (Which means you can also get my patches to hide it which saves you time too)

Cumulous, if you go into SoftICe and do a "U GetDialogItemTextA", does any code show up in the code window, and does it say GetDialogItemTextA at the code block that does show up?

If not - if all you see is some random code, the solution is to get the XP SYMBOLS WHICH NO ONE AROUND HERE seems to LISTEN. If you search this board about "SoftICE not breaking" you will find information which I've posted over and over, that you need to get the XP debug symbols from Microsoft and tell SoftICE to use them, and all will be well. The reason I am so animate about this is that on EVERY system I've done this on, it's fixed all those wierd softICE not breaking issues completely. You need to get the symbols for ntoskrnl, otherwise SoftICe doesn't know where to hook into the kernel at load time, in order to install its break handlers correctly.

Oh, and it never hurts to double check that you are loading USER32.dll exports into softice as well...

-nt20
sLayer
02-20-2004, 02:03 AM
I dont use softice that much as i m also usin xp.

But here is a solution.
GO to WINDOWS\SYSTEM32\DRIVERS
then go to winice.dat.
DONT FORGET TO MAKE A BACKUP COPY.

Now open it in notepad and scroll to the bottom
there u will see some crap startion with ":"
just delete it.
Now save and run softice hopefully it will break.

Laterz
:D
evaluator
02-20-2004, 03:51 AM
sLayer!

can you post that magic lines from your backup-ed 'winice.dat'?
bcoz in my 'winice.dat' i not found nothing with ":"
JMI
02-20-2004, 12:27 PM
Eval:

You KNOW that was a "typing" error and he meant ";". :cool:

Regards,
evaluator
02-20-2004, 03:23 PM
JMI, you again..

I'm waiting for answer from sLayer!
OK, sLayer!?
sLayer
02-22-2004, 01:06 PM
Open Notepad in winice.dat and scroll down until u see these lines

; EXP=\SystemRoot\System32\hal.dll

Just delete all the ";"s

Laterz :D
Aimless
02-23-2004, 01:22 AM
I think that you need to understand the "principle" behind the tutorial rather than trying to crack it step by step. The author, for all you know, could be working on Win95 with SI 3.22.

Have Phun


Using SoftICE - Details of some useful commands
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Using SoftICE - Details of some useful commands
PDA

View Full Version : Using SoftICE - Details of some useful commands

Kayaker
01-31-2004, 12:37 AM
Here are some very nice articles with diagrams which were created by a Numega programmer (Tsuyoshi Watanabe) detailing some useful SoftIce commands. They no longer exist on the original site so I have reformatted them slightly and attach them here for archive purposes. The diagrams themselves are extremely instructive explanations of the output from some of the more complex Softice commands. Some may recognize these articles from the Spiralspace website originally. I hope they prove useful for those who have never seen them.

How Windows NT uses GDT to implement "kernel mode" and "user mode" (GDT)

Where is the memory block you just allocated with Win32 API HeapAlloc()? (HEAP 32)

Create your own heap in your process and see it with SoftICE (HEAP 32)

Interrupt Descriptor Table and SoftICE "IDT" command (IDT)

Program modules (EXE, DLL) and SoftICE "QUERY" command (QUERY)

Walking "page directory" with SoftICE - understanding "address context" (CPU, ADDR, PAGE, PHYS)

Two ways to cause "page fault" situations, and how SoftICE reports it (PAGE)

How to access objects in various sections of a PE file with SoftICE (MAP32, SYM)

"Symbol Table" - the most important thing for source level debugging with SoftICE (TABLE, MOD, SYM)

SoftICE uses symbolic names to label memory object if symbol table is loaded (TABLE, FILE, TYPES)
dELTA
01-31-2004, 11:19 AM
Cool! :cool:

Other people are of course also very welcome to submit such high-quality "rare" documents and similar here for archival reasons!
JMI
01-31-2004, 01:27 PM
And so we can read up on them and attempt to figure out what the heck Kayaker is talking about when he gives us another one of his great low level lessons on the ins and outs of M$ beneath the covers. :p

Regards,
Kayaker
01-31-2004, 03:24 PM
Hey I'm only fumbling around in the dark of what MS calls an OS, like everyone else. But I agree quality reference material not easily obtainable elsewhere is always welcomed, these things tend to get lost over time.

Cheers,
Kayaker
cyclotron
03-19-2004, 10:45 PM
Nice work,thanks.
gook
03-31-2004, 01:41 PM
Thank you very much
dELTA
03-31-2004, 05:09 PM
Ok, new rule, if you bring a two months old thread to the top, only to say thanks, you will be banned... :rolleyes:
esther
03-31-2004, 07:56 PM
[>Ok, new rule, if you bring a two months old thread to the top, only to say thanks, you will be banned... :rolleyes:

LOL,its a bit too harsh.Its just 2 months old thread ;)
volodya
04-01-2004, 10:16 AM
Kayaker

AMAZING! I'll mirror them on wasm. Extremely nice!
Kayaker
04-01-2004, 03:56 PM
Well then, I guess the fuss was all worth it. Phew, good thing too, cuz I didn't know there was a time limit involved... :p
dELTA
04-01-2004, 04:17 PM
Ok, ok, I was only kidding, and you know it. :) But you have to agree that it's at least just a little annoying when two people, completely unrelated to the subject (not to mention having post counts of 1 and 3 :p) bring up a two months old thread just to say "thank you", huh? :D
JMI
04-01-2004, 04:34 PM
Well "thank you" for pointing that out for us. :D

Regards,


Dynamic memory allocation question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dynamic memory allocation question
PDA

View Full Version : Dynamic memory allocation question

Aquatic
01-31-2004, 01:58 AM
I am pretty sure about this, but I just wanted confirmation.

Is it true that in any win32 program that even though the locations of values get changed at runtime, the distance between those given values will always remain the same?

I stress the word always.

So let's say your game has an address for Lives and another one for Ammo.

The locations of these values will change once the process has been restarted, but their delta will remain the same?

Another question:

Why is it much easier to find a pointer to a 1byte value than a pointer to a 32bit float? It seems that the base pointer for 32bit floats are buried under many dynamic pointers. But if you search for the base pointer to a 1byte value it is always found instantly.

Thanks.
evlncrn8
01-31-2004, 03:55 AM
I am pretty sure about this, but I just wanted confirmation.

Is it true that in any win32 program that even though the locations of values get changed at runtime, the distance between those given values will always remain the same?

I stress the word always.

So let's say your game has an address for Lives and another one for Ammo.

The locations of these values will change once the process has been restarted, but their delta will remain the same?

really depends on the way the game was coded....

Another question:

Why is it much easier to find a pointer to a 1byte value than a pointer to a 32bit float? It seems that the base pointer for 32bit floats are buried under many dynamic pointers. But if you search for the base pointer to a 1byte value it is always found instantly.

Thanks.

again, depends on the game, compiler used, language it was coded in etc etc
dELTA
01-31-2004, 11:28 AM
If the two variables ("values") in question are stored as global variables in data section(s) of the executable image, their distance should always remain the same if the program in question is not having any funny business going on. But for stack variables, objects (OO) and other dynamically allocated types of variables, you can never trust them to have the same distance (even if they might very well have it at many times in these situations too). The distance can also be different between executions if the variables are stored as global variables in data sections of different modules.

About the pointers you mention, I'm not completely sure what you mean, but it is most likely dependent on the design of the program in question, and/or the compiler used.
Aquatic
02-01-2004, 05:50 PM
Is there anything a program needs to always be at the same mem location? Other than a pointer's value?
dELTA
02-01-2004, 07:20 PM
All the sections in the main executable module (i.e. the exe-file) are practically always at the same memory addresses (main executables are practically never relocated, and most of them don't even have relocation info included in the executable). This means that all data in all code sections, data sections (which means that all static global variables in these always have the same addresses) and other type of sections in the main executable are always on the same addresses. Why do you want to know about this?
Aquatic
02-01-2004, 08:46 PM
All the sections in the main executable module (i.e. the exe-file) are practically always at the same memory addresses (main executables are practically never relocated, and most of them don't even have relocation info included in the executable). This means that all data in all code sections, data sections (which means that all static global variables in these always have the same addresses) and other type of sections in the main executable are always on the same addresses. Why do you want to know about this?

I'm not talking about the program's ASM code, I am talking about the live memory.

I basically want a way to resolve dynamic values.

I guess calculating the distance from a given pointer is the only way.
dELTA
02-01-2004, 08:57 PM
I'm not talking about the program's ASM code, I am talking about the live memory.
What a lucky coincidence then, because that's what I'm talking about too... :) All sections of an executable file are mapped into "live memory" at runtime you know...
Aquatic
02-01-2004, 09:01 PM
What a lucky coincidence then, because that's what I'm talking about too... :) All sections of an executable file are mapped into memory at runtime you know...

Yes I know. Sorry.

Anyway, If you wanted to resolve a dynamic value each time the program starts, how would you do it?
dELTA
02-01-2004, 09:10 PM
That depends very much on what kind of memory value it is, and even more on exactly which point you resolve it at? Do you have any kind of breakpoint in the program and then resolve it, or is it more arbitrary, like you attach to the program "a second or two after it starts" and then try to find it?

Please tell us more details and we will most likely be able to help.
Aquatic
02-01-2004, 09:25 PM
Say for example in an RTS type game, you have a value for amount of gold. Every time that you reload the game you want to be able to read the value for gold into an edit box of your trainer.

But the value for gold is dynamic.

I already know how to do this with pointers, but just wanted to know if there was another way? Sometimes finding the pointer is the difficult part because often the base pointer is burried under many dynamic (fake) pointers.
dELTA
02-01-2004, 09:35 PM
In this case it is very dependent on the implementation of the target, and without analyzing the code used to access the value in the program itself it could be very hard (especially if it's designed to make the values non-easily found). The only generic approach I can think of is to emulate the search algorithm you used to originally find the value, in your "trainer", but this can be very hard too, since that original search might have involved program interaction and/or trial & error, but it might work.
evlncrn8
02-01-2004, 09:43 PM
even if the location of the code changes each time, it still has to use some form of a 'base pointer' and an index type to access it, so your best bet is analysing the code it uses for the index..

say for example

mov eax,[403000] ; load the base pointer
mov ebx,[403004] ; load the index
mov edx,[eax+(ebx*4)] ; load a value from the index..

in this example you would want to read the 2 dwords at 403000h and 403004 hinto your program, then multiply the value you read from 403004h by 4 (because thats how the program does the accessing) then add the value you read from 400300h, thus giving you the 'dynamic' address where the gold, lives, whatever is stored, again the example above will probably vary from game to game etc.. but i hope you get the idea
Aquatic
02-01-2004, 09:52 PM
even if the location of the code changes each time, it still has to use some form of a 'base pointer' and an index type to access it, so your best bet is analysing the code it uses for the index..

say for example

mov eax,[403000] ; load the base pointer
mov ebx,[403004] ; load the index
mov edx,[eax+(ebx*4)] ; load a value from the index..

in this example you would want to read the 2 dwords at 403000h and 403004 hinto your program, then multiply the value you read from 403004h by 4 (because thats how the program does the accessing) then add the value you read from 400300h, thus giving you the 'dynamic' address where the gold, lives, whatever is stored, again the example above will probably vary from game to game etc.. but i hope you get the idea

If you were just swimming through the code, and you saw the line:

mov eax,[403000].

Would you automatically know that it meant: 'load the base pointer'.
sgdt
02-01-2004, 10:05 PM
The location of where "Gold" may be stored at different locations from run-to-run IF it was in a dynamicly allocated structure (most games actually store such information in globals that don't change location, but that's off topic).

So you want a run-to-run independant way to get at "Gold"....

Obviously, the PROGRAM knows how to get it, right? And one of the pieces of code that gets "Gold" is ALWAYS going to be at the same location, regardless of run-to-run, correct (assuming the code doesn't get relocated)? So why not just call (or duplicate) one of their routines?

If you have Olly, run your program, set a hardware access breakpoint on "Gold", and when it pops up, make note of the function that's using it.

I mean, God, if you can fight protections this way, it should work for "Gold" too, no?

Anyway, an alternative would be just to make everything "Free" so you don't need any "Gold"... :)
Aquatic
02-01-2004, 10:08 PM
The location of where "Gold" may be stored at different locations from run-to-run IF it was in a dynamicly allocated structure (most games actually store such information in globals that don't change location, but that's off topic).

Would those globals be useful in my situation?
sgdt
02-01-2004, 10:58 PM
Globals are always at the same position in memory. In effect, they are "hard coded" into the program. Variables which only have one instance are commonly implemented as Globals. Even though good programmers loath them, it's still common practice because lazy programmers are responsible for a majority of the bloatware that exists today.

The code HAS to be able to get the data, or else it would be useless. By placing a hardware access break on it, you can back trace when the break fires and figure out how it was referencing the memory.

NOTE: If you see it break on something like this:

mov eax, [ebp-42]

Then you HAVEN'T got the right address, and you will need to search again. The reason is that your search was just a temp variable on the stack. (not actually a bad thing, because if you can repeat, then you can find out what eventually happened to it, or at least where it originated from).

Seriously, I would try breaking some simple shareware apps. You'll learn quite a bit very fast. Most of the Pop games are trivial, and UltraEdit would be a good second step (it has a nifty suprise should you just make the keycheck always return GoodGuy, but finding the memory wiper is quite easy and won't frustrate you at all). A simple hint on these programs is NOT to go after the registration window, but instead to go after where they load in the registration from the registry. So few people attack from there, most programmers don't obfuscate at all.

Anyway, back to "Gold". Assuming you don't want to modify the code, you can write a program that attatches to the game as a debugger, and use WriteProcessMemory to modify your gold values at will. Alternatively, just find out where the "Load Saved Game" is, and modify it here.
Aquatic
02-01-2004, 11:11 PM
Ok, thanks.

I have a lot to think about.
evlncrn8
02-01-2004, 11:25 PM
If you were just swimming through the code, and you saw the line:

mov eax,[403000].

Would you automatically know that it meant: 'load the base pointer'.

nope, thats where debugging the game comes into play, some code is easily identifiable tho and can usually be backtraced from a string xref such as the text 'Gold' or whatever you're searching for, of course, this can change per application, you just gotta do the hard work of debugging the application/game and analysing what it does.. the answers dont come magically u gotta work for them
dELTA
02-02-2004, 03:55 AM
Hmm, I thought Aquatic made it quite clear earlier in the thread that he "knew how to do this with pointers" (which require analysis of the code of the specific program, contrary to just use some memory scanner and noting down the address), but was just looking for an easier way, but now it doesn't seem like that at all anymore, hmm...

Anyway, many "big title games" today go to relatively far lengths trying to make it hard to cheat by patching their memory, e.g. by using encrypted memory values, fake/dummy values that will instead be found by the memory scanners, dynamic allocation with many levels, based only in differently placed stack variables and so on, so it might not be as easy as it seems anyway. But of course, with enough tracing and patience it will work just as much as breaking any protection, it's just that it might be quite hard to find a good initial breakpoint in a DirectX game like that, especially when values are encrypted in memory so that memory scanners can't help you to a good start.
Aquatic
02-03-2004, 11:41 PM
Ok guys. The reason I ask all this is because a friend is making an application called Game Trainer Studio.

It needs the user to provide a base pointer, then if you want to freeze a value you just need to enter its distance from the pointer's value to resolve it.

Here is the trainer maker: http://www.gamehacking.com/ipb/index.php?showtopic=7536 (early)

It would be nice if there was a way for the Maker to inspect the game, and then find some kind of base or reference that can always resolve values in memory for the user. That way the user only has to provide an address from their mem-sercher, and the program would automatically calculate the distance from the reference or pointer value.

The idea is to make the program as n00b friendly as possible.
dELTA
02-04-2004, 08:18 AM
My best idea for full automation would be like follows (which is still pretty unreliable and prone to error, but might work in many cases too):

1.
Find the correct value in memory by comparative search/analysis, like with most of these tools.

2.
Search the program's entire memory space (including stack, PE data sections and all dynamically allocated memory) for the pointer pointing to the closest memory location previous to the value (pointing right at it is of course the best, but not always likely if structs or objects are used).

3.
Repeat step 2 until the pointer you find is located either in a PE data section or on the stack (PE data section is best). Save this memory address, and save all the offsets between the pointer targets and the real values in each step of the chain.

4.
Restart the target program and traverse the same chain of pointers, from the "root address" you just found (the value on the stack or data section), by using the offsets you earlier saved.

5.
Modify the value at the end of the chain. If it affects the wanted property in the game, you are probably right, otherwise you are most likely not. :)

Like I said, this method can very easily go wrong or be thwarted due to several reasons, but it might also very well work under the right conditions. And if you want a fully automated method it's the best I can think of anyway.
Aquatic
02-04-2004, 01:33 PM
Yep, that's what it does currently.

For example

Using 'Money' as our base we can see that in terms of the locations of the values they are all very close, in fact each
value is just 4 away from the previous one in memory. (look at the addresses)
So now we can construct a basic table based on this knowledge:

Pointer 403138 4 Add FF FF // Money
Pointer 403138 8 Add 64 // Healthbar
Pointer 403138 12 Add 20 // # of lives
Pointer 403138 16 Add 64 //'you better stop this' bar.

Each value is 4 locations further than the last from the pointer. The 'Add' tells the maker to add 4 in the case of money, and add '12' in the case of '# of lives'. The numbers after the Adds are what you want to freeze the values at. These can be changed.

http://www.222clan.com/up-down/GTM_pointers.zip


IDC short-circuit evaluation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDC short-circuit evaluation
PDA

View Full Version : IDC short-circuit evaluation

nino
01-31-2004, 04:58 PM
Is it possible to make IDA's IDC language do short-circuit evaluation of logical expressions as in standard C ?
disavowed
02-01-2004, 01:41 PM
probably not the solution you're looking for, but nested IF's would work


Can any guru give me some hints on ClearCase?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Can any guru give me some hints on ClearCase?
PDA

View Full Version : Can any guru give me some hints on ClearCase?

Daemon
01-31-2004, 10:28 PM
Recently I have been trying to figure out a key( or make a keygen ) for ClearCase ( NOT ClearCase LT ), but I almost failed ( only choice is crack it).

At first I consider it use FlexLM like other Rational products, eventually I find it is not. It use a license management like NetLS, we can call it Atria License Management. ClearCase is developed originally by a company named Atria, Atria was bought by Rational, then Rational was bought by IBM. Atria's CEO Paul Levine is former engineer of Apollo Computer, which had a License Management named NetLS (only use on some Unix like AIX, Solaris, HP-UX and Irix).

It's license like this mode:
-license ClearCase TEMPORARY *.30 99991231 3c2a17d4.3d73047d.02

So any guru give me soome hints?
Aimless
02-02-2004, 12:36 AM
You may not know it, but you have just asked the board to crack the software and hand it over on a platter to you. This board will help you. But you need to point to us where you are stuck. And the matter of fact that you have indeed tried something to crack it. Detailing the CEO's names and history of the company won't cut the cake.

However, I understand that chances of you providing details with how you have tried to crack this is very slim, considering that you do not even know exactly the protection name, its versions or even how it works!!

Sorry bubba, its a definite no-no on this board.

However, here's some generic tips for you:

1. Use google to find more information about clear case.
2. Try to see how it works first.
3. Unless you are really interested in the implementation scheme (which I really doubt you are) try finding cracks on google for the same
4. Try going to www.searchlores.org for tips on how to search. You can search and get *anything* on the web.
5. Try cracking easier protections like: packed files and anti-debug code before moving on to the biggies. I recommend you start with Softice, IDA and winzip version 6. We'll see about bigger things later.

And above all, read the FAQ. Its got most amazing things that you were afraid of asking.

Have Phun,
Kayaker
02-02-2004, 01:38 AM
Thank you Aimless. I wasn't sure what to do with this, whether the post made any sense to anyone or not. If some further analysis of the protection isn't forthcoming, enough to merit it being in the Advanced RCE forum, I will move it to Off Topic or Newbies. What Aimless said was very well put, I hope the original poster understands what is expected.

Regards,
Kayaker
tom324
02-02-2004, 10:44 AM
Another option is using Search button. Like this:

http://www.woodmann.net/forum/showthread.php?t=1523&highlight=clearcase

Tom
JMI
02-02-2004, 03:37 PM
Oh now Tom, using the Search button is way too hard. :o

Regards,


Imagine having this computer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Imagine having this computer
PDA

View Full Version : Imagine having this computer

Aquatic
02-01-2004, 01:44 AM
128 CPUS!

http://www.sgi.com/origin/3000/overview.html

All the different components have seperate bricks:

http://www.sgi.com/origin/3000/bricks.html

http://www.blazofamily.com/downloads/files/lg_origin_3900_in.jpg
dELTA
02-01-2004, 07:07 AM
How did you get inside my house to take a picture of my computer? :p
JMI
02-01-2004, 01:22 PM
We have a video camera concealed in you humongous "monitor," from which we can view and record all that occurs in your "computer room." :D

Regards,
naides
02-01-2004, 03:18 PM
How did you get inside my house to take a picture of my computer? :p

When you are doing RCE stuff in this computer, and you see EAX= FFFFFFFF,

How do you know which of the 128 different EAX you are talking about?

I'm serious :o
nikolatesla20
02-01-2004, 03:28 PM
well naides, I think you'd be ok, since ring 3 apps never multiprocess (they only multithread). Usually only ring 0 use multiple processors....

-nt20
dELTA
02-01-2004, 07:08 PM
Not to mention that when you are debugging programs in multi-processor environments you will most likely have available to you some kind of information about which processor you are currently looking at in the debug window.
disavowed
02-02-2004, 08:00 AM
EAX= FFFFFFFF
functions returning -1? you're such a pessimist! :p
naides
02-02-2004, 08:06 AM
functions returning -1? you're such a pessimist! :p

All my functions have benn returning FFFFFFFF lately. :(
dELTA
02-02-2004, 09:59 AM
Here's a simple patch to solve all your recent problems then naides:

mov eax, 1
ret

:D
0xf0001
02-02-2004, 10:55 AM
i would say looking for an eax register on such "computers" is the wrong way from the beginning on .... :)

some of the big boxes do not even have a stack pointer eg - it is all free for
interpretation of the programmer to implement it.

but when the os is running, registers will become their meaning that helps. anyway
dont say i am too serious for the off-topic :)

btw i like the hp/superdome boxes - they also have this lego module approach - and they are not soo loud and you can go across without getting blown away by all these fans! (try it behind a sun e10000 complex) so think about it before buying the sgi box above ggggggggg so you see the real important things dont care about registers :)

greetz, 0xf001
0xf0001
02-02-2004, 10:57 AM
ahja and prepare to receive 0xFFFFFFFFFFFFFFFF in the registers :)
disavowed
02-02-2004, 02:22 PM
mov eax, 1xor eax, eax
inc eax

^ this is the preferred way
dELTA
02-02-2004, 06:51 PM
Damn messerschmitt... :p
evaluator
02-03-2004, 08:21 AM
while MSVC does
push 01
pop eax
??

after imagination of 128 cpus, what u think about Jannet's 2 cpu!? ~:)


Softice startup problem in XP SP1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice startup problem in XP SP1
PDA

View Full Version : Softice startup problem in XP SP1

roocoon
02-01-2004, 07:08 AM
Hi all.
Maybe somebody has come across this case and has some suggestions.
On an XP SP1 system, I used to run Softice (from DriverStudio 3.0) with its normal problems. in manual startup mode.
I backed up to 2.7 later on and still could run it the same way.
I haven't used the debugger for a couple of months and just tried it out now to locate a problem with msvcrt.dll crashing.
Well, I can't start it up anymore.
The DOS window comes up with the "net start ntice" completing successfully message but the DOS window doesn't close.
A CTRL+D opens the Softice window but the screen doesn't have its normal panels but only the trace log.
In there, after the Softice version, XP version, loaded mice etc, allocated memory and such, it comes to the first Load32 of module NetMsg.
Int0E Fault in Softice at some address, fault code 0.
Right after wbemcons loads successfully and that's about it.
The screen refresh slows down and an hboot is the easy way out.
So, why the error on NetMsg (it's v5.1.2600.0)?
My workgroup works fine and have no problems with it.
I've reinstalled 3.0 and even tried Softice 4.3 Lite but the problem remains.
The firewall (Outpost) is disabled and in any case I used to have it before when Softice was running fine.
No hardware changes either. Only a bunch of software and what is probably the culprit: WinXP security hotfixes.
If so, which one? I'd hate to remove them piecemeal, reboot and try.
Did anybody have a similar problem with some specific hotfix? Or can think of another reason?
Regards
nikolatesla20
02-01-2004, 07:50 AM
I really don't know what happened either, but My DS 2.7 went down for the count as well with similar symptoms. I could start it manually but it would lock up the machine. If I started it at boot time, it would BSOD !

I actually was able to fix it by reloading SoftICE again, repatching it (to hide it) and getting the latest ntoskrnl.exe and ntdll.dll symbols using the symbol retriever tool. I always set up SoftICE to use a symbols file for NT OS's because it's the only way to get it to work 100% reliably in my opinion, on NT.

Since both my XP system consists only of Service Pack 1, and the blaster worm patch (I have a firewall at home so I don't update everything all the time), I suspect the blaster patch. But its only a theory.

My SoftICE works fine again now in my desktop system. It's still hosed on my laptop, with the exact same symptoms that my desktop system had.

Try reloading SoftICE again, and then use the Symbol Retriever (found in the programs menu with SoftICe under "Tools", to get new symbols for ntoskrnl.exe and ntdll.dll, it will download the newest symbols automatically, using the file data, etc, from Microsoft, and convert them to nms files. Then go into SoftICE settings, under "Symbols", and tell it to load those files. Also, then go into "Advanced" where you see just a bunch of INI like type entries, and add the string "NTSYMBOLS=ON", and reboot. My theory right now is I got a BSOD cause the kernel changed, and softICe wasn't hooking into the right areas anymore.

And actual thought that just occurs to me, heh, I always use the symbol files, I guess if I patched the OS with an update than my files would already be bad prolly, and SI would still try to use them, hence mayhem? So maybe it won't act that way if you already DON'T use symbol files? I don't know. But I do know that using symbol files has always solved the big problems with SI for me. That of being able to BPX properly on API's, and now it seems to have possibly fixed this BSOD and lock-ups as well.

Don't know if all of that stuff still is there in DS 3.0. I still use 2.7 for everything.

-nt20
dELTA
02-01-2004, 12:53 PM
Here is a thread with very complex discussions about exactly this problem, including how he solved it on his computer:

http://www.woodmann.net/forum/showthread.php?t=5335

Please try the search function. :)
roocoon
02-02-2004, 03:39 PM
Thanks for the suggestions.
Good pointer about the symbols nicolatesla20. I had forgotten to update them and even though they were not the reason for the problem, I'm sure they saved me from some misfortune later on.
dELTA, I had searched before and saw that article. The description there, matched my problem in parts but the solutions didn't seem to apply to me.
Well, thanks for making me read it again.
I picked up two things I had missed the first time.
The link to OSINFO.DAT (handy to have) and the reference to Kaspersky AV to switch it to manual mode.
My Kaspersky service was disabled already that's why I had ignored that.
Big mistake. It was Kaspersky that was causing the problem after all. Disabling it, is not enough. I doubt it was the scan engine that was to blame (after all it was disabled) but probably it messed up the driver chain (I had a similar problem 2-3 years ago with a TCP/IP tracer utility).
So I removed Kaspersky and got back my Softice. A better deal I'd think.
Now if only I could get it to run on my laptop too and recognize the external mouse...
While I'm at it, what antivirus scanner and firewall for XP you know that works with Softice?
Take care all.


dll packed with Armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > dll packed with Armadillo
PDA

View Full Version : dll packed with Armadillo

none1899
02-02-2004, 01:52 AM
Hi all. I recently crashed into a dll packed with Armadillo and I?m totally stuck. Could anyone give me some general tips about unpacking suck dll?s?
dELTA
02-02-2004, 03:44 AM
Judging from the amount of info you provide (or rather the lack thereof), I assume you're just looking for the easy crack... I do this only to help Manko with the beta testing of the last version of his tool:

http://www.woodmann.net/forum/showthread.php?t=5442


Thinstall unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Thinstall unpacking
PDA

View Full Version : Thinstall unpacking

selecta
02-02-2004, 12:28 PM
Hi all,
Does someone know where I can find some tuto about unpacking thinstall packed programs ?
Tnaks you very much.
JMI
02-02-2004, 03:17 PM
Have you, by any chance used the search button at the top of all the forums and read the threads which mention that protection system here? Have you by any chance entered "thinstall" in your favorite search engine and reviewed the material that produces? Are you aware there is a tool out that claims it is a Thinstall unpacker?

Please read the FAQ linked at the bottom of the Forum and follow its advise about what you should do before you post and then come back with a more pointed question, including some discussion about what you have attempted to do to help yourself.

Regards,
selecta
02-02-2004, 03:21 PM
Yes i've tried and there is no answer about unpacking.

:o And you, do you tried to search about unpacking thinstall before posting your "reply" ?? :o

PS : I'm not looking for a tool that unpack, but if it exist a tuts that explain how to unpack this kind of packer by using si or another debugger
JMI
02-02-2004, 03:29 PM
Well then I guess you didn't bother to read this thread:

http://66.98.132.48/forum/showthread.php?t=4921&highlight=thinstall

You haven't looked at the unpacker on Protools and you haven't reviewed all the hits that "thinstall" will get anyone who enters it into a search engine. And, the answer is Yes, I did search about unpacking Thinstall before I replied to your post, that's WHY I had that information.

You are not off to a very good start. Perhaps you want to rethink your approach.

regards,
JMI
02-02-2004, 04:28 PM
selecta:

I have read your PM and believe you should keep trying both with your searching and your investigation. Have you gone to the authors site and downloaded their .pdf file and reviewed the information on their site about how their program works? This usually is a good source of information and gives helpful clues on how the program works. You can also download the program and experiment with it and then report back here what you have tried and what you have discovered and where you need further help.

Regards,
selecta
02-06-2004, 04:55 PM
Hi,
Well I had dump the packed software with a litle prog in C (call to createProcess/ReadProcessMemory) and using pe-tools i had recreate raw size of the sections so dissassembly is possible with wdasm. Then i've done a loader by using CreateProcess/WriteProcessMemory and it' ok now.

Thanks you for your help,
regards


SoftIce Does Not Pop Up....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SoftIce Does Not Pop Up....
PDA

View Full Version : SoftIce Does Not Pop Up....

minderz
02-02-2004, 07:59 PM
I am trying to decompiling an Armadillo 3.0a packed/encrypted exe.... and SoftIce does not pop up after loading the exe... I also check that .text is a executable section... The program is protected against soft ice and another problem is that i cannot modify executable because is protected against changes.
Someone can help me or tell me some place where i can find info?
Tnx Everybody!!!
minderz
02-02-2004, 08:00 PM
The App is JCreator ver 3.00.94...
Woodmann
02-02-2004, 10:50 PM
Howdy,

You just didnt say the app is :
JCreator ver 3.00.94.

Cause if you did you have violated the rules concerning the name of the prog you are trying to defeat.
That particular program has freeware versions.

Oh the shame..............

OBC
minderz
02-03-2004, 06:16 AM
Maybe i did an error saying the program name... but really i don't care if there is freeware version. I just wanna learn how to defeat that kind of protection. It's all. I don't need that program. I just said the name in the case some other else is trying just like me. Bye
nikolatesla20
02-03-2004, 08:03 AM
Woodmann, dangit, is there any way to put a "USE SEARCH AND READ THE FAQ" in big bold red letters on the main page, like it used to be? C'mon PLEASE...and I mean LARGE letters (large as in delta's monitor large).

minderz: All you need to do is search the forum for armadillo and you will find endless information man!

-nt20
evaluator
02-03-2004, 08:32 AM
IF sure you just want learn armadillo, download armadillo itself,
protect notepad & learn!!
this is 100% better, then some unknown program;

so now Q is: are you TrueMan!?
dELTA
02-03-2004, 04:17 PM
Ok, are those letters big and red enough for you? (they aren't of course playing in the same league as my monitor, but they will do for a start I think) :D

Also, we have a new and remade FAQ with completely new style and contents (thanks to ZaiRoN!), so check it out everyone!
minderz
02-03-2004, 05:35 PM
it seems i didnt disrespect anyone of you right?. I am just a newbie... you are having fun? I just ask something in a polite way. If this is not in your style can you be more professional and tell me to piss off? Tnx.
JMI
02-03-2004, 07:07 PM
minderz:

Try to take a step back and view the issue and the responses from "our" perspective. You appeared with a first post, not having done essentially any of the things one should do before asking a question here, i.e. you didn't really look around much, you didn't read the FAQ, you didn't search for discussion of your topic before you posted, you identified a specific target, and you didn't tell us what, if anything, you had actually done to try to solve your own problem.

Now there are already 145 threads here which discuss armadillo and by using that word and some qualifers in the search selection button you would have, undoubtedly found some very useful information, which would, at the very least, have permitted you to make a more focused question, which more closely followed our rules. There are many, many threads on anti-debugger tricks of various protection systems, again a very good topic for a search.

Now for you, this was a first post and a seemingly unfriendly response, but for us, it was just the latest in a very, very long series of "first posts" by people who didn't take any time to familiarize themselves with the way things are done here, because they simply wanted an answer to their question NOW.

So if you actually want to learn from this group, that includes "learning" how to do things in the right way on "this' Forum. That simply means taking the time to find out what those expectations are and fitting in. If you don't want to "fit in," you are always free to seek help elsewhere. However, it would be unreasonable to expect that all of the rest of us should suspend the rules and established procedures, just for your benefit.

We have no desire that you "piss off." We do desire that you "conform" in some reasonable manner to our requirements. Most of the rest that has been written in this thread was intended as an object lesson to anyone who might be tempted to repeat your errors.

As I stated in another thread, the comments were directed at the "behavior" not at an individual, and were intended to discourage similiar "behavior" from others.

Now you chose what you are going to do.

Regards,
minderz
02-04-2004, 07:08 AM
thanx a lot.
But i had the (maybe wrong) sensation that you people like to have fun on the newbies. I am also a newbie of forums. Expecially of this kind of forum. I understand that there is a lot of peolpe that need only cracks. But i'd prefere an explaination of your rules instead of the fact you assume i have bad intentions. I'm sorry for the trouble i caused. Bye
sLayer
02-20-2004, 01:50 AM
Cmon u have to rebuild the pe then only will softice break.
rebuild the pe and use sice symbol loader :D
minderz
02-23-2004, 03:22 PM
Are you capable of manual rebuild an armadillo 3 protected software without debugging? WOW!!!


OllyDbg scripting plugin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > OllyDbg scripting plugin
PDA

View Full Version : OllyDbg scripting plugin

crassy
02-03-2004, 12:33 PM
Thought you people might want to check this out...

http://ollyscript.apsvans.com

This is a plugin for OllyDbg that allows writing scripts to automate your work. Useful for finding OEPs etc. There are some scripts on the Exetools forum.

Hope I'm not being rude shamelessly advertising SHaGs work! :D
dELTA
02-03-2004, 03:31 PM
Cool, that could be a great help if used creatively, not to mention when it's developed even more... :cool:
SHaG
02-03-2004, 04:34 PM
Great to see the plugin is spreading =)

...not to mention when it's developed even more
I'm really in need of feature suggestions for v0.5!
JMI
02-03-2004, 05:16 PM
Judging from some of our posters general statements, they would prefer a tool which requires absolute no effort, which, upon the mere thought of the tool, would give them a perfectly working version of absolutely any and every piece of software that currently exist or which might be created at anytime in the future. :eek:

But then if such a tool were to be created, we would have nothing left to do in reverse engineering and we might actually have to find another hobby to occupy some of our spare time. ;)

Regards,
dELTA
02-03-2004, 06:26 PM
Wrong, we would have just the same amount of things to do, we would just get rid of all posters looking for the easy crack, so please go right ahead and implement that feature SHaG. :p

Anyway, SHaG, maybe you should ask Oleh to list your plugin (and other cool plugins) on his site? It would probably be beneficial to you both.

Finally, as you most likely already know, Oleh is currently asking for immediate suggestions regarding expanded plugin functionality for the upcoming version 2.0 of OllyDbg. If you have thought about any shortcomings or good ideas whatsoever in the OllyDbg plugin interface while developing this plugin of yours, please tell Oleh about it ASAP, to make sure that version 2.0 will be as great and useful as it possibly can!

Thanks for your nice plugin in any case!
JMI
02-03-2004, 06:43 PM
Now dELTA, if the "new" plug-in could provide "a perfectly working version of absolutely any and every piece of software that currently exist or which might be created at anytime in the future," simply by thinking about the plug-in, what would there be left to do? EVERYTHING would already BE cracked.

I know, we could try to invent a software that it COULDN'T crack and, gasp, WE would become the "new" protectionists. Talk about a role reversal. :eek:

Regards,
dELTA
02-03-2004, 08:04 PM
Hmm, if I recall correctly we're supposedly in this for the pure challange and technical knowledge, not for the final result of a cracked program? Or is that just something you recommend us to say when they send those nasty emails trying to take down the server? :p
JMI
02-03-2004, 09:06 PM
Actually that is a good description of why a great many of us are in this hobby, but it wouldn't change the fact that, as I had defined it, there wouldn't be much left to reverse. :cool:

Regards,
CluelessNoob
02-03-2004, 11:59 PM
imply by thinking about the plug-in, what would there be left to do? EVERYTHING would already BE cracked.

[exits lurk mode]

This would not be of use to those looking for a quick crack, for it would still require thinking.

[returns to lurk mode]
JMI
02-04-2004, 01:04 AM
Ah, yes. Very good point. I hadn't "thought" of that. :eek:

Regards,
dELTA
02-04-2004, 08:21 AM
I guess he'd just have to add the feature of producing a crack file too then (yes, including a leet nfo file). :D
SHaG
02-04-2004, 08:40 AM
All right, features for the next version:
- Crack anything in an infinitely small ammount of time
- If there is nothing to crack, then write the application
- Produce leet .nfo, rip, pack, pre
- Make coffee by using a espresso machine plugged into USB port

Some time later I will also have to add:
- Write symphonies
- Compute the meaning of life and present it in a pink message box.
dELTA
02-04-2004, 08:51 AM
Excellent, let us know when it's done (and don't dare coming back before that). :D
R@dier
02-04-2004, 09:31 AM
- Compute the meaning of life and present it in a pink message box.

umm already done, the answer was 42 :p altho a pink message box would be cool

gota love douglas adams :D

R@dier
Kayaker
02-04-2004, 11:21 AM
gota love douglas adams :D
R@dier

I love his 5-part trilogy. I've always thought one of the most clever/witty concepts in a storyline is that Dolphins are only visiting this planet and their parting message to us 'intelligent' humans is "So Long and Thanks for All the Fish". :p
JMI
02-04-2004, 12:47 PM
You are now entering the "Twilight Zone." Doo Dee Doo Daa, Doo Dee Doo Daa. :cool:

Regards,
SHaG
02-07-2004, 08:24 PM
Ollyscript v0.5 can now be downloaded at:
http://ollyscript.apsvans.com

New features like API breakpoints, run-to-return, module info etc. are implemented.

From readme.txt:
+ New commands:
CMT, GMI, GPA, LBL, RTR, RTU
+ New example script - tElock 0.98 OEP finder.
- Still no pink message boxes... :P

Comments please!!! =)
dELTA
02-09-2004, 07:37 PM
Very nice, really cool to be able to script OllyDbg itself for such relatively complex tasks as OEP finding and other unpacking operations! It also has the benefit that OllyDbg is quite likely to stick around and be updated for a while, unlike several other "scriptable tracers" in the past that has come and gone, not to mention how much more cool stuff one can do with a scripted Olly than a scripted "tracer only". Keep up the good work! :cool:
JMI
02-09-2004, 08:05 PM
Version 0.51 was released by SHaG and is available on his site, listed above.
I simply do not know who started that vicious lie that this is just a "f*ks-up fixer-upper" update :D, but the continued efforts are appreciated by those who realizes how good this really is. :cool:

Regards,
SHaG
02-10-2004, 05:29 AM
Ummm... Doesn't seem like my best week this week...

Another bug found and destroyed. v0.52 is available now. =)
JMI
02-10-2004, 01:04 PM
Don't worry, our agents are out cruising the net and destroying anything which even hints there could possible have been a "b*g" in your fine program. So if you would kindly stop "falsely" confessing all over the place that these are anything other that "brilliant improvements," it would give them alot less work to do. :D

Regards,
SHaG
02-14-2004, 06:44 AM
Web site updated with 16 scripts for Ollyscript.

hxxp://ollyscript.apsvans.com
dELTA
02-14-2004, 10:57 AM
Cool! Like I said before, this will most likely become a quite famous Olly plugin... :cool:
SHaG
02-15-2004, 03:22 AM
Cool! Like I said before, this will most likely become a quite famous Olly plugin... :cool:

Well, it looks like soon OllyScript is going to be blown out of the water by this:
hxxp://mars.walagata.com/w/focht/ASDevEnv.JPG =) Well, i don't complain - it seems to be the most advanced plugin for OllyDbg EVER.
Ricardo Narvaja
02-15-2004, 08:09 AM
Ollyscript is a good job, and is easy write scripts with it, despite the new plugin you continue with your work, is good, easy for work, and if the new plugin is better in same points, will be more complex sure, the simplicity of ollyscript for work is a good point to continue working on it.

Ricardo

Well, it looks like soon OllyScript is going to be blown out of the water by this:
hxxp://mars.walagata.com/w/focht/ASDevEnv.JPG =) Well, i don't complain - it seems to be the most advanced plugin for OllyDbg EVER.
Js
02-15-2004, 09:21 AM
yes I agree with Ricardo, hope you continue Ollyscript its the ida vs wda situation, I don't always feel like having a kip while I wait for ida when wda will do the job.
dELTA
02-15-2004, 05:39 PM
I agree too, the first thing I thought when seeing those screenshots of the other plugin was "bloat"... :rolleyes:
SHaG
02-24-2004, 09:32 AM
OllyScript v0.6 is now available for download at
hxxp://ollyscript.apsvans.com.

Here is an except from the readme:

2.1 What's new?
---------------
The internal architecture of the plugin totally redone and object-oriented
(its not perfect OO, but bear with it). Because of this rewrite, bugs are
likely to appear. Please report them to me ASAP!
Bugs with script processing are fixed, parts of code are redone etc.

+ New commands:
BPCND, BC, BPMC, JA, JB, JAE, JBE, AI, AO, TI, TO
+ Conditional breakpoints
+ Breakpoint clearing (even memory)
+ Tracing and animation
+ More jumps
+ Stepping through script
# BP behaviour fixed (it now SETS breakpoint, instead of TOGGLEING it).
# Bugs in script processing fixed (thanks s0nkite).
# LOG now logs things like strings that are referenced by the address,
referenced function addresses etc. Try it, its cool!
# "Thanks" section of readme updated. =)
------------------------------

Hope you like it! =)
cooper
02-27-2004, 09:46 AM
SHaG:
hi!
just foun out about your plugin but have a problem wiht it
i dont see it in plugins menu section, the dll itself is in the plugins
folder so can you help me here? im using OllyDbg v1.09d(step 4)
and OllyScript v0.6
R@dier
02-27-2004, 09:54 AM
SHaG:
hi!
just foun out about your plugin but have a problem wiht it
i dont see it in plugins menu section, the dll itself is in the plugins
folder so can you help me here? im using OllyDbg v1.09d(step 4)
and OllyScript v0.6

from the Authors Site

OllyScript v0.6 is now available! Requires OllyDbg v1.10.

/* it may also pay to re-check your plugin dir is correct */

Best Wishes

R@dier
cooper
02-27-2004, 05:08 PM
R@dier
downloading beta 1.10 solved this problem
thank you :)
SHaG
03-04-2004, 11:26 AM
OllyScript v0.62 posted.

* Breakpoint bug fixed (again).
* EFLAGS can be changed.

Damned bugs...
charlieC
04-01-2004, 08:56 AM
SHaG, you're swedish, right?
Kul med svenskar iaf :)

A generic logging feature would nice. Not just for executed instructions.

Anyways, been waiting for a plugin like this. Thanks!
dELTA
04-01-2004, 11:40 AM
Ok killar, det finns faktiskt åtminstone ett par personer här som inte förstår svenska, så håll er till engelska! :p
SHaG
04-01-2004, 06:59 PM
Hur kunde ni gissa? Kan det vara "apsvans"? =)

Generic logging? Humm... What exactly do you want logged?
charlieC
04-02-2004, 05:45 AM
Apsvans, yes! Hehe :)

Anything! For example, I want to log the text "OEP found!" when my script finds it.
Maybe it's not useful for everyone, but I think it would be a nice feature.
crassy
04-02-2004, 06:13 AM
You can do it even now...
log "OEP found"
charlieC
04-02-2004, 07:25 AM
You can do it even now...
log "OEP found"

But that logs it to the window in OllyDbg?
If you need to log lots of information, logging to a file might be nice.
Harding
04-02-2004, 04:22 PM
But that logs it to the window in OllyDbg?
If you need to log lots of information, logging to a file might be nice.

You can do that in OllyDbg. Just right-click in the log window and choose
"Log to file"
JMI
04-02-2004, 04:29 PM
Now there you've gone and given away the secret. :p

Regards,
Harding
04-05-2004, 07:21 AM
Now there you've gone and given away the secret. :p

Well I wanted to say "READ THE FAQ!" as all the cool guys do but I can't remember that I've seen that in the FAQ. ;)
SHaG
04-11-2004, 02:38 PM
New version of OllyScript is available for download.
Grab it at
http://ollyscript.apsvans.com

Changes in v0.7:
+ New commands: #INC, #LOG, DM, FIND, GO, MSGYN
+ Possibility to call OllyScript from other plugins
# Wildcard search for the FINDOP command
- Source code not included in distribution archive (available on request)
SHaG
05-07-2004, 09:11 AM
OllyScript v0.8 is now available!

Changes in v0.8:
+ New commands: DBH, DBS, DPE, FILL
+ PE dumper
+ Debugger hiding
# FIND now accepts wildcards


New FAQ! (+ complete forum archive for download!)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > New FAQ! (+ complete forum archive for download!)
PDA

View Full Version : New FAQ! (+ complete forum archive for download!)

dELTA
02-03-2004, 04:24 PM
Hi people, we have a new FAQ online (thanks ZaiRoN!), so take a look at it everyone!

http://www.woodmann.net/fravia/rce-faq.htm

Also, if anyone has missed Kayaker's announcement about this, we also have complete forum archives in easily browsable form for download now! (I always miss those announcements, they are really badly designed/implemented by vBulletin I think)

Here is a copy of Kayaker's original announcement message:

Forum Archives available for Offline Browsing

The forums archives are now available in .chm format for offline browsing. Similar in style to the "Archives" feature at the bottom of the page, with the addition of a 'Favorites' tab, print option, the usual .chm stuff.

A search index is NOT included nor are any of the attachments, but if you click on the individual thread title you can log in directly to the original thread from within the .chm browser.

I will try to update the file on occasion, if I forget, a gentle reminder or offer of the finest beer from your home Country should be enough to spur me to create a newer version.

The .chm file is 5.9Mb in size and is available here:

http://woodmann.com/forum/archive/ChmFile/RCEArchive_Jan26_2004.zip
JMI
02-03-2004, 05:18 PM
And yes, we will update the archive from time to time, so you needn't ask. :cool:

Regards,
esther
02-03-2004, 08:21 PM
>PE stands for Portable Execution

portable executable ;)

> Ida and Windasm

w32dasm

>I load a file but I am not able to see the string reference, is it possible?
>Yes, there could be some reasons:
>1. the program uses some anti-windasm tricks
>2. the program is packed
>3. the program is written in visual basic; in this case you can use a patch, ?>it lets you see the string reference (see protools for more info)

You've forgot delphi ;)
dELTA
02-04-2004, 02:21 PM
Doesn't really W32dasm find any Delphi strings? Is there any patch for it? It was so long ago that I used W32dasm, so I can't remember. Anyone?

I fixed the other things, thanks.
babar0ga
02-04-2004, 02:38 PM
bad link in FAQ
.../fravia/what_new.htm links to .../RCE-CD/
JMI
02-04-2004, 02:56 PM
OK. Fixed. Thanks. ... Whoa. Now they both point to the "what's new". Hang on. OK. This time they both seem to point to the correct place. :rolleyes:

Regards,
ZaiRoN
02-05-2004, 04:52 AM
Sorry guys, thx for the corrections :rolleyes:

esther: I am not totally agree with you, W32dasm shows delphi's strings references.

ZaiRoN
esther
02-05-2004, 11:11 AM
Hi ZaiRoN,

http://www.woodmann.net/forum/showthread.php?t=3712&highlight=delphi

Well you decide :)

vb show strings too :p
"VB5!"

Btw the faq should advise newbies to install softice with a clean OS?

Regards
ZaiRoN
02-05-2004, 12:18 PM
Hi esther,
I can't see any 'W32dasm does not show string reference' in this thread :p
Btw the faq should advise newbies to install softice with a clean OS?Hmmm, sorry but I can't understand, what do you mean exactly?

Nice to have such comments, thx.

Zai
esther
02-05-2004, 12:25 PM
I'm suggesting that the FAQ should put in this line on using Softice section.

Install a newly fresh window when trying using softice just to make sure other programs will not affect at background


IDA Debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > IDA Debugger
PDA

View Full Version : IDA Debugger

naides
02-03-2004, 09:15 PM
This is not a question.
I just would like to know people's opinions and experiences with the the debugger.
I have had problems running it, as it freezes quite often, and only a cold boot can solve it.
Mastering it could be both challenging and productive.

Just to start a conversation. . .
disavowed
02-03-2004, 10:43 PM
i'm very unimpressed with the debugger. until datarescue can integrate a debugger with olly-like quality, i'll stick with using ida just for disassembling.
Aquatic
02-03-2004, 11:32 PM
i'm very unimpressed with the debugger. until datarescue can integrate a debugger with olly-like quality, i'll stick with using ida just for disassembling.

Isn't Olly open source?
disavowed
02-04-2004, 07:53 AM
yes
naides
02-04-2004, 08:18 AM
Just to start a conversation. . .

You guys talk in monosylables, Perhaps a Beer?
r4g3
02-04-2004, 09:47 AM
the only thing ida dbg is better than olly is than you can place comments without alt+tab'ing ;) other than that it's very inconvenient to use.
Polaris
02-04-2004, 11:33 AM
This is not a question.
I just would like to know people's opinions and experiences with the the debugger.
I have had problems running it, as it freezes quite often, and only a cold boot can solve it.
Mastering it could be both challenging and productive.

Just to start a conversation. . .

Hi there ;)

the IDA Pro debugger is exactly like IDA Pro: needs time to be mastered... However, I never expected freezing or something like that... :confused:

Also I feel that we are going in the right direction for RE tools... No more small tools to be used together, but a "suite" to deal with any situation... With IDA Pro I can analize statically my listing and use debugger to reveal only interesting sequences.... I think I'll no more use any other debugger.

Byyyyezzz,
Polaris
disavowed
02-04-2004, 01:55 PM
the only thing ida dbg is better than olly is than you can place comments without alt+tab'ing ;) other than that it's very inconvenient to use.you can place comments in ollydbg. unless you mean you want to comment your static listing, in which case ignore this post :)
peterg70
02-04-2004, 10:16 PM
And if you mean adding comments to the static code then use dual monitors.

Make life alot more fun. Anyone Softice on dual monitors. Tried once and it basically ignored the second screen So Use Ollydbg since then without any problems. (except breakpoints disappearing all the time :) )

Tried IDA and found it difficult to read mainly. Thought never gonna use it to its full potential so got rid of it..

Peterg70
doug
02-05-2004, 12:23 AM
@peterg70
you know that when you are using softice, even if you had 10 monitors, they would all be "frozen" when the softice window pops up ? it's still 1 cpu.

(getting a little off-topic)
For long projects, a setup that I found to be efficient is a debugging machine and another one with IDA + all the other tools.

I still can't get used to ollydbg.. I always go back to softice; I find it much more powerful.. unless I was doing something wrong, I wasn't impressed very much by olly when tracing through SMC.. at some point I was just stepping over opcodes (It would refuse to 'assemble it' back)

And since 80% of protectors use smc...
naides
02-05-2004, 08:08 AM
Few months ago, when the Debugger option to IDA was announced, some people here, me included, became very excited. If this tool was going to be as powerful as the dissasembler, and it was seamlessly integrated to it, IDA would become the 'Ultimate' tool.

While this first version did not meet expectations, which were high to start with, does not mean that the idea and the tool lacks potential. I do not know if Ilfak ever reads this boards, or other RCE for that matter, but I think he could benefit from suggestions and observations about the debugger.

I concede that it may increased the chances of IDA being Warezed, but on the other hand, he could deliver an improved product to his market base.

Be kind to me.
nikolatesla20
02-05-2004, 09:39 AM
Well, softICE has its place. The only real reason to use softICe now for me (I use 2.7) is so I can set a global process breakpoint, for those nasty createprocess protectors (like armadillo). A normal debugger like Olly won't do that - it will only break on calls in its current process (which is good).

But I've used Olly for ALL my latest unpacking. It kicks butt big time. The biggest best thing about it is there are only a few ways to detect a ring3 debugger, and the debugger itself can modify these ways! With SoftICE you just have to hide it somehow. Also, with Olly you can take notes and work in a hex dump, or dump memory areas of interest on the spot, since ur computer doesn't freeze.

IDA is ok, it still doesn't always give as much information as I'd like. I mean, sure the graph of a function is nice, but I haven't found it all that helpful yet. The one thing that I've found the most useful is variable names. However, one thing I DONT like is it should be smart enough (maybe sooner or later), so I could name a variable like "mov eax, [ebx+4Ch]" into "mov eax, CountNumDays". I mean, with appropriate "code analysis" this should be possible, even if of course it requires a type of "virtual" engine to simulate so it can calculate where these offsets end up later, etc. I know it's prolly hard, but I think it sure would make things better...

-nt20
doug
02-05-2004, 11:43 AM
well you can do some fancy stuff if you define structures and enums approprietly

your statement would appear as:

mov eax, [ebx+CountNumDays] ; any comments defined in struct definition

I'm not sure if you can define ebx as a pointer to a structure over an entire function (to auto rename all [ebx+XYZ] arguments) yet.. but that just seems like the next logical step if it's not yet implemented.

And when your register is a 'biased pointer' to a memory location, ex:
(context: ebp is pointing to the start of the code segment, ebp+2C5h points to the string: "\\.\SICE")
lea esi, [ebp+2C5h]

you can give the instruction a 'Base Address' (using ctrl+r) of 'start' (either using its symbolic name or address) and the last instruction will look like: (adding an x-ref also)
lea esi, (meltICE_strings - start)[ebp] ; "\\\\.\\SICE"
nikolatesla20
02-05-2004, 12:08 PM
Ah, thanks doug - the struct define. Ok I will try that.

-nt20
dELTA
02-05-2004, 02:52 PM
Also, it does analyze and define/name all such stack-based variables without having to define structs, enums or anything, practically always for me anyway?! It does indeed have stack analysis, so it even handles esp-based stack variables!
nikolatesla20
02-05-2004, 09:41 PM
Yes, I know it does stack variables just fine, but it doesn't do other register based variables. For example, if you are looking at code that is from a C++ class, the object pointer gets passed in on a register, like ebx. So all the member variables (and possibly some functions) are [ebx+XXX]. Currently if I double click on the XXX you can't do anything with it. It would be nice if you could at least label it.

ESP variables such as [esp+XXX] do get a variable "name", IDA says like "var_0", "var_4", etc. But register based variables do not.

-nt20


please help me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > please help me
PDA

View Full Version : please help me

killer12345
02-04-2004, 02:40 PM
i am new to cracking and iwant to crack this program
i am trying to crack it for the last 3 days but icound not get nothig good
the pro check 402fea is auterised user and in 403083 he was checking
is binoy and another check again and the auther says that the file was
not crackable so please help me crack that file file included
sorry for my bad english
JMI
02-04-2004, 02:44 PM
killer12345:

You obviously did not read the FAQ listed in big letters at the top of the Forums. This is NOT a crack forum and cracking software for you is NOT what we do here. What we do is try to help people learn about reverse engineering software on their own, with a little help from this board. Please read the FAQ now and DO NOT post your program here or specifically identify a program you want someone to crack.

Regards,
killer12345
02-04-2004, 02:49 PM
soory sir iam not an englsih
JMI
02-04-2004, 03:06 PM
Yes. I understand, but we still have rules that you have to follow. If you have friends who can understand English better, ask them to help you understand.

Regards,


I need to find compression type (Data files)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > I need to find compression type (Data files)
PDA

View Full Version : I need to find compression type (Data files)

Aquatic
02-04-2004, 03:08 PM
I have a game that I play, and I want to be able to extract and decompress the individual files within the large data files for modding purposes.

MrMouse from Xantax already helped me with the extraction part, so I can extract the individual files alright. The problem is that they are still compressed, and therefore unitelligable, and there is no way to make sense of them.

I heard that companies usually don't make their own compression for their data files, but instead they use some pre-made open src compressors. If I can just identify the method being used, then I could maybe decompress the files.
sgdt
02-04-2004, 05:39 PM
I have a game that I play, and I want to be able to extract and decompress the individual files within the large data files for modding purposes.

You will need to, if you modify, recompress. If they are using a propriatary compression, this may be very difficult.

Assuming it's propriatary, you can get the games decompression routines quite easily. Load up Intel's VTune or AMD CodeAnalyst, run the game while sampling (stop sampling soon after decompression), and voila, the interesting parts will be pointed out.

Load up IDA and look for places calling those locations and you'll have the outer loop of their decompressor.

Then, load up OllyDbg, and after decompression set up a patch to dump files.

If you believe it's a "open src compressor" (say, GNU zip or compress), you will probably see a GNU style copyright notice very close to the module they linked in. Same is usally true for 3rd party compressors. It might be a good idea to look thru the executable.
Aquatic
02-04-2004, 08:14 PM
I know that the game reads from these data files at the character customization screen. Then when you save your charater it outputs a file with the same compression. So all the decompression and compression happens in the character creation part of the program. I saw this with Filemon.

For the part where it creates the character file, I set a Bp on Writefile, and then I checked the ASCII of the lpBuffer address, and it showed exactly what was written to the file, I confirmed this by opening the file in Winhex. The problem was that the ASCII in the lpBuffer had already been compressed.

To bad there isn't a function I can bp on that has a parameter like "Data to be compressed", or "Data to be uncompressed".

Anyway, that's as close as I got.
dELTA
02-04-2004, 10:28 PM
Disassemble the program and check out the code near the location where the WriteFile function is called from. Trace the buffer backwards from there in the disassembly, and it is very likely that you find your compression function quite quickly. If you don't find the decompression function at the same time (they are quite likely to be placed very near each other in the asm code) do the same with the ReadFile function for the equivalent read operation, and you should be able to find it too (but you will of course have to trace the buffer forwards after the ReadFile operation instead).
sgdt
02-04-2004, 11:16 PM
You can also use hardware read breakpoints on the data read to assist, if the code is long winded. Most likely, you *will* find routines that take a couple parameters like "data to be compressed" and "buffer to put compressed data to be written" (and vice versa for the read routine). Despite all the marketing hype, there's seldom much magic to a programs innards.
Aimless
02-04-2004, 11:19 PM
Of course, you may want to rename the compressed files as .ZIP and try to decompress them with Winzip before trying anything else, as most of the compressed files (hello Quake, Quake II, Quake III, Unreal Tournamet..et al) are simply packed with the zip alogrithm.

Have Phun
Aquatic
02-04-2004, 11:46 PM
Of course, you may want to rename the compressed files as .ZIP and try to decompress them with Winzip before trying anything else, as most of the compressed files (hello Quake, Quake II, Quake III, Unreal Tournamet..et al) are simply packed with the zip alogrithm.

Have Phun

Do I need Winzip specifically? Or can I use Winrar?

It would be bizarre if this actually worked, but I am skeptical.

Note: *edit* it appears some files have diff characters.
Aimless
02-05-2004, 02:25 AM
Basically, any util that uncompresses .zip files.

Have Phun
Aimless
02-05-2004, 02:52 AM
Just what is this game, btw?

Have Phun,
Aquatic
02-06-2004, 07:23 PM
How do I trace the buffer forward/backward?

I'm using Olly.

Also, how will I know where the decompression code starts and finnishes?

I will maybe post some of the code.
dELTA
02-07-2004, 08:17 AM
Debuggers aren't nearly as good as disassemblers for analyzing code, use the right tool for the right task. Disassemble it in IDA, and then you can view where the value that is pushed as a buffer parameter for the read/write calls come from, and where it goes afterwards. If that same buffer is pushed as a parameter to another function, there is a high probability that this function compresses/decompresses it.
Aquatic
07-03-2004, 03:01 PM
I want to follow up on this cause I still haven't done it.

Are you saying to use a chart?

If I do find the decompression/compression code, then how can compile it?

I was thinking of a small Radasm app that takes a compresed file and outputs it for you in a decompressed state, and can then recompress it. But the routines that I dump will be raw ASM, so I don't know if it will compile in MASM.
Aquatic
07-03-2004, 04:56 PM
When I BP on WriteFile in Olly it goes to some address starting with '77'. IDA doesn't have addresses that high.

So how will the code even be in IDA?

I can attatch the process with Olly, but it crashes in IDAs debugger.
Aquatic
07-04-2004, 05:05 PM
Sorry that means I was in kernel32.dll

Anyway, I have had some success. I managed to go back through the code all the way to the point where clicking the 'save button' no longer triggers a breakpoint on the code.

So should I start at the line where the first breakpoint is triggered up to the call to Writefile? Somewhere in there should be the compression code.

I did see a lot of code that looked weird, and so it is likely that is the compression routine. The compression may span over several routines, I had to go back through about 7 or so till I got to the first line that is triggered by the saving.

I also noticed that over time the address of the buffer will randomly change, so I have to BP on Writefile again to get the new addy.

I will post the code from the first line that breaks up to the writefile. Maybe you guys can help me identify the code that I need to dump.
shadz
07-05-2004, 05:41 AM
If its a commercial compression algo chances are there is going to be a signature stream at the start of the file, so looking at the first 50h or so bytes of the compressed file and googling for any suspect textual data could quickly lead you in the right direction.

No need to pull out the heavy duty toolz until you've done your background work...

Just my 2c worth

-Shadz
Aquatic
07-05-2004, 06:22 PM
^ no google results

Do you guys think that my logic is sound?

From the writefile I go back in the code to the first line that reacts to the clicking of the 'save' button. Because clicking the save button must initialize the process of getting the data ready to be written. right?

Seems logical.

I will look for similar code with 'Openfile'. (the reverse)

I can't seem to get IDA's flow-chart to show a routine and then make an arrow to an xref. It seems to only show a chart of code within a single routine. sure it has the xrefs charts, but those don't show the code.
doug
07-05-2004, 09:07 PM
BOOL WriteFile(
HANDLE hFile,
LPCVOID lpBuffer,
DWORD nNumberOfBytesToWrite,
LPDWORD lpNumberOfBytesWritten,
LPOVERLAPPED lpOverlapped
);

Your first thought should be: where does this lpBuffer get modified.
Check the Cross-references to lpBuffer.

Leave the flow-chart bulllshit alone, and start hunting down every reference to that buffer using a disassembler.

Furthermore, is this buffer within the .data section of the game? Probably not. Then it must have been allocated "somehow". Is lpBuffer entirely on the stack? Is it on the stack, but pointing to an allocated memory slot ? was it allocated using VirtualAlloc/malloc/GlobalAlloc?

---
I didn't follow this thread from the beginning, but if you're interested in unpacking data files.. I would not look for file writing, but file reading. Just watch it unpack its own data, it's more than likely the same compression/decompression algorithm.
Aquatic
07-05-2004, 09:35 PM
well it works like this.

Big Data file(resource)--------->EXE---------->small data file(your character)

The data in the big data file is compressed in the same way as the data in the small data file.

The EXE chooses the compressed data that it needs from the big data file and then outputs it to the small data file (dependeing on how you tweak your character).

I'm worried that the EXE doesn't even need to decompress the data, it just grabs from the big data file, then prepares an output for the small data file to be written. Maybe it just knows which offsets to grab from.
doug
07-06-2004, 07:42 AM
At some point, if it wants to display it to you, it's going to have to decompress it.

About your character file, I doubt it's data copied from a bigger data file, that would be a big waste. It would make more sense if your character file was just references (offsets as you mentionned) into the big data file. That doesn't change the fact that it could be compressed, but if what you want is to extract resource, I'd look elsewhere.

Look for what happens after a new handle has been opened to this big data file.
Aquatic
07-06-2004, 12:47 PM
At some point, if it wants to display it to you, it's going to have to decompress it.

Well it doesn't display it to you 'as such'. You are presented with a point&click/dag$drop GUI interface where you drag things onto your character or tick specific boxes to give them attributes...etc. Each time I edit a feature for my character like this, Filemon shows a READ from the big data file, and then I watch what is being read at the Readfile buffer in Olly.

Do you think that all the compression/decompression functions could all be in one of the game's Dlls? If so, then I could just use this Dll in my own app.

I will try your advice though.
shadz
07-07-2004, 02:45 PM
If the datafile is large, there will most likely be a single call to CreateFileA() to open the file (handle being stashed away somewhere) followed by an initial ReadFile() which may validate headers and stuff before going into some kind of read/write mode as items get read out or written back.

The header is a good starting point so you may want to bpx on ReadFile and verify what gets read to be whats known to be at the datafile in question. You can then xref this address to your disassembly and start looking for associated code to parse the header.

Alternativelly, to avoid the overheads of constant seeks when accessing random items within the datafile, the file (or parts of it) could have been mapped using MapViewOfFile(), effectively mapping the file to an address range that can be traversed like normal memory.

Again, you would want to catch where the initial file header is acquired and parsed, with the decompression routines most likely near by.

As for all this being in a dll - good probability. You should be able to verify this by traversing the call-stack after you have located a ReadFile operation with the data in question and seeing if the call originated from a dll or the main binary.

-Shadz


Softice 3.1 and Breakpoint Options
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice 3.1 and Breakpoint Options
PDA

View Full Version : Softice 3.1 and Breakpoint Options

JMI
02-04-2004, 03:12 PM
Thanks to Volodya who posted this in the exetools forum and a reminder why it is best to "RTFM." For all of you who have been unsatisfied with the operation ov breakpoints in DS v3.0, read the following from the "readme" for v3.1:

"Operating behavior of breakpoints in shared ring 3 modules. In versions of SoftICE prior to 3.0, breakpoints set in shared ring3 modules would hit according to the description as defined in the Using SoftICE book, Chapter 7, "Understanding Breakpoint Contexts." In 3.0, we changed this so that breakpoints would only hit within the context in which the breakpoints were set. For Version 3.1, we have now added a SoftICE environment variable to toggle the behavior of shared ring3 breakpoints. By default, breakpoints only trigger in the context in which they were set. To change to the pre-3.0 behavior, from the SoftICE command line, issue the command set BreakInSharedMods on. Note that all breakpoints will have to be cleared with a bc * and then reset after changing this value. For shared ring 3 module breakpoints, it is possible for your application (or another application that is sharing the module) to end up crashing. This is due to copies of the physical pages that the code pages reside on being present and SoftICE not tracking these copies. Any such ring 3's left around in memory will cause crashes. There is currently no easy workaround. One possible solution would be to issue the set i3here on command to allow for user mode int3's to trigger SoftICE, and then modify the byte in memory, replacing it with the original code byte."

Thanks again Volodya.

Regards,
volodya
02-04-2004, 03:41 PM
No, my dear JMI, you don't thank me. You thank NuMega :cool:
JMI
02-04-2004, 03:52 PM
I thank you for bringing it to our attention so soon. I thank numega for implimenting the option. :cool:

Regards,
Chester
02-10-2004, 05:56 AM
For me ds31 softice doesn't catch dll breakpoint's.
If i load an exe file, exe loads dll, i set breakpoint in dll, restart exe,
-> bang reboot

Anyone noticed too ? A BUG maybe ?
On AMD Barton 512 MB RAM

EDIT:
My Fault ;) Wrong patched NTICE sorry
dELTA
02-10-2004, 08:15 AM
Anti-deBUG maybe?
JMI
02-10-2004, 01:11 PM
"Default" dear Brutus, lies not in our stars, but in ourselves. :cool:

Regards,
evaluator
02-10-2004, 01:35 PM
try to research place, from where system calls DLL's EIP and put here BP
dELTA
02-10-2004, 05:49 PM
He already solved the problem, see his edit above. :)


Softice on notebook crashes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice on notebook crashes
PDA

View Full Version : Softice on notebook crashes

xoder
02-04-2004, 04:50 PM
hello,

some days ago i ran into some trouble with installing softice on my notebook(os is win2k sp4). i got a release of driverstudio 2.7(softice and some other tools) and installed it. it worked pretty fine till i came to the reboot. when i restart my notebook shortly after i get asked to press f8 for other startup options i get a bluescreen and my system is halted. i couldnt get my system back running so i installed a new, clean win2k and tried reinstalling driverstudio(this time only softice no other tools) with the same result, bluescreen. i decided to NOT try it again, instead i used a copy of softice (v4.05) i had laying on my disk and it worked nice. but now there another thing that worries me. when i break and start working in softice and leave it again, my temerature sensor for cpu raises up to 70+ degrees. does anyone know
1. why driverstudio crashes with a bluescreen
2. why softice heats up the cpu so much

regards xoder
sgdt
02-04-2004, 05:17 PM
DriverStudior 2.7 installed on this laptop without problem. What did the blue screen say?

Regarding tempature, do you have a "Speed Step" mobile laptop? If so, SI is probably not lowering the speed the CPU is running at.

Another thought... Some of the laptops around here have tempature controlled fans (i.e. does your fan suddenly make noise for a little bit and then go back to quite mode?). If you have one of these, try pressing "control-D" when the fan comes on and see if the fan ever turns off until you press "control-D" again to exit SI window. It might be the fan is software controlled (but I would hope not!!!).
naides
02-04-2004, 06:32 PM
hello,

1. why driverstudio crashes with a bluescreen
2. why softice heats up the cpu so much

regards xoder

1. why driverstudio crashes with a bluescreen: You may want to search in the board the troubles that Sice have with certain Graphic card Drivers and some times mouse drivers. In my case, I have Sice DS 2.7 installled on a Laptop, but I cannot use the touch pad, because Sice goes crazy. That is one good place to start. Does the computer ask the question about Loading Sice display driver and then SoftIce while Win2K is booting? What happens if You say no? does Win2K boot OK?

2. It happens to me also. When the CPU is tied with Sice, all the routines that deal with the cooling system and the speed control will not run, as Sice traps most of the interrupts. I see no solution to this problem, it is the nature of the beast. Your CPU life may be shortened as a consequence, but look at the bright side: You will have to buy a new and more powerful laptop sooner. :D
xoder
02-05-2004, 06:00 AM
sorry but i dont remember the message of the bluescreen anymore, but i think it was something with a kernel module.
for the fan problem, i have something like a workaround. i found to software to control my fans, so before switching to sice i turn them on with full speed, so temperature only goes up to ~60 degrees.

naides: if you gonna send me the money for a new powerfull notebook id highly appreciate it ;)

regards xoder


unknown cd protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > unknown cd protection
PDA

View Full Version : unknown cd protection

krkr
02-05-2004, 10:28 AM
ok sorry guys will try
doug
02-05-2004, 11:26 AM
i found nothing about how to crack it

then why not try it yourself?
Do you just want a cr*ck or do you want to learn something?

From what you posted, your investigation stopped at locating a .exe and a .slp; you want to call yourself a reverser?

the FAQ is there: http://www.woodmann.net/fravia/rce-faq.htm
esther
02-05-2004, 11:45 AM
>you want to call yourself a reverser?

You should give him more help rather than just flaming him.TRY PEID
PLEASE!!!! That's what written in the FAQ
JMI
02-05-2004, 01:44 PM
Now isn't that the "pot" calling the "kettle" black? esther, you are famous, or infamous for being impatient with the newbies. :rolleyes:

Regards,
evlncrn8
02-05-2004, 02:24 PM
i'd agree, he aint done any work reversing it,he doesnt deserve the answers handed to him on a silver platter

(why is it i have a feeling that statement is gonna bite me in the ass some day) heh
JMI
02-05-2004, 02:42 PM
No one needs to, nor is anyone here suggesting that an answer be handed to krkr. It appars that he may not have read the FAQ or done much in the way of attempt to help himself, or, at the very least, has not stated much about what he has done to help himself.

He did state, however, that he has found nothing about how to crack it, which at least suggests that he did attempt a search. It is also true that there is very little information out there on reversing the softlock system, although I did discover some older articles which may, or may not still be relevant. He didn't ask anyone to crack something for him, he asked only for confirmation whether .slp was actually softlock and if anyone had some information on the protection, because his own search had not revealed any.

Regards,
hobferret
02-05-2004, 03:19 PM
Try Krobars site if it still exists, I seem to remember something about it on there a couple of years ago :rolleyes:

/hobferret
JMI
02-05-2004, 03:50 PM
knock, knock... Yo hobferret, Do you, by any chance, mean the very same "Krobar" whose "Collection" is linked at the bottom of these Forums????? :D
OK. I realize you would have to have actually scrolled down a bit to see it. Tease, tease. :cool: As the saying goes, "good thing it wasn't a snake." ;)

Regards,
hobferret
02-05-2004, 04:04 PM
knock, knock... Yo hobferret, Do you, by any chance, mean the very same "Krobar" whose "Collection" is linked at the bottom of these Forums????? :D
OK. I realize you would have to have actually scrolled down a bit to see it. Tease, tease. :cool: As the saying goes, "good thing it wasn't a snake." ;)

Regards,

Who's there???

Yea JMI never been down that far ;)

Last remaining brain cell must have died :D

/hobferret
JMI
02-05-2004, 04:20 PM
Happened to me many times. Don't you just hate it when that last cell dies like that.? :D

Regards,
hobferret
02-05-2004, 04:39 PM
¡OK JMI el punto bueno quizá mi español es entonces mejor mi inglés, sólo últimamente yo no puedo ver la madera para los árboles! :D
JMI
02-05-2004, 05:25 PM
I guess that's why they call them the "Dark Codewoods." :D

Regards,
esther
02-05-2004, 10:31 PM
JMI:
>Now isn't that the "pot" calling the "kettle" black? esther, you are famous, >or infamous for being impatient with the newbies. :rolleyes:

I'm "impatient" when someone tells newbies below

doug:
you want to call yourself a reverser.

This is a newbies forum not advanced section....


New plugin for OllyDbg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New plugin for OllyDbg
PDA

View Full Version : New plugin for OllyDbg

Aster!x
02-05-2004, 02:09 PM
This plugin allows to hide debugger from IsDebuggerPresent API
function.
dELTA
02-05-2004, 02:59 PM
Cool, nice work! :cool:
Aster!x
02-05-2004, 03:52 PM
Cool, nice work! :cool:

Thanks! :)
Js
02-05-2004, 04:03 PM
Hi Aster!x,
Always happy to see new tot. Not much documentation, out of curiosity, how does this compare/improve on the already available Isdebuggerpresent plugin?
regards
Kayaker
02-05-2004, 04:20 PM
Hi Aster!x,

Kudos on the plugin. If you don't mind a couple of comments, the nicest thing you could do is teach people how to create their own Olly plugins by including the source. I fully encourage all forms of source on this board as it's the best kind of information to pass along.

I mention this specifically because, not to take away any credit at all from what you have done, but because SV also created an IsDebuggerPresent plugin and included full ASM source. I haven't actually tested either plugin, but comparing the two dlls it seems you have done it slightly different, using ContinueEventDebugHook and WaitForDebugEventHook and a different combination of _ODBG exports. It might be instructive if you included your source and people who are interested could compare the different approaches.

This is just a suggestion, and an encouragement for further plugins and open source, from which we all benefit.

Heh, I see Js (long time no Asp-talk ;-) had the same idea.

Cheers,
Kayaker
Aster!x
02-05-2004, 04:39 PM
Hi Js!
My english not so good for give more full description :(, but you may try and choose for itself best. ;)
Aster!x
02-05-2004, 10:59 PM
Hi Kayaker!

I'll think.
Possible little later full sorces will be available on _http://www.wasm.ru/
and accordingly will here appear link. :)
Aster!x
02-06-2004, 07:22 PM
Code was corrected.
The size of the file became else less.
doug
02-06-2004, 09:11 PM
if you need help on the translation part, let us know..

there's a lot of valuable content on wasm.ru that just doesn't get to be known by the rest of the world.

The other day I was searching for undocumented windows features and out of 6 google searches, wasm.ru stuff was there 5 times..
Aster!x
09-09-2004, 08:07 PM
New version of plugin
JMI
09-09-2004, 10:33 PM
Thanks for the update. :yay:

Regards,
Aster!x
12-03-2004, 05:25 PM
Hide Debugger 1.2.2 has been released

more options added
pLayAr
12-04-2004, 02:53 AM
good work :) & thanks


How to find out, what the call does ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to find out, what the call does ?
PDA

View Full Version : How to find out, what the call does ?

van_Hauser
02-05-2004, 07:11 PM
I have read some tutorials about reverse engeniering.
Most of them are easy to understand and the programs
were easy too.

Now in "real" it's not so easy anymore :-(

I tried "bpx getwindowtexta" in SofIce which works well.
After jumping out with F11 I see this code:

LEA EAX, [EBP-58] ;d eax = EC 5E D3 77 00 00 00 00 - ...
PUSH 1D
PUSH EAX
PUSH 0000041D
PUSH DWORD PTR [EBX+000001C4]
CALL ESI ;the first bpx getwindowtexta was for the name,
;now is this the call to get the number from the dialog ?
PUSH EAX
CALL EDI ;call and do something with the window registry ?
LEA ECX,[EBP-18]
CALL 00DC6E30 ;jesus another call i dont understand
AND DWORD PTR[ESP-04],00
PUSH 80000001 ;STATUS_GUARD_PAGE_VIOLATION
PUSH 00DDDAD0 ; yeah keep pushing stuff on the stack in dont understand
LEA ECX,[EBP-18]
CALL 00DC6E65
TEST EAX,EAX
JNZ 00DC78C3 ; NO JUMP
...

I have read the nice tutorial about "Basic Key Generation File Routines"
but cant find similar code :-(

I can dive into the calls with F8 but the routines there wont help me
and there are many other calls.

How can I find out what all the calls do and where to start
understandig what the program does ?
sgdt
02-05-2004, 09:40 PM
Are you sure it's
PUSH 80000001 ;STATUS_GUARD_PAGE_VIOLATION

and not
PUSH 80000001 ;HKEY_CURRENT_USER

It would make a lot more sense...
naides
02-05-2004, 10:48 PM
I have read some tutorials about reverse engeniering.
Most of them are easy to understand and the programs
were easy too.

Now in "real" it's not so easy anymore :-(

Welcome to the true World of RCE!

I tried "bpx getwindowtexta" in SofIce which works well.
After jumping out with F11 I see this code:

You need to scroll UP in the code, before the GetWindowTextA API is called.
The Second to last pushed paramenter before the call should contain the address of the buffer where whatever was gotten_form_the_window_text_a is stored. You should keep an eye on that.

LEA EAX, [EBP-58] ;d eax = EC 5E D3 77 00 00 00 00 - ...

Does EAX hold a pointer to some other value? check also d @EAX

PUSH 1D
PUSH EAX
PUSH 0000041D
PUSH DWORD PTR [EBX+000001C4]
CALL ESI ;the first bpx getwindowtexta was for the name,
;now is this the call to get the number from the dialog ?

Now, what API or routine is pointed by ESI? you may find out by stepping into it with F8 or by scrolling up in the code and find when the value of ESI was loaded. I doubt this is a call for GetWindowTextA, because 4 pramenters get pushed to the stack and they do not look like teh typical GetWindowTextA parameters. Get and API reference and study the assembly form of API calling

PUSH EAX
CALL EDI ;call and do something with the window registry ?
Hard to tell,You got to know what EDI is pointing to

LEA ECX,[EBP-18]
CALL 00DC6E30 ;jesus another call i dont understand

Check what is in EBP-18 by doing d EBP-18 AND d @[ebp-18]
in this case, the parameter may have been passed to the call in a register, ECX, and something is done with it.

AND DWORD PTR[ESP-04],00
PUSH 80000001 ;STATUS_GUARD_PAGE_VIOLATION
PUSH 00DDDAD0 ; yeah keep pushing stuff on the stack in dont understand
Looks like a magic number or an address near by, check it out

LEA ECX,[EBP-18]

EBP -18 again passed on ECX
CALL 00DC6E65

Now this call looks intersting. Calls to a local routine and returns a result in EAX
The Next constellation of instructions:
TEST EAX,EAX
JNZ 00DC78C3 ; NO JUMP

Is typical of a decision point, good cracker bad cracker, go or not go, and deserves careful consideration
...

I have read the nice tutorial about "Basic Key Generation File Routines"
but cant find similar code :-(

Forget about finding similar code in tutorials. Learn assembly, learn the logic. Even small changes in high level code i.e. C++, or compilation paramenters can produce drastic changes in the assembly code.

I can dive into the calls with F8 but the routines there wont help me
and there are many other calls.

How can I find out what all the calls do and where to start
understandig what the program does ?

The secret is knowing which one to dive in with F8. given your code Snippet, I would go for: CALL 00DC6E65
Aimless
02-06-2004, 02:34 AM
Hello,

Welcome to the cracking world. Simply put, there are always 2 aspects to cracking. They are:

1. Searching where in the world in the program the protections are
2. Breaking the protections

Most tutorials are aimed at the second option. Very few tutorials teach you about the first option. At most, it is generally left to the user to search where in that damned file the protection is located. To make matters worse, protections can be located at more than one locations. In fact, some programs are protections themselves entirely, which run the good program only if you bypass them. And what's worst is, these protections are masked using checksums, CRC, packing, anti-debug tricks, anti-monitoring tricks, digital certificates, private and public keys and anything you can think of. You will have to start at the bottom of this heap by cracking programs that have none of these.

Now, if I am not mistaken, the question you have asked is not really about point 2, but about point 1. I am afraid there is no straight answer. There is no generic way of searching the locations of the protections. Or which files for that matter, have the protections. However a good approach in this circumstances is the top down approach. You approach the application as a whole and go down into details as they appear clearly. Here are some steps you can do:

1. Generally, run filemon and regmon (www.sysinternals.com) to figure out which files are involved in the protection. Beware, there are programs that completely bypass the monitoring or change names when monitored.
2. A good idea is also to use a profiler to see the calls that are made in a program during a protection check. This helps you pinpoint actual calls made as opposed to ALL calls seen in a disassembly or softice tracing.
3. Then, you can concentrate on the calls obtained above, knowing that these are indeed the ones associated with protection. You can easily discount the API calls from these to get an even lesser number of calls to work with.
4. In which call is the protection located? Don't know. Its really difficult to tell as protections can be spread across different calls. That is why its important to crack programs initally that are simple and located in one call. Such as Winzip v5 or Winzip v6, Mirc V5 and so on. Try your searching skills on the same. Don't worry, you'll learn how to search. Even the best of us cannot, in a single sitting, sometimes pinpoint the protection. We spend most of our times, sometimes, in just trying to figure out where the heck is that protection scheme and where it snaps. So you are not different. On the contrary, I'd say you are in good company.

So try cracking old programs first. Trying to crack the latest version of FlexLM or Sentinel is not the way to proceed. Try these for flavour:

Phase I: Simple serial number cracks (forget about keygens)
Phase II: Time protected
Phase III: Serial or time protected with simple anti-debugger tricks
Phase IV: Serial or time protected with simple packing (say, upx or pe compress etc)
Phase V: Serial or time protected with both simple anti-debug and simple packing.
Phase VI: Serial or time protected with complicated anti-debugging
Phase VII: Serial or time protected with complicate packing
Phase VIII: Serial or time protected with complicated packing and anti-debugging and anti-dumping and anti-monitoring
Phase IX: Heavy duty protections like Safe Disc/ Securom etc
Phase X: Biggies like Flexlm/Alladin etc.

Phew, quite a bit. And remember, in each of the phases, the idea is to do both point 1 and point 2. You may find some phases are easier in point 1 and others are easier in point 2.

No one said cracking was easy. ;) But do it for its plain joy and you really wont' mind.

Have Phun
van_Hauser
02-06-2004, 04:58 AM
Hello !

Thanks for the answers !

Naides, thank you for the work you invested in your answer for a
newbie in assembler !

Well, I thought "You can code in C and C++ and had
"Introduction to computer architecture" in University
so this assembler stuff is no big deal" - WRONG DUDE :p
Now at least I know where to continue the learning.

@sgdt
Are you sure it's
PUSH 80000001 ;STATUS_GUARD_PAGE_VIOLATION
and not
PUSH 80000001 ;HKEY_CURRENT_USER
It would make a lot more sense...
In Softice the line
PUSH 80000001 ;STATUS_GUARD_PAGE_VIOLATION
is displayed as I wrote it here. The command plus the comment
behind it.

I can't tell you more as a newbie. You could be right about the HKEY_..
because values are read and written to registry, thats what I
was able find out with "regmon"

@Aimless: "But do it for its plain joy and you really wont' mind."
Well, I am sorry to tell you that I am a stupid perfectionist. By now
I just hate this plugin DLL nagging me and I wanna fill it in - bash it,beat in
,bite it. ;)

Hope to see you all again the time I made some progress.
nikolatesla20
02-06-2004, 08:37 AM
heh...

Welcome to the board !

I noticed you mentioned plug-in dll,..any chance I can get some more details? Sounds juicy :) I've done a lot of plug-in dlls over my learning time, I got one for MSVC++, I got a COM dll for the Task Manager, and I've done a VST instrument DLL.

DLL's are usually "easier". They usually will have less anti-debug code, especially anything too advanced, since they aren't actual processes themselves.

I agree with naides, you might want to try and fiddle with those JZ instructions, etc.

What does the plug-in "do" when it's not registered? Bring up a nag or have a message in the about dialog, or what?

I'm a little biased in this opinion, but I don't know if trying to keygen is a good way to start reversing...at least for me , it's too hard at first because you have to figure out how all the code "works" together. Whereas with cracking all you have to do is find the weak link in the chain of the protection. You only have to know which jump to fix (and sometimes a couple other small routines).

-nt20
van_Hauser
02-09-2004, 07:54 AM
Thanks nikolatesla20 - I PM'ed you about it.


English please?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > English please?
PDA

View Full Version : English please?

esther
02-05-2004, 11:02 PM
Hi there,

This is a language translation site hope it helps those aren't native speakers

hxxp://translation.langenberg.com/

Regards
Kayaker
02-06-2004, 01:30 AM
Croatian - Hvala vam
Czech - Být zavázán tebe
Danish - Tak for lån
English - Thank you
Filipino - pasalamatan ka
French - Je vous remercie
German - Danke
Greek - ευχαριστώ
Hungarian - Köszönöm
Icelandic - Þakka þú
Italian - Grazie
Japanese - メルシー
Norwegian - Takk skal du ha
Polish - Dziękuję
Portugeuse - Obrigada
Romanian - Mulţumesc
Russian - Благодарю
Serbian - Hvala ti
Spanish - Gracias
Swedish - Tack själv
Welsh - Ddiolch 'ch
Aimless
02-06-2004, 02:40 AM
But how do they translate the code they see in ENGLISH in IDA/SOFTICE to say, German?

;)

Have Phun
esther
02-06-2004, 09:25 PM
ты быть добро пожаловать ;)
naides
02-07-2004, 06:15 AM
Hi there,

This is a language translation site hope it helps those aren't native speakers

hxxp://translation.langenberg.com/

Regards

Translate Intel 80x86 Assembly language to KinderGarden level English. That would be impressive. . .
dELTA
02-07-2004, 08:24 AM
The Swedish translation is wrong, it says "Thank you too". :)
evaluator
02-07-2004, 10:18 AM
"& yo mom too"
esther
02-07-2004, 11:04 AM
[>Translate Intel 80x86 Assembly language to KinderGarden level English. >That would be impressive...

Looking @ your post you need a physiatrist rather than Kindergaren Teacher
LOL

>dELTA The Swedish translation is wrong, it says "Thank you too".

You need to email to the admins to the specific sites and give your suggestions rather than ranting here :D
dELTA
02-07-2004, 12:03 PM
I'll rant wherever I please thank you (too)... :D
JMI
02-07-2004, 12:25 PM
Yah. Heck, "everybody" knows it's just plain "tack." Or at least my Swedish professor, Dr. dELTA, told me so. Next weeks lesson will be "thank you very much." And, again, yes, Dr. dELTA has already taught it to me. :D

Regards,
Aquatic
02-07-2004, 03:43 PM
Why you throw language?
JMI
02-07-2004, 06:20 PM
This is "Off Topic." I don't quite understand what you mean by "throw language." Generally, we are simply trying to have a good time with a little light humor.

Regards,
Woodmann
02-07-2004, 07:47 PM
I don't quite understand what you mean by "through language.

I dont quite understand how you got "through" from "throw" :eek:

i aint no expert but i am sure i can bastidize the english langwije better then anyone.

You say potato and I say patayda, I dont eat no lobsta.
I drive a truck not a cah, your a retaahd.
Some of my favorite places:
gloucester=glosta
worcester=wosta
haverhill=hAvrill
newyork=newyawk
chicago=chicaago

We do not pronounce the letter R so, I will sometimes spell words to reflect the local dialect which I think is fuckin funny you bastid. :D

Woodmann
JMI
02-07-2004, 09:03 PM
While you and dELTA were scouring my posts to catch my spelling errors and gramatical "fou paws" I would expect you to report that in my post above the one with this (at least correctly spelled) transposition, that I had written "Dr. dELTA have already taught it to me" where it should, obviously, have said "Dr. dELTA 'already done teached' it to me. :o Dr. dELTA. of course, rushed to call it to my attention by ICQ. :eek:

I will note, only for posterity, that the last one occurred after I had already been sitting at this damn computer typing real world matters, unrelated to reverse engineering, for more than six hours on this beautiful "Saterday." My mind, what little there is left of it, was, and is still focused on processing that material, which has been my slavemaster for every single day of the last four weeks, rather than on what I was actually typing here. :p

And if you find those humorous, you should see some of the ones that I do catch while actually writing them. :rolleyes:

Regards, :D


PUPE now in english
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PUPE now in english
PDA

View Full Version : PUPE now in english

swoop
02-06-2004, 08:48 AM
Hi,

attached you will find the english version of PUPE incl. source.
I don't know if someone has done this before but I haven't found anything on the net.
So no need to learn spanish anymore :D
swoop
02-06-2004, 08:56 AM
sorry seems i had problems with attachments...
Js
02-06-2004, 06:30 PM
hiya,
your efforts appreciated.
cheers
mambox
02-13-2004, 02:11 PM
work appreciated!!

thanks!


problem with bmsg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > problem with bmsg
PDA

View Full Version : problem with bmsg

xoder
02-06-2004, 12:11 PM
hi,

i have a little problem with bmsg breakpoints. the program im working on is loaded so in softice i typed "proc" to get a list of the programs currently running. i noted the programs name and did "hwnd pgrogname". as a result i get a long list of window handles, classes etc. the button im looking for has the handle 20208, i also confirmed this with spy++ which gave me the same window handle for this button. now i wanna set a breakpoint on this button when its being pressed so i use: bmsg 20208 WM_COMMAND
but softice keeps telling me that 20208 is an "Invalid window Handle"
can someone please tell me what im doing wrong?

regards xoder
evlncrn8
02-06-2004, 12:15 PM
same problem here, its like the handles sice reports arent valid for the window, so i just get the window proc,and set a breakpoint there.. does the job
xoder
02-06-2004, 12:21 PM
same problem here, its like the handles sice reports arent valid for the window, so i just get the window proc,and set a breakpoint there.. does the job

thanks for your advice with the window proc breakpoint, but im still wondering why the handle softice tells me isnt valid. what kind of breakpoint do you use on the window-proc? bpx ?
esther
02-06-2004, 12:30 PM
did you try wm_lbuttonup or wm_rbuttonup or without these commands?

bmsg 1234
xoder
02-06-2004, 12:45 PM
i typed it exactly like i did above: "bmsg 20208 WM_COMMAND" but since softice said invalid window handle i think it has something to to with the actual handle (20208) but i have no clue whats wrong, since softice gave me the handle with the hwnd command.
dELTA
02-06-2004, 02:34 PM
Have you tried switching to the context of the target process before attempting to set the breakpoint? I don't know if that will make any difference, but it's sure worth a try...
naides
02-06-2004, 02:50 PM
Have you tried switching to the context of the target process before attempting to set the breakpoint? I don't know if that will make any difference, but it's sure worth a try...

I have had the same problem: 'invalid handle'.

It happens in Win2K and XP, along with DS 2.7. I remotely remember that for the brief time I had DS 3.0 it went back to working.

BMSG IS context sensitive, but even when you are in context, refuses to work sometimes. Perhaps the concept of context is more complex when dealing with Msgs.
xoder
02-06-2004, 03:02 PM
im using DS 3.1 on win2k. i have set the BreakInSharedMods=on to have breakpoints in pre 3.x mode(even i dont know if it will make any difference). is there any other way to set the breakpoint in the apps context? any other suggestions how to make softice trigger when pressing a register button(delphi app)?


Unpack Files...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpack Files...
PDA

View Full Version : Unpack Files...

Dav
02-06-2004, 12:21 PM
I'm using with "ProcDump32" and "pe-scan" to Unpack files, but sometime i can't Unpack the file that i want.
I know that there are many of methods to Pack/Unpack files, and i cant find good tools to get information about the files.

If someone can help me, I will appreciate your answer.

thanks.
evaluator
02-06-2004, 12:48 PM
:-
SideSwipe
02-06-2004, 01:18 PM
Use PEid v9.1 to find out what packer is used.

SS
Dav
02-06-2004, 01:42 PM
Use PEid v9.1 to find out what packer is used.

SS

Nice tool!!!, thanks...
Is there good tool to Unpack?
dELTA
02-06-2004, 02:35 PM
Have you by any chance seen those big red letters on the main index page of this board? They actually form "words", which in turn form a "request", or should I say "requirement" for posting on this board...
evaluator
02-06-2004, 02:56 PM
I just READ THE FAQ, where PEID >>is<< mentioned..

eh..
r4g3
02-06-2004, 06:04 PM
lol maybe the font size aint big enuf ;) make it 72
Dav
02-06-2004, 08:31 PM
I'm sorry, my english is not well, and i'm new with all this.
You're right!, i broke the rules, and i promise to not do that again.

I'm a programer by VB6, and when it started boring, i found the Assembly language that made my to love her,
and this forum is really good and serious from any forum that i saw, and i think here is the right place to learn.
selecta
02-06-2004, 09:08 PM
You can try PeId to find what packer is used and have a look on http://www.protools.cjb.net/ (unpackr section) to find the unpacker.
dELTA
02-07-2004, 08:19 AM
You are very welcome to learn here Dav. The problem is just that you won't learn much from asking for ready-made unpacker tools, and that is what we object to.
evaluator
02-07-2004, 10:05 AM
Hey!

I have good idea!
Because zillion time newbies incorrectly think, that unpk-forum is about unpacking tools,
lets write in forums Title: "this is not about unpacking tools, but manual-unpacking etc.."

good?
JMI
02-07-2004, 12:21 PM
Since most of the people who come here only looking for tools, don't even read the large red letters saying they should read the FAQ and Search, why would one think they would read a statement in the title of the Forum which said it was about "manual unpacking, not unpacking tools"?

Regards,
evaluator
02-07-2004, 04:03 PM
pleaseplease
nikolatesla20
02-08-2004, 09:40 AM
JMI, I agree. However, one begins to wonder how these users found this site in the first place. Perhaps they stumbled upon a link which lead them more directly to a specific forum area. In that case they would be less likely to notice the text because it only exists on the main page. I know it's a lot of work but possibly the text should be added to every page (it's just a template isnt it?).

-nt20
esther
02-08-2004, 10:05 AM
Hmm I think I have mention this sometime ago but I'm not sure if this systems is still working.... When registered the forum it will send an email to the user for activation at the same time with the faq.They should read it before posting anything.

Regards
JMI
02-08-2004, 12:49 PM
I still believe that, no matter what we do, a certain percentage of first time posters will not pay attention to anything but their desire for instant gratification of whatever it is that they desire in the form of an immediate solution to THEIR question or THEIR desire.

Regards,
dELTA
02-08-2004, 03:33 PM
esther: Yes, people have to "agree to" the FAQ before registering, on a web form. Or maybe that was in an old version of the board, hmm, not sure... :)

nikola: I purposely left out that red text from all pages when I added it to the main index. If people won't read it on the main page they most likely won't read it on the other pages either, and then the intrusiveness of that text in the layout of the pages then makes it undesirable and not worth it I figured.
hobferret
02-08-2004, 03:36 PM
I still believe that, no matter what we do, a certain percentage of first time posters will not pay attention to anything but their desire for instant gratification of whatever it is that they desire in the form of an immediate solution to THEIR question or THEIR desire.

Regards,

Yo JMI ;)

I agree with what you say totally :)

Look at what Dav posted:- Nice tool!!!, thanks...
Is there good tool to Unpack? :confused:

I believe that most forum members would not respond to a post like that, we all have to start somewhere but "posters" should at the very least try and show something of what they have achieved in order to get a response :rolleyes:

/hobferret
D-Jester
02-11-2004, 10:48 PM
I think a lot of people are drawn hear thinking that someone will "crack" a program for them.

For them to read the FAQs even before they register, they will just assume that its a ploy to keep software companies from trying to shut the site down,
and ignore it, such agreements I have seen that come to mind:

nakedcrew.net <- You must agree to their terms before you enter the site.
cracks.am <- Terms and conditions on the homepage.
Keygen.us <- Terms and conditions on the homepage.

If anyone wold read the forum a little before posting I am sure they will see reference to someone b*tching at someone else to read the FAQ...

Peace,
Kayaker
02-12-2004, 12:26 AM
>I think a lot of people are drawn hear thinking that someone will "crack" a program for them.

No doubt. But we need to set them straight about that else this forum would be a completely crappy crack site with no attraction whatsoever to knowledgable reversers/programmers.

>For them to read the FAQs even before they register, they will just assume that its a ploy to keep software companies from trying to shut the site down,
and ignore it

Agree. Hell who DOES read faq's ? I do if I'm researching a new field/subject and they have a good faq, but if it smells like a disclaimer, no way. Maybe we shouldn't call it a FAQ, maybe there's a better word. POSTING RULES would likely be just as ignored.

It's just a simple matter of following a few common sense posting strategies. These people, whether they read the faq or not or just ignore what it says (plus we have to remember any language difficulties), are only hurting themselves. It seems to me that with a modicum of effort more they could probably get the answer they seek without being 'bitched' at.

K.
D-Jester
02-12-2004, 12:49 AM
(plus we have to remember any language difficulties.)

I agree with Kayaker, but I also think that there are enough members of this forum, that surely The FAQs could be easily translated into many languages.


Game data files cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Game data files cracking
PDA

View Full Version : Game data files cracking

highfly
02-06-2004, 03:10 PM
i need help on cracking packed data file,

The files are packed to a single file and no compression is used,i found the file table which should have the file/folder name,size and starting offset,i found the size and starting offset but the file/foldername is encrypted or ?
hexa values
file name/folder -- 1A551BF3957B3E009932C2A1149361FF :confused:
starting offset -- 00000000
size -- 00506801

thanks
JMI
02-06-2004, 03:26 PM
Did you, by any change read the FAQ and do any searching for the answer to your question. If not, go back to the main page and read the big red letters.
Have you looked at your file in a hexeditor and/or a disassembler to determine whether it is actually encrypted?

Regards,
highfly
02-06-2004, 04:01 PM
i know there is similar thread on this topic :) ,

i viewed in hex editor,i can clearly view the size and start offset info but not the file and folder name which is of 16 bytes,i can't see any pointers here which points to the exe or the memory.any idea :confused:
dELTA
02-06-2004, 07:17 PM
So did you try to trace the unpacking code then?


FLEXlm 8.4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FLEXlm 8.4
PDA

View Full Version : FLEXlm 8.4

discoboy
02-06-2004, 03:36 PM
I would like thank everybody for help even those :o messages did not make me :mad: i hope all those :rolleyes: will find their match some day.
------------------
Interesting part is nothing was changed since 7.2 and great essey
FLEXlm 7.2 cracking information written by Nolan Blender is still current.
Same tools and the same techniques.
Regards,
discoboy


Clipper 5.3 with Exospace V 2.11
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Clipper 5.3 with Exospace V 2.11
PDA

View Full Version : Clipper 5.3 with Exospace V 2.11

Pilar
02-06-2004, 04:46 PM
Hi
I have Clipper´s program convert to EXE with Exospace V 2.11 and I need the enginering reverse to obtain the programs PRG

its possible??? :cool:

Thanks
dELTA
02-06-2004, 07:17 PM
Read the FAQ...


Reduce processor power?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Reduce processor power?
PDA

View Full Version : Reduce processor power?

xoder
02-07-2004, 12:24 PM
does anyone know if there is a tool to manually reduce the power(i mean GHz) of a notebook with mobile processor? this question came to my mind when working with softice on my notebook. (if the notebook is connected to AC the processor runs with full 2.2GHz if it is on battery its just ~1Ghz) my problem with sice is that the temperature of the cpu raises very fast when i'm in softice and the notebook is connected to AC. this forces me to manually turn on the fans on full speed to keep my cpu from being toasted which is pretty annoying(noise). i discovered that when the notebook is on battery and only running on 1GHz there is almost no temperature increase when working in sice. i wonder if anyone knows a tool to reduce the GHz even the notebook is on AC.

regards xoder
dELTA
02-07-2004, 07:04 PM
There are often BIOS settings for this with those mobile processors, don't you have any?
xoder
02-08-2004, 12:29 PM
i had a short look at it yesterday but didnt find anything useful, gonna have a deeper look tonight, i hope i can find something useful.
xoder
02-08-2004, 03:44 PM
just for the case anyone is interested:

if youre using an intel mobile cpu you can throttle your cpu's performance with a tool called speedstep(developed by intel). it allows you to manually reduce your cpus performance to some given settings. i tried it for a few times an it works pretty well. problem with softice overheating the cpu is solved :)
doug
02-08-2004, 04:05 PM
I've also noticed shorter battery lifetime when using softice (just a consequence of what you mentionned earlier).. This will probably help me with that as well.

thanks.


visual softice Vs. Softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > visual softice Vs. Softice
PDA

View Full Version : visual softice Vs. Softice

boron
02-07-2004, 07:23 PM
i wanted to know if i can use visual softice on a local machine under xp pro os and if so can it work as well as the old softice.
Woodmann
02-07-2004, 08:01 PM
Howdy,

I am wondering why you ask these questions.
Do not the answers at the C****ware site satisfy you ?
boron
02-08-2004, 07:12 AM
i tried to make it work on a local machine but it dosen't seems to recognize any VSI installed on the computer.
JMI
02-08-2004, 12:53 PM
Seems you didn't take Woodmann's hint. Go to the vendor's site and read what they say about using VSI, or perhaps you could do something really desparate, like reading the manual. There is both a user's guide and a reference for VSI, and/or maybe actually try using the search button at the top of the Forums and entering "visual softice."

Here's another really big hint: VSI does not work on just a single machine, unless you have a second, virtual machine also running.

Regards,


softice problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice problem
PDA

View Full Version : softice problem

snicko
02-08-2004, 01:00 PM
hi,

when i try to set a breakpoint on getdlgitemtexta i get the error "symbol not defined". then i typed EXP in softice and looked if getdlgitemtexta was in that list. it wasn't (surprise). i did find getdlgitemtext. it is the same with getdrivetypea etc. what do i have to add so that i can use getdlgitemtexta and getdrivetypea etc??

Regards, Snicko
snicko
02-08-2004, 01:10 PM
forgot to say, iv'e got softice 4.05 and Windows ME with the loader from icedump
JMI
02-08-2004, 01:44 PM
Actually what you may have forgotten was that you may need to download the symbols for your OS from our dear friends at M$, they are free afterall, and you need to check your winice.dat file to make sure that you have removed the ";" in front of the appropriate places. Try the search button at the top of the Forums and use "winice.dat." You will also find material using "symbol not defined" as your search criteria.

For example using the search button would have lead you to this thread:

http://66.98.132.48/forum/showthread.php?t=3515&highlight=symbol

which seems to directly repeat the substance of your question and gives the answer.

And did you, by any chance Read the FAQ before posting your question?

Regards,


FlexLM 7.2i
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM 7.2i
PDA

View Full Version : FlexLM 7.2i

GinFix
02-08-2004, 01:43 PM
Hi all

I have a bit of trouble here, understanding a Target that
uses FlexLM 7.2i without any goodies like crypt_filters
checkout_filter ...

I started to examine the lmgr327b.dll in IDA and applied
a sig for 7.2i. Unfortunatly l_sg was not revealed :( I tried
to follow the path shown in Nolan's essay. Looking for
multiple calls to time() did not work. My target has calls
to time() but they're never taken. I also was unsuccessful
with a search for the compare for 12345678 demokeys
I hoped to find l_sg there. After that I tried it by
searching for the push sequence with the following call
to the decoding routine. I found 80 of them. Ok lets go
I found a few that were actually taken and one of them
seemed promising. I was able to get vendorcode+4 / +8
but job+8 / +c / +10 were zeroed :( Steeping further
and setting breakpoints at job+8 / +c / +10 ... showed
that there was some code that accessed that data but
never there was some info filled in :(
I went back to the zendec demo from Nolan, just to
verify that I'm not doing any very basic errors.

btw. after getting stuck at that point I modified my
license by dropping out the server stuff.
Now the targets seems to want 6.1 behaviour while
it would have liked 7.1 before ...

Is there another way to find l_sg ? What about the
zeros in job+8/c/10 and the missing time calls ?
Did they change anything for 7.2i ?

Greetings

GinFix
JMI
02-08-2004, 02:02 PM
GinFix:

This is your first post here and you appear to have a working knowledge of FlexLM so you are obviously no novice, even though you are new to these pages. However, we have a policy of having people search the forums before they post a question. That's why we have it in big red letters at the top of the Forums that one should Read the FAQ and Search before asking a question.

Your post gives no information as to whether or not you followed that guideline, so I ask whether you did, indeed, read the FAQ and any, or all of the 15 other threads which discuss FlexLM 7.2 before you asked your question? If not, please use the search button and use "FlexLM 7.2" and see whether part or all of your question's answer can be found in those prior discussions. If not, indicate you have reviewed them and not found what you are looking for and perhaps someone can guide you further along your way to a solution.

Regards,
GinFix
02-08-2004, 02:19 PM
JMI:

Sorry for not mentioning this :(

I looked through out the forum. Unfortunatly I did not
find a hint that could help me. There were multiple
threads about zeroed job-structs,some unanswered :)
but some of them could were solved by stepping
through the decoding routine
Maybe I missed something but I looked quite carefully :)

GinFix
JMI
02-08-2004, 02:47 PM
And that's all we ask. And indicating you have done so avoids reminders, which are directed at the wider reading pulbic in any case. Hope someone who has spent time with this challenging system is able to help you out. Since this topic really isn't for Newbies, I'm taking the liberty of moving it to the Advanced Forum where it might get more critical reading.

Regards,
GinFix
02-08-2004, 03:22 PM
Thanks JMI
GinFix
02-08-2004, 07:10 PM
A little update :) It seems that I have been wrong ...
I just took a deeper look in the daemon itself
There are the calls to time, there is also a set_attr
to user_crypt (0F) A bit of work ... :(

The logfile also reports that the license is invalid
when the server is started. I should have looked there earlier :(

It seems that the hole checking is done in the daemon
and the target is just asking the daemon ...
Is that correct ? I'm asking cause that is my first try
to generate a server-base license

One thing is still confusing me. Commenting out the
server and daemon lines seems to change the targets
behaviour. No hard set_attr stuff. Maybe that's the easier
way to extract the key. One question left in that case
Why would a vendor allow that "backdoor" ?
server-licenses with user-crypt, nodelocked without
server no user-crypt ???

Any hints ... ?

Thanks

GinFix
redsk_y
02-13-2004, 05:30 AM
"It seems that the hole checking is done in the daemon
and the target is just asking the daemon ..."

Hi GinFix,

"It seems that the hole checking is done in the daemon
and the target is just asking the daemon ..."

... sometimes the target ask only the daemon for the license.

Even if you have extracted the right vendor struct (keys and encryption seeds) you need also to reverse the _user_crypt_filter if you want to make
the lmcrypt for your app. Nolan Blender has written an essay on this topic
that can be a good starting point. Infact, after reading this essay, Flexlm has changed the way in which they store the values to be xored with inchar.
Keep in mind that the _user_crypt_filter is only a way to obfuscate the right
license to make impossible to sniff it from memory.

"One thing is still confusing me. ..."

It sounds strange...check if the target and the daemon belong to the same
version.

regards,

rs


Possible to load NTICE manual ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Possible to load NTICE manual ?
PDA

View Full Version : Possible to load NTICE manual ?

Chester
02-08-2004, 03:23 PM
Is it possible to load NTICE manual ?
Under W9X it was possible to have only Core files
(winice.exe,siwvid.386,winice.dat)
in one Folder and load winice.exe dureing
startup sequence in the dosshell.

What do i need to do under WXP ??
Copy NTICE.SYS, SIWVID.SYS, WINICE.DAT
(hmm SIWSYM.SYS) to \system32\drivers\
but how to start them manually ??

Anyone has an answer ?

Chester
dELTA
02-08-2004, 03:39 PM
Due to the early loading stage of these drivers, you cannot load them manually after startup (correct me if I'm wrong anyone). You can make a nice and handy tool that enables/disables these drivers and reboots the system though, which is probably the closest you can get.
evlncrn8
02-09-2004, 02:25 PM
Due to the early loading stage of these drivers, you cannot load them manually after startup (correct me if I'm wrong anyone). You can make a nice and handy tool that enables/disables these drivers and reboots the system though, which is probably the closest you can get.

net start ntice

if you set softice to load manually and not on boot that is

siwvid still has to load before boot tho, but the softice configuration does that for you
dELTA
02-09-2004, 05:54 PM
Yes, that's what I meant, you cannot get away with not loading any of the drivers at boot time. And of course, any protector worth his name will then detect the ones that have to be loaded (and I assume anti-detection is the main issue here, what else? ;)).
Chester
02-09-2004, 06:28 PM
Not the dection thig, but the hole Registry Crap !
There must me another way to load it as a system driver
Must study now the new DS31

BTW Anyone noticed the new Routine in DS31 of the
UnhandledExceptionFilter Thing
(Funny seems Com*uware is reading some Tutors too)
dELTA
02-09-2004, 07:34 PM
Exactly which registry entries are you talking about, and what kind of trouble are they causing you?
Chester
02-10-2004, 05:59 AM
Run a Registry Tracker before & after installation.
Most of the Reg-Entries are not needed at all,
delete them(not all !!!) & you will see Softice is running

EDIT:
It would be 100% stupid to del these HKLM/SYSTEM !!!
Withot reverse some files do not del these one HKLM/SOFTWARE/NU*EGA
With little Tricks NTICE would load with only 1 Reg Entry !!

Maby i should wine elsewhere ;)
dELTA
02-10-2004, 08:19 AM
Err, yeah, good advice... And then please come here and whine about strange things happening with your Softice. While you're at it, delete the files in the Windows directory too (not all !!!), most of them aren't needed most of the time anyway.

And again, exactly what is the problem with the Softice registry entries, and how is it connected to starting the drivers manually or not?!
evaluator
02-10-2004, 12:01 PM
I understood initial question so:
"can I without normal installing, but simply putting files in new NT-system
make runnig ntice?"

mostly no.
Chester
02-10-2004, 12:26 PM
I understood initial question so:
"can I without normal installing, but simply putting files in new NT-system
make runnig ntice?"

mostly no.

Try this
Load after normal install, dump core file(most stuff inside data),
fill core files with right stuff, uninstall DS .
Reverse & think about & load ntice (without registry)
dELTA
02-10-2004, 12:40 PM
WTF? :confused:


Softice Breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Breakpoints
PDA

View Full Version : Softice Breakpoints

cover
02-08-2004, 07:38 PM
I just installed Sice v3.25 , using Win95a.
When I set a breakpoint eg. bpx getwindowtext and press ctrl-D, I am unable to get out of sice, instead I get a message "break due to bpx user!getwindowtext"
When I f11, I am in kernel.alloc.
Hope someone can help
Thanks.
dELTA
02-08-2004, 07:46 PM
Your target (or any other software running) might have some timer or event that calls this API, which is triggered as soon as you return. Set a conditional breakpoint with a counter and see if it helps.

Btw, exactly what the HELL are you doing on a machine with Windows 95a?!? :p
esther
02-08-2004, 09:50 PM
Its not surprising anyway :) . I'm using win95 on my older machine for some older programs since it doesn't works well in win2k .

scandisk is a powerful tool use it or regret :p


Admins ! plz pay attention !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Admins ! plz pay attention !
PDA

View Full Version : Admins ! plz pay attention !

fifthelement
02-09-2004, 09:30 AM
Dear Guys !
I have Download the new offline archive chm file ! but it doesnt have Indexing or searching feature ! how can users search within this file without any searching feature and find their answers ?
:confused:
Kayaker
02-09-2004, 01:02 PM
Hi

As I said in the announcement, a search index is NOT included. To create a comparable search index for the .chm file I would need to extract the keywords that exist in the boards' search index MySql database, which as I remember is *VERY* large, and somehow incorporate them into a .chm search index (.hhk) file which will link to each and every occurrence of the search phrase. Without going into the details, I'll just say it would not be an easy task.

However, I may be able to create a search index in another way, I've noticed there exists an "HHK Builder" application which is used to create an index file from the content of the HTML files in a .chm project. As the .chm file I created is composed of 4000+ html files, it might be an interesting experiment to see how well it works. Hopefully it will create the required multiple linking and not just a list of unlinked words.

If it works reasonably well I'll include a search index in the next version, but chances are it won't be comparable to the boards' built-in search index, so you're still back to searching the board online.

I was trying to keep the file size down to a reasonable level (already 6Mb zipped), for those on dialup, who I figured would most benefit from being able to explore the informational posts contained herein offline. Besides, the file was meant for archive/historical purposes and for leasurly browsing, not simply as a convenient forum search replacement. But I do agree a search index would be useful and I'll see what I can do.

Kayaker
Aimless
02-09-2004, 10:48 PM
You might try using "Search and Replace" by Funduc.

Pretty fast, and will search the more than 4000+ html files in a jiffy.

Have Phun
Kayaker
02-10-2004, 01:37 AM
Was that for me or him? ;-)

I do use a search/replace function on the html files prior to compiling to redirect the links to the server properly, etc., but that could be another option for searching... I believe .chm files can be decompiled back to their html files, though I've never looked into it. Then a search could be done. But that isn't really a great solution.

To update - I tried the HHK Builder app and it sucked. It created an .hhk index file of 16+Mb, the index "words" often included complete or partial post text, plus the HHW Workshop app crashed when compiling it.

That's the bad news. The good news is I created a *Search* tab (as opposed to an Index tab), and this worked reasonably well. For Advanced Search capabilities (boolean/wildcard) it only increased the .chm file to 9+Mb. Unfortunately the html files *all* have the same Title page <title></title> tags, so you may get 400 hits for "Asprotect" all with the thread name as 'RCE Messageboard's Regroupment'. You see this problem as well in the existing Favorites tab. I see no easy search/replace solution to that however, to try to give each html page a unique thread title by default. It's better than nothing, just not ideal.

The "Archives" feature at the bottom of the page (from which I generate the html files), is simply a .php script with a .css style sheet that displays the threads in the database in a different format. This format seemed the most friendly, which is why I used it. The other option is to create a .chm file with the default board format, but this is messy plus most of the features would have to be removed else the file would be many MB's larger. The Archives compilation with a Search function should remain around 10Mb for while, but will continue to grow.

To give each page a unique title one solution might be to come up with some kind of script which would reference the index pages (26 of them) and change the appropriate Title tags in the 4000 html files. If some php guru wanted to try, I could give them a few representative html files to attempt that... It could also be done as a specialized regular expression string search/replace app I suppose. The other "problem" is that Code tags, and as mentioned before Quote tags, are not included in the Archives feature, but this is a bug/design of the VBulletin script itself.

In the next few days or so I'll create a new file with a Search function and maybe a new page which will contain the most updated .chm file.

Cheers,
Kayaker
dELTA
02-11-2004, 08:47 PM
Ok, the php code is now patched, all thread pages will have the correct title from now on. Looking forward to a chm-file with nice search results. ;) Great work with the chm archive file Kayaker!
nikolatesla20
02-12-2004, 12:22 AM
This is going to be SWEET !

-nt20
Kayaker
02-12-2004, 12:41 AM
This is going to be SWEET !

-nt20

Yup. I've tested the nice mod (one further change to be made) and recompiled the chm file with what seems to be a pretty good regular expression search capability (however HHW manages that internally). Funny, I test it with "asprotect" and get 392 hits, on the board only 356. Remember though, this isn't going to be updated on a daily basis!

1K. ;)
udv
04-28-2004, 08:01 AM
Dear Guys !
I have Download the new offline archive chm file ! but it doesnt have Indexing or searching feature ! how can users search within this file without any searching feature and find their answers ?
:confused:

hi,guy,where download the chm file?
tell me the URL,please!
thanx!
Kayaker
04-28-2004, 11:50 AM
Registered User ! plz pay attention !
dELTA
04-28-2004, 02:29 PM
:D
+SplAj
05-02-2004, 02:39 AM
VisualCHM is a good compiler/decompiler for help files.

hxxp://www.vchm.com/

ciao


HeLp Me :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > HeLp Me :(
PDA

View Full Version : HeLp Me :(

GeKo
02-09-2004, 01:48 PM
You excuse my English:

I have really need of your help. I Have a protected program with ACProtect and I wanted to know if an exists "Un-Pack" special. How do I do to remove ACProtect from the program?. Please help me :(
dELTA
02-09-2004, 02:01 PM
Read the FAQ.
JMI
02-09-2004, 03:39 PM
and then do a search of "acprotect." And among the results you will find:

http://66.98.132.48/forum/showthread.php?t=4900&highlight=acprotect

Regards,
GeKo
02-10-2004, 03:54 AM
Thanks for the interest. I attach the protected program with ACProtect. I hope in your help and I remain waiting for your communications. I thank you

Attachment removed...
SpeKKeL
02-10-2004, 04:53 AM
Thanks for the interest. I attach the protected program with ACProtect. I hope in your help and I remain waiting for your communications. I thank you

Okee,

I used Eval's translation plug-in.(search the web ).and it says: " do a search of "acprotect." And among the results you will find:

http://66.98.132.48/forum/showthread.php?t=4900&highlight=acprotect "

Thanks for the interest,

SpeKK.
JMI
02-10-2004, 12:52 PM
Hmmm. That response sounds vaguely familiar. :rolleyes: I fairly sure I've read it somewhere before, now where the heck was it?? Especially that part about searching and the reference to the "acprotect" thread. :D

Regards,
D-Jester
02-11-2004, 10:20 PM
Do you ever get the feeling that no one read sthe FAQs?

Maybe its just me...
JMI
02-11-2004, 10:28 PM
Nearly every damn day of my life. :D

Regards,
SpeKKeL
02-12-2004, 06:41 AM
Ajo,

I must admit ac-protect has some nice (stolen???) tricks, you must hide si, it has a manner of stolen bytes(whatch the esp)you have to rebuild the imports and it makes some nice calls to perplexl !! these calls make my day shining ...(to make it difficult they use some extra code like :p )

SpeKK.
Shoob
02-12-2004, 07:25 AM
yep but this target had no stolen bytes + calls because of of its a MSVB app? deep calls are no problem at all just trace the target calls and replace the byte after the return with the call in you mainly dumped program - not that hard.
SpeKKeL
02-12-2004, 09:04 AM
[QUOTE=Shoob]yep but this target had no stolen bytes + calls because of of its a MSVB app? deep calls are no problem at all just trace the target calls and replace the byte after the return with the call in you mainly dumped program - not that hard.[/QUOTE

Not that hard at all !! It's FUN ! :D

SpeKK.
D-Jester
02-12-2004, 01:01 PM
From my 'personal' experience VB apps all start the same way.

Push 0041BFC4
Call MSVBVM60.ThunRTMain <-VB5 is Same Way

To find the address to push, use grep or peek to search for string reference inside the dumped file.
Find the string reference to "VB5!" or Hex: 56 42 35 21
And at the "V" or 56 you have the address to push.

Or course I am not an expert, I am only telling my personal experiences

Peace,


How Packed files are Packed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How Packed files are Packed
PDA

View Full Version : How Packed files are Packed

naides
02-09-2004, 05:07 PM
This is sort of a general question.

For starters, packing and unpacking are not my favorite theme in RCE, so my question may seem trivial for more advanced board users.

If I am correct, the usual approach to packed apps is to allow the protection stub to do the unpacking for you, then recover the unpacked image of the file form memory. My question is, how feasible it is to reverse the packing/unpacking algorithm itself?
There is a small, finite number of packing methods. Would it be another way to defeat this sort of protection?
dELTA
02-09-2004, 06:06 PM
Exactly what do you mean with "reverse the unpacking algorithm"? You mean like rip it and make a separate unpacker tool that works on static executables? This is quite possible indeed. The problem is that the packer algorithms are often changed quite frequently to prevent such a thing (at least in smaller details, enought to make an old unpacker tool not work anymore).

Then we have of course all kinds of tricks that work more or less in "real-time", and hence are patched into the code of the unpacked executable image in one way or another (plus API emulation tricks of different sorts). These are often designed to be hard to defeat in the static executable, and are designed so that the program should not work without the packer wrapper present in memory. These are the biggest problems with fully static unpacking I think.
doug
02-10-2004, 01:59 PM
not to mention it involves rewriting the entire unpacking stub yourself / updating it on every version change of the protection. (_time_ consuming, particularly to maintain that code, but then this also gives you _total_ understanding of the protection)

Letting the unpacker do these initials steps is a much more generic method and is a lot faster.
D-Jester
02-11-2004, 10:33 PM
I am confused as to what he means also, but I would suggest reading this, as it gives a general overview of the implementation, theory, and methods of packing and protecting.

Taken from anticrack.de before it shut down for the conversion.

Written by BigBoote from nakedcrew.net


Armadillo Tut Req. !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Tut Req. !
PDA

View Full Version : Armadillo Tut Req. !

fifthelement
02-09-2004, 09:47 PM
Hi, I have searched the whole forum for just one working link for Armadillo Tutorial but all of them r broken ! u can try by yourself ! any body knows any Armadillo Protection tut or any example on the net ?
Thanx :confused:
Woodmann
02-09-2004, 11:07 PM
Howdy,

I didnt have any problem finding tuts about arma.

Besides the search button up above, you can scroll down and find sites that have information about exactly what you are looking for.

If you still can not find anything, send me a private message so I can help you and save you from the public bashing you will certainly receive.

Leave him alone.....I will help him :rolleyes:

Woodmann
JMI
02-09-2004, 11:34 PM
Pssst. Don't tell fifthelement the evil, planet devouring thingie is closing in fast and is set to completely destroy the planet and all of humanity. Take him out to the temple and apply the magic keys and let him save the world. Again. For the first time. .... PLEASE. DO IT NOW. :D Oh drat. Where's Bruce when we REALLY need him? :rolleyes:

Regards,
fifthelement
02-10-2004, 11:52 AM
Thanx a lot I will send Woodmann pm.
Zilot
02-11-2004, 03:20 AM
Try on zilot.da.ru
evaluator
02-11-2004, 06:57 AM
yey, Zilot!

why my photo on your main page is so little sized!?
Zilot
02-11-2004, 11:34 AM
What is your photo there, monkey ??
JMI
02-11-2004, 12:18 PM
come on eval. That's a girl chimp. (dELTA told me. He can spot females quite easily on that humongous monitor of his.) :p

Regards,
dELTA
02-11-2004, 01:11 PM
I can spot females pretty easily without my monitor too, mind you. :p
JMI
02-11-2004, 01:45 PM
Or we can "disassemble" dELTA's words and get his "real" thoughts:

"I can spot pretty females easily without my monitor."

Regards,
evaluator
02-11-2004, 02:32 PM
Zilot, you look sad.
something bad happens?
Chester
02-11-2004, 02:46 PM
Maybe Chad is little'bit too paranoic. He check for Sten IceExt too,
even if no debugger is installed.

Si*k Men try to scan for WXP even if running on Debian :D
Zilot
02-12-2004, 04:23 AM
Zilot, you look sad.
something bad happens?

Where did you find that ???
JMI
02-12-2004, 05:32 AM
Eval is making a "joke" about the picture of the Chimp on your website. First Eval suggested it was Eval's picture and now Eval is suggesting it is "your" picture and that "you" look sad. :rolleyes:

Never mind. :) Too many InglisH :p

Regards,
dELTA
02-12-2004, 06:40 AM
I assume you mean InglicH? :D
JMI
02-12-2004, 11:28 AM
Eval has spelled it several different ways, so I "assume" I am authorized to spell it with any of the variations. By my search, there are 8 other instances. :p

Regards,
evaluator
02-12-2004, 02:41 PM
Zilot,

by your reaction(without smilies) I assumed that.
So you are NOT sad or.. ye?

--
JMI,

your assumption is not nice!(& this is 2nd time you made dirty assuption)
I think, you should apologize a Zilot.
JMI
02-12-2004, 04:00 PM
Eval:

I always try to wash my hands before making assumptions. Is that good enough?

As to the rest of you post, I regret that I had been unable to quickly locate the special plug-in which permits disassembly of your "code" and, as a result, I have no idea at all what you are talking about. :rolleyes:

Regards,
evaluator
02-13-2004, 04:12 AM
JMI,

when you wrote:
>Eval suggested it was Eval's picture
right interpretation of joke

>and now Eval is suggesting it is "your" picture and that "you" look sad
this is dirti assumption.

because when i asked:

>Zilot, you look sad.
>something bad happens?

this was NOT joke.

So, now I request from you again:

Because your assumption is not nice, I think, you should apologize a Zilot.
+ also you should apologize a Me, Because You treated me, as the dirty joker.

PS:
all this is not joke & I closed any joking-project between you & me from my side.
(as age-incompatible)
JMI
02-13-2004, 01:05 PM
Sorry Eval:

I still have NO idea why you would think "joking" about the picture of the chimp was "dirty?" I was only teasing about "whose" picture it was and whether or not the "gender" of the picture was male or female, which can not actually be determined "from the picture". I had NO "not nice" intent, and do not understand how YOU found one in those comments.

The issue is one of language comprehension, not age.

I am sorry if you took offense, but I still have no idea "why" or "how". :confused:

Regards,
evaluator
02-13-2004, 02:42 PM
I respect your decision: not apologize.

for avoid in future same trubles will good,
if you will not fall into explanations of my englese for others..
JMI
02-13-2004, 05:20 PM
As I said:

We have a language comprehension problem.

The phrase: "I am sorry if you took offense, but I still have no idea "why" or "how". IS an apology. ;)

Regards,
evaluator
02-13-2004, 05:35 PM
because I was NOT <offensed>, I not grab that at apology!
D-Jester
02-15-2004, 11:10 AM
I am confused while single steping through an prog.

PEID Reports:
Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks [Overlay]

I get a warning about setting a suspicious breakpoint.

I am not trying to set a BP. Is Armadillo doing it?

ScreenShot:
hxxp://d-jester1.tripod.com/images/armbp.png
(This link should not be clickable...stay on JMI's good side)

My apologies if this sounds like a stupid question.

I know the Parent process debugs the child process in Copy-Mem.
I didn't realize that it would set breakpoints on itself?
evaluator
02-15-2004, 11:49 AM
any warning can be fiction..
JMI
02-15-2004, 12:14 PM
D-Jester: Thanks for the thought, but we've fixed the code here and clickable links outside the Forums simply do not work, so here it is not an issue.

Regards,
dELTA
02-15-2004, 05:47 PM
Or rather, URLs outside the forum (+ other woodmann sites) do not become clickable... :p
JMI
02-15-2004, 06:06 PM
That too. :D

Regards,
D-Jester
02-17-2004, 11:08 PM
Shweet! Many Thanks to the Mods

Question:
In the dillo 2.61 tut by crUsAdEr he uses SetProcessWorkingSetSize for OEP fishing this API is available on NT systems only.

And if I am correct using the WaitForDebugEvent API is only useful in fishing for the OEP in version 3.x

What API is useful under 9x/Me For 2.x OEP Fishing?

I mean I can single step from EP to Program loading and once the Parent takes over, I can't break on API's.
So i can't find OEP

I have build a new IAT using imprec and revirgin.

So I am guessing I need to work more on defeating Cpy-Mem?
Or should I start using a system-wide debugger such as SI instead of Olly?
hobferret
02-18-2004, 05:34 AM
Good Morning Vietnam ;)

This thread is becoming rather "silly" :confused:

ENGLISH - SHINGLE - HESLING- HISGLEN -SHINGEL - HINLEGS
These are all anagrams of the word ENGLISH

Maybe, just maybe we should have a foreign language section like EXE Tools forum where there is a CHINESE section :D

/hobferret

PS No disrespect to anyone concerned :eek:
dELTA
02-18-2004, 07:59 AM
In that case only a Swedish one and an Italian one (and maybe a Vietnamese one if JMI is still up to it :)), we have to be able to understand them to moderate them you know. :p
JMI
02-18-2004, 11:27 AM
We would only need a limited vocabulary. Just the phrase "Do it for me" in many languages and a clickable URL to the target. :rolleyes:

Regards,
hobferret
02-19-2004, 08:09 AM
We would only need a limited vocabulary. Just the phrase "Do it for me" in many languages and a clickable URL to the target. :rolleyes:

Regards,

Hey - How about invisible writing or miss every other letter out of the vocab :D

/hobferret


SSL forum
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > SSL forum
PDA

View Full Version : SSL forum

nikolatesla20
02-10-2004, 12:48 AM
Hm, was thinking about this today. Wouldn't surprise me if the IT admins at my workplace had sniffers and were reading internet accesses....

Now if only I could access this site thru SSL they wouldn't get squat :)

-nt20
JMI
02-10-2004, 03:30 AM
I am shocked and dismayed that you may be accessing this Forum on company time and with company equipment. :o

Or am I just shocked and dismayed that you haven't spent more time trying to figure out how to "reverse" any potential "spyware" your employer may be using. :p Haven't you figured out how to make the "system" think it's someone else's machine that doing the dirty deed? :rolleyes:

And are you assuming that if you accessed this site through "their" internet connection using SSL that they would not still know that you are accessing this URL and that you are attempting to "conceal" the content of your surfing from their view? Often the "appearance" of impropriety is more damning than "actual" impropriety. :p

"Oh, I'm sorry, I was just doing my online banking. Yah, right. If you are going to cheat, you better give it "careful" thought. :cool:

Of course, we already know that you are way too valuable to the company to fire, because we have been using your internet access here to piggyback into their servers to read "their" files. :D Oh, no. Wait. That's Hacking and that's not what we do here. That's just what some of my former collegues at NSA, Oh. ssssh. Whatever you do, Don't say "carnivore." Really pisses them off. Don't tell them I mentioned it .... again. :D

Regards,
Kayaker
02-10-2004, 03:45 AM
I'm shocked and dismayed that this site would be deemed any more inappropriate than say a C programming forum. In that case we've really got to clean up our act! :p
dELTA
02-10-2004, 08:02 AM
nikola: STunnel + Squid...
nikolatesla20
02-10-2004, 08:17 AM
Hehe,

JMI: There was a time when I DID have that proxy on someone else's system :)

Kayaker: It's only a matter of P.C. Technically this site isn't bad but who knows ppl are uptight ?

This site is good for my mental health (keeps me thinking sharp) anyway so really it improves my job performance then, right :P

I can connect to my system at home and use it as a proxy, maybe I can set up something encrypted that way. 'cause proxy or no, if it aint encrypted they could sniff it.

-nt20
nikolatesla20
02-10-2004, 08:23 AM
Thanks Delta, stunnel looks like a viable solution. I can run it on my home PC and then connect to that from work using stunnel (I think). I'll look into it.

-nt20
dELTA
02-10-2004, 08:26 AM
Yes, run STunnel at your work computer, local port as input end and your home computer as output end. Run another STunnel at your home system, input end catching the output end of the other STunnel and output end directed to the input port of the Squid (or any other) proxy running at the same system. Then set the local port on your work computer to be proxy in your browser. Kablammo, you have a generic SSL proxy that will access any site, encrypting all data as far as your employer's system is concerned...
disavowed
02-10-2004, 09:04 AM
or use remote desktop (terminal services) to connect to your home computer and web browse on that. the communications are encrypted.
nikolatesla20
02-10-2004, 11:11 AM
I have UltraVNC on my home system, so really I CAN browse thru the remote interface, it's just kinda slow. Stunnel would probably be faster. And I'm using Proxomitron proxy so I could connect stunnel to it.

-nt20
dELTA
02-10-2004, 12:29 PM
Yep, remoting a computer is often annoyingly slow, ugly and well, annoying. ;) It might also cause problems with corporate firewalls and such, I like the solution from that dELTA fellow much better too. :D
JMI
02-10-2004, 12:44 PM
Now there's a REAL surprise. :D

Regards,
nikolatesla20
02-10-2004, 05:07 PM
ok, got stunnel up and running on my system at home.

The only thing I couldn't figure out yet was how to restrict access to the stunnel port on the open system at home...

otherwise ppl may start using my system as a proxy.

um, ignore my IP address :P

-nt20
JMI
02-10-2004, 05:11 PM
Nope. Too late. :cool:

Regards,
dELTA
02-10-2004, 05:47 PM
Any decent personal firewall software has IP filtering per application. Simply set it to only accept incoming connections from your work to the STunnel process, and you're safe.
nikolatesla20
02-10-2004, 07:37 PM
You think I'm going to run personal firewall software? *blech* load my system.

-nt20
JMI
02-10-2004, 07:45 PM
And then all you have to worry about is their inquiring as to why you are spending "way" too much time connected to your home computer. Remember that a good cover story is best prepared in advance of when they begin to tighten down the thumb screws.

I can attest from personal experience, that waiting untill you are dragged out of a motel room at 2:00 a.m., having had a pillow case thrown over your head and being tossed in the trunk of a vehicle and driving off to interrogation, is really NOT the right time to first start planning what one intends to offer as a "plausable" explanation of one's activities. :eek: Fortunately, I hadn't waited. But that's another story. And if I told it to you, I'd probably then have to kill you anyway. :D

Regards,
Woodmann
02-10-2004, 10:05 PM
Howdy,

If we are to be "paranoid" about what the admins are watching, wouldnt it be better to let them see something generic like a connection to google or altavista et al;

If they see a connection to one site for an extended period of time, better they think you are doing "real" research instead of other things.

Woodmann
nikolatesla20
02-10-2004, 11:53 PM
JMI: I figured I'd just tell them that I'm just testing things out.

But anyway, haha yes I've thought to myself. Suppose they were watching what sites were visited often, etc. And then now they see my connection is always to some foreign IP address, and they can't even look at the data since it's encrypted :P But hey perhaps it's just the yahoo e-mail login form :P

I do think it's kinda funny tho that in reality since now the stream is encrypted a person could basically go to any internet site they wished without fear of reprisal. For example, *naughty* sites. Not that I would do such a thing at work of course. Just an interesting observation. Maybe they have some software that watches all the data that comes thru and sifts for keywords. In any case, once it's SSL'ed they are screwed.

So I can really only think of 3 things happening:

1. Nothing
2. They realize it's encrypted and block the IP address of my home system.
3. They realize it's encrypted and ask me why. In this case they would openly reveal that they DO watch the data. :) So doubt this would happen, by you never know.

-nt20

-nt20
JMI
02-11-2004, 04:58 AM
I think perhaps you are missing the bigger picture. It is, after all, "their" internet connection. You "use" it only with their permission and they can monitor it as they wish, although it helps if there is something in your employment package, which you probably didn't read, which explains they have the right to do so. :eek:

However, you are only thinking about the issue of their knowing what "exactly" you are doing on the net, when the more "obvious" obversation they can easily make is that you are both "using" their net connection and making obvious efforts at "concealing" exactly what the heck you are doing by encrypting your data stream "from THEM."

As an employer, I would probably "fire your ass" simply for doing "that" faster than I would for surfing some internet site I might not approve of. The latter action suggest you might be a slacker, wasting valuable time I pay you to do work on "my" stuff. The former strongly suggest you are fricking dangerous because you are doing "something" YOU feel is necessary to actually conceal from my view, and I then begin to wonder what important company information you might be shipping off to places where I might not want it to go (like the IRS or EPA or something :D ).

The point you are missing is you aren't hiding your "USE" of the internet, you're only providing them with proof YOU don't want them to know "to do what?" Thinking you have concealed the "what" you tend to ignore the "when" and "how much" but you are NOT concealing that unless you are detouring through another machine at the office by a method which can't be detected or traced back to YOU. Of course if you make them suspicious that SOMEONE is doing this, then they have a mystery to solve and that is what THEY get paid to do. It's as addictive for them as Reversing is for us.

Planning requires that you view the issue from the uptight perspective of the office IT watchdog, not from a more calm view to which you might approach the issue if you were to discover someone else using such "tools." Suspicion is their JOB. From that perspective, you have no "need" to be encrypting your datastream, because their is nothing in THEIR business which requires you to do so, and the fact that you ARE, earns you the lable of "suspect." And "suspects" always draw the closest observation.

Those who have the admin password, assuming they are not complete dorks, can view the contents of your machine, gasp, when you aren't even in the office. Then you need to be prepared to have a good explaination WHY these programs are even ON your machine, and you better make sure you have left no trace in your various caches (on your office machine) of any of the pages you have viewed. And just why in the hell do you have encrypted folders young man?

Of course none of that is nearly as challenging as having to learn one or more completely different life histories, which you may be called upon to recite correctly in moments of intensified emotional stress. But, again, that's another story. :cool: Let me just say that the best cover story and the easest to remember is one that is close to the truth. Once you begin to make up lies DURING the coverup, the major hurtle become remembering which lies you told. :rolleyes:

Just food for though. Oh what a tangled web we weave. :cool:

Regards,
dELTA
02-11-2004, 06:18 AM
So I can really only think of 3 things happening:

1. Nothing
2. They realize it's encrypted and block the IP address of my home system.
3. They realize it's encrypted and ask me why. In this case they would openly reveal that they DO watch the data. So doubt this would happen, by you never know.
Another quite common solution is to block outgoing SSL traffic completely, if it is not needed for any of the company's legitimate business. :)
nikolatesla20
02-11-2004, 08:11 AM
Heh all right, all right, all good points.

Yes that is right, I guess I haven't been thinking clearly. The best "solution" would be to use misdirection.

I do keep my system at work clean as possible :)

I've thought about putting a deadswitch in the system at work :P hehe just kidding.

I think the message I get here is I should stop being such a slacker ! :D I kinda agree lol. Hey, at least I know how to set up stunnel now tho. So I've learned something. But JMI u scared me now so I'm going to behave for a while (probably like a week or so :P).

-nt20
evaluator
02-11-2004, 08:59 AM
worries..worries..

stop worry, be happy.

"What you are encrypting?" "Porn".
Basta!
**

nt20, don't more care about encryption,
because i just sent a mail to your work, where i'm explaining,
that you are CIA-agent.

turn on timer & wait light at end of STunnel..
JMI
02-11-2004, 11:52 AM
Well, nt20, that would have you observing another of the "agency's" rules, (how did eval discover your true identity so quickly?) and one the Watergate "third rate burglers" forgot, which is that at the 'first" sign or suspicion your clandestine operation may have been compromised or come under potential observation, you immediately cease "all" clandestine operations and return to your cover story.

And as to the "deadswitch," any even moderately efficient network system security should have rotating physical backup copies maintained off site. But that's just another building to blow-up or burn down, so what the heck. :cool:

Who me? I'm just a regular worker bee. See me here slaving over this damn computer? Want to see what's on my harddrive? Sure. What can I do to help? Half the time the damn machine seems to be doing stuff on it's own anyway. :cool:

Regards,
nikolatesla20
02-11-2004, 12:02 PM
Well so be it then, if you wish to accept the fact that you have all fallen into my overall plan of misdirection. After all, if I really was concerned with encryption, why would I bring it up so publicly if not to disseminate disinformation?

:D

-nt20
JMI
02-11-2004, 12:06 PM
Nope. Wrongo Bongo. One can NOT "disseminate disinformation" if anyone even suspects that it is "disinformation." One must appear only to be disseminating "information" and seemingly innocent information at that. :D

For example:

" Hi. I suspect that someone at my office may be attempting to use the company system to access the internet in a manner that would prevent detection or prevent the ability of anyone at the company from being able to determine exactly what they are, or have been doing. I've done a preliminary search on the net and don't seem to be making any progress. Can anyone steer me in the right direction on what types of tools or methods someone might use to attempt such a thing and how to potentially guard against it?"

Regards,
nikolatesla20
02-11-2004, 12:36 PM
Haha well to me, if I read a post like that, I would immediately assume the author of the post wanted some free help on how to do the stuff themselves too. I mean that's a red flag post to anyone experienced in reversing :)

-nt20
dELTA
02-11-2004, 01:17 PM
In any case, just register the domain name "www.barelylegalsluts.com" to your home computer IP, and then use it as a proxy. Then you will only seem like any of the other employees in the logs when you are connected to it half of your working day. :D That's misdirection to ya. :p
JMI
02-11-2004, 02:14 PM
OK. Time for another lesson from "James Bond, 101." The issue is "plausable denial." When the government of any country says they have no spies, no one believes them, but the answer is at least "plausable." As in "Why would WE be spying on the British, their are our friends."

Here's a test. Which message is clearly looking to be trying to screw the company? Your message:

"Hm, was thinking about this today. Wouldn't surprise me if the IT admins at my workplace had sniffers and were reading internet accesses....

Now if only I could access this site thru SSL they wouldn't get squat "

Or the one I wrote above. ;)

Which one would you prefer to have to try to explain to the Geheime Staatspolizei while they were applying "gentle" pressure to your family jewels? Get the point? :rolleyes:

Regards,
evaluator
02-11-2004, 03:23 PM
no
JMI
02-11-2004, 03:39 PM
Well maybe you have no family jewels. :D Or it's "too many inglicH". :cool:

Regards,
evaluator
02-11-2004, 03:49 PM
both
JMI
02-11-2004, 03:55 PM
Well, that's "eunuch." :rolleyes:

Regards,
evaluator
02-11-2004, 04:01 PM
JMI, when edit your posts, this fact not appears on post
(probably because you are mod);
then mark yourself when you edit.
JMI
02-11-2004, 04:46 PM
Should I also mark when I edit your, or someone else's posts also? Any other commands you have for me? :p

Did one of my edits spoil one of your jokes? That's not why I do them of course. :cool:

Regards,
Woodmann
02-11-2004, 07:34 PM
BWAHAHAHAHAHAHAHAHAHAHAHAAHA..........

JMI/jim :p You are working to hard. Stop now.:D

Woodmann
disavowed
02-11-2004, 07:46 PM
Well maybe you have no family jewels. :D Or it's "too many inglicH". :cool:both
hahahaha.. gotta love being an admin! :D
JMI
02-11-2004, 08:23 PM
I ain't no "dang nabit" Admin, I am just a lowly Moderator. :D It's true that I'm also "Super," but that's not my fault either. :rolleyes:

Regards,
evaluator
02-12-2004, 02:05 AM
JMI!!

>Did one of my edits spoil one of your jokes?
"cleck" !

>Any other commands you have for me?
G0 & edit back "cleck" !
JMI
02-12-2004, 03:20 AM
Sorry eval. You are going have to remind me where this former spelling was if you hope to have me change it back. :confused:

Regards,
evaluator
02-12-2004, 07:46 AM
really you are so old? or you joke!?
JMI
02-12-2004, 11:00 AM
Both. :D

Regards,
evaluator
02-12-2004, 11:34 AM
ok, sorry, oldy.
jokes closed.
JMI
02-12-2004, 11:37 AM
Can't take the heat, huh youngin? :rolleyes: Considering the alternatives, I'll take being an "oldy."

Regards,


The Function in PE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > The Function in PE
PDA

View Full Version : The Function in PE

AlanZheng
02-10-2004, 03:45 AM
Hi all:
I have a problem about PE.I want to record the "function" when I execute a .exe file.for example I launch the "microsoft word" and click the "file" menu.
But I want to record this process and record all transfer function.
AlanZheng
02-10-2004, 05:01 AM
Could somebody tell me how to get Inside Function from PE file.It is not function in Import sections and export sections. and I open a PE file useing the Hex edit,but I do not find out the local function.please tell me the whys?
And tell me the transfering way about inside function.
Thank you very much!

welcome communion to me.
My Email: zhengxd@langchao.com
dELTA
02-10-2004, 07:50 AM
Your request is still a little unclear to me. Please try to explain further. Explaining the purpose of the whole thing might make it easier to understand too.
evlncrn8
02-10-2004, 09:10 AM
sounds like you need to study the pe file format
JMI
02-10-2004, 12:49 PM
Since these two threads were from the same author, closely spaced in time, and appear to be directly related (at least on what can be determined at this point in time), I have taken the liberty to merge them together.

Regards,
AlanZheng
02-10-2004, 11:37 PM
Hi all:
My problem is the all function in the PE file.Include local and extern function in source code.They are get from other process or not. for example the source PE file use C/C++ at VC++6.0 platform.
I only get the export Function use the "depends" tool.The other function do not get.and I do not get the other function all the same when I open the .exe file use the Hex edit.
Please tell me whys?
Thank you very much.

My Email: zhengxd@langchao.com
Kayaker
02-11-2004, 12:05 AM
Since this seems like a 3rd question on the same topic by the same author, I have also taken the liberty to merge the threads.

We would like to help you with your problem if we can understand exactly what you are asking, but please don't keep posting the same type of question in different threads.

Maybe from the 3 posts we can figure out what it is you need.

To start with, do you understand the basic PE structure? Have you read and understood the documentation here for example?

http://66.98.132.48/forum/showthread.php?t=5384

Let's try this -

>I want to record the "function" when I execute a .exe file.for example I launch the "microsoft word" and click the "file" menu.
But I want to record this process and record all transfer function.

3 tools might do what you seem to be asking - Filemon, Regmon, an API monitor.

>Could somebody tell me how to get Inside Function from PE file.It is not function in Import sections and export sections. and I open a PE file useing the Hex edit,but I do not find out the local function.please tell me the whys?
And tell me the transfering way about inside function.

What do you mean by 'Inside Function'? If it's not an import or export then do you mean local calls or calls from a loaded dll?

Please try to clarify what you want.
dELTA
02-11-2004, 06:00 AM
Ok, my guess is that you are asking to be able to recover/pinpoint the different functions found in the source code of the program, from the binary after compiling the program, just like you can find the location of the exported functions? The problem is that no names are preserved for these "internal functions" during the compilation, so it is impossible to get them straight away. You have to disassemble and analyze the program manually, and "guess" which functions are which (if you don't have any debug symbols for the program that is, then you can get names for all memory addresses in the program).
sgdt
02-11-2004, 09:02 PM
IDA's FLIRT signatures for various compilers are very helpful. This leaves only the user written functions left to figure out, and even then, they are pretty simple because you can see what the code is doing (i.e., it's calling mktime or fread or whatever. Much nicer than only imports).

Anyway, FLIRT is pretty amazing. You can even create your own sigs, which is really handy when new versions of applications are being released often. This allows you to only have to deal with the functions that have changed. It isn't 100% accurate, but it handles the majority of the routines.

IDA rocks! Too bad it's so hard to buy. :(
Aimless
02-16-2004, 12:00 AM
Let me see if I understand you properly:

1. You can trace the exported functions of an executable using any tool that you want.
2. You can also trace the imported functions of an executable using any tool that you want.
3. What you CANNOT trace, is the actual local functions (as seen in a decent disassembler like IDA: for eg: sub_41234444)

If that is indeed the case, I would recommed you get a binary profiler (pretty hard to find) or use Microsoft Windebug or Ollydebug.

a. In case of Microsoft Windebug, breakpoint on all functions (import the bps from a file. Manually enter and you'll grow old)

b. Run the program and save the log file. Voila! You have the call list. If you want to see the hierarchy, then you have to use a command (forgot which, sorry, look up the docs)

c. If its Olly, you gotta run a trace.

d. Save the trace to a text file, run grep on it and get all lines with only CALL in them.

e. You're done.

Alternatively, you might try using Etch (but I doubt you'll find it now). A better idea is to use your own program to do the same. A good knowledge of C++/VB/PE Structure recommended.

If none of the above, I guess you'll have to repeat the question for the umpteenth time.

Have Phun
sgdt
02-16-2004, 10:06 AM
There are a couple "debug-less" profilers that I use, the first is of course VTune, and second is AMD's CodeAnalyst. AMD's CodeAnalyst is free and available from AMD's website. Neither profiler requires debug information or source code. Etch hasn't been maintained in quite some time, so I believe after the guy who wrote it got his thesis, he gave up.

OK, back to the question. If you don't want to use IDA's tree graph to determine what all functions are called from an exported function (and who they call, and who they call, etc.), then I would recomend a coverage check.

I'm fairly certain Olly supports coverage. What it does is automaticly place break points on EVERY instruction on your program. When the break point fires, the break point is automaticly removed and the program resumes. When the run is complete, instructions that don't have a break point are executed instructions, and instructions with remaining break points were not executed. Simple enough...

Usually this functionality is used for determining the completeness of your testing, but you can also use it to see any functions that might have been called by pointer-to-function (something that doesn't easily show up in IDA).

The SoftIce guys also have a wonderfull coverage tool, profesional grade with a price to match. It may require source, though, so I would try getting Olly to do it first.

Coverage is a bit easier than trace, because trace logs every instruction (including instructions that have already been executed). This information, while very usefull, can sometimes be quite large and distracting (especially with loops).

Anyway, if your zen with PE and a hex editor, you can add cool functions you find to the exports section. This is NOT for the faint of heart, and you will need to make sure that data it references are set up correctly (i.e. global or class variables that may have been set by what it expected to be a parent function).

This was a great deal more text than I expected to type...


Russian Webhosters against IceExt...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Russian Webhosters against IceExt...
PDA

View Full Version : Russian Webhosters against IceExt...

LobSang Ludd
02-10-2004, 11:17 AM
Hello there...

I know it's a big FAQ-NoNo to ask where to get the tools but it seems i
need more than just searchengines here. The "other" reason why i'm asking is
i do believe it's a legal tool.

/intro
A few days ago i wanted to start another trymedia-thread in the
miniproject-area (maybe i'll stick to HopCode or buntus's thread). Since i had
serious problems with Olly (and due to the fact that there was a newer
DriverStudio) on ActiveMark targets i thought SI could do that better.
Well...till i tryed to hide it.
/outro

Since NTIceDump seemed to old (on my HD) i thought IceExt v0.57 would do
better. (i use W2K)
But for some reason it's gone...The dl-link on Sten's hp is a dead one.
Had no luck with searchengines either (even russian meta's).

Is there anyone who could give me at least a hint here?
Is Aaron's ftp the wrong place for such tools (no luck there too)?

Thanks in advance and thank you for reading this lame request
till down here...
evaluator
02-10-2004, 11:53 AM
REALLY, did what method of search you tried for find IceExt???????????????
esther
02-10-2004, 12:04 PM
1)look for cracking tools in search engine
2)look at forum links below

hxxp://stenri.pisem.net/
LobSang Ludd
02-10-2004, 01:01 PM
thanks you vm for replying

:confused: well, it seems that i should have made my request shorter or somewhat clearer...

@evaluator: websearch i guess (including forums). and i dont have a searchengine in my bookmarks that can handle regular expressions... :(
or maybe i'm just to stupid to find the right searchterms

@esther: as i wrote in my first post: the download-link on hxxp://stenri.pisem.net is broken for me (takes me to hotbox.ru)

@both: i'm not having problems finding references for newer iceext (protools, crackl@b etc.) but nearly all of these links point to sten's site at the end from where i can't download. i haven't found a direct download link yet for a
iceext-version that works properly under w2k with newer softice
evaluator
02-10-2004, 01:32 PM
then you can try contact author!

mail
ICQ
doug
02-10-2004, 01:53 PM
.
evaluator
02-10-2004, 02:08 PM
what can i say!?

THANK YOU, ESTHER!
JMI
02-10-2004, 02:36 PM
LobSang Ludd:

Maybe it's time to empty your internet browser cache and dump cookies and then maybe your use of the author's URL at hxxp://stenri.pisem.net/ given by esther would work correctly for you. It certainly works without problem from this side of the world.

Regards,
LobSang Ludd
02-10-2004, 03:28 PM
Doug:

Thank you very much. I appreciate it a lot (and lots and lots...). :p

JMI:

Thanks for the good advice but it still doesnt work. In general my browser
settings are very strict (maybe too strict?) -> that is: no js, no plugins,
accept cookies only after i've read them, avoid using IE, flush new cookies on
exit. I hope it's not my ip-tables or snort script...But after i browsed the
forum i saw that more people are having troubles connecting to wasm.ru and
such sites. So i thought it could be a blacklisting (or DNS-censorship) problem
(i only have 3 dialup-accounts at the moment - guess it's not enough in these restrictive days :( )

I apologize for any inconfini...inconvinienz... or whats that word again?
Sheesh, that last brownie screwed my spelling...:D I'd betta go breakpointin now

Regards!

Save the Vinyl!
evaluator
02-10-2004, 04:47 PM
BTW, i also failed for dld iceext from main page. What the heck can be, JMI?
JMI
02-10-2004, 05:05 PM
More than likely has something to do with the security settings on your Browser. Are you using IE or one of the others? Did you get the same forwarding to hotbox.ru LobSang Ludd reported, or did it just not download?

Regards,
evaluator
02-10-2004, 05:43 PM
same forwarding on Opera & Mozilla
dELTA
02-10-2004, 05:59 PM
I can't get the file either. Did you really try to downoad the file itself JMI, or just access the page? It is the file link that seems to be broken, not the "surrounding page".
evaluator
02-10-2004, 06:49 PM
I created copy of sten's site & downloading works.
So in original site file not exists.
test it:
-http://je-.pisem.net/
Kayaker
02-10-2004, 07:00 PM
OT but interesting/disturbing nonetheless re wasm:

http://board.win32asmcommunity.net/showthread.php?threadid=17139
Aster!x
02-10-2004, 07:52 PM
wasm.ru works, but incognito.
JMI
02-10-2004, 08:13 PM
dELTA: You are correct again. Damn it. :D I did not understand the original post to indicate it was the link to the "file" which was "broken" so I only checked the link to the web address which I "thought" he was indicating was broken. I have since also confirmed that the link to the download does not find the file. Eval's does work. :cool: Aster!x are you suggesting that wasm.ru has a "secret" new IP? Hope so. Anything we can do to help?

Regards,
Aster!x
02-10-2004, 08:25 PM
JMI: Anything we can do to help?

I have some ideas, but it is necessary to consult with Volodya.
esther
02-10-2004, 09:31 PM
Hmm I misunderstood LobSang Ludd :p

>evaluator what can i say!?

>THANK YOU, ESTHER!

You're welcome LOL
dELTA
02-10-2004, 09:44 PM
Hehe, nice eval. :)

I actually had some trouble accessing msdn.microsoft.com the other day, would you mind setting up a quick mirror for that one too you think? :D
Woodmann
02-10-2004, 09:45 PM
Howdy,

I had no problem finding it ;)

Woodmann
evaluator
02-11-2004, 03:34 AM
finding what? iceext57.zip or wasm.ru?

but guys, i'm curious about that DDos.
I don't know exactly what it is (sending junk packets, ye?), but i know- this is very old fact.
So solution for DDos mostly done, isn't it?
dELTA
02-11-2004, 06:12 AM
Eval, DDoS attacks are very hard to defend against, and do not at all have a good "solution". With "normal DoS attacks", they typically come from one or a couple of systems, making it possible to block them out at the firewall or router level. But with DDoS attacks, the attacker has taken over (hacked) tens, hundreds or thousands of different computers, and then make them all attack at once. This makes it very hard to block out, and even giants like Microsoft have big problems with it. :(

The attacks can be performed in different ways, but the common thing is that they burden the server so much that it becomes practically unavailable for normal users, and might even crash.
evaluator
02-11-2004, 06:54 AM
dELTA,

last times, you too much warry about some Micro-giant.
forget it or we will think something wrong~:)
JMI
02-11-2004, 12:31 PM
Good analysis techniques require that one consider both how something might be done and how one might defend against it happening. Studying both sides of an issue generally leads to the better analysis of either and both sides. Thinking only about one point of view is, generally, inviting sloppy and overconfident conclusions.

Of course no one would actually "lie" to spies, would they. And no one would lie to a dictator who might have a habit to killing (or worse) those who do not bring him information which he wants to hear. :eek:

Regards,
evaluator
02-11-2004, 02:22 PM
JMI, too many inglicH..
lowerise..
dELTA
02-11-2004, 07:52 PM
Don't worry eval, that's even too many inglich for me to understand what the hell he's talking about... :D
evaluator
02-12-2004, 01:18 AM
>>Good analysis techniques..
hi probably recommends Dialectic method..
JMI
02-12-2004, 03:00 AM
Nope. Read, Hegel's THESIS, ANTITHESIS, and SYNTHESIS and they are somewhat catchy phrases for debate, and have studied and used the techniques. However, the prior discussion was just a recitation of the military rule of the 6 "P's." "Prior Planning Prevents Piss Poor Performance."

Regards,
evaluator
02-12-2004, 07:48 AM
& isn't that Dialectic!?
& isn't Hegel author of Dialectic?
Woodmann
02-12-2004, 07:43 PM
Hi,

I think JMI tends to be didactic.

(that word will cost you $11.50)

Woodmann
esther
02-12-2004, 09:52 PM
You mean dickdatic :p
JMI
02-12-2004, 10:01 PM
Now Eval, as I recall, Hegel was a late comer to the discussion. There was the famous or infamous "Augustine, de dialectica, in latin, long before my German ancestor took up the crudgel.

And didactic it is. I've said the secret woird. Did I win a hunred dollars??? :D

Regards,
Woodmann
02-12-2004, 10:40 PM
Oh esther,

I hope you are not being pugnacious towards the didactic person.

(You owe me $18.10, Euros will be fine)

Woodmann
jddakid
02-13-2004, 03:38 AM
You mean dickdatic :p
Hello, I mean no offense but since i had to get the dictionary out 2 times in this short thread i thought i would contribute..............di.dac.tic: adj. containing a moral or political messeage. Fond of instructing or advising others.........pug.nacious adj. quarrelsome and agressive. I parting this $1100
(euro) conversation Im not sure if i feel smarter or less inteligent ,so i will get :confused:
evaluator
02-13-2004, 04:56 AM
"To ALL, who wishes prizes for themselves:
"Usually every day YOU can prize YOURself by YOUR OWN shit.
"Enjoy & Be Happy!

--
THIS Is Copyrighted Joke!
Any Copying is iLLegUal without author's permission.
evaluator
02-13-2004, 05:11 AM
i played with translator, which gives this variant

"To ALL, who wishes the award for themselves:
"Usually every day YOU can award YOURSELVES with YOUR OWN dung.
"Enjoy & Be Happy!

this dung sounds funny.
Is it better?

--
THIS Is Copyrighted Joke!
Any Copying is iLLegUal without author's permission.
esther
02-13-2004, 11:03 AM
Hi Woomann,
I'm not.You owe me a PM+5000 euros :rolleyes:

>Im not sure if i feel smarter or less inteligent ,so i will get

Yeah you will get it from Woomannn :rolleyes:


miracle sig files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > miracle sig files
PDA

View Full Version : miracle sig files

xoder
02-10-2004, 11:49 AM
are there sig files for the miracle libraries to use with ida?

(JMI i googled and i searched the forum, nothing found)

regards xoder
JMI
02-10-2004, 12:57 PM
Well said xoder! :D That may have been a "miracle" all on its own. :cool:

Regards,
nino
02-10-2004, 03:11 PM
Create your own! It's not that hard. Grab a copy of IDA flair and the Miracl library from the ftp site and create the sig file. Put it in your IDA's sig directory and enjoy! The only problem you may have is that you may not find the right version of the library.
If you still prefer the easy way, here is a sig of version 4.7.3
xoder
02-10-2004, 04:07 PM
thx alot nino, actually i found flirt shortly after i wrote the first post. i couldnt make my own sig file yet, since i get some errors when trying to use the flirt tools on the ms32.lib. since you seem to be more experienced with this maybe you can help me. i do the following steps:
1. pcf ms32 miracl // i have to use pcf since plb gives me errors(ms32.lib ......................................is not OMF format file)
2. sigmake miracl miracl //miracl.sig: modules/leaves: 309/270, COLLISIONS: 5

well and thats where im stuck, i cant get it to make the sig file since it has those collisions. do you have an idea how to fix it?
cr.ap
02-10-2004, 04:24 PM
well and thats where im stuck, i cant get it to make the sig file since it has those collisions. do you have an idea how to fix it?

there should now be an miracle.err or similar file. look into this and remove the comment at the beginning of the file. run sigmake again and theres your sig.

cr.ap
xoder
02-10-2004, 04:54 PM
i removed the first comment lines in the .exc and it worked :)

thanks


Nokia 6600 Symbian: help disassembling
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Nokia 6600 Symbian: help disassembling
PDA

View Full Version : Nokia 6600 Symbian: help disassembling

Kassar
02-10-2004, 01:17 PM
I'd like to know how to disassemble/patch .sis files for Nokia 6600 Symbian.
Can anyone help me showing the right tools?
Thanx
JMI
02-10-2004, 02:43 PM
Kassar:

Go back to the first page list of these Forums and actually read the BIG LETTERS AT THE TOP which tell you to READ THE FAQ and SEARCH before you ask a question. If you had done that, or did do that, you should have also seen the larger print on the Tools of the Trade Forum which state very clearly: "Do not ask where to get the Tools of our Trade. Do not even think about asking for them."

What you need to do is start over, do some preliminary work and searching on your own, follow the guidelines about describing what you have already done to help yourself and then ask a more pointed question than "Can anyone help me showing the right tools?"

Regards,
dELTA
02-10-2004, 05:55 PM
Have you tried IDA Pro (Advanced)? It can disassemble a hell of a lot of formats anyway, it would be my first guess except specialized tools for symbian.

About your question, as long as you have made some effort trying to find some info regarding the subject yourself (and made that clear), it is perfectly ok to ask WHICH tools that people prefer for a certain activity, as long as you don't ask WHERE to get them (if they are not both free and hard to find, then it's sorta ok to ask where to get them too ;)). Just make sure to formulate the question unambiguously when being close to unallowed subjects like that.
Kassar
02-11-2004, 02:53 AM
"Can anyone help me showing the right tools?"
Kassar:

Go back to the first page list of these Forums and actually read the BIG LETTERS AT THE TOP which tell you to READ THE FAQ and SEARCH before you ask a question. If you had done that, or did do that, you should have also seen the larger print on the Tools of the Trade Forum which state very clearly: "Do not ask where to get the Tools of our Trade. Do not even think about asking for them."

What you need to do is start over, do some preliminary work and searching on your own, follow the guidelines about describing what you have already done to help yourself and then ask a more pointed question than

Regards,
dELTA
02-11-2004, 06:04 AM
Yeah, and then there was the part about showing that you made an effort yourself, or at least checked out the tips you were given... :rolleyes:

What processor does that phone have?

See for example this, just like I told you in my last post:

http://www.datarescue.com/idabase/idaarm710a.htm
JMI
02-11-2004, 12:21 PM
Now there's the format for "good writing". "Tell them what you're going to tell them; tell them; and then tell them what you told them." ;)

Regards,
Kassar
02-11-2004, 12:47 PM
Now I know itìs an ARM processor.
I know IDA could disassemble sis files (http://www.datarescue.com/idabase/gallery/arm_epoc_sis.htm)
I'll try to disassemble it and... let you know.
Thanx
JMI
02-11-2004, 01:48 PM
There you go, you've actually learned alot already, and that usually a good thing. ;)

Regards,
Kassar
02-12-2004, 01:56 AM
I can't disassemble .sis files.
I try to load sis file setting ARM as processor but I don't get a disassembled file w/ strings.
Where am I wrong?
Kassar
02-24-2004, 01:16 PM
I can't disassemble .sis files.
I try to load sis file setting ARM as processor but I don't get a disassembled file w/ strings.
Where am I wrong?
.text:10003410 aStoppingMessag unicode 0, <Stopping Messaging App>,0
.text:10003410 ; DATA XREF: start+1ACCo
.text:1000343E DCB 0, 0
.text:10003440 aStoppingHelpAp unicode 0, <Stopping Help App>,0 ; DATA XREF: start+1AD0o
.text:10003464 aStoppingSettin unicode 0, <Stopping Settings App>,0 ; DATA XREF: start+1AD4o
.text:10003490 aRegisteringSer unicode 0, <Registering Serial Number>,0
.text:10003490 ; DATA XREF: sub_10001EF0+29Co
.text:100034C4 aNoSerialFoundF unicode 0, <No serial # found for device: %S.>,0
.text:100034C4 ; DATA XREF: sub_10001EF0+2A8o
.text:10003508 aSerials_txt unicode 0, <SERIALS.TXT>,0 ; DATA XREF: sub_100021B0+C8o
.text:10003520 aEnablingXXXX unicode 0, <Enabling TALX>,0 ; DATA XREF: sub_100021B0+CCo
.text:1000353C dword_1000353C DCD 0x101F70B2 ; DATA XREF: .text:1000315Co

I doubleclick on "NoSerialFound" (sub_10001EF0+2A8o )and land here:
.text:10002130 LDR R1, =aNoSerialFoundF

This is part of a subroutine:
.text:10001EF0 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
.text:10001EF0
.text:10001EF0
.text:10001EF0 sub_10001EF0 ; CODE XREF: sub_100021B0+5Cp
.text:10001EF0 STMFD SP!, {R4-R10,LR}
.text:10001EF4 SUB SP, SP, #0x660
.text:10001EF8 SUB SP, SP, #4
.text:10001EFC STR R0, [SP,#4]
.text:10001F00 ADD R5, SP, #0x38
.text:10001F04 MOV R4, #0
.text:10001F08 STR R4, [SP,#0x38]
.text:10001F0C STR R4, [R5,#4]
.text:10001F10 ADD R0, SP, #0x630
.text:10001F14 ADD R0, R0, #0xC
.text:10001F18 MOV R1, #0xF
.text:10001F1C BL sub_100024E4
.text:10001F20 BL sub_10002774
.text:10001F24 LDR R3, [R0,#0x1C]
.text:10001F28 STR R3, [SP,#0x34]
.text:10001F2C MOV R10, R4
.text:10001F30 MOV R0, R5
.text:10001F34 ADD R1, SP, #0x34
.text:10001F38 LDR R2, [SP,#4]
.text:10001F3C LDR R3, =0x101
.text:10001F40 BL sub_10002F04
.text:10001F44 CMP R0, R4
.text:10001F48 BNE loc_100021A0
.text:10001F4C LDR R3, =loc_1000311C
.text:10001F50 STR R3, [SP,#0x2C]
.text:10001F54 STR R5, [SP,#0x30]
.text:10001F58 ADD R3, SP, #0x2C
.text:10001F5C LDMIA R3, {R0,R1}
.text:10001F60 BL sub_10002534
.text:10001F64 ADD R0, SP, #0x630
.text:10001F68 ADD R0, R0, #0xC
.text:10001F6C BL loc_10001390
.text:10001F70 ADD R4, SP, #0x520
.text:10001F74 MOV R0, R4
.text:10001F78 BL sub_10002F14
.text:10001F7C MOV R0, R4
.text:10001F80 MOV R1, R5
.text:10001F84 BL sub_10002F24
.text:10001F88 ADD R0, SP, #0x318
.text:10001F8C MOV R1, #0x100
.text:10001F90 BL sub_100024E4
.text:10001F94 ADD R12, SP, #0x248
.text:10001F98 STR R12, [SP]
.text:10001F9C ADD R6, SP, #0x24C
.text:10001FA0 MOV R5, #0
.text:10001FA4 ADD R9, R6, #0x14
.text:10001FA8 B loc_100020E8
.text:10001FA8 ; ---------------------------------------------------------------------------
.text:10001FAC dword_10001FAC DCD 0x101 ; DATA XREF: sub_10001EF0+4Cr
.text:10001FB0 off_10001FB0 DCD loc_1000311C ; DATA XREF: sub_10001EF0+5Cr
.text:10001FB4 ; ---------------------------------------------------------------------------
.text:10001FB4
.text:10001FB4 loc_10001FB4 ; CODE XREF: sub_10001EF0+210j
.text:10001FB4 ADD R7, SP, #0x318
.text:10001FB8 MOV R0, R7
.text:10001FBC BL sub_100026D4
.text:10001FC0 MOV R0, R7
.text:10001FC4 MOV R1, #9
.text:10001FC8 BL sub_100026E4
.text:10001FCC MOV R8, R0
.text:10001FD0 CMN R8, #1
.text:10001FD4 BEQ loc_100020E8
.text:10001FD8 MOV R0, R7
.text:10001FDC MOV R1, R8
.text:10001FE0 BL sub_10002344
.text:10001FE4 ADD R3, SP, #0x24
.text:10001FE8 STMIA R3, {R0,R1}
.text:10001FEC MOV R0, R3
.text:10001FF0 ADD R1, SP, #0x630
.text:10001FF4 ADD R1, R1, #0xC
.text:10001FF8 BL sub_100026F4
.text:10001FFC CMP R0, #0
.text:10002000 BNE loc_100020E8
.text:10002004 ADD R0, SP, #0x1C
.text:10002008 LDR R1, =aRegisteringSer
.text:1000200C BL sub_100023E4
.text:10002010 ADD R0, SP, #0x1C
.text:10002014 BL sub_10002634
.text:10002018 LDR R3, =dword_10003618
.text:1000201C STR R3, [SP,#0x248]
.text:10002020 STR R5, [SP,#0x24C]
.text:10002024 STR R5, [SP,#0x250]
.text:10002028 STR R5, [R6,#8]
.text:1000202C MOV R0, R9
.text:10002030 MOV R1, #0x13
.text:10002034 BL sub_100024E4
.text:10002038 STR R5, [R6,#0x44]
.text:1000203C STR R5, [R6,#0x48]
.text:10002040 STR R5, [R6,#0x54]
.text:10002044 STR R5, [R6,#0x58]
.text:10002048 ADD R0, R6, #0xC
.text:1000204C BL sub_10002464
.text:10002050 MOV R0, R9
.text:10002054 BL sub_100024F4
.text:10002058 ADD R2, SP, #0x2A8
.text:1000205C MOV R3, #0x32
.text:10002060 STR R3, [SP,#0x2A8]
.text:10002064 STR R3, [R2,#4]
.text:10002068 STR R3, [R2,#8]
.text:1000206C MOV R3, #3
.text:10002070 STR R3, [R2,#0xC]
.text:10002074 STR R5, [R2,#0x10]
.text:10002078 STR R5, [R2,#0x14]
.text:1000207C MOV R3, #2
.text:10002080 STR R3, [R2,#0x18]
.text:10002084 STR R5, [R2,#0x1C]
.text:10002088 STR R5, [R2,#0x20]
.text:1000208C ADD R4, SP, #0x2CC
.text:10002090 MOV R0, R4
.text:10002094 LDR R1, =dword_10003548
.text:10002098 MOV R2, #0x20
.text:1000209C BL sub_10002574
.text:100020A0 STR R5, [R4,#0x48]
.text:100020A4 BL sub_10002774
.text:100020A8 MOV R1, R0
.text:100020AC LDR R0, [SP]
.text:100020B0 BL loc_100009E0
.text:100020B4 MOV R0, R7
.text:100020B8 ADD R1, R8, #1
.text:100020BC BL sub_10002704
.text:100020C0 ADD R3, SP, #0x14
.text:100020C4 STMIA R3, {R0,R1}
.text:100020C8 ADD R0, SP, #0x260
.text:100020CC MOV R1, R3
.text:100020D0 BL sub_10002504
.text:100020D4 BL sub_10002774
.text:100020D8 MOV R1, R0
.text:100020DC LDR R0, [SP]
.text:100020E0 BL loc_10000AB8
.text:100020E4 MOV R10, #1
.text:100020E8
.text:100020E8 loc_100020E8 ; CODE XREF: sub_10001EF0+B8j
.text:100020E8 ; sub_10001EF0+E4j ...
.text:100020E8 CMP R10, #0
.text:100020EC BNE loc_10002104
.text:100020F0 ADD R0, SP, #0x520
.text:100020F4 ADD R1, SP, #0x318
.text:100020F8 BL sub_10002F34
.text:100020FC CMP R0, #0
.text:10002100 BEQ loc_10001FB4
.text:10002104
.text:10002104 loc_10002104 ; CODE XREF: sub_10001EF0+1FCj
.text:10002104 BL sub_10002424
.text:10002108 ADD R0, SP, #0x34
.text:1000210C LDR R1, [SP,#4]
.text:10002110 BL sub_10002F44
.text:10002114 CMP R10, #0
.text:10002118 BNE loc_100021A0
.text:1000211C ADD R4, SP, #0x40
.text:10002120 MOV R0, R4
.text:10002124 MOV R1, #0x100
.text:10002128 BL sub_100024E4
.text:1000212C ADD R0, SP, #0xC
.text:10002130 LDR R1, =aNoSerialFoundF
.text:10002134 BL sub_100023E4
.text:10002138 MOV R0, R4
.text:1000213C ADD R1, SP, #0xC
.text:10002140 ADD R2, SP, #0x630
.text:10002144 ADD R2, R2, #0xC
.text:10002148 BL sub_100024B4
.text:1000214C STR R10, [SP,#8]
.text:10002150 MOV R0, R4
.text:10002154 ADD R1, SP, #8
.text:10002158 BL sub_10003104
.text:1000215C MOV R4, R0
.text:10002160 LDR R3, [R4]
.text:10002164 LDR R1, =0x8CC0059
.text:10002168 LDR R12, [R3,#0x78]
.text:1000216C MOV LR, PC
.text:10002170 BX R12
.text:10002174 ; ---------------------------------------------------------------------------

so "NoSerilaFound" call is here:
.text:10002104 loc_10002104
What can I do to bypass it?
Or should I make it jump anywhere from here:
.text:10002118 BNE loc_100021A0
this is the text wiev:ED 00 00 EB 0C 00 8D E2
I need to know the command to modify (BE?) and how can I assemble it?

Thanks a lot mates.
(In assembler I would bypass it by nopping...)
monmur
03-29-2004, 03:11 AM
g'morning,

there's no 90h nop on ARM. what you basically do instead is changing the command to MOV R0, R0. the opcode therefore would be 00 00 A0 E1 ... use any hexeditor to patch the .app file. at least up to the ida version I'm using you can't reassemble arm code. but well, my ida is damn old ...

changing the BNE to BEQ would be

xx xx xx 1A -> xx xx xx 0A

there's an opcode list at http://www.ka0s.net

cya
Kassar
03-29-2004, 04:45 AM
Thank you very much, i'll try.
g'morning,

there's no 90h nop on ARM. what you basically do instead is changing the command to MOV R0, R0. the opcode therefore would be 00 00 A0 E1 ... use any hexeditor to patch the .app file. at least up to the ida version I'm using you can't reassemble arm code. but well, my ida is damn old ...

changing the BNE to BEQ would be

xx xx xx 1A -> xx xx xx 0A

there's an opcode list at http://www.ka0s.net

cya
Bengaly
03-30-2004, 02:43 PM
sis is just an archive (like zip is).
sis file contains the executable file (*.app),bitmap (mbm), aif..and some more files.
in order to disassemble any s60 written application, u must install it on your phone, than plug your USB cable (or use BlueTooth dongle), and copy the *.app (GUI application - executable under Symbian OS) to windows.
now, the only one out that you could do it with atm (probably nokia has some more phones out now, check thier pages) is with n-gage.

disassembly is for the ARM(9) as your target CPU.
monmur
03-31-2004, 01:09 AM
well, unmakesis works with symbian 6 and still many of the new symbian 7 apps use the old (though unicode) file format. and as far as i see, makesis itself doesn't even support creating those compressed s7-sis files.

this means, that installing and copying back the .app files is always a possibility BUT I'd rather use atzplzw's sweet unmakesis to extract the files from the archive on my desktop pc.

unmakesis:
http://mitglied.lycos.de/atzplzw/

sis file format:
http://homepage.ntlworld.com/thouky/software/psifs/sis.html

hav' a nice one ...
monmur
04-04-2004, 06:15 AM
does anyone have a working link to erl.exe ?
JMI
04-04-2004, 01:15 PM
Monmur:

Here's a copy of a post I made in the Newbie Forum a short while ago which applies to you as well.

Time to notice the statement in the title of the Tools of the Trade Forum, which states:

"Do not ask where to get the Tools of our Trade. Do not even think about asking for them."

Those kinds of things you need to do on your own. Searching on the net is a very important skill for would be crackers. If you lack skill in seaching, there is a link at the bottom of the forums for +Fravia's Searchlores, where you can learn how to do it. There is even a "lite" version available with just the debugger.

Regards,
monmur
04-04-2004, 05:05 PM
Searching on the net is a very important skill for would be crackers. If you lack skill in seaching, there is a link at the ....
Regards,

and not underestimating people around you is another important one ..
dELTA
04-04-2004, 05:39 PM
...and yet another one might be to formulate your questions and requests in a way that doesn't leave so much room for people to unnecessarily underestimate you then I guess. :rolleyes:
JMI
04-04-2004, 05:41 PM
I have not "estimated" you at all, either "over" or "under". I simply "advised" you of our rules, of which you should have been aware, and provided a link "If you lack skill in seaching."

Whether or not you have skills in searching, and whether or not you tried and failed to find what you were seeking, our rules still prohibit your asking for it here. That rule still applies, no matter how I might "estimate" you, and whether or not the rule meets with your approval.

Regards,
aknd
06-07-2004, 03:28 AM
sis is just an archive (like zip is).
in order to disassemble any s60 written application, u must install it on your phone, than plug your USB cable (or use BlueTooth dongle), and copy the *.app (GUI application - executable under Symbian OS) to windows.
now, the only one out that you could do it with atm (probably nokia has some more phones out now, check thier pages) is with n-gage.

disassembly is for the ARM(9) as your target CPU.

Well i use IDA 4.3 Advanced to disassemble a file of my own, just to practice how it could be done. unfortunately, the disassembly could not work on the code and it didn't give meaningful ARM instructions, instead it display the code section as it is data for example

.text:10000000 ; Segment type: Pure code
.text:10000000 AREA .text, CODE, READWRITE, ALIGN=0
.text:10000000 ; ORG 0x10000000
.text:10000000 CODE32
.text:10000000 dword_10000000 DCD 0xF028B500, 0xBC02FCD7, 0x4708, 0x1C06B570, 0x48271C0D
.text:10000000 ; DATA XREF: .text:10041CD4o
.text:10000000 DCD 0x48276070, 0x48276330, 0x6BB16030, 0xD0052900, 0x68826808
.text:10000000 DCD 0x21031C08, 0xFBD2F039, 0x29006BF1, 0x6808D005, 0x1C086882
.text:10000000 DCD 0xF0392103, 0x6C31FBC9, 0xD0052900, 0x68826808, 0x21031C08
!!!!
i already set the target processor to ARM before the disassembly. what do you think was wrong??

Thanks
aknd
monmur
06-07-2004, 05:28 AM
i recon that's because you set the processor type to ARM but didn't set the Thumb mode flag. i'm not sure if CTRL + T is the rite shortcut (don't have ida here with me). but normally when you disassemble an executable for arm, ida tells you that arm has those 2 different modes and how to change them. (big fat messagebox rite before disassembling starts.
aknd
06-07-2004, 06:11 AM
i recon that's because you set the processor type to ARM but didn't set the Thumb mode flag. i'm not sure if CTRL + T is the rite shortcut (don't have ida here with me). but normally when you disassemble an executable for arm, ida tells you that arm has those 2 different modes and how to change them. (big fat messagebox rite before disassembling starts.

Thanks to you, well it works Alt+G then change the value of T register into any thing, the IDA processor begin to realize the thumb instructions


simple rsa
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > simple rsa
PDA

View Full Version : simple rsa

Donan
02-10-2004, 10:05 PM
Hi all! I was looking for a way to learn cripto, speacially RSA and found this crackme. I think its impossible to be more simple. But I have a few (lots) questions... First its TSCube RSA-24 crackme. Can be found at www.crackmes.de and some others site, just use google.
Ive also found a couple of tutorials, but none explain the crackme itself. Only RSA...

00402871 CALL 004137E8 ;"GetDlgItemTextA" API
00402876 LEA ECX,[ESP+24]
0040287A PUSH ECX
0040287B MOV ECX,EBX
0040287D CALL 004029B0 ;the RSA function!
00402882 TEST EAX,EAX ;check
00402884 JZ 00402912 ;teh jump

Tracing it the call....

004029CD |. 68 DC004200 PUSH crackme.004200DC ; ASCII "9901"
004029D2 |. 8D8C24 E400000>LEA ECX,DWORD PTR SS:[ESP+E4]
004029D9 |. E8 52E7FFFF CALL crackme.00401130
004029DE |. 68 D0004200 PUSH crackme.004200D0 ; ASCII "12790891"
004029E3 |. 8D4C24 1C LEA ECX,DWORD PTR SS:[ESP+1C]
004029E7 |. C78424 6406000>MOV DWORD PTR SS:[ESP+664],0
004029F2 |. E8 39E7FFFF CALL crackme.00401130
004029F7 |. 68 C8004200 PUSH crackme.004200C8 ; ASCII "8483678"
004029FC |. 8D8C24 7402000>LEA ECX,DWORD PTR SS:[ESP+274]
00402A03 |. C68424 6406000>MOV BYTE PTR SS:[ESP+664],1
00402A0B |. E8 20E7FFFF CALL crackme.00401130
00402A10 |. 68 C0004200 PUSH crackme.004200C0 ; ASCII "5666933"

I can see that 9901 is probably "e". All others numbers are harder to guess.
First question, whats CALL crackme.00401130? Its probably a bignum function but made me wonder at the beginning. The whole crypto stuff is done below and its quite easy to identify some calls such as 00402B1D CALL 00402310 ;RSA-Encrypt!

the rest I have just a little idea...

so how to identify the N and the messages?
Whats the best bignum lib for a beginner?
mike
02-10-2004, 11:22 PM
Try http://www.alpertron.com.ar/ECM.HTM for a fast factoring program. That ought to make it clear which of the numbers is n!
ZaiRoN
02-11-2004, 05:04 AM
Hi Donan,
this crackme has been discussed in an old thread inside the mini project area: http://www.woodmann.net/forum/showthread.php?t=3950
Maybe it helps you...

ZaiRoN
Donan
02-12-2004, 02:57 PM
Hi Zairon and Mike! Thanks for the reply!

The other thread was good to understand what was going on...

Is there a way to find out wich cripto lib was used? Ive tried looking
at imports using IDA but had no luck... with this info I could compile an example and compare it to the program...

anyone got any hints?!

thanks

dONAN
ZaiRoN
02-12-2004, 05:37 PM
Hi Donan,
from readme file: "This was coded to test my Bignum library" ;)

ciao,
ZaiRoN


debug registers & SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > debug registers & SI
PDA

View Full Version : debug registers & SI

remains
02-10-2004, 10:32 PM
Hi:

Long time ago i made a lamme program wich allows loading plugins for softice and now i'm trying to make one myself wich prevents anti-bpm tricks. The method i want to use seems symple in theory: hook idt's vector 1 and then set Dr7 register's flag 13 so every time a debug register is going to be accessed my exception handler will be called. The problem is that i can't figure out how do windows and softice handle debug registers. If i change Dr7 directly when executing in softice's environment, i get a system crash. If i change it in the context structure of the debuggees thread, it seems that the changes don't take efect. At this point arises the question: are debug registers mantained in a global manner or are they mantained in a per thread basis ? If they are globaly mantained, how does the system know to wich program's address space does a bpm belong ? And if they are mantained in a per-thread basis, why are only 4 bpms allowed with softice ?

I'll continue debugging and trying to answer that questions myself, but if anyone could give me any idea my poor pc would probably suffer less hard reboots :/.

Bye and sorry for my hardly understandable english :(
Kayaker
02-11-2004, 11:28 AM
Hi

Quickly, A couple of things that might be useful to you are Yates' DRxLOG example - 'Log DRX operations via DR7 General Detection(GD) bit', as well as Spath's Softice Internals document, if you haven't seen either.

Kayaker
remains
02-11-2004, 12:53 PM
Hi again:

Thx for your quick response. I looked spath's article briefly searching in googles cache the highlighted words related with debug registers, but i didn't found what i was looking for. I will take a look to the drxlog program instead.

Thx again for your help.
JMI
02-11-2004, 01:54 PM
Well Spath's article is very close at hand. Try this URL and notice how close to the one you are already on. It is :) :

http://www.woodmann.com/crackz/Tutorials/Siceints.txt

Using "Softice Internals" as the search key words I got this result:

http://search.earthlink.net/search?q=Softice+Internals+&area=earthlink-ws

which listed many working links, several through Links found at the bottom of these pages.

You may also notice that there is a Link for Yates down there also. You will find the second article using "DRxLOG" as your search key word. You will find the article at:

http://66.98.132.48/yates/syscode.htm

Regards,
volodya
02-11-2004, 03:33 PM
Kayaker/JMI

Collegues, I do apologize, but what you are both talking about is old-old-old crap. The question about DR-regs and Soft-Ice is a pretty difficult one. Win9x and NT+ both handle DR-regs in the completely differnet manner!
OK, I'm not going to talk about 9x any more...
On NT the following picture is here, but, unfortunately it is not clear for myself as well. Under NT we DO NOT have TSS. The task switch is a software event, not a hardware one any more. One may go to ntoskrnl and disassemble SwapContext function. There you'll be able to see CR0/CR3 reloading, KPCR-reloading, etc... Now the question arises! A very difficult one. If you go to the Intel Manual you'll notice there so called GD-bits in DR-reg - chapter 15. Citation:

L0 through L3 (local breakpoint enable) flags (bits 0, 2, 4, and 6)
Enable (when set) the breakpoint condition for the associated breakpoint for
the current task. When a breakpoint condition is detected and its associated Ln
flag is set, a debug exception is generated. The processor automatically clears
these flags on every task switch to avoid unwanted breakpoint conditions in the
new task.

G0 through G3 (global breakpoint enable) flags (bits 1, 3, 5, and 7)
Enable (when set) the breakpoint condition for the associated breakpoint for all
tasks. When a breakpoint condition is detected and its associated Gn flag is set,
a debug exception is generated. The processor does not clear these flags on a
task switch, allowing a breakpoint to be enabled for all tasks.

If you set G0-G3 for DR0-DR3 you expect the processor to make a trap upon a task switch if the specified VA is met. BUT THERE IS NO TSS! No hardware task switches!!! How can Windows handle the situation? If the breakpoint comes from the ring-3, one should go deep into KeContextToKframes. The sequence of events is as follows:

ring-3:
SetThreadContext or SEH -> CONTEXT.DRx = VA, CONTEXT.DR7 = mask;

ring-0:
NtConinue->KiContinue->KeContextToKframes
In KeContextToKframes Windows puts the content of the CONTEXT structure in KTRAP_FRAME structure. Along with it Windows makes a lot of checks. Examples are:

.text:00430777 mov ecx, [esi+CONTEXT.Dr1]
.text:0043077A cmp MmHighestUserAddress, ecx
.text:00430780 sbb eax, eax
.text:00430782 not eax
.text:00430784 and eax, ecx
.text:00430786 jmp back1

As you see, here is the check for 7FFFFFFF is made.

.text:0043059C mov [ebx+KTRAP_FRAME.Dr3], eax
.text:0043059F mov eax, [esi+CONTEXT.Dr6]
.text:004305A2 and eax, 0E00Fh
.text:004305A7 mov [ebx+KTRAP_FRAME.Dr6], eax
.text:004305AA mov eax, [esi+CONTEXT.Dr7]
.text:004305AD and ax, 155h
.text:004305B1 test dl, dl
.text:004305B3 mov [ebx+KTRAP_FRAME.Dr7], eax
.text:004305B6 jz short loc_4305D9

As you see, here Windows is playing with G0-G3 bits.
So, ring-3 debugger cannot put a bpm anywhere it wants to!
As to the ring-0 there are no limitations, BUT!
If you set GD bit to 1, there is immediately one hardware feature available to you. As remains mentioned, there should be the int1 vector ready for the situation. But, remains, what are you going to do if something (like StarForce or ExtremeProt) is ALREADY sitting on int 1, ah????? OK, there is perhaps a solution even for this case, but I'm not going to mention it so far.
JMI
02-11-2004, 03:46 PM
Thanks Volodya.

Just one small correction to your observation about my response. I was not "talking about" the "old-old-old crap" at all. :eek: I had only responded to a request for help in finding the articles. I don't believe I made any comment about their usefulness or lack thereof. You other comments, however, were useful and interesting.

Regards,
volodya
02-11-2004, 04:03 PM
:p
JMI, did you get my email about Adobe?
JMI
02-11-2004, 04:12 PM
volodya:

Yes, thank you. I have finally checked that email addy and have gotten "both" of your messages, as you can see. I will use the proper title in the future but am somewhat confused. :confused: Again a "small" correction. My use of "Vlad," here and on exetools was short for "Vladimir," your (now former) nick here, not as an abreviation for "Vladislav." :p

But I would like to use whatever you prefer. Would you prefer "Volodya" or "Vladimir" on this Forum? We could change your registration here, if you wish, to "Volodya" keeping your current post count and other information.

Regards,
evaluator
02-11-2004, 04:12 PM
Little correcture:

TSS must present in all system which have more then Ring0.
TSS can absent only if system(test?) has only Ring0.

another fact is, that M$ not uses TSS for task-switching..
But it always cares about TSS.
volodya
02-11-2004, 05:01 PM
Of course. In fact, there are two more TSS. One for NMI, another... I forgot :cool:

JMI, convert me to "Volodya" then.
:D
"Vlad" is always in abbreviation of "Vladislav" :D
"Vladimir" and "Volodya" both have the shorten form of "Vova", but the last one I really hate :rolleyes:

OK. Sorry for offtop. As a partial excuse here is the code of SwapContext.

.text:00404334 SwapContext proc near ; CODE XREF: KiUnlockDispatcherDatabase+6Ep
.text:00404334 ; KiSwapThread+BCp ...
.text:00404334 or cl, cl ; esi - KTHREAD
.text:00404334 ; cl - BYTE WaitIrql
.text:00404334 ; ebx - KPCR.SelfPcr
.text:00404336 mov es:[esi+KTHREAD.State], 2
.text:0040433B pushf
.text:0040433C mov ecx, [ebx] ; ecx - *KPCR
.text:0040433E cmp dword ptr [ebx+80Ch], 0 ; KPCR.KPRCB.DpcRoutineActive
.text:00404345 push ecx
.text:00404346 jnz KeBugCheck
.text:0040434C mov ebp, cr0
.text:0040434F mov edx, ebp
.text:00404351 mov cl, [esi+KTHREAD.DebugActive]
.text:00404354 mov [ebx+50h], cl ; KPCR.DebugActive
.text:00404357 cli
.text:00404358 mov [edi+KTHREAD.KernelStack], esp
.text:0040435B mov eax, [esi+KTHREAD.InitialStack]
.text:0040435E mov ecx, [esi+KTHREAD.StackLimit]
.text:00404361 sub eax, 210h
.text:00404366 mov [ebx+KPCR.NtTib.StackLimit], ecx
.text:00404369 mov [ebx+KPCR.NtTib.StackBase], eax
.text:0040436C xor ecx, ecx
.text:0040436E mov cl, [esi+KTHREAD.NpxState]
.text:00404371 and edx, 0FFFFFFF1h
.text:00404374 or ecx, edx
.text:00404376 or ecx, [eax+20Ch]
.text:0040437C cmp ebp, ecx
.text:0040437E jnz zero_CR0
.text:00404384
.text:00404384 loc_404384: ; CODE XREF: SwapContext+107j
.text:00404384 test dword ptr [eax-1Ch], 20000h
.text:0040438B jnz short loc_404390
.text:0040438D sub eax, 10h
.text:00404390
.text:00404390 loc_404390: ; CODE XREF: SwapContext+57j
.text:00404390 mov ecx, [ebx+KPCR.TSS]
.text:00404393 mov [ecx+4], eax ; KTSS.Esp0
.text:00404396 mov esp, [esi+KTHREAD.KernelStack]
.text:00404399 mov eax, [esi+KTHREAD.Teb]
.text:0040439C mov [ebx+KPCR.NtTib.Self], eax
.text:0040439F sti
.text:004043A0 mov ecx, [ebx+KPCR.GDT]
.text:004043A3 mov [ecx+3Ah], ax ; into GDT fs
.text:004043A7 shr eax, 10h
.text:004043AA mov [ecx+3Ch], al
.text:004043AD shr eax, 8
.text:004043B0 mov [ecx+3Fh], al
.text:004043B3 mov eax, [edi+KTHREAD.ApcState.Process]
.text:004043B6 cmp eax, [esi+KTHREAD.ApcState.Process]
.text:004043B9 jz short __ret
.text:004043BB mov edi, [esi+KTHREAD.ApcState.Process]
.text:004043BE xor eax, eax
.text:004043C0 db 66h
.text:004043C0 mov gs, ax
.text:004043C3 mov eax, [edi+KPROCESS.DirectoryTableBase]
.text:004043C6 mov ebp, [ebx+KPCR.TSS]
.text:004043C9 mov ecx, dword ptr [edi+KPROCESS.IopmOffset]
.text:004043CC mov [ebp+KTSS.CR3], eax
.text:004043CF mov cr3, eax
.text:004043D2 mov [ebp+KTSS.IoMapBase], cx
.text:004043D6 xor eax, eax
.text:004043D8 cmp [edi+KPROCESS.LdtDescriptor.LimitLow], ax
.text:004043DC jnz short lldt
.text:004043DE lldt ax
.text:004043E1 lea ecx, [ecx]
.text:004043E3
.text:004043E3 __ret: ; CODE XREF: SwapContext+85j
.text:004043E3 ; SwapContext+102j
.text:004043E3 inc [esi+KTHREAD.ContextSwitches]
.text:004043E6 inc [ebx+KPCR.PrcbData.KeContextSwitches]
.text:004043EC pop ecx
.text:004043ED mov [ebx+KPCR.NtTib.ExceptionList], ecx
.text:004043EF cmp [esi+KTHREAD.ApcState.KernelApcPending], 0
.text:004043F3 jnz short _ret
.text:004043F5 popf
.text:004043F6 xor eax, eax
.text:004043F8 retn
.text:004043F9 ; ---------------------------------------------------------------------------
.text:004043F9
.text:004043F9 _ret: ; CODE XREF: SwapContext+BFj
.text:004043F9 popf
.text:004043FA jnz short ___ret
.text:004043FC mov al, 1
.text:004043FE retn
.text:004043FF ; ---------------------------------------------------------------------------
.text:004043FF
.text:004043FF ___ret: ; CODE XREF: SwapContext+C6j
.text:004043FF mov cl, 1
.text:00404401 call ds:_imp_HalRequestSoftwareInterrupt
.text:00404407 xor eax, eax
.text:00404409 retn
.text:0040440A ; ---------------------------------------------------------------------------
.text:0040440A
.text:0040440A lldt: ; CODE XREF: SwapContext+A8j
.text:0040440A mov ebp, [ebx+KPCR.GDT]
.text:0040440D mov eax, dword ptr [edi+KPROCESS.LdtDescriptor.LimitLow]
.text:00404410 mov [ebp+48h], eax
.text:00404413 mov eax, [edi+KPROCESS.LdtDescriptor.HighWord]
.text:00404416 mov [ebp+4Ch], eax
.text:00404419 mov eax, 48h
.text:0040441E mov ebp, [ebx+KPCR.IDT]
.text:00404421 mov ecx, dword ptr [edi+KPROCESS.Int21Descriptor.Offset]
.text:00404424 mov [ebp+108h], ecx
.text:0040442A mov ecx, dword ptr [edi+KPROCESS.Int21Descriptor.Access]
.text:0040442D mov [ebp+10Ch], ecx
.text:00404433 lldt ax
.text:00404436 jmp short __ret
.text:00404438 ; ---------------------------------------------------------------------------
.text:00404438
.text:00404438 zero_CR0: ; CODE XREF: SwapContext+4Aj
.text:00404438 mov cr0, ecx
.text:0040443B jmp loc_404384
.text:00404440 ; ---------------------------------------------------------------------------
.text:00404440
.text:00404440 KeBugCheck: ; CODE XREF: SwapContext+12j
.text:00404440 push 0B8h
.text:00404445 call KeBugCheck
.text:0040444A retn
.text:0040444A SwapContext endp
remains
02-11-2004, 05:30 PM
Rehi:

JMI: Sorry but i didn't expressed correctly in my last post. What i meant was that i have already read spath's article, but instead of reading it entirely, i looked googles cache of this article, so the terms i searched would appear highlithed. This way i can find rapidly in the document the part that interest me. For example:

h**p://66.102.9.104/search?q=cache:8T0L6kFIFaEJ:www.woodmann.com/crackz/Tutorials/Siceints.txt+%22debug+registers%22+softice&hl=eu&ie=UTF-8

If you scroll down in that page you will rapidly see highlighted in yellow the part wich refers to "debug registers". Sorry for the confusion. I haven't had time to read yate's program code so i don't know if i will find there the answer.

Volodya: I'm having a look to xprotector's anti-debug tricks. It runs in ring0 and at certain point it has a loop wich makes what i supose is a crc (i've just looked it brefly) to the code that is going to be executed after the loop and also to the code of the loop itself, so i can't set a breakpoint outside the loop because it will be detected by the routine. The solution is to set a hardware breakpoint, but the loop itself clears debug registers (except dr7 register wich is set to 700h). Tracing the code until it ends the loop isn't a solution in itself...

You asked what would i do if int 1's vector would be already hooked by xprot: well, i simply don't let it hook that vector, instead i couldn't use sice to trace the code.

About thread switches: I have seen some interesting things tracing GetThreadContext and such apis, but until now i haven't been able to do a serious work around that because i was trying first to correct my program's bug. If yates's program hasn't the solution to the bug, the only solution i see is kernel hacking around setthreadcontext and exception handling routines. I'm also thinking another possible solution, but i will try it this night (another long long nigth of reversing and good music; it doesn't sound so bad, does it ?)

Well, a lot of thanks againg, and sorry for my english, plese try to understand my efforts to make my posts understandable.
JMI
02-11-2004, 05:47 PM
Volodya:

Please call your parents and advise them that you have now officially been re-christened as "volodya" and they should stop referring to you by that "other" name. :D I think I found all the old references and, where appropriate, updated them to "volodya" also, in hopes of avoiding any confusion about just who the heck you are. :D And I always did say your Russian was way, way better than mine.:D

My own given name was usually extended, rather than abbreviated. It usually came out as something like; "Hey sh*tforbrains" or some such flattering designation. But that was just my Mom's way of showing affection. :p

Regards,
evaluator
02-12-2004, 02:03 AM
to remains

>If i change Dr7 directly .. in softice's environment, i get a system crash.
try playing only with 13flag & your handler must proper manage
all 13flag related occurences.

>are debug registers mantained in a global manner or .. per thread basis?
W2K,XP(NT-systems) mainteins DRx per Process basis.
(however Ntice cracks this system enhancement)
W98se not mainteins DRx, so they are global
(& dangerous, bcz in other process can happen crash)

>If they are globaly mantained, how does the system know to wich program's
debuger must care about correct process.

>why are only 4 bpms allowed with softice ?
Read manuals.
volodya
02-12-2004, 09:55 AM
JMI

Mucho gracias, senior :D :D :D
JMI
02-12-2004, 11:25 AM
You are welcome. Keep that good information flowing in and best of luck with your website and the attacker.

Regards,
[yAtEs]
02-13-2004, 11:51 AM
If i change Dr7 directly when executing in softice's environment, i get a system crash.

:(

I had fun with his also, the problem is that you must handle the exception
in your handler, you need to emulate the instruction then the important
bit of increasing EIP so you dont cause an exception loop, you probably
jmp to the original handler afterwards, or bpint 1 for testing, and softice
int 1 handler doesnt know what to do and dies with it, and general system int1 seems to ignore it :p

/yates.
remains
02-13-2004, 12:54 PM
Yes, I saw that the problem is there, so i've made some proves. First i made the next prove in the handler (i've earlyer changed dr7's bit 13's value succesfully and hooked vector 1):

OurExceptionHandler proc ;vector 1's new handler

mov eax, [esp]
int 3
...

When i'm in a ring3 program with sice and i hit f8, before the handler gets naturally called due to the single step feature, sice makes it's own work, and it touches debug registers (your program showed me that too), so when this happens the code showed above gets called. What i wanted to see with this code is if i got in eax the VA where the exception was generated. But here it comes the funny part (wich would be funnyer without the system crash wich comes later). When i hit f8 in sice the "int 3" i put in the handler doesn't get called. Instead sice pops again in the VA where the exception is generated in Ntice.sys (mov eax, dr0). What follows is the system crash (sice has problems debugging itselve, duh)

So, as softice sets fs register to 10h, i've though it could be a good idea just to make a iret without further processing when i get this value in fs. Something as:

OurExceptionHandler proc

push eax
mov ax, fs
cmp ax, 10h
jz epilog2

epilog2:

pop eax
iret

Anyway when this code gets called i get a system crash too. Now I'm downloading a very interesting 2*100 mb file with my modem so until tomorrow i'm not going to be able to make more proves.

Again lots of thanks for your help, no i know i'm closest to the solution of the problem :)
volodya
02-13-2004, 03:44 PM
Now I'm downloading a very interesting 2*100 mb file with my modem so until tomorrow i'm not going to be able to make more proves

I know what file you are downloading :D
Really cool one. :D
dELTA
02-13-2004, 05:37 PM
Yep, who wouldn't want to download something that contains the full source code to Notepad... :D
nikolatesla20
02-13-2004, 05:54 PM
volodya and delta and JMI: Not trying to start any flames, but my goodness enough thread hijacking lately? :p

(I just hijacked this thread to say that, so I'm no better)

-nt20
Timbo
02-18-2004, 05:47 PM
????
I took the dial command like this
mov eax, my value
mov dr7,eax
sti
ret
no error with xp so far ??


problem with rsa
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > problem with rsa
PDA

View Full Version : problem with rsa

xoder
02-11-2004, 08:55 AM
hello all,

im just having a closer look at a program thats using a 64-bit rsa protection. working with some tutorials and other docs i got to this point:

.text:00409BEC push esi ; empty miracle variable
.text:00409BED mov ecx, [eax]
.text:00409BEF mov eax, [edx]
.text:00409BF1 push ecx ; push n
.text:00409BF2 mov ecx, [esp+18h+arg_4]
.text:00409BF6 push eax ; push e
.text:00409BF7 mov edx, [ecx]
.text:00409BF9 push edx ; push my entered serial
.text:00409BFA call _powmod ; serial^e mod n

as far as i understand its encrypting(decrypting?) my serial with the powmod function from the miracl library.for e,n,d,p,q i got the following numbers:

n=81B95467E440DD59
p=D5C477E9
q=9B5A43F1
d=49352151A885660D
e=101B445

after it has encrypted my serial it uses

.text:00409C47 call _cotstr

to make the result to string(im not really sure if i understood the miracl documentation right)
after its done with converting there is a compare routine that checks the result from encryption(decryption?) to the following string: B60FE67B
my problem is that im getting pretty confused how to calculate my serial to be B60FE67B after it got encrypted(decrypted?)

should i encrypt it before with: B60FE67B^e mod n
or : B60FE67B^d mod n
(i think i tried both but no luck seems im not getting something right here)

regards xoder
human_thought
02-11-2004, 11:07 AM
Hello xoder,
and hello to everyone in this forum.This seems to be a very nice rce place,which for some weird reason i found out only recently.

as far as i understand its encrypting(decrypting?) my serial with the powmod function from the miracl library.for e,n,d,p,q i got the following numbers:

It's really encrypting your serial since the powmod function has a parameter for the public key(e).So if you have a comparison to a static value that has to be fulfilled,you have to perform RSA decryption:

Static_Value ^ d mod N = Serial

This should be your correct serial i guess...

human_thought
xoder
02-11-2004, 02:16 PM
well i tried but it still doesnt work, seems there is something i havent seen in this protection, gonna have a closer look.

could someone possibly post a small visual studio .net project here that uses the miracl library? im trying to get it running since 3 hours no luck. maybe someone knows how to get it running, it would help me alot on getting some feeling for rsa.
ZaiRoN
02-11-2004, 02:29 PM
Hi xoder, im trying to get it running since 3 hours no luckWhich is exactly your problem between .net and miracl library?

Zai
xoder
02-11-2004, 02:52 PM
i found some project on the web, lemme see if i can get it working it seems i included the wrong headers.
ZaiRoN
02-11-2004, 03:34 PM
Ok but also take a look at the MSVISUAL file located inside miracl directory (if I am not wrong...), it explains all the tasks you need to do in order to set-up a working project.
Personally, I use to include 'miracl.h' and add ms32.lib to the project... it works :-)

Good luck,
ZaiRoN
xoder
02-11-2004, 03:59 PM
well yeah that was the first thing i was stuck, i didnt find a way to insert ms32.lib into the project. at least it didnt work the way it was described in the msvisual.txt since i use visual studio .net 2003. do you have a clue how it works in vs .net 2k3?
xoder
02-11-2004, 05:06 PM
it seems i got them added, but it still refuses to run. i did the following steps to get them into the project:
1. open project properties tab
2. go to linker
3. add ms32.lib and bc32.lib to additional dependencies
4. include "big.h"

result: fatal error LNK1136: invalid or corrupt file

any ideas?
human_thought
02-11-2004, 05:28 PM
Have you also include miracl.h?

human_thought
ZaiRoN
02-11-2004, 05:43 PM
Hi,
the method you used to add the lib file is correct.
bc32.lib is designed for borland c++ compiler, if you use .net you don't need to add it to your project.
LNK1136: The input file either has a corrupt header or is zero size or abnormally small.I never seen this error, maybe one of the file is really corrupted... is this error referred to a particular file?

Later,
Zai
xoder
02-12-2004, 03:58 AM
human_thought, neither including miracl.h nor big.h worked, i just tried big.h cause i saw it in a project i found on the web and i thought its worth a try...

zai: no its a general error i just get the project name as reference. while reading through msvisual.txt i came across a point that tells to recompile the miracl lib when using it with visual studio mfc, is that really necessary?
ZaiRoN
02-12-2004, 04:45 AM
I don't use mfc and I don't know if it's really necessary but, it's often better to follow these 'hints' ;)
xoder
02-12-2004, 10:21 AM
ok, im gonna try my luck with a (hopefully successful) recompile. i gonna let you know if it helped.
xoder
02-12-2004, 11:31 AM
i actually managed to rebuild the miracl library with tons of warnings during build process. now i have another problem when trying to use it. i include "big.h" into my project also put "big.cpp" into it. but when trying to compile my program i get tge following errors:
1. error LNK2005: _multiply already defined in miracl2.lib(mrmodmul.obj)
2. error LNK2005: _redc already defined in miracl2.lib (mrmodmul.obj)

any ideas how to fix this?
xoder
02-12-2004, 02:10 PM
ok i got one step further again... i build the library a second time and now the redefinition error from my previous post is gone. in my project i include the "big.h" and "big.cpp" and i can at least compile it without errors. the problem now is that when i try to create an instance of big the program crashes with an unhandeled exception that comes from on of the Big() constructors....since i dont seem to get this stuff running, does anyone know how to fix this or if there are other libraries to use for bignum calculations?
mike
02-12-2004, 08:09 PM
If you want a bignum calculator, I think there are some online; it isn't hard to write your own, either. You could get Perl and use the BigInt package. Or get MuPad.

Or get Crypto++ from Wei Dai's site; it has good bignum support.
xoder
02-13-2004, 07:43 AM
mike, are you familiar with crypto++? i could need some help with it to set up an function with rsa encrypt. i downloaded the cryptosample from sourceforge but i cant get it running with visual studio 2003. even setting up my own rsa encrypt function doesnt work could you possibly give me some help with it?
dELTA
02-13-2004, 01:22 PM
I'm sure someone could help you, if you were only a little bit more specific than that... :)
xoder
02-15-2004, 12:36 PM
i had a more detailed look on this program and the encrytion routine but i still dont get it. i tried alot but it seems nothing im doing leads to a solution, im totally stuck, maybe someone can help.

.text:00409BD0 push ecx ; save register
.text:00409BD1 push esi ; save register
.text:00409BD2 push edi ; save register
.text:00409BD3 push 0 ; init value for the new mirvar
.text:00409BD5 mov [esp+10h+var_4], 0 ; ?
.text:00409BDD call _mirvar ; create new mirvar
.text:00409BE2 mov edx, [esp+10h+arg_8] ; adr of exponent -> edx
.text:00409BE6 mov esi, eax ; adr of new mirvar -> esi
.text:00409BE8 mov eax, [esp+10h+arg_C] ; adr of modul -> eax
.text:00409BEC push esi ; empty mirvar for result of powmod
.text:00409BED mov ecx, [eax] ; modul -> ecx
.text:00409BEF mov eax, [edx] ; exponent -> eax
.text:00409BF1 push ecx ; modul n ( 8D4861EE1D906A2D )
.text:00409BF2 mov ecx, [esp+18h+arg_4] ; adr of entered serial -> ecx
.text:00409BF6 push eax ; exponent e ( 101B445 )
.text:00409BF7 mov edx, [ecx] ; load adr of entered serial in edx
.text:00409BF9 push edx ; entered serial
.text:00409BFA call _powmod ; serial^e mod n (if i got it right==RSA), result in esi
.text:00409BFF push 0 ; init value for mirvar
.text:00409C01 call _mirvar ; create a new mirvar
.text:00409C06 mov edi, [esp+24h+arg_0] ;
.text:00409C0A push eax ; new mirvar
.text:00409C0B push esi ; mirvar with result
.text:00409C0C mov [edi], eax ; save adr of mirvar containing the result in [edi]
.text:00409C0E call _copy ; copy result of powmod to new mirvar
.text:00409C13 push esi ; push adr of mirvar to kill
.text:00409C14 call _mirkill ; kill old result
.text:00409C19 add esp, 24h ; ?
.text:00409C1C mov eax, edi ; mov return value to eax (mirvar with result)
.text:00409C1E pop edi ; restore register
.text:00409C1F pop esi ; restore register
.text:00409C20 pop ecx ; restore register
.text:00409C21 retn

after this call has been executed my fake serial "4343434345454545" ("EEEECCCC" in ascii) was encrypted to "5D1EF5CFD6D4B1AF" (unprintable ascii).
the program now compares the encrypted serial to "4236304645363742" ("B60FE67B" in ascii). from the above call i took n and the exponent e and
inserted them into te's rsatool, which gave me the following two primes p=30B9E91, q=2E647197DD and d=3AE0DDA74A7F480D. my conclusion was, since
the program encrypts the serial c=m^e mod n i have to decrypt the valid serial with d before entering it into the program. m=c^d mod n is the
formula i thought that is right for this purpose. i tried a few different attemps to calculate the right serial but something doesnt seem to work.
i tried to calculate:

4236304645363742^d mod n which seemed to be the most logical to me but te's rsatool told me something about M>N.

i decided to code a little tool with the miracl library just to see what B60FE67B^d mod n is. i succeeded after some days of trying and my program
gave me "406A95C49EADCF02". i tried it in the program but it turned out that its a wrong serial, it was encrypted to some unreadable ascii crap.
so i thought i could patch the program at runtime just to be sure they didnt mess something up with the powmod function so i patched the exponent e
in memory to the private key d "3AE0DDA74A7F480D" right before the programs uses _cinstr to make e a mirvar. following this idea the program should
calculate the m=c^d mod n for me. as result i got "1228394F88E9A157". but as already expected this also did not work...

currently im running out of ideas....a patch would be pretty simple there is just one flag i needed to patch but since its just rsa-64 it should be
possible to somehow calculate a proper serial. maybe someone can give me a hint about how to get "4236304645363742" after the encrypt function.
does it maybe have something to do with the mip->IOBASE or something else specific to miracl maybe reverse byte order?
mike
02-15-2004, 03:57 PM
First do the exponentiation & stuff on a bignum calculator so you don't have to worry about things like endianness, implementations, etc. If some tool tells you p and q, multiply them together to make sure you get n back. Do the exponentiation in a controlled system where you know what's going on, and then see where things differ in this system.

If you want more explicit help, post n,p,q,d,e,m,c and I'll doublecheck your answers.
xoder
02-16-2004, 03:47 AM
mike, do you have the url to such a bignum calculator? i just found an applet but since i work on my notebook i'd prefer to have it as an executable.
Donan
02-16-2004, 10:44 AM
Check YACAS
Thats what my uni teacher used when he got to RSA.

http://yacas.sourceforge.net/downloads.html

Its easy to use, has alot nice functions implemented.. Like, IsPrime() IsCarmichaelNumber(), Factor(), Mod()..... and its fast

Donanfer
xoder
02-16-2004, 01:30 PM
thx donan will check it out. i hope it runs better than this calculator i have right now, it makes my processor usage go up to 100% but gives me no result i guess it just hangs ;)
xoder
02-16-2004, 01:45 PM
can someone tell me how many hours/days it take to calculate :

4236304645363742^8D4861EE1D906A2D

on a 2,2ghz cpu? im sitting here waiting and i dunno if the program just crashed or if its still working. how can miracl solve m^e mod n in less than 1 second but m^e takes so long?
dELTA
02-16-2004, 07:25 PM
It has most likely crashed or malfunctioned in some other way. That calculation should be done in notime...
xoder
02-17-2004, 04:47 AM
does anyone know/have a good calculator for bignum operations? the only two i've found and tried are YACAS and BigInt Calculator but both seem to crash on the above math operation...
dELTA
02-17-2004, 08:47 PM
To be able to handle such large numbers you usually mod them with something during the same operation. the result would become all too large otherwise, I was assuming you already did that when I replied to your last post.
mike
02-18-2004, 05:44 PM
xoder, if 10^100 has 100 digits, how many digits are in

4236304645363742^8D4861EE1D906A2D ?

The way you calculate that thing mod n is NOT by doing the exponentiation first and then reducing modulo n. You first express the exponent as a bit string and then square and multiply, reducing mod n at every step.

For example, to raise m to the 11th (=1011 in binary) power, you calculate
1=m^0
1*m=m^1 (1=1 in binary)
((1*m)^2 mod n)=m^2 (2=10 in binary)
(((1*m)m^2 mod n)^2 mod n) = m^4 (4=100 in binary)
((((1*m)m^2 mod n)^2 mod n)*m mod n) = m^5 (5=101 in binary)
(((((1*m)m^2 mod n)^2 mod n)*m mod n)^2 mod n) = m^10 (10=1010 in binary)
((((((1*m)m^2 mod n)^2 mod n)*m mod n)^2 mod n)*m mod n) = m^11 (11=1011 in binary)
xoder
02-19-2004, 04:40 PM
i finally managed to get a valid serial. it turned out that i had missed some part of the protection, so sorry guys for making this big confusion. i also wanna thank a nice chinese guy for showing me what i did wrong. im gonna code a keygen for it and also write a small tutorial, so if anyone knows a site that publishes tutorials or wanna have it when its done just let me know.

thank you all

xoder
Donan
02-21-2004, 12:11 AM
Post the tutorial here =D We all would like to read something about RSA...


New lamer meats forum..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > New lamer meats forum..
PDA

View Full Version : New lamer meats forum..

Justin000
02-11-2004, 09:45 PM
Hi,

Nice site and all.. i like the recycling idea. I looked quite some time to find the old fravia's.. but now i find this daily updated forum. Nice. Proper.

So... already a lame question :

ne1 tried to take a look at Slock / SlockPK or perhaps dealt with it before ?
They are challenging us. Take a look at their site.

bbl,
Justin Time
esther
02-11-2004, 10:21 PM
>They are challenging us.

They are challenging you LOL

And you are challenging the forum :eek:
Justin000
02-12-2004, 12:45 AM
Hmm..
Well, if someone is interested in a challenge, check out the hxxp://www.crypto-central.com/slock/slock_prot_basics.html. It's even FUN to read.

SLockPK uses an encrypted “Initialisation Certificate” to store this sensitive information. The information is encrypted using “Public Key” (PK) encryption, which means that only one person can encrypt the information (the holder of the secret key – the author) but everyone can decrypt it (anyone who runs the software). For more information on how this is achieved, see hxxp://www.crypto-central.com/slock/slockcrypto.html

I saw SLock passing by when i was struggling with hxxp://www.davilexbusiness.nl/producten/downloadProduct.asp?ProductID=71&CustomerID=&Hash=6dc8d197c6298cfb307a8ae5f61e20df6730c21a The unpacked Dede project file comes out nice. IDA gives me a lot of info about the Scipio Datamodule. But it's keeping me up for too long :( Gotta finish some other stuff first.

So.. i release this challenge here. I know i'm new to this forum and you probably think i want you to hack this bi@tch for me. No my friend.. it's just a hackme.exe ! :D If you had clicked the first link you would have known what i'm bothering you all about ;) So.. If you are bored with doing lame cracks all over again, go take a look !! Don't even give me your notez, because i'm not finished with the $#%!@ !!

Regards, J. Time
JMI
02-12-2004, 02:32 AM
Justin000:

Do you, by any change, appreciate the humor in your spelling of the title to this thread? It's way better with your spelling of "meets" as "meats" because some suggest that newcomers to the Newbie Forum are "fresh meat" but that's only true if they skip the large red letters.

I assume you did check out the +fravia archive linked at the bottom of the page.

And while it is "way" off topic, your avitar is vaguely familiar to me and I wonder if you would identify the individual in the picture. Looks to me like a book jacket cover, but it's hard to tell at that size and my tired old eyes. Just curious. :cool:

Regards,
evaluator
02-12-2004, 07:40 AM
i already reconstructed this title as:
"New lamer eats forum.."
Solomon
02-12-2004, 08:58 AM
SLockPK uses RSA-1024. And the vendor sells their source codes. Long time ago they put the earlier C++ Builder versions of this baby on their site which contains some interesting *.h/*.obj files for us to read. :D
Justin000
02-12-2004, 07:52 PM
What large red letters ? Where.. ? :D

The avatar ? Looks familiar ? Am i dead famous ? (whoooops.. idia)
Look closely into the picture.. look into my eyes... into Baba !!
ofn:mainbaba2.jpg

Justin
JMI
02-12-2004, 09:50 PM
The first picture, the one without the breasts, does sort of look like Meher Baba in his younger years. :cool:

Regards,
UrgeOverKill
02-12-2004, 10:22 PM
hmmm, kinda looks like Gallagher.
JMI
02-13-2004, 12:40 PM
Nope. No watermellon juice. ;) With the addition, however, there could be "mellon" juice. :D

Regards,
Woodmann
02-13-2004, 07:56 PM
Howdy,

Einstein with a dye job :p

Woodmann
JMI
02-13-2004, 08:00 PM
I've seen many pictures of Einstein through his years, but none with that long a "do." :D

Regards,
R@dier
02-15-2004, 11:41 PM
I've seen many pictures of Einstein through his years, but none with that long a "do." :D

Regards,

JMI, didn't you go to school with him ?
:D

R@dier
JMI
02-16-2004, 02:09 AM
Well, it's all relative. :eek: I think I may have been his supervisor in the postal department there in Germany, but it was so long ago, I just can't seem to remember clearly. What were we talking about? :confused:

Regards,


How to unpack a .sys file?(device driver)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to unpack a .sys file?(device driver)
PDA

View Full Version : How to unpack a .sys file?(device driver)

cloud_y
02-12-2004, 11:40 AM
Although .sys is a PE file, but I think dumping .sys is very different from
dumping a exe or a dll.

Anyone can give me some suggestions in unpacking .sys file?
how to find the OEP?
how to dump the import table? (I think ImportRec will not work in Ring 0.)

I used google but found nothing helpful.
//thanks
AndreaGeddon
02-12-2004, 12:41 PM
As you correctly said, it is a PE :)
The import table is the same in a PE, if you see a non crypted .sys you can see in the import table the imports from ntoskrnl. The entry point is the one specified in the PE, it corresponds to the DriverEntry function of the driver, in which i suppose the self-unpacking code should reside. After that, usually the callbacks of the driver are placed in the driver_object structure (see ddk and related documentation for this) and they are the ones you should be interested in.
Bye!
AndreaGeddon
LiSa
02-19-2004, 11:24 AM
Some invaluable info abou sys in miniproject section. If well protected, you will not be able to live dump a .sys as a .exe because of int1 and int3 tricky redirections. Anyway, don't forget to unprotect pages with an or CR0
good luck
LiSa
evaluator
02-19-2004, 01:34 PM
you can unpack SYS file by debugging step-by-step.
for sympbols, by address determine those names, write down & then build new Import table.

What SYS are you unpacking?


Where Did +Tsehp Gone ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Where Did +Tsehp Gone ?
PDA

View Full Version : Where Did +Tsehp Gone ?

LaBBa
02-12-2004, 12:48 PM
Hi all ..

Well i got a lil good Q for all .. where did +Tsehp has gone ?!
i mean .. the tool revirgin was alwes updated until that MackT stop updating his gr8 tool ImpREC ... (does it tell us how he build his based tool on ? ;)

well.. i just wanted to know how come there is no more updaes on his tool ..

Regards ,
LaBBa .
JMI
02-12-2004, 01:11 PM
There are other threads here discussing these issues. +Tsehp stopped working of revirgin when the necessities of "real life" required his attention on other projects, like making a living. Funny how that works. :rolleyes:

As to where he has gone, I believe he hasn't actually "gone" anywhere new. You can probably still find him somewhere in France if you have the proper skills. :D As to why he is no longer "here," this has also been discussed. That "discussion" essentially was that it would not be discussed beyond notification that he decided to end his formal relationship with this Forum.

Regards,
evaluator
02-12-2004, 02:22 PM
Hi is dead for us.
JMI
02-12-2004, 02:31 PM
No dear, Daddy just doesn't love us any more. But YOU will always be "special" in his heart, so don't cry.

Regards,
evaluator
02-12-2004, 02:44 PM
Hi is dead for us.
dELTA
02-12-2004, 02:49 PM
Damn, those broken homes can really seriously mess up the kids. I bet eval could even speak proper english before it happened... :D
evaluator
02-12-2004, 03:09 PM
wellll, Labba!?

>>i mean..

or maybe someone helps you?
Js
02-12-2004, 04:43 PM
Last I heard +tsehp had settled down, married golem's sister and he and golem are working on some "secret" decompiler. May just be a rumour ;)
Woodmann
02-12-2004, 07:37 PM
Holy O fuckin shit...........

Last I heard +tsehp had settled down, married golem's sister and he and golem are working on some "secret" decompiler. May just be a rumour

Thats some funny shit :p

I would actually go to France if that were true ;)

Woodmann
JMI
02-12-2004, 10:04 PM
I thought they changed the name of the place to "Freedom?" Oh no, my friends, that was some of US. :o

Regards,


Strings in ExeScope versus W32DSM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Strings in ExeScope versus W32DSM
PDA

View Full Version : Strings in ExeScope versus W32DSM

Meteor
02-13-2004, 06:25 AM
Hi
this is a problem with Strings in a EXE file
the file informations Are :
Compiler : visual c++ 6
Checksum : 00000000 and real Checksum is : 93E752D2

after opening it with W32DSm , w32dsm can not Find Any string in the file and Button of strings is Gray But if I open it with Exescop , it will detect some Strings completly. now how can I reverse this File and cack its Serial protection . how it reference to Texts in the Exe File.?
disavowed
02-13-2004, 06:36 AM
use ida instead of w32dasm
if you only want strings, use bintext
Meteor
02-13-2004, 06:59 AM
You see the Checksum in Exe File is : Zero all
But Real Checksum calculated by insPEctor is Differ . How About This?
naides
02-13-2004, 07:10 AM
You see the Checksum in Exe File is : Zero all
But Real Checksum calculated by insPEctor is Differ . How About This?

My impression is that this exe file has some "atypical" features: like an incorrect Checksum number, Strings resources are not in the typical format that W32dsm recognizes, etc.

Search around for anti-w32dsm tricks, and you will find that these things are not uncommon.
You will have to do without W32dsm dead listing. Try Dissa suggestions, check if the file is packed???, try attack methods using a debugger instead.
Meteor
02-14-2004, 05:27 AM
My impression is that this exe file has some "atypical" features: like an incorrect Checksum number, Strings resources are not in the typical format that W32dsm recognizes, etc.

Search around for anti-w32dsm tricks, and you will find that these things are not uncommon.
You will have to do without W32dsm dead listing. Try Dissa suggestions, check if the file is packed???, try attack methods using a debugger instead.
tanx
but the program had a debugger detection system and can not use it
this is a nag screen alert saying bekos of security purposes ...
but i found this with binText(nice tool)
File pos Mem pos ID Text
======== ======= == ====
00096F8B 006F3F8B 0 Key is valid
but I couldnt find any reference to it like push command or any use of its Positions ..

a nag screen that detected SI have this

For security Purposes , this program will not run While system Debuggers are Active .please remove or disable system debugger before trying to run this program again (OK Button)

and i was see this nag before in some programs . is it a common Program for detecting Debuggers and an Anti For it ?
hobferret
02-14-2004, 05:57 AM
Hi :)

If you can not see strings in WDASM , see if the section header flags are C0000040 or something similar - if so change them to E0000060 then you should be able to read them :cool:

/hobferret
naides
02-14-2004, 08:56 AM
and i was see this nag before in some programs . is it a common Program for detecting Debuggers and an Anti For it ?

Yes. DEbugger detection devices are becoming more common. It also suggests that the protection of this program is not trivial.

There are anti(s) for debugger detection devices, search the board and you will find plenty of discussion about it. If you are using an NT based system ( winNT, win2000 or win XP) IceEXt is a good starting point.
disavowed
02-15-2004, 12:40 PM
You see the Checksum in Exe File is : Zero all
But Real Checksum calculated by insPEctor is Differ . How About This?
most exe's have a checksum of 0, because the OS ignores the checksums. generally, the OS only validates PE checksums on drivers
Aimless
02-16-2004, 12:05 AM
However, most of the issues can be solved by realising that W32dasm cannot read unicode strings.

Best way to do it is to use a string dumping utility (www.sysinternals.com) called as strings.exe which will also tell you the offsets.

Note that all VB/Delphi proggies will hold the strings in the resource sections, therefore, it might also be a good idea to use a resource hacker like reshack (www.programmerstools.org/utilities)

Have Phun


getright5.1 beta2 detect debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > getright5.1 beta2 detect debugger
PDA

View Full Version : getright5.1 beta2 detect debugger

Timbo
02-13-2004, 09:04 AM
seems that the new version is pain for me,
couldn't find out how new arma detect the debugger !
i have hidden all but it won't start.

anyone knows why ?
SpeKKeL
02-13-2004, 12:17 PM
You didn't hide it enough....!

SpeKK.
evaluator
02-13-2004, 12:32 PM
your post too much incomplete.
at least write your system, debugger, how you hide..
Timbo
02-13-2004, 12:59 PM
i'm useing
ds2.7 (xp) with sten's iceext, patched int 68, patched keyboard
does the new getright scan the memory ?
does your's debugger the new 5.1b2 ?
work on w9x with debugger !
evaluator
02-13-2004, 01:55 PM
yah, that can method of detecting ntice by RFlag.
You need patch ntice's INT0E handler. later..
evaluator
02-13-2004, 03:01 PM
at start of ntice's INT0E handler you will meet instuction:
8164240CFFFFFEFF = AND dword[esp+0C],0FFFEFFFF

so try change byte FE to FF, which avoids RF removal.

maybe Sten soon will release newer version of his plugin, where..
Timbo
02-13-2004, 04:24 PM
tried it (8164240CFFFFFEFF = AND dword[esp+0C],0FFFFFFFF)
doesn't seem to work :confused:
evaluator
02-13-2004, 05:38 PM
sure in INT0E handler?
if so, maybe better rename-patch NTice manually;
or wait to new IseExt?
Timbo
02-14-2004, 04:22 AM
Thanks evaluator :D :D
mmk
02-14-2004, 05:39 AM
If you're using IceExt, Armadillo (I assume GetRight is packed with Armadillo) detects IceExt by checking this registry key: HKEY_LOCAL_MACHINE\ SYSTEM\ CurrentControlSet\ Services\ IceExt.
evaluator
02-14-2004, 01:15 PM
well Timbo,
but tell people, what you did, ye?
Timbo
02-14-2004, 03:25 PM
well Timbo,
but tell people, what you did, ye?

Hmm blind on both eys didn't thought about Iseext
or didn't realisize first the Chester posting

ok hidden the Izipl(u)g :D or was it DsaPie ??

Are there any other VER$ of ntice build >1268 <1772 ??
Js
02-15-2004, 09:25 AM
glad you cleared it up about that DsaPie, been bugging me for some time.


RCE Board Archives .chm file available
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > RCE Board Archives .chm file available
PDA

View Full Version : RCE Board Archives .chm file available

Kayaker
02-13-2004, 11:28 AM
Boolean/wildcard search capable, favorites tab, server-linked thread titles. After a few style modifications/suggestions, this version is much improved from the previous.

Thanks to dELTA for php script modifications making the search function more user-friendly.

There should soon be a permanent link to the most recent version (updated occasionally) at the bottom of the main page.

10MB zipped .chm file.

LINK AT BOTTOM OF MAIN PAGE

Enjoy

Kayaker
dELTA
02-13-2004, 02:10 PM
It's available at the bottom now...
fifthelement
02-13-2004, 04:13 PM
Thanx Guys for adding searching feature to the board archive, without search it was almost impossible to use it ! :cool:
sope
02-15-2004, 02:45 AM
Greetings all Gems

My thanks to all of you for all your hard-work in making .chm file. It's toooo goood... :)

Regards, Sope.
JMI
02-15-2004, 02:54 AM
Don't go into overload, trying to re-read it all in one sitting. :D But there is one hell of alot of really good information in this Forum and the +Fravia archive. Of course there is some junk also, but most of that is in my posts. :eek: (Had to add that before dELTA did.) :rolleyes: :D

Regards,
Kayaker
03-02-2004, 11:39 AM
For anyone interested, the Archive has been updated to the Leap Year Edition...

K.
Kayaker
04-14-2004, 03:14 PM
For anyone interested, the Archive has been updated to the Leap Year Edition...

K.

Easter Bunny Edition hopped by...
gabri3l
04-14-2004, 06:16 PM
Just had to say thank you to all who worked on this. its great to throw on the ipaq and browse through. Glad to see its being kept updated. Thanks again.
Kayaker
04-16-2004, 04:24 PM
Actually I blew this one. No wait, I shouldn't put it that way, there were, um, technical difficulties, yeah that's it. Upgrade overwrote modification, Search/Favorites function got screwed up, and the Quality Control department was out kayaking :p

The problem is now fixed so if anyone downloaded the original Apr 13 version they may want to d/l the fixed version instead.

Cheers,
Kayaker
(Once again Happy when Wet, spring is here! :)
Tolstoinisten
04-17-2004, 09:26 AM
Thanx a bunch, Kayaker & crew :)

Been waiting for an update :p
gabri3l
06-09-2004, 05:28 PM
Noticed this was quietly updated. Just want to let you know that I am again very grateful. Thanks guys
Kayaker
06-09-2004, 09:21 PM
Noticed this was quietly updated.

I can't slip anything past you guys eh? ;)


Sentinel SuperPro Password Overwrite
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel SuperPro Password Overwrite
PDA

View Full Version : Sentinel SuperPro Password Overwrite

paulofutre10
02-13-2004, 04:22 PM
Hi

I have a Sentinel Superpro dongle , and i need the password for overwrite ( Word 1 , Word 2)

I went to www.safe-key.com and download sentread.exe ( for read the sentinel superpro) , its generate a file . I open that file with a hex-editor .
And i see the ID , the Write password , but i cant see the overwrite password .

Can you help me ?

Thanks
JMI
02-13-2004, 05:26 PM
Have you already read the FAQ and searched the Forums for information on "sentinel" and "superpro?" If not, please do that first.

Regards,
paulofutre10
02-14-2004, 09:23 AM
hi

I have read , and this forum (Clonning sentinel superpro) , they have the same problem that i . I don´t want to clone the sentinel , i just need the overwrite passord

Can you help me , find the overwrite password ?

How can i do a brute attack to the overwrite password ?

http://woodmann.com/forum/showthread.php?t=3579&highlight=sentinel+superpro

"- then launch a brute force attack on the write password (but be
careful and use an empty cell for doing that). The attack on
the write password will take no longer than a couple of minutes.
- a brute force attack on the overwrite password is feasible,
but it will take a couple of month ( 2..12 depending on the
amount of luck ;-) to go.
I had to do this on a specific dongle some time ago, and there
is nothing special about it.
Post by VoxQuietis "

Thanks
Paulo Futre
sope
02-15-2004, 02:41 AM
Hello Paulfutre10

Firstly i need to understand why you need to brute force Overwrite Password for a specific dongle ? Do you need to make some changes in dongle cell or its something else ?

Also if you can dig the executable files & check if they have used a function called RNBOsproOverWrite if you are lucky you can find overwritepassword 1 & 2.

Regards, Sope.
paulofutre10
02-15-2004, 06:04 AM
Hi

I need to make some changes in the dongle cell , because my software is by packs , and i need to active packs that i dont have.

I´m not a expert in this fild , when i talk about brute force Overwrite Password , i read this in this forum http://woodmann.com/forum/showthread.php?t=3579&highlight=sentinel+superpro

i just want to know the best way to get the overwrite passaword .

how can i dig in the executable files ?

Can you help me ?
naides
02-15-2004, 08:20 AM
Hi

i just want to know the best way to get the overwrite passaword .

how can i dig RNBOsproOverWrite in the executable files ?

Can you help me ?

First step is searching for "RNBOsproOverWrite" in google. I got 3 hits, one in english, two in Chinese with english text.

Also , disassemble or use Exescope to find out the list of import and export functions of relevant exe and dll files, and locate which ones import and export the function. Then study what the function does and follow the general advice of sope.
paulofutre10
02-15-2004, 11:39 AM
i use exescope in the directory file and open
Export, Product Name Removed.DLL
Ordinal Address Name
0000000A 10001170 sproActivate
00000009 10001150 sproDecrement
00000006 100010A0 sproExtendedRead
00000003 10001040 sproFindFirstUnit
00000004 10001060 sproFindNextUnit
00000001 10001010 sproFormatPacket
0000000D 10001240 sproGetFullStatus
0000000C 100011E0 sproGetVersion
00000002 10001030 sproInitialize
00000008 10001110 sproOverwrite
0000000B 100011A0 sproQuery
00000005 10001070 sproRead
00000007 100010E0 sproWrite

and
Export, SK32W.dll
Ordinal Address Name
0000000E 00403590 CLOSE_SENT
00000014 00407EF0 DllEntryPoint
0000000D 00403580 OPEN_SENT
0000000B 00406A40 RNBOskCfgLibParams
00000008 00407400 RNBOskCommand
00000005 004071C0 RNBOskEnable
00000001 00406EC0 RNBOskFormatPacket
0000000A 00407180 RNBOskGetFullStatus
00000009 004070B0 RNBOskGetVersion
00000002 00406F00 RNBOskInitialize
00000003 00406FA0 RNBOskRead
00000006 004072B0 RNBOskSetFamily
00000007 00407390 RNBOskSetPort
00000004 00407030 RNBOskWrite
0000000F 004046C0 SKMSFP
0000000C 00404650 SK_COMMAND

What i do now ?
paulofutre10
02-15-2004, 11:56 AM
i send the file

Edit by JMI: Do not attach portions of commercial software on these Forums and do NOT identify your target when you post target specific code.
sope
02-16-2004, 02:14 AM
Hello paulofutre10

Export, Product Name Removed.DLLYou take Product Name Removed.dll file & disassemble it in IDA. Check cross-ref of the function sproOverwrite if used it will show you. Go there & see the parameters passed. For reference of parameters pls read sentinel api reference. Hope it helps.

Regards, Sope.
paulofutre10
02-18-2004, 02:17 PM
Can you give me your email

I need help in IDA

paulofutre10@hotmail.com


PEiD v0.92
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PEiD v0.92
PDA

View Full Version : PEiD v0.92

v0kram
02-14-2004, 04:35 AM
New version at hxxp://peid.has.it ;)
dRag0nMa
02-15-2004, 08:33 PM
site down?
dELTA
02-16-2004, 07:25 AM
I just tried it, and it works fine for me.


newbie here, trying to disable menuitem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > newbie here, trying to disable menuitem
PDA

View Full Version : newbie here, trying to disable menuitem

oVum
02-15-2004, 09:45 AM
hi

The way I try'd was to change the byte 2 before the string i wanted to gray out with 01 ,I opened the menu and it looked to have worked but opening it a second time the menuitem was active again,the same thing was happening using a resource editor,The EnableMenuItem API is new to me but i think it is only way i can succeed can anyone help me how to do it that way it would be much appreciated
naides
02-15-2004, 11:45 AM
hi

The way I try'd was to change the byte 2 before the string i wanted to gray out with 01 ,I opened the menu and it looked to have worked but opening it a second time the menuitem was active again,the same thing was happening using a resource editor,The EnableMenuItem API is new to me but i think it is only way i can succeed can anyone help me how to do it that way it would be much appreciated

Read the tutorials on grayed menus, which are plenty in the links below. Clandestiny's is one of my favorites, and he refers you to others in there. also look in www.anticrack.de for grayed option tutorials and you will have plenty of introductory material.

Also look up 'EnableMenuItem' in an API reference or directly in google, and you will have some info about its parameters, and how it gets called.

Be aware that if your app uses MFC or other frameworks things can be a little more involved.

Without more details this is all I can tell you.
oVum
02-19-2004, 01:19 AM
I'm sorry to say after reading essays by Clandestiny Lord Soth and others i'm still no closer to solving :\
naides can u chk your pm plz

regards
oVum
evlncrn8
02-19-2004, 02:13 AM
I'm sorry to say after reading essays by Clandestiny Lord Soth and others i'm still no closer to solving :\
naides can u chk your pm plz

regards
oVum

The EnableMenuItem function enables, disables, or grays the given menu item.

BOOL EnableMenuItem(

HMENU hMenu, // handle of menu
UINT uIDEnableItem, // menu item to enable, disable, or gray
UINT uEnable // menu item flags
);
Parameters

hMenu

Identifies the menu.

uIDEnableItem

Specifies the menu item to be enabled, disabled, or grayed, as determined by the uEnable parameter. This parameter specifies an item in a menu bar or in a pop-up menu.

uEnable

Specifies flags that control the interpretation of the uIDEnableItem parameter and indicate whether the menu item is enabled, disabled, or grayed. This parameter must be a combination of either MF_BYCOMMAND or MF_BYPOSITION and MF_ENABLED, MF_DISABLED, or MF_GRAYED.

Value Meaning
MF_BYCOMMAND Indicates that uIDEnableItem gives the identifier of the menu item. If neither the MF_BYCOMMAND nor MF_BYPOSITION flag is specified, the MF_BYCOMMAND flag is the default flag.
MF_BYPOSITION Indicates that uIDEnableItem gives the zero-based relative position of the menu item.
MF_DISABLED Indicates that the menu item is disabled, but not grayed, so it cannot be selected.
MF_ENABLED Indicates that the menu item is enabled and restored from a grayed state so that it can be selected.
MF_GRAYED Indicates that the menu item is disabled and grayed so that it cannot be selected.
Return Value

The return value specifies the previous state of the menu item (it is either MF_DISABLED, MF_ENABLED, or MF_GRAYED). If the menu item does not exist, the return value is 0xFFFFFFFF.

Remarks

An application must use the MF_BYPOSITION flag to specify the correct menu handle. If the menu handle of the menu bar is specified, the top-level menu item (an item in the menu bar) is affected. To set the state of an item in a pop-up or nested pop-up menu by position, an application must specify the handle of the pop-up menu.
When an application specifies the MF_BYCOMMAND flag, Windows checks all pop-up items that are subordinate to the menu identified by the specified menu handle. Therefore, unless duplicate menu items are present, specifying the menu handle of the menu bar is sufficient.
sLayer
02-20-2004, 01:40 AM
OK now go to imports and in double click "Enable Menu Item".
Then u must see two jumps above it.
LIke this
First Comes the
Crap "je"<----Change this
Crap "Jne"
It should be in this format.Go and change the "Je" only to "Jne"
U can disable the menu.
IF the enable menu item function occurs many times trace until u find
this code.
Another way is through the hex way.
I used Heedit 2.1.14
Open the file
Lets suppose the menu is "Register".
Scroll down in heedit till u see someting like this.
R.e.g.i.s.t.e.r.This mostly occurs in the bottom section.
Now look for a "P" up there its value in hex should be "50"
Change the 50 to 58.Then then the menu is completely disabled.
If u put a "00" then the menu dissappears.
Hope this will help

Laterz
:cool: :)


Dump wont work
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dump wont work
PDA

View Full Version : Dump wont work

vodo
02-15-2004, 10:08 AM
hi

I have dumped the Name Removed the problem is it wont work after fixing the dumped file with imprec 1.6.

File Packer: exe32pack 1.38
Oep: 6DFCE

Name removed Download:
...removed...

My Dumped file download:
...removed...

Can anyone help?

vodo
bedrock
02-15-2004, 10:35 AM
did you try dumping this with my exe32pack unpacker/dumper in the tool of the trade section on this forum?

--
bedrock
vodo
02-15-2004, 11:31 AM
@bedrock

Yes i have tested with the tool. Same problem as in the manualy unpacked dump. i think it has crc or other checks but i cant find it.

vodo
Shoob
02-15-2004, 04:01 PM
Trace the target Day and Night you will find the error, i had a look at it too and i patched some jumps but this will take time that i dont have sorry, wish you good luck.
JMI
02-15-2004, 04:21 PM
vodo:

Time to read and follow the FAQ, referenced in BIG RED LETTERS at the top of the Forums.

Regards,
vodo
02-15-2004, 04:25 PM
@JMI

i have read it now. SORRY

vodo


Aspr stolen byte stubs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspr stolen byte stubs
PDA

View Full Version : Aspr stolen byte stubs

sonkite
02-15-2004, 11:43 AM
==== Microsoft Visual C++ 6.0 ====

55 PUSH EBP
8BEC MOV EBP,ESP
6AFF PUSH -1
6800000000 PUSH 00000000 ; needs updating
6800000000 PUSH 00000000 ; needs updating
64A100000000 MOV EAX,DWORD PTR FS:[0]
50 PUSH EAX
64892500000000 MOV DWORD PTR FS:[0],ESP
83EC58 SUB ESP,58
53 PUSH EBX
56 PUSH ESI
57 PUSH EDI
8965E8 MOV DWORD PTR [EBP-18],ESP

558BEC6AFF6800000000680000000064A10000
0000506489250000000083EC585356578965E8

==================================

==== Microsoft Visual C++ 7.0 ====

6A60 PUSH 60
6800000000 PUSH 00000000 ; needs updating

6A606800000000

==================================

==== Borland Delphi ==============

55 PUSH EBP
8BEC MOV EBP,ESP
83C4F4 ADD ESP,-0C
B800000000 MOV EAX,00000000 ; needs updating

558BEC83C4F4B800000000

55 PUSH EBP
8BEC MOV EBP,ESP
83EC10 SUB ESP,10
B800000000 MOV EAX,00000000 ; needs updating

558BEC83EC10B800000000

55 PUSH EBP
8BEC MOV EBP,ESP
83C4F4 ADD ESP,-0C
53 PUSH EBX
B800000000 MOV EAX,00000000 ; needs updating

558BEC83C4F453B800000000

55 PUSH EBP
8BEC MOV EBP,ESP
83C4F0 ADD ESP,-10
53 PUSH EBX
B800000000 MOV EAX,00000000 ; needs updating

558BEC83C4F053B800000000

==================================

These are all that i have seen so far, i hope these values are correct. Would be good if anyone who finds something wrong here please tell me.
crUsAdEr
02-15-2004, 07:15 PM
Greetingz folks :)
Good to see old faces around still... Some are missing but well.. tt is life :/
Kayaker not happy when wet anymore :)? Me been busy kayaking in the sea hence no time for RE :(...
Been ages since i am here... it is amazing how Aspr n Armadillo still generates so much attentions... what versions are they on now and any new features since?
dELTA
02-16-2004, 07:26 AM
It's nice to see your old face too crUsAdEr, welcome back. :)
Kayaker
02-16-2004, 12:13 PM
Kayaker not happy when wet anymore :)? Me been busy kayaking in the sea hence no time for RE

OK, now I'm totally jealous!! Nice to see you around again crUsAdEr, stick around for a while. That's not too bad a tradeoff though y'know - sea kayaking for RE. That would definitely make me Happy when Wet again... :D


idioms
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > idioms
PDA

View Full Version : idioms

tom324
02-15-2004, 04:16 PM
Where can I find list of assembler idioms generated by M$ VC and gcc?

Like:

neg eax
sbb eax,eax
and eax,8

=> eax = (eax ? 8 : 0)

PS. I did google and RTFM, but have only a portion of idioms.

Tom
evlncrn8
02-15-2004, 04:56 PM
Where can I find list of assembler idioms generated by M$ VC and gcc?

Like:

neg eax
sbb eax,eax
and eax,8

=> eax = (eax ? 8 : 0)

PS. I did google and RTFM, but have only a portion of idioms.

Tom

you mean mnemonics?

google search for "helppc", download it, unzip, run it, has all the info u need (well most of it nehows)
disavowed
02-15-2004, 10:11 PM
you mean mnemonics?i don't think that's what he meant. evlncrn8, if i'm understanding your question correctly, i don't know of any such resource. however, you can determine it all yourself by just compiling it and looking.
reverser
02-16-2004, 05:46 AM
Here are some articles on the topic. They are in Russian, but you can read the code :).
hxxp://web.archive.org/web/20030622210126/http://www.wasm.ru/article.php?article=1009004
Identifying arithmetic operations
hxxp://web.archive.org/web/20030622210126/http://www.wasm.ru/article.php?article=1009003
Identifying loops
hxxp://web.archive.org/web/20030622210126/http://www.wasm.ru/article.php?article=1009002
Identifying switch/case/break
hxxp://web.archive.org/web/20030622210126/http://www.wasm.ru/article.php?article=1009001
Identifying if/then/else

(linked to web archive because main site is ddosed :( )
tom324
02-16-2004, 08:02 AM
evlncrn8, disavowed & reverser: thanks for replies.

Here are some articles on the topic. They are in Russian, but you can read the code

Russian is not that hard :)

Tom
Polaris
02-16-2004, 11:41 AM
Have a look to the dcc and desquirr source codes... They contain lots of idioms... But probably you already did that ... ;)
tom324
02-16-2004, 01:25 PM
> But probably you already did that

Yes, desquirr is main source of all idioms I have found.

Tom


RE on server 2003?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RE on server 2003?
PDA

View Full Version : RE on server 2003?

crUsAdEr
02-15-2004, 09:16 PM
Hi folks... pls dont flame me if this question is silly...

The story is long ago I put aside sice and now it has become rusty... Nostalgia brings me back here and I thought hey why not get the tools back for some practise since i have some spare time... the prob is now i am running server 2003 and thus wondering if sice can work with it? Or else what is the best option? VMware or VirtualPC? ok if all else fail i need old trusty win2k on another partition... but it would be great if someone can give me a more convenient solution.

cheers,
crUs

btw, greetingz to ALL

P.S : pls reply asap b4 i install win2k :)
esther
02-15-2004, 10:10 PM
YO crUsAdEr,
>P.S : pls reply asap b4 i install win2k :)

Well install win2k just in case :p .

Or try ds 3.1
disavowed
02-15-2004, 10:12 PM
now i am running server 2003 and thus wondering if sice can work with it?you can find your answer at www.compuware.com (http://www.compuware.com)
crUsAdEr
02-16-2004, 07:18 PM
Thanks guys... ok now that my DS2.5 is useless... on the quest to contact Compuware for their lastest release 3.2 :)...

Esther.. still insane heh :)? I am disappointed that I have been inactive for 1 year, and I joined 1 year later than you... YET i have higher post count that you... guess newbie n lamer tends to talk more :)

cheers,
crUs
disavowed
02-16-2004, 07:29 PM
i'm catching up to him (because i keep making useless posts like this one) :)
dELTA
02-16-2004, 07:38 PM
on the quest to contact Compuware for their lastest release 3.2 :)...
As far as I (and Compuware's website) know, 3.1 is the most recent version? :)
esther
02-16-2004, 10:19 PM
crUsAdEr

>I am disappointed that I have been inactive for 1 year, and I joined 1 year later than you... YET i have higher post count that you... guess newbie n lamer tends to talk more :)

Do We need to give you an award on higher post count? LOL

Welcome back :cool:

disavowed:
>because i keep making useless posts like this one

There's more below catch it hahahaha
UrgeOverKill
02-16-2004, 11:52 PM
Hiya crUsAdEr,
Being a beta tester on that platform, I did not encounter much probs w/sice jus the usual bs, but it worked ok.
:cool:
crUsAdEr
02-17-2004, 08:12 AM
sweet...

Thanks UrgeOverKill for the info... what version are you using? DS3.1 ? I only found DS3.0 on the net :(, not sure if it works well with server 2003...

Delta... that explained why my initial search for DS3.2 did not return many results :/... perhaps we need a new search engine that will search into the future :)
bedrock
02-17-2004, 10:06 AM
You might want to take a look over at exetools forum ;)

--
bedrock
crUsAdEr
02-17-2004, 11:24 AM
thanks but in truth i had never managed to login the ftp there :/... it is just too congested...
JMI
02-17-2004, 11:27 AM
Well, if you actually read the thread, you might get some "other" ideas. :rolleyes:

Regards,
crUsAdEr
02-17-2004, 12:03 PM
Try It! Compuware Product Evaluations

Product Evaluation
Thank you for your interest in Compuware products. A representative will be contacting you with information about our award-winning products.

And I am still waiting :/.... guess they are gonna wait till 3.2 release to contact me :(
UrgeOverKill
02-17-2004, 08:22 PM
[QUOTE=crUsAdEr]sweet...

Thanks UrgeOverKill for the info... what version are you using? DS3.1 ? I only found DS3.0 on the net :(, not sure if it works well with server 2003...

I use a registered 3.0. IMHO it worked ok, until you started diving into the network part of the proggie. It gets buggie when handling multiple users across a givin network. All in all it was ok.
crUsAdEr
02-18-2004, 04:27 AM
Thanks folks.. sice is up n running along with IDA... took me sometime to config the winice.dat file lol... time to dig in...


problem fixing imports
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > problem fixing imports
PDA

View Full Version : problem fixing imports

jolopez
02-15-2004, 10:25 PM
well i have unpacked my target and fix the imports with imprec the programs runs well but when i try to do it in another so like 98 for example the executable fails, i have to ru imprec now and fix the dump now, so how can i fix this? i want to make an executable that runs in both sos.

this is my tables
1 CCCCCC0 kernel32.dll 0138 GetCurrentThreadId
1 CCCCCC4 kernel32.dll 007B DeleteCriticalSection
1 CCCCCC8 kernel32.dll 023A LeaveCriticalSection
1 CCCCCCC kernel32.dll 0090 EnterCriticalSection
1 CCCCCC0 kernel32.dll 020F InitializeCriticalSection
1 CCCCCC4 kernel32.dll 0367 VirtualFree

in one and
1 CCCCCCC0 kernel32.dll 015D GetCurrentThreadId
1 CCCCCCC4 kernel32.dll 00D6 DeleteCriticalSection
1 CCCCCCC8 kernel32.dll 0228 LeaveCriticalSection
1 CCCCCCCC kernel32.dll 00E1 EnterCriticalSection
1 CCCCCCC0 kernel32.dll 020A InitializeCriticalSection
1 CCCCCCC4 kernel32.dll 031B VirtualFree
in another how can i fix this? any help?
the cs are like xs. ;->
neviens
02-17-2004, 07:05 AM
As far I can see, only hints are different, and this isn't an issue, because PE loader loads imports by name, if find that hint is wrong (does it looks at hints at all?). Borland Delphi for example sets hints to zero.
So fault is elsewhere (wrong PE format for NT, API difference for Win95 and NT, etc.).
What error do you receive exactly?
jolopez
02-17-2004, 08:23 AM
this is the problem. now the problem is fixed. with imprec i had fix by ordinal. only i have to do is untick this and the problems goes out many thx people. One friend has help me before you, but in any maner many thx


Cant unpack ASPACK, even Aspack fails...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Cant unpack ASPACK, even Aspack fails...
PDA

View Full Version : Cant unpack ASPACK, even Aspack fails...

dipeshrestha
02-15-2004, 10:56 PM
Hi all, greetz,

Recently i have downloaded one program Auto Debug for windows v2.3 from Download Site Removed.

PEiD shows this program is packed with Aspack 2.1 and while viewing sections it has pec as well as aspack section. (Is it packed using two packer or what :confused: ).

I tried to manually unpack it and found its OEP at 42E9B8 (is it true). I dump it and using imprec i click on get import. Imprec says: "original iat rva found at 362a5 in section RVA:36000 Size: 5000"

Even after that dumped app. doesnt work. I tried with ASPACK Die, but application crashed. And one interesting thing is that when unpacked with ASPACKDIE, peditor shows it is not a valid PE file. :D .

Can someone help me with this? i will be learning new things from this discussion.

Dipesh
JMI
02-16-2004, 02:39 AM
Hey Dipesh:

No download links to commercial software allowed and no target specific code may be posted if you identify a target.

That aside, it is not unheard of for a software vendor to use both a packer and a protector. Here's another possibly shocking thought:

Sometimes the protection system actually is programed to, gasp, LIE about what method was actually used. :eek: Oh the shame of it. They would actually attempt to decieve we honest crackers. :rolleyes:

The identifier programs are fairly good, but sometimes the protectors write their programs to try to fool them into thinking some other protector has been used.

I know it is not the easy solution, but if you really want to learn things useful, you need to be studying manual unpacking which means searching for information and reading alot. Have you already reviewed threads here on "Aspack"? It would be a good term for a search.

Using "aspack sections" I got 13 threads which may have some information for your issue. When I used just "aspack" I got 103 threads, several of which have titles which should be of interest to your issue.

You may also need to review information on what makes a valid PE Header and what happens when protectors mess with that information. There is always something more to study and it is through study that most learning occurs. :cool:

You should do some of these things first and then ask a more specific question then "Can someone help me on this."

Regards,
dipeshrestha
02-22-2004, 11:51 PM
Sometimes the protection system actually is programed to, gasp, LIE about what method was actually used

Hi JMI,
Actually I have learned about aspack manually unpacking and i think i can unpack any aspacked program :rolleyes: . But my question is that how to defeat the protection system that lie about what method was actually use. I extensively rely on PE identifier program to know which packer was used to pack that program. How to defeat the spoofing of protection scheme.

dipesh
Panemuckl
07-02-2004, 04:49 PM
Tried it myself... AsPackDie and manual unpacking fails.

Have an eye on the Import section. It seems to me as if there's
a fake import section to fool ImpRec (original: 2832 imported functions, unpacked/imprec shows less)
ryan
07-02-2004, 09:53 PM
But my question is that how to defeat the protection system that lie about what method was actually use. I extensively rely on PE identifier program to know which packer was used to pack that program. How to defeat the spoofing of protection scheme.

You should not rely on PE identifier program at all. Just keep practising on targets that you know FOR SURE is from one particular packer. Over time, your "zen" will tell you what a new target is packed with.
cRk
07-03-2004, 11:42 AM
i tried this one before.. has encrypted parts of the code.. also some Imports calls are encrypted... it has a crc check.. after the exe has been modified it won't decrypt parts pf the code needed to run fine.. that's the reason why crash ..you most defeat crc check after unpacking it ... crc check has anti-loader tricks as well .... you can check this by just modifing a byte in memory with a loader or just modifing the last Aspack section where the 000 data is ... write anything there ... and you'll note what i mean .. if program runs... later it will quit with an Exitprocess call which is also encrypted.

Regards


BigInt Calculator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > BigInt Calculator
PDA

View Full Version : BigInt Calculator

xoder
02-16-2004, 04:06 AM
this is not a request for a crack!! i just want to ask if someone knows an url where to get this app (in of course unmodified form). i tried to find it on the web but all i could find was alot of cracks collections and some chinese sites but not one single link where i could download the program.

regards,

xoder
Js
02-16-2004, 05:04 AM
this is not a request for a crack!! i just want to ask if someone knows an url where to get this app (in of course unmodified form). i tried to find it on the web but all i could find was alot of cracks collections and some chinese sites but not one single link where i could download the program.

regards,

xoder
try
hxxp://wxw.codeaholics.com/download/
hope it helps


Aspr Stripper 2.07 final
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Aspr Stripper 2.07 final
PDA

View Full Version : Aspr Stripper 2.07 final

MiniMind
02-16-2004, 05:06 AM
On Exetools I found this :

Stripper 2.07 final for public!
Today was released new version of Stripper 2.07f for public. This version can unpack aspr 1.2x.

Goto: hxxp://www.is.svitonline.com/syd/stripper.html

Enjoy
__________________
[AHTeam]

Link is down, can someone please put it on the board or link it...
Great tools are to share...

thanks
MiniMind
dELTA
02-16-2004, 07:36 AM
Read the FAQ (or at least the descriptive text of this forum at the board index page)...
MiniMind
02-16-2004, 11:11 AM
Read the FAQ (or at least the descriptive text of this forum at the board index page)...

"- Do not ask where to find the "tools"."

I know, but first I would let everyone knows this new version is released...

Then I'm :mad: that you can't download it from official website...

MiniMind
evaluator
02-16-2004, 12:09 PM
YEY! my sexy mirror is still alive!
but unfortunatelly, i havn't svit's home page:(
//je-.pisem.net/
hocuspocus69
02-16-2004, 12:10 PM
:))))
evaluator
02-16-2004, 12:29 PM
this one is playing dirtie game:)
deLTa: DEL_PO_&_US :)
MiniMind
02-16-2004, 01:06 PM
:))))

Thanks for sharing :)
JMI
02-16-2004, 01:12 PM
MiniMind:

That you are pouting that you could not download a tool from a website is NO excuse for your blatant violation of our rules. Do NOT attempt this childish stunt again, or suffer the consequences. I hope this message is CLEAR.

Regards,
hocuspocus69
02-16-2004, 05:16 PM
I dont understand your message and i hope to haven't create a problem posting an attachment
MiniMind
02-16-2004, 05:41 PM
MiniMind:

CLEAR.

MiniMind
JMI
02-16-2004, 06:18 PM
hocuspocus69:

The problem was not with you, but was with MiniMind's asking something he should have understood, and appeared to understand, that he should not have asked and then trying to justify his breach of the rules because he "wanted" that tool. He says he has learned his lesson and that should end the issue. ;)

It is not a violation of the rules to post non-commercial tools here, although it is not generally encouraged.

You're OK. Really... your can breath again now. :D

Regards,
evaluator
02-17-2004, 10:05 AM
yey! my sexy mirror is dead!?
dirti ASS kills my mirror!? Vendetta!??


MFC Documentation!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > MFC Documentation!
PDA

View Full Version : MFC Documentation!

Bra!NSHiT
02-16-2004, 11:42 AM
Hi dudes,

is there any docu or paper available, which describes all functions of MFC library like Win32Api ???

See you. ;)
JMI
02-16-2004, 01:00 PM
So Bra!NSHiT:

Did you, by any chance, read the BIG RED LETTERS at the top of the Forums and READ the FAQ??? Did you, by any chance, make the slighest effort to help yourself and search here and/or on the net for the answer to your own question? Did you consider, perhaps, actually going to the M$ website and review the thousands of pages available there or perhaps, gasp, use their search function and enter "MFC Library Functions"?

This is not the place where "dudes" want to do all your basic research for you or manage for you the most basic of searching problems. Even the most basic search of the net would have led you to titles, such as "The definitive guide to Microsoft Foundation Class(MFC) library" and many, many others, and then you could have done your own search of available ebooks and papes on this subject. Come on 'dude." Get with the program.

Regards,
tom324
02-16-2004, 01:52 PM
JMI, perhaps we should charge (say 50 €/hour) for reading manuals and documentation and providing answers for those who are lazy to do so ;)

Tom
nikolatesla20
02-16-2004, 03:36 PM
MSDN.MICROSOFT.COM

enjoy, and don't come back here again until you have an actual good question!
-nt20
xoder
02-16-2004, 04:23 PM
i really enjoy JMI's posts :p
esther
02-16-2004, 10:02 PM
YOU PPL ARE INSANE!!!!
Kayaker
02-16-2004, 10:40 PM
i'm starting to agree, let's keep it cool huh?
Bra!NSHiT
02-18-2004, 06:28 AM
Hi,

:( ok ok, sorry for that. Don`t get panic guys.

Bye
evaluator
02-18-2004, 06:38 AM
Bra!NSHiT, do u see, what u did!?

board crashs bcoz of your pozt..i'm cry..

how you can, how you can..


Fullscreen to windowed mode and change resolutions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Fullscreen to windowed mode and change resolutions
PDA

View Full Version : Fullscreen to windowed mode and change resolutions

highfly
02-16-2004, 01:58 PM
many games doesn't have the option for windowed mode .how to change these settings and i got a old dx7 game which only 640x480 :D resolution how to change?

i also did some changes in dwstyle in createwindowEx api but :(

thanks
disavowed
02-16-2004, 07:27 PM
it's probably not what you had in mind, but you could use a vm like vmware
dELTA
02-16-2004, 07:29 PM
A good (although not fully supported by detailed knowledge of DirectX) guess would be that this would be very hard, since there are most likely a bunch of fundamental differences when drawing to a window and drawing to full screen. But someone else maybe knows better?
AndreaGeddon
02-17-2004, 06:16 AM
if i am not wrong the resolution change can be done via user32 api, try to see if the program uses ChangeDisplaySettings and AdjustWindowRect, you can modify their parameters to see if you can change resolution handling :)
Bye!
AndreaGeddon
dELTA
02-17-2004, 09:24 PM
But isn't this first once the program is in windowed mode? This one was in full screen DirectX mode if I'm not mistaken?
AndreaGeddon
02-18-2004, 07:10 AM
oops maybe i misunderstood the question! If you have a full screen game running in 640*480, and for example you want to run it so that monitor resolution is 1024*768 and the game window is 640*480 windowed mode, then i think you can use those apis. The fact that the window is in directx should not be a problem, afteral a window is a window! I tried this in opengl and it works, that is, i can toggle windowed or full screen mode, i think this *should* work also on directx. In particular you can use ChangeDisplaySettings(NULL, NULL) to go back to desktop settings when in fullscreen mode.
Hope i did not misunderstood the prolblem!
Bye!
AndreaGeddon
highfly
02-18-2004, 01:51 PM
oops,i asked two diff questions,

1,how to change a game's screen mode,the windowed mode,whatever may be the resolution

2,i got a old dx7 game which has only 640x480 resolution mode,how to change to higher modes

i messed some dwstyle of createwindowEx api to enable the title bar and frame but its again going to full-screen :(
evlncrn8
02-18-2004, 03:26 PM
oops,i asked two diff questions,

1,how to change a game's screen mode,the windowed mode,whatever may be the resolution

if the game uses full screen mode, it probably is using exclusive mode too, so changing it to windowed mode simply mightnt work, as you'll have at least 3 or 4 more procs to change during the direct x initialisation part, thats if it even works

2,i got a old dx7 game which has only 640x480 resolution mode,how to change to higher modes

i messed some dwstyle of createwindowEx api to enable the title bar and frame but its again going to full-screen :(

if the games coded for 640x480, chances are it wont 'plot' higher so you might make the window bigger but you'll still only see a 640x480 rectangle


About CrypKeyGen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > About CrypKeyGen
PDA

View Full Version : About CrypKeyGen

Google_o
02-16-2004, 09:53 PM
I calculated SiteKey with CrypKeyGen.
I input the SiteKey into editbox,but Msgbox popup,and say:
"Error Code : -5
Error Text : Program Moved Or SiteKey Bad Passwrod
"
I found that the init_crypkey will access some files,for example .lic/.ent,enc.
What else can I do when I calculated SiteKey with CrypKeyGen?
Thanks everyone.
JMI
02-16-2004, 11:27 PM
Sigh. :rolleyes:

Google_o did you read the BIG RED LETTERS at the top of the Forums and do a search here using "CrypKey" and read the previous Threads discussing that topic? If not, please go read the FAQ, read those threads and report back whether they help answer your question.

Regards,


Belgian police arrest female virus writer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Belgian police arrest female virus writer
PDA

View Full Version : Belgian police arrest female virus writer

crUsAdEr
02-16-2004, 11:22 PM
http://www.theregister.co.uk/content/56/35580.html

Sigh.. that is the price u pay for too much publicity i guess :/... hope she gets a good lawyer though...
Aimless
02-17-2004, 12:20 AM
Bah!!!

"Female" hackers? What will they think of next?

Come to think of it, I have been following progress of institutes where gorillas and orangutans work on computers. Imagine, the first "animal" virus when one of these primates suddenly develops an over-swelled brain!

Have Phun
JMI
02-17-2004, 12:51 AM
Well I can see the unfortunate headline already:

"Monkeys develop computer AIDS."

Hopefully, they are smarter that we have been and don't bother.

Regards,
nikolatesla20
02-17-2004, 12:52 AM
hm. I saw that TechTV episode with her in it. Wondered why would she want to be on TV anyway and risk being blamed for stuff.

-nt20
JMI
02-17-2004, 12:53 AM
Because for most it is one long ego trip and some can't resist more upclose and personal attention.

Regards,
nikolatesla20
02-17-2004, 01:00 AM
Concerning Monkeys, I saw this today:

"What is MonkeyShell 1.0? It's the latest most effective software protection system every yet developed. MonkeyShell wraps around your program like a banana, which can only be peeled using the correct security encryption keys. MonkeyShell was created at MonkeyLabs, where primates work day in and day out to provide a better protection for your use. Here are some key features of MonkeyShell 1.0:

1. Wraps your program like a banana peel. No code executes until the correct encryption key is entered. Also code named "slippery protection" because just when the cracker thinks he has a foothold to the system, it changes and slips out from their grasp.

2. Gorilla proof. No more gorillas cracking your programs with brute force.

3. Primate friendly. No special tools are required to use MonkeyShell 1.0, other than a common stick.

These and a few other undocumented features (to ensure security) are all yours to use with MonkeyShell 1.0. Download your free trial today and crank up the handle"

-nt20
SiNTAX
03-02-2004, 04:13 PM
hm. I saw that TechTV episode with her in it. Wondered why would she want to be on TV anyway and risk being blamed for stuff.

-nt20

Well I also read an interview with her in a Belgian magazine... I mean.. how stupid can you get?! Write virusses, make a public website, then boast about it everywhere you can.
JMI
03-02-2004, 04:22 PM
As I said. One long ego trip. :rolleyes:

Regards,


What did the old forum look like?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > What did the old forum look like?
PDA

View Full Version : What did the old forum look like?

Aquatic
02-17-2004, 01:04 AM
The one before vbulletin?

Wasn't the place called 'TShep's Domain'?
JMI
02-17-2004, 01:48 AM
How far back do you want to go? The "original" Forum was organized and run by Fravia+. +Tsehp took over the adminstration when Fravia+ decided to shift the focus of his efforts to his "searchlore" activities, and he opened another forum there, which is still active and linked below.

As explaind in other Threads, +Tsehp decided to end his association with this Forum last year. I am unfamiliar with this place having actually been titled "Tsehp's Domain" and google has no reference to it with that name.

Somewhere on one of my HD's I have some threads from the "old" forum from before vBulletin, which show the "look and feel" of the "old" Forum, if that is the real question you were asking.

Regards,
Kayaker
02-17-2004, 02:20 AM
To add to JMI's comments..

The "old" one was known as +Sandman's forum, who had sort of taken it over/continued from Fravia's reign. I'm pretty sure there was someone else who hosted the archives/forum for a brief time as well (forget who stepped in) until Tsehp saved it from certain extinction. Its existence was still pretty tenous mind you until Woodmann appeared as if by magic to host it on a fast secure server, and has been our benefactor for the past few years (how time flies!). I don't think it was ever considered or titled anyones "Domain" (c'mon now, no snide comments ;-)

Fravia's/Sandman's original forum was just a single forum, no subdivisions as I remember, expanded threads in certain incarnations, AllMyWeb or something was the forum software at one time. +Sandman was around very early during the initial setup of what might be known as the present forum, he actually created the MiniProject forum at my suggestion. Sadly he pretty much disappeared after that. There were a few false starts of the present forum format as well, as servers and forum software switched and posts got lost for good.

Too bad someone didn't archive the old forums. For a long while I had many saved posts from my newbie days at Sandman's and it was always kind of fun to go back and read them. You wonder if these people gave it up or finally got a life (oops what's that say 'bout me?) Mebbe other oldtimers have different recollections, things get pretty vague now and then...;) (considering the +Orc/Fravia era began when, 1997 or before?, I'm only middle-aged)

Beyond the historical muse - what a strange question to ask.
nikolatesla20
02-17-2004, 09:14 AM
omg I hate thinking about the past. It's always so sad.

I wish I could have had knowledge of this place back then. But of course, internet access still sucked yet then too.

-nt20
esther
02-17-2004, 10:44 AM
I still have a few archives from sandman's forum.

Let the memories alive hahahahaha
Woodmann
02-17-2004, 07:34 PM
Days gone by...................

Let me see what I can recall,

I remember the "insidetheweb" days. That place died and the board
moved to ???? disc server for a while ???
It was long ago. The bottom of this board says May 1999,
I beleive that date is incorrect.

Woodmann

I think that date may be correct.
I also think that instead of disc server, there was some kind of
messageboard script like php.
UrgeOverKill
02-17-2004, 08:14 PM
sheesh!!! all you guys are way too young, remember 'The Source' or 'Playnet' or even Viewtron....um me thinks somewhere back in the <glup> early 80's.... :cool:
Woodmann
02-17-2004, 08:23 PM
Easy there Pops,

We were talking about this place, not the Internet.

I hope your not going out to the garage to look at that damn
eniac clone you have under the tarp :p

Woodmann
UrgeOverKill
02-17-2004, 08:51 PM
<sigh>.....those were the days!
esther
02-17-2004, 08:58 PM
>Let me see what I can recall,

>I remember the "insidetheweb" days. That place died and the board
moved to ???? disc server for a while ???

Yeah, and golem made a identical board on other side ...

I don't remember the date but what I know newbies forum shift to boardhost

and later were regroup here :)

Thats what WhootMan poop here LOL :)

That were the good old dayz....
dELTA
02-17-2004, 09:56 PM
Fravia's/Sandman's original forum was just a single forum, no subdivisions as I remember

If I'm not mistaken, Fravia created a general forum and a tools forum from the start (separate insidetheweb forums), and Sandman soon after started a newbie forum (also a separate insidetheweb forum). It continued like this until the brief "turbulent period" between the original forums and the Woodmann forum I think.

Aah, the memories... The endless nights perusing every article on the original Fravia site, before even any board was created, following the little "story" that was available, in the new pages on the site and in the preambles of the new essays... Those were surely the days... :rolleyes:
Woodmann
02-17-2004, 10:23 PM
I found this.........
esther
02-17-2004, 10:37 PM
AWW I found fravia's old board threads!!! :)

update:

I remember fravia's board were pass to DQ and later Tsehp

Jclif :You are dang right,it's the revolution history of reversing :) but those uploaded threads are in teleported to my hdd but it's broken threads too :p
JimmyClif
02-17-2004, 11:00 PM
the Sandman's
http://web.archive.org/web/*/http://www.insidetheweb.com/mbs.cgi/mb628842
Fravia's
http://web.archive.org/web/*/http://www.insidetheweb.com/mbs.cgi/mb155985

Not all links work.. but ...heh... it's history, eh?
Aquatic
02-17-2004, 11:33 PM
Thanks for the replies. I think I stumbled across Sandman's forum over 2 years ago, and then I did some tuts on Krobar's site, and that kept me comming back.
Clandestiny
03-07-2004, 08:37 PM
I guess I'm like Kayaker, "middle aged", because I remember +Sandman's old place from back in my newbie days... Fravia's forum was before my time though. Wow, has it been *that* long...? :eek:


unix/irix software cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > unix/irix software cracking
PDA

View Full Version : unix/irix software cracking

no_fear2fall
02-17-2004, 03:24 AM
I have been in cracking for the last few months. This is the first message board I joined and it sounds very intresting. I read razzia's articles and some fravia's and some krobars. I reversed some software for windows but now i want to know about unix or irix or linux software cracking. I searched the faq and follow the Red Message instruction but found nothing. Now I am looking to this board to guide me in this area.

I have two ideas
one: crack unix/irix software in unix/irix
two: convert them in windows mz/pe format by some utility (if someone know please tell me)

So what you suggest people?

no_fear2fall
evaluator
02-17-2004, 04:28 AM
at
board.anticrack.de
i see forum about linux cracks etc. try ask there
esther
02-17-2004, 09:27 PM
You are just damn lazy to search the forum or the web
hxxp://!@#$.hcunix.net
yalcm
09-27-2004, 11:52 PM
hello, here
I had tried a lot and googled a lot in order to find a way into "hcunix.net", and all attempts failed. Can anybody shed a light ray to me "how to get there". BTW, I also had tried "h**p://***.hcunix.net" this site directly with no luck. Knowing that this is a simple (stupid) question, I hope that I'll not be flamed.
JMI
09-28-2004, 03:32 AM
Maybe you should try this:

http://www.networksolutions.com/en_US/whois/results.jhtml;jsessionid=LZDFCWGHCUJ4ICWLEALSFFA?whoistoken=0&_requestid=308125

which suggests that the name is available. :idea:

Regards,
Kayaker
09-28-2004, 09:56 AM
Er, the site has been dead for a few years I believe, but the people and papers aren't. What are you looking for? A simple search for 'hcunix' will grep an existing page of their published papers, other hits will guide you to where they may still play, what more might be needed?...

Kayaker


IceExt and DS 3.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceExt and DS 3.1
PDA

View Full Version : IceExt and DS 3.1

bedrock
02-17-2004, 10:23 AM
I read the other day that IceExt 0.57 (latest) is not working with DS 3.1 and I have not seen sign from Sten of update for quite some time, I dont know reasons, maybe he is busy with others, so i thought i would take a look...

Well i learnt a few things, and mostly now i learnt i am not skilled enough to solve this problem myself. But for starters i would like to say how far i have got to this point.

When you try and load IceExt on DS31, it fails trying to find softice Expression2Integer function pointer. Now looking at IceExt code shows there is a search function and some byte patterns it looks for, this function already has different byte patterns for DS < 3 and also for DS30 (you can see these in IceExt softice.h file), so i thought numega must of changed signature for this function again, so through comparing the ntice.sys files from DS30 and DS31 i found the Expression2Integer function and added the changes for new search pattern to IceExt code, but now it fails at next place which is looking for ActivateBPs function pointer, so i try and find this also, i add changed byte pattern and continue....

Well next IceExt is fails on ActivateHooks function pointer, but now i am stuck cause from comparing difference's and running old and new ntice.sys through IDA i can not locate this function in SI, i comment IceExt code out for now, not supprising it fails on DeactivateHooks also.

Well for now i have a butchered (M$ comment would say HACK :)) version of IceExt which loads but is not very functional under DS31. Maybe some others can better dissasemble ntice.sys and figure out some of this stuff. I think together we should be able to fix up IceExt, or maybe even the great Sten will update this great tool for all to use with new driver studio.

--
bedrock
dELTA
02-17-2004, 09:42 PM
Cool. :cool: Has anyone tried to contact Sten about this, without getting any replies?
doug
02-18-2004, 12:17 AM
I have contacted sten before & he replied within a day. he's a nice guy.

I think he checks this board once in a while, so if bedrock posts his changes, it'll probably help :p (ppl using ds 3.1 might also be able to review his code)

Also, it looks like sten has some hosting problems atm.
Kayaker
02-18-2004, 03:41 AM
Hi Guys,

I was doing a bit of exploring tonight, and it looks like ActivateHooks and DeactivateHooks will have to be rereferenced a bit. The others can be found with a new search pattern like bedrock showed. Here's what I've found so far for the record. Some of the Softice internal naming is from The Owl's pioneering work of course, and his original IDB databases are indispensible.

I found that ActivateHooks is called within the ActivateBPs function, and DeactivateHooks is called within the DeactivateBPs function. This is handy. Once they are identified, new search patterns can be devised. The DeactivateHooks function will especially need more looking into since the code pattern seems to have changed so much.

Hopefully you can make sense of the following code, each section has Sten's search pattern from softice.h, then a comparable DS3.1 pattern that might be usable for anyone wanting to make modifications.

Expression2Integer:

unsigned char PAT_Expression2Integer_DS30[] = // code pattern
{
0x55, // push ebp
0x8B, 0xEC, // mov ebp, esp
0x51, // push ecx
0x51, // push ecx
0x56, // push esi
0x33, 0xF6, // xor esi, esi
0x89, 0x75, 0xF8, // mov [ebp+var_8], esi
0x89, 0x75, 0xFC, // mov [ebp+var_4], esi
0x66, 0x89, 0x35, _XX_, _XX_, _XX_, _XX_, // and word ptr dword_DDCB0, si
0xE8 // call pCreate_fExp2Int
};

DS 3.1:
.text:0007A5D4 55 push ebp
.text:0007A5D5 8B EC mov ebp, esp
.text:0007A5D7 83 EC 0C sub esp, 0Ch
.text:0007A5DA 56 push esi
.text:0007A5DB 33 F6 xor esi, esi
.text:0007A5DD 89 75 FC mov [ebp+var_4], esi
.text:0007A5E0 89 75 F4 mov [ebp+var_C], esi
.text:0007A5E3 89 75 F8 mov [ebp+var_8], esi
.text:0007A5E6 66 89 35 7C 78 11 00 mov word ptr dword_11787C, si
.text:0007A5ED E8 00 72 F9 FF call pCreate_fExp2Int

ActivateBPs:

unsigned char PAT_ActivateBPs[] = // code pattern
{
0x80, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x01, // cmp dw_IsBPActivated,1
0x74, _XX_, // jz short locret_41BD4
0x80, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x01, // cmp dwNumberOfBPs?,1
0x74, _XX_, // jz short locret_41BD4
0x83, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x00, // cmp dword_C28AC+1,0
0x74, 0x01, // jz short loc_41BD5
//locret_41BD4:
0xC3 // retn
//loc_41BD5:
};

DS 3.1:
.text:000A2148 pActivateBPs proc near
.text:000A2148
.text:000A2148 80 3D 9C C4 0D 00 01 cmp dw_IsBPActivated, 1
.text:000A214F 74 12 jz short loc_A2163
.text:000A2151 80 3D F7 E8 11 00 01 cmp dwNumberOfBPs, 1
.text:000A2158 74 09 jz short loc_A2163
.text:000A215A 83 3D 8E 8A 10 00 00 cmp dword_108A8E, 0
.text:000A2161 74 08 jz short loc_A216B
.text:000A2163 loc_A2163:
.text:000A2163 60 pusha
.text:000A2164 E8 AB 2A 00 00 call sub_A4C14

DeactivateBPs (no change but DeactivateBPs is important to find DeActivateHooks!):

unsigned char PAT_DeactivateBPs[] = // code pattern
{
0x80, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x00, // cmp dwNumberOfBPs?, 0
0x75, 0x01, // jnz short loc_418EA
0xC3, // retn
//loc_418EA:
0x60, // pusha
0x06, // push es
0x66, 0x8E, 0x05 // mov es, wNTICE_SS
};

DS 3.1:
.text:000A1E6A pDeactivateBPs proc near
.text:000A1E6A 80 3D F7 E8 11 00 00 cmp dwNumberOfBPs?, 0
.text:000A1E71 75 01 jnz short loc_A1E74
.text:000A1E73 C3 retn
.text:000A1E74 loc_A1E74:
.text:000A1E74 60 pusha
.text:000A1E75 06 push es
.text:000A1E76 66 8E 05 D4 15 0E 00 mov es, wNTICE_SS

ActivateHooks:

unsigned char PAT_ActivateHooks[] =
{
0x83, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x01, // cmp dNumOfCPUs, 1
0x76, 0x0F, // jbe short locret_30979
0xC7, 0x05, _XX_, _XX_, _XX_, _XX_, 0x00, 0x00, 0x00, 0x00, // mov SpinLock, 0
0xE8, _XX_, _XX_, _XX_, _XX_, // call pActivateHooks
0xC3 // retn
};

DS 3.1:
The ActivateHooks call can be found in the pActivateBPs function,
the pattern matches closely pre-DS3.1 versions

.text:000A2188 FF 35 FF 16 0F 00 push dCurrentContext
.text:000A218E C6 05 F7 E8 11 00 01 mov byte_11E8F7, 1
.text:000A2195 C7 05 06 5A 11 00 00 00 00 00 mov dTSS_Base, 0
.text:000A219F C7 05 02 5A 11 00 FF FF FF FF mov dword_115A02, 0FFFFFFFFh
.text:000A21A9 E8 DB EA FF FF call sub_A0C89
.text:000A21AE E8 21 2B 00 00 call pActivateHooks
...

.text:000A4CD4 pActivateHooks proc near
.text:000A4CD4 60 pusha
.text:000A4CD5 E8 50 18 00 00 call sub_A652A
.text:000A4CDA E8 29 B3 FF FF call sub_A0008
.text:000A4CDF E8 30 FF FF FF call sub_A4C14
.text:000A4CE4 C6 05 D8 27 12 00 01 mov byte_1227D8, 1
.text:000A4CEB 61 popa
.text:000A4CEC C3 retn
.text:000A4CEC pActivateHooks endp

DeActivateHooks:

unsigned char PAT_DeActivateHooks[] =
{
0x83, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x01, // cmp dNumOfCPUs, 1
0x76, 0x13, // jbe short loc_3095F
0xF0, 0x0F, 0xBA, 0x2D, _XX_, _XX_, _XX_, _XX_, 0x00, // lock bts SpinLock, 0
0x73, 0x03, // jnb short loc_3095A
0xF9, // stc
0xEB, 0x06, // jmp short locret_30960
// loc_3095A:
0xE8, _XX_, _XX_, _XX_, _XX_, // call pDeActivateHooks
0xF8, // clc
// locret_30960:
0xC3 // retn
};

DS 3.1:
The DeActivateHooks call can be found in the pDeactivateBPs function,
the pattern matches closely pre-DS3.1 versions.
This one is a little trickier, there are now *2* calls, where before there
was only one. One or both of them may be the new DeActivateHooks function.

.text:000A1F47 loc_A1F47: ; CODE XREF: pDeactivateBPs+CDj

.text:000A1F47 E8 A1 2D 00 00 call sub_A4CED
.text:000A1F4C E8 AF 2C 00 00 call sub_A4C00
// one of these 2 calls seem to match what should be the call
// to DeActivateHooks as seen in earlier DS versions

....
.text:000A1F51 B0 01 mov al, 1
.text:000A1F53 E8 3B 68 FA FF call sub_48793
.text:000A1F58 58 pop eax
.text:000A1F59 E8 D2 62 FA FF call pSwitchContext_InWinice
.text:000A1F5E 58 pop eax
.text:000A1F5F A2 B0 9E 0D 00 mov fNOPAGE, al
.text:000A1F64 07 pop es
.text:000A1F65 61 popa
.text:000A1F66 C3 retn
.text:000A1F66 pDeactivateBPs endp

This is just a cursory look at things, I may have made some mistakes, but it should be enough as a guide to where the new functions are in DS 3.1.

As an aside, if you want to trace *into* IceExt, or any other Softice KDExtension, you can set a BPX in NTICE (yes, it seems to work!) at the call which calls the DriverEntry routine of standard KDExtensions. The DriverEntry routine is configured more like a regular DllEntry routine, except that you still need to find the PDRIVER_OBJECT to register a DriverUnload function. You can trace through IceExt live this way.

NTICE DS3.1
.text:0009A1A3 6A 00 push 0
.text:0009A1A5 6A 01 push 1 ; fwdReason = "DLL_PROCESS_ATTACH"
.text:0009A1A7 FF 76 17 push dword ptr [esi+17h] ; MZ Header
.text:0009A1AA FF 56 1B call dword ptr [esi+1Bh] ; load KDExtension
; DriverEntry_fdwReason_LoadKDExtension

Kayaker
bedrock
02-18-2004, 04:32 AM
Thanks for your great post Kayaker,

I can confirm that i also found the same as you for Expression2Integer and ActivateBPs and added the following byte pattern structures to softice.h file in IceExt:

unsigned char PAT_Expression2Integer_DS31[] = // code pattern
{
0x55, // push ebp
0x8B, 0xEC, // mov ebp, esp
0x83, 0xEC, _XX_, // sub esp, 0Ch
0x56, // push esi
0x33, 0xF6, // xor esi, esi
0x89, 0x75, 0xFC, // mov [ebp+var_4], esi
0x89, 0x75, 0xF4, // mov [ebp+var_C], esi
0x89, 0x75, 0xF8, // mov [ebp+var_8], esi
0x66, 0x89, 0x35, _XX_, _XX_, _XX_, _XX_,
// mov word ptr dword_11787C, si
0xE8 // call pCreate_fExp2Int

};

unsigned char PAT_ActivateBPs_DS31[] = // code pattern
{
0x80, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x01, // cmp dw_IsBPActivated, 1
0x74, _XX_, // jz short loc_A2163
0x80, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x01, // cmp dwNumberOfBPs?, 1
0x74, _XX_, // jz short loc_A2163
0x83, 0x3D, _XX_, _XX_, _XX_, _XX_, 0x00, // cmp dword_108A8E, 0
0x74, _XX_, // jz short loc_41BD5
// loc_A2163:
0x60, // pusha
0xE8, _XX_, _XX_, _XX_, _XX_, // call sub_A4C14
0x61, // popa
0xC3 // retn
};

And made these changes to the init function in the softice.cpp IceExt file:

//-------------------------------------------------------------------------
// Expression2Integer
//-------------------------------------------------------------------------
si_Expression2Integer = TYPE_Expression2Integer (RabSearch(PAT_Expression2Integer, sizeof(PAT_Expression2Integer),
si_CodeBase, si_CodeSize) + si_CodeBase - OFS_Expression2Integer);

if ((DWORD)si_Expression2Integer < (DWORD)si_CodeBase)
{
// search for DS30 pExpression2Integer signature
si_Expression2Integer = TYPE_Expression2Integer (RabSearch(PAT_Expression2Integer_DS30, sizeof(PAT_Expression2Integer_DS30),
si_CodeBase, si_CodeSize) + si_CodeBase - OFS_Expression2Integer);

if ((DWORD)si_Expression2Integer < (DWORD)si_CodeBase)
{
// search for DS31 pExpression2Integer signature
si_Expression2Integer = TYPE_Expression2Integer (RabSearch(PAT_Expression2Integer_DS31, sizeof(PAT_Expression2Integer_DS31),
si_CodeBase, si_CodeSize) + si_CodeBase - OFS_Expression2Integer);

if ((DWORD)si_Expression2Integer < (DWORD)si_CodeBase)
{
DbgPrint("ERROR: Can't find Expression2Integer address in memory.\n");
return FALSE;
}
}
}

//-------------------------------------------------------------------------
// pActivateBPs
//-------------------------------------------------------------------------
si_ActivateBPs = TYPE_ActivateBPs (RabSearch(PAT_ActivateBPs, sizeof(PAT_ActivateBPs),
si_CodeBase, si_CodeSize) + si_CodeBase - OFS_ActivateBPs);

if ((DWORD)si_ActivateBPs < (DWORD)si_CodeBase)
{
si_ActivateBPs = TYPE_ActivateBPs (RabSearch(PAT_ActivateBPs_DS31, sizeof(PAT_ActivateBPs_DS31),
si_CodeBase, si_CodeSize) + si_CodeBase - OFS_ActivateBPs);

if ((DWORD)si_ActivateBPs < (DWORD)si_CodeBase)
{
DbgPrint("ERROR: Can't find pActivateBPs address in memory.\n");
return FALSE;
}
}

I also found it fairly easy to step through the IceExt code live by placing an embedded int3 at the begining of the si_Init() function in the softice.cpp source file.

Hopefully i can spend some more time looking at this today, with your other findings we might be able to make some progress...

--
bedrock
bedrock
02-18-2004, 10:30 AM
Ok,

I've gone through Kayakers info and made some changes to softice.h and softice.cpp files of IceExt source and i have a version of IceExt that will function with DS31. We're not all the way there yet, as I can't find the function named si_UNH_Write, which Sten is using to add Unhandled Exception Filter protection.

But at least this version should give you some Softice hiding ability and !dump function (the main reasons i use iceext) and of course tetris is fully functional ;)

I am attaching a zip file with my two modified source files, in case others want to see changes (Sten) and an IceExt.sys file compiled in release using the XP DDK 2600.1106 version

On a slightly different issue, since installing DS31 and using BPINT 3, i keep landing in ntoskrnl!MmPrefetchPages+02B6, has anyone else noticed this? Maybe caus i've got XP SP2 beta also installed :confused:

PS. I haven't changed the version number of this file, it still identifies itself as 0.57, i wanted to keep my changes to a minimum.

Doh!, must of had a blonde moment, and added the wrong binary to the zip :o

Attachement should now be fixed, sorry guys.

--
bedrock
volodya
02-19-2004, 01:07 PM
Gentlemen, I recently talked to Sten. He is aware of the problem and will do everything. Project is neither dead nor frozen. Just that fucken DDoS screwed up not only wasm, but many-many-many other Russian resources.
bedrock
02-19-2004, 01:34 PM
Gentlemen, I recently talked to Sten. He is aware of the problem and will do everything. Project is neither dead nor frozen..

volodya, this is very good news to hear, hopefully the work we have already done will help Sten, sorry to hear about the continued DDoS attacks on your russian freinds.

--
bedrock
crUsAdEr
02-20-2004, 04:54 PM
Has anyone noticed that Symbol Loader cant detect sice active when iceext is loaded but will work fine once u unload iceext... i did a bit of searching and found the reason to be here in nmtrans.dll

.text:1001FB22 loc_1001FB22: ; CODE XREF: DevIO_ConnectToSoftICE+3Ej
.text:1001FB22 ; DevIO_ConnectToSoftICE+5Bj
.text:1001FB22 push offset Data
.text:1001FB27 lea ecx, [esp+110h+FileName]
.text:1001FB2B push offset a_Ntice ; "\\\\.\\NTICE"
.text:1001FB30 push ecx
.text:1001FB31 call sub_1001FB70
.text:1001FB36 add esp, 0Ch
.text:1001FB39 lea edx, [esp+10Ch+FileName]
.text:1001FB3D push 0 ; hTemplateFile
.text:1001FB3F push 80h ; dwFlagsAndAttributes
.text:1001FB44 push 3 ; dwCreationDisposition
.text:1001FB46 push 0 ; lpSecurityAttributes
.text:1001FB48 push 3 ; dwShareMode
.text:1001FB4A push 80000000h ; dwDesiredAccess
.text:1001FB4F push edx ; lpFileName
.text:1001FB50 call esi ; CreateFileA
.text:1001FB52 mov esi, eax
.text:1001FB54 cmp esi, 0FFFFFFFFh
.text:1001FB57 jnz short sice_active
.text:1001FB59 push 0A6580001h ; dwErrCode
.text:1001FB5E call ds:__imp_SetLastError
.text:1001FB64
.text:1001FB64 sice_active: ; CODE XREF: DevIO_ConnectToSoftICE+C7j
.text:1001FB64 mov eax, esi
.text:1001FB66
.text:1001FB66 loc_1001FB66: ; CODE XREF: DevIO_ConnectToSoftICE+29j
.text:1001FB66 pop esi
.text:1001FB67 add esp, 108h
.text:1001FB6D retn
.text:1001FB6D DevIO_ConnectToSoftICE endp

Here when iceext is loaded, CreateFileA failed and hence export function DevIO_ConnectToSoftICE of nmtrans.dll will return sice not loaded... of course a dirty patch would do the job but i rather understand why... hence this post...

Is this a iceext feature that was present since last releases or is this a bug of the new 'dirty patch' by bedrock :).. no offense bedrock... :)... any explanantion on why sice behaves this way when iceext is loaded? My guess is that iceext patchs something but not sure what...

cheers,
crUs
volodya
02-20-2004, 05:19 PM
The answer should have been looked for in the sources. Use the source, Luk :D
Being brief the answer is "yes". The trick is known as "MeltIce" and many protections are using the same idea to catch Soft-Ice. IceExt hooks several NT API calls through SDT and prevents NtCreateFile (...NTICE...) to return the correct answer. For this and not only for this purpose there is a "protect off" command in IceExt...
crUsAdEr
02-20-2004, 09:51 PM
lol... simple enough... thanks volodya...
pardon me for the silly question... been a while since i touched sice i forgot that meltice is still a viable option to detect softice :).. cheers... time to dig in the source n patch it to make symbol loader works then :)...
crUsAdEr
02-20-2004, 11:36 PM
sorry abt this.. but i am not much of a C++ programmer... and i was just wondering if there is a simple n nice way to change NewNtCreateFileA in protect.cpp to detect if CreateFileA is called by softice itself (nmtrans.dll) and response normally instead of kickin AntiMeltice...

static WCHAR FILT_STR1[] = L"\\??\\NTICE";
static WCHAR FILT_STR2[] = L"\\??\\SIWVIDSTART";
static WCHAR FILT_STR3[] = L"\\??\\SIWSYM";

#define FILT_STR1_SIZE ((sizeof(FILT_STR1)-1)/sizeof(WCHAR))
#define FILT_STR2_SIZE ((sizeof(FILT_STR2)-1)/sizeof(WCHAR))
#define FILT_STR3_SIZE ((sizeof(FILT_STR3)-1)/sizeof(WCHAR))

NTSTATUS NewNtCreateFile(
PHANDLE FileHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock,
PLARGE_INTEGER AllocationSize OPTIONAL,
ULONG FileAttributes,
ULONG ShareAccess,
ULONG CreateDisposition,
ULONG CreateOptions,
PVOID EaBuffer OPTIONAL,
ULONG EaLength)
{
NTSTATUS rc;

if (protect_MeltICE)
{

if (ObjectAttributes->ObjectName->Buffer)
{
if (
(_wcsnicmp(ObjectAttributes->ObjectName->Buffer,
FILT_STR1, FILT_STR1_SIZE) == 0) ||
(_wcsnicmp(ObjectAttributes->ObjectName->Buffer,
FILT_STR2, FILT_STR2_SIZE) == 0) ||
(_wcsnicmp(ObjectAttributes->ObjectName->Buffer,
FILT_STR3, FILT_STR3_SIZE) == 0)
)
{
DbgPrint(szMethodMeltICE);
return STATUS_OBJECT_NAME_NOT_FOUND;
}
}
}

rc=((NTCREATEFILE)(OldNtCreateFile)) (
FileHandle,
DesiredAccess,
ObjectAttributes,
IoStatusBlock,
AllocationSize,
FileAttributes,
ShareAccess,
CreateDisposition,
CreateOptions,
EaBuffer,
EaLength);
return rc;
}

of course in asm, we simply look on stack value n trace a few values down to find caller EIP but i rather do something nice n portable in C++,, any suggestion?
bedrock
02-21-2004, 05:45 AM
@ crUsAdEr,

No offence taken ;)

As volodya already answered, this was always the way symbol loader behaved with IceExt loaded and is due to protection.

I never thought about changing IceExt to allow symbol loader to detect softice, but i like your idea, i dont know how this can be done easily in C though, NtCreateFile is 'undocumented' my m$, although i found some information here hxxp://undocumented.ntinternals.net but it doesn't appear to be able to detect the caller of this function.

--
bedrock
doug
02-21-2004, 11:17 AM
crusader:
imho, A better solution to this when using IceExt is to disable Meltice, do what needs to be done w.r.t nmtrans and put protect back on.

Some protections use nmtrans.dll's exported NmSynmIsSoftICELoaded to detect the debugger.. If you let nmtrans checks pass through, you might be fooled by an easy MeltICE debugger check without knowing / being able to disable it (without recompiling).

just !help protect and it'll tell u what to do to disable only meltice.
crUsAdEr
02-21-2004, 12:13 PM
Hi doug,

Thanks for the suggestion... though i like to use softice log history and if symbol loader cant detect softice, i cant save log :(... i was thinking of actually print out a debug msg saying Softice detection by nmtrans.dll etc... so hopefully i wont be fooled if protector uses nmtrans.dll exported function... the thing is that even iceext debug print is also to sice command window, which is stored in sice log so if i cant access log file, i wont even see any of iceext debug msg...

I was just exploring anyway, getting old rusty brain back in shape :)

bedrock, if you watch pOutputHandle of NewNtCreateFile, you will see it is a n address on usermode stack, thus if you scroll down from that address a bit you will see the address of original caller of CreateFileA... the thing now is how to work out how usermode stack is mapped onto kernel mode stack... what else is called inbetween CreateFileA and the final NtCreatFile...
crUsAdEr
02-22-2004, 02:24 AM
Can someone confirm this?

DS3.1 no longer patch CC into UnhandledExceptionFilter anymore? I have tried to detect sice through this feature with no success... the patch routine doesnt seem to be there anymore...
JMI
02-24-2004, 08:29 PM
I've added this to another thread in the Newbie Forum, but thought I'd add it here as well.

"For those who may not have noticed, Sten's IceExt 0.60 is available at Wasm.ru. They are still under DDOS attack, so you may have to keep trying."

Regards,
andox
02-27-2004, 04:59 AM
wasm.ru does not work at all for me, are there any another site to download IceExt 0.60 from?
sgdt
02-27-2004, 09:07 AM
Have you tried ExeTools? That's where I got mine from.
ZaiRoN
02-27-2004, 09:16 AM
andox, this thread will help you:
http://www.woodmann.net/forum/showthread.php?t=5500&highlight=iceext
andox
02-27-2004, 09:27 AM
Thanks, i got it from exetools ftp :)
ZaiRoN
02-27-2004, 04:27 PM
Oooops... sorry. I did not notice the version :rolleyes:
Sten
03-01-2004, 06:04 AM
Can someone confirm this?

DS3.1 no longer patch CC into UnhandledExceptionFilter anymore? I have tried to detect sice through this feature with no success... the patch routine doesnt seem to be there anymore...

I've tested this on two machines. On one machine SoftICE doesn't patch UnhandledExceptionFilter at all.

On other machine INT3 is there, i.e. SoftICE patches UnhandledExceptionFilter but in a strange way. Now you can see this INT 3 instruction when disassemble function in SoftICE (previous versions hides INT3 when you activate SoftICE).

So, it seems SoftICE MAY patch UnhandledExceptionFilter during it's startup. It is not clear yet what conditions patching depends on.
Just disassemble KERNEL32!UnhandledExceptionFilter and look if SoftICE patches it on your system. If it does, you can now hide SoftICE just replacing INT3 instruction with the oribinal byte.
crUsAdEr
03-02-2004, 02:05 AM
HI Sten,

Thanks for the info... i can confirm that on 2 of my machine, win2k SP4 and Server 2003 both don't seem to be patched at UEF...

However, on the quest to find where sice patch... i stumbled upon quite a few functions in ntoskrnl that is patched by sice, eg. MiMapViewImageHeaderInHyperSpace, MiMapViewOfImageSection, _MmUnmapViewOfSection etc... note that these patched are masked by sice so display memory in sice wont show CC, but bpm on them will stick...

I guess sice hook these functions for paging handling etc.. not sure but if protectors want to check for sice, they sure as hell have lots of choices beside UEF... and i am not sure you can disable them the way you do with UEF.

On what system do you get sice to patch UEF?
Sten
03-02-2004, 03:44 AM
SoftICE patches UEF on my home PC (WinXP SP1). However, it does not patches UEF on other PC (WinXP SP1 + security patches). I'll check this again, patching may depend on SoftICE initialization settings for ex.

However, on the quest to find where sice patch... i stumbled upon quite a few functions in ntoskrnl that is patched by sice, eg. MiMapViewImageHeaderInHyperSpace, MiMapViewOfImageSection, _MmUnmapViewOfSection etc...

Yeah, I know SoftICE patches some functions from ntoskrnl. Fortunately, windows kernel code is not accessible for ring3 applications, so I do not consider this as a problem.

BTW, these hooks can be disabled with help of undocumented and unexported in official build IceExt command '!unhook'.
crUsAdEr
03-02-2004, 08:28 AM
cool... no wonder i couldnt call the !unhook functions... i saw it in the source but couldnt figure out how to use it :)... Do you know what these ntoskrnl hooks are for? Is this safe to disable them?

Yeah, I know SoftICE patches some functions from ntoskrnl. Fortunately, windows kernel code is not accessible for ring3 applications, so I do not consider this as a problem.
lol.. i didnot know that... sorry for the misinformation... i always thought you can read from anywhere in memory, just cant write to certain memory area only...

btw, i was looking but cant find the area of code where sice sits there, loop ard do nothing, freezing everythign waiting for user input... can u point me to them?

Thanks,
crUs
Sten
03-02-2004, 09:35 AM
Do you know what these ntoskrnl hooks are for? Is this safe to disable them?

The system seems to be stable after disabling these hooks however I would prefer to keep them enabled as SoftICE relies on this hooks someway..

btw, i was looking but cant find the area of code where sice sits there, loop ard do nothing, freezing everythign waiting for user input... can u point me to them?

SoftICE usually activates from one of the interrupt handler (p_INT03 for ex. in TheOwl notation). SoftICE calls pStopSecondCPUs to stop all CPUs except one SoftICE executes on and rises current APIC task priority to highest possible.

The main SoftICE routine called pNTIceMain. Here SoftICE does all the work for handling user input, executing commands e.t.c.
crUsAdEr
03-04-2004, 02:41 AM
Hi Sten,

I notice in your iceext source, you simply drop the command into the KbdBuffer and then call NTicemain... is this as simple as that to send a command to sice or do you also need to patch somewhere else in ntice memory?
Sten
03-04-2004, 04:25 AM
I notice in your iceext source, you simply drop the command into the KbdBuffer and then call NTicemain... is this as simple as that to send a command to sice or do you also need to patch somewhere else in ntice memory?

Yeah, you can send command to SoftICE in this way. No patching is needed.
Even SoftICE itself uses this trick when handling initialization string from winice.dat.
crUsAdEr
03-28-2004, 04:06 AM
Hi Sten,

Well this is what i found so far... using undocumaneted command "ver -ahk"
It will list all the hooks that sice installed, among which
NT API Hook function 25: UnhandledExceptionFilter
Hook address : 7C51BD2B Module: kernel32.dll
Handler : BF37CD01 StartSearchFn:
RetHandler : 0
OSI ID : FA000024
First byte : 0
Enable * : BF3B1D18 (=1)
Status : OK

With the enable flag offset at BF3B1D18, i trace down to this
INIT:0016FAA6 68 78 F9 16 00 push offset aDisableusermodehooks ; "DisableUserModeHooks"
INIT:0016FAAB A3 60 95 12 00 mov fDisableNameSaving, eax
INIT:0016FAB0 E8 93 2D 00 00 call pQueryRegistry
INIT:0016FAB5 85 C0 test eax, eax
INIT:0016FAB7 74 07 jz short loc_16FAC0
INIT:0016FAB9 83 25 18 9D 0D 00+ and fEnableUsermodeHook, 0
INIT:0016FAC0
INIT:0016FAC0 loc_16FAC0: ; CODE XREF: pReadUndocSiceSetting+115j
INIT:0016FAC0 85 F6 test esi, esi
INIT:0016FAC2 74 0F jz short loc_16FAD3
INIT:0016FAC4 83 3D 5C 95 12 00+ cmp fDoInt2DPatch, 2
INIT:0016FACB 74 06 jz short loc_16FAD3
INIT:0016FACD 89 35 1C 4C 15 00 mov Int2DLocation, esi

However, i cant seem to be able to find any Registry Key value corresponding to DisableUsermodeHook :/
Sten
03-29-2004, 04:01 AM
Hi crUsAdEr,

I've just released IceExt 0.62 and added some sort of a fix to UnhandledExceptionFilter problem. Now IceExt patches UEF directly and removes INT3 instruction. The problem - I do not know what original byte is, so I always assume it to be 68h.

Your info can be quite useful, thanks.
crUsAdEr
03-29-2004, 08:47 PM
Hi Sten,

iceext0.62 doesnt seem to be able to patch UEF on my system... it says fail to patch error... i couldnot locate your si_UNH_PAT either... can you tell me the exact RVA?
pLayAr
03-30-2004, 01:07 AM
Hi Sten,

Well this is what i found so far... using undocumaneted command "ver -ahk"
It will list all the hooks that sice installed, among which

With the enable flag offset at BF3B1D18, i trace down to this
INIT:0016FAA6 68 78 F9 16 00 push offset aDisableusermodehooks ; "DisableUserModeHooks"
INIT:0016FAAB A3 60 95 12 00 mov fDisableNameSaving, eax
INIT:0016FAB0 E8 93 2D 00 00 call pQueryRegistry
INIT:0016FAB5 85 C0 test eax, eax
INIT:0016FAB7 74 07 jz short loc_16FAC0
INIT:0016FAB9 83 25 18 9D 0D 00+ and fEnableUsermodeHook, 0
INIT:0016FAC0
INIT:0016FAC0 loc_16FAC0: ; CODE XREF: pReadUndocSiceSetting+115j
INIT:0016FAC0 85 F6 test esi, esi
INIT:0016FAC2 74 0F jz short loc_16FAD3
INIT:0016FAC4 83 3D 5C 95 12 00+ cmp fDoInt2DPatch, 2
INIT:0016FACB 74 06 jz short loc_16FAD3
INIT:0016FACD 89 35 1C 4C 15 00 mov Int2DLocation, esi

However, i cant seem to be able to find any Registry Key value corresponding to DisableUsermodeHook :/

GOOD WORK
i create a registry key named "DisableUsermodeHooks", and set it's value to 1
now ,si do not patch UEF!
bedrock
03-30-2004, 01:09 AM
Hi sten,

Also i tried this on my system which is running XP SP2 (RC1 build 2096), i checked kernel32!UnhandledExceptionFilter and it does begin with 0x68, but iceext062 report

Error: Unable to patch UnhandledExceptionFilter

--
bedrock
Sten
03-30-2004, 01:36 AM
Currently IceExt can patch UEF when SoftICE is activated in a context of a process that uses KERNEL32.DLL. (I'm too lazy to switch context from my code).

It seems DisableUsermodeHook registry key is preffered solution to UEF problem.

Hi sten,

Also i tried this on my system which is running XP SP2 (RC1 build 2096), i checked kernel32!UnhandledExceptionFilter and it does begin with 0x68, but iceext062 report

Error: Unable to patch UnhandledExceptionFilter

--
bedrock
crUsAdEr
03-30-2004, 02:15 AM
Hi Sten,

Can you point me to the RVA of si_UHF_Write_PAT used in in your protect.cpp code? I did try pattern searching but cant seem to find them...
Sten
03-30-2004, 02:20 AM
Hi crUsAdEr,

IceExt doesn't patches pUNH_Write procedure in SoftICE 4.3.1 (as there isn't any). IceExt directly writes to UnhandledExceptionFilter, see protSetUEFPatchDS31().

Hi Sten,

Can you point me to the RVA of si_UHF_Write_PAT used in in your protect.cpp code? I did try pattern searching but cant seem to find them...
crUsAdEr
03-30-2004, 03:15 AM
Thanks... that clears my doubt... the hooking is done by CptHook.sys but if we patch it then it will affect all API hooking...
crUsAdEr
03-30-2004, 04:41 AM
Hi Sten,

Attempting to stop iceext with "bpint 1" or "bpint 3" on will result in a system crash... that is because bpint install new handler via IDT hence when we try to remove iceext the handling chain is broken... perhaps you can try patching bpint to hook int1/3 differently, chain after your handler, so iceext can exit gracefully when required? Then again i guess there is no reason to remove iceext heh :)?

Anyway, since u r at it, can also fix the annoying "bpint 3 feature" that pop sice up at its own internal API hook (this has been reported here before) :)
Timbo
03-31-2004, 01:51 PM
Hi Sten,

nice work, but if "net start iceext" start's ntice and iceext patch
unhandledexceptionfilter direct, a "CC" on OEP's won't be triggered
with XP (SP1&SP2pre). I have to enter ntice, write cc, exit to desktop,
enter ntice, replace cc with 68 (well never seen 55 maybe w2k),
and ntice trigger OEP (with i3here on)
maybe someone knows more :confused:


ImpREC.dll problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > ImpREC.dll problem
PDA

View Full Version : ImpREC.dll problem

FEUERRADER
02-17-2004, 10:56 PM
I want use ImpREC.dll in my unpacker, but it works only on winNT-systems. HOWEVER, GUW32 use THIS ImpREC.dll and successfully rebuild import on win9x! It's a paradox!!!
In my unpacker ImpREC.dll on win9x import looks like:
=============================
KERNEL32.dll 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache KERNEL32.dll 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache 1FlushInstructionCache
=============================
On WinXP my unpacker works fine, but on win9x import filled FlushInstructionCache functions.

Rebuild function looks like:
BOOL RebuildImport(DWORD pid, DWORD oep_rva, DWORD iat_rva, DWORD nb_recursion, LPTSTR dump_filename);

Syntax of my call on MSVC++ 6.0:
RebuildImport(pi.dwProcessId, 0x401000, 0, 5, m_Dumpname);

What is nb_recursion??? I reversed PEiD Generic Unpacker by Snaker and there found this number. There was 5.
What number must be there??

p.s. sorry for my ugly english
v0kram
02-18-2004, 01:42 AM
ImpREC.DLL wont work on Win9X on a process which you loaded with the Debug APIs...It's a problem with the way APIs are handled or so on it...I had the problem long ago and discussed with MackT.

A work-around maybe to fire up the process again without Debug APIs and then use that handle to make ImpREC fix imports...


Lights out - Crypto game
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Lights out - Crypto game
PDA

View Full Version : Lights out - Crypto game

Aquatic
02-18-2004, 12:05 AM
http://www.2flashgames.com/f/f-35.htm

Can you solve it?

The solution is very interesting.

http://finmath.uchicago.edu/~wilder/Code/lights/instructions.pdf


MYDOOM Virus
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > MYDOOM Virus
PDA

View Full Version : MYDOOM Virus

Polaris
02-18-2004, 07:56 AM
Hi there...

I am willing to analize the MYDOOM virus... And I was wondering if anybody could point me to a valid binary (since my search are giving no results :( ).

Thanks in advance...

Polaris
dELTA
02-18-2004, 08:05 AM
Here's a ready made analysis for you. :)
Polaris
02-18-2004, 11:41 AM
:o

Here's a ready made analysis for you. :)

Ehmmm... I was asking for binary because I would have it analized by myself... As an exercise of RE.

However, thank you for the analisys.. I'll have a look!

Byyeyyeyzzzz
mmk
02-18-2004, 12:09 PM
Google for MyDoom. Read the av company's analysis and note that the file is copied to the kazaa shared folder. Install kazaa and search for the filenames it copies to the kazaa folder. Download and don't infect yourself...
esther
02-18-2004, 12:17 PM
it looks like autocad 3d graphic :D
JMI
02-18-2004, 09:39 PM
esther dear:

It's time for you to actually learn how to make this version of vBulletin work like the rest of us do. You seem to have been having alot of double posts and/or deletions and reposts with your edits lately.

Check your damn screen saver and see if it's timing you out and causing the problem. Otherwise, please figure out how to use the "edit button" so you do NOT have to double post or delete a thread nearly EVERY FRIGGEN TIME YOU POST. We're all getting double vision. :cool:

Regards,
Woodmann
02-18-2004, 10:49 PM
>don Wooma says<

Don't spit in the wind.

>or else you get a wet face<

Everybody be :)

Woodmann
shadz
02-25-2004, 03:26 AM
Hi there...

I am willing to analize the MYDOOM virus... And I was wondering if anybody could point me to a valid binary (since my search are giving no results :( ).

Thanks in advance...

Polaris

Check your email, I'm its a good likelyhood you got it spammed to you...

:P

-Shadz
evaluator
02-25-2004, 08:06 AM
Don Wooma, maybe correct version is:

Don't spit >against< the wind..

**
"Don Wooma", "Don Woodman" & other me's specipfic phrazez are
me's IntelLectual poperty, which is potected other laws;
esther
02-25-2004, 10:43 AM
>We're all getting double vision. :cool:

You ppl should change glasses :p
evaluator
02-25-2004, 11:31 AM
esther, did you see, what says Don Wooma!?

"Don't spit in the wind, or else esther gets a wet face"..

your commentz?
esther
02-25-2004, 11:38 AM
>"Don't spit in the wind, or else esther gets a wet face"..

>your commentz?

I spit on the floor,wall,road,but not against,on the wind ;)
Woodmann
02-26-2004, 05:11 PM
HAHAHAHAHAAa You guys are killing me :D

If I had the chance to sit in a room with esther and eval,
smoke myself a little herb and then have a conversation
about the international monetary system and its effects
on the 2004 celery crop...................

Hey, I can wish :p

Woodmann
evaluator
02-27-2004, 01:55 AM
ok, Don Wooma,

little suggestion: this simple virus request thread maybe better will look in OffTopic?


A request but keep the screaming down :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A request but keep the screaming down :)
PDA

View Full Version : A request but keep the screaming down :)

roocoon
02-19-2004, 03:13 PM
Hi all.
Anybody can point me to any forums or sites that could help locating a couple of documents?
In particular, the reference documents for CSAPI and CTAPI. The Microsoft Common Speller and Thesaurus APIs.
I believe an old version was in a 1994 MSDN disc. I'm looking for version 3.x but I haven't gotten the MSDN discs lately and I don't know if the documents are still included there.
Any suggestions?
Thanks in advance.
JMI
02-19-2004, 03:57 PM
Phsssst roocoon:

Don't tell anyone I told you this, but you can actually find stuff by searching on the net. Try to keep it hush, hush. We wouldn't want everybody to find out that they can actually do their own searching and actually find information out there on the net. It would make it soooo crowded out there.

Now since you are looking for information on M$ API, did it occur to you to go to M$'s KnowledgeBase and seek that information? But don't tell anyone else about that resource. Let's keep it our secret, O.K.?

And if you tried simply putting "The Microsoft Common Speller API (CSAPI)" into your favorite search engine you might have even discovered that there is an article there titled: "The Microsoft Common Speller API (CSAPI) for Office Spell Checking (Q262605)". I even suspect that a little similar "not so hard" searching will result in information on the "Thesaurus APIs" as well. But, don't spread it around. If anyone has information on version 3.x, they should.

Regards,
roocoon
02-19-2004, 05:41 PM
Fascinating what you learn every day :).
Take it a step further and actually read these MS references you point out and you might find that you have to sign a non-disclosure before MS gives you anything.
Now, all this irony aside, if you have actually found anything on the net, please let me know if you feel like it. I'm short on time and for all my searching I couldn't locate anything.
Take care.
Woodmann
02-19-2004, 09:04 PM
Howdy,

I have a stupid idea....
Why dont you take a peak inside Office and figure it out for yourself.

No wait, I have a better idea, why dont you tell us what you are trying to do.

Woodmann
JMI
02-19-2004, 09:16 PM
Oh now Woody, that would be telling. :rolleyes: We were supposed to guess.
As in his not telling us he HAD done any searching and what he had found, or not found. :eek:

Oh, and by the way Mr. "I did search," what about the very first listing in Mr. Google using "The Microsoft Common Speller API (CSAPI)" which is a reference to the CodeProject with the title of "Using the Microsoft Common Spell API" which contain: 1) CSAPI PDF Doc;( which just happens to be the "official" m$ documentation from October 1992, Revised 1994) 2) a demo project; and an link to the 3) Official CSAPI documentation (from M$). I mean, afterall, the PDF only contains 32 pages of the Code and descriptions of CSAPI. :rolleyes:

Now if you don't want to register at the CodeProject, to get the PDF file, that is YOUR problem, but it is not generally useful to demonstrate both your ignorance and your arrogance in the same reply.

Regards,
Woodmann
02-19-2004, 10:13 PM
Well now........

I was just trying to be nice :)
I mean, if all you have to do is give up a fake name and disposable email address to get some M.s documentation...........
You must be trying to do something that would be considered not legal in certain areas of the world. :eek:

Woodmann
disavowed
02-19-2004, 11:45 PM
I mean, if all you have to do is give up a fake name and disposable email address...
f33r www.mailinator.com (http://www.mailinator.com)
roocoon
02-20-2004, 02:26 AM
You guys don't give up, do you? :)
It's being fun but after this I won't respond to this particular thread anymore so you can be as sarcastic as you like.
First off, no bad feelings. I'm not offended in any sense and I don't try to be offensive. I sound sarcastic just to go along with the spirit.
The reference pointed to above refers to the 1994 version. I believe I mentioned that I needed version 3.
Registering with a false name: No need to. I registered with a real name BUT I have to wait for the appropriate support person to finish the negotiations with the Ireland office. No idea why he has to go through that place but that's the way MS works. Estimate is a week and it's been the same estimate since November.
To look into the function myself: Why if the info is available? Rediscovering the wheel won't make me smarter.
And to top it off, it's not for my use. I'm working on other parts of the project. It's for some developers in my group (not reversers) who have to provide the code that accesses the spelling and thesaurus functionality from within their own code. Deadline is 5 days for the whole project but because of MS it looks like this part wiill not be delivered on time.
That's it. Got to go look for the API.
Regards.
nikolatesla20
02-20-2004, 09:15 AM
Um, I have to say this. Why are you guys developing software but you don't have an MSDN license? Where I work they have a basic license, and we get pretty much all sdk's, and everything else you can think of, quarterly.

Also, look what I have found, young padowan.

To facilitate development of these add-in components, and to allow other software developers to build compatible CSAPI hosts, Microsoft has made the CSAPI specification available. Developers interested in implementing a CSAPI-compatible host application or CSAPI spell check engine and lexicon, can contact Microsoft Developer Support. The following Microsoft Knowledge Base article contains the contact information:

Q234322 OFF2000: Getting Support for Microsoft Office Solutions

NOTE: Third-party developers looking to incorporate spell check capabilities into their own applications may NOT use CSAPI to access the spell check engine and lexicons that are installed by Microsoft Office. Microsoft does not currently provide spell check utilities for use in third-party products.

Looks like u guys may be attempting something that is not supported and not allowed. That's why your functions aren't documented!

I got this info from October 2001 MSDN library.

Check out that Q number maybe it will help.

-nt20
Woodmann
02-21-2004, 07:57 PM
Howdy,

If you have the MSDN license then this whole thread is pointless.

Also, if you have the MSDN license and you dont get prompt support,
you need to contact someone higher up the food chain.
Being blown off like you claim has no excuse. If it were me, someone would lose their job over that shit.

If you need some help in moving up the food chain, let me know VIA PM.
I know some people who know some people who used to know some people ;)

Woodmann
evaluator
02-22-2004, 03:59 AM
Don Wooma,

>I know some people who know some people who used to know some people

i like trikie phrases:) thankz.
but in other side.. my trikie brain creates following Question:

"And.. how near or far are You from M$ !?"

---

roocoon!
1. your post in no way matches to given forum. (TOT)
2. please, read the FAQ & respect MB
roocoon
02-22-2004, 06:20 AM
Thank you all for the responses.
evaluator is right so let's stop this thread. I know the rules but I asked here since this forum drags in people who really deal with programming.
To satisfy Woodmann (thanks for the offer) and the others, the shop I'm helping is pretty small. They access Office XP for their dictionary usage but never got MSDN since their development is exclusively in Delphi (which drives me up a wall since Delphi is extremely unfriendly to the part of the work I'm doing for them, but that's another long story).
In any case, I don't think the MSDN discs contain the API anymore. I've only located the 1994 version in my old discs.
If anybody can locate and is willing to share the version 3 reference within the next couple of days please PM or e-mail me.
Take care everybody.
JMI
02-22-2004, 12:51 PM
Eval:

The answer to your question is that "Don Wooma" is "not near, he's far." :D
I, on the other hand, am not "nearly so far." :cool:

Regards,
Woodmann
02-22-2004, 08:16 PM
BAHAHAHAHAHAHAHAHAAAa.......

The Don only knows some people.
He does not hang out with them in social settings.
He does not associate with them in a business setting.

The Don's Mom has taught him well the skill needed.

Woodmann
evaluator
02-23-2004, 01:38 AM
Don's Words - The Law
Woodmann
02-23-2004, 08:03 PM
You mean Mom's word is the law :eek:
evaluator
02-24-2004, 06:28 AM
Don Wooma,

well, i think, JMI can write for You some historical-paper about this phrase.
ok, my trikie mind goes to suspend state..
-
Don Wooma,
Some btrd plays dirti with u here. Will You order to cut him?
Woodmann
02-24-2004, 05:09 PM
Howdy,

There are not that many people who can irritate me.

Sometimes I just hasta give somebody a slap, ya know what I mean ?
As for if you's askin me if I would have to give him 2 in the hat......
I dont know nuthin about that stuff ;)

Woodmann


crypt crackme:blowfish
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > crypt crackme:blowfish
PDA

View Full Version : crypt crackme:blowfish

lordor
02-20-2004, 02:25 AM
Hi,I come back again,this time bring the crypt crackme No3 here,if succeed,you will see a website! Gook Lock!
any quetion,pleas mail to :lordor@digitalnuke.com

by lordor
04.2.20
ZaiRoN
02-22-2004, 07:38 AM
Hi lordor,
nice one! A simple blowfish crackme for those whom have never seen this algo before.
Well, all the things that you need to know in order to solve this crackme are the functions used by the blowfish's implementation: the initialization function followed by an encryption/decryption function. Use google to locate (one of the millions) blowfish implementation and then try to understand what the crackme want... ;-)

Zai
lordor
02-23-2004, 04:56 AM
hi,zai
This crackme is very simple.I make this crackme just want to let the beginer to learn blowfish algorithm.

the lenght of serial is 20,the first 4 byte is "4002".
klier
04-03-2004, 09:12 AM
made a keygen for the blowfish crackme.
works on my computer,not sure on all.
can someone test?

Regards,
GabryJ
04-03-2004, 09:27 AM
no, it gives me an error and shutdowns.

Application called (some bytes) from (some bytes) Memory cannot be "read". Click ok to quit or cancel to debug. with a critical message box.
klier
04-03-2004, 09:31 AM
shiiit

thank you,
ZaiRoN
04-03-2004, 10:29 AM
Well done klier, it works on my xp sp1 machine.
GabryJ, which os are you using?

Zai
klier
04-06-2004, 02:20 PM
just curious.
on wich os it's crashing?
i have winxp sp1 to.

anybody

Regards,
GabryJ
04-07-2004, 08:26 AM
I have Win2k :(

It runs, but when I hit Generate or so...it crashes :(
klier
04-07-2004, 11:09 AM
probably smashed the stack :(

sorry

i learn best with trial and error and error and error.... :)

Regards,
lordor
04-09-2004, 10:27 PM
to klier:
your kegen will crash on my win2000sp4.but when using ollDbg to debug the kegen,It can create the right key in memory,gread!
roticv
04-12-2004, 10:36 AM
No, you did not preserve ebx, breaking the number one rule in win32asm coding.
klier
04-12-2004, 11:58 AM
Then i'm sorry that i broke the number one rule in win32asm coding. :o

Better next time.

Was my first keygen(no excuse).

Regards,
dev_zero
04-17-2004, 04:53 PM
I'm gonna try it in wine linux.. :)
Just wondering does anyone know about som good crypt revers engineering tutorials...? I don't know exactely what to do here?
mr.x
05-04-2004, 01:26 PM
http://wwww.digitalnuke was displayed first
"Nuke Group" was displayed second
nikolatesla20
05-04-2004, 01:46 PM
No, you did not preserve ebx, breaking the number one rule in win32asm coding.

That's why for quick and dirty ASM programs I just use pushad/popad on all my functions.

-nt20
klier
05-04-2004, 02:01 PM
That's why for quick and dirty ASM programs I just use pushad/popad on all my functions.

Yep,never forget. :)


"New" protection. ya right...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > "New" protection. ya right...
PDA

View Full Version : "New" protection. ya right...

nikolatesla20
02-20-2004, 02:35 PM
Anyone else see this yet?

http://www.pbs.org/cringely/pulpit/pulpit20040219.html

Same old, same old in my opinion. If code runs it can be broken...

-nt20
dELTA
02-20-2004, 05:47 PM
Yeah, the guy doesn't only seem to be full of crap, but his ridiculously over-positive praise and predictions about this "PSCP" makes it seem to me that he got quite the "christmas present" from the guys pushing that "technology"...


How to see invisible processes on your machine?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > How to see invisible processes on your machine?
PDA

View Full Version : How to see invisible processes on your machine?

Aquatic
02-20-2004, 07:54 PM
Is there any way to see so-called "invisible processes" on your comp? These are obviously processes that do not want to be seen.

I just wish there was a way to see all processes regardless of how cleverly they are trying to hide themselves.

I was thinking with Kernel mode softice.
Woodmann
02-20-2004, 08:25 PM
Howdy,

sysinternals.com

Woodmann
dELTA
02-20-2004, 09:18 PM
Processes per se should not be able to hide (if they don't manage to install ring 0 code or patch the kernel), but the usual ways to hide running code is to inject the code (e.g. through dll injection) as a new thread into an existing process. This can be very hard to detect, and the only reasonable way I can think of is to authenticate all dll:s used by processes (and that would still not be enough if the code is injected directly into the memory space of the target process without injecting a dll, in that case I guess the only way is to monitor all suspicious operations that write data to the memory of other processes, which is even harder).
Kayaker
02-20-2004, 11:26 PM
Hiya

I posted something in response to this, might be interestin', might not :)

http://66.98.132.48/forum/showthread.php?t=5547
Aquatic
02-21-2004, 02:50 AM
Thank you.


Softice as JIT debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice as JIT debugger
PDA

View Full Version : Softice as JIT debugger

ancev
02-20-2004, 09:22 PM
hi,

anybody can point me how set SI to be the jit(just in time) debugger, under XP? i´m using ds3

also... there´s a way to change, in XP, the GPF box? i liked to old one...

vecna/29a
volodya
02-21-2004, 01:06 PM
RTFM!
Read "Using Soft-Ice" manual.
faults on/faults off and remember to distinguish between the first/last chance notifications. Study CommonDispatchException code.
ancev
02-21-2004, 09:52 PM
volodya,

pffft... next time, no need to reply

ancev


Retrieving System, Process and Thread information using ZwQuerySystemInformation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Retrieving System, Process and Thread information using ZwQuerySystemInformation
PDA

View Full Version : Retrieving System, Process and Thread information using ZwQuerySystemInformation

Kayaker
02-20-2004, 11:22 PM
Hi All,

I wasn't particularly planning on releasing this, but it is a useful enough utility and example of driver programming. It demonstrates all the information you can retrieve using ZwQuerySystemInformation with the Information Classes of SystemBasicInformation, SystemProcessorInformation, SystemProcessesAndThreadsInformation and SystemModuleInformation.

In terms of more advanced driver programming, it gives an example of mapping kernel memory to user mode using MDL's, as described in the included OSR file 'Sharing Memory Between Drivers and Applications'.

The main reason I'm presenting it is in response to a question about detecting "invisible" processes, or possibly detecting if your code has been "injected". There is a bit of information that ZwQuerySystemInformation discloses that might be of some use. In particular, the SystemProcessesAndThreadsInformation class retrieves a few interesting bits of info for each running process, the ProcessId, and more importantly the InheritedFromProcessId, as well as the complete SYSTEM_THREADS listing.

Why is this important? A little playing with this utility will show that most User processes are started from the everpresent Windows Explorer process, and an applications' InheritedFromProcessId value reflects this. In other words, the ProcessId of Explorer = the InheritedFromProcessId of normally started applications. This appears to be true of applications started from the Desktop, StartMenu or Taskbar.

Now, can the InheritedFromProcessId tell the protectionist anything about the 'hijacking' loader? In terms of an attached Win32 debugger (i.e. OllyDbg), the answer is Yes, InheritedFromProcessId directly indicates the PID of the debugger. In terms of an injected dll, not necessarily, other than it exists, because in many cases of dll injection the "loader" has exited and only the injected dll remains, so the InheritedFromProcessId may be invalid or arbitrary.

So how to tell if your process is running an injected dll? By the number of threads running - if your program has only 1 main thread, but SystemProcessesAndThreadsInformation indicates 2, then you've got a stowaway and the CLIENT_ID structure will give you the ThreadID of it.

What you do then is your choice ;)

I haven't explored all the possibilities of this in terms of protection or otherwise, nor tested with every known injection technique etc., this is just observations from a little playing with my own information gathering utility for personal use. Perhaps this will be of some use or interest to others, full source, tested on Win2K.

Regards,
Kayaker
mmk
02-20-2004, 11:44 PM
You can always inject code into explorer and launch the app from an explorer.exe thread. That's what people will do if more apps check parent pid.

You also don't need to write a device driver to call ZwQuerySystemInformation().

Injecting code in another process doesn't mean you have to create a new thread.

It's a cat and mouse game, as you already know. You try to detect me, and I'll try to hide better. And do you know who the winner will be? Me. All I need to do is write a perfect CPU simulator and you'll never be able to tell if you're being debugged or not.
Kayaker
02-21-2004, 12:01 AM
>You can always inject code into explorer and launch the app from an explorer.exe thread. That's what people will do if more apps check parent pid.

Good point, might be an interesting experiment.

>You also don't need to write a device driver to call ZwQuerySystemInformation().

Nope, but I was more interested in a reason for learning to use MDL's than in what the 'subject' was, nor was this meant to be a caveat for injection detection, a simple driver example and information utility only.

>It's a cat and mouse game, as you already know. You try to detect me, and I'll try to hide better. And do you know who the winner will be? Me. All I need to do is write a perfect CPU simulator and you'll never be able to tell if you're being debugged or not.

S'OK, I'm not trying to detect anybody, but you're right it is a fun game nonetheless :D
sna
02-22-2004, 07:08 AM
here's a note for all the protectionists that might be reading this thread and thinking that these are good techniques for preventing software cracking. now that Kayaker has been nice enough to create this module that plugs right into your software, before using it you should be aware of the possible drawbacks and problems that could arise from doing so.

first of all, everyone might not be big fans of the default windows shell and as commonly happens with things that we don't like they get replaced. this happens. quite often. http://www.shell-shocked.org/

second of all, if your application relies on any third-party code whatsoever (read: uses the Windows API) then there will be no guarantees of any kind as to how many/which modules are loaded. also, just because you're not creating separate job threads doesn't mean that the third-party code isn't. for example what if the Microsoft programmers decide that Windows 2005 should stick a garbage collector in every process?

just something to ponder...

regards, sna
Opcode
03-01-2004, 06:50 PM
No one should trust in this module to see all process and threads running.
Rootkits are in a very advanced stage of hiding process and threads.
Actually, the unique tool that show all threads and process is the
Klister module (only for windows 2k).
It detects even processes hidden by the Fu rootkit.

Klister at
http://www.rootkit.com/project.php?id=14


bug in a game
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > bug in a game
PDA

View Full Version : bug in a game

Dj Heiko
02-21-2004, 10:39 AM
Hi,

I have a problem with a game.
At beginning I post the code were the bug came (ecx is 00000000)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A95(C)
|
:00428AC9 8B4E04 mov ecx, dword ptr [esi+04]
:00428ACC 8D7EF4 lea edi, dword ptr [esi-0C]
:00428ACF 57 push edi
:00428AD0 E84BEFFFFF call 00427A20
:00428AD5 8B46F8 mov eax, dword ptr [esi-08]
:00428AD8 8B0D60EF5200 mov ecx, dword ptr [0052EF60]
:00428ADE 8B401C mov eax, dword ptr [eax+1C]
:00428AE1 8B89F0190100 mov ecx, dword ptr [ecx+000119F0]

It comes at EIP 00428AC9

I know this line is a indirect pointer but I don´t know where esi+04 looks to get the worth for ecx.
But I think esi+04 looks in this case where no worth is for ecx.

Can I look in a table when esi+04 is a number what number ecx will get?
So I can edit esi berfor the bug comes.
sgdt
02-21-2004, 11:45 AM
Hi,

I have a problem with a game.
At beginning I post the code were the bug came (ecx is 00000000)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A95(C)
|
:00428AC9 8B4E04 mov ecx, dword ptr [esi+04]
:00428ACC 8D7EF4 lea edi, dword ptr [esi-0C]
:00428ACF 57 push edi
:00428AD0 E84BEFFFFF call 00427A20
:00428AD5 8B46F8 mov eax, dword ptr [esi-08]
:00428AD8 8B0D60EF5200 mov ecx, dword ptr [0052EF60]
:00428ADE 8B401C mov eax, dword ptr [eax+1C]
:00428AE1 8B89F0190100 mov ecx, dword ptr [ecx+000119F0]

It comes at EIP 00428AC9

I know this line is a indirect pointer but I don´t know where esi+04 looks to get the worth for ecx.
But I think esi+04 looks in this case where no worth is for ecx.

Can I look in a table when esi+04 is a number what number ecx will get?
So I can edit esi berfor the bug comes.

Have you considered using OllyDebug instead? It would make your life a bit easier...

In Olly, you can not only view the contents of ESI in the dump window, you can (on W2K or XP) set a hardware breakpoint on up to four locations and the program will stop when it toasts the value. It even has the ability to do single step trace logging and debugger hiding. Way cool stuff.

Anyway, check out the following (xx becomes tt)

For OllyDbg
hxxp://home.t-online.de/home/Ollydbg

Quick Start of commands
hxxp://home.t-online.de/home/Ollydbg/quickst.htm

Plug-ins and links (definitely get OllyScript!!!)
hxxp://ollydbg.win32asmcommunity.net/stuph/

For the Forums
hxxp://ollydbg.win32asmcommunity.net
naides
02-21-2004, 11:49 AM
Hi,

I have a problem with a game.
At beginning I post the code were the bug came (ecx is 00000000)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00428A95(C)
|
:00428AC9 8B4E04 mov ecx, dword ptr [esi+04]
:00428ACC 8D7EF4 lea edi, dword ptr [esi-0C]
:00428ACF 57 push edi
:00428AD0 E84BEFFFFF call 00427A20
:00428AD5 8B46F8 mov eax, dword ptr [esi-08]
:00428AD8 8B0D60EF5200 mov ecx, dword ptr [0052EF60]
:00428ADE 8B401C mov eax, dword ptr [eax+1C]
:00428AE1 8B89F0190100 mov ecx, dword ptr [ecx+000119F0]

It comes at EIP 00428AC9

I know this line is a indirect pointer but I don´t know where esi+04 looks to get the worth for ecx.
But I think esi+04 looks in this case where no worth is for ecx.

Can I look in a table when esi+04 is a number what number ecx will get?
So I can edit esi berfor the bug comes.

You can examine the value pointed by [esi+04] by typing in Softice

d @ [esi + 04]

But I suspect the origin of the bug is not the actual value pointed by [esi + 04] but rather that [esi + 04] points to an unmapped or invalid area of the memory, which certainly will generate a exception when you try to move it into ECX.
Dj Heiko
02-21-2004, 12:08 PM
The problem ist that this call was gone through many times and it works.
I testet very much (I work with softice but I have ollydebug too)

I find out that this call worked but any time the bug comes. I don´t know why.
The game don´t crash at this instruction
but several instructions later.
There ecx (is 00000000) copy to esi (it gos 0000000 too)

* Referenced by a CALL at Addresses:
|:00428535 , :00428A73 , :00428A9E , :00428AD0
|
:00427A20 83EC08 sub esp, 00000008
:00427A23 55 push ebp
:00427A24 56 push esi
:00427A25 8BF1 mov esi, ecx
:00427A27 8B5608 mov edx, dword ptr [esi+08]
:00427A2A 8B4E04 mov ecx, dword ptr [esi+04]
:00427A2D 3BCA cmp ecx, edx
:00427A2F 57 push edi
:00427A30 8974240C mov dword ptr [esp+0C], esi
:00427A34 0F84D2000000 je 00427B0C
:00427A3A 8B442418 mov eax, dword ptr [esp+18]

The bug is than in line 0042A27 (I´m sure why)

The pointer to ecx (00428AC9) has nearly every time a other worth.
So I have to look if the pointer is beside a worth or so on.

Any tips?
dELTA
02-21-2004, 12:40 PM
It seems to me like you either have to analyze and understand the surrounding code more (the real "bug" is often not located at the same line of code as the line that results in a crash because of the bug), or do an inline patch that checks if these pointer registers contain valid addresses (!= 0 ?) before referencing them.
Dj Heiko
02-21-2004, 02:33 PM
yes so I set several breakpoints with softice and get out that on EIP 00428AC9 ecx=00000000 but its clear on this line it isn´t the real bug.
But I dont´t know what I can do now.

I have the chance to write code before 00427A20 (where the game crash) because there are several nop lines.

There I write

cmp ecx, 00000000
je EIP

at EIP I jump to a other bigger nop place and there I tried much.
So when the indirect pointer is beside a right worth for ecx I can edit esi.

But I do´´t know what to do.
Dj Heiko
02-22-2004, 04:05 PM
Can nobody help me?

Or don´t you understand what I want?
dELTA
02-22-2004, 07:55 PM
Like I said in my last post, you must try to understand where the real bug is in the code, and then fix it, not just patch blindly. We cannot understand it for you (and certainly not without seeing the code).
disavowed
02-23-2004, 12:21 AM
using olly, set a conditional breakpoint on that line for when ecx == 0. then trace back from there to see where and why ecx was set to 0 for that instance
Aimless
02-23-2004, 01:26 AM
Hi,

Wrong move to analyse the function, before understanding where its coming from. I can see that its a conditional call. The first breakpoint I would put, is where the comparision is being made (even before the call instruction that would subsequently be called).

Then, take a look at all registers. You may need to work in IDA rather than ICE/Ollydbg before you come to a conclusion about the area where the wrong value is set.

A good tip is to understand what's happening to the function BEFORE its being called.

Yeah! I know. Its painful. But then again, no one said RCE would be a joyride.

Have Phun
Dj Heiko
02-23-2004, 02:39 AM
Yes you are right but I said, ecx going 00000000 on EIP 00428AC9.
But I don´t know why. I don´t know what to do now.
dELTA
02-24-2004, 07:27 AM
Oh for christ sakes...
Dj Heiko
02-24-2004, 12:29 PM
Whats this for a post?
This help me nothing, if you think it isn´t very intelligent what I write then write rather nothing.

The problem is I looked for the bug where it can happende but there isn´t a call near.
The call will be indirect called ^^ with a register or so on.

And usually the game go without a crash through the code so what can I edit.
I think I can only repair the bug before the game crash.

But I don´t understand the indirect pointer (00428AC9)
It esi is often 5/6 times a other worth but ecx is nevertheless identy.
But a other time the worth of ecx change and will be a while identy.

from where gets esi+04 the worth for ecx??
disavowed
02-24-2004, 02:10 PM
i answered your question above. please re-read my post
JMI
02-24-2004, 02:56 PM
He said:

"trace back from there to see where and why ecx was set to 0 for that instance."

Look ABOVE the point in the code where you found "ecx+00000000." You have to find where the code changes or sets "esi+4" and/or ecx to "00000000" or where is checks it or changes it, or even DOES NOT CHANGE IT. You have to stop the code ABOVE your error and TRACE back to the point of the error and observe what is happening to ecx.

Regards,
Polaris
02-24-2004, 03:29 PM
He said:

"trace back from there to see where and why ecx was set to 0 for that instance."

Look ABOVE the point in the code where you found "ecx+00000000." You have to find where the code changes or sets "esi+4" and/or ecx to "00000000" or where is checks it or changes it, or even DOES NOT CHANGE IT. You have to stop the code ABOVE your error and TRACE back to the point of the error and observe what is happening to ecx.

Regards,

JMI you are always SO clear :D :D ;)


SoftIce Just runs Once !
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce Just runs Once !
PDA

View Full Version : SoftIce Just runs Once !

fifthelement
02-21-2004, 12:35 PM
I have a very strange problem ! I Have downloaded Numega SoftIce 4.2.7 build 562. I also promise not to include links to bad things. I have windows xp SP1. when I install it and restart my PC everythinh is OK, by pressing ctrl+d softice pops up and works ! but when I restart my computer again and start NTICE service and press ctrl+d, it doesnt pop up and just system freeze ! but typing "x+[Enter]" it releases system ! it seems it is working but there is nothing visible, I set some breakpoints too ! (when it was invisible) It worked ! but I dont see anything just everything is freezed ! this was my last problem so I decided to change my OS to win 2000 advanced server to resolve it ! but when it loads siwvid.sys windows crashes winth KMODE_EXCEPTION_NOT_HANDLED !
anyone can help plz ? :confused:
JMI
02-21-2004, 01:03 PM
fifthelement:

There is much discussion here already about the operation of Sice and XP. Generally, none of the versions prior to 3.0 seemed to work well with XP, but 3.0 and 3.1 seem to have solved most of those problems.

What you need to do first is follow the directions of the BIG RED LETTERS at the top of the Forums and do your own search here using "Softice" and "XP" and/or "Sice" and "XP" or other combinations of those general terms. For example, using "softice problems XP" I got 27 threads including some discussing "crashing" on startup of softice.

After you have reviewed those threads, come back and discuss how your problems are not solved by what has already been discussed before. That is what the "Search" button is intended to provide, a means to review all the prior discussion of your issue.

Regards,
fifthelement
02-21-2004, 06:18 PM
Dear JMI, I have searched the whole web ! not just this forum ! but found nothing useful ! I have studied many docs but I couldnt find anything like mine ! my problem is that it works but just once after install, I thought may be some one on this forum had this problem before, so I asked.
Aimless
02-23-2004, 12:53 AM
Perhaps you need to move to DS 3.0 and above...?

Have Phun
Clandestiny
03-07-2004, 08:09 PM
It worked ! but I dont see anything just everything is freezed ! anyone can help plz ? :confused:

Consider updating your video drivers. I had a similar problem on my laptop, but after updating the video drivers, everything was fine.

Cheers,
Clandestiny
DeathWing
04-11-2004, 03:22 PM
Dear JMI, I have searched the whole web ! not just this forum ! but found nothing useful ! I have studied many docs but I couldnt find anything like mine ! my problem is that it works but just once after install, I thought may be some one on this forum had this problem before, so I asked.
try using DS. cause i have tried nearly everything and every video mode to solve the same problem. softice only showed after a fresh install. nothing worked. now im using DS 3.1
Silver
05-06-2004, 12:20 PM
Try downloading the sp4 patch and os.dat from the compuware softice updates page. I had a similar problem, updating fixed it.
Sergey R.
05-19-2004, 05:23 AM
fifthelement
Read this paper - hxxp://frontline.compuware.com/nashua/kb/doc/1348.asp (the last part).
I had similar problem with starting SI 2.7 on WinXP SP1 and it helped my to resolve it.


Hmm interesting new protection....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hmm interesting new protection....
PDA

View Full Version : Hmm interesting new protection....

Test2000
02-21-2004, 12:48 PM
Okay while doing some searching on various crackmes I decided to try out what I had learned on some more commerical games. I downloaded a range of old products that I like (mainly text simulations) and a few other things. Had no problems with most of these simple serial protection. Thats when I came across something tricky. I'll break it down in steps:

(1) I opened up the .exe of the programme I was attempting to reverse saw that it was your standard 14 day evaluation yada yada yada. Okay so advance clock and go back and see what happens.

(2) Ohh look at that the application has expired yada yada yada. Lets look for some references. Hmm seems standard serial protection lets enter a couple of those okay we've got our invalid message lets have a search again.

(3) Open up various tools to look for references (WDASM, HiEW) nothing so this looks like the application is packed.

(4) Lets have a look what its packed with well according to PEiD its packed with Protection Plus.

(5) Lets have a search around for some tutorials on Protecion Plus or any unpackers on Protection Plus. Found total: 0.

Thats about where I have hit the snag. I tried opening up the application with OllyDbg but it has some rather odd modules. The oddest one seems to be that it has a duplicate module of the actual exe file but its not the exe file. I've also looked at the actual PE header of the programme and the flags seem to be unpacked yet I know the application is packed because of the PEiD scan and the way the code displays in WDASM. Might be something for someone more advanced to have a play with and see what type of protection its using. If you want the .exe I've been trying to unpack for interests sake I'll PM you. Supposedly CORE already did a crack on this version but I believe it does not work.

Any information on the Protection Plus scheme if known would also be welcome as I may put this on my #2 list of priorities after I've finished my reading.

[Edit: One other thing I forgot to add is when I loaded up OllyDbg and tried to go back to the .exe it seemed to corrupt it. When I tried with SoftIce it had SoftIce detection running. As I use XP FrogsIce was not an option this may well be an option for someone running this scheme on a ME/9x platform].
hobferret
02-22-2004, 05:36 PM
Test2000 M8 ;)

Send a PM this sounds interesting :D

regards

/hobferret


Armadillo enhanced softice detection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo enhanced softice detection
PDA

View Full Version : Armadillo enhanced softice detection

fira
02-21-2004, 03:23 PM
Hi,

seems that with armadillo's enhanced softice detection enabled, you get the 'debugger present' error message even with softice disabled. so what does it check for? softice beeing installed ?
A quick glance with regmon/filemon didn't reveal nothing of interest. Anyone investigated this further ?

thanks!
mmk
02-21-2004, 03:47 PM
Armadillo checks for IceExt. Search the board for Armadillo and IceExt and you'll find a post with more details. Of course it checks other stuff as well, but at least the IceExt test is in the newer Armadillo versions.
[NtSC]
02-22-2004, 06:44 AM
From what Sten told me,new IceExtension is already worked out and will be released soon ;)


List of all String comparing APIs?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > List of all String comparing APIs?
PDA

View Full Version : List of all String comparing APIs?

Aquatic
02-21-2004, 08:20 PM
I am looking for a list of all well-known string comparing APIS.

Why? Well because sometimes the program don't use GetWindowTexta or GetDlgItemTexta, or even ComparestringA or ComparestringW.

Thanks.
doug
02-21-2004, 09:34 PM
you are mixing up things:

GetWindowTexta & GetDlgItemTexta are not comparison functions.

Furthermore, even if you had the most complete list of string compare functions, strings can be compared without calling any API at all.

(btw you can also get the text by sending the WM_GETTEXT window message, google that, plenty of info on it)
Aquatic
02-21-2004, 10:02 PM
I know they're not compare functions, I just meant any function involving checking a string.

& Thanks for info.
evlncrn8
02-22-2004, 01:12 AM
I know they're not compare functions, I just meant any function involving checking a string.

& Thanks for info.

lstrcmp, lstrcmpi etc etc
Kayaker
02-22-2004, 02:19 AM
The PSDK should be your best friend here... :) Plus there's a bunch of string handling functions if Shlwapi.dll is used.
Aquatic
02-22-2004, 06:08 AM
The PSDK should be your best friend here... :) Plus there's a bunch of string handling functions if Shlwapi.dll is used.

Hello.

Google gave me this:

PowerSDK is a development framework for Macromedia Flash. The framework allows libraries of code to be imported into the Flash Player at runtime. Once these libraries are loaded, they can be used with an application as needed. The current release provides support for Flash 5 and 6 Players with identical functionality on each version.

*head explodes*
ZaiRoN
02-22-2004, 06:26 AM
Google gave me this:As always happen, Google gave you a lot of entries; then you have to choose the right one. "Platform SDK" is what you need...

Zai
Solomon
02-22-2004, 06:56 AM
Progs written with Delphi/BCB never call GetWindowText/GetDlgItemText to get text input from editboxes.

If you search "strcmp" in VCL source code of "system.pas", you will get some string comparison functions(not M$ API) implemented by Borland. IDA can identify these functions if you have appropriate sig files.


link: "View Forum Leaders"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > link: "View Forum Leaders"
PDA

View Full Version : link: "View Forum Leaders"

evaluator
02-22-2004, 04:25 AM
link: "View Forum Leaders"

(:)Hop!(:)

just accidentally pressed thiz link.. terrible!
What a narcissism!? How you can guys, how you can!?

MAINE Ultimatum:
... make there also section: "Musicians" & put me:) plz-plz-plz-plz~:)
or i'l cryyyyyy
esther
02-22-2004, 09:35 PM
Cry!!!


what is a thunk???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > what is a thunk???
PDA

View Full Version : what is a thunk???

yaa
02-22-2004, 06:05 AM
Hello,

I already asked this question in other forums time ago, without really getting an answer that satisfied me (when I find this word I'm still puzzled). I often see this word pop up in articles and essays, and the idea I made myself of it is that it is a "a sequence of memory addresses or jumps to memory addresses" .... so, the IAT could be called a thunk.
In a book I also found the following:

In 32-bit environments, the linker generates a thunk of which it does know the address. The thunk looks like:

0x40000000: jmp DWORD PTR __imp_func1

Here __imp_func1 is the address for func1's slot in the import address table of the .EXE file. All the addresses are thus known to the linker. The loader only has to update the .EXE file's import address table at load time for everything to work correctly.

A definition of thunk I found is "A piece of coding which provides an address".

Could someone clarify this term?????

yaa
[NtSC]
02-22-2004, 06:52 AM
Actually an Iat-Thunk is a Pointer to an Import Ascii (if its no Ordinal).
And this Pointer to the Import Ascii will be filled by the OS when the Exe is executed aka. the OS Loader resolves the Import Table...

Lets say:

Thunk: points to --> GetVersion Ascii

after the Program was loaded by the OS.. The Pointer to the Ascii is replaced with the Memory-Address of GetVersion.

If you want to go like Hook Apis with this Method.. Be aware that the Import Table for example under W2k isnt automaticlly loaded when you create an Exe suspended. You should place a Break on its Entrypoint and then traverse the Import Table for the initialized Thunk-Adress you wanna redirect/hijack.

I would suggest you to study some good PE Documents,lets say Yates Pe-Notes or something to get better into that stuff.. ;)
esther
02-22-2004, 07:37 AM
Although this article is very old but it certainly explains what are thunks

hXXp://mup.anticrack.de/Matt%20Pietrek%20-%20PE%20Format.html
yaa
02-22-2004, 09:08 AM
[NtSC], your use of the word ASCII is confusing.
Isn't the IAT a set of DWORDs (not ASCII???!!!) updated by the loader with the real entry point to the imported dll functions?

Still, I'm surprised by the fact that everyone is using this thunk word and yet no one is able to give a clear definition of it.

yaa
[NtSC]
02-22-2004, 10:16 AM
Well...
Actually the Thunks contain Addresses that POINT to Ascii-Strings with the acoording Functions..

And the OS grabs these Ascii-Strings + acoording DllNames and resolves the Entry and writes the Adress of the Function into the ThunkSlot..

So its like..

Pointer to Ascii (Pointer to Function-Name) gets overwritten with the Function Address.
Aimless
02-23-2004, 01:18 AM
OK Yaa, here it is:

Imagine that there is an exe file. Note that this is a very rough representation just for understanding purposes. The words XXX stands for instructions (normal ones). The exe would look like this:

---Begin Exe----
XXX
XXX
XXX
call MessageBoxA
XXX
XXX
Call MessageBoxA
XX
XX
XX
Call MessageBoxA
----End Exe-----

What is the problem here?

The problem is, in my computer, the function MessageBoxA is actually located at memory addres 700999F. But in your computer it is loaded at 7884FF54. So, when you run the exe in my computer, the exe looks like this:

---Begin Exe----
XXX
XXX
XXX
call 700999F
XXX
XXX
Call 700999F
XX
XX
XX
Call 700999F
----End Exe-----

but in your computer, it may look like this:

---Begin Exe----
XXX
XXX
XXX
call 7884FF54
XXX
XXX
Call 7884FF54
XX
XX
XX
Call 7884FF54
----End Exe-----

Get that? Now we go further:

First of all, who does this? Who changes the address in memory to 7884FF54 in your machine and to 700999F in mine? Simple. Its the Operating System Loader. This is generally the process in all machines. So to summarize, the OS loads the addresses of the API in the memory (complicated process, but for now, keep it simple). OK? Easy as pie!!

Now, what is the further problem? Imagine messagebox, instead of being called around 3 times as shown in our exe, is now called 60 times!!! Uff!!! that's quite a headache for the OS loader. It has to now scan the exe in memory and replace ALL 60 occassions of MessageBoxA with the address (say 700999F or 7884FF54 - my machine or your machine). Is there not a simple way? Of course!!! What if I modify my exe in this manner:

---Begin Exe----
0001:00000001 XXX
0001:00000003 XXX
0001:00000005 XXX
0001:00000007 jmp 0001:00000090
0001:00000009 XXX
0001:00000011 XXX
0001:00000013 jmp 0001:00000090
0001:00000015 XXX
0001:00000017 XXX
0001:00000019 XXX
0001:00000021 jmp 0001:00000090
:
:
0001:00000090 Call MessageBoxA
----End Exe-----

Wow!!! Now all the loader has to do, it simply put the value in memory from your computer or my computer in one single place, instead of the 60 places. So, the exe on my computer would look like:

---Begin Exe----
0001:00000001 XXX
0001:00000003 XXX
0001:00000005 XXX
0001:00000007 jmp 0001:00000090
0001:00000009 XXX
0001:00000011 XXX
0001:00000013 jmp 0001:00000090
0001:00000015 XXX
0001:00000017 XXX
0001:00000019 XXX
0001:00000021 jmp 0001:00000090
:
:
0001:00000090 Call 700999F (in memory, which is MessageBoxA)
----End Exe-----

Simple to understand, is it not? Here, all jumps are called, well JUMPS. But the call at 0001:00000090? Its called as THUNKS. Get it? Simple is it not?

Have Phun
akimp3
02-23-2004, 12:04 PM
Hi
@slayer
Thank you very much this is one of the best definition of thunks
that i have ever seen.

bye
esther
02-23-2004, 10:25 PM
Hmm to what I know the os loaders searches for the dll address,depends on the os.The address jmp dword ptr[xxxxxx] only appears once while the call function repeats 2 or 3 times in the file.

The jmp table is the thunk as explain in the above docs.

Regards
yaa
02-24-2004, 05:08 PM
esther is right.
The multiple calls to a given API use a CALL instruction. The thunk instead uses unconditional jumps (JMP). Otherwise the API closing RET would take back to the thunk, not to the instruction following the API call.

Is the IAT itself a thunk???

hxxp://www.hyperdictionary.com/computing/thunk

yaa
Aimless
02-25-2004, 12:44 AM
Hrrr.....!!!!! Must be the fight with my wife I had last night on spending too much time on Woodmann's board.

Esther, you are correct. The above explanation got me mixed up in call/jumps. Here's the correct explanation.

Look Sharp!!

--------------------Begin New Explanation-------------------------

OK Yaa, here it is:

Imagine that there is an exe file. Note that this is a very rough representation just for understanding purposes. The words XXX stands for instructions (normal ones). The exe would look like this:

---Begin Exe----
XXX
XXX
XXX
call MessageBoxA
XXX
XXX
Call MessageBoxA
XX
XX
XX
Call MessageBoxA
----End Exe-----

What is the problem here?

The problem is, in my computer, the function MessageBoxA is actually located at memory addres 700999F. But in your computer it is loaded at 7884FF54. So, when you run the exe in my computer, the exe looks like this:

---Begin Exe----
XXX
XXX
XXX
call 700999F
XXX
XXX
Call 700999F
XX
XX
XX
Call 700999F
----End Exe-----

but in your computer, it may look like this:

---Begin Exe----
XXX
XXX
XXX
call 7884FF54
XXX
XXX
Call 7884FF54
XX
XX
XX
Call 7884FF54
----End Exe-----

Get that? Now we go further:

First of all, who does this? Who changes the address in memory to 7884FF54 in your machine and to 700999F in mine? Simple. Its the Operating System Loader. This is generally the process in all machines. So to summarize, the OS loads the addresses of the API in the memory (complicated process, but for now, keep it simple). OK? Easy as pie!!

Now, what is the further problem? Imagine messagebox, instead of being called around 3 times as shown in our exe, is now called 60 times!!! Uff!!! that's quite a headache for the OS loader. It has to now scan the exe in memory and replace ALL 60 occassions of MessageBoxA with the address (say 700999F or 7884FF54 - my machine or your machine). Is there not a simple way? Of course!!! What if I modify my exe in this manner:

---Begin Exe----
0001:00000001 XXX
0001:00000003 XXX
0001:00000005 XXX
0001:00000007 call 0001:00000090
0001:00000009 XXX
0001:00000011 XXX
0001:00000013 call 0001:00000090
0001:00000015 XXX
0001:00000017 XXX
0001:00000019 XXX
0001:00000021 call 0001:00000090
:
:
0001:00000090 jmp MessageBoxA
----End Exe-----

Wow!!! Now all the loader has to do, it simply put the value in memory from your computer or my computer in one single place, instead of the 60 places. So, the exe on my computer would look like:

---Begin Exe----
0001:00000001 XXX
0001:00000003 XXX
0001:00000005 XXX
0001:00000007 call 0001:00000090
0001:00000009 XXX
0001:00000011 XXX
0001:00000013 call 0001:00000090
0001:00000015 XXX
0001:00000017 XXX
0001:00000019 XXX
0001:00000021 call 0001:00000090
:
:
0001:00000090 jmp 700999F (in memory, which is MessageBoxA)
----End Exe-----

Simple to understand, is it not? Here, all CALLS are called, well CALLS. But the jump at 0001:00000090? Its called as THUNKS. Get it? Simple is it not?

Have Phun

-----------Close New Explanation---------------------------

Hope nobody crashed his computer because of this :P

Have Phun


Need help in unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help in unpacking
PDA

View Full Version : Need help in unpacking

siddhartha
02-22-2004, 09:35 PM
I'm trying to unpack a program packed with svkp 1.3x. When I find the OEP, dump it and run the dumped exe I get an error. I know I should repair the import table, but when I run ImpRec it says "96 unresolved imports". How do I do that so the dumped program runs normally and I can crack it?

P.S.: Is there a way to post a link to an external page so you can see what I'm talkin' about?

R.E.S.P.E.C.T.
evlncrn8
02-22-2004, 10:32 PM
unresolved imports.. trace them, you'll find svkp takes some imports himself like GetCommandLineA, along with the svkp exports that can be included like svkp_killdebugger etc.. use the search button and look up svkp, then start tracing it
siddhartha
02-22-2004, 10:44 PM
good idea, but when i hit the search button to trace it says: "Could not find anything good at this OEP! :-("
something's wrong with this proggie... any other suggestions?

R.E.S.P.E.C.T.
JMI
02-22-2004, 11:34 PM
siddhartha:

Perhaps evlncrn8 was suggesting that you try the "search" button here. You did read the BIG RED LETTERS didn't you?

There are several threads on svkp and a few even on svkp 1.3 already contained in the Forums. Have you read those to see if they assist in your searching for a solution?

There are also several threads on exetools regarding this protector. You should also review those. Try reading those and see if they give you any hints to try. If not come back and ask for further help.

Regards,
siddhartha
02-23-2004, 12:23 AM
Dear JMI, I did read all the threads at this forum and exetools also, but it didn't help me. I searched a thousand times, and I requested a generic tutorial on svkp on exetools indeed... so, other suggestions?

R.E.S.P.E.C.T.
evlncrn8
02-23-2004, 12:36 AM
good suggestion : debugging it, and finding the answers for yourself, most tuts are meant as examples, not 'heres how to crack protectionx on a silver platter'.. digest them, play with them, learn for yourself

for svkp basically u gotta find the missing ep bytes (if that option was used during packing) and resolve the missing imports, i know svkp has at least 10+ 'internal' apis that it sticks into the import records, experiment

pm me the info on the target, i'll have a look and see if i can help you with your missing imports


Does asprotect have anti-tracing code???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Does asprotect have anti-tracing code???
PDA

View Full Version : Does asprotect have anti-tracing code???

padawan
02-23-2004, 07:20 AM
Hello,

I'm taking a look at an application protected with Asprotect 1.2/1.2c, looking for the OEP I used the trace function of OllyDbg setting a stop condition of EIP < 900000 just as described in two different tutorials by LaBBa (http://www.woodmann.net/forum/showthread.php?t=4958 and http://www.woodmann.net/forum/showthread.php?t=4614). But this trace stop condition DOES NOT work!! OllyDbg goes past the OEP (which is indeed < 900000) running forever. I repeated this step various times and then gave up thinking that asprotect must have some anti-tracing code.
But this explaination does not satisfy me especially considering that the specific version of asprotect isn't very recent.

Can anyone help me understand what is happening or can suggest how I could go investigating this behavior???
I already found the OEP, so I don't really need this step, still it disturbs me not to understand what is happening.

padawan

PS: I search the forum for someone reporting something like this must have come up with nothing.
Ricardo Narvaja
02-23-2004, 08:00 AM
The trace into function of olly, for my experience,is not perfect, in many times, crash or step lines easily.

The better form to trace into work well is starting in the asprotect code, not in a api, and clear all options in DEBUGGING OPTIONS-TRACE.

if crash the trace, go to the last line before crash ad put a Hardware bpx, and run till this line, step the api, and continue tracing.

Ricardo
padawan
02-23-2004, 03:50 PM
thanks Ricardo,

I was starting tracing from inside ntdll.dll and I had set the option to trace over system DLLs selected. Unfortunately OllyDbg seems to have a bug because in this situation somehow any pause condition (such as EIP<900000) is somehow ignored and tracing goes on forever.

padawan


wasm.ru is back
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > wasm.ru is back
PDA

View Full Version : wasm.ru is back

crUsAdEr
02-23-2004, 11:01 AM
yep yep it is indeed back online...
esther
02-23-2004, 11:12 AM
Hooray?
Kayaker
02-23-2004, 12:52 PM
Hooray?

If you're willing to read between the lines of a Babelfish translation, yes, definitely, it's a fine site. Even a bad translation there is more understandable than many of the In-glitch posts we get here, n that incl00dz the annoyingly lazy l33t style d00d.. :p
JMI
02-23-2004, 02:28 PM
What he said. :D

Regards,
disavowed
02-23-2004, 03:04 PM
still looks pretty dead to me :(
too bad.. that was a nice site
JMI
02-23-2004, 03:33 PM
Maybe the DDOS attacks resumed when everyone announced they were back. :( I did access the site several times this morning, but is it not available at the moment.

Regards,
volodya
02-23-2004, 04:33 PM
Well, of course, the DDoS is still here, but despite it we are not going to close. The wasm was, is and will be! :cool:
esther
02-23-2004, 08:56 PM
Indood iz a fi sight itz waz noot up az thaz time,itz juzz a qoostionz :eek: :rolleyes: :p
JMI
02-24-2004, 03:08 PM
Well, that's clear. :D

Regards,
doug
02-24-2004, 04:58 PM
is it possible to get an offline version of the site?
Kayaker
02-24-2004, 05:27 PM
I'm surprised you missed it, even without a translation :)

http://wasm.ru/docs/1/wasm-offline-18_01_2004.chm
doug
02-24-2004, 11:36 PM
yea I remember seeing them regularly putting up offline versions
thought it was completely shut down :P
Last time I tried it, there was a 2 lines message in russian.
(btw, the offline version doesn't include any files..)

I was thinking about something like Immortal Descendants (7meg ID-RIP.zip with everything)

thanks.
volodya
02-25-2004, 02:32 PM
Last time I tried it, there was a 2 lines message in russian.

There is sth wrong with your connection. Offline version contains all the articles WITHOUT the files. No files. The resources are different here and in Russia. As I know both countries, I can compare. No any russian site will post files in the separate file. Doesn't make much sence.
As to the stability - we are sorry. I do realize it is not the best way of doing things, but DDoS is not stopping...
tom324
02-25-2004, 03:08 PM
volodya,

Perhaps a mirror of wasm.ru would be a good idea? Or zipped site uploaded here?

Tom
volodya
02-25-2004, 03:22 PM
Hello, Tom. Glad to hear you, old buddy.
Probably yes... But there are several difficulties.
1) The content may be prohibited in USA. Not that many cracks or warez but still...
2) DDoS will be switched to the mirror as well. It is personal...
3) I myself and three more people from wasm team must TRUST the mirror owners.
The last topic is the most serious one.
tom324
02-25-2004, 03:43 PM
> DDoS will be switched to the mirror as well.

A Linux box with iptables (before Web server) can help a bit about DDoS.

> It is personal...

The best defence is counterattack by publishing some names ;)

Tom
volodya
02-25-2004, 03:49 PM
Tom, I'm not a newbie... Beleive me. And we are all aready tired of the endless advices about IP tables, DNS redirection, etc.. etc... etc...

The best defence is counterattack by publishing some names

The best defence is to find this mothefucker and put his balls into his ass.
dELTA
02-25-2004, 06:30 PM
3) I myself and three more people from wasm team must TRUST the mirror owners.
The last topic is the most serious one.

In what way must you trust them, and in what way would this be important? Seems to me that keeping a copy of already public files can't really be abused in many ways even if you try?

Just curious...
volodya
02-25-2004, 08:03 PM
The name of the site can be obused. This is the only thing I DO care about.


Questions for Bill Gates
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Questions for Bill Gates
PDA

View Full Version : Questions for Bill Gates

disavowed
02-23-2004, 07:12 PM
I will be meeting Bill Gates in April and will have the opportunity to ask him some questions. Does anyone have any good questions they'd like asked?

Serious responses only, please.
esther
02-23-2004, 09:12 PM
What would be the next OS?

Will *nix & windows merge for the new OS?
disavowed
02-23-2004, 09:25 PM
What would be the next OS?

Will *nix & windows merge for the new OS?don't need gates to answer that. longhorn and no, in that order
esther
02-23-2004, 11:00 PM
Then there's no new breakthroughs in os a couple of years later.

There's no questions to ask bill gates afaic ;)
evaluator
02-24-2004, 01:56 AM
yep?

disavowed,
before requesting serious questions for BlGt, firstly you should imagine:
Whether BlGt will answer on really serious questions!?
dELTA
02-24-2004, 07:46 AM
disavowed:
Will any kind of actions be taken in Longhorn to discourage people from continuing to develop normal win32 applications, and make everyone migrate to the new type of programs? In that case, which? Will old win32 applications continue to work just like before in all ways at least?

May we ask what kind of meeting this is? You and five thousand other people in a room, or something better? Are you really serious?
evaluator
02-24-2004, 08:49 AM
deLTa, you are too strong with him:)

+ trikie Q to him
"& what serious question are you plain to ask BG yourself?"
disavowed
02-24-2004, 11:52 AM
Whether BlGt will answer on really serious questions!?yes, i will actually be expected to ask some very serious questions

Will any kind of actions be taken in Longhorn to discourage people from continuing to develop normal win32 applications, and make everyone migrate to the new type of programs?again, no need to ask gates this question. the documentation on microsoft.com clearly states that the answer is: no.

Will old win32 applications continue to work just like before in all ways at least?again, answered on their website. answer is: yes

You and five thousand other people in a room, or something better? Are you really serious?no, it will be a relatively small crowd. and yes, i am serious

what serious question are you plain to ask BG yourself?i would rather not say for anonymity reasons
evaluator
02-25-2004, 01:03 AM
ok, thanks for answers, disavowed.

>yes, i will actually be expected to ask some very serious questions
maybe you not understood my question?
i mean: are you sure, BlGt will answer on "very serious questions".
but no prob at all, you will see.

now for your anonymity:
1. because you declared about "very serious questions", so you can catched on them.
solution: ask you "very serious questions" after some other's "very serious questions".

2. relly, don't ask 3d person's Q, only your..;
(place here those's Q, we will anal-ze them)

thanks for fun.

--

deLTa, hehe, M$-RTM to you:)
naides
02-25-2004, 08:11 AM
I will be meeting Bill Gates in April and will have the opportunity to ask him some questions. Does anyone have any good questions they'd like asked?

Serious responses only, please.

I would like to know about Windows Security.
Is it Security by Obscurity?
If Windows source code became publicly available, would Windows machines became even more vulnerable? (see the news)
Is that one of the reasons why Win OS sources are kept a trade secret?
disavowed
02-25-2004, 10:09 AM
evaluator, thanks

I would like to know about Windows Security.
Is it Security by Obscurity?again, reading www.microsoft.com (http://www.microsoft.com) will explain that they are not trying to do security by obscurity

If Windows source code became publicly available, would Windows machines became even more vulnerable? (see the news)microsoft has said in the past: yes

Is that one of the reasons why Win OS sources are kept a trade secret?see above
dELTA
02-25-2004, 06:24 PM
I guess, in the end, it is very hard to come up with a serious question that noone has ever asked him before, and that is not published anywhere. What the hell, ask him at what age he lost his virginity then. :D
evaluator
02-26-2004, 01:50 AM
instead, deLTA, I think so:

without any looking in m$-web, you can easy answer on any serious q yourself.

lets play little game, you ask q, I will answer(if understand subj)
& then disavowed(~from m$ side:) will confirm.
Aquatic
02-26-2004, 04:20 AM
Ask if he will remove ActiveX from IE.
disavowed
02-26-2004, 09:18 AM
well, i wasn't 100% truthful... the gates thing was really yesterday, not in april (http://www.cornell.edu/CUHomePage/gates.html)
when i originally posted, i was under the impression that there wasn't supposed to be much publicity about it, so i didn't want to post the actual day and location until after-the-fact.

as it turned out, only four or five questions were taken before the end (including some pretty crappy questions like, "what's your favorite program?"). although i was on line to ask my question, i didn't get the opportunity to ask it. don evaluator, since you were interested, here's the question i was going to ask:
According to the Business Software Alliance, the software industry lost more than $13 billion in 2002 due to software piracy. The Motion Picture Association of America reports that more than $3 billion is lost every year due to piracy of movies, while the Recording Industry Association of America claims that $1 million is lost every day due to music piracy. Despite the loss of income, no one has yet been able to develop foolproof copy-protection technology for software or digital media. If such technology were developed, the royalties from the patent alone would be staggering, not to mention the cutting of billions of dollars lost every year due to piracy.

Do you believe that a technology will ever be developed that can prevent the copying of software or digital media? And if so, do you think Microsoft would use such technology in their software, possibly causing countries with high-piracy rates to migrate to open-source software?

according to http://www.mse.cs.cmu.edu/News-Gates.html, he will also be visiting UIUC, CMU, MIT, Harvard (well, he visited CMU already, i'm not sure about the others). if anyone here sees him at one of these other schools and wants to ask my question, feel free to use it.

oh well... at least it was cool getting to be only a couple of feet away from him :)
JimmyClif
02-26-2004, 01:37 PM
Do you believe that a technology will ever be developed that can prevent the copying of software or digital media?

Yes, I think the TCPA will sove this problems, next question please :D

----------

Blah, should have thrown a pie. /grin/
JimmyClif
02-26-2004, 01:44 PM
And if so, do you think Microsoft would use such technology in their software, ...snip...?

You bet your ass he would ;)
evaluator
02-26-2004, 02:28 PM
**
thank for your actual question!

Unfortunately, it does not depend on our desire or an opportunity;
(in In corresponding labs all is ready)
All rests in human rights.
But we firmly hope in common sense of legislators,
And when will happens this moment of happiness,
together with the corrected human rights The world will receive
new computers+systems, on which will be impossible to make something illegal;

As to the third countries, you too exaggerate a degree of their independence.
**
disavowed
02-26-2004, 02:41 PM
evaluator, i think i would have laughed my ass off had bill gates responded with that, word-for-word

jimmyclif, according to microsoft, tcpa (i assume you mean ngscb) will not be used to counter piracy. rather, it will help with rights-managment. think of it this way... company A modifies product B such that only user C can use B. at this point, the binary B can only be used by C. however, once C makes use of B, C could be able to remove the protection and distribute an unprotected B. thus, there is attestation, but still no real copy-protection.
JimmyClif
02-26-2004, 11:21 PM
disa,

the ngscb if searched at google brings me to microsoft on a page leading to the trusted computing group which then leads me to tcpa. let's not be picky ;) MS just renamed it - isn't it so?

I assumed quite some other things about it, maybe the way you describe it is the way they try to make it all appeal to the general public :) Sounds like ProductActivation² to me :-)


flexLM/'system clock setback detected' problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > flexLM/'system clock setback detected' problem
PDA

View Full Version : flexLM/'system clock setback detected' problem

incredibledible
02-23-2004, 07:27 PM
Hello all.
I am having alot of troubles with this small, but annoying problem.

First off, I have been running a Pixar graphics program that uses flexlm as its license manager, with the license.dat that is as follows:

<deleted>

Earlier today, I installed a DIVX player that had a mandatory 'thermometer/temperature' app that measures temp of your cpu or sumthing like that. I used the divx player, and decided that i dont need it, so i uninstalled the DIVX and the thermometer thing from my system. Later loking at the time on the computer, it read, something like
12:30, february, 2028, or sumthing like that.

So, i adjusted the time/date (correctly)in the box to adjust it on windows 2000.

Now, when i try to run the Pixar program, it doesnt work, and in the LRM.LOG file this is what it says:

18:01:26 (lmgrd) Logfile switching to +lmgrd.log
18:01:26 (lmgrd) -----------------------------------------------
18:01:26 (lmgrd) Please Note:
18:01:26 (lmgrd)
18:01:26 (lmgrd) This log is intended for debug purposes only.
18:01:26 (lmgrd) There are many details in licensing policies
18:01:26 (lmgrd) that are not reported in the information logged
18:01:26 (lmgrd) here, so if you use this log file for any kind
18:01:26 (lmgrd) of usage reporting you will generally produce
18:01:26 (lmgrd) incorrect results.
18:01:26 (lmgrd)
18:01:26 (lmgrd) -----------------------------------------------
18:01:26 (lmgrd)
18:01:26 (lmgrd)
<snip>
18:01:27 (pixard) System clock setback detected
18:02:27 (pixard) System clock setback detected
18:03:27 (pixard) System clock setback detected
18:04:27 (pixard) System clock setback detected
18:05:27 (pixard) System clock setback detected
18:06:27 (pixard) System clock setback detected

So I gather that because i set the clock back, the system clock, or rather the licensing software sees that the system clock setback was detected.....

Therefore, I think therein lies the problem that I am having.

I do not have any experience or knowledge with cracking and license type issues , and was wondering what the possible solution could be.

Please let me know asap, as I cannot do anything until this problem is rectified.
(and mind you, this is very annoyinng)

Any solutions would be more than greatly apperciated,

Regards,
inCreD
incredibledible
02-23-2004, 09:28 PM
please tell me what the best thing to do would be, as I am up shit creek until i can correct this problem.
I am sorry if this question is a little to "LAME" for the viewers who are just too advanced and elitist, but for those who have genuine knowledge and can offer a suggestion and arent so stuck up, that would be more than greatly appreciated.

Regards,

inCreD
Kayaker
02-24-2004, 01:32 AM
Howdy,

Somebody was having a bit of fun, but don't take it personally, and it doesn't stem from an elitist attitude. That said, if your question is aboveboard, it would seem that your first line of questioning should have been to the software company using the FlexLM license. You can try reinstalling the program with the original license, but once a "System clock setback" has been detected (and assumed to be a crack attempt), registry entries or files may be left behind that won't be wiped out by reinstalling.

If your question is not aboveboard and you haven't purchased a valid license, then don't try to pretend that you have. This was likely the assumption behind the picture attachment, as people try all kinds of tricks to get free cracks here. There was no need to post the entire FlexLM license file, especially inappropriate if it's yours, so I have deleted most of it except for part of the log file.

If you still want to try to solve the problem, you can start at Square one and learn to reverse yourself, beginning with learning the Windows API's used for Time and Date accesses. If you are willing to learn you will get help here, if not then you better contact Pixar...

Kayaker
peterg70
02-24-2004, 07:33 AM
Hate to state the obvious but why not set the date forward back to 2028 and continue working.
incredibledible
02-24-2004, 11:32 AM
hello again
thanks for the info
this app that i am using has been cracked long ago, and in no way an i trying to get a free one.
i am only trying to restore the once smoothly functioning cracked program.

thanks kayaker for this info, and i was wondering if you could direct me to where i should go for learning resources.
ie.what are the basics i need to learn
what direction (using small programs etc.) i should take to learn this myself.

thanks again,

inCreD
incredibledible
02-24-2004, 11:36 AM
of yeah, kayaker, i mean where do i start...
with windows api....
first off
where do i find out what an api is.....

and so on from SQUARE ONE...

thanks again,

inCreD
JMI
02-24-2004, 02:51 PM
There are significant recources linked at the bottom of these Forums. They would be a good place to start. You could also use the search function here and try various combination of words about "timelimits" and "clock change" and such. First try your imagination and some selfhelp, and then, if that doesn't get you started, describe what you have already tried and maybe someone will/can give you some more specific guidance.

Regards,
squidge
02-24-2004, 06:56 PM
Square one would be to determine the Flexlm version number and search for information, SDK's, etc on that version. I see that there is leaked source code of the flexlm library on the net to download - maybe this will help you on your quest?
sigint33
04-05-2005, 11:36 PM
Sorry for resurecting, this old thread, I found it last night searching for a solution to this problem, (while working on a time trial my machine crashed and I had to boot into the set-ahead date), bingo! one of my apps refused to run when the date was set back, the solution can easily be found by about 5 minutes worth of searching for flexlm+clock on google, - here's what I wanted to add - the fix is incredibly simple and easy to accomplish if you don't aggravate the situation by turning the clock forward to a date your app will run - this will increase your work to fix the problem, the longer you run at the wrong date the more work it will take.

SiGiNT


crack request job offering
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > crack request job offering
PDA

View Full Version : crack request job offering

disavowed
02-23-2004, 07:45 PM
sounds like the kinda shit we get here all the time: http://seeker.dice.com/jobsearch/servlet/JobSearch?op=1002&dockey=xml/a/6/a6bbf89f18de2d926dff230dcf16aa36@activejobs0&source=3 -

"Consultant needed for 30-60 day project of a Macromedia Director CD-ROM project. You will need to reverse engine an existing application to update the same project for the same client because the original Director files have gone missing."

:rolleyes:
Woodmann
02-23-2004, 08:01 PM
Or......

Someone destroyed some files before they quit/got fired :D


Questions in kernel32.dll of Win98
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Questions in kernel32.dll of Win98
PDA

View Full Version : Questions in kernel32.dll of Win98

cloud_y
02-24-2004, 04:21 AM
I use w32dasm to disassemble the kernel32.dll of win98, and see this:

Exported fn(): BackupRead - Ord:007Fh
Exported fn(): BackupWrite - Ord:0081h
Exported fn(): CallNamedPipeW - Ord:008Ah
Exported fn(): CreateFileW - Ord:00BCh
Exported fn(): CreateRemoteThread - Ord:00C8h
Exported fn(): FormatMessageW - Ord:012Eh
Exported fn(): GetNamedPipeHandleStateW - Ord:0190h
:BFFA9B8D 33C0 xor eax, eax
:BFFA9B8F B107 mov cl, 07
* Reference To: KERNEL32.Ordinal:0011
|
:BFFA9B91 E98377FCFF jmp BFF71319

I don't believe these export functions are the same, but why their address
are all 0xBFFA9B8D?
//thanks
Fake51
02-24-2004, 06:22 AM
Well, it could easily be an ugly hack. Note, that the function performs a jump, not a ret. Hence, it might later determine what function was actually called, without doing it straight away.
Don't think that's the case, tho. If it's kernel32 from 98, it shouldn't be using the xxxW api's unless memory serves me wrong. If they are not implemented, pointing them to the same dummy api wouldn't be out of the ordinary. That might be the same case with the other api's.

Fake
evaluator
02-24-2004, 08:46 AM
ye, that is our W9x.
that all functions are grouped togather because of same count of stack-params.
& that functions not works on w9x, so kernel32 will just restore stack
& jump back to caller.(also SetError mode)

but why i am all this writing
& why you are not researching yourself
& why not in newbie forum??
esther
02-24-2004, 11:32 AM
>but why i am all this writing
You want to help him :p
JMI
02-24-2004, 03:02 PM
Now it's in the newbie forum.

Regards,


Crapkey - Long time No Hear
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Crapkey - Long time No Hear
PDA

View Full Version : Crapkey - Long time No Hear

peterg70
02-24-2004, 07:42 AM
Hmmm it seems Crapkey has dropped off the radar.

All my *Targets* have long changed to a new version of license Manager (FlexLM) although the License file seems to be encrypted string rather than Feature etc format. Oh well thats for another post once I get a bit further.

Going back to the topic Has anyone seen a product still protected with Crapkey version 6.0. I wonder if people no longer use this sort of protection and that Flexlm has taken over...

Anyway you observations are most appreciated.

Peterg70
Pecker
04-07-2004, 02:25 AM
I can't talk certainly, because I don't know enough about the previous versions. But I think the new version of ipMonitor (7) uses it.

I say this because I know someone who purchased the product, and couldn't get it to work legitimately. (I had a quick look at it).

I'm not sure how long it'll last if it doesn't even let paying users use the protected software.
GabryJ
04-07-2004, 08:24 AM
They are obviously changing protections.

A protection that damages HD writing crappy info in the Slack Space of the HD cannot be good.

Also I prefere Armadillo, SVKP or PC-Guard V5. They will write tons of registry entries but wont ever go into inner hardware workings of my Hard Drive.

I wonder why CrypKey has not been yet denounced...i don't think it's so legal what it's doing.
sporter
04-11-2004, 03:19 AM
especially armadillo
GabryJ
04-11-2004, 10:47 AM
Yes...but with other, I can reformat my hard drive and clean everything from it, with crypkey how can i clean all traces?

Non to reset trial period, but if i want to clean up the hd, I WANT TO CLEAN UP MY HD, lefting nothing else than WHITE CLUSTERS, and NOT CRAPPY INFO.


Unpacking PC-Guard 4 Protected App
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Unpacking PC-Guard 4 Protected App
PDA

View Full Version : Unpacking PC-Guard 4 Protected App

MiniMind
02-24-2004, 03:28 PM
I've got a problem with unpacking an app protected "PC-Guard 4.03 - 4.15 -> Blagoje Ceklic" (PEiD 0.92)...

I'm using DS 3.0 with IceExt 0.57 and if program registration window is loaded and I'm popping SoftIce up my system (XP) is frozen...

Pop SoftIce up without program loaded won't cause that...

Does anyone know how to bypass this?

Thanks
MiniMind

<Edited>
JMI
02-24-2004, 04:05 PM
Have you already tried searching the forums using keywords such as "softice detection" and/or "softice hiding" and/or "hiding softice"? AFTER you have done some searching on your own, come back with a more specific question.

Regards,
MiniMind
02-24-2004, 06:37 PM
Have you already tried searching the forums using keywords such as "softice detection" and/or "softice hiding" and/or "hiding softice"? AFTER you have done some searching on your own, come back with a more specific question.

Found out a few things :

SoftICE Detection :

hxxp://members.v3space.com/blackfenix/htoprote.html

With IceExt 0.60 I don't have problems anymore :)
(added new anti-detection method discovered in Armadillo protector)

and it has tetris :) :) :)

So thread can be closed ...

MiniMind
JMI
02-24-2004, 08:28 PM
For those who may not have noticed, Sten's IceExt 0.60 is available at Wasm.ru. They are still under DDOS attack, so you may have to keep trying.

Regards,
MiniMind
03-03-2004, 05:19 PM
Does anyone knows whether the program is unpacked before you get Registration Window of PCGW32.DLL or after it ?

Can you unpack it if it is in evaluation mode ?

Because I don't know exactly what the OEP of this program is.
PEid can't find it...

I'm working with SI...

Greetings
MiniMind


FlexLM SDK v9.2 source code leaked
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FlexLM SDK v9.2 source code leaked
PDA

View Full Version : FlexLM SDK v9.2 source code leaked

Solomon
02-24-2004, 09:48 PM
perhaps some of u got that long time ago:rolleyes:
tom324
02-25-2004, 03:41 AM
Someone has made a _big_ mistake by publishing that. GT will surely change FlexLM in next versions and all info will be outdated :(

Tom
disth
02-25-2004, 04:17 AM
perhaps some of u got that long time ago:rolleyes:
MACROVION realease itself!!! only cvs,and named cad92 on 2004.1,
you can get any vionsion of flexlm if you ofen goto its ftp.(it will open seval days and deleted.....now,you can get full 9.22 sdk and 9.24 i86n3)
i am puzzled that what difference betwen 9.22 and 9.2b???9.24and 9.2e??
now flexlm 10.0 come on ,and changed flexnet......
tom324
02-25-2004, 04:26 AM
"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."
Albert Einstein (1879-1955) Physicist & Nobel Laureate
WARM3CH
03-12-2004, 07:55 PM
Just took a look at that source code. My reacation? I said to myself: WTF?!! But it's all in K&R C?!!!
I always hated the spagetti code FlexLM programmers have had made but now it seems that yet in 21st century, they are using the oldest possible methods to program! Not even using prototypes?! F*CK! F*CK! F*CK!
They just sit there, read the message boards and add more spagetti code to patch the newest found way to crack their lame code. Just look at the vendor structure, over the time it has been growing in a rather exponential way! And yet it is has so many holes like a swiss cheese. No guys, I don't think they CAN fix it in just another version. If I was at Macrovion, I would fire all those bastards and cleared the CVS and started all over again!
mr-noob
03-28-2004, 07:59 AM
I think flexlm users got a problem now if it's true that it is leaked.

I was snooping around on google and saw this http://www.x-formation.com
which is usable as a flexlm extention and provide extra security. Does any of you know about that?

Have a nice day.
squidge
03-28-2004, 03:52 PM
I've downloaded it, so I know for certain it's definitely out there. Must say though, I was suprised by the coding style. Seems like it was written by a few college kids as one of there assignments (wait, no, it's worse than that), and then patched up as and when the cracks and patches become available.

Compare this to the leaked WinNT/2K source, and you notice a big difference.

Needless to say, after looking at the code for a small amount of time, I quickly become bored and deleted it.

I think flexlm users got a problem now if it's true that it is leaked.

I was snooping around on google and saw this http://www.x-formation.com
which is usable as a flexlm extention and provide extra security. Does any of you know about that?

Have a nice day.
Alorent
05-03-2004, 11:07 AM
Is it possible to have a look at some of those source code or any place to get them? I'm quite curious about that "kiddy programming style" ;) I thought that ONLY real experts make that code :)

Maybe that give us hope to be in one of those big companies with our current programming style :p
JMI
05-03-2004, 12:32 PM
Alorent:

Go back out the the start page of this Forum and READ the part which states:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

The Diety invented search engines so you could try to finds things such as this, but I suspect, seeking instant gratification and ignoring the rules, you have not even tried to find it yourself. Even if you do not find it, do NOT ask for it here.

Regards,
Alorent
05-04-2004, 12:57 AM
Hi JMI,

Sorry for that. I made a search but I found nothing. I must be really bad searching for things on the net :)

Anyway, I was just asking for a piece of code where they could show us the coding style of those programmers. It was more a matter of curiosity not for "WAREZing" ;)

Thanks for the remind.


UPX Trouble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > UPX Trouble
PDA

View Full Version : UPX Trouble

boba303
02-25-2004, 10:24 AM
Hope some1 out there can help me:
My problem is that im dealing with a UPX packed exe which wasnt any problem unpacking. The OEP (498038) is found and the imports are fixed.

However, when launching the target nothing happends. The last thing thats happends is that it goes through ExitProcess. Im 100% sure that it is some kind of protection, but I dont know if its CRC or just a flag check on the targets OEP.

I found a similar problem in a crackme on this forum and did some backtracing with no use. My target got the same scheme but it never doesnt do any check like it did in the crackme, so I was hoping for some help or just ideas on how to proceed.
All of the other threads I read was more on how to unpack it but that step was already done. However finding this kind of help was a bit trickier, hope Im not creating a thread with similar topic that already exists.

the target Im dealing with can be found on
hxxp://www.macecraft.com/downloads/RegSupreme_setup.exe

Feels like I missed some information but just let me know and I will try filling ya in..
Shoob
02-25-2004, 10:34 AM
the problem is in the target itself.
boba303
02-25-2004, 12:37 PM
Ok, thats not very helpful. Im sure that the problem is in the program itself.
But since Im stuck I was hoping for a hint that could point me into the right direction.

This isnt either the first time I have come across a UPX target that behaves like this one so therefore I kinda hope someone else had some experience?
evaluator
02-25-2004, 03:00 PM
GOOD hint is only: sit & debug.
imagine, how program can know(e.g. detect) if it is unpacked..
D-Jester
02-25-2004, 10:48 PM
Try looking for checks on Filesize, IAT Location, Checksum, or see if he computes CRC or MD5, SHA-1.

All the prog's from macecraft are written in Delphi, so you might try DeDe.
I ran into the same prob with a different prog from macecraft.
He uses his own protection and licensing systems.

So if you have the time there is a lot to learn from it.
Unfortunately I didn't have the time to sit & debug it.

Wish I could be more help.

I will tell you that if you trial expires look in you widows/system or winnt/system32 directories for an *.ini file (mine was SndDrv32*.ini)which contains the second half of the trial info. The first half is in the programs subfolders, I believe it's "license.dat' deleting both will reset your trial.
nikolatesla20
02-26-2004, 01:29 AM
If it's Delphi, you HAVE to get DeDe.

Look first for functions which check the filesize. If you find one, just change any decision instruction after the filesize check (like a JZ or a JNZ) to its opposite, or even try NOPing too, and see if it runs then.

-nt20
boba303
02-26-2004, 06:43 AM
This is exactly what I was looking for. I will take your advice D-Jester, you wont learn from targets that easy to handle, thats why this target can actually learn you something.

But my guess is, (since im no guru in IAT and CRC), that there is no specific pattern to find them, right?
Like the filesize is fairly easy to find (GetFileSize etc) but the IAT and CRC can be anywhere without any need for a importcall?
Just wanted to make sure I got it right...

Thanks for the help so far :)
naides
02-26-2004, 07:36 AM
This is exactly what I was looking for. I will take your advice D-Jester, you wont learn from targets that easy to handle, thats why this target can actually learn you something.

But my guess is, (since im no guru in IAT and CRC), that there is no specific pattern to find them, right?
Like the filesize is fairly easy to find (GetFileSize etc) but the IAT and CRC can be anywhere without any need for a importcall?
Just wanted to make sure I got it right...

Thanks for the help so far :)

You may have done this already, but this is a suggestion for strategy, anyway.

In the unpacked version, you have two well defined instruction points in the code:
The OEP and the ExitProcess Call.

In the packed version, which you should have, you can put a BPX on the OEP, then find another instruction later in the code that definitely executes when the program is active and running, like some Display_Splash_screen call, or MesageBox saying Welcome etc

Using the Log feature of SoftIce symbol loader trace the packed, save the log, trace the unpacked, save the log, and compare.

By a stepwise approach, you can isolate the area where the code flow between the packed and unpacked where they take a different route.
xoder
02-26-2004, 08:32 AM
naides this is a good approach, i didnt know something like this is possible in SI. im gonna try it just for fun, really sounds interesting and helpful!

regards

xoder
hobgoblin
02-26-2004, 09:50 AM
I agree with evaluator. Sit down and start debugging. If you haven't done this so some extend before, it will be very helpful and you will learn a lot by simply tracing through code and instructions. Just to help you off with this one:
Load the program in Olly or Softice. Check out the fourth call from the OEP. That call checks a lot of interesting stuff like whether you have Softice or Ollydbg loaded, and it also checks the size of the version of RegSupreme you're running. If the check routine don't like what it finds, it kicks you to the bottom of the call, and then you run into exitprocess in the next call.
The call seems to check out several other things too, I just don't have the time to see what it is.
Good luck.
regards,
hobgoblin
boba303
02-26-2004, 12:01 PM
Thanks Hobgoblin, and I actually think I was in that area from the start but kinda rushed on without finding anything.

This help will surely help me...thanks alot guys


Digging up some old memories (real newbies: read this!)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Digging up some old memories (real newbies: read this!)
PDA

View Full Version : Digging up some old memories (real newbies: read this!)

TheBlackbird
02-26-2004, 04:14 AM
Greetings all.

My (nick)name is the Blackbird. Some of you may know me, some of you may not. I reversed (mainly: cracked) programs from 1998 until somewhere in 2001. In that time I had a website named "Cracking4Newbies" and was aimed to teach newbies how to crack starting from zero.

At a certain moment the TPA started their "Crackkiller project" and my site and most of its mirrors got shut down. As I stopped reversing in 2001 I didn't put any effort in keeping my site up.

Today I was talking to someone about reversing and I wanted to show him some old tutorials I wrote. So I searched Google and I found out that a previously shutdowned site of Cracking4Newbies had been unlocked. Yes, they didn't remove the site, just denied access. For some reason they unlocked it. In other words: my old C4N site is available again for any newbies around here.

Note that when I wrote my first essays I was pretty immature: I tried to write in that 'cool' cracker slang, I made a lot of spelling mistakes, I was pretty naïeve about a lot of things and sometimes the essay was just bad. However, even if they're a little outdated, many things of what I wrote can still be very useful for the newbie crackers/reversers out here, especially the 'newer' essays.

So, here's the URL: h**p://users.belgacom.net/blackb .... for as long as it lasts.

In case you're interested: I'm currently busy with serverside scripting (ASP, PHP, Coldfusion), graphics (Photoshop, 3D Studio Max) and lately I decided to start programming again (currently learning C# Builder). It has been a long time I did some reversing and when reading some posts on this board I'd really like to pick up reversing where I left it, if I only had the time... .

When writing this thread, the memory of meeting +Fravia en +Mallatia in Brussels crossing my mind, with Knotty getting drunk of the Belgian 'Kwak' beer. It was a fun time in which I learned a lot.... making it the ideal moment to say hi to Fravia, Mallatia, Neural Noise, Kwazy Webbit, Knotty Dread, tsehp, CD_Knight, _y, Lazarus, Nitrus, carpathia, warezpup, splaj, kayaker, all the guys from EVC, all the lads in #cracking4newbies and probably the many others I forgot.

Take care, and maybe cya until I start some new reversing project ;-)

sincerely,

The Blackbird
Solomon
02-26-2004, 04:52 AM
WB old friend :D
kugi
02-26-2004, 05:14 AM
Good to see that you are still around. Reversing has changed a lot and yet still remains the same. You may be happy to see that cracking4newbies is still available on the RCE-CD. (See link below)

Regards, kugi
crUsAdEr
02-26-2004, 05:34 AM
I remmember going to your site very often, think there was some IDA tutorial was real good... :)
Thanks for the site.
ryan
02-26-2004, 10:17 AM
When writing this thread, the memory of meeting +Fravia en +Mallatia in Brussels crossing my mind, with Knotty getting drunk of the Belgian 'Kwak' beer. It was a fun time in which I learned a lot.... making it the ideal moment to say hi to Fravia, Mallatia, Neural Noise, Kwazy Webbit, Knotty Dread, tsehp, CD_Knight, _y, Lazarus, Nitrus, carpathia, warezpup, splaj, kayaker, all the guys from EVC, all the lads in #cracking4newbies and probably the many others I forgot

How can you forget to mention me? ;)
TheBlackbird
02-26-2004, 10:24 AM
How can you forget to mention me? ;)

*Errrr* memorygap... enlighten me :)
ryan
02-26-2004, 10:27 AM
*Errrr* memorygap... enlighten me :)

I am like you, no longer cracking. Prefer not to mention my handle. ;-)
esther
02-26-2004, 10:41 AM
A wild guess will definately enligtened you ;)
TheBlackbird
02-26-2004, 10:43 AM
I am like you, no longer cracking. Prefer not to mention my handle. ;-)

As reversing is my nature I already visited your Code-Lock site, and read the big Code-Lock discussion on this board here and I saw "And to evlncrn8: Yes, I am very proud that I can crack VB very well, so well that at one point of time, some crackers think of me when they want to crack vb."

After reading this I knew that I know you, because I remember that there was someone cracking all VB programs at the time I was reversing. Can't come up with a nickname (which I wouldn't mention anyway, as you don't want your handle displayed here), but I remember :)
Woodmann
02-26-2004, 05:17 PM
Greets Black B,

It is always nice when people come back for a visit :)

Woodmann
Kayaker
02-26-2004, 09:50 PM
Hiya BlackB,

I remember well your site, still had it bookmarked until fairly recently actually then finally gave it up as lost for good, strange it got unlocked. Glad you winged your way back here, hope you can roost for a while and share your thoughts ;)

Cheers,
Kayaker
TheBlackbird
02-27-2004, 03:28 AM
Hiya BlackB,

I remember well your site, still had it bookmarked until fairly recently actually then finally gave it up as lost for good, strange it got unlocked. Glad you winged your way back here, hope you can roost for a while and share your thoughts ;)

Cheers,
Kayaker

Hey Kayaker ;)

I don't even have my site on my harddisk. The darn thing (the Maxtor harddisk) crashed two times in one year. First crash in jan. 2003, so they gave me a brand new one. Second crash (of that new Maxtor!) in november 2003. Everything gone. There were files dating 1993 on it. Well, the least I can say: it hurts when you loose all your personal files. I now have a Western Digital. Hope this one lasts a little longer.

Anyway. I browsed the messageboard, read some threads. My impression is that many more applications are protected: no more easy Winzip-targets. On the other hand, those protected programs (almost) all work with ASProtect, PCGuard, etc... which work on the same base they worked back in 2000. They are improved, and more difficult to beat... but in the end it remains the same: hide softice, dump and rebuild IAT.

But no protection improvement without tool improvement. I downloaded IDA Pro 4.51, Softice Lite 3.1, Regmon, Filemon, Process explorer and I was pretty impressed. Especially with IDA. Seems like the guys at Datarescue stubbornly keep developing IDA as if their lives were depending on it. Ok, their lives DO depend on it, but they 'd make a lot more income if they developed other products. I mean, with all those leaks... these guys must be REAL stubborn en determined to keep developing this. I was really surprised to see this pretty new version leaked. What do they do now: brake into Datarescue HQ and steal a copy, or beat a customer until he gives his copy of IDA? I think Datarescue rather sees us dead by now.

I'll hang around for some time. I'm not running away that soon ;-) I don't think I'll do some reversing in the near future because I'm occupied by a lot of other things. I'll read threads however :)

To end I also like to mention that there are a lot of people doing a great job here. Real nice.

greetings

The Blackbird
seven
02-27-2004, 08:08 AM
w b :)
KwazyWebbit
02-28-2004, 04:18 PM
Yo, BlackB ;)
ltns. I just got a note on RET board that you were back in town, as it were.
Thought I'd come by and say howdy :)
Nice to see you're still alive.

Welcome back,
Kwazy Webbit
Woodmann
02-28-2004, 07:08 PM
Wow......

It really does bring me :D to see old names.
nuu
02-28-2004, 09:24 PM
Well, well. I've been searching for you quite a few times mister BlackB. I'm glad to see you're back in action (or, well, that you're still alive and well for that matter :-)

Do you remember that long discussion we had in c4n back in...what was it, 1999? 2000 ? it was about the ethics of cracking...now that was a fun log. Do you still keep it by any chances ? I wouldnt mind a copy :) Now if it's on your website, excuse me in advance but it's just plain too late for me to go check right now ;)

Glad to see you again.
neural noise
TheBlackbird
02-29-2004, 07:57 AM
Well, well. I've been searching for you quite a few times mister BlackB. I'm glad to see you're back in action (or, well, that you're still alive and well for that matter :-)

Do you remember that long discussion we had in c4n back in...what was it, 1999? 2000 ? it was about the ethics of cracking...now that was a fun log. Do you still keep it by any chances ? I wouldnt mind a copy :) Now if it's on your website, excuse me in advance but it's just plain too late for me to go check right now ;)

Glad to see you again.
neural noise

Newral ;-) It's indeed a long time. Glad to see you too. Alive and well, as I hope you to be too.

I remember the ethics discussion we had. I don't have it on my computer anymore, BUT it's right under your nose in de RCE-CD section at the bottom of this very page you're viewing now. There's a copy of my old site in a .zip file there. I 've reread the discussion last week. Funny to see how I was, only three years ago and how my view on things changed. You should also check the thread on datarescue.com (search on "blackb") where I praised IDA Pro as a cracker's tool and the comments of Pierre Vandevenne. I've reread that too last week. Man, I was naive by that time, and it gave me good laugh to see this past side of me back :)

Well, see you around...

The Blackbird
Volatility
02-29-2004, 08:48 AM
Well howdy, stranger! With my advancing age and decreasing brain cells, I'd almost forgotten you ;) ... hmm, where am I?

Welcome back!
Vol
JimmyClif
02-29-2004, 01:59 PM
Do you remember that long discussion we had in c4n back in...what was it, 1999? 2000 ? it was about the ethics of cracking

Now, I might be off a couple links but here:

http://its.mine.nu/html/re/essays/c4n-ethics1.html
http://its.mine.nu/html/re/essays/c4n-ethics2.html

from the WebbitHole (KwazyWebbit) at http://its.mine.nu/

Cheers,
J
nuu
02-29-2004, 02:27 PM
thanks, those were the logs i was after :-)

BB, when are you planning to stop by c4n ?

nn
Woodmann
02-29-2004, 05:34 PM
Howdy,

It is nice to see Volatility and neural :)
nuu
02-29-2004, 07:02 PM
my pleasure to be here woodman :-)

later all!
nu
SiNTAX
03-02-2004, 04:07 PM
My impression is that many more applications are protected: no more easy Winzip-targets. On the other hand, those protected programs (almost) all work with ASProtect, PCGuard, etc... which work on the same base they worked back in 2000. They are improved, and more difficult to beat... but in the end it remains the same: hide softice, dump and rebuild IAT.
greetings

The Blackbird

Well didn't they tell you, history repeats :) ... if you compare the tricks used on C=64, Amiga, ... they aren't that different than those used today.
It actually becomes easier... more advanced tools to work with and more 'standard' wrapper protections around. (and less game/program coders that add extra sneaky bits in their own code.. like you had in the good old days)

/me feeling nostalgic..
Bengaly
03-05-2004, 07:21 PM
Welcome Back BlackB.
you just like me reads the forums from time to time and just having fun.
regards
-Ben


What's the best unpackers for HASP?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What's the best unpackers for HASP?
PDA

View Full Version : What's the best unpackers for HASP?

darui
02-26-2004, 06:41 AM
Hello guys! It's my first post (-:

My question is:

I have an executable file that is packed with HASP Envelope. What's the best utility to unpack it?

I used some, like PEiD Generick Unpacker, but after uncompress, executable does't works )-:

How is correct form to use these type of utility?

I need some others utilities to help unpack, or to use after unpack?

What's the best way to unpack an Enveloped executable?

(Sorry my English)

Thanks in advance,
darui
cRk
03-02-2004, 11:47 PM
this kind of post have been discussed many times the first thing you need to do is Search then read what you search .. it is obvious you need to read some tuts about unpacking.. then apply what you read and learned.. now after putting some practice ... should come hard times and questions and that's the time where you should come here with your doubts + cuestions


breakpoint softice <-> specific file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > breakpoint softice <-> specific file
PDA

View Full Version : breakpoint softice <-> specific file

holomorph
02-26-2004, 09:44 AM
Hi all!

I'm wondering how its possible to make softice stop when my program tries to open a file ? I could use api calls like "readfile" but the program opens tons of files and i will never find the right one...
But something like "bpx readfile xyz.dat" is not possible ?

Greetings and sorry for my english ;-)

Holomorpg
AndreaGeddon
02-26-2004, 12:39 PM
well you can use conditions on breakpoints, if you need to break an open operation on a given file you can set a condition on the "filename" parameter, for example if you want to break CreateFileA you know that the filename is the first parameter on stack, so once softice breaks on api entry point the pointer to file name will be on [esp+4], so you can use
bpx CreateFileA if @@(esp+4) == "yourfile.dat"
it should work, hope my memory is good!
Bye!
AndreaGeddon


new ollydbg feature
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > new ollydbg feature
PDA

View Full Version : new ollydbg feature

disavowed
02-26-2004, 06:02 PM
this is pretty damn cool... new version of ollydbg allows you to debug stand-alone dll's by letting you choose which function to call, specifying initial register values, and specifying the data pushed onto the stack: http://home.t-online.de/home/Ollydbg/Loaddll.htm

yeah, i know, you could write an .exe to do this yourself and then have have olly debug that .exe, but still, i think it's very cool that it's now built-in
JMI
02-26-2004, 06:07 PM
Yes, but let's not tell BillyG, O.K. ;) Let's just keep it to ourselves. :D

Regards,
disavowed
02-26-2004, 07:02 PM
bah, what's that supposed to mean? :)
volodya
02-26-2004, 07:18 PM
He is just joking sometimes if you don't catch that :D
JMI
02-26-2004, 07:18 PM
Sorry for the confusion. :rolleyes:

It was not supposed to "mean" anything. I was just having some fun playing off some of the comments in the "Questions for Bill Gates" thread. :p

Regards,


LINK: Windows Debuggers: Part 1: A Windbg Tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > LINK: Windows Debuggers: Part 1: A Windbg Tutorial
PDA

View Full Version : LINK: Windows Debuggers: Part 1: A Windbg Tutorial

Kayaker
02-26-2004, 10:57 PM
There's a new article at Code Project some might find useful. If nothing else Windbg is handy for analyzing crash dumps...

Windows Debuggers: Part 1: A Windbg Tutorial

http://www.codeproject.com/useritems/windbg_part1.asp#_Toc64133661
crUsAdEr
02-27-2004, 11:04 AM
are you psychic or what?
I was just whining to Clandestiny at 2am last night about how sucky Windbg is... this is good stuff :)
Thankx
Kayaker
02-27-2004, 11:44 AM
Lol, that must have been 2am your time, I know Clandestiny goes to bed earlier than that :p

WinDbg is nice because you can write your own kdextension dlls if need be. This in itself is a useful exercise since Softice KDExtensions a la IceExt are in fact based somewhat loosely around the WinDbg dll extension format. Learning to write a WinDbg kdextension is the first step in creating your own Softice counterparts.

I noticed also in one of the comments a link to a nice table:
Frequently Used [WinDbg] Debugger Commands
http://www.tonyschr.net/debugging.htm
crUsAdEr
02-28-2004, 03:08 AM
Does anyone know how Windbg implements its remote debugging functionalities? I notice that if softice installed on the debuggee will be first in the chain to handle int breakpoints etc, that is because i guess sice installed int3 hook later than windbg... so it gets called first?

I was thinking of writing a small sys that will rehook those int1/3, giving windbg ability to debug softice at will... however i have got no clue how windbg does its job over the serial port... thus I am writing to ask for any advice on this matter :)?

Thanks,
crUs
NeO
02-28-2004, 04:19 PM
Kayaker first of all i would like to say that i am impressed ,in what you really did to help this reversing comunty!Because you post ,sources ,links has help a lot of ppl in their coding and making their knowledge becomming bigger!There should be more ppl like you.You can find a lot of ppl in here which are more or less bragging about doing this and that .But normally all good stuff stays private and nothing is released!

So i can say one thing thanks for sharing :D

Hello crUsAdEr ltns...wb...
can you plz email me...

NeO ;)

bye
Kayaker
02-28-2004, 08:04 PM
Because you post ,sources ,links has help a lot of ppl in their coding and making their knowledge becomming bigger!
So i can say one thing thanks for sharing :D

Hi NeO

That's the result I hope to achieve, and the feeling I hope to foster on this board. I think it's working because a lot of people do contribute their source and ideas, and like you I always appreciate when I find something I can learn from. Thanks for the encouragement though, that too helps :)

Cheers,
Kayaker


softice -- simple problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > softice -- simple problem
PDA

View Full Version : softice -- simple problem

tjm2k
02-27-2004, 01:58 AM
Hi all,

I have searched the forums for an answer to my question, but to no avail... so sorry for the (almost certainly) spam.

I am following Nolan Blender's Zendenc tutorial, and have reached the part where I am supposed to break at 00439019 with softice. I cannot seem to do this.

I have tried :
bpx 00439019
bpm 00439019
and various combinations of typing 'be' before and after entering the breakpoint(s).

Can anyone give me some guidance?

Cheers,

-tjm
Aimless
02-27-2004, 02:35 AM
Try searching for the term "breakpoints" without the quotes on the msgboard search function. You'll be surprised.

Have Phun
naides
02-27-2004, 06:50 AM
Hi all,

I have searched the forums for an answer to my question, but to no avail... so sorry for the (almost certainly) spam.

I am following Nolan Blender's Zendenc tutorial, and have reached the part where I am supposed to break at 00439019 with softice. I cannot seem to do this.

I have tried :
bpx 00439019
bpm 00439019
and various combinations of typing 'be' before and after entering the breakpoint(s).

Can anyone give me some guidance?

Cheers,

-tjm

Also search 'memory space' along with 'breakpoint' and you'll see the answer to your problem
tjm2k
02-27-2004, 02:57 PM
Hi all,

Thanks for the search ideas.
I have already explored both of those options... all I really wan't is the correct syntax to break at 00439019.

I have now tried :
bpm 00439019 r, rw and w, all to no avail.

I am sure I am missing something obvious, so please put me out of my misery :)

Cheers,

-tjm
naides
02-27-2004, 07:14 PM
Hi all,

Thanks for the search ideas.
I have already explored both of those options... all I really wan't is the correct syntax to break at 00439019.

I have now tried :
bpm 00439019 r, rw and w, all to no avail.

I am sure I am missing something obvious, so please put me out of my misery :)

Cheers,

-tjm

Well.

You REALLY need to be standing on the memory space of the correct module to get a Hardware breakpoint to be set up correctly.
Also, if that module has a Data Segment (DS) that happens to be different from the Code Segment CS (unusual, but not unheard of), you have to EXPLICITLY write

bpm CS:00439019 X

Because, by default, bpm refer to the DS based address
Notice the X for Execution, but R for read should work also, as code needs to be read right before it is eXecuted.

Moreover, some protections clear the Debug registers, effectively defeating your breakpoint.

Good Luck.
tjm2k
02-27-2004, 08:36 PM
In this Blender's essay, he simply states break at 00439019.
I take it that this may not be as simple as he suggests?

I was thinking all that is required is to tell softice where to break, I figured if I had the patience to scroll through the assembler code in the softice popup, I could just double click 00439019 and my problem would be solved... (I haven't tried that yet).

But you seem to be indicating that I am missing a more important deeper understanding of what exactly "break at 00439019" entails.

Does anyone know if there is a "walkthrough" of Nolan Blender's zendenc essay with all commands used to complete the crack? I think that would be a great thing for me to learn from.

Cheers,

-tjm
naides
02-28-2004, 01:57 PM
In this Blender's essay, he simply states break at 00439019.
I take it that this may not be as simple as he suggests?

I was thinking all that is required is to tell softice where to break, I figured if I had the patience to scroll through the assembler code in the softice popup, I could just double click 00439019 and my problem would be solved... (I haven't tried that yet).

But you seem to be indicating that I am missing a more important deeper understanding of what exactly "break at 00439019" entails.

Does anyone know if there is a "walkthrough" of Nolan Blender's zendenc essay with all commands used to complete the crack? I think that would be a great thing for me to learn from.

Cheers,

-tjm

Direct quote from the tut:

"After the program loads and breaks at the entry point, a breakpoint is then set at 439019, and the stack examined at that point - I use dd esp. . ."

You need to load the program into the SoftIce symbol loader, which assures you you are in the program memory space. then setting a bpx 439019 works, at least in my computer. WinXP, Sice 4.27 with Kayaker's patch.
tjm2k
02-28-2004, 03:25 PM
Odd, I have loaded the program into softice and set bpx 439019, that is the first thing I tried. I doesn't work for me.

I use softice from DriverStudio 3.1, on Windows 2000 SP4. Are there any known bugs on that platform?

Cheers,

-tjm
JMI
02-28-2004, 05:13 PM
tjm2k:

One begins to wonder if you are actually paying attention to the words that are being used. You say:

"I have loaded the program into softice and set bpx 439019."

The tut says:

"After the program loads and breaks at the entry point, a breakpoint is then set at 439019."

Your statement is NOT the same as the one from the essay. Did you load the program and break at the entry point before you set bpx 439019 ???? If not, that may be your probelm.

Regards,
tjm2k
02-28-2004, 06:19 PM
Sorry if it seems that I didn't read the instructions well...

Anyway, I made it break :), and I got some of the data I need.

Only problem now is that the address pointed to by esp is full of nulls, instead of a proper FlexLM job structure.
I thought this might be because it had not been populated yet by the function at 439019, so I tried running the next line to no avail.

I have tried bpx 439019, bpm 439019 x and they both break. But bpm 439019 with r|rw|w don't break.

Is there any reason I should be seeing all null (00000000) at the address which should contain the job structure? It can't be any kind of protection because this is the sample program from the tutorial.

Cheers,

-tjm
tjm2k
02-28-2004, 06:32 PM
nevermind, found some instructions to go on...

but I would like to know if the null behaviour is the same for everyone.
tjm2k
02-28-2004, 06:50 PM
In the interest of future newbies...

to get around the null structure
break at 439018, record the job structure address
then goto the instruction right after 439019 (43901F)
g 43901F
now you can examine the job structure recorded previously, and it will be populated with values.

I got a different XOR value than Blender

Cheers,

-tjm

p.s thanks to all for putting up with my annoying questions
tjm2k
03-01-2004, 12:46 PM
Hi all,

Trying to follow Nolan Blender's Zendenc tutorial for my target app...

I understand the logic which gives him 439019 as the break address. However, I am not sure what to do in my target.

I have located the lm_new() and l_sg() routines.
However, I am not sure how to find the pointer to the decoding routine. Here is a code snippet.

.text:00403CB2 loc_403CB2:
.text:00403CB2 cmp dword_F2FD90, 1
.text:00403CB9 jl short loc_403CC2
.text:00403CBB xor eax, eax
.text:00403CBD jmp locret_40C6EB
.text:00403CC2 ; -------------------------------------------------------
.text:00403CC2
.text:00403CC2 loc_403CC2:
.text:00403CC2 push offset sub_40C6ED
.text:00403CC7 call sub_7BF0D4

The lm_new() routine is sub_40C6ED. I am thinking the address to the decoding routing is pushed onto the stack at 403CC2. But I really am not sure.
If I'm right, is the next step to break at 403CC2 and see what is on top of the stack after the call to sub_40C6ED (lm_new), then set a breakpoint at that address?
That seems to me to be equivalent to dword_49E5EC in Mr. Blender's tutorial.

Any help is much appreciated :)

Cheers,

-tjm
JMI
03-01-2004, 01:03 PM
tjm2k:

You don't need to start a new thread when you have another question about the subject you have already started. You new question belongs here, so I've merged the threads.

Regards,


Need help with FlexLM v8.4a
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help with FlexLM v8.4a
PDA

View Full Version : Need help with FlexLM v8.4a

adkiller
02-27-2004, 04:02 AM
hi,

Does anybody have an essay on that? I have a FlexLM 8.4a target that I want to crack.

Request for Tools of the Trade Removed. I am a darn n00b at reverse engineering.

The target is linked to the following functions in lmgrd8c.dll:
lp_checkin
lp_checkout
lp_errstring
lp_heartbeat

The license format is the following:
FEATURE Win32_XXXXX_Limited xxxxxxxx 5.5 12-mar-2004 uncounted \
000000000000 HOSTID=ANY START=26-Feb-2004
FEATURE Win32_XXXXX_Unlimited xxxxxxxx 5.5 12-mar-2004 uncounted \
000000000000 HOSTID=ANY START=26-Feb-2004

I found out the FlexLM version it was using via lmutil. I have no idea which of the tutorials work, since I don't have the SDK. What other SDKs would work in the above scenario?

If you could kindly provide any pointers on this, I would truly appreciate it.

-ad
JMI
02-27-2004, 11:07 AM
adkiller:

You have apparently avoid noticing the BIG RED LETTERS at the top of the Forum and not paid attention to the instructions on the "Tools of the Trade" Forum, which state "Do not ask where to get the Tools of our Trade. Do not even think about asking for them." This DOES include YOU. Have you read the FAQ and Searched the Forums for your issue?

Regards,
Aimless
03-01-2004, 12:43 AM
AARON is a good provider of the software.

Though, It may not find him on HTTP but on its cousin protocol used often.

Sure, he's got a website too with linking. He has lots of EXE and TOOLS. Try combining them both for websearch.

Have Phun
adkiller
03-03-2004, 09:52 AM
Thanks so much Aimless. Sorry JMI. Have been looking all over the place had no signs.

-Ad


Imagine Octal Opcodes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Imagine Octal Opcodes
PDA

View Full Version : Imagine Octal Opcodes

Aquatic
02-27-2004, 04:18 PM
We all know about Hex Opcodes, but imagine Octal Opcodes, that would be crazy.

Write your app using Octal opcodes, it would be harder to crack.
doug
02-27-2004, 07:15 PM
octal, hex, dec, binary are just different bases to represent the _same_ numbers.

even if for some odd reason you were given the opcodes in octal format, you could still put it back in hex notation.

I don't understand your comment.
Aquatic
02-28-2004, 02:28 AM
octal, hex, dec, binary are just different bases to represent the _same_ numbers.

even if for some odd reason you were given the opcodes in octal format, you could still put it back in hex notation.

I don't understand your comment.

True, true.
mmk
02-28-2004, 09:11 PM
I'll pass this on to the IDA Pro staff. When they find out that they can simply switch from hex to octal, no-one will be able to crack their software. Pure genius! :D


Armadillo 3.60 + COPYMEM II + ?? = No WriteProcessMemory!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 3.60 + COPYMEM II + ?? = No WriteProcessMemory!!
PDA

View Full Version : Armadillo 3.60 + COPYMEM II + ?? = No WriteProcessMemory!!

tenketsu
02-27-2004, 05:56 PM
HI!, my firts post in the forum... Well lest dump

I have tried to dump Target Name Revoved [Armadillo 3.60 (I guess) + COPYMEM II] the target is in VB Code, only call Bp WriteProcessMemory on [OllyDbg], 2 times: in the packed EP [father EntryPoint] put EBFE [2 bytes] and later restore it to the original Bytes.

But no more calls to WriteProcessMemory!!

I think.... The father only debug to the son for nanomites protection?? :eek:
or the WriteProcessMemory API call is emulated :confused:
or OllyDbg is detected and RAPED!! :eek:
or WriteProcessMemory is changed for another API.

I dump the Son Process & it's crypted-Grong: ANY comment.
D-Jester
02-28-2004, 01:32 PM
Did you try using y0da's Hoko or GetProcAddress?
Ricardo Narvaja
02-28-2004, 04:38 PM
There are a variant of the COPYMEM2, if you put a hardware BPX in WriteProcessMemory and stop only 2 times, and dont stop when copy 1000 bytes is the case of copymem2 without 1000 bytes trick, a litle variant more easy to unpack.

Only the father create the son and the son autounpack and run, if you detach the father, put a infiniteloop in the ep of the son (EP NOT OEP) and minimize the olly with the father, the son run how a armadillo without copymmem2 and the unpacking is similar and easy.
there are tuts in my ftp of this variant but in spanish
Ricardo
hobgoblin
02-29-2004, 04:36 AM
I'm interested in seeing what program you're reversing. Can you please pm me the url? I have recently reversed several targets using the latest arma version, and I might be able to answer your question about what's goin on after looking at it.
Bit if you read spanish, there are some really good tuts on the subject at Ricardo's ftp.

regards,
hobgoblin
tenketsu
02-29-2004, 11:05 AM
The URL is hxp://3w.codingworkshop.com/, but i have found tha way to proceed & is very simple

Gracias a Ricardo Narvaja por su FTP, sus tutos y demas mierdas que pululan en la red [en lo personal ODIO todo win arriba de W98 ^_^]
hobgoblin
02-29-2004, 12:10 PM
Nice to see you find out about it.:-)

regards,
hobgoblin
tenketsu
02-29-2004, 07:26 PM
A final comment:

Nanomites!
baudstupid
03-02-2004, 06:05 PM
Hi all,

hope someone can help me! I'm new to this whole Armadillo thing so I'm working my way through Narvaja's excellent tutorial "ARMADILLO FOR DUMMIES GETRATIGHT 5 (vol I).doc", but I'm getting myself all confused :confused:

Alls fine and dandy up to "STEP 4: NOP THE CRIPTER CALL". To quote the tute it says, "I'm in WriteProcessMemory API, so I open CALL STACK (K) window (alt+k) and there I see:" and theres a funky little picture of the Call Stack Window with loads of data to play with. However, when I get to the same point in the tutorial and hit alt+k I get a completely empty stack window. Am I missing something?

My breakpoint was indeed set on WriteProcessMemory and Olly breaks there so I assume I am 'in' the API, but the Call Stack Window is empty.

Please help.

::baudstupid
Ricardo Narvaja
03-02-2004, 06:32 PM
Right click- actualice

if continue empty look at the stack, down in the stack and the RETURNS TO .... is the same information (more complete) than CALL STACK.

Ricardo Narvaja

Hi all,

hope someone can help me! I'm new to this whole Armadillo thing so I'm working my way through Narvaja's excellent tutorial "ARMADILLO FOR DUMMIES GETRATIGHT 5 (vol I).doc", but I'm getting myself all confused :confused:

Alls fine and dandy up to "STEP 4: NOP THE CRIPTER CALL". To quote the tute it says, "I'm in WriteProcessMemory API, so I open CALL STACK (K) window (alt+k) and there I see:" and theres a funky little picture of the Call Stack Window with loads of data to play with. However, when I get to the same point in the tutorial and hit alt+k I get a completely empty stack window. Am I missing something?

My breakpoint was indeed set on WriteProcessMemory and Olly breaks there so I assume I am 'in' the API, but the Call Stack Window is empty.

Please help.

::baudstupid
baudstupid
03-02-2004, 06:56 PM
Many thanks to Narvaja!

...but I have another problem. I understand that WriteProcessMemory passes 1000 bytes between father and son, but when Olly breaks on WriteProcessMemory the stack window shows number of bytes to write as 2 not 1000 as I expect?! Obviously I can't go on to try and get the OEP from within the 1000 byte range.

Thanks in advance from a newbie whos trying to read tutorial after tutorial.

Attached is screenshot of stack window ~9k
Ricardo Narvaja
03-03-2004, 03:11 AM
In copymem2 stop in WriteProcessMemory 2 times, and pass two bytes, and the 3 time stop and pass 1000 bytes, run again till the 3 time.

Ricardo
bink_us
03-04-2004, 06:21 AM
There are a variant of the COPYMEM2, if you put a hardware BPX in WriteProcessMemory and stop only 2 times, and dont stop when copy 1000 bytes is the case of copymem2 without 1000 bytes trick, a litle variant more easy to unpack.

Only the father create the son and the son autounpack and run, if you detach the father, put a infiniteloop in the ep of the son (EP NOT OEP) and minimize the olly with the father, the son run how a armadillo without copymmem2 and the unpacking is similar and easy.
there are tuts in my ftp of this variant but in spanish
Ricardo

Could you perhaps tell me the name of the tutorials that cover this simpler form without the CopyMem protection? I haven't managed to work out how to get the EP of the child so I can't dump the child process :( I don't understand Spanish but I might be able to work out what the tutorials are saying with a bit of luck.

The target that I am working on seems to have the same kind of protection that BaudStupid is talking about. 2 WriteProcessMemory calls with 2 bytes and then the child process continues.
Ricardo Narvaja
03-04-2004, 04:58 PM
150-ARMADILLO con COPYMEM2 sin truco de los 1000 bytes por FLIPI.rar

in my FTP in NUEVO CURSO-TEORIAS in spanish only but is very easy, more easy of armadillo with copymem2 common with 1000 bytes trick.

ftp://curso:curso@ricnar456.no-ip.org/

user:curso
pass:curso

carpeta NUEVO CURSO-TEORIAS

NOT USE EXPLORER only FTP PROGRAMS and try again in differents hours is generally full my ftp.

Ricardo

Could you perhaps tell me the name of the tutorials that cover this simpler form without the CopyMem protection? I haven't managed to work out how to get the EP of the child so I can't dump the child process :( I don't understand Spanish but I might be able to work out what the tutorials are saying with a bit of luck.

The target that I am working on seems to have the same kind of protection that BaudStupid is talking about. 2 WriteProcessMemory calls with 2 bytes and then the child process continues.
bink_us
03-04-2004, 05:11 PM
150-ARMADILLO con COPYMEM2 sin truco de los 1000 bytes por FLIPI.rar

in my FTP in NUEVO CURSO-TEORIAS in spanish only but is very easy, more easy of armadillo with copymem2 common with 1000 bytes trick.

ftp://curso:curso@ricnar456.no-ip.org/

user:curso
pass:curso

carpeta NUEVO CURSO-TEORIAS

NOT USE EXPLORER only FTP PROGRAMS and try again in differents hours is generally full my ftp.

Ricardo

Thanks, Ricardo. I'll see if I can work out what is going on tonight :)
baudstupid
03-04-2004, 06:40 PM
Ok, like bink_us I'm plodding through Narvaja's "Requeteconcurso 19 nivel 2.doc". As always, great detail and explanation from the man, however Im struggling. No suprise. My inability to speak spanish doesn't help (although I've picked up a new phrase 'un loop infinito' :-) ) but anyway... copymem2 protection.

In the tute, after 2nd break on "WriteProcessMemory" change bytes at buffer to 'EB FE' for loop infinito ;-) new thread is started, and suddenly he is talking about Call kernel32.DebugActiveProcessStop at 0048E002.

I cannot see how he got the address 0048E000? Its not in the registers anywhere?

Please help.

Mucho Gracias!
bink_us
03-04-2004, 09:25 PM
Ok, like bink_us I'm plodding through Narvaja's "Requeteconcurso 19 nivel 2.doc". As always, great detail and explanation from the man, however Im struggling. No suprise. My inability to speak spanish doesn't help (although I've picked up a new phrase 'un loop infinito' :-) ) but anyway... copymem2 protection.

In the tute, after 2nd break on "WriteProcessMemory" change bytes at buffer to 'EB FE' for loop infinito ;-) new thread is started, and suddenly he is talking about Call kernel32.DebugActiveProcessStop at 0048E002.

I cannot see how he got the address 0048E000? Its not in the registers anywhere?

Please help.

Mucho Gracias!

I think the way that part works is to attach a second OllyDbg to the now looping child process and then you will be stopped at kernel32.DebugActiveProcessStop in the second debugger. Not 100% sure but I think that is how it works.

Edit: OK, I think I'm wrong. It is later on that you need to attach a 2nd OllyDbg to the child process. Now I'm thinking that the the code at 0048E000 is code to detach the father process from the child process so that we can then attach OllyDbg to the child.
Ricardo Narvaja
03-05-2004, 03:30 AM
Ths direction 48e002 is any direction of the exe, only is used for write the three lines to detach the father and let son run free.
You go to any part of the exe and assemble

Push [handle of the son]
Call DebugActiveProcessStop
nop

and right click in this push and NEW ORIGIN HERE, with this the three lines will be the next lines executed, and the last of the father.
You can put a BPX in the NOP and RUN.
When stop in bpx if the son are free, you can minimize the father, and continue debugging the son, ataching other olly.

Ricardo Narvaja
nikolatesla20
03-05-2004, 07:53 AM
Hehehe. DebugActiveProcessStop(). Microsoft wrote an Armadillo remover for us on that one :) :) :) :cool:

-nt20
baudstupid
03-05-2004, 07:57 AM
Are you saying we can write the 'push <handle>, call kernel..., nop' anywhere in the target.exe? Click 'New Origin Here' will only effect restart won't it?

After the 60 E8 --> EB FE it is in infinite loop, how can you get 'push, call, nop' to run? Restarting the process will loose edits!

Thanks!
bink_us
03-05-2004, 03:06 PM
Are you saying we can write the 'push <handle>, call kernel..., nop' anywhere in the target.exe? Click 'New Origin Here' will only effect restart won't it?

After the 60 E8 --> EB FE it is in infinite loop, how can you get 'push, call, nop' to run? Restarting the process will loose edits!

Thanks!

Here are the steps I followed:

- Open the target in OllyDbg
- set the IsDebuggerPresent byte to 00
- bp WriteProcessMemory
- F9 twice as the 2nd WriteProcessmemory is the one where you write the loop
- Edit the buffer in the WriteProcessMemory call to be EB FE so that the child process will be in an infinite loop (take a note of the bytes so you can put them back later)
- F9 again to run the parent - should see 2 processes with the same name in task manager and CPU usage of the child process will be ~100%
- bp WaitForDebugEvent to stop the parent
- Find the process id of the child by doing open in the OllyDbg that is running the parent and finding the process that isn't in red - press cancel
- pick a point in the parent and assemble in

PUSH <process id>
CALL DebugActiveProcessStop
NOP

- right click->new origin here on the inserted PUSH - this moves the current execution point to the selected line. It doesn't restart the process.
- breakpoint the NOP and F9
- when the execution stops at the NOP, check EAX is 1 that indicates the DebugActiveProcessStop command was successful
- the child process is no longer being debugged by the parent process so we can attach a new OllyDbg to the child. Leave the parent paused but don't close the OllyDbg.
- press F9 and then F12 in the new debugger after attaching and you should be paused at the EB FE loop in the child process.
- Edit back in the original 2 bytes to remove the loop

Now I'm not sure if what I did next was correct.

- set the IsDebuggerPresent to 00
- put a memory access breakpoint on the first section after the PE header in the memory window
- press F9

At this point the child process loaded a bunch of DLLs and I saw the targets splash screen pop up. This seems strange to me as I thought that I would hit the OEP before I saw the splash screen - is this assumption incorrect?

Then I hit a Priviledged Instruction exception and a bunch of other exceptions trying to write to 00000000. I used shift+F9 to pass those to the child process. This also seemed strange to me - anyone know whether this should worry me?

Eventually I hit the memory breakpoint which I assumed is the OEP. I then went to LordPE and dumped the process.

I found the IAT by following looking at a CALL ten or so lines down from the suspected OEP and got the start, end and size of the table. Entered all this into ImpRec and ended up with 11 unresolved calls that I'll need to track down somehow - time to search for a good IAT rebuilding tutorial.

(for those interested the target is available at pokerinspector.com)
Ricardo Narvaja
03-05-2004, 07:52 PM
The tipical armadillo nag, apear before you reach the OEP, when the son is autounpacking, if the olly pause in the first section (401000- xxxxxx) with a memory breakpoint on execution you are in the oep, (any armas are BPM protected and not stop in the oep or hang when detect the bpm)

Well i tell you look well the iat, look the values this entries have before, change to the final iat value, if before has 0000000, this are junk entries and you can right click, and in IMP REC, mark this entres with SHOW INVALID and select CUT THUNKS and bye bye, if you use the magic jump and this entries are not junk entries well, this are other theme jeje

Ricardo

QUOTE=bink_us]Here are the steps I followed:

- Open the target in OllyDbg
- set the IsDebuggerPresent byte to 00
- bp WriteProcessMemory
- F9 twice as the 2nd WriteProcessmemory is the one where you write the loop
- Edit the buffer in the WriteProcessMemory call to be EB FE so that the child process will be in an infinite loop (take a note of the bytes so you can put them back later)
- F9 again to run the parent - should see 2 processes with the same name in task manager and CPU usage of the child process will be ~100%
- bp WaitForDebugEvent to stop the parent
- Find the process id of the child by doing open in the OllyDbg that is running the parent and finding the process that isn't in red - press cancel
- pick a point in the parent and assemble in

PUSH <process id>
CALL DebugActiveProcessStop
NOP

- right click->new origin here on the inserted PUSH - this moves the current execution point to the selected line. It doesn't restart the process.
- breakpoint the NOP and F9
- when the execution stops at the NOP, check EAX is 1 that indicates the DebugActiveProcessStop command was successful
- the child process is no longer being debugged by the parent process so we can attach a new OllyDbg to the child. Leave the parent paused but don't close the OllyDbg.
- press F9 and then F12 in the new debugger after attaching and you should be paused at the EB FE loop in the child process.
- Edit back in the original 2 bytes to remove the loop

Now I'm not sure if what I did next was correct.

- set the IsDebuggerPresent to 00
- put a memory access breakpoint on the first section after the PE header in the memory window
- press F9

At this point the child process loaded a bunch of DLLs and I saw the targets splash screen pop up. This seems strange to me as I thought that I would hit the OEP before I saw the splash screen - is this assumption incorrect?

Then I hit a Priviledged Instruction exception and a bunch of other exceptions trying to write to 00000000. I used shift+F9 to pass those to the child process. This also seemed strange to me - anyone know whether this should worry me?

Eventually I hit the memory breakpoint which I assumed is the OEP. I then went to LordPE and dumped the process.

I found the IAT by following looking at a CALL ten or so lines down from the suspected OEP and got the start, end and size of the table. Entered all this into ImpRec and ended up with 11 unresolved calls that I'll need to track down somehow - time to search for a good IAT rebuilding tutorial.

(for those interested the target is available at pokerinspector.com)[/QUOTE]
Wurstgote
03-05-2004, 07:58 PM
Hi all,
baudstupid, this may be a stup... a real newbie question (concerning unpacking, it's the first time I've got to deal with Armadillo ;) ):
The kernel32 function DebugActiveProcessStop is only available in Win XP.
Do you know a workaround to achieve the same effect in Win2K?

Regards
Wurstgote
bink_us
03-05-2004, 08:32 PM
The tipical armadillo nag, apear before you reach the OEP, when the son is autounpacking, if the olly pause in the first section (401000- xxxxxx) with a memory breakpoint on execution you are in the oep, (any armas are BPM protected and not stop in the oep or hang when detect the bpm)

Well i tell you look well the iat, look the values this entries have before, change to the final iat value, if before has 0000000, this are junk entries and you can right click, and in IMP REC, mark this entres with SHOW INVALID and select CUT THUNKS and bye bye, if you use the magic jump and this entries are not junk entries well, this are other theme jeje

Ricardo

There are a few things a little different about this target I think
1/ There is no standard armadillo nag screen
2/ PEiD detects this as Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks but none of the unpackers I have tried (DilloDumper, ArmKiller etc) get anywhere trying to unpack it - I guess they only work on the copymem 2 protection.
4/ Retool and TRID don't detect a packer at all.

I'm going to work through the magic jump part of your tutorial next and hopefully everything will make sense :) I'm just hoping there are no nanomites.

Thanks for your input and time, Ricardo - I appreciate it.
baudstupid
03-05-2004, 09:07 PM
Hey big thanks to Ricardo and bink_us! Im getting somewhere now... working on the magic jump myself at the mo. Its tough going, but interesting. Good luck bink!

Wurstgote: I have no idea about a workaround for win2k! Soz!
Ricardo Narvaja
03-06-2004, 05:07 AM
Ths api debugActiveProcessStop is only for XP and win2k has not other api similar, only in winXP is possible.

This api is a serie os improvements made for winXP only.

Ricardo

Hey big thanks to Ricardo and bink_us! Im getting somewhere now... working on the magic jump myself at the mo. Its tough going, but interesting. Good luck bink!

Wurstgote: I have no idea about a workaround for win2k! Soz!
Ricardo Narvaja
03-06-2004, 05:11 AM
in this type of copymem2 without 1000 bytes trick, nanomites are not used.

nanomites are handled for the father, and in this versions, father has been disabled and son run without the father well ---->THIS VERSIONS HAS NO NANOMITES AT ALL.

Ricardo

Ths api debugActiveProcessStop is only for XP and win2k has not other api similar, only in winXP is possible.

This api is a serie os improvements made for winXP only.

Ricardo
%UNDEFINED%
03-06-2004, 11:35 AM
FYI from my experience if you are using Olly on 3.5x - 3.6x and you are warned about setting a suspicious breakpoint while single stepping, you must click Yes, otherwise Chad detects you and throws an illegal instruction "PREFIX: LOCK"

Thought I would give my two cents
schar
05-11-2004, 09:15 AM
The tipical armadillo nag, apear before you reach the OEP, when the son is autounpacking, if the olly pause in the first section (401000- xxxxxx) with a memory breakpoint on execution you are in the oep, (any armas are BPM protected and not stop in the oep or hang when detect the bpm)

Well, this is what I got now, the child process hang on breakpoint of first .text section
(401000), should already in oep, right? anyway to break it on the 'real' oep?
my first post here :D
thx.
schar
05-12-2004, 09:09 AM
no comment?

this app packed with debug block without 1000 writeprocessmemory, i stop the debug thread, run child thread, it will check license, if error happens client just quit (clockback etc), if i set break on child process before it unpack to first .text, there will be an access fault on 401000 and terminated, after it checks everything okey and .text filled with codes, then .data .idata filled with data just by memory copy, these area should already been unpacked before exec the memory copy, then i set memory access break on first .text, it loads DLLs from exception codes and breaks on 401000, :(:(
so, where to put breakpoints now? any help?

the time checking could be defeated by clean .TMP file and HKLM\Software\License and search a binary Key hidden at HKLM\Software\Classes\CLSID\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}\XXX
it will return to the first run, on different pc, the arm just hide the check key in the home of other applications' CLSID
Ricardo Narvaja
05-12-2004, 03:30 PM
i don't understand english very well and you write how talk a parlor jeje.

1)When you detach the father you atach the 2nd olly in the ep of the child process in the infinite loop, right?
2)well for reach the oep you go to view-memory and BPM ON ACCESS in the section begin in 401000, and run, when stop and in the left lower corner of the olly you see the program stop by memory breakpoint on execution and the adress is in the section 401000-xxxxxxx you are in the OEP.
3)If the program close and you don't reach the oep the bpm is detected, in some armas maybe you pass this detection using first a HE in a api (try), and next the bpm in the correct section.
Well if you are in the oep you can dump, but you need repeat the process for found the magic jump and repair the table, and use this process in IMP REC for FIX the dump.
If i don't understand your question repeat me slowly jeje, i'speak spanish only.
Ricardo
schar
05-12-2004, 09:16 PM
thx Ricardo :)

1: right.
2: left corner said: 'Memory breakpoint when executing [00401000]'.
here is the code on [00401000]:

push ebp
mov ebp, esp
sub esp, 14
push 1
call msvcrt.__set_app_type
call dummy.004010x0
mov esp, ebp
xor eax, eax
pop ebp
retn

is it the oep? thx :)
nikolatesla20
05-12-2004, 10:06 PM
thx Ricardo :)

1: right.
2: left corner said: 'Memory breakpoint when executing [00401000]'.
here is the code on [00401000]:

push ebp
mov ebp, esp
sub esp, 14
push 1
call msvcrt.__set_app_type
call dummy.004010x0
mov esp, ebp
xor eax, eax
pop ebp
retn

is it the oep? thx :)

looks like an OEP to me :)

-nt20
schar
05-12-2004, 10:13 PM
looks like an OEP to me :)

-nt20

okey, ill go for the magic jump :)
Ricardo Narvaja
05-13-2004, 03:19 AM
is a OEP possibly, and if OLLY say MEMORY BREAKPOINT ON EXECUTION and is the first time OLLY say this, is the OEP>

Ricardo Narvaja
schar
05-13-2004, 03:32 AM
when i debug the child, i found it runs like this after the splash screen:

1)it unpack code to [00401000-xxxxxxxx] sample:
00401008 CALL DWORD PTR DS:[D8C9E5A1] <--this entry is junk or encrypted
0040100E CALL DUMMY.00401080
2)the entry table area(i think) now is junk too.
3)it loading DLLs
4)the entry table area(i think) now is addresses
5)it rewrite codes [00401000-xxxxxxxx] sample:
00401008 CALL DWORD PTR DS:[010870a0] <--msvcrt.xxxxxxxx
0040100E CALL DUMMY.00401080
4)memory access break on [00401000]

the .text area different on many places between the first one and the last one after loading DLLs.
Ricardo Narvaja
05-13-2004, 03:45 AM
before the programa reach the OEP is selfunpacking and the changes are normal, when you are in the oep the program are fill unpacked, and you can dump. (in armadillos without 1000 bytes trick in clasical copymem2 is different)

Ricardo

when i debug the child, i found it runs like this after the splash screen:

1)it unpack code to [00401000-xxxxxxxx] sample:
00401008 CALL DWORD PTR DS:[D8C9E5A1] <--this entry is junk or encrypted
0040100E CALL DUMMY.00401080
2)the entry table area(i think) now is junk too.
3)it loading DLLs
4)the entry table area(i think) now is addresses
5)it rewrite codes [00401000-xxxxxxxx] sample:
00401008 CALL DWORD PTR DS:[010870a0] <--msvcrt.xxxxxxxx
0040100E CALL DUMMY.00401080
4)memory access break on [00401000]

the .text area different on many places between the first one and the last one after loading DLLs.
schar
05-13-2004, 06:17 AM
before the programa reach the OEP is selfunpacking and the changes are normal, whan you are in the oep the program are fill unpacked, and you can dump. (in armadillos without 1000 bytes trick in clasical copymem2 is different)

Ricardo

Now the problem:
The dumped code using 'CALL DWORD PTR DS:[010870a0]', which the [010870a0] in memory out of the RVA address of the dump file, how to rebuild the import table now?
Ricardo Narvaja
05-13-2004, 06:51 AM
the unique armadillo with the iat out of the exe is the new armadillo 3.70, what program are you viewing?
If there a case, there are tuts in my ftp (6 terrible tuts) and there are a script for resolve but i don´t test the script, in the ollydbg forum there are a new script published for repair the table.

If the script dont work, read the tutes on my ftp.

Is a haaard work

Ricardo Narvaja

Now the problem:
The dumped code using 'CALL DWORD PTR DS:[010870a0]', which the [010870a0] in memory out of the RVA address of the dump file, how to rebuild the import table now?
schar
05-13-2004, 07:03 AM
the unique armadillo with the iat out of the exe is the new armadillo 3.70, what program are you viewing?
If there a case, there are tuts in my ftp (6 terrible tuts) and there are a script for resolve but i don´t test the script, in the ollydbg forum there are a new script published for repair the table.

If the script dont work, read the tutes on my ftp.

Is a haaard work

Ricardo Narvaja

:) :) it's a new one

I grab the binary table at [010870a0], binary paste right after the original import table on [0040x000], rebuild the dump, then, maybe most of all the DLLs imported, the last thing could to do is to fix the .text area: dump all the symbols, use value in import table to modify the entry of the CALLs out of range.

I will read your new tuts, and see if scripts works... :)
thx Ricardo.
nikolatesla20
05-13-2004, 08:54 AM
the unique armadillo --->with the iat out of the exe <--- is the new armadillo 3.70, what program are you viewing?
If there a case, there are tuts in my ftp (6 terrible tuts) and there are a script for resolve but i don´t test the script, in the ollydbg forum there are a new script published for repair the table.

If the script dont work, read the tutes on my ftp.

Is a haaard work

Ricardo Narvaja

Perhaps I shall have a look at this feature - what exactly do you mean Ricardo by the statement above? What is different about IAT now.

-nt20
Ricardo Narvaja
05-13-2004, 10:11 AM
If i can explian in spanish will be more easy for me, i don´t speak english.

IAT in a normal program is in the exe, for example

the exe start in 400000 to 450000

the iat would be start in 401300 to 401700 for example.

in the new arma the iat in my machine start in

340000 to 340700 for example and is out of the image.

This is not the only trouble, the entryes in the iat are shufled (for example one of kernel32, one of user32, one of kernel32,again etc) and IMP REC or revirgin only reapair iats in order (all kernel32 entries, the separation, next user32, entries, etc) and armadillo change al the jmps and calls take values of iat to are all messed and shufled, for this reason if you need repair the tble you can order the entries and chenge the jmp and call to the correct value, and have new antidumps etc.

Perhaps I shall have a look at this feature - what exactly do you mean Ricardo by the statement above? What is different about IAT now.

-nt20
Ricardo Narvaja
05-13-2004, 10:14 AM
is more easy and you have the posiibility to look the program by yourself. go to my FTP and download tuts 203 to 208.

Ricardo Narvaja

If i can explian in spanish will be more easy for me, i don´t speak english.

IAT in a normal program is in the exe, for example

the exe start in 400000 to 450000

the iat would be start in 401300 to 401700 for example.

in the new arma the iat in my machine start in

340000 to 340700 for example and is out of the image.

This is not the only trouble, the entryes in the iat are shufled (for example one of kernel32, one of user32, one of kernel32,again etc) and IMP REC or revirgin only reapair iats in order (all kernel32 entries, the separation, next user32, entries, etc) and armadillo change al the jmps and calls take values of iat to are all messed and shufled, for this reason if you need repair the tble you can order the entries and chenge the jmp and call to the correct value, and have new antidumps etc.
schar
05-13-2004, 01:04 PM
This is not the only trouble, the entryes in the iat are shufled (for example one of kernel32, one of user32, one of kernel32,again etc) and IMP REC or revirgin only reapair iats in order (all kernel32 entries, the separation, next user32, entries, etc) and armadillo change al the jmps and calls take values of iat to are all messed and shufled, for this reason if you need repair the tble you can order the entries and chenge the jmp and call to the correct value, and have new antidumps etc.
Ricardo Narvaja

i fix some entries by save all the address table: [entry]-[ptr]-symble.name, then, paste out of range IAT inside .data1, rebuild exe will import these symbols but the [entry] in .text still out of range, then, make a patch app modify [outof range address] to [inside address], most of them are recovered, almost 300 entries, but still some are missing, now, since the DLLs are loaded, the entry is there, just modify the inside IAT the bad value to the DLLs real entry and patch the .text CALLs and JUMPs to the inside IAT address, then it will run.

fill all the holes :D:D
Ricardo Narvaja
05-13-2004, 01:13 PM
The program of my tut 203? I think is not the same version of armadillo the program of yours (the program of my tut have antidumps, have the iat shuffled, and you don't work in this items)

Ricardo

i fix some entries by save all the address table: [entry]-[ptr]-symble.name, then, paste out of range IAT inside .data1, rebuild exe will import these symbols but the [entry] in .text still out of range, then, make a patch app modify [outof range address] to [inside address], most of them are recovered, almost 300 entries, but still some are missing, now, since the DLLs are loaded, the entry is there, just modify the inside IAT the bad value to the DLLs real entry and patch the .text CALLs and JUMPs to the inside IAT address, then it will run.

fill all the holes :D:D
schar
05-13-2004, 11:10 PM
The program of my tut 203? I think is not the same version of armadillo the program of yours (the program of my tut have antidumps, have the iat shuffled, and you don't work in this items)

Ricardo

yes, the same packer by the bad boys, makes it just like a compiler :D
the script not works. :( so, i am reading tuts very carefully now, thx Ricardo's hard work.
Ricardo, got the message? you will see what i m looking on
Ricardo Narvaja
05-13-2004, 11:25 PM
i go to the page and the 1.21 versionis not anymore, there are 1.22 version now
VolX
05-14-2004, 12:13 AM
:) :) it's a new one

I grab the binary table at [010870a0], binary paste right after the original import table on [0040x000], rebuild the dump, then, maybe most of all the DLLs imported, the last thing could to do is to fix the .text area: dump all the symbols, use value in import table to modify the entry of the CALLs out of range.

I will read your new tuts, and see if scripts works... :)
thx Ricardo.

I have noticed your post in Ollydbg forum, since I'm not a registered user there so i just answer it here.

That script is only for a program packed with standard protection not packed with CopyMem-II .

Debug that script then you will know how easily this trick can be defeated even the program is packed with CopyMem-II .

bye!
schar
05-14-2004, 12:30 AM
I have noticed your post in Ollydbg forum, since I'm not a registered user there so i just answer it here.

That script is only for a program packed with standard protection not packed with CopyMem-II .

Debug that script then you will know how easily this trick can be defeated even the program is packed with CopyMem-II .

bye!

thx VolX, i will debug the script, i just used olly for a week :p
I just test it and nothing happens :( , the information send to you by forum message, if you would like to try it :)
Ricardo, they update so quickly, maybe bug found, i will down the new one.
paranoja
05-23-2004, 06:10 PM
[QUOTE=bink_us]
- set the IsDebuggerPresent to 00
- put a memory access breakpoint on the first section after the PE header in the memory window
QUOTE]

What do u mean first section after pe header? text1??? and what address is this is at?
dELTA
05-24-2004, 07:39 AM
He means whatever section that is first in the PE header section table, where you will also find its address.


asprotect closing door
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > asprotect closing door
PDA

View Full Version : asprotect closing door

klier
02-28-2004, 07:25 AM
Forgive me father cos i have sinned.
It's been 3 yr's since my last unpacking.
Peid said asprotect 1.22-1.23.
Dumped it at oep.
Fixed for stolen bts.
Fixed Iat.
No go.
Trace...
Call unpacks more...
and shuts the door with int 3.
Dumped after call and...
fixed the int 3 and did the above.
halelujah,see the stars.
Q:is this standard or exeptional behaviour?
klier
02-28-2004, 11:42 AM
first dump

004976B8 >/$ 55 PUSH EBP<<<<<<<<<<<from here....
004976B9 |. 8BEC MOV EBP,ESP
004976BB |. 6A FF PUSH -1
004976BD |. 68 90624C00 PUSH mod_van_.004C6290
004976C2 |. 68 B8794900 PUSH mod_van_.004979B8 ; SE handler installation
004976C7 |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
004976CD |. 50 PUSH EAX
004976CE |. 64:8925 000000>MOV DWORD PTR FS:[0],ESP
004976D5 |. 83EC 58 SUB ESP,58
004976D8 |. 53 PUSH EBX
004976D9 |. 56 PUSH ESI
004976DA |. 57 PUSH EDI
004976DB |. 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP<<<<<<<<<till here,stolen bytes
004976DE |. FF15 38314C00 CALL DWORD PTR DS:[<&kernel32.GetVersion>; kernel32.GetVersion
004976E4 |. 33D2 XOR EDX,EDX
004976E6 |. 8AD4 MOV DL,AH
004976E8 |. 8915 70255500 MOV DWORD PTR DS:[552570],EDX
004976EE |. 8BC8 MOV ECX,EAX
004976F0 |. 81E1 FF000000 AND ECX,0FF
004976F6 |. 890D 6C255500 MOV DWORD PTR DS:[55256C],ECX
004976FC |. C1E1 08 SHL ECX,8
004976FF |. 03CA ADD ECX,EDX
00497701 |. 890D 68255500 MOV DWORD PTR DS:[552568],ECX
00497707 |. C1E8 10 SHR EAX,10
0049770A |. A3 64255500 MOV DWORD PTR DS:[552564],EAX
0049770F |. 33F6 XOR ESI,ESI
00497711 |. 56 PUSH ESI
00497712 |. E8 A4510000 CALL mod_van_.0049C8BB
00497717 |. 59 POP ECX
00497718 |. 85C0 TEST EAX,EAX
0049771A |. 75 08 JNZ SHORT mod_van_.00497724
0049771C |. 6A 1C PUSH 1C
0049771E |. E8 B0000000 CALL mod_van_.004977D3
00497723 |. 59 POP ECX
00497724 |> 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
00497727 |. E8 6F4E0000 CALL mod_van_.0049C59B
0049772C |. FF15 B8314C00 CALL DWORD PTR DS:[<&kernel32.GetCommand>; [GetCommandLineA
00497732 |. A3 C42F6100 MOV DWORD PTR DS:[612FC4],EAX
00497737 |. E8 2D4D0000 CALL mod_van_.0049C469
0049773C |. A3 A4255500 MOV DWORD PTR DS:[5525A4],EAX
00497741 |. E8 D64A0000 CALL mod_van_.0049C21C
00497746 |. E8 184A0000 CALL mod_van_.0049C163
0049774B |. E8 12FAFFFF CALL mod_van_.00497162
00497750 |. 8975 D0 MOV DWORD PTR SS:[EBP-30],ESI
00497753 |. 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
00497756 |. 50 PUSH EAX ; /pStartupinfo
00497757 |. FF15 3C314C00 CALL DWORD PTR DS:[<&kernel32.GetStartup>; \GetStartupInfoA
0049775D |. E8 A9490000 CALL mod_van_.0049C10B
00497762 |. 8945 9C MOV DWORD PTR SS:[EBP-64],EAX
00497765 |. F645 D0 01 TEST BYTE PTR SS:[EBP-30],1
00497769 |. 74 06 JE SHORT mod_van_.00497771
0049776B |. 0FB745 D4 MOVZX EAX,WORD PTR SS:[EBP-2C]
0049776F |. EB 03 JMP SHORT mod_van_.00497774
00497771 |> 6A 0A PUSH 0A
00497773 |. 58 POP EAX
00497774 |> 50 PUSH EAX
00497775 |. FF75 9C PUSH DWORD PTR SS:[EBP-64]
00497778 |. 56 PUSH ESI
00497779 |. 56 PUSH ESI ; /pModule
0049777A |. FF15 84314C00 CALL DWORD PTR DS:[<&kernel32.GetModuleH>; \GetModuleHandleA
00497780 |. 50 PUSH EAX
00497781 |. E8 9A2FFCFF CALL mod_van_.0045A720<<<<<<<<<<<<<<<<<<trace into
00497786 |. 8945 A0 MOV DWORD PTR SS:[EBP-60],EAX
00497789 |. 50 PUSH EAX
0049778A |. E8 00FAFFFF CALL mod_van_.0049718F
0049778F |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00497792 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
00497794 |. 8B09 MOV ECX,DWORD PTR DS:[ECX]
00497796 |. 894D 98 MOV DWORD PTR SS:[EBP-68],ECX
00497799 |. 50 PUSH EAX
0049779A |. 51 PUSH ECX
0049779B |. E8 4D3A0000 CALL mod_van_.0049B1ED
004977A0 |. 59 POP ECX
004977A1 |. 59 POP ECX
004977A2 \. C3 RETN

call 00497781==
0045A720 $ 55 PUSH EBP
0045A721 . 8BEC MOV EBP,ESP
0045A723 . 81EC 0C010000 SUB ESP,10C
0045A729 . 897D F8 MOV DWORD PTR SS:[EBP-8],EDI
0045A72C . 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
0045A72F . 895D F4 MOV DWORD PTR SS:[EBP-C],EBX
0045A732 . 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
0045A735 . 8935 C0315500 MOV DWORD PTR DS:[5531C0],ESI
0045A73B . 6A 00 PUSH 0
0045A73D . FF15 98334C00 CALL DWORD PTR DS:[<&ole32.CoInitialize>>; ole32.CoInitialize
0045A743 . FF15 1C304C00 CALL DWORD PTR DS:[<&comctl32.#17>] ; [InitCommonControls
0045A749 . B9 20186100 MOV ECX,_Prog.00611820
0045A74E . E8 8997FAFF CALL _Prog.00403EDC
0045A753 . 6A 40 PUSH 40
0045A755 . 50 PUSH EAX
0045A756 . FF15 94175500 CALL DWORD PTR DS:[551794]<<<<<<<unpacking routine
0045A75C . E9 1A010000 JMP _Prog.0045A87B<<<<<<<<<<<<place for second dump
0045A761 . C2 6C69 RETN 696C

.00497778: 56 push esi
.00497779: 56 push esi
.0049777A: FF1584314C00 call d,[0004C3184]
.00497780: 50 push eax
.00497781: CC int 3<<<<<<<<<<<<<<<<<closes door with int 3
.00497782: 9A2FFCFF8945A0 call 0A045:089FFFC2F
.00497789: 50 push eax
.0049778A: E800FAFFFF call .00049718F -------- (1)
.0049778F: 8B45EC mov eax,[ebp][-0014]

corrected==
004976B8 >/$ 55 PUSH EBP<<<<<<<<<<<from here....
004976B9 |. 8BEC MOV EBP,ESP
004976BB |. 6A FF PUSH -1
004976BD |. 68 90624C00 PUSH dulat.004C6290
004976C2 |. 68 B8794900 PUSH dulat.004979B8 ; SE handler installation
004976C7 |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
004976CD |. 50 PUSH EAX
004976CE |. 64:8925 000000>MOV DWORD PTR FS:[0],ESP
004976D5 |. 83EC 58 SUB ESP,58
004976D8 |. 53 PUSH EBX
004976D9 |. 56 PUSH ESI
004976DA |. 57 PUSH EDI
004976DB |. 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP<<<<<<<<<till here,stolen bytes
004976DE |. FF15 38314C00 CALL DWORD PTR DS:[<&kernel32.GetVersion>; kernel32.GetVersion
004976E4 |. 33D2 XOR EDX,EDX
004976E6 |. 8AD4 MOV DL,AH
004976E8 |. 8915 70255500 MOV DWORD PTR DS:[552570],EDX
004976EE |. 8BC8 MOV ECX,EAX
004976F0 |. 81E1 FF000000 AND ECX,0FF
004976F6 |. 890D 6C255500 MOV DWORD PTR DS:[55256C],ECX
004976FC |. C1E1 08 SHL ECX,8
004976FF |. 03CA ADD ECX,EDX
00497701 |. 890D 68255500 MOV DWORD PTR DS:[552568],ECX
00497707 |. C1E8 10 SHR EAX,10
0049770A |. A3 64255500 MOV DWORD PTR DS:[552564],EAX
0049770F |. 33F6 XOR ESI,ESI
00497711 |. 56 PUSH ESI
00497712 |. E8 A4510000 CALL dulat.0049C8BB
00497717 |. 59 POP ECX
00497718 |. 85C0 TEST EAX,EAX
0049771A |. 75 08 JNZ SHORT dulat.00497724
0049771C |. 6A 1C PUSH 1C
0049771E |. E8 B0000000 CALL dulat.004977D3
00497723 |. 59 POP ECX
00497724 |> 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
00497727 |. E8 6F4E0000 CALL dulat.0049C59B
0049772C |. FF15 B8314C00 CALL DWORD PTR DS:[<&kernel32.GetCommand>; [GetCommandLineA
00497732 |. A3 C42F6100 MOV DWORD PTR DS:[612FC4],EAX
00497737 |. E8 2D4D0000 CALL dulat.0049C469
0049773C |. A3 A4255500 MOV DWORD PTR DS:[5525A4],EAX
00497741 |. E8 D64A0000 CALL dulat.0049C21C
00497746 |. E8 184A0000 CALL dulat.0049C163
0049774B |. E8 12FAFFFF CALL dulat.00497162
00497750 |. 8975 D0 MOV DWORD PTR SS:[EBP-30],ESI
00497753 |. 8D45 A4 LEA EAX,DWORD PTR SS:[EBP-5C]
00497756 |. 50 PUSH EAX ; /pStartupinfo
00497757 |. FF15 3C314C00 CALL DWORD PTR DS:[<&kernel32.GetStartup>; \GetStartupInfoA
0049775D |. E8 A9490000 CALL dulat.0049C10B
00497762 |. 8945 9C MOV DWORD PTR SS:[EBP-64],EAX
00497765 |. F645 D0 01 TEST BYTE PTR SS:[EBP-30],1
00497769 |. 74 06 JE SHORT dulat.00497771
0049776B |. 0FB745 D4 MOVZX EAX,WORD PTR SS:[EBP-2C]
0049776F |. EB 03 JMP SHORT dulat.00497774
00497771 |> 6A 0A PUSH 0A
00497773 |. 58 POP EAX
00497774 |> 50 PUSH EAX
00497775 |. FF75 9C PUSH DWORD PTR SS:[EBP-64]
00497778 |. 56 PUSH ESI
00497779 |. 56 PUSH ESI ; /pModule
0049777A |. FF15 84314C00 CALL DWORD PTR DS:[<&kernel32.GetModuleH>; \GetModuleHandleA
00497780 |. 50 PUSH EAX
00497781 |. E8 9A2FFCFF CALL dulat.0045A720 <<<<<<<<<removed int 3
00497786 |. 8945 A0 MOV DWORD PTR SS:[EBP-60],EAX
00497789 |. 50 PUSH EAX
0049778A |. E8 00FAFFFF CALL dulat.0049718F
0049778F |. 8B45 EC MOV EAX,DWORD PTR SS:[EBP-14]
00497792 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
00497794 |. 8B09 MOV ECX,DWORD PTR DS:[ECX]
00497796 |. 894D 98 MOV DWORD PTR SS:[EBP-68],ECX
00497799 |. 50 PUSH EAX
0049779A |. 51 PUSH ECX
0049779B |. E8 4D3A0000 CALL dulat.0049B1ED
004977A0 |. 59 POP ECX
004977A1 |. 59 POP ECX
004977A2 \. C3 RETN

trace into 00497781:
0045A720 $ 55 PUSH EBP
0045A721 . 8BEC MOV EBP,ESP
0045A723 . 81EC 0C010000 SUB ESP,10C
0045A729 . 897D F8 MOV DWORD PTR SS:[EBP-8],EDI
0045A72C . 8975 FC MOV DWORD PTR SS:[EBP-4],ESI
0045A72F . 895D F4 MOV DWORD PTR SS:[EBP-C],EBX
0045A732 . 8B75 08 MOV ESI,DWORD PTR SS:[EBP+8]
0045A735 . 8935 C0315500 MOV DWORD PTR DS:[5531C0],ESI
0045A73B . 6A 00 PUSH 0
0045A73D . FF15 98334C00 CALL DWORD PTR DS:[<&ole32.CoInitialize>>; ole32.CoInitialize
0045A743 . FF15 1C304C00 CALL DWORD PTR DS:[<&comctl32.InitCommon>; [InitCommonControls
0045A749 . B9 20186100 MOV ECX,dulat.00611820
0045A74E . E8 8997FAFF CALL dulat.00403EDC
0045A753 . 6A 40 PUSH 40
0045A755 . 50 PUSH EAX
0045A756 . 90 NOP
0045A757 . 90 NOP
0045A758 . 90 NOP
0045A759 . 90 NOP
0045A75A . 90 NOP
0045A75B . 90 NOP<<<<<<<<<<<nopped out unpacking routine
0045A75C . E9 01000000 JMP dulat.0045A762
0045A761 1C DB 1C
0045A762 > E8 49FBFFFF CALL dulat.0045A2B0
0045A767 . 8BD8 MOV EBX,EAX
0045A769 . 0FB6D3 MOVZX EDX,BL
0045A76C . 85D2 TEST EDX,EDX
0045A76E . 75 28 JNZ SHORT dulat.0045A798
0045A770 . 33C0 XOR EAX,EAX
0045A772 . 50 PUSH EAX ; /lParam => NULL
0045A773 . 68 ACA34500 PUSH dulat.0045A3AC ; |DlgProc = dulat.0045A3AC
0045A778 . 50 PUSH EAX ; |hOwner => NULL
0045A779 . 68 2C010000 PUSH 12C ; |pTemplate = 12C
0045A77E . 56 PUSH ESI ; |hInst
0045A77F . FF15 A8324C00 CALL DWORD PTR DS:[<&user32.DialogBoxPar>; \DialogBoxParamA
0045A785 . 85C0 TEST EAX,EAX
0045A787 . 7D 08 JGE SHORT dulat.0045A791
0045A789 . 6A 00 PUSH 0 ; /ExitCode = 0
0045A78B . FF15 00324C00 CALL DWORD PTR DS:[<&kernel32.ExitProces>; \ExitProcess
0045A791 > E8 1AFBFFFF CALL dulat.0045A2B0
SpeKKeL
02-28-2004, 01:21 PM
halelujah,see the stars.

Q:is this standard or exeptional behaviour?

Q: Did you wrote your post while drinking and smoking?

Q:Or got hit by lightning ?

What TF is your Question.. :confused:

SpeKK.
D-Jester
02-28-2004, 01:36 PM
I believe is wanting to know if the int3 use, is a common place anti-dbg?
klier
02-28-2004, 02:22 PM
SpeKKeL :
reply Q1=depends on the program,in this case it is a Program Name Removed because target specific code posted. :D

reply Q2=is that a problem? :o

reply Q3=For to rest both words and form
Seem lost in lightning and in storm,
While Saul, in wakeful trance,
See deep within that dazzling field
His persecuted Lord revealed
With keen yet pitying glance:
etc... :confused:
crUsAdEr
02-28-2004, 04:23 PM
now now.. that is another level of reversing :) (perhaps admins need to move this thread to ADVANCED reversing)... are you trying to be the next +ORC with all these riddles :)...
JMI
02-28-2004, 05:20 PM
crUsAdEr:

It's not a riddle, it's part of a poem titled "The Conversion of St. Paul."

http://www.geocities.com/Heartland/Pines/7224/Rick/kbCnPaul.htm

Regards,
klier
02-29-2004, 05:33 AM
Question is simple:working dump is not at oep but at jump (0045A75C).
Is this an option from asprotect?
Can't find something similar in forumsearch and tuts.

regards,
crUsAdEr
02-29-2004, 12:50 PM
yep it is a feature.. sometimes u need to dump before DIPs
klier
02-29-2004, 01:30 PM
crUsAdEr :
The dump is in my opinion way after any dip,and after OEP.
Excuse me if I'm wrong. ;)

Greetings,
SpeKKeL
02-29-2004, 01:51 PM
crUsAdEr :
The dump is in my opinion way after any dip,and after OEP.
Excuse me if I'm wrong. ;)

Greetings,

Well after a good night rest and thinking about poems... :D ,

Just unpacked some cd copy clone prog (is it obvious..???)

Oep begins with a jmp! Maybe a missed those stolen bytes but that's not a problem...Look at the oep (in the packed prog)> to the stack and the values stored in the registers
now you can see if you missed something important in you unpacked prog.
Dumping can take place before or after dips is mine opinion but i always dump as soon i see the prog is loaded in memory.

BTW i gave aspr debugger a try (version 1.06 is latest???) but it has cutted some thunks and erased some imports... .

BTW2 a good manner for reaching the oep or just before in aspr code is using bpm's on esp!

Uhhhh.... To be or not to be (is the only one i know..sorry)

Spekk.
klier
03-01-2004, 10:13 AM
Greetings

" One must do everything one can and then say 'God have Mercy!' " :)

First I made a dump at the fake oep,fixed the dump for the stolen bytes,fixed IAT and tried to run it.
The dump crashed and after examining the dump,i saw there was still some code packed and that the app. crashed at line 0045A756 . FF15 94175500 CALL DWORD PTR DS:[551794].
So i made e second dump at 0045A75C . E9 01000000 JMP dulat.0045A762 just after the unpacking routine.
First i planned to cut and paste all the unpacked code to the half-unpacked dump but i saw it was a big boring job,and you can easily overlook something.
So i treated the second dump the same as the first(stolen bytes,iat),nopped out the unpacking call and tried to run it.
It crashed.
Examined the dump and found that the call that you should trace for getting at the unpacking routine and the rest of the code
(00497781 |. E8 9A2FFCFF CALL mod_van_.0045A720)was changed in .00497781: CC int 3.
By replacing the int3 bytes in to the original i got a working dump.

Question:is this asprotects or the programmers doings.
JMI
03-01-2004, 12:43 PM
klier:

Reversing your greeting, the answer is: G. I. Gurdjieff, "The Fourth Way." :cool:

Regards,
klier
03-01-2004, 12:56 PM
JMI

your right again :)

happy birthday,
JMI
03-01-2004, 01:05 PM
Thanks, but I'm getting so old I can't remember what I'm thanking you for. :D

Regards,
klier
03-02-2004, 11:34 AM
JMI,you being a musician should find this without google. ;)

"The railings of the bridge
Were moving by the glass
The opportunity to leave
Was coming up fast

The situation passed across my
Mind once more,
And I decided that I needed
Less not more
Less not more
Less not more"

Bye,(thread closed) :D
JMI
03-02-2004, 02:23 PM
And the next stanza is:

I counted three fewer today
That is less
In any business the idea is not to get less
but to get more
And to sacrifice one's self
in the name of someone else
would be much more, not less, than you deserve
because it would be like dying
every single minute. :eek:

Regards,
cRk
03-03-2004, 12:14 AM
this is ASpr. with xxx days trial???

your exe could crash due aspr checks /calls that looks for places that maybe are not longer present.... check if your Dumped is OK..

ASPR usually write a Call that is somewhere near after OEP this call start with FF15

and most be fixed.. also check if your Stoled bytes are OK .. for delphi app's these Stolen bytes , most times , are important for the app. to run properly
klier
03-03-2004, 05:10 AM
cRk :

Yest it is a 30 days trial.
The call i nopped might be indeed that one.
Dump works perfect.

Thanks for info :cool:

Regards,
hobferret
03-03-2004, 10:03 AM
cRk :

Yest it is a 30 days trial.
The call i nopped might be indeed that one.
Dump works perfect.

Thanks for info :cool:

Regards,

Hiya all :)

The thing most likely to cause INT3's in the dump is that you have "dumped" it with breakpoints still active :D

Had this happen on a few occasions then realized that if I cleared all the breakpoints before tracing into the final part prior to dumping all was well ;)

Hope this helps, I'm going to take time off coz all I seem to be doing of late is reversing and life is just flying by :rolleyes:

But most likely will be back here B4 I know it!!!!!!

/hobferret 03/03/04
klier
03-03-2004, 06:35 PM
mission accomplished. ;)

hobferret:
"The thing most likely to cause INT3's in the dump is that you have "dumped" it with breakpoints still active "
I had indeed a breakpoint at that call.

Nice of getting to know you all.

By the way JMI,you reversed it wrong.
On 'the commercial album' there's only one stanza. :p

Regards,
JMI
03-03-2004, 06:43 PM
By the way klier:

The commercial album "reversed it wrong". :eek:

Check out:

http://blather.newdream.net/l/less.html

Regards,
klier
03-03-2004, 06:56 PM
JMI

you used google :mad: :mad: :mad:

See you
JMI
03-03-2004, 08:04 PM
Why would you assume that just because I have an interest in music, I would know every lyric ever written without use of a reference? Consider how much of "today's" music you will remember 30 or more years from today. I'm not the least bit embarassed to say I've never heard of "The Residents" or heard these lyrics performed, let alone, on "The Residents Commercial Album." :eek:

It's not like this group made a big splash in America and certainly not among my demographic group. ;)

Regards,
klier
03-04-2004, 04:37 AM
JMI

apologies accepted :D

Regards


Awsome Asprotect Tut!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Awsome Asprotect Tut!!
PDA

View Full Version : Awsome Asprotect Tut!!

Manko
02-28-2004, 05:31 PM
Hi!

AsProtected Notepad!

by HAVOC

http://codebreakers.anticrack.de/viewarticle.php?id=27&layout=abstract

This tut is absolutely amazing! I would have loved to be able to write something like this. (I know this stuff, but couldn't put it in writeing like he does.)
I would also have loved to see something like this when I was new at aspr...

It's very thorough and very enjoyable.
He actually takes time to explain things, AND often takes it one or two steps further. :)

/Manko
xoder
02-28-2004, 06:31 PM
indeed this is very nice! i never worked on asprotect but as far as i read its all explained very good! thx for pointing to this nice piece of work :)
crUsAdEr
02-28-2004, 10:07 PM
Real nice article... 41 pages :)...

However i feel that anyone serious enough about Aspr must use IDA as a tool, not thus Olly alone...
johndoe1
03-05-2004, 06:02 PM
it may be a nice tutor...
but...

i am missing the part where i can bypass protection schemes
( the anti loader protection for instance... )
cps530
03-14-2004, 10:21 AM
Probably is a fantastatic tutorial for people who know about unpacking and Asprotect. But for anyone who wants to learn, forget it! How about to add references? How about to be clearer. For instance, right after the title: '...methods used by the anti-crack ppl to prevent...'. What's 'ppl'?
Polaris
03-14-2004, 01:13 PM
Probably is a fantastatic tutorial for people who know about unpacking and Asprotect. But for anyone who wants to learn, forget it! How about to add references? How about to be clearer. For instance, right after the title: '...methods used by the anti-crack ppl to prevent...'. What's 'ppl'?

Maybe "people" ? :D
%UNDEFINED%
03-14-2004, 02:23 PM
It really boggles my mind to see people criticize a great tutorial on something.

Just curiousity, what was covered in your last tutorial, cps530?

Say why don't you PM me with a copy of it, maybe I can critique your proper use of acronyms? :D

Or if your still confused on the "ppl"
Have a look here:

www.acronymfinder.com/af-query.asp?String=exact&Acronym=ppl


A Hidden Online Serial Key Check.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A Hidden Online Serial Key Check.
PDA

View Full Version : A Hidden Online Serial Key Check.

DaddyJTHC
02-28-2004, 11:20 PM
Ok heres whut I have gathered. When you install the software, it access the file VISE_Key_Validator.dll in C:\Documents and Settings\UserName\Local Settings\Temp\{67e6a1f1-77cb-4c00-b113-c9cfa6d35bcd} under WinXP.

is there any way to show the values of the ASM registries while the program is running?

I extracted the installer, the only place it can be is in the VISE.dll file, it checks the key, if okay , it has to make a registry entry, if its not ok, it gives error.

i have found the website that triggers the response
look at
http://%/online_sales/validate2.html?code=Q5MDB-A5CG-YZEY-APBD9
sgdt
02-28-2004, 11:25 PM
It would be a little helpful to see whats happening past the test eax, eax.

How does the program terminate? Could you find references to exit, or is it posting a close message?
DaddyJTHC
02-28-2004, 11:31 PM
Sorry man,
after the test it performs

jne 00467041
mov eax, dword ptr [005CEF4C]
mov dword ptr [esp], eax
push 005D504C
lea ecx, dword ptr [esp+04]
sgdt
02-28-2004, 11:39 PM
Could you PM me the download address? (not the URL for their site, it wants an email addr to spam me).
sgdt
02-28-2004, 11:46 PM
I almost forgot, could you also edit your first message to remove the name of the software. The powers that be frown on code posted in the same thread as the software title the code is for. Legalities and stuff...
DaddyJTHC
02-28-2004, 11:47 PM
The protection is a goto once website. Im figure a way around it could be to bounce it to a locally ran website, but you would need to know what code is returned.
DaddyJTHC
02-29-2004, 04:28 AM
You think you got hacking skills, I got a piece of software that will stump even the most graceful hackers.

PM me if your interested. Great piece of software. Protection, Online Serial Number Verification.
sgdt
02-29-2004, 06:11 AM
A small but important issue is that it is a crippled demo. The only way to get some of the features to work is to actually write them.

Regarding it crashing, could you try making the following modifications?

466fdd
from 75
to EB

46a1a9
from E8 22 F6 FF FF
to 90 90 90 90 90

46a515
from 74
to EB
dELTA
02-29-2004, 07:56 AM
...
:00466FC2 6848CF5600 push 0056CF48
:00466FC7 64A100000000 mov eax, dword ptr fs:[00000000]
:00466FCD 50 push eax
:00466FCE 64892500000000 mov dword ptr fs:[00000000], esp
...
I have heard that ASM code , runs in top to bottom order, so i follow the program code as best i can, but cannot bypass this. aside from the above mentioned.
An exception to these "top to bottom" semantics (except normal jumps and calls of course) are exceptions (no pun(s) intended :)).

As can be seen in the quoted assembler code above, an exception handler frame is set up. Simply put, this means that the code flow will be redirected to the address set up in the exception handler frame if the processor raises an exception at any point in the code (e.g. inside the call at 00466FD6). This is often used to make protections a little bit trickier. My suggestion would be to put a breakpoint at the beginning of the exception handler code and then learn more about structured exception handling (SEH).
DaddyJTHC
02-29-2004, 05:47 PM
[QUOTE=sgdt]A small but important issue is that it is a crippled demo. The only way to get some of the features to work is to actually write them.

No sir, this is no crippled demo, if installed with the correct serial number, it is a full install. Like I said i have purchased this software, but have used my 5 install limit.
DaddyJTHC
02-29-2004, 05:51 PM
I figure since i cant beat them, I join em. I figure a great way to beat the protection since i have a valid key, is to fake there website call.

GET http://%s/sales_online/jump.cgi?id=pro2

If we could find the array block return, we could modify the %s var. to localhost, and create jump.cgi that returns the correct array block. hence, verifing the software and enabling it.

This is a once per install check.
sgdt
02-29-2004, 07:19 PM
[QUOTE=sgdt]A small but important issue is that it is a crippled demo. The only way to get some of the features to work is to actually write them.

No sir, this is no crippled demo, if installed with the correct serial number, it is a full install. Like I said i have purchased this software, but have used my 5 install limit.

Why do I say it's a crippled demo?

First, the observations about the program.

The installer pretty much keeps everything in the program directory. While the app uses DLLs, pretty much everything it uses is either off the parent directory, or part of the base install of windows. There don't appear to be any hidden files stored elsewhere.

The DLLs fall into two categories, RealProducer (by Real) and a USB driver. None of the DLLs are encrypted, and it's pretty easy to see by looking at them that they won't secretly embed code into our application should we successfully talk to a web site.

Now on to the EXE...

The exe is a regular VC++/MFC application. There are no packers or encryptors, all the text an resources are plain text, there is NO anti-debugger code, no anti-tracing code, and no anti-disasm code. The only thing even remotely tricky is a check to ensure the user isn't running on a 80486. (uses the pushf/pop eax trick).

Yes, it has TCP/IP code. But if place a break point on EVERY import, you'll see they don't fire. This can be explained by the fact that the only references are the MFC socket library calls, and the MFC references aren't referenced. (god, that was a bad sentance!).

For every string that mentions the word "demo version", there is no corosponding "real version" string. Right clicking on the EXE and going to properties yeilds the words "special build".

About the only thing thats even slightly deceiving is an error that pops up saying "Error 421 - Trouble initializing Sound Card - check drivers". That message pops up if it you don't bypass the serial check fully. But it's kind of obvious, EVERY other driver error was in UNICODE, while this one was in ASCII. Duh!!!

OK, a little more on that error. In addition to the place I mentioned above, that error is called all over the place if a function that ALWAYS returns 1 returns 0. This function is a "registered" function that ISN'T in our demo, it's just a stub so they wouldn't have to change a bunch of code.

The code won't even load the website URL unless the license key is valid.

Another thing to consider is the only calls to LoadLibrary are for DLLs we know about. There is no way to "add on an additional DLL" that has all the real code in it.

It is my opionion that this is a crippled demo. I belive, at best, the we site will download the REAL version to you, after you provide a key that looks suspiciously like a credit card number.

Again, just my opinion.

As far as getting it to be a little less crippled, the date checks and checks to see how many samples you have loaded and whether it's allowed to load them, well, those all seem fairly trivial. But, IMHO, the only way to get it to say "thanks for registering" is to write that code yourself.
sgdt
02-29-2004, 07:57 PM
OK, I know I may have came off harsh, and for that I appologize.

I realize the company screwed you on the 5 install thing. Protections are really bad for the end user, and sometimes they can even frustrate the technical folk as well.

Anyway, I just googled the program, and it's up on eDonkey. It's about a meg larger than the other one, but I don't think you wan't to write those code yourself (albeit it would be a learning experiance).

Anyway, it's at

Companyname.Productname.By.PeTeRPan.zip
hash c0f3b41340000961c4a9454dee3b0884
tamaño 7.75 MB. ( 8129142 bytes)

Replace Companyname and Productname with the companies name and product name.

It just finished downloading as I type this, so if you don't want to mess with the Donkey, let me know how I can send it (does your FTP support uploads?)

[edit] 8MB for nothing. They did the samething (well, actually they only changed 66FDD). It was a "patch" that was the full executable for a one byte change... Goodthing Bandwidth is free even if disk space isn't...
DaddyJTHC
02-29-2004, 08:26 PM
Anyway, I just googled the program, and it's up on eDonkey. It's about a meg larger than the other one, but I don't think you wan't to write those code yourself (albeit it would be a learning experiance).

I hate to be a pain, i know this program is available, but it doesnt work, the crack makes the software produce the Sound card error 421. Which you mentioned earlier.

There is NO KNOWN WORKING copy of this software. I told you i have owned this. and as far as program downloading the orginal, that is false, it cannot possiblly download a program that fast, as soon as you enter your key, it is running.

A note. I still have this program installed on one computer, and am not going to format, im running regmon, and determining the differnece in registry calls. Im figuring it has to be in there.
IF REGKEYVALUE=REAL then run else INVALIDKEY

blah blah blah

I do thank you for all input thou.

Also i can give you the Serial number for it if that helps.
it is stored in the registry also.
DaddyJTHC
02-29-2004, 11:05 PM
Ok heres whut I have gathered. When you install the software, it access the file VISE_Key_Validator.dll in C:\Documents and Settings\UserName\Local Settings\Temp\{67e6a1f1-77cb-4c00-b113-c9cfa6d35bcd} under WinXP.

is there any way to show the values of the ASM registries while the program is running?
dELTA
03-02-2004, 12:42 PM
is there any way to show the values of the ASM registries while the program is running?

Exactly what do you mean with this? The contents of the registers change between (practically) every instruction. To find out the value of them at a specific position in the code, set a breakpoint at this position and then read the contents of the registers from the debugger window when this breakpoint hits.


r!sc process patcher and aspr ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > r!sc process patcher and aspr ??
PDA

View Full Version : r!sc process patcher and aspr ??

johndoe1
02-29-2004, 01:48 PM
hi,

i tried to look this question up, but i didn't find it yet.

i want to patch an aspr protected app

because of the crc checking of the packed exe
i decided to try to create a loader using r!sc process patcher

in a tutor from r!sc process patcher it says

----------------
first patch, aspr protection checks the byte @ 57d31b, if its 0, it
calls createprocess, and uses writesprocessmemory to put a '2' @ that
rva, so it knows it has re-created itself, thus voiding any loader
handles, and calls exitprocess, to let the new one run..
------------------
i think this '@ 57d31b' is different on various versions of aspr

but.. now my problem

this aspr has a anti loader feature that works not at the same RVA

I mean if i have a loader start the packed exe.. the exe creates a new thread
starting itself again thus avoiding the loader...

how can i bypass that ???

how can i find out which RVA to processmemorywrite ??

grtz, JohnDoe1


Bypassing Debug Registers Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Bypassing Debug Registers Protection
PDA

View Full Version : Bypassing Debug Registers Protection

Opcode
02-29-2004, 08:37 PM
I wrote an article that involves a new method to bypass Debug Register protections, in the particular case, a rootkit detector named PatchFinder.
Maybe the method can be useful to someone.

The article:
http://packetstormsecurity.org/filedesc/bypassEPA.pdf.html

Regards,
Opcode
volodya
03-01-2004, 12:12 PM
The idea is funny. Definitely worth thinking around :D
Opcode
03-01-2004, 12:53 PM
The idea is funny. Definitely worth thinking around :D

Why the idea is funny?
Can you teach us another method to bypass a doubleword memory position read-write protected by an Debug Register and the GD flag in DR7 actived? :D

I'll really apreciate your answer, volodya. :p

P.S.: Did you readed the PatchFinder2 source code ?
volodya
03-01-2004, 01:32 PM
Irony is the mighty thing my friend :D
The answer will be - it depends on who is the first on int1.
Anyway, the idea is interesting and I'm going to thoroughly investigate the sources of Joanna's tool, so thank you again :p
Opcode
03-01-2004, 01:51 PM
The answer will be - it depends on who is the first on int1.

That's the whole point of my article.
Its obvious that is the Rooktit Detector the first on int1.

I expect to soon publish the first undetectable rootkit by PatchFinder.

Regards,
Opcode
mmk
03-01-2004, 07:45 PM
Opcode I read your article to circumvent the simple Debug Register protection. There are many ways to write to the IDT. You could write all 8 bytes to IDT[1] at once (use CMPXCHG8B) and then you'll get a debug breakpoint due to the write breakpoint @ IDT[1]. Of course, you were smart enough to write your handler to IDT[1] so you'll now get control. Now you have control of the debug registers.

Or you could setup your own IDT, install your own INT1 handler, generate a debug breakpoint, and your handler now has control of the debug registers. From here, restore original IDTR and do whatever you wish with the debug regs.

The protection they use is lame. Obviously they don't know much about the Intel architecture. :D

Happy rootkitting ;)
Opcode
03-01-2004, 09:37 PM
There are many ways to write to the IDT. You could write all 8 bytes to IDT[1] at once (use CMPXCHG8B) and then you'll get a debug breakpoint due to the write breakpoint @ IDT[1].

Hi, mmk.
Thanx for reading my article. :D
I never used the CMPXCHG8B instruction, but currect me if I'm wrong:

1. The PatchFinder utility, once installed protect with DR0 and DR1 all the 8 bytes of IDT[1] (write protection).
2. It enable the GD bit in DR7. If any driver
attemp to access any DRx register, the PatchFinder will see it.

So, if I try to use CMPXCHG8B in the IDT[1], I think that I'll don't
work because this will trigger the DR0 and DR1! Do you agree?

Look in the driver.c source code of PatchFinder the following:

#ifdef DR_PROTECTION
KdPrint (("pf: setting hardware protection...\n"));

dbProtect (DB_DR0, (int)getIntGateAddr(NT_DEBUG_INT), DB_LEN_4B, DB_PROT_WRITE);
dbProtect (DB_DR1, (int)getIntGateAddr(NT_DEBUG_INT)+4, DB_LEN_4B, DB_PROT_WRITE);
dbProtect (DB_DR2, (int)NewDebugHandler1, DB_LEN_4B, DB_PROT_RW);
dbSetGeneralProtection ();
#endif
volodya
03-01-2004, 09:48 PM
Opcode, consider another idea. We are in the multi-process system! Each and every task (including your so-loved drivers) gets the quantums of time from the OS-scheduler. What prevents one from disconnecting the driver from the scheduler, ah?
Opcode
03-01-2004, 09:59 PM
Opcode, consider another idea. We are in the multi-process system! Each and every task (including your so-loved drivers) gets the quantums of time from the OS-scheduler. What prevents one from disconnecting the driver from the scheduler, ah?

Hi, volodya

If you read the book "Inside Windows 2000" you will see that the
scheduler is in deep controlled by 3 structures:

- KiDispatcherReadyListHead
- KiWaitInListHead
- KiWaitOutListHead

So, I can hook/change this structures and I can intercept any access to it.
But, suppose that such "disconnector" driver exists. What parameters
shold this driver use to find what is the correct driver to disconnect from
the scheduler. Heuristics??? Binary pattern search??? Come on!!!

The objective of my research is show that there is no safe way to protect
a system against rootkit technology, because the kernel structure of
Windows is poorly architected in the security point-of-view.
The IPD was a good idea, but fail.

Regards,
Opcode

P.S.: I don´t really like drivers, I like ring zero programming :D
sgdt
03-01-2004, 10:39 PM
Ring 0 is definitely fun. Drivers can be fun too. Using the "standard" way of getting ring 0 (drivers) isn't as boring as you make it out to be, there is still plenty of fun to be had.

As you can probably guess from my user name (sgdt), I too enjoy other ways of getting to ring 0... :)
mmk
03-01-2004, 11:14 PM
1. The PatchFinder utility, once installed protect with DR0 and DR1 all the 8 bytes of IDT[1] (write protection).

The IDT is still writable (I assume PatchFinder doesn't write-protect it; it only sets two DWORD write BPs at IDT[1]). The debug breakpoint exception occurs only AFTER the write has occured. Thus, if you write a new IDT[1] entry with the CMPXCHG8B instruction, it will be your debug handler that will be called and not whatever was there before the write.

2. It enable the GD bit in DR7. If any driver
attemp to access any DRx register, the PatchFinder will see it.

You don't need to use the debug registers.

So, if I try to use CMPXCHG8B in the IDT[1], I think that I'll don't
work because this will trigger the DR0 and DR1! Do you agree?

You will get a debug breakpoint, but since you wrote your handler to IDT[1], you will get control, and not PatchFinder. Remember that for data breakpoints, the debug breakpoint exception is generated AFTER the read or write to the address with the breakpoint. Execution breakpoints are different since they occur BEFORE an instruction is executed.

I checked the Intel manual and CMPXCHG8B might not be so good because you'd have to know the value of IDT[1]. But you could use MMX instructions to write to it though, eg. MOVQ [esi+8],MM0 (esi=idt).

Another way to get control is to create your own temp IDT and generate a debug exception.

cli
lidt my_idtr
icebp ; DB 0F1h

...
my_idtr:
dw 0Fh
dd linear addr of temp idt

temp idt:
dd ?,?
dd x,y ; your INT1 descriptor here

Whenever a debug exception is generated, the processor clears the DR7.GD bit and sets some DR6 bits. Before returning, you would want to set DR7.GD again, clear some bits in DR6 that got set due to the debug exception, and restore the old IDTR.

There are other ways of detecting extra CPU cycles from rootkits. Here are a few:

* Use RDTSC to count processor clock cycles
* Use some performance monitoring MSRs to read processor-specific counters. Check the Intel/AMD manuals for processor specific MSRs. There are lots of them that can be used.

Expect future "rootkit detectors" to use these techniques. But remember that you can also stop these MSRs. :D
Kayaker
03-02-2004, 12:56 AM
Hi

There's a lot of interesting systems information coming out of this rootkit stuff, including the BlackHat papers and SANS conference publications by Hoglund, Rutkowska, etc. Getting a deeper understanding of it all is definitely on my to-do list.

Opcode's interesting article and Volodya's comment on multiprocessor systems allows me to ask a question I've been wondering about for a while. As I recall, each processor sets up its own IVT and when switching from real->protected mode for the first time makes a copy of it with LIDT as an IDT. I was playing with some old IDT hooking code on my new multiprocessor system when I noticed that the SIDT command would somewhat randomly retrieve either IDT table address, depending it seemed on which processor was currently active.

The second 'processor' is an Intel ICH5R South bridge controller chip that supposedly integrates various I/O functions associated with IDE, APIC, USB, PCI functions etc. I assume the system flip flops from this subsytem processor to the main 82865PE chip as required.

I noticed this behaviour because in my original code (written on an older single processor system), I used the SIDT command to retrieve the IDT in both my hooking AND unhooking code. i.e. I didn't save the "original" address of the IDT that I hooked for later unhooking, instead just blindly assumed SIDT would retrieve the same address. On my new 2 processor system this would sometimes fail and I would end up unhooking a different IDT table than which I orginally hooked. If I used the Softice IDT command at the time, it too would confirm that either one or the other IDT table addresses was active.

So my point/question then is, Opcode's code also uses the SIDT command (as does most generic IDT hooking code), but is it possible that it might retrieve the address of one of multiple IDT tables? Or does it matter and this is of no concern?

On my Win2K system the "main" IDT is at 80036400, which I believe is what most people have. The second IDT is an almost duplicate at 820A57E8. I say 'almost' because INT1 and INT3 have slightly different addresses when Softice is loaded, but they do lead to the same interrupt handler in Compuware's cpthook.sys driver.

If one were to do a byte search in memory for one of the interrupt addresses listed in the main IDT, one could probably find this second duplicate IDT (assuming you have a 2-processor system). As an example, here are the beginning of my 2 IDT's as listed by Sven Schreiber's w2k_spy:

Main processor IDT:
80036400..800364FF: 256 valid bytes

Address | 0000 0002-0004 0006 : 0008 000A-000C 000E | 00 02 04 06 08 0A 0C 0E
---------|---------------------:---------------------|------------------------
80036400 | 6CF0 0008-8E00 8046 : 7729 0008-EE00 B3A8 | l= .. ?. ?F w) .. e. ¦¿
80036410 | 7747 0008-8E00 B3A8 : 7765 0008-EE00 B3A8 | wG .. ?. ¦¿ we .. e. ¦¿
80036420 | 7284 0008-EE00 8046 : 73C8 0008-8E00 8046 | r? .. e. ?F s+ .. ?. ?F
...

Subsystem processor IDT (so it seems):
820A57E8..820A58E7: 256 valid bytes

Address | 0008 000A-000C 000E : 0010 0012-0014 0016 | 08 0A 0C 0E 10 12 14 16
---------|---------------------:---------------------|------------------------
820A57E8 | 6CF0 0008-8E00 8046 : 7738 0008-EE00 B3A8 | l= .. ?. ?F w8 .. e. ¦¿
820A57F8 | 7756 0008-8E00 B3A8 : 7774 0008-EE00 B3A8 | wV .. ?. ¦¿ wt .. e. ¦¿
820A5808 | 7284 0008-EE00 8046 : 73C8 0008-8E00 8046 | r? .. e. ?F s+ .. ?. ?F
...

Anyway, I just wanted to bring up this multiple IDT situation and wonder how it fits in to any rootkit scenario where IDT patching is involved.

Cheers,
Kayaker
mmk
03-02-2004, 01:35 AM
1. I hope you're tired Kayaker because your "Intel ICH5R SB" cannot execute x86 code, or any code for that matter. :D

2. If you have more than one logical (hyperthreading) or physical processor, you will have more than one IDT. Each processor has its own IDTR register and thus it must be initialized. It can be the same value between different processors but I guess MS has a reason for not doing that.

3. The OS switches tasks, but a rootkit is part of the OS and can easily disable interrupts. That's why my example code used "cli" before switching to the temp IDT or an interrupt could've occured afterwards leading to a CPU reset.
Opcode
03-02-2004, 07:56 AM
Hi, Kayaker and mmk.

Unfortunately, I dont have access to a multiprocessor system, so multiple IDT is new for me. :( I expect to have access to one asap.

mmk, are you sure that

The debug breakpoint exception occurs only AFTER the write has occured. :confused:

The #DB (Debug Exception) is a fault or trap ???

Faults
A fault is an exception that can generally be corrected and that, once corrected,
allows the program to be restarted with no loss of continuity. When a fault is
reported, the processor restores the machine state to the state prior to the beginning
of execution of the faulting instruction. The return address (saved contents
of the CS and EIP registers) for the fault handler points to the faulting instruction,
rather than the instruction following the faulting instruction.

Traps
A trap is an exception that is reported immediately following the execution of
the trapping instruction. Traps allow execution of a program or task to be
continued without loss of program continuity. The return address for the trap
handler points to the instruction to be executed after the trapping instruction.
Opcode
03-02-2004, 08:03 AM
Look at the Intel® Architecture Software Developer’s Manual
Volume 3:

15.3.1. Debug Exception (#DB)—Interrupt Vector 1
The debug-exception handler is usually a debugger program or is part of a larger software
system. The processor generates a debug exception for any of several conditions. The debugger
can check flags in the DR6 and DR7 registers to determine which condition caused the exception
and which other conditions might also apply. Table 15-2 shows the states of these flags
following the generation of each kind of breakpoint condition.
Instruction-breakpoint and general-detect conditions (see Section 15.3.1.3., “General-Detect
Exception Condition”) result in faults; other debug-exception conditions result in traps. The
debug exception may report either or both at one time. The following sections describe each
class of debug exception. See Chapter 5, “Interrupt 1—Debug Exception (#DB)”, for additional
information about this exception.
mmk
03-02-2004, 10:31 AM
#DB is both a fault and a trap. It depends on what triggered it.

faults: IBPs and DR7.GD #DBs
traps: DBPs, EFLAGS.TF, and the rest

Just do what I described in my previous posts and you will control the debug regs.
Opcode
03-02-2004, 11:55 AM
Just do what I described in my previous posts and you will control the debug regs.

I'm writing a driver to test what you'd said. :D
volodya
03-02-2004, 01:39 PM
I'm a little bit shocked :rolleyes: He told you the truth... It is a trap. But how come? Are the intel guys idiots? So, GD is nothing?
mmk
03-02-2004, 03:56 PM
DR7.GD=1 causes a #DB fault exception.

A data breakpoint is a trap. That's why you can write your IDT handler to IDT[1] and get control next time #DB is triggered. In the PatchFinder example, it would be triggered right after you write to IDT[1].

To Opcode, I'd recommend using your own temp IDT instead of using MMX registers to write to the IDT since you would otherwise change the FPU/MMX registers and other FPU/MMX state which the user process may be using.

; some init func
mov eax,offset int1_handler
mov my_idt+8,eax
mov my_idt+8+4,eax
mov word ptr my_idt+8+2,cs
mov word ptr my_idt+8+4,8E00h ; 32-bit int gate

; some anti-patchfinder rootkit code
pushfd
cli
sub esp,8
sidt [esp+2]
lidt new_idtr
db 0F1h ; icebp => triggers #DB
jmp skip
int1_handler:
lidt [esp+3*4+2] ; 3*4 = pushed eflags,cs,eip
; you may have to restore old (pushed) EFLAGS.IF here
call do_whatever ; rootkit code ;)
mov eax,dr6
and eax,not (1 shl ???) ; clear bit that got set due to icebp instruction
mov dr6,eax
mov eax,dr7
or eax,1 shl 13 ; set dr7.gd
mov dr7,eax ; only do this if dr7.gd was set by eg. patchfinder
iretd
skip:
add esp,8
popfd

...
new_idtr label fword
dw 8*2-1
dd offset my_idt
my_idt dd ?,?
dd ?,?

That code is untested so there may be a mistake or two. :D
Opcode
03-02-2004, 05:06 PM
Thanx, mmk

I'll test your code.
I hope to finish the driver tomorrow.

Is really nice to find people to share knowledge. :D
Kayaker
03-03-2004, 07:11 AM
If you have more than one logical (hyperthreading) or physical processor, you will have more than one IDT.

Right you are. If I turn off Hyperthreading in the bios the second IDT disappears and the number of active processors reported on my system (say with ZwQuerySystemInformation / class SystemBasicInformation) drops from 2 to 1. Reading the Intel docs on hyperthreading was illuminating, one physical processor appears as two logical processors and each maintains a complete set of the architecture state including most of the registers.

I wasn't under the illusion the subprocessor was executing any user code, just that it was the 2nd processor reported (physical) and was in some way the cause of the extra IDT table. What bothered me with that though was that I had d/l the specs for the chip and didn't see an IDTR register. I'm glad that hyperthreading provides a "logical" explanation ;)

Kayaker
Opcode
03-04-2004, 09:11 AM
Yes, it works !!! Tanx, mmk. :D

Now I'll dedicate to find some another way to hide process to
avoid Klister (www.rootkit.com) detection. :cool:

Regards,
Opcode
volodya
03-05-2004, 06:03 PM
M-m-m, it has been already done. 90210/WASM.RU has written the utility that works directly with EPROCESS and avoids Klister's detection. Your previous article is much-much more interesting thing.
Opcode
03-05-2004, 11:01 PM
M-m-m, it has been already done. FatMoon/WASM.RU has written the utility that works directly with EPROCESS and avoids Klister's detection. Your previous article is much-much more interesting thing.

Hi, volodya.
Can you send me a copy of the text/article/code, because I can´t
actually access the wasm.ru site. It's always offline for me. :(

But I can´t believe in just manipulation of EPROCESS, because the list that the Dispatcher uses points to a linked list of ETHREADS structs.
Well, but if you said, I believe :D

I'm waiting for the article, thanx a lot !!!
evaluator
03-07-2004, 05:52 AM
hi here.

little comment:

mmk wrote in source

"clear bit that got set due to icebp instruction"
F1h-Icebp should NOT modify DR6. OK (or not to OK)?

new IDT+LIDT is good method here.
mmk
03-07-2004, 06:17 AM
mmk wrote in source

"clear bit that got set due to icebp instruction"
F1h-Icebp should NOT modify DR6. OK (or not to OK)?

Each time #DB is triggered the CPU should update DR6. I don't remember if ICEBP will set a flag in DR6, but if it does, I think it sets the same flag as EFLAGS.TF=1 #DBs do.
volodya
03-07-2004, 06:44 PM
Can you send me a copy of the text/article/code, because I can´t
actually access the wasm.ru site. It's always offline for me.

http://29a.host.sk/main.html -->

29a7\Binaries\90210\PHIDE.ZIP
29a7\Utilities\29A-7.026

You go get it :D
tgodd
03-08-2004, 12:57 AM
So now propose what you are going to do in the event that the application clears the GD flag.
How are you to trap that?

Good luck....

TGODD
mmk
03-08-2004, 04:31 AM
So now propose what you are going to do in the event that the application clears the GD flag.
How are you to trap that?

Good luck....

TGODD

Which app? Rootkit or anti-rootkit?

anti-rootkit: DR7.GD cleared => probably rootkit present.
rootkit: always restores DR7.GD to its original state
evaluator
03-08-2004, 05:16 AM
mmk,

don't say: "I think.."

always test your ideas.
& Icebp works like 0CCh(e.g. INT-call).
mmk
03-08-2004, 06:39 AM
mmk,

don't say: "I think.."

always test your ideas.
& Icebp works like 0CCh(e.g. INT-call).

don't say: "always test your ideas." unless you have "tested your ideas" yourself. :D

ICEBP, like any other #DB will update DR6. When I said "I think", it was because I remember it changing something but didn't remember what. I checked some old notes and DR6.B[3:0] is updated.

So you're wrong in saying that ICEBP is like INT3 (#BP). INT3 doesn't update DR6. ICEBP does.
tgodd
03-08-2004, 07:26 AM
The hardlock driver by alladin clears the GD flag.
I am not familiar with the rootkit, all of my code is
written by following the intel docs.

The GD bit is not trapped, nor, as far as I can read
from the intel docs, is there a way to trap if the GD
bit gets manipulated.

tgodd
evaluator
03-08-2004, 03:30 PM
ok, i done some tests from Ring3, & seems F1 updates B0-B3 bits in DR6 register.
so F1 can't be treated as INT-call.
so i was wrong.

Thanks
Opcode
03-09-2004, 06:22 AM
Hi, volodya

PHIDE was a nice try, conecting the PID and EPROCESS to another process was original. But look at:

www.rootkit.com - "Cheating klister?"

Regards,
Opcode
evaluator
03-09-2004, 03:38 PM
i want write 1 note here

while set-up-ing new IDT,
there IS the way to Read/Write in memory WITHOUT triggering active DRx.

**
"That is.." - said Intlel
volodya
03-09-2004, 07:25 PM
evaluator
there IS the way to Read/Write in memory WITHOUT triggering active DRx

Do you mean the original article? Via physical memory?
evaluator
03-10-2004, 02:07 AM
yes, i mean via phisical memory.
what is "original article"?
mmk
03-10-2004, 03:23 AM
Original article = original post made by Opcode in this thread.

When paging is enabled, you can't use physical addresses; all addresses are linear addresses. What you and Opcode have done is map the same physical address to different linear addresses. This is nothing special at all, but of course it can be used to fool programs such as PatchFinder.
evaluator
03-10-2004, 03:52 AM
heh, heck me, i did not read this article, because of its title.

here i want to write some notes for author:

1.
>we found the PHYSICAL address of 0x8003F408 to be 0x03F00
maybe 0x0003F000 ?(1 more zero)
>(value obtained experimentally).
why so? you simple can grab it from PAGE TABLE.
& after also simply put it in new place of PAGE TABLE.

2.
>invoke ExAllocatePool
easier is MmAllocateNonCachedMemory

3. Why you need to disable WP at all?

4. after updating PAGE TABLE, will good WBINVD, etc.

5.>Once time in Ring Zero, forever Ring Zero.
for this Intl created 4 rings..
Opcode
03-10-2004, 06:30 AM
1.
>we found the PHYSICAL address of 0x8003F408 to be 0x03F00
maybe 0x0003F000 ?(1 more zero)

Yes, one more zero (error in typing) :D

>(value obtained experimentally).
why so? you simple can grab it from PAGE TABLE.
& after also simply put it in new place of PAGE TABLE.

value obtained experimentally means just a supposition.
I get the value from PAGE TABLE.

2.
>invoke ExAllocatePool
easier is MmAllocateNonCachedMemory

Yes, but is just a proof-of-concept, just to show how-to.
Thanx for the hint.

3. Why you need to disable WP at all?

Some memory areas of XP are SUPERVISOR level, but for READING-ONLY,
then, just for precaution, I use this. (P.O.C)
Read www.wiretapped.net/~fyre/sst.html

4. after updating PAGE TABLE, will good WBINVD, etc.

Another good hint :D

5.>Once time in Ring Zero, forever Ring Zero.
for this Intl created 4 rings..
In this point, I'm refering to the Ring-0 war between softwares.
The rootkit versus detector. Another rings are useless in this
'war'. It´s not possible to defeat rootkits attacks without ring-0.

I'm still waiting the Joanna response. After she does, I'll make
a more depurated tool. :cool:

Regards,
Opcode
mmk
03-10-2004, 07:08 AM
invlpg [mem] or reloading of cr3 (mov eax,cr3 / mov cr3,eax) is the preferred and documented way of flushing the TLBs. wbinvd may work, but it's not documented to flush TLBs (if it does do that in some processors). wbinvd is used for the data caches. It Writes Back and INValiDates the data in the data caches.
evaluator
03-10-2004, 08:55 AM
>Some memory areas of XP are SUPERVISOR level, but for READING-ONLY,
>then, just for precaution, I use this.

Nop, WP not helps you here. (re-read manual).
For this case only way is to check & set R/W in PTE.
mmk
03-10-2004, 09:05 AM
Nop, WP not helps you here. (re-read manual).
For this case only way is to check & set R/W in PTE.

Read the Intel manual (or test yourself :D ). Check Table 4.2 where it says the supervisor (non-ring3 code) always can write to any present page no matter what the page tables say so long as CR0.WP=0. If CR0.WP=1 the processor will check the page tables even for supervisor writes.
evaluator
03-10-2004, 11:50 AM
in chapter 2.5 done main description of WP flag.

Now i read in 4.11.3

>When the processor is in supervisor mode and the WP flag in register CR0 is clear
>all pages are both readable and writable.

this absolutely another BTW(?)-future of WP flag not explained in main description.

again, Thanks me for reading that + Sorry me from Intl.


newbie serial fishing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > newbie serial fishing
PDA

View Full Version : newbie serial fishing

buf
03-01-2004, 06:42 AM
Hi all

I just recently started reversing (although I think that's an expensive word for what I really do), and have done only disassembler approaches (dead listings). I thought it was easy enough to reverse some jumps and make the progs think they were registered. Now I was thinking about trying some serial fishing. Judging from the tutorials and posts I read, it seemed simple enough and it was a way to progress from just the jump reversing.
So I got myself a file, since it could be useful to the work too, and tried to fish it.
Just so you now (and if you want to see the code, cause I don't have it here - I'm writing from work), the program is Target Name and Addy Removed So, I disassembled it, and found the famous GetWindowTextA. And then I made myself debug it (I used OllyDbg), set a breakpoint on GetWindowTextA and the program stopped there when I tried to register.
As far as I could understand, the first time it stopped was to get my username. So far, so good. It gets the user, and starts making call after call inside call, and then I get lost. I managed to see that the prog was converting each letter of the user to hex, but not its real value in hex, instead something xored.
The prog does something similar with the serial, but I can't seem to follow the logic.
I've been around it for two weeks and with no success. Can't find the compare to the real serial, can't find an error message no reverse the jump (exescope shows a window of "Registration Failed", but I never get to see it), can't find the correct serial in memory although I have traced into ALL the calls and have been watching the stack and dump windows os OllyDbg...
I used fileinspectorXL to see if it was packed, and it says it's packed with Shrinker 3.2, but DeShrink says otherwise.
I would be really thankfull if anyone could point me in the right direction.

Oh, by the way, I'm not asking for a serial or crack, just some tips. I'm sorry I can't paste de code here, but it would be too large anyway, cause I don't understand most of it. I tried to avoid posting stupid questions, but I have nothing but stupid questions.

Sorry for the long post, just trying to make it clear for everyone. Excuse my english.
Thanks all.
Harding
03-01-2004, 06:45 AM
First of all: Remove the name of the program.
Second: Try some simple crackmes first. Try hxxp://www.crackmes.de
buf
03-01-2004, 07:03 AM
boy, talk about fast moderation/answering! :)

I'm sorry for the references I made to the program, but I see it's been taken care of.
Anyway, I think I'll follow that crackmes advice... better to start from the beginning and have a learning curve less abrupt than I'm having.
Thanks.
naides
03-01-2004, 07:31 AM
boy, talk about fast moderation/answering! :)

I'm sorry for the references I made to the program, but I see it's been taken care of.
Anyway, I think I'll follow that crackmes advice... better to start from the beginning and have a learning curve less abrupt than I'm having.
Thanks.

Now a days, very few programs construct or hold the 'real' serial in memory and do a daylight, direct comparison with your fake serial. It is just to easy to track, by placing breakpoints into compare_string like APIs.
Based in what you describe, your target was calculating a hash of the fake serial and comparing it to a hash for what it was suppossed to be.
Hashes are more or less irreversible transformations, in which given the serial is straightforward to obtain the hash, but the oposite operation, given the hash, it is complicated or impossible to extract the serial.
buf
03-01-2004, 09:53 AM
strangely enough, I think I understood your explanation ;)
So, if I could (cause I can't) recreate the process of making the hash and reverse it, considering the hypothetical situation in which I could determine where it creates the hash for the REAL serial, I would then obtain the serial number...
I really enjoyed writing all these expensive terms... hope I'll someday be able to make it happen...
This target needs serious reversing, thank you for explaining.
dELTA
03-02-2004, 12:52 PM
Based in what you describe, your target was calculating a hash of the fake serial and comparing it to a hash for what it was suppossed to be.
This does not increase the security, since the real serial obviously needs to be present in memory at some point if a hash is calculated from it (unless of course valid serials are not dynamically calculated, but instead only picked from a limited pool of static serials, in which case the static hashes of the valid serials could be stored in the program directly, thus limiting the possibilities of extracting a valid serial from the program, but since this "static pool" of serials would in turn introduce a big security hole itself I really wouldn't recommend it anyway :)).
naides
03-02-2004, 01:54 PM
This does not increase the security, since the real serial obviously needs to be present in memory at some point if a hash is calculated from it (unless of course valid serials are not dynamically calculated, but instead only picked from a limited pool of static serials, in which case the static hashes of the valid serials could be stored in the program directly, thus limiting the possibilities of extracting a valid serial from the program, but since this "static pool" of serials would in turn introduce a big security hole itself I really wouldn't recommend it anyway :)).

The 'Hash' of the real serial does not need to be calculated from a hard copy of a serial, it may be derived from your user name, hard-disk serial, a security code some other defined variable or combinations there of.
dELTA
03-02-2004, 02:14 PM
And in exactly what way would it then be related to the "hash" that you are comparing to the "hash of the real serial"? Sounds to me like you're back to describing a normal serial again. :rolleyes: Remember that it is implied in the term "hash" that you should not be able to easily derive two different datasets that have equal hashes, and that applies to shareware authors too. :D
naides
03-02-2004, 05:35 PM
Guess I was using the term hash too loosely, but I think buf got the idea.
buf
03-03-2004, 06:33 AM
you're right, I did get the idea...
meanwhile, I registered at crackmes.de and already cracked 2 crackmes AND without patching, both serial fishing... hope I'll get good at it, eventually.
By the way, from what dELTA said, about the serial having to be stored somewhere in memory, I read something about a "point h", which is equal to HMEMCPY but for XP. Can any of you try to explain me how to find that "point h"? or this question too lame and I should be severely spanked?
And another thing... kind of off topic from the serial fishing issue, but related to the software I was trying to reverse: how can I determine if the file is packed and which packer was used?
thanks in advance.
dELTA
03-03-2004, 07:57 AM
You can use PEiD to determine which packer is being used.
buf
03-03-2004, 09:36 AM
thank you, i'll get that PEiD now. I used FileInspectorXL once, but the result was totally wrong, so I don't trust it.
as for the "point h" bit, any tip?
thanks


removing "server check"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > removing "server check"
PDA

View Full Version : removing "server check"

boron
03-01-2004, 10:16 AM
hi all
I have a software that has somekind of a "server check" every time that i activate the software it connects to a server on the web and check its database the serial and username ,if not found it deactivates my software.

how can i remove the "sever check"?
sgdt
03-01-2004, 10:29 AM
Well, for experimenting with it, you could always add their website to your hosts file, and fire up a web server... (find he name of the site, add it to your \winnt\drivers\hosts file pointing to 127.0.0.1, run IIS or Apache or PWS or YouGetTheIdea, set up a page that says HeGotzPermision).

Alternatively, you could set a break on TCP/IP calls and CreateProcess calls, find where they are connecting, and force it to return good. This approach is nicer because you don't have a web server to maintain, but it depends on what you are more familiar with: FrontPage or HexWorkshop.
Aimless
03-01-2004, 11:56 PM
But the best way, is to download the crack for CuteFTP (as CuteFTP does the same, serial number checked on the server, not user machine), and see how that is bypassed.

Have Phun
boron
03-05-2004, 06:47 AM
thanks

i tried with hex workshop and ifound out where it connects to and then i just changed the server address and it can't connect any more.
cRk
03-05-2004, 03:21 PM
thanks

i tried with hex workshop and ifound out where it connects to and then i just changed the server address and it can't connect any more.

check apis that softwares uses to stablish connections..

Wininet , Wsock32 ........ ;)

Regards


Tages defeated
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Tages defeated
PDA

View Full Version : Tages defeated

disavowed
03-01-2004, 04:18 PM
Nice technical article:

http://www.cdfreaks.com/article/136
dELTA
03-02-2004, 01:35 PM
Very nice (it even has an +ORC quote in it)! :)

I'd really like to see more people posting quality links like this. So please everyone, if you see any good articles (or other types of resources) about reversing/cracking/low-level stuff like this anywhere, please don't hesitate to share them with the rest of us by posting them here (if in doubt, simply use the off-topic forum)!


A newbie question.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A newbie question.
PDA

View Full Version : A newbie question.

DaddyJTHC
03-01-2004, 11:22 PM
Hi, I have this software, and it goes to a website for serial number verfication. My question, is how can i see what site it goes to???
or what data is passed to the website..??? is there any way to monitor this??

Please reply-

Also i have a WinDasm Question.
When is shows this

* Possible StringData Ref from Data Obj - >"www.some.com"
|
:10001E68 mov edi, 10018258

where is this, i need to edit the www.some.com but i dont know where, can anyone help please.
Solomon
03-01-2004, 11:41 PM
I think any sniffer can do this job.
You can try Ethereal. It's free.
hxxp://www.ethereal.com/download.html

Hi, I have this software, and it goes to a website for serial number verfication. My question, is how can i see what site it goes to???
or what data is passed to the website..??? is there any way to monitor this??

Please reply-
DaddyJTHC
03-01-2004, 11:42 PM
I think any sniffer can do this job.
You can try Ethereal. It's free.
hxxp://www.ethereal.com/download.html

thank you very much..
naides
03-02-2004, 05:30 AM
Also i have a WinDasm Question.
When is shows this

* Possible StringData Ref from Data Obj - >"www.some.com"
|
:10001E68 mov edi, 10018258

where is this, i need to edit the www.some.com but i dont know where, can anyone help please.

It is referring to a string resource. You can check the STRINGS options in WinDasm main menu.
You can change it with a HEX editor, after you search for it, or with a resource editor. The Golden rules are: the new string you put in there should be shorter, or at most, the same length as the one before. You need to end it with a null character. Consider the posibility of the string being in unicode format. HexWorkshop can search and manipulate Unicode Strings.


CRC Check Trick
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > CRC Check Trick
PDA

View Full Version : CRC Check Trick

cRk
03-03-2004, 12:02 AM
i have searched alot and saw many good info. about CRC's . but haven't found , actually , the info. i'm curious to know ;) neither any tutos about this.
i saw someday some ARmadillo (2.5) Patcher MAde by GlobAl that makes the patched exes read the crc check from original one actually a .bak of the same file that the patcher created

also one day saw/used a patch for FlaX that used the same method ... i tried FlaX before and has a really strong crc check... the author of this patch used a very intelligent smart way as well againts crc checks . he made the patched exe to read the crc check from a backup made by the same patch
i noted this because when i deleted the backup then again the program was not working and crc check was activated!

by that time i was more newbie than now and couldn't check how this work , now i lost those files ... and haven't found any info about this yet .... i believe this is the place to meet specialist + reversers so my cuestion should be responded , one day or another , in here i guess.

How this patching method works againts crc check?

How to made the file to read its own crc check from its original file (in this case a backup made) ?

Can be implemented on any exe or Dll file?

GloBal are you reading this? :)

Regards
dELTA
03-03-2004, 08:01 AM
There are infinitely many ways to implement CRC checks, both regarding checksum algorithms and regarding actual implementation, so there is no general way to say "how to patch them to defeat them".

A good guess about how the redirection of the CRC check was made in your example though, is that simply the path parameter to the initial API call getting the handle to the file was patched to point at another file. That might very well be enough to cause this effect, and it's quite a clean patch too.
cRk
03-03-2004, 08:04 AM
well guess got some ideas but need an extended explanation.. maybe with examples?? remember i'm a newbie with hungry to Learn ;)

what does the handle mean and how to get it ?

Regards
dELTA
03-03-2004, 08:17 AM
Please read the following info about file handling in Windows:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/creating_and_opening_files.asp

Then consider what would happen if someone would change the "lpFileName" parameter of the "CreateFile" API call...

Here's the reference to the CreateFile command, if you by any chance wouldn't manage to find it yourself:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/createfile.asp
cRk
03-03-2004, 08:31 AM
i'm glad that you're helping me dELTA .. i didn't found those info. because i wasn't looking for them.. neither i searched over Billy site .... anyway i see how good this info. is and noted that is related about what i'm looking for...

actually i would prefer some real code injection for example using it on any exe or dll

i'll hope to see Global's reply about this :D


First success(es)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > First success(es)
PDA

View Full Version : First success(es)

TBone
03-03-2004, 05:53 PM
I'm not really sure why I'm sharing this except that perhaps it'll make someone feel nostaligic for their first reversing experiment. It's kind of long - apologies in advance. I'll be as generic as I can about the target without completely ruining the point of the story. I think I've browsed through the forums enough to get a general feel for what you can and can't talk about, but if I overstep a bound, let me know.

I've orbited around the reversing/cracking scene for a long time without ever really diving in to the fray. I've always been one of those "don't tell me how to use it; tell me how it works" kind of people. Why learn about chemistry before you've learned about quantum electrodynamics? :p. If you know how the nuts-and-bolts work, it's easy to deduce the rest. But be that as it may, I've never really got into it as a hobby because I never really had a practical reason to.

Well, all that changed thanks to a odd little piece of equipment. I have a professional GPS surveying system. It consists of two receivers - a base station and a "rover". The rover hooks in to a data collector, which can transfer the data to computer with a serial cable and a kermit program of your choice. Amusingly enough, the data collector is driven by an 8088 processor - that thing is a reverse engineering project all by itself.

But my problem was with the data it collects. As I said, getting the data off the collector is easy; the hard part is making something meaningful of it. The data is stored in a very proprietary (pronounced: "WEIRD") data format., consisting of raw latitude and longitude information for each point, dillution of precision information for each point, coordinate system information (i.e. how to convert from the raw lat/long to a state plane coordinate system), etc.

Now fortunately the manufacturer of this system sells it with piece of software that retreives the data from the collector, converts it to the desired coordinate system, and spits out a comma-dilimited ASCII file of X,Y,Z coordinates and point descriptions. Yay. At first all went well. Inexplicably, the software includes a copy protection system of the challenge-response variety. I.e. it gives you a serial number, you give that to the company, who gives you a registration code that matches whatever infernal algorithm they use to mangle and compare the two. As time went by, computers would get replaced, re-imaged, or (in once instance) exploded. Thus we needed replacement registration codes to keep us in business.

At first they were reasonable about this and gave us whatever we asked for. But somewhere down the line they decided that their software (which to this day is licenseless, mind you) was some kind of holy grail that everyone in the world would want to use. Why, I have no idea. Its only conceivable use is for retreiving data from their data collector, and no one would need to do that unless they owned one. Mind boggling. Their excuse was that various bloatware functions in their software had commercial value to a horde of surveyors and engineers who were apparently clamoring at their door to use this software for actual analysis and design work. Bullshit, says I. There are programs for doing that kind of thing, and they're called CAD packages. Using their backwards PoS software for engineering would be like using a jagged rock to saw a board. Sure, you could do it, but no one in the right mind would.

This meant war. We bought ~$25,000 worth of equipment from them, and part of that deal was that we could get the data off of the survey unit and into CAD. We never agreed to anything about only installing one copy of their software, and now they were trying to change the rules. So we told them that they could either give us a new registration code, or talk to our lawyers. For a while that worked. We got them to cough up one or two more keys, and then they just started ignoring us. Literally - we'd send them emails and they'd just flat-out refuse to respond. Things got bad. There was only one computer left in the office that still had a functional time-trial left on it, and it had only 2 or 3 more uses before it went kaput.

So I dusted off a few old ASM reference books and went to work as best as I could. Once upon a time I could actually do at least basic ASM programming, but that was easily 6-7 years ago, and I've got a mind like steel seive. Armed with W32DASM and a passing knowledge of very basic ASM commands (MOV, JMP, Jxx, ADD, SUB, etc.) and practically no knowledge whatsoever about how W32 apps are compiled and linked, I wasn't very optimistic.

It turns out I had naively over-estimated the intelligence/deviousness of most small corporate programmers. I remember that back when I was 11 or 12 (this was roughly a dozen years ago) I had one of these "1337 h4}{0r" friends (you know the kind). He told me in his infinte wisdom that most copy protections could be defeated simply by changing a single instruction to skip over the failure algorithm and go straight to the success algorithm instead. I thought, "surely programmers aren't still using the same decade-old methods that are so easily broken?" Surely they are. It took all of about 15 minutes to find the failure message ("That Which Shall Not Be Named has expired!") and backtrack to where the conditional jump was. NOPed a couple bytes and all my troubles were over! What a peculiar feeling.

Later I found a better solution. My first workaround told it to continue with normal program execution even if the program saw that it was unregistered (i.e. it never processed the "You have X remaining executions before blah, blah, blah" code). I improved it a little by just skipping over the portion of code where it checks to see if it was registered in the first place. Is I learn more, I'll go back and see if I can reverse their validation method, which is in a separate executable, and make a keygen from it. While I'm at it, I'll figure out how the program determines if it is registered or not, and what the validation program does to register the program when you give it a valid key.

Thusly inspired, I started poking around in an third-party .arx file for AutoCAD which had been giving me trouble for similar reasons. I won't go into the gory details, but suffice to say that .arx files are cute. They contain an indordinate amount of plaintext data in order to pass their function data to the LISP subsystem of AutoCAD. That makes them substantially easier to reverse than normal executables, and this time I was able to find what I was looking for in about 5 minutes. NOP NOP, bam. This could be addictive. :D I'm not sure whether to be delighted or disgusted that I could apparently train a chimpanzee to "crack" a very large portion of commercial software. You'd think that people might learn something and put some new ideas to use once every few decades.

Anyway, thanks for the invaluable mine of information around here. Two major annoyances in my life are now removed from the equation. When I get a little free time I think I'm going to pursue this as a more active hobby. I've got a few oddball programs and devices that I have always made me wonder what makes them tick.
Woodmann
03-03-2004, 07:04 PM
:D
dELTA
03-03-2004, 11:01 PM
Hehe, just the way it's supposed to be, welcome to the addiction. :p
JMI
03-03-2004, 11:21 PM
Someone get the number of "Reversers Anonymous" for when we get the call from his friends and family that they don't see him any more and that he just sits in front of the computer all night swearing at the screen and then whooping for joy for seemingly no reason. :p

Welcome aboard.

Regards,
Kayaker
03-03-2004, 11:57 PM
...and then whooping for joy for seemingly no reason.

Lol, it's the ones that merit the little victory dance around the chair that I enjoy :D

Good story.
Aimless
03-04-2004, 03:21 AM
That's good to hear. As we all know: "The best helping hand is the one attached to your own shoulder".

Have Phun
Polaris
03-04-2004, 05:30 AM
Congratulations my friend...

Your story is a perfect example of acting in engineering-way... :D
crUsAdEr
03-04-2004, 06:19 AM
NOP NOP, bam. This could be addictive. I'm not sure whether to be delighted or disgusted that I could apparently train a chimpanzee to "crack" a very large portion of commercial software.

lol.. u had me on the floor man :)... that was funny...


Asdd
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Asdd
PDA

View Full Version : Asdd

mr. seeQ
03-04-2004, 01:45 AM
HI, this is my another stupid program. As you may know every asprotected program has a dll file - main protection mechanism. Which do all dirty things (checks the application integrity, debugger presence,...)
So, if you want to study the Asprotect itself, you need first dump this dll file. After some analyzing of the aspr loader i write ASDD (ASprotect Dll Dumper). This program automaticly dumping this dll. ASDD has PEHeader rebuilding algorithm, so after dumping you may direct load it to IDA.
Must work with all OS and all Asprotect versions since 1.2
crUsAdEr
03-04-2004, 02:39 AM
i thought r!sc released his old unaspr source which also dump the dll?
johndoe1
03-05-2004, 05:38 AM
mmm,

what i am wondering does this asprotect.dll also have the antiloader protection
thus that it loads the main app via CreateNewProcessA ??

if so

then i would have to write a loader that first patches the asprotect.dll
then patch the main app and i won't have any problems anymore ?? :)
crUsAdEr
03-05-2004, 07:41 AM
yep. u can do that :)
johndoe1
03-05-2004, 07:57 AM
yep. u can do that :)

could you guide me thru that part ?
or is there any good tutor, on how to find / bypass the anti loader protection ???

grtz, JohnDoe1
Uradox
03-07-2004, 02:13 AM
Oh it works, wasnt sure i was expecting that :P good job
crUsAdEr
03-07-2004, 08:57 AM
johndoe, honestly, i havent touched the lastest aspr... but where do you have problem with?
createprocess? PatchProcess memory? CRC?


y0da's crypter 1.x/modified
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > y0da's crypter 1.x/modified
PDA

View Full Version : y0da's crypter 1.x/modified

fira
03-04-2004, 08:10 AM
Hi,

Just ran into something packed with y0da's crypter1.x/modified (according to petools and others), anyone seen something like this ?

Anyway, the thing is: i broke with sice with int3 on the packed program and there were some tricky jmps like this:

00569086 jmp 00569089
00569088 jmp FA189278
..............

so it jumps somewhere in between altering the subsequent instructions.(the jmp FA189278 changes in a jmp to another location). Now, I *know* I've seen a thread on this forum discussing this but I can't find it anymore, can anyone direct me to it ?

thanks a lot!
Opcode
03-04-2004, 09:06 AM
Hi, fira

I think that this helps ( obfuscation code )

http://woodmann.com/forum/showthread.php?t=5399&highlight=obfuscation

Regards,
Opcode
fira
03-04-2004, 09:21 AM
yup, that's the thread, don't know why it didn't show up in the search results for "obfuscation". thanks !


MAC Dongle Possible?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MAC Dongle Possible?
PDA

View Full Version : MAC Dongle Possible?

ejh
03-04-2004, 12:26 PM
I have an older software package (1995) that was upgraded with new software (1999). In order to run either package it requires a 1 time serial # input, which I have, and a Microguard Plus dongle. The dongle is ADB and Mac doesn't have ADB any longer. I use an ADB - USB adapter but now the driver for that is not compatable with the new OS which prohibits me from upgrading my computer. Neither software is sold currently.

Is it possible to crack this so that the software can be used without the dongle?

Thanks
ejh
naides
03-04-2004, 12:49 PM
Is it possible to crack this so that the software can be used without the dongle?

Thanks
ejh

It is possible to crack a Dongle protected software, but difficult to tell how doable it is without further details.
If I understand you correctly, this is an Apple Machintosh cracking excercise, which I know very little about.
ejh
03-04-2004, 01:07 PM
It is possible to crack a Dongle protected software, but difficult to tell how doable it is without further details.
If I understand you correctly, this is an Apple Machintosh cracking excercise, which I know very little about.

Yes it is a Apple Mac. The dongle is a Microguard Plus which was made by micro macro. They were bought by Aladdin and are not made anymore (as far as I know)


CBJ - Call for papers and participation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CBJ - Call for papers and participation
PDA

View Full Version : CBJ - Call for papers and participation

Zero
03-05-2004, 03:29 AM
Dear friends,

the CBJ (CodeBreakers-Journal) is is a free online Journal for Algorithms, Virus-Research, Software-Protection and Reverse Code Engineering.

For the first issue we request papers and participation.

IMPORTANT DATES:
Full Length paper Submission Deadline May 31, 2004

Papers are requested in the following areas:
============================================

Algorithms
----------
Watchdogs; Parallel Algorithms; 64-Bit-Technology; Genetic Algorithms; Neuronal Networks; Petri-Nets; Artificial Intelligence (AI); Agents; Compression; Cryptography; Multi Threading

Virus-Research
--------------
Virus-Analysis; Spreading Technologies; Self-Modifying-Code; Polymorphic Code; Metamorphism; VX Development; Worms; Trojans; Multithreaded Attacking Systems; Hiding Techniques

Software-Protection
-------------------
Cryptographic Protections; Watchdogs; Multi-Threaded Protections; Hardware Protections; Commercial Protector Evaluation (Tool Review); Shrinker; Crypter; Packer; Law; Software-Piracy; New Technologies

Reverse-Code-Engineering
------------------------
Cryptanalysis within applications; Self-Modifying-Code; Polymorphic Code; Metamorphism; System Analysis; Protection Analysis; Linux Reverse Code Engineering; New Technologies

==============================================

The topics above are just a guideline, not a must !

If you have any questions about the CodeBreakers-Journal feel free to contact me.

If you are not the right point of contact for this material we apologise,
and would appreciate you forwarding this to the correct person
or providing me with the contact details.

Best regards,

Zero
Chief Editor
CBJ (CodeBreakers-Journal)
Journal for Algorithms, Virus-Research, Software-Protection and Reverse Code Engineering
http://www.CodeBreakers-Journal.com


Cuestion Concerning Imprec. 1.6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Cuestion Concerning Imprec. 1.6
PDA

View Full Version : Cuestion Concerning Imprec. 1.6

cRk
03-05-2004, 03:30 PM
i did some search and found some Thread about imprec. but those didn't answer my cuestion...

which settings are the best to recover/rebuilt a dumped program/IAT ?

which settings makes/Rebuild IAT for Will ALL

these cuestions came due i couldn't make a program work in both OS .. rebuilded IAT with Imprec from winXP but then dosen't run in Win9x

i see some Unpackers like Aspr. Stripper rebuild good IAT and runs on WinALL :confused:

i have to do this manually or still i can do it modifing some settings on Imprec.? how to do this??

Excuse my lame cuestions! i think i'm hungry for knowledge ;)

Regards
prejker
03-05-2004, 06:33 PM
a common thing is that when you dump under winxp imprec will resolve Kernel32!SetErrorMode as Kernel32!RestoreLastError which is an alias under winxp. Switch RestoreLastError to SetErrorMode and check if it will work.
nikolatesla20
03-06-2004, 01:54 AM
Are you sure you don't mean SetLastError(). That's what gets switched..
hobferret
03-06-2004, 07:06 AM
Are you sure you don't mean SetLastError(). That's what gets switched..

Hi nt20 :)

Yes you are right there, also sometimes some of the advapi32.dll references are different :D

/hobferret
cRk
03-06-2004, 04:27 PM
:confused:

no answers? i see some other API like Oleaut , and other ... might be different and comes the problems for one OS or another with IAT.

what to do?
cRk
03-08-2004, 07:54 AM
there have been for about 3 cuestions i have asked on this board ..and none of them have been answered .... people on these days don't like to share knowledge ? . i can't believe noone knows about this.. so i should say it like that :mad:
nikolatesla20
03-08-2004, 11:05 AM
I've never noticed any Oleaut problems myself..

How I use ImpREC:

"Rebuild All" is a tricky thing to try doing, it's almost never successful. Sometimes if you suspect an API you should trace the IAT entry manually (step thru it with debugger) to see where it really goes. You should always insert the IAT using "Add new section".

The "OEP" entry in ImpREC stinks. If you don't put a valid entry in this field, then you paste on the new IAT table, ImpREC will overwrite the OEP of the file with the junk one you entered. So before you paste in the new IAT section, make sure you have the OEP entered and correct ! The OEP value you need to enter is only the offset, not the whole VA. In other words, if the ImageBase is 0x00400000 (typical) and OEP is 0x00401000, you only need to enter 1000 in the OEP box. If you don't it will be screwed when you paste on the new IAT.

-nt20
esther
03-08-2004, 12:31 PM
and OEP is 0x00401000, you only need to enter 1000 in the OEP box.

:eek: this has been discussed long time ago.... do a search in the forum....
cRk
03-08-2004, 01:21 PM
esther i now you're insame from long time ago :p but that was not my cuestion ..please read up...

nikolatesla are these options OK ?? check the screenshot

i'm using win9x/XP with all Updates

sometimes i get errors like

Error Starting Program....

the XXXX.exe files is linked to missing export xxxx.dll : .......

that's what i mean...
seven
03-08-2004, 06:25 PM
reinstall imprec again coz the default set iz the right set .
nikolatesla20
03-08-2004, 10:27 PM
yes, I agree, I never use any of those advanced options, I just use the default settings.

-nt20
TQN
03-08-2004, 11:15 PM
Hi cRK !
I was have same problem. After some test, I find the way to workaround. Do not check "Import All by Ordinal". The export ordinals in system DLLs of all OS (Win9x, WinNT...) not same. For example: Export function with ordinal 112 in Kernel32.dll in 9x is difference with export function 112 in Win2K. Uncheck it to import by name.
TQN
cRk
03-09-2004, 01:31 AM
thanks for all replies . since now i'll try it with default settings. :)

Best Regards


need Help (createProcess)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > need Help (createProcess)
PDA

View Full Version : need Help (createProcess)

shaddar
03-05-2004, 03:48 PM
hi there,

ok i'm currently trying to unpack a target which is somehow protecting itself by starting its main .exe again (createProcess) but with additional parameters.

now my question is, how can i follow that createProcess call in ollydbg? i'm already debugging the .exe but it doesn't break on the oep (because it's a different process i guess :D). is that even possible with ollydbg? i hope so :D

thx in advance
shaddar
03-05-2004, 04:07 PM
sorry, i already figured it out i think
ebfe on OEP and attaching another ollydbg instance works for me
nikolatesla20
03-06-2004, 01:56 AM
What protection is this? I sounds like possibly SoftDefender.
johndoe1
03-06-2004, 08:26 AM
sorry, i already figured it out i think
ebfe on OEP and attaching another ollydbg instance works for me

ebfe on OEP ????
shaddar
03-06-2004, 08:45 AM
ebfe on OEP ????

yup that worked but the .exe is reporting a virus if u don't hard-change it back on the 2nd run :D.

@nikolatesla20:
it's VOB ProtectCD. Version 5 i guess. too hard for me anyways :(
johndoe1
03-06-2004, 09:03 AM
yup that worked but the .exe is reporting a virus if u don't hard-change it back on the 2nd run :D.

@nikolatesla20:
it's VOB ProtectCD. Version 5 i guess. too hard for me anyways :(

what the hell is ebfe ?????
shaddar
03-06-2004, 09:15 AM
what the hell is ebfe ?????

ebfe is the opcode for "jmp eip" (which will let the program run in a loop forever) :D


ASPR : finding the anti loader protection scheme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR : finding the anti loader protection scheme
PDA

View Full Version : ASPR : finding the anti loader protection scheme

johndoe1
03-05-2004, 05:30 PM
hi guys,

how do i find the antiloader protection scheme
inside a ASPR protected file ?

i want to write a loader for a packed exe, but ASPR has anti loader protection..

i use ollydbg

how do i approach ?

grtz, JohnDoe1
prejker
03-05-2004, 06:43 PM
there are others ways to do it.. and easier ;)
find OEP and look for GetModuleHandleA and see where does the app write the instance to. for ex.

push 0
call GetModuleHandleA
mov [0045A3C1], eax

now that u know where it saves the instance you can write a loader.
make and infinite loop which checks if there is some value in that memory and if there is that means aspr has passed control to the original code and you can patch. You can compare like this:

cmp dword ptr [0045A3C1], 0
jnz patch

or like this:

cmp dword ptr [0045A3C1], 00400000
jz patch

of course there are many variants of this. You can stick with other apis not just GetModuleHandleA.

Hope that helps..
johndoe1
03-06-2004, 03:45 AM
there are others ways to do it.. and easier ;)
find OEP and look for GetModuleHandleA and see where does the app write the instance to. for ex.

push 0
call GetModuleHandleA
mov [0045A3C1], eax

hmmmm

finding OEP = easy...

but then ;-)

i like your approach btw... :) never thought of that
johndoe1
03-06-2004, 04:36 AM
mmmmm

this is what i found :-)
the first JMP to kernel32.GetModuleHandleA after the OEP

----------------------------------------------

00A01CD8 6A 00 PUSH 0
00A01CDA E8 D934FFFF CALL 009F51B8 ; JMP to kernel32.GetModuleHandleA
00A01CDF FF35 147EA000 PUSH DWORD PTR DS:[A07E14]
' olly says : DS:[00A07E14] = 0A28015
00A01CE5 58 POP EAX

00A01CE6 8B05 247EA000 MOV EAX,DWORD PTR DS:[A07E24]
' olly says : DS:[00A07E24] = 00151EE0, (ASCII ""program path\program name"")

----------------------------
i know that the address 00a01cd8 is still ASPR code

this code was called by the main program at :

--------------------------------
0040FCBE > FF15 F0604100 CALL DWORD PTR DS:[4160F0]
'olly says : DS:[004160F0] = 00A01CD8 ( see above routine )

0040FCC4 . A3 38034200 MOV DWORD PTR DS:[420338],EAX
'olly says : DS:[00420338] = 00151EE0

0040FCC9 . E8 BB290000 CALL AnyDVD.00412689
0040FCCE . A3 A4C24100 MOV DWORD PTR DS:[41C2A4],EAX
'olly says : DS:[0041C2A4] = 009B0768

0040FCD3 . E8 0F290000 CALL AnyDVD.004125E7
0040FCD8 . 85C0 TEST EAX,EAX
--------------------------------

i feel i'm close, but what is my next step ?

Grtz, JohnDoe1
johndoe1
03-06-2004, 10:25 AM
mmmmm

i feel i'm close, but what is my next step ?

Grtz, JohnDoe1

i tried to create a loader ( asm, with msms32 )

still the protection seems active..

because it cannot find the instance.

:(

i'm lost..

how can i now proceed i need help :)

maybe someone with another asm loader file
that bypasses the aspr loader protection
(including the original aspr file, so i can try to work this out ?? )

thanx for a reply
none1899
03-06-2004, 11:11 AM
here is my .cpp source of a loader which works on aspred progs... maybe it will help you
johndoe1
03-06-2004, 11:54 AM
here is my .cpp source of a loader which works on aspred progs... maybe it will help you

it is nice to see some people solved it ;-)

but i need to know the how to..

could you guide me through it ?

i really want to learn how to approach aspr..

or give me the ent.exe ( i think it is Target Name Removed)
that this loader works on ??
JMI
03-06-2004, 01:01 PM
johndoe1:

Save discussion of the target name for Private Messages. Code has been posted in this thread!!!

Regards,
johndoe1
03-07-2004, 07:19 AM
This is weird...

As i am able to make a loader for the app as the .cpp file was for ( ENT.exe )
which was protected with ASPR 1.23 RC4

i am not able to make a loader for my app

as it seems ASPR 1.23 RC4 has different builds....
the aspr version i try to approach seems to have a "load new instance feature"

because the memory i patched ( and succeeded ) didn't have a effect on the
exe file

if i patch the same address in olly ( after finding the OEP off course )

this patch works......

any help is very welcome
crUsAdEr
03-07-2004, 09:00 AM
try bpm on the address you patch.. see what else is trying to write on it?
johndoe1
03-07-2004, 09:17 AM
try bpm on the address you patch.. see what else is trying to write on it?

it shall be my bad coding ...

is there anyone who has a MASM example

on how to do what rejker said ??

because i get the handle written if the program already is visible...

i see a dialogscreen, and then i get the msgbox ( i created it for debug checking ) that says that the handle is written...

so patching won't have any effect then...

grtz,Johndoe1
prejker
03-07-2004, 07:13 PM
i dont see any VirtualProtectEx api calls in that .cpp loader code.
if you are using winxp u should call it to unprotect the place u want to patch in memory if am not mistaken ;)
seven
03-08-2004, 06:14 PM
as it seems ASPR 1.23 RC4 has different builds

different builds ..... yes

different reaction against loaderz .... no

all aspro defeated by loaderz .
johndoe1
03-09-2004, 03:48 AM
different builds ..... yes

different reaction against loaderz .... no

all aspro defeated by loaderz .

how did you defeat the protection ?

can you give me some examples ? on how you approached?
what you did to defeat aspro ?
seven
03-09-2004, 07:20 AM
how did you defeat the protection ?

uzed pelg 0.3 Predator's .
johndoe1
03-09-2004, 07:58 AM
uzed pelg 0.3 Predator's .

that don't defeat aspr loader generation :)

how did you bypass it using pelg ???

description please
seven
03-09-2004, 08:29 AM
that don't defeat aspr loader generation

u r right

coz it defeat :

aramadillo
upx
aspack
anticrack
pe-protector
code-crypt
wwpack32
neolite
petite
ACProtect
PELock
tElock
SVK Protector
EXE Stealth

too :)
johndoe1
03-09-2004, 08:34 AM
u r right

coz it defeat :

aramadillo
upx
aspack
anticrack
pe-protector
code-crypt
wwpack32
neolite
petite
ACProtect
PELock
tElock
SVK Protector
EXE Stealth

too :)

?????

i don't get you
seven
03-09-2004, 08:48 AM
i don't get you

aspro uzed 2 protect softwarez aginst crackerz . right ?

pleg uzed 2 protect crackerz aginst aspro . that,s it .

dump the proggy + check code + pleg = aspro vanish .
johndoe1
03-09-2004, 09:10 AM
aspro uzed 2 protect softwarez aginst crackerz . right ?

pleg uzed 2 protect crackerz aginst aspro . that,s it .

dump the proggy + check code + pleg = aspro vanish .

thats not whqat i want to do :)

i like to be able to write a loader and leave the original exe untouchd

if i would dump it, i could also patch it on disk

the idea of a loader is to leave the original untouched.. isn't it ?
seven
03-09-2004, 02:54 PM
i like to be able to write a loader

i support u , make smart loaderz aginst smart packerz .

if i would dump it, i could also patch it on disk

i agree but let pleg take care of that just load targetz RVA .

the idea of a loader is to leave the original untouched.. isn't it ?

nop , the idea of loaderz is to leave the original think,s untouched

by offline sniperz online patcherz which called loaderz .
johndoe1
03-09-2004, 04:37 PM
i support u , make smart loaderz aginst smart packerz .

i agree but let pleg take care of that just load targetz RVA .

nop , the idea of loaderz is to leave the original think,s untouched

by offline sniperz online patcherz which called loaderz .

mmmm I know it is possible to write loaders so the original file can stay untouched.

i have one here... it does defeat the anti loader protection, and leaves the original untouched..

i'd like to get smarter and write such loaders, as dumping isn't that difficult
once you know the stolen bytes part... :)
seven
03-10-2004, 06:38 AM
i'd like to get smarter and write such loaders

u r smart enough 2 write smart loaderz

4 sure u r smarter than me coz i don,t

even know what stolen bytez meanz,

but i know 1 thing 4 sure that unpack

just 2 crack iz a waste of time , but

unpacking 2 know how packerz work

so u could write new loader generator

that iz more smart more advance wont

be a waste of time , the magic of pleg

iz the ability of defeating all packerz

by a tiny softy kiss.thanx 2 Predator .
dELTA
03-10-2004, 07:24 AM
For christ sakes drop the 1337 sp33k seven...
SideSwipe
03-16-2004, 03:23 AM
Hello:

I have converted NONE1899's cpp loader code example to asm. I am having the same problem as JohnDoe1; if I patch the program (ASPR 1.23 RC4) with Olly, my changes work fine, no nag box. My loader however does not error out but the program acts as if no patches were applied? If it was a CRC error problem I would expect an error message or program closure. I have tried different values in the sleep function. Why does the patch not effect the program? WriteProcess returns success. Is ASPR changing the bytes back to original? wtf? ASloader by GlObAl & [NtSC] seems to handle changing the bytes, but I would like to make my own loader.

SS

.elseif eax==WM_COMMAND
.if wParam == 1001
invoke CreateProcess, addr FileName, NULL, NULL, NULL,FALSE,NORMAL_PRIORITY_CLASS,NULL, NULL, addr sd, addr pi
lop1:
;read 2 bytes at patch_address1
invoke ReadProcessMemory,pi.hProcess, patch_address1, addr dataread, 2, NULL
;check to see if the 2 bytes are our program code yet
mov al,dataread
cmp al,074h
jne lop1
mov al,dataread+1
cmp al,030h
jne lop1

;sleep till asprotect do memchk
invoke Sleep,150 ;10 or less gives protection error 15
;write a byte (075h) at patch_address1
invoke WriteProcessMemory, pi.hProcess, patch_address1, addr patch1, 1, NULL

.if eax != TRUE ;Shazbot!
invoke MessageBox,0,addr ErrorMsg,addr AppName,MB_OK
.endif

lop2:
invoke ReadProcessMemory,pi.hProcess, patch_address2, addr dataread, 2, NULL
mov al,dataread
cmp al,075h
jne lop2
mov al,dataread+1
cmp al,012h
jne lop2

invoke WriteProcessMemory, pi.hProcess, patch_address2, addr patch2, 1, NULL

.if eax != TRUE
invoke MessageBox,0,addr ErrorMsg,addr AppName,MB_OK
.endif

;all done
invoke MessageBox,0,addr DoneMsg,addr AppName,MB_OK
johndoe1
03-16-2004, 02:41 PM
Hello:

I have converted NONE1899's cpp loader code example to asm. I am having the same problem as JohnDoe1; if I patch the program (ASPR 1.23 RC4) with Olly, my changes work fine, no nag box.

do you mean that you got the loader working for the app none1899 made a cpp loader for ?

because i did that as well, no problem for me and it also works fine..

seems this program has no loader protection....

but the other part.... i fail to write loaders for programs with loader protection...

how do we have to approach this ??

grtz, Johndoe1
SideSwipe
03-17-2004, 03:46 AM
John:

I tried the loader code on a different app packed with ASPR 1.23 RC4. Not sure how to proceed.

SS
johndoe1
03-17-2004, 03:54 AM
John:

I tried the loader code on a different app packed with ASPR 1.23 RC4. Not sure how to proceed.

SS

ehm.. we need to bypass the loader protection..
either the memory is protected, or the aspr detects thast memeory is changed, and it reloads itself again.....
SideSwipe
03-17-2004, 12:27 PM
John:

I dont think ASPR is protecting memory because WriteProcessMemory does not error out. It may be reloading original code if ASPR detects ProcessMemory has changed. I tried to unpack ASload by GlObAl & [NtSC] to see what it does but it is packed with something that is beyond my skill level to unpack. Perhaps some of the more experienced +reversers can help us with this. How do we fake out ASPR anti-loader code? You ASPR loader creators, how do you do it? Please help. John, message me if you get any leads. :confused:

SS
[NtSC]
03-17-2004, 01:52 PM
Oops,Delta reminded me of this Thread.

Well,Asload for Example is based on RIng3 Thread Modification.
CreateThread,Read/Write ProcessMemory,VirtualProtect etc.

Generally Global investigated a few neat Offsets (Bytes) to Hook.
Thus we catch some save Points and disable unwanted Stuff.

Iam sure if you look closer to some Asprotect Threads you will find some Offsets (Bytes) you can use for ScanStrings.
SideSwipe
03-18-2004, 11:38 AM
Hello [NtSC]:

I did a search of the archives for "Asprotect Offset bytes" and "Scanstrings" and didn't find anything useful. I realize you may not want to give away your loader code, but could you perhaps explain in a bit more detail the steps to take. For example, do I use the debug api to single step the program until a certain eip? What scanstring's do you search for? Should I be paying more attention to CreateThread,Read/Write ProcessMemory,VirtualProtect etc in the target app (going to try this). A little pushad in the right direction would be helpful.

Tks,
SS
[NtSC]
03-18-2004, 01:48 PM
Hello [NtSC]:

I did a search of the archives for "Asprotect Offset bytes" and "Scanstrings" and didn't find anything useful. I realize you may not want to give away your loader code, but could you perhaps explain in a bit more detail the steps to take. For example, do I use the debug api to single step the program until a certain eip? What scanstring's do you search for? Should I be paying more attention to CreateThread,Read/Write ProcessMemory,VirtualProtect etc in the target app (going to try this). A little pushad in the right direction would be helpful.

Tks,
SS

Should I be paying more attention to CreateThread,Read/Write ProcessMemory,VirtualProtect etc in the target app (going to try this).
^^^Thats the right Way to go.. Atleast its the Way Asload does it.

Thus,there is no Register Check over Debug Apis or whatever.. That could be a bit slow at all. It is enough to insert some "EBFE´s" and check EIP for that.

Since Asload was some Cooperation Thingy between Global and me, i cant say anything about the Offsets (ScanStrings) without Global´s Permission.

Days back i was bored and Global got me for the Coding Part of Asload,thus
the major research on Asprotect was done by him.

I will try to contact him and look if he is in the mood to offer some more Infos,but i cant promise Stuff now. I hope you understand that ;)
johndoe1
03-19-2004, 04:17 AM
']
Since Asload was some Cooperation Thingy between Global and me, i cant say anything about the Offsets (ScanStrings) without Global´s Permission.

Days back i was bored and Global got me for the Coding Part of Asload,thus
the major research on Asprotect was done by him.

I will try to contact him and look if he is in the mood to offer some more Infos,but i cant promise Stuff now. I hope you understand that ;)

please global and ntsc, tutor us :)

we really like to know how to approacht ASPR
and future versions of aspr..
johndoe1
03-19-2004, 04:20 AM
please global and ntsc, tutor us :)

we really like to know how to approacht ASPR
and future versions of aspr..

what exactly does asload do ??

creates loaders for aspr proggies ?
i'd like to take a look at it. :)
crUsAdEr
03-19-2004, 08:41 AM
johndoe... i don't have any problem with aspr loader watsoever... and there isnt much anti loader in aspr anyway...

I fail to see u display any efforts? can u show us some codes of your loader... some effort to find out where your loader fail?

I dont think Gl0bal wish to reveal those bytes, simply cos it is too easy for Alexey to change them and make it harder for hook those bytes... u dont need them for your loader anyway...
johndoe1
03-19-2004, 09:08 AM
johndoe... i don't have any problem with aspr loader watsoever... and there isnt much anti loader in aspr anyway...

I fail to see u display any efforts? can u show us some codes of your loader... some effort to find out where your loader fail?

I dont think Gl0bal wish to reveal those bytes, simply cos it is too easy for Alexey to change them and make it harder for hook those bytes... u dont need them for your loader anyway...

ehm...

well i tried to approach on diff levels...

1st thing is sleep, and then change bytes...

2nd thing is wait for the handle to be written by the main program.
and then try to patch the bytes.. ( still the nags occur.. )

i'm programming in asm

readprocessmemory
compare memory with bytes to be read

if match .. then patch...

something like this..

invoke ReadProcessMemory,procinfo.hProcess,location1,addr readbuffer,1,0
cmp eax,0
je _Read process_memory
invoke lstrcmp,addr readbuffer,addr checkbytes1
cmp eax,0
jnz _wrong_version (or loop to wait..)
invoke WriteProcessMemory,procinfo.hProcess,location2,addr patchbytes1,2,0
cmp eax,0
jnz _WP_ERROR

i also tried to unprotect memory like this

invoke VirtualProtectEx, procinfo.hProcess, location2, 2, PAGE_EXECUTE_READWRITE, addr lOldProtect
cmp eax,0
jnz _UPM_ERROR

also no effect....

that bugs me :)

i need to know how to approacht ASPR... bypassing the protection scheme...

please help....

grtz, Johndoe1
%UNDEFINED%
03-19-2004, 11:34 AM
I assume you are using the Debug API?
Are you hooking the API IsDebuggerPresent?
Are you patching the Debug context?
johndoe1
03-19-2004, 11:39 AM
I assume you are using the Debug API?
Are you hooking the API IsDebuggerPresent?
Are you patching the Debug context?

ehm don't know exactly what you mean..

i don't hook that's for sure..

i'm waiting for a handle to be written in memory
then i start patching the memory..

but... i need to learn different approaches...

could we take an aspr'ed program
and try to do this in the forum ??

grtz, JohnDoe1
evlncrn8
03-19-2004, 01:48 PM
its often a good idea to suspend the process (via suspendthread) when using readprocessmemory/writeprocessmemory, doing your stuff, and then resuming
and why sleep and then change the bytes, launch the process supended, do your initial patches, then resume....
[NtSC]
03-19-2004, 03:11 PM
its often a good idea to suspend the process (via suspendthread) when using readprocessmemory/writeprocessmemory, doing your stuff, and then resuming
and why sleep and then change the bytes, launch the process supended, do your initial patches, then resume....

If you dont suspend the Thread before Read/Write ProcessMemory you will probably not get the Results you want. Its a must i guess :P
Well,GetThreadContext works out fine too.
But basically,its all doable over Ring3 at all.
SideSwipe
03-19-2004, 10:07 PM
Thanks for the hints and tips. I am going to recode my loader and try to incorperate the suggestions you all have offered. Will keep you posted.

John: let me know if you make any headway please. I have attached the ASloader program for you to look at.

SS
crUsAdEr
03-21-2004, 11:52 AM
Ok Johndoe... you know aspr has lots of seh right? my loaders normally load aspr process as a debuggee... each time seh occurs, it will hand control to our loader... then you can check whether your byte is there already or not, if so patch it or else go on let aspr do its job...

the sleep and wait approach doesnt work really well... i tried it once long time ago i think... using debugging APIs provide a stable solution... u dont have hold your breath and hope that u catch the byte in time to patch :)
cRk
03-21-2004, 12:11 PM
the best loader maker i ever seen for aspr. or any packer is FuckFmn v0.3 .. the problem is that dosen't work on some w2k machines , and dosen't work for winXP :(

but this bastard is able to patch any aspr. without using any trick (Win9x Full Working) ...it mades 6 kb loaders for any exe

Source Pack Including Loader maker : hxxp://www.smola.pac.pl/main/smola01.zip

Loader Maker v0.1 + Sample Scripts:

hxxp://www.smola.pac.pl/main/fuckfmn01.rar

Author says : a new technology loader working under ring0 for w9x/w2k.

maybe with some minor modifications can be modified to be winall working

i'll wish some day this can be done

Url: hxxp://www.smola.pac.pl/win32asm.htm

Main Site: hxxp://www.smola.pac.pl
johndoe1
03-21-2004, 12:12 PM
Ok Johndoe... you know aspr has lots of seh right? my loaders normally load aspr process as a debuggee... each time seh occurs, it will hand control to our loader... then you can check whether your byte is there already or not, if so patch it or else go on let aspr do its job...

the sleep and wait approach doesnt work really well... i tried it once long time ago i think... using debugging APIs provide a stable solution... u dont have hold your breath and hope that u catch the byte in time to patch :)

tried the asloader, et voila :)

but your approach... on SEH
can you explain a bit more on how you do that ??

an asm example of some kind.. would be nice :)

mmmm I am defiantely getting of the idea of looping in memory
i like your idea on seh ( that's how i manually do it in Olly )

but no i have to learn on how to intercept the SEH part

any help ??

grtz, JohnDoe1
johndoe1
03-21-2004, 12:17 PM
Thanks for the hints and tips. I am going to recode my loader and try to incorperate the suggestions you all have offered. Will keep you posted.

John: let me know if you make any headway please. SS

SS, i will....
johndoe1
03-21-2004, 12:25 PM
the best loader maker i ever seen for aspr. or any packer is FuckFmn v0.3 .. the problem is that dosen't work on some w2k machines , and dosen't work for winXP :(

well that that code doesn't work under some win2k and not under XP

is because of the vxd i guess

damn that asloader is gooooooood

:)
johndoe1
03-28-2004, 06:44 AM
well that that code doesn't work under some win2k and not under XP

is because of the vxd i guess

damn that asloader is gooooooood

:)

hey is asloader also good for the trial protection inside ASPR ?

i still have to defeat that one

for now i'm stuck to asloader...
but i need to know how to defeat the trial protection inside
ASPR

any help ??
johndoe1
03-28-2004, 07:43 AM
anyone know how to defeat the trial protection within ASPR ???
dELTA
03-28-2004, 07:57 AM
I'm quite sure they won't know it any more just because you post the exact same question in two consecutive posts anyway. :rolleyes:

And yes, there is quite much info about the Asprotect trial protection if you search this board, as usual.
johndoe1
03-28-2004, 08:47 AM
I'm quite sure they won't know it any more just because you post the exact same question in two consecutive posts anyway. :rolleyes:

And yes, there is quite much info about the Asprotect trial protection if you search this board, as usual.

me was double posting due to an err on my interent explorer i guess
i didn't see my last post... :(

i can't find any good info on aspr trial protection...

i know it can be defeated, because there is a routine in stripper that does it..
but.. can't find info here

can you help me out on how to find it, i searched for the string yuo suggested ( already did that earlier, with other words.. )

maybe i'm just dumb ??
esther
03-28-2004, 09:13 AM
>i can't find any good info on aspr trial protection...

trial protection what is it?
johndoe1
03-28-2004, 12:08 PM
>i can't find any good info on aspr trial protection...

trial protection what is it?

inside an asprotected file ( with time trial enabled )

the protection ( aspr part )
looks if the trial is expired or not..

if expired the aspr routine breaks in and running the program is prohibited

i need to know how this time trial protection works...

anyone knows how it works ??
esther
03-28-2004, 12:17 PM
>inside an asprotected file ( with time trial enabled )

>the protection ( aspr part )
>looks if the trial is expired or not..

>if expired the aspr routine breaks in and running the program is prohibited

>i need to know how this time trial protection works...

You have come to the wrong place.Here they only analysis the program how asprotect works.

You won't get fully cracking anwsers here(ask for crack will be banned!)

The only way is you have to debug the program yourself... :rolleyes:
johndoe1
03-28-2004, 01:41 PM
>inside an asprotected file ( with time trial enabled )

>the protection ( aspr part )
>looks if the trial is expired or not..

>if expired the aspr routine breaks in and running the program is prohibited

>i need to know how this time trial protection works...

You have come to the wrong place.Here they only analysis the program how asprotect works.

You won't get fully cracking anwsers here(ask for crack will be banned!)

The only way is you have to debug the program yourself... :rolleyes:

dear Esther Bastard :

i don't want you guys to crack ...

i'm just asking if anyone ever defeated the aspr time trial protection scheme..

i am wondering what it does.

this because i monitored registry
and removing the entry in the aspr registry entries still doesn't make the program believe it has 100% of time trial left..

i could dump the victim, and then just crack it.

but i am curious how this protection scheme works

so making a loader and leaving the original exe untouched..

but your answer truly doesn't help much !!
crUsAdEr
03-28-2004, 01:58 PM
it might help if u actually read n follow delta's advice...
all this questions have been discussed before... so it is up to you to find out :/
johndoe1
03-28-2004, 02:22 PM
it might help if u actually read n follow delta's advice...
all this questions have been discussed before... so it is up to you to find out :/

before i posted, i tried to find it on the forum...
but that hasn't helped me, thats why i tried to post it

i als asked delta how to look or use the forums search engine
to find entries on this matter

no answer yet..

if you have a answer please post it or pm me
( i'd like to know how to search this item on this forum )
is there a advanced search method ?
crUsAdEr
03-28-2004, 03:41 PM
Hmm, let me put it this way... there is no instant answer, hence no instant search... searching does take a bit of patience, to sort out the info and see the relevant info...

You should not expect an instant answer exactly for your questions, but there are other info similar to it and you might need to investigate the problem yourself based on those info to answer your own queries...

I type "registry asprotect" into the search field on top, got this
http://www.woodmann.net/forum/showthread.php?t=4000&highlight=registry+asprotect
seem fairly useful for your purpose i think, but i might be wrong...
JMI
03-28-2004, 03:43 PM
So what the heck are you using for search terms? Try the following without the quote marks in the search window: " aspr expired" and then try "asprotect expired." Also try "aspr time" and "asprotect time." Among the thread you will find is a long one titled: "Azpr's new check time algo," which would be a good place to start.

Searching on the net would find many tutorials related to that subject, but you apparently didn't bother really looking for anything. There are even programs available which reset the time limit for many versions of Asprotect which you could find with a little effort and which you could study to learn now it is done.

Two of your most important 'tools" are your eyes and your brain and you do not seem to be using either with any effort or much skill at all. You simply want someone else to GIVE you the answers, rather than spending time searching for the answers.

If the problem is that you do not know HOW to search then you should visit the Fravia's Searchlores site linked on the bottom of these Forums.

This is not the childrens school yard where someone will take you by the hand and teach you the ABC's. Here you are supposed to MAKE an effort and SHOW that effort and THEN ask for help. It's time you got with the program.

Regards,
johndoe1
03-28-2004, 04:03 PM
So what the heck are you using for search terms? Try the following without the quote marks in the search window: " aspr expired" and then try "asprotect expired." Also try "aspr time" and "asprotect time." Among the thread you will find is a long one titled: "Azpr's new check time algo," which would be a good place to start.

Searching on the net would find many tutorials related to that subject, but you apparently didn't bother really looking for anything. There are even programs available which reset the time limit for many versions of Asprotect which you could find with a little effort and which you could study to learn now it is done.

Two of your most important 'tools" are your eyes and your brain and you do not seem to be using either with any effort or much skill at all. You simply want someone else to GIVE you the answers, rather than spending time searching for the answers.

If the problem is that you do not know HOW to search then you should visit the Fravia's Searchlores site linked on the bottom of these Forums.

This is not the childrens school yard where someone will take you by the hand and teach you the ABC's. Here you are supposed to MAKE an effort and SHOW that effort and THEN ask for help. It's time you got with the program.

Regards,

thank you !!!

well i am sorta used on getting results on search engines

with "+" or "AND"

but i wasn't getting the right results that's why iasked for help

but thinking i am lazy and didn't try enough.. dont heav a brain
etc, well
yah that's your opinion..

thanks for that comment
JMI
03-28-2004, 05:02 PM
Perhaps you should spend more time actually reading the responses you get instead of defending yourself while at the same time demonstrating what has already been said about your efforts. No one said you did not have a brain and I did not suggest you were lazy. What I did say was "you do not seem to be using either (your brain or eyes) with any effort or much skill at all."

Your reply was: "well i am sorta used on getting results on search engines with '+' or 'AND'." Really? How come if I impute "aspr expired" or "aspr AND expired" it get the same 8 threads apparently seven of which you did not find?

How come if I imput "aspr time trial" or "aspr AND time trial" I get the same thread ""Azpr's new check time algo," which I got with the other search terms I used and YOU TRIED and DIDN'T? What it means is that you either DID NOT TRY and/or you are lying about it now to cover your sorry efforts at searching. Not very impressive.

Regards,
esther
03-28-2004, 08:03 PM
He's just lazy to search the forum.What can I say! he is a lazy bastard :rolleyes:
evaluator
03-29-2004, 01:26 AM
hey, esther!
try to search more qualified words before taping easier ones.

however, for me seems, member "johndoe1" is just trying to crack some target without any interest in reversing.
so will be good, if we will break him.
johndoe1
03-29-2004, 02:52 AM
hey, esther!
try to search more qualified words before taping easier ones.

however, for me seems, member "johndoe1" is just trying to crack some target without any interest in reversing.
so will be good, if we will break him.

jmi or whoever is a moderator or admin here

please deactivate my account...

i know when i'm unwanted :)

have a nice one d00ds


LINK: Process-wide API spying-an ultimate hack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > LINK: Process-wide API spying-an ultimate hack
PDA

View Full Version : LINK: Process-wide API spying-an ultimate hack

Kayaker
03-05-2004, 08:22 PM
Another just published article from Code Project, apparently a new twist on API spying..

Process-wide API spying-an ultimate hack

This article presents an absolutely universal model of process-wide API spying solution, capable of hooking all API calls in any user-mode process of our choice, i.e. our spying model is not bound to any particular API at the compile time. Our implementation is limited to logging the return values of all API functions that are called by the target module. However, our model is extensible - you can add parameter logging as well. Our spying model is particularly useful for analyzing the internal working of third-party applications when the source code is not available. In addition to the universal process-wide spying model, we also present one more way to inject the DLL into the target process.

http://www.codeproject.com/system/api_spying_hack.asp
crUsAdEr
03-06-2004, 10:23 AM
Hi Kayaker,

I dont think this is new :/... the trick of replacing IAT with call to your own functions has been discussed before i think... at first i thought he hook CreateProcess and patch the OS's IAT loading codes... then it will be system wide hooking but then again that would be OS's dependent :/...
nikolatesla20
03-07-2004, 05:34 PM
Hooking a process's IAT is one of my favorite injection techniques :)

-nt20


About PCGuard 5.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > About PCGuard 5.0
PDA

View Full Version : About PCGuard 5.0

javier
03-05-2004, 08:49 PM
Someone unpack this protection?
Shoob
03-06-2004, 06:42 AM
Someone unpack this protection?

If you meant its a weak protection, yes. Unpacking is no problem.


what about XPSP2 "Execution Protection"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > what about XPSP2 "Execution Protection"
PDA

View Full Version : what about XPSP2 "Execution Protection"

0rp
03-06-2004, 10:44 PM
http://msdn.microsoft.com/security/productinfo/XPSP2/memoryprotection/execprotection.aspx

will it harm "inplace" decrypting executables ?
sgdt
03-07-2004, 12:07 AM
http://msdn.microsoft.com/security/productinfo/XPSP2/memoryprotection/execprotection.aspx

will it harm "inplace" decrypting executables ?

They claim it's protection against buffer overrun attatck, but I doubt it's usefullness for that.

Maybe I'm stating the obvious here, but it seems like a program could call VirtualProtect and turn off the NX bit.

As anyone whos traced a convoluted protection (such as ASPR for example), pushing an address followed by a return is identical to a dirrect jump. In a buffer overrun attack, your writing to the stack, and the ret is already in the code of the reader. You vaporize the functions return address with parameters to VirtualProtect, and the functions return address with the call to virtual protect, and when the routine "returns", you now have executable code whereever you want.

I mean, isn't it the exact same problem as before? I mean, didn't they learn ONE SINGLE THING from when Sun gave a "NX" bit to the Sparc's claiming they were no longer vunerable to buffer overrun attacks? (That lasted a day or so, gotz ta luv marketing people!)

What it DOES buy Microsoft has a little bit to do with CRM, though. But that's just a wild ass guess... :)

If they really wanted to stop buffer overrun attacks, they should teach people to check their return values once in a while and maybe not use stack space to store stuff that could be coming from a hostile enviroment. Simply using the virtual protect of today, setting a read-only section just past where they KNOW the buffer is supposed to end and wrapping in a try...except is more than enough protection.

But that wouldn't let them control what plug-ins can do for Media Player...
mmk
03-07-2004, 03:45 AM
If you want to prevent buffer overflows, don't code in C/C++. Use Java, C# and similar safer languages. If you absolutely must use C++, use safe classes to manipulate buffers (that includes strings). That NX bit will only make it slightly harder, but it definitely won't make it impossible to exploit a buffer overflow.

With Visual C++ .NET's stack-based buffer overflow prevention option, you would have to take control of the SEH handler. That was easy => option useless.

With the NX bit (which is only present in some of the newest x86 CPUs, such as AMD x86-64 and future Intel processors) you could do as sgdt just said and call VirtualProtect() to make the stack executable again.

If both are enabled, take control of the SEH handler, return to VirtualProtect() and return to your code on the stack. It could be difficult to find the right return addresses to make this work, but it's not impossible.

Once again, use a safer language if you want to prevent buffer overflows! :D
SiNTAX
03-07-2004, 06:03 AM
With the NX bit (which is only present in some of the newest x86 CPUs, such as AMD x86-64 and future Intel processors) you could do as sgdt just said and call VirtualProtect() to make the stack executable again.

Note: ia32e (= Intel's version of AMD64) still doesn't have an NX bit.

Anyway the problem will be calling VirtualProtect(). It will be a tad more difficult, as you can't directly execute your own code anymore, so you need to push the right params on the stack (VirtualProtect() address + it's params + return to the stack location + your code). However, if they also add some form of randomization, then it will be almost impossible to do.

BTW: recent Linux RedHat kernels already have this. It's called exec-shield and is combined with prelink randomization. So shared libs load addresses are randomized every 24 hours and the prelinker tries to randomize them to an address < 0x01000000, so that you will always have a null byte in the address, which makes 'string' buffer overruns harder as the null byte terminates the string. (exec-shield also has no-exec stack protection)

see hxxp://people.redhat.com/mingo/exec-shield/ANNOUNCE-exec-shield for more info on exec-shield.
mmk
03-07-2004, 06:35 AM
Anyway the problem will be calling VirtualProtect(). It will be a tad more difficult, as you can't directly execute your own code anymore, so you need to push the right params on the stack (VirtualProtect() address + it's params + return to the stack location + your code).

Without the cookie protection, it's very easy to call any function with any argument.

original stack in vulnerable func:
[locals and saved regs]
[ret addr]
[args]
[callee's local data]

after stack based buffer overflow:
#1 [locals and saved regs, most likely destroyed now]
#2 [address of newfunc]
#3 [args]
#4 [addr of destaddr which will branch to your shellcode]
#5 [input to newfunc; you control this data]

When the function returns, it will execute a RET X instruction, which will return to newfunc and remove the input arguments ([args]) from the stack. ESP is now set to #4. When newfunc returns, it will return to destaddr and remove arguments (#5) from the stack.

Replace newfunc with VirtualProtect and #5 with VirtualProtect arguments to make the stack executable, and you have an exploit to hack into any computer with that vulnerable software.
SiNTAX
03-07-2004, 06:50 AM
Without the cookie protection, it's very easy to call any function with any argument.

original stack in vulnerable func:
[locals and saved regs]
[ret addr]
[args]
[callee's local data]

after stack based buffer overflow:
#1 [locals and saved regs, most likely destroyed now]
#2 [address of newfunc]
#3 [args]
#4 [addr of destaddr which will branch to your shellcode]
#5 [input to newfunc; you control this data]

When the function returns, it will execute a RET X instruction, which will return to newfunc and remove the input arguments ([args]) from the stack. ESP is now set to #4. When newfunc returns, it will return to destaddr and remove arguments (#5) from the stack.

Replace newfunc with VirtualProtect and #5 with VirtualProtect arguments to make the stack executable, and you have an exploit to hack into any computer with that vulnerable software.

Yups.. that's also what I said :-) But.. you have to know which version of windows you are targetting as you need to know the exact address of VirtualProtect() (not that this will make it much harder, but if the target is a network app that bombs out if you try to exploit it, then you only have 1 chance... ofcourse you can finger-print the target beforehand, enough tools around to do that).

Because one can know the address of VirtualProtect(), that's also why I mentioned that if this is combined with library base randomization, that you will have a very hard time exploiting it.
mmk
03-07-2004, 08:45 AM
you have to know which version of windows you are targetting as you need to know the exact address of VirtualProtect()

Using hardcoded addresses for stack based buffer overflows is something exploit writers have always used.

You only get one chance with all stack based buffer overflow exploits. Use the wrong return address and you get a lame DoS instead of complete control of the remote system.
SiNTAX
03-08-2004, 03:58 AM
Using hardcoded addresses for stack based buffer overflows is something exploit writers have always used.

You only get one chance with all stack based buffer overflow exploits. Use the wrong return address and you get a lame DoS instead of complete control of the remote system.

I have to disagree here... if you have an executable stack and you can write the code you want on it, then you can make your exploit work on any version of windows (as long as the program you're exploiting is the same)
mmk
03-08-2004, 04:38 AM
Of course you can make it work on any Windows version. The problem is finding a return address which can be used on all Windows versions. That's usually not possible so you have to scan the remote host and figure out the OS it's using, and then modify the exploit to work with that OS and Service Pack.
SiNTAX
03-08-2004, 01:45 PM
Of course you can make it work on any Windows version. The problem is finding a return address which can be used on all Windows versions. That's usually not possible so you have to scan the remote host and figure out the OS it's using, and then modify the exploit to work with that OS and Service Pack.

I think we are talking about 2 different things here... I was refering to the way it is now, ie executable stacks. If the stack is executable, you can load it with code that uses the contents of variables of the exploit target. Finding the KERNEL32 base in the target code isn't that hard. Since windows exe's load at a fixed address, the target exe address will be the same on all windows boxes. So your exploit is generic.

If the stack is non-executable, then you can only use return addresses & the target's own code, until you have called VirtualProtect(), but to find the VirtualProtect() address, you need the KERNEL32 base which you won't easily find if all you can use is the target's code & return addresses.
mmk
03-08-2004, 02:47 PM
To execute your stack overflow exploit code you must use at least one hardcoded address in the app or a DLL used by it which will jump to your code.
SiNTAX
03-08-2004, 05:07 PM
To execute your stack overflow exploit code you must use at least one hardcoded address in the app or a DLL used by it which will jump to your code.

Indeed... but the app's address is fixed (even on different version of windows).. so no problem there.
mmk
03-08-2004, 06:19 PM
Yes the base address (normally 400000) is usually the same. But I'm talking about how to get to the shellcode. And to do that you must use one hardcoded address usually for the return address or for the SEH handler. This address usually points to an address high up in memory because it usually can't contain any 00h bytes in it. When your code gets control you can easily find kernel32 base in 5 instructions so you don't need to know the program's base address. Just one hardcoded address and you can do anything.


New in crypto
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > New in crypto
PDA

View Full Version : New in crypto

Melin
03-07-2004, 03:07 AM
Hi guys,

I'm using an Scada aplication with an editor of scrips that uses cryptographics, and need to decryp them in our application (I have a demo from a supplier with a functions that I need to use).

I wish if some one can help me, and tell what kind of crypto is used in program or give me any suggestions.

Example of function encrypted:

BAF21170A7899570B629BEEE55BC729463E7
BAF20B678DA7
BAF2C82C46E741F6227385F67DB7BB57CA0B41A620F9051411B5194A898B92E99B
BAF2C83C4AE8423900
BAF2C8E1033DFD211A59B2E41908180F58B0D8
BAF2C83C4AE8423903
BAF2C8E1033DFD211A59B2E40D0818F53E93CF0E421156E3
BAF2C83C4AE8423902
BAF2C8E1033DFD211A59B2E40216E729E77DACE516
BAF2C83C4AE8423905
BAF2C8E1033DFD211A59B2E41DFA01021D0E040F
BAF2C83C4AE8423904
BAF2C8E1033DFD211A59B2E41FFB05071A4EF167FC6AFF49
BAF2C83C4AE842103CB93EB3
BAF2C8E1033DFD211A59B2E404262AE139AE2D7F9FAF
BAF2C83EBB75F93FED0B6396DD
BAF20B699A
BA314CA0

I know that the last line is: (space)END

any suggestion?
xoder
03-07-2004, 12:56 PM
i dont think you can tell what crypto is used just by pasting some hex values.
you should try to find out where the decryption is done and try to find the keys.

all lines except the last one start with "BAF2" so they possibly all have the same start in plaintext.

have you used a tool like peid on your target? does it find any common encryption algorithms?

regards

xoder
mike
03-09-2004, 03:14 AM
Looks to me like a simple byte-wise obfuscation. Can you create scripts yourself and look at the encrypted versions? If so, try changing one letter at a time and look at the result. If not, can you guess what the scripts look like other than the END line? Try changing some bytes around to see if you can make it give you some error that leaks info about what happened. Say that the command is really "BREAK" but you don't know that. Then you change the last letter. It could come back with an error like "no such command [BREA#]" that tells you a lot of plaintext.
nikolatesla20
03-09-2004, 12:25 PM
I did some quick research, and I wonder if this might be what you are encountering:

Appears that SCADA, at least the popular "WebAccess" app that I found, uses Tcl Scripts. Have you considered that this might be Tcl script that has been compiled to bytecode?

For example,

http://www.scriptics.com/software/tclpro/compiler.html

Is one such tool. If it's bytecode, you won't have access to the original source. It says tho that you can load bytecode and run it if you have the appropriate Tcl engine..

-nt20
Melin
03-09-2004, 04:20 PM
Thanks to all that read or answer.

I have the program to cryp the files and test how it works, and with the w32disaxxx, I found the call with the password that I use on my files.

But I don't know what kind of cryp is using.

Now, I'm searching what is the password on my files when I compile the project, its hard for me and slowly.

If anyone wants the program I can send (2,5Mb).

Best regards,
Melin

PD: Tomorrow I will post one function encrypted and originally with password used.
Melin
03-10-2004, 03:53 AM
Hi guys:

here an example how to works the program:

Password used: 1234 (there are a tab before every letter)

FUNCTION test()
Sleep(1);
A
B
C
D
E
F
G
H
I
J
K
L
M
N
O
P
Q
R
S
T
U
V
W
X
Y
Z
A
B
C
END

And here the code encrypted:

DD40DA748A6CB84B033E07040C03105181D0C51ABF07454718738A7BC1DD0747CE4FCA4BDA71A63890CE889B2078E764E432F50849C48C9475A87C

DD6ED36DCD
DD6E
DD71D262F4
DD155895EC708BE90C1DA33A993F554D
DDD719B628BC1F74918BF4
DDD72B
DDD728
DDD729
DDD72E
DDD72F
DDD72C
DDD72D
DDD712
DDD713
DDD710
DDD711
DDD716
DDD717
DDD714
DDD715
DDD71A
BFF979
BFF97E
BFF97F
BFF97C
BFF97D
BFF962
BFF963
BFF960
BFF961
BFF966
BFF909
BFF90E
BFF90F
BF34B0C7

Any suggestion?
Melin
xoder
03-10-2004, 04:52 AM
why dont you use a debugger like olly or softice and see what the encryption routine does? i guess it would be much easier to do it this way than making wild guesses on how the encryption is done. i dont think its any hard encryption algorithm used, the results look too much the same. maybe its just some XORs etc.
Melin
04-20-2004, 01:00 PM
Hi:

I found that the compiler create a temporaly file decripted in memory:
Any suggestions to save the file decrypted?

Thanks
Melin
dELTA
04-20-2004, 04:27 PM
Just dump that decrypted buffer from the memory to a file. Use a hex editor with memory reading capabilities or inject memory dumping code directly into the application.
mike
04-20-2004, 06:03 PM
By the way, the last byte of each line from A to P is xored with 0x6A; it looks like a stream cipher of some kind. That means that you can XOR values into the ciphertext and you'll get the same value XORed into the plaintext.


Getting hardware infos about the local computer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Getting hardware infos about the local computer
PDA

View Full Version : Getting hardware infos about the local computer

SynApsus
03-07-2004, 04:54 AM
Hello guys. This is my first thread here and I hope you will be able to answer me, I thank you in advance... ( sorry for my crap english I'm young and french )
That makes some time I code drivers, and I want now to identify the computer on which it is installed.
I found the BIOS int 11, which returns in AX a lot of info about the system. It would be perfect, but I don't know how to run a BIOS interrupt with my driver : it always crashes. I have probably forgotten something...
Or if you could help me by giving a method to identify the motherboard, for example, it would be great.
Thanks, with regards,
Syn[NGEN]
dELTA
03-07-2004, 07:33 AM
What kind of driver are you writing? VXD, WDM, DOS? How does your current code snippet to call the interrupts look? Always try to give as much details as possible to increase the probability of getting help.
SynApsus
03-07-2004, 10:57 AM
I am writing a WDM.
I tried to run my interruption with 3 methods, but no one functions.
First, a direct call to the int 11. ( --> reboot )
Second, I had put cli ant sti instructions before & after the int 11 ( ---> reboot )
Third time, I tried to call Hal!HalEnableSystemInterrupt() undocumented function. It fails, and the reboot follows...
Is there a protection in the eflags register ? in the control registers ?
Dunno at the moment, even after a little reading of the Intel's software developer manual.
If you have a beginning of answer ...
Kayaker
03-07-2004, 02:25 PM
Hi

What information are you trying to retrieve exactly? Much can be found out about the basic system architecture from regular Win32 APIs such as GetSystemInfo, or from using NtQuerySystemInformation with the SystemProcessorInformation class (or ZwQuerySystemInformation if you want to do it from within your driver).

Other info could probably be found out from the Registry itself. If you need a way to find a certain bit of info that the System Properties control panel app displays for example, try disassembling sysdm.cpl and see if you can isolate how it does it. (Likely we're back to accessing the Registry and using NtQuerySystemInformation plus a few assorted other APIs).

With a little more info about what you want, I'm sure a solution is at hand.

Kayaker
SynApsus
03-07-2004, 02:52 PM
I want to retrieve some info, which identifies a computer and only one; this info has to stay the same even if the processor is changed.
Of course if I wanted to have only info about the processor I had used cpuid or GetSystemInfo...
But the aim is different, I want to have very "hard" information like, dunno, the version number of the CMOS for example :)
Ant NtQuerySystemInfo doesn't return any value interesting to do this.
I know a lot of these values are in the registry, but I prefer ( for protection reasons, and to be sure ) get this info without it : too simple to add or delete registry info and to cheat with it. Am I clear now ?
I want to know, in priority, if it is possible to run a BIOS interruption in my device driver. It's a difficult question, I suppose it is simply because we are not anymore in real mode, but there is the moment to find a way to bypass it :) And I hope somebody knows how to help me !
Opcode
03-07-2004, 04:36 PM
I want to know, in priority, if it is possible to run a BIOS interruption in my device driver. It's a difficult question, I suppose it is simply because we are not anymore in real mode, but there is the moment to find a way to bypass it :) And I hope somebody knows how to help me !
No, I don´t believe that its possible to use BIOS interrupts in to protected-mode using WDM programming.
Using SoftICE, you will see that all interrupts are redirected to ntoskrnl.exe.
Disassembly this file and you will don't see any call to BIOS, neither in to the HAL.
You will need to direct programming in hardware, the only complete book
that I recommend to you is:
"The indispensable PC hardware book" of Hans-Peter Messmer.
You don't need BIOS to get what you want ! :)

Regards,
Opcode
Opcode
03-07-2004, 04:41 PM
Use the "The Operating Systems Resource Center".
It's very useful.
At www.nondot.org/sabre/os/articles.
disavowed
03-07-2004, 04:58 PM
I want to have very "hard" information like, dunno, the version number of the CMOS for example :)what about when people update their cmos? their system is still the same, but this version number would change
SynApsus
03-08-2004, 03:58 PM
Thanks fo r your answers to all. And for disavowed, I'll answer no problem : if I sell a program, in this case I'll send a new key, that's all. Updating the CMOS is a lot more rare than changing the CPU...
disavowed
03-08-2004, 04:39 PM
uh oh.. if i've updated my cmos more than i've updated my cpu, does that make me weird? :)
Woodmann
03-08-2004, 05:40 PM
uh oh.. if i've updated my cmos more than i've updated my cpu, does that make me weird?

No your not weird, I update my CPU every week :eek:

-cbo-
evlncrn8
03-08-2004, 06:02 PM
No your not weird, I update my CPU every week :eek:

-cbo-

aha, that'd be round about the same time you update the site then too? ;pp
SynApsus
03-10-2004, 01:02 PM
hmm... no one of you appears to be able to help me... I'll one more time have to find the solution by myself.
I'm sure it IS possible, just because under NT when I compile .com executables, I can call this int 11h without any problem ...
Thank you anyway.

Syn- Following his lonely way

and a note for disavowed : yes it does make you weird :D


MASM and dword ptr
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MASM and dword ptr
PDA

View Full Version : MASM and dword ptr

johndoe1
03-07-2004, 08:55 AM
how can i do this in MASM ???

cmp dword ptr [0045A3C1], 0
jnz patch

i need to check memory if this value is changed !!
evlncrn8
03-07-2004, 09:18 AM
how can i do this in MASM ???

cmp dword ptr [0045A3C1], 0
jnz patch

i need to check memory if this value is changed !!

mov eax,045a3c1h

cmp dword ptr [eax],0
jnz patch

is just one of many possibilities that springs to mind
mmk
03-07-2004, 09:33 AM
use a segment override, such as ds::
mov dword ptr ds:[12345678h],55aa55aah


Olly Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Olly Problem
PDA

View Full Version : Olly Problem

%UNDEFINED%
03-07-2004, 12:39 PM
Tool - Olly 1.09d
OS - WinME (I have all the Band-Aid's from WindowsUpdate)
Target - Yeah Right, like I am going to post it
Protection: Aspr (Problem Occurs with 1.2x - 1.3x RC4)

Ok while attempting an unpack I get a Memory Access Violation

011F33D8 3100 XOR DWORD PTR DS:[EAX],EAX

EAX = 00000000
DWORD PTR DS:[EAX] = ????????

Ok, thats where I land, I know I can use ALT + F9 or pass it to the prog, but does nothing when I do, EIP doesn't change. I can hold down ALT + F9 and it will switch to "Running" and the back to "Paused" without prossesing any further instructions.

If I set up under Debugging Options to ignore Memory Access Violations and automatically pass them to the prog, it runs the prog normally.

Why is it Olly can automatically send to prog and it works, but I can't? :confused:
I even tried Assembling it to:

011F33D8 33C0 XOR EAX,EAX

EAX = 00000000

And the prog crashes. :mad:

What am I missing?
evlncrn8
03-07-2004, 01:15 PM
at a quess i'd say it's trying to trip a fault so the exception handler takes over
so you could try seeing whats at fs:0 and working from that to set a bpx on its seh
mmk
03-07-2004, 01:19 PM
Ok, thats where I land, I know I can use ALT + F9 or pass it to the prog,

...

What am I missing?

Should be shift+F7/F8/F9.
%UNDEFINED%
03-07-2004, 01:25 PM
:p Yeah thats what I meant...sorry I am at work,
I have to limit my time online.
I was typing fast without thinking I guess
%UNDEFINED%
03-07-2004, 01:29 PM
I guess the point of my question would be why can't I send Violations to prog?


Any one with experience reversing a powerbuilder application?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Any one with experience reversing a powerbuilder application?
PDA

View Full Version : Any one with experience reversing a powerbuilder application?

lqtox
03-07-2004, 04:58 PM
Hello all,

I've searched far and wide on google and RCE boards but haven't found any tuts or hints on reversing powerbuilder targets. Anyone have experience with this? All the usual GetWindowTextA, GetDlgItemTextA etc. breakpoints don't seem to work for the registration dialog box. Thanks!
Aimless
03-08-2004, 12:26 AM
If its small and doesn't require dozens of dependent files, maybe you can send the application to me on my email.

Have Phun
lqtox
03-08-2004, 06:29 PM
I'll PM u the link to download the target. Thanks!
FrankRizzo
11-27-2004, 06:48 PM
There IS a powerbuilder decompiler of sorts, called DePB. I found it on one of the reversing boards in China. It's a demo version, and I haven't been able to find a registered version, or any info about where to locate the author. It has a few limitations, but was robust enough to me to make a keygen for my app after decompiling a few modules.

The filename is "DePB 1.0.zip" in case you want to look for it. It's a handy tool to have in your arsenal. For those that are curious, PB code decompiles as nicely as java, meaning that it gives you function names, variable names, and everything else. Pretty easy to reverse when you have the original source! :yay:


MSI :: The magically appearing dll file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MSI :: The magically appearing dll file
PDA

View Full Version : MSI :: The magically appearing dll file

baudstupid
03-07-2004, 08:57 PM
New one to me... I have an app that installed from an msi file. It successfully installed so I removed the original msi file from my system.

When you try and register the app (regname/serial combo) it fires up msiexec. I know that its not using the original msi file as I deleted it. I manage to figure out that a tmp file, which is infact a DLL, is created in my tmp diretory and this dll has an exported function called 'CheckRegCode'. Promising :D I've had a look at the dll in w32dsm and I think I can keygen it, but I have two quesitons:

1) Where does this dll file come from? :confused:

It is created and removed from the tmp directory during every reg attempt. Its not the same size as any of the DLLs in the program diretcory.

2) Is there anyway I can use Olly to trace the DLL?

If I attach to the msiexec process in Olly the tmp file is not listed as an executable module to dump.

NOTE: Theres a .msi file in \windows\installer that has a random number name but the summary tells me in contains the logic info and data required to install the app. This msi file is only a fraction, less than 10%, of the size of the original msi file.

Any help, tutes or places to look would be greatly appreciated!
seven
03-08-2004, 03:34 AM
proggy create this temp file so change :

create ---------> open existing

http://members.lycos.co.uk/sssevennn/gotu.jpg
least
03-08-2004, 07:58 AM
To find where the DLL comes from try to use filemon - it will give you answer immediately.
nikolatesla20
03-08-2004, 11:11 AM
Sounds like a crappy installer to me, to begin with.

When an author creates an MSI file, he has the option to make shortcuts "Advertised". What this means is the files needed to actually run the program are NOT installed. What you instead get is a shortcut to some special system magic that will run msiexec on demand, when you click the shortcut, and install the files you need at that time. This saves disk space, because if a user never uses a program it doesn't get installed. Hence, it's only "advertised".

Also, an MSI file knows about what files it contains. If one of these files is missing in a feature, it will try to repair it when you run that feature. The author of this MSI probably messed up and had that DLL in the MSI project when it shouldn't have been. MSI sees it's not installed (because the app deletes it when you quit registering), so it runs. Meanwhile, the app creates the DLL behind its back. (Just a theory).

Regarding the MSI temp file, any MSI package you install puts a local cached package of the MSI on the system. This is used for the Add/Remove functionality, to know how to repair/remove itself.

-nt20
baudstupid
03-08-2004, 03:42 PM
Thanks for your input guys. I'm getting somewhere now. I've established that its not infact msiexec that makes the call to the dll but instead the target. If I run the target with Olly, I can live patch it to make the program call my dll as opposed to the one its generating. Olly still doesn't seem to list the dll as an 'executable module' so I can't trace into it. Does anyone have any ideas on this?

Also, anyone have any tips as to analysing a dll to see number and/or type of arguments for the functions?
baudstupid
03-08-2004, 06:39 PM
Ok, it gets worse.

I was having a feeling that the dll in question wasn't actually getting called. I made the patch so it pointed to my own dll and made my own dll an empty file. I still got the same message telling me my serial was wrong. So it can't possibly have been doing the check with the dll right? No other files are created during the process so the check must be internal to the msiexec thread! Argh.

I can't get anywhere. I've tried catching when it reads the serial, with GetWindowTextA, GetDlg... etc... even tried MSI own ones of MsiGetProperty... but they just seemed to bring up SQL instructions like "SELECT ? FROM ? WHERE ?".

Anybody any suggestions?
dELTA
03-08-2004, 07:49 PM
Exactly what do you mean with "made my own dll an empty file"? Make your dll display a messagebox in each exported function, including the DLLMain function, and then you can see if it's loaded and which functions are called. If it is loaded, use PSAPI functions or similar inside the dll to get all the info you want about the loader/caller process. Also, you can make your dll code call some obscure Windows API, and then put a global breakpoint on this API in Softice, then you can catch it during execution and easily trace back to the original caller to see exactly how everything works. And in addition to this, there are at least a thousand other ways too. :)
least
03-09-2004, 02:50 AM
Be careful with your own DLL since you don't know how many parameters each function takes, you can't ballance stack so you could crash that app.
That olly doesn't list it in modules could mean that the DLL is loaded dynamicaly - is it listed when are typing the serial (maybee try BP loadlibrary).
Number of arguments should be clear when you look at the end of procedure - here should be something like ret x where x means number of bytes to pop off the stack after return. Then just look at the params. Or try to use IDA to disassemble the dll, it will show you the arguments.
baudstupid
03-09-2004, 07:34 AM
By "made my own dll an empty file" I mean literally that... I completely filled the dll its was loading with NOPs, in the hope that the app would through some kind of error, crash or just anything to suggest it was actually bothered about the content of the dll. It didn't it smiled nicely and told me my serial was incorrect. So, I think reasonably, the serial check isn't done in the dll!

Using Olly I set a breakpoint on MsiGetProperty again (or whatever its called, something like that) and it broke. On theses BPs I could see the msi process reading in my username and regcode from the dialog box, but they were all refered to as UNICODE.

Gonna have to do a bit more reading I think, but to summarise:

1) The dll is not called during the regcode check.
2) If I have the address of where in memory my username is stored, is it possible to set a breakpoint in Olly on memory r/w like in SoftICE?

(Can't actually use SoftICE as it causes apps on my machine not to work and I haven't found a work around yet.)

Thanks again.
least
03-09-2004, 07:44 AM
I'm not sure if filling the dll with nops was a good idea, since it probably failed to load - dll_main must return something to flag that all is alright. Maybee it just tried to load the dll and since dll didn't work it looked like bad serial. Try to put on the beginning of each exported function manually (haxeditor) CC opcode, but don't forget to write somewhere previous value - this way it will cause exception which olly breaks in.
Concerning the memory breakpoint - I think olly has similar feature. And concerning softice, if your machine isn't too old, try to use VMWARE, and use softice in this - for me it works like charm:)
nikolatesla20
03-09-2004, 12:11 PM
Hm.

Seems strange, you say MSIGetProperty is reading your serial, etc. Seems like the MSI package might be the one doing your serial check, and the temp DLL is just a dll the MSI uses to do the check? You can, for example, tell an MSI package to run an external DLL function. When you do this in an MSI project, it puts the DLL into its binary table. When the function is to be called, it extracts it from the binary table into a temp and then calls into the DLL.

Using a tool named "Orca" you can open a compiled MSI file and search for those unregistered text strings, maybe it will lead you closer. (try opening that temp MSI file you talked about with it)

-nt20


To Board Admins
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > To Board Admins
PDA

View Full Version : To Board Admins

disavowed
03-08-2004, 08:02 AM
You guys ever consider implementing secure-redirects for linking? In other words, when someone clicks on a link posted on the board, direct them to a dynamically generated page that does a meta-refresh to direct them to the link. This method ensures that there is no referer-tag, the reasoning behind the disabled links on the board at the moment.
dELTA
03-08-2004, 07:31 PM
As we have it set up now, all external URLs are made "unclickable" altogether (i.e. they are not really links, only underlined text). Only local URLs (to any place on the woodmann server) are clickable. That takes care of the referrer fields quite well too. ;)
JMI
03-08-2004, 08:10 PM
And we don't have to worry which are or might not be "friendly."

Regards,
disavowed
03-08-2004, 08:43 PM
delta, i understand that you're point is that the admins are just lazy :)
jmi, i don't understand what you mean, though
Kayaker
03-08-2004, 09:10 PM
i understand that you're point is that the admins are just lazy :)

Heheh. The meta-refresh idea sounds good, though personally I don't how that works, but re the lazy bit -

Oh sure, like not wanting to do a simple copy/paste without even having to un-hXXp *isn't* lazy?? :D
nikolatesla20
03-08-2004, 10:28 PM
I think the next Mini-Project could be modding Internet Explorer so it allows us to auto-copy-paste-navigate from these links :) :) :)

-nt20
JimmyClif
03-08-2004, 11:39 PM
Oh sure, like not wanting to do a simple copy/paste without even having to un-hXXp *isn't* lazy??

Actually the un-hXXp used to annoy the crap outta me.. with Opera all I need to nowadays do is doubleclick the URL and the friendly popup generated by my mouse offers me a [Go to URL] option. Gotta love that.
JMI
03-09-2004, 12:29 PM
disavowed:

We don't want people posting URLs to software vendors while they are discussing reversing their software. Those would be "unfriendly" to our future existence.

Regards,
dELTA
03-09-2004, 01:29 PM
disavowed, are you completely sure that there are no browsers out there which include pages using meta-refresh redirects in the referer field?
disavowed
03-09-2004, 03:19 PM
that's a silly question. i could make a browser right now that includes that info in the referer field. however, as far as i know, no real-world browser do this. but again, i haven't tested everything.
dELTA
03-09-2004, 06:49 PM
Maybe the "as far as I know" and "i haven't tested everything" parts are why we didn't do it, rather than being lazy. ;) And the question isn't more silly than implementing it without knowing would be anyway.
Woodmann
03-09-2004, 09:11 PM
Howdy,

disa has sent me a sample script to play with.
I have not had a chance to play with it yet but, I personally,
feel comfortable with disavowed's skills.
(disa, keep this script on the "down low" :)

Dont make me get esther out here. He knows the "score" :eek:

-cbo-
%UNDEFINED%
03-09-2004, 10:46 PM
This is all you need it prevents the "reffer" and it doesn't need to be implemented into the forum.

I really think that instead of suggesting that things should be changed, that we should be grateful to Woodmann, JMI, dELTA and the other admins for keeping this forum running.

Therefore we should interested in protecting it rather than us being to lazy to copy and paste a URL.

This should help I don't remember who wrote it, I just know that I got it off the exetools forum.

All you have to do is highlight the URL right click and select "Open Selected URL" and it will open in a new window even if its hxxp or etc...
disavowed
03-09-2004, 11:25 PM
delta: point well taken. however, i do know of another board that uses this type of scheme for linking off the board. it shouldn't be hard to use the code i sent woodmann to test the four or five major browsers.

woodmann: understood ;)

undefined: unfortunately, that only works for internet explorer. many users of this board use other web browsers. and i suggested changes to make the board more usable; i would think everyone is grateful to the admins for keeping this place running
%UNDEFINED%
03-10-2004, 03:03 AM
disavowed, Thats good point, I guess I am so used to IE that I forget, not everyone uses it.

I apologize.

However that would be my recomendation, if it were for all browsers ;)


Quiestion about vb pcode
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Quiestion about vb pcode
PDA

View Full Version : Quiestion about vb pcode

FISAT
03-08-2004, 09:42 AM
Hi to all :)
Is it possibel to put a NOP in vb pcode?? If so, witch is the opcode value

thanx
sarge
03-10-2004, 05:47 PM
The answer is both "Yes" and "No".

If you are looking for a magic single byte value that you can use to overwrite/bypass unwanted pcodes, then there isn't anything that suitable for a "no-brainer" substitution. And, considering the way pcode is used, you shouldn't expect any; why create a token that does nothing? Instead, you would of course simply just not put a token in the code. Even the concept of two mutually opposing opcodes (like the old "Push-Pop" sequence) won't necessarily work cleanly.

However, if you are looking to bypass a pcode sequence (like an unwanted call, or a byte comparison routine), then there IS hope:

1. If there is an even number of bytes to bypass (the byte count has to include both the opcode itself as well as the parameters), you can usually replace the offending sequence with the byte sequence "0x00 0x00 0x00 0x00...". This works because the opcode sequence you are then using is "0x00 0x00", repeated as needed. This sequence is not a "NOP", but is rather more of a "Do something, but make sure it's insignificant". Usually, it's insignificant enough to not harm the code.

2. If there is an odd number of bytes to bypass, you can use the same concept; use the "0x00 0x00" trick. Except here, you replace the last three bytes with "0x1E, 0x03, 0x00". This works because this sequence is a "branch to the next opcode" operation. So, the end result is a series of insignificant-do-somethings, followed by a jump to the next command (which is where the code is going anyway!).

Hope this info gives you enough of a start; just don't expect the above concepts to be a cure-all.

Sarge
sarge
09-10-2004, 10:26 AM
A minor error was pointed out to me by a friend. The statement (in step #2):
"last three bytes " should be "first three bytes". This properly results in a jump to the first of the "0x00, 0x00" sequences.

Thanks to "void" for pointing this out.

Sarge
dELTA
09-10-2004, 05:27 PM
If the even pairs of 0x00 are practically equivalent to NOPs, and those three bytes are "branch to the next opcode" as you say, why doesn't it work either way (i.e. the three bytes either before or after the 0x00 pairs)?
sarge
09-11-2004, 05:34 PM
Yup, you are right, you would think that it should work that way. But I mis-analyzed the usage of those three bytes. It would be more correct to say that they mean "branch to the byte at the third OFFSET" (which is the fourth byte). So, that byte sequence can only go at the beginning of your desired NOP code sequence. That way, the first thing that would happen is, three bytes of code are used up to get to the fourth byte; then, the fourth byte begins the remaining groups of NOP pairs.
Thus, you have the desired effect of an odd number of bytes being NOP'ed out.

Sorry for the error, I remember doing that in the wee hours of the morning. It worked on a 3 byte sequence, so it looked like it jumped over 3 bytes; instead, it was actually jumping to the fourth byte, which happened to already be the end of the test sequence.

My apologies...next time I'll test more fully.

Sarge
br00t_4_c
09-13-2004, 05:41 PM
Just for the record: PCode makes me feel "stabby" :mad:


1 byte puzzle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > 1 byte puzzle
PDA

View Full Version : 1 byte puzzle

evaluator
03-08-2004, 02:29 PM
change 1 byte only
disavowed
03-08-2004, 04:48 PM
i guess it's not the correct solution, but i know how to get rid of the nag by changing one byte:
change byte at file offset 0x000000a8 (assuming first byte of file is at offset 0x00000000) from 0x00 to 0x15
evlncrn8
03-08-2004, 05:26 PM
i guess it's not the correct solution, but i know how to get rid of the nag by changing one byte:
change byte at file offset 0x000000a8 (assuming first byte of file is at offset 0x00000000) from 0x00 to 0x15

heh thats what i was thinking, couldnt find any other way to do it
i thought it'd be something to do with messing eax in the line for the messagebox
like xchg ah,al so it pointed to the string (and not using the 2nd mov eax,blah) but no go.. not in 1 byte nehows
disavowed
03-08-2004, 05:48 PM
maybe evaluator mis-translated "two" as "one" :P
SiNTAX
03-08-2004, 06:31 PM
Solved... 1 byte indeed :)

PM'ed the solution to eval.
ZaiRoN
03-08-2004, 06:58 PM
Hi All,
SiNTAX was right... only 1 byte! Very funny puzzle game :D

good luck :p
Zai
TQN
03-09-2004, 12:27 AM
Change the B8 byte at 00401009 to 86. (Use Binary-Edit in OllyDbg). "registered" string will also be changed to "Registered".
TQN
evlncrn8
03-09-2004, 12:44 AM
Change the B8 byte at 00401009 to 86. (Use Binary-Edit in OllyDbg). "registered" string will also be changed to "Registered".
TQN

damnit i was close on the xchg ah,al thing.. im just getting rusty in my old age heh
evaluator
03-09-2004, 01:13 AM
SiNTAX PM-ed at 12:31 AM

ZaiRoN at 12:53 AM

.. i'm cryyyy:)
SiNTAX
03-09-2004, 03:01 AM
Change the B8 byte at 00401009 to 86. (Use Binary-Edit in OllyDbg). "registered" string will also be changed to "Registered".
TQN

Tsssk.. now you've spoiled it for the rest!
ZaiRoN
03-09-2004, 06:36 AM
Hi TQN,
why have you written the solution so soon? Now, no other will try the puzzle anymore... :(
evaluator
03-09-2004, 06:41 AM
in addition, more easy 1 byte puzzle, for newbies.
R@dier
03-09-2004, 11:44 AM
change [eax+10] to [ESI +10]
at offset 210h change 50 to 56

That was a bit of fun

Best Wishes
R@dier
evaluator
03-09-2004, 11:54 AM
Next (de)Generation of 1 byte puzzle..
yep, about 5 hour i trashed, but seems,
not so many will required for solving..

Who will first!?
evaluator
03-09-2004, 11:59 AM
in newbies-puzzle:
I was Zairon
II was R@dier

but because R@dier is more newbie, he WON!!
Kayaker
03-09-2004, 12:34 PM
Hi TQN,
why have you written the solution so soon? Now, no other will try the puzzle anymore... :(

No kidding eh? How about if someone wants to post a solution (nothing wrong with that per se), they write it in ROT13? Those who want the solution, have it. Those who don't, only see gibberish. Plus it avoids posting simple 1 byte zipped solutions as well.

http://rot13.com/

OK 1-bite wizard? :D
ZaiRoN
03-09-2004, 01:00 PM
Maybe you misunderstood me; I don't want to stop people from posting solution, they can post it but not so soon...
Btw, a rot13 solution is perfect ;-)
evaluator
03-09-2004, 01:17 PM
ya, in fact, better will, if you will PM me solution, so more people will interesting
to solve..
evaluator
03-09-2004, 04:24 PM
wooh!?

4 hours comes out & yet nobody solved?
i feel ~8-)

btw, Zairon, this one is for all, not only for newbies.
Don Wooma...:)

ok, i'm going to sleep; in PM i have 16 free place.
good luck..
ZaiRoN
03-11-2004, 06:25 AM
Well, this new puzzle is not so easy than the previous ones. A simple glance to the instructions doesn't help me to find the damned byte. Maybe we can choose another way.
What about a brute-force approach? We know that, at 40106D, edx should be 401090, so we will start changing a simple byte from 401018 to 401068. The scheme will be something like this:
install seh

@loop:
change the current byte ; the current byte will take values from 00h to FFh
jmp @puzzlecode
@incByte:
inc the current byte
if <current byte has taken all the possible values>
jmp @nextByte
else
jmp @loop

@nextByte:
restore the current byte with the original value and choose the next one (put it to 00h)
if <address of the current byte> == 401069
byte not found...
game over
else
jmp @loop

@ok: ; we have found the byte
remove seh
print the offset and the new byte
game over...

@puzzlecode:
xor ebx, ebx
mov eax, 402010
mov edi, 40107A
lea edx, [eax+10]
@401018:
<<< the modified code from puzzle.exe >>>
if edx == 401090
jmp @ok
else
jmp @incByte

seh_handler:
the "safe place" will be @incByte, nothing more...
A seh is necessary because we don't know what will happen when a single byte will be changed...
These are only some ideas floating on my mind, I don't know if it's really possible to write something like that but... who cares ;-)

Later,
Zai
Harding
03-11-2004, 02:03 PM
The bruteforce method did NOT work.
I wrote a ollyscript that would do that...
In the beginning it went well but after a while I (think!) hit the CALL or the JCC instructions and the whole computer went crazy.

I think using your brain would be the best solution.

/Harding
Foreigner
03-11-2004, 02:42 PM
Hello Harding,
can you post your script? I have never tried to write an ollyscript and I would like to see an example.

foreigner

ps.Have you solved the puzzle?
evaluator
03-11-2004, 05:02 PM
hm..

brute-force looks quite non-humanistic.

-io protesto:)
Harding
03-11-2004, 07:09 PM
Foreigner: Well, when I realized that my 5+ hours of work had been a total waste of time, I deleted the script (since it's useless, why keeep it?)
But there are some very good scripts at hxxp://ollyscript.apsvans.com

Eval: Has anyone found the solution yet? if nor, can't you give us some tip?
ZaiRoN
03-12-2004, 05:01 AM
hm..
brute-force looks quite non-humanistic.
-io protesto:)As you wish :-)
evaluator
03-12-2004, 01:26 PM
nobody yet PM-ed me.
want we call all-world reverserz?

in help i can say:
1.tool i used - HIEW, so use it
2.there is NO garbage code inside.
Harding
03-17-2004, 06:09 AM
Ok Eval. I give up, what is the solution?

/Harding
klier
03-17-2004, 02:26 PM
please wait...

suggestion : put a deadline on it,like april the first. :)

Regards,
evaluator
03-17-2004, 04:36 PM
I posted it on http://board.anticrack.de.
Lets see.
If there also will not solved, then i will upload it also on cracmes.de..
klier
03-18-2004, 11:05 AM
because i cannot PM :confused:

255h : 8D --> 71

Regards,
doug
03-18-2004, 11:33 AM
good job klier.

(& eval too)
evaluator
03-18-2004, 12:50 PM
HECK-ME!

In fact klier's Unusual solution eliminated my unusual failure!
Because i coded it for more tricky solution in another location...
i'm quite sad for my failure..
BTW! try again to find my solution.(now of course will easier)
Harding
03-18-2004, 01:29 PM
Klier: Great job! May I ask how you found this one?

Anyone know you I get "evaluation" when I step trough the code but "registered" when I run it?
klier
03-18-2004, 03:12 PM
25Eh : 8D-->3C|70|72|75|77|78|7B|7C|7F|A8|B1 ;)

Regards,
doug
03-18-2004, 06:23 PM
Klier: Great job! May I ask how you found this one?

Anyone know you I get "evaluation" when I step trough the code but "registered" when I run it?

the patch at 255h changes the exception handler (mov [esp+4], cl), so when icebp (int 1) at 40106C gets executed, it falls to that new exception handler (40101A), instead of the first one (40107A).

when you trace (presumably with olly?), the exception handler won't get executed.
evaluator
03-19-2004, 05:20 AM
klier, Congratz!

You finally solved it.
0040105E > 75h is my default.
Harding
03-19-2004, 06:35 AM
doug: Ok, thanks for the explaination. So with Olly I can't let the program take care of the exception?
Usually when an excepton occurs, Olly pauses and lets me choose what to do, why not now?

klier: How did you found this one?

eval: This is fun, you don't have anything more to play with?
klier
03-19-2004, 08:03 AM
Harding
>>"I think using your brain would be the best solution."
followed your advice and evaluators to use hiew. :)

I saw the shr dx,1 and the or dl,-080 but when i tryed to change a byte to make the code do that i always jumped into oblivion or exitprocess.(me newbie,hobbyist)

Asked myself :how and where is edi used (40107A,exitprocess) and how to change it.
And with a little luck and 'lightning-struck'...found a solution. :D

May be not suffice as explanation but i don't have much time right now.
Have to spread menure on the field(not mine,horsies) :eek:

Regards,
evaluator
03-19-2004, 05:04 PM
Puzzle No3
Kayaker
03-19-2004, 06:01 PM
eval: This is fun, you don't have anything more to play with?

Ah geez, he's got a hidden closet full of them! :D
klier
03-20-2004, 03:30 PM
evaluator,dirti means more then Registered! in the box? :confused:

Regards,
evaluator
03-20-2004, 06:01 PM
no, dirti looks..
not important crackme. work on 3.
BTW, Why you can't do PM!? if some truble, ask moderators.
dELTA
03-20-2004, 07:30 PM
Usually when an excepton occurs, Olly pauses and lets me choose what to do, why not now?
Yes, I'm a bit curious about this myself. Why aren't exceptions that are caused by an int1 hooked in Olly, but rather completely ignored by both Olly and and the program itself when single-stepped? Normal access violation exceptions for example are caught by Olly in both single-step and "running mode" (and you then get to choose whether to pass the exception to the program or not, as usual) but in this case neither Olly nor the program sees the exception at all?! Is this maybe a well known anti-debug trick or something like that? It would be great if anyone could give a more technical explanation for this, maybe you Eval?
doug
03-20-2004, 09:16 PM
just a wild guess here, but the opcode used isn't a typical INT1 (CD 01 I believe), but instead an "icebp" as some other disassemblers decode it.
klier
03-21-2004, 05:13 AM
if moderator or administrator reads this,can't PM a solution for puzzle03. :o

Don't know another way to ask! :(

Regards,
klier
03-21-2004, 05:24 AM
OK,problem solved. :)

Regards,
dELTA
03-21-2004, 05:53 AM
just a wild guess here, but the opcode used isn't a typical INT1 (CD 01 I believe), but instead an "icebp" as some other disassemblers decode it.
Ok, good start, but how come neither the program nor Olly sees this exception when single-stepping, but the program indeed gets it when running normally? That was the kind of technical explanation I was looking for. Eval, or someone else, enlighten us! :)
klier
03-21-2004, 07:29 AM
in olly,

do a bpxint1 and you get the exception.
shift F9 and --> registered.

google on icebp.

Regards,
evaluator
03-21-2004, 07:47 AM
OK, klier solved.

**
requested "technical explanation":
When you are "single-stepping" on F1h opcode (or INT01 when it has R3-privilege),
debuggers eats this exception, because they themselves are waiting own single-step exception.
this are common debuggers fault, which not happens in OUR tracerZ:)

So, for exact result, when you meet F1h opcode (or INT01..),
do not press F8 key on it (for SICE), but instead:
locate SEH addres, set BPX there & close debuggers window by CTRL-D.
then debugger will break & you'll happie:)

..shame(le) to you..

**
[when not cracked crackme runs, it not does exception.]
klier
03-22-2004, 05:29 AM
have a riddle of my own: :rolleyes:

wich byte 1 (one) you have to change in dirtiPuzzle to get this message from virusscanner(if you have one):

virus alert:
'Source: D:\dirti\dirtiPUZZLE.exe
Click for more information about this virus : Bloodhound.W32.EP' :D

Regards,
evaluator
03-22-2004, 09:33 AM
i not use any anti-vir;
probably it depends on each anti-vir;
evaluator
03-24-2004, 05:59 AM
Puzzle 04
corrected, try again
evaluator
03-24-2004, 02:12 PM
klier again solved puzzle04 in own way. try another ways also.
what can i say? this puzzle sux:(not well tested):
evaluator
03-24-2004, 05:37 PM
well, klier also found other ways, include my default.
good buy:)

who also want be good buy!?
klier
03-24-2004, 06:50 PM
i'm choked, a buy?
evaluator
03-25-2004, 03:18 AM
boy, boy.. soorri
evaluator
03-29-2004, 03:30 AM
easy puzzle05 on MBox theme.
evaluator
03-29-2004, 05:45 AM
bene, ZaiRon solved it quickly.


How to trace a register back? (plz help)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to trace a register back? (plz help)
PDA

View Full Version : How to trace a register back? (plz help)

Aquatic
03-08-2004, 06:02 PM
I want to find a static pointer to my value in a game, but when I BP on the value I get the line:

So I say to myself that this pointer is dynamic because it involves ESI, and ESI will change, and therefore be unreliable.

What I need help with is finding out how ESI gets populated, so I followed ESI back in the code until this line:

Yes this is where ESI gets populated, but still there is no sight of a static pointer, so now I must trace ECX back and find how ECX got populated with the value. Here the problem arises because if you look in the code that I posted below, the line MOV ESI,ECX is at the start of the routine, so ECX cannot be traced any further back.

So what now? How do I continue to trace ECX back on my quest for the static pointer?

Thanks

*Code removed* ;)
Kayaker
03-08-2004, 06:59 PM
Hi

To backtrace into the calling proc you can either check out a static disassembly, or use the live approach of setting a BPM x on the first instruction in the current proc.

005A64A0 83EC 08 SUB ESP,8

I haven't done that in quite a while, but when Softice breaks it should tell you the LastEIP or EIPFrom or whatever the term is (have forgotten exactly). This calling EIP value should be from some *other* proc, then you can set a BP on that address and continue to trace back within that proc, and repeat as necessary... ;)

Kayaker
ZaiRoN
03-08-2004, 07:07 PM
when Softice breaks it should tell you the LastEIP or EIPFromThis is also done by Olly, it shows you something like 'Call from <address>' directly inside the 'information' window (the one below the 'code' window)

Zai
Aquatic
03-08-2004, 07:27 PM
This is also done by Olly, it shows you something like 'Call from <address>' directly inside the 'information' window (the one below the 'code' window)

Zai

When I Bp on SUB ESP,8 it says

0012FC4C 005FA0AE RETURN to game.005FA0AE

It doesn't say where from

In Olly
naides
03-08-2004, 07:36 PM
When I Bp on SUB ESP,8 it says

0012FC4C 005FA0AE RETURN to game.005FA0AE

It doesn't say where from

In Olly

Another resource is:
Type on SoftIce: WS or Window Stack

It displays the call stack.
The first line is the current instruction, the second line contains the address where the current code was called from. by double clicking on it you can quickly go to the area that called the SUB ESP, 8 and see who or what was loaded into ECX. if it is not waht you are looking for you can look into the third line, which is the caller of the caller, and so on.

It only works for CALL. if the calling code was something like JMP EBX, you need some other strategy to trace back.
Aquatic
03-08-2004, 07:49 PM
Another resource is:
Type on SoftIce: WS or Window Stack

It displays the call stack.
The first line is the current instruction, the second line contains the address where the current code was called from. by double clicking on it you can quickly go to the area that called the SUB ESP, 8 and see who or what was loaded into ECX. if it is not waht you are looking for you can look into the third line, which is the caller of the caller, and so on.

It only works for CALL. if the calling code was something like JMP EBX, you need some other strategy to trace back.

I'm using Olly, but olly also has a stack window.
Aquatic
03-08-2004, 08:07 PM
No luck.
nikolatesla20
03-08-2004, 10:30 PM
If you are able to debug with olly, maybe you can run a "run trace" until it hits the breakpoint at the MOV ESI, ECX instruction. This will show in the trace log, the instructions that ran before it got to here.

-nt20
Aquatic
03-08-2004, 10:42 PM
If you are able to debug with olly, maybe you can run a "run trace" until it hits the breakpoint at the MOV ESI, ECX instruction. This will show in the trace log, the instructions that ran before it got to here.

-nt20

Sounds good.

How can I do this?
nikolatesla20
03-08-2004, 11:32 PM
I'm not good enough to explain it, here's some links I found googling

http://home.t-online.de/home/OllyDbg/Tut_rtr.htm

http://216.239.37.104/search?q=cache:P6xZSYsM3RcJ:www.immunitysec.com/papers/msrpcheap2.pdf+run+trace+ollydbg&hl=en&ie=UTF-8

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=435

And you can search "run trace" in the ollydbg forum mentioned above and get lots of links that may help you.

-nt20
koyaan
03-10-2004, 08:34 AM
Sounds good.

How can I do this?

load the target with olly

right click -> run trace -> set condition
eip is in range 005A64A5 to 005A64A7

hit trace into

when it breaks:
view -> run trace

you should find a "mov ecx, something" right before the call to that routine....

some compilers (vc with fastcall convention?) use ecx and edx to pass the first two arguments to a function

cheers
koyaan
Aquatic
03-10-2004, 04:08 PM
load the target with olly

right click -> run trace -> set condition
eip is in range 005A64A5 to 005A64A7

hit trace into

when it breaks:
view -> run trace

you should find a "mov ecx, something" right before the call to that routine....

some compilers (vc with fastcall convention?) use ecx and edx to pass the first two arguments to a function

cheers
koyaan

Hmm,

Maybe there is a step missing, because I do all that, but nothing comes up in the run trace window, and the game doesn't break.

Maybe because I'm attatching the debugger after the game loads?
koyaan
03-11-2004, 03:59 AM
Hmm,

Maybe there is a step missing, because I do all that, but nothing comes up in the run trace window, and the game doesn't break.

Maybe because I'm attatching the debugger after the game loads?

if its only executed at startup :rolleyes:

try broadening the eip range


How to access CMOS ram
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > How to access CMOS ram
PDA

View Full Version : How to access CMOS ram

Aquatic
03-08-2004, 09:02 PM
Here is an interesting article that explains how to read/write CMOS ram.

http://www.programmersheaven.com/2/Art_C_1

I don't know if any useful code could be written to the CMOS. Doesn't Softice use the CMOS to become kernel-mode?
Kayaker
03-09-2004, 12:31 AM
I coded a MASM example of accessing the RTC/CMOS a while back, crashes on Win2K though. I think I remember you can't use IN/OUT anymore, but I think I also remember seeing a mention of someone getting around that, if I'm recalling things correctly. It was a shareware app of some kind, which of course I can't find now. Anyone know if there's a way to access the CMOS programatically on NT systems?

Little lame 9x example of reading the RTC clock

http://66.98.132.48/forum/showthread.php?t=2554&highlight=rtc+cmos
evaluator
03-09-2004, 01:26 AM
KmdKit10 there is example driver- Beeper..
also much easy driver can be done.
least
03-09-2004, 02:32 AM
I'm affraid that in CMOS can't be any kind of code since it is accessed through IN/OUT instructions; it is used to store info you see when you get in BIOS - so it is not good idea trying to write to it. To access it you'd probably need to write KMD right as evaluator says.


Marathon CD Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Marathon CD Protection
PDA

View Full Version : Marathon CD Protection

iris_2002
03-09-2004, 10:59 AM
Hello All

I have the demo CD of the latest CD protection of LAserLock "Marathon" I tried alot to make 1:1 copy using the trade tools, but I couldnot :confused:

I want to ask the experts of this forum if there is anyway to make a copy of the CD or even to crack it.

Thanks alot.
JMI
03-09-2004, 12:09 PM
iris_2002:

You are apparently so anxious to achieve your goal you failed to see, or at least read the BIG RED LETTERS at the top of the Forums and have not read the FAQ. This is not the place to come if you are looking for someone to do the work for you and/or if you have done nothing to try to help yourself solve your problem and shown some of your own work. Time for you to do some study and searching on your own and then ask a more focused question.

Regards,
iris_2002
03-09-2004, 12:15 PM
iris_2002:

You are apparently so anxious to achieve your goal you failed to see, or at least read the BIG RED LETTERS at the top of the Forums and have not read the FAQ. This is not the place to come if you are looking for someone to do the work for you and/or if you have done nothing to try to help yourself solve your problem and shown some of your own work. Time for you to do some study and searching on your own and then ask a more focused question.

Regards,

Thanks JMI
First of all, I did my best trying to copy the CD, I tried much with almost all the trade tools.
That is why I asked first if anyone can help me with copying it.

Else
i asked if it is possible to reverse it, or if anyone reversed it, I didnt ask anyone to do the job for me, I am just asked for GUIDLINES, and this is the newbie forum where I can ask such quistion (as I thought).

Thanks again MR. JMI
JMI
03-09-2004, 12:23 PM
iris_2002:

According to your statements, you haven't "TRIED" anything other than clicking on someone else's ready made tools to see if they will permit you to copy a relatively new copy-protection system. If you are trying to say you have examined the copy protection with a debugger, that is not what you have said. If you just want an answer to the question of whether it "can" be cracked, the answer is obviously "yes." Given enough time and talent, anything that runs on the computer can, eventually be broken. Whether or not someone has actually done this with this protection 'really" isn't your question. What you "really" want is someone to tell you how, or help you do that and until you show that you are actually "working" at defeating the protection system "yourself," you are not likely to find what you seek here.

Regards,
iris_2002
03-09-2004, 12:48 PM
Yes Mr. JMI

I am just tried with ready made tools for copying protected tools (I didnt say another thing).

I know also that any program is brekable with some time and effort.

As I am newbie, all what do I am asking about is a tutorial or any description of the laserlock protection for the newest or even old versions Also if there is anyway to copy the CD.

and for now, dont u have such material ? ;)

Anyway Thanks again.
JMI
03-09-2004, 02:03 PM
iris_2002:

It appears that all you want to do is argue with me, instead of doing what I suggested you do in my first post in this thread, which was that you READ THE BIG RED LETTERS at the top of the forums, including the FAQ and then do what it suggests. Among those suggestion is that you "SEARCH" for the answer to your question BEFORE you ask. Did you read any of the threads here which will be discovered by entering "laserlock" into the search button? Did you go on the net and enter "laserlock + crack*" in your favorite search engine, or do you expect someone to do that work for you?

What I am suggesting is that you demonstrate that you are not too lazy to do some simple searching on your own before you ask someone else to do that for you. No one appears to have written a tool for you to use to copy your CD so if you want to actually "learn" how to do that, you have a long road ahead of you. No one will simply take you by the hand and show you how to do that. At least not here.

Regards,
evlncrn8
03-09-2004, 02:04 PM
its crackable, iat/it needs repaired and exe can use the laserlok dll to do a cdcheck at any time in the game (kinda like securom+triggers)
Aimless
03-10-2004, 12:28 AM
Try www.gamecopyworld.com

Have Phun
iris_2002
03-11-2004, 10:04 AM
Thanks God

Thanks All for help

I did it yesterday, but I was not able to log to the forums, thanks all for help

bye.
esther
03-11-2004, 10:59 AM
>Try wootwhateverwanker.gamecopyworld.com

You didn't read the BIG READ LETTERS DON'T YOU!?!!!!
[NtSC]
03-16-2004, 01:09 PM
Be more specific on what Version of Marathon you have plz (v2/v3).
Some Infos should be available on that in the PE-File.

And what did you do by now to remove it at all ;)
evlncrn8
03-16-2004, 05:26 PM
']Be more specific on what Version of Marathon you have plz (v2/v3).
Some Infos should be available on that in the PE-File.

And what did you do by now to remove it at all ;)

think marathon is v3 or higher
[NtSC]
03-17-2004, 10:19 AM
Well.. I had 3 or 4 Marathon Protected Games/Apps with Marathon v2 / v3.
V2 / V3 require different Types of rebuilding / dumping and the Apps even had some more Improvements and also have been Laserlocked MSI Installers if i remind right.
evlncrn8
03-17-2004, 10:56 AM
']Well.. I had 3 or 4 Marathon Protected Games/Apps with Marathon v2 / v3.
V2 / V3 require different Types of rebuilding / dumping and the Apps even had some more Improvements and also have been Laserlocked MSI Installers if i remind right.

havent seen that many laserlok protected things tho the v2 and v3 i had didnt need any changes in dumping/rebuilding, except for the oones that used their pesky dll later on in the game, catch at critical moment dump, resume, catch at oep, dump.. compare dumps shows u the code that was changed for his 'floating imports'.. rebuild ;)
[NtSC]
03-17-2004, 01:56 PM
havent seen that many laserlok protected things tho the v2 and v3 i had didnt need any changes in dumping/rebuilding, except for the oones that used their pesky dll later on in the game, catch at critical moment dump, resume, catch at oep, dump.. compare dumps shows u the code that was changed for his 'floating imports'.. rebuild ;)

Indeed a good Way to find the relinked Instruction Addresses.
But for v2 for Example you have to code some Call/Jmp Resolver that will hook Laserlock Code and replace the Calls/Jmps to the Laserlock Wrapper with the Adress of its real ThunkEntry.
But but,its no real Fun at all ;)


A Troublesome DLL file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A Troublesome DLL file
PDA

View Full Version : A Troublesome DLL file

DaddyJTHC
03-09-2004, 08:33 PM
I have this software that uses a DLL file to validate a email & cdkey code. My only guess is that after a successfull verification it makes a registry entry that the installed software checks before using.

I can track the website this dll file visits, but cannot get it to return the data i wish for.
here is a link for the download of this dll file

I promise I will NOT violate the Rules again by posting a URL of a Target

any help would be most acceptable.
and thankfully accepted.
JMI
03-09-2004, 08:51 PM
DaddyJTHC:

How did you draw the impression that we had suspended the Rule against posting URLs for targets just for YOU???? These are matters that are supposed to be left to PM if someone ASKS you for a URL. Otherwise do not post them here. Please acknowledge that you have clearly understood this message.

Regards,
evlncrn8
03-09-2004, 08:58 PM
mebe he's color blind and didnt see the red lettering on the main page ;)

thats the excuse i'll use if i ever break the rules ;p

/me runs
Woodmann
03-09-2004, 09:17 PM
HAHAHAHAAHHAHAHAHAAA.........

YAYA, thats it, I'm color blind...
I like that answer, f'ing clever and witty :)

Could you please make the words size 60 font please :p
Oh shit, I just had a great idea :eek:
(watch for it in the near future)

-cbo-
JMI
03-09-2004, 09:25 PM
We could start a variation of the joke: "Here's your sign!" :D

Regards,
DaddyJTHC
03-10-2004, 08:22 PM
i didnt think they applied since the file is freeware, and it is a private server, but they your rules and i will follow.
JMI
03-10-2004, 09:48 PM
That is all we ask. We don't want to have to guess what may or maynot be commercial software.

Concept wise, your question makes no sense with this being "freeware." Why would the program check something on "freeware" and not get the correct information? Is this really "freeware" that can be upgraded and you simply haven't told us the truth?

Have you attempted to determine what the DLL is checking when it connects to the website and/or what information it is attempting to validate? There are programs which will tell you what passes between the DLL and the website and if it is freeware, it shouldn't be checking anything all that complex. If it is "freeware" it should be able to register itself and you should be able to use Filemon and/or Regmon to determine what it has done. So at this point your story does not seem to be holding together. If, in fact, you have an email addy and a CDKey already, why don't you "register" your "freeware" and then use one of the many available programs to detail for you exactly what has changes in you register?????? :rolleyes:

Regards,
Woodmann
03-10-2004, 10:22 PM
OWWWWWWWWWWW....

To quote someone else who's name escape's me,

Wrong move dude.

-cbo-
DaddyJTHC
03-11-2004, 08:03 PM
well told, and thanks for the proper azz chewing, you've taken my words, and i didnt explain myself clearly. The program is not freeware, the verification DLL is an open source protection scheme, so i considered that freeware. modified for use of the program. but thanks anyway.
JMI
03-11-2004, 09:22 PM
So where we end up is:

1.) You did not start out telling the truth;

2.) Then you only tried to argue with me and ignored some advise which was suggested to you as to how to attempt to determine what was happening with your program after it connected with the server, and finally,

3.) You once again attempt to justify your untruth, deception, and flagrant violation of our Rules because YOU considered it "freeware" because it "used a variation of an open source protection system."

How truely and utterly pathetic.

Regards,
esther
03-11-2004, 11:49 PM
>thanks for the proper azz chewing

:eek: You did it to JMI!?!!!
DaddyJTHC
03-12-2004, 08:22 AM
More pathetic and childish personal flames removed. Can personal banning be far behind?
Kayaker
03-12-2004, 03:27 PM
Somehow I'm reminded of a sign above the photocopier at work...:p

WARNING!

This machine is subject to breakdowns during periods of critical need.

A special circuit in the machine called a 'critical detector' senses the operator's emotional state in terms of how desperate he or she is to use the machine. The 'critical detector' then creates a malfunction proportional to the desperation of the operator. Threatening the machine with violence only aggravates the situation. Likewise, attempts to use another machine may cause it to also malfunction. They belong to the same union. Stay cool and say nice things to the machine. Nothing else seems to work. Never let anything mechanical know you are in a hurry.
JMI
03-12-2004, 03:44 PM
Actually DaddyJTHC has now posted three threads here attempting to have someone solve his inability to determine how this "freeware" VISE Dll manages its email/cdkey/online validation. He even said in one that he had purchased a legal copy of the software and was complaining that it "only" allowed five installs. It seems he is so desparate to get his music career going that he can't "afford" to tell the truth. :eek:

He also apparently doesn't seem to understand that we can easily edit out those portions of his "gansta rap" attitude that he attempts to post here to impress his "homeys." :rolleyes: But he's obviously still very young and maybe he'll grow out of it, or at least realize his attitude has not impressed anyone here.

Regards,
DaddyJTHC
03-13-2004, 10:08 AM
As per JMI, I will keep this post proper, listing everything i have tried, and progresed onto this work.

I can see the data being sent, and even change the data being sent. The only problem is there is a perl script on the server. What is the most effective way to view a .pl file on an apache web server.

A side note.
JMI please accept this thread, I'm only asking for help, I am working on the actual problem.
nikolatesla20
03-13-2004, 10:31 AM
All you have to do is set up your own web server, (read some docs and throw up a basic server on your Local Machine)

Then, if you know the website, for example, www.blather.com, you go to "C:\windows\system32\drivers\etc" (this is the path on 2000/XP) and you will find a file name "hosts" (there is no file extension on it). Open this file in Notepad and add a line

127.0.0.1 www.blather.com

THis makes your system resolve blather.com to your local machine instead of asking a DNS server. Then, the application will unwittingly be going to your own web server. Now, if you know the page it's going to, just set up a similar path and page name on your own web server, and change the data (the page) that comes back so it's what it needs to be.

Simple.

-nt20
JMI
03-13-2004, 10:33 AM
Partial Attitude Adjustment noted.

I have taken the liberty of merging this with your most recent thread and will include a reference to the others of this series. Part of the problem is that you keep making new threads when you are still talking about the same original problem and you really provide insufficient information each time you restart the discussion.

For anyone who may be interested, he has a protection system that uses a DLL file to validate a email/cdkey/online registration system and he has to connect to a remote server to validate his online registration. He has now apparently determined that it runs a perl script to vaildate his target and he thinks he wants to "read" it on the remote server.

If you are interested, you can review his other threads on this same topic at:

http://66.98.132.48/forum/showthread.php?t=5590

and

http://66.98.132.48/forum/showthread.php?t=5600

You mentioned in one of these prior posts you still have one working version on another machine. Have you, by any chance, attempted to run a file comparer on the "good' version and a "not good" version to determine any differences and to see this "perl script" changed anything on your file?

And "Daddy Jiggles, The Hemp Clown," you are not going to win any points here (except maybe with your homeys) by pointing out typos in my posts. Everyone but you already knew I make typos and can't spell. :rolleyes: You STILL aren't paying attention to the fact that I can edit or delete your posts at will, but you've already demonstrated you learn very slowly.

Regards,
DaddyJTHC
03-13-2004, 10:41 AM
I am in the process of doing this, using regmon & filemon, the program itself doesnt do an online check after the first time.
I'm still comparing the lists.

Side note.
I'm sorry for making new threads, I will cease. Thank you for your patience.
DJ
JMI
03-13-2004, 10:59 AM
If you are wading through a regmon log file you might find this thread useful:

http://66.98.132.48/forum/showthread.php?t=4162

Kayaker wrote a tool to reduce the duplicates in the log to make finding what one may be seeking easier.

Again, refering to your earlier posts, if you have five "valid" re-installs, there has to be a countdown entry for the server to check against. Each time you re-install, it has to reduce this "entry" by one and to check it, there most likely has to be a compare instruction in the checking routine.

Regards,
DaddyJTHC
03-13-2004, 11:18 AM
I agree totally, I've pretty much chopped there webserver up looking for an answer. Basically as far as I can gather, each install get added into there database.(I couldnt find it) BUT After the intial check it doesnt make anymore attempts to verify. Either a file is downloaded or a registry entry is made. I havent determined which of the 2 is true.

Thanks for that link, it will help.
JMI
03-13-2004, 02:59 PM
And another thought:

You are aware, are you not, that VISE offers not only free copies of its software for downloading, it offers free copies of its User's Guide for downloading. Anytime you are attempting to reverse a protection system, it is a very good practice to obtain as much information as possible about how the maker describes its workings.

They also have a set of examples for the 3.1 version, including documentation and examples, for things like:
Default Install Location
Default Registration Info
Does Registry Key Exist
Uninstall Existing App

It is also a fairly good probability that the program itself is protected by the same general systems they offer to their customers. One of the things included in the program is an updater, which includes a reg snapshot and difference comparison tool which maps all the changes made to your system with the installation of the program protected by their products.

Regards,
JMI
03-13-2004, 08:38 PM
And yet another thought.....

Have you, by any chance examined the dll with IDA? There are some references to two CLSID's where your counter and/or validation might be hiding. There are also references to "AppKey," "SingleKey," and "Last Key." And have you looked at the .inx file which comes with the Release program? The one with the demo only refers to the "free version" and I suspect that they might have learned the lesson that the only safe demo is an incomplete one. However, if you reviewed the Manual for Vise and compared the .inx file for the "free" demo to the Actual Progrom which you still have on one of your machines, I believe you would find useful information by doing a compare of the two files.

Regards,
DaddyJTHC
03-14-2004, 01:02 AM
However, if you reviewed the Manual for Vise and compared the .inx file for the "free" demo to the Actual Progrom which you still have on one of your machines, I believe you would find useful information by doing a compare of the two files.

I will definitly check this, I have view the dll in IDA, I could understand most of it. I will do this now.

Thanks for the info.
DJ
JMI
03-14-2004, 01:46 AM
I did notice that the DLL had string compare functions and writes to a particular CLSID. Have you checked that one for the "good boy/bad cracker" and/or declining installs?

Regards,
DaddyJTHC
03-14-2004, 01:52 PM
All you have to do is set up your own web server,
I have a local server, and can get it to connect to it, but i dont know the information that gets returned, if only it were that simple.
DaddyJTHC
03-14-2004, 02:01 PM
writes to a particular CLSID.
I have notcied this, and have spent alot of time in my registry lately, the machine that has it installed finds the key and queries it according to regmon
QueryKey HKCR\CLSID\{B43CCF60-CE86-11d3-BDF4-00902745D0A9} SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B43CCF60-CE86-11d3-BDF4-00902745D0A9}
then again
QueryValue HKCR\CLSID\{B43CCF60-CE86-11d3-BDF4-00902745D0A9}\ApartmentModel SUCCESS 99 D2 32 19 01 3C 28 47

So how can I now, convert this into a registry entry?
JMI
03-14-2004, 05:16 PM
DaddyJTHC:

There are a number of things going with this install and you do not seem to be approaching them "logically" and/or sequencially. You have a DLL which identifies itself as VISE and you have a "setup.inx" file. Are you aware that the ".inx" is an Installshield script? Have you decompiled it and looked at the code for the "free version" as compared to the "purchased version" like I suggested? Assuming you have original install disks or the original install package, simply starting it and letting it run to the point where it asks you for the serial number will provide the needed files in you temp directory, as you have already discovered. You can simply copy them to another folder before you chose "Cancel" and close out the program. There are decompliers that will disassemble these ".inx" files very effectively and can be found on various tool sites with a search in your favorite search engine. WHERE to find it is NOT something you are supposed to ask here.

You said the purchased version has only five installs. Well, obviously, it has to keep track of how many installs you have had "somewhere." This code has to be recorded in a "reg" file or a temp file or a registry entry. Assuming the possibility it is a registry entry, you need to look for code in the ".inx" and/or DLL file that WRITES to a registry entry or writes somewhere else.

We can also assume that the vendor needs some way to "know" how many instally you have/had so they do not validate an attempt in excess of their limit. We can also assume, if they arent' completely incompetent, that they have a mechanism to check that it is not installed "five times" on as many different machines as you want to put it on. So you can expect and look for information that determines your Volumn ID information and/or HD and/or CD identification and/or OS information and something that may send this information to their server and/or writes it someplace on your machine. I see in the DLL and the INX file references to date parameters and their server could easily store the date of first-through fifth installs by recording these type of dates from where they are recorded on your machine.

Now you know that the DLL has references to TWO different CLSID keys. Do you know whether it writes to both or only one? If it writes to only one, does their server write to the other? Have you logged what goes OUT when you log on to their server? Or were you only thinking about what came IN? You regmon entries should show you what was QUERIED and what was SET and may even show by whom.

Another good place to look may be in the comparison of the registration checking function for the "free version" vs. the "purchased version." In the "free version" there is a StrCompare(global_string15, "521-1217-00004") which is supposed to be "local_number6 = (local_number6 != 0)" and if the result doesn't equal "0"

if(local_number6) then // ref index: 1
@00004F8C:0021 MessageBox("Invalid license key. Please re-enter.", -65534);
@00004FC0:0005 goto label_4df4;

which goes back to the enter password screen. Your "valid" password for your install may be hard coded in your "purchased version" .inx file, and if it is, this would suggest that their server is really checking the number of installs recorded against that serial number. Finding where this data is stored on your machine and what part of the DLL and/or .inx file access it should lead to where they check and should reveal what the proper result code might be for the "good-boy" result.

Regards,
DaddyJTHC
03-14-2004, 06:38 PM
Have you logged what goes OUT when you log on to their server?

Yes when reporting to thier server. It transmit the folloing information
email|cdkey|machineid
in a custom hex-let hash format.

this in turn causes the page to be returned
DPERROR:1 Key used to many times!

So based off what you have said, during install the program could download a different setup.inx if the cdkey verification process succeeds.
DaddyJTHC
03-14-2004, 06:48 PM
Another thing I have noticed is the frequest usage of the NTUSER.DAT.LOG file, is this common to use this file?
JMI
03-14-2004, 08:21 PM
OK. That tells you the server keeps track of the number of times the serial number is installed and probably checks for which email address and machineID, but it could just validate it five times regardless.

You need to answer some questions:

1.) Does the "purchased" version comes with a different ".inx" file and/or do you know whether or not it has the same dll file.

2.) How did you receive it? Do you purchase it on line and receive disks, or was it sent to you by email or download from their server?

3.) Do you have a copy of the original install exe on one of your machines? If so, what is it's size in KBs?

4.) When you get the error message "1 Key used to many times" does the install stop altogether, or does it just install the "free" version? I do not find that error message in either the "free" ".inx" or Dll files.

5.) Do you have a copy of the "purchased" ."inx" file and have you decompiled and compared it to the "free" version? Does that error message appear in its text?

6.) On the machine where it is still running, have you tried to get an update and if you try, make sure to record what is sent and received.

7.) I assume that Q5MDB-A5CG-YZEY-APBD9 was the hash of the original serial. Is that correct?

8.) What are the entries on the working copy for the A88A6800 Key and for the B43CCF60 Key, as shown in RegEdit? Do you have another copy installed on another machine you can compare those entries against?

Regards,
DaddyJTHC
03-14-2004, 08:41 PM
1.) Does the "purchased" version comes with a different ".inx" file and/or do you know whether or not it has the same dll file.
There is no free demo of this version of software.

2.) How did you receive it? Do you purchase it on line and receive disks, or was it sent to you by email or download from their server?
Download from there server.

3.) Do you have a copy of the original install exe on one of your machines? If so, what is it's size in KBs?
Both EXE's are the same.

4.) When you get the error message "1 Key used to many times" does the install stop altogether, or does it just install the "free" version? I do not find that error message in either the "free" ".inx" or Dll files.
No it resets the fields. during install. If you use the modified dll to install, the program will display the error, and terminate. THERE IS however a hacked version of this software, but it displays a 421 Sound Error, then terminates.

5.) Do you have a copy of the "purchased" ."inx" file and have you decompiled and compared it to the "free" version? Does that error message appear in its text?
Yes both are the same.

6.) On the machine where it is still running, have you tried to get an update and if you try, make sure to record what is sent and received.
No updates for the program exist.

7.) I assume that Q5MDB-A5CG-YZEY-APBD9 was the hash of the original serial. Is that correct?
That is my orignal cdkey yes.

8.) What are the entries on the working copy for the A88A6800 Key and for the B43CCF60 Key, as shown in RegEdit? Do you have another copy installed on another machine you can compare those entries against?
The machine is no longer at my house, so I am a little slow about getting this information, I have regmon logs, and am looking thru them now as I type.
DaddyJTHC
03-14-2004, 08:44 PM
This is the only key found in the regmon log on the machine that has it installed.

HKCR\CLSID\{B43CCF60-CE86-11d3-BDF4-00902745D0A9} SUCCESS
Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B43CCF60-CE86-11d3-BDF4-00902745D0A9}

HKCR\CLSID\{B43CCF60-CE86-11d3-BDF4-00902745D0A9}\ApartmentModel SUCCESS 99 D2 32 19 01 3C 28 47
JMI
03-14-2004, 08:59 PM
DaddyJTHC:

If you want to put the original exe up where you had it posted before (without reposting the URL) I'll download it and take a look. The whole exe would be best, but I need at least the DLL and the .inx file for the program, because the one I have from the company is the free demo.
If you want to do that, PM me and I'll download it and then you can take it down again.

Regards,
JMI
03-14-2004, 09:20 PM
DaddyJTHC:

Download completed. You can take it down now. I failed to notice the single letter difference between the file I down loaded and the one you have. Happens when your eyes get older. :D Looking back over your other threads, I also notice that while the B43CCF60 Key appears to be the same, I failed to notice that the A88A6800 key did not match your programs second CLSID. However that may suggest good things for further review. I'll take a look at the material and report when I've had a chance to look at it. I might also at some point need the non-working DLL, although sgdt's post suggests where it might be different.

Do you know if he may have only been looking at the "free version" also, but his discussion it is of that version, and not yours?

Edit: Now that I've had time to unrar it, I see the other files are included. Thanks. Always good to plan ahead. :D

Regards,
DaddyJTHC
03-14-2004, 09:26 PM
DaddyJTHC:

Edit: Now that I've had time to unrar it, I see the other files are included. Thanks. Always good to plan ahead. :D

For as long as I have been dealing with this, I am just glad someone will take the time to look.
JMI
03-14-2004, 10:28 PM
DaddyJTHC:

A few random thoughts from my quick review so far. First I believe I can say that the error code returned does not exist in either the .inx or the dll file. I've only begun to scratch the surface, but have an idea worth pursuing. The "ApartmentModel SUCCESS 99 D2 32 19 01 3C 28 47" may be more significant than I understand. Doing a little parallel research on the M$ site and here and the "ApartmentModel" seems to be an indicator of a COM object which may, and I emphasis may, indicate that such an object was downloaded by the server. This is mostly guesses at the moment. Some discussion of COM objects is found here:
http://66.98.132.48/forum/showthread.php?t=5437

Frankly, I don't know a hell of a lot about COM objects (OK really almost nothing), even to know if my guess may be in the right direction, but it sure would be interesting if we can locate a COM object on the machine with the working program that is somehow related to that "99 D2 32 19 01 3C 28 47" listing. Now just have to figure out how to find such things. More research required. I need to take a break and get some food and then I'll do some more research and review some more code. Might not post again until tomorrow. Thanks for the interesting progect. Maybe someone with more knowledge about COMs and where they hide will chime in. :)

Have you seen any reference to any COM files in the regmon printout?

Regards,

Regards,
DaddyJTHC
03-14-2004, 10:47 PM
indicate that such an object was downloaded by the server. This is mostly gussess at the moment.
This may be the case, as after further investagation, the working machine doesnt ever check online to see if the cdkey is valid. I've tried many different attempts to recreate that registry entry (NO LUCK). As far as the logs go, I can send them. I have the REG & file logs for both the Non-Working, and the Working Computer.

Another thing you noted that the error wasnt in the dll file. I do beg to differ there (I could be wrong). When I viewed the DLL in WDASM, and went into string refs. I could see the error listed in there. Under the format of
String Resource ID=00116
"Cannot install. This %s key has been used to many times."
Line 10576 pg 132 and 133 of 516.

If you look at the MODed .EXE it does bypass this check, but get held on the 421 Sound Card Error. Is there any light there to bypass ?
DaddyJTHC
03-14-2004, 11:24 PM
Noticed something odd in the regmon logs:
:Working Machine:
OpenKey HKCU\CLSID SUCCESS Key: 0xE18E2B20
QueryKey HKCU\CLSID SUCCESS Name: \REGISTRY\USER\S-1-5-21-73586283-789336058-839522115-1003_CLASSES\CLSID
OpenKey HKCR\CLSID SUCCESS Key: 0xE16B5640
CloseKey HKCR\CLSID SUCCESS Key: 0xE16B5640
It doesnt query the HKCR

:NON Working Machine:
OpenKey HKCU\CLSID NOTFOUND
OpenKey HKCR\CLSID SUCCESS Key: 0xE4039180
QueryKey HKCR\CLSID SUCCESS Name: \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID

Any signifigance here?
JMI
03-14-2004, 11:58 PM
Hey DaddyJTHC:

You'r not suggesting that I made a mistake are you? That would be the first one I ever made....so far this evening. :D It is somewhat curious, though. I am using IDA, as I'm running XP SP2 and haven't gotten WDSAM to work on my box. I have reviewed the IDA string references many times and don't see that listing. I have now checked the DLL with a text editor and do find the string at 1A882 but haven't figured out why they don't show up in IDA yet. :rolleyes:

I can see two possiblilities for copying but first we need to identify exactly what it refers to because it would do no good to have an entry without the corresponding COM object. Perhaps you could do a search of the machine that works and the one that doesn't for ".com" files and maybe we can identify what was installed. I need to figure out how to configure this version of IDA so it recognizes these strings.

Regards,
DaddyJTHC
03-15-2004, 12:36 AM
I'm running XP SP2 and haven't gotten WDSAM to work on my box.
The version of wdasm I have runs fine on both my 2003 server box, and my xpsp1 box. It is version 8.9.

I will do a search on that machine next time I get a chance for the .com Object.

Also about the two CLSID's

the A6 one isnt useful to us. It is to verify addons to the program. We need to stick with just the B4 CLSID , that one is definitly the more important of the two.
JMI
03-16-2004, 01:17 AM
DaddyJTHC:

Haven't had too much time with the program today, but do have a few interesting observations from the dead listing.

Public Entry of the DLL occurs at ViseEntry =10003E0A. At ViseEntry + 14A there is a reference to sub_100023B8 with a CODE XREF: sub_10001E1B+504.

Most of the relevant action seems to be connected with subroutines which begins at 10001E1B. This subroutine has reference to DPERROR at 1E1B + 20A1. Which is the “error code” format returned by the server.

We suspect that the "ApartmentModel" registry entry is important. There are calls related both to the "query", "creation", and "setting" of the Key at around 1E1B+ 504. ViseEntry + 14A calls 10001E1B + 504 which opens and queries the ApartmentModel Key at sub_100023B8.

10001E1B+4FA calls sub_10002476.

There are two calls to RegCreateKeyExA at 1002476 + 21 and at + 38. There are two calls to RegSetValueExA at 10002476 + 15C and at 10003DB3 + 44.

Only the Subroutines at 10002476 deals with "creating" and "setting" of an "ApartmentModel" Key. 2476 + 21 calls RegCreateKeyExA and 2474 + 15C calls RegSetValueExA in relation to an “ApartmentModel”.

ViseEntry + 1A7 calls sub_ 10001125 which alternatively "moves" 6, 5, 4, 3, 2, 1, and then has an "and" of 0. Each of these in turn goes to 1000D145. This may be the test of the returned number of "installs" returned from the server

So some further study of the dead listing should, hopefully lead to further isolation and understanding of these routines.

Regards,
nikolatesla20
03-16-2004, 08:33 AM
w00t COM reversing I love...

Anyway, if it IS com it doesn't necessarily have to be on your machine, DCOM can create an object remotely over the internet. However, I doubt this is the actual case.

Wow I wouldn't mind looking at this in my spare time-

nikolatesla20_at_yahoo_D-O-T_com.

-nt20
Tolstoinisten
03-16-2004, 11:11 AM
I need to figure out how to configure this version of IDA so it recognizes these strings.

Did you find out what caused this "error", JMI?

Sorry to budge in like this. It is very interresting read, but it would be nice to know what caused the error, so something like this doesn't happen with my version of IDA.

Cheerz,
DaddyJTHC
03-18-2004, 07:57 PM
JMI:

I have searched the working computer over, and either do not know how to look, or didnt find anything.
Both computers make a reg entry to the tk421.dll file. I'm currently examing this file for any relavance, although I believe it is more of an "audio related nature". No luck on much of anything else, will keep posted.

DJ
DaddyJTHC
03-20-2004, 10:48 PM
w00t COM reversing I love...

Anyway, if it IS com it doesn't necessarily have to be on your machine, DCOM can create an object remotely over the internet. However, I doubt this is the actual case.

Wow I wouldn't mind looking at this in my spare time-

nikolatesla20_at_yahoo_D-O-T_com.

-nt20
pm me for more info if your interested in helping!
DJ
The Svin
03-23-2004, 10:33 AM
... and flagrant violation of...
What does flagrant mean?
dELTA
03-23-2004, 12:12 PM
http://dictionary.reference.com/search?q=flagrant

Also, please use the "quote" functionality of the board when quoting people, instead of just making the quoted text italic, it is much less confusing.
DaddyJTHC
03-24-2004, 05:44 PM
Hey JMI, any luck with anything?
JMI
03-24-2004, 06:42 PM
I have been out of town for a few days and haven't gotten back to it yet. Will try again soon.

Regards,
DaddyJTHC
03-24-2004, 09:01 PM
Thats okay, just didnt hear anything from anyone. Glad your back, hope it was recreational.

DJ
JMI
03-25-2004, 01:04 PM
DaddyJTHC:

While you are "waiting" for me, did you look at those code sections which i mentioned back on March 16 which write the ApartmentModel entry and or try to further trace the code at ViseEntry + 1A7 calls sub_ 10001125 which alternatively "moves" 6, 5, 4, 3, 2, 1, and then has an "and" of 0. Each of these in turn goes to 1000D145. I stated this may be the test of the returned number of "installs" returned from the server.

It is interesting that there are two setup files in the two folders created in the temp folder when the program starts up and before it connects to the company server. We need to find the code which reads whatever response is sent back and then follow what it does with it.

Also have you tried exporting the ApartmentModel key in regedit and importing it into the registry of the machine where the program doesn't work?

I also noticed that when trying to run the MOD version, it is asking for a rmbe3260.dll from RealProducer. I haven't taken apart the Installshield exe yet to see if it is included.

I suspect that once the server sends back whatever confirmation it does when it determines whether there have been more than five installs, it simply proceeds with the install, unpacks the install program and inserts the CSLID key as part of the setup instructions. Obviously more study is required, but you should be studying this code also.

Regards,
DaddyJTHC
03-25-2004, 04:01 PM
Yes, I have been studying this code, although I am not the greatest. Yes I have done a complete registry dump of the working machine, and imported into the non-working machine, still same error. I also believe recently that the company has eliminated my key, as now I am getting "Invalid Key Error". As I have previously stated, I dont have direct access to the working machine, so that is the reasoning between the slow updates.

I have noticed the coding you were refering to 6,5,4,3,2,1 , and have tried a few NOP commands with no luck. I also was tracing back the errors, and seem to get "Windows must close this program" alot when I try and bypass them.

As far as the server goes, I cant say that anything actually gets downloaded because I didnt ever check while I was installing with a valid key.

I have made several attempts to contact the company to get a replacement key, so hopefully that might work out.
I'll keep you updated, Thanks for the lookout advise.

DJ
DaddyJTHC
04-05-2004, 01:24 PM
After furthur review, and the loss of my software. I am attempting one last snapshot of the working version. Results:
Software installed 09-05-99
Serial - Valid
Validation - Success
This software does not have access to internet, but did at time of registration
if nointernet but validation then success else failure

Non-working version. Results:
Software installed 09-05-99
Serial - Valid
Validation - Success
I have disabled this software's access to the internet.
Still caues failure return.

Software install form - Downloadable from online shopping cart.
Software Protection - In form of company DLL. -Can Bypass This but believe is incorrectly preformed.
Other Software Protection - Database entrys on companys local webserver.
Protection Data - Email & CdKEY Combination = encoded hexlet string e.g.
myemail.com|CdKey|SoftwareID or even MachineID = 9e9af73
Returns Validation Key is success. - Can Bypass this.

Installed Software makes final check of validation via internet. If internet isnt present the software will scream at you. Once the software makes this final check it no longer requires the internet.

Since I can no longer install this software correctly, I must use the working machine as a drive tool, but do not have direct access to it for long periods of time.

I have Filemon and Regmon the working computer, and imported the entire registry. No Success.

We were last looking for a COM Object in the ApartmentModel ? What would be the correct way to search for this. I am in-experienced when it comes to those.

Of coursed I have checked p2p software for working cracks, there is one, but produces a "sound card error" on every machine.

I have searched far and wide, and have gotten the most help here, thanks to JMI & Sarge, and believe there is an answer within site. Please dont be scared to help. :)
JMI
04-14-2004, 07:07 PM
DaddyJTHC:

Been very busy of late and haven't had much chance to play with the program. Did run the MOD version through PE Explorer and IDA, however, and noticed some interesting information. I noticed you are lurking on the Board and will add to this in a moment, when I locate my notes.

In my post of 3-15 I discussed the portion of the Vise DLL which contained the following code:

"ViseEntry + 1A7 calls sub_ 10001125 which alternatively "moves" 6, 5, 4, 3, 2, 1, and then has an "and" of 0. Each of these in turn goes to 1000D145. This may be the test of the returned number of "installs" returned from the server."

Looking at the Mod version of the file with PE Explorer I located the following:

0046A19F L0046A19F:
0046A19F C705AC525D0001001085 mov dword ptr [L005D52AC],85100001h
0046A1A9 E822F6FFFF call SUB_L004697D0
0046A1AE 8B0D4CEF5C00 mov ecx,[L005CEF4C]
0046A1B4 894C2404 mov [esp+04h],ecx
0046A1B8 83F806 cmp eax,00000006h
0046A1BB C644244401 mov byte ptr [esp+44h],01h
0046A1C0 773F ja L0046A201
0046A1C2 FF248534A24600 jmp [CASE_PROCTABLE_0046A234+eax*4]
0046A1C9 CASE_0046A234_PROC0000:
0046A1C9 6810FD5900 push SSZ0059FD10_Application_validated
0046A1CE EB28 jmp L0046A1F8
0046A1D0 CASE_0046A234_PROC0001:
0046A1D0 68F4FC5900 push SSZ0059FCF4_Validation_Failed__Bad_Key
0046A1D5 EB21 jmp L0046A1F8
0046A1D7 CASE_0046A234_PROC0002:
0046A1D7 68D4FC5900 push SSZ0059FCD4_Validation_Failed__Key_Overuse
0046A1DC EB1A jmp L0046A1F8
0046A1DE CASE_0046A234_PROC0003:
0046A1DE 68B0FC5900 push SSZ0059FCB0_Validation_Failed__Email_mismatc
0046A1E3 EB13 jmp L0046A1F8
0046A1E5 CASE_0046A234_PROC0004:
0046A1E5 6890FC5900 push SSZ0059FC90_Validation_Failed__ID_mismatch
0046A1EA EB0C jmp L0046A1F8
0046A1EC CASE_0046A234_PROC0005:
0046A1EC 6874FC5900 push SSZ0059FC74_Validation_Failed__Unknown
0046A1F1 EB05 jmp L0046A1F8
0046A1F3 CASE_0046A234_PROC0006:
0046A1F3 6848FC5900 push SSZ0059FC48_Validation_Failed__No_Internet_C
0046A1F8 L0046A1F8:
0046A1F8 8D4C2408 lea ecx,[esp+08h]
0046A1FC E873DE0E00 call SUB_L00558074
0046A201 L0046A201:
0046A201 8D4C2404 lea ecx,[esp+04h]
0046A205 C644244400 mov byte ptr [esp+44h],00h
0046A20A E828DD0E00 call SUB_L00557F37
0046A20F 8D4C2408 lea ecx,[esp+08h]
0046A213 C7442444FFFFFFFF mov dword ptr [esp+44h],FFFFFFFFh
0046A21B E8E0B7FEFF call SUB_L00455A00
0046A220 8B4C243C mov ecx,[esp+3Ch]
0046A224 8BC6 mov eax,esi
0046A226 5E pop esi
0046A227 64890D00000000 mov fs:[00000000h],ecx
0046A22E 83C444 add esp,00000044h
0046A231 C3 retn
;----------------------------------------------------------------------------------------------------

;----------------------------------------------------------------------------------------------------
0046A232 8BFF Align 4
0046A234 CASE_PROCTABLE_0046A234:
0046A234 C9A14600 dd CASE_0046A234_PROC0000
0046A238 D0A14600 dd CASE_0046A234_PROC0001
0046A23C D7A14600 dd CASE_0046A234_PROC0002
0046A240 DEA14600 dd CASE_0046A234_PROC0003
0046A244 E5A14600 dd CASE_0046A234_PROC0004
0046A248 ECA14600 dd CASE_0046A234_PROC0005
0046A24C F3A14600 dd CASE_0046A234_PROC0006
0046A250 SUB_L0046A250:
0046A250 6AFF push FFFFFFFFh
0046A252 6825D35600 push L0056D325
0046A257 64A100000000 mov eax,fs:[00000000h]
0046A25D 50 push eax
0046A25E 64892500000000 mov fs:[00000000h],esp
0046A265 81EC0C010000 sub esp,0000010Ch
0046A26B A14CEF5C00 mov eax,[L005CEF4C]
0046A270 56 push esi
0046A271 C744240800000000 mov dword ptr [esp+08h],00000000h
0046A279 89442404 mov [esp+04h],eax
0046A27D 8B942424010000 mov edx,[esp+00000124h]
0046A284 A160685D00 mov eax,[L005D6860]
0046A289 8D4C240C lea ecx,[esp+0Ch]
0046A28D 6804010000 push 00000104h
0046A292 51 push ecx
0046A293 52 push edx
0046A294 50 push eax
0046A295 C7842428010000010000+ mov dword ptr [esp+00000128h],00000001h
0046A2A0 FF1574655700 call [USER32.dll!LoadStringA]
0046A2A6 8D4C240C lea ecx,[esp+0Ch]
0046A2AA 51 push ecx
0046A2AB 8D4C2408 lea ecx,[esp+08h]
0046A2AF E8C0DD0E00 call SUB_L00558074
0046A2B4 8BB42420010000 mov esi,[esp+00000120h]
0046A2BB 8D542404 lea edx,[esp+04h]
0046A2BF 52 push edx
0046A2C0 8BCE mov ecx,esi
0046A2C2 E8E5D90E00 call SUB_L00557CAC
0046A2C7 C744240801000000 mov dword ptr [esp+08h],00000001h
0046A2CF 8D4C2404 lea ecx,[esp+04h]
0046A2D3 C684241801000000 mov byte ptr [esp+00000118h],00h
0046A2DB E857DC0E00 call SUB_L00557F37
0046A2E0 8B8C2410010000 mov ecx,[esp+00000110h]
0046A2E7 8BC6 mov eax,esi
0046A2E9 5E pop esi
0046A2EA 64890D00000000 mov fs:[00000000h],ecx
0046A2F1 81C418010000 add esp,00000118h
0046A2F7 C3 retn
;----------------------------------------------------------------------------------------------------

00558074 SUB_L00558074:
00558074 56 push esi
00558075 57 push edi
00558076 8B7C240C mov edi,[esp+0Ch]
0055807A 8BF1 mov esi,ecx
0055807C 85FF test edi,edi
0055807E 7504 jnz L00558084
00558080 33C0 xor eax,eax
00558082 EB07 jmp L0055808B
00558084 L00558084:
00558084 57 push edi
00558085 FF1564615700 call [KERNEL32.dll!lstrlenA]
0055808B L0055808B:
0055808B 57 push edi
0055808C 50 push eax
0055808D 8BCE mov ecx,esi
0055808F E863FFFFFF call SUB_L00557FF7
00558094 8BC6 mov eax,esi
00558096 5F pop edi
00558097 5E pop esi
00558098 C20400 retn 0004h
00557FF7 SUB_L00557FF7:
00557FF7 56 push esi
00557FF8 57 push edi
00557FF9 8B7C240C mov edi,[esp+0Ch]
00557FFD 8BF1 mov esi,ecx
00557FFF 57 push edi
00558000 E809FFFFFF call SUB_L00557F0E
00558005 57 push edi
00558006 FF742414 push [esp+14h]
0055800A FF36 push [esi]
0055800C E89F1BFEFF call SUB_L00539BB0
00558011 8B06 mov eax,[esi]
00558013 83C40C add esp,0000000Ch
00558016 8978F8 mov [eax-08h],edi
00558019 8B06 mov eax,[esi]
0055801B 80243800 and byte ptr [eax+edi],00h
0055801F 5F pop edi
00558020 5E pop esi
00558021 C20800 retn 0008h

What this shows is that the return of "0" leads to the:

push SSZ0059FD10_Application_validated
0046A1CE EB28 jmp L0046A1F8

section of the code and is where the Code has to end up if it is validated by what has been returned from the server.

Have you traced the MOD version in Softice and found the point where it failed? I still suspect that it is failing because of the absense of the COM entry we previously discussed.

Have you done a "file compare" on the working exe vs. the MOD exe to see what was changed and where?

Hope to have some more time to play with it soon.

Regards,

Regards,
DaddyJTHC
04-15-2004, 06:55 PM
Interesting,
yes i have traced the mod version, and it fails on a sound card 421 error. this may have something to do with the com object as you have stated. I myself have been busy also, but i hope to have some time this weekend to have access to the working machine so i can try and capute the whole system state, and restore it to mine, that way i can have more play time with it.

Thanks much.
Daddyj


Need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help
PDA

View Full Version : Need help

Razor
03-08-2004, 10:54 PM
Hello,

I am a newbie cracker, done some stuff in the past but right now i got a problem with unpacking and cracking an app packed with the newest version of Asprotect, i need someone to help me out or do the whole thing, ofcourse i am willing to cut some kind of deal with however is willing to help me out :D

Thank You!

aim: ?
icq: th1515vERYl@m3
Kayaker
03-09-2004, 09:59 PM
OK, by popular demand, the thread normally deleted at this time has been undeleted.

THIS is the reason for the BFRL (BIG F** RED LETTERS), and the plaintive yet mostly unheeded pleas to READ the BFRL. It has less to do with protecting the board from outside complaints and more to do with protecting the members from these types of posts. Imagine if you will a board *filled* with these types of requests, with target names and download links in every post, with a class of members ready to greet posters of this calibre with open arms, eager to supply a ready crack. Oh what a recipe for the lamest board around...

So is there madness to the Boards' policy and attempts to elevate the quality of reading material contained herein, or just a tight-assed approach to running a reversing forum? You decide.

To the original poster...I think there is a bus coming for you...
Woodmann
03-09-2004, 10:35 PM
i need someone to help me out or do the whole thing

The bus is here :eek:
Aimless
03-10-2004, 12:27 AM
Wrong move kid.

You may try cracking normal apps first. Asprotect gives ulcers to the best of them. Maybe in about 2-3 years?

Have Phun


softice question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > softice question
PDA

View Full Version : softice question

deadbeef
03-10-2004, 05:19 AM
hi all,

maybe someone has an idea for my problem.

in former times i always used softice on w9x platforms.
i often used the BMSG (breakpoint on windows message)
command and everything was fine.
first getting a valid handle by using HWND and then BMSG with that handle.

when i switched to windows 2K/XP i also tried it out.

addr <programm>
hwnd
bmsg <valid-handle-from-programm> wm_destroy

but BMSG always tells me, i've entered a invalid window handle.

WTF ?

HELP !

cheers,
deadbeef
JMI
03-10-2004, 08:16 AM
deadbeef:

Well, once AGAIN we have a first time poster who ignored the BIG RED LETTERS at the top of the Forums, who was sooooooo anxious to get an IMMEDIATE answer to his question, he didn't read the FAQ or Search for the answer like he was supposted to do BEFORE asking the question.

deedbeef-- Go back and read the FAQ and then USE THE SEARCH BUTTON and enter BMSG and READ what you find. IF that doesn't help you, come back with the information suggested by the FAQ with a more pointed question that hasn't ALREADY been answered.

Regards,
Aimless
03-11-2004, 12:44 AM
Try BMSG on the window containing the controls, not the controls itself.

Have Phun


how to write tutorials?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > how to write tutorials?
PDA

View Full Version : how to write tutorials?

koyaan
03-10-2004, 06:53 AM
hi there

i initially got interested in reverse engineering playing disavowed's wargame (which is now back online on w*w. mod-x.co.uk btw) .
i got back to it about 4 months ago when i moved into a new home where i got no internet connection yet... i dont own a tv either so i had to find something else to do with my time =)

i have succeded in cracking some protections and i want to share my experiences with the cracking community.

the faq says that you should not post target specific code on this board, although most of the tutorials around are target specific....

so i guess i shouldnt write "how to crack xxx" tuts but rather try explaining a generic way to crack a target.

so my questions are:
are there any kind of best practices for writing tutorials?
where should i send my tutorials? =)

cheers
koyaan
Uradox
03-10-2004, 07:14 AM
I really like this question =)
but im not qualified to answer it :P so maybe a moderator will
Woodmann
03-10-2004, 03:01 PM
Howdy,

I really like this question also.

There are two ways to approach this.
If the protection is lame because people use it straight out
of the box, a generic tutorial naming a target for an example
is more then good.

If it is a protection that has some unique features or has been customized then you should name the target.

The only no-no about tutorials is including a warezed version of the program, including a keygen or serial.Anything that makes it "plug-n-play" is not good.

You can send your tutorials to any place that has such things.

Woodmann
evaluator
03-10-2004, 04:01 PM
maybe here you can post:
http://research.microsoft.com/
Uradox
03-11-2004, 04:32 AM
Yeah and try not to re-invent the wheel as far as tutorials go.
E.G Do we really need another UPX unpacking tutorial?
:)
Tolstoinisten
03-11-2004, 07:33 PM
Hi,

Uhh, been browsing this forum for a couple of months and felt I had to contribute to this post in particular.

Good post, koyaan !

I'm currently writing a tutorial/guide on reverse engineering, and have thought a lot about including a "How to:" on writing tutorials, the do's and do not's.

I've thought little, not enough, to formulate a theory on this, but still enough to share my thoughts...

First of all you should consider your 'targets'. The most important target when it comes to writing tutorials, in particular tutorials that are reverse engineering related, is to decide which group in the scene that you want to write to.

In my opinion there are 4 groups, possibly 5, and these are:

a) Beginners
b) Intermediate
c) Advanced
d) Experts

You are probably already familiar with this "segmentation".

If you are planning on writing a tutorial for newbies then perhaps you should consider using the "re-invent the wheel" feel in your tutorial.

Also, are you writing a target-specific tutorial or a more therotical tutorial? You seem to want to write a tutorial that has more to do with theory than a specific target (even though you might use a target as an example in your theory-oriented tutorial).

You should read some of +ORC's old tutorials, he is a master when it comes to theory. Check out the way he has divided his essays (/tutorials) into sections and what he is doing in each section. Adopt the same style and approach to writing and you will be on to a good start.

Also, bad spelling and irregular grammar can really mess up an otherwise excellent tutorial. So that stuff is important too.

Good luck.

T.
esther
03-11-2004, 11:57 PM
If you can write something in a tutorial that includes below that would be excellent :)
a) Beginners
b) Intermediate

Advanced + Experts doesn't need to read tutorials and if they can write tutes which can easily understand by above categories that would be great :)

Regards
koyaan
03-15-2004, 05:42 AM
i will take everything said into consideration

what i am trying to write about is how to circumvent the safecast protection system
on a target where the main .exe is not packed, by injecting a call to a dll cleaning all
license data, and then patching the call to CreateMessageBoxA(nagscreen) et al
in memory so there is no need to unpack the "safecasted" dlls...

i hope this is a topic of interst, but because of my limited experiences my choices
are very limited =)

as soon as i get something together (and i got fulltime internet access again) i will publish a link on this board and would really appreciate your feedback.

koyaan
Polaris
03-15-2004, 07:09 AM
If you can write something in a tutorial that includes below that would be excellent :)
a) Beginners
b) Intermediate

Advanced + Experts doesn't need to read tutorials and if they can write tutes which can easily understand by above categories that would be great :)

Regards

I am shocked... A serious reply by esther???? :eek:

Where are we going? Armageddon? :D

By the way, I think that if you think too much at how to write a tut you will end up in nothing because you'll be overloaded (or you'lll end up writing a tut on tut writing :D).
So, gather your objectives, take a deep breath and write with clarity in mind: interested people will read it even if it is marked as "beginner". ;)

Best regards,

Polaris
esther
03-15-2004, 09:27 AM
>I am shocked... A serious reply by esther???? :eek:

I'm SERIOUS what I post in here,flammings or suggestions :rolleyes:

>Where are we going? Armageddon? :D

You have come back from mars? :eek:

>By the way, I think that if you think too much at how to write a tut you will end up in nothing because you'll be overloaded (or you'lll end up writing a tut on tut writing :D).
So, gather your objectives, take a deep breath and write with clarity in mind: interested people will read it even if it is marked as "beginner". ;)

If you don't think what you should write how do you begin?

What is your target audience?

What you should be includedif you are writing a cracking tute?
.....

There are lots of consideration made before writing something whether its for beginners,newbies,intermdediate and advanced.

Beginners should learn asm first rather than jumping to a cracking tute....
koyaan
03-24-2004, 12:54 PM
i thought this would fit here:
hxxp://66.98.132.48/fravia/rules.htm

cheers koyaan


What to put in ImpRec?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What to put in ImpRec?
PDA

View Full Version : What to put in ImpRec?

crassy
03-10-2004, 08:45 AM
Hello everyone!

I'm a bit stuck unpacking this AsProtected dll... The OEP I get is A67E30 and it really looks like the real OEP. However the dll gives me the following data in LordPE:

SizeOfCode: 0x00177000
SizeOfInitializedData: 0x00142400
SizeOfUninitializedData: 0x00000000
AddressOfEntryPoint: 0x00397001
BaseOfCode: 0x00001000
BaseOfData: 0x00178000
ImageBase: 0x00400000
SectionAlignment: 0x00001000
FileAlignment: 0x00000200
SizeOfImage: 0x003AC000
SizeOfHeaders: 0x00000400

So I really dont know how to convert the OEP I've got to fit into ImpRec... In what format does it want the OEP?

By the way, how does ImpRec find the import table given the OEP??

Hope my question is not too stupid... Excuse me if it is!
_Servil_
03-10-2004, 03:51 PM
I think on library (DLL) you should forget the image base stored in header as its only preferred value not realized. The library is just loaded at address where fere space enuf. The real image base for your library should be gotten from debugger or another process viewer in runtime. Your OEP value for imprec is then yout real OEP VA minus your real library base.

how imprec finds that table? it scans certain chunk of code starting at this OEP address looking for indirect jumps or callz. addressess referred by 'em are potentian IT entries. but it's my assumption only.
hobferret
03-11-2004, 07:09 AM
Hi all :)

Try using revirgin, that usually gives you the data right off :D

You could then transfer that to imprec ;)

/hobferret


SoftIce - Breaking on phisical sector access
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SoftIce - Breaking on phisical sector access
PDA

View Full Version : SoftIce - Breaking on phisical sector access

ATY
03-10-2004, 07:07 PM
Hi :)

I have a strange bug in an app being developed at my work place:

We develop an application on a Win2k environment.

on a specific sequence, when we crash our app (we use a known bug in a VB control), a specific file, that is not related to the bug/crash, is being partialy overwriten with a piece of memory dump - the first 450 Kb of the file are overwritten with some garbage memory content (a bitmap in this case, since we crash our app while it tries to load that bitmap).
The application crash doesn't cause blue-screen but only pops Dr.Watson (we tried to look at Dr.Watson's log file, but found nothing related to the file being overwriten).

The file that is being overwritten is .MDB file and is about 6 megs. We access this file (using MS Jet) before we initiating the crash (when the app starts), but we dont access it during the crash (we checked that the file is closed after we access it).

We suspect Windows Write Cache mechanism, but can't be sure.

Using File Monitor revealed nothing (it didnt show access to this file during the application crash - but the file was damaged anyway)

Our system is Win2k SP2 running over some embedded system (generally a Pentium 3 / 256 RAM - but not a regular Desktop PC)

In order to understand what exactly is causing this file "smash" I though about using SoftIce. I suspect that breaking on standard Win32 API (WriteFile) wont help, as FileMon wasn't able to trap it. we suspect that something is going wrong in the kernel level, not the application level.

So, finally... :) How can I break on a disk access to a specific file, or, even better, how can i break on disk access to a specific phisical sector ?

What we finaly wanna discover is what causing this file overwrite.
(btw, any ideas other that the suggested are more than welcome)

10x in advance, ATY.
evlncrn8
03-10-2004, 08:55 PM
at a guess,you could try setting up a seh handler, that closes all handles to the database, then shutsdown the application gracefully, that might stop the file corruption, as for monitoring a sector write,that could be pointless as if the file is written to,windows will probably move the data to another sector, write the information, then update the fat tables.. try the seh approach, it might work
Woodmann
03-10-2004, 08:57 PM
Howdy,

I am confused. You say :
on a specific sequence, when we crash our app (we use a known bug in a VB control), a specific file, that is not related to the bug/crash,

Please tell me how this file is not related.
Explain how the .MDB file is used.
Is this prog a 3rd party app?

Woodmann
ATY
03-11-2004, 01:56 AM
Howdy,

I am confused. You say :

Please tell me how this file is not related.
Explain how the .MDB file is used.
Is this prog a 3rd party app?

Woodmann

Woodmann: What I meant is that the .MDB file that is being overwriten, is not accessed for long period before we attemp to generate the crash.
The crash is generated by exploiting a bug in an Internet Explorer VB Control: we load a large HTML file with loads of images, scroll it down quickly, and at the same time trying to close the form - it simply crashes the VB layer (the GUI) of our app.

The .MDB file is accessed by using the Jet engine. a data from that file is beeing read while our application starts (this only happens when the aaplication starts, leter, we dont read/write to this file).

The prog is no 3rd party, but beeing developed by my company. Unfortunately, I can't post it over the Net.

evlncrn8: I understand that phisical sector might be problematic, since windows might move data. however, our app doesnt write data to the .MDB file, but only reads from it.
If we can trap access to a specific FILE or an entry in the MFT - that can be also helpful.

10x, ATY.
evlncrn8
03-11-2004, 02:50 AM
evlncrn8: I understand that phisical sector might be problematic, since windows might move data. however, our app doesnt write data to the .MDB file, but only reads from it.
If we can trap access to a specific FILE or an entry in the MFT - that can be also helpful.

-------------------

if thats the case then why not just set the file attributes of the mdb file to read only..that should prevent it getting corrupted.. in theory anyhows

also, perhaps this could help

hxxp://www.granite.ab.ca/access/corruptmdbs.htm
ATY
03-11-2004, 02:59 AM
if thats the case then why not just set the file attributes of the mdb file to read only..that should prevent it getting corrupted.. in theory anyhows

Hehe, We thought about it at first place, but read-only attribute seem to have effect only on the application level. Windows internal mechanisms (such as write cache, or swap) are not affected by this.
Aimless
03-11-2004, 03:42 AM
It seems that the problem needs to be approached logically. Once you apply your mind, it all falls into place. Correct me if I am wroing somewhere but...

1. I understand that you are opening the access file
2. I also understand that you are NOT closing the access file before the crash.

These lead me to believe that the following may be happending:

1. You open the MS access file
2. You open the application
3. This implies that both are loaded somewhere in memory
4. You crash the application, which overwrites something in the memory (possibly the space where the OS had loaded the access file)
5. This seems to be a perennial problem with SOFTICE too. You open the file in memory (any app), change the bytes in memory, and close softice. You'll find that the file got modified!!. This type of memory access and overwriting is obviously not going to be shown in filemon/regmon or even softice itself.

To solve this you may need to:

1. Use softice (possibly in Win98 -- I'll explain why)
2. Load access file, load app
3. Ctrl_D to ice and find where in mem the access db is located
4. BPR on the entire memory (that's why you need win98)
5. Now Ctrl_D again and come out of ICE
6. Work on app as required, and see what hits. Chances are, its gonna be the rouge low-level process that modifies the file

However, if you are REALLY stuck only on Win2k and above platforms then to prove that the same is being overwritten in MEMORY and not on the disk, do this:

1. Use Softice (NT version)
2. Load MDB, load app
3. Ctrl_D and see memory of MDB file
4. USE THE COPY COMMANDS TO MOVE THE MEMORY OF MDB TO A SEPERATE MEMORY REGION OR FILE (Check out tools on programmerstools.org for memorydumpers)
5. Work normally.
6. Just before the app exits (mostly, hits doctor watson -- you'll have to figure out that bp) go to ice and use the MEMORY COMPARE for MDB files
7. If different, you KNOW that its being modified in memory

You'll not get much ahead by using disk monitoring, because its NOT modifying the file on the disk, but the memory.

Have Phun
evaluator
03-11-2004, 05:33 AM
Lets firstly determine, IF file corruption happens
because of DR.Whatson's logging or memory dumping engine;
for this you can turn off both service & crash again your app.

then..
naides
03-11-2004, 06:53 AM
Hi :)

I have a strange bug in an app being developed at my work place:

We develop an application on a Win2k environment.

on a specific sequence, when we crash our app (we use a known bug in a VB control), a specific file, that is not related to the bug/crash, is being partialy overwriten with a piece of memory dump - the first 450 Kb of the file are overwritten with some garbage memory content (a bitmap in this case, since we crash our app while it tries to load that bitmap).
The application crash doesn't cause blue-screen but only pops Dr.Watson (we tried to look at Dr.Watson's log file, but found nothing related to the file being overwriten).

Out my deep ignorance.

This behavoir, writing a memory dump, conceded to the wrong place, appears to be a 'fossil' of the recovery procedure. You guess the routine happens inside windows Kernel, which is quite likely, as most low level disk access is handled by this system dll, but, rarely does any other crash result in the memory dump overwritting a file.

1-I think the root of the problem is in the VB routine you use to provoke the crash. As it is not vital to use such routine, can you start the crash using something else? A quick and dirty asm protection fault code perhaps?

2- Windows use API to tell the kernel what to write on the disk, but deep down to the metal, kernel uses software interrupts to do disk I/O. You can place interrupt breakpoints in softIce BPINT 21 if ax==4 or something like that to catch the kernel preparing itself to write a sector into the disk. then you do your autopsy and figure out what kernel routine called the interrupt, and who called that routine.
ATY
03-11-2004, 06:58 AM
Lets firstly determine, IF file corruption happens
because of DR.Whatson's logging or memory dumping engine;
for this you can turn off both service & crash again your app.

then..

evaluator: good idea. however, we tried that, and the corruption still occure.

Aimless: We run a query on the file using DAO (MDAC) (that uses the Jet engine). Basicaly we open the file and then close it.
Although I didn't check it yet, I hardly believe that the entire file remains in RAM since its 7 megs, and there is no good reason to keep the entire file or portions of it in RAM after it is no longer needed.
The corruption occuers only later (during the crash), long after we closed the file.

Another direction we think of, is that pointers in the MFT are getting corrut and that causes the problems (the actual phisical sector may not change, but when u try to access the file it is being read from different place).
least
03-11-2004, 07:36 AM
Hi,
maybee I'm wrong and what I'd do can't be done in W2K, but what about trying what aimless says with one modification: Trying virtualprotect(ex) on pages that contain MDB file setting guardian flag (it could mimick softice BPR command), so the code that access it should generate page fault and softice with faults on should catch it (hope so).
Or what about good old BPM R ...
Kayaker
03-11-2004, 05:26 PM
Hi

I wonder if it would be possible to flush the cache buffers after you are done with the mdb file. I'm just surmising as to how the read operation actually works, but say you ask MSJet to open a file, it calls CreateFile with FILE_SHARE_READ + FILE_SHARE_WRITE access (in case you are wanting to write to it), then maps a view of the entire file into its own address space with CreateFileMapping and MapViewOfFile, passing you the starting address of the mapped view. Or maybe the starting address is passed to the DAO engine and awaits your SQL queries.

Now let's say you write to the file then "close" it from within your app. You assume you are done with it, but in reality the system will do the actual writing to the file on disk in its own sweet time. The WriteFile call itself is probably part of the Jet engine, but even then the actual writing won't be done immediately unless FlushFileBuffers is called. The writing phase may be in a separate callback thread that may have other I/O operations queued, possibly not even finishing until the system has dealt with more pressing processing matters.

In the meantime, you're busy distracting the CPU with loading bitmaps and quick display updates due to the rapid scrolling, plus handling the deliberate crash and calling poor old Dr. Watson. Somewhere in there you overwrite the mapped view with the bitmap parts, and finally when things settle down the system gets around to writing its queued I/O operation, now corrupted.

You say you aren't actually writing to the file, but I think the principal may still hold. Perhaps there's a call to FlushViewOfFile (as opposed to FlushFileBuffers) which also ends up writing a corrupted image to the disk file. As Aimless mentioned, something along these lines often happens when you make changes to memory within Softice. This seems to be language specific as well (often occurred in MS Visual C++ v5 & 6 apps as I recall, but not every one, and I don't think anyone figured out the exact reasoning behind it).

Actually, you said it was a "long time" between when you close the file and the crash occurs. Perhaps you can use DuplicateHandle in some way to force the Jet engine to finish completely with the file + mapped view and clean up. Again, I'm just throwing out ideas here, maybe if you used DuplicateHandle with the DUPLICATE_CLOSE_SOURCE flag, you could force the original handle to the file to close, which might effectively "sever" the faulty connection and flush the buffers, then close the useless duplicate handle.

Perhaps none of this applies, but as you mention it does seem to have something to do with the write cache mechanism.

Regards,
Kayaker
Woodmann
03-11-2004, 05:26 PM
The DAO and the MDB file work together AFAIK.

You cant stop using one without the other unless you have
written some custom DLL files.

Check these to make sure they are not being used some where else in your program.
Since the crash is writing to your MDB file it is still open. The DAO must also be stopped or it will keep the MDB file open even if you tell it to close.
You may also have a DLL issue.

Thats my best guess :)

Woodmann
ATY
03-11-2004, 05:57 PM
Another pieces of (interersting) information:

We experienced another file overwrite - this time not .MDB.
We have 2 data files (that we didnt access at all while generating the crash) that got overwritten, this time with portions of the .MDB file (!) that got corrupted in the first place...

common things to the corrupt files: all are large files (above 2 megs), we tried to put smaller files in the same dir where we keep the .MDB file and nothing happened to them.

All the corrupt files (the .MDB and the 2 data files) are in virtual drives that where created by a subst command (i.e. the directories were mapped to drives). We dont wanna use "net use" to map those directories because of performance issues.
The .MDB and data files are on different "drives".

Kayaker: from what I understand, in order to be sure that the data is actually written to the disk, we have to "manually" flash the cache after each file access... I think it might be easier to simply turn of the Write-Cache mecanism (paying with some performance decrease). However, if something in the MFT get corrupt, I suspect the file overwrite might still occure.

P.S: after the file corruption occures, we run chkdsk and it returns with errors. we fix with /F, then on the next file corruption, errors return.
for example, one time, after running chkdsk /F the .MDB file size went to zero.
dELTA
03-11-2004, 07:23 PM
Very strange, the disk corruption issue (and the writing to files that are never opened at any point) suggest that the problem is not on application level, but rather on operating system level. If this is the case, the issue might in turn be used as an attack for bypassing filesystem permissions and such, and if you manage to find the source of this problem you might very well get your name on a Microsoft Security Advisory. :)
Woodmann
03-11-2004, 10:01 PM
Interesting,

chkdisk /f will restore the MFT after corruption.
I didnt beleive that the MFT could "really" be corrupted.

How about checking the size of the MFT maybe it isnt big enough.

Maybe you are trying to access a part of the MFT that
shouldnt be accessed? You know low level reservered stuff.


Struck in keygenning
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Struck in keygenning
PDA

View Full Version : Struck in keygenning

hell
03-11-2004, 01:53 AM
Hi folks i am a newbie. i started practising on a few crackmes and got struck kindly help! :mad:
what does the command do-----
ROR AX,CL
Ax contained 1234 previously and after the asm instruction changed to 9a10
or something like this

could someone please explain what this command is and what it does. please explain with examples. i will be very thankfull. :D
JMI
03-11-2004, 02:49 AM
Well hell:

Did you by any chance see the BIG RED LETTERS at the top of the Forums which tell you to read the FAQ and then search before you post a question? How are you expecting to write a keygen, let alone "crack" software, if you have little to no knowledge of assembly language instructions? Have you even considered that there is a wealth of knowledge out there on the net if you aren't too lazy or impatient to search for answers yourself?

There are many resources out there which will explain ROR to you and what happens with the instruction you seek. All you have to do is put "assembly language + ROR" into any search engine and you will find your own answer.

Being a newbie is NO excuse for failing to put some of your own effort into the learning process. This is not a school for those who are not willing to put in their own efforts and want someone to explain the very basics of assembly language to them.

Now READ the FAQ, do some of your own basic research and come back and answer your own question. It really isn't that hard, with just a little effort. There are even several links at the bottom of these Forums with useful information. For example the BlackBird Archive and Krobar have tutorials for newbies on assembly language.

Please let's have no one encourage this type of lack of effort by giving the answer for this simple search.

Regards,
hell
03-19-2004, 12:51 AM
i am really sorry for posting such an easy question on the forum. i regret it and i will make sure this thing is not repeated. anyways thanks for opening my ways. i will work harder and try to be a good cracker.

well, ROR stands for rotate right.

ROR ax, cl means rotate the bit string right times the value in cl.

:D


How do I remove A programes Licence
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How do I remove A programes Licence
PDA

View Full Version : How do I remove A programes Licence

cisco
03-11-2004, 02:27 AM
I am having a problem with a programe that has been licenced once and now I cant remove the licence.

I have uninstalled/reinstalled the programe - - no good
I have checked the reg and removed any referanece to the programe- no good

have searched for files that were created at the time of licencing --no good

I have run out of idieas can any one PLEASE HELP!! :confused:
JMI
03-11-2004, 03:09 AM
And have you, by any chance, looked at the code using either a debugger or a disassembler to see what it is checking to find that it has been previously installed? Have you, by any chance, thought of using the Search button here to seek threads on "registration checking" or "Trial expiration" or some such entries???

Have you attempted to think about the issue logically? At some point the program has to "create" a "hidden" registry file or a file that it checks to see if it has already been licensed. Have you tried both filemon and/or regmon to see what they reveal? Does it use a particular protection system?

Have you read the FAQ? You have not explained very well exactly what you have actually tried. How about you do a little "searching" in the Forums and then come back with a more focused question and a better explaination of what you have done to try to help yourself.

Oh, and DO NOT post the name of your target at this point.

Regards,


damaged stolen bytes ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > damaged stolen bytes ??
PDA

View Full Version : damaged stolen bytes ??

johndoe1
03-11-2004, 09:42 AM
hi,

anyone ever heard of damaged stolen bytes ?

how can i recover them ??

grtz, johndoe1
cRk
03-11-2004, 04:34 PM
there's something called "Search"" function on the board ..like google has ... have you ever used it? :eek:
johndoe1
03-11-2004, 04:45 PM
there's something called "Search"" function on the board ..like google has ... have you ever used it? :eek:

DUH

yes, i did

and only this pops up

coz the words damaged + stolen + bytes is not found

( without the + signs offcourse )

and yes i know stolen bytes...
and how to recover them
there are great tutors in this forum

Personal flame removed
JMI
03-11-2004, 05:42 PM
johndoe1:

Asking if you have searched is not a "personal attack" and it does not authorize you to make one. I have removed that portion of your post.

The problem is that "damaged stolen bytes" is a completely non-descriptive statement and no one knows from that statement alone what you suggest is the "damage" which you claim has been done to the "stolen bytes." If you have been reading the threads here and on the exetools forum, you would know that in many instances the stolen bytes, themselves, really are an artifact of the compiler that was used and may not even be necessary to make the program run correctly. If they are necessary for the program to run correctly, does it not stand to reason that you have not properly dumped the program, being either too early or too late for it to have offered the "undamaged stolen bytes"?

So lets have a better description of what, exactly, you mean by "damaged" without a reference to a specfic target or the posting of any code which identifies a specific target.

Regards,
DarkCluster
03-12-2004, 06:21 AM
stripper v2.05 b3
(c) by syd, kiev, 2002-2003

21:58:36 - loading modules..
- ASPack 2.xx (v1.00, full release)..
- ASProtect 1.xx (v1.03, full release)..

21:58:40 - open E:\Program Files\xxxxx\xxxxx\xxxxx.exe...
21:58:41 - executing.. may take for a few minutes.. be patient..
21:58:41 - asprotect detected..
Image Base :00400000
21:58:41 - dumping victim..
21:58:41 - processing import table..
ImportAddressTable RVA :00016038 - kernel32.dll
ImportAddressTable RVA :00016150 - user32.dll
ImportAddressTable RVA :00016024 - gdi32.dll
ImportAddressTable RVA :00016000 - advapi32.dll
ImportAddressTable RVA :00016140 - shell32.dll
21:58:41 - fixing import table..
ImportAddress RVA :00016040 - kernel32.dll!LockResource
ImportAddress RVA :000160a4 - kernel32.dll!GetCurrentProcessId
ImportAddress RVA :000160dc - kernel32.dll!GetCurrentProcess
ImportAddress RVA :000160ec - kernel32.dll!GetCommandLineA
ImportAddress RVA :00016124 - kernel32.dll!GetModuleHandleA
ImportAddress RVA :000161cc - user32.dll!DialogBoxParamA
21:58:43 - stolen bytes were damaged by alexey, look at last section..
EntryPoint RVA :0002d000
21:58:43 - saving unpacked file..
21:58:43 - file was unpacked successful..
21:58:43 - done..
cRk
03-12-2004, 08:00 AM
since exist excuses never people makes mistakes ... your desperate entire post without details just pointed to another crack request . the poor details and words damaged in this would mean Stoled ASPR. bytes which has been discussed many times . but maybe you did searched at all.. but didn't read?. your flaming behaviour indicates that i'm right! anyway you wouldn't bother yourself responding in such way if i were wrong .. so a little guessing just gave me the idea you didn't search at all :)

Best Regards
%UNDEFINED%
03-13-2004, 09:42 AM
DUH

and yes i know stolen bytes...
and how to recover them
there are great tutors in this forum

If you know how and have read the exisiting tutorials, why are you using Syd's Stripper?

That basically defeats the purpose of posting in this forum.

More than likely Stripper is running into an error, its called a Software Bug :eek: , yeah imagine that.

The fact that the tool is reporting "Damaged Stolen Bytes" is really pointless, when you look at what the stolen bytes do.

In order for the program to function properly they must be executed to do what? BALANCE THE STACK

That is why they are not simply removed altogether, however thay may be masked executed in a masked form similar to

enter 0,0

is the same as:

PUSH EBP
MOV EBP,ESP

Which is basically the being of every program written in 'Most Languages'.

I can't say for sure that every compiler adds the same instructions.

The program always assumes that there are instructions on the stack waiting to be executed. Keep in mind that the Stolen Bytes can be anywhere from 2 to 10 line of instructions long. Again I think it depends on the compiler.

The compiler adds them during Assembly

My only suggestion is to Debug, and read some existing reading material, or if you are feeling really 'Spunky' and are actually expecting a reponse, you could try an email Syd and see what he means by "Damaged Stolen Bytes".

But I wouldn't get your hopes up about getting a reply.

If you are here to do your homework, stay awhile and study.
If your looking for a keygen or a patch, get on the bus.
JMI
03-13-2004, 10:51 AM
I am absolutely SHOCKED :eek: to learn that software may have BUGS. :p

Regards,
DarkCluster
03-14-2004, 06:09 AM
If you are here to do your homework, stay awhile and study.
If your looking for a keygen or a patch, get on the bus.

Dood take a chill pill :D
%UNDEFINED%
03-14-2004, 02:02 PM
I really don't feel as though I was being unrespectful,

DoodHave a nice day :cool:


HASP Driver-How to Start?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HASP Driver-How to Start?!
PDA

View Full Version : HASP Driver-How to Start?!

zkhan123
03-11-2004, 12:36 PM
I tried to install a new program from a CD.
But it displays "HASP Driver not Found...
I found a hasp95.vxdin Windows directory.
When looked thru Procdumpthe EXE displays a lot of protect..protector...etc
as the Section names....Nothing more.!!!

I know it is a Dongle protection.(Which is a new Area for me..) :(
From Available resources..i got the Idea, thatBreaking HASP is Difficult
You have to break the Software Code(Real Program) instead.

But..how?I heard about the emulators for Aladdin's HASP.
But how to use it?
From where should i start.?All the Tuts expecting a reasonable knowledge previously!.
But for an utterly newbie like me ....what's the Best Resource to start.?

It would be a great help..if you give TUt Links..or Even Tut itself!! :D
Thanks in Advance
Kayaker
03-11-2004, 12:44 PM
Where to start?

http://66.98.132.48/crackz/index.html
zkhan123
03-11-2004, 12:58 PM
Where to start?

http://66.98.132.48/crackz/index.html

Well.. I already visited there.But still i lost in the codes... :confused:
JMI
03-11-2004, 01:12 PM
As you've already acknowledged, this is NOT an easy task. This, however, is not a place where you can expect someone to take you by the hand and lead you completely through the reversing of hasp dongles. If you are ALREADY lost in the code, simply from visiting the Crackz site, you do not have reasonable prospects at this stage of your knowledge of defeating this type of protection.

What you need to do is follow the BIG RED LETTERS at the top of the Forums and do YOUR OWN search for information on this topic. Start here with the SEARCH BUTTON and try various combinations of "hasp" and "dongle" and "alladin" and actually read those threads. Then go on the net and use similar search terms. I just did a quick search with "hasp + crack*" and found many articles, in several languages on the subject, including references to the +Fravia archive, linked at the bottom of the Forums.

The issue here is that you are doing very little to help yourself beyond asking someone else to explain it to you. That's NOT the way we do things here. You are supposed to do your own research and study and then ask specific questions AFTER you have done that and have a particular question.

Your BEST resource is your brain and a willingness to exercise it and an attempt to solve your own problems. Ask for help only when you have tried and are actually stuck on an issue you do not understand, not when you have simply run out of "effort."

Regards,


SSP license check?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SSP license check?
PDA

View Full Version : SSP license check?

ramin_rad2000
03-12-2004, 08:33 AM
Greetings to my incredible guides(goatas,Crackz,cyberhege...) and thank you all for this great site.
I have encounter a problem recently :( Which is with sentinel super pro dongle,god damn it!
The target is <target name removed> update(it actualy updates version 6.5 to 7) the program itself has no use for me but i want to gain experience with sentinel dongles while many great applications out there have this protection.
well i haven't got the version 6.5 itself on my computer installed, but the program seems to not care about it!any way when you run the program it first nags about not finding the hardware lock,well after a quick look at source code and patching _RNBOfindfirstunit function and some flags,it asks for a correct license.key file.
So is this license.key some kind of rainbow license file or field actions activation?
As far as i get the program reads cell 0 of the dongle at the begining and copies it to different locations but it never performs an actual comparison and then again call a routine which first reads this cell again and then i think it expects some encrypted code from license.key and put it together with cell 0 it then determins the program's flow??!
plz guys help me with this as you have always helped me find the answers.
ramin_rad2000
03-15-2004, 08:58 AM
well i have solved this problem myself,well if you guys are interested let me know and i will write the approach. :cool:
Zest
08-23-2004, 10:00 AM
Dear Ramin,
Hi,
I'm interested in your approach.
Could you please mesntion the name of the program ans also let me know what your remedy is by sending a PM.
Thanks in advance.
regards,
Zest.
cah
08-23-2004, 11:16 AM
Dear Ramin_rad2000

Cheers for your work on sentinel locks.

For a given application.exe, How to find Spro quries, algo, thier seed codes?
Do you have any tools to find these queries.

Sharing knowledge on this subject is highly appreciated
Gime your mail id
CaH
ramin_rad2000
08-28-2004, 08:47 AM
It was a long time agon since i worked on that application,I actully don't remeber much now,but in general it is very simple(you just have to read sentinel api guide and also you nedd to have rainbow signatures for ida).
I have them all and i can send it to your mail address if you want.
if there is a particular problem then mail it to me or post it to the forum.
regards


ASM language....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ASM language....
PDA

View Full Version : ASM language....

Code^Angler
03-12-2004, 11:36 PM
sorry if my english is not very well...

hi there.. :)
i intersting in doing a cracking but i do not know how to read an ASM language.. :confused: i had done some of crackes.de crackmes but i only manage to patch some of it.. but as i know patching is a lamezzz.. :(
what i want to do is try to find my serial based on my name...
hope you can help me in settle my problem..

in Asm Language, what is the most important topic i need to read... can some of u recommend me a site that provide an ASM tuts / notes..

Thankzzzz...
Uradox
03-13-2004, 12:34 AM
hxxp://spiff.tripnet.se/~iczelion/
dELTA
03-13-2004, 08:49 AM
http://cs.smith.edu/~thiebaut/ArtOfAssembly/artofasm.html

http://www.madwizard.org/view.php?page=tutorials.contents


task bar
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > task bar
PDA

View Full Version : task bar

scrarfussi
03-13-2004, 08:41 AM
:( hello i wuld like to know how i can run a program in such a way that the program icon does not appear on the task bar so noone knows that this program is running thanks in advance
disavowed
03-13-2004, 08:46 AM
you should be asking how to hide it from the process list as well, then (what you see in the task manager when you press ctrl-alt-del)

you can use google to find your answer to both questions
JMI
03-13-2004, 09:15 AM
But, but, but .... Searching for my own answers is so hard, even if the BIG RED LETTERS tell me I'm supposed to do that before I post a question.

It would appear scrarfussi that you have not done that yet or actually read the FAQ. Please do both now. Although your search should give you the answer, if it does not, come back and post again with what you tried and you can probably get some more help.

Regards,
The Svin
03-23-2004, 03:00 PM
WS_EX_TOOLWINDOW
scrarfussi
03-26-2004, 01:12 AM
i dont understand
Kayaker
03-26-2004, 02:43 AM
Well, if you search for WS_EX_TOOLWINDOW you'll find in its description under CreateWindowEx

WS_EX_TOOLWINDOW
Creates a tool window; that is, a window intended to be used as a floating toolbar. A tool window has a title bar that is shorter than a normal title bar, and the window title is drawn using a smaller font. A tool window does not appear in the taskbar or in the dialog that appears when the user presses ALT+TAB. If a tool window has a system menu, its icon is not displayed on the title bar. However, you can display the system menu by right-clicking or by typing ALT+SPACE.

And if you search for 'taskbar' on this forum you'll also find the solution discussed. If you need more detail, head over to the Win32ASM board and do the same. If you still need help, post a bit of your code.

Kayaker


i need some quick help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > i need some quick help
PDA

View Full Version : i need some quick help

init
03-14-2004, 01:03 AM
hello, i have this one program thats closing itself in the middle of use and when i search for possible calls it makes to close itself such as exitprocess and terminateprocess and nop them out, the program is still managing to close itself, what are any other possible calls it can be making to close itself?
nikolatesla20
03-14-2004, 01:59 AM
Hmm. Try looking for any DLL's that it might load. These could also call Exitprocess(). Also, TerminateThread could be used.

Maybe check for any windows messages as well, perhaps a WM_CLOSE. Of course, i would think that if you nop'ed all the exit codes out nothing would be able to close it, so first try the above suggestions....

-nt20
naides
03-14-2004, 06:53 AM
hello, i have this one program thats closing itself in the middle of use and when i search for possible calls it makes to close itself such as exitprocess and terminateprocess and nop them out, the program is still managing to close itself, what are any other possible calls it can be making to close itself?

You may also consider the possibility that the program does not call the API or message that closes herself, but produces an exception or other abnormal code path that results in the OS closing the program thread(s).

Do you have a clear idea of what triggers the closing?
try manually tracing around that code in SoftIce, logging your trace, and monitor the the tell tale signs of the program closing: a lot of "unload" type of messages in the SoftIce command area. This way you can narrow down the area of the code, the call, the provokes the closing, and trace into it.
init
03-14-2004, 01:13 PM
well here is the problem, the program is a mailer and after march 1st is when it started to close itself so the maker must have added something in the code to make the program close after that date, now the program randomly closes itself when you start to mail and it waits quite a while to do it like an hour or so
naides
03-14-2004, 06:10 PM
well here is the problem, the program is a mailer and after march 1st is when it started to close itself so the maker must have added something in the code to make the program close after that date, now the program randomly closes itself when you start to mail and it waits quite a while to do it like an hour or so

You are describing a time bomb kind of protection. Disassemble the program and look for time keeping API: getsystemtime, gettickcount. etc. Time bomb probably checks it often. Also look for the API postquitmessage.
Also DateChecks may have activated the timebomb mechanism. Look around for those APIs.


win XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > win XP
PDA

View Full Version : win XP

Code^Angler
03-14-2004, 01:20 AM
hi..
i'm currently using WinXP as my OS..
but some of the tools that i used did not work well in XP environment.. i already dload softice4.05 and tried to install it in my Pc's but, an error came out and it says that my OS is not suitable with it.. ( it only support 95/98), could someone tell me the tools (softice) that support WinXP?
Thanx..
JMI
03-14-2004, 01:53 AM
Code^Angler:

Once again we have to remind a new poster of the BIG RED LETTERS which tell you to read the FAQ and to SEARCH before you post a question. The subject of the proper versions of Softice to use with XP have been posted here several times already. This is WHY there is a request that you SEARCH first, so the same questions do not have to be answered over and over again because people are too lazy or too impatient to spend some time trying to solve their own problems. There are already 64 threads here discussing problems with Softice and XP, including several with titles about Softice 4.05 and XP.

Now please do what you should have already done. Read the FAQ and then use the search button and enter "softice winxp," without the quote marks.

Regards,


MSI mystery...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > MSI mystery...
PDA

View Full Version : MSI mystery...

volodya
03-14-2004, 03:44 PM
Well, I'm having one application. It is using InstallShield installer, but it is possible to make it to install just using MSI single file. This single file can be caught in Temp folder during installation, nothing special here.
So, when you are trying to install it (both ways - either from the standard package or from tmp msi file) it is asking for the serial number. And here the mystery begins.
In the case of IS it can be either a special dll or the inx file (the format I'm digging right now). In the case of MSI it could also probably be a dll hidden somewhere...
So, it is asking for the serial, checks it somehow and I can't understand how!
Tmp folder conains just ONE txt file with some GUID. The GUID is NOT present in the registry :confused:
As far as I was able to understand, there is also no some special dll. I was attaching to the process in the debugger and was watching "call stack" for each and every thread it has - NOTHING. So, I'm totally confused.
Any suggestions?

BTW, does anyone know any GOOD literature about MSI format. I used ORCA to play with it but I'd like to understand what I'm doing. Please, do not direct me to the MS MSI SDK - I don't like it :)
dELTA
03-14-2004, 09:07 PM
Sometimes tools like filemon can be good to find any possible "secret DLLs" like this, in a simple but yet efficient way? It should be able to show you all files that are touched by the installer, which in turn might give you valuable clues for starting points.
volodya
03-14-2004, 09:57 PM
Yes! Absolutely! I'm stupid. Right you are. Everything became obvious.
Application creates the dll upon request - MSI creates it from the data in MSI file. Writes binary data into it. Launches the dll. Dll checks for the serial and then app unloads the dll and deletes it! As simple as that.
dELTA, thanks again.

BTW, the question about the GOOD literature concerning MSI is still here...
Anticode
03-15-2004, 05:38 PM
Yes! Absolutely! I'm stupid. Right you are. Everything became obvious.
Application creates the dll upon request - MSI creates it from the data in MSI file. Writes binary data into it. Launches the dll. Dll checks for the serial and then app unloads the dll and deletes it! As simple as that.
dELTA, thanks again.

BTW, the question about the GOOD literature concerning MSI is still here...

Hi,
There is a plugin for total commander which lets you browse and extract files inside MSI files..

hxxp://clubtotal.free.fr/modules.php?name=Downloads&d_op=getit&lid=160
volodya
03-16-2004, 10:36 AM
OK, a set of MSI functions to retreive a file from the database.
Thanks. At least, now I have some sort of the beginning point.
mmk
03-16-2004, 02:46 PM
FYI, WinRAR can open a lot of different files, including .msi files and many others most people don't know about.
volodya
03-18-2004, 02:43 PM
mmk, you are right only partially. WinRAR is able to extract the files from the MOST msi-files. Some of them it cannot open. So I wrote a utility. So far I'm giving it without the sources but if anyone needs it I'll put them here. The utility should be used with ORCA. Using ORCA one determines the file name and then feeds it to my utility.
mambox
03-22-2004, 09:48 AM
any place to find orca?

got it in the fravia's time but lost it since a while.

thanks!
volodya
03-22-2004, 10:25 AM
ORCA is a part of the Platform SDK.
Soon I'll put it on wasm.ru
mambox
03-22-2004, 05:39 PM
ok.i'll wait then ;)


Sice for DS4.3.1 (WinXP)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Sice for DS4.3.1 (WinXP)
PDA

View Full Version : Sice for DS4.3.1 (WinXP)

saiwa
03-15-2004, 07:55 AM
I've tried Sice for DS4.3.1 for WinXP and everything's OK except the bpint 3 command always pop up Sice inside ntoskrnl module... with Sice 4.05 bpint 3 works as it should (???). Any hints ?

And, yes, any tips on how to patch ntice.sys with foreign keyboards mappings ???

Thanx, Saiwa
bedrock
03-15-2004, 09:11 AM
I had exactly the same problem, i just had to refine the break point, i now use

bpint 3 if(cs!=8)

Hope this helps

--
bedrock
saiwa
03-15-2004, 01:01 PM
Thanx, it will help.

Bye, Saiwa
hobgoblin
03-15-2004, 02:41 PM
And, yes, any tips on how to patch ntice.sys with foreign keyboards mappings ???

Check the Tools map in the softice folder. There you should have a small program called keymap.exe. Put it in the same folder as ntice.sys. Open a dos box and type " keymap.exe ntice.sys ". The program checks what keyboard system you have activated on your OS, and next time you open Sice (after a reboot), Sice followes your keyboard system.

hobgoblin
saiwa
03-15-2004, 05:07 PM
thanx... I will search for keymap.exe

Bye, Saiwa


tsehp.cjb.net
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > tsehp.cjb.net
PDA

View Full Version : tsehp.cjb.net

Anticode
03-15-2004, 05:26 PM
i accidently noticed that suddenly tsehp.cjb.net points to this place instead to micro$oft!?
anyone knows how come??
Kayaker
03-15-2004, 10:08 PM
I think he means it's the other way around now, i.e. referring back to "here" once again, instead of "there" ;)
disavowed
03-16-2004, 11:29 AM
kayaker: all fixed :P
Kayaker
03-16-2004, 06:24 PM
Well, if you say it's fixed, whatever you fixed that needed fixing, then that's good enough for me. Of course nop jobs don't usually require documentation, but... :p
Woodmann
03-16-2004, 07:30 PM
Howdy,

I hope you fixed all the broken links while you were at it. :p
Have you had a chance to take a look at the grout in the bathroom ?
That needs some touching up also.

:confused: -cbo- :confused:
JMI
03-16-2004, 08:43 PM
I could lend you my grout file. Works very well but is hard work. :)

Regards,
nikolatesla20
03-17-2004, 08:35 AM
u guys r wierd :p

-nt
JMI
03-17-2004, 01:02 PM
When did this fact first intrude upon your conscious mind? :rolleyes:

:D

Regards,
nikolatesla20
03-17-2004, 04:00 PM
When did this fact first intrude upon your conscious mind? :rolleyes:

:D

Regards,

Well, it's been in my subconscious for quite a while, I think those dreams of midgets riding unicycles were brought on from it (or, um, that was seeing Happy Gilmore too much). Seems it finally surfaced so I decided to post it as part of my therapy.

-nt20
JMI
03-17-2004, 05:33 PM
Go forth, my son, and heal thyself. :)

Regards,
Woodmann
03-17-2004, 07:10 PM
Can I get an AMEN !!!!
dELTA
03-17-2004, 07:38 PM
AMEN, praise the lord! :D


Hardlock cloning
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hardlock cloning
PDA

View Full Version : Hardlock cloning

proitm
03-15-2004, 05:42 PM
Is it possible to clone USB Hardlock dongle?

It doesn't use an ASIC.

It use a standard 8-bit RISC One Time Programmable, and an eeprom.

Regards.
tgodd
03-16-2004, 07:57 AM
Contrary to what you may think, there is in fact an asic in that there little lock.

The Micro is for the USB serial communication interface.
A 9346 equivalent memory device.
And a blob of epoxy beneath which is the asic.

Yes they can be cloned, but not commonly done.
Done only by a very few people world wide, of whom
would never release this info. $$$ involved.

However I bid you good luck in you persuit.

tgodd
proitm
03-16-2004, 02:41 PM
tgood

One side have the usb microcontroller (4K bytes of EPROM) and a Serial EEPROM (2K).
The other have a 6 MHz clock, resistors and capacitors.
Where is the blob of epoxy which is the asic?
tgodd
03-16-2004, 03:04 PM
Be sure it is in fact a hardlock.
Hardlock is manufactured by alladin.
Sounds like it is some other USB hardware lock.

Hardlock can not be interchanged with hardware lock.
proitm
03-16-2004, 03:37 PM
tgood, it is a Hardlock by Alladin. I'm sure.
I use the Hardlock drivers and the tools to read the programable eeprom.
I have two, one coded and other with de MOD 29809.
tgodd
03-16-2004, 04:11 PM
It would appear as though you are correct.
I have never had to concern myself with that detail, because
I already know every thing I need to from the LPT hardlocks.

Still you have the daunting task of glitching the contents of the
MCU eeprom and reversing it.

Again good luck.

Once you have a disassembly of the eeprom, you still have the daunting task
of writing a proccess to calculate the seeding values.

Again good luck.

tgodd
proitm
03-16-2004, 05:00 PM
tgodd, I saw almost all your posts, and I know you have the knowledge.
I need your help to try with the USB device.

Thanks
seed
03-24-2004, 07:31 AM
I have clone many times, Aladdin's CD has all that is needed to clone.
You can only do this with other Hasp locks with the same seed code.
Question to you if l may ask... I am looking to obtain 1 wire button so l can write my own seed code to the hasp lock... firstly can l write to it, and would you know how?

Thank you
tgodd
03-24-2004, 08:11 AM
If you are a software developer then yes you are able to acquire Hasps that can then be programmed for the developer ID that has been given.
As per cloning... That is an entirely different matter.

By one wire button I would have to assume you are refering to a dallas lock device

What does a dallas lock device have anything to do with a hasp???

Sorry Dude...
I must be have lost something in the translation !?!

tgodd


Whats the best CAB editor/extractor/replacer for MSI cab files?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Whats the best CAB editor/extractor/replacer for MSI cab files?
PDA

View Full Version : Whats the best CAB editor/extractor/replacer for MSI cab files?

flyingsilicon
03-16-2004, 06:37 AM
Hi,
Whats the best CAB file decomp/editor/extractor/replacer for MSI cab files for new installshield cab files?
something like I5COMP or similar to it.
Do you know any?
rgrds
FlyingSilicon :p :p :p
peterg70
03-16-2004, 06:42 AM
I assume you did a search on the internet and this board for like cases.

Perhaps searching for I6comp might be logical?

My 2 cents worth
Peterg70
flyingsilicon
03-16-2004, 07:04 AM
thanks Peter,
I got I6Comp, but you may know its not working on new Installshield MS CAB files. You can do something with MS SDKs but I mean a really easy one just like I6comp.
thanks anyway for your reply.
rgrds
FlyingSlilicon :D :D :mad:
nikolatesla20
03-16-2004, 08:25 AM
For MSI cab's you don't need anything special - I'm not sure why you are wanting an API or anything like that. Windows XP can just open these cabs like any other.

Of course I haven't tried replacing files in them.

Old InstallShield cabs were proprietary, but MSI cabs are normal windows cab files..

-nt20
Digitalqaida
03-23-2004, 09:13 AM
Yea I got the exact same problem so if any can find a solution.........:(
I found a discussion somewhere on the Web, one said that winAce was able to do the Job, but no .....i tried winace, Acdzip , and different other packers/repackers....my best guest so far is to disassemble other files used in the set up and see if it checks filesize etc. In my case it replied that a certain file was missing, .......

DQ


ASPR - IAT on Xp and 2000
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR - IAT on Xp and 2000
PDA

View Full Version : ASPR - IAT on Xp and 2000

rf1911
03-16-2004, 08:50 AM
I have a target packed with ASPR 1.23.

I dumped it, put back stolen bytes, fixed IAT with imprec.

All runs fine under XP, not on 2000. It cant find function 525 from advapi32.dll

Did i miss something?

(feel free to offend me if this has being already talked before, i just couldnt find anything about it.. :) )

Thanks..

RF1911
nikolatesla20
03-16-2004, 10:31 AM
Does function 525 have a name or is it being imported by ordinal?

I would first try to remove the entry for the import from the IAT manually (not too hard).

-nt20
hobferret
03-16-2004, 12:21 PM
Hi :)

If it is telling you this in a messagebox then the name is different in 2000. :D

Like RestoreLastError (XP) & SetLastError (ME) :D

/hobferret
rf1911
03-16-2004, 01:38 PM
It's imported as ordinal..

How can u handle those situation (XP/ME/2000)

Thanks!
amitophia
03-31-2004, 03:49 PM
It's imported as ordinal..
In windows XP 's advapi32.dll (SP0) function with ordinal number 525 is SaferComputeTokenFromLevel


Interesting technical article about the Windows loader
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Interesting technical article about the Windows loader
PDA

View Full Version : Interesting technical article about the Windows loader

dELTA
03-16-2004, 07:44 PM
Quite interesting technical article about the Windows loader:

http://msdn.microsoft.com/msdnmag/issues/02/03/Loader/default.aspx
disavowed
03-16-2004, 10:01 PM
<begin name-dropping / bragging>

i've spoken with the author (russ osterlund), he's a nice guy

<end name-dropping / bragging>


Advanced address context question!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Advanced address context question!
PDA

View Full Version : Advanced address context question!

Nad_Af
03-16-2004, 11:58 PM
Currently, I am writing a DLL but I have a problem.
Suppose that you have two running processes A and B, and you know that in process B the virtual address of a function is XXX, and of a varibale is YYY.

How can you call the function and modify the varible from process A?
What is the first thing to do?

I know I need to use WriteProcessMemory, but how???
Solomon
03-17-2004, 01:12 AM
You can't call that function directly from A.
In process A, you have to generate some push/call instructions and write them to process B, then use CreateRemoteThread to trigger your call instructions. or you can use Debug API to attach to process B, then use SetThreadContext to move EIP to your code. I think the 2nd way is difficult to implement.

Currently, I am writing a DLL but I have a problem.
Suppose that you have two running processes A and B, and you know that in process B the virtual address of a function is XXX, and of a varibale is YYY.

How can you call the function and modify the varible from process A?
What is the first thing to do?

I know I need to use WriteProcessMemory, but how???
dELTA
03-17-2004, 08:46 AM
Nad_Af, just to make sure we understand what you mean:
When you say "call the function from process A", do you mean "make process A cause it to be executed in the context of process B" (like Solomon understood it), or do you, for some crazy reason, want to execute the function that is present in the memoryspace of process B, inside the context of process A?

Also, you are talking about some DLL? Is this DLL loaded in both processes? In that case, you can implement some interprocess communication method into the DLL, and in this way more easily accomplish what you want, without any APIs for manipulating memory/threads/context for other processes.
Nad_Af
03-17-2004, 04:59 PM
What i mean is that I want to move the execution from PROCESS A, to the function in PROCESS B :confused: . But the DLL is not loaded in the address context of B.
Can I switch the context from A to B?
nikolatesla20
03-17-2004, 05:20 PM
Well, you can switch the context in a couple of ways:

1. Write a kernel driver that calls KeAttach and KeAttach. This forces a context switch. However, this will not put the params you want into the function, you'd have to pass those some other way.

2. Create a debugger process that debugs process B, and then you can easily freeze process B at the function, and write the parameters to the stack, and then let the function execute. Catch it again when the function goes to return. NOt too bad. However, if "your" code is in a DLL in process A you won't be able to do debugger because debug requires process A to actually be a debugger.

3. Grab a local copy of all the code of the function for your own use. Takes a little more work since you need to know where the function starts, stops, what other functions it calls, any global variables, etc. Not too practical I guess.

4. If you simply want to call a function and you know that process B won't crash, YOu don't need to be a debugger, you can simply call SuspendThread, and then GetThreadContext(), and then you can actually set the EIP with SetThreadContext too if you want, to force it to go to the function. But this will most likely crash after it's run the function once, so a full debugger is usually a better option, since you also can set a breakpoint to trigger the function call/return. Using only ThreadContext functions you won't necessarily know if you are at a point that is safe.

-nt20
Nad_Af
03-18-2004, 03:54 PM
I will tell you the story.
I have made a DLL that captures mouse messages, and when it encounters any, it calls the procedure sotred in Process A, the address of this procedure is passed to the DLL via a function exported. Because the DLL is loaded in the linear space of the process that loads it (Process A), it works fine; however, it doesn't work for messages that don't belong to Process A.

What Can I do to execute it safely?
dELTA
03-18-2004, 07:14 PM
So, you are capturing the mouse messages with a SetCapture hook then I presume? I think the clearly best and cleanest solution would be to capture the mouse messages with a global hook instead. Then the dll would be automatically injected into each process, and you could always execute the procedure at the address you are referring to (whatever address now this might be that you are talking about?) directly from the hook procedure, since you will always be in the right context when the hook is activated.
Nad_Af
03-20-2004, 12:52 AM
I already have set it using SetWindowsHookEx(), but the global function when executes doesn't run the procedure I passed to the DLL from the process (application), I have put some code to call that procedure from within the Global Hook function.

for example, I called the DLL from Visual Basic, I sent the DLL a function address within my VB app, but when the mouse pointer gets out the window of my VB app. the function is not called at all!

can you help??
dELTA
03-20-2004, 08:30 AM
Exactly what is this function that your hook function tries to call inside each application? Where does it get the address from? Please explain in more details what your goal is with this hook, and how you have implemented it, for us to be able to help.

Also, dealing with function pointers inside VB seems like trouble to begin with. :)
sna
03-20-2004, 09:51 AM
The custom callback function has to reside in a DLL, too. Can't you put it inside the same DLL as the hook procedure?

4. If you simply want to call a function and you know that process B won't crash, YOu don't need to be a debugger, you can simply call SuspendThread, and then GetThreadContext(), and then you can actually set the EIP with SetThreadContext too if you want, to force it to go to the function. But this will most likely crash after it's run the function once, so a full debugger is usually a better option, since you also can set a breakpoint to trigger the function call/return. Using only ThreadContext functions you won't necessarily know if you are at a point that is safe.
The problem with this approach is that OpenThread() is not implemented on Win95, 98, NT 4.

Another family of techniques, which are not applicable in this case, is the "shatter attacks":
http://www.idefense.com/idpapers/Shatter_Redux.pdf
I say not applicable because a randomly picked system may or may not be receptive to this kind of attack;
And from the sounds of it this is going in production code?

Regards, sna
Nad_Af
03-21-2004, 03:19 PM
The hook function catches WM_LBUTTONDOWN and then tries to call the VB function by its address (which is passed to DLL).

Exactly what is this function that your hook function tries to call inside each application? Where does it get the address from? Please explain in more details what your goal is with this hook, and how you have implemented it, for us to be able to help.

Also, dealing with function pointers inside VB seems like trouble to begin with. :)
dELTA
03-22-2004, 08:13 AM
You still haven't told us what this function is that you are trying to call, and more importantly, how its address is "passed to the dll"?


How to disassemble Startup code of Binary
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to disassemble Startup code of Binary
PDA

View Full Version : How to disassemble Startup code of Binary

joeblack_2k2
03-17-2004, 12:04 PM
When disassembling a binary file, I only see the code portions starting at the main routine. Is it possible to disassemble the compiler startup and exit code as well ?
dELTA
03-17-2004, 01:13 PM
This sounds to me like some kind of misunderstanding. Any normal disassembler will be able to show you the disassembled code at the entrypoint of the executable (check the EntryPoint field of the PE header to see what address this is), and this is indeed the first code that is executed when a program is launched. If the code at this address is indeed the code of your "main" procedure, then your compiler/linker hasn't generated any additional startup code.

What makes you think that the code you see in the disassembly is your "main" procedure? Which disassembler are you using?
Polaris
03-17-2004, 01:37 PM
This sounds to me like some kind of misunderstanding. Any normal disassembler will be able to show you the disassembled code at the entrypoint of the executable (check the EntryPoint field of the PE header to see what address this is), and this is indeed the first code that is executed when a program is launched. If the code at this address is indeed the code of your "main" procedure, then your compiler/linker hasn't generated any additional startup code.

What makes you think that the code you see in the disassembly is your "main" procedure? Which disassembler are you using?

Delta is right... I answered the same question on another forum with a "IDA will do it... With no problems".

Surely he is not much into disassembling: probably he is looking at the code he wanna analize without knowing that :D

Byez,

Polaris
joeblack_2k2
03-17-2004, 01:59 PM
Delta, I'm using IDA. IDA shows (amongst other) the current position in the binary. This position matches the position of the file when opened with a hex editor.

When I scroll to the very first line of code in IDA, the current position is shown as e.g. 0x400. The hex-code of IDA at 0x400 corresponds to what Hexedit shows at 0x400. Unfortunately all the code from 0x000 to 0x400 is not available in IDA.
The same is true for the end: IDA ends at 001E17FF (which is commented "END start") while the file in Hexedit ends at 1E31F8.

That is why I think that there are parts of code which IDA doesn't show.
Is there a possibility to tell IDA to do so ? Might be missing dll's be the reason ?

Thx,

JB

This sounds to me like some kind of misunderstanding. Any normal disassembler will be able to show you the disassembled code at the entrypoint of the executable (check the EntryPoint field of the PE header to see what address this is), and this is indeed the first code that is executed when a program is launched. If the code at this address is indeed the code of your "main" procedure, then your compiler/linker hasn't generated any additional startup code.

What makes you think that the code you see in the disassembly is your "main" procedure? Which disassembler are you using?
Iwarez
03-17-2004, 03:18 PM
The missing bytes are the .exe header and the other sections like resources and other things not related to the disassembly of a file.
dELTA
03-17-2004, 07:34 PM
joeblack_2k2, an exe file does not run linearly from the start to the end, which seems to be your current conception. The entrypoint can be anywhere in the code section, and it is specified in the PE header. When disassembling a file in IDA, it will normally take you to the entrypoint automatically to start out with. Also, dll:s have nothing to do with the disassembly of the main executable module in a program.

I strongly urge you do read up on PE executable files in general, or you will have very big problems going on any further.

I recommend checking out the "PE Tutorials" in the "Tutorials" section of Iczelion site (http://spiff.tripnet.se/~iczelion/), and continuing from there.
joeblack_2k2
03-17-2004, 11:38 PM
Delta, thanks for your tip !

Actually I was not talking about the execution of an exe-file, but just analysing the hex-view in IDA. This view <b>does</b> show me linear file contents. And within this view I found out, that parts (in the beginning and the end) in comparison with a "normal" hex editor are missing.

Btw, I am inspecting a file for Pocket PC.
I wonder whether these files are PEs too ?

JB
Iwarez
03-23-2004, 04:57 PM
The pocketpc files are also PE files with the same structure. And once again... IDA doesn't show you the header of an .exe so it's normal you don't see some bytes.
The Svin
03-28-2004, 01:36 PM
Well,. C,C++ and other HLL compiled apps have start up code and the is option in IDA not to show it, I'm not fun of IDA (too slow and has disasm engein with errors) but by default start up is collapsed (+ - to control it)
You can look up address of begining of code section and go to there using G and typing address (mostly 401000h) Anyway, indeed frist section at the begining of PE binary is pseudo section, and contains stab, headers, directory information, in other words - has nothing to do with code of main programm.


Got SERIAL..Still Can't Register?!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Got SERIAL..Still Can't Register?!!
PDA

View Full Version : Got SERIAL..Still Can't Register?!!

zkhan123
03-17-2004, 12:54 PM
Hi all,
I am able to sniff Serial of one program
But even after a 'Registration Succeded' MsgBox, There is no Success.

My Findings are :
1)There is a separate User-ID for each Computer.

2)A file *****.dat is created.The real Serial No: is Encrypted and stored here.
3)The File is packed with ASpack (Version???)

Seems more Protection Mechanisms are there.
Any body had the :mad: idea?
SideSwipe
03-18-2004, 01:27 AM
Perhaps the program is connecting to a remote server to validate the serial number you fished? If you use a good firewall it should tell you if the program is trying to connect to a remote auth server. Just an idea.

SS
Mr_BlacK
03-19-2004, 05:31 PM
Hi zkhan123,

Notice some protections make their serial generation routines depend on a program integrity check. This way, if you set breakpoints in the code, the generated serial you fish will be valid and recorded, but as long as you restart the program and you change or remove the breakpoints, the serial won't pass the initial validation and it will fail.

You'd better study the initial validation process, since that is the really important one which will lead to you target being set to "registered mode", even though it may use the same way to protect against tampering.

Please let us know of your progressions.
Good luck!


16 bit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > 16 bit
PDA

View Full Version : 16 bit

naides
03-18-2004, 06:34 AM
Just a general Question:

Does the 16 bit version of softIce work in a pure Win32 environment?

When I try to debug a 16 bit app with my regular Sice, it breaks only inside the NTVDM module, which is emulating the 16 bit environment for the app.

Neither Olly or WinDasm debugger seem to break inside the app code.

To restate the question, are there other 16 bit app level debugger that would work in a 32 bit environment?
Polaris
03-18-2004, 10:53 AM
Just a general Question:

Does the 16 bit version of softIce work in a pure Win32 environment?

When I try to debug a 16 bit app with my regular Sice, it breaks only inside the NTVDM module, which is emulating the 16 bit environment for the app.

Neither Olly or WinDasm debugger seem to break inside the app code.

To restate the question, are there other 16 bit app level debugger that would work in a 32 bit environment?

I think that the older versions of Borland Turbo Debugger will do the job... Unless you ran into memory problems :)

Have a try!

Polaris
least
03-19-2004, 03:55 AM
Why do you need to run 16bit version of sice in win32? All win32 sice can debug 32bit, 16bit windows and also dos code. Or try vmware, install win3.1 there and run 16bit sice there (works!).
Regards,
least


ASProtect high memory address trick
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect high memory address trick
PDA

View Full Version : ASProtect high memory address trick

Solomon
03-18-2004, 10:15 AM
I unpacked a prog protected with ASProtect v1.23 RC4, resconstructed the IAT and stolen bytes, fixed ResotreLastError of kernel32.dll.

The unpacked EXE runs well in Win2k3/2k/XP, but fails in some Win98 systems. The error is: failed to execute target process(Error code 1455) . That means not enough swap space to load the target. I noticed the ImageSize is 084D5000, very large number, nearly 130MB virtual memory. ASPR has re-based some sections to high memory address.

Currently I have no Win98 box to test it, perhaps increasing the swap space of Win98 will enable the exe to run. Any other way to reduce the virtual memory requirement except re-basing back these sections?


sentinel pro crack...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sentinel pro crack...
PDA

View Full Version : sentinel pro crack...

donfy
03-18-2004, 10:57 AM
Sorry...
I have a new program: italian program, Magistra.exe
It is protected by sentinel super pro. I need to crack it, but i cant do. i don't know programmation rules to make it.

I pray you to help me. I have original key and software, but i want delte the key call from my exe.
Someone tell me (possibly in italian) how i can it?

Thanks. Fabrizio. Roma
SideSwipe
03-18-2004, 11:16 AM
You are apparently so anxious to achieve your goal you failed to see, or at least read the BIG RED LETTERS at the top of the Forums and have not read the FAQ. This is not the place to come if you are looking for someone to do the work for you and/or if you have done nothing to try to help yourself solve your problem and shown some of your own work. Time for you to do some study and searching on your own and then ask a more focused question.

Regards,
__________________
SS
donfy
03-18-2004, 11:22 AM
You are apparently so anxious to achieve your goal you failed to see, or at least read the BIG RED LETTERS at the top of the Forums and have not read the FAQ. This is not the place to come if you are looking for someone to do the work for you and/or if you have done nothing to try to help yourself solve your problem and shown some of your own work. Time for you to do some study and searching on your own and then ask a more focused question.

Regards,
__________________
SS

Side thanks. I sorry. I need help in what mode i can make it for initial.
For example: i dont know what file to manipulate...
Thanks
JMI
03-18-2004, 12:01 PM
Gosh SideSwipe:

There is something very familiar about your post. Did you write it yourself? :rolleyes: You forgot to make the BIG RED LETTERS part RED.

Regards,
esther
03-18-2004, 12:29 PM
Stealing parts of statement is lame ,get flame!!!! LOL
donfy
03-18-2004, 12:37 PM
[QUOTE=JMI]Gosh SideSwipe:

Dear JMI I ask you excuse but me indeed I don't know whether to begin and that programs to use. I would like to learn even on a manual in Italian, but I don't know indeed what programs to use for craccare the key and thing to modify. Can you help me?
naides
03-18-2004, 12:40 PM
[QUOTE=JMI]Gosh SideSwipe:

Dear JMI I ask you excuse but me indeed I don't know whether to begin and that programs to use. I would like to learn even on a manual in Italian, but I don't know indeed what programs to use for craccare the key and thing to modify. Can you help me?

Look below, the link to CrackZ Archives, and read about Dongle Protections.
That should get you started.
donfy
03-18-2004, 12:45 PM
Naides you believe that alone I can eliminate the protections?
Which file do I have to work? the file. exe?

Do you advise me?
Thanks.
JMI
03-18-2004, 12:57 PM
donfy:

It certainly does not appear that you have enough basic knowledge to attack this type of protection system. But what you should do first is a great deal more reading about dongel cracking and THEN ask questions. We are not here to "train" you, only to add assistance AFTER you do most of the basic work of research and then attempt the effort yourself.

Regards,
donfy
03-18-2004, 01:00 PM
[Naides I pray you help me. I don't understand there nothing.
I have seen the list of the dongles. But what file I have to unload.
You know I have puara to ruin the key hardware using badly that programs.
I have Utraedit. What do I have to now do?
Which file do I have to modify? SX32W.DLL or MAGISTRA.EXE (start program file)?

Help...
donfy
03-18-2004, 01:02 PM
JMI you are right, but I don't succeed in understanding the manuals in English.
I am writing you through a translator...
Where can I find manuals in Italian?
donfy
03-18-2004, 02:00 PM
JMI I have made up for VISUAL BASIC. Can I work with this program on the files of the Dongle?
JMI
03-18-2004, 02:00 PM
donfy:

How would I know? Try doing a search using your search engine for "sentinel super pro + manual + Italian."

Regards,
Tolstoinisten
03-18-2004, 02:36 PM
donfy:

There are some great Italian crack sites out there. Just here yesterday I was browsing an Italian cracking site (I'm pretty sure it was Italian anyway). Use google (google.it - use the 'Cerca solo le pagine in Italiano' option. You know what it means).
donfy
03-18-2004, 02:38 PM
donfy:

There are some great Italian crack sites out there. Just here yesterday I was browsing an Italian cracking site (I'm pretty sure it was Italian anyway). Use google (google.it - use the 'Cerca solo le pagine in Italiano' option. You know what it means).

Dear Tolstoinisten, i have finded, but i can't find crack italian site or manual. Can you suggest me any site in wichh i can learn?

Thanks.
hobferret
03-18-2004, 03:48 PM
donfy :)

Sorry about this guys but had to have a say :D

I used to know an Italian family years ago :eek:

Sapevo una famiglia italiana e ricordavo alcune parole

Tenti e ottenga presa di software della traduzione

It's probably wrong but it was years ago!!!

/hobferret
Tolstoinisten
03-18-2004, 05:25 PM
donfy:

It took me 2 minutes to find this site (google.it). It is an Italian site with links. You will find some links on this site that will lead you to a number of Italian websites that deal with RE.

Where you go from there is up to you. You need to get in touch with the Italian RE community. Maybe you will find it there, maybe not. Maybe you will find it via IRC (!), newsgroups or other. Who knows?!

Again, good luck.

web.tiscali.it/coniglio_giuseppe/links.htm
dELTA
03-18-2004, 07:17 PM
ZaiRoN, could you please flame the guy in Italian, so he understands? :D


Unpack PECompact 1.84 - Have anyone can help me?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpack PECompact 1.84 - Have anyone can help me?
PDA

View Full Version : Unpack PECompact 1.84 - Have anyone can help me?

Zombie
03-18-2004, 08:41 PM
I have trouble for unpack it...Cant found code POPAD.
Can u help me for unpack PECompact 1.84 tut?

Thanx 4 read
%UNDEFINED%
03-18-2004, 10:58 PM
1. What is the problem....
2. What is the protection.....
3. What tools are you using....
4. What tutorials have you read....
5. Show your output listing WITH comments....
6. NOW ask your question....

Did you search this forum?
Did you search google?
Zombie
03-19-2004, 03:55 PM
Ops...Sorry didnt look this rule :)...
But i have just known how to do...I'll try post it late..

Again..Sorry about rulez :)
%UNDEFINED%
03-20-2004, 07:59 AM
This is a real quick example...no plugins used, trial version 1.84

Good Packer, he likes his stack tricks
Shoob
03-21-2004, 06:52 AM
@Zombie
I had an look at it, its nice and there must be alot fixed like if you click on the about box and the whole compression. :rolleyes: use 000011D7 as entry point and when you trace into the deep call you will find the bytes you need for you OEP. nothing more to say :rolleyes:
Zombie
03-21-2004, 11:56 AM
Yeh..Thanx everybody 4 help me...
:)

I done with it :)


Patching .NET opcodes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Patching .NET opcodes
PDA

View Full Version : Patching .NET opcodes

Mr_BlacK
03-19-2004, 05:24 PM
Hi, everyone

I'm new at cracking .NET applications.
My first target is easy to decompile with ILDASM and the code is pretty readable even though I'm new to the framework platform. However, I'm missing a decent opcode list and, most of all, a program where I can see the opcodes together with the disassembly so I can study the code and get to know where to patch and which new opcodes to replace the original ones.

Anakrino crashes here and IDA 4.15 doesn't seem to load the target DLL.
I would appreciate any help on .NET "opcode-lists" and tools to see/change bytes in .NET applications. I have already searched both this forum and Google but didn't find any tool which can help me. A tool like the p-code debugger from my old friends from WkT! would be extremely handy for this task. ;)

I'm currently downloading M$ SDK, but would love to use any other tool which doesn't come from them.

Thank you all in advance for your time and your kind help.
Happy cracking! :p

Mr. BlacK
cRk
03-20-2004, 11:30 PM
i think your point is good.. but will be better if your primary purpose will be knowledge instead of cracking ;)... i'm looking too for any info. on how to reverse bytes , like any other app. VB , delphi .. , with use of ahex editor ... is this possible?? i got Ildasm + a tool made by Yoda to get detailed information of the structure.. but what about adeep analisys like W32dasm gives or IDA gives what exactly can be reversed with this .NET applications?? cuestions is .. is it possible to patch this kind of applications? how? what tools can be used?? ..i saw some comments about patching the Framework libraries used.... is that the only solution ?

Regards
Bengaly
03-21-2004, 03:31 AM
i created this tool last year for .NET lookup tool.
hxxp://biw.rult.at/tools/dexil.zip

have fun.
esther
03-21-2004, 04:54 AM
>is it possible to patch this kind of applications?

Some guys in Biw has crack some .net protections

http://biw.rult.at/tuts/crackmenot_tut.rar

Regards
dELTA
03-21-2004, 05:50 AM
For the people who have tried both tools, how does IDA compare to ILDASM when disassembling .NET programs? Won't IDA show any opcodes, like with normal programs, if you activate it from the options?
Mr_BlacK
03-21-2004, 07:19 AM
Hi everyone.

I've been playing around and had some success. I used IDA 4.51 + ILDASM + .NET deflector. Each of these programs have something which the others don't have, and combined, they make reversing .NET applications much easier.

I was using a foreign version of ILDASM, which made me unable to see that there was an option to see the bytes corresponding to each instruction. This, combined with the ability if .NET deflector to decompile some classes and the clean and intuitive new interface of IDA, really helped me a lot.

I have just done some basic jump patching to bypass checks in binaries which don't have the "tampering check" enabled (this topic was covered somewhere on this forum), so I guess it's too early to make out any conclussions, but my first impression is quite good, even though I haven't even used the SDK debugger yet, for example.

Let me know if I can be of any help to any of you starting this subject too. My knowledge is very basic, but I am willing to share what I know with whoever is interested on this.

And the last, but not the list, I have to accept that the way I requested for help may lead to some kind of misunderstanding. I associate inside my head cracking with learning and my main interests are learning, having fun, and sharing my conclusions with the rest of you. Please excuse me if my first post didn't show my intentions in the correct way.

BTW, I'm still missing an "opcode" list for the .NET framework.
Were you able to find any?

Thank you all for your replies. I will check those links posted.
Happy cracking! ;)

Mr. BlacK
Mr_BlacK
03-21-2004, 07:41 AM
Well, I tried the links.

Both tutorials at BiW reversing are very interesting and dexil is a great help too, thank you!!!

I have to explain that when I patched the binaries, I did it the old way, that is, I patched one kind of jump to another ( 2B - 2C - 2D are the possible IL opcodes for jumps I have seen so far ). IDA (4.51) will show the opcodes too together with a handy arrow system very useful to track jumps, and .NET Deflector will sometimes dump a very accurate decompilation of the IL code.
When .NET deflector fails to decompile, disassembling is quite ilustrative too.

Take a look at all of these programs and some other posts/tutorials on .NET reversing and you will see it's quite easy. The dead listing approach reminds me a lot to the one related with Visual Basic p-code applications. I guess that with some more knowledge on the .NET framework itself it will be easy to play with .NET binaries.

Another question which arises is if EXE packers will work with .NET binaries or if a new generation of packers must be created, which may make these applications *EVEN* slower. I will try some UPX now to answer to this point.

Please let me know your conclusions too and thanks for your help and time.

Mr. BlacK
cRk
03-21-2004, 11:43 AM
Mr. Black i was searching for this tool ".NET deflector" without success .. where can i find it? :)
dELTA
03-21-2004, 03:14 PM
He probably means ".NET Reflector":

http://www.aisto.com/Roeder/DotNet
dELTA
03-21-2004, 04:44 PM
For anyone interested in this "tampering protection" (strong name signatures), here's that old thread discussing it:

http://www.woodmann.net/forum/showthread.php?t=4389
Mr_BlacK
03-21-2004, 05:04 PM
Yes, sorry, I mistyped the name. It's .Net Reflector, as dELTA already pointed out. It seems to be a great tool, but it lacks (or I haven't been able to find it) the ability to show IL opcodes and sometimes the decompiler fails. Anyway, it really surprised me. Give it a try!

I also recommend reading some previous topics on .NET, particularly the ones about strong signatures (http://www.woodmann.net/forum/showthread.php?t=4389) and .NET debugging (http://www.woodmann.net/forum/showthread.php?t=4459), the two BiW tutorials about dotNET reversing at http://biw.rult.at, and the article about IL itself already mentioned in some other post, located at http://www.macadamian.com/column/assemblies.html

Enjoy yourselves ;)
zacdac
03-21-2004, 08:39 PM
@Delta

There are two basic types of MSIL (miscrosoft intermediate language) disassemblers.

ILDASM, Reflector and the like use the Reflection api to disassemble a dot net assembly.

IDA does not use the reflection api, instead it examines the bytes of the dot net assembly to disassemble.

The distinction between the two methods above is useful because many of the current crop of dot net protectors have the ability to stop disassembly via the reflection api. This is achieved by placing invalid meta data in the CLR (common language runtime) header of the file. This meta data is ignored during the execution of the program so it runs fine.

@Mr_Black

For a listing of MSIL opcodes, there were documents that shipped with the initial beta release of Visual Studio .Net. These contained the info you wanted. The document name escapes me atm, but i will try to remember to look it up for you. There is also a MSIL chm book around as well.

ZD
cRk
03-21-2004, 09:02 PM
i see these kind of applications are getting in used almost frecuently from some author to avoid reversing.. what else could be?? i don't see nothing special by coding using this Net framework crap .. applications just runs slowly + needs 23 MB of framework crap libraries to run out.. give me abreak :D

but imagine all program will be coded using this... the situation could be dangerous for us (reversers) so i'll hope more tools up+ todate will arrive for this.. more tuts + knowledge to kick once again Microsoft monopoly and his .net frame stuff

we'll see more program using this... author are thinking this can't be cracked ... bullshit . we're getting use to it...let's hope the really good programs we had bought or we use freely won't use this for our speedy needs... imagine an application coded with this and Using Xtreme Protector...

LOLLL :p
Mr_BlacK
03-22-2004, 03:09 PM
Hi. First to thank master zacdac for his explanations, which clarify why my target "couldn't be decompiled" with Reflector. I'll search info on those obfuscators, because it would be nice to code some anti-invalid data tool to play with ;)

I also have to say that I totally agree with cRk. My test target is an internal beta build of a quite famous iRC client recoded in .NET. Even though it's a beta, which will be optimized, the code takes too long to load and sucks a lot. The organization of the DLLs reminds me a lot of the Java classes. It seems like we will have to start thinking of the future as a Virtual-Machine powered one: damn slow, but multi-platform. At least, once we get to know how to reverse these programs, I guess we will be able to play with different Operating Systems, which is always fun. Maybe it will be a good way to attrack crackers to the magical world of *N?X cracking :cool:

While so, it's time to study and learn.
zacdac, I will search too, but please let me knoe if you put your hands on some of those books/docs you just wrote about

Thanks for the answers.
It's nice to see people sharing the same (cool :p ) interests.
Happy reversing!
SynApsus
03-22-2004, 03:57 PM
To find the opcodes, this kind of site :
http://dotnet.di.unipi.it/EcmaSpec/PartitionIII/

is very useful :cool:

Have a nice day !
Mr_BlacK
03-22-2004, 04:24 PM
Wow, thanx SynApse.
That's a very good resource!

The offline version is available at http://dotnet.di.unipi.it/ecmaspec/ecmaspecs.zip

Thanks again! :D
The Svin
03-23-2004, 10:24 AM
I would appreciate any help on .NET "opcode-lists" and tools to see/change bytes in .NET applications

.NET is related to OS
"opcodes" is related to processor. Big difference ;)
Bengaly
03-23-2004, 02:26 PM
yeah, i agree with The-Svin.
i would not call the opcodes of msil an real opcode.
the .NET is just a stupid VM.. another java steal off.
and i too wonder why we need VM on our real machine and runnning 20k app which takes 10sec to run while we can code 2k app in asm and run in 1ms :D
something went wrong in the mind of m$ programmers.
ah well.
they do shape the world as they see, sad but true.
dELTA
03-23-2004, 03:11 PM
Well, what would you call them then? In Java, they are called "bytecodes" anyway.
JMI
03-23-2004, 03:29 PM
I have it on good authority that dELTA knows his "Beans" and we're not talking coffee here. :D

Regards,
The Svin
03-23-2004, 03:59 PM
Well, what would you call them then? In Java, they are called "bytecodes" anyway.
bytecodes sounds better. not confusing :)
SiNTAX
04-02-2004, 02:50 AM
Here's something that shouldn't be missing from your .NET cracking toolbox: Mono. ( hxxp://www.go-mono.com ). Freely available implementation of a .NET runtime including source.
SiNTAX
04-02-2004, 03:07 AM
i see these kind of applications are getting in used almost frecuently from some author to avoid reversing.. what else could be?? i don't see nothing special by coding using this Net framework crap .. applications just runs slowly + needs 23 MB of framework crap libraries to run out.. give me abreak

but imagine all program will be coded using this... the situation could be dangerous for us (reversers) so i'll hope more tools up+ todate will arrive for this.. more tuts + knowledge to kick once again Microsoft monopoly and his .net frame stuff

I'm afraid that this will be unstopable.. as some of the newer API's of Longhorn & Avalon will only be accessible from the .NET runtime. So people will be forced to make .NET programs.

As for the speed issue.. in .NET you can use Ahead Of Time compilation, meaning you have native x86 code that you run, just like a normal .exe program.
cRk
04-02-2004, 10:36 AM
finally this just comercial business between microsoft monopoly and the hardware manufacturers .. each time a new OS comes they all need more RAM & more faster computer .. and then people have to BUY .. i'm not saying this won't be future way the software will be.. but in my case i will look for something different than Billy crap and will stay using old Way ..making and application in this way wouldn't be better .. and i'm sure many people don't like .NET stuff .. i have used someof them as soon as i see how slow they works i end up uninstalling right away..

WinXP . Win2003 ..... new oneswill come ... but noone of Them will Survive Reversing and neither BUGS ..... Longhorn ??

i WOnder how many service packs and security patches will be done for that one

this is all Business my friend ;)

Regards


what can i do to crack dongle routine?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > what can i do to crack dongle routine?
PDA

View Full Version : what can i do to crack dongle routine?

donfy
03-20-2004, 04:53 PM
I have used Deassembler W32 and and Olly.
Therefore W32 tells me that to the sentence: "non installed key"
to which correspond two offsetts: 00024145h and 00024097h
To these two offsetts, corriponde a same jmp 0042BC50

To which corresponds all this:
| :00401000(U)
|
:0042BC50 64A100000000 movs eax, dword ptr fs:[00000000]
:0042BC56 55 pushes ebp
:0042BC57 8BEC movs ebp, esp
:0042BC59 6AFF pushes FFFFFFFF
:0042BC5B 687DBD4200 pushes 0042BD7D
:0042BC60 50 pushes eax
:0042BC61 64892500000000 movs dword ptr fs:[00000000], esp
:0042BC68 83EC1C sub esp, 0000001C
:0042BC6B 56 pushes esi
:0042BC6C 57 pushes edi
:0042BC6D 8BF1 movs esi, ecx
:0042BC6F 6A01 pushes 00000001

I believe is the routine where the Dongle works...

To the push 00274b to which it corresponds "the key is not installed" I have found that they are connected two addresses: 00424c97 and 00424d45

I have put with Olly a BP and the program stop here before giving me the error message.

But I don't now know whether to go on and I ask your help.
Tell me if everything thin for an ignorantone...

I have read tutorial to all flattens, but vio I pray helped me.

I want to know how change instruction in routine with OLLY.

Thanks
SideSwipe
03-20-2004, 05:58 PM
To change the instruction in Olly, simply double click on the offending instruction and either nop it out or code a jmp to wherever.

SS
donfy
03-20-2004, 06:05 PM
To change the instruction in Olly, simply double click on the offending instruction and either nop it out or code a jmp to wherever.

SS

Thanks, but to eliminate CALL instruction i cant know to do
I have BP in this line
Breakpoints
Address Module Active Disassembly
00424C9C MAG3 Always CALL <JMP.&MFC40.#1060>

I have not succeeded in intervening on this education

I have said to cancel it, but it has not served.
In short with a CALL that I have to do?

Fabrizio
SideSwipe
03-20-2004, 07:02 PM
Hello:

To eliminate a call instruction you must NOP it out. NOP stands for NO OPERATION. Double click on the call instruction, Olly will pop up a box that says Assemble at Address XXXXXXXX. Check the checkbox that says Fill with nop's then press the assemble button. The call will be disabled. To change a Call or other instruction, do the same thing except you must type in the instruction yourself and the hit the assemble button. Try to find out what makes the program jmp to 0042BC50.

SS
donfy
03-21-2004, 03:06 AM
Hello:

To eliminate a call instruction you must NOP it out. NOP stands for NO OPERATION. Double click on the call instruction, Olly will pop up a box that says Assemble at Address XXXXXXXX. Check the checkbox that says Fill with nop's then press the assemble button. The call will be disabled. To change a Call or other instruction, do the same thing except you must type in the instruction yourself and the hit the assemble button. Try to find out what makes the program jmp to 0042BC50.

SS

At JMP 0042BC50 is it:

:0042BC50 64A100000000 mov eax, dword ptr fs:[00000000]
:0042BC56 55 push ebp
:0042BC57 8BEC mov ebp, esp
:0042BC59 6AFF push FFFFFFFF
:0042BC5B 687DBD4200 push 0042BD7D
:0042BC60 50 push eax
:0042BC61 64892500000000 mov dword ptr fs:[00000000], esp
:0042BC68 83EC1C sub esp, 0000001C
:0042BC6B 56 push esi
:0042BC6C 57 push edi
:0042BC6D 8BF1 mov esi, ecx
:0042BC6F 6A01 push 00000001

Is it a dongle routine?

A have click NOP on call instruction bun the program told me dongle non installed.
SideSwipe
03-21-2004, 01:57 PM
Don:

I am no expert on Dongle Cracking. In fact, I have never tried to reverse a Dongle protected program. That being said, it is really hard for me to tell if the code snippet you provided is infact part of the protection scheme. All I can tell you at this point is how I would approach the problem.

First a little humor, face towards France and pray to the god +Tsehp. Then spin in a circle and shout Woodman until your voice is raw. Carve +Splaj's name into your arm and with the dripping blood write JMI on your churches front door. This puts you into the right frame of mind.

Put a break point on all occurances of MessageBox in your target to find out wich one fires when you start your program or select a menu item or whatever(there may be several). When Olly breaks, with your eyes, try to determine where the MessageBox function is called from. Before the message box function is called, there should be some kind of Dongle check function and then a descision if the program should continue running or display the MessageBox. From there, try to determine what instructions makes the descision. Make the program think that the dongle is installed. This is really a generic approach and may not work at all, but it is how I would start. Do some work on it, make notes of what you have tried, take a few screen shots of relevant code. Zip it all up and upload it to the board, maybe someone can help, always remember, the Lord helps them that helps themselves.

Best Regards,
SS
Woodmann
03-21-2004, 08:31 PM
Howdy,

The last time I checked, you cant nop a dongle call. Of course there are a few exceptions, but that was a long time ago.

You need to provide some more information.
Who made the dongle, you know, who's protection is it.
If it is a new app, you may name it, I give you permission but, you have better done some searching :eek:

You must be prepared to put in many hours of work to reverse a dongle.
There is no easy answer in almost every case.

If you have the dongle and require some additional features or extended time, you are in a different situation. It would help if you did some more research of your dongle to show your desire to learn.

Woodmann
%UNDEFINED%
03-21-2004, 11:20 PM
... First a little humor, face towards France and pray to the god +Tsehp. Then spin in a circle and shout Woodman until your voice is raw. Carve +Splaj's name into your arm and with the dripping blood write JMI on your churches front door. This puts you into the right frame of mind...
LMAO, I am going to get that printed on a T-Shirt.

I dare say that comes close to topping some of the whitty comments I have read of JMI's, ...close...almost


Softice Will not display
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Will not display
PDA

View Full Version : Softice Will not display

L2R
03-21-2004, 07:08 PM
Hello I am having a problem with the softice code box even displaying

I press Ctrl D and the softice display doesnt show, everything freezes til I press ctrl d again or type x and enter

Ive tried all the displays for it and it still doesnt seem to work

I have a intel 8284 chipset win2k sp4 256mb ram

Can anyone help me for this
Tolstoinisten
03-21-2004, 08:21 PM
Hello I am having a problem with the softice code box even displaying

I press Ctrl D and the softice display doesnt show, everything freezes til I press ctrl d again or type x and enter

Ive tried all the displays for it and it still doesnt seem to work

I have a intel 8284 chipset win2k sp4 256mb ram

Can anyone help me for this

What version is it?

I had (actually, I think I still do), a problem with SICE not showing. It seemed that everytime I wanted to add another export of mine own, instead or on top of the default ones, the bloody thing wouldn't show up for some reason. Still don't know what causes this. Obviously a bug. Anyway, I've left SICE at default and it pops out just as it is supposed to do, except whenvever I add exports it goes nuts.

Your scream doesn't freeze. SICE is running as it should, but it doesn't show on your screen. That is why you can type in 'x' and it will exist or CTRL-D and it will exist too.

I use Ollydbg and maybe you should too. The 4.1+ version of SICE are buggy on most Win2k or WinXP systems, I'm afraid...

T.
Kayaker
03-21-2004, 09:08 PM
I've got the same problem for the first time ever as well. While waiting for my graphic card to be repaired I threw an older first generation Radeon DDR card in. The card itself works fine with updated drivers and still looks great, but Softice comes up running but with a blank screen. It will only show a display if I remove the drivers and run with a default VGA driver at *16* colors (not even 256)! Then sice looks great and everything else looks crap.

Soo.., try playing with your video settings, uninstall your graphics driver, update your driver, etc. You might get lucky, you might not, thems the breaks I guess ;)
L2R
03-21-2004, 09:19 PM
I use use softice version 4.05 should i get a dif version
Tolstoinisten
03-22-2004, 06:05 AM
Hi,

I use v4.2.7. Used to have 4.05, just like you, and it worked like a charm. But then suddenly one day... lots of little blue screens of death... and I had to reformat my hdd & reinstall SICE. Maybe one day I will go back, but so far I'm pretty happy with Olly. You could try another version, but is it worth it?

Olly, olly, olly :D

T.
omega_red
03-22-2004, 10:49 AM
Olly, olly, olly :D

T.

Is it possible to use Olly to debug fullscreen DX applications?
Tolstoinisten
03-22-2004, 11:07 AM
Is it possible to use Olly to debug fullscreen DX applications?

Yes, I believe this is possible, but SICE is better at this than Olly. It is practically designed for this kind of debugging.
just
03-25-2004, 10:18 AM
How? Other than having 2 screens...
omega_red
04-03-2004, 01:44 AM
Yes, I believe this is possible, but SICE is better at this than Olly. It is practically designed for this kind of debugging.
I've used sice for that many times in old w9x days, but now when I try to pop it up when some directx app is active, it either crash or hang the system. DS 4.3.0 build 1268, win2k sp4, radeon 7500 (set up to universal video driver). I've tried playing with "video memory size" in config but with no effects.
Timbo
04-03-2004, 03:48 PM
@L2R
run cmd.exe in fullscreen, press strg+d & tell me if it popup
(if than it's a Driver (MS) issue )

@omega_red
you are not alone buddy

http://www.woodmann.net/forum/showthread.php?t=4522

problem with ati, well switch to an old RIVA TNT or GeForce
(for debugging purposes only ;) )

(seems ATI Drivers are buggy )
omega_red
04-05-2004, 09:38 AM
Yeah.. bad luck. Thx for the info.
zao
04-10-2004, 02:38 PM
i have the same problem with 4.27 not showing.. when i first installed it, it showed up but then it locked my mouse up so i had to reboot then it stoped showing the up.. i am using winxp with sp2 rc1.
dELTA
04-10-2004, 08:59 PM
I really wouldn't use non-final service packs for the operating system if I attempted to get Softice to work...


ASPR Dumper is additon for ASPRDbgr!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR Dumper is additon for ASPRDbgr!
PDA

View Full Version : ASPR Dumper is additon for ASPRDbgr!

FEUERRADER
03-21-2004, 11:03 PM
ASPR Dumper v0.1 Readme
====================

Description
-----------
This tool was written as auxiliary utility for unpacking ASProtect v1.23.
Designed to use with AsprDbgr v 1.06 or above.

Features
--------
- Dump active process (Asprotected target)
- Rebuild import table restored by AsprDbgr (uses ImpRec.dll)
- Dump polymorphic piece of code with OEP stolen bytes and save it to new section (idea is from AsprStripper, thx Syd)

Usage
-----
Run AsprDbgr and open your target. On question about import, choose Yes if you want to rebuild import through ASPR Dumper, this will allow AsprDbgr to restore it. In case of unresolved
entrys, better use ImpRec for this job. Questions about DIP-Table you must solve by yourself.
Stop trace at "Call + OEP-jump-setup at:" string. Just run ASPR Dumper, choose target process from list. At this moment you are possible:

1) Dump victim - dump active process. Aspr sections are NOT truncated.

2) Add import - if AsprDbgr resolved import table, you can fix dump. Enter IAT Start from AsprDbgr and press "Add Import".Name of fixed dump would be FileName_.exe

3) Get stolen bytes - restores polymorphic code. Enter Call + OEP-jump-setup value from AsprDbgr. Press "Get stolen bytes". Choose dump filename (it can be with restored IAT). ASPR Dumper would paste stolen block into new section .pseudo and correct Entrypoint.
That`s all.
..........
It's my new tool, designed for using with asprdbgr. It can help u get mutated stolen bytes.

Today or tomorrow it will be available for download from exetools.com forum ("Software Releases").

What u think about this tool? What u thinks, Manko?
cRk
03-22-2004, 03:47 AM
what about making all in one stuff .. i think you and Manko can work together ... let's way for Manko opinion .. btw if this is going to do same work as Aspr. stripper + works only under win2k/XP i don't see anything special on your "New ideas" so far i know aspr. stripper do gives stolen bytes very well on last section

Regards
Manko
03-22-2004, 02:53 PM
Hi!

I'd gladly give out my sources to almost anyone, though they are in a terrible state...
Yes, cRk, asprdbgr is w2k/xp only, so basing an unpacker on it might not do much good for you w9x guys... :P (And syds stripper does what most need anyway.)
I'm just too lazy to code w9x, since I never use it.

/Manko

what about making all in one stuff .. i think you and Manko can work together ... let's way for Manko opinion .. btw if this is going to do same work as Aspr. stripper + works only under win2k/XP i don't see anything special on your "New ideas" so far i know aspr. stripper do gives stolen bytes very well on last section

Regards
FEUERRADER
03-24-2004, 05:58 AM
To Manko:
I have some question to u:
1) What latest version of asprdbg? 1.06?
2) Where can I download sources of latest asprdbgr version? Maybe u can send it to me - feuerrader(at)ahteam(dot)org.
3) What u think about my ASPR Dumper ?
Manko
03-28-2004, 05:09 PM
Hi!

To Manko:
I have some question to u:
1) What latest version of asprdbg? 1.06?
2) Where can I download sources of latest asprdbgr version? Maybe u can send it to me - feuerrader(at)ahteam(dot)org.
3) What u think about my ASPR Dumper ?

Yea, I'm really lazy so 106 is latest. I ought to work on few targets where IAT still gets trashed... but...
I'll mail you the source, though it's awful... hrm...
I think your dumper is great! ;)

/Manko


VBox 4.6.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > VBox 4.6.2
PDA

View Full Version : VBox 4.6.2

jabz
03-22-2004, 12:46 AM
Hey Im trying to crack the newest VBox 4.6.2 and I have stumbled on a bunch of possible OEP. How do i find out the correct one?

All help is appreciated
hobferret
03-22-2004, 04:44 PM
jabz

Before anyone here will help you, you need to post what you have achieved so far.

Apart from that there are numerous items on the board regarding this very topic.

/hobferret
jabz
03-22-2004, 06:28 PM
sorry ok..i guess what im saying is i need help finding the correct OEP. i have read a lot of tutoirals on Vbox.. well not a lot but whatever is available, and every which one has a different method. When i use these methods on my program, i get different OEP possibilities. For example if i break on GetVersionExA i get in the part of code and a few lines up, i could see the stack being set up, with PUSH EBP.....and so on, if i break on GetVersion...i get the same result with the stack being set up..but at a different address. Furthermore when i have tried to trace it manually, i got to parts of code that looked like this

INT 3
INT 3
INT 3
INT 3
PUSH EBP
MOVE ESP,EBP
. ;so on
.
.
INT 3
INT 3
INT 3
PUSH EBP
MOVE ESP,EBP
. ;so on

as you can see, im clearly not sure what is happening, ill be glad if someone can explain this.
Thanks.
Jabz
naides
03-22-2004, 08:25 PM
I have been messing around with some VBox 4.6.2 protected apps that will go unmentioned here. I have tried to manually unpack it.

the first few bytes before the OEP, which set up the stack frame, are stolen, and you can reconstruct them if you carefully trace the last 10 to 20 instructions of the Vbox module, lost in between obfuscated code.

There are traps, so quick shortcuts, like braking in GetVersion and GetVersionExA often land in some senseless code which appears in partially unpacked-decoded segments but jump back into Vbox code.

I hope I made some sense

Naides
hobferret
03-23-2004, 10:46 AM
naides :)

I have never seen a VBox with stolen bytes, maybe I am wrong but unlikely :confused:

Most likely if you set a break on an API [NOT GOING TO SAY WHICH ONE] After the NAG you will be a few lines down from the EP, code may appear obfuscated if you just scroll up, however, if you look for the bytes which create the stack frame and then do U ADDRESS it will appear. It's the way some debuggers show the code following the break ;)

If you wanna PM me a program that has STOLEN bytes I would like to see it :)

/hobferret
LetMeIn
09-25-2004, 12:16 PM
I have a target wrapped in VBox 4.6.2 that I want to unwrap. I have been using the tut written by Lunar_Dust as a guide. The first several steps match almost exactly even though the target app is different. However, I get completely lost when I try to find the OEP. I have tried breaking on GetVersion, but the code I get doesn't match the tut. I'm not sure where to go from here. Any help would be much appreciated.

BTW, I am brand new to unpacking. This is my first attempt.
Eggi
09-25-2004, 02:21 PM
maybe a bpm on access on the code section can help you.
naides
09-25-2004, 05:56 PM
However, I get completely lost when I try to find the OEP. I have tried breaking on GetVersion, but the code I get doesn't match the tut. I'm not sure where to go from here. Any help would be much appreciated.

BTW, I am brand new to unpacking. This is my first attempt.

GetVersion has been used and abused. It worked in old programs, not any more. Try reading HobFerret Tut, try Ricardo Narvaja manual unpacking tuts, do not stick to the tutors so tighly. They are good, Lunar Dust one is very well written, but they do not have universal applicability.
LetMeIn
09-28-2004, 09:29 AM
Where can I find the Hobferret tut? I have found it on the exetools forum, however, I am not elegible to download until I make "3 valid postings." As yet, I cannot talking intelligently enough about the subject to make such postings.

I have used google, etc. and there is not much out there on vbox 4.6.
%UNDEFINED%
10-02-2004, 07:35 AM
PM me with the target, I would like to try my method of finding the OEP on this program.

hobferret tut:
http://www.exetools.com/forum/showthread.php?t=4160
JMI
10-02-2004, 05:49 PM
%UNDEFINED%:

He already said he found it on the exetools forum, but couldn't download there yet. Paying attention is useful. :yay:

regards,
JMI
10-04-2004, 12:24 PM
Well, sometime we are so anxious to be helpful, we forget to pay attention to the details. :eek: And a thank you to Naides for reminding me that this tut contains target specific information and, as such, is not appropriate for posting on this Forum. If you want to PM %UNDEFINED% I'm sure he can e-mail it to you or put it up somewhere where it might be permitted, :idea:

Regards,
%UNDEFINED%
10-05-2004, 08:40 PM
:whoops: I am so sorry JMI, I actually hadn't read it yet.

My thanks to Naides :loveu: for catching that, I should have been more careful.

And you are right JMI, somtimes I get that way, I am not the most experienced Unpacker, I don't get into keygening or other types of R.E., so when someone asks for help on a packer target that I have spend many hours exploring, I tend to jump without thinking, but I guess that it why you are here.

Not to babysit or wipe my pooper, to moderate and protect this forum from honest mistakes as well as blatant disreguard or forum policy.

I thank you for not banning me for breakinig Woodmann rules.
JMI
10-05-2004, 11:11 PM
We aren't really that heartless that we would ban you simply for violating a rule about attaching a tut with target specific code. At least not on the first instance. I had actually read it when it was first posted on exetools and I also had forgotten that it contained target specific code. It is sufficient that the error was recognized and corrected. Punishment is generally reserved for more flagrant and/or intentional violations. These rule are in place to protect the Board from efforts to shut it down and not as a tool for banning the unwarry or even careless.

Enough said. ;)

Regards,
LetMeIn
10-14-2004, 10:28 AM
I have made some small steps, but steps none the less. After completing the code injection similar to what is described by Lunar_Dust, I used imprec and I still have lots of imports in the kernel32.dll that are still invalid. These invalid calls are to the vboxtb.dll that I used in my code injection. I tried all of the different trace options in imprec with no success. Does anyone have a clue what's going on and/or suggestions on a possible fix?
hobferret
10-14-2004, 11:18 AM
QUOTE REMOVED JMI :devil:

Letmein :)

If you look in the dissembly window in Imprec you will see that all point to the Vbox dll :D

Have you tried options 2&3 in Imprec?

Have you dumped the target at the OEP? Dont forget you need to put the CORRECT OEP inti Imprec or else it will all be bo****ks :confused:

If you want my tute on Vbox gimme a valid email address and I will send you what I have :cool:

/hobferret
JMI
10-14-2004, 11:44 AM
Using either the "Quick Reply", on the bottom far right, or the "Post Reply" on the bottom left saves posting an unnecessary "quote" and saves room in the database. :yay:

Regards,
LetMeIn
10-14-2004, 03:53 PM
Yes I have tried options 2 and 3 in imprec. They didn't help. As for dumping at the OEP - how can I verify that. I set a breakpoint on GetModuleHandleA and stepped through the code as detailed by RemedY in his tut. Once arriving at the OEP, I did a dump - full... The one thing I'm fairly certain I didn't do was change the OEP in Imprec, but I didn't think that was necessary until I was ready to "Fix Dump"
hobferret
10-15-2004, 05:57 AM
Hi again :)

PM the target and I will try and help you :devil:

Regards

/hobferret
sonkite
10-16-2004, 08:22 AM
PM the target also I would like to check it out. Thanks.
hobferret
10-16-2004, 03:03 PM
LetMeIn :)

OK had a quick look and here is what I get :devil:

OEP @ 2DF1AE

IAT START 2E7000 END 2E78F8

No probs with Imprec except two which are easy resolved by disassemble/hexview :yay:

/hobferret
LetMeIn
10-17-2004, 08:29 AM
I have the OEP and the IAT Start the same as you. Where does the 2E78F8 factor in?

I'm still getting invalid imports in the kernel32.dll in addition to the 2 that you mentioned. There must be some minor detail that I'm missing. Is there a point when you let the program fully load? If so, does the code injection come before or after?
venom925
10-17-2004, 08:59 AM
2E78F8 is the end of your IAT he's telling you your IAT is 8F8 long
LetMeIn
10-17-2004, 11:23 AM
Ok, so does that mean I need to change the "size" from 00001000 to 000008F8 under the "IAT Infos Needed" in Imprec?
hobferret
10-17-2004, 12:06 PM
And I thought that it was only me and JMI that were suffering brain cell death :devil:

Well said venom925 that would have been my reply :yay:

LetMeIn - - WAKEY WAKEY :boo:

/hobferret
venom925
10-17-2004, 12:10 PM
thanks:D
JMI
10-17-2004, 12:40 PM
Sorry, hobferret, what with my advanced age and all, I forgot what we were talking about. :D

Regards,
venom925
10-17-2004, 07:46 PM
PUSH EBP ; Real entry point of SFX code
MOV EBP,ESP
PUSH -1
PUSH <removed by me:p >.482E63DC

forgive me ,hobferret, but would this not be the OEP if so its located at 96BC0 :confused: .
hobferret
10-18-2004, 03:57 AM
venom925 ;)

No that is not the OEP :boo:

Real OEP is 2DF1AE
2DF1AE 6A74
2DF1B0 PUSH 6858792E48

OK :devil:

JMI Dont worry you are only 1 year older than me :cry:

/hobferret
hobferret
10-18-2004, 07:03 AM
Hi to all :)

There is one thing I should mention:-

In the tute I wrote a while back forget about all that crap after breaking on GetProcAddress; just do a bpx on FreeLibrary and you are nearly at the OEP :devil:

/hobferret
JMI
10-18-2004, 12:00 PM
hobferret:

I'm not worried. I just can't remember how old I am, so I don't know how young you are. :devil:

Regards,
hobferret
10-20-2004, 08:51 AM
JMI :yay:

Put it this way I was swimming down the old man's pipe when you were born :devil:

So you have 9 months start on me :yay:

/hobferret
JMI
10-20-2004, 09:19 AM
Heck. Before you were born, I was already taking my first trip to Europe...... by boat, no less. :D No Wait. That was my only trip, but at least it lasted several years and the trip home was again by boat. Not too many of our generation who have made that trip in anything other than an airplane. :idea:

Regards,
hobferret
10-20-2004, 09:37 AM
Well then :devil:

In my job I have been round the world so many times I should be in the Guiness book of records :cool:

The only boat trip I have been on was between the north and south islands of New Zealand :yay:

I am in England now and staying here because I don't like the idea of flight anymore for obvious reasons and I ain't crossing the Atlantic in a boat at any price :boo:

/hobferret
JMI
10-20-2004, 10:14 AM
Especially NOT in an empty cargo hauler. Up and down, side to side, up and down, side to side = barff, barff, barff. :cry:

It's not a journey, it's an adventure. :D Film at 11:00. :yay:

Regards,
LetMeIn
10-20-2004, 01:07 PM
Ok, I've worked on it some more and I still have the same problem - kernel32 imports. I have changed the size to 8F8 and the OEP to 002DF1AE. I have checked my code injection and it works. I still get an invalid kernel32 thunk. I'm completely lost.
hobferret
10-20-2004, 02:05 PM
I dont know what you are doing wrong but here is the kernel32 imports :confused:

Try and do the rest for yourself, you will never learn anything if someone else does the work for you :cry:

Better let everyone know where you are different

/hobferret

FThunk: 002E7148 NbFunc: 00000094
1 002E7148 kernel32.dll 0064 CreateProcessW
1 002E714C kernel32.dll 01EE GlobalHandle
1 002E7150 kernel32.dll 031A SetProcessWorkingSetSize
1 002E7154 kernel32.dll 0364 VirtualAlloc
1 002E7158 kernel32.dll 0367 VirtualFree
1 002E715C kernel32.dll 036C VirtualQuery
1 002E7160 kernel32.dll 021E IsBadReadPtr
1 002E7164 kernel32.dll 008D DuplicateHandle
1 002E7168 kernel32.dll 00B9 FatalAppExitW
1 002E716C kernel32.dll 032C SetUnhandledExceptionFilter
1 002E7170 kernel32.dll 02FA SetErrorMode
1 002E7174 kernel32.dll 00DC FindResourceW
1 002E7178 kernel32.dll 018E GetPrivateProfileStringW
1 002E717C kernel32.dll 0398 _lcreat
1 002E7180 kernel32.dll 0396 _hwrite
1 002E7184 kernel32.dll 01F3 GlobalSize
1 002E7188 kernel32.dll 0379 WinExec
1 002E718C kernel32.dll 0275 OutputDebugStringA
1 002E7190 kernel32.dll 0154 GetFileInformationByHandle
1 002E7194 kernel32.dll 0245 LocalFree
1 002E7198 kernel32.dll 01A5 GetShortPathNameW
1 002E719C kernel32.dll 016B GetLongPathNameW
1 002E71A0 kernel32.dll 0134 GetCurrentDirectoryW
1 002E71A4 kernel32.dll 038B WritePrivateProfileStringW
1 002E71A8 kernel32.dll 01CE GetTimeZoneInformation
1 002E71AC kernel32.dll 01D4 GetVersion
1 002E71B0 kernel32.dll 0214 InterlockedExchange
1 002E71B4 kernel32.dll 00F0 GetACP
1 002E71B8 kernel32.dll 02F7 SetEndOfFile
1 002E71BC kernel32.dll 039A _lopen
1 002E71C0 kernel32.dll 0395 _hread
1 002E71C4 kernel32.dll 0180 GetNumberFormatW
1 002E71C8 kernel32.dll 0166 GetLocaleInfoW
1 002E71CC kernel32.dll 0397 _lclose
1 002E71D0 kernel32.dll 0399 _llseek
1 002E71D4 kernel32.dll 0192 GetProcessAffinityMask
1 002E71D8 kernel32.dll 016D GetModuleFileNameA
1 002E71DC kernel32.dll 0157 GetFileTime
1 002E71E0 kernel32.dll 01B7 GetSystemTimeAsFileTime
1 002E71E4 kernel32.dll 0036 CompareStringA
1 002E71E8 kernel32.dll 03A9 lstrcpyn
1 002E71EC kernel32.dll 039D lstrcat
1 002E71F0 kernel32.dll 02B6 ResetEvent
1 002E71F4 kernel32.dll 0141 GetDiskFreeSpaceExW
1 002E71F8 kernel32.dll 010A GetComputerNameW
1 002E71FC kernel32.dll 00B4 ExpandEnvironmentStringsW
1 002E7200 kernel32.dll 0324 SetThreadExecutionState
1 002E7204 kernel32.dll 01B2 GetSystemInfo
1 002E7208 kernel32.dll 0050 CreateFileMappingW
1 002E720C kernel32.dll 0354 UnmapViewOfFile
1 002E7210 kernel32.dll 0251 MapViewOfFile
1 002E7214 kernel32.dll 006A CreateThread
1 002E7218 kernel32.dll 00BC FileTimeToLocalFileTime
1 002E721C kernel32.dll 01D5 GetVersionExA
1 002E7220 kernel32.dll 0138 GetCurrentThreadId
1 002E7224 kernel32.dll 02AD RemoveDirectoryW
1 002E7228 kernel32.dll 0164 GetLocalTime
1 002E722C kernel32.dll 01C3 GetTempPathW
1 002E7230 kernel32.dll 025E MultiByteToWideChar
1 002E7234 kernel32.dll 00B1 ExitThread
1 002E7238 kernel32.dll 00BD FileTimeToSystemTime
1 002E723C kernel32.dll 0153 GetFileAttributesW
1 002E7240 kernel32.dll 01D6 GetVersionExW
1 002E7244 kernel32.dll 0137 GetCurrentThread
1 002E7248 kernel32.dll 0169 GetLogicalDrives
1 002E724C kernel32.dll 0049 CreateDirectoryW
1 002E7250 kernel32.dll 0035 CompareFileTime
1 002E7254 kernel32.dll 0135 GetCurrentProcess
1 002E7258 kernel32.dll 0213 InterlockedDecrement
1 002E725C kernel32.dll 033D SystemTimeToFileTime
1 002E7260 kernel32.dll 0217 InterlockedIncrement
1 002E7264 kernel32.dll 0146 GetDriveTypeW
1 002E7268 kernel32.dll 01F0 GlobalMemoryStatus
1 002E726C kernel32.dll 0104 GetCommandLineW
1 002E7270 kernel32.dll 039F lstrcatW
1 002E7274 kernel32.dll 028C QueryPerformanceFrequency
1 002E7278 kernel32.dll 0337 SizeofResource
1 002E727C kernel32.dll 028B QueryPerformanceCounter
1 002E7280 kernel32.dll 02AA ReleaseMutex
1 002E7284 kernel32.dll 0172 GetModuleHandleW
1 002E7288 kernel32.dll 005C CreateMutexW
1 002E728C kernel32.dll 0041 CopyFileW
1 002E7290 kernel32.dll 0051 CreateFileW
1 002E7294 kernel32.dll 0221 IsBadWritePtr
1 002E7298 kernel32.dll 0155 GetFileSize
1 002E729C kernel32.dll 0188 GetPrivateProfileIntW
1 002E72A0 kernel32.dll 0037 CompareStringW
1 002E72A4 kernel32.dll 014B GetEnvironmentVariableW
1 002E72A8 kernel32.dll 03A0 lstrcmp
1 002E72AC kernel32.dll 0327 SetThreadPriority
1 002E72B0 kernel32.dll 00D4 FindNextFileW
1 002E72B4 kernel32.dll 00C6 FindClose
1 002E72B8 kernel32.dll 0338 Sleep
1 002E72BC kernel32.dll 023E LoadLibraryW
1 002E72C0 kernel32.dll 023D LoadLibraryExW
1 002E72C4 kernel32.dll 00CD FindFirstFileW
1 002E72C8 kernel32.dll 03A6 lstrcpy
1 002E72CC kernel32.dll 007E DeleteFileW
1 002E72D0 kernel32.dll 023B LoadLibraryA
1 002E72D4 kernel32.dll 0194 GetProcessHeap
1 002E72D8 kernel32.dll 0202 HeapFree
1 002E72DC kernel32.dll 01FC HeapAlloc
1 002E72E0 kernel32.dll 00EA FreeLibrary
1 002E72E4 kernel32.dll 03AC lstrlen
1 002E72E8 kernel32.dll 0206 HeapReAlloc
1 002E72EC kernel32.dll 029D ReadFile
1 002E72F0 kernel32.dll 0385 WriteFile
1 002E72F4 kernel32.dll 0300 SetFilePointer
1 002E72F8 kernel32.dll 0030 CloseHandle
1 002E72FC kernel32.dll 0372 WaitForMultipleObjects
1 002E7300 kernel32.dll 004B CreateEventW
1 002E7304 kernel32.dll 01CB GetTickCount
1 002E7308 kernel32.dll 02FB SetEvent
1 002E730C kernel32.dll 0374 WaitForSingleObject
1 002E7310 kernel32.dll 03A5 lstrcmpiW
1 002E7314 kernel32.dll 0191 GetProcAddress
1 002E7318 kernel32.dll 03A3 lstrcmpi
1 002E731C kernel32.dll 03A2 lstrcmpW
1 002E7320 kernel32.dll 016E GetModuleFileNameW
1 002E7324 kernel32.dll 03A8 lstrcpyW
1 002E7328 kernel32.dll 007B DeleteCriticalSection
1 002E732C kernel32.dll 0090 EnterCriticalSection
1 002E7330 kernel32.dll 0162 GetLastError
1 002E7334 kernel32.dll 03AE lstrlenW
1 002E7338 kernel32.dll 03AB lstrcpynW
1 002E733C kernel32.dll 023A LeaveCriticalSection
1 002E7340 kernel32.dll 020F InitializeCriticalSection
1 002E7344 kernel32.dll 024E LockResource
1 002E7348 kernel32.dll 01EB GlobalFree
1 002E734C kernel32.dll 01F6 GlobalUnlock
1 002E7350 kernel32.dll 01E4 GlobalAlloc
1 002E7354 kernel32.dll 01EF GlobalLock
1 002E7358 kernel32.dll 0378 WideCharToMultiByte
1 002E735C kernel32.dll 00E6 FormatMessageW
1 002E7360 kernel32.dll 0326 SetThreadLocale
1 002E7364 kernel32.dll 016F GetModuleHandleA
1 002E7368 kernel32.dll 01A6 GetStartupInfoA
1 002E736C kernel32.dll 0322 SetThreadAffinityMask
1 002E7370 kernel32.dll 0223 IsDBCSLeadByteEx
1 002E7374 kernel32.dll 02AB ReleaseSemaphore
1 002E7378 kernel32.dll 0241 LocalAlloc
1 002E737C kernel32.dll 0290 RaiseException
1 002E7380 kernel32.dll 00B0 ExitProcess
1 002E7384 kernel32.dll 0136 GetCurrentProcessId
1 002E7388 kernel32.dll 0240 LoadResource
1 002E738C kernel32.dll 00EC FreeResource
1 002E7390 kernel32.dll 00E0 FlushFileBuffers
1 002E7394 kernel32.dll 01F2 GlobalReAlloc
esther
10-21-2004, 04:08 AM
I thought its against the rules of posting iat or upload it here?!?!?!?! :eek: :rolleyes:
hobferret
10-21-2004, 04:34 AM
esther ;)

I dont think so because it is not program specefic i.e. nobody has named the program this bit of the IAT belongs to :yay:

/hobferret
JMI
10-21-2004, 09:05 AM
And cutting and pasting will not get one a working IAT either. :yay:

Regards,
LetMeIn
10-21-2004, 07:24 PM
Many thanks to hobferret!! After the manual entry in the kernel32 FThunk I was able to "Fix Dump" and it worked!!! I have attached a word document that has the same Thunk that hobferret listed above. The missing entries I had are highlighted in red. If anyone cannot view the word document, let me know and I'll try an alternate format.

I would still like to know what caused my problem. If anyone discovers how or why this happened, please let me know. I would like to improve on my skills.

Thanks again to hobferret and others, I certainly couldn't have done it without you!!!
hobferret
10-22-2004, 04:24 AM
Justin :)

It would help if you outlined what and how you did it. i.e. where you dumped it, which version of Imprec you used and exactly what occured when you tried to get the kernel32 API's, what OS and version etc :confused:

/hobferret
LetMeIn
10-22-2004, 10:06 AM
I have a zip file of the tutorial I used for this project written by RemedY. It is even written using the same app I tried to unpack. I will gladly pm it to anyone who would like to see it. The text is in German, but the screen shots of code are in English. I used this tut in conjuction with the one written by Lunar_Dust to feel my way through this.

I am running Win XP Home Edition, I used Ollydbg 1.10, Imprec 1.6, and LordPE Deluxe.

I used a break on GetModuleHandleA and used alternating "Alt+F9" and "F9" commands to step through to the OEP. Once arriving at the OEP I did a "dump full..." with LordPE. I used Imprec to check invalid imports. Traced the code and found a empty place to inject my code (as outlined in the RemedY tut mentioned above). Used Imprec again to check that all my imports were valid and they were except for some of the kernel32.dll APIs. That's when hobferret stepped in and saved the day! :yay:
hobferret
10-22-2004, 10:46 AM
Hi again Justin:D

I don't know why you have found it necessary to "inject code" :confused:

The real easy way to find the OEP is to run the prog in Olly - when you get to the nag screen do a bpx on FreeLibrary - you are only a few steps from the EP - use F7 not F8 :yay:

I use XP Pro with SP1 and have only had a problem with 2 User32.dll calls, the two usual suspects which have been mentioned all over the place :devil:

Anyways glad you have gotten it working but I am still confused why you have had to use code injection :cool:

/hobferret
LetMeIn
10-22-2004, 01:38 PM
I'm probably the one who is confused. :thinking: I say "inject code" because of what Lunar_Dust did in his tutorial. Does he not use a form of code injection? Granted that it is very little code, but code nonetheless. I have also heard of this referred to as "Semi-automatic" IAT restoration.

Is there an easier way to restore the IAT?
ThunderPwr
10-23-2004, 09:48 AM
could you please send me your tut about VBOX?

Thanks in advance :)

ThunderPwr
hobferret
10-24-2004, 04:38 AM
ThunderPwr :)

I would if I still had it locally, unfortunately I suffered a HDD failure on my Slave where all was kept so I dont have it anymore.

You can get if off Exetools site :devil:

/hobferret
JMI
10-24-2004, 03:05 PM
New registrations are currently disabled on exetools while we catch up with the influx of new members. :eek:

Regards,
%UNDEFINED%
10-24-2004, 06:04 PM
Rename to *.zip

hobferret's tut: (443 kb)
http://d-jester1.tripod.com/images/UVBXAPM_Hob.bmp

Lunar_Dust's tut: (756 kb)
http://d-jester1.tripod.com/images/UVBXFHMX_Lunar.bmp

Both tut's on VBOX 4.6 :yay:
LetMeIn
10-29-2004, 02:02 PM
I'm trying to go back and figure out what happened with my IAT, so I'm trying to do it long hand by following Ricardo's manual IAT tuts. Following his method I sifted through the PE header of the section named for the target app and found the IAT starting at F1E20C and ending at F1E300 giving it a length of 140. In an earlier post hobferret showed the IAT start at 2E7000 and ending at 2E78F8 giving it a length of 8F8. Can someone help me understand?
hobferret
10-29-2004, 02:12 PM
Hi :)

If in doubt about IAT length etc:-

Get to the OEP in Olly then look for something like CALL DWORD PTR [ADDRESS]

Get that in the memory window then scroll up to the top of the block, that should be the first pointer, go down till you see a load of rubbish - you then are likely at the end of the IAT. Some progs have great big empty blocks in the IAT so you need to make sure you are at the finish :devil:

/hobferret
LetMeIn
11-02-2004, 11:42 AM
round and round I go...I have arrived at the same point in my second target app as I have in the first. I have the OEP located. I have the IAT located and sized. When I get the imports, all get resolved except the ones directed to the standard vbox routine. I have tried using Imprec 1.6. I have tried using Revirgin 1.2. I haven't had any success with either. I have tried using all the trace function in each program, but they just lock up or return with a fail. I'm sure the problem is user error. :)

Is there a way to manually trace through these calls to find the API after the vbox routine is completed? Am I missing a plugin that I need to be using?

Also, a special thanks to hobferret for his tireless support to get me this far.
sHice
11-02-2004, 03:59 PM
Is there a way to manually trace through these calls to find the API after the vbox routine is completed? Am I missing a plugin that I need to be using?

if you have the offset of the redirected call which points into the vbox dll you can set a breakpoint on this offset and then wait until softice breaks then u can see the right api and fix the offset in imprec or revirgin.
btw it would be very nice if u could send me the name of the target via pm.
hobferret
11-03-2004, 04:38 AM
LetMeIn

Remember what I said before get to the OEP in Olly then look for something like CALL DWORD PTR [ADDRESS]. Any unresolved can be stopped in this block and then traced to see where you end up!

I still do not understand why you are having so much trouble, have you checked to see if the program is still running when you are trying to resolve the IAT?

Sometimes the program will crash out when you are tracing, that's when you encounter a fail or a read error! Don't know what else to say but it's got to be something you are doing wrong!

/hobferret
LetMeIn
11-03-2004, 02:49 PM
I still do not understand why you are having so much trouble, have you checked to see if the program is still running when you are trying to resolve the IAT?

:idea: :idea:
I know why I'm having so much trouble...I'm an idiot!!! :D I didn't have the program running while I was trying to use the trace options in Imprec. I knew that it had to be something simple.

I have traced out the IAT and I now have a working "unwrapped" exe.

Hobferret - Thank you so much for your patience and guidance. You fed me with just enough info to keep me going, but not so much that you gave it away. I couldn't have done it without you! :yay:
%UNDEFINED%
11-07-2004, 09:59 AM
Since the discussion seems to be about HASP SL (Formerly Priviledge Client & Vbox)

I too am having difficulty rebuilding my IAT for Vbox 4.6 target all attempts with impREC return vboxtb:Ordinal 001

I understand why but Lunar_Dust spoke of using impREC's "Hook" and "Trap Flag" to find the decrypted API.

Aparently I am doing something wrong because neither work.

could someone either PM me or (if JMI is okay with it) upload their impREC.ini file so I can see if something is not set up right

I am working on XP Pro SP2; Logged in as Admin

Thanks
JMI
11-07-2004, 10:19 AM
It would be best to leave these things to PM or email, rather than posting .ini files. If there was just a portion which was a problem, that would be one thing, but we do not want to be providing cookie cutter ini files for people to past into their cracking efforts.

Regards,
LetMeIn
11-07-2004, 10:33 AM
%UNDEFINED% -

Don't use trace level 1 (disasm). It will always return a vboxtb.

1. Make sure that in the bottom right hand corner of Olly that it says "running" and not "paused." Hint: let the prog completely load.

2. Use trace level 2 first on all unresolved. Some will trace some will not.

3. Use trace level 3 on the rest. It was my experience that the program crashed each time i ran this, so be prepared to restart each time. I suggest a hand written table so you don't lose your work or save and reload your tree each time.

Hope that helps!!

LetMeIn
venom925
11-07-2004, 11:39 AM
%UNDEFINED% try raising your timeout in imprec sometimes this will find a few more imports i have mine set at about 300 ms also keep in mind the vbox keeps 2 calls for it self so youll have to find those for your self, very easy to do in olly


Unable to unpack a file wrapped by Bit-arts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unable to unpack a file wrapped by Bit-arts
PDA

View Full Version : Unable to unpack a file wrapped by Bit-arts

paco
03-22-2004, 04:46 AM
:mad: Hi,
First of all , I introduce myself as a newbie in unpacking. I read a lot of tutorials and forums but I'm still not able to unpack a file called Dont be lame. .This program is packed with bit-arts by Read the FAQ sofware wrapper (crunched/PE heuristic as checked by PEiD) . It has no evaluation possibility and you must to be connected to their server for validation before the software can be unpacked on the drive.
I tried to manually unpack it but the dumped file is always below the original weight ( 1.5Mb and the packed file weights 4.47Mb) . The Import segment is always destroyed each time I disassemble the file.When I use Ollydbg, it always warns that the Module Entry Point is outside the range... . This is very confusing to me and I can't find the OEP.

When I read Heathcliff tute about fusion v3 (bit-arts), I thought that I found my way. Unfortunately the approch was quite different because here I have no demo or evaluation version available.
I spent more than three months, using a lot of tools ( SI/PEiD/Revirgin/Ollydbg/IDA Pro...) without success, so questions :
1- Is it possible that an unpacked file weights lower than the packed one ?
2- How can I achieve this unpacking without connection to their server ?
3- Does anyone have experience with this kind of file or protection?
Any help will be highly appreciated.
Tks for helping me cause I'm really newbie . I came to this forum for education purpose and as French-speaking, it is also an opportunity to improve my English. So sorry for all the mistakes I made.
Regards
Paco
hobferret
03-22-2004, 05:00 PM
:mad: Hi,
First of all , I introduce myself as a newbie in unpacking. I read a lot of tutorials and forums but I'm still not able to unpack a file called I will not be lame .This program is packed with bit-arts by Read the FAQ sofware wrapper (crunched/PE heuristic as checked by PEiD) . It has no evaluation possibility and you must to be connected to their server for validation before the software can be unpacked on the drive.
I tried to manually unpack it but the dumped file is always below the original weight ( 1.5Mb and the packed file weights 4.47Mb) . The Import segment is always destroyed each time I disassemble the file.When I use Ollydbg, it always warns that the Module Entry Point is outside the range... . This is very confusing to me and I can't find the OEP.

When I read Heathcliff tute about fusion v3 (bit-arts), I thought that I found my way. Unfortunately the approch was quite different because here I have no demo or evaluation version available.
I spent more than three months, using a lot of tools ( SI/PEiD/Revirgin/Ollydbg/IDA Pro...) without success, so questions :
1- Is it possible that an unpacked file weights lower than the packed one ?
2- How can I achieve this unpacking without connection to their server ?
3- Does anyone have experience with this kind of file or protection?
Any help will be highly appreciated.
Tks for helping me cause I'm really newbie . I came to this forum for education purpose and as French-speaking, it is also an opportunity to improve my English. So sorry for all the mistakes I made.
Regards
Paco

Hey JMI :)

You are slipping here - Links to progs :o Wot next :)

/hobferret
Kayaker
03-22-2004, 06:59 PM
I agree any kind of link or proggy name should be unnecessary, will gladly delete it, but it all depends on what comes next, generic or target specific response(s). One stays, the other leaves ;)
Woodmann
03-22-2004, 08:02 PM
Shit,

The bus is full for today.............

And Paco, you have already been warned about posting
like this. I did not realize that it was you who sent me an email
until after I re-instated you under your email nick.
Now I check the IP address and see that you were deleted
for being a lamer.

This will be your last chance to redeem yourself.

-cbo-
paco
03-23-2004, 07:58 AM
Hi Woodmann,
I sincerely apologize for having written the name of a file in my first post. I thought it was useful to people to have an

idea of wich kind of protection I am dealing with. Sorry, I'm faulty.
My concern about the mail I sent to you was related to a problem of registration. In fact, I didn't receive the e-mail

validation so I couldn't post my message.Thank for having validated it.
Anyway, I'm still trying to unpack this file, but as I said before, this protection seems unbeatable compared to the others

files I have been able to unpack or patch. This leads me to the conclusion that maybe it's the end of manual unpacking or

I've not enough experience to defeat the need of server connection before the file is unwrapped. Remember it's not a demo or

an evaluation or shareware version.
The last think I did is trying to dump the file using Ollydump plugin (with FrogIce active) . The problem encountered is that

the prog is lanched while tracing and ,again I have to face the need of internet connection .
I've not found any tute yet concerning this kind of protection , so I will keep on trying,
Hope you'll forgive me
Tks a lot ("Merci beaucoup" in French)
Paco
Woodmann
03-23-2004, 07:40 PM
OK,

So you have read some tuts and they do not help you in this situation.
I have an old saying: If a PERSON made it then another PERSON can take it apart.

Since this prog needs access to work, you need to find where it makes this "call".
Next, how do you find this information it desires?
Can you find it hidden in a validation routine?

But you say that you cant unpack it. You can, you just haven't found out
how to do it yet.

Woodmann
paco
03-24-2004, 07:39 PM
Hello Woodmann,
Thanks for your wise advice. I'm still trying to find out the "call" concerning the access. I think it is hidden in a packed area of the file so it can't be accessed unless it is unpacked.
In the meantime, I dumped the memory map and the log data while tracing with Ollydbg. Both are attached to my post . You will notice the different system files .DLL/.OCX related to the net.
Hope it can help....
Regards
Paco
Woodmann
03-24-2004, 09:21 PM
Mr. Jiggyfly.........

I have some bad news for you but, you already know this.
%UNDEFINED%
03-25-2004, 12:47 AM
Eh paco, PM (Private Message) me with the target and URL, I'll take a look and see what advice I can offer.
paco
03-26-2004, 04:45 AM
Mr. Jiggyfly.........

I have some bad news for you but, you already know this.

HI Jiggy,
I've read a tute from Heathcliff in a thread called "Fusion v3 cracked, Titanium v3 defeated, Bit-arts fooled..." Perhaps you should read it and if by chance you can contact Heathcliff, maybe you'l have info about Fusion 3 by Bit-arts. Myself , I don't have it. GOOD LUCK
Paco :rolleyes:
Jiggy
03-26-2004, 04:49 AM
HI Jiggy,
I've read a tute from Heathcliff in a thread called "Fusion v3 cracked, Titanium v3 defeated, Bit-arts fooled..." Perhaps you should read it and if by chance you can contact Heathcliff, maybe you'l have info about Fusion 3 by Bit-arts. Myself , I don't have it. GOOD LUCK
Paco :rolleyes:

Thank you very much, I'll search it and I'll find it. I'm really glad about your post !!!

Bye
paco
05-03-2004, 01:13 PM
HI,
I've not succeeded with manual unpacking of the file so I tried PEiD v0.92 .
I scanned the file using PEiD v0.92 and found the OEP at 00401F30. After that, I unpacked it with snaker's Generic Unpacker v0.1 ( wich is part of PEiD) and rebuild the imports with ImpREC. The unpacked file generated has a size of 1,16 Mb , while the original one was 4,47 mb .
When I launch the unpacked exe, I get a message saying that the file size is incorrect...
How can an unpacked file have a size smaller than the packed one ?
There is still something else to do but I don't know what !!!
Tks coop
Paco :mad:


Armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo
PDA

View Full Version : Armadillo

Jiggy
03-22-2004, 05:36 PM
Hi,

I'm having a problem unpacking a file. First of all I'm newbie in unpacking and with Armadillo I don't think I'll be able to get an exe easy to patch.

The real problem is that PEiD 0.9 says "Armadillo 2.5x - 2.6x -> Silicon Realms Toolworks" and with the latest version, the 0.92 it's "Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks [Overlay]".

Who can take contact with me to unpack the file? I'll patch it on my own, I just need an unpacked file to get my work going.

Thank you in advance to all replying to me.

jiggymask@yahoo.fr

ps: For de moderators of this forum> I'm sorry about the first post, I didn't read the faq, now it's all done. Regards :p
Woodmann
03-22-2004, 06:26 PM
Well Mr. Jiggyfly,

I have some good news. I really did save money with Geico.

Since I saved some money I will be nice to you and offer you this:

Solution here! (http://www.woodmann.net/forum/search.php?do=process&query=armadillo)
Jiggy
03-23-2004, 04:37 AM
Well Mr. Jiggyfly,

I have some good news. I really did save money with Geico.

Since I saved some money I will be nice to you and offer you this:

Solution here! (http://www.woodmann.net/forum/search.php?do=process&query=armadillo)

Hi,

I don't understand what you're trying to say at all and your link seems to be broken or invalid. What is Geico? An auto insurance??!!

I don't need that, I need help unpacking and that's it.

Have a nice day
Tolstoinisten
03-23-2004, 05:35 AM
Jiggy:

The link isn't at all broken. It points to the "RCE-CD". You should download this.

What Woodman is trying to say to you is... Use the resources available to you. These are (among other things of course) - Google. As you already must know since you've used it to find out what Geico is. That and of course the RCE-CD.

You might also want to use the search option.

T.

Hi,

I don't understand what you're trying to say at all and your link seems to be broken or invalid. What is Geico? An auto insurance??!!

I don't need that, I need help unpacking and that's it.

Have a nice day
Jiggy
03-23-2004, 06:14 AM
Ok,

What I have by clicking his link is...

"vBulletin Message
Sorry - no matches. Please try some different terms."

That's why I thougt the link was wrong.

I don't really need to download this 10Megs archive because I'm looking for a tut on how to unpack that shit.

I'm looking for anybody who knows how to unpack Armadillo because it's way to difficult to learn that when you're newbie. So if anybody has some time to spend with me, I'd be glad.

Thank's to all

Regards
Tolstoinisten
03-23-2004, 11:03 AM
Ok,

What I have by clicking his link is...

"vBulletin Message
Sorry - no matches. Please try some different terms."

That's why I thougt the link was wrong.

I don't really need to download this 10Megs archive because I'm looking for a tut on how to unpack that shit.

Hi,

I'm glad that you found it. And you should download the entire CD, but of course you can always pick just one collection, say Krobar's.

You say that you are looking for a tute on how to unpack armadillo.. that is ironic surely, considering the fact that the RCE-CD contains nothing BUT tutorials, guides and manuals. You will find many armadillo tutorials on that CD.

That is why I suggest that you download it.

I'm looking for anybody who knows how to unpack Armadillo because it's way to difficult to learn that when you're newbie. So if anybody has some time to spend with me, I'd be glad.

It is difficult to unpack armadillo, especially when you are a newbie. It is perhaps better to reconsider then & start from the beginning isntead. You can't expect to jump right into RE by taking on armadillo or any other similar software protection.

Begin here:

Click me (http://66.98.132.48/forum/showthread.php?t=5679)

And follow the rant. 'Tis good advice methinks.

T.
Kayaker
03-23-2004, 11:43 AM
Hi,

I don't understand what you're trying to say at all and your link seems to be broken or invalid.

For some reason the link has become invalid, but it was originally a Board Search result for "Armadillo".
Jiggy
03-23-2004, 11:43 AM
Okay thank you, I'll download it and search for help.

But do you know if there are some guys here on the forum able to help me unpack a file? Even if I can get a goot tut or whatever on Armadillo, I don't think I'll be able to do the same on my own on my file that's why I need someone as support.
Tolstoinisten
03-23-2004, 12:01 PM
Hi,

Don't post a crack request. If you want help, post your findings first, then you will get some help.

Still, I think the odds are against you. You are new to all of this, but good luck in any case :)

Even though you find tutorials that deal with armadillo and who are target specific, they still follow (usually) the same steps.

Post your findings and explain what you have done, then post your questions.

T.

Okay thank you, I'll download it and search for help.

But do you know if there are some guys here on the forum able to help me unpack a file? Even if I can get a goot tut or whatever on Armadillo, I don't think I'll be able to do the same on my own on my file that's why I need someone as support.
dELTA
03-23-2004, 01:13 PM
Ok, ok, I fixed the link, enjoy! :rolleyes:


Minor rant
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Minor rant
PDA

View Full Version : Minor rant

TBone
03-22-2004, 05:53 PM
So I'm back from vacation and reading through lots of old tomes, tutorials, guides, etc., on assembly. I basically have to learn it all over again after giving up on the hobby several years ago.

And I know I'm being pretty nit-picky but I have to get something off my chest...

assembly != machine code
assembly != machine code
assembly != machine code

Ahhhhh. I feel better now.

I have a lot of gratitude to anyone who goes through the trouble of writing FAQs, how-tos, guides, etc. for other people to read, but that one thing has been bugging me. It seems like a lot of guides don't accurately make that distinction, and a few of the writers themselves don't seem to be aware that there is a difference.

Assemblers do a lot more than just translating mnemonics like MOV AX, CX into binary opcodes and operands, even if it doesn't do any optimizations, and you restrict yourself to primitive assemblers that don't handle variables. Even if you aren't talking about the actual assembly process, but rather just about the language itself, it's not really true to assert that assembly statements directly correspond to opcodes and operands as if it were just a 1-to-1 mapping. For example, in the IA-32 assembly language, even something as elementary as the MOV statement represents 14 different processor opcodes depending on the size and type of of the operands. Modern assemblers aren't just a matter of mnemonics anymore.

Anyway like I said, I know I'm being kind of petty perhaps, but I feel like sometimes we do a bit of a disservice when we say - If you want to learn how to reverse:
1) Learn assembly

When we really should say something more like:
1) Learn how processors work
2) Learn how programming languages evolved
3) Learn how assemblers work
4) Learn assembly

So there's my minor rant :p
The Svin
03-23-2004, 08:39 AM
Well, even with the same operands and instruction you can encode it often in different ways.
For example mov eax,ecx you can encode 2 different ways, inverting bit D and swapping codr and memr fields in modrm byte.
While mov eax,[ecx] you can encode into binary 7 different ways :)


Support Royalty from Numega
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Support Royalty from Numega
PDA

View Full Version : Support Royalty from Numega

Aimless
03-23-2004, 01:10 AM
Considering the amount of SoftICE support we do over here on this board (display not working, I got this OS and that OS why will ice not work, etc) do you think we should ask for support royalty from Numega?

Any ideas for rates?

(Hell, if McDonalds guy spills tea and client gets burnt, client files lawsuit and wins!! If this kinda things is done in US, hows the above suggestion to get rich quick??)

Woodmann, should you get royalties from Numega, do not forget my part ;)

Have Phun
Aquatic
03-23-2004, 04:51 AM
Considering the amount of SoftICE support we do over here on this board (display not working, I got this OS and that OS why will ice not work, etc) do you think we should ask for support royalty from Numega?

Any ideas for rates?

(Hell, if McDonalds guy spills tea and client gets burnt, client files lawsuit and wins!! If this kinda things is done in US, hows the above suggestion to get rich quick??)

Woodmann, should you get royalties from Numega, do not forget my part ;)

Have Phun

I doubt any of the support here goes to paying customers.
disavowed
03-23-2004, 02:06 PM
firstly, numega doesn't exist anymore. if we were to get royalties from anybody, it would be from compuware.

secondly, compuware wouldn't pay us royalties because:
(1) they never asked us to provide such advice
(2) most of the people we're helping are not paying customers (as Aquatic said above)
(3) compuware would not endorse our advice since most people who answer questions here are not paying customers and if compuware did endorse us and someone gave a wrong answer to a question, compuware could possibly be held liable


Trap, interrupt & all that stuff
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Trap, interrupt & all that stuff
PDA

View Full Version : Trap, interrupt & all that stuff

crUsAdEr
03-23-2004, 01:43 AM
Hi folks,

Ok i hope someone could clarify all this confusion for me... I know i have to read the Intel Manual volume 3, and indeed i did but i guess somehow the truth evades me... i am still confused over all this int/trap handler stuff... The only difference i can understand is that trap/interrupt have different values pushed on stack before the handler is caller... so what is what and when which one occurs?

The recent discussion about rootkit detection mentioned it but to be honest i was kind of lost, when is interrupt handler called and when is trap handler called? I understand our IDT entries will specify whether a handler for specific int is interrupt handler or trap handler... using softice i can almost never see a Trap handler, only mainly int32 (which is interrupt handler i presume)... hence the confusion...

Let's say we have an int 3 instruction
int 3
this will trigger out interrupt handler? which in turn call the appropriate seh handler?

Or if we set T flag on EFlags for tracing, this will call int1 handler? How different is it from the INT 01 instruction and ICEBP... i know ICEBP was asked about by Kayaker long ago and discussed to a fair details, but how is ICEBP "eaten up" (eval's words) by our ring-3 debugger but not seh handler?

Hope you guys can understand me, cos honestly i am quite confused, hence the "confused question".

Thanks,
AndreaGeddon
03-23-2004, 06:50 AM
nice question! The idt entry descripor has the Type field which specifies the trap/interrupt handler. For what i know the interrupt handler is generally an asyncronous call so it should provide more register saving than a trap handler. A trap handler differs because you can pass parameters to it and it can return a return value (so i think it can do the std register saving). Its like saying that interrupt is asynchronous and trap is syncrhonous. There are still other type of idt descriptor (they are 16), each one with its own meaning. I am assuming you are talking about 32bit interrupt gate and 32bit trap gate (14 and 15). Naturally they are mutually exclusive. You can define several interrupt/trap handlers, but just only one can be installed at a time.

Calling an int 3 in the code calls the related handler (interrupt or trap), the function is os dependant, however on win it will end calling the per thread seh chain -> per process handler (unhandled exception filter). If the process is being debugged, the r3-debugger will be notified first. Softice is a bit different, as it has its own int3 handler.

Setting the trap flag generates a call to the int1 handler, which is dispatched like every other exception (see int3 :)). ICEBP is an opcode that generates an INT1, so it is a call to int1, i dont know if there is a *real* difference between the two.
Hope i am not telling wrong things!

Bye!
AndreaGeddon
evaluator
03-23-2004, 04:47 PM
crUsAdEr, too much words, i not well understand
write numbered questions..

>>how is ICEBP "eaten up"(eval's words) by .. debugger but not seh handler?
there i also wrote: it is fault of debugger
(because not analyzes & then not manages).
Also, when debugger runs, he seats on debug-handlers, so he decides,
when will send to SEH, or eat..

about ICEBP.
i mostly read about ICEBP as INT01;
but now one said, it modifies DR6. i tested this fact & it's true.
so, calling ICEBP as INT(inter-privilege call) is wrong.
crUsAdEr
03-24-2004, 12:25 PM
ok eval... so ICEBP eaten up by debugger is Olly bug :)... undertand!

AnreaGeddon : thanks, that explains it, we can only install one at a time, either an interrupt handler or a trap handler...

ok onto next question,
Why can we trace the INT 01 handler in softice? as i see it, single stepping is by setting T flag then int01 handler is called? but if we are tracing within int01 handler wouldnt that cause an infinite loop?
crUsAdEr
03-24-2004, 03:24 PM
The TF flag normally is not cleared by privilege changes inside a task. The INT n and INTO
instructions, however, do clear this flag. Therefore, software debuggers that single-step code
must recognize and emulate INT n or INTO instructions rather than executing them directly. To
maintain protection, the operating system should check the CPL after any single-step trap to see
if single stepping should continue at the current privilege level.
The interrupt priorities guarantee that, if an external interrupt occurs, single stepping stops.
When both an external interrupt and a single-step interrupt occur together, the single-step interrupt
is processed first. This operation clears the TF flag. After saving the return address or
switching tasks, the external interrupt input is examined before the first instruction of the singlestep
handler executes. If the external interrupt is still pending, then it is serviced. The external
interrupt handler does not run in single-step mode. To single step an interrupt handler, single step
an INT n instruction that calls the interrupt handler.

doesnt make much sense to me :(
the last sentence said single step the INT instruction to step handler, yet the first sentence say INT instruction clear T flag?
evaluator
03-24-2004, 03:48 PM
>so ICEBP eaten up by debugger is Olly bug
not bug, fault; also SICE's fault.

>Why can we trace the INT 01 handler in softice?
if you mean NTOSKRNL's INT 01 handler, this will not cause loop.
(meditate on it:)

>the last sentence said single step the INT instruction to step handler,
>yet the first sentence say INT instruction clear T flag?
first put there BPX, then start trace.(this explaned also)
crUsAdEr
03-24-2004, 03:54 PM
>Why can we trace the INT 01 handler in softice?
if you mean NTOSKRNL's INT 01 handler, this will not cause loop.

i meant sice's handler...

>the last sentence said single step the INT instruction to step handler,
>yet the first sentence say INT instruction clear T flag?
first put there BPX, then start trace.(this explaned also)
sorry do u care to elaborate?
evaluator
03-24-2004, 04:02 PM
>>i meant sice's handler...
mostly when i tried to trace sice's handler(or other code), sice crashes..
evaluator
03-24-2004, 05:06 PM
>>if we are tracing within int01 handler wouldnt that cause an infinite loop?
i meditated on it, answer is: NO.

loop can be if:
1. insude INT01 handler will be set BPMX
2. inside INT03 handler will be BPX

but debuger will still crash, when self tracing, because of overwrites of .data
variables..
crUsAdEr
03-25-2004, 03:00 AM
yeah i thought of that as well...
like for INT01 handler, sice will place BPX at the next instruction for single stepping... or else it can set T flag... but the key is how sice can determine whether an area of code is int1 handler or not... ah well... guess i must dig further into this handler...

but yeah, sometimes tracing int handler in sice causes crash, sometimes it doesnt... that is because overwrites of .data variables as kayaker did mention to me...
evaluator
03-25-2004, 03:22 AM
>>how sice can determine whether an area of code is int1 handler or not
why you stuck on so easy things?

how any code can determine any range of address(self)??
crUsAdEr
03-25-2004, 03:29 AM
erm... if u look at int01 handler in sice... it is really quite complicated with lots of subroutine called within the handler, spreading from cpthook.sys to ntice.sys... some of the codes are shared between both int1 and int3 handler...
The Svin
03-25-2004, 01:09 PM
The only difference i can understand is that trap/interrupt
have different values pushed on stack before the handler is caller...
so what is what and when which one occurs?

Well, first of all in your question you used wrong enumeration.
You said "trap/interrupt" as if it's different sons of the same family.
Actually trap is interrupt. One kind of interrupts.
There are three kind of interrupts:
1.fault
2.trap
3.abort.

Most of Programmers (ecpecially HLL programmers) take it as execution on some opcode
as one step thing. Actually opcode handling takes several stages as decoding, address
calculation, PL checking etc. And exeption (active #signal in internal of proc.) can be
errised in any of the stage if something is not valid.

So talking about fist two kinds of interrupt handling (fault and trap) we
shall keep in mind that the cause of interrupt is some instruction, and the instruction
has address (=EIP in moment of decoding).
1. fault is type of interrupt when exeption is rised BEFORE "bad" instruction
is executed. In the moment EIP=address of the instruction.
2. trap is type of interrupt when active exeption signal formated AFTER
the "bad" instruction is executed. Thus EIP at the moment already is pointer to
NEXT TO the instruction bytes (they say usually "next command" but I don't like
it, since nobody can garantee that there is not some garbage, EIP just points to
(address of instruction + size of instruction, that may be next instruction address,
or something else))

You sain "different values pushed on stack", - and it's wrong to put it this way.
Not "different" it's always EIP (among others). Both fault and trap save EIP, the
other thing is that since fault doesn't let bad instruction to be executed EIP
at the moments equal to address of the instruction, and trap occurs after execution,
thus EIP has value of next, after instrution bytes address.

And about abort (3rd type of interrupt)
- it's really bad situation, when it can not be fixed, and
termination is the only solution, usually cause is some hardware problem.

Let's say we have an int 3 instruction
int 3

:))))
It's not enough to say "int 3" since the same mnemonic is used for two
different opcodes: CC and CD 03. The are different ways handled.
crUsAdEr
03-26-2004, 12:21 AM
Hi The Svin,

Thanks for a very clear explanation but i guess the misunderstanding is due to my "mis-phrasing"... i was actually refering to the trap-gate and interrupt-gate...

sorry abt that :/

btw, is CC in someway similar to ICEBP, as in they differ from normal INT_xx instruction by some flag settings?
evaluator
03-26-2004, 02:29 AM
open 3 volume, press F3 and put for search:"trap gate";
read all places, where search stops until end.
then ask again, if not clear(because Intl plays dirti for me also:);
The Svin
03-26-2004, 03:10 AM
Do you mean what is trap gate, interrupt gate and task gate?
Well, it's a lot of typing :)) Since I have no idea of what
do you know and what you don't know about them.
If only difference between trap and interrupt gates is needed,
it's not to big:
int. gate works as trap gate except fot one difference:
When exeption passes control trough int. gate processor reset
to 0 IF (int flag) AFTER including in stack ret. address, yet
BEFORE execution 1st instruction of int. handler.
Reset to 0 IF means hardware ints prohibited until IRET instruction
is executed, yet progs. ints through NMI entry are allowed.
Of course, handler having enough PL can allow hardware ints by itself.
Automatic canceling hardware ints it the kinds of exeptions
(kinds using int gate) is important for handling ints from hardware:
sorce of int. may keep active IRQ signal until handler of interrupt
resets it (switch off) directly. In the case if IF would not reset to 0
it's possible multiple reaction of processor to one and the same signal
of interrupt - it happence 'cause processor checks for active signar in
enter line INTR, and it woul cause STACK OVERFLOW and reset of processor
itself. Thus IF set to 0 before first command of handler, after ret. address
included in stack. It doesn't happen while passing control though trap gate.
For other things they are work the same way.
So we should differ trap/int/task GATES (wich related to the way passing
control) and trap/fault/about types of exeption (wich related to when
it occurs, what is in stack etc.) For example we can have fault exeption
handled though trap gate :)


Where to get the targets???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Where to get the targets???
PDA

View Full Version : Where to get the targets???

ullusingh
03-23-2004, 08:38 AM
Hi. I'm learning how to crack. But most of the tutorials are target based. Now the biggest problem is to find the target. In almost all the cases, the newer versions of the shareware is available for download, wherein the protection scheme has been changed.

So how to get the targets?? Can somebody help me. I have had some practice with ORC packs, but thats it.

Any advice is welcome

:)
Tolstoinisten
03-23-2004, 11:00 AM
Google, my friend.

There are websites out there that offer old shareware files. Some tutorials on the Krobar website deal with specific targets & you have a 60% approx. (my experience) of finding these targets on these sites. Also you might want to try P2P networks & search them through for targets.

Good luck.

Hi. I'm learning how to crack. But most of the tutorials are target based. Now the biggest problem is to find the target. In almost all the cases, the newer versions of the shareware is available for download, wherein the protection scheme has been changed.

So how to get the targets?? Can somebody help me. I have had some practice with ORC packs, but thats it.

Any advice is welcome

:)
disavowed
03-23-2004, 02:18 PM
you can also try
1. contacting the authors of the tutorials
2. finding newer tutorials
seven
03-23-2004, 02:58 PM
Now the biggest problem is to find the target

u r right .

who write tutorials should upload the targetz too .
least
03-24-2004, 03:27 AM
On the other hand, if the tutorial isn't too old, you can find newer version of the target and the chance is that the protection scheme isn't too different. Here you can use the tutor as the clue of what to look for and then find the rest on your own. I used this approach and in most of cases you can learn more then just following "there is jne at addr XXX so lets NOP it...".
Regards,
least


Removing the Call Home "feature" in vBulletin 3.0?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Removing the Call Home "feature" in vBulletin 3.0?
PDA

View Full Version : Removing the Call Home "feature" in vBulletin 3.0?

Cumulous
03-23-2004, 04:18 PM
Hi! I would like to know how to remove *all* of the Call Home features of vBulletin 3.0 Final.

I tried doing a search on it, both here and at a few other sites, but came up empty. I figure since this is a Reversing Forum running vB 3.0, it should be a question easily answered here. :) :) :)

TIA!
Woodmann
03-23-2004, 07:45 PM
Howdy,

Not to pee on your breakfast but.......

More people get busted running stolen V-bulletin by people
"ratting" them out.
Save yourself the aggravation and get a free php board.

BTW, this forum software is not that expensive and the support
is excellent in comparison to every other server software.

Woodmann
CluelessNoob
03-23-2004, 09:24 PM
Not to pee on your breakfast but.......

I think its damn smart of the authors to ask to be shown all the weaknesses in their code.

Bravo!
Woodmann
03-23-2004, 10:34 PM
;)

They might even be smart enough to use a proxy :D

Woodmann
Cumulous
03-24-2004, 12:39 AM
Well, that's the funny part. I *am* a licensed owner of vB. I just don't like the idea of code that Calls Home. I hate it on sheer principle.

So I'm trying to get rid of it. I found some code in /admincp/index.php that references version.vbulletin.com. I eliminated that, so that now the AdminCP shows N/A for the Most Recent Version. But I don't know if there's something else that I've missed.

Can you help? :)
seven
03-24-2004, 03:33 AM
use maguma studio to search and ( eliminate or replace )

unwanted codez , dont forget to add all extentionz ( php.css.style)

in search box , save ur work , reinstall vb3 .
Cumulous
03-24-2004, 07:34 AM
Yes, but is there other code other than "version.vbulletin.com" that I should be looking for? :)
dELTA
03-24-2004, 08:27 AM
As a theoretical technique for finding out if some php software is "calling home", I would simply use a personal firewall to check if the webserver software (or php.exe if you're not running it as an integrated module) is making any outbound connections.

The authors might of course have designed it to perform the "calling home" by routing it through the clients accessing the board too, and in that case I would use either a personal firewall on my browser (making it notify about all outbound connections except the ones to the forum server), or a proxy server, doing the same thing.

Although, the calling home will probably only be perform at relatively seldom and randomized occasions, and if they have also encrypted/hidden the addresses and other signs of calling home in the code well enough to be hard to catch with a regular expression search, I guess there is only long-term tests or detailed code review that'll do.

Firewalling your webserver to block any outbound connections is good security practise in any way, so do that and you will be safe if they don't route the calling home through the clients (there might be "legal problems" or similar with that technique, so I doubt the authors would do it, but you never know).
seven
03-24-2004, 12:09 PM
code other than "version.vbulletin.com"

2 yearz ago , can,t remember .

but i don,t think there waz another code .

hxxp://members.lycos.co.uk/sssevennn/vb.jpg
Cumulous
03-24-2004, 06:37 PM
As a theoretical technique for finding out if some php software is "calling home", I would simply use a personal firewall to check if the webserver software (or php.exe if you're not running it as an integrated module) is making any outbound connections.

Delta, you're absolutely right insofar as a long term basis is concerned, as well as general security measures. You'll get no argument from me. :)

But if anyone should happen to have existing and superior knowledge as to whether there is any remaining code other than what I caught, I would appreciate hearing it. :)
Aquatic
03-24-2004, 07:23 PM
Can Vbulletin licenses be bought second hand?


simple crypt crackme:twofish
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > simple crypt crackme:twofish
PDA

View Full Version : simple crypt crackme:twofish

lordor
03-24-2004, 03:18 AM
this is a crypt crackme4(using twofish and smc),I think it is very very simple.if you succeed,you will login main window.have fun.any quesion and comment,please mail to :lordor@digitalnuke.com


AsProtect 1.23 RC4 Registered and something else?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > AsProtect 1.23 RC4 Registered and something else?
PDA

View Full Version : AsProtect 1.23 RC4 Registered and something else?

Fahr
03-24-2004, 05:27 AM
Hello all,

I am trying to unpack some prog (some url). Loading it in PEID gives me that it's packed with the following protector:

ASProtect 1.23 RC4 Registered -> Alexey Solodovnikov

I tried CASPR on it, but to no avail. Then I decided to dump it manually, loaded it in OllyDBG and pressed F9, only to get a messagebox telling me that it cannot run when a debugger is present.
Now, I don't know much about ASProtect, but last time I unpacked something ASProtected, it did NOT have debugger protection.
This leads me to think that there's more to it than only ASProtect, only I can't quite figure out what or how to get rid of it.

Any help is appreciated,
- Fahr
hobferret
03-24-2004, 05:37 AM
Hello all,

I am trying to unpack THIS PROG for XXXXXXXXX version 3.2.1 (http://www.somesite.com/download/download_XXXXXX.html). Loading it in PEID gives me that it's packed with the following protector:

ASProtect 1.23 RC4 Registered -> Alexey Solodovnikov

I tried CASPR on it, but to no avail. Then I decided to dump it manually, loaded it in OllyDBG and pressed F9, only to get a messagebox telling me that it cannot run when a debugger is present.
Now, I don't know much about ASProtect, but last time I unpacked something ASProtected, it did NOT have debugger protection.
This leads me to think that there's more to it than only ASProtect, only I can't quite figure out what or how to get rid of it.

Any help is appreciated,
- Fahr

Well Shit...........

2 IN 2 DAYS

I don't believe it yet another link to software :mad:

Fahr read the FAQS as Woodman says THE BIG RED LETTERS before you post anything :rolleyes:

/hobferret
Fahr
03-24-2004, 05:46 AM
Well Shit...........

2 IN 2 DAYS

I don't believe it yet another link to software :mad:

Fahr read the FAQS as Woodman says THE BIG RED LETTERS before you post anything :rolleyes:

/hobferret

My bad indeed, I thought it would be rewritten to hxxp://, since I've seen that in some other posts and it seems to be ok...

Anyways, I edited it. Hope it's ok now.

- Fahr
hobferret
03-24-2004, 06:45 AM
My bad indeed, I thought it would be rewritten to hxxp://, since I've seen that in some other posts and it seems to be ok...

Anyways, I edited it. Hope it's ok now.

- Fahr

OK Fahr :)

I ain't admin but now you have gotten rid of the link e.t.c. Do a search on the board for either ASPR or Olly and all will become clear :D

I will just give you one tip and that is set a breakpoint on IsDebuggerPresent and when you stop F7 3lines down and look at address where 01 is stored, press spacebar and change it to 00. That will rid you of your problem ;)

If you need more help make sure you post what you have done so far, else you will be flamed as a lamer :rolleyes:

There are hundreds of posts regarding ASPR here so in reality you should be able to figure out what is going on!!!

/hobferret
Fahr
04-02-2004, 03:09 PM
Hobferret; thanks for the tip, I should have thought of that myself - it runs like a charm now in OllyDBG :D

The next problem presents itself, though, I made a good dump (or at least, I think so). Here's what I did;

1) I pressed shift-F9 till the prog started; a total of 30 times.
2) I reset the prog, reran and pressed shift-F9 29 times.
3) I put a breakpoint on the RETN, pressed shift-F9.
4) I executed an TC EIP<900000 and landed in an obscure (wrongly disassembled) section.
5) I pressed F8 once and landed in something that looks like the OEP, it starts like this:

PUSH EBP <--- I landed here
MOV EBP, ESP
MOV EAX, DWORD PTR SS:[EBP+8]
TEST EAX, EAX

Looks like an entrypoint to me, also, it appears that no bytes were stolen! Double bonus.
Anyways, at this point I left OllyDBG to hang on PUSH EBP and dumped the process fully with LordPE. So far, so good. Then I ran the process normally, opened ImpRec, opened the process, clicked 'IAT Autosearch' and it came up with 'Could not find anything at this OEP! :-('.
So now I'm stuck with that :P I don't know enough about IAT to manually rebuild it. I could learn, of course, but that would take a lot of time, which I don't quite have atm :S. So is there some other way to do this? I mean; ImpRec SHOULD have no problem with this program... I tried to find Revirgin, but can't seem to find a downloadable anywhere :(

Thanks,
- Fahr
hobferret
04-02-2004, 03:52 PM
Fahr :)

I think you are trying to run before you can walk :D

It does not look like the EIP to me anyways :)

If you are using that location as the EIP it's quite obvious why Imprec can't find anything good. I know what you have done wrong but read the following line. :D

Look for LaBBa's "Step by Step" ASProtect Final tut, can't remember where it is now but I have seen it somewhere coz I D/L it :D

If you get hold of that and read, study and inwardky digest, you will see where you are going wrong :)

It is most likely the best tut for ASPR around, old LaBBa did some good work there, it's especially useful for newbies. Like he describes it, it is a step by step tutorial. :cool:

Regards

/hobferret
JMI
04-02-2004, 04:03 PM
Use the "Search" button in the top bar of the Forums and enter "LaBBa" without the quote marks and you will find what you are looking for.

Regards,
hobferret
04-02-2004, 04:16 PM
Use the "Search" button in the top bar of the Forums and enter "LaBBa" without the quote marks and you will find what you are looking for.

Regards,

Hey JMI :cool:

Told you my brain cells were dying :D

As soon as I saw it I remembered where it was :p

http://66.98.132.48/forum/showthread.php?t=5304&page=3&pp=15

Regards

/hobferret
JMI
04-02-2004, 04:28 PM
You have no "brain cell" excuse better than mine. :rolleyes:

My cells have been dying for alot longer than yours. :D

Regards,
hobferret
04-03-2004, 02:00 AM
You have no "brain cell" excuse better than mine. :rolleyes:

My cells have been dying for alot longer than yours. :D

Regards,

JMI M8 :)

I doubt it, I was fighting in the civil war under General Stephen D. Lee but I managed to survive at least till now :cool:

Regards

/hobferret
Fahr
04-03-2004, 03:22 AM
Fahr :)

I think you are trying to run before you can walk :D

It does not look like the EIP to me anyways :)

If you are using that location as the EIP it's quite obvious why Imprec can't find anything good. I know what you have done wrong but read the following line. :D

Look for LaBBa's "Step by Step" ASProtect Final tut, can't remember where it is now but I have seen it somewhere coz I D/L it :D

If you get hold of that and read, study and inwardky digest, you will see where you are going wrong :)

It is most likely the best tut for ASPR around, old LaBBa did some good work there, it's especially useful for newbies. Like he describes it, it is a step by step tutorial. :cool:

Regards

/hobferret

I WAS following that tut, but then I saw the snippet which I thought was an entry point and dumped there - completely discarding the tut :o

Now I did what LaBBa said, after my initial F8, I once more ran the TC. I land in a bunch of code which does not at all resemble LaBBa's example code, not even remotely. It's completely not disassembled properly, it's a giant row of DB [blah] lines. I can read past that, but the raw bytes also don't resemble LaBBa's example code :S
I dumped the process anyways, but then, according to his tut, I have to dump it again after the RET (C3). As I said; my code is complete gibberish and there's no RET to be seen in a LOOONG time...
Add to that that ImpRec still can't find anything with IAT Autosearch, and that doesn't have anything to do with WHERE I dump it either; the exefile has it's EP set to 1000, and ImpRec just can't find anything there, neither when I run the process outside the debugger, nor when I run it IN the debugger. LaBBa's tut never mentions changing the EP in ImpRec. It just states; hit AutoSearch and let magic happen - well, apprently not for this program :S

Also - his tut is for ASPR 1.23 - this program is packed with ASPR 1.24... I don't know if it matters, but I'm starting to think it does...

Thanks,
- Fahr
hobferret
04-03-2004, 04:51 AM
Fahr :)

Hold on a minute your first post stated that it was packed with ASProtect 1.23 RC4 Registered :confused:

Now then after what you just said I don't know what is going on :confused:

PM the Prog name and D/L link and I will have a look, tomorrow most likely, have a wedding to attend today :(

Regards

/hobferret

Forgot to say that the EP of 1000 is very probably incorrect, the EP of all ASPR's is 1000 - Are you at that address when you dump the target??

If you use the dump plugin in Olly that usually sets the correct EP and have you looked at the run trace to see if there are any REP STOS etc in there, if so you have stolen bytes.

/hobferret
Fahr
04-03-2004, 04:59 AM
Crud, my mistake - I don't know where the ASPR 1.24 comes from, but it is indeed packed with ASPR 1.23 RC4... I don't know why I suddenly thought it was ASPR 1.24... how bizarre :confused:

Anyways, I managed to make the code more readable hitting 'analysis -> analyze code', so I am able to recognize sections from LaBBa's tut now! Should have thought of that before :D (I don't do Olly too often...).

Next problem; when I'm on the code snippet after the second trace, the tut says I have to press F8 till the retn and then after the retn I am supposed to jump to some other code snippet. I pressed F8 till after the retn, but the 'code snippet' I get into is utter and complete gibberish. No matter how often I press 'analyze code', it just doesn't improve... I don't think this snippet is where I should be... :confused:

For reference, the final address and code I end up on is this;

00635A6B . FFA1 CCAC6300 JMP DWORD PTR DS:[ECX+63ACCC]

I'll PM you the URL and program name. Thanks a lot already! This one really has me puzzled...

Have fun at the wedding ;)

Thanks,
- Fahr
hobferret
04-06-2004, 05:26 AM
Hi Fahr :)

Had a quick look at your prog and it does work if you follow LaBBa's ideas :D

There are stolen bytes so you have to FIND THEM use LaBBa's idea once again.

One tip the IAT starts @ 23E21C [+400000] ;)

Hope this helps you!

Regards

/hobferret
Fahr
04-06-2004, 06:50 AM
Hi Fahr :)

Had a quick look at your prog and it does work if you follow LaBBa's ideas :D

There are stolen bytes so you have to FIND THEM use LaBBa's idea once again.

One tip the IAT starts @ 23E21C [+400000] ;)

Hope this helps you!

Regards

/hobferret

Thanks! I think this will help me a lot :) Using that IAT start address, I can just use ImpRec, can't I?

Thanks,
- Fahr
Fahr
04-06-2004, 01:12 PM
Ok, 2 questions if I may;

1) How did you find that IAT RVA? I would like to know for future reference :p
2) According to LaBBa's tut I should get 8 invalid IAT entries (of course, this depends on the program), but I get 84 (!)... Am I missing something here? I cut out all the high numbers. Trying to fix some (viewing hex) results in a 'read error'. Can I treat the ones with 'read error' as being invalid as well?

Thanks,
- Fahr
hobferret
04-07-2004, 07:52 AM
Ok, 2 questions if I may;

1) How did you find that IAT RVA? I would like to know for future reference :p
2) According to LaBBa's tut I should get 8 invalid IAT entries (of course, this depends on the program), but I get 84 (!)... Am I missing something here? I cut out all the high numbers. Trying to fix some (viewing hex) results in a 'read error'. Can I treat the ones with 'read error' as being invalid as well?

Thanks,
- Fahr

Fahr :)

If you look at the code where you first land in Olly - after the trace you will see the address reference for at least 1 of the IAT's, can't remember which one coz I have deleted it. I did keep the Imprec txt file :D

The IAT is as follows:-

1 0023E21C kernel32.dll
1 0023E2D0 kernel32.dll

1 0023E2D8 user32.dll
1 0023E2E4 user32.dll

1 0023E2EC advapi32.dll
1 0023E2F4 advapi32.dll

1 0023E2FC oleaut32.dll
1 0023E304 oleaut32.dll

1 0023E30C kernel32.dll
1 0023E318 kernel32.dll

1 0023E320 advapi32.dll
1 0023E340 advapi32.dll

1 0023E348 kernel32.dll
1 0023E4EC kernel32.dll

1 0023E4F4 version.dll
1 0023E4FC version.dll

1 0023E504 gdi32.dll
1 0023E698 gdi32.dll

1 0023E6A0 user32.dll
1 0023E9AC user32.dll

1 0023E9B4 ole32.dll
1 0023E9B8 ole32.dll

1 0023E9C0 kernel32.dll

1 0023E9C8 oleaut32.dll
1 0023E9FC oleaut32.dll

1 0023EA04 ole32.dll
1 0023EA24 ole32.dll

1 0023EA2C oleaut32.dll
1 0023EA38 oleaut32.dll

1 0023EA40 comctl32.dll
1 0023EA9C comctl32.dll

1 0023EAA4 winspool.drv
1 0023EAB0 winspool.drv

1 0023EAB8 shell32.dll
1 0023EAD0 shell32.dll

1 0023EAD8 comdlg32.dll
1 0023EAE8 comdlg32.dll

1 0023EAF0 winmm.dll

1 0023EAF8 gdi32.dll

1 0023EB00 kernel32.dll

1 0023EB08 ace32.dll
1 0023ED94 ace32.dll

If there are some you cannot resolve for yourself, search the board there is info here if you look for it :D

Regards

/hobferret
Fahr
04-07-2004, 09:52 AM
Ok, thanks for the explanation :)

I already have the IAT and deleted the wrong entries. Now I have 7 more unresolved entries to fix (I already fixed a lot), I think I'll manage :)

Is there any way of knowing if I fixed the other entries correctly? Or will I only find out once the app crashes? :p

Thanks,
- Fahr
hobferret
04-07-2004, 10:23 AM
Ok, thanks for the explanation :)

I already have the IAT and deleted the wrong entries. Now I have 7 more unresolved entries to fix (I already fixed a lot), I think I'll manage :)

Is there any way of knowing if I fixed the other entries correctly? Or will I only find out once the app crashes? :p

Thanks,
- Fahr

Fahr ;)

You will most likely find out if it crashes :D

I assume you have found the STOLEN BYTES OK :D

If not just as another tip it's written in Borland Delphi :eek:

As I said B4 there is info on the board regarding unresolved pointers so you should be able to manage it ;)

You can always click on SHOW SUSPECT that will give you a good idea of what's wrong M8 :)

Regards

/hobferret
Fahr
04-07-2004, 12:51 PM
I didn't even look for the stolen bytes yet, I figured I'd first fix the IAT :p

I know it was written in Delphi - the RCData full of TForms kinda gives it away (I program Delphi at work, so I should know :p)

And what am I supposed to do with Show Suspect? It only shows me some duplicate entries which are apparently faulty... doesn't solve much... or did you mean it can help me track potential problems?

Thanks,
- Fahr
Fahr
04-07-2004, 01:21 PM
One more thing; I tried searching this board on any and all combinations of "ImpRec, Unresolved, IAT" but I wasn't really able to find anything worthwhile. I did find some mentions of an Emul plugin, which I can't seem to find anywhere...

Another tutorial on Aspr I read states:

(OFF TOPIC: In this case it has fixed all the invalid Thunks. However, if there are any left you would want to select them and right click and under plugin tracers and pick ASProtect 1.22. If there are still some invalid one lefts then simply delete them.)

somehow, I don't think that's a good idea :p

I THINK I managed to fix some (if not most) of the unresolved calls, but as I said, 7 (or 8, after a new trace) remain unresolved. LaBBa says I should EXECUTE them and see what the results are... this bit has me a bit puzzled - HOW do I execute them? Just breakpoint them in Olly and run the app? I might never find the option in the app which calls to that API...

Thanks,
- Fahr
hobferret
04-08-2004, 04:31 AM
One more thing; I tried searching this board on any and all combinations of "ImpRec, Unresolved, IAT" but I wasn't really able to find anything worthwhile. I did find some mentions of an Emul plugin, which I can't seem to find anywhere...

Another tutorial on Aspr I read states:

somehow, I don't think that's a good idea :p

I THINK I managed to fix some (if not most) of the unresolved calls, but as I said, 7 (or 8, after a new trace) remain unresolved. LaBBa says I should EXECUTE them and see what the results are... this bit has me a bit puzzled - HOW do I execute them? Just breakpoint them in Olly and run the app? I might never find the option in the app which calls to that API...

Thanks,
- Fahr

Fahr :)

Here is a list of some of the unresolved calls, one's I have made notes of and some from LaBBa's tut :D

Aspr notes V1.4??

Redirected calls which cannot be auto resolved!

44B717 6513C4
6513C4 55 PUSH EBP
6513C5 8BEC MOV EBP,ESP
6513C7 5D POP ESP
6513C8 C20400 RET 04
Becomes Kernel32!FreeResource

44B724 65139C
65139C 6A00 PUSH 00
65139E E8B53DFFFF CALL Kernel32!GMHA
6513A3 FF35E46C6500 PUSH DWORD [00656CE4]
6513A9 58 POP EAX
6513AA 8B05F46C6500 MOV EAX, [00656CF4]
6513B0 C3 RET
Becomes Kernel32!GetCommandLineA

44B730 651388
651388 A1E86C6500 MOV EAX, [00656CE8]
65138D C3 RET
Becomes Kernel32!GetCurrentProcess

44B760 65133C
65133C Look it’s GetModuleHandleA
Becomes Kernel32!GetModuleHandleA

44B770 650EE8
650EE8/F0E GetProcAddress
Becomes Kernel32!GetProcAddress

44B7A0 651358
651358 6A00 PUSH 00
65135A E8F93DFFFF CALL Kernel32!GMHA
65135F FF35E46C6500 PUSH DWORD [00656CE4]
651365 58 POP EAX
651366 C3 RET
Becomes Kernel32!GetCommandLineA

44B7D4 6513B4
6513B4 55 PUSH EBP
6513B5 8BEC MOV EBP,ESP
6513B7 8B05F46C6500 MOV EAX, [00656CF4]
6513BD B84508 MOV EAX, [EBP+08]
6513C0 5D POP EBP
6513C1 C20400 RET 04
Becomes Kernel32!LockResource

4753F8 - ED13D0
EDI3D0 6A00 PUSH 00
ED13D2 CALLKernel32!GMHA
ED13D7 FF35E86CED00 PUSH WORD [00ED6CE8]
ED13DD 58 POP EAX
ED13DE 8B05F86CED00 MOV EAX, [00ED6CF8]
ED13E4 C3 RET
Becomes Kernel32!GetCommandLineA

4573FC - ED13C0
ED13C0 55 PUSH EBP
ED13C1 8BEC MOV EBP,ESP
ED13C3 CALLKernel32!GetVersion
ED13C8 A1F46CED00 MOV EAX, [00ED6CF4]
ED13CD 5D POP EBP
ED13CE C3 RET
Becomes Kernel32!GetVersion

457444 - EE9E24
EE9E24 52 PUSH EDX
EE9E25 68369507C0 PUSH WORD [C0079536]
EE9E2A C3 RET
Becomes Kernel32!GlobalUnlock

475464 - ED13B8
ED13B8 A1EC6CED00 MOV EAX, [00ED6CEC]
ED13BD C3 RET
Becomes Kernel32!GetCurrentProcess

4754D0 - ED0EF0
ED0EF0\\ED0FI6
CALL Kernel32!GetProcAddress
RET 08
Becomes Kernel32!GetProcAddress

475518 - ED1360
ED1360\\ED1384
CALL Hernel32!GMHA
RET 04
Becomes Kernel32!GetModuleHandleA

LaBBa explanation!

PUSH EBP
MOV EBP,ESP
MOV EAX,[FF7E24] // DWORD VALUE 001522398
POP EBP
RETN4
EITHER LOCK RESOURCE or FREERESOURCE

PUSH DWORD PTR DS:[FF7E14]
POP EAX
RET
GET VERSION

PUSH EBP
MOV EBP,ESP
MOV EAX,DWORD PTR DS:[FF7E24]
MOV EAX,DWORD PTR SS:[EBP+8]
POP EBP
RETN4
EITHER LOCKRESOURCE or FREERESOURCE

MOV EAX,DWORD PTR DS:[FF7E20]
RETN
GETCURRENTPROCESSID

MOV EAX,DWORD PTR DS:[FF7E18]
RETN
GETCURRENTPROCESS - GETCURRENTPROCESSID works too!

PUSH EBP
MOV EBP,ESP
MOV EAX,DWORD PTR DS:[FF7E24]
POP EBP
RETN4
EITHER LOCKRESOURCE or FREERESOURCE

Another thing regarding execute them - First I am a relative newcomer to Olly but in SICE you would just do a "dd address" of IAT then set a BPX on what location that address refered to. i.e. if say 654320==01234567 then set BPX on 01234567. The prog will stop at that address all you need to do then is TRACE thru till you find the correct API ;)

There must be a way to do the same in Olly, I suppose you would set a break on memory execution, but I am not sure, like I said Olly is a whole new world to me. Maybe someone else on the board can direct you in the right direction :cool:

Just one other thing, if you get a read error when you look at the code in Imprec, make sure the prog has not crashed out. Sometimes when you do an auto trace the prog has gone so you will get a read error if there is nowt there to grab :D

Regards

/hobferret
JMI
04-08-2004, 03:09 PM
hobferret:

Sorry for the delay in commenting on your successfully becoming the oldest living person in these United States and having lived well past your 140th year. :eek: Quite an accomplishment. :D

Someday maybe I can share with you my military experience of invading the U.S. from a rubber raft and running an Intel Op in Fayetteville. We westerners aren't too used to those 96 degree and 98 % humidity summer days. :D Too bad that last Civil War Soldier's Bride died so many years ago. Must be lonely now. :( May 10th is not too far away and I will lift a glass in your honor on the occasion. :cool:

Regards,
bart
04-08-2004, 07:08 PM
excellent :o
Woodmann
04-08-2004, 08:44 PM
I was fighting in the civil war under General Stephen D. Lee but I managed to survive at least till now

He would be Robert E Lee's long lost brother ? :p
Ulysses called me, he wants his sword back :eek:

Woodmann
hobferret
04-09-2004, 05:39 AM
Hi JMI :)

Your memory is fading too, the U.S. was not in existance back then and we certainly did not have rubber rafts. :D

It was all blood sweat and tears back then. They were close to producing GPS guided bombs but just lacking the final part of the puzzle.

You must realize that I was only joking, I take my hat off to the many bold men on both sides who fought and lost their lives.

BTW General Stephen D. Lee was a post war college president and he knew all about Intel, just visit his grave in Columbus Mississippi and pose the question.

Finally, I would love to share the experience with someone who was involved, it would be a great honor. :)

And to Woody, yes he was a distant relative of Robert E. Lee :)

Regards

/hobferret
hobferret
04-09-2004, 05:46 AM
I didn't even look for the stolen bytes yet, I figured I'd first fix the IAT :p

I know it was written in Delphi - the RCData full of TForms kinda gives it away (I program Delphi at work, so I should know :p)

And what am I supposed to do with Show Suspect? It only shows me some duplicate entries which are apparently faulty... doesn't solve much... or did you mean it can help me track potential problems?

Thanks,
- Fahr

Fahr :)

It occured to me there must be a better way of finding the stolen bytes try this out :D

1st Set break on the old code locking API, make a note of the EAX value, hope everyone remembers it! :D

2nd Set conditional break on REP STOS BYTE PRT ES:[EDI]
Scroll up til you find a JMP SHORT XXXXXXXX, should be 6 lines up, make a note of the address.

3rd Restart prog, break again on the famous API, when you get to EAX make it same as noted before.

4th Set conditional break on JMP SHORT XXXXXXXX.

When prog stops take the jump this puts you into the address which REP STOS clears out, now you don't have any violations you can just trace thru it - NO PROBS!

Regards

/hobferret
Fahr
04-12-2004, 08:35 AM
Fahr :)

It occured to me there must be a better way of finding the stolen bytes try this out :D

1st Set break on the old code locking API, make a note of the EAX value, hope everyone remembers it! :D

2nd Set conditional break on REP STOS BYTE PRT ES:[EDI]
Scroll up til you find a JMP SHORT XXXXXXXX, should be 6 lines up, make a note of the address.

3rd Restart prog, break again on the famous API, when you get to EAX make it same as noted before.

4th Set conditional break on JMP SHORT XXXXXXXX.

When prog stops take the jump this puts you into the address which REP STOS clears out, now you don't have any violations you can just trace thru it - NO PROBS!

Regards

/hobferret

I'm not exactly sure what you mean here. As I said; I haven't even tried to find the stolen bytes, so I also haven't failed yet :p
But I should just be able to find those bytes in the Run Trace Log, shouldn't I?

- Fahr
Fahr
04-12-2004, 08:54 AM
Ok, I have 2 more unresolved IAT entries (and some suspects, but first things first), mainly thanks to the notes hobferret posted about IAT a few posts back - thanks!

Anyways, I can't figure those 2 out... they appear to be calling to ntdll.dll, but I find that VERY hard to believe, since this program also runs on 9x/ME.
Both entries are similar, they look like this:

push ebp
mov ebp,esp
push -1
push 77F87CB0 // ~= ntdll.dll/0199/RtlDeleteCriticalSection
push 77F98191 // ~= ntdll.dll/04A3/wcstoul
mov eax,fs:[0]
push eax
mov fs:[0],esp
push ecx
push ecx
sub esp,10
push ebx
push esi
push edi
push 77F87C1E // ~= ntdll.dll/0199/RtlDeleteCriticalSection
retn

In fact, it seems like both entries are EXACTLY alike...

Can anyone tell me what this is? I can't seem to figure it out :S

Thanks,
- Fahr
crUsAdEr
04-12-2004, 08:58 AM
hint : Here is the how the function ntdll!RtlDeleteCriticalSection looks like

.text:77F87BF9 public RtlDeleteCriticalSection
.text:77F87BF9 RtlDeleteCriticalSection proc near ;
.text:77F87BF9
.text:77F87BF9 push ebp
.text:77F87BFA mov ebp, esp
.text:77F87BFC push 0FFFFFFFFh
.text:77F87BFE push offset dword_77F87CB0
.text:77F87C03 push offset _except_handler3
.text:77F87C08 mov eax, large fs:0
.text:77F87C0E push eax
.text:77F87C0F mov large fs:0, esp
.text:77F87C16 push ecx
.text:77F87C17 push ecx
.text:77F87C18 sub esp, 10h
.text:77F87C1B push ebx
.text:77F87C1C push esi
.text:77F87C1D push edi
.text:77F87C1E mov ebx, [ebp+arg_0]
.text:77F87C21 mov eax, [ebx+10h]
.text:77F87C24 test eax, eax
.text:77F87C26 jnz loc_77F88C43
.text:77F87C2C and [ebp+var_20], 0
Fahr
04-12-2004, 09:03 AM
Uhm thanks and nice IDA output... but I don't see how it can help me :confused:
crUsAdEr
04-12-2004, 11:10 AM
sigh.. perhaps look harder and think a little bit?
maybe a quick search around and look at a few tutorials?
Fahr
04-12-2004, 01:48 PM
Don't get me wrong here - I don't mean I don't understand the code or whatever, I just don't get its relevance in this particular situation. This program does not run on WinNT only, so I don't think it import ntdll.dll, which leads me to believe that this API call is something entirely different from what it appears to be.
It's not that I don't get what you're hinting at - apparently there is something with that bold line in your code bit... I just don't get what you mean by POSTING it...

Flame me all you want, but I just don't get the idea...

- Fahr
crUsAdEr
04-12-2004, 02:46 PM
ok i see... you should look at the whole Import tree overall... then guess which module is this import from... if it is a single import from a module.. it is most likely ntdll!... if it is part of lots of import from a certain module, for example kernel32.dll then it might be tricky but i doubt it honestly!!!

Just try with the obvious n see if it works...
Fahr
04-12-2004, 02:51 PM
Both entries (which are the same) are in the kernel32.dll tree. One is all the way on top, the other one is halfway... but I'm pretty sure they're both kernel32.dll imports...

I guess this makes it tricky :p

- Fahr
crUsAdEr
04-12-2004, 03:16 PM
next thing you can do is BPM on that IAT address and see when it is written on.. from then on you cna backtrace to find the IAT redirection routine which will have the API name decrypted before redirection...

Another method is disassemble your dump.exe in IDA and see when it is called... if it is never called it might be bogus...

Also, check if your Import are alphabetically sorted :)... if so it makes your job a hell lot easier...
hobferret
04-13-2004, 04:32 AM
Ok, I have 2 more unresolved IAT entries (and some suspects, but first things first), mainly thanks to the notes hobferret posted about IAT a few posts back - thanks!

Anyways, I can't figure those 2 out... they appear to be calling to ntdll.dll, but I find that VERY hard to believe, since this program also runs on 9x/ME.
Both entries are similar, they look like this:

push ebp
mov ebp,esp
push -1
push 77F87CB0 // ~= ntdll.dll/0199/RtlDeleteCriticalSection
push 77F98191 // ~= ntdll.dll/04A3/wcstoul
mov eax,fs:[0]
push eax
mov fs:[0],esp
push ecx
push ecx
sub esp,10
push ebx
push esi
push edi
push 77F87C1E // ~= ntdll.dll/0199/RtlDeleteCriticalSection
retn

In fact, it seems like both entries are EXACTLY alike...

Can anyone tell me what this is? I can't seem to figure it out :S

Thanks,
- Fahr

Fahr :)

I think you will find that these calls are actually to Kernal32.dll - with the same routine :D

You will NOT find the stolen bytes in the run trace, you have to do it by tracing, hence the post about a better way of doing it :cool:

Regards

/hobferret

BTW I ain't suggested that you have failed M8 ;)
Fahr
04-17-2004, 02:06 PM
I DID IT!! I UNPACKED IT! - well, kind of anyways. Following LaBBa's FINAL tut, I was able to work it (before, I only found the first one he posted and didn't bother to read thru the thread - DOH.).

Lots of thanks to Hobferret for his help with the IAT, couldn't have done it without you :)
Lots of thanks to all the other people for having a nearly ENDLESS patience with me and my n00bishness :p

One more thing, though. The app runs fine as far as I could see, but when I CLOSE it, it gives me an access violation. Running is no prob, closing is. It says 'Runtime error 216 at 00403B36'.

Here's what I've found;
OEP is at 635A5B

Stolen bytes:
PUSH EBP
MOV EBP,ESP
SUB ESP,10
PUSH EBX
MOV EAX, 63516C

I know that hobferret mentioned something about PUSH EBX... would it run better if I removed it and moved the OEP up by one?

Thanks again to all! :)

- Fahr
Fahr
04-17-2004, 02:16 PM
Ok, I went ahead and did it already - without the push ebx, it runs fine :p

No more errors or access violations or anything. But can anyone please explain me WHY? I DID find PUSH EBX as one of the stolen bytes...

Thanks,
- Fahr
hobferret
04-18-2004, 04:07 AM
Ok, I went ahead and did it already - without the push ebx, it runs fine :p

No more errors or access violations or anything. But can anyone please explain me WHY? I DID find PUSH EBX as one of the stolen bytes...

Thanks,
- Fahr

Fahr ;)

Glad to see you got it working :cool:

Like I said however I am still not really sure if there is one more - a PUSH EBX - may be missing but unlikely because the extra push should cause it to crash somewhere - which it obviously did :D

Regards

/hobferret
Fahr
04-18-2004, 04:33 AM
Fahr ;)

Glad to see you got it working :cool:

Like I said however I am still not really sure if there is one more - a PUSH EBX - may be missing but unlikely because the extra push should cause it to crash somewhere - which it obviously did :D

Regards

/hobferret

Obviously indeed, but I still don't know why that extra push is there in the first place...

Oh well, it works :D I'm already busy on ACTUALLY cracking the thing. I'm thinking of writing a complete tut covering unpacking and cracking this particular target... I'll be sure to mention you in the thanks :p

- Fahr
hobferret
04-18-2004, 05:41 AM
Fahr ;)

To be honest I don't know either, maybe it's part of ASPR code obfuscation :D

It always helps if you know what the prog was compiled with, that way you have a better idea of how the stack frame is created :p

BTW did yoy try the code locking idea of getting the stolen bytes, darn site easier as there are no exceptions because the code has not been executed :D

Regards

/hobferret

Obviously indeed, but I still don't know why that extra push is there in the first place...

Oh well, it works :D I'm already busy on ACTUALLY cracking the thing. I'm thinking of writing a complete tut covering unpacking and cracking this particular target... I'll be sure to mention you in the thanks :p

- Fahr
Fahr
04-18-2004, 07:26 AM
Fahr ;)

To be honest I don't know either, maybe it's part of ASPR code obfuscation :D

It always helps if you know what the prog was compiled with, that way you have a better idea of how the stack frame is created :p

BTW did yoy try the code locking idea of getting the stolen bytes, darn site easier as there are no exceptions because the code has not been executed :D

Regards

/hobferret

To be honest, I didn't quite get what you meant by the code locking API and how to figure those bytes :o
I used LaBBa's method, NOP-ing all the exceptions on my way and tracing thru the code like that...

- Fahr
hobferret
04-18-2004, 07:41 AM
To be honest, I didn't quite get what you meant by the code locking API and how to figure those bytes :o
I used LaBBa's method, NOP-ing all the exceptions on my way and tracing thru the code like that...

- Fahr

Fahr ;)

Have a look at this thread :D

http://woodmann.com/forum/showthread.php?t=4936

Regards

/hobferret
Fahr
04-18-2004, 07:52 AM
Fahr ;)

Have a look at this thread :D

http://woodmann.com/forum/showthread.php?t=4936

Regards

/hobferret

Hmm... interresting... by why GetSystemTime? And is that EAX value he mentiones the EAX value I will need for the stolen bytes? (mov eax, [something])?

Thanks,
- Fahr
hobferret
04-18-2004, 08:25 AM
Hmm... interresting... by why GetSystemTime? And is that EAX value he mentiones the EAX value I will need for the stolen bytes? (mov eax, [something])?

Thanks,
- Fahr

Ok M8

Read my post on page2 of this thread and all will become clear :D

Regards

/hobferret
Fahr
04-18-2004, 11:12 AM
Ok M8

Read my post on page2 of this thread and all will become clear :D

Regards

/hobferret

So GetSystemTime is the code locking API? And tracing thru it will also give me the EAX value? I'll check it out...

One more thing, at the end of page 1 you say the IAT begins at 23E21C. I am retracing my steps to write a tut, but I just can't find 23E21C :S. So far the closest IAT address I came acros was 23A61C - a difference of 3C00! So can you please tell me how you find that IAT address? Cuz I'm still in the dark...

Thanks,
- Fahr
hobferret
04-18-2004, 12:01 PM
Fahr :)

If you look at Page1 you will see that I posted this:-

One tip the IAT starts @ 23E21C [+400000]

That means if you are looking for it in a debugger it will be 63E21C, I can't look again coz I have deleted the prog, not of much use to me :D

You must have found it someway because you have gotten it working :D

Regards

/hobferret
Fahr
04-18-2004, 12:36 PM
Fahr :)

If you look at Page1 you will see that I posted this:-

One tip the IAT starts @ 23E21C [+400000]

That means if you are looking for it in a debugger it will be 63E21C, I can't look again coz I have deleted the prog, not of much use to me :D

You must have found it someway because you have gotten it working :D

Regards

/hobferret

I know that, of course. I also found 63A61C instead of 23A61C. I just don't get how you found that real IAT entry.
When I fill out the OEP in ImpRec, it comes up with 23A61C for the RVA. Obviously, this is not correct...
And I didn't find the REAL RVA myself, I used the info you gave me.

- Fahr
hobferret
04-19-2004, 05:19 AM
Fahr :)

Your in luck, I have been searching thru my notes and still have the info on this prog :D

Finding the IAT in Olly

After tracing you end up at 00407180 JMP DWORD PTR DS:[63E318], at this point you are in the program so this must be pointing to a valid IAT referrer.

Goto the dump screen and goto expression 0063E318. Now scroll up until you find a DWORD that is a "large" number, one that does not look like part of a dll routine.

For example 0063E218 is DCC8CC21, bear in mind that you have to reverse it, this can't be a dll! - 0063E21C is E4D3D300 reversed becomes 00D3D3E4 and looks promising!

Then scroll down til you think you are at the end of the JUMP table and that becomes the last referrer!

If in doubt use the first one in Imprec and set a length of 1000 then cut and delete the useless ones!

Dont forget you also need the EP to be correct or at least somewhere close! and away you go!

Cant be of any more help coz like I said I dont have the prog anymore and I aint going to reinstall it :D

Regards

/hobferret
JMI
04-19-2004, 07:39 PM
Fahr:

Just so you don't think you have gone completely crazy, (using your target from before it was removed :eek: ) You said you:

1) I pressed shift-F9 till the prog started; a total of 30 times.
2) I reset the prog, reran and pressed shift-F9 29 times.
3) I put a breakpoint on the RETN, pressed shift-F9.
4) I executed an TC EIP<900000 and landed in an obscure (wrongly disassembled) section.

(There is another way to do this last step, besides the TC EIP<900000, which was described in R@dier's tut on tag & rename, which is:

Press Alt + M keys and bring up the memory map window
then look for the target "code" section, right click on it and choose set memory breakpoint on access. Then press CTRL + F11 and you are at the entry point of the Code section at 00407180, which is the same address you get to with the TC EIP<900000.)

Here you should do a CTRL +A to "Analyse" code. You should now be at:

00407180 $-FF25 18E36300 JMP DWORD PTR DS:[63E318]

Now at this point, the address you need for your last MOVE EAX, target,XXXXXX instruction is generally to be found in "either" EAX or EBX. In this case it's in EBX and it is the 0063516C which you later found.

Now another R@dier reported trick (don't know who started either technique): Remove the analysis. "Right Click" in the CPU window, Analysis--> Remove Analysis. Now do Alt + K to bring up the STACK window. If you didn't remove the Analysis, you will have only one entry. If you did remove the Analysis, you will have two. The second is:

Call stack of main thread, item 1
Address=0012FF8C
Stack=00635A6C
Procedure / arguments=Target.00407244
Called from=Target.00635A67

If you Double click on the 00635A67 it will open the CPU window again at that location. This one is kind of tricky, because it's at an odd address, and if you scroll up, the view shifts to an even address. Generally your Stolen Bytes go right above this address. [EDIT: In OllyDBG you can move the display up or down, one bit at a time by using the CTRL + up or down arrow.]

Now finding the Stolen Bytes can be accomplished by tooking in the Trace Window. View --> Run Trace. If you set your Debugging Options in the TRACE tab to check "Log Commands" and "Show ESP," when you open the TRACE by going to Window --> Run Trace, the window will open. Next Right Click on the window --> Highlight Register --> EBP.

Now if you scroll down to the bottom you will see alot of "REP STOS BYTE PTR ES:[EDI]" code which was used to erase the Stolen Bytes and other things. Now if you look above this section, you should have a red section in the command window. Keep looking up and you will eventually see a red highlighted EBP (Generally around 600 or less) which is identical to ESP. In this case it is: 12FFA0. Look into the Command Window opposite the ESP, which is immediately above the highlited EBP and you will see:

PUSH EBP
MOV EBP,ESP
SUB ESP,10
PREFIX REPNE: --> ; Superfluous
PREFIX REPNE:--> ; Superfluous
SUB ESP,1C --> ; Superfluous
SUB ESP,18--> ; Superfluous
JMP Short (to next instruction)-->
PUSH EBX
and you already know that the next needed instruction is:
MOV EAX, 63516C from EBX above.

Some of these techniques are discussed on the exetools forum also. Do a search there for britedream and you will get a list that generally includes the ASPR threads.

Enough for now.

Regards,
Fahr
04-25-2004, 06:06 AM
Thanks for the replies! I'll check it out and report back on my findings :)

Sorry for my late reply, I've been terribly busy as of late.

- Fahr


Seed Code for Hasp 4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Seed Code for Hasp 4
PDA

View Full Version : Seed Code for Hasp 4

seed
03-24-2004, 08:26 AM
Hi all,
:confused:
I was wondering if anyone has attempted to re-write or change the seed Code (Pass 1 and Pass2) on a Hasp 4 Dongle?
And can it be done?
If not, would it be possible to replace the chip, but if l do that, would it be possible to write my own seed code to it?

Thank you :D
tgodd
03-24-2004, 03:28 PM
I have heard from people who insist that it can be done.
However I am sure that there is a fuse on that die which if blown,
could prevent this from being done.

tgodd
seed
03-24-2004, 05:36 PM
Thank you tgodd for the reply,

I believe this is true aswell... What l had been thinking is to now do, is to replace the chip, and write my seed code. Is there such a program or hardware that you know off that is ready avaliable to get hold off to do this.

Thank you again
tgodd
03-25-2004, 03:11 AM
The chip is a custom asic and cannot be purchased.
Because nobody would sell it to you.

Emulation is the only real way.

USB's may be able to be reprogrammed in the way that you speak,
however, I have not encountered anyone who has managed to do so.

tgodd


GetProcAddress
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > GetProcAddress
PDA

View Full Version : GetProcAddress

cooper
03-24-2004, 10:09 AM
I faced the following problem today
Aim adding dll to a program
its quite simple :
using LoadLibraryA, GetProcAddress, FreeLibrary
if some function is not imported its possible to
get its handle from system dlls like kernel32.dll
by using GetProcAddress
But what to do if GetProcAddress is not imported also?
thats the question
thanx for help.

sorry if this has already been talked
bart
03-24-2004, 11:12 AM
you can always write your own GetProcAddress if you know the base of the dll file, its not that hard, just scan export table, but i would advice to first load kernel and find out real GetProcAddress, and then use it to find other apis (you might have some troubles with forwarded apis)
disavowed
03-24-2004, 12:52 PM
http://scifi.pages.at/yoda9k/snippets/kernel.zip
http://scifi.pages.at/yoda9k/snippets/kernel2.zip
Foreigner
03-26-2004, 07:03 AM
Hi cooper,
can't you add the function inside the file, changing the Import Table ?
cooper
03-27-2004, 05:16 PM
thank you you advices helped me
Hi cooper,
can't you add the function inside the file, changing the Import Table ?

only if you teach me how to do it
Kayaker
03-27-2004, 05:59 PM
thank you you advices helped me

only if you teach me how to do it

Now that might turn this thread into a Miniproject after all, hint, hint...:-)
ZaiRoN
03-28-2004, 09:45 AM
Ok cooper/foreigner/Kayaker, a new miniproject will begin.

I have attached a stupid program; the program contains two calls, one for GetModuleHandleA and the other for ExitProcess. Our task is to display a messagebox with caption "I am the caption" and text "I am the text".
This can be done in two different ways:
1. Using LoadLibraryA/GetProcAddress combo. If you look at the imported functions you will only see LoadLibraryA, GetProcAddress is not imported and you have to add it manually.
2. Adding user32.dll to the import table and then adding MessageBoxA function.

In the first point you have to change Original First Thunk and First Thunk arrays only, in the other one you have to play also with Image_Import_Descriptor structure. I suggest you to try both of them, you will find how easy is to work with these structures ;)

Some nice tutorial that may help you:
Iczelion's Import Table Tutorial: http://spiff.tripnet.se/~iczelion/pe-tut6.html
[yAtEs] Pe Notes (http://www.woodmann.net/yates/YATES.PE.txt[/url)
[yAtEs] Understanding Import Tables (http://www.woodmann.net/yates/Import_tables.txt[/url)
Also, take a look at this thread: Messin' with the import table (http://www.woodmann.net/forum/showthread.php?t=162)

Good luck,
ZaiRoN
evaluator
03-29-2004, 03:31 AM
i failed..help me:)

but instead created new 1byte puzzle on this theme:)
uploaded in puzzles thread.
cooper
03-29-2004, 02:09 PM
@ evaluator :))))))

OK i've made it the first way by now
i added new function to First Thunk
but had to fill with zeroes Original First Thunk
(as far as I understood this array is not important)
so now I know how to do it
tomorrow I'll try adding user32.dll
br00t_4_c
04-06-2004, 01:05 PM
Hey everybody :) It's my first time posting here so please forgive my n00bish question. I have attempted to complete this mini-project so far using the first method mentioned in the instructions. I added the zero-terminated function name ("GetProcAddress") preceded by an ordinal of "00 00" to the list of function/dll names and added an RVA to the newly added name in the OriginalFirstThunk and FirstThunk members of the array of IMAGE_IMPORT_DESCRIPTOR structures. Now when I try to run the proggy under WinXP, I get the following error message:

"The application failed to initialize properly (0xC0000005). Click on OK to terminate the application"

Any thoughts would be greatly appreciated....

:confused:
ZaiRoN
04-06-2004, 01:38 PM
Hi br00t_4_c,
seems like there is a problem with the new added function (GetProcAddress). I bet you have added the rva of the new function directly at offset 0x648, am I right? OriginalFirstThunk has a final 00 dword at the end. Is this your problem?

ZaiRoN
br00t_4_c
04-06-2004, 02:13 PM
:rolleyes: Oops, never mind, forgot to terminate the IAT with a null pointer -sorry for the wasted forum space... :D

I did indeed add the rva to the new function at 648. Then i inserted a 00 dword to terminate the OriginalFirstThunk with a null pointer. Then I adjusted the rvas for anything that would have been affected by this insertion by adding 4... ran the thing again and no more crash :D

Thanx for the speedy reply ZaiRoN


how i can forget: c0ngratz, m$!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > how i can forget: c0ngratz, m$!
PDA

View Full Version : how i can forget: c0ngratz, m$!

evaluator
03-24-2004, 02:07 PM
how i can forget: congratz m$ ((((((:))))))
Woodmann
03-24-2004, 06:16 PM
OK.....

I give up :confused:

Woodmann
JMI
03-24-2004, 06:34 PM
Maybe he's congratulating them on their $613 million fine for violating the EU anti-trust laws. ?????????

Regards,
Woodmann
03-24-2004, 07:03 PM
They aint done with that mess yet. We still have about 3 more years of appeals and back room deals before that gets resolved.

Woodmann


AsProtect 1.23 RC4 Registered and something else? (Thread split)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > AsProtect 1.23 RC4 Registered and something else? (Thread split)
PDA

View Full Version : AsProtect 1.23 RC4 Registered and something else? (Thread split)

Woodmann
03-24-2004, 05:43 PM
Howdy,

Just to clarify a few things.

You can link to information using http.
You can link to other things RCE related. IE; plugins etc.

You shall not link to a program that is not your own. IE; no progs you are trying to RE.
You shall not link to a ready made crack.

JMI is the one responsible for the now famous "Read the big red letters"
Woodmann
JMI
03-24-2004, 06:25 PM
Small "technical" correction. :) The "original" quote was:

"Read the BIG RED LETTERS". :D

We have to make sure the historical record is correct, because one never knows how it might ultimately be used. Take, for instance, this casual response used on the Exetools Forum which the recipient liked so much he added it to his own signature:

"The Deity gave you both eyes with which to see and a mind with which to inquire. Please try to use both. Have you even tried searching for this?? There is actually a search button at the top of the Forums. Use it effectively"

:rolleyes:

Regards,
hobferret
03-25-2004, 07:26 AM
Hiya JMI :)

Sorry I missed the Read out of my post just another instance of brain cell death :D

I apologise coz I thought it was Woodman's idea of the BIG RED LETTERS :)

When I just read the posts I could have kicked the cat. Luckily we don't have one (kicking the goldfish isn't as satisfying, and much messier). :confused:

/hobferret
JMI
03-25-2004, 12:25 PM
Hey hobferret:

I was just teasing and my comment was directed at Woody. :D And indeed I believe it was his idea to put the statement in RED at the top of the Forums, although it had appeared there for some time. No apology was, or is needed and we are happy to have members reminding members of the proper way to proceed. ;) I was just having some fun with which parts of the "quote" attributed to me should have been in RED, nothing else. Some times I write it as just "you apparently haven't paid attention to the BIG RED LETTERS at the top of the Forums." Whatever works for those who are so anxious for instant gratification that can't take time to try to help themselves. :rolleyes:

Regards,
dELTA
03-25-2004, 08:04 PM
Actually, it was my idea (well, at least this last time around), inspired by a request from nikolatesla20. :)
JMI
03-25-2004, 08:16 PM
Sorry dELTA:

It's "Official" policy around here, that dELTA is not allowed to have any "ideas," or at lease not receive any credit for them, until he is substantially older. :D Of course, by then, we'll be too old to remember to give him credit. :rolleyes:

Regards,
Kayaker
03-25-2004, 08:29 PM
/me shakes head at last 2 posts.

You see what the rest of us have to put up with around here!? :p
dELTA
03-25-2004, 08:49 PM
Yeah, about that policy, I've been wondering who the hell came up with that?! :p At least I guess I can't be blamed for it, since it's policy not to give me credit for anything. :D Hmm, or come to think about it, maybe there was some subclause about it being fully legal to give me the blame for things, (even those I really wasn't responsible for), as long as it isn't anything positive? ;)

And Kayaker, what the hell do you mean with the last two posts, huh?!? :D
JMI
03-25-2004, 09:15 PM
Obviously, he meant yours and his. :D Naturally, he couldn't have been talking about mine. :eek:

And we have given you "credit". Didn't I loan you the money to go to the movies and get a bag of popcorn, or was that some other kid??? ;)

Regards,
esther
03-25-2004, 11:03 PM
"The big red letters" are originated by me :).I'm the one which start to flame ppl using big red letters.Credit? nah I just want you admins put money in ma bank every month.Please do so :rolleyes:
JMI
03-26-2004, 12:56 AM
Sure thing. Just give us the account number and the access code and we'll comply. :D

And a search for "big red letters" suggests that the first reference was dELTA's use of it in this thread on Feb. 6th, 2004:

http://66.98.132.48/forum/showthread.php?t=5480

And I used it a short while later in this thread:

http://66.98.132.48/forum/showthread.php?t=5481

The "BIG RED LETTERS" appears to have been initiated by me in this thread on Feb. 15th, 2004:

http://66.98.132.48/forum/showthread.php?t=5520

Regards,
evaluator
03-26-2004, 10:56 AM
i'm with esther:)

you, dirti ones, removed esther's great job!

**
keep fight!
JMI
03-26-2004, 12:29 PM
Sorry esther:

But you appear to be talking about using "big red letters" to flame someone and we were talking about telling someone to "read the BIG RED LETTERS" at the top of the Forum, which tell them to search before asking a question. These are not the same subject. :cool:

Regards,
esther
03-26-2004, 09:45 PM
>But you appear to be talking about using "big red letters" to flame someone and we were talking about telling someone to "read the BIG RED LETTERS" at the top of the Forum, which tell them to search before asking a question.

Well most of my post are deleted for 2 reasons

I have deleted it.

Admins have deleted it.

Flames that telling ppl to read the faq and searching the web.

>These are not the same subject

It is the same subject!!!,different ways to put in :cool:
Woodmann
03-26-2004, 10:22 PM
:p


Process Environment Block
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Process Environment Block
PDA

View Full Version : Process Environment Block

LibX
03-26-2004, 04:32 AM
can some1 help me on a list with all functions for win98 i found them for Win2K/XP and also 2003 but i can't find the list for Win98 :(

regardes
LibX

PS: http://www.annie.ro/fs.txt <-- this i what i mean sorry for the bad english :)
Kayaker
03-26-2004, 01:20 PM
Hi

You might find a comparable structure here, there are quite a few Win95 structures at least. I'm not sure if there was a direct counterpart for the PEB for Win98, some of the info might have been held in the PDB or elsewhere, or simply didn't exist. If you find otherwise, please report.

http://mitglied.lycos.de/pepage/

Kayaker
LibX
03-29-2004, 12:50 AM
Thx also usefull ;)
But i still need the compleet list.
anyone?


CreateRemoteThread and VB apps!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > CreateRemoteThread and VB apps!
PDA

View Full Version : CreateRemoteThread and VB apps!

Nad_Af
03-27-2004, 12:23 AM
I have tried to create a remote thread for a Visual Basic app. but when a part of the remote thread function executes the app crashes or terminates abnormally. The remote function is very simple; it just contains a MsgBox statement.
how to create threads for VB applications?
disavowed
03-27-2004, 10:36 AM
this has nothing to do with Advanced reversing and programming

and use google
dELTA
03-27-2004, 11:25 AM
Well, I guess it might have something to do with programming after all, even though the "advanced" aspect could possibly be discussed. ;)

And Nad_Af, you really need to provide more details than that if you want any useful help.
disavowed
03-27-2004, 12:36 PM
sorry, i had always interpretted it as:
advanced (reversing and programming)

as opposed to:
(advanced reversing) or (advanced programming)
dELTA
03-27-2004, 12:49 PM
Nah, pure programming questions are allowed too, it's a nice way to make available the great resources of advanced low-level knowledge that people possess around here.

Of course the same rules apply as for the rest of the forum though. Provide as many background details as possible, and make reasonably advanced questions that are not based on pure lazyness. Questions somehow related to reversing matters are of course preferable (I guess thread injection could count as one of those), but others are ok to.


Macrovision's "Hacker University" at E3...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Macrovision's "Hacker University" at E3...
PDA

View Full Version : Macrovision's "Hacker University" at E3...

disavowed
03-27-2004, 10:41 AM
"Macrovision's 'Hacker University' at E3 to Preview World's Most Robust Copy Protection Technology for Gaming Industry":

http://www.macrovision.com/company/news/press/newsdetail.jsp?id=Thu%20Mar%2025%2012:23:56%20PST%202004
r4g3
03-27-2004, 11:06 AM
... a product of sales departament of macrovision. do you see anything else here ?
disavowed
03-27-2004, 12:37 PM
nope, hence the posting in off-topic :)
sporter
04-11-2004, 03:16 AM
ccctournament
http://salisburypost.townnews.com/articles/2003/10/07/sports/07-area_schedule.txt
sporter
04-11-2004, 03:18 AM
the correct ccctournament URL is
http://salisburypost.townnews.com/articles/2003/10/07/sports/07-area_schedule.txt
dELTA
04-12-2004, 12:39 PM
Wtf?
disavowed
04-12-2004, 10:00 PM
yes, wtf indeed. i didn't reply to this earlier today because i was so confounded. but now that i see i'm not the only one, i might as well confirm the wtf'ness
Kayaker
04-12-2004, 11:50 PM
What's to wtf? If you're in Rowan County, North Carolina this coming Wednesday, check out the awesome Salisbury high school tennis team whip Lexington's ass in the CCC Tournament. GOOOO Salisbury!

C'mon, it's perfectly logical guys (they have good drugs at Salisbury apparently...)

:p
Aquatic
04-13-2004, 01:49 AM
again, wtf?
Woodmann
04-13-2004, 03:47 PM
Ummmmmmmmmmm........

It reminds me of a chess game :eek:

-OBC-
dELTA
04-13-2004, 04:43 PM
Hehe, I thought just the same Wood. :) Can't seem to find any connection though.


BreakPoints with SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > BreakPoints with SI
PDA

View Full Version : BreakPoints with SI

Illmasz
03-27-2004, 03:43 PM
Hello All,

I have only just registered and have come across this great forum and thought I would seek some help. Yes, this has to do with Softice and Windows XP but hasn't got anything to do mainly with not able to run it. I have downloaded SoftIce v.4.05 for NT and XP (runnin XP) and have encountered a strange problem. I am doing a newbie tutorial where I have to use softice and use a breakpoint such as "bpx getsystemtime" and then run the application. In the tutorial it states that once I used the breakpoint and then run the application, Softice should pop-up. I have had no success in making softice pop-up even when trying other tutorials, with other application to crack and using other breakpoints. Any idea if this is an issue with Softice and Windows XP? Also, I am thinking of getting into reverse engineering seriously and was thinking of downgrading my Operating system back to Windows 98 for the sake of simplicity when using Softice Ice, would you recommend this? Thank you for your attention and hopefully some help :)

Illmasz
klier
03-27-2004, 04:27 PM
I will help.(because i'm new to) :)

Inhale red. Say, out loud or silently: "read the faq!" Blow out any remaining air as though you were blowing out a candle. Pause. Breathe in red and say again: "read the faq!" Blow. Pause. Inhale. "read the faq!"

Blow, pause, inhale, and say, in big red letters: "search before posting!" Blow. Pause. Inhale. "search before posting!" Blow. Pause. Inhale. "search before posting!."

Exhale forcibly. Pause in the emptiness. Inhale red. Say, with passion: "READ THE FAQ AND SEARCH BEFORE POSTING!." Again: blow, pause, inhale, and say: "READ THE FAQ AND SEARCH BEFORE POSTING!." Blow. Pause. Inhale. And with intensity say: "READ THE FAQ AND SEARCH BEFORE POSTING!."

Exhale strongly. Make a noise. Pause. Inhale bright red and say or yell: "READ" Exhale loudly. Pause. Inhale red; say/yell: "THE" Again, exhale with a noise, pause, inhale red. Say/yell: "FAQ!" (You can put a pillow or towel on your face and yell into it.)

adaptation of...
Kundalini Meditation
By: Susun S. Weed

do a search in this forum for winxp and softice,you'll find alot.
no need for downgrading,may be consider ollydbg(search again). ;)
Illmasz
03-27-2004, 04:33 PM
Haha,

Alright, well thanks for the help I suppose :) I checked out the FAQ but didn't find a lot about this issue, probably because I just scanned through it and searched for keywords,heh. I got Olly as well but no idea how to use that. It seems that there aren't many tutorials around for this program unless, I am probably wrong. Thank you.

Illmasz
klier
03-27-2004, 04:44 PM
ollydbg forum:

http://ollydbg.win32asmcommunity.net/index.php?

Regards,
naides
03-27-2004, 04:45 PM
I will help.(because i'm new to) :)

Inhale red. Say, out loud or silently: "read the faq!" Blow out any remaining air as though you were blowing out a candle. Pause. Breathe in red and say again: "read the faq!" Blow. Pause. Inhale. "read the faq!"

Blow, pause, inhale, and say, in big red letters: "search before posting!" Blow. Pause. Inhale. "search before posting!" Blow. Pause. Inhale. "search before posting!."

Exhale forcibly. Pause in the emptiness. Inhale red. Say, with passion: "READ THE FAQ AND SEARCH BEFORE POSTING!." Again: blow, pause, inhale, and say: "READ THE FAQ AND SEARCH BEFORE POSTING!." Blow. Pause. Inhale. And with intensity say: "READ THE FAQ AND SEARCH BEFORE POSTING!."

Exhale strongly. Make a noise. Pause. Inhale bright red and say or yell: "READ" Exhale loudly. Pause. Inhale red; say/yell: "THE" Again, exhale with a noise, pause, inhale red. Say/yell: "FAQ!" (You can put a pillow or towel on your face and yell into it.)

adaptation of...
Kundalini Meditation
By: Susun S. Weed

do a search in this forum for winxp and softice,you'll find alot.
no need for downgrading,may be consider ollydbg(search again). ;)

creative, quite creative . . .
Aimless
03-28-2004, 10:58 PM
1. v4.0.5 is no longer stable on WinXP. DS 3 is the way to go

2. You need to be in the correct context to break the point

3. What API you think the program is using, it may actually not be using.

4. Generally not a good idea to scrap a program because you cannot work it out. Crank up the brain cells and get that damned ice working. Show it whos the boss!

5. Softice is softice. Ollydbg is Ollydbg. When it comes to bare-metal bones, nothing beats ICE. Might be worth your time and effort to learn a couple of things of ICE. May I sugges a complete week off from cracking and simply sitting with the SoftICE manual?

Have Phun
Illmasz
03-29-2004, 11:12 AM
Ok. I will try to use a DS 3 and see how it goes. I have heard great things about Softice and want to use it over Olly but also thinking to use Windows 98 instead of XP for reversing since I have read that some breakpoints cant be used in XP because it is using NT technology. How will this effect cracking? Thanks for the much help guys.

Illmasz


Revirgin and BSOD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Revirgin and BSOD
PDA

View Full Version : Revirgin and BSOD

cps530
03-27-2004, 06:36 PM
I am having problems with my pc (windows xp professional): freezes during boot, blue screen of death and so on. I can't understand why, but it seems to me the problem began after installing REVIRGIN. After installing REVIRGIN on my lap top (working beautifully!), the same problem: BSOD. Does anyone know about REVIRGIN and this kind of error? Thanks
esther
03-27-2004, 09:49 PM
Most of the problems comes from your hardware,check your rams.I'm not sure of winpx it works well in win2k
evaluator
03-28-2004, 02:56 AM
if your problems come after installing REVIRGIN, then Uninstall it & see what will happens.

all is so easy if you will try think
cps530
03-28-2004, 09:34 AM
The problem my dear evaluator is that the BSOF appears when I am not using REVIRGIN. So, it would be posible REVIRGIN damaged my system? that's the question. Think my friend. As simple as that.
esther
03-28-2004, 10:23 AM
>So, it would be posible REVIRGIN damaged my system?
>that's the question. Think my friend. As simple as that.

Coz you think too much.Your brain is fucked .Eva has given you the tip.if you don't know how rtfm.
Kayaker
03-28-2004, 12:38 PM
So, it would be posible REVIRGIN damaged my system?

After installing only, or after using? Installing should do nothing unless the msi installer overwrote something critical. And if you uninstall? Reboot to last known good configuration? Safe mode?

If after having been used on a target... there have been complaints of this, though 99% of people have had no problems.
SpeKKeL
03-28-2004, 01:06 PM
Revirgin...,

Maybe your clock is internally forwarded?

Didn't you know about the 4-4-2004 virus inside revirgin? then she becomes

again a virgin whith the blue screen of death... :eek:

Happy enough i've uninstalled the bitch..

SpeKK.
esther
03-28-2004, 08:08 PM
Spekk,
Where can I download this revirgin?I want to test her virginess :)
Please PM?

Kayaker:

I don't understand these ppl anyway,they always complans abt tools but didn't check their hardware and os.Aren't they reverse engineerers!?!
crUsAdEr
03-28-2004, 10:20 PM
Esther, not everyone start off an expert :), give newcommer a chance will ya :)
esther
03-28-2004, 10:35 PM
crUsAdEr,

:) Its a kind of attitude they should have,check all before complain.Of coz it might not rebuilt newer packers and encryptors since its not updated anymore.

expert or not is the reason ;)

Regards
Aimless
03-28-2004, 10:53 PM
...that maybe someone is trying too hard to be "Arrogant Bastard".

Maybe we need to soften our responses? Sure that most are not so busy that they are often indunated with newbie calls and get irritated?

Let us do ourselves a favour and keep the newbie bashing to a minimum.

Sure, he didn't read the FM, but we can atleast point out nicely?

Flame on!

Have Phun
esther
03-28-2004, 11:49 PM
>Maybe we need to soften our responses? Sure that most are not so busy that they are often indunated with newbie calls and get irritated?

>Let us do ourselves a favour and keep the newbie bashing to a minimum.

>Sure, he didn't read the FM, but we can atleast point out nicely?

>Flame on!

Thats what you will get this when you are soft....
http://www.woodmann.net/forum/showthread.php?t=5617&page=4&pp=15

welll your title tells all :D


Common ASM instructions explained (from MSJ Under The Hood)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Common ASM instructions explained (from MSJ Under The Hood)
PDA

View Full Version : Common ASM instructions explained (from MSJ Under The Hood)

0rp
03-28-2004, 04:01 PM
common asm snippets explained

http://www.microsoft.com/msj/0298/hood0298.aspx
http://www.microsoft.com/msj/0698/hood0698.aspx
Kayaker
03-28-2004, 06:30 PM
Thanks for the nice articles. I changed the title to make it more descriptive.

Kayaker
WaxfordSqueers
04-06-2004, 06:05 PM
common asm snippets explained

http://www.microsoft.com/msj/0298/hood0298.aspx
http://www.microsoft.com/msj/0698/hood0698.aspx

Haven't posted here before...sorry if I mess up.

Did anyone notice who wrote the articles above? None other than Matt Pietrek, the guy who wrote the reverse engineering bible. I read his book, Windows 95 Programming Secrets, long before I'd heard of Fravia. Anyone who hasn't heard of this work of art needs to read it.

BTW..good to see you're still around Kayaker. Your insights have helped me over the years...thanks.
dELTA
04-06-2004, 10:42 PM
If you're a big fan of Matt Pietrek, you might want to check out his website too:

http://www.wheaty.net/

:)
WaxfordSqueers
04-06-2004, 11:53 PM
If you're a big fan of Matt Pietrek, you might want to check out his website too:

http://www.wheaty.net/

:)

Thanks. I've contacted Matt a couple of times over the years. He's a nice guy. I was really impressed initially with his chapter on 'spelunking'...his way of poking around in the Window's code. He, of course, developed Boundschecker for NuMega.

I've never gotten deeply into it, however, being a bit beyond a beginner and not quite intermediate. He's light years ahead me. From reading Matts books, I can actually follow Kayaker and other guys when they go off into Ring 0 code. But I'm not good enough to apply it due to a lack of hands on. I'm kind of an armchair reverser. :-)

On Matt's site, he mentions his interest in rock...heavier bands like Guns and Roses. I'm a musician myself, so I kind of relate to that. That's why I dropped out of the reversing arena...I was spending all my time doing it and ignoring the music. :-) Every once in a while, though, I fire up IDA and spelunk through some code to see if I can spot some of the easier reverses.

I'm sifting through the threads in this forum and finding them very interesting. There are some pretty smart people posting in here and things have come quite a way since the old +Orc material. I remember when dongles were first conquered and it amuses me to see how brilliantly people rise to the occasion to reverse the most difficult of software.


I found a Cplus ver B dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > I found a Cplus ver B dongle
PDA

View Full Version : I found a Cplus ver B dongle

Konstantin
03-28-2004, 10:30 PM
Hello everybody.
In a flea market I found a Sentinel-Cplus Version B dongle.
It has a lable witch reads "Intertel Serie: IT0148XXX"

I am no dongle afficionado and I know nothing about dongles.
I have one question though, is it possible to reprogram a dongle to use it with some software wich requires a dongle to run?

I have read something on the net about protection hardware and used "sread1" program to dump the memory map (actually I have no Idea what does it means), so If anyone is interested in the dump file I have it attached, only detail I put .txt ext so the forum could accept the attachment.

If anyone would want this dongle I could send it to you.

Konstantin.
evaluator
03-29-2004, 01:13 AM
can you also send some money?
or icecream at least..
Konstantin
03-29-2004, 07:23 AM
can you also send some money?
or icecream at least..

/*good guy mode ON
/*DCC evaluator BigBucs
/*DCC evaluator Ice Cream
/*good guy mode OFF
/*requesting evaluator to focus on the thread instead of his wild dreams

Konstantin
esther
03-29-2004, 08:55 AM
/*google.com mode ON
/*search found Woodmann.net
/*Woodmann.net mode ON
/*search found http://www.woodmann.net/crackz/index.html
/*Woodmann.net mode OFF
/*requesting Konstantin to read the tutorials link shown above rather than telling evaluator to read your thread.
CluelessNoob
03-29-2004, 12:13 PM
can you also send some money?
or icecream at least..

Eval,

If you are offering to work for ice cream I have several gallons of Chunky Monkey for you.

Unfortunately, they are wrapped with Dillo, so you would have to get them out before you could enjoy them.

:D
evlncrn8
03-29-2004, 01:09 PM
Unfortunately, they are wrapped with Dillo, so you would have to get them out before you could enjoy them.

crunchy on the outside, soft and creamy on the inside eh? ;)
CluelessNoob
03-29-2004, 07:40 PM
crunchy on the outside, soft and creamy on the inside eh? ;)

Yummm. I see you've enjoyed the treat as well.
Konstantin
03-29-2004, 07:53 PM
esther you are insane

I am in no way going to spend no mo time on this dongle, so if anyone is interesting in da dongle drop me a pm.

Konstantin
evaluator
03-30-2004, 01:42 AM
CluelessNoob, ye, thanks for fun.

one additional Q:
what is common cost of "several gallons of Chunky Monkey" you have?
Konstantin
03-30-2004, 07:20 AM
CluelessNoob, ye, thanks for fun.

one additional Q:
what is common cost of "several gallons of Chunky Monkey" you have?

It seems to me that you are enjoing this "creamy thing" thread.
Go get kinky on another threa cuz this is mine!

Konstantin
CluelessNoob
03-30-2004, 09:01 AM
CluelessNoob, ye, thanks for fun.

one additional Q:
what is common cost of "several gallons of Chunky Monkey" you have?

Hmmm. The wife usually does the shopping :cool: but I think its about $3 - $4 per quart, which makes it $12 - $16 per gallon.

Depending on how hungry you are it could get quite costly. :D
Woodmann
03-30-2004, 02:20 PM
Regular price $3.59 per quart
Sale price $2.99 per quart

As for a used dongle. I dont think it has much value.
There is some place that can make you what ever you
need for short money. I dont recall the name and I am
too lazy to search for it :cool:

Woodmann
evaluator
03-30-2004, 02:31 PM
sit, i assumed, "gallon" means at least 10L & CluelessNoob is enough rich..
sorrie.

now i can imagine,
when CluelessNoob last time asked his wife about buying prog,
how "several gallons of Chunky Monkey" easily could start to fly..
CluelessNoob
03-30-2004, 11:03 PM
sit, i assumed, "gallon" means at least 10L & CluelessNoob is enough rich..
sorrie.

now i can imagine,
when CluelessNoob last time asked his wife about buying prog,
how "several gallons of Chunky Monkey" easily could start to fly..

rotflmao

The wife does not buy software, just food. I will have to have her talk to Woodmann about his local grocery stores, I feel we may be wasting money. I have three daughters (4, 0.75 and 0.75 years), so money is far from plentiful.

In all seriousness, I do have a Dillo target I am working on, but its not "for sale". Help yes, but I am finding new info every day for that... I have (I think) dumped it, but I am having problems rebuilding it... Most likely because it includes a protected DLL as part of the program.

I have been lurking for a while and could not pass up eval's "will work for food" comment. Sorry if my attempt at humor was percieived as a solicitation for cracking, that was not my intent.
evaluator
03-31-2004, 01:03 AM
yeh!

there was my failure in joke, i too much quickly read your post & phrase -
"The wife usually does the shopping" -
i interepreted as she is selling (instead of shopping); so on..

don't worry, your joke i interpreted exactly as joke.

send me in PM some story about that program & you;


Discovery reversing the kernel memory
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Discovery reversing the kernel memory
PDA

View Full Version : Discovery reversing the kernel memory

Opcode
03-29-2004, 05:26 AM
Hi, Reversers !

While reversing some structures in the XP kernel, I found a new
way to get some hidden variables without having to scan the
kernel.

Take a look at
hxxp://www.rootkit.com/vault/Opc0de/GetVarXP.pdf
and
hxxp://www.rootkit.com/vault/Opc0de/GetVariables.zip

Regards,
Opcode
dELTA
03-29-2004, 04:40 PM
Cool, thanks for the info. :cool:
Opcode
03-29-2004, 06:38 PM
I updated the article because I found an error :eek:

Instead of:

mov eax, 0ffdff034h
mov eax, [eax+078h]

The currect code is:

mov eax, 0ffdff034h
mov eax, [eax]
mov eax, [eax+078h]

Sorry.

Opcode


Can anyone help a beginner?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Can anyone help a beginner?
PDA

View Full Version : Can anyone help a beginner?

Opelix
03-29-2004, 07:00 AM
Ok.......... You guys have hear this question thousand times! But can anyone guide me where I should start collecting material about Sentinel SuperPro dongles? I have access to a program that is protected with this dongle, a "small" program (abuot 900 licenced users)
It works quite funny, once I have started the dongle it is possible to remove it, when trying to e.g. print or save it asks for the dongle......ok..... but when choosing the same option for the second time it is actually possible to print or save! The program cd content is actually many programs, but the dongle restricts not licensed programs. It would be really nice to start studying this program, but as I mentioned I need some help to get me going. So please can anyone guide me where I can find some information that a beginner can understand. I think think this would be a very interesting project for those who are well into dongle cracking.
dELTA
03-29-2004, 04:28 PM
If you are even yourself assuming that we already heard this question a thousand times before, searching the board would most likely be quite an excellent idea...
naides
03-29-2004, 08:11 PM
Ok.......... You guys have hear this question thousand times! But can anyone guide me where I should start collecting material about Sentinel SuperPro dongles? I have access to a program that is protected with this dongle, a "small" program (abuot 900 licenced users)
It works quite funny, once I have started the dongle it is possible to remove it, when trying to e.g. print or save it asks for the dongle......ok..... but when choosing the same option for the second time it is actually possible to print or save! The program cd content is actually many programs, but the dongle restricts not licensed programs. It would be really nice to start studying this program, but as I mentioned I need some help to get me going. So please can anyone guide me where I can find some information that a beginner can understand. I think think this would be a very interesting project for those who are well into dongle cracking.

Look down in this page, click the link to CrackZ site and you will get a nice introduction to Dongle reversing


Undocumented file format containg executable code ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Undocumented file format containg executable code ?
PDA

View Full Version : Undocumented file format containg executable code ?

Fritz[]
03-29-2004, 09:44 AM
Hello.
I've been cracking a Add-on for AutoCAD and I've found somethin' new, at least for me ...
Seems that 'code' is in .fas files ?
I've found similiar file at net so check :
- hxxp://www.autocutresearch.com/ftp/pnlmkr.vlx
anyway, almost at the end, there is string "fas4 crunch" and on beginning :Don't change it ...

How can i crack that protection or a more detailed question :
how can i disassemble that code and 'read with recognizable' functions ?

I'm stuck there...

Thx for help.
Fritz[]
03-29-2004, 09:51 AM
I found more informations on http://xarch.tu-graz.ac.at/autocad/news/faq/autolisp.html

saying : "FAS Security:
There was recently a lengthy discussion about FAS security at both newsgroups. Apparently FAS can be decompiled to readable source code, but this tool is not available on the net yet. Rumors say that MNC files can also be decompiled for years now but this doesn't exist the net either. Linked and dropped FAS/VLX (compiled with Optimized/Internal) is similar to Kelvination. Symbol names, strings and numbers are more insecure than algorithms."

seems it is protected ...
Dead_Loop
06-15-2004, 09:53 PM
']seems it is protected ...
...with a very simple XOR lastbyte with current byte algo.
Look at: hxxp://lisp-decompiler-project.cjb.net :D
There you will find a fas bytecode disassembler.
Now it's up to you do do the rest. :devil:


F3 in hiew
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > F3 in hiew
PDA

View Full Version : F3 in hiew

NaTn
03-29-2004, 02:05 PM
hey all,

when I try to edit (using F3) it keeps saying me something like "sharing violation (r)etry (a)bort" when I press retry, the same window pops up again,

now I tried different versions of hiew, and all were the same, so what am I doing wrong, and even with beginner CRACK-ME tuts I'm having this :s

plz help me
doug
03-29-2004, 03:09 PM
hey all,

when I try to edit (using F3) it keeps saying me something like "sharing violation (r)etry (a)bort" when I press retry, the same window pops up again,

now I tried different versions of hiew, and all were the same, so what am I doing wrong, and even with beginner CRACK-ME tuts I'm having this :s

plz help me

an easy guess: is your file read-only or in use in another application?
naides
03-29-2004, 03:30 PM
an easy guess: is your file read-only or in use in another application?
Typically your file is running, or is open by W32dsm.
Make a copy of the file with a different name: MyFileCRK.exe (which you should always do anyway, in case you screw up) and HIEW edit the copy, while you are working on the dissasembled file.
NaTn
03-30-2004, 05:36 AM
that was it, the file was open in w32dasm :s how stupid can you be *g* thx guyz
naides
03-30-2004, 06:12 AM
that was it, the file was open in w32dasm :s how stupid can you be *g* thx guyz

I can only speak for me, but I think we all have had that problem when we are learning to crack for the first few times. . .


Help, unpacking armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help, unpacking armadillo
PDA

View Full Version : Help, unpacking armadillo

MeNiA
03-30-2004, 06:13 AM
hi, I'm new here...
Now, my problom is in unpacking armadillo (PEID: Armadillo 3.00a - 3.61 -> Silicon Realms Toolworks), my main problom is I dont know where to start if I want to make an unpacker. I'm new to asm, I'm searching for tutorials to learn how to make unpacker (I've searched the forums but doesnt seem to match what I was looking for) and advices for tools to use.
Currently I'm using softice,ollydbg - I have softice but I have no idea what do I need to do with it. When it pops-up and all that... thanks.
crUsAdEr
03-30-2004, 07:15 AM
lol.. slowly... new to softice, asm yet u want make unpacker?
start by learning how to search...
MeNiA
03-30-2004, 08:15 AM
I've told you, I found some but not those who matches my search. not to the keywords or something, I mean that matches to what I was looking for.
Making the unpacker is a later level, can you add a link if you've got or write little tutorial (realy little) for softice. Lets say I started softice's service, now, I opened a packed executeable,then loaded it, got a message "error while unpacking the program, code 2, ...."
...
any advices? i wanna take the pdf lesson thats included with it but... i formatted my comp a while ago and i dont have any compilers aviliable..
i need the gdidemo.exe i guess...
esther
03-30-2004, 09:14 AM
Are you a beginner or newbie or advanced?
MeNiA
03-30-2004, 11:50 AM
Are you a beginner or newbie or advanced?
i worked with asm but im not as unpacking, only by making hacks for games (which those hacks codes i did not make - only modified to suitable other vers). so i'll say i got 10% asm lol. then im a beginner, send your help and we'll see. plz tell me how to use softice.
esther
03-30-2004, 07:47 PM
>so i'll say i got 10% asm lol. then im a beginner,

You need at least 50% of asm.
>send your help and we'll see. plz tell me how to use softice

There are trillions in krobar's site.There's a bottom link down there

You MUST TRY UNPACKED SIMPLE PACKERS FIRST,LEARN TO CRAWL FIRST

BEFORE YOU STAND UP AND WALK!!!
Pumqara
04-01-2004, 11:49 PM
I think that you should start with FSG.It is a very easy packer (even not a protector though)
%UNDEFINED%
04-03-2004, 10:31 AM
Rather than start a new thread, I thought I would ask my question here.

I wrote out what I have done so far, check it out and tell me what you think


VB P-Code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VB P-Code
PDA

View Full Version : VB P-Code

Spencer
03-30-2004, 03:31 PM
Hi Guys,

I found a little and interesting app on the web. I suspect the possibility of this utility being a hoax and I would like to ear an opinion.

Let me explain :

First of all this app is protected by a packer named ExeStealth that I have already unpacked and have presented me with a VB P-Code exe :).

0040104C > $ 68 C8954000 PUSH Xxxxxxx.004095C8
00401051 . E8 EEFFFFFF CALL <JMP.&MSVBVM60.#100>

it jumps to MSVBVM60.dll and the only call to the app code is to do this:

0040A91C . B8 4C000000 MOV EAX,4C
0040A921 . 66:3D 33C0 CMP AX,0C033
0040A925 . BA B0AB4000 MOV EDX,Xxxxxxx.0040ABB0
0040A92A . 68 3E104000 PUSH <JMP.&MSVBVM60.MethCallEngine>
0040A92F . C3 RETN

and return to the VB library and call the the app again for Form Load procedure. Ok I have decompiled the target and this is what I take:

[Form]
Private Sub Form_Load()
'-=-=-=-=-=-=-= ProcAddr Range: [0040AB74 - 0040ABB0] , ProcSize: 3C =-=-=-=-=-=-=-
0040AB74: 27 08 FF LitVar_Missing PushVarError 80020004 (missing) VT_ERROR signifies an optional argument that is missing
0040AB77: 27 28 FF LitVar_Missing PushVarError 80020004 (missing) VT_ERROR signifies an optional argument that is missing

*********** Referent String: "WARNING UNAUTHORIZED! Dongle not found." ***********
|
0040AB7A: 3A 58 FF 00 00 LitVarStr PushVarString Ptr_00409C48

0040AB7F: 4E 48 FF FStVarCopyObj [local_B8]=vbaVarDup(Pop)
0040AB82: 04 48 FF FLdRfVar Push local_B8
0040AB85: F5 10 00 00 00 LitI4: Push 00000010
0040AB8A: 1B 01 00 LitStr: Push Ptr_00409B58
0040AB8D: 1B 02 00 LitStr: Push Ptr_00409BB8
0040AB90: 2A ConcatStr vbaStrCat
0040AB91: 23 78 FF FStStrNoPop SysFreeString [local_88]; [local_88]=[stack]
0040AB94: 1B 03 00 LitStr: Push Ptr_00409BC4
0040AB97: 2A ConcatStr vbaStrCat
0040AB98: 46 68 FF CVarStr
0040AB9B: 0A 04 00 14 00 ImpAdCallFPR4 Call Ptr_00401020; check stack 0014 (no return value)
0040ABA0: 2F 78 FF FFree1Str SysFreeString [local_88]; [local_88]=0
0040ABA3: 36 08 00 68 FF 48 FFreeVar Free 0008 variants : 68 FF 48 FF 28 FF 08 FF
FF 28 FF 08 FF
0040ABAE: 13 ExitProcHresult
0040ABAF: 00 A4 LargeBos IDE beginning of line with A4 byte codes

Now what do you think it is a hoax or not ?

Rgds

Spencer
sarge
03-30-2004, 04:50 PM
Do you think WHAT is a hoax...your question is not clear.

First, you start out describing an "app", which you apparently have to unpack. Then you say that (something?) presented you with a "VB P-Code exe". Do you mean that, when the app was unpacked, you discovered it was a VB program, compiled to PCode?

Now, you say you decompiled the "target". Do you mean you decompiled the VB program you just unpacked? Or did you use the program you just unpacked to decompile some other target program? Or maybe you used it to decompile itself?

Finally, what part of this operation do you think might be the hoax? If you mean does your data dump look like real, viable P-Code, well, yes it does.

The datadump format you have shown is very reminisicent of one of the PCode decompilers I have seem from (I think) China, although I have to look that up. Why not try one of the other PCode dumpers and compared the outputs?

Sarge
Woodmann
03-30-2004, 06:35 PM
:cool:
disavowed
03-31-2004, 06:03 AM
would you mind telling us which program you used to produce that pcode output? sarge, i know you're a pcode guru too.. mind posting the name of that chinese dumper once you find it?
Spencer
03-31-2004, 12:40 PM
Do you think WHAT is a hoax...your question is not clear.

First, you start out describing an "app", which you apparently have to unpack. Then you say that (something?) presented you with a "VB P-Code exe". Do you mean that, when the app was unpacked, you discovered it was a VB program, compiled to PCode?

Now, you say you decompiled the "target". Do you mean you decompiled the VB program you just unpacked? Or did you use the program you just unpacked to decompile some other target program? Or maybe you used it to decompile itself?

Finally, what part of this operation do you think might be the hoax? If you mean does your data dump look like real, viable P-Code, well, yes it does.

The datadump format you have shown is very reminisicent of one of the PCode decompilers I have seem from (I think) China, although I have to look that up. Why not try one of the other PCode dumpers and compared the outputs?

Sarge

Hi

1 - yes. after unpacked discovered that was a VB prog compiled to p-code.

2 - Decompiled the VB prog that just unpacked

3 - I mean that this is a prog that don't do anything. It only present us with this error message for 20 times on every textbox, label, button or option box. yes it was decompiled with VBParser. ExDec give an error when try to load. P-Code Loader 4.2 works fine but as explain after loaded it stops on Form Load routine.

Now I used SI, Ollydbg and nothing!!!! It seams that the prog loads de VB library and only go out to the the Form Load routine. The author use the same routine error for about 20 times as I said for any mouse click on Text Box, Command Buttons, Label’s and Options Box’s.

If you want I will send the file by e-mail for your analyses. Only see this prog you understand what I mean. It have 0,97 mb zip compressed.

rgds

Spencer
sarge
04-01-2004, 07:02 AM
1.
I can be reached at sargeant_g@hotmail.com.

2.
No problem on the China stuff, if I can find it. I'll take a look this weekend. As I said, it looks very familiar...it may be that VBParser is it.

3. There are a few other analyzers you might try for VB:
a. VBRezQ
b. VBReformer
c. WKTDebugger
d. VBEditor
e. RACEVB6

Sarge
Spencer
04-02-2004, 02:43 AM
Hi,

Thnks for yr reply.

i will try the tools mentioned. I allready have the WKTDebugger - Loader 4.2. It works but don't accept any BPX on any address only stop on the begin of Form Load routine.

Target sent by email and your opinion about it will be very, very apreciated.

Thnks again

Spencer
sarge
04-06-2004, 05:13 AM
Disavowed:
I have found a cryptic note to myself referencing the "Chinese" program I mentioned. It has only an email address and a sample decompiled code; the format of that decompiled code is similar to Spencers post, which is why I thought it looked familiar. I really believe I have further info here someplace, but I haven't found it yet. At any rate, you may wish to contact the author. The address I have is "?jtt@yeah.net"; the "?" is either an upper case "I" or a lower case "L"; they both look the same in print. (No joke here---it really is "yeah.net"). I'll keep looking to see if I can find the actual proggie.

Spencer:
Never had a problem with the WKT breakpoints. Since the prog stops on the FORMLOAD, that is certainly the SUM (StartUp Module) for your target. You can then single step, set breakpoints, etc, like any debugger.

Sarge
Spencer
04-06-2004, 03:09 PM
Hi Sarge,

I have sent you an email with this project. Sorry if haven´t received but you can find it at :

h**p://id-discussions.com/vbulletin/attachment.php?s=&postid=302176

This is packed with EXEStealth. You can find an unpack tool on te web at cobans site :

h**p://www.cobans.net/unstealth.php.

As i said the decompiled of this P-code was made with VBParser 1.2. You can find it at:
h**p://www.pediy.com/tools/Decompilers/VB_pcode/VBParser/VBParser1.2.zip

But i do not give my time with this project as a lost, because this was a very intersting way of contact with p-code and discovery very intersting tools to play with.

Wayting you opinions about this. For me, this a fake program with a fake protection.

Thnks again for your time and it is a pleasure to participate in this forum.

Tgds

Spencer
sarge
04-07-2004, 06:50 PM
Spencer:
I'll check it out as soon as I can

Disavowed:
I found the proggie. It's from the China Cracking Group. It's simply called VBparser. But it's 95percent in Chinese. Of course, it's available if you want it.

Sarge
sarge
04-17-2004, 11:18 AM
Spencer:
Finally got the progs dl'ed. Sorry it took so long, been ill lately.

Now, company is sending me out of town for a few days. So I don't think I'll get to actually look at the progs until next weekend. But I won't forget!

Sarge

--------------------------EDIT-----------------------------
I am unable to DL the x-factor zip file properly...I always get an invalid file error. I'm using Win XP. Any ideas?

S
Spencer
04-18-2004, 04:44 PM
Spencer:
Finally got the progs dl'ed. Sorry it took so long, been ill lately.

Now, company is sending me out of town for a few days. So I don't think I'll get to actually look at the progs until next weekend. But I won't forget!

Sarge

--------------------------EDIT-----------------------------
I am unable to DL the x-factor zip file properly...I always get an invalid file error. I'm using Win XP. Any ideas?

S

Hi Sarge,

Take your time, no problem :)

No problem with XP. It's probably some file demage when sent by e-mail.

pls chk my last post where you have all the links for down the app, the unpacker and the decompiler that i used.

rgds

Spencer
sarge
04-21-2004, 03:49 PM
That's my point....the DL didn't work..twice

Sarge
Spencer
04-23-2004, 04:05 PM
That's my point....the DL didn't work..twice

Sarge

Hi Sarge,

I hv try to send an email with de x-factor but it was returned.

pls confirm you email to spencer@faston.cjb.net

Thnks n rgds

Spencer
sarge
04-23-2004, 06:53 PM
Done!

Sarge


Unofficial Driverstudio FAQ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Unofficial Driverstudio FAQ?
PDA

View Full Version : Unofficial Driverstudio FAQ?

Snatch
03-30-2004, 03:33 PM
Why not? Instead of all the useless messages on this forum that all say "learn to search" why not just paste a link to a FAQ that has all the information.

This board is unorganized, cluttered and random. That is not a bad thing! But for people getting started it is. A noise free version thats some sort of FAQ that discusses all the standard usual Softice configuration issues and the ADDR/context issues would solve this. It would be more organized and easier to read and understand. Basically I am saying someone should take the time to take all the fragments here and organize them coherently. Searching is always good but there are some basics that keep coming up here over and over and a new thread is gained but no new information. I dont have much time for reverse engineering these days I just feel this might be an alternate strategy to help people getting started to resolve these practical issues. Who has the time and wants to spend the time doing so would provide a valuable resource to everyone and greatly simplify and organize and get rid of noise. Other topics fall under this category also. The board should be used for the out of the ordinary situations or new ground that hasnt been explored which is what in many cases it is used for(which is why its such a wonderful board and I still browse it).

Just my thoughts! Glad to see a lot of people are still here :). Oh ya, I will be back.

Snatch
naides
03-30-2004, 03:49 PM
Why not? Instead of all the useless messages on this forum that all say "learn to search" why not just paste a link to a FAQ that has all the information.

This board is unorganized, cluttered and random. That is not a bad thing! But for people getting started it is. A noise free version thats some sort of FAQ that discusses all the standard usual Softice configuration issues and the ADDR/context issues would solve this. It would be more organized and easier to read and understand. Basically I am saying someone should take the time to take all the fragments here and organize them coherently. Searching is always good but there are some basics that keep coming up here over and over and a new thread is gained but no new information. I dont have much time for reverse engineering these days I just feel this might be an alternate strategy to help people getting started to resolve these practical issues. Who has the time and wants to spend the time doing so would provide a valuable resource to everyone and greatly simplify and organize and get rid of noise. Other topics fall under this category also. The board should be used for the out of the ordinary situations or new ground that hasnt been explored which is what in many cases it is used for(which is why its such a wonderful board and I still browse it).

Just my thoughts! Glad to see a lot of people are still here :). Oh ya, I will be back.

Snatch

I volunteer Santch and Me to do the job, How do you like it?
Kayaker
03-30-2004, 06:20 PM
I agree, but would it really reduce the noise? You'll still get people who will come along and say, not to isolate a recent post but - they've never used Softice before, but they want to build an Arma unloader, so how do you configure Sice, but in the meantime can you send me an Arma unloader? Sure, you could point them to a shiny new DS Faq, but would they really care or benefit?

So add a few stock items concerning Sice basics to a faq, Mammon's tales, Rhyader's bp doc, Crackz getting started guide, Tornado's notes, ADDR and XP considerations are already covered in the existing FAQ thanks to Zairon, whatever comes up from a few "Softice/DS" searches, etc. etc. Well, even if that was made available, it might help a few deserving newcomers who have actually made the effort to also read the official documentation but are stuck, and this would help them the most. Great, glad to help.

But, I think unless this 'unofficial' DS faq was complete with a very easy to use index of all the niggling details that would immediately answer their question, many would still ignore it, couldn't be bothered with the effort of searching through the pages of information, and would rather ask their question directly on the board for a quick answer. It appears to be human nature.

It is a good idea, and we've considered this and more before, but I don't know, it just seems a monumental task to effectively reduce the 'noise' level with yet another faq. I think as a newbie you tend to be overwhelmed with the amount of info you need to learn and the scope of the RCE thing. It's only after some time some people learn the patience and virtues of searching for their own answers, and recognizing when a question should be asked that deserves asking.

We all get tired of reading (and writing) the Seach and Big Red Letters replies, and what sometimes becomes mean spirited and flamebait threads. If there is an effective way of getting rid of them I'm all for it, in the meantime I'll vote for Naides directive :D

Cheers,
Kayaker
Woodmann
03-30-2004, 06:27 PM
Howdy,

I will be the last person to argue this ;)

Whoever is willing to undertake such a project,
SI, Arma, Flex, other debuggers et al;
You know, the topics that have been answered to death,
they/you willing be doing a GREAT service for the entire
RCE community to compile these into an easy to
read RCE type manual for each topic.

When you need a tut, where do you go-Krobar
When you need Dongle help where do you go - CrackZ

Who shall offer such help ?
I will do one topic, who else ?

Woodmann
ancev
03-30-2004, 07:54 PM
guys,

this will not reduce the number of silly requests and like.

beside that, searching by yourself is not only good for the board, but also for the 'personality' of newbie coders.

ancev
naides
03-30-2004, 09:44 PM
I am serious. It is not difficult to do, Actually cut and paste may acomplish more than 50% of the job. It can be updated every now and again when fundamental new issues occur.

Will it reduce the number of elementary questions? probably not, but Such is life, for a few genuinely dedicated newbies, it may be a useful resource, because the data will be compiled and referenced in a easier to search format.

Another idea: When you search the board, you only get hits among the postings. Is it possible, plausible and advisable to include the FAQ material in the search space, perhaps with high priority, so the FAQ answers are the first hits?


old DOS program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > old DOS program
PDA

View Full Version : old DOS program

bluetongue
03-30-2004, 09:16 PM
Hi,
I'm trying to learn with a very Old DOS programa that has a FLOPPY Protection, But it's amazing if I load the code in SICE I got the code with instructions that cahanges once that I star tu run the program, so if I change any change in the file on the HD next time when I load and run again the program the change it's not there, Looks like a Dummy Code or Hiden Code somewhere..
somebody with any clue?
Thanks
Bluetongue
naides
03-30-2004, 09:56 PM
A DOS program would be 16 bit code. When you run it in a Win32 OS, chances are the program is played in a Virtual machine. This issue may complicate debugging and cracking somewhat.

Old FLOPPY protections made heavy use of BIOS interrupt 13h. Learn about it and that may help you close on the protection routines.

Can you explain on different words or an example of the actual code what you say about the code changing? what you say is not clear.
bluetongue
03-30-2004, 10:06 PM
Thanks for your reply. But to get less problems with the debugging I install the Old DOS6.22 and I Install all the staff for DOS, the first thing that I read it was about the INT 13, but the thing is:
1) IF I Load the Program with S-ICE LDR and I start to dive into the code, comes with a lot of Instructions very strange so I started with BINT 13 so in that way I debuged the program and I printed out a lot of the code, but when I compare the code after my First Stop in the Break point with the code as soon I load with the LDR are totally diferent, looks like the program changes the code but itself. The only thing that I distinguish is a lot of Changing Vectors...
Do you think that I'm talking a lot of crap or it has some sense.?
Thanks
Blutongue
Aimless
03-30-2004, 10:50 PM
Perhaps this...

1. Trying to "debug" DOS applications (specially with protections based on Floppy/CD) is a nightmare under any system that is basically "NT" based. This means NT4, NT5, XP, ME and win2k and win2k3. It might be better to use a disassembler in this case. Try Sourcerer (better than IDA cos it ennumerates the Interrupts at the end and gives one shot call/callee for all calls that the program makes)

2. If you really want to "debug" only, you'll have to install Win98 or its variants. You can try a virtual machine manager such as Bochs or VMWare, but ice behave funnily with them. Your best bet is a fresh installation of Win98.

3. You also need Softice for DOS rather than softice for windows. Boot your PC in the DOS mode rather than running DOS after windows has started, will give you better results and remove the noise.

4. Try using the CE:EIP NOT <addr> command to filter out additional noise when breakpointing.

5. Try to understand low level floppy accesses. My hunch is that the int13 is not going to be used at all, but other interrupts. A text searchable format of Ralf Brown's may be useful.

6. You may also try to low-level copy all sectors from the floppy disk using good old debug.exe (as found in ORC tuts) and compare them to the changed ones once the program has run. SImply breakpoint over there and it should lead you to the routine that sets off the protection routine. You can take it from there.

Have Phun
bluetongue
03-30-2004, 11:03 PM
Thanks for your reply,
I'm agree with you about to try to debug a DOS program in Windows, so that's what I installed DOS 6.22 in my old 486, so I'm with the native OS for that program, I found all the instructions where the program makes a read for a especific sector in the floppy, the problem is that when I want to make the changes into the file, the next time that I load the program the code looks without the change, I doble checked with an HEX editor and the change it's in the file, but this is funny, If I load the Program with s-ice LDR option and I have a look to one of the instructions, this instructions changes as soon I start to run de program.
Funny Isn't it?
Thanks
Bluetongue
Aimless
03-31-2004, 12:57 AM
1. You may be dealing with Self Modifying Code over here. You may need to go to google and find out some basics about the SMC.

2. Your program may be storing its pristine instructions in either data/rsrc section, subsequently upon running some check (CRC, Checksum, etc) it may be overwriting the code portion of the file in memory with the correct instructions.

3. Some associated files may be recreating the entire program if they find that the same has been alterd (CRC, Checksume, etc)

4. Though softice detection for DOS programs was funnyily easy, it could still hold the answer to why the code is being modified in memory

5. Just ensure that the program does not keep backup copies of itself,which it restores on-the-fly.

6. If none of the above works, its time to get dirty: You can effectively do this:

a. Modify the file on the HDD/Floppy
b. You know the bytes you have modified. Put int 03 instructions for the beginning of the patch. Ask softice to break on int 03
c. Load the program in memory
d. See the breask
e. Find what breaks it. Use memory map to find out the process hitting the file.
f. You can find what it is that is actually modifying the file.

Have Phun
bluetongue
03-31-2004, 02:21 AM
Yes, what you just said it has more sense, I didn't know that some programs can be selfmodified in DOS, and I,m 100% sure that that'w whta happens, but there is no hiden files, Looks like at the end of the file there is a pice of data that the program reads itself.
Got any Idea how can I manage this?

Bluetongue
Aimless
03-31-2004, 03:19 AM
Basically this points out beginners to SMC.

http://www.eccentrix.com/members/mammon/Text/smc_apj.txt

Have Phun
PS: you may have to search virus sites on polymorphic code (samples can be searched specifically where the payload/code is in the data/rsrc sections)

let me know how it goes.
hobferret
03-31-2004, 03:52 AM
Hi :)

I may be wrong here but I have not played with DOS for about 10 years or more :D

Something in the deeper part of my single cell brain is telling me that some progs where you had an installation disk ( for copyright) marked a few sectors as BAD, then when it ran it removed the tag and the data it required was in those blocks marked as BAD. Like I said I may be wrong but it is years ago now :o

/hobferret
dELTA
03-31-2004, 10:57 AM
Didn't DOS Softice have memory access breakpoints? In that case, simply stop the program at the entry point, and put a memory write breakpoint at your patched instruction, then run. Now you should easily be able to see the code that modifies the patched location, and be able to backtrack from there, disabling the modification code or patching any possible CRC code that triggers it.
Woodmann
03-31-2004, 03:44 PM
Howdy,

I am unclear about some things.

The box is an old 486 with DOS and SI for DOS- No windows ?
Are you working from a copy of the original floppy or are you trying to modify the program on the floppy ?

Woodmann
bluetongue
03-31-2004, 07:18 PM
Looks like the original flopy it has a bad sector, Now I can Install te programa into C: drive but when I try to run the program It'comes with the error "COP'S COPYLOCK II BAD COPY" thats why I want to Crack it, if I try another disk the Program asks forever fgor the original disk, I founf with S-ICE the instruction, but Im new with this, and I cant find the instruction in the exe File coz it changes on the fly as soon you execute the program.
Thanks for the help
Bluetongue
bluetongue
03-31-2004, 07:20 PM
I forgot, my Box it's 486 with DOS 6.22 Loaded on it and S-Ice for DOS, I'm trying to reproduce all the original enviroment.
bluetongue
03-31-2004, 07:38 PM
I found this, can somebody explain it to me??

Cop's CopyLock II Standard for DOS
For the copy protection of DOS .EXE and .COM files. Files are locked to key diskettes. The key diskette is required each time the program is loaded, or once for each reboot. No special diskettes, hardware or code changes are required. All DOS diskette formats are supported. Unlimited number of protections. Highest diskette and code security. The protected files are encrypted and furnished with state-of-the-art debug-trapping. On the market since 1984
Woodmann
03-31-2004, 07:41 PM
Howdy,

I think that protection was to prevent the copying of the floppies
to the hard drive without the proper key. It is probably the same
for the installation.
It is not self modifying code, you need to stop the routine from looking for the key. This may be the reason why you cant make any changes. No key=no change. I think this may be an easy NOP job.

That is some old protection ;)

Do some Google work and see what you can find.

Woodmann
bluetongue
03-31-2004, 07:47 PM
But Just one question.
It says that The protected files are encrypted and furnished with state-of-the-art debug-trapping. Can you please tell me whats all this about? Just one thing it's clear to me, The code that I'm debbuging it's not the same that the one in the exe file.
I know this could be very easy for you, bot I just started with al this two weeks ago...
Thanks
Bluetongue
Woodmann
03-31-2004, 08:07 PM
Howdy,

Well, the problem is what WAS state of the art back then ?. It is difficult to recall things that are so old. I cant even remember what I had for lunch
yesterday :eek:

Encrypted....maybe. Anti-debug....maybe.

The anti-debug means it can detect SI or others and shut itself down.
This usually occurs instantly when you try to debug.
Since you can get it somewhat loaded means that the new tools are not recognized.

Have you tried to look at it in a hex viewer ?
I only ask because this is old and maybe you are trying new technologies that maybe dont return the results you desire.

Woodmann

I love the old shit ;)
bluetongue
03-31-2004, 08:14 PM
Well I'm new in all this and all the documents that I found are more related to SI, but all this tools are for DOS too I tried to found all the tools for that age. One of the things that I notice is that some disassemblers says that the file it's splited and even with SI if I type map looks like my program it's in two segments of the memory
Thanks
Woodmann
04-01-2004, 06:04 PM
Howdy,

I found this little tid-bit today:

Simple trickery. Format a diskette as single-sided, but then store the secret copy-protection information on a track formatted on the second side. DISKCOPY would read the boot sector, determine that the disk was single-sided, and only bother copying the first side.

User stupidity. The program would simply try writing a dummy file to the disk. Since most commercial software came on write-protected disks, the write would fail, and the program would continue. But if you'd just made a copy, chances were high that you'd forget to write-protect the disk when you were finished, and the write would succeed, which then aborted the program.
Secret hardware information. Most disk drives could actually seek beyond track 40; usually to 41. Some software companies formatted that extra track (DISKCOPY didn't go that high) and stored secret info in it for the program to check.

Wacko disk formats. This is when you go slightly beyond the obvious, like formatting a normal 9-sector track with 10 or 11 sectors (or less, like 4 or 5), or by writing an incorrect track ID (track 20 says its track 30, etc.), or something similar. DISKCOPY didn't know how to handle stuff outside the norm like this, so you usually needed a special program like CopyIIPC or CopyWrite to analyze the diskette thoroughly, then attempt to duplicate the format. This was about 66% successful; the other 33% you had to do yourself, usually (I personally used the Ultra Utilities). Electronic Arts had one of the best schemes in the early 80's; I couldn't figure it out until about 1985. They formatted track 15 with over 90 sectors! :-D
Weak Bits. Some bits on the disk were recorded as halfway between 1 and 0, which made the disk difficult to copy. This wasn't used too often because it was unreliable, even on the original disk!

Damage. The most expensive method of copy protection was also the most effective: Physically damage the disk. Using a laser, it was possible to burn a small hole in the disk surface, and then all the program had to do was check to see if there was a read error in that particular sector, and if so, continue running the program. If you turned the disk surface manually by grabbing the inside ring, you could actually see a tiny hole in the disk surface!

If it was so easy (relatively speaking) to figure out these formats, then why didn't everybody just write bitcopy or nibbler programs to analyze the diskette and make perfect copies of everything (except the laser hole, of course)? It wasn't quite that easy: While the IBM floppy controller could read all of these formats, it did not have the ability to write all of them. A third-party company (usually the diskette duplication facility itself) specially prepared the diskettes using custom floppy controllers. To this day I don't know if the read-all-but-not-write-all phenomenon was a decision made on purpose by IBM's engineers or just a hardware glitch that software companies took advantage of. (Probably a hardware glitch.) Either way, I eventually broke down in 1987 and bought a Copy ][ PC Option Board, which went between the floppy drive and controller, allowing me to write those special formats. Trivia: To this day, there is only one diskette I have never been able to duplicate, even with the help of my Option Board: A Cops Copylock ][ demo diskette that I sent away for (Cops was a third-party copy-protection library you could purchase to copy-protect your own programs). I never found any programs that actually used Cops as the copy protection scheme, which was fortunate, since I couldn't copy it. :-(

Woodmann
bluetongue
04-01-2004, 06:20 PM
Hi Mr Woodman,
That methot to duplicate the Disk it's very interesting, but the problem it's that I got the original Disk, and now the disk It's saying tha the copy it's a BAD COPY, this it's a different message that the one that you get with a non original disk, itn that case the program just asks for the original disk forever.
I found some information regarding this scheme, and I found a utility to remove it, but sisnce this software it was developet in 1998 I think that I need a very old computer tu run it.
Looks like I chose a very complicate target to learn about all this, but It's exicting anyway.
Look the attachment. I found this information that explains how the security patch it woprks, may be you can tell me how can I get rid off the pice of crap.
Thanks
Bluetongue
anormal
04-09-2004, 01:53 PM
hi all,

the protection you talk, Cop's CopyLock, is very easy to remove, forget about copying the disk exactly, it's much more easier to crack the app,

i've been doing research in old disk-copy protections for some moths ago, i am writing a very extense and technical paper about all these protections for my university degree, just for historic notes

i posted in this forum asking for help about disassembling and reversing the very old and very famous copywrite program, but all i got was my message been deleted, still wanting to know why

copywrite program stills has the most hardest and difficult dos shell crypter i've ever seen, and it's soooooo old (first protected version from 1984 !!!) forget about old protect, FFSE, SDW386, etc hehe, this is really weird

if you want to copy the disk, just ask, i have a very extense collection of old copy-protected disks collection (i have for example 24 versions of CopyIIPC and 13 versions of Copywrite)

best regards and good luck,
anormal
ps. you can p.m. if you want
dELTA
04-09-2004, 03:30 PM
anormal, is this paper of yours available online somewhere? Would you be willing to upload it here otherwise? It would be very interesting to read!
anormal
04-10-2004, 11:48 AM
[OFF TOPIC]

anormal, is this paper of yours available online somewhere? Would you be willing to upload it here otherwise? It would be very interesting to read!

this is off-topic here, take in account that i am only doing this study for documentantion and historic research, and of course i'll make it public, in this and other related forums, have you seen hxxp://www.caps-pr0ject.0rg/ ?

by now, i am studing (reversing) very old dos copiers, i have a nice collection, i plan to finish this job in a pair of months of so, if you want or need something just ask, if you know anyone that could help me with copywrite shell just let me know! ;)

thanks!
[/OFF TOPIC]

best regards!
bluetongue
04-10-2004, 06:27 PM
Hi Anormal,
Yes Im very interesting in get some clues in how this protection it works,I found just one tool that says that can remove the whole protection and uncrypt the program, but it doesn't work, all I know right know is that the propgram has been encrypted with a pice of the security code.
If you can ilustrate to me I'll be more tha happy.
Regards
Bluetongue
anormal
04-11-2004, 01:46 PM
just private message me, or post more info about your app,
my other experiencies with this protec. is that is easily patched ;)

regards!
Tramb
05-13-2004, 05:19 PM
Maybe you can try DosBox with a debug build, there's a debugger in it (though it's not softice :) ).
I don't have SoftICE for DOS so I can't tell if you can virtualize your PC by launching SoftICE and your app in DosBox but if it works, you have a DOS sand box (no reboots) and the possibility to tweak the VM source to do impossible stuff which can be very useful (setting bp on some hardware stuff and interrupts and so on)


keyboard problem with SoftICE on NT systems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > keyboard problem with SoftICE on NT systems
PDA

View Full Version : keyboard problem with SoftICE on NT systems

quasar
03-31-2004, 01:02 AM
After I have updated my hardware I have problem running SoftICE on my computer. Sometimes I got '6' and '2' when I press cursor keys or keyboard works like ctrl+alt was pressed down. My keyboard is a simple PS/2, and mainboard is EPOX 8rda3 with NForce 2 ULtra 400 chipset. I've tried SI 4.0.5, 4.2.7 and 4.3.1 on 2000, xp and 2003. SoftICE on 98SE works without problems. Do you know what is the reason?
bedrock
03-31-2004, 01:56 AM
In SoftIce configuration settings, try going to Trobleshooting and select 'Disable Num Lock and Caps Lock programming' you could also try 'Do Not patch keyboard driver' i needed these settings to get SI working properly on my sony laptop.

--
bedrock
quasar
03-31-2004, 02:13 AM
ehm, I've already tried obvious setting, but they didn't help. Maybe people at Numega will help me
JMI
03-31-2004, 02:22 AM
Only if you have a legitimate copy. :D

Regards,
quasar
03-31-2004, 02:40 AM
Only if you have a legitimate copy. :D

shit they want serial number, maybe one from tE!'s keygen will work ;p


link problem using MS Visual c++6.0 when useing Cryptlib
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > link problem using MS Visual c++6.0 when useing Cryptlib
PDA

View Full Version : link problem using MS Visual c++6.0 when useing Cryptlib

chengyou
03-31-2004, 02:28 AM
Hi,

I am a newbie. I try to use Cryptlib low level interface to run a demo using DES algorithm.

When I use MS Visual c++ 6.0 under Windows 2000 Pro to build this test.c file. This error occur:
cryptlib.h : fatal error LNK1136: invalid or corrupt file

Does any expert give me hint, thank you very very much in advance.

This is the test.c source code

#define INC_CHILD

#include <stdio.h>
#include <string.h>
#include <conio.h>
#include <string.h>

#include "crypt\des.h"
#include "cryptlib.h"

int main()

{
#define CRYPTLEN 128
#define BUFFERLENGTH (CRYPTLEN+64)
char CryptBuffer[BUFFERLENGTH];

int status;
int mode;
int ok1;
int i=0;

CRYPT_CONTEXT cryptContext;

// input crypt context buffer
printf("\nBitte eine Zeichenfolge eingeben:\nbis zu 32 Zeichen (256 Bit)\n\n>");

ok1=1;
while (((mode=getch()) != 13) && ok1==1)
{
putch(mode);
if (i < CRYPTLEN-1){
CryptBuffer[i++] = mode;
}
else{
printf("\nBuffer filled!");
ok1 = 0;
}
}

//last element to 0 for String with ending 0
CryptBuffer[i++] = 0;

printf("\n%s\n",CryptBuffer);
printf("\nEs werden %i Bytes verschluesselt\n", strlen(CryptBuffer));

/* Cryptlib Initialisierung */
status = cryptInit();
if( cryptStatusError( status ) )
{
printf( "cryptInit() failed with error code %d.\n", status );
return( -1 );
}

/* Load the key, encrypt the buffer, and destroy the encryption context */

cryptCreateContext( &cryptContext, CRYPT_UNUSED, CRYPT_ALGO_DES );

cryptGenerateKey( cryptContext );

printf( "\ntext: %s; textlen: %d", CryptBuffer, strlen(CryptBuffer));

/* Write the encrypted data to the screen */

printf( "\nContents of buffer after encryption: \n\n%.32s\n", CryptBuffer );

/* Load the key, decrypt the buffer, and destroy the encryption context */

cryptDecrypt( cryptContext, CryptBuffer, BUFFERLENGTH );

/* Write the decrypted data to the screen */

printf( "\nContents of buffer after decryption: \n\n%.32s\n\n", CryptBuffer );
printf( "\ntext: %s; textlen: %d", CryptBuffer, strlen(CryptBuffer));

cryptDestroyContext( cryptContext );

cryptEnd(); /* Cryptlib schliessen */

return 0;

}
naides
03-31-2004, 03:47 AM
You may have better luck for inteligent answers in a different (Visual C) Board, but, at quick view:

The code looks consistent, and compiles OK. This is a Linker error Code.

Often, the Library cryptlib.lib included by cryptlib.h is in Borland format, and does not link in a MS environ. You may need to recreate the library and or.check if there is a MS compatible version
chengyou
03-31-2004, 10:46 AM
Great hints! Naides, Thanks a lot!
Now I can turn the right way.

I have try several different c++ compiler, all the problem are due to the cryptlib.h file.

;)
mike
04-04-2004, 09:10 PM
Also, the best place for cryptlib advice is the cryptlib mailing list. It's very responsive.
chengyou
04-06-2004, 04:01 AM
Hi, Sir

I use MS Visual C++ 6.0 under Windows 2000 to test one algorithm.

This program seem encrypt correctly, because the error alert not occur,
But the decrypt seemed not correct.

Does anybody give some hints? thanks a slot.

this is the running result
--------------------------------------------------------------------
show the buffter:
hello
initialisation of cryptlib sucess.
successfully load cryptCreateContext. using algoriothm DES
Generating keys...

text: ↓≥≡ P√¼T╕4╨Γ b╙s φπ╖π⌡≥d{ G°;Ls╪/ì╪╤▒εI"Ç#╖τΘ2↕╟→₧↑>_9►╪a¼tP└4Mô%
ª¬«♣s╥ü╟ê∩¼{íûß}y ┼≡öe&fB/¿ →ù=óü▐"l╝←jaR9Φæ╟óbA☼ÿ♀ù$♥↨∩Zÿ<; textlen: 125

Contents of buffer after encryption:

↓≥≡ P√¼T╕4╨Γ b╙s φπ╖π⌡≥d{ G°;Ls╪

Contents of buffer after decryption:

τGI∞öè]D²²

current cryptBuffer length: 10
the first cryptlib running finish.
Press any key to continue

This is the test source code
//****************************************************************************

#ifdef _MSC_VER
#include "../cryptlib.h"
#include "../test/test.h"
#else
#include "cryptlib.h"
#include "test/test.h"
#endif

//****************************************************************************

void main( int argc, char **argv )
{

CRYPT_CONTEXT cryptContext;

#define CRYPTLEN 128

int InitStatus;
int ContextStatus;
int EncryptStatus;

// assign stored data

unsigned char TransData[] = "hello";

int len = strlen(TransData);
char *CryptBuffer = (char *)malloc(sizeof(char)*(len+1));

memcpy(CryptBuffer,TransData, (len+1) );

printf(" show the buffter: \n%s\n",CryptBuffer);

/* Initialise cryptlib */

InitStatus = cryptInit();
if( cryptStatusError( InitStatus ) )
{
printf( "cryptInit() failed with error code %d.\n", InitStatus);
exit( EXIT_FAILURE );
}
else
printf( "initialisation of cryptlib sucess. \n");

cryptAddRandom( NULL, CRYPT_RANDOM_SLOWPOLL );

/* Load the key, encrypt the buffer */

ContextStatus = cryptCreateContext( &cryptContext, CRYPT_UNUSED, CRYPT_ALGO_DES );

if( cryptStatusError( ContextStatus ) )
{
printf( "cryptCreateContext() failed \n");
exit( EXIT_FAILURE );
}
else
printf( "successfully load cryptCreateContext. using algoriothm DES \n");

/* Create key*/

cryptGenerateKey( cryptContext );
printf ("Generating keys...\n");

/* Write the encrypted data to the screen */

EncryptStatus = cryptEncrypt( cryptContext, CryptBuffer, CRYPTLEN);

if( cryptStatusError( EncryptStatus ) )

{
printf( "Couldn't encrypt data, status = %d.\n", EncryptStatus );
}

else
printf( "\ntext: %s; textlen: %d\n", CryptBuffer, strlen(CryptBuffer));

printf( "\nContents of buffer after encryption: \n\n%.32s\n", CryptBuffer );

/****************************************************************************
/* Load the key, decrypt the buffer, and destroy the encryption context */

cryptDecrypt( cryptContext, CryptBuffer, CRYPTLEN );

/* Write the decrypted data to the screen */

printf( "\nContents of buffer after decryption: \n\n%.32s\n\n", CryptBuffer );
printf( "current cryptBuffer length: %d \n", strlen(CryptBuffer));

cryptDestroyContext( cryptContext );

printf("the first cryptlib running finish. \n");

free (CryptBuffer);

cryptEnd();

}
mike
04-07-2004, 06:55 AM
Well, if you're going to put crypto in your own code, don't bother with the low level encrytion calls. Use the enveloping API.

One bug in your program is you're telling cryptlib that the buffer size is CRYPTLEN when you only allocate 5 or 6 bytes.


LINK: Toby Opferman's Debug Tutorials
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > LINK: Toby Opferman's Debug Tutorials
PDA

View Full Version : LINK: Toby Opferman's Debug Tutorials

ZaiRoN
03-31-2004, 02:44 AM
Debug Tutorial Part 1: Begining Debugging Using CDB and NTSD: http://www.codeproject.com/debug/cdbntsd.asp
"This tutorial is merely an introduction to debugging. This would be considered "tutorial #1" and I will write more add ons if the feedback is good. There are a lot of complex debugging techiques and issues that it's hard to know where to start. This tutorial attempts to start at the beginning and get you acquanted with debugging. I hope to expose novices and intermediate level programmers to the world of advanced debugging. "Advanced" debugging, basically without recompiling, without doing "message box or printf debugging".

Debug Tutorial Part 2: The Stack: http://www.codeproject.com/debug/cdbntsd2.asp
"In this article, I will investigate the stack and how it plays an integral part in debugging. Anytime you ask the question "What do you do when your program traps?" the most common answer is "Get a stack trace". This is definately true, it's probably the very first thing you should do anytime you investigate a crash dump."

Debug Tutorial Part 3: The Heap: http://www.codeproject.com/debug/cdbntsd3.asp
"In the previous installment of this debug series we learned about the stack. The stack is a temporary storage location for local variables, parameters, return addresses, and just about anything the compiler wants to use it for. In this installment of the debug series, we will learn about the heap in usermode."

Debug Tutorial Part 4: Writing WINDBG Extensions: http://www.codeproject.com/debug/cdbntsd4.asp
"Welcome to the fourth installment of this debugging series. In this installment we will be getting a bit away from actual debugging for a bit and dive into creating helpful debugging aids."

Well, nice readings to all ;-)

ZaiRoN
ZaiRoN
08-11-2004, 05:22 AM
3 more tutorials added.

Debug Tutorial Part 5: Handle Leaks: http://www.codeproject.com/debug/cdbntsd5.asp
" In this article, we will go over handles in Windows, what they are and how to debug leaks. The intent of these articles is not to regurgitate the WinDbg/NTSD help files but rather introduce real problems, what they are and how to solve them using the debuggers."

Debug Tutorial Part 6: Navigating The Kernel Debugger: http://www.codeproject.com/useritems/cdbntsd6.asp
" In this tutorial we will be covering a few of the basic features of the kernel debugger and get used to using it. I obviously can't cover everything so only select topics will be covered to just get used to the debugger. Hopefully you will find this article useful in your debugging adventures."

Debug Tutorial Part 7: Locks and Synchronization Objects: http://www.codeproject.com/useritems/cdbntsd7.asp
" In this section we will learn about locks and synchronization objects in Windows. In this tutorial we will do something a little different, we will be using both the Usermode debugger and the Kernel mode debugger since I have given the introduction to both debuggers already. This way, we get the best of both worlds."

Regards,
ZaiRoN
SHaG
08-18-2004, 05:10 PM
Very useful ZaiRoN. Thanks!
homersux
09-27-2004, 08:01 PM
bump this, this should be stickied but there are too many good stuff on this forum, :yay:
Kayaker
09-27-2004, 08:26 PM
Maybe we should create a forum/page with sticky links to some of the best of the best references that are posted here? Before, as you say, they end up in the electronic ether...
Innocent
09-28-2004, 02:43 AM
Sounds like a good idea to me.
JMI
09-28-2004, 03:34 AM
Or just download the Archive and have it all. :idea:

Regards,


interlok troubles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > interlok troubles
PDA

View Full Version : interlok troubles

lucvida
03-31-2004, 07:35 AM
hi ive been trying to research pace interlok (latest latest version) so i can disable it however i am a total newbie and dont really know what to do. if anyone can tell me how to get rid of it so i can use the program its protecting that would be the bestest ever. any point in a direction would be just as good
Kayaker
03-31-2004, 09:23 AM
The boards search function would be a good start, I get 7 other hits when I type in 'interlok'.
LiSa
04-09-2004, 11:29 AM
hy,
first, get ucf/zone unpacker and try it, it will maybe work...
If not, you will have to hook deviciocontrol to collect good response of tpkd.sys (ie undebugged)
after that disassemble tpkd.sys (crypted..)
find the dispatcher and fake the answer of services 70060 (debug check and selfdecrypt), 70080 (dbg check and time md5 encryption for expiration purposes,700A0 and 700B0 (weird calculus). Once you do that, you can debug the exe. interlok create one or two threads, the second one ask the .sys and if ok unpack the application and run it by a jump ebx. Bp on it and dump then run imprec to complete.

I used a different technic on a graphic soft by manual unpacking tpkd.sys to have an overview of the nice obfucation and debug detecting techniques used.
Once I will found or someone post me a pace sdk, I will build an automatic unpacker for release 5 of the driver.
Now I must desappear a little bit. look in the forum using the search and you will find some clues
Good luck
Fsound
04-28-2004, 02:10 PM
Hi there,

I have searched for the "ucf/zone unpacker" but cannot find it.
Where can I get it?

I have problems with the latest PACE, too :mad:

Best,
Fsound
dELTA
04-28-2004, 02:35 PM
You can find it in the FAQ, on the third row after the heading...
Fsound
04-28-2004, 02:50 PM
just shoot me, but I cannot find it in http://woodmann.com/forum/faq.php
JMI
04-28-2004, 04:15 PM
BANG!!!!!

Check the FAQ link in the BIG RED LETTERS at the top of the Forums.

READ THE FAQ AND SEARCH BEFORE POSTING!

Clicking on that link gets your here:

http://66.98.132.48/fravia/rce-faq.htm

The third line is: - Do not ask where to find the "tools".

This message is also repeated in the caption for the Tools of the Trade Forum:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

NOW ARE YOU ABSOLUTELY CLEAR ON THIS?

Regards,
Fsound
04-28-2004, 04:22 PM
alright ...
but why do you put it in the FAQ and not into the rulez?

btw: I already said that I have searched before posting ...
JMI
04-28-2004, 04:28 PM
Are you completely dense or what? That message is in a file called:

rce-faq.htm

and the "Rule" is also posted directly on the face of the Board.

We don't give a damn if you searched for the tool you want or not.

YOU ARE NOT TO ASK FOR THE LOCATION OF TOOLS ON THIS FORUM.

Now it's time for you to state that you CLEARLY understand and will FOLLOW this rule or you are history.

Regards,
Fsound
04-28-2004, 04:40 PM
as I already said: ALRIGHT
JMI
04-28-2004, 04:48 PM
But you followed it with the "excuse" that you had search and failed, as if that was an excuse for ignoring what was clearly in front of your face.

Regards
Fsound
04-28-2004, 05:07 PM
yes, you are right, it was my fault.

It's all because I am tired and tried hours of patching a PACE-protected DLL.
Sorry :-(
Tolstoinisten
04-28-2004, 06:34 PM
Hehe, F-Sound, the users at N2C warned you about this.. I read the thread there ;)

Instead of asking for an unpacker, decrypter or what have you, perhaps you should try to post yours results and see what answers you get.

People here are willing, I'm sure, to help you out :)

As for me PACE = Tooth Paste... :D
Fsound
04-29-2004, 04:18 AM
thanks for the warning.

My results aren't that good.
The (hidden) driver detectes Olly and sICE, if you open the protected DLL or the SYS-Driver and reboots the system.

I tried to install a VirtualPC on WinXP using Win98se and WinXP, but no success.
The latest InterLok-Drivers detect the virtual enviroment and give a bluescreen when launching the protected app.

I am very sad :-(
JMI
04-29-2004, 10:54 AM
So it'a time for you to read up on anti-debugger detection and defeating techniques and try to find what the program is using. There is a gread deal of information on the Forum about these issues and much more out there on the net. That is why the Diety invented search engines (and the search button here), so you could find information you might need.

How about you start there.

Regards,
Fsound
04-29-2004, 01:49 PM
alright ... but can anybody please answer THIS question first:

Is it possible to depack (etc.) the latest PACE at all?
JMI
04-29-2004, 03:19 PM
Well the obvious answer is that if it can be packed, it can be unpacked. If it couldn't, PACE wouldn't have to be continually updating the software to overcome the latest advances of the crackers. The main necessity for the "unpacking" is that you keep the debugger working. If you can't, YOU will not succeed.

There are many ways that the protector may be attacking your debugger. It might search for the window names of the product. It might even check for another running process that it can identify as a debugger and shut it down, or crash the system if it detects one running. You simply have to recognize that it IS detecting your debugger and then set out to figure out how and prevent it from shutting it down.

The PROBLEM is that at the moment you don't know very much about how debuggers ARE detected and until you study and find that out, you have little chance of recognizing such code in your target unless someone simply TELLS you the answer. This appears to be what you really want. It is also what we generally do not do here.

Now have you reviewed the materals already here and on the net on reversing this software or not?

Regards,


Which C++ IDE do you use and why?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Which C++ IDE do you use and why?
PDA

View Full Version : Which C++ IDE do you use and why?

5aLIVE
04-01-2004, 08:13 AM
Hello,
Just from reading some of the posts on this forum it is clear that some of you write code. I am currently taking the time to learn ANSI C++, I've noticed that most people seem to favour M$ visual C++ rather than Borlands
C++ Builder offering.

I was wondering what you guys prefer and if you could give me a few reasons why you prefer one over another IDE. This is just to help me make an informed choice of which is best when I come to writing some Windows programs myself.

Thanks in advance for any input.

5Alive.
bart
04-01-2004, 03:13 PM
im using VS6 and 2003 becouse its free
dELTA
04-01-2004, 04:20 PM
In exactly what way are they "free"?
disavowed
04-01-2004, 05:51 PM
maybe he means free of the crappiness inherent in borland's and metroworks's products
dELTA
04-01-2004, 07:11 PM
Which is exactly?
5aLIVE
04-02-2004, 02:13 AM
im using VS6 and 2003 becouse its free

Do you mean "free" to download at your leisure without a license perhaps?

I was looking for a more technical and reasoned response to the strengths and weaknesses of each and why one is perceived to be better than the other.

Thanks,
5Alive.
naides
04-02-2004, 04:51 AM
Do you mean "free" to download at your leisure without a license perhaps?

I was looking for a more technical and reasoned response to the strengths and weaknesses of each and why one is perceived to be better than the other.

Thanks,
5Alive.

The center theme of the board is Reverse Code Engineering, not Code Engineering.
In the RCE community, at least in the near past, there was a strong bias against IDE in general, because, when you examine the disassembly of applications written with either of the popular ones, Builder or VC, you see how inefficient, repetitive, and plain all bulky they are.

The current trend in hardware development, with HD near Terabytes and powerful CPU, making efficient and compact code is not a priority, and people settle for bloated code that LOOKS professional with minimal effort.

So:
1) If you want a technical, head to head analysis of the IDEs, you may have better luck in other boards or sites in the web, where people code for a living.
2) I f you want full control of the computer, maximum flexibility, and freedom to code, and are not afraid of a steeper, longer learning curve, use neither. You will code what you want to code, not what they thought you should code.
3) Microsoft Makes the OS of choice, and can, and does, tweak things around so its products have an edge over the competitors, Look at IE vrs Netscape, Look at .NET vrs JAVA, look at the IDEs. those are reasons to keep in mind if you depend on an IDE for making a living.
doug
04-02-2004, 10:16 AM
visual c++ 6
(I tried .NET, went back to v6.0)

I don't think it is free, unless you get an academic license.

I can't comment on borland's ide, never tried.

for msvc, it gives me what I want:
-things integrate well, getting the platform sdk, ddk, driverworks tools to function properly wasn't an issue.
- list of fields/function in a popup menu when i hit . or ->
- tiling/splitting, multiviews.
- its debugger is simple and efficient.
- ...

both sides are fine (especially since you are a newbie), ppl just pick their clan.. btw I first started with lcc-win32.. (freeware) and used it for quite some time. If you really want to know, you should just try demos and see for yourself which one you prefer/find more intuitive, that's all that matters, really.
Solomon
04-04-2004, 09:09 PM
I'm using VC++ 6 because there is a very handy plugin for it named Visual Assist(w*w.wholetomato.com). I can't live without this plugin.

I also use Source Insight(w*w.sourceinsight.com) to read C/C++ source code. It's very powerful. With WebDrive(w*w.webdrive.com), you can use Source Insight to edit/view source code on Unix/Linux systems directly. If somebody wants to read the Linux kernel source, Source Insight is one of the best choices.

There is also a popular IDE named Visual SlickEdit(w*w.slickedit.com).
disavowed
04-18-2004, 04:58 PM
im using VS6 and 2003 becouse its free
maybe he was referring to this?: http://www.microsoft.com/downloads/details.aspx?FamilyId=272BE09D-40BB-49FD-9CB0-4BFA122FA91B&displaylang=en


I´ve cracked a program but i don`t know how...!!!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > I´ve cracked a program but i don`t know how...!!!!
PDA

View Full Version : I´ve cracked a program but i don`t know how...!!!!

Gento
04-01-2004, 09:05 AM
Hello, i was trying to patch a program. I want to patch the internet connection of a dll using odbg109d.

Import: wininet.dll, im trying with

* Reference To: WININET.InternetGetConnectedState, Ord:0066h
|
FF1518620210 Call dword ptr [10026218]
8B4C2408 mov ecx, dword ptr [esp+08]
8901 mov dword ptr [ecx], eax
33C0 xor eax, eax
C3 ret

90 nop
....
....
....
90 nop

i´ve change this

* Reference To: WININET.InternetGetConnectedState, Ord:0066h
|
FF1518620210 Call dword ptr [10026218]
8B4C2408 mov ecx, dword ptr [esp+08]
33C0 xor eax, eax
8901 mov dword ptr [ecx], eax
C3 ret

90 nop
....
....
....
90 nop

Is this correct? Before that i' ve crack this soft with a crack founded from internet

... at this moment i am tryingo to do the same with another version,

thank all !!!!

(sorry for my bad english, i am spanish one)
ZaiRoN
04-01-2004, 10:04 AM
Hi Gento.
hmmm, from your message I am not able to understand which part of the code you have patched. You patch the call to InternetGetConnectedState, am I right? Don't know if its the right way, you should tell us more about the protection...

Best regards,
ZaiRoN
Gento
04-01-2004, 10:10 AM
Hi ZaiRoN

No protecction

I`ve change this

8901 mov dword ptr [ecx], eax
33C0 xor eax, eax

into this

33C0 xor eax, eax
8901 mov dword ptr [ecx], eax

I think it was very easy and i very happy !!!!

Thinks are more eary that we think.....uoouuuuu !!!!
Will
04-01-2004, 11:17 AM
;Call InternetGetConnectedState to check for an internet connection
FF1518620210 Call dword ptr [10026218]
;put the offset of the buffer (esp+8) into ecx
8B4C2408 mov ecx, dword ptr [esp+08]
;move return value (eax) of the InternetGetConnectedState call into your buffer
8901 mov dword ptr [ecx], eax
;Clear eax
33C0 xor eax, eax
;return
C3 ret

By switching those two lines, you're faking the return of the InternetGetConnectedState call, by zero-ing it out. If eax =='s true, then there is an internet connection. If eax =='s false, then there isn't. You're just making it always false. Interesting approach.

cheers,
will
Will
04-01-2004, 12:52 PM
Just out of curiosity, how did you manage to change that code accidentally?
Gento
04-02-2004, 01:42 PM
Hello Will, first I was thinking to change the result of the function InternetGetConnectedState (eax) but I did not know the correct number of eax. so first i changed this bytes and the soft works.
Gento
04-02-2004, 01:48 PM
Hello Will, first I was thinking to change the result of the function InternetGetConnectedState (eax) but I did not know the correct number of eax. so first i changed this bytes and the soft works.

NOw I am trying to kill a nag that is shown when i close the soft. This nag has two buttons (ok and cancel)

ANy suggestion about this?
Will
04-02-2004, 04:11 PM
Well it depends on what you're trying to do. Do you just want to stop the displaying of the nag? There are a number of nag-killing tutorials on krobar's site.

Without knowing more, about the only thing that I would suggest is to check whether it's a window or a dialog and then lookup either the CreateWindow/Ex or DialogBoxParam/DialogBoxIndirectParam API functions in the help file or on msdn. If there's no call to the Dialog or Window then it can't nag you anymore.

cheers,
will
Gento
04-02-2004, 05:15 PM
Ok will (so sorry for my bad english)

I want not to display the nag. I dont know if I must 'simulate' the ok button.

thanks i´ll look for the tutorials
ZaiRoN
04-03-2004, 02:12 AM
Hi Gento,
removing the nag (as suggested by Will) is the best choice. If you want you can 'simulate' the hit of the ok button, you can write an external program that sends a wm_command with wparam=BN_CLICKED to the nag. To send the message you have two options: postmessage or sendmessage; the first one posts the message into the program's message queue and returns to your external program immediately while the other does not return (to your external program) until the message has not processed.

Zai
dev_zero
04-17-2004, 11:55 AM
Just wondering which prog did you use to change the code?? hview??
Gento
04-19-2004, 08:37 AM
Hello

Wdasm, ollydgb and to change the code hex workshop v4.23

http://66.98.132.48/forum/showthread.php?t=5775 (this is the loader code to find the nag with error of course)


Asprotect patching exposed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Asprotect patching exposed
PDA

View Full Version : Asprotect patching exposed

condzero
04-01-2004, 06:41 PM
I am a relative Newbie on this subject. I admit to having a healthy respect
for the Asprotect protection software. So much so, that I have chosen
memory patching to get around the problem. Seems the proliferation of
loaders and in-mem patchers support my position. Without incurring
the dreaded BIG RED LETTERS nor divulging too much information
(not sure how much is too much, would appreciate some enlightenment),
I thought I would share (in a general sense) how I was able to get these two (Evaluation versions both protected by the latest and greatest version of Asprotect) to run with my patches without using a loader or helper app on winxp pro.

The memory patch approach methodology was the same in both cases, however, the means in doing so, differed slightly. I'm probably not breaking
any new ground here, but fostering an exchange of ideas on this subject seems to be a good idea. If interested, contact me and I will provide you the details. Perhaps, then, someone, more technical than myself, can provide further details and clarification to the general audience on a more generic way to accommodate win9X/NT, etc. IMHO, this approach lends itself
to patching directly without any modifications.
dELTA
04-01-2004, 07:26 PM
You are very welcome to describe the methods you used, right here in the forum, just as long as you don't use any specific targets as examples, so please go right ahead!

(I removed the target names from your thread title, so that you can more freely demonstrate your techniques without getting into trouble with the forum rules)
condzero
04-02-2004, 08:31 AM
Case 1. utilized one of the application's dll files to do my memory patching. Yes, the dll file was also protected with Asprotect, but it seems that the level of protection for dll's is not the same as for the module.exe file.

Case 2. utilized a system dll (msimg32.dll) called by the application to apply the memory patch.

In both cases, the methodology of applying the patch was the same. The timing is one key issue. Having an application that supplies it's own means to patch it (dll) is a good thing. When this option is not available, as in the second case, you can still find a way. Seems, in case 2, the application looks for a couple of system dll's in it's own program folder first, before looking in the usual system32 folder. I found this out by using NTFILMON (a wonderful utility supplied by the folks at www.sysinternals.com). So I used this to my advantage, and copied the rather small 5k system dll (msimg32.dll) into the program folder and applied the patch to it.

As I said before, the timing is the key. Both dll's don't come into play (load), until after both apps have gone through the unpacking/protection schemes of
Asprotect. This allows for more liberal usage of the registers and call stack
without worry of Asprotect, if you need to do so.

Case 1.
Overlay the beginning of the *.dll asprotect code (.aspr section) with:

JMP (*.DLL ADDRESS / bottom of the .aspr code section) to our patches:
NOP
NOP
...
our patches: (in most cases replacing a JNZ instruction with a JMP)
located near the bottom of the *.dll code, but first,
PUSH EDI; save the register
followed by a series of:
LEA EDI,DWORD PTR SS:[MODULE.EXE ADDRESS]
MOV BYTE PTR SS:[EDI],0EB
where module.exe address is the address(es) of the module we are
memory patching too. Note: we are also doing the same here with the
effected *.dll.
...
then,
replace the overlayed bytes at the top of our *.dll
MOV BYTE PTR DS:[<ModuleEntryPoint>],???
MOV BYTE PTR DS:[*.DLL ADDRESS],???
MOV DWORD PTR DS:[*.DLL ADDRESS],???
where ??? is whatever instructions were originally overlayed
then,
POP EDI; restore the register
then,
JMP Copy_of_.<ModuleEntryPoint>
we jump back to the top of the *.dll file and execute the original
code.
This is a one-time patch, where once the *.dll is called and our
memory patching has been executed, the *.dll's original code
that has been restored will execute. Our memory patched code
will execute only once.

Case 2. Samething, however your patches can be applied to the more
normal text/code section (i.e. there is no .aspr section).

There is no need to use procdump or any utility to expand
the code. The changes I describe (using any hex editor) can be made
directly. I have one caveat. In case 1, I hard coded a base address on the *.dll file using a pe editor. In the second case, the system *.dll file had a hard coded base address. So I admit, I used direct addressing in my lea instructions.
So the issue of relocatability still needs to be addressed, also, the memory
addresses of *.dll files on different operating systems. I am using winxp
pro. That's where you folks come in. The point being, that sometimes we
can make use of already linked *.dll files and not have to use an external
program (loader?) to memory patch the code.

As a final note, not attributable to asprotect, but I bring this up. I noticed a
rather strange looking *.dll file being loaded that resided in my:
C:\documents and settings\user\local settings\temp folder.
The file was: _update.dat which is a dll file masquerading in sheep's clothing.
Upon further inspection, this file was not part of the original app. Apparently,
I had a spyware dll file and exe file on my computer that attached itself
to this application. So if you have a process running on your machine
called sysupd.exe, get rid of it. Also get rid of the _update.dat file. Also good
idea to get rid of any temp files in the folder I describe above.
Manko
04-02-2004, 10:28 AM
Hi!

Great work, condzero! :)

/Manko
dELTA
04-02-2004, 07:26 PM
Thanks for sharing your ideas condzero. One thing to note about this kind of "dll injection" where you put a copy of the dll in the program's own folder, is that Microsoft changed this behavior in Windows Server 2003 (and also in Windows XP SP1 I think), so that dll's from the system32 dir are still loaded first, even if there is a dll with the same name in the program's own folder (yes, it was for the exact purpose of circumventing such dll injection attacks actually :)).


Again... XP+SoftIce 4.27
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Again... XP+SoftIce 4.27
PDA

View Full Version : Again... XP+SoftIce 4.27

Djony
04-01-2004, 08:11 PM
Hi, guys
I am complete newbie (first post here) stuck, like many here, in setting SoftIce 4.27 on my Windows XP + SP1.I saw some advices searching forum, but nothing efficient, at least for me.When I do Ctrl+D it freezes everything, until i hit the combo again.When I first installed Sice it "gave" me a new device in keyboard section (yellow mark in front of it).I've un installed that device and Sice gave me hell disabling my keyboard.I could nothing but to repair my XP and now I have same problem like before, but without strange device (keyboard working properly).I don't even get to see any Sice windows accept Loader 32.It just freezes when I hit Ctrl+D.My startup is empty.I tried starting Sice with different video options, always the same.
My graphic card is Radeon 9100.I saw some advice about getting symbols for ntoskrnl.exe but I always get an error code.Why?In Symbol Retriever in address for Simbol site field stands http://msdl.microsoft.com/download/symbols.
Is this right address?Also I don't have winice.dat file.Should I make it?Where should I put it( give me exact path, please)?
I am starting Sice manually.Please help, really wish to learn cracking.Thanks in advance!
Woodmann
04-01-2004, 08:27 PM
Hi,

This question is one of those that has so many possible answers......
SI gave you ! on your keyboard in the control panel
because it is having problems with the keyboard drivers.

You can try a different keyboard, remove your current keyboard from the control panel/system/hardware devices, plug in the new keyboard and restart to see what happens.

Woodmann
Djony
04-02-2004, 09:29 AM
Hi woodmann, thanks for answering, but to be honest with you I don't know hao because whenever I uninnstall the default driver for my keyboard XP installs the same by it's famous automatism (I guess that's the word, sorry for bad english).Some specific advices would help such idiot like me.I' ve noticed another thing which could give somebody idea.I tried to reinstall SoftIce but in config i've disabled all suports.First reboot after installation (or reinstallation, how do you want it) it gives so much desired monochrome window in which I can work.But when I reboot PC and try same thing again I'm stuck like on the beginning.Then I tried again to reinstall and the story goes again: first time OK, after NO.I guess Sice sees I'm a newbee first time I start it and it doesn't want to speak with me anymore.And now you want to tell me that computer can't think!
esther
04-02-2004, 09:43 AM
Hello,
You should find the latest Ds 3.1 instead of Softice 4.27
Djony
04-02-2004, 12:06 PM
well esther, do yo know any link for available download?
JMI
04-02-2004, 12:29 PM
Time to notice the statement in the title of the Tools of the Trade Forum, which states:

"Do not ask where to get the Tools of our Trade. Do not even think about asking for them."

Those kinds of things you need to do on your own. Searching on the net is a very important skill for would be crackers. If you lack skill in seaching, there is a link at the bottom of the forums for +Fravia's Searchlores, where you can learn how to do it. There is even a "lite" version available with just the debugger.

Regards,
Djony
04-04-2004, 01:37 AM
Ok! Sorry for asking stupid question.But there goes anothere one:
Will do the Driver Studio v3.0 Retail +SoftIce 4.27 do the job?

Thanks!
DeathWing
04-10-2004, 12:17 PM
i had the same problem and ds 3.1 solved it.
zao
04-10-2004, 02:42 PM
i have that problem to.. but when i first installed it, it worked but locked up my mouse. and after i rebooted it didn't show up any more..
Djony
04-10-2004, 07:11 PM
Thanks for you replies guys, I've downloaded the package I was asking about.It solved that problem, and bring new one.Not stoping in WinMain.I found some patches for it, but these worked only first time after pathing.What should I do?
DeathWing
04-11-2004, 03:07 PM
first sorry for my english. i never used any patch for breaking to winmain cause i never do it. but do you know the diffrence between softice and DS while using BPX? maybe you should first use addr ????
Djony
04-11-2004, 10:23 PM
You are right (and you say your english is bad).Everything works fine on DS 3.0.
Thanks for replying!


wasm.ru on woodmann.net
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > wasm.ru on woodmann.net
PDA

View Full Version : wasm.ru on woodmann.net

disavowed
04-01-2004, 08:45 PM
whoa, since when is wasm.ru being hosted on woodmann.net?

thanks woodmann, that's one of the better sites out there, and was missed. now we just need someone to translate it all to english :P

i also just noticed the "ctrl+d" site.. gonna check that out, too
disavowed
04-01-2004, 08:46 PM
looks like the linking on wasm.ru has to be changed from absolute to relative since wasm.ru/ isn't root anymore :)
crUsAdEr
04-01-2004, 09:13 PM
Hopefully it gives the wasm.ru admins more incentive to support English as well as Russian :)...
disavowed
04-01-2004, 11:03 PM
da


unpacking pebundled files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking pebundled files
PDA

View Full Version : unpacking pebundled files

fr1sk3y
04-02-2004, 02:18 AM
hi
i'm looking for instructions on unpacking pebundled files

thank you in advance for your replies

bye
JMI
04-02-2004, 12:45 PM
If you are truely interested in "learning" about unpacking and not just having someone "unpack" a specific file for you, you have a fairly long learning process ahead of you. You will find a great deal of information already available here on the Board if you learn how to use the search button at the top of the Forums. You also need to read the FAQ because it will show you how to properly post a question. Generally you need to show some of your own work and describe where you are stuck and thenask for help.

So far, you have not shown that you have done anything to help yourself which actually learning how to unpack anything. You might want to use you favorite search engine and try things like "pebundle + unpacking." Copies of the packer are available for study. It's time for you to do some of your own initial work, don't ya think?

Regards,


Crack sites - why so scummy?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Crack sites - why so scummy?
PDA

View Full Version : Crack sites - why so scummy?

Aquatic
04-02-2004, 04:25 AM
1. Why must they shove ActiveX smut down our throats?

2. Why the tie-in with the animal porn sites?

3. Why replace our homepage with online Casinos?

It's as if they want to out-do eachother at annoying ppl.

Or maybe there is hidden agenda behind it all.
dELTA
04-02-2004, 07:05 AM
Wild guess:
People want cracks + The crack-site people want money (and zombie computers for spamming and whatever) = They use cracks as baits to get it...
CluelessNoob
04-02-2004, 07:34 AM
There is a simple answer to your problems.

Don't use an ActiveX enabled browser.

I have been using Mozilla with many browsing "security" tweaks for quite some time. My surfing experience both in the mainstream web and the less travelled paths has been much less interrupted.

Ditch the evil code from Redmond and you will be much happier.
disavowed
04-02-2004, 07:45 AM
or, use ie and disable activex and scripting. best of both worlds

(yes, i know every once in a while an exploit comes out which can affect ie even when things are disabled)
Will
04-02-2004, 01:33 PM
....or you can just not visit those types of sites to begin with. Then you won't have to worry about it. ;)

my $.02,
will


WiseInstaller help?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WiseInstaller help?!
PDA

View Full Version : WiseInstaller help?!

ramin_rad2000
04-02-2004, 08:49 AM
Greeting dear reservers
I'm stucked with a wiseinstaller target which asks for productID and registeration number,wise calls some security functions from a dll in temp dir
[Hmi32.dll] which is very confusing :confused:
I bmsg on registeration form and after searching memory for what i have enterd and finding thier address i simply put a bpm on them but it is all so confusing,and it never does a clear cmp or lstrcmp. :(
as far as i have gone the respective dll function is _hmrvalidp@32 which calls hmr3valid after it passed some parameters[name,city....,productID,regnum]
I have cracked the installer password itself and extract all the files and i knew where to copy them and i also dumped wise memory.I found all of the filenames and their destination in it and after that i also found the registry structure (which have to be made) exists in the memory(dumped) but some of them are hard to simulate like {SOFTWARE\HaestadMethods\%APPNAME%\%VERSION% %BUILD% Build}
Here is my question:
Can i simulate windows reg from this dumped data[hmi.txt]?Or can anyone help me to find the serial itself or any brute way to disable these dll calls?

Attachment deleted...
dELTA
04-02-2004, 07:12 PM
It sounds to me like that called dll function might do all the tests and then return a simple boolean (like for example 1 or 0), have you tried to analyze and patch the return value of that dll?
ramin_rad2000
04-03-2004, 02:17 AM
It sounds to me like that called dll function might do all the tests and then return a simple boolean (like for example 1 or 0), have you tried to analyze and patch the return value of that dll?
Well i don't know why they deleted the attachments,I haven't asked for crack
there was a text file in the attachemtns with the dumped memory.i thought that could help. the dll retuns something like :
--------------------------------------------------------------------------
%TEMP%\HMI32.dll _HmR3Validp@32 211960
40COMPANY
40CITY
40STATE
40PRODUCT
40VERSION
40PRODUCTID
40REGNUM 1VALIDREG VALIDREG 1 f16 0VALIDREGTRUE
f16 0VALIDREGFALSE  %TEMP%\HMI32.dll _HmCRCCheckp@8 211960
40PRODUCTID 1VALIDPRODUCTID VALIDPRODUCTID 1 f16 0VALIDPRODUCTIDTRUE
f16 0VALIDPRODUCTIDFALSE  VALIDREG TRUE VALIDPRODUCTID TRUE f16 0VALIDREGDATATRUE
f16 0VALIDREGDATAFALSE 
f16 0VALIDREGDATAFALSE  VALIDREGDATA TRUE %TEMP%\HMI32.dll _HmR2Lp@8 211960
40REGNUM 2LC %TEMP%\HMI32.dll _HmR2Sp@8 211960
40REGNUM 2SL SL 0 f16 0SL99  PRODUCT FMW f16 0SL0 
دظb×غb¨ DISPLAY Error  INSTALLCOUNT %LC% f16 0LC ×غb8قb* DISPLAY License Enforcer  
%NAME% f16 0OPTIONS/skipdisk  f31 3DIRECTIONDISPLAY91012632256232566321280633562Enter User Name CMDLINE /HMISuperUser 1Display ReadMe CMDLINE /HMISuperUser 0Select Destination DirectoryStart Installation >cca DISPLAY Enter User Name ccr DISPLAY Display ReadMe f16 24ALREADYAGREE%RESPONSE% cنcآ DISPLAY Select Destination Directory
--------------------------------------------------------------------------
i guess if i enter the right pass then the prog show this message:
Select Destination DirectoryStart
can i some how bpm on this to find out the right program flow?
ramin_rad2000
04-03-2004, 04:37 PM
I have cracked the prog by patching the dll return calls[quite interesting]
and i have wrote a patch like this in dll
orginal:
--------------------------------------------------------------------------
sub aaaa
push.....
.
.
.
call sub x
bbbb: pop eax
.
.
.
ret
--------------------------------------------------------------------------
patched:
--------------------------------------------------------------------------
sub aaaa
push....
.
.
.
jmp xxxx [some where at the end of .rdata]
pop eax
.
.
.
ret
--------------------------------------------------------------------------
.
.
.
xxxx push esp
push eax
mov eax,yyyy
mov ds:[nnnn],eax
pop eax
pop esp
call sub x
jmp bbbb (next offset after call sub x in sub aaaa)
--------------------------------------------------------------------------
It works fine in win98 but in winxp it crashes,i wonder why?
unfortunatly i couldn't configured sice to work in winxp and so i can't debugg!
any tips? :confused:
doug
04-03-2004, 05:29 PM
what about relocations? did you fix that too?

if all the code you pasted is stuff you added, then you should consider what happens when the code is loaded at a different imageBase than the prefered one.
ramin_rad2000
04-05-2004, 03:02 PM
That is exactly what i have thought of,the program saves the address in edi somewhere but i couldn't find out where. probably it is something like: mov edi,[ebp+x].
you are absolutly right,the memory address which i patched is somewhere in wiseinstaller itself(it stores dll return data there) well i have to trace more!
thank you very much :)


same codebytes, different meaning ?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > same codebytes, different meaning ?!
PDA

View Full Version : same codebytes, different meaning ?!

0rp
04-03-2004, 05:23 PM
if i compile this function

void foo()
{
printf("bar\n");
}

the compiler produces this:

00401090 55 push ebp
00401091 8B EC mov ebp,esp
00401093 68 10 71 40 00 push 407110h <--- "bar\n"
00401098 E8 73 01 00 00 call 00401210 <-- printf
0040109D 83 C4 04 add esp,4
004010A0 5D pop ebp
004010A1 C3 ret

if VirtualAlloc new memory, and cpy all this codebytes to this memory (55, 8B, EC, ... C3), the debugger shows this:

00340000 55 push ebp
00340001 8B EC mov ebp,esp
00340003 68 10 71 40 00 push 407110h
00340008 E8 73 01 00 00 call 00340180 <---- wtf?
0034000D 83 C4 04 add esp,4
00340010 5D pop ebp
00340011 C3 ret

my question: why does the call gets 00340180 and not 00401210 ?
doug
04-03-2004, 05:41 PM
note that the printf function has been injected into your code (that's ok).

now, if you look carefully, the instruction used to call printf uses EIP-relative addressing.

00401098 E8 73 01 00 00 call 00401210 <-- printf
0040109D 83 C4 04 add esp,4

the destination (401210) is calculated as follows:
-> 40109D (next instruction) + 173 = 401210

in your valloc'd code:

00340008 E8 73 01 00 00 call 00340180 <---- wtf?
0034000D 83 C4 04 add esp,4

-> 34000D + 173 = 340180.

there are many workarounds for this.
Ex: Patch the dword after E8 with (00401210 - 34000D = C1203). You can compute these offsets at runtime.
0rp
04-03-2004, 05:42 PM
ah EIP relative, ok
thx


Rainbow Superpro Sentinel Driver
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Rainbow Superpro Sentinel Driver
PDA

View Full Version : Rainbow Superpro Sentinel Driver

Chad°|°Z
04-03-2004, 11:14 PM
I've been studying a program which uses Rainbow Technologie's Sentinel driver version 5.41.1 (32 bit). I've been disassembling the prog using IDA pro but I am not having any luck loading the sig file. I already have sspro.sig but this does not reveal any RNBOspro API calls. There are many tut's on Sentinel drivers but I can't seem to get past first base without the proper .sig file. Any advice? :confused:
Also, should I be disassembling sentinel.sys or the .exe file that runs the original program?
sope
04-05-2004, 07:25 AM
Hello Chad°|°ZAlso, should I be disassembling sentinel.sys or the .exe file that runs the original program?Take .exe file first. If the .sig files does not find the api calls binary search in ida for the famous 7242 bytes & carry on with the fantasy...

Regards, Sope.
Chad°|°Z
04-05-2004, 07:15 PM
Thanks for the response, Sope. It's becoming more clear every day just how far down on the curve I am (since I don't know what your talking about). Rather than ask a series of beginner questions, I'm off to the user manual for IDA and SICE. Every day things are making more sense. I haven't worked much with asm since the 8088 days. Back to the books! :cool:

Thanks.


VB P-Code <SPLIT>
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > VB P-Code <SPLIT>
PDA

View Full Version : VB P-Code <SPLIT>

sarge
04-03-2004, 08:17 PM
WARNING.....venting follows:

This MB is the pits. I have to re-login EVERY time I change a page, and even to view different message threads within the same forum. It has taken 3 attempts to request a new password, just to get in so I can reset it back to my old password. And when I DO get in, there is a 50/50 chance that I may (or may not) be allowed to post. I am not happy here!

Spencer: I have not yet received anything from you. If you did in fact send it, it probably got dumped via junkmail. Please try again, with a subject line that is likely not to look to hotmail like junk. Better yet, tell me here in this MB the subject line you will use, and I will look for it.

I have not yet had time to look up the "Chinese" program we had discussed; I have spent most of my time trying to get back into this MB. Now that I'm here, I wanted to get this message posted before something else went wrong.
But I will get on it tomorrow.

Sarge
JMI
04-03-2004, 08:24 PM
Sarge:

The Board seems to be running fine so it may be a cookie problem. You did not mention whether you had deleted your cookie and attempted to sign in again and get a new one. The cookie is used for the view between pages. At the moment that is all I can thing of, since it is working perfectly for me all day.

Regards,
dELTA
04-03-2004, 08:35 PM
Make sure to always use the domain "www.woodmann.net", that might solve your cookie problems. It might also be the security settings in your browser that cause these problems, and in this case too it might have to do with the "multiple domains" used by this board. Make sure to set your browser settings to accept all kinds of cookies for both the domains "www.woodmann.net" and "www.woodmann.com", including third-party cookies and all other cookie types. That should do it.
JMI
04-03-2004, 09:36 PM
There goes that dELTA again, trying to get all the cookies he can. ;)

Regards,
klier
04-04-2004, 08:58 AM
had a simular problem when i logged in at "http://woodmann.cjb.net/"

logging in at "http://www.woodmann.net/forum/index.php" solved it.
sarge
04-04-2004, 10:21 AM
Wow! Thanks to all for their ideas. Yep, I have my browser set to "accept no cookies" (or whatever the equivalent is). I'll have to loosen up my security a bit, I guess.

I prefer this MB over my second choice by quite a bit, due to it being somewhat more open to controversial discussions. (VB PCode reversing is controversial?) Hope the cookie thing works.

Get back to you'all in a bit.

Thanks again.

Sarge
esther
04-04-2004, 10:27 AM
If it doesn't works check the box "remember me" and log in
Woodmann
04-04-2004, 03:24 PM
Howdy,

I have my "cookies" set to discard on exit.
The "remember me" box wont work with that setting.

For some strange reason I have received a few emails these
past few days from people having problems logging in.

Opera will cause you to have problems. When ever something
goes wrong on this message board I can always find the
solution by looking at my settings for the browser.

For people who have registered and have not received an email,
it is because your mail server will not accept email from this server or,
your mail box is full or, you typed something wrong and your email address comes back as "unknown user".
I get emails bounced back about 6 times a day for those reasons.

Woodmann
esther
04-04-2004, 10:19 PM
Howdy Woodmann,

For my case yes coz I didn't put any proxy in IE internet options and it works for me ;)
sarge
04-06-2004, 05:18 AM
Just an FYI:
Klier's tip seems to be working for me,at least for now
Thanks all for your support
Sarge


flexlm 9.0 help!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > flexlm 9.0 help!
PDA

View Full Version : flexlm 9.0 help!

noxworld
04-04-2004, 10:54 PM
I try to crack a program potected by flexlm 9.00.
follow the Nolan Blender's "Zendenc FLEXlm 7.2 cracking information"
i find the ENCRYPTION_SEED1 ,ENCRYPTION_SEED2 and VENDOR_KEY i make up the lmcrypt.exe using flexlm sdk 9.2 .the mode is upgrade from 7.2.the LM_STRENGTH is LM_STRENGTH_DEFAULT.sign length = 12.but it can not work.then i make it up with flexlm sdk 7.2h, it can not work also .the software can work on demo mode protected by flexlock. i use the flsetup.exe(7.2)with the seed ,make up fldata.ini , it worked ! so ,it seemed that the seed is right.perhaps it did not use the ENCRYPTION_SEED,but the LM_SEED in lm_code.h.there should be some relation beteen LM_SEED and ENCRYPTION_SEED.does LM_SEED generate the ENCRYPTION_SEED in lmseed.h?how can i find the LM_SEED ?
JMI
04-05-2004, 03:08 AM
Your post does not indicate whether you have attempted to review any of the other 173 threads listed when the search button is used with "flexlm." Have you reviewed any of them to see if they can assist you with your issue before you asked for help?

You have mentioned only one tutorial. Have you searched for any others which discuss flexlm reversing? Have you reviewed the materials contained in the CrackZ site listed in the links at the bottom of the Forum? Have you reviewed any of the Flexlm manuals available on the net? Using "LM_SEED + flexlm" in my favorite search engine took less than a minute to find a 2002 version of the "Implementation Guide." Even though this first hit was for version 3.2 it has substantial disucssion of both LM_SEED and ENCRYPTION_SEEDS which you should review on your own. Further searching can be accomplished using "Flexlm + ENCRYPTION_SEEDS."

Have you search for and reviewed the Flexlm source code which is available on the net?

In short, if you have done something to try to help yourself solve this problem, you have not yet indicated what that might have been. Generally, attempting to help one's self is expected of those seeking help here.

Regards,
CrackZ
04-06-2004, 06:11 PM
Hiya,

I've been looking at FLEXlm's latest offering in little chunks over the last few weeks, v8.x through to v9.x. A paper will be forthcoming on my site in the next few weeks.

1. The LM_SEED's are NOT related to the ENCRYPTION_SEED's, they are securely generated by the developer with lmrand1 (actually you can make them up but in practice it seems crazy to do so). You have absolutely no hope of deriving them, 2^96.

2. The rest of the FLEXlm information, ENCRYPTION_SEED's etc, are still hidden via _l_sg() in exactly the same fashion as described by Nolan Blender and can be used to build a valid lmcrypt, later versions of the SDK insist on LM_SEED being defined, but you can still generate simple SIGN=123412341234 or default licenses.

3. In my essay I describe a very easy way to make a 1 byte patch which will switch the FLEXlm routine to use the old style checkout (aptly named _our_encrypt(), as opposed to the new style authenticator (aptly named _our_encrypt2()), this approach I have tested now with 7 targets and it has worked flawlessly.

Drop me an e-mail if you want some more details.

Regards

CrackZ.
noxworld
04-06-2004, 09:39 PM
thank you !
i really need some details information . my email address is noxworld2000@163.com.
CrackZ
04-26-2004, 07:03 PM
Hiya,

I know this thread is old now *but*.....

http://www.woodmann.com/crackz/Tutorials/Flex2004.htm

This is my latest discussion of how we can force all current FLEXlm versions to accept old style licenses with a trivial patch to protected binaries.

As noted elsewhere, you haven't a hope of finding the LM_SEED's used by the developer in the later secure implementations.

Regards

CrackZ.
whyIII
04-26-2004, 08:36 PM
Crackz, Great work!!
res_spectre
04-27-2004, 10:37 AM
I promise that next time I post I won't violate the rule against asking where I might find the Tools of the Trade, which states:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.
Tricker
04-27-2004, 01:35 PM
I'm a complete idiot and not only didn't read the post right above mine, I also ignored the rule against asking for the tools of the trade.

I promise that next time I post I won't violate the rule against asking where I might find the Tools of the Trade, which states:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.


How does this program work?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How does this program work?
PDA

View Full Version : How does this program work?

JWcal
04-05-2004, 08:27 AM
Hey people, just signed up here, this is my first post. :)
I'm not exactly sure what to search as I'm unaware of the technical term used for this. Here it goes...

1. What is the problem....
I've read plenty of tutes but i haven't been able to find any that relate to my problem. I've found and changed a condition(JNZ to JE) and i get the correct Message Box showing but the program still remains registered.

2. What is the protection.....
Need some help here i think.

3. What tools are you using....
Ollydbg1.09d. Sorry can't get SI to work. :(

4. What tutorials have you read....
The ones at Krobar's under serial section.

5. Show your output listing WITH comments....
6. NOW ask your question....
(Can i bend the rules with 5 and 6? :D)

The whole code that i want to post is quite large, i'll post it on request. Here is basically how i see it.

My serial is entered.
Stored in a register.
Call is made.
JNZ if code if fake.

Here are some problems:
1.) (As described above)When JNZ is changed the program executes as if it were registered(pops up "Success" box) but it really isn't.

2.) There are 4 parts to the section I think needs the "fixing".

Call something
JNZ wrong:
"Congrats"
some more code;
"Serial you entered is correct"
more code;
wrong:
"Invalid"
some more code(like the one after "Congrats")
"Serial entered is wrong"

Now when i enter the wrong serial i get "Serial entered is wrong".
When i change the JNZ i get "Serial you entered is correct".
Why do i not get "Invalid" or "Congrats"?

Here is the code that i dont understand
NOTE: Serial i entered is "123" and i have edited out the name of the program.

0048F0F5 E8 DEC4FFFF CALL ProgName.0048B5D8
0048F0FA 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0048F0FD BA 50F34800 MOV EDX,ProgName.0048F350
0048F102 E8 F157F7FF CALL ProgName.004048F8
0048F107 0F85 02010000 JNZ ProgName.0048F20F

I breakpointed each line(Info straight from Ollydbg).
LINE 1:
EAX 0097E85C ASCII "123"
Z=0

LINE 2:
EAX 00000000
EDX 0097E85C ASCII "123"
z=1

LINE 3:
EAX 0097EB9C
EDX 0097E85C ASCII "123"
z=1

LINE 4:
EAX 0097EB9C
EDX 0048F350 Progname.0048F350
z=1

LINE 5:
EAX 00000000
EDX 00000001
z=0

Now my questions.
Is there something going on in those calls that needs to be changed to get the program registered? I had a look through each call and the first one is called 4 times and the 2nd is called like 15+ times.

Please tell me if you require more info.
Is there a specific tute i should read?
Is this program too advanced for me?

Any help will be greatly appreciated.

Cheers JW.

For some reason i tried posting this and it gave an error. Apologies if it did actually post but at this time i can't see where the thread is. :(
dELTA
04-05-2004, 10:46 AM
The program does most likely check the serial each time it is started too. Since you only patched the jump that reacts to the result of the serial check function, this second check, which is located somewhere else will still detect the incorrect serial.

If you are lucky, the same serial checking function is used in both places, and it will work if you patch the function to always return the correct value, instead of patching the test that follows the call(s) to this function.

Otherwise, try to monitor where your license data (serial and such) is stored during the registration, and then breakpoint the accesses to these locations and restart the program. When it breaks, trace the data all the way to the second checking function and patch that one too.


!dump in IceExt 0.62
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > !dump in IceExt 0.62
PDA

View Full Version : !dump in IceExt 0.62

naides
04-05-2004, 06:27 PM
When I try to use the memory dumper that IceExt provides I get an error message: "error exception occurred while dumping memory"

I am asking this question because I am not sure if this is a problem with my computer, my windows setup, my SofIce version (4.27) or a bug in IceExt. Sten actually mentions that a bug was fixed in this version.

Could other people that have IceExt installed tell me if !dump works for them??

thank you
crUsAdEr
04-06-2004, 01:44 AM
Hi naides, it seems to work fine on my box...

Make sure that you are dumping a valid range of memory address, as that exception occurs when RtlCopyMemory fails...
naides
04-07-2004, 06:52 AM
Hi naides, it seems to work fine on my box...

Make sure that you are dumping a valid range of memory address, as that exception occurs when RtlCopyMemory fails...

Thanks for the info Crusader. I have been experimenting and I still run into problems: Example

I run Notepad.exe. The process ImageBase address is 01000000h
The Process imageSize is 13000h I can dump it seamlessly with LordPE for instance.

But, if I try to use !dump from IceExt, it complains with the exception message.
I can dump the first 2000h bytes with no problem, but anything beyond that results in error. It happens with other processes also.
Can you dump memory segments of arbitrary length?
crUsAdEr
04-07-2004, 09:21 AM
That is true... i do encounter random error with dumping, sometimes it works sometimes it doesnt... perhaps other can do more tests on this...
Kayaker
04-07-2004, 11:21 AM
Hi

If you try it from a fresh reboot you might be able to dump it. ExAllocatePool doesn't necessarily allocate contiguous memory, and over time the limited non-paged memory becomes fragmented. These driver memory allocation APIs generally allocate page-sized chunks, even if you only want a few bytes of memory. If one standard 4K page is 1000h, and you're trying to dump 13000h, I suppose that's a lot of contiguous memory to expect. It *sounds* like this might be the problem.

The newsgroups talk about this issue of allocating large blocks of contiguous memory at lot. The only time you are assured of getting it is when you first turn the machine on. As a driver developer the suggestions are to use MmAllocateContiguousMemory or AllocateCommonBuffer in your DriverEntry routine to secure your slice of the non-paged pool pie. I think there are ways of 'tracking' non-contiguous memory chunks using MDL's, but may only be for standard user app+driver applications.

I was kind of wondering if this might become a problem, cuz I use ExAllocatePool for memory dumping too. Unfortunately the problem is compounded by having to schedule a file output routine in a separate thread which occurs *after* you have exited from Softice. I'm sure there's a way around the problem, dumping in pieces if necessary from within the extension, tracking the physical pages of memory allocations that need to be split, say with a doubly linked list, and somehow scheduling them all to be dumped to the same open file later on, ...yadda.

But in general that sounds like a big pain in the ass. Better to tell the user to reboot, cross your fingers and kwitcher griping. ;-)
crUsAdEr
04-07-2004, 11:28 AM
Hi Kayaker,

Just wondering, do we really need a NonPagedPool for dumping? I thought Windows should be able to handle paging by itself since we are dumping at Dispatch Level...
Kayaker
04-07-2004, 12:33 PM
Possibly. If you're lucky ;) The memory allocated isn't actually freed until after the file is written, so one might hope your dump(s) is still there come WriteFile time. But once out of Softice (or maybe even within), I don't know if you can be assured there might not be paging out/paging in or reallocations of paged memory going on beforehand.

I guess it would depend on how the system handles pageable memory "earmarked" for later use. If you allocate paged memory, say across several pages, you get what in return? A pointer to the start of the memory. If between that time and WriteFile time (several seconds perhaps), the system needs some more memory for its own use... who's to say you're protected over the full range? There may be some kind of internal bookkeeping going on that tries to keep paging out of memory that hasn't been freed yet to a minimum, but I couldn't begin to guess.

I do know that after exiting Softice after queuing via a semaphore a few file output routines from an extension for later processing, the file writing isn't 'immediate', and it's even possible to shut your driver down (and the separate I/O thread it created) before the file output is complete, so synchronization is needed. Setting the thread to HIGH_PRIORITY would likely help too.

It might be worth a shot to use the paged pool just to see what *does* happen, the worst you'll get is a bad Asp dump :p
crUsAdEr
04-07-2004, 02:14 PM
NO but even if the pages are paged out, upon writing the memory out to file, Windows will be able to handle that page fault and page in the appropriate pages?

Also, if you look at IceExt source, the error is caused by RtlCopyMem failing... the error for Reserving NonPagedPool is different... so that should not be the issue i think!
Kayaker
04-07-2004, 02:51 PM
Also, if you look at IceExt source, the error is caused by RtlCopyMem failing... the error for Reserving NonPagedPool is different... so that should not be the issue i think!

Yeah, that's true, I see where the error message lays now, it's not with the actual allocation (I was sourceless). Do you think it's the fault of RtlCopyMemory or within SheduleDumpFile?
crUsAdEr
04-07-2004, 09:17 PM
Hi Kayaker,

I have recompiled iceext with mroe error msg and the error is definitely RtlCopyMemory... I have no clue why it fails though...

"Callers of RtlCopyMemory can be running at any IRQL if both memory blocks are resident. Otherwise, the caller must be running at IRQL < DISPATCH_LEVEL"

I am sure cmd_dump is running @ DISPATCH_LEVEL so perhaps either memory blocks are not resident?

Perhaps Sten could comment on this?
Kayaker
04-08-2004, 02:08 AM
Hi

So you can duplicate the error? That's handy. Out of curiousity do you have any idea what *size* of buffer you can get away with?

I had a thought about this, just a theory that might be false. Assume under *normal* driver conditions you allocate a large buffer with ExAllocatePool, while it may not return a range of pages that is *physically* contiguous, because of fragmentation or whim, it will be *virtually* contiguous and the Virtual Memory Manager should be able to handle any memory copy to it. The paging mechanism and PTEs and all that mysterious stuff being involved.

The thing is, we're not really in a *normal* driver condition here but in Softice space within an extension. While you can call most kernel APIs and such, I wonder if the VMM itself is affected and the page fault that occurs which would normally trigger a new page being brought in doesn't work as expected?

Naides mentioned being able to dump 2 pages worth but no more. Perhaps that time ExAllocatePool allocated 2 contiguous *physical* pages, which were copied into OK, but the rest were scattered physically, requiring the services of the VMM, which seemed to have gone belly up on him.

This might be hokum because Softice itself uses ExAllocatePoolWithTag (the tag being "SIce"), but I can't tell what procedure it's used in or how many bytes might be allocated. It might be for small mem allocations <= 1 page so the VMM never comes into play. Sice also uses MmAllocateContiguousMemory, where the pages are guaranteed to be physically contiguous and which, again a theory, might be used for larger allocations. So much for theorizing :p
crUsAdEr
04-08-2004, 04:28 AM
Hi naides,

Can you try this... scroll down in Data Windows of sice for the whole file... use PageDown or something :)... then you will be able to dump no problem...

I think RtlCopyMemory will fail when part of the file is paged out... also !dump will fail due to any "uninitialized" data section, sometimes you will see in sice ???? in certain section of the file, using pagein command i was able to dump properly...

SO i guess the problem is Memory not resident, so we have to somehow lower IRQL before dumping... but i am not sure, will have to wait if Sten will do anything about this :/
naides
04-08-2004, 12:56 PM
Hi naides,

Can you try this... scroll down in Data Windows of sice for the whole file... use PageDown or something :)... then you will be able to dump no problem...

I think RtlCopyMemory will fail when part of the file is paged out... also !dump will fail due to any "uninitialized" data section, sometimes you will see in sice ???? in certain section of the file, using pagein command i was able to dump properly...

SO i guess the problem is Memory not resident, so we have to somehow lower IRQL before dumping... but i am not sure, will have to wait if Sten will do anything about this :/

Results of the experiment:

Loaded Notepad.exe in symbol loader

ImageBase 01000000 Size 13000

Tried to dump: Only the first two pages 2000h dump.

Let me expand what I mean: If if place !dump c:\dump.dmp 01000000 100 it dumps. I gradually increase the size of the dump until I get the error message. The limit here was 2000.

I place the file in the data window and looked at it by paging down. around address 01009000 to 1009FFF and 0100E000 to 0100EFFF there were pages that were not mapped ie they showed as ????? marks

After this maneuver, I was able to dump up to 8FFFh. once I hit the area belonging to the file but not mapped-in, while I examined in Sice data window, I hit the exception error code. It seems that !dump uses an API that does not have the paging in capability, am I correct?
crUsAdEr
04-08-2004, 08:11 PM
Hi naides,

Try Disable Mapping of Nonpresent Pages in sice setting... then you will be able to see all the ???? where the page is not present...

It seems that !dump uses an API that does not have the paging in capability, am I correct?

I think it is just that !dump is executing at IRQL DISPATCH_LEVEL which the MSDN says paging will not be supported? Which is why RtlCopyMemory fails... somehow we need to lower IRQL before dumping...
Kayaker
04-08-2004, 11:32 PM
Nice one crU ;)
("Good Spot" in the birding world)

If I use KeGetCurrentIrql in regular driver code it returns 0 or PASSIVE_LEVEL, which is normal. If I use it in my Softice extension it returns at a whopping what is the 3rd highest IRQL level of 29 or IPI_LEVEL. Softice itself (or its extensions at least) must run at an elevated level so it doesn't get interrupted by anything lower, in fact the only things which could interrupt its execution are Machine checks/bus errors and Power-fail interrupts. Interestingly there is no KeRaiseIrql API in Sice code, so it must do it some other way during initialization.

Programming the MS WDM by Oney talks about IRQL and Paging:

--------------------------------------------
IRQL and Paging
One consequence of running at elevated IRQL is that the system becomes incapable of servicing page faults. The rule this fact implies is simply stated:

Code executing at or above DISPATCH_LEVEL must not cause page faults.

One implication of this rule is that any of the subroutines in your driver that execute at or above DISPATCH_LEVEL must be in nonpaged memory. Furthermore, all the data you access in such a subroutine must also be in nonpaged memory. Finally, as IRQL rises, fewer and fewer kernel-mode support routines are available for your use.

...it’s well to point out that the rule against page faults is really a rule prohibiting any sort of hardware exception, including page faults, divide checks, bounds exceptions, and so on.
-------------------------------------------

During testing I was able to change the IRQL level within a Sice extension to that of PASSIVE_LEVEL (0) or DISPATCH_LEVEL (2) in the following way.

LOCAL OldIrql:DWORD
LOCAL DummyIrql:DWORD

invoke KeGetCurrentIrql ; (include hal.inc/hal.lib)
mov OldIrql, eax
; returns IPI_LEVEL equ 29 ; Interprocessor interrupt level

invoke KeLowerIrql, PASSIVE_LEVEL ; // DISPATCH_LEVEL
invoke KeGetCurrentIrql
; returns PASSIVE_LEVEL or DISPATCH_LEVEL

; Do our memory copy here?

; Raise it back
lea eax, DummyIrql ; storage for returned value, we won't use
invoke KeRaiseIrql, OldIrql, eax
invoke KeGetCurrentIrql
; returns IPI_LEVEL

Btw, This ignored the DDK, again from Oney:
-----------------------------
The DDK documentation says that you must always call KeLowerIrql with the same value as that returned by the immediately preceding call to KeRaiseIrql, but this information isn’t exactly right. The only rule that KeLowerIrql actually applies is that the new IRQL must be less than or equal to the current one.
-----------------------------

The one possible caveat to lowering the Irql is that something other than the page fault(s) we want to occur might interrupt the mem copy, so ExAllocatePool should likely be done beforehand, then raise the Irql again as soon as possible:
-----------------------------
It’s a mistake (and a big one!) to lower IRQL below whatever it was when a system routine called your driver, even if you raise it back before returning. Such a break in synchronization might allow some activity to preempt you and interfere with a data object that your caller assumed would remain inviolate.
-----------------------------

It makes sense now that the error is probably coming from the source buffer side of things (generally pageable user code), and not the destination buffer (non-pageable allocated memory):
-----------------------------
Paged pool.
Driver routines running below DISPATCH_LEVEL IRQL can use a heap area called paged pool. As the name implies, memory in this area is pagable, and a page fault can occur when it is accessed.

Nonpaged pool.
Driver routines running at elevated IRQLs need to allocate temporary storage from another heap area called nonpaged pool. The system guarantees that the virtual memory in nonpaged pool is always physically resident. The device and controller extensions created by the I/O Manager come from this pool area.
----------------------------------------------------------

So it sounds like either page everything in before copying or temporarily lower the IRQL.
crUsAdEr
04-09-2004, 02:40 AM
So it sounds like either page everything in before copying or temporarily lower the IRQL

I was thinking of altering the iceext implementation a bit, instead of copying dump to a nonpagedpool then later save to file, we can schedule a file dump with context pointer, then we skip the nonpagedpool alltogether, on sice exit, before dumping, switch context, dump then switch context back...

Seems complicated :/... looks like dumping is a user-mode job really :)... a quick look at ntdump sourcecode also suggests that it can only dump @ IRQL less than 2 only... ah well, with !suspend, we can always use LordPE and avoid the ugly EB FE
evaluator
04-09-2004, 03:07 AM
probably for be safe, before copying memory Sten uses MmIsAddressValid.
check it, then ..
Clandestiny
04-09-2004, 04:28 PM
Hi Kayaker,

Just wondering, do we really need a NonPagedPool for dumping? I thought Windows should be able to handle paging by itself since we are dumping at Dispatch Level...

In an SI extesion, you will need to do all memory allocations from the non paged pool. Consider the fact that SI can be arbitrarily entered at any point in time. As such, no guarantees can be made regarding the state of the system.

There are 3 execution contexts for kernel mode code.

1. Trap or Exception context - normally when a ring 3 app makes a request of a kernel mode driver by "trapping" into kernel mode. In this case, the context is equivalent to the user code that caused the trap. Therefore, the kernel mode code sees memory as it is seen by the user mode requestor. Dispatch routines would run in this context.

2. Kernel mode thread context - can make no assumptions about current processes, threads, or memory.

3. Interrupt context - because the interrupt can occur asynchronously and at any time, the context of the code executing at the time of the interrupt is arbitrary. Code running in interrupt context therefore can likewise make no assumptions about the state of the page tables or current processes / threads.

What you are dealing with in an SI extension would be essentially interrupt context because you can make no assumptions about anything, including the IRQL level of the code that was just interrupted when you entered SI. Because no assumptions can be made regarding IRQL level, you will be very limited in what you can do.. You may or may not be running at or below Dispatch level so basically you will have to assume that you could potentially be running at the highest IRQL level and obey all restrictions. The only memory that will be available to a driver at this level will be the non paged pool (remember no assumptions can be made about the page tables). Also, it should be noted that a driver must be executing at or below DISPATCH_LEVEL to allocate or free even non paged memory. In order to get stuff done, an SI extension will have to delegate & synchronize a lot of stuff with kernel threads (which are running at passive level IRQL).

Cheers,
Clandestiny
Kayaker
04-10-2004, 06:13 AM
It looks like lowering the Irql isn't going to work in practice. Softice has its own exception handler built in for just this scenario, when you try to access a page not paged in you get:

Extension aborted: A page fault at CS:EIP %04x:%08x occurred when address %08x was referenced SS:EBP %04x:%08x

If you were to comment out the exception handler in IceExt which covers the RtlCopyMemory call, you would probably see this default Softice one come up instead. It points exactly to the faulting MOVSD instruction and exactly to the non-paged in address where the fault occurred. You can exit gracefully afterwards.

Even if I lower the Irql before copying, the extension is aborted outright by Sice, so there's no chance of the page fault being handled properly anyway. Plus there's no way to raise the Irql back to what it should be and all that happens is a nice BSOD.

The only way I could get a successful full dump of notepad was, as crUsAdEr mentioned, to first either scroll down in the data window to page in each section that showed as NP by the PAGE command, and where necessary use the PAGEIN command.

As for paging in programatically, the PAGEIN command in Softice points us back to the same problem:

c_PAGEIN_
...
call pGetIRQLLevel
cmp eax, 2
jb short loc_19F36
push offset aIrqlMustBeBelo ; "IRQL must be below DISPATCH_LEVEL to page in memory"

Boooo...

Using MmIsAddressValid would be a good idea to test each page, at least to inform the user, unfortunately it can't be used within an extension either:
Callers of MmIsAddressValid must be running at IRQL <= DISPATCH_LEVEL.
Clandestiny
04-10-2004, 08:53 AM
Seems complicated :/... looks like dumping is a user-mode job really :)... a quick look at ntdump sourcecode also suggests that it can only dump @ IRQL less than 2 only... ah well, with !suspend, we can always use LordPE and avoid the ugly EB FE

You have a point there with the !suspend... Clearly due to the elevated IRQL you can't do much in the SI extension if the memory is not paged in already... But couldn't you *programatically* suspend the process and then queue it out to a kernel thread (runs at IRQL = PASSIVE LEVEL). You should have access to the process environment block (PEB = fs+30). I don't know all of the undocumented fields, but there may be some way to set the process to a suspended state manually.

Cheers,
Clandestiny
crUsAdEr
04-10-2004, 04:33 PM
Sure Clan,

Instead of scheduling the buffer and length for dumping, we can also pass PID or context of file to dump, then use ZwOpenProcess, ZwReadVirtualMemory but then i just feel that defeat the purpose... might as well use ring3 app like LordPE which is real good at what it is doing already :)
crUsAdEr
04-11-2004, 01:44 AM
Hey Clan,

1. Trap or Exception context - normally when a ring 3 app makes a request of a kernel mode driver by "trapping" into kernel mode. In this case, the context is equivalent to the user code that caused the trap. Therefore, the kernel mode code sees memory as it is seen by the user mode requestor. Dispatch routines would run in this context.

This means if we enter sice via a Breakpoint on a ring3 app, we will be @ IRQL==PASSIVE_LEVEL?
I think entering sice via hotkey, we will be @ IRQL==DISPATCH_LEVEL because sice pops up via DISPATCH_INTERNAL_DEVICE_CONTROL???
Sten
04-11-2004, 03:55 AM
This means if we enter sice via a Breakpoint on a ring3 app, we will be @ IRQL==PASSIVE_LEVEL?
I think entering sice via hotkey, we will be @ IRQL==DISPATCH_LEVEL because sice pops up via DISPATCH_INTERNAL_DEVICE_CONTROL???

Current !DUMP command implementation does not support paged out memory. RtlCopyMemory generates an exception when trying to access such pages.

I try to copy memory being dumped to temporal buffer and dump it later when you have exited from SoftICE. This needed to avoid possible memory modification prior it's being dumped.

The solution to support paged out memory seems do not copy memory when SoftICE is active, but suspend process being dumped (all it's threads) dump memory from worker thread and then resume process again.

There is no way to access paged out memory when SoftICE is active since SoftICE itself executes on a hiest IRQL (for ex. when APIC is available, SoftICE sets Task Priority to 0FFh, then do some low level programming and lowers it to 0EFh to allow some IRQs it needs).
Clandestiny
04-11-2004, 03:22 PM
Hey Clan,
This means if we enter sice via a Breakpoint on a ring3 app, we will be @ IRQL==PASSIVE_LEVEL?
I think entering sice via hotkey, we will be @ IRQL==DISPATCH_LEVEL because sice pops up via DISPATCH_INTERNAL_DEVICE_CONTROL???

The context refers to what assumptions about memory / current processes the driver can make. I don't think the execution context has a direct relationship to driver IRQL level. The user app would be executing at IRQL PASSIVE_LEVEL because all user threads execute at that level, but when the bp is hit, that doesn't mean that SI will also be executing at that IRQL. This how I understand it anyway... I'm not an expert on driver development by any means... Just trying to learn myself :) What Sten said about SI executing on the highest IRQL makes a lot of sense though since the definition of IRQL implies that code executing at a high IRQL cannot be interrupted by code at a lower IRQL. SI must be able to freeze the system and if it were not executing at the very highest IRQL, then it could be interrupted other code.

Cheers,
Clan
crUsAdEr
04-11-2004, 08:37 PM
Thanks guys... i was a bit confused by !irql command output... i realised that it actually output the irql of the popup client context, not irql of sice itself...


Crypkey (again)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Crypkey (again)
PDA

View Full Version : Crypkey (again)

Cobra
04-06-2004, 12:04 AM
Please excuse me for being so stupid but I just can't figure out how to find
the master and user keys.Everything I've read so far say's that they are in plain text in the target.The program is protected with Crypkey v5.4 .Please tell me what I should be looking for.
peterg70
04-06-2004, 08:16 AM
Look for functions that are called in the program.
The keys are sent to the DLL to verify the parameters needed.
Typically they are in plain sight in the code since crypkey think they are very secure.
If they are not in the string listing try just looking at the exe itself via a hex editor etc.

peterg70

Please excuse me for being so stupid but I just can't figure out how to find
the master and user keys.Everything I've read so far say's that they are in plain text in the target.The program is protected with Crypkey v5.4 .Please tell me what I should be looking for.
squidge
04-07-2004, 01:39 AM
Also try dumping the program and searching through the dump for the keys just in case they decided to run another exe protector over the top.

Please excuse me for being so stupid but I just can't figure out how to find
the master and user keys.Everything I've read so far say's that they are in plain text in the target.The program is protected with Crypkey v5.4 .Please tell me what I should be looking for.
Cobra
04-07-2004, 07:24 AM
Thank you, I found them in a file burried in a windows system32 folder.Now all I have to do is find the key level and option bits.


Tiny Encryption Algorythm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Tiny Encryption Algorythm
PDA

View Full Version : Tiny Encryption Algorythm

quake_ger
04-06-2004, 05:53 AM
Maybe somebody can help me with this? (but only the decryption code)
All I know that there are loops and in every loop it add delta.
But more I don´t know. I am not really a newbie but the sample codes on the internet are only in C and I only know Visual Basic.
I don´t understand C/C++.
Can somebody explain it to me or give an address where I can find a Visual Basic code?
Donan
04-06-2004, 05:07 PM
http://www.ftp.cl.cam.ac.uk/ftp/papers/djw-rmn/djw-rmn-tea.html

http://www.google.com/search?hl=pt&ie=UTF-8&oe=UTF-8&q=%22tea+encryption%22+vb&lr=

;)
mike
04-07-2004, 07:02 AM
James 1:5 If any of you lack wisdom, let him ask of [Google], who giveth to all men generously and without finding fault, and it shall be given to him.
:D
quake_ger
04-07-2004, 01:03 PM
thx Donan


ASProtect 1.2x [New Strain] -> Alexey Solodovnikov
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect 1.2x [New Strain] -> Alexey Solodovnikov
PDA

View Full Version : ASProtect 1.2x [New Strain] -> Alexey Solodovnikov

SAM2004CN
04-06-2004, 12:08 PM
I am trying to unpack some prog (Name of Target Deleted). Loading it in PEID gives me that it's packed with the following protector:

ASProtect 1.2x [New Strain] -> Alexey Solodovnikov

I failed when i tried "stripper 2.07f" on it. could you tell me how to unpack
it. thanks. i want the detail .tell me how.
sam2004cn#msn.com ==my Email adress!

Thanks JMI. I got it I will do what's you suggest...
JMI
04-06-2004, 01:17 PM
SAM2004CN:

This is not the way we do things here. You are not supposed to post the link to the target and then ask someone to do the work for you. You need to read the FAQ. All you've done is try someone else's tool and failed. There are many, many threads here on unpacking Asprotect protected files, including a good tutorial by LaBBA. Use the search button at the top of the Forums and enter "aspr and unpacking," without the quote marks.

Regards,


looking for NetSentinel Tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > looking for NetSentinel Tutorial
PDA

View Full Version : looking for NetSentinel Tutorial

flyingsilicon
04-06-2004, 01:15 PM
:confused: Hi all you nice guys,
I'm looking for some tutorials about Rainbow NetSentinel reversing.
I saw too many for Sentinel Super Pro and Pro , but there isn't any about Netsentinel.
Could you, any of all profesionals (lovely and helpfull too) friends here ,help me or show something usefull for me..?
best regards yaaa , with big amount of thanks and
FlyingSilicon :confused:
JMI
04-06-2004, 01:29 PM
I don't suppose you've tried anything obvious, like entering "Rainbow NetSentinel " in you favorite search engine and reviewing the information available on the net about the program and dongle? There's material in several languages and drivers appear to be available for you to study. That's certainly the place to start.

Regards,


Another nice (Crypto)Tool from reteam.org...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Another nice (Crypto)Tool from reteam.org...
PDA

View Full Version : Another nice (Crypto)Tool from reteam.org...

LobSang Ludd
04-06-2004, 01:33 PM
Hello there...

Since advertising of recommendable tools has become a nice tradition
on this board i would like to throw my 0002h (euro)cents in here.

nice idea, nice tool and i hope developing will go on...

slowpeople: root://x3chun.reteam.org/
fastpeople: wood://x3chun.reteam.org/tool/cryptosearcher.zip
weed://x3chun.reteam.org/different.htm

Rigartz and Auf Wiedersehen...

Save the Vinyl!
LobSang Ludd
04-07-2004, 07:04 AM
Pinky! My Glasses! Narf!
't looks like i applauded to early...
Never trust a catchy screenshot. Also gives some false alarms on XP-SP1
(crc32 in a ms-dos header?). Anyway...

Happy Eastern to all mmmembers...

Save the Vinyl!
cRk
04-08-2004, 03:24 AM
look for me great and unique tool but. there's one small problem!!.. i can't Dump files protected with Xtreme Protector (XPROT) :( this is a real challenge for all reverses .... all dumpers out there just crash .. who will be the heroe to make this dream come true ?

if you want to test out and play a little you can search for handycafe or Jazler XP that are protected with this protector.. i can't imagine more software are getting protected with this . imagine most programs wrapped with this and no tools available to defeat it


BPM doesnt stick?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > BPM doesnt stick?
PDA

View Full Version : BPM doesnt stick?

crUsAdEr
04-07-2004, 02:59 AM
Sorry folks, hope this is not breaking any rules :)... i know everyone is tired of Aspr...

As i remember correctly, when i last used DS2.7, sice was able to recover BPM even with aspr's seh trick?

However when i tried DS3.1 bpm doesnt seem to stick? Looks like the service of superbpm is still required? Has Numega remove this feature or what?


Original application and hardlock (for the last time...)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Original application and hardlock (for the last time...)
PDA

View Full Version : Original application and hardlock (for the last time...)

Fritz[]
04-07-2004, 06:40 AM
Yes, yes, I know ... HardLock was topic of discussion about 1000 times...

Sorry, I just wanna get straight answer.

Let's say that I've got ORIGINAL application and it's HardLock. Can i somehow 'clone' that HardLock so I can have 'full version' of software ?
Yes, I was searching thru forum and found many topics about this, but one says "It's can't be done, it's not easy", while other "yes, I've done it many times, ...."

Does it involves much work while 'gathering' all information from HardLock (btw, is there suck tool?) and how (theory) can I provide that information to application (with some emulator? Is there suck tool or i have to code somethin' like it) ?

Thank you, and sorry moderators for bringing this topic into discussion!

with respect,
Fr1c
nikita@work
04-07-2004, 02:33 PM
The answer is quite simple: if you have hardware function all can be done, if you don't it's impossible.

Many people have this function but it's still private...
tgodd
04-08-2004, 07:18 AM
And I do not beleive you are one of them.

;)
nikita@work
04-08-2004, 08:12 AM
And I do not beleive you are one of them.

;)

Do you hint for proofs? ;)


API on Safedisc 2.60
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > API on Safedisc 2.60
PDA

View Full Version : API on Safedisc 2.60

quake_ger
04-07-2004, 01:52 PM
I am just trying to unpack safedisc2 (Morrowind,German). I read 3 tutorials about Safedisc 2 (from Peex, quake2, ...). I fixed all APis except 4 which are not really api-functions. Is it this API Stuff how r!sc it called? How can I fix them?
I would be happy if somebody can help me :confused:
evlncrn8
04-07-2004, 02:25 PM
I am just trying to unpack safedisc2 (Morrowind,German). I read 3 tutorials about Safedisc 2 (from Peex, quake2, ...). I fixed all APis except 4 which are not really api-functions. Is it this API Stuff how r!sc it called? How can I fix them?
I would be happy if somebody can help me :confused:

not really api functions? so they're safedisc api right? aka crypted code chunks, trace into the call, and watch what it does.. quite simple
quake_ger
04-07-2004, 02:51 PM
Do you know the Routine how it comes to the "real" api?
it makes the same way but the api which comes out is no API from Kernel32.dll, User32.dll, Ole32.dll, Msvcrt.dll,... and so on. But I downloaded a Crack to compare the IAT and this API must be called from Kernel32.dll
evlncrn8
04-07-2004, 08:48 PM
Do you know the Routine how it comes to the "real" api?
it makes the same way but the api which comes out is no API from Kernel32.dll, User32.dll, Ole32.dll, Msvcrt.dll,... and so on. But I downloaded a Crack to compare the IAT and this API must be called from Kernel32.dll

then its a normal api, not sd2 api (crypted code chunks).. trace into the call using e8's, you'll see where he does the api resolve ..

what you're describing is the safedisc api wrapper, where it goes to a memory area, then into the handler, and eventually (after a while) ends up at the right api va to do the api call.. trace into it, pay attention to the registers..
quake_ger
04-09-2004, 02:29 PM
but its not a normal api. This Api doesn´t exist, what I sometimes get.

...where it goes to a memory area, then into the handler, and eventually (after a while) ends up at the right api rva to do the api call.. trace into it...

yeah I already know this. At the end is a ret. And this ret brings me to the real rva. But at 6 or 7 calls the rva doesn´t exist! but what exactly is API STuff how r!sc it called?
evlncrn8
04-09-2004, 05:23 PM
but its not a normal api. This Api doesn´t exist, what I sometimes get.

...where it goes to a memory area, then into the handler, and eventually (after a while) ends up at the right api rva to do the api call.. trace into it...

yeah I already know this. At the end is a ret. And this ret brings me to the real rva. But at 6 or 7 calls the rva doesn´t exist! but what exactly is API STuff how r!sc it called?

sd2/3 api-> 'Crypted Code Chunks' usually starts with a call, which goes into the sd routine, basically it then decrypts the bytes, sets eip to the start, executes it, then when it rets it gets crypted back up again

as for the api not existing, try tracing it again, this time only probe the api u couldnt before when u reach oep, note down the code flow, then repeat again, you'll see where he's catching you.. also remember theres anti bpm code, so be careful
quake_ger
04-13-2004, 08:52 AM
sd2/3 api-> 'Crypted Code Chunks' usually starts with a call, which goes into the sd routine, basically it then decrypts the bytes, sets eip to the start, executes it, then when it rets it gets crypted back up again

I don´t really understand it. Which Bytes will be decrypted and when? Peex wrote in his tutorial that he changed the address in esp and then he got the right address. I tryed a different way I downloaded an API spytool and tryed to find out which address will be called but I only found HeapAlloc Api´s and but not what I searched :(
evlncrn8
04-13-2004, 12:17 PM
r eip to one, trace into it, watch what happens

and 'which bytes'.. the ones were the call is.. like i said, ditch the tuts
and do some tracing, make your own notes, it'll all fall into place easier then
quake_ger
04-15-2004, 07:28 AM
It seems that 'Crypted Code Chunks' are only in SAfedisc 2.60 and above. (But why doesn´t Safedisc2Cleaner unwrapp Morrowind?)
evlncrn8
04-15-2004, 12:34 PM
It seems that 'Crypted Code Chunks' are only in SAfedisc 2.60 and above. (But why doesn´t Safedisc2Cleaner unwrapp Morrowind?)

nope, ccc's existed even in the days of sd1, theres different variations tho if i remember correctly morrowind didnt have any, keep debugging or rebuild the exe, play the game, and have faults on in sice, that way you should catch where it crashes, backtrace, see whats going on etc
quake_ger
04-22-2004, 07:35 AM
Okay, I did it :D
After debugging about an hour I found the real calls and so on.


Problem after install Borland C++Builder 5 into winxp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Problem after install Borland C++Builder 5 into winxp
PDA

View Full Version : Problem after install Borland C++Builder 5 into winxp

Gento
04-07-2004, 04:20 PM
Hello I have installed this soft into my machine with windows xp, but when i execute the main program, nothing happens

Any suggestion?

thanks from spain


Help C++ compiling
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help C++ compiling
PDA

View Full Version : Help C++ compiling

crUsAdEr
04-08-2004, 04:06 AM
OK, i wrote a function in C++ which doesn't do anything much, and here is the compiled results

.text:00013641 55 push ebp
.text:00013642 8B EC mov ebp, esp
.text:00013644 53 push ebx
.text:00013645 56 push esi
.text:00013646 57 push edi
.text:00013647 60 pusha
.text:00013648 83 3D A8 16 04 00+ cmp dword_416A8, 0
.text:0001364F 74 06 jz short loc_13657
.text:00013651 8B 45 08 mov eax, [ebp+arg_0]
.text:00013654 80 20 EF and byte ptr [eax], 0EFh
.text:00013657
.text:00013657 loc_13657: ; CODE XREF: sub_13641+Ej
.text:00013657 61 popa
.text:00013658 5F pop edi
.text:00013659 5E pop esi
.text:0001365A 5B pop ebx
.text:0001365B 5D pop ebp

The question is how do I tell the compiler to skip all the push esi, pop esi...
All i needed was the pusha and popa...

So what directive do I need?

Thanks
tom324
04-08-2004, 03:27 PM
Check compiler options and set optimization level to max.

Tom
disavowed
04-08-2004, 06:34 PM
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vccelng/htm/msmod_25.asp
TQN
04-08-2004, 09:31 PM
Hi crUsAdEr !
If you use VC++, you can declare a function with __declspec(naked). For functions declared with the naked attribute, the compiler generates code without prolog and epilog code.
Regards
disavowed
04-08-2004, 11:00 PM
tqn: see my post directly above yours ;)
crUsAdEr
04-09-2004, 01:02 AM
Thanks, disavowed and everyone else :)...
I thought it was naked something but wasnt sure :)


Need other SentinelLM Crackmes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need other SentinelLM Crackmes
PDA

View Full Version : Need other SentinelLM Crackmes

Bra!NSHiT
04-08-2004, 04:13 AM
Hi,

well i`m looking for other crackmes wich are protected with SentinelLM.
I used the search option in this board, but the result was only cyberhegs crackme. :(

It would be great if anyone could give me some Sentinel Stuff. But no SentinelSuperPro ! :D

Bye


can i buy a good protection for my application ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > can i buy a good protection for my application ?
PDA

View Full Version : can i buy a good protection for my application ?

theNewman
04-08-2004, 06:58 PM
Hi all,

sorry but i am only a lame VB6 Programmer. I know a little bit how reversers work. Now, i want to to protect a Programm a little bit.
So - i have a question to you experts.

First i want to insert a little protection by myself ( a lame one, but not mega lame ;-) )

Second and additional i want to buy a protection. So my question is, wich is at the moment the best protection on the market for a VB6 Product ?
Wich Product make it ugly hard and takes life time to crack it ?
what ?? now one ..... :-( - oh ... come on - okay .. takes some days....

I think this one is not really hard:
http://www.copyprotection.com
he he he he

but now the funny things beside, my question is really serious
Im very happy if you give me some suggestions

best regards
newman
Kayaker
04-08-2004, 07:20 PM
Hi

While I'm not specifically endorsing it one way or another, try a search for "Code-Lock Ryan" on this board, read the threads with the most posts, and make your own judgement.

There are many other protections, and many other opinions on them, which I'm sure you'll hear some.

Only coherent comments, either negative or positive will be kept. Ones like "this prot sux 3ggs man and the developer is an ahole!" will be deleted without mercy...

Kayaker
dELTA
04-08-2004, 08:39 PM
Actually, I've heard that Code-Lock sux 3ggs, and that Ryan is quite the ahole. :D
Woodmann
04-08-2004, 08:47 PM
Ummmmmmmmmm......

I think his protector is PFG.

Woodmann
disavowed
04-08-2004, 09:11 PM
First i want to insert a little protection by myself ( a lame one, but not mega lame ;-) )

Second and additional i want to buy a protection. So my question is, wich is at the moment the best protection on the market for a VB6 Product ?if you want to buy the best protection, why would you want to also implement your own additional protection? if you think what you buy is going to work, then there's no point in adding something yourself. if you think what you buy isn't going to work, then why bother buying it?
theNewman
04-09-2004, 02:35 AM
@disavowed

i think two different protections safer then one. i will not do this crypting and antidebugger stuff by myself. but this should be the first difficult. if this level killed then my little stuff should stand as long as possible. i think a good way of some protection is to generate a lot of work, really big work that not can jumped over to the end and looked there what is the key because its allover a part of the application.
I know there is no 100% secure

Best regards
Juergen


Borland Builder Exceptions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Borland Builder Exceptions
PDA

View Full Version : Borland Builder Exceptions

RottenFish
04-08-2004, 11:01 PM
Hi all reversers out there, btw, first post in here, what a cool place I´ve found!! thanks google!! :)

Now to the problem... I have a copy of BB6 Enterprise Edition installed on my comp at home. Is not a "legal" one, is a copy. Sometimes I have lots of exceptions, mostly when I load some project. This exception happen always in some DLL of BB6.

So, I wonder if this happening only because my BB6 is an "alternative" version, or BB6 is too buggy??

I played a lot with former version BB5 and never had a problem like this.


Which tool is better for packet sniffing/modifying?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Which tool is better for packet sniffing/modifying?
PDA

View Full Version : Which tool is better for packet sniffing/modifying?

RottenFish
04-08-2004, 11:18 PM
hi all reverser gurus.

Im reversing a multiplayer server of a very well known game.

Im interested mainly in comunication protocol between client/server. I decoded almost 90% of protocol, now I want to change some packets and send it back to server to see what happens.

Im using Clearsight for packet sniffing but I´ve found not too much useful cause I can´t modify packets, only watch them.

So, here is the question, which tool should I use to sniff this thing??
disavowed
04-09-2004, 02:15 AM
if you want to modify packets on the fly and have it be very customizable like
"if *(header+0x10) == 0x6E then *(header+0x4C) += 0x08", then you're probably best off coding your own tool with winpcap.

if you're just looking for passive sniffers though, iris (www.eeye.com (http://www.eeye.com)) and/or ethereal should suffice
anormal
04-09-2004, 12:49 PM
hi!

have you seen C0mmview of Tam0soft?, i 've used it for years and works great for me

regards!
peterg70
04-10-2004, 01:53 AM
Best approach to modifing packets for those sort of games is to create a simple program that accepts input packets and passes them on to the internet

That way you configure the game to connect to your interface which then handles the packets being transferred between client and server. Similiar to a Proxy Client. If the client won't let you connect to the local machine then use a lan and connect to another machine which has internet access. That way you can easily decompile the packets.

Note that these packets typically have checksums associated with them. Best way is to slowly tweak the specifications as requried while recalculating the required checksum.
anormal
04-11-2004, 01:27 PM
umm, i forgot about an app called "PacketForge" by famous Aphex,

try to find it in iamaphex.cjb.net

regards friends!
Aquatic
04-11-2004, 07:02 PM
I recommend WPE PRO 0.9A (XP)

You can get it here: http://membres.lycos.fr/tsearch/cheattools.html

Don't use 1.3 if you have XP, 0.9A is the latest for XP.

From the help file:

If you have a packet like this :
04 BB 04 00 00 00 06 00 08
and you want increase or decrease for example the byte in position 7 (byte = 06) by one each time a packet is sent:
-right mouse button on a packet logged,SEND
-double click or press INSER on the byte at the position 7(it will be show in red) and press play as usually
-wpe will send packet :
04 BB 04 00 00 00 07 00 08
04 BB 04 00 00 00 08 00 08
04 BB 04 00 00 00 09 00 08
etc...
for decrease set the step at -1
RottenFish
04-12-2004, 09:17 PM
Thanks for all advices guys, it saved me lot of time!! :)


Packed and probably self-checking. Help needed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Packed and probably self-checking. Help needed
PDA

View Full Version : Packed and probably self-checking. Help needed

rokafeller
04-09-2004, 06:49 AM
Hi,
I'm on a small program which is a "timer" for pc (shut down at certain time).
You can run it 100 times, then nag appears. I discovered that it places a reg key to take count of # of executions. It also was packed, I unpacked it (PEpacker). Then found the JLE where there's the check of executions and patched. The program runs but.. some functions are altered! for example, it does nothing instead of shutting down at the set time.
I also tried to repack it after patching.. some functions are back but completely. I think somewhere it checks its length... have you any suggestions?

Thanx
rokafeller


"Systemwide Windows Hooks without external DLL"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > "Systemwide Windows Hooks without external DLL"
PDA

View Full Version : "Systemwide Windows Hooks without external DLL"

disavowed
04-09-2004, 09:05 AM
This article is about a year old, but the information contained in it is new to me. Maybe some of you will also find it interesting:

http://rattlesnake.at.box.sk/newsread.php?newsid=193
JimmyClif
04-09-2004, 09:48 AM
What does declspec(dllexport) do ? Have to wait to get home to have a look at that.

Another way would be to use PEBundle :p

Thanks for sharing, disa!
disavowed
04-09-2004, 05:12 PM
allows you to export functions from an .exe

check the exports of system32\ntoskrnl.exe to see an example
evaluator
04-10-2004, 01:32 AM
ntoskrnl.exe is DRIVER:)

>allows you to export functions from an .exe
good.
greatly helps when EXE will loaded as library by other process.

>check the exports ntoskrnl.exe
ntoskrnl.exe is DRIVER:)
mmk
04-10-2004, 07:41 AM
>check the exports ntoskrnl.exe
ntoskrnl.exe is DRIVER:)

But a driver can also export funcs/vars. If you check ntoskrnl.exe you'll see that its export dir is present. Other drivers can link to it.
evaluator
04-10-2004, 12:39 PM
what then?
ntoskrnl.exe is driver.


ds 3.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ds 3.0
PDA

View Full Version : ds 3.0

zao
04-10-2004, 10:57 PM
hi i am a newbie to cracking.. and just installed ds 3.0 after having problems with 2.7 not showing up for me.. anyways when ever i start softice it locks up the comp but i can hit ctr-d and it says waiting for remote debuggin and sits there forever..

i am using winxp sp2 rc1 i know that may be causeing some problems with it.. is there a version that works have decent with windows xp..
Djony
04-11-2004, 10:46 PM
Maybe you should look for some options in initialization settings (Why not deactivating remote debugging or remote acces ?).Anyway, I have DS 3.0 on XP+SP1 and it works fine, so if you can't do anything about current problem: back to SP1!

P.S. Sorry for my bad english.Are you really "tako zao" or not?Maybe "samo rdjav"? :D
evaluator
04-12-2004, 03:36 AM
run full-instalation.
zao
04-12-2004, 06:03 PM
i did disable the remote debugging.. anyway i am going to reinstall it and see if that helps..

Are you really "tako zao" or not?

no clue who tako zao is.. i am just zao..
zao
04-12-2004, 06:59 PM
well i got it all working now.. i ended up installing 3.1 i the 3.0 version i had wasn't full or something..


M.sc in security(RE,...)?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > M.sc in security(RE,...)?
PDA

View Full Version : M.sc in security(RE,...)?

akimp3
04-11-2004, 04:19 AM
Hi

I Was wondering if ther is any university in France that i can continue
my studies. I have a BsC in computer and i want to pursuit my studies
in Security.Any comment would be appreciated.

Thanks in advance

akimp3
Aquatic
04-11-2004, 07:18 PM
Most Universities list courses on their websites.

Your best bet would be to speak to an academic advisor at your Uni.


flex + hareware key???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flex + hareware key???
PDA

View Full Version : flex + hareware key???

ramin_rad2000
04-11-2004, 08:31 AM
:confused: Have you ever encounter a security system with "hardware key + flexlm"??
i found [downtvdd.dll ds1410d.sys keyread.txt] files somewhere like: programpath:\lmsetup\licmgr\xxxxslm1 where xxxx is the application name.
I have cracked the calls for hardlock key and program works fine with normal capabilities but it has several disabled capabilities too,and i don't know what to do with them.... :( :( any hint????
there is nothing like lmgrv or [flex stuff] ,so i can't understand what kind of security is this?! :confused:
CrackZ
04-12-2004, 04:59 PM
Hiya,

FLEXlm can interface with hardware locks via the FLEXID switch on the license line. Those that Macrovision support are HASP/Sentinel & what you have drivers for, the DS (Dallas SemiConductor iButton) device.

You don't really say whether the iButton works separately from FLEXlm or whether there is actually FLEXlm in the protection scheme, does lmver report anything? for example.

Its really difficult for anyone to help you much further from the scant information provided.

Regards

CrackZ.


unpacking secuROM 5.00.3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking secuROM 5.00.3
PDA

View Full Version : unpacking secuROM 5.00.3

sHice
04-11-2004, 06:55 PM
hi
i tried to unpack a game protected with secuROM 5.00.3 first i dumped the exe at the oep and then i coded a callfixer which replaces every secuROM call with the correct api call.when the call fixer had done his job i dumped the .text section with the correct calls and replaced the .text section of my first dump with the fixed .text section.next i started the game and everything worked just fine but when i wanted to load a savegame *bang* i was back on my desktop ... it happened what i had thought would happen.the game tries to call an api which my call fixer couldn't fix cause i didn't try to load a savegame when my callfixer was active.to solve that problem was easy i started my callfixer again and this time i loaded a savegame then dumped the .text section replaced it everything was fine in my new dump.but what can i do if the game wants to call an unresolved api in the middle of the game?? i can't play the whole game with my callfixer :( any solutions for this !?
thx
doug
04-11-2004, 10:35 PM
code something that scans through the code section for every call patterns that lead to securom's handler.
nikita@work
04-11-2004, 11:01 PM
code something that scans through the code section for every call patterns that lead to securom's handler.

or spend some hours and reverse common dispatcher where Securom resolve real addr by first value on stack (return address) and big table... and pay attention on WinAPI calls with speacial values in registers - securom handle it...
evlncrn8
04-11-2004, 11:55 PM
and watch out for those evil timers
ooo and triggers too
sHice
04-12-2004, 06:11 PM
ok thx .. another question:how can i fix my fixed securom calls so that the program is able to run on every pc ? for example call [00800000] and 00800000 holds the address of GetVersion but this will only work on my pc :/ i read that procdump can do this job but when i try to open the exe procdump says "error while accessing the file (READ/WRITE)" is there another tool that can do this ?
thx
evlncrn8
04-12-2004, 09:17 PM
ok thx .. another question:how can i fix my fixed securom calls so that the program is able to run on every pc ? for example call [00800000] and 00800000 holds the address of GetVersion but this will only work on my pc :/ i read that procdump can do this job but when i try to open the exe procdump says "error while accessing the file (READ/WRITE)" is there another tool that can do this ?
thx

thats called rebuilding the imports, code a tool to do it, it isnt that hard or use some import rebuilder, if you're having problems like that at this stage, securom might be slightly out of your league skill wise
sHice
04-27-2004, 11:04 AM
or spend some hours and reverse common dispatcher where Securom resolve real addr by first value on stack (return address) and big table... and pay attention on WinAPI calls with speacial values in registers - securom handle it...

ok i coded a call searcher and i found 178 securom calls.then i jumped to every call i had found to see which api the call causes but it seems that it were the wrong apis sometimes :( so you think that it also depends on the values in the registers at the time the securomcall is called ? i'm not sure what you mean cause my english is not that good sry :/

thx!
nikita@work
04-28-2004, 11:35 AM
so you think that it also depends on the values in the registers at the time the securomcall is called ? i'm not sure what you mean cause my english is not that good sry :/
thx!

Application can call WinAPI functions with special values in CPU registers... SecureRom check is that function "hooked" (by the same table as it get original function addr) and then check (by another table) values of registers. Also the secont table contains value how complete this call (e.g. return constant).
swoop
04-29-2004, 03:44 AM
And be aware of API calls which don't start at the beginning
of the API function. Most protections "emulate" stack
handling and stuff like mov ebp,esp right before they
jump into the middle of an API function...
SkUaTeR
05-06-2004, 03:13 AM
ok i coded a call searcher and i found 178 securom calls.then i jumped to every call i had found to see which api the call causes but it seems that it were the wrong apis sometimes :( so you think that it also depends on the values in the registers at the time the securomcall is called ? i'm not sure what you mean cause my english is not that good sry :/

thx!

ok they are correct but securom make checks of time to determine if you are rebbuilding the game if it assume you are rebuilding a game they return a random values.

i supossed you hook the return of the wrapper to obtain a correct api
if you hook before of the jump to the api you see the pointer to the iat
and you use it and dont need to use pe rebuilder .

and the securom v5 have more of one wrapper they have a big MainWrapper in this they return the true api and check for the triggers and execute it.

and the rest of the wrappers only return the true api.

if you patch the wrapper to avoid the crc checks and the time checks you should know the mainwrapped is copy to varius locations in memory and the game call to this memory and the code of the memory return to the mainwrapped on the executable to make a jump to the true api
you should locate the mainwrapped advance this is copied to memory apply the patch to avoid the crc checks and time checks and then run your rebuilder routine.

if need more info question here .

regards

PnD.
sHice
05-06-2004, 07:40 AM
i discovered the iat in the memory and i saw that it has 3 values that are no apis(00 00 00 00 | 00 00 00 00 | 00 37 10 40).these values were returned to 3 calls when i tried to rebuild the game by running my routine... so the following apis went wrong too.so i think the game assumed that i was rebuilding it.i took a look how securom decides which api is the right for the call and i think it works like this:
00611D8A call [securom]
and then it generates the address of the api in the iat of 00611D8A+2=00611D8C but i couldnt see how it depends on the registers but i might be wrong i'll have another look at it ..
and where does it make the crc checks and the time checks ? is it in the same call that causes the api ?

thx
SkUaTeR
05-06-2004, 09:45 AM
and where does it make the crc checks and the time checks ? is it in the same call that causes the api ?

thx

Yes the crc and time checks are taken in the same call that return to the true api.

you have varius method to avoid the fake api return , you can locate a counter of number of apis rebuilders on the routine and set to 0 and at the time to rebuild a api you can call sleep for a seconds . i hope with this method you can rebuild the entire apis.

but the best method is locate the checksums and the time checks
plz use ida and dissasemble the main wrapper routine and look in it.
you only need apply 2 or 3 patches to the wrapper and the problem is out...

regards
Timbo
05-07-2004, 10:13 AM
Seems Nobody seen SecuRom5 (eg. a game called HIT.. PART3)
there are no more Timers (haven't seen so far) like in older ver$ or
API address finding on runtime !

Now there were only stolen bytes with API call inside.
The call were like

push staus register
mov status register, address of stolen whatever
push status register
ret

or

push SR
mov SR,ADDRESS
CALL [SR]
ADDRESS_BYTES:00,00,00,00
...

and so on

Well pretty funny, last time i unpacked securom it was the 2 PART of the Game
sHice
05-07-2004, 04:40 PM
ok i'm done :cool: i found the position where securom fucked up the real addresse of the api in the iat by doing the following:
sub eax,edx ; eax holds the address of the api in the iat and edx = 0000000C
so all apis get shifted .. just a 2 byte patch like SkUaTeR said :p tnx for all your help !


A (beginner) beginner
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A (beginner) beginner
PDA

View Full Version : A (beginner) beginner

Chessmaster
04-12-2004, 02:18 AM
hello everyone, perhpas you dont see much of people like me, but i have trouble getting softice to work.

i am using windows xp with all the newest updates

i already have the softice patch for windows xp and softice is loading at startup.

the problem i currently face is that any command i type in, it says that it doesnt have the symbols, what should i do?
crUsAdEr
04-12-2004, 02:48 AM
click on the FAQ link above.. and do it quick before you get banned!!! next time learn the house rule before posting... :)
Chessmaster
04-12-2004, 02:53 AM
sorry, but i dont know what you mean
crUsAdEr
04-12-2004, 02:56 AM
There is link to FAQ on the menu row on top of this page!!!
Kayaker
04-12-2004, 03:28 AM
hello everyone, perhpas you dont see much of people like me,

Bets? ;)

Hi, now that you've read the faq and logged off probably scratching your head and none the wiser... The "house rules" are simple. Begin with a search on this board using the Search function with some logical keywords to try to find the solution to your problem. "Symbol not defined", which is the error message you got, is a good start. Reading the Softice manual and learning about loading "symbols" is another good one.

This is simply a gentle lesson in the first step to the wild and wonderful world of RCE, learning to search for answers, your greatest asset. You *should* be able to figure this one out if you persevere. If not, don't be afraid to ask since this is the newbie forum after all.

Kayaker


A Good Api monitor tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A Good Api monitor tool
PDA

View Full Version : A Good Api monitor tool

vTeit
04-12-2004, 03:27 AM
A Good Api monitor tool.

http://www.autodebug.com
mambox
04-29-2004, 10:00 AM
..if not one of the best api monitor currently avail!
Alorent
04-29-2004, 01:30 PM
Wowww, that's a great tool!

Thanks for the link.

Regards,
Alorent


ds 3.1 win2000 not breaking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ds 3.1 win2000 not breaking
PDA

View Full Version : ds 3.1 win2000 not breaking

jpfeffer
04-12-2004, 12:54 PM
All,

I am having some issues with softice. I used 4.05 but had no luck getting it to work correctly on win2000 adavanced server. video issues, I suspect.

I then used 4.27 and it was better, usually if I did a clean install it would work correctly until I rebooted, then no more.. Ctrl D didn't pop up a think or.. if it did pop up setting breakpoints was useless. It never would break.

I recently downloaded Driver Studio 3.1, and now the Ctrl D seems rock solid. I seem to always get a popup.. Great.. Except that it doesn't seem to be hooking the API.. Setting things like GetDlgItemTextA or GetSystemTime do absolutely nothing. At the moment it is set to manual start, but I have tried other settings.

The install was from a full install of DS 3.1, I have looked at the patches on the vendors site, and even tried a couple of them, even though they were supposed to apply to ds 3.0 only.

Being somewhat new to the software, I am a bit confused about what to even look at. By the way it is running on a muli boot machine (Inspiron 8100 laptop)

Any ideas why it is not hooking into the api? or does it sound like someting else?

Thanks
dELTA
04-12-2004, 01:00 PM
Search the board for "softice context sensitive breakpoints" and see if that helps you (also info about it in the FAQ).

Also, some packers/protectors prevent API breakpointing by emulating the first couple of bytes in several APIs...
JMI
04-12-2004, 02:44 PM
There is also an option on the 3.1 version to set or not set context sensitive breakpoints.

You will find that thread here:

http://66.98.132.48/forum/showthread.php?t=5470

Regards,
jpfeffer
04-12-2004, 05:12 PM
Thanks for the tips.. I had already done a significat amount of searching prior to posting.. I did follow the advice and did the search again just to make sure.

I haven't not found anything that addresses my problem. I am using 2k advanced server and xp sp1, both with the same problem.

I have set the context sensitive to the previous versions behavior.. Still no change.,.. So for the moment, I am taking a break.. my head is sore from all the banging against the wall. LOL

Once I get into softice. .ctrl d then use the addr command and use winzip32 for example.. softice no longer says idle it says winzip32.. ctrl d back to hit enter on the reg code.. and then it says wrong code. softice never broke. ctrl d back.. and it is idle..

Running it through the symbol loader complains no symbols for winzip32, but did I want to continue loading,, yes,.. then softice pops su and says break due to symbol loader. ctrld back to app. hit enter on the reg screen, and again no breaks.

Even using GetSystemTime and then opening the clock on the taskbar doesn't pop up softice.

p.s winzip is 8.1... once in a great while on a magical reboot, softice does pop up correctly.. It is just inconsistent..

Thanks

Thanks for the ear
Aimless
04-13-2004, 12:01 AM
1. Maybe Winzip32 does not use dlgbox or messagebox (try using a resource editor to see whether the nag screen/error message is a custom made resource rather than default windows API)

2. Maybe winzip 8.1 is ice sensitive and contains anti-debug tricks?

Hae Phun
.:hack3r2k:.
04-15-2004, 03:11 PM
Tip:

Put a breakpoint at entrypoint (be sure to type first bpint3 in sice), start the program and when it breaks start puting breakpoints for the apis u'r interested to spy. After that replace the CC byte with the original one and press F5. Each time a function u'r bp sice will popup.

Br;)


Teach yourself programming...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Teach yourself programming...
PDA

View Full Version : Teach yourself programming...

TBone
04-12-2004, 04:01 PM
...in 10 years:

hxxp://www.norvig.com/21-days.html

I don't recall where I encountered this, but I thought y'all might find this pretty funny, and pretty true.
DaddyJTHC
04-12-2004, 06:29 PM
Thats about true thou.


Windows DRM and WMV
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Windows DRM and WMV
PDA

View Full Version : Windows DRM and WMV

peterg70
04-12-2004, 07:54 PM
I think I have put this in the write forum

Latest Bug bear for me is DRM WMV files

I Download a WMV file from a website (Not porn) and went to open it and Media player informs me to update my DRM. Well there is no way I am updating anything microsoft wants me to.

Went looking on the net and found a software which will remove the DRM from wma but not wmv. The problem is you still need to get a license.

Anyone with some more info, technical papers etc.

@Mike This seems to use a fair bit of encryption that why I put it here. Have you had a go at it?

Cheers
Peterg70
JMI
04-12-2004, 08:17 PM
Hey peterg70:

Re-read your first sentence. :eek: I see you have caught that problem which often attacks my typing, where your brain thinks one word and your fingers "write" another. It's good not to be alone. :D

Regards,
mike
04-13-2004, 01:57 AM
Sorry, I haven't looked at it at all.
Tolstoinisten
04-21-2004, 04:05 AM
Went looking on the net and found a software which will remove the DRM from wma but not wmv.
You are probably thinking of this site

hxxp://home.wanadoo.nl/lc.staak/freeme.htm

If not, it makes for an interesting read, and perhaps it will help you..?

Cheerz,
peterg70
08-30-2004, 10:39 PM
Seems this is getting more popular out on the net.

Would be good to start looking at this sort of thing. Anyone who any info or links PM them to me.

Regards
Peterg
br00t_4_c
09-11-2004, 08:39 AM
I like how peterg70 first qualified his post by saying "(not porn)". Heh. That's what they all say. :D

Anyhoo, this page has a little primer on the topic:

hxxp://www.ntta.szm.sk/Tutors/DRMPrnc/DRMPr.htm

Hope that helps...


Armadillo Hang
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Hang
PDA

View Full Version : Armadillo Hang

jandis
04-12-2004, 09:30 PM
Before I begin, I'd like to say I searched the forums and read the FAQ (I know you looked at my post count! :D ) I also read the arma tut found on zilot's page and have read numerous other armadillo tutorials.

So, I use olly, load up the arma app (v3-3.6?), hide the debugger, then bp on WriteProcessMemory. Yes I am using windows xp and im using olly. If i run the program with the bp it just hangs on "Running" and nothing happens at all, the program doesnt appear nor does it terminate. Now I read zilot's tut and it said try GetVersion before WriteProcessMemory because it can detect breakpoints. That worked to no avail too. If I dont set a breakpoint on GetVersion or WriteProcessMemory then I am presented with the common 2 INVALID LOCK SEQUENCE errors, but after that it terminates itself. I even tried catching the isdebuggerpresent check after the 2 lock sequence errors, maybe hoping to bypass the breakpoint check, but nothing.

So my question is, does Armadillo have a new protection to where a new approach is needed? Or does it have a new debugger check (like it had for sice) that it has for olly?

Thanks for the help and hopefully I didn't miss a post which covered this already :X

[edit] to hopefully help you out I tried this on the latest versions of getright and hypersnap (maybe that will help you deduce which version this is of arma, I am in no way asking how to directly unpack/crack these specific apps)

[edit2] I also tried other olly detecting techniques like FindWindow(class name etc..) and the combo of CreateToolhelp32Snapshot, Process32First, Process32Next, GetCurrentProcessId. Maybe its doing a fs:[20] check?

Lol all i know is bp IsDebuggerPresent and using the olly hide debugger option arent working :X
Ricardo Narvaja
04-13-2004, 04:15 AM
Put hardware BPXS on apis and will be not detected.

But i think many reads olds tutes of getright and lydia but there are new versions of armadillos and new tutes too, but only in spanish, the last hypersnap, is a new version of ARMADILLO WITH TABLE DESTRUCTION, and is very different of old tuts is very important look what tut can be for each version.

I.m working in the new armadillo with iat destruction i wrote the tutes, when i go resolving parts

tuts 203-204-205-206 are of new armadillo HYPERSNAP

t think in 207 will be finalized and ended (jeje i think is very tricky this new arma)

Ricardo
Ricardo Narvaja
04-13-2004, 04:19 AM
The new armadillo detects softice installed, use or not use, charged or not charged not run with softice installed, with ollydbg not change detection at all only IsDebugPresent nothing more.

Ricardo
jandis
04-13-2004, 12:59 PM
The words from the master himself! Thanks a lot Ricardo, I will definitely try this out when I get home. Seems as if I was thinking a little too hard and was beatin around the bush.
%UNDEFINED%
04-13-2004, 08:14 PM
This is the method I use to break on all API's in Armadillo
jandis
04-14-2004, 07:32 PM
Thanks for the help undefined and ricardo. Interesting though, I think I found another variant of copymem because the 2nd breakpoint on WriteProcessMemory did not bring me to the OEP. Everything seemed to be working great on the 2nd break, but once I thought I was finished I was brought to:

004C2E84 3F AAS
004C2E85 B3 BE MOV BL,0BE
004C2E87 3D 955032F4 CMP EAX,F4325095
004C2E8C 26:383A CMP BYTE PTR ES:[EDX],BH
004C2E8F 99 CDQ
004C2E90 45 INC EBP

Obviously, not the OEP. So i read about the lil 1000 byte trick in another post here and read flipi's tut on it on ricardo's ftp and followed the instructions, broke on the 3rd, and towards the end again I was brought to something like the crap above, still in the arma protection it seems.

I rechecked the FAQ and I think I can post the program name in here since it doesnt violate "shows where and how to patch/keygen blah blah blah on a specific target" or any other rule. If I can i'll edit this post and add it, but for now just pm me now for the information if interested.

Btw, I dont think I made a newbie mistake because I unpacked about 3 successfully before I reached this one, Who knows.

Thanks again
Ricardo Narvaja
04-15-2004, 03:23 AM
Have ypu two proceses with the same name running when apllication is running?

There are tuts of new armadillo with table destruction but not are copymem2. if you send me de link to download this program i see

ricnar22@millic.com.ar

Ricardo

Thanks for the help undefined and ricardo. Interesting though, I think I found another variant of copymem because the 2nd breakpoint on WriteProcessMemory did not bring me to the OEP. Everything seemed to be working great on the 2nd break, but once I thought I was finished I was brought to:

004C2E84 3F AAS
004C2E85 B3 BE MOV BL,0BE
004C2E87 3D 955032F4 CMP EAX,F4325095
004C2E8C 26:383A CMP BYTE PTR ES:[EDX],BH
004C2E8F 99 CDQ
004C2E90 45 INC EBP

Obviously, not the OEP. So i read about the lil 1000 byte trick in another post here and read flipi's tut on it on ricardo's ftp and followed the instructions, broke on the 3rd, and towards the end again I was brought to something like the crap above, still in the arma protection it seems.

I rechecked the FAQ and I think I can post the program name in here since it doesnt violate "shows where and how to patch/keygen blah blah blah on a specific target" or any other rule. If I can i'll edit this post and add it, but for now just pm me now for the information if interested.

Btw, I dont think I made a newbie mistake because I unpacked about 3 successfully before I reached this one, Who knows.

Thanks again
Spec0p
05-01-2004, 06:13 PM
Well while pausing to wait if someone can help me on the other question about arma the jmps type thing on topic "armadillo 4 dummies (part 2)", i got another arma app to try it again, well i got one like jandis. Open in Olly, tried to put bpx, bp on IsDebuggerPresent, and i also tried %UNDEFINED% method, it just doesnt breaks fortunally i have airbag on my box :D
I tried to bpx GetVersion but not even that one, and i get no exceptions errors, i press F9 and Olly status says Running but nothing happens it just stays there, doesnt open windows, show messagebox or exits. So i checked task manager if he had created another process or anything, but not it doesnt only one process is active and eating 98% of my processor resources, so i went and try to find why, i found the answer here:

006930CD XOR EAX,EAX
006930CF INC EBX
006930D0 CMP EAX,2FFF00
006930D5 JNZ SHORT xxxxx.006930CF

now, or i dont know anything about asm or this will never stop :confused:
if iam right then here is the answer to our question jandis, it doesnt do anything, because its too busy trying to get out from a infinit cycle :mad:

i really cant find a way to break on it, he must be decting the debugger but not with the IsDebuggerPresent API, at least it doesnt looks like, gonna keep trying, hope someone has some idea... :p

Regards,
sPeC!
%UNDEFINED%
05-02-2004, 05:49 AM
If Memory Breakpoints aren't breaking try Hardware on access -> DWORD

Sometimes I have experienced this, I don't know what causes it. This may help,

I have had similar problems before with such errors, programs that crash etc...

The first thing I would recommend is adjusting you OllyDbg configuration.
Do not check/Select:
-SFX
->Extend Code section to include extractor

-Analysis 1
->Keep Analysis between sessions

Check/Select:
-Debug
->Use Hardware breakpoints to step or trace code

-SFX
->Pass exceptions to extractor

Second is use the CleanupEx plugin for OllyDbg, use it if you start getting errors after debugging the same program again and again. Or You can manually delete your *.udd and *.bak files Olly creates.

If nothing else, did you try a reboot?
MEPHiST0
05-05-2004, 02:02 PM
what about this new armadillo..
Armadillo v3.70 im sure..

seems if you have a bpx on IsDebuggerPresent - the exe wont run in Olly..
k so i removed that....

and this hang..:

Priviledged Instruction:
004561B1 EC IN AL,DX
004561B2 8BF5 MOV ESI,EBP

olly debug cant process this exception.. k ghey...
k now removed all my toggled breakpoints..

still getting this priviledged instruction, with olly cant process..

hmm anyone know what is up with this armadillo?
i will be debugging..
Ricardo Narvaja
05-05-2004, 02:14 PM
detect ollydbg by name of the process.

make this

copy the ollydbg.exe to the other folder rename with the name you want (pirulo.exe for example) and recopy in the olly folder.

You have two exes

OLLYDBG.exe and PIRULO.exe

Use pirulo.exe without BPX and voila armadillo don't detect and run well

Ricardo Narvaja

what about this new armadillo..
Armadillo v3.70 im sure..

seems if you have a bpx on IsDebuggerPresent - the exe wont run in Olly..
k so i removed that....

and this hang..:

Priviledged Instruction:
004561B1 EC IN AL,DX
004561B2 8BF5 MOV ESI,EBP

olly debug cant process this exception.. k ghey...
k now removed all my toggled breakpoints..

still getting this priviledged instruction, with olly cant process..

hmm anyone know what is up with this armadillo?
i will be debugging..
MEPHiST0
05-05-2004, 02:59 PM
nice!
now that my last conflict is over with..
well
the armadillo IAT stealing methods seem to be the same..
the exe is unpacked! :D

thanks very much ricardo!! :)
Ricardo Narvaja
05-05-2004, 03:07 PM
I unpack an armadillo with table destruction (HYPERSNAP 5) and is terrible 6 tuts i wrote of this protection is terrible, i think this is not of this type of armadillo.

Look at my tuts 203-204-205-206-207-208

Ricardo Narvaja

nice!
now that my last conflict is over with..
well
the armadillo IAT stealing methods seem to be the same..
the exe is unpacked! :D

thanks very much ricardo!! :)
JMI
05-05-2004, 03:24 PM
For those who do not read Spanish well, or at all, you can get a fairly clear sense of the comments, good enough to follow along, through the use of online translators, such a bablefish and others. Ricardo did a lot of work on those six parts, getting it to show him the tricks. :cool: Great work. :)

Regards,
DariuZ
05-05-2004, 04:13 PM
yeah, great tuts, guess i will have to spend some time in front of bubbelfish to get the hang of this father/son app of the newest arma... really annoying shit atm ;)
Ricardo Narvaja
05-05-2004, 05:17 PM
this new tus are of armadillo without copymem2 and table destruction, this have not father and son, i'm investigating now the version with copymem2 patiente.

Ricardo

yeah, great tuts, guess i will have to spend some time in front of bubbelfish to get the hang of this father/son app of the newest arma... really annoying shit atm ;)
DariuZ
05-05-2004, 07:10 PM
mm got it unpacked and fixed iat... now seems like somethine more...


How to bypass Norton AV2004 emulator?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to bypass Norton AV2004 emulator?
PDA

View Full Version : How to bypass Norton AV2004 emulator?

1crazy4u
04-12-2004, 10:33 PM
A packer modified by me starts extremely slow(about 20 sec), after I disabled the auto-protect of Norton AV2004, it starts as fast as normal, :mad: , I think it is because of emulator of Norton AV2004, so, is anyone have some experiences or methods to bypass it(do not tell me just disable it,:). Any information is appreciated. :p
mmk
04-12-2004, 10:40 PM
If you don't modify the packer NAV might recognize it and optimize the execution (eg. unpack it first before emulating instructions).

Also try running the unpacked program to test if it's really caused by packing it or something else.
1crazy4u
04-12-2004, 11:02 PM
If you don't modify the packer NAV might recognize it and optimize the execution (eg. unpack it first before emulating instructions).

Also try running the unpacked program to test if it's really caused by packing it or something else.
Thank you for your replying, I'm sure it's NAV's fault, if i do not pack the program, everything is OK. For some reason , I need to modify the packer. Any better idea?
SpeKKeL
04-13-2004, 03:43 AM
Howdy,

I always used trend-micro's PC-cillen Anti-virus but some time ago i gave nav a try, must say i switched back verry fast to pc-cillen updating,scanning (sure for packed files) took much longer..
By-passing doesn't seems a good idea..

Greets,

SpeKK.
%UNDEFINED%
04-13-2004, 08:20 PM
Might I enquire as to the name of the packer?


Recent Fravia Sighting
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Recent Fravia Sighting
PDA

View Full Version : Recent Fravia Sighting

Aquatic
04-13-2004, 02:40 AM
20 March 2004

http://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=1;t=000688

Glad to see he's still around.
evaluator
04-13-2004, 07:47 AM
is he he?
how to be sure?
Woodmann
04-13-2004, 03:40 PM
Howdy,

There is no way to know but, it would be reasonable that
it is he. There are a few clues ;)

Woodmann
evaluator
04-13-2004, 04:25 PM
ok.

as i impressed, he can be old man.
+SplAj
04-14-2004, 03:36 AM
Evalibrator

because F+ did NOT suggest to dine at Macdonalds ..... so you assume 'he can be old man' :rolleyes:

as i impressed , you is young boy
evaluator
04-14-2004, 03:45 AM
well, i'm not dinning in McD, but also not an old man;
whatz now??
also i have seen old men there;
UrgeOverKill
04-16-2004, 04:44 PM
ahh yes, ename beers, the blondest of them all.. I wonder if thoust ever tantalized his pallette with Chimay? :)
ZaiRoN
04-16-2004, 05:28 PM
ahh yes, ename beers, the blondest of them all.. I wonder if thoust ever tantalized his pallette with Chimay? :)Chimay, I like this beer!
There are some great beers from Belgium, they know how to make beers ;)
evaluator
04-17-2004, 01:24 AM
very seems, pedi-cartoon-makers..
klier
04-17-2004, 08:44 AM
Hey,Belgium Doesn't Exist!
http://zapatopi.net/belgium.html
disavowed
04-17-2004, 12:39 PM
chimay is over-rated. give me a good tetley's english ale any day
UrgeOverKill
04-17-2004, 08:28 PM
actually Disovowed, IMHO Thomas Hardy Ale is the best. r e a l l y smooth but good.
ZaiRoN
04-18-2004, 05:09 AM
De gustibus non est disputandum: Slalom for me :-)
Bengaly
04-22-2004, 12:27 PM
Pierre (from datarescue) is 100% trying to defend the product (ida) insted of actually mass marketing it :)
fravia, was nice for him to offer a dinner and making a nice discussion and well insted of actually being interested he still tries to say how ida is this. and that.. heh.
go figure,

i would take the offer to get a free meal and some drink (water.. no beers!!!.. yuk :D) :)
evaluator
04-22-2004, 02:54 PM
exactly because fravia offers dinner to person, who already "skipped" once such like offer,
i assumed he is old man (too much tollerant);
if i will offer someone something & s-he will say word: "skip",
2nd time will not happens at least in good condition;
in bad condition i can "skip" noise on "skipper's" face;
disavowed
04-22-2004, 06:39 PM
i'm sure that if pierre were to have accepted the invitation, it could be seen in the eyes of some of datarescue's customers as pierre condoning piracy or other unethical uses of ida because of how many people associate fravia's old site. i see pierre's decision as a business decision, not a personal snub.
Bengaly
04-23-2004, 05:24 PM
could be, but he can't ignore the fact is that IDA is widely used for 'reversing' matters.
discussing about reversing won't budge ida it self a bit, it can only help.


Fishing Setup Key..how??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Fishing Setup Key..how??
PDA

View Full Version : Fishing Setup Key..how??

Ravindra_mo
04-13-2004, 06:04 AM
Hi..

This is my first post on this forum. thinking I would get some help from the fellows around here, I put this question(Well Im newbie dont be bothered if unable to explain details properly).
Im having a software which is asking for a serial No. for continuing setup. although I had read all sorts of materials Im unable to find or fish any serial through which I could find the Key for the SETUP.EXE to continue the Installation. please help me find it if there is any other way to be followed.

Thank You...
Fake51
04-13-2004, 08:50 AM
Hi..

This is my first post on this forum. thinking I would get some help from the fellows around here, I put this question(Well Im newbie dont be bothered if unable to explain details properly).
Im having a software which is asking for a serial No. for continuing setup. although I had read all sorts of materials Im unable to find or fish any serial through which I could find the Key for the SETUP.EXE to continue the Installation. please help me find it if there is any other way to be followed.

Thank You...

Oh well ...

Tuts and essays, tuts and essays. Promise you'll read till your eyes are close to pop out. And while you're doing that, you can try using this approach:

1. If the app is asking for a serial number, and won't continue if it doesn't get one, then it must accept some input
2. If the app accepts some input, it must validate said input in some manner, in order to determine whether to continue with the installation.
3. The app asks for a serial number.
4. Hence, there is a validation check or checks somewhere.

So, you gotta follow the input. A typical way in is getdlgitemtext (a or w), getwindowtext (a or w), and others like it. Perhaps a bmsg might work. If the app produces a "Wrong serial you fucking nitwit son of dumb motherfucking lowlife newbie cracker" you can try to break on it and work your way backwards from that point. If you're smart, you'll try and locate the input-calls AND the msgbox call - because somewhere in between in the code flow, the validation will occur.

Hope the help gets you further. Sorry for the abuse.
Fake


HELP!! Cant find the correct ID button in GetDlgItem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HELP!! Cant find the correct ID button in GetDlgItem
PDA

View Full Version : HELP!! Cant find the correct ID button in GetDlgItem

Gento
04-13-2004, 08:47 AM
Hi i've trying this:
.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
include \masm32\include\user32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

.data
MsgCaption db "Iczelion's tutorial no.2",0
MsgBoxText db "Win32 Assembly is Great!",0
dfx db "DFX Close",0

handlewindow dd 00000000h

.code
start:
xor eax,eax
invoke FindWindowA, 0, addr dfx
cmp eax,0
je start

mov handlewindow, eax

invoke GetDlgItem, eax, 02bfh
mov handlewindow, eax

invoke SendMessageA, eax,WM_LBUTTONDOWN,0,0
mov eax, handlewindow

invoke SendMessageA, eax,WM_LBUTTONUP,0,0

invoke MessageBox, NULL,addr MsgBoxText, addr MsgCaption, MB_OK
invoke ExitProcess,NULL
end start

but 02bfh is no correct. Can anybody helo me??? I have seeing the api reference but i can see the correct value. :confused:
Fake51
04-13-2004, 08:59 AM
Before I venture any stupid guesses: have you debugged your app, to make sure it finds the right window? And why do you keep storing eax in a variable that you keep overwriting without using it?

Fake
Gento
04-13-2004, 09:43 AM
Yes I used OLLYDBG, the target is a dll so I cant find the correct ID. It finds the window. I uses w32dsm89 to disassemble and to find the ID but in a document (making one loader using ollydbg by ricardo navaja) I've got the correct value is 2.
Fake51
04-14-2004, 01:41 AM
Yes I used OLLYDBG, the target is a dll so I cant find the correct ID. It finds the window. I uses w32dsm89 to disassemble and to find the ID but in a document (making one loader using ollydbg by ricardo navaja) I've got the correct value is 2.

How about using some app to glean some system info? Should be quite a few that will tell you everything about all the open windows - to let you see what the id is, and if it's changing from time to time. Have you checked the calls in the dll, to see if the id is hardcoded?

Fake
Gento
04-19-2004, 08:39 AM
hardcoded !!!! :confused: uppssss :eek: :(
cRk
04-21-2004, 07:56 AM
you can use PELG to get The Window Titles or Windows Classes of a Program

PELG = Predator's eXtreme Loader Generator

btw what exactly mean that you code you just wrote?? you want to kill a Nag by finding the window name and simule that you pressed the button?


Starforce 3...Uncrackable?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Starforce 3...Uncrackable?
PDA

View Full Version : Starforce 3...Uncrackable?

Hangman
04-13-2004, 10:41 AM
Greetings people...
I was reading through a few threads here,somewone mentioned something about not yet seeing any "starforce 3" protected media..Well.I know of a game right now that is causing quite a stir in the "scene".. Gangland-it seems to be
"uncrackable".Two groups have released cracks for it but neither of the two different cracks that were succesfull.No one were able to defeat the protection!!!
Other notable games will likley employ the starforce protection-spectulation,
I would guess the upcoming doom 3 and halflife 2....
How come no one
will crack this protection for Gangland since,as somewone redily replied and pointed out that starfore 3 has been cracked on shet loads of other game- - -??
There have been a few other games that were cracked using the starfore protection,perhaps its just extremely difficult and avoided?
Sorry for the confusion and my englesh,I am german and Im sorry if I have confused some facts before my edit.my humble apolagies to all who have laid
eyes on this thread.
evlncrn8
04-13-2004, 12:13 PM
several groups? more like 2 unknown groups who simply packed up the demo exe and dlls (also sf3 protected), and released them as cracks

and sf3 has been cracked,dead to rights, trackmania, castle strike, singles..all sf3 all cracked, so if you're gonna cite stuff, at least research your material before you make your comment
Woodmann
04-13-2004, 04:15 PM
Howdy,

The reason why it doesnt get cracked is the 39 dollars.
How many hours would you spend to defeat a 39 dollar software ?

A person who does crack it only wants the knowledge not the game.

Woodmann


Advanced binary diff tools?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Advanced binary diff tools?
PDA

View Full Version : Advanced binary diff tools?

n3tsniper
04-14-2004, 12:59 AM
Hey guys. I am relatively new to the cracking scene. I have only done simple NOOP patches for basic software using W32DASM, but now I am working on cracking my first few apps for the PocketPC. I was wondering if any of you guys know of a nice binary differencing tool? I mean, something that will show me "blocks" of bytes that are equal/not equal between two different files. I have purchased and installed Insaniquarium 1.09 for PPC/ARM and also downloaded a pre-cracked executable (same version) for comparison. Any ideas on some diff tools?

Thanks,
Netsniper
hobgoblin
04-14-2004, 01:23 AM
Try hexworkshop. It has a build-in compare function that's very usefull.. :)

regards
least
04-14-2004, 01:59 AM
I use wincommander (now totalcommander), it has nice compare function.
Never needed anything else.
Regards,
least
n3tsniper
04-14-2004, 03:02 AM
Thanks for replies. I didn't know Total Commander had diff capabilities. It's a great app, so I'll be using it more frequently now. I downloaded a newer demo of HexWorkshop as well. I have used it before (long time ago) as a simple hex editor, but I'll try it again for the diff features. Thanks again...
gook
04-14-2004, 08:34 AM
There's also a nice dos executable called "fc.exe". Use it like this: fc /b file1 file2.
n3tsniper
04-14-2004, 10:41 AM
Yes!!! DOS program is the best, can't believe I never saw this before. Thanks...
KSA
04-14-2004, 10:59 AM
Try Beyond Compare with HexView Plugin. I think it's the best to compare hex and ascii files.

KSA


Sorcerers are bad cyber lovers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Sorcerers are bad cyber lovers
PDA

View Full Version : Sorcerers are bad cyber lovers

dELTA
04-14-2004, 07:16 AM
This is about as off-topic as it gets, and yes, I know this one is pretty old too, but it's so damn funny that if someone didn't already see it you really should take a look. :p

http://www.greentara-redlayla.com/bloodninja.html

It's a chat log of a quite funny guy messing with people in a cybersex chat room...
Polaris
04-14-2004, 07:44 AM
This is about as off-topic as it gets, and yes, I know this one is pretty old too, but it's so damn funny that if someone didn't already see it you really should take a look. :p

http://www.greentara-redlayla.com/bloodninja.html

It's a chat log of a quite funny guy messing with people in a cybersex chat room...

NOOOOO!!! I CAN'T BELIEVE THIS!!! :D He is my new favourite HERO!!! Let's bring up a bloodninja fan-club ;)


crack this crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > crack this crackme
PDA

View Full Version : crack this crackme

anna
04-14-2004, 10:36 AM
who can crack this crackme?

the user are: XancheZ

can you find the serial?

Crackme : http://emc2h.web1000.com/crack/CRACKME.EXE

Send the answer to this mail : o_o12o_o@hotmail.com

Good luck
klier
04-14-2004, 12:57 PM
Why:
the user are: XancheZ ? :confused:
klier
04-14-2004, 01:11 PM
FYI:
http://www.woodmann.com/crackz/Tutorials/Cruehds.htm

Regards,
anna
04-14-2004, 01:43 PM
ok
I can´t find the serial, help, is very important.

thank's
Woodmann
04-14-2004, 02:50 PM
Hi there,

The bus will be leaving at midnight :eek:

-CBO-
CluelessNoob
04-14-2004, 10:14 PM
The bus will be leaving at midnight :eek:

But midnight in what time zone?

;)
anormal
04-15-2004, 05:26 AM
hehehe,
lol
klier
04-15-2004, 05:46 AM
find it rather sad
evaluator
04-15-2004, 02:21 PM
yey! This crackme Self Generates serial:)

enjoe with my art of cr0cking(:)

[edit] attachment in post below..
r4g3
04-15-2004, 02:53 PM
ah those "is very important." whinings usually mean "crack it for me so i can get some $$ from it"
JMI
04-15-2004, 03:14 PM
Sometimes. :D

Regards,
r4g3
04-15-2004, 04:28 PM
hehe ok this is a crackme, so prolly had to show he can actually crack ;)
dev_zero
04-17-2004, 11:50 AM
yey! This crackme Self Generates serial:)

enjoe with my art of cr0cking(:)

This is compiled wrong.. You really need to learn to write crackmes that work, for this doesnt... Memory access violation...
evaluator
04-17-2004, 01:28 PM
on my w98se runs ok. i not tested on xp..
NOW!
reverse it, debeg it, FIX bug & notify us, what happens!!!!!

this will your home-work, OOOkey!?
dev_zero
04-17-2004, 02:47 PM
Sorry but it dont work on w2k sp4.... Memory access voilation fault... Softice pops up and notifies me about the memory problem..
evaluator
04-18-2004, 01:17 AM
just tested on XP, runs OK.
that is w2k problem.(probably with dlgbox).
not cracked, original crackme runs?
roticv
04-18-2004, 03:21 AM
I think it is because ebx is not preserved, since IIRC ebx is used in dispatchmessage in win2k
evaluator
04-18-2004, 07:44 AM
well, thank!
so error happened because after f_ cdecl proc i not restored stack;

uploaded corrected version:)


Private Message Replies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Private Message Replies
PDA

View Full Version : Private Message Replies

CrackZ
04-14-2004, 02:35 PM
Hiya,

This is a public message for 'nathan' and 'ramid_rad2000' to drop me an e-mail since I can read their private messages but am thwarted when trying to reply to them ;P.

Yes, whatever it seems I try I am not quite logged in so have been unable to send a reply (which fortunately I typed and saved in NotePad anticipating the usual time out frustration).

I suppose I should ask if anyone else has this problem, or whether I'm doing something of the utmost stupidity (perish the thought ;-) ). Yes, I have said 'remember me' too, but it never does ;P.

Regards

CrackZ.
klier
04-14-2004, 04:31 PM
had a similar problem when i logged in at "http://woodmann.cjb.net/"

logging in at "http://www.woodmann.net/forum/index.php" solved it.


softwarekey.com protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > softwarekey.com protection
PDA

View Full Version : softwarekey.com protection

bobbobbins
04-14-2004, 03:14 PM
Anyone know anything about softwarekey.com protection?

I have an app that uses a file called key32lbe.dll but can't see where this gets called in softice.

License executable has two user codes(automatically generated) that seem to be computer dependent. Then there are two codes it requires as well as a serial number. I was thinking it uses the two user codes in conjunction with the serial number to somehow generate the other two required keys.

Thanks for any help.


ASPR v1.23 RC1 Removed, program doesn't stay running...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR v1.23 RC1 Removed, program doesn't stay running...
PDA

View Full Version : ASPR v1.23 RC1 Removed, program doesn't stay running...

Infin8Cyn
04-14-2004, 04:57 PM
I'm really pretty new to debugging, and ASM, but I'm slowly trying to teach myself and lurking around here. I've been trying to use OllyDbg v1.09d to remove a version of ASProtect v1.23 RC1 [Overlay] from a piece of software. However, I'd also tried using ASPR Stripper v2.07f on the file. When I would use ASPR Stripper it would tell me that "it wasn't nice to play with other peoples files". I assumed it had Anti-Debugger protection in it, so I began working with OllyDbg.
After a while of poking through with Olly, I could not make it trip on "IsDebuggerPresent," so I ran ASPR Stripper across it again. This time it worked, however, with ASProtect removed, the program now launches (It's icon and program appear on the taskbar) then quickly disappears. I'm going to use the SysInternals tools to see if it's looking for a file or reg. key or something, but I'm lost as to what to check now. Any help would be greatly appreciated.
JMI
04-14-2004, 06:57 PM
Infin8Cyn:

There is a tremendous amount of information already contained on this Forum about asprotect and there are at least 8 existing threads which reference aspr v 1.23. Have you searched for and reviewed any of them? There are also many, many more threads about removing aspr itself.

So far, you have only run asprstripper on the program twice. The first time it gave you a message which suggests it detected you effort to use asprostripper, but you assumed it detected Softice and switched to Olly instead of attempting to figure out what it was really doing. Then you tried Olly and it didn't immediately pop on "IsDebuggerPresent" and you abandoned Olly immediately and tried asprstripper again, and this time you "think" it worked, but now the progrom launches and then shuts itself down. So really, the only thing you have done is to use a ready made tool twice and it didn't work to your satisfaction and you now ask someone to explain "why" to you.

You really need to make a more serious effort, or at least explain that you have made a more serious effort, before you ask for help. Here's a serious suggestion. Just go to the "search" button at the top of the Forums and enter "LaBBa", without the quotes. You will get at least 23 threads, mostly about aspr, including Labba's "super tut." After you have read most of these, and tried some of their techniques, come back and ask another question, which explains what you have actually tried, besides asprstripper.

Regards,
Infin8Cyn
04-14-2004, 08:35 PM
JMI,
I was merely posting the points in which something significant actually occured. I've stepped through the program with Olly multiple times and have searched and extensively downloaded every thread I could find both here and through google.

I've run through the Tuts on both 1.x, 1.23, and the 1.3x versions and the 42page Asprotected Notepad tut. I'm not good at this at all and never claimed to be. For all it matters, I'm an uber-noob. I've just been trying to work through this for several days now. And was curious if anyone else working on ASPR had run into such an issue before. I wasn't asking for for solutions just something to point me in a direction of some sort...
cRk
04-15-2004, 01:48 AM
please .. private message me the target . i'd like to see it :)

Regards
JMI
04-15-2004, 03:05 AM
Infin8Cyn:

The point is that no one could tell from your first post the information which you claim in your second post, or that you had done much at all to help yourself. If you had read the FAQ you would, perhaps, have explained yourself a little better. It is somewhat suspicious that your story has so many changes at this point.

There is nothing in your first post which stated: "I wasn't asking for solutions just something to point me in a direction of some sort..." In fact your final statement was "Any help would be greatly appreciated. "

Your first post states: "After a while of poking through with Olly, I could not make it trip on "IsDebuggerPresent, so I ran ASPR Stripper across it again." Now you say: "I stepped through the program with Olly multiple times." Which do you wish us to believe? Did you actually learn and/or observe nothing if you actually "stepped through the program with Olly multiple times"?

You say you've downloaded a bunch of tuts and I would presume you want us to believe you have read them, yet your posts says nothing about your having attempted to unpack ASPR yourself, only that you ran asprstripper a second time, and then the program showed up in the task bar and then closed itself down. You do not discuss having attempted to reconstruct the IAT or having done any of the other things which are explained in the tutorials you "downloaded," for example finding the OEP and/or stolen bytes.

So why don't you stop trying to blow smoke up our backsides because you are not very good at it. There is nothing wrong with being inexperienced, but it is not useful to try to be deceptive. Have you read and attempted to follow LaBBa's tut? If you had actually "just been trying to work through this for several days now" and had read several tuts, you would be more familiar with what to look for and/or what to do when attacking an ASPR protected target. You show NO sign of having such knowledge which is available in the threads I already directed you to review.

Do you want to start again? Or make more excuses?

Regards,
Infin8Cyn
04-15-2004, 10:42 AM
JMI,
A favorite saying of mine goes something like this: "Don't explain yourself to people. Your friends don't need it, and your enemies won't believe you anyway."
Everything I told you was true. As I told you, I only posted the events in which something important occurred. I never claimed to know everything, and wouldn't make that statement.
There is nothing in your first post which stated: "I wasn't asking for solutions just something to point me in a direction of some sort..." In fact your final statement was "Any help would be greatly appreciated. "
Yes. When you help a child on their homework do you just give them the solution? No, you point them in a direction and help them in finding a solution.
Your first post states: "After a while of poking through with Olly, I could not make it trip on "IsDebuggerPresent, so I ran ASPR Stripper across it again." Now you say: "I stepped through the program with Olly multiple times." Which do you wish us to believe? Did you actually learn and/or observe nothing if you actually "stepped through the program with Olly multiple times"?
Once again, I reference the fact that I only posted where an event of some consequence occured. Do you believe that in several days of tinkering I merely poked through it once and ran ASPR Stripper twice?
You do not discuss having attempted to reconstruct the IAT or having done any of the other things which are explained in the tutorials you "downloaded," for example finding the OEP and/or stolen bytes.
Sure, I didn't unpack ASPR myself (Hence I didn't need to reconstruct the IAT or replace stolen bytes.)However, I took the first step which was trying to find (and bypass) the anti-debugger scheme, then ran a program which did all those steps (OEP, Repair the IAT, and then re-inserting the stolen bytes.) I am now trying to debug the output of that program. Forgive me for not unpacking it by hand, but I don't quite understand why that necessitates me being reamed for not having done so.

And just for the record, the tuts I've found (and yes, read) are fine except for one aspect. For the most part they (the Tuts) almost always have the same target and are just changes to account for what's different between ASPR 1.2x and ASPR 1.3x and so on and so forth. (LaBBa's "Final Tut" is an exception to this rule thank god.)
SO, I've already explained it all, you know what I'm curious about, so... if you don't want to believe me, feel free that's your right. Otherwise, my question still stands, is this an issue anyone else has run into?

cRK, Consider yourself PM'd.
JMI
04-15-2004, 01:38 PM
Infin8Cyn:

You obviously still don't get it, so I'll try one more time and if you change your story again and elevate obfuscation over truth again, your thread will simply disappear. It doesn't really matter what your favorite sayings are or what your habits of explanation are. We have certain procedures and requirements here which are set forth in the FAQ about how one is expected to ask a question and what information it is expected to contain.

This isn't about expecting you to know every thing or chastising you for not knowing everything. It is about getting you to include in your post the relevant information about what you have done to try to help yourself, to get you to show some of that work, and have you describe where you are stuck. What you have done is present a continually moving target about "what you have done" and have "shown" none of your work.

You protest that "When you help a child on their homework do you just give them the solution? No, you point them in a direction and help them in finding a solution." Actually, what one should do is ask them what they have tried themselves and perhaps make suggestions of where they might look to find the answers themselves. The object is to make them THINK about the problem and, at least with most homework assignments, understand that the method of finding the answer is generally "in the book" the school gave them.

Back to credibility. You ask now: "Do you believe that in several days of tinkering I merely poked through it once and ran ASPR Stripper twice?" I suggest that you re-read your first post and ask yourself how one would come to a different conclusion.

You complain: "Sure, I didn't unpack ASPR myself (Hence I didn't need to reconstruct the IAT or replace stolen bytes.) However, I took the first step which was trying to find (and bypass) the anti-debugger scheme, then ran a program which did all those steps (OEP, Repair the IAT, and then re-inserting the stolen bytes.) I am now trying to debug the output of that program. Forgive me for not unpacking it by hand, but I don't quite understand why that necessitates me being reamed for not having done so." You weren't reamed for not doing those steps. You were informed that the tuts which were suggested would teach you how to do those things yourself.

Now you claim you have been "debugging the output" of the results of your second application of asprstripper and yet you seem to have no idea why it is crashing. Or at least you haven't bothered to attempt to explain where in the code this is happening. Whether or not this is true, it is, again, a completely different story than what you stated in either your first or second post.

Finally, you make the completely ridiculous statement that: "And just for the record, the tuts I've found (and yes, read) are fine except for one aspect. For the most part they (the Tuts) almost always have the same target and are just changes to account for what's different between ASPR 1.2x and ASPR 1.3x and so on and so forth. (LaBBa's "Final Tut" is an exception to this rule thank god.)." This statement, again, contradicts your previous statement that " I've run through the Tuts on both 1.x, 1.23, and the 1.3x versions and the 42page Asprotected Notepad tut."

Of course, not all the threads here, and certainly not all the tuts on the net are about the same target and you apparently have missed the point of those threads entirely, which is to study and attempt to learn how aspr, itself, works to hide the manner in which it is attempting to prevent your finding out how it protects itself.

You have apparently not grasped that your problem with asprstripper is that it apparently did not correctly rebuild the IAT or may have left an incorrect jump which now goes nowhere. This is not uncommon, even if one manually unpacks the file. If you had made any effort to attempt to dump the program and rebuild it yourself, or to follow the IAT or execution of the program with Olly, you probably could, and should have made that discovery. If the program is crashing, you should be able to detect WHERE that is happening with Olly. If you can't you need to spend more time actually learning how to use a debugger. Patience if one of the hardest things to learn.

Are you aware that there are plug-ins for Olly that hide it from aspr and bypass the IsDebuggerPresent detection? Or that there are plug-ins which find the last exception, and do you even know what that means? Do you know anything about SEH and do you really want to learn?

Have you read R@dier's tut titled "Manual Unpacking ASProtect 1.23 RC4 - 1.3.08.24" which is a detailed discussion, with pictures, of using Olly to remove aspr? It discusses finding and removing a remaining entry which goes nowhere and had to be removed to get the program to actually start.

The problem with "following" tuts is that, if you only follow, you are not really learning how to THINK about what the protector is doing to the program and to hide what it is doing. Examining many tuts should teach you how to THINK about what the protector does and, if you learn those lessons, you can attempt to apply them to the next iteration/version of either the target or the protector.

So the answer to your self-important question is that it is something people have run into before, whether or not they used asprstripper. Now how does that help you actually solve the problem?

Regards,
Infin8Cyn
04-16-2004, 01:00 PM
JMI,
After sittin' on this for a day, here's my thoughts. I think a simple "Did you unpack it yourself? No? Then how do you know it was done right at all? We can't really help you if you just used an application to unpack it for you. Who knows if it unpacked correctly." but, you came off as a hardass.
Everything I said was true. But I see what you're trying to point out. But, expect a "yay, I succeeded." post in the newb lounge in the future. Patience may be tough, but I'm also stubborn.

Are you aware that there are plug-ins for Olly that hide it from aspr and bypass the IsDebuggerPresent detection?
Yes, and I've been using it in OllyDbg.
Do you know anything about SEH and do you really want to learn?
No and Yes, respectively.

Manual Unpacking ASProtect 1.23 RC4 - 1.3.08.24
No, you just pointed me to it, reason being: It's on Exetools.com. Registration is disabled, hence I can't login and learn from the information there... How would I go about getting into Exetools? or at least obtaining the info you referenced...
JMI
04-16-2004, 02:02 PM
Infin8Cyn:

And why should anyone spend time trying to help someone who confesses he is too immature and/or stubborn to follow the rules and/or who simply can not recognize when he is actually being helped? You seem intent on attempting to prove just how macho you think you are and you only demonstrate how truely lacking in judgment you remain. We have no need to abide your attitude or preferences and you seem unwilling to conform to ours. This is not a school for anger management and you have done absolutely nothing to deserve any assistance here.

Regards,
Infin8Cyn
04-16-2004, 02:34 PM
I think you took that wrong, I meant when I succeeded in unpacking it on my own. I'm stubborn in success, not in proving you wrong. God knows I'm not an ASM master or some Debugger god... My previous post was a "I see your point, I'll work on that, thanks." type post. Not a "I'm too stubborn to listen to you, here's the bird, Good Bye."
JMI
04-16-2004, 03:52 PM
Infin8Cyn:

The technique you continue to use is called "damning by faint praise" and I have not been either impressed or annoyed by such techniques for more years than you have probably been alive. There was, of course, no contrition in your post #8, nor any indication of appreciation or commitment to work on your approach. Your preference remains to misrepresent what you have already stated and then insert what you hope is a demonstration of your "stick-it to um" attitude. Quite pathetic really. :rolleyes:

You continue to protest that "everything I said was true" when no one said you lied. I only pointed out, correctly, how your own account of what you did continued to change with every telling, as did this one. For example, you finally identified that you were using the "IsDebbugerPresent" plug-in for Olly and yet you seemed not to understand why you "could not make it trip on "IsDebuggerPresent." Had you mentioned that fact in the beginning, you might have been directed to study what that plug-in actually does. For example, this thread on the Olly Forum:
http://ollydbg.win32asmcommunity.net/index.php?action=vthread&topic=523&forum=1&page=-1

If you have succeeded in unpacking your target you may rightly feel pride, but that may not be the end of your efforts. Often the authors of software have other tricks awaiting those who remove the "first" layer of protection.

You have also indicated that you intend to post a self-aggrandizing ""yay, I succeeded post in the newb lounge in the future." Can you not simply appreciate your own accomplishment? Is your ego so fragile, that you need the rest of us to bow in your direction for you to truly enjoy the fruits of your efforts?

Regards,
cRk
04-19-2004, 02:50 AM
i was checking it and found out that maybe your problems remains not really about ASPR ... is because this soft from that company always has some tricks/Crc checks. after unpacking aspr. out of it this silent crc check will be activated . as you might note the crash that happends are using the API RaiseException for this ... Rebuild IAT using Imprec .. for the Limited version OEP is: 0051A86C (0011A86C)

now your work remains on finding out how this crc check works .. i give you a tip .. also it could be skipping some good code that needs it to load .. and not Stolen bytes are present :)
Infin8Cyn
04-20-2004, 03:14 PM
I noticed what you said about stolen bytes. However, I haven't had much time time to work on it at the moment. Damn work taking up too much of my life. Thanks for the tip..


A stranger dongle. help me please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > A stranger dongle. help me please
PDA

View Full Version : A stranger dongle. help me please

donkisot
04-15-2004, 04:36 AM
http://cc.domaindlx.com/nghuydemo/uploads/LodeDongle.tif

I have a program of LodeData corporation.
It's <program name removed> with a stranger dongle

I asked some my friends, they said it's a complex dongle and they didn't know any more.
Have anyone here know this dongle.

Please tell me what's is it.

Best regard

donkisot

ps:
sorry for not well my English
nikita@work
04-15-2004, 06:28 AM
I have a program of LodeData corporation.

I asked some my friends, they said it's a complex dongle and they didn't know any more.
Have anyone here know this dongle.

hxxp://www.lodedata.com/faq.html#_Hardware_Locks__Security

one interesting phrase:

-----
The hardware lock consists of two parts, the holder (the black part) and the button (the round silver part with a sticker on it).
----

may be dallas tablet?
tgodd
04-15-2004, 12:48 PM
That would be dallas iButton

That lock is not all that complicated.
donkisot
04-15-2004, 09:01 PM
Thanx for your reply.
If possible Tell me how to edit/read this dongle?
Have tools or utilities for it.

Thanks again

donkisot
JMI
04-16-2004, 12:59 AM
donkisot:

We have a clear rule here, stated in the title to the Tools of the Trade Forum. That rule states:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

The thread you posted asking for cracking tools has been deleted. Do not repeat this mistake.

Regards,
Kayaker
04-16-2004, 01:23 AM
The thread you posted asking for cracking tools has been deleted. Do not repeat this mistake.
Regards,

I concur and confirm, the interest only seems to be to get hold of this dongle crack tool.
donkisot
04-16-2004, 01:46 AM
Oh I'm sorry .
I never repeat this mistake
:)

donkisot
CrackZ
04-16-2004, 05:24 PM
Hiya,

In terms of reading the iButton, I seem to recall the SDK with the filename 'all4_31.zip' could be downloaded quite freely from the web.

I reversed the iButton driver back to full source code quite some time ago, very nice simplistic dongle and driver (makes a change eh from these monstrosities I'm forced to come to terms with these days ;p), I'm also with tgodd, its a very simple device.

Regards

CrackZ.
donkisot
04-16-2004, 09:50 PM
Thanx CrackZ

That's a good idea

I'll try follow your instruction

donkisot
ramin_rad2000
04-17-2004, 07:53 AM
I have searched for it but nothing was found!
sope
04-17-2004, 09:57 AM
I have searched for it but nothing was found!fxp://fxp.dalsemi.com/pub/software_auth/ds1410e/ds1410k4.v31/all4_31.zip
hope this helps
ramin_rad2000
04-17-2004, 11:16 AM
i don't understand,but should it not say that buttons found?!coz i have the orginal sdk and it says too that buttons not found.
donkisot
04-18-2004, 12:30 AM
Ibutton have sdk for Dos, 16bit, 32bit
I download all of them.
Now i'm looking at 32bit sdk "sacwd32.dsw" -> "sacwd32.dll"
I'll try to rewrite "sacwd32.dll"

Good Luck to all :)

regards,
donkisot
tgodd
04-18-2004, 08:43 AM
Now your playing nice.
;)

Good Luck,

tgodd
donkisot
04-22-2004, 11:13 PM
Hi,
i've pass Ibutton dongle.
:)
thanks all 4 your ideas
special thanks to CrackZ, tgodd

donkisot
donkisot
04-25-2004, 11:32 PM
Hi ramin
my software use sacwd32.dll.
So my approach is very simple.
I did:
1.Download win32.zip from http://www.ibutton.com/software/softauth/utilities.html
2.Find all import function from sawcd32.dll. I usesd W32dsm.
3.Find the order of called functions of sawcd32.dll exported function.
4.Find values return from ibutton.
5.Rewrite sawcd32.dll's function with value found in step 4. These function always return the value
without access the dongle. I used Visual C++ 6.0
6.Test without dongle

I recommend you use "Win32\sdk4.31\disk3\win32\Dll\" for found the way software get protect key of ibutton.

regard,
donkisot

Ps:
Ramin's private box is full.
i can't reply pm to you


[Release]I make this PE'tool for chaging a PE file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > [Release]I make this PE'tool for chaging a PE file
PDA

View Full Version : [Release]I make this PE'tool for chaging a PE file

lordor
04-15-2004, 05:00 AM
5.14 Release Bate2
1、Fix some Bug
2、Chang the mainwindow,and chang "DiyingPE" to WinPE
3、Add process list

4.15
This is bata1,privide some function:
1、Add new Section
2、Kill the last section(also can del data in the file)
3、other:enable the disabled button and menu

Any bug and comment,please mail to me:lordor@digitalnuke.com 、lordor@163.com
lordor
05-14-2004, 10:42 PM
5.15Update

Have any advice or bug,pleae let me know
disavowed
05-15-2004, 01:11 PM
i have yet to take a look at your program. is there anything it can do that lordpe can't do?
sHice
05-15-2004, 01:40 PM
hi
it's really cool! especially the "Add New Section" function! but i can't figure out how to save my changes for example when i changed the oep i don't know how to save :confused: and what does the activation function do ? if i select Enable Menu or Enable Button nothing happens :confused:
i really like it tnx !
disavowed
05-15-2004, 03:22 PM
but i can't figure out how to save my changes...
and what does the activation function do ?maybe it saves your changes :p
cRk
05-15-2004, 09:22 PM
i have seen many tools that just do the same as other* tools does.. similar options, similar dump engine... etc etc.... why would someone waste time on coding something similar with same option... only the GUI is different
doug
05-15-2004, 10:45 PM
i have seen many tools that just do the same as other* tools does.. similar options, similar dump engine... etc etc.... why would someone waste time on coding something similar with same option... only the GUI is different

he probably started it as a mini-project.. "teach yourself the PE-format", and then it has grown into a full-blown tool.
cRk
05-16-2004, 12:37 PM
i understand ... but my comment was not a critic for his tool.. is a general comment about the comment disavowed wrote .... i'll hope someday this tool will be #1 on Pe Editors . why not! . :)

it is good to know coders are working on the scene for New updated tools like this one.

Regards
lordor
05-16-2004, 11:01 PM
to disavowed:
yes this tool do more well in some fuction,example Add new Section

to sHice:
Now only view the item of pe,can't change yet.the activation function is enable the grayed button or menu(when your select this function,please select the other runing program that you want to kill the grayed button)

to cRk
why do I make it?juct doug saied "teach myself the PE-format".but I also want to make a new pe tool :it can view pe32/pe64/pe.net format and do some chang e,It can assist to packed a program or unpacked a program,it can disam the runing program(so you don't have to unpack the program first) and so on :p
cRk
05-17-2004, 03:13 PM
thanks! :cool:

Best Regards!
disavowed
05-18-2004, 01:02 PM
to disavowed:
yes this tool do more well in some fuction,example Add new Section
lordpe can add new sections.

please understand that i'm not trying to be critical of your tool, i just want to know if i should bother using it instead of or in addition to lordpe.
sHice
05-18-2004, 02:04 PM
yes lordpe can add new sections but it doesnt fill the new section with 00 or whatever it only adds the new section to the peheader.you have to do the rest with a hexeditor ...
cRk
05-20-2004, 01:16 AM
also not sure but pe.net i believe are not handled by Lordpe.

it is good to know that someone is working providing new tools for the becoming popular .net pe format
disavowed
05-20-2004, 09:31 AM
a .net pe file is still a pe file, and thus is handled correctly by lordpe

unless you mean that winpe has extra info for .net pe's
disavowed
05-22-2004, 11:04 AM
from y0da:
I would like to add to your discussion that LordPE is even able to have
a deep look inside the METADATA block of PE.NET files. It internally
uses MetaPuck to reach this aim. This functionality can be reached over
the directory table view -> COM header etc.


Vbox Spanish Tut In English
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vbox Spanish Tut In English
PDA

View Full Version : Vbox Spanish Tut In English

hobferret
04-15-2004, 08:57 AM
I have been having some trouble with VBOX 4.6 and Win XP :)

I found a tut on Ricardo Navaja's site in Spanish regarding a VBOX prog :D

I would like to ask either Ricardo or Nikolatesla if I could upload the tut now in English and HTML to their site :cool:

It may be of some use to others, it did work for me, however I was not using the program the tut is written for :(

Any reply would be appreciated, if you want to get hold of the original it is on Ricardo's site listed under:/nuevocurso/teorias/195-desempacando vbox para orniaco :)

Regards

/hobferret
Ricardo Narvaja
04-15-2004, 09:31 AM
When i can download the tut in english?

If you put a link i download or you can upload to my FTP FOLDER UPLOAD is the unique folder with permission to UPLOAD archives or send me to mi mail

ricnar22@millic.com.ar
Thanks i put in my ftp and web servers
Ricardo Narvaja

I have been having some trouble with VBOX 4.6 and Win XP :)

I found a tut on Ricardo Navaja's site in Spanish regarding a VBOX prog :D

I would like to ask either Ricardo or Nikolatesla if I could upload the tut now in English and HTML to their site :cool:

It may be of some use to others, it did work for me, however I was not using the program the tut is written for :(

Any reply would be appreciated, if you want to get hold of the original it is on Ricardo's site listed under:/nuevocurso/teorias/195-desempacando vbox para orniaco :)

Regards

/hobferret
jandis
04-15-2004, 03:42 PM
Awesome hobferret! Translations are great for those of us who arent satisfied with babelfish's output. Can't wait to see it on the ftp :)
Ricardo Narvaja
04-15-2004, 04:06 PM
yes i put in my ftp and in web servers

Vboxed (TUTE 195 by ORNIACO) translated to english for HFERRET .zip

hxxp://www.ricnar456.no-ip.org:8090/NUEVO%20CURSO/TEORIAS/210-Vboxed (TUTE 195 by ORNIACO) translated to english for HFERRET .zip

and in the ftp

ftp://curso:curso@ricnar456.no-ip.org/

host:ricnar456.no-ip.org
user:curso
pass:curso
port 21

carpeta NUEVO CURSO-TEORIAS tute 210
Thanks HFERRET good job
Ricardo

Awesome hobferret! Translations are great for those of us who arent satisfied with babelfish's output. Can't wait to see it on the ftp :)


Hasp Hinstd.dll?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hasp Hinstd.dll?
PDA

View Full Version : Hasp Hinstd.dll?

thomasfreedy
04-15-2004, 08:07 PM
Hello All,

Can anyone tell me how to find the access point
to this dll? The app was created in Delphi 6.

Thanks.
sope
04-16-2004, 02:25 AM
Hello thomasfreedy

Can you explain in detail what you mean by access point to this dll ? Do you mean you need to brk in debugger when .dll is loaded ? or something else

Regards, Sope.
thomasfreedy
04-16-2004, 08:41 AM
yes, I tried the different hasp tricks from crackz's papers and can't seem to get access to any of the hasp routines.

Thanks, Thomas
CrackZ
04-16-2004, 05:20 PM
Hiya,

As far as I was aware hinst.dll was simply a HASP driver helper / configuration dll and sets parameters for the HASP driver / checks installation status etc, etc.

Unless you were really interested in that stuff of course.....

Regards ;-)

CrackZ
Spencer
04-18-2004, 05:04 PM
Hi thomasfreedy,

Try to read " tips & tricks for cracking Dongles by CrackZ" on cRACKER's nOTES. look on the web for it.

As CrackZ said "Remember that the weak part of the dongle is usualy the software driving the hardware..." ;)

Rgds and good cracking

Spencer


cracking help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > cracking help
PDA

View Full Version : cracking help

zao
04-16-2004, 02:56 AM
hi i am new to cracking and was just wondering if i am on the right track with this program i am trying to crack.. i have added a screen shot so you can see..
screen shot.. (http://members.shaw.ca/zao420/shot.PNG)

so far i have found out it uses the simgangster.lic file witch i made and added some crap to it.. then ran smart check with it.. by the way i get an error saying my license can't be validated and reverting back to demo.

anyways.. from what i can tell its using an encrypted key. so what would be my next step? use soft ice and brake befor it checks the lic file. or is there another way..

also does anyone know why ds 3.1 doesn't brake for me. i set some brake points like it says in a tut but it never brakes.. i load the program up into symbol loader like people have said on this board. but i can;t manage to get it to brake at all.


DllMain breakpoint
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DllMain breakpoint
PDA

View Full Version : DllMain breakpoint

0rp
04-16-2004, 06:20 PM
hi,

how can i set a breakpoint (using olly) on the first instruction of a DllMain ?

the problem is, that LoadLibrary will call immediately the DllMain after the dll is mapped in the callers addressspace

is there a trick to accomplish that, or should i step through the whole LoadLibrary-function?
Ricardo Narvaja
04-16-2004, 08:30 PM
Put a mark in DEBUGGING OPTIONS-EVENTS- stop in module load- and when stop and look the name of dll you want in VIEW-EXECUTABLE, right click in this line and go to FOLLOW ENTRY with this you found the entry point, and you can put a BP o HE in Entry Point.

Ricardo Narvaja
0rp
04-18-2004, 09:06 AM
damn, i love ollydbg
thxalot


ActiveMARK Packaging Tools Released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ActiveMARK Packaging Tools Released
PDA

View Full Version : ActiveMARK Packaging Tools Released

%UNDEFINED%
04-17-2004, 09:02 AM
Ran across this, I don't believe they have ever before made their tools available to the public.

Has anyone taken a look at this?

http://www.trymedia.com/developer.shtml

I downloaded it, but I can't install it on WinME, it requires NT/2K/XP

So I will have to wait until I get home before I can rip into it and see what low and behold I have.

I am not looking for any help with anything, I was just wanting to hear everyones thoughts :confused:
LobSang Ludd
04-18-2004, 10:48 AM
Hello #undef

TYVM for the info. Much appreciated...
Unfortunately this tool isn't usable for 'unregistered'
Trymedia Developers. :D You need a Login-Account on TM-Servers to make
any use of this VB-App. The only interesting thing (imho of coz) is the
win_sample.exe, which is protected by ActiveMARK R5.0.896. But i think
any AM protected Target is more suitable for reversing issues so there is no real need to download this 6.8 MB.

And beside that, it's a pity (for a multi-zillionare-company) that only
'cosmetical' changes raised the version from ActiveMARK R4.0.710
to the 5.0RC. By cosmetical i mean the GIF's in the AM-Browser hehe...
Under the 'hood' nothing changed: CRC32 loops, SHA-1 checks on the crypted-tunnel-VFS, Rijndael, anti debug threads, obfuscation and code-interleaving is the same. A lot of EBFF's to make Disasm'ing harder. Dumping is very easy, fixing the dump is harder (to hard for me :( ). I think
generating a valid license file (<VID>.lcn) is still the proper way for an
attack. But im not that Crypt-Wizard.
The AM-Pro Wizard with the C++ SDK would be a much worthier download.
(This is not a request - it's a wish) :p

As always...Comment are very welcome.

Rigartz!

PS.: There's a good chance that my translation plugin may be broken. If you found any langwatch errors you can keep em for ya self. Brownies rule...
...im off

Save the Vinyl!
mmk
04-19-2004, 12:03 PM
And beside that, it's a pity (for a multi-zillionare-company) that only
'cosmetical' changes raised the version from ActiveMARK R4.0.710
to the 5.0RC. By cosmetical i mean the GIF's in the AM-Browser hehe...

They must make money and you make money by upping the version number. :D

Under the 'hood' nothing changed: CRC32 loops, SHA-1 checks on the crypted-tunnel-VFS, Rijndael, anti debug threads, obfuscation and code-interleaving is the same. A lot of EBFF's to make Disasm'ing harder. Dumping is very easy, fixing the dump is harder (to hard for me :( ).

Fixing it is not so hard. The only problem is restoring some of the API functions, but they're easy to find and guess. The bad part about ActiveMARK is that no interesting app is protected by it.


BPM on multiple CPU system
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > BPM on multiple CPU system
PDA

View Full Version : BPM on multiple CPU system

crUsAdEr
04-17-2004, 04:57 PM
Hi folks,

I myself do not have a multiple CPU rig but was just wondering how ntice handle BPMs on those boxes... does it set DRx on all CPU to the same breakpoints or does it uses DRx on one CPU only? I think it is likely the former but there is no way to verify... hence if anyone with Multiple CPU, hyperthreading perhaps can help me check if DRx on all CPUs are set to the same breakpoint? You know the drill.. use "CPU" command after a couple of BPM?

Thanks,
crUs
tgodd
04-17-2004, 09:21 PM
Each processor has it's own IDT hence each processors break points would have to be set.

i.e. proc1-dr1 gets set as well as proc2-dr1.

This is because it could never be pre-determined which
processor thread the breakpoint will occur.
crUsAdEr
04-18-2004, 03:42 AM
Hi tgodd,

Thanks for the reply... u r POSITIVELY sure about this?
I thought so too but i just want someone with Multiple CPU to verify..
tgodd
04-18-2004, 08:41 AM
KDPC Alt_Hook[64]; // DPC Object
// Dpc routine to call idt setup again
VOID CallInt2(IN PKDPC Dpc,
IN PVOID DeferredContext,
IN PVOID SystemContext1,
IN PVOID SystemContext2)

{
ASM_Init_Routine(); // Call ASM to do Debug code
return;
}

//Code snippet to setup break point registers on each cpu.
Proc_Num = *KeNumberProcessors;
for ( i = 0 ; i < Proc_Num ; i++ )
{
KeInitializeDpc(&Alt_Hook[i],CallInt2,pDriverObject);
KeSetTargetProcessorDpc(&Alt_Hook[i],i);
KeInsertQueueDpc(&Alt_Hook[i],NULL,NULL);
}

Here is a code snippet on how this is done.


Harddisk serial number & reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Harddisk serial number & reversing
PDA

View Full Version : Harddisk serial number & reversing

skydeath
04-17-2004, 08:40 PM
Hello,
I wish to send a fake serial number to a software so I decide to write a fake dll to hook DeviceIoControl and send my fake serial.
So I have write a dll kernel33.dll in the same directory and patch the import table. All work fine and the fake serial is ok.

The problem is that the software has got a CRC protection so it detect the patch on the import table (kernel32 -> kernel33) so I have try to build a false kernel32.dll with direct Api address but nothing work. The dll seems not accept by the program. I am under Windows 2000 and SafeDllSearchMode is set to 0.

If someone has an idea why my dll is not accept (NT security maybe?) or someone can show me a working technic.

Thanks.
dELTA
04-17-2004, 09:24 PM
Sounds to me that it might be a lot easier to disable that CRC-check, have you tried it?

Or even funnier and more suitable for this situation, if the CRC-check is performed on the file on the disk (i.e. contrary to in memory, which is not likely if the import table is included in the CRC check) why don't you hook the CreateFile api too, and redirect it to an intact copy of the file whenever the program tries to open a handle to its own exe file on the disk? :)
skydeath
04-18-2004, 11:28 AM
seems a good idea to hook CreateFile :)

I have a valid license serial number for only one harddisk so I don't want to do too many patch because the program seems to have more than one CRC and when you do bad patching he just discreetly disable some functions. About the idea to make a keygen it's really more difficult especially with unknow hash algorythm.
disavowed
04-18-2004, 01:27 PM
you could also patch the calling app's call to DeviceIoControl and change the returned data (as opposed to patching or hooking kernel32)


decompile_me ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > decompile_me ;-)
PDA

View Full Version : decompile_me ;-)

libertine
04-18-2004, 05:16 AM
Try your luck on this one: www.backtrace.de/cashdispenser

Looking forward to your solutions!
disavowed
04-18-2004, 01:32 PM
i haven't been able to access http://www.backtrace.de / http://www.sport-und-event.de/backtrace.de/ for weeks
libertine
04-18-2004, 01:46 PM
ah, i remember you saying that once on irc.
but sorry, I dunno what the problem is. maybe try a proxy?
does anyone else have this problem ?
JMI
04-18-2004, 02:00 PM
Here ya go.

simulation software of the German EuroBank AG. :D

Solutions will only be accepted until the 30th of April 2004 !!

Regards,
doug
04-18-2004, 02:10 PM
not really hard, so you guys should hurry up ;)
disavowed
04-18-2004, 04:54 PM
ah, i remember you saying that once on irc.
but sorry, I dunno what the problem is. maybe try a proxy?
does anyone else have this problem ?
http://www.backtrace.de (http://www.backtrace.de) gives me a 302 redirect to http://www.sport-und-event.de/backtrace.de/ (http://www.sport-und-event.de/backtrace.de/), but i can't resolve www.sport-und-event.de (http://www.sport-und-event.de) to an ip address
OorjaHalT
04-19-2004, 01:17 AM
It sure opened rightly for me
libertine
04-19-2004, 05:43 AM
doug, finished yet ? ;)
doug
04-19-2004, 10:44 AM
ya, well, it's 'the document the interface' part that turns me off a bit:)
Hopcode
04-19-2004, 11:11 AM
ya, well, it's 'the document the interface' part that turns me off a bit:)

Wish i could understand what the fuck the german means in the program too :)

since its fictitious, why not using english directly ? :)
doug
04-19-2004, 02:39 PM
Wish i could understand what the fuck the german means in the program too :)

since its fictitious, why not using english directly ? :)

I don't speak / understand german either, however,
http://babelfish.altavista.com/ was enough to understand what each msg stands for...
libertine
04-20-2004, 08:33 AM
use babelfish, treat the german language as the first hurdle.
LaptoniC
04-20-2004, 06:34 PM
Do we allowed to patch card.bin then it is easy to smash it for fun and profit :)
Woodmann
04-20-2004, 09:24 PM
Do we allowed to patch card.bin then it is easy to smash it for fun and profit

:D

Woodmann
libertine
04-21-2004, 04:59 AM
Readme.txt says:

Your goal is to

1.) decompile the software
2.) document the software
3.) find potential programming flaws
4.) exploit the vulnerabilities by
gaining control over the cash dispenser
5.) describe how to fix/secure the code

---
Anything else is not a valid solution.
LaptoniC
04-21-2004, 04:30 PM
I dont get it.If we have access to cash dispenser(software) directly we can change it in anyway we want.No fun in it.
doug
04-21-2004, 10:01 PM
i don't think your exploit can change anything in the .exe (however, when fixing those security vuln., then obviously there are changes to the exe)

The way I see it, the only input into the ATM machine (that you have control over) is the card.
libertine
04-22-2004, 04:37 AM
why don't you just start off with the first task rather than discussing about patching anything ?
LaptoniC
04-22-2004, 06:02 PM
I know what I am talking about.Of course I dissambled it.As you know it gets name until it reaches 0 char.So if you patch card.bin you can let it to read a lot of bytes.And because name buffer 52h you wil have nice buffer overflow.Whatever.
evaluator
04-22-2004, 11:27 PM
but..

this is crackme or "upgrademe"?(upgrade my prog?)
libertine
04-23-2004, 02:24 AM
there's nothing more to say, except if you're posting solutions here - where's the fun in it? readme.txt says it all.
mmk
04-23-2004, 04:42 PM
IMHO, reverse engineering this program is like cracking a crackme, a total waste of time. Why find vulns in that program when one can find vulns in real programs?
doug
04-23-2004, 07:53 PM
imho, crackmes are often toy examples for specific problems.

If you can't do this crackme, you can't expect to do any kind of serious reversing on bigger, more complicated programs.

Usually, you don't waste time on a crackme unless there's something new/interesting to learn.
libertine
04-24-2004, 12:01 PM
the task is to decompile it (convert it to 'C' or 'Pseudocode', not to crack it. but of course, if you are a pro at reverse engineering there's no reason to try it.


Low-level Keyboard Hook
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Low-level Keyboard Hook
PDA

View Full Version : Low-level Keyboard Hook

SynApsus
04-18-2004, 09:05 AM
Hello guys.
I am coding a new tricky tool using a kernel driver and I want to make my program pop-up when I press a key, just like SoftIce for example.
There are in the windows 2000 DDK an example of a keyboard input filter in ring0, based on a hook, but I wanted to make it different :
I want to know if there are QUICK methods to do it, using ints or direct port access.
If someone could tell me how we can read keyboard input using IN/OUT instructions with 60h and 64h ports, or which interrupt has to be hooked, how do they function ( I think under NT systems it is interrupt 31h )
it would b veeeeeery nice !
Thanks, syn
Clandestiny
04-18-2004, 02:05 PM
Hello guys.
I am coding a new tricky tool using a kernel driver and I want to make my program pop-up when I press a key, just like SoftIce for example.
There are in the windows 2000 DDK an example of a keyboard input filter in ring0, based on a hook, but I wanted to make it different :
I want to know if there are QUICK methods to do it, using ints or direct port access.
If someone could tell me how we can read keyboard input using IN/OUT instructions with 60h and 64h ports, or which interrupt has to be hooked, how do they function ( I think under NT systems it is interrupt 31h )
it would b veeeeeery nice !
Thanks, syn

Hiya,

If you opt to write a keyboard filter, I can give you a few pointers as I've just recently written one.

It is, however, possible to hook the keyboard directly. For details on the keyboard see:

h**p://cs.smith.edu/~thiebaut/ArtOfAssembly/CH20/CH20-2.html

Cheers,
Clandestiny
SynApsus
04-19-2004, 02:38 PM
Hmmm.... I said I wanted to do that under windows 2000. I think the ArtOfAsm link only works under win9x...
I tested it :) and even when I try different keystrokes, the in al, 60h always return me the same byte. And if it works, it doesn't help me on how to rightly code this...
Anticode
04-20-2004, 04:19 AM
look at http://www.sysinternals.com/ntw2k/source/ctrl2cap.shtml
also look at http://www.anticracking.sk/EliCZ/import/Build3.rar source code
KeyboardDriver_rpuc and KeyboardDriver_filter directories.
SynApsus
04-20-2004, 01:08 PM
Thanks, I'll see that and check if it is a right solution !
( I think ctrl2cap uses API way to hook, as far as I remember, and that's not my aim )
Thanks anyway !
Clandestiny
04-20-2004, 02:20 PM
Thanks, I'll see that and check if it is a right solution !
( I think ctrl2cap uses API way to hook, as far as I remember, and that's not my aim )
Thanks anyway !

No, Ctrl2Cap creates a filter driver to intercept the keyboard read IRPs.

-Clandestiny
SynApsus
04-21-2004, 06:41 AM
Clandestiny, you're right, but me too... it wanted to say it uses 'internal' or 'native' api in the filter driver ...
I don't want to use any windows api, even native ones ! I want to directly read my scancodes with the port or by hooking an interrupt, and intercept the key being sure my program is the first to read it, before windows.


ASPR 1.23 loader SEH approach
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR 1.23 loader SEH approach
PDA

View Full Version : ASPR 1.23 loader SEH approach

Mrklippel
04-18-2004, 09:20 AM
hi guys,

i'm not a newbie concerning aspr protection, but compared to you
i might be considered one..

in the latest ASPR protections i found that if i would create a loader
that patches bytes in memory, that my loader wouldn't function..

because of a loader protection scheme of Alexey..

Now i used Olly to approach the victim, and after a few SEH's
( depending on the target 15 to 23 SEH's ) i was able to patch the memory
and have the program run without any nags anymore..

now comes my question..

I know it is possible to do SEH handling inside ASM but as i am fairly new to that, i'd like some help if possible..

i can create a loader in asm, that patches bytes in memory, but...

i need to do this after a few SEH's ( depending on the target )

how can i do this ?

load a target, so that it handles SEH's

count the SEH's that occurred and after a number of SEH's start to look for
the bytes in memory to patch..

i tried to look for asm and SEH examples on the internet, and on this forum, but i only found a few examples that had SEH handling inside, and these examples weren't loaders.

is there someone who wants to help me out here and give me / point me
to an example of a loader in ASM that handles SEH ?

or someone who wants to do this part together...

I never started with unpacking ASPR myself, because i hate stolen bytes and api simulation etc..
and i like the idea of leaving the target "physically" untouched

anyone able to provide me with some knowledge ?

if i have the complete sollution for a "SEH" enabled aspr loader, i'll share a template with you guys..

grtz, MrKlippel
crUsAdEr
04-18-2004, 10:09 AM
invoke CreateProcessA, addr ProgName, NULL, NULL, NULL, NULL,\
DEBUG_PROCESS+DEBUG_ONLY_THIS_PROCESS+NORMAL_PRIORITY_CLASS,\
NULL, NULL, addr startInfo, addr processInfo
.if eax==0
lea eax, Cant_create_Process
jmp @error
.endif ; create the damn process
DebugLoop:
invoke WaitForDebugEvent,offset DebugEvent,INFINITE
mov eax,DebugEvent.dwDebugEventCode

cmp eax,CREATE_PROCESS_DEBUG_EVENT
jz CreateProcessEvent

cmp eax,EXIT_PROCESS_DEBUG_EVENT
jz ExitProcessEvent

cmp eax,EXCEPTION_DEBUG_EVENT
jz ExceptionEvent

jmp ContinueProcess

CreateProcessEvent:
mov eax,DebugEvent.dwProcessId
mov processInfo.dwProcessId,eax
mov eax,DebugEvent.u.CreateProcessInfo.hThread
mov processInfo.hThread,eax
jmp ContinueProcess

ExitProcessEvent:
invoke ContinueDebugEvent,DebugEvent.dwProcessId,\
DebugEvent.dwThreadId,DBG_CONTINUE
invoke ExitThread,0 ; EXIT

ExceptionEvent:
; is exception a Breakpoint?
;here do the SEH counting & PATCHING

ContinueProcess:
invoke ContinueDebugEvent,DebugEvent.dwProcessId,DebugEvent.dwThreadId,DBG_CONTINUE
jmp DebugLoop
.endif

I dig up some old notes on aspr.. hope this helps.. you will need to modify and tweak it a bit i guess...
search on DebugAPI for more info..
Mrklippel
04-18-2004, 10:13 AM
I dig up some old notes on aspr.. hope this helps.. you will need to modify and tweak it a bit i guess...
search on DebugAPI for more info..

@crUsAdEr

thanx for such a quick reply,
i'm gonna try it immediately..

thx again d00d :)
Mrklippel
04-18-2004, 05:21 PM
hi guys,

i made a rather successfull approach with my loader sofar

Crusader, you gave me the right direction, however i adjusted things a bit.. :)

what i did :

in my loader i counted the number of seh's

and after 15h of ( for my victim) them i patched the memory..

sometimes this can be a lower number sometimes higher
because ASPR sometimes skips routines..

it really is a simple approach..

i'm only diving into defeating the trial protection part... once i am able to implement that into my loader... i got it working, and i'll share it with you guys.. :)

i searched the board on aspr and trial protection, and found some interesting articles, however i didn't find what i'm looking for..

i read that aspr not only adds a key in it's own part of the registry but
somewhere in the CLSID ....

does anyone have a clue how to find that reg entry ?

because i could regclean my system, but i cannot implement that in my loader :)

if someone wants to take a look at unfinished ASPR loader code
private message me, i'll mail it

bye for now

grtz MrKlippel
gook
04-20-2004, 01:41 AM
Hello Mrklippel,

Maybe you want to take a look at Manko's asprdbgr. Reading the source can be a great way to help you in the direction. It can be found on this board.

Greetings
Mrklippel
04-20-2004, 09:34 AM
Hello Mrklippel,

Maybe you want to take a look at Manko's asprdbgr. Reading the source can be a great way to help you in the direction. It can be found on this board.

Greetings

mmmm i'm thinking about a different approach...

i'm gonna monitor registry access during the ASPR seh's...

and do a lil trick with that..


possible to get the string(file) from md5 hash
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > possible to get the string(file) from md5 hash
PDA

View Full Version : possible to get the string(file) from md5 hash

highfly
04-18-2004, 05:13 PM
possible to get the string(file) from md5 hash

something like getting 1kb file from the 16 bytes md5 hash,this md5 has is calculated from that 1kb file,possible?

for example

Text is : woodmann
md5 hash for woodmann is : 1B C6 BD 2E C2 0A AC 23 4B 59 84 C4 48 74 41 97

now possible to get the text(woodmann) from that md5 hash
dELTA
04-18-2004, 05:32 PM
No, the purpose of cryptographic hashes is to prevent just that (not to mention that for longer generic data strings like e.g. 1 kb it would be theoretically impossible to compress them to 16 bytes under most circumstances, just imagine how incredibly good data compression algorithms that could be derived if that would be possible).

The best you can do is to bruteforce all possible source strings inside a given length range.
highfly
04-18-2004, 05:44 PM
the file loading strings are unencrypted in exe with foldername,filename,extention are in different location in exe,when the program is executed it joins foldername,filename,extention and creates md5 hash then it loads the file by checking the hash in the file,anyway to get foldername,filename,extention with the hash
dELTA
04-19-2004, 08:53 AM
Surprisingly enough, as it happens, Windows file paths are not an exception to what I just said about hashes, no... :rolleyes:
highfly
04-19-2004, 01:01 PM
any idea how exe joins the file and folder names which is at different location in exe
dELTA
04-19-2004, 01:10 PM
By copying them to a buffer in the memory?
highfly
04-19-2004, 01:23 PM
to load a file it uses the path and filename in exe,btw the files loaded are from a pack file which does'nt have names,it identifies with hash

process

get the filename and folder name
join those and make a string
with the string it calculates md5
now it loads the correct file from the pack file with that md5 hash

any possible method to crack this function
dELTA
04-19-2004, 07:09 PM
Exactly in what way would you like to "crack" this function, you must be much more specific and give much more details to get any real help. What are you trying to accomplish, and why? How did you get the information you currently have?

Also, if the files are extracted only based on these "md5 hashes", there can only be a finite number of predetermined static hashes (i.e. a lookup-table) for files to extract from that archive, since there is no way for the application to reverse that hash and determine the original path from it.

How do you know it's an md5 hash at all? Are you sure it's not just some sort of encrypted data?

Also, why don't you just capture any file you like when the program extracts them itself? Modify the input to that "hash" function during runtime if you can't get the program itself to request the files you want from that library.

And remember, MUCH more details now if you want any further help!


unpack me
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpack me
PDA

View Full Version : unpack me

girl
04-18-2004, 07:22 PM
unpack it
I'm a chinaese gril
help me

thankyou
esther
04-18-2004, 09:08 PM
*sigh* Do you think ppl here will believe you are a girl :eek: :rolleyes:
Woodmann
04-18-2004, 09:13 PM
Errrrrrrrrrrrrr........

Most women would not make so many spelling errors :eek:

Woodmann
girl
04-18-2004, 09:15 PM
sorry!
why????
this is a new Protector .
I can't unpack it.

help me
girl
04-18-2004, 09:16 PM
I'M a chinaese girl (cracker) ---------TRUE.
esther
04-18-2004, 09:18 PM
Most Woman will sharp enough to read the faq before posting here :eek: :rolleyes:
girl
04-18-2004, 09:29 PM
to esther

whan do you mean?
esther
04-18-2004, 09:33 PM
http://www.woodmann.net/fravia/rce-faq.htm

*sigh* you aren't a girl after all :eek:
Woodmann
04-18-2004, 09:37 PM
Howdy,

What exactly are you looking for ?

So what if I have it unpacked....now what ?

You need to include more information.

Woodmann
girl
04-18-2004, 09:42 PM
sorry !!!!!!!!
My English is very poor.
can't express my thought.
sorry!!!!!!!!
esther
04-18-2004, 09:47 PM
you need to show what you have done before ppl can help you,that's what Woodmann means ;)
girl
04-18-2004, 10:08 PM
to esther
thank you
evaluator
04-19-2004, 08:44 AM
hi, "girl"

i have 3 question:

1. why you need to unpack it?
2. why we need to unpack it?
3. what proctector's name is? (is it your protector?)
esther
04-19-2004, 09:33 AM
1. why you need to unpack it?

For fun and laughter

2. why we need to unpack it?

To help her to unpacked it,if you suceed in unparking it she give you a kiss LOL

3. what proctector's name is? (is it your protector?)

Dunno,doesn't run in my win2k,maybe I have softice installed ;)

Update:

It doesn't run even softice disavbled :p maybe compatible issues
girl
04-20-2004, 01:47 AM
proctector's name -----SDproctector v1.10 ---chinese.
you can run it -----XP
I'm a cracker I want to unpcakthis.
thank you.
my msn: mm@digitalnuke.com

welcome

if you unpack it I'll give you a kiss. :p

thanks!!!
evaluator
04-20-2004, 09:55 AM
esther, you have AMD!?
Mrklippel
04-20-2004, 11:32 AM
1. why you need to unpack it?

For fun and laughter

2. why we need to unpack it?

To help her to unpacked it,if you suceed in unparking it she give you a kiss LOL

3. what proctector's name is? (is it your protector?)

Dunno,doesn't run in my win2k,maybe I have softice installed ;)

Update:

It doesn't run even softice disavbled :p maybe compatible issues

mmm it is a weird kinda protection...
i cannot attach to it with olly
if i start this app, and then start olly..
olly closes and the app closes....
evaluator
04-20-2004, 04:29 PM
this is SoftDefender newer version.
it checks for program file names, program window class names etc..
rename all in Olly or in Sice & try so.
{Sturm}
04-21-2004, 05:38 PM
well i've tried running it with olly after renaming everything and it still detected it and closed before even unpacking anything :|
anyone had any luck?
it also seems to have some sort of crc check maybe to check the integrity of the program to see if you put some breakpoints....
not sure how it checks for the presence of a debugger tho..
%UNDEFINED%
04-21-2004, 09:30 PM
Interesting protection, I have never had the pleasure of examing it before now.

I tried protecting my own target and single stepping through it

It detected me using a stack trick...I am pretty sure at least

http://d-jester1.tripod.com/images/Exit__.png

http://d-jester1.tripod.com/images/stacktrick.png

URL's are case sensitive

Sorry I couldn't be more help
{Sturm}
04-21-2004, 10:39 PM
yeah i did the exact same thing...downloaded the demo and protected my own target...
however im not sure about the trick used...im still really a newbie at all this so im not sure to understand about that stack trick??
when single stepping through i have also found the that the loopfd seemed a bit suspect....and also some places you can put breakpoints, other places you can't because it checks for modifications to the program :/

interesting target...makes me wonder what's up next after by passing this first trick :confused:
evaluator
04-22-2004, 01:15 PM
don't forget, it creates second process, first exits, passing in tmp file time;
many TickCount checks, again not_correct check for single-step tracing;
(self overwriting REP_MOVS, some earlier AMD always will fail)
there can be some more checks for Ring3 debugger, then IsDebuger byte.
later will look.
upb
04-22-2004, 04:16 PM
HI!

i found a nice anti-ollydbg-tracing trick at the very start of the program :)

SDPI:0106B046 push large dword ptr fs:0
at this point, the last seh handler will be circular, with this i mean that the pointer-to-next-handler member in the structure will reference the same last seh handler struct. and this somehow fucks up olly's ability to single step thru the code, olly will be caught in a 100% cpu hogging loop.

the same thing can be done with those 5 instructions (the protector used 26)
push dword ptr fs:[0]
push esp
sub dword ptr [esp], 4
mov fs:[0], esp ; <- olly v 1.08b will hang after single stepping this
pop eax
pop dword ptr fs:[0]
evaluator
04-23-2004, 09:19 AM
ok, in decrypted protector section I see api name ZwQueryInformationProcess;
on XP this breaks 2 time;
second time this api called with parameter 7; traced it..
so it works like IsDebuggerPresent, but gives info from KPEB(Ring0 PEB);
So this is, why can detected Ring3 API debuggers;
{Sturm}
04-24-2004, 01:53 AM
ok, in decrypted protector section I see api name ZwQueryInformationProcess;
on XP this breaks 2 time;
second time this api called with parameter 7; traced it..
so it works like IsDebuggerPresent, but gives info from KPEB(Ring0 PEB);
So this is, why can detected Ring3 API debuggers;

well tks a lot...that was my big problem :| i just changed the jmp right after this api is called and the program runs fine...however im not sure to understand 100% how this work, i guess ill just try to find more info on it :)
also, how did you end up setting a breakpoint on that api? another common trick..??
JMI
04-24-2004, 04:47 AM
Well perhaps he did a SEARCH of the Board, using "Debugger Detection", (without the quotes) and read nikolatesla20's post #6 [mentions the parameter "7"] and Kayaker's great comments in post #8 of this thread [mentioning "ZwQueryInformationProcess"]:

http://66.98.132.48/forum/showthread.php?t=5140

or, maybe he read it when it was posted. :rolleyes: Or maybe he taught Kayaker how it worked. :D Anyway, well worth the read, as Kayaker generally goes deeper into the code then others generally do. Must be because he spends so much time "gliding over the surface" [in his Kayak] every chance he gets.

Regards,
evaluator
04-24-2004, 07:42 AM
curious, but i tried search for word "ZwQueryInformationProcess", & search sux
because too much long word?? can you fix it?

so i myself discover about it, but in mind i remember that Kayaker one told something about.

BPX i set on this api & that's all folks.
{Sturm}
04-24-2004, 09:36 AM
well this is really interesting :) learning quite a few tricks...
it seems however that the protected notepad also has something else to detect olly.
when i packed my own program i was able to run it fine by just changing the jump after the return of ZwQueryInformationProcess
but for the notepad protected one, since its protected by the full version of SoftDefender i guess it has a few more tricks..:)
nikolatesla20
04-25-2004, 11:40 PM
LOL

Softdefender is one of the best protectors out there currently in my opinion. I actually have an unpacker written for it it's about 98% done, but too bad I'm not going to share my info right now...to busy with other things, and I didn't write everything down! but I have all my code to go by.

Basically the program writes out a tmp file, kills itself, then restarts itself, reads in the temp file, the current tick count is used in the temp file so if it takes too long, it kills itself again (to detect ring3 debug), also does LOTS of gettickcounts everywhere, as well as the nice ZwQueryInformationProcess. If you are a ring3 debugger tho you can override ALL of these calls and give the protection what it thinks it needs to keep working. Not that hard.

My unpacker fakes the whole temp file read and just feeds it bogus info :) LOL. Also, override GetTickCount and return a constant value always..piece of cake. Now just have to dump at OEP. Well, OEP is a little harder to find, because of stupid other checks, but it's easy manually, just hard automated. That's why I never finished yet, got busy with other things.

Definitely a nice protection.

I think I got far enough to do a program dump, but you'll have to find OEP yourself. If you have any skill at unpacking that shouldn't be too hard for you anyway. Imports as well, you should be able to do manually. The dump is always the hard part with this protection.

I wrote this a LONG time ago, so I have no idea if it works on current SoftDefender, but you are welcome to try it for the dump.

-nt20
Kayaker
04-26-2004, 03:23 AM
curious, but i tried search for word "ZwQueryInformationProcess", & search sux
because too much long word?? can you fix it?

Done. I increased the maximum search length from 20 to 30 characters and rebuilt the search index. ZwQueryInformationProcess or a wild card derivative of it shows up now.

This will increase our database size, but shouldn't be by too much since the long words are mostly only API's. Maybe we could up the length even a bit more, caretakers? (Did I break anything? :p)

Also, another method is to use the unrestricted search function of the Archive .chm file. The original thread can then be opened from the server by clicking on the thread title.

Here's a quiz that would actually help us here - what is the longest API or other reversing term that might be used in this forum?

Cheers,
Kayaker
dELTA
04-26-2004, 06:06 PM
Well, one of the contestants might be the "Can anyone give me a SuperDuperMegaUnpackerCrackerPatcherThatWillDoEverythingForMeWithoutMeHavingAFrickinClueAboutWhatsGoingOnAtAll, please?". :D
evaluator
04-27-2004, 04:26 AM
..from library "you_bastar.dll"?

fif, dirti delta..
girl
04-27-2004, 06:32 PM
thank you


VMWare vs. Virtual PC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > VMWare vs. Virtual PC
PDA

View Full Version : VMWare vs. Virtual PC

sgdt
04-18-2004, 11:20 PM
I'm always running into things that are potentially hostile, and thus needed a sandbox to determine if "stuff" was friend or foe. You know the type of stuff, code at the begining of DLLs. EXEs that friends bring over. Stuff that IS puts on your computer at work. Yes, funky stuff where I don't dare risk REAL computers.

Not being able to attain VMWare easily, I decided to give VirtualPC a try. I was amazed at it's absolute lack of speed. After an hour of installing W2K and stuff on it (and no end in sight), I decided to look for VMWare a little harder.

W2K, service packs, etc., are all installed on VMWare, Virtual PC is only now ready to install the OS service pack.

It's night and day. Something tells me that Bill with his Billions bought the wrong company...

While waiting for the OS to install on MS VPC, and looking for VMWare, I ran accross a review pitting the two against each other. Summery was that while VMWare was faster, VPC was easier to use. Maybe a while back, but VMWare 4.5.1 is every bit as easy as VPC 2004. And when you take into account frustration on waiting for things to happen, VPC looses flat out on ease of use.

MS Virtual PC may be easier to find, but it's nearly unusable. When you take into account integration between VMWare and SoftIce, it's not even a comparison anymore.

Many of you knew this already, and I pretty much suspected as much. But I guess I had to see it for myself. I couldn't imagine even MicroSoft could write something that could run THIS slow. VMWare for me, thanks! (BTW, W2K installed on VMWare *faster* than it did on the actual host box. I still haven't figured that one out. Probably the 32 bit drivers were already loaded or some such. I'm not complaining, though!!!).
Aimless
04-19-2004, 12:14 AM
Micro$oft is known for its ease of use, not performance under duress.

Have Phun
disavowed
04-19-2004, 08:48 AM
just one thought.. have you tried increasing the thread priority of vpc to see if that makes it comparable to vmware?
dELTA
04-19-2004, 09:09 AM
I have a recent magazine test/comparison of the two here in front of me too (from a Swedish magazine). In that test they ran e.g. Sysmark in it, and the two had very similar performance.

From own experience though, I can say that it can make a world of difference how much ram memory is allotted to the virtual machines, and how much memory is in the physical host! Perhaps you are "on the border" with these values, and VMWare just has its critical limit a bit lower than Virtual PC?

With that said, I should also say that I really love VMWare, and that it is simply amazing. With the Softice compatibility it's just unbeatable (there are some problems with that though, which I will soon submit a post about here, to hopefully help other people trying to get it working).
bflash2k
04-19-2004, 10:27 AM
Moreover, you can use Softice in a VMWare "machine" .....
sgdt
04-19-2004, 11:38 AM
Was it a fair comparison? I think so.

The machine at home that I tried it on is a dual Xeon rig with 2GB of 533FSB ram, 15K SCSI drives on a dual channel U320 controller (stripe set delivering almost 200MB/sec), and a wickedly overclocked dual head nVidea video card, all watercooled (even all the drives, 8 HD blocks, 2 CPU blocks, and a Video block. It's wicked!).

Both the VMWare and the VPC virtual machines were configured to use 512MB RAM. For the first hour VPC was running while installing the OS, it was the only program running on the box.

After an hour of installing the OS, I decided to *look* for VMWare (google running on another computer, and finally eDonkey). I found it, down loaded it, and installed it on this rig, got it running, and had the OS and service packs (and Olly, PEiD, RegSnap, etc.) installed before VirtualPC was even ready to install the OS service pack. Total time after downloading was under 20 minutes.

I agree there may be some setting on VPC that needed to be checked or unchecked or what not. But for both VMWare and VPC, I used their respective "virtual machine wizards" to set things up. Even if VPC was comparible in speed at optimal settings, it is very safe to argue it's wizard was lacking.

Maybe it's just me, or my configuration. Maybe VPC hates xeons or SCSI (there are software that don't benefit at all). But, for me at least, VPC blows dogs for quarters. I would LOVE to see VMWare get some serious cheap competition, as I need to purchase soon. MicroSoft has the resources and the talent to do it, but it seems for the past year since they purchaced VPC they really haven't done enough. Just an opinion.
ElMago
04-21-2004, 12:09 PM
Did you use a CD to install or copy the installation files to your hard disk?Virtual PC is extremly slow in accessing shared folders. CDs seem to be faster for me. The core emulation speed is OK once a system is installed with a few glitches here and there. For what you're doing, however, VMware is the far better choice. Virtual PC emulates very common hardware and is more compatible with retro and exotic operating systems--Os2 for example and is good for use as an emulator to run old DOS software but for investigating hostile code VMware is the way to go. You might be interesed in this article:www.zeltser.com/sans/gcih-practical/revmalw.pdf.
disrupt0r
04-22-2004, 03:02 AM
just one thought.. have you tried increasing the thread priority of vpc to see if that makes it comparable to vmware?

By default, Virtual PC gives priority to 'normal' OS processes. This can (and should) be changed in Options -> Performance dialog.

This will speed up Virtual PC quite a bit, but it's still at least two times slower than equivalent VMWare configuration. I've seen comments like "it's because of better hardware abstraction", but I have yet to see the proof.
ElMago
05-08-2004, 12:12 PM
This is an update to my previous post. I recently Installed VmWare 4.05 and have been comparing it to Virtual PC 5.2--the last pre M$ version. The host system is an Athlon 2400 laptop with 512 ram and Windows 2k service pack 4. I installed PcDOS 2000 and Windows NT 4.0 as guest systems. First
result--surprise, surprise--was that NT4 installed considerably faster on Virtual PC and CD access was considerably faster. Virtual disk access is slighty faster and I haven´t done anything yet that benchmarks Cpu and cores emulation speed. My laptop has a video card that gives me lots of problems with DOS grapics--bgi graphics especially--and I have been using VPC to run a few old DOS applications that I chrerish. Vmware's video emulation wasn't up to the the task.

The NT installation program detected VPCs emulated S3 Trio card and
installed a driver automatically--this is first time ever I haven't had to install a video driver after NT4 was installed. Video emuation is the one area where VPC is the clear winner. Next-and of more interest to reversers--I installed softice for DOS and Windows 3.1 on my virtual machines. VMware was 1000 times superior. Since they declare their official support for softice in their documentation this shouldn't be a surprise. Both versions installed and worked absolutely flawlessly. On VPC I couldn't get the DOS version to work at all--froze up the system after the first control D-- and the Windows 3.1
version worked after a bit of tweaking--not too different to experiences I've had with it on real computers. I haven't had the time to install and test the Nt version yet but I expect the results to be about the same.

One conclusion I come to is that performance of VPC seems to depend on a computers hardware/softwar/0s configuration. My experiences contradict those of Sagt. Both programs have their strenghs and weaknesses. Vmware has softice support and superior networking on it's side and VPC has simplicity and compatibility. I definitely have uses for both of them.
sgdt
05-08-2004, 09:24 PM
One conclusion I come to is that performance of VPC seems to depend on a computers hardware/softwar/0s configuration. My experiences contradict those of Sagt. Both programs have their strenghs and weaknesses. Vmware has softice support and superior networking on it's side and VPC has simplicity and compatibility. I definitely have uses for both of them.

VPC is also smaller, and cheaper.

I *think* the issue I was having had more to do with me running dual Xeons, not exactly the most common configuration. I also run dual monitors that gives some software fits.

YMMV. For what I do on this configuration, VMWare trounced VPC. It was like comparing a Cray to a VIC-20 (you could almost watch screen redraws on VPC).

I *KNOW* that MS couldn't have screwed it up THAT bad, ergo, I'll blame configuration. But I can't dump my rig, or spend a great deal of time tweeking VPC, when VMWare isn't that much more expensive and works correctly right out of the box.

Additionally, it seems that whenever I'm in need of running a virtual machine, I'm also in need of running SoftIce. I mean, I don't use it for everyday things, only when I need a sandbox to prevent a situation from getting out of control.
babar0ga
05-09-2004, 09:23 AM
Here is interesting actricle about detecting vmware. Offtopic here but...

hxxp://z0mbie.host.sk/vmware.txt
dELTA
05-09-2004, 10:08 AM
Nice info, thanks. :cool:
ElMago
07-20-2004, 01:47 PM
Haven't had much free time lately but did finally try to install Softice 4.05 on my WinNT4 virtual machines. It bombed badly on both VMWare and VPC!! Wouldn't work at all on VPC and froze up the machine on the first control D with VMware.
In spite of these setbacks, I find both these programs to be fantastic RCE tools. In the reversing of of Malwares as usefull and important as Softice and IDA. I am screening all suspicous downloaded executables with my VPC/NT machine(ease of use wins, the undo changes to virtual hard is automatically executed every time I turn off the Virtual machine). This has saved my ass a few times--my time really, restoring a system from an Image file takes a lot longer than turning off VPC. For more in depth investigations I eventully plan on setting up VMware with a full suite of RCE tools. As soon as I have some free time and I can find a combination of Windows and Softice that work together in a VMware machine.
nikolatesla20
07-20-2004, 03:49 PM
While VMWare is definitely more powerful in the case that you can actually run SoftICE on it, it still sucks in some ways because you need to run SoftICE in VGA 16 color mode.

VMWare also supports USB , however, I could not get our company's propietary drivers to work on it, it blue screened.

In the benchmark tests, VMWare smoked VPC on floating point ops, but VMWare also dragged *ss on graphics operations.

In any case, I've used both of them extensively, and I rather like VirtualPC so far, yes it ALWAYS takes a while to install an O.S., but it runs just fine once you have it all set up.

And the networking is pretty much just as flexible in VPC as in VMWare. VMWare, however, does support Linux, etc, better, because it will have additions for it, whereas Microsoft removed all support for linux in VPC. Notice I said "Support". You can still run linux in it, it's just you won't have any VPC additions, etc. So if you are going to use a *nix OS or other, you will prolly be better of with VMWare - MAYBE. See, VPC emulates more "real" hardware that OS's like *nix can actually detect properly. With VMWare, all the drivers are special, they don't emulate anything common, so you practically NEED their additions.

If it's a windows product, VPC works just fine, and it's waaaay cheaper.

-nt20
dELTA
07-20-2004, 06:57 PM
It is indeed possible to run Softice in VMWare, and also in graphic modes other that "VGA 16 color mode". Please see the following thread regarding this subject:

http://www.woodmann.net/forum/showthread.php?t=5806
Silver
07-22-2004, 03:22 PM
With VMWare, all the drivers are special, they don't emulate anything common, so you practically NEED their additions.

Have to say that for every o/s I've installed under VMware, I've never needed anything special... Apart from spending an hour the first time trying to figure out how to install the VMWare tools into linux... then noticing the .iso in the install dir :D :rolleyes:
wtbw
07-22-2004, 07:20 PM
Or use Visual Softice, which is lovely :)

Will
doug
08-02-2004, 02:05 PM
Was posted on slashdot, but thought it was an interesting addition to this thread...

Virtual machine shootout: VMware vs. Virtual PC:
http://arstechnica.com/reviews/004/software/virtual-machines/vm-1.html

it's a 4 pages comparison with benchmarks.
ElMago
08-02-2004, 03:33 PM
Wow, great info, didn't even mean to ask for it but thanks to Delta all the same. I like the direction this tread is moving into.
Kayaker
08-02-2004, 05:10 PM
Here is interesting actricle about detecting vmware. Offtopic here but...
hxxp://z0mbie.host.sk/vmware.txt

Don't know if this one has been mentioned yet:

VMware Fingerprinting
http://www.trapkit.de/vmm/vmm.htm


Hasp emulator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hasp emulator
PDA

View Full Version : Hasp emulator

trick
04-19-2004, 02:35 AM
Hello,

I search a Hasp emulator (free) for windev

Tanks


question about debuggin an app and preventing registry access..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > question about debuggin an app and preventing registry access..
PDA

View Full Version : question about debuggin an app and preventing registry access..

Mrklippel
04-19-2004, 03:40 PM
hi,

i have a question,

i like to know if it is possible to write a loader that loads an exe file
AND that allows the exe file to write only to 2 given keys in the registry...

reading is allowed for all keys

writing only for 2 keys ( and their subkeys offcourse.. )
disavowed
04-19-2004, 04:15 PM
yes, it is possible
Mrklippel
04-19-2004, 04:19 PM
yes, it is possible

is it possible, you tell a little more on how to approach ?

eg hooking, or doing something else..
i'd like to know how,

because if i can prevent the app to write to any other key than it needs, i can defeat/bypass the trial scheme :)

eg, for all reads to registry, from within aspr i can return "notfound" or something like that

i will do that untill the last SEH' then i'll handover the control to the registry again to the program

as result the trial scheme is defeated, or is this thought to easy ???

grtz, MrKlippel
dELTA
04-19-2004, 07:03 PM
One generic method would be to let the loader do the following:

1.
Inject hook/handler function (see below) into target memory space (inside PE cave, or allocate dynamic memory).

2.
Replace IAT address entry (or equivalent) of the desired registry API function with an address to your own hook/wrapper function (the one you just injected). Inside this function, forward all calls that have "legal" parameters to the real API, and for the other ones return whatever error codes you like (i.e. in this case when it attempts to write to any other registry key/value than the ones you want).
disavowed
04-19-2004, 07:26 PM
easier solution: http://research.microsoft.com/sn/detours/
Mrklippel
04-20-2004, 09:36 AM
easier solution: http://research.microsoft.com/sn/detours/

mmm great idea.... :)

now i'm looking for a good asm example... so i can start working...

i like the idea of monitoring api calls..


UD2 opcode
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > UD2 opcode
PDA

View Full Version : UD2 opcode

TBone
04-19-2004, 03:55 PM
As part of my ongoing effort to modernize my knowledge of how program execution works from top to bottom, I'm reading through the Intel IA-32 Architecture Software Developer's Manuals to brush up on assembly before I tackle more complex topics like PE/COFF format, etc. I haven't really studied the subject since the DOS days, when things were decidely simpler, heh.

Anyway, I came across this opcode and thought it was kind of amusing, so I played around with it a little. Intel's specifications indicate that it's functionally equivalent to NOP except that it raises an invalid opcode exception (#UD). Ok, sounds fun. So I wrote a little .asm file to test it out. It turns out that MASM doesn't know how to assemble a UD2 opcode, so I just assembled two NOPS instead:
.386
.model flat, stdcall

include \masm32\include\windows.inc
include \masm32\include\kernel32.inc

includelib \masm32\lib\kernel32.lib

.code
start:
NOP
NOP
invoke ExitProcess, NULL
end start
Then I pulled out a hex editor and changed the 90 90 to 0F 0B (UD2).

Executing the binary does nothing, which isn't all that surprising, but I thought that maybe Windows would at least bark about an invalid opcode exception. I tried loading it with OllyDbg and it generated the exception as soon as you start exceution. Passing the exception to the program caused it to transfer control to ntdll.dll. I don't have an import library built yet, so it's a little hard to tell what happens after that. According to Olly, the application couldn't handle the exception, and it terminates. Hmm, ok. It sounds like Windows itself just doesn't handle that exception. Am I interpreting this right?

Secondly, if you load the executable with IDA, it doesn't seem to know what to do with that opcode. W32DASM at least shows it as "invalid opcode", but IDA just makes a mess of it:
.text:00401000 _text segment para public 'CODE' use32
.text:00401000 assume cs:_text
.text:00401000 ;org 401000h
.text:00401000 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
.text:00401000 public start
.text:00401000 start dd 6A0B0Fh, 1E8h, 25FFCC00h, 402000h, 7Ch dup(0)
.text:00401000 _text ends

With a little undefining and manual defining, I can at least get:
.text:00401000 ; Segment type: Pure code
.text:00401000 _text segment para public 'CODE' use32
.text:00401000 assume cs:_text
.text:00401000 ;org 401000h
.text:00401000 assume es:nothing, ss:nothing, ds:nothing, fs:nothing, gs:nothing
.text:00401000 public start
.text:00401000 start db 0Fh ;
.text:00401001 db 0Bh ;
.text:00401002 ; ---------------------------------------------------------------------------
.text:00401002 push 0
.text:00401004 call ExitProcess
.text:00401009 int 3 ; Trap to Debugger
.text:0040100A ; [00000006 BYTES: COLLAPSED FUNCTION ExitProcess. PRESS KEYPAD "+" TO EXPAND]
.text:00401010 align 200h
.text:00401010 _text ends

Is there some way to define that opcode for IDA? It's not really a big deal; I just found it odd that the most highly esteemed decompiler had no idea how to handle it.
evaluator
04-19-2004, 10:25 PM
search IDA support forum. maybe also RTM?
disavowed
04-19-2004, 11:00 PM
evaluator, you should rtm if you think ida has an m to r :)
TBone
04-20-2004, 12:04 PM
Erm, thanks...

I have been r-ing through the m, thank you. You can define custom operands, but as far as I can tell, not custom opcodes/instructions. The only thing that sounded halfway pertinant was this snippet:
Display bad instruction <BAD> marks

Some assemblers do not understand some instructions even if they
should to. For example, the Z80 processor has several undocumented
instructions and many assemblers fail to recognize them. IDA knows
about this fact and tries to produce an output that can be compiled
without errors, so it replaces such instructions with data bytes.

The problem is more severe with Intel 80x86 processors: the same
instruction can be coded differently. There are 2 operation codes
for ADD instruction, etc. The worst thing is that the different
operation codes have different lengths. If the assembler used to
compile a file and your assembler produce different operation codes,
you may obtain completely different output files.

That is why IDA can mark such instructions as <BAD> and replace them
with data bytes. Example:

Enabled:
db 0Fh,86h,7Eh,0,0,0 ; <BAD> jbe loc_0_205
db 0Fh,82h,78h,0,0,0 ; <BAD> jb loc_0_205
db 0Fh,83h,72h,0,0,0 ; <BAD> jnb loc_0_205
Disabled:
jbe loc_0_205
jb loc_0_205
jnb loc_0_205

IDA.CFG parameter: SHOW_BAD_INSTRUCTIONS
But as you can see from what I posted, the db XXh, XXh, XXh output that I'm getting doesn't result from <BAD> marking. If that were the case, we might see something like:
db 0Fh, 08h; <BAD> ud2
But as it is, IDA just doesn't seem to know what to do with it. At any rate I've tried it with SHOW_BAD_INSTRUCTIONS set to YES and to NO, and it predictably makes no difference.

I checked with the IDA forums -- there's no mention of UD2 specifically, and I can't find anything about handling unknown opcodes there, either. Like I said, it's no big deal. A) I was just curious. B) I thought it was interesting that it not only didn't interpret the 0F 0B opcode, but it also screwed up interpretation of adjacent code. That seems like kind of strange (and potentially exploitable) behavior. Seeding a few of these in key sections of code would make it a real PITA to disassemble it with IDA. It wouldn't really be a serious deterent; it's just one more thing in the bag o' tricks you could use to scramble and confuse reversing tools.
gabri3l
04-20-2004, 08:07 PM
In the new intel manual it defines UD2 as two different opcodes. 0F0B and 0FB9, maybe IDA recognizes the other one?


Vectors
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Vectors
PDA

View Full Version : Vectors

_ColdMind
04-21-2004, 01:24 AM
Hi all !
When I say vectors I think at strings, arrays and forces, ETC.
What want +ORC to say in his '97 tutorial with "save all vectors" and "vector compare". What are the vectors for a debugger ?? Is it about that IVT ? Or maybe I am confused.
Fake51
04-21-2004, 06:43 AM
Hi all !
When I say vectors I think at strings, arrays and forces, ETC.
What want +ORC to say in his '97 tutorial with "save all vectors" and "vector compare". What are the vectors for a debugger ?? Is it about that IVT ? Or maybe I am confused.

ORC's on about DOS and real-mode. He's talking about S-Ice 2.80 (well, basically, the dos-version of s-ice, which are versions prior to 3.x, if memory serves me). And he's talking about the interrupt vectors, which are the addresses for interrupt handlers. The point is two-fold: a description of s-ice, and an introduction to some protection techniques. The last being hooking interrupt vectors for yourself, so your code has more control of the system.
Hope that helps some. Keep asking if it still eludes you.

Fake
naides
04-21-2004, 09:59 AM
The concept of vector here is mathematically accurate. the Interrupt Vector table is a rectangular array of bytes. Each Row is a linear array of bytes (Vector) that point to a memory address, the first instruction of the interrupt handler code.
TBone
04-21-2004, 12:56 PM
If I'm not mistaken, a "vector" is just what some programmers call a pointer. So a vector is just a byte/word/dword/etc. that contains the address of some data structure such as an object on the heap or the beginning of a stack frame.
Fake51
04-22-2004, 08:18 AM
The concept of vector here is mathematically accurate. the Interrupt Vector table is a rectangular array of bytes. Each Row is a linear array of bytes (Vector) that point to a memory address, the first instruction of the interrupt handler code.

Far as I remember, a vector is defined by a direction and a speed. As such, interrupt vectors fail to be vectors - they may have a direction, but they don't have a speed. Even the direction part of it is a bit off - normally, the direction is fixed (say, in terms of degrees), but in the case of interrupt vectors, the direction is dependent on where the interrupt is raised (when drawing vectors in 3D you represent the direction as to points in space - that gives you both the direction and the speed). The fact that the pointers make up an array does not make it more or less mathematically accurate.

As to the notion that "vectors" in this context is just what programmers denote a pointer, I suspect that is more or less true. However, I have only really heard "vectors" used when talking of interrupt vectors, and not of pointers in general. I could easily be mistaken, though.

Fake
TBone
04-22-2004, 09:37 AM
Well, if the vector consisted of a segment and offset, then I guess maybe you could say that those corrolate to direction and magnitude, but that's probably stretching it a little :)

I only say that the term "vector" is used as a synonym for "pointer" because I had a professor once who used it that way. He may well have been wrong. He was also one of the old computer hands from the 60s and 70s who was a) way smarter than literally almost everyone around him no matter where he went and b) knew the hardware level and the compilation process better than probably anyone I've met. Perhaps the term "vector" is just a "vintage" term and don't run into it much because of that. I can kind of see how it might originate from the drum memory days - i.e. the drum has to be rotated towards a particular direction before an address is read. *shrug*
naides
04-22-2004, 10:27 AM
Far as I remember, a vector is defined by a direction and a speed. As such, interrupt vectors fail to be vectors - they may have a direction, but they don't have a speed. Even the direction part of it is a bit off - normally, the direction is fixed (say, in terms of degrees), but in the case of interrupt vectors, the direction is dependent on where the interrupt is raised (when drawing vectors in 3D you represent the direction as to points in space - that gives you both the direction and the speed). The fact that the pointers make up an array does not make it more or less mathematically accurate.

As to the notion that "vectors" in this context is just what programmers denote a pointer, I suspect that is more or less true. However, I have only really heard "vectors" used when talking of interrupt vectors, and not of pointers in general. I could easily be mistaken, though.

Fake

http://www.math.montana.edu/frankw//ccp/multiworld/virtual/Vectors1/learn.htm
http://education.yahoo.com/reference/dictionary/entries/13/v0041300.html

I think vector here is defined as a one dimentional array of bytes

ie, int1 V == 00 08:80 09 A4 87

just as a vector in R3 is ( 1,4,5)
_ColdMind
04-23-2004, 05:11 AM
Originally Posted by Fake51
Keep asking if it still eludes you.

I understand and maybe all these things about Intrerrupt Vector Table (IVT) was known by me but I swear I don't know how to save that vectors.
Fake51
04-23-2004, 06:57 AM
I understand and maybe all these things about Intrerrupt Vector Table (IVT) was known by me but I swear I don't know how to save that vectors.

It was a function in s-ice 2.80 - when saving the interrupts made sense (in dos real-mode). The point of saving the vectors was to be able to compare them to the vector table later - to see if any of the interrupts had been hooked.
I hope you're not trying to re-enact the first ORC tuts - the general knowledge in them applies, but the specifics are ... fairly outdated. While it may serve some personal interest to go through it, it would probably be more fruitful to find newer tuts+targets - note: didn't say the ORC pack isn't worth reading - but single-stepping thru them? Time can be applied in better ways.

@Naides:
I learnt my vector-math from 3d-calculations, and thought that was where vectors had their primary use (and, therefore, their primary definition). Nice to learn something new - cheers.

Fake
_ColdMind
04-25-2004, 04:08 AM
If I'm not mistaken, a "vector" is just what some programmers call a pointer. So a vector is just a byte/word/dword/etc. that contains the address of some data structure such as an object on the heap or the beginning of a stack frame.
I thought TBone want to say that a pointer is a bidimensional vector (linear array with two elements ??). Is this true ? Who tell Fake51 a vector is defined by a direction and a speed ... the speed is a vector dx/dt but not any vector need to have a speed.

Thanks a lot.
I found something that solve my problem: http://www.woodmann.net/forum/showthread.php?t=2936
Fake51
04-26-2004, 08:26 AM
I thought TBone want to say that a pointer is a bidimensional vector (linear array with two elements ??). Is this true ?

Well, under dos there is two parts to the interrupt pointers: segment and offset. The two parts make up a dword (both segment and offset are word-sized). If this doesn't make sense to you, read up on real-mode and protected-mode.
However, pointers in general cannot be seen as bidimensional vectors - a pointer is merely an indicator, a direction, if you will. Exactly what the pointer is made of is another question.

Who tell Fake51 a vector is defined by a direction and a speed ... the speed is a vector dx/dt but not any vector need to have a speed.

The speed of a vector can be zero, but the the definition of vectors (when used in physics and 3D-graphics) is speed and direction. Whether the actual speed of a vector is zero does not matter - since the vector is still defined in terms of a direction and movement in that direction.

Thanks a lot.
I found something that solve my problem: http://www.woodmann.net/forum/showthread.php?t=2936
Nice to see the search button works.

Fake

Edit: far as I can tell, the info in the other thread is about interrupt structure under protected mode - which is ofcourse nice to know about, but a slightly different topic than what I think you were reading about.


VMWare & Softice - Experiences, problems and solutions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > VMWare & Softice - Experiences, problems and solutions
PDA

View Full Version : VMWare & Softice - Experiences, problems and solutions

dELTA
04-21-2004, 11:02 AM
I recently installed Softice (DriverStudio 3.1) inside a VMWare (4.0.0.4460) machine. While doing this, I experienced some problems, and I thought it would be a good idea to document these problems and solutions here, since I found that they had not earlier been discussed either on this board or the exetools board.

First of all, when installing Softice to a standard configured VMWare machine, it will hang the system as soon as you try to start Softice from the start menu. This problem is described in the following article in the VMWare support knowledge base:

http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=965&p_created=1049834747&p_sid=l6hHm4Mg

and also in the following article in the Compuware support knowledge base (which in turn refers to the VMWare article):

http://frontline.compuware.com/nashua/kb/doc/1702.asp

For documentation reasons, I also quote it here:

Q: When I using the SoftICE debugger in a VMWare virtual machine, the guest operating system hangs. How can I work around this problem?

A: If you plan to use SoftICE in a virtual machine, open the configuration file for the virtual machine in a text editor and add the following two lines:

vmmouse.present = FALSE
svga.maxFullscreenRefreshTick = 5

Otherwise, your mouse and screen may become unresponsive when breaking into the SoftICE debugger, making it appear as if your guest operating system has hung. svga.maxFullscreenRefreshTick can be set to any value greater than 0. Lowering the value of svga.maxFullscreenRefreshTick increases the responsiveness of SoftICE, but it also has a negative impact on the performance of the guest operating system when SoftICE is not running. We recommend removing or commenting out these configuration options when you are not using SoftICE.

Sometimes, even with these configuration options, pressing Ctrl-D does not display the SoftICE window and your mouse and screen appear unresponsive. Exit SoftICE by pressing Ctrl-D again, then use SoftICE in VGA mode as explained below.

Open a command prompt (for instance, choose Start > Run, type cmd and click OK).

Press Alt-Enter to enter VGA mode.
Press Ctrl-D to enter SoftICE.

The first time I tried this solution I had two problems:

First, I added those two lines to the end of the VMWare virtual machine config file (.vmx), but VMWare just kept deleting them! This happened also when VMWare was completely deactivated (and also did not have any active snapshots or suspension states) while I performed the edit of the file. As soon as I started the virtual machine (i.e. not directly when starting the VMWare program) those lines were deleted from the the config file and consequently ignored in the virtual machine.

For some reason, I found the following method to work to get those lines to stay:

1.
Install Softice in the virtual machine.
2.
Reboot the virtual machine.
3.
Pause the virtual machine after logging into it and being at the desktop of it.
4.
Perform a "save snapshot" in VMWare for the virtual machine.
5.
Add the two patch lines to the end of the virtual machine config file (.vmx):
----------------
vmmouse.present = FALSE
svga.maxFullscreenRefreshTick = 5
----------------
6.
Start the virtual machine again (with the resume/play button).
7.
The mouse should now act weird inside the virtual machine (you cannot click anything with it, although it moves, and it will not escape the virtual machine screen without pressing the ctrl+alt hotkey).
8.
Press the ctrl+alt hotkey to get the mouse out of the VMWare window, and click the "Reset" button for the virtual machine, it will now reboot.
9.
The lines should now still remain in the config file, and be used in the booted virtual machine.
10.
Start Softice from the start menu of the virtual machine. It should not hang the system anymore (nothing will display on the screen except a DOS-windows appearing and disappearing though).

Ok, now comes the second strange part. As described in the quoted VMWare support article text above, "Sometimes, even with these configuration options, pressing Ctrl-D does not display the SoftICE window and your mouse and screen appear unresponsive". At this point it is only the Softice window that is invisible for some reason (i.e. you can press ctrl-d again to get back to the system, or you can type "X" and then press enter too to get back, the Softice window is there and you can interact with it, but for some reason it's just invisible).

I have no idea why this happens to some people, and even more strange, it first happened to me too. I then tried the solution described above with the DOS window, and it worked, but it is not very desirable I guess, since when a breakpoint hits when you are not in DOS VGA mode you will be in trouble with the invisible window I would think (I have not confirmed this though).

Even funnier was that after almost giving up trying to get it working without the DOS window (I tried both the default universal video driver mode, and other video modes too, without any luck), I accidently reverted my virtual machine to a snapshot I made just before installing Softice (i.e. DriverStudio 3.1) into the virtual machine (this feature in VMWare kinda sucks btw, the revert button is just beside the tabs from which you choose your virtual machines, and there is not warning when you accidently press that button, it just reverts your virtual machine right away to the last snapshot, possibly causing you to lose tons of work, so be very careful with your aiming when clicking on those tabs!). Anyway, I then re-installed Softice and now all of a sudden it worked perfectly, the Softice window shows up nicely on the screen as soon as I press ctrl-d, and can be used successfully (using all default settings in Softice, both regarding video mode and otherwise, nothing was altered from the defaults). This means that this problem does not have anything directly to do with the virtual machine operating system itself, and neither with the VMWare version or something like that (since it was the exact same virtual machine used, just reverted to the point just before Softice was installed), but rather something else, seemingly random. I guess the VMWare/Compuware guys don't really now either, since they don't give any more info about it in their help either, except for that quite unsatisfactory workaround with the DOS VGA mode. Btw, I'm running my virtual machine in 800*600 resolution, and have VMWare Tools installed and running.

I hope this will be a help to at least someone, and it would be great if people could collect their own experiences, problems and solutions with VMWare + Softice in this thread too, to make it a really good resource for archival reasons.

dELTA
JMI
04-21-2004, 01:56 PM
Here is an tut posted by WhoCares on the Exetools Forum. He advised:

"This is not a cracking tutorial, but a short guide to set up VMWare to support remote debugging via serial port and named pipe. Credits go to my friends from CCF."

I'd post a link to the thread, but the rest of it was just "thank you" statements. I haven't tried it out, but it does have pictures. ;)

Regards,
dELTA
04-21-2004, 07:17 PM
Thanks, strange that this one didn't show up in my search over at exetools, and even stranger that it didn't show up on the search I just tested based on your quote (search string: "VMWare remote debugging")? I've always found the search functionality over at exe tools a little unstable for some reason, any idea why this is?

Even a search for only "VMWare" returns only fours threads, out of which the one you're referencing is not one. :(
JMI
04-22-2004, 12:57 AM
Hey dELTA:

In case you didn't find it, its in the Windows Crack Tutorials Forum, at:

http://www.exetools.com/forum/showthread.php?t=3499

It doesn't show up for my search there either. :o But knowing vBull, a search is only as good as the last time the search index was updated. This thread was from February 24, 2004 and maybe Aaron hasn't updated the indexs since then. As I know from personal experience on this Forum, it does take a good long while on the version 3 series software to update them all. I can't think of anything else that might cause it. They are actually running the "final" 3.0.0 version. I have also noticed that vBull has released a 3.0.1 "bug fix" edition, which I'll download soon for installation here.

Regards,
jsynesio
04-22-2004, 01:58 AM
I had the same problem, but when I added these two lines, I included quotes and this solved the problem for me.

----------------
vmmouse.present = "FALSE"
svga.maxFullscreenRefreshTick = "5"
----------------
dELTA
04-22-2004, 07:56 AM
I noted that those lines in the VMWare/Compuware information lacked quotes too, but it did no difference for me when adding them. I'm currently running it fully working without the quotes, just like in the VMWare/Compuware examples.
least
04-23-2004, 04:35 AM
Hi,
I also had a hard times playing with sice and vmware. I've found out that
when you DON'T install vmware tools and configure sice using universal
video driver (not windowed - fullscreen) it runs quite fine (W98,W2K).
The only drawback is that you can use just 640x480, 16 colors.
BTW DS 3.1 should cooperate better with vmware:)
Regards,
least
naides
03-14-2005, 03:11 PM
Sorry to bother everyone by re-surrecting this thread, but the remote.zip that JMI kindly posted here is corrupted now. Could anyone upload a working copy?
Timbo
03-14-2005, 03:37 PM
VOILA
naides
03-14-2005, 04:44 PM
Got it. Thankyou much!
dmx
03-20-2005, 08:06 AM
2least for use windowed mode try this truck (at VMWare), try edit in config file *.vmx :
vmmouse.present = "FALSE"
svga.maxFullscreenRefreshTick = "5"

here you can found some add-on's for VMWare like Virtual Floppy Driver or something else hxxp://chitchat.at.infoseek.co.jp/vmware/
eminemence
04-20-2005, 01:27 AM
Cool tip man.
Was having a tough time testing my drivers on the actual PC.
Now I can test my drivers in VMWare. :yay:
Bye.
--eminemence.


Crypting or Packer plz ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Crypting or Packer plz ?
PDA

View Full Version : Crypting or Packer plz ?

BoOmSlAnGz
04-21-2004, 12:48 PM
hello all, i dont no verry speak english , excuse me :( (i am french :p )
i find a packer or a crypter for :
Example :
i have a exe file detect with my antivirus
i can [exe detect] --> [exe undetect] (for my personal utility cavity :D )

excuse me for my english :(
thanks

in french :

bonjour a tous,
je cherche un tools (packer ou crypteur )qui me permetrais de rendre indetecté un fichier exe detecté par mon antivirus ( pour mon utilisation personelle evidement :D )

voila :)
merci
@+
JMI
04-21-2004, 01:49 PM
It's been a long time since I've used my studies of French, but if I understand your question, why should we help you find something to hide an exe from anti-virus software? Do you want to distribute "hidden" virii?

Regards,
BoOmSlAnGz
04-21-2004, 02:07 PM
simple,
i can : my exe file detected is not detect with your assistance

:)
Hopcode
04-28-2004, 04:03 PM
simple,
i can : my exe file detected is not detect with your assistance

:)

Im sorry, but your english is even weaker than evaluator's!

Who said it couldn't be worse ;)
Tolstoinisten
04-28-2004, 04:08 PM
Im sorry, but your english is even weaker than evaluator's!

:D

I think what he is saying is:

He said, "I can", most likely in response to JMI's question;

Do you want to distribute "hidden" virii?

Then he concluded: "my exe file detected is not detect with your assistance"

Meaning, he didn't get the help he needed from JMI. He required assistance..

Who the hell knows anyway... :p

EDIT: JMI wrote:

I believe his message means he "can" make his exe undectable by anti-virus programs with our assistance.

That makes more sense :)
JMI
04-28-2004, 04:24 PM
I believe his message means he "can" make his exe undectable by anti-virus programs with our assistance.

Regards,
Kayaker
04-28-2004, 06:40 PM
I believe his message means he "can" make his exe undectable by anti-virus programs with our assistance.

Oh Goody. I want to get infected first, please please, me first!
Woodmann
04-28-2004, 07:06 PM
Howdy,
I dont think he can make his exe undetectable,
I think he is asking, how do I make my exe undetectable by anti-virus ???

Simple, Send it to people who dont run anti-virus? :eek:

Actually, this might be a good time for Eval to step in and do some "translation" for us :)

Woodmann
JMI
04-28-2004, 11:37 PM
Shudder at the thought. Eval a translator of broken English. :o :D

And Kayaker, there are areas in most major cities where you can get almost "any" kind of "infection" you might care to risk, and several from which there is no "cure." :rolleyes: Much safer out there on the water in your Kayak, alone. ;)

Regards,
Kayaker
04-29-2004, 12:16 AM
And Kayaker, there are areas in most major cities where you can get almost "any" kind of "infection" you might care to risk, and several from which there is no "cure." :rolleyes: Much safer out there on the water in your Kayak, alone. ;)

So I should just keep practicing my strokes on my own then?... :p
JMI
04-29-2004, 12:27 AM
No, damnit. THEN you won't be able to SEE the river. :rolleyes:

(You know, as in: "if you do that you'll go blind!") :o :D

Regards,
FoolFox
04-29-2004, 03:24 AM
Yes, he want to bypass AV detection...

BoOmSlAnGz,c e que tu demande va a l'encontre des regles
de ce forum, c'est pas ici que tu trouveras une reponse a ce
probleme.

Ici, personne ne va faire le boulot a ta place, eventuellement
si tu as un probleme technique precis tu peux poser ta question
mais la regle c'est d'abord d'expliquer ce que toi tu as fait et
poser une question precise. A condition que la question ne
concerne pas une activite malicieuse telle que la creation de virus
non detectes par un AV

De plus, packer/crypter un virus n'empecheras pas sa detection
car le virus seras depacke/decrypter en memoire avant son
execution et c'est la que l'AV va le choper.

FoolFox
JMI
04-29-2004, 10:56 AM
Merci. :D

Regards,


No matter what there is always another way
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > No matter what there is always another way
PDA

View Full Version : No matter what there is always another way

gabri3l
04-21-2004, 04:21 PM
I have been working on a program that is used to view an infobase. The infobase is protected by a corresponding license file. The license allows/restricts you from viewing past a certain date, seeing certain sections of the text, printing, copying, exporting (to a pdf for example). I first started by trying to enable all the grayed out menu items. Then i figured that would be too much work there had to be an easier way. Well there is: included with the program is another one that lets you update/upgrade your license file. You update by calling the company, giving them your generated challange number and then putting in the one they give back to you. You can now view the file for another 3 days. Well, i wanted to do more than just see it for another few days. So it seems that if you log in as a administrator with the right password then you can edit the license. You choose admin from the drop down box of allowed logins and then type the pass. All in all, it turns out that with all the protection, put into this program there still existed one little flaw. Using a resorce editor I changed the drop down box to a text box. Type in a name that doesnt exist and no password. As the program does a check my name which doesn't exist has a password that doesn't exist aka: null. my null field in the password box is the correct pass! funny enough it logged me in with complete administrator control. it now allows me to edit the license file. Just thought that this was a unique way of cracking this security feature. Has this sort of thing happened to anyone else?
disavowed
04-21-2004, 05:59 PM
nice solution. maybe it'll help inspire some of us veterans to think outside the box more


Normal Breakpoints Work!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Normal Breakpoints Work!
PDA

View Full Version : Normal Breakpoints Work!

telophase
04-21-2004, 09:44 PM
Hello Everyone!,

I am new to R.E forums. Actually I had a problem with a program (forgot

its name) since the normal breakpoints used in ntice(Sice for Win NT) to

serial fish dont work(GetWindowTextA, GetDlgItemTextA) so how do i go

about the target? Which break points should i use? Is there any other

method to serial fish ?Also i think that the target is packed can anyone

suggest me any good tool(with GUI if possible) to detect if the target is

packed?

Thankx in advance for viewing!
naides
04-21-2004, 11:34 PM
Hello Everyone!,

I am new to R.E forums. Actually I had a problem with a program (forgot

its name) since the normal breakpoints used in ntice(Sice for Win NT) to

serial fish dont work(GetWindowTextA, GetDlgItemTextA) so how do i go

about the target? Which break points should i use? Is there any other

method to serial fish ?Disassemble the File, learn to break on the button clicks, use the nag screens, read the FFAQ (Fuckingly Frequently Asked Questions
Also i think that the target is packed can anyone

suggest me any good tool(with GUI if possible) to detect if the target is

packed? PEiD

Thankx in advance for viewing!

Cheers
Aimless
04-22-2004, 12:59 AM
Come on kid. Try to find out WHY the breakpoints are not hitting. Is it a software feature or your lack of knowledge of how breakpoints are set in all things NT?

Maybe it would really do good to you once in a while to use the search button and hit it with "breakpoints" minus the quotes. You should see TONS of stuff that tell you why breakpoints do not hit in NT based systems and what you should to to get them to hit.

You'll have to "learn" the knowledge. Not absorb it by osmosis. And what would you have done if this board had not existed? Searched Google? Try doing that too!

Esther, I owe you an apology for a remark made by me to you regarding newbies long ago. I guess they do get on the nerves after some time.

Have Phun
JMI
04-22-2004, 02:20 AM
Part of the root problem is the tendency for many people to look for instant gratification, particularly when it might be achieved with little or no personal effort. Somehow the first response does not seem to be to resort to "self-help," but simply to avoid all personal effort and ask someone else to do the research for them and "instantly gratify" the desire, or self-perceived "need" for the answer RIGHT NOW.

This is essentially a failure of acceptance of personal responsibility. We are responsible for helping ourselves and seeking answers to our own questions. We have no right to expect the world to BRING everything WE want to our feet, so that we do not have to stir ourselves from our lack of effort.

Although such habits are rightly to be discouraged, the goal is to train the "proper" response of a resort to "self-help" and, only after that has failed, to seek guidance from others. We don't want, or need to kill off the lazy or poorly trained in the process. While it remains their own failing, it is also a symptom of the times in which we live and it is our duty, and often burden, to try to guide them back to the true path down which knowledge may be achieved, rather that a gratification urge fulfilled.

These are general comments, not necessarily appropriate for telophase, but if he actually did anything to try to help himself, he certainly failed to mention that fact, even though it is required by the FAQ. You did read the FAQ, did you not?

Regards,
telophase
04-22-2004, 02:27 AM
I had breakpoints set up on MessageBoxA, GetDlgItemTextA,GetWindowTextA

dis-assembelled the prog using wdasm.

Tried to dead-list it.

Tried searching the memory using softice's "s" instruction.

tried BPM on the locations but still failed.

tried using DialogBoxParam to check whether it uses its own box to show "bad guy" message.

Another other things that u can expect from a newbie. if so do let me know ;)
JMI
04-22-2004, 02:43 AM
READ MY LIPS:

1. Go to the "Search" button at the top of the Forums and enter, without the quote marks "breakpoints." Read EVERYTHING you find.

2. Second, SEARCH for "packers and identif*". Read EVERYTHING you find.

3. THIRD, Read the Damn FAQ and you would already know what you should do, BEFORE you ask a question and you would also know what information you should provide WHEN you ask a question.

After you have done these three things, THEN come back and ask a question that explains what YOU have done to try to help yourself answer your question and where you are stuck. IS THIS CLEAR NOW???

Regards,


A Vobx 4.6 packed module
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A Vobx 4.6 packed module
PDA

View Full Version : A Vobx 4.6 packed module

naides
04-22-2004, 12:08 AM
Please be kind to me. I am old in cracking but new (lazy) in unpacking, may be because I have not really needed a packed program that did not have an equivalent software around wich was easier to deal with.

Anyway, the Problem:

This program is packed with Vbox 4.6. The main exe was not a problem, but a critical .dll-like module is also packed. (it is NOT a bonafide dll, but it is a PE format module with a .mod extension) I CANNOT use the classical trick of break&entry with CC and bpint, because the antidebugging routines of Vbox modules and the IceExt int 3 !protect fight to one antother and send the computer into something worse than a BSOD. If I deactivate IceExt Int 3 protection, no low level critical exception happens but the program detects the debugger and refuses to run.

I attempted to place other interrupt instructions like int 02 and int 05 as ways to stop the process at the packed dll module EP but Sice does not break on bpint 2 or 5 for example. Placing an Int 1 instruction is suicidal.

Any suggestions to make the process break at the entry of the dll, or an alternative approach to find the OEP?
Realize that I have no apriori knowledege of the memory address the module gets loaded into, and I know it changes from run to run.
I disassembled otehr modules of the same type that are not Vboxed and found no pattern or signature, or recurent API call near their OEP, or a dllmain kind of typical code.
sope
04-22-2004, 02:27 AM
Hello naides,

I guess you must have already tried it, but still i am doing my part.

(1) Since the main .exe was not a problem i guess you found the oep & might have rebuilded it. Check & noted down few bytes just before the OEP. Load the program & then dump the .mod file if its loaded with the program. Check for the few bytes just noted down. If you find we know where the brk pt shoud be.

(2) Now if that .mod file is not loaded while the program is running or it gets loaded when we click some button on menu, then i guess you should write a small program which will just load that .mod file using "LoadLibrary" function & check it if its loaded or not. If loaded we will dump it & then check for the bytes noted down. You need to take care of relocation so i suggest you to use "reloc"tool.

(3) Also try to use Ollydbg and see if you can break on .mod file if its loaded with the .exe

Hope we find better suggestion from expert's in unpacking .dll's

Regards, Sope.


Safer-K128
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Safer-K128
PDA

View Full Version : Safer-K128

ramon
04-22-2004, 05:55 AM
Hi,

I have the following C# code <<attached>>, the class SaferKn encrypts and decrypts blocks bytes, it is Safer-K128 with 10 rounds.

if I do:
byte[] array1_crypted;
byte[] array1_decrypted;
byte[] array1 = new byte[] { (byte)'H', (byte)'e', (byte)'l', (byte)'l', (byte)'o' };

SaferKn MyCipher = new SaferKn();
array1_crypted = MyCipher.EncryptBlock(array1);
array1_decrypted = MyCipher.DecryptBlock(array1_crypted);

then I can see that "array1_decrypted == array1 == Hello" as expected,
but if I use MyCipher.KeyScheduling(...) with my own userkey1 and userkey2
before encrypt/decrypt then "array1_decrypted != array1" will be different!!!

Sorry if I'm missing something basic here, but if the users keys are the same, why "array1_decrypted != array1", the userkey1 and userkey2 is not the same for encrypt and decrypt? If not how to retrieve decrypt user keys if I know the encrypt keys?

thank u for your attention,
Ramon
mike
04-23-2004, 12:41 AM
OK, the two user keys are there so you can have a 64-bit key or a 128-bit key. You're using 128-bit, so all 16 bytes should be generated randomly.

The way it's supposed to work, you call KeySchedule once and then can encrypt & decrypt blocks to your heart's content. If that doesn't work, there may be an error in the code.

http://citeseer.ist.psu.edu/massey95safer.html
has test vectors and the state in each round, so you can check your implementation.
ramon
04-23-2004, 03:31 AM
Yeah, thanks mike, I solved the problem, this code was ripped of from an app, I just used original code C code of safer and I got it to work.

cyas


Armadillo Unpacking Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Unpacking Problem
PDA

View Full Version : Armadillo Unpacking Problem

.:hack3r2k:.
04-22-2004, 08:18 AM
Hi !

I have a protected app with armadillo demo version that is hardware protected. I load it in ollydbg First i make it run by patching ram with a good hw fingerprint for which i have name key, after that i skip debugger detection and try to apply what i gathered by reading all the tuts i found. Problem is that nothin' apply. just two calls tho WriteProcessmemory before that 'This program has been protected by an unregistered evaluation version of the Armadillo Software Protection System. It is NOT LICENSED for distribution.

This warning message will not appear on programs protected by a paid-for version of Armadillo.' messagebox appears and after that a box that gives me some memory reading error. Also putting breakpoints on memory access doesn't work. Any ideea what i do wrong ?

Br;)
%UNDEFINED%
04-24-2004, 06:40 AM
I have had similar problems before with such errors, programs that crash etc...

The first thing I would recommend is adjusting you OllyDbg configuration.
Do not check/Select:
-SFX
-Extend Code section to include extractor

-Analysis 1
-Keep Analysis between sessions

Check/Select:
-Debug
-Use Hardware breakpoints to step or trace code

-SFX
-Pass exceptions to extractor

I think that is what I found my problem was.

Second is use the CleanupEx plugin for OllyDbg, use it if you start getting errors after debugging the same program again and again.
.:hack3r2k:.
04-25-2004, 07:26 AM
Thx for reply.

I will try that and let you know if i still encounter any errors.

Br;)
.:hack3r2k:.
05-02-2004, 01:44 PM
Thx for reply.

I will try that and let you know if i still encounter any errors.

Br;)

Problem stii remains.. Also child process has implemented IsDebuggerPresent trick. Any ideeas ?

Br;)
DariuZ
05-08-2004, 06:50 AM
Just do the same you did to avoid the debugger detection in the father.. :)
Ricardo Narvaja
05-08-2004, 09:11 AM
The detection in the child may be different (possible name of ollydbg process)
by putting in the olly folder other OLLYDBG but with other name, and using this renamed exe the detection of new armas are fooled.
Maybe the child are detecting a BPX, go to the breakpoints window and erase all bpx (if you in the father put a bpx in the son appear too)

The detection by IsDebuggerPresent in the child is not possible, the child normally is debugged by the father and the byte is 1 for this reason, when run normally is being debugged, if you put to zero, the child can detect is not debugged and close.

Ricardo Narvaja

Just do the same you did to avoid the debugger detection in the father.. :)
DariuZ
05-08-2004, 05:24 PM
The master has spoken :cool:
EJ12N
05-08-2004, 09:04 PM
The master has spoken

LOL.... agree :p
.:hack3r2k:.
05-09-2004, 03:27 AM
Thx for reply !

I allready bypass those tricks but problem is that i allway get read or write errors after that nag box saying that this app was prot. with a demo version of arma. On my approach to dump that app i used the tutorial attached that uses an easy and different way of manually unpacking arma (method works on winnt/2k/xp ONLY). If someone has any hints let me know as i don't know what else should i try.

Br;)
Ricardo Narvaja
05-09-2004, 09:10 AM
This variant of the method is in the tuts in my FTP

150-ARMADILLO con COPYMEM2 sin truco de los 1000 bytes por FLIPI.rar

the author of your tut make a bad copy of this tut, in the original tut say, is ONLY FOR ARMADILLOS WITH COPYMEM2 WITHOUT 1000 bytes trick, for the normal copymem2 this method don't work at all.

Put and HE WriteProcessMemory and next the copy of two bytes continue running and if the program stop again in this api and copy 1000 bytes bye bye is the classic armadillo with copymem2 and the method of your tute don't work, read the classic tuts of armadillo with copymem2 and nanomites.

Ricardo

Thx for reply !

I allready bypass those tricks but problem is that i allway get read or write errors after that nag box saying that this app was prot. with a demo version of arma. On my approach to dump that app i used the tutorial attached that uses an easy and different way of manually unpacking arma (method works on winnt/2k/xp ONLY). If someone has any hints let me know as i don't know what else should i try.

Br;)
Ricardo Narvaja
05-09-2004, 01:32 PM
I dont't speak english very well, jeje.

The tut you are reading are ok but are two versions of copymem2.

1)Copymem2 with nanomites
2)copymem2 without 1000 bytes trick

this tut work only in the 2 type, for this reason you can determine what type of arma is the program you are unpacking, if is the 2 type use this tut, our tut is in spanish, but is similar.
If are type 1 use tutes of copymem2 clasical method.

you understand me?(bad bad english of mine)

Ricardo Narvaja
.:hack3r2k:.
05-09-2004, 02:44 PM
Thx Rocardo for reply !

As my target is protected with a DEMO VERSION of arma i thinked i find myself in second case. i'll take a look at you tut an apply what i learn on my app.

br;)


Abbott and Costello in the 21st century
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Abbott and Costello in the 21st century
PDA

View Full Version : Abbott and Costello in the 21st century

Kayaker
04-22-2004, 10:19 AM
ABBOTT: Super Duper Computer Store... Can I help you?

COSTELLO: Thanks. I'm setting up an office in my den, and I'm thinking
about buying a computer.

ABBOTT: Mac?

COSTELLO: No, the name's Lou

ABBOTT: Your computer?

COSTELLO: I don't own a computer. I want to buy one.

ABBOTT: Mac?

COSTELLO: I told you, my name's Lou

ABBOTT: What about Windows?

COSTELLO: Why? Will it get stuffy in here?

ABBOTT: Do you want a computer with windows?

COSTELLO: I don't know. What will I see when I look in the windows?

ABBOTT: Wallpaper.

COSTELLO: Never mind the windows. I need a computer and software.

ABBOTT: Software for windows?

COSTELLO: No. On the computer! I need something I can use to write
proposals, track expenses and run my business. What have you got?

ABBOTT: Office.

COSTELLO: Yeah, for my office. Can you recommend anything?

ABBOTT: I just did.

COSTELLO: You just did what?

ABBOTT: Recommend something.

COSTELLO: You recommended something?

ABBOTT: Yes.

COSTELLO: For my office?

ABBOTT: Yes

COSTELLO: OK, what did you recommend for my office?

ABBOTT: Office.

COSTELLO: Yes, for my office!

ABBOTT: I recommend office with windows.

COSTELLO: I already have an office and it has windows! OK, let's just say,
I'm sitting at my computer and I want to type a proposal. What do I need?

ABBOTT: word.

COSTELLO: what word?

ABBOTT: word in office.

COSTELLO: the only word in office is office.

ABBOTT: the word in office for windows.

COSTELLO: which word in office for windows?

ABBOTT: the word you get when you click the blue w

COSTELLO: I'm going to click your blue w if you don't start with some
straight answers. OK, forget that. Can I watch movies on the Internet?

ABBOTT: yes, you want real one.

COSTELLO: maybe a real one, maybe a cartoon. What I watch is none of
your business. Just tell me what I need!

ABBOTT: real one.

COSTELLO: if it's a long movie I also want to see reel 2,3&4. Can I watch
them?

ABBOTT: of course.

COSTELLO: great, with what?

ABBOTT: real one.

COSTELLO: OK, I'm at my computer and I want to watch a movie. What
do I do?

ABBOTT: you click the blue 1

COSTELLO: I click the blue one what?

ABBOTT: the blue 1.

COSTELLO: is that different from the blue w?

ABBOTT: the blue 1 is Realone and the blue w is word.

COSTELLO: what word?

ABBOTT: the word in office for windows.

COSTELLO: but there's three words in office for windows!

ABBOTT: no, just one. but it's the most popular word in the world

COSTELLO: it is?

ABBOTT: yes, but to be fair, there aren't many other words left. It
pretty much wiped out all the other words out there.

COSTELLO: and that word is real one?

ABBOTT: real one has nothing to do with word. Real one isn't
even part of office.

COSTELLO: stop! Don't start that again. What about financial bookkeeping
you have anything I can track my money with?

ABBOTT: money.

COSTELLO: that's right. What do you have?

ABBOTT: money.

COSTELLO: I need money to track my money?

ABBOTT: it comes bundled with your computer.

COSTELLO: what's bundled to my computer?

ABBOTT: money

COSTELLO: money comes with my computer?

ABBOTT: yes. No extra charge.

COSTELLO: I get a bundle of money with my computer? How much?

ABBOTT: one copy

COSTELLO: isn't it illegal to copy money?

ABBOTT: Microsoft gave us a license to copy money.

COSTELLO: they can give you a license to copy money?

ABBOTT: why not, they own it.
dELTA
04-22-2004, 02:07 PM
Haha, that's good. :p
JMI
04-22-2004, 02:22 PM
Yah, but who's on first?

Regards,
dELTA
04-22-2004, 02:30 PM
Bill Gates... the third. :D
disavowed
04-22-2004, 06:29 PM
delta, you mean "third base" :)

kayaker: very good post. actually, the original "who's on first" was one of the first mp3's i ever had on my computer
JMI
04-22-2004, 07:10 PM
I actually watched them do it on live TV. :D Variety shows with comics were standard fair in the early days of commercial TV. Only in Black & White also. You had more fun watching live commercials, where things could, and often did go wrong.

Regards,
dELTA
04-22-2004, 07:16 PM
Disavowed, I have a similar memory of this bit, Rain Man was one of the first pirated movies I had on my disk, errr, I mean... :D
kugi
04-24-2004, 04:34 AM
Good work Kayaker. You must have had some time on your hands. Thanks for jogging my memory about Abbott and Costello.

Regards, kugi
naides
04-24-2004, 07:31 AM
Good work Kayaker. You must have had some time on your hands. Thanks for jogging my memory about Abbott and Costello.

Regards, kugi

Kayaker, that is your reward for creative work. . . They are calling you a idle bum!!!! :D

I have an extension for that statement:

Everybody that logs into this Board and/or does RCE has waaaaaay to much time on his/her hands.

You should find a job at a Local fast food restaurant or enlist in the Army instead, then you will be doing something really useful and productive :D :D
Kayaker
04-24-2004, 01:16 PM
Good work Kayaker. You must have had some time on your hands. Thanks for jogging my memory about Abbott and Costello.
Regards, kugi

Kayaker, that is your reward for creative work. . . They are calling you a idle bum!!!! :D

Whoah, whoa, whoah. Gee I'll have to put a disclaimer next time. The only credit I can take is a quick copy/paste from an email a co-worker sent me of this joke going the rounds.

So, yes, I am an idle bum. Also shiftless, a layabout, a vagabond and a cad. Perfectly suited to my job. When hired, I admitted my genitalia had been removed as a child. I was told in that case I could arrive at work 2 hours late. "Why?", I asked. "Well, this IS a government job after all, and since we all spend the first couple of hours sitting around scratching our balls, there's no need for you to come in for that!"

:p
JMI
04-24-2004, 02:51 PM
Well, I guess they call that having a eunuch lack of qualifications for the job. :D Although my own experience with government service was that everyone spent the first two hours trying to get someone else to scratch their ball or admire how HUGE they thought their's were. :rolleyes:

Regards,


minute trial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > minute trial
PDA

View Full Version : minute trial

TrainingDay
04-22-2004, 11:20 AM
Hi all,

Can i point me to a essay on how to reverse engineer a program with on like 60 minute use limit before program expires.

Thanks in Advance
naides
04-22-2004, 11:33 AM
Hi all,

Can i point me to a essay on how to reverse engineer a program with on like 60 minute use limit before program expires.

Thanks in Advance

I think you can write the assay yourself when you are done with the program.
Disassemble it and look for time keeping API, like GetLocalTime, GetSystemTime, GetTickCount.
The program probably checks the time rather frequently, so it will quit right on time, when the 60 mins are up.
Also look at what happens when it quits: do you see a nag screen, or just stops?

Consider breakpoints in PostQuitMessage or EndProc sort of things.
Time limited Software be it 30 days or 60 min fall into the same scheme.
TrainingDay
04-22-2004, 12:24 PM
I found a dll called SHLWAPI.DLL It has StartStopWatch StopWatch in strn ref in w32dasm, so i need a essay on how to change the hex values in order to either remove min. timer or give me a billion millions, but i dont know hex.
Thank You
naides
04-22-2004, 01:49 PM
I found a dll called SHLWAPI.DLL It has StartStopWatch StopWatch in strn ref in w32dasm, so i need a essay on how to change the hex values in order to either remove min. timer or give me a billion millions, but i dont know hex.
Thank You

If you do not know hex, or assembly, and need step by step instructions to reverse your program, you may as well look for a ready made crack.
Try your luck here:

http://www.google.com/search?num=20&hl=en&q=+%22crackz+OR+appz+OR+warez+OR+serialz+OR+keygens%22&btnG=Google+Search
TrainingDay
04-22-2004, 03:07 PM
But there use to be tutorials from woodman.com, i just forgot how to get there again. Thats why i asked for a tutorial on this.

Thank You
hobferret
04-22-2004, 03:27 PM
Hi :)

This is not another Elicense program IS IT?

/hobferret
Woodmann
04-22-2004, 03:45 PM
Howdy,

You dont need to memorize hex, just get a manual.
The links for tutorials are down below.

Woodmann


Busted
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Busted
PDA

View Full Version : Busted

Harding
04-22-2004, 01:36 PM
hxxp://www.usdoj.gov/opa/pr/2004/April/04_crm_263.htm


Help: Can see Api call in Hexeditor but not Dissassembler!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help: Can see Api call in Hexeditor but not Dissassembler!
PDA

View Full Version : Help: Can see Api call in Hexeditor but not Dissassembler!

zambuka42
04-22-2004, 04:45 PM
Hello, this is my first posting here, and I hope i'm not being completely oblivious to the answer... but I've run into this a couple times in the past few weeks (of my intro to reversing)... I'll give an example:

I can open a file (app.exe) with a hex-editor and do a text search for an API call I KNOW this file makes (api call: 'sproInitialize'). Within the hex-editor I am able to find this string. Obviously though, being in this editor does me no good for my ultimate goal. However, my original reason for opening the file here was to find the api call. good. Now I know this is the file I was looking for... but wait!....

When I open this same file in W32dasm or IDA pro, nowhere is there a string ref, api ref, or simple text found referencing this call. Is there something I'm missing??? As far as I can tell, the program is not packed. Please help! thanks. -b
Woodmann
04-22-2004, 06:26 PM
;)
dELTA
04-22-2004, 07:22 PM
The text you find in the hex editor is most likely either from the import table of the exe or from a string that is used to dynamically load the function in the application. If IDA is unable to make the connection between a call to such a static import (e.g. because it is performed with an indirect call), or between the string and the code that uses it to dynamically load this function from the library, it will not necessarily be shown as a string in the IDA listing.

Use a debugger, and if it is a static import set a breakpoint on the IAT entry for the function, and if it is a string that is used to dynamically load the function set a memory read breakpoint on the string. This should let you find the code that uses the function while running the application under the debugger.
zambuka42
04-22-2004, 08:54 PM
First, let me say thank you for responding (and so quickly!), you know how frustrating it can be to sit in a dark room for hours on end.. doing what we do... and reach a road block and wait for a response. Obviously I've been trying other things, but its nice to get a response...

that said.. I am a newbie... I've got the skills, just lacking some key knowledge...

I use two main debuggers: W32dasm 8.9, and Softice(I am still extremely new to softice). My main problems is that I cannot debug this app! It is a commandline runable program, but acts as a service. When I try to run it from the debugger: It loads fine, yet the debugger is tricked into thinking the program has terminated. As for Softice, I am running it as "Boot".. but am not too understanding of how to isolate this one application while running it.

Obviously I am grateful for the help, and will do some more research into furthor options I could try, but if you have the time:

Any thoughts on the debugger problem? Also, I am unfamiliar with "indirect calls", "IAT entries", & "setting a memory read breakpoint".Thanks. -b


CAD add-on dll and Olly
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > CAD add-on dll and Olly
PDA

View Full Version : CAD add-on dll and Olly

GoatBoy
04-22-2004, 11:18 PM
Hi all, I have a Cad add on (reg. and time trial) which consists of a dll, an arx and a separate registration exe. I've fished the serial with Smartcheck, registered but the time trial is giving me grief. I've tried using Olly 1.1 with the dll loader (the dll is where the protection is) but it doesn't seem to run like an exe. I've also tried deadlisting with W32dasm and IDAPro but I think I need to trace into it. Ideas? :confused:
condzero
04-23-2004, 08:14 AM
GoatBoy,

I don't too much care for the OLLY DLL loader myself. What you can do is edit the DLL using any hexedit utility. Look in the PE Header section of the DLL. There you will find (in many cases) two bytes (They're called Characteristics. If you view them in a PE explorer utility they will look the reverse of what you see in the hexedit I show below) that you can change, which will effectively turn the DLL into an EXE so that OLLY can bring it up like a regular program. Suggest you copy the DLL to another name (if you can or don't forget to change back after testing) and:

Change "0E 21" TO "8E 81".

Good Luck!
GoatBoy
04-23-2004, 08:48 PM
Thanks for the quick reply...I just did what you suggested - it loaded without dlloader but it stopped running right away as it did in the loader. I'll have to work on it more tonight. Thanks again! :)


I need ollydbg help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > I need ollydbg help
PDA

View Full Version : I need ollydbg help

venom925
04-23-2004, 11:53 AM
every time i try to set a breakpoint on a kernell function it tells me unabble to set breakpoint i have both the 110b version and the 109d both do it. im trying to set the bp on the isdebuggerpresent function.
ZaiRoN
04-23-2004, 12:35 PM
Hi,
which is the error message Olly gives you? How did you set the breakpoint?
naides
04-23-2004, 12:41 PM
every time i try to set a breakpoint on a kernell function it tells me unabble to set breakpoint i have both the 110b version and the 109d both do it. im trying to set the bp on the isdebuggerpresent function.

Pay Close attention to the spelling and the UpperCase and lowercase name of the function. Olly is case sensitive and IsDebuggerPresent is not the same as isdebuggerpresent.
Better yet, if you got through the menu: View->Executable Modules and in the Window that shows up right click on Kernel.dll, in the menu that shows up select View Names and from the pop-up window select the export IsDebuggerPresent, right click it, and you can toggle the breakpoint through point and click, which is less error prone to users of less than 30 years of age: the mouse generation.

:D
Ricardo Narvaja
04-23-2004, 12:51 PM
In windows 98 olly not let put bp in in a api, only bpx (in references to an api) this is very disgusting change to XP if you want use ollydbg.

Ricardo

Pay Close attention to the spelling and the UpperCase and lowercase name of the function. Olly is case sensitive and IsDebuggerPresent is not the same as isdebuggerpresent.
Better yet, if you got through the menu: View->Executable Modules and in the Window that shows up right click on Kernel.dll, in the menu that shows up select View Names and from the pop-up window select the export IsDebuggerPresent, right click it, and you can toggle the breakpoint through point and click, which is less error prone to users of less than 30 years of age: the mouse generation.

:D
venom925
04-23-2004, 12:57 PM
Hi,
which is the error message Olly gives you? How did you set the breakpoint?
Hi,
it only tells me "Unable to set breakpoint"
Pay Close attention to the spelling and the UpperCase and lowercase name of the function. Olly is case sensitive and IsDebuggerPresent is not the same as isdebuggerpresent.
Better yet, if you got through the menu: View->Executable Modules and in the Window that shows up right click on Kernel.dll, in the menu that shows up select View Names and from the pop-up window select the export IsDebuggerPresent, right click it, and you can toggle the breakpoint through point and click, which is less error prone to users of less than 30 years of age: the mouse generation.
i tried this still didnt work
got any other ideas?
Ricardo Narvaja
04-23-2004, 01:13 PM
tyoe

BPX IsDebuggerPresent

no

BP IsDebuggerPresent

BP is only allowed for NT/2000 and XP users

Ricardo
PD:change to xp

Hi,
it only tells me "Unable to set breakpoint"

i tried this still didnt work
venom925
04-23-2004, 01:18 PM
tyoe

BPX IsDebuggerPresent

no

BP IsDebuggerPresent

BP is only allowed for NT/2000 and XP users

Ricardo
PD:change to xp
ok not to beat a dead horse but where do i type that?
Ricardo Narvaja
04-23-2004, 01:25 PM
is a plugin for type commands

hxxp://ollydbg.win32asmcommunity.net/stuph/g_cmdbar300108.zip

change hxxp, put http in the link and download the plugin

put the dll in the olly folder and in ollydbg menu APPEARENCE-DIRECTORIES in the plugin path change the path to OLLY folder and restart olly, down appear the bar for type.

Ricardo

ok not to beat a dead horse but where do i type that?


flexlm 8.0d using 8.0c sdk... works fine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > flexlm 8.0d using 8.0c sdk... works fine
PDA

View Full Version : flexlm 8.0d using 8.0c sdk... works fine

stevematulis
04-23-2004, 06:48 PM
0) obtain 8.0c sdk, may say 'beta', but that's fine

1) make sure your vendor keys are good
--> extraction via 7.2 method verified, works fine.
--> you need vendorcode struct+4 and struct+8 as data[0] and data[1],
sampled after stepping over the breakpoint (the two 32-bit numbers after the 0x00000004 in the structure)
--> you need jobstruct+8, +C, +10 - sampled after stepping over the breakpoint as well (the 3 32-bit numbers after 0x00000066, stepping over one first)
--> you need 4 vendor codes as well - obtain from job struct

2) plug these into the fixed version of calcseed, along with the vendor name
--> write down the two EncSeed values generated

3) plug all of this into a modified lmrecode that has the new glseed&val of 0x3CDE3EBF, 0x6F7330B8 in place of 0x788f71d2 and 0x7648b98e, or build a modified lmrecode yourself - source is around
--> plug in the numbers when asked, don't worry about the warning, just write down vendor_key5

4) modify the lm_code.h in machind with vendor codes, vendor, enc seeds - don't worry about encseed 3 and 4

5) modify the lib files in i86_n3 that are used to do the builds - replace 0x788f71d2 with 0x3CDE3EBF, 0x7648b98e with 0x6F7330B8

6) run build.bat, use makekey.exe to generate license. you'll have to run vcvars32.bat if you don't have build environment set up for dos box

7) if you want to use genlic.exe instead, you'll have to do step #5 above on it since it doesn't get built by build.bat / makefile.

SM


Driver_irql_not_less_or_equal
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Driver_irql_not_less_or_equal
PDA

View Full Version : Driver_irql_not_less_or_equal

The Keeper
04-24-2004, 10:24 AM
Hello,

Im using softice from driverstudio 3.1 with windows 2003 but whenever i start my computer after logging in i get a BSOD on NTICE that says DRIVER_IRQL_NOT_LESS_OR_EQUAL

when i disable softice all goes fine, has anyone experienced this problem before or know the solution to it?

The Keeper
JMI
04-24-2004, 02:34 PM
Did you, by any chance, follow the FAQ guidelines and try a search for this topic on the Board before you posted your question? You will get alot of threads if you search using "softice startup" [without the quotes.] Give that a try and then report back whether that helped.

For example, there is some discussion of it here:

http://66.98.132.48/forum/showthread.php?t=5736

Regards,
The Keeper
04-24-2004, 04:22 PM
Hello, i actually posted here cause i found the url you posted on google by searching my first subject, but in that url i found nothing that could help me, i also searched for softice startup but no problem similar to mine...the nearest one is http://66.98.132.48/forum/showthread.php?t=3564&highlight=driver+irql but there is no service pack for 2k3 yet...


DrCOM Monitor...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DrCOM Monitor...
PDA

View Full Version : DrCOM Monitor...

babar0ga
04-24-2004, 12:34 PM
Debug, Monitor and Reverse engineer COM based binaries.

Features:
-Object creation/destruction monitoring
-Reference count monitoring/manipulation
-Type Information acquisition
-Registry summery
-Method invocation

www.ddevel.com


java third party components debugging
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > java third party components debugging
PDA

View Full Version : java third party components debugging

ramin_rad2000
04-24-2004, 04:36 PM
Is there a way to debug an executable jar file,i have heard of a debugger by IBM called OLT which is only available in USA(IBM policy? :( )
Object Level Trace (OLT) is an extension of the IBM Distributed Debugger that enables you to trace and debug multilingual distributed applications from a single workstation.
dELTA
04-24-2004, 06:43 PM
http://sourceforge.net/projects/jbcd
ramin_rad2000
04-24-2004, 07:22 PM
http://sourceforge.net/projects/jbcd

thanks a lot delta :)


Req: Patcher that can apply different patches based on file version
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Req: Patcher that can apply different patches based on file version
PDA

View Full Version : Req: Patcher that can apply different patches based on file version

zambuka42
04-25-2004, 12:48 AM
Hey, if anyone knows... I am looking for a patcher that can apply a different patch based on the version of the file. (thus, if I know what needs to be patched on all previous versions of a file.. it will do it) Thanks. -b
klier
04-25-2004, 03:27 AM
and i need a new pair of shoes.... :)
btw:you can easily make it yourself,check filesize|version and patch on.

Regards,
zambuka42
04-25-2004, 10:46 AM
well, on that note.. is there any source code around I can use to create my own patcher? (preferrably visual basic?) thanks.
Woodmann
04-25-2004, 01:13 PM
Howdy,

Please dont post the same question with a different title.

Woodmann
zambuka42
04-25-2004, 01:27 PM
Howdy,

Please dont post the same question with a different title.

Woodmann

well, i am sorry, it was not meant to be the same question... my second post is in regards to creating my own patcher rather than getting help finding one
klier
04-26-2004, 11:21 AM
vb is not my native language but...
with this template: patch -->you should have found it yourself! :(
for the rest,try to make an effort yourself please and read your vb doc's....
just a question:have you cracked all versions yourself?

Sub Main()
On Error GoTo Error
If FileLen(App.Path & "\Prog.exe") = 0 Then GoTo Error
Open App.Path & "\Prog.exe" For Binary Access Write As #1
Put #1, octet, bite
Close #1
MsgBox "Ok", vbApplicationModal, "OK"
GoTo TheEnd
Error:
On Error Resume Next
Close #1
MsgBox "not able to patch", vbExclamation, "error"
TheEnd:

End Sub
zambuka42
04-26-2004, 04:10 PM
vb is not my native language but...
with this template: patch -->you should have found it yourself! :(
for the rest,try to make an effort yourself please and read your vb doc's....
just a question:have you cracked all versions yourself?

Sub Main()
On Error GoTo Error
If FileLen(App.Path & "\Prog.exe") = 0 Then GoTo Error
Open App.Path & "\Prog.exe" For Binary Access Write As #1
Put #1, octet, bite
Close #1
MsgBox "Ok", vbApplicationModal, "OK"
GoTo TheEnd
Error:
On Error Resume Next
Close #1
MsgBox "not able to patch", vbExclamation, "error"
TheEnd:

End Sub

answer, yes I have cracked all versions.. thanks for the code.. but I have put in SERIOUS effort to find this code! Coming to this forum was a last ditch effort... so please forgive my intrusiveness! I have no VB documentation that clearly states how to Patch a program and i haven't found any code boards to tell me, I did not know that a simple Put statement with the octet is all you need.
klier
04-27-2004, 03:32 AM
I have not put in SERIOUS effort either to find this code,but just searched this board. :D

Regards,


WKT Debugger Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > WKT Debugger Problem
PDA

View Full Version : WKT Debugger Problem

EJ12N
04-25-2004, 04:24 AM
Hi ok i was trying to use WKT but i cant find in no place the

Symbolic debug files (DBG) files for use with the debugger:

MSVBVM60.DBG v.6.0

MSVBVM50.DBG v.5.0

Symbolic debug files (NMS) for use with SoftIce Symbol Loader.

MSVBVM60.NMS

MSVBVM50.NMS

Because the links on WKT site doesnt work
:mad:
i know many people have it so can some one please share those with me :) i didnt find nothing on google either

Thank you!
OorjaHalT
04-25-2004, 07:28 AM
here they are
Besides i dont think you need .dbg files for proper running of WKTVBDE at least i dont have them and been using it for quite sometime. Maybe you have some other problem
EJ12N
04-26-2004, 11:05 PM
here they are
Besides i dont think you need .dbg files for proper running of WKTVBDE at least i dont have them and been using it for quite sometime. Maybe you have some other problem

:( it says this

Compiled with VB6
Address of table 1: 401478
Can NOT locate the VB DLL inside this computer.

Can NOT find a ENGINE section for the DLL.

i do have the DLL because i have vb6 pro installed in my computer

Any help ?
disavowed
04-27-2004, 08:00 AM
for best results, put msvbvm60.dll and your target app in the same directory as the debugger
OorjaHalT
04-27-2004, 10:16 AM
This happens when you are running another VB application while using wkt for debugging. you need to close other vb application when using WKT
EJ12N
04-29-2004, 09:55 PM
Thanks i will give it a try thanks


MASM and MSVBVM60 imports
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > MASM and MSVBVM60 imports
PDA

View Full Version : MASM and MSVBVM60 imports

Fahr
04-25-2004, 06:03 AM
Hello all,

I recently sniffed out a serial from a certain program. The idea is very straight forward; one call and the serial is in EAX. The serial is based on a hardware dependant code, rather than a name. Since nobody else is able to use my code, I decided to attempt a keygen.

I skipped through the registration proc, but it is extremely obfuse and extremely long (3098 lines, not mentioning a second sub proc which is called), so I don't really feel like trying to figure out what it does.

In the past, I once ripped a whole registration proc from a program and built another GUI around it. I figured that would be the best option in this case as well. Problem is; the program is written in VB and the regproc is full of calls to the MSVBVM60.dll. In order to make this work, I'll need to import MSVBVM60 in MASM...

Does anybody know how I can pull this off? Or maybe where I can find premade import headers? I searched the net, but couldn't find anything.

The best option would be to use inline ASM in VB, but since VB doesn't support that...

Thanks,
- Fahr
%UNDEFINED%
04-25-2004, 06:31 AM
Your best bet it to use Smartcheck and try to build a VB keygen from its output, however if you are hard headed enough and determined enough, I would try looking here for some of your information.

http://vb-decompiler.com/index.php
Fahr
04-25-2004, 06:35 AM
That's another problem I forgot to mention; this program was originally packed. After unpacking it, SmartCheck wont run it properly, says the code is still not very VB-ish, which can well be, since there's still loader crap and all.

SmartCheck is not really an options here. I'll check out that vb-decompiler though.

Thanks,
- Fahr
xixiaolou
04-25-2004, 08:20 AM
You said "the serial is in EAX", so why not use keymaker and so on, they can broken at the address where your serial be in EAX?

BTW: now we can use inline asm in vb6, just with help of some addin for vb,
you can search "tweakvb" ar google
Fahr
04-25-2004, 10:25 AM
You said "the serial is in EAX", so why not use keymaker and so on, they can broken at the address where your serial be in EAX?

I'm really not sure what you mean with this sentance... I know where in the program the serial is in EAX when you hit the 'register' button (with a wrong or right serial in the input box), so I can sniff it using OllyDBG.
Other people, however, don't know much or any reverse engineering. For those people I would like to build a keymaker, so they don't have to dig into OllyDBG etc.

TweakVB looks promising, I'll certainly look into it.

- Fahr
%UNDEFINED%
04-25-2004, 11:12 AM
I think he means why don't you use inline keygening, or in other words patch the program to message box the correct serial number when you click register with your name and fake serial....etc....Essentially I think it would be less work, but then again, I have never attempted it I have only read about it
Fahr
04-25-2004, 11:19 AM
Oh, I've certainly considered that option. It would indeed be much less work, only a matter of minutes...

Point is that it would still require me to spread a patched exe, rather than a small keymaker. I can't build it in a byte patch either, because the original exe is packed...

Replacement exe @ 2MB VS Keymaker @20KB...

If a keymaker is possible, it would most certainly be the better option. It's also neater, I think. If I could pick between downloading a patched replacement exe or a keygen, I would definately go for the keygen...

- Fahr
Fahr
04-25-2004, 11:23 AM
Another thought! Would it be possible to write a loader which would grab the serial from mem at the moment of generation?

I never wrote a loader yet, so I wouldn't know if it can be done, especially seeing how the orig exe is packed...

- Fahr
Kayaker
04-25-2004, 11:51 AM
Point is that it would still require me to spread a patched exe, rather than a small keymaker.

Excuse my diatribe, don't take it personal, you can do what you want, but,

Bah, if all you're interested in this for is spreading cracks, keep this shit out of the Advanced Forum, this thread is moved...

Kayaker
Fahr
04-25-2004, 02:25 PM
Excuse my diatribe, don't take it personal, you can do what you want, but,

Bah, if all you're interested in this for is spreading cracks, keep this shit out of the Advanced Forum, this thread is moved...

Kayaker

I only used that as a point to illustrate. What I am really trying to do here is find a solution around that VB stuff...

But move it around as you wish, I guess you know what's the best place for this :)

- Fahr
babar0ga
04-25-2004, 03:40 PM
The best option would be to use inline ASM in VB, but since VB doesn't support that...

Thanks

inline ASM in VB:
www.tweakvb.com
Fahr
04-26-2004, 01:22 AM
inline ASM in VB:
www.tweakvb.com
Yes, someone already mentioned that. I'm looking into it.

- Fahr
Fahr
04-26-2004, 04:16 AM
Hmm... Inline Assembly in VB is not really an option, either... it doesn't recognize MSVBVM6.dll imports (I should've known, of course).

Is there really no way to import MSVBVM6.dll functions in MASM? In theory, it should be possible, no?

And otherwise that loader idea... any thoughts on that?

Thanks,
- Fahr
TQN
04-26-2004, 05:34 AM
Oh, I think yes. We probaly can import and use export functions of MSVBVM60.dll in MASM32. But the document and prototype of them was not documented by Microsoft, so we must need some code reversing.
I use dumpbin /exports to create a export list file of MSVBVM60.dll, and change it to DEF file format, then use lib /machine:ix86 /def:def_file to create import library for msvbvm60.dll.
To create inc file, I use a tool call impapi, found on Win32ASM board.
The attached file contains: msvbvm60.def, msvbvm60.lib and msvbvm60.inc.
Good luck !
Fahr
04-26-2004, 05:38 AM
Thanks! That will be most helpful :)

Params etc. shouldn't really be a problem, since I have the IDA ASM output with the right calls in it... I should be able to copy it 1:1 with some minor changes here and there.

Thanks a lot for your inc and lib! :) I'll post here how it went :)

- Fahr
Fahr
04-26-2004, 11:43 AM
It seems that the .inc file is not compatible with MASM :(

MASM wants inc definitions like this:

CreateSecurityPage PROTO : DWORD
EditSecurity PROTO : DWORD,: DWORD

with param definitions, prolly needed for the MASM specific .invoke statement...

Is there any way I can convert this .inc to a MASM compatible .inc? I don't think it's possible to generate definitions of the params from the DLL...

- Fahr
Fahr
04-26-2004, 12:33 PM
There is an l2inc utility with MASM32 which can generate .inc files for lib files, but this doesn't work with the .lib file generated with lib.exe :(

I tried your .def file and I rebuilt it myself, I do get the lib, but l2inc wont process it. It gives no errors, nothing, it just doesn't produce any output either...

- Fahr
Fahr
04-27-2004, 12:53 PM
Ok, disregard all that, I still got it working by changing all 'global's into 'extrn's... apparently MASM32 doesn't know global, but it does know extrn.

The program compiles ok, but there are some weird things... I hardcoded in the hardware dependant serial for now. At some point it puts it thru __vbaStrLen. The original program returns 12h (18), the actual size. My 'program' returns some bizarre number which is extremely high.

Eventually my program dies on a __vbaStrMove... I guess it just can't be done without the Visual basic stuff around it :(

I'll continue experimenting. If anyone has any input, it would be most welcome.

- Fahr
sope
04-28-2004, 01:49 AM
Hello Fahr
If anyone has any input, it would be most welcomeBelow link might help you understand if its possible or not
hxxp://board.win32asmcommunity.net/showthread.php?threadid=7879&highlight=msvbvm60.dll

Regrads, Sope.
naides
04-28-2004, 04:18 AM
Hello all,

I recently sniffed out a serial from a certain program. The idea is very straight forward; one call and the serial is in EAX. The serial is based on a hardware dependant code, rather than a name. Since nobody else is able to use my code, I decided to attempt a keygen.

I skipped through the registration proc, but it is extremely obfuse and extremely long (3098 lines, not mentioning a second sub proc which is called), so I don't really feel like trying to figure out what it does.

In the past, I once ripped a whole registration proc from a program and built another GUI around it. I figured that would be the best option in this case as well. Problem is; the program is written in VB and the regproc is full of calls to the MSVBVM60.dll. In order to make this work, I'll need to import MSVBVM60 in MASM...

Does anybody know how I can pull this off? Or maybe where I can find premade import headers? I searched the net, but couldn't find anything.

The best option would be to use inline ASM in VB, but since VB doesn't support that...

Thanks,
- Fahr

Sorry if I come late into this thread, and perhaps you are far into your project to consider a lateral solution but:

When you rip the code off the program you are taking the fish out of the water, and now you have to reconstruct the whole environnment in which it can work and survive.
Why don't you just leave it there, and modifiy the code so the whole, mostly untouch program IS your KeyGen?
In this case you would only need to inject some code that does the display of the Key once it is generated using already imported API, and modify the last few intructions of the Key generating routine to jump or call your code.
It would require quite less construction, but perhaps Construction is what you want to do, so by any means . . .
Fahr
04-28-2004, 05:33 AM
Sorry if I come late into this thread, and perhaps you are far into your project to consider a lateral solution but:

When you rip the code off the program you are taking the fish out of the water, and now you have to reconstruct the whole environnment in which it can work and survive.
Why don't you just leave it there, and modifiy the code so the whole, mostly untouch program IS your KeyGen?
In this case you would only need to inject some code that does the display of the Key once it is generated using already imported API, and modify the last few intructions of the Key generating routine to jump or call your code.
It would require quite less construction, but perhaps Construction is what you want to do, so by any means . . .

This is actually exactly what I did for now and it works fine, instead of the error (wrong key blah) it shows the key itself.
Point is, however, that this is not the nicest solution. I already realized that 'ripping' the keygen will be nearly impossible, if it's not the VB imports, it's because the whole environment is gone (as you said) and it will be hell to figure out and recreate. I am now basically at the point where I consider 2 remaining options:

1) Rebuild the keygen algorithm from looking at the code. Problem here is that the code is somewhere near 4000 lines long and more than extremely obfuscated.
2) Build some kind of loader which applies the 'crack' I already built on the fly (modify the prog in mem instead of on the HD). Problem here is that the original program is packed, plus I never wrote a loader yet and I wouldn't know where to start...

For now using the program itself as its own keygen works, but I would like to build that loader (building the keygen for this particular program was already deemed impossible on some other board, where someone attempted the same).

- Fahr
Fahr
04-28-2004, 05:46 AM
Hello Fahr
Below link might help you understand if its possible or not
hxxp://board.win32asmcommunity.net/showthread.php?threadid=7879&highlight=msvbvm60.dll

Regrads, Sope.

I read the topic and as far as I can say; everyone more or less agrees it's either extremely difficult or just impossible.

Thanks for the info, I completely discarded the code ripping idea and will focus on other possibilities :)

- Fahr
sope
04-28-2004, 07:52 AM
plus I never wrote a loader yet and I wouldn't know where to start... We have a simple loader on this forum as well here's the url hxxp://66.98.132.48/forum/showthread.php?t=5107 will help you begin with a loader coding for your program.
Fahr
04-28-2004, 07:57 AM
We have a simple loader on this forum as well here's the url hxxp://66.98.132.48/forum/showthread.php?t=5107 will help you begin with a loader coding for your program.

Thanks! That looks like what I want :)

I'll check it out! :)

- Fahr
Fahr
04-29-2004, 01:39 PM
Hmm... the whole loader idea doesn't seem to quite work out :S

I downloaded Zairon's loader and changed it to fit my needs (which are about the same as Zairon's, except for the addresses).
When I run it, it sticks in the while loop forever. I managed to fish out that it generates an access violation. I added this case:

case EXCEPTION_ACCESS_VIOLATION:
char* cTmp = new char[50];
GetThreadContext(processInfo.hThread, &context);
sprintf(cTmp, "Access violation at %d!\n", context.Eip);
printf(cTmp);
delete[] cTmp;
break;

in the exceptioncode switch. Now when I run it it gives me:

Access violation at 4911260!

only a million times, always at the same address...

When I check in Olly, it says 4911260 doesn't exist (even after I run the unpacker).
The loader never reaches the EXCEPTION_SINGLE_STEP, only the initial one, where I set the EP, then a few DLL loads and then endless access violations.

I have NO idea what I'm doing wrong. I didn't really change anything in Zairon's code except for the exe name and the addresses...

Any help?

Thanks,
- Fahr
Fahr
04-29-2004, 01:46 PM
Hmm... I just checked it out and it turns out I have exactly the same problem using Zairon's original source on the original crackme...

Is it just my comp? Or is there something buggy in his loader source?

- Fahr


what tools are best
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > what tools are best
PDA

View Full Version : what tools are best

venom925
04-25-2004, 10:13 AM
what in everybodies opnion is the best tools to unpack software on win98se. im trying to learn and dont want to get something that will set me back instead of pushing me head. I want to unpack things like Aramadillo and asprotect or harder but i know i need to crawl before i can walk and run.
EJ12N
04-26-2004, 11:15 PM
what in everybodies opnion is the best tools to unpack software on win98se. im trying to learn and dont want to get something that will set me back instead of pushing me head. I want to unpack things like Aramadillo and asprotect or harder but i know i need to crawl before i can walk and run.

knowledge -.- unpacking manually is the best unpacker
so if you want to unpack ASProtect, Armadillo and such do it manually :p
venom925
04-27-2004, 07:13 AM
knowledge -.- unpacking manually is the best unpacker
so if you want to unpack ASProtect, Armadillo and such do it manually :p
LOL. thanks, but if youll read the orginal post i wasent asking for a hand-out i was asking what tool(s) are best to learn from IE..programs like SI,olly....
i planed on doing it manually i just want the right tools to do it
disavowed
04-27-2004, 08:01 AM
then si and olly
venom925
04-27-2004, 08:05 AM
then si and olly
will olly set breakpoints in win98se ive heard on here it cant be done, is that true


CRC,checksum??!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CRC,checksum??!
PDA

View Full Version : CRC,checksum??!

ramin_rad2000
04-25-2004, 10:52 AM
there is function which is needed to be patched and it is like:

func abxxxxx

aaaaaaaa mov eax,[xxyxxyyx]
bbbbbbbb test eax,eax
cccccccc je xxxxxxxx
... here goes the rest

.
.
.
.
xxxxxxxx xor eax,eax
yyyyyyy ret

the program first calls this function 3 times and all these 3 times eax is 0, so it jumps to xxxxxxxx[XOR do nothing ok?]then again after a while it goes to xxxxxxxx,and this time I need to change this 'xor' to 'or' in order to crack it.
when i do it in sice after 3rd time[at the beginning of fourth time]it works
but the problem is, when i chang the first word of xor instruction 33 to OB(or) in HIEW the prog crashes after 3rd call!well i don't know of crc or checksum plz help me.
regards
%UNDEFINED%
04-25-2004, 12:22 PM
I have no idea what you are trying to explain with this...
ramin_rad2000
04-25-2004, 12:38 PM
I have no idea what you are trying to explain with this...

67DC1412 mov eax,[67DCEC1D]
67DC1418 test eax,eax
67DC141A je 67DC142E
.
.
.
.
.
67DC142E xor eax,eax
67DC1430 retn 08

is that clear,suppose it as a function which i need to patch.it was called 3 times first and eax was 00000000 at 67DC1418 and it jumped to 67DC142E(je)(because eax was already zero 'xor' made no change right?)i changed xor to or at 67DC142E in fourth time with sice and it all worked out then.but when i tried to change this xor to or with hiew the prog crashed after 3rd call.
I am saying that this change didn't change program flow but there must be a crc check there,i only changed one word( 33 to 0b).how can i defeat this.
Kayaker
04-25-2004, 07:35 PM
I'm not so sure a program crashing after a 3rd call to a changed routine is a positive indication of a crc check, but.. How about setting a BPM R(ead) breakpoint on 67DC142E, if there's a check it must read those bytes to take them into account and the break may indicate the checksum routine.
ramin_rad2000
04-26-2004, 02:33 AM
I'm not so sure a program crashing after a 3rd call to a changed routine is a positive indication of a crc check, but.. How about setting a BPM R(ead) breakpoint on 67DC142E, if there's a check it must read those bytes to take them into account and the break may indicate the checksum routine.

I tried it but i didn't work :(
Do you know how to reverse crc?
ramin_rad2000
04-26-2004, 03:18 AM
Kayaker if is uses CreatfileA and then ReadfileA then do you think that bpm works?
Kayaker
04-26-2004, 12:38 PM
if is uses CreatfileA and then ReadfileA...

Well, does it? CreateFileA, ReadFile, OpenFile, MapViewOfFile, _hread, _lcreat, _lopen,... are a few options. It's up to you to decide if any likely API's are being used in a crc check and adapt your strategy to suit.


Unpacker Detection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Unpacker Detection
PDA

View Full Version : Unpacker Detection

Corpus
04-25-2004, 10:57 AM
Hi,

I have an application that I want to unpack cause if I open it with IDA I see a lot of "rubbish". Anyway, I was wondering how I can know with which packer a certain program is packed? Are there any tools to detect this? I am trying to use procdump to unpack but when I choose unknown as unpacker it gives me an error message: Process isn't 32 bit or is already finished...

thanks,

Corpus
llAmElliK
04-25-2004, 12:50 PM
In my opinion isn't Proc-dumper pick if don't know concrete compressor,find him by the help of Pe-Scan and then use unpacker,that is programme compression-after-mostly then you needn't edit PE header (isn't as a rule)
*RemedY*
04-26-2004, 11:03 AM
There are certain tools you can use to detect with which packer a program is packed with. For instance there are PEID or Language2000.. Try to google for "unpackers" and you will quickly come across a detector for packers like the two mentioned above.

Greets *RemedY*
llAmElliK
04-26-2004, 11:56 AM
Yes, subscribe and Language 2000 advise! ;)
JMI
04-26-2004, 08:36 PM
Although I've looked, I've not seen anything to suggest that Language 2000 has been updated since the year 2000. Assuming my research is correct, one of the other identifiers would probably be more up to date.

Regards,
EJ12N
04-26-2004, 11:20 PM
:) PEiD all the way
llAmElliK
04-27-2004, 12:49 AM
These tool them to a flabby much (LordPE),but for beginner get past such,which him exclude from quantity "down-the-line"information.
Btw Peid ,yes good. ;)
Corpus
04-27-2004, 04:33 AM
Thanks for the quick replies,

I am gonna check out that PeId tool u guys suggested.
dev_zero
04-30-2004, 05:11 AM
You can use file analyzer to find out which packer det exe-file is packed with. Or in some other case the compiler.. :)
llAmElliK
04-30-2004, 04:03 PM
have some CME in which are neither described pe header (are two),is it scram and in the same way me nothing no-show wherewith.What about it?What advise tool (after-touch,that you classical fail). :confused:

ThX **llAmElliK**
dELTA
05-01-2004, 07:50 AM
Wtf, seems like eval has quite the worthy opponent here... :p


Microsoft Word's dictionary
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Microsoft Word's dictionary
PDA

View Full Version : Microsoft Word's dictionary

disavowed
04-25-2004, 10:29 PM
Something funny I just noticed while typing up a study guide in Word:
Microsoft included the term "overpriced" in their dictionary, but not "underpriced". Reflection of their marketing? :)


Changing a Windows XP software to run under Windows NT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Changing a Windows XP software to run under Windows NT
PDA

View Full Version : Changing a Windows XP software to run under Windows NT

peterg70
04-26-2004, 04:38 AM
I have some camera software which is for windows XP etc but no support for Windows NT.

The software installs no problems but comes up with the error GetLongPathNameA does not exist in Kernel32.dll when executing.

Found the DLL with it. I wonder is there a way to convert this DLL so that it calls the a compatible NT API rather than.

All software I have at the moment is only for rebuilding the IAT. What about just changing the API to a compatible one? Any thoughts,

Some guidance or thoughts?
peterg70
04-26-2004, 05:28 AM
Found that LordPE can actually edit the Exports against each DLL. Just alot of digging to find it.

Still how can I switch GetLongpathname to a WIndows NT compatible version.
+SplAj
04-26-2004, 06:04 AM
hi

I suggest make a new dll with 'emulated call' API patch it in with LPE :)

The GetLongPathName API call is only available on Windows 98/ME and Windows 2000/XP. It is not available on Windows 95 & NT. This code example emulates the function for use on 95 & NT and will work on the other systems as well.
........gooooooogle :rolleyes:


vwin32 and win32 service table
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > vwin32 and win32 service table
PDA

View Full Version : vwin32 and win32 service table

ajron
04-27-2004, 03:44 AM
Does anybody know if win32_service_table in vwin32.vxd differ in different (95/9x/me) windows version? I woud like to hook some service by "ordinal" but I saw in icedump sources something like this:

FindVWIN32Win32APIs:
push ecx
mov eax,[VWIN32.W32ServiceTable]
mov ecx,[eax] ; W32 API count
sub ecx,byte 4
add eax,byte 4 ; walk the parameter count list
.next:
add eax,byte 8
cmp [eax],byte 2
loopnz .next
jnz @F
cmp [eax+8],byte 2
jnz .next
cmp [eax+8+8],byte 5
jnz .next
cmp [eax+8+8+8],byte 5
jnz .next
sub eax,[VWIN32.W32ServiceTable]
shr eax,3
mov [VWIN32.W32_SetThreadContext],eax
dec eax
mov [VWIN32.W32_GetThreadContext],eax
...

This code search services by specific parameters numbers sequence instead of simple get by ordinal. So what do you think
?
Kayaker
04-29-2004, 12:10 AM
Hi

It's hard to say if there would be any rearranging of service ordinals across versions or whether new ones would just be tacked onto the end of the earlier version. In Matt Pietrek's Window's 95 System Programming Secrets he lists 4Eh of the these Win32 Services, I read in a newsgroup there were something like 65h in Win98, and there were likely more added in WinMe. (These Win32 Services are referenced from the DDB_Win32_Service_Table pointer and are essentially equivalent to the newer Int2E ntdll services in Win2K).

Chances are new service function ordinals are added to the existing table (Win95->Win98A/B->WinMe), and any obsolete functions there may be simply point to a "not implemented" message, but this is a bold leap of M$ faith I wouldn't bet my house on.

While the Icedump code scans the parameter dword table as well, instead of just relying blindly on undocumented ordinal values, once the first service is found (W32_SetThreadContext), the rest are simply referenced to it in order and match the listing in Pietrek's book, i.e.

ord 15h = _VWIN32_Set_Thread_Context
dec eax
ord 14h = _VWIN32_Get_Thread_Context
add eax, 6
ord 1Ah = SuspendThread
etc.

Your best bet might be to disassemble vwin32.vxd for each of the OS's, if you can get hold of them, and see if you can confirm that the pattern of parameter dwords is at least the same. (VWin32.vxd is built dynamically from the file on the CD into VMM32.vxd on system installation and when the services are registered, so you might need to disasm vmm32.vxd instead).

Out of curiousity, does Icedump work OK on WinMe?

Kayaker
ajron
04-29-2004, 06:22 AM
Thanks for the reply.

Your best bet might be to disassemble vwin32.vxd for each of the OS's

Hmmm, it's probably the best choice.

Out of curiousity, does Icedump work OK on WinMe?
I have no problem with it, but I want to write similar tool for educational purpose on my own ;)

Here is a very very first version of my tool, but it can protect Sice from some tricks now. It work on my WinMe with no problem. Maybe someone regards it as useful.


Armadillo, Hardware FingerPrint, Keygens
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo, Hardware FingerPrint, Keygens
PDA

View Full Version : Armadillo, Hardware FingerPrint, Keygens

xkodi
04-27-2004, 04:48 AM
This is my first post and hope that I don't break some rules even after I read the FAQ. Also I want to excuse for my bad English.
I read many threads for Armadillo protection in this forum and all tutorials I found, but they focus mainly on unpacking and said nothing for Armadillo Hardware protection - when protected application display window showing Hardware Fingerprint(HFP) and asking for name/key. I have application from 02.2002 protected this way - it uses an old version of Armadillo - maybe 1.7-1.8 - it creates file like Arm3.tmp, ArmD.tmp, etc. in user temp dir, which I think you called Armadillo server and don't load entire proccess to memory, until you enter valid name/key, so I can't dump. I haven't valid name/key/HFP, so I can't do what I read on this forum - to change HFP in memory and reuse valid name/key for another PC. Debugger detection of protected application works when I use SoftICE 4.05, but doesn't work with SoftICE from DriverStudio 2.7(strange for me), so I use DS2.7 SI and set bpx to GetWindowTextA :
(this is from Armadillo server Arm3.tmp, etc.)
* Possible Reference to Dialog: DialogID_0077, CONTROL_ID:0415, ""
|
:1000A0B3 6815040000 push 00000415
:1000A0B8 53 push ebx
:1000A0B9 FFD6 call esi ---> breaks here, get name
:1000A0BB 50 push eax
:1000A0BC FFD7 call edi ---> breaks here, get key
:1000A0BE 8D8500FEFFFF lea eax, dword ptr [ebp+FFFFFE00]
:1000A0C4 50 push eax
:1000A0C5 E8B6280000 call 1000C980
:1000A0CA 85C0 test eax, eax
:1000A0CC 59 pop ecx
:1000A0CD 0F841A010000 je 1000A1ED
:1000A0D3 8D8500FFFFFF lea eax, dword ptr [ebp+FFFFFF00]
:1000A0D9 50 push eax
:1000A0DA E8A1280000 call 1000C980
:1000A0DF 85C0 test eax, eax
:1000A0E1 59 pop ecx
:1000A0E2 0F8405010000 je 1000A1ED
:1000A0E8 8B0DB0940110 mov ecx, dword ptr [100194B0]
:1000A0EE 8D8500FFFFFF lea eax, dword ptr [ebp+FFFFFF00]
:1000A0F4 6A01 push 00000001
:1000A0F6 50 push eax
:1000A0F7 8D8500FEFFFF lea eax, dword ptr [ebp+FFFFFE00]
:1000A0FD 50 push eax
:1000A0FE E8BBDEFFFF call 10007FBE
:1000A103 84C0 test al, al
:1000A105 0F859E000000 jne 1000A1A9 ---> change it to jp
* Reference To: KERNEL32.GetLastError, Ord:011
After I change (in memory) jne 1000A1A9 to jp 1000A1A9 it displays "Key is valid, and has been stored.", and after I click OK it says "Loading..." , creates file with same name as the exe and extension .TMP0, but crashes and in the end I have .TMP0 with 0 bytes size. Any ideas? I am really newbie in reversing and can't do much more, but I saw keygen for programs protected with HFP even with more recent version of Armadillo like 2.61, released from group called DreamTeam, so it isn't impossible to make a keygen(if someone want the program and the keygen I can send them). The keygen asks for Name/HFP and prints Keys like "F492-D9AA-1EE3-7B74-33E6-BD46-A665-90C6-FC17-84B1", but I think in programs protected with old version of Armadillo like in my case key looks like "0AC5-7C9A-68CA-1B1B". True/False? Also when I debug Armadillo Software Protection System 1.82 it looks much like the code above and there is a keygen from Duelist for Armadillo 1.82. So my main question(request) is to post here as much as possible information about Armadillo HW protection and how to crack, make keygen, etc., nobody talk about that but for me it is more than possible it is already made and also of course information that can help me in my case. Thank you.
naides
04-27-2004, 05:17 AM
This is my first post and hope that I don't break some rules even after I read the FAQ. Also I want to excuse for my bad English.
I read many threads for Armadillo protection in this forum and all tutorials I found, but they focus mainly on unpacking and said nothing for Armadillo Hardware protection - when protected application display window showing Hardware Fingerprint(HFP) and asking for name/key. I have application from 02.2002 protected this way - it uses an old version of Armadillo - maybe 1.7-1.8 - it creates file like Arm3.tmp, ArmD.tmp, etc. in user temp dir, which I think you called Armadillo server and don't load entire proccess to memory, until you enter valid name/key, so I can't dump. I haven't valid name/key/HFP, so I can't do what I read on this forum - to change HFP in memory and reuse valid name/key for another PC. Debugger detection of protected application works when I use SoftICE 4.05, but doesn't work with SoftICE from DriverStudio 2.7(strange for me), so I use DS2.7 SI and set bpx to GetWindowTextA :
(this is from Armadillo server Arm3.tmp, etc.)
* Possible Reference to Dialog: DialogID_0077, CONTROL_ID:0415, ""
|
:1000A0B3 6815040000 push 00000415
:1000A0B8 53 push ebx
:1000A0B9 FFD6 call esi ---> breaks here, get name
:1000A0BB 50 push eax
:1000A0BC FFD7 call edi ---> breaks here, get key
:1000A0BE 8D8500FEFFFF lea eax, dword ptr [ebp+FFFFFE00]
:1000A0C4 50 push eax
:1000A0C5 E8B6280000 call 1000C980
:1000A0CA 85C0 test eax, eax
:1000A0CC 59 pop ecx
:1000A0CD 0F841A010000 je 1000A1ED
:1000A0D3 8D8500FFFFFF lea eax, dword ptr [ebp+FFFFFF00]
:1000A0D9 50 push eax
:1000A0DA E8A1280000 call 1000C980
:1000A0DF 85C0 test eax, eax
:1000A0E1 59 pop ecx
:1000A0E2 0F8405010000 je 1000A1ED
:1000A0E8 8B0DB0940110 mov ecx, dword ptr [100194B0]
:1000A0EE 8D8500FFFFFF lea eax, dword ptr [ebp+FFFFFF00]
:1000A0F4 6A01 push 00000001
:1000A0F6 50 push eax
:1000A0F7 8D8500FEFFFF lea eax, dword ptr [ebp+FFFFFE00]
:1000A0FD 50 push eax
:1000A0FE E8BBDEFFFF call 10007FBE
:1000A103 84C0 test al, al
:1000A105 0F859E000000 jne 1000A1A9 ---> change it to jp

By flipping this jump, you obligated the program to say "YOU ARE THE BOSS" under duress, but the program rechecks the validity of the key at least one more time, somewhere else, and catches the lie. You need to locate those other places and deactivate them, or better yet, produce a valid Key.

You need to jump into the calls at

:1000A0C5 E8B6280000 call 1000C980 ,

:1000A0DA E8A1280000 call 1000C980

and more specifically

:1000A0FE E8BBDEFFFF call 10007FBE

and learn what makes a good key a good KEY. Also find out where the key gets stored, and, using BPM, catch the program evaluating it and reading it again

* Reference To: KERNEL32.GetLastError, Ord:011
After I change (in memory) jne 1000A1A9 to jp 1000A1A9 it displays "Key is valid, and has been stored.", and after I click OK it says "Loading..." , creates file with same name as the exe and extension .TMP0, but crashes and in the end I have .TMP0 with 0 bytes size. Any ideas? I am really newbie in reversing and can't do much more, but I saw keygen for programs protected with HFP even with more recent version of Armadillo like 2.61, released from group called DreamTeam, so it isn't impossible to make a keygen(if someone want the program and the keygen I can send them). The keygen asks for Name/HFP and prints Keys like "F492-D9AA-1EE3-7B74-33E6-BD46-A665-90C6-FC17-84B1", but I think in programs protected with old version of Armadillo like in my case key looks like "0AC5-7C9A-68CA-1B1B". True/False? Also when I debug Armadillo Software Protection System 1.82 it looks much like the code above and there is a keygen from Duelist for Armadillo 1.82. So my main question(request) is to post here as much as possible information about Armadillo HW protection and how to crack, make keygen, etc., nobody talk about that but for me it is more than possible it is already made and also of course information that can help me in my case. Thank you.

JMI, not every thing is lost. . . Some newbies do read the FAQ, and post questions that show some effort !!! Is this the first one this year?
xkodi
04-27-2004, 05:38 AM
thank you for reply, I think
:1000A0C5 E8B6280000 call 1000C980 ,
:1000A0DA E8A1280000 call 1000C980
checks if name/key is not a NULL string and displays message box like "please enter name/key" if so, but 1000A0FE E8BBDEFFFF call 10007FBE is too complicated for me, so many call and conditional jumps. I can't find where valid key is store. Also I don't know nothing about the key maybe it is store crypted in memory or something. I use PEiD v0.92 on my protected program and it says "Armadillo 2.20 -> Silicon Realms Toolworks [Overlay]" and KANAL(Krypto ANALyser v2.5 by snaker) plugin says BLOWFISH::000037C8::004037C8 . What about Armadillo and Blowfish cipher? Duelist keygen also uses Blowfish...some more info?


pocket program need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > pocket program need help
PDA

View Full Version : pocket program need help

einstein
04-27-2004, 10:38 AM
Hi,

i hope someone can help me.
This program is for a pocket pc. (like iPAQ)

Look at this:

.text:00023B38 STMFD SP!, {R4,R5,LR}
.text:00023B3C SUB SP, SP, #8
.text:00023B40 MOV R5, R0
.text:00023B44 ADD R0, SP, #0
.text:00023B48 BL sub_15378
.text:00023B4C ADD R1, SP, #0
.text:00023B50 ADD R0, R5, #0x98
.text:00023B54 BL _GetWindowTextW_CWnd__QBAXAAVCString___Z ; CWnd::GetWindowTextW(CString &)
.text:00023B58 ADD R0, SP, #4
.text:00023B5C ADD R1, SP, #0
.text:00023B60 BL __0CString__QAA_ABV0__Z ; CString::CString(CString const &)
.text:00023B64 LDR R4, =unk_BB6D4
.text:00023B68 LDR R1, [SP,#4]
.text:00023B6C LDR R0, [R4]
.text:00023B70 BL sub_69E78
.text:00023B74 LDR R0, [R4]
.text:00023B78 LDRB R3, [R0,#0x328]
.text:00023B7C CMP R3, #0
.text:00023B80 BEQ loc_23B94
.text:00023B84 MOV R0, R5
.text:00023B88 BL sub_23890
.text:00023B8C B loc_23BB8
.text:00023B8C ; ---------------------------------------------------------------------------
.text:00023B90 off_23B90 DCD unk_BB6D4 ; DATA XREF: .text:00023B64r
.text:00023B94 ; ---------------------------------------------------------------------------
.text:00023B94
.text:00023B94 loc_23B94 ; CODE XREF: .text:00023B80j
.text:00023B94 MOV R1, #0xAF00
.text:00023B98 LDR R2, =aInvalidRegistr
.text:00023B9C ORR R1, R1, #0xF9
.text:00023BA0 ADD R0, SP, #0
.text:00023BA4 BL sub_3ADF8
.text:00023BA8 LDR R0, [SP]
.text:00023BAC MOV R2, #0
.text:00023BB0 MOV R1, #0x40
.text:00023BB4 BL sub_8F978
.text:00023BB8
.text:00023BB8 loc_23BB8 ; CODE XREF: .text:00023B8Cj
.text:00023BB8 ADD R0, SP, #0
.text:00023BBC BL sub_845F0
.text:00023BC0 ADD SP, SP, #8
.text:00023BC4 LDMFD SP!, {R4,R5,PC}
.text:00023BC4 ; ---------------------------------------------------------------------------
.text:00023BC8 off_23BC8 DCD aInvalidRegistr ; DATA XREF: .text:00023B98r
.text:00023BC8 ; "Invalid registration key!"
.text:00023BCC

at adress 23B54 the program read the serial (i think)
at adress 23B70 the serial will be checked
at adress 23B80 the program jump to the invalid regkey.

at the sub 69E78 ida show this:

.text:00069E78
.text:00069E78 sub_69E78 ; CODE XREF: .text:00023B70p
.text:00069E78 ; sub_66B78+68p
.text:00069E78
.text:00069E78 var_74 = -0x74
.text:00069E78 var_6C = -0x6C
.text:00069E78 var_68 = -0x68
.text:00069E78 var_64 = -0x64
.text:00069E78 var_60 = -0x60
.text:00069E78 var_5C = -0x5C
.text:00069E78 var_5B = -0x5B
.text:00069E78 var_5A = -0x5A
.text:00069E78 var_59 = -0x59
.text:00069E78 var_58 = -0x58
.text:00069E78 var_57 = -0x57
.text:00069E78 var_56 = -0x56
.text:00069E78 var_55 = -0x55
.text:00069E78 var_54 = -0x54
.text:00069E78 var_53 = -0x53
.text:00069E78 var_52 = -0x52
.text:00069E78 var_51 = -0x51
.text:00069E78 var_50 = -0x50
.text:00069E78 var_4F = -0x4F
.text:00069E78 var_4E = -0x4E
.text:00069E78 var_4D = -0x4D
.text:00069E78 var_4A = -0x4A
.text:00069E78 var_46 = -0x46
.text:00069E78 var_C = -0xC
.text:00069E78 arg_0 = 0
.text:00069E78
.text:00069E78 MOV R12, SP
...

what must i do now?

I hope anyone can help me.

regards
Einstein :)
gabri3l
04-27-2004, 03:56 PM
I've never worked with ARM processor instructions before. It looks as if the serial is checked but here is a list of all the ARM instructions. hxxp://www.heyrick.co.uk/assembler/qfinder.html. A better site is hxxp://www.crhc.uiuc.edu/ECE371EMR/qrc0001c_armside.pdf

Just a quick look at the reference card and we now know

.text:00023B7C CMP R3, #0 <---Compare
.text:00023B80 BEQ loc_23B94 <--- Branch (jump) if equal to next intructions
.text:00023B84 MOV R0, R5 <--- continues if It is not equal
.text:00023B88 BL sub_23890
.text:00023B8C B loc_23BB8

Hopefully help give you a better understanding of whats going on
einstein
04-28-2004, 12:20 PM
hello gabri3l,

thanks for your request.
What do you think I can do?

text:00023B7C CMP R3, #0 <---Compare -change to R3, #1 ???
.text:00023B80 BEQ loc_23B94 <--- Branch (jump) if equal to next intructions -I think thats wrong, because i tried to change BEQ to BNE.
So the screen "invald registration" is never showing.
.text:00023B84 MOV R0, R5 <--- continues if It is not equal - i don`t know
.text:00023B88 BL sub_23890
.text:00023B8C B loc_23BB8

i hope you can help me.

Regards
Einsein ;)
gabri3l
04-28-2004, 02:48 PM
Another source of ARM knowledge is hxxp://www.peter-cockerell.net:8080/aalp/html/toc.html Chapt. 3 talks about the instruction set.

What happened when you changed the branch and tried registering with an invalid serial?

Are you just trying to patch the program or search for a valid string?

From cockerell.net:
----
There are sixteen instructions, and they have very similar formats. Examples of instructions from this group are ADD and CMP, which add and compare two numbers respectively. As mentioned above, the operands of these instructions are always in registers (or an immediate number stored in the instruction itself), never in memory
-----
So maybe try keeping an eye on the registers.
einstein
04-28-2004, 03:06 PM
Hi gabri3l,

when i changed the ".text:00023B80 BEQ loc_23B94" to BNE
the message "invalid Registration..." does not appear.

Yes i will patch the program. But i need help, because i am a beginner.

Regards
Einstein
gabri3l
04-28-2004, 03:49 PM
Well if you are just starting out try taking a look at
hxxp://www.searchlores.org/fravia/personalia/ipaq.htm
hxxp://www.woodmann.com/fravia/tsehp_pocketpc.htm

Have you saved the modified program and tried syncing it to your pocket pc? did it register?

--This may be better in the newbie forum, not really advanced reversing--
einstein
04-29-2004, 11:44 AM
Hi,

yes i tried, but with no result. only the message "invalid registration" is never shown.
There is a second prob. The unregistred program shows the reg screen in short time intervals.
So it is possible to work with the program fully, but it shows allways the reg screen. (thats uggly)
Is it possible that i send the file to you?

What do you mean with the newbie forum?
Where can i find it?

Einstein
einstein
04-29-2004, 11:46 AM
Ok, sorry.
I see, the newbie forum is here.

:D :D :D
Einstein
JMI
04-29-2004, 03:05 PM
It's ALL relative. :D

Regards,
einstein
04-29-2004, 03:16 PM
hi JIM,

do you know the pocket language?

Einstein
JMI
04-29-2004, 03:22 PM
Nope. Sorry.

Was just making a pun on your nick: Einstein.

You know, "the theory of relativity".

Regards,
gabri3l
04-29-2004, 07:20 PM
Hello again JMI. :)

:rolleyes: einstein i just shook my head when you asked where the forum was...

If you want to Private Message me with a link to the prog I'll take a look at it. Though as i said before I really dont know ARM instructions. In the meantime read up on those tutorials i gave you. Try searching for the call to the messagebox that asks you to register or try fishing out the valid serial. As said before its prob in a register and is compared to yours.
einstein
04-30-2004, 01:11 PM
hi Gabri3l,

do you have an PDA? Then i can send you the link. Otherwise i must send you the exe file.

regards
Einstein :)
gabri3l
04-30-2004, 04:18 PM
Yes i do. I will not be home this weekend however. So you can just PM me whenever you get a chance. And I will take a look at it on Monday.
einstein
04-30-2004, 04:29 PM
ok, thanks.
we see us at monday.

ciao
Einstein
akimp3
05-01-2004, 08:31 AM
Hi

I have worked a little bit on ppc re. I have seen in your ida dissasembly
there is a .text:00023B70 BL sub_69E78 just before the CMP R3,1 so this BL(branch and link) go to the sub_69E78 subroutine and check your serial.this subroutine return 1 if the serial is valid and it return 0 if the serial is invalid so you should go in this sunroutine and find mov Rx,0 and replace it with mov Rx,1.as you know the serial check routine maybe called several time in different parts of the programm so by this way the check routine will allways return TRUE.
I have attached one of my tutorial to this post the protection is similar to your target take a look .

Good luck

akimp3
einstein
05-01-2004, 09:28 AM
hello akimp3,

thanks for your post.
there is one problem:
at adress .text:00069E78 MOV R12, SP is the sign SP.
What can i do there?

Einstein
einstein
05-02-2004, 05:56 AM
Hi,

i have tried change mov to movne and moveq and the program hangs up.
So i must soft reset my iPAQ.

Can somebody help me?

regards
Einstein
akimp3
05-06-2004, 02:33 AM
Hi
sorry for my late reply. I was out of town.
Please PM me the name of the prog i will take a look myself.
I have never seen something like the sub_69E78 code.
another way to solve your problem is to fing every BL sub_69E78
find the CMP R3, #0 and patch the BEQ after it like the first you done
yourseft but the problem was that you only patched the BEQ attext:00023B80 bu there must be a lot of call to sub_69E78 find them
all and patch the BEQ just after the call.

Good luck

akimp3
einstein
05-09-2004, 11:20 AM
Hi akimp3,

sorry for my late aply.
Do you have an PDA? (iPAQ)

Otherwise i must send you the exe file.

Here is the whole sub_69E78 code:

.text:00069E78
.text:00069E78 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
.text:00069E78
.text:00069E78
.text:00069E78 sub_69E78 ; CODE XREF: .text:00023B70p
.text:00069E78 ; sub_66B78+68p
.text:00069E78
.text:00069E78 var_74 = -0x74
.text:00069E78 var_6C = -0x6C
.text:00069E78 var_68 = -0x68
.text:00069E78 var_64 = -0x64
.text:00069E78 var_60 = -0x60
.text:00069E78 var_5C = -0x5C
.text:00069E78 var_5B = -0x5B
.text:00069E78 var_5A = -0x5A
.text:00069E78 var_59 = -0x59
.text:00069E78 var_58 = -0x58
.text:00069E78 var_57 = -0x57
.text:00069E78 var_56 = -0x56
.text:00069E78 var_55 = -0x55
.text:00069E78 var_54 = -0x54
.text:00069E78 var_53 = -0x53
.text:00069E78 var_52 = -0x52
.text:00069E78 var_51 = -0x51
.text:00069E78 var_50 = -0x50
.text:00069E78 var_4F = -0x4F
.text:00069E78 var_4E = -0x4E
.text:00069E78 var_4D = -0x4D
.text:00069E78 var_4A = -0x4A
.text:00069E78 var_46 = -0x46
.text:00069E78 var_C = -0xC
.text:00069E78 arg_0 = 0
.text:00069E78
.text:00069E78 0D C0 A0 E1 MOV R12, SP ; Rd = Op2
.text:00069E7C 0F 00 2D E9 STMFD SP!, {R0-R3} ; Store Block to Memory
.text:00069E80 F0 5F 2D E9 STMFD SP!, {R4-R12,LR} ; Store Block to Memory
.text:00069E84 3C D0 4D E2 SUB SP, SP, #0x3C ; Rd = Op1 - Op2
.text:00069E88 00 40 A0 E1 MOV R4, R0 ; Rd = Op2
.text:00069E8C CE AF 84 E2 ADD R10, R4, #0x338 ; Rd = Op1 + Op2
.text:00069E90 01 30 A0 E3 MOV R3, #1 ; Rd = Op2
.text:00069E94 0A 00 A0 E1 MOV R0, R10 ; Rd = Op2
.text:00069E98 28 33 C4 E5 STRB R3, [R4,#0x328] ; Store to Memory
.text:00069E9C A4 69 00 EB BL sub_84534 ; Branch with Link
.text:00069EA0 00 00 8D E2 ADD R0, SP, #0 ; Rd = Op1 + Op2
.text:00069EA4 68 10 8D E2 ADD R1, SP, #0x68 ; Rd = Op1 + Op2
.text:00069EA8 55 69 00 EB BL __0CString__QAA_ABV0__Z ; CString::CString(CString const &)
.text:00069EAC 00 10 9D E5 LDR R1, [SP,#0x74+var_74] ; Load from Memory
.text:00069EB0 28 00 8D E2 ADD R0, SP, #0x28 ; Rd = Op1 + Op2
.text:00069EB4 18 C4 FF EB BL sub_5AF1C ; Branch with Link
.text:00069EB8 04 00 50 E3 CMP R0, #4 ; Set cond. codes on Op1 - Op2
.text:00069EBC 6F 00 00 1A BNE loc_6A080 ; Branch
.text:00069EC0 1B 30 A0 E3 MOV R3, #0x1B ; Rd = Op2
.text:00069EC4 BA 22 DD E1 LDRH R2, [SP,#0x74+var_4A] ; Load from Memory
.text:00069EC8 18 30 CD E5 STRB R3, [SP,#0x74+var_5C] ; Store to Memory
.text:00069ECC 02 30 A0 E3 MOV R3, #2 ; Rd = Op2
.text:00069ED0 19 30 CD E5 STRB R3, [SP,#0x74+var_5B] ; Store to Memory
.text:00069ED4 48 30 A0 E3 MOV R3, #0x48 ; Rd = Op2
.text:00069ED8 1A 30 CD E5 STRB R3, [SP,#0x74+var_5A] ; Store to Memory
.text:00069EDC 09 30 A0 E3 MOV R3, #9 ; Rd = Op2
.text:00069EE0 1C 30 CD E5 STRB R3, [SP,#0x74+var_58] ; Store to Memory
.text:00069EE4 63 30 A0 E3 MOV R3, #0x63 ; Rd = Op2
.text:00069EE8 1D 30 CD E5 STRB R3, [SP,#0x74+var_57] ; Store to Memory
.text:00069EEC 08 30 A0 E3 MOV R3, #8 ; Rd = Op2
.text:00069EF0 1F 30 CD E5 STRB R3, [SP,#0x74+var_55] ; Store to Memory
.text:00069EF4 47 30 A0 E3 MOV R3, #0x47 ; Rd = Op2
.text:00069EF8 20 30 CD E5 STRB R3, [SP,#0x74+var_54] ; Store to Memory
.text:00069EFC 16 30 A0 E3 MOV R3, #0x16 ; Rd = Op2
.text:00069F00 21 30 CD E5 STRB R3, [SP,#0x74+var_53] ; Store to Memory
.text:00069F04 13 30 A0 E3 MOV R3, #0x13 ; Rd = Op2
.text:00069F08 23 30 CD E5 STRB R3, [SP,#0x74+var_51] ; Store to Memory
.text:00069F0C 0B 30 A0 E3 MOV R3, #0xB ; Rd = Op2
.text:00069F10 24 30 CD E5 STRB R3, [SP,#0x74+var_50] ; Store to Memory
.text:00069F14 11 30 A0 E3 MOV R3, #0x11 ; Rd = Op2
.text:00069F18 25 30 CD E5 STRB R3, [SP,#0x74+var_4F] ; Store to Memory
.text:00069F1C 0C 30 A0 E3 MOV R3, #0xC ; Rd = Op2
.text:00069F20 26 30 CD E5 STRB R3, [SP,#0x74+var_4E] ; Store to Memory
.text:00069F24 0F 30 A0 E3 MOV R3, #0xF ; Rd = Op2
.text:00069F28 27 30 CD E5 STRB R3, [SP,#0x74+var_4D] ; Store to Memory
.text:00069F2C 04 00 A0 E3 MOV R0, #4 ; Rd = Op2
.text:00069F30 B8 32 DD E1 LDRH R3, [SP,#0x28] ; Load from Memory
.text:00069F34 1B 00 CD E5 STRB R0, [SP,#0x74+var_59] ; Store to Memory
.text:00069F38 03 38 A0 E1 MOV R3, R3,LSL#16 ; Rd = Op2
.text:00069F3C 1E 00 CD E5 STRB R0, [SP,#0x74+var_56] ; Store to Memory
.text:00069F40 02 30 83 E0 ADD R3, R3, R2 ; Rd = Op1 + Op2
.text:00069F44 BE 22 DD E1 LDRH R2, [SP,#0x74+var_46] ; Load from Memory
.text:00069F48 08 30 8D E5 STR R3, [SP,#0x74+var_6C] ; Store to Memory
.text:00069F4C BC 32 DD E1 LDRH R3, [SP,#0x74+var_4A+2] ; Load from Memory
.text:00069F50 22 00 CD E5 STRB R0, [SP,#0x74+var_52] ; Store to Memory
.text:00069F54 18 00 8D E2 ADD R0, SP, #0x18 ; Rd = Op1 + Op2
.text:00069F58 03 38 A0 E1 MOV R3, R3,LSL#16 ; Rd = Op2
.text:00069F5C 02 30 83 E0 ADD R3, R3, R2 ; Rd = Op1 + Op2
.text:00069F60 0C 30 8D E5 STR R3, [SP,#0x74+var_68] ; Store to Memory
.text:00069F64 A7 C3 FF EB BL sub_5AE08 ; Branch with Link
.text:00069F68 10 10 8D E2 ADD R1, SP, #0x10 ; Rd = Op1 + Op2
.text:00069F6C 08 00 8D E2 ADD R0, SP, #8 ; Rd = Op1 + Op2
.text:00069F70 86 C3 FF EB BL sub_5AD90 ; Branch with Link
.text:00069F74 10 90 9D E5 LDR R9, [SP,#0x74+var_64] ; Load from Memory
.text:00069F78 14 70 9D E5 LDR R7, [SP,#0x74+var_60] ; Load from Memory
.text:00069F7C 14 31 9F E5 LDR R3, =__itod ; Load from Memory
.text:00069F80 29 88 A0 E1 MOV R8, R9,LSR#16 ; Rd = Op2
.text:00069F84 27 08 A0 E1 MOV R0, R7,LSR#16 ; Rd = Op2
.text:00069F88 00 30 93 E5 LDR R3, [R3] ; Load from Memory
.text:00069F8C 0F E0 A0 E1 MOV LR, PC ; Rd = Op2
.text:00069F90 03 F0 A0 E1 MOV PC, R3 ; Rd = Op2

ok, thats it.
I changed at adress 00069E90 Mov R3, #0 in R3, #1
(Here you can see it.)

So the program is registrated. But not 100%.

:D :D :D :D :D :D :D :D :D

regards
Einstein
akimp3
05-10-2004, 11:46 AM
Hi

yes I have a PDA(POCKET LOOX 600 WM2003).

As i have seen(a quick look) your patching in this routine is
100% correct so it must be others subroutine we have to patch.
what the program show you that you understand it is not
100% registered? a msgbox, a label? tell me this and we should
localize it (the msbox or the label) in IDA and desactivate the jump
to it.

Good luck

akimp3
einstein
05-10-2004, 11:58 AM
Hi,

ok, thanks.

When the program is registred, you must see the program serial number
and the Date till you can update for free.

At me, the program shows 00000 for the program serial number and nothing
about the date till you can update. I think that is not so correct.

But the program works fine.

Now you have PM.

Einstein :D
einstein
05-30-2004, 10:41 AM
Hi Akimp3,

are you back?
I have another target. I think this is not so simple as my first.

Einstein :D
akimp3
06-01-2004, 10:27 AM
Hi Akimp3,

are you back?
I have another target. I think this is not so simple as my first.

Einstein :D
Hi

I am backed and badly stucked on see ** ****** program
I have always the 0000 serial problem and i cant find how the
serial is validated to be able to construct a valid one.I am really
sorry but i think someone expert should take a look at the routine.
I have also tried to crack it another way(from the unregistered
string in IDA)but the same problem is there. i think for now
you should download the latest version from the site and crack
this way.
About your new target please PM me more info and i will look at it.
The biggest problem in PPC reversing is the lack of a good debugger,
evc debugger is not good at all compared to ollydbg and softice,...
that we use on PC.Maybe someone should start to write a debugger
for ppc.
I will wait for your PM

akimp3
einstein
06-01-2004, 11:07 AM
HI,

cool. You have pm.

Einstein
einstein
06-09-2004, 02:48 PM
Hi akimp3,

your messagebox is full. please delete some mails.

I found our target with crack on emule.
Do you think if it is possible to copare the orginal exe file with the cracked.
So we can find out where we must change the exe.

What do you think?
I found a tool calles code fusion wizard.

Do you know about this?

Regards
Einstein :D
einstein
06-12-2004, 11:53 AM
Hi,

you are great.
very nice. It works.

I have changed at the three adresses the code to FF B0 0B E2.

Can you tell me how you find out this three codes?
I will learn it for the next update.

Thanks
Einstein :D :D :D :D :D :D :D :D :D :D :D :D

ps.
delete some mails from you acount. I can't send you pm.
akimp3
06-13-2004, 04:27 AM
Hi

For the first 2 addresses these are adrreses that jump to the only reference
of the message"enter valid password in simulator about menu".
and for the other one you should find all the call to settimer,
see the parameters ,only one call has 92000h as parameter.
conver it to decimal =555149100 divide it by 1000(settimer parameter is
in milisecond)=598.016 then divide it by 60=9.9669333333333333333333333333333
this is 9.96 minute or 10 minute as you told.
and it is the only call that set the timer to raise and event every
10 minute so we patch it.
Thats it.You can ask me if there is any other detail you want to know.

bye

akimp3

ps.
delete some mails from you acount. I can't send you pm.
its done you can send me pms
einstein
06-14-2004, 12:49 PM
Hi akimp3,

thanks.
There is one question for me:

how do you come on the Opcode FF B0 0B E2? (AND R11, R11, #0xFF )
How do you find out this?

What is register 11?

Regards
Einstein :D :D :D
akimp3
06-15-2004, 05:41 AM
Hi

As you know there is no NOP operation in the ARM processor.
the AND of A and A give you A,The and of A and FF(logic 1)
also give A.So AND R11, R11, #0xFF change nothing and i
used it as a NOP. you can find the opcode in my first ppc re
tutorial.

Good luck

akimp3
einstein
06-16-2004, 07:26 AM
HI,

cool. ok.
I doesn´t know that.

Now I am again a bit more clever.

Thanks for your help.

Regards
Einstein :yay: :D :D :D :D :yay:
akimp3
06-17-2004, 02:54 AM
Hi

I wish you good luck.

Akimp3
einstein
06-19-2004, 06:16 AM
Thanks, Thanks.

I hope i can learn any more about this.
But at the moment i have no target.

So i will still wait and wait and wait...
But the updates will come. :D :D :D and then i will start a new session.

Ok,
thanks at all for your help.
Your great.

Regards
Einstein :yay: :D :D :D :yay:
einstein
04-20-2005, 10:42 AM
Hi akimp3,

do you remember me?
Now it is a half year ago that we write about my target.

But the problem that i have is the new function in my target.
I don´t understand it.

I hope you can help me.

Best Regards
Einstein


Writing Windows NT Device Drivers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Writing Windows NT Device Drivers
PDA

View Full Version : Writing Windows NT Device Drivers

Kayaker
04-27-2004, 11:38 PM
There are a lot of resources for writing device drivers, from dedicated sites to books to source snippets, most can be easily found while doing beginning research and I could probably list a page of bookmarks, but here's one I hadn't stumbled on before that might be useful. Some information might be outdated though as it was written for Windows NT 3.1, but in general may still be relevant.

Writing Windows NT Device Drivers
http://www.driverlinx.com/Publications/NTDriver/ntdriver.htm

also a companion article
Writing Windows 95 Device Drivers
http://www.driverlinx.com/Publications/W95Driver/win95driver.htm

While I'm giving away secrets, here's a unique current site put together by the driver gurus:
The Independent Newsletter of Windows Driver Programming
http://www.wd-3.com/

Happy KMD trails,
Kayaker
Opcode
04-28-2004, 11:34 AM
Hey Kayaker,

Very nice this link:
http://www.wd-3.com/ :D

Thanx


Kernel reverse engineering tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Kernel reverse engineering tool
PDA

View Full Version : Kernel reverse engineering tool

Opcode
04-28-2004, 03:42 PM
This tool is absolutely amazing:

http://www.opening-windows.com/home.html

Install the program and read the User's Guide.

Regards,
Opcode
CrackZ
04-28-2004, 07:43 PM
If it does remotely close to what they say it should.....

I'm definitely shelling out for a copy ;-).

This has many applications for our community and ought to be well worth the $. I actually had this idea about 3 months ago to write something similar for a long term project but figured it'd be an absolute nightmare to implement, the warnings of BSOD's in the user manual seem to back up my thoughts back then.

Regards

CrackZ.
Alorent
04-29-2004, 01:38 PM
Hi,

Amazing tool! :D

Does anyone know some internals of how that tool works? Is it like a debugger putting the Trap Flag?

Thanks
Opcode
04-29-2004, 01:54 PM
Does anyone know some internals of how that tool works? Is it like a debugger putting the Trap Flag?

Yes, it uses Drx registers and single-step debug with the Trap Flag.
The manual inside the ft10eval.exe in the RTF format gives a good
explanation.

In my system, I have created a simple .bat file to run my
trace sessions. The result is saved in the file with the .itr extension.

Regards,
Opc0de


Dll won't run
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dll won't run
PDA

View Full Version : Dll won't run

GoatBoy
04-28-2004, 08:42 PM
Hi All, I'm trying to debug a dll directly with Olly but not having any luck. When I load it and step over the code, it immediately goes into one of it's imports (msvbvm60.dll) which calls the function GetCurrentThreadId, then goes to kernel32 where ExitThread is called and the process terminates. This all happens within 30 or so steps and apart from the first 3 lines, it never even reaches the main Dll. I know kernel32.dll has IsDebuggerPresent but that function isn't called so I'm wondering why it would exit so quickly?
Thanks... :confused:
DaddyJTHC
04-28-2004, 08:56 PM
Hi All, I'm trying to debug a dll directly with Olly but not having any luck. When I load it and step over the code, it immediately goes into one of it's imports (msvbvm60.dll) which calls the function GetCurrentThreadId, then goes to kernel32 where ExitThread is called and the process terminates. This all happens within 30 or so steps and apart from the first 3 lines, it never even reaches the main Dll. I know kernel32.dll has IsDebuggerPresent but that function isn't called so I'm wondering why it would exit so quickly?
Thanks... :confused:

I had this happen once before, I believe you must also process the file that calls the dll, because since there is no direct access, its first instinct is to quit.
GoatBoy
04-28-2004, 09:27 PM
I had this happen once before, I believe you must also process the file that calls the dll, because since there is no direct access, its first instinct is to quit.

Thanks for the reply. ..

I was hoping to avoid that because the host exe has IsDebuggerPresent and also Olly comes up saying adlm.dll has possible self modifying code. When I step over it, something about Interlock comes up. All these things add to my confusion so I was trying to isolate the cuplrit. I guess it only makes sense that it won't run properly without the host... Back to the drawing board!!!!


A push in the right direction
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A push in the right direction
PDA

View Full Version : A push in the right direction

cYRAx
04-28-2004, 09:00 PM
I am trying to learn ASM, using MASM compiler. Is that the "right landuage" to learn when trying to crack? Or schould i start reading TASM tutorials? My aim is not to become a harcore ASM coder, but a decent cracker, just want to learn ASM for coding keygens and crack me's. I am reading Iczelion's coding tutorials. I think a good knowledge of ASM is the key to sucess in this buisness.

Am i on the right track?

Please excuse my English, it is not my mother language..
Aimless
04-28-2004, 11:56 PM
You'll probably be better off spending time understanding select ASM commands that are used for cracking rather than the whole instruction set.

Unless your job demands it, reading through all 3 manuals (though I admit, its really cool) of the Intel Processer guides is just a bit too much.

Ability to *read* rather than *program* ASM takes premium.

Have Phun
PS: If you are trying to be a cracker, TASM/ASM/NASM doesn't make much difference unless you are really looking at higher end products to crack.
JimmyClif
04-29-2004, 12:43 PM
push cYRAx

Well, good thing with learning masm is that you get to learn windows programming in assembly language - problem is that probably you'll get stuck there and won't come back. As many others did before :)

I can only recommend to learn it as it will open new ways on solving the riddles you'll encounter in your reversing career. Once you got that going and you slap your own dll into some other process you'll get more hooked than ever.
dELTA
04-29-2004, 12:51 PM
Once you got that going and you slap your own dll into some other process you'll get more hooked than ever.
Hehe, nice pun. :p
TBone
04-29-2004, 01:35 PM
Hehe, nice pun. :p

A push in the right direction
When I saw the title of this thread, I thought it was going to be an asm pun :p

If I'm being annoying, just POP me with your FIST :D


profile
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > profile
PDA

View Full Version : profile

AlanZheng
04-28-2004, 10:41 PM
How do I config the "profile" at VC++6.0?
If anyone know it,please tell me,thanks a lot.

My mail: zhengxd@langchao.com
MSN: lcw_Alan@hotmail.com
Aimless
04-28-2004, 11:51 PM
Very Simple.

1. Open your Visual C++ Project (I assume you are using VS6 and not .NET)
2. Compile the program normally.
3. Select "Profile" from the menu and press OK
4. It will automatically tell you that the program is not built with profiling options and will instruct you exactly how to go about it.
5. Follow.

Have Phun


Vbox and Olly
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vbox and Olly
PDA

View Full Version : Vbox and Olly

hobferret
04-29-2004, 07:38 AM
Hi all :)

I have written a tut for Vbox 462 and Olly :D

Who has room where I can post it, I tried to put it up on Arron's site but could not get the darn thing to attach.

I had loads of problems finding a tut for this and I could not get Sice and Xp to work until I spoke to Nadies or Naides as he is known. I keep getting him confused coz he says Naides is nobody but to me that don't make sense.

To me the Spanish nadie - pronoun nadies = nobody :confused:

Just hope someone has room for it coz I believe I can't post it here, it's against the rules :D

Regards

/hobferret
JMI
04-29-2004, 03:04 PM
hobferret:

Don't know what the problem may have been on exetools. Attachments seem to have been working generally. I assume, since I know you are knowledgable, that it was in one of the acceptable forms of "bmp doc gif jpe jpeg jpg pdf png psd rar txt zip." The only other thing might have been the size. How big was the tut? Shouldn't have been a problem. Post some more info and maybe I can fix it or get Aaron to do so over there.

Another thought is I could PM you an address to email it and see if I can attach it over there.

After someone here reviews it, it might be a candidate for posting on the +Fravia section's "What's New" site. That's were tutorials are generally posted and this is a good subject for a new one.

[EDIT: Never mind. I see you sent it to R@dier and he was able to get it posted over there. It can be located here:

http://www.exetools.com/forum/showthread.php?t=4160 ]

Regards,
hobferret
04-30-2004, 03:16 PM
JMI ;)

Yep it was a zip, the problem was that when I clicked on the attach button nowt happened :D

Maybe it has something to do with the Internet Security I have gotten running, will have to try with another one :mad:

Regards

/hobferret

hobferret:

Don't know what the problem may have been on exetools. Attachments seem to have been working generally. I assume, since I know you are knowledgable, that it was in one of the acceptable forms of "bmp doc gif jpe jpeg jpg pdf png psd rar txt zip." The only other thing might have been the size. How big was the tut? Shouldn't have been a problem. Post some more info and maybe I can fix it or get Aaron to do so over there.

Another thought is I could PM you an address to email it and see if I can attach it over there.

After someone here reviews it, it might be a candidate for posting on the +Fravia section's "What's New" site. That's were tutorials are generally posted and this is a good subject for a new one.

[EDIT: Never mind. I see you sent it to R@dier and he was able to get it posted over there. It can be located here:

http://www.exetools.com/forum/showthread.php?t=4160 ]

Regards,
naides
04-30-2004, 07:19 PM
Hi all :)

until I spoke to Nadies or Naides as he is known. I keep getting him confused coz he says Naides is nobody but to me that don't make sense.

To me the Spanish nadie - pronoun nadies = nobody :confused:

Regards

/hobferret

Naides means (Nadie) Nobody. It is an old form of Spanish, the way it was pronounced in the 14th century. It is still used coloquially in Latin America Kinda the same mood an English speaker would use terms like Kinda, Dunno or Ain't.

A famous Argentinian Cartoonist pen-name is Naides
chickenbones
05-26-2004, 12:12 AM
I've been trying to get pass vbox in xp for the entired day...i was so happy i found this tut, but exetools no longer take new member, can anyone plz try to attach the tut here?? It would be nice if i can see it

Thanks
hobferret
05-26-2004, 05:43 AM
I've been trying to get pass vbox in xp for the entired day...i was so happy i found this tut, but exetools no longer take new member, can anyone plz try to attach the tut here?? It would be nice if i can see it

Thanks

Hi :)

It's against the rulez to post stuff like that here, it maybe elsewhere on the WWW but I don't know for sure :D

/hobferret
nikolatesla20
05-26-2004, 08:44 AM
www.reteam.org

Lunar dust also wrote a good tutorial

-nt20
hobferret
05-26-2004, 10:37 AM
www.reteam.org

Lunar dust also wrote a good tutorial

-nt20
Hi nt :)

I agree Lunar dust tute was a good one, I put it into HTML if you remember. However, he was using the API GetVersion to grab the entry point.

I have done this one so we arrive at the entry point via a JMP, coz some of these blasted programs have weird entry points and GetVersion won't do the job :sneaky:

BTW the tute I sent R@dier must have been the wrong version, coz I have at the bottom of the finished one in RED LETTERS the text This guide should only be used for research purposes it is the users own choice what he/she use the purposes for and I can't be held responsible in anywayIf you like the program then buy it

Regards

/hobferret


patching dll functions at runtime?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > patching dll functions at runtime?
PDA

View Full Version : patching dll functions at runtime?

ramin_rad2000
04-30-2004, 06:40 AM
Probably most of you have written this kind of loader b4 but here is my question?
I want to write a loader which fires the app then wait for a debug signal(LOAD_DLL_DEBUG_INFO) and then find out if this is the right dll and then patches one of it's functions.
I have seen stones tut on this but i couldn't understand it.
Please just try to give an actual source code or tutorial coz i know in general what have to be done :D
cRk
05-03-2004, 11:45 PM
interesting topic .. i always have seen loaders for .exe files and never .dll or .ocx is there a possible way to make a memory patch(loader) like Risc process patcher does but in .dll files?? in case NOT.. then what other ways we can take to patch a .dll in memory like using a loader for targets been packed or protected some how.
SynApsus
05-04-2004, 01:06 PM
Of course it is possible. I don't think it exists but it seems to be easy to code...
Just code a program which will run the process you have to patch in memory and who uses the dll ( a loader ) then enumerate the modules using Module32First/Module32Next, find the dll you want to patch, determine the address of the patch ( use the difference between the patch location and the image base of the dll ) and that's all.
ramin_rad2000
05-05-2004, 02:01 PM
SynApsus can you give us a source code?
can we use the rva in a dll as an offset to apply patch?Is this rva different in every machine?
I made a simple patch(in a dll)and it worked both in xp and 98 and i want to know wether it is general or not?
SynApsus
05-05-2004, 10:48 PM
No, I will not provide source code lol. Find it by yourself !
Some tips to help you :
** Reversing
- Find the bytes to modify and notice the RVA where u will have to patch. This RVA can change very easily ! So you will have to substract the imagebase of the dll and the RVA you just noticed ( do all that in the disassembler ! do not substract the RVA you get in the debugger and the image base of the PE header because the image base of a dll can change when loaded, and the datas will be redirected with the relocations ) Keep this number somewhere : IT will never change. ( if we suppose the location of the patch is not in an dynamically allocated space hehe )

** Patching
- Load the process using the Debug Apis and CreateProcess etc
- Freeze it at each LOAD_DLL_DEBUG_EVENT debug event
- check if this loaded dll is the one you want to patch
- if it is, use the lpBaseOfDll member of ur LOAD_DLL_DEBUG_INFO struct
to retrieve the module handle ( real image base in memory atm ) and add it
the number we noticed.
- Now you can use the writeprocessmemory function to write to the dll in the
debuggee process, just when loaded...

lol, I have not given you the source code but not far of it !
cRk
05-06-2004, 11:29 AM
this is not so easy for someone who dosen't know about coding at all .... would someone else provide source code/ or a tool able to do this task .. i'm newbie...i don't think i will be able to handle this .. maybe someday with free time i'll learn some coding tricks :p
condzero
05-23-2004, 07:54 AM
Hello,

Please find attached a very basic working prototype 'C' program that should work for you
with some minor changes. It does the basic Create Process / Wait for debug event /
Is this the event I'm looking for? / Continue debug event / cycle.
I used this prototype to memory patch a program (protected by a latter version
of Asprotect) based on the timing/loading of a *.dll similar in context to what
you are looking for.
Once you familiarize yourself with the process, you should not have any trouble
adapting to patch a *.dll vs an *.exe as I have done.
Note: this program was written to run on winxp:
A) makes use of the psapi.dll which allows for enumerating modules within a
process. If you don't have version winnt 4.0 or greater, than you
will probably need to use the toolhelp32 snapshot method as
SynApsus mentions. There is plenty of information out there to
show you how to do this.
B) makes use of DebugActiveProcessStop API only valid for version winxp and
greater. This API allows for the debugger to detach from the process
you loaded (your target app). Sweet. :)
C) you may need to explicitly include c:\path\psapi.lib (for psapi.dll) in the link step to avoid any reference type errors.
I am partial to this approach as it eliminates the need to use a process dumper, pe editor
tool, worry about CRC checking, or having to rebuild an IAT. The choice
is yours.
I would be very interested in hearing of your success.
Good Luck!


hiding public key in the app
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > hiding public key in the app
PDA

View Full Version : hiding public key in the app

senso
04-30-2004, 11:59 AM
I have a quick question. I want to use encrpytion/decryption in my application. I will encrypt some data using my private key, and I want
the application to decrypt the encrypted data using the public key.

However, I'd like to hide the public key in the application so that it cannot
be discovered by people disassembling the EXE file.

What is the best way to hide it in the code so it is at least relatively difficult to find the public key?

Thank you!
naides
04-30-2004, 01:04 PM
I have a quick question. I want to use encrpytion/decryption in my application. I will encrypt some data using my private key, and I want
the application to decrypt the encrypted data using the public key.

However, I'd like to hide the public key in the application so that it cannot
be discovered by people disassembling the EXE file.

What is the best way to hide it in the code so it is at least relatively difficult to find the public key?

Thank you!

1 Search "steganography" in Google

2 Look into Malathia site.

3. Hiding the Key can be trivial, Hiding the PROCESS that reads the key and does the encrypt-decrypt job is a completely different matter. Once you isolate that code it would be simple to catch it reading the "hidden" public key. That is the challenge
senso
04-30-2004, 01:56 PM
3. Hiding the Key can be trivial, Hiding the PROCESS that reads the key and does the encrypt-decrypt job is a completely different matter. Once you isolate that code it would be simple to catch it reading the "hidden" public key. That is the challenge

I guess my question should have had 2 parts:

Part #1: How do I hide the public key in the file itself so that you can't just look at it with a disassemler and a hex editor and figure it out in 2 minutes?

This one, you answered. Thank you. I will do the searches you suggested.

Part #2: How do I hide the public key once it is extracted from the EXE file and it is sitting in memory?

Without some code to defeat SoftICE or debugging tools which can attach themselves to processes, I can't hide it, right? No matter how well I hide this key in the EXE file, it has to be used at some point, and at that point it is vulnerable.

Do you have any suggestions to at least make it relatively difficult to get to the key once it is extracted and sitting in the process memory?

Thank you!
nikolatesla20
04-30-2004, 02:07 PM
Why would you need to hide the public key? I mean this is the whole point of asymetric crypto, is that the public key is well, hmm its : public !!! :rolleyes:

No one will be able to do anything with it anyway without the private key.

Anyway, if you have to hide something, then your app isn't truly secure, and you haven't thought it out correctly. Crypto, when correctly applied, is secure. It's just most people screw it up.

Do you have any suggestions to at least make it relatively difficult to get to the key once it is extracted and sitting in the process memory?

At the risk of sounding like a jerk, this is a reversing board, not a create-a-protection board. We help enough authors improve their protection as it is :p

-nt20
TBone
04-30-2004, 02:43 PM
Why would you need to hide the public key? I mean this is the whole point of asymetric crypto, is that the public key is well, hmm its : public !!! :rolleyes:

No one will be able to do anything with it anyway without the private key.

Well, kind of. When you encrypt something with the public key, only the private key can decrypt it. Conversely, when you encrypt something with the private key, only the public key can decrypt it. That sounds useless, but it's actually more or less how signing a document with your private key works. If the public key succesfully decrypts the signature block, then you know that the sig block was made by the private key. And if the decrypted signature block is still a succesful hash of the signed text, then you can be reasonably certain that the document hasn't been modified since the signature was made. That's a bit of an oversimplification, but you get the idea.

Somehow I don't think that's what was meant here, though. I think the OP got the keys backwards. Encrypt with the public, decrypt with the private. I suppose you could encrypt your code with your public key and then hope to "hide" your private key in the software somewhere so that you could decrypt it covertly, but that's not nearly as secure as it sounds. Public key cryptography is strong if and only if you keep your private key private. But more than that, sooner or later you're going to have to decrypt the code in memory, at which point it could be dumped and analyzed in unencrypted form.
senso
04-30-2004, 03:08 PM
Well as TBone and tesla suggested, perhaps I am doing something I shouldn't be doing... I am planning to use the encrpytion/decryption for a software registration system. If I am only sending the app some information in encrpyted form, then keeping the public key in the app and encrypting the info using the private key should be fine.

If I ever hope to send something back from the app to myself in encrypted form though, then I'd like the key to be secret still so that someone else can't find the key and forge a message back. Then I won't know if the app sent the message or someone else using the app's key sent the message...

I didn't post the message on here to come up with a good protection system although the replies kinda steered the conversation in the direction. I posted the message here in the hopes of finding a good way to hide the key in the EXE file somehow. Since you guys reverse engineer all the time, I figured you'd know of some tricks that I wouldn't know or couldn't easily find about.

So if you could tell me what ways I can use to hide the key in the EXE and in the memory, I'll worry about creating a good security model. :)

Thanks again!
nikolatesla20
04-30-2004, 08:12 PM
If you are looking to have the application possibly send data back to you in an encrypted fashion, you should look into the internals of how SSL and Kerebos security works. They use techniques to validify the sender of messages on both ends, I believe especially Kerebos was designed for the type of thing you are describing (preventing "man in the middle") But I don't have my security book in front of me so I don't remember 100%.

No doubt about it, using crypto the right way for real security is hard. You'll have to study up on it a bit to find the correct way. Like I said, you are only as strong as your weakest link, and most shareware authors don't know enough about crypto and end up implementing it with a big loophole. If it's implemented right though, you won't have to hide anything because there just won't be much a cracker can do.

It wouldn't hurt to invest in a good crypto book that explains the basic methodologies and techniques (not necessarily the algorithms, because they can be complex). After that you can move on to the algos.

-nt20
dev_zero
05-01-2004, 08:03 AM
Isn't it so that when you pack your exe with exe stealth it will almost be impoossible to unpack.. If thats true you can just pack it with exe stealth.
dELTA
05-01-2004, 08:12 AM
Yes, of course, why didn't we think of that... :rolleyes:

Now when that's settled, I guess we can close down this board, all is lost anyway if people start using exestealth on their applications... :p
nikolatesla20
05-01-2004, 02:20 PM
Isn't it so that when you pack your exe with exe stealth it will almost be impoossible to unpack.. If thats true you can just pack it with exe stealth.

hmm. Does dev_zero work for a certain packer company or something..

Anyway, you want to be another ignorant shareware author? Don't be ignorant, learn something new, get some crypto books and learn how to do it right.

-nt20
ryan
05-01-2004, 02:54 PM
Anyway, you want to be another ignorant shareware author? Don't be ignorant, learn something new, get some crypto books and learn how to do it right.
-nt20

I fully agree. Learn to crack and then learn to protect. It's the only way to go.
senso
05-01-2004, 03:12 PM
I fully agree. Learn to crack and then learn to protect. It's the only way to go.

Sadly, the more I reverse engineer apps and see how their protection works, the more pesimisstic I get. Ultimately the CPU has to execute the instructions which means at some point somehow, the code will be vulnerable in memory or in the registers. I don't think there is anyway around that without detecting SoftICE and debuggers in memory and preventing them from doing their dirty work. I don't know if I want to invest much time into trying to keep seasoned crackers out of my code. They are not potential customers anyhow since they were not willing to pay for the app in the first place.

By the way, I have been reading crypto books for a while now. Right now I am munching on "Applied Cryptography" by Bruce Scheier. Reading cryptography doesn't help too much. Cryptography books are not written to teach shareware programmers how to protect their code. Some of the techniques in such books could definitely be used to protect the executable, or create time-limited, crippled code, but it is definitely not a straightforward thing to do. You have to read the books and devise your own method which may or may not be secure.

I am basically trying to stop casual people from figuring out (using debugging tools) where my keys are, how the decryption works and what part of the EXE holds the protection related code... No amount of encryption will help me to achieve this. The best I can do is make life harder for people who are determined to crack my protection. For that, I need to hide things well which is why I came here. For some reason I thought a reverse engineering forum would have lots of people who come across good tricks to make it hard to figure out what an EXE does. I know you guys are not crackers per se, but you still have to figure out how code works without looking at its source code. I could be wrong. If this is not a good place and you know of a better forum, please do let me know!

Thank you.
r4g3
05-01-2004, 06:10 PM
um once again.
if you wanna use asymmetric crypto and runtime code decryption why hide public (rsa) key ? dont see any reason to do that. if i find "trash" code in disassembly and see a 1024bit rsa key i will definitely drop cracking this one. unless of course someone may try find bugs in your crypto implementations. but VERY few ppl actually do that :)
on the other hand 1 leaked key and you are yet another author of cracked shareware ;p
Woodmann
05-01-2004, 07:03 PM
Howdy,

Lets look at it from a different angle.

Who hides a public key ? We all agree that it makes no sense but,
Why not hide it ? For the lack of a better phrase, call it a "encrypted access key".

A sort of double keyed protection. Is it foolish ? Maybe.
I don't think we have looked at all the possibilities.

In order to protect a demo/share version, the author needs a way to "protect" his app from the ware--z people.
Would it be easier to block this encrypted key or add cripple crap to the prog ?
I think cripple crap is a waste of time. Sooner or later someone will wade through the bazillion lines and figure it out.

If you encrypt it, you have one more layer of protection.
If your key has been exposed, would it not be easier to just kill the bad key and issue a new one with future downloads ?

I know there are progs that use something like this. Kind of like the reg code blocking after something has been ware---zed to hell.

Just some thoughts,
Woodmann
senso
05-01-2004, 11:28 PM
um once again.
if you wanna use asymmetric crypto and runtime code decryption why hide public (rsa) key ? dont see any reason to do that. if i find "trash" code in disassembly and see a 1024bit rsa key i will definitely drop cracking this one. unless of course someone may try find bugs in your crypto implementations. but VERY few ppl actually do that :)
on the other hand 1 leaked key and you are yet another author of cracked shareware ;p

Well based on what is suggested above by r4g3, someone could go into the exe, find the public key, decrypt the encrypted code, dump it to a file, fix up the PE and run the app forever... I am not saying it is easy to do, but it is not that hard either. For this scheme to work, you need to hide the public key. Asymmetric crypto works much better for -say- securing a comm channel. When the user has access to your binary, a disassembler and some time, it is not as good.

You are all correct that if I implement things correctly, I shouldn't have to hide anything. I really like the idea of not using obscurity as security. Definitely not the right way to go.

I need to come up with a method that makes everything depend on each other so that people cannot change anything in the EXE binary, cannot bypass anything (modification of EXE should not be allowed), cannot modify the public key embedded in the app, etc.. so and so forth. I also need to somehow find a way around dumping. The app will have to do much more than just decrypting the encrypted version of itself and run it. If someone dumps that code to a file and tries to run it, it should somehow know that something is wrong (EXE integrity checking).

What I just said in this post renders my original question useless since trying to hide information is irrelevant. It will eventually be found. Thank you for helping me see that point.

Thank you all for your input and time.
r4g3
05-02-2004, 01:40 PM
"Well based on what is suggested above by r4g3, someone could go into the exe, find the public key, decrypt the encrypted code, dump it to a file, fix up the PE and run the app forever..."
yes, but again - you can do that only if you have a valid key. this is because is usuall shemes rsa is used only to prevent keygens. entered serial decrypted with rsa, sanity check and then use some part of decrypted serial for symmetric cipher which does the actual code decryption. This is becuz rsa would be too slow and more importantly decrypting using public key would indeed make whole thing useless (and yes you should worry about hiding it in that case).
It seems to me that you dont fully understand how it should be implemented.
nikolatesla20
05-03-2004, 09:24 AM
Well based on what is suggested above by r4g3, someone could go into the exe, find the public key, decrypt the encrypted code, dump it to a file, fix up the PE and run the app forever... I am not saying it is easy to do, but it is not that hard either. For this scheme to work, you need to hide the public key. Asymmetric crypto works much better for -say- securing a comm channel. When the user has access to your binary, a disassembler and some time, it is not as good.

You are all correct that if I implement things correctly, I shouldn't have to hide anything. I really like the idea of not using obscurity as security. Definitely not the right way to go.

I need to come up with a method that makes everything depend on each other so that people cannot change anything in the EXE binary, cannot bypass anything (modification of EXE should not be allowed), cannot modify the public key embedded in the app, etc.. so and so forth. I also need to somehow find a way around dumping. The app will have to do much more than just decrypting the encrypted version of itself and run it. If someone dumps that code to a file and tries to run it, it should somehow know that something is wrong (EXE integrity checking).

What I just said in this post renders my original question useless since trying to hide information is irrelevant. It will eventually be found. Thank you for helping me see that point.

Thank you all for your input and time.

LOL. You are on a quest for the holy grail of protections I'd say. If you find it you could make lot$ of money selling it to other shareware authors that's for sure.

Anyway, disregarding the whole EXE protection in itself, I thought you had said you would have been fine with the key being public but you wanted the app to be able to talk OUT to an external location securely. That's why I recommended Kerebos and SSL implementation study because you seemed to indicate you only wanted to prevent someone from using your public key and and making a fake message. Now, normally, people don't use the PUBLIC key to encrypt a message for authentication. That wouldn't make sense since it's a public key. They encrypt with the private key, and send it out to the world, and the world uses the public key to decrypt and see that the data is valid. If you want to go BOTH ways, you need a different implementation, which I believe you can find how to do with Kerebos or other. They use timed session keys combined with checksums, etc, etc, and also I think use a third party to help in the validation.

So I only was attacking your implementation because I thought this was your mission. Simply protecting an EXE- well, this has been performed over and over again by numerous shareware authors, you'll just have to try and think of everything that could be done to your app and try to prevent it. Without slowing the app to a crawl.

-nt20


FlexCrypt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > FlexCrypt
PDA

View Full Version : FlexCrypt

jackal
04-30-2004, 10:26 PM
Hi,

I'm trying to find a license key similar to that used for flexlm 5.12
it's in xxxx-xxxx-xxxx-xxxx-xx.
i read the flsxcrypt tut but this app looks for a file after entering some random nr for lic key.
also there is no .z files just a decrypt.dll

what should i do ?

do you know some other tuts ?

Thanks,
J.
Woodmann
05-01-2004, 07:25 PM
Howdy,

Have you read the works by Nolan Blender ?
They can be found on the original site.

Woodmann
jackal
05-01-2004, 08:36 PM
Yes,

The Reversing Globetrotter Software's Flexcrypt
and
Pilgrim's Further FlexCrypt analysis

but still I can't get to vendorcode structure.

I looked in other app's and extracted the vendorcode's (same vendor) from there but on this one i can't get it.

J.

Howdy,

Have you read the works by Nolan Blender ?
They can be found on the original site.

Woodmann


Symbol Loader not loading from CL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Symbol Loader not loading from CL
PDA

View Full Version : Symbol Loader not loading from CL

micmic
05-01-2004, 06:47 AM
CL=command line. When I write "loader32 myapp.exe" (either from "myapp.exe" directory or from Symbol Loader directory), Symbol Loader window appears but it says "No Module Opened" and of course the program is not loaded. Now, if I use the menu from the Symbol Loader GUI, file opens without problems and breaks in at WinMain as it should.

I use Softice from DS 2.7 with nmtranspatch applied. The above problem is very annoying because it destroys my one-click debugging of my own apps.

So, why doesn't SL work from command line ?

Thanks :cool:
naides
05-01-2004, 07:13 AM
CL=command line. When I write "loader32 myapp.exe" (either from "myapp.exe" directory or from Symbol Loader directory), Symbol Loader window appears but it says "No Module Opened" and of course the program is not loaded. Now, if I use the menu from the Symbol Loader GUI, file opens without problems and breaks in at WinMain as it should.

I use Softice from DS 2.7 with nmtranspatch applied. The above problem is very annoying because it destroys my one-click debugging of my own apps.

So, why doesn't SL work from command line ?

Thanks :cool:

Using Symbol Loader From a DOS Prompt
Symbol Loader (LOADER32.EXE) supports a command-line interface that lets you use many of its features from a DOS prompt without viewing Symbol Loader's graphical interface. Thus, you can automate many of the most common tasks it performs.

Before you use LOADER32.EXE from a DOS prompt, use Symbol Loader's graphical interface to set the default search paths and to specify translation and debugging settings for each module you plan to load. Symbol Loader saves these settings for each file and uses them when you use Loader32 to load or translate files from a DOS prompt.

To run LOADER32.EXE, either set your directory to the directory that contains LOADER32.EXE or specify the SoftICE directory in your search path.

Command Syntax
LOADER32 [[option(s)] filename]

Where options are:

Sounds cumbersome to me. Does not expedite things unless you device a way to do this "on the fly"
micmic
05-02-2004, 09:38 AM
Before you use LOADER32.EXE from a DOS prompt, use Symbol Loader's graphical interface to set the default search paths and to specify translation and debugging settings for each module you plan to load. Symbol Loader saves these settings for each file and uses them when you use Loader32 to load or translate files from a DOS prompt.

To run LOADER32.EXE, either set your directory to the directory that contains LOADER32.EXE or specify the SoftICE directory in your search path.

Command Syntax
LOADER32 [[option(s)] filename]

I've tried all these to no avail. Yes, both my app dir and SL directory where in the path and I specified directories and everything in SL, but still nothing.

I finally copied the Symbol Loader from SI 4.05 over the new one and it works again like a charm. Go figure...


Hasp 3 dos exe envelope
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hasp 3 dos exe envelope
PDA

View Full Version : Hasp 3 dos exe envelope

sadistcef
05-01-2004, 11:39 AM
i have a dos exe file which was protected with hasp 3 envelope.
i am tracing the file when i come on a call, the codes are changing and i can't find these new codes with hiew.so i can reverse with softice but i can't make a patch. how can i change these codes. can somebody help me please!!!!!!!!!!!!!!
CrackZ
05-01-2004, 01:39 PM
Hiya,

1. Does your target file have the string HASPDOSDRV inside?.

2. I've not seen more than about 5 DOS protected envelopes, actually the last one I really remember was CASMate (16-bit win, but the DOS ones are similar I'm sure); assuming it is the usual form of one jump to HASP entry point, this can be patched redirected trivially by studying the unpacking code and modifying the decryption bytes, read about CASMate on the web.

Send me the target if you want, and I'll have a look, the DOS HASP interface is vulnerable to something like bpx prestochangoselector if I remember rightly ;-).

Regards

CrackZ.


ascend the code after a [ebp+08]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ascend the code after a [ebp+08]
PDA

View Full Version : ascend the code after a [ebp+08]

atlas
05-01-2004, 02:36 PM
lol
I need explications on instructions like [ebp+...]
Example

017F:004F3CC7 8B45DC MOV EAX,[EBP-24]
017F:004F3CCA 83C410 ADD ESP,10
017F:004F3CCD 85C0 TEST EAX,EAX
017F:004F3CCF 7505 JNZ 004F3CD6

017F:004F3CD6 8B4D14 MOV ECX,[EBP+14]
017F:004F3CD9 8B55EC MOV EDX,[EBP-14]
017F:004F3CDC 51 PUSH ECX
017F:004F3CDD 8B4D0C MOV ECX,[EBP+0C]
017F:004F3CE0 50 PUSH EAX
017F:004F3CE1 8B4510 MOV EAX,[EBP+1
017F:004F3CE4 52 PUSH EDX
017F:004F3CE5 50 PUSH EAX
017F:004F3CE6 51 PUSH ECX
017F:004F3CE7 E864FDFFFF CALL 004F3A50

017F:004F3A50 55 PUSH EBP
017F:004F3A51 8BEC MOV EBP,ESP
017F:004F3A53 6AFF PUSH FF
017F:004F3A55 68009B5400 PUSH 00549B00
017F:004F3A5A 64A100000000 MOV EAX,FS:[0000000
017F:004F3A60 50 PUSH EAX
017F:004F3A61 64892500000000 MOV FS:[0000000 ,ESP
017F:004F3A68 51 PUSH ECX
017F:004F3A69 53 PUSH EBX
017F:004F3A6A 8B5D08 MOV EBX,[EBP+08];
; ebp+08;;gives a interressant value to EBX
;; and now ?How to ascend the code ?Wich supplies a value to ebp+08 ?
017F:004F3A6D 56 PUSH ESI
017F:004F3A6E 57 PUSH EDI

017F:004F3A6F 8D43FF LEA EAX,[EBX-01];
; ebx gives a interressant value to EAX
017F:004F3A72 33D2 XOR EDX,EDX
017F:004F3A74 33F6 XOR ESI,ESI
017F:004F3A76 83F810 CMP EAX,10
017F:004F3A79 8965F0 MOV [EBP-1 ,ESP
017F:004F3A7C 8955FC MOV [EBP-04],EDX
017F:004F3A7F BFF0F0F0F0 MOV EDI,F0F0F0F0
017F:004F3A84 B 0 JA 04F3B79
;;good boy - bad boy
bart
05-02-2004, 12:54 PM
those are local variables or params passed to the function

some_shitty_proc proc lpParam1:dword

local local_variable:dword

mov eax,local_variable

...
LOUZEW
05-02-2004, 02:27 PM
lol
I need explications on instructions like [ebp+...]
Example

017F:004F3A68 51 PUSH ECX
017F:004F3A69 53 PUSH EBX
017F:004F3A6A 8B5D08 MOV EBX,[EBP+08];
; ebp+08;;gives a interressant value to EBX
;; and now ?How to ascend the code ?Wich supplies a value to ebp+08 ?
017F:004F3A6D 56 PUSH ESI
017F:004F3A6E 57 PUSH EDI
[/code]

Under Softice :

"D EBP+8" command give you the right address where is stored this param.
Then you can put a conditional breakpoint on memory access to see who is writing in !
naides
05-02-2004, 03:15 PM
lol
I need explications on instructions like [ebp+...]
Example

017F:004F3CC7 8B45DC MOV EAX,[EBP-24]
017F:004F3CCA 83C410 ADD ESP,10
017F:004F3CCD 85C0 TEST EAX,EAX
017F:004F3CCF 7505 JNZ 004F3CD6

017F:004F3CD6 8B4D14 MOV ECX,[EBP+14]
017F:004F3CD9 8B55EC MOV EDX,[EBP-14]
017F:004F3CDC 51 PUSH ECX
017F:004F3CDD 8B4D0C MOV ECX,[EBP+0C]
017F:004F3CE0 50 PUSH EAX
017F:004F3CE1 8B4510 MOV EAX,[EBP+1
017F:004F3CE4 52 PUSH EDX
017F:004F3CE5 50 PUSH EAX
017F:004F3CE6 51 PUSH ECX
017F:004F3CE7 E864FDFFFF CALL 004F3A50

017F:004F3A50 55 PUSH EBP
017F:004F3A51 8BEC MOV EBP,ESP
017F:004F3A53 6AFF PUSH FF
017F:004F3A55 68009B5400 PUSH 00549B00
017F:004F3A5A 64A100000000 MOV EAX,FS:[0000000
017F:004F3A60 50 PUSH EAX
017F:004F3A61 64892500000000 MOV FS:[0000000 ,ESP
017F:004F3A68 51 PUSH ECX
017F:004F3A69 53 PUSH EBX
017F:004F3A6A 8B5D08 MOV EBX,[EBP+08];
; ebp+08;;gives a interressant value to EBX
;; and now ?How to ascend the code ?Wich supplies a value to ebp+08 ?
017F:004F3A6D 56 PUSH ESI
017F:004F3A6E 57 PUSH EDI

017F:004F3A6F 8D43FF LEA EAX,[EBX-01];
; ebx gives a interressant value to EAX
017F:004F3A72 33D2 XOR EDX,EDX
017F:004F3A74 33F6 XOR ESI,ESI
017F:004F3A76 83F810 CMP EAX,10
017F:004F3A79 8965F0 MOV [EBP-1 ,ESP
017F:004F3A7C 8955FC MOV [EBP-04],EDX
017F:004F3A7F BFF0F0F0F0 MOV EDI,F0F0F0F0
017F:004F3A84 B 0 JA 04F3B79
;;good boy - bad boy

It is in red. Learn the Stack dynamics in a introduction to assembly book or site
atlas
05-02-2004, 04:14 PM
I can't put bpm because I want to ascend the code .

Revenge Naides has understand what I trie to do .What he is redunderlining is right .
I am amazed , he did it in deadlisting , I have found the same result in live approach with poor raisonings and It was very long .
I will add that he has not put in red this line in wich I have found a interresting byte

017F:004F3A51 8BEC MOV EBP,ESP;

Would be able to put a name of document where I am sure to find your method ?
I have read any tricks on the stack push ,pop (increase or contrary of 4 bytes) , call , ret .I think I understand the role of esp but EBP nothing .
And this knowledge don't permit to ascend the code .
Most of explications shows the opposite direction the from the top to the bottom and not from the bottom to the top .
naides
05-02-2004, 06:05 PM
I can't put bpm because I want to ascend the code .

Revenge Naides has understand what I trie to do .What he is redunderlining is right .
I am amazed , he did it in deadlisting , I have found the same result in live approach with poor raisonings and It was very long .
I will add that he has not put in red this line in wich I have found a interresting byte

017F:004F3A51 8BEC MOV EBP,ESP;

Would be able to put a name of document where I am sure to find your method ?
I have read any tricks on the stack push ,pop (increase or contrary of 4 bytes) , call , ret .I think I understand the role of esp but EBP nothing .
And this knowledge don't permit to ascend the code .
Most of explications shows the opposite direction the from the top to the bottom and not from the bottom to the top .

I am in a good mood today.

The stack is an area of memory hanging from the roof so every time you push something in the stack, it grows down. ESP points to the Bottom of the stack, and everytime you push something in the stack, the value of ESP decreases by 4 (Because registers are 4 bytes long) ESP is the ADDRESS of the last thing you pushed into the stack. Clear? OK

Before calling a function, the parameters are pushed into the stack, because callee function needs to know where to find them to be able to use them.

Let us imagine that ESP was hex 0000010 and a function that takes three parameters,Func (a,b,c) is called. Each parameter is pushed
c is pushed ESP is now 00000010 - 4 = C
b is Pushed ESP is now 0000000C - 4 = 8
a is Pushed ESP is now 00000008 - 4 = 4

(note the reverse order)
Then when call instruction is executed the return address is automatically pushed in the stack,
So now ESP is 4-4 = 0

Now you are at first instruction of the Callee function and the Parameters are at known locations: a at [ESP + 4] b at [ESP + 8] and c at [ESP + C]

but using ESP as reference to track your parameters is a pain, because it keeps changing every time you push or pop something to the stack.
Enter EBP, which you use to "freeze" the position of the stack when the call got started. That is why MOST call code start with

push EBP ;so the caller code frame of variables can be restored at the end of the call
mov EBP, ESP ; Now all the addresses ca be referenced to EBP instead of the slizzy ESP

But ESP got decreased by 4 when we pushed EBP so now a, the last pushed parameter is located at [EBP+8] b at [EBP+C] c at [EBP+10], the return address at [EBP + 4]the previous value of EBP is at [EBP].
Not infequently, the next isntruction of a typical call will substract a number from ESP,
for instance

sub ESP, 0C

which would open a space for 3 four byte (dword) local variables , which are going to be at addresses BELOW the EBP

The passed parameters and outside variables are found as Postive offsets from EBP like [EBP+0C] or [EBP + 10] while local variables, if there are any, are referred by negative offsets of EBP [EBP - 4], [EBP - 8].

At the end of the call, before the ret, EBP is poped [The frame is restored] so the caller code local variables an their relative positions remain in the same places relative to the original value of EBP. And that is why it is so easy to fuck up code flow when you mess with pushes pops and returns if you dont READ THE FUCKING MANUAL AND LEARN THE STACK DYNAMICS
naides
05-02-2004, 07:00 PM
By the way, IDA will be much more helpful to "ascend" in the code:

You can rename [EBP + 8] to "My Variable", or "my shit" and IDA will track it up the call tree up to a certain point.
atlas
05-03-2004, 01:54 PM
Thanks Sir


getversion system crash
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > getversion system crash
PDA

View Full Version : getversion system crash

arieri
05-01-2004, 02:46 PM
hi

I have a problem when setting a break on getversion or getversionexa with softice ds3,1
on winxp sp1
If I break on a program with these apis and after finishing debugging and clears the
breakpoints and leave softice my system crash when I execute any program on my machine so
I must reboot the maschine to act normal. I can set any other breakpoints without problems
such as getmodulehandlea, getprocaddress, getlocaltime etc.... but not getversion or
getversionexa strange
does anyone have an idea what could be the problem?

My system is a P4 3,00 ghz, I did not have this problem on my old computer P3 500mhz ds 2,7

regards
arieri
naides
05-01-2004, 04:16 PM
hi

I have a problem when setting a break on getversion or getversionexa with softice ds3,1
on winxp sp1
If I break on a program with these apis and after finishing debugging and clears the
breakpoints and leave softice my system crash when I execute any program on my machine so
I must reboot the maschine to act normal. I can set any other breakpoints without problems
such as getmodulehandlea, getprocaddress, getlocaltime etc.... but not getversion or
getversionexa strange
does anyone have an idea what could be the problem?

My system is a P4 3,00 ghz, I did not have this problem on my old computer P3 500mhz ds 2,7

regards
arieri

Diregard, I did not read the question carefully.
arieri
05-01-2004, 04:55 PM
thanks naides, that seems to do the trick


How to "reverse" this algo???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to "reverse" this algo???
PDA

View Full Version : How to "reverse" this algo???

yaa
05-01-2004, 07:48 PM
Hello,

I'd need some help in reversing this algo. But apart this specific piece of code I'd like to understand how to approach similar mathematical problems.

Here is the algorithm:

// num1 gets loaded with the decimal equivalent of a 16 hex digits string
ulong num1;

uint num2 = ((uint) (num1 >> 48));

if (num2 != 51712)
{
return false;
}

uint num3 = (((uint) (num1 >> 16)) & -1);

if ((num3 % 10007) != 0)
{
return false;
}

uint num4 = ((uint) (num1 & ((long) 65535)));
uint num5 = ((num2 + (num3 >> 16)) + (num3 & 65535));
num5 = ((num5 * 7) & 65535);

if (num4 != num5)
{
return false;
}

What I need to obtain is obviously the value of num1.
How would you approach such a problem??? I have written a brute force app but solving it this way does not satisfy me.

yaa
disavowed
05-01-2004, 08:31 PM
uint num2 = ((uint) (num1 >> 48));

if (num2 != 51712)
{
return false;
}
This implies that num1 = 0xCA00???? (?'s mean unknowns)

uint num3 = (((uint) (num1 >> 16)) & -1);

if ((num3 % 10007) != 0)
{
return false;
}
this is impossible... num3 = 0x0000CA00, and num3 % 10007 = 1677. it can never equal 0.

can someone else verify that i'm not doing my math wrong?
r4g3
05-01-2004, 08:43 PM
which lame shareware app uses this as serial algo ? ;) ye but its 4.30am and appearently ive got nothing better to do all the job for smbd else ;)
btw since when ulong is defined as long long ?
oki anywayz this is very simplistic. "0123456789ABCDEF"
num2 is the highest 16bits == 4 hex digits of input and those are 5171d == 0xCA00, so "0123" -> "CA00"
num3 is the "456789AB" part. num3 = ((rand()*rand())%429197)*10007; here rand()*rand() for bigger number ;)
num5 is generaly "0123" + "4567" + "89AB", *7 and take lowest 4 nibbles/nipples of it.
num4 = num5.
sooo finaly.

unsigned long bla = ((rand()*rand()*rand()*rand())%429197)*10007;
unsigned long chk = ((0xCA00 + (bla >> 16) + bla & 0xFFFF)*7) & 0xFFFF;
printf ( "CA00%08X%04X", bla, chk );

any mistakes ? ;)
r4g3
05-01-2004, 08:44 PM
// num1 gets loaded with the decimal equivalent of a 16 hex digits string ... and those shifts > 32

so yep disa, he surely doesnt know how to write "unsigned __int64" ;)
oki gotta go sleep, cuz my keyboard aint no pillow ...
doug
05-01-2004, 08:59 PM
I think r4g3 is correct.

yaa, this algorithm is short so there's not problem writing a set of equations ('constraints') in terms of the bits of num1 (64bits number)

num2=num1>>48
num2=0xCA00
num3=(num1)>>16
num3%10007 != 0 ; this is the same as writing num3= k*10007, (k is anything u want.)
num4=num1& 0xFFFF ; bits 0-15 of num1.
....

so lines 1 says: num2 is the high 16 bits of num1, line 2 completes by giving you that value: 0xCA00.
so you have Bits[48-63] = 0xCA00

num4 is bits 0-15 of num1.. this is compared to the final value of num5.

write out final equation:
num4 = num5
Bits[0-15] = WORD[ 0xCA00 + Bits[32-47] + Bits[16-31] ] *7
==>
Bits[0-15] = WORD[ 0xCA00 + High16[k*10007] + Low16[k*10007] ] *7

1. you choose k
2. you find Bits[0-15]
3. you concatenate the expression: Bits[48-63] Bits[47-32] Bits[16-31] Bits [0-15]

if you know how to solve simple systems of equations.. this algorithm shouldn't be a problem for you.

edit: when I write WORD[...] it means you take bits 0-15 and chop off the rest. Same for Low16. High16 meant to take bits 16-31 of a 32bits number.
disavowed
05-02-2004, 12:45 PM
so yep disa, he surely doesnt know how to write "unsigned __int64" ;)ahh.. i was wondering about that 48-bit shift :)


REQ: binary calculator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > REQ: binary calculator
PDA

View Full Version : REQ: binary calculator

yaa
05-02-2004, 07:00 AM
Hello,

I was looking for a calculator that can handle up to 8 byte numbers in hex, decimal and binary format with all usual and bitwise operations (and, or, xor, bit shifts, etc).
Anyone know of a good one???
Thx.

yaa
r4g3
05-02-2004, 07:23 AM
hah how about you try typing "%systemroot%\system32\calc.exe"
gook
05-02-2004, 07:54 AM
hah how about you try typing "%systemroot%\system32\calc.exe"

don't forget to put it into scientific mode
yaa
05-02-2004, 08:38 AM
Nothing better around??? It misses the rsh function.

yaa
Js
05-02-2004, 08:39 AM
doesn't have absolutely everything you want but its handy.

hxxp://wxw.zap.org.au/software/basecalc/
hope it helps
ZaiRoN
05-02-2004, 09:15 AM
It misses the rsh function.Hmm, no. Use 'inv' followed by 'lsh'.
Another nice calculator was written by Ewayne (source code included): http://spiff.tripnet.se/~iczelion/files/EWCalc.zip
klier
05-02-2004, 09:50 AM
online:
hxxp://www.motionnet.com/calculator/
offline:
save as...
Ricardo Narvaja
05-03-2004, 03:33 AM
I use the excalibur calculator is free and is very ( the most?) complete i see.

hxxp://www.freedownloadscenter.com/Business/Standard_Calculators/Excalibur_32_bit.html

if not work the link type in google excalibur calculator.

There are buttons to change the functions used form matematical, financial,trigonometrics and have all binary funcion and have ROR,x by example
Ricardo
JMI
05-03-2004, 04:18 AM
Be advised that Ricardo's link seems to resolve to the ex32_105.zip file which is not actually in the ftp server to which the link resolves. However there are several good links to the ex32_106.zip version, which is actually from 2001 and a later version. Several locations are referenced an any reasonably good search engine.

Regards,
Ricardo Narvaja
05-03-2004, 04:32 AM
hxxp://www.hpcalc.org/hp48/pc/emulators/ex32_106.zip

thanks this is a good link for excalibur 1.06

Ricardo
JMI
05-03-2004, 04:33 AM
Small repayment for all of your good work. :D

Regards,


Need Help with "access violation...."
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need Help with "access violation...."
PDA

View Full Version : Need Help with "access violation...."

zambuka42
05-02-2004, 05:47 PM
Hi, there is a program that I've cracked.. and it worked great. However, there is one line of code which is giving an "Exception: access violation (0xc0000005), Address: 0x004374a6" error. This is not a BIG problem, because i can jump over this address. However, by jumping over this address, I cause a certain line of text in the program to dissappear. Like I said, not a huge problem, but I'd love to understand why this is happening.

This address is a line in a small loop.. i'll paste that here.. Any help is appreciated. Even if its "can't help.. but here's some info for your brain..."

*ps : This file cannot be loaded into a debugger... Don't ask why.. long explanation... but take my word please :)

:0043727B E89C050000 call 0043781C
:00437280 66F745FC1008 test [ebp-04], 0810
:00437286 59 pop ecx
:00437287 8BC8 mov ecx, eax
:00437289 894DF8 mov dword ptr [ebp-08], ecx
:0043728C 0F84FE010000 je 00437490

:00437490 85C9 test ecx, ecx
:00437492 7509 jne 0043749D

:0043749D 8BC1 mov eax, ecx

:0043749F 8BD6 mov edx, esi
:004374A1 4E dec esi
:004374A2 85D2 test edx, edx
:004374A4 7408 je 004374AE
:004374A6 803800 cmp byte ptr [eax], 00
:004374A9 7403 je 004374AE
:004374AB 40 inc eax
:004374AC EBF1 jmp 0043749f
Alorent
05-03-2004, 01:41 AM
Hi,

Well, it looks that EAX points to a wrong (or not mapped) address. Why don't you check the value of EAX in that address in the original program and then check it in your cracked version?

After that, just "trace back" to see what makes different your cracked version from the original version.

If you cannot load it under a debugger...I think that most of us are interested in hearing why not. We are here to learn ;)
zambuka42
05-03-2004, 10:00 AM
If you cannot load it under a debugger...I think that most of us are interested in hearing why not. We are here to learn ;)

Rightly so.. here goes.. Hopefully there is something obvious that me (being somewhat of a newbie at cracking) has looked over..

This file is an nt/2k service. It can be started from the command line by typing: "app.exe -start". and stopped by "app.exe -stop". I've loaded it into ollydebug, w32dasm, & turbo debug. Every time I start it in any of these, everything loads to the entry point fine.. but when I set my breakpoints and try to run it.. the debuggers think the file has terminated... even though it remains running in memory. Maybe there is a way to do it in softice.. but i'm not a pro at that yet either. I can't single-step thru the debugger from the entry point to find out WHY it thinks the program is terminated because frankly.. there's just TOO much damn code to go through before that point.

Anyway.. maybe something good will come from this. I appreciate it all :) -b
Alorent
05-03-2004, 11:00 AM
I see...

Well, in case that you cannot load it in SoftICE or your SICE breakpoints does't pop up (the common XP problem with breakpoints...) you could change the instruction 0x004374a6 with a INT 3 (0cch) in your HEXeditor. Make BPINT3 in Sice and start the service.

When SICE pops up, you change the INT 3 for the original instruction and watch EAX....The same procedure in your cracked version and compare.

Well, this is just the procedure that I will do in your current stage ;)

Good luck.
naides
05-03-2004, 11:04 AM
Rightly so.. here goes.. Hopefully there is something obvious that me (being somewhat of a newbie at cracking) has looked over..

This file is an nt/2k service. It can be started from the command line by typing: "app.exe -start". and stopped by "app.exe -stop". I've loaded it into ollydebug, w32dasm, & turbo debug. Every time I start it in any of these, everything loads to the entry point fine.. but when I set my breakpoints and try to run it.. the debuggers think the file has terminated... even though it remains running in memory. Maybe there is a way to do it in softice.. but i'm not a pro at that yet either. I can't single-step thru the debugger from the entry point to find out WHY it thinks the program is terminated because frankly.. there's just TOO much damn code to go through before that point.

Anyway.. maybe something good will come from this. I appreciate it all :) -b

If it is a service, it runs in Ring 0 and those debuggers will not be able to follow it there. SoftIce should. Try to load it using the Sice symbol loader application which should work, except if the service does not have a winmain call at entrypoint.

Otherwise you can find the service process runing in memory using the Proc command in Sice, change the address context using the :addr The_process_name_or_process_id command and set your breakpoints there.
and debug. . .
zambuka42
05-03-2004, 11:05 AM
I see...

Well, in case that you cannot load it in SoftICE or your SICE breakpoints does't pop up (the common XP problem with breakpoints...) you could change the instruction 0x004374a6 with a INT 3 (0cch) in your HEXeditor. Make BPINT3 in Sice and start the service.

When SICE pops up, you change the INT 3 for the original instruction and watch EAX....The same procedure in your cracked version and compare.

Well, this is just the procedure that I will do in your current stage ;)

Good luck.

First let me express again my appreciation at your taking the time to help me with this. Cracking this program is not nearly as important to me as knowledge.

Ok. that said. I will change that instruction to int3. Now.. how do I load it into softice? I thought softice just simply runs and you can't have it watch one specific file? Or are you saying, that by "bp int3", softice will break when ANY program has an INT3 and hopefully it will only be my program that does that? Second, (as you can tell i haven't done much with sice).. how do I change an instruction WHILE its running and loaded with sice (i know, I know.. read the docs... I will.. but if its a quick instruction you could give me, then please forgive my laziness :) Anyway.. thanks again
zambuka42
05-03-2004, 11:13 AM
change the address context using the :addr The_process_name_or_process_id command and set your breakpoints there.
and debug. . .

Ring 0 huh? Good to know.. I'll have to learn a bit more about these rings..

Onwards.. apparently there is no winmain because the symbol loader isn't happy with the file so I'll try your other way...

I'm afraid i'm unfamiliar with addr .. (truthfully I'm really only familiar with breaking on api calls... and then using that info to help me with a dissassembler). I'll have to look up what addr is and how i will be able to use it. thanks for the info
naides
05-03-2004, 04:18 PM
Ring 0 huh? Good to know.. I'll have to learn a bit more about these rings..

Onwards.. apparently there is no winmain because the symbol loader isn't happy with the file so I'll try your other way...

I'm afraid i'm unfamiliar with addr .. (truthfully I'm really only familiar with breaking on api calls... and then using that info to help me with a dissassembler). I'll have to look up what addr is and how i will be able to use it. thanks for the info

This is what I would do:

type in Sice:

proc

you will see a list of processes, and your service should show up there, with a process ID (three hex digits) and a process name, which may or may not be the name of the file.

if you type in Sice MAP32 process_name

you will see the addresses in which your process is loaded

if you type

ADDR process_name

now you are sitting in your service memory space Look at the lower right corner of Sice and you will see your process name there

once there you can search the BYTES of the routine you want to trace
beit
0043727B E89C050000 call 0043781C
:00437280 66F745FC1008 test [ebp-04], 0810
:00437286 59 pop ecx
:00437287 8BC8 mov ecx, eax
:00437289 894DF8 mov dword ptr [ebp-08], ecx
:0043728C 0F84FE010000 je 00437490

:00437490 85C9 test ecx, ecx
:00437492 7509 jne 0043749D

:0043749D 8BC1 mov eax, ecx

so

S 0 L ffffffff E8 C0 50 00 00 66 F7 45 FC 10 08

the DATA window should show the code at some address in hex form

you can then put it on the code window by typing

u 1B:xxxxxxxx (whatever address the code seems to be) and now you should see it in Sice a disassemble of your code similar to above but live and direct!!!

place a BPX where you want it and provoke the code to run thorugh your routine. Sice should brake

Debug and enjoy.
zambuka42
05-03-2004, 05:13 PM
Debug and enjoy.

good god man.. I want to reach through this cable and give you a big smacker on the lips! I've really been enjoying this "using softice" pdf.. NOT. I was contented enough with your previous answer, and I was now trying to find time to do the research i needed to learn more about softice (which I still need to do), but you've gone above and beyond and I really appreciate it. For the first time in years I am excited about learning this new depth to software. I've been capable of doing almost anything I've ever wanted to in the cyber world, and this avenue is just another tool(knowledge) that trumps most of the ones I've used before. Thanks alot for your help! -b
JMI
05-03-2004, 06:06 PM
Hum?? Going to have to check the rules about "reaching through the cable and giving..big smack on the lips." Might not be approved for all viewers. :D

But we are happy you're happy. Just a thought. You might actually want to check some sections of the manual for the operation of SICE. :o I know. It is a shocking concept to actually READ the manual, but give it a try. You might actually like it. :)

Regards,
zambuka42
05-03-2004, 06:09 PM
It is a shocking concept to actually READ the manual, but give it a try. You might actually like it. :)

Regards,

absolutely, i didn't want to give the impression I would use your kindness as a replacement for my laziness.. i'll have sice down pat in a few days. thanks again. laterz -b
naides
05-04-2004, 11:57 AM
good god man.. I want to reach through this cable and give you a big smacker on the lips! -b

Thank you for the offer, Handsome, but I am old enough to be your mother.
:p
JMI
05-04-2004, 12:22 PM
I seriously doubt that there is anyone using these forums who is old enough to be one of my parents. :D But it would be interesting to talk to an octogenarian cracker. :p

Regards,
zambuka42
05-04-2004, 06:13 PM
Thank you for the offer, Handsome, but I am old enough to be your mother.
:p

oh well.. that doesn't bother me :) .. anyway, thanks again... i've starting to navigate sice MUCH better than before.. and even though I'm having to go through TONS of code, this is helping. This program is CONSTANTLY doing something. It never rests, which makes it much harder for me to debug. anyway, thanks. toodles. And don't get discouraged, feel free to take me up on my offer! :) -b
dELTA
05-05-2004, 02:48 PM
If it is a service, it runs in Ring 0 and those debuggers will not be able to follow it there.
Actually, all services don't run in ring 0 at all, only the driver kind of services do this.

There are some common problems with debugging services like this though:

1.
The services most likely execute in the LocalSystem context, which makes it prohibited for normal user applications to directly attach to them with a ring 3 debugger, at least without tinkering with the process privileges.

2.
When the service is started as described above, by directly calling the executable on the command-line with a special argument, what the application will most likely do is to register itself as a service in the operating system, and then start this service through the normal service control APIs as a second process, and then exit. This would be consistent with the description above that the debugger "thinks" that the application terminated. It actually most likely did, but started a second service process instance of itself instead.
zambuka42
05-05-2004, 03:54 PM
what the application will most likely do is to register itself as a service in the operating system, and then start this service through the normal service control APIs as a second process, and then exit. .

Yeah, this had occured to me.. I was hoping it wasn't, cause i don't know how to have a debugger "jump" over rather than attaching to a currently running process. anyway, I'm making some headways... thanks. -b
dELTA
05-05-2004, 05:53 PM
In the worst case, you can always patch in a spinning jump at the executable entrypoint in situations like that, and then take your good time to attach the debugger to the process, then restore it and continue.


Redirect IAT advice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Redirect IAT advice
PDA

View Full Version : Redirect IAT advice

Pepone
05-02-2004, 07:14 PM
I play now with some ARM 3+. I have all done, except redirected APIS. Old trick for breaking at R/W IAT now doesn't work, or if I it works on some other target, then get GetProcAddress won't take me to magical jump, which redirect IAT. So can someone give me some advice pls, how to get/read clean IAT in this case ? I searched forum before I start this thread, but I didn't find satisfactory answer.


How to bpx on class method?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to bpx on class method?
PDA

View Full Version : How to bpx on class method?

Jacques
05-02-2004, 09:26 PM
Hi all,

I have been using SoftIce for a few months now, but there is one thing that I can't figure out and haven't found any mention of in the documentation or any tutorial. Perhaps I missed it and this is a stupid question, but here goes anyways:

How do you set a break point on a class method?

Let say I wanted to set a breakpoint on CClass::MyMethod()... how do I go about doing this?

(I am certain that the symbols are loaded, and I can see "CClass::MyMethod" in the .nms file, so it's not that.)

Thanks,
J


Deleting a button (C++)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Deleting a button (C++)
PDA

View Full Version : Deleting a button (C++)

EJ12N
05-02-2004, 09:34 PM
How can i accomplish this ??....

I would really appreciate if the answer coming using olly :)

if not is ok...

Thank you
klier
05-03-2004, 07:17 AM
not sure if this is what you want but if you only want to remove a button from a dialog:
use resource hacker(or similar) and delete the button(only possible if button is made in resources).

if button is made in code,load in olly,locate code by search for text(from button) in dump window and put breakpoint memory on access.
fill the code with NOPs.

you can also do the first manually,but this is easier.

Regards,
disavowed
05-03-2004, 08:34 AM
in case klier's ideas don't work, you can also inject code to do ShowWindow(button handle, 0). but i would only do that as a last resort
EJ12N
05-05-2004, 07:30 PM
It works thanks


Identifying Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Identifying Protection
PDA

View Full Version : Identifying Protection

xollox
05-03-2004, 12:23 AM
I've been lurking in this forum for a while, and I've come across a problem that I need some help with.

I have a program that I'd like to some "work" with, but I am unable to identify what protection is used. It's a publically available beta demo of a game that I'd like to write some hacks for.

PE-Scan reports "no recognised packer/encryptor found" and PEiD reports "Nothing found *"

When I try to open it in OllyDbg, it says that it's packed or encrypted and when loaded it shows code that is clearly packed/or encrypted.

Since I'm a newbie in the field, I don't know where to go from here. Any help would be appreciated.
nikolatesla20
05-03-2004, 09:27 AM
A good start is to load the program into LordPE or PEditor and take a look at the sections. How many are there and what are there names, etc. This can usually strongly point towards the protection used.

If you can post this info without giving away the name of the target (DONT TELL US THE TARGET) then do so and maybe one of us might recognize it.

-nt20
dELTA
05-03-2004, 10:09 AM
Also, I guess the authors of programs like PEiD are always interested in samples of unknown packers, and if you're lucky you might be able to get the information you want from them at the same time. Try to find out as much as possible yourself first though, to make it easier for them.
xollox
05-03-2004, 09:57 PM
Thanks for the tips, guys.

Here is what LordPE told me:
.CODE
.rsrc
.idata
.ext
XPROT
.vmtext
Harding
05-04-2004, 05:06 AM
Thanks for the tips, guys.

Here is what LordPE told me:
.CODE
.rsrc
.idata
.ext
XPROT
.vmtext

I might be wrong here , but I think it's Xprotector (Extreme protector.)

/Harding
Alorent
05-04-2004, 06:27 AM
It looks extreme protector...but maybe it's not. I thought that extreme put all the sections in one or 2, but not so many as I can see in your program. Maybe the section names have been manipulated manually.

As Delta proposed, PEiD could solve your problem.
esther
05-04-2004, 11:44 AM
Get the latest PeID out there ;)
UrgeOverKill
05-04-2004, 07:54 PM
I do believe that the latest ver out there is 0.92....
xollox
05-07-2004, 03:28 AM
I do believe that the latest ver out there is 0.92....

I double checked that I had the latest version (released may 4) and copied all the userdb info out of the forums that i could find and still nothing.
dev_zero
05-07-2004, 05:54 AM
What about file analyzer XL....
SiNTAX
05-12-2004, 07:23 AM
.... a publically available beta demo of a game that I'd like to write some hacks for.

I hope hacks != cheats.
dELTA
05-12-2004, 04:05 PM
Why? As long as it isn't a networked multiplayer game I really can't see any harm in it?
SysCall
05-12-2004, 04:49 PM
Are you xollox from MPC forums (bf1942/bfv)?

If so ... nice to meet ya here ... i used to visit the boards/forums under different aliases :p

I hope hacks != cheats.

Hehe .. of course cheats ;)
Lots of multiplayer stuff for quite some time now ... leaving Punkbuster in dust (it aint a challenge in its current state, really) ...

Lots of ppl have learned how to build their own private hacks now ... my personal estimate by visiting EA (pb enabled) servers that at least 5-10% cheat .. but well ;)
xollox
05-13-2004, 02:51 AM
Are you xollox from MPC forums (bf1942/bfv)?
The same (:

I hope hacks != cheats.
To be honest, it does equal cheats. Over the past few months I've become less and less interested in actually playing games and more interested in reversing them, seeing how they work, making modifications, etc. For a while I probably spent 20+ hours/week reversing and 3 or 4 hours every other week playing. My online play time is severly limited by my bandwidth (56k) for the time being. Luckily I have friends nearby with broadband...

What about file analyzer XL....
I tried both file inspector XL and file analyzer. (I googled file analyzer XL and couldn't find anything by that name...) Both report the packer as "ASPack 1.02b or 1.08.03" Is this a potential misreport or do these older anaylzers pick up something that doesn't PEiD doesn't?

Also, I guess the authors of programs like PEiD are always interested in samples of unknown packers, and if you're lucky you might be able to get the information you want from them at the same time. Try to find out as much as possible yourself first though, to make it easier for them.
Should I try to contact the authors and let them know about the program? I looked over the PEiD website and can't find any sort of reporting method...
SiNTAX
05-13-2004, 03:48 AM
To be honest, it does equal cheats. Over the past few months I've become less and less interested in actually playing games and more interested in reversing them, seeing how they work, making modifications, etc. For a while I probably spent 20+ hours/week reversing and 3 or 4 hours every other week playing. My online play time is severly limited by my bandwidth (56k) for the time being. Luckily I have friends nearby with broadband...

Tssk.. that puts you in my bad book I'm afraid (not that anybody cares about that :) ).. but some people still have ethics.. and spoiling other peoples fun/day isn't something I enjoy...
dELTA
05-13-2004, 11:41 AM
Should I try to contact the authors and let them know about the program? I looked over the PEiD website and can't find any sort of reporting method...
Yeah, I'm sure they'll appreciate it, just ask in their forum (http://peidforums.has.it), maybe giving them a link to the file in question too.
doug
05-13-2004, 05:15 PM
It's just a lame in-house packer that tries to mimic xprotector by adding an 'XPROT' section.
xollox
05-14-2004, 12:58 AM
It's just a lame in-house packer that tries to mimic xprotector by adding an 'XPROT' section.
Do you know what program I am talking about or are you just guessing?
doug
05-14-2004, 07:03 PM
I'm not guessing
xollox
05-15-2004, 02:13 AM
I'm not guessing
Do you have any hints as to how to go about unpacking the program? Generic unpackers didn't seem to do the trick (although I'm not really experienced with unpacking at all, so I could be using them incorrectly)
doug
05-15-2004, 09:03 AM
Do you have any hints as to how to go about unpacking the program? Generic unpackers didn't seem to do the trick (although I'm not really experienced with unpacking at all, so I could be using them incorrectly)

Other than following manual unpacking steps, nope, sorry.

you could:
Dump it at runtime to get an idea of what your facing, and what you have to rebuild/fix.
use tools such as ImpRec to rebuild as many imports as it can. (Or do it by hand, and you'll learn much more)
post a specific question if you are _really_ stuck at some point. (How to unpack X or How to unpack X using Y isn't considered specific :D )

besides, if what you want to do is find cheats burried in the game or write a trainer; you don't need a 100% working rebuilt exe.. you just want a fairly clean/readable disassembly.
xollox
05-15-2004, 12:41 PM
Alright, I guess I have my work laid out for me. Thanks for the help and info guys, I'll report back if I have any specific questions.
Baron Gede
05-25-2004, 03:27 AM
Use a technic of Injections.... for work...
/CreateRemoteThread.../


what registers do WINAPI-CALLs depends on?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > what registers do WINAPI-CALLs depends on?
PDA

View Full Version : what registers do WINAPI-CALLs depends on?

0rp
05-03-2004, 09:07 AM
if i call an API-function like MessageBoxA, i get the return value in EAX and the stack will be cleaned by an appropriate ret instruction through the api-function.

API functions use __stdcall callingconvention, does this mean, that _always_ only EAX contains valuable informations for the caller, or are sometimes other registers important too?
nikolatesla20
05-03-2004, 09:30 AM
_stdcall means all parameters to a function are pushed on the stack and the function uses ESP / and or EBP for parameter values/referencing, and the return value is in EAX. Other registers are usually saved/restored, in other words, unaffected.

-nt20
dELTA
05-03-2004, 10:16 AM
Here's some other useful registry preservation information for win32 asm coding:

http://board.win32asmcommunity.net/showthread.php?threadid=12679
0rp
05-06-2004, 12:26 PM
thx for the hints, but i did not get it to work.
i have written some code, which acts like a stub or proxy.
i try to do this:
- hook GetProcAddress
- any GetProcAddress returns this stubcode, which calls the expected function

the problem is, that it does not work for every function and i dont know why.

and this is the stubcode:

;save initialreturnaddr in TLS
mov eax, esp
push eax
mov eax, tlsindex
push eax
call TlsSetValue

;remove initialreturnaddr and push new one
add esp, 4
push newret

jmp original ;execute originalcode

;newret:
push eax ;save returnvalue
push signature
call vtrace ;call some displaystuff
add esp, 4 ;remove params

;restore old initialreturnaddr
mov eax, tlsindex
push eax
call TlsGetValue
mov ecx, eax
pop eax ;restore returnval
jmp ecx ;jump to initialreturnaddr
nikolatesla20
05-06-2004, 02:14 PM
thx for the hints, but i did not get it to work.
i have written some code, which acts like a stub or proxy.
i try to do this:
- hook GetProcAddress
- any GetProcAddress returns this stubcode, which calls the expected function

the problem is, that it does not work for every function and i dont know why.

and this is the stubcode:

;save initialreturnaddr in TLS
mov eax, esp
push eax
mov eax, tlsindex
push eax
call TlsSetValue

;remove initialreturnaddr and push new one
add esp, 4
push newret

jmp original ;execute originalcode

;newret:
push eax ;save returnvalue
push signature
call vtrace ;call some displaystuff
add esp, 4 ;remove params

;restore old initialreturnaddr
mov eax, tlsindex
push eax
call TlsGetValue
mov ecx, eax
pop eax ;restore returnval
jmp ecx ;jump to initialreturnaddr

You should never do JMP instructions to some unknown address, the reason is JMPS can only go so far depending on the type of jump ! For example, a short jump is only able to go 255 bytes away. ALso, JMP instructions are calcuated by the NEXT BYTE, so you have to actually calcuate them if you are changing them dynamically, you can't just plug in a number. They are way too inflexible for what you need to do here.

A much better and more effective technique that will always work is to do a PUSH , RET combo. For example:

PUSH <address value>
RET

Using this you can go anywhere in the 4Gig memory space without any problems.

Also, you do not need to "save" the return address at the beginning of your routine! All you have to do is push your own return address on the stack (just push the address of where your function is) and do a RET. What I mean is this: The params get pushed. Now, overwrite the part of code that calls GetProcAddress with your own routine address. As long as your routine keeps the stack clean then at the end of the routine all you need to do is another PUSH <address of GetProcAddress> , RET and the parameters will even be still in the right place.

Like so:

If you want your code to run after GetProcAddress is called, then:

PUSH <address of your routine>
PUSH <address of GetProcAddress>
RET

So what happens is you push two return addresses, The RET will pop off and navigate to GetProcAddress. When GetProcAddress gets done, it's RET will pop off an execute your routine. Then you can have another PUSH RET at the end of your routine to return to the orignal code.

If you want your code to run BEFORE GetProcAddress:

PUSH <GetProcAddress>
PUSH <address of your proc>
RET

It's that simple. Just use PUSH , RET combos everywhere and you never have to worry about offsets or anything like that.

-nt20
0rp
05-06-2004, 03:11 PM
ok, i replaced the jmps with push/ret, but i get the same result.
some apps work without any problems, other app crash immediately

Also, you do not need to "save" the return address at the beginning of your routine! All you have to do is push your own return address on the stack (just push the address of where your function is) and do a RET.

if i do not replace the initial return addr, the expected api function wouldn't return to my proxy code (the api function would return directly to the caller).

is it possible, that the problems are caused by my registermanipulations (ax, cx) ?
nikolatesla20
05-07-2004, 08:51 AM
Yes, whenever I create a hook routine I always do a pushad/popad combo in my routine, so I don't have to worry about screwing the registers.

Do a pushad as the first command (after you do a mov ebp, esp - otherwise you will have a harder time getting the params. Use ebp to get to params as usual) like so:

push ebp
mov ebp, esp
pushad

<your code - use ebp+XX to get to params. First param ebp+08>

popad
leave (same as mov esp, ebp - pop ebp)
push <return address>
ret

This is the format I always use to make my hook routines 100% safe and easy to hook, cause no offset calculations required, unless you are calling an API yourself too, then of course you have to find its address, etc. But this will keep your regs. safe.

-nt20
0rp
05-09-2004, 09:10 AM
the stubcode is now:

mov ecx, [esp]
mov tlsval, ecx //__declspec(thread)

add esp, 4
push newret
push original
ret

//newret:
mov ecx, tlsval
push ecx
ret

only ECX is modified, but i get the same result. some MFC apps work, some simply crash.

if i use this code, it seems to work always:

mov ecx, 0 //modify ECX too, but no problem here
push original
ret

do you have any idea, whats now wrong?
doug
05-09-2004, 10:36 AM
did you debug what kind of crash it was? I'm a bit curious as to what makes it crash.
Try putting an int 3 in your routine to single step each cases until you see a buggy one.

Aside: you could try to change your routine to another register (eax); ecx is usually to "this" pointer passed between functions in c++.
0rp
05-11-2004, 06:17 PM
did you debug what kind of crash it was? I'm a bit curious as to what makes it crash.
Try putting an int 3 in your routine to single step each cases until you see a buggy one.

GetOpenFileNameA() is one of these functions, that always crash with an "accessviolation while reading" exception, somwhere deep in the comdlg.dll and i still don't know why.

this code works flawlessly, so the only difference is the modified return, by what the expected call will return to my proxycode.

mov ecx, 0 //testing purposes
push original
ret

maybe i should give up now
nikolatesla20
05-11-2004, 07:27 PM
I still don't know why you want to store away anything in ecx. You shouldn't have to - you should use the stack for everything you need. If you use the right combo of push / rets / pops you can get this to work no problem.

Also, why are you playing with tls storage , it's too complicated and could be dangerous, just use normal asm. tls could be unreliable, who knows what windows is doing with it behind u.

-nt20
0rp
05-12-2004, 05:29 AM
the stack looks like this, if my code is called:
param0
param1
...
paramX
retaddr

all i could do now, is to jump directly to the expected function, and everything would work, but i'm also interested in the returnval of the expected function. to get this value, i have to replace the initial retaddr with one, that points to my code, and after this code, i need the initial return addr, so i need to save it, but where? i can't push it, because of the parameters.

if i declare a global var with __declspec(thread), every thread has its own 'instance', thats why i use it to save the initial return.
0rp
05-12-2004, 07:09 AM
hm
maybe the problem is, that i use only one place to save the initial return val, but what if one hooked function calls another one? then the tls val would be overwritten.

i should use a stack like tls-structure
doug
05-12-2004, 07:11 PM
well, if you can, pm me :
- the target
- your code
- small txt file explaining what you do.
0rp
05-13-2004, 04:16 AM
it works now, even with GetOpenFileName
:)

this is the code: http://pro.n5home.net/inject.cpp.html
nikolatesla20
05-13-2004, 09:04 AM
it works now, even with GetOpenFileName
:)

this is the code: http://pro.n5home.net/inject.cpp.html

Are you using a named pipe to shuttle data back and forth? Neat idea.

Only problem would be you should use a random name in case you ever release the tool, so it can't be detected.

-nt20
0rp
05-13-2004, 09:43 AM
thx

i plan to write a tool, wich shows GetProcAddress-ed API-calls with its callstack (retrieved through the StackWalk-API). maybe this helps to reverse packed tools.

do you think this makes sense ? i mean, there are _a lot_ of api monitors, but do they capture runtime loaded api calls ?


Where can I find...?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Where can I find...?
PDA

View Full Version : Where can I find...?

highenergy
05-03-2004, 10:19 AM
Hi,

I'm a newbie and want to where to get an packing/unpacking tutorial or e-book avaible on the net. Because writings you wrote on this forum still in advanced level to me.

Byee
naides
05-03-2004, 10:52 AM
Hi,

I'm a newbie and want to where to get an packing/unpacking tutorial or e-book avaible on the net. Because writings you wrote on this forum still in advanced level to me.

Byee

If you Understand Spanish, try Ricardo Narvaja: Nuevo Curso.
Very basic and does not assume much about your basic knowledge
esther
05-03-2004, 12:06 PM
http://biw.rult.at There are some tutes on unpacking.If you are a newbie try cracking with targets +tutorials


how to do this ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how to do this ?
PDA

View Full Version : how to do this ?

mcensamuel
05-03-2004, 04:12 PM
Hi,

I am new to this field.Sorry..if anything wrong...

now i am testing one n/w application.When i am sending some types of packet,it is giving segfault.It is in Linux ELF fileformat.So i tried to attach that process to strace and gdb.

I have found that ,it is giving segfault becuase the previous function returning 0xFFFFFFFF.
Now the problem is,when try to replicate the same situation at two conditions.
ONE - Send packets at 1mbps ,it is giving segfault.
TWO - Send one packet at a time ,like manual entry.It is NOT giving segfault.
In simple,it is giving segfault ,when i sending packets at higher speed and not giving segfault when i sending packets at lower speed.

Now i want to trace this program.Is there any possibility ??

Thanks in advance for your help.

Thanks
McEnroe.
dELTA
05-05-2004, 02:12 PM
Well, you already said you had attached a debugger and pin-pointed the function that returns a different result in the case of the crash. Analyze this function in a disassembler, investigating what might cause the return value to change, and then set breakpoints (possibly conditional that only break when the function result is the bad one) incrementally from the back of this function until you find the point that differs between a crashing and a non-crashing run.


A Protected Mode Debugger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A Protected Mode Debugger
PDA

View Full Version : A Protected Mode Debugger

ajron
05-03-2004, 04:17 PM
It can debug almost any:
- Real Mode (RM)
- Virtual Mode (VM)
- VCPI- or DPMI-based Protected Mode (PM), and
- Windows 3.1x and Win95/98 program.

hxxp://www.sudleyplace.com/swat/swat.htm :)


Finding call to files on source CD.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Finding call to files on source CD.
PDA

View Full Version : Finding call to files on source CD.

BBQmyNUTZ
05-03-2004, 07:27 PM
Hi, everyone... as you can probably guess, I'm a complete and total n00b who just cracked his first program earlier today. I still have barely any understanding of ASM, but I'm trying. ^_^

Anyways, onto my question. The game which I wanted to run without the cd used a simple CD check, which I just bypassed and that works fine. However, the voice files (in .wav format) for the game are not copied to the harddrive during installation, and when the game runs it pops and error message stating they cannot be found.

I tried looking at the usual calls (getdrivetypea, messageboxa) and I can't seem to find anything that will lead me to where the files on the CD are being called to, or how to change it so that it can read from the harddrive.

I'm using OllyDbg for the debugging and patching of the file. Any help would be appreciated in pointing me on the right path, and if any additional information is needed I'll do my best to provide it for you.

Thanks,

Kai
Woodmann
05-03-2004, 08:03 PM
Howdy,

Search an you shall find such info's as:

GetDriveTypeA
GetVolumeInformationA
GetDriveAttributeA
FindFirstFileA
SetCurrentDirectoryA
GetFileSize
CreateFileA
GetDiskFreespaceA
GetFileAttributeA
mciSendCommandA & mciSendStringA (used to check AudioCD)

Woodmann
BBQmyNUTZ
05-03-2004, 08:08 PM
*Update*

Well, I did manage to find a few suspects, as well as the where it is being called from by setting some breakpoints... but I still have absolutely no idea what it's doing or how to get it to do what I want.

Very confusing. :p

Kai
BBQmyNUTZ
05-03-2004, 08:13 PM
Howdy,

Search an you shall find such info's as:

GetDriveTypeA
GetVolumeInformationA
GetDriveAttributeA
FindFirstFileA
SetCurrentDirectoryA
GetFileSize
CreateFileA
GetDiskFreespaceA
GetFileAttributeA
mciSendCommandA & mciSendStringA (used to check AudioCD)

Woodmann

Thanks for replying, Woodmann. The modular call which led me to the CD check was GetDriveTypeA, however, when the program looks for the sound files on the cd it doesn't use that call. As stated in my update post, I was able to search around and find where I *believe* is where I need to be (found via a text string search), but the lightbulb hasn't gone off yet to where I can actually understand where I am or what I'm looking at.

BTW, many thanks for the site and the forum. I wouldn't have gotten as far as I have already without some of the tutorials I've read here.

Kai
dELTA
05-05-2004, 02:16 PM
Did you install the program from the CD? My guess would be that it has just saved the installation source path somewhere (e.g. a datafile or the registry) and tries to access the files based on this. My first try would be to perform the installation from the start from a second harddisk partition instead (possibly subst:ed if necessary), and see how that goes.
BBQmyNUTZ
05-05-2004, 09:47 PM
Did you install the program from the CD? My guess would be that it has just saved the installation source path somewhere (e.g. a datafile or the registry) and tries to access the files based on this. My first try would be to perform the installation from the start from a second harddisk partition instead (possibly subst:ed if necessary), and see how that goes.

I've tried both install methods. The installation itself doesn't copy the files to the harddrive, and the game exe doesn't look for them anywhere but the CD.

Kai
BBQmyNUTZ
05-11-2004, 08:44 PM
I've tried both install methods. The installation itself doesn't copy the files to the harddrive, and the game exe doesn't look for them anywhere but the CD.

Kai

Anybody have any ideas? This thing is really annoying me. :p I've been at it for the past couple of days and I can't get anywhere.

Kai
DaddyJTHC
05-11-2004, 11:23 PM
Anybody have any ideas? This thing is really annoying me. :p I've been at it for the past couple of days and I can't get anywhere.

Kai
I have had a program quite like this, and have found that the calls are not made in the general "X:\voice\wave.wav" format they are most likely refered to in a standard C/C++ define, hence not stored in string reference, there is usually always a secondary file in this instance,

1st
try running filemon to trace where the call is made from, and made to.

2nd
as DELTA said, it can be stored in the reg. regmon will help you there.

3rd, there are many program that can emulate a directory as a cd. hence, copy the cd to a directory and make the program run it as a cd.

hope this helps some.
dj
BBQmyNUTZ
05-12-2004, 08:56 AM
I have had a program quite like this, and have found that the calls are not made in the general "X:\voice\wave.wav" format they are most likely refered to in a standard C/C++ define, hence not stored in string reference, there is usually always a secondary file in this instance,

1st
try running filemon to trace where the call is made from, and made to.

2nd
as DELTA said, it can be stored in the reg. regmon will help you there.

3rd, there are many program that can emulate a directory as a cd. hence, copy the cd to a directory and make the program run it as a cd.

hope this helps some.
dj

Most bizzare thing happened... I changed the cd protection patch a little bit and it now seems to be working. ^_^ Not sure what I did and why it affected the programs ability to read that folder... but I'll take it!

Kai
DaddyJTHC
05-12-2004, 12:58 PM
Most bizzare thing happened... I changed the cd protection patch a little bit and it now seems to be working. ^_^ Not sure what I did and why it affected the programs ability to read that folder... but I'll take it!

Kai

I would make it a point to learn what you did, and how it affected this program if you are wanting to learn anything.

Regards
DJ
BBQmyNUTZ
05-12-2004, 04:33 PM
I would make it a point to learn what you did, and how it affected this program if you are wanting to learn anything.

Regards
DJ

Have no idea where to start. I've just been doing alright up to this point by following the calls and jumps, knowing where they're going, and bypassing or omitting as needed. I don't understand ASM, and to be honest, most of the reads I've gone through all assume some level knowledge, which unfortunately I don't possess.

Anyways, onto my next problem child. ^_^

Kai


[Help] Key-Lok II and MS Access target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > [Help] Key-Lok II and MS Access target
PDA

View Full Version : [Help] Key-Lok II and MS Access target

FoxB
05-04-2004, 12:59 AM
I have the target, protected Key-lok dongle and calls of function kfunc() are inserted into MS Access application.
I had to write the library intercepting all references to original library kldll32.dll.

MSAccess executable-> application.dll-> msvbvm60.dll-> emulation.dll-> kldll32.dll

After a run target I have only one call kfunc() instead of described in two:
_KFUNC@16:
Arguments=000056e1, ValidateCode1=0000ee5f, ValidateCode2=0000dfc8, ValidateCode3=00000000,
ReturnValue1=0000a34e, ReturnValue2=0000cb34

The subsequent run of my target have shown, that entrance value Arguments and returned values of value changes only:
_KFUNC@16:
Arguments=00000d69, ValidateCode1=0000ee5f, ValidateCode2=0000dfc8, ValidateCode3=00000000,
ReturnValue1=0000cc48, ReturnValue2=0000d5d3

_KFUNC@16:
Arguments=00003b8c, ValidateCode1=0000ee5f, ValidateCode2=0000dfc8, ValidateCode3=00000000,
ReturnValue1=0000b3b0, ReturnValue2=00000a8f

I had to address for example from Key-Lok II SDK and I have checked up, that all over again there is call KLCHECK:
kfunc (KLCHECK, ValidateCode1, ValidateCode2, ValidateCode3), and then
kfunc (Argument1, Argument2, Argument3, 0)

_KFUNC@16:
Arguments=00000001, ValidateCode1=0000488b, ValidateCode2=0000fee2, ValidateCode3=0000ef90,
ReturnValue1=0000b954, ReturnValue2=0000ea79

_KFUNC@16:
Arguments=00002428, ValidateCode1=0000a79e, ValidateCode2=0000532d, ValidateCode3=00000000,
ReturnValue1=0000abe4, ReturnValue2=0000dd5d

After substitution of correct values (thanks Sab:-)) I have good result with an example from SDK.

My question - as it is possible for me find valid call of kfunc()?

WBR


Preserving Undocumented Kernel Information - KeServiceDescriptorTableShadow
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Preserving Undocumented Kernel Information - KeServiceDescriptorTableShadow
PDA

View Full Version : Preserving Undocumented Kernel Information - KeServiceDescriptorTableShadow

Kayaker
05-04-2004, 02:19 AM
Hi All

I am going to do something I truly hope no one takes offense to. A few months back, on another forum, there was an interesting discussion concerning the KeServiceDescriptorTableShadow. Recently someone asked another question on the subject, and due to apparent policy changes on that forum, the thread was deleted.

I have absolutely no argument with this decision, they have their rules and regulations designed to protect their board, we have ours. However, I like to encourage these types of discussions on this board, and in the interest of keeping undocumented kernel programming knowledge freely available to all, I would like to resurrect the bulk of that thread and its attachments.

Understand that I'm not trying to play one-upmanship on another forum that I respect and enjoy participating in, my only desire is to preserve and encourage discussions on undocumented system programming issues. If anyone objects they are free to PM me. Here are the relevant posts from that thread for posterity.

Regards,
Kayaker

=================================================================================

Posted by Opcode:

In WindowsXP I found the KeServiceDescriptorTable pointer in a member of the KTHREAD Structure.
In the file Ntundoc.inc written by Four-F , I found it at offset 0xdc, but in XP it is in the offset 0xe0.

Appears to me that KTHREAD structure changed from windows2k to XP.

How can I find the KeServiceDescriptorTableShadow that is exported by Win32K.sys ?

=================================================================================

Posted by Kayaker:

Hi

>KeServiceDescriptorTable .. I found it at offset 0xdc, but in XP it is in the offset 0xe0.
>Appears to me that KTHREAD structure changed from windows2k to XP.

>How can I find the KeServiceDescriptorTableShadow that is exported by Win32K.sys

I think you just did. I had read that there was a change between Win2K sp1 and sp3 and the KeServiceDescriptorTable is now a per-process one. The first time a thread calls a Win32 GUI service, its system service table is changed to one that includes the GDI and USER services in Win32k.sys. This new service table contains pointers to both the ntoskrnl call table and to the win32k table. I've played with this to add new Int2E services to the ntoskrnl table, as far as I know the win32k.sys portion is what is used for any of the user services as well (Service ID > 1000), so I think there's no need to 'hunt' for the KeServiceDescriptorTableShadow.

Here's some code I've used for Win2K, things might be slightly different for XP.

ServiceDescriptorTable structure:
--------------------------
;typedef struct ServiceDescriptorTable {
;PVOID ServiceTableBase;
;PVOID ServiceCounterTable(O); • j •
;unsigned int NumberOfServices;
;PVOID ParamTableBase;

ServiceTableBase (SSDT) - points to a table of pointers to each ntoskrnl (or win32k.sys) function starting address
ServiceCounterTable - only used in debug builds, for us contains 0
NumberOfServices - 0F8h for Win2K sp3
ParamTableBase (SSPT) - points to a table containing the number of parameter *bytes* for each matching SSDT entry
---------------------------

To start with, there is an exported ntoskrnl.exe function that retrieves the KeServiceDescriptorTable. This table however ONLY contains the ServiceDescriptorTable for the ntoskrnl calls.

; Use internal system KeServiceDescriptorTable
mov edi, offset KeServiceDescriptorTable ; exported ntoskrnl.exe function
mov edi, [edi]

EDI is now the ntoskrnl.exe ServiceDescriptorTable as decribed in the above structure definition. In Win2K on my system this is at 80482E20.

This doesn't really do us much good though since we really want the "Shadow" table which is per- process and also contains the win32k.sys ServiceDescriptorTable.

As you mentioned Opcode, the KeServiceDescriptorTable is at offset 0xDC of fs:[124h] for Win2K, I guess you found it at 0xE0 in XP. I might be wrong, but I think this is all you need to find the Win32k.sys function addresses, again, the KeServiceDescriptorTable should be updated to include pointers to both the Service Tables.

If I use the following code in a driver, I see the ServiceDescriptorTable for both ntoskrnl and win32k.sys (a total of 8 dwords). In Win2K on my system this is at address 80482F60.

; Use KeServiceDescriptorTable for current process
mov edi, fs:[124h] ; pointer to Thread Environment Block (TEB) for main thread
add edi, 0DCh ; [TEB+DCh] is KeServiceDescriptorTableShadow
mov edi, [edi]
mov pKeServiceDescriptorTableShadow, edi ; save it for restoring later

assume edi : ptr ServiceDescriptorTable

Now you can access the SSDT, NumberOfServices and SSPT for either the ntoskrnl services (Service ID < 1000) or the win32k.sys services (Service ID > 1000)
[edi].ServiceTableBase
[edi].NumberOfServices
[edi].ParamTableBase

I hope this helped a bit. If anyone is interested I could post my test program which gives an example of adding user-defined NTOSKRNL Services in Win2K. You simply make a copy of the original SSDT and SSPT, increase their size, and add new SSDT (your function addresses) and SSPT (how many parameter bytes they use) entries to the end of each table, then update the KeServiceDescriptorTable. These new services can now be called via Int2E from either user mode or kernel mode. I don't think you can do this in XP without modifying the permissions of the Service Table addresses in memory. I'm not sure if such a posting would be against the Board's policy, but it is a fairly innocuous example.

Regards,
Kayaker

=================================================================================

Posted by Opcode:

Hi, Kayaker

I'm trying to hook the function 0x1225 of
KeServiceDescriptorTable.
Using the SoftICE I did the following:

bpint 2e if (eax==1225)

When the breakpoint fired, I perceived in
the int 2eh interrupt handler, that the
XP kernel find the KeServiceDescriptorTableShadow
in this way:

push 00 ;eax=0x1225 (win32k.sys)
... (resumed)
mov esi, [FFDFF124] ;esi=TEB pointer
...
mov edi, eax ;edi = 0x1225
shr edi, 08
and edi, 30h ;edi = 0x10
add edi, [esi+e0] ;EDI is now the KeServiceDescriptorTableShadow pointer !!!
...
and eax, 0FFFh ;eax=225h
mov edi, [edi]
mov ebx, [eax*4+edi]
...
call [ebx] ;<-- Call the 0x1225 function of Win32k.sys !!!
...

But doing this im my DriverEntry procedure , i got the BSOD!!!

mov eax, [ffdff124]
add eax, 0e0h ;eax point to KeServiceDescriptorTable
add eax, 0x10 ;eax point to KeServiceDescriptorTableShadow
mov eax, [eax] ; <<<<<<<<--- Blue Screen of Death

Using the DbgPrint function I discovered that mov eax, [eax] was mov eax, [00000000] !!!
But debugging with the help of w2k_mem.exe http://www.orgon.com/w2k_internals/ w2k_internals.zip
for seeing the kernel memory, and doing

w2k_mem #0x200 0xffdff000 +p 0x124 +0xe0

// w2k_mem.exe
// SBS Windows 2000 Memory Spy V1.00
// 08-27-2000 Sven B. Schreiber

Loading "SBS Windows 2000 Spy Device" (w2k_spy) ...
Driver: "w2k_spy.sys"
Opening "\\.\w2k_spy (file://\.w2k_spy)" ...

SBS Windows 2000 Spy Device V1.00 ready

FFDFF000..FFDFF1FF: 512 valid bytes

Address | 00 01 02 03-04 05 06 07 : 08 09 0A 0B-0C 0D 0E 0F | 0123456789ABCDEF
---------|-------------------------:-------------------------|-----------------
FFDFF000 | F0 BC E6 F5-F0 BD E6 F5 : 00 80 E6 F5-00 00 00 00 | _+µ§_¢µ§.?µ§....
FFDFF010 | 00 00 00 00-00 00 00 00 : 00 E0 FD 7F-00 F0 DF FF | .........Ó².._¯_
FFDFF020 | 20 F1 DF FF-00 00 00 00 : 00 00 00 00-00 00 00 00 | ±¯_............
FFDFF030 | C0 20 FF FF-B8 DD 53 80 : 00 F4 03 80-00 F0 03 80 | + __©¦S?.¶.?._.?
FFDFF040 | 00 20 04 80-01 00 01 00 : 01 00 00 00-64 00 00 00 | . .?........d...
FFDFF050 | 00 00 00 08-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF060 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF070 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF080 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF090 | 00 00 04 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF0A0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF0B0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF0C0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF0D0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF0E0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF0F0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF100 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF110 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
FFDFF120 | 01 00 01 00-D0 87 58 FF <<<<-- TEB POINTER

FF5887D0..FF5889CF: 512 valid bytes

Address | 00 01 02 03-04 05 06 07 : 08 09 0A 0B-0C 0D 0E 0F | 0123456789ABCDEF
---------|-------------------------:-------------------------|-----------------
FF5887D0 | 06 00 70 00-00 00 00 00 : D8 87 58 FF-D8 87 58 FF | ..p.....Ï?X_Ï?X_
FF5887E0 | F8 D0 1C FF-F8 D0 1C FF : 00 C0 E6 F5-00 80 E6 F5 | °ð._°ð._.+µ§.?µ§
FF5887F0 | 00 E0 FD 7F-00 00 00 00 : 6C BC E6 F5-00 02 00 00 | .Ó².....l+µ§....
FF588800 | 00 0A 00 08-04 88 58 FF : 04 88 58 FF-0C 88 58 FF | .....?X_.?X_.?X_
FF588810 | 0C 88 58 FF-A8 81 58 FF : 00 00 00 00-51 00 00 00 | .?X_¿üX_....Q...
FF588820 | 00 00 00 00-00 00 00 00 : 00 00 00 00-40 88 58 FF | ............@?X_
FF588830 | 00 00 00 00-80 B7 54 80 : FA 09 05 00-08 10 00 02 | ....?ÀT?·.......
FF588840 | 18 BA E6 F5-18 BA E6 F5 : D0 87 58 FF-E8 D0 1C FF | .¦µ§.¦µ§ð?X_Þð._
FF588850 | 40 88 58 FF-00 00 01 00 : 00 00 00 00-00 00 00 00 | @?X_............
FF588860 | D0 87 58 FF-00 00 00 00 : 00 00 00 00-00 00 00 00 | ð?X_............
FF588870 | 00 00 00 00-00 00 00 00 : D0 87 58 FF-00 00 00 00 | ........ð?X_....
FF588880 | 00 00 00 00-00 00 00 00 : C8 88 58 FF-C8 88 58 FF | ........+?X_+?X_
FF588890 | D0 87 58 FF-C0 88 58 FF : 40 88 58 FF-02 01 01 00 | ð?X_+?X_@?X_....
FF5888A0 | 00 00 00 00-FF FF FF FF : 01 00 00 00-00 00 00 00 | ....____........
FF5888B0 | 80 AE 54 80- <---- [TEB+e0] !!!

8054AE80..8054B07F: 512 valid bytes

Address | 00 01 02 03-04 05 06 07 : 08 09 0A 0B-0C 0D 0E 0F | 0123456789ABCDEF
---------|-------------------------:-------------------------|-----------------
8054AE80 | 88 25 50 80-00 00 00 00 : 1C 01 00 00-A4 2B 50 80 | <-- KeServiceDescriptorTable
8054AE90 | 40 8C 99 BF-00 00 00 00 : 9B 02 00 00-A0 27 99 BF | <-- KeServiceDescriptorTableShadow
8054AEA0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
8054AEB0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
8054AEC0 | 88 25 50 80-00 00 00 00 : 1C 01 00 00-A4 2B 50 80 | <-- KeServiceDescriptorTable
8054AED0 | 00 00 00 00-00 <--------------------------------------- My BSOD!!!!
8054AEE0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................
8054AEF0 | 00 00 00 00-00 00 00 00 : 00 00 00 00-00 00 00 00 | ................

When I load my driver with the KmdManager of Four-F KMDKIT, and using DebugView of
Mark Russinovich, I discovered that

mov eax, [eax+e0] or mov eax, [TEB+e0] results in eax = 8054aec0 and not 8054ae80 !!!!

Why w2k_mem have the currect address and I my driver don't ????

My theory:

"When a thread first calls a Win32 GUI Service, its system service table is changed to one that
includes the GDI and USER services in Win32k.sys" - Mark Russinovich in "Inside Windows 2000"

More debbuging and I founded in KTHREAD that the owner process is "SYSTEM" in my driver
when loaded by KmdManager and in the w2k_mem, the owner process is "w2k_mem.exe".

I suppose that "SYSTEM" is a kernel process and don´t use Win32 GUI Services, therefore don't
have the KeServiceDescriptorTableShadow pointer!

Then, I'm doing the following to skip the BSOD:

mov eax, 0ffdff124h
mov eax, [eax]
add eax, 0e0h
mov eax, [eax]
mov eax, [eax - 030h]

and until now, it's working !!!

If anyone have another theory, please tell me !!!

And, Kayaker, thanks for the help and please send me your testing program.

Sorry again for my bad english and for this post size!!!

Regards,
Opcode

=================================================================================

Posted by Kayaker:

You seem to be right Opcode that the Service Table your driver sees is not the updated "shadow" table. Your diagnosis of the Int2E function is more or less correct I believe, [_KTHREAD+E0h] should be the *ntoskrnl* portion of the Service Table for the process, [_KTHREAD+E0h]+10h should be the *win32k.sys* portion if it is being used (the next 4 dwords). (This is why the Service ID's for win32k.sys are > 1000, the 'shr edi, 08' forces the "+10h").

For me with the GUI+driver setup, that is essentially what I see at [_KTHREAD+DCh], 2 sets of 4 dwords describing each ServiceDescriptorTable. I *thought* that in most cases a regular app using a driver IOCTL DispatchControl routine would have already had a call to win32k.sys, which according to theory would have initialized the Service Table to include this "shadow" table. (Some may wonder about my previous usage of the term TEB, this is probably wrong and _KTHREAD is more accurate).

Perhaps you could take your code out of DriverEntry and instead use DeviceIoControl to set it up. Are you using any GUI interface at all?

Anyway, here's the example of adding user-defined NTOSKRNL Services for Win2K, an implementation of the idea from Undocumented Windows NT by Prasad Dabak et al. The driver is loaded and 2 blank services added when you click on the button, information is returned to the edit box, then the new service can be tested. The original service table is restored and the driver unloaded on exit. It's not meant to be a treatise on the subject, just my own playings. Let me know if there are any problems.

Regards,
Kayaker

Attachment: addntservices.zip

=================================================================================

Posted by Four-F:

While dispatching system service request, KiSystemService (int2Eh/sysenter handler) fetches ServiceDescriptorTable address from the KTHREAD.ServiceTable of calling thread itself. Wherever it points, KiSystemService will use it for dispatching system service request.

There is two thread types: non-GUI & GUI.
For non-GUI thread its KTHREAD.ServiceTable points to KeServiceDescriptorTable. This pointer is exported by ntoskrnl.exe.
For GUI thread its KTHREAD.ServiceTable points to KeServiceDescriptorTableShadow. This pointer is not exported.

KeServiceDescriptorTable and KeServiceDescriptorTableShadow are basically the same with only one exception and consist of four structures (see above definition of ServiceDescriptorTable by Kayaker). First ServiceDescriptorTable is for Native API (exports from ntoskrnl.exe), third ServiceDescriptorTable is for Internet Information Services (if installed) (exports from Spud.sys), fourth ServiceDescriptorTable is reserved.
The exception is the second ServiceDescriptorTable. In KeServiceDescriptorTable it is unused but in KeServiceDescriptorTableShadow it is for Win32 USER and GDI services (exports from Win32k.sys).

All threads in System or Idle process are non-GUI ones. So, they KTHREAD.ServiceTable points to KeServiceDescriptorTable. Any just created thread is also non-GUI one and its KTHREAD.ServiceTable also points to KeServiceDescriptorTable. But if thread does first call to any service from user32.dll or gdi32.dll the system converts such thread to GUI-thread. It looks like this:

:004B9627 _PsConvertToGuiThread@0 proc
. . .
:004B964A mov eax, large fs:124h
:004B9650 mov esi, eax
. . .
:004B96A5 mov [esi+KTHREAD.ServiceTable], offset _KeServiceDescriptorTableShadow
. . .
:004B96C0 retn
:004B96C0 _PsConvertToGuiThread@0 endp

The common way to find KeServiceDescriptorTableShadow address is to scan memory ~one page up and down around KeServiceDescriptorTable, which address can be easily obtained. You have to find the match with first ServiceDescriptorTable of KeServiceDescriptorTable. If this match found, its first ServiceDescriptorTable of KeServiceDescriptorTableShadow. Some drivers I've seen (Invisibility by Y0da, for ex, etc...) do basically the same.

I can suggest another method. It's more generic one, IMHO.

Thirst thing you have to do is to find ServiceTable field offset in KTHREAD structure. It's easy. You create thread and call your driver with DeviceIoControl. In driver you will be in that thread context. So you obtain KeServiceDescriptorTable and scan KTHREAD of calling thread for match. This way you have KTHREAD.ServiceTable offset.

Second thing you have to do is to convert you thread to GUI one. It's also easy. Just call any user32 API. Then do another DeviceIoControl. The calling thread is now GUI one, so its KTHREAD.ServiceTable points to KeServiceDescriptorTableShadow and I'm sure you just have figured out what you have to do next :-)

Or slightly more easy implementation (see attachment). I just enumerate threads whith ID = 80h-400h, trying to find a thread which KTHREAD.ServiceTable not equal to KeServiceDescriptorTable. Just use GetServiceDescriptorTableShadowAddress in your driver and throw DbgPrint call away.

Tested under 2000, XP and Server 2003. Please test it under NT4.

Attachment: findshadowtable.zip

=================================================================================
Kayaker
05-04-2004, 02:21 AM
Attachment 1
Kayaker
05-04-2004, 02:22 AM
Attachment 2
Kayaker
05-04-2004, 02:23 AM
=================================================================================

Posted by Metro_Mystery

I know, more or less- this post goes goes back a few months; but I have a question that relates directly to it.

Just a few quick structure definitions...

typedef struct tag_SYSTEM_SERVICE_TABLE {
PULONG ServiceTable; // array of entry points
PULONG CounterTable; // array of usage counters
ULONG ServiceLimit; // number of table entries
PCHAR ArgumentTable; // array of argument counts
} SYSTEM_SERVICE_TABLE, *PSYSTEM_SERVICE_TABLE, **PPSYSTEM_SERVICE_TABLE;

typedef struct tag_SERVICE_DESCRIPTOR_TABLE {
SYSTEM_SERVICE_TABLE ntoskrnl; // main native API table
SYSTEM_SERVICE_TABLE win32k; // win subsystem, in shadow table
SYSTEM_SERVICE_TABLE sst3;
SYSTEM_SERVICE_TABLE sst4;
} SERVICE_DESCRIPTOR_TABLE, *PSERVICE_DESCRIPTOR_TABLE, **PPSERVICE_DESCRIPTOR_TABLE;

Now in Windows XP, [TEB+e0] always points to the PSERVICE_DESCRIPTOR_TABLE at address 0x80544BC0.

Using Softice- I read the data at this address ->

PSERVICE_DESCRIPTOR_TABLE->ntoskrnl = 0x80544BC0

And found that ->

PSERVICE_DESCRIPTOR_TABLE->ntoskrnl->ServiceTable = 0x804FC624;
PSERVICE_DESCRIPTOR_TABLE->ntoskrnl.ServiceLimit = 0x0000011C;
...

PSYSTEM_SERVICE_TABLE->win32k = 0xBF995BA8

Obviously, the ntoskrnl SYSTEM_SERVICE_TABLE has be filled in with the correct addresses of all the System Service Functions etc...

However, if I then read the address at PSYSTEM_SERVICE_TABLE->win32k; although it has been assigned a pointer to 0xBF995BA8 [Address of the KeServiceDescriptorTableShadow], upon reading this address I get ->

PSERVICE_DESCRIPTOR_TABLE->win32k->ServiceTable = ?;
PSERVICE_DESCRIPTOR_TABLE->win32k.ServiceLimit = ?;

The SYSTEM_SERVICE_TABLE for the GUI/Graphical win32k functions hasn't yet been assigned the address of the functions etc. This makes sense; as my driver can't run as a GUI application [I don't think it can, anyway].

So, as pointed out by almost everyone who replied in this post; I learnt that the KeSystemServiceTableShadow isn't appended to the SERVICE_DESCRIPTOR_TABLE unless it calls a GUI/Graphical Function [i.e. User32.DLL].

But the problem, and my question is... how do I get the KeSystemServiceTableShadow appended to the SERVICE_DESCRIPTOR_TABLE in KernelMode- I can't call a Graphical/GUI function in my driver- and I can't get the KernelMode address in UserMode... A few of you talked about creating system threads and calling usermode Graphical/GUI functions to convert them- but I didn't really understand how I could use this to get the KeSystemServiceTableShadow appended to the SERVICE_DESCRIPTOR_TABLE pointed to in my KernelMode driver.

Any ideas?

Thanks,

Adam

=================================================================================
Opcode
05-04-2004, 07:34 AM
Hi Kayaker,

I appreciate your decision.
Its good to see that I have a place to
make good questions and to help.
Now I will just use this forum,
I leaved the other forum. :D

Thanks,
Opcode
nikolatesla20
05-04-2004, 09:06 AM
Um, why is this info so "dangerous" in some forum admin's mind..

-nt20
upb
05-06-2004, 07:27 AM
Um, why is this info so "dangerous" in some forum admin's mind..

-nt20

o_O coding rootkits O_o
Opcode
05-06-2004, 07:56 AM
o_O coding rootkits O_o

By the rootkit definition, I don't see any reason to code
a rootkit that will use the KeServiceDescriptorShadow
because this table maps the kernel version of the
functions exported by GDI32, USER32 and some
DirectX functions.

The most important table for rootkit is the KeServiceDescriptor
which is exported by ntoskrnl.

Maybe I'm wrong :D


IDA argument list - c++ program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IDA argument list - c++ program
PDA

View Full Version : IDA argument list - c++ program

mcensamuel
05-04-2004, 12:54 PM
hi,

i am trying to disassamble one c++ program( i dont have source code for that).
I opened the executable file in the IDA.I searched for some function and entered that function.On the entry point of that function,IDA shows it have two orguments,but when i checked in 'functions' window ,it shows that function has only one argument.What might be the reason,why IDA is showing two arguments in the place of only one argument...

i tried one simply "hello world" C++ program,,in that case, it shows only one argument for a function with one argument.

Why it is showing differently for this program ???
sorry for my bad english...

thanks
naides
05-04-2004, 01:06 PM
hi,

i am trying to disassamble one c++ program( i dont have source code for that).
I opened the executable file in the IDA.I searched for some function and entered that function.On the entry point of that function,IDA shows it have two orguments,but when i checked in 'functions' window ,it shows that function has only one argument.What might be the reason,why IDA is showing two arguments in the place of only one argument...

i tried one simply "hello world" C++ program,,in that case, it shows only one argument for a function with one argument.

Why it is showing differently for this program ???
sorry for my bad english...

thanks

Class functions have a hidden argument: "this", which is a pointer to the class structure.
this might be one explanation.
mcensamuel
05-04-2004, 01:36 PM
Class functions have a hidden argument: "this", which is a pointer to the class structure.
this might be one explanation.

thanks for your reply.
I have tried this with two sample program...when i tried debuf using GDB..i got differnet argument insert order for C and C++.

When i complied a C program,that has a function like
functionname(int aa,int bb)....for this first 'bb' is inserted into stack and then ''aa" is inserted to stack..

But for a c++ program that has a function like
private_fnt(int &int_var,int defau=20)
First 'int_var' is inserted into stack.
Second 'defau' is inserted into stack.
Third "this" inserted into stack.

Is this correct or am i missing anything ??

Thanks in advance...
mcensamuel
05-04-2004, 01:42 PM
thanks for your reply.
I have tried this with two sample program...when i tried debuf using GDB..i got differnet argument insert order for C and C++.

When i complied a C program,that has a function like
functionname(int aa,int bb)....for this first 'bb' is inserted into stack and then ''aa" is inserted to stack..

But for a c++ program that has a function like
private_fnt(int &int_var,int defau=20)
First 'int_var' is inserted into stack.
Second 'defau' is inserted into stack.
Third "this" inserted into stack.

Is this correct or am i missing anything ??

Thanks in advance...

sorry...i did a mistake in this...sorryyyy
nikolatesla20
05-04-2004, 01:44 PM
Well, apparently your C++ compiler uses a different calling convention.., which would cause a difference in which parameters are pushed, like you said.

Looking at the Windows calling conventions, most of them are right to left, and member functions without variable args by default use the "thiscall" (MSVC++, anyway) convention..however, thiscall uses ecx as the this pointer, so I'm not sure what calling convention you are seeing here.

-nt20
Polaris
05-04-2004, 03:15 PM
thanks for your reply.
I have tried this with two sample program...when i tried debuf using GDB..i got differnet argument insert order for C and C++.

When i complied a C program,that has a function like
functionname(int aa,int bb)....for this first 'bb' is inserted into stack and then ''aa" is inserted to stack..

But for a c++ program that has a function like
private_fnt(int &int_var,int defau=20)
First 'int_var' is inserted into stack.
Second 'defau' is inserted into stack.
Third "this" inserted into stack.

Is this correct or am i missing anything ??

Thanks in advance...

But which compiler are you using? Recognizing the compiler you are dealing with can greatly help. As nikolatesla20 says this is a really strange way of passing parameters... The strange thing is a C/C++ compiler pushing parameters from left to right... This usually is the behaviour of pascal/modula2 compilers.
barny451
05-05-2004, 05:28 PM
But which compiler are you using? Recognizing the compiler you are dealing with can greatly help. As nikolatesla20 says this is a really strange way of passing parameters... The strange thing is a C/C++ compiler pushing parameters from left to right... This usually is the behaviour of pascal/modula2 compilers.
The original reason for pushing from right to left was that this also works for a variable number of arguments (the ANSI ... in a function prototype), because the stack pointer ends up pointing at the left-most (i.e. first) parameter.
While this was a common compiler implementation choice, there is nothing to stop a compiler from optimising by recognising functions which don't have a variable number of arguments and generating different code (both for caller and the function itself) which does left-to-right parameters (i.e. stack pointing at the last param). This is usually more efficient which is why most windose API calls are declared as PASCAL, which explicitly forces left-to-right parameter pushing to Windows compilers.

HTH
barny


Need to track 99% resource usage by cracked prog... ring 0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need to track 99% resource usage by cracked prog... ring 0
PDA

View Full Version : Need to track 99% resource usage by cracked prog... ring 0

zambuka42
05-05-2004, 06:04 PM
I thought i'd start a new thread for this... i posted earlier about the same program, but this is a new problem. Hope I'm not being to needy :) -b

I've recently cracked a program. Everything works exactly as I needed except for the fact that the program is now taking up 90-99% cpu power as reported by the task manager. I've only been able to use softice to debug this program and thus far have not been able to find a way to figure out WHY this is happening. Any advice would be greatly appreciated. :) -b
Kayaker
05-05-2004, 10:39 PM
Hi

I'm curious why you think this is a ring0 issue? One thing you might try is, go into Control Panel / Administrative Tools / Performance and right click on the graph and select Add Counters. From here you can add monitoring options. For example, under System you can add File Read Bytes/sec, or other operations to monitor. If you can isolate the correct thing to monitor maybe you can narrow down the problem. An idea anyway.

Kayaker
zambuka42
05-06-2004, 10:29 AM
Hey, thanks for the reply... I don't necessarily think its a ring0 issue, i just wanted to include as much info in the subject as possible... as for the monitors.. good idea.. thanks, I hope it narrows down. -b
dELTA
05-06-2004, 05:03 PM
Ok, a little clarification of the FAQ might be necessary here I see, we like you to include as much true and relevant info as possible in the message subject lines, not just any random info and buzzwords that might not actually have anything to do with the subject... :D


Help doing inline keygenning....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help doing inline keygenning....
PDA

View Full Version : Help doing inline keygenning....

EJ12N
05-05-2004, 07:36 PM
Hi im doing a keygenME and the algo of it is too long but i mean LONG...(maybe 200+ lines) uhmm anyways i know how to make it so it displays the correct serial on the error msgbox :) but i what i did is add a new editbox (txtbox) with resource editor and i now what i want is how to make that edit box display the correct serial instead of doing it in the message box :)

well that's all

THank you!

Regards,
ZaiRoN
05-06-2004, 03:13 AM
Hi EJ12N,
there are some functions you can use in order to solve your problem: SetDlgItemText, SetWindowText, SendMessage(wm_settext). Choose one of these and use it...
EJ12N
05-06-2004, 03:55 AM
uhmm i know that... but the thing is how to do it... ? i dont have the source for the program so i gotta inline patch it to do that but how ?
Thank you :)
ZaiRoN
05-06-2004, 04:12 AM
i dont have the source for the programSorry but, what does it mean? Why do you need the source of the program !?!

zai
Aimless
05-06-2004, 05:32 AM
uhmm i know that... but the thing is how to do it... ? i dont have the source for the program so i gotta inline patch it to do that but how ?
Thank you :)

You may try to search on google for <Code Caves>, <adding sections PE> and seach the old fravia mirror for adding fucntionality.

A good read would be to go to google and search for <RazziaPad> or <Razzia> or <How to add functionality to Notepad>

Have Phun
EJ12N
05-06-2004, 08:48 AM
Sorry but, what does it mean? Why do you need the source of the program !?!

zai

i said that cuz maybe u miss understood me :p
Well ima go search for those tuts Aimless said... but if anyone could describe it here for me how to do it would be great :)

Thank you!
Will
05-06-2004, 02:00 PM
i know how to make it so it displays the correct serial on the error msgbox

You know how to add code for that but not how to insert a single api call like SetWindowText?
EJ12N
05-06-2004, 04:58 PM
Yes i dont know about how to setwindowtext on the new edit box i did to make it display on messagebox is easy you just change code... but i never done this SetWindowText so can anyone help :p
Will
05-06-2004, 06:02 PM
Well showing the serial in a msgbox still involves a call to wsprintf, adding a string ("%d,0" or whatever), adding a buffer (25 dup(0) or whatever), and inserting the code.

That's about equally as complicated as adding a call to GetDlgItem/SetWindowText, which would consist of something like this:

(assuming that they're already imported, although importing them isn't much of a problem either :) )

;either overwrite unimportant code or insert a jump to a cave, then add this
push nIDDlgItem ;the dlg id that you gave the edit box
push hDlg ;the hWnd of the dlg -- it'll most likely be in 1 of 2 places
;ebp + xx or in a buffer
call GetDlgItem ;hopefully it's imported already
push lpString ;since you've already got the serial in a buffer that you
;used with your MessageBox/Ex call ;) then just use that
push eax ;hWnd is in return of GetDlgItem
call SetWindowText ;hopefully it's imported already, if not try SetDlgItemText

That's more than enough info for you. You're selling yourself short though, by thinking that you can't do this already. You've already added the MessageBox code, so this isn't much more difficult if at all. ;)

cheers,
will
EJ12N
05-07-2004, 02:20 PM
NVM i got it :) Thanks anyways

Well showing the serial in a msgbox still involves a call to wsprintf, adding a string ("%d,0" or whatever), adding a buffer (25 dup(0) or whatever), and inserting the code.

That's about equally as complicated as adding a call to GetDlgItem/SetWindowText, which would consist of something like this:

(assuming that they're already imported, although importing them isn't much of a problem either :) )

;either overwrite unimportant code or insert a jump to a cave, then add this
push nIDDlgItem ;the dlg id that you gave the edit box
push hDlg ;the hWnd of the dlg -- it'll most likely be in 1 of 2 places
;ebp + xx or in a buffer
call GetDlgItem ;hopefully it's imported already
push lpString ;since you've already got the serial in a buffer that you
;used with your MessageBox/Ex call ;) then just use that
push eax ;hWnd is in return of GetDlgItem
call SetWindowText ;hopefully it's imported already, if not try SetDlgItemText

That's more than enough info for you. You're selling yourself short though, by thinking that you can't do this already. You've already added the MessageBox code, so this isn't much more difficult if at all. ;)

cheers,
will


n00b PDA reversing question...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > n00b PDA reversing question...
PDA

View Full Version : n00b PDA reversing question...

n3tsniper
05-06-2004, 12:48 AM
I'm new to the PDA cracking scene and read Fravia's intro, but I need a little more info if someone could kindly help out ;-)

When I load the PDA executable into IDA Pro, it allows me to choose processor type, but metapc is the default - is this correct? It seems like it should be one of the ARM settings. Any ideas? And anyone know of some simple PDA app cracking walkthroughs using IDA Pro? Thanks for your help...

Netsniper
akimp3
05-06-2004, 02:37 AM
Hi

if you only want a simple tutorial take a look at the post
"pocket program need help" i had post one of my tutorials
on the second page.If you prefer a book try"Security warriors"from
Dr peikari ex HCU+ hacker.you can find it in w**ez bu it is
better to buy it to support guys like him.

Good luck

akimp3
n3tsniper
05-06-2004, 11:01 AM
Hi

if you only want a simple tutorial take a look at the post
"pocket program need help" i had post one of my tutorials
on the second page.If you prefer a book try"Security warriors"from
Dr peikari ex HCU+ hacker.you can find it in w**ez bu it is
better to buy it to support guys like him.

Good luck

akimp3

I just bought Kaspersky's "Hacker Disassembly Uncovered". I'm hoping to learn a lot from that book. I'll check out Security Warriors too. Thanks for the info...

Netsniper


Direction on unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Direction on unpacking
PDA

View Full Version : Direction on unpacking

Silver
05-06-2004, 11:53 AM
Hey,

Looking for a little direction here. I'm playing around with unpacking/decrypting, but I need some experience. I can manually unpack the easier stuff (upx etc), but Armadillo etc is beyond me at the moment. Anyone able to offer some suggestions of things I should play with to get some experience?

Thanks.
EJ12N
05-06-2004, 01:17 PM
Hey,

Looking for a little direction here. I'm playing around with unpacking/decrypting, but I need some experience. I can manually unpack the easier stuff (upx etc), but Armadillo etc is beyond me at the moment. Anyone able to offer some suggestions of things I should play with to get some experience?

Thanks.

Read Tutorials about unpacking Armadillo and follow the tutorial with target then if you did it :) time to go play alone... get the tutorial with a different target but still packed with armadillo and try to do it yourself with help of tutorial....practice practice alot with many programs and you would be an unpacking god :D

Hope that helps!
Silver
05-06-2004, 03:13 PM
:D Well, I was under the impression that Armadillo was one of the hardest to break (based on some posts here too).

Should I be looking at Petite/Aspack etc? There are plenty of tutorials, but I like to learn myself/my own way. Plus, a lot of them were written by people who took l33t h4xX0r typing to heart, and thought grammar was optional ;)

Different note. Just *how annoying* are progs that say "To register, use the Register option in Help Menu".... except the genius developers forgot to add that option in :D
nikolatesla20
05-07-2004, 09:07 AM
You should move on to AsPack next (AsPack, not AsProtect), it's good practice when you are starting out. The other packers have too many tricks to learn the basics when are starting. AsPack doesn't have any fancy tricks of it's own, it just compresses and mods the IAT a little. So you can practice dumping and fixing the IAT, both core staples of unpacking work. All the other protections do the same thing but just add more bells and whistles (like debugger detection, CRC checks, dump prevention, etc.)

Once you have the basics down (dumping and IAT rebuilding) the rest become easier because those two basics are the most important.

-nt20
Silver
05-07-2004, 11:06 AM
Thank you, exactly what I needed.


IsDebuggerPresent - how to bypass WITHOUT changing the mem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > IsDebuggerPresent - how to bypass WITHOUT changing the mem
PDA

View Full Version : IsDebuggerPresent - how to bypass WITHOUT changing the mem

Fahr
05-07-2004, 08:17 AM
Hello all,

I'm working on an ASPR packed file, no problems there (thanks to hobferret and LaBBa) and I was just wondering if it would be possible to bypass IsDebuggerPresent in some other way.
What I do now is break on IsDebuggerPresent, step twice and change the value in the memory that is going to be written to EAX. No probs, all runs fine.
However, I also tried to fix the JE that tests the AL after the call to IsDebuggerPresent. I also tried to fix the value in EAX itself after the call. In both cases everything goes bad!
For some reason, if I do anything else than changing the value in memory (like fixing the jump or changing EAX), the packer code eventually lands in either a data segment, an endless loop or at 0.
Not that it's really NEEDED to bypass it some other way (though it would be more convenient when writing a loader), I was just wondering WHY it goes like this. Logically, I'd say fixing the jump or EAX should take care of it. There is only one call to IsDebuggerPresent, so why does it only work when I change the value in memory?

Maybe someone can shed some light on this issue.

Thanks,
- Fahr
nikolatesla20
05-07-2004, 09:01 AM
If you change the JE, you are modding the program code, and it no doubt detects this with a CRC routine of some sort. Also, if you wait until the code returns, and then change the value in eax, you are once again "modding" the code in a way because you are setting a breakpoint in the code.

The safest and most effective way to modify IsDebuggerPresent detection is to edit the Program's thread block. This is easy in OllyDbg. You can do this before the program even starts to run, after Olly loads it.

NOTE THIS example works for Windows 2000 / XP.

Open your program in OllyDbg. Note the value of the FS register. On my 2000 system, it's 7FFDE000. Go to the hex dump window in Olly (at the bottom) and right click and say Go To->Expression and type in this value.

Now, at FS[30], which would be 7FFDE030 on my machine (30 bytes in ) there is another address, this points to the program's thread environment block (TEB). Select this address in the window by clicking and selecting it, then right click and say "Follow DWORD in dump". This address by the way in my 2000 system is 7FFDF000.

Now, 3 bytes in you will see a 01. This is telling windows the program is being debugged. Change it to a zero by selecting it, and just start typing in zero, zero. Olly brings up the memory edit window, after entering the zeros just push ok and now you are hidden from the IsDebuggerPresent detector, and you didn't modify or edit any program memory or API memory. In fact, the program hasn't even started yet.

-nt20
SHaG
05-07-2004, 09:09 AM
There are also plugins for OllyDbg that do this shit for you...
- IsDebuggerPresent by Asterix
- OllyScript v0.8 by SHaG (that's me =) )
Fahr
05-07-2004, 09:11 AM
If you change the JE, you are modding the program code, and it no doubt detects this with a CRC routine of some sort. Also, if you wait until the code returns, and then change the value in eax, you are once again "modding" the code in a way because you are setting a breakpoint in the code.

True, but setting a breakpoint seems to have no real effect; if I set a breakpoint on the CALL to IsDebuggerPresent (not INSIDE the call, but on the statement where it is called) or a few lines before it, then trace into the call and modify the mem, it runs fine...
Also, when I change the JE to JMP, then jump it, then change it BACK into JE, it also goes WRONG.
Even more extreme; if at the JE (which it doesn't take), I change the EIP into the value it SHOULD jump to (then I didn't modify anything), it goes wrong!
This is so bizarre...

Open your program in OllyDbg. Note the value of the FS register. On my 2000 system, it's 7FFDE000. Go to the hex dump window in Olly (at the bottom) and right click and say Go To->Expression and type in this value.

Now, at FS[30], which would be 7FFDE030 on my machine (30 bytes in ) there is another address, this points to the program's thread environment block (TEB). Select this address in the window by clicking and selecting it, then right click and say "Follow DWORD in dump". This address by the way in my 2000 system is 7FFDF000.

Now, 3 bytes in you will see a 01. This is telling windows the program is being debugged. Change it to a zero by selecting it, and just start typing in zero, zero. Olly brings up the memory edit window, after entering the zeros just push ok and now you are hidden from the IsDebuggerPresent detector, and you didn't modify or edit any program memory or API memory. In fact, the program hasn't even started yet.

This is VERY interesting! I usually do it like this; I put a BP on IsDebuggerPresent, then once it breaks, I step twice, follow the address in mem and change the value (which is at 7FFDF002, like yours).
Is there a generic way to determine this TEB and the address of the debugger 01? One that will work on all platforms? That way I could disable the IsDebuggerPresent byte before running the actual program (from a potential loader).
There is a isDebuggerPresent hider plugin for OllyDBG, which uses the OllyDBG API to do about the same as far as I could see...

Thanks,
- Fahr
Fahr
05-07-2004, 09:13 AM
There are also plugins for OllyDbg that do this shit for you...
- IsDebuggerPresent by Asterix
- OllyScript v0.8 by SHaG (that's me =) )

Thanks, I knew the first one, I'll look into the second one.
But I am more interested in how it actually works and why it doesn't than tools to bypass it (I can pretty much bypass it by hand).

Thanks,
- Fahr
Ricardo Narvaja
05-07-2004, 09:48 AM
Varios debugger not only detect the byte 7ffdf002 by the apis IsDebuggerPresent, also test directly the value of this byte, for this reason, if you don´t change the value in memory to zero, the program detect and don´t run.

Ricardo
Fahr
05-07-2004, 10:16 AM
Varios debugger not only detect the byte 7ffdf002 by the apis IsDebuggerPresent, also test directly the value of this byte, for this reason, if you don´t change the value in memory to zero, the program detect and don´t run.

Ricardo

That would indeed explain a few things...
new question now is; how do I find this byte by myself? I assume it's not always 7ffdf002...

Thanks,
- Fahr
Fahr
05-07-2004, 10:30 AM
I fiddled around a bit. At the beginning of the process I can read the value of FS from the Context I get with GetThreadContext.
However, this value is 0x38, just like in Olly at startup, it says FS is 0x38. Olly also states that it is somehow connected 7FFDE000; the full line is:

S 0 FS 0038 32bit 7FFDE000(FFF)

I can only select (and change) the 0038... so how do I get 7FFDE000 if I have the FS value of 0x38?

Thanks,
- Fahr
Ricardo Narvaja
05-07-2004, 10:37 AM
The packers uses generally the same lines of code of the api IsDebuggerPresent, but out of the api, in this form, the exe detect the debugger without the use of api IsDebug.
In my machine when i start a program, EBX point to the value, right click in ebx -follow in dump and the 3 value is the byte to change.

Ricardo.

I fiddled around a bit. At the beginning of the process I can read the value of FS from the Context I get with GetThreadContext.
However, this value is 0x38, just like in Olly at startup, it says FS is 0x38. Olly also states that it is somehow connected 7FFDE000; the full line is:

S 0 FS 0038 32bit 7FFDE000(FFF)

I can only select (and change) the 0038... so how do I get 7FFDE000 if I have the FS value of 0x38?

Thanks,
- Fahr
Fahr
05-07-2004, 11:09 AM
You are right! EBX points to the right location :)

Thanks a lot, you just solved all my problems :)

- Fahr
nikolatesla20
05-07-2004, 12:09 PM
I fiddled around a bit. At the beginning of the process I can read the value of FS from the Context I get with GetThreadContext.
However, this value is 0x38, just like in Olly at startup, it says FS is 0x38. Olly also states that it is somehow connected 7FFDE000; the full line is:

S 0 FS 0038 32bit 7FFDE000(FFF)

I can only select (and change) the 0038... so how do I get 7FFDE000 if I have the FS value of 0x38?

Thanks,
- Fahr

char KillIsDebuggerPresent (PROCESS_INFORMATION pi)
{
DWORD tib, pib;
LDT_ENTRY segselector;
CONTEXT TempContext;

TempContext.ContextFlags = CONTEXT_SEGMENTS;
GetThreadContext(pi.hThread,&TempContext);
GetThreadSelectorEntry (pi.hThread, TempContext.SegFs, &segselector);
tib = ((segselector.HighWord.Bytes.BaseHi) << 24) +
((segselector.HighWord.Bytes.BaseMid) << 16) +
(segselector.BaseLow);
//printf ("TIB @ %X\n", tib);

if (ReadProcessMemory (pi.hProcess, (void *)(tib+0x30), &pib, sizeof (pib), NULL) == 0)
{
printf ("Could not get PIB from TIB !\n");

return 0;
}
else
{
char debug_info = 0xFF;
// printf ("PIB @ %X\n", pib);
pib += 2;
if (ReadProcessMemory (pi.hProcess, (void *)pib, &debug_info, sizeof (debug_info), NULL) == 0)
{
printf ("Unable to read from PIB !\n");

return 0;
}
else
{
// printf ("Old debug value in PIB: %X\n", debug_info);
if (debug_info != 0x01)
{
printf ("PB value unexpected. Aborting!");

return 0;
}
else
{
debug_info = 0;
if (WriteProcessMemory (pi.hProcess, (void *)pib, &debug_info, sizeof (debug_info), NULL) == 0)
{
printf ("Could not write new value into PIB !\n");

return 0;
}
else
{
// printf ("PIB debug value override ok!\n");
return 1;
}
} // debug info
} // read pib
} // read tib
}

Shared with hopeful permission from Squidge.

-nt20
Fahr
05-08-2004, 10:11 AM
A generic way! That is exactly what I was looking for :)

Thanks to you and thanks to Squidge :)

- Fahr


IAT rebuilding question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > IAT rebuilding question
PDA

View Full Version : IAT rebuilding question

Silver
05-07-2004, 01:56 PM
Hi,

Followed the advice in the other thread, now I'm playing with aspack. I've aspacked Notepad and sucessfully found the OEP and dumped it. It of course doesn't run yet, but I've run araxis (compare tool) over it to double check I've got the right OEP. However now I have some questions:

1. It doesn't run because of a broken IAT. To fix this, I believe I have to run the packed notepad, dump the IAT from it, then add it into the one I dumped. I'm unsure how to find the IAT, and how to add it into the dumped notepad.

1b. Is the right way to do this, add a new section to the dumped exe, insert the dumped IAT at the raw offset, then edit the PE to point the IAT to the RVA?

2. The size of my dumped notepad is significantly larger that the original (not the packed one) notepad. Ie roughly: Win2k notepad.exe = 60k, aspacked version = 30k, dumped version = 90k. Why is this?

All replies appreciated. I've searched for some IAT rebuilding help, but most of the tutorials use tools (revirgin etc). I want to do this absolutely manually.
hobferret
05-07-2004, 04:19 PM
Silver :)

Have you tried searching for R@dier's tuts, if I remember correctly he did one on Aspack a while back :D

/hobferret
Silver
05-08-2004, 01:48 PM
hobferret, thanks for the reply. I can't find R@dier's aspack tutorial (although I find a few other things by him).

Actually, I don't really need a "How to crack Aspack". I need a generic "Ideas on how to find the IAT after the app has been unpacked, and how to import the good/fixed IAT into the dumped app". When I know the outline, I can work the rest out myself...

It's very frustrating, everything I find just says "use revirgin/imprec"...

**edit. Hold on, am I being incredibly stupid? If I use sice's map32 on it when I've got to the OEP, that will show me the sections. One of those will be the import table, so I can just dump it with /pedump. Is that correct? Still leaves the question of how I add it to the dumped exe though...
nikolatesla20
05-08-2004, 02:21 PM
There's nothing wrong with using ImpREC to do the hard work for you, letting it construct the IAT and adding a new section.

Yes, looking at the sections is usually a good start, you can usually tell on a lot of targets where the IAT used to be this way. Some protections, however, strip the section names out to screw you.

In that case, what I usually do, is put a BPX on some other API that i know is to be called. Then, just do a RET from that call back into the user code, and you will see where the API was called from. NOw, look at the call [xxxxxxxx] instruction that was in the code. Most API calls are like so:

in the code that calls the actual api:
CALL DWORD PTR[xxxxxxxx]

if you look at the xxxxxxxx in the CALL , it will point to the location of the original IAT. There is no overwriting that, cause it's in the code section. Only very few programs actually try to overwrite the CALL's into the IAT. Only SafeDisc is one that I know of that does.

Also, some programs use a "jump table" - instead of a CALL DWORD PTR they just do a CALL xxxxxxxx, and then at xxxxxxxx, there's a JMP DWORD PTR [xxxxxxxx]. It's the same principle, the JUMP goes into the table instead of the call. In either case, you can find the address xxxxxxxx by stepping thru the API that got called, because it must always return to the original code sooner or later, and then that xxxxxxxx value will point straight to the IAT.

-nt20
Silver
05-08-2004, 05:00 PM
nikolatesla20, thanks for the reply, that's helped a lot. I know there's nothing wrong with using imprec/revirgin for this, but I want to do it myself manually a few times just to be sure I understand the process.

From your reply, I see I'm doing the right thing by creating a new section and importing the dumped IAT into it, then modifying the pe to point to it. I have some further questions though.

I know I can identify the end of the IAT by 5 dwords (0x00000000), but how do I identify the start? I understand that those 5 dwords are part of the descriptor struct, and that they appear at both the start and the end of the IAT. The ones at the end will be all 0's, but the ones at the start will not be 0x00000000 by definition, as they contain data for the first chunk.

I can follow the jmp in sice and scroll up from where it lands, but I'm not sure how to make sure I've got the start of the IAT.

Also, maybe I'm missing the point here, but when the exe is unpacked in mem shouldn't there be something that points to the RVA of the good, unpacked IAT? Why can't we locate & use that instead of manually looking for it?

Thanks for putting up with the questions :D
Silver
05-10-2004, 11:41 AM
*bump* anyone able to offer some advice on my msg above (how to find the start of the IAT)?
br00t_4_c
05-11-2004, 08:52 AM
Silver, I believe the easiest way of finding the IAT is to do the following:

1) At offset 0x3C you find the (DWORD) RVA to the PE header.
2) Now go 0x80 bytes into the PE header and you should see the (DWORD) RVA to the first IMAGE_IMPORT_DESCRIPTOR in the IAT. But remember that this is a virtual adress so you will have to convert it to an offset in the disk-based file. This can be done by opening the file in your favorite PE editor and seeing which section of the file would fall inside of. Then find the raw offset that corresponds to the virtual offset and you're good to go.

You may also want to check out the following tutorial by Yates he explains it in much greater detail and far more eloquently... well I found it quite useful at any rate....

hxxp://its.mine.nu/html/re/essays/Import_Tables.html

Good luck :D
JMI
05-11-2004, 10:52 AM
Why not read the version of the Yates article on the import table which is already located here and found in the link at the bottom of the Forums?

It's at:

http://66.98.132.48/yates/Import_tables.txt

Regards,
br00t_4_c
05-11-2004, 11:02 AM
Yes, yes... what JMI said :cool:
Silver
05-11-2004, 12:30 PM
Thanks guys, that is precisely what I was looking for. Not sure how I missed the Yates one, I think my brain went to sleep after looking through hundreds of tutorials that just said "use revirgin".

Thanks! :D
JMI
05-11-2004, 12:52 PM
You might want to also try something really off the wall and go to your favorite search engine and enter something really daring, such as "import table rebuilding." Just a thought. :cool:

Regards,
Silver
05-13-2004, 10:49 AM
JMI, try that on Google. The first hit is some tutorial code to do it, the next few pages are junk. Hence my post :D

Off on holiday for a bit now, back in a few weeks!

Oh, while I think of it, can anyone offer an explanation as to the size difference (my original post question). More accurately:
Original notepad: 49.7 KB (50,960 bytes)
Aspacked notepad: 36.5 KB (37,376 bytes)
Unpacked/dumped notepad: 66.0 KB (67,584 bytes)
dELTA
05-13-2004, 11:56 AM
About the size issue, my guess would be that the PE section(s) added by Aspack is still left in the file after it's dumped, you must remove them manually. Looking at the PE sections (in the PE header of the file) and their sizes should be able to give you some good clues anyway.


Newsrover hiding files?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Newsrover hiding files?
PDA

View Full Version : Newsrover hiding files?

dgnt
05-08-2004, 01:52 AM
I uninstalled Newsrover quite a while back and today when I installed a new demo it said my 30 day trial had expired. I unistalled again and deleted all I could find in the registry but it didn't help, is there any way to find out what their hiding on my computer?
Aquatic
05-08-2004, 02:27 AM
filemon/regmon.

http://www.sysinternals.com/ntw2k/utilities.shtml

I think they can track everything.

hint: Check regmon as app gives 'bad boy' msg.
dgnt
05-08-2004, 04:57 PM
filemon/regmon.

http://www.sysinternals.com/ntw2k/utilities.shtml

I think they can track everything.

hint: Check regmon as app gives 'bad boy' msg.

Thanks, I'll give both a try.
R@dier
05-09-2004, 07:02 AM
@dgnt
Also try regshot.
take a shot before install then again after it will show you the differences in your registry
It’s a handy tool

R@dier


cm2 + spliced code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > cm2 + spliced code
PDA

View Full Version : cm2 + spliced code

DariuZ
05-08-2004, 06:57 AM
got a lill question here...
i cant seem to get to the spliced code snippet at this app that uses cm2, tried every solluton i could think of... no luck sofar...

so if anyone has any nice ideas feel free to point them out ;)

//Dar
naides
05-08-2004, 07:37 AM
I don't have ideas, nice or otherwise because I don't have the foggiest idea what you are talking about.
May be if you re-phrase the question, assuming that we cannot see what you have done in your computer, do not routinely splice code snippets using cm2, or even know what the fuck cm2 is?
DariuZ
05-08-2004, 08:31 AM
well i got it now neways

still this is a topic in Packing and Unpacking, dont think anything needs more explanation..!
dELTA
05-08-2004, 08:44 AM
Well, if that makes you feel l33t I guess that's up to you, but if you want helpful replies I'd suggest you'd be a lot more specific than that too...
DariuZ
05-08-2004, 05:22 PM
Well, if that makes you feel l33t I guess that's up to you, but if you want helpful replies I'd suggest you'd be a lot more specific than that too...

c'mon, "feel leet" ...u kiddin?
i dont wanna start anything here, so ill just say doh. im still in the stadium of learning arma and have a far way to go still.

And mm ok the question was a bit vague... :O so ill just drop it here...


Acoustic cryptanalysis
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Acoustic cryptanalysis
PDA

View Full Version : Acoustic cryptanalysis

disavowed
05-08-2004, 02:57 PM
Interesting stuff: http://www.wisdom.weizmann.ac.il/~tromer/acoustic/


hardlock emulation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > hardlock emulation
PDA

View Full Version : hardlock emulation

Ziggy
05-08-2004, 03:32 PM
Hi.
Does anybody can help to emulate such functions:
HLM_CHECKEXPDATE
HLM_CHECKALLSLOTS

i'm talking about kernel-mode (driver level) emulation.
thanks for you answers.
SysCall
05-10-2004, 01:46 PM
Hi,

do you really need to go kernel mode?
Some years ago (almost forgot) i emulated the HL API at user mode level by implementing HL API providing my own hlvdd.dll.

About kernel mode ... a good disassembly/analysis/deadlist of the kernel mode driver and its user mode equivalent (hlvdd.dll) + the HL API SDK should give some hints...

Regards
Ziggy
05-13-2004, 07:36 AM
Hi,

do you really need to go kernel mode?
Some years ago (almost forgot) i emulated the HL API at user mode level by implementing HL API providing my own hlvdd.dll.

I also tried to make HLM emulation in such way...
But I have no possibility to discover emulation for HLM_CHECKALLSLOTS, coz I have no information about... and also have no dongle to log it's requests\responses...
Have you emulated HLM_CHECKALLSLOTS in your's hlvdd.dll?
Maybe you could help me about this (we can talk in private)

About kernel mode ... a good disassembly/analysis/deadlist of the kernel mode driver and its user mode equivalent (hlvdd.dll) + the HL API SDK should give some hints...

I'm fully agree with you, but as you know that it's a large amount of obfuscated code there... Now I'm trying to discover HLM_CHECKALLSLOTS in hlvdd. It needs a lot of time and patience... ;)
but there is so few information about HLM (RUS) functions in SDK...

thanks.
SysCall
05-13-2004, 02:10 PM
Hi,

Have you emulated HLM_CHECKALLSLOTS in your's hlvdd.dll?

that was not necessary at the time i used to emulate the user mode driver.
(the app used a subset of HL API so i implemented only necessary stuff :cool: )

Look into the HL API SDK, the C data structures (HL_LIS) of the functions are described there (.pfd, the header files ...).

I quote the relevant info (which is freely available, i downloaded the SDK some years ago from their public ftp)...

There might have been some bits changed but should give you some hints/ direction ....

HLM_CHECKALLSLOTS(BUFLEN,BUFFER)
Checks all slots (LiMaS only).
Arguments
BUFLEN After the function is performed, this variable returns the
actual buffer length occupied. The function only returns the
required buffer length if the value of the BUFLEN and
BUFFER variables is 0. (32-bit)
BUFFER Pointer to the HL_LIS data structure which contains the slot
and license information. Refer to "The HL-LIS Data
Structure" section for more information.
Return
The return value contains the API status.
Use
If you are using licensing, this function queries the current status of all slots.
Example
result =
HLM_LOGIN(29809,DONT_CARE,"HARDLOCK","@0=/&#s3",
RUS_VK, 0,"378p,IPX");
IF (result == STATUS_OK)
result = HLM_CHECKALLSLOTS(BUFLEN,BUFFER);
.
.
result = HL_LOGOUT();
ENDIF;

HLM_CHECKEXPDATE(SLOT,YEAR,MONTH,DAY)

Returns the expiration date (HL-RUS/LiMaS).
Arguments
SLOT Defines the slot number. Slot number 0 indicates the global
expiration date for local modules and Hardlock Server modules. For
Hardlock Server the expiration dates for the single slots (1- 32767)
can also be checked. (32-bit)
YEAR Pointer for the variable in which the expiration year is returned.
(16-bit)
MONTH Pointer for the variable in which the expiration month is returned.
(16-bit)
DAY Pointer for the variable in which the expiration day is returned
(16-bit).
Return
The system returns the API status (see chapter 4.1).
Use
If you use the expiration date option, this function checks when the license
expires. This can be done separately for each slot if you are using Hardlock
Server. The global expiration date (local and server) is returned using slot 0.
Example
result = HLM_LOGIN(29809,DONT_CARE,"HARDLOCK","@0=/&#s3", RUS_VK, 0,"378p,IPX");
IF (result == STATUS_OK)
result = HLM_CHECKEXPDATE(0, &year, &month, &day);
IF (result == RUS_DATE_EXPIRED)
PRINT("Global expiration date exceeded");
.
.
result = HL_LOGOUT();
ENDIF;

The HL-LIS Data Structure
The HL_LIS data structure contains the global license information.
current_date 16-bit Current date (days since 01.01.1999).
res 16-bit Reserved.
num_slots 32-bit Number of slots.
glob_exp_date 16-bit Global expiration date (days since
01.01.1999).
res2 16-bit Reserved.
slots[ ] Depending on
number of slots
Pointer to the first HL_SIS structure, see
below.
The HL_SIS data structure
The HL_SIS contains license information for the individual slots.
max_user 32-bit Maximum available licenses.
cur_user 32-bit Number of licenses currently being used.
exp_date 16-bit Expiration date for this slot.
flag 8-bit 0 No singularity: Multiple calls of the
slot on one computer take up the
equivalent number of licenses.
1 Singularity: Multiple calls of the slot
on one computer only take up one
license.
reserved 8-bit Reserved.

typedef _PACKED struct ALIGN_ { /* HL_LIS slot information */
Long max_user;
Long cur_user;
Word exp_date;
Byte flag; /* singularity flag */
Byte res; /* filler to make structure size multiple of 4 bytes */
} ALIGN_GCC HL_SIS;

/* License Information Structure (HL_LIS) */
typedef _PACKED struct ALIGN_ {
Word current_date;
Word res;
Long num_slots;
Word glob_exp_date;
Word res2; /* filler to make size multiple of 4 bytes */
HL_SIS slots[1];
} ALIGN_GCC HL_LIS;

Regards


Win2003 Server Activation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Win2003 Server Activation
PDA

View Full Version : Win2003 Server Activation

Alorent
05-09-2004, 05:07 AM
Hello,

I downloaded Windows 2003 Server and as you all may know, it needs to be activated before a month or so. My main intention is not to make a crack for it, but to learn another way in cracking and not just crack an ordinary application.

I was thinking which files I should "manipulate/crack" in order to avoid the activation license...I also tried to install SoftIce but no luck. THe problem is that for me, I have no clue where to start at, because this is not like a normal program that needs to be cracked. The patch could be in any module inside the OS, I think.

Any directions about where to start "attacking" to get rid of the Activation?

Thanks a lot.
dELTA
05-09-2004, 08:17 AM
You should be able to get hold of quite a lot of information about this protection with google. Start there and see where it leads.
skydeath
05-11-2004, 10:06 PM
When you activate your windows XP/2003, your activation key is store in the %systemroot%\system32\wpa.dbl

I think it's winlogon.exe which control if the key is valid (not verifiied) and I think the key file doesn't work on another Windows without the same hardware (harddisk id, graphic card id, motherboard id,....)


Forums...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Forums...
PDA

View Full Version : Forums...

Silver
05-09-2004, 06:11 AM
Anyone know what's happened to board.win32asmcommunity.net - it's been broken for ages. Also, anyone know why exetools forum has become private? I used to have an account there, but it seems to have been deleted...
sgdt
05-09-2004, 06:48 AM
Anyone know what's happened to board.win32asmcommunity.net - it's been broken for ages. Also, anyone know why exetools forum has become private? I used to have an account there, but it seems to have been deleted...

First, question #1. I have no idea, but I *thought* OllyDebug's forum was off of there, and it's up (usually). Considering the time (sleepy), I'm probably mistaken, though.

Question #2. If you had registered with their site using an e-mail that is either no longer valid or if you accidently bounced back a message from them, your account was probably removed. They might also delete if there is a period of post inactivity, but I'm not sure.
dELTA
05-09-2004, 08:13 AM
The win32asm board seems to have a problem with the vBulletin software, possibly after a failed upgrade or something like that. Hopefully they should be restored soon.

I don't think the Exetools forums have gone private, your account has most likely just been pruned due to inactivity, have you tried to create a new one? For a definitive answer, I'm sure JMI can offer a comment.
Silver
05-09-2004, 12:00 PM
I think I got pruned due to inactivity. I was away for a long while. When I try and log in with my old u/p, it fails. If I try and create a new account, it says (to the effect of) "The administrator has disabled this".

Odd.
JMI
05-09-2004, 12:48 PM
As for exetools, it has not gone private. At the moment it has over 14,000 "registered" members, most of whom simply "registered" to get access to the ftp. Recently Aaron announced that he was tired of getting email bounces from "members" with invalid email accounts and that he was going to start deleting those without valid email after May 1, 2004. Actually I had been a member for a sufficient time that the original email I had registered with was no longer valid and needed updating. :eek:

Then he decided that the ftp access needed to be changed. There were so many people on the ftp all the time that the "regular" users of the Forums had difficulty gaining access. Also there was too much non-programming material being uploaded. As a result Aaron instituted a second policy change requiring at least 10 posts for access to the ftp. He has also announced that those who don't post often, but upload some useful things will be given consideration. Again only programming related materials are permitted.

He has also closed new registrations for the time being. He has said that it will remain closed this year, but he may reopen after he has had time to prune the huge membership of its dead wood. He has also announced that if a "registered" member does not post for six months or visit for three months, their account will be deleted. We'll have to see what happens after the cut-down is in place for a while.

Regards,
Silver
05-09-2004, 03:10 PM
Ah right. That's a real shame, I was away for a long time so couldn't get on the forum. I didn't post much, I spent time reading what was there (had little use for the ftp).

Any chance of getting an account before next year? :D
JMI
05-09-2004, 06:28 PM
The decision on whether or not to reopen registration and when is solely up to Aaron. Looking at the listing on the bottom of exetools this afternoon I notice that the "registered" members are now down to 3,800+, so some 11,000+ "registered" members have been culled. After he sees how that goes for a while, he may re-open registration again. I really do not know.

Regards,


How should I create INC for NICE 4.3.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How should I create INC for NICE 4.3.1
PDA

View Full Version : How should I create INC for NICE 4.3.1

Timbo
05-09-2004, 10:21 AM
Anyone could teach (show) me how to create a valid NTICE.INC for the
NTICE 4.3.1 B1722 with the old INC's of the id6026 (old).
I haven't done scripting with IDA ! Is it possible or do i have make it
by hand ?
Kayaker
05-09-2004, 11:35 AM
Hi

I think this script by Toteu is what you want:

http://66.98.132.48/forum/attachment.php?attachmentid=479

in thread
http://66.98.132.48/forum/showthread.php?t=3982
Timbo
05-13-2004, 02:41 PM
Well have to make it by hand coz to many differences
Thanks
djnz
05-19-2004, 02:13 PM
Hey,

I wrote a script some time ago, to aid me in adding support for an unsupported version of softice.
The script loads an .inc and names the addresses based on it's contents.
So, you need a version of ntice.sys that's currently supported, run the script against this,
then try locate the same addresses in your disassembly of the unsupported ntice.sys and name them accordingly.
You could reduce your workload by checking which names are actually used by icedump, since they're not all used.
Once you have the disassembly named, you can either construct a new .inc manually, or by using a script that dumps user changes.

Good luck
(The script is attached to this post)


Unpackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Unpackme
PDA

View Full Version : Unpackme

oyang2003
05-09-2004, 10:41 AM
I searched on google and found nothing detailed,
and i can understand only English.

Regards.
Alorent
05-09-2004, 11:07 AM
Do you have any target that uses latest version? it seems that Obsidium doesnt release more updated demo versions....
oyang2003
05-10-2004, 07:33 AM
Do you have any target that uses latest version? it seems that Obsidium doesnt release more updated demo versions....
It's a unpackme. PEiD report 1.1.1.4.

I have dumped it and have not reparied its import table.
And i'm not sure if the stolen codes are OK,i'll leave it at
the last.:D
evaluator
05-11-2004, 04:52 AM
wooh!
we very-very love unpackmes, where it is!?
Js
05-11-2004, 07:25 AM
wooh!
we very-very love unpackmes, where it is!?
How about make it a mini project?
oyang2003
05-11-2004, 09:28 AM
How about make it a mini project?
I have defeated it.:D

Here it is. It is a .rar but the forum refused to
take it so strip the .zip :p
evaluator
05-11-2004, 01:42 PM
so now we can see, this is protected keygenme..wrong title..
oyang2003
05-12-2004, 12:33 AM
so now we can see, this is protected keygenme..wrong title..
It was used as a examination to unpack,no need to
write a keygen,upacking is enouph.:D


Unknown packer and how do generic OEP finders work???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unknown packer and how do generic OEP finders work???
PDA

View Full Version : Unknown packer and how do generic OEP finders work???

yaa
05-09-2004, 01:01 PM
Hello,

I casually discovered a delphi application to be packed by an unknown packer. All file analyzers I utilized simply detected the application as a delphi application. Anyhow PEiD's generic unpacker plugin succeeded in correctly identifying the OEP and unpacking it (on w9x systems also Christoph Gabler's old Startup Code Unpacker was succesfull in unpacking the application). Although I can now crack it with no problems I'd like to understand more about what I've faced.

The unpacked application has an additional PE section (named .snaker). Also, the packer loader checks for the presence of a debugger (IsDebuggerPresent is called) and has code that checks for the integrity of wide areas of the loader's own code. The function that does the integrity checking is the following:

00809E20 /$ PUSH EBX
00809E21 |. PUSH ESI
00809E22 |. PUSH EDI
00809E23 |. TEST EDX,EDX
00809E25 |. JBE SHORT Xselerat.00809E6E
00809E27 |. MOV EBX,ECX
00809E29 |. AND EBX,0FFFF
00809E2F |. MOV ESI,ECX
00809E31 |. SHR ESI,10
00809E34 |. AND ESI,0FFFF
00809E3A |. MOV EDI,EDX ; EDX contains the number of bytes
00809E3C |. DEC EDI
00809E3D |. TEST EDI,EDI
00809E3F |. JL SHORT Xselerat.00809E65
00809E41 |. INC EDI
00809E42 |. MOV ECX,EAX ; EAX contains the start address
00809E44 |> /XOR EAX,EAX
00809E46 |. |MOV AL,BYTE PTR DS:[ECX]
00809E48 |. |ADD EAX,EBX
00809E4A |. |MOV EBX,0FFF1
00809E4F |. |CDQ
00809E50 |. |IDIV EBX
00809E52 |. |MOV EBX,EDX
00809E54 |. |LEA EAX,DWORD PTR DS:[EBX+ESI]
00809E57 |. |MOV ESI,0FFF1
00809E5C |. |CDQ
00809E5D |. |IDIV ESI
00809E5F |. |MOV ESI,EDX
00809E61 |. |INC ECX
00809E62 |. |DEC EDI ; exit the loop when EDI is zero
00809E63 |.^ \JNZ SHORT Xselerat.00809E44
00809E65 |> MOV EAX,ESI
00809E67 |. SHL EAX,10
00809E6A |. ADD EAX,EBX
00809E6C |. JMP SHORT Xselerat.00809E70
00809E6E |> MOV EAX,ECX
00809E70 |> POP EDI
00809E71 |. POP ESI
00809E72 |. POP EBX
00809E73 \. RETN

Has anyone got any idea about what packer this may be???

But at this point I'm indeed very curious about generic OEP finders (I suppose that generic unpackers simply dump the application on the OEP and try fixing the IAT). I wonder how do they work? What common property among packers do they take advantage of to identify the OEP? Any insight into this most fascinating question is most welcome.

Thx.

yaa
nikolatesla20
05-10-2004, 09:35 AM
One of the most common things a generic unpacker can look for is code execution that finally reaches the code section.

For example "most" packers put there unpacking code in higher memory. It has to, since the real code of the original program can't be moved in memory (not unless they patched every single address reference). The compiler put the imagebase address at a specific point in memory and without a relocation section (which most EXE's lack) the program code HAS to stay at this imagebase. (DLL's can move around).

Anyway, all a generic unpacker really has to do is look for code execution that falls within the first or second EXE section. Most packer code is definitely going to be higher in mem than this, and the packer code is what starts first, so that means that eventually a basic packer is going to have to unpack the program, and jump to the original code. It's when this code starts that you know you are probably at the OEP.

This is kinda how the "trace" in some unpackers works. Like Revirgin's trace.

-nt20
yaa
05-10-2004, 11:32 AM
nikolatesla20,

your explaination about packer's loader code usually having to work at high addresses is illuminating indeed. I never thought of it. How idiot I am.

But I wonder, couldn't packers steal a few of the app startup instructions (moving just a few instructions and eventually recalculating a few relative addresses isn't a big deal) and move them in higher addresses??? Or viceversa, couldn't they find a few holes in the original application code and use those hole for their own code??? This would probably fool any generic unpacker unless the unpacker has been coded to look for well known function prologues ... but then these vary depending on the language and compiler used .. and probably even compiler settings (speed/size optimizations).

yaa
nikolatesla20
05-10-2004, 12:05 PM
Yes some do steal some of the starting code , this is known as "stolen bytes" in the ASprotect packer world.

However, you will find thru exerience in unpacking that a large amount of the time stolen bytes are actually uneccasary for the program to run. You can usually get away without having them.

Other programs, more advanced protectors, do replace instructions in the original program. Actually most of the time, they simply make a new import table with addresses that point to the protector's code. There are very few protections which actually go to the trouble of modding the code itself in the program (SafeDisc is one that does).

Since the code eventually has to reach the first section, it's pretty tough to "disguise" it's execution. SO most packers try to instead prevent debuggers, etc, from watching what they are doing.

Another unique solution that a protection known as SoftProtect does, which is very original, is it scans for RET instructions in the target when it's packing it. It then puts addresses of these instructions into a table, and when it comes time to "jump" to the OEP, it simply does a type of "stack unwind" - it pushes the beginning of the table unto the stack, and does a RET. This causees the processor to jump to the first address listed at the beginning of the table. And where does this address lead? Why , to another RET of course, which causes the processor to again pop off the next address off the stack and once again it finds another RET, and again, until it reaches the end of the table, and lands on the OEP address. This is very effective at preventing tracers, since the amount of RET's could be very large, and there will be numerous ones that get executed in the code section before actually reaching OEP. It is a very unique technique and I praise the author for coming up with it. However, it's weakness is the table. If you can find the table, you have the OEP, since it's at the end of the table! How do you know you are at the end of the table? Simple, you just compare each address in the table with the range of the code section. If it's still in range, it's a valid address, if not, you've reached the end of the table, and the last address you looked at was the OEP. So all you really need to do is find the beginning of this address-OEP-stack-unwind table.

So basically each protector has its own unique ways of trying to hide what it does, but the same as always, if it executes, you can watch/modify it. Just have to find what to look for.

-nt20
yaa
05-10-2004, 01:13 PM
But I wonder, how are imported function addresses updated???
I mean does the OS loader update the IAT even for the "wrapped" application imported functions or is the packer loader responsible for this task???

This is a point I've never been able to clarify.

yaa
nikolatesla20
05-10-2004, 04:05 PM
The packer loader is responsible to do this job.

-nt20
yaa
05-10-2004, 05:30 PM
But is this because even the original IAT gets packed? Because I suppose that otherwise the OS loader would update it .... or am I mistaken?

yaa
doug
05-10-2004, 08:58 PM
But is this because even the original IAT gets packed? Because I suppose that otherwise the OS loader would update it .... or am I mistaken?

yaa

more often than not, the imports are partially (or completly) wiped and rebuilt through various techniques (and this is generally what characterizes the packers) at run-time, usually in the last few steps of the packer, before it passes control back to the app.
%UNDEFINED%
05-10-2004, 09:00 PM
Basically the original IAT is stripped, although this is not true of all packers.
Most encryptors designed to hinder anyone from unpacking them, use API redirection and IAT emulation.
While I do not know how to exactly explain how it works, I know what it does.
From my experience, I have seen that the cryptors will remove all of the imports except one from each different DLL.
That is what is left of the original.
Based on that data the cryptor will find all of the needed Thunks, and place them elsewhere in memory and build a temporary IAT.
All API calls will go through this.
But it won't be dumped with the normal code/data/rsrc, and even if it was, its not a usable IAT.
This prevents the program from running if its dumped since no useable import table exists
yaa
05-11-2004, 03:46 AM
UNDEFINED,

if I understood correctly what you mean by API redirection and IAT emulation, to work either:

(1) all calls to APIs made in the application have their relative addresses corrected to point to the new programmatically built thunk of correct API addresses (your emulated IAT). In this case the original IAT isn't at all used.

or:

(2) the real IAT is used as a thunk, filling it with the addresses that lead to the real thunk of correct API addresses (your emulated IAT). This last solution would save the packed from having to correct all API calls made thru the application since they already point to the original IAT.

yaa
%UNDEFINED%
05-11-2004, 09:32 PM
Basically the second one, if your interested in some detailed reading, take a look at this essay by AndreaGeddon.

They go into great detail about how the import table is "rebuilt"
nikolatesla20
05-11-2004, 10:01 PM
UNDEFINED,

if I understood correctly what you mean by API redirection and IAT emulation, to work either:

(1) all calls to APIs made in the application have their relative addresses corrected to point to the new programmatically built thunk of correct API addresses (your emulated IAT). In this case the original IAT isn't at all used.

or:

(2) the real IAT is used as a thunk, filling it with the addresses that lead to the real thunk of correct API addresses (your emulated IAT). This last solution would save the packed from having to correct all API calls made thru the application since they already point to the original IAT.

yaa

The second one is usually the case. The reason is because a program usually has two "thunk tables". The "OriginalFirstThunk" and the "FirstThunk". The FirstThunk table is the actual table that the code , such as Call Dword Ptr[xxxxxxxx] instructions, which call into the API, point to (the xxxxxxxx is an address in the table). The FirstThunk table MUST be present then, because all code depends on it. The OriginalFirstThunk table is a backup of the FirstThunk table in case the FirstThunks are missing.

The O.S. Loader looks at the ImportTable and fills in the addresses of each particular DLL into the FirstThunk table. If the ImportTable does not have any entries, the O.S. loader will FAIL to load the program, it will say something like "Program initialzation failed". This is why packers have to leave at least one API call for each DLL that is imported, in the FirstThunk table - it's so the O.S. doesn't crap out. Some protections, like Armadillo, replace the entire Import Table (by Import table I mean the table which lists DLL names and DLL function names, not the actual table of addresses to functions - the table of addresses to functions is the "FirstThunK" table). BUT they still must always patch the DLL function addresses into the FirstThunk table. The FirstThunks cannot be moved (not unless you have a relocations section which tells the O.S. loader how to move it). Hence this is the greatest weakness of IAT redirection. One can easily find where the FirstThunks are and work on the addresses from there , usually some will be valid and point to real API calls, and others will point to redirected protection calls.

It really pays to study up on Import table structures, it makes unpacking 100% easier to understand.

-nt20
yaa
05-12-2004, 07:58 AM
As I see it, you could leave the FirstThunk there so that the OS loader will not complain and simply redirect all the CALL DWORD PTR [xxxxxxxx] instructions to point to a completely different addresses table.

I will read Andrea's tut, it seems just what I need to strengthen my understanding of how packers work.

yaa
nikolatesla20
05-12-2004, 11:30 AM
As I see it, you could leave the FirstThunk there so that the OS loader will not complain and simply redirect all the CALL DWORD PTR [xxxxxxxx] instructions to point to a completely different addresses table.

I will read Andrea's tut, it seems just what I need to strengthen my understanding of how packers work.

yaa

Yeah you could change the CALL's but it's a lot more work, and you have to make sure you don't miss one of them, or write over a CALL that isn't an API call. To do that you have to cross-reference every CALL with an API to see if it goes to the import table. It's possible but more complicated, that's why most protectors don't do it. Like I said, SafeDisc is one that DOES do this. The other reason is there might be a JMP table instead of calls. In either case, you have to most likely use a Disassembly engine to do it right, Disassemble the code, search for CALL DWORD PTR strings and check the address that follows to see if it's in the Import table region. Then you know you can patch it. So most protectionists are just too lazy / and / or stupid to add a Disassembly engine.

In the near future, my unpackers will contain a disassembly engine so they can more effectively find code sequences (Including OEP code). For example, some code sequences that do the same thing can actually be opcoded in different ways. All you really need to do is look for a "template". Not even exact instructions, just things like "look for this, does this item come after it, and then this next item is in there too? And in the middle is this item between them all? If so, this is probably the right spot..". So it would be opcode independent, instead it searches for actual code operations. Combine a disassembly with a regular expression engine and you have a powerful tool on your hands IMO. Someone needs to make this, I think I will sometime in my spare time.

-nt20
yaa
05-12-2004, 12:21 PM
The other reason is there might be a JMP table instead of calls.

Yes, I've seen that Borland compilers generate such jump tables.
It isn't even clear to me why they are used since they could just generate a direct jump to the dll function start instruction. A useless jump or anyhow one that could have been saved.

yaa
Dr.Golova
06-03-2004, 03:06 PM
Yes, I've seen that Borland compilers generate such jump tables.
It isn't even clear to me why they are used since they could just generate a direct jump to the dll function start instruction. A useless jump or anyhow one that could have been saved.
yaa

Borland use OMF object file, and this obj don't contain info about external symbols. For example linker start generate exe file from several obj's. In firs obj it fount reference (i.e. call) to some external symbol "my_cool_proc", but linker don't know is this symbol some function from dll or it's some public function from another obj file. So linker remember addres of this reference and if found this symbol in next obj, link this call to function, if all obj linked it start scan import libraries, add jmp d,[xxxx] table for each needed symbol and link references to this table. Ofcource, compiler (obj generater) also used in this shit - if compiler cnow this symbol is in dll it can generate direct call d,[xxxx] as modern compilers do.


DirectX interface names
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DirectX interface names
PDA

View Full Version : DirectX interface names

omega_red
05-10-2004, 11:49 AM
Is there a way to see names of called methods of direct3d object under the debugger? Even with debug versions of dlls from DX SDK neither SoftICE nor Olly nor WinDbg shows the names. It's only something like "d3dim!Direct3D_HALCleanUp+abcde".
Or maybe there is another way to see which method is called anyway? ;)
Silver
05-10-2004, 01:59 PM
Sure, you need the symbols installed though.

http://msdn.microsoft.com/downloads/list/directx.asp
(you'll need the extras pack, http://www.microsoft.com/downloads/details.aspx?FamilyId=42DA4820-7DE1-494A-B43D-F930B1649F93&displaylang=en)

http://msdn.microsoft.com/archive/default.asp?url=/archive/en-us/directx9_c/directx/intro/program/debugging/debuggingdx9.asp
omega_red
05-10-2004, 03:16 PM
Sure, you need the symbols installed though.

http://msdn.microsoft.com/downloads/list/directx.asp
(you'll need the extras pack, http://www.microsoft.com/downloads/details.aspx?FamilyId=42DA4820-7DE1-494A-B43D-F930B1649F93&displaylang=en)

http://msdn.microsoft.com/archive/default.asp?url=/archive/en-us/directx9_c/directx/intro/program/debugging/debuggingdx9.asp
Thanks a lot. Should be obvious that I'm missing symbol data :)
omega_red
05-13-2004, 12:08 PM
Well, I have the .pdb debug files for all DirectX DLLs. I have debug version of these DLLs. But how to feed them into SoftIce? ;)
When I try to load symbols for the DLL, either retail or debug, loader says that there is no debug information in it :confused:
I tried to put the .pdb files in the same directory as my exe (like SoftIce docs suggest), and in Windows system dir together with DirectX - no effect. Maybe I'm missing something obvious again ;]
Timbo
05-13-2004, 02:38 PM
Get the PDB files, translate them to nms and add the to your winice.dat
like this LOAD=?:\PATH\file.nms


Armadillo 2.x/3 DLL stub unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 2.x/3 DLL stub unpacking
PDA

View Full Version : Armadillo 2.x/3 DLL stub unpacking

SysCall
05-10-2004, 01:29 PM
Hello all,

first post ... congrats to this forum ;)

I have a target that just seems to me like a never ending story :(

It consists of .exe file and some .dlls.
The exe was packed with armadillo 2.xx? with CopyMem II technique and table destruction.
Though i never encountered armadillo before i was able to unpack the .exe manually and restore IAT+OEP with the help of ollydbg + ricardos tutorial (thanks man) in considerable amout of time.

Well ... the .exe started successfully and the reg dialog popped up.
So i thought easy game ... well was not.
The dialog does not come from the .exe itself but from one of its .dlls

I tried to trace it and later inject a helper dll (containg my nifty code) but failed.
The debugger locked up every time.
Using PeID it said packed with "Armadillo 2.51 - 3.xx DLL Stub".
Well .. seems every binary of this target is packed with armadillo :mad:

That problem of this target is, that the init/unpack + dialog code is called from entry itself = DllMain().
This causes the OS loader lock to get locked the whole time which in turn makes it impossible to load any additional code.
(i had to "break on dll load" + breakpoint on entry to trace it)

My idea was to redirect the entry point to an empty one (only saving the instance handle away).
Then i would add a special export to fake DllMain() call from external - this would allow me to inject additional dlls/code without the dreaded OS loader lock (and to quick brute the serial code (its XXXX-XXXX- ... style, 16 bytes num)).

Well it didnt work ... the code seems to unpack itself into some .PDATA000 section and check itself with some checksum code (it reads itself from disk).

I dumped the section to a separate file and it seem to contain some armadillo stuff...
I tried to fix the IAT but it didnt work at all, because some of the code calls back to original .text1 section.
The .PDATAxxxx section is dynamically allocated on heap and i'm not sure of its functionality...

Can someone shed any lights on this? I've searched the forum but did not found any occurences on armadillo dll stub unpacking.
Any hints welcome... :confused:

Thank you very much.
nikolatesla20
05-10-2004, 04:13 PM
Even tho this teaches you nothing,..

It's been forever since I wrote this, and since Arma no doubt has a new version which breaks it try this for older armas...2.85-3.xx ?

I don't remember which version I made it for.

-nt20
SysCall
05-10-2004, 05:15 PM
Hello again ;)

The tool seems to do its work in general - until the loader tries to load the (original?) dll.
It returns with lasterror=6 (invalid handle).
The loader gets the original dll supplied as parameter while its started as debuggee of unpacker.

The log window of the "unpacker" tool outputs this:

LoadLibrary called for xxxxx.dll
arma secu dll base: xxxxxxh (i guess this is the heap-allocated memory block that gets unpacked - i can see PE signature+sections there)
scanning secu dll
scanning secu export table
OEP aquired
setting OEP bp <---- reminder dialog pops up here and the unpacker waits until i press "ok"

IAT decrypt block found at xxxxx
scanning for import redirect..
OEP found xxxxx
protected dll loaded at xxxxh
dll size xxxxxh
dumped file created successfully (its like orginal file size + unpacked sections?)
...

-- imp rebuild stage ---
sanitizing iat, please wait...
dll OEP found: xxxxh
.rdata offset xxxxh
IAT cleaned and ready

The loader error seems to pop up asynchronously/immediately after i press the "ok" button of dialog.

I viewed the modules list of dll loader with process viewer (while its attached by unpacker) and it does not show the original dll.

The calculated OEP of the tool seems ok.
I had manually traced with ollydbg to same point

Any ideas ...
SysCall
05-10-2004, 05:57 PM
Another observation ... i debugged your loader (hope you dont mind hehe).

In the LoadLibrary() call where you load the target dll i never see the name of target dll (supplied by commandline) but the loader app name itself.

My "interpretation" to C code of your loaders disassembly:

...
int main( int argc, char* argv[])
{
....

// error here: argv[0]??
HINSTANCE hInst = LoadLibrary( argv[0]);
if( hInst == 0)
{
sprintf( buf, "error loadlibrary, getlasterror returns %d", ::GetLastError());
MessageBox( .... "dll loader error", buf, ...);
}
...
MessageBox( ... "Dllloader", "press ok when done...");

}

Really looks like ::LoadLibrary( argv[0]) instead of ::LoadLibrary( argv[1]) to me ... is this intended?

Or is there another way, the loader gets instructed which dll to load (environment var)?

Regards
nikolatesla20
05-10-2004, 09:00 PM
Yes, it "fails" like this on the newer versions of arma, and you are correct, it screws up for some reason by loading the wrong argument, good job debugging :)

I think at one point I tracked down the cause of the error but I never go around to fixing it 100% , it was a long while ago since I did this code hehe.

The dll I think still gets dumped clean...all you need to do is rebuild the IAT. And that's the only reason the loader waited for you anyway, after the dump it would keep the DLL in mem so you could do the IAT.

So just write down the info for where the IAT is (the offset) and run the original arma protected program and use ImpREC with that info to find the clean imports..use LordPE to get the protected DLL's imagebase, and then apply the IAT offset that the unpacker gave you to ImpREC to search for the clean IAT. This should work. Sorry for the malfunctions, the arma authors do a good job of keeping up with things.

-nt20
SysCall
05-11-2004, 12:51 AM
Hello,

So just write down the info for where the IAT is (the offset) and run the original arma protected program and use ImpREC with that info to find the clean imports..

i loaded the target in imprec and put in OEP, IAT offset (did auto search on later point, after dismissing reminder dialog).
It find _an_ IAT (the one from "--- import rebuild stag ---") but it seems to me some entries pointing to the dynamically heap unpacked memory block/dll.
They look like stubs:

.rdata offset (given by unpacker and/or auto search of imprec):

rva:xxxx: mod:kernel32.dll ord:xx name:GetVersionExA
rva:xxx4: mod:kernel32.dll ord:xx name:Sleep
rva:xxx8: ptr:00DA87F1 <---- stubs, point to in memory unpacked dll?
rva:xxxC: ptr:00DAxxxx
rva:xx10: mod:kernel32.dll ord:xx name:DeviceIoControl
....

The unpacked? dll base is 00DA0000 which seems to correspond with these entries (i found PE signature+sections there).
The protected dll base is 0x10000000 (just like every user created one).

What goes wrong here?

Thanks

addenum:

The dumped file contains the following sections:

.text
.rdata (IAT to be rebuilt?)
.data
.text1
.adata
.idata (the initial IAT of original protected dll?)
.data1 (data seg of arma dll?)
.reloc1
.pdata (the PDATA000 seg)

The .pdata seg starts with signature 'PDATA000',0 and after a few bytes the PE signature can be found (+11 bytes later)
nikolatesla20
05-11-2004, 11:53 AM
Ok,

I worked on it this morning, got new version for you to try. It works on my newer arma (3.50???). It was previously coded for 3.20.

Fixed DLLLoader
Fixed CreateProcess call to DLLLoader
Added new arma version

-nt20
SysCall
05-11-2004, 03:14 PM
Hello again ;)

I tried your proggy and the loader issue seems fixed.
But the fundamental problem is left ...

It dumps raw dll/sections to disk, starts the loader which loads the protected dll and waits for imprec.

It puts out following:

"*** IAT was not able to be hooked ***
this is probably newer ver of arma... dont have sigs for it.."

OEP found: xxxxh
.rdata offset xxxxh

Lemme try to understand some things... (correct me if im wrong, please)

The protected dll unpacks its .pdata section to dynamically alloc'd memory (heap).
The unpacked stuff itself is the security dll which is a valid PE file in memory.
The protected dll and the security dll "connect" function pointers to each other (SetFunctionAddresses) so one cannot exist without the other.
(i verified this because the protected dll has some public exports, that get called by main .exe later - which in turn call the security functions)
The security dll itself has a public IAT (in memory) and some "secret" function address table where it calls back to protected one.

The security dll verifies the protected dll's integrity by reading the file from disk and use crc like stuff?

Would the following idea sound feasible?

- dump the security dll from memory leaving PE image on disk, record the "public" IAT offsets (where to find OEP of it?) and the secret function table (offsets into protected dll)
- record the offsets of protected dll .rdata entries which go into security dll

- build a new IAT for protected dll, resolving to imports from security dll
(how can i do it while the security dll is a chunk in memory (not visible in module list), imprec wants to select protected dll but not memory chunk?)

One problem remains ... i dont know if the "callback" secret function table is used in any protected dll code (with new OEP)
If so it may be difficult.
Maybe its possible to convert this secret table to some IAT style, resolving the entries (callbacks to protected dll) by OS loader.

Any suggestions ... hints

Regards
SysCall
05-11-2004, 03:52 PM
Update ... i got the security dll dumped and fixed (though the initial dump address was < 0x400000 i simply set the image base to unpacked heap base address so all code/data references did match - it worked).

I can now see all imports of its .rdata section fine.
Ollydbg loads it with its loader helper and the DllMain() entry point gets successfully executed.

My next step would be to "connect" the security dll to the protected dll by trying to "reference" the redirected IAT entries to newly created dll.

How can i add a custom (security) dll to imprec?
Injection the addtional dll into loader process space doesnt help, imprec doesnt see it (can't select in import editor).
Before that i have to extend/recreate the export table of security dll (it only contains a single export "SetFunctionAddresses" for now).

Regards
nikolatesla20
05-11-2004, 04:08 PM
You don't need this security dll for anything.

I have to say, trying to explain how I go about unpacking this would take some time, and I just don't have it right now at this particular moment.

I'm making some more new sigs :cool:

-nt20
nikolatesla20
05-11-2004, 04:57 PM
Added Arma 3.60 support

Hmm there are so many versions, I think I 'll come up with a better search method :cool:

-nt20
SysCall
05-11-2004, 05:32 PM
Hehe .. will try to email the security dll later :)

I think i've found it ... unfortunately the app expired _just_ at this moment *arrrgg*
When the dialog pops up i set hw bp at projected IAT when the first entry is written, it breaks.
I looked around the code and found one conditional responsible for redirected table entries "destruction".
I nopped it and found it fully restored the IAT (using "dump" -> "display as long" -> "address").
Before i could use PUPE + imprec it was 00:00 and the dialog just displays expired info ...

Someone know where it stores the "installation timestamp" without diggin too deep to repeat that steps again?

Regards
SysCall
05-11-2004, 06:05 PM
I'm making some more new sigs

Hmm ... i guess you use opcode signatures to find the corresponding IAT build/restore code/conditionals right?

I noticed the following unique pattern/sequence which works for my version
(From the hardware breakpoint accessing instruction within 1000 bytes forward range):

protected .exe = Copymem II + table destr:

xxxxxxxx 83BD 08E7FFFF 0>CMP DWORD PTR SS:[EBP-18F8], 0
xxxxxxxx 75 3F JNZ SHORT 00AFF48F ; -> nop to restore whole table
xxxxxxxx 0FB785 0CE7FFFF MOVZX EAX, WORD PTR SS:[EBP-18F4]

protected .dll stubs + table destr:

same sequence!

cmp dword ss:[ebp-xxxx],0
jnz yyy ; must be nopped
MOVZX EAX, WORD PTR SS:[EBP-zzzz]
TEST EAX, EAX

Maybe there are easier ways ... nopping that conditionals and placing endless loop instruction outside of IAT rebuilder loop (to attach with imprec) worked for me...

Regards
nikolatesla20
05-11-2004, 07:07 PM
Hehe .. will try to email the security dll later :)

I think i've found it ... unfortunately the app expired _just_ at this moment *arrrgg*
When the dialog pops up i set hw bp at projected IAT when the first entry is written, it breaks.
I looked around the code and found one conditional responsible for redirected table entries "destruction".
I nopped it and found it fully restored the IAT (using "dump" -> "display as long" -> "address").
Before i could use PUPE + imprec it was 00:00 and the dialog just displays expired info ...

Someone know where it stores the "installation timestamp" without diggin too deep to repeat that steps again?

Regards

Good work ! Sounds like you have a good handle on debugging !

I usually term it the "magic jump" :D

You can put in an infinite loop if you really want, if you are doing it manually that will work fine. Nice work.

-nt20
SysCall
05-12-2004, 03:19 PM
Hello again :rolleyes:

For the sake of completeness...

To fix/track installation "timestamp", i used a native call interface (NCI) tracer, which works thru kernel mode.

(i read somewhere arma effects registry and file monitors so i didnt want to waste unnessary time).

By analyzing the log output i quickly identified the registry portions:

HKLM\Software\Licenses\[all keys]
HKEY_CLASSES_ROOT\CLSID\{xxxxx} (you will find out the specific one hehe...)

It also records some unique items from registry like bios version, date, computer name and from harddisks for example the disk geometry to calculate fingerprint keys.
They get stored into registry and temp file.

To detect clock reversing/forwarding it searches some well known directories for files, mask: "*" (bpx FindNextFile + pFindData + fileattr != DIRECTORY) and compares the file time to system time.
For example if it finds newer ones than system clock .. well thats a short circuit :D There are other (difference checks) too.

Just make sure the registry stuff is deleted, temp dir cleaned and pay attention to %windir% ;)

Of course all can be verified by either bpx on interesting kernel32 exports or using api tracer (to identify the key apis) or doing deadlist of security dll...

Regards


tElock 0.98b1, 7 renamed sections, 2x CRC32 poly
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > tElock 0.98b1, 7 renamed sections, 2x CRC32 poly
PDA

View Full Version : tElock 0.98b1, 7 renamed sections, 2x CRC32 poly

Fsound
05-11-2004, 01:23 AM
Hi there,

I am trying to debug a DLL-based dongle-emulator because I want to know, how it works.

It's protected with tElock 0.98b1 (information by PEID).
I am using the latest beta of Olly. This allows me to load DLLs.
OllyScript & TeLock-Script by "loveboom" have helped me to find the OEP: 64AE0F

Then I have dumped the file ... 499kb => 1,84mb
Next I tried to load the program with the unpacked dongle ... does not work.

Now PEID tells me that it's no more packed BUT 2x CRC32 poly inside :-(

CRC32 (poly) : 001D73BD : 005DA98D
CRC32 (poly) : 001D7A12 : 005DB012

Hey, let's crack the CRC-check
Then I have loaded the DLL in w32Dasm and wanted to go to the reference-address ... but it does not exist.

Damn, what am I doing wrong?


Canterwood's web site
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Canterwood's web site
PDA

View Full Version : Canterwood's web site

proletsearch
05-11-2004, 06:55 AM
I want to say hello to everyone and to share what I've recently found out surfing the net..

http://canterwood.online.fr/

some of the tuts are written in french, but you can use any translation software you have to translate them in native english and take a look at the links to the other sites, which you will see at the left bottom side of the web page..

Have a nice day/night
proletsearch


Splash - Loader
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Splash - Loader
PDA

View Full Version : Splash - Loader

Fsound
05-11-2004, 01:07 PM
Hi there,

as mentioned in http://www.woodmann.net/forum/showthread.php?t=5893, I've got a problem with a DLL, which loads a splash.

And yes: This DLL is loading the splash.
There is ONE splash inside the app and the other one in the DLL.

I unpacked TeLock and can access the bitmaps now, but I cannot change it because of the CRC32 check.

Would it be possible to create a loader, which removes the secondary splash?

Best,
Fsound
JMI
05-11-2004, 01:23 PM
Fsound:

We have been having this same discussion by PM, but it's time to post it openly. You keep posting questions that demonstrate that you have NOT done any preliminary research on your own before you ask a question. Let's assume someone answers your question that it IS possible to create such a loader. Your next question would, inevitably, be HOW?

What you need to do is actually do some research on how crc32 actually works and what loaders do and then show some of your own work as part of your question. As I stated in my previous PM, this is not a school to teach you the basics or to do your research for you.

It is time you got this message.

Regards,
Fsound
05-11-2004, 01:40 PM
The problem is, I have a job beside playing around on the computer.
I don't have time to read 1000 tutorials and learn how to cr*ck small apps.

I know there are people out, who can do it and who know, how to do it.

Would you learn how to cut your hair, if you need a haircut?
Would you study medicine, if your leg is broken?

It's all a give and take ... that's our (social) life!
dELTA
05-11-2004, 02:18 PM
Well, to continue on your analogy, exactly what are you offering in return then? Would any barber cut your hair for free? Would any doctor fix your leg for free?

Also, leaving the analogy, this is not a crack request forum no matter if you have something to offer or not, so why don't you run off to your precious life and stay there, huh? :eek:
Woodmann
05-11-2004, 06:31 PM
Ummmmmmmm.... Actually,

I just use the clippers to cut my hair down to the "wood" :D

As for home surgery, I do quite a good job, just ask the woman who lives with me, she is always bitching at me to not do it. :o

It's amazing what you can do with an exacto knife and some tape.

TA TA, Woodmann
JMI
05-11-2004, 11:46 PM
Let me just add my two cents worth also.

I have indeed been cutting my own hair with scissors, a comb and two mirrors since 1966. I was in college at the time. The only time someone else cut my hair was basic training, where I had no choice and had to pay for the priviledge of getting my head skinned.

As to your working excuse, I have been working full time for more than 30 years and learned what I know about reversing late in the evening and gave up sleep to read those 1000 tutorials you are avoiding.

So I have NO patience for your self indulgent winning about what YOU want and what YOU need and when YOU need it. Even if I wasn't tired of your excuses for not following our Rules, it should be obvious to you that management around here recognizes that your current attitude is reserving you a seat on the lamer bus.

Choose carefully how your chose to further flaunt your disdain for our Rules.

Regards,


dll dump questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > dll dump questions
PDA

View Full Version : dll dump questions

0rp
05-11-2004, 06:53 PM
k, i have a selfdecrypting dll, decrypted and bped at its oep.

if i use procdump to dump this instance, it doesn't work (DllMain returns FALSE). why does procdump LoadLibrary this image instead of doing some ReadProcessMemorys ? however, if i use other tools, i get a image, but this dump does not work.

i searched the forum and found some tricks (double load the same image, and diff them to get reloc differences), but i did not find a complete tutorial.

are there some tuts about this topic?

thx a lot
nikolatesla20
05-11-2004, 07:23 PM
If it's decrypted in mem and you are at OEP all you really have to do is dump it, and then set it's ImageBase to the mem location that it was at in memory. Hopefully the relocation table will be whole, which will allow the DLL to be relocatable properly.

Use LordPE to dump the dll out.

-nt20
0rp
05-12-2004, 02:19 PM
in olly, at address 4153BB, i have valid code. if i dump the dll using LordPE and load this dumped file with IDA, 4153BB doesnt contain valid opcodes.

if i search the whole dumped image for the opcodes at 4153BB, i don't find them. it seems this dumped image isn't decrypted.

whats wrong with my dump?
nikolatesla20
05-12-2004, 02:40 PM
in olly, at address 4153BB, i have valid code. if i dump the dll using LordPE and load this dumped file with IDA, 4153BB doesnt contain valid opcodes.

if i search the whole dumped image for the opcodes at 4153BB, i don't find them. it seems this dumped image isn't decrypted.

whats wrong with my dump?

Take a look at the ImageBase that LordPE says the DLL is at, and set that ImageBase on the file as well, using a PE editor (either LordPE or PEditor)

If the ImageBase isn't right IDA will get lost.

-nt20


Acoustic cryptanalysis
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Acoustic cryptanalysis
PDA

View Full Version : Acoustic cryptanalysis

neviens
05-13-2004, 03:11 AM
Hi!
Found an interesting article:

A powerful method for extracting information from supposedly secure systems is side-channel attacks: cryptanalytic techniques that rely on information unintentionally leaked by computing devices. Most side-channel attack research has focused on electromagnetic emanations (TEMPEST), power consumption and, recently, diffuse visible light from CRT displays. The oldest eavesdropping channel, namely acoustic emanations, has received little attention. Our preliminary analysis of acoustic emanations from personal computers shows them to be a surprisingly rich source of information on CPU activity...

Full text here:
http://www.wisdom.weizmann.ac.il/~tromer/acoustic/
Neviens.
naides
05-13-2004, 05:44 AM
Hi!
Found an interesting article:

A
Full text here:
http://www.wisdom.weizmann.ac.il/~tromer/acoustic/
Neviens.

Sorry neviens, you were scooped at

http://www.woodmann.net/forum/showthread.php?t=5883

I guess the article is so good that not one but two deep thinking reverse engineers found it relevant for the board!
neviens
05-13-2004, 07:05 AM
Huh, seems I have to read the board more carefully :(
Neviens.


ASProtect 1.23 RC4 - 1.3.08.24
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect 1.23 RC4 - 1.3.08.24
PDA

View Full Version : ASProtect 1.23 RC4 - 1.3.08.24

LaBBa
05-13-2004, 10:16 AM
Hi all ..

Well it's been a while since i wrote somthing about ASPR but just wanted all to have a look at this nice work of ASPR with this target :
hxxp://xxx.fmjsoft.com/download/stars26.zip

have fun...
Shoob
05-13-2004, 11:33 AM
Hi all ..

Well it's been a while since i wrote somthing about ASPR but just wanted all to have a look at this nice work of ASPR with this target :
hxxp://xxx.fmjsoft.com/download/stars26.zip

have fun...

Thats looks all quite old but should be new .... if you are lazy dump after the deep call at 0047A92F, fix iat and have fun ;(, after that remove the deep call that repz about 255 ~ bytes.
dELTA
05-13-2004, 11:52 AM
LaBBa, more specifically what makes this target an especially "nice work of ASPR", if I may ask?


Thinstall???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Thinstall???
PDA

View Full Version : Thinstall???

yaa
05-13-2004, 12:28 PM
Hello,

I casually found an application protected with thinstall.
I've seen there is but a single year old post on this packer. Has anyone dealt with it already??? I've searched with my friend goooogle but nothing, not even a single tutorial.

yaa
dELTA
05-13-2004, 06:10 PM
Maybe you should try your old friend "the forum search feature", and you'll get at least some more info about it...
yaa
05-14-2004, 03:55 AM
I did. Before posting.

yaa
JMI
05-14-2004, 04:24 AM
If you used the search function HERE, how come you don't know there are THREE posts here on this topic?

Regards,
dELTA
05-14-2004, 05:09 AM
Always try to reference any previous threads you know of regarding the same subject on the board, and also show what info you've currently got, like your efforts, your results and so on, and you will be much more likely to get any help.
BillyTh3Kid
05-23-2004, 02:07 AM
Hi to all the admins & moderators .

1stly i have searched whole of this forum .I got 4/5 posts regarding thinstall.I searched the whole of the net using google.In one of the post JMI has written r u aware there is a tool tht claims to unpack Thinstall. Also he had written search protools. Well out in protool therez no unpacker for thinstall. Also i know u mods r quite helpful .SO JMI will u plz gladly give me the link to tht tool claiming to be thinstall unpacker

Thanku
dELTA
05-23-2004, 04:55 AM
The mods are most helpful when someone is not breaking the rules, like asking for links to tools...
JMI
05-25-2004, 12:37 AM
And since you ARE breaking the rules, the answer in NO.

Regards,
BillyTh3Kid
05-26-2004, 11:12 AM
hi JMI

may be i am breaKING THE RULES by asking for the unpacker but in the tools section many ppl have uploaded diferent utilities .

so may be i was thinking if any unpacker exists for thinstall u can upload it in the tools of trade scetion.
JMI
05-26-2004, 11:31 AM
Your thought process is flawed. If you think you can flaunt our rules and still get what you want, you are demonstrating very immature behaviour. You will get no help from me with this attitude and should anyone attempt to post such a tool here, it will be deleted and you will be banned.

This better be very clear to you now. DO NOT repeat this behaviour.

Regards,


yet another softice bp question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > yet another softice bp question
PDA

View Full Version : yet another softice bp question

0rp
05-13-2004, 01:50 PM
i'm using driverstudio3.1 visual softice.

i added kernel32.dll with "addsym ......\kernel32.dll" and if i do a "bpx getlocaltime", i get "invalid process id".

i won't switch to any context, because my victim isn't loaded at this time.

where is my mistake?
thanks
doug
05-13-2004, 05:01 PM
i'm using driverstudio3.1 visual softice.

i added kernel32.dll with "addsym ......\kernel32.dll" and if i do a "bpx getlocaltime", i get "invalid process id".

i won't switch to any context, because my victim isn't loaded at this time.

where is my mistake?
thanks

so you are attempting to set a system-wide breakpoint.

You should first switch SoftICE's breakpoints mode to system-wide. Although I don't use ds3.1, I remember seeing quite a few guides on how to do that, here and/or exetools forum. It's been discussed many times already.

Or you should load your target and break at the EntryPoint, THEN context-switch into it & resume the process.

I attached a lame exe loader that does a CreateProcess( ... suspended ...)
try playing with that.
0rp
05-13-2004, 05:46 PM
so you are attempting to set a system-wide breakpoint

yes
and i read the thread from the faq, but:
SI>set BreakInSharedMods on
Error executing command.

anyways, creating suspended should work

thanks


ida misinterpreted data section as code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ida misinterpreted data section as code
PDA

View Full Version : ida misinterpreted data section as code

The Keeper
05-13-2004, 04:40 PM
Hello,

the data section of my program has 0xC0000040 characteristics, when i disassembled my program in ida
it shows data section as code, i have to convert all this manually to strings, i changed the data section
characteristics to 0xE0000020, but now i want ida to reanalyze just the data section, is it possible ?
if not, will reanalyzing the whole program gonna make ida show data as data and not as code ?

best regards
The Keeper
The Keeper
05-14-2004, 03:27 PM
move to tools of trade please.
Kayaker
05-14-2004, 04:03 PM
Hi

Moved.
I'm a little confused, you say the data section was C0000040, which is normal for a .data section, then you changed it to E0000020, which signifies an executable .code section. Unless this was a typo, I'd say leave it at C0000040.

You can select a block of data (use the Edit function Alt-L to begin selection then scroll to end, right click and select Data to convert). To be honest your question about - will reanalyzing do such and such - kind of begs the answer, why not just try it and find out?

Kayaker
Hopcode
05-14-2004, 04:32 PM
Hello,

the data section of my program has 0xC0000040 characteristics, when i disassembled my program in ida
it shows data section as code, i have to convert all this manually to strings, i changed the data section
characteristics to 0xE0000020, but now i want ida to reanalyze just the data section, is it possible ?
if not, will reanalyzing the whole program gonna make ida show data as data and not as code ?

best regards
The Keeper

What about idc ?
AnalyseArea should do the trick.

you are not forced to make a script to use IDC statement, use calculator or "command line" (look config file)

Cheers.
The Keeper
05-14-2004, 09:23 PM
Hello,

Kayaker, its a 200mb database, i'd rather ask than loose a full day disassembling the program. the section characteristics was not a type, ida recogized the data section as code, so maybe setting it as code ida would recognize as data :P

i can select all the data section and then type 'a' for example but then it will convert like :

Jan db "January",0,"February",0

not the way i want

Jan db "January",0
Feb db "February",0

well, thats ok, i already convinced myself to convert all those strings manually.
AnalyseArea converts data to code, i wanna convert code to data
TQN
05-14-2004, 09:38 PM
I offen select a block of uncorrect data, press "U" to undefine it, then select every block of string and press "a". So I will have:
Jan db "January",0
Feb db "February",0
Sorry if my way is wrong.
Regards
Kayaker
05-14-2004, 11:27 PM
Kayaker, its a 200mb database, i'd rather ask than loose a full day disassembling the program

Heheh, I thought the reason for you asking might be something like that ;)

I know what you mean though, I've had to go in and manually define string data individually like TQN mentions, it would be nice though if there was a script or plugin, if one doesn't already exist, that would correctly parse a block of data into discrete strings, recognizing null terminators and ignoring non-ascii values.

For example, this block of data as a whole

db 4Fh ; O
db 6Eh ; n
db 65h ; e
db 0 ;
db 0 ;
db 90h ; É
db 54h ; T
db 77h ; w
db 6Fh ; o
db 0 ;
db 0 ;
db 90h ; É

would correctly parse to

aOne db 'One',0
db 0
db 90h ; É
aTwo db 'Two',0
db 0
db 90h ; É

without having to define 'One' and 'Two' individually

Cheers,
Kayaker


Custom calling conventions in IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Custom calling conventions in IDA
PDA

View Full Version : Custom calling conventions in IDA

Tramb
05-13-2004, 04:55 PM
Hello everybody,

I am a newbie at reverse engineering (because I want to RE a good old game, Cruise for a Corpse, to reimplement it portably, for those who care :) ) but an experimented programmer in C++ and assembly (not much x86 though) (and some interesting academic languages ;) )

I noticed in IDA that when I press Y on a function, I can specify parameters for _cdecl functions and then IDA would infer some information about parameters and comment the "push" with parameters name at caller's location. Which is good :)

But there are some functions in the .EXE that take their parameters as AX, BX or even different non standard conventions. Is there a way I can tell IDA how to map registers and input parameters so that I have comments at caller's site just like

mov bx, -1 ; fileHandle
?

That would save me a bit of typing :)

Thanks in advance and sorry for any English mistake!

Bertrand
Hopcode
05-14-2004, 04:35 PM
Hello everybody,

I am a newbie at reverse engineering (because I want to RE a good old game, Cruise for a Corpse, to reimplement it portably, for those who care :) ) but an experimented programmer in C++ and assembly (not much x86 though) (and some interesting academic languages ;) )

I noticed in IDA that when I press Y on a function, I can specify parameters for _cdecl functions and then IDA would infer some information about parameters and comment the "push" with parameters name at caller's location. Which is good :)

But there are some functions in the .EXE that take their parameters as AX, BX or even different non standard conventions. Is there a way I can tell IDA how to map registers and input parameters so that I have comments at caller's site just like

mov bx, -1 ; fileHandle
?

That would save me a bit of typing :)

Thanks in advance and sorry for any English mistake!

Bertrand

convention using registers could be fastcall calling convention
Tramb
05-15-2004, 05:02 AM
convention using registers could be fastcall calling convention

I thought this, too.
But no :)
fastcall, if I'm correct, would pass parameters in DX, CX and in this program, they use AX, BX...
I suppose it was pure assembly code linked, not compiler generated one.
Yet I'd LOVE to be able to tell IDA the mapping between registers and formal parameters :)
Polaris
05-15-2004, 09:23 AM
I thought this, too.
But no :)
fastcall, if I'm correct, would pass parameters in DX, CX and in this program, they use AX, BX...
I suppose it was pure assembly code linked, not compiler generated one.
Yet I'd LOVE to be able to tell IDA the mapping between registers and formal parameters :)

I think that the only way for propagating type informations using custom/strange calling conventions is writing an IDA plugin. It should not be anything really big nor difficult...


How to find static pointers in a process? (hlp)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to find static pointers in a process? (hlp)
PDA

View Full Version : How to find static pointers in a process? (hlp)

Aquatic
05-14-2004, 12:46 AM
Bear with me...

Say you wanted to always resolve the location for '# of lives' in your game.

You could do a function:

'Location held by static pointer' +/- distance to lives value.

Now this works because even though the locations of values are dynamically allocated at runtime, the relative distance between them remains the same. So whatever the distance between 'location held by static pointer' and your value is in one instance of live memory, that distance will be the same at the next runtime.

This does not work in dynamic pointers of course, because the location held by a dynamic pointer will change at each runtime. i.e (esi+4) (There is usually a register involved with dynamic pointers).

The beauty of static pointers is that you can use any one, you just need to add the distance between the location it holds and your value. Then if you wanted to resolve a second value, you can just use that same static pointer.

The problem is, how do you locate a static pointer's location in memory? 99% of values that you BP on in memory will be generated by dynamic pointers which are useless.

Static pointers are the only true non-dynamic part of live memory. (The only thing that has a predictable location.)

QUOTE:

if you find the correct STATIC BASE POINTER, it's location never changes. the STATIC BASE POINTER (SBP) holds the address for the DYNAMIC BASE POINTER (DBP) which does change at run time. so, the SBP holds the hex in four bytes which points to the DBP which is the base pointer for the addresses in the code. for instance a line in the code might be MOV EAX, (EBP+0x09). if you did a breakpoint on an address (let's say the address which holds the field of view (zoom) is 4E5170A) and the code keeps showing code which references (EBP+0x09) then you know that you take the address which holds the zoom (4E5170A) and subtract the 0x09 from it which will give you the EBP address (4E51701) which would be the same as the DBP above. convert the address 4E51701 to decimal (let's just say that it is 21764521, although i don't have a converter handy). then you clear tsearch and then do a new search looking for a type LONG and value 21764521. this will show you the address which is the SBP which never changes. sometimes you will get several addresses that point to the DBP when you do that search. you have to look at them and sometimes test with different maps or different numbers of players in COOP or whatever and see which one really points to the actual address you are looking for.

after you know the SBP, then you work backwords. from within your trainer you:

1 do a LONG read of memory at the SBP address which will give you the DBP
2 add the offset that is in the code back (which in this case is 0x09)
3 this is the dynamic address holding the field of view. poke to it and:
4 change the field of view (poke using FLOAT, which is also four bytes)

hope this helps-

http://216.239.53.104/search?q=cache:wPZuqcARiUAJ:www.mpcheatz.de/mpc/forum/showthread/t-35738.html+%22static+pointer%22+trainer&hl=en

You guys understand what I am talking about now?

(Isn't there always at least one 'Global Static Base Pointer'?)

So, what is a quick way to locate these static pointers?
JMI
05-14-2004, 01:20 AM
Gosh. :o There's something vaguely familiar about the contents of this post. Seems I've read it somewhere else very recently. Deja vu all over again. :D Hope you get more help here.

Regards,
Aquatic
05-14-2004, 01:44 AM
Gosh. :o There's something vaguely familiar about the contents of this post. Seems I've read it somewhere else very recently. Deja vu all over again. :D Hope you get more help here.

Regards,

me too. I deleted the old thread.
SysCall
05-14-2004, 01:53 AM
Well if you have read the appropriate MPC threads regarding 'private hacks', DMA whatever you would have known that TSearch is your tool of trade.

There are lots of tutorials how to do that (no need to reiterate here).

Regards
Aquatic
05-14-2004, 01:58 AM
Well if you have read the appropriate MPC threads regarding 'private hacks', DMA whatever you would have known that TSearch is your tool of trade.

There are lots of tutorials how to do that (no need to reiterate here).

Regards

Guh. You have to register to use their search function.

If you mean Eedock's tut, well that is a rubbish tut cause the game he uses has no dynamic pointers anyway. So dynamic pointer aren't even dealt with.
JMI
05-14-2004, 02:08 AM
SysCall:

Don't you think the "attitude" of your post was more than a little condescending for someone who only started posting here three days ago?

Regards,
Aquatic
05-14-2004, 02:11 AM
SysCall:

Don't you think the "attitude" of your post was more than a little condescending for someone who only started posting here three days ago?

Regards,

Yeah, lol.

But let's not de-rail this thread.
JMI
05-14-2004, 02:13 AM
No de-railment intended, but it IS my job to help maintain the sensibilities around here and it's a function I intent to carry out.

Regards,
Fake51
05-14-2004, 07:38 AM
You're rather confusing here ... you seem to be mixing up static and dynamic pointers quite a bit.

Here's the thing: if a given variable resides at a dynamically allocated place, there's no way to know where that will be (unless you fire your executable up several times in a row under win9x, in which there is quite a chance that windows will respond each time with the same memory places allocated). Now, as for the relation between static pointers and dynamic pointers ... there is NONE. Not if you consider both pointers to point to places in data. However, the text you quoted seems to me to be about something else:
It looks as if the static pointer is actually a pointer to a place in the code, where the SAME variable is referred to. That place in the code will always refer to the same variable, and can therefore be used as a point of departure - since, by normal programmer praxis, the structure of the data array will be the same from time, for expediency.

Have you understoodthis? You see, I just don't get your reply:

The problem is, how do you locate a static pointer's location in memory? 99% of values that you BP on in memory will be generated by dynamic pointers which are useless.

If you BP on the memory that holds the variable, and you get to a place in the code that is responsible for changing the variable, you can then check if it changes that and only that location. If it does, lo and behold, there's your static pointer.

Static pointers are the only true non-dynamic part of live memory. (The only thing that has a predictable location.)

Yes, but because they are part of the code, not because they are pointers in any normal fashion.

Fake

EDIT: ramble ramble ramble. Are you in any way referring to apps/games that always allocate memory in the same every time? By way of virtualalloc, say. Then just break on the calls to the alloc functions. I still don't see any use of this, though. Much better to break on a part in the code that you know does the dirty work, and just get the address from there.
dELTA
05-14-2004, 10:32 AM
Aquatic, isn't this practically the exact same thing you asked in a thread here some months ago? We were discussing following the pointer chain backward then too...

Anyway, I think you need to be a little more specific, but if you want to just know if a pointer at a certain memory address is in static or dynamic memory, I guess you could simply look if the pointer is located inside the memory range of a PE section or not. If it is, it is static, otherwise it is dynamic. If it is on the stack, it can be considered somewhere inbetween, also depending on how deep on the stack it is etc...
SysCall
05-14-2004, 01:42 PM
Guh. You have to register to use their search function.

Do we talk about same tool?
I used TSearch 1.6b some time ago (from http://membres.lycos.fr/tsearch/) which has no limitation i am aware of (though i never used it extensively).
I preferred attaching ollydbg to the running process or injecting helper dlls fixing up some stuff :D

If you mean Eedock's tut, well that is a rubbish tut cause the game he uses has no dynamic pointers anyway. So dynamic pointer aren't even dealt with.

Dunno who that guy is. Just check the BF1942 and BFV subforums there is lots of stuff/tutorials posted on this topic (dynamic/static pointers).

Almost everything in this mutiplayer game has been hacked.
I bet there are 100s of private hacks around which have been built from the knownledge exposed in these threads.

The accompanying PB provides no protection at all.
I explained some of the inner workings in some threads just search for it.

Regards

Don't you think the "attitude" of your post was more than a little condescending for someone who only started posting here three days ago?

No offense meant. Yes maybe ... sometimes i get a bit angry when questions get asked 1000 times.
There is much stuff around that topic in MPC subforums .. one only has to use search function.
dELTA
05-15-2004, 08:18 AM
The accompanying PB provides no protection at all.
I explained some of the inner workings in some threads just search for it
Your name over at that board isn't SysCall, is it? I searched for it, and didn't get any hits. Also, when searching for just "punk buster" and similar I got too many unrelated hits to be able to find any juicy ones. :( I've been a bit curious about it before, and exactly what it does, so if you have some good technical info about its internals, could you post some links to it here?
Aquatic
05-15-2004, 01:53 PM
I guess there is no simple answer to my question.

So let me try and get everyone on the same wavelength here.

Lets go on a journey...

1. Search for value in game.

2. BP on it.

3. Find the pointer that points to the value. (holds the value's location).

4. restart game.

5. Go to the addy where the pointer was before. (It's the same pointer, but wait the memory location that it holds (points to), doesn't hold your value anymore). So it's a dynamic pointer. Now, if it were a static pointer, then the location it points to would always hold your value.

However, say you found a static pointer that has nothing to do with your value, ... well that's ok too, because all you need to know is the distance between your value and that of the value held at the location that this arbritrary static pointer points to.

...Up to this point I haven't even had to look at the asm code, all the above has to do with live memory locations. (Artmoney can do step 3 automatically for you.)

Why the hell am I asking this? Well think about it. Most trainers use the crude method of having to patch the asm code in order to defeat dynamic values, this requires way more work than is neccessary, and also it prevents you from altering client-side values whilst online. Oh man, don't you guys get it? My theory would allow you to manipulate client-side values without the server disconecting you for patching the game's raw asm.

*laughs hysterically as head explodes*
SysCall
05-15-2004, 03:06 PM
Your name over at that board isn't SysCall, is it?

Yes, i never use the same nick/handle for different message boards/forums.
Its better to keep low noise :rolleyes:

Posting deep links to threads is not a good idea ... just search for punkbuster screenshot, console hack, code cave parts whatever.

Regards
Fake51
05-15-2004, 04:03 PM
I guess there is no simple answer to my question.

So let me try and get everyone on the same wavelength here.

Lets go on a journey...

1. Search for value in game.

2. BP on it.

3. Find the pointer that points to the value. (holds the value's location).

4. restart game.

5. Go to the addy where the pointer was before. (It's the same pointer, but wait the memory location that it holds (points to), doesn't hold your value anymore). So it's a dynamic pointer. Now, if it were a static pointer, then the location it points to would always hold your value.

However, say you found a static pointer that has nothing to do with your value, ... well that's ok too, because all you need to know is the distance between your value and that of the value held at the location that this arbritrary static pointer points to.

...Up to this point I haven't even had to look at the asm code, all the above has to do with live memory locations. (Artmoney can do step 3 automatically for you.)

Why the hell am I asking this? Well think about it. Most trainers use the crude method of having to patch the asm code in order to defeat dynamic values, this requires way more work than is neccessary, and also it prevents you from altering client-side values whilst online. Oh man, don't you guys get it? My theory would allow you to manipulate client-side values without the server disconecting you for patching the game's raw asm.

*laughs hysterically as head explodes*

Here's the where the chain snaps for me:
You find your dynamic pointer (a variable, that changes, since the memory place changes)
Your find your static pointer (which is, mysteriously, always the same, quite possibly because it's in the .data section)
The range between the two will be ... dynamic.

Hence, the only thing to do is to find the code that references the dynamic pointer, and grab the pointer from there.

If this is not what you're looking for, please do be more specific ... and logical.

Fake


Any way to add new vid drivers for SoftICE?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Any way to add new vid drivers for SoftICE?
PDA

View Full Version : Any way to add new vid drivers for SoftICE?

Chal021
05-14-2004, 03:41 AM
I have softice workin on my xp desktop fine .... well theres some probs, but it works good till i reboot .... but its dealable

but on my laptop when i first load it and try a ctrl+d the screen goes haywire like someone put put a background of the desktop in tiny tile mode. Then when i ctrl+d out ... everything resumes normally

Anyone know how to make softice recognize new drivers? cuz the vid driver for my laptop isnt listed in the videocard set that they give. ive tried universal mode, and when i test, it says its ok .. but when i try to actually use it, it gives me probs. Any ideas?

softice ver 4.2.7
windows xp (all updates and service packs installed)

well ... installing an updated driver didnt work

any ideas on getting SI to recognize my driver (cuz i think thats what the prob is). btw ive seen the Vsetup.ini file ... but dont understand how to manipulate it. I have a ATI Radeon IGP 345M

any help would be greatly appreciated :D
naides
05-14-2004, 06:27 AM
I have softice workin on my xp desktop fine .... well theres some probs, but it works good till i reboot .... but its dealable

but on my laptop when i first load it and try a ctrl+d the screen goes haywire like someone put put a background of the desktop in tiny tile mode. Then when i ctrl+d out ... everything resumes normally

Anyone know how to make softice recognize new drivers? cuz the vid driver for my laptop isnt listed in the videocard set that they give. ive tried universal mode, and when i test, it says its ok .. but when i try to actually use it, it gives me probs. Any ideas?

softice ver 4.2.7
windows xp (all updates and service packs installed)

well ... installing an updated driver didnt work

any ideas on getting SI to recognize my driver (cuz i think thats what the prob is). btw ive seen the Vsetup.ini file ... but dont understand how to manipulate it. I have a ATI Radeon IGP 345M

any help would be greatly appreciated :D

Don't take it the wrong way, but there has been plenty of discussion about the issue in the board. Search back.
I summary, video interface of Sice is touch and go. . . particularly with laptops.

Suggestions people came up in the past?
play with all the possible video settings combinations until one works,

E-mail compuware tech support with your system ID and your purchase serial number and they may be able to help you
:p

Try using Driverstudio 3.1 instead, which was what worked for me.
Silver
05-14-2004, 09:57 AM
As I posted in another thread, grab the osinfo.dat and update sp from the compuware site. sice crashed, bsod'd and screwed up my video on my laptop until I applied the update, now it works fine (apart from a brown flashing line where "Press <whatever> to not load <something>" should be on bootup).
evn
05-16-2004, 01:17 AM
@silver
now it works fine (apart from a brown flashing line where "Press <whatever> to not load <something>" should be on bootup).

That's a known and fixed bug, both the new version and the patch for older versions fix this afaik. Patch is available on compuware's webpage.


FORTRAN - Mathematics Library
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > FORTRAN - Mathematics Library
PDA

View Full Version : FORTRAN - Mathematics Library

Aimless
05-14-2004, 06:26 AM
Hi All,

Just wondering...

Is there anything that can act as a *free* replacement for the IMSL Library that generally provides a plethora of statistical and financial functions?

Though IMSL is good, I have no time or inclination or talent to break the softkey protection it uses.

I searched GNU and others, but since they are FORTRAN mathematic libraries, even though I found many free ones which can be comparable to the IMSL, they unfortrunately having only engineering and calculus related functions and no statistical or financial functions.

Pointers anyone? Any help appreciated.

Have Phun
jsteed
05-14-2004, 10:05 AM
Wow Fortran! I haven't used that since the early 80s, although it does bring back many fond memories. You must have a huge legacy code base to still want to program in that. Both CernLib and SPSS have statistical modules written in Fortran and I believe are free, (I know CernLib is). I can't help you with the financial end.

cheers, jsteed
tazman
06-17-2004, 01:54 PM
Hi,

Use matlab :) and its statistical tool box
UrgeOverKill
06-19-2004, 07:32 PM
Hi Aimless,

WOW! a fortran question...:) after you get done doing what you r doing, check out 'Visual Numerics' site, as they have a proggie called PV-Wave. Not what you need but its cool nevertheless.


Where hackmate site has gone?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Where hackmate site has gone?
PDA

View Full Version : Where hackmate site has gone?

highenergy
05-15-2004, 02:40 AM
Do anybody know where hackmate site has gone? I'm typing hackmate in browser address bar and a lot of unrelated things comes. :mad:


@ xollox
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > @ xollox
PDA

View Full Version : @ xollox

Fake51
05-15-2004, 05:38 AM
Hi

I was reading the post by Aquatic on gamehacking, and decided to look around for some info. Your name came up on MPC, alongside a tut (might have been written by looney) - it seemed to offer some info on what Aquatic was on about. However, gaining access to MPC proved harder than one would have suspected (registering simply wasn't working), so I wasn't able to either search the board or download the tut. Would you care to post the tut here, or perhaps explain the ideas in it? Just to clear up some confusion.

Fake
xollox
05-15-2004, 12:39 PM
I'm not sure that this an appropriate place to discuss it. MPC registration should work, although they may be having some troubles with it. Keep trying and I'd be more than happy to help you there.
Fake51
05-16-2004, 08:36 AM
I'm not sure that this an appropriate place to discuss it. MPC registration should work, although they may be having some troubles with it. Keep trying and I'd be more than happy to help you there.

MPC registration keeps on directing me to a blank page. Care to reconsider discussing the topic here? I fail to se the inappropriate nature of the subject. I hope you can help me out there too. Or perhaps send me a pm.

Fake
xollox
05-17-2004, 02:36 PM
You should be able to view posts on MPC without logging in.
Fake51
05-17-2004, 02:56 PM
You should be able to view posts on MPC without logging in.

I am. I am, however, not able to download the tut you posted (the one by Looney, I think). Reading on ín that thread, I didn't find enough info to satisfy my search - which is why I'm asking you to either post it here, or go over the ideas in that tut. The main point being elucidating exactly what is meant by the static pointers, the dynamic ones, and the relationship between them. I'm wondering how the dynamic pointer was retrieved from the static one, and how the static one was retrieved. Knowledge like this hardly seems contrary to the rules of this place.

Fake
dELTA
05-17-2004, 06:05 PM
I managed to register on that board without any problems (I suggest you try with another browser). But if you post a link to the thread you are talking about, I can download it and post it here if you want.
Fake51
05-17-2004, 07:54 PM
I managed to register on that board without any problems (I suggest you try with another browser). But if you post a link to the thread you are talking about, I can download it and post it here if you want.

It's this thread:
http://www.mpcheatz.de/mpc/forum/showthread.php?s=&threadid=32914

Cheers
Fake
dELTA
05-18-2004, 05:38 AM
Ok, here you go:
Hacking With ASM:
http://www.gameutils.times.lv/agtp1.txt
http://www.gameutils.times.lv/agtp2.txt
http://www.tsongkie.com/tutorials.shtml
http://www.trainorcreations.com/ (gamehacking)

There are loads of others - use Google or your favourite search engine you will soon see - its not finding the information that's hard its cutting the wheat from the chaff.

Disclaimer: If you carry out all of the following actions and it doesn't work or worse you have a serious fault on your system I am not to blame. You can however direct all your anger towards Mr Gates and his crowd with my deepest sympathy.

Software:
You will need a memory searching program I suggest t-search:
Download from here:
http://membres.lycos.fr/tsearch/ (download either 1.6 or 1.6b they should be fine for this)
I will try to write this for someone using this tool. Incidentally t-search has a fantastic tutorial in its own help guides read it (pop another guilder in the box) There are loads of others with their own advantages and disadvantages use what you want but I do like t-search its so easy

I have no intention of teaching you how to use t-search or easywriter or any of that its all in the t-search help guide (chink) if you cant be bothered to read that then you might as well stop reading now.

NOTE: Open up a notepad document and take notes as you go along (saving as you go) - doing this will enable you to not only recover information if your system crashes but also to refer back to it in a few days. It is always useful to go over old work you never know what you might have missed last time

This is going to look a little daunting at first - but it isn't really so just bear with me.
For ease of reading lets split this up into multiple areas:

1. Make a strong cup of coffee and put the pot noodle on standby.
2. Finding your Dynamic Team Address (The normal way)
2b. Finding your Dynamic Team Address (The easier way)
3. Breakpointing your Dynamic Team Address
4. Finding the correct jump.

1. Make a strong cup of coffee and put the pot noodle on standby.

This is gonna take some time and I believe its illegal to hack without caffeine in ya! In fact I am not even sure if its possible? I have heard of some of the young uns using chemicals other than caffeine I do not recommend this for your future well being.
But its your choice - choose wisely.

a. Fill up the Kettle with water
(unplug it first or you might not be able to get to the tap - also small hazard here methinks)
b. Plug in the kettle and switch on waiting until boiled.
(Be careful here - hot water can scold you - you have been warned)
c. Put a sachet of your finest instant into a cup no milk maybe sugar - your choice and it shouldn't affect the outcome
(Don't over do this - a sugar rush can be fatal)
d. Open the pot noodle and pour the sauce sachet over it.
e. Put the water into the cup again taking care not to scold yourself.
f. Carefully walk over to the computer with your coffee taking care not to spill it on the computer or its parts.
g. When Coffee is cool enough take your first sip - if its acceptable goto step 2 otherwise go back to a.

2. Finding your Dynamic Team Address (The normal way):

Bear in mind this address is dynamic so it changes as the game does hence you have to get this all done on the same server every new one you join will have a new address.

The first thing you should start with is finding your team "address" to do this start bf1942 and join an empty server with a long map finish time (CTF is good). If you have multiple computers I would suggest starting the multiplayer internet server on one and joining it with another. Better yet get a friend to help and start a server for your testing with a long map change time and a short spawntime

You should do all this testing on the client (your main machine) - never the server as it will skew your results or worse give you false flags. This is pretty much a general rule unless you want to create only a single player trainer.

Back to the point, join the server on the allied team (there are only about 1/3 million 2's compared to the 1 million 1's) or the other then search for your team value in this case it is as follows:
axis=1
allied=2
(remember this)

So you need to use t-search (or whatever program you prefer) to find these values join Allies (wait until you spawn) then alt-tab out to t-search then doing an "Exact" Search for the value "2" (4-byte). You will get a list of about 1/3 of a million areas of memory with the number 2 stored.
Now alt-tab back into the game and change from team allied to team axis (wait until you spawn).
Now do a "Search Next" for the value "1" (4-byte) you should now have much less addresses.
Keep repeating this process from this point only using "Search Next" (changing spawns helps) until you have less than 30 values. This is really monkey work but just keep at it until you have it.

Now you have this list your team address will be one of them!

Starting from the BOTTOM of the list: Change each one of these to the other team number then alt-tab back into the game to check your colour on the minimap. i.e. if you are Allied t-search will have a list of 2's change them one at a time to 1 then check for each value until you change to red.
Incidentally you will also now be able to see the enemy team on your map but not your own! handy but only half the battle.

When this finally occurs write down the address - congratulations you now have your dynamic team address!

NOTE: Don't be confused here - you didn't swap teams you just convinced your client machine that you are on a different team so it's showing you different information. By All means take a look at the server and check what it sees is what is happening.

Now you can do something kinda special here to either steal the dynamic address and store it somewhere fixed or even fix the dynamic team address itself as it has other uses but that is out of the scope of this tutorial - see the above tutorials for information on this.

For now you only have the team address for only these maps so lets move along.

2b. Finding your Dynamic Team Address (The easier way)
(This is easier but maybe a little harder to understand)
You do not need to do this if you did the above
Create this code in the top box of the easywrite interpreter:
offset 0x00418093
mov [esi+0x90],eax
mov dword ptr [0x004180E9],esi
ret
offset 0x004180B9
call 0x00418093
nop
offset 0x004180e9
add [eax],al
add [eax],al

create the address 4180e9 (4 byte) and monitor it in the cheats list of t-search.
Start bf don't pick a team! alt tab out to t-search and connect it to bf1942
activate your easywrite code (tick the box) in the easywrite interpreter.
alt tab back into bf1942 choose your team - then alt tab back out to t-search

look in t-search at the value (4 byte) for 4180e9 - open calculator (windows in scientific mode)
add 144 (decimal) to the value of 4180e9 then convert this to hexadecimal put this hexcode into a new cheat in your team switch area in the cheats list of t-search
When you change this value you can now convince your "client" that you are on the other team at will.

Either way the hexadecimal value you now have is your current dynamic team address!

If you do both 2. and 2b. you should come up with the same result the latter isn't as annoying.

Told ya - it was easier

1) Open t-search.

2) Make sure Search, EasyWrite and Cheat list are depressed in the toolbar, and that you have four windows in the main area. The top left is the memory search win, top right is the cheat list, bottom left is easywrite interpreter, bottom right is... nothing. Note I'm using default window positions. If you've changed them this may not apply.

3) Click the white document shaped thing in easywrite (new), then cut and paste the code from the tutorial into the top window:

offset 0x00418093
mov [esi+0x90],eax
mov dword ptr [0x004180E9],esi
ret
offset 0x004180B9
call 0x00418093
nop
offset 0x004180e9
add [eax],al
add [eax],al

4) name it something... for eg: "Team Address Finder" or "DMA Fragger" or whatever. Now click okay, then save this using the disk icon above the easywrite box. This will mean you don't have to type this in again next time.

5) Add a cheat to the cheat list (top right) with the new button (white document), then put in description: "Team Address Pointer", Address: "4180e9", and select "4 Bytes", click ok, then save this cheat list (top right) using the disc icon again.

** Here is where you start in future, since you have saved these you can simply click the "open file" icons in the relevant sections (easywrite window, cheat list window) and load them in. **

6) Now start battlefield, and join another server (with long map times. Preferably one you've set up yourself (ON A DIFFERENT COMPUTER) When the map loads, you get the intro screen detailing the map type and game type etc. DO NOT CLICK TO JOIN THE GAME YET.

7) Leave it on this screen, then alt-tab back to t-search.

8) Click "Open Process" and select "BF1942" from the list.

9) Click the tick box next to "DMA Fragger" or what ever you called it, in the easywrite (bottom left) window

10) Open windows calculator up, and MAKE SURE it's in scientific mode (View->Scientific)

11) Alt-Tab back into the game and join one of the teams.

12) Alt-Tab back into t-search and check the number in the "Value" column of "Team Address Pointer" (top right). Is it 0? If it is, alt-tab into the game and change teams, then come back to t-search. Continue this process until this number is some long, crazy number like "9044928549".

13) Paste this number into windows calculator (may screw up and you need to type it manually, it does for me, if so make sure you get it absolutely right otherwise it won't work.)

14) Add 144 to the number in calculator, then press =

15) Click the "Hex" radio button at top left, and what will appear in the box is the magical team address!

16) Click "new" button in the cheat list of t-search (top right), and in Description type: "Dynamic Team Address", Address: The number from calculator, "4 Bytes" Then click okay. No point in saving this one, as it changes every time you join a server (possibly even when it changes maps).

3. Breakpointing your Dynamic Team Address

Ok That was fairly easy wasn't it? if you think so your gonna laugh at how easy the next bit is.

Start the Debugger in t-search (Click Autohack on the menu then click "Enable Debugger")
Start the Autohack in t-search (Click Autohack on the menu then click "Autohack Window")

In the Autohack window click Edit on the menu then click "Set Breakpoint"
Enter the team address you have found i.e. E4A6328
Change the type to "Read/Write" and click "Set"
Then go back into the game and have a little fun for a minute or two but erm don't change teams just yet

When you come back out look at the Autohack window "Debug Event" tab you should be presented with a list of values that have been reading from and writing to this memory address.
This is my list from the same actions:
Data Breakpoint at : 0x47C120 8B9190000000 mov edx,[ecx+0x90]
Data Breakpoint at : 0x426812 8B8E90000000 mov ecx,[esi+0x90]
Data Breakpoint at : 0x426B42 8B8690000000 mov eax,[esi+0x90]
Data Breakpoint at : 0x426B48 8B8F90000000 mov ecx,[edi+0x90]
Data Breakpoint at : 0x427993 8B9990000000 mov ebx,[ecx+0x90]
Data Breakpoint at : 0x427EE9 8B8790000000 mov eax,[edi+0x90]
Data Breakpoint at : 0x7CF51E 398590000000 cmp [ebp+0x90],eax
Data Breakpoint at : 0x7CF45F 8B8F90000000 mov ecx,[edi+0x90]
Data Breakpoint at : 0x42FC00 8B8190000000 mov eax,[ecx+0x90]
Data Breakpoint at : 0x8CA45B 8B8190000000 mov eax,[ecx+0x90]
Data Breakpoint at : 0x8CA58D 8B8690000000 mov eax,[esi+0x90]
Data Breakpoint at : 0x8CADB4 83BE9000000002 cmp dword ptr [esi+0x90],0x2
Data Breakpoint at : 0x881D34 39B790000000 cmp [edi+0x90],esi

Think about this for a moment. This is where the game has been comparing your team value address with other addresses or even loading other pointers for the same reason - why would it do this? well to confirm what it needs to show you and to tell you of course

The list is large but the good news is that it is fixed so you no longer have to worry about the server crashing map/game changing etc. You have your list now what to do with it?

4. Finding the correct Jump.
Now the hard/long/tiring bit, I am going to help you out a little here as this bit it truly guess work with a little common sense thrown in.

Take a look at this line:
Data Breakpoint at : 0x426B48 8B8F90000000 mov ecx,[edi+0x90]
Using the Autohack dissembler window take a look at this address:
0x426B48

00426b48 8B8F90000000 mov ecx,[edi+0x90]
00426b4e 3BC1 cmp eax,ecx
00426b50 0F8554010000 jnz 0x00426CAA
00426b56 8B8D8C000000 mov ecx,[ebp+0x8C]
00426b5c 48 dec eax

Interesting so it moved the value of our team address into ecx it then compares eax and ecx then if they are different it jumps to a different address. Now if we really wanted to dig we would go back up and work out what it loaded into eax but for now lets just say "erm no mr computer they are the same honest". Here its down to your personal style I tend to remove the offending jump in this case:
00426b50 0F8554010000 jnz 0x00426CAA
So I would do the following:
Poke 426B50 90 90 90 90 90 90
Note: You need enough nop's to balance your opcodes in this case:
0F8554010000
becomes:
909090909090
If you don't do this odd things WILL happen

This will remove that line from our program "temporarily" remember your looking at the jumps here dont go nopping the whole place.

The same goes for the other addresses (you dont need to nop them all - in fact you prolly cant ) but at this point its all experimentation for you - go on nop yourself out - the worse you can do is kill the game so you have to reload but you now have your list and your notepad copy so you can get right back in there

This is actually hours of work and experimentation but it comes down to this:
You need to nop only TWO jumps to get the full map working one for Vehicles and one for Men on foot. There is a handy further nop you can do which you can have also that will give you a "Last Seen" Marker on the map - also very useful. I cant quite remember now but it was either Ultion or Dr Kenneth that found and announced this one

In the end you should be left with this:

Poke 426B50 90 90 90 90 90 90
Poke 426CAF 90 90 90 90 90 90
Poke 4272F5 90 90 90 90 90 90

I know a lot of people have more than this (some maybe less) it is all down to your personal taste but be warned if you nop the wrong area it might look ok and even work but you will "might" activate the enemy team sounds when they are loosing the game. The computer then warbles at you for sometime - it works fine but can be a little distracting (see annoying as hell)

If you found the above without just poking the above codes boil the kettle again and this time make your pot noodle you deserved it - well done

Food for thought:
Data Breakpoint at : 0x8CADB4 83BE9000000002 cmp dword ptr [esi+0x90],0x2
The above he is comparing your team to check if you are allied - why would he do that

The End.....

I thought I'd expand on the original Easywrite explaination for the noobs out there.

1) Open t-search.

2) Make sure Search, EasyWrite and Cheat list are depressed in the toolbar, and that you have four windows in the main area. The top left is the memory search win, top right is the cheat list, bottom left is easywrite interpreter, bottom right is... nothing. Note I'm using default window positions. If you've changed them this may not apply.

3) Click the white document shaped thing in easywrite (new), then cut and paste the code from the tutorial into the top window:

offset 0x00418093
mov [esi+0x90],eax
mov dword ptr [0x004180E9],esi
ret
offset 0x004180B9
call 0x00418093
nop
offset 0x004180e9
add [eax],al
add [eax],al

4) name it something... for eg: "Team Address Finder" or "DMA Fragger" or whatever. Now click okay, then save this using the disk icon above the easywrite box. This will mean you don't have to type this in again next time.

5) Add a cheat to the cheat list (top right) with the new button (white document), then put in description: "Team Address Pointer", Address: "4180e9", and select "4 Bytes", click ok, then save this cheat list (top right) using the disc icon again.

** Here is where you start in future, since you have saved these you can simply click the "open file" icons in the relevant sections (easywrite window, cheat list window) and load them in. **

6) Now start battlefield, and join another server (with long map times. Preferably one you've set up yourself (ON A DIFFERENT COMPUTER) When the map loads, you get the intro screen detailing the map type and game type etc. DO NOT CLICK TO JOIN THE GAME YET.

7) Leave it on this screen, then alt-tab back to t-search.

8) Click "Open Process" and select "BF1942" from the list.

9) Click the tick box next to "DMA Fragger" or what ever you called it, in the easywrite (bottom left) window

10) Open windows calculator up, and MAKE SURE it's in scientific mode (View->Scientific)

11) Alt-Tab back into the game and join one of the teams.

12) Alt-Tab back into t-search and check the number in the "Value" column of "Team Address Pointer" (top right). Is it 0? If it is, alt-tab into the game and change teams, then come back to t-search. Continue this process until this number is some long, crazy number like "9044928549".

13) Paste this number into windows calculator (may screw up and you need to type it manually, it does for me, if so make sure you get it absolutely right otherwise it won't work.)

14) Add 144 to the number in calculator, then press =

15) Click the "Hex" radio button at top left, and what will appear in the box is the magical team address!

16) Click "new" button in the cheat list of t-search (top right), and in Description type: "Dynamic Team Address", Address: The number from calculator, "4 Bytes" Then click okay. No point in saving this one, as it changes every time you join a server (possibly even when it changes maps).

Now you can follow the rest of Looney's tutorial
JMI
05-18-2004, 05:51 AM
Yo dELTA:

Wouldn't it have been easier, and shorter, to just attach the article here? No JAG to watch so you quoted the whole thing? :cool:

Regards,
dELTA
05-18-2004, 05:53 AM
I don't like attached files very much, they are often lost between board upgrades, and the information in them isn't searchable. :( Since this subject isn't discussed very frequently here, I thought it'd be extra good to make the information searchable too.
JMI
05-18-2004, 05:55 AM
OK, what attachments have we lost??? :eek: Point made about searchable though. ;)

Regards,
dELTA
05-18-2004, 06:01 AM
There has been a few board upgrades where all attachments have been lost. Hence the posts you see sometimes, saying things like "The file is attached in this and that thread, but the link isn't working"...
Fake51
05-18-2004, 07:10 AM
Thanx a bunch.

Blue skies
Fake
SiNTAX
05-19-2004, 02:29 AM
LOL.. had a look on that MPC forum..

Obnoxious popup box that is... and here's how to disable it :)

Put the following 3 lines in your mozilla/firefox's profile chrome/userContent.css file:

#vbplocation {
overflow:hidden;
}

Cheated the cheaters...
xollox
05-19-2004, 06:31 PM
Sorry for the hassle guys. Fake51, if you need any more help with that (as it's for an older version), let me know and I can help you out.
Fake51
05-20-2004, 03:10 AM
Sorry for the hassle guys. Fake51, if you need any more help with that (as it's for an older version), let me know and I can help you out.

Cheers. Actually, I don't really care about the target specifics - I was just hoping he was dealing with the issues of DMA and SBA (geez I hate those names - DMA is Direct Memory Access, not Dynamic Memory Address). Just wondering if it would clear up the other thread on the subject - and, ofcourse, wanting to expand my own horizons. Wasn't what I had hoped, though, even though it's interesting on it's own.

Fake


Exetools Forum Viewable to Non-Registered
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Exetools Forum Viewable to Non-Registered
PDA

View Full Version : Exetools Forum Viewable to Non-Registered

JMI
05-15-2004, 12:58 PM
For those of you who have been pestering me by PM about access to Exetools I can report that this morning Aaron appears to have set the main Forums for viewing by non-registered guests.

At the moment new registrations remain closed and I have no idea when they may be re-opened. That decision is solely up to Aaron and he has said they will remain closed for the remainder of the year. You'll simply have to continue to visit and see if it has re-open. He is still in the process of culling the membership list of those who registered only to gain access to the ftp. The "membership" is now down from 14,000+ to 3,800+ and still gradually going down. Those who do not post for six months or do not visit for three months are being deleted.

Even if he re-opens registration soon, no one who registers gains access to the ftp immediately. At the moment 10 posts of some substance are required (meaning "thank you" is not sufficient and posts seeming to have been made just for post count are deleted), although consideration is given to those who do not post, but do upload the approporate materials. Limits on what is acceptible have also been enforced.

While "guest" will be able to visit most of the Forums and read the posts, they will not be able to download attachments and will not have access to the ftp password or the ftp.

Again, I do not make these policies, so there is no point in sending me a PM complaining about such things, or asking me to do something about them, or asking that I get you or a friend a membership.

Regards,
disavowed
05-15-2004, 03:36 PM
JMI, i saw that you posted yesterday, "Most ebooks are available in a great many other places"... could you post or privmsg some of those places? apparently i'm a bit out-of-the-loop when it comes to the ebook "scene" :rolleyes:

also, i think many ppl on this board would be interested in such places if they're stable

thanks
JMI
05-15-2004, 05:08 PM
I'm not too up on the ebook scene either, but there is a long thread on exetools where one will find a great many places listed with ebooks available:

http://www.exetools.com/forum/showthread.php?t=3440

I have not visited nor attempted to download books from these sites, so it's catch as catch can.

Regards,
SiNTAX
05-17-2004, 09:10 AM
JMI, i saw that you posted yesterday, "Most ebooks are available in a great many other places"... could you post or privmsg some of those places? apparently i'm a bit out-of-the-loop when it comes to the ebook "scene" :rolleyes:

also, i think many ppl on this board would be interested in such places if they're stable

thanks

I'm probably stating the obvious here.. but have you checked a.b.ebooks recently?!

Or.. if you are loaded... hxxp://www.books24x7.com
Woodmann
05-17-2004, 03:48 PM
Since you are tired of people sending you pm's I will just ask it here.

Can you get me hooked up over at exe tools ?

TA TA, Woodmann
JMI
05-17-2004, 05:43 PM
No, but I did register you at a couple of porn sites which always send you worms and/or trojans when you attempt to sign in. Just to keep your registry cleaning techniques up to snuff. :D

Regards,
dELTA
05-17-2004, 06:12 PM
Can you hook me up with the porn sites too? :D
WaxfordSqueers
05-17-2004, 07:10 PM
JMI, i saw that you posted yesterday, "Most ebooks are available in a great many other places"... could you post or privmsg some of those places? apparently i'm a bit out-of-the-loop when it comes to the ebook "scene" :rolleyes:
thanks

you might try the newsgroups as well. A lot of interesting stuff rolls through the likes of:

alt.binaries.e-books
alt.binaries.e-books.technical

There was a really good book came through recently by Kris Kaspersky (Hacker Disassembly Uncovered). Don't know if he is 'the' Kaspersky from AVP. Talks about Softice and IDA.
Kayaker
05-17-2004, 10:48 PM
Can you hook me up with the porn sites too? :D

Wut? JAG not doing it for you anymore? :p
dELTA
05-18-2004, 05:41 AM
Actually, it's been on a break over here for a while, but returned yesterday, wohoo (although with some crappy spinoff-series-starter-episode which Catherine Bell was hardly in, but anyway). :p

But I did search on google before asking about the porn sites, but couldn't find any, I promise. :D
JMI
05-18-2004, 05:53 AM
You couldn't find any porn sites or any with the "extra" features I promised Woody?

Regards,
dELTA
05-18-2004, 05:57 AM
Could not find any, search very much everywhere, please help unpack. :p
JMI
07-18-2004, 11:06 AM
For those of you who may be interested, it appears that Aaron has reopened registration on the exetools forum again. This will NOT get you automatic access to the FTP, however, that still requires at least 10 posts of some content. Thank-yous by those who don't already have 10 or more posts are simply deleted and will not count.

Regards,
Silver
07-20-2004, 01:16 PM
Thanks for the heads up


Changing default menu selection.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Changing default menu selection.
PDA

View Full Version : Changing default menu selection.

BBQmyNUTZ
05-15-2004, 08:56 PM
Have a game that originally only allowed it's music to be played via the original CD, but there is an option in the menu to use wav files which was greyed out. I figured out how to enable that option to where it's selectable and the wav audio works fine after ripping the music tracks from the CD and finding out what filenames the program looks for, however, it still defaults to the CD audio even though I've specified that the WAV option be checked at startup. I would like to get it to recognize the wav fails by default.

I've already gone through the motions with the check and enablemenuitem calls, but they don't seem to have any effect on how the program runs, only what the menu displays.

I know where the code is that controls whether it plays the wav files or jumps to the CD audio part, and even though I've tried patching it to just jump to the wav code, it still doesn't work until I select the option in the menu.

I'm having a pretty tough time with this, so if someone could maybe lend me a hand I would really appreciate it.

Kai
Fake51
05-17-2004, 01:46 PM
Well, it seems that either it doesn't check what to play when it starts up - or you've missed something vital.

Study the menu-function, to see what exactly it does, when you make it play the wav files. Then compare the routine with the startup of the program, to find similarities and differences.

If it doesn't check whether to play cd-audio or wav files, then you might have to patch the program to make it perform the appropriate menu-function - since that has the desired effect, it may be able to work in the startup phase as well.

Fake
BBQmyNUTZ
05-17-2004, 11:02 PM
Well, it seems that either it doesn't check what to play when it starts up - or you've missed something vital.

Study the menu-function, to see what exactly it does, when you make it play the wav files. Then compare the routine with the startup of the program, to find similarities and differences.

If it doesn't check whether to play cd-audio or wav files, then you might have to patch the program to make it perform the appropriate menu-function - since that has the desired effect, it may be able to work in the startup phase as well.

Fake

Thanks for the reply Fake. As I said previously, the option isn't *really* supposed to be available... so it should be naturally defaulting to the CD-DA audio. I know exactly where the conditional jumps are that determine which option is to be used, but even though I've basically forced it to only jump to the WAV audio it *still* won't default to it.

I understand that this is a kind of "just learn it and do it" kind of forum, but I'm really at a loss here on what to do, and I don't even know where to start in regards to finding the information I need to learn.

Kai
Fake51
05-18-2004, 02:01 AM
Thanks for the reply Fake. As I said previously, the option isn't *really* supposed to be available... so it should be naturally defaulting to the CD-DA audio. I know exactly where the conditional jumps are that determine which option is to be used, but even though I've basically forced it to only jump to the WAV audio it *still* won't default to it.

I understand that this is a kind of "just learn it and do it" kind of forum, but I'm really at a loss here on what to do, and I don't even know where to start in regards to finding the information I need to learn.

Kai

Well, without knowing the program, I can only recommend that you think logically about the issue.

The question you need to be asking is whether the program can actually be forced to default to wav-files. Maybe, even though you've forced the correct jumps, the program doesn't care because the choice is made after the jumps you forced. Or maybe, defaulting to cd-audio is simply hardcoded a bit later on. Either way, dig deep enough, and you should find clues.

Btw, have you checked that the code you forced is actually run at startup? Sure it doesn't follow another path, to start the audio?

Fake
BBQmyNUTZ
05-18-2004, 11:25 AM
Well, without knowing the program, I can only recommend that you think logically about the issue.

The question you need to be asking is whether the program can actually be forced to default to wav-files. Maybe, even though you've forced the correct jumps, the program doesn't care because the choice is made after the jumps you forced. Or maybe, defaulting to cd-audio is simply hardcoded a bit later on. Either way, dig deep enough, and you should find clues.

Btw, have you checked that the code you forced is actually run at startup? Sure it doesn't follow another path, to start the audio?

Fake

That's my problem... I don't know how to find out any of the things you are referring to. I think I'm in a little over my head here.

Kai
Fake51
05-18-2004, 04:36 PM
That's my problem... I don't know how to find out any of the things you are referring to. I think I'm in a little over my head here.

Kai

Never a moment for learning like the present. Grab the opportunity to do some debugging - have a picnic in the code-woods. Moderate to heavy amounts of zen, alcohol, caffeine and lack of sleep usually helps (or is it plenty of sleep? I always forget, in the dead of night)

Start with the easy bit, then. I'm assuming you're using some sort of debugger. Well, breakpoint on the piece of code you're forcing - check if it's run at startup. Then take things from there.
Second, find out how it goes about playing the audio - a trip through the menu function might provide some details (at least it should give you some variables to breakpoint on).
Third, start piecing info together.

Fake


Lets put those graphic processors to use
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Lets put those graphic processors to use
PDA

View Full Version : Lets put those graphic processors to use

int21hex
05-16-2004, 01:18 AM
Has anyone considered using programmable graphics cards in aiding crypto attacks? I have not much information on the idea but there is no relevant google links, so seemingly this is an original idea but I would not hold my breath.
sgdt
05-17-2004, 11:57 PM
Has anyone considered using programmable graphics cards in aiding crypto attacks? I have not much information on the idea but there is no relevant google links, so seemingly this is an original idea but I would not hold my breath.

Have you had a look at BrookGPU?

hxxp://graphics.stanford.edu/projects/brookgpu/index.html

Pretty wicked stuff.
int21hex
05-18-2004, 12:32 AM
Wow, thanks that is very interesting. I have something to eat tonight.


Good Virus--Bad Virus
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Good Virus--Bad Virus
PDA

View Full Version : Good Virus--Bad Virus

WaxfordSqueers
05-16-2004, 07:44 PM
Hi,

I know there are certain signatures in files that set of a viruschecker. There are several in the RCE-CD contents. One I just came across is in SEHALL.ZIP.The virus refered to is VIRTOOL.WIN32.TRACER and it's in ring32.exe of the zip file OWL-SEH.zip.

I know OWL is a good guy and I've come across this situation before. But I find references to pseudo-viruses like VIRTOOL.WIN32.Tracer on the net as if they are real viruses (Virii). How do I tell the difference between a malicious virus and one that just happens to have the signature of a virus?

I've used the search engine extensively to find answers to this but don't see anything.
dELTA
05-17-2004, 06:09 AM
Yeah, the more recent versions of e.g. Symantec Antivirus have started to detect a lot of things like this. It even detects many keygens and cracks as "hacker tools", and also some normal computer security tools, very annoying. Symantec Antivirus 2004 has some settings for different categories of things to detect and not detect, and hopefully some other antivirus programs have this too. I'd turn off detection of all kinds of "hacker tools" and other crap like that if I were you, it's only annoying and doesn't reduce any dangers at all.

As you see in the name of the detected item of yours, it is called a "virtool". Most of the time, you can safely ignore any warnings about anything it calls a "hacker tool", "virus tool" or anything like that.
WaxfordSqueers
05-17-2004, 06:38 PM
As you see in the name of the detected item of yours, it is called a "virtool". Most of the time, you can safely ignore any warnings about anything it calls a "hacker tool", "virus tool" or anything like that.

Thanks for confirming my suspicions. I've seen references to so-called hackers tools on anti-virus sites but they lump them in with all the other malicious viruses. They should list friendly virii, like the one that infected systems to undo the damage done by MSBlaster. Then again, they're all so paranoid, and so ill-informed as to hacking/cracking, that we are all viewed with a jaundiced eye.
nikolatesla20
05-17-2004, 10:09 PM
Thanks for confirming my suspicions. I've seen references to so-called hackers tools on anti-virus sites but they lump them in with all the other malicious viruses. They should list friendly virii, like the one that infected systems to undo the damage done by MSBlaster. Then again, they're all so paranoid, and so ill-informed as to hacking/cracking, that we are all viewed with a jaundiced eye.

Don't know if I'd go as far as to say that they are uninformed to hacking/cracking. These guys are on top of the game of RCE in my opinion, they have specialized in house toolz to help them with their work even. I would not be surprised if some members of ths board or of othre hacking boards belong the anti virii companies. What better way to stay on top of things? (or hire a hacker to write a new virus for them j/k).

If we could apply the same technologies to unpacking and auto tools, as antivirus tools perform, we would have some insane power tools. Cracker tools need to start being stepped up a notch or two...for the future.

-nt20
WaxfordSqueers
05-18-2004, 12:51 AM
Don't know if I'd go as far as to say that they are uninformed to hacking/cracking. -nt20

I get your point. What I was getting at are those types who view reversers as bored teenagers without a life. My experience over the years has shown many reversers to have university training as programmers. Rumour has it that +Orc himself may have been such an academic.

When I first read Matt Pietrek's book on Windows, in which he went right into reversing (aptly calling it spelunking), what struck me was how he was straddling the border between the legal and illegal. He wasn't condoning anything illegal, but he was showing the reader how to go about it. It's similar to another book I read where an author teaches the reader how to make a submachine gun.

In a recent book, which I've only skimmed, Kris Kaspersky refers to reversers (hackers, he calls them) as criminals, yet he goes to great pains to demonstrate the internals of Softice and IDA. He shows how to defeat Softice, yet points out as well, how a reverser might overcome those tricks. He goes on to demonstrate unassembled code and how to read it. It's like he's saying, "hey all you criminals, here's the right way to do it". It's almost as if Pietrek and Kaspersky are crackers at heart. Ilfak (IDA) and Quine were actually corresponding at one point, through a mutual admiration, as I saw it.

It seems the elite have a warm spot in their hearts for reversers, but I'm not refering to that group. I'm talking about the crowd who are paranoid about reversers, and would see them all put in concentration camps. They don't appreciate the great skill involved, and that's what I mean by uninformed. Also, they miss the human element. I've never come across a mean-spirited person in the reversing community.

It would seem anyone with half a brain would admire the great work that has been done in the reversing community. Some of the cracks have been spectacular. But where there's a dollar to be lost, some people are going to behave hysterically. It's this mean-spirited, childishness to which I refer. I guess they never identified with the spirit of Robin Hood, or Santa Claus, for that matter. :-)
doug
05-18-2004, 07:39 PM
Cracker tools need to start being stepped up a notch or two...for the future.

-nt20

imho, the power of their tools holds, in part, because they never leave the computer of their respective creators. (and well, they can afford a lot more development time)

There are several great cracking tools, but everytime, their release brought a set of countermesures that specifically targeted the tool.

95% of the protections I see on the market focus only on "public tools" and "common cracking techniques". I'm sure a lot of people here won't agree, but I guess that sometimes, keeping 'some' information to yourself is the only way to stay one step ahead of the protectionists:)
nikolatesla20
05-19-2004, 09:22 AM
imho, the power of their tools holds, in part, because they never leave the computer of their respective creators. (and well, they can afford a lot more development time)

There are several great cracking tools, but everytime, their release brought a set of countermesures that specifically targeted the tool.

95% of the protections I see on the market focus only on "public tools" and "common cracking techniques". I'm sure a lot of people here won't agree, but I guess that sometimes, keeping 'some' information to yourself is the only way to stay one step ahead of the protectionists:)

Agreed. Excellent point. (How many release groups no doubt have highly efficient SafeDisc removal tools, etc prolly lots that are private).

However, I also was trying to just get a small bit of play here - what I mean to say is if the tools were more powerful, for example, using regular expression engines, or virtual execution engines even, combined with disassembler engines, the code could be made strong enough to keep up with a protection even if the author tried to change it. Point being most protections use a very broad foundation, and then they just build upon or change small things at a time to break a public tool. If that public tool is powerful enough to recognize the "foundation" of the protection then it will always work more effectively, even when up against protection code changes. For example, not using byte code searches, but using regular expression searches inside a dissassembly engine. Looking for an execution pattern, not a code pattern. And the tool would have to allow end-user modification, to escape common detection. Allow the user to change it's title, its filename, any window names, the works. Maybe even if it's debugger based, allowing the change of the style of breakpoint.

Yes, such a thing is mind-boggling and insanely complex it seems, but I do think it could be true in the future. I mean at least offering the more powerful abilities would always help.

Of course if this tool belongs to "a group" it would still be effective even if private..

And keeping a tool private will always make it more effective, but not necessarily more "powerful".

-nt20
qsmt
06-26-2004, 03:07 PM
just wondering if anyone tried to scan the rce-cd with housecall from trendmicro. while norton only found 2 virii, one of which was a hackerTool, housecall claimed this:

PE CHAMPAGNE-------+Sandman\Files\TheChopper.exe

TROJ ANSIBOMB.20----Gthorne.zip Layer4 ANSIB20.EXE

TROJ VZMNUKER.A-----Gthorne.zip Layer2 vzmnuker.exe

WM DEMONSTRATE----Gthorne.zip Layer3 DMV.DOC

XM DMV.B-------------Gthorne.zip Layer3 DMVEXCEL.XLS

HLLP.4631-------------ImmortalDesendants.zip Layer2 ld20kg.exe

Possible Virus----------LordLucifer.zip Layer2 STNRINGO.EXE

Possible Virus----------Stone.zip Layer2 STNRINGO.EXE

HLLP.4631-------------tornado.zip Layer2 ld20kg.exe

i have not gone through the whole content of the cd yet. so maybe these are virii or asm tutorials. perhaps housecall freaks out on these types of files. i don't know much about this type of stuff but i figured i would point it out in case it could be of interest to some others.

FYI: i downloaded the rce-cd contents from the woodmann/RCE-CD page. also scan was done before unzipping.

i shout thanks to all who share their knowledge,
qsmt
WaxfordSqueers
06-27-2004, 08:30 PM
[QUOTE=qsmt]

>>>>while norton only found 2 virii,

I scanned it with AVP and it turned up only the Win32.virtool type virii listed above. As I said in my original post, many of those types are flagged because of the abnormal way in which they are written. Since Norton only found two, and AVP picked out only virtool types, it would seem safe to assume the detections are anomalies. Then again, it's a chance you take.

I've run those with virtool-flagged virii before with no infection. In fact, if you check out the type flagged by AVP, you can't find descriptions for them anywhere on the net. It seems to be picking up virus signatures and not actual virii.

One of those included by you was Greythorne's ansibomb. He is a smart dude who wrote his own stuff and that's probably why Trend's virus program flagged it. Since many of those programs are quite dated, it wouldn't hurt to delete them to be on the safe side.

BTW...IMHO...AVP is still one of the best out there.


Anyone have any good IDA tutorials (how to use)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Anyone have any good IDA tutorials (how to use)
PDA

View Full Version : Anyone have any good IDA tutorials (how to use)

Chal021
05-17-2004, 12:45 AM
W32DASM is really easy to use ..... and very simple .... i opened up ida pro and ...... :confused:

im sure all this increased functionality is worth learning about ..... but i need some info ... searched the net and couldnt find anything worthwhile

anyone got any good tuts?
naides
05-17-2004, 10:30 AM
W32DASM is really easy to use ..... and very simple .... i opened up ida pro and ...... :confused:

im sure all this increased functionality is worth learning about ..... but i need some info ... searched the net and couldnt find anything worthwhile

anyone got any good tuts?

Ricardo Narvaja, "Nuevo Curso" as long as you can read spanish.
ZaiRoN
05-17-2004, 10:41 AM
Hi Chal021,
but i need some infoWhat exactly? Do you tried to read the help inside Ida? It should help you.

Good luck,
Zai
Polaris
05-17-2004, 12:26 PM
W32DASM is really easy to use ..... and very simple .... i opened up ida pro and ...... :confused:

im sure all this increased functionality is worth learning about ..... but i need some info ... searched the net and couldnt find anything worthwhile

anyone got any good tuts?

I don't think you searched the web enough.... There is a funny page on Datarescue's website called "support"... Imagine what's in? :eek:

Trying the "getting started" official doc? It shows you: how to define code, data, ascii strings, navigating and even a small tutorial on IDC. This will teach you the basic of the usage of ida.

Search a bit and get it

Also, these tutorials on the official webpage will fill the remaining gaps:
hxxp://www.datarescue.com/idabase/idasupport.htm

Read this and you'll be able to use IDA Pro at its best.... Then you'll have to learn to search :D
Aimless
05-18-2004, 01:19 AM
You may also google search for +"Mammon" +"IDA" and you should get a good detail about how to use IDA.

Have Phun

PS: IDA is like beer. You don't like it at first and wonder why the more bitter the beer, the better its considered. Only when you get used to the taste, you begin to appreciate it more (or am I going over the top?)
naides
05-18-2004, 08:32 AM
You may also google search for +"Mammon" +"IDA" and you should get a good detail about how to use IDA.

Have Phun

PS: IDA is like beer. You don't like it at first and wonder why the more bitter the beer, the better its considered. Only when you get used to the taste, you begin to appreciate it more (or am I going over the top?)

Please Answer Yes or no to the following questions:

1. C)ut back or C)ontrol: "Have you ever attempted to cut back or control your drinking?"
2. A)ngry or A)nnoyed: "Have you ever been angry or annoyed by anything anyone said about your drinking?"
3. G)uilt: "Have you ever felt guilty about your drinking?"
4. E)ye opener: "Have you ever needed an eye opener?" An eye opener is a drink taken usually early in the morning following a binge to avoid withdrawal.

See you in the NEXT RCE chapter of AA meeting
:D :D
Aimless
05-18-2004, 11:56 PM
Hic!

Wasshat U talkin t'me?

Hve Phon,
Chal021
05-29-2004, 02:15 AM
thanks fer the pointers guys (coding humor) :D

I really appreciate it :D


Armadillo Anti-SICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo Anti-SICE
PDA

View Full Version : Armadillo Anti-SICE

HaRdLoCk
05-17-2004, 04:29 AM
whenever i tried to debug an armadillo protected app it told me "for security purposes this programm will not run while system debuggers are active" - it detected my softice, even if it was not loaded. having installed and enabled iceext does not help either, so it must check somehow for the installation of softice. after playing with the driver, registry and folders i figured out how it does detect softice and how to fix that. since i never found any article on that one, id like to share this here ;-)

armadillo checks for service ntice (no matter if running or not). the check is made using OpenSCManagerA and OpenServiceA. the call to OpenServiceA must return 0 and the extended error information MUST return ERROR_SERVICE_DOES_NOT_EXIST, else the annoying message pops up. quite evil imo, because i cannot run any armadillo protected app on a machine with installed softice ;-/

heres the code snipped:

call dword ptr [ebp-14h] ; OpenServiceA
test eax, eax
jz CannotOpenService
push eax
mov byte ptr [ebp-1], 1
call dword ptr [ebp-10h]
jmp short loc_2B

CannotOpenService:
mov esi, ds:0E460D4h
call esi ; GetLastError
cmp eax, 424h ; ERROR_SERVICE_DOES_NOT_EXIST?
jz GoodBoy

you can simply add advapi32.dll to your exports in softice and then bpx OpenServiceA. type d esp and change NTIce to something else in the data window.
evaluator
05-17-2004, 03:23 PM
can't you look, what service Name it tries to open??
doug
05-17-2004, 06:25 PM
Have a look at:

Rename NTice service. SuperHidden! :P : http://www.woodmann.net/forum/showthread.php?t=4636

about dillodumper (but has details on this particular anti-debug trick):
http://www.woodmann.net/forum/showthread.php?t=4697

basically a search for "softice detection", "hiding softice" brings all the big threads on anti-softice tricks on this board.
JMI
05-17-2004, 07:26 PM
Oh My God.

You don't mean that the search button ACTUALLY WORKS??? Who'd a thunk it. What will they come up with next? Searching on the net?? Nah. Way too hard. :eek:

Although to be completely fair to HaRdLoCk I believe he was telling us he actually found a solution. :cool:

Regards,
nikolatesla20
05-17-2004, 10:05 PM
I've found that new Armadillo still has another trick up its sleeve, I haven't found it yet. I have a fully patched and hidden SoftICE, even more so than documented on this board, and it still detects it. However, in VMWare is does not detect it. So it's definitely a hardware based detection scheme. Just haven't found it yet.

It doesn't matter much anyway, since you don't need SoftICE to do Armadillo work. A regular ring 3 debugger will do just fine.

-nt20
evaluator
05-18-2004, 01:36 AM
maybe you are about that new trick with RF? i wrote about it in newbies forum.
JMI
05-18-2004, 03:41 AM
Losely translated: ;)

Review this thread: :D

http://66.98.132.48/forum/showthread.php?t=5514

see if that's the check.

Regards,
evaluator
05-18-2004, 04:43 AM
>>You don't mean that the search button ACTUALLY WORKS???
(:)
JMI
05-18-2004, 05:17 AM
Great quote Eval. ;) Yep. It ACTUALLY DOES. :eek:

"Evaluator" in user name, search in forum(s) set to "newbie forum" and "rf*" for key word(s) and there it was. Who'd a thunk it could be so easy. :rolleyes:

Regards,
HaRdLoCk
05-18-2004, 06:43 AM
ah damn i used that frickin search button but probably with wrong words ;-P

i'd be anyway interested in detailed instructions how to patch softice against that one. i tried to do so, but ended up in a non working version of course :(
nikolatesla20
05-18-2004, 09:09 AM
maybe you are about that new trick with RF? i wrote about it in newbies forum.

Thanx for the info evaluator. I never saw that thread about it in the newbie forum. I knew already about it detecting iceext, but I couldn't find the hardware detection (I searched the web for every type of detection I could think of). I did know it was hardware though since SI in VMWare would let Arma run.

Dangit SoftICE stay away from modding my hardware regs ! lol.

By the way HardLock, did you remember to correct the checksum of the .sys files after you modded them? If you don't do this windows won't load it.

-nt20
evaluator
05-18-2004, 09:15 AM
so you are about another detection?
Timbo
05-18-2004, 10:14 AM
so you are about another detection?

Well there are many many other's ;)
Unload Stens tool
voilà
A funny one : Divx Player
nikolatesla20
05-18-2004, 11:02 AM
Well there are many many other's ;)
Unload Stens tool
voilà
A funny one : Divx Player

A feature of new cracking tools that should be included - randomized strings on windows, class names, service names, etc.

It doesn't have to be random, it could just include another small program that would allow the user (i.e., reverse engineer) to enter his own strings and then reboot, without using hex editor. A pre-made customizing program.

Alas, this over time becomes much work and for what? Knowledge...

-nt20
Timbo
05-18-2004, 11:38 AM
This tool would eat up this files for shure
bootcfg.sys, cpthook.sys, ntice.sys, siwvid.sys
would replace unneeded command's like dial or serial
with more usefull ones sumperbpm & dr7 reset
and so on


Asprotect 1.31 Build 04.27
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect 1.31 Build 04.27
PDA

View Full Version : Asprotect 1.31 Build 04.27

Computer_Angel
05-17-2004, 12:43 PM
Have any one try to unpack it yet ? Many thing new !
A lot of different from 1.23 RC4 and I'm stucked now :D
You can try to unpack the download to know what is different.
Uradox
05-19-2004, 04:30 AM
Have any one try to unpack it yet ? Many thing new !
A lot of different from 1.23 RC4 and I'm stucked now :D
You can try to unpack the download to know what is different.
i guess its a lot diffirent if you strickly rely on methods you learn from tutorials... some mechanics are new but nothing changes for me cept additional step at getting imports ;\
MEPHiST0
05-19-2004, 06:49 PM
/me pinches ura :)

im checking it out.. appears to be different..
is that a bpx check i see? getting error when bpx is left on IsDebuggerPresent.. >:|

looks the same, not much different at all...
OEP is 401000...

just trace till the PUSH 0C.. set a bpx on teh push 0c..
dont BPX the RETN down there.. because it gets obfuscated and the RETN isnt executed..
there will be one more retn in that process, f7 that.. and it adds up OEP like normal ASPR...

lets see about the IAT..
havent got it resolved yet!...

whats that extra step :)

:X!
JMI
05-19-2004, 10:05 PM
There is a companion thread on exetools regarding this files. You will find it at:

http://www.exetools.com/forum/showthread.php?t=4294

Regards,
MEPHiST0
05-20-2004, 02:36 PM
hi JMI..

wondering if you can get me added to members on ExeTools forums?

Id like to resond to some of the threads over there.. but seems the forums registration is locked..
JMI
05-20-2004, 03:12 PM
MEPHiST0:

Read my first post in this thread and then you would already know the answer to your question.

http://66.98.132.48/forum/showthread.php?t=5915

The relevant part is:

"Again, I do not make these policies, so there is no point in sending me a PM complaining about such things, or asking me to do something about them, or asking that I get you or a friend a membership."

Regards,
Uradox
05-20-2004, 04:37 PM
my exetools acount seems dead now been so long since i used it anyway.
That extra step was patching some shit when aspr builds the imports and then doing a dump of the table.
Imprec was dead in this case so manualy was the answer :|
il probely tell u in the *other* place
dELTA
05-20-2004, 05:04 PM
What is "the other place" if I may ask, considering that you just said your exetools account was dead (and hence you cannot post there)?
JMI
05-20-2004, 06:17 PM
MEPHiST0:

Exetools is open for READING by guest/unregistered, so there should be no reason why you could not at least READ the companion post there on this unpackme.

Regards,
MEPHiST0
05-20-2004, 10:46 PM
sorry JMI, i did not mean for it to sound like complaining..

i just want to be a part of exetools forums as well as woodmann forums :)
Uradox
05-21-2004, 10:41 PM
sorry i only mean an ircd somewhere
SpeKKeL
05-24-2004, 02:30 PM
Hey, this version brings something to play again (just like some years ago....)

I wonder how many api's Alex. has pre-coded ! or has he coded some smart generation routine which cuts and pasts the used api's..... .
It looks like some other packer which allso took some bytes from the used api
and pasted them in his own routine before calling/jumping to the api-location some bytes further... .
Think it has all to do to prevent us to use our semi-automatic toolsssss,(bye,bye imprec___)
h'...mmm how should we patch all those jmps now??? :hmm:
Let's wait till his "final" :D release

SpeKK.
crUsAdEr
05-24-2004, 02:38 PM
spekkel : u r forgetting Imprec supports plug in... Imprec will still owns Asprotect anytime :)
SpeKKeL
05-24-2004, 02:48 PM
Yep i know all about plugins......................... .

But giving here iat info's (rva ) will give some problems, isn't it ?
(did you try it?)
Problem: imprec doesn't recognize the addresses like [xxxxxxxx] .
plugin could indeed be made if you give the right tracing address.
btw there are calls wich go straight to aspr code and calls to jmps (inthe main exe) which will lead to the aspr code.

SpeKK.
crUsAdEr
05-24-2004, 05:10 PM
Yep i know all about plugins......................... .

lol... of course i know that :)... u might not remember but u were the one who introduced me to imprec plugin :)... cant remember if u even sent me some source code...

just that unless aspr can do worse than "import table elimination" by armadillo... imprec will do just fine, of course some manual work is required...


question about some stuff in exe header
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > question about some stuff in exe header
PDA

View Full Version : question about some stuff in exe header

wired
05-17-2004, 01:03 PM
Hi, I noticed that some exe files contain some stuff right after the dos-stub, it appears to be some DWORDs which slightly differs from each other, terminated by the text 'Rich' right before the last DWORD.

if you don't know what i mean, check for example the calc.exe from winxp. on raw offset 0x80 this stuff starts, and ends at 0xd8. many exefiles do have it, but i wasn't able to see some logical pattern in it.

does someone knows what this stuff is?

thanks in advance.
dELTA
05-17-2004, 01:18 PM
http://www.woodmann.net/forum/showthread.php?t=5398

http://www.woodmann.net/forum/showthread.php?t=4499

Sadly, the interesting info was deleted from that thread in the other forum. :( If someone has a copy of it, you are very welcome to post it here anyway.
wired
05-17-2004, 04:26 PM
well, thanks so far. weird stuff anyway, those "disappeared" posts which contained "the truth" :)

does someone else remember what was written in those posts?

thanks.
dELTA
05-17-2004, 06:09 PM
Yeah, it was concluded that it was "encrypted" information about several different versions of the compiler, linker and other stuff like that (they also analyzed how to decrypt it). All that data can be safely removed from the exe anyway, and probably should be too, if you want a more "untraceable" executable.
lifewire
07-16-2004, 08:44 AM
well, i reversed the stuff. is someone still interested, i can write a little article with my results.
dELTA
07-16-2004, 09:03 AM
Sure, that would be very nice, please post it here.
lifewire
07-18-2004, 06:21 AM
here we go! feel free to place it on your favourite places on the net, maybe you can make some other people happy with it ;)
dELTA
07-18-2004, 07:10 AM
Cool, thanks! :yay:
neviens
07-18-2004, 11:05 AM
>... You can write a very simple tool that will
>zero out the rich structure given an exe file, or patch your linker so that it
>won't get written at all...
>

Link from "other forum" regarding a subj (possible broken link warning!):

_http://board.win32asmcommunity.net/showthread.php?threadid=14699

Linker patch also discussed there.
Neviens.
dELTA
07-18-2004, 01:55 PM
That's the thread I was referring to above, in which the info was deleted. You can even see that I have posted myself in that thread, asking where the info went. Can you still find any reference to any detailed info about this in that thread? (not that we really need it anymore, now that we have lifewire's nice essay, but anyway :))
disavowed
07-26-2004, 10:26 PM
lifewire, regarding the 0x536e6144 constant, its ASCII equivalent is: ^naD, or if we were to interpret it byte-by-byte in little-endian: Dan^

i would guess as MZ is related to Mark Zbikowski, Dan^ is related to some guy at MS named Dan
lifewire
07-27-2004, 05:57 AM
nice :)
Silver
07-27-2004, 01:01 PM
Now I got curious... Dan Ruder, Mechanics of Dynamic Linking, Microsoft, MSDN Library 1993, as referenced by patent 6253258 filed by Symantec for "Subclassing system for computer that operates with portable-executable (PE) modules".

Wow, I'm bored :D
lifewire
07-27-2004, 01:36 PM
hahaha, yeah, i guess that must be THE Dan ;)


How to make a kernel debugger ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to make a kernel debugger ?
PDA

View Full Version : How to make a kernel debugger ?

comelysouthchin
05-18-2004, 01:01 AM
i want to know some knowledge about kernel debugger just like softice who can debug the whole system . how to do such debugger ?
any reply wil be ok.
Aimless
05-18-2004, 01:22 AM
Make sure you have more than a passing knowledge of:

1. OS internals
2. Driver models
3. Assembly Code and C

Maybe in about 6-7 months time we can subsequently think of implementing a kernel debugger.

Alternatively, if you are really getting impatient, I'd suggest you move to:

http://www.microsoft.com/ddk

and download the example code. One of the codes is for building a very simplistic kernel debugger.

Have Phun
Aquatic
05-18-2004, 01:28 AM
Wouldn't a device-level debugger be even better? (lower level)

Or get a custom-made CMOS chip that can hold a debugger. (lowest possible level)
comelysouthchin
05-19-2004, 12:12 AM
Thanks for all relpy ,first
I think I am good at c and assemble ,but i have no experience in Driver Model . I think it is a better way to learn from Example code .
thanks
Kayaker
05-19-2004, 11:46 AM
Hi

An interesting endeavour. A couple of things that might be of interest,

Inside kernel debugging support - an interesting in-depth paper that discusses kernel debugger internals from the WinDbg/KD perspective:
(I've attached the article for preservation)

http://www.vsj.co.uk/articles/display.asp?id=265

Also, if, hypothetically, one had the 'leaked' MS code that was going around a few months ago, then, again hypothetically, one would have a good portion if not all of the source from WinDbg64, in a folder of the same name, which might be of some use (hypothetically speaking of course, heheh ;)

Oooh, my ears perked up...

...if you are really getting impatient...

http://www.microsoft.com/ddk

and download the example code. One of the codes is for building a very simplistic kernel debugger.
I'd like to buy a vowel please... :)

I spent quite some time there yesterday but seem to have missed this example code, any other clues come with this tip? :D

Cheers,
Kayaker
tgodd
05-21-2004, 06:45 AM
From a quote from AQUATIC:

Wouldn't a device-level debugger be even better? (lower level)

Or get a custom-made CMOS chip that can hold a debugger. (lowest possible level)

Device level debuggers do exist.
And they are the lowest possible level (Not the CMOS chip statement).

These debuggers are referred to as ice boxes.
They are typically used to debug processors and chipsets, and are also extremely good for debugging code.

Periscope used to sell a redimentary ice box at one time.

Just a little info to hrow into the frey!

TGODD
bilbo
05-21-2004, 09:15 AM
(1) have a look at BlindStudio: incomplete sources for a kernel debugger from Mamaich. The project is dead, and currently available only from Elicz homepage: h..p://www.anticracking.sk/EliCZ/import/Build3.rar

(2) search Google for [Nt/Zw]SystemDebugControl: the API is available on Windows XP (very limited on Windows 2K) and is very powerful... I think that the best of it has not yet been discovered...

Have phun, Bilbo
dELTA
05-21-2004, 04:16 PM
These debuggers are referred to as ice boxes
Cool, finally I get to know where the hell Numega got the name "Softice" from! :cool: (I'd assume it refers to it being a software debugger that's [almost] as good as one of these hardware "ice boxes")
Aquatic
06-01-2004, 04:29 PM
But an integrated CMOS debugger would be better than an ice box.

Look I found one: http://www.gensw.com/pages/prod/bios/debug.htm

Here is giant documentation on an integrated BIOS debugger: http://www.embeddedx86.com/downloads/Manuals/EBIOS-UM.PDF (Page 33)

About Softice.
The 'Soft' refers to 'software' version of the icebox. But I think you figure that out. :)

There are no anti-debugger tricks for these hardware debuggers, are there?
doug
06-01-2004, 05:04 PM
...

There are no anti-debugger tricks for these hardware debuggers, are there?

I don't know if any prot/packer/... uses them, but check
http://www.x86.org/secrets/intelsecrets.htm (check the undocumented opcodes sections)

Check the facilities that the chip provides for debugging with an ice. Then it's fairly easy to think of a few anti-debug tricks.
I haven't been there for a while, but I think some flags in Dr7 and some undocumented opcodes are useful to ice debuggers.
Aquatic
06-01-2004, 05:32 PM
Well, here is a picture: http://www.embeddedx86.com/epc/ts5400-spec.php

16 MBytes of High Speed SDRAM
(32 or 64 MB RAM optional)
2 MByte Flash disk with full BIOS suppport
(4 or 8 MByte Flash optional )

Hey doug, those undocumented opcodes look pretty useful.


ntice 4.27 on win2k sp4, cannot load advapi32.dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ntice 4.27 on win2k sp4, cannot load advapi32.dll
PDA

View Full Version : ntice 4.27 on win2k sp4, cannot load advapi32.dll

homersux
05-18-2004, 11:18 AM
Does anyone have similar experience? If i put
EXP=\systemroot\system32\advapi32.dll

ntice loads very slowly and can't load advapi32 symbols. after ntice finishes
loading, the "system" thread uses 99% of the cpu time and the computer
has to be rebooted.

if I don't include that line in winice.dat, everything works fine but i still don't
have the advapi32 symbols therefore I can't set bpx on those functions. :confused:
Timbo
05-18-2004, 11:32 AM
???
EXP=\systemroot\system32\advapi32.dll
How about
EXP=C:\WINDOWS\SYSTEM32\advapi32.dll
homersux
05-19-2004, 11:02 AM
I suppose I could try that but they should be the same and I don't see why
one wouldn't work but the other would.
dELTA
05-19-2004, 12:40 PM
As a general tip with Softice, if you are running a Windows service pack that was not released back when your version of Softice was released, it is quite likely that you need some kind of patch/update/newer version to make it run ok. Patches can sometimes be downloaded from the Compuware website for free anyway.


Reverse engineering in the movies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Reverse engineering in the movies
PDA

View Full Version : Reverse engineering in the movies

disavowed
05-18-2004, 01:00 PM
I just saw the movie Paycheck. The main character (played by Ben Affleck) is a reverse-engineer! His profession was even referred to as such in the movie.

The movie itself wasn't too bad, except for the fact that it had Ben Affleck in it, of course.
JMI
05-18-2004, 01:55 PM
"Reverse-engineering" is a perfectly legal profession in the sense that one seeks to understand the operation of some software and to emulate its functionality without using the actual intellectual property of that software. In this context one team can view the "target" software and figure out what the heck it is doing and another group, required to be kept in strict isolation from the first group, attempts to come up with a solution that will work with the other's software, without utilizing it's code.

It's also done in the chemical and electronic industry all the time.

Regards,
Aimless
05-19-2004, 05:19 AM
1. Movie modems seem to transfer data at Gbps rather than Mbps...wonder what ISP they use...

2. Every program *always* has an override switch and the password is *always* guessable in 3 tries...

3. If you delete an open file from one terminal (evil guy discovers hero snooping on his file by checking the machine where he is working), it gets deleted at the other terminal where the hero is viewing it...

4. All office machines have trace programs on them that enable graphical (in AutoCAD 3-D) view of the building with terminals that are on so that its convenient for the evil guy sidekick to trace the hero reading his dirty dirty files...

5. The person whom the evil guy holds hostage (generally professor or doctor) can program in assembly and binary and probably even debug CMOS with his bare eyes and fingers!!

6. Hard disks and floppies are so resilient, that they are burnt, sunk, jumped on, made dirty by the shovels...and they still run the first time without any boot sector or read errors...gotta hand it to the awesone CD/DVD drives!!!

7. Everybody who can operate on a computer can crack any cryptically protected software using just desktop computers in 15 seconds flat!! (Guess the Zimmerman was lying when he said that it will take the time till the universe implodes again;) Then again, all companies crypt important documents with mere XORing.)

8. Software is cracked without debuggers, disassemblers, unpackers, uncrypters, dumpers etc. etc.

9. Heros always carry bus loads of cables with them to at-an-instant connect the laptop to ATMs, Mainframes, and god bloody knows what.

10. Heros almost always connect to the LAN without the wires or patchcords!!! Guess wireless is really popular globally!!

11. Wonder where the hero recharges his laptop....

12. AAAhhhh! The Big One!!! Almost ALL machines used in movies *DO NOT* seem to be operating on any known version of Windows! *nix users can now go wild with joy!!

13. Most machines are NEVER PCs. They are almost always Macintoshes or Powerbooks. Hmmm...
JMI
05-19-2004, 05:33 AM
Well those last items are know as "product placement" where the film maker is actually paid to have certain products displayed/used in the films. They even occasionally pay actors to smoke. Cough, cough. :rolleyes:

Regards,
disavowed
05-19-2004, 07:21 AM
nice list

3. If you delete an open file from one terminal (evil guy discovers hero snooping on his file by checking the machine where he is working), it gets deleted at the other terminal where the hero is viewing it...
hmm.. only time i saw this was in Clear and Present Danger. has it happened in many other movies?
evaluator
05-19-2004, 11:07 AM
better is Flash-movies:)
here i found some movie about REngineer esther
//atomfilms.shockwave.com/afassets/downloads/exe/heros_load_ad.exe
vgb
05-19-2004, 11:56 AM
12. AAAhhhh! The Big One!!! Almost ALL machines used in movies *DO NOT* seem to be operating on any known version of Windows! *nix users can now go wild with joy!!

13. Most machines are NEVER PCs. They are almost always Macintoshes or Powerbooks. Hmmm...

The motion picture industry uses Macs for the majority of their graphics, etc. Seems logical that's what they would feature in the flic.

vgb
dELTA
05-19-2004, 12:37 PM
hmm.. only time i saw this was in Clear and Present Danger. has it happened in many other movies?
I've seen it in at least a bunch of tv series, even if I don't remember any specifics. And it does of course always come with a nice animation on the screen too btw. :p
WaxfordSqueers
05-19-2004, 02:11 PM
12. AAAhhhh! The Big One!!! Almost ALL machines used in movies *DO NOT* seem to be operating on any known version of Windows! *nix users can now go wild with joy!!

My favourites (most frustrating) are the electrical fires that seem to pop out of consoles (keyboards). I'm both an electrician and electronic technician, and I've never seen the likes of that in my entire career. I've seen plenty of smoke and sparks, but never coming out of a closed cabinet, or a keyboard.

The best one I saw was a 600 volt transformer blowing up. I'm glad I wasn't in the immediate vicinity, because there was molten copper flying everywhere. It was in an electrical room in an underground parkade, and the noise was deafening. There was so much smoke, you couldn't see anywhere in the parkade. It amazes me that Hollywood effects artists make up what they think is exciting whereas the real thing is much more awesome.

I used to marvel at the original Mission Impossible, when the black guy (Gregg Morris??) would make complex electronics seem mundane. He'd access a telephone circuit, with 100 cable pairs, and zero-in to the exact one he needed, from a convenient cabinet located outside, behind some bushes, in broad daylight. None of the terminals were marked, and even if they were, I've never seen one that tells you the specific circuit you need. You'd actually have to go into the building, find the telephone set you need, and trace it back through several intermediate cabinets to the main telephone room. That does not explain why there is a convenient box sitting outside, behind a bush, with the cable pair you need.
Fake51
05-19-2004, 02:58 PM
I've always marveled at how incredibly good the picture processing software is in movies and TV-series. It seems that no matter how blurry an image is, they can always "dig deeper in the pixels" to produce a perfect image of the bad guy (typically). Having tried a few times with photoshop myself, I really have to hand it to them - marvelous.

Fake
JMI
05-19-2004, 02:59 PM
And speaking of things going bump in the night and not accurately reflected on film, I always marvel at how shells and rockets seem to go off without actually shaking the ground on which the camera happens to be located. Although my own experience with such things was not nearly as frequent as many others, I can attest that the noise, vibration, and the shaking of terra firma from such events is quite literally "breath taking" and will, on occasion, actually bounce one out of bed, let alone a fairly sound sleep. :o

And while it might not be true, as the movies are fond of saying, that you never hear the shot that kills you, you certainly won't remember it afterwards. :rolleyes:

Keep your heads down out there. ;)
klier
05-20-2004, 06:16 AM
but on the otherhand:
"By reverse engineering successful movies one can discover what moves human beings." ;)
Regards,
Woodmann
05-20-2004, 06:03 PM
I thought I was the only person who noticed such things :p

Ever notice how :

You can get access to the room with pasword locked door with a retina scan and fingerprint id with some thing that looks like a walkman with a cable and a card attached to it ?

Every team has a guy who is a computer ace and he can brute force the combination to a safe with a bazillion dollars in...with a laptop and 7 minutes.

The good guy knows just the right command to reveal all the secret files that he couldn't find with his 3 tries at the password.

Every database can be downloaded on to a floppy in 5 seconds while the building is engulfed in flames.

The bad guy file always has his picture and all the vital information including the last place he made a phone call from and what toilet tissue he wipes his ass with.

Everytime there is a disk for money transfer, the bad guy has no idea that the good guy made a copy. The bad guy never has a comp to check the disk before he hands over the million dollars

Gun fire in a building is deafening yet people can still hear each other speak.

A long time ago there was a movie that was so horrible the trailer ran a little thing that said "keep repeating to yourself, it's only a movie"

I love the movies :)

Woodmann
dELTA
05-20-2004, 06:10 PM
You can get access to the room with pasword locked door with a retina scan and fingerprint id with some thing that looks like a walkman with a cable and a card attached to it ?
And if that wouldn't work after all, it always works to blast away the keypad with your gun. No matter how advanced the lock system is, the door will slide right open when someone does this. :p
Woodmann
05-20-2004, 06:28 PM
BAHAHAHAHAHAHAHAHAHAA

You are absolutely correct :)

Woodmann
koyaan
05-25-2004, 08:45 AM
whenever anyone wants to destroy a computer they just shoot the screen
and all data is lost...

and the major fault in paychek: his memory gets deleted after every job,
so how the heck does he learn new techniques 8) ?
dELTA
05-25-2004, 07:16 PM
Visiting places like this on his spare time between the projects maybe? :p
nikolatesla20
05-25-2004, 10:43 PM
They only deleted specific things in his memory, directly relating to the job...
dELTA
05-27-2004, 06:09 AM
Well, they rather deleted specific periods of time, i.e. the periods during which he had worked on the project, but during that period all memories were deleted, including f*****g Uma Thurman. :D
evaluator
05-27-2004, 08:47 AM
hey you!

don't you see, i'm little girl here.. so no bad wordz!
naides
05-27-2004, 10:26 AM
hey you!

don't you see, i'm little girl here.. so no bad wordz!
he said FORKING, FORKING

Don't try to pull a Michael Powell /Janeth Jackson show of indignation here :D :D
JMI
05-27-2004, 12:03 PM
Actually he didn't say anything of the kind. It was completely left to your imagination to fill in the spaces filled with "*"s and YOUR problem if you "imagined" a "bad wordz." :whoops:

Regards,
esther
05-27-2004, 12:33 PM
>better is Flash-movies:)
>here i found some movie about REngineer esther
The girl carrying a cat,so pathetic like you :p
evaluator
05-27-2004, 02:05 PM
thanks for solving cat:)

want you to find some fun movie about me?
disavowed
05-31-2004, 09:21 AM
I just saw "The Day After Tomorrow" and I think I saw them using VMware when showing a presentation to the President. If anyone wants to try to confirm/disconfirm that, it looked to me like a Windows VMware guest window on top of some other host platform.
Silver
06-07-2004, 08:48 AM
Always amazing how people can be on a military helicopter, yet talk to each other by slightly raising their voice... If you've even been on a helicopter, you can barely hear someone shouting unless you're using the comms.

Oh, and nice how so many o/s's are represented by 3d rotating cubes (hackers, swordfish, jurassic park, the net, etc etc etc)
dELTA
06-11-2004, 01:27 PM
disavowed, here's the scene you are referring to I assume, and I don't see any particular signs making me believe it's VMWare, do you? Looks like a desktop with some icons on it and some other non-VMWare app in front of it I think, and sure, the desktop doesn't cover the whole screen, but I don't see anything resembling the typical VMWare controls above it?

Sorry about the late reply, I didn't want to spoil the movie by looking around for that scene in the copy on my HD before seeing it at the cinema. ;)
kittmaster
06-27-2004, 10:07 PM
nice list

hmm.. only time i saw this was in Clear and Present Danger. has it happened in many other movies?

The building outlay was used in eraser when they where trying to find arnold accessing the disk from the head guys office. He was "isolating" access on the "secure" terminals..... ;)
Aquatic
06-28-2004, 01:50 AM
Ever see the film 'Casebusters'?

It's about these kids that decypher codes.
disavowed
06-28-2004, 06:32 PM
delta: yep, that's the scene. thanks for finding it. any chance of getting a higher-res pic of it?
dELTA
06-28-2004, 07:23 PM
Well, nah, not until a dvdrip is released anyway. ;) But I frankly don't see anything in that picture indicating that it would be VMWare, do you?
disavowed
06-28-2004, 09:58 PM
yeah, i guess it makes sense that the dvd's not out yet ;)

i didn't see anything in particular that indicated vmware, but as you said, there is a windows-like desktop in a window on the screen. lemme know when the dvd comes out ;)
disavowed
06-28-2004, 10:11 PM
I removed the screen distortion from the original camera angle. As you can see, it is very revealing :p
dELTA
06-29-2004, 07:46 AM
Hehe, cool. :) What software did you use to do that? Did you just skew it in different directions until it was rectangular?
nikolatesla20
06-29-2004, 08:48 AM
Photoshop can easily correct perspective problems like that.

-nt20
Silver
06-29-2004, 12:54 PM
That looks like a terminal services session to me....
nikolatesla20
06-29-2004, 01:16 PM
Well, if we had the nice tools that they always have in the movies, we could simply enlarge and "enhance" the image until we could make it all out clearly :devil:

-nt20
dELTA
06-29-2004, 03:51 PM
My friend is a movie director, so he let me borrow one of the image enhancement tools that they use in the movies, and you were right, it was indeed Terminal Services:
:D
Woodmann
06-29-2004, 03:54 PM
Bwahahahahahahahahahahaaaa :D
nikolatesla20
06-29-2004, 04:02 PM
Delta, lol , making that image, there's 5-10 minutes of your life you'll never get back !

Regarding that image "utility" - you should rip the code with TMG Ripper Studio, and repackage it in your own GUI, you could make millions ! *sniff* (me smells acprotect)

-nt20
dELTA
06-29-2004, 04:10 PM
Hehe, yeah, I actually thought Acprotect was some kind of joke the first time I saw it, it's such a total rip-off of Asprotect!? And then the stupid bastards even have the nerve to give it almost the same NAME! I sometimes still wonder if it's a joke, or why Alexey hasn't sued their asses off (or well, sent the KGB after them or something anyway :))...
nikolatesla20
06-29-2004, 04:22 PM
Well, I managed to snarf a copy of that special image software you used, (I got some connections too)

Wondered if anyone noticed this in the screen - image pixelated for PG rating....

No wonder there was a storm. A storm in the pants..

-nt20
disavowed
06-29-2004, 08:34 PM
Hehe, cool. :) What software did you use to do that? Did you just skew it in different directions until it was rectangular?
i recreated the scene in a 3d environment in 3d studio max, then overlaid the videocap as a 2d mesh. after that, i applied an extrusion algorithm and rotated the screen in 3dsmax, then rendered the scene and posted the output.

seriously though, i just used photoshop's free_transform/distort

as for the paris hilton pic posted... try blurring your eyes and looking at it. it's much easier to see the original image ;)
Silver
06-30-2004, 10:38 AM
hahaha omg... dELTA, that had me laughing for ages :D nice one!
nikolatesla20
06-30-2004, 10:38 AM
as for the paris hilton pic posted... try blurring your eyes and looking at it. it's much easier to see the original image ;)

Wow that is actually pretty cool, it works..never thought of that.

-nt20
JMI
06-30-2004, 01:35 PM
For those of us whose eyes are always "blurring," the picture was always clear. :D

Regards,
Silver
06-30-2004, 02:46 PM
Hey, that's really strange. When you blur your eyes, it's like you can see more detail than is actually there... Wonder if there is a medical/scientific explanation for that...
JMI
06-30-2004, 02:54 PM
When you "blur" your eyes, you change the focal length of the image on the retina. There is probably also a tendency of the brain to "adjust" the image to resolve it into something that appears to make sense. :idea:

Regards,
nikolatesla20
06-30-2004, 07:22 PM
So maybe there is a future for those "special" image enhancement programs from the movies hehehe

-nt20
JimmyClif
07-01-2004, 12:39 PM
The 'blurring' of the eyes first came to use in the days when watching 'blurred' (unpayed for) porn channels, IIRC :thinking:

/(Dude in American Pie) screaming "It's a tit - That was a tit"
Silver
07-02-2004, 03:45 AM
It's also interesting how changing the focal point allows you to see those stereograms (the pics that turn 3d when you stare at them)...
klier
07-03-2004, 07:48 AM
depixelated for those who are getting tired of blurring there eyes. :devil:
nice movie software.
Regards,
Silver
07-03-2004, 11:10 AM
the magic of voxels.... er, hm.
disavowed
07-05-2004, 08:25 PM
yep, i guess those biopsychology classes i took were useful after all

Wow that is actually pretty cool, it works..never thought of that.

-nt20
dELTA
08-23-2004, 04:42 PM
Here's a program to turn your computer into one of those cool movie computers:

http://www.nullsoft.com/free/nbeep/

:p

And here's a higher res image of that Day After Tomorrow computer screen, as promised earlier:
JMI
08-23-2004, 04:54 PM
We, ALL, shall be eternally grateful for both offerings. :devil:

Regards,
disavowed
08-24-2004, 12:30 AM
And here's a higher res image of that Day After Tomorrow computer screen, as promised earlier:un-warped picture attached below

Here's a program to turn your computer into one of those cool movie computers:

http://www.nullsoft.com/free/nbeep/
is there anything nullsoft can't do? ;)


NTice.sys Patch for DriverStudio v3.x,fix problem of Symbol Loader not breaking at Wi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > NTice.sys Patch for DriverStudio v3.x,fix problem of Symbol Loader not breaking at Wi
PDA

View Full Version : NTice.sys Patch for DriverStudio v3.x,fix problem of Symbol Loader not breaking at Wi

iceplus
05-19-2004, 04:18 AM
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
I C E P L U S
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
NTice.sys Patch for DriverStudio v3.x
to fix problem of Symbol Loader not
breaking at WinMain
Only tested on Winxp, DS v3.0,3.1,(2.7??)

NTice.sys path: %SYSTEM%\drivers
for example:
"C:\windows\system32\drivers\"

iCePlUs[2004]

Web:iceplus.126.com
Email:iceplus@hotmail.com
dELTA
05-19-2004, 06:46 AM
That problem is still in the latest Softice? Why don't they ever fix it, it's been there for ages now?!
crUsAdEr
05-19-2004, 07:23 AM
Mine does break fine at WinMain.. using DS3.1...
ZaiRoN
05-19-2004, 08:51 AM
I agree with you Crusader.
iceplus, can you tell us more about the patch? Seems like you only nopped some conditional jumps, why?

best regards,
ZaiRoN
Kayaker
05-19-2004, 10:32 AM
Hmm, a patch with no source, hidden imports, altered section characteristics...

Why not an open and honest presentation of the problem and its solution?
dELTA
05-19-2004, 12:31 PM
The problem I was referring to was that Softice used to refuse to breakpoint at entrypoint/winmain if the PE section it was located in didn't have certain characteristics (like the executable flag etc). Does it always break nowadays, disregarding the PE section flags, or is this what this tool supposedly fixes maybe?
naides
05-19-2004, 02:41 PM
Hmm, a patch with no source, hidden imports, altered section characteristics...

Why not an open and honest presentation of the problem and its solution?

I followed the web address this Iceplus fellow gives

http://iceplus.126.com

There seems to be a discussion about what this patch is all about. The only problem is that it is carried in chinese. Perhaps this person has good intentions but cannot communicate. . .
iceplus
05-19-2004, 08:05 PM
.text:0003106B BreakLdrProcHandle proc near ; CODE XREF: sub_3163F+3Bp
.text:0003106B
.text:0003106B arg_0= dword ptr 8
.text:0003106B
.text:0003106B 55 push ebp
.text:0003106C 8B EC mov ebp, esp
.text:0003106E 60 pusha
.text:0003106F 8B 5D 08 mov ebx, [ebp+arg_0]
.text:00031072 0F B6 0D D2 2F 0E+ movzx ecx, LoadProcName
.text:00031079 41 inc ecx
.text:0003107A BE D3 2F 0E 00 mov esi, offset unk_E2FD3
.text:0003107F 8D 7B 0E lea edi, [ebx+0Eh]
.text:00031082 FC cld
.text:00031083 E8 24 CC 03 00 call _StringCmpareNoAa ; compare process name
.text:00031088 75 75 jnz short loc_310FF
.text:0003108A 66 A1 F3 2F 0E 00 mov ax, word_E2FF3
.text:00031090 66 83 F8 FF cmp ax, 0FFFFh
.text:00031094 74 05 jz short loc_3109B
.text:00031096 66 39 03 cmp [ebx], ax
.text:00031099 75 64 jnz short loc_310FF
.text:0003109B
.text:0003109B loc_3109B: ; CODE XREF: BreakLdrProcHandle+29j
.text:0003109B 0F B7 43 02 movzx eax, word ptr [ebx+2]
.text:0003109F 0F 02 C8 lar ecx, eax
.text:000310A2 75 5B jnz short loc_310FF ; patch here NO JUMP
.text:000310A4 66 81 E1 00 18 and cx, 1800h ; in DS V3.1, we search "66 81 e1 00 18" to get "BreakLdrProcHandle" address
.text:000310A9 66 81 F9 00 18 cmp cx, 1800h
.text:000310AE 75 4F jnz short loc_310FF ; patch here NO JUMP
.text:000310B0 66 A3 66 E2 0F 00 mov word_FE266, ax
.text:000310B6 C6 05 6C E2 0F 00+ mov byte_FE26C, 3
.text:000310BD E8 6F F3 FF FF call sub_30431
.text:000310C2 72 3B jb short loc_310FF ; patch here NO JUMP
.text:000310C4 8B 0D F9 2F 0E 00 mov ecx, dword_E2FF9
.text:000310CA 03 4B 04 add ecx, [ebx+4]
.text:000310CD 89 0D 68 E2 0F 00 mov AddressInCur, ecx
.text:000310D3 8D 3C 01 lea edi, [ecx+eax]
.text:000310D6 C7 05 6D 41 11 00+ mov BreakViewType, 10004h
.text:000310E0 8B C1 mov eax, ecx
.text:000310E2 E8 AD 71 01 00 call sub_48294
.text:000310E7 A3 01 30 0E 00 mov dword_E3001, eax
.text:000310EC 66 8B 0D 66 E2 0F+ mov cx, word_FE266
.text:000310F3 E8 44 FF 06 00 call sub_A103C
.text:000310F8 C6 05 D1 2F 0E 00+ mov byte_E2FD1, 0
.text:000310FF
.text:000310FF loc_310FF: ; CODE XREF: BreakLdrProcHandle+1Dj
.text:000310FF ; BreakLdrProcHandle+2Ej ...
.text:000310FF 61 popa
.text:00031100 5D pop ebp
.text:00031101 C2 04 00 retn 4
.text:00031101 BreakLdrProcHandle endp
iceplus
05-19-2004, 08:40 PM
00000:
00001: ;================================================================================
00002: ; SiceLdrBreak Patch V0.1beta
00003: ;
00004: ;================================================================================
00005:
00006: format PE GUI 4.0
00007: entry start
00008:
00009: include '%fasminc%\win32a.inc'
00010: include 'pe.inc'
00011: ;================================================================================
00012: ; DATA
00013: ;================================================================================
00014: section '.data' data readable writeable
00015: hIcon dd 0
00016: hInstance dd 0
00017: flags dd ?
00018: pNewFileName rb 40h
00019:
00020: ofn OPENFILENAME
00021:
00022: hFile dd ?
00023: FileSize dd ?
00024: hMapFile dd ?
00025: pMemory dd ?
00026: pFileFilter db "WDM Files",0,"*.sys",0,0
00027:
00028: pFileName rb 40h
00029:
00030: message db 'Patch error !', 0
00031: message2 db 'Good! Patch succeed !',0dh,0ah,0dh, 0ah,\
00032: 'Please restart your computer!',0
00033: caption db 'SiceLdrBreak Patch', 0
00034:
00035: codebin db 66h,81h,0E1h,00h,18h,66h,81h,0F9h,0,18h
00036: codesize dd $-codebin
00037:
00038: nop1 db 75h,5bh
00039: size_nop1 dd $-nop1
00040: nop2 db 75h, 4fh
00041: size_nop2 dd $-nop2
00042: nop3 db 72h,3bh
00043: size_nop3 dd $-nop3
00044:
00045: ;================================================================================
00046: ; CODE
00047: ;================================================================================
00048: section '.code' code readable executable
00049:
00050: start:
00051:
00052: invoke GetModuleHandle,0
00053: mov dword [hInstance], eax
00054:
00055: invoke DialogBoxParam,eax,37,HWND_DESKTOP,DialogProc,0
00056: or eax,eax
00057: jz exit
00058: exit:
00059: invoke ExitProcess,0
00060:
00061: proc DialogProc,hWnd,msg,wparam,lparam
00062: push ebx esi edi
00063: cmp [msg],WM_INITDIALOG
00064: je WmInitdialog
00065: cmp [msg],WM_COMMAND
00066: je WmCommand
00067: cmp [msg],WM_CLOSE
00068: je WmClose
00069: xor eax,eax
00070: jmp finish
00071: WmInitdialog:
00072: ; set icon
00073: invoke LoadIcon,[hInstance],IDI_FIRST
00074: mov [hIcon],eax
00075: invoke SendMessage,[hWnd],WM_SETICON,1,eax
00076:
00077: mov [ofn.lStructSize],sizeof.OPENFILENAME
00078: mov eax,[hWnd]
00079: mov [ofn.hwndOwner],eax
00080: mov eax,[hInstance]
00081: mov [ofn.hInstance],eax
00082: mov [ofn.lpstrFilter], pFileFilter
00083: mov [ofn.lpstrTitle], caption
00084:
00085: mov [ofn.lpstrFile], pFileName
00086: mov [ofn.nMaxFile],1000h
00087:
00088: jmp processed
00089:
00090: WmCommand:
00091: cmp [wparam],BN_CLICKED shl 16 + ID_File
00092: je getfilename
00093: cmp [wparam],BN_CLICKED shl 16 + ID_Patch
00094: jne processed
00095: ;---------------------------------------------------------------------------------------------
00096: invoke GetDlgItemText,[hWnd],ID_FileName,pFileName,40h
00097: mov [flags],MB_OK
00098:
00099: invoke IsDlgButtonChecked,[hWnd],ID_BackUp
00100: cmp eax,BST_CHECKED
00101: jne not_backup
00102: invoke CopyFile,pFileName,pNewFileName,FALSE
00103:
00104: not_backup:
00105:
00106: invoke CreateFile, pFileName,GENERIC_READ or GENERIC_WRITE,FILE_SHARE_READ or FILE_SHARE_WRITE,\
00107: 0,OPEN_EXISTING,FILE_ATTRIBUTE_ARCHIVE,0
00108: cmp eax,-1
00109: je failed
00110: mov [hFile], eax
00111: invoke GetFileSize, eax, NULL
00112: mov [FileSize], eax
00113: invoke CreateFileMapping, [hFile],NULL,PAGE_READWRITE,0,0,NULL
00114: mov [hMapFile], eax
00115: invoke MapViewOfFile, [hMapFile],FILE_MAP_ALL_ACCESS,0,0,0
00116: mov [pMemory], eax
00117: ;;;;;;;;;;;;;;;;;;;;Repair NTice;;;;;;;;;;;;;;;;;;;;;;;;;;
00118:
00119: stdcall GetNticeCodeSize, eax
00120: stdcall BinSearch, esi, ecx, codebin, dword [codesize]
00121: cmp eax, -1
00122: jz failed
00123: add esi, eax
00124: sub esi, 8h
00125: stdcall BinSearch, esi, 30h, nop1, dword [size_nop1]
00126: cmp eax, -1
00127: jz failed
00128: add esi, eax
00129: mov word [esi], 9090h
00130: stdcall BinSearch, esi, 30h, nop2, dword [size_nop2]
00131: cmp eax, -1
00132: jz failed
00133: add esi, eax
00134: mov word [esi], 9090h
00135: stdcall BinSearch, esi, 30h, nop3, dword [size_nop3]
00136: add esi, eax
00137: mov word [esi], 9090h
00138: stdcall RepairCheckNum, [pMemory]
00139: invoke MessageBox, [hWnd],message2,caption,MB_OK
00140:
00141: ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
00142: invoke UnmapViewOfFile,[pMemory]
00143: invoke CloseHandle,[hMapFile]
00144: invoke CloseHandle,[hFile]
00145: jmp processed
00146: ;---------------------------------------------------------------------------------------------
00147: getfilename:
00148: mov [ofn.Flags],OFN_EXPLORER+OFN_FILEMUSTEXIST+OFN_HIDEREADONLY
00149: mov [ofn.lpstrTitle],NULL
00150: invoke GetOpenFileName, ofn
00151: or eax,eax
00152: jz failed
00153: invoke SetDlgItemText,[hWnd],ID_FileName,pFileName
00154: invoke lstrcpy,pNewFileName,pFileName
00155: invoke lstrlen,pNewFileName
00156: mov esi, pNewFileName
00157: add esi, eax
00158: mov dword [esi],'.bak'
00159: jmp processed
00160: ;----------------------------------------------------------------------------------------------
00161: load_out_of_memory:
00162: invoke CloseHandle,ebx
00163: failed:
00164: invoke MessageBox,[hWnd],message,caption,MB_OK
00165: jmp processed
00166: ;----------------------------------------------------------------------------------------------
00167: WmClose:
00168: invoke EndDialog,[hWnd],0
00169:
00170:
00171: processed:
00172: mov eax,1
00173: finish:
00174: pop edi esi ebx
00175: return
00176: endp
00177:
00178: ;--------------------------------------------------------------------------------
00179: proc GetNticeCodeSize, pMem
00180:
00181: mov esi, [pMem]
00182: mov eax, dword [esi+IMAGE_DOS_HEADER.e_lfanew]
00183: add eax, esi
00184:
00185: mov esi, dword [eax+IMAGE_NT_HEADERS.OptionalHeader+IMAGE_OPTIONAL_HEADER32.BaseOfCode]
00186: mov ecx, dword [eax+IMAGE_NT_HEADERS.OptionalHeader+IMAGE_OPTIONAL_HEADER32.BaseOfData]
00187: sub ecx, esi
00188: add esi, [pMem]
00189: return
00190: endp
00191:
00192: proc RepairCheckNum, pMem
00193:
00194: mov esi, [pMem]
00195: mov edi,[esi+IMAGE_DOS_HEADER.e_lfanew]
00196: add edi,esi
00197: mov dword [edi+IMAGE_NT_HEADERS.OptionalHeader+IMAGE_OPTIONAL_HEADER32.CheckSum],0
00198:
00199: mov ecx,[FileSize]
00200: inc ecx
00201: shr ecx,1
00202: xor eax,eax
00203: clc
00204:
00205: cal_checksum:
00206: adc ax,word [esi]
00207: inc esi
00208: inc esi
00209: loop cal_checksum
00210: mov ebx,[FileSize]
00211: add eax,ebx
00212: mov dword [edi+IMAGE_NT_HEADERS.OptionalHeader+IMAGE_OPTIONAL_HEADER32.CheckSum], eax
00213:
00214: return
00215: endp
00216:
00217: ;===========================================================
00218: proc BinSearch,lpSource,sLen,lpPattern,pLen
00219:
00220: push ebx
00221: push esi
00222: push edi
00223: ; ----------------
00224: ; setup loop code
00225: ; ----------------
00226:
00227: mov esi, [lpSource]
00228: mov edi, [lpPattern]
00229: mov al, [edi] ; get 1st char in pattern
00230:
00231: mov ecx, [sLen]
00232: add esi, ecx ; add source length
00233: neg ecx ; invert sign
00234: dec [pLen]
00235:
00236: jmp Scan_Loop
00237:
00238: ; ---------------------------
00239:
00240: Pre_Match:
00241: lea ebx, [esi+ecx] ; put current scan address in EBX
00242: mov edx, [pLen] ; put pattern length into EDX
00243:
00244: Test_Match:
00245: mov ah, [ebx+edx-1] ; load last byte of pattern length in main string
00246: cmp ah, [edi+edx-1] ; compare it with last byte in pattern
00247: jne Pre_Scan ; exit loop on mismatch
00248:
00249: sub edx, 1
00250: jnz Test_Match
00251: jmp Match
00252:
00253: Pre_Scan:
00254: add ecx, 1 ; start on next byte
00255:
00256: Scan_Loop:
00257: cmp al, [esi+ecx] ; scan for 1st byte of pattern
00258: je Pre_Match ; test if it matches
00259: add ecx, 1
00260: js Scan_Loop ; exit on sign inversion
00261:
00262: ;-----------------------------
00263:
00264: No_Match: ; fall through here on no match
00265: mov eax, -1
00266: jmp isOut
00267:
00268: Match:
00269: add ecx, [sLen]
00270: mov eax, ecx
00271:
00272: isOut:
00273: pop edi
00274: pop esi
00275: pop ebx
00276:
00277: return
00278: endp
00279:
00280: ;================================================================================
00281: ; IAT
00282: ;================================================================================
00283: section '.idata' import data readable writeable
00284:
00285: library kernel,'KERNEL32.DLL',\
00286: user,'USER32.DLL',\
00287: comdlg32,'comdlg32.dll'
00288:
00289: import kernel,\
00290: GetModuleHandle,'GetModuleHandleA',\
00291: lstrlen,'lstrlenA',\
00292: lstrcpy,'lstrcpyA',\
00293: CopyFile,'CopyFileA',\
00294: CreateFile,'CreateFileA',\
00295: GetFileSize,'GetFileSize',\
00296: CreateFileMapping,'CreateFileMappingA',\
00297: MapViewOfFile,'MapViewOfFile',\
00298: UnmapViewOfFile,'UnmapViewOfFile',\
00299: CloseHandle,'CloseHandle',\
00300: ExitProcess,'ExitProcess'
00301:
00302: import user,\
00303: DialogBoxParam,'DialogBoxParamA',\
00304: LoadIcon,'LoadIconA',\
00305: SendMessage,'SendMessageA',\
00306: CheckRadioButton,'CheckRadioButton',\
00307: GetDlgItemText,'GetDlgItemTextA',\
00308: SetDlgItemText,'SetDlgItemTextA',\
00309: IsDlgButtonChecked,'IsDlgButtonChecked',\
00310: MessageBox,'MessageBoxA',\
00311: EndDialog,'EndDialog'
00312:
00313: import comdlg32,\
00314: GetOpenFileName,'GetOpenFileNameA'
00315:
00316: ;================================================================================
00317: ; RSRC
00318: ;================================================================================
00319: section '.rsrc' resource data readable
00320:
00321: ID_Patch = 101
00322: ID_File = 102
00323: ID_FileName = 201
00324: ID_BackUp = 401
00325: IDI_MAIN = 501
00326: IDI_FIRST = 502
00327: IDB_LOGO = 601
00328:
00329: directory RT_DIALOG,dialogs,\
00330: RT_ICON,icons,\
00331: RT_GROUP_ICON,grpicons,\
00332: RT_BITMAP,image
00333:
00334: resource icons,\
00335: IDI_MAIN,LANG_NEUTRAL,icon_data
00336: resource grpicons,\
00337: IDI_FIRST,LANG_NEUTRAL,main_icon
00338: resource dialogs,\
00339: 37,LANG_ENGLISH+SUBLANG_DEFAULT,demonstration
00340: resource image,\
00341: IDB_LOGO,LANG_ENGLISH,LogoBMP
00342: icon main_icon,icon_data,'main.ico'
00343:
00344: bitmap LogoBMP,'logo.bmp'
00345:
00346: dialog demonstration,'NTiceLdrPatch for DS v3.x',200,200,168,80,WS_CAPTION+WS_POPUP+WS_SYSMENU+DS_MODALFRAME
00347: dialogitem 'STATIC','NTice:',-1,5,40,70,8,WS_VISIBLE
00348: dialogitem 'EDIT','',ID_FileName,30,40,120,10,WS_VISIBLE+BS_FLAT+WS_TABSTOP,WS_EX_STATICEDGE
00349: dialogitem 'STATIC','IcePlus[2004]',-1,5,60,70,8,WS_VISIBLE+WS_DISABLED
00350: dialogitem 'BUTTON','&BackUp',ID_BackUp,75,60,40,10,WS_VISIBLE+WS_TABSTOP+BS_AUTOCHECKBOX+BS_FLAT
00351: dialogitem 'BUTTON','&Patch',ID_Patch,125,59,40,12,WS_VISIBLE+WS_TABSTOP,WS_EX_STATICEDGE
00352: dialogitem 'BUTTON','...',ID_File,153,40,11,11,WS_VISIBLE+WS_TABSTOP+BS_PUSHBUTTON,WS_EX_STATICEDGE
00353: dialogitem 'STATIC',601,-1,0,0,250,50,WS_VISIBLE+SS_BITMAP,WS_EX_STATICEDGE
00354: enddialog
00355: section '.reloc' fixups data readable discardable
00356:
00357:
Kayaker
05-20-2004, 12:30 AM
Thank you Iceplus :)
I feel better running patch code if its purpose isn't hidden, plus it makes the post more interesting ;)

The key seems to be the LAR (Load Access Rights) instruction, if it fails so does the rest, hence the extra jump patches.

Description:
----------------------------------

Loads the access rights from the segment descriptor specified by the second operand (source operand) into the first operand (destination operand) and sets the ZF flag in the EFLAGS register. The source operand (which can be a register or a memory location) contains the segment selector for the segment descriptor being accessed. The destination operand is a general-purpose register.

The processor performs access checks as part of the loading process. Once loaded in the destination register, software can perform additional checks on the access rights information.

When the operand size is 32 bits, the access rights for a segment descriptor include the type and DPL fields and the S, P, AVL, D/B, and G flags, all of which are located in the second doubleword (bytes 4 through 7) of the segment descriptor. The doubleword is masked by 00FXFF00H before it is loaded into the destination operand. When the operand size is 16 bits, the access rights include the type and DPL fields. Here, the two lower-order bytes of the doubleword are masked by FF00H before being loaded into the destination operand.

This instruction performs the following checks before it loads the access rights in the destination register:

Checks that the segment selector is not null. Checks that the segment selector points to a descriptor that is within the limits of the GDT or LDT being accessed Checks that the descriptor type is valid for this instruction. All code and data segment descriptors are valid for (can be accessed with) the LAR instruction. The valid system segment and gate descriptor types are given in the following table. If the segment is not a conforming code segment, it checks that the specified segment descriptor is visible at the CPL (that is, if the CPL and the RPL of the segment selector are less than or equal to the DPL of the segment selector).

If the segment descriptor cannot be accessed or is an invalid type for the instruction, the ZF flag is cleared and no access rights are loaded in the destination operand.
----------------------------------

In this case, the Softice code can be traced live and you can follow what's happening. There *are* certain areas of ntice code where a standard BPX will break, and this appears to be one of them. The code can be found with a standard byte search and you can set a BP on the proc start, for example:

:driver ntice
Start - BEF25000 Size - 175880
:s BEF25000 L 175880 8D 7B 0E FC E8

will find the code
lea edi, [ebx+0Eh] ; pointer to "NOTEPAD"
cld

Start Loader32.exe with notepad and it should break.

What I found is that the single argument (arg_0) of the function is a pointer to this data:

01 00 1B 00 00 10 00 01 CA 65 00 00 00 00 4E 4F .........e....NO
54 45 50 41 44 TEPAD

With the valid segment selector 001B (user mode programs in Win2K), this function *should* succeed and loader32 will break at Winmain.

mov ebx, [ebp+arg_0]
...
movzx eax, word ptr [ebx+2] ; 001B
lar ecx, eax ; ecx was 0, now 00CFFB00
jnz exit
and cx, 1800h ; ecx = 00CF1800
cmp cx, 1800h
...

Why this might be failing for Iceplus in XP I couldn't say, if the segment selector is passed correctly then there may be some other issue with access rights going on.

Btw, the call
.text:000310BD call sub_30431
is a call to the function pMapSelectorToLinAddr (The Owl's definition)

Regards,
Kayaker
iceplus
05-20-2004, 02:15 AM
Hi,Kayaker!THanks for your annotation.
When segment selector is 001BH,Break at winmain is succeed.when it is 0023H,cann't break at winmain!why??
Kayaker
05-20-2004, 11:17 AM
Hi

Right you are. 23h is a DATA segment selector (DS) and obviously doesn't meet the security requirements. If I change the .code section characteristics of notepad to C0000040, MAP32 shows the section address beginning at 23:1001000 instead of 1B:1001000, and loader32 doesn't break at Winmain.

What occurs now is

mov ebx, [ebp+arg_0]
...
movzx eax, word ptr [ebx+2] ; 0023
lar ecx, eax ; ecx was 0, now 00CF1000
jnz exit ; no jump
and cx, 1800h ; ecx = 00CF1000
cmp cx, 1800h ; this compare fails!
jnz exit

Also, a packed file such as UPX normally doesn't break at Winmain with loader32, but if you change the section characteristics of the *first* section to E0000020 (executable), the segment selector becomes 001B and loader32 will break. (Interestingly it's the first section UPX0 that needs changing, even though the Entry Point is in the 2nd section UPX1).

So I guess this little security trick of changing the characteristics of the first section fools not only W32Dasm but Loader32 as well. Either change it manually, or in the case of crc checks, your ntice.sys patch would seem to be useful.

Cheers,
Kayaker
pLayAr
05-20-2004, 01:03 PM
any one who use
bpx Kernel32!BaseProcessStart ?
:)
dELTA
05-20-2004, 05:10 PM
I guess that would work too, although it might be a bit tedious since you have to single-step to the real EP after this one breaks, right?
Navin
05-22-2004, 07:41 AM
Guys, I still can't make SoftICE (DS 3.1) break on WinMain. IcePlus's patch doesn't work for me. OS: WinXP Pro SP2. Hope you would suggest another solvation... :confused:
pLayAr
05-22-2004, 07:52 AM
I guess that would work too, although it might be a bit tedious since you have to single-step to the real EP after this one breaks, right?

bpx Kernel32!BaseProcessStart+20
then after ONE single-step, it's the EP
Navin
05-22-2004, 08:40 AM
The problem now is

:BPX Kernel32!MainProcess
:Symbol not defined (Kernel32!MainProcess)
:BPX Kernel32!MainProcess+20
:Symbol not defined (Kernel32!MainProcess+20)
:BPX Kernel32
:Symbol not defined (Kernel32)
:BPX Kernel
:Symbol not defined (Kernel)
:BPX KERNEL
:Symbol not defined (KERNEL)

Meantime BPXs on memory addresses sets well

Do you know what's this?
Kayaker
05-22-2004, 10:56 AM
Navin, please do a board search for "Symbol not defined winice.dat" and read the Using SoftICE and SoftICE Command Reference pdf manuals. Your problem is very common and is caused by not reading/understanding the instructions provided with Softice.
Navin
05-22-2004, 12:38 PM
Yup, i've read all related topics. But the problem is much complex ;)

:exp kernel32! <--- Listing of all functions, but there are no 'MainProcessStart' :( I've tried also different breakpoints such 'MessageBoxA' etc. They appear in listing (BL), but seems like they don't work, SI doesn't breaks on execution of any API...

Suggestions, notes, feedback are welcome ;)
ZaiRoN
05-22-2004, 01:18 PM
seems like they don't work, SI doesn't breaks on execution of any API...It could be related with the BreakInSharedMods env variable. Try to set the variable to ON (if you have not already done).
Since of we are leaving the main discussion of this thread, if your problem has never been happened to someone, please open a new thread.

Good luck,
ZaiRoN
Timbo
05-22-2004, 04:32 PM
Did it work before patch was aplied ? (I don't think so!)
You have SP2, did you downloded ntoskrnl.pdb (right one !)
and translated in to nms and load in in winice.dat ?
If correctly loaded, EXP should be available

Feedback welcome
Navin
05-23-2004, 07:46 AM
Patch doesn't matter, same results. I'm tring now to get ntoskrnl.pdb and other pdb's but not sucessfully till this moment. Symbol loader doesn't want to download pdb's and MS Policy doesn't let me download symbols (have no licens, sorry Bill G., nothong personal)..... Ok, and for the topic - My SI doesn't break on WinMain :)
Navin
05-23-2004, 09:13 AM
If correctly loaded, EXP should be available
BTW, I can load kernel32.dll, user.dll etc without nms-files. 'exp *' shows listing of all functions (about 300) but there no 'MainProcessStart' :(...

I jumped on this thread till now
http://woodmann.com/forum/showthread.php?p=36797#post36797
pLayAr
05-23-2004, 09:44 AM
must get the nms file ,and then will find the kernel32!BaseProcessStart ( not MainProcessStart)

another method below,
use symbol loader to load a file that si can break on Entry Point( or use lordpe's "break & enter"), then "u esp", u will find the point, & this address will NOT change UNTIL your system next update.

the code is like this:
_BaseProcessStart:
push 0c
push 77e71210
call __SEH_prolog
and dword ptr [ebp-4],0
push 4
lea eax,[ebp+8]
push eax
push 09
push fe
call [ __imp__NtSetInformationThread ]
call [ EBP + 8 ] // here call the new process' Entry Point !!
push eax // "u esp" at EP will get there

i hope this helpful
Navin
05-23-2004, 10:06 AM
Hm. Can't get even PDB-files (SymbolLoader shows - Error Download). So, there no 'BaseProcessStart' :( I see BaseProcessInit... etc but not what you said. Ok, i'll try 'break & enter', thanks a lot.
pLayAr
05-23-2004, 11:17 AM
just follow my step, once break on EP ( any .exe file), u esp( this can see when od load a file), and that the point
:)
Navin
05-23-2004, 11:31 AM
Man, you're my saviour! God bless you ;)
bilbo
05-24-2004, 08:33 AM
Good work, IcePlus!

But where did you found NTICE symbols such as BreakLdrProcHandle, LoadProcName, StringCmpareNoAa, AddressInCur, BreakViewType ???

Regards, Bilbo.
Kayaker
05-25-2004, 02:02 AM
Good work, IcePlus!

But where did you found NTICE symbols such as BreakLdrProcHandle, LoadProcName, StringCmpareNoAa, AddressInCur, BreakViewType ???

Regards, Bilbo.

I've noticed Iceplus online a few times but not replying, in case she? has trouble formulating an answer in English, I'd say these are made up descriptive names from good intuitive reversing, not any kind of NTICE symbols.

StringCmpareNoAa is an obvious string check routine from the disassembly.

LoadProcName is a pointer to a byte value that gives the length of the text that follows (something Sice uses elsewhere as well, i.e. 07h then the string "Notepad"). It's actually a little clearer *without* the descriptive name as to which is the pointer to the text length (unk_E2FD2), and which is the pointer to the string itself (unk_E2FD3)

.text:00031072 movzx ecx, unk_E2FD2 ; "LoadProcName"
.text:00031079 inc ecx ; used as a counter in the StringCmpareNoAa call
.text:0003107A mov esi, offset unk_E2FD3

AddressInCur - if you look at my listing of (arg_0) you see the value of this variable at [ebx+4] is 01001000, the load address of notepad.

BreakViewType - The Owl defines this same variable as dBreakReason. See Sten's IceExt source for defines of the various Break Reason values (BREAK_SYMBOL_LOADER equ 0x10004h). More good intuitive reversing here!

BreakLdrProcHandle - not sure about the handle part, but if you trace back far enough you see the function is called when a module is loaded, string ref to
NTICE: Load32 START=%x SIZE=%x KPEB=%x MOD=%s',0

etc...
iceplus
05-25-2004, 02:25 AM
I've noticed Iceplus online a few times but not replying, in case she? has trouble formulating an answer in English.
ye, I am online everyday .but my english is too bad !:whoops:
who is OWL ?
JMI
05-26-2004, 02:04 AM
Using the "Search" button at the top of the Forums and entering "owl", without the quotes, would have gotten you all the posts by him or with his name. He was one of the original authors of the "icedump" program."

You can read more here:

http://www.woodmann.net/krobar/beginner/25.htm

Regards,
bilbo
05-26-2004, 02:41 AM
Thanks Kayaker for your explanations...

You know, I hoped for some "a la M$" source leak... :)
Bilbo
Kayaker
05-26-2004, 10:12 AM
You know, I hoped for some "a la M$" source leak... :)

I Wish!! I salivate over the idea of a debug version of Softice, and would gladly give up someone else's first born child for a copy of ntice.pdb :D
iceplus
05-26-2004, 07:14 PM
Using the "Search" button at the top of the Forums and entering "owl", without the quotes, would have gotten you all the posts by him or with his name. He was one of the original authors of the "icedump" program."

You can read more here:

http://www.woodmann.net/krobar/beginner/25.htm

Regards,

Thank you !


how to determine importtype?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > how to determine importtype?
PDA

View Full Version : how to determine importtype?

0rp
05-19-2004, 06:00 AM
how can i determine the type of an imported symbol (function or var) ?

VirtualQuery returns always PAGE_EXECUTE_WRITECOPY
dELTA
05-19-2004, 06:53 AM
You might want to be a little more specific than that, just a tip...
0rp
05-19-2004, 07:04 AM
i get the addresses of all imported symbols of a module (through IMAGE_IMPORT_DESCRIPTOR and IMAGE_THUNK_DATA...) for hooking purposes (of course :)

i now modify these addresses, and let them point to custom code, but this will crash if the symboladdr points to a variable instead a function (i.e. msvcrt._acmdln)

or i'm completly wrong and these addresses will never point to variables?
doug
05-19-2004, 05:31 PM
Given an import table, i don't think there is any way to tell whether a particular entry is an imported variable or an imported function.

How you import it and how you use it define that behavior.

With that said, what you want to do can probably be done in another way.. tell us what you want to do, we'll be able to help more.


File time
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > File time
PDA

View Full Version : File time

crUsAdEr
05-19-2004, 02:43 PM
Hmm... this is really weird...

Can someone explain this? I look at properties of a file and get
Created : 12 May 2004, 13:17:22
Modified : 27 April 2004, 13:11:22
Accessed: 19 May 2004 20:08:23

How is this possible that a file is modified before it is created? Which date should i trust for last modified date?

Thanks,
crUs
evaluator
05-19-2004, 02:57 PM
this happens mostly when file extracted (from archive or installer)
(time from archive seems copied to "modified" attr)
disavowed
05-19-2004, 03:10 PM
if it really bothers you, you can use a tool like this to change the days/times: http://www.eluent.com/eltouch.htm
crUsAdEr
05-19-2004, 03:31 PM
hi disavowed... it doesnt really bother me... i just need to find out the exact time that a file was last modified...
nikolatesla20
05-19-2004, 06:48 PM
The modified date is gospel, it usually is the actual correct date of when the file was "created", unless the installer was told to set the date to the date of install, in which case, you lose all date info.

-nt20
Fake51
05-20-2004, 03:14 AM
Is there a difference between file security on Nt/Xp/2k and 9x/me? Or can you still just set the file-times as you wish? Wouldn't be surprised, anyway.

Fake
dELTA
05-20-2004, 05:38 AM
NTFS has more date info for files than FAT(32), yes, and you can set this data as long as you have the correct permission for the files. This may be necessary for smooth operation of e.g. archiver tools and similar (as mentioned above), and since there is a separate permission system I don't see it as a flaw, but rather as a useful feature.
Fake51
05-20-2004, 05:44 AM
NTFS has more date info for files than FAT(32), yes, and you can set this data as long as you have the correct permission for the files. This may be necessary for smooth operation of e.g. archiver tools and similar (as mentioned above), and since there is a separate permission system I don't see it as a flaw, but rather as a useful feature.

The question isn't really whether it's a flaw or design feature - it's whether it can be exploited. Thought NTFS had more security, though.

Fake
dELTA
05-20-2004, 07:00 AM
I meant "security flaw" as in "bad security design", which is quite inherent in your statement "Thought NTFS had more security". But again, you need to have write access to the file (which can be nicely controlled in NTFS, because it has just that, "more security") to be able to change its date, so I really don't see the security problem. If you have access to change the contents of the file, why shouldn't you be able to change the date of it? Not to mention that even if there weren't any direct APIs to do it, you could just change the system time and recreate/touch/read the file to set any date information you wanted anyway.
Fake51
05-20-2004, 07:10 AM
I meant "security flaw" as in "bad security design", which is quite inherent in your statement "Thought NTFS had more security". But again, you need to have write access to the file (which can be nicely controlled in NTFS, because it has just that, "more security") to be able to change its date, so I really don't see the security problem. If you have access to change the contents of the file, why shouldn't you be able to change the date of it? Not to mention that even if there weren't any direct APIs to do it, you could just change the system time and recreate/touch/read the file to set any date information you wanted anyway.

Actually, I meant: "thought NTFS had more security than 9x/me". In a, "thought so"-kinda way.

Generally, I just don't see much use for setting file date/time.

Fake
dELTA
05-20-2004, 09:24 AM
One primary use of making it possible to set the filedates manually is when you want to preserve the timestamps on files through some operations, e.g. the earlier mentioned compress/extract scenario, but also other scenarios like e.g. editing or writing metadata to media files (e.g. pictures taken with a digital camera). There are lots and lots of scenarios like this.
Fake51
05-21-2004, 02:25 PM
One primary use of making it possible to set the filedates manually is when you want to preserve the timestamps on files through some operations, e.g. the earlier mentioned compress/extract scenario, but also other scenarios like e.g. editing or writing metadata to media files (e.g. pictures taken with a digital camera). There are lots and lots of scenarios like this.

Unfortunately, it's also quite easy to hide changes to files that way.
I see pro's and con's to the stuff - don't really care much bout it though. If people want to wreak havoc or abuse the OS, there are worse things they can do.

Fake
dELTA
05-21-2004, 04:38 PM
Yes, many things can be used in one way or another to aid bad deeds, but it is practically never a good solution to remove these things for this sake though (bye bye internet?). Instead, it is often best to provide a security base that can be utilized to secure these items anyway. In this case this security base is the NTFS permission system. If we are talking about a user without admin permissions, the admin can set the permissions so that the user cannot modify the files (and thus not their dates either), and if we are talking about an admin level user, any malicious program he runs could bypass the file system layer and manipulate the file data directly on the disk anyway, even if there were no APIs to write to files without changing the dates, and no APIs to directly manipulate the dates either. So, then we would have removed this feature and all its "good" uses for nothing, making life more inconvenient for normal users, but still having just the same vulnerability as before. Finally, to cover any possible counter-example situation, if a non-admin user wants to be able to modify the contents of the files, but still wants to be able to see if the files have been modified by someone else, he should consider to accomplish this cryptographically (which will result in the bad guys not being able to edit the files undetected by any method, not even with admin rights and direct access), instead of trusting the security-by-obscurity-based method of not directly exposing certain functionality to normal users.

And yeah, sure, this example with filedates might be less significant than others, but it's this general philosophy and approach to security that I'm objecting against. It's quite a widespread and normal reaction though, but it practically never holds up in reality if you just think some more about it.

:)
Fake51
05-21-2004, 05:11 PM
Yes, many things can be used in one way or another to aid bad deeds, but it is practically never a good solution to remove these things for this sake though (bye bye internet?).
One doesn't need to remove it - just make it harder to abuse or screw up, by default.

Instead, it is often best to provide a security base that can be utilized to secure these items anyway. In this case this security base is the NTFS permission system. If we are talking about a user without admin permissions, the admin can set the permissions so that the user cannot modify the files (and thus not their dates either)
And what about the files that the user needs to be able to modify? Perhaps if there were settings, so that only the system sets the time, but not allowing user time/date changes.

Ofcourse things can be circumvented, but rather that it be hard than easy.

... and if we are talking about an admin level user, any malicious program he runs could bypass the file system layer and manipulate the file data directly on the disk anyway, even if there were no APIs to write to files without changing the dates, and no APIs to directly manipulate the dates either.

Running admin priviledges is also a risk - it's the normal user that's the main concern to me.

So, then we would have removed this feature and all its "good" uses for nothing, making life more inconvenient for normal users, but still having just the same vulnerability as before.

Strange that you arrive at this conclusion.

Finally, to cover any possible counter-example situation, if a non-admin user wants to be able to modify the contents of the files, but still wants to be able to see if the files have been modified by someone else, he should consider to accomplish this cryptographically (which will result in the bad guys not being able to edit the files undetected by any method, not even with admin rights and direct access), instead of trusting the security-by-obscurity-based method of not directly exposing certain functionality to normal users.

"He should consider" ... which is of course true. The main problem arises when the normal user trusts the system that is not secure. The whole point of talking about the normal user is exactly that the normal user isn't always in a position to have the necessary level of information - how is the normal user to know how the date/time can be changed? Far as I remember, that's what started this whole thread.
I agree that there are good uses for functions like these. There are also very good uses for Outlook Express, however the program should be deleted at first sight - most of the problems with it, is that normal users don't have the information level necessary to determine what is a risk and what is not. And even though this may be a fault on the part of the normal user, the risk and damage is too high to disregard. There will always be stupid users, and blaming them won't help - making software secure will. This doesn't mean removing all functions, it just means making it as secure as possible.

And yeah, sure, this example with filedates might be less significant than others, but it's this general philosophy and approach to security that I'm objecting against. It's quite a widespread and normal reaction though, but it practically never holds up in reality if you just think some more about it.

:)

Well, in general I agree with your attitude towards security - better to advance the level of knowledge than to try and remove the threat (since, by hypothesis, new threats will always arrive). However, there's two sides to the coin: the other hypothesis is that new fools are born every minute. As such, the only rational thing to do seems to me to be to raise the general level af computer-literacy, while striving to make software as secure as possible. In no way does this entail removing functions from software.

And, as I have stated already in this thread, I do believe that the security of file time/date is an improvement over 9x/me - security is in pretty much every way improved from 9x/me, which is very nice. This just doesn't mean that it can't get better - as long as normal users continue to get fooled (in one way or another, in regard to security in general) there is obviously room for improvement. Be it in the area of knowledge or software-security.

Scuze the ramble, btw.

Fake
doug
05-21-2004, 05:30 PM
care to what kind of exploits you could make out of changing File date/time?

You can only do it on files for which you have write access. Is there anything that relies on file date/time that would break if you changed them?
Fake51
05-21-2004, 05:41 PM
care to what kind of exploits you could make out of changing File date/time?

You can only do it on files for which you have write access. Is there anything that relies on file date/time that would break if you changed them?

If a program can change the file time/date info on my files as long as I'm logged in, then the program can change those files without my knowing it. This is as it should be, since there are many good uses for this, as Delta pointed out.
However, the normal user has no reason to suspect that his files have changed if the file date/time info is the same - since, normally the time/date stamps do indeed change when you access the files (in cases of writing).
It's not really a question of whether anything would break or not - it's a question of the general users relying on something that may not be as secure as they think.

This may not be biggest security problem in Windows, by far. The question I'm asking is merely whether this design can be exploited, and whether it can be made more secure.

Fake
dELTA
05-22-2004, 06:07 AM
I think your view is somewhat contradictory.

One doesn't need to remove it - just make it harder to abuse or screw up, by default.
Ofcourse things can be circumvented, but rather that it be hard than easy.
it's a question of the general users relying on something that may not be as secure as they think.
When you make it "harder to abuse", the bad guys will still be able to do it, just like you say, but the only thing you might accomplish then is to make the users think it's even more secure (and remove functionality that may be beneficial to them at the same time), which is indeed a bad thing, just like you also say. This is also the exact same conclusion that you thought it was "strange that I arrived at".

There will always be stupid users, and blaming them won't help - making software secure will.
Which is exactly what I meant about making the data tamperproof with cryptographical means on the application level (and no, the users don't need to write these programs themselves, it will be up to the applications that need their data to be tamperproof to do this), instead of restricting an operating system which cannot be ultimately trusted anyway (and no, I don't mean "Windows is not secure", I'm referring to the fact that the data cannot be trusted to not have been tampered with even if the operating system isn't exposing any APIs to do it, just like I explained before).

This doesn't mean removing all functions, it just means making it as secure as possible.
Exactly what do you propose to make the date/time functionality more secure without removing any functionality then, in addition to the NTFS permission system?

Running admin priviledges is also a risk - it's the normal user that's the main concern to me.
One of the biggest problems with "normal users" is that they are indeed logged in with admin privileges all the time...
Fake51
05-22-2004, 06:48 AM
I think your view is somewhat contradictory.

When you make it "harder to abuse", the bad guys will still be able to do it, just like you say, but the only thing you might accomplish then is to make the users think it's even more secure (and remove functionality that may be beneficial to them at the same time), which is indeed a bad thing, just like you also say.

If you limit the number of ways in which one can abuse the system, or screw it up, this makes it alot easier to determine whether foul play is at hand. If virii only had one way of propagating, it would severe limit the number of virii in the open. As it is, there are a lot of ways that virii can spread, and as a result a lot of computers are down every now and again.
Making the system harder to break indeed makes it more secure. If less people know how to break the security, that to me is a plus. There will always be bad guys out there, but that doesn't mean one shouldn't care about security, as your reasoning will lead to.

This is also the exact same conclusion that you thought it was "strange that I arrived at".

No. You, for some strange reason, argue that functions should be removed. This is a step of your reasoning I see no premises to accept. In fact, you were arguing that user options be restricted, so that the problem wouldn't be there - unless ofcourse you think that the only way to avoid the problem for users, is to remove the to permission to change files.

Which is exactly what I meant about making the data tamperproof with cryptographical means, instead of restricting an operating system which cannot be ultimately trusted anyway (and no, I don't mean "Windows is not secure", I'm referring to the fact that the data cannot be trusted to not have been tampered with even if the operating system isn't exposing any APIs to do it, just like I explained before).

You're missing the point: if the general user doesn't know of the security holes, he's not going to use cryptographical means to secure his data. That's the whole point: if all users did, there wouldn't be a problem. However, a lot of users simply don't know that maybe there's a good reason to - and they will never know. Instead of waiting for the inevitable to happen, there may be a point in trying to increase the security of the OS. If the user can use cryptography on his own, it can be implemented in the system as well.

Exactly what do you propose to make the date/time functionality more secure without removing any functionality then, in addition to the NTFS permission system?

I'm not perfectly familiar with NTFS, but it seems possible to me, that one could implement a system log of file changes (can't remember if there's already something of the sort implemented). In addition to the date/time variables changeable by the user, an additional variable could be used, to keep track of last modification. The variable would be dependent on a system clock not modifiable by normal users.
As we already agreed, there's no point in implementing much extra security for admins - but these had better know what they're doing anyway. The real concern lies with normal users.

One of the biggest problems with "normal users" is that they are indeed logged in with admin privileges all the time...
Some are, some aren't. If the security can be raised for at least some, that's still a step in the right direction, wouldn't you say? Or maybe everybody deserves what they get?

Fake
dELTA
05-22-2004, 07:39 AM
No. You, for some strange reason, argue that functions should be removed.
Hmm, that's odd, I thought I was the one arguing for providing a security base (the permission system) that could be used for secure usage, and you were the one that argued for removing features from the operating system that could be used for lots of other non-malignant things too...

Anyway, feels like we're going in circles here, I don't have the time to repeat myself again, and since I think I've made my point pretty clear (to most people anyway) I'll stop here for now.
Fake51
05-22-2004, 08:14 AM
Hmm, that's odd, I thought I was the one arguing for providing a security base (the permission system) that could be used for secure usage, and you were the one that argued for removing features from the operating system that could be used for lots of other non-malignant things too...

Please provide a quote where I state that the date/time functions should be removed.

Actually, I'll have a try:

Generally, I just don't see much use for setting file date/time.

Well, if you'll equate "just don't see much use for" with "think the following functions should be removed:" I see your point. But maybe that's just a bit overinterpretive?
As a matter of fact, you're the only one who has suggested that upping security means removal of functions. I could be wrong tho - please point to where you think I suggested that any functions that could be abused should be removed.

Anyway, feels like we're going in circles here, I don't have the time to repeat myself again, and since I think I've made my point pretty clear (to most people anyway) I'll stop here for now.
Sure.

Fake


VxD and PageNotPresent
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VxD and PageNotPresent
PDA

View Full Version : VxD and PageNotPresent

ajron
05-19-2004, 06:29 PM
I'm writting VxD which dumps a memory. Maybe it's no problem to do it but I have one ;(.

Initially i call mem_dump() function while processing DEBUG_QUERY, but I read somewhere that it's not a good idea to process code which may cause page fault from DEBUG_QUERY. Next I call mem_dump() from W32_DEVICEIOCONTROL [DIOC_OPEN] (maybe it's not a good idea too - I don't know) but it's not solve my problem.

When I read some not present memory (not all) the system crashes. AFAIK the system process page fault to load not present page in this situation. And it's true but not at all in my case. When I test dumping memory, the system crashes in concrete pages in context. Different in different processes, but always at not present one. When I pass over this few non present pages (with other non present it's no problem) everything goes ok. Maybe someone know what is wrong.

Below is mem_dump() code. R0File is wrapper class for R0_XXXFile services.

void mem_dump()
{
char txt[256];
char fileNm[]="c:\\file.tmp";

Trace_Out("Prepare to die ;-)");

R0File file;

file.SetInContext();

if(file.Create(fileNm,OPEN_ACCESS_READWRITE|OPEN_SHARE_DENYREADWRITE|OPEN_FLAGS_COMMIT))
{
Trace_Out(" Memory dumping ...");

DWORD page = PAGE(0x00400000);

while((page << PAGESHIFT) < 0x80000000)
{
if(IsPageCommitted(page))
{
_Sprintf(txt,"--> Dumping committed page %x\n",page);
Out_Debug_String(txt);

file.Write((PBYTE)(page << PAGESHIFT),PAGESIZE);
}

page++;
}

file.Close();

Trace_Out(" Memory dumped!");
}
else
{
Trace_Out(" Create file failed");
}
}
dELTA
05-20-2004, 05:22 AM
You might find the info in the following thread interesting:

http://www.woodmann.net/forum/showthread.php?t=5736
ajron
05-20-2004, 09:20 AM
You might find the info in the following thread interesting:
http://www.woodmann.net/forum/showthread.php?t=5736

Thanks. I didn't suppose that IceExt problem has a connection with my problem with VxD, but it has (for ex. dumping at DEBUG_QUERY msg) ;). Anyway, calling LinPageLock() for all non present pages (during W32_DEVICEIOCONTROL) solves this situation by now. Strange is that not all non present pages caused problem.


exe file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > exe file
PDA

View Full Version : exe file

NonPanic
05-19-2004, 07:53 PM
Hello guys :o

I'm new here, and I'm a newbie. And my english might not be the best, sorry for that.

To my problem then !

I'm trying to reverse an exe file that includes a public key.

The authors of this file says it is strongly encrypted. I've tried a lot of tools to find out what encryption is used to this file, but I've failed.
I have tried latest versions of PEiD, Language2000, PE Explorer, Ollydebugger and so on to find something about this file, but no success.

The only thing I found out is that the file is programmed with Borland C++ Win32 1999.

In my opinion, this file is not encrypted, just the data in it, or maybe just the public key.

There are 8 sections in the file, it looks like this -

.text
.data
.tls
.rdata
.idata
.edata
.rsrc
.reloc

PEiD says that the .data section is packed.

Is it possible that only the .data section is packed or encrypted ?

If so, can I find out what packer/encryptor that is used for that ?

Don't hang me if this is a stupid question, just leave it then.
Else, thanks for your eventually answere :o

Regards NonPanic
Aimless
05-19-2004, 11:46 PM
Hello NonPanic. Welcome to the RCE board.

I might suggest an alternate course of action for you. Since you have mentioned that you are a newbie, I might suggest you leave unpacking and decrypting based protections away for a while.

I might also suggest you find an older version of Winzip (say, version 5/6/7) and try cracking the key based protection. Then you need to try cracking a time based protection and finally license-file based protections.

Once you have a solid 6-7 months of cracking such varied protections, you may try the Mini-Project Area to practice cracking of protected files. Once you have got a hang of the kind of packer/crypter used, and can manually unpack and decrypt, it will not make much of a difference whether you can really identify the packer/crypter, except purely for speeding up the cracking process.

My advice is, go slow and go steady.

Have Phun
NonPanic
05-20-2004, 11:09 AM
Hello Aimless !

And thanks for your answere.

Well, I have cracked an older version of Winzip, some key based protection and time litmit progs, and read alot of tutorials.

But as you suggested, I think I need to do it more and take it slow.

And I will try the Mini-Project Area for practice.

Thanks for your advice :)

Rgds NonPanic


Softice, VMWare and INT3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice, VMWare and INT3
PDA

View Full Version : Softice, VMWare and INT3

asr
05-20-2004, 03:26 AM
Hi,

i noticed several posts about vmware and softice. I made all necessary adjustments and they work more or less good. The problem I am still having however is that manually places int3 calls crash vmware.
For example if I place a 0xcc at the entry point of an application the vm goes down immediately (not the os running inside). breakpoints i set with softice work fine.
Does anyone else here know this problem or any workaround?

-asr
Harding
05-20-2004, 04:16 AM
Put EB FE in the EP instead so the program is put into an infinite loop, then use softice to replace the first bytes again and keep tracing.
JMI
05-20-2004, 04:18 AM
It would help if you had mentioned the versions of the software you are using and the OS. It's also not clear what you mean by "if I place a 0xcc at the entry point of an application the vm goes down immediately."

Are you saying that as soon as you change the byte to CCh, without doing anything else, VMWare crashes, or are you saying "after" you change the first byte to CCh and start the program, VMWare crashes??????

Have you turned "ON" "I3HERE" in softice? Did you use 'bpint 3' in softice ?

In short, think more carefully about what your setup is and about what you actually did and remember that WE WEREN'T WATCHING YOU DO IT and don't know your machine. Say what YOU DID like you wanted someone who WASN'T there to know EXACTLY how you set thing up and enough of the complete steps you followed to actually understand WHERE it started to go wrong.

Regards,
asr
05-20-2004, 06:06 AM
It would help if you had mentioned the versions of the software you are using and the OS. It's also not clear what you mean by "if I place a 0xcc at the entry point of an application the vm goes down immediately."

Are you saying that as soon as you change the byte to CCh, without doing anything else, VMWare crashes, or are you saying "after" you change the first byte to CCh and start the program, VMWare crashes??????

Have you turned "ON" "I3HERE" in softice? Did you use 'bpint 3' in softice ?

In short, think more carefully about what your setup is and about what you actually did and remember that WE WEREN'T WATCHING YOU DO IT and don't know your machine. Say what YOU DID like you wanted someone who WASN'T there to know EXACTLY how you set thing up and enough of the complete steps you followed to actually understand WHERE it started to go wrong.

Regards,

Thx for your reply. I'm using Driver Studio v3.1, VMWare v4.5.1 Workstation. The OS running inside VMWare is Windows 2000 Pro. Placing an endless loop wont help me since i want to break on application entry.
I changed the byte at an entry point of an application to 0xcc. Set "bpint 3" inside softice and ran the application. VMWare then came with a popup saying "Virtual Machine Kernel Stack fault..."

I hope this will reflect what i wanted to do.

-asr
Harding
05-21-2004, 01:25 PM
...Placing an endless loop wont help me since i want to break on application entry.-asr

It will work if you place the infinte loop at the Entry Point.
Rummy
05-26-2004, 07:53 PM
I'm using Driver Studio v3.1, VMWare v4.5.1 Workstation. The OS running inside VMWare is Windows 2000 Pro. Placing an endless loop wont help me since i want to break on application entry.
I changed the byte at an entry point of an application to 0xcc. Set "bpint 3" inside softice and ran the application. VMWare then came with a popup saying "Virtual Machine Kernel Stack fault..."
I run the exact same versions and have not seen this problem. What's your base OS? Mine is also Windows 2000 Pro. Try I3HERE ON instead of bpint 3 and see what happens.


simple crackme without validation button
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > simple crackme without validation button
PDA

View Full Version : simple crackme without validation button

atlas
05-20-2004, 07:39 AM
lol

Am I constrained to use Windasm on this crackme or am I be able to use Sice to do the same job ?
If I can find it with Sice , How ?
In wich case have I not tu use Sice ?

Here is the response of this simple crackme 3625043
prdx_LT
05-26-2004, 05:14 AM
tutorial for total newbies ;)
atlas
05-26-2004, 02:54 PM
Yes but you don't really answer to my question .
Finally I have found another way with Sice more complicated way ...
I search any tricks to break inside Sice even if I haven't a validation button .
I have found this way
1/bmsg handle wmkey_down
2/s 0 l ffffffff 'false code'
3/bpr with the results of step 2/
At once I land near the solution but I am lucky to find like this .My opinio wm_keydow is not reliable
prdx_LT
05-26-2004, 05:36 PM
i'm not good using Sice so I even don't know how to find correct way... :( I know that's bad but... so I found correct way using tools that I know :/
OorjaHalT
05-27-2004, 03:32 AM
i'm not good using Sice so I even don't know how to find correct way... :( I know that's bad but... so I found correct way using tools that I know :/
Simply try bpx hmemcpy and as soon as you enter something it would break
just keep on using F12 till you are in crackme code area
ZaiRoN
05-27-2004, 04:01 AM
I think it's always good to have a little knowledge of all the available tools. The crackme is written in Delphi and, this time Softice is not the best tool to use... why not Dede? Dede is almost perfect towards Delphi program. Don't know if you have this tool before but it's pretty intuitive and for the moment, I will not tell you how to solve the crackme with Dede (Where would be the fun... :-)). Try to solve the crackme with this tool and tell us everything you don't understand.

Good luck,
Zai
prdx_LT
05-27-2004, 06:36 AM
Simply try bpx hmemcpy and as soon as you enter something it would break
just keep on using F12 till you are in crackme code area

Yes I know hmemcpy but, I don't have any knowledge about Sice, but with tools like W32Dasm, Hiew, peid, etc, I have... I know that I must lear Sice, because it's da best debugger ever... But for this moment I'm using these tools that I know well... :/
OorjaHalT
05-27-2004, 12:40 PM
With utmost regard to zairon i disagreethat sice is not the best tool for this crackme which happens to be in delphi. I did crack in sub 1 min. flat using sice and even after using dede you still need another tool to know the password
ZaiRoN
05-27-2004, 01:06 PM
Hi OorjaHalT,
nice to see you here.

I suppose you are using 9x where hmemcpy works fine but what about if you use xp/nt/2k os? Imho, for those who don't have much experience it's not so simple, this is the reason why I told that 'softice is not the best tool for this crackme' :)
even after using dede you still need another tool to know the passwordWhat do you mean? I can clearly see the password with Dede...

later,
ZaiRoN
hobgoblin
05-27-2004, 01:51 PM
I used Olly to solve this one. Olly is a good tool to understand what's going on is this proggie, and if you're only looking for the correct serial it will take you less than a minute to find it. In my opinion Olly is the easiest one to use on this one.

regards,
hobgoblin
atlas
05-27-2004, 02:03 PM
OorjaHalT , would tou be able to explain your Sice méthod ? Just put wich kind of bpx you have used ...

In the purpose to giv eme any ideas ...
ZaiRoN
05-29-2004, 09:03 AM
Hi,
since of there are many ways to solve the crackme, it might be a good idea to have some little solutions based on the tool used. Here is a little explanation using Dede.

Load and process the crackme. After some seconds, Dede ends the initial procedure and shows all the informations retrieved about the crackme.
The 'Forms' panel contains all the relative infos about the form(s) inside the crackme, in this case we have only one form named TForm1. If you click above this voice, you will see all the controls inside the only dialog in the crackme; the one we are looking for is:object pass: TEdit ; edit control
Left = 104 ; left position inside the dialog
Top = 16 ; top position inside the dialog
Width = 137 ; width
Height = 21 ; height
Color = clYellow ; background color
TabOrder = 0 ; tab order...
Text = 'Entrer un password valide' ; initial text
OnChange = passChange ; procedure called when the password is changed
end

The check procedure is all inside 'passChange' routine. To see the procedure you have only to click on the 'Procedures' panel and then, double click over the voice 'passChange'. The last thing to do is to read the right password:* Reference to: Controls.TControl.GetText(TControl):TCaption;
00464E1B E820C3FCFF call 00431140 ; get the serial
00464E20 8B45FC mov eax, [ebp-$04] ; eax -> serial
* Possible String Reference to: '3625043'
00464E23 BA7C4E4600 mov edx, $00464E7C ; edx = 3625043
* Reference to: System.@LStrCmp;
00464E28 E817F8F9FF call 00404644 ; compare between our serial and '3625043'
00464E2D 7512 jnz 00464E41
* Possible String Reference to: 'Mot de passe correcte'
00464E2F BA8C4E4600 mov edx, $00464E8C ; edx -> "password is right"
* Reference to control TForm1.verif : TEdit
00464E34 8B83F4020000 mov eax, [ebx+$02F4]
* Reference to: Controls.TControl.SetText(TControl;TCaption); ; set the right message
00464E3A E831C3FCFF call 00431170
00464E3F EB10 jmp 00464E51
* Possible String Reference to: 'Password Erroné'
00464E41 BAAC4E4600 mov edx, $00464EAC ; edx -> "password is not right"
* Reference to control TForm1.verif : TEdit
00464E46 8B83F4020000 mov eax, [ebx+$02F4] ; set the wrong message
* Reference to: Controls.TControl.SetText(TControl;TCaption);

regards,
ZaiRoN
atlas
05-30-2004, 10:36 AM
================ Sun May 30 10:52:43 2004
:HWND CRACKMEV
Window Handle hQueue SZ QOwner Class Name Window Procedure
0800(1) 10D7 32 CRACKMEV2 TForm1 1427:00000CC4
0808(2) 10D7 32 CRACKMEV2 Edit 1427:00000DE2
0804(2) 10D7 32 CRACKMEV2 Edit 1427:00000DB6
07FC(1) 10D7 32 CRACKMEV2 TApplication 1427:00000D32
:BMSG 804 WM_KEYDOWN
Break due to BMSG 0804 WM_KEYDOWN (ET=.61 microseconds) +F12 (never think that wm_keydown
could be efficient)
hWnd=0804 wParam=0065 lParam=004C0001 msg=0100 WM_KEYDOWN
:BD*
:S 0 L FFFFFFFF '11223344'
Pattern found at 0187:00BD33C0 (00BD33C0)
:BPR bd33c0 bd33c0+8 rw
;; uses F5 we land near of the comparison with F12 too but F5 is better for this crackme

Break due to BPR #0187:00BD33C0 #0187:00BD33C8 RW
Break due to BPR #0187:00BD33C0 #0187:00BD33C8 RW
Break due to BPR #0187:00BD33C0 #0187:00BD33C8 RW
Break due to BPR #0187:00BD33C0 #0187:00BD33C8 RW ;;so F5x4

017F:0040466F 8B1F MOV EBX,[EDI]
017F:00404671 39D9 CMP ECX,EBX ;;here is the comparison
to see it do this ? ECX ; ? EBX the comparison runs four characters at once and fours characters
;;in a second time
017F:00404673 7558 JNZ 004046CD (JUMP )
017F:004046CD 5A POP EDX


Softice & IDA symbols
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice & IDA symbols
PDA

View Full Version : Softice & IDA symbols

omega_red
05-20-2004, 06:22 PM
self-censored ;]
JMI
05-20-2004, 06:28 PM
omega_red:

Which part of these CLEAR instructions for this Forum did you NOT understand?

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

And, YES thay DO apply to YOU also.

Regards,
doug
05-20-2004, 07:09 PM
I use ida2sice by mostek when I want to get symbols from an IDA .idb into sice. It produces an .nms file.
Works well.
omega_red
05-20-2004, 07:19 PM
:whoops:
Sorry for that.


a crackme without comparing string
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > a crackme without comparing string
PDA

View Full Version : a crackme without comparing string

riijj0
05-20-2004, 08:01 PM
This is a simple crackme, trying to validate the serial number without string
comparsion. Hope that you find it interesting. :)
riijj0
05-27-2004, 08:39 PM
did anybody try it ?

I am looking for your comment for improvement :rolleyes:
klier
06-21-2004, 12:13 PM
Reg name:klierklier
Reg key:E90F2938
improvement:fill zeros in dll with random numbers.
Regards,
riijj0
06-25-2004, 03:39 AM
Thank you so much :-) You are excellent !

In fact, if one serial number was found, the others can easily found the other serial numbers. This crackme is hard for the first breaker only.

I am testing the improvement you told me :-)


Armadillo 2.51 - 3.xx DLL unpacking - OEP?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 2.51 - 3.xx DLL unpacking - OEP?
PDA

View Full Version : Armadillo 2.51 - 3.xx DLL unpacking - OEP?

MEPHiST0
05-20-2004, 10:50 PM
hi all..

attempting to unpack a arma protected dll..

the DLL is opened by Internet explorer.. blah blah, not a prob..
attach explorer.exe and i get teh priviledged instrcution from arma.. and attemp to unpack from there..

anywho im having trouble find the entry point...
i usually bpx on SetProcessWorkingSetSize or GetCurrentthreadId to get to OEP..

but this is not working? (or well it might take me to OEP.. but im sure its not hte right way.. maybe)

any tips on getting to oep?
MEPHiST0
05-21-2004, 06:07 PM
o fine, i see how u all are :P

:)
Woodmann
05-21-2004, 07:17 PM
Howdy,

You have been around here enough to know the process.

I am sure you are not the first person to have this problem.

Now, since I am a mind reader I can tell you that the OEP can be found at this address:0041000.

If I am wrong, the psychic network has nothing to worry about :eek:

-cbo-
CluelessNoob
05-21-2004, 08:58 PM
If I am wrong, the psychic network has nothing to worry about :eek:

If the psychic network were right half as often as you we would all worry.

:D
MEPHiST0
05-22-2004, 02:01 AM
woodmann..
o yea your a mind reader ;)

i was looking for tips on unpacking armadillo .dll's.. not psychic advice :D :idea: :loveu:
just never unpacked an arma dll before.. so hard to belive..?

ive managed arma+debug blocker.. not copymem nor nanomites..

and no that is not oep.. not close.. :D :whoops:

i tried that .dll unwrapper for arma that Lunar made.. (nice tool btw..)
but didnt unwrapp this .dll, nothing, no info at all.. unlike some .dll's that at least gave oep..like i said its opend by explorer.exe for a context menu..
not sure if that makes a differnce..

tried the api i knew about that arma uses.. but no luck.. maybe i should have tried it when i wasnt drinking? :confused:

anyway ive read the thread below mine.. simular topic.. but i didnt read anything about getting oep.. so i created my own thread, just wondering how to get OEP out arma packed dlls :D
SHaG
05-22-2004, 02:58 AM
I've actually done some arma dll unpacking. I attach my test files for it:
- dllforarmadillo_nodillo.dll - a simple dll that shows message boxes from dllmain
- dllforarmadillo.dll - the same dll packed with armadillo
- etster.exe - does loadlibrary =)

Now look at the original dll, se where the EP is - thats your OEP. Now try to find this same address in the packed one. =)
A tip for when you get to resolving imports, there is a place where dildo destroys them, but it can be bypassed.

Don't want to disclose more info on this, I'm sure Chad reads this board. Fi he does I'd like to tell him I think he's a moron with an inflated ego. :P
Hopcode
05-22-2004, 05:26 AM
Im not sure he is the only one with inflated ego if you ask me :)

Anyway, the new import protection cannot be bypassed that easy, you are working on demo import protection.

I recommend to read Ricardo's tutorial for this one. Nice work!

Cheers

Hopcode
SHaG
05-22-2004, 05:40 AM
There are many, many others with egos the size of hot air baloons... =)

Well, yeah, this is made by a demo version, but I've actually worked with a dll from a retail soft that used exactly the same mechanism. Maybe that app was protected by a demo/pirated version of Arma? :confused:

Concerning Ricardos tuts: they sure are great! Only problem is extracting all that knowledge using Babelfish. =)
Hopcode
05-22-2004, 09:24 AM
they did not use the good protection level, that's all :)

its like when authors don't use pieces of code encryption in Asprotect etc.
without a key, unpacking is useless..

Oh well...
crUsAdEr
05-22-2004, 10:16 AM
Which is why i still find Asprotect a better protection compare to Armadillo... with the later using code encryption or not doesnt matter, unpacking always works :/...
MEPHiST0
05-22-2004, 10:47 AM
most unpacked aspr exe's ive done..
either get an access violation in: 6138xx (xx is dif in every exe..)
somtimes no access violation..
but just search in hex for 61 38.. get ur name in there somewhere ;)
can bpx hw access > dword to check out where its coming from..
its usually regged..

SHaG:

thanks man for the help ;)
doesnt help me out much tho.. i can HW bp on that OEP and get to it..
but the reason for this post is, because im all out of idea's to get OEP :D

but im gonna download that and try it out right now, do it acouple times.. maybe ill notice somthing that can help me out.. thx again
MEPHiST0
05-23-2004, 01:09 PM
hell0

i got to the OEP of SHAG's nice little semi-tutorial thing he did..
(thanks SHAG!!)

but i have a question...
first of all i know about nanomites and what they do.. well sorta.. same with copymem..

and this seems to happen with ALOT OF arma packed EXE's / now Dll's since i can unpack em now..

now..
the CALL into Entry points:
<-- i trace into this: and 'SOMETIMES' CODE is All f00ked up.. not executable
<-- happens alot when protection is arma+debug blocker
found a DLL that has done it too me too..

now a buddy of mine says 'the appz i have trouble with'..
they unpack perfectly normal for him, trace into the CALL EDI and code is fine.. dump.. fix iat and it runs..

does anyone know what could be doing this? its almost like arma isnt decrypting the entry point.. but im not advanced enough to find out what the reason is.. has anyone ever have this kind of prob? :D

--------------------------------------------------------------------

SHAG's .dll however worked out fine..
I didnt realize it, but i have got to the EP.. not knowing it was OEP (/me is drunk)
the Entry point was in perfect condition unlike some other Dll's i have tried..
pissin me off.. thinkin it was some anti viruss .dll's i had loaded that could be messin with the EP... but im stupid :P

let me know if anyones experianced this problem.. because id like to unpack every arma there is :D
nikolatesla20
05-23-2004, 03:28 PM
A DLL will never have nanomites.

-nt20
SHaG
05-24-2004, 02:28 AM
NT20: That's what I was trying to get at but was afraid to say because I wasn't sure. As I see it, protecting DLLs just can't be done in quite the same way as protecting EXEs.

MEPHiST0: I saw you tried to msg me on efnet (got it in my bnc log). Please try again. Nick is SHaG when I'm online and shag when I am not.


Newbie, In need of direction
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Newbie, In need of direction
PDA

View Full Version : Newbie, In need of direction

SmokinJo
05-21-2004, 09:14 AM
I am a total newbie, but looking to learn. I have a prog that I am trying to remove restrictions. Can anyone point me to a good place to start learning the ropes. Thanks for any advice!
Aquatic
05-21-2004, 01:45 PM
Download Ollydbg, and start playing with it.
naides
05-21-2004, 01:59 PM
Click the links below, and read the tutorials.
:yay:


Old Novex
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Old Novex
PDA

View Full Version : Old Novex

bi0w0rM
05-21-2004, 03:29 PM
Anybody have tutorial about unpacking Novex for DOS?
JMI
05-21-2004, 04:01 PM
Did you do your own search on the net, or do you just want a cure for laziness? If you have searched, you should have said so and if you had read the FAQ as the BIG RED LETTERS at the top of the Forums instruct you to do, you would know that as well.

Regards,
Woodmann
05-21-2004, 05:10 PM
You owe me 10 dollars US for doing "half" your work for you.

http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=%22novex%22&as_q=dos&btnG=Search+within+results

If you cant figure out the rest then send me 25 dollars US more and I will tell you.

-cbo-
Polaris
05-22-2004, 08:01 AM
You owe me 10 dollars US for doing "half" your work for you.

http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=%22novex%22&as_q=dos&btnG=Search+within+results

If you cant figure out the rest then send me 25 dollars US more and I will tell you.

-cbo-

Damn, thats quite cheap! ;) Next time I'll also forget rules and hire you for making the job! Hehehhe! :D
bi0w0rM
05-22-2004, 09:27 AM
You owe me 10 dollars US for doing "half" your work for you.

http://www.google.com/search?hl=en&lr=&ie=UTF-8&q=%22novex%22&as_q=dos&btnG=Search+within+results

If you cant figure out the rest then send me 25 dollars US more and I will tell you.

-cbo-

THANK YOU!!! :))))
Woodmann
05-22-2004, 02:47 PM
Your Welcome.


EXCEL macro signature
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > EXCEL macro signature
PDA

View Full Version : EXCEL macro signature

naides
05-21-2004, 06:40 PM
The problem:

I have modified some app which works as a EXCEL add-in and is mostly contained in a .xll file. When I try to load it, EXCEL complains: "The macros in this file do not match the digital signature . . .blah blah "
and refuses to load it.
There are ways around it, of course. Like lowering the security level for macros, or loading the add-in after EXCEL is running, but I would like to re-sign the updated file without perturbing the EXCEL security level, and without modifying the EXCEL code.

Microsoft provides info about signing macro libraries that you make, but it is not trivial when the macros are in an already compiled module .xll .
My question to the public is: does anybody know how the MSdigital signature operates? or knows of a source about the issue?
At first value looks like a CRC check of some sort, and I have some ideas about how to locate it, but pehaps some one here already invented the wheel before I do.

Thank you
dELTA
05-22-2004, 05:40 AM
A wild guess would be that the xll file is simply signed with a normal authenticode signature, in which case you can quite easily remove the signature data (just an appended binary chunk) and then use the Microsoft authenticode tools to apply your own, or am I wrong?


What is the best EXE-protector?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What is the best EXE-protector?
PDA

View Full Version : What is the best EXE-protector?

make
05-22-2004, 06:06 AM
I'm planning to purchase some kind of a EXE-protector for my Windows-programs, but I'm not sure which one I should choose. There are at least Armadillo, Xtreme-Protector, Obsidium, ACProtect and ASProtect.

I tested Armadillo but I didn't like it; it was too complex to use. Xtreme-Protector increases the size of the EXE-file too much. Obsidium, ACProtect and ASProtect were all quite easy to use.

If I choose to use one of the three programs last mentioned, which one should I take? The protected files don't have to be completely crack-proof. All I wan't that the protector hides the original code of my program and the resources at the end.

I don't want it to be possible to unassemble my code so it would be possible to detect which compiler is used and the resources should be crypted so it would not be possible to decrypt it easily.
.:hack3r2k:.
05-22-2004, 06:47 AM
:D

I suggest you to purchase Xprotector as even if is "hard" as you say to use and increases file size offers better protection then the others. I mean it can't be reversed by any middle cracker arround. If u'll search things about Xprotector reversing u'll have the surprise to find allmost nothing usefull. Anyway there's no best protector.... :devil:

Br;)
crUsAdEr
05-22-2004, 06:50 AM
I don't want it to be possible to unassemble my code so it would be possible to detect which compiler is used and the resources should be crypted so it would not be possible to decrypt it easily.

i doubt any protector can do this...
sgdt
05-22-2004, 01:45 PM
The only 100% protection I'm aware of is to write software nobody is interested in.

I don't know if you're aware of this or not, but using OllyScript, you can dump fragments of code as the program runs, so even if you never have your full exe decrypted at any given time, the whole can be dumped by anyone with notepad and a little patiance.

Convolution helps, but increasing size to make a bigger hay-stack doesn't. Profilers such as VTune and CodeAnalyst will pin-point your most treasured routines with a single click of a mouse.

ASProtect will keep out the newbies, and if used properly, will give headaches to even the best. (most authors are lazy and just wrap there exe).

Suggestion: concentrate on watermarking. Stego is a difficult field, but there are resources available.
NeO
05-22-2004, 05:16 PM
hehe if you ask me i wouldnt use not even one of mentioned protectors :whoops: ,,WHY ? Because everyone of them is used by may customers there for its alwasy a target of crackers ..so it such way..there is a lot of tuts out and dumper/unpacker which do a job perfectly for you..

So the best way to protect your app is ..to do it properly yourself :devil:

And if you intented to buy it anyway...just one that is not used a lot ..and its not so much targeted as this ones :confused:

BYe :loveu:
EJ12N
06-01-2004, 01:30 AM
Armadillo latest version
not many people like to crack targets with armadillo the new one lol my 2cents :)
silkscalp
06-03-2004, 06:09 PM
(in commercial context : the ratio price/protection is the more important.

The best method for protect a commercial application is to protect it just for block the most of cracker. The elite can even crack your protection so use a cryptor/compressor that is a good protector whith the lowest price....

Silkscalp)
MrAnonymous
06-11-2004, 06:52 PM
Armadillo latest version
not many people like to crack targets with armadillo the new one lol my 2cents

They do like keygenning the newest Arma tho, as TMG keygenned Arma 3.75 today I wouldnt trust it to protect very much :P
make
06-13-2004, 06:48 AM
Thanks for the answers. I'm not a cracker myself (what you probably guess) but I need some kind of protection for programs. I don't like the stupid resource section in modern Windows-programs and that's the biggest reason why some protection is needed.


Crypto tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Crypto tool
PDA

View Full Version : Crypto tool

SheepShagger
05-22-2004, 12:24 PM
Yesterday I came across this site http://mywebpage.netscape.com/cryptobench/ I haven't used the program that much but seems interesting if you are into crypto stuff
klier
05-23-2004, 10:27 AM
nice tool,but inform me when you're in the neighborhood so i can hide my sheep(those wooly bastards). :)
Regards,
Aimless
05-26-2004, 06:07 AM
I've seen movies of animal sex (poor animal is bewildered and shocked). But this is the first admittance of the same on this board.

Seriously, I just dig u'r nick, man!

Its soooo cool!

Have Phun
SheepShagger
05-27-2004, 12:27 AM
Well... thanks -I think :)- Sheep Shagger is a common derogatory term for Welsh people and in my case it goes back several years when I used to play Quake II on-line. I got a few chuckles every time I fragged some poor soul's rear-end with the BFG. The server's message was something along the lines of "PoorBastard got ripped by A SheepShagger's shaft" or similar.

klier, I definitely promise to spare your flock if I ever happen to be around
Woodmann
05-27-2004, 05:51 PM
Ummmmmm.....

Over these parts, you dont really want to be called a Sheep shagger.:eek:

Woodmann
SheepShagger
05-27-2004, 11:46 PM
I feel kinda guilty for taking the thread so off topic and now I'm uncertain if I violated some 'indecent handle' rule. If so, please let me know and will gladly change it to something less X-rated.
JMI
05-28-2004, 12:10 AM
You are only receiving the generally good natured ribbing that anyone who choses a nick which suggests some interesting, and rather unusual sexual proclivities might expect to receive. Over on this side of the pond it suggests someone with an interest in "sexual relations" with sheep. :cry: Unless you object to the natural chuckles the connotation raises, there is no need to change the nick on our account.

Now let's all sing that old time favorite: "I'm in love with ewe, ewe, ewe."

Regards,
SheepShagger
05-28-2004, 12:51 PM
In that case, bring it on yanks! I'll wait for you while I eat a delicious plate of Faggots.

NB, Maybe this thread should be moved to Off Topic specially if you naughty people now want to add cannibalism to sexual aberration :p
JMI
05-28-2004, 01:16 PM
Just in case some of our more "sensitive" readers may "assume" SheepShagger is now being "politically incorrect" and is intending to imply consuming a plate full of (a derogatory term for) "gay" people, I provide a recipe for "Faggots with Onion Gravy" which is a dish with pig livers, lamb or pig heart and pork belly, trimmed and rind removed. :yay:

http://www.bbc.co.uk/food/recipes/database/faggotswithoniongrav_3899.shtml

Pretty soon the Scots will be demanding equal time for recipes for Hagus and then the new Recipe Forum will be in full bloom. :cool:

Regards,
Woodmann
05-28-2004, 06:09 PM
Howdy,

I was wondering how pig livers wound up being called "meat faggots" ?

I did find out that Mr. Brains was at one time the largest producer of "faggots" in England.

Mr. Brains faggots, what a name !!!

Woodmann
klier
05-29-2004, 10:46 AM
SheepShagger,pig livers and cannibalism,oink? :thinking:
klier
05-29-2004, 12:17 PM
I was wondering how pig livers wound up being called "meat faggots" ?

"The word faggot means a bundle and just as a collection of sticks was tied up with string so the contents of a faggot is wrapped in a piece of caul which is a see-through lacy, fatty membrane which surrounds the pig's stomach and entrails. This keeps the ingredients together and the fat prevents it from drying out. The faggot is then packed together in a dish and baked until golden brown. Also known as Savoury Ducks, faggots can be eaten hot or cold and when served hot are traditionally accompanied by peas."
Regards,


More eLicense 4 issues
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > More eLicense 4 issues
PDA

View Full Version : More eLicense 4 issues

Fahr
05-23-2004, 06:17 AM
Hello all,

I must admit that I never actually unpacked eLicense 4, since the program I was working on a while back released an update every week or so... I just built a little program (using ZapHidden by someone else, don't remember whom...) that reset the trial each time.

Anyways, I now got something else on my hands and this one promises to be more interesting. Point is; there is NO trial. The only way to run the program is to reg it.
Since the actual program never really runs, I guess it's more or less impossible to dump it from the eLicense nag screen, so I figured I should first get the program to RUN... I also guess that the existance of this 'Trial' button is a param somewhere, but there's prolly more params, like how long the trial should take, etc. I don't think it's possible to 'force' a trial button to appear.

So, I'm stuck. I have no idea what to do next or if this is even possible at all. I could actually BUY the program (not too expensive) and then attempt to dump it once it really runs... but then I might as well just use the regkey I got to further reg it.

So, does anybody know if this is possible and if so, where to start?

Thanks,
- Fahr
hobferret
05-24-2004, 09:13 AM
Fahr :)

Interesting......

Maybe you could PM the target - I'm not going to install it on my PC but on an old one I found in a dumpster :D

Regards

/hobferret
Fahr
05-24-2004, 11:05 AM
Hobferret,

as always #1 to come to the rescue :D most appreciated.

I sent you a PM with the target details. Thanks a lot! :)

- Fahr
hobferret
05-25-2004, 09:14 AM
Fahr :D

Check your PM, it's all too easy :devil:

Regards

/hobferret
dELTA
05-25-2004, 07:18 PM
hobferret, if you found out something interesting about this protection wrapper you are of course welcome to share it with the rest of us, instead of just saying how easy it was... ;)
hobferret
05-26-2004, 04:17 AM
hobferret, if you found out something interesting about this protection wrapper you are of course welcome to share it with the rest of us, instead of just saying how easy it was... ;)

dELTA ;)

I did not post anything here coz it is really no different to what has been posted in the past - especially the bit about elicense ebooks :D

Regards

/hobferret
Fahr
05-26-2004, 04:21 AM
Related to this issue; I just CAN'T get SoftICE to break on elicen40.dll and I assume that breaking when the dialog is already visible is too late...
Also, OllyDBG (which I use normally) just runs this app without breaking at the EP.
What tool(s) did you use, Hobferret? Cuz I have the feeling I am missing something here...

Thanks,
- Fahr
hobferret
05-26-2004, 04:33 AM
Hi all ;)

This is from the PM to/from Fahr ;)

Re: Elicense crap

--------------------------------------------------------------------------------

Quote:
Originally Posted by hobferret
Hi M8

Just follow this and you will be done!

It's written in VB6 so IAT is a piece of cake!

Elicense40.dll 09/17/2002 70KB & spawned temp file

02614BDE 8985E0F0FFFF EAX==1 HERE
02614BE4 8B8594DAFFFF M==1 HERE
02614BEA 898510F3FFFF
02614BF7 0F85DA020000 JNZ - YOU SHOULD AUTO JUMP HERE
0261588E JUMP HERE
026162A3 JUMP HERE
0261889F JUMP HERE
02619128 JUMP HERE - WILL TAKE YOU THRU UNPACKING TO EIP

EIP 0040BE7C

Regards

/hobferret

Looks simple indeed I assume you did that with SoftICE? Cuz if I try to load it in OllyDBG, it immidiately runs :S

I do have SoftICE, but I guess I'll need some pointers on how to load this. Also note that elicen40.dll is packed with some ASPR, also not good for OllyDBG :P

- Fahr

It is quite easy to find this code in Olly - when at NAG screen set BP on DestroyWindow hit Quit - Olly will break on DestroyWindow, then just follow the code thru, I think it appears after 2, maybe 3 Ret's - Don't forget the values of the registers/memory need to be changed :devil:

In SICE just load it into the loader and do the same - Don't forget if you are using DS you need to use the ADDR command else it wont break ;)

Regards

/hobferret
Fahr
05-26-2004, 04:57 AM
I can't believe it! I actually get a trial reg screen :D I guess the EAX and mem changes have something to do with the command that was pressed? As in; 1 = trial, eventhough the button isn't there? Very cool!

One thing though, in my mem, the mentioned routines are on adresses B0000 below yours, no probs there, I can find all the right code and jumps, EXCEPT this one:

0261588E JUMP HERE

For me it should be at 0256588E, but there's nothing there. Only at 88D:

0256588D 8B95 849EFFFF MOV EDX,DWORD PTR SS:[EBP+FFFF9E84]

The rest of the jumps are all there, as well as the little snippet at the start...

- Fahr
hobferret
05-26-2004, 05:32 AM
Fahr :cool:

Typo :D

Shud be 02615B8E - SORRY!!!

Yep if EAX==1 you gotta trial kinda like Vbox idea.

BTW you should not get a trial reg screen, it's probably coz you aint jumped at the one above wot I typed wrronng :idea:

Regards

/hobferret
Fahr
05-26-2004, 06:22 AM
Cool it should be working now, thanks :D

One more q, after the last jump (to the unpack routine, so to say), I put in a

TC EIP < 2500000

seemed like a good idea at the time, since that whole temp module is loaded at 25xxxxx and the OEP is at 0040BE7C. But I guess I missed something again, cuz it seems like tracing takes forever :S

- Fahr
hobferret
05-26-2004, 06:25 AM
Cool it should be working now, thanks :D

One more q, after the last jump (to the unpack routine, so to say), I put in a

TC EIP < 2500000

seemed like a good idea at the time, since that whole temp module is loaded at 25xxxxx and the OEP is at 0040BE7C. But I guess I missed something again, cuz it seems like tracing takes forever :S

- Fahr

Just set a hardware breakpoint on EIP :D

Remember all elic EP==EP!

/hobferret
Fahr
05-26-2004, 06:42 AM
Ah! Of course! That kind of slipped my mind :p

I DID try a software breakpoint, but that never ends well with self-modifying code.

One more odd issue; I have a dump now, I did a full dump using LordPE when OllyDBG broke on the EP. I then ran the demo of this app (which does run normally) and used ImpRec to capture the import table, which I then applied to my dump. So far, so good.

The IAT fixed dump wont run, gives me an AV error and quits. The raw dump, without IAT fixed just gives me an error message saying "Invalid data!!!" and then quits :hmm:

I think that maybe I should fix the IAT using the original exe, but I can't get that one to actually run up till the point where I get a main screen. When I press F9 at the EP in Olly, it generates some unhandled exceptions and exits. End of story.

Or maybe that dumped exe without IAT fix is good and just requires some more cracking?

Thanks,
- Fahr
hobferret
05-26-2004, 07:15 AM
Hi again :p

I don't think you will fix anything by running the demo :D

When you have unpacked the God darn thing and dumped it - run it from there and you have the RIGHT program running :D

EDIT - Sometimes you can resolve the IAT with the prog locked at EIP - EDIT

Another tip:-
When in temp file you will RET to elicense40.dll @ 02483C3E

Then:-
02483CCF FF255CF84902 JMP NEAR [0249F85C] == 0040BE7C

0040BE7C 68ECE34000 PUSH DWORD 0040E3EC
0040BE81 E8F0FFFFFFFF CALL MSVBM60!ThunRTMain

All addresses except prog are relative to my PC, if you don't have this code at the EP then it has not unpacked :D

Good nite for now, like I said before this elicense crap pi**es me off, personally I ain't found anything useful wrapped with this pile :!:

Regards

/hobferret
Fahr
05-26-2004, 10:04 AM
Ow, then mine is NOT unpacked :S It starts with something completely different!

What went wrong? I followed all the steps and DID land on the EP after the unpack routine... only the code was different.

- Fahr
hobferret
05-26-2004, 10:22 AM
Ow, then mine is NOT unpacked :S It starts with something completely different!

What went wrong? I followed all the steps and DID land on the EP after the unpack routine... only the code was different.

- Fahr

Fahr :)

The only thing I can say is this. When you get to:-
02614BDE 8985E0F0FFFF EAX==1 HERE
02614BE4 8B8594DAFFFF M==1 HERE
02614BEA 898510F3FFFF
02614BF7 0F85DA020000 JNZ - YOU SHOULD AUTO JUMP HERE

Trace thru the whole thing manually til you get back into the elicdll and the near jump to the EIP :idea:

Or gimme your web space data and I will upload it for you, but this has been done with ME coz that's wot was on the old base unit I found :whoops:

Regards

/hobferret
Fahr
05-26-2004, 04:06 PM
I don't get it :confused:

I found the retn to elicen40.dll, I also found the jump to the OEP (it's actually at the same address as in your case), but after I jump to the OEP it is NOT unpacked!

What did I do wrong? :hmm: I changed the EAX to 1 and the memory to 1 one line below it, the JNZ DOES jump, then I fixed the other 4 conditional jumps into JMPs, it DOES enter the unpack routine after the last jump (or so it seems), but the target just doesn't unpack :confused:

am I going nuts here? Or am I still missing something?

Thanks,
- Fahr
hobferret
05-26-2004, 04:25 PM
Fahr :cool:

The only thing you appear to be doing different is changing the code at the JMP - I only changed the EAX register and the memory below it - When I came to the area where you need to JMP I just changed the register AND I also stepped thru the whole piece till I reached the EIP :D

So I dunno what you are doing M8 - keep on trying I'm sure you will get there in the end :whoops:

Regards

/hobferret

I don't get it :confused:

I found the retn to elicen40.dll, I also found the jump to the OEP (it's actually at the same address as in your case), but after I jump to the OEP it is NOT unpacked!

What did I do wrong? :hmm: I changed the EAX to 1 and the memory to 1 one line below it, the JNZ DOES jump, then I fixed the other 4 conditional jumps into JMPs, it DOES enter the unpack routine after the last jump (or so it seems), but the target just doesn't unpack :confused:

am I going nuts here? Or am I still missing something?

Thanks,
- Fahr
Fahr
05-27-2004, 11:34 AM
I just can't get it done :hmm:

Here's step by step what I do;

1) I load the exe into OllyDBG, it immidately runs
2) When the screen appears I type BP DestroyWindow and press the Exit button
3) I land here:

77E14885 > B8 59110000 MOV EAX,1159
77E1488A 8D5424 04 LEA EDX,DWORD PTR SS:[ESP+4]
77E1488E CD 2E INT 2E
77E14890 C2 0400 RETN 4

I put a breakpoint on the RETN and hit F9
4) At the RETN I press F8 and trace through a total of 3 RETNs (including this one)
5) I land here:

02564BDE 8985 E0F0FFFF MOV DWORD PTR SS:[EBP-F20],EAX
02564BE4 8B85 94DAFFFF MOV EAX,DWORD PTR SS:[EBP-256C]
02564BEA 8985 10F3FFFF MOV DWORD PTR SS:[EBP-CF0],EAX
02564BF0 83BD E0F0FFFF 02 CMP DWORD PTR SS:[EBP-F20],2
02564BF7 0F85 DA020000 JNZ s154.02564ED7

I change the value of EAX to 1
6) I press F8 and change the value of the memory to 1, then press F8 twice more and jump (the jump is taken).
7) I put a breakpoint on 0256889D, 0256629C, 02565B87 and 02569121, those are all lines before the conditional jumps.
8) I press F9 and land here:

02565B87 83BD 10F3FFFF 01 CMP DWORD PTR SS:[EBP-CF0],1

There I change the value of EBP-CF0 into 0, the jump is taken.
9) I press F9 and land here:

0256629C 83BD 10F3FFFF 01 CMP DWORD PTR SS:[EBP-CF0],1

The jump is also taken, it checks the same value
10) I press F9 and land here:

0256889D 85C0 TEST EAX,EAX

There I change the value of EAX to 1, the jump is taken.
11) I press F9 and land here:

02569121 83BD 10F3FFFF 01 CMP DWORD PTR SS:[EBP-CF0],1

The jump is taken, once again the same value.
12) I press F8 at the last jump and land here:

02569669 8D8D BCA2FFFF LEA ECX,DWORD PTR SS:[EBP+FFFFA2BC]
0256966F E8 FC9BF9FF CALL s154.02503270
02569674 C645 FC D1 MOV BYTE PTR SS:[EBP-4],0D1
02569678 8D8D BCA2FFFF LEA ECX,DWORD PTR SS:[EBP+FFFFA2BC]
0256967E 51 PUSH ECX

Supposedly the unpack routine.
13) I trace through pressing F8, passing several jumps and RETNs until a RETN to eLicen40.dll, after which I land here:

02483C3E 8985 08E4FFFF MOV DWORD PTR SS:[EBP-1BF8],EAX
02483C44 8B85 B0F3FFFF MOV EAX,DWORD PTR SS:[EBP-C50]
02483C4A 50 PUSH EAX
02483C4B FF15 84914902 CALL DWORD PTR DS:[2499184] ; kernel32.FreeLibrary

14) I trace that one through manually by pressing F8, passing a FreeLibrary and a DeleteFileA until here:

02483CCF -FF25 5CF84902 JMP DWORD PTR DS:[249F85C] ; XXX.<ModuleEntryPoint>

15) After I press F8 I land on the OEP, the code looks like this:

0040BE7C > 56 PUSH ESI
0040BE7D C4FA LES EDI,EDX ; Illegal use of register
0040BE7F 9F LAHF
0040BE80 00E8 ADD AL,CH
0040BE82 F0:FF65 FF LOCK JMP DWORD PTR SS:[EBP-1] ; LOCK prefix is not allowed

What did I do wrong!

Hobferret, thanks for willing to upload it, but that's only a last resort option... I really want to unpack this one by myself :)

Thanks,
- Fahr
hobferret
05-28-2004, 03:08 PM
Fahr :)

NOTE:- This guide should only be used for research purposes it is the users own choice what he/she use the purposes for and I can't be held responsible in anyway :thinking:

If you like the program then buy it

Elicense40.dll 09/17/2002 70KB & spawned temp file

02614BDE 8985E0F0FFFF EAX==1 HERE
02614BE4 8B8594DAFFFF M==1 HERE
02614BEA 898510F3FFFF
02614BF7 0F85DA020000 JNZ - YOU SHOULD AUTO JUMP HERE
0261588E JUMP HERE ***CHANGE EIP TO 02616067***
026162A3 JUMP HERE ***CHANGE EIP TO 02618858***
0261889F JUMP HERE ***CHANGE EIP TO 02619121***
02619128 JUMP HERE ***CHANGE EIP TO 02619669***
THEN TIL RETURN @ 02619AE8 RET TO 0264FBF8

0264FBFA JUMP BECAUSE EAX==1
0264FC17 MOV 01h INTO EAX
0264FC76 RET 0C TO 02653163 NOTE ESI==1 & EAX==1
02653169 JMP IS NOT TAKEN
0265316D JMP IS TAKEN
026531A6 MOV EAX 01h
026531AD RET 0C TO 0260C3BD
0260C3BE RET OC TO Elic.dll @ 02483C3E
02483C58 JMP IS TAKEN
02483C95 CMP DWORD BYTE 00 -- M==025B0000
02483C9C JMP IS TAKEN
02483CAA JMP IS TAKEN
02483CCF JMP PROGRAM EP 0040BE7C

Maybe it's because you are changing the bytes in memory to make the jumps is what is causing the problem. I don't really know why you are having these problems but that is the only thing which comes to mind. All I can say is that it worked the way I have done it. As I have said before I have yet to find any program wrapped with this muck that is of any use to me personally, I am not a "game" fan! :eek:

Regards

/hobferret
Fahr
05-28-2004, 04:22 PM
Ok, that's it :\

I did EVERYTHING to the LETTER, placing hardware breakpoints to avoid code modification and still no unpack...

I am beginning to think it's an NT specific thing, since there's also calls to the ntdll etc.
I'll try this on 9x/ME and check if that works out. If that also doesn't, I guess I'm going to tear out my hair...

Thanks,
- Fahr
hobferret
05-29-2004, 03:33 AM
Fahr :devil:

Ok, that's it :\ :confused:

I ain't gonna try this on XP coz it took forever to get rid of all the crap this stuff leaves behind :mad:

I guess that if you can't get it to work on 98/ME you better order a wig :p

Regards

/hobferret
Fahr
05-29-2004, 04:11 PM
Ok, that's it :\ :confused:

As in; OK, that does it, I don't know anymore

Anyways, I installed ME inside VMWare (cool stuff), but OllyDBG says "CAN'T PLACE BREAKPOINT" when I do a BP DestroyWindow.
I searched for a bit online and found on the Olly users forum that Win 9x/ME can't place breakpoints inside system DLLs!

I know this can be done, cuz I remember SoftICE tells you something about it when you install it (to enable setting breakpoints there), but I'd like to know how to do it without installing SoftICE...

I guess you know, since you also managed; so please share :p

Thanks,
- Fahr
hobferret
05-29-2004, 05:06 PM
Fahr ;)

I don't know, never tried to run Olly on 98/ME for the reasons you state, however, have you tried TRW2000 ;)

I would put money on the fact that you can do it with that program, if you are not aware you can load and unload it at will - give it a try :D

Other than that and SICE I would suggest something like looking in the memory window of Olly for the bytes you need to stop it at, then set a breakpoint on execution :yay:

Regards

/hobferret
Fahr
05-30-2004, 03:18 AM
The problem is that I can't install a lowlevel debugger inside a Virtual Machine without severe consequences...

Also; BPX DID work in Olly, I traced it all thru (in WinME), again with the same results :(

I'm beginning to think it's something with Olly that prevents doing this properly. Which tool(s) did you use to get this done? SoftICE? I have it installed, but I can't step over anything in it (according to the NuMega guides, this is because there is some other driver controlling INT 1 and INT 3 breakpoints and it has some fix involving Vectors, but that's all WAY above my field of knowledge...)

Thanks,
- Fahr
hobferret
05-30-2004, 01:56 PM
The problem is that I can't install a lowlevel debugger inside a Virtual Machine without severe consequences...

Also; BPX DID work in Olly, I traced it all thru (in WinME), again with the same results :(

I'm beginning to think it's something with Olly that prevents doing this properly. Which tool(s) did you use to get this done? SoftICE? I have it installed, but I can't step over anything in it (according to the NuMega guides, this is because there is some other driver controlling INT 1 and INT 3 breakpoints and it has some fix involving Vectors, but that's all WAY above my field of knowledge...)

Thanks,
- Fahr

Fahr :(

Can you be more explicit about what you are doing - I did it with SICE, however, I tried it with Olly on ME and got the same results as you posted :boo:

Regards

/hobferret
Fahr
05-30-2004, 03:45 PM
So it IS Olly! :eek: I am no goin crazy after all :eek: and I wont need a wig! :D

I tried it with SICE on Win2K, but I already plan to install a WinME partition simply for RE purposes.

One thing though; when I BP on DestroyWindow and I step, somehow everything goes wonky on the 3rd line (INT 2). I had this in both Olly AND SICE. I used to place BPs on the last line (the RET) and then just run, but I guess it should be steppable?

Oh, and another thing, since I am not an export on SICE; how to change the value of a register/memory? I will need to change EAX, memory and the EIP. I could prolly find this elsewhere in a tutorial if I searched for 5 seconds, but since I'm annoying the hell out of you anyways... :D

I will let you know how things went with WinME

Thanks,
- Fahr
Jblaze
06-04-2004, 11:47 AM
i have a elicense protected program that doesnt have a try me or trial button on the nag screen, will i still be able to unwrap this?

thanks
Fahr
06-04-2004, 11:53 AM
Just read this thread - it's all about it!

But you'll need SoftICE and possibly an installed WinME.

I still have to install WinME, will prolly do so this weekend, so I'll let you know how it worked out.

- Fahr
Jblaze
06-04-2004, 03:48 PM
cant i just use windows compatibility to make the program think that im using windows me? when i installed softice it was asking for windows 95 or 98 and i just switch the compatibility and it worked
Fahr
06-04-2004, 03:54 PM
Ugh. I HOPE you're kidding :S

You just can't install a lowlevel debugger for Win9x/ME on a windows NT without severe consequences.
And I also have SoftICE for NT, but it has some glitches, so I plan to install ME anyways.

And if you don't understand WHY you can't install a lowlevel debugger like SoftICE on the wrong OS, I think you should read some more tutorials and documents on it before attempting this one - no offence, just an idea :p

- Fahr
SlantNGo
06-07-2004, 05:06 PM
So you got it working with SoftICE but not Olly? I struggled at it with Olly for a few weeks, had some help from hobferret and some others but never did manage to hit the OEP. Specifically, what problem were you having with Olly? I'm trying to figure out if it's an issue with Olly or if I'm just stupid.
Fahr
06-08-2004, 01:02 AM
Well, I didn't unpack it at all yet, but hobferret managed to do it with SoftICE and, using the same procedure, not in Olly.

I followed his steps exactly with Olly, I DID hit the OEP, but it was not unpacked at all, all the code was still encrypted, which soon resulted in some errors and a program shutdown.

- Fahr


SoftIce Symbol Retriever - Getting PDB Files aka Symbols
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SoftIce Symbol Retriever - Getting PDB Files aka Symbols
PDA

View Full Version : SoftIce Symbol Retriever - Getting PDB Files aka Symbols

Navin
05-23-2004, 09:03 AM
Resently i came to the problem with 'Symbol Retriever' tool wich as you guess doesn't work on my PC (WinXP Pro SP2).

I'm tring now to download needed PDB-files manually. For that porpose i use 'trashbin' (http://www27.brinkster.com/sparksite/work/trashbin/trashbin.htm).

For example:

i've copied 'ntoskrnl.exe' from %Windows%/system32/ to c:/temp. Then downloaded 'trashbin' from http://www27.brinkster.com/sparksite/work/trashbin/trashbin.htm and put it in the same dir. Then in the shell...

c:\temp\trashbin ntoskrnl.exe /coff /pe

Then looking for strings 'TimeDataStamp = 1050016239' and 'SizeOfImage = 0x1d6e80'.

Then put these HEX data to MSDL link by formula:

http://msdl.microsoft.com/download/symbols/ntoskrnl.dbg/{TimeDataStamp}{SizeOfImage}/ntoskrnl.db_

and get

http://msdl.microsoft.com/download/symbols/ntoskrnl.dbg/3E95F9EF1D6E80/ntoskrnl.db_

Try to d/l ntoskrnl.db_ by this link and ..... YES! - nothing. this makes me fill sad. Oh, guys, what you can do to get SoftIce work properly breaking up on WinMain etc...

Looking back for your comments....

BTW, to extract file from *.db_ we use this windows tool 'c:\temp\expand ntoskrnl.db_ ntoskrnl.dbg'.... So, this way we get 'ntoskrnl.dbg'. By similar scheme we would get 'ntoskrnl.pdb'.
Navin
05-23-2004, 09:16 AM
NOTE: I use in my 'research' ntoskrnl.dll v5.1.2600.1024 (xpsp2.030410-1604)
doug
05-23-2004, 09:20 AM
from your other posts, I'm guessing you want to load those symbols into softice.

did you try SoftIce's tools, the SymbolRetriever? symrtrvr.exe. Yes? why isn't it working? is it setup properly?

I don't see why you want to go through that trouble of manually downloading symbols when a ready-made, fully working tool exists, and will even translate it to .nms.

Oh, guys, what you can do to get SoftIce work properly breaking up on WinMain etc...

I've never had to use that feature of softice, there are tons of other ways to get the _same_ thing done.

--
btw: this is a newbie question.
Navin
05-23-2004, 09:38 AM
SymbolRetriever Status - Error Download. Tried 100 times, but get the same Error message.
Navin
05-23-2004, 09:41 AM
Yes, I agree with you, WinMain break doesn't matter 100% true... BUT, tried hundreds of API functions and nothing breaks. TRY to explore TradeStation 8.0 (tradestation.com).....
Navin
05-23-2004, 09:48 AM
did you try SoftIce's tools, the SymbolRetriever? symrtrvr.exe. Yes? why isn't it working? is it setup properly?

Yes. SymbolRetriever shouldn't be installed there no setup procedure. It works like independend API.

btw: this is a newbie question.

Ok. This is an easy question for you rite? Then tell me how to download PDB-files from Microsoft without SymbolRetriever and WinXP Licens?
arz
05-23-2004, 10:31 AM
you could try downloading and installing the full symbol package, and then
set paths in symbol retriever to reflect your changes(ie get symbols locally),

hXXp://www.microsoft.com/whdc/devtools/debugging/symbolpkg.mspx
doug
05-23-2004, 10:43 AM
sorry, but I own the license for my windows version - I guess I can't help you on that side. (normally you get a support CD or a /SUPPORT dir on the beta CD)

But if you were one bit serious you would try to understand why the symbol retriever doesn't work.

Did you try with a non-beta file?
Does the symbol retriever work under other situations?
Could it be that you are using a beta which does __not__ have public symbols available? (as a registration is required on beta.microsoft.com)

I'm sorry, but your little provocative statements won't get you the spoon-feed answers that you are waiting for.
And this isn't tech support hotline - we don't owe you answers.

--
@arz: Only symbols for XP Sp1 are there. and if a windowsUpdate changed some of your system files, their symbols are no-longer valid.
arz
05-23-2004, 10:51 AM
@doug: k thnx for the info..., just grabbed the addr from 'favs' and didnt bother
checking...
Timbo
05-23-2004, 11:07 AM
try to down ntoskrnl.exe,
never seen ntoskrnl.dll
Navin
05-23-2004, 11:36 AM
Yep, you've confirmed my anxiety - SoftICE doesn't work with symbols library in WinXP Pro SP2 (v1204), that's the derivation. I'm using now 'break & exit' API to get SI break on WinMain. Thanks for flame in my sirious topic ;)
Kayaker
05-23-2004, 12:14 PM
Well, I haven't got much sympathy for complaints about a pirated OS either... but for others interested...

What I do is use Nmsym to translate the symbols to NMS using a .bat file. I just stick all the files needed into a new folder, but you can specify individual paths in the batch file if you want.

Take the 2 files nmsym.exe and nmtrans.dll from the Softice directory and put them into a folder. Then take each of the system dll/exe/drv/ocx... files you want translated, along with their respective .DBG and .PDB symbol files and stick them in the same directory.

Then create a batch file in this directory with a line for each symbol to translate, such as:

------------------
@echo off

nmsym.exe /TRANSLATE:source,package,always /SOURCE:. kernel32.dll
nmsym.exe /TRANSLATE:source,package,always /SOURCE:. user32.dll
nmsym.exe /TRANSLATE:source,package,always /SOURCE:. ntoskrnl.exe
nmsym.exe /TRANSLATE:source,package,always /SOURCE:. hal.dll
nmsym.exe /TRANSLATE:source,package,always /SOURCE:. ntdll.dll
nmsym.exe /TRANSLATE:source,package,always /SOURCE:. advapi32.dll
------------------

Run the .bat file and you should have .NMS files for each system file. Now under the Softice Initialization/ Symbols settings you can point to this directory and have the .NMS files loaded during startup.
doug
05-23-2004, 01:34 PM
Also, this method is great when you are debugging with softice your own applications.

(I've had all sorts of problems with MS VS6's integrated debugger when debugging 'complex' multithreaded apps or client/server apps.)

using the same method shown by Kayaker, I build an .NMS for softice which contains source & symbol information for my project. 'SRC' command to switch between disassembly and source-mode. This is also possible from the Symbol Loader, but I find the batch file method a lot faster than creating a workspace in the symloader (and manually refreshing the symbols)

nmsym.exe /UNLOAD:appname.exe
nmsym.exe /SOURCE:/path/to/src/dir /TRANSLATE:SYMBOLS,ALWAYS appname.exe
nmsym.exe /LOAD:SYMBOLS appname.exe
REM execute application
REM appname.exe
nikolatesla20
05-23-2004, 03:31 PM
Yep, you've confirmed my anxiety - SoftICE doesn't work with symbols library in WinXP Pro SP2 (v1204), that's the derivation. I'm using now 'break & exit' API to get SI break on WinMain. Thanks for flame in my sirious topic ;)

You need the symbols for ntoskrnl32.exe. AND you have to add the line "NTSYMBOLS=ON" in SoftICE's configuration, or it WONT work. A simple search would have given you this.

-nt20
bilbo
05-24-2004, 04:28 AM
Navy,

the inquiry to Microsoft Symbol Server has changed with files compiled on Visual Studio 7 (that's the case of XP NTOSKRNL.EXE).
The new format is:
http://msdl.microsoft.com/download/symbols/ntoskrnl.pdb/<...>/ntoskrnl.pd_
where <...> is <GUID><AGE>

GUID are 32 digits univoque id,
AGE is one byte denoting the linking level

Both are found inside the Debug Direcory Entry.
You can find those 32+1 bytes inside the executable, immediately after signature "RSDS".
But be careful about the GUID bytes ordering for the first 8 bytes!
E.g. 9C C7 5E C9.FB FB.20 42.AF 2B 6E 9D 09 55 1A 1F becomes
C9 5E C7 9C.FB FB.42 20.AF 2B 6E 9D 09 55 1A 1F without spaces/dots.

Cheers! Bilbo.
Navin
05-24-2004, 08:07 AM
Thanks bilbo! This is the most usefull advise, i'll try to get pdb-s this way. Anyway, just already cracked TradeStation8 without symbols help.... Congratulations! mine oh mine!
bilbo
05-24-2004, 08:41 AM
I agree, even if I am not a cracker... A single crack makes feel you so mighty...
Anyway symbols, for M$ cracks, help a lot!
Go on this way! Bilbo.
Navin
05-24-2004, 04:38 PM
Yep, you so understand me ;) BTW, i used 'GetWindowTextA' break & Softaica breaks on this API function only when i add 'BPINT3' break point. Is that normal? Or should i reconfigure my SI?
Navin
05-24-2004, 04:58 PM
the inquiry to Microsoft Symbol Server has changed with files compiled on Visual Studio 7 (that's the case of XP NTOSKRNL.EXE).
The new format is:
http://msdl.microsoft.com/download/symbols/ntoskrnl.pdb/<...>/ntoskrnl.pd_
where <...> is <GUID><AGE>

GUID are 32 digits univoque id,
AGE is one byte denoting the linking level

Both are found inside the Debug Direcory Entry.
You can find those 32+1 bytes inside the executable, immediately after signature "RSDS".
But be careful about the GUID bytes ordering for the first 8 bytes!
E.g. 9C C7 5E C9.FB FB.20 42.AF 2B 6E 9D 09 55 1A 1F becomes
C9 5E C7 9C.FB FB.42 20.AF 2B 6E 9D 09 55 1A 1F without spaces/dots.

Don't understand how to do that, too advansed for me... Could you please give me some chief steps how to extract GUID and AGA from ntoskrnl.exe.
bilbo
05-25-2004, 01:35 AM
a) open NTOSKRNL.EXE with an hex editor (e.g. Hex Workshop)
b) look for the string "RSDS": there is only one occurrence (in XP-SP1 I find it at offset 6BAC)
c) write down the 16+1 bytes following that string: in my case
9C C7 5E C9 FB FB 20 42 AF 2B 6E 9D 09 55 1A 1F 02
d) sort the GUID with the following algoritm:
a0 a1 a2 a3 b0 b1 b2 b3 c0 c1 d0 d1 e0 e1 e2 e3 e4 e5 ->
a3 a2 a1 a0 b3 b2 b1 b0 c1 c0 d1 d0 e0 e1 e2 e3 e4 e5
(so, the e... bytes are not re-sorted) in my case:
C9 5E C7 9C FB FB 42 20 AF 2B 6E 9D 09 55 1A 1F
e) remove the spaces and add a trailing character for the AGE (in my case 02, so add '2'). The final string, in my case, will be
"C95EC79CFBFB4220AF2B6E9D09551A1F2"
f) prepend http://...../, append ntoskrnl.pd_, and download it
g) expand *.pd_ to *.pdb
h) if you want to use it with SoftIce, convert *.pdb to *.nms using NMSYM.EXE

By the way, Symbol Retriever which comes with DS 3.1 is working for me...

Cheers, Bilbo
Navin
05-25-2004, 07:32 AM
Thanks for explonations. What i did wrong? Look at the screenshot.

These are bytes from the ntoskrnl.exe:
88 57 0C B7 DE E3 DB 44 A5 65 A4 0B B6 80 36 CC 01

Now i sort bytes with your algoritm:
B7 0C 57 88 44 DB E3 DE 65 A5 0B A4 B6 80 36 CC 01

And get the link:
http://msdl.microsoft.com/download/symbols/ntoskrnl.pdb/B70C578844DBE3DE65A50BA4B68036CC1/ntoskrnl.pd_

Nope.
bilbo
05-25-2004, 10:28 AM
Nope.

Yes, I have tried your link and it does not work, even if it was formed correctly.
You can try my link and it must work!

h..p://msdl.microsoft.com/download/symbols/ntoskrnl.pdb/C95EC79CFBFB4220AF2B6E9D09551A1F2/ntoskrnl.pd_

The only plausible explanation is that they have not put symbols on their server, because XP2 is yet in beta phase.
Sorry! Bilbo.
doug
05-25-2004, 11:11 AM
The only plausible explanation is that they have not put symbols on their server, because XP2 is yet in beta phase.
Sorry! Bilbo.

which brings us back to the fact that
(i) he isn't a registered XP customer
(ii) he isn't a registered XP Beta customer
Navin
05-25-2004, 12:16 PM
which brings us back to the fact that
(i) he isn't a registered XP customer
(ii) he isn't a registered XP Beta customer

I think there should be another link for WinXP SP2 (beta) symbols... I can download symbols for SP1 and it's not require customer/serial number or whatever.. maybe something like that:
http://msdl.microsoft.com/download/beta/symbols/ntoskrnl.pdb/C95EC79CFBFB4220AF2B6E9D09551A1F2/ntoskrnl.pd_
P.S.: Guys, you think negatively about me because of this customer shit. But let me explain you, I live in Russia and here nobody buys licensed software :( ok, maybe just few peoples and above average corporations. This reality! I’m not proud of this at all. The only reason for this - is cost, and not because we bad guys, not Christians, slow-witted etc.. For example, would you buy WinXP if it costs you $2500? Yes, perhaps you will, but what about majority average Americans?
doug
05-25-2004, 12:54 PM
The reason why I mentionned the license stuff is nothing personnal against you, it's just that (correct me if I'm wrong), you need a special registration/access level to get anything off beta.microsoft.com (incl. XP SP2beta).

We can all download XP SP1 (and its symbols) off the net, because it's no longer tagged as a beta. XP SP2 on the otherhand, is considered a private beta (even if it was leaked on the net instantly), therefore anything related to it will require some level of authorization. From what I could see, MS uses their Passport + some beta user ID..

And since it appears that the SP2 beta was put on the net without the corresponding symbols.
There's nothing you can do unless:
1) You obtain access to microsoft's beta website
2) someone who has access to the website leaks both the ServicePack and its corresponding symbols.


Armadillo 3.6x
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 3.6x
PDA

View Full Version : Armadillo 3.6x

tenketsu
05-23-2004, 04:59 PM
Well ArmaCrap again.. ;)

I try UCompare from IDM Computer Solutions, Inc. & find some sorprises.

Ollybdg is detected !!

A far return is implemented in father process.

Check it!, and have some FUN.

Post comments......
dELTA
05-24-2004, 07:37 AM
Yes, you can read about this detection in other Armadillo threads on this board.
tenketsu
05-24-2004, 09:45 AM
ok!
tenketsu
05-24-2004, 07:56 PM
I dump UCompare, rebuild the IAT & work's fine in WinXP.

In Win2K one error in the IAT by kernel32.RestoreLastError, this function is available only in WinXP don't work on Win2K or Win98.

If anyone has this error only rebuild the IAT & replace RestoreLastError for SetLastError (not SetLastErrorEx).

I get disapointed; for the dump, rebuild & crack [only 4 bytes :boo: ] i have used 25-35 minutes.........

That's all folk's
tenketsu
05-26-2004, 10:51 PM
I try UEdit [IDM Computer Solutions, Inc.]

Datos:
*CopyMemII
*IAT fuera de la memoria del ejecutable
*IAT Destrozada
*Nanomites [el algoritmo de saltos ya cambio]

Toda una joya no creen :devil:
tenketsu
05-27-2004, 11:06 PM
y... bien.

DUMP: ok!

IAT: ok!

NANOMITES: En este armadillo la tabla de las direcciones donde se encuentran los nanomites esta encriptada [o he sido burlado :D ].
En el proceso padre solo hay una cadena de bytes 03000080 [80000003], pero me detecta cada BPx de todos tipos y tamaños, cierra al hijo y se cuelga.

Se aceptan sugerencias.
JMI
05-28-2004, 12:01 AM
tenketsu:

The expected language of this Forum is English. There are other Forums if you prefer to post in other languages. Also this is not the appropriate place for you to post your view of your own personal exploits. We really aren't interested in reading about your bragging about your accoumplishments. I hope this message is clear.

Regards,
tenketsu
05-28-2004, 12:34 AM
Don't put the last 2 post in english because i don't speak this language at 100%
I only post comments, teories or ideas.
My intention is not get glory or status, is only share, comment & get comments about the post.

I'm so sorry if my style-idology are pretentious.

Well, i think... that's it
Hopcode
05-28-2004, 05:17 AM
So far as i can read, your ideas is just a rip off of Ricardo :)

People here are sharing informations, if you just want to brag about what "you" have done, then do that somewhere else.
Especially not in spanish or whatever language.

Cheers,

Hopcode

Don't put the last 2 post in english because i don't speak this language at 100%
I only post comments, teories or ideas.
My intention is not get glory or status, is only share, comment & get comments about the post.

I'm so sorry if my style-idology are pretentious.

Well, i think... that's it
tenketsu
05-28-2004, 09:56 AM
Call me "braggart" is excessive, but i thik maybe it's my fault.

Call me "ripper" is unacceptable.

I really apreciate Ricardo Narvaja an his FTP :loveu: , for his knowledge & he is nice, agreable.

The forum is yours [admins-useres] then i dont't start another thread anymore. Thank's for all.


Problem to emulate SproQuery
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Problem to emulate SproQuery
PDA

View Full Version : Problem to emulate SproQuery

nasty
05-24-2004, 09:39 AM
Hi To all,
i'm working from about 2 months on Spro emulation.
I have problem in SproQuery .. to calculate Xor values.
I have also the Dongle dump. how i can emulate this values to use in debugging?
Please gimme advices please.
I'm going mad!!

I have understood that the only way is "Brute" the entire array of response .. i have prepared a C bruter but i don't have understood how i calculate the right offset (in file), the bytesize ..
Please i want a complete example of bruter for this.
Thanks
KSA
05-24-2004, 11:52 AM
Hi,

Is this target protect with Sentinel SuperPro Shell Protection ?
nasty
05-24-2004, 12:43 PM
yes!
this is a part of the shell ..
tom
06-01-2004, 09:52 AM
I did this a while ago and dumping al possible queries seemed the only solution for me. I allready posted a routine to load the correct value from a file a while ago.

http://www.woodmann.net/forum/showthread.php?t=5136

The problem i had had to do with the fact that the addresses he called were not correct in the context. (CreateFileA,SetFilePointer,ReadFile,CloseHandle)

(note that this code also returns some values to 'standard' queries this program required)

The code to dump the possible queries to a file is quite simple:

for(query=0;query<=0xffff;query++) {
ret = RNBOsproQuery (ApiPacket, 0x08, &query, &rsp, &rsp32, 4);
if (ret == 0) {
write(fd,&rsp,4);
} else {
printf("Error at query %i, aborting\n");
return 0;
}
}


FSG v2.0 executable packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > FSG v2.0 executable packer
PDA

View Full Version : FSG v2.0 executable packer

bart
05-24-2004, 10:16 AM
http://www.woodmann.net/bart/download.php?id=xt_fsg20.zip
or
http://tinyurl.com/37eqh
dELTA
05-24-2004, 11:49 AM
What?
bart
05-24-2004, 11:51 AM
what what :), isnt it TOT forum?
dELTA
05-24-2004, 11:55 AM
Yeah, I just guess a small description would be in its place when posting a link to a file of warez release format which is also distributed from our own server, like e.g. "here is a packer I have created, and not really cracked and warezed, like the friggin nfo file in it says"...
Gustav
05-24-2004, 12:45 PM
Norton AV says:Bloodhound.W32.EF
bart
05-24-2004, 01:11 PM
and you trust it, shame on you :)
klier
05-25-2004, 01:39 PM
Norton AV says:Bloodhound.W32.EF

is because of low entrypoint?
bart
05-25-2004, 01:58 PM
i think becouse its shitty, and cant even emulate fsg's code (if executable != msvc or delphi then virus)
Kayaker
05-27-2004, 02:58 AM
Interesting, I was cleaning up a W32/Spybot.worm.gen worm I just got, damned if I know how though since I never click on anything that might get me infected. I had to turn off my firewall though for access to a site, might have happened then.

Luckily I turned the firewall back on when I next logged on (dialup) and caught the worm in action, filenamed 'intersvc.exe' (UPX 0,1,2 packed). Started doing a bit of research after cleaning up, there are now >1000 variants of this worm, and found this entry about the worm:

"Some are encoded using FSG packer for PE executables".

http://hq.mcafeeasap.com/dispVirus.asp?virus_k=100282

'tis a shame your nice packer is used for this shite...
Ah well, such is the pitfalls of net travel.

K.
evaluator
05-27-2004, 08:54 AM
Kayaker, RTM?????????
Kayaker
05-27-2004, 08:36 PM
Hmmm, you mean this...?

features:
+ designed for asm executable files (kg, cracks, trojans :)

Ya, I guess you're right :stunned:

...still shite though
evaluator
05-30-2004, 12:33 PM
forgot to write one curious situation.

1. If this packer made for viri-trojs,
then Anti-Virs are doing good job, when FALSE-ALARMing!

2. But then, this packer will not be used by Viri-authors.

3. So then Anti-Virs will do bad job,
when FALSE-ALARMing & thay will remove FALSE-ALARM.

4. But then Viri-authors will think about using this packer..

5. GoTo 1.


Old winice (vxd) & relocation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Old winice (vxd) & relocation
PDA

View Full Version : Old winice (vxd) & relocation

Timbo
05-24-2004, 03:21 PM
I'm trying to understand how the old winice.exe vxd combination
is relocating. Anyone know how ?? NZ ??
It's not a PE I know ;)
Kayaker
05-24-2004, 06:46 PM
Hi

Not sure exactly what you're getting at, but the vxd is in LE format and will be loaded somewhere above 0C0000000h, the base address for the system shared region in Win9x. The exact starting address can be obtained from the Softice 'VXD' command, or programatically if need be.

K.
Timbo
05-25-2004, 04:38 PM
Well i mean
who calculate something like this
mov esi, adress
in hex seen only
BE 00 00 00 00

so how come the adress into this zeros,
i didn't see any reloc section
(like in ntice.sys 8 -> reloc)
inside this winice.exe (vxd inside)

how is it done :thinking:

well i really should wipe W9X
Kayaker
05-25-2004, 11:19 PM
I'm not sure exactly how the OS maps vxd sections, I think it's dependant on load order, size of the sections, available memory, etc., and not to any inherent reloc info. as might exist in PE files. I haven't got things installed any longer to look into it further.

The easiest thing to do is get the "real" starting address of the driver sections with the 'VXD' command and calculate the offset from the disassembled addresses as seen in IDA. You can then use this raw->virtual offset to unassemble selected instructions and read the real Data variable addresses from the Softice window.

If you were really interested, you could look into how the Vxd_Desc_Block DDB structure was initialized when a driver is loaded, along with the Device_Location_List, ObjectLocation and other structures which define linear address and other info about a driver. But methinks this is not the case ;)


Softice 4.05 breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice 4.05 breakpoints
PDA

View Full Version : Softice 4.05 breakpoints

tee_bag
05-24-2004, 06:47 PM
Hey Gurus,

I have installed Softice 4.05 on my xp machine and have installed the xp patch.

I am trying to learn Softice through tutorials I have found on the net.

I am at the breakpoint section and I just cant get them to work.

I ahve taken the semicolons out of winice.dat(even tho I have read that is only for win9x) and I have added a whole bunch of .dlls into the symbol loader exports.

The tutorials basically say to type in BPX GetDlgItemTextA and press enter then get out of softice and go to start-> run-> whatever and press enter.

Softice should pop up, but it doesnt; I have also tried GetWindowTextA

I am really confused and help would be much appreciated,

Thanks,
Aimless
05-24-2004, 11:45 PM
Right!

This is a very common problem. First, I'd suggest you do a "softice breakpoint" search using the search function (without the quotes). This should come up with interesting topics.

For a quick and dirty...

1. Softice based on NT systems (NT4, ME, 2000 , XP and 2003) is not the same as softice for the 95/98/98SE versions.

2. In XP and kin, you have to be in the correct context to put the breakpoint, otherwise the breakpoint will not stick.

3. For example, your app is notepad. Then you will have to:

a) proc (this will give you names of all processes)
b) addr NOTEPAD (this will ensure you are in the context of notepad)
c) bpx MessageBoxA (this will hit in the context of Notepad)

As you search through the board, you will find how to automatically set the breakpoint context to that where you want so that you do not have to all the time keep on changing contexts to set breakpoints (default context, is what it may be assumed).

Finally, remember, you cannot be a good RCE if you ask us to crack. And most people ask us to crack because they do not know the answers. And many a times, they do not know the answers, because they do not search!

So search, and be happy!

Have Phun
boonlia
05-31-2004, 08:37 AM
Well I faced the same problem but then i tried by removing the letter A from the last part of breakpoint. We add A for 32 bit softwares but at times it doesnt work. Try doing it and may be it works fine.
I do not know how but at times it do work.

Hey Gurus,

I have installed Softice 4.05 on my xp machine and have installed the xp patch.

I am trying to learn Softice through tutorials I have found on the net.

I am at the breakpoint section and I just cant get them to work.

I ahve taken the semicolons out of winice.dat(even tho I have read that is only for win9x) and I have added a whole bunch of .dlls into the symbol loader exports.

The tutorials basically say to type in BPX GetDlgItemTextA and press enter then get out of softice and go to start-> run-> whatever and press enter.

Softice should pop up, but it doesnt; I have also tried GetWindowTextA

I am really confused and help would be much appreciated,

Thanks,
LOUZEW
05-31-2004, 02:42 PM
A well know problem
use the search option on this forum !


How to unpack file packed with "EncryptPE v1.0 CnCrkGroup PE·"?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > How to unpack file packed with "EncryptPE v1.0 CnCrkGroup PE·"?
PDA

View Full Version : How to unpack file packed with "EncryptPE v1.0 CnCrkGroup PE·"?

JonathanL
05-24-2004, 10:14 PM
I am a real newbie. I am learning unpacking. I encountered 2 packed files(from a forum). It seemed packed with "EncryptPE v1.0 CnCrkGroup PE·", via FI 3.01(PEID can't recognize them). When I fired it with OD,after 2 or 3 exceptions, the proggie exited. How to config OD to unpack the packer? Would anybody post a tut about unpacking it?

The attached files include an exe file and a dll file.
JonathanL
05-24-2004, 10:18 PM
The zipped dll file.
Kayaker
05-25-2004, 12:19 AM
Hi

I've got a better idea. You just uploaded 1.6+Mb worth of what appears to be a commercial app. While it was hard to tell because the program links to a Chinese? site, the program is listed on several download archive sites and has many earlier versions.

The program itself (some net app) was essentially unusable, dozens of messy controls with nothing in English, and gave me several error and access violation (Delphi?) messages before even starting.

Now, that said, this example for unpacking purposes was pretty crappy IMO. Let alone the fact that it was most likely a commercial app, which makes your post a crack request, blatant disregard of the board rules, blah, blah, and any of the moderators would have deleted this post outright and lambasted your ass for not reading the Faq.

Instead, I might suggest this, go to the packers home page

http://www.encryptpe.com/

and pack notepad to your hearts content. Start analyzing it and report what you find. If things look interesting you can up a packed test file and create a mini project if you wish. If anyone has experience with the packer or wants to test it themselves they can assist. But please, we try to avoid the "here's an app, can you unpack it and write me a tut" type of posts here.

Kayaker
JonathanL
05-26-2004, 04:19 AM
Sorry,sorry. I am not targeting on the "commercial app". The uploaded files were taken from a forum, as I said. It couldn't be run on my computer, i.e.,they were parts of an app, not a complete "commercial app".

We can download a demo packer from the site you posted. But, as I know,the demo version and the registered version are not the same. The registered one is more difficult to unpack. The demo version packed proggie can be fired and debugged with OD, and the registered one can't be debugged (on my poor konwledge) with OD. And it is not so easy to find out a proggie (especially with a packed dll) packed with this thing. This is the reason I posted the exe and dll files to this forum for help.

The attached test files are packed with a repacked EncryptPe from a Chinese forum. I hope we can learn something from unpacking this packer.
Kayaker
05-26-2004, 04:53 PM
I know you weren't specifically targetting this app, however all that was missing was a few non-PE data files, making it target-specific enough to make RE'ing it a legal liability to the board.

As for the packer, since there seems to be zero information about it anyway, I would think the demo version would be enough to satisfy your desire to learn unpacking, at least as a start...

Since this test app looks interesting enough, I move it to the Mini Project forum as an unpacking challenge. I'd suggest the first task is to analyze the embedded file v1200*.epe that is written to disk, how it is decrypted and how it is used by the program. Next task might be to figure out why the program crashes when Softice is loaded, perhaps it detects ring3 debuggers as well.

To trace the program, if you can't get it to break any other way, I'd recommend setting BreakInSharedMods ON and setting a BP on _BaseProcessStart, as outlined by pLayAr in this thread, the trick works well:

http://66.98.132.48/forum/showthread.php?p=36907#post36907

Detail your initial findings, tweak the interest of others, and we may soon find out how this packer works.

Cheers,
Kayaker


strange behavior of unpacked exe (upx)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > strange behavior of unpacked exe (upx)
PDA

View Full Version : strange behavior of unpacked exe (upx)

koyaan
05-25-2004, 09:33 AM
okay... im trying to unpack the all seeing eye atm...
upx is pretty straight-forward... i was able to find the oeip, i do a EB FE to
get it in an endless loop, dump it with lordpe then fix the entry point...

i start my dumped exe and... it runs!
now i close it and try to start it again...it crashes :p

i loaded it in olly and it seems the first call to an api causes the problem...
by comparing the iat of the dumped exe with the original i found that every adress there was off by the same offset... pasted the original into the dumped, but it didnt quite work out, but im quite a newbie when it comes to unpacking / rebuildin...

what really bugs me is that my dumped exe runs once (or even twice) and suddenly refuses cooperation....

ps: i did search for upx on the board ty :)

cheers koyaan
tenketsu
05-25-2004, 10:34 AM
Unpacking UPX is very easy.

Check the tutorial: "49-REVISION DE PACKERS AL DIA DESEMPACANDO UPX 1,24" in the ftp of Ricardo Narvaja

If you can't do it, use "Generic Unpacker For UPX" by Bratalarm.

There are no trick's with the IAT, UPX is a compresor not a protector
esther
05-25-2004, 12:01 PM
Don't toggle the space bar and assemble it.Use binary edit
to change the EBFE
There are some crc check I think[

update:
when using assemble you must type jmp short blah.Its a short jump
zyzygy
06-17-2004, 11:00 PM
Hi I dunno if this helps or not but ,here is an esay way to unpack upx.Disassemble the packed target and scroll down "hard" till you reach till you see the 00000000 bytes ,then scroll up a bit and you will find an unconditional jump,this is the jump to the oep and note the address down .Then load it in the loader and set a breakpoint there and do an ebfe there.Dump it and viola it is unpacked .You have to change the ep using procdump.

And upx doesnt modify the iat,if it does it is an upx scrambler.Then you have to rebuild the iat.

Hope this helps ;)
bye
esther
06-17-2004, 11:08 PM
The reason is simple,you have run the program once,its still in the the memory stack.This program is certainly weird ;)
zyzygy
06-18-2004, 02:26 AM
Hi,
coulnt get ya,has the program been unpacked??sorry for this q,but i get confused easily :D
esther
06-18-2004, 09:19 AM
Its the same old upx,nothing new,just fixed the imports will do
cRk
06-18-2004, 11:27 AM
Pe Explorer + its UPX plugin makes a perfect unpacked exe for the All seen eye .. it also reconstruct all section names to its original delphi or VC ++ state

also you can inline patch it .... i don't see anything special in this case..
esther
06-18-2004, 11:59 AM
I'll emphasize more on it :thinking: .It actually runs after unpacked without fixing the imports(it reads the original stack of imports).If you reboot your system,the unpacked file will not run.You have to fixed the import tables.

This is the first strange file I have ever seen :)

Regards
Fatty[NegX]
10-05-2004, 07:41 PM
did I miss something?
upx -d -o output.exe allseeingeye.exe
UPX Being the upx exe, -d meing decompress, -o output.exe meaning output file
and all seeingeye.exe being the input.
that outputs the unpacked exe yes? I've used it before... sorry if this is some newb comment that doesn't apply but... it seems rather trivial

I also have had a problem with a decompressed exe, it opens fine, works fine, but when open it in SmartCheck, it crashes SC with a memory error. (this is a VB app, which is the reason for SC) if I open the original packed exe sc works fine =-D


Microsoft MSO.DLL (Product Activation)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Microsoft MSO.DLL (Product Activation)
PDA

View Full Version : Microsoft MSO.DLL (Product Activation)

Nad_Af
05-25-2004, 09:29 PM
Hello:
Some products of Microsoft use the the DLL "MSO.DLL" for activation procedure. I found that the Activation method by using telephone (as in Visual Studio .NET) is: :confused:

Calling the DepositConfirmationId(LPCTSTR bstrVal) passing it the ID provided. If the functions returns 0, it means success, otherwise, I always got 0xCCCCCCCC.

Now, the DepositConfirmationId function is in the ILicAgent Interface.
I tried to debug a program I created to see how the function can return 0, but I was lost in the function body:

unsigned long ILicAgent::DepositConfirmationId(LPCTSTR bstrVal)
{
unsigned long result;
static BYTE parms[] =
VTS_BSTR;
InvokeHelper(0x5f, DISPATCH_METHOD, VT_I4, (void*)&result, parms,
bstrVal);
return result;
}

How can I know the method the function is based on? (I mean how to follow the debug code in SoftIce)

Is the MSO.DLL code for the function loaded into my app address space?
djnz
05-26-2004, 06:06 PM
Hey,

Obviously, you'd need to step into the InvokeHelper function to get to the code which actually invokes the method.
Could you elaborate on where the snippet is from and perhaps rephrase your question (im affraid i don't see what your problem is)?

Thanks.
Nad_Af
05-26-2004, 11:54 PM
Actually, I am trying to activate Visual Studio .NET 2002 using telephone method. The serial you enter in the text boxes is concatenated and passed to the function DepositConfirmationId to check and complete the registration.
My question is: Is it possible to know where exactly the function DepositConfirmationId code reside in the DLL, the virtual address, file offset, exported function, so I can unassemble it. Because when I tried to debug the program, I got lost in the big OLE code, too many calls, jumps and pushes.

Is it clear, now?
dELTA
05-27-2004, 06:33 AM
As far as I understand, you are looking for a way to get the entrypoint of a function exported in a COM interface by a module? There are several COM analysis tools, try to search for "COM analysis", "COM reverse" etc.

Also, this one might be good:

http://www.ddevel.com/Home/Main.asp
djnz
05-27-2004, 07:38 AM
Yeah, i get it now.
You want to locate a method of an COM object.

COM objects implements one or more interfaces, each interface has it's own methods.
The methods of all the interfaces that an object implements is stored is stored in the objects virtual function table (vft).
The order in which the methods are stored is pre-defined, for each interface the methods are stored in the same order as in the interface definition.
The interfaces methods are ordered from the top of the inheritance tree, that is, the methods of the base interface are stored first.
The first argument to all methods in the vft is a pointer to an instance of the object (the memory allocated for the object).
In msvc++ the the entries in the vft points to compiler generated stubs, which sets the *this* pointer and calls the actual method.
A pointer to the vft is stored at the first 32 bits word of the objects instance
data.

So, once you have the vft of an COM object, you've got pointers to all it's methods.
The easiest way to locate the vft is using ida (you could also do it from softice, but i'd need more information on where you're at, to give an explanation).
If you can get the com interface plugin (http://www.datarescue.com/freefiles/com_plugin_V1_21.zip) to work, then that should name the methods for you.
The plugin didn't work for me, so what i did was a binary search for the uuid of ILicAgent, because the uuid is needed for the implementation of IUnknown::QueryInterface, which all COM objects implements.
I found one instance of the uuid in the text section, but there were no references to it, since ida wasn't finished with it's analysis.
I then did a new search for the virtual address of the uuid, which turned up one result, in a function which has the characteristics of a c++ constructor.
One of the last instructions in the function was obviously initializing the vtf pointer of the object instance:
mov dword ptr [esi], offset vftILicAgent

So, now all that remains is to locate the right entry in the vft.
The first methods belongs to IUnknown, then IDispatch and finally comes the methods of ILicAgent.

Have fun.
nikolatesla20
05-27-2004, 10:23 AM
http://www.woodmann.net/forum/showthread.php?t=5046&highlight=matt

and

http://www.woodmann.net/forum/showthread.php?t=5437&highlight=vtable

-nt20
Nad_Af
05-27-2004, 09:12 PM
Could you tell me how to locate it (the entry) exactly, please?
Nad_Af
05-28-2004, 12:27 AM
Hello:
I tried CoClassSyms with MSO.DLL but Windows displayed a runtime error while the program was executing.

Could you generate the debug file for me, please?
I don't have IDA; how can I use it in SoftIce?

http://www.woodmann.net/forum/showthread.php?t=5046&highlight=matt

and

http://www.woodmann.net/forum/showthread.php?t=5437&highlight=vtable

-nt20
nikolatesla20
05-28-2004, 08:36 AM
Just curious, how did you know its MSO.DLL that does the activation, and how did you originally come upon the ILicAgent interface...

Stupid questions, but I haven't looked at many windows components like this lately.

-nt20
Nad_Af
05-28-2004, 08:30 PM
Well, I might be wrong but I don't think so. The call to the ILicAgent interface resides in a .DLL file, in a .HTML page, as a JScript code. The Activation assistant uses this code when you try to activate by telephone, I found this by debugging using SoftIce.
You can check that yourself!! :whoops:

Could anyone generate the .DBG file for me, please?

Just curious, how did you know its MSO.DLL that does the activation, and how did you originally come upon the ILicAgent interface...

Stupid questions, but I haven't looked at many windows components like this lately.

-nt20
djnz
05-29-2004, 10:04 AM
Could you tell me how to locate it (the entry) exactly, please?

InvokeHelper is a mfc function which prepares the arguments for a call to IDispatch::Invoke and processes the return value.
Think about this for a minute.
What's required to make a call to an interface method?
What would such a call look like?
Nad_Af
05-29-2004, 04:31 PM
Thanks, but I don't know much about COM programming. Can you explain more? :confused:

InvokeHelper is a mfc function which prepares the arguments for a call to IDispatch::Invoke and processes the return value.
Think about this for a minute.
What's required to make a call to an interface method?
What would such a call look like?
Solomon
05-30-2004, 06:00 AM
Try this:
COM Plugin V 1.2 by Dieter Spaar
hxxp://www.sport-und-event.de/backtrace.de/plugins.htm
Nad_Af
05-31-2004, 03:50 PM
:whoops: I don't have IDA?
Does it work within SoftIce or C/C++ itself?

Try this:
COM Plugin V 1.2 by Dieter Spaar
hxxp://www.sport-und-event.de/backtrace.de/plugins.htm
Nad_Af
06-01-2004, 02:44 PM
I have downloaded IDA, but the plugin doesn't work with MSO.DLL, it seems that nothing works with this DLL.
I just want to know how to determine the RVA of the function (DepositConfirmationId) in MSO.DLL from its Type Library (.tlb)?

After I have loaded the .EXE that uses MSO.DLL, where does the code for DepositConfirmationId reside? (In MFCO42D.DLL,
MFC42.DLL, OLE32.DLL) :thinking:
nikolatesla20
06-01-2004, 03:30 PM
The 2 links that I gave you GIVES YOU THE INFO you seek. Try reading BOTH threads to the full !

In some cases, you CANT just get the VA from the tlb, because the object might only have a dispatch interface, in which case there will BE NO VA TABLE ! In this case, you'll have to try to step thru the Invoke() routine to land in the code you seek.

READ READ READ ! I know it takes effort, but it's the only way to learn!

Thanks, but I don't know much about COM programming. Can you explain more?

You've convicted yourself here...learn MORE about COM programming then! There is plenty of info on the 'net.

-nt20
Nad_Af
06-03-2004, 12:49 AM
Well, I know that but I don't even know where the DepositConfirmationId code resides. Which DLLs to search?

The 2 links that I gave you GIVES YOU THE INFO you seek. Try reading BOTH threads to the full !

In some cases, you CANT just get the VA from the tlb, because the object might only have a dispatch interface, in which case there will BE NO VA TABLE ! In this case, you'll have to try to step thru the Invoke() routine to land in the code you seek.

READ READ READ ! I know it takes effort, but it's the only way to learn!

You've convicted yourself here...learn MORE about COM programming then! There is plenty of info on the 'net.

-nt20
nikolatesla20
06-03-2004, 09:58 AM
First you have to become familiar with the structure of IDispatch. GetIDsOfNames is part of the IDispatch Interface. Once you know the correct offset of the GetIDsOfNames routine, you can query for an IDispatch pointer, and then put a bpx on the offset from the pointer you get. This would then be a BPX on GetIDsOfNames. You can then watch for the name (it will be a BSTR or a char string) to come thru as an agrument, and then see which ID it returns.

Better yet, you could put a BPX on Invoke() and go from there..

IDispatch interface: in vtable order

(IUnknown part)

QueryInterface
AddRef
Release

(IDispatch part)

GetTypeInfoCount
GetTypeInfo
GetIDsOfNames
Invoke

If you query for an IDispatch interface (Use QueryInterface on the original object, and ask for an IDispatch interface), and you get a pointer back, then [pointer + sizeof(DWORD)*6] will be the GetIDsOfNames address. Notice the dereference !

[pointer to IDispatch + sizeof(DWORD)*6]

the value at this address will be the address to GetIDsOfNames in memory. Now you can BPX on this address, and when a program tries to call it, such as a VBScript that does any function call on the object, you should break. YOu could also alternatively set a BPX on Invoke().

If unsure, then you can always make your own simple COM object using VC++, and then debug it with Olly and watch how it works. Throw some strings in it so you can see them in the disasm, and know where you are.

-nt20


FlexLM v9 clarifications needed...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM v9 clarifications needed...
PDA

View Full Version : FlexLM v9 clarifications needed...

Aimless
05-26-2004, 12:22 AM
Okay...before we start anything, I am currently quite new to FlexLM protections (there, I said it!!).

I need help in trying to break a FlexLM protection. The actual process of breaking is going to be mine, but along the way, I need some clarifications on how FlexLM actually works. This question is one of those clarifications. Yes, I know there is a user manual, a reference manual and a programmers guide. Yes, I also know there is Crackz archive and google. However the previous guides and manuals do not give me insight to FlexLM working from basis of RCE, where as Crackz site is...well, if I am unable to understand FlexLM internal working based on RCE, then it's pretty much quite alien stuff to me. So please bear with me as a FlexLM newbie and hope that I can get certain clarificaitons. This example is specific to: uncounted, permanent and unserved licensing model. No deamons are used.

The program that I am trying to RCE has got a DLL that does the grunt work. This DLL is actually protected by DYNAMIC FLEXLM DLL (yep, the DLL was not compiled with the FLEXLM static library, but was compiled to use the dynamic Flexlm DLL). This means, that I now have a DLL that does my usual jobs and a Flexlm DLL that it dynamically calls to find out license details.

My first clarification: how it looks from above
=================================
I would like to get the basics of how FlexLM works from a bird's eye view. Let me know if the following is correct:

1. Vendor contacts Macrovision to purchase FlexLM licensing SDK
2. Macrovision sells the Flexlm SDK to the vendor at $$$
3. Macrovision also gives the vendor, his own vendor keys (these are 5 in number) and his vendor name
4. Vendor codes his own .exe or .dll file as the application exe/dll
5. Vendor uses the static flexlm library or the dynamic flexlm dll to act as its protection. If static, he links to the same during comilation/linking process, if dynamic, he needs to ensure that the dynamic flexlm dll is given in the distribution. The protection is a combination of his 5 vendor keys given to him by Macrovision, plus 2 additional encryption keys which can be of his choosing.

Please let me know if this overall process of Vendor getting Flexlm protection is correct.

My second clarification: how it really works
================================
1. The user (for simplicity sake, assume he is creating a application dll file which will use the dynamic flexlm dll) starts to code his dll (in either Visual Studio or Borland Studio)
2. In his code, he uses the API calls that are part of the dynamic flexlm dll and other miscellaneous flexlm files)
3. He compiles/links and produces the necessary dll.
4. He creates a text file (which will act as the license file) with the necessary features, expiry dates and signatures
5. He opens lmcrypt.c and enters his vendor name, his 5 vendor keys that Macrovision have provided and his 2 encryption keys which he has himself chosen
6. He then compiles lmcrypt.c into an executable file called, say, lmcrypt.exe
7. He runs this freshly compiled lmcrypt.exe on the text license file that got created. This results in the proper license file, in encrypted format, getting created.
8. He distributes his (a) application dll, (b) the flexlm dynamic dll and (c) the proper encrypted license file

Please let me know if this is correct.

My third clarification: So what are these?
===============================
1. If I have to run lmcrypt.exe on the text license file to get the correct license file, then why does some applications protected by Flexlm work with the above text files only. Why don't they also use the encrypted files? For example, a file with options such as FEATURE, permanant, HOST_ID=any etc text file is used as a license file for some flexlm protected licenses such as Intel Compilers and Vtune where as others use the encrypted format of files such as IBM Rational Rose etc. So where does it say that this app will use a text file as license and this app will use encrypted file as license?
2. In text files, you often see SIGN=12345678. How is this generated? And is this typically given by macrovision to the vendor (unlikely) or generated from compilation or running of the lmcrypt.exe on the text license file?
3. If I get to know (a) the vendor name (b) the 5 vendor keys and (c) the 2 encryption keys, can I generate a valid copy of lmcrypt.exe from the source?
4. How do I get to know the vendor name?
5. How do I know whether the software will accept the text file as license or it will have to be run through lmcrypt.exe
6. How do I get the SIGN=<how do I get this?>
7. WHen I am creating a text file or encrypted file for licensing, how do I know I have given all parameters? For example, I may be trying a perfectly valid text license or encrypted license using the FEATURE option, but it does not work. Turns out, the app also needs the PACKAGE line in the license file. How to I know that it needs the PACKAGE and other such lines?

Trust someone knowledgable and very familiar with Flexlm (Crackz comes immedately to mind) reads this and spends the time to reply. Thanks to all who reply in advance.

Have Phun
nathan
05-26-2004, 06:24 AM
You'd better start from the actual manuals ... almost all your questions can be aswered by simply reading it.

nathan
CrackZ
05-26-2004, 02:35 PM
Hiya Aimless,

An apology first of all because I think I remember losing an e-mail from you where you asked my answers to these ;-).

first clarification - all 5 correct, but depending on the FLEXlm options purchased the vendor may also have been provided with additional keys (CRO keys - for the counterfeit resistance option) or the option to generate his own set of seeds (LM_SEED1/2/3) used by the ECC (Certicom add-on).

second clarification - all correct.

third clarification - 1. not sure what you mean here, all FLEXlm licenses are standard in unencrypted readable format, any additional encryption is provided by the developer, the check out routines don't do any decrypting of the license file at all. 2. SIGN=signature (12 digits), this was introduced around v7.x or so, its a variation on the default FLEXlm checkout just computed slightly differently. In later versions this can be really long like SIGN=1234 4321 1234 ..... this is the later Certicom add-on. 3. Yes, but this setup tends now to be older versions. 4. Vendor name is passed to various FLEXlm functions (e.g. _l_36n_buff()) which you have to trace to recover seeds anyway, also through other higher level API's, as someone said above, you can find this detail in the manuals. 6. In the manuals, but for the new FLEXlm you've no hope of generating a valid SIGN. 7. Answer, you don't, I spent some time chasing down an old target wondering why it wouldn't check out, turned out they wanted a VENDOR_STRING in there, a lot of the time when I've had problems like this the FLEXlm API actually tells you the problem, a lot of other times, the applications themselves don't care, since the licensing layer returns success.

Regards

CrackZ.
CrackZ
05-26-2004, 03:01 PM
Noticed I forgot:

third clarification - 5. You might be confused here. lmcrypt.exe is the developers license generator, end-users never see it obviously ;-). Not sure what you mean by knowing whether software will accept a license file.....as I understand it targets either query a license server for a license or a license file (license servers have their own license file).

Regards

CrackZ.
Aimless
05-26-2004, 11:51 PM
Sweet. Thank you Crackz. It's good to get the cowebs beginning to get cleaned.

A couple of questions (seems a bit naive, maybe...)

1) Why should I trace all API calls from the FlexLM dlls et all (unless of course, I am trying to make a valid license). Is it not better to merely give positive responses to all calls that the app makes to the flexlm dynamic dll? Or is there something I am missing (perhaps the code from the application is encrypted and is decrypted during run-time by the flexlm dll??)

2) Also, to clarify what I requested in the lmcrypt.exe, if the files are going to be perfectly text, then why do I need to run them through the lmcrypt.exe? Unless, the lmcrypt is used only during served models? Simply put, what does that damn file do? Is it even necessary to compile the file for creating an application with uncounted, permanent and unserved model?

3) CRO, ECC, Own seed generation? *Ouch!!* I'm already quaking in my boots.

4) Finally, would you like to continue the discussion on the board or would you like to now converse via email? As per your convenience.

Have Phun
dELTA
05-27-2004, 06:36 AM
Finally, would you like to continue the discussion on the board or would you like to now converse via email? As per your convenience.
If it's all the same to you, you are of course very welcome to continue it here, so we get to keep all the nice info on the board. :)
CrackZ
05-27-2004, 03:33 PM
Hiya Aimless,

In reply briefly ;-).

1. As you say, there isn't any reason to trace the FLEXlm lmgr*.dll's used by a target unless you want a valid license (i.e. dig out the pertinent vendor information), on my page, ZiGo's dll's do just as you say and return probably nothing more than EAX=0 to the various FLEXlm functions, BlastSoft's FLEXGen does much the same but also intercepts the routines. There is a big caveat here - the ratio of developers using the FLEXlm dll's to the static library is not a favourable one now for modern software, or at least it isn't in my experience (10:1 or more against maybe), the dll's are regarded as *old* FLEXlm technology, of course FLEXlm dll or static library aside, anyone can patch the _lc_checkout() return to 0 and have it return success.....but then what happens when your target go's to checkout the demo_feature you'd really not like to have licensed ;-).

2. lmcrypt.exe is simply a convenient way for developers to generate their licenses. You fill in the license with 0 as the key, run lmcrypt.exe against it and it updates it with the correct licensing information. The pre v8 SDK's still ship with GenLic which is a more friendly UI for doing exactly the same, the only reason most people choose to build lmcrypt.exe if they can is that it supports the advanced FLEXlm options, such as old format licenses, PACKAGE/INCREMENT/ISSUER lines etc, etc. You don't have to build it to generate the very basic licenses, but some might say 'WHY NOT ;-)'.

3. The CRO option was a very poorly implemented add-on (extra sales maybe? ;-) and I think was probably just added to 'get away' from the default FLEXlm checkout; but don't scoff at the Certicom stuff ;-), no-one I know of or have seen in either the formal or informal scene has been verifiably successful against it.

4. Up to you, if you feel what you are asking is of interest to the people browsing here, by all means we'll continue here, but I'll leave that judgement up to you ;-).

Regards

CrackZ.
Aimless
05-31-2004, 05:33 AM
Hrm...therefore, continuing where we left off:

1. My application used a .dll to do its main work.
2. It also uses another .dll dynamically (a flexlm license manager .dll) to do the necessary verification, compared to the common practice of including the .dll
3. The flexlm license manager .dll checks the XXXXXXXXXXX.lic file and allows me to work or throws me out of the application (by not starting at all, with a decent message that there were no licenses found)

By discussing the above scenario with Crackz, it comes to light that if we just want to work the application (without bothering about generation of valid licenses) then we can just patch the calls that ensure that the licenses are valid. This leads to patching of _lc_checkout(). Now here are my further queries:

1) Application DLL ----> Flexlm DLL -----> License File (.lic)
2) Where should the point of attack ideally be:
....a) The Application DLL?
....b) The FlexLM DLL?
....c) The License File (.lic) - highly unlikely as we are not bothered with valid licenses

My hunch tells me it should be the Flexlm DLL, but Crackz can inform me of my error if its not so. Also, I have tried the same and some interesting queries arise:

1. If Application DLL -----> Flexlm DLL, then there have to be exports in the Flexlm DLL (which there are, by ordinal, of course) and subsequent imports in the Application DLL (which is a holy mess of calls, getting me confused, but strangely the IAT does not show ANY import from FlexlmDLL. Huh? I thought that the Application DLL calls some function (by name, by ordinal, by whatever,) but the import table should contain the FlexlmDLL name right? wrong. The Applciation DLL does not contain the Flexlm DLL name.) My question is: Is this some new form of obfuscation? or simply renaming of the FlexLM dll (note the FlexlmDLL is not called as lmgr8xxx.dll, but instead the correct name is UnManagedFlexlm.dll, wow!)

2. If I need to ensure that _lc_checkout() returns 0, then obviously, I first need to find the _lc_checkout() function. I assume (I know, but better to confirm) that the _lc_checkout() function resides in the FlexLM DLL and not the application DLL. Now, there is no .LIB file (library file) or and .OBJ file (object file) in the FlexLM 9.2 SDK (nope, it *is* indeed complete. No missing files). So when you say (Crackz, its for you) that you can create the lmgr8xxx.lib and open it in IDA, does that mean you first need to compile it? Or for that matter is there any compilation needed in any file in the SDK for me to actually find the _lc_checkout() routine? (I *know* you must have mentioned in it one of the tutorials, but I just want to reconfirm). I'm trying to currently follow your steps from 2004, but am getting confused by NOT finding the necessary files in the SDK readymade(its a different story if they have to be compiled) to open in IDA and generate signatures from. So, what files do I have to compile to get the .LIB/.OBJ/.PDB etc. file that will enable me to open it in IDA and generate signatures so that I can make out where _lc_checkout() really is. Crackz, if you feel however, that's this method is sufficently examined and detailed in the 2004 essay on Flexlm from you, and not worth repeating again, just tell me so and I'll try to re-read that essary again.

3. Hmmm..never thought of invalid license/patched .dll neverthless, can actually screw up the DEMO mode for that application. My app dll has a demo mode and a full mode, protected by the Flexlm lic. So assuming I manage to find _lc_checkout(), return 0 so that its always positive, what will be the result. Will I run the full version or the Demo version? And how is the precedence determined?

Whew! quite a lot of questions. Crackz, thanks for taking me so far. I've cleared up lots of doubts about the internal workings from your posts. Trust you'll answer this one as well.

Have Phun.
CrackZ
05-31-2004, 03:48 PM
Hiya Aimless,

1. You need to work out whether UnManagedFlexlm.dll is :

i). Really just a lmgr****.dll in disguise (try lmtools and see if it reports a FLEXlm version)
ii). A dll with the FLEXlm static library inside, or
iii). A dll acting as simply a forwarding wrapper to lmgr****.dll which does the real work.

Point of attack should always be the _lc_checkout() routine, depending on the above scenario that might mean you have to patch both or only one of your DLL's.

2. Point of clarification. I used lmgr.lib (from the SDK) as a starting point in IDA for FLEXlm applications protected with the static FLEXlm library, since lmgr.lib is what is linked against applications which use FLEXlm this way, essentially you load up your target application and lmgr.lib and then start labelling ;-). The reason I did this was mainly that when I generated signature files for use in IDA from lmgr.lib, several functions (_l_sg() and others, notably the top layer API _lc_checkout() etc, etc) got missed, the FLEXlm developers know this and obfuscate their code accordingly to produce just this effect.

_lc_checkout() should be clearly visible inside the FLEXlm lmgr****.dll as an export. Have a re-look at the 'muster' part of the FLEXlm 2004 page.

3. The precedence depends on which feature the developer tried to checkout first, if he's read his FLEXlm manuals, checkout success of the demo means you'll never checkout the full version. On the other hand he might try checking out the full version and then simply assume you must be a demo user. You'll just have to test your implementation to see which it is.

Regards

CrackZ.
Aimless
06-02-2004, 12:56 AM
Hrrrr.....if only the vendors would give everything in one directory...

Still trying to compile the lmgr9a.c and getting reports of missing dependencies...but I'm getting there.

The good news is that the unmanagedflexlm.dll is actually the FlexLM dll. The lmutils reports it as Flexm v9. Good. So I'm just gonna break the checkout() func in this dll and give it a good 0 in the return. (It;ll be fun to watch the demo mode giving wierd results, heh!)

Hrrrr...still no compilation....trying to find some .h files in the source..I hate the .mak file....grrr!

This looks like it'll take a long week...Weekly updates of whether I've been successful in compiling the same will be put up on this notice board (aww..just kidding)

Have Phun
bobbobbins
06-07-2004, 09:00 AM
Hi
I have a target which uses flexlm 9.2. I found the checkout functions using the library from an older SDK (8.?). Anyway after forcing _lc_checkout() to return 0 my application just crashes.
Is there anyway I can snoop the assembly to find the correct SIGN ? and enter this into the license file? Seems like the protection is based somehow on the hostid of my computer.
Thanks
whyIII
06-08-2004, 08:18 AM
Hi
I have a target which uses flexlm 9.2. I found the checkout functions using the library from an older SDK (8.?). Anyway after forcing _lc_checkout() to return 0 my application just crashes.
Is there anyway I can snoop the assembly to find the correct SIGN ? and enter this into the license file? Seems like the protection is based somehow on the hostid of my computer.
Thanks

Maybe your target has CRC check
bobbobbins
06-08-2004, 01:29 PM
I have tried a few things including returning 0 form _lc_checkout in a live debug session with SI. There is no CRO added protection since the SIGN= requires only 12 characters. From reading CrackZ's latest tut it is doing the new style checkout authentication just like his GerbT**l target. I'm going to try his technique of forcing it to do an old style checkout. I'll let you guys know what happens.
Oh ......how do you get by the checksum check?
redsk_y
06-08-2004, 03:03 PM
Your target could check the presence of a VENDOR_STRING that
usually cointains some other usefull information...
Another thing: verify if it is called lc_authorize (or something like this, I don't remember well the name), this is another check.

regards,

rs
CrackZ
06-09-2004, 04:34 PM
Hiya,

Just a quick few additional thoughts.

1. If your sure the target will accept just a SIGN=12 digits attribute, try a fake license with any 12 digits, run it through _lc_checkout() and see what it returns, if you get -8 as an error you ought to be able to generate licenses by using an older SDK version and plugging in vendor keys/derived encryption seeds. If you get another error look up the define in lm_client.h (think thats the name), might be you get LM_PUBKEY_ERR.

Caveat, if the target uses some sort of vendor defined checkout filter, then start reading up on those (lc_set_attr()).

2. I've seen a few targets now that really dislike direct patches to _lc_checkout(), both of them crashed with nasty null pointer errors, a few of them used a very simple 'check the file for tampering' routine, one other required additional things in the license line and refused to run without them.

Regards

CrackZ.
SPMTRP
06-14-2004, 01:19 AM
Not sure if this is appropriate, but I found it to be quite helpful (not enough to help me attack mine, though).

h**p://dev.csdn.net/user/zxg32 - 7 part analysis based on the source code the guy had available to him.
bobbobbins
06-22-2004, 02:57 PM
Hi,
I'm still getting stuck with my flexlm 9.2 protection. Seems like I get a different job structure every time I run the program and hence different seeds. Is that supposed to happen?
NOP
06-23-2004, 10:41 AM
Does have anybody right FlexLM 9.2 or 9.x signature file for IDA ? I couldn't compile it ;o(
Aimless
06-25-2004, 04:00 AM
Does have anybody right FlexLM 9.2 or 9.x signature file for IDA ? I couldn't compile it ;o(

Hrrr.....!!!! Welcome to the club buddy!

I'm using VS .NET and the appy is giving me .h not found error after .h not found. Even though the .hs are all there! And the paths are also correctly changed in the files.

But what's life without challenge. For those who are following this thread...sorry, but I am *yet* to compile the file. *Sigh*

Have Phun
bobbobbins
06-25-2004, 11:50 AM
I got success at last. My app is now working. Thanks for everyone's help!!

Why don't you guys use an earlier flexlm sdk. I used 8.0 lmgr.lib and it still helped me track down the relevant funtions for flexlm 9.2 in IDA using Crackz' tutorial.
NOP
06-25-2004, 12:46 PM
I'am using Mingw ... yes 8.x is ussefull but .. continue trying

BtW> Sorry 4my bad english iam only human ;o)


Simple crackme, find solution without patching...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Simple crackme, find solution without patching...
PDA

View Full Version : Simple crackme, find solution without patching...

prdx_LT
05-26-2004, 11:42 AM
It's pretty simple crackme, just find what he wants from you and try to not patch it...
prdx_LT
05-27-2004, 06:41 AM
why u r so inactive? :)
hobgoblin
05-27-2004, 08:27 AM
The necessary text is http://cracking.tinkle.lt, and the necessary file is a .reg file. :cool:

hobgoblin
prdx_LT
05-28-2004, 02:55 AM
The necessary text is http://cracking.tinkle.lt, and the necessary file is a .reg file. :cool:

hobgoblin

As i said it's pretty simple :) but i think that u don't just looked source ;)


attachments...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > attachments...
PDA

View Full Version : attachments...

MEPHiST0
05-27-2004, 05:17 PM
hey :X

just wondering if the attachment button is broke? :)
clicking on it and nothing happens..

was gonna up a tut (html) small
doug
05-27-2004, 05:27 PM
hey :X

just wondering if the attachment button is broke? :)
clicking on it and nothing happens..

was gonna up a tut (html) small

works fine here. Using Mozilla Firefox/0.8

html isn't in the list of valid file extensions.

Maximum file size: 2.00 MB
Valid file extensions: bmp doc gif jpe jpeg jpg pdf png psd txt zip
JMI
05-27-2004, 05:32 PM
MEPHiST0:

Do NOT post any tuts here which identify ANY commercial software. Acknowledge that you clearly understand this rule.

Regards,
MEPHiST0
05-27-2004, 07:25 PM
well the html has images and stuff..
so its in a .zip file..

JMI...
you mean dont display the name of the app, on the forums that im writing a tutorial for? or just dont release it on these forums if it involves commercial software..?

sorry just makin sure i dont break 'the rules' lol :P
Woodmann
05-27-2004, 08:16 PM
Howdy,

If you want to post your tutorial in the forums, please do not include any names of the software unless it is your own. You can post anything that is generic as far as protections are concerned.

If you want to post it in the essay's/tutorial section, send it to me and I will review it.

Woodmann
akimp3
05-28-2004, 02:32 AM
Howdy,

If you want to post your tutorial in the forums, please do not include any names of the software unless it is your own. You can post anything that is generic as far as protections are concerned.

If you want to post it in the essay's/tutorial section, send it to me and I will review it.

Woodmann
Hi

Woodmann could you please tell me where is this section
because i can not see it.

thanks in advance

bye
evaluator
05-28-2004, 02:47 AM
me also..:)
Woodmann
05-28-2004, 05:21 PM
Oh Evaluator.........You must know where the essay's are located :p

For all of you who have never spent any time at the original site, here is your link, you lazy bastards :devil:

http://66.98.132.48/fravia/what_new.htm

Woodmann
akimp3
05-29-2004, 12:59 PM
Oh Evaluator.........You must know where the essay's are located :p

For all of you who have never spent any time at the original site, here is your link, you lazy bastards :devil:

http://66.98.132.48/fravia/what_new.htm

Woodmann
Hi

Woodmann I already know this page but it was not updated for a long
time so i thinked it was dead.(I had also send you three tutorial on ppc
cracking but you did'nt upload them there).

Thanks
esther
05-29-2004, 01:20 PM
>you lazy bastards :devil:

:whoops: LOL
Woodmann
05-29-2004, 03:54 PM
Howdy,

The essay page isn't dead, it just lacks contributions.

ak, I dont recall every getting any essay's from you.
If anyone has sent me an essay that hasn't been posted,
send them to me again and I will post them.

Woodmann


Change control properties in VC++
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Change control properties in VC++
PDA

View Full Version : Change control properties in VC++

!oz!
05-28-2004, 05:14 AM
Hi,

I'm trying to find how change property values for controls, like menu items, buttons, etc... :hmm: Does anyone know how to change properties in visual controls from assembler level ? Maybe some controls have their own declarations in hex.... :thinking:

regards
omega_red
05-28-2004, 10:02 AM
Which properties exactly?
nikolatesla20
05-28-2004, 12:19 PM
If you are simply trying to edit dialog type controls, you should be able to use any resource editor (Resource hacker, EXEScope) to do it.

-nt20
!oz!
05-28-2004, 03:36 PM
It is a submenu item (like Help/About), and it's property Enabled is set to false, so it is grayed - I cannot edit it with resource editor. I've tried to enable it with WindowJuggler in Olly, but it is hard to locate, it gaves me only WndHandle something like 0x1202B4, WndID : 0x0 and Class Name : #32768. :(

regards


Interview...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Interview...
PDA

View Full Version : Interview...

bflash2k
05-28-2004, 07:25 AM
This is a link to Nicolas Brulez's interview on a french website. Sorry if it is in french :whoops:

h**p://w*w.secuobs.com/news/20052004it_nbrulez.html (h**p://w*w.secuobs.com/news/20052004it_nbrulez.html)

Interesting...
nikolatesla20
05-28-2004, 08:33 AM
hey, good article.

Maybe some day they will interview the guy who cracked the challenge (was there one?) and get the opposing viewpoint.

-nt20
br00t_4_c
05-28-2004, 01:16 PM
heh -"smashing le pile pour le fun et le profit". The fact that the guy who is in large part responisble for Armadillo has no formal education to speak of makes me feel all warm and fuzzy. :smug:


Softice and LCD Flatscreen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Softice and LCD Flatscreen
PDA

View Full Version : Softice and LCD Flatscreen

arieri
05-28-2004, 08:59 AM
Hi

Maybe a stupid question but I am considering buying a new monitor and
wonder if anyone have tried softice on a lcd screen. Does the softice window appears clear and good readable on the screen??

regards
arieri
naides
05-28-2004, 09:26 AM
It works OK in a Laptop.
Centrino, The Mobile Cracking technology!! :D
crUsAdEr
05-28-2004, 11:40 AM
no problem here :)
everything works fine :)...
arieri
05-28-2004, 06:14 PM
thanks for your replys

arieri
Pyrae
06-10-2004, 11:29 PM
Well, the screen itself even seems a bit clearer on TFTs (Acer laptop & Acer AL1731m).
What annoys me a little, is a delay (perhaps 0.3 secs) before the softice window pops up, but thats quite subjective...


How do you pronounce "IDA"?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > How do you pronounce "IDA"?
PDA

View Full Version : How do you pronounce "IDA"?

disavowed
05-28-2004, 10:42 AM
Most of us use IDA Pro. How do you pronounce "IDA"?
MEPHiST0
05-28-2004, 11:14 AM
err i call it Interactive disassembler :)
Kayaker
05-28-2004, 11:14 AM
I spell it, "eye-dee-ay"

I know someone who pronounces it, "eye-da"

When we chat verbally, I keep wondering who this Ida person is who's name keeps coming up...
naides
05-28-2004, 12:30 PM
I spell it, "eye-dee-ay"

I know someone who pronounces it, "eye-da"

When we chat verbally, I keep wondering who this Ida person is who's name keeps coming up...

I'd say "eye-da"

I think Ilfak is doing a word game with Lady Lovelace, Ada Byron, which I think is the woman portrayed in the Icon of the GUI version.

http://www.agnesscott.edu/lriddle/women/love.htm
Iwarez
05-28-2004, 01:02 PM
Locally I would pronounce it as ieh-dah, in english I pronounce it eye-da. It just depends on the language you speak ;)
Woodmann
05-28-2004, 05:52 PM
Not to split hairs with this but,
Since IDA represents the first letters of each word, it should be pronounced
eye-dee-aye.

eye-duh :stunned: is a formal name that would be written as Ida.
Maybe Ilfak will tell us.

Woodmann
evaluator
05-28-2004, 11:44 PM
thiz poll is for Ingech pronouncerz.(define)
esther
05-29-2004, 01:39 AM
This poll is to teach you Ingech.
I call it I D A
or I DA
evaluator
05-29-2004, 06:03 AM
why "or I DA"?

***
hey..Duddieman..
esther
05-29-2004, 11:35 AM
>hey..Duddieman..

Don;t call me names I ain't him!!!!

I DA sounds nice
Woodmann
05-29-2004, 03:25 PM
"or I DA"

They make frozen potato products :devil:

Woodmann
lifewire
05-30-2004, 05:58 AM
I pronounce it in my motherlanguage which sounds in english somehow like:

ee - dah (with the ee as in 'geek') ;)
dELTA
05-31-2004, 06:58 PM
I pronounce it "ee-dah" too, just like lifewire, because it is the pronounciation of that name in my mother language too. Is your mother language by any chance Swedish, lifewire? :)
ByteZero
05-31-2004, 11:04 PM
I would pronounce it "eye-dee-ay".
lifewire
06-01-2004, 04:41 AM
no dELTA, it is dutch :) (but I have to say that dutch doesn't differ very much from swedish)
mike
06-02-2004, 07:08 PM
The girl in the IDA logo is obviously named "Ida", but does anyone know who it is?
dELTA
06-02-2004, 07:23 PM
An earlier post in this thread by naides suggested that it might be Ada Byron / Lady Lovelace. I guess there is at least some resemblance, and that woman also has some Belgian connections (the home country of Ilfak / IDA Pro):

http://www.mathematicianspictures.com/Mathematicians/Lovelace.htm
disavowed
06-03-2004, 06:59 PM
from the horse's mouth: http://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=4;t=000085
naides
06-03-2004, 09:10 PM
from the horse's mouth: http://www.datarescue.com/ubb/ultimatebb.php?ubb=get_topic;f=4;t=000085

Babbage's lover, the first code analyst, Ada Lovelace certainly belongs in IDA's logo . . .
mike
06-03-2004, 09:50 PM
Babbage's lover, the first code analyst, Ada Lovelace certainly belongs in IDA's logo . . .
Babbage may have done more to hold back the development of computing machines than encourage it: www.thomasfowler.org.uk
http://www.mortati.com/glusker/


App better than ring-0?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > App better than ring-0?
PDA

View Full Version : App better than ring-0?

Aquatic
05-28-2004, 11:49 AM
Would it be possible to have an app that was higher authority than ring0?

I know ring0 is the Kernel of the OS, so it would have to be outside the OS even. Maybe you could have something that loaded before the Windows kernel? Or even incorporated into the BIOS chip.

This would be one level better than a kernel-mode debugger.
omega_red
05-28-2004, 01:53 PM
Ring0 is the most privileged CPU mode, so you can't really achieve higher control over hardware/operating environment. Look at SoftIce, it can control all of the OS if loaded before it, but theoretically some other ring0 code can disable/damage it. Hardware debugger is the way to go if you don't want to interfere with the debugged software :)
Aquatic
05-28-2004, 06:10 PM
what does a hardware debugger look like?

Anyone ever use one?
Aquatic
05-28-2004, 06:15 PM
Check out this integrated BIOS debugger: http://www.gensw.com/pages/prod/bios/debug.htm
evaluator
05-29-2004, 12:11 AM
as you need to know, (Intl) processors has 4 mode for execution:
Real, Protected, Virtual..
IV mode is your pre-last chance:)

RTM, because that is what is & not more than is.

but sure, processor makers have other tip of processors,
on which they build-debug new architects.
bilbo
05-31-2004, 06:35 AM
Check out this integrated BIOS debugger: http://www.gensw.com/pages/prod/bios/debug.htm

Nice!
Another solution could be the debugging version of Bochs (which by the way is open source!).
Regards.
Bilbo


ImpRec Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ImpRec Question
PDA

View Full Version : ImpRec Question

jingjang
05-28-2004, 09:01 PM
Hi..i noob in unpacking files..if read Labba tutorial and others oh how to unpack. Im stuck with trying to recreat IAT using Imprec. All the tutorials i read says that 'we have to click on the 'IAT autosearch button' and change the RVA size to 1000. then get imports and fix the invalids.

However when i click 'IAT autosearch' button it says that 'Could not find anything good at this OEP' does this mean i need to put the spesific OEP for the programme? (which i think is the case) if so can anyone give me a link to a tutorial on how to get the OEP? coz i been searching and and reading and i still cant recognize the OEP. My understanding is that it is where the programe starts? but sometimes the programes gives fake OEP and therefore we need to search for examplee 11bytes be4(in the case in labba's tutorial.) why 11?

Thanks for your help. =)
comelysouthchin
05-29-2004, 01:48 AM
1.first you must get the correct OEP
2.then you can use importrec to get iat .
jingjang
05-29-2004, 06:31 AM
1.first you must get the correct OEP
2.then you can use importrec to get iat .

But when using imprec with other programme like the prog in Labba's tuttorial, this msg did not show even though i was using the defaults and just straight hit the "IAT autosearch". Only with the programme im trying to unpack it display "'Could not find anything good at this OEP'
jingjang
05-29-2004, 11:08 AM
i tried again with another prog protected wif ASPR 1.23 and no error msg came. Only with the programme im trying to unpack the "could not find anything good on this OEP'.

Wondering whats wrong, i tried use the FEUERRADER [AHTeam] tool to unpack it and find out wat i did wrong. Few hours i left it and it just like anyalizing the file and nothing else. So i guess something is wrong.

Double check wheter it was ASPR 1.23 protected and it was.


VirtualAllocEx equivalent on win9x?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VirtualAllocEx equivalent on win9x?
PDA

View Full Version : VirtualAllocEx equivalent on win9x?

doug
05-28-2004, 10:03 PM
in the PSDK, they mention that VirtualAllocEx is included in Windows XP, Windows 2000 Professional, and Windows NT Workstation 4.0

I believe in win98 kernel32 Exports that function, but returns status_not_implemented.

so is there an equivalent to VirtualAllocEx in win9x?
What do you guys do when you want to get memory into another process' space?
Kayaker
05-28-2004, 10:37 PM
Hi

I think Elicz's Elirt.dll is the classic way of emulating CreateRemoteThread, VirtualAllocEx, VirtualFreeEx, OpenThread for Win9x.

It used to be at
http://www.anticracking.sk/EliCZ/export.htm
doesn't seem to be listed separately now but may be incorporated into one of the other packages. Ah, I'll just up it here...

Personally what I used to do was a CREATE_SUSPENDED dll injection along the lines of Iczdump, then you have the free access to the process' memory.

K.
doug
05-28-2004, 10:53 PM
Thanks kayaker.

Also, I just found the following:

hFileMapping = CreateFileMapping((HANDLE) 0xFFFFFFFF, NULL,
PAGE_READWRITE|SEC_COMMIT, 0, dwSize, NULL);
if(hFileMapping != NULL)
lpData = MapViewOfFile(hFileMapping, FILE_MAP_ALL_ACCESS, 0, 0, dwSize);

with a note mentionning that under Windows 9x the address above 0x80000000 is shared by all processes and the CreateFileMapping call above allocates a block of mem in that zone. (tested and it works)
evaluator
05-29-2004, 12:15 AM
for W9x, instead of VirtualAllocEx you can use VirtualAlloc in upper memory:

if W9x
then

VirtualAlloc(nil,size,MEM_COMMIT+SEC_COMMIT,PAGE_EXECUTE_READWRITE);

if NT vp:=VirtualAllocEx(ph,nil,size,MEM_COMMIT+MEM_TOP_DOWN,PAGE_EXECUTE_READWRITE);


Setting break point at the RET
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Setting break point at the RET
PDA

View Full Version : Setting break point at the RET

jingjang
05-29-2004, 05:28 AM
In labba's tut it says set a break point at the RET

00FF3A2C 3100 XOR DWORD PTR DS:[EAX],EAX (where we stop..so set break here? is this RET?)00FF3A2E 64:8F05 00000000 POP DWORD PTR FS:[0]
00FF3A35 58 POP EAX
00FF3A36 833D B07EFF00 00 CMP DWORD PTR DS:[FF7EB0],0
00FF3A3D 74 14 JE SHORT 00FF3A53
00FF3A3F 6A 0C PUSH 0C
00FF3A41 B9 B07EFF00 MOV ECX,0FF7EB0
00FF3A46 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
00FF3A49 BA 04000000 MOV EDX,4
00FF3A4E E8 EDD0FFFF CALL 00FF0B40
00FF3A53 FF75 FC PUSH DWORD PTR SS:[EBP-4]
00FF3A56 FF75 F8 PUSH DWORD PTR SS:[EBP-8]
00FF3A59 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
00FF3A5C 8338 00 CMP DWORD PTR DS:[EAX],0
00FF3A5F 74 02 JE SHORT 00FF3A63
00FF3A61 FF30 PUSH DWORD PTR DS:[EAX]
00FF3A63 FF75 F0 PUSH DWORD PTR SS:[EBP-10]
00FF3A66 FF75 EC PUSH DWORD PTR SS:[EBP-14]
00FF3A69 C3 RETN
Fake51
05-29-2004, 06:59 AM
1. Learn asm
2. If step 1 fails, learn asm
3. If step 2 fails, learn asm
4. If step 3 fails, learn asm
5. If step 4 fails, learn how to read
6. If step 5 fails, admit that you're a complete failure and quit the scene
7. Study the source code that you rip. Particularly this line:

00FF3A69 C3 RETN

Anything in that line resembling a RET? ANYTHING AT ALL?

Fake
sonkite
05-29-2004, 11:07 AM
1. Learn asm
2. If step 1 fails, learn asm
3. If step 2 fails, learn asm
4. If step 3 fails, learn asm
5. If step 4 fails, learn how to read
6. If step 5 fails, admit that you're a complete failure and quit the scene
7. Study the source code that you rip. Particularly this line:

Anything in that line resembling a RET? ANYTHING AT ALL?

Fake

Your so nice with the newbies. :)
Fake51
05-29-2004, 11:13 AM
Your so nice with the newbies. :)

Thank you. I take great pride in being sarcastic and arrogant.

Fake

Ps. It seems to me that to qualify as a newbie, one should be capable of at least some independent thought.
jingjang
05-30-2004, 06:03 AM
00FF3A2C 3100 XOR DWORD PTR DS:[EAX],EAX
00FF3A2E 64:8F05 00000000 POP DWORD PTR FS:[0]
00FF3A35 58 POP EAX
00FF3A36 833D B07EFF00 00 CMP DWORD PTR DS:[FF7EB0],0
00FF3A3D 74 14 JE SHORT 00FF3A53
00FF3A3F 6A 0C PUSH 0C
00FF3A41 B9 B07EFF00 MOV ECX,0FF7EB0
00FF3A46 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
00FF3A49 BA 04000000 MOV EDX,4
00FF3A4E E8 EDD0FFFF CALL 00FF0B40
00FF3A53 FF75 FC PUSH DWORD PTR SS:[EBP-4]
00FF3A56 FF75 F8 PUSH DWORD PTR SS:[EBP-8]
00FF3A59 8B45 F4 MOV EAX,DWORD PTR SS:[EBP-C]
00FF3A5C 8338 00 CMP DWORD PTR DS:[EAX],0
00FF3A5F 74 02 JE SHORT 00FF3A63
00FF3A61 FF30 PUSH DWORD PTR DS:[EAX]
00FF3A63 FF75 F0 PUSH DWORD PTR SS:[EBP-10]
00FF3A66 FF75 EC PUSH DWORD PTR SS:[EBP-14]
00FF3A69 C3 RETN

yea 00FF3A69 C3 RETN does look like ret.... the thing is i just wanna make sure coz...they say put break at ret...so was thinking wheter should click on 00FF3A69 C3 RETN and f2 or...f2 at 00FF3A2C 3100 XOR DWORD PTR DS:[EAX],EAX
... p/s i dont mind sacarsm =) its all in the process of learning
Aimless
05-30-2004, 11:57 PM
Hi, welcome to the board, and ignore most of the newbie flames, you'll get that often. However, its assumed that you have some working knowledge of assembly. No programming skills necessary, just assembly reading skills.

A good idea might be to go to the Intel site and get the instruction reference manual. Straight from the horse's mouth. Look up the RETURN instruction. Note that in assembly translation from binary to assembly, one instruction can have different meaning, different opcode and different representation.

RET
RETN
..etc are all different "variants" of the return instruction. How did I know this? Simple, its mentioned in the intel instruction reference manual. You might try getting the one for Pentium IV rather than the 64-Bit Itanium one, though.

Mostly, try to get an idea of what the author of the tutorial is trying to get across. Following the tutorial blindly will lead only to that program being cracked and leave you frustrated because you did not master the rudimentary basics. A good idea might be to also add the Windows API help file( you'll find it scattered all over the net. Its. 21 MB) This'll spare you asking what the Windows API does, what parameter is passed, what is returned etc.

But most of all, enjoy the game. Don't worry if things do not come out correct the first time. We are here on the board for that. But make sure you have worked on the problem you are solving and have something to show us that you were indeed working on it.

A good idea might be to try cracking Winzip versions 5/6/7 or MIRC versions 5/6. Try going after time-based protections then. Leave the crackmes and the keygenmes for now. They almost always offer no good experience.

Have Phun
jingjang
05-31-2004, 04:00 AM
cheers mate ;)


How do you bpx on a class method??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How do you bpx on a class method??
PDA

View Full Version : How do you bpx on a class method??

Jacques
05-29-2004, 06:12 PM
Greetings all,

I posted this question a few weeks ago now... lots of people read it, but there were 0 replies. (I suppose that means that it was either not an easy question, or it's so silly nobody bothered to reply. :-) Anyways, I thought I would try again cause I'm still stuck:

I have been using SoftIce for a few months now, but there is one thing that I can't figure out and haven't found any mention of in the documentation or any tutorial. The question is:

How do you set a breakpoint on a class method?

More specifically how do you set a breakpoint on a custom method like "MyClass::MyMethod()" or an MFC method like CString::Format()?

I am certain that the symbols are loaded, and I can see "CClass::MyMethod" in the .nms file, so I don't think it's that. If I manage to find the location for "MyClass::MyMethod()" in the Softice code window, then I can set a breakpoint by double clicking on the label in the code window... but this is hardly a practical way of doing so.

My guess is that the problem has something to do with C++ name mangling for class methods... but I don't know how to proceed from here.

Anyone have any ideas?

Thanks,
Jacques
naides
05-29-2004, 08:24 PM
Greetings all,

Anyone have any ideas?

Thanks,
Jacques

I am not sure I understand what you want to do.

Do you have high level information like CString::Format() method is used in such and such situation? are you debugging an app in which you have source code available, which may make such a question relevant?

The typical work that goes on here happens in code that has been stripped from symbols, debug information, optimized, and not unusually encrypted and obfuscated, all of which make locating the code of a high level method unfeasible or perhaps unnecessary.

IDA can recognize typical "signatures" of common use methods in libraries like MFC and label them in the dissasembly accordingly, but this may not be what you want.
Can you provide an example of the problem you want to solve??
Jacques
05-29-2004, 11:22 PM
I am not sure I understand what you want to do.

Do you have high level information like CString::Format() method is used in such and such situation? are you debugging an app in which you have source code available, which may make such a question relevant?

The typical work that goes on here happens in code that has been stripped from symbols, debug information, optimized, and not unusually encrypted and obfuscated, all of which make locating the code of a high level method unfeasible or perhaps unnecessary.

IDA can recognize typical "signatures" of common use methods in libraries like MFC and label them in the dissasembly accordingly, but this may not be what you want.
Can you provide an example of the problem you want to solve??

Hi. First, here are the answers to your questions:

1) I can't think of anything special about the situation.

2) I do not have source code available, only what IDA provided.

3) I pulled "MyClass::MyMethod()" and CString::Format() out of the air as examples of a class method implemented by the developer, and a standard class method that is part of MFC.

I understand the type of reversing work that happens here, and I was doing something similar. I should also clarify that I mis-spoke in my initial post, I am not stuck in the sense that I can't accomplish my objective... that was resolved weeks ago. I am stuck on this in the sense that it's bugging me... I also don't understand why I can't say "bpx CString::Find" or "bpx CDialog::OnInitDialog".

I did use IDA to disassemble the code in question, and it was IDA that provided the following at the top of the function disassembly:

public: unsigned char __thiscall CVerifyI::VerifyInstallNmbr(char const*) const
public ?VerifyInstallNmbr@CVerifyI@@QEEPBD@Z
?VerifyInstallNmbr@CVerifyI@@QEPBD@Z proc near

A few lines down there was an IDA generated jmp label: loc_40003278

I could not break on VerifyInstallNmbr() no matter what I tried, but breaking on loc_40003278 worked as expected.

After generating the .nms file from IDA, and loading and translating it in the Symbol Loader, VerifyInstallNmbr() show up as (in the Softice code window):

CVerifyI::VerifyInstallNmbr(char

(Not a typo, the label ends after the 'r')

So the questions are:
- Is it possible to say "bpx VerifyInstallNmbr" in some fashion?
- Is the label trucation messing up Softice?

In the more general case, why does "bpx CString::Find()" not work? Is it because Softice can only determine the mangled C++ name and not the developer friendly name because I have no .nms file for MFC? Or maybe this is where ordinals come in?

I have probably confused things even more... thanks for your patience.
Jacques
Kayaker
05-30-2004, 01:48 AM
Hi

If you break in the context of the program and type SYM, does your function and address show up, along with all the other nms symbols? In theory, that symbol name should be the one you can use in a breakpoint. If it doesn't, maybe you can simplify and undecorate it in IDA without the :: or brackets and try again.

K.
Jacques
05-30-2004, 11:46 PM
Hi

If you break in the context of the program and type SYM, does your function and address show up, along with all the other nms symbols? In theory, that symbol name should be the one you can use in a breakpoint. If it doesn't, maybe you can simplify and undecorate it in IDA without the :: or brackets and try again.

K.

Hi Kayaker,

Thanks for telling me about the SYM command, that's very useful... I definitely won't be forgetting that one.

The function does show up in the list produced by SYM in the same truncated form as in the code window:

CVerifyI::VerifyInstallNmbr(char

I was about to try your second suggestion (renaming/simplifying the function name in IDA) when I noticed that perhaps I hadn't chosen the correct options in IDA when generating the MAP file. The three checkbox options for deciding what to include when generating the map file are:

- Segmentation information
- Autogenerated names
- Demangle names

Only the first one is checked by default, so I always used to check the other two as well because it made sense to include the autogenerated names and to demangle the names.

I generated a new map file with "Demangle names" UNchecked, with the hope that this option was messing up the class::method symbols. Loaded the new .nms file in Softice, and the symbol is fixed! It is now:

CVerifyI::VerifyInstallNmbr

and simply typing "bpx CVerifyI::VerifyInstallNmbr" works just fine.

Thanks a lot for your help!

Jacques.
Kayaker
05-31-2004, 12:05 AM
Hey, glad it worked. Thanks for your explanation as well, that's definitely useful to know.

Cheers,
Kayaker


Olldbg and Symbol Files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Olldbg and Symbol Files
PDA

View Full Version : Olldbg and Symbol Files

br00t_4_c
05-29-2004, 06:24 PM
Hey all,

Quick question. I am working on a target whose main protection routines reside in a COM type library. Now, I was directed to a rather ancient tool on MSDN by Matt Pietrik that generates a .map file for the lib and I wondering if anyone was aware of a utility that will take a type library and produce a .pdb (or even a .dbg) symbol file?

I thought maybe I could feed the .map file to softice or ida to generate a .pdb but this does not seem to be doable? :confused:

Also, does anyone know of any good tutorials on loading debugging sybols in to Ollydbg, I tried the olly users forum but the discussion of these issues is kind of sparse. (see: hxxp://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=679, etc...) I believe that Olly should be able to resolve the symbol info in a .pdb file, but I've had no success to date...

Any assistance would be greatly appreciated.

Thanx :D
JMI
05-29-2004, 08:30 PM
br00t_4_c :

What happened to the requirement that one do one's own searching HERE before asking a question? Recognizing that pdb is only three letters, if you had tried the "Search" button and entered "pdb*" (without the quotes) you would have found threads with facinating titles, such as:

NTice.sys Patch for DriverStudio v3.x,fix problem of Symbol Loader not breaking

SoftIce Symbol Retriever - Getting PDB Files aka Symbols

and many others with references to pdb files. A similar search using "com debugging" would get you additional information on COM issues. How about helping yourself to those threads and then ask for help.

Regards,
br00t_4_c
05-29-2004, 11:38 PM
With all due respect JMI, I'm wondering if you even read my post before dismissing it as an inane and ill-considered question? I am asking a very specific question about the conversion of a .map file to .pdb format and subsequently how to properly load the symbols into Ollydbg in order to more effectively debug a COM type library. Alas the use of symbol files in Ollydbg seems to be a poorly documented topic and I will gladly direct you to three or four unanswered threads on the Ollydbg users forum that attest to this fact. I was actually directed to a very useful resource on COM debugging by information contained in another posting on this forum :yay: , but unfortunately it left me with new questions. It's all well and good to generate softice symbol files with nsym, but I highly doubt that said files will be of any use to me while debugging in Olly. Perhaps (entirely possible) I am gravely misinformed. If so, then flame away :thinking: Otherwise I think the question is legit and I would appreciate some thoughts on the matter.

Regards... nay... warm regards,

br00t_4_c
JMI
05-30-2004, 04:26 AM
br00t_4_c:

"With all due respect br00t_4_c" we have this problem "all the time" and it has to do with the simple fact THAT I READ YOUR POST MORE CAREFULLY THAN YOU APPARENTLY DID. You have a thought process IN YOUR MIND which we have no access to. We are forced to deal with WHAT YOU WRITE in your question. What is also clear is that you did not carefully read what I posted.

No one dismissed your post as either inane and ill-considered, but it is my function here to attempt to insure that members use the search facility before posting. It happens to be one of our Rules. To illustrate my point I will quote parts of your original post and your current one.

Your original post said nothing about using the search facility here before posting your question, hence the tenor of my response. Your first actual question was:

"I wondering if anyone was aware of a utility that will take a type library and produce a .pdb (or even a .dbg) symbol file? I thought maybe I could feed the .map file to softice or ida to generate a .pdb but this does not seem to be doable?"

You will notice there is NO mention of OllyDBG in the context of this question, but rather the generation of .pdb (or .dbg) symbols files "using softice or IDA." Hence I gave you references to threads discussing the generation of pdb files and, because you mentioned a "COM type library" I also gave you threads mentioning debugging com objects.

In your second post you state:

"I am asking a very specific question about the conversion of a .map file to .pdb format and subsequently how to properly load the symbols into Ollydbg in order to more effectively debug a COM type library."

Yet the words you wrote in your first post fail to make this explicit connection. In fact, you phrase the question about Olly as an addendum and state:

"Also, does anyone know of any good tutorials on loading debugging sybols in to Ollydbg, I tried the olly users forum but the discussion of these issues is kind of sparse. "

So, despite your current protestation that you were somehow treated unfairly, it is clear that your original post EXPRESSLY mentions the generation of pdb files and using Softice and working on a COM protection in the same context, not directely connected to Olly. Although you discuss use of Olly, it is referenced in the context of "good tutorials on loading debugging sybols in to Ollydbg" with no EXPRESS statement that you either were or intended to use Olly on your COM object.

Now, with "all due respect" I suggest you do three things:

1.) Assume that I have carefully read the post and that when I suggest someone use the search function on the Board, their post does not indicate that they have searched here and that I am fulfilling my responsibilities.

2.) That if you are given specific references to threads which contain information about the subjects YOU ACTUALLY MENTIONED in your post, assume that someone is actually trying to help you out, particularily when you state:

"Any assistance would be greatly appreciated."

3.) Take a little more time to actually THINK about what you ACTUALLY WRITE and then ask yourself what someone who looked ONLY AT THE WORDS YOU WROTE would think you were asking.

If it will help you sleep better at night, you may also assume that I read the OllyDBG Forum, and many others, on a regular basis.

Regards,
br00t_4_c
05-30-2004, 06:56 PM
Hmm, well taking a second look at my original posting, perhaps it was poorly worded. If my poor writing caused any confusion, I apologize. I am also quite certain that you are a regular reader of a large number of forums JMI -the deity be praised I shall sleep again. Anyhow, I'm still wondering... you know what forget it, the whole twenty paragraph chastisement just wore me out, I'll figure it out myself.
Aimless
05-31-2004, 12:13 AM
Wooo....quite a battle there. I think my English just got notched up 2 slots higher...

Anyways, there are the following things to note:

1. .map files are of 2 types (YUP!!). Borland map files and microsoft map files
2. IDA produces Borland map files
3. There is no known software that converts either Borland / Microsoft .map files to .PDB formats
4. You may find a tool (related to delphi) called MAP2DBG.exe (or .zip) which takes map files and produces .DBG files
5. Problem is, you also have 2 .dbg categories. Borland and Microsoft. Microsoft .DBG files are now defunct and they use .PDB files.
6. But now .PDB files from microsoft are also (a) .NET based and (b) native code based (whew!!)

So hope that clarifies a couple of things that you have doubts about.

A good idea is to read the documentation on Ollydbg plugins and decide how you want to go about doing the same (as comments, as labels, etc.)

Have Phun
br00t_4_c
05-31-2004, 08:19 AM
Aimless, your reply is much appreciated.

As for the "battle", I get cranky on when I get shunted off to the search page (my fault in this case) and hope JMI doesn't take my comments the wrong way. I have just found this to be a frustrating issue and have not been able to make much progress with it -br00t_4_c shakes his fist in the general direction of poorly documented proprietary debugging formats... :mad: meh.

Anyways, thanks Aimless :)


NeoLite 2.0 DLL Decrypting / Decrunching / Decompressing / Unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > NeoLite 2.0 DLL Decrypting / Decrunching / Decompressing / Unpacking
PDA

View Full Version : NeoLite 2.0 DLL Decrypting / Decrunching / Decompressing / Unpacking

nitr8
05-29-2004, 07:41 PM
Hi there

I used to try out unpacking of a NeoLite v2.0 packed DLL file, but can't get it to work.

I've read several tutorials on doing it, but never reached the end of the hole process, because the unpacked (dumped) DLL file is about 20 megs big, while the packed one is only about 111 Bytes and the Loader of the DLL always says Injection failed, when´i reset the Entry Point within ProcDump.

The DLL is being Loaded by a Program (EXE). So the Procedure goes like this: LOADER -> (PACKED) DLL FILE -> MAIN PROGRAM EXE FILE

which means: it is an Addon to another Program. The Addon's DLL file is crypted with NeoLite v2.0 and i want to unpack the DLL

i tried finding out OEP so far and i did CC at E9 in the DLL with HexEditor then did "d eip", "[ALT]+[D]", "CC", "[ALT+D]", traced throught the code with F10, till i stand with the line on the code "JMP EAX", did again: "d eip", "[ALT+D]", "EBFE", "[ALT+D]", "[CTRL+D]" and dumped the hole DLL (full dump) file which was loaded in the REAL PROGRAM EXE (Not the Addon EXE).

-> over 20 megs of DLL file created (wtf) :confused:

The problem now is following: When starting the Addon for the FIRST TIME, it has an OEP at 1147915C. In this first start it is searching for the Real Program's EXE and creates an INI file. After that If you close the Addon and start it again, it has an OEP at address 03BB915C.

I don't know what i'm doing wrong but the size of the DLL file isn't normal and also the Injection failed message is making my hope for the graves... :(

Can anybody please tell me or describe step by step how to dump the DLL file from ground, to get it working and smaller and what the real OEP is?

BTW: the Image Base of this DLL is at unbelievable 10000000... :confused:

Also: ProcDump didn't help much it sometimes said "Process can't be dumped" so i used LordPE for dumping
cRk
05-30-2004, 07:01 PM
i stand with the line on the code "JMP EAX",

check EAX value ; EAX = ???? <-- that's OEP

in memory you see the image BASE of the dll --> RVAs you see ... the only difference is you'll set image base to the begin of those RVA as it was 00401000

it's obvious you're lost or actually you don't know what you're doing .. there are many tuts about unpacking Neolite and always is the same home work.

after you dump the dll there's not need to fix imports for this packer .. maybe you'll only need to fix each section ... it's good to use a Pe Rebuilder for this cases .. i usually use the one which has ProDump and work very well.. after rebuilding there's 90% possibilities your .dll will run ok.

if Prodump can't dump is because that dll most have an Anti-dump trick .. before you try to dump with LordPe make sure to hit the option correctImageSize for this case then dump.

Regards
nitr8
05-31-2004, 02:17 AM
maybe you'll only need to fix each section ... it's good to use a Pe Rebuilder for this cases ..

exactly... i did yesterday.

i set E9 to CC at Hexdump E9A6000000, then set bpint3 in SoftICE, launched that thing, SoftICE poped up, i entered:

d eip, pressed [ALT]+[D], entered E9 at CC (original bytes), pressed [ALT]+[D] once more, traced through the code with F10, till i was over JMP EAX, entered d eip once more, pressed [ALT]+[D] again and there i was at the point everybody was talking about... i was at the 558B bytes. the other times before i just didn't trace over JMP EAX. i just stood on the code line, but didn't trace over it. that was my mistake ( :whoops: ). i finally replaced them with the EBFE bytes (nice trick py CoDe_InSiDe - thx for that info), pressed [ALT]+[D] once more, pressed [STRG]+[D], loaded LordPE, fully dumped the DLL (ProcDump wouldn't do it), after that launched ProcDump, clicked on "REBUILD PE", loaded the file into it and it said "successfully rebuild". :D

After all the stuff above i just had to replace the EBFE bytes with the original 558B bytes, cuz it didn't really run after rebuilding, just was in a loop. so launched hexeditor, searched for EBFE Hex String, replaced it with 558B (original bytes), saved that shit and launched the file. It's working now. :loveu:

The DLL file is still over 20 megs, but the size doesn't matter. Program works and i'm really happy about it.

*Happy* :yay:
cRk
05-31-2004, 05:23 PM
i'm glad it runs :D


Reverse engineering poker protocols?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reverse engineering poker protocols?
PDA

View Full Version : Reverse engineering poker protocols?

skaut
05-30-2004, 04:16 AM
Has anyone tried to reverse protocols used to play online poker? Seems like quite a large task, but looking at some clients not totally impossible..
JMI
05-30-2004, 04:33 AM
skaut:

This is not a place to ask someone else to provide you with cracks to anything. That may not be your intent, but it certainly appears so from the brevity of your post. If you have observed the BIG RED LETTERS and actually read the FAQ they mention, you would already know that your question, which shows none of your own work is not in the proper form to generate mush assistance here. Time to re-think what you are really doing.

Regards,
skaut
05-30-2004, 07:42 AM
skaut:

This is not a place to ask someone else to provide you with cracks to anything. That may not be your intent, but it certainly appears so from the brevity of your post. If you have observed the BIG RED LETTERS and actually read the FAQ they mention, you would already know that your question, which shows none of your own work is not in the proper form to generate mush assistance here. Time to re-think what you are really doing.

Regards,

O, I hear you. That wasn't meant to be a request of any kind. I just started looking at how these games communicate and wondered if this was something that has already been investigated by someone else.

My brief investigation shows that communication over an SSL channel seems to be standard and that the protocols are quite extensive. Reversing it all from tracing code etc seems to be a large task. So far I think it could be possible to get the client to log communication to a file, the code seems to maybe have such a feature but it is of course turned off in the release binaries. The particular client I looked at might have a setting for this at least, I'm not sure though since I am not totally sure about the code yet. That was all I did before I threw in that quick post.

I'm interested in game theory and probability theory and the reason for reversing the protocol would of course be to be able to analyze my game and/or automate my game. Another way to accomplish this would be to use the usual client and have another program watching over it - reading stuff from its window and possibly pushing buttons in an automatic way. This is nothing I have investigated at all so far, but I guess it could be an easier way to go..


Sice loading problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Sice loading problem
PDA

View Full Version : Sice loading problem

SynApsus
05-30-2004, 02:55 PM
Hello...
I have a big problem; since some months I changed my wheel mouse ( which was PS/2 ) with another one, an USB one.
But once I did that, when I wanted to run softice, it freezed !
I tried a re-installation, a lot of parameters and configuration changes, but nothing worked. If you have an idea about resolving this problem ?
Why does softice not work at all with a new mouse ? :confused:
nikolatesla20
05-30-2004, 03:16 PM
You don't need a mouse with SoftICE, just go in the SoftICE settings and disable the mouse entirely. The mouse will give you nothing but problems in my own experience, and you don't need it, it slows you down.

-nt20
Aimless
05-31-2004, 12:17 AM
If you are using Softice v4 then ignore this, as nothing works on Softice v4. The same is only for Driverstudio v3.1 (the only version and above that works)

1. Go to Start -> Compuware
2. Select Settings
3. Select Mouse
4. Select PS/2 or USB
5. The part "Enhanced Mouse" should *BE* checked

If you do not see the above, you are using a wrong version of ICE. Get DStudio.

Have Phun
SynApsus
05-31-2004, 01:39 AM
nikolatesla I never used the mouse with softice : it has always been disabled.
But now the main softice window doesn't show anymore since I installed my new mouse...
I'll try with the trick of Aimless.
Note : I use DS v3.0 .
SynApsus
05-31-2004, 08:18 AM
I found a solution by myself... I connected two mouses at my computer.
Sice works fine now :)
Thanks for your replies !


Help with a weird encrypter/packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help with a weird encrypter/packer
PDA

View Full Version : Help with a weird encrypter/packer

hobferret
05-30-2004, 04:52 PM
Hi all ;)

I have gotten hold of a program that won't run with any sort of debugger/dissembler :confused:

It has 5 sections
.text
.rdata
.data
.rsrc
.perplex

It only gives you 3 runs and then you gotta reg it, not very friendly :rolleyes:

I have searched the web and exetools and this forum and only found one mention of it and that did not tell me anything :confused: :confused:

Does anyone know of this and how to defeat it :D

Regards

/hobferret
Js
05-30-2004, 06:20 PM
only protector I have seen with that section name is Ultra/aCprotect but unless its been much improved the no debug doesn't sound right. would you please pm me the target?
cRk
05-30-2004, 07:06 PM
:boo: would you give more detail info. about it????

you're not too newbie for this kind of posts ... at least mention the target so we can search for it.

Regards
nikolatesla20
05-30-2004, 11:47 PM
Yep, that's ACProtect..

Nothing too hard here, just attack it as usual...hide your debugger with the usual FS[0] byte editing trick in Olly, or use an Olly debug hider plugin, search the board for more info about these.

ACProtect uses the CreateToolhelp32 API to detect a parent process that is running it, to make sure it's not being run under a debugger. You can bp on this API and for the CreateToolHelp32 call to return a zero (FAIL).

Not sure which ACProtect it is, 1.09 replaces various CALL instructions in the target to upper memory locations, it's easy to recover these though since they are listed in a sequential table, just find the first one, and you can auto-patch all the rest

I made a scanner for these, based on this method..

Look for "E8" byte first (CALL)
if found, grab next four bytes, if they are higher than BASE+SIZE ignore them
if they are higher than OEP then calc where they go to by getting next address (current address +5) and adding...DWORD should always be positive since new call exists in higher memory...

// Fixes ripped code segments in a dumped file - here it scans
// a file in memory, and fixes the segments from the process
// this is currently running.

BOOL FixRippedCodeMemory(HANDLE hProcess,LPVOID lpMem)
{

LPVOID lpBase = lpMem;
LPVOID OriglpMem = lpMem;

unsigned char* Byte;
DWORD* CallData;
DWORD JumpAddress;
DWORD AddressOfOrigCode;
DWORD Distance;
DWORD LastValidAddress;

// Scan for CALLS that are above mem space

// need to calculate the difference between our mapped mem
// and the file's imagebase
/*
if ((DWORD)lpMem > MemImageBase)
MemDifference = ((DWORD)lpMem - MemImageBase);

if ((DWORD)lpMem < MemImageBase)
MemDifference = (MemImageBase - (DWORD)lpMem);
*/

// Scanner. MemSize if relative
for (unsigned long i = (DWORD)lpBase; i < (DWORD)lpBase + LastSectionVA;i++)
{

// Look for "E8" byte first (CALL)
// if found, grab next four bytes. if they are higher than BASE+SIZE ignore them.
// if they are higher than MemMatchLow then Calc where they go to
// by getting next address (current address + 5) and adding..
// DWORD to call should always be positive, it exists in higher memory.
Byte = (unsigned char*)lpMem;

if (*Byte == 0xE8)
{

// read next 4 bytes (DWORD) , see it it's a valid address
CallData = (DWORD*)((DWORD)lpMem + 1);

if (*CallData != 0)
{

// calculate the distance from the next instruction.

Distance = (((DWORD)lpMem+5) + ((DWORD)*CallData) - (DWORD)lpBase);

Distance = Distance + (DWORD)PEImageBase;

if ((Distance > (PEImageBase+LastSectionVA)) && (Distance < (PEImageBase + PEImageSize)))
{

// this is a valid CALL instruction into higher memory.
//printf("CallData: %Xh \n",*CallData);
//printf("Address: %Xh \n",(DWORD)lpMem - (DWORD)lpBase);

LastValidAddress = Distance;
//ClearMessage();
//sprintf(MESSAGE,"CALL found to: %Xh ",Distance);
//ShowMessage();

// grab the value of the JMP from this call.
// first, make sure it's a JMP instruction
// REMEMBER, lpMEM still points to the original CALL instruction
// look at the bytes at "Distance"

// convert back to our file mapping postion
Distance = Distance - (DWORD)PEImageBase;

Distance = Distance + (DWORD)lpBase;

//printf("Distance new is %Xh \n",Distance);

ZeroMemory(&JumpData,sizeof(JumpData));

memcpy(&JumpData,(void*)Distance,2);

if (memcmp(JumpData,JMP_INSTRUCT,2)==0)
{

// this is a valid JMP
//printf("JMP Valid ");

// get the JMP [<address>]
memcpy(&JumpAddress,(void*)(Distance+2),sizeof(DWORD));

ClearMessage();
sprintf(MESSAGE,"CALL Found at: %Xh - JMP Valid, address Found: %Xh",LastValidAddress,JumpAddress);
ShowMessage();

//printf("Address found: %Xh \n",JumpAddress);

// now we would read in the value from that address, from the
// other process space, move to that value, and grab five bytes
// and replace the original CALL instruction with the original bytes
ZeroMemory(&ORIG_CODE,sizeof(ORIG_CODE));

if (ReadProcessMemory(hProcess,(LPVOID)JumpAddress,&AddressOfOrigCode,sizeof(DWORD),NULL)==0)
{
ClearMessage();
printf("Couldn't read process mem to patch Code: Error: %d \n",GetLastError());
ShowMessage();

return FALSE;
}

// read the five bytes, and copy them
ReadProcessMemory(hProcess,(LPVOID)AddressOfOrigCode,ORIG_CODE,5,NULL);

// copy the original bytes back.
memcpy(lpMem,ORIG_CODE,5);

}

//break;

}

}

}

// move lpBase
lpMem = (LPVOID)((DWORD)lpMem + sizeof(unsigned char));

}

lpMem = OriglpMem;

return TRUE;
}

Attachment for version 1.09f. New version is different now though..

-nt20
hobferret
05-31-2004, 04:34 AM
Thankx everyone for your replies :)

Will first of all try nt20's method :D

Can't post target names or will be flamed by admin :devil:

Regards

/hobferret
Shoob
06-01-2004, 05:34 PM
Is this this same as the old FixACDump Proggy? i loved it :devil: btw great innovative Smilies props go to admin!
sna
06-02-2004, 06:31 PM
Hi.

Nikola's method for dealing with the anti-dumping protection will unfortunately not work past version 1.09. During protection of a file, sets of instructions that occupy 5 bytes are processed in a poly-engine that makes sure any derived set take up more than 5 bytes. The new sets are stored in an array that is put with the other project dependent data in the ACProtect appended section.

During protector initialization, just after decompressing the sections, you'll see how it moves the array into dynamically allocated memory. A bit later on it will iterate over a second array, containing offsets (?) to the original instruction sets and overwrite them with CALL instructions to link in the new code instead.

Question, if you were a building engineer and you had to repair a house... Would you wait until it came down in pieces to only then pick them up and try to repair whatever damage there was in the first place?

Regards, sna
Kayaker
06-02-2004, 07:27 PM
Hi

>>During protection of a file, sets of instructions that occupy 5 bytes are processed in a poly-engine that makes sure any derived set take up more than 5 bytes.

>>Question, if you were a building engineer...

Clever modification.

Yes, but you don't put an umbrella up before it rains either ;). Ahh, when you own a house you're always renovating, building additions, moving the furniture around, putting fluffy pillows on the couch..., same as in programming. I think the protector side enjoy/hate the challenge of having to write better programming code, as much as the other side does to tear it apart, only with a more vested interest :p

K.
nikolatesla20
06-02-2004, 10:56 PM
Hi.

Nikola's method for dealing with the anti-dumping protection will unfortunately not work past version 1.09. During protection of a file, sets of instructions that occupy 5 bytes are processed in a poly-engine that makes sure any derived set take up more than 5 bytes. The new sets are stored in an array that is put with the other project dependent data in the ACProtect appended section.

During protector initialization, just after decompressing the sections, you'll see how it moves the array into dynamically allocated memory. A bit later on it will iterate over a second array, containing offsets (?) to the original instruction sets and overwrite them with CALL instructions to link in the new code instead.

Question, if you were a building engineer and you had to repair a house... Would you wait until it came down in pieces to only then pick them up and try to repair whatever damage there was in the first place?

Regards, sna

I have not examined in detail the new version, but the principles are the same, all you need to do is look for CALLS that are outside the original program's memory space. That's the problem with protectors, they must use higher mem. Once you have those, now it's easy to pick and choose the code you want to rip. A protector is not the only one that can write a "poly engine" (which is just a buzzword). Frequently these "poly engines" contain logic errors and still have a basic pattern than can be searched for. Think outside the box (or in this case, outside the EXE).

-nt20
cRk
06-03-2004, 10:21 AM
anyone knows what anti-loader tricks this program use?? which API use to know that the exe is been running from other exe .. actually a loader ..also Regmonitor does not work ..i mean the Acprotect exe as it detect it just crash .. same as any loader .. it crash before Writeprocess memory happends so it knows that it's been ran with other process or exe (loader) :(
i managed to dump it and knows where the OEP should be but has most bytes at the begin stolen or encrypted .. IAT almost completed but for kernel32 and other API all entries all missing
nikolatesla20
06-03-2004, 12:08 PM
Take a look at this thread

http://www.woodmann.net/forum/showthread.php?t=4900&highlight=acprotect

shows what the program searches for. It uses the ToolHelp32 API to find running processes, etc. Part of the TOolhelp API you can use to find a parent process, so it can see what process is its parent.

You can bypass everything by forcing CreateToolhelp32Snapshot API to fail (return a zero in EAX), since this protection must still work on Win9X, and this API might not exist, it then continues on without any ill effects (because it has to be prepared for the API not being installed, and then it can't use it).

-nt20
hobferret
06-06-2004, 10:26 AM
Hi all :)

I have been messing around with this for a while now and am still PERPLEXED :confused:

The only place where I can find the memory being modified is at an instruction MOV BYTE PTR DS:[EDI],AL where it puts as nt20 says E80B000000 at 00401000, I try to put a breakpoint on memory access or execution but the program crashes prior to getting there.

Loads of unable to pass exception to program. :!:

Any body have any ideas? :yay:

Regards

/hobferret


Asprotect 1.23 RC4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Asprotect 1.23 RC4
PDA

View Full Version : Asprotect 1.23 RC4

kik44
05-30-2004, 07:40 PM
Hello

I try tu unpack files with asprotect 1.23 rc4 and when i open it, then select it at imprec, then i click on IAT Autosearch it says "Could not find anything good at this OEP! :-(" Then i put oep and try again but i have the same error.

Any idea what can i do?
naides
05-30-2004, 09:24 PM
Hello

I try tu unpack files with asprotect 1.23 rc4 and when i open it, then select it at imprec, then i click on IAT Autosearch it says "Could not find anything good at this OEP! :-(" Then i put oep and try again but i have the same error.

Any idea what can i do?

Try this:

for (int myoep= 0x40000000; myoep <= 7fffffff ; myoep ++)

{
Imprec->tryout (myoep);
if (Imprec->result_message_iatautosearch() == ("IAT found")
cout << "got it, OEP was: " << myoep << endl;
}

brutish but effective way to find the OEP ;) ;) ;) .
kik44
05-31-2004, 04:06 AM
i'm new with unpacking, where i put this? Excuse my noob questions :p :D i put on pluggin for olly or is only for imprec, i don't find where i need to put on imprec
jingjang
05-31-2004, 04:07 AM
have same problem :(
Get this error to sometimes 'OEP does not match Memorry' but then i guess i must have input the wrong OEP .
naides
05-31-2004, 09:33 AM
i'm new with unpacking, where i put this? Excuse my noob questions :p :D i put on pluggin for olly or is only for imprec, i don't find where i need to put on imprec

I guess I was too cruel with my little joke. . . :devil: :devil:
There is no way to make Imprec run my BS code snippet, It was a tongue in chick way to say that a correctly identified OEP is a pivotal task to unpacking, you cannot find an OEP by ImpreC trial and error.

If ImpreC finds not valid IAT
Chances are your OEP is not correct
SO: How do you come up with the OEP of a packed program?
What is OEP in contrast with EP?
There are tons of tuts comments and posts in here and else where that deal with this issue.
silkscalp
06-03-2004, 05:56 PM
OEP : This the entry point of the program unpacked. When we have the OEP we write it instead EP after haved Dumped the programme

EP : Entry point of the program packed, the execution of the code begin here. When we have dumped the program , the OEP will be the EP for begin after the routine of unpack... :D

If I'm wrong :whoops: tell me or precise it.... Thank's


Dll relocation?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Dll relocation?
PDA

View Full Version : Dll relocation?

crUsAdEr
05-31-2004, 03:49 AM
Ok, I have this unpacked dll which wont load at certain image base... meaning :

if i use LordPE to to rebuild PE image with option Change ImageBase to 10000000h then LoadLibraryA call to this dll will fail, giving error 2E6 which is ERROR_BAD_PIPE.

if i use LordPE to rebuild PE image but with new ImageBase set to say, 1F700000h then the dll works fine, can be loaded with no problem...

So the question is what the hell is wrong :)?
I have checked and it must be that Reloc info are correct or else LordPE wont be able to rebuild it, but it seems Windows is unable to utilise this reloc information and throw up when it cant load the dll at the designated ImageBase?

Anyone got any idea? This is the weirdest thing i have seen whole week :)
sgdt
05-31-2004, 04:18 AM
I have checked and it must be that Reloc info are correct or else LordPE wont be able to rebuild it, but it seems Windows is unable to utilise this reloc information and throw up when it cant load the dll at the designated ImageBase?

The Reloc has to be toast, or at least missing an entry or two. But, it should be easy to find (in a morbid sort of way).

Anyway, lets say your image is naturally 1F700000-1F8FFFFF. In a hex editor, or in a program, look for sequences of bytes that are in that range. When you find one, look in your relocation list to see if there is a entry. If not, make a note of the address. When you are done, bring the DLL into IDA (at 1F700000), and look for those addresses. If they are real (and not artifacts of random code or data), add a reloc entry. When complete, you'll be able to rebase in LordPE or whatever.

If your list is exceptionally large, consider living with it being at 1F700000. :hmm:
crUsAdEr
05-31-2004, 06:32 AM
The Reloc has to be toast, or at least missing an entry or two. But, it should be easy to find (in a morbid sort of way).

Anyway, lets say your image is naturally 1F700000-1F8FFFFF. In a hex editor, or in a program, look for sequences of bytes that are in that range. When you find one, look in your relocation list to see if there is a entry. If not, make a note of the address. When you are done, bring the DLL into IDA (at 1F700000), and look for those addresses. If they are real (and not artifacts of random code or data), add a reloc entry. When complete, you'll be able to rebase in LordPE or whatever.

If your list is exceptionally large, consider living with it being at 1F700000. :hmm:

Hi sgdt, thanks for the reply but i think u misunderstood me...
the original dll ImageBase is 28000000h but it wont load when LoadLibrary is called with it...

I use LordPE and can successfully rebase the dll to any image base i wish... if i rebase the dll to 1F70000h the dll loads fine, if i rebase the dll to 10000000h the dll wont load again :/... So the point is that i can rebase the dll as i wish... but at certain ImageBase the dll cant be loaded by Windows but at some other ImageBase it works fine?
dELTA
05-31-2004, 07:17 PM
You might get a very good clue by simply tracing the DLLMain-procedure at DLL load time, noting were the non-working version deviates from the execution path of the working one.
crUsAdEr
05-31-2004, 10:09 PM
Hi Delta,

the problem is DLL main is never executed....

OS wont load it at all... looks like OS doesnt recognise relocation directory at all :/...
dELTA
06-01-2004, 06:26 PM
Very strange indeed. But just to be sure, you do know that the DLLMain is executed during the call to LoadLibrary, right, and that the return code of DLLMain can affect the result of the LoadLibrary function? Otherwise it practically must be something wrong with the PE structure of the DLL, relocation wise or other, as far as I can see.
crUsAdEr
06-01-2004, 08:17 PM
Hi Delta, yep i am aware of DLL loading process...
I set CC on DLL entry point, doesnt break... the thing is LordPE is able to rebase fine so the reloc struct seems good, so i am not sure what is wrong really... either Windows is stricter abt reloc format, or perhaps some dll setting flags? though i have ripped exactly the original header...
nikolatesla20
06-01-2004, 09:22 PM
What exact O.S. are you using here, because in different Windows versions DLL's have to be above/below certain ranges...and you can't rebase them to whereever you want.

-nt20


"Relative" Debugging.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > "Relative" Debugging.
PDA

View Full Version : "Relative" Debugging.

Aimless
05-31-2004, 05:03 AM
Hmmm... Read below direct snippet. www.guardsoft.com

"Our Mission

Guardsoft is committed to improving software quality through the use of a new debugging and testing technology called Relative Debugging.

Relative debugging allows a user to compare data between two executing programs. It was devised to aid the testing and debugging of programs that are either modified in some way, or are ported to other computer platforms. Whilst traditional debuggers force the programmer to understand the expected state and internal operation of a program, relative debugging makes it possible to trace errors by comparing the contents of data structures between programs at run time. In this way, the programmer is less concerned with the actual state of the program, and more concerned with finding when and where differences between the old and new codes occur"

Maybe used for random data usage packers/encryptors?

Have Phun.


Olly and SMC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Olly and SMC
PDA

View Full Version : Olly and SMC

least
05-31-2004, 10:57 AM
Hi all,
some time ago I went to a problem when tracing SMC with olly. At some point it was confused - EIP in the middle of displayed instruction and I haven't found any way to make it synchronize starting from EIP (or do something with similar effect). I know that many of you use Olly for unpacking and this kind of stuff so you probably know the trick;) So if someone would be so kind to share his (or her) knowledge with me, I'd be very pleased.
Kind regards,
least
sonkite
05-31-2004, 12:14 PM
Hi all,
some time ago I went to a problem when tracing SMC with olly. At some point it was confused - EIP in the middle of displayed instruction and I haven't found any way to make it synchronize starting from EIP (or do something with similar effect). I know that many of you use Olly for unpacking and this kind of stuff so you probably know the trick;) So if someone would be so kind to share his (or her) knowledge with me, I'd be very pleased.
Kind regards,
least

I usually use shift+* which means goto eip basically.. dunno if this is what u mean.


Little BruteMe ex.: Genetic Algorithm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Little BruteMe ex.: Genetic Algorithm
PDA

View Full Version : Little BruteMe ex.: Genetic Algorithm

ZaiRoN
05-31-2004, 02:20 PM
Hi All !
This is not a crackme but a BruteMe and, the aim is to brute the algo in order to find one of the right serials.
The algo used in this BruteMe has been done to be simple, it's a stupid math formula. The main problem is to code a very fast bruter, it might be not so easy (There are 16 chars inside the serial....)

Which will be the best approach to the target? Is it possible to write a bruter that find a valid serial in... 4/5 seconds?

Good luck,
ZaiRoN
shaddar
05-31-2004, 08:12 PM
hi there,

i think this may not be a true brute-forcing attempt but hey, it does work in under 5 secs. (hell, it doesn't even check if it's still calculating with "printable" characters). anyway, here's my ugly code

----------------snip--------------------

int _tmain(int argc, _TCHAR* argv[])
{
//char serial[] = "aAaAaAaAaAaAaAaA"; // these also work in under 5-seconds
//char serial[] = "1234567890123456";
//char serial[] = "zzzzzzzzzzzzzzzz";
char serial[] = "abcdefghijklmnop";
int sum = 0;
int targetsum = 134797;
int changeIndex = 0;
bool lastDir = true;

_recurse:
if( lastDir )
serial[changeIndex]++;
else serial[changeIndex]--;

for( int i = 0; i < 16; i++ )
{
sum += (int)serial[i] * (int)serial[i];
}
if( sum < targetsum )
{
if( lastDir )
{
if( changeIndex > 0 )
changeIndex--;
else changeIndex = 15;
}
else
{
if( changeIndex < 15 )
changeIndex++;
else changeIndex = 0;
}
lastDir = true;
}
else if( sum > targetsum )
{
if( !lastDir )
{
if( changeIndex < 15 )
changeIndex++;
else changeIndex = 0;
}
else
{
if( changeIndex > 0 )
changeIndex--;
else changeIndex = 15;
}
lastDir = false;
}
else if( sum == targetsum )
goto _finish;

sum = 0;
goto _recurse;

_finish:
printf( "yo serial is: %s", serial );
}

serial1: QSayZYZ[\]^_`XPQ
serial2: \[[SSdd\\\\\\\\[
serial3: YYZ[\[UgdXYZ[\]^
etc.

they look funny, but they work :D

edit: fixed typo
ZaiRoN
06-01-2004, 03:45 AM
Hi Shaddar.
Well done, your approach is pretty nice and your program is fast enough (the check over the printable chars does not increase the speed of the program) :-).
Btw, what about if the sum is 16384; yes, you can change the starting serial but do you think it's possible to make your program independent from the final sum? I mean, something that works *fast* with every targetSum without changing the initial serial each time.

Are there others different techniques to use in this type of problems?

Best regards,
ZaiRoN
shaddar
06-01-2004, 01:49 PM
Hey again,
ok check out the changes i made. just requires you to enter the no. of chars (the serial has) + the target-sum. funny thing is: with 16 chars and 16384 as targetsum you get 16 spaces as solution :D

Are there others different techniques to use in this type of problems?

patching comes to mind :D
ZaiRoN
06-01-2004, 03:48 PM
Hi shaddar,
nice work!patching comes to mindWhat about Genetic Algorithm? :idea:

Zai
Aquatic
06-01-2004, 04:19 PM
Hey shaddar, that's pretty 1337.

nice one :yay:
shaddar
06-01-2004, 04:59 PM
thank you :D

sorry, i don't know much about genetic algorithms (+ isn't the implementation a bit too much work for the given target?), so wait for the pro's to post here :D

regards
ZaiRoN
06-02-2004, 07:51 AM
isn't the implementation a bit too much work for the given targeHmmm, maybe you are right but I need something *easy* to introduce this subject; we had spoken only few times and we never treated the subject in this forum. Take it as an introduction plus a simple example on coding a Genetic Algorithm :).

--------------------------------------------------------------------------
The idea behind Genetic Algorithm is simple: you start with an initial population and then, applying some rules the population evolve, trying to reach the goal. In this case the goal is the value of the sum and the members of the population are the serials.

The scheme of a generic GA is:BEGIN
1. Create the initial population
while (goal is not yet reached)
BEGIN
2. Calculate the fitness of every member of the population
3. Sort the population using the fitness value

4. if (goal is reached)
Solution is find, quit from the while

; --- Reproduction process ---
5. Elitism
6. CrossOver
7. Mutation
END
Print solution
END

1. Create the initial population
--------------------------------
The initial population is filled with random solutions. In this specific case we will have a lot of 16-chars_serial where each character it is choosen randomly. How many members should be in the population? It's not easy to answer to this question; with a big population you have the possibilities to explore much more solutions than a small population but on the other hand the process could take much more time... as you can see there is not a fixed rule and it's up to you to decide the size of the population.

2. Calculate the fitness of every member of the population
----------------------------------------------------------
For every different problem, we have to create a specific fitness function; the fitness function is the core of the GA. The function is applied to each member of the population; in this way, every member of the population will have a fitness *score*. The score represents the *distance* between the current solution and the goal solution. For many problems, like maths optimization problems, the fitness function is represented by the function itself. Due to the fact that the fitness function is a very important part of the GA process, it is fundamental to find a good fitness function if you want a nice GA.

3. Sort the population
----------------------
The population is sorted, with key equal to fitness value, from the best to the worst current solution. In this task you will have to apply a 'sort' algorithm to the population.

4. Check solution
-----------------
As suggested by the title, this is a simple check to find out if a member has reached the goal... nothing more.

Points number 5,6,7 are part of the reproduction process. These are the rules you can apply in order to evolve the population. You can use all of them or only some of them.

5. Elitism
----------
This strategy was born because when a new population is created there is the possibility to lose the best solution(s); the elitism is used to preserve few best solution(s). Elitism increases the performance of the GA.

6. CrossOver
------------
Crossover is a technique used to evolve the population. There are various version of this technique: One point crossover, Two point crossover, Uniform crossover, Partially Mixed Crossover and so on...
Which is the best? It's not easy to answer this question. I think that each version is suitable for a specific problem; for example, Partially Mixed Crossover is used for problem like 'Traveling Salesman'...
Here is a little description of some techniques:

- One Point Crossover(OPC): we have to choose a CrossOver Point, after that the children are created combining some genes of the father with some of the mother. I.e:
Father / Mother: 10110110 11100001
^ ^
| |
---------------- CrossOver Point

Children:
10110 + 001 = 10110001 <-- first part is taken from the father and the rest from the mother
11100 + 110 = 11100110 <-- first part is taken from the mother and the rest from the father

- Two point crossover: the idea behind is taken from the OPC. Each member is represented in a ring form, we have to find two crossover points and to exchange the genes of the father with the genes of the mother. I.e:
Father (10110110) and mother (11100001) in his circular form, the first gene is the one on the top:

1 1
0 0 <-| 1 1 <-|
1 1 | 0 1 |
1 1 | 0 0 |
0 | 0 |
^ | ^ |
| | | |
| ----------------------- First crossover point
| |
| |
| |
----------------------------------- Second crossover point

We will have children like:
1 + 1100 + 110 = 11100110 <-- start and end from father, middle from mother
1 + 0110 + 001 = 10110001 <-- start and end from mother, middle from father

- Uniform CrossOver: given two parents, a mask is used to decide which genes are taken from the father and which are taken from the mother. I.e.:
Father: 10110110
Mother: 11100001
Mask: 01001100 (1: take from the father, 0: take from the mother)
--------
Children: 10100101

7. Mutation
-----------
Mutation is a very important operation in the evolution process and, it's applied after Crossover. It consists on a simple mutation of a gene, nothing more. In some cases, it's possible to evolve the population with only this operation, removing the Crossover process (think about asexual reproduction...).

Well, (I hope) this might give you a little introdution to the Genetic Algorithm.
--------------------------------------------------------------------------

Now, we can try our first GA with this bruteme exercize...

Later,
ZaiRoN
shaddar
06-02-2004, 01:52 PM
wow, nice post zairon!

ok, i tried to come up with a prog for this, but oh well, the reproduction process is a bit confusing for me ( ok i get that about elitism but i wouldn't know how to use the other two in this case :hmm: )

this one also doesn't sort the population (yet? :D). it just creates a random population over and over (bruteforceing again hehe). but please, take a look and tell me if this could be the (very!) basic shape of such a GA.

oh, btw. this time the serial consists only of printable chars at least :cool:

bye
ZaiRoN
06-02-2004, 04:44 PM
This is surely a nice start, you have defined a structure for each member, you have created the population... you are on the right way. There is a little error; the program calculates the fitness two times consecutively, the first one inside CreateInitialPopulation and the other in the 'for' statement. When you will introduce Crossover and Mutation you will surely remove it.

Now, the Crossover. Suppose you want to apply a OnePoint Crossover technique. What to do? Well, one way is to choose two random parents and to join them in order to create the children. Suppose that the 2 parents are:
father = "I am the father!"
mother = "I am the mother!"
and the crossover point is 10 (this number is also random... everything is random in GA :P). The children will be:
child1 = "I am the fother!"
child2 = "I am the mather!"

Following this method, the population evolves creating new members.

Mutation: you have to change a gene (or more genes) of a cromosome. You can exchange two bytes, you can change the 3° bit of the second byte, you can... be creative, you have the power and you define all the rules of the world :devil:

If you don't understand something else, tell me...

Good luck,
Zai
shaddar
06-02-2004, 05:44 PM
ok, i think i get that now :D

hmm...well, i don't think i'm going to put that in c++ code right now, since it really involves too much work. maybe someone else will come an do that :devil:

anyway, thx again for the lil' introduction :yay:, maybe comes in handy sometime :D

cu
ZaiRoN
06-03-2004, 03:33 AM
since it really involves too much workAre you sure? In this case you can write a GA in more or less 150 lines of c++ code, including comments and white line between instructions. :sneaky:
Why do you think it's too much work?

later...
shaddar
06-03-2004, 10:38 AM
Are you sure? In this case you can write a GA in more or less 150 lines of c++ code, including comments and white line between instructions.
Hmm....ok i thought it would need a little more with elitisim, crossover + mutation. anyway....

Why do you think it's too much work?
well, i think it's too much work because i already posted 2 other programs here that seem to solve the 'problem' of bruteMe :rolleyes:

bye
ZaiRoN
06-13-2004, 10:46 AM
A little genetic algo example...
314159265358979
06-18-2004, 06:02 PM
Thanx you very much for this GA explanation, but I have one little question, is it necessary to sort entire population, isn't enought just find k best and then continue? I was thinking of some kind of heapsort, or just one cycle throught population to find the best one.

314159265358979
SvensK
06-20-2004, 04:37 AM
Here's a quick asm keygen for it :)
ZaiRoN
06-20-2004, 11:33 AM
314159265358979,
isn't enought just find k best and then continue?Yes; the purpose of the sort function is to find the best k members and then to use them in the evolve process. If you use a more fast way, that is great.

Svensk, and the source? :p

zai
SvensK
06-20-2004, 11:47 AM
PM me if ya want the source. The only interesting thing is this:

begin:
mov serialSum, 0
lea esi, szSerial
mov ecx, keyLength
xor ebx, ebx

loop1:
xor eax, eax
lodsb ; Get Next Char
mul eax
add ebx, eax
loop loop1

mov serialSum, ebx
cmp serialSum, 20E8Dh ; Is Serial Sum = 20E8Dh ?
jne invalidserial

Regards
SvensK


Aspr 1.23 problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspr 1.23 problem
PDA

View Full Version : Aspr 1.23 problem

jingjang
06-01-2004, 01:23 AM
00B5DDBC 891F MOV DWORD PTR DS:[EDI],EBX <<<last execption
00B5DDBE 64:EB 02 JMP SHORT 00B5DDC3 ; Superfluous prefix
00B5DDC1 CD 20 INT 20
00B5DDC3 67:64:8F06 0000 POP DWORD PTR FS:[0]
00B5DDC9 36:EB 01 JMP SHORT 00B5DDCD ; Superfluous prefix
00B5DDCC 6983 C4048D7C 4B>IMUL EAX,DWORD PTR DS:[EBX+7C8D04C4],2EB>
00B5DDD6 CD 20 INT 20
00B5DDD8 52 PUSH EDX
00B5DDD9 F2: PREFIX REPNE: ; Superfluous prefix
00B5DDDA EB 01 JMP SHORT 00B5DDDD
00B5DDDC 9A 515355F3 EB02 CALL FAR 02EB:F3555351 ; Far call
00B5DDE3 CD 20 INT 20
00B5DDE5 F2: PREFIX REPNE: ; Superfluous prefix
00B5DDE6 EB 01 JMP SHORT 00B5DDE9
00B5DDE8 69EB 019A8D94 IMUL EBP,EBX,948D9A01
00B5DDEE 0FDC02 PADDUSB MM0,QWORD PTR DS:[EDX]
00B5DDF1 97 XCHG EAX,EDI
00B5DDF2 4C DEC ESP
00B5DDF3 2BD1 SUB EDX,ECX
00B5DDF5 2BD7 SUB EDX,EDI
00B5DDF7 81D5 D4705CF4 ADC EBP,F45C70D4
00B5DDFD 52 PUSH EDX
00B5DDFE 83DD BB SBB EBP,-45
00B5DE01 BD 2E234100 MOV EBP,41232E
00B5DE06 5D POP EBP
00B5DE07 C1CD 7C ROR EBP,7C ; Shift constant out of range 1..31
00B5DE0A 55 PUSH EBP
00B5DE0B F3: PREFIX REP: ; Superfluous prefix
00B5DE0C EB 02 JMP SHORT 00B5DE10
00B5DE0E CD 20 INT 20
00B5DE10 81DB 0F5439DB SBB EBX,DB39540F
00B5DE16 5B POP EBX
00B5DE17 C1C3 9A ROL EBX,9A ; Shift constant out of range 1..31
00B5DE1A 53 PUSH EBX
00B5DE1B 0BC9 OR ECX,ECX
00B5DE1D 59 POP ECX
00B5DE1E EB 01 JMP SHORT 00B5DE21
00B5DE20 C7C1 C14B87D1 MOV ECX,D1874BC1
00B5DE26 2E:EB 01 JMP SHORT 00B5DE2A ; Superfluous prefix
00B5DE29 C781 EADBB805 2E>MOV DWORD PTR DS:[ECX+5B8DBEA],3DAF72E
00B5DE33 FA CLI
00B5DE34 64:EB 02 JMP SHORT 00B5DE39 ; Superfluous prefix
00B5DE37 CD 20 INT 20
00B5DE39 5D POP EBP
00B5DE3A 5B POP EBX
00B5DE3B 59 POP ECX
00B5DE3C 5A POP EDX
00B5DE3D 5F POP EDI
00B5DE3E 833D 683BB600 00 CMP DWORD PTR DS:[B63B68],0
00B5DE45 74 14 JE SHORT 00B5DE5B
00B5DE47 6A 0C PUSH 0C
00B5DE49 B9 683BB600 MOV ECX,0B63B68
00B5DE4E 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C]
00B5DE51 BA 04000000 MOV EDX,4
00B5DE56 E8 8536FFFF CALL 00B514E0
00B5DE5B A1 4016B600 MOV EAX,DWORD PTR DS:[B61640]
00B5DE60 C700 E1000000 MOV DWORD PTR DS:[EAX],0E1
00B5DE66 8BC3 MOV EAX,EBX
00B5DE68 E8 474CFEFF CALL 00B42AB4
00B5DE6D A1 C415B600 MOV EAX,DWORD PTR DS:[B615C4]
00B5DE72 8B00 MOV EAX,DWORD PTR DS:[EAX]
00B5DE74 E8 5B67FFFF CALL 00B545D4
00B5DE79 A1 4016B600 MOV EAX,DWORD PTR DS:[B61640]
00B5DE7E C700 E3000000 MOV DWORD PTR DS:[EAX],0E3
00B5DE84 FF75 FC PUSH DWORD PTR SS:[EBP-4]
00B5DE87 EB 01 JMP SHORT 00B5DE8A
00B5DE89 E8 8B45F88B CALL 8CAE2419
00B5DE8E 0085 C07525FF ADD BYTE PTR SS:[EBP+FF2575C0],AL
00B5DE94 ^75 F4 JNZ SHORT 00B5DE8A
00B5DE96 EB 01 JMP SHORT 00B5DE99
00B5DE98 -E9 FF75F0EB JMP ECA6549C
00B5DE9D 01C7 ADD EDI,EAX
00B5DE9F FF75 EC PUSH DWORD PTR SS:[EBP-14]
00B5DEA2 68 3CB0B500 PUSH 0B5B03C
00B5DEA7 EB 01 JMP SHORT 00B5DEAA
00B5DEA9 E8 FF75F0FF CALL 00A654AD
00B5DEAE ^75 E8 JNZ SHORT 00B5DE98
00B5DEB0 68 8CB4B500 PUSH 0B5B48C
00B5DEB5 EB 01 JMP SHORT 00B5DEB8
00B5DEB7 9A FF75E4EB 019A CALL FAR 9A01:EBE475FF ; Far call
00B5DEBE 09C0 OR EAX,EAX
00B5DEC0 74 01 JE SHORT 00B5DEC3
00B5DEC2 50 PUSH EAX
00B5DEC3 FF75 E0 PUSH DWORD PTR SS:[EBP-20]
00B5DEC6 EB 01 JMP SHORT 00B5DEC9
00B5DEC8 -E9 FF75DCC3 JMP C49254CC
00B5DECD 5F POP EDI
00B5DECE 5E POP ESI
00B5DECF 5B POP EBX
00B5DED0 8BE5 MOV ESP,EBP
00B5DED2 5D POP EBP
00B5DED3 C3 RETN

From Labba tut it say we need to get to the last exception and break on RET.
I did this but the prog ran.
evlncrn8
06-01-2004, 02:14 AM
2 rets there at least, did you try breaking on the other one? did you try tracing on and seeing what happens? why not do some work and actually trace things when the tuts dont seem to be accurate, and not come expecting to be spoonfed the answer
jingjang
06-01-2004, 06:43 AM
oopss..was sleepy when posting it...shows u how much i was working on it...i set the break on the 1st ret..and it ran...same as the 2nd.
i was wondering if

00B5DDBC 891F MOV DWORD PTR DS:[EDI],EBX <<<last execption
00B5DDBE 64:EB 02 JMP SHORT 00B5DDC3 ; Superfluous prefix
00B5DDC1 CD 20 INT 20

made any diffrent..since in labba's tut we stop at a difrent address coz in his and most tuttorial it say last exception look somting like this

00FF3A2C 3100 XOR DWORD PTR DS:[EAX],EAX
00FF3A2E 64:8F05 00000000 POP DWORD PTR FS:[0]
00FF3A35 58 POP EAX
00FF3A36 833D B07EFF00 00 CMP DWORD PTR DS:[FF7EB0],0
00FF3A3D 74 14 JE SHORT 00FF3A53


[RSA] Largest N you did factored ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > [RSA] Largest N you did factored ?
PDA

View Full Version : [RSA] Largest N you did factored ?

Bra!NSHiT
06-01-2004, 07:11 AM
Hi,

please tell me, what was your largest N you did factored under normal conditions ? That means, no Super-computer from your university or something else. ;)

Wich tool u used for this stuff ? How long did it take ? Wich computer did u used ? (CPU Speed, RAM).

Bye


IceExt & DirectX
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceExt & DirectX
PDA

View Full Version : IceExt & DirectX

omega_red
06-01-2004, 11:40 AM
I've recently installed IceExt (0.64) again - I wanted to test !bpr (for setting bp at whole d3dim module, I need to track all calls) (readme says that bpr is in development, I'm just curious how much functional it is). Anyway, before I could use it, my system crashed after launching the game I'm debugging. It was KeBugCheckEx with params: 0x0000007f (0x00000008, 0x00000000, 0x00000000, 0x00000000). I've noticed that the bsod appeared shortly after screen resolution change - and yes, it's something with DirectX itself - even directdraw test from dxdiag app causes the same error. I have the latest DirectX SDK installed, tried with debug/retail dlls - no matter what, still crashing.

Videocard (used for DX debugging, ATI drivers for my normal Radeon don't work even with clean SoftICE):
Model : NVIDIA RIVA TNT2 Ultra
RAMDAC : Integrated RAMDAC
Video BIOS : Version 2.05.13.03.00
Total Memory : 32MB (32MB Video) (32MB AGP)
System/SoftICE ver:
SoftICE (R) - DriverStudio (tm) 4.3.0 (Build 1268)
Windows NT Version 5.0 - Build 2195 (Free) SP 4
Using universal video driver.

Again, clean SoftICE works well, crashes are only with IceExt loaded.
omega_red
06-01-2004, 11:51 AM
Forgot to mention - I haven't set any breakpoints at all, just started the app and.. boom.
Sten
06-01-2004, 11:54 AM
Forgot to mention - I haven't set any breakpoints at all, just started the app and.. boom.

Thanks for the report, I'll check it.


Method to Detect Virtual PC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Method to Detect Virtual PC
PDA

View Full Version : Method to Detect Virtual PC

nikolatesla20
06-01-2004, 02:11 PM
I ripped this method from Microsoft's own Virtual PC product:

I installed VirtualPC, then installed Win2K on it, and then installed VirtualPC inside of VirtualPC. It installs fine but when run it comes up and says "Virtual PC cannot be run inside another virtual machine". Naturally I wanted to turn this off.

After some hunting, I found the code responsible for this: (from Olly)

004C1680 55 PUSH EBP
004C1681 8BEC MOV EBP,ESP
004C1683 6A FF PUSH -1
004C1685 68 B0BB5C00 PUSH Virtual_.005CBBB0
004C168A 68 58605700 PUSH Virtual_.00576058 <-- SE handler
004C168F 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
004C1695 50 PUSH EAX
004C1696 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
004C169D 83EC 08 SUB ESP,8
004C16A0 53 PUSH EBX
004C16A1 56 PUSH ESI
004C16A2 57 PUSH EDI
004C16A3 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
004C16A6 C745 FC 00000000 MOV DWORD PTR SS:[EBP-4],0
004C16AD 33C0 XOR EAX,EAX
004C16AF 33D2 XOR EDX,EDX
004C16B1 33DB XOR EBX,EBX
004C16B3 33C9 XOR ECX,ECX
004C16B5 0FC7C8 CMPXCHG8B EAX ; Illegal use of register
004C16B8 0100 ADD DWORD PTR DS:[EAX],EAX
004C16BA C745 FC FFFFFFFF MOV DWORD PTR SS:[EBP-4],-1
004C16C1 B0 01 MOV AL,1
004C16C3 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10]
004C16C6 64:890D 00000000 MOV DWORD PTR FS:[0],ECX
004C16CD 5F POP EDI
004C16CE 5E POP ESI
004C16CF 5B POP EBX
004C16D0 8BE5 MOV ESP,EBP
004C16D2 5D POP EBP
004C16D3 C3 RETN
004C16D4 B8 01000000 MOV EAX,1
004C16D9 C3 RETN
004C16DA 8B65 E8 MOV ESP,DWORD PTR SS:[EBP-18]
004C16DD C745 FC FFFFFFFF MOV DWORD PTR SS:[EBP-4],-1
004C16E4 32C0 XOR AL,AL

As you can see, the code performs a CMPXCHG8B EAX instruction, which causes an exception. A real processor handles this exception by going to the exception handler. The virtual processor does not call the exception handler, and thus sets EAX to 1, which causes the program to know something isn't right. The exception handler goes ahead and runs the Virtual software normally.

This could be a good technique for a program to detect if it's running in Virtual PC or not. Just set up an exception handler, and perform a CMPXCHG8B EAX instruction, and if your exception handler never gets called, you are in a virtual machine (at least a Virtual PC machine). I believe you have to hard code the CMPXCHG8B EAX instruction however, since it won't assemble with most compilers (because it's invalid). The bytes are: OF C7 C8.

-nt20
dELTA
06-01-2004, 06:34 PM
Cool, thanks for the info. :cool:

Btw, after disabling this check, did it work without any problems to run another Virtual PC instance inside the first one?!
nikolatesla20
06-01-2004, 07:20 PM
Well, the program ran fine, and even let me set up a new virtual machine, but it didn't show any picture, so I'm thinking it's some sort of directx thing. Not sure though because I can actually run dxdiag in the virtual Win2K and it runs fine (albeit without any Direct3D support) . No Direct3D, but DirectDraw appears to work.

But the sub virtual machine gives me no "picture" . It just stays black.

-nt20
disavowed
06-01-2004, 07:51 PM
this might sound silly, but... how about using your working virtualpc, putting vmware in there, and then putting the second virtualpc in that vmware?
nikolatesla20
06-01-2004, 09:20 PM
I could try it.

I've already run my GameBoy Advance and Super Nintendo emulators inside the VM and they work great! LOL running an emulator inside an emulator. You gotta love programming !

Anyway, another hilarious side note is that Olly disam I quoted above is from inside the VM machine, while I debugged the non-working Virtual PC to trick it. So you can debug pretty good. In fact I found the code faster because in the VM I found that the sub Virtual PC would run when I used Olly and stepped thru exceptions manually (by using ALT+F9) !!!! That's how I knew it was related to the exceptions.

-nt20
comelysouthchin
06-02-2004, 12:29 AM
unsigned char x[] = { 0xfo, 0x0f, 0xc7, 0xc8 };
main ()
{
void (*f)(void) = x;
f();
}

run it ,then find it what will happen ?

from :http://freebsd.ntu.edu.tw/bsd/8/2/28.html
evaluator
06-14-2004, 02:39 PM
VPC inside VPC will not work, bcz will not try to emulate VPC-architect..

in fact, VPC is NOT clear general emulator, it will emulate systems, which it "knows".

btw, cmpxchg8 trick i see in m$-VPC,
in older VPC's was another illegal instruction.
mYeXcKsN
07-15-2004, 09:16 PM
if Xprotect could run under VPC?
lifewire
07-16-2004, 08:41 AM
did you know that there is a special opcode to interface with virtual pc? like resizing the screen, disable additions, etc? it is done with: 0x0f, 0x3f, xx, yy where xx is the class and yy is the command. you can read more here: http://29a.host.sk/29a-7/Articles/29A-7.029
Shub-nigurrath
07-27-2004, 08:59 AM
the last link isn't working..anyother alternative?
doug
07-27-2004, 10:08 AM
works fine here.
nikolatesla20
07-27-2004, 11:16 AM
Im not too worried about those interfaces, not to mention they only probably work effectively on Win9x.

-nt


Registry file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Registry file
PDA

View Full Version : Registry file

TrainingDay
06-01-2004, 07:14 PM
Hi,

Could someone help me I have a program that i suppose look for a .reg entry in order for it to be a full version. How can I find what key its looking for? And is there anyway to find it without using softice.
shaddar
06-01-2004, 08:13 PM
hey,

try regmon from www.sysinternals.com (http://www.sysinternals.com)


Request: Armadillo Tuturial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Request: Armadillo Tuturial
PDA

View Full Version : Request: Armadillo Tuturial

paranoja
06-01-2004, 07:30 PM
can somebody tell me what I am doing wrong:
I downloaded NO NAMES
1) I did the eb fe trick at the writeprocessmem
2)stoped the debugger by calling stopdbug....
3)In child i set bpx on access on the first section. i get the oep at like 550bd6.
4)i dump it lordpe ->intelliscan.
5)find iat table by looking at a call 10 or so line blow.
6)***iat table is at like 7ce000 (3ce000) and it is 214 lines long.
(is this correct????????)
5)i go to imprec. put in 150bd6 oep, ***rva 3ce000 (is this the rva???), size 214. No invalid thunks no suspects.
6)fixed the dump
7)when i run the fixed prog it never shows no screen but exits.
Can someone help. I know bink_us worked on the same program and I wonder how far he got.
I need some replies, appreciated.
%UNDEFINED%
06-05-2004, 12:44 PM
i get the oep at like 550bd6.
i dump it lordpe
Rebuild the PE
LordPE:

Options

Select:
Dumpfix
Realign

Normal

Validate PE

Then Add the Import Table.
Also make sure that either you or ImpRec is changing the Programs Entry Point to the OEP

If that doesn't work try dumping it again.
cRk
06-05-2004, 05:48 PM
which target is??? maybe import table you got is the one which ARM uses .. is thatarget COPY MEM II protected?


Another IDA Pro website
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Another IDA Pro website
PDA

View Full Version : Another IDA Pro website

dELTA
06-02-2004, 07:32 PM
Just saw this site, "The IDA Palace", linked from the Datarescue page, maybe someone will find it useful:

http://www.backtrace.de
Aquatic
06-03-2004, 02:15 AM
page won't load.
mr.x
06-03-2004, 03:01 AM
page won't load.

It works
dELTA
06-03-2004, 05:26 AM
Yep, it worked for me when I tested it yesterday and it works now. It immediately redirects to the following URL though, so maybe your browser doesn't like the redirect or something like that:

http://www.sport-und-event.de/backtrace.de
Aquatic
06-06-2004, 04:28 PM
I can't load it in IE or Firefox.

edit: It only worked when I used a proxy.


Debugging Kernel Drivers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Debugging Kernel Drivers
PDA

View Full Version : Debugging Kernel Drivers

lordsoth
06-02-2004, 11:33 PM
hi,
I just want to know how to debug drivers using SoftIce, I would like to understand better what they do line-by-line, anyone knows good tutorial?
thanks
LordSoth
djnz
06-03-2004, 05:20 AM
Hi,

Debugging drivers is as broad a subject as debugging anything else, what you'll need specifically is a basic understanding of ring 0, kernel mode api's and the driver model.
I would suggest you get hold of the windows driver development kit, it describes some kernel mode api's and the driver model.

I could give you a few tips, if you're looking for something specific.
Opcode
06-03-2004, 06:36 AM
Hi lordsoth,

I don't create device drivers for windows 9x anymore, just for
windows 2k/xp/2k3 and using assembly language.

Take a look at the excellent Four-F device driver tutorials:
hxxp://www.freewebs.com/four-f/

Download MASM32 at hxxp://www.masm32.com
and search at Google for the SoftICE PDF manual.

Good luck ! :yay:
lordsoth
06-03-2004, 08:12 AM
Thanks but I don't want to develp ( not yet) I just want to debug them and find how they works, I've just read first 3 tuts of Four-F,thanks
LordSoth
doug
06-03-2004, 09:43 AM
To be able to reverse-engineeer you need to know how it works. SO to be successful you still need to follow the steps of a developper.

What you do not need to worry too much about:
- what APIs can/cannot be used at different IRQLs
- Synchronization and Multiprocessor issues
- PNP, power management, Defered procedure calls
- ...

Interesting things to know:
- What happens when you createfile/readfile/writefile/closehandle/deviceiocontrol (particularly DeviceIoControl) on a driver handle.
- DriverExtensions, Filter Drivers
- Can you tell what context a driver executes in? Always?
- System threads

Drivers are much more complex than user-mode apps, and you probably won't be able to do much unless you do some serious reading. You'll find that it's almost like learning a new programming language; you won't get good unless you practice.

You probably should write small drivers to get a feeling how they work.


DLL in NASM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DLL in NASM
PDA

View Full Version : DLL in NASM

AmAdEuS
06-03-2004, 11:01 AM
sup dudes... I'm stuck @ the end of this little job:
http://home.arcor.de/dj_amadeus/natdll.asm

the source is compile and linked fine without any warnings...
it's a translation from the output of vs.net's C-compiler

the orig DLL compiled by vs.net was injected by my loader just fine.. but the NASM-one somehow can't laoded into the process.... maybe i missed some declaration needed to make it an valid win32-dll or something?
i built it using the following settings:

nasmw -O 42 -f obj natdll.asm
alink -oPE -dll natdll win32.lib

hope anyone can help me...
amadeus
AmAdEuS
06-03-2004, 06:20 PM
ok i found out, that i'm missing the DllMain entry point..
i foudn this info on a dll-skelett on sourforge:
%include "\lab\vasm\inc\nagoa.inc"

global DllMain
global MsgBox
export MsgBox

[segment .code USE32]

proc DllMain,hInstDLL,fdwReason,lpvReserved
mov eax,TRUE
endproc

proc MsgBox,param1,param2
call MessageBoxA,0,[param1],[param2],MB_OK
call ExitProcess,0
endproc

but the thing is that nasmw doesn't accept proc as an valid instruction...
so anyone knows anything about it? finding infos on a win32-related issue for a asm-dialect that is used mainly on *NIX is pretty hard...
djnz
06-04-2004, 09:28 AM
Hi,

proc isn't a keyword that's natively supported by nasm,
it's provided as a a macro which is declared in the file c32.mac in the misc directory.
You might want to checkout win32nasm (ftp://ftp.szif.hu/pub/demos/tool/win32nasmbase.zip),
which amongst other things includes an example of a dll.
AmAdEuS
06-04-2004, 01:23 PM
thx alot
dELTA
06-05-2004, 02:58 PM
AmAdEuS, you are welcome to ask this type of questions here too, but the following forum would probably be much more suitable and likely to give you good and quick answers in the area of pure assembler programming:

http://board.win32asmcommunity.net/
AmAdEuS
06-07-2004, 10:40 AM
i know this board... got the things fixed btw, ported everything to masm and have a nice adaptive nocd-laoder for scand bw in all their future versions...


Decoding TwoFish Encryption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Decoding TwoFish Encryption
PDA

View Full Version : Decoding TwoFish Encryption

sailor__eda
06-04-2004, 12:53 AM
I have a problem that I've been working on for a little while and I wanted to know what you guys thought about this.

I know TF128 is pretty difficult to crack by brute strength but my problem is slightly different.

I want to know if it is possible to retreive the key if you knew what a portion of the file looked like. To elaborate further, assume I have a tf encrypted file A.tf
If I know what the first 100 bytes of file A are i.e unencrypted, then does this make it easier to obtain the keys? (Aside from allowing me to use a smaller portion of the file to do a brute strength attack on)

Just curious.

Sailor_EDA
SheepShagger
06-04-2004, 11:39 AM
What you're referring to is called "Known plaintext attack" and good (a.k.a. strong) cryptographic systems are/should be immune to it.

To answer your question:

From a practical point of view, it doesn't.
From a theoretical one, it may (as in very unlikely, but who knows). You've several blocks of ciphertext and its corresponding plaintext (6 or 12 depending on the blocksize used by the TF implementation) which is slightly better than a ciphertext only attack

If you can find a way to derive any information about the key using this attack, then you can claim to have broken Twofish and you will be famous :D

From Wikipedia (http://en.wikipedia.org/wiki/Known-plaintext_attack):

The known-plaintext attack is a cryptanalytic attack in which the attacker has samples of both the plaintext and its encrypted version (ciphertext) and is at liberty to make use of them to reveal further secret information; typically this is the secret key.

At Bletchley Park in World War II, strenuous efforts were made to use, and even force the Germans to produce messages with, known plaintext. The known plaintexts were called "cribs", and schemes to force the Germans to produce them were called "gardening".

If you search the board for known plaintext you'll find more info like http://www.woodmann.net/forum/showthread.php?t=4141

Hope this helps.
sailor__eda
06-06-2004, 01:54 AM
Thanks for the response. That was pretty informative.

Sailor_EDA


GENTIUM dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > GENTIUM dongle
PDA

View Full Version : GENTIUM dongle

steven_t_lc
06-05-2004, 08:36 PM
Doesn anybody know about this dongle from .sk?
There're functions named as GNT_CryptPrivate GNT_GetDevices GNT_GetSerialNum GNT_GetTokenID GNT_GetTokenSta
tus GNT_Logout GNT_ReadRAM1 GNT_ReadRAM2 GNT_UserLogin, etc.
I'm looking for API or manuals..
MeteO
07-21-2004, 04:14 PM
Yonkie, are you trying to crack Henrich bFXTool?
JMI
07-21-2004, 06:40 PM
steven_t_lc:

Which part of the Rules listed in the FAQ linked in the BIG RED LETTERS did you NOT understand?? :whoops: Those rules are repeated in the listing for the "Tools of the Trade" Forum, which states:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

Time to pay attention and follow the Rules. And this newbie request for help breaking the rules, certainly did not belong in the "Advanced" Forum, and was moved here.

Regards,


Dongle Access Codes Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Dongle Access Codes Problem
PDA

View Full Version : Dongle Access Codes Problem

evilman
06-05-2004, 09:18 PM
After I upgrade Wilcom designer ES45 version 6 (Parallel Dongle) to version 8 (USB Dongle), I can not use my old dongle for earlier version anymore as the access codes was changed while dongle is updated.
JMI
06-06-2004, 01:57 AM
:whoops:

While you have posted a statement, you have not asked a question. If your question is how do you crack the dongle you need to read the BIG RED LETTERS at the top of the Forums and then read the FAQ. Read the FAQ and then try a question which is more focused and shows you have done some of your own work. We are not here to do the work for you.

Regards,


Link: Kernel Services in User Space on Win2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Link: Kernel Services in User Space on Win2K
PDA

View Full Version : Link: Kernel Services in User Space on Win2K

doug
06-05-2004, 10:05 PM
http://research.microsoft.com/collaboration/university/europe/events/dotnetcc/version4/Slides/maggiorini.ppt

USYC: an Infrastructure for Providing Kernel Services in User Space on Microsoft Windows 2000
-------------------

27 powerpoint slides. Might give you some ideas.

The slides further refer to a dead link.. But I believe the new location is:
http://homes.dico.unimi.it/~pagae/NPTLab/usyc.html
dELTA
06-06-2004, 05:43 AM
Cool! :cool:
bilbo
06-08-2004, 01:55 AM
Yes, nice, but give us the code please!
Bilbo
nikolatesla20
06-08-2004, 09:23 AM
Technically you can do this already - you can have a generic driver that takes in a function pointer as an argument. The driver then calls this function pointer, which exists in user space code.

However, of course the user code is then running in ring0, so yes we need to go through a task gate to go back to ring3. This can be accomplished with the right interrupts. The only real problem is guarantee of context when the user code executes. you have to be in the right context ! One thing that is proven though, is DriverIOControl is always going to run in the same context as the calling user mode program. If a driver uses a DriverDispatch (or an IORequest, which sends a DCP message) function though, to complete its task, the driver IRQ gets queued and who knows when it will run. In that case you'd have to pass in the process ID too (or process handle?), and use KeAttachProcess(PEB) and KeDetachProcess() (which is undocumented) or similar to force the context switch..

The "Syscall proxy" that they talk about sounds like what kernel32.dll does already - it takes calls, then jumps to NTDLL.DLL, which does a interrupt syscall to get the job done..

-nt20
bilbo
06-10-2004, 11:55 AM
An amusing thread on the same subject from "big head" people

h..p://groups.google.it/groups?th=a53813cbf2276062

Bilbo
dELTA
06-10-2004, 05:34 PM
Actually, the software in the initial link did the opposite of what nt20 and the people in that thead are talking about, at least as far as I can see?
Kayaker
06-10-2004, 11:50 PM
Ah, found the article I was looking for... The method alluded to by nt20 I believe, on a way to run user mode code in a kernel context is described in this 1996 OSR article "Understanding and Using Execution Context in NT Drivers". According to the article you can issue Win32 function calls, pop up dialog boxes, and perform File I/O. The only difference is that the user-application is running in kernel mode, on the kernel stack, and is not subject to privilege limits, quotas, or protection checking. The article is attached.

I had played with the technique a bit, but was never able to pop up a dialog box successfully. OSR Online requires registration now but some of its excellent articles are archived on Chapeaux Noirs and I believe Wasm.ru as well.

Kayaker
doug
06-11-2004, 09:12 AM
[If you can spare the few hours to analyse the xprotector driver]

Xprotector performs a similar trick (IoAccessMap). The driver flips some bits in the page directory, allowing the calling user-mode application to have read/write access over the IDT and the Xprotector driver's .data

So the IDT is patched (quite a few times) at r3 and the int 3 handler also runs at that level. Access to instructions like iretd is also granted to the r-3 application.

I never investigated if that driver could be exploited, but I always considered it as a wide-open backdoor into my computer. (As soon as you send it a DevIo control, you get those priviledges). When you run an xprot application, you never get a Message warning you that a backdoor driver is being installed ;)
evlncrn8
06-11-2004, 09:18 AM
When you run an xprot application, you never get a Message warning you that a backdoor driver is being installed ;)

heh, you also dont get a message that the application will be 4x its size, run like a snail on treacle or has the potential to crash randomly ;)


icedump site?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > icedump site?
PDA

View Full Version : icedump site?

esther
06-06-2004, 03:19 AM
Hello all,

Does anyone has the copy of site? Just discovered its down
(or not it exist anymore?)

Please pm me if you have it :)

Regards


Project RainbowCrack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Project RainbowCrack
PDA

View Full Version : Project RainbowCrack

klier
06-06-2004, 06:53 AM
may be interesting for someone...

"In short, the RainbowCrack tool is a hash cracker. While a traditional brute force cracker try all possible plaintexts one by one in cracking time, RainbowCrack works in another way. It precompute all possible plaintext - ciphertext pairs in advance and store them in the file so called "rainbow table". It may take a long time to precompute the tables, but once the one time precomputation is finished, you will always be able to crack the ciphertext covered by the rainbow tables in seconds."

http://www.antsight.com/zsl/rainbowcrack/#action

Regards,
HaRdLoCk
06-09-2004, 05:49 PM
this seems only be a good idea when small passwords are used. the time you waste on cracking a hash will be the same, unless you or someone else has already rainbow tables computed. but what if i use a 20 byte password hashed with SHA1 for example? you need damn a lot time to pre-compute all that tables - maybe start a project like seti@home? ;-)
klier
06-10-2004, 07:38 AM
if you only need 1 password it's useless,otherwise...may be.
for example:on/offline application(haven't tried it):
http://sarcaprj.wayreth.eu.org/index.php
or when you have much time preparing but not much time searching for the password... :sneaky:
Regards,
mike
06-12-2004, 05:35 PM
This technique is as old as the hills. The whole point of adding salt to the hash in crypt(3) (the program that hashes the passwords in passwd) was to defeat this kind of thing.
klier
06-13-2004, 10:20 AM
yeah i know,it's in the manual.
as old as the street ,new version.
a story:
http://www.giac.org/practical/GCIH/Mike_Mahurin_GCIH.pdf
sorry if boring... :-/
Regards,
hongker
07-07-2004, 05:53 AM
Ho Ho Ho


Message Tracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Message Tracking
PDA

View Full Version : Message Tracking

crUsAdEr
06-06-2004, 05:50 PM
Hi guys.. what is the best way to track down a Message in a program? The program retrieve a certain WM_ message using PeekMessageA and i need to track down how the message got into the queue...

BP on SendMessageA and PostMessageA doesnt seem to catch anything and BMSG only breaks in CSRS context :/, not the program's context...

Thus is there an easy way of observing the Message Queue etc to track down where and how a certain message get into the queue?

Thanks
Aimless
06-06-2004, 11:11 PM
You might try:

1. Spy++
2. Borland Winsight

All freely available on the net...

Have Phun
crUsAdEr
06-07-2004, 09:39 AM
Thanks Aimless.. i check out those tools and find Winspector real good :)

However they dont help me much... the dont tell me the offset of the code/call where the Message is inserted in the queue so i still dont know how the message gets there...
let me be more specific about the problem...

This is the piece of code

CODE:00452EA2 6A 01 push PM_REMOVE ; wRemoveMsg
CODE:00452EA4 6A 00 push 0 ; wMsgFilterMax
CODE:00452EA6 6A 00 push 0 ; wMsgFilterMin
CODE:00452EA8 6A 00 push 0 ; hWnd
CODE:00452EAA 57 push edi ; lpMsg
CODE:00452EAB E8 2C 55 FB FF call PeekMessageA
CODE:00452EB0 85 C0 test eax, eax
CODE:00452EB2 74 75 jz short loc_452F29
CODE:00452EB4 B3 01 mov bl, 1
CODE:00452EB6 83 7F 04 12 cmp [edi+MSG.message], WM_QUIT
CODE:00452EBA 74 66 jz short bad

ok so i need to track down how this WM_QUIT gets into the Message Queue but Winspector / Spy++ doesnt even show any WM_QUIT found... yes the message is there when i debug the program with Olly...
nikolatesla20
06-07-2004, 10:26 AM
I find it hard to believe that bpx on SendMessage or PostMessage wouldn't work, but maybe also try PostThreadMessage and PostQuitMessage too..

-nt20
crUsAdEr
06-07-2004, 12:15 PM
Hey Nikolatesla... thanks man.. u nail the bugger... PostQuitMessage is the culprit :/... As a Delphi programmer i should have thought of this earlier ...


PE File Virtual Size > Size Of Raw Data
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PE File Virtual Size > Size Of Raw Data
PDA

View Full Version : PE File Virtual Size > Size Of Raw Data

4543
06-07-2004, 04:43 AM
Hi

I've been messing around writing my own PE library, and when testing out the PE dump functions I have found something interesting. Sometimes the virtual size can be greater than that of the raw data.

Example (kernel32.dll):
Section: .data
Virtual Size: 9752
Size Of Raw Data: 9216

My question is, what does the PE loader do to fill the bytes it has no data for in memory? My guess would be it fills the difference with 0x00 or similar. This is still a bit confusing though, because I thought the compiler would be required to instead expand the amount of raw data so its >= the virtual size..

Thanks in advance!

4543
Solomon
06-07-2004, 05:16 AM
Does it matter whether it's filled with 0x00 or random data?

Hi
My question is, what does the PE loader do to fill the bytes it has no data for in memory? My guess would be it fills the difference with 0x00 or similar.
4543
06-07-2004, 05:37 AM
Does it matter whether it's filled with 0x00 or random data?

Is it of practical value? Unlikely, but I am simply curious about best practice for this kind of situation.

4543
doug
06-07-2004, 07:59 AM
The size difference is important. It's not just random data that will go in that gap when the program is running.

You have the choice.. you can have it all set to zero on disk and have VirtualSize=RawSize
or
set the rawsize accordingly and let windows handle the rest at load time (but usually this involves rebasing a lot of the PE structures)

These differences usuallly occur when you define global, un-initialized variables.
ex:
some_var db ?

It's a LOT easier to keep the VirtualSize and RawSize match 1:1, but your exes tend to get very big.
4543
06-07-2004, 11:32 AM
These differences usuallly occur when you define global, un-initialized variables.
ex:
some_var db ?

Hmm, OK, thanks. I thought that unintialized data should go in .bss though? Actually if what you say is true, shouldnt the RawSize of a .bss section always be 0, with Virtual Size equal the amount of storage required?
doug
06-07-2004, 12:12 PM
Hmm, OK, thanks. I thought that unintialized data should go in .bss though? Actually if what you say is true, shouldnt the RawSize of a .bss section always be 0, with Virtual Size equal the amount of storage required?

.bss could be merged with .data

As for the 2nd question, I have never investigated that, but I suppose it depends on many things, compiler, linker, ...
4543
06-07-2004, 02:01 PM
.bss could be merged with .data

As for the 2nd question, I have never investigated that, but I suppose it depends on many things, compiler, linker, ...

OK, thank you very much for your help and insight!

On a related note, I'm about to embark on a real adventure: I've resolved a nasty undefined base class problem in my library I'm going to add code so it can write an EXE out again...

4543


Is there such a tool?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Is there such a tool?
PDA

View Full Version : Is there such a tool?

homersux
06-07-2004, 10:46 AM
listfunc win32exe

1. func_a(DWORD para_a, BYTE para_b....)
2. func_b(....)

Basically it will try to analyze the binary and produce a list of functions with its
arguments. This would be something very useful imo.
sgdt
06-07-2004, 12:42 PM
listfunc win32exe

1. func_a(DWORD para_a, BYTE para_b....)
2. func_b(....)

Basically it will try to analyze the binary and produce a list of functions with its
arguments. This would be something very useful imo.

Have you tried IDA? It's a bit more work than simply firing off a command line, but I can assure you it'd provide much more accurate results...
homersux
06-07-2004, 01:22 PM
I am sure you can do that with IDA and a script, but it'd be like shooting a mosquito with a cannon. IDA is kinda too big for such a job and a lot of resource is wasted. Something simple and elegant would be much better.
doug
06-07-2004, 02:00 PM
to be able to do what you want, there should be some sort of symbols file associated with the executable (or via export table). Otherwise can it possibly figure out the parameters?
sgdt
06-07-2004, 02:54 PM
Figuring out CDECL functions wouldn't be an issue (never is). You probably could easily make something that could recognize such functions. But FASTCALL, on the other hand, really does require looking at the caller and the callee simutaniously.

IDA, as long as you set your compiler type, does a great job of figuring out most of the grunt work. But it's almost always manual (for good reason) when it comes to the FASTCALL routines.

Writing such a utility wouldn't be particularly hard, but it also wouldn't be particularly accurate. You can usually guess somethings FASTCALL by looking at whos calling and if the instruction before modifies ECX, it is a good canidate. Additionally, if it uses ECX before setting it, it's probably FASTCALL. Same goes for EDX, but I usually look for ECX first.

CDECLs almost always have an "add esp, <arg_count * 4> after the call, but that's not a rule. Additionally, you can have situations where the callee is a jump to another function. And then there's exception handlers!!!! That's enough to drive anyone writing an analyzer batty...

Hope this is usefull.
homersux
06-07-2004, 04:50 PM
sgdt, I have thought about those types of function signatures. My question reminds that
if there is such a tool available or maybe one has to start from scratch? I hope not. :)

Although I firmly believe this would be something that would help debug/etc tremendously (with more features, such as jump table look up into imported apis etc). I am willing to start a project
if nobody can think of anything remotely related to this and not as bloated as ida or the like. The accuracy of this analysis tool does not have to be 100% because by nature this is a static analysis tool and should be combined with a dynamic analsysi tool such as olly or sice to look for interesting function entry points.
sgdt
06-07-2004, 05:59 PM
A number of years back, I wrote a program to hunt for functions and look for ways to make them faster. Kind of like a peephole optimizer. The targets were overbloated many-megabyte exes.

The first trick I did was data. Because the amount of pointers I was dealing with was very large, I needed a way to add to a list without re-allocating a ton of data. So I had a series of arrays that would get re-allocated, and the array was chosen based on a hash (I had 32 arrays, the hash would return a value between 0-31). This allowed me to instantly (by next part of hash) determine if a pointer already existed and add it if not.

Second trick was to look for pointers. The first thing I did was look at the relocation table. This gave me all the physical pointers, they were added. Then, I would look at the code and using a MMX sliding window, determine if something could be a relative pointer (jumps/calls/etc.). These were added.

Then, I would transverse each pointer with a simple emulator that looked for sane code. The SID byte was processed as a array of pointers-to-functions, because it was too expensive to parse otherwise. Entries that were deamed non-functions were null-ed out (again, to avoid moving mass qty of data). In the end, the arrays were collapsed.

Anyway, it identified functions right up there with IDA, and had a run time of a few seconds for a 13MB exe. However, it had problems (which is why I went to IDA). The first problem was that it couldn't see jump tables. This could have been fixed by handling jump *pointer, but I never got that working correctly. It also didn't see VMTs, and functions ending in jmp.

But it was very fast... Adding the MMX sliding window search brought the spead up to the point it was calculating all it did in roughly the same amount of time it took to bring up the target program.

Basicly, the idea was to make the bulk of the searching as fast as possible, even at the expense of false positives. Then, looking only at the subset, determine what was real and what was artifact. A MMX sliding window, complete with bounds checking, is only a couple clocks. Being able to eliminate pointers to data in-mass via a known-bad list helped too. But even with all my tricks, I wasn't able to get it to do what I needed, and ended up using IDA pretty much exclusvely when reversing (as apposed to cracking, where Olly and SIce reign supreme).

It was a very long time ago, I wish I still had it because of the months of work I poured into it. Some of it is still around, one of the pattern matchers it had became a wicked data parser for the company I work at, dealing with data about 12 times faster than their old hashed string list code.

Oh well. Anyway, about the biggest piece of advice I can give is "realloc is evil" when dealing with lots of data. Find other ways.
Aimless
06-07-2004, 11:38 PM
There are 2 parts to your question.

1. Can we output a list of all functions from an .EXE - Answer: YEs you can. Load it in IDA, write an IDC script that parses the entire disassembly and output the file. Alternatively, search for the CALL opcode in Ollydbg and output the same. Results are the same.

2. It is very difficult to write the parameters of a function from the file, as it is impossible to determine the number of parameters used by a *user* function. WinAPI is easy, of course.

Have Phun
homersux
06-08-2004, 10:08 AM
It's probably faster with olly in a semi-dynamic-static way. Only drawback is that olly has to be able
to load it to work.
Clandestiny
06-10-2004, 10:41 AM
Hiya,

I assume you are proposing to build a dynamic list of functions, a sort of coarsed grained profiler / tracer at the function call level. This is indeed doable. I have written a program which does exactly this. It is written as an IDA plugin, but it has the functionality of a simple debugger. An IDA plugin is really an ideal solution to this type of problem because it allows you to combine IDA's great static analysis data with a stand alone program capable of using it to build a runtime analysis. The list of functions in the target executable is obtained from the IDA database (let IDA do the grunt work ;) and the target is then loaded under the control of my debugger. Before the process is set to the running state, int 3 style breakpoints are set on each of the function addresses which are hit and logged dynamically as the program executes. The number of arguments for each function can also be obtained from the IDA database so it is a simple matter to extract them from the stack in the breakpoint handler as they're hit. As such it can function as a generic function monitor, capturing local programmer defined functions, static library functions, and the usual api calls.

There are also quite a few additional possiblites for automation regarding input tracing across function parameters / returns (can we say "bringing serial sniffing into the 21'st century", heh, heh ;) Some type of scriptability would also be possible (ie. tagging the output of a specific function and tracing it as input to subsequent functions). These type of techniques for automated reverse engineering seem to be underutilized in the protections reversing community, but they are quite advanced in the vulnerability reversing community. Consider the possiblites for discovering something like a heap overflow if you can dynamically script a trace to tag the output of any heap creation functions and then trace the input parameters of subsequent functions for that tag to determine where the heap handle is being used. In this manner, one can quickly narrow down the vulnerability space to a subset of the program state space.

Cheers,
Clandestiny


Faster bruteforcing a SPro dongle?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Faster bruteforcing a SPro dongle?
PDA

View Full Version : Faster bruteforcing a SPro dongle?

Schrödinger Cat
06-07-2004, 11:10 AM
Hope I don’t screw it on my first post with you, guys… LOL! :whoops:

Well, first of all I apologize for written English, since this is not my native language…

But cut to the chaise, here’s the deal; I’m trying to modify some info stored inside my Rainbow’s SPro dongle… (Parallel port version) Honestly, I have this software (An ERP) from my native country, I’m not crazy about this software but at least helps to get the job done… Unfortunately every year the software gets almost 100% more, and more expensive than the last year, but no mayor upgrades are done through time and support gets worst every day… (For heavens sake, they write their code in Borland’s Delphi!!!)

I’m not gonna stop paying for the basic licenses I have been paying for years, but I want to expand the number of authorized networked licenses to run simultaneously (Have 11 right now, need an extra 6 at least)

So far I have read as many texts I have found around, have read the FAQ of the site’s forum, have run as many searches I have think about and read multiple times al related post I have found…

So here is were I’m right now: I decided not to emulate the dongle since I need to modify info related to the license management, so I got my Rainbow’s SDK and prepared my self to bruteforce the 3 passwords (One Write Password and two Overwrite Passwords), basically what I did was working over +Spath’s SPRODUMP V 0.2 code (C language) and modifying the code by adding the functions for bruteforcing not only the write password, but both overwrite passwords, one over the other obviously…

So far, so good… the program seems to be working well… but as you can guess, helluva slow… My best guess is a years and a half search maximum if the first overwrite password comes to be FFFF.

I tried to modify the timing on the delay loops by reducing the microseconds declared on the original code, but it didn’t seem to work… I know parallel port haves a very slow transfer rate, but I believe this can be done faster… I’m I right? If so, what can I do to tweak the SPRODUMP code to improve the dongle access time?

I would sincerely appreciate any help you could bring me on this matter…

Yours, The Schrödinger Cat! :yay:

.


Does IDA debugger show live memory?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Does IDA debugger show live memory?
PDA

View Full Version : Does IDA debugger show live memory?

Aquatic
06-07-2004, 01:07 PM
I want to see what's held at the address of a param.

I don't mean the code, but the live memory.

I know Olly does this easily, but I don't want to use both at once.

Thanks.
Aquatic
06-08-2004, 12:35 AM
Nevermind, I found it.


Help with RCData
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help with RCData
PDA

View Full Version : Help with RCData

b3ie
06-07-2004, 03:15 PM
Hi
I have a software that i want to try to fully reverse engineer. I'm totaly newbie and guess i'll need atleast a year to be able to do that. I have searched and read, but I havent found anything that can help me. It is a delphi application. I dont quite understand everything i read, but I do my best. Anyway when i try to open it in a Resource Editor all i get in the RCData area is a binary dump (I think its a binary dump?). I want to make it work so that when i open a the RCData in a resource editor I can see the options and change them. This software actually needs a dongle, and I have a clone of the dongle, so some other guy patched it to work with the cloned dongle. The file is upx'd so I know I have to unpack it first, but it is the unpacked version I have the problem with. Could anyone help me?
dELTA
06-07-2004, 03:25 PM
I want to make it work so that when i open a the RCData in a resource editor I can see the options and change them
And exactly what "options" would that be?

Btw, luckily for you, external links are disabled in this forum... Don't post links to commercial software here!
b3ie
06-08-2004, 09:28 AM
And exactly what "options" would that be?

Btw, luckily for you, external links are disabled in this forum... Don't post links to commercial software here!
Sorry for posting the link, how can I post the software then, or am I not allowed to do that either. I think I'm going to read the rules once again before posting anything else. Anyway I am not sure if its a binary dump or a hex dump. I hope I can still get some help !
b3ie
06-08-2004, 09:57 AM
I hope I'm not breaking any rules if I post a screenshot (didnt find them to read) , if I am, just warn me and I will remove it right away. Anyway this is how it looks in Resource Hacker:
b3ie
06-08-2004, 10:00 AM
Since I couldnt upload both files I am making a new reply (this is taken from another software). Heres how it should be in Resource Hacker:
+SplAj
06-09-2004, 05:58 AM
change text from Unregistered to Registered.... hmm not quite that simple and effective.

:idea:
Search for 'DaFixer' and 'DeDe' in goooooooooogle and you will find all you need.

eg http://66.98.132.48/fravia/dafix_t1.htm
dELTA
06-09-2004, 07:55 PM
Yep, that's a typical Borland/Delphi form resource in your dump, they don't use standard Windows resources for their GUIs, so you'll have to use special tools to edit them, like the one mentioned by +SplAj above for example. Just don't be too sure it will suffice with a simple edit of the resources to "solve your problem"...
b3ie
06-10-2004, 06:30 PM
Actually the to screenshots I uploaded are from the same software, but the first screenshot is a small update of the software, nothing big. The second screenshot is the previous version. I dont need to make it register, that is already done. What I want is to disable some of the functionality (illegal), but keep the legal. I managed to do it with the prevouse version with just a resource editor. Now I want to use the updated version but I have to do everything again with the resource editor which wouldnt be too bad if I actually managed to get access. I tried DeDe, it worked on the old version, but on this version it just stops responding and exits. I have tried many protectors finders (PEiD, etc...) but they doesnt find anything. What can I do?


Okay, ultimate challange i belive
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Okay, ultimate challange i belive
PDA

View Full Version : Okay, ultimate challange i belive

Bmsfx
06-07-2004, 04:44 PM
Me and some friends have been trying for month's to crack the lineage mmorpg's blowfish code, and as far as i know (in the game's 5 years+) noone have ever successfully cracked it (and ALOT have tryed to do it).

For anyone interrestet to look at it, ill post some of the info i got now..

first i did a check on the file using a program called KANAL, it showed it was using:

Blowfish (Check 2), whatever check 2 means.
and
CRC32 (prolly just for file check)

Here are some packet stuff (key auth) happens when you connect to the server (3 packets are transfered)

peer 1_x = server -> client
peer 0_x = client -> server

char peer1_0[] = {
0x0a, 0x00, 0x29, 0xe5, 0x4c, 0x66, 0x79, 0xa8,
0x00, 0x4e
};
char peer0_0[] = {
0x0e, 0x00, 0xcb, 0x45, 0x03, 0xa9, 0x8f, 0x9b,
0x01, 0x20, 0x8c, 0x3b, 0xa8, 0x82
};
char peer1_1[] = {
0x22, 0x00, 0x60, 0xfe, 0x9b, 0x13, 0xac, 0xb8,
0x22, 0x12, 0x3b, 0x11, 0xf6, 0x22, 0x9e, 0x8a,
0x10, 0x45, 0x6c, 0x46, 0xa1, 0xb4, 0x9c, 0x35,
0xef, 0xce, 0xfa, 0xd1, 0x0b, 0x50, 0x95, 0x70,
0xa9, 0x2e
};

firsly some packet info on those 3.

first [xx xx] of every packet = size of packet
rest is data & opcodes and so on.

the 1_0 packet is always code [0x0a 0x00] [0x29] (where 0x29 is opcode)
rest of the data you see is always random numbers and stuff.

we belive server sends a key to client, and client returns a new key encryptet with the key server sends, and then at last packet server receive a key from client wich is the key to use.

(also note, these packets are always same size).

i can post a few here (else go download lineage from www.lineage.com)

packet 1
char peer1_0[] = {
0x0a, 0x00, 0x29, 0xe5, 0x4c, 0x66, 0x79, 0xa8,
0x00, 0x4e
};
char peer0_0[] = {
0x0e, 0x00, 0xcb, 0x45, 0x03, 0xa9, 0x8f, 0x9b,
0x01, 0x20, 0x8c, 0x3b, 0xa8, 0x82
};
char peer1_1[] = {
0x22, 0x00, 0x60, 0xfe, 0x9b, 0x13, 0xac, 0xb8,
0x22, 0x12, 0x3b, 0x11, 0xf6, 0x22, 0x9e, 0x8a,
0x10, 0x45, 0x6c, 0x46, 0xa1, 0xb4, 0x9c, 0x35,
0xef, 0xce, 0xfa, 0xd1, 0x0b, 0x50, 0x95, 0x70,
0xa9, 0x2e
};

packet 2
char peer1_0[] = {
0x0a, 0x00, 0x29, 0x0b, 0x95, 0x58, 0x0b, 0xbf,
0x00, 0x12
};
char peer0_0[] = {
0x0e, 0x00, 0x4e, 0xa7, 0x70, 0x01, 0xa2, 0x27,
0xce, 0x20, 0x7a, 0x5c, 0xbc, 0x59
};
char peer1_1[] = {
0x22, 0x00, 0xe5, 0x1c, 0xe8, 0xbb, 0x81, 0x04,
0xed, 0x12, 0xcd, 0x76, 0xe2, 0xf9, 0xb3, 0x36,
0xdf, 0x45, 0x9a, 0x21, 0xb5, 0x6f, 0xb1, 0x89,
0x20, 0xce, 0x0c, 0xb6, 0x1f, 0x17, 0x24, 0x79,
0xe2, 0xce
};

packet 3
char peer1_0[] = {
0x0a, 0x00, 0x29, 0xb3, 0x75, 0xbd, 0x4c, 0xa2,
0x00, 0x06
};
char peer0_0[] = {
0x0e, 0x00, 0xa3, 0x5a, 0xb2, 0x14, 0x5a, 0xe0,
0xcb, 0x20, 0x55, 0x4c, 0x6e, 0x8e
};
char peer1_1[] = {
0x22, 0x00, 0x08, 0xe1, 0x2a, 0xae, 0x79, 0xc3,
0xe8, 0x12, 0xe2, 0x66, 0x30, 0x2e, 0x4b, 0xf1,
0xda, 0x45, 0xb5, 0x31, 0x67, 0xb8, 0x49, 0x4e,
0x25, 0xce, 0x23, 0xa6, 0xcd, 0x8d, 0x91, 0x0c,
0x7b, 0x54
};

packet 4
char peer1_0[] = {
0x0a, 0x00, 0x29, 0x75, 0xa8, 0x61, 0x25, 0xf1,
0xd8, 0xf6
};
char peer0_0[] = {
0x0e, 0x00, 0x76, 0x27, 0x81, 0x52, 0xc9, 0x3d,
0x25, 0x20, 0xb3, 0xe4, 0xf5, 0xfb
};
char peer1_1[] = {
0x22, 0x00, 0xdd, 0x9c, 0x19, 0xe8, 0xea, 0x1e,
0x06, 0x12, 0x04, 0xce, 0xab, 0x5b, 0xd8, 0x2c,
0x34, 0x45, 0x53, 0x99, 0xfc, 0xcd, 0xda, 0x93,
0xcb, 0xce, 0xc5, 0x0e, 0x56, 0xf8, 0x02, 0xc1,
0xe4, 0xe1
};

I tryed checking the lin.bin file in IDA but im getting sooo lost all the time.

anyways, if anyone wanna have a go or can provide more info, all info is welcome :)

Thanks.
mike
06-08-2004, 04:31 AM
When you say "crack" the blowfish code, what exactly are you trying to accomplish? Do you want to write a bot for lineage? What is the crypto preventing you from doing?
Bmsfx
06-08-2004, 06:28 AM
well first of all, im not doing this to cheat in the game, im trying to figure out, is NCI (the game dev's) as good as people say, for years people have kept saying that it is impossible to crack there encryptions (packets).

NCI is one of the largest company's for mmorpg's, and im trying to see, if people work together, can they beat them.

i might be interrestet in making something for it later (a server emulator) but thats not in the "idea" yet, people are still playing the game on the real servers (altho the server population is getting lower and lower) duo to the fact that it:

Lineage 2 came out and replaces it
cost 15$ a month (same as lineage 2, but 2 is much larger)
Lineage 1 got a very outdatet gfx engine.

when i startet many years ago there was 1000+ ppl online all the time, now its down to 90-160 (160 on a GOOD day) online.

I dont wanna see this game die away, and then sit and have nothing to do, i like this game..

I program visual c++ (winsock mostly) and have the "skills" to make a emulator once needed.

I tryed yesterday again to memory hook it, to see where it does it's winsock call's but that got confusing, i know where it does its sends, but still not where it does its encryption.

The encryption prevents me from seeing the packets, the opcodes, whats wierd is even the ingame messages (eg. chat) is also encryptet.

hope this answers some of your questions, else just let me know :)
mike
06-08-2004, 06:46 PM
The encryption prevents me from seeing the packets, the opcodes, whats wierd is even the ingame messages (eg. chat) is also encryptet.OK, so it's preventing you from reverse-engineering the protocol. My bet is that they construct the packet and then encrypt the whole thing. Finding the encryption code should be straightforward, since you know what it looks like. You can also look for references to the blowfish tables to greatly reduce the amount of code you're looking at.

Set a breakpoint on the call to the encryption function; I bet the buffer that's being encrypted will be the packet you want to dump.
Bmsfx
06-09-2004, 01:21 PM
OK, so it's preventing you from reverse-engineering the protocol. My bet is that they construct the packet and then encrypt the whole thing. Finding the encryption code should be straightforward, since you know what it looks like. You can also look for references to the blowfish tables to greatly reduce the amount of code you're looking at.

Set a breakpoint on the call to the encryption function; I bet the buffer that's being encrypted will be the packet you want to dump.

im not 100% what u mean by reference to the blowfish tables
i been reading this one

http://babel.altavista.com/babelfish/trurl_pagecontent?url=http%3A%2F%2Fquequero.org%2Fuic%2FBlowFish.htm&lp=it_en

i cant locate the blowfish reference tho.

has some info on blowfish, but my problem is i cannot execute the file in debug mode to set breakpoints because its memory protectet, game crashes at once when i try to do anything but run it normally (in a read/write memory error).

ill continue to looking at it tho.
mike
06-09-2004, 08:44 PM
(Three pages of code dumps)OK, this isn't helpful. You are the one who is interested in reverse-engineering this particular target; no one else will do it for you. What we can offer here is techniques, approaches to the problem, tools, etc.
im not 100% what u mean by reference to the blowfish tablesYou need to become familiar with the algorithm that does the encryption in order to recognize the code that implements the algorithm. Blowfish was created by Bruce Schneier. You can find a description here

http://www.schneier.com/paper-blowfish-fse.html

The tables to look for are the S and P tables. They start out with known values that are changed during the key setup step. You will find large tables of random-looking constants in the program.

A more pressing problem is the anti-debug code. What do you mean, run it in debug mode? What debugger are you using? If you're using SoftIce and you're running into problems with the target detecting it, you can try some of the other forums for help with bypassing that. It will be almost impossible to reverse-engineer the protocol if you can't set breakpoints.

Good luck!
Bmsfx
06-09-2004, 09:37 PM
OK, this isn't helpful. You are the one who is interested in reverse-engineering this particular target; no one else will do it for you. What we can offer here is techniques, approaches to the problem, tools, etc.
You need to become familiar with the algorithm that does the encryption in order to recognize the code that implements the algorithm. Blowfish was created by Bruce Schneier. You can find a description here

http://www.schneier.com/paper-blowfish-fse.html

The tables to look for are the S and P tables. They start out with known values that are changed during the key setup step. You will find large tables of random-looking constants in the program.

A more pressing problem is the anti-debug code. What do you mean, run it in debug mode? What debugger are you using? If you're using SoftIce and you're running into problems with the target detecting it, you can try some of the other forums for help with bypassing that. It will be almost impossible to reverse-engineer the protocol if you can't set breakpoints.

Good luck!

thanks for the url, and yes i know noone will do it for me, and i AM trying my best, i guess those dumps where useless since they got deletet (sorry for that, just thought i had something there).

And yeah, im very happy that you guys will give me some idea's tips'n'trix :)

about the debug mode stuff, i used IDA to do it (run program in debugging mode), but im getting softice and ill try again.

in IDA the program crashed at startup, because there is a memory protection thing in the exe, it can detect if something is hooking itself to the client (im not 100% sure but i think its the nprotect thing) to prevent keyloggers and so on..

but ill take a look at what you postet first and have a go with softice and return back to report whatever progress im making.
Bmsfx
06-11-2004, 05:47 PM
okay after checking some more i found out the file uses actually 3 encryptions

1) CRC32 (file check only i belive to check if someone tampered with files)
2) Blowfish (only for username / password i think)
3) DES (most likely Triple-DES)

so i think ill go read up on Triple DES & DES first.
dELTA
06-11-2004, 07:05 PM
Actually, in this situation you probably shouldn't need to know much more about these three algorithms than the following:

CRC32 is a 32-bit hash/checksum, which is a weak enough algorithm (non-cryptographical) to make it completely and fully breakable without any effort at all, if needed.

Blowfish is a symmetrical block cipher, which you should not consider trying to break per se, you will fail.

DES/3DES are also symmetrical block ciphers that for all practical purposes should be considered non-breakable per se.

Knowing this, you should instead concentrate on analyzing the use of these technologies in the application, i.e. the design of the application security model, for which you only need to consider these algorithms above as black boxes, labeled with what I said above. Then you should find weak spots in this general design instead, and exploit these.
Bmsfx
06-11-2004, 08:44 PM
thanks delta, problem is the people who made this mmorpg have millions and millions, so i dun think ill find a weak spot easily.

i read DES uses 7 byte key, the first packet i receive (key i guess) is 7 byte data

eg:

[xx xx] size
[xx] opcode
[xx xx xx xx xx xx xx] 7 bytes data.

i tryed IDing the exe file with PeID it said it was:

Microsoft Visual C++ 6.0 [Debug] (this might be a weak spot though if its released in debug mode)

i just wish i knew alot about this stuff, so maybe you are right about i have to find a weak spot and "exploid" it.

but first ill try find out how to remove the damn memory protection (anti debug) stuff in the file.

and besides, if i cant get the encryption/decryption rutine then i cannot make a emu for it at any time if thats what i wish to play around with right?.
dELTA
06-12-2004, 08:31 AM
Just like with packed programs, it is theoretically impossible to prevent someone that has a working client in his possession from decrypting all communications from the server and modifying the client's responses in a situation like this (no matter how many millions of dollars the developers have access to). Hence, there is no need to find a real "flaw" in the design of the protocol, but rather simply to reverse it and see which points are the natural ones to intercept. Hence, the crypto algorithms used are quite irrelevant, and the great work lies in reversing the program and its design (which will have good interception points in them).

All I mean is that if I were you I'd put the effort into improving my general reversing skills rather than studying some crypto algorithms, you won't be "breaking", or even modifying, any crypto algorithms at all anyway if you do it the right way.
mike
06-12-2004, 05:43 PM
Yep. Server sends encrypted data, client has to decrypt it to show you where everyone else is in the game. So when it's decrypted, you just need to know where to look.

Also, client has to assemble the plaintext before encrypting it to send to the server. Again, you just need to know where to look to find the plaintext.

The kind of encryption is irrelevant, as dELTA said, except to help you find the code that does the encryption. The buffer coming into an encrypt routine is plaintext, and the buffer coming out of a decrypt routine is plaintext. That's where you want to look.
Bmsfx
06-12-2004, 05:47 PM
oooh okay, thanks to both of you, that kinda makes sence now.

was getting a headacke trying to figure out the damn encryptions, i wont waste more time on that then, ill rather try locating the buffer, sounds alot easier.

i might be a slow learner, but i wanna learn, so this info helps alot.

Thanks again, ill come back and let ya all know my progress (if any :) ).
Bmsfx
06-13-2004, 03:32 PM
okay i think i found the buffer location, so whats the next step ?

is there a way to "monitor" whats comming in/out of that location ? (i mean data)

note: im using IDA pro right now and Api Monitor 1.5, do i need any other programs ?

(i dont know how to use softice so i hope i wont need that one).

Thanks again :loveu:

edit: i think this is the buffer because

in trace, all the "text" data goes -> what i think is buffer then -> jumps to encryption rutine area (i think thats it anyways, makes most sence) then -> send ().
dELTA
06-13-2004, 03:54 PM
I would create a loader that uses the debugging API to place breakpoints just before encryption and after decryption, and then read out the buffers at these points every time they hit. That way, it would be very easy to retrieve/display/store entire communication sessions in unencrypted format, for later analysis or whatever it is you want to do with them.

If you are really lucky and the encryption/decryption routines are located/exported by a dll, you could instead get away with making a proxy dll, for the same kind of interception functionality.
Bmsfx
06-13-2004, 05:19 PM
thanks i guess ill have to have a go at that then..

sounds like thats how the bot for the game works (gamenameProxy) it got a exe file and a dll file, and i checked the dll and it uses api hooks.

problem is i never wrote a api hook before, let alone one that can intercept breakpoints.

well guess its time to learn, have to find some info/excamples for that (for visual c++ 6 tho).

Thanks again, ill report back later. :)
Bmsfx
06-15-2004, 11:41 PM
okay i studied some different codes on making a hook.dll and a loader, so far so good, i can run the game, but it doesnt load the dll i injectet into the exe file.

(i know it injectet the dll code because in api spy i can see it does a WriteToProccessMemory)

i cant seem to find any good places to read about injecting a dll into a exe AND locating where to call the load dll string from the exe.

im pretty sure it injects okay, it just dont "execute" aka read the dll file when i start the game.

i found out it need to be near LoadLibraryA, but not how and where to put it.

also while at it, i coudnt find any place to read about my specific problem wich is:

after loader inject the dll, and game loads the dll, how do i monitor the "breakpoint" and how do i set that breakpoint ?

i mean, lets say i want it to break at

0x0049001 buffer
0x0049002 after buffer - break here right ? then read the buffer and continue.
0x0049003 encrypt

my hook is just set with some excamples right now about logging winsock recv() & send() from a exe file, so i know it doesnt load the dll.

sorry but im not good at this reverse engineering thing, and i never did a dll hook like this before, i understand whats it "supposed" to do, but not excatly how.

hope someone can help.

thanks
dELTA
06-16-2004, 07:12 AM
You cannot create real "breakpoints" by just using an injected dll, you'll have to use a loader with the debugger API for that.

But you can create a hook from an injected dll anyway, let's say your code looks like this, as you say:

0x0049001 buffer
0x0049002 some other instruction 1
0x0049003 some other instruction 2
...
0x0049008 some other instruction N
0x0049009 encrypt

Then you could e.g. patch like this:

0x0049001 buffer
0x0049002 jmp your_hook_proc_in_the_injected_dll
0x0049003 some other instruction 2
...
0x0049008 some other instruction N
0x0049009 encrypt

And your hook procedure in the dll would look something like this:

your_hook_proc_in_the_injected_dll:
0x0099001 <preserve registers>
0x0099002 <do whatever you like>
0x0099003 <restore registers (and stack of course)>
0x0099004 <execute the original instruction you overwrote, i.e. "some other instruction 1">
0x0099005 jmp 0x0049003

Exactly what are you currently using WriteProccessMemory for btw?
Bmsfx
06-17-2004, 05:42 AM
thanks that helps alot :)

mmm i dun know about the writeprocessmemory, api spy just told me my loader did that.

what im doing is:

start loader.exe
hit start button.
it injects the dll call and the dll code (after checked memory is availible and so on).
resumes the game.

anyways, its not completet yet, ill continue to work on it.

thanks for the "process" of injectet / loading :)
dELTA
06-17-2004, 06:58 AM
mmm i dun know about the writeprocessmemory, api spy just told me my loader did that
Hmm, something tells me you didn't create that loader yourself... :D
Bmsfx
06-17-2004, 07:42 AM
ofcourse i didnt :-/ , i studied some excamples and used some code here and there, and trying to figure out how it works...

i can make applications like well... server software, winsock stuff and so forth in VISUAL c++ (win32 api or MFC for that sake)

...... but not in asm...

asm looks like gibbish to me, i know hex adresses and offsets and so, but as i said before, i NEVER before made a hook, so i have not much of a choice but to study others hooks and see what does what where and when..

putting all them push and pop and asm pointers and who knows what doesnt make much sence to me, making the program is easy, making the "inject" code is hard for me...

if i knew much about this, i prolly woudnt be here asking would i :D

im still trying to shake some of the hook code out of some of the bot creaters (to attach a logging2file .cpp/.h thing wrote) but they aint really coorparative... and i doubt that will change..

so basicly im having to do "double" work because they aint gonna help me...

its frustrating but o well...

will continue to ask questions here (aslong as i am permittet / you get tired of me) :D

thanks to all for the help though, its okay if you guys give up on me, but i AINT giving up on this tho...

i waitet almost 4 years for someone to do what im doing, noone ever did, so i guess, if you do nothing, you get nothing... so .... here i am :rolleyes:

i have no plans on giving up, not now, not ever (i think ever might be a big word but..)its possible and i wanna do it sooo badly...

the loader DOES work, it does load the & run the exe, and it does resume the thread, and it does try to inject the dll loader codes... but it aint working :sneaky:

i think i know the error tho, and thats the ASM stuff for the inject/loader and the inject addresses... and thats ASM! :boo:
dELTA
06-17-2004, 09:32 AM
Sure, just keep on struggling, you'll get it right in the end. As long as you put in your own effort and make the most out of the replies that people offer, you are always welcome with your questions here. :yay:
Aquatic
07-13-2004, 07:41 PM
I didn't read any of this thread... but couldn't you just intercept the packets before the get encrypted?
dELTA
07-14-2004, 05:42 AM
I didn't read your post, but my guess is that the answer would be somewhere between 42 and Thursday...
Bmsfx
07-15-2004, 04:45 PM
hum my plaintext thing aint working, i just dont think i get the general idea...

HOWEVER, i do know HOW it encrypts now, username/pw & ingame packets.

1) username / pw is blowfish, the key is part of the packet you receive at init.
2) the DES key (i found this key so thats done, its 8 bytes) is used for what i belive, is filesystem OR to decrypt the blowfish key from server (first packet)
3) the ingame packets are decryptet via some xor of the username you use to login.

i tryed different ways to find out what and how to "unxor" the ingame packets, but never got plaintext out of it.

for this im using a server wich sends fake encryption packets (blowfish key) and fake responce i recorded from real servers, it will accept any username and password and log me into the map.

in game i type different things on the chatboard and can see i get the same output (packetlog) every time if i use same username, else it will change.

(i testet if it uses password aswell, but it doesnt, only username)

so is a plaintext buffer REALLY nessesary ?? since i cannot make one, i just dont know asm good enough for that....:(

so i know:

DES key 8 bytes (i got the key, not 100% sure what used for yet, it get init BEFORE packets gets transfered)
Blowfish key, pattern = GetKeyPacket, GenerateKey, and then some more transfers.
Ingame packets = Xor with login username as key
Bmsfx
07-15-2004, 04:59 PM
sorry for double post, it was getting long and i wantet to make sure you all understand this :)

i was thinking this is the encryption "rutine"

init DES with key.
get first packet (blowfish key).
uncrypt with DES key.
send responce packet final key or so (generatekey).
server sends final packet (unknown to me yet).

you login with your username password.

client saves username (it does in a extern file).
client uses the xor key on the data packets.

-----

1 problem though.

if i type hello ingame.

first time i get lets say ".o...!<k"
second time i get maybe "...#..s!"

but, thats ALWAYS like that aswell, if i use same username....

but the text i send is the same, so that does look wierd to me, there has to be something i missed somewhere.

any idea's ?
dELTA
07-15-2004, 05:17 PM
As discussed earlier, you really shouldn't bother too much with what algorithms are used and try to break these, or even necessarily manually try to catch the key and decrypt them yourself. It's all about finding the point in the code where they are decrypted by the program itself, and then hook it.

And yes, the existence of a plaintext buffer is necessary, otherwise the encrypted data wouldn't be much good for anything, now would it? :) In the worst case, it could be decypted one block at the time, overwriting the previous block, but it shouldn't be really hard to extract it all by hooking that code either, if you just pinpoint it.
Bmsfx
07-15-2004, 06:57 PM
okay hmm, then i need a few links to how :

find a inject address (i use IDA pro if that helps)
find a loader addreess

and how to intercept a buffer -> log buffer -> return to program and continue..

i tryed all kinda things, i just cannot get it to work..... i never wrote a program like this before, and asm pussles me....

i tryed "cracking" this for .... well lets just say.. too long, and the furthest i ever got was, well the stuff i wrote here.

i tryed finding "how to hook plain text buffer" in google, but nothing turned up, i tryed reading some source for another games plaintext buffer hook program, but, he didnt really comment anything very well and it looked VERY advanced..

maybe someone can show me a few code lines that might be interrestet for what im doing ? (eg past projects or something, or perhaps another site with some interresting code snippets)... or simply... alot of documentation on how to do it..

i DO understand that a plaintext buffer hook proggie would be uber good to have, also if they change encryptions or something, but if i got this trouble making it.. well you get the idea...

tools i got right now is:

IDA Pro 4.3
Visual c++ 6.0 sp5

testing inviroment:

fake server with "force set" packets to test stuff locally.
real server acc to test on real servers.

i cant belive it would be this hard to make, sure, its "advanced" but thinking all it have to do is.

print plaintext in buffer
print plaintext out buffer

nothing else..

anyways, once again, i do apriciate all you guys help, and i almost feel bad asking so much, but i really always wantet to do this... imagine it as a dream i have, for along time, its in my grasp, but.... i continue to fail making it work, its so... frustrating..

well, once again, thanks and all further help, guide, links, snippets are appriciatet.
dELTA
07-15-2004, 07:17 PM
With your current level of knowledge, I sadly think it would be practically impossible to explain any further to you what to do in this case, without actually writing the whole program for you. :(

Here are some good tips though:

1.
Don't use such specific google searches, you cannot expect to find exactly what you want, you can often just find information that will enable you to do what you want.

2.
Study some assembler programming, then search for, and study, code injection and hooking in general (there are lots of stuff about it available by a simple search on google).

3.
Make sure you understand how crypto can and will be used in programs.

4.
Apply all this knowledge to this problem, and you will come much further.

I'm sorry, but there often isn't a "quick fix" that will work unless you have the required background knowledge, sad but true. :(

Good luck with it all anyway, and you are very welcome back here with some less general questions related to this project when you have increased your knowledge level to one reasonable for this project.
Bmsfx
07-15-2004, 08:41 PM
well, not to talk against you, i do know a bit, its just a few things im in doubt off...

i do understand, if you put in your loading code, you need to save the registers you replace and then after your injection dll is done running whatever it will do, you run thru the registers you saved and jump back into the program.

what i dont understand:

where do you find a empty place to inject your loader code (.data, .text, ...?).
where do you find the inject location to run your "hook". <-- this one i have ALOT of problems with.

obvious, the location to inject the code call whatever_stub need to be at start of the program, or else there aint much point in loading it because the target sends 3 packets i need at init of program.

so question is, should i inject it at init winsock ? since thats usually only done once at program startup ?.

eg:

some asm.
call mydll_stub -> it runs then does what you removed and jmp back to "some more asm"
some more asm.

or should it be put at the buffer location ? this is what i am in doubt about.

and i did study some inject programs, and i did read a bit about asm, but im running tired, and i been at this "target" for over 2 years (i learned alot, in beginning i was a fool though and did all kinda stupid stuff that never worked or could work), so i would say about 6 month trying to locate encryptions, and now finally getting somewhere but still far from...

so as you can see, im determined, and i will make this work, even if i have to sacrifice 2 years more of my life to do so.
dELTA
07-15-2004, 09:03 PM
Yes, it is indeed very nice to see that you are really determined and willing to put down your own effort to make this happen. What I'm telling you is that at this point you will have to put down just a little further effort before we will be able to answer your remaining questions with any reasonable explanatory effort, that's all, please don't take me wrong.

Just go study code injection/hooking some more, and we will be able to continue, that's all I'm saying. Since you ask where to inject the hook code, I assume you are not very familiar with dll injection, please read up on this subject and then return, and I'm sure we can continue this.

Finding the hook location can only be done by disassembling/tracing/analyzing the code of your particular program, and then following the advice we gave you earlier in this thread about where to inject the hook, and noone here will be able to tell you any more than this, so making sure that your reversing skills are good is critical for this point, more than anything else.

Again, good luck, and see you later. :yay:
Bmsfx
07-21-2004, 11:04 PM
hehe this aint going so good :\

anyone interrested in making some quick $$ making me the plaintext hook ? :D (if this board dont allow it, i ofcourse wont do that).

k well i read alot more on hooks, specially enjoyed this one :

hxxp://www.viksoe.dk/code/wepmetering.htm

made it pretty clear what to do and so, i read some about asm but dunno... i just cant get it to work....

i locatet the buffer in & out from winsock (after decryption, before encryption) in the send, recv..

i THINK i locatet the encryption rutine too.. but not 100% on that...

anyways, i still cant get it to work, i have alot of problem on where to inject the hook, and where to inject the call to the hook.

everytime i try it crashes... :(
Bmsfx
07-31-2004, 08:51 PM
okay gonna try removing the anti debugging thing, seems thats a nessesary step to make a hook (locating inject point and so)....

when launching the file in a debugger, i get this error:

target: the instruction at 0x00458844 referenced memory at 0x7FFE0304.
The memory could not be written. (0x00458844 -> 7FFE0304).

the code it breaks at is:

.text:00458844 loc_458844: ; CODE XREF: sub_441040+2Bj
.text:00458844 add [edx], eax
.text:00458844 ; ---------------------------------------------------------------------------

im not quite sure what to do from here, ill try searching the forum a bit more on the topic, but i already tried searching alot, perhaps i missed it...

else, any comments on this would be nice (perhaps if you seen this before).
dELTA
08-01-2004, 04:57 AM
It's impossible to know from only seeing that single code line. The edx register apparently contains a bad address there, so you should trace its contents backwards to see how this address is built, and the execution paths leading to it, and look for suspicious things along the way.
Peres
08-03-2004, 02:53 PM
Hi! I read the whole thread. I summarize here what I understood:

1. we've got a packed application
2. the application communicates to some server with encrypted messages
3. you're trying to find where the plaintext messages get encrypted or decrypted

I'm going to have a lot of spare time and I love to disassemble PE files... Mail me a link where I can download the target if you wish. Best before next Friday.

Peres

P.S.: I won't download ISOs!
Bmsfx
08-03-2004, 05:27 PM
i have mailed you :) thanks
homersux
08-03-2004, 09:19 PM
I read through the entire thread as well since I am very interested in game hacking. My suggestions to the author:

1) learn code injection and test with easy target, say notepad.
2) don't worry about encryption, because the game, no matter how strong an encryption it uses, it will have to provide the gamer the plaintext information (if you fail to see this point, you need to really *think* harder which is something currently lacking in what your post has shown), therefore you always have ultimate control of information on client side.
3) i found it most useful to find out the keyboard handler subroutine in a game setting, and hooking that subroutine to execute arbitrary code, again, practice with easy target first, even the ones you write your own keyboard handler source code so you know exactly what's going on.
4) assembly knowledge is a must for this kind of game hacking, therefore prepare to learn it thoroughly or let it pass.
Bmsfx
08-08-2004, 05:16 PM
homersux ya, but i would have to use years to learn hardcore assembly for this target, and for this target only since i dont plan of making a habbit out of breaking encryptions (but who knows).

and as i said time is running out for the "target".

btw, the cash offer is still up, and we are not taking 5$ here...

75$ for plaintext hook & source (prefer c or c++).
100$ for plaintext hook & source & the encryption rutines.

the offer is 100% serious, because i do not belive i will ever have all the skills needed for this target.

if people enjoy breaking a exe down, why not do it and make a bit extra ?.

anyways, i downloaded the The Art of Assembly Language book on the net and startet to read it, but its a endless long book if you ask me...
Bmsfx
08-18-2004, 09:19 PM
well finally found a memory monitor that works with this target, i can read all memory the target uses, quite some interresting things in there.

now i just need to locate what buffer location is the blowfish key storage location, then i should be able to figure out how it makes that key / what the key is.
dELTA
08-19-2004, 08:51 AM
Sounds good, keep up the good work. :) Btw, what is the name of the good memory monitor that you found? Did you try out several of them and can recommend some of them? It's always nice to hear from people who compared several different tools within the same area.
Bmsfx
08-19-2004, 10:01 AM
im using MemoryMonitorXP from

http://www.spywindows.com/PAGE1/SOFTWARE.HTM

(note its shareware so i guess its ok to post the link).

it seems really good, im using the "function" in it called Process Memory Explorer, it list the memory locations and so on, and so on, and.. well u get the idea.

this one, instead of hooking the target, it hooks the system memory thingy, and then it can display every programs memory use, without the "target" knowing its there.

so memory hook will work nomather what.
dELTA
08-19-2004, 10:23 AM
Ok, sounds good. It also seems like they have a pretty nice collection of different kinds of monitoring/hooking tools in general, I'd recommend people to take a look at that site.


Disasm idea (Interactive flow-chart)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Disasm idea (Interactive flow-chart)
PDA

View Full Version : Disasm idea (Interactive flow-chart)

Aquatic
06-08-2004, 12:43 AM
You know how IDA can show all the code in a flow-chart? Well this is really useful because you have a way to get your head around what the code is doing, and where it's going.

But... it would be better if you could click stuff on the flow charts, and set BPs...etc

So what I propose is to do away with the flat 'deadlist' display of the disassembly, and to make the whole thing based off a flow-chart. If the flow-chart was fully interactive, and it displayed all the addresses...etc, then you wouldn't need the traditional flat 'deadlisting' of the code.

So just integrate all functionality into the flow-chart, and you will have the ultimate disassembler.
doug
06-08-2004, 09:28 AM
until you see anti-flowchart tricks being used. Obfuscation must be pretty good on that already, but I can imagine what it would be like when pushed to the extreme.

The flowchart is a nice util, particularly for finding High level language code patterns, but by no means a complete solution by itself.
Aquatic
06-08-2004, 12:11 PM
I don't get it.

Why aren't flow-charts 'perfect'?
Polaris
06-08-2004, 01:06 PM
Simply because you can fill code with useless code which is never executed BUT which is parsed by the flow-charter, making the flow-chart enormous and useless. You shold FIRST unobfuscate source code, and then use flowcharts.
nikolatesla20
06-08-2004, 01:12 PM
I seriously have never gotten benefit from reading a flowchart..they are just too big to make sense of in most modern software..

Or maybe i just need to use it more

-nt20
Aquatic
06-08-2004, 02:53 PM
Well, flow-charts are a great way for n00bs to get their heads around the concepts.

It doesn't matter that the charts are 'huge' ... fine let them be huge, they are still easy to navigate. If they were also interactive then they would be even easier to navigate.
doug
06-08-2004, 03:36 PM
slightly O-T

I strongly believe that you should go through the pain of properly learning things if you want to be good at it.

There are some things that you can't avoid if you want to reverse-engineer. Let's just say that knowing assembly is a strong requirement;)

Reverse-engineering is complex and newbies often find that they have too much to learn to do XYZ, and try to cut corners. They ask questions without searching, they don't read documentation, ...

I see flow charts as a great tool to figure out complex branching patterns. You could easily do your analysis without them, but I don't think a proper analysis can be done exclusively with them.

The way I see it, instead of hunting for "jz or jnz", your average flowchart newbie will be looking for the proper branch pattern. He might get discouraged when he sees that if he printed his serial check proc flowchart, it would fill an entire room whereas a regular dissassembly would be 15 pages.
(Note: I tried the IDA flowchart thing.. printed it on 6*5 pages, it's barely readable.. the disassembly is 10 pages)
Aquatic
06-08-2004, 05:08 PM
Why would you print it out? lol

I don't see how using flow-charts limits you. Example?

Also, your opinion is based on IDA's flow chart, which is pretty basic, and is not what I am proposing.

Yes, using flow-charts takes away the '1337' factor of swimming through code, but so what?
naides
06-08-2004, 05:54 PM
Why would you print it out? lol

I don't see how using flow-charts limits you. Example?

Also, your opinion is based on IDA's flow chart, which is pretty basic, and is not what I am proposing.

Yes, using flow-charts takes away the '1337' factor of swimming through code, but so what?

Aquatic:

You are very passionate about your idea, obviously, and that is commendable. I think it has quite a bit of potential.
I doubt anybody but you would develop it, so it is up to you to take it to fruition. . .

Let us start form the beginging: What would be your stating material? a linear disassemble produced by IDA? my gut feeling is that it would deflate the very spirit of what you are trying to constuct, so an IDA like, run through all the possible branching points kind of analysis would be more productive.

And what would be the product?
An interactive, flow schematics of the code in two dimensions, in which every branching point is connected and followed. It has to be reproducible, thorough and systematic.

Ambitious but not impossible. Should you talk to Ilfak???
Aquatic
06-08-2004, 06:35 PM
I was thinking of making the flow-chart a transparent 3D sphere that you can fly around in.

The code would start at the north pole, and then branch down.

When a BP is hit, then you can see that box glow yellow, and then you can fly up to it.
doug
06-08-2004, 07:22 PM
You are missing the point I am trying to make. All these tools sound very nice, but it doesn't take away the fact that you still have to learn the basics - otherwise you won't understand the information that is presented to you.

I find the flowchart limits me the same way I find that windows limits me when I need to go through half a dozen sub-menus to do what I want. Not to mention that any simple obfuscation targeted at your tool will destroy it, which brings us back to the current utils we have, minus the huge investment.

I don't want to take away your dreams, and take no offense in the following comment, but you have posted a few things about the ultimate disassembler, the ultimate live debugger, amazing computers ... are you living in wonderland :devil:

I was thinking of making the flow-chart a transparent 3D sphere that you can fly around in.

Have you seen swordfish?
http://www.woodmann.net/forum/showthread.php?t=5931&p=37223

Do you want a 3D game or a tool to get real work done?
Aquatic
06-08-2004, 08:30 PM
Well, I'm just having fun.

One day this could be real.

I don't mean physically fly around. I mean with your mouse, lol.
nikolatesla20
06-08-2004, 09:47 PM
Aquatic, I support your imagination! Being creative never hurts :) I myself have had some ideas on tools that would be more powerful, all it takes is some time and some initiative :) and perhaps I will get around to trying out a few ideas as well.

-nt20
dELTA
06-09-2004, 07:50 PM
When a BP is hit, then you can see that box glow yellow, and then you can fly up to it.
And when you get an exception you lose one life, luckily, you can get extra lives by rescuing the princesses from the code caves by nulling out the evil random bytes that surround them. When you finally make the last patch needed to complete the crack, you win (and if you do it by clicking the special combo of Softice hotkeys fast enough, you perform a special killer move, and a keygen is automatically generated for you as a bonus), and then you get a 30 minute long 3D ending scene, sometimes even with famous actors in it. But if you fall asleep or give up before making the crack, and instead post a crack request on the RCE board or start dreaming about four-dimensional flow charts that will crack any application before it is even downloaded to your computer, it's game over, and the last thing you see on the screen before your harddisk is formatted is an animation of Alexey running away with all the princesses, and Chad unleashing his evil army of nanomites upon the defenseless glowing flowchart box population, who can do nothing but knock themselves silly flying into the walls of the transparent spheres while trying to escape in wild panic.

Sorry, couldn't help myself. :D Keep up the dreaming, it might just result in something good one day. ;)
Silver
06-10-2004, 06:53 AM
My 0.02. Compuware/Numega DevPartner has similar-ish functionality to this in it's debugging system. It presents COM object ref counts as a graph, which you can click on to jump to the call that inc/dec'd the refcount. It also shows function coverage and calls in a design similar-but-different to a flow chart. Only works for C++ & MSVC AFAIK.

There's also a product called "Understand", they do Delphi, Java, C# and C++ versions, doubt they do an asm one. It is meant to present source code in a relative & easy to understand manner. Never used it, been told it's good.

All these products are great when it's your code that you're analyzing. When it's reversed code, they don't really cut it that much (although it can be helpful to see a visual pattern of some code, such as lots of jumps etc).

And to really take the P. Diddy, there is a guy who rewrote parts of Doom so that he could manage his systems with it. Yep, really. All the demons have processes numbers, kill the demon you kill the process. Doors open apps, etc. Pretty funny. http://www.cs.unm.edu/~dlchao/flake/doom/
Polaris
06-10-2004, 01:10 PM
And when you get an exception you lose one life, luckily, you can get extra lives by rescuing the princesses from the code caves by nulling out the evil random bytes that surround them. When you finally make the last patch needed to complete the crack, you win (and if you do it by clicking the special combo of Softice hotkeys fast enough, you perform a special killer move, and a keygen is automatically generated for you as a bonus), and then you get a 30 minute long 3D ending scene, sometimes even with famous actors in it. But if you fall asleep or give up before making the crack, and instead post a crack request on the RCE board or start dreaming about four-dimensional flow charts that will crack any application before it is even downloaded to your computer, it's game over, and the last thing you see on the screen before your harddisk is formatted is an animation of Alexey running away with all the princesses, and Chad unleashing his evil army of nanomites upon the defenseless glowing flowchart box population, who can do nothing but knock themselves silly flying into the walls of the transparent spheres while trying to escape in wild panic.

Sorry, couldn't help myself. :D Keep up the dreaming, it might just result in something good one day. ;)

:) :) :) :) :) :) :D :) :) :) :)


Piracy & Unconventional Wisdom
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Piracy & Unconventional Wisdom
PDA

View Full Version : Piracy & Unconventional Wisdom

+SplAj
06-08-2004, 07:07 AM
maybe sumthin worth reading .....

http://blogs.atozed.com/kudzu/articles/228.aspx
nikolatesla20
06-08-2004, 09:14 AM
Very good

-nt20
Woodmann
06-08-2004, 06:30 PM
GRRRRRRRRRRRRRRRRRRRRR............

I spent 20 minutes typing a well thought out response and one fucking slip of the finger erased it all.

Anyway, there are some very good points in that article.

Woodmann
+SplAj
06-09-2004, 05:45 AM
well it's a fuckin good job your not the US Gov't man in charge of the 'NUKE' button........it'll be a few thousand half-life years before anybody could type a response
Woodmann
06-09-2004, 03:16 PM
C'mon Splaj.....

We all know that there is only one way to set off the "nukes".

1) 2 people are needed.
2) both have to have another person give them access to launch sequence that is locked in the safe.
2) Where are those 2 guy's with the key's to activate the switches ?
3) timing has to be precise, if one guy turns his key to early they have to start the whole thing over again. (They never show the part when they screw it up :)
4) Stand there and wait for the phone to ring for official word to press the buttons.
5) Phone rings again, stand down-deactivate launch sequence.
6) Push the button anyway to see what really happens :devil:

Woodmann
+SplAj
06-10-2004, 04:14 PM
Woody

OMG with such detail plan.....you must be 'Mr NUKEM' :loveu:
Woodmann
06-10-2004, 07:38 PM
OK,

So I have a reputation for pushing buttons I shouldn't have :eek: ;)

Woodmann
JMI
06-10-2004, 07:46 PM
Yup!

:whoops: Oh, did I do that?????

Woody, We love you anyway. :yay:

Regards,
evaluator
06-11-2004, 08:44 AM
Hello there,

We have been working non-stop on something to protect your ideas.
'Drum Roll Please' ....... CopySite.com is Now Here !

Now you can get a U.S. Copyright for your Website, Images,
Written Works, Music and more all Online in just 5 minutes !

If you create something it is yours. Do not let anyone steal
what you have worked so hard to create. Copyright It !

Copyright Your Work Now for Only $129 -> http://www.copysite.com/

CopySite.com can also help with additional services like 'StopThief'
which monitors for others using your material and 'SiteArchive' which
archives your entire Website every month for backup and proof of date
created.

Copyright your Website & More Today -> http://www.copysite.com/

Note: We will automatically download your Website and burn it to a CD
for submission to the U.S. Copyright Office once you sign up. If you are
Copyrighting other material, you can upload it using our Copyright Wizard.
Woodmann
06-11-2004, 02:18 PM
:eek: I smell something ......

Wait... I think I know what it is.......

Wait....

Wait for it.....

IT SMELLS LIKE.......

A rip-off :boo:

TA TA, Woodmann


Strange armadillo target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Strange armadillo target
PDA

View Full Version : Strange armadillo target

Heathcliff
06-09-2004, 06:02 AM
Hi all,

I'm back after 2 years of no reversing. I found a usefull tool, but I can't seem to get it correctly unpacked. I know it's Armadillo, but it looks like it got some new features. I tried to follow the tuts from Ricardo (excellent job!) Here are my notes:

To find target search Google with these keywords (this is not the target name!):

nyfnet client

Notes:

DebugDetectionByte: 7FFDF002
DebugEventFrame: 12EB88
OEP: 401000
.text: 401000 - 527000

The unpacking:

Start OllyDbg
Debug options, exceptions -> Ignore all.
Load target exe
In hex pane: Go to Expression 7FFDF002
Type 00
BP WriteProcessMemory
3 x F9
In code pane: Go to Expression 5D022A (this is the encryptor call)
Space (Assemble): NOP
Go to Origin
F2
SHIFT-F4: Log expression: [ESP+8] (optional)
CRTL-F9
F7
Start PUPE
Note the ProcessID of the first target process in list (child)
Right click on this process and select 'Parchear'
Set number of bytes to: 2 (arrow down)
Set OEP: 401000
Click 'Buscar' (search)
Note 2 bytes: EB10
Type bytes for infinite loop: EBFE (will let the child sleep on entrance)
Click 'Parchear'
Close Pupe
Go back to Olly
BC WriteProcessMemory
BP WaitForDebugEvent
F9 (to hit the BP)
In code pane: Go to Expression: 5CD7F0 (skip event to return-address)
New Origin Here
Go to Expression: 5CD7DE (to show assembly from the right address on)
Space (Assembler): NOP complete call with pushed arguments from 5CD7DE to 5CD7EF)
Select 5CD7F0 and Space (Assemble): JMP 401000 (NOP is added, note: code continues at 5CD7F7)
Replace OEP values in DebugEventFrame with: 00 00 40 00
Go to Expression: 401000
Space (assemble):
ADD DWORD PTR DS:[12EBA0],1000 (Locations in DebugEventFrame where OEP is)
ADD DWORD PTR DS:[12EBAC],1000
ADD DWORD PTR DS:[12EBB0],1000
CMP DWORD PTR DS:[12EBB0],527000 (End of .text)
JNZ 5CD7F7 (Don't continue original code after the last unpack-section)
PUSH 21C4 (childs ProcessID is shown in PUPE)
CALL DebugActiveProcessStop (Detach child)
NOP
BP on last NOP
When the BP is hit exit Olly (kill the parent-process)
Restart Olly
Attach to child (ignore warnings)
When EIP is in ntdll, hit CTRL-F9 until in target
In hex-pane: Go to Expression: 401000
Type: EB 10
Start LordPE
(If there are too many processes, burn some of them to get the child visible)
Select IntelliDump
Dump full: Dumped.exe
Click 'PE Editor' (or open any other PE Editor, it doesn't matter)
Open Dumped.exe
Change EntryPoint to: 00001000
Calculate Checksum
Save
Close LordPE
Running Olly can be closed
Start new Olly
Open Dump -> Olly error: Unable to start file 'C:\Dumped.exe'

So it seems i cannot open the dumped exe in Olly! :mad: It is however possible to open the dumped exe in IDA Pro. I'm trying to work around this problem and get the IAT reconstructed in another way, but it would sure help if someone could tell me why Olly won't open my dump!

Some other things I found out when I opened my dump in IDA:
- The tool is written in Delphi
- The registration is done with ArmAccess.dll (part of Armadillo). This dll is hard to reverse, so it would be much easier to get the dump fixed and patch the dump so ArmAccess.dll will not be called anymore and make it 'always registered'.
- Search for 'REGISTERED' and scroll up and down to see the registration code.

I'm not sure yet if this target has nanomites. I haven't looked into that yet.

Any help is appreciated!
Thanks in advance to Ricardo for his great tuts!

Greetz,
Heathcliff
Heathcliff
06-09-2004, 06:28 AM
I found out that if you don't close Olly with the child process at the OEP it is possible to continue with seaching for the IAT etc (as described in Ricardo's second tut).

The jumps to the IAT start at: 525A98
The IAT is: 563000 - 564147

There is a lot missing here and I suspect some import-redirection.

I'm still wondering why I can't open the dump in Olly, coz I might need this later on.

Heathcliff
dELTA
06-09-2004, 07:58 PM
Always nice to see one of the names from the good old days return, welcome back Heathcliff. :)
Heathcliff
06-13-2004, 07:20 PM
Hi all.

Thanks dELTA. It's good to be back. But this Armadilla really gives me headages! Some help is appreciated here! This is what I've got:

The parent is 'debugging' the child. When the child has sent 47 debug-events to the parent, the offsets for the IAT have just been copied and the IAT is about to be filled with absolute addresses (original and redirected) before jumping to the OEP. So the child needs to be debugged at that moment. The parent needs to be detached and killed before OllyDbg can attach to the child-process. But the child must not continue to fill the IAT. It is not possible to alter the code in the child-process because the parent will kill the process. Ricardo's trick to set an infinite loop at the 'magic jump' does not work on this target. So an infinite loop must be placed in an API-call which is used by the child and then the child will wait for us to attach Olly. The routine for filling the IAT starts at 00C8F453 (addresses may have a different offset on other systems). The first imported function which is called is 'msvcrt.strchr'. This is the API-call in which the infinite loop has to made with Pupe. After the parent is detached and a new Olly is attached to the child, the child can be altered so it will fill the IAT with original addresses.

The loop, which fills the IAT, is different from what Ricardo describes in his tut. In the first part the next DLL-name is retrieved from the IT. If it reached the end of the IT, loop will exit at 00C8F48E. This is where an infinite loop must be set to pause for the Import Reconstructor when the IAT is built.

The loop which really fills the IAT-entries for the DLL's in the IT starts at 00C8F7CC. In this loop a table with redirected addresses is checked first. If a redirected address is found for the function-address currently being calculated, this address will overrule the address of the real DLL-import. If no redirected address was found, the base-address of the DLL will be added to the offset in the IAT. To prevent the redirected address being retrieved, the code at 00C8FA3B has to be filled with NOP.

There's another trick. This trick makes it difficult for Import Reconstructor to correctly sort out the different DLL's in the IAT. The zero's, which normally indicate the end of an DLL in the IAT, are also being replaced with redirected addresses. To prevent this the code at 00C8F8E7 has to be filled with NOP.

When I looked at the IAT, I noticed that NOT all entries had been calculated. It seemed there were no correspondent entries in the IT for them and I also couldn't find code using these entries. So they seem unused. And my guess is, that the only reason they're there, is to accomplish some harmless error reports in Import Reconstructor. I think the errors in Import Reconstructor could be safely ignored.

After I used Import Reconstructor to fix my dumped exe I still have same problem as I had before. My dumped exe can't be run in any debugger! Olly still reports 'Unable to start file 'C:\Dumped.exe' when I try to open the dumped and fixed exe. IDA is able to load the exe, but when I try to
run it, it reports 'Command "ProcessStart" failed'. Arg! When I open the exe in PE Editor everything looks normal.

When I try to run the exe it reports:
C:\Dumped.exe
Only part of a ReadProcessMemory or WriteProcessMemory request was completed.

This is the same message I got before I fixed the IAT. I hoped the fix would enable me to use a debugger on the exe, or fix the ProcessMemory errors. But it didn't. I'm kinda stuck again. Maybe it's all easy to fix, but I must at least be able to run this dumped exe in a debugger. Can someone please give me an indication of how it is possible, this exe cannot be run in any debugger?

This is what I did to get the IAT fixed for my exe:

Start new Olly
Open original exe
Reset Debugging-flag
BP WaitForDebugEvent
47 x F9 (After 47th time WaitForDebugEvent the IAT was build and now being destroyed)

View Executable Modules
Right click msvcrt
View Names
Look for 'strchr' and write down the address (77C43600)

Open Pupe
Select first target (child)
Write down the ProcessID (1E18)
Right click
Parchear

Optional:
Number of bytes: 4
Enter address: 563360 (Redirected IAT-Entry)
Buscar (Search)
Check to see if it contains an offset: D0 42 16 00

In Pupe enter address: 77C43600 (= strchr)
Numer of bytes: 2
Buscar (Search)
Write down the original contents: 33 C0
Enter new values: EBFE
Parchear

In Olly code pane: Go to Expression: 401000
New origin here
Space (assemble)
PUSH 1E18 (ProcessID of child)
CALL DebugActiveProcessStop
NOP
Select the NOP
F2
F9 (EAX must be 1 when the BP is hit, CPU usage goes to 100%)
Close Olly

Start new Olly
Attach to target (only child remained)
CTRL-F9 (to get from ntdll to the infinite loop on msvcrt.strchr)
In Code pane: Go to Expression: 77C43600
Enter original values: Binary Edit: 55 8B
CTRL-F9 (to get to the IAT-filling)

In Code pane: Go to Expression: 00C8F48E
Binary Edit: EB FE
In code pane: Go to Expression: 00C8FA3B
Space (Assemble): NOP
In code pane: Go to Expression: 00C8F8E7
Space (Assemble): NOP
F9

Run Import Reconstructor
Select child process
Fix dump

My guess is, something already went wrong when I dumped the exe. But I have no clue.

HELP!

Heathcliff
nikolatesla20
06-13-2004, 10:52 PM
Hi all.

TThe loop which really fills the IAT-entries for the DLL's in the IT starts at 00C8F7CC. In this loop a table with redirected addresses is checked first. If a redirected address is found for the function-address currently being calculated, this address will overrule the address of the real DLL-import. If no redirected address was found, the base-address of the DLL will be added to the offset in the IAT. To prevent the redirected address being retrieved, the code at 00C8FA3B has to be filled with NOP.

There's another trick. This trick makes it difficult for Import Reconstructor to correctly sort out the different DLL's in the IAT. The zero's, which normally indicate the end of an DLL in the IAT, are also being replaced with redirected addresses. To prevent this the code at 00C8F8E7 has to be filled with NOP.

When I looked at the IAT, I noticed that NOT all entries had been calculated. It seemed there were no correspondent entries in the IT for them and I also couldn't find code using these entries. So they seem unused. And my guess is, that the only reason they're there, is to accomplish some harmless error reports in Import Reconstructor. I think the errors in Import Reconstructor could be safely ignored.

Those are most likely the traditional entries in between DLL thunks, which should normally be zero, instead they put in some junk code. No matter because if the rest of the IAT is valid, you can just open up the tree in ImpREC (expand the "bad" invalid tree), scroll to the bottom of the tree, and you will see the invalid thunk. All you have to do is right click on choose "delete thunks" to get rid of the bad entry, an wallah your thunk list becomes valid.

For Olly, also make sure your imagesize correctly matches what it really should be (the imagesize entry in the header). And check the sections for their read/write/execute settings, and sometimes Arma puts in garbage for the "Pointer to symbol table". Remove this pointer completely, set it to zeros.

-nt20
-nt20
Heathcliff
06-14-2004, 01:39 AM
Those are most likely the traditional entries in between DLL thunks, which should normally be zero, instead they put in some junk code. No matter because if the rest of the IAT is valid, you can just open up the tree in ImpREC (expand the "bad" invalid tree), scroll to the bottom of the tree, and you will see the invalid thunk. All you have to do is right click on choose "delete thunks" to get rid of the bad entry, an wallah your thunk list becomes valid.

For Olly, also make sure your imagesize correctly matches what it really should be (the imagesize entry in the header). And check the sections for their read/write/execute settings, and sometimes Arma puts in garbage for the "Pointer to symbol table". Remove this pointer completely, set it to zeros.

-nt20

Okay! Thanks alot! I will try this..

Greetz,
Heathcliff
Heathcliff
06-14-2004, 05:26 AM
Damn! This is really starting to freak me out! I followed all Nico's instructions:

- I set the Base of Code to: 00001000 (VOffset of .text, flags seem ok)
- I set the Base of Data to: 00127000 (VOffset of .data, flags seem ok)
- I filled Pointer of Symbol Table and Number of Symbols to 0
- I set the IAT offset and size to 00163000 and 00001168
- I recalculated the checksum
- The ImageSize was already ok: 00327000
- I reconstructed the imports again, but now I deleted all invalid thunks.

I still can't seem to run this dump in the debugger! Any more suggestions are very welcome!

Some extra notes from me for people who want to help me:

- The IAT seems to be from 563000 to 564167 (not 564148, as I said before). So in ImpRec use offset 163000 and size 1168.
- If you remove the infinite loop in msvcrt.strchr at 77C43600, replace it with 33 C0 (these are the original values and not 55 8B, as I said before)

This target is in some aspects different from the target in Ricardo's tuts:
- The call to the decrypter and the encrypter are different from eachother
005D0172 CALL 005D04BF (= decrypter for dumping)
005D022A CALL 005DC4A0 (= encrypter for dumping, should be NOP)
- It is not possible to set an infinite loop on the 'magic jump', because the integrety of the child process is checked before building the IAT. Altering the child will cause it to end the process. Set the infinite loop in msvcrt.strchr work ok though.
- The routine for filling the IAT is very different. Many offset don't seem to be calculated, because they are unused. The end-marks for the DLL's in the IAT are being overwritten. The CALL Ricardo refers to for patching is in this case only being called when writing correct values to the IAT, so other patches have to made (as I described in a previous post in this thread).

I really hope someone can help me out! I suspect I still have an invalid PE-header somehow. If someone want to look at it I can PM my dump.

Greetz,
Heathcliff
crUsAdEr
06-14-2004, 06:01 AM
Hi Heathcliff,

I decided to look at this one... i assume u r talking abt the client version...
here are my finding
OEP : 1000
IAT start : 163138

I am not sure what your IAT problem is cos this one is 3.50a, doesnt have Import elimination...
Heathcliff
06-14-2004, 06:12 AM
Hi Heathcliff,

I decided to look at this one... i assume u r talking abt the client version...
here are my finding
OEP : 1000
IAT start : 163138

I am not sure what your IAT problem is cos this one is 3.50a, doesnt have Import elimination...

Hi crUsAdEr,

Thanks for your help. I'm talking about the client-version indeed. I did find the OEP and IAT too. This target absolutely does have Import redirection. If you watch the IAT you will see a lot of addresses beginning with 00C8xxxx or anywhere near this address-range. Though all addresses should be something like 77xxxxxx. Anyway, this is not really my problem, coz I already successfully patched the routine for filling the IAT and everything seems to be ok now.

The main problem I have is that I can't open the dumped exe in OllyDbg. I keeps telling me Unable to start file 'C:\Dumped.exe'. I can't go on if it won't run in the debugger. Do you have this problem too?

Thanks!
Heathcliff
crUsAdEr
06-14-2004, 07:30 AM
nope... i rebuild Import directory completely based on Import dump, didnt use Imprec at all... i can load the program fine with Olly, reloc need to be corrected but i can run it here...

I notice my IAT is a bit higher than yours... i did look at the range RVA 163000-163138 but they are not IAT entries... so perhaps that is why Olly wont load it...
Js
06-14-2004, 07:36 AM
had exactly the same problem recently

try imprec with these options
rebuild original FT
create new IAT
use header from disk

didn't find out what the problem was, too old, fat and lazy now to be bothered but it worked.
Heathcliff
06-14-2004, 07:57 AM
@ crUsAdEr

Well, I'm not really an experienced unpacker, but the first dump I made seems to be wrong. I don't exacly understad what you mean with rebuilding the import directory based on the import dump and correcting the reloc. Could you take a look at how I unpacked (see my first post in this thread) and see what you did different? And could you please explain in a bit more detail? The first dump I made can't be loaded in Olly. I did change the IAT to different addresses already, including the address you gave, but it doesn't seem to matter at all.

@ Js

The first dump I made cannot be loaded into Olly, so it doesn't seem to have anything to do with the reconstruction of the imports. I tried your suggestion anyway, but I still got 'Unable to start C:\Dumped.exe'. Thanks for your help.

Greetz,
Heathcliff
crUsAdEr
06-14-2004, 09:24 AM
hi Heathcliff,

to be honest i dont understand what you did to unpack the program, truth to be told i have not read Ricardo's tut so i dont even know what you are talking abt up there...

if u PM me your email, i will could send u the unpacked.exe's import directory dump...
Heathcliff
06-14-2004, 11:55 AM
Hey crUsAdEr,

I tried to add the dumped IT to my dumped exe. I added a section to my exe and entered the IT offset and size in the header, but still no luck!

Unable to start file 'C:\Dumped.exe' :mad:

The header of the original exe is a bit incomplete (some section offsets and sizes are set to 0). When I try to copy the original header to my exe, the sections are totally screwed.

I starting to feel defeated by those Arma-bastards!

Heathcliff
crUsAdEr
06-14-2004, 12:33 PM
try one of those PE verifier... i think there was one posted recently in exetools forum...
Heathcliff
06-14-2004, 02:46 PM
Well thanks for the tip crUsAdEr! I downloaded PEVerify and it came up with this error:

Error: resource name points out of image 69cb67f1h
File loading error code is 51 (breaked at offset 002b7000h)

I tried to open my exe in Resource Hacker and it gave me an error. If I open the original exe in RH all resources are visible, so they are not packed. My resources were f*cked when I dumped my exe!!

So I then copied the original resource with an hex-editor to the dump with the original IT attached. When I use PEVerify on this exe it says:

Error: imported DLL name points out of image 16b43800h
File loading error code is 56 (breaked at offset 002b5600h)

So there is something wrong with the imports. I am able to open the exe in Olly at this point, but Olly also gives some errors.

As I described in previous posts I did some efforts to reconstruct the imports. I kept this version of the exe and I now have copied the original resource section to the raw-offset in this reconstructed exe. I used PEVerify once again and it now says everything is ok!!

AND I CAN FINALLY OPEN IT IN OLLY AGAIN!!

Pfff! Thanks to PEVerify I can finally continue with normal cracking! And all my efforts to reconstruct the IAT also have payed off! I still don't know why my resource got screwed. I tried dumping on different machines with different dumper-progs. I think the resource-memory is already relocated when I enter the OEP.

Anyway, thank for all the help so far, guys!

Heathcliff
Heathcliff
06-17-2004, 05:18 AM
Damn! This one use Strategic Code Splicing (same sort of thing as Nanomites, but a little bit different). See also: http://www.woodmann.net/forum/showthread.php?t=5330

There is nowhere a good description of how to defeat this.

The easy way is to dump the memory where the spliced code is right after the exe is dumped. It must be done in the same session, because the spliced code is relocated every time you run the exe. You can see where the spliced code is by viewing the jump at 401145 (this is the first jump to spliced code) right after the exe is dumped. The spliced code must be added as a section to the dumped exe. Then add some code which allocates some memory at the same address as the original address of the spliced code and then copy the code to this allocated memory. After this is done the code must jump to the OEP. And the EP must be set to this new code.

The hard way (better) is to intercept the code which overwrites the original code with a jump to the spliced code. Maybe this is not possible when the code is already modified during packing and not at runtime. I haven't found a clue where this might be happening. I'm not even sure this is happening in the parent process or in the child process.

I thought I was almost there. But it seems I still have some work to do. :(

Greetz,
Heathcliff
kyrios
07-05-2004, 03:39 PM
Amazingly, you've returned after 2 years absent. Welcome back m8.
it's good to see you that you never give up.
Try to activate this option in LordPE:
Full dump: paste header from disk.

This option always needed in Arma, SVKP and TElock. Good luck heathcliff.

BR,
kyrios


Texas Instruments Interactive; can someone help me to crack it?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Texas Instruments Interactive; can someone help me to crack it?
PDA

View Full Version : Texas Instruments Interactive; can someone help me to crack it?

tututu42
06-09-2004, 06:57 AM
Hello,

At:Target name not allowed
You find the site from which you can download the trial (version 1.2).

So far I never found a crack for it. Not for version 1.0 nor 1.1 nor 1.2!!
If someone knows how to unprotect it (so it does not work for only 30 days and the nag screen for run or try will appear) please let me know it how to do it.

Sorry for the word "crack" I did not read the forum before posting it!
I hope I can ask for help in "unprotecting" the trial(s); I do NOT know or Understand why crack-request are forbidden here ????

Thanx for understanding my error. I try to watch my words here for the mayby a "little bit" difficult rules.

Thanx for helping

tututu42
Fake51
06-09-2004, 08:36 AM
Hello,

You find the site from which you can download the trial (version 1.2).

So far I never found a crack for it. Not for version 1.0 nor 1.1 nor 1.2!!
If someone knows how to crack it please let me know it how to do or where to download a working crack (version 1.1 is protected with vbox; it has a vboxt420.dll; I do not know yet about the protection of version 1.2)

Thanx for helping

tututu42

Another day, another nitwit, dumbass, shitforbrains, sonofasmackusingbitch, whorefucking maggot from the rectum of a dead goat. Read the fucking rules of the forum you idiot.

Fake
klier
06-09-2004, 08:50 AM
Your post keeps (dis)appearing.Should that mean something? :idea:
http://www.elan2003.com/singing_roaches.html :smug:
Regards,
klier
06-09-2004, 11:02 AM
Now that you have read the faqs(but "I do NOT know or Understand " them),you can search the forum for vbox or something. :hmm:
Regards,
Kayaker
06-09-2004, 11:08 AM
I do NOT know or Understand why crack-request are forbidden here ????

Oh Dear, my communication skills must be woefully inadequate...

Tutu, I explained to you yesterday that this wasn't allowed here. If you still can't figure it out then you're probably in the wrong place to begin with.

I told you I was doing you a favor by deleting your 3 crack/license file requests yesterday :devil:

Kayaker
Fake51
06-09-2004, 12:07 PM
Now that you have read the faqs(but "I do NOT know or Understand " them),you can search the forum for vbox or something. :hmm:
Regards,

You know, since (s)he's too stupid to read AND understand forum policy, (s)he's probably too stupid to understand what to do about vbox too. Not to mention the fact that using Peid on the main executable seems to identify the protection as something else (heck, even a normal peek with notepad reveals that).

Fake
klier
06-09-2004, 12:40 PM
didn't bother to download ..MB.
where can i get notepad? :rolleyes:
Regards,
Woodmann
06-09-2004, 03:34 PM
Hi,
:idea:
Go here:http://world.altavista.com/

Then paste this:http://www.woodmann.net/fravia/rce-faq.htm
into the "TRANSLATE A WEB PAGE" box.

Pick a language you understand and push the translate button.

Woodmann
Rackmount
06-10-2004, 05:05 PM
Fake51: I believe you are being a bit hard on the poor sod. I know the mother and she wont go anywhere near smack...she does crack not smack. Just thought I should clarify that.

Tututu42: Sorry to hear about your surrogate goat mommy dying. She will be missed by all.
Aimless
06-11-2004, 12:53 AM
Looks like he's mistaken this forum with the "ask your crack, wait for 2 days and see the solution" kind of forums that abound on the .ru and chinese sites

And perhaps he should turn more to "www.searchlores.org" to find his cracks rather than the "RCE" forum.

Fake, I think you really scared him off. Poor sod's not gonna post here ever again, I think (or was that really so many requests off him that never made it to this board?)

Have Phun
Fake51
06-11-2004, 03:21 AM
Fake, I think you really scared him off. Poor sod's not gonna post here ever again, I think

With a bit of luck ...

Fake


Help ACprotect Unpack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Help ACprotect Unpack
PDA

View Full Version : Help ACprotect Unpack

Hayalet
06-09-2004, 11:51 AM
Acprotect
is there any tool or a tutorial to unpack it
naides
06-09-2004, 12:13 PM
Hi all,

are the any tutorials or other informations about unpacking a Acprotect packed program out there?

Thanks in advance.

Yes
Hayalet
06-09-2004, 12:40 PM
ACprotect is there any tool or a tutorial to unpack it
MaRKuS-DJM
06-09-2004, 12:43 PM
Yes

LOOOOOOOOOOOOOOOOOOOOL
a very clear answer... but exact to the question :D
JMI
06-09-2004, 02:18 PM
Hayalet:

I appears that you have some difficulties with English. Have you read the FAQ mentioned in the BIG RED LETTERS mentioned at the top of the Forums. If you had read the FAQ, you would know to try the search function here before posting your question.

Go to the search button at the top of the Forums and enter; "ACprotect," without the quote marks, and read the threads you find. You are NOT supposed to ask for tools here.

Regards,
Js
06-09-2004, 02:30 PM
is there any tool or a tutorial to unpack it
_http://www.reteam.org/board/viewtopic.php?t=95
if you understand Bulgarian try this
_http://bb.domaindlx.com/bgrc/article_read.asp?id=16
Hayalet
06-09-2004, 02:50 PM
Ok. Thanks
dELTA
06-09-2004, 08:00 PM
Bulgarian, is there any tool or a tutorial to read it? :D
Js
06-10-2004, 12:53 AM
Bulgarian, is there any tool or a tutorial to read it? :D
Well if Hayalet hapeens to be Bulgarian, possible since there are more than a couple of Bulgarians then he wouldn't need a tool to read read it.
dELTA
06-10-2004, 05:37 AM
Bulgarian, is there any tool or a tutorial to read it? :D
naides
06-10-2004, 05:41 AM
Bulgarian, is there any tool or a tutorial to read it? :D

Da
dELTA
06-10-2004, 05:43 AM
Bulgarian, is there any tool or a tutorial to read it? :devil:
MEPHiST0
06-10-2004, 09:17 PM
acprotect is alot like asprotect :P

just go with that..
naides
06-11-2004, 10:48 AM
Bulgarian, is there any tool or a tutorial to read it? :devil:

Да


Armadillo FingerPrint...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo FingerPrint...
PDA

View Full Version : Armadillo FingerPrint...

DeAtH HaS cOMe
06-09-2004, 05:39 PM
Hi this is my first post hehe
First of all, sorry by my poor english , i'm Spanish :)

Well, the problem is that:
I've a program what is packed with Armadillo 2.20 (analyzed by PeID 0.92, no CopyMem2), the program is a Windows Installer, and when i run it, (it create a Armadillo.tmp, a DLL), i need a hardware key to continue with install (the Armadillo's fingerprint protection), and i found when it decides if the key is good or bad, i patch this, and it store the key in the registry successful, but then there is other password to continue install, and this is also in the Arm DLL...

I found where you must to patch to continue, and i patch it but the program has an exception (It tries to read from a unknown memory site), and program terminates...Any idea??

Thanks for all!
Ciao!!
Heathcliff
06-09-2004, 06:03 PM
Try to open your unpacked exe in a debugger and when it hits the exception you should examin the stack-view to get any clues where the last executed code is. If there is an address of a piece of code in the code-section of your target, then reload the process and set a breakpoint at the address you found. Then start it and when it hits the breakpoint, you keep hitting F7 and watch what is happening there and look for the cause of the exception. Solve this problem. It is probably an unresolved call to the parent-process you stripped, or to an unresolved IAT-entry, or you might just have missed something when you unpacked it.

Hope this helps (I ain't have much experience either)
Heathcliff
DeAtH HaS cOMe
06-10-2004, 02:57 AM
yeah, i know... but i don't unpack the program, because i can't find the OEP, i need first the KEy and password to can execeute installation normally, so i can't unpacked it :(.
And the exceptions happens when the program try to extract the installation

Well, I will looking for...

Thanks HeathCliff!

Ciao!


flexlm 8.1a feature problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > flexlm 8.1a feature problem
PDA

View Full Version : flexlm 8.1a feature problem

huangcd
06-10-2004, 02:08 AM
I have encounted a problem when trace into a daemon with SI.

With SI i found the job structure and vendor structure. I decided to use these two structure data to regenerate the encrypted seed1 and 2 and generate the license via SDK . But now the problem is : where are the features? I searched through all the daemon exe files with IDA and still the daemon do not break at lc_checkout() or l_checkout() in Softice. where can i find them ?

thx,
redsk_y
06-10-2004, 02:18 AM
huangcd,

Usually the daemon doesn't include any features. You have to
find them in the client or in the target.

--rs
huangcd
06-10-2004, 04:38 AM
huangcd,

Usually the daemon doesn't include any features. You have to
find them in the client or in the target.

--rs

redsk_y,

thanks for ur reply. I once checked the target exe file. But it is too big with 18M bytes. Yeh,u r right. Maybe i should find the features in the target.

thx


with one valid NAME & KEY
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > with one valid NAME & KEY
PDA

View Full Version : with one valid NAME & KEY

cell_phreaks
06-10-2004, 02:21 AM
:( i m very new to this forum this iz my very first post i hope u people will not disappoint me my problem iz I have one application protected ARMADILLO it alwayz ask me for NAME & KEY N show HARDWARE FINGERPRINTS for my PC.
i have one valid name and key for different hardware finger prints !!! Is there any option with which i can fool this protection or ANY tutorial regarding same problem or step by step explanation ?

plzzzzzzzzzz thanx in advance
cell_phreaks
06-10-2004, 03:20 AM
@LEAST give me thread or site where the same problem discussed ??

waiting........
dELTA
06-10-2004, 05:41 AM
Here's a link for you: http://www.woodmann.net/forum/search.php

PS. I think you have mistakenly mixed up the "s" and "z" buttons.
cell_phreaks
06-10-2004, 10:13 AM
already tried out searching but all vain!! ANYONE PLZZZZZ
Rackmount
06-10-2004, 04:55 PM
Ok....so you say you searched....perhaps we can assist in your searching techniques...what search engine did you use and what did you enter into the search engine? How many hits did the search results find? Did you try any other search engines? Try re-ordering the seach terms....does this change the results? If you are unable to search and find information, you will most likely not be able to understand the material even if you found your "step by step" guide. While this forum is for newbies, stating you are a newbie will not make anyone fall over themselves to assist you if you cannot show what you have done to help yourself. Also, as far as I am aware, there are no penalties for using more than 100 words to explain your situation. So go on and tell us in detail what you have done, what tools you have used, and anything else that might make it seem like you are trying to work this out on your own and not just seeking a quick fix.
Woodmann
06-10-2004, 06:06 PM
If I only had a dollar for everyone who said they had searched.........

I beg people to ask me how to better their efforts at searching.

Now, the first thing you need to understand (and this goes for all newbies)
is that you cannot just open up your program with a hex editor and change a call and have a working app. It will NOT happen.
You have to have a MORE then basic understanding of all things associated with RCE. If you want a 5 minute fix, you want something called a CRACK.
We do not have those things here.

How do you gain such abilities ??? You start with tutorials and some reference manuals.
Here is an example:http://www.woodmann.net/forum/showthread.php?t=5836&highlight=armadillo+hardware

There is no end result to this thread because the person who asked the question either did not understand the tips or just never posted his success.

I think it was the former.
You owe me a dollar for doing your search. :smug:
cell_phreaks
06-11-2004, 02:00 AM
well respected ADMIN & MEMBERS THANX FOR UR ANSWER i have searched this forum many many times before posting my very first query
@WOODMANN i had also seen this (http://www.woodmann.net/forum/showthread.php?t=5836&highlight=armadillo+hardware) before ur post even downloaded the tutorial for unpacking armadillo 3.40 by LOWNOISE But the tutorial has something missing i.e (OS to use)

@Rackmount
after reading the tutorial i m confused about two things
1=OS to use(for me its working in XP only)
2=it is for wat>is it for fooling time limitation or for hardware protection?

EVEN after that i have tried it on my applet the tutorial is in three parts 1st part says change the two bytes EB FE witch stands for JMP EIP (successfully done)after that it says if u r getting EAX is =00000001 in the (FPU)the operation was successfully completed (THIS IS ALSO DONE) AFTER THAT i got the process ID n attached successfully after that when i run the application by PRESSING (F9) IT should give me the JMP EIP loop for restoring the original bytes @ this point i m not getting the two byte but three bytes and also not getting the splash screen!!

i m really confused.......
Rackmount
06-11-2004, 11:43 AM
What operating system....hmmmmm...lemme see...

"Manual Unpacking Armadillo

--------------------------------------------------------------------------------

Here is my little contribution to this Board

This tut is based on my notes of this app, This is the second time i unpacked a armadillo app so the info in this tut may not be completely correct
because i make use off the DebugActiveProcessStop api it works only on WIN2K / XP or above

Have fun with this tut, and don't look at the crappy english
lownoise"

This was taken from site where Lownoise posted his tut....can you tell the OS now?

Question # 2...most likely it encompasses both aspects if they are involved in the protection scheme, otherwise the end result wouldn't be a working solution
cell_phreaks
06-12-2004, 02:26 AM
hey guys
i have done some more effort now ORIGINAL BYTES restored successfully n also getting the (SCREEN) NOW the tutorial telling me
((The splash screen is executed in the armadillo code that means that we haven't passed the Oep. To locate OEP we set a memory breakpoint at the first section after the Pe header))

CAN SOME ONE TELL ME THE ABOVE LINES IN EASY WORDS

THANX IN ADVANCE
cell_phreaks
06-12-2004, 10:32 AM
IF IS THERE ANYONE WHO HAVE TUTORIAL FOR PATCHING ram WITH GOOD WORKING valid key ,name & hardware fingerprints plzz tell me i need it badly plzzzzzzzz
dELTA
06-12-2004, 08:19 PM
There still seems to be a problem with your "z" key...
Fatty[NegX]
10-05-2004, 07:51 PM
wow he haz the exact zame problem az my keyboard doez, I think zomeone patched my keyboard driverz...........
JMI
10-05-2004, 11:07 PM
We really don't need you to chime in with such comments four months after the last post in the thread. It had little redeeming value to begin with. It would seem that you are just interested in seeing you nick on the Board.

Regards,


softice 4.05 and WINME, black screen on start-up....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softice 4.05 and WINME, black screen on start-up....
PDA

View Full Version : softice 4.05 and WINME, black screen on start-up....

clip
06-10-2004, 10:12 AM
***EDIT.... i searched the forums and found a post to fix my problem, but i could not post a reply in that forum for whatever reason. here is what my reply was gonna be,.....**

sorry to bring back such an old post, but i'm a noob and i searched the forum for my problem and this thread is exactly what happens to me.

as you can tell, those links are dead. wutever0 is unregistered so no email to contact him.

i have winme. i installed the debug kit for winme. installed softice 4.05..?? changed debugger.exe with a new one. i restart windows only to come to a black screen with a blinking underscore iin the upper left corner. so after about 5 mins of waiting, i hit Enter and a full screen of softice blinks for a split second, then the screen goes black again and windows continues loading. then another screen comes up saying the AVG could not load. thats my anti-virus program. i hit enter to bypass the screen. now windows loads fine afterwards. i hit ctrl-D and softice pops up!! Great!!

so my problem is, there is no winice.exe in the autoexec.bat. the config.sys is blank. everytime i boot windows, i have to press enter to get past the black screen and press enter again to bypass the anti-virus app could not load, please re-install AVG..

so how do i solve this black screen, and AVG not loading? i heard of a Dos patch for winme, but i have not tried it. will this help? does anyone have a mirror of the above links or the files needed?

btw, i uninstalled softice and had to rename the debugger.exe to another file to load windows properly. including AVG. nothing in autoexec.bat references debugger.exe. so where does this file come from in the startup process. is there an .ini file?

hope someone can help. thanx.
clip
06-10-2004, 10:13 AM
heres the post i was refering to,

http://www.woodmann.net/forum/showthread.php?t=451&highlight=black+screen
Aimless
06-11-2004, 12:49 AM
Windows ME is half 98 and half NT.

You will not find any entry for ICE in config or autoexec (that's the domain of the 95-98-98SE)

Instead, ICE is implemented as a driver. This driver is loaded at runtime (you can also change it to load after windows loads).

The black screen that you see is the SOFTICE Universal Video Driver being loaded.

Perhaps your AVG does not like SoftICE or cannot run on a patched video driver.

If you want to remove the black screen do this:

1. Go to C:\
2. Open the file boot.ini
3. Remove the /nogui option
4. It works.

And we have to do something about the AVG of yours. If you're not using McAfee or Norton, you're not using anything.

Have Phun
clip
06-11-2004, 10:47 AM
thanks for the reply.

i'll try this out a little later. btw, how do i get softice to load after windows loads?
clip
06-11-2004, 10:22 PM
ok, i just checked my C:\ drive in the root and there was no boot.ini file. i even had " show hidden files on"...??? where is it?

anyway, after uninstalling Softice a few days ago, i noticed my cd drive no longer works. no power to it and the bios does not recognise it.

does softice install or replace certain drivers, then when uninstalled, it uninstalls a needed driver to detect the cd drive.??? i mean, the cd drive isnt even in the device manager.

any help here.?? thx.
esther
06-11-2004, 10:50 PM
>anyway, after uninstalling Softice a few days ago, i noticed my cd drive no longer works. no power to it and the bios does not recognise it.

>does softice install or replace certain drivers, then when uninstalled, it uninstalls a needed driver to detect the cd drive.??? i mean, the cd drive isnt even in the device manager.

Buy another cd drive,find a loader wmldr.It works for winme
clip
06-12-2004, 10:55 PM
hmmm, i wanna get my cd drive working before i mess with softice again.

i opened my pc and the connections were good. but the bios still doesnt detect it. funny thing in windows is that i have 2 hard drives on the 1st IDE slot, master and slave, and the slave HD is acting strange too. i cant open any .exe's. it creates a page fault in itself..?? NO VIRUSES either!

the cd drive is on the 2nd IDE master by it self. not detected.

ok, this is the second time this has happened actually. i'm just remembering. a few weeks ago my cd drive was working fine, then i tried installing softice and messing with it only to find out it did not work. so i uninstalled it. the next day i noticed my cd drive wasnt working and my 2nd HD wasnt working great either. i didnt know why.?? then a few days later, my bro got it working while i wasnt home. everthing worked fine, even my HD. i dont know how he did it and i didnt ask.

so now, just a few days ago i read on the net about winme compatibility with softice and the winme ddk debug kit. i needed to install that to get softice working. so i did and then installed softic, set it up right. rebooted, got the black screen, AVG could not load....blah ......blah. skipped that screen , loaded windows and bam, softice loaded. i didnt like the black screen etc, so i uninstalled softice. the next day, my damn cd drive isnt working again..!!!! see a coincidence??? uninstalling softice removes my cd drive and it doesnt work or whatever...!!!

so before i tell my bro to fix my pc,......again, i'm wondering if you softice experts can figure this one out. what exactly does softice install? does it replace any .dll's, vxd's etc?? i wanna get my cd drive working again , before i ask my bro to fix it.

thx.
esther
06-13-2004, 12:31 AM
SOFTICE WILL NOT CHANGE YOUR BIOS SETTNGS :rolleyes:

SOFTICE WILL NOT DISABLED WHATEVER EXE HDD. :rolleyes:

You should check your bios seetings if its all auto. :rolleyes:

You should change your ide cable. :rolleyes:

You should find a technician and check it :rolleyes:
Silver
06-13-2004, 11:16 AM
Totally OT, but that sounds exactly like what DaemonTools did to one of my systems once. Installed it, all sorts of problems, CD drives vanishing & harddrives on the blip. Removed it, everything back to normal. Wierd, and now I use Alcohol.
clip
06-13-2004, 12:16 PM
my bios settings are all auto.

i swear that softice is the culprit. i know it is. the sad thing is that all my apps are on the 2nd hd and i cant load nothing from that hd. i'll download softice again to my master hd and install it to see if my cd drive comes back alive.

man, this sux.
clip
06-19-2004, 10:57 PM
ok, i finally fixed it.

i installed my old cd drive to see if the connectors were working ok. they were and windows installed the old drive.

i then shut down and powered off. i installed my cdrw. and turned on the pc. the cd drive powered on!!!!! and windows installed it. how the hell did it work like that?? thats crazy.

anyway my cdrw drive is working again, wooohooo!!!
cyberbarty
06-21-2004, 07:16 PM
Softce doesnt work with AVG loaded
if you F8 at startup and step through and press N to the AVG lines it will load

i use a windows loader which was written by the icedump team and find it excellent
u just put it into C:\WINDOWS\SYSTEM\VMM32 and copy 3 files into windows folder and u can select whether to load Softice or not every time
:)


.NET RCE Info: Salamander obfuscator Anti-ILDASM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > .NET RCE Info: Salamander obfuscator Anti-ILDASM
PDA

View Full Version : .NET RCE Info: Salamander obfuscator Anti-ILDASM

nikolatesla20
06-10-2004, 02:40 PM
I played with this today and made a nice little info HTML if anyone might be interested.

.NET apps can't really be "protected" perse'.

This is a small reversing of the Salamander .NET obfuscator, it has an anti-ILDASM feature, so I wanted to learn how it crashes ILDASM. Here's what I found. This may have been found before somewhere out there on the net but we don't have much .NET info here so I decided to post it.

This is good old hand reversing.

Also, for .NET 2 good books to grab are:

SAMS - .NET Common Language Runtime Unleashed
MSPress - Inside Microsoft .NET IL Assembler

These two books will be invaluable for RCE'er's of the future..you can find both of these on the web if you look hard enough (emule).

Also, these protector authors are high on crack, the other day (last week) Their price was $799 for 1-5 devs, now I see it's $1399. Who the heck is going to pay that I don't know..

-nt20
volodya
06-10-2004, 03:55 PM
M-m-m. Question. It is just that trivial? Only header modification? Does it add something other? Does it obscure .NET asm?
nikolatesla20
06-10-2004, 04:04 PM
No, the obfuscator screws the header like above, then it also randomizes any object strings. For example, a Form's name would go from something like "MyForm1" to "A", which would make no contextual sense then to anyone reverse engineering the program.

The real problem is that you must leave all system object references in place, or the program just won't run. For example, you can't rename the string "System.Windows.Forms.Form". So even though the form name is changed, you still know it's a form ! Because the disasm will still show it inherits from a Form !

Mind you, I am talking simply about the obfuscator, not the "protector". The protector converts the IL code to machine code (which the JIT compiler does normally anyway), to help "hide" what's going on from any .NET disams. Of course once it does this it's open to normal disasms !

I still think this tool is somewhat pointless because .NET SDK comes with a tool to convert your IL program to machine code. It's called NGEN: here is a quote from the book:

A managed executable can be precompiled from IL to the native code, using the NGEN utility. You can do this when the executable is expected to run repeatedly from a local disk, to save time on just-in-time compilation. This is standard procedure, for example, for managed components of the .NET Framework, which are precompiled during the installation. (Tom Archer refers to this as install-time code generation.) In this case, the precompiled code is saved to the local disk or other storage, and every time the executable is invoked, the precompiled native-code version is used instead of the original IL version. The original file, however, must also be present because the precompiled version does not carry the metadata.

-nt20
dELTA
06-10-2004, 05:38 PM
Cool, thanks for the upload nt20. :cool:
SiNTAX
06-11-2004, 04:55 AM
Probably old news, but if you're interested in .NET stuff, then be sure to check out MONO (hxxp://www.go-mono.com) and Portable.NET (hxxp://www.dotgnu.org), which are opensource implementations of the CLR and class libs.
MrAnonymous
06-11-2004, 07:16 PM
Obfusticators help curve piracy abit, unmanageled .net code is rediclously easy to crack in most cases. You maybe interested at looking at thinstall, it links a .NET exe and protects it so it can be run without the .net framework.
No, the obfuscator screws the header like above, then it also randomizes any object strings. For example, a Form's name would go from something like "MyForm1" to "A", which would make no contextual sense then to anyone reverse engineering the program.

The real problem is that you must leave all system object references in place, or the program just won't run. For example, you can't rename the string "System.Windows.Forms.Form". So even though the form name is changed, you still know it's a form ! Because the disasm will still show it inherits from a Form !

Mind you, I am talking simply about the obfuscator, not the "protector". The protector converts the IL code to machine code (which the JIT compiler does normally anyway), to help "hide" what's going on from any .NET disams. Of course once it does this it's open to normal disasms !

I still think this tool is somewhat pointless because .NET SDK comes with a tool to convert your IL program to machine code. It's called NGEN: here is a quote from the book:

-nt20
SiNTAX
06-14-2004, 03:05 AM
Obfusticators help curve piracy abit, unmanageled .net code is rediclously easy to crack in most cases. You maybe interested at looking at thinstall, it links a .NET exe and protects it so it can be run without the .net framework.

Don't you mean managed instead of unmanaged ?!

Managed = .NET code
Unmanaged = i386 code (or whatever processor you're targetting)
TQN
06-14-2004, 08:15 AM
Hi nikolatesla20 !
Do you have ever try with other .NET obfuscator, ex: DotObfuscator installed with VS .NET 2003, WiseOWL...As I know, .NET obfuscators did not obscure IL code, and it replace method name, class name, variable name... with obscure name. Do you think a tool will named as Deobfuscator .NET is available ???
Regards
nikolatesla20
06-14-2004, 09:46 AM
I have the .NET SDK but I for some reason wasn't able to find the DotObfuscator program that supposedly comes with it yet...

-nt20
zacdac
06-15-2004, 02:41 AM
g'day

Just to fill in some blanks..

The DotObfuscator Community Edition v1.2 is shipped with Visual Studio 2003 and not the sdk ...

From memory the community edition of dotobfuscator doesn't have the anti-ILDASM feature ...

The online version of remotesofts decompiler includes a string de-obfuscator ...

The method of inserting invalid meta data to disable decompiling only works for those decompiliers that use the refelection api to do their work.
Other decompiliers such as IDA (which are not based on the reflection api) will decompile the invalid meta data in the target without any problems.

Zac


Softice (driverstudio 2.7)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice (driverstudio 2.7)
PDA

View Full Version : Softice (driverstudio 2.7)

Bmsfx
06-10-2004, 04:14 PM
Okay so i got my hands on this supposedly nifty tool, installed it, startet it, and opened symbol loader (after downloading some symbols like winsock and so on)

loaded my "project to crack" into it, then hit "load"

the game startet, and ... nothing..

what am i supposed to do with this tool ? isnt there supposed to start some debugging screen or something in the background showing what the game is doing or ?

i tryed seaching for some tutorials on how to use it on winxp and so on, but found nothing useful.

i did try searching this forum also.

(note softice is startet, since i can see symbols that have been loaded in the left side of symbol loader)

am i supposed to do/start something else ?
doug
06-10-2004, 04:56 PM
Okay so i got my hands on this supposedly nifty tool, installed it, startet it, and opened symbol loader (after downloading some symbols like winsock and so on)

loaded my "project to crack" into it, then hit "load"

the game startet, and ... nothing..

what am i supposed to do with this tool ? isnt there supposed to start some debugging screen or something in the background showing what the game is doing or ?

i tryed seaching for some tutorials on how to use it on winxp and so on, but found nothing useful.

i did try searching this forum also.

(note softice is startet, since i can see symbols that have been loaded in the left side of symbol loader)

am i supposed to do/start something else ?

SoftICE ships with a manual in pdf format, you should read it first.

New trend: Saying you have done your research, but really haven't.
Bmsfx
06-10-2004, 05:44 PM
hint, I HAVE READ IT..

but i dont get anything its saying, all about network debugging and crap, i dont need that..

i just need to debug on this single machine..

btw, i got it to popup during a game when it crashed (it poped inside the game window)

but what i need is it to run constand in the background, checking everything, not only when a game crashes.

new trend : bashing people instead of actually helping.

or maybe you just dont know the answer to the question no?

in IDA it was simple, load the exe, hit the "debug file" option, and wrooms, but sadly this program detects that, so IDA is useless.
doug
06-10-2004, 07:02 PM
a simple search on this board returned 25 matches for topics relevant to what you want. Maybe you should refine your search by using keywords such as:

softice break WinMain
Break and Enter

"Using SoftICE.pdf" also contains everything you need.

The fact that this same question has been asked dozens of times already just proves that you didn't search for more than 5minutes, like the others.

This is about the most simple thing you can do with softice, yet it's the one that generates the most (identical) questions.

The reason softice poped up when your game crashed is because you have FAULTS on.

Furthermore, if the app you are debugging detects IDA's debugger, it will probably also detect softice. You will have to investigate that too before you say that SoftICE is also "useless". Plenty of documention on this forum for that as well.
JMI
06-10-2004, 07:44 PM
Again proving that the "brain" is the most important reversing tool. You need to "think" what your problem is and the what terms may apply, and then search for information on your topic.

Regards,
Bmsfx
06-10-2004, 08:54 PM
thanks you, i didnt know it was softice break WinMain that might be the problem :) was all you had to say

search for softice break WinMain.

and that would been it..

i didnt mean to offend anyone, but it seems lately people are more busy making a jery springer show out of everything then actually just post a quick reply..

im here because im not good at this, thats why i asked, i really had no idea it was about winmain.

but if thats because im dumb them im sorry, but some people are dumb, cant change that :D
JMI
06-10-2004, 10:51 PM
Bmsfx:

You need to clearly understand the difference between being "dumb" and being "lazy." You were being teased for at least appearing to be "lazy." We generally don't tease people who have actually tried to help themselves but "just don't get it."

Part of the problem is that you either did not read the FAQ listed at the top of the Forums, or chose not to follow it's directions. We can't tell which from what you post. You were supposed to explain what you had already done to try to help yourself.

Softice is a complex tool and it is NOT suprising that you would not completely understand how it works the first time you tried it, but it is also NOT reasonable that you did not give ANY indication that you had taken the most basic step of self-help, reading the manual, before you posted your question.

The second thing is that your problem with softice not breaking on entry of the program is an issue that has been previously discussed in many threads. This again means that you appeared not to have followed the FAQ instructions on doing a search here and possibly on the net for the solution to your problem before expecting someone else to solve it for you.

You will protest that you didn't know "what" the problem was to search for the right topic, but you fail to recognize that the main reason you didn't know what you might need to look for was that you failed to take the time to do adequate research before you started "cracking." This is a fairly common problem with those who lack the patience to attempt to learn how reverse engineering actually works before the actually start "reversing." For example, you know we have a "Tools of the Trade Forum" and if you had actually spent any significant time simply reading threads about problems using softice, you would have seen many, many threads discussing the issue of Softice not breaking on winmain and how to try to solve it.

So here's a test for you. Pretend you actually know how to reverse engineer, after having spent considerable time actually reading materials on the subject and having gotten your feet wet by trying many different protection systems. Now read the actual words you wrote in your first post, and tell us whether or not you would have concluded that the author of that post had demonstrated any personal effort at solving his own problem.

Then observe that, even though the poster did not evidence any self-help effort, he was actually told how he could find the answer to his question, and you will see that he responded with complaints that he was asked to do some of the finding and studying of that information "on his own first." Then see if you would have much patience with his complaints that someone didn't take him by the hand and spoon feed him what should have been an easy answer to discover with a little more effort.

Regards,
naides
06-11-2004, 03:22 AM
Bmsfx:

You need to clearly understand the difference between being "dumb" and being "lazy." You were being teased for at least appearing to be "lazy." We generally don't tease people who have actually tried to help themselves but "just don't get it."

Part of the problem is that you either did not read the FAQ listed at the top of the Forums, or chose not to follow it's directions. We can't tell which from what you post. You were supposed to explain what you had already done to try to help yourself.

Softice is a complex tool and it is NOT suprising that you would not completely understand how it works the first time you tried it, but it is also NOT reasonable that you did not give ANY indication that you had taken the most basic step of self-help, reading the manual, before you posted your question.

The second thing is that your problem with softice not breaking on entry of the program is an issue that has been previously discussed in many threads. This again means that you appeared not to have followed the FAQ instructions on doing a search here and possibly on the net for the solution to your problem before expecting someone else to solve it for you.

You will protest that you didn't know "what" the problem was to search for the right topic, but you fail to recognize that the main reason you didn't know what you might need to look for was that you failed to take the time to do adequate research before you started "cracking." This is a fairly common problem with those who lack the patience to attempt to learn how reverse engineering actually works before the actually start "reversing." For example, you know we have a "Tools of the Trade Forum" and if you had actually spent any significant time simply reading threads about problems using softice, you would have seen many, many threads discussing the issue of Softice not breaking on winmain and how to try to solve it.

So here's a test for you. Pretend you actually know how to reverse engineer, after having spent considerable time actually reading materials on the subject and having gotten your feet wet by trying many different protection systems. Now read the actual words you wrote in your first post, and tell us whether or not you would have concluded that the author of that post had demonstrated any personal effort at solving his own problem.

Then observe that, even though the poster did not evidence any self-help effort, he was actually told how he could find the answer to his question, and you will see that he responded with complaints that he was asked to do some of the finding and studying of that information "on his own first." Then see if you would have much patience with his complaints that someone didn't take him by the hand and spoon feed him what should have been an easy answer to discover with a little more effort.

Regards,

That concludes my closing statement, you Honor. Unless the defense calls for further discusions, I move for a prompt bench decision.


Prevent application from receiving messages
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Prevent application from receiving messages
PDA

View Full Version : Prevent application from receiving messages

diz
06-11-2004, 08:54 AM
I would like to not allow some message (WM_CLOSE) to be received by some application. I mean, when I click on X in top right corner, I want the app to do nothing.

I though that it would be easy. I tried to set up a hook in to message queue. I used Iczelion tutorial and modified his sample a little:

GetMsgProc proc nCode:DWORD,wParam:DWORD,lParam:DWORD
; invoke CallNextHookEx,hHook,nCode,wParam,lParam
mov edx,lParam
assume edx:PTR MSG
.if [edx].message==WM_CLOSE
invoke MessageBox,NULL,offset caption,offset caption,MB_OK
.endif
assume edx:nothing
xor eax,eax
ret
GetMsgProc endp

InstallHook proc hwnd:DWORD
push hwnd
pop hWnd
invoke SetWindowsHookEx,WH_GETMESSAGE,addr GetMsgProc,hInstance,NULL
mov hHook,eax
ret
InstallHook endp
But it does not react on WM_CLOSE. Messagebox never popups, whenever I close some other application or app that sets the hook.
I also not sure, when (and do) I need to call CallNextHookEx function. It seems to make no difference.

What am I doing wrong? Maybe it's not possible to prevent app from receiving message?
JimmyClif
06-11-2004, 10:25 AM
Check out the Hook Library.. If I remember correctly he suppresses WM_CLOSE in one of his example codes.

http://board.win32asmcommunity.net/showthread.php?s=&threadid=14463&highlight=hook

Cheers,
JC
diz
06-11-2004, 01:36 PM
Very mucho thanks. It seems to do the trick.

Now I stumbled across another (even harder I think) problem. I need to limit blocking just to main windows, and not subwindows (or childs). But that's another story and I will try to do it by myself.

Thanks again :)
JimmyClif
06-11-2004, 02:24 PM
No biggie..

Use a FindWindow and grab the handle of the app you want to hook. Then call GetWindowThreadProcessId using that handle. Now you got the thread id. Use it for the SetWindowHookEx call. Voila. Only your app gets hooked.
diz
06-11-2004, 03:00 PM
Yeah, I already have ThreadId because I'm creating this process with CreateProcess.

But I must filter messages _within_ this thread because too much is blocked. For example menus are impossible too close, tabs etc.

The only thing, I want to block is closing of the main window. I'm not sure if this is possible (but I didn't looked into it yet).
Fake51
06-11-2004, 04:32 PM
Yeah, I already have ThreadId because I'm creating this process with CreateProcess.

But I must filter messages _within_ this thread because too much is blocked. For example menus are impossible too close, tabs etc.

The only thing, I want to block is closing of the main window. I'm not sure if this is possible (but I didn't looked into it yet).

Just screen for hWnd. Get it from FindWindow.

Fake
dELTA
06-11-2004, 04:34 PM
Subwindows use the message queue of the main window, simply filter the messages based on the hWnd parameter from your hook procedure to get the ones you really want.

EDIT: Damn Fake51, where are your manners, squeezing past me right on the goal line like that. :p
JimmyClif
06-11-2004, 05:48 PM
Try it with WH_CALLWNDPROC as hook instead of the WH_MSGFILTER.
SheepShagger
06-11-2004, 06:02 PM
EDIT: Damn Fake51, where are your manners, squeezing past me right on the goal line like that. :p

Don't complaint to much, you just did that to me in the crypto forum :D
dELTA
06-11-2004, 06:55 PM
You should only know what I did just now to you in that same thread in the crypto forum then... :p
diz
06-11-2004, 07:55 PM
Before I try with FindWindow (can be hard because window title is not constant), I tried with WH_CALLWNDPROC hook.

Yes, it catches WM_CLOSE, but I have no idea how to prevent WM_CLOSE from closing app.

This is a code snippet:
GetMsgProc proc nCode:DWORD,wParam:DWORD,lParam:DWORD
mov edx,lParam
assume edx:PTR CWPSTRUCT
.if [edx].message == WM_CLOSE
invoke MessageBox,NULL,offset caption,offset caption,MB_OK
.else
invoke CallNextHookEx,hHook,nCode,wParam,lParam
.endif
assume edx:nothing
xor eax,eax
ret
GetMsgProc endp

InstallHook proc hwnd:DWORD
push hwnd
pop hWnd
invoke SetWindowsHookEx,WH_CALLWNDPROC,addr GetMsgProc,hInstance,NULL
mov hHook,eax
ret
InstallHook endp
I you are looking at this code, and thinking 'WTF is this?' than feel free to correct me, cause I did some coding on my own and it can be very inncorect ;)

I also have another code - a modified version of the Hook Library (thx JimmyClif) which uses WH_CBT hook and reacts on HCBT_DESTROYWND message.
This one prevents closing, but as I said before, also affects menus, tabs and every other widget. And I don't know how to get hWnd here without using FindWindow (like I said, window title changes).

The first version (using WH_CALLWNDPROC hook) seems better because it has CWPSTRUCT struct which holds hWnd of window. There is just the problem with preventing WM_CLOSE from happening. Maybe it's not possible this way? Maybe it's already too late when WM_CLOSE is sent?
dELTA
06-11-2004, 08:12 PM
About the FindWindow call, you can use it with window class strings only, and I guess the window class doesn't change?

Also, if there is some pattern whatsoever to the changes of the window title (e.g. some static string followed by the name of the current open document/page/resouce/whatever, as is quite common), you can always enumerate all top-level windows and perform whatever string matching operation you want on their titles to find the one you want. You can even enumerate them and resolve the name of each of their executables, which should be effective no matter how much their window titles or even window class strings change. Go get 'em. :)
JimmyClif
06-11-2004, 10:21 PM
You're right... WH_CALLWNDPROC hook can only examine the message but not modify it. This time I actually read a little bit about it, so try this:

GetMsgProc proc nCode:DWORD,wParam:DWORD,lParam:DWORD
mov edx,lParam
.if [edx].MSG.message == WM_CLOSE
invoke MessageBox,NULL,offset caption,offset caption,MB_OK
.else
invoke CallNextHookEx,hHook,nCode,wParam,lParam
.endif
xor eax,eax
ret
GetMsgProc endp

InstallHook proc hwnd:DWORD
push hwnd
pop hWnd
invoke SetWindowsHookEx,WH_GETMESSAGE,addr GetMsgProc,hInstance,NULL
mov hHook,eax
ret
InstallHook endp
Fake51
06-12-2004, 05:57 AM
Subwindows use the message queue of the main window, simply filter the messages based on the hWnd parameter from your hook procedure to get the ones you really want.

EDIT: Damn Fake51, where are your manners, squeezing past me right on the goal line like that. :p

Sorry bout that, mate, wasn't intentional. Just here to help. ;)

Fake
SheepShagger
06-12-2004, 12:58 PM
You should only know what I did just now to you in that same thread in the crypto forum then... :p

Your move :devil:
diz
06-12-2004, 01:44 PM
You're right... WH_CALLWNDPROC hook can only examine the message but not modify it. This time I actually read a little bit about it, so try this:
The WH_GETMESSAGE hook also catched the WM_CLOSE message, but... too late - app window was already closed then.

So I went back to Hooklib and made more changes to handle app recognition.
Finding window by class wasn't working, because it catched some other window of this app (which had same class).
As a last resort I tried dELTA tip with EnumWindows. This one in fact worked (thanks dELTA :)). Thanks to constant string that is appended to window title.

So i already achived what I wanted to achieve :)
Last step is to send keystroke to this app. I need to send CTRL+H.

I tried:
invoke SendMessage,windowHandle,WM_KEYDOWN,VK_CONTROL or VK_H,0
invoke SendMessage,windowHandle,WM_KEYUP,VK_CONTROL or VK_H,0
but without luck so far.

Does somebody have other ideas how to send this keystroke?
I hope it's not a showstopper, it would be a shame now, when 90% of hook is done ;)
dELTA
06-12-2004, 08:31 PM
Press that key combination manually, then hook the message(s) it results in and make an exact duplicate them, that should work. :-)
JimmyClif
06-12-2004, 09:26 PM
what about sending first the VK_CONTROL and then a "H" ?
Silver
06-13-2004, 07:37 AM
IIRC you modify the LPARAM of the message to indicate if alt, control etc have been pressed. Been a while since I've done this though. Use Delta's suggestion, get a copy of Spy++ and trap all the messages to a window, then see what the exact params were for the control-h.
diz
06-13-2004, 08:59 AM
Unfortunetly it does not use standard wm_keydown for keystrokes (nor wm_command and any other message - spy++ shows nothing when pressing for example CTRL+H).

I am a little bit confused. Does it means that the app is not using windows messages for controlling itself? This program is multiplatform so I guess it's the reason for not using windows specific solutions.

It's Opera browser by the way (I'm not about cracking so I think I'm safe with telling the name).
dELTA
06-13-2004, 09:15 AM
You already have your own message hook procedure installed, right? Why use third-party programs when you can use your own hook and be sure that it works exactly as you like? Just capture all the messages with your own hook to see which they are. If you still don't get any messages at all in that one either, then something is fishy, but I really think you will.
diz
06-13-2004, 10:50 AM
Ok, I used spy++ and saw that some of the child windows were receiving normal WM_KEYDOWN/KEYUP messages.
So I tried sending this to the top level window and it kinda works. It wasn't working before, because I used SendMessage (when I should have used PostMessage :rolleyes:).

So I replicated sending keystroke with this:
invoke PostMessage,windowHandle,WM_KEYDOWN,VK_CONTROL,1D0001h
invoke PostMessage,windowHandle,WM_KEYDOWN,VK_H,22001h
invoke PostMessage,windowHandle,WM_KEYUP,VK_H,0C0220001h
invoke PostMessage,windowHandle,WM_KEYUP,VK_CONTROL,0C01D0001h
The lParam is taken from spy++. Unfortunately it's just sending H key, control seems to be omitted (same with 0 as lParam).
And I don't understand what's the problem.
Silver
06-13-2004, 11:10 AM
Thats interesting. When I do the same with Spy++ on any random app, I get a WM_KEYDOWN with WPARAM 48 and LPARAM 230001 for the H key. Where are you getting 220001?

Incidentally, my bad, I double checked. Control key isn't a modifier for a keypress message, the sequence is exactly as you've written - control down, h down, h up, control up. The difference is the control modifier not triggering TranslateMessage() to convert keydowns to WM_CHAR.
diz
06-13-2004, 11:17 AM
Yeah, lParam is bad in above code. It was for VK_G which I tried before.

I'm going to do some more testing, maybe I will make it work somehow.
diz
06-13-2004, 05:46 PM
I did some test and I must say that it's a little beyond me ;)

Tests were done on CTRL+SPACE keystroke and spyed with spy++.

Normal pressing by keyboard produces this:
invoke PostMessage,win,WM_KEYDOWN,VK_CONTROL,001D0001h
invoke PostMessage,win,WM_KEYDOWN,VK_SPACE,00390001h
invoke PostMessage,win,WM_KEYUP,VK_SPACE,0C039001h
invoke PostMessage,win,WM_KEYUP,VK_CONTROL,0C01D0001h
Well, it's already changed to invokes but you know what I mean.

Now, I've put this into simple asm app. Then I runned spy++ again and checked what this time the program is receiving.
To my suprise, the results are:
-------------------
scrap all this, was error in lParam (wrong cRepeat)
P WM_KEYDOWN nVirtKey:VK_CONTROL cRepeat:1 ScanCode:1D fExtended:0 fAltDown:0 fRepeat:0 fUp:0
P WM_KEYDOWN nVirtKey:VK_SPACE cRepeat:1 ScanCode:39 fExtended:0 fAltDown:0 fRepeat:0 fUp:0
P WM_KEYUP nVirtKey:VK_SPACE cRepeat:36865 ScanCode:03 fExtended:0 fAltDown:0 fRepeat:0 fUp:0
P WM_KEYUP nVirtKey:VK_CONTROL cRepeat:1 ScanCode:1D fExtended:0 fAltDown:0 fRepeat:1 fUp:1
P WM_CHAR chCharCode:'0020' (32) cRepeat:36865 ScanCode:03 fExtended:0 fAltDown:0 fRepeat:0 fUp:0
This WM_CHAR at the end is very interesting. I guess that it has something to do with TranslateMessage that Silver was mentioning.
But how to avoid it? I also tried to send this keys with PowerPro app, and this one sends CTRL+SPACE properly (lParam is exactly the same as in my code).
-------------------

So again, the spy++ message log is exactly the same when sending with PowerPro and with my app.
Unfortunetly, the first is working, the latter not (just sends space - no control).
Here's the log:

------- PowerPro
P WM_KEYUP nVirtKey:00FF cRepeat:1 ScanCode:00 fExtended:0 fAltDown:0 fRepeat:0 fUp:1 probably nonimportant
P WM_KEYDOWN nVirtKey:VK_CONTROL cRepeat:1 ScanCode:1D fExtended:0 fAltDown:0 fRepeat:0 fUp:0
P WM_KEYDOWN nVirtKey:VK_SPACE cRepeat:1 ScanCode:39 fExtended:0 fAltDown:0 fRepeat:0 fUp:0
P WM_KEYUP nVirtKey:VK_SPACE cRepeat:1 ScanCode:39 fExtended:0 fAltDown:0 fRepeat:1 fUp:1
P WM_KEYUP nVirtKey:VK_CONTROL cRepeat:1 ScanCode:1D fExtended:0 fAltDown:0 fRepeat:1 fUp:1
------ my app
P WM_KEYDOWN nVirtKey:VK_CONTROL cRepeat:1 ScanCode:1D fExtended:0 fAltDown:0 fRepeat:0 fUp:0
P WM_KEYDOWN nVirtKey:VK_SPACE cRepeat:1 ScanCode:39 fExtended:0 fAltDown:0 fRepeat:0 fUp:0
P WM_KEYUP nVirtKey:VK_SPACE cRepeat:1 ScanCode:39 fExtended:0 fAltDown:0 fRepeat:1 fUp:1
P WM_KEYUP nVirtKey:VK_CONTROL cRepeat:1 ScanCode:1D fExtended:0 fAltDown:0 fRepeat:1 fUp:1


got P,Q,D, how to compute E?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > got P,Q,D, how to compute E?
PDA

View Full Version : got P,Q,D, how to compute E?

prejker
06-11-2004, 12:58 PM
Hey guys!
I found an app that uses rsa in this way:
if(serial^D mod N == name) { bIsRegged = true; }
My question is how can i compute E so i can generate a good serial?
I know that D = E^(-1) mod ((P-1)*(Q-1)) but dont know how to get E from that ;/
thx for replying;)
dELTA
06-11-2004, 01:19 PM
Are you really sure you have P and Q? That does not make sense, where did you get them from? If you have those, it's very easy to get E and D, but the main idea of asymmetrical cryptos like RSA is that you only get N and one of D and E, from which is it "impossible" (if the bit length is big enough and so on) to calculate the one of D and E that you don't have, the whole security of the RSA crypto system relies on that.
prejker
06-11-2004, 01:50 PM
let me correct myself ;)
the app has N, D hardcoded in the serial routine and i've calculated P and Q in rsa-tool.
dELTA
06-11-2004, 04:29 PM
Ok, I guess there weren't too many bits in that key after all then... :)

Well, like you say, simply solve the equation for E (E is the modular inverse of D (mod (p-1)*(q-1)))

Here's an example algo for you:

http://mathforum.org/library/drmath/view/51895.html

For more info, search for "modular inverse" etc...

Also, any decent bignum library will do it automatically for you.
SheepShagger
06-11-2004, 05:19 PM
I know that D = E^(-1) mod ((P-1)*(Q-1)) but dont know how to get E from that

E = D^(-1) mod ((p-1)(q-1))

<N,D> is the private key which should be kept well... private (as in don't hardcode it in your program :rolleyes: ) That's strike one and two. Strike three is to select small P and Q so that the factorization of N can be done trivially

This is a good example of why the general problem with cryptography is not the algorithm or the protocol but its implementation.
prejker
06-11-2004, 05:56 PM
That really helped. thanks guys;)
dELTA
06-11-2004, 06:49 PM
<N,D> is the private key which should be kept well... private (as in don't hardcode it in your program ) That's strike one and two.
Actually, only either D or E is to be kept secret out of <D,E,N>, and since D and E are completely symmetrical, it doesn't matter which one of them you put on the "private key" and which one you put in the "public key", or rather, noone can even claim at all to know which one of them is E and which one is D (even though E is the common denomination of the one in the public key, sure, but in that case you can just as well say that it was just a slight deviation from naming conventions in prejker's original post and not a mistake on the application, and ALSO, in the case of a serial check using asymmetrical cryptography, the operation performed in the application is normally indeed a decryption, which is the normal situation to use the key containing D, so you can't even say it's a deviation from naming convention actually).

As for differences between D and E, their relative size is sometimes chosen in a way to optimize the speed of encryption vs decryption/signing, but that's another story...
SheepShagger
06-11-2004, 09:55 PM
Sorry, but that's not entirely true. As I mentioned before, the weakest link in cryptography is not the algorithm, or the protocol but the implementation. The devil is always in the details :)

The RSA algorithm as designed by Rivest, Shamir and Adleman is:

1. Find two large random primes p and q of approximately equal size such that their product n = pq is of the required bit length, e.g. 1024 bits.

2. Compute n = pq and phi = (p-1)(q-1).

3. Select a random integer e, 1 < e < phi, such that gcd(e, phi) = 1

4. Use the extended Euclidean algorithm to compute the unique integer d, 1 < d < phi, such that ed is congruent 1 (mod phi).

5. <n,e> becomes the public key and <n,d> the private.

Encryption is achieved by c = m^e mod n and decryption by m = c^d mod n thus the relationship between e and d, in this context, is better defined as bijective rather than symmetrical: ((x^e)^d) is congruent x mod n

Choosing e is not something you approach lightly. Yes, you want a small enough number so computations are performed fast but above all things (this is about security after all) e must not divide neither (p-1) nor (q-1) otherwise your private key can be derived.

e and d shouldn't be used interchangeably because after you derive d you don't know if gcd(d,phi) = 1

As a general rule, always follow the designer's algorithm until the variation you want to implement has been reviewed and approved by the crypto community. Even a small, insignificant, deviation may have undesired interactions that can weaken the system.

I'm sure you (dELTA) are familiar with this paper but for the people following this thread that are not, D. Boneh wrote an interesting paper titled "Twenty years of attacks on the RSA cryptosystem" http://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf
mike
06-12-2004, 05:28 PM
e and d shouldn't be used interchangeably because after you derive d you don't know if gcd(d,phi) = 1
Yes, you do! If gcd(e,phi(n))=1, then it's in the group of units mod phi(n). By the definition of a group, each element has an inverse in the group. So d is a unit, and is therefore also comprime to phi(n).

Signing messages is decrypting the hash of a message (i.e. raiseing to the d power mod n). Other people take your public key <n,e>, encrypt the result, and check the hash to verify.

You choose e small if you want encryption to happen quickly, and d small if you want decryption to happen quickly. There are attacks on the system if e is too small (like 3). See the paper he cited.
dELTA
06-12-2004, 07:45 PM
The crypto god has spoken, what can I tell you SheepShagger, I told you so? :D Also, even if you would have been correct in your statement about the asymmetry between D and E, the statement about which one was D and which one was E would only be according to the arbitrary labeling of prejker anyway, as I said above.
SheepShagger
06-12-2004, 08:10 PM
Yes, you do! If gcd(e,phi(n))=1, then it's in the group of units mod phi(n)

:whoops: You're correct. I guess the only thing I can use as an excuse for overlooking that fact is the time of the post. :D

At first, I was concerned that an "untested" d may lead to a solvable linear congruence of the form: de congruent b (mod n). The equation can only be solved if gcd(d,n) > 1 divides b (hence my post), but in my haste I overlooked that e and d are indeed coprimes (shame on me) plus since one is the modular inverse of the other, the linear congruence does not have a solution.

After thinking a bit about the question, I don't see any reason why <n,d> couldn't be the public key providing that (I'm purposely ignoring any message padding like OEAP):

- Both exponents are of sufficient size to avoid small exponent attacks
- The keys are never interchanged (the public now becomes private)
- e isn't one of the usual values (3, 17, 2^16+1)

... but I've been wrong before :p and I still believe that a crypto algorithm should be followed as designed unless you fully (a.k.a. mathematically) comprehend the ramifications of the variation. Mike, could you point me to such analysis?

I mean, what's the impact of using RSA as designed except that the public key is <n,d>? What happen when n is multi-prime? And when the private key is in the form <p, q, dP, dQ, qInv>?

dELTA, Now I understand your comment about how will he know if it's D or E and agree with your post
mike
06-12-2004, 10:09 PM
After thinking a bit about the question, I don't see any reason why <n,d> couldn't be the public key providing that (I'm purposely ignoring any message padding like OEAP):

- Both exponents are of sufficient size to avoid small exponent attacks
- The keys are never interchanged (the public now becomes private)
- e isn't one of the usual values (3, 17, 2^16+1)

... but I've been wrong before :p and I still believe that a crypto algorithm should be followed as designed unless you fully (a.k.a. mathematically) comprehend the ramifications of the variation. Mike, could you point me to such analysis?
You're right: you should always follow the directions exactly unless you really know what you're doing.

Mathematically, there's no difference between d and e; if you choose one at random, the other is random too. As you noticed, there is a difference in the way they are used, though I don't know of any better analysis than the paper you cited.
SheepShagger
06-12-2004, 11:16 PM
Mathematically, there's no difference between d and e

Well, I spent a couple of hours thinking about this and what I found so far is that e and d share the same mathematical properties so, I will cautiously agree with you and graciously :p concede it is possible that e and d are interchangeable.

However, I disagree with your statement about d being random. On the contrary, it is very much deterministic (calculated using the extended Euclidian algorithm to find the inverse of a number mod x) but I understand what you're trying to say.

dELTA, a lot of time and thought went into the design of RSA and you wouldn't believe how many crackpots (I'm not suggesting you're one of them :D ) claim they've discovered a way to factorize large numbers or have made changes to "strengthen" the algorithm so it's just natural that whenever someone suggests deviations from the design, a request for a proof will follow.

Anyway, enough math for today but thanks to you guys am a bit wiser so I'll drink on your honor.

P.S.: Speaking of crackpots, one of my favorites: http://www.timecube.com/
mike
06-13-2004, 05:29 PM
However, I disagree with your statement about d being random. On the contrary, it is very much deterministic (calculated using the extended Euclidian algorithm to find the inverse of a number mod x) but I understand what you're trying to say.Yes. Do what I mean ;)


vbox 4.6.2 timelimit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > vbox 4.6.2 timelimit
PDA

View Full Version : vbox 4.6.2 timelimit

venom925
06-11-2004, 07:27 PM
im having a very hard time finding out what to break on in olly to un pack a expired timelimit with vbox nag popping up. can somebody kindly point me in the right direction, please keep in mind that i already used the search feature here, an could not find anything to help. thanks.
Woodmann
06-11-2004, 07:55 PM
http://www.woodmann.net/forum/search.php?searchid=58041

NO MORE !!!

I can promise that from now on anyone who claims to have searched
and didn't will have their posts removed.

If you have searched and none of those 12 posts did not help you,
tell us why they did not help.

Woodmann
JMI
06-11-2004, 08:17 PM
Just to be completely fair: :devil:

We shouldn't count his own post as one "existing" post on vbox cracking. :whoops: But there are 11 "others." :thinking:

Regards,
Fake51
06-12-2004, 06:03 AM
Just to be completely fair: :devil:

Actually, if you read closely, you'll see that he DIDN'T search.

please keep in mind that i already sued the search feature here

Guess I didn't read the small print of the EULA myself. Never knew one could sue the search feature.

Fake
venom925
06-12-2004, 05:38 PM
Actually, if you read closely, you'll see that he DIDN'T search.

Guess I didn't read the small print of the EULA myself. Never knew one could sue the search feature.

Fake
well belive me you can, they didnt help me because i am trying to use olly. i did use the search feature and read those i found more then 11 (12 including mine) but none tell you how to use olly to crack or whatever word you want to use, to remove the time limit.
Woodmann
06-12-2004, 06:49 PM
So.........

If you read those threads. Why did you not tell us that you read them, and why they did not help you.

This will go a long way to helping you.

Woodmann
Kayaker
06-12-2004, 10:08 PM
but none tell you how to use olly to remove the time limit.

I would suggest you quit looking for a step by step recipe, either for the method for removing the time limit, or for someone to give you the proper search parameters.

Let's say NO ONE has EVER figured out how to remove the time limit from this protection. What would you do then? How about starting at square one and using standard classic reversing techniques? By now you *should* have already gotten as much information as possible using Filemon, Regmon, an API monitor, a Message Spy, etc... Protection detects these? Figure out a way to hide them.

At least *some* of the info obtained from these tools should give you a clue what to look for. But let's say you still can't quite figure out how this hypothetical never-before-cracked protection sets a time limit. *Now* is the time you come to us, outline what you have done and what you have discovered, and ask for help.

Where do I get off saying this? Well besides being good advice, it *appears* that you haven't progressed past glancing at the search hits that Woodmann gave you. He used "vbox 4.6.2" only. If I use "vbox Olly*" I get a few hits not listed in the first search and 'time limit' is specifically discussed in some of them. What about trying 'vbox + time limit or trial or expired or...' what do you get?

If I simply use "vbox" I get 99 hits! Ah, but you don't want to read through 99 posts do you? Can't really blame you, but that's not the point, you need to be willing to put in the work if you can't find a ready answer, and that includes using other tools to do your own reversing research.

Like Woodmann said, people need feedback from you on what you have read and tried and why it didn't help, as opposed to simply reciting the ever popular 'I searched' disclaimer.

Kayaker


Unpacking a with Petite v2.2 packed DLL file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking a with Petite v2.2 packed DLL file
PDA

View Full Version : Unpacking a with Petite v2.2 packed DLL file

nitr8
06-12-2004, 03:54 AM
Hello

I'm wondering how unpacking on a Petite v2.2 packed DLL file works, since i only yet read tutorials that described how to do it on packed EXE files.

I tried it anyway with SoftICE and OllyDbg, but can't step behind it.

There is nothing in the code, that should look like this:

POPAD...
POPF...
ADD...
JMP...

:(

I found the following in OllyDbg:

MOV...
PUSH...
PUSH DWORD PTR FS...
MOV DWORD PTR FS...
PUSHFW
PUSHAD
PUSH EAX
PUSH 10000000

I tried setting a New Origin onto the first MOV (it's the EiP=1147B042), then traced until i executed the PUSHAD and stood on PUSH EAX, wrote down the ESP and EDI, pressed CTRL+G on Hexdump Window, entered the ESP, selected the first 2 bytes, set a breakpoint on Hardware Access, WORD. After that i just pressed F9, then SHIFT+F9 - but OllyDbg just send me an Access Violation Message in it's Status Window and after that a message, that the Debugged program was unable to process exception. After pressing SHIFT+F9 2 more times, OllyDbg just terminated the hole process. I dunno why and what to do else. :(

I need big help on this one. :-/

Thank you very much.
Shoob
06-15-2004, 08:15 AM
POP EDI
REP STOS BYTE PTR ES:[EDI]
POPAD
POPFW
ADD ESP,8
JMP LOCATION.XXXXXXXX

look for this.


Installshield 9 - S/N Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Installshield 9 - S/N Protection
PDA

View Full Version : Installshield 9 - S/N Protection

lordbyte
06-12-2004, 06:10 AM
I have a program, which is packed in an Installshield 9(I think?) single .exe file. When Setup is launched, after a few steps, you get the usual S/N box.

1) From what I've been able to tell, the new installshield setups, extract only the first part of the .cab files into the temporary directory. The main .cab file seems to get extracted only after the Sn is entered.

2) The new .inx files seem to be different from the 6.x & 7 versions. Thus all current inx decompilers do nothing.

3) I tried using SICE to bpx a few calls (for the S/N) but nothing is triggered (I've used the addr to set the correct process).

Is there anyone with any ideas on how I could proceed with this one? Please not that I'm relatively new to this.

Cheers,
lordb
evlncrn8
06-12-2004, 06:47 AM
if you're lucky the s/n scheme might be in a dll loaded runtime, usually sitting in the temp dir, i used to always wait for the serial window to pop up, then kicked in sice and did a bpx loadlibrarya, then entered a bogus serial, clicked ok or whatever, then reenter the serial, it then usually always broke loading the dll, then it went through a getprocaddress and called the serial routine, 9/10 times setting eax = 1 on the return from the proc worked you could try that
Solomon
06-12-2004, 07:45 AM
BTW: If it's an installshield password, it's often checked with FeatureValidate()/ComponentValidate() API, which is only a MD5 hash comparison.
lordbyte
06-12-2004, 04:39 PM
Hi again,

Tried both your suggestions, but SICE never fires up. Regarding the external DLL, everything it extracts in the temp directory looks to me like a standard IS DLL. There is a custom .EXE file named DBUpdate (written in Delphi 7). I couldn't get DeDe's decompiler to dump everything (would crash towards the end), but from what I saw, it goes on their website and gets updates to their DB. Now, why it needs to be extracted first thing in the installation, is quite interesting.

One more thing. When doing proc from SICE, I see several processes with 'Deleting' as their status. What does 'deleting' mean? And how long do they stay in this state for? They were there 10 minutes later. (Asking because one of them was DBUpdater).

Any other ideas?

Thanks,
lordb


About SF3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > About SF3
PDA

View Full Version : About SF3

Elnino
06-12-2004, 08:52 AM
I'm looking at Starforce 3 and have some questions, especially about anti-debugging tricks:
1) I've debugged at boot prohlp.sys / prodrv.sys and found something like that:

D29B9A93 mov eax,01
D29B9A98 xor edi,edi
D29B9A9A call [Get_DDB]
D29B9AA0 mov [ebp-54],ecx
D29B9AA3 mov eax,[ebp-54]
D29B9AA6 test ecx,ecx
D29B9AA8 mov [ebp-0A4], ecx
D29B9AAE mov eax,ecx
D29B9AB0 je D29B9AC3
D29B9AB2 mov edx,2A
D29B9AB7 cmp [eax+06],dx
D29B9ABB je D29B9AC3
D29B9ABD mov eax,[eax]
D29B9ABF test eax,eax
D29B9AC1 jne D29B9AB7
...

After execution of the Vxd Call at D29B9A9A, I get ecx=C0011360 (address in VMM).
First time at D29B9ABD, eax=C0011360 with [eax]=C00334C4 (address in VMM).
Second time at D29B9ABD, eax=C00334C4 with [eax]=C002F3A4 (start offset of Winice).
So I replace, the second time, just after D29B9ABD, eax by the corresponding value without Sice.
But it doesn't avoid anti-debugging tricks.And putting ecx=0 just after the Vxd Call causes an error code C0000001, and after the loading of window$ the message:
"You must reboot your computer to finalize installation of drivers". :confused:
What does really make this routine?

2) How can I detect access to IDT? I can't put a bpr in IDT and that's logical because softice uses some interruptions. And there're some SIDT instructions in the code, which are not used.
How can I proceed to detect access to IDT without tracing the whole code ?

3) Are anti-debugging tricks only in prodrv.sys or in the two drivers?
If someone could help me or give me clue, that'll be great.

Best regards,
Elnino
SkUaTeR
06-14-2004, 11:42 AM
hello , in the 2 drivers SF3 use a drX register to insert garbage .

But if you want steel the debugger and run the protected program
this is too hard first you need change the name of sice driver to avoid the detection by the method MeltIce (\\.\ntice) then you need unpack
the drivers to clean the handle code of the DRX trash and correct the checksums.

(search in this forum "hide softice")

Well i make this steps i have a unpacked drivers with the drx trash code clean
and hide my sice then run the game but my machine show a BSOD.
Maybe if you follow these steps and apply your method the game run .

i have working under Win2k SP4.

if you get any by this method plz comment to me in this moment i dont have time to tested but i hear what under winMe and following these steps you have a "semi-Operative" sice.

good luck.

PD: in the code of the drivers have a P-code instructions this protection is a nightmare.
evlncrn8
06-14-2004, 02:28 PM
the bsod is because the sf3 driver reroutes int 3 and int 1 i think for its own use (virtual file system uses int 03h).. thats the reason for the bsod.. getting round it is a whole different story


Making a program run without the loader ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Making a program run without the loader ?
PDA

View Full Version : Making a program run without the loader ?

markh51
06-13-2004, 09:07 AM
I have a none commercial program which I want to change...

I want it to run without the use of the dongle in place. (I have the dongle, but it is a pain in the arse, as I have more than 1 prog which requires the use of a dongle on the LPT port)

I have tried to reverse the prog but is proving to be a bit of a nightmare, as the program with the protection can't be run by itself. If you try it throws a "Access violation at adress..." error. It will only run if it is called by the loader. When it does run, it opens in full screen and you can't switch back to the disassembler !

So my questions are:

1) What routine would the program use to check to see if it was run by the loader ?

2) How do I stop it loading in full screen and not been able to switch back ?

3) How do I get rid of the nasty dongle (Dallas iButton)

Thanks in advance.
JMI
06-13-2004, 02:42 PM
markh51:

At the moment, your post simply looks like a crack request. You have apparently not read the FAQ listed in the BIG RED LETTERS at the top of the Forum. Time for you to do so now.

After you read the FAQ, you will discover that one of our requirements here is that you not only attempt to help yourself before you ask a question, you also have to do your own research, show what you have done and where you are stuck, after tyring to help youself.

Your post shows no personal effort at solving your own problem and contains information which suggests you are not being truthful with us. For example, why would a "non-commercial" program be protected with a "Dallas iButton"? So I ask YOU what you have done to determine:

1) What routine would the program use to check to see if it was run by the loader ?

2) How do YOU try to stop it loading in full screen and not been able to switch back ?

3) What have you searched for and read on how YOU get rid of the nasty dongle?

We are not here to do YOUR work for you, only to try to help you along AFTER you have demonstrated that you have tried to help yourself.

Regards,
markh51
06-13-2004, 03:21 PM
First of all, I am not expecting anyone to do all the work for me, I have been working on this program for over 8 days without any luck... thats how I have "helped myself".

Secondly... I came to the conclusion that the proram is not commercial due to the fact that it is not available for sale... anywhere. I OWN a copy of this program as well as 2 dongles for it. I just want to make it work without the dongle as I have other programs such as my compiler which requires a dongle to be in place as well.

The reason why I have had no luck with this prog is because, it must be run through a "loader" for it to run. When it does run, it opens in full screen and stops you switching back to the debugger.

The only way I can see me been able to do this, is if I can make it run without the loader and stoping it going in to full screen (or finding a way of switching back to the debugger)

So any help is greatly appreciated.

Best regards,
Markh51
JMI
06-13-2004, 04:19 PM
markh51:

You still seem to be missing the point. We are not mind readers, we can deal ONLY with what you write. You will notice your first post (as well as your second) says nothing about what you have actually done to help yourself execpt: "I have been working on this program for over 8 days without any luck."

You say the program has to be run by a "loader." Have you looked at this "loader" in any analysis tools, such as IDA and/or WDasm to examine the code?

You say it "stops you switching back to the debugger." Have you done ANY research here or on the net on "anti-debugger" procedures or techniques or are you simply waiting for someone to give you a tutorial on how programs might muck with your debugger? Are you aware that it is not unusual for programs to disable a debugger or how they might do that? Have you seached here or anywhere for such information? We don't even know WHICH debugger you might be trying.

No one can tell from what you have posted ANYTHING about your skill level or knowledge base or ANYTHING you may have already tried. The FAQ states you should:

Cut and Paste these questions in your post, including your answers :
1. What is the problem....
2. What is the protection.....
3. What tools are you using....
4. What tutorials have you read....
5. Show your output listing WITH comments....
6. NOW ask your question....

It is hard to argue you have done ANY of these things and you certainly have not told us ANYTHING you have actually done to help yourself solve this problem. You may have done many things, but you have done NOTHING to SHOW that you have done ANYTHING. That IS the point.

Regards,
markh51
06-13-2004, 04:51 PM
Sorry about this, I'm new to posting things, I never thought to explain in a bit more detail:

1. What is the problem....
The application which I need to remove the dongle protection from must be called from the loader. This make it a bit more tricky to debug, but no impossible.

2. What is the protection.....
The only protection what I can see, is the Dallas iButton and a anti-soft ice routine which I have already removed.

3. What tools are you using....
IDA Pro, W32DASM 8.93, PE Explorer and a Hexeditor

4. What tutorials have you read....
I have trawled the net about the Dallas iButton, but there appears to be nothing apart from it can be cracked by using a dictionary attack only if the developer uses a "normal" word... not in this case ! I have downloaded a copy of the API and have searched for the Functions/refrences but there appears to be nothing in the main prog or the DLL file.

5. Show your output listing WITH comments....
I have attached TXT file, is this what you mean by output listing ?

6. NOW ask your question....

1) What routine would the program use to check to see if it was run by the loader ? If you run the prog without the loader it throws a "Access violation at address..."

2) How do I stop it loading in full screen and not been able to switch back ? You can't use CTRL-ALT-DEL or ALT-TAB or anything only CAPSLOCK appears to work.

3) How do I get rid of the nasty dongle (Dallas iButton) ?
I think I would be able to this myself if I could debug the prog as it was running, as I am just having to take a shot in the dark at the moment.
JMI
06-13-2004, 05:27 PM
markh51:

This is much better. Now it's time to use some stratigic thinking and do some searching. You say you have removed the anti-softice routine (or at least disabled it) and now advise that one of the problems is that the program appears to disable parts of the keyboard necessary for activating softice.

This should suggest to you certain search criterial for analysis of your problem, such as "keyboard" and "disable." Just doing a simple search HERE using those two terms I found several threads here, including one titled:
"how to remove Alt+tab protection" which may have some pertinent information. You will find it at

http://66.98.132.48/forum/showthread.php?t=5287&highlight=disable+keyboard

The other threads with that search may also help. What you need is some general research on keyboard hooking and the API which are used for that prupose and then determining what the "loader" is using to disable those keys.

You might be interested in the fact that Windows has an " application compatibility toolkit" that allows some hooking and modification of the keyboard. Check out the article at http://www.rpgexpert.com/548.html on how the program can be used to disable some keys. Analysis on the program might give you some clues and might actually permit you to modify your program itself.

Googling using "disabling alt tab" also will find some useful information, such as this short article at:

http://www.codeguru.com/Cpp/misc/misc/keyboard/article.php/c433/

"Disabling the Alt-Tab key combination
Rating: none

Dan Crea (view profile)
February 4, 1999

The simplest way to achieve this is to use the RegisterHotKey function. By calling this function from within your process you take precedence over the O/S. The WM_HOTKEY message that is generated by the specified key combination will be re-directed to the your processes message queue. To block the hotkey, don't process the WM_HOTKEY message that is sent to your queue. Below I have copied a constructor and destructor that demonstrate this action.

// Call the RegisterHotKey function when the application
// is instantiated to block the ALT-TAB combination
// Note: The m_nHotKeyID is a int which specifies the hotkey
// ID, the hotkey id is programmer defined
CMainFrame::CMainFrame()
{
m_nHotKeyID = 100;

BOOL m_isKeyRegistered = RegisterHotKey(GetSafeHwnd(), m_nHotKeyID,
MOD_ALT, VK_TAB);

ASSERT(m_isKeyRegistered != FALSE);
}

//lets remove the hotkey block when the application is destroyed
CMainFrame::~CMainFrame()
{
BOOL m_iskeyUnregistered = UnregisterHotKey(GetSafeHwnd(), m_nHotKeyID);
ASSERT(m_isKeyUnregistered != FALSE);
}

There you have it, the simplest way to block the ALT-TAB without writing a VxD.
One last thing, the hotkey block will continue as long as your application is running. When your process terminates the hotkey will return to its original functionality. "

Those same search terms will find you an interesting article titled: "Typename, Disabling Keys in Windows XP with TrapKeys" at

http://msdn.microsoft.com/msdnmag/issues/02/09/CQA/default.aspx

which discusses ways it can be done.

In other words, when you identify a problem (in this case certain keys on the keyboard are disabled) this should suggest to you various terms you can use to search for answers to your problems. This is the result of thinking about your problem, understanding what it is, and chosing terms which describe the problem, and then searching for answers.

Regards,
markh51
06-13-2004, 05:45 PM
JMI:

The thing is I don't use softice I use W32DASM or IDA, I just disabled the routines as I thought they might affect other debuggers. I don't know how to use softice :(

The main loader totaly disabled the keyboard, but I have now patched that. The prog which I am trying to debug uses directdraw for full screen, does this stop you switching tasks ?

Why would the prog throw a Access violation at address error if it is not called from the loader. I have looked at API's like kernel32 GetCommandLineA.
JMI
06-13-2004, 06:08 PM
markh51:

Read the additions to my previous post. If you aren't dealing with anything (at the moment) other than the disabling of parts of the keyboard, those links and search terms I suggested should get you on your way.

Are you using IDA as your debugger or are you not using a debugger at all?

If the loader "totally disabled the keyboard" and you patched it, maybe you didn't do so correctly or completely. And if it "totally disables the keyboard" does the program run only from the mouse?

Please note that DETAILS ARE IMPORTANT. Nothing in your first two posts mentioned that the "entire" keyboard was disabled, so you certainly left the impression this was a anti-debugger issue when it now suggests it is something else. Maybe you should search for "keyboard disabled."

Regards,
markh51
06-14-2004, 01:32 AM
JMI:

I am using IDA and W32DASM as my Debugger and Disassembler.

The patch for the "Disabled keyboard" does work because, if you run the "unpatched" loader and exit, the keyboard remains diabled, however if you run the patched version and exit... everything seems OK.

This prog DOES only work from the mouse.

I am not sure if the main prog does disable the keyboard, as it does not accept commands from the keyboard, however pressing capslock makes the light go on and off, but other key combo's won't work.

Also had a look through previous posts but nothing really stands out. I had a look at the link you sent, I will follow it up a bit more through Google.

Any other ideas are welcome.

Cheers.
markh51
06-14-2004, 02:43 PM
JMI:

Can you have a look at the Anti-Softice code I patched, is this right:

* Referenced by a CALL at Addresses:
|:0044EF46 , :004521E9
|
:0044F3F8 53 push ebx
:0044F3F9 33DB xor ebx, ebx
:0044F3FB 6A00 push 00000000
:0044F3FD 6880000000 push 00000080
:0044F402 6A03 push 00000003
:0044F404 6A00 push 00000000
:0044F406 6A03 push 00000003
:0044F408 68000000C0 push C0000000

* Possible StringData Ref from Code Obj ->"\\.\SICE"
|
:0044F40D 6828F44400 push 0044F428

* Reference To: kernel32.CreateFileA, Ord:0000h
|
:0044F412 E88976FBFF Call 00406AA0
:0044F417 83F8FF cmp eax, FFFFFFFF
:0044F41A EB08 jmp 0044F424 <--- I changed this to a JMP
:0044F41C 50 push eax

* Reference To: kernel32.CloseHandle, Ord:0000h
|
:0044F41D E85E76FBFF Call 00406A80
:0044F422 B301 mov bl, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0044F41A(U)
|
:0044F424 8BC3 mov eax, ebx
:0044F426 5B pop ebx
:0044F427 C3 ret

Also, I am having a problem with my softice 4.05 for W95... When you press CTRL-D, the screen goes black and nothing happens.

Thanks.
JMI
06-14-2004, 04:16 PM
markh51:

This is known as the "MeltICE" method of detecting SoftICE. You will find it discussed here as method 11 and how to work around it:

http://www.crackstore.com/003.htm

As the code there shows you, there used to be a compare eax and a je if eax was not -001.

Are you really running win95? I've deleted your duplicate thread in the Tools of the Trade Forum asking about the Softice 4.05 and win95 question you already asked here. dELTA was refering to the BIG RED LETTERS and the mention of the FAQ at the top of the forums, which I've mentioned to you already. He's telling you you need to use the search button for "softice" and "video" problems before asking for help. It is most likely a problem with compatiability of your video card, which is an issue you will see discussed many times.

as I said in my previous post:
In other words, when you identify a problem (softice, blank screen, video, win95) this should suggest to you various terms you can use to search for answers to your problems. This is the result of thinking about your problem, understanding what it is, and chosing terms which describe the problem, and then searching for answers.

For example, using "softice and blank screen" (without the quotes) I got a thread titled: "softice 4.05 and WINME, black screen on start-up...." and while I realize it refers to WinME you should have at least read it because you may have the same problem. You will find it at:
http://66.98.132.48/forum/showthread.php?t=6025&highlight=softice+blank+screen

Regards,
markh51
06-14-2004, 04:30 PM
JMI:

Thanks for that but I sorted the softice problem by un-installing and then re-installing it. it now seems to work fine.

I DID do a search before I posted this and I found the same thread which you found but it is was not the same problem which I was getting... but never mind now it's all sorted.

Is the patch which I applied to the "MeltIce" code OK, I wasn't too sure whether to force a jump or just go to the next line.
JMI
06-14-2004, 04:53 PM
markh51:

Let me say again that the way to avoid suggestion to searching, is to say you searched and didn't find anything which seemed to answer your question.

On the MeltICE trick, assuming your code was previously a "je" (jump if equal), then you want to take the jump. You could do it one of two ways.

You could make
:0044F417 83F8FF cmp eax, FFFFFFFF into
:0044F417 cmp eax, eax

and then the je would be taken, or as you did, you can change the je to jmp to always go, no matter how the compare works out. The code compares a negative result, meaning it didn't find Softice so it jumps to continue. If it found Softice, it would go somewhere else.

Just remember for other circumstances that the cmp will set a flag, depending on the result, and it is at least possible that something might check that flag later in the routine, but in this case I don't think it is part of the MeltICE routine.

Also you might want to take a look at OllyDBG as a somewhat easier debugger to start with. It works only in ring 3, but that will work for most earily reversing activities. You will find it at:
http://home.t-online.de/home/Ollydbg/

Regards,
CrackZ
06-14-2004, 05:30 PM
Hiya,

I'm not sure whether there was a conversation had here about Dallas iButton's, I seem to remember one, or perhaps that was with someone else, regardless :

Find the iButton v4.31 SDK, and then from what I quoted then:

"Most iButton protected programs I've seen are statically linked with the dll swa32ut.dll (something like that), even if this is not the case its a trivial patch to make your target load this dll and of course redirect calls there (I have if you need an example swa32ut.dll with source code."

Give me a shout anyway if you want more help with this.

Regards

CrackZ.
markh51
06-14-2004, 05:34 PM
JMI:

I have just had a look at the code which call's the "MeltIce" routines:

:0044EF42 753E jne 0044EF82 <--- Goto Kernel32.CloseHandle
:0044EF44 8BC7 mov eax, edi
:0044EF46 E8AD040000 call 0044F3F8 <--- Check //./SICE
:0044EF4B 84C0 test al, al
:0044EF4D 7533 jne 0044EF82 <--- Goto Kernel32.CloseHandle
:0044EF4F 8BC7 mov eax, edi
:0044EF51 E8DE040000 call 0044F434 <--- Check //./NTICE
:0044EF56 84C0 test al, al
:0044EF58 7528 jne 0044EF82 <--- Goto Kernel32.CloseHandle
:0044EF5A 6A00 push 00000000

What are the "test's" and "jne's" for after it has returned from the "MeltIce" routines ? I ask this because, If I patch the "meltIce" code like you said before, with the JMP's, the prog just quits ?!?
JMI
06-14-2004, 07:39 PM
markh51:

Why in the hell are you still not doing your own research??? Have you bothered to SEARCH on the net for MeltICE code and compare it to your code? Isn't that what YOUR brain is for???

Using "MeltICE code" (without the quotes) it took only a second to find:

http://www.woodmann.net/krobar/tutlist/tutlist286.htm

which is located on our server for God's sake. Don't you look for anything? It has the entire asm code for MeltICE:

And now, the Dead Listing of an .exe file using that code:
* Referenced by a CALL at Address :004011DE
:00401080 E87BFFFFFF call 00401000 ; first, check for S-Ice Win95
:00401085 85C0 test eax, eax ; check if loaded...
:00401087 7410 je 00401099 ; No, jump to check_NT, if yes:
:00401089 6894604000 push 00406094 ;->"SoftICE for Windows 95 is active!"
:0040108E E83D000000 call 004010D0
:00401093 83C404 add esp, 4
:00401096 33C0 xor eax, eax
:00401098 C3 ret ; S-Ice Win95 detected. Bye_bye.
:Check_NT
:00401099 E8A2FFFFFF call 00401040 ; Now, check for S-Ice WinNT
:0040109E 85C0 test eax, eax ; check if loaded...
:004010A0 7410 je 004010B2 ; jump if NOT loaded to can't_find, else
:004010A2 6870604000 push 00406070 ;->"SoftICE for Windows NT is active!"
:004010A7 E824000000 call 004010D0
:004010AC 83C404 add esp, 4
:004010AF 33C0 xor eax, eax
:004010B1 C3 ret ; S-Ice WinNT detected. Bye_bye.
:can't_find
:004010B2 6848604000 push 00406048 ;->"Can't find SoftICE with this method!"
:004010B7 E814000000 call 004010D0
:004010BC 83C404 add esp, 4
:004010BF 33C0 xor eax, eax
:004010C1 C3 ret ; S-Ice not found.

********************************End of detection********************************
The detection/CreateFileA routine for S-Ice Win95:
:00401000 6A00 push 00000000 ; CreateFileA parameters
:00401002 6880000000 push 00000080 ; ...
:00401007 6A03 push 00000003 ; ...
:00401009 6A00 push 00000000 ; ...
:0040100B 6A03 push 00000003 ; ...
:0040100D 68000000C0 push C0000000 ; ...
* Possible StringData Ref from Data Obj ->"\\.\SICE" ; VxD driver for S-Ice Win95
:00401012 6830604000 push 00406030
* Reference To: KERNEL32.CreateFileA, Ord:0031h
:00401017 FF15BCA04000 Call dword ptr [0040A0BC] ; CreateFileA
:0040101D 83F8FF cmp eax, FFFFFFFF ; Handle= -1 ?
:00401020 740D je 0040102F ; Yes, jump otherwise...
:00401022 50 push eax ; SoftIce Win95 IS loaded!
* Reference To: KERNEL32.CloseHandle, Ord:0018h
:00401023 FF15F8A04000 Call dword ptr [0040A0F8] ; Close file's handle
:00401029 B801000000 mov eax, 00000001 ; Eax:=1
:0040102E C3 ret !
; Back to the caller
* Referenced by a (C)onditional Jump at Address :00401020
:0040102F 33C0 xor eax, eax ; Eax:=0 (not loaded)
:00401031 C3 ret !
; Back to the caller
...
The detection/CreateFileA routine for S-Ice WinNT:
...
* Referenced by a CALL at Address :00401099
:00401040 6A00 push 00000000 ; CreateFileA parameters
:00401042 6880000000 push 00000080 ; ...
:00401047 6A03 push 00000003 ; ...
:00401049 6A00 push 00000000 ; ...
:0040104B 6A03 push 00000003 ; ...
:0040104D 68000000C0 push C0000000 ; ...
* Possible StringData Ref from Data Obj ->"\\.\NTICE"; VxD driver for S-Ice WinNT
:00401052 683C604000 push 0040603C
* Reference To: KERNEL32.CreateFileA, Ord:0031h
:00401057 FF15BCA04000 Call dword ptr [0040A0BC] ; CreateFileA
:0040105D 83F8FF cmp eax, FFFFFFFF ; Handle= -1 ?
:00401060 740D je 0040106F ; Yes, jump otherwise...
:00401062 50 push eax ; SoftIse WinNT IS loaded!
* Reference To: KERNEL32.CloseHandle, Ord:0018h
:00401063 FF15F8A04000 Call dword ptr [0040A0F8] ; Close file's handle
:00401069 B801000000 mov eax, 00000001 ; Eax:=1
:0040106E C3 ret !
; Back to the caller
* Referenced by a (C)onditional Jump at Address :00401060
:0040106F 33C0 xor eax, eax ; Eax:=0 (not loaded)
:00401071 C3 ret !
; Back to the caller

NOW DO YOU SEE ANY SIMILARITY BETWEEN THIS AND YOUR CODE???
(Yes, I know they've moved some parts of it around a little bit, but LOOK at the code and what it is doing. It makes the checks and closes Softice if one or the other version is found. It would not take much modification to make it close the target program if either is detected. You could search for that as well.)

As Frog's Print concluded:

"But is S-T-U-P-I-D because we now will be able to check if any program is detecting Soft-Ice even before it will have the time to do so: just with a BPX CreateFile(A)." (Actually, should be BPX CreateFileA)

Now, if you look at this code, you will see that it is making more than one check, isn't it. Which one have you patched? Have you patched the other? Have you done anything to determine whether Softice 4.05 is Softice 95 or Softice Win-NT??? Does it not make sense, if you do not know, to LOOK IT UP and, as a fall back position, if you do not know, to patch both???

Now come on, this particular issue is not that hard IF YOU JUST DO A LITTLE STUDY OF THE TOPIC FIRST.

Regards,
Aimless
06-15-2004, 12:02 AM
Might I suggest that instead of breaking dongles (as people who have been RCE for years still struggle) you simply find a crack for the same?

It kind of seems a little too enthusiastic to feel that a dongle needs to be broken just because of our familiarity with SoftICE or IDA or w32Dasm.

Feel free to ignore this if you have a lot of RCE experience and think this is a good time to start on dongles.

Have Phun
markh51
06-15-2004, 02:25 AM
I have been looking for a cr*ck for the iButton for quite sometime now but without any success, so the only way I can see, is to remove the protection myself... unless anyone else has any ideas ?
JMI
06-15-2004, 02:43 AM
I don't suppose you paid much attention to CrackZ' post or did any searching for information on iButton coding or found the SDK he mentioned, now did you??? There's interesting stuff out there like an article titled:

A Basic iButton Interface

found at http://www.codeproject.com/samples/ibuttoninterface.asp

but apparently you just want someone to help you find a crack or do the work for you. How about trying something REALLY desperate, like putting something like "iButton SDK" into your favorite search engine and reading some of the hits.

Regards,
markh51
06-15-2004, 02:53 AM
Like I said earlier, I have been searching for a while now (on google), but the only thing what I could come up with was the SDK from Dallas website. Obviously, their kit is not going to let you "hack" the iButton or remove the protection, so instead I just used the API as a reference to check the code against, but like I said, I could not find any reference in the code to the iButton API.

I'll take a look at the link you provided.

Thanks.
markh51
06-15-2004, 03:03 AM
OK, I had a look at the link you provided and downloaded the Source Code, only problem is I don't have MS Visual C++ to compile it I only have Borland Builer C++. Anyway, I don't think this tool will be very useful as it seems similar to the TMEX tools which dallas provide. These tools are no use unless you know the password for each section as the contents are encrypted.
JMI
06-15-2004, 03:09 AM
Instead of ONLY reading the link I gave you, why don't you actually do some research on the subject of "ibutton + code" and "ibutton sdk" and "ibutton+ crack*" (without the quotes.)

Regards,
markh51
06-15-2004, 03:51 AM
Yes, I've tried them variations on google and there is nothing there what will break the iButton, only tools which will communicate with it, which is no good unless you have the password. The only tool I found performs a Dictionary attack on the iButton, but this is only effective if the developer uses a weak password.

Thanks.
JMI
06-15-2004, 04:21 AM
markh51:

Take a CLOSE look at the code I posted from MeltICE. Look at the references to "CreateFile" and you will see no "()" around the "A". If you try BPX CreateFileA it should work.

Yes I know what Frog's Print wrote in the line I quoted, but he wrote that in 1999. If you had read a few more threads here, or anywhere, on breakpoints this would have become obvious to you. I believe the "()" are most frequently used to indicate that there may be an API with and without the letter on the end, depending on the system one is using. There is a CreateFile for Windows Me/98/95 and a CreateFileA for later versions.

There's even a program called "auto debug for windows" that claims to have automated circumvention of several anti-debug systems. It can be found at:

http://www.autodebug.com/antidebug.html

Regards,
markh51
06-15-2004, 04:29 AM
JMI:

Yeah, I know now, I read the post a little bit closer ;)

That's why I edited it, but you must have replied b4 I changed it.
markh51
06-16-2004, 04:57 AM
JMI:

I have come across another "problem" in the prog... If you change anything in the main prog it will half load then crash, but if using the original unchanged prog it will load OK. So it seems to know even if you patch one or two bytes even though the file sizes are EXACTLY the same.

I have done a bit of research on google but I don't really know what I am searching for as I have not come across this before. Do you think it is comparing the CRC values of the files ?

Do you have any ideas on this matter ?

Cheers.
ZaiRoN
06-16-2004, 05:04 AM
it is comparing the CRC values of the files ?Could be. Put a bpm over the byte(s) you changed and check if there is a crc or something else...
markh51
06-16-2004, 05:11 AM
ZaiRoN:

I take it you are talking about using SoftIce, how do I do that ?

Do I use "bpm address" ? Then what do I look for ?

Also another problem I have with softice, is how do I get it to break at a certain address of a file if it has not loaded it yet ? I need to do this becuase I need to break in to the file more or less as soon as it loads.

Cheers.
JMI
06-16-2004, 12:26 PM
markh51:

You need to stop starting new threads each time you seem to have an additional question about reversing this program. You already asked your question about CRC checking here and we don't need a separate thread about it from you. Once again you have also failed to do your own searching and research, both about CRC techniques and about how to make softice work. It does come with a manual, which you should read.

Regards,
markh51
06-16-2004, 02:09 PM
For your information I have already looked through the SoftIce manual and read how the BPM works, but I don't understand how to use it in my situation.

Why every time when I ask a question do you always think I haven't bothered to look ? I always look at any manuals if available and on google.

So if you can be so kind to tell me how I can use BPM to do what zairon said I would appreciate it.

Thanks.
JMI
06-16-2004, 03:08 PM
markh51:

There are, at least two GOOD reasons why I question whether you have search before you ask a question.

1.) You NEVER state that you have SEARCHED for the answer to a question.

2.) You CONTINUE to ask questions that I KNOW have answers EASILY available by searching.

Take, for example your question "Do I use "bpm address" ? Then what do I look for ?

This tells me your haven't the slightest idea what a CRC check is doing and that, despite your protestations to the contrary, you haven't paid much attention to the Softice manual on the use of BPM (Address) and you really didn't SEARCH for information on the subject, or at least you didn't do so with ANY thought about what you were looking for.

Take for example this search:

http://search.earthlink.net/search?q=softice+%2B+bpm+address&area=earthlink-ws

The very first entry is to:

#Cracking4Newbies SoftIce Tutorial, found at http://www.woodmann.net/krobar/beginner/04.htm

Does that address LOOK FAMILIAR? It's right here.

It contains the statement:

BREAKPOINTING ON MEMORY ACCESS
--------------------------------------------------------
SYNTAX: BPM <address> R/W
The R/W tells SoftICe whether to pop up on a read or write operation to that address. The default is RW (read & write)

The third entry in the search was: Guide to SoftICE Commands
http://www.woodmann.com/crackz/Tutorials/Sicecref.htm

Does that address LOOK FAMILIAR? It's also right here.

It contains: BPM
Break point on memory access
BPM[size] address [R|W|RW|X] [debug register] [IF expression] [DO bp-action]

There are pages and pages of other references.

I KNOW this information is IN THE F*CKING MANUAL with explainations and examples.

There are also pages and pages of search references to CRC available. One such provides:

cyclic redundancy check
(algorithm)

Definition: (1) A method to detect and correct errors by adding bits derived from a block or string of bits to the block. (2) An algorithm to compute bits characteristic of a block based on the algebra of polynomials over the integers, modulo 2. (3) The characteristic bits of a block.

Now if you had read several of these articles on CRC you would understand that there has got to be a routine which "reads" (hint, hint, hint) the bits (or bytes) of the code to check against a "sum" which is generally hard coded in the software "somewere." So..... in order to "read" the bits/bytes there must be code which is reading all, or some significant part of your target's code. Hence the use of BPM <address> (R/W).

How you ask (again)? Well THINK about it. If it is going to "add" bits/bytes, it has to read the code. If you break when "some particular code" is read you will know you are possibly in a routine which is doing a CRC. Now this is not always WHY some code is being read, because it would also "read" an entered serial, but determining that code is being read would, at least suggest, it might be a CRC, and IF your target crashes after you change ANY code, you can pretty well be assured something akin to a CRC is happening. So now, the only thing you need to know is what <address> to check is being read. Well duh!!! How about the one (or more) YOU changed.

Now IF you had SEARCHED and READ any articles on REVERSING CRC (now there's an interesting search criteria) you would already know most of this and what to do if your BPM breaks on a read of the code you previously changed.

The main problem is that you appear to lack some of the most basic level skills of reversing. That, in and of itself, is where we all started and no reason for criticism. You, however, seem not to want to do this basic home work before you venture into the dark codewoods and then you scream for help when you get lost, instead of SEARCHING for the correct path with any forethought or significant effort on your own, or, at the very least, with NO demonstration you have done so. You certainly appear to be trying to fly, before you actually learn how to crawl.

Regards,
markh51
06-16-2004, 03:53 PM
Setting a BPM on the address I changed, does nothing. Any ideas ?
JMI
06-16-2004, 04:32 PM
Did you set BPM <address> or BPM <address> R/W ? Details ARE important.

The first one will NOT work. The second one should.

And you NEVER actually confirmed that you were, or were not using Win95.
If not what OS are you using?

Regards,
markh51
06-16-2004, 04:42 PM
I am using Win95

Using BPM address R, still does not work !

Do you think the prog could be using kernel32.readfile, to check the CRC of it self ? but it has to have the original CRC value to compare it against, so it must be coded in to the prog ?
markh51
06-16-2004, 04:52 PM
I set a BPX on the readfile and found a interesting piece of code, which the prog seems to loop inside of for a while, can you take a quick look and see what you think:

* Referenced by a CALL at Address:
|:00402F54
|
:00402EB4 55 push ebp
:00402EB5 8BEC mov ebp, esp
:00402EB7 51 push ecx
:00402EB8 53 push ebx
:00402EB9 56 push esi
:00402EBA 57 push edi
:00402EBB 8BF1 mov esi, ecx
:00402EBD 8BFA mov edi, edx
:00402EBF 8BD8 mov ebx, eax
:00402EC1 8B4510 mov eax, dword ptr [ebp+10]
:00402EC4 0FB75304 movzx edx, word ptr [ebx+04]
:00402EC8 23D0 and edx, eax
:00402ECA 3BC2 cmp eax, edx
:00402ECC 7558 jne 00402F26
:00402ECE 6A00 push 00000000
:00402ED0 8D45FC lea eax, dword ptr [ebp-04]
:00402ED3 50 push eax
:00402ED4 8B4308 mov eax, dword ptr [ebx+08]
:00402ED7 F7EE imul esi
:00402ED9 50 push eax
:00402EDA 57 push edi
:00402EDB 8B03 mov eax, dword ptr [ebx]
:00402EDD 50 push eax
:00402EDE FF550C call [ebp+0C]
:00402EE1 85C0 test eax, eax
:00402EE3 7511 jne 00402EF6

* Reference To: kernel32.GetLastError, Ord:0000h
|
:00402EE5 E8BAE3FFFF Call 004012A4
:00402EEA E8B5F9FFFF call 004028A4
:00402EEF 33C0 xor eax, eax
:00402EF1 8945FC mov dword ptr [ebp-04], eax
:00402EF4 EB3F jmp 00402F35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402EE3(C)
|
:00402EF6 8B45FC mov eax, dword ptr [ebp-04]
:00402EF9 33D2 xor edx, edx
:00402EFB F77308 div [ebx+08]
:00402EFE 8945FC mov dword ptr [ebp-04], eax
:00402F01 8B4514 mov eax, dword ptr [ebp+14]
:00402F04 85C0 test eax, eax
:00402F06 740A je 00402F12
:00402F08 8B4514 mov eax, dword ptr [ebp+14]
:00402F0B 8B55FC mov edx, dword ptr [ebp-04]
:00402F0E 8910 mov dword ptr [eax], edx
:00402F10 EB23 jmp 00402F35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402F06(C)
|
:00402F12 3B75FC cmp esi, dword ptr [ebp-04]
:00402F15 741E je 00402F35
:00402F17 8B4508 mov eax, dword ptr [ebp+08]
:00402F1A E885F9FFFF call 004028A4
:00402F1F 33C0 xor eax, eax
:00402F21 8945FC mov dword ptr [ebp-04], eax
:00402F24 EB0F jmp 00402F35

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00402ECC(C)
|
:00402F26 B867000000 mov eax, 00000067
:00402F2B E874F9FFFF call 004028A4
:00402F30 33C0 xor eax, eax
:00402F32 8945FC mov dword ptr [ebp-04], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00402EF4(U), :00402F10(U), :00402F15(C), :00402F24(U)
|
:00402F35 8B45FC mov eax, dword ptr [ebp-04]
:00402F38 5F pop edi
:00402F39 5E pop esi
:00402F3A 5B pop ebx
:00402F3B 59 pop ecx
:00402F3C 5D pop ebp
:00402F3D C21000 ret 0010

Thanks for your time.
dELTA
06-16-2004, 06:36 PM
Sure, I just took a look at it and it's a very fine piece of code indeed.

Now for the love of god will you stop posting pages of completely uncommented code here, not to mention start following the posting guidelines which people have been trying to get you to understand for the last week or so!?! :mad:
markh51
06-17-2004, 01:19 AM
The reason why it is un-commented is because I don't know what it is, so I was asking if you could tell me whether or not it looked like the CRC checking routine, as placing a BPM over the changed code does not work.
bilbo
06-17-2004, 02:39 AM
Hi, Markh51,
a snippet of code with external function calls is really tough to attach.
Here is anyway an hypothesis...

; function name:
; get_elements_from_file(arg0, arg1, arg2, arg3)
; passed arguments and registers:
; arg0 error on read bytes mismatch
; arg1 function, ReadFile
; arg2 sort of flags, the bits inside [EAX+4] must be set here
; arg3 out address, to put-in the number of elements read, or NULL
; EAX must be the pointer to a structure describing one element:
; +00 field: file handle
; +04 field: sort of flags (16 bits)
; +08 field: element size
; ECX number of elements
; EDX buffer to be filled inside this function
; return 0 if ko, else the number of elements retrieved

; function prolog
402EB4 push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx ; number of elements
mov edi, edx ; buffer

mov ebx, eax ; passed struct pointer

; check: arg2 flags(?) must have set the bits inside [struct+4] flags
mov eax, dword ptr [ebp+10] ; arg2
movzx edx, word ptr [ebx+04]
and edx, eax
cmp eax, edx
jne 402F26 ; return ko

; read: must return not-zero
push 00000000 ; lpOverlapped
lea eax, dword ptr [ebp-04]
push eax ; lpNumberOfBytesRead
mov eax, dword ptr [ebx+08] ; elements size
imul esi
push eax ; nNumberOfBytesToRead
push edi ; lpBuffer
mov eax, dword ptr [ebx]
push eax ; hFile
call [ebp+0C] ; arg1: ReadFile?
; check the result
test eax, eax
jne 402EF6 ; ok
; the read failed
call 4012A4 ; GetLastError()
call 4028A4 ; acknowledge_return_code(passed in EAX)
; return 0
xor eax, eax
mov dword ptr [ebp-04], eax ; retval
jmp 402F35 ; return 0 (ko)

402EF6 mov eax, dword ptr [ebp-04] ; number of bytes read
xor edx, edx
div [ebx+08] ; divide by number of bytes per element
mov dword ptr [ebp-04], eax ; retval: number of elements read

; store the number of elements read if passed address is not null
mov eax, dword ptr [ebp+14] ; arg3
test eax, eax
je 402F12 ; skip storing result
; do the storing
mov eax, dword ptr [ebp+14] ; arg3
mov edx, dword ptr [ebp-04] ; number of elements
mov dword ptr [eax], edx
jmp 402F35 ; return number of elements

; check if we have got the requested number of elements
402F12 cmp esi, dword ptr [ebp-04] ; retval
je 00402F35 ; return ok (number of elements read)

; on failure
mov eax, dword ptr [ebp+08] ; arg0: error on read bytes mismatch
call 4028A4 ; acknowledge_return_code(passed in EAX)
; return 0(ko)
xor eax, eax
mov dword ptr [ebp-04], eax ; retval
jmp 00402F35 ; return 0

; return ko
mov eax, 00000067
call 4028A4 ; acknowledge_error_code()
; return 0(ko)
xor eax, eax
mov dword ptr [ebp-04], eax ; retval

; return EBP-4
402F35 mov eax, dword ptr [ebp-04] ; retval

; function epilog
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0010 ; clear the 4 arguments

So, no CRC checking, as you see.
Regards, Bilbo.
Kayaker
06-17-2004, 03:00 AM
Hi markh51

Could be part of a checksum code, but it could also be your grocery list for all the use it is ;-) We have absolutely no perspective on where this code lays or what it might be doing, and there are probably only 1 or 2 clairvoyants on the forum and they're busy guessing on the stock market. (EDIT: OK, Bilbo must be one of them :p)

This is where doing background research on all of the dozens of "CRC" threads, or on any of the subjects you've been trying to tackle lately, beforehand is useful - to give you a better perspective on what to look for. An app might use CreateFile/ReadFile to read a copy of itself in to check it, but it might also use OpenFile, _lopen, _hread, _lcreat, MapViewOfFile, maybe others, so you should also rule these API's out.

Let's say the app uses ReadFile to copy sections of itself into memory and perform some check on it. The bytes it's checking are in memory somewhere (i.e. the lpBuffer address of ReadFile), NOT on the bytes in the running image file that you tried to set a BPM(R) on. Two different addresses, not surprising it doesn't break.

Again, you need to approach this slowly and logically. Is ReadFile called only once (reads the whole file), or several times (reads it in sections)? How many bytes does it read in? At what starting address(es) is the file read? And where does it store it?

If you can you find your patched bytes in the read-in memory, THEN maybe you can set a BPM(R) on that address and see where it takes you. Can't find your patched bytes? How about setting a "tag" you can search for. Assuming your patched code isn't actually run until after the crc check passes (check with BPX/BPM(X)), you might be able to make your "patch" a distinctive character tag you can search for. Say "EMKCUF". Since it's going to fail the check anyway, who cares?

Keep trying, but remember, engage mind before keyboard... ;)

Cheers,
Kayaker
markh51
06-17-2004, 03:10 AM
Bilbo:

I am VERY greatful for you going through that piece of code for me even though it was not the routine I was looking for.

EDITED: Due to the post above being posted as I was typing this one ;)

Thanks for that Kayaker :yay:
markh51
06-17-2004, 05:09 AM
Kayaker:

Ok, what I done was modified the NTICE string to unique string. I ran the file an sure enough it crashed. So I seached for my string in memory using the S command, and I found a pattern match, so I noted down the memory location and set a "BPM address R" and ran the file again... It did not break, Any ideas why ?

Cheers.
dELTA
06-17-2004, 06:54 AM
Somewhere around the hundredth time you ignore people's tips about what do do, when to post, what to post and how to post, maybe people will start getting really annoyed with you...

Tha answer to your last question is already explicitly in Kayaker's post above, not to mention the tip of trying to think before you post, not just step-by-step following any detailed instruction you might find anywhere (including misunderstanding it first in half of the cases), and then posting again as soon as it didn't produce a crack for you. Aaargh!
Kayaker
06-17-2004, 09:47 AM
Ok, what I done was modified the NTICE string to unique string.

I am using Win95

HuH?? Just out of curiousity why are you patching the string 'NTICE'?
markh51
06-17-2004, 09:58 AM
It doesn't matter now, I've found the code which does the CRC check, easily bypassed :D
Stone-D
06-25-2004, 01:48 PM
JMI: Offtopic, appologies. Throughout all my years on the net, from usenet to forums, I've only encountered one admin, on the Mailtraq mailing lists, from whom I dreaded a reply. You have knocked him from that spot. Salute. :)
JMI
06-25-2004, 03:20 PM
I believe this is called "damning by faint praise". :devil: :D

Regards,


Armadillo horror
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo horror
PDA

View Full Version : Armadillo horror

hipu
06-13-2004, 09:33 AM
Hi

This is my 1st attempt to unpack armadillo - and its not going so well...
my 1st problem is finiding the encryption procedure so i can NOP it - following the tutorial (english translation) from ricardo, after i set BP WriteProcessMemory, i see nothing in my call-stack window (except for the WriteProcessMemory call - doing Actualize doesnt help either) and no other valid return address in the stack window :

0012D938 004F9B80 /CALL to WriteProcessMemory from mytarget.004F9B7A
0012D93C 0000004C |hProcess = 0000004C (window)
0012D940 00442000 |Address = 442000
0012D944 00A94B90 |Buffer = 00A94B90
0012D948 00001000 |BytesToWrite = 1000 (4096.)
0012D94C 0012DA54 \pBytesWritten = 0012DA54
0012D950 00000001
0012D954 00000411
0012D958 0012F568
0012D95C 00000045
0012D960 00561378 mytarget.00561378
0012D964 00560000 mytarget.00560000
0012D968 005620A0 mytarget.005620A0

i did try to NOP some procedure call which looked to me like the decryptor call, but when i reach to the final step CALL DebugActiveProcessStop, after the call a new OllyDbg process starts (im guessing cause of an error...) - attached to the son, and crashes...

my question is this - how can i find the encryption call?

also, an (un)related question - is the LPE armadillo plugin can handle the 1000 bytes blocks and nanomites protection or is it only for the simple armadillo protection?

//////////////////////////////////////////
here are the steps i am trying to follow :

1. BP WaitForDebugEvent
F9
dump DebugEvent
BC WaitForDebugEvent
2. BP WriteProcessMemory
F9
dump window - offsets changed shows OEP
BC WriteProcessMemory
set conditional BP on WriteProcessMemory : [ESP+8] , Log = Always
3. look at stack-calls window - next call after WriteProcessMemory is encryptor. go to adr
call, search for refrences - the 2nd one is the DEcryptor - go there, and NOP the call
4. Ctrl-F9
F8
start PUPE
patch OEP to EBFE
5. BP WaitForDebugEvent
F9
look at stack dump - goto caller of WaitForDebugEvent and set origin from there
NOP the call to WaitForDebugEvent and the PUSHs (from PUSH 3E8)
change the JE to : JMP 401000, and add a NOP line after
change offsets of OEP in dump window to 400000 (3 places)
goto 401000 and add :
ADD DWORD PTR DS:[oep_offset1], 1000
ADD DWORD PTR DS:[oep_offset2], 1000
ADD DWORD PTR DS:[oep_offset3], 1000
CMP DWORD PTR DS:[oep_offset3], .rdata starting offset (look at mem view to get value)
JNZ <line after JMP 401000>
NOP
set BP on NOP
PUSH <child handle>
CALL DebugActiveProcessStop
NOP
set BP on NOP
F9
F9
if eax = 1 then all ok
6. close olly
start olly
attach to process
F12
change value at OEP to 55 8B
LordPE - select IntelliDump, and dump full
Ricardo Narvaja
06-13-2004, 11:35 AM
The 2 or 3 crackers with your call stack truoble, download the ollydbg.ini of crackslatinos page and the call stack show all calls perfect, i don't know what configuration is different but with this ini work perfect, try and tell me if you can work with this ini.

Página de CRACKSLATINOS
http://www.crackslatinos.hispadominio.net/

Ricardo Narvaja
hipu
06-13-2004, 12:27 PM
hi ricardo - and tnx for your excellent tutorials btw... i admire the time and effort you contribute to the community (yea, forums and all..)

i still dont get anything usefull (at least as it looks in your tutorials) in my stack/call stack window. if i scroll down the stack (some 70 lines) i can find some intresting return adr :

0012D938 004F9B80 /CALL to WriteProcessMemory from mytarget.004F9B7A
0012D93C 0000004C |hProcess = 0000004C (window)
0012D940 00442000 |Address = 442000
0012D944 00A94B90 |Buffer = 00A94B90
0012D948 00001000 |BytesToWrite = 1000 (4096.)
0012D94C 0012DA54 \pBytesWritten = 0012DA54
...
...
0012DA5C /0012DA90
0012DA60 |004F87EE RETURN to mytarget.004F87EE from mytarget.004F8B36
0012DA64 |00000041
0012DA68 |00A92B6C
0012DA6C |00000000
0012DA70 |00000001
0012DA74 |00000411
0012DA78 |0012F568
0012DA7C |7FFDEC00 UNICODE "DILLOOEP"
0012DA80 |00524AE0 mytarget.00524AE0
0012DA84 |00524AE0 mytarget.00524AE0
0012DA88 |00000001
0012DA8C |0012F578
0012DA90 ]0012F578

and looking into adr 004F87EE shows :

004F87E4 51 PUSH ECX
004F87E5 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
004F87E8 52 PUSH EDX
004F87E9 E8 48030000 CALL mytarget.004F8B36
004F87EE 83C4 0C ADD ESP,0C
004F87F1 25 FF000000 AND EAX,0FF
004F87F6 85C0 TEST EAX,EAX
004F87F8 75 07 JNZ SHORT mytarget.004F8801

finding refrences to mytarget.004F8B36 reveals another call (which looks to me like the re-encryptor) :

004F8AAE 8B0D E8655200 MOV ECX,DWORD PTR DS:[5265E8]
004F8AB4 8B15 EC655200 MOV EDX,DWORD PTR DS:[5265EC]
004F8ABA 8B048A MOV EAX,DWORD PTR DS:[EDX+ECX*4]
004F8ABD 50 PUSH EAX
004F8ABE E8 73000000 CALL mytarget.004F8B36
004F8AC3 83C4 0C ADD ESP,0C
004F8AC6 50 PUSH EAX
004F8AC7 F7D0 NOT EAX
004F8AC9 0FC8 BSWAP EAX
004F8ACB 58 POP EAX
004F8ACC 73 00 JNB SHORT mytarget.004F8ACE

btw - ive tried the ollydbg.ini both versions 1.10step3 and 1.09dstep4 - same results.
one remark about the ini though - before using it olly wasnt able to disasm the all exe, only parts of it, and showed me lots of meaningless opcodes (i had to re-analyze each time) - using the new ini solved that.
Ricardo Narvaja
06-13-2004, 01:06 PM
If the call stack don't show the info in the stack the RETURNS TO ..... give you the same information.

Ricardo Narvaja
JMI
06-13-2004, 02:29 PM
hipu:

Despite the fact that you are struggling with your first efforts with ARMA, I wanted to acknowledge the effort you have made with your first posts here which clearly demonstrate that you put some thought into what you posted and did a very good job at following the guidelines for these Forums.

You were careful to make sure that the code you posted did NOT identify your specific target (others should note how it is fairly easy to substitute "mytarget" for the "real" name of the target) and you clearly described what you had reviewed, what steps you had followed and where you were having your problem. More of our first time posters could learn by your example. Keep up the good effort and good luck with your project.

Regards,
Heathcliff
06-13-2004, 05:43 PM
I'm also trying to unpack an arma. I found that the DEcrypter call and the ENcrypter call were not the same in my target:

005D0172 CALL 5D04BF ; DEcryter call
|
005D022A CALL 5DC4A0 ; ENcrypter call

If you found the DEcrypter call, then scroll a bit down. The next immediate call will probably be your ENcrypter call.

Good luck!
Heathcliff
hipu
06-14-2004, 11:28 AM
ok ppl, thank you for all your help - mytarget is dumped and now im working on the lovely IAT.

i was just wondering how come olly didnt produce proper call stack - even when using the same ollydbg.ini ricardo used.

Heathcliff: it is a bit strange encryption & decryption will be diffrent procedures... in mytarget however, it was same. best of luck in yourtarget ;)

JMI: thank you for the kind words

btw, and im just throwing my hat here - is there any spanish member who is willing to translate PUPE to english (reversing the resources using resource-editor isnt such a bad idea either...) ?
SHaG
06-14-2004, 11:51 AM
I wonder if the stack window trouble is caused by the "always trace over system dlls" setting... Just a thought.
Ricardo Narvaja
06-14-2004, 12:16 PM
The tuts of armadillo with copymem2 was made with old ollydbg maybe 1.09 or 1.08 you try with old versions of ollydbg ?

Ricardo
hipu
06-14-2004, 12:19 PM
oldest one i tried was version 1.09dstep4
Ricardo Narvaja
06-14-2004, 12:22 PM
I don't remember well the number of ollydbg of the tut but for the date i think 1.09b or less. All ollydbg are in mi http in herramientas.

Ricardo
Js
06-14-2004, 12:37 PM
"is there any spanish member who is willing to translate PUPE to english"
carful you don't fall over it ;)

_http://www.woodmann.net/forum/showthread.php?t=5478&highlight=pupe+eng%2A
hipu
06-14-2004, 03:51 PM
:whoops:

greetings my friend :yay:


hi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > hi
PDA

View Full Version : hi

izzi
06-13-2004, 10:15 AM
Hi,

I have a program which unlocks.. pansonic x60/x66. the problemis when i open it.. which was opened using .rar program. when i click on the program it shows a a small window:

with:

hardware finger print (????-????)
name:
key:

is this program protected using armadillo yes? no?

how do i know if a program is prtected by armadillo?

is there a quick solution>?

the program was made very recently.

regards
izzi
ZaiRoN
06-13-2004, 10:51 AM
how do i know if a program is prtected by armadillo?
is there a quick solution>?1. Read the FAQ
2. Search the board

Good luck!
mr.x
06-13-2004, 06:31 PM
Use PEiD 0.9x to detect the protection


A Request to all Posters on posting replies
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > A Request to all Posters on posting replies
PDA

View Full Version : A Request to all Posters on posting replies

Kayaker
06-13-2004, 02:39 PM
Hi All,

There seems to be a growing tendency when replying to a post to use the 'Reply With Quote' or 'Quick Reply to this message' buttons. This is convenient and I tend to do it myself. The problem is that some people rarely edit out the unneeded parts of the points they are replying to, and we often end up with posts with a one sentence reply and a several paragraph original Quote, over and over again.

Besides being redundant and making the thread more difficult to read, this is causing the size of the forum database to grow at an alarming rate. For example, the DB download for archive/backup purposes in January was 180Mb, now it's over 300Mb. I hate to extrapolate to next year at this time.

The DB is backed up daily on the server and the size isn't really a big deal, but for those of us who download it regularly to our harddrives for safety, size does matter as they say. Note that this will also increase the size of the Archive .chm file of the forum unnecessarily, which you guys/gals download. For those of you who have it, you also know that QUOTE tags are lost in the .chm file, making the threads even more confusing to read.

I'm not certain why the increased tendency to include quotes, I think it's just the layout of the new VBulletin version we're using and the 2 "quote" reply buttons, the regular Reply button at the end of the thread is not quite as prominent.

All we're asking is that people be aware of this and be a little more selective when including quotes, and we'll have a more streamlined and easier to read forum.

Thanks.

Regards,
Kayaker
JMI
06-13-2004, 03:15 PM
Kayaker:

I seem to recall reading about some mods on the vBulletin.org Forum to change the position and/or location of the "reply with quotes" button and/or add a standard "reply" button which did not quote the post. I know I've visited sites using vBull which had removed that as a standard or moved it from it's prominent location. Maybe we should consider the modification ourselves. What I've seem most prequently are separate "reply" and "quote" labelled buttons, which make it clear when one is "quoting" and/or just replying.

Regards,
esther
06-25-2004, 11:53 AM
what about cut and paste certain imoprtant portions? I think it would reduced the database.my 2 cents

Regards
Kayaker
06-25-2004, 03:05 PM
Thanks for the suggestion Esther, actually, we've got a couple of other ideas as well. One is to fix the buttons so they are a bit more logical and don't default to including quotes.

The other is to make sure the server goes down every few days, as it just did, so no one can reply to anything! I figure if "someone" crashes the server for 10 days out of every month our database growth will decline by 1/3... :p

Cheers,
K.
JMI
06-25-2004, 03:38 PM
Just to keep the record straight:

No one "crashed" the server on this occasion. I have it on good authority that there was simply an accounting error with the company hosting the server and they locked us out until the issue was resolved. :whoops:

Regards,
dELTA
06-27-2004, 01:41 PM
Last time I checked, the prime suspect of a certain act does not count as "good authority" for information implicating his innocence. :devil:
JMI
06-27-2004, 01:59 PM
Well then, there is no excuse for not checking the logs, is there?

Hope you had a good "midsommarafton."

Regards,
dELTA
06-27-2004, 02:07 PM
It's happened before, and I'm quite sure it could happen again, that "someone" could take down the server without leaving a single trace in most kinds of logs. :D And thanks, midsommarafton was great. :)


Manual unpacking Virogen Crypt v0.75 question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Manual unpacking Virogen Crypt v0.75 question
PDA

View Full Version : Manual unpacking Virogen Crypt v0.75 question

akimp3
06-13-2004, 04:14 PM
Hi

I have read the hacnho Manual unpacking Virogen Crypt v0.75 tutorial
it works great on his crack me, but on my target i can not find the pattern
jnz xxxxxxxxx
mov eax,1
retn 0c
push xxxxxxx
retn
Is there anyone who has worked on this and could help me?

Thanks

akimp3
TQN
06-14-2004, 08:07 AM
Yes, the tutorial of hacnho did not correct. It work only with his machine... I have unpacked the Virogen Crypt v0.7 in the past. It is easy to unpack. As I remember, you can use the bp GetProcAddress in OllyDbg, F12 to run until return. Scroll down until you find a a some jmp/je/jne. Bp them and one of them will be a jump to OEP.
Regards
akimp3
06-14-2004, 10:50 AM
Hi
Thank you for your quick reply.
I have added a breakpoint on getprocaddress in kernal 32.
then i clicked F9 to run.
it braks in getprocaddress
i clicked execute til return ctrl+f9 (not f12 as you told).
it goes to the return a the end of getprocaddress in kernel 32
you told me to scroll and find the jump. i am still in kernel 32 should
i put breakpoint in there or i missunderstood.
please give me some advice

Thanks

akimp3
sTfN0X
06-14-2004, 11:37 AM
As stated before, unpacking Virogen Crypt is quite easy. Just put a bp on GetProcAddress and press F9. When Olly breaks, clear the bp. Then press CTRL+F9, then F8 once and you will be out of Kernel32. After that scroll down till you see a RET (2 lines after a RET 0C). put a bp on the RET, F9 to run and break on the RET. then F8 once and you're at the OEP.
akimp3
06-15-2004, 01:49 AM
Hi
Thank you for your good reply.
I have done all the step but after the f8 when i come out of kernel32.dll
in the main exe i am on a ret command, i scrolled down to find the ret 2 line after ret 0c but there is no ret 0c in this exe at all i have scrolled to the end
bur i have not found any ret 0c.
Could you please give me an advice?
Thanks

akimp3
sTfN0X
06-15-2004, 03:41 AM
Well, there's also another solution. A bit more complicated though, PM and I'll take a look at it. ;)

Regards,

sTfN0X


IceExt 0.64
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceExt 0.64
PDA

View Full Version : IceExt 0.64

$tEpHoNz
06-13-2004, 09:26 PM
Installed I have softice DS 2.6 w/ iceext 0.64 and iceext refuses to do anything. It use to start softice (0.62) if it wasnt manually started. Now nothing. Also I get "Extension command not found" with !protect on and any other command. Just curious if its a DS compatibility problem or something simple I may have overlooked. Thx for replies.
-$-
l0rtsu
06-14-2004, 08:26 AM
http://www.exetools.com/forum/showthread.php?t=4300
$tEpHoNz
06-14-2004, 02:41 PM
iight I'll go back to 0.62 Thx for info...nice forum overthere
-$-
Uradox
06-16-2004, 06:48 AM
Hmm i have a simular problem with ds 2.7 and 0.64 but only in regards to the Extension command not found problem. Not one command seems to work for me. Pitty the website posted in that thread doesnt have an archive of older versions to get.
Mind you for the past 2 years softice has hardly worked with my hardware - now finaly it works! I am happy :devil:
JMI
06-16-2004, 12:42 PM
Using "iceext" in google (without the quotes) finds links to several older versions of the program. How about you try that. :idea:

Regards,


Do you use your reversing knowledge to cheat in games?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Do you use your reversing knowledge to cheat in games?
PDA

View Full Version : Do you use your reversing knowledge to cheat in games?

Aquatic
06-13-2004, 09:47 PM
Do you?
nikolatesla20
06-13-2004, 10:47 PM
I've written a few trainers, for example I wrote one for Serious Sam so I could play multi with my roomate, and we could rocket jump everywhere without dying. ALso wrote a cheat for Rainbow Six for single player, infinite health..

IDA helps a lot for reversing games.

-nt20
Solomon
06-13-2004, 11:38 PM
It's common in China to use trainers for online games. Some authors of trainers got very rich by selling trainers to players. The government has announced online-game-trainers as "illegal publications". People who make or sell trainers for online games will be punished.
+SplAj
06-14-2004, 01:50 AM
Hi Solomon

good to see you are still around.......

When will those in charge ever learn. This world is run by commerce and by entrepreneurs NOT by 'them' and their stupid rules.

Let business be free and then apply a tax model.... all round happiness :)

ciao
esther
06-14-2004, 10:20 AM
hmm seems like off topic :devil:
SiNTAX
06-16-2004, 05:56 AM
Wrote my fair share of trainers back in the old days.. u know.. for fame, not fortune.. not much left of that according to google :)

Only thing left I could find was some meager greetings.. lol..
, SINTAX /TSL (NICE TRAINERS! YOU'RE LOYAL TOO..),
hxxp://asle.free.fr/groups/Silents/_txt_/saturn.txt

Man.. talk about wasted time :-)
Solomon
06-17-2004, 11:14 PM
Hi, +SplAj

Nice to see old friends still here :)

sorry for that off topic...


Can't see WIN32K with SoftIce?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Can't see WIN32K with SoftIce?
PDA

View Full Version : Can't see WIN32K with SoftIce?

bilbo
06-14-2004, 11:44 AM
Platform: Windows XP SP1; DriverStudio 3.1.
Tried to look at some WIN32k Data/Code.
No success. Code is INVALID, Data is ????????.
"mod win32k" gives BF800000, but PEheader pointer is 00000000.
Anyone has experienced such oddity?

Cheers, Bilbo.

Maybe paged out because too big? But PAGEIN does not work...
Kayaker
06-14-2004, 12:07 PM
Hi

What do you get if you try it from the context of a user mode program which has a gui component and has partially loaded enough to register some of its window classes / created its controls? Under these conditions win32k.sys should have kicked in by now I would think.

K.
bilbo
06-15-2004, 01:36 AM
Thanks, Kayaker, I could have thought it myself. I fall again on the "context" subject.

Furthermore, also Microsoft Kernel Debugger (kd -kl) has the same behaviour.
On the other hand, Russinovich's LIVEKD shows win32k address space without problems.

Best regards, Bilbo.


tut question...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > tut question...
PDA

View Full Version : tut question...

MEPHiST0
06-15-2004, 02:51 AM
hey wassup..

i wrote a tut on arma + debug blocker..
uses a shareware app.. is that ok? :)
OorjaHalT
06-15-2004, 03:31 AM
Yeah great but where do we find them :yay:
JMI
06-15-2004, 03:50 AM
Send the tut to Woodmann by PM and he will evaluate it for posting on the Fravia site linked at the bottom of these Forums, where the other tuts are posted.

You can also post it at exetools if you are a member or send it to me by PM and I can post it there for you. :idea:

Regards,
MEPHiST0
06-15-2004, 02:50 PM
k thanks JMI :)

i would post it on EXE Tools forums myself.. but silly registration is down ;)
tell some1 there to make me a user name and pass :D
JMI
06-15-2004, 04:11 PM
MEPHiST0 :

I have your tut and will post it on the exetools "Windows Crack Tutorials" shortly. I can not get you a membership unless and until Aaron decides to re-open membership. They are now down from 18, 000+ to 912 members so it is obvious why most people joined up. :idea: (Upload on exetools complete.)

Regards,
JMI
06-15-2004, 08:31 PM
MEPHiST0:

Per your request, I have posted your modified tut in place of the original on the exetools forum. :yay:

Regards,
venom925
09-06-2004, 05:49 PM
is there any way the MEPHiST0 tuts sould be posted here, the exetools forum require that u post atleast 3 time and that left up to god knows who to judge if its worthy. i only want to learn from the tut

i found the tut i was looking for just by doing a little more searching
peterg70
09-07-2004, 06:30 AM
I find it difficult to actually get to the site (exetools) Just page not displayed.

Any thought on why its always down?

Peterg70
venom925
09-07-2004, 06:35 AM
i get the page to come up all the time

MEPHiST0:
is there a updated version of your tut, not the one on the fravia whats new sightand the exetools sight, i dont like that sight cause i cant dl there? if so where would i be able to dl that file?
JMI
09-07-2004, 08:57 PM
Well venom925:

With regard to your statement about exetools that:

"u post atleast 3 time and that left up to god knows who to judge if its worthy,"

the guy who drew the short straw and has to make that judgment would be me. :yay:

Regards,
venom925
09-08-2004, 08:08 AM
the guy who drew the short straw and has to make that judgment would be me. :yay:

Well no disrespect intended. I just really wanted to dl that tut so i could read it and learn from it, kinda ticked me off to no end when i could not dl it :whoops:
JMI
09-08-2004, 10:54 AM
I took no offense at your post, whether or not you might have intended any adverse comment. :yay: I was simply attempting to answer your question. :cool:

And how hard can it really be to get 3 posts which aren't some variation of a "thank you," "cool", or "nice work" type post count spam? ;)

Regards,
venom925
09-08-2004, 06:00 PM
does anybody know if there is a updated tut by MEPHiST0 for arma
JMI
09-08-2004, 08:02 PM
Have not seem mention of a specific Update, although he has another Tut posted on exetools.

http://www.exetools.com/forum/showthread.php?t=4632

I suspect that Ricardo's multipart tutes on the "destruction of table" may be of later versions of the protection. Mentioned here and on exetools as well:

http://66.98.132.48/forum/showthread.php?t=4810.

There are also some other discussions which you probably have seen on the exetools forum about some of ARMA's latest tricks.

Regards,


FSG 2.0 oep finder
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > FSG 2.0 oep finder
PDA

View Full Version : FSG 2.0 oep finder

cooper
06-15-2004, 04:21 AM
Anyone has studied the unpacking algo?
so as for me I did it the following way:
look for 95 8B 07 40 78 bytes
-------
XCHG EAX,EBP
MOV EAX,DWORD PTR DS:[EDI]
INC EAX
-------
look down 8 bytes for
JMP DWORD PTR DS:[EBX+C]
set bp after break step into oep
tested on many executables - works fine.

here is amy script for ollydbg

// FSG 2.0 OEP Finder
// by cooper @ http://www.woodmann.net

var x

findop eip, #958B0740#
mov x, $RESULT
add x,8
bp x
run
sto
bc x
cmt eip, "This is the entry point"
ret

also add to userdb.txt of peid if you use it:
[FSG v2.0->bart/xt]
signature = 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13
ep_only=true


Worst case worm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Worst case worm
PDA

View Full Version : Worst case worm

mike
06-15-2004, 08:45 AM
Thought some might find this interesting.

http://www.icir.org/vern/papers/worst-case-worm.WEIS04.pdf
Polaris
06-15-2004, 01:11 PM
Really interesting! Thanks! ;)


Classic......404 file not found
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Classic......404 file not found
PDA

View Full Version : Classic......404 file not found

+SplAj
06-15-2004, 09:28 AM
http://www.methodlab.com/404.swf

:yay:
esther
06-15-2004, 11:24 AM
LOL :devil:
JMI
06-15-2004, 12:25 PM
I guess I'm going to have to turn my sound back on. :idea: :devil:

Regards,
klier
06-15-2004, 04:27 PM
bad link :mad: :)
i like this one
http://sh.newsun.dk/404.php
Regards,
dELTA
06-15-2004, 05:52 PM
bad link :mad:
Yeah, did you get a 404 when trying to access that link too? :D
Kayaker
06-17-2004, 04:00 PM
Not for newbies apparently ;-)

http://www.aaerox.com/


Crackme and Sources
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Crackme and Sources
PDA

View Full Version : Crackme and Sources

kinMD
06-15-2004, 10:53 AM
HI

I need help . Where can I find Crackmes With Their Sources ?

Thanx In Advance...
JMI
06-15-2004, 12:19 PM
First, try using your brain. You want "crackmes" with "sources." Try entering those two terms (without the quotes) in your favorite search engine and see what you get. Something really complicated, like:

http://www.google.com/search?hl=en&ie=UTF-8&q=crackmes+and+sources

Regards,
ZaiRoN
06-15-2004, 12:49 PM
Hi kinMD,
try to got at www.crackmes.de , there are tons of crackmes but only few with source. I am pretty sure Harlequin's crackmes comes with the sources, don't know about the others.
Btw, most of the solutions comes with keygen's source code...

zai.
kinMD
06-15-2004, 02:54 PM
Thank You JMI and ZaiRoN :) I appreciate your help . Thanks again .


dumping securom 4.8 via loader
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > dumping securom 4.8 via loader
PDA

View Full Version : dumping securom 4.8 via loader

AmAdEuS
06-15-2004, 11:58 AM
hello,
our team has made a loader that enables warcraft3/Tft to connect to pvpgn-server by patching out the server-auth...

the loader hooks the GAMEMAIN function of game.dll and patches the few jumps in mem, and replaces the hash-routine for the pw's with the one of starcraft.

since our former source of the nocd-crackz has been busted i tried to make these on my own,too ,but encountered lots of difficulties when dumping with icedump etc...

so my questions is (before i go and code all this i thought it'll be clever to ask first) if it would work if i read the complete process-memory from war.exe @ the execution of the hooked GameMain function and write this to a file then.

would this gimme a correct decrypted dump of the exe, or does securom rencrypted certain parts again after they have been used? (it's securom 4.8.x)

perhaps anyone has already done this and made some experience with it, or may even provide some code for masm/nasm that shows how to do this effeciently...
thx for your time and help....
evlncrn8
06-15-2004, 05:30 PM
you'd have to dump it at true ep, rebuild imports and fix all the api calls, and triggers if there are any (though i dont think there are). try using the search button next time too
AmAdEuS
06-16-2004, 12:51 PM
i've read the other threads... i just didn't seem to even get an dump with the correct size...
i'd thought of (after having an correct dump) compare the gimpsRUS vcrack from an older version of the game with a clear dump of the uncracked exe from same version, so i can see what he did to the triggers etc...

but if i dump from the EP on it won't be the same size as his exe... although the file in mem seems same sizze as the file on disk...

so i don't understand why dumping it leads to another size...
forgive me if i'm sutpid in your opinion, but i'm new to all this, i some smaller appz in asm now and cracked some hash-functions inmem etc, but never dealed with copy-protections
AmAdEuS
06-16-2004, 12:54 PM
perhaps could just be so kind to tell step by step how to get this file to disk?
i've really read all i could find about it but still doesn't seem to do it right...

my startup is to replace game.dll by my own dll, which will then load game.dll
so to be more excact, what must this url do to write down the correct exe as it lies in mem, and why the hell is it changed on readproc @ all?

here's the src:

; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««

; DLL for dumping war3.exe
; by AmAdEuS ,coded for MASM32

; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««

.486 ; set processor model
.model flat, stdcall ; default STDCALL calling convention
option casemap :none ; always use the case sensitive option

include include\windows.inc
include include\user32.inc
include include\kernel32.inc

includelib lib\user32.lib
includelib lib\kernel32.lib

; «««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««

; -----------------------------------------------
; procedures
; -----------------------------------------------
Dump PROTO :DWORD
; -----------------------------------------------
.data

CrackBuf byte 1568211 dup (?)
DumpEntryAddr dd 0
written dd 0

;-----------------------------------------------------
.code
LibMain proc hInstDLL:DWORD, reason:DWORD, unused:DWORD

.if reason == DLL_PROCESS_ATTACH
invoke GetModuleHandle,NULL
mov hInstance, eax

mov eax, TRUE
invoke Dump.addr CrackBuf

.elseif reason == DLL_PROCESS_DETACH
;blabla
.endif

ret

LibMain Endp

; ««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««

Dump proc lpBuffer:DWORD,

invoke GetCurrentProcessId

invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,eax
mov DumpEntryAddr, eax

invoke ReadProcessMemory,DumpEntryAddr,lpBaseAddress,lpBuffer,1568211,addr written

; shouldn't Crackbuf contain the full decrypted exe @ this point?

Crack endp

; ««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««««

end LibMain

;AmAdEuS (who feels so small among the ppl here :( )
gook
06-16-2004, 03:51 PM
What you need to do is make a dump of the code section. The code section doesn't change in size. Use a pe tool to find it's size and dump it at the right moment.
AmAdEuS
06-16-2004, 04:32 PM
thx alot... the hint i missed :)
evlncrn8
06-16-2004, 05:05 PM
oh btw last war3 exe i checked on the update was securom 5, and from your code it looks like you have a hell of a lot more work to do although you're in luck it has no triggers, so just true ep patching, rebuild, import rebuild, api call rebuild, job done


Java application packed with towerj
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Java application packed with towerj
PDA

View Full Version : Java application packed with towerj

regor
06-15-2004, 02:04 PM
Hi,

does someone has unpacked java class files packed with Towerj (tools which encaspulated a JVM in order to provide an exe file) ?
Clandestiny
06-16-2004, 06:59 PM
Hiya,

I'm not familiar with Towerj, but Java should be quite easy to unpack. It falls prey to the same ol' vulnerability that every piece of packed code falls to (ie. it must be decrypted before it can run). The java code has to be decrypted before its loaded into the jvm class loader. See the msjava.dll export java_lang_ClassLoader_defineClass0.

I actually had some experience with this type of target a long time ago and ended up patching msjava.dll to dump the encrypted class files to disk and then to reload a patched class from the disk at runtime.

See my original thread on the subject here:

http://www.woodmann.net/forum/showthread.php?t=1692&highlight=Java+unpacking

Clandestiny


Need programming tips to achieve this effect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Need programming tips to achieve this effect
PDA

View Full Version : Need programming tips to achieve this effect

homersux
06-15-2004, 03:54 PM
I need to write a win32 program (maybe service) that works on windows 2000 that will totally blank the screen (black) and not responding to user input (keyboard/mouse, including all the hot keys). The machine will appear dead but is actually working. (optional) Upon getting a secret passphrase from the user, the machine restores to its original state. The 2nd part is optional.

I have done a lot of research but I haven't found much useful (powerful and genreic) information on this aspect of windows. I wrote a screensaver hoping to achive this. But it has two problems,
1) it's onset is not random
2) it doesn't disable ntkrnl to wake up the scheduler when user inputs even after I tried some tricks.

So I would like to hear what you should say about this.
Clandestiny
06-15-2004, 05:16 PM
I'm not sure what you mean by "random onset", but you can probably achieve the lack of user input response by writing a KMD filter driver which intercepts the keyboard and mouse IRPs. A filter driver will definately be generic and this would also be the perfect implementation for your requirement of getting a passphrase from the user. The keyboard filter could check each intercepted keyboard IRP against some passphrase very easily. The only drawback would be the necessity of doing a scan code to ascii conversion before checking it.

Cheers,
Clandestiny
homersux
06-15-2004, 05:27 PM
hxxp://www.rootkit.com/board.php?thread=1172&did=edge0&disp=1172
Kayaker
06-15-2004, 06:05 PM
Hi

There may be a very nice way of doing that, along the lines of a screensaver as you mentioned, or putting the monitor into a fake suspend state and disabling mouse/keyboard input except for your passphrase, but here's an idea maybe worth looking into. This code was for Win9x, I'm not sure if it would work on Win2K but you would need to program a driver to use the IN/OUT commands.

Once upon a time there was a protection which did something similar if it caught you tracing over it or something. I believe it may have been DP-tEunlock or dp-borg2, maybe someone can confirm, but I remember seeing the effect. Anyway, someone had posted a similar type code snippet on the Win32asm forum and I was interested in what it was doing so I did a bit of digging. Here's my analysis of it, which may or may not be entirely accurate.

Original question:
==============================
I have this code which is supposed to disable screen, and it worx fine on my Win98:

mov dx, 03c4h
mov al, 01h
out dx, al
inc dx
in al, dx
or al, 20h
out dx, al

The problem is that I would like to turn it back on, but I don't know how?
Also, could someone pls explain what this code does exactly?
==============================

Possible explanation:

==============================
I did a little bit of searching and came up with this. Port 3C4h Index 1 is the VGA Sequencer Clocking Mode. If bit 5 is set this turns off the screen and gives all memory cycles to the CPU interface.

--------------------------------------------

3C4h is the VGA Sequencer Index Register (SEQX).
This register is loaded with a binary value that indexes the sequencer register for read/write data. This value is referred to as the "Index Number" of the SR register.

Bits 4-0 : SEQ ADDRESS - Sequencer Register Index
A binary value indexing the register where data is to be accessed.
Bits 7-5 : Reserved

Index 0: reset register
INDEX 1: CLOCKING MODE REGISTER
Index 2: map mask register
Index 3: character map select register
Index 4: memory mode register

---------------------------------------------

3C5h is the VGA Sequencer Data Register (SEQ_DATA).
This register is the data port for the sequencer register indexed by the
Sequencer Index register (3C4h).

Bits 7-0 : SEQ DATA - Sequencer Register Data
Data to the sequencer register indexed by the sequencer address index.

3C5h Index 1: CLOCKING MODE REGISTER
.......1 8/9 dot clocks (9 bits for mda-compatibility)
.....1.. 16/8 bits shift mode (see also 3cf.5)
....1... 40/80 column mode
...1.... 32/8 bits shift mode (see also 3cf.5)
..1..... DISABLE THE DISPLAY, to give the cpu more access to video memory

---------------------------------------------

So I roughly interpret the code as:

mov dx, 03c4h ; VGA Sequencer Index Register 3C4h (SEQX)
mov al, 01h ; Index 1 (clocking mode register)
out dx, al ; write index to 3C4h register
inc dx ; point to Data Register 3C5h (SEQ_DATA)
in al, dx ; read indexed Data Register into accumulator
or al, 20h ; set bit 5 (20h = 100000)
out dx, al ; output to Data Register

I would assume to reverse it you would just need to unset bit 5 again with xor 20h.

==============================
EOF

I'm not sure how you're thinking of adding a "random" onset of the screen blanking. Perhaps using an APC callback (slight random factor there since the OS decides when to call your APC), then a small random sleep/timer function within the callback itself before calling the screen blanking code. Couple of ideas anyway (to go along with Clandestiny's covert filter driver of course :p)

Cheers,
Kayaker
nikolatesla20
06-15-2004, 06:25 PM
U guys are all just pure evil :P

-nt20
Clandestiny
06-15-2004, 08:57 PM
hxxp://www.rootkit.com/board.php?thread=1172&did=edge0&disp=1172

Heh, heh, yeah... I have some experience with the filter driver approach as you can see :devil:

Hi Kayaker :) Nice idea for the screen part.

Clandestiny
bilbo
06-16-2004, 02:51 AM
Nice snippet, Kayaker!
Just three notes:

(1) not all the non-VGA graphic boards will support the bit you refer at. I tried it on an Intel 82845G, and it did not worked. Worked well on Matrox MGA G100.

(2) As far as I've tried, if you read the Clocking Mode Register you will always obtain a 0 value. So, just two out's are necessary: the first, with value 0x20,
to blank the screen; the second, with value 0, to unblank it!

(3) on XP platforms a driver is no more required to do port I/O! Try the following code...

/*
* Written by Bilbo - 16jun04 - for XP platform
* NOTE: it does not work on ALL video boards! (e.g. Intel 82845G)
*/

#include <windows.h>
#include <stdio.h>
#pragma comment(lib, "advapi32")

typedef DWORD (NTAPI *PZwSystemDebugControl)(DWORD ControlCode,
PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer,
ULONG OutputBufferLength, PULONG ReturnLength);
PZwSystemDebugControl ZwSystemDebugControl;

typedef struct {
DWORD low_io_addr;
DWORD high_io_addr;
PVOID user_addr;
DWORD len;
DWORD reserved0; // must be 1
DWORD reserved1; // must be 0
DWORD reserved2; // must be 1
DWORD unused; // never accessed by the kernel
} IO_STRUCT_OP;

#define FCHK(a) if (!(a)) { printf(#a " failed\n"); exit(0); }

void
get_api_address(void)
{
HMODULE hModule;

FCHK(hModule = GetModuleHandle("ntdll.dll"));

FCHK((ZwSystemDebugControl = (PZwSystemDebugControl)
GetProcAddress(hModule, "ZwSystemDebugControl")));
}

void
debug_privileges(BOOL on)
{
HANDLE hToken;
TOKEN_PRIVILEGES tok;

FCHK(OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken));

tok.PrivilegeCount = 1;
tok.Privileges[0].Attributes = on ? SE_PRIVILEGE_ENABLED : 0;

FCHK(LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tok.Privileges[0].Luid));
FCHK(AdjustTokenPrivileges(hToken, FALSE, &tok, sizeof(tok), NULL, NULL));
}

void
out(WORD port, BYTE val)
{
IO_STRUCT_OP io = { port, 0, &val, 1/*len*/, 1, 0, 1, 0 };

FCHK(ZwSystemDebugControl(15, &io, sizeof(io), 0, 0, 0) == 0);
}

BYTE
in(WORD port)
{
BYTE val;
IO_STRUCT_OP io = { port, 0, &val, 1/*len*/, 1, 0, 1, 0 };

FCHK(ZwSystemDebugControl(14, &io, sizeof(io), 0, 0, 0) == 0);
return val;
}

void
main(void)
{
get_api_address();
debug_privileges(TRUE);

out(0x3C4, 1); // force next I/O from Clocking Mode Register
printf("%x\n", (BYTE)in(0x3C5)); // 0

out(0x3C5, 0x20);
Sleep(3000);
out(0x3C5, 0x00);

debug_privileges(FALSE);
}

Cheers, Bilbo

Forgot to say: you need to be Administrator to grant debug privileges...
Kayaker
06-16-2004, 11:38 AM
Wow. That's interesting Bilbo, nice code. I'm glad Windows is getting so much more secure from 9x->2K->XP, heheh :rolleyes:

==============================
Multiple Windows XP Kernel Vulnerability Allow User Mode Programs To Gain Kernel Privileges

Summary:
There exist several vulnerabilities in one of Windows XP kernel's native API functions which allow any user with the SeDebugPrivilege privilege to execute arbitrary code in kernel mode, and read from and write to any memory address, including kernel memory.

Details:
ZwSystemDebugControl(), exported from ntdll.dll, calls a Windows operating system function

NtSystemDebugControl(). This function is executed in ring 0 (kernel mode) and is meant to be used by user mode debuggers having the SeDebugPrivilege privilege.

Impact:
Any user with the SeDebugPrivilege privilege could execute arbitrary code as the kernel, and read from and write to any address the kernel can. The program can do anything to the computer the kernel can, e.g. reprogram any computer hardware, such as the BIOS flash memory or patch the kernel in memory.

Since the user needs the SeDebugPrivilege, a privilege normally only given to administrators, to exploit these vulnerabilities, these are not serious vulnerabilities. The user is also normally an admin so he or she could easily install a device driver to become part of the kernel instead of exploiting these vulnerabilities.

Microsoft says it's OK for user mode programs to write to the kernel so long as you have the SeDebugPrivilege privilege, and will not fix anything.
===========================
Silver
06-16-2004, 11:46 AM
I'll throw this one in there. How about writing a hook for the gdi? I looked into something similar a long time ago (I wanted to code an app that could pull text from any part of the screen), and got deeply involved in gdi mirror drivers. That will allow you to make sure nothing is displayed on-screen, and it's all win32 user-mode legit AFAIR. This book is more than helpful & includes example code:

Windows Graphics Programming Win32 GDI and DirectDraw®
Feng Yuan
Publisher: Prentice Hall PTR
First Edition December 01, 2000
ISBN: 0-13-086985-6, 1234

It's around in .chm format.
homersux
06-16-2004, 02:07 PM
Looks like I opened a can of worms...
//Cheers
dELTA
06-16-2004, 06:31 PM
In my view, the clearly most simple way of doing this, involving only ring 3 code, would seem to be just a program that puts a black window over the entire screen, and then hooks the mouse and all function keys that would normally be used to manipulate windows (like alt-tab, the windows key combinations, and such), using simple usermode hooks. The only thing that might then be a problem is the ctrl-alt-delete sequence, but it can be quite easily circumvented too, with e.g. a simple GINA dll...
TQN
06-16-2004, 10:14 PM
I think this article on CodeProject can help you:
hxxp://www.codeproject.com/w2k/AntonioWinLock.asp
Regards
homersux
06-17-2004, 08:17 AM
I am having trouble getting my hands on w2k ddk, it seems they no longer offer free downloads at M$. :(
bilbo
06-17-2004, 11:34 AM
Just another chance:

write your kernel drivers in Assembly Language, using KdmKit
(www.freewebs.com/four-f/) and MASM32 (www.masm32.com)

both are updated frequently, they are free, they come with very good samples and documentation... what else?

Good luck! Bilbo.
Silver
06-17-2004, 01:23 PM
dELTA, if you're replacing the gina then there's not much point sticking to usermode only... As minor changes go, that one isn't :D

How about this, code a DirectX app that uses fullscreen mode, then use DirectInput in exclusive mode to trap the keyboard and mouse. DInput has functions built in to disable windows hotkeys. Not sure about Ctl-Alt-Del, but I do know if you create a fullscreen app with a wierd displaymode then hit Ctl-Alt-Del, the security box doesn't appear properly...
evilbit
06-18-2004, 07:43 AM
Install a global hook on the system (using SetWindowsHookEx), and do not pass mouse/keyboard messages.
ZaiRoN
06-18-2004, 08:17 AM
evilbit, this is exactly what Delta suggested :p
homersux
06-18-2004, 09:59 AM
The KDM approach worked. But the screen isn't restored after out 3c5h, 0 :(

I haven't tried the SetWindowsHookEx approach, but I doubt it will disable keyboard (of course there are tricks to disable the hot keys...), imo the kdm approach is better.
homersux
06-18-2004, 10:17 AM
Ok, I found out the reason:

blank_screen
invoke Sleep, 3000
restore_screen

The problem is with "invoke Sleep, 3000", it calls the scheduler and there is some task switch. Upon waking up, my task IO map is not restored properly by windows (I updated my task IO map so I can do port IO directly through my device driver) and then restore_screen doesn't work. So if I don't call sleep and immediately restore screen, it works. Task switch is the evil.

Ok, now a new problem, if the user press power down or blindly use ctl+esc, up, enter, select "restart", and go ahead, there is a split second of window screen showing up (I imagine during g_exit_window, the WEP calls the video driver to restore screen anyhow). This is kinda bad because the user now knows there is something that's messing with software and the hardware is actually ok. I don't want the user to see anything after the monitor goes blank.
ZaiRoN
06-18-2004, 05:13 PM
Hi homersux,
haven't tried the SetWindowsHookEx approach, but I doubt it will disable keyboard... imo the kdm approach is better.I agree with you about the kdm approach but I think that it's also possible using SetWindowsHookEx approach.
You can easily avoid special combos, like ctrl-esc. The main problem is ctrl-alt-del combination but you can follow Delta's suggestion... maybe it's also possible to avoid this kind of combination with a runtime patch that doesn't run the task manager (re-enabling the feature when the program is closed, of course).

regards,
ZaiRoN
evilbit
06-19-2004, 08:38 AM
evilbit, this is exactly what Delta suggested
well.. didn't read the whole thread, stupid me :D

anyway,
a WH_DEBUG hook should solve this problem.

From the MSDN:

The DebugProc hook procedure is an application-defined or library-defined callback function used with the SetWindowsHookEx function. The system calls this function before calling the hook procedures associated with any type of hook. The system passes information about the hook to be called to the DebugProc hook procedure, which examines the information and determines whether to allow the hook to be called.
0rp
06-21-2004, 04:11 PM
you could also try to create a Direct3DDEvice or DirectDrawSurface with exclusive and fullscreen flags set.

with a directinput device, you could also block keyb and mouse inputs
Silver
06-22-2004, 06:25 AM
Didn't I already say that? :D

Oh also, homer, if you code a gdi mirror driver you can prevent anything from being drawn IIRC, so it may be worth looking into that.
SynApsus
06-27-2004, 04:28 PM
Exactly Silver, you can use the SetCooperativeLevel () function of the DirectX SDK with the flag (DDSCL_EXCLUSIVE or DDSCL_FULLSCREEN), which will draw your window in the entire screen and disables all the hotkeys you don't define, even CTRL+ALT+DEL.


VXD Files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VXD Files
PDA

View Full Version : VXD Files

markh51
06-16-2004, 08:16 AM
I have a app which makes calls to a VXD file, so I opened the VXD file in a disassembler to find there were no strings/imports or anything.

How do I go about to use softice to watch the VXD file, or is there some other tool which extracts things from the VXD file.

Any help with regards to these files would be appreciated, as I have never came across these files before.

Cheers.
Fake51
06-16-2004, 09:21 AM
Search, I guess. No wait, let me just make that clear: search for docs on vxd structure. Iczelion has info on vxd's, go there too. And disassemble the vxd's in IDA. It should show you the calls the vxd makes. And did I mention you should SEARCH on google?

Fake
markh51
06-16-2004, 10:32 AM
I have already searched on google using various search terms, but did not find anything interesting within the first 10 pages.

Thats why I asked !!!
Kayaker
06-16-2004, 10:51 AM
Hi

Nothing interesting or nothing understandable? Fake gave you the best suggestions, read Iczelion's VxD tutorials for a basic understanding of how vxd's are constructed, and use IDA to disassemble them. You shouldn't really need much more than that except for time to read and absorb all the info.

Kayaker
dELTA
06-16-2004, 06:21 PM
Also, blindly screening the first 10 google hits for an exact solution to one's problem and then giving up if it ain't there isn't exactly a winning strategy either... :rolleyes:
markh51
06-17-2004, 01:15 AM
No, I meant 10 pages as in "10 pages" not the first 10 results, I seach through about 200 results.
Fake51
06-17-2004, 07:24 AM
Here's some old files on vxd's I had lying around. One of em is by Griyo and has to do with virii. I removed the source and virii info from it, the rest is usable. Apart from this, go with Icz tuts.

Fake
markh51
06-17-2004, 07:31 AM
Thanks for that :yay:


Dont quite understand what this inst is doing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dont quite understand what this inst is doing
PDA

View Full Version : Dont quite understand what this inst is doing

Flack
06-16-2004, 10:40 PM
Hello,

Here is the part of code I need help with:

0050B311 /$ 8B4424 08 MOV EAX,DWORD PTR SS:[ESP+8]
0050B315 |. 56 PUSH ESI
0050B316 |. 85C0 TEST EAX,EAX
0050B318 |. 8BF1 MOV ESI,ECX
0050B31A 75 08 JNZ SHORT nbpro.0050B324

Now, when I get to line 50B311, an ASCII string from the stack is placed in EAX. My question is what exactly does TEST EAX,EAX do? Wont that always result in clearing the zero flag? Isnt that what happens when you TEST something with itself?

As you can probably tell from my question, I am quite new at this :p

Thanx for the help,
-Flack
evlncrn8
06-16-2004, 11:04 PM
TEST - Test For Bit Pattern

Usage: TEST dest,src
Modifies flags: CF OF PF SF ZF (AF undefined)

Performs a logical AND of the two operands updating the flags
register without saving the result.

download a copy of helppc (google search) ;)
bilbo
06-17-2004, 01:30 AM
In your particular case, testing something (EAX) with itself means that, as soon as just one bit of EAX is set, the Zero Flag will be cleared.
E.g. testing the binary 0100 against 0100 will reset the Zero flag, but also testing 01100 or 01000 with itself.
The only way to have the zero flag set is to test a null value.
In other words, TEST EAX,EAX followed by JNZ xxx is equivalent to
IF (EAX not null) THEN jump xxx

Regards, Bilbo


Armadillo scripts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo scripts
PDA

View Full Version : Armadillo scripts

hipu
06-17-2004, 10:59 AM
here are 2 scripts i made for myself since i was abused with this armadillo - i hope others might find them usefull too. HOWEVER - i made the 2nd script (unpack) specificly for my own needs and armadillo version. you might want to change it to suit your own.

enjoy ;)

script 1 : arma_detach_parent.osc

/*
Armadillo script - detach parent from client - by hipu
tnx to Ricardo for his complete instructions (im just emulating what the man says...)

MAKE SURE ALL BREAKPOINTS ARE DELETED BEFORE EXECUTING THE SCRIPT!!!

ALSO: since im using the IsDebuggerPresent plugin, i didnt do IsDebuggerPresent patch.
do whatever is needed if u dont use the plugin...

*/

var WaitForDebugEvent
var WriteProcessMemory
var pDebugEvent
var pBuffer
var child_ProcID

//eob found_WaitForDebugEvent
gpa "WaitForDebugEvent", "kernel32.dll"
mov WaitForDebugEvent, $RESULT
gpa "WriteProcessMemory", "kernel32.dll"
mov WriteProcessMemory, $RESULT

bp WriteProcessMemory
run

//stopped here cause of breakpoint
run

//stopped here cause of breakpoint (2nd time)
bc WriteProcessMemory
mov pBuffer, esp
add pBuffer, 0c
mov pBuffer, [pBuffer]
log "*** original OEP bytes :"
log [pBuffer]
mov [pBuffer], #EBFE#
log "*** changed OEP bytes :"
log [pBuffer]

bp WaitForDebugEvent
run
run
run
bc WaitForDebugEvent

mov pDebugEvent, esp
add pDebugEvent, 04
mov pDebugEvent, [pDebugEvent]
log pDebugEvent
mov child_ProcID, pDebugEvent
add child_ProcID, 4
mov child_ProcID, [child_ProcID]
log child_ProcID

rtr //ctrl-f9
sto //f8
mov eax, child_ProcID
asm eip, "push eax"
sto //f8
asm eip, "call DebugActiveProcessStop"
sto //f8
asm eip, "nop"
sto //f8
ret

script 2 : arma_unpack_client.osc

/*
Armadillo script - detach parent from client and unpack (1000 bytes method) - by hipu
tnx to Ricardo for his complete instructions (im just emulating what the man says...)

MAKE SURE ALL BREAKPOINTS ARE DELETED BEFORE EXECUTING THE SCRIPT!!!

ALSO: since im using the IsDebuggerPresent plugin, i didnt do IsDebuggerPresent patch.
do whatever is needed if u dont use the plugin...

*/

var WaitForDebugEvent
var WriteProcessMemory
var pDebugEvent
var pBuffer
var child_ProcID
var oep_offset1
var oep_offset2
var oep_offset3
var crypto_proc
var child_OEP
var patched_line1
var imgbase
var rdata_begin

gmi eip,MODULEBASE
mov imgbase, $RESULT
mov rdata_begin, imgbase
find rdata_begin, #2E726461746100# //find ".rdata" string
mov rdata_begin, $RESULT
add rdata_begin, 0c
mov rdata_begin, [rdata_begin]
add rdata_begin, imgbase
log rdata_begin

/*
another way to get the .rdata_begin - taken from VolX
gmi eip,MODULEBASE
mov imgbase, $RESULT
mov rdata_begin, imgbase
add rdata_begin, 3c
mov rdata_begin, [rdata_begin]
add rdata_begin, imgbase
add rdata_begin, 0f8
add rdata_begin, 28
add rdata_begin, 0c
mov rdata_begin, [rdata_begin]
add rdata_begin, imgbase
log rdata_begin
*/

//eob found_WaitForDebugEvent
gpa "WaitForDebugEvent", "kernel32.dll"
mov WaitForDebugEvent, $RESULT
gpa "WriteProcessMemory", "kernel32.dll"
mov WriteProcessMemory, $RESULT

bp WaitForDebugEvent
run
bc WaitForDebugEvent

mov pDebugEvent, esp
add pDebugEvent, 04
mov pDebugEvent, [pDebugEvent]
log pDebugEvent

mov oep_offset1, pDebugEvent
add oep_offset1, 18
mov oep_offset2, pDebugEvent
add oep_offset2, 24
mov oep_offset3, pDebugEvent
add oep_offset3, 28

bp WriteProcessMemory
run
bc WriteProcessMemory

mov child_ProcID, pDebugEvent
add child_ProcID, 4
mov child_ProcID, [child_ProcID]
mov child_OEP, [oep_offset1]

// ******* UGLY WAY TO FIND ENCRYPTOR. USE AT YOUR OWN RISK!
mov crypto_proc, esp
add crypto_proc, 128
mov crypto_proc, [crypto_proc]
//1st crypto_proc cal...
//sub crypto_proc, 5
add crypto_proc, 2d0
mov [crypto_proc], #9090909090#
rtr //ctrl-f9
sto //f8

log "crypto_proc was nopped..."
log "patch OEP of child process to EBFE (using PUPE...)"
log child_ProcID
log child_OEP
log "press script/resume when ready"
msg "look in the log, and press script/resume when ready"

pause

bp WaitForDebugEvent
run
bc WaitForDebugEvent

mov patched_line1, [esp]
sub patched_line1, 12
fill patched_line1, 1a, 90
asm [esp], "CALL 401000"
asm 401000, "ADD DWORD PTR DS:[0], 1000"
asm 40100A, "ADD DWORD PTR DS:[0], 1000"
asm 401014, "ADD DWORD PTR DS:[0], 1000"
asm 40101E, "CMP DWORD PTR DS:[0], 0"
asm 401028, "JNZ 401035"
asm 40102A, "PUSH 0FFFFFFFF"
asm 40102F, "CALL DebugActiveProcessStop"
asm 401034, "NOP"
asm 401035, "RET"

mov [401002], oep_offset1
mov [40100C], oep_offset2
mov [401016], oep_offset3
mov [401020], oep_offset3
mov [401024], rdata_begin
mov [40102B], child_ProcID

mov [oep_offset1], 400000
mov [oep_offset2], 400000
mov [oep_offset3], 400000

//go [esp]
mov eip, [esp]

bp 401034
run
bc 401034

msg "Close OllyDbg, execute again and attach to your newely created process. Have fun."

ret
mambox
06-21-2004, 01:13 PM
thanks to share it!
SHaG
06-22-2004, 02:54 AM
Hipu: do you mind if I add your scripts to the OllyScript site?
BTW, you can easily hide the debugger by using the DBH command in your script :)
friedo
06-22-2004, 06:02 AM
May be there´s an error in the script:

The OEP offset is get after "bp WaitForDebugEvent", but at stackoffset 18,24,28 the first time OEP is shown is after "bp WriteProcessMemory".

So this breakpoint has to be moved before reading OEP from stack:

log pDebugEvent

// HERE BREAKPOINT INSTEAD AFTER OEP
bp WriteProcessMemory
run
bc WriteProcessMemory

mov oep_offset1, pDebugEvent
add oep_offset1, 18
mov oep_offset2, pDebugEvent
add oep_offset2, 24
mov oep_offset3, pDebugEvent
add oep_offset3, 28

mov child_ProcID, pDebugEvent
add child_ProcID, 4
mov child_ProcID, [child_ProcID]
mov child_OEP, [oep_offset1]

(Second script, may be it´s in the first one too.)

Other thing:
My app isn´t starting if any breakpoint is set so i have first to start without checking all exceptions (debugging options) until first exception. After that i can check all the exceptions (so they will be ignored) and can set breakpoints...

How can i realize that in a form of a script????

regards,
friedo
hipu
06-24-2004, 04:46 PM
SHaG: feel free to use the scripts as you like, just add a comment that these scripts should be used mostly as an example :) and btw, it could be a great addon the ollyscript to read/change other process address, which will eliminate use of PUPE... my 2 cents ;)

friedo: the scripts works fine for me - as said, its an example - change it to suit your own needs ;)
friedo
06-24-2004, 04:58 PM
the scripts works fine for me - as said, its an example - change it to suit your own needs ;)
Hmm.. thought the changes i mentioned where essentially but no madder.
A more script-question for me is how to check/uncheck the debuggingoptions of olly through a script?! But may be it´s better i ask for in the ollyscript board...
Anyway: Fine job! ;o)
cell_phreaks
06-25-2004, 01:18 AM
i have an application which is protected with hardware protection by armadillo i mean it ask for a name & key n show different hardware finger prints on different machines SO is there any ready made SCRIPT for that also with which it show same finger prints on every machine if we have valid name & key (To change dword value of HFP in memory)


Armadillo 3.00a - 3.61, Ollydbg endless loop?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo 3.00a - 3.61, Ollydbg endless loop?
PDA

View Full Version : Armadillo 3.00a - 3.61, Ollydbg endless loop?

friedo
06-17-2004, 01:23 PM
Hello.

Have an application protected by armadillo with olly detection.
With hidden IsDebuggerPresent and renamed olly.exe it runs in debug environment but strange thing is that if i set a breakpoint somewhere (for example bpa writeprocessmemory or bpa waitfordebugevent) the client runs in an endless loop?!

Did anybody have this phaenomen ever had before?!
(Because i think it´s not an ollydbg problem but some sort of debug protection in this armadillo. But i did not find anything about...)

Kindest Regards,
friedo
MrAnonymous
06-17-2004, 04:29 PM
When your starting your Arma target dont set ANY breakpoints at first, in Olly just hit F9 to start you'll get a prefix lock exception. Now its safe to set any break points you want and you wont be thrown into an endless loop.


unpacking a dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpacking a dll
PDA

View Full Version : unpacking a dll

zyzygy
06-17-2004, 01:26 PM
Hi guys,

Could somebody tell me how to unpack a dll form any packer,general theory ?thanks :)
JMI
06-17-2004, 01:39 PM
The FIRST thing to do is read the BIG RED LETTERS at the top of the Forums and then read the FAQ. That will tell you to search for answers BEFORE you post a question.

Go to the search button at the top of the Forums and enter "unpack dll" (without the quotes) and read the many threads you will find with that search.

Regards,
MaRKuS-DJM
06-18-2004, 08:03 AM
it works the same way as a executable... you can use a PE Editor to change characteristics that windows don't think it is a dll and then execute it or use ollydebug. i think it's better to change characteristics. then unpack as usual
cRk
06-18-2004, 10:11 AM
you can use a PE Editor to change characteristics that windows don't think it is a dll and then execute it

exaclty which characteristics to change?? and what values to change for ?

:yay:
MaRKuS-DJM
06-19-2004, 07:53 AM
for DLLs, you have to subtract 2000 from characteristics to make windows think it is an executable.

example:
characteristic of DLL: 210E
- 2000 = 010E

windows will think it is an executable. of course it is only for unpacking. the dll itself won't run. after unpacking, change characteristics back or dll won't work

@Crk
characteristics in PE Header
zyzygy
06-19-2004, 08:01 AM
thanks for the info will try it out

could you tell me how to do it exactly ?thanks a million
%UNDEFINED%
06-19-2004, 12:17 PM
for DLLs, you have to subtract 2000 from characteristics to make windows think it is an executable.

example:
characteristic of DLL: 210E
- 2000 = 010E

windows will think it is an executable. of course it is only for unpacking. the dll itself won't run. after unpacking, change characteristics back or dll won't work

That's an excellent idea, never thought of that approach
dELTA
06-19-2004, 04:18 PM
could you tell me how to do it exactly ?
No.
JMI
06-19-2004, 08:23 PM
Or to elaberate on dELTA's, somewhat cryptic response, that's why the Diety inventy the internet. So that you could search the net and find information about things you don't know how to do. Why heck, you could even try SEARCHING for an answer HERE. There is a search button here, don't ya know???

Using the words: "PE Editor change characteristics" (without the quotes) you should find some interesting reading about PE headers and at least a couple of kinds of "characteristics" one might change.

These is also alot of information on the net about the PE file format you probably should become familiar with if you intend to actually learn how to unpack.

Regards,
zyzygy
06-20-2004, 01:45 AM
Ok thank you for the replies ,i will surely do that .
MEPHiST0
06-20-2004, 05:26 PM
nice tips on the .dll > exe MarKUS :)

can load dll in olly now :D
neviens
06-21-2004, 05:25 AM
Somtimes it is necessary to load the dll for unpacking without any changes,
because of CRC selfchecking. For this approach I usualy do a small program
with LoadLibrary() function inside, then a famous Spl/\js 'BPX ORD_0056+94'
breakpoint under win98 will do a job (or "Break on new module" under Olly?).
Neviens.


IDA MakeStruct
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA MakeStruct
PDA

View Full Version : IDA MakeStruct

nino
06-17-2004, 06:28 PM
Please someone help. MakeStruct does not work with structures whose last field is a string (zero-length in structure definition). If the string field is already defined MakeStruct fails, if it is undefined it's not included in the structure field. However the Declare Structure field tool button creates the structure ok!
Kayaker
06-17-2004, 11:45 PM
Hi

Is the problem that you haven't *explicitly* defined a STRING or UNICODE_STRING structure before defining the struc that uses it? This may make the struc definition fail on the *last* field.

I had a similar problem inserting a struc where the last field was a pointer to a UNICODE_STRING. By default IDA declared this standard type structure wrong. It should recognize it from the pdb, but instead defined the last field as zero length:

0000 RTL_DRIVE_LETTER_CURDIR struc ; (sizeof=0x8, standard type, variable size)
...
0008 DosPath db 0 dup(?)
0008 RTL_DRIVE_LETTER_CURDIR ends

This was very curious because I had already defined several other strucs with UNICODE_STRING fields, but they were never the LAST field. In fact, when I tried to dump the idc file, IDA gave an access violation error message, produced only a partial idc file (up to the bad struct), and basically hung until I terminated it.

When I then *explicitly* declared a UNICODE_STRING struc first (even though IDA recognizes the struc internally by default), the other structure was properly defined and a proper idc file was produced:

0000 RTL_DRIVE_LETTER_CURDIR struc ; (sizeof=0x10, standard type)
...
0008 DosPath UNICODE_STRING ?
0010 RTL_DRIVE_LETTER_CURDIR ends

If you're getting a similar problem when the last field of a structure is a string, there may be a bit of a bug here requiring this workaround.

Kayaker
nino
06-18-2004, 03:11 PM
The last field of the structure definition is even simpler. Not a STRING or UNICODE_STRING structure but a simple C string. Zero length so that individual instances supply their own string field. Something like this:
_tpida struc
tpDtt dd ?
tpMask dw ?
tpName dw ?
BaseType dd ? ; offset (FFFFFFFF)
Elements dd ? ; base 10
Name db 0 dup(?) ; string(C)
_tpida ends

so no prior string structure needs to be defined. Later on individual instance you try to apply this definition and if you do it programmatically MakeStruct don't include the string field. Like this
CODE:0048A9B3 stru_48A9B3 dd 4 ; tpDtt ; 004CAD84o
CODE:0048A9B3 dw 90h ; tpMask
CODE:0048A9B3 dw 0Ch ; tpName
CODE:0048A9B3 dd offset `__tpdsc__'[TXMenu]; BaseType
CODE:0048A9BF db 54h ; T
CODE:0048A9C0 db 58h ; X
CODE:0048A9C1 db 4Dh ; M
CODE:0048A9C2 db 65h ; e
CODE:0048A9C3 db 6Eh ; n
CODE:0048A9C4 db 75h ; u
CODE:0048A9C5 db 20h ;
CODE:0048A9C6 db 2Ah ; *
CODE:0048A9C7 db 0 ;

But if you do it using the Declare Structure Variable menu/toolbutton (Alt-Q) it works:
CODE:0048A9B3 stru_48A9B3 dd 4 ; tpDtt ; 004CAD84o
CODE:0048A9B3 dw 90h ; tpMask
CODE:0048A9B3 dw 0Ch ; tpName
CODE:0048A9B3 dd offset `__tpdsc__'[TXMenu]; BaseType
CODE:0048A9B3 db 'TXMenu *',0 ; Name

You see?
dELTA
06-18-2004, 06:31 PM
Sounds like someone might want to send an email to Ilfak (or maybe someone already has)? :)


Which API's are used for connecting to website?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Which API's are used for connecting to website?
PDA

View Full Version : Which API's are used for connecting to website?

Flack
06-17-2004, 10:05 PM
Hello,

I have an app that connects to a webpage to verify the name/serial number.

Is the best way to deal with this to break when the app connects to the webpage and then work from there? If it is, can someone tell me which API to break on?

I've never worked on an app that connects to verify the info, so Im not quite sure how they work. If the cgi returns a value, such as "Registration Failed", how would I go about finding that return value and changing it to a good value?

Thanx for all of the help :D
-Flack
Solomon
06-17-2004, 11:07 PM
Please check the import table of your target.

Sometimes it uses WinInet API such as InternetOpenUrl()/HttpSendRequest().

Sometimes it directly uses low-level WinSock API to do this.

A network sniffer may help.
PhotoPaul
06-18-2004, 09:29 AM
Try to break on winsock's send() API
Flack
06-18-2004, 08:11 PM
Thanx for the tips guys.

I have another question while Im at it. If the app is connecting to a cgi app, is there a certain API that is used to get the result?

Since the name/serial is checked there, it must send back some result. How is this result returned?

Thanx again for the help :D

-Flack
dELTA
06-19-2004, 04:08 PM
Nope, a cgi app is a completely normal http request like any other, it just happens to do some extra server side computation before returning the content, but this is completely transparent to the client.
comelysouthchin
07-01-2004, 12:17 AM
:cry: Hi ,you had better read something about http protocol , when you connect to a web site , IE will send some requirement to the web host . then the web server will analyse the requirement . how to connect to web server ? just like any other socket programme , use connect ,send some requirment . read something about http protocol ,you will find the result of your question .


Need help in developing keygen for <deleted>
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help in developing keygen for <deleted>
PDA

View Full Version : Need help in developing keygen for <deleted>

sailor__eda
06-17-2004, 11:10 PM
Hi there,

I've been trying to crack <deleted> for several weeks now and it seems like I'm still not closer to cracking it or for that matter even understanding where the serial is compared (it seems like its compared in several places). Needless to say it is particularly challenging especially since the programmers have deliberately made it difficult for crackers - there is even a comment in the code to challenge ivanopolu to crack this.

If anybody has been successful in cracking this, I'd appreciate any pointers or clues.

Thanks

Sailor__eda
esther
06-17-2004, 11:16 PM
You don't get it do you?!!!! :eek:
Lack of effort and explaining <---- crack request :boo: :boo:
Kayaker
06-17-2004, 11:55 PM
This identical request was deleted 2 days ago by any one of our intrepid moderators, you haven't picked up on how we do things here yet, eh? This isn't it.
sailor__eda
06-18-2004, 01:43 AM
I'm sorry I didn't mean to offend anybody. Perhaps I didn't word my question clearly enough. I wasn't requesting a crack for the app, I wanted to know how the serial checking worked because I haven't been able to figure it out.

I was really looking for some pointers or some tips. I thought this was the correct forum for this but forgive me if I was mistaken.

Sincerely,

Sailor__eda
JMI
06-18-2004, 07:52 AM
What is clear is that you didn't read the posting guidelines listed in the FAQ link in the BIG RED LETTERS at the top of the Forum. Read that and you will know what is expected here.

Regards,


ida pro plugin question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ida pro plugin question
PDA

View Full Version : ida pro plugin question

_Servil_
06-18-2004, 06:21 AM
Guten tag,

i 'd like to know is theer a resource decompiler
plugin or direct support in new versions already.?
i know ida always lacking that...

if theres not this where a suitable place so newbie can
send a plugin (i know only protools but that seem as
standalone tools site).

thankful for hints..

svl
dELTA
06-18-2004, 06:21 PM
What do you mean "send a plugin", have you created such a plugin yourself?

There are several IDA related websites with plugin collections and such, here is one of them, search for the rest:

http://www.backtrace.de
Kayaker
06-18-2004, 08:35 PM
That backtrace.de is a great site (for those who can connect), but don't forget our dear friend [yAtEs]...

http://woodmann.com/yates/ida.html
_Servil_
06-19-2004, 12:52 AM
Thanks for your tips,
thats just the kinda sites..


SoftICE Console
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE Console
PDA

View Full Version : SoftICE Console

Euclides
06-18-2004, 03:01 PM
How can softice draw a console like this ?
JMI
06-18-2004, 03:50 PM
A console like what???

Regards,
dELTA
06-18-2004, 06:34 PM
Didn't you hear the man, like this. :D My guess would be crayons anyway. :p

(and a more serious guess about what he means is how Softice can put its text mode console over the Windows screen... let's just say that the answer to that one is a bit too long, it's even longer than.... this :D)
JMI
06-18-2004, 06:37 PM
I see dELTA has been practicing his mind reading techniques again. :yay:

Regards,
Euclides
06-19-2004, 01:58 AM
Didn't you hear the man, like this. :D My guess would be crayons anyway. :p

(and a more serious guess about what he means is how Softice can put its text mode console over the Windows screen... let's just say that the answer to that one is a bit too long, it's even longer than.... this :D)
thank you for your interest
yes
i want to mean;
softice works under ring0 but how can it communicate with display and keyboard ?
(ok keyboard is easy but display ?)
i was searched vga systems in google,i found big,beatiful nothing :( :( :(
evlncrn8
06-19-2004, 07:18 AM
thank you for your interest
yes
i want to mean;
softice works under ring0 but how can it communicate with display and keyboard ?
(ok keyboard is easy but display ?)
i was searched vga systems in google,i found big,beatiful nothing :( :( :(

siwvid = the softice video console driver, delve deeper
bilbo
06-21-2004, 11:49 AM
siwvid = the softice video console driver, delve deeper

Or have a look at the equivalent BS_VID, the BlindStudio video driver, open source from Mamaich.

By the way, "this" console is not text mode, but it uses the current graphics mode.

Enjoy yourself, Bilbo.


miracl problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > miracl problems
PDA

View Full Version : miracl problems

Ray
06-19-2004, 02:32 AM
hiya all,

i have downloaded miracl and started playing with it, but i cannot seem to make a working compilation.
i followed the notes in msvisual.txt , i even created a new .lib and this is what i get :
.......\MIRACL\include\big.h(65) : error C2874: using-declaration causes a multiple declaration of 'istream'
...program Files\Microsoft Visual Studio\VC98\INCLUDE\iosfwd(256) : see declaration of 'istream'

any help you be appreciated.
klier
06-19-2004, 02:59 AM
project settings
link
ignore libraries:
--the lib wich causes a multiple declaration of...--
(in my case LIBC.lib)
had to include USER32.lib in object/library modules.
hope this helps.
Regards,
Ray
06-19-2004, 02:09 PM
i tried, & tried, & tried, & failed. :(
i am using vc++ 6, project/settings/link/Category=input ( !? ) and then ignore libs ?
klier
06-20-2004, 05:33 AM
Try example in map 'curve'.
sea.txt
win32 console application.
add files to project:big.cpp/big.h/mueller.cpp/ps_big.cpp/ps_big.h/ms32.lib
additional include directories: path to miracl\include\
(previous post was for a win32 appl.)

Regards,
arz
06-20-2004, 04:42 PM
The following works without any problems for me on VC6. However
if your using *.cpp and not *.c then I believe setup is different.

1, Tools->Options->Directories - set the correct paths
i.e. c:\Program Files\VC6\miracl\include
c:\Program Files\VC6\miracl\lib
c:\Program Files\VC6\miracl\source

2, For each project that uses miracl,
Project->Settings->Link Object/library modules
add 'miracl.lib', or whatever your compilled miracl.lib is called.
That must be done for each configuration used (Debug/Release);

3, In *.c or *.h etc #include <miracl.h>

arz...
Ray
06-22-2004, 09:43 AM
yeap.
that helped.
got it working now.
thanks guys.


help with a cbuilder component
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > help with a cbuilder component
PDA

View Full Version : help with a cbuilder component

criss Axel
06-19-2004, 06:03 AM
Hi,

I have a problem with a component for CBuilder6. Like many other you can't run the program with the component ("test.exe") without having CBuilder opened. But like not many other i was not able to figure the protection scheme. The component is called I will read the FAQ 1.0.
The problem is that if you try openning the prog. without the IDE opened
it shows a nasty erorr: "Erorr reading memori adress at xxxxxxxxxx in module vcl60.bpl......".
I loaded test.exe with ollydbg and i foud that the procedure of finding if IDE is opened is taking place before the exe's entry point. I looked at the component's .bpl wich is loading with test.exe but i can't figure out the function responsable for the message erorr.
My question is can someone help me about this kind of protection?
I looked on the net for a solution but nothing.

Thanks.
dELTA
06-19-2004, 04:11 PM
I can tell you for sure that the IDE check is not performed before the executable's entrypoint (well, if it's not placed in some statically linked dll of course, but then you should really know which one it is if it's your own program), and no, we don't allow crack requests here.
criss Axel
06-20-2004, 04:47 AM
I don't espect to be allowed to ask crack requests. I'm asking only for a hint or something like that.
The dll is loaded first by the IDE and then statically by my program. So when i start my prog. the dll checks if it was already loaded by the IDE.
What function does that or else, how can it be done. I haven't found the function usually used by other components - FindWindow.
And because it causes an error, not displaying a message or something like that, i have no idea how to find the function responsable for the IDE check.

Thanks
dELTA
06-20-2004, 02:18 PM
Single step the DLLMain of the dll of the component, that should most likely get you to the error soon enough, making it possible to see why it happened.
criss Axel
06-21-2004, 05:25 AM
Thanks for the ideea i would go for it, but i was lucky and found what functions it uses to find out if the IDE was opened: getwindow and getwindowclass.
Stupid me :D
It was doing some other checks and if every thing was OK it sets byte 1 to some location. Then it uses the byte to figure it out if it has to mess up with @Forms@Aplication function hence the ugly error and if it shows the component on the form (a button for example).

I've found an other pack of components (only visual components - the one it was interesting me was the popupmenu with the possibility of displaying a text verticaly like win98 start menu).
I've fixed all the inconvenients of the trial version (i think) but in the instalation exe i have the possibility of installing the full version with source code.
The problem is i can't manage to find the to serials (for full version and for source code) in that Wise Installer.
I've found a forum about wise installer but it doesn't help, i've found the wise installer password but i need other passwords.
I've unpacked the installer but the files i'm interested in, are crypted (xxxxx.obj.eox or xxxxx.hpp.eox). There is no exe in the installer besides uninstaller.exe so i don't know how to decrypt those files.
The procedure of cheking the serials is damn big and complicated but i know that in the end if it gets a 3 as a result it's displaying a wrong pass message and goes all over again.
If someone knows how to break this kind of protection or knows how this wise installer works i apreciate every hint.

Thanks


Online Checker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Online Checker
PDA

View Full Version : Online Checker

squ1d
06-18-2004, 04:24 AM
Hi, im new here and ive been trying to crack a software that checks if the key is valid on the internet.
The thing is, i could bypass the authentication, but the software then becomes unusable :/
Here it is:
seg000:00401D4C call sub_401610 <- check the net for the key
seg000:00401D51 test eax, eax <- authentication
seg000:00401D53 jz short loc_401D6D
seg000:00401D55 mov edx, [esp+20h+hInstance]
...

I just have nop the test and it enters the program, no functions tho :/
what should i do?
naides
06-18-2004, 05:46 AM
seg000:00401D4C call sub_401610 <- check the net for the key

00401D4C call not only brings a good boy/bad boy answer in eax, which is tested immediately, but should also brings another element, perhaps a decryption key, that is necessary for the software to run. Check the input and output of that sub_40610 call for clues.
squ1d
06-18-2004, 11:11 AM
i cant find it :// been looking for it =(
would u mind helping me out? got msn/aim or something like it?
cRk
06-18-2004, 11:22 AM
:eek: does this belongs to this part of the board (advanced) ?
squ1d
06-18-2004, 11:27 AM
sorry for posting it in the wrong section :/
squ1d
06-18-2004, 11:39 AM
btw, what i mean by unusable, means that i click the buttons, they dont work, the close button, the start button, nothing works at all.. its like no function is assigned to the buttons.
squ1d
06-19-2004, 01:25 PM
Still cant find how to make my proggie work, please help me :// im cracking my head over here =( I could bypass the online checker, it works by checking the name of the executable with a database on the internet.
But the program becomes unusable, the window is there, but you click it and it doesnt work, none of the buttons, not even the close button. Heres what ive found out so far, please, any ideas are welcome:

seg000:00401D4C call sub_401610 <- connect to the internet
seg000:00401D51 test eax, eax <- check validity
seg000:00401D53 jz short loc_401D6D <- continue or stop
seg000:00401D55 mov edx, [esp+20h+hInstance]
seg000:00401D59 push 0 ; dwInitParam
seg000:00401D5B push offset DialogFunc ; lpDialogFunc
seg000:00401D60 push 0 ; hWndParent
seg000:00401D62 push 65h ; lpTemplateName
seg000:00401D64 push edx ; hInstance
seg000:00401D65 call ds:DialogBoxParamA ; Create a modal
seg000:00401D6B jmp short loc_401D7D <- proggie
....
seg000:00401628 mov [esp+2A4h+var_290], 1388h
seg000:00401630 mov [esp+2A4h+var_288], ebx
seg000:00401634 mov [esp+2A4h+var_28C], 1
seg000:0040163C call ds:GetModuleHandleA <- get filename
seg000:00401642 push eax ; hModule
seg000:00401643 call ds:GetModuleFileNameA <- get filename
seg000:00401649 lea edi, [esp+298h+Filename]
seg000:00401650 or ecx, 0FFFFFFFFh
seg000:00401653 xor eax, eax <- store filename??
...

after that it connects to the web server and gets back to 00401D51..
what should i be looking for?
evlncrn8
06-19-2004, 02:21 PM
seg000:00401653 xor eax, eax <- store filename??

how the hell is that 'store filename' ?

after that it connects to the web server and gets back to 00401D51..
what should i be looking for?

1. keep your questions in the thread you created initially
2. debug it some more and note down exactly what happens
dELTA
06-19-2004, 04:26 PM
3. Read Naides' initial reply.
4. seg000:00401650 or ecx, 0FFFFFFFFh <-- Disconnect all buttons from code, send all contents of harddisk to Microsoft, delete all porn from computer, set up exception handler to make an <xor eax, eax> instruction store a filename, and finally, set single step trap flag. :D
JMI
06-19-2004, 08:11 PM
Oh no!! Not the infamous "delete all porn from computer" call. Man, dELTA has been caught by that one many times. :whoops: That's why he recognizes it so easily. :yay: He just hates it when that happens. :boo:

Regards,
squ1d
06-19-2004, 08:17 PM
damn
NOT MY PORN!
ehehhe
but still, i dont get it, could you explain it to me a bit more detailed?
a friend told me that there is a proggie that connects the buttons to the functions, but i got no idea which proggie is it, and where to find it.
and id like to understand this a bit more. =/ any tuts that are sorta about that? ://
Silver
06-20-2004, 05:54 AM
What everyone is trying to say is that somewhere in the call is a piece of code that "enables" everything that doesn't work for you right now. You've killed the call 00401D4C, and now your app doesn't work. Enable it, and it does. Thus there is something in there other than a protection routine.

So trace the code, step into the call and read what's happening. Taking a wild guess, you'll most probably find another couple of calls inside the call 00401D4C. One of those will probably lead to the protection check, another will lead to code that enables (or has a hand in enabling) the dialog items.

In other words, you've patched it too high up the code "tree". But what do I know, eh. I couldn't even undo aspack ;)
squ1d
06-20-2004, 09:31 AM
the thing is that i didnt kill it
i patched under it, on test eax, eax...
i still dont know what to do :(
how do i check the input/output of a function through ida? the program doesnt allow to have softice on when running it, so cant debug it with it.
evlncrn8
06-20-2004, 10:12 AM
the program doesnt allow to have softice on when running it, so cant debug it with it.

no such thing as cant... go find the anti debug code, smack it on the head and load softice and start tracing, working from a deadlisting doesnt seem to be working from you, or try using other debuggers like trw, olly etc, perhaps it doesnt check for those


NanoFixer v1.0 [for Armadillo 3.6x - 3.7x]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > NanoFixer v1.0 [for Armadillo 3.6x - 3.7x]
PDA

View Full Version : NanoFixer v1.0 [for Armadillo 3.6x - 3.7x]

tenketsu
06-19-2004, 05:39 PM
This is a little tool in asm [MASM32] for patch the nanomites, not resolve tables!!, ONLY patch very lame, dont you think :confused:

skeleton by Zilot

EXE + SRC:
stephenteh
06-26-2004, 04:54 PM
is there a english version??

ask 1 dumb question... how to use this tool....
tenketsu
06-26-2004, 05:51 PM
Please!!, all the info is in the Leeme.txt file and the spanish is the language most easy in the wordl. Use English-Spanish Interpreter [ESI]
babar0ga
06-27-2004, 06:31 AM
spanish is the language most easy in the wordl.

is, it? :D

i don't think so... well, why than all the people all over the world use english to comunicate?

i am form croatia and think that english is one of easiest if not the most easy one. why?
well, in croatian there is so much tenses and suffixes to words... it's really hard...
i heard some neighbour languages(hungaryan, italian, slovenian, german) and all of them seams not so easy as english...
at least to me

regards :)

p.s.
it's summer, come to croatia on vacation (all of you) :devil:
CluelessNoob
06-27-2004, 01:43 PM
p.s.
it's summer, come to croatia on vacation (all of you) :devil:

Free beer and women for everyone?

:yay:


Hasp4 dmp to reg converter HaspPro.Emul
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hasp4 dmp to reg converter HaspPro.Emul
PDA

View Full Version : Hasp4 dmp to reg converter HaspPro.Emul

DongleGuru
06-20-2004, 08:17 AM
Now every one knows howz that 3c and 3d functions are emulated by the glashas dongle emulator. And everyone have the registred copy of hasp professional emulator with keygen by infern0.
Can anybody prepare the .dmp to .reg converter. Specially that
EDStruct: Data?
Regards
tex
Woodmann
06-20-2004, 06:53 PM
What ?
naides
06-20-2004, 09:06 PM
It is crystal clear for any competent brain reverser/mind reader. Delta?
JMI
06-20-2004, 10:58 PM
Is it just my imagination, or are we getting a group of these all of a sudden that do not seem to make a great deal of sense?

Regards,
DongleGuru
06-20-2004, 11:51 PM
here http://yo.mama.com you will find the software with crack.But infern0 no more supports for the .dmp to .reg
Regards
dongleguru.

PS.
Take a look at this great webpage (http://www.woodmann.net/fravia/rce-faq.htm) too, I haven't had time to look at it myself yet though.
dELTA
06-21-2004, 02:46 AM
Seems to me that he wants someone to write a hasp cracking utility for him. Hmm, cracking tool manufacturing requests, even worse than crack requests? ;)
JMI
06-21-2004, 01:09 PM
The next good question is why he has chosen the name "DongleGuru". Seems like "DonogleWantabe" would have been more descriptive.

Regards,
CrackZ
06-21-2004, 04:32 PM
Hiya,

My 2c and then some;

Before we all rush to tell him to read the FAQ or use a search engine etc, etc, what he seeks is actually a legitamate 'request', however it isn't the best english I've ever seen ;-).

Background.

Glasha's HASP 4 emulator protection was broken (about 2 months ago ifirc), this essentially made public the internal HASP 4 algorithms (encrypt/decrypt are the ones of particular interest), however to make the emulator work you require the presence of a registry key (obtained by dumping the dongle).

Works kind of like this :

h4dmp.exe -> PWD1PWD2.dmp -> DMP->Reg Converter -> Registry Key (enables encrypt / decrypt services to work correctly).

As for the answer to the question, well it isn't hard to find ;P.

Regards

CrackZ.
Woodmann
06-21-2004, 07:21 PM
CrackZ.......

You the man :D

Woodmann
JMI
06-21-2004, 08:07 PM
Yep to both. CrackZ IS the man and "well it isn't hard to find." But we know that it is not that likely that any "searching" has been going on.

Regards,
naides
06-21-2004, 09:27 PM
"The first step in finding an answer is asking the right question"

Aristotle

Actually, he never said anything like that, He did not speak English either, but none the less this aphorism is a cardinal fact in research. . . of any kind.

Naides
JMI
06-22-2004, 03:12 AM
Well he may have ask "the right question," which was "Can anybody prepare the .dmp to .reg converter" to which the answer is: "yes, someone has." This, however, does not appear to be the question he wanted to ask, was "where" he might find it.

That question, however, is one that is NOT supposed to be asked here. And, in any case, the answer would be: "Seek, and yee shall find."

Regards,
sope
06-23-2004, 12:11 AM
Greetings CrackZ,

this essentially made public the internal HASP 4 algorithms (encrypt/decrypt are the ones of particular interest)
Just wanted to clarify does it mean that 3C / 3D services good data can be recovered without original dongle ? OR we still require the original dongle at some end.

Regards, Sope.
jeetz4u
06-23-2004, 12:15 AM
Ohhhh i tried to do this job a month before but i was not able to do anything.
Here the attched file have my little research.
Here i did two job.
1. I grab dongle with original haspdrivers and that file is Original.Lock44830FE3.dmp
2. I capture the dongle with glasha programm and with glasha hasp emulator driver i again grab the dongle that file is Emu.44830FE3.dmp

One can compare both the files the only difference is between bytes 0000005c and 000000d3. That much bytes are used to create the EDStruct section in the registry. Here is the sample EDStruct with .reg file.

REGEDIT4
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Emulator\HASP\Dump\44830FE3]
"Name"="Jack"
"Copyright"="Son"
"Created"="29.05.03 14:46"
"SN"=dword:325BA014
"Type"=dword:00000005
"Memory"=dword:00000000
"SecTable"=hex:71,73,31,33,E9,EB,A9,AB
"NetMemory"=hex:FF,FF,FF,FF,FF,FF,00,00,FF,FF,FD,FF
"Option"=hex:01,01,00,4A,1F,01,1E,0C,83,01,09,12,25
"Data"=hex:FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,FF,\
41,50,53,4F,C3,C0,0D,00,11,03,04,00,11,03,04,00,\
15,FF,00,00,03,17,04,04,05,17,04,04,06,17,04,04,\
08,17,04,04,0A,17,04,04,0B,17,04,04,0D,17,04,04,\
0E,17,04,04,12,17,04,04,13,17,04,04,17,17,04,04,\
19,17,04,04,1A,17,04,04,1B,17,04,04,1C,17,04,04,\
1D,17,04,04,21,17,04,04,22,17,04,04,27,17,04,04,\
29,17,04,04,2B,17,04,04,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00
"EDStruct"=hex:00,A4,00,00,8A,00,01,34,00,D4,00,00,46,00,01,0A,\
00,04,00,00,46,00,01,4D,00,74,02,00,46,00,01,73,\
00,B2,04,00,46,00,01,74,00,A4,01,00,46,00,01,6D,\
00,94,01,00,46,00,01,6D,00,14,00,00,46,00,01,0A,\
00,64,02,00,46,00,01,72,00,92,04,00,46,00,01,2E,\
00,44,02,00,46,00,01,65,00,24,00,00,46,00,01,3A,\
00,E4,01,00,46,00,01,61,00,D4,01,00,46,00,01,6D,\
00,14,02,00,46,00,01,32,00,A2,04,00,46,00,01,44,\
00,64,03,00,46,00,01,65,00,14,04,00,46,00,01,74,\
00,94,03,00,46,00,01,6D,00,24,02,00,46,00,01,01,\
00,84,02,00,46,00,01,00,00,54,03,00,46,00,01,00,\
00,A4,03,00,46,00,01,00,00,54,01,00,46,00,01,01,\
00,34,00,00,EA,00,01,00,00,04,00,00,EA,00,01,00,\
00,A4,05,00,EA,00,01,20,00,C4,00,00,EA,00,01,72,\
00,F4,00,00,EA,00,01,6B,00,C4,01,00,EA,00,01,6C,\
00,14,02,00,82,00,01,6E,00,C8,1D,00,82,00,01,31

Hows this EDStruct is prepared that what of interest.
jeetz4u
06-23-2004, 12:27 AM
one more interesting thin in the .dmp file here that

In that region of the file from bytes 0000005c and 000000d3.

The exact Middle portion 80 98 44 81 F2 19 BF C4 is of main interest too.
Because before that and after that all the bytes are equals. May be this the main 8 bytes used to decrypt or encrypt the functions. And this 8 bytes only is the EDStruct in registry. Might be that brain people didnt put this bytes directly but for misguiding it changed the data in registry and programmed the emulator.
Regards
jeet
tgodd
06-23-2004, 06:32 AM
The hasp4 3c/3d functions were cracked and released in summer of 2003, before brain studio had their emulator for the hasp4 3c/3d.

There are other emulators available which are much easier to reverse than brain studio.

This thread seems to me, to be, alot to do about nothing.

tgodd
jeetz4u
06-23-2004, 08:13 AM
friend, do u have any stuff or any emulator? working with this fuctions.
I would like to have. If you can help me
it will great help to me.
jeetz
JMI
06-23-2004, 02:02 PM
jeetz4u:

You are NOT supposed to ask for the "Tools of the Trade" here. You should have noticed the statement in the Tools of the Trade Forum which clearly states:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

This is why search engines were invented. So that you could do your own searching for information available on the net. Even if you can NOT find what you seek, do NOT ask for it here.

Regards,
mr.x
06-29-2004, 04:06 PM
Very nice this info, any better on "EDStruct" part?
isnull
07-01-2004, 11:50 AM
EDStruct size must be 2016 bit

EDStruct in Glasha Hasp Emulator :

D7 37 81 54 7F 0E C3 C6 05 F6 8C 19 E5 63 CF 3F
17 C2 EE 36 C7 54 B6 7A 81 5F BB 06 75 0C A9 B3
8C EE 61 AE FC 44 D9 1D DE 17 F3 43 16 9B 3E C7
AA AB 8B 9B F3 A2 99 B7 F0 D3 41 A0 AF D2 28 B5
FE CC C5 5E AD 48 8D 58 92 89 52 1D 86 FF 9D 70
07 EC 07 90 C6 6B 56 37 9D 19 5C 7E B0 4C A2 3C
F0 C6 BA 0D 5B 20 D7 36 6D 3F 65 55 5E A5 1A 72
A3 78 1C C3 89 F4 BA F0 33 E2 DF 58 E8 D8 24 27
63 A5 3F C6 CC AA 22 18 03 7D 8C B3 5F EC 19 96
FE 18 89 0E 51 21 D9 E5 98 4A 83 E4 4A 8D C5 D4
4B 5C 68 B0 3B 13 8A D1 AC FA 9D AD C8 7F BC C7
8B 92 F5 FA C7 06 47 6C C4 89 43 F0 4A DE 90 27
A9 27 AA 0F 95 40 83 50 00 E0 C6 4B D8 B4 1B C6
28 9C 6D 53 74 2D BF F9 F5 86 C9 EC 60 86 8C 20
06 65 1E 7C C5 9A AD 68 AD FB 63 9C 88 AE 4A 41
E1 69 62 BC 23 DD 0F 72 D4 92 38 60 62 AB 70 F4

This structure is meshed in emulator by func in addr 10B24

This unmeshed EDStruct:

A1 8A 85 5D 46 8A 17 1D 36 0E D4 6D AE 1D 57 5F
FA 55 6A B3 E6 19 59 F1 1C BE 43 16 E9 A9 01 89
2B CE 9B 64 24 8C 58 FE 8B DE 21 61 C9 84 4E CF
9A 65 25 8D 06 BA FF AA 55 15 BD 82 D9 A8 FD 02
42 EA E3 EE 77 22 DD 9D 35 B1 48 65 30 CF 8F 27
35 9E D3 86 79 39 91 C1 CA BF EA 15 55 FD 04 1E
1F 4A B5 F5 5D E9 EF D2 87 78 38 90 D7 5A C3 96
69 29 81 63 B9 80 D5 2A 6A C2 43 4E AF FA 05 45
ED FF A8 CD 98 67 27 8F 9D 7F 4A 1F E0 A0 08 0D
69 80 D5 2A 6A C2 34 3D D0 85 7A 3A 92 EF 8D C0
95 6A 2A 82 F6 79 68 3D C2 82 2A 3E 19 7C 29 D6
96 3E B0 2C 01 54 AB EB 43 5D 88 75 20 DF 9F 37
25 5C 1D 48 B7 F7 5F A6 0A 47 12 ED AD 05 C5 DD
D0 85 7A 3A 92 10 2E 03 56 A9 E9 41 CA 9B A6 F3
0C 4C E4 48 7B 42 17 E8 A8 00 48 8C AD F8 07 47
EF FB 36 1E C6 7D FE 94 16 56 FB 55 00 00 00 00

and.... this internal structure of EDStruct:

1010000110001010100001010101110101000110100010100001011100011101

00110110000011101101010001101101101011 array1a
1000
01110101010111010111111111101001010101 array2a

const -> round - from 0 to 38 params.
0 11010 101011001111100110000110010101100111110001 00011100 ^
1 01111 100100001100010110111010011010100100000001 10001001 |
0 01010 111100111010011011011001000010010010001100 01011000 |
1 11111 101000101111011110001000010110000111001001 10000100 b
0 10011 101100111110011010011001010010010110001101 00000110 y
1 01110 101111111110101010010101010001010110111101 10000010 t
1 10110 011010100011111101000000100100001011101010 11100011 e
1 11011 100111011100100010110111011001110100110101 10110001 s
0 10010 000110010100110000110011111000111100100111 00110101
1 00111 101101001110000110011110010011100110010001 11000001 f
1 10010 101011111111101010000101010101010111111101 00000100 r
0 00111 100001111101001010101101011111010101011101 11101001 o
1 11011 111101001010000111011110000011100010010000 11010111 m
0 10110 101100001110010110011010010010100110000001 01100011
1 01110 011000000011010101001010100110101011000010 01000011 3
0 10011 101010111111111010000001010100010111101101 11111111 1
1 01010 001100110110011000011001110010011110001111 10011101
0 11111 110100101000011111111000001010000000001000 00001101 t
0 11010 011000000011010101001010100110101011000010 00110100 0
0 01111 011101000010000101011110100011101010010010 11101111
1 00011 011100000010010101011010100010101010000010 11110110 0
0 11110 010110100000111101110000101000001000101010 00111110
0 00110 010111110000101001110101101001011000111110 10110000
0 01011 000000000101010100101010111110101101000011 01011101
1 00010 000111010100100000110111111001111100110111 00100101
0 10111 000001110101001000101101111111011101011111 10100110
0 00010 100100011100010010111011011010110100000101 11000101
1 10111 011101000010000101011110100011101010010010 00010000
0 01011 100000001101010110101010011110100101000001 11001010
1 00110 111010011011110011000011000100110011100100 01001000
0 11110 110100001000010111111010001010100000000000 01001000
1 00011 001010110111111000000001110100011111101111 11111011

00110110000111101100011001111101111111 array1b
1010
01010000010110010101101111101101010101 array2b

i need help for research algorithm, which made EDStruct
from ??SecretTable?? or ??hsp passwords?? or other ??data??
maestro
07-02-2004, 02:41 PM
There's also some info on

hxxp://wasm.ru/article.php?article=protect_by_hasp03
written by Chingachguk

I'm not good at assembly but maybe some of you are
All things may help I suppose....
jeetz4u
07-02-2004, 11:39 PM
Friend,
EDStruct in the glasha emulator is created by the .dmp file the h4dmp.exe is creating. you can find the h4dmp.exe file from the glasha website.

I am sending files.
1. 44830fe3.dmp generated with the h4dumper in presense of emulated timehasp

2. Registry file to emulate the 4483 0fe3 dongle that is jackson.reg

regards
jeet.
isnull
07-03-2004, 12:19 AM
Unfortunately, this article not containt's info about creating EDS.
isnull
07-03-2004, 12:56 AM
I run h4dmp.exe after emulate HASP with jacksons.reg.
dump file 44830FE3.dmp not equal your dump file 44830FE3.dmp.

so, your EDStruct is bad.
jeetz4u
07-03-2004, 01:39 AM
ok friend,
but i generated the that file with my hasp emulator.
dont know how its diff. from your.
Tell me did u found something else ?
isnull
07-03-2004, 02:17 AM
How you make EDS Table in reg file?

P.S. if EDS Table maked by Glasha Hasp Emulator - then is bad, because it contains copy of random address of memory.
mr.x
07-05-2004, 08:44 AM
Friend,
EDStruct in the glasha emulator is created by the .dmp file the h4dmp.exe is creating. you can find the h4dmp.exe file from the glasha website.

I am sending files.
1. 44830fe3.dmp generated with the h4dumper in presense of emulated timehasp

2. Registry file to emulate the 4483 0fe3 dongle that is jackson.reg

regards
jeet.

jeet, what do you mean? your attachment is the same with Jackson, nothing changed
maestro
07-05-2004, 11:37 AM
@tgodd

Could you be more specific which emulators you mean
which wore with 3c/3d and are worth investigating?

tnx
souz
07-24-2004, 08:43 AM
Hi all!
I know the exact structure of DMP file from glasha's emulator. and i can build the necessary reg file for it if i have 3c\3d algorhytm... Can anyone give me such information? e-mail me if so...
The Glasha's dump consists of three main section:
Questions & answers for building the secret table.
Questions & answers for building the 3c algorhytm.
Questions & answers for building the 3d algorhytm.
other parameters are public and no so important.

Regards,

C0ND0R.
katran@xaker.ru


Is it illegal to solve an RSA code?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Is it illegal to solve an RSA code?
PDA

View Full Version : Is it illegal to solve an RSA code?

Aquatic
06-20-2004, 10:09 PM
Is it illegal to "make the attempt" at factoring an RSA code?
esther
06-20-2004, 10:20 PM
Is it illegal to "make the attempt" at factoring an RSA code?

Hmm its kinda "off topic" well depends on the admins ;)
crUsAdEr
06-20-2004, 10:23 PM
yeah i have seen quite a few threads started by aquatic which serve no purpose beside asking silly questions...
Woodmann
06-20-2004, 10:25 PM
Hi,

I do not see any reasons why you cannot. Just use your common sense.

Woodmann
JMI
06-20-2004, 11:01 PM
The issue would not be that you reversed it, but what you DO after having reversed it.

Regards,
neviens
06-21-2004, 05:53 AM
From newspaper advertisments:
"The taxi driver who found documents with "Top Secret" grif on his taxi back seat,
is kindly asked to shoot himself right now".
Neviens :)


LFSR-based cypher analysis
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > LFSR-based cypher analysis
PDA

View Full Version : LFSR-based cypher analysis

sapu
06-21-2004, 04:15 AM
Hi,
I'm analysing an hardware device (a dongle key) than seems to be using a linear feedback shift register (LFSR) cypher. I am quite sure it uses LFSR because i obtained similar results simulating 2 LFSR in cascade mode.

The device contains a certain number of 16bits cells who could be programmed once from the vendor in order to obtain different cypher algorythms (2 cells = 1 algorythm).

I found the algorythm is based on 2 'seed' values than depends from the 2 'cell' content (a dump obtained with some of those values follows).

My purpose is to find the exact correlation between the 2 'cell' values and the 'seed' values.

Does anyone has any suggestion about how to analyze the problem ?
Thx for any reply :)

cell#1, cell#2, seed#1, seed#2
0x0000, 0x0000, 0x5001E000, 0x40018000
0x0000, 0x0001, 0x500D6004, 0x40038000
0x0000, 0x0002, 0x505CE010, 0x40058000
0x0000, 0x0003, 0x50606014, 0x40078000
0x0000, 0x0004, 0x526BE040, 0x40098000
0x0000, 0x0005, 0x52C76044, 0x400B8000
0x0000, 0x0006, 0x53B6E050, 0x400D8000
0x0000, 0x0007, 0x532A6054, 0x400F8000
0x0000, 0x0008, 0x4195E100, 0x40118000
0x0000, 0x000F, 0x49FE6154, 0x401F8000
0x0000, 0x0010, 0xD629E400, 0x40218000
0x0000, 0x0080, 0xD140E000, 0x41018000
0x0000, 0x0600, 0x5F51E000, 0x4C018000
0x0000, 0x1000, 0x7C01E000, 0x60018000
0x0000, 0x2000, 0x1001E000, 0x00018000
0x0000, 0x3FFF, 0x43333554, 0x3FFF8000
0x0001, 0x0000, 0x2FFFE000, 0x40007FFE
0x0002, 0x0000, 0x68787999, 0x8CCCD554
0x0003, 0x0000, 0xCBE5BFA5, 0xE28A36DA
0x0004, 0x0000, 0x9014015E, 0x11451248
0x0005, 0x0000, 0xFCA66C14, 0xD37A4B96
0x0006, 0x0000, 0xE09EE788, 0xF25ECE9C
0x0007, 0x0000, 0x03EC13F3, 0xF4B4B332
0x0008, 0x0000, 0x61853184, 0xD0909110
0x000F, 0x0000, 0xDF267CF3, 0x98360C62
0x0010, 0x0000, 0x0381A538, 0x04110420
0x0100, 0x0000, 0xD05DC296, 0x48058200
0x1000, 0x0000, 0x5411CE80, 0x4401A000
0x2000, 0x0000, 0x4101AC00, 0x5001C000
0x3FFF, 0x0000, 0xC018000B, 0x80060002
0x0001, 0x0001, 0x0DDD0666, 0xEAAA7FFE
0x0001, 0x0002, 0xC1148665, 0x15547FFE
0x0001, 0x0003, 0xD0066003, 0xBFFE7FFE
0x0001, 0x0004, 0xA753866A, 0xEAA87FFE
0x0002, 0x0001, 0xD2C2CFAF, 0xAEEED554
0x0002, 0x0002, 0x21316D8D, 0xC888D554
0x0002, 0x0003, 0xABBBDBBB, 0xEAAAD554
0x0003, 0x0001, 0x779E7451, 0x400036DA
0x0003, 0x0002, 0x3F5AAC84, 0xA79E36DA
0x0003, 0x0003, 0x80116770, 0x051436DA
0x0004, 0x0004, 0x52D80B3E, 0x934D1248
0x0005, 0x0005, 0x5ECE0E98, 0x59F84B96
0x0006, 0x0006, 0x177FB7EB, 0xFD92CE9C
0x0007, 0x0007, 0xB7859609, 0xC282B332
0x0008, 0x0008, 0x71013094, 0xC0809110
0x000F, 0x000F, 0xE7F9F71E, 0x00500C62
0x0010, 0x0010, 0xE5A12338, 0x84310420
0x0080, 0x0080, 0x10416140, 0xC0008100
0x0600, 0x0600, 0xD64E3E7B, 0x8C518C00
0x1000, 0x1000, 0x7891CE80, 0x6401A000
0x2000, 0x2000, 0x0501AC00, 0x1001C000
0x3FFF, 0x3FFF, 0x00000006, 0x00000002
Sab
06-21-2004, 04:17 PM
just curious is that a sspro standard dongle your working on?
CrackZ
06-21-2004, 04:38 PM
just curious is that a sspro standard dongle your working on?

Hardlock I'd say ;-).

Regards

CrackZ.
mike
06-22-2004, 06:46 PM
If it's really an LFSR, then you can use the Berlekamp-Massey algorithm.
sapu
06-28-2004, 05:26 AM
Hi mike,
Very thanks for your suggestion.
I found a C/C++ implementation on www.qualcomm.com.au/UsefulStuff.html, i'll try this one...
If it's really an LFSR, then you can use the Berlekamp-Massey algorithm.

About the 'sample' values, yes, there are from an SSPRO dongle using the 'standard' (not 'enhanced') query mode.
The 'standard' algo is completely useless in order to emulate a 'real' dongle, but it's still useful to guess the original content of cells in range 00-07 (write & override pwds).
just curious is that a sspro standard dongle your working on?

Regards,
SaPu
Sab
06-28-2004, 02:53 PM
sspro std algo has been laying around for sometime now hidden . If you try checking out some dumpers for it (not spath type) you might find the answer inside rather then going through B Massey. -Sabbbbbrrrrr22orijdskflksdf
sapu
07-09-2004, 03:34 AM
Nope, B&M doesn't work.
In fact, the B&M algorythm could be used to retrieve the LFSR feedback from a sequence of MULTIPLE results obtained with the SAME feedback value.
In my case, i have a list of SINGLE results obtained with DIFFERENT feedback values.
Does anyone has another suggestion ???

If it's really an LFSR, then you can use the Berlekamp-Massey algorithm.
Sab
07-09-2004, 04:30 AM
sapu. see pm, send me an email or send me ur email.


Armadillo once again (wrong IAT after unpacking)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo once again (wrong IAT after unpacking)
PDA

View Full Version : Armadillo once again (wrong IAT after unpacking)

friedo
06-21-2004, 06:54 PM
Hello.

I am newbie in unpacking, read some tuts and just dumped a file (Armadillo 3.00a - 3.61 -> Silicon Realms Toolworks) now but there´s something mysterious going on here or i made a mistake.
Everything seems to be equal to Ricardos Armadillo Tut part 1 (of course with other application and correct stack-adresses etc.), but first thing was that lordpe comes up with a message that some areas filled with zeros because of no access (i am using win xp).

Anyway, the start of my dump looks unencrypted (and other areas also because many strings are readable too):

005EFC83 >55 push ebp
005EFC84 8BEC mov ebp, esp
005EFC86 6A FF push -1
005EFC88 68 E0606700 push test.006760E0
005EFC8D 68 F0665F00 push test.005F66F0
005EFC92 64:A1 00000000 mov eax, [dword fs:0]
005EFC98 50 push eax
005EFC99 64:8925 00000000 mov [dword fs:0], esp
005EFCA0 83EC 58 sub esp, 58
005EFCA3 53 push ebx
005EFCA4 56 push esi
005EFCA5 57 push edi
005EFCA6 8965 E8 mov [dword ss:ebp-18], esp

005EFCA9 FF15 48813402 call near [dword ds:2348148]
-----------------------------------------------------------
005EFCAF 33D2 xor edx, edx
005EFCB1 8AD4 mov dl, ah

1. Ollydbg can open the dumped exe but tells me that entry seems to be outside of code (but points to oep=5efc83)
2. 0x234814 should be an address of IAT but it points somewhere ollydbg can not access..

q1:
so is this an error in dumping or did somebody else ever had such a phaenomen?

q2:
can i fix this dump in a way or do i have to repeat dump procedure?

q3:
any hints how to solve this and get a right dump?

regards,
friedo
MEPHiST0
06-22-2004, 01:41 AM
try using imprec...

enter the oep.. and adjust the rva and size on iat..

see what you can catch :)

unless it's import elimination :P
friedo
06-22-2004, 08:18 AM
try using imprec...
enter the oep.. and adjust the rva and size on iat..
see what you can catch :)
unless it's import elimination :P
imprec can not find because the adresse pointing to iat is not available! ;o)
anyway, i think it´s import elimination. in the client (after separating from father) the adress points to an iat which seems to be right!

but how can i solve this?! i think i have to adapt this adress to a real one with an iat but i do not know how to do?!
further more the dumped file (dumping works fine now, lordpe dumps all memory locations now instead of first time) is 22MB big (from a packed 2MB file) and many areas are filled with zeros...
so i think there´s an additional armadillo trick somewhere else.. ;o)

Is there a tool to eliminate such zero areas?!

friedo
friedo
06-25-2004, 02:56 AM
Well. My application uses adress 02348xxx as pointer for IAT but the IAT is at Position 01729xxx. I think i can patch whole file because call [] is 0xff 0x15 0xXX 0x8X 0x34 0x02 but isn´t there a solution to bring the real IAT to the wishing Adress instead 01729xxx???

Think it should be possible to change PE Header and Section information but i don´t know how. I tried to change but instead of healing i damaged it completely..
(So i am a newbie not a PE professional..;-))

Any hints are welcome...
regards,
friedo


VTCPAK33 Target
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VTCPAK33 Target
PDA

View Full Version : VTCPAK33 Target

Innocent
06-21-2004, 09:29 PM
First, let me say that I have read every piece of elicense information on this board and I am still stuck. And yes I read the FAQ too. :p

Heres what I did:
I dumped the program after suspending it at the oeip with the a eip, jmp eip method. I then rebuilt the IAT with Import Reconstructor. I start up the fixed file and everything seems to work ok and then bam: access violation at blah blah corrupt program error. I don't think the target is using the xor method like in deep paint 1.1b so I'm pretty sure my dumps are OK. I'm figuring that my problem must be the rebuilt IAT then? Or a problem with the PE header? I am not looking for a simple crack for this I just need some hints to point me in the right direction. I've tried for the past 2 days to get this and I'm not going to give up :p

A big thanks to all of the cool posters on this board! I have learned a lot already by studying your work.
naides
06-21-2004, 09:38 PM
Even after successful unpacking and IAT reconstruction, the program may have further protection, or other tricks. You need to learn to interpret those access violation report messages and debug the unpacked program, to figure out why and where those errors are generated.

The access violation message/report is FULL of useful information
Innocent
06-22-2004, 11:18 AM
This is the code that crashes:
:00403210 85C0 test eax, eax
:00403212 7410 je 00403224

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040321F(C)
|
:00403214 8B00 mov eax, dword ptr [eax] ;First access violation here <--
:00403216 39D0 cmp eax, edx
:00403218 7408 je 00403222
:0040321A 8B40DC mov eax, dword ptr [eax-24]
:0040321D 85C0 test eax, eax
:0040321F 75F3 jne 00403214
:00403221 C3 ret

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403218(C)
|
:00403222 B001 mov al, 01

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00403212(C)
|
:00403224 C3 ret
:00403225 8D4000 lea eax, dword ptr [eax+00]

===================================================================

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0054C16E(C)
|
:0054C14E 8BD7 mov edx, edi
:0054C150 8B83D4080800 mov eax, dword ptr [ebx+000808D4]
:0054C156 8B08 mov ecx, dword ptr [eax]
:0054C158 FF5108 call [ecx+08]
:0054C15B 85C0 test eax, eax
:0054C15D 740D je 0054C16C
:0054C15F 8BD0 mov edx, eax
:0054C161 8B8364080000 mov eax, dword ptr [ebx+00000864]
:0054C167 8B08 mov ecx, dword ptr [eax] ;Second violation here <--
:0054C169 FF5110 call [ecx+10]

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0054C15D(C)
|
:0054C16C 47 inc edi
:0054C16D 4E dec esi
:0054C16E 75DE jne 0054C14E

The first violation appears to be an essential part of the code that reads data or something, the second I have no clue...
naides
06-22-2004, 03:20 PM
This is the code that crashes:
:00403210 85C0 test eax, eax ;Is EAX == 0? skip to 403224
:00403212 7410 je 00403224 ; try forcing this jump and see what happens

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040321F(C)
|
:00403214 8B00 mov eax, dword ptr [eax] ;First access violation here <-- ; loads the dword pointed by eax into eax
:00403216 39D0 cmp eax, edx ; if it is eaual to EDX
:00403218 7408 je 00403222; quit the loop 'continue'
:0040321A 8B40DC mov eax, dword ptr [eax-24] ; otherwise load a value pointed by eax-24 into eax
:0040321D 85C0 test eax, eax; if eax == now 0 quit the loop
:0040321F 75F3 jne 00403214; else loop and keep on scanning
:00403221 C3 ret

Let us concentrate on the first Access violation: eax should be holding a vaild address right before the 00403214 mov instruction, but in the unpacked program is not. check out the code above that instruction to find out where eax gets its value. Also, if possible, trace the same code in the packed, original application, to see how this code is supposed to work under the "right" circumstances.

appears to be scanning a linked list for a value equal to the one contained in edx
Innocent
06-24-2004, 05:17 PM
Firstly, thanks for the help naides! Ok, I tried editing the jump you suggested (I had changed this jump before when looking for myself but forgot) and it makes the program stop working. I edited other jumps in the loop and they make Icons on the map screwy so I think this loop can't really be edited.
I looked at the first violation loop in both the original and dumped programs and they look about the same except some eax values are different (like 130000 in dumped and 180000 in the orig) but I don't think that has anything to do with the problem. The dumped program crashes within 15 seconds of starting it.

Something very interesting: when I have runservice.exe running the program does not crash. Heres the procedure:
1. start orig. program (runservice.exe shows up in task manager)
2. close orig. program (runservice process is still running)
3. start dumped program (runs without crashing)
I can't just start the dumped prog. and then run runservice.exe (it won't stay in memory)

How can I figure out why it doesn't crash when runservice is running? The dumped version does not ask for vtcpak33.dll to run but it does ask for zsapi.dll.

zsapi has functions in it with nice names like: could not read license data, grace period expired, licctrl_ServiceEvent, and many more that I don't like the looks of. I'll try and look with Filemon to see if runservice is doing anything. Maybe the program checks to see if runservice is in memory?
Whatever the problem is runservice has something to do with it.
One step closer.....
Any suggestions would be most helpful :)
And thanks again naides for taking the time to reply!
Is it just me or has the forum been down for a couple of days?
naides
06-25-2004, 11:04 AM
Well innocent, lets start by saying that you don't look so innocent, you are guilty of cracking, as charged! :sneaky:

The linked list scanning we dealth before may or may not be related to the running of the program, I don't know. The symptom here is that some code, somewhere, needs to be run to:

initialize and load the right "seed" value in eax in the 00403214 scanning loop we discussed before. Linked lists are very sensitive the the initial values. if they are not correctly initialized to a valid chain in the heap memory they sooner or later will end up on a memory address that haphazardly result in a access violation when they point to an invalid memory address.

AND

start the service "runservice.exe" module in the correct fashion so it stays in memory and provide the critical services your app needs to run.

Likely you bypassed the execution of that critical code when you unpacked your app. Perhaps it is run before or during the unpacking. The challenge would be detect such code in the original, unpacked app and emulate it or somehow run it in the unpacked app.

Notice that I DO NOT know the answer to your problem, I just give you pointers of where to search.
Innocent
06-25-2004, 01:31 PM
Ok I have been trying to trace runservice with softice but haven't had any luck. In order for runservice to be ok I have to open the original program and click free trial. When the orig. prog is loaded it loads runservice at startup. I closed the window with the free trial button and tried the dump. Still crashes. If I open orig. prog and hit free trial then close the orig. and try the dump, it works. This tells me that something is changed in runservice from the time it is loaded and after the orig. prog is loaded. Runservice is a protective measure and is not critical to the program itself; though the dump is still checking for it somehow...

These are the api's used by runservice:
Import Module 001: KERNEL32.dll

Addr:000020DA hint(018F) Name: GetVersionExA
Addr:000020CA hint(01DF) Name: LoadLibraryA
Addr:000020B8 hint(0153) Name: GetProcAddress
Addr:000020A8 hint(012D) Name: GetLastError

Import Module 002: USER32.dll

Addr:000020F8 hint(02B3) Name: wsprintfA

Import Module 003: ADVAPI32.dll

Addr:00002110 hint(0088) Name: DeregisterEventSource
Addr:00002138 hint(01B7) Name: RegisterEventSourceA
Addr:00002128 hint(01C1) Name: ReportEventA

How would the dump access runservice?
However it does it does it continually because if I have runservice running and I close it after i'm in the dump it crashes. So it must be continually checking to see if it is there.

Oh and btw no one is innocent. :sneaky:
naides
06-25-2004, 02:54 PM
Ok I have been trying to trace runservice with softice but haven't had any luck.

Several ways you can skin this cat: Use OLLY: you can set in options, debugging options, events break on new module (DLL) and see if you can catch the original (packed) app opening the runservice module.

Or:

Disassemble the runservice, note an API that is used near the entry point, perhaps GetVersionExA and put a BPX on that API so you break when it is loaded and trace it

Or:

change the first byte of the runtrace entry point to a CC byte, in Sice put a Bpint 3 and hope it breaks. When it does, you have to restore the CC byte to its original value and the trace.

In order for runservice to be ok I have to open the original program and click free trial. When the orig. prog is loaded it loads runservice at startup. I closed the window with the free trial button and tried the dump. Still crashes. If I open orig. prog and hit free trial then close the orig. and try the dump, it works. This tells me that something is changed in runservice from the time it is loaded and after the orig. prog is loaded. Runservice is a protective measure and is not critical to the program itself; though the dump is still checking for it somehow...

Well Watson, how big is runtrace? can you disassemble it and debug it? what about understand it? does it export any function? how does the unpacked program crash when you unloaded it. That should help you isolate the code that continuosly call or check for its presence in memory. it seems to hold a key to this question

These are the api's used by runservice:
Import Module 001: KERNEL32.dll

Addr:000020DA hint(018F) Name: GetVersionExA
Addr:000020CA hint(01DF) Name: LoadLibraryA
Addr:000020B8 hint(0153) Name: GetProcAddress
Addr:000020A8 hint(012D) Name: GetLastError

Import Module 002: USER32.dll

Addr:000020F8 hint(02B3) Name: wsprintfA

Import Module 003: ADVAPI32.dll

Addr:00002110 hint(0088) Name: DeregisterEventSource
Addr:00002138 hint(01B7) Name: RegisterEventSourceA
Addr:00002128 hint(01C1) Name: ReportEventA

This API list does not tell me any thing but perhaps searching what each one do in google may clue you on what runservice does. Anyone else in here has seen this or a similar protection?

How would the dump access runservice?
However it does it does it continually because if I have runservice running and I close it after i'm in the dump it crashes. So it must be continually checking to see if it is there.

Oh and btw no one is innocent. :sneaky:

OK
Innocent
06-25-2004, 07:44 PM
1. Ok olly breaks on dll's but does not break when runservice starts (runservice is an exe so it shouldn't break on it anyway right?)

2. runservice is very small and easily disassembled (but not easy for me to understand... I have been looking at the api's in the w32 programmers reference but so far I can't really figure it out :thinking: I'm not the greatest with complex asm yet) I'll attach a txt with runservice code

3. I can get runservice to break on getprocaddress but can't seem to trace it back to the original call (kept f12ing and setting breakpoints on the calls but I can't find the original call)

4. the bpint 3 method doesn't work :)

5. the unpacked program crashes at the addresses in my earlier post: the problem is that the routine that produces the violation at 00403214 is called by about 100 different lines of code

6. Did you get my pm? I was hoping to talk to you outside of the forum
I'm trying my best to get this but I'm a newbie so go easy on me :D
cRk
06-26-2004, 08:22 AM
if the program you unpacked ran ok when you fixed the iat .. i don't think the problem remain on IAT ... it most have some other hidden crc checks .. that works using exeptions to crash the app. could be also it stopped decrypting some part of the code as soon it checked it was unpacked.. then when it tries to reach some code can't read/translated it because still is encrypted and that's the reason why crash. :smug:
Innocent
06-26-2004, 01:07 PM
1. I don't think it uses crc checks because the dumped program will run fine if runservice.exe is running
2. The dump is not still encrypted because it runs fine with runservice running.
Somehow the dump is checking for it in memory or maybe runservice is supplying the dump with good values I don't know which but whatever the problem is runservice is at the heart of it.
Thanks for your reply nonetheless :cool:
naides
06-28-2004, 09:20 AM
OK from a cursory and limited read to the contents of the runservice.exe does not appear to be doing that much, but the devil is in the details:

It loads a library (dll) called mmfs.dll and perhaps a service mmfs.sys, then it uses the function ADVAPI32.RegisterEventSourceA to publish some event to the system perhaps that the mmfs are up and runing I don't know.
Some thing tells me that the brunt of the protection is carried by those mmfs files.
Check if they get created in memory. perhaps they are the ones that check so that runservice is continuously loaded all the time and sabotage the application if you unload it.

There are other more convoluted strategies to get into a module's code, break in and trace it. Look at this post, http://66.98.132.48/forum/showthread.php?t=5853.

It works for me.

Good luck
Innocent
06-30-2004, 07:40 PM
Good thinking naides. The runservice exe does in fact load mmfs.dll and a file called mmf.sys I found something else out: the program checks for mmf.sys once about 10-15 seconds after the program is started. It will then check again at a certain intervals to see that mmf.sys is ok. If I close runservice it modifies mmf.sys so that the checks will fail. mmf.sys and runservice are part of the elicense protection software. All I have to do is eliminate the check (probably the best idea) or pass it good information (less desirable). I'll attach a little snippet of the filemon log when runservice is running for the dumped prog. It looks like the zsapi.dll that the dump loads might have something to do with it. I think there might be a crc check on the dll though because if I edit it there is an access violation on loading the program. My question is: how do I find where the dump accesses zsapi.dll for the mmf.sys check? I am not really familiar with how programs access dll files... I also have a feeling that zsapi.dll checks for more than just mmf.sys. I think that zsapi is causing all the problems and if I could just eliminate it from the dump it would work.
naides
07-01-2004, 10:11 AM
My question is: how do I find where the dump accesses zsapi.dll for the mmf.sys check? I am not really familiar with how programs access dll files...

Several ways. The most obvious, which I doubt a protectionist would use is loading the dll at start and calling its exported functions. Look into the prog import list and the dll export list and see if they communicate this way.

Libraries can also be loaded dynamically at run time using the API LoadLibrary to load the file in memory and the api GetProcAddress to get a hold of code address the Starting point of the functions the program wants to call.
Innocent
07-01-2004, 03:15 PM
Several ways. The most obvious, which I doubt a protectionist would use is loading the dll at start and calling its exported functions. Look into the prog import list and the dll export list and see if they communicate this way.

Sure enough the dll and the prog. both have the function zsapi.GetLoc in the export/import lists. I'm assuming there is going to be a spot or two that I need to get rid of in the dump. The dump calls the certain part of the dll it wants to access and then returns to the dump after it's done right? So it looks like I can do this two ways: 1. Find the dll crc check which I think is in the dump and eliminate it so I can just edit the dll directly (can crc's be hidden in dll's too?) or 2. Find where the dump accesses the dll for the 2 or so checks and get rid of them. I'm not really familiar with all this dll stuff but I have reversed some other things. Don't want you to think I'm an idiot because I'm not :sneaky: Just inexperienced, thats all.
naides
07-01-2004, 05:10 PM
The dump calls the certain part of the dll it wants to access and then returns to the dump after it's done right?

Correct. It is typically a function call or a indirect jump into the memory space where the dll is located. That is what dlls are made for, they supply "prepacked" snippets of code that perform frequently used routines

So it looks like I can do this two ways: 1. Find the dll crc check which I think is in the dump and eliminate it so I can just edit the dll directly (can crc's be hidden in dll's too?)

"I think there might be a crc check on the dll though because if I edit it there is an access violation on loading the program."

I do not think this symptom necessarily means that there is a CRC check. Did you edit the code area of the dll? if there are CRC checks on the dll file, changing a single byte in an irrelevant area of the header, for example where it says "This program cannot be run in DOS mode" swtich the "This" for "Thin": If the program refuses to run then there is a file integrity check. If that is the case, APIs like CreatefileA, specially if the second parameter [ESP+04] in the stack points to a string with the name of the file makes you believe that the .dll has been open for inspection, integrity check.

The main exe, a dll or any file with executable code can perform a CRC check, on another file or even on itself.

Don't want you to think I'm and idiot because I'm not Just inexperienced, thats all.

How do you think we, the Idiots become experienced?
Innocent
07-04-2004, 04:25 AM
Changing any irrelevant code in the dll causes an error. I think that maybe the crc check is in the dll itself. I have checked the prog. and the dll for the createfilea code you mentioned and didn't find anything worthwhile.

If the dll has the crc embedded in itself, I think the best way to get rid of my problem is to get rid of the code in the prog. that calls for the dll. Even if I did get rid of the crc check in the dll there are probably too many functions in it I would have to patch to make the program work. So the thing to do would be to get rid of the code that accesses the dll.

Hate to sound stupid but have any other tips?
:thinking:

Once again thanks for your time naides. :yay:
JMI
07-04-2004, 12:54 PM
It is more than likely that the program will not run at all without the dll, but it is always possible that it doesn't do anything but protection functions. It is rather a simply test if it is unnecessary. If you do remove the code from the program which calls the dll and re-run the program, you will quickly determine whether the program runs or not. My guess is that it will not run, but it could happen. :idea:

Regards,
Innocent
07-04-2004, 06:16 PM
Yes it looks like to me all the dll does is go through protection functions. It is filled with a bunch of stuff for elicense protection so I think that it is really not necessary... then again I could be wrong :D
Innocent
07-07-2004, 03:28 AM
Sort of a bump :devil: I still don't know how to get rid of this protection. There is a crc check on the dll that I need to remove. I think I can edit the dll protection functions so the program will run if I get rid of the crc check. My problem is I don't know what to look for. I have read some tutorials on crc stuff but still am having no luck. Any tips?

Ive narrowed the problem down but just don't know how to solve it. Any help is of course greatly appreciated :)
JMI
07-07-2004, 04:38 AM
Innocent:

Using the main search function at the top of the Forums enter "CRC check" (without the quotes) and you will find several threads which might help you understand how CRC checks might work in your dll. You should also search on the net using phrases, such as "CRC Check" and "CRC + reversing." You will find, among others, an article titled "CRC and how to Reverse it - by Anarchriz" which is in one of the archives on our server. You will find it at :

http://www.woodmann.com/fravia/crctut1.htm

One of the Threads has a discussion by Kayaker about the APIs that might be called in CRC checking. Remember that it is going to process the file, dll or whatever in some and, generally, check it against some fixed value. Part of what you generally will be doing is trying to find the end of this process, where the result of the check is "tested" and determine what the result of that test should be if the code had NOT been changed and force it to return that correct result. This can get pretty complicated, but this is a good conceptualization of the problem.

Regards,
Innocent
07-13-2004, 05:37 AM
Heh always plugging the search function JMI :sneaky: I had already looked at the tutorial by Anarchriz before but it didn't help much. All the info about crc in the world doesn't help if you can't find where it is in the program. I did finally get rid of the crc check in the program so I could edit zsapi.dll. After a little softice tracing (Thank God for it!) I found what I needed to edit. It works perfectly now. :D Thanks to everyone who posted. I'm on to other projects now.
naides
07-13-2004, 10:45 AM
Congrats.
Now comes the pay-back. . .
Why don't you write a tutorial, explaining your thought process and the key points of the protection, and publish it in one of the available Tut collections,
so all of us can benefit from your findings.


Using code caves for bruteforcing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Using code caves for bruteforcing
PDA

View Full Version : Using code caves for bruteforcing

bboitano
06-22-2004, 11:59 AM
Hi all,

I'm working on a several crackits and am exploring using code injection / code caves to bruteforce some of them. I've read up on the different tools that have been mentioned in the forum (topo, zeroadd and the one by Delta) and read some of the tutorials on line (Kwazy Webbit etc). Most of the online tutorials I have read all deal with a simple string compare.

I've written my own bruteforcers for some of the crackits (in VB) but my ASM coding is basically non-existant. I was wondering if there was a generic bit of ASM code that you could drop into a target that has a few options to fiddle with (i.e length, alpha-numeric) etc.

For instance one such example that I am working on - that would be an ideal subject grabs the windowtext (only the first 5 characters), then checks that it is only letters or numbers, and then proceeds to hash them and compare the resulting hash with the correct answer. (In fact, the crackit is designed to be bruteforced and I am trying to write one in VB but am struggling and would rather use the crackits own code against it so to speak).

Since I know that it is only 5 characters long, and can only be 0-9, a-z or A-Z one way to solve it would be to bruteforce it. Especially if it is a one-way hash that you can't reverse back to the original windowtext.

So can someone please either help me with my Googling skills (since I can't find anything) or help me find an appropriate section of code.

Many thanks in advance
bb
dELTA
06-22-2004, 03:53 PM
If you find it hard to write a small asm loop that increments a string for bruteforcing, I suggest you study some assembler first. Otherwise I think it would most likely be quite problematic for you to connect any code, ready-made or otherwise, to any already present hash function in the program in question in any case. Good asm skills are really handy to have in any case, so it's a good investment no matter what.

If you have some more specific questions during your attempts to do this, you are welcome to ask them here though.
bboitano
06-23-2004, 10:24 AM
dELTA - I'm sure you're right :D

I've download a simple target to play with from hxxp://www.woodmann.net/forum/showthread.php?t=3169 which has loads of space at the end of the file to mess around with.

Now can somone please point me in the right direction for some sample code so I have an idea where to start from to generate the characters that will be feed into validation routine (in this instance a simple CALL <JMP.&KERNEL32.lstrcmpiA>)

In VB I clumsily use nested loops for a brute forcer i.e.

For a = 1 to 255
For b= 1 to 255
testpass=chr(a)+chr(b)
do stuff to check if testpass works
if good print testpass else
next b
next a

Obviously if it wanted to speed it up and only check numbers I would change the ranges to 48 to 57. Is this what I should be looking at trying to implement in ASM or is there a better way?

I was also wondering if this would be a good topic for a tutorial, since I will be approaching this with only a basic level of RE and an even more basic level of ASM understanding, I will probably ask some of the same newbie questions as others looking to do this. I realise that its not possibly the best target for a tutorial being as that we have to push both the correct answer and our generated one into the CALL making it a little redundant but I think the concept should be generally sound. Anyway - I'll start writing one up based on the RE of the crackit since its nice and simple.

Thanks again.

bb
bboitano
06-25-2004, 04:09 AM
Well,

I was going to write a tutorial on how to 'code-inject' but I thought better of it due to the fact I can't really explain why I am doing what I am doing. But I can show you two examples of working code that have worked on simple crackits for me. And ask a few questions of those more experienced than I for some pointers :)

The first was a simple crackit that I got from Woodmans site. Since actually b/forcing the full 20chr password is a bit much for a beginner (not to mention very time consuming), I truncated it to 4 characters. And because I am a wuss!

Patching the address of the conditional jump to the Bad Serial bit with the address of 401180 (which is a nice empty bit at the end of the code) I coded this brute forcer for the four characters.

Worth noting in the orginal the password is not 4 letters long ;)

00401180 > BB 00254000 MOV EBX,abexcm5_.00402500 ;The address I chose in memory to manipulate the pass
;In this app the proper address is 402324
00401185 . C703 30303030 MOV DWORD PTR DS:[EBX],30303030 ;Fill that address with "0000"
0040118B . C743 04 000000>MOV DWORD PTR DS:[EBX+4],0 ;make sure its terminated
00401192 . 33C0 XOR EAX,EAX ;Zero EAX [redundant now I think]
00401194 > EB 42 JMP SHORT abexcm5_.004011D8 ;Jump to checking routine - I've replicated it here but
;normally you should call to Validation_Routine
00401196 > 8043 03 01 ADD BYTE PTR DS:[EBX+3],1 ;Increment password
0040119A . 8A43 03 MOV AL,BYTE PTR DS:[EBX+3] ;Move the byte incremented to AL
0040119D . 3C 7A CMP AL,7A ;Check it compared to "}" (the next chr after "z")
0040119F . 90 NOP
004011A0 . 90 NOP
004011A1 . 90 NOP
004011A2 .^7E F0 JLE SHORT abexcm5_.00401194 ;less than "z" then continue incrementing
004011A4 . C643 03 30 MOV BYTE PTR DS:[EBX+3],30 ;if greater reset to "0"
004011A8 . 8043 02 01 ADD BYTE PTR DS:[EBX+2],1 ;increment chr before
004011AC . 8A43 02 MOV AL,BYTE PTR DS:[EBX+2] ;move newly incremented chr to AL
004011AF . 3C 7A CMP AL,7A ;Check less than "}"
004011B1 .^7E E1 JLE SHORT abexcm5_.00401194 ;if less then continue checking
004011B3 . C643 02 30 MOV BYTE PTR DS:[EBX+2],30 ;as above
004011B7 . 8043 01 01 ADD BYTE PTR DS:[EBX+1],1
004011BB . 8A43 01 MOV AL,BYTE PTR DS:[EBX+1]
004011BE . 3C 7A CMP AL,7A
004011C0 .^7E D2 JLE SHORT abexcm5_.00401194
004011C2 . C643 01 30 MOV BYTE PTR DS:[EBX+1],30
004011C6 . 8003 01 ADD BYTE PTR DS:[EBX],1
004011C9 . 90 NOP
004011CA . 8A03 MOV AL,BYTE PTR DS:[EBX]
004011CC . 3C 7A CMP AL,7A
004011CE .^7E C4 JLE SHORT abexcm5_.00401194
004011D0 .^E9 2CFFFFFF JMP abexcm5_.00401101 ;if 1st chr of 4 byte pass is equal to '{' then the
;pass doesn't lie between 0 and z so jump to error message
004011D5 90 NOP
004011D6 90 NOP
004011D7 90 NOP
004011D8 > 68 00254000 PUSH abexcm5_.00402500 ; /String2 = "" <- Our pass
004011DD . 68 00204000 PUSH abexcm5_.00402000 ; |String1 = "" <- Correct pass
004011E2 . E8 66FFFFFF CALL <JMP.&KERNEL32.lstrcmpiA> ; \lstrcmpiA
004011E7 . 83F8 00 CMP EAX,0
004011EA .^75 AA JNZ SHORT abexcm5_.00401196 ;Doesn't work therefore continue
004011EC .^E9 26FFFFFF JMP abexcm5_.00401117 ;Works - this is in fact a jump to the good boy box
;and I have patched it so the text is our pass. Perhaps
;given space create a message box with the pass
;so it could be written down and then just pass it to
;the good boy routine to continue

Improvements I can see at this point

Eliminate double jumps going from 0401194 and then back to 04011D8

Tighten up the code to remove the now redundant nops. I used them to seperate my code into segments and also they are there as a result of some tidying up.

As mentioned above use a messagebox to give you the right pass. Then pass that to the good boy routine so it can continue i.e make registry entries etc so it knows its regged. Not in this instance with this program but for others.

At this point - I have the following questions:

It looks like its fairly easy to scale this up to say 8 or more letters (obviously there is a time penalty for doing so - duh!) There may be times when we are severley limited by space so is there an more efficient method of doing this?

I need to work out a good way to preserve the state of the password. As it stands, because I have replicated the validation routine, it becomes self contained and as a result the JMP from the 'goto bad boy section' will always reset the algorithm back to '0000'. If you used this method, and the correct memory addresses, then there is a good chance that the password would be 'freed' or overwritten at some point in the validation routine.

Anybody care to give me a hand? Please remember - when you've all finished laughing at my ASM coding - that this is my first attempt to do this :)

Anyways - buoyed by my brilliant foray into the world of code caving I tried another crackit. This one was a crackit from theblacksheep challenge site (I heartily recommend you check it out - there are some fun things to learn and do over there) for which I had written a brute forcer in VB to crack it some time ago. Infact it was my first b/fer of any kind.

This one is nice and easy to do because it tells you it is five characters long. Handy!

So with this one (I can attach if anyone wants to see it) I've overwritten a little of the bad boy message box, not the call to it because I cannot jmp far enough away to put my code and not overwrite the good boy message :(

So now instead of producing the Bad Key message box it will kick you into my routine which looks the same as above nearly.

0040122F > 8005 0C304000 >ADD BYTE PTR DS:[40300C],1 ;Real password location this time - Increment it
00401236 . A0 0C304000 MOV AL,BYTE PTR DS:[40300C] ; Usual Compare stuff
0040123B . 3C 7A CMP AL,7A
0040123D . 7E 6B JLE SHORT CrackIt-.004012AA ;Again redundant double jump - should just point at
;the call to Valid_routine
0040123F . C605 0C304000 >MOV BYTE PTR DS:[40300C],41 ;For the sake of speed I have just used A-z
;Since I know there are no numbers :)
00401246 . 8005 0B304000 >ADD BYTE PTR DS:[40300B],1
0040124D . A0 0B304000 MOV AL,BYTE PTR DS:[40300B]
00401252 . 3C 7A CMP AL,7A
00401254 . 7E 54 JLE SHORT CrackIt-.004012AA
00401256 . C605 0B304000 >MOV BYTE PTR DS:[40300B],41
0040125D . 8005 0A304000 >ADD BYTE PTR DS:[40300A],1
00401264 . A0 0A304000 MOV AL,BYTE PTR DS:[40300A]
00401269 . 3C 7A CMP AL,7A
0040126B . 7E 3D JLE SHORT CrackIt-.004012AA
0040126D . C605 0A304000 >MOV BYTE PTR DS:[40300A],41
00401274 . 8005 09304000 >ADD BYTE PTR DS:[403009],1
0040127B . A0 09304000 MOV AL,BYTE PTR DS:[403009]
00401280 . 3C 7A CMP AL,7A
00401282 . 7E 26 JLE SHORT CrackIt-.004012AA
00401284 . C605 09304000 >MOV BYTE PTR DS:[403009],41
0040128B . 8005 08304000 >ADD BYTE PTR DS:[403008],1 ;Five letters this time
00401292 . A0 08304000 MOV AL,BYTE PTR DS:[403008]
00401297 . 3C 7A CMP AL,7A
00401299 . 7E 0F JLE SHORT CrackIt-.004012AA

Since I didn't know how much code was involved this time, there is now a huge nop gap up until 4012AA which is the jump to the call (sigh) of the is_it_valid bit.

Amazingly, doing it this way (even when allowing for 0-z) it is in the order of DAYS faster than the VB bruteforcer I wrote for the same crackit. This addition to the code can do it in minutes but my last VB bruter for this took several days (presumably for two reasons :- my programming in VB is only slightly worse than in asm :shock: and two VB had to emulate the registers which is handled here quite nicely ;) )

Thinking more on this I also think that I should approach this in a slightly different fashion. I am concentrating in these examples (partially because I know they are of length x) changing the submitted password from 0000 to 0001 to 0002. With a little more simple coding I should be able to make the routine change the pass 0000 to 1000 to 2000 etc. I think this would give me the advantage of operating using passwords of length <x in that another check (CMP AL,00h) could be used to increment the length of the password so I start with password of length 1 and move up to length x.

Anyway, I think that is enough rambling from me for now. I would really appreciate some feedback on this and my techniques as I realise I am very new to this and am probably not doing it the best way.

Cheers all and happy RE'ing.

bb
What would Brian Boitano do?
JMI
06-25-2004, 04:13 AM
He'd make a plan
And he'd follow through,
That's what Brian Boitano'd do.

Regards,
bboitano
06-25-2004, 05:54 AM
He'd make a plan
And he'd follow through,
That's what Brian Boitano'd do.

Regards,

JMI :D

My plan is as follows

1. Locate forum with people who can help me
2. Ask for help!
3. Show I am working on it and prepared to try things on my own
4. Ask for advice as to ways I could do things better
5. Get some pointers as to where I could be doing better
6. Ask some questions about handling the stack for another example
7. Understand what I am doing
8. Become 'Code Injection Guru' :sneaky:

I'm following thorugh and am up to stages 4 & 5 at the moment and hoping someone will come along and help me learn some more. Any takers ?!?!

Thanks for the laugh anyway!!

bb
What would Brian Boitano do?
Donan
06-25-2004, 09:22 AM
You could always write a .dll in your favourite language and inject a call to your code. This way you dont have to be an ASM expert and you only need to reverse the crackme once ;)

Just one link
http://www.woodmann.net/forum/showthread.php?t=4941&highlight=dll+code+injection

enjoy :yay:
bboitano
06-25-2004, 09:32 AM
Thanks Donan,

I'll try and read up a little bit more on this over the weekend. I've got 101 questions right now but I imagine that a little reading will answer most of them.

Alternatively you can expect me back on Monday with 100 questions, having answered only 1!! [Most likely What Does DLL Stand For :D]

But thanks for helping and have a good weekend :yay:

bb
What would Brian Boitano do?


Armadillo message before RUN
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo message before RUN
PDA

View Full Version : Armadillo message before RUN

Flagmax
06-22-2004, 07:41 PM
Hi, I got a program here that trying to unpack. I got a good dump now and program runs. But there is one problem. When I load the dump in Ollydbg, I get a message with one OK button. It says, "This program has been protected by Unregistered Evaluation version of Armadillo..." This shows up before I get to OEP. So I think it happens while Olly loads DLLs. The Armadillo was 3.0a - 3.6, I believe its Dead in my Dump because IAT is not affected anymore and I can easily redump my dump and ImpRec finds the table by itself and disassembly of the dump is good.
I dont know how to break on anything while OLLY loads the EXE. Could it be I messed while manually rebuild IAT table?

When I press Pause in Olly when Msg pops up, it says I am inside IMAGEHLP.DLL and EIP is at 7FFE0304 C3 RETN

Please any info would be great.

Thank you.

EDIT: I was playing with Pause and landed here:
7FFE030F 8BD4 MOV EDX,ESP
7FFE0311 0F05 SYSCALL --------- I believe this brings up the MSG, I can't trace it this Syscall
7FFE0313 C3 RETN
Alorent
06-23-2004, 02:03 AM
Have you found and set the original entry point?

This is not magic, if you have removed the armadillo wrapper, you cannot see any armadillo messages. Maybe an imported DLL is protected by Armadillo?

About your guessing where the code that shows the message box is...I think that you have gone too deeper. YOu just have to find a possible call to MessageBoxExA (Ring-3 context)

Regards,
Alorent
Flagmax
06-23-2004, 02:13 AM
Yes I found the OEP and set it with PE-Editor.

I now believe it had two Armadillo protections. First PEid said 3.0a-3.6, and after I unpacked, dumped, iat fixed it now PEid says 1.xx-2.xx. I tried the program on a machine that has Softice and it detected it. So some kind of Armadillo is still there.

When I open the EXE in Ollydbg, I see it loads few dlls, then bamm the MSG with OK button, so I click Ok and Olly loads the rest of dlls and it lands right on OEP.

This Armadillo does not mess with program at all. The code is fine and IAT looks good aswell. I am guessing it just has debugger detection.

I am unable to break on anything because MSG shows up before OEP :(

I am not very good at unpacking, just read a bunch of Tutes, some in Spanish that had to translate. And at this time I can only guess that maybe one of the dll it uses is protected with this Armadillo or maybe its something with PE header which I am not sure how it works. Maybe Armadillo runs before OEP.
hobgoblin
06-23-2004, 04:26 AM
Hi there,
I'm interested in taking a look at your target. Can you PM me or mail me the URL for your target? I have been looking at a lot of Armadillo'ed programs lately, and caught interest in the problem you're describing.
regards,
hobgoblin
Mail: hobgoblin@chello.no
friedo
06-23-2004, 10:32 AM
I now believe it had two Armadillo protections. First PEid said 3.0a-3.6, and after I unpacked, dumped, iat fixed it now PEid says 1.xx-2.xx. I tried the program on a machine that has Softice and it detected it. So some kind of Armadillo is still there.

I´ve had such thing too. After unpacking PEid says 1.xx-2.xx... but this has nothing to say, unpacked application runs...
But it seems that´s different for your application...
naides
06-23-2004, 11:28 AM
Hi.
From what you already stated here, the error message is probably generated by one of the .dll loaded by the program.
Remember that every time a .dll module is loaded, its windll function is called, which is supossed to initialize variables, publish exports and other house keeping chores for the dll. May be even some unpacking, all this before the main module code has even started to execute.

In Olly click options -> debugging options, click on the event tab and check the "break on new module (dll )" box.
Now when you load your app you can keep an eye on each and every dll that gets loaded and isolate the dll and the code that generates the error message.


Armadillo is down...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadillo is down...
PDA

View Full Version : Armadillo is down...

hipu
06-24-2004, 06:16 PM
hey everyone, just wanted to thank this wondefull forum for all his excellent info. i couldnt done it without you... i was messing with the magic jump for days untill i simply did a small search in the forums, and found the great post from SysCall (http://www.woodmann.net/forum/showthread.php?t=5891) which identifies the magic jump signature, which allowed me to easily trace it and patch quickly. tnx again ;)

magic jump signature as taken from syscall :

cmp dword ss:[ebp-xxxx],0
jnz yyy ; must be nopped
MOVZX EAX, WORD PTR SS:[EBP-zzzz]
TEST EAX, EAX
MEPHiST0
06-28-2004, 02:01 PM
cool hipu :)
and i like the scripts

heres another thing (for all) you can do with armadillo..

if you know how to unpack armadillo..
you can get teh EXACT ARMADiLL0 version.. very easy.. (which comes in handy) and i dont know if many people know about it.. i was gonna ask 'PEiD' makers if they could code something for arma exact version info :D

you can break on CreateThread or SetProcessWorkingSetSize..
k now most the code is decrypted..

scroll upto the top of olly debug..
whatever the address is, ctrl+s to search, and search for: armVersion>

when u search for armVersion> right click on the code.. and click> Follow in DUMP > then view in hex or text mode
and right after armVersion> ir shows EXACT armadillo compiler version :D

yay.
this will work with ALL v3.xx versions of armadillo.. and shows exact armadillo version.. seen it from arma 3.20c all the way upto arma 3.75a

i posted this info in here.. because i didnt want to start another armadillo thread.. there are alot of em :)

regards..

edited:
was just looking at some older armadillo.. v2.xx i think..
and i couldnt find the Armadillo Version infomation using this method above..
disavowed
06-28-2004, 06:30 PM
cool. good post, mephisto


WinXP 10-Client Server Limit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WinXP 10-Client Server Limit
PDA

View Full Version : WinXP 10-Client Server Limit

Stone-D
06-25-2004, 12:20 AM
WinXP Pro and Win2K Pro allow for a maximum of 10 machines to connect to shares at any one time(1). XP Home has a maximum of 5. The Server variants require CALs (Client Access Licenses). WinNT 4 and Win9X have no limitation at all.

Has anyone had a go at removing this limit in XP? I'm going to give it a shot myself this weekend, but I'd rather not reinvent the wheel. I've searched google with various keyword combinations but no one seems to have even tried.

(1) To check this, open the command prompt/console and type :

NET CONFIG SERVER

C:\>net config server
Server Name \\SERVER
......
Server hidden No
Maximum Logged On Users 10
Maximum open files per session 16384

Idle session time (min) 1
The command completed successfully.

C:\>
Solomon
06-25-2004, 01:21 AM
It's stored in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\Users

Try: change this value and restart "Server" service.

I changed this default value to 99 when I install my Win2003.
Stone-D
06-25-2004, 02:12 AM
Unfortunately this setting is hardcoded for XP home / Pro. That registry key does nothing. But, then again, I haven't done a total reboot so I'll give that a shot later. However, all posts on the topic in usenet or other forums suggest that it is hardcoded.

I believe I've narrowed down the culprit to winsrv.dll or srvsvc.dll. Merely copying the 2003 versions to XP results in a failure to boot.

I think the easiest solution here is to install 2k3 then trace any registry accesses that query that Users setting. After that, I can use that info to dig into XP.


Unpacking Neolite 2 (exe, dll)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Neolite 2 (exe, dll)
PDA

View Full Version : Unpacking Neolite 2 (exe, dll)

Panemuckl
06-26-2004, 04:48 AM
Hi!

Since it's my first post I'd like to tell you that I've used the search function,
studied the faq and read tutorials, so there's no need to flame me right now.
:loveu:

I need some advice on unpacking Neolite 2. To practise, I tried to
decompress Neolite itself. Guess what, I already managed to unpack
neolite.exe without any trouble...

Next, I was working on pecomp.dll, also provided and packed with Neolite.
I changed the characteristics ( [ PE_header_start + 22 bytes ] --> [value]-0x200h),
as described somewhere. So I was able to dump it using Ollydbg.

My question
But how do I rebuilt a dump (of an unpacked DLL file)? How do I rebuilt the
Imports? While unpacking Neolite.exe, I used ImpRec to rebuilt the dump.
As a library cannot be executed directly, I run it through Neolite and picked
up the DLL (ImpRec). But the OEP seems to be incorrect and no IAT is found.

Any help, any explaination?

BTW ollyDBG tells me that the OEP of the DLL is 0040 C638.
[image removed]
MaRKuS-DJM
06-26-2004, 05:58 AM
as i see on the pic, you didn't insert OEP...
0040C638 means insert C638. but i wonder... normally DLL's have no imagebase of 400000
num
06-26-2004, 08:01 PM
Hi all! I am used LordPE for dumping Neoxxx.dll.Ollydumper is not correct dumping my dll.You see ImageBase this dll in ollydbg then change in LordPE Editor and too change OEP.I am find oep in dll the next metod: Go to expression:address section "code" dll.Then :search command JMP EAX and set HBPX then run.Sorry for my English!
Panemuckl
06-27-2004, 07:40 AM
The entry Point of the DLL (after JMP EAX) was 0035 C638, so I dumped it
using LordPE as you told me. After fixing the OEP (C638) and Image Base
(0035 0000) it worx just fine!

Thanx alot!

-topic closed-

After unpacking ASPACK I'd like to unscramble some SVKP "protected" exe.
Unfortunately, Ricardo's site (tutorial) has gone :( Does any1 have a copy?

My Target: Powermule.exe, a spyware/trojan infected emule client.
I just managed step 1 of SVKP unpacking by removing the anti-debug shit.


Hello All
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Hello All
PDA

View Full Version : Hello All

xeno
06-26-2004, 08:21 AM
hello,everybody,I'm come from china.I'm very glad come here.I like unpack very much! :)
none1899
06-26-2004, 11:01 AM
welcome m8! ;D
xeno
06-27-2004, 05:36 AM
I'm glad to come here
dELTA
06-27-2004, 01:49 PM
Yeah, we're glad that you're still as glad about it this second day of your membership as you were on the first day, but I think we're starting to get the picture clear enough now though. :p
disavowed
06-27-2004, 09:31 PM
delta: yhbt, me-thinks :P
dELTA
06-28-2004, 09:16 AM
Well, in that case it's the worst troll I've ever seen. :)
JMI
06-28-2004, 11:21 AM
One pill makes you smaller. One pill makes you tall. The one's that mother gives you don't do anything at all. Go ask Alice. :yay:

Regards,
esther
06-28-2004, 11:34 AM
You are here why ask Alice :whoops: LOL
disavowed
06-28-2004, 06:34 PM
alice? you must be thinking of http://3564020356.org/ (+malattia's site)


IceEXT problems again
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceEXT problems again
PDA

View Full Version : IceEXT problems again

omega_red
06-27-2004, 01:34 PM
A little history before I go to the real deal :)

Today I downloaded some utility to decompile .swf files, wanted to check how good it is. Well, surprise - "General extraction error", it seems armadillo protected. I'm not really into unprotecting, but things like program not functioning with SoftICE even INSTALLED, not running, REALLY PISSES ME OFF! I use sice often and won't f**k with uninstaling it to test some shitty app. "OK, let's load IceEXT and see", I thought. Turned !protect on and launched the app. Whoops.. BSOD ;]

I don't want to dig inside this stinking piece of software, I'm only writing this to help improve IceEXT (as with my previous report with DX problems).
I'm inluding winice's start log & windbg's crashdump analysis (in 1 file, seems that can post only one attachment). Hope this helps somewhat ;)
doug
06-28-2004, 04:50 PM
I don't know about the IceExt issue, but

- your softice serial is in your report txt file.

- The SoftICE check is most likely just a registry / OpenService / EnumServicesStatus call.

I would vote for OpenService, but nikolatesla20 would know better.
Woodmann
06-28-2004, 05:49 PM
Howdy,

I removed the file. Clean it and upload it again.

Woodmann
omega_red
06-28-2004, 07:31 PM
Nice example of what man can do in a hurry <smashes the table with his head ;>
bedrock
06-29-2004, 05:36 AM
Newer Arma's also look for IceExt service key in the registry, thats why Sten's installer let's you choose different names for the iceext service :)

--
bedrock


ocx unpack header?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ocx unpack header?
PDA

View Full Version : ocx unpack header?

OcxUnpacker
06-27-2004, 03:07 PM
i have a problem with a ocx file, i cant open it with pe -explorer, mh the problem is in the header? how i can open it? with which tool?
JMI
06-27-2004, 03:56 PM
What have you done to try to help yourself? Have you even read the FAQ listed in the BIG RED LETTERS?

Regards,
OcxUnpacker
06-27-2004, 08:26 PM
i will unpack a ocx file of a voicechat client
JMI
06-27-2004, 08:43 PM
You seem to have some problems understanding English. Have you read the FAQ?

Regards,
OcxUnpacker
06-28-2004, 06:09 AM
yes
JMI
06-28-2004, 06:25 AM
Great. Now... what have you done to try to help yourself????

Regards,
OcxUnpacker
06-28-2004, 07:24 AM
I have try it with upx to open did not fold,afterwards it does not try to open with PE- exlporer went also.

Where is the problem? protected?
SvensK
06-28-2004, 08:44 AM
lol, great stuff :)
esther
06-28-2004, 10:41 AM
This link will certainly you unpacking upx whatever http://www.methodlab.com/404.swf
bilbo
06-28-2004, 11:47 AM
esther, your link was pointed out less than 15 days ago by SplAj...
not to blame you, just to say I am a careful reader of this forum :-)

OcxUnpacker, you had better to make the same question to PE explorer support (h..p://www.heaventools.com/support.htm): they "want to hear from you!"

Regards, bilbo
esther
06-28-2004, 12:23 PM
Well the mod has warn him twice he seems doesn't bother to read the faq and search. :eek:

That link will certainly help him :devil:
OcxUnpacker
06-28-2004, 12:39 PM
mh i have open the ocx with a hex editor

$Id: NOHACK v2.0 .UPX!....Q.A.6
what is that?
evlncrn8
06-28-2004, 10:32 PM
mh i have open the ocx with a hex editor

$Id: NOHACK v2.0 .UPX!....Q.A.6
what is that?

looks like text to me.. or it could be a free mc donalds voucher, redeemable at your local store.. do some fucking research and find out
bilbo
06-29-2004, 02:43 AM
The only thing I can tell you is that your file has been compressed by some (unknown to me) hacked release of UPX compressor ("UPX!" is the original signature). Everyone can build an hacked release of UPX, because the sources are available. Or, even easier, you can hide/modify some fields, and manual decompression (UPX -D) will not work anymore.

You can:

(a) restore some critical fields in UPX compressed file (see for example
h..p://www.joestewart.org/tools/upxrestore.pl) and then "upx -d"

(b) disassembly the file and reverse engineer it (you can bet that this approach will work always!)

By the way: searching google I found the same answer on a german forum (h..p://www.boardy.de/showthread.php3?threadid=34297442), more than one month ago. No progress in the meanwhile?

Regards, Bilbo
Kayaker
06-29-2004, 03:36 AM
found the same answer on a german forum

Lol, 5 will get you 10 (good odds) both posters are one and the same person?... A couple of words from a Babelfish mutilation, er translation, from that post seem to crop up here... mh, fold ??
OcxUnpacker
06-30-2004, 11:40 AM
which toolz i need to unpack manually a ocx file,and i need a how to about ocx unpack
Kayaker
06-30-2004, 05:28 PM
Hi

What you need to start with is some basic reversing skills. You'll never unpack this ocx without learning to unpack UPX in general. I don't know how much of this you will understand but,

Download UPX and protect Notepad with it.
Search for one of the many UPX tutorials you can find linked to on this site.
Search for one of the many UPX posts discussing it on this forum.
Learn to unpack UPX in your sleep. It's a very easy packer to learn about unpacking on, and the best to start with for anyone.

When you've done that, take another look at the ocx. You need to understand the *differences* between regular UPX and this NOHACK version first. Then you can try to unpack the ocx. Learn how to break on the entry point of a dll/ocx and figure out how to trace and dump the file. There is nothing you can do until you learn some basic reversing, so go do it.

You uploaded a link to the ocx and asked "can erverybody decommpressed it? You need to understand nobody can unpack it without an ocx loader of some sort to start with. YOU have that. YOU need to help yourself. Also understand that what you did is against forum policy, nor the way things are done in this RCE world, nobody here will unpack it for you.

However, to pull a story out of my ass, it's full identification is
$Id: NOHACK v2.0(C) 2003-2004 SER SISTEM Tech. All Rights Reserved. by MONSTER UPX!
It's a regular Delphi ocx which can be opened with LordPE or most any other PE editor. IAT table looks relatively undamaged, all resources are visible, first 2 sections renamed to # (renamed or modifed UPX0/UPX1 sections. No idea about internal changes. NoHack is a also a term adopted by a group concerned with trojans on irc clients and Chinese firewall software.

Btw, we may need some new Smilies...

"Have you read the FAQ?"
"yes"

Suggest emoticons for: Blank Stare, Uncomprehending Blink, Shuffle Feet, Stare at Ground, Whistle Nonchalantly, Back Away Slowly, Turn and Run. :)

K.


WinMain question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > WinMain question
PDA

View Full Version : WinMain question

0rp
06-28-2004, 05:39 AM
if i load a visual c++ gui app into olly, the stack points to the 4 winmain params (current instance, prev instance, cmdline, showstate), but if i load a delphi gui app, the stack points to some bogus values.

i thought, every gui app OEP gets called with the 4 winmain params pushed by the win32 loader?
lifewire
06-28-2004, 07:00 AM
nope. WinMain is not the entrypoint of your C++ program. the entrypoint of your C++ program is inside some .lib that is always linked with your .exe. in that lib, information is gathered and passed to winmain. like a GetModuleHandle(NULL) to obtain the HINSTANCE and such. that is also why an emtpy (main {}) compiled .cpp file is so large.


dos cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > dos cracking
PDA

View Full Version : dos cracking

joe locks
06-28-2004, 06:19 AM
hi
i am new to cracking and need some help
i want to crack a dos based accounting program where should i start
the program is protected
uses a time potected for demo purposes
then you contact seller gives you give him a name and address he give you a code
you enter the name and address exactly the way you give to him and enter the code it accepts
he also give a network code if it is more then one user

please can anyone give me ideas on how to crack this program
also the name appears in all the screens after it is registered
the program has individual modules for
general ledger
creditors ledger etc

thanks

joe
naides
06-28-2004, 10:04 AM
please can anyone give me ideas on how to crack this program

you need to disassemble the program,
trace it live,
Find the protection code

and

reverse it.
lifewire
06-28-2004, 05:17 PM
yes, for example: search for references to the text strings used in the time nag message if such a thing exists, and trace back from there. (in IDA or something)
joe locks
06-29-2004, 08:30 AM
thanks for the help

can you be more specific on what tools etc to use

thanks

joe
naides
06-29-2004, 09:14 AM
you need to disassemble the program, You need a disassembler
trace it live, You need a debugger
Find the protection code You need your brain

and

reverse it. You need your brain plus a hex editor

You also need to read the FAQ
naides
06-29-2004, 09:35 AM
Ok


Basic cracking. Please help.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Basic cracking. Please help.
PDA

View Full Version : Basic cracking. Please help.

josechu
06-28-2004, 01:46 PM
Hello,
I'm trying to crack a Windows application. I've disassembled it using IDA Pro 4.51. I know the lines of code I must change to crack it. How can I patch the application? I've produced the ASM source code (with IDA Pro) and I tried to assemble it with MASM but I doesn't work. I get a lot of errors.

Thanks in advance,

Josechu.
naides
06-28-2004, 02:10 PM
Use Hiew (hacker's editor), decode mode, edit command, asm option.
josechu
06-29-2004, 12:55 AM
Use Hiew (hacker's editor), decode mode, edit command, asm option.

Oh, that's OK. Is there any other more "windows oriented" editor?

Thanks in advance,

Josechu.
ZaiRoN
06-29-2004, 03:28 AM
Hi josechu.
Click here (http://www.woodmann.net/fravia/rce-faq.htm)

Good luck,
Zai
naides
06-29-2004, 05:25 AM
Oh, that's OK. Is there any other more "windows oriented" editor?
Josechu.

You are trolling me, aren't you :cry: :cry: :cry:
dELTA
06-29-2004, 07:53 AM
I've heard that Microsoft Word is kinda "Windows oriented"... :rolleyes:
JMI
06-29-2004, 02:18 PM
Where did you hear that?? :rolleyes:

Regards,
lol_basha
07-02-2004, 09:49 AM
hey

you can use patchfx110 it's what u call windows oriented

http://coders.shnet.pl/main/tools.html

it's not english just go tio the last one ... u'll recognize it from the name
Woodmann
07-02-2004, 02:02 PM
:thinking: :confused:

I will stick with a plain old hex editor. ;)

Woodmann


Getting a feel for how a program works
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Getting a feel for how a program works
PDA

View Full Version : Getting a feel for how a program works

5aLIVE
06-29-2004, 05:56 AM
Hello,
It's been a while since I've posted here, that's not to say I don't
visit every once in a while!

I have a couple of questions about an interesting program I would
like to reverse. I'm trying to learn as much as I can about how it works
before I attempt to make sense of any dead listings or debugging.

The app generates a unique hexadecimal ID based on some of the
computer hardware components, this is equivalent to a user name.
Passwords are validated based on this unique ID. Nothing new here
really.

I found that the exe has the magic constants P and Q as used in
RC5/6. So my initial thinking is that the computer ID and password
validation are based on one of these algos.

I reasoned that if I alter each constant by a digit this is likely to cause
the unique ID value to change or reject the validation of previously
valid passwords. No such effects were evident, the program just
performed as normal.

What I'd like to know is if my reasoning is correct and can is it safe to
assume that these algos are not used? It does seem odd that I
found a function header contain "RC5" in its name. Perhaps it has been
compiled into the code though not actually used?

The program in question acts as a client which on request loads a
second independent program (no network connectiom).

The second program in turn loads a DLL which acts on the the ID and
password in some way.
What I'd like to know here is how does the DLL knows where in the
memory space of the client will these variables will be stored.

Does it find the entry point of the client and use fixed offsets to
access the variables?
How would you implement this in C/C++ for example? This should aid
my understanding.

Thanks for reading my post. :)
dELTA
06-29-2004, 07:59 AM
Put a data breakpoint on the constants if you want to know where/if they are used. Also, any values in the main app memory space that are used by the dll are most likely communicated by parameters to some function in the dll, either directly (passing the value itself, or a direct pointer to it) or indirectly (passing a pointer that is in the beginning of some kind of pointer chain, which can ultimately be used to resolve the address of the value in the main app memory space).
5aLIVE
06-29-2004, 08:29 AM
Put a data breakpoint on the constants if you want to know where/if they are used.

Doing this would give me a definitive answer.

Also, any values in the main app memory space that are used by the dll are most likely communicated by parameters to some function in the dll, either directly (passing the value itself, or a direct pointer to it) or indirectly (passing a pointer that is in the beginning of some kind of pointer chain, which can ultimately be used to resolve the address of the value in the main app memory space).
What you suggest is more logical, I got the direction of communcation the wrong way around. I've since noticed that the DLL does a check to see if the client is running. If I were to remove this check with a simple patch and
load the second app independently, this would confirm the direction of communication. Though I'm sure you are quite correct.
This does raise one question for me though, can the client pass values to the DLL even the the DLL is loaded by the second program. Is his quite a normal thing to do? Iwould have thought this is some sort of OS security breach?
Hmm, slightly confused by this.

Once again Delta you are the first to post a reply. Thanks for the insight, I'll see were this leads me. :) .
5Alive.
dELTA
06-29-2004, 11:17 AM
can the client pass values to the DLL even the the DLL is loaded by the second program. Is his quite a normal thing to do?
I'm not completely sure what you mean, but here are some facts:

1.
Several programs can load the same dll at the same time, yes.

2.
Several programs can load the same dll at the same time, and also operate on the same set of live data inside a shared data section of this dll, yes (such shared data sections are defined in the dll at compile/link time, and the operating system will then make these sections global to all processes that loads the dll).

3.
Other types of shared memory, created dynamically at runtime can also be used to share data between different processes loading the same dll, yes.

4.
Under "normal conditions" (i.e. when no shared data sections have been explicitly defined in the dll, and no dynamic shared memory code is being used in it), all loaded instances of the dll will operate on their own set of data though, i.e. if some data manipulating call is made to the dll from one process, all other instances of this dll loaded by other processes will stay completely unaffected.
5aLIVE
06-29-2004, 12:53 PM
Hi Delta,

I've just ran Process Explorer by Sys Internals, in DLL view it shows that the main app doesn't load the DLL in question, only when the main app loads the second program, the second program loads the DLL.

I was confused that one program could write data into the memory space of a second independent program, I understood this program memory space to be protected against other programs writing data to them. But then of course programs like trainers and loaders do exactly this. I guess this only applies to operating system files then?

So if one only one program loads the DLL, can a second program write to its data section? If I undestand correctly, I don't think any of the facts you listed conform to the way this program behaves. :confused:

The only way I can see this working is if the DLL has some shared data space, that the main app can write data to.
dELTA
06-29-2004, 03:09 PM
Judging from your description, my guess would be that the dll either reads the values from a file or registry key, or that you have misunderstood something about what the dll actually does, or the meaning of those values. ;)

But sure, processes can manipulate the memory space of other processes by using several different API commands used for debugging and such (this is what loaders and trainers do). The user account under which the manipulating process is running must have certain privileges allowed from the operating system to do this though. Also, even harder restrictions apply when manipulating the memory of other processes that are not running under the same user account as the manipulating process itself.

But in this case I really don't see any reason why your application would use techniques like this, it seems quite unnecessary from what you have told us about the application anyway.
5aLIVE
06-29-2004, 04:48 PM
These values are indeed stored in the registry, having run the registry monitor it is the main app can be seen to read these values,
this acts as a check to see that the unique ID hasn't changed for the current password(s). If the ID has changed, the registry is updated with a new ID and the now invalide passwords are removed.

I am now convinced that unique ID and passwords must be read by the DLL as you suggest, however, having said that, regmon only seem to display registry acesses via executables. Is this pehaps a limitation of regmon, what choices might I have to see the DLL read from the registry?

The other thing that confuses things a bit for me is that if I load the secondary program independently of the main app, the DLL will load as expected, but it will protest that it cannot be run without the main app running in memory. I patched this check in the hope that the DLL would read the registry values and run. It now protests that the secondary app must be launched via the main app. Perhaps if I patch this it'll fix it.

It looks like I've been overthinking things a little bit here maybe.
Thanks for the advice so far.
5aLIVE
dELTA
06-29-2004, 05:04 PM
DLLs are loaded by executables into the executable's process space, and then their code can be executed inside this process space. Hence, the registry access will be logged for the process that currently has the dll loaded and executes its code when it happens. It's not a limitation in Regmon, it logs processes, not the modules from which they originate (if any).
JMI
06-29-2004, 05:13 PM
And if you are struggling with the regmon printout, you should check out this thread:
http://66.98.132.48/forum/showthread.php?t=4162

were Kayaker provides a utility to remove duplicate entries, to make the study more "revealing." As Kayaker said: "It was actually JMI's woeful story of having to sift through 20,000+ Regmon log entries that finally spurred me to code this idea I'd had for quite a long time." We all owe him a debt of gratitude for that effort and the review of 20,000+ entries which may no longer be necessary. :idea:

Regards,
5aLIVE
06-29-2004, 06:11 PM
@dELTA, I've learned a great deal from the little excursion so far, and now understand that it is the calling process rather than the DLL which will be shown a reading from the registry.

So in this particular case, will the main app be shown as the process which reads the registry values of interest? When at a particular point in time, it is actually the loaded DLL from the secondary app. In other words the process at the top of the "process tree" is always shown to be the one accessing the registry. Have I got this right?

I'll aim to have a proper sift through the regmon logs to see what I can find. Thanks JMI/Kayaker for the little app. I'll try it out tomorrow, I need some sleep now.

Thanks guys.
5aLIVE
dELTA
06-30-2004, 06:12 AM
No, the relationship between processes (i.e., who started who) will not matter in Regmon, the process that loaded the dll will be the one showing. Note that dlls are not own processes, they are just incorporated into the process that loads them, so they are not "subprocesses" or something like that.
5aLIVE
06-30-2004, 07:46 AM
The process that loaded the dll will be the one showing.
Okay that's clear, in that case the secondary app doesn't read the particular registry values im interested in. I've confirmed this by disassembling both the main app and the DLL and only found RegQueyValueEx API calls in the main app. I made use of Kayakers tool to help sift through things, very helpful indeed!

So the main app must pass these values to the DLL at some point. Therefor I think I need to find the RegQueyValueEx calls of interest and then where in memory these are stored.

If I then set BPs these memory locations being read, I should be able to see the communication beteween the main app passing these values to the the DLL? Is this a good approach?

I'm learning as I go so this will doubtless take some time. Sorry for all these questions, I am trying to do as much as I can though I do need a bit of guidance here and there.
Regards 5aLIVE.
dELTA
06-30-2004, 09:13 AM
Yeah, that should be pretty ok. Breakpoint the RegQueyValueEx API to find the right call faster. But exactly what location in the code is it that you are trying to pinpoint, and why? Why is the point of communication of the values to the dll important? Didn't you already know the point in the dll that performs calculations on the values?
5aLIVE
06-30-2004, 10:28 AM
Yeah, that should be pretty ok. Breakpoint the RegQueyValueEx API to find the right call faster.

I'll give it a shot.

But exactly what location in the code is it that you are trying to pinpoint, and why? Why is the point of communication of the values to the dll important?

See my answer below.

Didn't you already know the point in the dll that performs calculations on the values?
In a word, no. Presently what I do know is that these values are input to a message digest algo, there maybe a salt added I need to find too.
It is my aim to find out how these values are manipulated in the DLL before a digest is created.

Part of the digest is then used to create an interim key to use with a symmetric crypto algo.
dELTA
06-30-2004, 11:38 AM
It might be quite efficient to breakpoint all the exports of the dll, if you're lucky it will not make many more calls to it than the one you're looking for, with the hashing. This will also make it very easy to inspect all parameters that are passed to the dll (and the return values from the dll too).
5aLIVE
07-01-2004, 09:28 AM
Sounds like a good idea to me. I've since found paremter references in the data section to ID and password which should help me find what I'm looking for.

The more I look at this, I think I should be concentrating my efforts on the main app as this is where the unique ID is generated and where the password is checked. Now lets see what I can find today.

5aLIVE


WIN32 Debug API
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WIN32 Debug API
PDA

View Full Version : WIN32 Debug API

yousky
06-29-2004, 04:30 PM
Hi all,

First of all, thanks to Iczelion for his tutorial on Win32 Debug API.

I've read different examples of the use of WaitForDebugEvent. I've implemented that in a little programm to handle Exception by the $CC (Int 3). All works fine except when i've rewrite the original memory code by the $CC.

Explanation:

- CreateProcess of the target
- WriteProcessMemory to put the $CC code at the right memory address for the breakpoint
- WaitForDebugEvent
- Handle the EXCEPTION_BREAKPOINT
- GetThreadContext
- WriteProcessMemory with the original 1 byte memory code at EIP - 1 to continue the execution of the target program
- SetThreadContext with the EFlags using $100
- ContinueDebugEvent
- Handle EXCEPTION_SINGLE_STEP
- WriteProcessMemory to put the $CC code at the right memory address for the breakpoint
- ContinueDebugEvent

=> The code of the target programm is executed after the breakpoint.

My problems is that after that, the WaitForDebugEvent give me EXCEPTION_ACCESS_VIOLATION so the target programm freeze and loop.

Do you have an idea for that problem ?

Thanks for your help.
Yousky
dELTA
06-29-2004, 05:00 PM
What is the single stepping for? And a wild guess would be that the "right memory address for the breakpoint" is actually the wrong address anyway.:)
doug
06-29-2004, 05:37 PM
@delta:
the single step exception handling is for the trap flag that he sets in eflags

@yousky:
could you indent the order in which you do these things. For example, are you doing a writeprocessmemory at eip-1 in the exception handler?? I don't think you should be patching to eip-1 in that case, but to eip.

Anyway, There's no magic answer to your question, you'll have to debug it yourself to see.
yousky
06-29-2004, 06:14 PM
The SINGLE_STEP is to put again the breakpoint at the rigth memory address. But it seems that after my program crash with a violation access. I think this is a Memory problem when a rewrite the Int3. Dont understand for the moment why I have this violation :-(.
Move over, the EIP seems to be good, as i've rewrite the original byte code and i'm after the original breakpoint, I can in the SINGLE_STEP exception put the Int3 breakpoint again without affecting the process running.

I've check the Address memory, the old and new byte, and all seems to be ok I've dump the memory to be certain that my writeprocessmemory works.

argggg :confused: :confused: :confused:

Thanks for your reply.

Yousky
nikolatesla20
06-29-2004, 06:14 PM
Don't WriteProcessMemory until after ONE INT3 comes thru first. The windows subsystem sends your debugger an INT3 exception one time, at the beginning of loading the debugee program. You must respond to this INT3 first, and then you can start doing your own thing. Otherwise, you'll get messages like "The application failed to initialize properly" or probably even that access violation you see now, since the program really isn't fully loaded yet until you tell windows you are ready by responding to that first INT3 exception.

Example:

// Wait until child process exits.
for(;;)
{

// Wait for a debugging event to occur. The second parameter indicates
// that the function does not return until a debugging event occurs.

WaitForDebugEvent(&DebugEv, INFINITE);

// Process the debugging event code.

dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;

hCurrentThread = ThreadMap[DebugEv.dwThreadId];

switch (DebugEv.dwDebugEventCode)
{
case EXCEPTION_DEBUG_EVENT:
// Process the exception code. When handling
// exceptions, remember to set the continuation
// status parameter (dwContinueStatus). This value
// is used by the ContinueDebugEvent function.

switch (DebugEv.u.Exception.ExceptionRecord.ExceptionCode)
{

// This breakpoint is called once always.
case EXCEPTION_BREAKPOINT:
// First chance: Display the current
// instruction and register values.

if (DoneOnce == FALSE)
{
// First time thru, breakpoint is from windows system

// Set up our CreateProcessW breakpoint
CreateProcessAddress = LookupAPIAddress("CreateProcessW","Kernel32.dll");

// Here you can set a breakpoint..
PlaceBreakPoint(pi.hProcess,CreateProcessAddress,CreateProcessHandler);

dwContinueStatus = DBG_CONTINUE;
DoneOnce = TRUE;

// Remember to get out here !
break;

}

if (DoneOnce == TRUE)
{

// pass unexpected int3 exception back to program
// Here you could also just handle your own INT3's that you've set.

dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;

break;

}

-nt20
yousky
06-29-2004, 06:20 PM
Yes I use EIP-1 with my writeprocessmemory but only in the EXCEPTION_BREAKPOINT, for the EXCEPTION_SINGLE_STEP I use the SAME EIP-1 value to put new breakpoint, not the current thread context EIP, normal.

Arggg crazy :(, it seems so easy on the paper lol hehe.

Thanks
Yousky
yousky
06-29-2004, 06:42 PM
Here is ma Delphi code :) yes hehe.

-----------------------------------------------------------
// Only for the example.
OrgCode := $55;
Int3Code := $CC;
PBPAddress := Pointer($00478BD0);

// Create debug process.
FillChar(StartupInfo, SizeOf(StartupInfo), 0);
StartupInfo.cb := SizeOf(StartupInfo);
if CreateProcess(nil, 'G:\Divers\Developpement\Projets Delphi\Swf7\Project1.exe',
nil, nil, False, CREATE_SUSPENDED + DEBUG_PROCESS + DEBUG_ONLY_THIS_PROCESS,
nil, nil, StartupInfo, ProcessInfo) then
begin
// Put breakpoint at the right memory address.
if not WriteProcessMemory(ProcessInfo.hProcess, PBPAddress, @Int3Code, 1, Nb) then
raise Exception.Create('Write memory error');

// Resume thread.
ResumeThread(ProcessInfo.hThread);

// Loop.
while not Terminated do
begin
// Wait for debug events.
WaitForDebugEvent(DebugEvent, INFINITE);

// Events handler.
case DebugEvent.dwDebugEventCode of
// Debug event.
EXCEPTION_DEBUG_EVENT:
case DebugEvent.Exception.ExceptionRecord.ExceptionCode of
// Access violation exception event.
EXCEPTION_ACCESS_VIOLATION:
if DebugEvent.Exception.dwFirstChance <> 0 then
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_EXCEPTION_NOT_HANDLED)
else
Terminated := True;

// Breakpoint exception event.
EXCEPTION_BREAKPOINT:
// First time.
if DebugEvent.Exception.dwFirstChance <> 0 then
begin
// Test the good address memory breakpoint (only for example).
if Cardinal(DebugEvent.Exception.ExceptionRecord.ExceptionAddress) = BPAddress then
begin
// Get context.
Context.ContextFlags := CONTEXT_CONTROL;
GetThreadContext(ProcessInfo.hThread, Context);

// EIP - 1 for writing original byte code.
dwBPLoc := Context.Eip - 1;

// Write original byte code.
if not WriteProcessMemory(ProcessInfo.hProcess, Pointer(dwBPLoc), @OrgCode, 1, Nb) then
raise Exception.Create('Write memory error');

// For EXCEPTION_SINGLE_STEP.
Context.EFlags := Context.EFlags or $0100;

// Set context.
SetThreadContext(ProcessInfo.hThread, Context);
end;

// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_CONTINUE);
end
else
// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_EXCEPTION_NOT_HANDLED);

// Single step exception event.
EXCEPTION_SINGLE_STEP:
// First time.
if DebugEvent.Exception.dwFirstChance <> 0 then
begin
// Get context.
Context.ContextFlags := CONTEXT_CONTROL;
GetThreadContext(ProcessInfo.hThread, Context);

// Restore the INT 3 instruction in the place of the BP.
if not WriteProcessMemory(ProcessInfo.hProcess, Pointer(dwBPLoc), @Int3Code, 1, Nb) then
raise Exception.Create('Write memory error');

// Set context.
SetThreadContext(ProcessInfo.hThread, Context);

// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_CONTINUE);
end
else
// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_EXCEPTION_NOT_HANDLED);
else
// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_CONTINUE);
end;

EXIT_THREAD_DEBUG_EVENT,
EXIT_PROCESS_DEBUG_EVENT:
// Terminate the loop.
Terminated := True;
else
// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_CONTINUE);
end;
end;
end;
---------------------------------------------

This code is simple to read even if you don't code in delphi. So if there is an error :) you will certainly catch it.

Thanks to all :) for your help.
Yousky
yousky
06-29-2004, 06:44 PM
Argg indented code :) sorry.

// Only for the example.
OrgCode := $55;
Int3Code := $CC;
PBPAddress := Pointer($00478BD0);

// Create debug process.
FillChar(StartupInfo, SizeOf(StartupInfo), 0);
StartupInfo.cb := SizeOf(StartupInfo);
if CreateProcess(nil, 'G:\Divers\Developpement\Projets Delphi\Swf7\Project1.exe',
nil, nil, False, CREATE_SUSPENDED + DEBUG_PROCESS + DEBUG_ONLY_THIS_PROCESS,
nil, nil, StartupInfo, ProcessInfo) then
begin
// Put breakpoint at the right memory address.
if not WriteProcessMemory(ProcessInfo.hProcess, PBPAddress, @Int3Code, 1, Nb) then
raise Exception.Create('Write memory error');

// Resume thread.
ResumeThread(ProcessInfo.hThread);

// Loop.
while not Terminated do
begin
// Wait for debug events.
WaitForDebugEvent(DebugEvent, INFINITE);

// Events handler.
case DebugEvent.dwDebugEventCode of
// Debug event.
EXCEPTION_DEBUG_EVENT:
case DebugEvent.Exception.ExceptionRecord.ExceptionCode of
// Access violation exception event.
EXCEPTION_ACCESS_VIOLATION:
if DebugEvent.Exception.dwFirstChance <> 0 then
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_EXCEPTION_NOT_HANDLED)
else
Terminated := True;

// Breakpoint exception event.
EXCEPTION_BREAKPOINT:
// First time.
if DebugEvent.Exception.dwFirstChance <> 0 then
begin
// Test the good address memory breakpoint (only for example).
if Cardinal(DebugEvent.Exception.ExceptionRecord.ExceptionAddress) = BPAddress then
begin
// Get context.
Context.ContextFlags := CONTEXT_CONTROL;
GetThreadContext(ProcessInfo.hThread, Context);

// EIP - 1 for writing original byte code.
dwBPLoc := Context.Eip - 1;

// Write original byte code.
if not WriteProcessMemory(ProcessInfo.hProcess, Pointer(dwBPLoc), @OrgCode, 1, Nb) then
raise Exception.Create('Write memory error');

// For EXCEPTION_SINGLE_STEP.
Context.EFlags := Context.EFlags or $0100;

// Set context.
SetThreadContext(ProcessInfo.hThread, Context);
end;

// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_CONTINUE);
end
else
// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_EXCEPTION_NOT_HANDLED);

// Single step exception event.
EXCEPTION_SINGLE_STEP:
// First time.
if DebugEvent.Exception.dwFirstChance <> 0 then
begin
// Get context.
Context.ContextFlags := CONTEXT_CONTROL;
GetThreadContext(ProcessInfo.hThread, Context);

// Restore the INT 3 instruction in the place of the BP.
if not WriteProcessMemory(ProcessInfo.hProcess, Pointer(dwBPLoc), @Int3Code, 1, Nb) then
raise Exception.Create('Write memory error');

// Set context.
SetThreadContext(ProcessInfo.hThread, Context);

// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_CONTINUE);
end
else
// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_EXCEPTION_NOT_HANDLED);
else
// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_CONTINUE);
end;

EXIT_THREAD_DEBUG_EVENT,
EXIT_PROCESS_DEBUG_EVENT:
// Terminate the loop.
Terminated := True;
else
// Continue debug.
ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId,
DBG_CONTINUE);
end;
end;
end;
disavowed
06-29-2004, 08:39 PM
don't forget that after clearing the breakpoint that you hit and restoring the original byte, you need to GetContext(); context.Eip--; SetContext()

if this doesn't apply to your question, then nevermind :)
doug
06-29-2004, 09:52 PM
yes, I agree with disavowed, and this is what I tried to show my first post...

depending on where EIP is when the exception occurs (At exception / Next instruction after exception)

correct me if I'm wrong, but I think you need to do one of these two things:

At next instruction: (EIP in context points to the instruction after the CC)
- Patch at EIP-1 & Decrement EIP after the INT3 was patched with the real byte (otherwise you are in the middle of the instruction when you return)

at exception: (EIP in context point to the CC)
- Patch at EIP & don't change EIP

Right now, it looks like you are doing a mix of these two.
dELTA
06-30-2004, 06:18 AM
@delta:
the single step exception handling is for the trap flag that he sets in eflags
Well duh. :) I was just suspecting that this was some strange scheme to get the next good EIP or something, and that it might be the reason for the crash, that's why I asked.
nikolatesla20
06-30-2004, 08:42 AM
Once again, I repeat: The windows system will pass an INT3 to your debugger RIGHT AWAY. This INT3 isn't yours, it's the system telling you the program is loaded and ready. You should not do any writeprocessmemory until this exception comes in otherwise the behavior could be undefined !

So all you do is set a flag, on the first int3 exception that comes in (EXCEPTION_BREAKPOINT), that's the windows system breakpoint. All you need to do is continue with a DBG_CONTINUE. You can also, before continuing, now set your writeprocess breakpoint. From this point forward, after continuing from the first breakpoint, any more new exceptions will be yours, etc and everything will be normal.

This is very important! I had trouble with debuggers until I finally realized this fact and accounted for it. Take a look at the code I posted above.

-nt20
yousky
06-30-2004, 10:02 AM
Thanks all, I will check all yours last answers this afternoon and make tests.

Some times (rarely) :) i've had no crash but when I reload the EXE for debugging, the soft freeze.

I'll will try to test my EIP (doug)

Then trap the first INT3 (system window) to put the first breakpoint and then wait for my Breakpoint Event (nikolatesla20).

Bye bye :)
yousky
yousky
06-30-2004, 05:43 PM
Arfff i've found the problems.
First thanks to all for your anwsers, very precious informations.

I've had 2 problems, first with the EIP that I will not decrement by 1 when I put the breakpoint.
Next, thanks to nikolatesla20, the first EXCEPTION_BREAKPOINT was effectively the system windows one.
And finaly, some ContinueEvent have been homited :-(( looser i am lol.

All seems to work now, thanks thanks all

see you soon
bye bye
yousky


Protection plus
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Protection plus
PDA

View Full Version : Protection plus

Omnibus
06-29-2004, 09:10 PM
I need some help with a program protected with Protection Plus 4.x from Concept Software (result from PEID). The dumped file has too many garbage after the last named section; Imprec doesn't recognize mfc42.dll functions (it seems to me, the oep of dumped file is correct).
The unique succesfull approach was to patch the program with Princess Sandy; after this, the time limit can be defeated.
I did search this forum and the one at exetools, searched google and I haven't found anything about this compressor/protector.
Any help will be fine.
PS: I'm not requesting a crack. Just help on unpacking and rebuild the IAT.

Thanks.
JMI
06-29-2004, 10:33 PM
Not of specific assistance in your quest, but have you read the company's publications about their protection system? It should at the least give you some ideas on the nature of their views of their protection scheme. You will find a "tutorial" about their product at:

http://www.softwarekey.com/help/SWKey_brochure2.pdf

They claim their "electronic management system" can:

· Force returned software to stop working
· Track client's usage of your application at your Internet server
· Change license modes remotely
· Retrieve registered user and license update information automatically
· Terminate software purchased fraudulently any time in the future

There is also a specifications page which provides some information. A trial download is available.

This would suggest that the program permits the company to watch you use a program protected with their system without your knowledge and that they maintain the ability to "terminate" the program in the future from their server (or at least that is part of their claim). This should suggest to you some of the things you might be looking for in the program. There is also some general discussion of decryption/decription of user information.

Not a bad place to start.

Regards,


USB Mouse
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > USB Mouse
PDA

View Full Version : USB Mouse

mivc
06-30-2004, 12:48 PM
Hi,

I have a wireless USB mouse and Keyboard with one receiver attached on one usb port.

In softice (2.6) the mouse is not working.

How can i make this work.

Thanks!!!!
naides
06-30-2004, 01:18 PM
Use Driverstudio 3.1.

Post in the right board

I explain: DS 3.1 has a little better set of drivers, and worked for me in a similar situation.
Remember, all the Windows Drivers are worth little (shit) at the level Sice operates in kernel, Ring 0, but everybody writes windows compatible drivers, why in hell should you write Numega "ready" drivers?


Nasty Nag removal
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Nasty Nag removal
PDA

View Full Version : Nasty Nag removal

Panemuckl
07-01-2004, 10:47 AM
Hi!

To practise, I'm currently working on some DSL driver software.

I've done so far:

- unpacking, full restore, imp fixing (unpacked version works fine)
- removed anti-debug (now OllyDBG is my friend)
- removed CRC (MD5) self-check (naggy "CRC failure" -> Terminate)

Now the app runs with all modifications without any problems,
but still a little NAG appears on start-up:

"Application out of date, please update"
[ OK ]

After pressing OK, the program executes normaly. So all I have
to do is removing that last nag screen. May sound stupid, but it's
not that easy after all...

My problem: I can't find the corresponding call to MessageBoxA!

If you wanna give it a try yourself, PM me for the modified executable.

Hopefully, some1 will teach me how to find the correspondig nag.

BTW: [ ALT+F1: BPX MessageBoxA ] ==>> "Not found"
SvensK
07-01-2004, 11:21 AM
PM me an url for the target and I'll have a look.
MaRKuS-DJM
07-01-2004, 12:06 PM
maybe MessageBoxW? try to use a BP instead a BPX
Panemuckl
07-01-2004, 12:19 PM
Tried it all:

BP User32.MessageBoxA
BP User32.CreateWindowExA
...

doesn't work. Really annoying.
naides
07-01-2004, 12:40 PM
Tried it all:

BP User32.MessageBoxA
BP User32.CreateWindowExA

Try braking on the message that gets sent when you click the OK button.
SvensK
07-01-2004, 02:23 PM
Weird app, it's constantly polling something it refers to as "magic value #1".

004172F4 |> 81BD 70FFFFFF 71187639 CMP DWORD PTR SS:[EBP-90],39761871
004172FE |. 74 1E JE SHORT removed.0041731E

If something is off with it, the Expire nag shows. If you load the app in Olly and start it, you can search for references to "Your evaluation period has expired. Order Name Deleted today!".

004174A1 |. 50 PUSH EAX
004174A2 |. 68 30964700 PUSH removed.00479630 ; UNICODE "Your evaluation period has expired. Order Name Deleted today!"

The above code is part of the polling code, I hope you can work your way through from here.

And another thing, if you leave the original .exe in the folder and run your patched exe as <orgname>Crk.exe you don't have to patch the CRC check.
All you need to patch for the CRC check is EB at 17C32h.

Edit: If this still isn't enough for you, I might have another look at it later on.

Regards
SvensK
Panemuckl
07-01-2004, 04:22 PM
I noticed the "Magic value #1" stuff, but it it's not important to crack
the nag. Obviously, the author included various anti debugging stuff, but
thanks to your help I finally solved that issue.

1. Passing through the code, I noticed that the app is calling
User32.MessageBoxIndirectW, as you can see on the SS below

function MessageBoxIndirectW; external user32 name 'MessageBoxIndirectW';

{
Other BP worthy calls:

CreateDialogIndirectParamA / CreateDialogIndirectParam
CreateDialogParamA / CreateDialogParamW
DialogBox
DialogBoxIndirect
DialogBoxParam / DialogBoxParamA / DialogBoxParamW
EndDialog
MessageBeep
MessageBoxA / MessageBoxW
MessageBoxExA / MessageBoxExW
MessageBoxIndirect / MessageBoxIndirectA / MessageBoxIndirectW
}

2. having a look at the stack, I saw that there's a push of "expired" to it

3. passing some more lines of code, you will end up on the corresponding call
to User32.MessageBoxIndirectW

4. step 2-3 lines up and change the JE to JNE

5. Run -> Window still pops up

What's wrong? Apparently there's some more hidden checks, so
I took a closer look on the following lines of code. Et voila: Another call
to MessageBoxIndirectW. After patching the corresponding JE (same
procedure as above), the NAG has finaly gone...

So Winkler & Luders did a good job, but considering myself an intermideate, not good enough ;)

Thanks for your help though.
Panemuckl
07-01-2004, 04:43 PM
Try braking on the message that gets sent when you click the OK button.

How's that? You mean SoftIce?
JMI
07-01-2004, 05:22 PM
Panemuckl and SvensK:

Our Forum rules clearly PROHIBIT the posting of target code which identifies a commercial target. :boo: Both of you have violated this rule and I have edited your posts to remove the offending identifications.

Further violation of this rule will result in drastic consequences. Make sure you do not repeat this violation.

Regards,
naides
07-01-2004, 05:23 PM
Yes, I meant with softIce. I do not know if it is doable in OLLY, shame on me, I do not use Olly as often as I should.
You need to know the handle of the Nag, window etc that has the button.
You find that out with a SPY program (Ispy, Spy++ etc)
Then you place a breakpoint on message in SoftIce

bmsg Hwnd WM_LEFTBUTTONUP or WM_DESTROY, among others.

When you click the OK button in the NAG, SoftIce breaks and you are deep into USER32 code woods, but you can trace your way back (F12) into your app near the code that create and destroy your NAG. It works in a fair number of cases.
Panemuckl
07-01-2004, 05:41 PM
Dear Super Moderator,

Sorry, wasn't aware of that
JMI
07-01-2004, 07:30 PM
Then please read the FAQ linked in the BIG RED LETTERS on the main page of the Forums to learn the rest of the do's and don'ts.

http://66.98.132.48/fravia/rce-faq.htm

Regards,
hipu
07-02-2004, 12:20 PM
u tried looking for the string "Application out of date, please update" and trace it?


Flag Read/write of header section
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Flag Read/write of header section
PDA

View Full Version : Flag Read/write of header section

Frenchy
07-03-2004, 05:19 AM
IS it possible to do that:

during execution of prog..i would change its flag of section .text. (code) to have read and write..after i modify some instruction in coding..and then put off the flag write of the section....

thanks for help :confused:
dELTA
07-03-2004, 07:36 AM
You cannot do this by modifying the section flags during runtime, but you can indeed accomplish it by using the VirtualProtectEx API and friends instead.
Frenchy
07-03-2004, 07:50 AM
thanks delta, i go and see that...


Looking for information on manual Import Reconstruction.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Looking for information on manual Import Reconstruction.
PDA

View Full Version : Looking for information on manual Import Reconstruction.

altruist
07-03-2004, 06:10 AM
Hey guys I was wondering if anyone had tutorials on manual import reconstruction as I'm not one to just use ImpREC for the rest of my life without truly appreciating(knowing how the tool works) what the tool does.

I'd also be interested if anyone has a newbie group dedicated to working together on new protections as a team rather then pushing out cracks to the warez scene.

Some feedback would be appreciated, thanks in advance

altruist
naides
07-03-2004, 09:23 AM
http://www.woodmann.net/forum/showthread.php?t=3563&highlight=manual+unpacking
Silver
07-03-2004, 11:08 AM
I asked a similar question a while back....

http://www.woodmann.net/forum/showthread.php?t=5877
bilbo
07-05-2004, 02:53 AM
Obviously, u can always download IMPREC.DLL sources from its author (MackT) site:
h..p://wave.prohosting.com/mackt/main.htm

Regards, bilbo
br00t_4_c
07-05-2004, 02:29 PM
There's a really nice and thorough article on adding imports by hand in the first edition of Code Breaker's Journal too... not exactly a tutorial on reconstructing mangled or missing imports, but it definitely has some relevant info in it...

hxxp://www.codebreakers-journal.com/viewarticle.php?id=18&layout=abstract

very well explained with multiple examples... :yay:


aspacker - HELP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > aspacker - HELP
PDA

View Full Version : aspacker - HELP

psycho-c
07-04-2004, 05:48 AM
i have a program which won't show me its asm code when i try to dissassemble it using w32asm. it won't even open it. i used peid's scanner, and it said it's packed by ASPack 2.1
how do i unpack it? and if i do, will it show me it's code??

thank u very much!!

P.S
how do i crack/patch proggies that don't have refernce strings?? how do i know where the bad/good guy is without them??
dELTA
07-04-2004, 06:35 AM
Don't cross-post, read the faq, search.


Import Table: Working with IAT, ImpRec
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Import Table: Working with IAT, ImpRec
PDA

View Full Version : Import Table: Working with IAT, ImpRec

Panemuckl
07-04-2004, 11:29 AM
Hi!

Intro

To get familiar on rebuilding import tables, I've coded a simple application that basically just shows a form:

// main code

hWnd = CreateWindow( szAppName,
"Title",
WS_OVERLAPPEDWINDOW,
CW_USEDEFAULT,
CW_USEDEFAULT,
400,
300,
NULL,
NULL,
hInstance,
NULL);

ShowWindow(hWnd, iCmdShow);

SIMPLEAPI.EXE OEP: 0x10E0.

Loding simpleapi.exe in ImpRec, click "IAT Autosearch".
Since I've entered the correct OEP and the import table is just fine (not screwed up by some packer), it should be easy to locate it.

Autosearch:
Set RVA = 0x12100, size = 0xB8 (how's that???)
-> Located (only) 1 library: kernel32.dll.

Okay, lets try it manual:
Set RVA = 0x12000, size = 0x1000
-> Now it found 3 DLLs ("valid:Yes"), but it also shows off lot of trash: 101 unresolved pointers ("valid: No").

How can this happen? Why does ImpRec show an invalid thunk between 2 valid thunks (Kernel32.dll - ?trash? - GDI32.DLL)? If you follow the raw offsets in the file you won't find that invalid thunk!

Hopefully someone will enlight me.
evlncrn8
07-04-2004, 01:18 PM
why not try and rebuild it manually instead of relying on imprec? that might give you the answers to your questions

Unexpectedly, simpleapi_.exe runs! But having a look inside at the IAT, I noticed that GDI32.DLL and USER32.DLL are still missing. So obviously the manual import (+ deleting the invalid thunks) didn't work after all.

wrong, i think u need to learn the pe format a bit more.. gdi32.dll and user32.dll are NOT missing, its at a different va..

simple exe = iat @ .412000
simple1 exe = iat @ .4161f0 (imprec made a new section .mackt)
Panemuckl
07-04-2004, 03:32 PM
>why not try and rebuild it manually instead of relying on imprec? that might give you the answers to your questions

That's exactly what I intent to do. And you're right about the import! :idea:
Now I was able to delete the import table (fill with zero) and replace it at the same file offset using ImpRec!

One more question:
Lets take for example that I've unpacked some app and created a new import table (new section) using ImpRec. Since the new section ".mackt" is insered at the end of the file, it should be possbile to remove the old import table (to be exactly: the section) savely (as it's not pointed by the header anymore).

So how do I remove an empty section? Using "Kill section" in ProcDump won't work.
evlncrn8
07-05-2004, 04:45 AM
Lets take for example that I've unpacked some app and created a new import table (new section) using ImpRec. Since the new section ".mackt" is insered at the end of the file, it should be possbile to remove the old import table (to be exactly: the section) savely (as it's not pointed by the header anymore).

So how do I remove an empty section? Using "Kill section" in ProcDump won't work.

heh you really need to study the pe format a bit more, the reason you cant remove the empty section in your rebuilt exe is because other sections follow it....the 'original' iat is in the .idata section, below it are other sections, .edata, .rsrc and .reloc, removing the .idata section will result in a 'black hole' within the pe image, thus making it invalid, you could remove it but you'd have to either leave it there but make its virtual size 0 so its filled with 0's when its loaded, or totally remove it but you'd have to rebase the sections below it or begin merging sections etc.. your main objective should be that in your dump you rebuild the exe, using the original iat and filling it in with the rebuilt information making the dumped exe as similar as you can to the original exe, rebuilding iat by making new sections is sloppy ;)
nikolatesla20
07-06-2004, 10:24 AM
heh you really need to study the pe format a bit more, the reason you cant remove the empty section in your rebuilt exe is because other sections follow it....the 'original' iat is in the .idata section, below it are other sections, .edata, .rsrc and .reloc, removing the .idata section will result in a 'black hole' within the pe image, thus making it invalid, you could remove it but you'd have to either leave it there but make its virtual size 0 so its filled with 0's when its loaded, or totally remove it but you'd have to rebase the sections below it or begin merging sections etc.. your main objective should be that in your dump you rebuild the exe, using the original iat and filling it in with the rebuilt information making the dumped exe as similar as you can to the original exe, rebuilding iat by making new sections is sloppy ;)

Your opinion. If you aren't "releasing" it to the public then who cares, in my opinion, functionality is what matters. Not to mention that adding a new section is just much more reliable to work the first time. Work smarter, not harder..

-nt20


how do I use an apps dll in my own apps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > how do I use an apps dll in my own apps
PDA

View Full Version : how do I use an apps dll in my own apps

acane
07-05-2004, 09:25 AM
Hi

I got an application (which I bought) which uses its own database files to store data. It use a database dll to access the data in the database.
If load the dll in IDA, I can see a class that handles the database management.

My question is, how could I use this class ion my own app to query the database?
If the database exported a function, I could recontruct the function and use LoadLibrary and GetProcAdress to use the function, but can something similar be done for classes?

Thanks
bilbo
07-06-2004, 01:22 AM
Hi
It use a database dll to access the data in the database.
If load the dll in IDA, I can see a class that handles the database management.

That's not clear. A DLL with some code in it always exports functions.
What do you mean for class?

bilbo
acane
07-06-2004, 02:33 AM
That's not clear. A DLL with some code in it always exports functions.
What do you mean for class?

bilbo

Well, a dll could either export a function or and entire class.
ie for a function:
int __declspec(dllexport) MyFunc();

To use this function, you would use LoadLibrary to load the DLL , and use GetProcAddress to get access to the exported function.
Or you could include the lib file and the .h file of the dll and use the exported function as you normally would

for a class
class __declspec(dllexport) MyClass
{
public:
MyClass();
~MyClass();
private:
int MyVar;
};

For classes, as far as I know, you have to include the lib and .h files to use the exported class.

My question is , if you are reversing a dll that exports both a function and a class, you could use the exported functions by reconstructing its parameters and using loadlibrary and getprocaddress.

But how would you use the exported class?
Silver
07-06-2004, 04:23 AM
As far as I'm aware, you can't. A class is a high level language construct, which is broken down into functions and vtables. It doesn't really exist. If you don't have the definition of the C++ class (ie: the .h), you can't get a compiler to build the code correctly.
bilbo
07-06-2004, 06:27 AM
a dll could either export a function or an entire class

No, acane, a dll cannot export a class. It can exports pointers to data, but a class - as Silver pointed out - is an abstract object. Look at it as a structure definition: the concept is very similar. Only when you instantiate it, it will be materialized in members and vtables.

Try to look at your DLL export table. Do you find numbers inside it (that is the case of MFC42.DLL, which is written in C++)? Do you find "decorated names"? So you have at hand all the constructors, destructors and methods of your class(es). You must also infere the size and the public members, and you will be able to call your DLL from another application.

Or, maybe, the exports are only DllGetClassObject, DllCanUnloadNow,
DllRegisterServer, and DllUnregisterServer?
If that is the case, we are facing yet another subject. Your DLL is exporting COM interfaces, not classes. The approach must be different.

Regards, bilbo
acane
07-06-2004, 08:59 AM
I understand.
If I manage to construct a .h file, would'n i still need a .lib file then? How would I get that?

I've search around and I can't seem to find a tutorial that deals with this.
I'll create my own dll and reverse it to see if its some way possible
Lord8Bit
07-06-2004, 11:20 AM
[QUOTE acane]

If I manage to construct a .h file, would'n i still need a .lib file then? How would I get that?

[/QUOTE acane]

If your .h file is correct, you just need the nifty little tool called DLL2LIB. Search Google, and you will find it easy. :yay:

Best Regards
LordByte
_Servil_
07-06-2004, 11:39 AM
you need to know exact class declaration otherwise you are out of lock
(compile fake dll with that class declaerateion and use generated importlib in this case)
bilbo
07-06-2004, 11:59 AM
Lord8Bit:you just need the nifty little tool called DLL2LIB
dynamic to static converter? it sounds interesting!

I would anyway maintain the original DLL, building by hand the .LIB:
step a) build a TARGETDLL.DEF file
EXPORTS
exported_function_1
exported_function_2
...

step b) lib /def:targetdll.def
where lib is Microsoft's LIB.EXE

_Servil_: you need to know exact class declaration otherwise you are out of lock

In fact, I tried with a dummy definition such as

class c {
char dummy[2000];
public:
c(); // constructor to be imported
~c(); // destructor to be imported
...methods to be imported...
};

and it worked!

Regards, bilbo
Silver
07-06-2004, 12:35 PM
Bilbo, it did? What happens if you reorder it (not renaming vars, just reordering the definition):

class c {
public:
c(); // constructor to be imported
~c(); // destructor to be imported
...methods to be imported...
private:
char dummy[2000];
};

I was under the impression that what I've typed is "different" when compiled to what you've typed, not least because now you can't access dummy via a pointer to an instance of class c (whereas you could before, as it was the first member it would be at that address, but now we have an unknown number of function pointers in front of it).

Ok, that was explained badly, but hope it got the point across. If bilbo is right, then it's easy. If I'm right, then it's a hell of a lot harder.

Incidentally that DLL2LIB tool is great, I've used it before.
TQN
07-06-2004, 11:06 PM
Hi Silver !
We can use a class exported in a DLL. I have tried and successed.
First, we use dumpbin to create a def file for DLL (dumpbin.exe /exports theDll.dll). Don't change the name mangling of functions and class define.
Then we build the import lib with lib.exe.
After, we use undname.exe or new depends.exe to view the unname mangling of class members, copy to the new .h file, and place a __declspec(dllimport) to the class define.
Ex: class __declspec(dllimport) Cxxx {
Hope my information will help you.
Regards
TQN
acane
07-07-2004, 02:22 AM
Thanks
That DLL2Lib tool is excellent. Makes you wonder. Someone could add all the security in the world to their main app but if there core logic is in a dll, someone could write their own GUI and use the DLL's

Anyway, I'm gonna take a look at the DLL2lib tool in depth and there do the tutorials on adding extra menu functions to the app
bilbo
07-07-2004, 03:29 AM
Silver: What happens if you reorder it
Again, a class is just an extension of a structure. The functions (object methods) are not included in the class definition, but are compiled as external code. So the order in class member definitions is irrelevant.
Try to compile this snippet:

#include <iostream>
using namespace std;

class c0 {
public:
c0(); // constructor to be imported
~c0(); // destructor to be imported
//...methods to be imported...
private:
char dummy[2000];
};

class c1 {
private:
char dummy[2000];
public:
c1(); // constructor to be imported
~c1(); // destructor to be imported
//...methods to be imported...
};

void
main(void)
{
cout << sizeof(c0) << "," << sizeof(c1) << endl;
}

Both c0 and c1 will have a size of 2000 bytes!

TQN
We can use a class exported in a DLL. I have tried and successed.
Not exactly. Try to compile this:

/* bilbo 6jul04 - compile as cl -W3 -GX -LD try.cpp */

#include <iostream>
using namespace std;

class
__declspec(dllexport)
c {
private:
public:
int m_i;
c();
void prt(void);
};

c::c()
{
m_i = 777;
}

void
c::prt(void)
{
cout << m_i << endl;
}

You are feeling all the class is being exported, isn't it? But look at the exports of your resulting DLL: They are three:

??0c@@QAE@XZ __thiscall c::c(void)
??4c@@QAEAAV0@ABV0@@Z class c & __thiscall c::operator=(class c const &)
?prt@c@@QAEXXZ void __thiscall c::prt(void)

Only the functions were exported. The concept of class has gone away: no space for member m_i. (Incidentally, an assignment function was inferred by the compiler, the second one).

place a __declspec(dllimport) to the class define.
__declspec(dllimport) is not needed in the calling program. Try this:

#pragma comment(lib, "trydll")

class c {
char dummy[2000];
public:
c();
void prt(void);
};

void
main(void)
{
c cc;
cc.prt();
}

In both cases (with or without __declspec(dllimport)) the two functions related to class c (the constructor and the method prt()) will be placed in the IMPORTS section of the executable.

acane
That DLL2Lib tool is excellent.
Yup, not so bad. But you need some knowledge of the DLL to use it from your application, exactly as in the case you do not use DLL2LIB.

Regards, bilbo
Silver
07-07-2004, 05:37 AM
Bilbo you misunderstood, probably because I explained it really badly.

Again, a class is just an extension of a structure. The functions (object methods) are not included in the class definition, but are compiled as external code. So the order in class member definitions is irrelevant.

Here:

TEST.CPP:

#include "dumped.h"
#include "original.h"

CDumped cDumpInstance;
COriginal COriginalInstance;

int main(int argc, char* argv[])
{
void* pPointer = &cDumpInstance.var1;
cout << "DumpInstance var1 addr: " << pPointer << endl;
pPointer = &cDumpInstance.var2;
cout << "DumpInstance var2 addr: " << pPointer << endl;

pPointer = &COriginalInstance.var1;
cout << "OriginalInstance var1 addr: " << pPointer << endl;
pPointer = &COriginalInstance.var2;
cout << "OriginalInstance var2 addr: " << pPointer << endl;

return 0;
}

ORIGINAL.H
class COriginal
{
public:

int var1;
int var2;

COriginal();
virtual ~COriginal();

};
DUMPED.H

class CDumped
{
public:

int var2;
int var1; // Note different order

CDumped();
virtual ~CDumped();

};

Output is:

DumpInstance var1 addr: 0x0042E180
DumpInstance var2 addr: 0x0042E17C
OriginalInstance var1 addr: 0x0042E16C
OriginalInstance var2 addr: 0x0042E170

Note the order/position in mem of the class vars, simply because of the order they are declared in the class definition.

Both c0 and c1 will have a size of 2000 bytes!

You're right, they will, but do what I did and view the structure in mem and they will be different.

That was kinda my point - I didn't know whether var ordering made a difference when trying to reconstruct a .h from a DLL.

I might suck at swimming, but I know C++ :D
bilbo
07-07-2004, 08:16 AM
Sorry Silver if I looked too hard to you, but what I wanted to say is that the order of the class members is not relevant as far as they are not used by the application. This is surely true:

(a) if the member is an object method (function): it will be used by the application but it does not appear inside the class definition.
So the classes c0 - see above in this thread - (with dummy[] defined after methods) and c1 (with dummy[] defined before) are equivalent

(b) if the members are private: the application cannot touch them, so it has no need to bother with their position.

But if the members are public and the application wants/needs to access them, you are right: the position inside the class storage is of capital importance. For example, in MFC, we must know the position of CWinApp.m_lpCmdLine to access it!

As an initial step, in order to quickly build an application which loads the DLL, I thought to coalesce all the class members in some storage - possibly oversized - named char dummy[2000]. But more steps are required as far as the reversing process goes on...

I might suck at cracking, but I know C++
cracking? do not speak so loud, JMI can hear you!
C++? surely you know it better than me: I hate it, mostly when I have to use it for work!

Best regards, bilbo
Silver
07-07-2004, 09:59 AM
Cracking? Who said cracking? :devil:


dUP 1.03
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > dUP 1.03
PDA

View Full Version : dUP 1.03

diablo2oo2
07-05-2004, 01:23 PM
hmm again a patcher. well i love Search and replace patching, so i decided to code my own patcher.

here some info:

diablo2oo2's Universal Patcher [dUP]
************************************
Version: 1.03 [build 30062004]

Features:
-Search and Replace several Byte Patterns
-choose if you want to patch the whole file or just a number of matches
-Ignore Bytes during search and replace
-'Checking Search Bytes' occurrence in a file (very cool feature,very helpfull!)
-Creating a patch for a packed target [UPX;FSG;ASPACK...]
-Saving Projects
-Creating a small compressed Patch (4 kb) with Appname,URL,Author & Release Info!

you can get it from my homepage: hXXp://navig8.to/diablo2oo2
mr.x
07-06-2004, 11:03 PM
Nice update version, you should add more feature that ppl can add a banner/GFX :yay:
diablo2oo2
07-26-2004, 11:40 AM
i added some new features and kicked some bugs.

Version: 1.06 [build 26072004]

Features:
-Search and Replace several Byte Patterns
choose if you want to patch all matches or a certain match.
Ignore Bytes during search and replace.
'Checking Search Bytes' occurrence in a file (very cool feature,very helpfull!).
-Offset Patch [RawOffset and VirtualAdress]
with Compare Function.
CRC32 check enable.
-Creating a patch for a packed target [UPX;FSG;ASPACK...]
-Saving Projects.
-Creating a Patch with Appname,URL,Author & Release Info!
-Compress patcher with your favorite packer.
UPX: [c:\upx.exe --best %s] upx 1.25 doesnt work with the patcher for packed targets.
FSG: [c:\fsg.exe %s] fsg 2.0 can pack all patcher.

***Version History since v1.05***

[1.06]
-added Offset Patch Feature [also for packed exe's]
-Compare Function for Offset Patches
-Save/Open Offset Projects
-removed internel Packer;added option to choose your packer (upx,fsg,mew...)

[1.05]
-!!! Match Number will only patch the specified Number, and not the patterns before
-new "Check Occurence of Search Bytes" features; more info
-added Tab Control Navigation
-Hidden File Bug fixed

[1.00]
-fisrt release

check it here http://navig8.to/diablo2oo2 . here is always the latest version!
cRk
08-02-2004, 04:04 AM
your great patcher just miss multiple files support + adding support at least for .dll files... is that so hard? ...also would be great if you check the file compare option .. for me crashed under win9x when tried to compare FlashFXP with some modified and original exe file.

Regards
andycham28
08-02-2004, 09:55 AM
cant to your webpage to download it,

Error 404 - The web page you typed in could not be found on the internet.
JMI
08-02-2004, 01:01 PM
Maybe you did something wrong. I just copy and pasted it into my browser and got there correctly.

Regards,
andycham28
08-03-2004, 11:18 AM
Maybe you did something wrong. I just copy and pasted it into my browser and got there correctly.

Regards,

I copied the http://navig8.to/diablo2002 and pasted in address bar but all i get is a 404.

I just been to http://navig8.to/ and on there is states

404 | Not Found

--------------------------------------------------------------------------------

http://navig8.to/diablo2002 does not exist.

The short URL you are trying to access does not exist on this server. Note that it might be still available for registration.
martin
08-03-2004, 11:27 AM
note that in diablo2oo2 what you would expect to be two zeros are in fact lower case "o"s.

;)
andycham28
08-03-2004, 11:33 AM
note that in diablo2oo2 what you would expect to be two zeros are in fact lower case "o"s.

;)

Tried that aswell as stated i copied from the first post of http://navig8.to/diablo2oo2 but all i get is a 404

any way when to navig8.to and did a quick search
came up with this

http://thascene.net/mp2k/diablo2oo2/index.htm this works for me.
diablo2oo2
09-15-2004, 03:05 PM
update: version 1.08
JMI
09-15-2004, 05:37 PM
All we can tell you andycham28, is that it is an issue with YOUR machine or YOUR ISP, which may be blocking that for some reason. Try dumping your cookies and try again. Works fine from most other places. :eek:

Regards,
diablo2oo2
10-30-2004, 06:01 PM
Update to 1.09

[1.09]
-Removed "Options" Dialog,now easier to use
-add xm feature [playing Fast Tracker Modules]
-dUP remember now all important paths
-improved loader code
-fixed caption bug,when using custom *.res file
JMI
10-31-2004, 10:49 AM
Thanks for your continuing efforts and sharing with those of us who either lack the skill or the time to make such thing on our own, or lack both. :yay:

Regards,
diablo2oo2
11-04-2004, 03:39 PM
Update: Version: 1.10

[1.10]
-loader bug fixed when using xm files
-smaller patcher size when not using xm files
-Command line Packer bug fixed,when changing path
-about box msg fix,when changing text
diablo2oo2
11-17-2004, 03:39 PM
version 1.11 is out:

[1.11]
-selecting a packer is now easy.
dUP detects packer and set optimal parameters
-fixed problem with upx: packing patcher for packed targets
JMI
11-18-2004, 01:13 PM
And Thanks once again. :yay:

Regards,


Missing something in this code...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Missing something in this code...
PDA

View Full Version : Missing something in this code...

Silver
07-05-2004, 03:57 PM
Hey all,

I'm playing with a target, and come across something I don't quite understand.

Scenario. App loads, checks current system time, compares it to a value then messageboxes with "Trial Period Expired". I've tracked down to the call that does the check & decision whether the trial is ok or finished. It calls this code:

:00416790 55 push ebp
:00416791 8BEC mov ebp, esp

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004167FD(C)
|
:00416793 83EC08 sub esp, 00000008
:00416796 56 push esi
:00416797 50 push eax
:00416798 B8D3605765 mov eax, 655760D3
:0041679D 53 push ebx
:0041679E BB1C684100 mov ebx, 0041681C
:004167A3 51 push ecx
:004167A4 B955000000 mov ecx, 00000055
:004167A9 0003 add byte ptr [ebx], al
:004167AB 05BE71BDBA add eax, BABD71BE
:004167B0 4B dec ebx
:004167B1 C1C00C rol eax, 0C
:004167B4 05EA3B89E8 add eax, E8893BEA
:004167B9 35F815836E xor eax, 6E8315F8
:004167BE 2D5691812D sub eax, 2D819156
:004167C3 C1C004 rol eax, 04
:004167C6 E2E1 loop 004167A9
:004167C8 22FB and bh, bl
:004167CA C20A44 ret 440A

When I step into this code and trace it, it simply sits at the loop instruction and, er, loops :D. When I execute it, it "magically" jumps out the loop and a messagebox with the trial expired message appears.

I am absolutely sure that this call (code above) is what causes the messageboxa calll - if I trace over the code one level above, and step over the call to 416793, the messagebox appears (ie: it's not the next instruction).

Can anyone give me a pointer of where to go next? Thanks!
ZaiRoN
07-05-2004, 04:30 PM
Hi.
The snippet is a simple decryption routine. It decrypts 55h bytes inside the range 4167C7/41681C starting from 41681C. ebx is the pointer to the current byte to change.

ZaiRoN
naides
07-05-2004, 05:06 PM
This smells like anti-tracing code:

Two possibilities: The code knows you are tracing, and, while at it, it just goes round and round.

OR

It goes round and round many times so a tracer will quit in despair, then it executes the dirty ;)

The most suspicious, out of the loop reference is

:0041679E BB1C684100 mov ebx, 0041681C
:004167A3 51 push ecx
:004167A4 B955000000 mov ecx, 00000055
:004167A9 0003 add byte ptr [ebx], al

Which bring into the soup memory addresses somewhere else

Put Break points to the end of the loop, and find out who or what is kept on the [ebx] == 41691C address and perhaps it would help you.

Satan
doug
07-05-2004, 09:16 PM
End to start self-decryption routine.

Note the important point here:
:0041679E BB1C684100 mov ebx, 0041681C
:004167A3 51 push ecx
:004167A4 B955000000 mov ecx, 00000055

Also notice the apparant "junk" after the loop instruction. RET 440a ?!? where did it use that much stack space?

:004167C6 E2E1 loop 004167A9
:004167C8 22FB and bh, bl
:004167CA C20A44 ret 440A

dig further and notice that: (your decryption parameters)
41681c - 55 = 4167c7
Check whats sits there:

:004167C6 E2E1 loop 004167A9
:004167C8 22FB and bh, bl
:004167CA C20A44 ret 440A

The very last iteration of the decryption-loop seems to patch the "loop instruction" into something else.

If you are using softice, try something like :
BPM 4167C3 X IF (ecx<3)

and carefully trace (using F8) and watch what's going on live.
Silver
07-06-2004, 04:00 AM
Thanks for the help guys, that clears things up, I will poke at the code some more later today.

A related question. Now that I know what this code does, I will be able to find the decrypted code & understand what happens. Normally I'd be able to patch some part of the code to prevent the trial from expiring, but I can't do that here.

So, the question. What is the general/accepted method of patching a prog that encrypts the part of the code you want to patch?

The code is clearly stored in the exe, just encrypted. So should I dump the unencrypted code, import it back into the app over the top of the encrypted code, kill the decryption routine and replace it with a call to the unencrypted code? If so, what's the best tool to do that (dump the code & import it).

Just had another thought - I can bpx on MessageBoxA (at which point the code must be decrypted), should I just patch in sice to jmp eip, then procdump it and extract the unencrypted code?

Thanks for the help, didn't expect this app to be so eductional :D
dELTA
07-06-2004, 07:16 AM
So should I dump the unencrypted code, import it back into the app over the top of the encrypted code, kill the decryption routine and replace it with a call to the unencrypted code?
Yes, that is a good and common way of doing it.

If so, what's the best tool to do that (dump the code & import it).
A hex editor with memory editing capabilitites will work just fine, e.g. Winhex. Copy the decrypted code from memory and paste into the exe on disk.
Silver
07-06-2004, 12:29 PM
Thanks as always for the advice :yay:
Silver
07-07-2004, 01:14 PM
Wow this app is giving me trouble :D. I sucessfully got the decrypted code from mem pasted over the actual code, and the app runs fine, so that's good. But I've found another trick.

I'd appreciate some confirmation here. I think I've found an anti-tracing technique in this code. I follow the code to this:
:00416851 EB10 jmp 00416863
That's fine. So I try and follow the call in wdasm, and all hell breaks loose. Looking in the deadlisting, I see this:
:00416861 80AB8B45FC5E8B sub byte ptr [ebx+5EFC458B], 8B
:00416868 E55D in ax, 5D
:0041686A C20800 ret 0008

That looks really wrong to me, so am I right in thinking this is an anti-trace technique? Making it appear as though the code jumps to the middle of an instruction?

So to fix it, I traced in sice to check nothing else funny was going on (it wasn't). Sice started showing some odd behaviour (ie: it would show the instruction at 416867 correctly, but when stepped over it "magically" changed to "in eax, 5d").

I then nop'd the first 2 bytes, to change the deadlist to:
:00416861 90 nop
:00416862 90 nop

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00416851(U)
|
:00416863 8B45FC mov eax, dword ptr [ebp-04]
:00416866 5E pop esi
:00416867 8BE5 mov esp, ebp
:00416869 5D pop ebp
:0041686A C20800 ret 0008

Which (as you can see) has appeared to stop that little problem and let me trace with wdasm.

So, the questions:
(1) Am I right in thinking this is an anti-tracing technique?
(2) Why did sice/wdasm go a bit screwy? Is that normal?
(3) Have I done the right thing by nop'ing the dummy bytes that were causing the issue, or is there a "proper" way to deal with this?

Thanks again. I know I'll be posting again, done all this work and still not found the code that does the expiry check :rolleyes:
dELTA
07-07-2004, 01:30 PM
If the execution reaches an illegal instruction (or whatever else might be included in the description of "all hell breaks loose") when you debug it but not when you don't, I would guess that your tracing is detected at some point prior to actually getting there, thus directing you to the bad code branch several steps earlier. The "proper" way of fixing this would then most likely be to find and neutralize this initial detection, not starting to nop out bytes at the "payload" (even though this _might_ work too, depending on the implementation of it all).
Silver
07-07-2004, 01:45 PM
Hm, I don't think the app has caught me tracing it - I get the same behaviour whether I run it normally, debug it through wdasm or load it through sice.

Handily in this case the app is pretty stupid - if I turn the system clock back a month, it doesn't expire. Turn it forward a month, it expires. Does that change your answer/thoughts somewhat?

edit... Ok, I'm struggling with this app. Anyone kind enough to give me a hand via privmsg where I can say the appname? I really want to understand how to beat this...
dELTA
07-09-2004, 06:26 AM
So, does this problem occur only when the app is expired, or always since you fixed the encrypted code, no matter if it's expired or non-expired?
Silver
07-09-2004, 06:46 AM
wierd, just got a message saying "Sorry this forum is not accepting new posts".

I see the same behaviour in both my patched version and the original version. I don't believe my patches have altered the behaviour of the app. I've been testing it by pasting my patches into a virgin version of the app, then running it on good and expired dates. I see exactly the same behaviour in both patched and virgin exes; the app works as expected.

I don't have my notes on this app with me at the moment, I'll post further later. Off the top of my head, in C++ terms the app is generating a function pointer somewhere and calling it, which is why I see a call eax instead of a cmp and jne/je etc.

IM-not-so-experienced-O, this app seems to be heavily obfuscated with parts of the code encrypted that don't appear to be relevant to the protection, maybe to cause a lot of wasted time decrypting the wrong thing...
Panemuckl
07-09-2004, 08:48 AM
Send me your target and I'll have a look at it. PM the link to DL
doug
07-09-2004, 08:51 AM
what you experienced is commonly refered to as "self modifying code"

:00416851 EB10 jmp 00416863

:00416861 80AB8B45FC5E8B sub byte ptr [ebx+5EFC458B], 8B
:00416868 E55D in ax, 5D
:0041686A C20800 ret 0008

Look the jmp target address (416863), and try to find this address in your dead-listing.. it's in the middle of another instruction.

If you check what's _really_ at 416863 (which is what softice did after you jmp'd to it), it starts with the byte 8B. If you are 100% sure that the bytes that are jumped over are not used, you can effectively NOP them like you did.

Use a better disassembler, like IDA. Or code yourself a cleaner if you find this annoying.

And of course, search the board for topics on self modifying code.
Panemuckl
07-09-2004, 12:17 PM
Polymorphic as I expected. Alot of protection for a crappy piece of shit like
this. It has several anti-debug checks (better than IsDebuggerPresent) and
creates a thread of itsself (similar to unpacking), that's executed after
creation. So forget WinDasm, you have to use Soft-Ice / Olly.

BTW U don't even have to crack it. Just delete all associated registry keys*
and re-install it after trial.

*) check @ HKEY_CURRENT_USER\Software\<Name of UnH Crappy Solutions>

I've uploaded a nag free copy of your target. Check your PM for the URL.

Enjoy ;)
Silver
07-09-2004, 12:21 PM
Hey, thanks for looking at it :)

Can you explain how you cracked it? I don't really care about the app, I just want to understand how you did it... Thanks!
Panemuckl
07-09-2004, 03:29 PM
Hey, thanks for looking at it :)

Can you explain how you cracked it? I don't really care about the app, I just want to understand how you did it... Thanks!

Well, take a look inside the file and recognize the strings:

Make sure you've enabled all IE Integration items.
There will be no way to do this after the trial period is over!
Purchase the registration key to continue using *** *** after the trial period is over.

At the string, set a hardware BP on memory access (first DWORD). Run!
You'll notice that it won't break as the nag appears. So take a closer look
inside the code. Maybe it's a matter of practise, but soon you'll recognize
some encrypted string

V291bGQgeW91IGxpa2UgdG8gZG8gaXQgcmlnaHQgbm93Pw

VGhlIHRyaWFsIHBlcmlvZCBoYXMgZXhwaXJlZC4gVG8gY29udGludWUgdXNpbmcgQnJvd3NlciBTZW50aW5lbCwgcGxlYXNlIHJlZ2lzdGVyLg

(some more...)

So set a BP to it, same as above. Run. You'll end up near 0x418a51.
Et voila:

004189C7 . C68424 9801000>MOV BYTE PTR SS:[ESP+198],12
004189CF . E8 4CDA0000 CALL BrowserS.00426420
004189D4 . 8D4C24 4C LEA ECX,DWORD PTR SS:[ESP+4C]
004189D8 . 68 9C604600 PUSH BrowserS.0046609C ; ASCII "V291bGQgeW91IGxpa2UgdG8gZG8gaXQgcmlnaHQgbm93Pw"
004189DD . 51 PUSH ECX
004189DE . C68424 A001000>MOV BYTE PTR SS:[ESP+1A0],13
004189E6 . E8 35DA0000 CALL BrowserS.00426420
004189EB . 8D5424 60 LEA EDX,DWORD PTR SS:[ESP+60]
004189EF . 68 84604600 PUSH BrowserS.00466084 ; ASCII "QnJvd3NlciBTZW50aW5lbA"
004189F4 . 52 PUSH EDX
004189F5 . C68424 A801000>MOV BYTE PTR SS:[ESP+1A8],14
004189FD . E8 1EDA0000 CALL BrowserS.00426420
00418A02 . 68 144B4600 PUSH BrowserS.00464B14 ; ASCII ""
00418A07 . 8D4424 74 LEA EAX,DWORD PTR SS:[ESP+74]
00418A0B . 50 PUSH EAX
00418A0C . 8D4C24 68 LEA ECX,DWORD PTR SS:[ESP+68]
00418A10 . 51 PUSH ECX
00418A11 . C68424 B401000>MOV BYTE PTR SS:[ESP+1B4],15
00418A19 . E8 529DFEFF CALL BrowserS.00402770
00418A1E . 8D5424 68 LEA EDX,DWORD PTR SS:[ESP+68]
00418A22 . 52 PUSH EDX
00418A23 . 50 PUSH EAX
00418A24 . 8D8424 8800000>LEA EAX,DWORD PTR SS:[ESP+88]
00418A2B . 50 PUSH EAX
00418A2C . C68424 C001000>MOV BYTE PTR SS:[ESP+1C0],16
00418A34 . E8 07ECFEFF CALL BrowserS.00407640
00418A39 . 83C4 40 ADD ESP,40
00418A3C . 8B4C24 40 MOV ECX,DWORD PTR SS:[ESP+40]
00418A40 . 8B00 MOV EAX,DWORD PTR DS:[EAX]
00418A42 . 8B5424 44 MOV EDX,DWORD PTR SS:[ESP+44]
00418A46 . 6A 04 PUSH 4
00418A48 . 51 PUSH ECX
00418A49 . 50 PUSH EAX
00418A4A . 8B4424 38 MOV EAX,DWORD PTR SS:[ESP+38]
00418A4E . 55 PUSH EBP
00418A4F . 52 PUSH EDX
00418A50 . 50 PUSH EAX
00418A51 . C68424 9801000>MOV BYTE PTR SS:[ESP+198],17
00418A59 . E8 32DDFFFF CALL BrowserS.00416790 <--- jmp to code YOU pasted*
00418A5E . FFD0 CALL EAX <-- call you're looking for**

*) returns EAX = address of function User32.MessageBoxA
**) call EAX == call User32.MessageBoxA

Now it should be easy for you to step back to the condition that needs to
be altered. It's at 0x418865 and 0x41886f: JMP 0x418997. From there,
it's not that easy to go on as the actual code (where the condition is polled)
is generated out of the encrypted data.

So do the following: Set a hardware BP on memory access to 0x418865 (the first JMP to 0x418997 == MsgBox("Trial over")). Run!
You will end up in the loop that decrypts the code to offset 0x418865. It's at 0x418238. As you see, a char "5" is taken and encrypted to "0x0F".
This value is written to memory 0x418865. The full command at 0x418865 is like

00418863 . 3BCA CMP ECX,EDX
00418865 . 0F8F 2C010000 JG BrowserS.00418997 <--- Trial is over
0041886B . 7C 08 JL SHORT BrowserS.00418875
0041886D . 3BF0 CMP ESI,EAX
0041886F . 0F87 22010000 JA BrowserS.00418997 <--- Trial is over
00418875 > 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24]
00418879 . E8 6273FFFF CALL BrowserS.0040FBE0
0041887E > 53 PUSH EBX
0041887F . BB 7D884100 MOV EBX,BrowserS.0041887D

All you have to do now is to make sure that both jumps are NOT taken.
But remember: This is not static code, it's dynamically produced by the app!
You will have to find out the corresponding encrypted code of the modified
commands and patch the corresponding offset in the file. Thats what I did.
Hint: the procedure is located at 0x418238

You can also use a loader and patch the bytes as soon as the app reaches the MessageBox call. There are many ways around, so keep practising!

The author did some good job ... hehe... so much energy spent on protecting;
so easy to crack anyway. :devil:
Silver
07-13-2004, 08:30 AM
Hi Panemuckl!

I saw your original unedited reply before the board went down, so did some work on it and found the jump you talked about in the bit you added. Thanks for pointing me in the right direction, I was too low down the stack :thinking:

The question I was going to post was "Now that I've found it, how do I patch it?" but you answered that in your edit :D

You will have to find out the corresponding encrypted code of the modified
commands and patch the corresponding offset in the file. Thats what I did.

How did you do it? I have found the block of encrypted code, and I have found the "plain" code that decrypts that block. If I break it with sice, I can patch it in memory so that it works every time.

First I thought I'd break on the end of the decryption loop, dump the app then cut the decrypted code out of the dump and paste it into the target, like I was doing before. Except that from what I've found, the code is cross-decrypted? Ie: 3 different calls decrypt parts at different times? So that doesn't work.

Writing a loader is pretty straightforward, so I'm more interested in how you patched it.

If I was to take a guess, I'd try and find an area of the deadlist that I could use (think that's called a code cave?), write some code into it to patch the jump, then insert a call to that code right after the decrypting loop. But I'm not sure that's the right way to do it.

Can you give me a pointer?
Silver
07-20-2004, 12:53 PM
Excuse the bump, hoping Panemuckl will return and fill in the final blank :yay:
Panemuckl
07-21-2004, 08:19 AM
Excuse the bump, hoping Panemuckl will return and fill in the final blank :yay:

I already gave you a detailed instruction with all offsets you need to patch, but unfortunately the server was gone just before I clicked the submit button... But that was not my fault, u know ;)

Back to topic... I don't remember the procedure anymore, but I believe I'd just patched this line

00418A59 . E8 32DDFFFF CALL BrowserS.00416790
00418A5E . FFD0 CALL EAX <--- NOP it out

You don't need to patch encrypted code, just bypass the jump to the decrypt+MsgBoxA call. I really don't remember anymore. But if you like, still have the patched exe on my disk. So you can check it out yourself
Silver
07-22-2004, 03:19 PM
Doh, that makes far more sense :D

Thanks for your help!


Could someone help me?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Could someone help me?
PDA

View Full Version : Could someone help me?

Aaerox
07-05-2004, 08:31 PM
I know this is incredibly offtopic, but my dns server is down, and this was the only site I had the IP to. Could someone ping patriot.localirc.net and give me the ip, just so I could at least get on irc. Thanks :]
JMI
07-05-2004, 10:43 PM
Your right and I'm moving it to the Off Topic Forum. Aside from that, ping comes back at 66.78.33.142. :yay:

Regards,


PC-Guard 5.0's code XORing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PC-Guard 5.0's code XORing
PDA

View Full Version : PC-Guard 5.0's code XORing

thenut
07-06-2004, 04:16 AM
Hi,

I know that with peID you can easily dump and fix PCGuard targets.
My main concern is whether there's a tool outhere to fix encrypted code
that is decrypted on the fly and and the end is crypted back with some
PC-Guard internal XORing function for the already dePCguarded app.
I know that in the first place I should have tried to do it on my own,
I am just interested whether someone else already created something like
that, so no need to reinvent the wheel.
Thanks in advance,
dELTA
07-06-2004, 07:42 AM
thenut, your question is a borderline crack/unpacker request, be careful here...

Anyway, I thought I'd refresh you all about the rules of this messageboard, regarding asking for tools of different kinds:

1.
You may NOT ask for cracks, automatic unpackers and other kinds of ready-made zero-knowledge tools for breaking software protections.

2.
You may NOT ask about where to download ANY tool, freeware, pirated or whatever (this is to make sure no links to pirated software occur here, and to avoid people using this forum instead of google, even for freeware tools). This does of course include NOT being allowed to ask if someone can send it to you too!

A valid exception to this rule of not being allowed to ask WHERE a tool can be found is when the original site of a free tool has disappeared, and it is hard to find it by searching. In that case you MAY ask if anyone knows what happened to the site, and if there are any ways to find this tool anywhere else.

3.
You MAY ask for the existence (i.e. name) of a tool that has some feature that you have been looking for and been unable to find yourself, AFTER having put some reasonable effort into searching for it yourself on the net. Some features may be quite hard to find through searching though, and that's why you are allowed to make use of the collected knowledge of the board members here if you haven't been able to find it through searching the net.

I hope that makes it a bit more clear for you all.
thenut
07-06-2004, 02:32 PM
Hi dELTA,
thanks for highlighting me the rules, but believe me I read them. And believe me
I have searched the archives and found zero about what I am looking for.
And yes, my post applies very well to item 3. in your list. Since I am NOT looking
for someone to do the job instead of me, I am interested in whether someone has
already done similar tool (i.e. I was asking for if that tool exists or not).
Anyhow the problem is solved, since I have created the tool I was looking for.
Cheers,


Palm Reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Palm Reversing
PDA

View Full Version : Palm Reversing

Will
07-06-2004, 12:31 PM
I just ordered (and received...woohoo!) a Symbol SPT1800 (palm os device w/ barcode scanner). The problem is that it didn't come with any software. Symbol does offer an sdk though....pretty much just a couple of libs and headers and a few examples of using the libs.

The problem with that is that I'm not all that into warez and I'm not going to spend $400 on the metrowerks codewarrior software. The only palm development that I've done is with pila, but that doesn't offer any way (that I've found) of linking an external library. There is a new version of pila out as well that looks nice but it doesn't have that capability either.

The good news is that I've managed to disassemble the one lib that I need and have ripped a couple of functions out of it and transported them to my pila source. The ripped functions work great except for the ones that reference global variables. I don't know how to debug symbol-specific palm apps. I can't seem to find any roms for pose. Is there a way to debug the apps while they're running on the symbol with it in the cradle?

(The global --looks like just one so far-- looks like an initialized variable. I can't find anywhere where it gets a return value or any other data moved into it. The only way that I can think of to see what's going on at runtime is to debug it. I guess I could patch the app to display the contents of that variable but in the end I'll need a way to debug the symbol apps anyways.)

thanks,
will
sgdt
07-13-2004, 05:06 PM
I've done a lot of work on the Symbols, both Palm style and PowerPC.

For Palm, you should get CodeWarior, you won't regret it. GCC will work, I guess, but IMHO, CodeWarior is much nicer and SDKs are built for it.

The SDK is pretty simple, set your scan conversions, and all will be good.

That unit's pretty expensive, this isn't a hobby, is it?
Will
07-21-2004, 04:28 PM
Well it is a hobby actually, but it's also work related. I develop a lot of little software projects that make my work easier. I'm not a professional software developer. I'm in Telecom, and we've recently integrated Cisco VoIP into our more traditional TDM PBX voice network. I convinced my boss to order a Symbol unit to help me inventory our Cisco phones, but also because I've been wanting to play with one for the longest time. ;) He wasn't too thrilled when it shipped without software, but I was delighted.

I'm actually quite fond of PILA, although it's almost beta quality. I'd like to play with Pila 2 but I'm not messing with cygwin to do it. I've used a trial version of Code Warrior, but there's no way that I'm paying $400 for it. I would if I used it professionally, but I'm a telecom geek by trade. I only program as a source of enjoyment.

My real question was how do you debug symbol apps? I vaguely remember reading/hearing something about debugging palm apps while the palm was in the cradle, but I don't remember anything concrete and can't seem to find it again. It seems that you'd need some sort of conduit, with a debugger running on the computer that it's attached to. How do you debug your symbol apps?

cheers,
will
sgdt
07-23-2004, 01:02 PM
Actually, I used the emulator for most of my debugging. The Palm emulator is actually quite accurate (vs. the PocketPC emulator, which is very inaccurate!).

The next thing I did was create a dummy symbol library for debugging, producing random scan codes. The reason is the emulator emulates Palm, not Symbol. This allowed for much faster debugging than thru the cradle.

Last, I ditched the cradle, and went to a strait cable for debugging of live Symbol units. Scanning while holding the unit in it's cradle, hoping it doesn't come loose crashing your debugger, was too much of a pain, and a cable was only a few bucks at best buy. But, 95% of all debugging took place on the emulator.

When writing for Symbols PocketPC line, I tried the same method, but I got bitten. The PocketPC emulator isn't very accurate, and will actually allow you to do unaligned memory accesses. Run on a real Symbol PocketPC, and BOOM, bad things happen. Also, I was unable to get a regular cable for Symbol's PocketPC. It was propriatary, so it was stuck on the cradle. :(
Will
07-23-2004, 02:33 PM
I've seen those cables, but never really needed one before. It sounds like it'd be better suited for debugging then the cradle though. Thanks for pointing that out.

I figured that maybe there was some sort of 'magic' symbol rom for pose. But it sounds like you sort of created your own by using a dummy symbol library. That's probably the closest thing to a symbol rom I guess.

I have a few questions that maybe you'll be able to answer if you have the time.

1) How are palm libraries statically linked at link time?
It seems that the 68k binary code is sort of cut/pasted into the 68k binary code of your app which makes perfect sense. However I was going through a dead listing from one of the examples in the symbol sdk which calls some functions from one of the symbol libs, and noticed a couple of strange looking trap calls. Forgive me as I don't have it in front of me right now, but I remember it looking like the 68k equivalent of calls to the win32 LoadLibrary, and related api calls...as if it were loading an external library. Do have any information on that?

2) Differences between deadlistings of different disassemblers.
I'm not big on warez, but I wanted to try IDA with palm apps but I don't like it one bit. It misreports the number of locals. There were a couple of other things that I didn't like but I don't really remember them at the moment. Anyways, this isn't about tool-bashing. The disassembly output from IDA, palmdemon, and pildis are slightly different. I haven't figured out if it's just that some opcodes are interpreted differently, or if it's some anti-disassembler stuff or what. I was just curious if you'd seen anything like that.

3) How exactly do you do the serial debugging?
The more that I think about it, the more I think that I saw that in the debugger that comes with the palm sdk (although the last one that I have is for 3.5 I believe). Is there a pose setting to attach to the serial port? (again, I don't have pose on this machine)

4) a5 relative globals
Globals are represented by positive offsets from a5 right? What's represented by negative offsets from a5? While we're on it, are all variables defined outside of procs but within the code section, represented as positive offsets from a2?

cheers,
will
Will
07-25-2004, 12:54 PM
I've figured out how to do the serial debugging. You're absolutely right about using the cradle for debugging though. It sucks.


how does ImpRec work?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > how does ImpRec work?
PDA

View Full Version : how does ImpRec work?

0rp
07-06-2004, 05:58 PM
how does ImpRec finds the IAT section?

if i enter an OEP, does ImpRec searchs for "call ds:[407030]" like calls (0xFF15) and assumes, that the IAT section could be 7XXX ?

and if, how does this search work? does ImpRec follows jumps and calls to find more searchable code ?
JMI
07-06-2004, 06:46 PM
A first question. Have you searched for and read anything about how Imprec works, either here or on the net, before asking your question?

Are you aware that the source code of ImpRec is available for your review?

It seems a little searching is in order and certainly some reading of the FAQ in the BIG RED LETTERS. :idea:

Regards,
0rp
07-06-2004, 06:56 PM
i'm sorry
:(
JMI
07-06-2004, 07:23 PM
And maybe I was a wee bit to hasty about the source code being available. There are certainly several places which "say" the source code is available, but that seems to be for some of the plug-in. Not sure now if the source for ImpRec, itself, was ever available, but further searching should find the answer. However, there is a great deal about ImpRec on the net and on these forums you should review and if you also review threads here on manual import rebuilding and stury the PE header, you will come to find out where the IAT is supposed to be located. :idea:

Regards,
disavowed
07-06-2004, 08:06 PM
And maybe I was a wee bit to hasty about the source code being available... further searching should find the answer.
JMI, please read the FAQ in BIG RED LETTERS and try SEARCHING before posting on this message board! :p
dELTA
07-06-2004, 08:09 PM
:D
JMI
07-06-2004, 08:29 PM
Oh what a cruel world. :eek: :devil:

In fact, it was because I was actually searching for the "source" which was alleged to be there, that I discovered the representation did not seem to be completely correct. :rolleyes:

I am not a programmer and I took their word that "the source" was included. Then, to make sure, I looked inside several versions of ImpRec I have on my HD and discovered the "sourced" seemed to be to pulgins only. I then searched and after several fruitless paths, concluded that the claims I had read appeared to simply be an overstatement. Haveing made that discovery, by further searching, I duely reported the results to the waiting world, knowing full well the abuse which would be heaped on this poor hapless sole, who was only trying, with his last ounce of strength, to do one last good deed before he perished from exhaustion.

Oh cruel fate. Oh the shame of it all. I guess I'll have to go kill myself now. No wait, :idea: there are plenty of people waiting in line for the priviledge of killing me. Well at least I won't have to use the energy to kill myself. :yay:

:loveu: Good bye.

Regards,
Woodmann
07-06-2004, 09:35 PM
Ahhhhhhhhhhhhh.....

'tis is not nice to see the preacher not practice what he hath preached.
:devil:

No excuses accepted :D

Ta Ta, Woodmann
0rp
07-07-2004, 03:46 AM
no, you're right

the ImpRec light dll source is freely available
and it seems, that it does contain enough interesting stuff

http://wave.prohosting.com/mackt/projects/imprec/ImpREC_lite_v11.zip
JMI
07-07-2004, 04:28 AM
Well that at least clarifies somewhat the issue of the "full source" code. One can be easily mislead by entries in google, such as:

Protools - Utilities
... Import REConstructor 1.6 (289K). ... fixes section entries in header (size & offset)
and is also able to rebuild the import table if ... Full source code included. ...

which was one of the links I saw with the quick check, before my first post. I then got to thinking that I had downloaded a copy of v1.6 from there and did not recall seeing source code there. But I did recall reading, somewhere that source code was available for ImpRec and Orp has now cleared up that it was for the "lite" version. I feel so vindicated that, perhaps, i won't kill myself after all. :idea: And of course, now I'll have to resist any extrenious attempt to accomplish that task. :yay:

Regards,


Delphi dumped apps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Delphi dumped apps
PDA

View Full Version : Delphi dumped apps

Shub-nigurrath
07-09-2004, 03:47 AM
Hi,
I have a little problem I whish to discuss here..

I have a Delphi quite complex app which is asprotected. Well, no problems removing asprotect, but the unpacked application I got has a problem: it's written in Delphi so the ASM isn't quite clear and to do even simple things, like compare strings, it's not so simple to read, not talking about variables which are always relative to EBP, as usual in Delphi programs..

Unfortunately the unpacking process removed all those informations usually used by DeDe to reverse the program..

I'm just wondering now if there's a way to get back the informations used by DeDe or similar programs into the dumped program.

The problem is the same for any other not c++ program I guess.
HaRdLoCk
07-09-2004, 05:34 AM
use IDA and apply all delphi signatures. u can then create a map file and load it into olly for example.
Shub-nigurrath
07-09-2004, 05:59 AM
good suggestion..I haven't thought, also because I wasn't able to find a good signature 4 IDA in the past...where can I find it ? Is there a way to export from dede or dsf files
nikolatesla20
07-09-2004, 06:51 AM
Have you tried using DeDe on the running process?

-nt
HaRdLoCk
07-09-2004, 08:37 AM
IDA comes with pretty good delphi signatures. just click the nice flower and press insert button. check out these signatures:

BP32_2 Borland Delphi/C++Builder VCL
C4VCL CBuilder 4 and Delphi 4 VCL
D3VCL Delphi 3 Visual Component Library
D4VCL Delphi 4 Visual Component Library
D5VCL Delphi 5 Visual Component Library
DELPHI Delphi V1.0
Shub-nigurrath
07-09-2004, 10:14 AM
2nikolatesla20
yep, DeDe won't attach to the ready-to-dump process (I mean with stolen bytes placed back with Olly stopped at the OEP)..buttons are not activated..

2HaRdLoCk
I tried to do it, but despite this applying delphi sigs only identify 8, 10 matches at all..
crUsAdEr
07-09-2004, 10:39 AM
hmm... if you dump it right generally Dede should be able to work on it with some minor fixes on the file header... Also generally IDA built in sig will do pretty well already...
Shub-nigurrath
07-09-2004, 03:52 PM
minor fixes on the header? Which for example?
The dump is "perfect", because the asprotected file is quite simple, the stolen bytes aren't erased as they are visible at the OEP through ecx..
Shoob
07-09-2004, 05:05 PM
learn Delphi routines!
esther
07-13-2004, 10:21 AM
__________________
(.|.)
..).( (¯`·._.·[¯¨´*·~-.¸¸,.-~*´¨&8~)
₪¯¨´*·~-.¸¸,.-~*´¨]·._.·´¯)
( v )
.\|/

:rolleyes:
JMI
07-13-2004, 10:40 AM
All that is just the substitution for Shub-nigurrath's graphics under Shub's signature block that appears on other Forums. :yay:

Regards,
esther
07-13-2004, 10:43 AM
This might offend some ppl out there LOL

eg Evaluator :devil:

he would say you dirty..... :whoops:
JMI
07-13-2004, 11:17 AM
Actually, I hadn't even paid attention, so I had not "visualized" the form on the left. :devil: But, then, I have a clean mind, so they are just paranthesis and periods to me. :yay:

Regards,
Shub-nigurrath
07-13-2004, 11:43 AM
do some characters create problems to any1? I would never been able to think of it. Nothing special indeed, so just because I don't want to "hurt" anyone, I removed them

..if you are so sensible boys and girls well let know that the world is worst, goddamned worst ..humpf
dELTA
07-13-2004, 11:52 AM
Speaking of eval, haven't been around for a while, anyone knows where he went? Maybe vacation or something I guess...
JMI
07-13-2004, 11:53 AM
Shub-nigurrath:

Don't need to be humpfing. ester was just teasing evaluator, who sometimes objects to things which display the female form in way the eval seem not to find pleasing. WE don't mind and it was just general teasing. No need to get up tight about either the symbols or the posts. :yay:

Regards,
Shub-nigurrath
07-13-2004, 05:33 PM
well well ok, reenter in the terms more appropriate for this forum so.
Anyway for what was the initial question of this thread I solved the problems with IDA/DeDe and dumped Delphi programs, thanks to suggestions here posted..

TAL.


Graduation project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Graduation project
PDA

View Full Version : Graduation project

Stilgar
07-09-2004, 10:43 AM
Hi everybody,

I'm working in a project for my graduation in the university, and I'm not so confidente about it. :-/

Currently, the project is of the following form:

Title: The importance of Reverse Engineering by means of study of cases

Case 1 - Ressurrecting a dead component
By means of an old DOS game, I try to recreate the original screen editor through reverse engineering in the executable, in search of the format of the screens archive.

Case 2 - Fighting malwares, trojans and virus
Using a Trojan that infect me while I used Internet Explorer, I use reverse engineering to detect the alterations that it makes in my computer, and to create corrections for the same ones.

Case 3 - Adding functionalities
I modify the writing routine of a freeware keylogger so that the recorded keyboard keys in the archive of log are cryptographad before they are saved.

It would like suggestions. Do I have to include more cases? Which? The depth is reasonable? The cases are relevants? Any suggestion would be appreciated.

PS: Excuse the bad Altavista translation :D
dELTA
07-09-2004, 11:41 AM
About the depth and relevance of the cases, you'd better ask your university about that instead. :)

As for the cases themselves, I think it completely depends on what you make of it, but I would guess that you need to be much more specific in the definition, right now it is very unclear what you are going to do with each case, and what the results are supposed to be in the report.
doug
07-09-2004, 02:28 PM
interoperability: for example, reverse-engineering protocols, APIs when you do not have their specification. Making your system compatible with another. Trillian, WINE, ...

for fun: learning how things work.

Reverse-engineering is not just about computers. Car makers check their competitors' vehicles too.
Shub-nigurrath
07-09-2004, 03:55 PM
Hi,very interesting work indeed..working in an accademic environment too I'm also interested in this project, it could be the base for other works too..would you share it as soon as it will be ready (if it's in english of course) ??


Changing notepad's background color
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Changing notepad's background color
PDA

View Full Version : Changing notepad's background color

homersux
07-09-2004, 04:39 PM
I have an idea how to do this, basically i need to patch the wndproc
and add a WM_CTLCOLOR code segment in notepad's code cave (? where the code segment
ends but not yet at the end of the memory page). Then after the
WM_CTLCOLOR code segment is executed, it jmps back to the original
notepad's wndproc.

My question is, Is there an easy way to change notepad's background
color? the default WHITE_BRUSH is annoying.
evlncrn8
07-09-2004, 05:02 PM
yep the WM_CTLCOLOR , intercept it, and return the handle of a brush to draw the background that should allow you to quite easily change the background color, the system has a few basic brushes already defined like the WHITE_BRUSH one, which can be obtained from a GetSysColorBrush call, and if the color you want to use isnt available, then you can make one , and just return with eax = the handle of the brush u want the background to be you may have other things to do such as calling a SetBkColor etc on the window as well so the text also assumes the same background color, shouldnt be too hard ;)
bilbo
07-14-2004, 01:59 AM
Or do it dynamically.

You need some code-injection mechanism, and then you can callSetClassLong(notepad_wnd, GCL_HBRBACKGROUND, (LONG)newbrush) from Notepad address space

Have a look at h..p://www.codeproject.com/dll/subhook.asp

Regards, bilbo
homersux
07-14-2004, 10:15 AM
Well, the first approach doesn't work. It happens that the message
WM_CTLCOLOREDIT (0x113) is never passed to notepad windproc at 0100248f.
And even if it was passed to the windproc, the message jmp table executes
something that does not relate to color management at all.

code injection is very easy, i have a generic code injection scheme setup. i will try
the sendwindowlong approach shortly.

Another question: can anyone make obtain a non-NULL ptr1 (cannot change base address in 2nd VirtualAlloc call)

#include <stdlib.h>
#include <stdio.h>
#include <windows.h>
#include <windwsx.h>

int main(){
LPVOID * ptr, *ptr1;
ptr = (LPVOID)VirtualAlloc(0, 0x1000, MEM_COMMIT, PAGE_READWRITE)
ptr1 = (LPVOID)VirtualAlloc((LPVOID)((LPBYTE)ptr+0x1000), 0x1000,
MEM_COMMIT, PAGE_READWRITE)
printf("ptr = %08X, ptr1=%08X\n", ptr, ptr1);

}
bilbo
07-14-2004, 11:17 AM
Hi, homersux,

the second approach doesn't work either, I have tried it today without success. Sorry if I gave you a wrong advice!

In fact (I tried with a yellow brush) the notepad class will come with a yellow background (you can see it when you resize the window) but it is immediately hidden by the child Edit window.
By the way, changing the background on the child window with the same technique does not work.

I am trying to subclass on the fly the notepad window, but without success at the moment.

-----------------------------------------------------------------------

Your second question is another good question!
Why the second LocalAlloc() fails? I cannot answer!
In fact, if you do

{
MEMORY_BASIC_INFORMATION mbi;
VirtualQuery((LPBYTE)ptr+0x1000, &mbi, sizeof(mbi));
printf("base %x,allocbase %x,allocprotect %x,size %x,state %x,protect %x,type %x\n", mbi.BaseAddress, mbi.AllocationBase, mbi.AllocationProtect, mbi.RegionSize, mbi.State, mbi.Protect, mbi.Type);
}

you will see that memory at ptr+0x1000 is MEM_FREE!
But this is another thread...

Regards, bilbo
homersux
07-14-2004, 11:35 AM
I have answer to the 2nd problem at least on windows 2000. It's a lenthy analysis of ntoskrnl!MmAllocateVirtualMemory. Basically the kernel will not allow the 2nd call to proceed no matter what. It has to be a on a 64K boundary with MEM_RESERVE|MEM_COMMIT option to succeed. It's very interesting.

The notepad thing is really interesting, I have learnt quite a few things about gdi32 in the process.
bilbo
07-15-2004, 09:48 AM
Hi, homersux,
I finally managed to obtain some results on your questions...

1. NOTEPAD BACKGROUND
The following code, pasted in a file testlib.c, will build a dll TESTLIB.DLL

// coded by bilbo, 15jul04 - compiled with M$: cl -W3 -LD testlib.c

#include <windows.h>
#include <stdio.h>

#pragma comment(lib, "user32")
#pragma comment(lib, "gdi32")

#define BKG_COLOR RGB(0xFF,0xFF,0) // yellow

// globals
HBRUSH brush;
WNDPROC oldproc;

/*
* new window procedure for the Notepad class
*/
LRESULT CALLBACK
WndProc(HWND hwnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
{
if (uMsg == WM_CTLCOLOREDIT) {
// change background of current line to bypass default white
SetBkColor((HDC)wParam, BKG_COLOR);
// change color of all remaining lines
return (LRESULT)brush;
}

return CallWindowProc(oldproc, hwnd, uMsg, wParam, lParam);
}

/*
* exported function for LOADDLL.EXE
*/
void __declspec(dllexport)
TestFunction(void)
{
HWND wnd;

// search for Notepad class
wnd = FindWindow("notepad", 0);
if (!wnd) {
MessageBox(0, "Notepad not found", 0, 0);
return;
}

brush = CreateSolidBrush(BKG_COLOR);
if (!brush) {
MessageBox(0, "Cannot create new brush", 0, 0);
return;
}
// subclass it
if (!(oldproc = (WNDPROC)SetWindowLong(wnd, GWL_WNDPROC, (LONG)WndProc))) {
MessageBox(0, "Cannot set new wndproc", 0, 0);
return;
}

// force immediate repaint
InvalidateRect(wnd, 0, 1);
}

Inject TESTLIB.DLL inside NOTEPAD with the command
"loaddll /l <pid> testlib.dll(full path) TestFunction"

You can find LOADDLL.EXE with sources at
http://www.codeguru.com/Cpp/W-P/dll/article.php/c105

2. VIRTUALALLOC ODDITIES
I've reverse-engineered NtAllocateVirtualMemory() in ntoskrnl.exe.
What you say
It has to be on a 64K boundary with MEM_RESERVE|MEM_COMMIT option to succeedis not exact.

In order to succeed, VirtualAlloc() with a prefixed address must find the address inside the VadRoot binary tree of the process. This means that a previous VirtualAlloc() with a 0 address must have been done with MEM_RESERVE flags. Unfortunately, every such VirtualAlloc() will occupy 10000h bytes, independently on the Size parameter.
So, the only way I found to obtain two pointers with a difference of 1000h bytes between them is the following: MEM_RESERVE a quantum of memory with VirtualAlloc(0, ...), then MEM_COMMIT two times with VirtualAlloc(not_zero, ...)
The following code will show you what I am saying:

// coded by bilbo - 15jul04

#include <windows.h>
#include <stdio.h>

void
main(void)
{
LPBYTE ptr;

// len 1 or 10000 is the same, but we use 10000 for further commit
ptr = VirtualAlloc(0, 0x10000, MEM_RESERVE, PAGE_READWRITE);

ptr = VirtualAlloc(ptr/*not 0*/, 0x1000, MEM_COMMIT, PAGE_READWRITE);
printf("first ptr = %#x\n", ptr);

ptr = VirtualAlloc(ptr+0x1000, 0x1000, MEM_COMMIT, PAGE_READWRITE);
printf("second ptr = %#x\n", ptr);
}

The fun is just started!
bilbo
Silver
07-15-2004, 11:31 AM
Don't you need to release the brush object (Select null into the GDI object) then call DeleteObject() on the brush as well?

Just doing this off the top of my head, but I'm fairly sure you'll get a GDI object leak if you don't...
homersux
07-15-2004, 12:16 PM
The findings from hooking notepad wndproc was extremely interesting :) Note I don't use the lame CBT global hook. I use remotethread dll->loading additional dlls to avoid relocation problems etc. I find the following results interesting:

1) Don't preserve stack before making calls to actual WINAPI WndProc, the hooked program will work ok
until you move the mouse out of the window region. Apprently inside TranslateMessageEx, it's trying to do something smart about the stack and corrupts the original wndproc subroutine entry (4 bytes)

2) Preserve stack (a couple assembly tricks here) and don't preserve return result from original wndproc,
you can type and move mouse out of window region, everything seems ok. But you cannot minimize, move the window -:)

3) Preserve stack and preserve return result from original WndProc, everything works and behaves normal. This is the only way to go when hooking WndProc.
homersux
07-15-2004, 12:27 PM
Bilbo, thanks for your replies. I will try the answer from your first experiment shortly.

Now onto the VirtualAlloc thing, we all know that once you reserve a huge chunk of memory then
subsequently you can obtain a ptr 0x1000 bytes after the first ptr. I didn't make it clear that in my
test program, one cannot change the amount of memory the first call allocates, i.e. the 0x1000 bytes but not 0x10000 bytes. Here is the result from my studies of the NtAllocateVirtualMemmory,

Internals of VirtualAlloc win32 API

Win32 API VirtualAlloc allocates a multiple page size memory space
from the system. The function takes 4 arguments and returns a pointer
to the allocated memory space:

ptr = VirtualAlloc(address, size, mmFlag, pgFlag)
address: 0 or fixed address (rounded up to 64kb)
size: rounded up to page size
mmFlag: MEM_COMMIT, MEM_RESERVE
pgFlag: PAGE_READ, PAGE_WRITE, PAGE_READWRITE ..

The function calls VirtualAllocEx to do the job, pseudo code for
VirtualAlloc call VirtualAllocEx(-1, address, size, mmFlag, pgFlag

VirtalAllocEx has one more argument, the process handle, -1 means the
calling process itself. VirtualAllocEx calls IVirtualAlloc. pseudo
code for VirtualAllocEx:

setup stack frame
setup SEH
if(address){
ecx = [7c5cf048] // global variable lowMemBoundary = 4MB
if(address < [ecx+13c]) // [ecx+13c] = 0x00010000
goto out_bad_below_4MB
// The 3rd argument is always 0 when called from ring3 application?
eax = IVirtualAllocEx(-1, &address, 0, &size, mmFlag, pgFlag)
label_1
remove SEH
return EAX

IVirtualAlloc:
mov eax, 10 <-- syscall index for ntoskrnl!NtAllocateVirtualMemory
edx = esp+4 <-- the return address: label_1 in VirtualAllocEx
int 2e

NtAllocateVirtualMemory:
setup kernel SEH
if(user land esp > 7fff0000) goto called_from_kernel
copy stack parameters from user land (EDI) to kernel land (ESI)
called_from_kernel:
mov ebx, 80499e48 (win2ksp4)
call ebx
if(eax != 0) eax = 0 <------ Interesting
else eax = AllocatedAddress
remove kernel SEH
SYSEXIT

This subroutine called through ebx is the real labor code that
allocates the memory. This subroutine is definitely written in higher
level language, probably C due to the presense of stack frame and
stupid compiler optimizations such as mov [ebp-20], eax; mov eax,
[ebp-20] sequence. This subroutine takes the same argument list as
IVirtualAlloc.

The pseudo code follows (when MEM_COMMIT and address are set):

setup stack frame
setup SEH
sub esp, 124 ; lots of local variables

local_stack_ebp-18 = esp
if(arg3 >= 15) goto called_from_kernel
local_mmFlag_ebp-128 = mmFlag & 200000
local_mmFlag_ebp-128 = mmFlag & 200000
if (mmFlag | MEM_RESERVE) goto attempt_to_reserve_page

if(addr > 7fff0000) goto out_bad_MMTooHigh
if(addr > eax=(7ffeffff+ffff0000)=7ffdffff) goto out_bad_MMTooHigh
if(eax - addr < 64kb ) goto out_bad_NotEnoughMem
if(size == 0) goto out_bad_invalidSize
if(pHandle = arg0 != -1) goto allocate_in_another_process
setup thread related parameters
call ExAcquireFastMutex
call NtAcquireFastMutexUnsafe
if(addr == 0) goto free_base_address_allocate
fixed_base_address_allocate
verify pgFlag and mmFlag
align size to 4k boundary
push address >> 0c
push (address + size -1) >> 0c
push ptr to memory_block_linkedlist

call sub_8044eb8a <--interesting subroutine that walks through the LL

if(eax == 0) goto out_bad_STATUS_conflicting_address
prepare to allocate memory with the information in eax
free_base_address_allocate:
allocate the memory at address
... // abbrieviated
out_bad:
mov eax, ERROR_CODE ; C0000018 STATUS CONFLICTING_ADDRESS
ret

sub_8044eb8a:(address >> 0c, (address+size-1) >> 0c, MM_block_LL_head)
mov eax, [esp+0c] ; head ptr to the MM_BLOCK_LL
l_1:
test eax, eax
jz out_bad
mov ecx, [esp+4] ; address >> 0c
cmp ecx, [eax+4]
jbe l_2
mov eax, [eax+10]
jmp l_1
l_2:
mov ecx, [esp+8] ; (address + size -1) >> 0c, upper bound
cmp ecx, [eax]
jae out_good
mov eax, [eax+0c]
jmp l_1
out_bad:
xor eax, eax
out_good:
ret 0c ; 3 arguments

the structure of the MM_BLOCK is:
struct MM_BLOCK_LINKEDLIST{
DWORD linear_address >> 0c;
DWORD lower_bound_LA >> 0c;
unknown; 0
DWORD upper_bound_LA >> 0c;
DWORD next_block; <-- always points to a higher address block
}
The head of MM_BLOCK linked list is derived by:
mov eax, FS:[124] ; FS=30, ring0 TIB
mov eax, [eax+44]
mov eax, [eax+194]
mov MM_BLOCK_LL_HEAD, eax

Using the MEM_COMMIT argument and fixed address, the last MM_BLOCK is
21f0, 21f0, 0, 21f0, 0 (hypothetically in my test case), thus
sub_8044eb8a always ends up returning 0 in eax. This subsequently
causing AllocateVirtualMemory to return C0000018 in EAX and eventually
0 in EAX to IVirtualAlloc.

A simple alternation of the mmFlag argument will change the execution
path (MEM_RESERVE|MEM_COMMIT) to

attempt_to_reserve_page:
804AFC03 (IoOpenDeviceRegistryKey+0284)
mov eax, [ebp-8c] ; address
lea edx, [eax+edi-1] ; address+size-1
or di, 0fff ; align size to page boundary
and ax, 0000 ; aligh address to 64k boundary <--- MOST INTERESTING
mov [ebp-20], eax
...
push MM_BLOCK_HEAD
push address+size-1 >> 0c
mov eax, [ebp-20]
shr eax, 0c
push eax ; 02f0 instead of 02f1 due to or ax, 0000
call sub_8044eb8a(02f0, 02f1, MM_BLOCK_HEAD)
if(eax != 0) goto out_bad_STATUS_CONFLICTING_... <-------- AHHHH!!!
else proceed...

Do you see the difference here compared with the MEM_COMMIT case,
here, the kernel bails out when eax!=0 but it bails out when eax=0 in
MEM_COMMIT case. Why is that? Well, again check sub_8044EB8A, when the
code walks through the MM_BLOCK_LL and reaches the end, the jbe and
jae instruction will return 02f0 in eax thus it is never zero. What
does this tell you? When you do MEM_RESERVE|MEM_COMMIT, your address
has to be on a 64k boundary! There is no such restriction for
MEM_COMMIT, however, the kernel would still bail out regardless if
your fixed address is on a 64k boundary or not. Your call to
VirtualAlloc must be MEM_RESERVE|MEM_COMMIT to succeed if you use a
fixed address. If you start out with address 0 though, you can use
MEM_COMMIT alone and it will work. This sound a little complicated,
try to play with sample code and see what the results are.
homersux
07-15-2004, 12:46 PM
Great, the notepad's color finally changed, lol :) Here is my hookdll source:

#include <windows.h>
#include <windowsx.h>
#include <stdlib.h>
#include <stdio.h>
#include "injinfo.h"

//typedef void (*LPFUNC)(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam);
typedef DWORD (*LPFUNC)();

// The worker dll and function that do some real work
#define THREADHELP_DLL "ThreadHelpDll.dll"
#define THREADHELP_FUNC "HookFunc"

// It's unlikely that a process will run 2 threads containing this structure
// But if the situation arises, we'll have to convert this to per thread data.
// Since thread is always executed in the context of the hosting process,
// this data is not shared among processes unless a shared rw segment is specified.
struct t_inj_info * l_info;
LPFUNC orig_func;
DWORD i, stackPtr, ORetAddr, retval;
HDC hdc;
HBRUSH brush;

LRESULT CALLBACK
new_func(HWND hwnd, UINT message, WPARAM wParam, LPARAM lParam){

// removed the stack messing for clarity purpose.
if(message == WM_CTLCOLOREDIT){
hdc = (HDC)wParam;
SetTextColor(hdc, RGB(255,255,0));
SetBkColor(hdc, RGB(255,0,0));
//GetSysColorBrush(COLOR_3DHILIGHT);
}else{

orig_func = (LPFUNC)(l_info->target_func_ptr);

// Do real work here. We have set up a frame for powerful code injection.

for(i = 0; i < 5; i ++)
((LPBYTE)(l_info->target_func_ptr))[i] = l_info->old_op[i];
__asm { cpuid }
//orig_func(hwnd, message, wParam, lParam);
retval=orig_func();
for(i = 0; i < 5; i ++)
((LPBYTE)(l_info->target_func_ptr))[i] = l_info->op[i];
}
return retval
}

BOOL MakeBrush(){

char * wndname = "PopPad1";
HWND hwnd = FindWindow(wndname, 0);
brush = CreateSolidBrush(RGB(255,0,0));
if(hwnd == 0 || brush == 0){
MessageBox(0, "Error during DLL HOOKING", 0, 0);
return FALSE;
}

//SetClassLong(hwnd, GCL_HBRBACKGROUND, (LONG)GetStockObject(BLACK_BRUSH));
InvalidateRect(hwnd, 0, 1);
return TRUE;
}

__declspec(dllexport) BOOL HookFunc(struct t_inj_info * example){

BOOL retval;
BYTE op[5];
DWORD oldpageattr, i, offset, opbytes;
char * mutex_name = "editctl_mutex";
HANDLE worker_mutex;

l_info = example;

//worker_mutex = CreateMutex(NULL, TRUE, mutex_name);
worker_mutex = OpenMutex(SYNCHRONIZE, FALSE, mutex_name);
if(worker_mutex == 0) return FALSE;

retval = VirtualProtect( (LPVOID)(((DWORD)(example->target_func_ptr))&0xFFFF1000),
0x1000, PAGE_EXECUTE_WRITECOPY, (PDWORD)&oldpageattr);
if(retval == FALSE) return FALSE;

offset = ((LPBYTE)(DWORD)new_func - (LPBYTE)(DWORD)(example->target_func_ptr))-5;
op[0] = 0xe9; // far jump
for(i = 0; i < 4; i ++)
op[i+1] = (BYTE)( (offset >> (8*i)) & 0xff );
opbytes = 5;

for(i = 0; i < 5; i ++){
example->old_op[i] = ((LPBYTE)(example->target_func_ptr))[i];
example->op[i] = op[i];
((LPBYTE)(example->target_func_ptr))[i] = op[i];
}
_asm { cpuid }

example->hookapi_addr = (DWORD)new_func;
if(!MakeBrush()) goto out;
//example->hookapi_addr = (DWORD)worker_mutex;
//ReleaseMutex(worker_mutex);
// We'll wait for the main controler to tell us to terminate: InjectThread app in this case
// After sleeping for 60 seconds, the control application is guranteed to have obtained
// the released mutex and reset its state (through the magic multi-tasking, Sleep yields CPU).
// Wait till control application release it.
//Sleep(1000);
WaitForSingleObject(worker_mutex, INFINITE);
CloseHandle(worker_mutex);
out:
// Clean up our track
for(i = 0; i < 5; i ++)
((LPBYTE)(example->target_func_ptr))[i] = example->old_op[i];
return TRUE;
}
bilbo
07-16-2004, 09:10 AM
to Silver
Don't you need to release the brush object (Select null into the GDI object) then call DeleteObject() on the brush as well?
well, Silver, thanks for the warning, you are right under a theoretical point of view.
But, just because curious, I dumped the GDI table during and after Notepad execution. As soon as the Notepad is killed, the handle is invalidated, so there is no need to DeleteObject(). I was surprised too. This happens on Wiondows XP. I don't know about previous M$ systems.
Look!
during subclassed Notepad execution...
0641.E14C8BA0 068C 0 E410 7800A8 10 (BRUSH_TYPE)
0641 is the table slot, E14C8BA0 is the pointer to kernel object, 68C is the process id, E410 is the high part of the handle (the low part is the slot, so the handle you obtain from CreateSolidBrush is E4100641), 7800A8 is the pointer in process memory, 10 is the type

after Notepad is exited
0641. 64F 0000 0 E510 0 0
64F is no more a kernel pointer but a link to the next free slot, E510 maybe a hint for the next handle to be created, 0 the pid, 0 the type.

to homersux
Your answer is interesting but I did not have yet the time to try it; and I work on another platform.
Just a suggestion. Why don't you grab ntoskrnl symbols??? It would be a lot easier for you to analyze M$ kernel "sources"!

Best regards, bilbo
Silver
07-16-2004, 11:01 AM
That's very interesting... I'll remember that. Maybe it's a hangover from the NT4 days that they've fixed in (maybe) 2000 and XP... I sure remember being able to run out of GDI handles/objects in 9x and NT... Thanks for posting that update bilbo!
dELTA
07-16-2004, 12:02 PM
Yeah, GDI/User resource handling in Windows 9x sucks, they are even allocated from a fixed pool, so if your program has a too complex GUI, you can run out of them even without having a leak... :boo: This was fixed too in 2000/XP though.
homersux
07-16-2004, 09:05 PM
Silver, on 2000/XP, any process owned kernel objects will be deleted once
the object is no longer referenced (count == 0). The kernel can refer
back to the owner through a field in kernel object's structure ( normally
the 2nd dword).

So there is no need to release resources explicitly in a user application that
really doesn't use a lot of resource. But if your application is a resource hog,
you want to release resource (including kernel objects) immediately after
its lifetime is over so your application can proceed.
Peres
07-18-2004, 05:00 PM
I have taken a different - more classic - approach. I patched notepad and gave it a new menu item allowing the user to select the background color from the common 'color picker' window. I can upload it together with some sort of document if someone is interested. Please notice that my notepad is localized in italian...

Peres
bilbo
07-19-2004, 06:59 AM
Surely could be interesting...

Please notice that my notepad is localized in italian...

I'm afraid you have also to take into account the platform, not just the localization...

Regards, bilbo
homersux
07-19-2004, 08:00 PM
I definitely would like to read about what you've done, Peres. Good work!
Peres
07-20-2004, 12:47 PM
I didn't know if I could enclose my patched version of notepad for copyright issues... I uploaded it in the end. After all, it is a better product now. You can see this new feature clicking on 'Sfondo...' from menu 'Formato'.

Warnings:

I patched italian notepad for win2000.
Number base (hex or dec) isn't always specified; however it is always easy to recollect from the context.
Offsets are meant to be RVAs, except when explicitly specified.

---------------------------------------------------------------------------
THE TASK
---------------------------------------------------------------------------

I am going to add the following piece of code to notepad's own window procedure; I show C code since detailed asm code would be too long to list here. I think the code is pretty straightforward. It uses the color common dialog from comdlg32 in order to allow the user to pick his/her favourite color, then it updates the gdi brush when asked to.

if ( uMsg == WM_COMMAND && HIWORD(wParam) == IDM_SETBGCOLOR ) {

memset( &CC, 0, sizeof(CC) );
CC.lpStructSize = sizeof(CC);
CC.hwndOwner = hwndNotepad;
CC.lpCustomColors = &CustomColors;
CC.rgbResult = rgbBrush;
CC.Flags = CC_RGBINIT;

if ( !ChooseColorW( &CC ) ) {
rgbBrush = CC.rgbResult; // saves new rgb brush color
bBrushChanged = TRUE; // flags new brush

InvalidateRect( hWnd, NULL, TRUE ); // forces repaint
}

return 0;

} else
if ( uMsg == WM_CTLCOLOREDIT && (HWND)(lParam) == hwndEdit ) {

if ( bBrushChanged == TRUE ) {
if ( hBrush ) DeleteObject( hBrush ); // deletes brush
hBrush = CreateSolidBrush( rgbBrush );// new brush
}

SetBkColor( (HDC) wParam, rgbBrush ) ;// sets text background color (mandatory)
bBrushChanged = FALSE;
return hBrush;
}

The main quirk here is the fact the snippet invokes three api functions which notepad doesn't import, namely ChooseColorW (from comdlg32.dll), CreateSolidBrush and SetBkColor (from gdi32.dll).

The tasks are the following:
1. add new imports to notepad
2. modify its window procedure

---------------------------------------------------------------------------
GATHERING REQUIREMENTS
---------------------------------------------------------------------------

Room required by data structures used in the snippet above:

CHOOSECOLORW CC structure 24h bytes
COLORREF[16] CustomColor array 40h bytes
BOOL b_BrushChanged 4h bytes
COLORREF rgb_Brush 4h bytes
HBRUSH hBrush 4h bytes
---------
total 70h bytes

The snippet needs some functions not currently imported by Notepad:

FUNCTION DLL
CreateSolidBrush gdi32
SetBkColor gdi32
ChooseColorW comdlg32

We can make a rough estimate of the room we need for the new imports:

New functions names and ordinals 32h bytes
New import table entries (2) 50h bytes
IAT table (3 entries) Ch bytes
names arrays pointers (3 entries) Ch bytes
---------
9Ah bytes

Let's say 256 bytes (100h) will be surely enough.

Finally, making a good estimate for the space needed by the code is difficult, but I think 512 bytes (200h) will suffice.

In the end, we will need no more than 880 bytes (370h).

---------------------------------------------------------------------------
FINDING CAVES
---------------------------------------------------------------------------

Notepad.exe section table from PE header is summarized in the table below; the CAVE column highlights the space which is wasted for memory alignment - until now.

RVA ALIGN VIRT CAVE NAME
SIZE SIZE
1000 7000 65CA 0A36 .text
8000 2000 1944 06BC .data
A000 6000 6000 0000 .rsrc

Alignment between text and data section provides us with a lot of free space, about three times our rough estimate above. We can grow the code section and make it reach its maximum size (7000h), just add A00h bytes before offset 6C00h (where data section starts in the image file). We also need to modify the following fields in the section table of the PE header:

* text section virtual size (7000h)
* data and rsrc raw offsets to reflect the change (+A00h)

---------------------------------------------------------------------------
ADDING IMPORTS
---------------------------------------------------------------------------

A quick search for import data makes clear that .text section contains the import section beyond the actual executable code: as it is apparent from the following table, every relevant information about import is kept between RVAs 1000 and 8000.

OFFSET RVA SIZE
Import table 5C50 6650 00B4 (8 entries)
Name pointers arrays 5D04 6704 02FC
Names 6000 6A00 0BC9
Bound import table 0600 1000 02FC

Here is the actual situation of import table entries in Notepad.

NAMES THUNKS DLL
NAME ## RVA RVA RVA
advapi32 7 6704 1000 6C4C
gdi32 23 6724 1020 70BC
kernel32 48 6784 1080 6F56
mscvrt 19 6848 1144 6BBA
shell32 4 6898 1194 6AC6
user32 70 68AC 11A8 755C
winspool 3 69C8 12C4 75BC
comdlg32 9 69D8 12D4 6A8A

Here is the actual layout of import data stuff:

START END
RVA RVA
1000 1300 IAT table
1300 131C Debug data
.
.
.... 6650 Executable code
6650 6704 Import table
6704 6A00 Names pointers array
6A00 75C9 Names

Both IAT table and names pointers array must grow 12 bytes to accomodate the 3 new entries above. As you can see, there is currently no available room to comfortably enlarge them. There is a great number of paths we can tread from now on. I am taking the hardcore approach, for it has been a long time since I last delved into import table intricacies and I would like to recall.

The best way seems to add a couple of extra entries to the import table, for comdlg32 and gdi32 respectively. The import table already contains data for them both, but we are not messing with something that already works well. You can add any number of references to one library since the loader is smart enough, so why bothering.
Since we need 28 bytes (hex) to accomodate two new entries and we have got no room we shall move the import table away, say after the actual names at 75D0. The room left will immediately be handy, in fact we are putting names, names pointers and thunks there. Choosing a layout is a matter of personal taste, and here is mine:

RVA NEW CONTENT
6650 names pointers for extra comdgl32 (666C)
6654 zero
6658-665C names pointers for extra gdi32 (667B)
6660 zero

666C ordinal and name for 'ChooseColorW'
667B ordinal and name for 'SetBkColor'
6688 ordinal and name for 'CreateSolidBrush'

66A4 bound address for comdlg32 function
66A8 zero
66AC bound addresses for gdi32 functions
66B4 zero

We must also grow the import table adding two entries referring to the new content above; the only information missing are the pointers to DLL names, but we can recycle the old ones.
Of course, the PE header must be updated as well. We must change the import table address (to 75D0), its size (to B4+28), and finally the IAT size since we added 3 bound entries (to 2FC+4+4+8+4 accounting for separators)

Here is the situation after the modifications:

NAMES THUNKS DLL
NAME ## RVA RVA RVA
advapi32 7 6704 1000 6C4C
gdi32 23 6724 1020 70BC
kernel32 48 6784 1080 6F56
mscvrt 19 6848 1144 6BBA
shell32 4 6898 1194 6AC6
user32 70 68AC 11A8 755C
winspool 3 69C8 12C4 75BC
comdlg32 9 69D8 12D4 6A8A
comdlg32 1 6650 66A4 6A8A
gdi32 2 6658 66AC 70BC

Notepad has 3 more imports now.

---------------------------------------------------------------------------
ADDING FUNCTIONALITY
---------------------------------------------------------------------------

I lack an effective tool for assembling short snippet of code, because I can't get SnippetCreator by Iczelion to work properly. I wrote the assembly code corresponding to the C routine above using symbolic names for globals and routine, then searched the image file for the real VAs of what I needed:

HWND hwndNotepad: HWND of notepad main window
HWND hwndEdit: HWND of notepad's multiline text box
Both handles can be easily found searching for RegisterClassW, then following the code until both windows are created dinamically and their handles stored.

DeleteObject: address of bound import
InvalidateRect: address of bound import
We can get the VAs for the imports by looking at the IAT in any disassembler.

Actual window procedure address is passed as a parameter to RegisterClassW... it is 100248Fh in my notepad.

Also, I needed to choose some VAs for my data:

CHOOSECOLORW CC 1007800h
COLORREF[16] CustomColors 1007824h
COLORREF rgbBrush 1007864h (initialized to 0FFFFFFh)
BOOL bBrushChanged 1007868h
HBRUSH hBrush 100786Ch

Substituting the VAs in the code is commonly done with regular expressions. The assembled code can be pasted at any offset: I chose 7000h. The snippet forwards control to the original window procedure if necessary using a push/ret combination. Last but not least, the call of RegisterClassW must be changed since notepad's new window procedure now start at VA 1007A00h.

It's a long and perhaps fragmented document... I feel a little sorry for my English.

Peres
homersux
07-20-2004, 03:14 PM
hi, Peres, it's quality stuff. I shall be excercising your approach with my English version of notepad on w2k soon. This has been my original idea on how to do it but at that time I lack the knowledge. My api hijacking method works prety well of course but I'd like to get back onto my original idea (the way you have done it) and try hand craft PE files.

Can you explain a little bit how you added the menu item (resource editing?)
Peres
07-21-2004, 01:43 AM
It's a simple matter - compared to the rest - so I forgot to explain... ResHacker is perfect for things like that. Just open notepad, and take a look at its menu resource tree. It's a very simple resource indeed, in fact it contains a single menu. Now look to the right: the grammar of rc scripts is very simple. I added the following stuff:

MENUITEM SEPARATOR
MENUITEM "S&fondo...", 9000

The ampersand makes the 'f' an accelerator key for the menu item. The only issue might be choosing an appropriate menu item id. Just look at the rest of the script and pick an unused number (less than 65536 since resource id's are 16 bit numbers - I suppose). I chose 9000 (2328h): it's the constant I named IDM_SETBGCOLOR in my C code.

Peres

P.S. have you noticed that my notepad doesn't retain the background color you choose amongst sessions? You could add some registry code for that. (I am a bit tired of messing with masm...).
Will
07-23-2004, 03:47 PM
Wasn't there a reverseme along that theme? There was a basic window with a menu with a few color choices, and you had to add the functionality for the menu items to work.
Peres
07-23-2004, 04:05 PM
I don't know of any reverseme like that. The fact is I'm pretty new... I saw a thread about changing notepad's background color, and since I never tried the ameliorating game I gave it a try.
Will
07-25-2004, 11:39 AM
Well I found it:
hxxp://www.reversemes.de/reversemes.html
(It's called 'Fun With Guis' or something like that.)

It's not exactly how I remembered it though. You have to add the menu yourself, as well as the functionality. It might be worth taking a look at.

cheers,
will
homersux
07-31-2004, 10:12 PM
After a little bit coding, I bring you two tools that I think are useful for this project and projects like this one. RelocateGUI and InjectFile.

The approach I have used is to write c/asm mixed code and use as much option
as the compiler(vs6) gives me to ease the task. You have noticed the in the
source code how I packed all the global variables together in a 'gvars' data
segment and the code is in 'code' segment. These directives allow me to
easily relocate the codepatch machine code. After this dll is compiled, you
can load it into lordPE or any other pe viewer to examine its sections and
IAT etc. Then I use RelocateGUI to relocate all the global variable reference
in codepatch to an arbitrary base (the New Relocation Base textfield), in my
case, I used 0x01007600 (because I will be injecting code to 0x6d00 into
notepad.exe and I want the data to be visible at 0x6c00. Both 0x6c00 and 0x6d00
are raw offsets, and they are translated to 0x01007600 and 0x01007700
as virtual addresses). After the code is relocated, use injectFile to
put this binary image into notepad.exe at raw
offset 0x6d00 (in the Offset field in injectFile). injectFile will overwrite
the data in notepad.exe at said offset, it's a replace operation not insert.
Afterwards, I make a copy of notepad.exe, I load one in lordpe and another one
in hiew for modification. This is the step 5, I need to manually replace
the thunk values referenced in codepatch, RelocateGUI is smart enough only
to replace the global variables but not the iat thunk values. Another neat
thing that would totally automate the process would be to hardcode those iat
values inside the 'gvars' data segment and propotype all the functions and
call through gvars thunk, then it'd be not necessary to manually. This is
left as an exercise to the readers. Note that in the code I popped 4 times before I jump to the original 0x0100248F wndProc, that was from observation
of the compiled codepatch assembly.

code
<pre>
#include <windows.h>
#define IDM_SETBGCOLOR 9300
typedef DWORD (*pfn_WndProc)(HWND, UINT, WPARAM, LPARAM);

//#pragma comment ( linker, "/BASE:0x01000000") // Align to notepad's image base
#pragma data_seg("gvars")
#define GVARS __declspec(allocate("gvars"))
GVARS CHOOSECOLORW CC;
GVARS HWND hwndNotepad = 0;
GVARS HBRUSH hBrush = 0;
GVARS COLORREF rgbBrush = 0, CustomColors[16];
GVARS BOOL bBrushChanged = FALSE, initHwnd = FALSE;
GVARS pfn_WndProc pWndProc = (pfn_WndProc)0x100248F; // Notepad's wndproc address
GVARS BYTE notepadTitle[8] = "Notepad";
#pragma data_seg()

#pragma code_seg("code")
__declspec(dllexport) DWORD CodePatch(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam){

if ( ! initHwnd){
hwndNotepad = FindWindowA(notepadTitle, 0);
if( hwndNotepad != 0)
initHwnd = TRUE;
}

if ( uMsg == WM_COMMAND && LOWORD(wParam) == IDM_SETBGCOLOR ) {

memset( &CC, 0, sizeof(CC) );
CC.lStructSize = sizeof(CC);
CC.hwndOwner = hwndNotepad;
CC.lpCustColors = CustomColors;
CC.rgbResult = rgbBrush;
CC.Flags = CC_RGBINIT;

if ( ChooseColorW( &CC ) ) {
rgbBrush = CC.rgbResult; // saves new rgb brush color
bBrushChanged = TRUE; // flags new brush

InvalidateRect( hWnd, NULL, TRUE ); // forces repaint
}

return 0;

} else if ( uMsg == WM_CTLCOLOREDIT) { // && (HWND)(lParam) == hwndEdit ) {

if ( bBrushChanged == TRUE ) {
if ( hBrush ) DeleteObject( hBrush ); // deletes brush
hBrush = CreateSolidBrush( rgbBrush );// new brush
SetBkColor( (HDC) wParam, rgbBrush ) ;// sets text background color (mandatory)
bBrushChanged = FALSE;
}
return (DWORD)hBrush;
} else
__asm {
pop edi
pop esi
pop ebx
pop ebp
jmp pWndProc
}

return 0;
}
#pragma code_seg()
</pre>

I have uploaded the two tools and the dlls (extrememly useful) in this post. Hope you found them useful for your own projects. :)
Peres
08-01-2004, 03:56 AM
I will give a try to your tools. I believe my handcraft approach is still less convoluted, though.

Peres

P.S.: hey! You still didn't save the background color in the registry... :)


(x ^ y) mod z = w
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > (x ^ y) mod z = w
PDA

View Full Version : (x ^ y) mod z = w

Foreigner
07-09-2004, 05:13 PM
(x ^ y) mod z = w

I have x, y and w; is it possible to find z? Is there a tool that can help me?

Thanks in advance.
naides
07-13-2004, 11:55 AM
(x ^ y) mod z = w

I have x, y and w; is it possible to find z? Is there a tool that can help me?

Thanks in advance.

I am unsure of your symbol convention, but I assume that ^ means "to the power of".
If that is the case, and you know both x and y, you know the value of (x^y) = n (Some integer number).

The Equation is rewritten

n mod z = w, where you know n and w and want to find z.

By the definition of modulus

n \ z = q (q is quotient) where \ is integer division

and

n mod z = w the modulus operation, your equation

then

n = z * q + w

z * q = n - w (1)

Any couple of integers z and q which satisfy the equation (1)

will provide one valid value for z

If you factorize out (n-w), both of which you know, you will find all possible values of z that satisfy your equation (factorization tools are plenty on the net).

There is a range of possible values of z that correctly solve the equation. If you might have more information on z you could narrow down its possible value.

Hope this makes sense
gabri3l
07-13-2004, 04:19 PM
It has been awhile since I used the mod function; but w is the remainder of (x^y) / z
As Naides said; there are many possible answers for z.

hint: if z greater than half of (x^y) then w will equal ((x^y) - z)

However in math it means something a little different. It is usually written as x = (
n ^ p) mod z

Let us replace (n^p) with y
resulting with x = y mod z

Which reads as "x is equivalent to y, modulo z". What this means is that x and y have the same remainder when divided by m.

You may find this page useful as well
hxxp://mathforum.org/library/drmath/view/51619.html#assoc


PE Problems after unpack hasp envelope...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PE Problems after unpack hasp envelope...
PDA

View Full Version : PE Problems after unpack hasp envelope...

friedo
07-13-2004, 08:08 AM
Hello.

I unpacked a hasp envelope (find oep, recover iat) and the program runs fine. The only thing is that the Resource section seems to be now behind the import section. Further more i would like to ged rid of this .protect section...
(btw. resourcehacker tell me resources are damaged while exescope and most pe tools show me right resources.. but i can not change any resources because the size of this section seems to grow up and the program won´t run anymore.) In addition to that it´s an delphi application and dede doesn´t recognize, even if i tried to dump the process i can not but this i think could be solved due to chaning some section flags...

I read several PE Tutorials, tried some pe tools (seems that automatic of these tools won´t work), but i don´t find a solution for this (especially for reorganizing sections and get rid of additional garbage..)

So i would like to delete three sections from header/file and change the position of resource section behind the import section to make it editable by resource tools.

Do somebody have a tip for me where to search (some tuts specially for this) or how to solve this?

Regards,
friedo


Where'd the board go?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Where'd the board go?
PDA

View Full Version : Where'd the board go?

Silver
07-13-2004, 08:32 AM
Problem with the database, 404, dns resolution error, 404... What happened?!
JMI
07-13-2004, 09:52 AM
The Board was down while we completely rebuilt the server to the latest software versions of the server software and upgraded vBulletin from version 3.0.0 gamma through seven version upgrades to version 3.0.3. :yay: That's where we went.

Regards,
dELTA
07-13-2004, 09:53 AM
We've been doing some major upgrades of the server during the last few days, which has caused some problems, but now everything should be back to normal, or actually, better than normal, with new shiny versions of everything. :)
dELTA
07-13-2004, 09:54 AM
Damn, JMI beat me to the explanation with a few seconds. :)
JMI
07-13-2004, 09:56 AM
Always. :yay:

Regards,
mr.x
07-13-2004, 10:01 AM
JMI, what did happend with exetool?
esther
07-13-2004, 10:17 AM
something happen! :eek: but not exetools :devil:
JMI
07-13-2004, 10:26 AM
Yes, exetools was also down for a day, July 10th, if I remember correctly. Don't know what the problem was, Aaron didn't say. He might have been doing server maintenance also. ;)

Regards,
Silver
07-13-2004, 12:18 PM
Well, good job :) I like the new scrolling frame for long tags, too.


Remove assembled code from image
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Remove assembled code from image
PDA

View Full Version : Remove assembled code from image

Silver
07-13-2004, 08:39 AM
Hi guys,

This is either such a stupid question that no-one has asked it, or it's not possible. In sice, how do you remove an in-mem patch you add using the assembler?

The sice manual under the command reference for A says the 3 ways to remove it are to reboot, modify the image or flush the cache. I don't want to reboot every time, and modifying the image is awkward and annoying. I also can't figure how to flush the cache - everything I find talks about flushing the disk cache, not the instruction/patch cache.

Yep, I've googled and searched. Maybe I'm searching the wrong terms. It seems such an easy thing - load an app, trace, make a patch, then remove it to start fresh & try something else.

Feel free to slap me if I'm being stupid :D
evlncrn8
07-13-2004, 11:46 AM
sysinternals, download sync from there, should do the job, alternatively createfilea c:\ or whatever the drive is, then call flushfilebuffers (using the handle you obtain from the createfilea), then a closehandle.. same thing
Silver
07-13-2004, 12:16 PM
I already tried that, and assumed I misunderstood the post. Sync flushes the delayed write buffer to disk, but sice is holding the patch internally.

I found a newsgroup post that suggested the same thing, so I downloaded sync, made a change in sice, ran sync, reloaded the module, and my assembled patch was still in the image. So at least I tried :D

I'm still open to being told I'm an idiot ;)
evlncrn8
07-13-2004, 07:43 PM
before starting, copy the exe to a .bak or whatever, then do ur stuff, then copy the .bak back to the .exe and run sync, with any luck that should work, but softice can be wierd sometimes ;)


IDA and Dede dissassembly differences
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > IDA and Dede dissassembly differences
PDA

View Full Version : IDA and Dede dissassembly differences

5aLIVE
07-13-2004, 09:13 AM
Hiho,
I'm looking at disassembly listings for a particular event in a Delphi form. Dede shows a list of opcodes whereas IDA shows some double words.

I'm a little confused by this, sure I can highlight the double words in IDA and convert them to code which matches that as shown in Dede.
Now, IDA shows that the first double words is accessed by a subroutine, which makes me think it has handled the dissasembly correctly.

Whereas Dede shows instructions like these :
006231AE 86913D10D411 xchg [ecx+$11D4103D], dl
006231B4 867C0090 xchg [eax+eax-$70], bh
006231B8 27 daa
006231B9 4E dec esi
006231BA 319412BA3A68D5 xor [edx+edx+$D5683ABA], edx

In my limited experience of assembler, I'd say these don't make any sense(I've just picked a few of the more weird looking ones).
What do you guys think?

My idea was to add comments in the IDA listing to the RVAs which Dede has identified as events. As it stands it doesn't look like this is fool proof, perhaps I can at least comment a few events to help my improve my chances of understanding what is going on at some level.
Is this approach something you would do for a medium-sized app?

Thanks for any help.
5Alive.
5aLIVE
07-13-2004, 01:17 PM
Hmmm, spent a little more time thinking about this and thought that I should attach to the program using OllyDbg and dissassemble at the adresses of interest. Lo and behold, the dump matches that of Dede.

I expect the two match as they are both dumped at runtime, whereas IDA does it "cold". Problem solved I think.
5Alive.


MFVDasm, Softlockx, and Bitarts PHASE1 (could use some help :-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > MFVDasm, Softlockx, and Bitarts PHASE1 (could use some help :-)
PDA

View Full Version : MFVDasm, Softlockx, and Bitarts PHASE1 (could use some help :-)

homersux
07-13-2004, 11:03 AM
Target: MFVdasm hxxp://redirect.to/MFVDasm Packed by Softlocx
Tools: IDA pro, Softice, dumpbin, regmon, filemon
Difficulty: intermediate

Initial analysis of the target yeilds the following findings:

1. The executable is packed by Softlocx and decompresses an executable
image insNNN.tmp in SYSTEM\TMP directory. The user registration is
handled by this executable which itself is packed by softlocx
protection by examing its source listing (around 244kB). The unpacker
uses unaligned jmp to fool disassembler but IDA was able to correctly
identify these commonly used techniques:

jmp near $+6
0xE9 <--- false MOV EAX, 4_bytes_after
push EBP <--- jmp destination
...

The unpacker allocates 2x3 pages of memory and does the unpacking, then
use rep movsb to 0x482c6 which is the next EIP address:

ebx = ebp+ (ds&4)? 17ac : 176f <-- a clever scheme is used to determine the base load address
<-- of this code entry point page address, i.e. ebp=0x00482000
<-- on w2k, the ds selector always ends up as 011y (gdt, ring3)
<-- so ebx = ebp+176f
call ebx
chunk1 = VirtualAlloc(0, 0x3000, MEM_COMMIT, PAGE_READWRITE)
eax = 1926+ebp
call eax
unpack(chunk1)
chunk2 = VirtualAlloc(0, 0x3000, MEM_COMMIT, PAGE_READWRITE)
size=unpack(chunk2, chunk1)

esi=chunk2
edi=0c6h <-- hardcoded
edi=edi+ebp
ecx=size
004820c4: rep movsb
004820c6: Start of self modifying code, dest of rep movsb from chunk2

An unpacker could be built based on the above analysis.

2. The installation image insNNN.tmp modify registry settings and
create a file called SYSTEM_ROOT\netdet.ini. This file is critical in
softlocx to determine if the protection scheme has been tempered with,
working together with the registry. After I manually edited the file
content, the software displays expired license even though it still
has 6 days left in demo mode (obviously I made bad changes to the
netdet.ini file). So it might be interesting to have a bpx CreateFile
if @@(esp+8)='...\netdet.ini', and examine the code flow afterwards.
filemon and regmon are highly recommended to examine insNNN.tmp IO and
registry activities.

3. The softlocx license manager displays a temporary license number
that changes with the number of days left. I haven't studied how these
two numbers relate to each other.

4. Now onto the key verification part, this part of code uses a few
tricks too. The key encoding data and a couple of pointers, [ebp-1c],
[ebp-2c], [ebp-28] are different in each softice session, even though
they seem to point to user_key, enc_key1, enc_key2. But there are a
few invariants. One invariant is the base pointer register ebp. It
always equals to 0012EAAC. If you examine the heaps insNNN uses,
0012XXXX is an additional process heap insNNN allocated. Another
invariant is in [ebp-3c] = 02f04b60, the 8 digit user registration
code. The encoding code segment can be tracked down by bpm 02f04b60
and is around 00415459 on my computer. There is one global variable
that maybe related to softice presence 2 levels down to the key
encoding subroutine.

Following the encoding subroutine, a seemingly simple key verification
routine takes user_key (4 digit) and enc_key1 and makes a comparison.

compare_keys(user_key, enc_key1, 8)
if(eax != 0) goto out_bad
do_somemore_encoding_comparison, goto out_bad whenver possible
compare_keys(user_key, enc_key2, 8)
do_somemore_encoding_comparison, goto out_bad whenver possible

It seems strange why user_key is only first half of the key but the
compare_keys subroutine actually compares 8 bytes from both
address. What is even more strange is that the enc_key1 and enc_key2
almost always ends up different and contains alphabatics. A little
more on the encoding part, the insNNN keeps a couple encoding magic
number arrays around [ebp-24], and an index shift array around
[ebp-60]. These arrays are used to produce enc_key1, and enc_key2,
both are 4 bytes long. I haven't figured out a way to even produce
numeric only enc_keys.

5. The "thanks for registration" message is kept at 0044D7b8
(invariant?), and is referenced at 0044e4c7 (by s 0 L -1 b8,d7,44,00).
Backtracing to this address may be impossible because the program is
in a constant state of self-modifying.


Dallas iButton problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dallas iButton problems
PDA

View Full Version : Dallas iButton problems

markh51
07-13-2004, 11:20 AM
Hi,

I have a problem with a app which is protected with a Dallas iButton(1991), I have the original software and a few dongles but I want the app to able to run without the use of the dongle. The app uses calls to a external file VSAuthD.vxd so I can't find the the calls to this file inside of the main app using W32DASM like you do with DLL files, the only thing I have noticed is that Kernel32.DeviceIOControl gets called everytime before the external VXD file does, I noticed this by setting a "BPIO -h 378". I have checked the return values on EAX but they vary alot so there is no way to emulate them (I don't think).

Does the main app have to send the password to the dongle to decrypt the stored info ? If so is there anyway of viewing the password as it must be coded in to the app ?

If any one has any advice on these dongles I would appreciate any help I can get. I have downloaded the SDK and other materials relating to the dongle and done searches on this forum and on google, but nothing REALLY helpful.

Cheers in advance.
JMI
07-13-2004, 11:57 AM
markh51:

I don't see why you have created a new thread for what seems to be a continuation of your previous thread on the DallasiButton. I will shortly merge the two threads together and you can continue it in that one.

Regards,
markh51
07-13-2004, 03:04 PM
I created a new thread due to the fact the other thread was full of crap and off topic subjects and was more aimed towards the CRC problem, no one said much about the iButton. This thread is for the iButton so I would appreciate it if you left it here.

Thanks.
markh51
07-20-2004, 01:34 AM
Ok, I think I have found the code which does the checking of the iButton, but I don't know how to "get around" it !

I have been trying to change this bit of code for the last few days, but it has too many jumps and I don't understand some of the code, so can someone take a look at the code I found if I post it to you off board ?

Cheers.


change hwfp
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > change hwfp
PDA

View Full Version : change hwfp

crux_pt
07-13-2004, 03:07 PM
hi ppl. i have searched a lot here and didnt found what i was looking for.

i am trying to change my computers HWFP to make a armadillo serial code to work with it. how can i know how the armadillo's hwfp is calced?

i can have all info needed from another guy who has the real code and his hwfp.

i can get all hardware info needed.

if you guys can help me find what is needed.

i already have his hard drive fingerprint in my HDD. that wasnt enough.

any more ideas?
JMI
07-13-2004, 03:11 PM
A little off the wall maybe, but why not investigate the possibility of fixing the code so it always returns "good boy" on the hwfp, or does it use that information to decrypt part of the code? Just a thought.

Regards,
crux_pt
07-13-2004, 03:18 PM
well mate, i donno about cracking. :(

can u point me some start?

making the program accept any code would be cool too :)

any link
MaRKuS-DJM
08-02-2004, 04:38 AM
JMI, return good boy is impossible for fingerprint. it is used to decrypt part of the code with real key and name. i'm working on the same problem
evaluator
08-02-2004, 08:00 AM
why impossible?

you can dump GOOD HWFP on working machine & then give it for eat on other.


Help with ASM code ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help with ASM code ?
PDA

View Full Version : Help with ASM code ?

markh51
07-13-2004, 03:18 PM
I have a line of ASM which I am trying to work out how it does what it does.

The line reads: MOV EAX, [EBX+000002FC] and every time I step over it, it changes EAX to a single number i.e 00000008, why ?

The EBX register is always at 00EF1E8C when this line is executed. I need to know how it works out the value to put in the EAX register.

Cheers.
naides
07-13-2004, 03:39 PM
EBX is being used as the base of a lookup table, and 000002FC is the positive displacement (it used to be called the Base Pointer in prehistoric times) What is being moved to EAX is at the memory address pointed by EBX + 000002FC, or EF2188, so look at that memory address, and you should find the 00000008 value.
markh51
07-13-2004, 04:08 PM
Thanks for that, how do I "look" at the address of 00EF1E8C ? and how did you come to get that address from the info I gave you ?
shadz
07-13-2004, 05:33 PM
You cant (directly) see the contents of EBX during
disassembly, but you may be able to deduce it by
looking at surrounding code.

eg:
----
table dd 100h
dd 200h
... etc

mov ebx, offset table ;; get table base
mov eax, [ebx+4] ;; get 2nd entry (200h)
----
Alternatively, if you are debugging this code, just look at
the contents of the EBX register before you execute the
line, then compute the full address and use the debugger
to display the contents of that memory.

-Shadz
markh51
07-13-2004, 06:18 PM
Yeah, I am debugging this code using sice, but I'm still a little lost. What I need to know is how to find the bit of code that puts the numbers (8 in this case) in to EBX which is then put into EAX when MOV EAX, [EBX+000002FC] is executed.
naides
07-13-2004, 06:43 PM
and how did you come to get that address from the info I gave you ?

I added, using a hex calculator, the value of EBX, which you said it was 00EF1E8C plus the positive displacement it was added to it, 000002FC, and get 00EF2188.
In softIce you can type, without quotes "? 00EF1E8C + 000002FC "and it will do it,
or, if you do it at the right momment, when EBX holds 00EF1E8C ,
type "? EBX + 000002FC "

Thanks for that, how do I "look" at the address of 00EF1E8C ?

You need to look at the address 00EF2188. You do that by typing in Sice

" dd 00EF2188" assuming you have a data window open. you can see, and change data in a specific memory address.

:yay:
naides
07-13-2004, 06:54 PM
Yeah, I am debugging this code using sice, but I'm still a little lost. What I need to know is how to find the bit of code that puts the numbers (8 in this case) in to EBX which is then put into EAX when MOV EAX, [EBX+000002FC] is executed.

the 8 is in no way contained in EBX, it is POINTED by EBX + 000002FC. That is what the brackets mean. EBX in this case is a pointer, a memory address of another value.
JMI
07-13-2004, 07:04 PM
Hi naides:

I took the small liberty of highlighting your comments in the markh51 quotes so they would stand out more clearly. ;) Hope that's ok and that I marked the correct comments.

Regards
naides
07-13-2004, 08:04 PM
;)
markh51
07-14-2004, 05:28 AM
naides:

OK, I seem to get what you saying... so are the numbers contained at memory address 00EF2188 ? If so, how can I find the part in the code where the numbers are written to the memory address ? I have tried using a BPM at this address, but it just seems to break at different parts of the code.
dELTA
07-14-2004, 05:51 AM
Different parts than what? Than the ones you want? Than the ones you guessed? :) Maybe it is modified from all these different parts of code?

It is also possible that the array is created dynamically, and then the base address may be different each time, and you will end up having put a breakpoint in the heap, where random memory allocation for any code inside the program might have claimed this memory address and used it for other purposes. In that case you need to backtrack the code to see where the buffer is created (follow the value of ebx backwards in the code) and create the data breakpoint first at this point.
naides
07-14-2004, 06:09 AM
naides:

I have tried using a BPM at this address, but it just seems to break at different parts of the code.

Besides what Delta suggested, If you are interested in the piece of code that writes the 00000008 at that memory location, perhaps a conditional BPM?

BPMD 00EF2188 W IF ( @00EF2188 == 00000008)
I am not certain it would work because I don't know if the IF clause is evaluated before or after the write action takes place, but is worth a shot.
doug
07-14-2004, 08:18 AM
most likely after, as it is the usual behavior of a read/write hardware breakpoint (for obvious reasons bpm X is different). SoftICE's handler evaluates your expression once it has control. And it gets control after the write has taken place.

so it looks ok.
--
I'd also recomment a good asm tutorial to markh51.
markh51
07-14-2004, 03:55 PM
Thanks guys for all your suggestions on this, I have now worked it out.

Thanks again


inline patching asprotect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > inline patching asprotect
PDA

View Full Version : inline patching asprotect

Shub-nigurrath
07-13-2004, 05:29 PM
Hi,
it seems like all the tools around such as AIPH, ASLoad and another one which I don't remember aren't working fine on recent asprotected programs. That wouldn't be bad generally speaking because forces to win my lazyness and do it manually, but unfortunately I haven't found around neither updated tuts on inline patching aspacked programs..

Is there any recent pointer (which much probably now I'm thinking to have missed) to tuts for manually doing it?

TIA.
ThunderPwr
07-21-2004, 04:15 PM
Hy Shub, I'm working about DVR-Studio 0.99g, after PE_stud we see that program was packed with ASProtect 1.2x [New Strain].We can't find any unpacker for this and I'm a newbie in this art. We are starting to read manual unpacking and inline patching.

Do you know some recent good tut about this?

After ProcDump analysis I see only three section .rsrc, .data and .adata, other section is unnamed.
Could you plase give me some info about this?

Thanks in advance!!!!!

Byez
ThunderPwr
Shub-nigurrath
07-21-2004, 04:37 PM
hi, there are some very recent tutorials on asprotect 1.2x on our tutorials page -> tutorials.accessroot.com

let's have a look there..and see if they apply for U..
dELTA
07-21-2004, 05:13 PM
ThunderPwr, please see my post in this thread:

http://www.woodmann.net/forum/showthread.php?p=38537
ThunderPwr
07-21-2004, 06:02 PM
I'm going to the post

Thanks again!!!!
ThunderPwr
07-21-2004, 06:16 PM
Thanks for ypur help, i'm going to stdy ....

Byez
ThunderPwr


Will RSA-640 be solved soon?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Will RSA-640 be solved soon?
PDA

View Full Version : Will RSA-640 be solved soon?

Aquatic
07-13-2004, 08:19 PM
They managed to solve the 576, so solving the 640 must be within their reach.

http://www.rsasecurity.com/rsalabs/node.asp?id=2093

I also notice that the prize money has been reduced.
mike
07-18-2004, 11:58 PM
http://web.archive.org/web/20030208012320/www.rsasecurity.com/rsalabs/challenges/factoring/numbers.html

As of August 2003, the prizes are the same. And the whole point of RSA is that it gets exponentially harder, so it's not a sure bet that 640's within reach.


new aspr 1.31 un-dumpable?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > new aspr 1.31 un-dumpable?
PDA

View Full Version : new aspr 1.31 un-dumpable?

0rp
07-14-2004, 06:38 PM
readme content:

1. New EntryPoint Protection
This improved option now uses advanced technique for changing the
part of application and placing it to the envelope's code. Original
code content is changing throw emulation and polymorphic replacement.
Since this version EntryPoint protection uses a Virtual Machine, which
makes the removal or recovering of original code practically impossible.

<---- P-CODE ?

2. Emulate Standard system functions. One more good option against manual
unpacking - ASProtect just removes some common functions from protected
application and executes them in the envelope code.
You can change this oprtion via the Option Tab ("Emulate Standard
system functions" option).

3. New ASProtect polymorphic markers (for EXE files only !)
By using this marks you could protect any code inside your application.
In order to use new marks, you need to insert one mark instance at any
place of the code inside function you would like to protect.

and a simple function

before protecting:

00401F44 $ 68 981F4000 push test.00401F98
00401F49 . 64:A1 0000000>mov eax, dword ptr fs:[0]
00401F4F . 50 push eax
00401F50 . 8B4424 10 mov eax, dword ptr ss:[esp+10]
00401F54 . 896C24 10 mov dword ptr ss:[esp+10], ebp
00401F58 . 8D6C24 10 lea ebp, dword ptr ss:[esp+10]
00401F5C . 2BE0 sub esp, eax
00401F5E . 53 push ebx
00401F5F . 56 push esi
00401F60 . 57 push edi
00401F61 . 8B45 F8 mov eax, dword ptr ss:[ebp-8]
00401F64 . 8965 E8 mov dword ptr ss:[ebp-18], esp
00401F67 . 50 push eax
00401F68 . 8B45 FC mov eax, dword ptr ss:[ebp-4]
00401F6B . C745 FC FFFFF>mov dword ptr ss:[ebp-4], -1
00401F72 . 8945 F8 mov dword ptr ss:[ebp-8], eax
00401F75 . 8D45 F0 lea eax, dword ptr ss:[ebp-10]
00401F78 . 64:A3 0000000>mov dword ptr fs:[0], eax
00401F7E . C3 retn

and after protection:

00401F44 $- E9 A13D4F00 jmp 008F5CEA
CRAP
00401F7E 4D db 4D

jumptarget:

008F5CEA 68 64BC735E push 5E73BC64
008F5CEF 66:9C pushfw
008F5CF1 57 push edi
008F5CF2 8D7C4B 78 lea edi, dword ptr ds:[ebx+ecx*2+78]
008F5CF6 8D7C37 88 lea edi, dword ptr ds:[edi+esi-78]
008F5CFA 2BFE sub edi, esi
008F5CFC EB 01 jmp short 008F5CFF
008F5CFE F3: prefix rep: ; Superfluous prefix
008F5CFF 8D7C51 2B lea edi, dword ptr ds:[ecx+edx*2+2B]
008F5D03 8D7C0F D5 lea edi, dword ptr ds:[edi+ecx-2B]
008F5D07 2BF9 sub edi, ecx
008F5D09 F3: prefix rep: ; Superfluous prefix
008F5D0A EB 02 jmp short 008F5D0E
008F5D0C CD 20 int 20
008F5D0E 13FE adc edi, esi
008F5D10 8D7C0C 3B lea edi, dword ptr ss:[esp+ecx+3B]
008F5D14 2BF9 sub edi, ecx
008F5D16 8D7C37 C5 lea edi, dword ptr ds:[edi+esi-3B]
008F5D1A 2BFE sub edi, esi
008F5D1C 8D7F 06 lea edi, dword ptr ds:[edi+6]
008F5D1F 68 BED4ACD1 push D1ACD4BE

is this still dumpable?
JMI
07-14-2004, 07:33 PM
Perhaps if you followed the instructions in the FAQ, found in the BIG RED LETTERS you might already have the answer to your own question. Searching with "astrotect 1.31" (without the quote marks) would find you a thread on this forum with a link to a thread on the exetools forum, where something using this version of ASPR, and its unpacking is discussed.

That's why we have a Search button and why one should follow the rules to use it BEFORE asking a question.

Regards,
Solomon
07-14-2004, 09:18 PM
Is there anything new? So-called "Virtual Machine" were used by some commercial protectors before.
hobgoblin
07-15-2004, 04:15 AM
I agree on what JMI says about searching. But the question raised is interesting. I'm familiar with the solution outlined by britedream, and the thread about this on exetools. But the question is: have anyone (else) managed to sucessfully unpack this version? I haven't seen anybody posting a solution to this yet....

regards,
hobgoblin
crUsAdEr
07-15-2004, 08:18 AM
lol... well aspr nanomite is still in its infantile stage... not as convoluted as arma yet... an unpacker is slightly trickier to code since the poly engine used is pretty decent so i guess that is why sydx hasnt rls an unpacker yet!
Shoob
07-15-2004, 03:51 PM
You mean ASProtect v.1.31 build 06.14 ? thats was no problem for me ... let me know if a newer version is avaiable.
JMI
07-15-2004, 04:45 PM
There are a few places where they claim to have a copy of Asprotect v2.0 Build 06.23 Alpha. :devil: :D And I have seen discussion of that version listed in Russian and Vietnamese. Searching is usually how such things are found. :idea: :yay:

Regards,
dELTA
07-15-2004, 05:00 PM
You mean ASProtect v.1.31 build 06.14 ? thats was no problem for me ... let me know if a newer version is avaiable.
The virtual machine feature is only optional, so your target might not have had it activated, even though it used that Asprotect version. Actually, the VM feature in this new Asprotect version is quite buggy, so it is even likely that it wasn't activated in that target. :)

And yes, I can confirm the existence of Asprotect 2.0 alpha.
0rp
07-15-2004, 05:23 PM
try to dump this

notepad, aspr 1.31.5.18
hobgoblin
07-16-2004, 04:07 AM
Hi JMI,
Maybe I'm misunderstanding you when you wrote:"There are a few places where they claim to have a copy of Asprotect v2.0 Build 06.23 Alpha".
If you mean that they have successfully unpacked v2.0, that's quite possible. It's packed with Aspack, and is easily unpacked in 3 minutes.
I'm wondering why nobody seems to have posted a solution to how to unpack a program protected with v1.31 (or v2.0)( as for instance the latest version of WhereIsIt). And of course another way of doing it than britedream described for us. If there is another way.

regards,
hobgoblin
JMI
07-16-2004, 07:26 AM
The reference to "where" is a place you visit that claims to have a copy of that version for download. One place which claims to have a tut on version 2 is cracklatinos. :devil:

Regards,
hobgoblin
07-16-2004, 08:36 AM
Hi JMI,
Yeah, I figured that out. I actually downloaded v2.0 from there a while ago. I was merely talking about a tut on how to unpack v2.0 protected programs.

regards,
hobgoblin
JMI
07-16-2004, 12:36 PM
There is, indeed, one on the cracklatinos site. :devil: hint = 249. :devil:

Regards,
hobgoblin
07-16-2004, 01:02 PM
Hi again,
Thanks for the info, JMI, appreciate it. :)
But I can't find it. I have traced through all the pages at the site, but can't find anything related to 249.
Are you refering to another site than "crackslatinos.hispadominio.net" ?

regards,
JMI
07-16-2004, 01:12 PM
Yes I am referring to that site. :devil: Maybe you should recall that Ricardo's tuts were numbered when he was discussing ARMA and, then, perhaps look in the "/miembros/teorias" section for the number I suggested. :idea: :yay: I could just post the full path, but that would be cheating, wouldnt it???? :sneaky:

Regards,
hobgoblin
07-16-2004, 01:34 PM
Hi JMI,
Due to some sudden blindness I didn't see it the first time. :rolleyes:
When I revisited the site I found it without problems. Thank you for helping out, JMI. Appreciate your helpfulnes.

hobgoblin
JMI
07-16-2004, 01:43 PM
I'm sorry, could you please post that in braille. MY eyesight is also failing. :p
It is easier to spot when one knows what one is looking for. :yay:

Happy reading. I used the SYSTRAN plug-in translator, which did not do as good a job as it usually does on Russian on this one. Don't know why, but alot of it remained more "cryptic" than the usual machine translation. :confused: Guess I need to do further 'training" of the dictionary.

Regards,


File checksum value problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > File checksum value problems
PDA

View Full Version : File checksum value problems

markh51
07-15-2004, 05:21 AM
I have a app which checks it's files aren't damaged/modified by using a list of all the installed files along with the CRC32 value of each file. The problem is, the CRC32 values don't appear to be CRC32 values at all as I have downloaded a utility which checks 22 types of checksum on a file and NONE of them have the same value as in the text file even though the files have NOT been modified. Is they anyway I can find out how they have calculated the value of each file ?
JMI
07-15-2004, 09:13 AM
Do you do ANY of your own basic research before you ask such basic questions? This is what searching the internet is all about and you continue to ask the most basic of questions every time you find something new and clearly have done absolutely nothing to try to solve the problem yourself. Yes, I know you said you downloaded someone else's utility, which didn't work, but what basic research have you actually done on "how crcs are caculated"?

This is similar to your previous question in the "Help with ASM code " thread on the meaning of a simple piece of assembly language code, that almost ANY reference on assembly language would have answered for you, followed by the actual reading of the SICE manual. This is not supposed to be a kindergarden where you come everytime you have the most basic of questions about how code works. YOU are supposed to do the BASIC research YOURSELF. This principle is clearly stated in the FAQ. It is time that you FOLLOW it BEFORE you post such questions. Even using the search button here with "CRC check" there are 116 threads discussing the issue.

All of these questions seem to relate to your interest in one program using the Dallas iButton and you continue to make thread after thread which simply confirm you have almost NO background in reverse code engineering. This in itself is no problem. The fact that you fail to study and research BEFORE you ask such foundational questions is a problem.

And you MUST stop posting such threads in the "Advanced" Forum. They clearly are "Newbie" questions.

Regards,
Woodmann
07-15-2004, 07:17 PM
And you MUST stop posting such threads in the "Advanced" Forum. They clearly are "Newbie" questions.

Someone who has been around long enough to have 35 posts should know better.
Dont post your lame questions in the advanced forum and dont be so lame as to ask your "pre" newbie questions in the newbie forum.

Harsh ??? perhaps but, you have been here long enough to know.

Mods--remove this post if you feel it is unfit, I do not mind at all ;)

-CBO-
JMI
07-15-2004, 07:34 PM
Well we have to realize that nearly all of markh51's posts came in two threads, which he, himself started, but that is no excuse for asking questions about general subjects that should ALWAYS be search FIRST. :idea:

Regards,
esther
07-15-2004, 08:25 PM
>Harsh ??? perhaps but, you have been here long enough to know.

This is just a minor reminder if everyone do their part on searching the forum
first before posting anything here,you will not see JMI's nag :p .I suppose you have never seen harsh remarks in the forum before LOL


Cryptanalysis questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Cryptanalysis questions
PDA

View Full Version : Cryptanalysis questions

akimp3
07-16-2004, 03:32 AM
Hi

I have a file that is encrypted with an algorithm and a key that i don't
know. This file is used with a software and hardware to program a flash memory.
I have also a dump of the flash memory after programming with the device
so the file is un-encrypted.
The question is :I have the encrypted and decrypted form of a file
how can i found the algo and the key than is used?
one of my friends has told me that maybe the key is in the encrypted file
this sounds true because the decrypted file is some byte shorter than
the crypted one.
I have attached the too file to this thread,If someone could show me the path(specially Mike). the encrypted file is the one with CAS in its name.

Thanks in advance

akimp3
mike
07-16-2004, 06:34 PM
I haven't looked at the files yet (I've been out of town for three weeks) but unless it's a completely braindead algorithm, you'll be out of luck.
akimp3
07-17-2004, 01:45 AM
@Mike

Hi ,Thanks for your reply.
Someone told me if i get the correlation of the encrypted file
there is a table that tell the correlation of encryption algorithm
and with this i could find the algo that is used.
Do you know anything about this method?
do you think it will be helpfull if i gather more file pairs?

Thanks in advance

akimp3
naides
07-17-2004, 06:42 AM
Excuse me for evesdroping, but trying to deduce the algorithm, specially if you don't have the key, by comparing cyphertext and plain text can be an uphill battle. Wouldn't you have better luck reversing the decoding routine if it is present somewhere in your software?
akimp3
07-17-2004, 11:49 AM
@naides

Hi,

Thank for your help. I don't know if the encryption is done by the software
or on the hardware interface.If it was me i would certainly do encryption
on hardware to keep baby cracker away.I don't have The CAS studio software
I will download it and take a look at it maybe it will be on the software.
there was a tool called crypro kanal or something like that, that find crypto
algo in an exe I will try your suggestion.

Thanks
mike
07-19-2004, 12:05 AM
@Mike

Hi ,Thanks for your reply.
Someone told me if i get the correlation of the encrypted file
there is a table that tell the correlation of encryption algorithm
and with this i could find the algo that is used.
Do you know anything about this method?
do you think it will be helpfull if i gather more file pairs?

Thanks in advance

akimp3
The only way you can do that is if you know what the key is. With some algorithms you can distinguish them from random with lots of plaintext/ciphertext pairs and no key, but even for something with a small keyspace like DES, you need around 2^47 ~= 300 trillion pairs.
mike
07-19-2004, 12:11 AM
I just looked at the files. There is no way the encryption is anything decent, and you have a pretty good chance of breaking it. Pop open the encrypted dump in a hex editor, set the width to 16 bytes, and look at columns. You get way too many of the same nybbles repeated. Looks to me like a weak stream cipher with a period of 16 or 32. XOR the files together and I bet you'll get an even more blatant pattern.


Babel's Library Reversing machine (Search "Jorge Luis Borges")
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Babel's Library Reversing machine (Search "Jorge Luis Borges")
PDA

View Full Version : Babel's Library Reversing machine (Search "Jorge Luis Borges")

naides
07-16-2004, 09:29 AM
This post is supposed to be in a pure philosophical plane. I will not touch feasibility of what I am discussing here, but more than once computer algorithms have pulverized the barrier of impossible into simple.

Now, A PROGRAM, no matter how complex it might be, is only a linear array of bytes. Yes, it has internal structure, information is encoded in those bytes that is more than the bytes themselves, etc, but plainly,

It is a linear array of bytes, with a beginning and an end, a finite, ordered collection of bytes.

Protection is encoded in those bytes, and reversing involves changing some of those bytes. Typically, a few of them, five, ten when the reversing involves a jump inversion or something simple, a few hundred if code injection is necessary, but plainly

Reversing is changing a subset of bytes.

THE PROBLEM is to know which bytes to change and change them into what values.

The method we all use is a more or less structured attack, knowing the internal rules that govern the byte patterns of the program (also known as code), at least partially understanding the program or the protection overall structure, so we find some guidance towards which bytes to change and to what. This is also known as Heuristic approach, and it is used not only in reversing, but in a multitude of computer and no-computer knowledge activities.

But there are other approaches, to the problem:

Brute force attack: We systematically replace byte after byte until we obtain the desired result (Program runs without protection).

A structured attack: in which we introduce certain rules of thumb on which bytes to try and change, limiting the number of combinations of the attack. For example only changing bytes in areas that contain code, or knowing that most cracks involve changing an instruction, only change bytes are part of a valid instruction into another valid instruction. Or Knowing that a fair number of protection are based on decisions, concentrate the attack on decision instructions.

A self learning system, which can evaluate the results of a given byte or bytes change not as good-bad, black-white but can grade it towards certain goals and concentrate on changes and areas that produce the best positive results.

Of course this sort of combinatory attack is best performed by a computer program, with enough speed and power to perform the repetitive, brutal operations that I am proposing.

If you think about, such a machine could, give enough time reverse all protections, but it would also have the most fascinating side effect: It will modify in untoward ways, the behavior of the program it is reversing. Most of its creatures will be non-functional or dysfunctional programs, which would do silly stuff, or run into endless loops, but some of them will be indeed interesting, Perhaps write all the variations of the story of your life, or paint your picture in the screen at all possible ages, and with all possible changes or, in summary do every thing a computer program can do, including rewrite itself in a slightly modified way, or become the program that created it. . .

Doesn’t it give you the shudders???
dELTA
07-16-2004, 12:26 PM
Since you are only patching the existing bytes ot the target, hence being restricted by the orginal size, the program would actually not be able to "do every thing a computer program can do".

Also, there are also of course massive problems connected to the "testing if it was a successful patch", being amongst others:

1.
If you don't limit the memory space/stack space allowed to be used by the tested app you would be subject to the well known so called "Stopping problem" (look it up), which would prevent the theorectical existence of such a tester program altogether.

2.
It would be impossible to make sure that the tester program itself did not affect the behavior of the program (i.e. trace/simulation detection and such), at least without special hardware.

3.
It would be practically impossible to make the program see the effects of a certain isolated patch as good/bad, since effects may be delayed infinitely.

4.
The time complexity would of course be incredible, at least:

((size of program)!) ^ ((size of allowed working memory for program)!)

(note that the exclamation marks are mathematical operators)

Finally, I know some of these things are more towards addressing the feasibility issue, which you said you wouldn't consider, but I just felt like listing them anyway, and the first one is a theoretical showstopper, no matter if you have infinite computer power, special hardware and whatever.

Then there is of course also the issue that in some cases it might even be easier to generate a program with identical functionality from scratch instead, using the same type of bruteforce method. ;)
naides
07-17-2004, 12:54 PM
Thank you for your answer Delta. I realize this is not a "miniproject" or anything of that nature, is simply a thought experiment. It is a subject close to my real life work, because the way information flows and changes in computers is only a variation of the way information flows and reproduces itself in biological systems

Since you are only patching the existing bytes ot the target, hence being restricted by the orginal size, the program would actually not be able to "do every thing a computer program can do".

Well, with the current structure of computer systems, a program may not be self contained, self sufficient, limited by the size of the code. It can recruit dlls, run other programs, it can make replicas of itself and use those as a source of mutation/evolution of new functionalities. Not even the physical limit of memory/mass storage is absolute, because computers can and are interconnected, so a self propagating, interconnected program can recruit further resources.

Also, there are also of course massive problems connected to the "testing if it was a successful patch", being amongst others:

1.
If you don't limit the memory space/stack space allowed to be used by the tested app you would be subject to the well known so called "Stopping problem" (look it up), which would prevent the theorectical existence of such a tester program altogether.

I am familiar with Turing's Stopping problem theorem, but I do not completely grasp what the relevance is in here. In fact The system programmer-computer-code does exactly that. Modify code following certain rules, run a test, check results, compare with goals. If goals reached, terminate, if not, loop. If the programmer is a human or another computer or program I do not see the fundamental difference.
The stopping problem deals with the limit case scenario, but I would put forward the example of biological life, which for eons has been doing with DNA bases, genes adn gene products what we are here discussing a program would do with bytes.

2.
It would be impossible to make sure that the tester program itself did not affect the behavior of the program (i.e. trace/simulation detection and such), at least without special hardware.

So be it, we would need special hardware, or what if the "debugged" program is running on a virtual machine kind of environment, in which the "programmer" code has access to the program code and output, but the debugged program has no access to the programmer's code?

If the programmer and the debugged modify each other, would not they evolve together?
3.
It would be practically impossible to make the program see the effects of a certain isolated patch as good/bad, since effects may be delayed infinitely.

Yes, some effects may be delayed, some may be immediate and measurable.
A human programmer is in no better situation, that is why there is no bug-free program apart from "Hello Word!"

4.
The time complexity would of course be incredible, at least:

((size of program)!) ^ ((size of allowed working memory for program)!)

(note that the exclamation marks are mathematical operators)

You are calculating the numbers necessary to exhaustive run through all the variations. The interesting part happens in THE PROCESS of running those variations

Finally, I know some of these things are more towards addressing the feasibility issue, which you said you wouldn't consider, but I just felt like listing them anyway, and the first one is a theoretical showstopper, no matter if you have infinite computer power, special hardware and whatever.

Then there is of course also the issue that in some cases it might even be easier to generate a program with identical functionality from scratch instead, using the same type of bruteforce method. ;)

Sure, I used the cracking example as an introduction, but modifying an already existing program rather that starting from scratch saves very many iterations/modifications becuse the most fundamental structures/functions are already in place

This is not to be taken too seriously, I think it is just an intersting topic. ;)
dELTA
07-18-2004, 06:57 AM
Well, with the current structure of computer systems, a program may not be self contained, self sufficient, limited by the size of the code. It can recruit dlls, run other programs, it can make replicas of itself and use those as a source of mutation/evolution of new functionalities. Not even the physical limit of memory/mass storage is absolute, because computers can and are interconnected, so a self propagating, interconnected program can recruit further resources.
Yes, but even the possibilities of all functionality that can be recruited by a limited-size program is still constrained by the size of it, combined with the total sum of functionality of all programs currently existing in the universe, which is not _necessarily_ infinite. At least not if you are not at the same time allowed to manipulate the state of the surrounding universe, which was not mentioned in the premises, and which would also be equal to "expanding the array of original bytes", which would in turn contradict the problem definition.

I am familiar with Turing's Stopping problem theorem, but I do not completely grasp what the relevance is in here. In fact The system programmer-computer-code does exactly that. Modify code following certain rules, run a test, check results, compare with goals. If goals reached, terminate, if not, loop. If the programmer is a human or another computer or program I do not see the fundamental difference.
The stopping problem deals with the limit case scenario, but I would put forward the example of biological life, which for eons has been doing with DNA bases, genes adn gene products what we are here discussing a program would do with bytes.
The relevance of the stopping problem is that there is a bunch of simulations that will never stop, and hence your test program will never finish either. If your simulator program is not "infinitely multi-threaded" there are a lot of working/stoppable mutations that will never be reached at all, and the simulator will never stop.

Your argument against this, with the "system programmer-computer-code" is hence an argument against the stopping problem itself, and I refer to the proof of the stopping problem (which can indeed be a quite hard to grasp, I agree). An initial hint though: The tested program will in some cases never reach any of the rule triggers that your tester program has defined, no matter how big the (finite) number of such triggers/situations is.

Also, some important differences from the biological life example you mention:

1.
The "test" of each new mutation for a DNA program is "spawned in a separate thread", in a system with seemingly unlimited resources for the number of threads (i.e. "infinitely multi-threaded", as mentioned above). Hence, the stopping problem would not affect the simulation of all possible (stoppable) DNA programs. (also, no DNA program is seemingly able to go into an infinate loop anyway, due to the external premises set up for DNA programs, but the premises for e.g. x86 programs do not prevent this).

2.
The central test program of DNA programs, which we call "the universe" has indeed neither stopped nor finished it's exhaustive test of all mutations yet, and hence, it may very well be subject to the stopping problem too.

Finally, I do indeed agree about not taking this too seriously, as you say, it's just an interesting thought experiment. :)


product key/ time trial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > product key/ time trial
PDA

View Full Version : product key/ time trial

ksbrace
07-16-2004, 02:26 PM
Hello,
I am relatively new to Rev. Eng. I have done several tutorials which always make it look short and simple. It probably will get the way for me, but I'm stuck on a little personal project. Anyway, I downloaded a target with a 30 day timetrial. Then I changed my clock to go beyond the 30 days and I get the message:
Your trial period has expired , I loaded up W32DASM and found the area:

* Referenced by a CALL at Address:
|:0042A0C1
|
:004295C9 B86C0D4600 mov eax, 00460D6C
:004295CE E8DD9D0100 call 004433B0
:004295D3 51 push ecx
:004295D4 51 push ecx
:004295D5 53 push ebx
:004295D6 56 push esi
:004295D7 8BF1 mov esi, ecx
:004295D9 33DB xor ebx, ebx
:004295DB 57 push edi
:004295DC 895E50 mov dword ptr [esi+50], ebx
:004295DF A160D04700 mov eax, dword ptr [0047D060]
:004295E4 8945F0 mov dword ptr [ebp-10], eax
:004295E7 395E60 cmp dword ptr [esi+60], ebx
:004295EA 895DFC mov dword ptr [ebp-04], ebx
:004295ED 7E30 jle 0042961F
:004295EF 8945EC mov dword ptr [ebp-14], eax

* Possible Reference to String Resource ID=00189: "Your trial period expires in %d days."
|
:004295F2 68BD000000 push 000000BD
:004295F7 8D4DEC lea ecx, dword ptr [ebp-14]
:004295FA C645FC01 mov [ebp-04], 01
:004295FE E86284FDFF call 00401A65
:00429603 FF7660 push [esi+60]
:00429606 8D45F0 lea eax, dword ptr [ebp-10]
:00429609 FF75EC push [ebp-14]
:0042960C 50 push eax
:0042960D E88E67FEFF call 0040FDA0
:00429612 83C40C add esp, 0000000C
:00429615 8D4DEC lea ecx, dword ptr [ebp-14]
:00429618 E8C882FDFF call 004018E5
:0042961D EB0D jmp 0042962C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004295ED(C)
|

* Possible Reference to String Resource ID=00190: "Your trial period has expired."
|
:0042961F 68BE000000 push 000000BE
:00429624 8D4DF0 lea ecx, dword ptr [ebp-10]
:00429627 E83984FDFF call 00401A65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042961D(U)
|
:0042962C FF75F0 push [ebp-10]

* Possible Reference to Dialog: DialogID_007B, CONTROL_ID:016C, "Your trial period expires in %d days."

I also found this area that looks of interest:

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EA54(C)
|
:0040EAD3 51 push ecx
:0040EAD4 8D8F04010000 lea ecx, dword ptr [edi+00000104]
:0040EADA 8BC4 mov eax, esp
:0040EADC 8965E0 mov dword ptr [ebp-20], esp

* Possible StringData Ref from Data Obj ->"}"
|
:0040EADF 6860EB4700 push 0047EB60
:0040EAE4 8918 mov dword ptr [eax], ebx
:0040EAE6 E88F330000 call 00411E7A
:0040EAEB 33C9 xor ecx, ecx
:0040EAED 3BC3 cmp eax, ebx
:0040EAEF 0F9CC1 setl cl
:0040EAF2 3BCB cmp ecx, ebx
:0040EAF4 894DEC mov dword ptr [ebp-14], ecx
:0040EAF7 7413 je 0040EB0C
:0040EAF9 395DDC cmp dword ptr [ebp-24], ebx
:0040EAFC 7C0E jl 0040EB0C
:0040EAFE 6AFF push FFFFFFFF
:0040EB00 6A30 push 00000030

* Possible Reference to String Resource ID=00229: "The licence code you provided is not valid for this product."

I made a couple of changes using HIEW, but I can't get it to work. Any help would be greatly appreciated! Thanks in advance!
JMI
07-16-2004, 02:36 PM
ksbrace:

I've sent you a follow-up PM about this post and how you might make it comply with our Rules and your second attempt is much better, with the additional point that you can state that you downloaded a target with a 30 day timetrial, without naming the target, which is prohibited by our Rules when code is posted. I edited your post to include this information from your original post, to make it more clear.

I make this Reply simply to bring this point to other new posters and to mention that your "Code" sections have been identified as "PHP Code" which they obviously aren't. You used the "tag" [php] instead of [code] which would correctly label them for you. I also fixed that for you. :yay:

Regards,
naides
07-16-2004, 02:54 PM
Hello,

* Referenced by a CALL at Address:
|:0042A0C1
|
:004295C9 B86C0D4600 mov eax, 00460D6C
:004295CE E8DD9D0100 call 004433B0
:004295D3 51 push ecx
:004295D4 51 push ecx
:004295D5 53 push ebx
:004295D6 56 push esi
:004295D7 8BF1 mov esi, ecx
:004295D9 33DB xor ebx, ebx
:004295DB 57 push edi
:004295DC 895E50 mov dword ptr [esi+50], ebx <-
:004295DF A160D04700 mov eax, dword ptr [0047D060]
:004295E4 8945F0 mov dword ptr [ebp-10], eax
:004295E7 395E60 cmp dword ptr [esi+60], ebx
:004295EA 895DFC mov dword ptr [ebp-04], ebx
:004295ED 7E30 jle 0042961F <-- Here, this jump seems to send you to "expired"
:004295EF 8945EC mov dword ptr [ebp-14], eax This Code should run instead

* Possible Reference to String Resource ID=00189: "Your trial period expires in %d days."
|
:004295F2 68BD000000 push 000000BD
:004295F7 8D4DEC lea ecx, dword ptr [ebp-14]
:004295FA C645FC01 mov [ebp-04], 01
:004295FE E86284FDFF call 00401A65
:00429603 FF7660 push [esi+60]
:00429606 8D45F0 lea eax, dword ptr [ebp-10]
:00429609 FF75EC push [ebp-14]
:0042960C 50 push eax
:0042960D E88E67FEFF call 0040FDA0
:00429612 83C40C add esp, 0000000C
:00429615 8D4DEC lea ecx, dword ptr [ebp-14]
:00429618 E8C882FDFF call 004018E5
:0042961D EB0D jmp 0042962C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004295ED(C)
|

* Possible Reference to String Resource ID=00190: "Your trial period has expired."
|
:0042961F 68BE000000 push 000000BE
:00429624 8D4DF0 lea ecx, dword ptr [ebp-10]
:00429627 E83984FDFF call 00401A65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042961D(U)
|
:0042962C FF75F0 push [ebp-10]

* Possible Reference to Dialog: DialogID_007B, CONTROL_ID:016C, "Your trial period expires in %d days."

I also found this area that looks of interest:

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040EA54(C)
|
:0040EAD3 51 push ecx
:0040EAD4 8D8F04010000 lea ecx, dword ptr [edi+00000104]
:0040EADA 8BC4 mov eax, esp
:0040EADC 8965E0 mov dword ptr [ebp-20], esp

* Possible StringData Ref from Data Obj ->"}"
|
:0040EADF 6860EB4700 push 0047EB60
:0040EAE4 8918 mov dword ptr [eax], ebx
:0040EAE6 E88F330000 call 00411E7A
:0040EAEB 33C9 xor ecx, ecx
:0040EAED 3BC3 cmp eax, ebx
:0040EAEF 0F9CC1 setl cl
:0040EAF2 3BCB cmp ecx, ebx
:0040EAF4 894DEC mov dword ptr [ebp-14], ecx
:0040EAF7 7413 je 0040EB0C
:0040EAF9 395DDC cmp dword ptr [ebp-24], ebx
:0040EAFC 7C0E jl 0040EB0C
:0040EAFE 6AFF push FFFFFFFF
:0040EB00 6A30 push 00000030

* Possible Reference to String Resource ID=00229: "The licence code you provided is not valid for this product."

Be aware, that unless the protection is very primitive, reversing this code may only change the message (Don't shoot the messanger), bu not the decision of expired or not. That decision may have been taken before this piece of code runs.

Suggestions: Learn to trace this program live, using either SoftIce or better, OllyDebug.
Put a breakpoint in the code you/I pointed above.
While tracing make the code not take the jump (by manually changing the instruction or the status of the flag that controls the jle, and see what happens.

If not, find out who call this code, by either looking at the dead list or if live looking at the call stack, and how it decides if the expired versus you have %d days decision is taken.

See, we are nice!!!
ksbrace
07-16-2004, 05:43 PM
Thanks for the reply. I noped the following line:

:004295ED 7E30 jle 0042961F

to look like:

:004295ED 9090 jle 0042961F

This didn't work.
I guess my next thought was to make the jle into jg and see what happens. If it's less than or equal it jumps to expired. If it's greater, it shouldn't jump to expired, right or am I way off?
ksbrace
07-16-2004, 10:41 PM
I got it!!!

I had to change the program as follows.

:004295ED 7E30 JLE 0042961F <-CHANGE TO EB30 JMP 0042961F

AND

:00429640 7E05 JLE 00429647 <- NOP THIS LINE

This will get rid of the expiration but not the nag screens.
dELTA
07-17-2004, 07:11 AM
Since you haven't showed us the surrounding code at the location of the second patch (00429640), it's hard to know for sure, but my guess is that it affects the return value of the procedure you displayed the code of above, which is in turn used as an indicator by the program as to if it should carry on or exit.

Another guess is that the procedure that displays the nag is the one at 00401A65, and if you skip this call (with the correct stack balancing of course) you will get rid of the nags in a clean way too. You could actually most likely skip the entire body of the procedure in which you made the patches, just making sure it returns the right value.
ksbrace
07-17-2004, 11:06 AM
dELTA, sorry I thought I posted the whole section previously. I do still have the nag screens to deal with yet.

* Reference To: MFC42.MFC42:NoName0395, Ord:0320h
|
:004295C4 E9C7940100 Jmp 00442A90

* Referenced by a CALL at Address:
|:0042A0C1
|
:004295C9 B86C0D4600 mov eax, 00460D6C
:004295CE E8DD9D0100 call 004433B0
:004295D3 51 push ecx
:004295D4 51 push ecx
:004295D5 53 push ebx
:004295D6 56 push esi
:004295D7 8BF1 mov esi, ecx
:004295D9 33DB xor ebx, ebx
:004295DB 57 push edi
:004295DC 895E50 mov dword ptr [esi+50], ebx
:004295DF A160D04700 mov eax, dword ptr [0047D060]
:004295E4 8945F0 mov dword ptr [ebp-10], eax
:004295E7 395E60 cmp dword ptr [esi+60], ebx
:004295EA 895DFC mov dword ptr [ebp-04], ebx
:004295ED EB30 jmp 0042961F
:004295EF 8945EC mov dword ptr [ebp-14], eax

* Possible Reference to String Resource ID=00189: "Your trial period expires in %d days."
|
:004295F2 68BD000000 push 000000BD
:004295F7 8D4DEC lea ecx, dword ptr [ebp-14]
:004295FA C645FC01 mov [ebp-04], 01
:004295FE E86284FDFF call 00401A65
:00429603 FF7660 push [esi+60]
:00429606 8D45F0 lea eax, dword ptr [ebp-10]
:00429609 FF75EC push [ebp-14]
:0042960C 50 push eax
:0042960D E88E67FEFF call 0040FDA0
:00429612 83C40C add esp, 0000000C
:00429615 8D4DEC lea ecx, dword ptr [ebp-14]
:00429618 E8C882FDFF call 004018E5
:0042961D EB0D jmp 0042962C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004295ED(U)
|

* Possible Reference to String Resource ID=00190: "Your trial period has expired."
|
:0042961F 68BE000000 push 000000BE
:00429624 8D4DF0 lea ecx, dword ptr [ebp-10]
:00429627 E83984FDFF call 00401A65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042961D(U)
|
:0042962C FF75F0 push [ebp-10]

* Possible Reference to Dialog: DialogID_007B, CONTROL_ID:016C, "Your trial period expires in %d days."
|
:0042962F 686C010000 push 0000016C
:00429634 FF7604 push [esi+04]

* Reference To: USER32.SetDlgItemTextA, Ord:0253h
|
:00429637 FF150C604600 Call dword ptr [0046600C]
:0042963D 395E60 cmp dword ptr [esi+60], ebx
:00429640 90 nop
:00429641 90 nop
:00429642 6A02 push 00000002
:00429644 5F pop edi
:00429645 EB02 jmp 00429649
:00429647 33FF xor edi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429645(U)
|
:00429649 FF7604 push [esi+04]

* Reference To: USER32.GetParent, Ord:0145h

00401A65

* Referenced by a CALL at Addresses:
|:004013BE , :004074F1 , :00407514 , :0040755F , :00407582
|:00407612 , :0040FD6B , :004261F1 , :00426403 , :00426410
|:004265C0 , :00426AD2 , :00426BD9 , :00426BE6 , :00426E7B
|:00426E88 , :00427151 , :0042715E , :004272B0 , :004272BD
|:00427368 , :00427375 , :0042745A , :00427467 , :0042945A
|:0042946F , :004295FE , :00429627 , :0042976B , :0042A651
|:0042AD9F , :0042ADB4 , :00441DEF , :00441F8F , :00441F9F
|:00441FAF , :00441FBF
|
:00401A65 55 push ebp
:00401A66 8BEC mov ebp, esp
:00401A68 81EC08010000 sub esp, 00000108
:00401A6E 53 push ebx
:00401A6F A110554900 mov eax, dword ptr [00495510]
:00401A74 56 push esi
:00401A75 894DF8 mov dword ptr [ebp-08], ecx
:00401A78 BE00010000 mov esi, 00000100
:00401A7D 57 push edi
dELTA
07-18-2004, 06:07 AM
So, did you try what I recommended above, about the nags? And since you didn't include the end of the function this tim eeither, it is still not possible to really see what that last patch does, all you can see is that it affects the contents of the edi register, setting it to 2 instead of 0 (I'm not telling you that you necessarily need to include the whole function though, especially not if it's big).
ksbrace
07-18-2004, 07:27 AM
dELTA,
Thanks for your help/guidance. I haven't tried anything w/the nags because I wasn't sure what to do at 00401A65. I thought that I got the surrounding code for 00429640 on my last reply. I thought the function ended on :00429649. I hate to sound ignorant (but if you don't know, you have to ask), how do I know when the function ends? I have included some more:

* Possible Reference to Dialog: DialogID_007B, CONTROL_ID:016C, "Your trial period expires in %d days."
|
:0042962F 686C010000 push 0000016C
:00429634 FF7604 push [esi+04]

* Reference To: USER32.SetDlgItemTextA, Ord:0253h
|
:00429637 FF150C604600 Call dword ptr [0046600C]
:0042963D 395E60 cmp dword ptr [esi+60], ebx
:00429640 7E05 jle 00429647
:00429642 6A02 push 00000002
:00429644 5F pop edi
:00429645 EB02 jmp 00429649

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429640(C)
|
:00429647 33FF xor edi, edi

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00429645(U)
|
:00429649 FF7604 push [esi+04]

* Reference To: USER32.GetParent, Ord:0145h
|
:0042964C FF158C604600 Call dword ptr [0046608C]
:00429652 83CF01 or edi, 00000001
:00429655 57 push edi
:00429656 53 push ebx
:00429657 6870040000 push 00000470
:0042965C 50 push eax

* Reference To: USER32.PostMessageA, Ord:01FFh
|
:0042965D FF1594604600 Call dword ptr [00466094]
:00429663 8D4DF0 lea ecx, dword ptr [ebp-10]
:00429666 E87A82FDFF call 004018E5
:0042966B 8B4DF4 mov ecx, dword ptr [ebp-0C]
:0042966E 33C0 xor eax, eax
:00429670 5F pop edi
:00429671 5E pop esi
:00429672 40 inc eax
:00429673 5B pop ebx
:00429674 64890D00000000 mov dword ptr fs:[00000000], ecx
:0042967B C9 leave
:0042967C C3 ret

* Referenced by a CALL at Addresses:
|:0042A0DA , :0042BA8F
|

* Possible Reference to Dialog: DialogID_007D
|
:0042967D 6A7D push 0000007D
:0042967F 58 pop eax
:00429680 C3 ret

* Referenced by a CALL at Address:
|:004294C7
|
:00429681 B8A00D4600 mov eax, 00460DA0
:00429686 E8259D0100 call 004433B0
:0042968B 83EC2C sub esp, 0000002C
:0042968E 53 push ebx
:0042968F 56 push esi
:00429690 57 push edi
ksbrace
07-18-2004, 08:44 AM
ok, I've been 'attempting' to remove the nag screens. dELTA, you had mentioned that if I skip the call at 00401A65 that may eliminate the nag screens. I thought by changing this
:004013A0 7405 je 004013A7
To
:004013A0 7505 jne 004013A7

but that didn't work. Any guidance would be greatly appreciated. Thanks,

* Possible Reference to Dialog: DialogID_00DE, CONTROL_ID:0175, "Settings:"
|
:0040135E 6875010000 push 00000175
:00401363 50 push eax
:00401364 895DFC mov dword ptr [ebp-04], ebx
:00401367 E8B9120000 call 00402625
:0040136C 53 push ebx
:0040136D 6A05 push 00000005
:0040136F 8D45E0 lea eax, dword ptr [ebp-20]
:00401372 6A01 push 00000001
:00401374 50 push eax
:00401375 8D4E4C lea ecx, dword ptr [esi+4C]
:00401378 C645FC01 mov [ebp-04], 01
:0040137C E80E130000 call 0040268F
:00401381 8BC8 mov ecx, eax
:00401383 C645FC03 mov [ebp-04], 03
:00401387 E898130000 call 00402724
:0040138C 8BC8 mov ecx, eax
:0040138E C645FC04 mov [ebp-04], 04
:00401392 E88D130000 call 00402724
:00401397 8B4DE0 mov ecx, dword ptr [ebp-20]
:0040139A 834DFCFF or dword ptr [ebp-04], FFFFFFFF
:0040139E 3BCB cmp ecx, ebx
:004013A0 7405 je 004013A7
:004013A2 E8D38C0000 call 0040A07A

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004013A0(C)
|
:004013A7 A160D04700 mov eax, dword ptr [0047D060]
:004013AC 8945C0 mov dword ptr [ebp-40], eax

* Possible Reference to String Resource ID=00225: "General"
|
:004013AF 68E1000000 push 000000E1
:004013B4 8D4DC0 lea ecx, dword ptr [ebp-40]
:004013B7 C745FC05000000 mov [ebp-04], 00000005
:004013BE E8A2060000 call 00401A65
:004013C3 680200FFFF push FFFF0002
:004013C8 680000FFFF push FFFF0000
:004013CD 6A0E push 0000000E
:004013CF 6A0E push 0000000E
:004013D1 53 push ebx
:004013D2 6884574800 push 00485784
:004013D7 FF75C0 push [ebp-40]
:004013DA E81B080000 call 00401BFA
:004013DF 83C40C add esp, 0000000C
:004013E2 8BCF mov ecx, edi
:004013E4 50 push eax
:004013E5 E803100000 call 004023ED
:004013EA 395E0C cmp dword ptr [esi+0C], ebx
:004013ED 8945A4 mov dword ptr [ebp-5C], eax
:004013F0 895DC4 mov dword ptr [ebp-3C], ebx
:004013F3 0F86CD040000 jbe 004018C6

* Reference To: OLEAUT32.SysFreeString, Ord:0006h
|
:004013F9 8B3D485F4600 mov edi, dword ptr [00465F48]
dELTA
07-18-2004, 09:39 AM
Most normal functions end with the instruction "ret" or "retn". Do note that all execution paths of the function must be ended with this instruction before the code of the functions ends though, not just one of them (i.e. the first occurrence).

And I'm not sure where you are suggesting to make that latest patch, you are no longer located in the same function as above. The call that I guessed might display the nags must be skipped inside the function you were in before, not just at any place, it might be a more generic message/dialog related function. But that was just a guess from my side anyway, it would need more analysis to verify. Try my earlier suggestion about returning immediately from the entire function instead (just balance the stack first), and see if there are any checks for specific return values afterwards, in that case return those.

Finally, after you posted the additional code it can be seen that your earlier patch that "made it work" affects a parameter to the PostMessage API, use an API reference to see exactly what it did.

Anyway, my internet access is quite limited right now, and I won't be able to provide any more detailed help on this matter. Someone else is welcome to take it from here, maybe naides, or someone else who is usually helpful to newbies? :)
ksbrace
07-23-2004, 09:14 AM
Ok, I read this tutorial today on killing nags and it said to look for FF FF 82 or FF FF FF FF 82 and to look at the text and see if that was related to one of the nag screens. There were several FF FF 82 spots, I changed one of them to FF FF 7E and it got rid of the first nag. I tried it with the second and third nag and the proggy gave me an error. Funny thing, when I change an FF FF 82 to FF FF 7E on either of the final 2 nag screens, it just takes out a block of the entire window/dialog box. Leaving a big blue space in it. Is this the preferred method on killing nags or not?
naides
07-23-2004, 11:49 AM
Ok, I read this tutorial today on killing nags and it said to look for FF FF 82 or FF FF FF FF 82 and to look at the text and see if that was related to one of the nag screens. There were several FF FF 82 spots, I changed one of them to FF FF 7E and it got rid of the first nag. I tried it with the second and third nag and the proggy gave me an error. Funny thing, when I change an FF FF 82 to FF FF 7E on either of the final 2 nag screens, it just takes out a block of the entire window/dialog box. Leaving a big blue space in it. Is this the preferred method on killing nags or not?

I have been assigned by the administration to help you in this matter. :p

The "readymade" methods you read in some tutorials may work or may not, but it is the wrong path to learn RCE. Rather concentrate on learning why things happen, then how to modify the code so things do happen the way you wanted.

* Referenced by a CALL at Addresses:
|:004013BE , :004074F1 , :00407514 , :0040755F , :00407582
|:00407612 , :0040FD6B , :004261F1 , :00426403 , :00426410
|:004265C0 , :00426AD2 , :00426BD9 , :00426BE6 , :00426E7B
|:00426E88 , :00427151 , :0042715E , :004272B0 , :004272BD
|:00427368 , :00427375 , :0042745A , :00427467 , :0042945A
|:0042946F , :004295FE , :00429627 , :0042976B , :0042A651
|:0042AD9F , :0042ADB4 , :00441DEF , :00441F8F , :00441F9F
|:00441FAF , :00441FBF
|
:00401A65 55 push ebp
:00401A66 8BEC mov ebp, esp

As you can see the code at :001A65 gets called from dozens of areas in your program so we better leave it alone, or you may sabotage a lot of important functionality.

On the other hand the nags seem to be generated in code like this:

:004295ED EB30 jmp 0042961F
:004295EF 8945EC mov dword ptr [ebp-14], eax

* Possible Reference to String Resource ID=00189: "Your trial period expires in %d days."
|
:004295F2 68BD000000 push 000000BD The NAG text is pushed
:004295F7 8D4DEC lea ecx, dword ptr [ebp-14] More setup stuff
:004295FA C645FC01 mov [ebp-04], 01
:004295FE E86284FDFF call 00401A65 This call displays the NAG
:00429603 FF7660 push [esi+60]
:00429606 8D45F0 lea eax, dword ptr [ebp-10]
:00429609 FF75EC push [ebp-14]
:0042960C 50 push eax

At least is a good thing to explore. So prevent the line:

:004295FE E86284FDFF call 00401A65 from executing.

How?

If you just nop it the program will crash because

:004295F2 68BD000000 push 000000BD right before the call changes the stack

so replace the bytes

:004295FE E86284FDFF call 00401A65

for

:004295FE 59 pop ECX One pushed one poped, we are even
:004295FF 90909090 nop nop nop

If you do this at the code that generates you NAG (Which you can identify by the text that gets pushed, you prevent the nag form being generated, and finish your project.

Be aware that the NAG may be called from other areas in the code appart from :004295FE which I used AS AN EXAMPLE. you have to figure out where it gets called and neutralize it. If my hypothesis is correct is one or more of the many addresses that call

:00401A65 routine
JMI
07-23-2004, 01:51 PM
See why we gave "nobody" this assignment. :idea: :yay: :devil:

Regards,
Woodmann
07-23-2004, 04:00 PM
Hi,

naides is a great choice for this job.
He spends enough time here, may as well make him work while he is here. :D

Woodmann
dELTA
07-23-2004, 06:56 PM
Thanks naides, I knew we could trust you for a nice and patient explanation like this. :)

Btw, I've always been wondering what these magical FF FF FF 82 bytes really are? They are described but never explained in bunches of nag removal tutorials, and sadly I never got around to investigating them myself.

Does anyone have a good explanation for what these bytes really are?

Since they appear to always occur in connection to the text of the nag inside the executable, I guess they must be located in either the data section or the resource section of the exe, and hence not being part of any opcode or opcode parameter. What makes me even more curious is that this simple generic patch seems to work flawlessly so often, both in the old days, since it originally appeared in that old tKc tutorial I think, and today, for example in the program discussed in this thread.

Are they some kind of resource flags, and in that case exactly what flags are they? Or is it something else? Please help me put an end to this mystery once and for all. :p
JMI
07-23-2004, 07:08 PM
Doo-Dee-Duu-Daa; Doo-Dee-Duu-Daa. You are about to enter the Twilight Zone. :D

Regards,
Woodmann
07-23-2004, 07:19 PM
Ummmmmmmmmm...........

JMI.....You are already in the twilight zone :eek:

Lay off the weed, and dont give me the old "for medicinal purposes" bullshit.

Luv to my 'peeps, :)

Woodmann
JMI
07-23-2004, 07:57 PM
But I NEVER had sex with that woman... oh sorry... wrong story... I mean, I never inhaled." :devil: Cough, cough.

Regards,
Kayaker
07-23-2004, 09:22 PM
Hi,
naides is a great choice for this job.
He spends enough time here, may as well make him work while he is here. :D
Woodmann

I think we should start paying Naides his due worth, what with all the monies we get from Compuware as a subsidiary Softice support forum, the percentage of advertising revenues we get from the Big Protectors, plus the kickbacks from... Oh wait, that wasn't supposed to get out was it? :sneaky:
Uradox
07-24-2004, 01:31 AM
dont quote me on it but probely resource flags like u suggest for delphi or vb or one of those sorts of ide's :)
Used to do simular stuff years ago with delphi nags.
Dont really think its a good method if the program can run without the nag with registration. Lazy more or less but hey if it works i guess skys the limit ;)
ksbrace
07-25-2004, 11:33 AM
naides,
Thanks for the help. I have implemented the change and I am still getting the 2nd and 3rd nags. I will keep looking and try to find out where the other calls are being made and make a similar change as you have suggested. I have found this at the top of the disassembly:

001 - ControlID:FFFF, Control Class:"" Control Text:"You are able to evaluate the product for a trial period of 30 days."
This is part of the nag and this is the only place the You are able to evaluate the product for a trial period of 30 days. is located. I noticed the ControlID is FFFF. I was wondering if that is where the tutorials were always getting to look for FF FF 82??? Also, Here's the area where the 2nd nag seems to appearing(there is more text than the 'You are able....'

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004295ED(U)
|

* Possible Reference to String Resource ID=00190: "Your trial period has expired."
|
:0042961F 68BE000000 push 000000BE
:00429624 8D4DF0 lea ecx, dword ptr [ebp-10]
:00429627 E83984FDFF call 00401A65

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0042961D(U)
|
:0042962C FF75F0 push [ebp-10]

* Possible Reference to Dialog: DialogID_007B, CONTROL_ID:016C, "Your trial period expires in %d days."
|
:0042962F 686C010000 push 0000016C
:00429634 FF7604 push [esi+04]

Now I tried making the same changes as you had mentioned at address :0042961F and :0042962F but the nags still appeared.

The 3rd nag appears w/this text:You have successfully installed the licensed product. which is only located here:
001 - ControlID:FFFF, Control Class:"" Control Text:"You have successfully installed the licensed product."
the remaining text of the 3rd nag is:Click Finish to start the application
which is only located here:

002 - ControlID:FFFF, Control Class:"" Control Text:"Click Finish to start the application." I'm still digging and reading info, but I have been spinning my wheels for a few days now. Thanks, for your help!


RegQueryValueExa Help (New)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RegQueryValueExa Help (New)
PDA

View Full Version : RegQueryValueExa Help (New)

mivc
07-17-2004, 05:27 PM
Hi,

I've read this question in this form but i still can't make SI to popup on this breakpoint.
The key i want to break on is called RegPass. I set my breakpoint with:

bpx RegQueryValueExa IF *(esp->8)=='RegP' DO "d esp->14;"

SI will not popup when this value is queried. (I've looked with RegMon to see which key is
Queried for the registration)

When i just use bpx RegQueryValueExa, SI will popup each time this function is called and
when i look with ? *esp->8 is see that the strings are in reverse order. For example
if the key was RegPass then *esp->8 will show 4 bytes PgeR, so i tried the following;

bpx RegQueryValueExa IF *(esp->8)=='PgeR' DO "d esp->14;" but this is also not working.

Can someone help me with to solve this problem.

Thanks!!!
JMI
07-17-2004, 05:42 PM
Since there are a number of problems discussed in these forums relating to softice and the functioning of breakpoints, you have left out some essential information, such as which OS and which version of SICE you are running, whether you have uncommented relevant sections in the .dat file.

And you question relates to a "Tool of the Trade" and is being moved there.

Your breakpoint looks the same as the one posted in the Rhayader's Softice Tips;

"BPX RegQueryValueExA IF *(ESP->8) == 'Regi' DO "D ESP->14;"
...

3. Now, the expression *(ESP->8) == 'Regi' means that the expression will evaluate to TRUE, only if "the value stored in the address pointed to by the content of [ESP+8]" is "equal" to "Regi". Why only use four character? Well, the * operator, only return DWORD value (32-bit). So, we can only use the first 32-bit which is equal to four character. Also, SoftIce will convert 'Regi' to 0x69676552 (it's Regi in little endian format ;). So, it's case-sensitive. I probably should note that, there is two equal sign, and it's a single quote. The use of two equal sign and single quote is the same as C language.

Since the * operator return DWORD value, there will be a problem if we want to retrieve only a WORD (16-bit) value. We had to use the SoftIce Word() function. You can see User Guide Chapter 8, sub Forming Expressions, sub Built-in Functions, for the Word() function. But, since most program align values/structures in 4-byte boundary, the use of Word() function is quiet rare. The example that will follow is retrieve 16-bit value, yet we can safely use it without the Word() function. "

He was trying to break on:

HKEY_CURRENT_USER\Software\Microsoft\Developer\Setup\RegisteredOwner
HKEY_CURRENT_USER\Software\Microsoft\Developer\Setup\RegisteredOrganization

so he used the first four letters of "Registered." You say you are looking for "RegPass." It is, as you note, case sensitive, but not reversed. Check your HKEY listing to make sure you do not have an incorrect one. It's "little endian format" so the reversing takes place only in that process.

Provide the additional information and maybe someone can assist.

Regards,
mivc
07-18-2004, 10:36 AM
I'am working with Driverstudio 4.3.1 build 1722
With the latest OSINFO.DAT

under Windows 2000 Prof. windows NT 5.0 Build 2195 SP3

The key I'am looking for is
HKEY_CURRENT_USER\Software\JetCar\JetCar\General\RegPass so this

BPX RegQueryValueExA IF *(ESP->8) == 'RegP' DO "D ESP->14;"

Should do it, but it Does not.

The Winice.dat looks like;

NMI=ON
VERBOSE=ON
HST=256
PHYSMB=1024
DRAWSIZE=2048
INIT="color f a 4f 1f e;wl;code on; altscr off; lines 90;width 90; wc 35; wd 35; wr;wf; faults off;wf;set BreakInSharedMods on;X;"
SYM=4096

EXP=C:\WINNT\system32\version.dll
EXP=C:\WINNT\system32\CSRSRV.DLL
EXP=C:\WINNT\system32\NTDLL.DLL
EXP=C:\WINNT\system32\BASESRV.DLL
EXP=C:\WINNT\system32\WINSRV.DLL
EXP=C:\WINNT\system32\VB40032.DLL
EXP=C:\WINNT\system32\msvbvm60.dll
EXP=C:\WINNT\system32\COMCTL32.DLL
EXP=C:\WINNT\system32\comdlg32.DLL
EXP=C:\WINNT\system32\advapi32.DLL
EXP=C:\WINNT\system32\msvcrt.DLL
EXP=C:\WINNT\system32\shell32.DLL
EXP=C:\WINNT\system32\ole32.DLL
EXP=C:\WINNT\system32\oleaut32.DLL
DISASSEMBLYHINTS=ON
LOWERCASE=OFF
CODEMODE=ON
SELECTORS=ON
CHECKSTRINGS=ON
AUTOCONNECT=OFF
NETSUPPORT=OFF
HOSTNAME=COMPMIVC

F1="h;"
F2="^wr;"
F3="^src;"
F4="^rs;"
F5="^x;"
F6="^ec;"
F7="^here;"
F8="^t;"
F9="^bpx;"
F10="^p;"
F11="^G @SS:ESP;"
F12="^p ret;"
SF3="^format;"
AF1="^wr;"
AF2="^wd;"
AF3="^wc;"
AF4="^ww;"
AF5="CLS;"
AF11="^dd dataaddr->0;"
AF12="^dd dataaddr->4;"
CF1="color f a 4f 1f e;wl;code on; altscr off; lines 90; width 90;wc 35; wd 35; wr;wf;wf; faults off;"
CF2="^wr;^wd;^wc;"
MACROS=256
MACRO setWtxt="bpx user32!setWindowTextA do \"d esp->8;\""

MOUSE=ON
ECHOKEYS=OFF
NOLEDS=OFF
NOPAGE=OFF
PENTIUM=ON
THREADP=ON
SIWVIDRANGE=ON
NTSYMBOLS=ON

MENU=Copy , NMPD_COPY , 0
MENU=Paste , NMPD_PASTE , 0
MENU=Copy&Paste , NMPD_COPYANDPASTE , 0
MENU=Display , NMPD_DISPLAY , 0
MENU=Un-Assemble , NMPD_UNASSEMBLE , 0
MENU=What , NMPD_WHAT , 0
MENU=Prev , NMPD_PREV , 0
MENU=Reip , r eip %cp% , 0
MENU=Add Watch , watch %cp% , 0
MENU=Break On Text , bpx %cp% , 0

Can you tell me if there this winice.dat file is OK.

Thanks!!
dELTA
07-18-2004, 01:48 PM
I'am working with Driverstudio 4.3.1
No you're not... :rolleyes:
JMI
07-18-2004, 07:07 PM
Actually, you might just mean your working with "Softice 4.3.1 build 1722" from something, maybe, called "Driverstudio 3.1." :whoops:

Regards,
Kayaker
07-19-2004, 04:22 AM
Hi,

The conditional breakpoint
BPX RegQueryValueExA if *esp.8 == 'Regi'
seems like it should work in your case.

A few things to try, sometimes you have to mix things up.

Set the bp IN the context of the program, not before.

See if the area of code of the RegQuery call is Paged Out when you set the bp. It's *possible* the bp might not stick in this case. If so, try displaying that page containing the address in the data window, scrolling if necessary, this tends to page-in the section of code as far as Softice is concerned. Or use IceExt to page the section in, or just trace manually until the code is read in and is visible.

Try with and without Set BreakInSharedMods ON.

Try setting the bp on another registry call used immediately beforehand, such as RegOpenKey or CreateKey or QueryKey, whichever is used. You'll get fewer hits and can probably check each manually.

INT 2E Breakpoints
==================

I think a more reliable way to break on APIs in general, might be to break on the underlying Int2E call where possible, in this case NtQueryValueKey. You're using a BPINT interrupt breakpoint and the IDT vectors, instead of BPX and INT3, one may work where the other doesn't. Plus the code in ntdll is guaranteed to be paged in.

There are a couple of considerations though..

Trace the API for a while and you'll find

mov eax, 09Bh ; NtQueryValueKey
lea edx, [esp+4]
INT 2E

The breakpoint to use to break on *every* call to NtQueryValueKey/RegQueryValueExA would be:

BPINT 2E if eax==9B

Now to set a conditional break you need to "find" where your registry string, now in UNICODE format, is stored on the stack. It is still at esp.8, but is immediately after a standard UNICODE structure (word/word/dword), so actually begins at ((esp.8)+8).

Problem 1 - dealing with the unicode string. The string "Re" becomes dword 0x00520065. Softice doesn't like dwords beginning with 00 and truncates it to 0x520065. Bad things seem to happen then. So what you need to do is shift 1 byte to ((esp.8)+9) which sets the string breakpoint condition to 0x52006500.

Problem 2 - when designing a breakpoint condition referencing the stack you can use ESP or EBP. When setting a bp on the start of a function call or API, you reference with ESP. When setting a bp within a function call (after the standard 'push ebp' prologue has executed), you reference with EBP. Shockingly, this is in the SI manual...

From my testing, for INT 2E we need to use EBP in the conditional breakpoint, ESP will not break even with the "correct" conditional syntax. You will need to confirm on your own system that the UNICODE string is referenced at EBP.C, but should be consistent in ntdll.dll.

After all this you end up with a simple and effective breakpoint condition:

BPINT 2E if eax == 9B && *(ebp.c+9) == 52006500

This should be equivalent to RegQueryValueExA if word(*esp.8) == 'Re'. If you really need the extra 2 characters you can simply add on another && condition.

Cheers,
Kayaker
bilbo
07-19-2004, 06:53 AM
Hi, Kayaker,
a very exhaustive answer, as usual!

Be only warned that, starting from Windows XP and where supported (e.g. not on AMD CPUs), M$ has implemented a new kernel entering procedure which seems to be faster.
No more INT 2E but SYSENTER.
See for example from Elicz site:
http://www.anticracking.sk/elicz/infos/FastNTCALL.txt

So BPINT 2E will not work anymore.

Best regards, bilbo
Kayaker
07-19-2004, 09:26 PM
Thanks for pointing that out Bilbo. I try to happily ignore the details of XP ;) In this case it's an interesting change. I wonder if an opcode breakpoint on SYSENTER would be of much use?

BPX eip if word(*eip == 0F34) && eax == NTCallNumber && (check stack for defining string/value)

Regards,
Kayaker
bilbo
07-20-2004, 02:27 AM
Yup, I didn't think of it!
Unfortunately it does not work!

It looks like BPX EIP does not work on Windows NT derivated operating systems (tried SI ver 4.0.5 on Windows NT and SI ver 4.3.1 on Windows XP). It immediately resolves EIP with the current address!

Could anyone confirm this?

Regards, bilbo
dELTA
07-20-2004, 05:41 AM
Doesn't Softice always evaluate all expressions in breakpoints immediately? Otherwise, each such breakpoint would be the equivalent of tracing the program, with all the time penalties that this brings with it and such, right?
mivc
07-20-2004, 12:45 PM
Hello Kayaker / Bilbo,

First of all thanks for your replies this problem!

I'am a Newbie on Softice and Assembly, but believe me, i'am a quick learner
and i am dedicated.
I' am reading about PE headers and some protection schemes and i'am looking up anything which i do not understand yet. To solve my first problem, the conditional breakpoint question, you stated 2 things which i do not grab.

First what do you mean about ' Set the bp IN the context of the program, not before.

Second. You said 'See if the area of code of the RegQuery call is Paged Out'
and 'use IceExt to page the section in'

Could you explain what you mean about these.

If this is going to deep to explain, and this will be beyond our goal, it would be fine if you could suggest me to study some articles concerning the above.

Thanks anyway!!
Kayaker
07-20-2004, 12:47 PM
Doh! You're right of course, the <address> component of an expression is always resolved to an address immediately. I think an opcode breakpoint like this may have worked with the BPR command where you could specify a range of addresses. Sten needs to develop his BPR equivalent further :)

Just surmising, what about a break on (KiFastCallEntry + offset)?

KiFastCallEntry:
MOV ESP, SS:[0xFFDFF040]
MOV ESP, [ESP+4] ;this is ring-0 stack for FastCall
PUSH 0x23 ;imitate ring-3_SS
PUSH EDX ;ring-3_ESP + 4 (see LEA EDX, [ESP+4] above)
SUB DWORD PTR [ESP], 4 ;ring-3_ESP + 4 - 4 (-> ring-3_ESP)

...BREAK and test ring 3 esp here, or...

PUSHFD

OR DWORD PTR [ESP], 0x200 ;imitate ring-3_EFlags, IRQs enabled
PUSH 0x1B ;imitate ring-3_CS
PUSH ECX ;this should be ring-3_EIP ?
;..fill in KeTrapFrame

... OR BREAK and test saved registers in KeTrapFrame
(is this _KTRAP_FRAME?)

;..go to common NTCALL dispatch code

I'd be interested in seeing the SYSENTER code and how the MSR registers themselves are written to. What is the ntdll.dll equivalent counterpart in XP?

K.
Kayaker
07-20-2004, 01:06 PM
First what do you mean about ' Set the bp IN the context of the program, not before.

Second. You said 'See if the area of code of the RegQuery call is Paged Out'
and 'use IceExt to page the section in'
Hi

1. "IN the context" meaning set the breakpoint while you are IN Softice and stopped at the start, or elsewhere, in the "context" of the target program.

2. You can recognize Paged Out as Softice displaying in the data window all question marks ????????. If the code address you are trying to break on is paged out, Softice may not break sometimes. This is more likely with BPX breakpoints, BPM(x/r/w) breakpoints tend to be more reliable.

IF this is the case, you can page in the memory as I described and see if the breakpoint now sticks.

Good luck,
Kayaker
JMI
07-20-2004, 01:08 PM
mivc:

You have forgotted one of the general concepts in operation here, which is that you are supposed to SEARCH the Forums BEFORE you ask a question. :whoops: This is illustrated by your question about "context" "paged out" and "IceExt." These question have already been asked several times and the answers can be found by a simple search of the Forums, including how to change and/or set the "context" and use IceExt to PageIn.

Go to the main search button and use "softice and context" (without the quote marks) and check out what you find there.

For the second question try both "breakpoint and paged out" and "breakpoint and pages" (again without the quotes) and check out what you find and then come back if you still do not understand and ask a more pointed question. This should also turn up some information about IceExt, which you could search separately.

Regards,
bilbo
07-21-2004, 03:36 AM
Kayaker:
What is the ntdll.dll equivalent counterpart in XP?
instead of

mov eax, <syscall>
lea edx, [esp+arg_0]
int 2Eh

on XP platforms you will find:

mov eax, <syscall>
mov edx, 7FFE0300h
call edx

and, in case SYSENTER is supported,

7FFE0300:
mov edx, esp
sysenter
ret

with the following MSR settings:

MSR 174 (ring 0 CS): 8
MSR 175 (ring 0 ESP): 0
MSR 176 (EIP): KiFastCallEntry

mivc:

From SoftIce Command Reference

Any breakpoint set on an address below 80000000h (2 GB) is address context sensitive. That is, they are only triggered when the context in which they were set is active. This includes WIN32, WIN16, and DOS V86 applications. Take care to ensure you are in the correct context before setting a breakpoint.
and
Use the ADDR command to both display and change address contexts within SoftICE so that process-specific data and code can be viewed.

JMI:

You're right.
"The next best thing to knowing something is to know where to find it."
Samuel Johnson
But please don't be too angry!

Regards, bilbo
JMI
07-21-2004, 04:57 AM
bilbo:

Why should I be angry? :confused: After all, you did find "the Precious." :yay:

Regards,
MarQueze
08-19-2004, 05:18 PM
MIVC,

I've been struggeling with the same thing using driverstudio 4.3.1 build 1722 on win2k SP4.

Rhayader's syntax doesn't seem to work.

I've taken a step by step approach to tackle this problem.
After a break on RegQueryValueExA on a key named 'Driver' I used the SoftIce expression evaluation function:
?*(ESP->8)=='Driv'
This evaluates to FALSE!!
Although ?*(ESP->8) results in 'virD'

I played around a bit with some different notations and discovered that
?DWORD(*(ESP->8))=='Driv'
evaluated to TRUE :idea:

This means the conditional breakpoint should be:
BPX RegQueryValueExA DWORD(*(ESP->8))=='Driv' DO "something usefull"

Please let me know if this works for you too!!

:yay:

Cheers,

MarQueze


Microsoft C# and Basic .NET
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Microsoft C# and Basic .NET
PDA

View Full Version : Microsoft C# and Basic .NET

fifthelement
07-18-2004, 04:28 PM
hi guys, it is a long time that I were very busy with the university and couldnt come here and miss u so much :p
is there any thing special with reversing C# and Basic .Net apps ? I have an application and want to reverse it but I cant not ! Ollydbg even cant run it ! and crashes ! PEiD says it is Microsoft C# and Basic .NET .
unfortunately I dont have SoftIce. because in my country I can not buy it :( where is the problem ? can I say my app name here ?
Woodmann
07-18-2004, 05:18 PM
Howdy,

The search button still works. :idea:

Woodmann
JMI
07-18-2004, 05:30 PM
Oh, Thank God. I was afraid it was broken. :devil: Hint: use "debugging .net" (without the quotes) as a search term.

Regards,
iunknown
07-21-2004, 03:21 PM
you can use ildasm then modify the il then recompile it with ilasm =D


Format String Bug in OllyDbg 1.10
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Format String Bug in OllyDbg 1.10
PDA

View Full Version : Format String Bug in OllyDbg 1.10

disavowed
07-18-2004, 08:46 PM
Old news (from yesterday) - http://lists.netsys.com/pipermail/full-disclosure/2004-July/024042.html

* [FMADV] - OllyDbg Format String Bug

* Introduction:
There exists a format string bug in the code that handles Debugger
Messages in OllyDbg. This means any traced application can crash OllyDbg
and execute machine code.

* About (From the Webpage):
OllyDbg is a 32-bit assembler level analysing debugger for Microsoft
Windows. Emphasis on binary code analysis makes it particularly useful in
cases where source is unavailable.

OllyDbg is seen as an industry standard when it comes to analysing
vulnerabilties on win32 and it's easy to understand makes it a must for
anyone developing exploits on windows. Many people have sung the praises
of OllyDbg, including some very high profile engineers and exploit
developers.

* Technical details:
Typically OllyDbg attaches to a process and allows the user how to
customize the session; wether they trace, or they breakpoint some stuff or
whatever. The windows API is actually very debugger friendly and has many
functions to interact with debuggers (most likely built for their own
(safe) debugger WinDbg). One of these functions, OutputDebugString sends a
string directly to the debugger for interpretation, which OllyDbg displays to
the user via a status line along the bottom, sans a format specifier,
which means the user supplied string is used as the format specifier.

To reproduce this excellent bug, these steps can be taken:

1. Download Python (http://python.org) and win32com
(http://starship.python.net/crew/mhammond/win32/Downloads.html). These
two are _essential_ to any hacker's windows box.

2. Run 'python' so you get an interactive shell.

3. Attach to the 'python' process with OllyDbg, press 'F9' to continue
execution.

4. Type 'import win32api' and press enter in the python screen.

5. Type 'win32api.OutputDebugString("%s" * 50)' to crash OllyDbg.
Typically, if you have OllyDbg set as the JIT Debugger, another OllyDbg
screen will pop up ;) OR

6. Type 'win32api.OutputDebugString("%8.8x" * 15)' to view whats on the
stack!

7. The python process will now have died since OllyDbg died, so do the
process again!

If this is all too hard, or you don't believe ;) Then a screenshot for
your viewing pleasure is availiable at:
http://felinemenace.org/~nd/ollyfmt.png

Andrewg of FelineMenace managed to create a python script to exploit this
vulnerability, albeit with some shellcode problems :)

* Conclusion:
It certainly opens up the possibly for binaries to start owning their
debuggers, in an anti-reversing sense. GDB is a huge project too, with
multiple public/unpublished bugs. Because Debuggers work with the
executable in a state of execution, disassemblers such as IDA could be
vulnerable to a static attack of a malformed binary, much like the
executable handling in the OpenBSD kernel i suppose. The possibilities are
endless! However there is a definate need for disclosure of these bugs, as
debuggers/disassembler are the first defense against the malicious.

* Greets:
TFM (Team FelineMenace), Greg + rootkit.com, people who spend their day
making sure imported beer is actually imported, peach.gotdns.org.

----
http://felinemenace.org/~nd
dELTA
07-19-2004, 08:53 AM
Hehe, that's really cool (but scary)... :cool:
disavowed
07-20-2004, 09:35 PM
i was going to make a nice simple patch for it, but ollydbg takes the OutputDebugString string and *printf's it twice. that means patching more than one location. and i don't feel like patching in jmp's to caves in more than one spot.

just trying to save someone the trouble if they want to fix it themselves and don't want to patch more than one spot (while keeping the intended functionality (as opposed to skipping output of the debug string))
disavowed
07-20-2004, 09:38 PM
and for anyone interested, the first vsprintf is at 0x0042E130 and the second is at 0x0045A630. both those addresses are for the most recent version of olly
lifewire
07-21-2004, 03:57 AM
maybe is this: http://www.cs.ucsb.edu/~jzhou/security/formats-teso.html
an interesting paper for those interested in the working of format string exploits
nikolatesla20
07-21-2004, 11:35 AM
I think I hear Chad Nelson breathing.....he's nearby....

-nt20


Sentinel sproQuery Again :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Sentinel sproQuery Again :(
PDA

View Full Version : Sentinel sproQuery Again :(

FoxB
07-19-2004, 12:50 PM
Hi ALL!

I am working on a target & i don't have the dongle as the many people.
My work is complete on 75%, i have:

1. Known Sentinel functions.

sproFindFirstUnit()
sproRead()
sproQuery()

2. Order of events:
from start - The decryption routine is defined. Recovering the 0x28c byte's of table.
1 - sproFindFirstUnit(Developer ID 0xD4E4) - patch, passed.
2 -sproRead(Words 0x30, 0x34, 0x38 ,0x3C, 0x00, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15) - patch, emulate, passed.
3 - sproQuery(), identify Cyberheg's GetQuery() & GetResponse() - patch, emulate, passed.
4 - sproQuery(), this time we need to handle GetQuery() & GetResponse() - two table defined, patch, passed.

5 - sproQuery(static query data 0xfb4c74b5) - code section.
Start address 401000, size 0x169222 bytes, correct result should be 0x7c01c3ef. Recovering the key ..... My brute force code enclosed, the size of the section is 1.6Mb's so very big
(two day - 0x221f83 pass of decryption from 0xffffffff on my P4 2.0GHz) - stopped, trouble.

6 - sproQuery(static query data 0xfba2ee13) - data section.
Start address CE6000, size 0x52000 bytes, correct result should be 0xe87c9b0e. Recovering the key is 0xdacc397f. Data section recovering OK.
Recovering of section was spent at the rate of, that the program is written on VC++ and first four bytes to section of the data is zero.

3. I have trouble with Recovering of code section.
I also read FAQ and all topic's, concerning to Sentinel Key and sproQuery. I not have solution. If anyone have solution, tell me please.

WBR
sope
07-20-2004, 02:30 AM
Hello FoxB,

Well, i can just guide you to this Sentinel Super Lesson which i learnt an hard way some time back. I suggest you to read it hope it helps.

http://www.woodmann.net/forum/showthread.php?t=4703

If you don't have demo you will have to spend time till you get the good key.

Good Luck, Sope.
HarmEr
07-22-2004, 03:09 AM
2FoxB
c answer on this question on hxxp://www.reng.ru/board/viewtopic.php?t=754&postdays=0&postorder=asc&start=0


learning idc
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > learning idc
PDA

View Full Version : learning idc

Hero
07-19-2004, 01:52 PM
hi
I'm too newbie in cracking app and I never need to use IDA Pro's idc.
But when I cracking a program I got the Algorithm too easy,But I can't
Disassemble it with IDA Pro.
The algorithm is the folowing:A very small Start routine that only have
two important commands:
1-A Push with a imadiate value setting that contain the starting address
of the real program body in data segment.
2-A RET,when you get RET because computer sturcture we will go to
return address,But with no address we will go to the imadiate value
that we set by Push.
With this algorithm IDA Pro can't disassemble this application usefully.
Now my question:
How I can write an idc for IDA Pro that Disassemble the application with
structure that I said?

sincerely yours
omega_red
07-19-2004, 04:54 PM
You can go to the push'd address and mark this location as code (hotkey 'C') - it should work just fine.


softice 4.0 trouble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > softice 4.0 trouble
PDA

View Full Version : softice 4.0 trouble

computerbum30
07-19-2004, 06:03 PM
Hello everyone,i'm new at this so hopefully you guys could cut me some slack.
I have softice version 4.0 installed,cannot get it to load.the screen comes and then dissapears.
My current operating system is windows xp professional.Will this program work with xp pro?
Woodmann
07-19-2004, 06:32 PM
Howdy,

There are some conditions you have been made aware of during registration.
Like most people, you did not read them.

search

-CBO-
JMI
07-19-2004, 06:35 PM
We can't cut you any slack unless we know you have read the FAQ in the BIG RED LETTERS at the top of the Forums and you tell us that you have searched among all the softice threads already on this Board and you did not find anything to assist with you specific issue. ;)

Using "softice AND startup" (without the quote marks, but WITH the capital letters) I got 45 threads already existing and one with the catchy title:

"SoftIce Just runs Once"

Now how about a little "self-help" as that FAQ suggests, or, if you actually did that, follow the FAQ guidelines by stating you have searched. :yay:

Regards,


Safedisc (v1) and ollydbg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Safedisc (v1) and ollydbg
PDA

View Full Version : Safedisc (v1) and ollydbg

digitalmerlyn
07-19-2004, 10:53 PM
I can't seem to get past the anti-debugger tricks in an older version of safedisc (v1.32.14 - I guess that's R4?) using OllyDBG.

Here is what I have tried so far:
1. changeing IsDebuggerPresent value
2. nop'ing "int 68" (which I'm not sure is even necessary)

I'm not sure what else to try. I've read quite a few tutorials on safedisc but all of the use softice. There are two things that the tutorials mention that I haven't tried:
1. hiding drivers (which is obviously SoftICE related and irrelavent in my case)
2. playing with the debug register

Regarding the debug register, it checks DR2 and NOT DR7. ArthaXerXes' safedisc tutorial mentions that the DR2 check doesn't seem to work. I've used IDA Pro to look at it and it seems, as he said, to not work correctly.

Any tips/recommendations as to which direction I should be heading in?
evlncrn8
07-21-2004, 10:12 AM
artha's tut is flawed in some places, im pretty sure it was a dr7 check, and if i remember right, riscs tool decrypted v1's fine, so analyse his code, sd1 is simple u just need to decrypt it and rebuild the api calls, no need to debug it using olly.. oh yeh and use softice+icedump
Mr. Kaka
07-31-2004, 07:13 AM
If you are running NT, the dr checks are located in the driver, secdrv.sys I think. Good luck. :devil:


Complexity of HASH algoritm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Complexity of HASH algoritm
PDA

View Full Version : Complexity of HASH algoritm

lordsoth
07-20-2004, 04:21 AM
hello,
I'm doing a research for an exam that I'll have on 25, I need to know (please give me som link if you know them, I wasn't able) what's the complexity in term of O(...) of SHA-1 and MD5, and even of TIGER.
If there're also some comparative with MD5 and SHA-1, that would be great. It's my last exam before graduation! please help me, thanks

lordsoth
lifewire
07-20-2004, 05:31 AM
i can't answer it exactly, but i GUESS that it is just O(n). seems the most logical one to me.
dELTA
07-20-2004, 05:44 AM
This is a strange question, because these functions always take a fixed size input for each iteration, and hence, their complexity is obviously always O(n), where n is the size of the total input (i.e. the number of iterations).

Please note the clear distinction between computational complexity (described by O-expressions as above) and running time / algorithmic complexity. SHA-1 e.g. has a little more "complex" algorithm than MD5 (in the meaning bigger, longer, larger number of instructions per iteration, but still not having anything to do with computational time complexity) and hence, with non-optimized implementation methods it will practically always have a little longer execution time than MD5, but this has nothing to do with computational complexity.

(Edit: Lifewire's reply wasn't there when I first viewed the original post and pressed the reply button, but as it seems, we have the same opinion anyway :))
lordsoth
07-20-2004, 02:10 PM
so I can't determine it exacly in any way?!?!?
I hoped to see some O(n)......O(n*logn).... sob sob :P
thanks anyway!
lordsoth
dELTA
07-20-2004, 05:08 PM
Again, the computational complexity (which is the kind of complexity that can be described with O-expressions) is "exactly" O(n). The algorithmic complexity can never be described with an absolute measurement like that, and absolutely not with any O-expressions. At most, you can describe it with a relative measurement for a certain machine code implementation on certain specified hardware platform.

Please try to understand this, since I have quite a strong feeling that this will help you a lot more on that exam than any execution time measurements for those hash algos...
mike
07-20-2004, 05:51 PM
If you mean, "what is the hash output size?": MD4, MD5, RIPE-MD and the various Snefru hash functions all have 128 bits of output; SHA-1 is a 160-bit hash; TIGER is 192 bits, but you can truncate it to 160 or 128 bits.
Peres
07-21-2004, 05:05 AM
I remember Knuth's first volume - Fundamental Algorithms - having a lot of stuff regarding algorithmic complexity estimates. Try visiting your favourite library.

Be warned: Knuth is Knuth. Nuff said.

Peres


How can I get an information for a certain thread?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How can I get an information for a certain thread?
PDA

View Full Version : How can I get an information for a certain thread?

dive2code
07-20-2004, 10:18 AM
Hi all,

If a certain thread is attached or injected in explorer.exe and I wanna get a virtual address of the thread, what to do in soft-ice or some other debugger?

I used a thread command within soft-ice, but it just showed me a TID & accetra.

I couldn't know which TID is matched with the thread what I want to debug.

Thank you for reading my question and forgive my poor english, cos I'm a not native speaker of English.

If you can't understand my point, plz feel free to let me know.
doug
07-20-2004, 12:42 PM
could you clarify what you mean by "get a virtual address of the thread"
dELTA
07-20-2004, 04:59 PM
I assume he means the thread entry point, which would be useful when detecting injected threads in applications... There is a new API in Windows Server 2003 to get this info, but sadly, they say that if you don't execute the API right after the thread is created (i.e. in a debugger, responding to the thread creation event), the returned info is "undefined". This makes me suspect that this info is not stored internally once the thread has started executing... :(

Does anyone know if this info is stored in any undocumented data structures, to be acquired anytime during the lifetime of the thread?
disavowed
07-20-2004, 08:05 PM
delta, afaik, the start-address is not stored anywhere

dive2code, i would recommend doing a global hook on CreateRemoteThread, so that you can see lpStartAddress's
dive2code
07-20-2004, 09:24 PM
Hi doug, dELTA, disavowed,

Thank you for your replies.

To doug : yes I mean a entry point. sorry for not enough explanation

CreateRemoteThread may be work in my case. I guess :p

I would try.

thanks again :yay:


question about armadillo packed dll & IAT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > question about armadillo packed dll & IAT
PDA

View Full Version : question about armadillo packed dll & IAT

lordsoth
07-21-2004, 01:43 AM
hi, I'm trying to unpack a dll protected by armadillo, don't know exacly what version, When resolving IAT, I found 3/4 pointers to this

0159AB19 jmp 0159AB1E
0159AB1E jmp 0159AB23
0159AB23 jmp 0159AB19

what should I do with that?? shoul I truncate it? for example one occurrence is placed between advapi32.dll and comctl32.dll

thanks a lot!
lordsoth
JMI
07-21-2004, 02:07 AM
Well, if you've actually been reading the threads and tuts on ARMA, you would be aware that ARMA has routines which find the address of many API's and construct jumps into the ARMA space to locate the actual API after it destroys the IAT. Perhaps it would do you some good to read some more on how this all works. There have been threads here and/or exetools on the ARMA routines which accomplish this process. It would, of course be a good idea ( :idea: ) if you checked exactly what is at each address, so you understand what ARMA is doing with its attempt to hide the "real" API jumps. :yay:

Regards,
stephenteh
07-21-2004, 09:06 AM
this is not a valid pointer.. u can cut it..
if u look carefully...u will noticed all 3 jumps is jumping at the same place...
lordsoth
07-21-2004, 04:16 PM
I know, but I need to know if those are useless one or had been hidden/modified by armadildo!
thanks
stephenteh
07-25-2004, 11:55 AM
it's useless, u will see this kind of pointer between 2 difference dll...


new article about ECC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > new article about ECC
PDA

View Full Version : new article about ECC

lifewire
07-21-2004, 06:22 AM
i found this article quite interesting:

http://www.deviceforge.com/articles/AT4234154468.html
Solomon
07-28-2004, 01:07 AM
The following Korean site is great for ECC lovers.
hyyp://cnscenter.future.co.kr/crypto/algorithm/ecc.html


Wibu dongle unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Wibu dongle unpacking
PDA

View Full Version : Wibu dongle unpacking

DongleGuru
07-21-2004, 01:37 PM
I have one target <program name removed>
I full dump the exe in presence with dongle with lordpe.
I found the OEP and Import table too.
I fixed the pe header and section.
Still when programm starts showing
General Error
FormatMessage()
Error code blah blah.
Then programm starts and then autoclose by the kernel error in msvcrt.dll file

I found the similiar software old version crack. I found that in crack there is one more .idata section in last with small size. i dont come to know its function. Should i need such section ?

Help plz.
Regards
D
CrackZ
07-21-2004, 02:06 PM
Hiya,

I've been doing some work on Wibu myself (actually its more of a theory verification project now), if you can fwd me the name of the target by private e-mail I'd appreciate it.

I apologise in advance to the 'management team' for this request, but I did read the FAQ and use the search facility and read the terms and conditions and throw a pinch of salt over my left shoulder ! ;-).

Thanks

CrackZ.
JMI
07-21-2004, 02:53 PM
What about clicking your heels and saying three times: "There's no place like home; there's no place like home; there's no place like home"? :D You do have the ruby slippers, don't you? :devil:

Regards,
CrackZ
08-15-2004, 12:07 PM
Hiya DongleGuru,

Many thanks for sending me your target.

This is really more a request for help or theory clarification rather than anything else since I unfortunately do not have a Wibu Key to test anything with. Hopefully others on the board have in the past or might care to send me one or can even satisfy my curiosity..... ;-).

Whilst researching the Wibu crypt function as used by the 'Wibu envelope', I found around the web a 'Reaktor Dongle Emulator', this is a wkwin32.dll replacement which actually implements the WkbCrypt function, theres a real caveat though, the one I found has 2 variables used in the crypt process (essentially 64-bits of data) which I am halfway confident is a FEAL key used on a per customer basis.

I don't know where this 64-bit key is obtained from, but 2 ideas seem probable :

i) It might simply be sat on board the dongle and can be 'read out' by looking at the Wibu communication protocols (this seems the least likely to me), or /

ii) The key is actually computed from the FirmCode and/or UserCode (on board), perhaps the algorithm that does this transformation can or has been recovered, I haven't looked since if they've done it halfway right, it ought not be visible.

Unless the 64-bit key can be recovered, I consider breaking the Wibu envelope as pretty much an impossibility.

Sorry to re-incarnate a fairly old thread.

Regards

CrackZ.
FoxB
08-16-2004, 10:02 PM
Hi ALL!

WIBU-KEY SDK includes text file Wkfirm.wbc which allows you to make "WIBU Envelope" not having a key. With FirmCode 10 or 250010.
I have WIBU key for FirmCode 10, ready to help you in un-enveloping.
PM me if need.

WBR
friedo
08-24-2004, 02:04 AM
... I found around the web a 'Reaktor Dongle Emulator', this is a wkwin32.dll replacement which actually implements the WkbCrypt function, theres a real caveat though, the one I found has 2 variables used in the crypt process (essentially 64-bits of data) which I am halfway confident is a FEAL key used on a per customer basis.

...
Unless the 64-bit key can be recovered, I consider breaking the Wibu envelope as pretty much an impossibility.

Hi.
Is this "Reaktor Dongle Emulator" a tool for emulating a Wibu Key or just a crack for a program called "reaktor"?
I think this dll replacement is exactly what i need but i did not find in the net. Because my interest is to emulate the wkbcrypt function without a dongle! Please can you give me more information about place for download?

For the Envelope:
You need original key otherwise forget it. If you have original key you can debug or use an own function after finding firmcode and so on to decrypt exe.
monguz
08-24-2004, 05:32 AM
try with dis hint...

... Zone's Reaktor 3.05 emu for Reaktor 4
------------------------------------------
Take wkwin32.dll and drop it in c:\windows\system32 folder and overwrite
wkwin32.dll (136kb). This will allow you to load the old Reaktor3 ensembles as well as the new.

Found at:
umt.pl/index.php?showtopic=658&view=getlastpost

Greets monguz
friedo
08-24-2004, 05:44 AM
Thx, but not thas what i am exactly searching for.
The question is if the cryptalgorithm of wibu is already reversed and if you only need a *.wbc file to create an envelope without a dongle it seems that the algo (wibu offers fast algo = crypto on pc with key from box and slow algo = crypto in box) could be found in that dll.
crackz wrote that there can be add some firmdata in form of a special file to that dll so may be it´s already an emulation of the cryptosystem...
i do not need that for the program called Reaktor but it´s interesting if it´s solved in that way i am interested in...

regards,
friedo


Nice trick to hide Olly to most controls..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Nice trick to hide Olly to most controls..
PDA

View Full Version : Nice trick to hide Olly to most controls..

Shub-nigurrath
07-22-2004, 02:51 AM
Hi,
try this method for hiding Olly (it should work on Armadildo also)..I found it elsewhere: credits goes to DaGoN

----------------------------------------

1. install Olly in a subfolder (e.g. c:\dildo\0llyDbg). Note that there's a 0 -zero- in the place of the 'O' of Olly

2. Open Ollydbg with winhex or another hex editor and find for this sequence
20332E31004F6C6C79446267 then substitute the O of Olly with a zero '0' (e.g. 0llyDbg)

3.find again for 6E7570004F6C6C79 and substitute the O of olly with a zero.

4. find again for 6F6C6C796462672E657865005F416464736F7274656464617461 and still do as before.

5. Rename the file Ollydbg.ini as 0llydbg.ini (there's always a zero instead of the 'O')

6. change the following parameters in the 0llydbg.ini to point to the current folders
"Symbolic data path", "UDD path", "Plugin path"

7. To allow plugins to be loaded now you have to open each one with WinHex and to find the string "OLLYDBG.EXE" then replace the 'O' with a zero.

In this way most of the unpackers as also Armadildo will not still identifies Olly as Olly but as a generic debugger, so the only protection remaining are those not specific for Olly...

NB. I tested these byte sequences on version 1.09d and 1.10, but the concepts is the same for any other version of Olly (after having pasted them into WinHex you'll see which is the textual corresponding meaning)

cya
SvensK
07-22-2004, 07:18 AM
Thanks for sharing.
TQN
07-23-2004, 05:24 AM
Thanks. I think this can be added into my plugin.
Shub-nigurrath
07-23-2004, 05:31 AM
your plug, which one?
TQN
07-23-2004, 10:26 PM
I am rewrite the Delphi Plugin and OllyDbg Plugin SDK for Delphi. I am busy now and need more time to finish the plugin.
nikolatesla20
07-24-2004, 08:42 AM
It would be good if you made the plugin to randomize the names.

-nt20
TQN
07-26-2004, 10:34 PM
Thanks for your idea, nikolatesla20 !
I will make it. But now, I am busy with a .NET project and a IDA Delphi 6, 7 RTL Signature. I will release this signature on this week.
TQN
proletsearch
07-30-2004, 05:30 AM
Does anyone had success with this trick? Because it seems not to work for me, after doing exactly what is explained above.. :-/
Shub-nigurrath
07-30-2004, 09:46 AM
for me it's working, I tested accurately before posting on the last 1.10 version of Olly..what doesn't work?
proletsearch
07-30-2004, 03:18 PM
I do not say that it's not working at all - but for me it's not..

It does not work with ASprotect latest...- I haven't tried it with Armadillo, maybe this has something to do with my OS ( winxp sp2 beta)... :thinking:
JMI
07-30-2004, 03:46 PM
winxp sp2 beta is reported to break alot of software. :boo: And WHY are you running sp2 beta anyway. :thinking: Just because some beta version of software has been release, doesn't mean everyone should install it, and if one does, one should EXPECT problem. That's why they call it "beta." :idea:

Regards,
proletsearch
07-31-2004, 02:20 AM
@JMI - bacause I am a Beta-tester...
And there is a much smarter way to hide the debugger, which works for me :yay: but it seems that you can use the trick posted by Shub-nigurrath, so It's not needed to tell you..
tDJ
07-31-2004, 03:53 AM
Thanks Shub-nigurrath. Nice trick. I tested it on jv16 PowerTools v1.4.1 and it works. :)

But what about number 7:7. To allow plugins to be loaded now you have to open each one with WinHex and to find the string "OLLYDBG.EXE" then replace the 'O' with a zero.Do you mean changing the string in the plugins itself? I did not and all plugins worked too. :confused:

EDIT: I know already why it worked without changing the plugins. If you have both 0llydbg and the original Ollydbg.exe in the same dir, it works :). When I removed the ollydbg.exe I got a lot of errors when starting 0llydbg.exe. When I put it back, anything works well and the program is still hidden. ;)
Shub-nigurrath
07-31-2004, 07:13 AM
Hi,

2 tDJ
the change of string inside the olly plugins is simply because they are searching for ollydbg.exe which shouldn't be anymore there..remove because some tricks seek for a file called Ollydbg.exe and if present in the folder, it vanishes the trick..renaming the plugins string as I said allow 0llydbg to still loads all the plugins correctly.

2 proletsearch
It's strange that's not working 4 U? Consider that the trick only hide Olly as being Olly and not as being a debugger, if you understnd what I mean..after the trick you have to apply also normal generic debugger tricks...
Anyway you are mentioning also a lot of other tricks you know..I'm collecting for a thing I'm writing all the possible specific Olly tricks available around..plz can you post them here or PM them to me, just for completeness...it might be interesting..

cya
tDJ
07-31-2004, 10:06 AM
Search and replace for all 12 plugins at once was easily done by PowerGREP. :)
disavowed
07-31-2004, 09:39 PM
Search and replace for all 12 plugins at once was easily done by PowerGREP. :)
too bad powergrep can't search for unicode text (without having to write it out in hex with 0x00's) :(
cRk
08-01-2004, 05:11 PM
Search and replace for all 12 plugins at once was easily done by PowerGREP.

for those who use 0lly and would like to easily implements this tricks.. you could also make a generic byteshunter patch with Codefusion and make it *.* .. so it could be possible to browse the target and will work with any plugin or extra files this great debugger use... this is just a little tip. :eek:

Regards
Shub-nigurrath
12-13-2004, 12:17 PM
you can easily do everything using a bat file using this nice unix style utility

gsar - General Search And Replace utility
http://gnuwin32.sourceforge.net/packages/gsar.htm

it's an excellent utility and its sources are easily modificable..


Need some help with olly script
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need some help with olly script
PDA

View Full Version : Need some help with olly script

Qwertos
07-22-2004, 11:38 AM
im a lil new to olly script so i wanted to ask how to set in the script conditions , like in olly for ex:
if i want thet olly will break on cmd like JMP EAX how i write it in the script ?


universal brute force tool
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > universal brute force tool
PDA

View Full Version : universal brute force tool

Boris
07-22-2004, 11:50 AM
Hi, I can`t imagine I`m the first who had this idea, but I would like to ask you what you think about it :
I`d like to develop a universal brute-force tool to get serialnumbers for programms protected with name+serial or serial-only protection.

1. Create a process with the debugge with set DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS flags
2. let the debugge run to the point the serial ist read in and find out the adress where the serial is placed in memory.
3. store the thread context
4. try serial 1... n dependent on how long the serial number should be,
casesensitivity ...., by writing the serial to the adress found out in step 2
5. let the programm proceed, while logging its progression ( fe. jump adresses till the occurency of a special event f.e. a message box, a special number of jumps ...
6. the result is a logfile with serial numbers and what they affected ( jumps..)
7. I would guess that there is a big part of serials which affected the same reaction of the programm, these might be invalid serials, the rest should be analysed.

Please tell me what you think about it, I have good experiance in coding, but just little in cracking, so I can`t appraise wether such a programm would deliver useful results.
doug
07-22-2004, 12:22 PM
ok first, let me reassure you, you're not the first who had this idea,
the idea of patching a target such that it bruteforces itself is used frequently. You don't need to have a tracer for this, you just have your bruteforcer stop when it's at "good_serial" location

Besides, this method can't be applied with any more generality than the others. Coding something that finds where the serial is entered & checked is something you won't achieve. There are no auto-cracking tools.
doug
07-22-2004, 12:28 PM
In case you want more input...

Bruteforcing usually takes an enormous amount of time.

I don't know if you have experienced with tracers ("logging progresssion") before.. but usually, the performance difference is usually huge. (tracers being slow)

So tracer+bruteforcer combined = you'll be dead before it's done bruteforcing 1 simple serial.
Boris
07-22-2004, 05:56 PM
Ok, the time bruteforcing takes is something I was concerned about. Is it common programmers stop threads for short moment to be protected againts this kind of attack ?
I just thought if there ist a wait(..) call in a serial validation algo which causes a delay of 1 sec for each serial and the serial consists of case not sensitive letters would it take + the numbers 0..9 it would take
1,54 * 10^39 years to check all possible serials - :thinking: .... :boo:
But I think I `ll try to code something like that anyway ... just for fun
evlncrn8
07-22-2004, 07:48 PM
you're doing it the hard way, trace, find the algo like doug said, remove any delays like you mentioned the wait(..) thing, rip the algo out, make your own bruteforcer.. which will be considerably faster and probably easier, do something more creative and fun.. course, you'd also be better off tracing the algo, finding where it validates the entry, reverse the algo and use the key.. ;)


Aspr Exception Handler Emulation notes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspr Exception Handler Emulation notes
PDA

View Full Version : Aspr Exception Handler Emulation notes

Uradox
07-23-2004, 10:45 AM
A While ago i promised these documents i wrote about aspr's 1.3 exception handeling feature...this feature since hasnt really hit off since theres not a lot of exe's it can protect with this and those it can often crashed (from my tests) I noticed in a app recently there was some code relivant to this handler tho it was not used or complete from what i could tell...
So here those notes are. Somewhat not very well commented but they were written during 'runtime'
How to patch notes dont seem to be around but its really not that hard, when u read the table u just apply a common call/jmp distance calculation to it etc..

I'v lost the table fixer tool alltogether due to a HD failure at the time so if anyone has it (i know i gave it to a few ppl) post it here for those interested.

Sorry if this post has broken any rules i did look in the FAQ breifly.
Now i go back into my nest and hide =)
crUsAdEr
07-23-2004, 06:41 PM
Hi Uradox,

Thanks for the notes but they are more or less old stuff i think... i looked at aspr1.31 and most of these info are irelevant... except some interesting comments you made alongside the codes...

Just wondering where you ripped the code from? The aspr.dll embedded in each protected exe or are some of the code from the original asprotect.exe itself? The current nanomite in aspr is more interesting and subtle, though basically it is still the same as what you describe...
Uradox
07-24-2004, 01:22 AM
its from the aspr dll.
Parts are generated per application too so some code i described is not the same in all applications. Newer is simular just small changes in methods for it.. still uses the table still same format from what iv seen but I dont look deeply into it anymore.
Old yes.. it was something i did around nov/dec last year when it surfaced =) thought it may have been of some use for some other ppl.


Softice 4.3 Breakpoints Not Working
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Softice 4.3 Breakpoints Not Working
PDA

View Full Version : Softice 4.3 Breakpoints Not Working

Medic
07-23-2004, 04:33 PM
Hi,

Am trying to discover the install password on an exe prog.
Have looked at Import functions using WDasm and found that it called MessageBoxA

Set a breakpoint in Softice BPX MessageBoxA and gone back to installer. Click OK after entering password but Softice doesn't pop up?

Have tried HWND but Softice reports "Unable to find Desktop Window"

I've read that there are problems with breakpoints on this version of Softice..
Any suggestions really appreciated.

Thanks,

Medic

Operating Sys: WIn XP Sp1
Cracking Tools: W32DASM, Softice v4.3 (Full Driver Suite v3 installed)
Program: <program name removed>
ZaiRoN
07-23-2004, 04:42 PM
Hi.
Take a look at this incredible guide: how to start!!! (http://www.woodmann.net/fravia/rce-faq.htm)

Good luck,
ZaiRoN
Medic
07-24-2004, 03:33 AM
HI ZaiRoN,

I had read lots of other posts about breakpoints and XP on this forum and had read the insturctions on posting (sorry for posting the prog link).

Volodyas advice about setting BreakInSharedMods on is not recognised by the current version of SI, and I followed nikolatesla20 advice on setting NTSYMBOLS=ON but that doesn't help.

I tried updating the symbols for ntoskrnl.exe thinking that might be it but the System Retriever does not connect to the microsoft server (think this is a Numega bug). I cant find a copy of ntoskrnl.pdb to use symbol loader either.

Finally I followed advice on Numegas help about updaing osinfo.dat (they have a ftp download especially for XP SP1) but this stops SI loading at all..

The last prog I cracked was on 2000 SI v3 and everything used to just work but I cant even start without BPs working.

If I type U MessageBoxA code appears which makes me think SI can see it and I've tried ADDR [progname] before setting thr BP but that doesn't work either.

Thanks again for your help, I anyone can add to other things I could try I'd really appreicate it.

Medic.
ZaiRoN
07-24-2004, 05:35 AM
Hi.

With DS v3, to set a breakpoint over MessageBoxA (or any other function) you have to be in the process context. The simple way is to use softice symbol loader; try to run the program from the loader and when it breaks over the entry point, put your bpx.

Have tried HWND but Softice reports "Unable to find Desktop Window"Use the command PROC; proc command without parameters shows information about all processes that are running in the system. For every process you will see some fields, you need the first one: the process name that you will use as a parameter of another command: hwnd.
Type 'hwnd process_name' and you should be able to see all the informations you need.

Good luck,
ZaiRoN
Medic
07-25-2004, 06:13 PM
Hi ZaiRon,

Thanks for the last tips! It really helped.
Turns out that Softice WAS working correctley and the symbols were a red herring too!

Could'nt see the point of using PROC as I already new the exe name and was just setting ADDR [exe name] and setting BPXs on eveything WDASM said the exe was calling.. This resulting in no response from SI, a bit of head scratching and then I used PROC and saw a strange proc name. The format was is-Txxxx and it changed each time I ran the exe. So I set my ADDR contect to is-T0HKJ and bingo, bpx messageboxa worked every time.

But once in SI the code did a JNZ (not taken) before a direct call to the wrong serial window.... Tried patching the JNZ but still end up at the wrong serial window...

is-Txxx is a .tmp file that seems to contain the origonal exe code and some extra bits copied from user32.dll.
Had a search about the forum for ideas of what this might be called and found volodya having similar behaviour with Installsheild MSI files. This is just a crappy little exe prog and I cant believe that they went to much trouble to protect it....?

Any suggestions on how to proceed??

Thanks allot,

Medic


Ice License (delphi)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Ice License (delphi)
PDA

View Full Version : Ice License (delphi)

Slider
07-23-2004, 09:58 PM
hi, i my first attempt to crack was a program (Name Deleted) that probably uses this protection(that´s what a plugin from PEiD said (units browser)... anyone knows it? is it possible to crack it? other question: anyone knows what these functions do?

LStrFromChar,StrToInt

It looks obvious, but i´m very confused in this part of code,cuz i´m using trw2000 once sice isn´t working, and just to curtail:

(in sice)
bpx 017F:0066A110 is ok right?

and is there a bpr for trw2000???

thanks and sorry for the english... :)
Aimless
07-23-2004, 11:55 PM
Hi there,

You are using 2 wrong approaches.

1. Name Deleted is not a easy serial/time application that can be easily cracked. Since you are not aware of even the rudiments, I'd suggest you begin by hitting Winzip v5 and upwards. MIRC v5 and upwards will also do.

2. You need to go to the borland site, into their public folders, and download the winhlp32.zip file. This will tell you the meaning of all the functions such as LStrFromChar and StrToInt etc. If you find (and you will, as you go further up the tree of reversing) that the info may not pertain to the more newer levels of OS. For that, feel free to go to MSDN collection (www.microsoft.com) and search for the API. Simply putting the API in the search box in the home page of the site will get you matches that should keep you busy.

And who uses TRW nowadays? Use ICE or Ollydbg or Microsoft Debugger with the LiveKD extension available at www.sysinternals.com

Have Phun
JMI
07-24-2004, 01:19 AM
Slider:

READ THE DAMN FAQ linked in the BIG RED LETTERS at the top of the Forums. Our Rules PROHIBIT posting TARGET SPECIFIC CODE if you IDENTIFY THE NAME OF THE TARGET. :whoops: :boo:

Get with the program and follow the Rules. :idea:

Regards,
TQN
07-24-2004, 05:02 AM
LStrFromChar,StrToInt are functions in Delphi Runtime Library. If you have Delphi, you can go to Source\RTL directory, open file SysUtils.pas and see the Object Pascal source code of two above functions.
Slider
07-24-2004, 08:46 PM
hey aimless, thanks a lot dude! and JMI sorry... it won´t happen again... :D
JMI
07-24-2004, 09:01 PM
That's all we ask. :) You got unloaded on because it has been happening alot lately that new registrants fail to read the FAQ and immediately begin to break the rules. This one is designed to help keep the software police off our "you know what" and from trying to convince our SP to shut us down.

Regards,
HaRdLoCk
07-26-2004, 12:51 PM
if its really ice license this sig file for ida might help you.


c compiler/linker and snippet creator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > c compiler/linker and snippet creator
PDA

View Full Version : c compiler/linker and snippet creator

homersux
07-24-2004, 09:10 AM
is there a compiler/linker that can generate binary image relocated at arbitrary memory address? in vc, #pragma comment (linker, "/BASE:address) only allow address to be 64k aligned. I want to have something more flexible. Consider if the following function is the first function in a file:

int y = 0;
int foo(int x){
y = x*3;
return y;
}

the generated binary code most likely is this:
00401000:
push ebp
mov ebp, esp
mov eax, [ebp+8]
imul eax, 3
mov [00410342], eax ; 00410342->y
pop ebp
ret

Is it possible to force y and a bunch of other variables to be generated in a segment starting, say 01007600. Yeah, it's closely related to my notepad mod project. I also got a handcrafted notepad working with colors. But it was major pain to relocate the global variables (cannot use stack because they are global) everytime I recompile. Another approach would be to code the entire thing in assembly but there is still relocation problem. You'll have to either hardcode in the address youself or trying what I am trying now: is there a way to tell linker where a portion of code or data should start in memory.

I am having trouble with snippet creator, the code cannot be assembled. The temporary .asm file doesn't seem to be a valid assembly code.
lifewire
07-24-2004, 11:51 AM
i don't think that it is possible. but maybe you can do this: the .obj's generated by the compiler contain fixup tables for relocation. you can code a parser for those tables which automatically relocates. it is a very simple job, i coded it when i was a real newbie.
dELTA
07-24-2004, 03:20 PM
Or you can create a macro that inserts 0-64k nops/junk data in front of the object you want to exactly specify the address for, hence complementing the 64k-only align option in the VC compiler, effectively going around it and making it do the job for you after all. :)
homersux
07-24-2004, 07:52 PM
another way to circumwent this problem is to have
a function body taking up arbitrary length in a C code,
that's pretty hard to do as well. In asm, it's easy.
dELTA
07-25-2004, 05:56 AM
Isn't that sorta kinda what I said? :) And if you use macros with inline asm, which should be no problem in vc, it should not be hard to do directly in the C program either, should it?
doug
07-25-2004, 11:04 AM
I don't understand why you would go through that much pain, really.

How much code do you want to relocate?
When I want relocatable code, I either code in ASM something that uses no absolute addressing OR
I program a DLL.

You probably want to code a DLL and use the .reloc section to rebase your code wherever you want. (You can add any kind of delta offset, not just image bases - as long as its the same delta you add everywhere). Parsing the .reloc is very easy. Use the PECOFF.pdf document for that matter.
dELTA
07-25-2004, 06:06 PM
Yep, that would be the next thing I'd suggest, but I'm not completely sure I agree that writing a program that parses reloc-data and patches the code is less work than adding one compiler directive and a macro of a few lines to the source code, and then having the compiler/linker doing all the rest for you. ;)
doug
07-25-2004, 07:03 PM
I think a .reloc parser is something you will use a lot. For example if you have to inject a large amount of code in your unpacked targets, and (obviously) it's never at the same VA; then you'll code a DLL, inject the code+data & relocate them using the reloc table that's been prepared for you already.

Writing it once is not wasted time.

Besides, parsing relocs is extremely simple. You don't need to get fancy; two nested while loops. We're talking about 25 lines of asm code - maybe 7 in C.
homersux
07-25-2004, 08:11 PM
Worth a shot, I'll have something hopefully ready by the end of this week. I'm gonna think it over how to do it well. Any existing tools out there for this purpose?
dELTA
07-26-2004, 06:24 AM
There is a tool called ReloX by MackT, which can mess with relocations. You can find a link to it on CrackZ's news page (http://www.woodmann.com/crackz/Whatsnew.htm).
homersux
07-26-2004, 09:55 AM
delta, it's easy to say but diffcult to do it with the compilers. I have tried to use compiler directives
and macros, but they don't seem to work well, at least not with VS 6.0

Show me how you can relocate my example code snippt with just compiler directives and macros,
relocate code to 01007700, and relocate y to 01007600(ideally, but this seems really bizzar for a compiler to have data in code segment, so i'll relax this to 01008000).

I'd love to see how anyone can do that without modifying the binary code.
dELTA
07-27-2004, 06:24 AM
I can't drop any exact example off the top of my head, I just know that is should be theoretically possible the way I say above, sorry.
Peres
07-27-2004, 01:34 PM
Hi! Nobody remembers of the old .org assembly directive? Am I completely dejected?
doug
07-27-2004, 10:12 PM
:yay:
but you then you still need to know where it's going to be loaded at, at time you are building it. For homersux' problem though, it's probably the best solution.
homersux
07-31-2004, 10:16 PM
please read my post in mini project regarding changing notepad's color. I have included a couple tools that will make projects like this much easier in the future, alone with the source code for patching.


Deferences between Debug and Release in IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Deferences between Debug and Release in IDA
PDA

View Full Version : Deferences between Debug and Release in IDA

Hero
07-25-2004, 12:19 AM
hi
When we build an application in visual C++ we can set build mode
to be "Debug" or "Release".In "Debug" mode the file contains some
additional data that shows the used names such as function names,
variable names,etc.
I want to know how we can set IDA Pro to use this additional data in
"Debug" mode to show the real name of subs,etc.
Is it possible?If yes,How?

sincerely yours
JMI
07-25-2004, 04:18 AM
Well, first you have to find someone stupid enough to release software which still contains the debug information and then you have the advantage of knowing alot more information "that shows the used names such as function names, variable names,etc." I would thing the advantages of that are "ovbious" and that you really don't need someone to tell you how that might be helpful in reversing the program.

However, as a practical matter, it will be rare or never that you would find such information in commercial software. Certain checked builds aside.

Regards,
doug
07-25-2004, 10:43 AM
For microsoft compilers/linkers, I believe the debug information is all contained in an external file (the PDB). So unless you have it, you don't have more debug information.

Of course, in debug mode, the file is a lot larger. But if you disassemble it, you'll notice it's not optimized at all, and it contains a lot of debug traps to facilitate the use of a debugger and various debugging utils. (esp pointer checks, stack variables 0cch'd, etc..)

Use Edit->Plugins->Load PDB if you have the PDB file.

(it's also possible to produce a .pdb in release mode)


Seems like Arma detects virtual PCs..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Seems like Arma detects virtual PCs..
PDA

View Full Version : Seems like Arma detects virtual PCs..

Shub-nigurrath
07-25-2004, 06:47 AM
Hi,
reading out it seems that the new versions of Armadildo added a trick similar to the one posted here

_http://www.swissdelphicenter.ch/torry/showcode.php?id=1819

which allows to detect execution on a virtual machine..
Iwarez
07-25-2004, 02:52 PM
What would be the good of that? Why shouldn't I be able to run a program under a VM? It's some valuable time they took that they should have put in their protection.
dELTA
07-25-2004, 06:12 PM
Most likely to avoid people easily circumventing any trial period limitations that leave persistant traces on the computer to prevent reinstallation as a means to reset the trial period. So, that makes it part of the "protection" that you thought they should have spent that time on indeed. :)
Iwarez
07-26-2004, 01:19 PM
Well, I think the number of people using a VM to run trial applications is almost equal to nil. As such it's a waste of time ;)
Shub-nigurrath
07-26-2004, 03:38 PM
It's a thing that's starting to be used: crack on a virtualPC the program just to not dirt the real pc with most times useless (4 the cracker) programs..
MrAnonymous
08-17-2004, 01:51 AM
For Mac Users for example, there only way to run win progs is through virtual pc so doing something stupid and pointless like trying to detect virtual machines as a 'cracker tool' or alike is just bound to piss loads of people off who validly use them.
Well, I think the number of people using a VM to run trial applications is almost equal to nil. As such it's a waste of time ;)
Hopcode
08-25-2004, 10:55 AM
Arma (and other protectors) detect virtual machines and don't use some of their protection tricks when they are not compatible. that's all.

Please don't say bullshits when you haven't any single clue about what you are talking about.

Thanks.
JMI
08-25-2004, 11:14 AM
Alright, let's not make the comments about the individual (unless it's me teasing my friend dELTA :devil: ). If you want to criticize the validity of the information, that is one thing. We don't want this to be a place for flame wars. :yay:

Regards,


PVDasm 1.5c
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PVDasm 1.5c
PDA

View Full Version : PVDasm 1.5c

Bengaly
07-25-2004, 07:22 AM
- Reported bugs fixed
- New additions to the MASM wizard.
- MMX code (users without it report to me)
- and more

complete listing here: hxxp://pvdasm.anticrack.de/ReadMe.txt

download latest build: hxxp://pvdasm.anticrack.de/index.php?Section=1

enjoy,
regards
bengaly
Kayaker
07-26-2004, 10:37 PM
Hi Bengaly,

Nice project, as usual. I had a look at it today to see how you incorporated a hex editor, since I was just about to look into doing the same. After half an hour of reversing, checking out RAHexEd.dll, and wondering how tf you did it, I finally read the help file. As they say, when in doubt read the instructions. Thanks for the heads up on the RadASM module. :)

Just curious, have you looked into how easy (read difficult) it might be to analyze and include associated debug data (pdb/nms)?

Cheers,
Kayaker
Bengaly
07-27-2004, 05:30 AM
hi Kayaker,

thanks for checking out my little project.
i have also submited a vc6 example to KetilO (RadAsm's author) on how to implemant the RaHexEdit (can be found in his webpage: hxxp://radasm.visualassembler.com/projects/CustDemo.zip)

i haven't checked about pdb/nms yet. (but i did read about it once).
i'll check it as soon as i'll get to it.

regards,
Bengaly
homersux
08-01-2004, 10:02 PM
There seems to be some bugs with this version,
1) it does not load all executible sections
2) it cannot close a file (unmap from memory)

the disassembled assembly contains too much text information, i.e.
mov eax, dword ptr ds:[esi+4]

maybe better written as
mov eax, [esi+4] (concise and probably more readable imo)

I do personally would like to see a better version of HIEW (i use it daily but its interface isn't really that great although
it really does its job well). I'd like to see pvdasm geared
towards a specific functionality instead of reinventing the wheels because at one point, the knowledge is there, it's just how well can u make a tool.

pvdasm is certainly useful, I do use it from time to time (filemap.exe it was called :), one thing I would like to see is to have a close file option to completely remove it from mmap so other editing work can be done, or maybe you could make a copy of the mmap and close the original one , because with a file opened in pvdasm, it cannot be editted directly.
Bengaly
08-02-2004, 04:26 PM
heya homersux :)

"he disassembled assembly contains too much text information, i.e.
mov eax, dword ptr ds:[esi+4]"

yes, but i peronally think it is better readable like, but
it is more likely a programmer's own choise, there isn't bad or not bad way to present it.
but mabye i will be able to add a feature which the user can select whatever he want to see more/less about the assembly. (i'll see what i can do)

"it does not load all executible sections"
care to bring example infront of me?

"it cannot close a file (unmap from memory)"
actually its not a bug, i just didn't add it. :) , i'll work on it.

"I'd like to see pvdasm geared
towards a specific functionality"
what more specific functions should you think to be added?, i did add Masm Source Code generator Wizard for example, plugin system..etc
well, i alweay said i would gladly take any new ideas to be added.

"pvdasm is certainly useful, I do use it from time to time"
glad to hear, i always stated that pvdasm can be used wisely if other tools can be played among, it does not exist to replace or to outlast any existing tool.
it brings out a variant options to the community.

"(filemap.exe it was called)"
haha :) yes, actually i had VS6 to generate filemap.exe every time, because pvdasm was in the very begining a test about memory maped files :D, but now i changed the VS6 generation settings :)

i do promise to do the best to keep pvdasm worthwhile.
homersux
08-03-2004, 04:35 PM
if the code has multiple text sections, pvdasm only picks up the one that has code entry or starting with ., you can experiment by creating new code sections. Try this dll(rename .txt extension) i uploaded here.

As i said, something like a better version of hiew will definitely attract a lot of user. We all know how useful hiew is.
Bengaly
08-04-2004, 07:06 AM
hi homersux,

ah, you mean the HexEditor control..
this is not my control, it belongs to the radAsm project coded by KetilO.
the hex editor in pvdasm is a custom control where all functions belongs to the RAHexEd.dll


Need bruteforcing tutorial?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need bruteforcing tutorial?
PDA

View Full Version : Need bruteforcing tutorial?

highenergy
07-25-2004, 05:07 PM
Hi all there,
I am a beginner level learner. I heard a lot about bruteforcing but din't know anything about it. Can you suggest me a beginner level tutorial which deals with how to write bruteforcing code in asm and how to insert that code inside any target?

:loveu:
JMI
07-25-2004, 05:20 PM
Welcome to the Board. Now the FIRST thing you need to do is back-up a step and notice those BIG RED LETTERS on the opening page. Within that sentence you will see a reference to the FAQ and the comment that you should actually read it and search before you post. But you were in such a hurry to ask your question, you just blew right on by, now didn't you. :whoops:

So, time to go back and actually read the FAQ and learn how things are supposed to be done around here. :idea: Try using the SEARCH button at the top of the Forums, as is suggested by that FAQ, enter the word "bruteforcing" (without the quotes) and you will find several threads discussing this issue.

If you "wannabe" a cracker, you have to learn how to search the net. If you don't know how to do that, there is a link to a site know as "Searchlore" which is run by the original founder/inspiration of this site. There you will learn how to search more effectively.

However, this is not a difficult search topic at all. Just go to your favorite search engine and enter; "bruteforcing and tutorial" (again without the quotes) and you will find plenty to read, including several tutorials included in some of the collections linked at the bottom of these Forums.

Regards,
highenergy
07-25-2004, 11:12 PM
I've looked all the web but could't find the info all looked for. There're some tuts but none of them beginner/newbie level.
Aimless
07-25-2004, 11:58 PM
Why don't you try searching Google with the words:

Icezelion Tutorials

You should get some good tuts on the asm/C++ part. They even have a phorum for that sorta thingy.

Have Phun
JMI
07-26-2004, 12:23 AM
And you couldn't possibly have "looked all the web" and found no "beginner/newbie" tutes using the search terms I gave you. The second in my search results is a tut which resides on our own server.

Tutorial #1TUTORIAL #1 Published by +Tsehp. ... INTRODUCTION: Today we are going to learn how to make a crappy bruteforcing keygen type thingy for a high end app. ...

www.woodmann.net/krobar/beginner/193.html

Notice the word after "krobar."

There is also this one, also on our server, but here reference to a copy elsewhere:

http://fravia.anticrack.de/along_01.htm

Now if you mean a tut written for someone who doesn't know squat about assembly language programming, then you really are only talking about a tut on how to use a bruteforce cracking program somebody else wrote for you, because that would be pretty mych the limit of what your skill set would be, and again those can be found on the net.

Regards,
highenergy
07-26-2004, 11:58 AM
I've already found that links when I searched the web as already said before. Anyway thanks for fast replies.
:loveu:


Windows message constants
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Windows message constants
PDA

View Full Version : Windows message constants

Hero
07-26-2004, 12:36 AM
Hi All
I am trying too crack a simple application.but I need some help.
I know that we can handle a specific windows messages in Application,
by setting a simple conditional breakpoint.But I want to know the
windows message constants(for example WM_PAINT).Where can I
find the list of Windows message constantsValues (I mean for example
111h is WM_COMMAND value)?
I can't find it in MSDN (perhaps I couldn't).

sincerely yours
ZaiRoN
07-26-2004, 03:55 AM
Hi.
There is a file called Windows.inc, that comes with masm package, containing all these values. I don't have it on this machine but, if you want I will attach it here later.

Regards,
ZaiRoN

ps. WM_PAINT = 0Fh :D
shadz
07-26-2004, 05:12 AM
softice also has an online list accessible by typing wmsg
and ida has a partial list as part of its enumaration libraries.

alternatively, one of the standard windows header files should have the complete list...

-Shadz
Hero
07-26-2004, 06:53 AM
Thanks for help. :yay:


Finding windows Handle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Finding windows Handle
PDA

View Full Version : Finding windows Handle

Hero
07-26-2004, 07:12 AM
Hi
Do you ever see simple programs that find real text value of an masked EditBox (for example by *) by pointing cursor on it?
This program have made me this question:
How we can find the handle of Window that we point it by cursor?
Is it possible?

sincerely yours
Shub-nigurrath
07-26-2004, 07:39 AM
use the VC++ spy tool, which can be installed on its own, but there are plenty of such things..
sna
07-26-2004, 08:36 AM
Using the Win32 API: GetCursorPos/WindowFromPoint/ChildWindowFromPoint

Regards, sna
Fake51
07-26-2004, 08:36 AM
Hmmm, probably thru input focus. You can trap systemwide messages, and see where they go. I don't think inactive windows get sent keyboard messages, and probably not mouse messages either (can't remember exactly).

Fake
highenergy
07-26-2004, 12:07 PM
I just would like to add this little info. Iczelion already did it with a working example. Look at Tutorial 24:Windows Hooks at www.win32asm.cjb.net
Silver
07-26-2004, 02:39 PM
http://www.codeguru.com/Cpp/I-N/ieprogram/security/article.php/c4387
Hero
07-26-2004, 10:55 PM
Thanks everybody for answer.:D


Hiding Si
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hiding Si
PDA

View Full Version : Hiding Si

ReVeR
07-26-2004, 12:12 PM
Hello.
i need to hide si in win xp
i tried iceext, but i can't seem to use it..
the !protect command is not found....when i laod si thou iceext...
and i donno any other ways to hide it....
Thx in advnace
doug
07-26-2004, 12:40 PM
search this board for
Hiding softice
SoftICE detection

... and use a spellchecker.
evlncrn8
07-26-2004, 09:45 PM
yep, what doug said, with a big sign on top of it pointing to the BIG RED LETTERS on the main page (wheres jmi when u need him) ;)... or

/me looks at the bottom of this thread, with all those helpful links with 'similar thread' above it
JMI
07-26-2004, 10:38 PM
JMI was at dinner when you posted, but observed the post and doug's reply this morning and thought it was not necessary for me to beat him up any further. :idea: :devil:

And who would have thunk it. Similar threads right there in plain sight of God and everybody. Hello, Knock, Knock, are you people looking down there??? :yay: I guess that's why we turned the feature on. So you could find "similar threads" even without searching. :eek:

Regards,
naides
07-27-2004, 03:49 AM
how does the "similar threads" feature work?
Does it automagically zero in on key words and bring other threads that contain those same keys?
Or is it manually set up by JMI when he is not at dinner?
JMI
07-27-2004, 04:06 AM
Its a function of the search index and is automatic. :yay: It does, however depend on the current state of that index and is not very intuitive.

Regards,
ReVeR
07-30-2004, 01:02 AM
i have searched to forums...here is my question:
how do i protect a breakpoint wiht iceext?
!protect bpx MessageboxA
woudl this be an example of that?
i don't ahve SI right now so i wanted to get some info before installing it again....(gotta find)
sHice
07-30-2004, 05:16 AM
read the help file of iceext... !protect is the command to hide sice e.g. against int 1 detection this command has no additional parameters.
naides
07-30-2004, 03:55 PM
i have searched to forums...here is my question:
how do i protect a breakpoint wiht iceext?
!protect bpx MessageboxA
woudl this be an example of that?
i don't ahve SI right now so i wanted to get some info before installing it again....(gotta find)

What version of do you have?
What version of IceExt?

Do you run IceExt manually? It does not load automatically!

Once loaded can you run any other ! command? how about !tetris?

The command is !protect on it is off by default at start.

The readme of IceExt is not completely clear, but it is rather thorough.


Unpacking project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Unpacking project
PDA

View Full Version : Unpacking project

ReVeR
07-26-2004, 12:13 PM
Hello.
i got a crackme that is packed and i wann unpack it...i don't wanna use any other tools available for it, but wann do it manualy to see how it is done...
any links will be greatly appriciated.
thx in advace
Eggi
07-26-2004, 12:35 PM
what do you mean with "tools". do you also mean without a debugger?
ReVeR
07-26-2004, 01:47 PM
no i meant without progrs that autometicaly unpack my program.
Eggi
07-26-2004, 02:01 PM
hxxp://www.reteam.org/

There is a tutorial about unpacking asprotect without tools.
JMI
07-26-2004, 03:51 PM
Enter "manual unpacking" (without the quotes) in the SEARCH button at the top of these Forums and in your favorite search engine and you will find enough information to last a long time.

Regards,
ZaiRoN
07-26-2004, 04:01 PM
Hi ReVeR,
feel free to attach your crackme here. Maybe others would like to play with it.

Zai
SvensK
07-27-2004, 05:00 AM
@Zai: Indeed :)
ReVeR
07-27-2004, 07:31 PM
ok here is the crack me, it takes 2 minutes to crack it (literally) once u unpacketed it...
so i don't think it is gonna be fun
but here it is anyways:
ZaiRoN
07-28-2004, 04:38 PM
Hi ReVeR.
>i don't wanna use any other tools available for it, but wann do it manualy to see how it is done...
I think we can divide the project into some little tasks, i.e. how to find the Original Entry Point, how to create a new IAT and so on. Did you think about something in particular?

ZaiRoN
ReVeR
07-28-2004, 04:41 PM
no, nothing in particular, i jsut wanted to learn how to unpack manualy...
i still gotta read some stuff on how to do it,
Ricardo Narvaja
07-28-2004, 05:45 PM
I made 4 parts of a tut of Manual unpack without Import Reconstructor, i use a script for make a list of the apis used and a little inject for use GetProcAddress and charge the values in the IAT, is a little hard for newbies but is very useful, is in spanish.

Download of my FTP quickly i'm unemployed now and in a little time i have no more internet connection.

http://www.ricnar456.dyndns.org/

or

http://www.ricnar456.dyndns.org/

user:crackslatinos
pass:fiaca22

folder:NUEVO CURSO-TEORIAS

253-IMPORT TABLES A MANO (parte 1).rar
254-IMPORT TABLES A MANO (parte 2).rar
255-IMPORT TABLES A MANO (parte 3).rar
256-IMPORT TABLES A MANO (parte 4).rar

Download quickly the day 20/8/2004 the ftp will be closed .

Ricardo Narvaja
dELTA
07-29-2004, 07:07 AM
Ricardo, I'm very sorry to hear that about your job. :(

Do you know if you will you distribute your tutorials somewhere else?
JMI
07-29-2004, 09:48 AM
Most of Ricardso's tuts are already preserved on the exetools FTP and have been there for some time and I downloaded a copy on my HD as well. I'll make sure I have them all from the cracklatinos site and be glad to help Ricardo if he has any problem restoring them when he gets back on his feet and back on the net again.

Currently that archive contains numbers 1-170, and 203-208, and 213 (English translation of the vbox tut).

Again Ricardo, best of luck to you and your family. :yay:

Regards,
Ricardo Narvaja
07-29-2004, 12:05 PM
Well i was working in the same place for 23 years, will be difficult for me but i try.

Thanks

Ricardo Narvaja
Ricardo Narvaja
07-29-2004, 12:10 PM
Well in the crakslatinos page

http://crackslatinos.hispadominio.net/

and in the ftp of exetools and the crackslatinos mail list continue your work, and i expect return when i found a job.

Ricardo Narvaja
dELTA
07-29-2004, 02:08 PM
Ok, I wish you the best of luck then, and expect to see you back soon! :)
JMI
07-29-2004, 06:28 PM
OK. I've now completed my personal archive of the NUEVO CURSO-TEORIAS folder and I'll upload the additional files to exetools shortly. :idea:

Ricardo you might want to make a small edit to the files titles.

Both

IMPORT TABLES A MANO (parte 3).rar
IMPORT TABLES A MANO (parte 4).rar

are labled as 256 and there is no 255.

Again thanks for all your great efforts and we hope to can get back to work and back to cracking very soon. :yay:

Regards,
Ricardo Narvaja
07-29-2004, 06:38 PM
Thanks the archive is renamed

255-IMPORT TABLES A MANO (parte 3).rar

256-IMPORT TABLES A MANO (parte 4).rar

Thanks

Ricardo Narvaja
JMI
07-29-2004, 06:44 PM
:yay: :loveu:

Regards,
klier
07-30-2004, 07:40 AM
>>it takes 2 minutes to crack it (literally) once u unpacketed it...
...and a few minutes more to let it count below -1
(solution at crackmes.de crashes below -1 on my XP SP1) ;)
Regards,
ReVeR
07-30-2004, 12:01 PM
it is extremly easy, it took me 2 minutes literally to crack it after i unpacked it, but the problem was i want to redone it with manual unpalcing....reading ur tuts now ppl , thx
klier
07-30-2004, 12:15 PM
manual unpacking this target takes only 2 minutes too. :)
read "Manually UnPacking of Yoda's Crypter v1.1" from CoDe_InSiDe and "Manual unpacking y0da's Crypter v1.2" from hacnho.
Regards,
ReVeR
08-10-2004, 01:36 PM
hey, can u give me direct lines cuz i have no idea qwhere to look for them.....
sry
klier
08-10-2004, 04:06 PM
This lines may contain spelling faultz
htpp://www.hvanoline.net/furom/showtipic_27123.html
http://home.tiscali.be/detten/tits.htm
Ragards, :sneaky:
ReVeR
08-11-2004, 09:46 AM
ahem...i am sory but i can';t decipher those links....
i got for the first one wiht the errors corrected:
http://www.hudaonline.net/forum/showtopic_27123.html
doesn't work.
i got the second link working and there is 1 tut from the ones that u mentioned...
can u please look at the first link?
and i will try to get my spelling error free.
klier
08-11-2004, 12:09 PM
>>i got for the first one wiht the errors corrected:
>>http://www.hudaonline.net/forum/showtopic_27123.html
apparently not :rolleyes:
bored now ,search yourself,you have all the keywords!
Regards,
ReVeR
08-11-2004, 12:55 PM
crap, i meant that i got the second one...i didn;t get the first one....
and what is this, decryption contest?
i mean there are alot of web sites that are close in spelling of ur given one.....
i got all teh keywords, but if u try to look through all the sites that can be made from ur link,.....gonna take shit load of time....:(
dELTA
08-11-2004, 05:02 PM
Google is your friend.

http://www.hvaonline.net/forum/index.php?showtopic=27123


Vertical scroll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Vertical scroll
PDA

View Full Version : Vertical scroll

ReVeR
07-26-2004, 11:14 PM
hello.
i had sthis buggin me for a while....
does anyone know hwo to remove a vertical scroll bar from a cmd windw?i mean totaly and wihtoureturening remove it to hell...
any ideas?
nikolatesla20
07-27-2004, 11:18 AM
I think you'd have to override the window "style" . Check into windows classes and style bits, and SetWindowLong function.

-nt20


A quick Thank You
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A quick Thank You
PDA

View Full Version : A quick Thank You

Medic
07-27-2004, 05:17 PM
Hi All,

I've been on the board a week after getting back into reversing after a couple years rest.

The initial target I chose showed the weakness in my understanding, my old knowleadge and the current tools (mostly XP specific problems).

Through asking for help and reading loads of posts on the board I've managed to improve my knowleadge, learn some new tools, reverse my initial target and 8 others this week!

Just wanted to say thanks. It wouldn't have been easy or even possible without the board.

Cheers,

Medic :D

Tools used:
DS 3.1
Ollydbg
PEiD
Inno setup unpacker


WIN32 DEBUG API(AGAIN)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > WIN32 DEBUG API(AGAIN)
PDA

View Full Version : WIN32 DEBUG API(AGAIN)

canuckcracker
07-27-2004, 09:59 PM
Hello,

I'm just trying to single step one of my applications via the windows DEBUG API(I have read icezelions great tutorials) but I'm stuck and I'm not sure if it's something I'm doig wrong or what.

http://the.xlabs.org/debug.csrc -> src for my program
http://the.xlabs.org/output -> the program output

When I catch the EXCEPTION_SINGLE_STEP and EIP is at 77xxx

Is this correct?(is this kernel32 addrsss space?) or is somethig wrong here?

I can only trace exactly 8352 instructions like this and then i get no more
events.

I've also tried to modify my Eip and set it to the atcual entrypoint of the program, using this i can trace 10 instructions & thats it.

It doesn't crash or anything, i just dont get anymore events and the program doesnt load on either case.

Any pointers is appreciated! thanks
doug
07-27-2004, 10:18 PM
Search this board for
Debug Api

Particularly, this thread: http://www.woodmann.net/forum/showthread.php?t=6098&highlight=Debug+Api

contains useful information - check post #5.
bilbo
07-28-2004, 03:18 AM
Really doug's answer hits the spot.
Some other words could be interesting...

When I catch the EXCEPTION_SINGLE_STEP and EIP is at 77xxx Is this correct?(is this kernel32 addrsss space?) or is somethig wrong here?

As nikolatesla20 pointed out, the first event is a bonus added by Windows for the debugger. It is an EXCEPTION_DEBUG_EVENT, and you are stuck inside NTDLL.DLL

_DbgBreakPoint@0 proc near
int 3
retn ; <-- HERE!!!
_DbgBreakPoint@0 endp

The best thing you can do here is

ContinueDebugEvent(..., ..., DBG_CONTINUE);

I can only trace exactly 8352 instructions like this and then i get no more events.
That's interesting!

The reason of the program hanging is due to entering in Ring-0 (kernel mode) with the Trap Flag set in EFLAGS. This require more investigation to better understand the underneath mechanics...

If you use printf(), your trace will stop some instructions before at a meaningless point, but if you use OutputDebugString() you will see the very last traced EIP, which on Windows XP/Pentium must be

7FFE0300: mov edx, esp
7FFE0302: sysenter ; <-- HERE!!!
ret

Even if you comment out printf()/OutputDebugString(), the application hangs, so simply avoid to set TrapFlag from ring 3 when you enter ring 0!

Regards, bilbo
canuckcracker
07-29-2004, 09:15 PM
Hi Bilbo,

Thanks for your reply.

I've now set a breakpoint on the EntryPoint so that I avoid tracing inside of
NTDLL, however, I end up back inside of NTDLL(77xxxx address) and the same happens ..

Anyways, I've gone another route and just used ReadProcMem to search for the exact place I want in the program and then set a break here, works good. But I'd stll like to be able to trace from the very beginning and trace the WHOLE program if i ever wanted to -- is that possible?

Thanks

I've also done as nikola suggests and I WriteProcessMemory AFTER i catch the windows breakpoint, i think something is wrong with how i restore the byte at which i placed the breakpoint?? not sure.. but the program just crashes..

NEW SRC is here:

http://the.xlabs.org/debug.csrc
Iwarez
07-30-2004, 12:51 AM
You have to flush the instruction cache after you write the new bytes and set the eip 1 byte back to account for the breakpoint instruction if I remember well.
bilbo
07-30-2004, 04:06 AM
You have to flush the instruction cache after you write the new bytes
that's not necessary, AFAIK

and set the eip 1 byte back to account for the breakpoint instruction if I remember well.
That's your error canuckcracker! Your restored instruction will never executed, and garbled codes can be executed instead.
On Windows breakpoint you did not need to execute again INT3, but here, on entry point, it is necessary to restart from your saved code!
Then, do not forgive to initialize sinfo - on XP your snippet does not run... E.g.
STARTUPINFO sinfo = {sizeof(sinfo)};

trace the WHOLE program if i ever wanted to -- is that possible?
As I told you, you just must be careful to skip all kernel code: you cannot enter ring 0 with the trace flag set. And next, are you really interested to trace also system libraries, such as KERNEL32?

I started some years ago a similar project, but then I lost interest in it, because a tracer can easily be defeated by the traced application.
Anyway, let me know if you make some progress.

Best regards, bilbo
disavowed
07-30-2004, 06:29 PM
You have to flush the instruction cache after you write the new bytes that's not necessary, AFAIK
msdn recommends it, but i have never done it and have never had any problems from not doing it

and set the eip 1 byte back to account for the breakpoint instruction if I remember well.
you only have to do that if you overwrote existing code with your own int3. otherwise, you can just dbg_continue.
evaluator
07-31-2004, 02:09 AM
well, 2 years, ago i found for Tsehp trikie&comfort way
for Single-Step tracing on XP:

discard "Fast System Call" 'greats' & Return back to INT2E.

however, until yesterday i not looked in problem about
m$'s Errorneous managment for SYSENTER. ok now i looked:)

in one word, after SYSENTER_with_TFlag FS-register is loosing.
in same one word, save FS value on SYSENTER,
and after SYSENTER check & restore it via SEH_CONTEXT;

of course best way is back to grEat INTs.


Hooking DLL functions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hooking DLL functions
PDA

View Full Version : Hooking DLL functions

Hero
07-28-2004, 06:15 AM
Hi All
I have an DLL with some functions in it.I want to hook every access to
this DLL through my Application.How I can do this?
For example,With my Application "AppHooking" and a using DLL "MyDLL.dll",
I want to detect every access to "MyDLL" functions and Run "AppHooking"
Before that program that want to use this DLL.

sincerely yours
JMI
07-28-2004, 08:41 AM
Why don't you start with the SEARCH button and try "DLL Hooking" (without the quotes) like you are supposed to do before you post a question?

Regards,


Delphi 6 and 7 IDA Signature
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Delphi 6 and 7 IDA Signature
PDA

View Full Version : Delphi 6 and 7 IDA Signature

TQN
07-28-2004, 11:39 PM
Hi all !
After above half month of my free times, I have finished with creating IDA Signature file for Delphi 6 and 7 RTL (not contain VCL, CLX). I recompile the Delphi 6, 7 RTL source to .obj file, create .pat file, use DCUExplorer tool to manual edit unknown, unexport functions (named with xxxx::_16xxx, unknown_libname, ...). I have tested them with a Delphi 7 console app and a Delphi 7 Dll, and almost above 95% of RTL functions will be recognized. The D6RTL.sig is rude, and is a subset of D7RTL.sig. I suggest you should use D7RTL.sig for Delphi 6 and 7 .exe, .dll.
But I have a note: in IDA, the B32VCL.sig is a startup signature file, so it will be applied automatically, but it have many unname and unknown functions. When we apply D7RTL.sig, the name of recognized functions in D7RTL will not be applied to the unknown and unname functions in B32VCL.sig. So, when IDA start, remove the B32VCL.sig in Signature window, apply D7RTL.sig, then apply B32VCL.sig.
I hope you will enjoy !
Regards !
TQN
dELTA
07-29-2004, 07:09 AM
Nice work TQN, thanks! :cool:
314159265358979
07-29-2004, 10:04 AM
Nice work, thanx. Another way is to load *.bpl in IDA as dll, let it analyze that file and then export signatures with idb_2_pat plugin. It's cool if you have only demo with precompiled .dcus. But, even better is to parse *.dcu into *.pat.

314159265358979
TQN
07-29-2004, 10:22 PM
Thank dELTA and 314159265358979 !
After finished this signature, I realize that I could do it easier with a dcu2pat tool. I will add this tool to my todo list in my free time. Another way is rebuild the DCULoader loader of Mike Sinkovsky for IDA Pro 4.5 and uses IDB_2_PAT to create the signature.
Regards !
TQN
friedo
07-31-2004, 11:46 AM
Thank dELTA and 314159265358979 !
After finished this signature, I realize that I could do it easier with a dcu2pat tool. I will add this tool to my todo list in my free time. Another way is rebuild the DCULoader loader of Mike Sinkovsky for IDA Pro 4.5 and uses IDB_2_PAT to create the signature.
Regards !
TQN
btw. delphi allows to create OBJ files instead of DCUs. There´s already an OBJ2PAT tool... ;-)
TQN
07-31-2004, 11:14 PM
Thanks friedo !
This is the way I created this signature (obj2pat == plb ??). But the pat file created will ignore and don't have a large number of small functions (< 16 byte), and a lot of xxxx:_16xxxx and unknown_libname functions. So I must use DCUExplorer to manual add and edit them.
TQN
JonathanL
08-08-2004, 11:20 AM
A wonderful work! Thanks a lot, TQN!


Free Web Space
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Free Web Space
PDA

View Full Version : Free Web Space

bilbo
07-29-2004, 10:51 AM
It seems that this question has never been posted here: maybe it is too stupid...

Anyone can suggest some place in the net where an old hobbit can spend his last years? By the way, it must be free...

Best regards, bilbo
nikolatesla20
07-29-2004, 12:09 PM
I just heard of this place:

www.100webspace.com

100 megs space.

they allow PHP and a MySQL database for free too, so you can play with the more fun stuff :)

-nt20
dELTA
07-29-2004, 02:05 PM
What kind of site is it? If it's a serious reversing related site, Woodmann might agree to host it on this server, you never know... PM him about it in that case.
JMI
07-29-2004, 04:29 PM
Maybe he just wants to do another volumne of his book and needs a place to keep his notes and drawings of all his adventures in MiddleEarth. :yay:

Regards,
bilbo
07-30-2004, 03:52 AM
thanks, mates, for your answers...

nikolatesla20: that's really interesting... what I cannot understand is: if I search "powered by ...", "hosted by ...", I manage to find only two sites resident there. Is it possible? Or search engines do not take footers into account, or what?

dELTA: your suggestion is intriguing and I would be honoured too if the thing could go on, but I am already currently spending more than half a day reversing and I am afraid to become crazy. So, as JMI correctly argued (in my native language we say "he knows his chickens") I would like to put other stuff too. Anyway, "you never know"...

Regards, bilbo
JMI
07-30-2004, 04:09 AM
Hey... Chickens are easy. You feed em. You steal their eggs. And, eventually, you chop off their heads; clean and pluck them; then cook and eat em. :eek: :yay:

Regards,
esther
07-30-2004, 10:12 AM
WOW This sections becomes chicken farm LOL :whoops: :devil:
UrgeOverKill
07-31-2004, 07:53 PM
In nature, living things evolve through changes in their DNA. In an animal like a chicken, DNA from a male sperm cell and a female ovum meet and combine to form a zygote -- the first cell of a new baby chicken. This first cell divides innumerable times to form all of the cells of the complete animal. In any animal, every cell contains exactly the same DNA, and that DNA comes from the zygote.

Chickens evolved from non-chickens through small changes caused by the mixing of male and female DNA or by mutations to the DNA that produced the zygote. These changes and mutations only have an effect at the point where a new zygote is created. That is, two non-chickens mated and the DNA in their new zygote contained the mutation(s) that produced the first true chicken. That one zygote cell divided to produce the first true chicken.

Prior to that first true chicken zygote, there were only non-chickens. The zygote cell is the only place where DNA mutations could produce a new animal, and the zygote cell is housed in the chicken's egg. So, the egg must have come first.

This nfo has been plucked from a previous discussion........
JMI
07-31-2004, 11:35 PM
Hey wait, that's "off topic." No one asked which came first. :sneaky: :D

Regards,


Coding ASPACK dumper
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Coding ASPACK dumper
PDA

View Full Version : Coding ASPACK dumper

canuckcracker
07-30-2004, 12:44 AM
Hi,

I'm writing a dumper for aspack -- I just want to know, does aspack mess up the IAT ? if you dump from memory after the aspack code(after its done uncompressing) will your IAT be messed ? and have to rebuild it? thanks.
JMI
07-30-2004, 01:22 AM
Sigh.....

Did it not occur to you to use the SEARCH button on the top of the Forums and search for threads on ASPACK so you might have the least clue how and what it does? You WERE supposed to have already read the FAQ in the BIG RED LETTERS. Even the simplist search using "aspack unpacking" (without the quotes) will yield 37 posts for you to review such basic knowledge. Just using "Aspack" (again without the quotes) I got 113 threads.

How about you do what the FAQ suggests you do and search before you ask such a basic question. After your search here, you should have your answer, but if you are confused after reviewing the already availalbe materials, I'm sure someone can help you further.

Regards,
mr. seeQ
07-30-2004, 05:28 AM
aspack NOT mess up the IAT
evaluator
07-31-2004, 02:07 AM
just 2 days ago coded aspack dumper with DBG-api!
letz!?
deXep
08-03-2004, 10:25 AM
see yoda's aspackdie/src plz :D


Assembly Coding in Delphi Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Assembly Coding in Delphi Problem
PDA

View Full Version : Assembly Coding in Delphi Problem

Hero
07-30-2004, 02:04 AM
Hi All
I'm trying to write a piece of Assembly code in Delphi.I know I should
do this by asm keyword.I want to return Flags value to a
variable.I use the following code in the start of my Main project file:

var
Flags:DWord;
begin
asm
Pushf
Pop Flags
end;
......
end.

But this code make nothing for me and only hide caption bar and Border
of Main form.
why?How I can Do this?

sincerely yours
Lord8Bit
07-30-2004, 02:45 AM
Try something like :

Function GetFlags: dword;
asm
push eax
pushfd
pop eax
mov Result,eax
pop eax
end;

Best regards
LordByte
TQN
07-30-2004, 03:15 AM
Hi Lord8Bit !
Good code, but don't need to use Result. Function return number in Delphi always uses EAX. So the code will be:

function GetFlags: DWORD;
asm
pushfd
pop eax
end;

Regards !
TQN


code for call processing application
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > code for call processing application
PDA

View Full Version : code for call processing application

rraajjiibb
07-30-2004, 04:54 AM
I am new to the realm of REVERSE ENGINEERING.

I have taken up a small project..

I aim to develop a utility that will help to trouble shoot call processing failures in a cellular network.

I have with me the executable ( mc68k executable). It runs on a LUCENT implementaion of UNIX system based on 3b21d processor.

I want to look at the code mainly to understand what message is thrown under various conditions of call processing failures.

Could anyone help me with the forward path?????
naides
07-30-2004, 05:57 AM
best place to start looking is IDA. It can disassm a variety of executables, but I did not check if you strain is one of them. it also has an OK incorporated debugger, but doubt you would be able to run it on a win32 environment with your mc68k exe files.
Your best bet is looking for application development SDK and see if they have debuggers incorporated to them
dELTA
07-30-2004, 05:58 AM
I'm not really sure what your question is, but try to disassemble the executable with IDA, that's your best shot for executables of strange formats.

EDIT: Oh great, overtaken at the goal line again... :)
disavowed
07-30-2004, 06:32 PM
best place to start looking is IDA.... it also has an OK incorporated debugger, but doubt you would be able to run it on a win32 environment with your mc68k exe files.
ida's debugger can only handle windows PE files


A Little Help Maybe!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A Little Help Maybe!
PDA

View Full Version : A Little Help Maybe!

canuckcracker
07-30-2004, 06:32 PM
Hi All,

I'm trying to reverse a target. POST CODE

I posted url -- since i have not posted any relevant code, i believe this is allowed? if not, i apologize, please delete.

Anyways, inside of olly when i hit ctrl+n, there are no relevant functions to grabbing the serial #(ie: getdlgitemtext, getwindowtext)

edit: oops, had to let it load the dll, then i can break on strcpy

cant follow this code at all, dunno wga the hell he is doing :/

anyone able to help me out? i can give you what i have so far if you pm me..

thanks
Kayaker
07-30-2004, 09:31 PM
Hiya

Ahah, a loophole.

.If URL allowed .then Code NOT allowed = PM discussion only = No thread content + rash of private crack requests. Or,

.If Code allowed .then URL/target NOT allowed = Public discussion + thread with a point.

The second way seems to be a better strategy. I'm deleting the URL but encourage you to analyze the code further and pick a specific point where you're having problems, then come up with a relevant post with code and someone may be able to help you.

Kayaker
kugi
07-31-2004, 12:10 AM
Hi Kayaker,

Great reply. It is good to see that some reversers can still play nice.

Regards, kugi


Problem Finding Import Table
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Problem Finding Import Table
PDA

View Full Version : Problem Finding Import Table

canuckcracker
07-31-2004, 02:32 AM
pDosHdr = (PIMAGE_DOS_HEADER)pMap;
pNTHdr = (PIMAGE_NT_HEADERS)((DWORD)pMap+pDosHdr->e_lfanew); // e_lfanew specifies offset of NT HEADER
pSectionHdr = (PIMAGE_SECTION_HEADER)((DWORD)pDosHdr+pDosHdr->e_lfanew+0xf8); // SECTION HEADERS START

printf("NTHEADER @ %08x\nSECTIONHEADERS START @ %08x\n", (pMap+pDosHdr->e_lfanew), (pDosHdr+pDosHdr->e_lfanew+0xf8));
printf("%s\n", pSectionHdr->Name);
printf("%08x\n", pNTHdr->OptionalHeader.DataDirectory[1].Size);
printf("Import Table @ %08x Image Base @ %08x\n", pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress, pMap);
pImpDesc = (PIMAGE_IMPORT_DESCRIPTOR)(pMap + pNTHdr->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
printf("%08x is IMPORT_DESCRIPTOR\n", pImpDesc);

Should this not be a valid IMPORT_DESCRIPTOR struct?

p.s: pMap is the address of my file mapped in memory via MapViewOfFile

Thanks,

canuckcracker
doug
07-31-2004, 09:31 AM
It looks like it might be a pointer issue. You can only add byte offsets to BYTE pointers. Otherwise the constant or the offset will get multiplied before it is added to your pointer.

For instance,
DWORD *ptr;
ptr = ptr + 1 ; will get translated to something like: add ptr, 4

You should really try single stepping your C code. You need to help yourself.
upb
07-31-2004, 10:18 AM
if you just map the file into memory then you would need to convert any RVA's to physical addresses. Because its exactly the same as accessing the file on disk.


Recosntruction the code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Recosntruction the code
PDA

View Full Version : Recosntruction the code

souz
07-31-2004, 08:02 AM
Hi all!
Can anyone help me with this portions of code to explain whiat this code do?
The code:

.text:00010A4D Sub_001 proc near ;
.text:00010A4D
.text:00010A4D var_4 = dword ptr -4
.text:00010A4D arg_0 = dword ptr 8
.text:00010A4D
.text:00010A4D push ebp
.text:00010A4E mov ebp, esp
.text:00010A50 push ecx
.text:00010A51 sub edx, 10h
.text:00010A54 push ebx
.text:00010A55 neg edx
.text:00010A57 push esi
.text:00010A58 mov esi, ecx
.text:00010A5A sbb edx, edx
.text:00010A5C lea eax, [esi+8]
.text:00010A5F not edx
.text:00010A61 and edx, eax
.text:00010A63 cmp byte_15B72, 0
.text:00010A6A mov eax, [esi+4]
.text:00010A6D push edi
.text:00010A6E mov ebx, edx
.text:00010A70 mov [ebp+var_4], eax
.text:00010A73 mov edi, eax
.text:00010A75 lea ecx, [ebp+var_4]
.text:00010A78 jnz loc_10B26
.text:00010A7E mov edx, [ebp+arg_0]
.text:00010A81 add edx, 238h
.text:00010A87 call sub_10837
.text:00010A8C test ebx, ebx
.text:00010A8E mov eax, [ebp+var_4]
.text:00010A91 jz short loc_10A95
.text:00010A93 mov [ebx], eax
.text:00010A95
.text:00010A95 loc_10A95: ; CODE XREF: Sub_001+44j
.text:00010A95 ; Sub_001+E8j
.text:00010A95 mov ecx, [esi]
.text:00010A97 xor ecx, eax
.text:00010A99 mov [esi+4], ecx
.text:00010A9C mov [esi], edi
.text:00010A9E xor ecx, ecx
.text:00010AA0
.text:00010AA0 loc_10AA0: ; CODE XREF: Sub_001+76j
.text:00010AA0 ; Sub_001+11Ej
.text:00010AA0 mov eax, dword_1597A
.text:00010AA5 mov edx, [esi+4]
.text:00010AA8 xor eax, 25807724h
.text:00010AAD ror eax, 7
.text:00010AB0 xor eax, edx
.text:00010AB2 rol eax, cl
.text:00010AB4 xor eax, [esi]
.text:00010AB6 inc ecx
.text:00010AB7 inc ecx
.text:00010AB8 cmp ecx, 0Ch
.text:00010ABB mov [ebp+var_4], eax
.text:00010ABE mov [esi+4], eax
.text:00010AC1 mov [esi], edx
.text:00010AC3 jb short loc_10AA0
.text:00010AC5 cmp byte_15B72, 0
.text:00010ACC mov edi, eax
.text:00010ACE lea ecx, [ebp+var_4]
.text:00010AD1 jnz loc_10BA0
.text:00010AD7 mov edx, [ebp+arg_0]
.text:00010ADA add edx, 238h
.text:00010AE0 call sub_10837
.text:00010AE5 test ebx, ebx
.text:00010AE7 mov eax, [ebp+var_4]
.text:00010AEA jz short loc_10AEF
.text:00010AEC mov [ebx+4], eax
.text:00010AEF
.text:00010AEF loc_10AEF: ; CODE XREF: Sub_001+9Dj
.text:00010AEF ; Sub_001+145j ...
.text:00010AEF mov ecx, [esi]
.text:00010AF1 xor ecx, eax
.text:00010AF3 mov [esi+4], ecx
.text:00010AF6 mov [esi], edi
.text:00010AF8 xor ecx, ecx
.text:00010AFA
.text:00010AFA loc_10AFA: ; CODE XREF: Sub_001+D0j
.text:00010AFA mov edx, dword_1597E
.text:00010B00 mov eax, [esi+4]
.text:00010B03 xor edx, 36459714h
.text:00010B09 rol edx, 9
.text:00010B0C xor edx, eax
.text:00010B0E rol edx, cl
.text:00010B10 add ecx, 5
.text:00010B13 xor edx, [esi]
.text:00010B15 cmp ecx, 1Eh
.text:00010B18 mov [esi+4], edx
.text:00010B1B mov [esi], eax
.text:00010B1D jb short loc_10AFA
.text:00010B1F pop edi
.text:00010B20 pop esi
.text:00010B21 pop ebx
.text:00010B22 leave
.text:00010B23 retn 4
.text:00010B26 ; ---------------------------------------------------------------------------
.text:00010B26
.text:00010B26 loc_10B26: ; CODE XREF: Sub_001+2Bj
.text:00010B26 mov edx, offset unk_1598A
.text:00010B2B call sub_10837
.text:00010B30 test ebx, ebx
.text:00010B32 mov eax, [ebp+var_4]
.text:00010B35 jz loc_10A95
.text:00010B3B mov [ebx], eax
.text:00010B3D mov ecx, [esi]
.text:00010B3F xor ecx, eax
.text:00010B41 mov [esi+4], ecx
.text:00010B44 mov [esi], edi
.text:00010B46 xor ecx, ecx
.text:00010B48 mov eax, dword_1597A
.text:00010B4D mov edx, [esi+4]
.text:00010B50 xor eax, 25807724h
.text:00010B55 ror eax, 7
.text:00010B58 xor eax, edx
.text:00010B5A rol eax, cl
.text:00010B5C xor eax, [esi]
.text:00010B5E inc ecx
.text:00010B5F inc ecx
.text:00010B60 cmp ecx, 0Ch
.text:00010B63 mov [ebp+var_4], eax
.text:00010B66 mov [esi+4], eax
.text:00010B69 mov [esi], edx
.text:00010B6B jb loc_10AA0
.text:00010B71 cmp byte_15B72, 0
.text:00010B78 mov edi, eax
.text:00010B7A lea ecx, [ebp+var_4]
.text:00010B7D jnz short loc_10BA0
.text:00010B7F mov edx, [ebp+arg_0]
.text:00010B82 add edx, 238h
.text:00010B88 call sub_10837
.text:00010B8D test ebx, ebx
.text:00010B8F mov eax, [ebp+var_4]
.text:00010B92 jz loc_10AEF
.text:00010B98 mov [ebx+4], eax
.text:00010B9B jmp loc_10AEF
.text:00010BA0 ; ---------------------------------------------------------------------------
.text:00010BA0
.text:00010BA0 loc_10BA0: ; CODE XREF: Sub_001+84j
.text:00010BA0 ; Sub_001+130j
.text:00010BA0 mov edx, offset unk_1598A
.text:00010BA5 call sub_10837
.text:00010BAA test ebx, ebx
.text:00010BAC mov eax, [ebp+var_4]
.text:00010BAF jz loc_10AEF
.text:00010BB5 mov [ebx+4], eax
.text:00010BB8 jmp loc_10AEF
.text:00010BB8 Sub_001 endp

Thanks!
dELTA
07-31-2004, 09:36 AM
No.

Don't post large chunks of random uncommented code here like that, and especially not without any kind of explanation... :boo:
disavowed
07-31-2004, 09:35 PM
how can you expect us to give you a perfect explanation without posting all of the code for sub_10837 too? :)
JMI
07-31-2004, 11:29 PM
Alright, let's not encourage him to do so. :thinking:

Regards,
Polaris
08-01-2004, 05:47 AM
Alright, let's not encourage him to do so. :thinking:

Regards,

:devil:
naides
08-01-2004, 07:55 AM
Hi all!
Can anyone help me with this portions of code to explain whiat this code do?
The code:

Thanks!

The code is producing a hash of the double word passed in [EBP+04] and storing it at [ESI+4]

That is crystal clear!
dELTA
08-01-2004, 05:35 PM
You are always too nice Naides... :p
JMI
08-01-2004, 06:17 PM
"Nobody" is Nice. (Bad pun intended) :yay:

Regards,
souz
08-02-2004, 01:09 AM
Sorry to all!

It's main part of Glasha's Hasp Emu 3c/3d hasp algorhytm. (3c)
JMI
08-02-2004, 01:16 AM
And nadies (nobody) told you what the code is doing, although you shouldn't have asked in that way. But as long as you understand that posting long sections of code is not the right way to do thing, that's all we really wanted you to learn.

The rest was just having a little fun. ;)

Regards,
naides
08-02-2004, 11:12 AM
souz, don't believe a single word nobody tells you.
He is full of shit.
The only person here qualified to read minds is Delta.
I have plenty of threads to prove it. Do you want a list? ;)
JMI
08-02-2004, 12:55 PM
:yay:

Regards,
dELTA
08-02-2004, 01:32 PM
Hehe, nobody is funny too. ;)
JMI
08-02-2004, 02:03 PM
Now dELTA, what you should have responded to that post was:

I knew you were going to say that. :idea:

Regards,


CrypKey 6.0 for Newbie?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > CrypKey 6.0 for Newbie?
PDA

View Full Version : CrypKey 6.0 for Newbie?

BrntPhish
07-31-2004, 04:21 PM
Ok do not flame me .. I HAVE read everything i could find on CRYPKEY 6 (which was only posts here by squidge & others). I have googled my brains out looking for the 6.0 SDK and came up empty. WDasm is of no use. SoftIce will not run on this PC so i have been using Olly and Hiew. Finally i realized the crypkey calls and protection etc and have been researching that for a week now. I have my site code and have decoded it via ckinfo, but now i am at a loss of what to do next or what tools i need to use for 6.0.

I am new at ASM and reversing but grasp the basic concepts (I think). I have limited experience in writing basic code(VB, COBOL, C++, JAVA).

I have read TNT'S Crapkey ..oops tutorial (too no avail).
Woodmans Crypkey text
Fravia;s CRypkey removal

When i read woodmans and fravia i could understand them but they are of little help with a 6.0 problem ... and i just got lost in TNT's and need "instructions for the instructions".

Sooooo... now .... what do i need to do? Is it too advanced for a newb? I have completed a couple of the crackmes, but cannot find anything pertinent to my crypkey problem. When i open with olly the "program entry point is outside the code as specified ,....blah blah"

IS there any material anywhere else to help me figure this out anyone willing to point me towards something here?

Please do not flame, this is the ONLY place i have found ANY info on crypkey6. App is protected by version 6.1 (cki32j.dll). After tons of "googling", Yahoo, and atsa and others i am declaring myself stuck.

Thanks,
BP
dELTA
07-31-2004, 05:09 PM
Commercial protection systems like CryptKey might be a little too hard for a newbie to begin with, yes. :( You should get some experience with easier protections first, serial fishing, time trials, easy packers and such. Then make an attempt of understanding the instructions in that TNT tut again, that's the best advice I can give, good luck!
BrntPhish
07-31-2004, 08:49 PM
thanks, afraid that was gonna be the answer. back to the boring little tuts and crackmes.

Thanks
Phish
fly
08-03-2004, 09:41 AM
Does the program which protected by CrypKey 6.0 run normal?
Please give a link.
jacky1108
08-12-2004, 10:01 PM
I also met the same problem with you, and I even don't know which version that my app was protected, I also tried to dig out some useful information from internet, but it's really so poor.
peterg70
08-14-2004, 12:20 AM
Its been a while since I last looked at crapkey. (Note the spelling. Try a search on that on this board and you will find more info.)

I would be interested in the target name (PM only do not post here).
The reality of 6.X was that they implemented anti cloning i.e harddisk ID included into their standard protection.

Peterg70


SafeDisc v3 - New protection?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SafeDisc v3 - New protection?
PDA

View Full Version : SafeDisc v3 - New protection?

klunder
08-01-2004, 01:38 AM
Although I lack the skills to remove such a protection, I am simply curious as to what new protections have been added to safedisc that is making it difficult for crackers to defeat DOOM III's protection. I couldn't seem to find any information on macrovisions website about new options nor any other forum. One rumor I heard was it had a polymorphic OEP? I am sure that is just a rumor, but I am really intrigued to know what exactly is different from the easy normal ol safedisc we have come to know. Silent Alarm has been around for awhile, so I wouldn't think that would be causing the problem.

Thanks
Silver
08-02-2004, 07:08 AM
Not that I know much about it, but Doom3 juarez releases have been available for a few days now. So I'd uneducatedly guess it's not that hard compared to some apps (one certain webcam software springs to mind that nobody appears to be able to crack successfully).
disavowed
08-02-2004, 06:32 PM
So I'd uneducatedly guess it's not that hard compared to some apps (one certain webcam software springs to mind that nobody appears to be able to crack successfully).
just out of curiousity.. url?
Silver
08-03-2004, 07:25 AM
via privmsg, in case you want to discuss it some other time.
evlncrn8
08-04-2004, 06:28 AM
safedisc 3 isnt really new, last version i looked at was 3.20.22, where all they 'added' was the ccc's were now able to be e9 jmps as well as the e8 calls, polymorphic oep i doubt very much ;), tho i'll have a look at it as/when i get my stuff back
gook
08-04-2004, 03:41 PM
There is no such thing as polymorphic OEP in doom :)


Any Assembly Programming Certification?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Any Assembly Programming Certification?
PDA

View Full Version : Any Assembly Programming Certification?

profdracula
08-01-2004, 02:11 AM
Hi evrybdy!

There's a lil question for you guys: Is there any Certification for Assembly Programming? I could'nt find any at certification-sites or at Google. Anybody :confused:
lifewire
08-01-2004, 03:28 AM
I guess there isn't any. win32asm isn't used much in the real world (because in most situations it has more disadvantages than advantages), except for very small parts of OS'es and for parts of games that need much optimalisation (altough the cpu is used less and less nowadays, the GPU is preferred more). generic assembly is still used though, for embedded systems. but i guess you don't mean that.
disavowed
08-01-2004, 08:16 PM
most high-level programmers have never even heard of assembly language, so if you put "assembly language" on your resume, the employer will probably believe you (in other words, no certification necessary)
JMI
08-01-2004, 11:56 PM
Ummm. Ahhh. What's "assembly language"?

Is that there the language them fancy folks speak in the national "assembly" or what? :devil: :thinking:

Regards,


Adding functionality to RASAPI32.DLL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Adding functionality to RASAPI32.DLL
PDA

View Full Version : Adding functionality to RASAPI32.DLL

profdracula
08-01-2004, 02:38 AM
Hi evrybdy!

I am a lil confuzd 'bout adding functionality to RASAPI32.DLL. What I'm trying to do is this;

I want to store entered username and password to a file(when 'Connect'-button at the Dialup DlgBox is clicked). Using SICE, i found out that at virtual-address 7F892D5A, ECX contains the password. Before this there is a call to GetDlgItemTextA. Similarly I found the VA where UserName is stored. I also found the cave for adding my own code at file-offset=0002158E(.text)
or at VA 7F8A158E. Now what I know is this: I know where in memory values are stored, and i know where can my add my own code. Now how can I hijack code from 7F892D5A to my own cave, and what must I do to write memory contents to a file? I think I'll have to use CreateFileA and WriteFile. But how? Can anybody guide me?

Thnx in advance.
Peres
08-01-2004, 03:49 AM
Before you hijack and cause terror, you must be sure that your virtual address (7F892D5A) belongs to a routine which doesn't get called from other points in RASAPI32. You will do some funny damage if you start writing files on your hard disk whenever that routine gets called...

Peres
profdracula
08-01-2004, 02:07 PM
Thanx Peres!

This routine is called once only, when Connect-button is hit. So what next?
Can u tell me precisely, what am i supposed to do? I mean, my own thought post-mortem procedure was: Jumping from 7F892D5A(push ecx) to my cave,Writing ECX contents to a file, restore disturbed instructions(because of jump to cave) and jump back. Is'nt that what I'm supposed to do?
Peres
08-01-2004, 03:41 PM
Your idea is right, but you should first determine what you need in order to support your brand-new routine. You could need room for globals as well as new import functions. Just write some code using CreateFile and such - as you said in your first post - and you'll see.

Peres


Back to INT2E, trash SYSCALL:)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Back to INT2E, trash SYSCALL:)
PDA

View Full Version : Back to INT2E, trash SYSCALL:)

evaluator
08-01-2004, 07:25 AM
>>well, 2 years, ago i found for Tsehp trikie&comfort way
>>for Single-Step tracing on XP:
>>discard "Fast System Call" 'greats' & Return back to INT2E.
>>however, until yesterday i not looked in problem about
>>m$'s Errorneous managment for SYSENTER. ok now i looked:)
>of course best way is back to grEat INTs.

here I quickly built DRIVER for run-time changing SYSENTER-SYSEXIT to INT2E-IRETD.
It will fail, if not find orig-INT2E handler, but it can find under active SICE;
I have only XP-original built, & if it fails on SP1-SP2, send to me NTOSKRNL.EXE.
I have not AMD(XP-ready), but i think, also should patch correctly;

USAGE:
1. start KmdManager by Four-F; (included)
2. choose driver;
3. click on "REGISTER" button; (required ADMIN privileges)
IF SUCCESS:
4. click on "RUN" button; Driver will start & exit;
If you see STATUS = SUCCESS & LAST ERROR = "The specified driver is invalid", so ALL is OK!
if you see STATUS = SUCCESS & LAST ERROR = "The request .. because of an I/O device error",
so patch not happens, because of not exact matches or already patched,
if you are trying not first time;

for be sure, what happens, look at 7FFE0300h of virtual memory;

5. finally, you can press "UNREGISTER" button.

Now you are ready for happy tracing & debugging with INT2Eh;
SICE(from DS2.7) also will mutch happy on INT2E & will display function numbers!

**
SOON: About non run-time disabling SYSENTER-SYSEXIT, or how I found..

[edit] corrected attachment in below post..
evilcry
08-01-2004, 08:45 AM
Hi,
i'm new in this forum.

Intersting application, i will deeply study the source code ;)

Have a nice day
Bye
evaluator
08-01-2004, 09:12 AM
nothing big interesting I see there.. simple patcher.

Please, provide me with memory dump of address 7FFE0000h from
XP SP1,SP2;(& AMD)
I will check patterns, if they are similar with XP-orig.
doug
08-01-2004, 10:15 AM
Thanks eval, very interesting indeed.

In your code, I noticed you named 'syscall': "AMD sysenter" is there any reason for that?

Here is what my system has at 7FFE0300 (Windows XP SP1, AMD Athlon XP)

7FFE0300 ; ---------------------------------------------------------------------------
7FFE0300 8B D4 mov edx, esp
7FFE0302 0F 34 sysenter
7FFE0304 C3 retn
7FFE0305 ; ---------------------------------------------------------------------------
7FFE0305 9C pushf
7FFE0306 81 0C 24 00 01 00 00 or dword ptr [esp], 100h
7FFE030D 9D popf
7FFE030E C3 retn
7FFE030F ; ---------------------------------------------------------------------------
7FFE030F 8B D4 mov edx, esp
7FFE0311 0F 05 syscall
7FFE0313 C3 retn
7FFE0314 ; ---------------------------------------------------------------------------
7FFE0314 9C pushf
7FFE0315 81 0C 24 00 01 00 00 or dword ptr [esp], 100h
7FFE031C 9D popf
7FFE031D C3 retn
7FFE031E ; ---------------------------------------------------------------------------
7FFE031E C2 08 00 retn 8
7FFE031E ; ---------------------------------------------------------------------------

Intel P4m (xp sp1)

7FFE0300 8B D4 mov edx, esp
7FFE0302 0F 34 sysenter
7FFE0304 C3 retn
7FFE0305 ; ---------------------------------------------------------------------------
7FFE0305 9C pushf
7FFE0306 81 0C 24 00 01 00 00 or dword ptr [esp], 100h
7FFE030D 9D popf
7FFE030E C3 retn
7FFE030F ; ---------------------------------------------------------------------------
7FFE030F 8B D4 mov edx, esp
7FFE0311 0F 05 syscall
7FFE0313 C3 retn
7FFE0314 ; ---------------------------------------------------------------------------
7FFE0314 9C pushf
7FFE0315 81 0C 24 00 01 00 00 or dword ptr [esp], 100h
7FFE031C 9D popf
7FFE031D C3 retn
7FFE031E ; ---------------------------------------------------------------------------
7FFE031E C2 08 00 retn 8
7FFE031E ; ---------------------------------------------------------------------------
evaluator
08-01-2004, 10:33 AM
Curious:)
Because i merged .text with INIT, driver REalLy not loads!
I reuploaded corected zip.

doug, but in AMD docs I read 0Fh 05h is SYSENTER for amd!??
evaluator
08-01-2004, 10:47 AM
nah, I just named AMD's 'SYSCALL' as AMD's SYSENTER;
(they are same functions, but another names+opc)

this is not prob, but..
so on AMD-XP at 7FFE0300h is Pentium opcode of SYSENTER!?
& this instruction is executed insteaed of AMD's SYSCALL really??
doug
08-01-2004, 04:12 PM
this is not prob, but..
so on AMD-XP at 7FFE0300h is Pentium opcode of SYSENTER!?
& this instruction is executed insteaed of AMD's SYSCALL really??

Yes, that's what happens here. opcode 0f 34 gets executed.

Can't really trace into with softice though.
evaluator
08-01-2004, 04:18 PM
that is very okey for my driver, if same code is on AMD, so patch will same.
But anyway is interesting, why on AMD not used own "SYSCALL-SYSRET"???
(OF05h 0F07h opcodes) Any info?

later about why we can't trace into SYSENTERs terrible managment..
evaluator
08-01-2004, 05:02 PM
this is little trainer on W9x for see, how easy is traicing with debugger into SYSENTER-SYSEXIT;
i built it for calculating SYSENTER-SYSEXIT speed;
15h rdtsc-cicle i have as high-speed on my 600CEL;

enjoe;

[edit], forgot.. this prog expects Pentium..
JMI
08-02-2004, 04:04 AM
Those of you following this interesting Thread will find additional discussion of these issues, including imput by some of the posters here on the exetools forum in a Thread titled: "SYSENTER hook"

http://www.exetools.com/forum/showthread.php?p=22708

Some of it is the same information, but some of it is not included in the discussion here.

Regards,
evaluator
08-02-2004, 08:16 AM
i reuploaded more correct version of SYSENTER-SYSEXIT-trainer;(for W9x)
so what speed has SYSENTER-SYSEXIT on your Pentiuses?
bilbo
08-02-2004, 08:37 AM
hi, mates,

since there is people interested in the thread, here is how I have managed to go from SYSENTER to INT 2E and vice versa.

Notes:
(a) used language is C for better reading (sorry, at least for me...)
(b) no kernel driver involved - the whole job is done by ring3
(c) platform is Windows XP (W2k has no SYSENTER stuff)
(d) I have not performed the bunch of checks which evaluator carried out... sorry: this is not a production release, just a learning tool...

Usage:
SWITCH [-INT2E | -SYSENTER]

// swap.c
// coded by bilbo on 02aug04 - compiled with M$ as "cl -W3 swap.c

#include <windows.h>
#include <stdio.h>

#pragma comment(lib, "advapi32")
#define FCHK(a) if (!(a)) { printf(#a " failed\n"); exit(0); }
#define DebugWriteMemory 9

// globals
typedef DWORD (NTAPI *PZwSystemDebugControl)(DWORD ControlCode,
PVOID InputBuffer, ULONG InputBufferLength, PVOID OutputBuffer,
ULONG OutputBufferLength, PULONG ReturnLength);
PZwSystemDebugControl ZwSystemDebugControl;

/*
* get native entrypoint and grant debug privileges
*/
void
prepare_me(void)
{
HMODULE hModule;
HANDLE hToken;
TOKEN_PRIVILEGES tok;

// retrieve the native function ZwSystemDebugControl entrypoint
FCHK(hModule = GetModuleHandle("ntdll.dll"));
FCHK((ZwSystemDebugControl = (PZwSystemDebugControl)
GetProcAddress(hModule, "ZwSystemDebugControl")));

FCHK(OpenProcessToken(GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken));

tok.PrivilegeCount = 1;
tok.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

// grant debug privilege
FCHK(LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tok.Privileges[0].Luid));
FCHK(AdjustTokenPrivileges(hToken, FALSE, &tok, sizeof(tok), NULL, NULL));
}

/*
* write a buffer to kernel space
*/
void
wr(LPVOID dst, LPVOID src, DWORD len)
{
struct {
LPVOID kernel_addr;
LPVOID user_addr;
DWORD len;
} mem;

mem.kernel_addr = dst;
mem.user_addr = src;
mem.len = len;
FCHK(!ZwSystemDebugControl(DebugWriteMemory, &mem, sizeof(mem), 0, 0, 0));
}

void
main(int argc, char **argv)
{
LPVOID the_addr = (LPVOID)0xFFDF0300;

if (argc != 2) {
printf("Usage: %s -int2e to \"downgrade\" WinXP to INT 2E\n"
"\t-sysenter to \"upgrade\" it to SYSENTER\n", argv[0]);
return;
}

prepare_me();

if (!strcmp(argv[1], "-sysenter")) { // restore original SYSENTER

// 8BD4 mov edx, esp
// 0F34 sysenter
// C3 ret
static BYTE SYSENTER[] = { 0x8B, 0xD4, 0x0F, 0x34, 0xC3 };

wr(the_addr, SYSENTER, sizeof(SYSENTER));

} else { // "downgrade" to INT2E

// EB03 jmp $+3 ; skip SYSENTER/RET
// 0F34 sysenter
// C3 ret
// 8D542408 lea edx, [esp+8]
// CD2E int 2eh
// C3 ret
static BYTE INT2E[] = { 0xEB, 0x03, 0x0F, 0x34, 0xC3, 0x8D, 0x54, 0x24,
0x08, 0xCD, 0x2E, 0xC3 };

wr(the_addr, INT2E, sizeof(INT2E));
}
}

Simple is beautiful, isn't it?
Best regards, bilbo
evaluator
08-02-2004, 10:54 AM
so you will overwrite code
pushf
or dword ptr [esp], 100h
popf
retn

here reterns kernel if TFlag tracing on sys enter:)
omega_red
08-02-2004, 11:50 AM
Do you have any docs that show working of ZwSystemDebugControl? Although I've found interesting source (search for "Copyright (C)2004 randnut@hotmail.com" on google), it'd be nice to share some knowledge ;)
lifewire
08-02-2004, 12:33 PM
that is interesting bilbo, i didn't know that it was possible to write to kernel memory from ring3... and it quite scary too, since i see enough possibilities for abuse.

ZwSystemDebugControl performs a subset of the operations available to a kernel mode
debugger.
NTSYSAPI
NTSTATUS
NTAPI
ZwSystemDebugControl(
IN DEBUG_CONTROL_CODE ControlCode,
IN PVOID InputBuffer OPTIONAL ,
IN ULONG InputBufferLength,
OUT PVOID OutputBuffer OPTIONAL ,
IN ULONG OutputBufferLength,
OUT PULONG ReturnLength OPTIONAL
);
Parameters
ControlCode
The control code for operation to be performed. Permitted values are drawn from the
enumeration DEBUG_CONTROL_CODE .
typedef enum _DEBUG_CONTROL_CODE {
DebugGetTraceInformation =1,
DebugSetInternalBreakpoint,
DebugSetSpecialCall,
DebugClearSpecialCalls,
DebugQuerySpecialCalls,
DebugDbgBreakPoint
}DEBUG_CONTROL_CODE;
InputBuffer
Points to a caller-allocated buffer or variable that contains the data required to perform
the operation. This parameter can be null if the ControlCode parameter specifies an
operation that does not require input data.
InputBufferLength
The size in bytes of InputBuffer .
OutputBuffer
Points to a caller-allocated buffer or variable that receives the operation’s output data.
This parameter can be null if the ControlCode parameter specifies an operation that
does not produce output data.
OutputBufferLength
The size in bytes of OutputBuffer .
ReturnLength
Optionally points to a variable that receives the number of bytes actually returned to
OutputBuffer . If this information is not needed, ReturnLength may be a null pointer.

i guess i violate some copyrights here, if somebody is interested in more text you can mail me.
omega_red
08-02-2004, 01:11 PM
that is interesting bilbo, i didn't know that it was possible to write to kernel memory from ring3... and it quite scary too, since i see enough possibilities for abuse.

I know that it's possible by \Device\PhysicalMemory, but didn't know the SystemDebugControl way, which looks more "clean" ;)

PS. Is your info from DDK? I think I have to spare some HD space to install msdn docs again ;]

PS2. In the source I've mentioned there are more interesting values of the control code ;)
typedef enum _DEBUG_CONTROL_CODE {
DebugSysReadIoSpace = 14,
DebugSysWriteIoSpace = 15,
DebugSysReadMsr = 16,
DebugSysWriteMsr = 17,
DebugSysReadBusData = 18,
DebugSysWriteBusData = 19,
} DEBUG_CONTROL_CODE;
omega_red
08-02-2004, 01:33 PM
Anyway, it's not working on win2k (although ZwSystemDebugControl is present in ntdll) - I knew that XP is evil :p
lifewire
08-02-2004, 01:55 PM
the documentation for the api is in the book "Windows NT 2000 Native API Reference".
omega_red
08-02-2004, 08:24 PM
Great, thanks. Seems that ordering this book was also a good idea ;)
bilbo
08-03-2004, 02:08 AM
evaluator: ??? you're setting Trace Flag, next??? obviously I'm overwriting code, I'm patching it! Have you tried the code? Does it work? That's all!

lifewire, disavowed: your doc from book and your code from "Mainsoft" refer to Win2K, and they relate to the less interesting part of the API. They are of little practical use.

omega_red: yes, WinXP is evil, and they have added the most interesting parameters to the API. Sorry you are not running it. You could always implement back inside Win2K! Here they are (found from reversing the kernel, missing in DDK docs):

DebugSysGetVersion = 7,
DebugReadMemory = 8,
DebugWriteMemory = 9,
DebugReadPhysMemory = 10,
DebugWritePhysMemory = 11,
DebugSysReadControlSpace = 12,
DebugSysWriteControlSpace = 13,
DebugSysReadIoSpace = 14,
DebugSysWriteIoSpace = 15,

Now we must infere the structures in and out to the API:

DebugSysGetVersion (7)

struct is DBGKD_GET_VERSION64, see DDK docs

DebugReadMemory (8)

look my snippet at
http://www.exetools.com/forum/showthread.php?t=4620

DebugWriteMemory (9)

look my snippet in this thread

DebugReadPhysMemory (10)
DebugWritePhysMemory (11)

they act like \Device\PhysicalMemory, which you pointed out
input struct is (names are my inventions)

typedef struct {
PVOID low_phys_addr;
PVOID high_phys_addr;
PVOID user_addr;
DWORD len;
} PHYS_MEMORY_OP;

DebugSysReadControlSpace (12)
DebugSysWriteControlSpace (13)

for KPROCESSOR_STATE structure manipulations. Input Struct is

typedef struct {
PVOID lobias; // in KPROCESSOR_STATE
PVOID hibias; // must be 0
PVOID user_addr;
DWORD len;
DWORD processor_no;
DWORD unused;
} CONTROL_STRUCT_OP;

DebugSysReadIoSpace (14)
DebugSysWriteIoSpace (15)

see my snippet at http://www.woodmann.net/forum/showthread.php?t=6056

WinXP is evil, but it is a lot more fun!
Regards, bilbo
evaluator
08-03-2004, 11:37 AM
you not understand well, what about i..
remember, you know, that if we directly will replace code on 7FFE0300,
we will have problem with past syscalls;
samely,theoretically, if there was pending traced target, then it will retern on 7FFE0305h..
this of course just theoretical fact..

so mOST safer is keeping those code also.
bilbo
08-04-2004, 02:21 AM
remember, you know, that if we directly will replace code on 7FFE0300,
we will have problem with past syscalls;
samely,theoretically, if there was pending traced target, then it will retern on 7FFE0305h..

That's true, past syscalls are hanging, but not at 7FFE0305, just at 7FFE0304. Let's look at the original code

7FFE0300 8BD4 MOV EDX,ESP
7FFE0302 0F34 SYSENTER
7FFE0304 C3 RET <- this must be preserved
7FFE0305 8BD4 MOV EDX,ESP
7FFE0307 0F05 SYSCALL (AMD opcode)
7FFE0309 C3 RET

It is safe to overwrite the code in red! In fact, if you put a breakpoint there, Softice will never pop-up. That's AMD code which, as we have seen so far, it is never used at the moment!

Regards, bilbo

P.S. Very interesting your MSR_AND_SYSCALLS program. I spent some delightful time disassembling it... Unfortunately I cannot try it at the moment...
bilbo
08-05-2004, 03:09 AM
Tried MSR_AND_SYSCALLS on Windows 98 Pentium III 866MHz Intel:
0x15 / 0x15
The number of cycles is not depending on the clock, correct?

Regards, bilbo
evaluator
12-30-2004, 03:20 PM
hi, goys!

in august i lost Internet connection, now restored;
but yet havn't normal place for PC;
today i quickly wrote this part about SYSENTER-INT2e;
check it for grammar & other errors & replay;

later i will review errors in SYSENTER management by m$;
JMI
12-30-2004, 10:13 PM
evaluator, our musician friend:

Welcome back. We've missed your enduring charm and wise contributions. :yay:

Regards,
evaluator
12-31-2004, 09:21 AM
JMI,

i'm not BACK & not ASS.. & here is no offtop!

:) remove my & your post:)
JMI
12-31-2004, 04:10 PM
evaluator:

As frequently is the case, I'm not sure what you mean by what you wrote. I was simply trying to welcome you after a long absence.

Regards,
esther
01-01-2005, 10:36 PM
He meant he posted on the wrong section.He wants you to delete the "wecome" message )just like thankyou message in exetools rofl
JMI
01-02-2005, 03:41 AM
On exetools, only those who have insufficient post count to be Members are not allowed to post "Thank You" type posts because they become excuses for trying to increase post count. However, Aaron has now activated a "Thank You" button on the threads and anyone can "thank" anyone without posting at all. It also shows in the tag with the post count how many "thank yous" one has and there is a view of those who have given the "thank you's."

And evaluator's post is not in the "wrong section." It is clearly a continuation of the prior discussion. He may have been asking me to remove my "off topic" welcome, but there is no need to do so. :smug: He is welcome back, even when he is obtuse. :D

Regards,
diz
01-02-2005, 09:32 AM
"i'm not BACK & not ASS.. & here is no offtop!"

evaluator:

As frequently is the case, I'm not sure what you mean by what you wrote.

I think he said that he's not 'back'. And 'back' is what he relates to 'ass' :)
This might have been a words riddle, you didn't studied it long enough ;)
JMI
01-02-2005, 01:22 PM
Actually, my own decryption was to connect the word "ASS" with my use of the phrase "wise counsel," making a play on the difference between "wise" and "wiseass." But I was not sure. Sometimes eval's jokes are more complex than I can "decrypt." :D

Regards,
evaluator
01-03-2005, 02:55 PM
i ripped MMIsAddressValid function (XP0) (little changed) & not understand
last check in function(@@81:). Is it need? or bug? or bad rip?
explain somebody, plz

MMIsAddrVal:
mov ecx, [esp+04]
mov eax, ecx
shr eax, 14h
and eax, 0FFCh
mov eax, [eax+0C0300000h]
test al, 1
jz @@NotValid
test al, al
js @@Valid
shr ecx, 0Ah
and ecx, 3FFFFCh
sub ecx, 40000000h
mov eax, [ecx]
test al, 1
jz @@NotValid
test al, al
js @@_81

@@Valid:
mov al, 1
retn 4

@@NotValid:
xor al, al
retn 4

@@_81:
;here ECX = calculated PTE address..

and ecx, 0FFCh; (for example for @F0000000,@B0000000..etc..=0
mov eax, [ecx+0C0300000h]
and ax, 81h
cmp al, 81h
jnz @@Valid
jmp @@NotValid
Timbo
01-04-2005, 06:12 AM
Well couldn't explain this but anyway
tried the backint2e system driver, changes were made, but
if i set a breakpoint (let's say GetDrivetypeA) debugger won't popup.
After i enter debugger manually i see that the breakpoint was deleted.
Without loading 'backint2e' setting breakpoints will work.
0rp
01-04-2005, 09:11 AM
whats the problem with SYSCALL and singlestep?
or why is the int2e callgate 'better' than a syscall?

@evaluator you should try to get the leaked 2ksrc, that would answer your question
evaluator
01-05-2005, 03:07 AM
i will never try sources; SourceLooking is against reversing!

about sysenter will continued;
but no comments about text?
Kayaker
01-05-2005, 11:52 PM
Hi evaluator

That is actually explained in Bilbo's excellent analysis of the Softice PHYS command. It's a check on the Page Size (PS) and Present (P) bits of the PDE.

http://woodmann.net/forum/showpost.php?p=41341&postcount=13

Cross-reference with the Intel manual Vol 3 fig. 3.14
PS bit 7, P bit 0
81h = 1000,0001

I found a snippet from a "roll your own" MmGetPhysicalAddress that uses a similar algorithm to MmIsAddressValid which also explains it.
and ax, 81h ; PS=1 P=1 (PDE .4M Page)
cmp al, 81h

Kayk...
evaluator
01-06-2005, 03:01 AM
Kayaker, i'm NOT about 81h, but ECX content! (which's PDE is there?)
force to execute that code & see..

in fact, code already is ripped & not prob to not optimise;
just interesting on strange.
Timbo
01-21-2005, 11:21 AM
OT:
Well new ones on the way
0F 01 C1 vmcall

hxxp://www.heise.de/ct/04/15/024/


Tool to convert RVAs to physical addresses???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tool to convert RVAs to physical addresses???
PDA

View Full Version : Tool to convert RVAs to physical addresses???

yaa
08-01-2004, 01:57 PM
Hello,

is there a good tool around that after having parsed a PE file is capable of converting RVAs on that PE file to physical addresses?
BTW is it correct that to convert RVAs to physical addresses the specific PE file header must be first analyzed?
Thx.

yaa
Peres
08-01-2004, 03:46 PM
There are a lot of tools providing the feature you ask for. I am fond of PEditor, but it's a matter of taste. In reply to your question: you only must scan the section table - located just after the PE header - to be able to convert between RVAs and offsets.

Peres
cRk
08-01-2004, 05:01 PM
There are a lot of tools providing the feature you ask for.

sure!!! just do a little google search and you'll see :yay:

btw i recomend you to make a better effort and read the rulez + faq again, in case you ever did, of this board before posting again ....

Regards
yaa
08-01-2004, 05:11 PM
I found Iczelion's. It seems to do the job fine. I didn't know of PEditor. If I hadn't asked I would not have known .... and I did ask google. It seems that this time Peres was better then google.

yaa
cRk
08-01-2004, 05:15 PM
Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

it's sad that maybe you don't read very well or you pretend to be a litle blind i guess. you did never saw the topic of this section didn't you? ;)

let's wait for JMI reply .... :D
JMI
08-01-2004, 05:19 PM
Hi yaa:

Sometimes cRk is a wee tad grumpy, although his suggestion was good, it would have been more helpful if he had suggested some search terms he knew would produce results. You may be suprised that the actual title of your thread contains the terms which would have found you several.

Try again using "RVA to physical addresses" and/or just "RVA physical address". (without the quotes) Mr. Google produced several additional tools you might want to try. And searching tool site is also a good place to find such things, usually under "utilities".

And cRk: It is NOT a violation of the "Rulez" to ask for the "name" of a tool. Just to ask where to find it. THAT is what searching if for.

Regards.
disavowed
08-01-2004, 08:19 PM
if you want to do it programmatically, this is handy: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/debug/base/imagervatova.asp
JMI
08-02-2004, 12:05 AM
Oh there ya go, bring some darn piece of Code into the problem again. We don't want no stinking Code man. We want tools man ... preferrably easy tools.

We don't want to work man,we want a prepackaged, genuine, over-the-counter solution man. Yah, Right On. We want the "tool" to do the work, Dude. What was you thinging man? :devil:

Regards,
evaluator
08-02-2004, 02:18 AM
disavowed,
little help, why i can't find about ZwYieldExecution in that m$-library.
JMI
08-02-2004, 02:53 AM
Because you need Windows NT/2000 Native API Reference, page 245. :yay:

ZwYieldExecution yields the use of the processor by the current thread to any other thread that is ready to use it.

NTSYSAPI
NTSTATUS
NTAPI
ZwYieldExecution
VOID
);
Parameters
None
Return Value
Returns STATUS_SUCCESS or STATUS_NO_YIELD_PERFORMED
Related Win32 Functions
SwitchToThread
Remarks
SwitchToThread exposes the full functionality of ZwYieldExecution.

Have fun.

Regards,
Peres
08-02-2004, 06:15 AM
I'm gonna change my title from 'PE Restyler' to 'Human search engine'
yaa
08-02-2004, 04:34 PM
cRk I honestly find it hard to understand the subtle pleasure that people like you seem to experience when they can scold someone. It is something that is simply far from me.

yaa
evaluator
08-02-2004, 04:58 PM
"Windows NT/2000 Native API Reference" is not MSDN, ye?
JMI
08-02-2004, 07:59 PM
Last time I looked, ye. :D

Regards,


Have Hardlock (Dongle) will learn!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Have Hardlock (Dongle) will learn!
PDA

View Full Version : Have Hardlock (Dongle) will learn!

Pixeldog
08-01-2004, 02:11 PM
Hello out there, I have just found this forum and am pleased to find a great deal of info when reading between the lines. However since I am not in anyway a reverse engineering guru, just a pixel shifter (I make it look great) there are a few things I really need to know.

First off I also do cad/cam work with an industrial program at my afternoon shift job (pays the bills) and I am needing to use the program from work at home more often then usual. Here's the problem, the program with the dongle needs to stay at work during the day shift for the cad/cam operator during the day so the only time I have is the weekend to bring the dongle home and use it.

I have been reading and researching just about everything I can get my hands on, even the article found on this forum which deals with the type of hardlock this program uses.

After reading the FAQ section I know not to ask for the obvious but I am eager to learn the proper ways of getting by this program protection if anyone was willing to guide the blind, ie: is it worth trying to break the dongle or is there something that could speed up the process.

I have downloaded many tools from a few sites but find that they don't work to well with WinXP so I am going to install dual OS Win 95/98 to help make those tools and the program that I have run easier. Turns out that the program I use works better on Win 95/98, there are updates but the company I work for is a little scared to dip into the pocket and spend the money, you know "if it works why upgrade" attitude.

Looking forward to any comments.
dELTA
08-01-2004, 05:37 PM
...or is there something that could speed up the process...
You're dangerously close to a crack request, proceed with caution...
JMI
08-01-2004, 06:18 PM
Danger Will Robinson Danger :whoops:
Woodmann
08-01-2004, 07:07 PM
Lets get down to it........

You want to have a running version of this software at home.
If this program runs best under 95/98, it should be no problem for
you to find out how to bypass the dongle.

Now, you need to decide how much effort you want to put into this.
You can buy a replacement dongle or, you can actually learn something.

I will tell you right now that if you want to learn, it will take the most time.

Everything you want to know is available to you right here.
There is a search function at the top and links at the bottom of each page.

Good luck, Woodmann
evaluator
08-02-2004, 02:13 AM
another chance for "speed up process" with no time loss:
is "use the program from work at home" is iLLegaL!?

!?!
JMI
08-02-2004, 02:45 AM
Not if the Boss says he can. :yay: And, of course, he could ask the Boss to buy another dongle so he could do more work at home, unless, of course, the Boss doesn't know. :sneaky:

Regards,
Pixeldog
08-02-2004, 10:02 AM
As mentioned in my long winded intro of my problem, the boss is to cheap to upgrade the program to a version that works with WinXp, the last thing he wants to do is buy another dongle, already went that route. He said I could buy it, but that would require more funds then what I have at this time, besides he wants me to complete or catch up on the work load, "go figure".

I just thought that since I do have the dongle on weekends that there might be a chance that a seasoned pro from the boards could help with the learning curve of busting this damn dongle protection, not just give a crack.

I have followed much of the information that is within this forum and found it to be interesting and I would imagine informative for someone who has RE skills, but like I said earlier I am a pixel shifter (artistic type) and grasping some of this RE stuff when the starting point eludes me is not easy.

So again if there is someone willing to guide my exploration into the darkness of RE and put the seed of knowledge into my head i would be very gratefull.

Thanks
Fake51
08-02-2004, 12:27 PM
You're dangerously close to a crack request, proceed with caution...

Guys, go easy on him, he specifically stated that he wanted to learn. His "speeding up the process" seems intended not at crack requests but more likely at info on how to bypass dongles. Anyone here that doesn't remember the old essays on fravias site about useless dongle protections that didn't work the dongles right?

Anyway, never worked with dongles, so I don't have useful info to share. Only the generic:

Never lose sight of your main goal: to make the sucker work. There's never just one way of doing things, and many times some ways are easier than others.

Fake
NoLOcK´s
08-06-2004, 03:20 PM
Hi, all
dELTA
08-07-2004, 12:40 PM
Mental note:
Insert into FAQ that posts like that will result in immediate ban... :rolleyes:
Pixeldog
08-07-2004, 01:01 PM
dELTA.... I am confused, I don't believe anything I am asking is against the rules that I have taken the time to read a number of times. Just looking for a mentor, nothing more than that.
JMI
08-07-2004, 02:36 PM
One of the requirements here is that you do some of your own work and show what you have done. So far, you have not shown that you have done anything, other than "download some tools which do not work well with WinXP." This is not a mentoring society. Those here attempt to assist with specific, identified problems. This is not were to come to "learn all you need to know about reversing this dongle" from the ground up, in ten easy steps. It simply doesn't work that way, and it shouldn't.

Reversing dongles, depending on type and version, is generally not an easy task and you have also done nothing to demonstrate either your skill set or that you have spent the time necessary to acquaint yourself with whatever literature may be available on reversing your particular brand of dongle. Since, from your brief description of you situation, you dongle is not likely to be a really current version, there is likely to be information available on the net describing other's efforts at reversing its protection system. That is what searching the net is all about, entering search terms in combination, attempting to get good leads to information. You should know the name of your dongle. Try searching for "name_of_dongle and reversing" (without the quotes) and then try it again substituting "cracking" for "reversing." In otherwords, work at it, don't just wait for someone to take you by the hand and lead you through the dark codewoods.

Regards,
dELTA
08-07-2004, 03:28 PM
Pixeldog, although I agree with JMI (which was the reason for my first post in this thread), my last post was referring to the post by "NoLOcK´s". :)
qww
08-14-2004, 10:47 AM
it's true


Help Rebuilding IAT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help Rebuilding IAT
PDA

View Full Version : Help Rebuilding IAT

canuckcracker
08-01-2004, 10:59 PM
Hi,

I've been reading a tutorial by TiTi on how to rebuilt the IAT.

I have everything done except I don't understand this part:

4. For each function name in the 3rd part of the import table, we call the
GetProcAddress API. When this API returns 77E7897Fh, that's it, we reached
the right function. So we make the corrupted IAT point to the right
function name. (in this case that is 'wsprintfA').

www.yates2k.net/rebuild.txt

He talks about the "3rd part of the import table" where all the function names are, read in each name, call GetProcAddress on it and compare to the address I read in from IMPORT_THUNK_DATA.u1.Function, if its the same, convert the address.

My problem is, I don't know how to go to the start of this "3rd part" of the import table??

Any help appreciated,

thanks,

edit:

while googling for info i stumbled across this nice article on PE format
http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx
JMI
08-02-2004, 12:13 AM
There is a whole lot of information about IAT rebuilding on this Forum. In fact, there is so much information we had to invent something special, called the "SEARCH" button to handle access to all the information.

Perhaps you've heard of it? It's mentioned in the FAQ, you know, the one mentioned in the BIG RED LETTERS which says what you are supposed to do before you ask a question.

Please go back and read those FAQ topics now, then search the forum for information using "IAT rebuild*" (without the quotes) as your search term and then post again after you've done some basic homework on your own.

Oh. And your edit, saved me from giving you this for the rest of your homework assignment:

http://board.win32asmcommunity.net/attachment.php?postid=144294

Regards,
canuckcracker
08-02-2004, 12:15 AM
I have searched the forum. I've read TiTi's tutorial, I've also searched on google. I'm stumped about one section of TiTi's tutorial.

How do you know I have not searched? if you can check logs, perhaps you should and you will see a search for iat rebuilding, with variations on the keywords. I just simply do not understand a part of the tutorial and I'm asking for help.

While one or more of my other posts perhaps should have been researched better, you really discourage any kind of posts looking for help by your constant flaming of "use search! use search!"

Thank You
JMI
08-02-2004, 12:25 AM
canuckcracker:

You have posted several threads in the last several days which demonstrate that you are indeed a newbie. That, in and of itself is no problem. We were all newbies at one time or another and even after we have some experience on some, or many subjects, we remain newbies on other subjects.

The problems is that you keep asking the most basic of questions which demonstrate that you have too limited a background in cracking, that is explained ONLY by the fact that you have failed to do very much BASIC reading of the broad subject matter.

This is not a kindergarden where we take you by the hand and teach you everything you should want or need to know. This is a place where YOU are supposed to DO THE BASIC WORK YOURSELF .

Your stuck on "part three" because you haven't a clue about what an IAT is or how one is constructed or how one is messed with by a protector and you "just" want someone to explain this "one" simple thing to you, while you have certainly apparently done NOTHING to study the problem by reading MANY tutorials and threads on rebuilding IATs. That is your problem. Not how to do "step three in a 1999 tutorial."

Now stop posting such question and particularly stop posting such questions in the Advanced Forum and spend some quality time just reading and reading and reading, until you have some better idea what IAT is all about and what protectors try to do to it. The object isn't just to get through this ONE ancient tut, but to LEARN SOMETHING ABOUT IAT REBUILDING.

Regards,
canuckcracker
08-02-2004, 12:29 AM
I have read numerous papers on PE format. TiTi's tutorial is the only one which explains rebuilding the IAT. While I understand what he does, I don't understand what he means by "3rd part of the import table" -- This doesn't mean I don't understand what an Import Table is, or what it's used for.

And yes the object IS to learn about the PE format & specifically the IAT & how protections/packers may "mess it up" excuse if while in my search for this knowledge(yes, SEARCH, because i have SEARCHED) despite what you would like "think". I will refrain from ever posting again.

It's no wonder there is no discussion on this board. You're simply anal & over jealous about your "moderating" duties.

Regards to you!

p.s: you shouldn't waste your time replying as I am deleting my account & will not read it.
JMI
08-02-2004, 01:04 AM
Well, seems canuckcracker's taken his marbles and gone home in a huff. :rolleyes:

I wouldn't want any subsequent readers to suspect that TiTi's tutorial on IAT Rebuilding "is the only one which explains rebuilding the IAT." Heck, it's not even the only only on the Yates link at the bottom of the forums.

http://66.98.132.48/yates/Import_tables.txt

titled: Understanding Import Tables, written for the beginner.

There are many, many others on the net and some of the other links at the bottom of the Forums discussing how the IAT works, what it does and how various protectors attempt to screw it up.

Searching on this Forum using "rebuild IAT" (without the quotes) produced 174 Threads discussing IAT rebuilding, including specific ones for a large variety of protector schemes that mess with the IAT.

Regards,


Interesting studies on web topology
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Interesting studies on web topology
PDA

View Full Version : Interesting studies on web topology

TBone
08-02-2004, 04:01 PM
I wasn't quite sure where to post this since there isn't really a general forum here. I figured that this is probably where it would do the most good since it pertains to the "physics" of searching the web. I think the article is vague enough about the actual searching process that I won't get banned for giving out too many details about our big top secret that you can search the web for information :devil:

I think this paper was written in 2000, so if it's old information that everyone already knew about, then I guess I'm just an idiot :p. It's a research paper called "Graph structure in the web" by 8 researchers from AltaVista, IBM, and Compaq. They did an exhaustive study on the structure of the web from a hyperlinking standpoint, using a huge data set acquired from AltaVista. The paper itself is really detailed and includes mathematical models that I've grown far too rusty with to fully appreciate, but some of the most interesting conclusions include:

In other recent work, [Albert, Jeong, and Barabasi 99] report the intriguing finding that most pairs of pages on the web are separated by a handful of links, almost always under 20, and suggest that this number will grow logarithmically with the size of the web. This is viewed by some as a "small world" phenomenon. Our experimental evidence reveals a rather more detailed and subtle picture: significant portions of the web cannot at all be reached from other (significant) portions of the web, and there is significant number of pairs that can be bridged, but only using paths going through hundreds of intermediate pages.

Our analysis reveals an interesting picture (Figure 9) of the web's macroscopic structure. Most (over 90%) of the approximately 203 million nodes in our crawl form a single connected component if hyperlinks are treated as undirected edges. This connected web breaks naturally into four pieces. The first piece is a central core, all of whose pages can reach one another along directed hyperlinks -- this "giant strongly connected component" (SCC) is at the heart of the web. The second and third pieces are called IN and OUT. IN consists of pages that can reach the SCC, but cannot be reached from it - possibly new sites that people have not yet discovered and linked to. OUT consists of pages that are accessible from the SCC, but do not link back to it, such as corporate websites that contain only internal links. Finally, the TENDRILS contain pages that cannot reach the SCC, and cannot be reached from the SCC. Perhaps the most surprising fact is that the size of the SCC is relatively small -- it comprises about 56M pages. Each of the other three sets contain about 44M pages -- thus, all four sets have roughly the same size.

We show that for randomly chosen source and destination pages, the probability that any path exists from the source to the destination is only 24%. We also show that, if a directed path exists, its average length will be about 16.

When you check out the model they finally wind up with, you can see that in general, only about 50% of the web (the core and the out nodes) is connected in a way that you would be able to find it by following links, assuming you had access to the core. And even more surprising - if you didn't have a search engine at all (and had to rely only on linking to find things on the web), you would probably only be able to reach 25% of it.

The other paper I ran across is called "Searching the World Wide Web" by Steve Lawrence and C. Lee Giles, for NEC Research. This is an earlier study from 1998, so it's getting pretty out of date, but some of the statistics may still hold true. Basically they concluded that individual search engines generally only covered 3-35% of the indexable web. They don't really define what they mean by "indexable", but I think the other paper gives you some ideea of what subset of pages that might include.

Okay, so it's probably antithetical, but:
http://www.almaden.ibm.com/cs/k53/www9.final
http://www.neci.nec.com/~lawrence/science98.html


new linux disassembler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > new linux disassembler
PDA

View Full Version : new linux disassembler

0xf001
08-02-2004, 04:54 PM
hi!

i am currently writing a new linux disassembler - based on mammon_s libdisasm.
currently it is in very early stage - but actually already can be useful. there are some interesting features to come (at least i think so, haha).

you might have a look at hxxp://lida.sourceforge.net

comments are very welcome. interested ppl of course can join!

cheers, your 0xf001
homersux
08-03-2004, 04:39 PM
looks good, I hope it's not too much to ask for a console CLI version of this tool.
OorjaHalT
08-03-2004, 08:08 PM
The download link seems down
homersux
08-03-2004, 08:28 PM
I downloaded it and tried it, it works ok but it got some bugs.
there is a cli backend that works on a console.

the bug is easy to reproduce,
as root,
dd if=/dev/hda of=mbr count=1 bs=512 (replace /dev/hda with the device that has the boot record, normally it's /dev/hda)
then
lida_end mbr -d 0 512
this doesn't seem to work.

I tried it with another file, it worked. so there is some bug in it.
0xf001
08-04-2004, 04:55 AM
hi all!

thanks for your replies!

[OorjaHalT]
the download link has been corrected, anyway it is the standard SF location :)

i know there are bugs in it - i am working on them. I also yesterday got libdisasm to segfault. damn. i will now update the libdisasm (it uses 0.16, but only disassemble_address of it), this requires some rewrite.

[homersux]
looks good, I hope it's not too much to ask for a console CLI version of this tool.

ahm. hmmm. originally it is intended to be gui based. as you have the navigation there. nevertheless i plan to move much of the perl stuff to the backend. this is CLI based :)
as you already tried this will serve the most tasks.
do you have some comments how you would like to work with a cli version?

To your masterboot :)
lida_end mbr -d 0 512
this doesn't seem to work.

I tried it with another file, it worked. so there is some bug in it.

currently RAW files are not yet supported. this is a minor effort - I will include it today evening.
you see that if you use the gui and try to open a raw file :)

------

thank you for trying out, definitely there is much to do and I will update as fast as I can. It is 0.1 and not intended to be stable or safe to use.
i have already a long todo list. next to come is some cryptoanalysis, automatic disassembling of data section regions and finaly flow analysis.

thank you again and please keep posting everything you encounter - this helps a lot!
lifewire
08-04-2004, 07:09 AM
the program looks nice. what kind of cryptoanalysis can we expect?
0xf001
08-04-2004, 10:01 AM
thanks lifewire :)

basically in the first run there will be a pattern based "heuristic" scanning like kanal does. This should find common patterns which are used as array initialization for certain algorithms. i am trying to make the search more "fault tolerant" or "fuzzy", so that slight changes to the standard values are recognized. Researching these patterns takes some time of course :)

on the other side - what is important?
you want to know which algorythms are used. and where. on linux - most likely programs will not implement algorythms - they will more likely use openssl functions. So possibly the above mentioned scanning is not as valuable as I initially thought. But anyway - I think in the future there will be more efforts put into SW security on linux side - for eg commercial products.
PPl will probably try to make finding algorythms harder by coding themselfes, or at least change the default arrays. This is where the above mentioned scanning should help.
Anyway I also ould like to provide an automated "summary overview" of functions in which you are interested.
So even if a program just plain functions like md5_init, ... linked to openssl, it should be displayed.
What I also plan is to try to do some heuristic fingerprint scanning for typical algorithm implementation. This will analyze the code sequences, not the datablocks.

Any further comments - please let me know! As mentioned interested people are welcome to overtake certain parts :), or submit ideas, fingerprints, ... :)

cheers, 0xf001
Polaris
08-04-2004, 11:52 AM
Any further comments - please let me know! As mentioned interested people are welcome to overtake certain parts :), or submit ideas, fingerprints, ... :)

cheers, 0xf001

Your projects looks really good and well-promising... Please include the possibility to have plugins and a SDK, it will make easier to expand and develop new ideas.

Byez,

Polaris
0xf001
08-04-2004, 07:16 PM
heya!

i have uploaded a new version. this includes bugfixes, mainly:
libdisasm segfault when decoding certain instruction and
displaying the disassembly:
now there is a difference between
mov eax, 80808080
and
mov eax, [80808080]
sorry for that :) of course in second case the value stored at the memory address is displayed.

btw did you realize that ldasm does not make a difference between both instructions?
this is really annoying.
even objdump does
(mov $0x80808080, %eax and mov 0x80808080, %eax)

cheers, 0xf001
0xf001
08-06-2004, 06:47 AM
hi again!

i have now uploaded lida-0.1.4.

this includes the cryptoanalyzer which detects currently typical implementations of
ripemd160, md2, md4, md5, blowfish, cast, des, rc2, sha(1+2)
algotithms

it is definately now getting more and more nice to work with it :)

cheers, 0xf001
Bengaly
08-06-2004, 04:16 PM
hey 0xf,

does lida have first pass analyzer? :) (aka, code-flow simulation)
0xf001
08-07-2004, 06:46 AM
hi ben,

unfortunately not yet, it currently only plain disassembles forward the whole section and remembers certain addresses as jmp/call destinations, and exported symbols. at least for usual gcc created executables this is usable, but definately i need to include the control flow analysis ... :)
besides that also the next step should be together with flow analysis - the seperation between code and data - and to somehow let the user mark address ranges to set the "type" or similar.
i am currently starting to implement it, but have not much time. for the
next version (except bugfixes) i hope to have a first basic implementation :)
but to make it intelligent i think that requires a lot of work ... we will see :)

cheers, 0xf001
0xf001
08-09-2004, 08:09 PM
hi ben!

short update: lida now does code flow analysis :)
it works great (i am impressed by myself, haha)
it traces during disassembly (which recursively goes through all possible branches) and keeps track (remembering start of instructions + their memory usage) of what it already disassembled, ... also if possible in this run indirect addressing is covered. so pass 1 == disassembly in this case
therefore i found a very efficient method :) (no stucts, or storage of address values or similar needed, hehe!)
second "pass" is to scan for function prologues and for each found one repeat pass1 starting at this address.
third pass is to examine the left holes :)
currently i am thinking of how to best find unreferenced "code regions" / "functions" as this i see as the major key for "not forgetting" to disassemble certain ranges. i know which ranges i have not yet processed, but just disassembling them could result in disassembling "data blocks". so i want to put there "some more analysis" - before attemting to disassemble.

the nature of my "pass1" implementation also immediately tells if there is some "jump into the middle of a previous processed instruction" - which is used as old antidisassembly "trick".
so i am also implementing a logic which tries to automatically overcome that
and let you probably view both disassemblies, somehow specially marked.

while implementing i find more and more fun on it, and cool it is still extremely fast (i never repeat any already processed address), oltough algorithm has totally changed :)

greets, 0xf001
Bengaly
08-10-2004, 04:01 PM
hi 0xf,

great! :)
if i had linux i could test it, unfortunately i don't.
but keep up the great work!
0xf001
08-10-2004, 05:41 PM
hey ben!

i have released now v 00.02 :)

this includes the control flow disassembling engine, and also the gui is pretty much updated, so i have now the typical seperate windows for
strings and symbols where you can click on the list items to jump to the address :)
also in sum i am running over 5 passes now. basically this is

1 - recursive disassembly from entry point (following all branches, stepping into calls)
2 - a "heuristic" scan finds the main() function, for glibc binaries, repeats
pass 1 from there.
3 - repeat pass 1 from the start of all executable sections
4 - scanning for function prologues and repeat pass 1 for each
5 - (optional) disassembling of "caves", this disassembles all bytes between
already known code blocks
6 - for all caves that are still existing (this can be when disassembly of the
end of the cave would overwrite a prev disassembled instruction)
display the bytes in DB xx, xx, xx ... form
if 5 is not done, the whole cave is displayed so.

cheers, 0xf001

btw i have new screenshots for you to see the new gui if you are interested.
getting linux on a computer btw is very easy nowadays - hehe :)
i myself switched totally now - at least for work. but that is another topic.
once you have linux, i hope to already have a good disassembler for you :)

cheers, 0xf001
Bengaly
08-11-2004, 04:15 AM
hi 0x0f,

"i hope to already have a good disassembler for you"
hrm, for me?.. for the linux community :)

do you trace control flows of indirect jumps, jump tables (i.e: jmp eax, jmp [eax+xx]).
recursive flow is good way, but this takes x amount of time.
sometimes the recursive flow can go deep soo much that the stack could not bear it and will crash (theory, but its possible if i am not mistaken)

i knowi can install linux, but i dont have hdd space for it.
keep up the good work.
0xf001
08-11-2004, 07:14 AM
hey ben,

yes, i take care of indirect jumps, but not yet jump tables.
i even think of implementing analysis to check for call [eax] :) - not always possible of course.

some function scanning and disassembling of caves for most executables yet creates same results as using objdump which is probably more luck at the moment.

recursive flow is good way, but this takes x amount of time.

no, this is not the case. at least i do not understand why it should? i on the fly update a map where i immediately see, if i already disassembled areas.
so 3 calls to the same functions: it is only once stepped into.
also call function+27: the destination address if it is marked as already disassembled i do not need to go there anymore.
i create a buffer with the size of the executable. for each instruction i disassemble i set at the address of the instruction (offset) the first byte to eg 1. for the remaining bytes of the instruction i set their correspond buffer values to 2. so if i disassemble offset 345, and my buffer[345]==1,
then i was already ecactly there.
using the map i can see even more:
i see if i want to disassemble at a point where i previously have disassembled, and the byte where i want to disassemble previously was a byte in the middle of an instruction.
meaning if the buffer[345]==2 then i attempt to disassemble the "middle" of a previous processed instruction.

example:

addr001 instruction -> buf[001]=1,buf[002]=2,buf[003]=2
addr004 instruction -> buf[004]=1,buf[005]=2
addr006 label1: instruction -> buf[006]=1,buf[007]=2,buf[008]=2
addr009 instruction
at another place:
jmp label <------- here i immediately see that i have already dis-
assembled exactly this address :
buf[006] == 1
....
....
jmp label+1 <-------- here i immediately see, that i have already
disassembled the address, but the concerned
instruction i have disassembled before started
one byte before, so i am disassembling
the middle of an instruction
buf[007] == 2

cool, ey :)

sometimes the recursive flow can go deep soo much that the stack could not bear it and will crash (theory, but its possible if i am not mistaken)

hehe. you are right. i tested it with nesting of over 5000 levels, and i only once segfaulted, because i was using a temp buffer as local variable, whcih i made to a global var, since then no problems.
but in theory it is possible of course!
in praxis i did not find any executable yet where it happens.
once i have enhanced the algorythm enough i will take time to build
up own "recursive" data structure for the local vars.
i really see no more comfortable way to disassemble than recursive.
i think you need to do so.
the problem is: i can not create a "complete" list of destination addresses, even in multiple runs - if i do not have recursion. i can not know where jumps/calls are located. anyway i find it the best technique for me, as it takes same time as plain disassembling from start to end.
at least same number of calls to "disassemble_address".

the good thing nevertheless is that even now without jump tables, you get
perfect results for nearly all "standard applications, gcc binaries" - and for any situation - you get the unrecognized data displayed as
DB xx, xx, xx
from there you can look at the data and disassemble from any address you want. just "d address" "d address+1"... and you see, if there is code hidden.
so the goal IS to disassemble as accurate as possible, but maybe there is always a situation where i can not recognize code areas.

sthg like
call label1
label1:
call function
; after here lets say eax contains a calculated value
pop ebx
add eax, ebx
call [eax] ->>>>>>>> where to go from here :) ??

therefor function scanning would cathc the destination if it uses stack setup prologue. if not - it would be in the middle of
DB xx, xx, xx, xx, xx

using the debugger you will see the destination(s) and can then use
"d address"
to update your deadlisting. this is how i planned to use lida :)

cheers, 0xf001
0xf001
12-05-2004, 04:22 PM
hi!

there's a new version of lida available. i have added

- bookmarks
- dump disassembly to text file
- representation of data sections

and removed
- bugs :) hehe

hxxp://lida.sourceforge.net

check it out :)

btw you probably might find the information i give on the website stone-age old about the objdump disadvantage, but - i have been asked that really :)


how to decrypt *.rar file ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > how to decrypt *.rar file ?
PDA

View Full Version : how to decrypt *.rar file ?

icray
08-04-2004, 07:57 AM
it is difficult to decrypt *.rar compressed by winrar because it use crc code.But I have heard someone can decrypt it without passwd .I think maybe they use the winrar bug.And someone can decrypt files compressed by winrar 3.x algorithm ?
Silver
08-04-2004, 10:00 AM
Results 1 - 10 of about 4,610 for rar decryption.
naides
08-04-2004, 10:31 AM
it is difficult to decrypt *.rar compressed by winrar because it use crc code.But I have heard someone can decrypt it without passwd .I think maybe they use the winrar bug.And someone can decrypt files compressed by winrar 3.x algorithm ?

RAR uses AES (Advanced Encryption Standard) 128 bits, not CRC, which is something else. So far bruteforce/dictionary attack (and time) are the method of choice for decryption. You may be mistaken with zip encryption, which is weak. Or am I wrong?
Silver
08-04-2004, 01:08 PM
naides, I believe you're almost right. Off the top of my head, Winrar 2.x and Winzip 7 used weak encryption that could be broken with some simple "collision work". Don't ask me what, I just seem to remember an app that did it.

Quote from the WinRAR faq:
What is the difference between WinZIP and WinRAR encryption?

ZIP format uses a proprietary encryption algorithm.

RAR archives are encrypted by the much stronger AES-128
standard. If you need to encrypt important information,
it is better to select the RAR archive format.

WinZIP 8 and higher use AES as well:

AES Encryption Information:
Encryption Specification AE-2.
The AE-2 encryption specification described here involves a minor change to the AE-1 encryption specification covered in the original May, 2003 version of this document. The recent changes to this document are summarized in the Change History section below. Without compromising the basic Zip file format, WinZip Computing has extended the format specification to support AES encryption, and this document fully describes the format extension

So, um, WinRAR FAQ needs updating :D
Incidentally, this is pretty interesting: http://www.cs.ucsd.edu/users/tkohno/papers/WinZip
cRk
08-04-2004, 01:20 PM
gzipped-PostScript .. i downloaded this document and extract it but the document always gets opened with paint shop Pro .. and can't see nothing ... which program should i use for this .ps (postscripts) documents ?? :)

Regards
doug
08-04-2004, 01:27 PM
download GhostView + GhostScript

adobe acrobat can probably open it though.
cRk
08-04-2004, 01:34 PM
Adobe acrobat reader don't
recognize it or even try to open it .. looking for ghostview... :)

Regards
icray
08-05-2004, 02:40 AM
yeah, i think i make a mistake.And silver, the app you mean is passware? It need at least 5 files to decrypt. Why it need 5 files?
Formal
08-05-2004, 03:53 AM
See what Eugene Roshal (the author of WinRAR) says:

Q: I forgot my password, please help me!

A: WinRAR encryption does not have any backdoor. Even if I forget a password to any my archive, I shall not be able to restore it. So please do not ask me to help in this situation.

So, as naides said - bruteforce or dictionary attack. I don't think anyone can do it anoter way and I doubt there is such bug in the encription routine, that allows decryption without password.
Peres
08-05-2004, 05:23 AM
Careful with that axe, Eugene...
Silver
08-05-2004, 06:57 AM
I don't think it's passware, I really don't remember the name of the app. But the reason it needs 5 files is probably because of whatever collision thing it uses.

Hey, look at me, clutching at random straws...
arash
08-05-2004, 12:18 PM
yeah, i think i make a mistake.And silver, the app you mean is passware? It need at least 5 files to decrypt. Why it need 5 files?
how i can remove rar password?
doug
08-05-2004, 12:25 PM
how i can remove rar password?

are you joking ? did you not read what has just been said?
Innocent
08-05-2004, 03:21 PM
are you joking ? did you not read what has just been said?
Heh, I agree. Learn to search before asking simple questions like that. There are many password crackers out there that you can find with a simple search.
dELTA
08-05-2004, 06:26 PM
how i can remove rar password?
Oh, for the love of god, not one of those again...
JMI
08-05-2004, 07:08 PM
Don't you just delete the ".rar" file? :devil:

Regards,
qww
08-14-2004, 10:48 AM
it's true
JMI
08-14-2004, 01:14 PM
qww:

What the heck are you doing??? This is the second thread you have just posted: "It's ture" in which appears to have NOTHING to do with the Thread. :rolleyes:

Regards,
dELTA
08-14-2004, 02:03 PM
I thought just the same... Maybe he's trying to climb the ranks quickly by being the ultimate yes-man or something. :p

Anyway, here's something for you to agree with qww: If you keep doing it you will be banned, ok? :rolleyes:
JMI
08-14-2004, 03:34 PM
That IS true. :D

Regards,
Fatty[NegX]
10-05-2004, 07:28 PM
There are two most popular RAR PW crackers that I know of, Advanced RAR Password recovery and Passware password recovery suite, which recovers passwords for many types of files. As for RAR the only method for 3.x archives IS brute force, unless you have some of the files that are in the archive. Having some of the files in the archive helps because the program knows that the decrypted result is, and can determine the password from comparing the encrypted with the decrypted, figuring out what algo is used. (I Know this cause I had to use it once)
JMI
10-05-2004, 07:35 PM
And "Why" did you feel compelled to share the obvious with us two months after the last post in this thread?

Regards,


Can't disassemble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Can't disassemble
PDA

View Full Version : Can't disassemble

bullet187
08-05-2004, 04:54 AM
I can't disassemble some apps like Alcohol 120% or 3D StudioMAX. When I try to open it W32dasm shut down.
omega_red
08-05-2004, 06:26 AM
They're packed/crypted/using bug in w32dasm to crash it. Use IDA. Without unpacking you won't see anything interesting anyway ;)
Aimless
08-06-2004, 01:52 AM
Hi son,

Did you try cracking Winzip v5 and MIRC v5 first before you attacked Alcohol and 3DS Max?

And stop using w32dasm. Its time is over. You use SoftICE and IDA and maybe, with lots of luck, you'll get a major graphic application that's not compresessed and anti-debugged.

My opinion: Crack Winzip and MIRC first. And that too start from version 5 and above.

Learn to stand up, then walk and then run.

Have Phun
bullet187
08-09-2004, 01:08 AM
Thanks to You!
I'll try winzip...:)


IDA FLAIR
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA FLAIR
PDA

View Full Version : IDA FLAIR

omega_red
08-05-2004, 06:37 AM
I've tried to make signature files for msvcrt from vs 2003, however neither plb nor pcf can read the lib. Says that it's not OMF format file or not COFF module. I know that m$ uses their own coff-like format, but how to make it compatible with flair? My IDA ver is 4.5.1.770.
TQN
08-05-2004, 10:35 PM
Hi omega_red
PLB used for OMF .obj and .lib files. PCF used for COFF .obj and .lib files. The msvcrt lib in VS 2003 is a import lib, not a static lib, so you dont need to create signature for it. IDA will automatic read and apply the export functions.
I have created the IDS file for MFC71 and signature file for VC71 (VS 2003) CRT, and posted it on the ExeTools forum. You can search and download it.
Regards,
TQN
omega_red
08-06-2004, 04:43 AM
Yeah, I knew I got something wrong ;)
Thanks for the info.


Unpacking Execrytor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Execrytor
PDA

View Full Version : Unpacking Execrytor

MiniMind
08-05-2004, 08:33 AM
Hi All

Does anyone knows how to defeat Execryptor 1.5.1...

I tried to unpack it with Olly (It's first packed with a modified version of UPX).. I found the original entrypoint but couldn't find the IAT...

So my question is : Is it possible to first unpack the UPX part and then go on ?

Other Info about this cryptor is also welcome...

ps. I've already tried to unpack it with Generic "UPX Unpacker by Bratalarm" but after succesfull unpacking it didn't run...

GR
MiniMind
Js
08-05-2004, 03:41 PM
If memory serves me correctly, evil unpacked it, I'm sure if you ask him nicely he will tell you all about it :)
JMI
08-05-2004, 03:50 PM
I'm suspecting you may have mis-typed 'eval" as evil." :eek: "But who knows what evil lurks in the hearts of men." "The Shadow knows." :D

In any case, MiniMind, you appear not to have followed the directions in the FAQ mentioned in the BIG RED LETTERS at the top of the Forums. At least you have not indicated any effort at searching for the answer to your problem. Using "execryptor unpacking" without the quotes, I quickly found several interesting sources of information, including an OllyScript related to this target.

Regards,
MiniMind
08-05-2004, 04:10 PM
I searched for it on this forum only 1 thread not very helpful.

I already found that script "Execryptor 1.5.x", but wasn't able to understand it... (script itself didn't work)

But I will search and read some more about OllyScript...

MiniMind
Js
08-05-2004, 05:13 PM
"I'm suspecting you may have mis-typed 'eval" as evil."
a slop of the funger :)
JMI
08-05-2004, 05:23 PM
Happens to the bust o fus. :devil:

Regards,
cRk
08-06-2004, 12:29 PM
:idea: don't need to unpack UPX first since OEP UPX will give will be for the Execryptor section .. if you know REAL OEP just dump from there set it with a PEeditor ... fix IAT ...same process for all packers/protectors, when you reach real OEP exe/.dll will be fully decrypted for most cases ;)

Regards
MiniMind
08-09-2004, 07:49 AM
Thanks I will work on it...


Offline board archive chm file updated Aug 3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Offline board archive chm file updated Aug 3
PDA

View Full Version : Offline board archive chm file updated Aug 3

Kayaker
08-05-2004, 09:51 AM
Hi all, Link at its usual spot near the bottom of the page...


How to anti crash code in swf files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to anti crash code in swf files
PDA

View Full Version : How to anti crash code in swf files

winroot
08-05-2004, 10:50 AM
How to anti crash code in swf files? :confused:
When I Decompile some flash , it can crash your tools or it doesn't work normal. :confused:
I found it have many "psmask" ascii ,when i use ue open it!
I have a few experience at swf decompile,only have some swf flie format
knowledge and poor english.
plz give a help!
Thx
Kayaker
08-06-2004, 08:18 PM
Hi

Maybe you can explain a bit more. What are these "psmask" areas? Is this a special type of Flash file, what version is it? You can get the latest specifications at http://www.openswf.org. One definition of psmask is used in 3D (cartographical) mapping to clip out regions of data points using polygons. Perhaps it represents a similar type of graphical function.

Whatever it is, your decompiler obviously can't handle the syntax. A search for 'flash decompiler' on this board will give you a link to one you could try. If not then you're just going to have to reverse the problem yourself.


Problems with IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problems with IDA
PDA

View Full Version : Problems with IDA

markh51
08-05-2004, 03:03 PM
I have disassembled a application in IDA4.3 but I can't work something out.

When I am searching for my string it always seems to find it in the .DATA: bit, but these line numbers don't go anywhere in the program.

So the question is... how do I find the ".DATA:" bit in the main program
Innocent
08-05-2004, 04:50 PM
Thats because when you click on the string it takes you to the .DATA section. You will see something like this:
.data:10020698 aStandard db 'standard',0 ; DATA XREF: sub_10002C6C+148o
.data:100206A1 align 4

In this example, 'standard' is referenced by sub_10002C6C. Double click on the reference sub_10002C6C to go to the code. You might also want to read an IDA primer while you're at it.
JMI
08-05-2004, 05:21 PM
NO.... Not RTFM. :idea:

Regards,
markh51
08-05-2004, 05:52 PM
This one does not have the XREF, so double clicking it does not work.
Innocent
08-05-2004, 06:46 PM
Did you wait for your disassembly to complete first? If you did not wait for the analysis to finish, string searching might not work correctly. As I stated before you might want to read an IDA primer. IDA is not an easy program to tackle (I'm a newbie myself).
JMI
08-05-2004, 07:12 PM
And are you suggesting that they put a string reference in the .DATA section and "never" reference it in the code? Only reason that is likely to occur is that it is something which was in the code at one time and modification of the code removed the XREF and they simply did not delete it from the .DATA file. Or unless it's in an encrypted section. :idea:

Regards,
markh51
08-06-2004, 01:10 AM
What I found out was... when I seached for the string and it was returned without the XREF, I used the line number (to the left of the returned string) and set a BPM at that address in SI and it seemed to work, the application stopped as it was about to return the string.

Does this sound right ?
Formal
08-06-2004, 01:24 AM
...it is something which was in the code at one time and modification of the code removed the XREF and they simply did not delete it from the .DATA file.

I think if that has been the case (string has no longer been referenced), the linker would remove the whole string, isn't it right?
bilbo
08-06-2004, 01:42 AM
Unfortunately, the linker is not so smart or -better- it does not have the authority to do so.
Try compiling this:

char s[] = "mystring";
void
main(void)
{
}

Regards, bilbo
Aimless
08-06-2004, 01:46 AM
Imagine:
======

DATA.00000000: dataxxx
DATA.00000023: datayyy
DATA.00000034: dataabcd
DATA.0034cdfw: datapqer
.......

1)Accessing data simple way
======================

If a program refers to the data directly such as:

TEXT.00012345: push dataabcd

then you will find that actually:

DATA.00000034: dataabcd XREF: Text.00012345

If you click on the XREF, it will take you to the code location at TEXT.00012345.

2) Accessing data the TABLE way
=========================
Your program can also refer to the data indirectly such as:

TEXT.00012345 push [DATA.00000000+34]

In this case, you will NOT find any XREF when you see the data section. You will simply see:

DATA.00000034: dataabcd

the XREF: Text.00012345 part will not be there because its being reffered via a table.

However, you can search for XREFS at the BEGINNING of the table, i.e. at DATA.00000000 [OR] you can search for 34 binary in IDA.

Yet, there are many ways to indirectly access data. Use a different bait to fish out your strings. And make sure you are not confusing the DATA section strings with the RESOURCE section strings. You will NOT get RESOURCE section strings XREFS.

Have Phun
shadz
08-06-2004, 06:34 AM
And are you suggesting that they put a string reference in the .DATA section and "never" reference it in the code? Only reason that is likely to occur is that it is something which was in the code at one time and modification of the code removed the XREF and they simply did not delete it from the .DATA file. Or unless it's in an encrypted section. :idea:

Regards,

Or perhaps, as good as IDA is, it simply wasnt able to resolve an xref because the data is referenced by register
indirect addressing mode....or because the fragment of code which references the data hasnt been 'discovered'
by IDA for various reasons...

-Shadz
TQN
08-07-2004, 04:51 AM
You say correct, biblio !
I compiled your code with VC .NET 2003, maximum optimize options. The mystring still in the data section.
markh51 !
Sometime, we should open the problem windows, and press C (Code) or P (proc) to force IDA try disassemly blocks of problem code (and you think they are code block), and may be the reference will be in those blocks.
Regards
TQN


Append text to an edit control text buffer?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Append text to an edit control text buffer?
PDA

View Full Version : Append text to an edit control text buffer?

homersux
08-05-2004, 06:33 PM
Other than getwindowtext, append text, then setwindowtext, is there a easy way to append text
to a multi-line edit control? This could be used as a convenient log window for verbose information output.
Kayaker
08-05-2004, 09:53 PM
Hi,

Are you meaning in your own code, as opposed to this is a reversing trick question?

Unless you WANT to use a multiline edit control, using a listbox and LB_ADDSTRING might be a bit more convenient for log output like this. It's dead easy to control, add, modify... Also has the nice feature of being able to associate a dword value to any item you add using LB_SETITEMDATA, for whatever use you might make of that.

Unless you go to RichEdit, multiline edit controls somehow don't seem as useful for *appending* text without having to fiddle around with carets, line breaks, scrolling and such. Assuming you don't want user input you could use WM_SETTEXT, but it seems you'd need to copy the existing text to a buffer, append it, then write it back, too much overhead.

I find listboxes handy for displaying results from GetLastError / FormatMessage output, which I try to use routinely. Not that this has anything to do with your question, but for the sake of code an example and couple of macros:

...
.else ; CreateService fails

invoke GetLastError
; most likely error is ERROR_SERVICE_EXISTS equ 431h

OutputLBText hListBox_Log, \
CTEXT("ERROR: CreateService failed with System Message:")

OutputSystemErrorMsg hListBox_Log

.endif ; CreateService endif

;=======================================================
; Listbox handling Macros to deal with display issues
;=======================================================

;--------------------------------------------------------------------
; MACRO to format FormatMessage string for display in Listbox
; CarriageFeed/LineReturn is not handled well by Listboxes.
; This macro finds the CF/LR added by FormatMessage and
; null terminates the string.
; Usage: pass system error message in eax, i.e.
; invoke GetLastError
; OutputSystemErrorMsg, hListBox
;--------------------------------------------------------------------
OutputSystemErrorMsg MACRO _hWnd
LOCAL lpFormatMsg
.data?
lpFormatMsg db 64 dup(?) ; max buffer for FormatMessage
.code
invoke FormatMessage, FORMAT_MESSAGE_FROM_SYSTEM, NULL, eax,\
NULL, offset lpFormatMsg, sizeof lpFormatMsg, NULL

cld
push ecx
push edi
mov eax, 0Dh
or ecx, -1
lea edi, offset lpFormatMsg
repne scasb
dec edi
mov byte ptr [edi], 0 ; null terminate the string
pop edi
pop ecx

invoke SendMessage, _hWnd, LB_ADDSTRING, 0, offset lpFormatMsg
invoke SendMessage, _hWnd, LB_ADDSTRING, 0, CTEXT(" ")
invoke SendMessage, _hWnd, LB_GETCOUNT, 0, 0
sub eax, 1
invoke SendMessage, _hWnd, LB_SETTOPINDEX, eax, 0
ENDM
;--------------------------------------------------------------------

;--------------------------------------------------------------------
; MACRO to output Listbox text, may include CF/LR and/or variable formatting arguments
; Usage: pass CF/LR as "\n", leave blank if desired if including Args
; OutputLBText hWnd, CTEXT("text")
; OutputLBText hWnd, CTEXT("text"), \n
; OutputLBText hWnd, CTEXT("text %04X"), \n, eax
; OutputLBText hWnd, CTEXT("text %04X %04d"), ,eax, eax
;--------------------------------------------------------------------
OutputLBText MACRO _hWnd, Text, CFLR, Args:VARARG
LOCAL StringBuff
.data?
StringBuff db MAX_PATH dup(?)
.code
push eax
IFNB <Args> ; if 'Args' argument is not blank, format according to Text syntax
invoke wsprintf, offset StringBuff, Text, Args
invoke SendMessage, _hWnd, LB_ADDSTRING, 0,\
offset StringBuff
IFNB <CFLR> ; if 'CFLR' argument is not blank, add a blank line
invoke SendMessage, _hWnd, LB_ADDSTRING, 0, CTEXT(" ")
ENDIF
ENDIF

IFB <Args> ; if 'Args' argument is blank, output Text as passed
invoke SendMessage, _hWnd, LB_ADDSTRING, 0, Text
IFNB <CFLR>
invoke SendMessage, _hWnd, LB_ADDSTRING, 0, CTEXT(" ")
ENDIF
ENDIF
invoke SendMessage, _hWnd, LB_GETCOUNT, 0, 0
sub eax, 1
invoke SendMessage, _hWnd, LB_SETTOPINDEX, eax, 0

pop eax
ENDM
;--------------------------------------------------------------------
;=======================================================

Kayaker
homersux
08-06-2004, 08:26 AM
well unfortunately, i need to use a simple logging edit control in user land app.
The problem with list control is it cannot be easily copy/pasted. RichEdit is not
a basic gdi32 control object. I may have to fall back to the copy/append/reset
approach since the amount of text information is not huge.
cr.ap
08-06-2004, 07:58 PM
according to msdn you can get/set a handle to the EditControl TextBuffer with EM_GETHANDLE/EM_SETHANDLE, however last time i played with it for the exact same reason, i couldnt get it to work correctly an do so dianlly ended up with the same old circular buffer and Get/SetWindowText, maybe you have more luck.

cr.ap

PS: another option for appending may be EM_SETSEL/EM_REPLACESEL.


Sentinel SuperPro Emulator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel SuperPro Emulator
PDA

View Full Version : Sentinel SuperPro Emulator

nikan
08-07-2004, 12:46 AM
hi all
my problem is a target that protected with superpro. preiviously i changed the target and redirect rnbo function to a dll. but now i need a way that the target work without patching .
if i write the sentinel.sys the problem will solve.
my question : can i write a filter driver that capture all data transfer bitween program and driver(sentinel.sys) and send correct result back to the program or i must write a sentinel.sys ?

thanks.
Jacques
08-08-2004, 09:58 PM
Hi nikan,

I can't answer your question regarding the filter driver, but I did have a similar problem about a year ago where I had to bypass a superpro dongle without patching the target.

What saved me was finding an emulator by some guy called Steven that I was able to modify for my own purposes. There are a few versions of this emulator floating around, the one that I used was v0.24 because it had DebugPrint calls that allowed you to watch the calls being made in your debugger's output window... Steven did a pretty nice job. (There seems to be a v0.43 around, but it doesn't have the debug prints.)

The emulator is able to recognize 15 products. If the given vendor ID matches one that it knows about, then it will use the associated block of "dongle memory" for the read/write calls.

All I had to do was:
1) Change the vendor code to that of the target.
2) Adapt the "dongle memory" block so it provides data that works with whatever checks there are in the target.
3) Recompute the checksum field in the PE header. (This field is not used by standard exe's, but is used by .sys drivers. I used LordPE to fix it.)

The emulator also has a 10 minute time limit built-in, but bypassing it is pretty easy. I suppose this is step #1.

This emulator worked great for the first target I used it on, however, just today I tried it on a second target (that's why I'm on the board again) and it doesn't recognize any of the function calls (in the debugger it says "fn is XXXX - yet unknown"). Something funny is going on in this new target, it seems that the function specifiers in the superpro packet are different with each invocation. Hopefully it will work in your case.

Let me know if you're interested and I can provide more details.

Jacques
nikan
08-09-2004, 12:49 AM
hi Jacques

tanks for your reply.
i have sentinel emulator version 0.43 and a patch that remove time limit.
can you tell me is it support sproQuery?
however i decide to write a filter driver becaus if i copy sentinel.sys of emulator to win32\driver then other superpro protected programs dos not work if i have related dongle.
also it is good that memory dump and sproquery pair can change from registery.

nikan.
Jacques
08-09-2004, 01:56 AM
I don't know for sure if version 0.43 of the emulator will work, but I imagine you can probably get it work. I've never used it myself, mainly because it didn't have the DebugPrint calls, and v0.24 worked just fine for me. I also seem to remember that v0.43 is set up with only a single block of "dongle memory" (but I can't recall for certain).

As for sproQuery(), the emulator does recognize the call, and v0.24 prints the following info for it: "sproQuery: cell=%02X, len=%02X" to the debugger. What is does after this, beyond faking a good return code, I'm not exactly sure. (My target was quite simplistic, it just read the values in 5 cells and XOR'd them together, it didn't use sproQuery at all.) However, doing a quick scan of the code once more, I do see a call to a fucntion that prints "process_query() - cant find dump"... so it seems that the emulator is set up to handle algorithm queries.

If you're not in a rush and you need to be able to use real Sentinel dongles too, then writing a filter driver sounds like the way to go. Unfortunately, I don't know enough about the Windows Driver Model to be able to tell if this will work or not.

I am quite interested in whether the filter driver would work, so if you do decide to do this, please keep posting your progress on the board.

Jacques
nikan
08-09-2004, 08:28 AM
ok
i started to write the filter driver with compuware driver suite 2.7 and windows 2000 ddk.
previously i write a program that can encrypt and decrypt the rnbo Packet correctly.
can anyone help me with any idea and information about filter driver?
i was found that sentinel driver make a device named "rnbdrv" is it true?
Jacques
08-10-2004, 05:08 PM
ok
i started to write the filter driver with compuware driver suite 2.7 and windows 2000 ddk.
previously i write a program that can encrypt and decrypt the rnbo Packet correctly.
can anyone help me with any idea and information about filter driver?
i was found that sentinel driver make a device named "rnbdrv" is it true?
An original sentinel.sys has the following string refs it:
\\Device\\ParallelPort
\\Device\\RNBODEV
\\DosDevices\\RNBODRV
but I have no idea if this is the proper way to refer to the driver when trying to add a filter layer to it.

Question for you:
Did you find a doc on the encryption/decryption of the spro packet, or did you trace the code and figure it out yourself?

Question for the dongle experts:
Is it even possible to create a filter driver for the sentinel drivers? It seems suspicious that no-one has done it before... (or maybe they have and I don't know about it).
nikan
08-11-2004, 01:27 AM
the filter driver is written!!!
my filetr driver and enc\dec algorithm is work properly in sentinel driver version 5.41!
i know about one version of this algorithm.
the next improvment in my project is :
1:read dump and sproquery pairs from registry.
2:create a filter driver that work in 2 mode: emulate mode and capture mode.

nikan.
nikan
08-11-2004, 01:31 AM
hi Jacques
sorry for my bad english writing.
i traced a target that call rnbo function and found the way of enc\dec.
nikan.
Jacques
08-11-2004, 03:23 AM
the filter driver is written!!!
my filetr driver and enc\dec algorithm is work properly in sentinel driver version 5.41!
nikan.
Excellent!

What driver name did you use when you created the "Device Filter" shell in Driver Studio?

Did you have to filter anything besides Read & Write? (and maybe Create & Close)?
nikan
08-11-2004, 06:51 AM
hi Jacques
the symbolicnames of devices that are created by sentinel.sys are RNBODRV0 and RNBODRV1.
all of packet transfers between program and driver are performed via ReadFile function.
after any call to rnbo function except (formatPacket for the first time and initialize) , the program prepair the packet and encrypt it and finally send it to driver via ReadFile function.

nikan.
Jacques
08-12-2004, 02:05 AM
Hi nikan,

I did know about passing the packet via ReadFile, but my driver knowlegde is minimal at best, so I'm still having trouble figuring out where things fit in at that level.

What is the difference between RNBODRV0 and RNBODRV1? Is 0 for parallel and 1 for USB?

Thanks for the tips,
Jacques
nikan
08-12-2004, 05:21 AM
hi Jacques
i am not sure but possiblly you are correct.
i tested may filter driver with a usb superpro dongle and the correct response recieved from RNBODRV1.
i will test a parallel dongle asap to find out if dongle response will recieve from RNBODRV0 or not.

nikan.
cah
08-12-2004, 08:58 AM
Dear Nikan

How to find & analyse spro quries & their seed codes for given application?
Do you have any tools for it? How to inject this code into exe file?

Help in this highly appreciated
CaH
nikan
08-12-2004, 09:39 AM
hi Jacques
capture mode of my driver is completed.
i tested it with some protected programs, then i decided to test it with superpro shell, so i created a shelled version of notepad.exe with my dongle.
you can see data transfer between Sentinel toolkit and driver in protection duration here:

"
In,RNBOsproSetUnitInfo
OUT,RNBOsproSetUnitInfo
In,RNBOsproFindFirstUnit(DeveloperId=0x0000)
OUT,RNBOsproFindFirstUnit(DeveloperId=0x0)-> Status=0x0
In,RNBOsproOverwrite(WritePassword=0x0000,OverwritePassword1=0x0000,OverwritePassword2=0x0000,Address=0x3C,Data=0x226A,AccessCode=0x3)
OUT,RNBOsproOverwrite(WritePassword=0x0000,OverwritePassword1=0x0000,OverwritePassword2=0x0000,Address=0x3C,Data=0x226A,AccessCode=0x0)-> Status=0x0
In,RNBOsproOverwrite(WritePassword=0x0000,OverwritePassword1=0x0000,OverwritePassword2=0x0000,Address=0x3D,Data=0xEA46,AccessCode=0x3)
OUT,RNBOsproOverwrite(WritePassword=0x0000,OverwritePassword1=0x0000,OverwritePassword2=0x0000,Address=0x3D,Data=0xEA46,AccessCode=0x0)-> Status=0x0
In,RNBOsproSetUnitInfo
OUT,RNBOsproSetUnitInfo
In,RNBOsproFindFirstUnit(DeveloperId=0x0000)
OUT,RNBOsproFindFirstUnit(DeveloperId=0x0)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x1D5DDBD3,Length=0x4)
OUT,RNBOsproQuery(Response=2AFF717F,Response32=FF2A7F71)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x1E6D65B,Length=0x4)
OUT,RNBOsproQuery(Response=5BC57D9A,Response32=C0000A7D)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x40E7DC6F,Length=0x4)
OUT,RNBOsproQuery(Response=385CF58,Response32=5C38580F)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0xD244FFA,Length=0x4)
OUT,RNBOsproQuery(Response=218B8727,Response32=8B212787)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0xCB90863,Length=0x4)
OUT,RNBOsproQuery(Response=CA6777D8,Response32=67CAD877)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0xDF72CA25,Length=0x4)
OUT,RNBOsproQuery(Response=C085466E,Response32=85C06E46)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x9F82141B,Length=0x4)
OUT,RNBOsproQuery(Response=30D73352,Response32=D7305233)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x83C5C3EB,Length=0x4)
OUT,RNBOsproQuery(Response=725BADEA,Response32=5B72EAAD)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0xBF4FA9EC,Length=0x4)
OUT,RNBOsproQuery(Response=A31B782,Response32=1BA38207)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0xDADD9E6C,Length=0x4)
OUT,RNBOsproQuery(Response=F1294E59,Response32=29F1594E)-> Status=0x0
In,RNBOsproSetUnitInfo
OUT,RNBOsproSetUnitInfo
In,RNBOsproFindFirstUnit(DeveloperId=0x0000)
OUT,RNBOsproFindFirstUnit(DeveloperId=0x0)-> Status=0x0
In,RNBOsproSetUnitInfo
OUT,RNBOsproSetUnitInfo
In,RNBOsproFindFirstUnit(DeveloperId=0x0000)
OUT,RNBOsproFindFirstUnit(DeveloperId=0x0)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x0000,Length=0x4)
OUT,RNBOsproQuery(Response=52D57DB8,Response32=D552B87D)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x44E4A547,Length=0x4)
OUT,RNBOsproQuery(Response=3950DE20,Response32=503920DE)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0xDCF1C80,Length=0x4)
OUT,RNBOsproQuery(Response=35739CA,Response32=7335CA09)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x48B38CC,Length=0x4)
OUT,RNBOsproQuery(Response=78DB6474,Response32=DB787464)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x7192555D,Length=0x4)
OUT,RNBOsproQuery(Response=A8DD2735,Response32=DDA83527)-> Status=0x0
"

and after runnig shelled notepad.exe my programs shows these sequence of calls to driver :

"
In,RNBOsproFindFirstUnit(DeveloperId=0x0000)
OUT,RNBOsproFindFirstUnit(DeveloperId=0x0)-> Status=0x0
In,RNBOsproRead(Address=0x30)
OUT,RNBOsproRead(Packet,Address=0x30,Data=0x0)-> Status=0x0
In,RNBOsproRead(Address=0x34)
OUT,RNBOsproRead(Packet,Address=0x34,Data=0x0)-> Status=0x0
In,RNBOsproRead(Address=0x38)
OUT,RNBOsproRead(Packet,Address=0x38,Data=0x0)-> Status=0x0
In,RNBOsproRead(Address=0x3C)
OUT,RNBOsproRead(Packet,Address=0x3C,Data=0x0)-> Status=0x4
In,RNBOsproSetUnitInfo
OUT,RNBOsproSetUnitInfo
In,RNBOsproRead(Address=0x0)
OUT,RNBOsproRead(Packet,Address=0x0,Data=0x28)-> Status=0x0
In,RNBOsproQuery(Address=0x0,Data=0xB55EE90,Length=0x4)
OUT,RNBOsproQuery(Response=B55EE90,Response32=5EB500E9)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0xA33A314C,Length=0x4)
OUT,RNBOsproQuery(Response=C3ED6B28,Response32=EDC3286B)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0xB285D6C8,Length=0x4)
OUT,RNBOsproQuery(Response=74497B23,Response32=4974237B)-> Status=0x0
In,RNBOsproQuery(Address=0x3C,Data=0x44E4A547,Length=0x4)
OUT,RNBOsproQuery(Response=3950DE20,Response32=503920DE)-> Status=0x0
In,RNBOsproWrite(WritePassword=0x0000,Address=0x100,Data=0x3125,AccessCode=0x0)
OUT,RNBOsproWrite(WritePassword=0x0000,Address=0x100,Data=0x3125,AccessCode=0x0)-> Status=0x5
In,RNBOsproSetUnitInfo
OUT,RNBOsproSetUnitInfo
In,RNBOsproSetUnitInfo
OUT,RNBOsproSetUnitInfo
"

i changed the developer id and passwords to zero!
i hope that this inforamtion help you to solve your problem with shell!
again sorry for my bad english writing.

nikan.
nikan
08-12-2004, 09:45 AM
hi CaH

i don't know but i gess that sproQuey algo is the same as packet transfer enc/dec algo.

nikan.
Jacques
08-12-2004, 06:17 PM
hi Jacques
capture mode of my driver is completed.

i hope that this inforamtion help you to solve your problem with shell!
again sorry for my bad english writing.

Nice work nikan!

Thanks for the including the call sequence information, it definitely helps. I think your idea of making a filter driver that can operate in both "spy" and "emulate" mode is definitely the best idea. Once you get it to work properly, you will be able to emulate any SuperPro dongle with only a little more effort.

I'm a little short on free time at the moment, so I will probably stop my work on my current target. Your efforts have inpired me to do this the right way, so as my spare time increases I think I will also try to write a filter driver like yours. Yesterday I identified the packet decryption code in v0.24 of the emulator and v5.41 of the real sentinel.sys. As expected, the emulator does not know about the newer encryption method. The encryption/decyption code is not trivial, but it's not too hard either...

Jacques

PS Your English is just fine, and it's probably a lot better than my ability at your native language. (what is it?)
nikan
08-16-2004, 02:46 AM
hi Jacques

tell me if i can help you in your project.
my project on superpro is compeleted. i startetd to write a filter driver for HARDLOCK dongle. this is a harder target!!!

nikan.
Jacques
08-16-2004, 11:24 PM
hi Jacques

tell me if i can help you in your project.
my project on superpro is compeleted. i startetd to write a filter driver for HARDLOCK dongle. this is a harder target!!!

nikan.

Thanks for the offer nikan. If you don't mind, I will take you up on your offer, but not just yet because my free time is diminishing rapidly (work, life) and to make things worse, my main PC died last night. I'm looking at a complete re-install on a new drive, so it will probably be a week before I have enough time just to get the system back to where it was.

Anyways I'll keep you posted once I get back to it.

Thanks,
Jacques
nikan
08-18-2004, 08:24 AM
hi all

some note on superpro shell:

1: packet signature in sqroquery call from shell is 0x7243 not 0x7242.
2. sproquery pairs are different in every run of shelled program so possibly it is removable without dongle because propably the spro algo is hided in shell.

nikan.
PVA
08-20-2004, 02:06 AM
some note on superpro shell:
1: packet signature in sqroquery call from shell is 0x7243 not 0x7242.
2. sproquery pairs are different in every run of shelled program so possibly it is removable without dongle because propably the spro algo is hided in shell.

1. in new version of drivers it support both packet signatures
2. shell contain 16 pairs in two continuous tables that xor'ed by const value. And it produce some (two?) requests that are decryption keys for sections.

[newbie]

p.s. sorry for bad english
nikan
08-20-2004, 02:44 AM
hi pva

"in new version of drivers it support both packet signatures"
yes i saw it before.

"sproquery pairs are different in every run of shelled program so possibly it is removable without dongle because propably the spro algo is hided in shell"
i say it because the query pairs that used by shell is different in every run and is different with those that used by toolkit during shell making time.

if the query algo is not hided in shell therefore it is a symmetric algo so that a program can xor data with a const then call sproQuery and supply xored data ,then xor response with that const and the result is consistently valid, is it true? i will test it.

nikan.
PVA
08-20-2004, 03:32 AM
"sproquery pairs are different in every run of shelled program so possibly it is removable without dongle because propably the spro algo is hided in shell"...
program may be unshelled w/o dongle, but there are no sproQuery in shell. It use another algo. Basic unshell tricks already described in "Unbreak the shell" (or smth similar) tutor by Cyberheg (AFAIK) & discussed on russian messageboards.

[newbie]
nikan
08-20-2004, 08:56 AM
hi pva

i read that tut before beacuse it is the first result of serach on "carck shell sentinel" on google !!!
but i search for a new way for cracking the shell if it is.
if query algo is not in shell so the idea that i wrote on my last post is true, is it?

however i tested my emulator on sum program and it work perfectly but it is not work on shelled programs and i want to add this feature to my emulator, if you have valuable info please share it with me.

tanks.
nikan.
nikan
08-26-2004, 01:08 PM
hi all

there was a bug in my filter driver (packet overflow) that lead me to missundrstand about shell making procedure.

during making shell ,sproquery is called 500 time for making 500 query pairs that is xored with two static data ,encrypted and saved in section 00000001. and another call is for encryption of sum piece of target.

nikan.
Flanger
08-31-2004, 11:36 PM
Hello , Nikan.
I have same problem . Help me please.I am sorry for the impudent request. Give me source code your filter driver. Sorry my English.

Best Regards ,
Flanger.


Function Start/End Addresses in IDA (IDC coding)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Function Start/End Addresses in IDA (IDC coding)
PDA

View Full Version : Function Start/End Addresses in IDA (IDC coding)

Bengaly
08-07-2004, 06:01 AM
hey all,

i want to create a more detail *.map file from IDA,
i start with Functions (EP/Subroutines) which are defined in map as only beginning of a function.
e.g:

0001:00000000 start
0001:00000031 sub_401031
0001:00000118 sub_401118

the problem is that, map does not give us detail about the address of the end of a function, only address of next Function.

so therefor this is not true that sub_401031 starts at 401031 and end in 00401118.
yes we know that already, but if we try to enum all function via IDC and try get the start and end, we will get the same thing as above.
mabye there are some functions that i am unaware of (?) so i tried to write some code to give us a real start/end of a function insted.

function example in IDA

sub_401031 proc near

00401031 ; first instruction here
...
... ; code here
...
00401115; last function instruction here

sub_401031 endp

as you can see the real function bound is: 00401031-00401115 and NOT 00401031-00401118 as IDA gives us by internal IDC function.

'normaly' a function ends with a single byte instruction 'ret' or a 3 bytes instruction 'ret xxxx' but ofcourse it can end with just about any other instruction lenght.
so the usual 'remove 3' or 'remove 1' from the 00401118 (function ida gives us) is wrong.
and the only approach is to 'backward' instruction count.

IDC supports a function called FindCode(..) with a nice flag SEARCH_DOWN, but not SEARCH_UP :thinking:

the idea i had is to set: end_addr - xx bytes, FindCode(..) == address of instruction with a lowest addr than the last instruction of the end function. and count instruction down until we pass the last instruction's address, and this is the real adderss.

the IDC i wrote works well in some cases, and other cases it crashes (loops forever) because the backward number puts us in wrong instruction i think.
the script will try to ignore APIs which defined as a function entrypoint as well.

if some have way better ides, please post here.

; rename *.txt to *.idc, load exe, w8 for the process to finish, execute this script.

regards,
Bengaly
dELTA
08-07-2004, 12:49 PM
In case you settle with the assumption that the functions will always end with ret or ret xxxx, why don't you just simply count forward from the function start until you reach the start address of the next function, and simply store the address of the last ret you have found? :rolleyes:
Peres
08-07-2004, 03:49 PM
Maybe you could trace the code until the value of the ESP register is zero - with respect to the beginning of the function, of course. Beware you have to trust IDA's calculation of the stack which is not always accurate because of routines that FLIRT failed to - or couldn't - recognize.
You could combine this ESP-tracing approach with some pattern analysis as dELTA pointed out. For example, you can test if the line you found actually transfers control to some other location via a ret, call or jmp instruction.

Peres
Bengaly
08-07-2004, 05:54 PM
hi Delta,

yes, this indeed can be done, no metter the ret/ret xxxx instructions.
also bear that if the function's body is long, such process can take time to handle out vast amount of functions analysed by ida.

my approach was to go back x instructions back from the end, but it seems to be a false way as it can not be trusted in extreem cases, but can play the role of a back-up way.

in the up comming dawn i shall try the primitive way, as for speed we care not.

hi Peres,
i am not using idc debugger built-in idc instructions, so i can not test registers and follow control flow.
nor i have needed this way.

thank you for your replies,
Bengaly


IDA: what a bomb!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > IDA: what a bomb!!
PDA

View Full Version : IDA: what a bomb!!

yaa
08-08-2004, 04:25 PM
Hello,

after an awful lot of time I suddenly realized how much powerful is IDA. :whoops:
Wanting to start using it is there 1 or 2 good tutorials that can lead me thru its fundamental set of features?
Thx.

yaa
yaa
08-08-2004, 04:42 PM
Hello again,

I've seen there are IDA primers by blackb and mammon_ but they seem rather old, would you suggest anything else to startup?

yaa
esther
08-09-2004, 12:06 AM
:rolleyes: search the forum you will find a book written for newbies
yaa
08-09-2004, 07:18 AM
I looked around the board and not only and since what I found may interest others here I go:

Tuts from DataRescue:
hxxp://www.datarescue.com/idabase/idasupport.htm

The IDA Palace
hxxp://www.sport-und-event.de/backtrace.de/

Mammon_ site:
hxxp://www.eccentrix.com/members/mammon/

BlackBird site:
hxxp://cracking.stormloader.com/

esther is the book that you talk about one of those written by Kris Kaspersky???

hxxp://www.lowth.com/alist/author/-/Kris%20Kaspersky/

yaa
esther
08-09-2004, 09:57 AM
:yay:


Interlok v5 exploration...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Interlok v5 exploration...
PDA

View Full Version : Interlok v5 exploration...

ptrace
08-08-2004, 07:58 PM
Hi all, my first post here. After doing a search and reading through the few posts on interlok that are here (the only real usefull info on the whole net actaully) I thought I would post some of my findings reguarding the v5 interlok protection running on OS X.

First things first, as per usual, there is a piece of anti-debugging code playing around with gdb, a nice suprise though is its monumentally simple, which is why I got past this part so quickly. It is done with the ptrace() function, this can be used in linux too, but what is passed to the function differs. Here is a small piece of code illustrating it.

#include <sys/types.h>
#include <sys/ptrace.h>

int main()
{
ptrace(PT_DENY_ATTACH,-1,0,-1);
printf("Hello\n");
return 0;
}

when this is compiled and run from the shell, it works just fine

./ad
Hello

when you attempt to load it into gdb you get this (notice no Hello)

(gdb) r
Starting program: ad
Reading symbols for shared libraries . done

Program exited with code 055.

simple enough, so all that was needed to bypass the anti-debugging in the target was to patch the args passed to ptrace to something benign. For example;

0x00001d64 <main+28>: li r3,31
0x00001d68 <main+32>: li r4,-1
0x00001d6c <main+36>: li r5,0
0x00001d70 <main+40>: li r6,-1
0x00001d74 <main+44>: bl 0x1f3c <dyld_stub_ptrace>

A quick look at /usr/include/sys/ptrace.h shows the various other values that one can use. The bytes for the above args are this

3860001f
3880ffff
38a00000
38c0ffff

So all thats needed is to swap out 3860001f (li r3,31) with 38600001 (li r3,1).

on a side note, A poke into /darwinsource/Current/xnu-517.3.7/bsd/kern/mach_process.c will show you what the call to ptrace actually does.

Ok now that the debugger is functional there is something of use. I esentially am going into interlok completely blind, I have no past experience with it and have no idea how it does its thing (yet).

From what I can tell, the specific target im playing with still uses the older CFM/PEF executable format, ie. code fragments like in OS9/8 and after some exploration it seems that interlok builds dynamic stub tables at run time. Incidentally using ptrace() as a breakpoint to get into the interlok code is very usefull FYI. At this point im still clueless as to what the kernel extention PACESupport.kext does, allthough im guessing its decryption (for PC people, PACESupport.kext should be on par with Tpkd.sys). I fired up a little utility called PEFViewer and was able to see a fair amount of the unencrypted pace code inside the target (which will remain nameless for the time being).

I did some tracing for awhile and stumbled upon what I think is the spot where code is either called after its decrypted, or something along those lines, but still cant quite visualize the whole picture of how interlok is working (v5 on PPC) in my head, so if anyone has anything at all they can add or suggest it would be great! documentation, experience from the PC side, whatever. Naturally if I find out anythign else I'll post it.

ptrace
dELTA
08-09-2004, 12:52 PM
Thanks for sharing your info, you are very welcome to submit more info when you get even further into the protection too if you like. :)
LiSa
08-10-2004, 07:02 AM
Hello, I know noting about mac, but here is a way to decrypt the tpkd.sys. Maybe you can look for similar algo in your mac files. The antidebuuging tricks in PC seems to be definitely harder to bypass....

seed1 equ 0B9D000C6h
seed2 equ 0B9AD7FC9h
seed3 equ 0AB3D2B3h
seed4 equ 0DA32C597h

; decrypt bin file
mov eax, ptData
add eax, Doffset
push 0
push seed1
push seed2
push seed3
push Dlen
push eax
call sub_12260

; decrypt bin file
mov eax, ptData
add eax, Doffset2
push 0
push seed1
push seed2
push seed4
push Dlen2
push eax
call sub_12260

; ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ S U B R O U T I N E ÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛÛ

; Attributes: bp-based frame

sub_12260 proc near ; CODE XREF: .text:0001115Ap

var_1C= word ptr -1Ch
var_18= word ptr -18h
var_14= word ptr -14h
var_10= dword ptr -10h
var_C= dword ptr -0Ch
var_8= dword ptr -8
var_4= dword ptr -4
arg_0= dword ptr 8
arg_4= dword ptr 0Ch
arg_8= dword ptr 10h
arg_C= word ptr 14h
arg_10= word ptr 18h
arg_14= byte ptr 1Ch

push ebp
mov ebp, esp
sub esp, 1Ch
push ebx
push esi
push edi
cmp [ebp+arg_0], 0
jz short loc_12275
cmp [ebp+arg_4], 0
jnz short loc_1227C

loc_12275: ; CODE XREF: sub_12260+Dj
xor eax, eax
jmp loc_1241A
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

loc_1227C: ; CODE XREF: sub_12260+13j
mov eax, [ebp+arg_0]
mov [ebp+var_8], eax
mov eax, [ebp+arg_4]
shr eax, 1
mov [ebp+var_C], eax
movzx eax, [ebp+arg_14]
test eax, eax
jnz short loc_122D6
mov eax, [ebp+arg_8]
shr eax, 10h
mov ecx, [ebp+arg_8]
add ecx, eax
and ecx, 0FFFFh
mov [ebp+var_4], ecx
movzx eax, word ptr [ebp+var_4]
movzx ecx, [ebp+arg_C]
cmp eax, ecx
jle short loc_122C9
movzx eax, [ebp+arg_C]
mov ecx, [ebp+var_4]
sub ecx, eax
mov [ebp+var_4], ecx
mov eax, [ebp+var_4]
and eax, 0FFFFh
mov [ebp+var_4], eax

loc_122C9: ; CODE XREF: sub_12260+50j
mov eax, [ebp+arg_8]
and ax, 0
or eax, [ebp+var_4]
mov [ebp+arg_8], eax

loc_122D6: ; CODE XREF: sub_12260+30j
cmp [ebp+var_C], 0
jnz loc_12379
mov eax, [ebp+var_8]
mov [ebp+var_10], eax
movzx eax, word ptr [ebp+arg_8]
movzx ecx, [ebp+arg_10]
imul eax, ecx
mov [ebp+var_4], eax
mov ax, word ptr [ebp+var_4]
mov dx, word ptr [ebp+var_4+2]
div [ebp+arg_C]
shl edx, 10h
mov dx, ax
mov [ebp+var_4], edx
mov ax, word ptr [ebp+var_4]
xchg ax, word ptr [ebp+var_4+2]
mov word ptr [ebp+var_4], ax
mov ax, word ptr [ebp+var_4]
mov [ebp+var_14], ax
movzx eax, [ebp+var_14]
and eax, 8000h
test eax, eax
jz short loc_12336
mov ax, [ebp+var_14]
add ax, [ebp+arg_C]
mov [ebp+var_14], ax

loc_12336: ; CODE XREF: sub_12260+C8j
mov ax, [ebp+var_14]
mov [ebp+var_18], ax
mov ax, [ebp+var_18]
shr ax, 8
mov [ebp+var_18], ax
mov eax, [ebp+var_10]
mov al, [eax]
xor al, byte ptr [ebp+var_18]
mov ecx, [ebp+var_10]
mov [ecx], al
mov eax, [ebp+var_10]
inc eax
mov [ebp+var_10], eax
mov eax, [ebp+var_4]
and ax, 0
mov [ebp+arg_8], eax
movzx eax, [ebp+var_14]
mov ecx, [ebp+arg_8]
or ecx, eax
mov [ebp+arg_8], ecx
jmp loc_12417
; ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ

loc_12379: ; CODE XREF: sub_12260+7Aj sub_12260+1B1j
movzx eax, word ptr [ebp+arg_8]
movzx ecx, [ebp+arg_10]
imul eax, ecx
mov [ebp+var_4], eax
mov ax, word ptr [ebp+var_4]
mov dx, word ptr [ebp+var_4+2]
div [ebp+arg_C]
shl edx, 10h
mov dx, ax
mov [ebp+var_4], edx
mov ax, word ptr [ebp+var_4]
xchg ax, word ptr [ebp+var_4+2]
mov word ptr [ebp+var_4], ax
mov ax, word ptr [ebp+var_4]
mov [ebp+var_1C], ax
movzx eax, [ebp+var_1C]
and eax, 8000h
test eax, eax
jz short loc_123C9
mov ax, [ebp+var_1C]
add ax, [ebp+arg_C]
mov [ebp+var_1C], ax

loc_123C9: ; CODE XREF: sub_12260+15Bj
movzx eax, [ebp+var_1C]
shl eax, 8
movzx ecx, [ebp+var_1C]
sar ecx, 8
or eax, ecx
mov ecx, [ebp+var_8]
mov cx, [ecx]
xor cx, ax
mov eax, [ebp+var_8]
mov [eax], cx
mov eax, [ebp+var_8]
inc eax
inc eax
mov [ebp+var_8], eax
mov eax, [ebp+var_4]
and ax, 0
mov [ebp+arg_8], eax
movzx eax, [ebp+var_1C]
mov ecx, [ebp+arg_8]
or ecx, eax
mov [ebp+arg_8], ecx
mov eax, [ebp+var_C]
dec eax
mov [ebp+var_C], eax
cmp [ebp+var_C], 0
ja loc_12379

loc_12417: ; CODE XREF: sub_12260+114j
mov eax, [ebp+arg_8]

loc_1241A: ; CODE XREF: sub_12260+17j
pop edi
pop esi
pop ebx
leave
retn 18h
sub_12260 endp

; link bin file using

Dlen equ 064Dh

Doffset equ 771Ch
Doffset2 equ 7D6Ch

Patch_table_off equ 0BAE8h

xor ecx,ecx
mov ebx, ptpactch
ici:
mov edi,[ebx]
;int 3
cmp edi,0
jz out_loc
mov eax, ptData
add eax, Doffset
add eax, edi
lea esi,[ebx+4]
mov edi,[esi]
mov [eax],edi
add ebx,8
jmp ici

good luck
ptrace
08-12-2004, 07:56 PM
Thanks much for the info LiSa. Unfortunatly the kext on OSX isnt encrypted at all (or fortunatly if you wanna look at it that way :P). I have poked around a little more and have noticed that there are a few more anti-debug tricks, still easy to bypass. I seem to have located the code that does the loading of various code fragments, and then decrypts them, but have yet to find a way to intercept/dump anything. The way this target is working, its still compiled in the old PEF binary format, which means it has resource forks and various other things, and code only gets loaded as its needed (ie, in fragments). Has anyone been sucessfull in coding a util that completely removes pace? (out of curiosity, I dont want it).

It seems like it should be very simple if I can located the proper places in the code to either a) clone the decrypt code and make an unpacker, or b) figure out a way to dump the code from memory after decryption. The hard part about b is that code is only loaded in fragments as its needed, so that is probably not too practical. Thats why I wonder if it has been done on PC. A is just a matter of coding the tool. Also, for anyone who has experience doing this on OS9/8/7, since these binaries are PEF they are essentially the same, if there is anything you can add please do :) (or PM it to me)


PEB of another process?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > PEB of another process?
PDA

View Full Version : PEB of another process?

sonkite
08-08-2004, 09:06 PM
Anyone know howto get TEB/PEB address of another process? I want to use it to patch aspr dbg check without hooking. TIA.
sna
08-09-2004, 05:58 AM
Hi.

You could use GetThreadContext w/ CONTEXT_SEGMENTS to obtain the value of FS in your target thread;
Then use GetThreadSelectorEntry specifying the value of FS.

LDT_ENTRY.HighWord.Bytes.BaseHi, LDT_ENTRY.HighWord.Bytes.BaseMid and LDT_ENTRY.BaseLow.
Shift the values in place, do a bit of OR'ing and voila!

Regards, sna

(OMFG the formatting came out wrong)
sonkite
08-09-2004, 11:25 AM
Great thanks, worked like a charm =)


Breakpoints in SICE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Breakpoints in SICE
PDA

View Full Version : Breakpoints in SICE

bullet187
08-09-2004, 01:37 AM
Hello!
I have SoftIce 4.5 on XP. Is there breakpoint like hmemcpy on Win98 when GetWindowTextA or GetDlgItemTextA doesn't work?
gryzon
08-09-2004, 01:48 AM
Just take a look at hxxp://www.team-x.ru/xforum/topic876.html :D
bullet187
08-09-2004, 01:50 AM
Very funny!
Are you from Poland?
gryzon
08-09-2004, 01:51 AM
Yes ;)
gryzon
08-09-2004, 01:55 AM
Sorry, my mistake! :boo:
JMI
08-09-2004, 02:07 AM
Actually, the article is in Russian, not Polish.

Emulation Hmemcpy In winXP

The object of this article - to show, as and SoftIccE it is possible to determine with the aid of OllyDbg, where to establish into WinXP the point of stop in order to attain the effect, similar to work API of function Hmemcpy in win9x. This SOMETHING - is not API function. This SOMETHING - it is simple address in modulus USER32, which was called name point-..h .

!!! point-..h is not universal constant. It is unique for each system!!!

Point-.h through OllyDbg (idea it belongs Ricardo Narvaja )

1. Load CRACKME..EXE in Olly.

2. place the conditional point of stop to API TranslateMessage. For this:
a) open the list of imports [ Ctrl + N ]
b) find API TranslateMessage.
c) by the right knob of mouse in the line "USER32..TranslateMessage".
d) in the appearing menu select point "conditional log breakpoint on import".

3. now we determine conditions for the wear and tear of the point of stop.
In the field "Condition ' we write MSG == 201
In the field "Expression ' we write MSG
Decode value of expression as: Assume by expression.
For ' Pause program ' establish value ' On condition '.

OBSERVATION: In some systems condition MSG == of 201 can not be carried out. In this case place MSG == 202.

4. start appendix [ F9 ], introduce any registration data (Name: PowerUser, Serial: 162534) press "OK '.

5. troubleshooter it stops fulfillment protsessav modulus USER32:

77D43DD3 56 PUSH ESI
77D43DD4 8B7424 08 MOV ESI,DWORD PTR SS:[ESP+8]
77D43DD8 66:817E 08 E500 CMP WORD PTR DS:[ESI+8],0E5
77D43DDE 0F84 16870300 JE USER32.77D7C4FA
77D43DE4 6A 00 PUSH 0
77D43DE6 56 PUSH ESI
77D43DE7 E8 9EFFFFFF CALL USER32.TranslateMessageEx
77D43DEC 5E POP ESI
77D43DED C2 0400 RETN 4

6. Open the map of memory [ Alt + M ]. Then [ Ctrl + B ] for the search for line.

7. in the window of search introduce the series number, which was being used during the registration in CRACKME..EXE
0014A698 31 36 32 35 33 34 00 00 00 00 00 00 00 00 00 00 162534..........
0014A6A8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0014A6B8 AB AB AB AB AB AB AB AB 00 00 00 00 3C 00 95 00 ............<...

8. Establish the point of stop to the access to the memory, where is stored introduced s/n. dl4 this isolate seriynik in the window of dump call by the right knob of mouse. In the appearing menu: Breakpoint - > memory, on access

9. start appendix [ F9 ]. Olly will stop directly at point-.h:

77D6067C F3:A5 REP MOVS DWORD PTR ES:[EDI], DWORD PTR DS:[ESI]

Point-.h through SoftIce

Here it is still simpler.
Load CRACKME..EXE, introduce any name (PowerUser) and seriynik (615243) into the appropriate fields of introduction, then place into SoftIccE the conditional point of stop to TranslateMessage:

bpx TranslateMessage if @(esi+4)==201 [introduction]

or, if WM_.LBUTTONDOWN (201h) does not operate

Bpx TranslateMessage If @(.esi+ya)==202 [introduction]

(with the address [ esi+4 ] at the entrance in API it is stored the code of communication)

In the window of registration CRACKME..EXE harvest "OK '. After the emersion of the window of diagnostic routine, find, where in the memory is stored introduced s/n:

S 00000000 L ffffffff '615243'

It will seem in the window of data. Now it remained to place the point of stop on the memory, where it is stored:

bpm xxxxxxxx R

where the xxxxxxxx - this is the address, from which begins s/n introduced by you.

SoftIccE tormoznet directly after point-.h:

:77D6067C F3A5 REPZ MOVSD <------ point-h
:77D6067E 8BC8 MOV ECX, EAX <---- тут приземляется SoftICE
:77D60680 83E103 AND ECX, 03
:77D60683 F3A4 REPZ MOVSB

Thus, for my system point-.h is equal to 77D6067C. now it is possible to place on it the points of stop (bpx 77D6067C), similarly how we made bpx hmemcpy in the old and already overgrown by moss 98-oy.

Until today everything.

Keep on reversing…

That will get you most of it, and the crackme. A few words are garbled.

Regards,
bullet187
08-09-2004, 02:24 AM
Hello!
I know that this txt is in russian but the nick of that guy 'gryzon' is in polish. I'm from polish too.
Thanks for help!
I'll try it.


This is not a post
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > This is not a post
PDA

View Full Version : This is not a post

bullet187
08-09-2004, 03:08 AM
This is only info, not a post.
Last time i have application that doesn't work on hdd. Message that application can only work on CD won't disappear. I've tried to find fuction GetDriveTypeA, but no results. I've tried other ways to crack it, but nothing happens. And guess what kind of security was in that application. Program was checking attributes of files. If attribs was read-only program works correctly...:)
dELTA
08-09-2004, 12:45 PM
I'm sorry to be the one to tell you son, but that is most definitely a post. :D

Funny crappy protection anyway. :)
TBone
08-11-2004, 12:52 PM
Ceci n'est pas une pipe...
dELTA
08-11-2004, 05:08 PM
Now that is not a post... :rolleyes:
JimmyClif
08-12-2004, 09:18 AM
Dies ist kein Pfosten. Lederhosen.
dELTA
08-12-2004, 09:46 AM
Jaha, eftersom den här tråden på något konstigt sätt blev en språkuppvisning får väl jag inte vara sämre då... Det här är inte ett inlägg. Läderkalsonger. :D
JMI
08-12-2004, 10:31 AM
All these may be loosly translated as:

"I'm padding my post count." :devil:

Regards,
dELTA
08-12-2004, 12:27 PM
I guess it takes one to know one. :devil:
JMI
08-12-2004, 03:26 PM
The count is now dELTA 4 - JMI 2. :rolleyes:

Regards,
Woodmann
08-12-2004, 06:34 PM
Ceci n'est pas une pipe...

I like that, 'tis clever ;)

I read this mind melter and was left numb
and jamming a dull pencil into my left ear canal.

Enjoy :D

http://www.ed.uiuc.edu/EPS/PES-Yearbook/94_docs/PALERMO.HTM

Woodmann
Pyrae
08-12-2004, 09:38 PM
Dies ist kein Pfosten. Lederhosen.

I kind of focussed on what this board is all about and tried to reverse your usage of online translation services for that one - but yet to no avail.
At least Babelfish gives some different results for english to german and french to german translations. ;)
Btw, "Pfosten" actually means sth. like 'lamp post' and is sometimes used as a swear word for someone who didn't act very cleverly ('Du Pfosten!'). :yay:
So, who's able to tell

1. which translator has been used here
and
2. what was the exact input passed to it?

pyrae
Kayaker
08-12-2004, 11:18 PM
I like that, 'tis clever ;)

and jamming a dull pencil into my left ear canal.

..jamming 2 pencils...

Perhaps should be titled The Art of Reversing Art?

While I'm still chewing on the deep philosophical meaning of "aesthetics of a critical pedagogy", this line struck me nicely as an underlying benefit of the RE games we play:

"The consequence is that one’s habitual unreflective ways of viewing the world are changed. The model of this experience can be used to form a critical consciousness with new understandings of work, self and others."

And what of the pipe?

"If one takes the claim of the title “This is Not a Pipe” seriously, three things emerge: (1) “This” particular painting of a pipe does not stand for or represent any of that class of objects found in the world, that are called pipes; (2) “This” the sentence itself could not not represent a pipe; (3) “This” mixed element of discourse and image, written pipe and drawn text “is not a pipe.”

"What is the point? Foucault wants to show how the systems of imagery and language cancel each other in Magritte’s painting."

Reminds me somewhat of that puzzler - several balls of different color, each one labelled with a *word* which represents the wrong color. A yellow ball is labelled "Green", a blue ball "Red", etc. While looking at the picture, try saying out loud the true colors of the balls and it is very difficult. Again one needs to separate imagery from language.

Perhaps the clever Search games may yet appear ever and anon? :D

K.
JMI
08-13-2004, 01:35 AM
pppsssttt... Don't tell dELTA about the "pipe" O.K.??? He's already tried to smoke it. Or, at least, he "thinks" he has. :devil:

REgards,
JimmyClif
08-13-2004, 07:04 AM
pyrae,

I didn't use a translation engine :) I'm having German in my repertoire of foreign languages, and Lederhosen along with Sauerkraut is just a little tagalong for anything german, close to the word "well" in the english language. :D
TBone
08-13-2004, 11:34 AM
:D

I'm glad someone got the pipe joke.

And here you thought it was just a postcount pad, you philistine! ;) I can't say I'm big into French surrealist art, but I've always liked that painting in a certain reality cracking kind of way. The television and movie industry chronically presents you with a certain image as being representative of some reality over and over again until you start to believe that the image *is* the reality. For example, Ever notice how actors that are supposed to be playing teenagers are always 4-6 years older than the character? Every time I see a television show with a "teenager", I always want to say:

http://i.imdb.com/Photos/Events/2398/KatieHolme_Mazur_2098170_400.jpg
This is not a 16-year-old.

Our minds are just geared for representative imagery. You only have to vaguely hint that A represents B and we'll accept it as long as there's some similarity. The almost universal response to seeing this painting for the first time is "Yes, it is." It's amazing how persistant that perception can be, even when you're told in very concrete and truthful terms that this is *not* a pipe.

Anyway, I digress. I tend to take a more practical view of Rene Magritte instead of getting into all this high art vs. low art malarky. If he could turn a buck selling a picture of a pipe, more power to him :p

Edit: Dangit. When you edit a post, it turns parsing back on. I'm glad you've got that nerfed :-/
klier
08-13-2004, 04:25 PM
>>I can't say I'm big into French surrealist art..
this is not a french surealist. ;)
René François-Ghislain Magritte was born in Lessines, Hainaut (Belgium).
Regards,
dELTA
08-13-2004, 05:21 PM
http://i.imdb.com/Photos/Events/2398/KatieHolme_Mazur_2098170_400.jpg
This is not a 16-year-old.
Hey! She may not be 16, but she may on the other hand quite likely be a goddess, so watch your tongue about Katie, ok?! :p

PS.
Yes, even more so than Catherine Bell... :D
esther
08-13-2004, 09:09 PM
OFF TOPIC!!!!!!!! HAHAHAHAHAHAHAHA :confused: :thinking: :D
JMI
08-14-2004, 01:09 PM
Yep. This is where it belongs. Poor bullet187. ;)

Regards,


Windows NT System-Call Hooking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Windows NT System-Call Hooking
PDA

View Full Version : Windows NT System-Call Hooking

JMI
08-09-2004, 12:55 PM
For those of you who may be interested in this topic and do not yet have a copy of this famous 1997 article, authored by Mark Russinovich (of Systernials and Winternals fame) and Bryce Cogswell titled "Windows NT System-Call Hooking," nino (a member here and at exetools) found a copy in the wild and has attached it on the exetools forum. It's not something we can attach here, but it is a widely quoted article, not easily found. If you can't download on exetools (three post mimimun required) PM nino or me and we will try to assist as we can, but we are not a messenger service.

You will find the attachment in the #9 post in this thread:

http://www.exetools.com/forum/showthread.php?p=23296

Thanks to nino and happy reading.

Regards,
dELTA
08-09-2004, 01:07 PM
Great, I've been looking for that one for quite some time, thanks! :yay:
Jacques
08-11-2004, 03:15 AM
I've also got a copy of the original, straight from the Dr. Dobbs journal archive CD.

Anyone who wants a copy can send me a pm. (JMI: it's ok to do this, yes?)

Jacques.
JMI
08-11-2004, 10:56 AM
Sure. And that's where nino found it. A copy of the CD is loose in the wild.

Regards,


Sentinel SuperPro: IDA sigs, function #'s, & shell
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel SuperPro: IDA sigs, function #'s, & shell
PDA

View Full Version : Sentinel SuperPro: IDA sigs, function #'s, & shell

Jacques
08-09-2004, 08:53 PM
The target I am working on is protected by a Sentinel SuperPro dongle.

I have successfully done another SuperPro app before, but that one was pretty easy (and it's the limit of my Sentinel experience). I am now stuck on a couple of points...

Here's what I've done:

1) I've re-read the Sentinel API.

2) I've read most of the Sentinel related posts on the board.

3) I've applied the Sentinel signatures in IDA, but no luck.
I applied the following sigs:
sentpro -- Sentinel SuperPro static link library
sspro ---- Sentinel SuperPro Lib - Killer_3K
sspro62 -- Sentinel Super Pro 6.2 lib (sope)
sspro_v6 - Sentinel SuperPro (v6.0 lib) by CyberHeg

I didn't expect the last two sigs to work because the target comes with version 5.41.1 of the Sentinel drivers. I was hoping that Killer_3K sig would work as it had on the first app (which used version 5.39.2), but no luck.

Side Question:
IDA was not able to recognize the compiler that created the target. Does this by any chance hamper it's ability to apply other signatures?

Looking at the code in IDA, there are a couple of fishy things.

First, there are numerous cmp's to the infamous 7242h Sentinel packet ID. These cmp's are near the beginning of the functions (just past an initial NULL check), and the functions are all nestled in close proximity. Sure looks like a statically linked Sentinel library to me.

Second, the multi-color code map that is part of one of the toolbars shows the first 90% or so as dull green (data), and only the last 10% as code (blue).

I thought that this might mean they used the SuperPro shell feature to hide the code. I downloaded SPUICA v1.05.1 and SSunshl 1.0 by ExeLord, but both tools reported that the exe is NOT shelled. (Note: I do not have a dongle (required by these tools for unshelling) but they still seemed to analyze the file ok.)

BUT, doing some more digging, I found CyberHeg's tutorial on Sentinel Shells: http://www.woodmann.com/crackz/Tutorials/Cyberheg4.htm
The first block of code given in the tutorial describes the main switch in that app... it's quite similar to the area of code near "start" in my target. Both contain a lot to sequential cmp's and jmp's with similar compare constants (704h, 611h, 0e4h, etc.). Way too similar for it to be a coincidence. Here is the block from my target:

cmp ecx, 5910h
mov ds:dword_508D48, edx
mov ds:dword_4FE77C, ebp
jg loc_50BAE9
jz loc_50BD1F
cmp ecx, 1992h
jg loc_50BA1C
jz loc_50B9FD
cmp ecx, 704h
jg loc_50B9A5
jz loc_50B981
cmp ecx, 0E4h
jz short loc_50B94D
cmp ecx, 342h
jz short loc_50B940
cmp ecx, 611h
jnz loc_50B866
...
jmp short loc_50B916

Near the bottom of the tutorial CyberHeg also shows a block of "decoy" code (with calls to GetTickCount & GetCurrentProcessId) which is meant to mislead the reverser. This block is nearly identical to the first chunck of code in my target.

Questions:
-- Are the similarities noted above enough proof that the exe is indeed shelled?
-- Do the unshellers need the dongle to figure out if it's shelled? (Or is version 5.41.1 of the shell just not covered by the tools?)
-- Any ideas as to why none of the IDA sigs worked?

Back-tracking a bit, one of the first things I attempted was to try the emulator I had successfully used in my first project. This emulator was written by some guy named Steven. I found version 0.24 very useful, because it identified each SuperPro function it responded to by doing a DebugPring (making it very easy to follow the sequence of calls by watching the debugger's output window).

When I try to use the emulator, to at least see what is begin called, it responds with the following DebugPrints:
---- RNBO: fn is ABE - yet unknown
---- RNBO: fn is 5076 - yet unknown
---- RNBO: fn is 453E - yet unknown

These bogus (?) function numbers aren't constant either. Subsequent invocations of the app produce new numbers:
2nd invocation:
---- RNBO: fn is B3D4 - yet unknown
---- RNBO: fn is F6B0 - yet unknown
---- RNBO: fn is 80AD - yet unknown
3rd invocation:
---- RNBO: fn is 2847 - yet unknown
---- RNBO: fn is 85AD - yet unknown
---- RNBO: fn is AC64 - yet unknown

I did verify that the emulator obtains the function numbers from:
base of packet (location of 7242h id) + 30h

These calls most likely equate to:
RNBOsproInitialize
RNBOsproFindFirstUnit
RNBOsproQuery
but it would be nice to confirm this and actually see what's happening.

Last question:
-- Why is the emulator not able to recognize the functions with this target? (Are the packets being encrypted?)

Any pointers would be appreciated, and thanks for reading my long-winded post...

Jacques
nikan
08-10-2004, 03:46 AM
hi Jacques

"When I try to use the emulator, to at least see what is begin called, it responds with the following DebugPrints:
---- RNBO: fn is ABE - yet unknown
---- RNBO: fn is 5076 - yet unknown
---- RNBO: fn is 453E - yet unknown"

this is because the packet is encypted before call read to sentinel driver and if driver can not decrypt the packet the function numebr is not valid.
a guy in exetools forum say to me that there are two algo for enc/dec in sentinel driver.
i was worked on enc/dec functions of a sentinel ver 6.3.1 with driver 5.4.1 and succesfully done it.
you have two way to solve this problem.
1: write a sentinel.sys
2: change dec/enc routin of last emulator !!!

after solving this problem another bigger problem is that you must know sproQuery pairs of your shelled target (possibly 4) to unshell it with emulator.
Jacques
08-10-2004, 06:53 PM
a guy in exetools forum say to me that there are two algo for enc/dec in sentinel driver.
i was worked on enc/dec functions of a sentinel ver 6.3.1 with driver 5.4.1 and succesfully done it.

after solving this problem another bigger problem is that you must know sproQuery pairs of your shelled target (possibly 4) to unshell it with emulator.
Interesting... are you saying that the driver has a choice of two algorithms for encryption/decryption of the packet, or that some versions of the driver use one method and other versions use another?

I'm hoping to get my hands on the dongle for a little while to help with the sproQuery pairs and the unshelling.

How is your filter driver progressing?


Dll functions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dll functions
PDA

View Full Version : Dll functions

ReVeR
08-12-2004, 12:28 AM
Hey.
i got this question.
i got a prog that calls an openGl function....it is rather easy in c++ but, if u disasseble the code u see that to call teh openGl function the program needs to call the getprocadress function and then use it to get to the ogl function.....
any ideas on why this is this way?
and also to what extent is this the same as lets say ....calling a winapi function?
thx
lifewire
08-12-2004, 03:56 AM
sometimes it is done when using functions from certain dll's that are not supposed to exist on all systems. normally, if an imported module (dll) is missing, the windows loader would say "can't find blabla.dll". when a program manually loads the module using loadlibrary and locates the imported functions using getprocaddress it could display a more friendly error message like "you don't have opengl. download it from www.opengl.something".
naides
08-12-2004, 06:11 AM
A dll can be statically imported during the compilation/linking process. Most winApi dll are imported this way by default. In that case you don't need to use getProcAddress or any thing like that, Import Table Mechanism of windows PE
finds out the addresses of all the imported functions when the program loads.
The second flavor of dll is imported during runtime in an "as needed" fashion, which reduces some overhead, but requires more explicit work by the program(er). That is when LoadLibrary and GetProcAddress gets used to obtain the particular function code address, because it is not contained in the IAT.
ReVeR
08-12-2004, 10:33 AM
eh...crap i got it.....i forogt that we include libs for ogl.....
sry for dumbas post....one morequestion...were is GetDriveTypeA and MessegeBoxA ?
what dll?
kernel or user?
thx
naides
08-12-2004, 10:51 AM
eh...crap i got it.....i forogt that we include libs for ogl.....
sry for dumbas post....one morequestion...were is Kernel32:GetDriveTypeA and User32:MessegeBoxA ?
what dll?
kernel or user?
thx

Quickest way to find out is in SoftIce put a bpx on the function, then when you list the breakpoints (bl), the dll name is prepended to the name of the API function.

Olly will allow you to see the functions in the import list grouped by dll. A little more cumbersome.
ReVeR
08-12-2004, 04:07 PM
k, thx....
1 more question....
what does getDriveTypeA return when the cd rom is found ?
thx
gabri3l
08-12-2004, 04:21 PM
The returns for getdrivetype are

0: The drive type cannot be determined.
1: The root directory does not exist.
DRIVE_REMOVABLE or 2: The drive can be removed from the drive.
DRIVE_FIXED or 3: The disk cannot be removed from the drive.
DRIVE_REMOTE or 4: The drive is a remote (network) drive.
DRIVE_CDROM or 5: The drive is a CD-ROM drive.
DRIVE_RAMDISK or 6: The drive is a RAM disk

You should probably grab the win32api help file at Iczelion. It will answer a lot of your questions. hxxp://spiff.tripnet.se/~iczelion/files/win32api.zip
lifewire
08-13-2004, 06:36 AM
all api related questions are in the sdk. there you'll find also in which module the api's are exported. a better way to quickcheck in softice is not to bpx and bl, but use: exp apiname.
naides
08-13-2004, 09:20 AM
a better way to quickcheck in softice is not to bpx and bl, but use: exp apiname.

A Newbie Knows more than I do. Oh, the shame! ;) ;) ;)
dELTA
08-13-2004, 10:04 AM
I wouldn't exactly consider lifewire to be a newbie, although maybe you were only making a joke referring to his post count here. :)
naides
08-13-2004, 11:02 AM
I wouldn't exactly consider lifewire to be a newbie, although maybe you were only making a joke referring to his post count here. :)

Anybody may have more info that I have. I was making a joke!. I am a professional newbie.

I don't judge a person by the post count, what a difference from some people in this board. . . :p :p :p
dELTA
08-13-2004, 05:14 PM
Aw man, even the newbies are starting to make post count related wisecracks to me... ;) And I wouldn't really call you a newbie either for that matter naides. :)


problems with a program protected by aspack + aspr
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > problems with a program protected by aspack + aspr
PDA

View Full Version : problems with a program protected by aspack + aspr

orestes
08-12-2004, 03:34 PM
Time ago I have used stripper 2.07f and PEid 0.92 to unpack a program that the programer always protect two times, before he used aspack 1.06 and aspack 2.1, but in recent days he used asprotect 1.23 RC4 and aspack 2.11. The problem now is that the first packer can be removed but the second how is a unpacked file non a original packed the tool don't reconize. I really unpack the last version but now i can't do it.

If first I use stripper to unpack, PEid says that the unpacked program is packed by asprotect 1.23 RC4. But if first I use aspackdie to unpack PEid says that the unpacked program is packed by aspack 2.12

Well, actually i'm using asprdumper and works fine (excepts the debug of Manko that crash maybe because isn't aspr but seems like it), the problem is rebuild the IAT of the second unpacked, i try with revirgin 1.5 and Imprec 1.6 final, to trace i try ollydbg 1.1 because softice is detected (i work in xp, i can't use frogsice or ntdump)

Resuming I wanna know if there are other method to unpack and how i can rebuid the IAT because revirgin and Imprec show me only trash. :confused:
namrahus
08-13-2004, 05:28 PM
It has to be unpacked manually. :mad:
orestes
08-13-2004, 07:35 PM
Thanks namrahus, but I already tryied and I can't get it. I need to learn more before to get it.
JMI
08-14-2004, 01:24 PM
Well then your path is clear. You need to study manual unpacking more and learn how to do it. There is much discussion already on this and other Forums on manually unpacking this version of ASPR. Time for you to read more than one or two tutes. Use the search button and things like "manual unpacking and ASPR" (without the quotes) or maybe even just "ASPR" or "Asprotect unpacking" (don't actually use the quotes in the search box.)

Regards,


!protect on....
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > !protect on....
PDA

View Full Version : !protect on....

SpeKKeL
08-13-2004, 07:09 AM
Howdy,

Since iceext sets it's protect function by default off i was wondering if there is a simple way to set it by default on.....
It's just for my kids, when playing some protected games that they don't have to type in SI !protect on.
Maybe some automatic script..???

Thanks,,

Spekk.
Kayaker
08-13-2004, 04:28 PM
Hi

Please don't turn your children into script kiddies! (Or script kitties for the girls..) :p

Here's a silly idea... You'll probably need to output the text "!protect" to the Softice command window + return. Code a small driver which calls

DbgPrint("!protect \n");

or maybe

static char pText[] = "!protect";
DbgPrint("%s \n", pText);

If everything goes as planned, Softice should pick up the DbgPrint text '!protect' and handle it as if you typed it in. If need be you could put in a small 'wait' to let the command be processed. The old BCHK interface allowed SI command window input from code, which would run immediately, this type of input may/should do the same.

Of course this and the script to run "net start IceExt" should be accessible by an on/off push of a button for the aspiring young reversers.

Kayaker
dELTA
08-13-2004, 05:28 PM
As the old saying goes:

Give your children a crack (or a script to hide Softice), and they'll be hungry again tomorrow, teach them how to crack, and they'll never be hungry again. :p

It's probably time you ruined their lives by introducing them to the fine art of reversing anyway, not to mention all the food money you could apparently save, if the saying is to be believed. :D
Woodmann
08-13-2004, 05:39 PM
Howdy,

Start them early, the more they learn the more they.......
ummmmmmm learn ??? :confused:

Woodmann
dELTA
08-13-2004, 05:43 PM
Start them early, the more they learn the more they.......
I think the words you're looking for are "get picked on in school". :p
SpeKKeL
08-14-2004, 03:10 AM
Yep i've got the message..

(But i was the man who made the cracks sjit i am becomming very old.)

Old SpeKK.
JMI
08-14-2004, 01:30 PM
If your "kids" are still at home, and especially if they are still using "your" computer, you really aren't that "old". Or are "you" using "their" computer? :devil:

Regards,
lifewire
08-14-2004, 02:58 PM
this sounds really neat, an old father that teaches his kids how to RCE :)
Woodmann
08-14-2004, 04:49 PM
this sounds really neat, an old father that teaches his kids how to RCE

I agree :)

And SpeKK, change your nic to "oLD SpeKKeLed HeN"
It is a beverage my brother enjoy's.

Woodmann
SpeKKeL
08-15-2004, 05:12 AM
Done. :p
JMI
08-15-2004, 05:41 AM
No wonder your kids get to use "your" machine. You give in too easily. :D We NEVER do what Woodmann tells US to do. :cry:

Just kidding Woody. :loveu:

Regards,
SpeKKeL
08-15-2004, 05:46 AM
Maybe "we" have only one machine.......

Think we are off topic :whoops:

oLD SpeKKeLed HeN (used to be SpeKK.)
bedrock
08-16-2004, 02:41 AM
Why not just modifiy the iceext source, and recompile :D

--
bedrock
SpeKKeL
08-16-2004, 03:24 AM
Good idea, Shall i ask my kids ?

SpeKK.


adobe acrobat and sice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > adobe acrobat and sice
PDA

View Full Version : adobe acrobat and sice

homersux
08-13-2004, 09:43 PM
It seems acrobat 5 has sice detection code, the application will not load when sice is loaded. Is this a known behavior of adobe acrobat?
dELTA
08-13-2004, 09:55 PM
Yes, and it has also been discussed before on this board. If you would have searched for "acrobat softice", the following thread is one out of the six hits you would have gotten:

http://www.woodmann.net/forum/showthread.php?t=2477
homersux
08-13-2004, 11:00 PM
thanks, got a little lazy there. :P
I actually looked through google but couldn't find a useful link.


Man in the middle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Man in the middle
PDA

View Full Version : Man in the middle

nelixx
08-14-2004, 04:14 AM
I make making a peer 2 peer protocal much like waste for a small dark net, but i have one huge problem.

Man in the middle attacks.

I have had so manu ideas and solotions, but they all lead back to the same problem, a man in the middle is a proxy of you. so theres no way you can stop him... right?
dELTA
08-14-2004, 09:56 AM
Sure there is, simply authenticate and encrypt all connections with asymmetrical cryptography, just like e.g. SSL. Waste is using this already I think, so why do you want to make your own instead of using Waste, what do you think Waste is lacking?

I actually designed my own protocol for this about two years before Waste was released, but never had the time to implement it fully, and it had some cool features that Waste is lacking, that's why I'm extra curious about it. :)
nelixx
08-14-2004, 10:20 AM
a man in the middle can just replace the public keys used in the key exchange.
with his own, so he can decrypt all the packets.

my only solotion is to have all the keys signed with a 3rd party keys (ala verisign) but that doesnt make my network very decentralized.

waste is vuln to untrusted users being on the network, its also vuln to man in the middle on connection.
dELTA
08-14-2004, 01:50 PM
The public keys (i.e. "asymmetrical identification certificates" of some kind) do of course have to be either distributed beforehand, or, like you suggest, signed by a trusted source, but otherwise it wouldn't be much of a private network to begin with, now would it? Consider carefully on a design level what you want to accomplish with this protocol, and when these things are clearly defined, then start to think about the implementation.

If you give us a bit more detailed description of what you really want to accomplish with the protocol, in terms of authentication and access control, I'm sure we will be able to help you.
nelixx
08-15-2004, 07:41 AM
yes more info would be good, but i fear sharing vaporware.
i think i solved the problem with an inherited chain of key signing.

i
guy11
09-10-2004, 10:21 AM
i worked a year ago on some crypto thing and i remeber that there was a diffie hellman algo, which solves the mim problem.
(there a the old diffie hellman algo and some extended versions often used in vpns)
dELTA
09-10-2004, 05:19 PM
Are you sure that this algorithm protected against a man in the middle who could intercept and edit the traffic? (which is the common definition of man-in-the-middle, contrary to a simple eavesdropper) I don't think this is possible without some kind of pre-distributed credentials of some sorts (e.g. client-side certificates or some other secret, known only by the two persons in the endpoints).

There is indeed a Diffie-Hellman algorithm for secure public key exchange though, which prevents any attacker who cannot edit the traffic from eavesdropping, but this is just equivalent of the two endpoints sending over their public RSA keys in plaintext, and then encrypting the rest of the communication with these, which does not protect against man-in-the-middle attacks.

Maybe Mike is willing to settle it for us anyway? :)
mike
09-10-2004, 05:52 PM
Diffie Hellman doesn't help at all in a MITM attack. It's just another public key scheme. nelixx's idea about key signing could work if it's done right. You just have to be sure that the verification key can't be replaced by the MITM. That was the idea behind having Verisign's public key built into every copy of Internet Explorer.

(And delta, about the time lag--I check once a day, but usually about 8 hours later than the posters, since I'm in New Zealand. The reason I hadn't commented is because nelixx said he had it sussed)
JMI
09-10-2004, 07:51 PM
Hey Mike, someone down there in New Zealand is leasing out the computer they used to do the animation for the Lord of the Rings. It's reported to be the 83 fastest in the world. Now is your chance to grab some time for that more complicated crypto work. :yay:

Regards,


Configuring SoftIce.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Configuring SoftIce.
PDA

View Full Version : Configuring SoftIce.

Tribo
08-14-2004, 12:29 PM
Hi Everybody, I have installed SoftIce for WINNT 4.05 and installed the Patch for WinXP... When I open SoftIce, I opened and Exe, (with the mouse) but I realized that the Keyboard doesn't respond, U can't type a single char!, And when I start to test this problem the computer hangs... Do u now what could be the problem?...

Thanxs in advance
Tribox.
JMI
08-14-2004, 01:20 PM
Time for you to read the FAQ listed in the BIG RED LETTERS, which you were supposed to have done BEFORE you posted.

Had you done so, you would then know that you were supposed to SEARCH before you ask a question. Had you done that, using something like "softice and winXP" (without the quotes) you would have discovered that WINNT 4.05 really doesn't work well with WinXP and that you need a later version of Softice. DO NOT ASK WHERE YOU CAN GET ONE HERE.

The search button will also help you find answers to questions about using Softice and various keyboard and mouse issues. Again search, using such things as "softice and keyboard" or "softice and mouse" (again without the quotes).

Regards,
Tribo
08-14-2004, 05:14 PM
Thanxs JMI, now Im going to search... remember that I installed a Patch (3 .sys files) to the installed S-ICE Winnt 4.05, so it can work in WinXP...

P.D.: u mention that I need a later version for WinXp... I already downloaded Compuware DriverStudio v3.1-SoftIce 4.3.1, Does this version work for XP?...

Thanks for all,
Tribo.
dELTA
08-14-2004, 05:22 PM
now Im going to search...
Compuware DriverStudio v3.1-SoftIce 4.3.1, Does this version work for XP?...
I sorta think that the whole idea of searching is to do it before asking questions whose answers are easily found both in the FAQ, or by searching this board with practically arbitrary search strings... *sigh*

PS.
You forgot about lying about having read the FAQ.
Tribo
08-14-2004, 06:24 PM
Sorry Delta, I'm going to investigate more before doing stupid questions... :D
I've made what JMI, and checking the posts...

Thanks,
Tribo.

PS: I already read the FAQ!!! :P:P:P ;-)
JMI
08-14-2004, 06:43 PM
Now Tribo, if you had ALREADY read the FAQ section titled:

Softice questions ,

you wouldn't have had these "Softice questions."

Regards,
dELTA
08-14-2004, 07:17 PM
Considering the smileys, I think he was referring to my reminder that he forgot to lie about reading the FAQ, quickly remedying that... :)
JMI
08-14-2004, 07:45 PM
Looks like this one is going to end up in the Off Topic as well. :idea:

Regards,


A Little Help With Ollyscript
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A Little Help With Ollyscript
PDA

View Full Version : A Little Help With Ollyscript

Innocent
08-14-2004, 07:19 PM
Ok I have been studying some things in Olly and now I want to make an automated script. I know exactly what I want to do but I just don't know how to do it. I have read the entire readme list of functions but I am still stumped. This is what I want to do:

1. I arrive on a line like this: 02563E40 CMP DWORD PTR SS:[EBP-F20],2
I want to change the memory at DWORD PTR SS:[EBP-F20] to 1. In Olly I can easily just right click on the eip and select follow in dump-> memory address and change it by hand. Can I do this with a script?

2. I arrive at a line after some tracing. I want to get the address of the line I am on i.e. 02564127. Once I have this, I want to set a breakpoint so many bytes after this line: 02564127+1400 bytes. The syntax would be something like this I suppose:

declare variables:
var addr
var const
var bpline
mov const, 1400 // make the variable const equal to 1400 bytes
1. get address of eip and save it in var addr: mov addr, eip // addr = current eip
2. add address of eip to constant value.
Something like: add addr, const
3. move the result of the add into variable bpline and set a bp there:
mov bpline, addr // bpline = addr
bp bpline

EDIT: I figured out how to do number 2 but I still don't know how to change the memory in #1.

This is all I need really... Hope someone can help :D
Ricardo Narvaja
08-14-2004, 11:14 PM
var pire

mov pire, ebp
sub pire,0f20
mov [pire],02

Ricardo Narvaja
Ricardo Narvaja
08-14-2004, 11:17 PM
var pire

mov pire, ebp
sub pire,0f20
mov [pire],01

sorry is 01

Ricardo Narvaja
Innocent
08-14-2004, 11:49 PM
Eso es muy fácil! ¿Por qué no lo pensé? jeje :yay:
Muchas gracias.
Ricardo Narvaja
08-14-2004, 11:59 PM
preguntarle o pedirle al autor de ollyscript porque si se puede poner

cmp [ebp-4],2

no se puede poner

mov [ebp-4],2

y si

mov [ebp],2

cual es el impedimento para permitir una operacion antes del mov dentro del corchete, si en el cmp se puede hacer perfectamente.

Vaya a saber je

Ricardo Narvaja
dELTA
08-15-2004, 06:53 AM
Ok guys, let's keep it civil here... :) English please.
Innocent
08-15-2004, 07:12 AM
Heh. ¿Hay una problema con Español? I see what you are saying Ricardo. If the cmp statement works just fine then why can't we do a mov too? Unfortunately I think the author is pretty busy right now. Also, I wish there was a feature to remove all current breakpoints in the list. When loading one of my targets, olly sets a hardware breakpoint on the oep. I have to remove it manually or the unpacking won't work right. (stupid cc screws it up)

Another question: can an ollyscript set a bp on an api? I tried to set a bp on FreeLibrary but I got an error.
Ricardo Narvaja
08-15-2004, 08:20 AM
GPA proc, lib
-------------
Gets the address of the specified procedure in the specified library.
When found sets the reserved $RESULT variable. $RESULT == 0 if nothing found.
Useful for setting breakpoints on APIs.
Example:
gpa "MessageBoxA", "user32.dll" // After this $RESULT is the address of MessageBoxA and you can do "bp $RESULT".

With this podes poner Bp en las apis jeje.

Sorry por la mezcla de idiomas es que soy malisimo speaking english jaja.

Ricardo Narvaja
hobferret
08-15-2004, 01:56 PM
Ricardo :)

No se preocupe por la mezcla de idiomas Ricardo, yo creo la mayoría de nosotros aquí entienda español.

¡Su trabajo es apreciado bien por nosotros todos!

/hobferret
Ricardo Narvaja
08-15-2004, 02:23 PM
jeje i think this 30/8 is the end of my ISP connection for no pay, but various friends pay me 6 month more of internet, for this reason you will continue tolerating me a little more jeje.

Ricardo Narvaja
hobferret
08-15-2004, 02:33 PM
Ricardo :)

This 30/08 are you referring to cracklatinos which has not been updated since then?

/hobferret
Ricardo Narvaja
08-15-2004, 03:06 PM
No 30/8/2004 will be, the end of my personal participation, i lost my job and i'm unenployed now, and mi ISP cut me the internet connection 30/8, but a group of friends help me and pay me 6 months more of internet and you will tolerate me a little more jeje.
The crackslatinos page and crackslatinos list continue, with me or without me, is only my personal situation.
I will be founding job but i'm online for six months more.

Ricardo Narvaja
SHaG
08-15-2004, 05:59 PM
If the cmp statement works just fine then why can't we do a mov too?

If you describe the issue at hand in English I will be happy to fix it for you in the next release. :D
Innocent
08-15-2004, 10:40 PM
Hello SHaG. :D Heh, Spanish is my second language. Thanks for making ollyscript! It is pretty cool.

I see 2 additions (maybe):
1. I wish there was a feature to remove all current breakpoints in the breakpoint list. When loading one of my targets, olly sets a hardware breakpoint on the oep. I have to remove it manually or the unpacking won't work right. (stupid cc screws it up) I wish I could clear the breakpoint list with a command from the script. (Don't know if you can do this. Maybe just wishful thinking?) :sneaky:

2. I arrive on a line like this: 02563E40 CMP DWORD PTR SS:[EBP-F20],2
I want to change the memory at DWORD PTR SS:[EBP-F20] to 1. In Olly I can easily just right click on the eip and select follow in dump-> memory address and change it by hand.

What Ricardo was saying is that I guess if we do a "cmp [ebp-f20],2" in a script, it will work and return a result. If we try to do a: "mov dword ptr ss:[ebp-f20], 1" it gives an error. So thats why I said "If the cmp statement works just fine then why can't we do a mov too?"

The way Ricardo showed me how to do it is thus:
var mem
mov mem, ebp // move ebp into variable mem
sub mem, f20 // subtract f20 from var mem. Now [mem] = dword ptr ss:[ebp-f20]
mov [mem], 1 // now we can change the memory at [ebp-f20] to 1

So it would be a lot easier if we could just do a "mov dword ptr ss:[ebp-f20], 1"

Now if only I knew how to make a loader that does what my ollyscript does... :-/

Thanks again for the awesome plugin!
Ricardo Narvaja
08-16-2004, 07:24 AM
Yes the question is, if you can use

cmp [ebp-0f20],2

in ollyscript why can not use

mov [ebp-f20],2

and is possible

mov [ebp],2

is not permitted the operations in a mov and is permitted in a cmp.

Ricardo Narvaja
omega_red
08-16-2004, 09:37 AM
Yes the question is, if you can use

cmp [ebp-0f20],2

in ollyscript why can not use

mov [ebp-f20],2

and is possible

mov [ebp],2

is not permitted the operations in a mov and is permitted in a cmp.

Ricardo Narvaja

If I understand correctly, it's all about writing hex numbers ;)
You cannot use f20, because it would be treated as identifier. Put extra 0 in front, if the first significant nibble is a letter.
Ricardo Narvaja
08-16-2004, 09:43 AM
cmp [ebp-0f20],2

is possible

mov [ebp-0f20],2

is not possible

is not possible make

[xxxx-yyyy]

adds o subs in a mov [ ]

and is possible in a cmp [ ]

is not for the zero before f20 if you need

mov [ebp-4],2

is not possible too

Ricardo Narvaja


Installshield self extracting-exe ...possible?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Installshield self extracting-exe ...possible?
PDA

View Full Version : Installshield self extracting-exe ...possible?

BrntPhish
08-14-2004, 09:14 PM
using the filemon utility i do not see ANY extraction of ins, inx etc before the correct password is entered. Will teh package for the web method work?


Where to start?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Where to start?
PDA

View Full Version : Where to start?

patyrick
08-15-2004, 01:21 AM
I use a program at work that saves its files in some proprietary format. My desire is to manipulate data in the file without having to use the program. I was able to do this on earlier versions of the program since all of the data was stored in the file's macintosh resource fork. I have tried some very simple means of analyzing the newer file format i.e., making incremental changes to a file and comparing it to its older self, looking for strings in the file. However, even the same file is never saved the same twice. I can not make heads or tails of the file format. I can only conclude that the data is encrypted. If I wanted to go about learning how the file format is structured, how would I start? The company that writes the program does not like to give out its SDK, which infuriates the hell out of me. Any strategies?
JMI
08-15-2004, 05:36 AM
You "of course" read the FAQ in the BIG RED LETTERS, didn't you???? That's the first place to start and you should indicate that you have read it.

Since you are asking about MAC programs and file formating, you should have, at the very least ALREADY done a search on the net, looking for ANY information on the file format used by this company.

Although I started out in MAC reversing, but it has been some time since I spent much time reversing on my MAC. First you need to research what tools are available for debugging programs on the MAC. If you can't look at the code, you really can't make much progress. Another consideration is the OS you are running. You do understand that there has been a major change in the underlying fuctionality between OS 9 and OS X, do you not? OS X is now Unix based and you need to be thinking about that while attempting to reverse newer MAC programs.

Of course the other FUNDAMENTAL LAW OF SOFTWARE is the program, itself, HAS TO KNOW HOW TO DECODE ITS OWN FILE FORMAT. If it couldn't, it couldn't operate, right? So, SOMEWHERE in the code, is the process for manunipulating the materials in the file, and if they are manipulated in some manner to prevent their easy viewing in a text editor, the program has to unwrap that process to show you the information in a format you can read and understand. So the SECOND place to start, after obtaining a debugger that works on a MAC, is looking for the "where" and the "how" the program does that transformation.

And NO don't ask here where a MAC debugger may be obtained. That is also one of the rule, plainly spelled out on the title to the "Tools of the Trade" Forum.

Regards,


IAT Rebuilding of a safecasted dll
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > IAT Rebuilding of a safecasted dll
PDA

View Full Version : IAT Rebuilding of a safecasted dll

is0x000
08-15-2004, 02:14 AM
I've been working the full month trying to unpack a dll crypted with safecast. I've been able to dump the decrypted dll easily. The problem comes rebuilding the IAT, there are 141 unresolved pointers that points to decryptation routine inside ~df394b.tmp that is extracted from the dll at runtime.

The real problem is that the api returned from the decrypter for a given pointer is rva dependent so the same pointer returns different apis depending on the rva where it was called.
Using ImpRec 1.6 I have rebuild the IAT using TrapFlag Trace so at least I have an IAT wih all the apis that are called from the decrypted dll, and now I'm manually fixing each api call to the real value of the api that should be called, but it's a really slow work cause imagine how many times will be called those 141 unresolved pointers... I'm really bored and I probably will make a mistake that will make all my work useless.

Anybody have tryed an easyer aproach or know how to automatize the work?
Any recomendation are wellcomed.

Thank You in advance
evlncrn8
08-15-2004, 08:54 AM
easier approach.. use softice, shield it with iceext or whatever, trace the api handler and see how it works.. generally goes to an area in mem, which pushes a magic, then bounces into the main handler, which eventually does a getprocaddress on the api (watch the stack for ptr to asciiz when they're decrypted) or it lifts the va from its internal cache.. pretty simple.. if its taken you 1 month you're definately doing it the wrong way
quake_ger
08-16-2004, 11:30 AM
try to use revirgin's tracer


Updated Support for Visual SoftICE 3.0/3.1 (XP SP2/ W2K3 AMD64)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Updated Support for Visual SoftICE 3.0/3.1 (XP SP2/ W2K3 AMD64)
PDA

View Full Version : Updated Support for Visual SoftICE 3.0/3.1 (XP SP2/ W2K3 AMD64)

JMI
08-15-2004, 10:35 PM
Just in case some of you aren't on the official update notification list from Compuware, these nice folks have issued some updates to make SI 3.1 work with the new SP2 M$ update.

You will find a thread by the same title by NightLight on the exetools Forum with information, download instructions, and even an attached file with the files. Of course the evil admin over there does not permit people to download attachments unless one is registered and has at least 3 "posts of some substance." :sneaky: (That guy acts like he thinks he's me. :idea: But if he's me, then who am I? :eek:) You wil the info here:

http://www.exetools.com/forum/showthread.php?t=4947

Regards,


How to find difference between two binary files.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to find difference between two binary files.
PDA

View Full Version : How to find difference between two binary files.

mcensamuel
08-16-2004, 01:47 AM
Hi gurus,

Recently when i tried to find a bug in a program.
I got two versions of the same program.
With one of the program i am getting error and with the other
i am not getting any error.

How can i found out difference between the two files.

will u people do ...normal address range checking..or anything else..

please redirect me to some points ..where i can read and learn...

Thanks in advance for your help...!!
thanks
:whoops:
lifewire
08-16-2004, 03:16 AM
currently there is a thread on "the other board": http://board.win32asmcommunity.net/showthread.php?s=&threadid=19149 on the same subject.

you can also use the standard stuff that comes with windowsxp: system32\fc.exe compares two files, with /b it compares binary
hobferret
08-16-2004, 04:56 AM
Hi

Try this link

hxxp://www.respublica.fr/topcracks/x-brain27.zip

If that aint available search for x-brain :D

A very simple file compare program

/hobferret
omega_red
08-16-2004, 05:16 AM
Total Commander has a nice compare built-in, same for almost any hexeditor (I'm using Hex Workshop).
dELTA
08-16-2004, 06:51 AM
I really like the "Synchronize & compare" feature of WinHex for this, it's the best I've seen.
mcensamuel
08-16-2004, 07:15 AM
hi,
actually i dont want to do normal byte-by-byte comparison..
i wants to know..where the program is changing..
i am doing compaison between various file sized files.
thanks
monguz
08-16-2004, 07:38 AM
Hi..
decompile them (disassemble) identify the buggy thing ,then try to find the same piece of code (patter or signature search) in the 'good' one.
thats all... i think hier is it no oder way to 'compare' apples with mellons..
greetz monguz
naides
08-16-2004, 09:28 AM
hi,
actually i dont want to do normal byte-by-byte comparison..
i wants to know..where the program is changing..
i am doing compaison between various file sized files.
thanks

You need to state your problem with more details.
I have little idea of what you are trying to acomplish here.

Reading in between lines it seems that you are dealing with two VERSIONS of a program, one that is crashing and another that is not. . . Right?

Concentrate on the crashing one. Learn to interpret the error messages, which usually points in the general direction of the misfunctional code.

Also be aware that the error may not be produced by the main .exe file itself but one of the import modules
You may be up to a serius disassemble-debug project
Woodmann
08-16-2004, 04:55 PM
Hi,

I am going to guess and say bad rebuild of dump.

Woodmann
disavowed
08-16-2004, 06:57 PM
I really like the "Synchronize & compare" feature of WinHex for this, it's the best I've seen.
ExamDiff Pro (http://www.prestosoft.com/ps.asp?page=edp_examdiffpro) is better ;)
dELTA
08-16-2004, 07:00 PM
I am going to guess and say bad rebuild of dump.
I am going to guess and say that he's after the holy grail of auto vulnerability identification, comparing a vulnerable and a fixed version of a program... :)

And nice tip about that program disavowed. Cool that is handles inserted portions like that, but the big problem with e.g. absolute addresses in code remains, still making it very hard to find the relevant changes between two different builds of a certain software. :-/ It would be really cool and useful with a program that could identify and handle inserted chunks like that while still ignoring changed absolute addresses in otherwise identical code and such. Anyway ever heard about a tool like that?
disavowed
08-16-2004, 09:52 PM
And nice tip about that program disavowed. Cool that is handles inserted portions like that, but the big problem with e.g. absolute addresses in code remains, still making it very hard to find the relevant changes between two different builds of a certain software. :-/ It would be really cool and useful with a program that could identify and handle inserted chunks like that while still ignoring changed absolute addresses in otherwise identical code and such. Anyway ever heard about a tool like that?
i don't know of any publicly available tool to do that. the easiest way to make such a tool would probably be with an idc script. probably wouldn't take more than a few hours to make.
Silver
08-17-2004, 02:25 PM
bit late, but Araxis Merge is a great diff tool IMO. I use it all the time, for coding as well.


enabling missing option
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > enabling missing option
PDA

View Full Version : enabling missing option

Towelie
08-17-2004, 05:35 AM
hi all,

i'm trying to reverse a soft written with delphi 5,
first it had a serial check - when a wrong serial is entered you cannot use it, when you install it it write some serial to the registry, this serial lets you work with the software but limits you to 36 entries. i found some procedure checking the serial and generate a working serial (no 36 limit), but...
with both of the serials there are a few features blocked - when i click them i get this screen ask me to buy the soft.

the version i'm working on, is called demo version - it even creates a registry key named demo, it is possible that those features are not even coded, but the existence of the serial validation procedure - and the fact that there is a serial that lets you work with lighter limit or with no limit at all, makes me think other. another thing - DeDe shows me the missing features form.

any suggestion on how to find the place where it cheacks if this is a demo or not?
dELTA
08-17-2004, 05:30 PM
Backtrack from that "ask you to buy the soft" screen that you mention.

PS.
You wanna get hiiiiigh? :D

PS2.
Only people who watch South Park will understand that joke. :)
Towelie
08-17-2004, 06:24 PM
since i wrote that post,

with a little (well big) help from DeDe, i found that the code of the disabled functions is coded, but there is some procedure ahead of it that popup the BuyMe screen, when i patched it into NOP, i got the screen of the disabled function, but when i carry on - i got an Access Vaiolation error.

i think i need some more digging in the serial validation procedure.

if you have any idea,
i'm hearing.

and remember, there is a little towel in every one of us...... ;)
Woodmann
08-17-2004, 06:33 PM
Wow....

I thought only "USA" got to watch SouthPark.
Towelie is way better then Mr. Hankey, whom
I assume is a long lost relative seeing how they
both sound the same. :p

Woodmann
Towelie
08-17-2004, 06:42 PM
and remember, there is a little Mr. Hankey in every one of us......
dELTA
08-17-2004, 07:44 PM
Hey, watch who you're accusing of being full of crap! :p

And about the code, I would look for branches before the code displaying that message. Also, make sure to balance the stack when you're nopping out function calls, otherwise you might get crashes like that even from "correct" patches.


Ollydbg and C++ Applications (specifically RTTI)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Ollydbg and C++ Applications (specifically RTTI)
PDA

View Full Version : Ollydbg and C++ Applications (specifically RTTI)

Santa Clawz
08-17-2004, 06:15 AM
Greetings all,

Anyone here managed to get C++ applications to run in OllyDbg once analysed? When hitting F9 the target bails with an exception - 'Access violation: No RTTI data!'

Anyone had this problem and got round it? It's a great debugger which I'd like to use exclusively but can't if I can't reverse apps written in C++ (er, quite a few ;-)

Regards

Santa Clawz
sgdt
08-17-2004, 10:25 AM
I think close to 99% of all apps I use Olly on are C++ (VC++ specificly).

It's not a C++ thing, but rather a protection thing. What you are seeing is the detection of Olly and the application getting pissed. More than likely, it was counting on something to catch the debug event and fill in required information.

What you should try first, to test your feeling it's olly, is to run the app under VC++ (load the exe into VC++, it'll complain you don't have debug info but run anyway). One can guarentee that VC++ *does* handle C++, so if it doesn't run, you can then know it's not that Olly somehow forgot how to deal with the most popular language in existance.
Santa Clawz
08-17-2004, 11:58 AM
Cheers for the reply but unfortunately I do not have VC++! I use Dev-Cpp (I come from a Linux background so this works well for me!). I can disassemble the target OK. I have no other debuggers to test it with. Actually saying that, I did download microsofts debugger and it seemed to run OK in that. Although I hate that debugger so I removed it.

Are there any configuration options I may have that will procude this error? What are yours like?

Santa Clawz
babar0ga
08-17-2004, 01:44 PM
You should go to and seek help there...hxxp://ollydbg.win32asmcommunity.net/
Silver
08-17-2004, 02:28 PM
Point of note, there is no RTTI in vanilla C/C++ (apart from basic typecasting when building code). Normally some 3rd party lib is used that provides it, such as Boost (iirc).
Santa Clawz
08-18-2004, 03:30 AM
You should go to and seek help there...hxxp://ollydbg.win32asmcommunity.net/

Do you really think I havn't tried that!!? Huh.
Js
08-18-2004, 07:18 AM
nice attitude, your post on olly forum is dated after your first post here and after babar0ga's reply.
Santa Clawz
08-18-2004, 11:01 AM
nice attitude, your post on olly forum is dated after your first post here and after babar0ga's reply.

Well that is odd then, I thought I posted that about 2 weeks ago. I re-posted it today yes, and also sent an E-mail to the author about a week ago so don't take me for some
unintuitive luser that can't be bothered to do their homework or at least try google or the webpage where they got the app. My attitude may have been a little hostile because I get sick of people posting replies like that, although I do sympathise - I know there are people who are out there who just want YOU to do THEIR work for them.

Plus, I'm having a bad day!

Regards

Santa Clawz


unknown TEB fields
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > unknown TEB fields
PDA

View Full Version : unknown TEB fields

Neitsa
08-17-2004, 06:25 PM
Hello,

Can somebody explain me what are those fields in the TEB structure on Win NT environment (start of TEB located at FS:[0]):

LastStatusValue: offset 38h
Count Owned Locks:offset 3Ch
HardErrorsMode: offset 40h

'LastStatusValue' is surely related to LastErrorValue, which is the last error done by the thread, but Status of what ?

Count Owned Locks: maybe this field is about mutual-exclusion locks for threads, but I'm not sure...

HardErrorsMode: So, Hard errors are critical errors done by hardware (Am I right ?) but what is the 'Mode' ? and why Threads should deal with Hard errors (I was thinking that was the job of the Kernel) ?.

Thank you very much. Regards, Neitsa.

Damn, First post Here and registred since Feb. ! So , I'm very happy to be here and I like to see and read posts by great coders and reversers

Keep up the good work !
Woodmann
08-17-2004, 06:50 PM
Howdy,

I have read this post a few times now and I am not quite sure what you are asking.

If you are looking for a basic explanation as to what those 3 mean,
MS has all the documentation you could ever want. :)

Woodmann
Neitsa
08-17-2004, 08:12 PM
Hello Woodmann,

Thank you for your answer, and sorry if my question wasn't clear.

Yes I'm searching for an explanation of what those fields mean.

I've searched through the MSDN but the PEB and TEB aren't documented by MS, and I've also googled for them but can't find an answer for those fields...
(searched also in WINTERNL.H, but found nothing to explain what they are)

All I've wrote in my previous post is what I guess they are...

I've found those fields in the "inside MS win2k" book, but they aren't explained either...

And Soory for my bad english :-/

Regards, Neitsa.
Woodmann
08-17-2004, 08:50 PM
Howdy,

Your English is fine :)

Try looking for Matt Pietreks (I think the spelling is correct)
book. He is the "MAN" when it comes to MSDN.

Woodmann
Kayaker
08-17-2004, 11:12 PM
Hi

These 3 fields are pretty well undocumented AFAIK. Sven Schrieber in his 2001 work doesn't even acknowledge their existence, the TEB structure described there ends with the field LastErrorValue at [TEB + 34h].

The exact use for these 3 fields are anybody's guess. The TEB is the only part of the ETHREAD block which exists in the process address space, so any of the fields must be important from a user mode perspective (like the PEB pointer). Windows may use the fields somewhere in ntdll code, an examination with IDA might reveal something.

Possible explanations of the fields:

LastErrorValue [TEB + 34h] - will be 0 or a C000xxxx error code.

LastStatusValue [TEB + 38h] - may indicate the Wait status of the thread, as used in synchronization. A guess.

Count Owned Locks [TEB + 3Ch] - the question is what type of locks are we talking about here? There are resource locks, critical section locks, spin locks, other wait events...

There is a structure SYSTEM_LOCK_INFORMATION used with ZwGetSystemInformation (class SystemLockInformation), which may or may not be associated with this particular TEB field.
This structure is identical to the one used with RtlQueryProcessDebugInformation
PDI_LOCKS 0x20 // The locks created by the process (DEBUG_MODULE_INFORMATION)

-------------------------------
typedef struct _SYSTEM_LOCK_INFORMATION { // Information Class 12
PVOID Address;
USHORT Type;
USHORT Reserved1;
ULONG ExclusiveOwnerThreadId;
ULONG ActiveCount;
ULONG ContentionCount;
ULONG Reserved2[2];
ULONG NumberOfSharedWaiters;
ULONG NumberOfExclusiveWaiters;
} SYSTEM_LOCK_INFORMATION, *PSYSTEM_LOCK_INFORMATION;

Address
The address of the lock structure.
Type
The type of the lock. This is either RTL_CRITSECT_TYPE (0) or RTL_RESOURCE_TYPE (1).
ActiveCount
The number of threads granted access to the lock. Critical sections count from -1, and
resources count from 0.
ContentionCount
The number of times a thread had to wait for the lock.
--------------------------------------

I have seen a couple of TEB variations which declare this field as a count of owned CriticalSection locks, but it may include any Resource locks as well.

HardErrorsMode [TEB + 40h] - The last TEB field may be an indicator of this (DDK):

-------------
IoSetThreadHardErrorMode enables or disables hard error reporting for the current thread. If hard errors are disabled for a given thread, calls to IoRaiseHardError will not display a message to the user indicating that a serious error has occurred.

IoRaiseHardError causes a popup to be displayed that warns the user that a device I/O error has occurred, which might indicate that a physical device is failing.
------------

The popup of IoRaiseHardError is created via a kernel APC, and APC handler code resides in ntdll.dll. Ntdll may make use of the HardErrorsMode flag in the TEB field somewhere in its code.

Since WinDbg returns 0 for these 3 !teb fields for a normal process, one would have to try to code a situation where they would return a value, identifying their use.

If anyone has any other ideas... cough it up! ;-)

Kayaker
Opcode
08-18-2004, 06:20 AM
Alex Ionescu has made a excellent job in his
"Introduction to NT Internals".

Take a look about the TEB in his PDF:
http://www.relsoft.net/Articles/Process/part1.pdf

Regards,
Opcode
dELTA
08-18-2004, 07:35 AM
Very nice document Opcode, thanks! Strange though that only one of those fields (LastStatusValue) is mentioned, and the offset for that one doesn't seem to be consistent with the value mentioned above either, or am I wrong?
Neitsa
08-18-2004, 08:23 AM
Hello,

I wish to thank you all for your answers.

Here's what M.Russinovich and A Solomon are telling us about TEB struct in the "inside MS windows 2000 - third edition" book, using KD program to display those fields:

kd> !teb
TEB at 7FFDE000
ExceptionList: 0
Stack Base: +4
Stack Limit: +8
SubSystemTib: +0Ch
FiberData: +10h
ArbitraryUser: +14h
Self: +18h
EnvironmentPtr: +1Ch
ClientId: +20h
Real ClientId: +24h
RpcHandle: +28h
Tls Storage: +2Ch
PEB Address: +30h
LastErrorValue: +34h
LastStatusValue: +38h
Count Owned Locks:+3Ch
HardErrorsMode: +40h

In my windows 2k SP4, the +38h and +3Ch fields are always set to 0 with "normal" user-mode programs, and the last fields has always the same value:

7FFDE040 E42238C8

Anyway, with all the informations you've provided, I'll try to see if can reverse ntdll (maybe ntoskernel also) to see where those fields can be used.

Thank you very much !

Regards, Neitsa.
Kayaker
08-18-2004, 10:49 AM
Yeah, the TEB in that (albeit very nice) Relsoft doc is the same as initially proposed elsewhere, such as
http://pulhas.org/xploitsdb/NT/5966.html

typedef struct _NT_TEB
{
NT_TIB Tib; // 00h
PVOID EnvironmentPointer; // 1Ch
CLIENT_ID Cid; // 20h
PVOID ActiveRpcInfo; // 28h
PVOID ThreadLocalStoragePointer; // 2Ch
PPEB Peb; // 30h
ULONG LastErrorValue; // 34h
ULONG CountOfOwnedCriticalSections; // 38h
PVOID CsrClientThread; // 3Ch
PVOID Win32ThreadInfo; // 40h
ULONG Win32ClientInfo[0x1F]; // 44h
PVOID WOW32Reserved; // C0h
...

In The Assembly-Programming-Journal, (2004)
Detecting operating systems without Microsoft Advanced Programming Interface
http://www.Assembly-Journal.com
the fields in question are defined in their own substructure,
which isn't a bad "working" hypothesis:

The last entry of TEB is the pointer to process database.
On NT-based operating systems this value will point to the address
of Process Environment Block.

Additional data following TEB - this additional data has no logical structure
and differs on each non NT-based operating system. On Windows
NT, 2000, XP and 2003 this additional Data is defined as follows:

NT_TEB_ADDON struct
LastErrorValue DWORD ? ; 00h (34h TEB)
LastStatusValue DWORD ? ; 04h (38h TEB)
CountOwnedLocks DWORD ? ; 08h (3Ch TEB)
HardErrorsMode DWORD ? ; 0Ch (40h TEB)
NT_TEB_ADDON ends

I did a bit of exploration last night of ntdll.dll in IDA, trying text searches for the relevant bits of

mov eax, fs:18h ; TEB

then searches for code indicating the fields being used

mov reg, [eax+34h]
+38h]
+3Ch]
+40h]

Lots of hits, but no home runs yet...

Kayaker
disavowed
08-18-2004, 09:29 PM
LastStatusValue is the STATUS_* equivalent of the ERROR_* value returned by GetLastError(). In other words, LastStatusValue == RtlNtStatusToDosError(GetLastError()). Neitsa, this value is "always set to 0" for you becuase you've been checking it when your thread's last error is ERROR_SUCCESS (STATUS_SUCCESS) :)
Neitsa
08-18-2004, 11:17 PM
Hello Disavowed,

Maybe I've misanderstood something but I think you're talking about LastErrorValue.

From Kernel32.dll:

.text:77ED390F ; DWORD GetLastError(void)
.text:77ED390F GetLastError db 'NTDLL.RtlGetLastWin32Error',0

from ntdll:

.text:77F51502 public RtlGetLastWin32Error
.text:77F51502 RtlGetLastWin32Error proc near
.text:77F51502 mov eax, large fs:18h
.text:77F51508 mov eax, [eax+34h]
.text:77F5150B retn
.text:77F5150B RtlGetLastWin32Error endp

doing a little error in a program:

PUSH 0 ;no control ID / error
PUSH DWORD PTR SS:[EBP+8] ; |hWnd
CALL <JMP.&user32.GetDlgItem> ; \GetDlgItem

returned : ERROR_CONTROL_ID_NOT_FOUND (0000058D)

TEB fields :

7FFDE034 0000058D (Last error = ERROR_CONTROL_ID_NOT_FOUND)
7FFDE038 00000000 ; this damn field always at 0
7FFDE03C 00000000
7FFDE040 E4559888

Searching through ntdll with dead-listing, I've found nothing trully interesting bout this +38h field, but sometimes it's hard to find those things without a live approach. (Got to code a little program to see..)

Thank you for your answer Disavowed, all comments , criticisms and helps are always appreciated ! Just tell me if I've made a mistake or if you can find/see something.

Regards, Neitsa.
Kayaker
08-19-2004, 03:01 AM
Hi

I question the use of the label HardErrorsMode at [TEB+40h] by WinDbg for Win2Ksp3. A check of the TEB in the context of a user thread in Softice indicates the value there (Neitsa recorded it as E4559888) is a pointer to the address of an ETHREAD structure. DISPATCHER_HEADER at + 0, LIST_ENTRY beginning at +8, Teb pointer at + 20h...

The "other" TEB definition appears to be more correct
PVOID Win32ThreadInfo; // 40h

On the other point, disavowed is correct. There seems to be a distinction between Win32 and NTSTATUS error codes, clarified by the WinDbg function !error.

0:000> !error 58d
Error code: (Win32) 0x58d (1421) - Control ID not found.

0:000> !error c0000034
Error code: (NTSTATUS) 0xc0000034 (3221225524) - Object Name not found.

I also found this telling output at
http://www.codeproject.com/debug/cdbntsd4.asp

LastErrorValue: 0
LastStatusValue: c0000034
Count Owned Locks: 0
HardErrorMode: 0

Cheers,
Kayaker
Neitsa
08-19-2004, 07:10 AM
Hello,

Nice post Kayaker, now I understand my error about different win errors (I've searched through my headers files and found NTSTATUS.h with all Status error codes). So, please forgive my mistakes in my previous post.

Also, there's a little more question, I dont't understand really where this stucture came from (see Kayaker's link: http://pulhas.org/xploitsdb/NT/5966.html ), and on the other hand why KD / Windbg doesn't diplay the same fields.

The previous post from Kayaker tends to tell us that Windbg is wrong when display some of those fields...

I wish to thank you all for your previous replies.

Regards, Neitsa
disavowed
08-19-2004, 05:24 PM
The previous post from Kayaker tends to tell us that Windbg is wrong when display some of those fields... maybe microsoft is sick of people reversing their os, and decided to throw a red herring into windbg? :)
Elftor
08-20-2004, 01:29 AM
maybe microsoft is sick of people reversing their os, and decided to throw a red herring into windbg? :)

heh heh ...
Neitsa
08-20-2004, 08:05 AM
:D

You got a point Disavowed ! Something rotten in the kingdom of MS...

Regards, Neitsa.
bilbo
08-24-2004, 04:04 AM
The previous post from Kayaker tends to tell us that Windbg is wrong when display some of those fields...
maybe microsoft is sick of people reversing their os, and decided to throw a red herring into windbg? :)

Come on, mates, do you think they are so smart, and what could be a bug is in fact an intelligent trick?

By the way, there is no sickness neither bugs from them. The command
!teb does not give you the offsets, but the correct values.

The correct citation from Solomon-Russinovich book is not the one Neitsa reported (where in the hell did you find it?), but

EXPERIMENT
--------------------------------------------------------------------------------
Examining the TEB
You can dump the TEB structure with the !teb command in the kernel debugger. The output looks like this:

kd> !teb
TEB at 7FFDE000
ExceptionList: 12ffb0
Stack Base: 130000
Stack Limit: 12d000
SubSystemTib: 0
FiberData: 1e00
ArbitraryUser: 0
Self: 7ffde000
EnvironmentPtr: 0
ClientId: 490.458
Real ClientId: 490.458
RpcHandle: 0
Tls Storage: 0
PEB Address: 7ffdf000
LastErrorValue: 0
LastStatusValue: 0
Count Owned Locks:0
HardErrorsMode: 0

Best regards, bilbo
Neitsa
08-24-2004, 09:24 AM
Hello,

Yes you're right Bilbo , but I was thinking that each fileld was DWORD aligned. On the other hand Pegasus posted this little MASM struct:

NT_TEB_ADDON struct
LastErrorValue DWORD ? ; 00h (34h TEB)
LastStatusValue DWORD ? ; 04h (38h TEB)
CountOwnedLocks DWORD ? ; 08h (3Ch TEB)
HardErrorsMode DWORD ? ; 0Ch (40h TEB)
NT_TEB_ADDON ends

but from the kayaker's post we can see this:

ULONG LastErrorValue; // 34h
ULONG CountOfOwnedCriticalSections; // 38h
PVOID CsrClientThread; // 3Ch
PVOID Win32ThreadInfo; // 40h

from this link :http://pulhas.org/xploitsdb/NT/5966.html

I can't find either HardErrorMode or CountOwnedLocks but LastStatusValue is there:

NTSTATUS LastStatusValue; // BF4h

As Kayaker and disavowed said the LastStatusField at offset 38h is correct:

On the other point, disavowed is correct. There seems to be a distinction between Win32 and NTSTATUS error codes, clarified by the WinDbg function !error.

0:000> !error 58d
Error code: (Win32) 0x58d (1421) - Control ID not found.

0:000> !error c0000034
Error code: (NTSTATUS) 0xc0000034 (3221225524) - Object Name not found.

So, Who's right who's wrong ? It's very strange...
disavowed
08-24-2004, 10:35 AM
according to the leak from Mainsoft, i'm right ;)
bilbo
08-24-2004, 11:36 AM
according to the leak from Mainsoft, i'm right ;)
Of course you're right, disavowed, but as usually things go in this strange world of human beings, everyone is right!

To make more light in this matter, let's do some reverse engineering...
Kernel debugger will help us a lot...
In all M$ operating systems the command !teb is contained in an extension debugger DLL. Let's see...

NT4: F88 bytes are read for TEB structure. Disasm from NT4FRE\NTSDEXTS.DLL follows.

push [ebp+var_F54] ; var_F88-var_F54: +34
push offset aLasterrorval_0 ; " LastErrorValue: %u\n"
call dword_4EE92EB4
add esp, 8

push [ebp+var_394] ; var_F88-var_394: +BF4
push offset aLaststatusva_0 ; " LastStatusValue: %x\n"
call dword_4EE92EB4
add esp, 8

push [ebp+var_F50] ; var_F88-var_F50: +38
push offset aCountOwnedLock ; " Count Owned Locks:%u\n"
call dword_4EE92EB4
add esp, 8

push [ebp+var_60] ; var_F88-var_60: +F28
push offset aHarderrorsmode ; " HardErrorsMode: %u\n"
call dword_4EE92EB4

Win2K: FA4 bytes are read for TEB structure. Disasm from W2KFRE\NTSDEXTS.DLL follows.

push [ebp+var_F70] ; var_FA4-var_F70: +34
push offset aLasterrorval_0 ; " LastErrorValue: %u\n"
call dword_4EE95024
pop ecx
pop ecx

push [ebp+var_3B0] ; var_FA4-var_FB0: +BF4
push offset aLaststatusva_0 ; " LastStatusValue: %x\n"
call dword_4EE95024
pop ecx
pop ecx

push [ebp+var_F6C] ; var_FA4-var_F6C: +38
push offset aCountOwnedLock ; " Count Owned Locks:%u\n"
call dword_4EE95024
pop ecx
pop ecx

push [ebp+var_7C] ; var_FA4-var_7C: +F28
push offset aHarderrorsmode ; " HardErrorsMode: %u\n"
call dword_4EE95024

WinXP: since I'm playing on an XP box, there is no need to disasm; command dt may be used!

kd> dt _TEB
+0x000 NtTib : _NT_TIB
+0x01c EnvironmentPointer : Ptr32 Void
+0x020 ClientId : _CLIENT_ID
+0x028 ActiveRpcHandle : Ptr32 Void
+0x02c ThreadLocalStoragePointer : Ptr32 Void
+0x030 ProcessEnvironmentBlock : Ptr32 _PEB
+0x034 LastErrorValue : Uint4B
+0x038 CountOfOwnedCriticalSections : Uint4B
+0x03c CsrClientThread : Ptr32 Void
+0x040 Win32ThreadInfo : Ptr32 Void
+0x044 User32Reserved : [26] Uint4B
+0x0ac UserReserved : [5] Uint4B
+0x0c0 WOW32Reserved : Ptr32 Void
+0x0c4 CurrentLocale : Uint4B
+0x0c8 FpSoftwareStatusRegister : Uint4B
+0x0cc SystemReserved1 : [54] Ptr32 Void
+0x1a4 ExceptionCode : Int4B
+0x1a8 ActivationContextStack : _ACTIVATION_CONTEXT_STACK
+0x1bc SpareBytes1 : [24] UChar
+0x1d4 GdiTebBatch : _GDI_TEB_BATCH
+0x6b4 RealClientId : _CLIENT_ID
+0x6bc GdiCachedProcessHandle : Ptr32 Void
+0x6c0 GdiClientPID : Uint4B
+0x6c4 GdiClientTID : Uint4B
+0x6c8 GdiThreadLocalInfo : Ptr32 Void
+0x6cc Win32ClientInfo : [62] Uint4B
+0x7c4 glDispatchTable : [233] Ptr32 Void
+0xb68 glReserved1 : [29] Uint4B
+0xbdc glReserved2 : Ptr32 Void
+0xbe0 glSectionInfo : Ptr32 Void
+0xbe4 glSection : Ptr32 Void
+0xbe8 glTable : Ptr32 Void
+0xbec glCurrentRC : Ptr32 Void
+0xbf0 glContext : Ptr32 Void
+0xbf4 LastStatusValue : Uint4B
+0xbf8 StaticUnicodeString : _UNICODE_STRING
+0xc00 StaticUnicodeBuffer : [261] Uint2B
+0xe0c DeallocationStack : Ptr32 Void
+0xe10 TlsSlots : [64] Ptr32 Void
+0xf10 TlsLinks : _LIST_ENTRY
+0xf18 Vdm : Ptr32 Void
+0xf1c ReservedForNtRpc : Ptr32 Void
+0xf20 DbgSsReserved : [2] Ptr32 Void
+0xf28 HardErrorsAreDisabled : Uint4B
+0xf2c Instrumentation : [16] Ptr32 Void
+0xf6c WinSockData : Ptr32 Void
+0xf70 GdiBatchCount : Uint4B
+0xf74 InDbgPrint : UChar
+0xf75 FreeStackOnTermination : UChar
+0xf76 HasFiberData : UChar
+0xf77 IdealProcessor : UChar
+0xf78 Spare3 : Uint4B
+0xf7c ReservedForPerf : Ptr32 Void
+0xf80 ReservedForOle : Ptr32 Void
+0xf84 WaitingOnLoaderLock : Uint4B
+0xf88 Wx86Thread : _Wx86ThreadState
+0xf94 TlsExpansionSlots : Ptr32 Ptr32 Void
+0xf98 ImpersonationLocale : Uint4B
+0xf9c IsImpersonating : Uint4B
+0xfa0 NlsCache : Ptr32 Void
+0xfa4 pShimData : Ptr32 Void
+0xfa8 HeapVirtualAffinity : Uint4B
+0xfac CurrentTransactionHandle : Ptr32 Void
+0xfb0 ActiveFrame : Ptr32 _TEB_ACTIVE_FRAME

So we can see that the TEB structure is grown from F88 to FA4 to FB4 with the evolution (involution?) of M$ systems, but the offsets of the four fields are always the same

LastErrorValue: +34h
LastStatusValue: +BF4h
Count Owned Locks:+38h
HardErrorsMode: +F28h

Well, what about the structure NT_TEB_ADDON described by Thomas Kruse (Pegasus?) in Assembling Programming Journal Vol.1 No.1? He seems the only guy to be wrong! He correctly located only the first field, LastErrorValue, at bias +34, but the structure NT_TEB_ADDON is not existing, and the TEB is a lot bigger than 44h bytes, as we saw!

Regards, bilbo
Neitsa
08-24-2004, 11:53 AM
:yay:

Thanks a lot Bilbo (from the Shire ?), that's definitly solve some trouble, at least for me.

Now...hmmm I got to search what's the meaning of all those fields ;) maybe something interesting on there...

I wish to thank you all for your replies !
JMI
08-24-2004, 03:51 PM
That wandering Hobbit has picked up some really useful informations in his wanderings. Glad he made it out of the cave and back to Middle Earth to share his findings with us. ;)

Regards,
Kayaker
08-24-2004, 05:19 PM
... and the RingBearer shall wield clarity of thought.. ;)

I suppose the lack of a structure definition should have been a clue? :thinking:

0: kd> .load kdex2x86
0: kd> !strct teb
Structure is not in database.

..slaps forehead...

Regards,
Kayaker
Woodmann
08-24-2004, 07:05 PM
Hi,

The person of bilbo seems extremely intelligent.
He knows much about TEB that seems to be hidden
from some of us :eek:
He as also contributed some "deep" info's from the
nether regions of coding. ;)

I am very grateful he is among us :D

Woodmann
bilbo
08-25-2004, 02:40 AM
Now...hmmm I got to search what's the meaning of all those fields ;) maybe something interesting on there...
Just to quote... myself (or, better, Tolkien): All who wander are not lost.
Something very interesting, by the way...
The person of bilbo seems extremely intelligent
I do not understand well what you are saying, you know, human language is so complicated, sometime they say black and they are meaning white... Anyway, I'm just a seeker...

Regards, bilbo
JMI
08-25-2004, 11:17 AM
In any case we are glad to have you among us and sharing your knowledge. :yay:

Regards,
Woodmann
08-25-2004, 04:10 PM
Hi,

quote:
Originally Posted by Woodmann
The person of bilbo seems extremely intelligent

I do not understand well what you are saying, you know, human language is so complicated, sometime they say black and they are meaning white... Anyway, I'm just a seeker..

I thank you for sharing your knowledge. :D

Woodmann


help linux shared linked library
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > help linux shared linked library
PDA

View Full Version : help linux shared linked library

celestezhu
08-17-2004, 09:09 PM
hi all
i have a damn question.

i have a linux shared linked library(*.so) now.
i must crack it.
i want to know the information of interface and interface's parameters in this library.

i use objdump -dx to get the interface information.
but, how can i get the information of interface's parameters.

thks.
Kayaker
08-18-2004, 01:37 AM
There's no need to crosspost on different forums. The way to attract specific attention is to create a descriptive title, not multiple postings. I changed your title to include the word 'linux', else some linux-knowledgable people may ignore the posting entirely.

Kayaker
dELTA
08-18-2004, 07:18 AM
If they are anything like Windows shared libraries (DLLs), you cannot do this automatically in a good and 100% secure way...
SiNTAX
08-18-2004, 10:25 AM
On C++ libs you can get some more information by demangling the functions. Use the -C option on objdump to demangle the names.
Alternatively you can use the c++filt command to demangle a name.

e.g.
libstdc++
has 0008b870 w DF .text 0000002c GLIBCXX_3.4 _ZNSt14codecvt_bynameIwc11__mbstate_tED2Ev

If you use objdump -CT or pipe the line above through c++filt you get:

std::codecvt_byname<wchar_t, char, __mbstate_t>::~codecvt_byname [not-in-charge]()

Which is a bit more readable :)
celestezhu
08-18-2004, 10:28 PM
thank you all.
i have made a little progress.

i have got some call tree in the library.
but,
how can i get the parameter of interface in library, it's a c library.
i only can get interface's name.
SiNTAX
08-19-2004, 01:55 AM
AFAIK you can't. You will have to disassemble the library to know which params are passed to it.

Checkout ltrace & strace
celestezhu
08-20-2004, 01:13 AM
isn't there a existing tool can do such thing?
god bless me.
the question is i am not very familiar with Assembly.

is there any chance you could possilbly recomment some guide for me?

thank you.


DOS programa with a disk Protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DOS programa with a disk Protection
PDA

View Full Version : DOS programa with a disk Protection

winroot
08-17-2004, 09:40 PM
Hi,
I'm trying to learn with a DOS programa that has a disk Protection,
but i cann't konw how does is work?

how does it protect disk to copy?
seg001:0100 assume ss:dseg, ds:nothing
seg001:0100
seg001:0100 ; 圹圹圹圹圹圹圹?S U B R O U T I N E 圹圹圹圹圹圹圹圹圹圹圹圹圹圹圹圹圹圹圹?
seg001:0100
seg001:0100
seg001:0100 public start
seg001:0100 start proc far
seg001:0100 mov ax, cs
seg001:0102 mov ds, ax
seg001:0104 assume ds:seg001
seg001:0104 mov word_E028, es
seg001:0108 mov es, ax
seg001:010A assume es:seg001
seg001:010A mov word_E02A, ss
seg001:010E mov word_E02C, sp
seg001:0112 mov sp, cs
seg001:0114 mov ss, sp
seg001:0116 assume ss:nothing
seg001:0116 mov sp, 242h
seg001:0119 mov ax, word_E028
seg001:011C add word_E030, ax
seg001:0120 add word_E030, 10h
seg001:0125 mov ax, 201h
seg001:0128 lea bx, ds:244h
seg001:012C mov cx, 5
seg001:012F mov dx, 80h ; '€'
seg001:0132 int 13h ; DISK - READ SECTORS INTO MEMORY
seg001:0132 ; AL = number of sectors to read, CH = track, CL = sector
seg001:0132 ; DH = head, DL = drive, ES:BX -> buffer to fill
seg001:0132 ; Return: CF set on error, AH = status, AL = number of sectors read
seg001:0134 jb loc_E017
seg001:0136 cmp word ptr [bx+2], 0AA55h
seg001:013B jnz loc_E017
seg001:013D lea di, ds:1A2h
seg001:0141 mov si, bx
seg001:0143 add si, 6
seg001:0146 mov cx, 4
seg001:0149 rep movsb
seg001:014B cmp byte_E032, 0
seg001:0150 jz loc_DFE3
seg001:0152 mov ax, word_E022
seg001:0155 add word_E02E, ax
seg001:0159 mov ax, word_E024
seg001:015C add word_E030, ax
seg001:0160 jmp short loc_DFFE
seg001:0160 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
seg001:0162 db 90h
seg001:0163 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
seg001:0163
seg001:0163 loc_DFE3: ; CODE XREF: start+50j
seg001:0163 mov ax, word_E028
seg001:0166 mov es, ax
seg001:0168 assume es:nothing
seg001:0168 lea si, ds:1E2h
seg001:016C mov di, 100h
seg001:016F mov cx, 10h
seg001:0172
seg001:0172 loc_DFF2: ; CODE XREF: start+7Cj
seg001:0172 lodsw
seg001:0173 xor ax, word_E022
seg001:0177 xor ax, word_E024
seg001:017B stosw
seg001:017C loop loc_DFF2
seg001:017E
seg001:017E loc_DFFE: ; CODE XREF: start+60j
seg001:017E mov sp, word_E02C
seg001:0182 push word_E030
seg001:0186 push word_E02E
seg001:018A mov dx, word_E028
seg001:018E mov es, dx
seg001:0190 mov ds, dx
seg001:0192 assume ds:dseg
seg001:0192 xor si, si
seg001:0194 xor di, di
seg001:0196 retf
seg001:0197 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
seg001:0197
seg001:0197 loc_E017: ; CODE XREF: start+34j
seg001:0197 ; start+3Bj
seg001:0197 mov dx, 1B3h
seg001:019A mov ah, 9
seg001:019C int 21h ; DOS - PRINT STRING
seg001:019C ; DS:DX -> string terminated by "$"
seg001:019E mov ah, 4Ch
seg001:01A0 int 21h ; DOS - 2+ - QUIT WITH EXIT CODE (EXIT)
seg001:01A0 start endp ; AL = exit code
seg001:01A0
seg001:01A0 ; 哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪哪?
seg001:01A2 word_E022 dw 0 ; DATA XREF: start+52r
seg001:01A2 ; start+73r
seg001:01A4 word_E024 dw 0 ; DATA XREF: start+59r
seg001:01A4 ; start+77r
seg001:01A6 align 4
seg001:01A8 word_E028 dw 0 ; DATA XREF: start+4w
seg001:01A8 ; start+19r ...
seg001:01AA word_E02A dw 0 ; DATA XREF: start+Aw
seg001:01AC word_E02C dw 0 ; DATA XREF: start+Ew
seg001:01AC ; start+7Er
seg001:01AE word_E02E dw 0FDFFh ; DATA XREF: start+55w
seg001:01AE ; start+86r
seg001:01B0 word_E030 dw 0DDF9h ; DATA XREF: start+1Cw
seg001:01B0 ; start+20w ...
seg001:01B2 byte_E032 db 1 ; DATA XREF: start+4Br
seg001:01B3 aWarningFileWas db 'Warning: File was damaged by COMPUTER VIRUS ! $',0
seg001:01E3 db 461h dup(0)
seg001:01E3 seg001 ends
seg001:01E3
seg001:01E3
seg001:01E3 end start
dELTA
08-18-2004, 07:15 AM
First of all, this thread belongs in the newbie forum, and you should really read the FAQ regarding the posting guidelines...

Anyway, it seems to read a direct disk sector from the floppy, probably marked as bad on the original disk, and check if a certain byte pattern is present in that sector.
winroot
08-18-2004, 11:03 AM
thx your replay
It read a direct disk sector from the disk c:\ and check it
but what does it read?
naides
08-18-2004, 02:22 PM
thx your replay
It read a direct disk sector from the disk c:\ and check it
but what does it read?

It reads One sector at C hard drive, Head 00, track 01, Sector 01, into a buffer pointed by bx, ds:0244.

If it does not succesfully read the sector, or the bytes at position 02 ([bx+2] of the sector are not equal AA55 it claims a virus has striken (jmp loc_E017), otherwise it does more stuff. . .

You can manually look up the contents of that sector using and advanced hexeditor that can read sectors,

and you can learn 16 bit assembly, even an old and dumb 8086 like me can do it.


Fusion vs. Thinstall
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Fusion vs. Thinstall
PDA

View Full Version : Fusion vs. Thinstall

adltlef
08-18-2004, 02:56 PM
Hi!

I search in the forum for fusion. I found about 5 threads. And 6 about thinstall. I read most of this.
But, which program is better?

Thanks


Archives
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Archives
PDA

View Full Version : Archives

ReVeR
08-18-2004, 11:51 PM
Hey.
i wanted to make a prog that will allow me to unpack a certain format (ex. .rar etc...)....how can i do that? i wanted not just and algo how to do it, but more of how u got that algo.....
thx
ughugh
08-19-2004, 07:12 AM
For rar there's..:

http://www.rarlab.com/rar/unrarsrc-3.4.2.tar.gz

..but the general approach to figuring out an unknown (as in no hits on google) algorithm is reversing the program that does the unpacking. Breaking on & tracing from file open/read/etc calls usually gives a starting point. Also, you might want to read this thread:

http://www.woodmann.net/forum/showthread.php?t=6012
ReVeR
08-19-2004, 03:07 PM
well, are there any examploe of something like that being done?
maybe for a rar but with the aproach of unknown archive?
maybe someon can do a qucik explanation on how to do that(basic steps)...i mean something like rar shoudl not be that hard for ppl with exp in this area.....

so far i got this:
i but a bpx on CreateFileA(if that is waht is used for file reading), then i see where it is called and start tracing to see how it is done and then recoding it in w/e lanuage?
dELTA
08-19-2004, 03:30 PM
Read the thread that ughugh suggests above. Also, noone will give you step-by-step instructions, you need to put in some effort and learn things yourself too. You will need to have a much deeper understanding about related concepts to be able to perform something like this I'm afraid.
Js
08-19-2004, 03:41 PM
check out what information is already available on the subject?
http://www.wotsit.org/download.asp?f=rar202
then depending on what language you program in there may be source available to at least give you a start.
ReVeR
08-19-2004, 04:58 PM
i am not asking somone to give me step by step., but an example is nice, since i never coded a archiver/unarchvier.....
anyways, gonna go read those links


MD4/MD5/SHA-0 Dead
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > MD4/MD5/SHA-0 Dead
PDA

View Full Version : MD4/MD5/SHA-0 Dead

halvar
08-19-2004, 01:50 AM
Hey all,

at the crypto rump session, a few chinese published collision-breaks
for MD4/MD5/HAVAL. This might be interesting for some of us.
They didn't explain their methodology, so we'll have to figure it out
ourselves. I'll read through it and try to understand what's going on.
(don't expect another post until september ;)
Anyone else tackling it ?

CHeers,
Halvar
www.sabre-security.com
JMI
08-19-2004, 02:05 AM
Here is another discussion about this subject:

http://www.exetools.com/forum/showthread.php?t=5032

Regards,
dELTA
08-19-2004, 08:41 AM
Hi Halvar, thanks for the info (and nice to see you around here btw, I hope you stick around :)).

Here are some more links regarding this matter:

SHA-1 Break Rumored
http://www.freedom-to-tinker.com/archives/000661.html

The effect of a break in SHA-1
Almost a collision in MD5
http://www.rtfm.com/movabletype/archives/2004_08.html

Technical report by the Chinese guys themselves:
http://eprint.iacr.org/2004/199.pdf

(the latter two links were also mentioned in the thread JMI referred to)

And some more info from Eric Rescorla:

As you may or may not have heard, this year's CRYPTO conference
has been very interesting:

* Joux has found a single collision in SHA-0--an algorithm that nobody
uses but that is very similar to SHA-1. However, SHA-0 was changed to
fix a flaw (later found by Joux), thus becoming SHA-1 so we can hope
that this attack can't be extended to SHA-1. The attack was fairly
expensive, requiring about 2^51 operations the brute force attack
would take about 2^80).

* Biham and Chen can find collisions in a reduced round version of SHA-1
(40 rounds). The full SHA-1 is 80 rounds. It's hard to know whether
this can be extended to full SHA-1 or not. NSA (who designed SHA-1)
seems to be generally pretty good at tuning their algorithms so that
they're just complicated enough to be secure.

* Weng, Fang, Lai, and Yu have what appears to be a general method for
finding collisions in MD4, MD5, HAVAL-128, and RIPEMD. They
haven't published any details.

What does this mean for us? I'll be writing up full details hopefully
soon, but here's a short overview...

WHAT'S BEEN SHOWN?
An attacker can generate two messages M and M' such that Hash(M) = Hash(M').
Note that he cannot (currently) generate a message M such that Hash(M)
is a given hash value, nor can he generate a message M' such that it hashes
the same as a fixed message M. Currently this is possible for MD5
but we have to consider the possibility that it will be eventually
possible for SHA-1.

USES OF HASH FUNCTIONS
We use hash algorithms in a bunch of different contexts. At minimum:

1. Digital signatures (you sign the hash of a message).
(a) On messages (e.g. S/MIME).
(b) On certificates.
(c) In authentication primitives (e.g., SSH)
2. As MAC functions (e.g. HMAC)
3. As authentication functions (e.g. CRAM-MD5)
4. As key generation functions (e.g. SSL or IPsec PRF)

THE POTENTIAL ATTACKS
The only situation in which the current attacks definitely apply is
(1). The general problem is illustrated by the following scenario.
Alice and Bob are negotiating a contract. Alice generates two
messages:

M = "Alice will pay Bob $500/hr"
M' = "Alice will pay Bob $50/hr" [0]

Where H(M) = H(M').

She gets Bob to sign M (and maybe signs it herself). Then when it
comes time to pay Bob, she whips out M' and says "I only owe
$50/hr", which Bob has also signed (remember that you sign the
hash of the message).

So, this attack threatens non-repudiation or any kind of third
party verifiability. Another, slightly more esoteric, case is
certificates. Remember that a certificate is a signed message
from the CA containing the identity of the user. So, Alice
generates two certificate requests:

R = "Alice.com, Key=X"
R' = "Bob.com, Key=Y"

Such that H(R) = H(R') (I'm simplifying here).

When the CA signs R, it's also signing R', so Alice can present
her new "Bob" certificate and pose as Bob. It's not clear that
this attack can work in practice because Alice doesn't control
the entire cert: the CA specifies the serial number. However,
it's getting risky to sign certs with MD5.

WHAT'S SAFE?
First, anything that's already been signed is definitely safe. If you
stop using MD5 today, nothing you signed already puts you at risk.

There is probably no risk to two party SSH/SSL-style authentication
handshakes.

It's believed that HMAC is secure against this attack (according to Hugo
Krawczyk, the designer) so the modern MAC functions should all be
secure.

I worry a bit about CRAM-MD5 and HTTP Digest. They're not as well
designed as HMAC and you might potentially be able to compromise them to
mount some kind of active cut-and-paste attack, though I don't have one
in my pocket.

The key generation PRFs should be safe.

-Ekr

[0] In practice, the messages might not be this similar, but there
turn out to be lots of opportunities to make subtle changes in any
text message.
mike
08-20-2004, 03:02 AM
When the details come out I'll have a look and explain how it works.
halvar
08-20-2004, 06:53 AM
Historically speaking, the details might not come out (see Dobbertin's mid-
90's MD5 attack :-)

I looked a bit at the MD4 collision (mainly coz I know MD4 better than MD5)
and a certain similarity to Dobbertin's attack is visible. I only had about one
hour, so here is what I have so far (apologies if it is sparse, figuring out what
the attack does just from the two hashes is hard)
The attack consists of changing block X1, X2 and X12 of the hashed
data.

The choice of block X12 is not surprising:
It is used in step 12, step 19, and step 35.
This means that the distance over which a change in X12 can propagate
is 35-12 = 23 steps, which is minimal amongst all the blocks. Further-
more the distance between step 12 and step 19 is minimal amongst all
blocks used in the first two rounds.
Dobbertin's attack focused on changing only X12 for these reasons.

What is immediately evident is that two out of three changed blocks
are always used in adjancent steps:
Block X1 Block X2 Block X12

Round 1: 1 2 12
Round 2: 20 24 19
Round 3: 40 36 35

This means we have the following pattern:
X1, X2 get used
(...)
X12 gets used
(...)
X12, X1 gets used
(...)
X2 gets used
(...)
X12, X2 gets used
(...)
X1 gets used

After the last use of X1, all introduced delta's have cancelled out.
The occurence of "pairs" and then a single modified block in each
round looks interesting.

Cheers,
Halvar


How can i do?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How can i do?
PDA

View Full Version : How can i do?

Brainrain
08-19-2004, 07:29 AM
Hi all!I've a simple question i think.Maybe somebody could help me.So the question is:How can i convert a name to bignum in delphi with FGInt unit?
dELTA
08-19-2004, 09:24 AM
Exactly what do you mean with "convert a name to bignum"? I can sorta guess what you mean, and in that case it is most likely something of a misunderstanding, but go ahead and prove me wrong. ;)
Brainrain
08-19-2004, 02:25 PM
dELTA! Like <the program I want to crack> does.
dELTA
08-19-2004, 03:00 PM
Ok, so I guess that once again, my mind reading powers were right... :)

What you want to know is most likely how to generate a correct serial for a certain name, for the software you mention.

First of all, you cannot just "convert" a name to a number. There are infinitely many ways to generate a serial from a name, and most of them do not include bignum-libraries for that matter. You must disassemble/debug your target program, and analyze the algorithm they use. If you're lucky and it's a bad design, you will also be able to fish a serial directly out of the memory of the program, without actually knowing anything about the algo.

I suggest you start reading tutorials about serial protections, serial fishing, keygenning and such, to get a better understanding about this topic.

I also strongly suggest that you read the FAQ for this board before posting again, so you don't happen to make a crack request and I'll have to delete your thread. Also, you shouldn't post the name of your target, so I edited it out in your post above.
Brainrain
08-19-2004, 05:00 PM
That wasnt a crack request... And if you can fish a serial from a 255 bit RSA then you are the king. :DDD
dELTA
08-19-2004, 06:05 PM
Well, if you could "convert a name" to a valid RSA key you wouldn't be half bad yourself I guess... :thinking:
JMI
08-19-2004, 06:07 PM
And if you would read the FAQ listed in the BIG RED LETTERS you might actually have a better idea about how you are supposed to ask a question and what you are supposed to do before you ask.

So far, mostly what you've done is violate those rules.

Regards,


Nice site for driver development
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Nice site for driver development
PDA

View Full Version : Nice site for driver development

dELTA
08-19-2004, 09:27 AM
Here's a quite nice little site for people interested in getting started with Windows driver development:

Lord of the Ring0:
http://silverstr.ufies.org/lotr0/


RSA - More than 2 primes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > RSA - More than 2 primes
PDA

View Full Version : RSA - More than 2 primes

jandis
08-20-2004, 12:51 AM
I searched the forums and google but nothing seemed to turn up, except that yes there is a possibility of there being 3-4 primes. Here is the problem:

x = x^d mod n

Known
-----
N = 968b80866737a48f5d6798ae96f16f93f19f, base 16
D = 1024

When trying to use N to find p&q I get 4 prime factors:
3, 1D, 5AEE72489D, 4DF055177D4679B

So the problem is p & q are needed in order to find e in the equation e = d^(-1) mod ((p-1)(q-1)). Any help would be appreciated and please excuse my crypto ignorance.
mike
08-20-2004, 02:53 AM
What you need to do is compute d^-1 mod (p-1)(q-1)(r-1)(s-1). Which is impossible, since p-1=3-1=2, and 1024 doesn't have an inverse modulo an even number. So your numbers can't be right.


"General extraction error", the hidden face of armadillo?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > "General extraction error", the hidden face of armadillo?
PDA

View Full Version : "General extraction error", the hidden face of armadillo?

Elftor
08-20-2004, 02:59 AM
Hooray guys!

When i try to launch a freeware protected by armadillo (yes! a freeware protected! haha... :boo: ) i can get in my face this error:

hxxp://membres.lycos.fr/verrnum/error.png

So when i try to made this screenshot with HyperSnap 5.xx (Shareware version) fresh installed i get once again this error when i attempt to launch it (so this screenshot was made with another program like SolidCapture, Shareware version).

Well! I'm very happy! The sun lighting, the sky is blue...

Now i launch PeiD and i see: Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks

Ok! Now i want know why i have this stupid bastard error messagebox ?

I don't have any debugger except ollydbg. Do you think of Armadillo detect my ollydbg and refuse to execute any program protected by it ?

If this then i think i'll kill the author of Armadillo... heh :devil:

PS: And sorry for my english!

Elftor.
Ricardo Narvaja
08-20-2004, 10:39 AM
armadillo detect ollydbg only if you are debugging with ollydbg or ollydbg is open (debugging or not), but renaming the exe OLLYDBG.exe for other name and letting one copy of ollydbg.exe in the same folder for mantain the functionality of the plugins. Your use the renamed OLLYDBG and there are no problem.
Armadillo detect softice installed if you have softice installed this is detected.
You have XP with SP2 installed? Maybe compatibility problems with copymem2 and the new sp2, in the new armadillos chad anounce copymem2 will be not continue more, maybe not work in SP2 i think.

Ricardo Narvaja
Elftor
08-20-2004, 10:48 AM
Thx for your reply Ricardo ;)

Well... i have 2000 SP4, no SoftIce but just olly.
The prob appears when i launch theses programs normally (double click on exe or start --> program --> application X

I have already try your tips by renamming ollydgb.exe to another name but no success. I have too deleted the JIT (Just In Time) in the registry but no success...

Elftor.
Ricardo Narvaja
08-20-2004, 10:52 AM
is very extrange but i have problems running old armadillo with copymem2 in older versions, for slow execution, with machines with so much programs running and old processors.
If there is not the case maybe detect other thing SMARTCHECK, REGMON, FILEMON, or other utilities of cracking.

Ricardo Narvaja
Elftor
08-21-2004, 12:25 AM
Maybe ya.
I'm sure there are somes guys in this forum who have attempt an approach of armadillo and they can say more about this subject...

What armadillo detect exactly? ... specific interruption? specific Program? other?
JMI
08-21-2004, 11:37 AM
Why not do a little of your own homework and actually try searching here and on the net for information on how or what ARMA may attempt to detect the presence of debuggers? Using "armadillo detect" (without the quotes) I got a number of threads talking about ARMA detecting debuggersand/or other programs used to examine its "hidden" tricks. Yes, I know much of the talk is about SICE but there is information in those threads which might be useful. Another search you could try is "olly detect" or "anti olly" in a search on the net. (again without quotes.)

The point here, as made in another recent post in the Newbie Forum, is that you should not just ask questions whenever you do not know the answer to something. You should FIRST attempt to FIND the answer YOURSELF and only AFTER that is unsuccessful, should you ask.

Regards,
Elftor
08-21-2004, 03:16 PM
That's very simple... I have already made search before posting here and when you search on the net this error you obtain "General extraction error Location IMP1" or another error and in another language than english, i'm sorry guy but don't speak X languages, i have already difficults to speak in english.

And where you find a similar problem:
1°) there are no reply
2°) there are no solution already found by guys who have replyed.
3°) there are the lead developer of armadillo who reply to guy and say to email to support... -_- (in the current situation, support is made for client who has buy armadillo and not for a simple guy who can't run any shareware protected by armadillo...)

In more theses search on the net, i have already speak with somes guys on somes channels on irc and anybody can explain this error that's why i post in this forum and specialy here, not on newbie section, with a hope to see somes guys who have the same problem and/or can explain why this error with an experience in asm.

So now, i can ASK!

Elftor.
JMI
08-21-2004, 03:38 PM
So that would mean that you noticed that someone has already reported "general extraction error" issues to Silicone Realms (although at a slightly different location) and THEY don't have an explanation for the issue yet. :thinking:

Regards,
esther
08-22-2004, 12:58 AM
Well it doesn't tells you a debugger detected,might be the service pack or os problem
quazar
08-25-2004, 12:54 PM
did u ever install DriverStudio....if yes then that may be problem, since sometimes it doesn't get un-installed correctly...and arma detects some left around reg keys....
Elftor
08-25-2004, 01:12 PM
Hello quazar,

Ya! i have un-installed it a long time ago now and for this problem i have deleted all reference than "numega" "softice" "driverstudio" in the registry and reboot my pc but no result and same problem.
quazar
08-26-2004, 12:44 AM
sometimes traces of DriverStudio still remain...search the registry for "SIWVID" and "NTICE" and delete those keys in which they reside....also sometimes u may not be able to delete these keys since, thay may be read-only but u can set write privilege on the key then delete them.....for that u can use the "regedt32" instead of "regedit"
MarQueze
08-26-2004, 07:56 AM
did u ever install DriverStudio....if yes then that may be problem, since sometimes it doesn't get un-installed correctly...and arma detects some left around reg keys....

Hmmm....
I've been able to debug Armadillo 3.x executables with driverstudio 3.1 without any problems. I'm using IceExt to hide Softice and untill now that has worked fine.

Only had to manually patch the UnhandledExceptionFilter API since the signature of this function differs for each Service Pack I guess (Im using Win2K SP4).

Cheers,

MarQueze
Elftor
08-26-2004, 03:08 PM
quazar: after your reply, i have deleted all reference to "SIWVID" and "NTICE" and also "IceExt" in registry but no result.
cRk
08-27-2004, 07:37 PM
this is really an extrange bahaviour and case.. same happends to me with Jcreator Pro evenwith DriverStudio 3.1 Not loaded on WinXP .. i tried renaming the above mentioned string names, registry entries, program files names ... and nothing hapends ..still the app. tells me a debugger is running

then i tried loading DriverStudio and running Iceext. (Latest version) and sames happens.. obviously... but now really the debugger is running what the hell is armadillo reading??

dosen't happend with all armadilled programs of course .. but this most be some advanced new technique involved on this against Softice/driversuite

if run Jcreator Pro on Win9x with softice installed but not running i don't get this warning debugger detection message .. just in WinXP Pro + SP1a

Regards
nikolatesla20
08-27-2004, 08:29 PM
An armadillo General Extraction Error means that arma has detected a debugger of some sort. Remember, there are numerous ways to detect SoftICE.

-nt20
Elftor
08-27-2004, 09:10 PM
To all guys who have replyed: Thank you very much!

I have finally successfully down the Anti-Debug armadillo protection.
This night i have re-launched my shareware to see the error box before doing a search in registry and at my great surprise the software was launched successfully !!! \o/

So... the last modifications i have made are those i've posted in my previous reply. Between this reply and now i don't have make any change.

That's why this is strange why my application was not executed successfully after last reboot...

So... Thanks a lot to you guys ;)
and thank to Neitsa!

Elftor.

PS: and for JMI, u see now why i can ASK! HAHAHaaaa...
JMI
08-28-2004, 12:35 PM
Well Elftor, if your post illustrates anything, it illustrates the value of general searching for information before one asks a question. What it illustrates specifically is that you did not do sufficient reading on the issue of general debugger detection, to include searching for what are rather obvious methods of detecting debuggers, used by many programs.

In this case the searching of the registry for various entries, and specifically "SIWVID" and "NTICE" and also "IceExt" seem to be the cause of your error message and the finding and changing (or removing) of these entries is among the "general knowledge" available on the net for a long time. You report that after completing that search and removing those entries, your program no longer "detects a debugger" and no longer gives you an error.

So, again, what you question does illustrate, is that searching for "anti-debugger" and/or "debugger detection" methods, both here and on the net, would have allowed you to solve you problem on your own. :yay:

Regards,


Unpacking Vbox
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking Vbox
PDA

View Full Version : Unpacking Vbox

Flako
08-20-2004, 11:05 AM
I read the britedust tutorial for unpacking vbox of Derive and a I never could get to the XOR EDX, EDX line.

How many time I have to press F8 to get there?.

Regards

:D
Peres
08-20-2004, 02:33 PM
I am quite sure no one can tell you how many times you have to press the F8 key on your keyboard.
Thank God there are no magic gestures. If cracking was that deterministic we would have to find another job.

Peres
Hopcode
08-25-2004, 10:58 AM
VBOX isn't hard at all.

if you are trying to find the entry point, try to set a bpx on an API used by compilers at entry point, such as GetVersion, GetModuleHandleA etc

for the IAT, i think Imprec can rebuild most of them without problems.

Now, VBOX is named Privilege and its a pile of crap.

There are only 2 redirected api and its always the same api functions it seems.
Takes 5 minutes to unwrap Privilege (Aladdin) "protection".

Hopcode
nikolatesla20
08-25-2004, 12:02 PM
hxxp://www.reteam.org has a couple of good tuts on VBOX

-niko20
MaRKuS-DJM
08-25-2004, 02:53 PM
it's also very easy to write your own ASM VBox import resolver because every API is lead to the same address.
naides
08-25-2004, 03:01 PM
http://www.exetools.com/forum/showthread.php?t=4160
JMI
08-25-2004, 05:25 PM
I have also posted in the Advanced Forum here, a reference to an Imprec plugin by LaptoniC posted on exetools to help resolve APIs for this protection system.

You will find his post at:

http://www.exetools.com/forum/showthread.php?t=5117

and the cross-reference and the attached plug-in are here at:

http://www.woodmann.net/forum/showthread.php?t=6289

Regards,
%UNDEFINED%
08-28-2004, 12:13 PM
The easiest way to find the OEP is to use OllyDbg.

Open the file, run it until the Try/Buy Dialog comes up.

BP FreeLibrary

Press Try, When Olly Breaks, Open Memory Window, Select the Code (First) section of the File, Set Memory Break On Access.

BC FreeLibrary

And Run

Boom your at the OEP, now if you can just fix the IAT


softice not popping
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > softice not popping
PDA

View Full Version : softice not popping

SpiderVenom
08-20-2004, 10:58 PM
I've just recently installed SoftICE 4.3.1 on my XP SP2 machine, and although it runs fine, it refuses to break. I'm using the following commands to test:

BPX GetWindowTextW
BPX GetDlgItemTextW
BPX GetLocalTime

In the case of GetLocalTime, I've written a small Delphi app that calls getlocaltime on the click of a button. SoftICE will just not pop. For interest, I directed softice to handle all INT3's, then embedded an INT3 command in my delphi app, and it does break. It just won't stop on breakpoints, period. I'm pretty sure I have the correct exports loaded, and I do have the latest OSI data files. Does anyone have any idea why this isn't working? Thanks.
Aimless
08-21-2004, 01:09 AM
1) Try searching on this board for "softice breakpoints" and you'll get the answer why your breakpoints do not stick, while the int3 does.

2) A small hint...you need to be in the correct context to set the breakpoint to work. Check the SICE manual to see _how_ to be in the correct context.

Have Phun
SpiderVenom
08-21-2004, 01:42 AM
Thank you! You solved a few hours of frustration with that. At least for once, it wasn't a lack of RTFM on my part... the SoftICE manual is out of date on the need to be in context. That said, I should have used the (shudder) search function. My apologies. Thanks again :)
dELTA
08-21-2004, 07:03 AM
The answer to that one is even found directly in the FAQ, which you should have read before posting in the first place...
JMI
08-21-2004, 11:42 AM
And I believe the description of the use of context sensitive breakepoints and the "option" to change then to the "old" way, IS discussed in the manual and in mentioned here in the other Threads you will find with a search criteria mentioned above. For example, this thread:

http://66.98.132.48/forum/showthread.php?t=5470&highlight=softice+breakpoints

Regards,
SpiderVenom
08-21-2004, 03:24 PM
Well, I have the original PDF manual, for version 3.0 (NuMega's version 3, not Compuware's) and while it discusses being in context, it states explicitly that you don't (didn't) have to be in context if it was a breakpoint in a shared module - not so anymore, obviously. Also, if you mean the FAQ in the html readme file that comes with SoftICE - I don't have the readme for 3.0 or above, never did. I have SoftICE lite, in other words only the symbol loader and softice itself. If you mean a different FAQ, please point me towards, I'd like to read it. And without sounding pompous, I'm not some sort of computer/forum n00b... I'm just a lazy twit that can't get off his bum and search forums :p ... will try harder :whoops:
SpiderVenom
08-21-2004, 03:29 PM
Scratch that annoyed comment about not being a n00b... I really shouldn't back chat to an admin :P (yes, even _I_ know that :p )
JMI
08-21-2004, 03:54 PM
Well SpiderVenom, by definition, has a poison tongue. ;)

There have been patches released for XP SP2, discussed here:

http://66.98.132.48/forum/showthread.php?t=6253

Maybe, since you ARE running SP2, you might NEED them. :eek:

And, of course, you didn't NEED the version 3.1 readme file to know the information about the option to use or not use context sensitive breakpoints and the requirements of context sensitive breakpoints, because it was already posted here and would have been found by a search of this Board. That was the purpose of the prior comments, and dELTA's comment, that it was such a 'frequent" question, it ended up in the FAQ. :yay:

Regards,
SpiderVenom
08-21-2004, 04:20 PM
Ooooh, BURN :p

Well I'll just have a retreat into my hole and wait for my tongue to refill...

In the meantime:

I will use the forum search before asking stupid questions.
I will use the forum search before asking stupid questions.
I will use the forum search before asking stupid questions.
I will use the forum search before asking stupid questions.
I will use the forum search before asking stupid questions.
I will use the forum sea...
dELTA
08-21-2004, 04:30 PM
And to answer your question about which FAQ I was talking about, it was the one mentioned with the (apparently not) BIG (enough) RED LETTERS on the main page of this forum... ;)

I like your mantra though. :p
SpiderVenom
08-21-2004, 05:17 PM
And to answer your question about which FAQ I was talking about, it was the one mentioned with the (apparently not) BIG (enough) RED LETTERS on the main page of this forum
:thinking:
:thinking:
:thinking:

:eek:

:whoops:
SpiderVenom
08-21-2004, 05:22 PM
READ THE FAQ AND SEARCH BEFORE POSTING!
Haven't you realised by now that it doesn't working on idiots like me unless it takes up the entire screen and is accompanied by at least ten popups, several dialog boxes, and a sound bite?
JMI
08-21-2004, 07:50 PM
Of course the "sound bite" would have to be in at least 12-15 languages to have any chance of reaching the majority of our viewing audience. :idea:

Regards,
SpiderVenom
08-21-2004, 09:37 PM
A sound bite is just what you need... I'm sure there's plenty of people willing to scream RTFF in their language. You could even do a documentary about the regrets people have had over not reading the faq... "Hi, I'm SpiderVenom. I really wish I'd read the FAQ. I just never gave any thought to how it could affect my life." :p
Kayaker
08-21-2004, 10:48 PM
Yeah SpiderVenom, you give 'em hell. Don't take none of that admin lip..:p
JMI
08-21-2004, 11:00 PM
Now Kayaker, "everyone" knows Spiders don't have lips, so they NEED to take some. :whoops: If admin lip is all they can get, then they just have to settle for that. :yay:

Regards,
SpiderVenom
08-21-2004, 11:35 PM
Maybe we don't have lips, but we do have fangs, perfect for biting smart alec moderators :p

Admins are evil. Give them a little bit of power, let them run a forum, and they think they own the world (there better not be a http://forum.world.com/). As an example, I visited the EXETools forum a while ago... they have this sadomasochistic self-important admin who won't let people download files unless they have made 3 posts of some "substinence" !!!!

Cue long silence as SpiderVenom stares at JMI

Hang on one second... I'm an admin at my website... :thinking: :thinking: :thinking:... :eek:... :whoops:
esther
08-22-2004, 01:11 AM
>Admins are evil. Give them a little bit of power, let them run a forum, and they think they own the world

They pay for the servers,they decide rules.If you don't like it,fuck of? :whoops: LOL
SpiderVenom
08-22-2004, 01:34 AM
I'm insane :DYou most certainly are :p Nice to meet a kindred spirit :p
JMI
08-22-2004, 04:34 PM
Yah, we got to do something about that evil admin over at exetools. Imagine, preventing people from freeloading on the FTP unless they actually have a whole 10 posts "of some substance." :cool:

Imagine the good old days when there were 14,000+ members with access to the FTP and NOONE could get on because everyone wanted to be on. Imagine them trying to make it more accessible for those who actually post of the Forum. Oh the shame of it all. :devil:

But I hear he has taken spider anti-venom, just as a precaution. :idea:

Regards,
SpiderVenom
08-22-2004, 06:37 PM
Hooray for the good old days!

Seriously, I do agree with your policy about the ftp. It's just that for me, it'll take several years to get the experience to post something original. Ohwell... I guess I'll just have to become a big famous ubercracker and shame you for eternity :idea:

Antivenom eh... I wonder if they sell anti-antivenom :idea:
JMI
08-22-2004, 08:55 PM
Small correction: The requirement on exetools is not for 10 Posts of "something original," but only for 10 Post "of some substance." That simply means things like "good, I want it," "Thank you type posts" and general comments which appear to have nothing to do with the content of the thread (like most of the posts in this thread :D) won't count towards getting FTP access.

After one has 10 posts there "of some substance" then the users may post as much B.S. as they want, because it is then obvious that they are not doing so "just to get FTP access." Reading the posts there, one will find many, many posts which are not very "substantial" but are of "some substance" and have not been deleted.

We have had many new registrants attempt to get access to the FTP password by posting 10 quick short statements, sometimes of just nonsense, thinking, mistakenly, they will get instant access to the password as soon as they pass the 10 post threashold. However, the requirements include membership for 30 days and no one is getting automatic promotion, so that attempt, and there have been several, including another two today, simply gets them banned. :whoops:

Regards,
SpiderVenom
08-22-2004, 09:50 PM
like most of the posts in this thread :DOf course... but you gotta love threads that go offtopic and end up with a "quipping" (I'll probably get laughed at for using a word that old) war. Ah the joys of open forums.
Aimless
08-23-2004, 01:43 AM
Is this thread for real? I mean, here we are on the Tools board discussing spider venom?

Why don't we simply shift the entire thing to the off-topic.

IDEA: Why don't we simply open up another section called: "DUMB/BAD/RIDICULOUS/LAME NEWBIE SECTION". All such questions shall be auto forwarded to this section. This will get the newbies who have yet to RTFM be careful in framing their next question as they don;t want their posts to end up in the stoopid section. Any hey, we can get a few laughs when all our nerves are taut trying to break that damned Flexlm routines. (Who in his right mind invented FLexlm bTW?).

Have Phun
Silver
08-23-2004, 07:04 AM
I'm going to ignore Aimless' attempt to get this thread OT or out the forum, and perpetuate this nonsense... :D

JMI, not that I need/use/have ever logged into it, but why does the exetools FTP have loads of warez on it? It seems counterproductive to me - if it just had up to date RCE tools (like the exetools webpage, but newer) then surely the demand for access would drop?

Doesn't make much sense to me, any idiot with a few minutes can get access to a 0 or 1 day FTP, or failing that break out a copy of edonkey and use search...

*edit*, I'm a muppet, I typed forum where I meant FTP.
dELTA
08-23-2004, 08:28 AM
Ok, moved to off-topic, babble away... :)
JMI
08-23-2004, 11:50 AM
Silver, I'm not sure what you mean by "lots of warez" on the FTP. Generally, Aaron's rules limit uploading to "programming and reversing tools" and efforts to upload general "warez" are deleted.

I have nothing to do with making of these policy decisions on what should or should not be uploaded there. But the Forum and FTP are in China and not generally subject to the same rule as this Forum may be. I simply attempt to help Aaron enforce the rules he makes and maintain some semblance of order in the postings.

Regards,
Silver
08-23-2004, 12:22 PM
Fair enough... I'm only going by the topic titles in that forum, I've never actually logged on/looked further. By "lots", I meant "any" ;) .... Just my personal opinion, wasn't aimed as a criticism against you. I'm far more blatant if I do that ;)
JMI
08-23-2004, 01:13 PM
I did not take it as criticism and "I" wouldn't be accepting any on that issue in any case, because it is not a policy over which I have any input or control. ;)

And, at least in this country, everyone is not only entitled to have opinions (even on both sides of any issue) but to express them as well. :eek:

Regards,


REPZ Instruction
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > REPZ Instruction
PDA

View Full Version : REPZ Instruction

markh51
08-21-2004, 05:17 AM
I have came across a REPZ intruction in my routine and do know how it does, what it does. When I step across it, it loops for a set amount of times and fills the memory with some data.

How does it know where to get the data from to fill the memory with ? There is a call, a few lines above the REPZ instruction, could this be generating the data to fill the moemory with ?

Thanks
Js
08-21-2004, 05:25 AM
http://www.online.ee/~andre/i80386/Opcodes/
markh51
08-21-2004, 06:01 AM
JS:

Thanks for that, but due to the fact that I am new to this, maybe you can explain in "newbie" terms ;)

Cheers
dELTA
08-21-2004, 07:01 AM
If you want any chance if being able to read/understand the assembly code of your targets, you really have to at least be able to read an instruction reference. While I may agree that the document at the given link above is a little messy, here are some other good ones that you should be able to read:

http://protools.anticrack.de/docs.htm

and here are direct links to the latest Intel Instruction Reference documents, which are very good:

ftp://download.intel.com/design/Pentium4/manuals/25366614.pdf
ftp://download.intel.com/design/Pentium4/manuals/25366714.pdf

You really have to put down some effort yourself, and not just expect to have everything "explained in newbie terms" by other people.
markh51
08-29-2004, 06:09 AM
dELTA:

Thanks for them links, but I'm still totaly lost. I have figured that the REPZ instruction seems to add bytes in to memory until ECX=0, but the bit I can't work out is where does it get these bytes from ?
naides
08-29-2004, 06:39 AM
ESI: Extended SOURCE Index
EDI: Extended DESTINATION index

That's why they exist.
lifewire
08-29-2004, 06:52 AM
dELTA:

Thanks for them links, but I'm still totaly lost. I have figured that the REPZ instruction seems to add bytes in to memory until ECX=0, but the bit I can't work out is where does it get these bytes from ?

actually, REPZ does nothing with memory and esi and edi. it is the prefixed instruction that does the job. like movsb/d scasb/d, lodsb/d (although a rep'ed lodsb/d is not very useful), etc.
markh51
08-29-2004, 07:37 AM
Cheers naides, that's all I needed ;)
markh51
08-29-2004, 07:40 AM
lifewire:

What do you mean ?

Every time I step over REPZ it moves whatever is stored at the address in ESI into the address stored at EDI until ECX=0.
Neitsa
08-29-2004, 08:11 AM
Hi ,

markh51, REPZ is a REPEAT instruction with condition ! It does nothing else than repeating the suffixed operation (REP is a prefix).

ex:

REPNE SCASB ; REPNE is a prefix / Scasb is the string operation

or

REPZ MOVSB

etc.

Also, REPZ is equal to REPE

REPZ: Repeat string instruction until condition is TRUE (ZF=1 for REPZ) and ECX != 0
naides
08-29-2004, 09:01 AM
Lifewire is right, REPZ is a prefix that repeats any isntruction until ECX becomes 0. But, in the context Mark was asking the question, it sounded like a REPZ MOVSD or REPZ MOVSB instruction, which are very common usage of the prefix. then, EDI and ESI do make sense. That was what I meant.
JMI
08-29-2004, 10:55 AM
Which is why markh51 needs to spend some quality time reading and studying general assembly language guides, like those suggested by dELTA. Assembly language is the "view" language of most debuggers and if you don't know what you are looking at, you are not likely to be able to make much progress figuring out what is happening. Effort at learning IS required. :idea:

Regards,


AZURE IDA Pro plugin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > AZURE IDA Pro plugin
PDA

View Full Version : AZURE IDA Pro plugin

Polaris
08-21-2004, 03:03 PM
Hi everybody.

Just wanna inform you of the release of the AZURE IDA Pro plugin, downloadable (binary for IDA 4.5) from http://polaris.kcmo.net ;)

The AZURE plugin performs PE Scanning directly within IDA pro. It is useful to:

* detect packers (IDA Pro does not do that)
* check IDA pro's scannings
* enhance IDA pro's scannings

Details are available on website and in the readme.txt file.

Byez ;)

Polaris
dELTA
08-21-2004, 04:32 PM
Sounds really nice, but that URL sadly seems to be dead?
Bengaly
08-21-2004, 05:37 PM
sounds cool polaris ;)
Polaris
08-22-2004, 03:56 AM
Sounds really nice, but that URL sadly seems to be dead?

Hmmm... Just checked, everything seems to be ok.

@Delta: Did you get it? ;) I am awaiting your feedback!

@Ben: Hey man, this will be released (hopely) soon even for PVDasm :D
dELTA
08-22-2004, 07:34 AM
Yep, got it now, looks nice. I'm really not the best man for the job to evaluate such a software though, since I'm not really much into unpacking.

But let's hear from some people who are, c'mon guys. :)
JMI
08-22-2004, 04:37 PM
Yah. Lets have a plug for the plug-in. Where are all you IDA users?? Give it a shot and report back. :yay:

Regards,
Bengaly
08-22-2004, 04:56 PM
@Ben: Hey man, this will be released (hopely) soon even for PVDasm

@Polaris: That would be lovely :)
r4g3
08-23-2004, 11:44 AM
well... it falsely identified arma on dumped dll, neolite2 sections removed.

--> AZURE: Entry point at 10015474
--> AZURE: Signature Microsoft Visual C++ v6.0 DLL found!
--> AZURE: Signature Armadillo v1.xx - v2.xx found!

it is not as accurate and has less signatures than peid, so ... ehm ... whats the use of it ? telling EP is kinda useless too dont you think ? finaly what packer other than arma you may think of disasming before you dump mem ?

is just my opinion
Polaris
08-23-2004, 02:16 PM
Hmm.... You go straight to the point, eh? ;)

However:

well... it falsely identified arma on dumped dll, neolite2 sections removed.

It could be a bug... Please send me the file in mail (if possible).

it is not as accurate and has less signatures than peid, so ... ehm ... whats the use of it ?

The idea is to add functionality to IDA... Also consider this is the first version, and stuff will be added to it. Anything you wanna see implemented? Feel free to contact me!

telling EP is kinda useless too dont you think ?

That's the remainder of debug release... Sorry! :cry:

Byez!
Polaris
08-25-2004, 08:10 AM
@Polaris: That would be lovely :)

AZURE now runs even on PVDasm 1.5d... Download will be available soon.

Byez,

Polaris
Bengaly
08-25-2004, 09:46 AM
yeah, looks great,
thanks for your support Polaris :)
JMI
08-25-2004, 11:22 AM
We do appreciate you efforts, even if the early code is not perfect in every way or doesn't have every bell and whistle those who don't code anything for the community might wish for. That's what the development process and field testing is designed to help move forward. :yay:

Regards,
ssx
08-27-2004, 04:23 AM
why do i need this plugin? petools or peid can show the same info.
dELTA
08-27-2004, 06:32 AM
Why do we need PEiD when we already have this plugin? :)
Why do we need your opinion when we already have out own? :)

Because competition and variety is never bad. :yay:
Bengaly
08-27-2004, 06:43 AM
well, plugins can save up time.
insted of openning zillions of tools, you can have them 'collected' in 1 main tool :)
well, you get the idea.

btw, if you are a Pvdasm user and want to check out the azure plugin for it, you can download it now from either polaris's site or from pvdasm site.

note that azure is for pvdasm 1.5d, which has released by now.

greetz,
Bengaly
Polaris
10-16-2004, 06:12 AM
AZURE binary for IDA Pro 4.7 is available for download at:

http://polaris.kcmo.net

Byez,

Polaris
Sab
11-15-2004, 03:10 AM
this adding functionality idea seems good, but rather then just identify the packer i think you should take it a step further (u should definetly get a teamf or this) and identify some of the critical functions of the packers in addition to identifying it.. i.e. detecting xprotector-> then it signatures someof the functions that may be optional such as "found X amount of potential CRC's" "is using high number of decryptors" etc,this way even if the versions of the packer changes it still may identify some of the critical algo / protection elements allowing one to understand deeper the code and if done with good enough will also help in general debugging/dumping... maybe (: sounds like a lot of work now that i typed it heh.


Adding Functionality to Printer Drivers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Adding Functionality to Printer Drivers
PDA

View Full Version : Adding Functionality to Printer Drivers

bboitano
08-22-2004, 03:51 AM
Has anyone considered adding funtionality to HP printer drivers as a mini-project?

Specifically the removal of the built in image censor that works by detecting a small geometric pattern in the image and on detection of said image, truncates the output to around 1inch in height and places the URL hxxp:\www.rulesforuse.org\ underneath.

I have googled and found people adding functionality to other high end software packages that include the same image detection but nothing on the printer driver front.

A copy of the detected image can be seen at hxxp://www.cl.cam.ac.uk/~mgk25/eurion.pdf which shows the 5 circles that the software looks for.

A Slashdot article on the subject (for those that are interested) is here hxxp://slashdot.org/articles/04/01/20/1734209.shtml?tid=158&tid=99

The thing that worries me most about this is not the currency aspect. Its what happens if someone puts the circle design on their webpage images? Does this prevent printing, copying, etc. web images? Effectively, there's now a standard symbol for "do not copy". (quoted from slashdot)

bb
dELTA
08-22-2004, 07:03 AM
That URL you say it adds underneath "illegal outprints" might be a good starting point if you're lucky. Can you find any string references to it in the driver (or any file related to it), or were they at least clever enough to encrypt it (or maybe store it as an image or similar)?
bboitano
08-22-2004, 07:35 AM
That URL you say it adds underneath "illegal outprints" might be a good starting point if you're lucky. Can you find any string references to it in the driver (or any file related to it), or were they at least clever enough to encrypt it (or maybe store it as an image or similar)?

Nope - they weren't clever enough to encrypt it :)

I can find the string linked in several DAT files and one EXE. From a few simple tests, I can tell that its the EXE that holds the starting point at least as renaming the EXE prevents printing, altering the URL text in the file alters the text that appears on output and there is a jump that can be 'switched' to prevent the text appearing at all.

However, the print output is still truncated :(

I thought it might make an interesting mini project to try and track down the actual routine that searches for the 'watermark' rather than just switching jumps until the picture appears!
dELTA
08-22-2004, 07:39 AM
Well, are those drivers publicly downloadable somewhere? Otherwise we kinda have a problem. And don't post the URL if they are, just tell us if they are.

Anyway, tracing back from the code that references that string, it most likely shouldn't be too hard to find the whole truncation algorithm either, have you tried that?
bboitano
08-22-2004, 12:09 PM
Well, are those drivers publicly downloadable somewhere? Otherwise we kinda have a problem. And don't post the URL if they are, just tell us if they are.

Yes they are. A simple Google provides you with many many download targets.

Anyway, tracing back from the code that references that string, it most likely shouldn't be too hard to find the whole truncation algorithm either, have you tried that?

I have looked back in the code but can't find a specific entry point into the routine I have been fiddling with which deals with the url being added. I'm still looking though but from what I can glean its not a simple call to a routine should this be detected :(

But I'm still looking :)


nice (and new) article about NT-Syscalls
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > nice (and new) article about NT-Syscalls
PDA

View Full Version : nice (and new) article about NT-Syscalls

0rp
08-22-2004, 05:46 AM
hxxp://www.summitsoftconsulting.com/NtSystemCalls.htm

abstract:
Most texts that describe Windows NT system calls keep many of the important details in the dark. This leads to confusion when trying to understand exactly what is going on when a user-mode application "calls into" kernel mode. The following article will shed light on the exact mechanism that Windows NT uses when switching to kernel-mode to execute a system service.
disavowed
08-23-2004, 10:09 AM
nice article, thanks for posting!
lifewire
08-25-2004, 04:23 AM
well, it isn't very complete imho. i didn't even see the servicedescriptortable being mentioned and such :(
nikolatesla20
08-25-2004, 09:07 AM
Shouldn't this be in the advanced forum?
dELTA
08-25-2004, 09:26 AM
Probably should, done and done. :)
Japheth
08-28-2004, 11:23 AM
Hi,

the author of this article somewhat claims that it is not possible to directly call into higher provileged code, therefore an "interrupt gate" would be necessary for this task. But AFAIK, there exist "call gates" in the x86 architecture, which can be located in the GDT and LDT and thus switching to ring 0 by a simple far call is possible. The opposite direction, calling ring 3 from ring 0, is in fact NOT possible, because the cpu needs information about what stack to use and this cannot be defined by a far call (so only a RETF or IRET can "call" out to lower privilegded code).

.
homersux
08-30-2004, 09:27 AM
>>But AFAIK, there exist "call gates" in the x86 architecture, which can be located in the GDT and LDT and >>thus switching to ring 0 by a simple far call is possible.

This is not possible in protected mode programming on ia32 because the CPU checks the code segment selector priviledge level CPL, call-gate selector RPL, call gate descriptor DPL, destination code segment descriptor DPL to make sure things like you described won't happen (far call from ring 3 to ring0 unless ring0 code is conforming code). For more details check ia32 manual vol 3 chaptor 4.

Imagine for a second if what you said can be made possible, then the entire ia32 protected mode protection was just made a joke.
omega_red
08-30-2004, 09:48 AM
If you can install a callgate descriptor in GDT/LDT, you CAN call to ring0.
Proof: ry.pl/~omega/asm/ring0nt.zip
sgdt
08-30-2004, 11:03 AM
Imagine for a second if what you said can be made possible, then the entire ia32 protected mode protection was just made a joke.

Err, yes, it is. But it's not entirely at intel's door stop, Microsoft is the ones who left the ability for Ring-3 to get at physical memory (and thus modify the descriptor tables). It's amazing what you can get away with...

Call gates are quite cool, but they can bite on occasion if one is not carefull. A few protections I've ran across use them as a "Kiss of Death" to instantly reboot the machine when they detect something's wrong. (invalid instruction in ring 0 reboots machine, while ring 3 just throws exception. Shows up in disasm as same, but depending on HOW the code gets called determines if it simply goes to next level or of you see the BIOS screen...

Call gates are also the basis for most "no-install-needed" root kit stuff, as well as a couple virii.

-sgdt
homersux
08-31-2004, 01:06 PM
If you can install a callgate descriptor in GDT/LDT, you CAN call to ring0.
Proof: ry.pl/~omega/asm/ring0nt.zip

hmm, it's actually a neat trick by indirection of the callgate descriptor. Scratch everything I said, I just checked the manual again, indeed this satisfies every condition in table 4-1. This is made possible through the installation of a DPL=3 call gate. In addition, an actual stack switch also occurs with this trick so it's real ring 0 switch.
0rp
09-22-2004, 03:00 PM
following article

hxxp://www.summitsoftconsulting.com/SysCallOpts.htm

its about how SYSENTER/SYSCALL works in detail (MSR regs and stuff)
lifewire
09-22-2004, 03:10 PM
cute :)
user
10-09-2004, 12:49 PM
following article

hxxp://www.summitsoftconsulting.com/SysCallOpts.htm

its about how SYSENTER/SYSCALL works in detail (MSR regs and stuff)too bad it's not much more than a few paragraphs from the manuals. the real interesting stuff is not mentioned at all... think of what happens when you single step SYSENTER... why's SYSENTER_ESP_MSR set to 0? how does the kernel recover?
JMI
10-09-2004, 03:00 PM
They could tell you, but then they would have to kill you, so they are doing you a favor by not telling you. :eek:

Or, at least that is what they say. :devil:

Interesting reading, never the less.

Regards,


New memory protection in XP SP2, details and problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > New memory protection in XP SP2, details and problems
PDA

View Full Version : New memory protection in XP SP2, details and problems

dELTA
08-22-2004, 08:03 AM
Here is an article with some "details" about the new memory protection in Windows XP SP2:

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2mempr.mspx

I can't really understand why several of the big packers are having problems adapting to it (Armadillo is apparently discontinuing its "copymem2" feature because of it, as mentioned in this thread (http://www.woodmann.net/forum/showthread.php?t=6269), and I know that Asprotect is having problems with certain of its features too).

Does anyone know why this is? As far as I can see, all they need to do is properly VirtualProtect() their memory, and all will be fine again? I guess the SafeSEH features might have something to do with it, especially the registered function table handler requirement, but it shouldn't be really hard to get around for a packer either I think?

Any ideas?
Aimless
08-23-2004, 01:48 AM
As an offshoot, can we expect SoftICE to malfunction again and _once again_ NOT break at the beginning of executables?

:)

Have Phun
dELTA
08-23-2004, 06:49 AM
This would probably solve it in that case anyway:

http://www.woodmann.net/forum/showthread.php?t=6253

I'm still hoping for some info on my question above though...
Heathcliff
08-25-2004, 06:18 AM
The CopyMem II protection from Armadillo should work fine on SP2, according to this topic: hxxp://support.siliconrealms.com/index.php?showtopic=2045&st=0. It is probably just your debugger having trouble with SP2. All memory protection flags are valid in Armadillo.

Greetz,
Heathcliff
SpeKKeL
09-15-2004, 03:33 AM
Welll for those who want a quick break at the beginning of all exe's:

Simple put a bpx at: RegisterWaitForInputIdle+0046 >call [ebp+08]

(used to be: getcurrentdirectoryw+0041 allso call [ebp+08] )

SpeKK.
naides
10-07-2004, 07:56 AM
Well I did it. I installed SP2, an it DID produce some problems with Sice.
I have not gone into deep, hardcore testing, but the breakpoints have become erratic, and the exception handling is firing at pseudorandom frequency.
I uninstalled and reisntalled Sice (3.1) but does not make a difference. I did uninstall SP2 and things calmed down somewhat, not completely.

The problems is I had other misadventures in parallel, I burned up a CPU and had to replace it, and the mother board, so I did a lot of patching in my system, ergo I am not sure if the problem is indeed in SP2 or in all the other tweeking I did to my computer.

Question to the public:

Someone else installed WXP SP2, and how did it behaved with Sice?

Regards

Naides
dELTA
10-07-2004, 08:25 AM
Did you apply the patch(es?) from Compuware to make DriverStudio 3.1 work correctly in SP2?

One example is referenced in the following thread:

http://www.woodmann.com/forum/showthread.php?t=6253
naides
10-07-2004, 10:41 AM
Yes sir I did, it did not help
dELTA
10-07-2004, 12:36 PM
Ok, that sucks, I'm out of ideas. :( Damn I hate SP2...
JMI
10-07-2004, 08:43 PM
Well, you could always uninstall it. :yay:

Regards,
dELTA
10-08-2004, 06:10 AM
No, because there are some security patches that are only included in SP2 and not available as stand-alone, and also, new stuff from both Microsoft and others will start requiring it pretty soon, as always... :boo:
JMI
10-08-2004, 08:26 AM
Alternative No. 2, then stop complaining. :devil:

Regards,
dELTA
10-08-2004, 10:47 AM
Never! :boo:
JMI
10-08-2004, 07:59 PM
We know, we know. :rolleyes:

Regards,
Silver
10-09-2004, 10:26 AM
Delta, personally I don't see a need to worry about SP2. I still use Win2k on my "everyday" machines. Unless you're directly connected to the net, not using a gateway firewall and using Internet exploder to browse, you're at minimal risk of anything bad happening...
JMI
10-09-2004, 11:02 AM
This is, of course, an alternative solution for the short run, but as my friend dELTA indicates, M$ is determined to move everyone in the direction of WinXP and the features of sp2 because of all the criticism of its vulernabilities and the inroads which have incurred in its dominance in the world market as a result of all the attacks which have been successful against its OS without sp2. As more and more software manufactures adapt and correct for the new problems created by this "innovation" older systems will become less and less functional, except with older software. We clearly aren't there yet, but M$ will offer less and less support for other flavors of the OS in the months to come to continue to force those migrations.

Regards,
Silver
10-09-2004, 01:28 PM
I agree with that too. It's frustrating when vendors force an upgrade on you, for example as I'm a DX coder I'm going to be forced to upgrade to Longhorn to code anything for the next DX platform. However I think this is a slightly different discussion - XP SP2 is a security related upgrade, and isn't a pre-requisite for applications (and it's unlikely to be). The next versions of Windows will force mandatory upgrades though, as you say.
SpeKKeL
11-12-2004, 01:03 PM
After lot's of troubles with ds 3.1 : errors patches not breaking installing uninstalling etc.........i switched back to 2.7 with the latest osinfo.dat file.
Puted in my winice.dat file under a function key :bpx RegisterWaitForInputIdle+0046 and it breaks on winmain.
Pffff.. no more troubles anymore, bpx on every api nomore atach or addr....

Back to yesterday :yay:

Spekk.
Woodmann
11-12-2004, 05:34 PM
Hi Spekk :)
JMI
11-12-2004, 07:23 PM
We old folks need to stick together. :D

Regards,
SpeKKeL
11-13-2004, 08:43 AM
We old folks need to stick together. :D

Regards,

Yep, therefore we need this board !

Old and Rare ?Live goes on,..sjit i become sentimentel :whoops:

Hi Woody ;)

Spekk.
MaRKuS-DJM
11-13-2004, 09:55 AM
there was already a post how to get bp on api working again in 3.1


Unknown packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unknown packer
PDA

View Full Version : Unknown packer

MiniMind
08-22-2004, 08:17 AM
On Internet I found the program GeoWhere and I couldn't found out
with wich protector/packer was used...

PEID couldn't say, section names are normal + a few random

2 times CRC32 check en 1 MD5 hash looks like a good protection ???

Anyone has any idea what kind of protection it is ?

(It's no cracking request)

Thanks,
MiniMind


TLSGetValue
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > TLSGetValue
PDA

View Full Version : TLSGetValue

sarge
08-22-2004, 05:16 PM
Help! I'm trying to understand the usage of TLSGetValue, for RE purposes of course. I have read the MS docs and done the Google thing. I have earned what the prototype declaration is, and I understand the English of the explanation. But all the resources I have searched (I gave up after about the first 50 of a-bazillion-or-so on Google), parrot the same explanation the MS gives. My question is simple...what data is at the pointer (for a specific index) in that array? Is there any specific required stuff that MUST be there, or is a thread free to just use that memory for any data storage it desires?

I'll be happy to study, if someone knows the source of a better, cleaner explanation than the MS pap. I suspect I can take the more tedious path and find the matching TLSSetValue for that same index, and determine the hard way what was put there, but that's going to be a lot of effort if I have to do that for each TLSGetValue I want to examine.

Any (easy) ideas?

Thanks all
Sarge
0rp
08-23-2004, 04:29 AM
TLSGetValue returns an application defined DWORD

you can use TLSSetValue to set this value to what ever you want
and even if every thread uses the same index value, it get its very own DWORD value back

it is also possible, to declare a var with __declspec(thread), wich results in the same behavior, but funny things will happen, if you use this in a DLL and load the DLL with LoadLibrary
omega_red
08-23-2004, 04:54 AM
TLS is an area in TEB (thread environment block):

...
/*C00*/ UCHAR StaticUnicodeBuffer[0x20C];
/*E0C*/ ULONG DeallocationStack;
/*E10*/ UCHAR TlsSlots[0x100]; // <-- TLS
/*F10*/ LARGE_INTEGER TlsLinks;
/*F18*/ ULONG Vdm;
...
So you can access it like:

mov eax, value
mov fs:[0xe10 + offset], eax

Actually, I've noticed that TLS is defined as a byte array, not dword array (at least in my nt4.h ;)
sarge
08-23-2004, 07:46 AM
Thanks. I really didn't expect the answer to be something simple, like, "it's a pointer to a string", "it's a pointer to an object", "it's the infinite value of PI", but I guess :

"TLSGetValue returns an application defined DWORD"

says it all.

Thanks, both

Sarge
sna
08-23-2004, 05:17 PM
Hi.

Trying to bypass TlsGetValue isn't all that bright. Especially when the implementation or offsets for TLS differs depending on what platform your code is ran on. If you were to disassemble TlsGetValue on Win9x you'd see this, or a variation thereof:

mov ecx, dword ptr [esp+04] // dwTlsIndex
mov edx, dword ptr fs:[00000018] // ptr TEB
cmp ecx, 00000040
jnb BFF92B2E
mov eax, dword ptr [edx+4*ecx+00000088] // lpTlsValue
...The lesson to be learned here is that you should always stick to the documented interfaces!

Regards, sna
JMI
08-23-2004, 06:31 PM
Especially if one wants to avoid unforseen difficulties. :yay:

Regards,
sarge
08-24-2004, 09:31 AM
Well, the real question is/was what the final pointer represents. I suspect, from my examination of my target proggie, that it is a pointer to an object. But I wasn't sure that, that would fit the usage/definition of TLSGetValue. Thus, my question was in reference to the then unknown proper usage. It appears that having an object pointer as a return value is perfectly fine.

Thanks

Sarge


win32asmcommunity is down
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > win32asmcommunity is down
PDA

View Full Version : win32asmcommunity is down

Silver
08-23-2004, 12:25 PM
win32asmcommunity is down due to hack attempt. That really sucks.

Random idiots try and hack my site all the time too. I can see why some idiots want to attack "big" commercial sites, but what's the point in attacking community sites. :mad:
JMI
08-23-2004, 01:19 PM
Simply to prove they can. A general sense of inadequacy and the need to prove ones powers adds to the compulsion. :idea: Also the smaller servers tend to be less well protected than large commercial boards that one would assume could afford talented consultants on these issues.

Regards,
dELTA
08-23-2004, 03:36 PM
I've been talking with Hiroshimator about it, and he's actually uploading the board backup to the server for restoration as we speak. He is also switching the forum software to get rid of the vulnerabilities that were used in the hack. ETA for reopening should be a few days now, so stay tuned...
TQN
08-23-2004, 08:40 PM
I think if we can, we can take a hand to help Hiroshimator. Win32AsmCommunity is a great board and is one of my favorite site. I feel very angry with this hacker. Hacker is not a coder, and can not compare with coder in the programming area. On ExeTools, someone has suggest donating money, and why not for Woodmann and Win32asmcommunity board.
Regards
TQN
JMI
08-23-2004, 10:31 PM
But they haven't actually GIVEN any.

Regards,
Woodmann
08-24-2004, 12:08 AM
Howdy,

Perhaps if I offered stock, like an IPO, I could
raise the funds to run this place without it costing
me any money. :D

Then again, who would want this mess ? :eek:

Regards, Woodmann
dELTA
08-24-2004, 09:06 AM
The Win32ASM board just opened again a few seconds ago, Hiroshimator welcomes you all back... :yay:
JMI
08-24-2004, 09:51 AM
Glad to see them back, but sorry they switched to the phpbb, rather than upgrade.

Regards,
dELTA
08-24-2004, 09:59 AM
Yeah, me too, don't like phpbb too much. :-/ Luckily, the good site content out weighs it anyway in this instance. :)
Silver
08-24-2004, 02:54 PM
Hope he's patched it, phpbb is insecure by default.


Winzip registration routine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Winzip registration routine
PDA

View Full Version : Winzip registration routine

SL0rd
08-23-2004, 02:02 PM
Hi, its my first post...
I sucessflly break the registrationroutine of Winzip 9, using the thechnique know as key fishing (using SoftIce), I have modified the routine so that it accepts any serial number too. Im a beginner and Im just doing it to learn and increase my skills. Im trying to get the algorithm that generates the serial number( to make a keygen), but its hard to me, it seems complex at the momment, I would like to know if someone have already done it and say me just how difficult is it, in a 0-10 scale and give me some hints.
JMI
08-23-2004, 03:23 PM
Have you read the FAQ listed in the BIG RED LETTERS? I raise this question for two reasons. First, you have not stated that you have and this is your first post. Second, even though you appear to be asking just a simply question, you will, ultimately, not get much useful information that does not result in the posting of some code and, because you have identified your target, that would be specifically prohibited here.

So, if all you want is an answer that says, "on a scale of 1-10" it's and X, there would appear to be no problem. However, as soon as any "hint" involves code from the target, there is a BIG problem, so just make SURE that neither YOU or ANYONE ELSE posts any code from THIS target. :idea:

Regards,
SL0rd
08-25-2004, 01:32 PM
Sorry, very MUCH!
I understand the point and I agree with ALL that you said. I will not do it again, I dont want troubles nor put the forum in troubles too!
Im stuying the soft. cited and I discovered very intersting things!
I will read the FAQ now, I learned the lesson! :whoops:
JMI
08-25-2004, 01:38 PM
That's all we ask. :yay:

Regards,


IceExt troubles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IceExt troubles
PDA

View Full Version : IceExt troubles

SpiderVenom
08-23-2004, 09:03 PM
This should probably be in the newbies section. This could probably be answered my reading/docs searching. However I can't seem to find a specific answer to my problem.

MOV Solution,"Post here and get flamed" :p

I'm working on a SafeDisc 2.8 program, which I'll never crack since this is my first cracking project. That said, I am getting somewhere.

I tried using IceExt 0.64 to hide SoftICE from SafeDisc, but no luck. From what I've read, there's other detections in softice that iceext can't stop, but I might be wrong. Anyways, iceext stops a MeltICE attempt, but safedisc tries other protections and detects it. Now my problem... when I turn on IceExt's protections, I get a message "Unable to patch UnhandledExceptionFilter", and I think it's this protection that safedisc is detecting SI on. Why does this occur (XP SP2). Also, does anyone have an English copy of peex's safedisc 2.7 tutorial? Cheers (I wonder how many spelling errors there are).
JMI
08-23-2004, 10:30 PM
Maybe you should find and read the threads on the patches for softice running on SP2 and look for discussion of problems caused by SP2 with several of the protectors. :yay:

Regards,
SpiderVenom
08-23-2004, 11:08 PM
Give a man a fish, feed him for a day. Give him a net, feed him for a lifetime. Utterly useless if the man is to stupid to use the net.

I... couldn't find anything... tried all the keywords I could think of... shame :(
SpiderVenom
08-23-2004, 11:10 PM
Although I did find a thread on the new DEP protection in sp2, but this only mentions a few packers having troubles, and I'm too stupid to see if it related to unhandled exceptions and the like.
JMI
08-23-2004, 11:37 PM
Perhaps you might have tried looking 6 threads down from your own at the one titled:

Updated Support for Visual SoftICE 3.0/3.1 (XP SP2/ W2K3 AMD64)

and its reference to the post on the exetools site.

And if you keep on with the "too stupid" routine, everyone will eventually come to believe it, particularily if you continue to act the part.

Regards,
SpiderVenom
08-23-2004, 11:49 PM
Ok, I'll cut the stupid routine. I looked at that post on the exetools forum, guess I didn't read it properly. Points taken. Thanks.
MarQueze
08-26-2004, 08:19 AM
Hi SpiderVenom,

Had some troubles with the same thing myself. this is what pushed me in the right direction. It's from the IceExt release notes:

N.B. I assume the original byte at the beginning of the UEF api is 68h,

That is probably the problem. Different kernel.dll's might have different UnhandledExceptionFilter functions.

In softice do
d UnhandledExceptionFilter
And change the first byte to 68.

Hope this helps.

Cheers,

MarQueze
mYeXcKsN
09-14-2004, 06:26 AM
You should just E UnhandledExceptionFilter 90 in sice .This is just the same effect as iceext does.

But I think there is need to do that in xp system. I don't think it is the protection that safedisc is detecting SI on
doug
09-14-2004, 04:50 PM
uhh, that's assuming the first instruction of that API is a coded on 1-byte.
a much better solution is to first check what that byte really was and then fix it.

An even better solution is to fix IceExt itself, if needed. I posted something very similar on exetools, but whoever asked the question (few weeks ago) never tried what I suggested. probably padding post count ;-)


Safedisc 2 questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Safedisc 2 questions
PDA

View Full Version : Safedisc 2 questions

SpiderVenom
08-23-2004, 11:23 PM
I've got several questions about safedisc 2.

First, from what I've seen, the simple protections like MeltICE are in the code/dlls that are packed on to the executable?

Second, I noticed that the module DrvMgt.dll is loaded then unloaded, then some protections are called. So I gather DrvMgt is used to load SecDrv.sys?

Finally, I'm guessing at this. Is secdrv used to run code in ring 0 to pull off protections such as privileged instructions?

PS. What's the best way to beat the UnhandledExceptionFilter protection?

And JMI, please don't tell me to search :p
JMI
08-23-2004, 11:30 PM
Sorry SpiderVenom, it's kind of like my job.

Just because you want information about safedisc2 and particularily about "UnhandledExceptionFilter" doesn't mean that you get to get away with being to darn lazy to search this board for information on the subjects. And if you have already done so, it's your own fault for trying to be a smartass and not saying so. :thinking:

There is some very useful information, particularily about "UnhandledExceptionFilter" already on the board and one of your first stops should be to find it and review it.

And bear in mind that being cutesy only goes so far and doesn't earn you any pass on following the rules.

And just because you have more than one question about safedisc2, doesn't mean you should cross post in several Forums.

Regards,
SpiderVenom
08-23-2004, 11:47 PM
Ok, ok, I'm depressed, I get the picture.

Yes I did search, I didn't really find any clear answers. Thanks for the hints. And I'll stop being a smartass.
doug
08-24-2004, 12:06 PM
Just to show you that finding information is not out of your reach:

Searching for 'Safedisc' (since you had a safedisc question) brings 80 results, but in the first page you have the most recent/relevant results:
http://www.woodmann.net/forum/showthread.php?t=4591&highlight=Safedisc
http://www.woodmann.net/forum/showthread.php?t=5022&highlight=Safedisc
http://www.woodmann.net/forum/showthread.php?t=4612&highlight=Safedisc

extra link:
http://www.yates2k.net/cd/safedisc

tips:
- safedisc checks for breakpoints (BPX) by checking if there is a 0xCC at the beginning of each API. If you use BPX <apiname>, it will catch you. There are many ways to work around that.

- If the program terminates without any MsgBox: bpm ExitProcess X DO "dd esp", and do some analysis from there. (hint: You will find a magic value on the stack)
SpiderVenom
08-24-2004, 02:30 PM
Ah thanks. I read somewhere else about the bpx thing, thanks for the tip. About that unhandled exception filter post.

Someone talked about grabbing some free kernel space and patching it with a JMP. Why not just patch the first byte of UnhandledExceptionFilter back to the original? Will softice become unstable when this happens?
doug
08-24-2004, 04:01 PM
when you !protect on with IceExt, this is what it does. It patches it back to whatever it was before. However, that will also disable some of SoftICE's functionalities (faults on, for instance - I don't know of any other) but it is a perfectly fine solution.

What was suggested as a work-around was to patch Kernel32's export table _after_ softice has initialized. So SoftICE will still have a CC at the start of the UnhandledExceptionFilter, while any application started after the patch will not see the CC because the API was re-routed into a jmp first. By doing that, you keep everyone happy. ;)
SpiderVenom
08-24-2004, 05:55 PM
Thanks, that explains. On small detail... being a nub, I'd like to know, what is the best way to patch out the CC in UnhandledExceptionFilter? I know IceExt does this, but it just spits out an error and says it can't do that on my system, perhaps cause I'm running sp2.

Regards
doug
08-24-2004, 07:53 PM
well, anything that can write to memory without triggering a copy-on-write. I'm not sure if it will work if you do it directly in SoftICE. (in that case it would be a simple "eb UnhandledExceptionFilter")

I think that for your purposes the easiest way might be to patch SoftICE's driver. Search for "UnhandledExceptionFilter" in ntice.sys and patch it to anything else, ex: "xxhandledExceptionFilter". Rebuild the checksum & save. (though you'll get plenty of warnings in the sice console).

If you search this board (or maybe exetools), you might even find a place where someone explains what to patch in ntice.sys to disable UnhandledExceptionFilter patching by softICE. I remember seeing that somewhere.

You can also wait for IceExt to be updated or update it yourself.

Or, go back to SP1 because the problems you are having right now is just the tip of the iceberg. A lot of cracking-tools might stop working with sp2.
dELTA
08-24-2004, 08:38 PM
A lot of cracking-tools might stop working with sp2.
Well, let's just say that cracking tools aren't the only ones...

http://support.microsoft.com/default.aspx?kbid=884130&product=windowsxpsp2

The funny thing is that just a week ago or so, this list was several times longer, and even funnier is that it included a big frickin' bunch of high profile MICROSOFT programs... I just wonder how things can be removed from that list, it's not like there still won't be versions of those programs out there that might "experience a loss of functionality", even though they have rushed out patches for them, so it's all very odd I think...
doug
08-24-2004, 09:22 PM
hehe yea. I remember seeing the MS office suite in there.

For a lot of programs listed there, it is actually the copy protection mechanism that breaks down with SP2

home-made cracking tools are even more subject to problems because they often rely on undocumented OS structure (just like those stupid short-sighted copy protections) and don't care if it breaks at every OS hotfix/service pack.


More problems with XP SP2...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > More problems with XP SP2...
PDA

View Full Version : More problems with XP SP2...

dELTA
08-24-2004, 12:25 PM
Another funny surprise in Windows XP SP2 is apparently a hard-coded limit for the number of uncompleted outbound TCP connections per second, set to 10. :boo: This does among other things mess up most file sharing software pretty badly.

Here is more info, and also a fix:

http://www.lvllord.de/
JMI
08-24-2004, 03:57 PM
And for those not checking around for possible solutions for this issue (did anyone mention dELTA? :devil: ) there has been some patch and revised patch code posted on exetools for nearly two weeks. :yay:

http://www.exetools.com/forum/showthread.php?t=4928

Regards,
doug
08-24-2004, 04:00 PM
There's also a thread (and fix) about this on exetools

http://www.exetools.com/forum/showthread.php?t=4928
JMI
08-24-2004, 04:02 PM
Ah, great minds. :D

Regards,
doug
08-24-2004, 04:09 PM
:whoops:
I'm too slow to compete with JMI :(
You were using that 'quick reply' feature weren't you?
JMI
08-24-2004, 04:14 PM
Nope. Just the ordinary sloooooow one. I just happened to drop in a few moments before you and already had exetools open in another window, doing my regular pruning. :yay:

Regards,
dELTA
08-24-2004, 04:36 PM
Well, who needs to check around, as I said in the original post there's already a fix at the link I gave (meaning both info for manual patching and an automatic patcher), and they're not even pulling any stupid PR tricks like demanding you to be a member to download the goodies. :devil:
JMI
08-24-2004, 04:48 PM
And, of course, as dELTA knows, you only need a measly 3 posts on exetools to download attachments and if he was REALLY paying attention, he would have noticed that the exetools post listed the SAME german page he posted here. :idea:

Regards,
dELTA
08-24-2004, 05:03 PM
Registering membership, submitting three posts, paying attention, god damnit that board is demanding. :D

And because of that, I thought I'd offer this information to everyone who has SOMETHING else to do than reading every last post on every damn board on the entire net, and instead decide to only stick to the best one, ok? :devil:
Silver
08-25-2004, 09:21 AM
If we were sticking with only reading the best forum on the net, how would we have spotted your post in this one :devil: :sneaky:
dELTA
08-25-2004, 09:32 AM
Infidel! Seize him! :p
JMI
08-25-2004, 11:35 AM
Here's actually a report of a benefit of SP2 in the functioning of Olly after a pause and an attempt to then step into the program again with F7. Thanks to MaRKuS-DJM. You will find his comment here:

http://www.exetools.com/forum/showthread.php?t=5112

Regards,
JMI
08-27-2004, 05:49 PM
Here's another potential problem with SP2, from an article reported by ferrari over at exetools, titled: "Top Threat: Windows Security Center Spoof"

http://www.pcmag.com/article2/0,1759,1639276,00.asp

Regards,
Silver
08-28-2004, 10:12 AM
There's quite a few new issues appearing... Some internet explorer spoofing problems too... Give it some time, SP2 is not going to have that much of an impact on security. Just like everything else, it will fix whats known and create new issues to be found.


Aramadillo 3.0-3.6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aramadillo 3.0-3.6
PDA

View Full Version : Aramadillo 3.0-3.6

blackoliver
08-24-2004, 05:50 PM
Hi
This is my first post so please be gentle. :D Anway I'm trying to crack a program called H****L. This program pops up with a nag screen asking for a
name and serial. I have tried to unpack it with various programs like;

DilloDumper, Armadillo Deprotector, Demaradillo, Armadillo Killer, UNARM etc all no no avail.

I havent been able to find PEiD's generic unpacker plugin.

Of course i used peid to determine that it was version 3.0 - 3.6. But peid seems to give the incorrect entry point. Also when stepping through the program (olly 10.3) I get stuck in an infinite loop. I tried unpecompact and got this:

Entry point reached: 0x49d000 then of course it starts the trace it ends up setting a breakpoint at: 0x4d45AA, then the programs gets stuck.

I am going to buy the program next week. At least that will get me into the program. Becuase as it stands you get the nag screen and if you dont have the name/serial you have no other choice but to close the program
But i wanted to crack it because even after you buy it you have to wait thirty days and then go back to the regestration server and re-register and still... you can only get to use on one machine. That really pissed me off when i read that.

Any suggestions. I've read the various tuts, but none seem to address this particular issue.

Thanks
B'
nikolatesla20
08-24-2004, 06:24 PM
So you have to enter a name/serial to run the program at all? Then I'm afraid NONE of the tools you listed would work. Unless you had at one time a "demo" version that would at least run, you won't be able to just unpack it.

-nt
blackoliver
08-24-2004, 06:35 PM
Yes, it requires a serial/username to work at all. There is a demo but its a limited 8 bit version of the program and it dosent require an serial/key.

Like i said in a week or two i will buy it...then of course i can reverse to my delight.

I think the way that they are marketing this program spells disaster.
Basicly i'm Sol until i get the key=serial/password right?

Thanks

B'
xastey
09-01-2004, 06:40 PM
well most of the time if you unpack a arma app it will acted like it was registered with a serial.. so you can just use MEPHiST0 tut and unpack it that way


DR7.GD bit and DRX access exception problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DR7.GD bit and DRX access exception problem
PDA

View Full Version : DR7.GD bit and DRX access exception problem

0rp
08-25-2004, 04:59 AM
hi,

i wrote a driver, which enables the GD (general detection) bit in the DR7 reg. if this bit is set, any access to one of the debugregs (like mov eax, dr2) results in an int 1 exception.

i also hook int 1 to catch these exceptions, and handle them my own way (i never write to the DR regs or return fake values from them).

this idea isn't new, it is based on yates' DRxLOG.

everything seems to work, a doom3 start looks like this (safedisc debug checks):
code=mov dr6, ebx, image=winlogon.exe, addr=804DDD26, fake=yes
code=mov dr7, ecx, image=winlogon.exe, addr=804DDD29, fake=yes
code=mov eax, dr1, image=Doom3.org.exe, addr=B29E88A4, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E88BA, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E892B, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E892B, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E892B, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E892B, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E892B, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E892B, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E892B, fake=yes
code=mov eax, dr7, image=Doom3.org.exe, addr=B29E892B, fake=yes
code=mov dr7, ebx, image=winlogon.exe, addr=804DE049, fake=yes
code=mov dr0, esi, image=winlogon.exe, addr=804DE04C, fake=yes
code=mov dr1, edi, image=winlogon.exe, addr=804DE052, fake=yes

but i have a little problem (yates' driver too): if i start a random app (notepad) from ollly, no new exceptions are thrown.

it seems, that olly is able to set the DR7.GD bit to 0 and disables the GD exception.

but how? any access to DR7 should be faked through my handler ?!

the code of this driver is attached
bilbo
08-25-2004, 10:33 AM
Hi, 0rp,

nice toy you are playing with...
I do not understand anyway why WINLOGON address space is involved... the same happens on my XP machine...

it seems that olly is able to set the DR7.GD bit to 0 and disables the GD exception.
It's not Olly, but processor architecture... Look at Intel manual...
The processor clears the GD flag upon entering to the debug exception handler, to allow the handler access to the debug registers.
Now, in your INT 1 handler, if DR6 does not say you that a debug register access has been detected, you jump directly to label executeOldHandler, forgetting to set again GD bit in DR7! From that moment, your handler will no more be called when debug registers are accessed.

By the way, why are you forcing six calls to your handler inside
unHook()?
__asm {
mov eax, dr7
mov eax, dr7
mov eax, dr7
mov eax, dr7
mov eax, dr7
mov eax, dr7
}
I cannot see the need of them!

Regards, bilbo
0rp
08-25-2004, 02:04 PM
forgetting to set again GD bit in DR7! From that moment, your handler will no more be called when debug registers are accessed.

thxalot, that is the problem

i do now

executeOldHandler:
//re-enable GD
mov eax, dr7
or eax, 2000h
mov dr7, eax

popad
jmp oldint1

which works more robust. it would be nice, to re-enable this bit after the old int1 code, but this should be impossible (?)

or i could try to modify the pushed returnaddr, that is used by the corresponding IRET and let it point to my code

By the way, why are you forcing six calls to your handler inside
unHook()?

you are right, there is no need for six movs. one mov is enough to trigger the handler
Opcode
08-26-2004, 02:42 PM
Hi,

take a look in
http://www.woodmann.net/forum/showthread.php?t=5595

Maybe this thread help in something... :D

Regards,
Opcode


Network access
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Network access
PDA

View Full Version : Network access

naides
08-25-2004, 06:37 AM
The Problem:

I have an application that consistently attempts to access the network, probably a "phone home" atempt.
The firewall detects it and blocks it, but I would like to locate the code that does it and deactivate it. I have looked for a reference of network related API functions, but the list is rather daunting, and I have no clear idea of which API the application may be using, because I do not know anything about network programming.

I searched the app import list, and found nothing revealing, but this is one of those apps that is split in a zillion dlls over several folders, so it is not trivial to examine each one of them for net related APIs.

My question is, is there a low level function/code/port that is always invoked during network access that I can use as a bait to locate the offending code, and the offending dll?

Is there another approach to this problem?
The program is written in Visual C++ 6.0

Sorry for the newbie level question,
dELTA
08-25-2004, 08:01 AM
I guess it might work to run the application under an API monitor program (e.g. Autodebug), and then when the firewall warning comes up, just switch to the API monitor log and see what the last called API is in the application. Since the firewall blocks inside this API it should be the one (or at least among the few last ones, depending on what strange things the firewall might be up to). In that case you should be able to see directly where it is called from and everything.
naides
08-25-2004, 08:44 AM
Thank you Delta, that should do it.
dELTA
08-25-2004, 09:30 AM
Also, if the application is not supposed to do any network communication at all, an easy and efficient patch might be to simply make it believe that the call to WSAStartup (or similar network code init function) returned an error code. :)
Harding
08-29-2004, 08:16 AM
To naides:

Another way to do it is like this:
1. Remove all rules for the program in the firewall.
2. Run the program in a debugger of your choice.
3. When the app. is trying to connect to the internet, the firewall
pops up asking if it should allow the program to connect.
4. Switch to the debugger, pause the program and examine the
code.


Stupid encryption Examples. (In protector help file). um, duh.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Stupid encryption Examples. (In protector help file). um, duh.
PDA

View Full Version : Stupid encryption Examples. (In protector help file). um, duh.

nikolatesla20
08-25-2004, 03:46 PM
Just wanted to share this with everyone to show you how NOT to use encryption. See the problem in this implementation of the encrypted code?

unit Unit1;

interface

uses
Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, ShellApi;

type
TForm1 = class(TForm)
Label1: TLabel;
Label2: TLabel;
lbtrialtime: TLabel;
Label4: TLabel;
Label5: TLabel;
lbusername: TLabel;
Ok: TButton;
Label3: TLabel;
Label6: TLabel;
Memo1: TMemo;
procedure OkClick(Sender: TObject);
procedure Label6Click(Sender: TObject);
procedure FormCreate(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;

var
Form1: TForm1;
KeyCorrect: boolean;
implementation

{$R *.dfm}

Procedure TForm1.OkClick(Sender: TObject);
Begin
Close;
End;

Procedure TForm1.Label6Click(Sender: TObject);
Begin
ShellExecute(0, 'open', 'http://www.ultraprotect.com', Nil, Nil, SW_SHOW);
End;

Procedure TForm1.FormCreate(Sender: TObject);
Var usrname: Array[0..255] Of char;
a: byte;
Begin
memo1.clear;
Memo1.Lines.Add('Status:'+#13+#10);
{$I ..\..\include\critic_begin.inc} //dynamic lock begin
Memo1.lines.add('Dynamic En/Decrypt here!');
{$I ..\..\include\protect_begin.inc} //the embedded lock header and sapce
Memo1.lines.add('EmbeddedProtection here!');
fillchar(usrname, 256, #0);
//Get User name from UltraProtect loader
MessageBox($FFFFFFFF, @usrname[0], Nil, 0);
If trim(usrname) <> '' Then
lbusername.caption := usrname
Else
Begin
lbusername.caption := 'unregistered user';
//Get Trial UsageTime from UltraProtect loader if required
MessageBox($FFFFFFFF, @a, Nil, 1);
lbtrialtime.caption := inttostr(a);
End;
KeyCorrect := false;
{$I ..\..\include\regonly_begin.inc} //RSA lock code begin
KeyCorrect := true;
{$I ..\..\include\regonly_end.inc} //RSA lock code end
If keycorrect = false Then Begin
showmessage('Only licensed user can use this function');
Memo1.lines.add('RSA LOCK here :-<');
End Else Memo1.lines.add('RSA UnlOCK here :-)');

{$I ..\..\include\protect_end.inc} //the embedded lock tail and sapce
{$I ..\..\include\critic_end.inc} //dynamic lock end
End;

End.

See the problem? Look at the key testing....

And this is supposed to be a code example in using ACProtect.

-nt20
br00t_4_c
08-25-2004, 03:51 PM
Heh.
dELTA
08-25-2004, 04:59 PM
OMFG, I guess that's what happens when you rip someone else's code and sell it as your own product, while still wanting to at least make your own examples not to make it too obvious... :D
JMI
08-25-2004, 05:30 PM
Tell me you didn't find this as part of the "encryption" of something from our "Office of Homeland Security." :thinking: :rolleyes:

Regards,
Hopcode
08-26-2004, 06:01 AM
Looks like the author didn't get it well ;)

Its pretty obvious that this example is mucked up.

Anyway, Delta speaks about ripping, this protector can be found if you know where to search, as well as Asprotect.

I have noticed that both products are very similar , even the includes etc.

ACProtector is a rip off of Asprotect? (not even mentionning the name)
dELTA
08-26-2004, 10:05 AM
When ACProtect was first released, it was ridiculously similar to ASProtect, including examples, help files and everything, so yes, many people think it is originally a rip-off of ASProtect.
nikolatesla20
08-26-2004, 10:29 AM
Speaking of ACProtect, I've looked at the new version, not too much has changed. OEP is simple to find, easy to dump too.

The code ripping code is better now, it uses a common self-decrypt routine, and also the original code that is ripped is obfuscated a little bit. Still rips 5 bytes sequences.

-nt20


Hasp Privilege Imprec Plugin by LaptoniC
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Hasp Privilege Imprec Plugin by LaptoniC
PDA

View Full Version : Hasp Privilege Imprec Plugin by LaptoniC

JMI
08-25-2004, 05:16 PM
One of our members, LaptoniC, has posted a new Imprec plugin for Hasp Privileges. Thought some of you might be interested in taking a look. You will find it at:

http://www.exetools.com/forum/showthread.php?t=5117

He stated:

This plugin will resolve APIS which is protected by HASP (actually Aladdin) Privilege. Privilege is ESD system something like Vbox.

Because some of you may not be eligible to download from exetools and this might be interesting to study, I have taken the liberty, on this unusual occasion, of uploading it here.

Regards,
Hopcode
08-26-2004, 05:53 AM
Hello,

Thanks :)
Just a lil note.

Its not HASP Privilege, but Aladdin Privilege.
And it is the new name of VBOX.

Aladdin bought VBOX and screwed it even more.
This protector is a joke.

Thanks for the plugin though, im sure some people will enjoy it.

My two cents,

Hopcode.
LaptoniC
08-26-2004, 02:41 PM
WTF!
Why you deleted my post at http://www.woodmann.net/forum/showthread.php?t=6270 What is in this post was just attachment and a sentence saying that

"Here is the plugin so you wont deal with exetools "make 3 valueable post and download" limitation.Enjoy

I am contributing something to community and you JMI cant resist to this.
JMI
08-26-2004, 05:03 PM
LaptoniC:

I'm sorry you are feeling persecuted, but your suspicion about a reason for removing your post in the other thread simply not accurate. I deleted that post simply because there was already a link posted there to this thread and there was already a copy of your attachment here. In fact, this thread was created before I posted in the other one.

Because there was already a copy of your file attached here in this thread, we didn't need to burden the server with an additional copy in that thread as well.

And LantoniC, you KNOW you are not accurately stating the contents of your other post. It is still there, you just can't see it. What you actually posted was:

"Here is the plugin so you wont deal with exetools stupid "Make 3 valuable post and download attachment crap.Enjoy."

That also was not necessary.

Regards,


Is it possible!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is it possible!
PDA

View Full Version : Is it possible!

blackoliver
08-25-2004, 09:44 PM
Ok, since only one person answered my last post i will ask a very direct question. Is it possible to reverse a target that requires a serial/password to run. How can I reverse it if I cant unpack it?

I've checked the tuts and none seem to address this issue. If anyone knows please tell.

Be as blunt as you feel you have to be.
Ricardo are you out there?

HELP.......

Thanks for any and all who reply. :)

B'
evlncrn8
08-25-2004, 11:02 PM
well question is why cant you unpack it... and yes it is possible to reverse a target that requires a serial/password to run.. ppl do it all the time
nikolatesla20
08-25-2004, 11:50 PM
No, as far as I know, you cannot unpack an armadillo target that requires a username/password, unless you have either a keygen first (in which case unpacking is kinda not the point) or you have a username/serial already.

-nt20
Ricardo Narvaja
08-26-2004, 04:05 AM
I don't know if is possible or not possible, if i say is not possible, maybe in a par of month is discovered a method for bypass this, but for my experience the section code is decryted using the right serial-name, if you bypass the comprobation of the serial name, and try unpacking using the bad serial name, the section code unpacked is a mess and don't RUN.
maybe a hard bruteforcing can do this i don't know, but i think if days and days of bruteforcing are justified for run a program only, sure there are hundred of programs in internet with the same use.

Ricardo Narvaja

Ricardo Narvaja
blackoliver
08-26-2004, 08:00 AM
Okay. thanks. Thats what I thought. I will have the key/serial in one week.

Thanks'

B'
dELTA
08-26-2004, 10:11 AM
Let's conclude it like this:
If properly implemented, such an application can indeed be as hard to crack as the cracking of the most secure existing encryption algorithm.

This being said, the question is of course always if the author of the protection in question has implemented the cryptography in a suitable way, which is indeed not always the case (see for example this recent funny thread (http://www.woodmann.net/forum/showthread.php?t=6288)).


Encrypted execution engine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Encrypted execution engine
PDA

View Full Version : Encrypted execution engine

tom324
08-26-2004, 03:56 AM
User-mode program tracing and application to encrypted execution engine

(paper and code)

http://www.core-dump.com.hr/documents/cryptexec.pdf

http://www.core-dump.com.hr/software/cryptexec.tar.gz

Tom
lifewire
08-27-2004, 03:21 AM
funny, a friend of mine recently wrote his thesis about the same subject :)
JMI
08-27-2004, 11:58 AM
Did he pass? ;)

Regards,


How can I modify a win xp system dll?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How can I modify a win xp system dll?
PDA

View Full Version : How can I modify a win xp system dll?

Japheth
08-26-2004, 04:02 AM
Hi,

I would like to change some bytes in ntdll.dll. the change itself is easy, of course, but winxp doesnt like the modified binary and reboots immediately. What must be done to make xp accept such modifications?

Japheth
ZaiRoN
08-26-2004, 04:27 AM
Hi Japheth,
you have to avoid the Windows File Protection system. In few words, you have to patch a dll system named sfc_os.dll (sfc.dll for 2k) and to remove some keys from the registry. For the moment, I won't tell you nothing more because it's a funny reversing game (but if you want...) ;)

Good luck,
ZaiRoN

p
MaRKuS-DJM
08-26-2004, 05:04 AM
i know that modification too ZaiRoN! i wonder why microsoft disabled the registry-keys to disable SFC. after you patched it, all patches are no problem (i just used it for UXTheme patch, TCP/IP Patch and kernel IsDebuggerPresent)
Japheth
08-26-2004, 12:20 PM
> For the moment, I won't tell you nothing more because it's a
> funny reversing game (but if you want...)

Some more hints would be appreciated. May be I'm loosing some fun then, but currently I'm engaged in too many such funny games.

Japheth
Neitsa
08-26-2004, 12:35 PM
Hello,

A google search with "sfc.dll" return numerous match about this trick. Here's one of them, very well explained:

http://www.collakesoftware.com/aboutwfp.htm

If you have a multi-boot , you can also do it from another OS...

Regards, Neitsa.
JMI
08-26-2004, 02:27 PM
Oh Oh. Somebody is stealing my "search and ye shall find" lines. :D Glad to have the help. ;)

Regards,
Japheth
08-26-2004, 10:55 PM
thanks, Neitsa
lifewire
08-27-2004, 03:22 AM
patching is not the right thing to do. sfc_dll exports a function (only by ordinal, not by name) to disable it at all.
Japheth
08-27-2004, 07:10 AM
To lifewire: But it has worked. Of course, since this solution may
cause problems if one installs another service pack, it would be
nice to know more details about your mysterious ordinal-exported function.
lifewire
08-31-2004, 01:58 PM
Japheth: http://29a.host.sk/29a-7/Articles/29A-7.004
two ways: to disable it one minute and to disable it at all (as long as the system isn't rebooted). good luck :)
bilbo
09-03-2004, 01:38 AM
Beautiful and precious, lifewire!

During my reversing I found a third method: the replacement of the dll SFCFILES.DLL, which is simply an enumeration of files to watch, with some little code at the start of the DLL to return the start of the list and the number of files, according to the XP version running on the computer.

The method is implemented by Damian Bokowski (http://www.d--b.webpark.pl/dreampackpl_en.htm) who simply set a null list inside SFCFILES.DLL. He also provide a nice tool...

Regards, bilbo
Japheth
09-03-2004, 01:59 AM
Very good links, thanks guys
nikolatesla20
09-03-2004, 06:56 AM
I think so many reversers are busy working on commercial protections and the like, they forget they can also spend some time reversing their O.S., just as the gentleman in the above link did. Obviously how can Microsoft apply Service Packs, etc, without disabling SFP? So it makes sense they have a method for it. (In a similar vein reversing another MS product is how I came upon Virtual PC detection methods, and the like).

The good thing is reversing MS code is usally easy, since it's not traditionally protected in any way, and it gives an RCE engineer a more in-depth knowledge of his operating system.

-nt20
bilbo
09-03-2004, 08:36 AM
hi, nikolatesla20, I fully agree with you!

The good thing is reversing MS code is usally easy, since it's not traditionally protected in any way
and they give away the .PDB files for free...

and it gives an RCE engineer a more in-depth knowledge of his operating system
which is at an higher level rapported to the knowledge he/she gains from reversing single commercial apps...

Regards, bilbo


a SEH CONTEXT' Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > a SEH CONTEXT' Question
PDA

View Full Version : a SEH CONTEXT' Question

Limee AKA Lamer
08-26-2004, 04:06 AM
typedef struct _CONTEXT {
ULONG ContextFlags;
~~~~~~~~~~~~~
is the ContextFlags a Constant?
ULONG Dr0_PAL_Undefined;
ULONG Dr1_PAL_Undefined;
ULONG Dr2_PAL_Undefined;
ULONG Dr3_PAL_Undefined;
ULONG Dr6_PAL_Undefined;
ULONG Dr7_PAL_Undefined;
// FLOATING_SAVE_AREA FloatSave;
......
LONG SegGs_PAL_Undefined;
ULONG SegFs_PAL_Undefined;
ULONG SegEs_PAL_Undefined;
ULONG SegDs_PAL_Undefined;

ULONG Edi;
ULONG Esi;
ULONG Ebx;
ULONG Edx;
ULONG Ecx;
ULONG Eax;

ULONG Ebp;
ULONG Eip;
ULONG SegCs;
ULONG EFlags;
ULONG Esp;
ULONG SegSs;
}
Neitsa
08-26-2004, 05:00 AM
Hello,

is the ContextFlags a Constant?

The ContextFlag lets you define what you want to read/write from the CONTEXT Structure with the GetThreadContext or SetThreadContext API's (If you use the CONTEXT struct with an SEH, this field is no use).

You can retrieve various CONTEXT fields while specifing a special value in ContextFlags.

Asm snippet:

mov context.ContextFlags, CONTEXT_INTEGER
invoke GetThreadContext,DebugEvent.u.CreateProcessInfo.hThread, addr context

Here's values for ContextFlags (can be mixed up) for X86 CPU.

#define CONTEXT_CONTROL CONTEXT86_CONTROL
#define CONTEXT_INTEGER CONTEXT86_INTEGER
#define CONTEXT_SEGMENTS CONTEXT86_SEGMENTS
#define CONTEXT_FLOATING_POINT CONTEXT86_FLOATING_POINT
#define CONTEXT_DEBUG_REGISTERS CONTEXT86_DEBUG_REGISTERS
#define CONTEXT_FULL CONTEXT86_FULL

Just take a closer look at Winnt.h (there's different values for different CPUs).

For exemple, if you specify CONTEXT_INTEGER, the value returned in CONTEXT struct will be:

ULONG Edi;
ULONG Esi;
ULONG Ebx;
ULONG Edx;
ULONG Ecx;
ULONG Eax

Hope it could help.

Regards, Neitsa.


how to get the point of the CONTEXT STRUCT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to get the point of the CONTEXT STRUCT
PDA

View Full Version : how to get the point of the CONTEXT STRUCT

Limee AKA Lamer
08-26-2004, 02:00 PM
in the stack, the data as follows

006ED5B0 006ED5B8 Pointer to next SEH record
006ED5B4 00D50217 SE handler
006ED5B8 006EFF68 Pointer to next SEH record
006ED5BC 00D50A6F SE handler

how to get the point of the CONTEXT STRUCT,
if the SE handler is 00D50217?
thx
Peres
08-26-2004, 02:15 PM
The Context struct is built and passed to the exception handler by the system. You won't find it on the stack. However, since it contains a representation of the processor context, you can find the values by looking at the registers.

Peres
Limee AKA Lamer
08-27-2004, 11:48 AM
what this mean?
where eax is a pointer to the thread context passed by the
system to the exception handler by [esp+0C].
I can't understand.Can you help me?

The Context struct is built and passed to the exception handler by the system. You won't find it on the stack. However, since it contains a representation of the processor context, you can find the values by looking at the registers.

Peres
Peres
08-27-2004, 04:30 PM
As soon as you get inside an exception handler the dword at [ESP+0C] will point at the Context struct. This will be true until you push or pop something from the stack. You can use that pointer to gain access to the field of the structure you need.
doug
08-27-2004, 07:04 PM
limee:
you get a CONTEXT structure under 2 circumstances:
- You are in an exception handler
- You called a thread-function like GetThreadContext

which one are you refering to and what are you trying to achieve?


QuickUnpack DLL release
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > QuickUnpack DLL release
PDA

View Full Version : QuickUnpack DLL release

Shub-nigurrath
08-26-2004, 03:56 PM
Well,
this fine release is a Dll version of the already released QUnpack program, from FEUERRADER of AHTeam (http://www.exetools.com/forum/showthread.php?t=4611&page=1&pp=15).

What I did is to transform it into a DLL and to improve the whole code robustness and functionality..

The main purpose of such a dll is to create complex patchers that would unpack on the fly the programs on the target PC, then apply byte changes to crack the program. Of course is much more useful where inline patching is not possible..

Hope will be useful!

Please give it a try and let me know, this is the first version and suggestions/criticism (if not offensive :p) are welcome!
:D :D

What it does:
-------------
The Dll works almost as the original Qunpack program. Essentially what is done is:

• set some hardware breakpoint into the debugged process
• find the OEP, using some custom method (if the target program is packed by FSG 1.33, ASPack 2.12 or UPX 1.2x, the OEP is found using an own technology) or the code of the GenOEP.dll (included inside)
• dump process to previously allocated buffer.
• rebuild dump and realign it.
• rebuild the import table (using some code taken from ImpRec)

How to use in your own program:
------------------------------
This is the protototype of the main function

int __stdcall UnpackFile(char* InName, char* OutName, BOOL AutoOEP, DWORD realOEP, char **pLog_buff);

Here below instead a code sniplet of how to use the DLL in you programs:

char *infile_buff=NULL; // it's the buffer pointing to the file to be unpacked
char *outfile_buff=NULL; // it's the buffer pointing to the file where to store unpacked file.
char *log_buff=NULL; // it's the buffer storing the log.
BOOL autoOEP=TRUE;
DWORD realOEP=FALSE;

//TODO: Init above buffers and values as you want..

UnpackFile(infile_buff, outfile_buff, autoOEP, realOEP, &log_buff);

// Writes to a file the log_buff filled and allocated by the UnpackFile API!
// Note that the main program has to wait untill the threads launched by
// UnpackFile() is terminated.
// GetLog() returns a not NULL value only when the hard work is finished.
// You might consider placing this loop into a separate thread of the main
// application, just not to block the user interface too long.
// NB. Remember to free the allocated buffer!

while(GetLog(NULL)==NULL);

FILE *fp=NULL;
if(log_buff!=NULL)
if((fp=fopen(".\\Unpacking_log.txt","w"))!=NULL) {
fprintf(fp,log_buff);
free(log_buff); //really important, remember to free the buffer!
log_buff=NULL;
fclose(fp);
fp=NULL;
}

Help function:
--------------
whenever you choose to pass the OEP to the function directly, usually you might have to convert it from a string representation to a real HEX value (usually it's inserted from an edibox).
Just for reference you might use this function that converts an hex value from string representation

//added to convert an exadecimal string to an hex value
unsigned char HEX_2_INT_TABLE[] = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 2, 3, 4, 5,
6, 7, 8, 9, 0, 0, 0, 0, 0, 0, 0, 10, 11, 12, 13, 14, 15, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 10, 11, 12, 13, 14, 15, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};

int hexstr2int(char *hexstr) {
register unsigned int length, i, value, shift;
for (length = 0; length < 9; length++) if (!hexstr[length]) break;
shift = (length - 1) * 4;
for (i = value = 0; i < length; i++, shift -= 4) value += HEX_2_INT_TABLE[(unsigned int)hexstr[i] & 127] << shift;
return value;
}

Belongs and Greetings:
----------------------
The DLL contains the code coming from some already existing DLLs. Those DLLs have been transformed into library files and directly linked to the Qunpack.dll to reduce external files dependency.
Those files are
• NDump.dll and RebPE32.dll which belongs to NEOx [uinC].
• GenOEP.dll by snaker
• Force.dll by FEUERRADER

Thanks again to FEUERRADER and to AHTeam members..

Distribution:
-------------
You may redistribute as you want the DLL, but please remember to give credits to the guys I mentioned and to me also!
If you witsh you can also include the present documentation and header files.

History:
--------

1.0 [+] initial release
1.1

[-] fixed a bug when realOEP is given
[+] added some details in the log file
[+] modified the little client
[+] modified the readme and added some more explanations

1.2 [+] eliminated the need for any external dll, now Qunpack.dll can works without any external dll
JMI
08-26-2004, 04:53 PM
We are, of course, happy to have your efforts posted here as well.

Thanks again. :yay:

Regards,
Shub-nigurrath
08-31-2004, 12:28 PM
Hi,
upgraded to version 1.2, see the original post

History:
--------

1.0 [+] initial release
1.1

[-] fixed a bug when realOEP is given
[+] added some details in the log file
[+] modified the little client
[+] modified the readme and added some more explanations

1.2 [+] eliminated the need for any external dll, now Qunpack.dll can works without any external dll


I want to write a generic static disassemler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > I want to write a generic static disassemler
PDA

View Full Version : I want to write a generic static disassemler

wjinbo
08-26-2004, 08:07 PM
I want to write a generic static disassemler,I want some advice!
JMI
08-26-2004, 08:30 PM
Here's some advise. Read the FAQ contained in the BIG RED LETTERS. It will give you a better understanding of how and what you should do and include when you want to post here. :yay:

Regards,
Aimless
08-26-2004, 11:45 PM
1. Go to protools

2. Go to the disassembler section

3. Download dssam01.zip by Sho CHang

4. Download the source code from his web page

5. Voila! You have a detailed (with func/API/string/resource recognition) disassembler source at hand

6. Modify to heart's content.

Have Phun
Neitsa
08-27-2004, 06:34 AM
Hello,

Take also a look at the anticrack.de portal. Especially on AOD (Advanced art of Disassembly) and the PVDasm (or Proview) engine by Bengaly.

www.anticrack.de

Regards, Neitsa.
0rp
08-27-2004, 08:20 AM
http://bastard.sourceforge.net/libdisasm.html
theCrackman!
09-19-2004, 01:16 PM
to write an disassmbler is not easy i think, anyway good luck ;)
Solomon
09-20-2004, 03:30 AM
grab a copy of IDA, learn how to use its features and how it's designed :P


New kernel32.ids and D7RTL.sig for IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New kernel32.ids and D7RTL.sig for IDA
PDA

View Full Version : New kernel32.ids and D7RTL.sig for IDA

TQN
08-27-2004, 01:26 AM
First, I said sorry to JMI because my cross post this topic at ExeTools forum and here. I think if I post here, many people can able to download.
I have created the new kernel32.ids for IDA and add more 40 function signature to D7RTL.sig. For more information, you can view at ExeTools forum.
Thank for your reading and interesting.
TQN
dELTA
08-27-2004, 06:17 AM
Thanks TQN, sounds great! :cool:

And you never have to apologize for posting both here and at the exetools forum at the same time. They are two completely separate forums, and just like you say, many users only visit one of them, so we actually encourage you to post any good stuff you may have on both of them! And that goes for everyone reading this too!
JMI
08-27-2004, 11:55 AM
Duh! :eek: I saw his thread and tool on exetools and rushed to post it here in the Advanced Forum, not having yet read this Forum and not seeing it as a lead New Thread. Having discovered that TQN had already posted this new tool here, I deleted my own Thread attaching it here. :whoops:

Great work TQN. Glad to have it here. :yay:

Regards,
Neitsa
08-28-2004, 06:30 PM
Great !

Thanx for sharing TQN.

Regards, Neitsa.

:yay:
TQN
08-29-2004, 11:06 AM
Thanks dELTA, JMI and Neitsa !
This .ids file is not a tool, it is only a manual job editing a large text file, so I think, it is posted at the Tool better than posted at Advance.
Later, when I release some IDA plugins, loader..., I will post here and on the ExeTools.
Best regards,
TQN
"Coding for food, reversing for fun"


Is the code at wrong direction?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Is the code at wrong direction?
PDA

View Full Version : Is the code at wrong direction?

Limee AKA Lamer
08-28-2004, 10:04 AM
I trace the anti-debug code as follows,
Is the code at wrong direction?
as if this code will run and run until the
system be crashed!

0040DA3F > PUSHAD
0040DA40 CALL NOTEPAD.0040DA4B
0040DA45 MOV ESP,DWORD PTR SS:[ESP+8]
0040DA49 JMP SHORT NOTEPAD.0040DA65
0040DA4B > PUSH DWORD PTR FS:[0]
0040DA51 MOV DWORD PTR FS:[0],ESP
0040DA57 PUSHFD
0040DA58 OR DWORD PTR SS:[ESP],100
0040DA5F POPFD
0040DA60 CLC
0040DA61 JNB SHORT NOTEPAD.0040DA3F --->
evlncrn8
08-28-2004, 11:25 AM
hmm looks like that codes setting up an int 1 exception, setting up the exception handler and anding the dword with 100h = setting the 'trace' flag in the eflags
which if im not mistaken would be set on the popfd, so the int 1 would 'happen' on 40da61 i think, so look at the exception handler to see where its meant to go, it looks like anti trace code heh
nino
08-29-2004, 05:33 PM
I think this would be equivalent to
0040DA3F > PUSHAD
0040DA40 JMP NOTEPAD.0040DA65
0040DA42 NOPs
.
.
.
0040DA65


Vbox 4.6.2[Im stuck] please help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vbox 4.6.2[Im stuck] please help
PDA

View Full Version : Vbox 4.6.2[Im stuck] please help

venom925
08-28-2004, 02:45 PM
Ok. ive tried and tried but I cant seem to figure it out. so ill tell you what i did and what errors i got maby you can help me out.first im using olly110 on xp pro. Im trying to unwrap this app , so i found the OEP witch is 4e77d0 - 400000 {image base} = e77d0. and i found the IAT which starts at 115c000 - 400000 {image base} = d5c000 and its AB8 long. after finding all this i dump the app. i run imprec on the app to get the IAT to find its screwed. so i look at the redirected calls and i find they all point to one decrypt call. time to code inject ,heres what i did - its in red {orginal follows}

026C0000 E8 1AE69404 CALL vboxtb.0700E61F
026C0005 2803 SUB BYTE PTR DS:[EBX],AL
026C0007 36:0000 ADD BYTE PTR SS:[EAX],AL
026C000A 0000 ADD BYTE PTR DS:[EAX],AL
026C000C 0000 ADD BYTE PTR DS:[EAX],AL
026C000E 0000 ADD BYTE PTR DS:[EAX],AL
026C0010 A1 5A006C02 MOV EAX,DWORD PTR DS:[26C005A]
026C0015 8B18 MOV EBX,DWORD PTR DS:[EAX]
026C0017 81FB 00000001 CMP EBX,1000000
026C001D 7C 1B JL SHORT 026C003A
026C001F 81FB 00000003 CMP EBX,3000000
026C0025 7F 13 JG SHORT 026C003A
026C0027 53 PUSH EBX
026C0028 C3 RETN
026C0029 90 NOP
026C002A 0000 ADD BYTE PTR DS:[EAX],AL
026C002C 0000 ADD BYTE PTR DS:[EAX],AL
026C002E 0000 ADD BYTE PTR DS:[EAX],AL
026C0030 0000 ADD BYTE PTR DS:[EAX],AL
026C0032 0000 ADD BYTE PTR DS:[EAX],AL
026C0034 0000 ADD BYTE PTR DS:[EAX],AL
026C0036 0000 ADD BYTE PTR DS:[EAX],AL
026C0038 0000 ADD BYTE PTR DS:[EAX],AL
026C003A A1 5A006C02 MOV EAX,DWORD PTR DS:[26C005A]
026C003F 83C0 04 ADD EAX,4
026C0042 A3 5A006C02 MOV DWORD PTR DS:[26C005A],EAX
026C0047 3D B8CA1501 CMP EAX,115CAB8
026C004C 7D 06 JGE SHORT 026C0054
026C004E ^ EB C0 JMP SHORT 026C0010
026C0050 90 NOP
026C0051 90 NOP
026C0052 90 NOP
026C0053 90 NOP
026C0054 - EB FE JMP SHORT 026C0054
026C0056 0000 ADD BYTE PTR DS:[EAX],AL
026C0058 0000 ADD BYTE PTR DS:[EAX],AL
026C005A 0010 ADD BYTE PTR DS:[EAX],DL
026C005C 8B00 MOV EAX,DWORD PTR DS:[EAX]
026C005E 0000 ADD BYTE PTR DS:[EAX],AL
026C0060 0000 ADD BYTE PTR DS:[EAX],AL
026C0062 0000 ADD BYTE PTR DS:[EAX],AL
026C0064 0000 ADD BYTE PTR DS:[EAX],AL
026C0066 0000 ADD BYTE PTR DS:[EAX],AL
026C0068 0000 ADD BYTE PTR DS:[EAX],AL
026C006A 0000 ADD BYTE PTR DS:[EAX],AL
026C006C 0000 ADD BYTE PTR DS:[EAX],AL
026C006E 0000 ADD BYTE PTR DS:[EAX],AL
026C0070 8B1D 5A006C02 MOV EBX,DWORD PTR DS:[26C005A] ;
026C0076 8903 MOV DWORD PTR DS:[EBX],EAX
026C0078 68 3A006C02 PUSH 26C003A
026C007D C3 RETN

{orginal}
026C0000 E8 1AE69404 CALL vboxtb.0700E61F
026C0005 2803 SUB BYTE PTR DS:[EBX],AL
026C0007 36:0000 ADD BYTE PTR SS:[EAX],AL
026C000A 0000 ADD BYTE PTR DS:[EAX],AL
026C000C 0000 ADD BYTE PTR DS:[EAX],AL
026C000E 0000 ADD BYTE PTR DS:[EAX],AL
026C0010 0000 ADD BYTE PTR DS:[EAX],AL
026C0012 0000 ADD BYTE PTR DS:[EAX],AL
026C0014 0000 ADD BYTE PTR DS:[EAX],AL
026C0016 0000 ADD BYTE PTR DS:[EAX],AL
026C0018 0000 ADD BYTE PTR DS:[EAX],AL
026C001A 0000 ADD BYTE PTR DS:[EAX],AL
026C001C 0000 ADD BYTE PTR DS:[EAX],AL
026C001E 0000 ADD BYTE PTR DS:[EAX],AL
026C0020 0000 ADD BYTE PTR DS:[EAX],AL
026C0022 0000 ADD BYTE PTR DS:[EAX],AL
026C0024 0000 ADD BYTE PTR DS:[EAX],AL
026C0026 0000 ADD BYTE PTR DS:[EAX],AL
026C0028 0000 ADD BYTE PTR DS:[EAX],AL
026C002A 0000 ADD BYTE PTR DS:[EAX],AL
026C002C 0000 ADD BYTE PTR DS:[EAX],AL
026C002E 0000 ADD BYTE PTR DS:[EAX],AL
026C0030 0000 ADD BYTE PTR DS:[EAX],AL
026C0032 0000 ADD BYTE PTR DS:[EAX],AL
026C0034 0000 ADD BYTE PTR DS:[EAX],AL
026C0036 0000 ADD BYTE PTR DS:[EAX],AL
026C0038 0000 ADD BYTE PTR DS:[EAX],AL
026C003A 0000 ADD BYTE PTR DS:[EAX],AL
026C003C 0000 ADD BYTE PTR DS:[EAX],AL
026C003E 0000 ADD BYTE PTR DS:[EAX],AL
026C0040 0000 ADD BYTE PTR DS:[EAX],AL
026C0042 0000 ADD BYTE PTR DS:[EAX],AL
026C0044 0000 ADD BYTE PTR DS:[EAX],AL
026C0046 0000 ADD BYTE PTR DS:[EAX],AL
026C0048 0000 ADD BYTE PTR DS:[EAX],AL
026C004A 0000 ADD BYTE PTR DS:[EAX],AL
026C004C 0000 ADD BYTE PTR DS:[EAX],AL
026C004E 0000 ADD BYTE PTR DS:[EAX],AL
026C0050 0000 ADD BYTE PTR DS:[EAX],AL
026C0052 0000 ADD BYTE PTR DS:[EAX],AL
026C0054 0000 ADD BYTE PTR DS:[EAX],AL
026C0056 0000 ADD BYTE PTR DS:[EAX],AL
026C0058 0000 ADD BYTE PTR DS:[EAX],AL
026C005A 0000 ADD BYTE PTR DS:[EAX],AL
026C005C 0000 ADD BYTE PTR DS:[EAX],AL
026C005E 0000 ADD BYTE PTR DS:[EAX],AL
026C0060 0000 ADD BYTE PTR DS:[EAX],AL
026C0062 0000 ADD BYTE PTR DS:[EAX],AL
026C0064 0000 ADD BYTE PTR DS:[EAX],AL
026C0066 0000 ADD BYTE PTR DS:[EAX],AL
026C0068 0000 ADD BYTE PTR DS:[EAX],AL
026C006A 0000 ADD BYTE PTR DS:[EAX],AL
026C006C 0000 ADD BYTE PTR DS:[EAX],AL
026C006E 0000 ADD BYTE PTR DS:[EAX],AL
026C0070 0000 ADD BYTE PTR DS:[EAX],AL
026C0072 0000 ADD BYTE PTR DS:[EAX],AL
026C0074 0000 ADD BYTE PTR DS:[EAX],AL
026C0076 0000 ADD BYTE PTR DS:[EAX],AL
026C0078 0000 ADD BYTE PTR DS:[EAX],AL
026C007A 0000 ADD BYTE PTR DS:[EAX],AL
026C007C 0000 ADD BYTE PTR DS:[EAX],AL

now inside the call at the top i did this

0700E61F 55 PUSH EBP
0700E620 8BEC MOV EBP,ESP
0700E622 83EC 10 SUB ESP,10
0700E625 53 PUSH EBX
0700E626 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0700E629 895D F8 MOV DWORD PTR SS:[EBP-8],EBX
0700E62C 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
0700E62F 8955 F0 MOV DWORD PTR SS:[EBP-10],EDX
0700E632 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
0700E635 50 PUSH EAX
0700E636 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
0700E639 50 PUSH EAX
0700E63A 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
0700E63D 50 PUSH EAX
0700E63E 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0700E641 50 PUSH EAX
0700E642 E8 12000000 CALL vboxtb.0700E659
0700E647 83C4 10 ADD ESP,10
0700E64A 5B POP EBX
0700E64B C9 LEAVE
0700E64C 68 70007002 PUSH 2700070
0700E651 C3 RETN
0700E652 F4 HLT ; Privileged command
0700E653 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10]
0700E656 5B POP EBX
0700E657 C9 LEAVE
0700E658 C3 RETN

{orginal}

0700E61F 55 PUSH EBP
0700E620 8BEC MOV EBP,ESP
0700E622 83EC 10 SUB ESP,10
0700E625 53 PUSH EBX
0700E626 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0700E629 895D F8 MOV DWORD PTR SS:[EBP-8],EBX
0700E62C 894D F4 MOV DWORD PTR SS:[EBP-C],ECX
0700E62F 8955 F0 MOV DWORD PTR SS:[EBP-10],EDX
0700E632 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
0700E635 50 PUSH EAX
0700E636 8D45 F4 LEA EAX,DWORD PTR SS:[EBP-C]
0700E639 50 PUSH EAX
0700E63A 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
0700E63D 50 PUSH EAX
0700E63E 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0700E641 50 PUSH EAX
0700E642 E8 12000000 CALL vboxtb.0700E659
0700E647 83C4 10 ADD ESP,10
0700E64A 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
0700E64D 8B5D F8 MOV EBX,DWORD PTR SS:[EBP-8]
0700E650 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
0700E653 8B55 F0 MOV EDX,DWORD PTR SS:[EBP-10]
0700E656 5B POP EBX
0700E657 C9 LEAVE
0700E658 C3 RETN

ok heres what i did i set new orgin at 26c0010, bp at 26c0054 and ran the app like the tut said and heres what i got.
02700070 Access violation when writing to [77D47668]
02700070 Access violation when writing to [77E775F1]
............lots of these...............
02700070 Access violation when writing to [77E775F1]
Debugged program was unable to process exception
Thread 00000094 terminated, exit code 80 (128.)
Thread 0000031C terminated, exit code 80 (128.)
Thread 000003BC terminated, exit code 80 (128.)
Thread 00000768 terminated, exit code 80 (128.)
Thread 00000584 terminated, exit code 80 (128.)
Thread 00000578 terminated, exit code 80 (128.)
77E802F4 New thread with ID 000003E4 created
Process terminated, exit code 80 (128.)
--------------------------------
i know i cant post the name of the app here but if you want to pm me i will be more then happy to tell you. thanks for any help any of you can give me.
LaptoniC
08-28-2004, 04:36 PM
I want to reply but JMI will delete it so I cant write sorry.
venom925
08-28-2004, 04:42 PM
can you pm me then or icq
nikolatesla20
08-28-2004, 11:08 PM
There are 2 problems which could cause your trouble:

026C0017 81FB 00000001 CMP EBX,1000000 <- this could be different in your app. This lower limit is not always going to be the same value for each app.
026C001D 7C 1B JL SHORT 026C003A
026C001F 81FB 00000003 CMP EBX,3000000 See above note
026C0025 7F 13 JG SHORT 026C003A
026C0027 53 PUSH EBX
026C0028 C3 RETN
026C0029 90 NOP
026C002A 0000 ADD BYTE PTR DS:[EAX],AL
026C002C 0000 ADD BYTE PTR DS:[EAX],AL
026C002E 0000 ADD BYTE PTR DS:[EAX],AL
026C0030 0000 ADD BYTE PTR DS:[EAX],AL
026C0032 0000 ADD BYTE PTR DS:[EAX],AL
026C0034 0000 ADD BYTE PTR DS:[EAX],AL
026C0036 0000 ADD BYTE PTR DS:[EAX],AL
026C0038 0000 ADD BYTE PTR DS:[EAX],AL
026C003A A1 5A006C02 MOV EAX,DWORD PTR DS:[26C005A] <- do you even realize what this is doing? It's reading a variable from 26C005A, whic h you are supposed to set up ahead to get ready. See below
026C003F 83C0 04 ADD EAX,4
026C0042 A3 5A006C02 MOV DWORD PTR DS:[26C005A],EAX
026C0047 3D B8CA1501 CMP EAX,115CAB8
026C004C 7D 06 JGE SHORT 026C0054
026C004E ^ EB C0 JMP SHORT 026C0010
026C0050 90 NOP
026C0051 90 NOP
026C0052 90 NOP
026C0053 90 NOP
026C0054 - EB FE JMP SHORT 026C0054
026C0056 0000 ADD BYTE PTR DS:[EAX],AL
026C0058 0000 ADD BYTE PTR DS:[EAX],AL
026C005A 0010 ADD BYTE PTR DS:[EAX],DL <- ok, here is that variable I talked about. Notice it's set to 00008B10. And notice your IAT starts at 115C whatever. YOu haven't set this variable - it's supposed to point to the beginning of your Import Table.
026C005C 8B00 MOV EAX,DWORD PTR DS:[EAX]

And without assuming too much, I can make the observation that this is what happens when you simply follow a tutorial without knowing what is really going on and don't read what the tutorial actually says.

-nt20
MaRKuS-DJM
08-29-2004, 05:33 AM
i have unpacked much VBox targets, and so i can say you are right nikolatesla20.
the most important is to understand a tutorial.
venom925
08-29-2004, 08:37 AM
ahh i c what your saying thanks
JMI
08-29-2004, 10:57 AM
If I'm not mistaken, failing eyesight and all, it would appear that LaptoniC post is still there. :yay:

Regards,
LaptoniC
08-30-2004, 02:18 PM
Yep you deleted again.I knew it.My 5 posts dissapeared you are doing monolog here I reply and you delete and you keep your replies.What a joy.As you thretened me in your private messages please delete my account.
And please delete all my unvaluable posts from this server too
Seems you are the only one who can decide what to do and how to do.Thanks.
venom925
08-30-2004, 02:25 PM
why has this turned into a posting pi##ing contest, Can't we all just get along :D
LaptoniC
08-30-2004, 02:28 PM
I am the bad guy here.If he kept my messages everybody would know how bad I am and flame me.So good old JMI deleted my posts.Thank you JMI you saved me :)
Kayaker
08-30-2004, 04:07 PM
Yeah, you so bad LaptoniC, you've always been such a troublemaker here... :D

Please JMI, how is he ever to reach your own notable post count if you keep deleting his, er, messages?

As Venom says, let's stop the phisphing contest and all get along shall we?

:loveu:
venom925
09-03-2004, 11:22 AM
I want to thank all of you for your help LaptoniC: i did have the wrong OEP but that was found and naides if you read this thank you for the point in the right direction to fix the AIT. Now i have a full version of the app and unwraped my first vbox :D . thanks again everybody :yay:
Woodmann
09-03-2004, 03:51 PM
:D
LaptoniC
09-03-2004, 05:36 PM
I am glad that my pm helped you. :)
naides
09-04-2004, 06:22 AM
naides if you read this thank you for the point in the right direction to fix the AIT.

Well, IMHO that is the point and the spirit of the board. When you are stuck, you may find some inspiration and pointers here.
Glad you did it, and learned in the process. . .
;)


i'm gone lost my mind ...(Kaspersky)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > i'm gone lost my mind ...(Kaspersky)
PDA

View Full Version : i'm gone lost my mind ...(Kaspersky)

Euclides
08-28-2004, 09:06 PM
OS:WinXP
more than 6 days i'm working on this project. and still i can't found "The Problem"
i want to write just a very simple exe packer.
my packer works very good but "Kaspersky Ant-Virus" occurr "Suspicious code alert"

Why why why stupid antivirus doing this to me ?

it was another stange thing.
when i was added a new and totaly empty section an existing file,it was occurred the same error "Suspicious code"
hey there is no code !
how could be some thing "Suspicious" if there is no exist

the same "stupid program" occurr NOTHING when files packed with y0da's cryptor.

i have soruce of y0da's cryptor but i'm still desperate straits

-HELP ! HELP !
-Is anybody hear my scream ?
Woodmann
08-28-2004, 09:30 PM
Howdy,

You have answered your own question.
Think about this, What makes code look suspicious ?
You cannot add empty sections. Kas looks at this and see's a problem.
What is the problem ? >>there is nothing there<< Must be bad !!!

Since most people run a anti-V, you need to find out what bad code you have written.

As I think about this, remember how many people/companies tell you to shut off your ant-V before running their utils ??
Look into this. You will probably find out what is causing you these problems.

Woodmann
lifewire
08-29-2004, 04:55 AM
did you set the entryrva in the pe header to your new created section? that is suspicious too. especially when your new created section is the last section and has notcode and writable flags.
ancev
08-29-2004, 08:58 AM
lifewire,

using apvx, from z0mbie, unpack the .avc till you find the w32 heuristics obj.

then disasm with IDA :cool:

ancev
lifewire
08-29-2004, 02:47 PM
yes ancev, i knew that, very nice :) also the special .obj's per virus name can be very interesting :)


Ring3 debugger detection stuph (was Please test a program)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Ring3 debugger detection stuph (was Please test a program)
PDA

View Full Version : Ring3 debugger detection stuph (was Please test a program)

Limee AKA Lamer
08-29-2004, 11:35 AM
this Program can test the present of OD
Please get rid of the plugin of isdebuggerPresent
esther
08-29-2004, 11:55 AM
PAY US THEN WE TEST FOR JO :eek:
hobgoblin
08-29-2004, 01:54 PM
I don't get it. When I run this program in Olly, I get the message "Debugger NOT present". (This happens when I have the Hide debugger plugin activated, and it happens when I run Olly without).
What's the purpose with this?
Limee AKA Lamer
08-29-2004, 02:12 PM
Do you run the program on Win9x?
The Program is available on Win2000 or XP.
Win9x does not take effect.

and it happens when I run Olly without).
~~~~~~~
What happens

I don't get it. When I run this program in Olly, I get the message "Debugger NOT present". (This happens when I have the Hide debugger plugin activated, and it happens when I run Olly without).

What's the purpose with this?
r4g3
08-29-2004, 02:12 PM
hey hey if anyone else wants test this piece of ... can do that now by proof reading the source code of it, i did great work to rewrite it in C, please value my effort ;\

#include <windows.h>
#pragma comment ( linker, "/ENTRY:main" )
#pragma comment ( linker, "/NODEFAULTLIB:libc" )

int __stdcall main ( int hmod, int reason, int reserved )
{
if ( IsDebuggerPresent () )
MessageBox ( 0, "Test", "Debugger present", MB_OK );
else
MessageBox ( 0, "Test", "Debugger NOT present", MB_OK );
ExitProcess ( 0 );
}
Neitsa
08-29-2004, 02:38 PM
:D Well, This is maybe a joke, but...anyway

I'm sure Limee, that almost 99% of people interested in reverse engineering or cracking know this API...

There's numerous anti-debug tricks. If you want to go a little bit deeper, just rip (i mean Copy/paste) the function code in you program:

MOV EAX,DWORD PTR FS:[18] ;TEB self pointer
MOV EAX,DWORD PTR DS:[EAX+30] ;PEB pointer
MOVZX EAX,BYTE PTR DS:[EAX+2] ;IsDebuggerPresent Flag

you can also separate each line of the above code in your program and set them appart, in this way, this code is less easy to discover (a "middle" cracker will see it very easily).

MOV EAX,DWORD PTR FS:[18]
mov AntiDebug1,eax

....;lot of code

mov eax,AntiDebug1
MOV EAX,DWORD PTR DS:[EAX+30]
mov AntiDebug2,eax

...;lot of code
mov eax,AntiDebug2
MOVZX EAX,BYTE PTR DS:[EAX+2]
mov AntiDebug3,eax

;if eax==1 then a Debugger is here
;just test it far away with some complicated way

You can also remove the access by Self pointer and access directly to PEB

This trick is useless with the Olly "Isdebbuggerpresent" plug since it's testing the above flag.

There's numerous way to deect a debbuger, just do a little google/forum search, you'll find a lot of hits.

Regards, Neitsa.
Kayaker
08-29-2004, 02:44 PM
Ahh, don't pay any attention, we test free of charge here :p

OK, since the IsDebuggerPresent check is easily fooled as noted, how about something a bit more challenging? Though I'm sure it's been done, I haven't seen EPROCESS.DebugPort detection implemented yet, nor subverted...

When a ring3 debugger is attached, this field contains a pointer to the LPC (Local Procedure Call) port used by the debugger. Interestingly this is the same pointer as the ExceptionPort entry of EPROCESS which is always present.

To see the DebugPort field in action, create an exception which will be handled by the debugger, such as calling CloseHandle twice on the same handle (invalid handle exception). Trace into the second CloseHandle -> _NtClose and find the test for a valid DebugPort. If a debugger is attached KeRaiseUserException is called, bypassed if not.

This is a simple driver-based debugger check unrelated to IsDebuggerPresent. It seems to me that subversion (i.e. Olly plugin) might be a bit more difficult since you can't simply zero out the DebugPort field without affecting the debugger operation.

Kayaker
Neitsa
08-29-2004, 02:48 PM
Hi Kayaker,

That's trully interesesting, thanks for sharing !

Regards, Neitsa.
hobgoblin
08-29-2004, 04:14 PM
Agree. Really interesting stuff, Kayaker. :)

to Limee: I tried out your proggie on XP with SP1.
nikolatesla20
08-29-2004, 10:27 PM
Kayaker, are you talking about the typical Process Debug Port? I use this code:

Also, if you are talking ring0 than a driver is needed, and most drivers aren't encrypted (dangerous to encrypt ring 0 code..) so no problem to bypass then.

// Override QueryInformationProcess to return a zero value, so the program
// does not detect our debugger process.
NtQueryInformationAddress = LookupAPIAddress("NtQueryInformationProcess","ntdll.dll");
PlaceBreakPoint(hProcess,NtQueryInformationAddress,QueryInformationHandler);

......

BOOL QueryInformationHandler(HANDLE hProcess, HANDLE hThread)
{

CONTEXT TempContext;
ZeroMemory(&TempContext,sizeof(TempContext));
TempContext.ContextFlags = CONTEXT_CONTROL;
GetThreadContext(hThread,&TempContext);

DWORD ProcessInfoArg = 0;

// get the return address
ReadProcessMemory(hProcess,(LPVOID)TempContext.Esp,&NtQueryInformationReturn,4,NULL);

ReadProcessMemory(hProcess,(LPVOID)((DWORD)TempContext.Esp +8),&ProcessInfoArg,4,NULL);

if (ProcessInfoArg == 0x07)
{
//ShowString("Called ProcessDebugPort");

PlaceBreakPoint(hProcess,NtQueryInformationReturn,QueryInformationReturnHandler);

return TRUE;
} else
return FALSE;
}

......

BOOL QueryInformationReturnHandler(HANDLE hProcess, HANDLE hThread)
{

CONTEXT TempContext;
ZeroMemory(&TempContext,sizeof(TempContext));
TempContext.ContextFlags = CONTEXT_CONTROL;
GetThreadContext(hThread,&TempContext);

// have to edit the value at [esp+8] to zero
DWORD EspValue =0;

//ReadProcessMemory(hProcess,(LPVOID)((DWORD)TempContext.Esp+8),&EspValue,4,NULL);
WriteProcessMemory(hProcess,(LPVOID)((DWORD)TempContext.Esp+8),&EspValue,4,NULL);
return TRUE;
}

This code is part of my tools..it overwrites the PROCESS_DEBUG_PORT call to return false.

-niko20
Limee AKA Lamer
08-29-2004, 11:30 PM
which system does ur program run on?
win 9X or win 2000?

I don't get it. When I run this program in Olly, I get the message "Debugger NOT present". (This happens when I have the Hide debugger plugin activated, and it happens when I run Olly without).
What's the purpose with this?
esther
08-29-2004, 11:46 PM
>Ahh, don't pay any attention, we test free of charge here

Aww he paid you under the table huh? LOL

>which system does ur program run on?
win 9X or win 2000?

hobgoblin Agree. Really interesting stuff, Kayaker.

to Limee: I tried out your proggie on XP with SP1.

Didn't you see it?
Kayaker
08-30-2004, 02:37 AM
Hi nikolatesla,

Yes, I believe it's one and the same DebugPort being checked. The difference is that using NtQueryInformationProcess with the ProcessDebugPort information class 7 only returns a boolean value indicating whether or not a debug port has been set. I still need to trace NtQueryInformationProcess+ProcessDebugPort to see how it's done internally, my static analysis wasn't conclusive.

The ring0 method illustrated in the NtClose code is like this (Win2Ksp3):

:0044F691 xor esi, esi
...
:0044F8BB mov eax, large fs:124h ; KTHREAD
:0044F8C1 mov [ebp+var_88], eax
:0044F8C7 mov eax, [eax+44h] ; [KTHREAD+44h]
:0044F8CA cmp [eax+120h], esi ; DebugPort
:0044F8D0 jz short loc_44F924
:0044F8D2 loc_44F8D2: ; CODE XREF: NtClose+25Dj
:0044F8D2 push 0C0000008h ; Invalid Handle error
:0044F8D7 call KeRaiseUserException

Now here's something peculiar. [KTHREAD+44] is reported to be a pointer to a KPROCESS structure (part of _KAPC_STATE).

0: kd> !kthread
struct _KTHREAD (sizeof=432)
+000 struct _DISPATCHER_HEADER Header
...
+034 struct _KAPC_STATE ApcState
+034 struct _LIST_ENTRY ApcListHead[2]
struct _LIST_ENTRY *Flink
struct _LIST_ENTRY *Blink
+044 struct _KPROCESS *Process
...

If this is the case, the next line in the code would reference [KPROCESS+120h], which doesn't make sense because the sizeof KPROCESS is only 6Ch. Instead, [EPROCESS+120h] *does* exist and makes sense in the context of what can be seen tracing the code. I hope someone can confirm or not this analysis.

The possible driver implemented debugger check code then would be:

mov eax, large fs:124h ; KTHREAD
mov eax, [eax+44h] ; KTHREAD.KAPC_STATE.Process -> PTR EPROCESS
cmp [eax+120h], 0 ; EPROCESS.DebugPort (LPC_PORT_OBJECT)
jnz debugger attached

>dangerous to encrypt ring 0 code..
I think I remember someone mentioning that before, why would that be the case? As long as you know you're not paged out... code is code is code n'est pas?

>Aww he paid you under the table huh?
Sshhh...
nikolatesla20
08-30-2004, 07:26 AM
>dangerous to encrypt ring 0 code..
I think I remember someone mentioning that before, why would that be the case? As long as you know you're not paged out... code is code is code n'est pas?

Well, with the new AMD and/or XP SP2 a driver probably wouldn't be allowed to modify its own code because of memory protection enforcement now. But that remains to be seen.

-nt20
Kayaker
08-30-2004, 10:33 AM
Ah, omega_red just set me straight on my confusion re KPROCESS+120 vs EPROCESS+120. As it turns out it comes to the same thing. Thanks for that :)

There are just too damn many substructures involved and it depends on which structure definition you happen to be looking at at 2am...

Here is the gist of omega-red's explanation resurrected (but using my structure output). Don't know why you deleted your post though.

Cheers,
Kayaker

EPROCESS is an extension of KPROCESS, maybe this will explain it.

struct _EPROCESS (sizeof=648)
+000 struct _KPROCESS Pcb
+000 struct _DISPATCHER_HEADER Header
+000 byte Type
...
+06a byte Spare[2]
--------------------------------> KPROCESS ends
+06c int32 ExitStatus
+070 struct _KEVENT LockEvent
+070 struct _DISPATCHER_HEADER Header
...
+120 void *DebugPort
+124 void *ExceptionPort
...
0rp
08-30-2004, 10:55 AM
hi,

mov eax, large fs:124h ; KTHREAD
mov eax, [eax+44h] ; KTHREAD.KAPC_STATE.Process -> PTR EPROCESS
cmp [eax+120h], 0 ; EPROCESS.DebugPort (LPC_PORT_OBJECT)
jnz debugger attached

where did you found this code?

btw, this is funny to:
0:001> dt _ethread $thread -vb

ntdll!_ETHREAD
struct _ETHREAD, 54 elements, 0x258 bytes
+0x000 Tcb : struct _KTHREAD, 73 elements, 0x1c0 bytes
+0x000 Header : struct _DISPATCHER_HEADER, 6 elements, 0x10 bytes
.....
+0x033 Priority : 127 ''
+0x034 ApcState : struct _KAPC_STATE, 5 elements, 0x18 bytes
+0x000 ApcListHead : (2 elements)
[00] struct _LIST_ENTRY, 2 elements, 0x8 bytes
[ 0x0 - 0x0 ]
+0x000 Flink : (null)
+0x004 Blink : (null)
[01] struct _LIST_ENTRY, 2 elements, 0x8 bytes
[ 0x0 - 0x0 ]
+0x000 Flink : (null)
+0x004 Blink : (null)
+0x010 Process : (null)
+0x014 KernelApcInProgress : 0 ''
....
Kayaker
08-30-2004, 03:48 PM
where did you found this code?

Micro$oft? ;-)

Hi,
Really, it's right there in the NtClose code I showed. If you want to follow it exactly you need to trace an *invalid* CloseHandle which will generate an exception. A valid CloseHandle call follows the same path, just branches a bit earlier.
If Olly is attached it will handle the exception by pausing until you press F7/F8/F9 again, then the invalid CloseHandle call is returned from and execution continues.
It doesn't really matter what structure elements you use to get there, it's just the idea of physically checking EPROCESS.DebugPort.

Not sure why you're getting a null EPROCESS/KPROCESS pointer.
Kayaker
09-01-2004, 12:30 AM
Hi All,

Well, just carrying on with this, a little Ring 3 Debugger detection idea in the spirit of RCE...

Straight from the PSDK description of the CloseHandle API:
"Closing an invalid handle raises an exception when the application is running
under a debugger. This includes closing a handle twice, and using CloseHandle
on a handle returned by the FindFirstFile function."

Calling CloseHandle with an invalid handle forces the debugger, and the user, to handle the ensuing
exception. The *time* taken for CloseHandle to return therefore takes magnitudes of time longer than if a debugger is *not* present, on the order of seconds or milliseconds rather than nanoseconds. By clocking the single API call (using QueryPerformanceCounter) we can then make a *subjective* guess whether or not a debugger is attached.

Here is a rough sketch of what occurs when CloseHandle is called:

Kernel32!CloseHandle ->
ntdll!_ZwClose (INT 2E/SYSENTER) ->
ntoskrnl!_KiSystemService -> _NtClose ->

The first thing done in NtClose is, apparently, to disable kernel APC's by setting
KernelApcDisable to -1. The field is reset to 0 just before returning from NtClose.
This is interesting in terms of the possible reliability of using an API timing check
of any sort. While there is no direct IRQL level raising going on to prevent system
interruption of the code flow, setting this flag may serve a similar purpose, giving
a greater chance of us calculating accurate execution times.

0044F685 mov eax, large fs:124h ; KTHREAD
0044F68B dec dword ptr [eax+0D0h] ; KernelApcDisable
; [KTHREAD+D0h] uint32 KernelApcDisable

Next, ntoskrnl!ExMapHandleToPointer is called, in turn calling ExpLookupHandleTableEntry
and ExLockHandleTableEntry. If a valid handle was passed, a pointer to the HandleTable entry is returned and ExDestroyHandle is called to clear the entry, then returns from CloseHandle directly.

If an *invalid* handle was passed to CloseHandle, the code first tests if a debugger is attached by checking the EPROCESS.DebugPort field, as we noted above.

:0044F691 xor esi, esi
...
:0044F8BB mov eax, large fs:124h ; KTHREAD
:0044F8C1 mov [ebp+var_88], eax
:0044F8C7 mov eax, [eax+44h] ; [KTHREAD+44h] *Process
:0044F8CA cmp [eax+120h], esi ; [EPROCESS+120] *DebugPort
:0044F8D0 jz short loc_44F924
:0044F8D2 loc_44F8D2: ; CODE XREF: NtClose+25Dj
:0044F8D2 push 0C0000008h ; STATUS_INVALID_HANDLE
:0044F8D7 call KeRaiseUserException

; [KTHREAD+44h] is a pointer to the EPROCESS/KPROCESS block for the running application
; +044 struct _KPROCESS *Process

; [EPROCESS+120] is a pointer to EPROCESS.DebugPort (LPC_PORT_OBJECT)
; +120 void *DebugPort

If the DebugPort field is empty, the code simply resets the KernelApcDisable flag and returns STATUS_INVALID_HANDLE back to the user. If not, then KeRaiseUserException is called and the
debugger is forced to handle the exception, and more importantly the *user* is forced to
handle the debugger. This is what takes a lot of time and is of course the basis for the method of detection.

Without a debugger attached, the invalid CloseHandle call in the following code takes
on the order of 10-2 to 10-3 milliseconds on my 2.8GHz machine running Win2Ksp3.
The fastest time I could record using OllyDbg to "Beat the Clock", by having to press
F9 to resume execution after the exception error pause, was around 300 milliseconds.

I make no judgements on how effective this method of debugger detection might be,
just that it exists. Normally timing checks might be considered unreliable, but in
this case the code flow is relatively straightforward, and the KernelApcDisable flag
in NtClose may prevent the system from grabbing any CPU cycles, limiting false readings.

Prevention? Assuming the code is hidden well enough to avoid direct patching, then you're
probably looking at a monitoring hook of some sort on CloseHandle. Either that, or design
(modify?) a debugger which ignores such an exception and returns directly without
requiring user intervention. This may make the timing values too close to be a reliable
indicator. Source attached and follows.

Cheers,
Kayaker

.586
.model flat, stdcall
option casemap:none

include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\kernel32.lib
include \masm32\include\user32.inc
includelib \masm32\lib\user32.lib

include \masm32\include\masm32.inc ; for FPU routine
includelib \masm32\lib\masm32.lib

CTEXT MACRO text:VARARG
LOCAL TxtName
.data
TxtName BYTE text, 0
.code
EXITM <ADDR TxtName>
ENDM

;======
.DATA?
;======

;---------------------
hInstance HINSTANCE ?
hFile HANDLE ?
StringBuff db 64 dup(?)
FloatBuff db 32 dup(?)

lpPerformanceFrequency LARGE_INTEGER <>
CountsPerSec QWORD ?
lpPerformanceCount LARGE_INTEGER <>
StartCount QWORD ?
EndCount QWORD ?
ExecutionTime QWORD ?
msec DWORD ?

;##################################################

;======
.CODE
;======
start:
invoke GetModuleHandle, NULL
mov hInstance,eax

; ==================================================
; Create a dummy file in the current directory
; ==================================================

invoke CreateFile, CTEXT("dummy.txt"), GENERIC_READ, FILE_SHARE_READ, NULL,\
CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL

.if (!eax)
invoke MessageBox, NULL, CTEXT("Error"), CTEXT("Can't create the file"),\
MB_OK+MB_ICONERROR+MB_TASKMODAL+MB_TOPMOST
invoke ExitProcess, 0
.endif

mov hFile, eax

invoke CloseHandle, hFile ; the valid CloseHandle call

; ==================================================
; Initialize our timing check
; ==================================================

finit ; initialize FPU

; -------------------------------------------------------------
; Get the frequency of the high-resolution performance counter
; -------------------------------------------------------------

invoke QueryPerformanceFrequency, ADDR lpPerformanceFrequency

fld qword ptr [lpPerformanceFrequency] ; push result onto top of FPU stack st(0)
fstp qword ptr [CountsPerSec] ; store value in st(0) into variable

; -------------------------------------------------------------
; Get the starting tick value
; -------------------------------------------------------------

invoke QueryPerformanceCounter, ADDR lpPerformanceCount

fld qword ptr [lpPerformanceCount]
fstp qword ptr [StartCount]

; ==================================================
; Call CloseHandle a second time using the same file handle
; Will generate STATUS_INVALID_HANDLE and force
; KeRaiseUserException if debugger attached
; ==================================================

invoke CloseHandle, hFile

; -------------------------------------------------------------
; Get the ending tick value
; -------------------------------------------------------------

invoke QueryPerformanceCounter, ADDR lpPerformanceCount

fld qword ptr [lpPerformanceCount]
fstp qword ptr [EndCount]

; -------------------------------------------------------------
; The time in seconds between the two QueryPerformanceCounter calls is
; (EndCount - StartCount) / CountsPerSec
; -------------------------------------------------------------

fld qword ptr [EndCount] ; load EndCount to st(0)
fsub qword ptr [StartCount] ; sub StartCount from st(0)
fdiv qword ptr [CountsPerSec] ; divide result by CountsPerSec
mov msec, 1000 ; shift decimal place to milliseconds
fimul msec ; multiply result in st(0) by 1000
fstp qword ptr [ExecutionTime] ; store result in st(0) to variable

; -------------------------------------------------------------
; Convert floating point result to a string using the
; masm32lib function FloatToStr
; -------------------------------------------------------------

invoke FloatToStr, qword ptr [ExecutionTime], ADDR FloatBuff

;===============================================

invoke wsprintf, offset StringBuff,\
CTEXT("%s is the elapsed time for CloseHandle"),\
offset FloatBuff

; A direct check of the elapsed time is probably better here, say
; ExecutionTime > 10 milliseconds might be considered a
; positive test for a debugger
;
; Instead, this is a lame check of where the decimal point is in the string
; Since we are forcing FloatToStr to convert milliseconds, anything less
; than 1 ms will be expressed as i.e. "1.0 x 10-3"
; and the decimal point will be the second character

lea eax, offset StringBuff

.if byte ptr [eax+1] != '.'

invoke MessageBox, NULL, offset StringBuff,\
CTEXT("Wise choice, you're using a debugger..."),\
MB_OK+MB_ICONWARNING+MB_TASKMODAL+MB_TOPMOST

.else

invoke MessageBox, NULL, offset StringBuff,\
CTEXT("No debugger detected. Have you tried Olly?"),\
MB_OK+MB_ICONINFORMATION+MB_TASKMODAL+MB_TOPMOST
.endif

invoke ExitProcess, 0

end start
omega_red
09-01-2004, 09:22 AM
Doh, after posting I thought that I am wrong and deleted that instead of waiting for other opinions. Had to be really late night ;)
dELTA
09-01-2004, 11:25 AM
Hehe Kayaker, cool. :cool:
Neitsa
09-01-2004, 04:19 PM
Hello Coders,

Just a question about the subject which currenty intresting us...

Does someone noticed this field in the PEB struct:

//PEB offset
+010 struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters

Now in the _RTL_USER_PROCESS_PARAMETERS struct :

typedef struct _RTL_USER_PROCESS_PARAMETERS {
// (sizeof=656)
+000 uint32 MaximumLength
+004 uint32 Length
+008 uint32 Flags
+00c uint32 DebugFlags <= here !
+010 void *ConsoleHandle
//...[cut]

I've already tested this field with a debugger, but I can't see any change...Maybe someone is aware of what it could be...

Thank you !

Regards, Neitsa.


VB forms
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VB forms
PDA

View Full Version : VB forms

Towelie
08-29-2004, 04:14 PM
hi all,
is there a way to extract VB form's details, the way DeDe do it for delphi?
sarge
08-30-2004, 07:43 AM
Try a search....far be it from me to recommend RACE.

Sarge
Towelie
08-30-2004, 07:51 AM
i already found one, VBReFormer
sarge
08-30-2004, 08:03 AM
Good program, you should find it useful

Sarge
dipeshrestha
08-31-2004, 02:20 AM
i would like to ask some vb related problem in this thread. I have one game developed in VB6. After 2 level it will popup one window saying it is evaluation version and then quit. but i want to continue with this game and try to figure out form where in the program that window is poped up. i bpx on showwindow api and after completion of level 2, i landed on same dll. i continue tracing that code but it doesnt jump to program.exe instead it continues on that dll and finally quit. Can someone guide me how can i disable this type of protection? i have googled this problem but most of the result shows me only serial fishing...

dipeshrestha
peterg70
08-31-2004, 02:36 AM
Sounds like the program has already jumped to the shutdown sequence without returning to the program and you are simply getting a message as it shutdowns.

Try tracing back up and find out what routine is called then do a search for all imports to the main exe you may get lucky

Also try to search for the text string in the main exe and put some breakpoints around those.

Regards
peterg
dipeshrestha
08-31-2004, 05:26 AM
Try tracing back up and find out what routine is called then do a search for all imports to the main exe you may get lucky

Also try to search for the text string in the main exe and put some breakpoints around those.

Hi perterg, thank you for your quick response. when i break on showwindow and F12, i am inside vbvm60.dll i want to know which vb func. has been called from application. i have tried AutoDebug 2.3 and tried all likely function but in vain. :confused: Please give me some idea now to trace back in vb when i landed on that dll. similarly, i have tried using text string but the text string used in that window is not listed in the list... :boo: ... any further suggestion? that apps is driving me mad...

dipeshrestha
Towelie
09-08-2004, 05:05 AM
try to see if any part of the game is using the same procedure from within the .dll, case not, try to patch the dll, (copy it the game's directory) and tell it to retrn just after it has been entered to this procedure. i once pathced a software wrote in vb, using this method, it asked for some file, and i just told it to return from the procedure.


Identify Processor on Smart Card
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Identify Processor on Smart Card
PDA

View Full Version : Identify Processor on Smart Card

bellesdad
08-29-2004, 05:07 PM
Could someone help with the principals involved in getting this infomation, that is identification of the processor on a smart card.
Woodmann
08-29-2004, 05:22 PM
Howdy,

Tell me what I had for dinner :eek:

What does the card do. Is it an atm card, personal id card, usb, parallel, phone, credit card. A little hint would help.

Woodmann
bellesdad
08-29-2004, 05:36 PM
As for what you had for dinner, I'm not shure for it's breakfast here and I've just had Coffee and toast with vegemite on the toast. Would rather of had Eggs and grits but they don't sell grits down here.

As for the card it is Irdeto2 4.1 version for Satellite TV.
bellesdad
08-29-2004, 05:37 PM
Also the card has picture of spongebob on it.
Woodmann
08-29-2004, 05:55 PM
Howdy,

How about some grits with vegemite on them :p
As for the smartcard, it has been awhile since I played
with the sat cards.

Woodmann
bellesdad
08-29-2004, 05:58 PM
My grits were always done with some butter and salt and pepper on them, now for the question can the smart card be connected to soft ice? if so how woud one do this?(Please)
Woodmann
08-29-2004, 06:53 PM
Howdy,

There are utilities that can help you in determining what exactly you have.
What I am not sure of is the interface needed to do this. I would imagine you need a card reader unless todays receivers can interact with a pc.
(shows you how long ago I played with such things :)

If it will interact with a PC then you can do anything you want.
I would think by this time that sat cards have some kind of encryption for their data.

This reminds me of the "good old days" when you could do phreaking and it worked !!!
We then moved onto cable and sat stuff. You could open up a cable/sat receiver and start changing connections until we got the full package.
Ahhhhhh..... the good old days.

Search and you shall find. PM if you need some help ;)

Woodmann


what fuction of this code be done
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > what fuction of this code be done
PDA

View Full Version : what fuction of this code be done

Limee AKA Lamer
08-30-2004, 07:31 AM
004020AF is the Exception Handle entrance

004020AF CALL 402103 --->

00402103 > XOR EAX,EAX
00402105 POP ESI
00402106 MOV EBX,DWORD PTR FS:[EAX]
~~~~~~~~~~~~~~~~~~~~~~~~~~
which point is the EBX Point to??

00402109 MOV EBX,DWORD PTR DS:[EBX]
0040210B LEA ESP,DWORD PTR DS:[EBX-2A]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
especially this instruction,i cant't understand what
fuction does it achieve
When the instruction be stepped,the point of the
context has be changed.
please tell me,why???
0040210E POP EBP
nikolatesla20
08-30-2004, 08:59 AM
The FS register is used in Windows systems for exception handling. As you can see, the first MOV EBX, DWORD PTR FS:[EAX] moves in FS:[0] (since EAX is XORED). This moves in the pointer to the first exception handler structure into EBX.

A good reference to check out to understand this better is found here.

hxxp://www.jorgon.freeserve.co.uk/ExceptFrame.htm

-nt20
naides
08-30-2004, 09:00 AM
004020AF is the Exception Handle entrance

004020AF CALL 402103 --->

00402103 > XOR EAX,EAX EAX is now 0
00402105 POP ESI
00402106 MOV EBX,DWORD PTR FS:[EAX]
~~~~~~~~~~~~~~~~~~~~~~~~~~
which point is the EBX Point to??

It points to The address at FS:[0] Which is the top of the Exeption Handler sturctures chained list

00402109 MOV EBX,DWORD PTR DS:[EBX] But that value is discarded in the next move and replaced to the pointer to the SEH structure, Now EBX points to the structure, before was a pointer to a pointer
0040210B LEA ESP,DWORD PTR DS:[EBX-2A]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Now the Stack Pointer is replaced with data contained in the SEH structure pointed by EBX

especially this instruction,i cant't understand what
fuction does it achieve
When the instruction be stepped,the point of the
context has be changed.
please tell me,why??? I don't Know, need more info
0040210E POP EBP

In red
naides
08-30-2004, 01:45 PM
Sorry, I did not see Nikola's Answer before I posted


wysiwyg 1.09
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > wysiwyg 1.09
PDA

View Full Version : wysiwyg 1.09

conan981
08-30-2004, 02:40 PM
the prog in object uses super sentinel pro dongle. the prog search for the dongle, search if the dongle inserted is correct and if not ask for an upgrade code,bypassed this it ask again for a license ...
anyone can help me with this little proggy?:D
i used a dll (not mine) for emulatin the presence of the dongle, nopped the upgrade code but i'm landing around for the license :(
any contribute is appreciated
gino
JMI
08-30-2004, 05:18 PM
It seems clear that you have not read the FAQ listed in the BIG RED LETTERS. If you had done so, you would know that you have not provided enough information for anyone to be very helpful. What ever else you do, do not, at this point, post the name of your target, but you at least need to identify the dongle type you are working with and the type of OS you are using. It may also be necessary to identify the program you are using to try to defeat the dongle if someone is to try to help you use it effectively.

Regards,
conan981
09-04-2004, 02:55 PM
the dongle is a sentinel pro
the OS is winXP
the prog use to analize the code is Ollydbg
:| sorry


Krobars crackme2 tut
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Krobars crackme2 tut
PDA

View Full Version : Krobars crackme2 tut

Saber
08-30-2004, 03:51 PM
Hi guys (and girls)!

I'm kinda new to this cracking scene.
Been learning from Krobar's great tuts :yay:
But now i'm encounting problems with non-working hmemcpy in WinXP.

Quote from krobar's tut:
bpx hmemcpy and push enter. Now F5 out of softice and click Check it Baby!
:
:
:
After about the 6th RET, we'll land here:

xxxx:0042F4CA 8B45F0 MOV EAX,[EBP-10]
xxxx:0042F4CD 8B55F4 MOV EDX,[EBP-0C]
xxxx:0042F4D0 E82745FDFF CALL 004039FC
xxxx:0042F4D5 751A JNZ 0042F4F1

We see a CALL just before a jump. Well we gonna trace INTO this call. F8 traces INTO a call (push F8 when we on the call line) and we end up here:

xxxx:004039FC 53 PUSH EBX<--we land here
xxxx:004039FD 56 PUSH ESI
xxxx:004039FE 57 PUSH EDI
xxxx:004039FF 89C6 MOV ESI,EAX
xxxx:00403A01 89D7 MOV EDI,EDX
xxxx:00403A03 39D0 CMP EAX,EDX
xxxx:00403A05 0F848F000000 JZ 00403A9A
:end of quote

So, how can I break into this same place of the code:
xxxx:0042F4CA 8B45F0 MOV EAX,[EBP-10]
I've already tried different breakpoints, just doesn't break in any near this.
Is it possible to break like this: "BPX 0042F4CA"? At least it seems not, cos I've tried it several times with different options.
And i've already read some help-files for breakpoints...

Thanks in advance, help noob. :rolleyes:
Harding
08-31-2004, 05:51 AM
There is no such thing as hmemcpy in W2K/XP/2003. You'll have to get some newer tuts or install W9X.
bilbo
08-31-2004, 07:07 AM
I am not able to set a breakpoint over hmemcpy function, it's strange because I saw it in many tutorials... why?
Hmemcpy works only under Windows98 and WindowsME. If you have something else (2k/NT/XP) you need to change your approach to the target.

Hint for Google: +hmemcpy +"point h"

Regards, bilbo
naides
08-31-2004, 08:20 AM
To Bilbo: Has the "point h" that Ricardo described in his tuts worked for you?
So far I have not had any luck, or I am missing something. . .
bilbo
08-31-2004, 11:03 AM
Sorry, naides,
I'm not currently involved in this kind of stuff.

In case you missed it, this thread seems very exhaustive
http://www.exetools.com/forum/showthread.php?t=4323

I can find the sequence of bytes mentioned in the thread above inside the internal function USER32!ECGetText(), in my XP box, which is called from EditWndProc(), so - on a theoretical point of view - it should work!

Regards, bilbo
JMI
08-31-2004, 11:44 AM
And Ricardo posted the tools in that thread this morning. For those challenged by the 3 post rule there, I am attaching those tools here.

Regards,
JMI
08-31-2004, 11:49 AM
Here's the other one, as only one attachment is allowed per post.

Regards,
esther
08-31-2004, 12:43 PM
Don't forget there are point.h tutorials in here

http://biw.rult.at/tuts/ollyguide2.rar
http://biw.rult.at/tuts/Searching.rar
Saber
08-31-2004, 03:12 PM
Thanks for help, guys :yay:
From now on i'm trying to manage on my own.
JMI
08-31-2004, 05:05 PM
That's the attitude. :yay:

Regards,


Question about Softwrap
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question about Softwrap
PDA

View Full Version : Question about Softwrap

cRk
08-30-2004, 08:19 PM
Does anyone here has deal before with a target that is wrapped with Softwrap and also has a Softwrap.dll which looks it handle there registration checks + SICE checks and expiration stuff.... i got a target which needs the IAT and i haven't been able to fix it.. does anyone here has been able to fix IAT for such targets ... i took the .exe to unpack which seems to be easy for my limited knowledge so far.. it has last section named as .Xlock

ok the good part is i have searched many times and without finding anything for this kind of packed way .... isn't the normal .locked that all tuts around mention...

if someone is interested to have a look please send me a PM and i'll send you the download details..

btw i'm waiting for JMI critics :D

Regards
JMI
08-30-2004, 08:34 PM
What are you waiting for me to criticize? You said you searched and didn't find anything and that is what nearly always prevents a suggesting that searching will help solve the problem. :yay: You also said for those interested in the target to sent you a PM and that, also, is what we ask members to do. So you get two points for proper form. ;)

Regards,
cRk
09-02-2004, 02:38 PM
at least i made a good dump of it and set the right OEP.. Imprec 1.6 can't find any good entry for IAT :( and i fail to rebuild manually.. i need someone experienced that knows this wrapper to explain me.. how to do it... this is not a crack request. it's not fail to try this just couple of time and for only 5 minutes..

Regards
Hopcode
09-02-2004, 07:01 PM
Softwrap is quite easy to unpack.

On the other hand, their "protection" is protected by another commercial protector which is Xlock. That's why you have that section.

Basically, you dont' want to deal with Xlock to unpack a softwraped target.
Don't confuse the target exe you want to unpack.

Xlock is just here to protect lame software code :)
cRk
09-03-2004, 10:07 AM
you dont' want to deal with Xlock to unpack a softwraped target.

the true is .. i have to deal with both.... both .. the main .exe + the dll have that section means both are packed with this garbage.. other stuff about softwrap is quite easy to deal with i know /// if you're interested to try it .. let me know .. and i'll send you target details on PM

using some sence ..i assume the .Xlock section + Softwrap of the exe calls the Softwrap.dll before reaching the OEP .. i assume the .dll takes me to the OEP if still trial days left after pressing the OK button of the nag ... if this .dll as well wouldn't be packed the job could be easier to reverse it to kill nag + trial .. but also the exe will do an integrity check against any changes there. so i believe the easier short way is to unpack the main exe to remove all this and let the program run without Xlock/softwrap. as i wrote i already got a dumped exe with good OEP .. i'm stuck with the IAT .. later i found out that Peid also gives right OEP for the target.

Regards
xastey
09-03-2004, 03:43 PM
here are some good tuts
http://mxbnet.host.sk/prog/unpacking/softwrap.htm
http://myhome.hanafos.com/~comgod/com41.htm
cRk
09-03-2004, 03:51 PM
i see you haven't read well what i have posted so far.. this isn't my case.. i ain't got any .locked file ..if that would be my case i wouldn't bother anyone... the problem remains with Xlock/IAT

Regards
LaptoniC
09-03-2004, 05:48 PM
I saw some softwrap target that have not packed softwrap.dll.So if this is the case you can patch the softwrap.dll so you can return good value(granted ??)I dont remember well but its crc algo also was simple so you can patch DLL and return good values and even you can patch exe from this dll because you have the rights to do.Just my 2 cents.
cRk
09-03-2004, 09:35 PM
it's packed.. what about explaining how to inline patch this dll instead of been arrogant! didn't i wrote the dll is also packed with a .Xlock Section

Just my 2 cents.

maybe you would like to try the target and test your skill against it and explain how to patch it ?

there's nothing to patch on the exe.. it's just packed with Xlock :mad:
Js
09-04-2004, 03:04 AM
instead of been arrogant!

I don't think he was being arrogant, seems like he was hinting a non-packed dll might be found and it may be possible to replace the packed dll with an non-packed and patched one, seems like a reasonable suggestion to me.
cRk
09-04-2004, 11:28 AM
he was hinting a non-packed dll might be found and it may be possible to replace the packed dll with an non-packed

i believe he meaned it was going to b easy to patch if the dll wouldn't be packed.. and it's true but its packed in this case.. is not bad idea to find this .dll not packed and replace it.. anyone would like to share it?

LaptoniC do you have it ?
LaptoniC
09-04-2004, 03:46 PM
Of course I have non packed dll.Do you think I am speculating ?.I really dont talk antyhing that have no idea about it.Maybe because I am arrogant :) Just PM me and I will send the url of the software that have unpacked softwrap.dll
cRk
09-05-2004, 01:39 PM
the program you told me is not softwrapped in anyway .. is there any other you know or you have the one tha has softwrap.dll ??
Js
09-05-2004, 02:05 PM
I'm curious, is your target vb?, never came across a softwrap(ed) app that wasn't. I know your targets a 20mb d/l, too big for me but I did unpack xpsmoker (vb) thats wrapped with new(ish) softwrap. Oh and you might consider ollydb for softwrap if you are on w2000/xp its so much simpler.
LaptoniC
09-05-2004, 06:29 PM
There are two versions at that page one is adwared and other is day limited trial please look carefully.First click related page on products page then look Download title for the file.I am not talking about the download link at the main page :)
cRk
09-06-2004, 09:20 AM
it's a Microsoft Visual C++ 6.0 game (OEP: 0043C66C)...can be run only 3 times and has 10 minutes for playing only. i haven't enought time lately to start with Olly ..i got many good tuts for Olly. i will read them all and start using Olly when i got some more free time.. using SICE with this target is not simple i know. i was true when i guess the integrity check stuff . the exe check the integrity of the dll and maybe not all these Softwrap.dll are the same or work in the same way for difference APP... code difference,OEP...etc ..i see that softwrap made it harder to reverse in this way.. not softwrap in fact but Xlock .. if the exe have all there could be easily defeated witha simple loader.. but they put all trial crap on this .dll .. which also the exe detect its valid crc check against any modification.. and as i see not Experienced reversers has put much attention on this Xlock stuff? ... maybe because is not too comercial.. but i haven't found any tuts about it specially for fixing IAT. i found this about softwrap.dll could be of interest for someone --> hxx//www.softwrap.com/faq4_v4.asp

if still someone is interested to help me and explain me fixing this one i will be really much apreciated.

Regards


Low Level Graphics Programming Project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Low Level Graphics Programming Project
PDA

View Full Version : Low Level Graphics Programming Project

SynApsus
08-31-2004, 06:09 AM
Hello.
I'm new in driver coding, I have yet some useful ( or not ) drivers written. But now i'm faced with a problem for which I don't have the answer.
I want to display a colored and formatted text on the screen using my driver, a text who will be displayed OVER all the other windows, even Fullscreen ones.
If someone could help me, by telling me what Native Apis can do that, for example... or just a link to a sourcecode or a compiled driver ( NT/2k/XP of course ) which I will be able to analyse.

[EDIT JMI: As this Thread progressed it was suggested that a collaberative effort might be made to accomplish some of the things discussed here and I suggested it might make a good Mini-Project. At the parties request, I have moved it here, in the hope those interested and qualified might contribute to that effort.]
bilbo
08-31-2004, 07:21 AM
Are you searching for an OSD (On Screen Display)?
Look at http://www.codeproject.com/w2k/forecast.asp

Regards, bilbo
disavowed
08-31-2004, 07:30 AM
SynApsus, siwvid.sys does what you want (when it's used to display softice in a popup window, as opposed to fullscreen)
nikolatesla20
08-31-2004, 08:01 AM
I think you need to write a video mini-driver. A mini-driver plugs into the larger driver architecture of windows and allows you to do such specialized tasks as video. Most video drivers and sound card drivers are mini-class drivers. If you have the DDK, then you should be looking in the class drivers sections. It's a very steep learning curve so get out some coffee and have fun!

-nt20
Silver
08-31-2004, 08:49 AM
The only GDI/Windows graphics book you will ever need:

Windows Graphics Programming Win32 GDI and DirectDraw®
Feng Yuan
Publisher: Prentice Hall PTR
ISBN: 0-13-086985-6

And it's floating around in .chm format too.
SynApsus
08-31-2004, 04:13 PM
Thanks to all, especially for this excellent book which talks about Ring3 AND Ring0 graphical programming.
bilbo, I tried before to do this with a topmost window in ring3 level... it is not convenient for me. It is a timer window ( injected in a process ) whose text is modified every second, and if the process who displays this text is resource-greedy, the seconds do not ravel as normal ( every real second, they come too late )
More, if this text is displayed in a process who is in fullscreen mode, the fullscreen is disabled to display my text. I want she stays and the text to be displayed REALLY at the top. So, Ring0 :)

If you have other links or other help to give, that would be very cool : the book is very interesting but not very complete about ring0 graphic programming. It just talks a little about it.

Excuse me for my english, I try to do as better as I can.
bilbo
09-03-2004, 09:15 AM
Well, in that case disavowed is right... siwvid.sys has complete control of the current screen, because it knows the current pixel format and the current address at which the video memory is mapped.

How it obtains this info? It reads from the registry a list of the video drivers used by the system (kernel DLLs), and hooks their entry point, which is DrvEnableDriver(), using a powerful hooking engine.
In this way it obtains a pointer to the driver structure DRVENABLEDATA, and it can hooks all the interface functions exported by the driver.

Regards, bilbo
user
09-18-2004, 10:24 AM
SynApsus, siwvid.sys does what you want (when it's used to display softice in a popup window, as opposed to fullscreen)it's the exact opposite, ddraw knowledge is inside ntice itself, siwvid is the legacy video mode switching stuff.
homersux
09-27-2004, 04:51 PM
I am interested in this aspect of graphics programming. Mainly how do you float a window inside a full screen mode game. This is probably doable with directx if the game itself uses directx engine. Could someone point me to some examples, pointers or tuts?

thx!
Silver
09-28-2004, 12:54 PM
Homer, can you phrase your question a bit differently? "float a window"? You can make dialogs etc appear within a DX fullscreen app, but it's kludgy. The best way to make it appear as though a normal window is visible over a DX full screen app is to draw the window through the GDI normally, then blit it to a DX surface and use the surface as a texturemap for an RHW quad. I code a lot of DX/D3D stuff...
homersux
10-03-2004, 01:56 PM
Silver, something like an in game maphack is the kind of stuff I am aiming at. It's like an overlaying window on top of the full screen game interface.
Silver
10-04-2004, 07:12 AM
Hm, in that case I'd inject some code based around DrawPrimitiveUP using RHW to make life easy. Shouldn't be too difficult, providing you make absolutely sure to get the calls inside a BeginScene()/EndScene() segment, and not to change (or at least reset) the renderstates after your rendering. Thinking about it, your best bet would be to add you code immediately before the Present() call, which would allow you to mess with the transforms and the renderstates without having to reset them. Shaders and multipass rendering are a no-no for this however.

If you have a live example, I'll be happy to code you a mini-DX app in C that you can rip the compiled code from to inject into something - would save you learning any DX (if you don't know any already?)...
homersux
10-08-2004, 10:24 AM
Silver, I found it hard to understand what you just said in your previous message even though I am a code injection guru, that just shows you how much I know about directX stuff :) Since I am fairly certain that a full screen mode windows media player uses directX (or not?), maybe you can demonstrate how to draw a text clock window over it? Besides being a demo, it's got some practical use as well.
Silver
10-09-2004, 10:42 AM
Hehe :D This could be interesting, because I'm a DirectX guru but firmly in the "noob" category for code injection.

Here's my thoughts, if we can work together on this. I'll code a simple app in C++ (DX in asm is a bit of an arse because of the COM and object issues) that uses DX to draw something (a clock is fine). I'll tag the function that does the actual clock drawing with some easy to locate code. I'll give you the exe, and you can pull the disasm of the function out of it. I'll then code a second app that does some D3D rendering (a cube or something), which we can use as a target. I'll then help you find the right location in the assembled target to call my clock code, and you can handle the injection part of it. End result should be the target with the clock code injected into it.

Windows Media Player is not necessarily a good target for our first attempt at this - it doesn't actually use D3D, it uses DShow. In simple terms, D3D is the 2D and 3D rendering interface for the DirectX suite, whereas DShow is the video rendering interface (hence the xvid/ffdshow *filter* - they are DShow filters). We can't use DShow COM methods to draw anything with ease, we need to use D3D. It's possible that WMP imports the D3D methods, but I'd rather try it on a sample exe where we can control both the target and the injection code - then move onto a live target.

If that makes sense to you, I'll go ahead and do it. If you have other ideas let me know - I'm really interested to see how you inject this code into a working sample, and would really like to try this little project...
JMI
10-09-2004, 11:05 AM
Give some thought to making this a "mini-project" and moving the effort into that Forum and you might attract some additional help from others with some specialized knowledge on these topics. Just a thought. :yay:

Regards,
homersux
10-09-2004, 07:33 PM
Here's my thoughts, if we can work together on this. I'll code a simple app in C++ (DX in asm is a bit of an arse because of the COM and object issues) that uses DX to draw something (a clock is fine). I'll tag the function that does the actual clock drawing with some easy to locate code. I'll give you the exe, and you can pull the disasm of the function out of it. I'll then code a second app that does some D3D rendering (a cube or something), which we can use as a target. I'll then help you find the right location in the assembled target to call my clock code, and you can handle the injection part of it. End result should be the target with the clock code injected into it.
--
Silver, this sounds like a fine plan to me. Please code 2 apps like you said and tell me which code is to be injected into which at what function entry. It's easy for me to dynamically inject code.

JMI, move this to mini project is a good idea.
JMI
10-09-2004, 08:03 PM
Move to the Mini-Project Forum accomplished. I added a note to the first post explaining why it is here. :yay: Good luck on your efforts.

Regards,
nikolatesla20
10-09-2004, 09:16 PM
I've done this sort of work before - I made a game cheat that changed the Direct3D calls to change the draw mode to D3D_WIREFRAME, so you could see thru everything.

Hooking DirectX is the best way to go with this, it's easily possible and it actually used a lot for "cheats" as well as added functionality. Using an injection DLL would allow you to do some pretty elaborate things.

-nt20
homersux
10-09-2004, 10:57 PM
What's the best way to learn directX? Graphics programming is really not my status quo.
Silver
10-10-2004, 08:55 AM
Okay, I'll get on with coding those today and should be able to upload them later (bit busy right now).

homersux, learning D3D (DX is D3D, Dshow, DInput, Dplay, DSound etc, so for the graphics side just concentrate on D3D) is a fine art. Some people pick it up quickly, others find it impossible. It took me probably about a year to get good at it. The main issue is that you have to learn so much theory before you can even start putting it into practice, and the theory is way left of any other type of coding... There are a lot of good tutorial sites on the net though.
Silver
10-10-2004, 09:44 AM
Okay, here we go. I've attached a zip to this message containing 2 exes and a bitmap. The bitmap is used for the texturemapping and is a bit irrelevant, I just used an old test app of mine for speed. They are both DX8 for no reason, I can convert to DX9 if you'd prefer but I didn't know what SDK or OS you have.

Target.exe is our target. Locate the push and call to MessageBox() starting at 4043AD (the params are something like "NOP THIS CALL" so you know you've got the right one). Nop that call, run the exe and you'll see a 3d cube. You need to inject your code precisely at this location, do not overwrite any bytes other than the MessageBox related stuff. The code immediately after it is D3D related that flips the backbuffer.

Inject.exe is our source. Locate the push and call to MessageBox() starting at 4316AD (again, params make it obvious so check the stack). Nop the call, you should see a shaded triangle drawn in the top left of the window. This Messagebox call is at the very top of the function that draws the triangle. The C++ code looks like this:

HRESULT InjectThis(LPDIRECT3DDEVICE8 pDevice)
{
MessageBox(NULL, "INJECT THIS CALL CODE", "SOURCE", MB_OK);

DWORD dwFVF_SIMPLEVERTEX = (D3DFVF_XYZRHW | D3DFVF_DIFFUSE);
typedef struct _tagSimpleVertex
{
float x,y,z;
float rhw;
D3DCOLOR dwDiffuse;
} SIMPLEVERTEX;

; snipped, setting up a local array for the triangle here

pDevice->SetVertexShader(dwFVF_SIMPLEVERTEX);
pDevice->DrawPrimitiveUP(D3DPT_TRIANGLELIST, 1, Triangle, sizeof(SIMPLEVERTEX));

return S_OK;
}

This code is entirely self contained, except for 1 parameter - the function param LPDIRECT3DDEVICE8. This is a pointer to the D3D COM object that lets us talk to D3D. I think this may be an issue, but I'll let you comment on my explanation. Note where this call occurs, immediately before calls to IDirect3DDevice8::EndScene() and IDirect3DDevice8::Present() (you'll spot the Present() call by 4 NULLs pushed to the stack).

When an app sets up D3D COM interfaces, it calls Direct3DCreate8() to intialise a COM interface, this is a wrapper call for CoCreateblahwhateveritis(). This call returns a pointer to a D3D top level COM object IDirect3D8. That pointer is then used to detect the capabilities of the graphics card via various COM method calls (known as D3DCAPS), and then to create the D3D device using IDirect3D8::CreateDevice(). IDirect3D8::CreateDevice() returns a pointer to a new COM object of the IDirect3DDevice8 interface. LPDIRECT3DDEVICE8 is a typedef for a pointer to a pointer to an IDirect3DDevice8 interface. It is this pointer, the device pointer, that we have to use to access all of D3D's methods. The issue we have is that there is no way to retrieve this interface pointer without a lot of messing. The normal process for a D3D app is that at some point it will call IDirect3D8::CreateDevice() and store the returned pointer in either a global variable, or in a class wrapper (probably as a static member or a singleton) for use by the rest of the app. So, in my very limited experience of code injection I think nikolatesla is correct in that we need to hook the CreateDevice() call to store the device pointer for ourselves.

Sorry if I just taught you to suck eggs, but wanted to be clear.

So, I see the next tasks as:
1. Rip the function from inject.exe
2. Make "necessary adjustments" to target.exe to retrieve the device pointer
3. Inject the function from inject.exe to target.exe
4. Supply the device pointer to the injected function.

Once we've done this, we can start extending the code a bit.

And this is where I check out and hand over to you :D :yay:
nikolatesla20
10-10-2004, 05:45 PM
This is an interesting project, I'll definitely join in. I've done a bit of this type of work before.

IDirect3D8::CreateDevice() returns a pointer to a new COM object of the IDirect3DDevice8 interface. LPDIRECT3DDEVICE8 is a typedef for a pointer to a pointer to an IDirect3DDevice8 interface. It is this pointer, the device pointer, that we have to use to access all of D3D's methods. The issue we have is that there is no way to retrieve this interface pointer without a lot of messing. The normal process for a D3D app is that at some point it will call IDirect3D8::CreateDevice() and store the returned pointer in either a global variable

Since there is almost always a single instance of a Direct3D object, you can just disasm the code and find where EAX gets stored after the Direct3DCreate8 call.

push 0DCh
.text:004039CA call Direct3DCreate8
.text:004039CF mov dword_4D95A0, eax
.text:004039D4 cmp dword_4D95A0, 0

Notice here it's in a global variable at 004D95A0. Hence now all you need to know if the offset into this pointer (this pointer is actually a pointer to a vtable) and you can hook BeginScene. After a BeginScene call you can do any of your own code you want, although perhaps for drawing over the top of everything you might want to hook EndScene and add your drawing.

At one time I actually had record of the function offsets for BeginScene and EndScene, etc. But who knows where those notes are now :).

"PunkBuster" uses this type of technique to draw additional menus, etc. (at least it used to)

-nt20
nikolatesla20
10-10-2004, 10:00 PM
Direct3DCreate8 returns pointer to IDirect3D8 interface:

general interface method invocation goes as follows:

mov eax, dword ptr 0xXXXXXXXX <- XXXXXXXX is global interface ptr location
mov edx, [eax] <- get vtable
mov ebx, dword ptr 0xXXXXXXXX <- interface ptr again, here it's "this" ptr.
push ebx
call dword ptr [edx + 0xXXh] < - call method in vtable.

We need to get Direct3DDevice interface ptr, so:

IDirect3D8 interface exposes function CreateDevice()

CreateDevice call = IDirect3D8 [vtable + 0x3Ch]

Device object ptr is returned in address ptr [esp+0x1Ch] inside CreateDevice call.

In the demo "Target.exe", the device ptr is stored at 0x004D95A4

to get vtable of the device ptr:

mov eax, dword 0x<device ptr location>
mov ebx, [eax] <- we now have vtable ptr. in ebx

to call a function:

call dword ptr [ebx+0xXXh] < - call vtable method

Direct3DDevice offsets:

BeginScene - [vtable + 0x88h]
GetBackBuffer - [vtable + 0x40h]
SetMaterial - [vtable + 0xA8h]
SetLight - [vtable + 0xB0h]
SetTransform - [vtable + 0x94h]
EndScene - [vtable + 0x3Ch]
Present ???? [vtable + 0x8Ch]
DrawPrimitive - [vtable + 0x118h]
SetTexture - [vtable + 0xF4h]

If you have a Device pointer, you can invoke these functions using these offsets into that pointer.

-nt20
Silver
10-11-2004, 08:58 AM
nikolatesla, that's very interesting, thanks for the info. One thing to add, multiple IDirect3DDevice8 interface instances is usually likely in either multi-monitor configurations or for some (strangely coded) utility apps that use multiple windows/views (think 3D modelling editor).

To add, some further functions that will be of use to us a pseudo-game cheat coders (all IDirect3DDevice8:: methods):

SetRenderState()
SetVertexShader()
DrawPrimitiveUP()
Clear()

I'd recommend that DrawPrimitiveUP() is always used in preference to DrawPrimitive for this. Although it's a big performance hit, for our purposes it's going to become quite awkward to manage vertex buffer swapping and binding through injection.

Some clarification of BeginScene(), EndScene() and Present(). BeginScene (BS) is used to tell D3D that you're about to start rendering to the backbuffer, so all locks should be checked. BS can be called automatically by some methods, especially D3DX utility library methods, therefore searching for BS calls is not necessarily going to find the "right" one. EndScene (ES) is used to close a BS block, and tells D3D that locks on the surface can be released. Present() tells D3D to page flip the back buffer to the front buffer for on-screen display. It's the last rendering action completed on every iteration of the rendering loop.

Where this becomes slightly more complex is that certain state changes cannot take place inside a BS/ES block. For example, you cannot change the rendertarget inside one of these blocks. There is also a performance hit for every BS/ES call, and Microsoft recommend you keep to 1 (or as few) BS/ES blocks where possible. This leads onto another consideration - multipass rendering. It's very common for apps to use multipass rendering to achieve certain effects. An explanation of why would take too long, but in summary it means that it's quite likely to find a call to a Render() function, and this function is called several times using switch() type functionality before Present() is called.

Think that's all I have relevant to contribute for the moment.
homersux
10-11-2004, 10:21 AM
Silver, the target.exe crashed my computer. :) I hope you didn't plant anything evil in that thing. The size is 904KB, amazingly big for such a simple application. Also it'd be useful if you could also include the source code and project file since I have no idea what programming semantics there is for d3d programming.
--
edit, the target.exe keeps crashing my computer, there is not much I can do. :( win2k, directx 9c, and july 2004 directx (9c update) sdk here.
nikolatesla20
10-11-2004, 11:23 AM
Well, I woudn't recommend hooking the actual functions themselves generically, rather it might be better to just disasm the app and now you could search for the Correct areas you want to inject.

BUT:
As far as multiple devices, I don't know of any game at this time that supports them. Multipass is a good argument, but you could simply find in the disasm where you wanted to hook your code - besides, in a multipass you might wish to render your object each time, so it didn't get erased by one of the multipasses. I disasmed Raven Shield, and even that game only contained one BeginScene call. Multipass is really the only time you'll get more than one BeginScene(), since most game engines are built around an object tree:

BeginScene()

RenderAllObjects walking the list of objects

EndScene()

is usually the way it's done.

If you want to change the state to wireframe, etc, you have to override the SetRenderState like you mentioned. That's actually a good function to also record down.

You'll always have to know the function offsets somehow.

In the DX9 SDK I have now, I got these just this morning. Just throw messageboxes in your code before any Direct3DDevice call, and then disasm it to find where the call goes

That's the overall problem, is sometimes these offsets will be application specific as well. (Or usually DX version specific)

BeginScene [ vtable + 0xA4h]
Present [vtable + 0x44h]
SetRenderState [vtable + 0xE4h]
EndScene [vtable + 0xA8h]
GetBackBuffer [vtable + 0x48h]

The purpose of using these pointers isn't just to have the ability to call them, it's also so you can find in the code where you should override with your own code. With an already compiled EXE you should be able to use the Direct3DCreate8 call, which is the only Direct3D import, and walk from there to find the CreateDevice call, and then use the Device ptr to find where BeginScene(), etc get called. You should learn to be able to do this manually in your disassembler. If you can't do this, you won't be able to inject any code in your target. Step one is recognizing these common structures and offsets to calls so you can find the location you need to hook into.

-nt20
Silver
10-11-2004, 12:22 PM
nikolatesla, thanks, I understand better now. I'll have a go at this tomorrow when I have some more time.

I have to raise one objection to what you said though. It's an absolute requirement of D3D that you cannot be in a BeginScene/EndScene block when changing the rendertarget. That means that any effects such as cubic environment mapping, spheremapping etc will show at least 2 blocks. How common they are in commercial games, I don't know. They are very common in demos/intros.

homer, I've attached a new zip to this message. It contains the inject.exe and the target.exe with a parameter slightly altered. I'm guessing the crash was because your card doesn't support lockable backbuffers properly, so please try the inject.exe out (you can just OK the messageboxes to make sure it works). I've also included a VC6 workspace for the inject.exe code. It will show you the structure of a D3D app, the calls and setup sequence and how I rendered a simple tri in the injection function. I didn't bother including the source for the lit cube because that contains lots of extra rubbish that just confuses the issue.

Let me know if you still have issues with getting the code running. If you have Visual C, you can load the inject workspace, comment out the messagebox call then run it with debug to see any debug spew that might indicate a problem.

The large size of the previous exe was because I built it as debug, sorry. These are built as release but are the same code, so you'll be able to find the messagebox calls just like before.
nikolatesla20
10-11-2004, 09:22 PM
Here's an injected version I made,

I added a new section to the PE with LordPE, ripped the code bytes from inject EXE, and put them in the new section. Then I NOPPED the MsgBox code in the target, and changed it to:

mov eax, 0x44c764
mov ecx, [eax]
push ecx
call 00450000
pop ecx
nop
nop
nop
nop
<nop until good code>

And this works fine. It's easier since the inject code uses all local variables :), and it gets the device object ptr passed in as an argument, so it's not too bad.

Apparently however Direct3D does not care rendering with different vertex shaders and weird stuff happens. While I get both to draw, the cube jerks around strangely.

-nt20
Silver
10-12-2004, 07:07 AM
Nice job. I'm not sure why it's jerking on your machine - does the original cube on its own exhibit the same symptoms (eg: nop the messagebox in target.exe and run it like that)? It might be your gfx card, an incompatibility with the D3DCAPS, or it might be something I forgot on the D3D side.

I'll run it on my d3d coding machine when I get home and see what I can figure out. I'll poke around in your targetinjected.exe deadlist too :D

Here's another thought on this miniproject. It was easier for you to inject this code because of the (effectively) dead bytes where the Messagebox() call was. How would you go about injecting this same code if you didn't have the dead bytes to use? Bearing in mind, you're very restricted on where you can call your injected code (unless you do something cunning like render the injected gfx with a high Z-bias so they always get drawn on top...). You could move bigger chunks of code into the injected call, but then you've got to worry about vars being used...

So, I propose the next stage for this is to add keyboard input. I'll code another inject.exe that (for example) sets wireframe, point and fill mode rendering. Task is to manipulate the messageloop to trap a keypress, and call the injected function to change the rendering mode (for example, pressing + cycles between point, line and fillmode). Unless anyone has better ideas :)
nikolatesla20
10-12-2004, 08:51 AM
Nope, nothing wrong with my video card, I got latest Nvidia stuff, the target.exe runs fine on its own.

Actually if you NOP the messagebox the cube rotates weird period, it jerks around, so I think it's a problem with your code , sorry :p

Oh, and about rendering with a high z-bias: You don't need to do this if you set the VertexShader to use 2D only coordinates. The renderer then will draw stuff straight up on the viewport, and won't do any depth calculation on it. (Set your FVF to be already-transformed-coordinates).

I'd say for injection purposes you can pretty much take over anywhere betwen BeginScene() and EndScene() if you want, depending on what you want to do. For example, if you are drawing a UI over the top, you could probably get away with drawing it at any time, and use 2D FVF's. But if you want to make walls transparent, but people not, you'll have to find in the code where walls get drawn and do your work there. If you want everything transparent, it's easy to just find a SetRenderState anywhere and play with it, keep playing with RenderStates you find until you hit the right one. (You can narrow it down by looking at the arguments that get passed to SetRenderState to see if they are D3DRS_SRCBLEND or DESTBLEND).

As you can see from this newly attached example, vertices that are FVF's with XYZRWH will not get sent thru the 3D translation engine (they are assumed to already be translated to screen coordinates), therefore they draw on top of everything else if you have a z = 0.0f. In the example the triangle is now drawn over the top of the rotating cube.

-nt20
homersux
10-12-2004, 10:14 AM
ok, new target.exe works. let's see now what was the original goal we wanted to achieve? UI ontop of a d3d rendering? :)

--
Geez, man there is something wrong with your target.exe, the first time it executes fine but it crashes on the 2nd run. I am using a laptop without a real 3d card. But it's probably got bugs in the code. I have done basically the same thing nico has done and the code injection is pretty easy. But the question is if this is the kind of stuff that works for a commercial game?

Ok after rebooting about 4-5 times, :( this is my version of injected target, iI added a new section .inj 4k bytes long and copy/pasted injecthere code. It works fine and shows both cube and triangle.
Silver
10-12-2004, 12:59 PM
Actually if you NOP the messagebox the cube rotates weird period, it jerks around, so I think it's a problem with your code , sorry

hrm, if I knew my code was on trial, I'd never have started ;) . Bit strange though, works fine here. This is one problem with D3D, if you don't set up the caps properly it won't work everywhere. What GFX card do you have?

Oh, and about rendering with a high z-bias: You don't need to do this if you set the VertexShader to use 2D only coordinates. <snip> For example, if you are drawing a UI over the top, you could probably get away with drawing it at any time, and use 2D FVF's

Yup, but then you are completely restricted to 2D stuff, so can't do cool things like put a minature version of a 3D map in the corner :)

therefore they draw on top of everything else if you have a z = 0.0f

Actually they'll be drawn on top anyway, the Z component is ignored, it's the RHW component of the FVF/vertex struct that matters.

homer: If you've just got a built in card, it's definately the caps that are the problem. It's awkward and long winded to set up all the caps properly , you effectively have to test each cap, check the return result then use that result to set the actual cap. And there's a hell of a lot of caps - if you have the SDK, look for the DirectX Caps Viewer in the DX Utilities dir. So in summary, I was lazy and didn't set them up properly :rolleyes:

But the question is if this is the kind of stuff that works for a commercial game

Yes, it does. Believe it or not I've coded a commercial game (and on the basis of this crappy code, feel free to not believe it :D ) and the major difference between a game and this sample is that a game will have some kind of base engine to separate the "gameplay" code from the game mechanics, so the D3D device creation will be sandwiched inside a load of other junk. I'm a better coder than reverser, honest ;)
homersux
10-12-2004, 01:29 PM
It seems the difficulty in a real world example is:

1) finding the location of the p_Device, in this example, it's straightforward once the target is disassembled (it's got a similar code structure with inject).

2) locating a point for code injection, somewhere between BeginScene and EndScene. In this example, we used static code inject, 2 cons 1) exe integraty check will dismiss the attempt 2) needs to rewrite part of original exe or save/restore in new code segment--lots of
code rewrite 3) injected code may be complicated and has non-local data references, in our exercise inject code is nice and compact :)

So if I was to attack something more seriously, it means I'll be using dynamic code injection and will patch code on the fly. The added benefit is load/unload patch at will.
nikolatesla20
10-12-2004, 02:27 PM
Well, homersux, the only difference with dynamic injection is:

1. Allocate memory in the other process with VirtualAllocEX
2. Relocate any memory location-dependant code in your injection snippet to compensate for location of remote memory.
3. Inject the code (write it) into the remote memory
4. Write out the small bit of hook code that causes the EXE to jump
to your newly injected code

It's that simple. Relocation is actually the hardest and boringist part (if you have to relocate addresses in your injection code).

Yes, you pretty much always have to either disasm or debug the game live so you can find the appropriate place to inject.

You could write more advanced code that would start the game EXE and then hook into its Direct3D functions so it would work on more than one game, but it still would be D3D version dependent (since the offsets to methods will be different between an IDirect3D8 and IDirect3D9 interface), and also is a bit more work. But it can be done. In fact, since DirectX is COM based, even though the interfaces are different, you should be able to query the DirectX 9 interface for a DirectX 8 interface pointer thru QueryInterface(). QueryInterface() should be the very first function pointer in the vtable. If you know the interface ID (IID) of the IDirectX8 interface, you could write your code to use DirectX 8 and just always query for this interface in your injection.

However, this is just theory right now :)

Silver: I'm using a Nvidia GeForce2 Ti at work, and a NVidia GeForce4 440MX at home, and it acts the same on both systems. I'll check my modded code again.

-nt20
homersux
10-12-2004, 05:26 PM
silver, what're the differences between window mode and full screen d3d? It seems window mode uses a backbuffer or some sort just from reading your code.
Silver
10-14-2004, 06:33 AM
what're the differences between window mode and full screen d3d
Well the main difference is that in windowed mode, the D3D front and back buffer surface format must be configured to be the same as the Windows desktop format (bit depth), as well as other params like refresh rate etc. In full-screen mode you have complete control over all display parameters.

Both windowed and fullscreen use a backbuffer and frontbuffer page flipping system, it's just windowed mode is far more dependant on Windows...

nikolatesla, you said:
If you know the interface ID (IID) of the IDirectX8 interface, you could write your code to use DirectX 8 and just always query for this interface in your injection.
Not sure I follow, from the context you wrote this in are you saying that you can use DX8 interfaces for a DX9 injection/hack? If so, I'd disagree.

As a side thought, in a real world example I would think a good approach would be to locate the app's d3d engine wrapper functions and to call those directly. Because doing basic things like drawing boxes and blitting text is such a pain with D3D, every non-trivial app I know of uses at least a wrapper of some sort (eg, MyEngine::TextOut(...) wraps text blitting functions etc), if not a full engine. It would make sense to use these functions where possible, to minimize the amount of work you would have to do in the injected code, not just to reduce the code but also to reduce the dependancies on caps and config.
nikolatesla20
10-14-2004, 07:06 AM
As a side thought, in a real world example I would think a good approach would be to locate the app's d3d engine wrapper functions and to call those directly. Because doing basic things like drawing boxes and blitting text is such a pain with D3D, every non-trivial app I know of uses at least a wrapper of some sort (eg, MyEngine::TextOut(...) wraps text blitting functions etc), if not a full engine. It would make sense to use these functions where possible, to minimize the amount of work you would have to do in the injected code, not just to reduce the code but also to reduce the dependancies on caps and config.

This is a good thought , you should be able to use the functions in the dxd8/9 libraries since they are DLLs and should be in the other process. It would be interesting to try using those.

-nt20
homersux
10-15-2004, 09:25 AM
ok, so now can we have some code to be injected to target and displays
a clock in text? :devil:
Silver
10-15-2004, 01:06 PM
hehe, sure thing. I'll do that this weekend. This may be harder to inject as we'll need to create global objects in the target for the injection code. I'll post here when I've done it.

edit 20/10 - my apologies, I've been really busy the last few days. I'll get this done as soon as I have a bit of spare time. I have a nightmare deadline coming up for coursework material I'm writing :(
goggles99
02-28-2005, 12:52 PM
This topic is VERY interesting and informative. I just happen to be working on a D3d game trainer and I would like to add a status menu of sorts to display in-game.

Would anyone here happen to have any of the zip files which were attached to this topic? They are all corrupted (since this forum went down). If possible, could you re-up them here?

Thanks a lot :)

Also, Silver, nikolatesla20, and homersux. Would you mind if I use the info in your posts here to make a tutorial?
I will (of course) credit your names.
Silver
03-01-2005, 12:29 PM
No problem on my part. I never did have time to continue this, unfortunately. Let me know if you would like any DX-specific help with your tut, as this thread is very basic from a DX point of view. I've also apparently misplaced the code I wrote, perhaps homer or nikola still have it along with their injection.
homersux
03-07-2005, 04:21 PM
Let's see if I still have the files.
goggles99
03-19-2005, 02:02 PM
Thank you Silver and homersux...
I now have all I need to get going :yay:
Opcode
04-22-2005, 06:26 AM
How it obtains this info? It reads from the registry a list of the video drivers used by the system (kernel DLLs), and hooks their entry point, which is DrvEnableDriver(), using a powerful hooking engine.
In this way it obtains a pointer to the driver structure DRVENABLEDATA, and it can hooks all the interface functions exported by the driver.

Regards, bilbo

How can I find these registry entries? Where are they?
I'm reading the DDK about video drivers but I'm not
able to find where win32k.sys/ntosknl.exe find and load
the video drivers DLLs!

Thanks for any help!

Regards,
Opcode
bilbo
04-22-2005, 07:09 AM
Sorry, Opcode, if I was confusing you...

The registry entries are not system-wide entries, but NTICE ones, and their are set at installation time:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice\InstalledDisplayDrivers to enable the hooking
and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice\ExcludedDisplayDrivers to disable it

Regards, bilbo
Opcode
04-22-2005, 07:16 AM
Thanks bilbo!

This is my problem exactly:

01. I know how to create a video driver dll.
02. I want that the Windows graphics subsystem load my
driver dll. I'm supposing that is the win32k.sys
that will load it.
03. I just don't know what registry key I need to
create to make win32k.sys load my driver.

This is because I want to put a INT 0x03 opcode
inside the DrvEnableDriver function to see how the
graphics subsystem works internally.

I appreciate any help... and Google didn't help me!

Regards,
Opcode
bilbo
04-22-2005, 10:09 AM
As for the registry entries, they are plunged into CurrentControlSet...
Search the registry for your current DLL name (e.g. MGAUD, IALMRNT5), the same detected inside the NTICE entry.

As for INT03, I am afraid you cannot set a breakpoint so early in the system life, and I don't know if VMWare (or, better: the debug version of Bochs) can help you for a sofisticated video...
You should use (aargh!) M$ WinDbg with a cable connection to another computer...

Best regards, bilbo


PKLITE32 1.1's signature
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PKLITE32 1.1's signature
PDA

View Full Version : PKLITE32 1.1's signature

Limee AKA Lamer
08-31-2004, 08:37 AM
PKLITE32 1.1 -> PKWARE Inc.
which signature does PKLITE32 1.1 -> PKWARE Inc.
have?
dELTA
08-31-2004, 06:17 PM
Read FAQ. Have? :devil:
JMI
08-31-2004, 06:32 PM
dELTA, I hope you appreciate I left this one for you. :smug:

Regards,


Kernel Filter Driver Example & Article
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Kernel Filter Driver Example & Article
PDA

View Full Version : Kernel Filter Driver Example & Article

Clandestiny
08-31-2004, 05:37 PM
Hi guys,

I haven't been around on this board much for a while, but I recently posted this article over on rootkit.com and Kayaker suggested that it might be an appropriate example to also provide here on the Advanced Reversing & Programming forum. A while back I was playing around with filter drivers and ended up writing Klog, a simple key logger based upon a keyboard filter.

So here it is... In it's current form, Klog is more of a teaching example than a functional attack tool, but it should provide a starting point for those interested in incorporating filtering techniques into a kernel rootkit. Filters also have some potential applications in software protections (covertly testing for a keyboard input sequence perhaps). Klog currently supports only US layout keyboards and makes no effort to hide itself, however, these deficiencies will be remedied in future versions. The project download includes the source code, compiled driver, and a tutorial / article on filter driver design issues.

A partial transcript of the article follows... The full version in .pdf form (including colorful illustrations ;p ) can be found in the project download.

Introduction:

The following tutorial outlines the design of a simple key logger implementation using a kernel filter driver. Although the key logger itself is only proof-of-concept and lacks the functionality of a useful attack tool, it presents filter drivers as a potentially useful (and underutilized) rootkit hooking technique while demonstrating a few of the basic programming challenges that distinguish kernel design from user land development. The filter is based on the method shown in the ctrl2cap program at sysinternals.com.

If you’ve written a kernel driver before you already know that the drivers for each of the system’s hardware devices are layered into a hierarchal “device stack” and that a hardware device may have one or more drivers associated with it. Filter drivers are a special kind of driver that can be transparently inserted on top of or in between existing drivers in the stack. The key word, of course, is “transparently” because the surrounding drivers are unaware of the filter driver’s existence. The filter may be used to add functionality to an existing lower level driver, hide or modify data being sent to an upper level driver, or to stealthily intercept data. Clearly, the application of filters to rootkit development falls into this latter category and the possibilities range from simple key loggers to complex network and file system filters.

Installing The Keyboard Filter:

Installation of the filter is performed in the Driver Entry procedure and just like any other driver, one of the first steps is to fill in the IRP dispatch table. Filter drivers must support the same set of IRP_MJ_XXX requests as the underlying driver it is attached to. If we think of a filter driver as a sort of IRP net, this makes a sense. The net must have holes of the same size and position (i.e. same IRP_MJ_XXX slots filled in) for the lower driver to properly receive all of the IRP request types it supports. The easiest way to accomplish this is to expose a dispatch routine for every slot in the Major Function table of the filter driver object. If the filter is not interested in some of the IRPs, it simply provides a generic routine that passes them down to the next driver in the stack. A separate routine is provided for the IRPs the filter is interested in inspecting or modifying. In the case of our keyboard filter, we are only interested in inspecting the “read” IRPs. Similarly, the filter driver should set the same flags as the underlying device it is attaching to. After setting up the dispatch table, the device object is created and the device extension (a non paged memory area for the driver to store global variables) is initialized. One primary difference between regular drivers and filter drivers lies in the fact that their device objects are unnamed. We create an unnamed device object by calling IoCreateDevice and passing NULL for the device name. The actual insertion of the filter is performed by calling IoAttachDevice and supplying the filter driver’s device object as well as the name of the keyboard device to which we’re attaching. We also save the old pointer to the top of the stack so we know where we need to direct IRPs later after we’ve intercepted them. In the case of a keyboard filter, there are a couple of potential stack insertion points. The first is I8042prt.sys. This is the low level port driver for the keyboard. There is an example in the DDK showing a filter for the port driver. The second point of insertion is kbdclass.sys, Microsoft’s upper level class driver for the keyboard. Both this key logger as well as the sysinternals example ctrl2cap attach to the class driver.

We can summarize the basic steps for attaching a filter driver as:

1. Fill in all entries in the IRP_MJ_XXX dispatch table for the filter driver. Unhooked IRPs receive a pointer to a “pass down” routine and hooked IRPs receive a pointer to a special “hook” routine.

2. Create an unnamed keyboard filter device object by calling IoCreateDevice.

3. Initialize the Device Extension
4. Set the flags of the filter device equal to the flags of the underlying target device.

5. Attach the filter device to the target device using IoAttachDevice.

Additional initialization performed by the key logger involves creating a file for logging, starting a system thread for processing File I/O, and setting up a few necessary synchronization objects whose purpose will be discussed later.

Intercepting & Logging Keyboard Data:

After the filter driver is installed, the implementation can be broken down into two essential functions: intercepting and logging the data. First, we’ll discuss intercepting the data. In the case of a key logger, we are primarily interested in sneaking a peek at the data being read from the keyboard by the OS when the user presses a key. In practical terms, this means intercepting the “read” IRP’s of the keyboard device. The following diagram and accompanying sequence of steps outlines outlines this process:

1. The Operating System’s I/O manager sends an empty IRP packet down the device stack for the keyboard.

2. “Read” IRPs are intercepted by the filter driver’s dispatch routine for IRP_MJ_READ on their way down the driver stack. While in this routine, the IRPs is “tagged” with a “completion routine”. The “completion routine” is basically just a fancy name for a callback function that says “I want to see this IRP again when it comes back up the device stack.”

When a “read” IRP is received, the tasks of the filter driver dispatch read routine are as follows:

A. It sets up the IRP stack for the lower driver by setting the next IRP stack location equal to the current IRP stack location. The stack location pointers are obtained by calling IoGetCurrentIrpStackLocation and IoGetNextIrpStackLocation.

B. It sets a completion routine on the current IRP by calling IoSetCompletionRoutine

C. It passes the IRP on to the next driver in the stack with IoCallDriver.

All other received IRPs are directed to a “pass down” dispatch routine which simply passes them down the stack without touching them.

3. When the tagged, empty IRP reaches the bottom of the stack at the hardware / software interface, it waits for a key press.

4. When a key on the keyboard is pressed, it “completes” the IRP. The IRP is filled with the scan code for the pressed key and sent on its way back up the device stack.

5. On its way back up the device stack, the completion routines that the IRP was tagged with on its way down the stack are called and the IRP is passed into them. This gives the filter driver an opportunity to extract the scan code information stored in the packet and add it to a queue for processing by the logging component. It is important to note that the completion routine can be called at DISPATCH_LEVEL and, consequently, that we have to be aware of the API and memory allocation restrictions at that level. This affects our design in a practical way. When we enter the completion routine we would like to extract the keyboard scan code and log that scan code to a file. Unfortunately, we can only accomplish the first task due to IRQL restrictions on File I/O. Because file system APIs can only be called at IRQL PASSIVE_LEVEL, we have to set up a separate thread running at PASSIVE_LEVEL to handle them. Having a separate thread also introduces the need for a queuing mechanism and synchronized access to the queue. We can use an interlocked linked list for this purpose as the ExInterlockedInsertTailList and ExInterlockedInsertHeadList are guaranteed to be mutually exclusive and this avoids having to deal with a separate mutex or spin lock. A semaphore can also be used to notify the thread doing the file I/O when there are scan codes available for it to log. This is accomplished by incrementing the semaphore count once for every received IRP. By calling KeWaitForSingleObject in the thread, the thread will block if the semaphore count is 0 (i.e. there is no work to do). This is more efficient than simply spinning in an infinite loop constantly checking if there is anything in the queue. The last item to be aware of is that memory for the list items must be allocated from the non paged pool since the completion routine may be running at DISPATCH_LEVEL.

6. Before writing the scan code out to the log file, it is converted to it’s ASCII representation. Unfortunately, this conversion is dependent upon the layout of the keyboard and I couldn’t find any kernel support to generically convert scan codes for different keyboard layouts. Therefore, my scan code conversion is currently limited to a manual conversion routine for a US keyboard layout.

A Final Caveat:

There is an issue related to unloading a filter driver which needs to be mentioned. As we know, the dispatch routine “tags” keyboard IRPs with a completion routine on their way down the stack and they sit there waiting to be “completed” when the user presses a key on the keyboard. These IRPs are therefore “pending” completion (i.e. until they are filled with data and sent back up the stack). If we attempt to unload the driver while there is an IRP pending completion, the system will crash. This is clearly due to the fact that the memory address for the completion routine will be invalid when the OS tries to call it after unloading the driver. The obvious way to solve this is to simply not unload the driver. Like a rootkit, there is little need to unload a keylogger so this may be an acceptable solution. As an alternative, we can keep a count of the number of outstanding IRPs and refuse to unload until the count becomes 0. This alternative, however, has the unfortunate side effect that the driver won’t unload until the user presses another key (ie. until the IRP is filled with keyboard data and passed back up the stack and handled properly by the completion / logging routines).

See the attached .pdf and code for the rest...

Clandestiny
dELTA
08-31-2004, 06:26 PM
Very nice and interesting package Clan, hope to see more of them here in the future. :cool: :yay:
JMI
08-31-2004, 06:31 PM
Yes, Thanks and welcome back and welcome back to dELTA from where ever he has been the last few days. ;) Probably a J.A.G convention or marathon. :devil:

Regards,
Woodmann
08-31-2004, 09:51 PM
Howdy,

I like to play with keyloggers. Thanks for the new toy ;)

Woodmann


Board probs ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Board probs ??
PDA

View Full Version : Board probs ??

monguz
09-01-2004, 01:14 PM
Something seems to be wrong...the board is only over IP reachable..
dELTA
09-01-2004, 02:34 PM
We've had a slight DNS issue, it is fixed now though, and should work again from all over the globe within 24 hours or so.

The woodmann.com domain works too btw, in addition to the IP. It's only the woodmann.net domain that was affected by the problem.
Bmsfx
09-01-2004, 03:28 PM
ya i had the problem getting here too, but you guys where quick and fixed it, i almost panic'd :P
monguz
09-02-2004, 02:27 PM
Big Thanks..it works again...21:30 GMT+2
lifewire
09-03-2004, 10:13 AM
i'm glad it's back :)
JMI
09-03-2004, 10:38 AM
As dELTA said, the problem was not with the Board, but with the IPS messing up the connection through Woodmann.net. The Board was up and running thw whole time, it was just that most people couldn't get through to the right place. :whoops:

Regards,


NtQuerySystemInformation and open handles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > NtQuerySystemInformation and open handles
PDA

View Full Version : NtQuerySystemInformation and open handles

omega_red
09-01-2004, 04:56 PM
I'll forward here a post from microsoft.public.win32.programmer.kernel newsgroup (Message-ID: <cgkcte$1kcp$1@mamut.aster.pl>)
NtQuerySystemInformation can return all opened handles, but in all infos I
can find in net, returned array provides 16-bit handle values and handles
are pointer-precision values (I tested my XP for handle limit and I was able
to open much more then 2^16 files). Are docs found on the net invalid or
native system calls are not very compatible..?
...and my reply:
I've just written quick and dirty code to check what this 'handles'
actually are. All of them are 0 (on w2k sp4). It returns valid type and
kernel object address, so maybe this is the way.

Interestingly, there is some sample code in the book "Windows NT/2000
native API reference" for enumerating any process' open handles. Firstly it
calls NtQuerySystemInformation with class SystemHandleInformation, and then
uses ZwDuplicateObject for each handle to get private copy of it. However,
foreign handle supplied to ZwDuplicateObject is the same abovementioned
handle - so how it's supposed to work if all of them are null?

#include <windows.h>
#include <stdio.h>

typedef DWORD (NTAPI *pNtQuerySystemInformation)(DWORD info_class, void *out, DWORD size, DWORD *out_size);

struct SYSTEM_HANDLE_INFORMATION
{
ULONG ProcessId;
UCHAR ObjectTypeNumber;
UCHAR Flags;
USHORT Handle;
PVOID Object;
ACCESS_MASK GrantedAccess;
};

SYSTEM_HANDLE_INFORMATION buf[100000];

void main()
{
DWORD size;
pNtQuerySystemInformation NtQuerySystemInformation =
(pNtQuerySystemInformation) GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQuerySystemInformation");
NtQuerySystemInformation(16, buf, sizeof(buf), &size);
DWORD n = size/sizeof(SYSTEM_HANDLE_INFORMATION);
for (DWORD i=0; i<n; i++)
{
printf("%08x: PID: %08x, type: %02x, handle: %04x, ptr: %08x\n", i,
buf[i].ProcessId, buf[i].ObjectTypeNumber, buf[i].Handle, buf[i].Object);
}
DebugBreak();
}

Anyone got some info about this?
Kayaker
09-02-2004, 02:42 AM
Hi,

All I can say at the moment after checking out what is returned from SystemHandleInformation (an array of SYSTEM_HANDLE_INFORMATION structures), is that "handles" are indeed 16 bit values, they begin numbering from 04h for each PID and increase to the total number of (open?) handles for each process, 0004h, 0008h, 000Ch,...

If you type PROC -x <process> in Softice you'll get further Handle info including the total number of handles. This number matches the number of SYSTEM_HANDLE_INFORMATION structures returned for each process.

As far as I can tell, everything looks fine. I'm not sure what 'pointer-precision values' are supposed to be or why these 16 bit handles don't match what this guy thinks they should be.

Kayaker
omega_red
09-02-2004, 02:45 PM
Well, HANDLE type is 32-bit, but NtQuerySystemInformation returns 16-bit "handles", which are anyway all NULL (at least on my system).
00000000: PID: 00001041, type: 08, handle: 0000, ptr: 00040005
00000001: PID: 001f0fff, type: 08, handle: 0000, ptr: 00080006
00000002: PID: 001f03ff, type: 08, handle: 0000, ptr: 000c0012
00000003: PID: 00000000, type: 08, handle: 0000, ptr: 00100012
00000004: PID: 00020019, type: 08, handle: 0000, ptr: 00140012
00000005: PID: 0002001f, type: 08, handle: 0000, ptr: 00180012
00000006: PID: 0002001f, type: 08, handle: 0000, ptr: 001c0012
00000007: PID: 00000020, type: 08, handle: 0000, ptr: 00200012
00000008: PID: 00020019, type: 08, handle: 0000, ptr: 00240012
00000009: PID: 0002001f, type: 08, handle: 0000, ptr: 00280008
0000000a: PID: 001f0003, type: 08, handle: 0000, ptr: 002c0012
0000000b: PID: 0002001f, type: 08, handle: 0000, ptr: 00300008
0000000c: PID: 001f0003, type: 08, handle: 0000, ptr: 00340012
0000000d: PID: 0002001f, type: 08, handle: 0000, ptr: 00380006
0000000e: PID: 001f03ff, type: 08, handle: 0000, ptr: 003c0006
0000000f: PID: 001f03ff, type: 08, handle: 0000, ptr: 00400006
...

[edit]
The results seem strange anyway, what those PIDs suppose to be? Have I made some silly error in my code? ;)
Kayaker
09-02-2004, 04:24 PM
Hi

I can tell right off that you seem to be offset by 1 DWORD. The 1st DWORD returned by NtQuerySystemInformation/SystemHandleInformation is the *number* of SYSTEM_HANDLE_INFORMATION structures that follow, an array of arrays.

The first dword you show is 1041, this is the number of structures to follow, offset your output by 1 dword and it should make sense.

The PID you have should probably be 00000008 (default System pid)
ObjectTypeNumber should be your 5, 6 ,12...
Flags can be 00 or 01 I think
Handle is 0004, 0008, 000c, etc.
GrantedAccess will be values like 001f0fff

If you type PROC in Softice you'll see the pid's of all the processes, these seem to be in the same order (load order?) as the "groups" of SYSTEM_HANDLE_INFORMATION strucs returned by SystemHandleInformation.

Further comment:
It would appear then that Object Handles as we know them (passed from API calls for example) are zero-extended 16 bit values from 0004h - 0FFFFh that the system assigns sequentially for each process. This should give a total of 16,383 handles available for each process. Logically enough I suppose, MS decided that was enough (Bugcheck protected?) So what will happen with 64bit processors, zero-extended dword values passed as 64bit? ;-)
omega_red
09-02-2004, 05:30 PM
Oh well *slaps his head*. One dword and such a mess :)
It also lightened the original question: why this handles are 16-bit, although there can be more than 65536 handles per system.

00000000: PID: 00000008, type: 05, handle: 0004, ptr: 81ad63c0
00000073: PID: 00000000, type: 1a, handle: 0004, ptr: 81530b08
000000b5: PID: 000000ac, type: 11, handle: 0004, ptr: e134a830
000000d6: PID: 000000c4, type: 11, handle: 0004, ptr: e1332910
...

Handle values are not systemwide unique.
Four-F
09-04-2004, 03:44 AM
The kernel object handles are NOT 16 bit values.

First, open your copy of "Inside Microsof Windows 2000" and look at Figure 3-14 "Process handle table architecture in Windows 2000". Then go deep into ExpLookupHandleTableEntry and you will see something like this:

//
// Decode the handle index into its separate table indicies
//

l = (Handle.Index >> 24) & 255;
i = (Handle.Index >> 16) & 255;
j = (Handle.Index >> 8) & 255;
k = (Handle.Index) & 255;
omega_red
09-04-2004, 04:25 AM
So how do you explain this? Handles returned by NtQuery.. ARE 16bit...
0rp
09-04-2004, 06:58 AM
So how do you explain this? Handles returned by NtQuery.. ARE 16bit...

the several components of a 32bit handle are used to select one handletable

if ( l != 0 ) return NULL;
if (HandleTable->Table[i] == NULL) return NULL;
if (HandleTable->Table[i][j] == NULL) return NULL;
return &(HandleTable->Table[i][j][k]);

and handles returned by NtQuery.. are probably always Table[i] handles
Kayaker
09-04-2004, 01:08 PM
Hi, thanks for clarifying that those are actually index values. :)
omega_red
09-04-2004, 01:31 PM
Yes, it makes sense now and explains why they are not unique.
Four-F
09-05-2004, 09:43 AM
The right answer is: ObpCaptureHandleInformation callback truncates handle values down to USHORT.

(*HandleEntryInfo)->HandleValue = (USHORT)((ULONG_PTR)(HandleIndex));

I've attached the simple msvc6 project. It creates 16384 named events. Run handle -a -p handles at appropriate moment and you will see something like this:

handle -a -p handles

ffe8: Event \BaseNamedObjects\MyEvent00016360
ffec: Event \BaseNamedObjects\MyEvent00016361
fff0: Event \BaseNamedObjects\MyEvent00016362
fff4: Event \BaseNamedObjects\MyEvent00016363
fff8: Event \BaseNamedObjects\MyEvent00016364
fffc: Event \BaseNamedObjects\MyEvent00016365
0: Event
4: Event
8: Event
c: Event
10: Event
14: Event
18: Event
1c: Event
20: Event
24: Event
28: Event
2c: Event
30: Event
34: Event
38: Event
3c: Event
40: Event
44: Event <- This is the last created event with the name
"\BaseNamedObjects\MyEvent00016383". And its
handle is 0x10044


Gmail
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Gmail
PDA

View Full Version : Gmail

gabri3l
09-03-2004, 09:56 AM
I know this is pretty off topic, that's why it's in this section. ;) I have 11 extra invites that I don't feel like going to waste. So I figured RE people deserve them more than anyone else. If anyone wants one just PM me or email me gabri3l2003(at)gmail.com. Higher post counts and mods/admins obviously get priority. Thanks.

Gabe
dELTA
09-03-2004, 11:14 AM
I think this PR scheme of gmail is quite effective. They give out a "limited number" of invitations to current users, and this is the only way for new users to get an account. When people get these limited invitations, they feel just like you, they don't want to waste them, so they start pushing them on their friends. These friends in turn feel privileged to get access to such an invitation (i.e. "limited" resource), and so the whole thing loops, with exponential growth. :)

Thanks for sharing your invitations anyway, nothing wrong with that, I just wanted to share my views on their clever PR scheme. :)
Aimless
09-04-2004, 01:17 AM
Which brings me to a slight disgression....

Why are people always doing what they promised they would not do and subsequently fall into the growth~money umbrella?

Its like linux and crap shouting we will _never_ be like microsoft. But then going and trying to implement (in my opinion:crappy) windows-like interface.

When will people be honest and admit I'm in it for the money?

Google + Email is a lot like Unix trying to go graphical. I feel its going to fall badly on its face. Hmmm.. Just another brilliant _small_ company going the _big_ way and becoming unrecongizable in the process. Another brick in the wall.

Oh by the way, please don't flame me. I am not trolling. Linux _is_ (well, maybe) a good OS, and the view expressed are _entirely_ my personal opionions. Of course they could be wrong.

Then again, they could be correct too...;)

Have Phun
Silver
09-08-2004, 12:41 PM
I'm interested to know why you think that? GMail has 3 important things:

1. Huge storage - 1 gig is unprecendented for a free mailhost. It's even scared Microsoft into doing the same with Hotmail (whicxh I'm sure will really piss off the Hotmail+ subscribers)

2. Good user interface. Gmail is *fast*, even over a 28k modem. The interface is clean, and once you get used to the "conversation" and label system rather than folders, it's easy.

3. Clever revenue - GMail puts (IMO) fairly unintrusive context sensitive adverts on the right hand side of your emails. Personally I never even see them, and because I only use GMail for public and mailing list email, privacy etc doesn't bother me (never use someone else's mail service if you do care about privacy).

Those 3 add up to success. Google is a big company. They're technically excellent. GMail is useful, convenient and easy to use. My only annoyance with it is that it doesn't work with IE 5.0, 5.01 or 5.5 (I believe). That's a pain in the ass when you're using a basic 98, NT, or 2k machine that hasn't been upgraded...
dELTA
09-08-2004, 07:33 PM
It's even scared Microsoft into doing the same with Hotmail (whicxh I'm sure will really piss off the Hotmail+ subscribers)
I just saw the other day that Hotmail+ (or whatever their premium service is called) has 2 GB storage now, so maybe they're not that pissed after all. :)
Silver
09-09-2004, 12:04 PM
lol... but seriously, 2 gig of email? I get that much in spam, not in real mail.... <checks outlook .pst file> 247meg of email for the last 5 years or so. Ok thats just this machine and doesn't count my mail stored on other systems... but it probably comes in at less than 500meg in total. What the hell will anyone do with 2gig (or even 1 gig at that!) I have no idea.

Good marketing ploy tho, seeing as storage is dirt cheap.
JMI
09-09-2004, 04:29 PM
Why they'll start e-mailing software to all their friends. The junk sent expands to fill the space available.

Once I paid a small forutne for a 20Mg, yes I said "Meg" HD and thought I'd never fill it up. Now I have 2 200Gig HDs and they are getting full. Time to off load some cr*p again and store it on CDs, until I get a DVD writer. :yay:

Regards,
Will
09-13-2004, 02:55 PM
I've still got a few invites left as well. If anyone's interested, send me a pm.

cheers,
will
dELTA
09-19-2004, 10:21 AM
http://isnoop.net/gmailomatic.php
Silver
09-19-2004, 12:35 PM
heh, nice
dELTA
09-30-2004, 08:55 AM
Ok, this is getting ridiculous:

http://www.tomshardware.com/hardnews/20040927_194824.html

:)
Silver
09-30-2004, 09:39 AM
So, um, where's my woodmann.net 10 terabyte mailbox then? :D


Why remove my thread?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Why remove my thread?
PDA

View Full Version : Why remove my thread?

Limee AKA Lamer
09-03-2004, 12:40 PM
I'd just upload a notebook.exe packed with armadillo,
this is not a comerical softwore
I think only discuss it with others!
please find back my thread from recycle?3x
JMI
09-03-2004, 02:51 PM
limee:

Let me make this as clear as I can to you. Your prior thread was removed by an Admin because it was a crack request and included commercial software. Both things which are not permitted on these forums.

Despite that notice to you, you now have posted two separate threads (one of which I deleted completely) giving your view on what is permitted and what is not. Unfortunately, you don't make the rules and you don't get to decide what is permitted and what is not. Cease and desist and do not post about this program again or be prepared to suffer the consequences. :whoops:

You have been warned for the last time.

Regards,
dELTA
09-04-2004, 08:34 AM
If you upload an exe file, not having any recognizable name or anything, and then practically say "tell me how to find the OEP / tell me how to unpack", it will be treated as a crack request, since noone will go to the trouble of verifying the current license conditions of the software that you so kindly left out even the name of completely.

Please read the posting guidelines in the FAQ, then follow them. After that all will be fine and no more threads will be removed.


I intuitive cracking of mine!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > I intuitive cracking of mine!
PDA

View Full Version : I intuitive cracking of mine!

SL0rd
09-03-2004, 03:14 PM
Hi, I would like to share one early cracking experience...
I was trying to get the correct serial to a VB6 app. With hexworkshop I foun
domething that seems like the serial, its a string like "ABCD0000".
I tried that string and its not work! so I set a bp at __vbastrcomp, and here begins a intersting part (at least for me), my input was compared with a string like ABCD0000EF (its in UNICODE) just in front it (at softice data window) I saw other two unicode chars, say,"PM", he. I tried the "ABCD0000EF" string as the serial number but its not worked, its annoying to me, I will call the above string as S1 by now. My input is being compared with S1 so why its not the correct serial!? I decided trace a bit to see if the string above is being modified, after a lot of F10 I found that the 2nd and 3rd char of the S1 was stripped out and S1 now was "A D0000EF", what hell are happening there! Ok I guessed that two char need to be inserted in that places, then I remember the initial softice data window dump showing S1 followed by the chars "PM", I just tried put "PM" at the blanks and voila! the good messagebox saying "thanks for ..." I really still dont have total domain in how the real serial number(s) to this app are generated, VB assembly listing is a shit! the point is that I dont needed to know ALL about the registration procedure I used my "intuition" what made this crack special to me!
I spent about two hours still get a correct serial, Im a beginner I know!
If someone is intersted in study this app, will be a pleasure!contact me. :)
br00t_4_c
09-03-2004, 03:41 PM
+ORC would be proud of your decidedly "ZeN" approach :yay:
dELTA
09-04-2004, 08:41 AM
Hehe, always nice to see the first few steps of a new reverser. :yay:
JMI
09-04-2004, 11:13 AM
Much more hopeful than the "last steps" by an "old reverser." :idea:

Regards,


SoftICE Woes on XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE Woes on XP
PDA

View Full Version : SoftICE Woes on XP

Neo-Vortex
09-04-2004, 08:55 AM
im trying to get SoftICE working on windows xp and i get this:

C:\Program Files\NuMega\SoftIceNT>ntice

C:\Program Files\NuMega\SoftIceNT>net start ntice
System error 127 has occurred.

The specified procedure could not be found.

C:\Program Files\NuMega\SoftIceNT>

any ideas?
esther
09-04-2004, 09:18 AM
Yea read the faq and come back!!!!
Neo-Vortex
09-04-2004, 09:25 AM
Yea read the faq and come back!!!!

he he... im usually the one who says that if its something im familiar with... only problem is i already have... and googled it... and searched these forums... to no avail...

although if the faq your talking about is the one located at http://www.woodmann.com/crackz/Faq.htm then it dosent have anything there... if you mean another faq (like mabe one that comes with SoftICE) then please feel free to tell me where it is :P
dELTA
09-04-2004, 09:33 AM
Ok, let's make a long flaming session a little shorter. :p What version of Softice/DriverStudio are you using, and at what service pack level is your WinXP? :)
Neo-Vortex
09-04-2004, 09:35 AM
Ok, let's make a long flaming session short, what version of Softice/DriverStudio are you using? :)

SoftICE 4.05 for NT (During the install it said something about NT 5 (also known as xp) and that builds over this number require read-only protection to be disabled or something like that, i hit yes, it rebooted, then continued installing leading me to believe it supports, well should, XP...) oh, sp1 too
esther
09-04-2004, 09:36 AM
Softice questions
Softice + XP, is it possible?
It's possible but sometimes not so easy, you need to install DriverStudio (v3.1 at the moment).
Most of the problems are related with settings like video, mouse and/or keyboard. The most stupid (and maybe right) answer to solve this problems is: try all the possible available settings and browse Compuware site for bugs (and patch...).
There are some threads that may help you, here is one of them:
http://www.woodmann.net/forum/showthread.php?t=5335

There are big red letter on top of the main forum lazy ass
dELTA
09-04-2004, 09:40 AM
I was just about to suggest you'd reevaluate your opinion of having "searched these forums", and prepare to get flamed, but I was apparently too late... :D

90% of all XP + Softice related threads has the answer "Use DriverStudio 3.1" and yes, there is an explicit paragraph about it in the FAQ too, and yes, that's the FAQ pointed to by the big red letters on the main page, that says you should read it before posting... :rolleyes:
esther
09-04-2004, 09:42 AM
LOL
Neo-Vortex
09-04-2004, 09:47 AM
ok, well i saw the other faq and figured they were one and the same... anyway, ill see if i can get it working now...
dELTA
09-04-2004, 10:02 AM
Yeah, that double FAQ link has annoyed me too, so I just fixed it. Congratulations, you were the last one to be able to use that as a valid excuse. :D Good luck with the Softice props now.
Neo-Vortex
09-04-2004, 06:33 PM
he he, cool :P

now, if only i could find a copy of DriverStudio... hours of searching to no avail, arg...
JMI
09-04-2004, 06:58 PM
And, of course you DID READ these instructions in the title of the "Tools of the Trade Forum":

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

But your post above was just complaining, not really a request for help, right. :yay:

Regards,
Neo-Vortex
09-04-2004, 07:19 PM
actually, i did read that... i was just complaining (hence me saying arg)... stupid thing... everywhere has SoftICE... but nooo, not DriverStudio... whats worse is that i already have it somewhere on one of the 3 box's i have... somewhere in a mess of 300gb spread out amoung 3 box's (not evenly of course)... searching the internet for it... or searching my hdds... that is the question... which is harder... thats another...
JMI
09-04-2004, 08:29 PM
The "thumbs-up" smilie was an indication that I was giving you that benefit of the doubt. Remember also that some things said are posted as a "warnings" to those who come along after the original poster, in the hope they might not read your statement "the other way." ;)

Regards,
Neo-Vortex
09-04-2004, 10:01 PM
good enough... *goes back to looking...* god damn it, what could i have saved it as?...
dELTA
09-05-2004, 10:11 AM
god damn it, what could i have saved it as?...
"Pre-teen scheissen movies"? :D


interrupt handler problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > interrupt handler problem
PDA

View Full Version : interrupt handler problem

0rp
09-04-2004, 03:33 PM
hi,

i've written a driver, wich does detours like instrumenting of functions (it replaces the first 5+ byte with a jump to an own function..) in ring0

problems occur, if i hook interrupt 0x01 (debug trap) and this is weird, since the same technique works for int 0x2B (wich is heavily used)

this is what i'm currently trying:
jmp my instr 0 --------> my instr 0
original instr 2 <----. my instr 1
orginial instr 3 | my instr 2
orginial instr 4 | my instr 3
iretd | orginal instr 0
| original instr 1
'--- jmp original instr 2

i alloc with ExAllocPool(NonPaged) memory and copy my instrs, the saved original instrs and the jmp into it.

could there be a problem regarding different segements (and DPLs) between original handler code and my alloced code?

and why does it work for int 2B? is it because 2B ints are always traps and no faults ?

thx
Alorent
09-05-2004, 06:14 AM
Hello,

Your proposition looks OK. In which IRQL are you hooking that? I think you have to do it from PASSIVE LEVEL to succeed.

Regards,
Alorent
0rp
09-05-2004, 07:03 AM
hi,

i install the hook at passive level, but it gets called at a higher prio.

windbg says
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually
caused by drivers using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: f694e9e2, memory referenced
Arg2: 000000ff, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: f70a60e0, address which referenced memory

the faulting instructions is: mov edx,[edx] (which is not the first instruction of the original handler, but prolly the first memory access)
nikolatesla20
09-05-2004, 08:39 AM
Have you tried to trace your hook with SoftICE so you can see what the result of ExAllocPool really was? Just put an int3 in your driver before the ExAlloc, then "bpint 3" in SI, and then load the driver and call it to install the hook. SI will pop up, and then you can walk from there. You need to make sure ExAllocPool worked right, and not only that, that all your pointers to it are correct (perhaps you have a bad pointer arithmetic somewhere). The only way to know for sure is to use SoftICE.

After all, that's what SoftICE was primarily made for, was tracking down driver issues.

You should also consider doing a PUSH, RET combo instead of using a JMP. Whereas JMPS need to be calculated at run time, a PUSH , RET can use the straight up Virtual Address. For example, PUSH <actual address of my code>, RET. It's a much more reliable method. You could use the same technique at the end of your code to come back.

-nt20
0rp
09-05-2004, 09:15 AM
i checked the hooking code in ring3 with olly and it works as expected

but this sample could be a problem for my detouring technique:

F7BC3076: EB 04 jmp +0x4
F7BC3077: AA stosb
F7BC3078: 06 push es
F7BC307A: FE FF jmp edi
F7BC307C: 6A 00 push 0x0
F7BC3083: 66 C7 44 24 02 00 00 mov [esp+02], 0x0
F7BC3085: 8B EC mov ebp, esp
F7BC3086: FC cld
....

i would copy the relative jmp (EB 04) into my buf which results in a completely wrong codeflow

damn
:/
lifewire
09-05-2004, 11:41 AM
that is a nasty problem :)
but i'm not very into ring0, but isn't it much easier to patch the idt?
0rp
09-05-2004, 11:52 AM
ye, its possible to modify the IDT entries, but its also easy detectable

btw, why does an anti softice app not scans these IDT entries, and if it finds entries located at 0xF_______, softice is found ?

i use now this code to surround my own stuff and i detect this funny jmp +4 (not very generic, but it works):

pushad
pushfd
push fs
mov bx, 30h
mov fs, bx
push ds
push es

own stuff

pop es
pop ds
pop fs
popfd
popad

old instructions
push oldcode + offset
ret
Alorent
09-06-2004, 01:38 AM
Do you save/restore (pushad/popad) all the registers before and after passing the control to the original INT1 vector?


DeviceIOControl and mouse drivers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DeviceIOControl and mouse drivers
PDA

View Full Version : DeviceIOControl and mouse drivers

Uranus
09-04-2004, 04:51 PM
Hello all, I'm not much of a reverse engineer, but I'm trying to figure out how my mouse software communicates with the HID drivers. I need the control codes to pass onto DeviceIOControl() particularly.
Thing is, I have a rather nice 9 button mouse but the software sucks, everytime I want to play a game with the extra buttons, I have to launch the software and edit them one-by-one. Then switch them back when I go back to windows cause the buttons are really useful for browsers :-/

The logitech and microsoft intellipoint software both work with my mouse, so it can't be a trade secret?

Like I said, I probably wont be able to reverse engineer it, so I was wondering if anyone has come across the control codes I need to change the button bindings?
Kayaker
09-07-2004, 09:25 PM
Hi

I don't have any suitable setup to study, but I might guess your mouse software installs its own filter driver attached to the lower level port driver i8042prt.sys, or the upper level class driver mouclass.sys. The fact that Logitech or Intellimouse both recognize and can remap your mouse buttons may only mean that they are intercepting the mouse button clicks (via their own filter drivers) and remapping them using their own internal IO Control codes.

If you want to find the IOCTL codes your mouse uses, your choices may be:

1. Disassemble the main exe file your mouse uses, which may be a control panel extension file (.cpl), and get the codes directly from any DeviceIOControl calls. The second parameter pushed to the API DeviceIOControl is the dwIoControlCode. You won't necessarily recognize what they do offhand, but you should be able to get their values.

2. Disassemble the filter driver (assuming a secondary driver isn't used to handle IOCTL) and find the dispatch routine for the device control requests. If you were able to recognize what you were disassembling, the IOCTL codes are accessible through a structure Irp-> Parameters.DeviceIoControl.IoControlCode.

3. Try DriverSpyNt by Jeremy Collake, with this software you should be able to hook your installed mouse device and record any IRP_MJ_DEVICE_CONTROL requests and the IOCTL codes used as you play with your mouse software.

How you might use these IOCTL codes afterwards I'm not sure. The button mapping info should be stored in the registry or an .ini file, you may be able to do a quick reg or script hack or small program, to change the current mapping that way. However this may not work if there still needs to be communication with the filter driver to in some way "update" the current mapping. What ideas did you have in mind?

Regards,
Kayaker
Uranus
09-08-2004, 08:22 AM
Thanks so much for replying.

I took a look at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB, and one of the keys has a reference to mouclass.sys I believe, so it probably uses that upper level driver.

1. I tried debugging (even if I'm not very good at it) the mouse properties program (which btw, is this -> c:\WINDOWS\system32\control.exe Mouse). The second parameter is a pointer to the data sent to the mouse right? but in my newby-ness, I could see the address that it points to, but I didn't know how to actually view the data.

2. I have no idea how to accomplish this. :(

3. Will try this right after I finish this post :) thanks for the info.

Well, I already attempted to change the registry setting where the button bindings are kept, and it doesn't work. The mouse properties screen reflects that change, but the mouse will still be bound to the old settings, so I assumed there should be some kind of communication through DeviceIOControl to the mouse drivers (and there is, as I stated afterwards).

So what I'm gonna do is use the CreateFile() function to open the mouse device, DeviceIOControl to change whatever button bindings the user has configured, and update the registry accordingly. Only thing missing is the control codes :)

Well, off to try that DriverSpyNT!
Four-F
09-09-2004, 03:11 AM
Uranus, just have a look at:

IFSKIT\src\input\pnpi8042
IFSKIT\src\input\mouclass
IFSKIT\src\input\moufiltr

You will find there FULL source code of these drivers. Probably common DDK also has it. Also read in DDK docs the following sections:

I8042prt Driver Reference
Mouclass Driver Reference
Moufiltr Driver Reference
Uranus
09-09-2004, 09:39 AM
thanks for the IFSKIT tip, but I can't seem to find it anywhere!

Anyway, I tried DriverSpyNT, and got about 80 calls to DeviceIOControl whenever I change a mouse button. Most of them are identical, but the weird thing is that I tried to bind several buttons and I can't find a difference anywhere! Those 80 calls seem to be the same regardless of what binding you choose. Perhaps it just changes the registry and tells the mouse driver to update its bindings from the registry?


Sentinel Super Pro Shelled files problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sentinel Super Pro Shelled files problem
PDA

View Full Version : Sentinel Super Pro Shelled files problem

nasty
09-04-2004, 07:23 PM
Hi to all,
I'm not "expert" in SSpro dongle...
I'm working on a SSpro target from about 3 months, but this software have about all mainly files .exe and .dll shelled!
I have unshelled some files but it's a problem to unshell all !!
I have got then the original SSpro USB dongle.
Now i want to know .. there is a fast way to dump all files using the dongle and after using without dongle?
What are the right steps to do a good dump and a fix (patch) to the shelled file ... to work right?
I have, until now, follow the theory "without dongle".
Please help me !
Thanks a lot . and see you soon!
Woodmann
09-04-2004, 09:45 PM
Hi,

I am not quite sure what you are asking.
If you are asking is there a way to use the dongle to figure out
how to run your program without it....Yes

You need to "spy" the information passed between the dongle and program and then write the patch.

Woodmann
(of course you could have searched for this)
nasty
09-05-2004, 06:06 AM
Thanks for reaply Woodman!
Yes i want to "spy" this information.
But what spy i can use?
There is a kind of dll that can spy the query and other info from the dongle?
I have tryied to "spy" manually but i have some errors (is also why i'm not expert with this).
Please help me .. i want to learn much about this .
Thanks!
nasty
09-05-2004, 06:12 PM
Thanks for reply Woodmann but the link that you send don't works .. tell me "Sorry - no matches. Please try some different terms."
can you resend?
Thanks!
Woodmann
09-05-2004, 07:36 PM
My bad, sorry.

Open the search pull down at the top of any page and enter your favorite search phrase ie; sspro

Tell us if your search helped you or if it did not, why. :)

Woodmann
nasty
09-06-2004, 05:57 AM
Thanks for reply Woodmann.
The problem is this ..
as i tell i have broken some shell on several files of my target (using as "know-how" this great forum) ..

So to unshell some file i made a dump (with dongle) and using the first 8 or 16 byte of the dumped stuff i brute the N sections (of the shelled files ... in my case 2 sections, .text and .data) and after unshelling (rebuilding the sections.. change the IA address and size and surely the OEP usign LordPE) and removing the "added by the shell" 4 sections to the original file!

The problem is that this shelled files are MANY and MANY!
And need MUCH MUCH time!
Now i have got again the dongle to try again so i ask to "expert" a "faster" method to unshell the stuff (all the files .. why is not only ONE file!!)
I know how this forum works (search for "sspro" or "sentinel" or "sentinel super pro") and i know a bit as the Sspro works .. but i think that MUCH MUCH expert guys are there.
So please help.
Thanks


I can't find the OEP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > I can't find the OEP
PDA

View Full Version : I can't find the OEP

Limee AKA Lamer
09-05-2004, 04:51 AM
I packed the notebook.exe with armadillo 2.00
Although I knew the OEP,it is 4010CC!
but I can't find it,who can help me?
tell me the way
Can I upload the attachment on this forum?
I can not deal with it,thx!
sonkite
09-05-2004, 05:11 AM
Tried setting a hardware breakpoint on 4010CC.
Eggi
09-05-2004, 05:39 AM
you should find it with a bp CreateThread.


Sticked in by the debugging loop
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Sticked in by the debugging loop
PDA

View Full Version : Sticked in by the debugging loop

Limee AKA Lamer
09-05-2004, 08:23 AM
00405A71 > JMP UN.004056C5 --->

004056C5 > CALL UN.00405C64
004056CA AND EAX,0FF
004056CF TEST EAX,EAX
004056D1 JE UN.00405A76 --->
004056D7 PUSH 3E8
004056DC MOV EDX,DWORD PTR SS:[EBP-A4]
004056E2 PUSH EDX
004056E3 CALL <&KERNEL32.WaitForDebugEvent>
004056E9 TEST EAX,EAX
~~~~~~~~~~~~
When use SICE debug the code,
the eax return value is always 0,
in other words,this code have not
the debugEvent.How sto Solve it?
004056EB JE UN.00405A71 --->
br00t_4_c
09-08-2004, 12:44 PM
Just a thought by why not just toggle the Z flag?
Limee AKA Lamer
09-08-2004, 01:04 PM
I have try it,but it is no use.

Just a thought by why not just toggle the Z flag?
neviens
09-09-2004, 09:29 AM
>...the eax return value is always 0,...
>

What GetLastError() says?
Neviens.


Powerfull tool to successfully unpack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Powerfull tool to successfully unpack
PDA

View Full Version : Powerfull tool to successfully unpack

diaa_elsherif
09-05-2004, 08:36 AM
I started cracking not so long.......I am facing problems cracking some applications using OllyDbg 1.10......the problem is that these applications are packed by ASPack.......I don't know whether my conlusion was right or wrong but I used unpack v2.2......it says application is packed with ASPack v1.0.8.3......I obtained all aspack unpackers but no use.........so please somebody tell me a powerfull unpacker to determine what the application is packed by and unpack it
nikolatesla20
09-05-2004, 08:44 AM
You already have that powerful tool - it is called "your brain". :D

-nt20
diaa_elsherif
09-05-2004, 08:50 AM
thanks nikolatesla20............but please if u have something useful rather than joking
Limee AKA Lamer
09-05-2004, 09:51 AM
aspackdie maybe unpack it.
dELTA
09-05-2004, 10:38 AM
No, nikolatesla20 is not kidding, if you think reversing/cracking is about finding the right unpacker on the net, you're way off...
diaa_elsherif
09-05-2004, 10:42 AM
I don't understand.......u mean I should search more on the net or try to understand the code and unpack it on my own?!
dELTA
09-05-2004, 11:06 AM
This board is all about understanding stuff yourself, yes. It's actually even against the board rules to ask for unpackers etc, please read the FAQ.
esther
09-05-2004, 11:21 AM
delta,
He seems shock on your reply LOL


Aspack 2.12? Maybe...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Aspack 2.12? Maybe...
PDA

View Full Version : Aspack 2.12? Maybe...

HellSoul
09-05-2004, 12:16 PM
Well, i must say, i got a problem, i have to unpack a dll

first i have opened it with lordpe to write down imagebase, import table ecc ecc, then i noticed 2 sections:
.xpdata and .adata
well .xpdata sure is a rename for .aspack so i noticed the aspack protetion then i opened the dll with PeID and it said Aspack 2.12.

so i tried to unpack it using OllyDBG.

problem is that i noticed that the protection is not necessary an aspack 2.12 indeed after reading many tutorial and trying many approach to find the OEP the results were near to zero if not exactly zero.

i think there is a debug protection that "protects aspack 2.12" in fact when i try to do something with ollydump or ollyscript it gives me a debug error.
i tried the plugin isdebugpresent but, even if it doesn't give any errors, doesn't seem to work well.

the dll is here packed with a self-executable tool
url DELETED

hope someone can help
thanks for reading.
JMI
09-05-2004, 12:52 PM
Well it seems that getting help with your reversing project was SO IMPORTANT to you, you just couldn't wait or be bothered to read the FAQ referenced in the BIG RED LETTERS. Had you taken the time to do so, you would have known not to post links to commercial software here. You would also know that we insist that people first attempt to help themselves by searching for answers to their problems both here and on the net before asking questions here.

Aspack2.12 and debugger detection are issues which have been discussed here many times before and that's why there is a "search" button available for you to do some of your own homework on these issues. You can also search the net using something like "aspack2.12 + olly detect" (without the quotes).

Time to do more reading and then report back with the results of your efforts and then ask for hints.

Regards,
HellSoul
09-05-2004, 01:50 PM
Well, first i must say sorry for the link :(
i didn't notice that i couldn't post files from commercial softwares.

please forgive me.

but before opening a new thread i've already searched for about 5-6 days on google (the net) and this forum without finding the answer to my problem.

after the post of JMI i've searched again but always without no result...
please help me :(
JMI
09-05-2004, 04:25 PM
If you first problem is how to prevent the software from detecting Ollydbg, then you need to search here and on the net for ways that software detects Ollydbg. Try using "asprotect + ollydbg detect*" (without the quotes) and read how software detects Ollydbg. The references to asprotect are because it is made by the same company as aspack.

There are 8 threads here which have some discussion of "ollydbg detect." Have you read those? There are 38 Threads here already on aspack unpacking. Have you read those or are you looking just for a canned answer for your particular target?

There are 34 hits on aspack unpacking on the exetools forum:

http://www.exetools.com/forum/search.php?searchid=33174

including several specifically on aspack 2.12, including one titled " Jump to OEP - Aspack 2.12" so I'l finding it a little difficult to understand why you can't find any information to help solve your problem. Perhaps you need more help actually learning "how to search."

Regards,


hash algo help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > hash algo help
PDA

View Full Version : hash algo help

ramin_rad2000
09-05-2004, 12:43 PM
I am wondering if any one can give me a clue about this kind of hash algo :confused:
-------------------------------------------------------------------------
10001850 53 push ebx
10001851 B900800010 mov ecx,L10008000
10001856 56 push esi
10001857 8B74240C mov esi,[esp+0Ch]
1000185B 8B06 mov eax,[esi]
1000185D 8901 mov [ecx],eax--->Serial number
1000185F 8D4608 lea eax,[esi+08h]
10001862 668B5604 mov dx,[esi+04h]
10001866 50 push eax
10001867 66895104 mov [ecx+04h],dx
1000186B 51 push ecx
1000186C 8A5E06 mov bl,[esi+06h]
1000186F 885906 mov [ecx+06h],bl
10001872 C6050680001000 mov byte ptr [L10008006],00h
10001879 FF1530B40010 call [KERNEL32.dll!lstrcatA]
1000187F 6810800010 push L10008010
10001884 6A0C push 0000000Ch
10001886 6800800010 push L10008000
1000188B E8000E0000 call SUB_L10002690(it goes down)
10001890 83C40C add esp,0000000Ch
10001893 8A4E06 mov cl,[esi+06h]
10001896 880D00800010 mov [L10008000],cl
1000189C 6800800010 push L10008000
100018A1 8A4607 mov al,[esi+07h]
100018A4 BE64000000 mov esi,00000064h -->(interesting!)
100018A9 C6050280001000 mov byte ptr [L10008002],00h
100018B0 A201800010 mov [L10008001],al
100018B5 FF1594B50010 call [MSVCRT20.dll!atol]---->does anybody know how this works?
100018BB 83C404 add esp,00000004h
100018BE 8BC8 mov ecx,eax
100018C0 A110800010 mov eax,[L10008010]
100018C5 2BD2 sub edx,edx
100018C7 F7F6 div esi
100018C9 33C9 sub ecx,edx
100018CB 5E pop esi
100018CC 5B pop ebx
100018CD 83F901 cmp ecx,00000001h
100018D0 1BC0 sbb eax,eax
100018D2 F7D8 neg eax
100018D4 C20400 retn 0004h

The brute forcing is easy:at 100018C9 ecx must be less than edx so that the carry will be set and the sbb eax,eax will then be -1(FFFFFFFF) so after neg eax function will return 1. if it is MD5 then please give me some especifics on it(i am a totall newbie in crtypto stuff)

serial number removed by mike

------------------------------------------------------------------------
SUB_L10002690
10002690 53 push ebx
10002691 BAFFFFFFFF mov edx,FFFFFFFFh
10002696 8B4C240C mov ecx,[esp+0Ch]
1000269A 56 push esi
1000269B 8BC1 mov eax,ecx
1000269D 03CA add ecx,edx
1000269F 85C0 test eax,eax
100026A1 7428 jz L100026CB
100026A3 8B74240C mov esi,[esp+0Ch]
100026A7 L100026A7:
100026A7 8A06 mov al,[esi]---->serial
100026A9 46 inc esi
100026AA 33DB xor ebx,ebx
100026AC 8AD8 mov bl,al
100026AE 33DA xor ebx,edx
100026B0 C1EA08 shr edx,08h
100026B3 81E3FF000000 and ebx,000000FFh
100026B9 8B049D70A20010 mov eax,[L1000A270+ebx*4]----->(goes down)
100026C0 8BD9 mov ebx,ecx
100026C2 33C2 xor eax,edx
100026C4 49 dec ecx
100026C5 8BD0 mov edx,eax
100026C7 85DB test ebx,ebx
100026C9 75DC jnz L100026A7
100026CB L100026CB:
100026CB F7D2 not edx
100026CD 8B442414 mov eax,[esp+14h]
100026D1 5E pop esi
100026D2 5B pop ebx
100026D3 8910 mov [eax],edx
100026D5 33C0 xor eax,eax
100026D7 C3 retn
----------------------------------------------------------------------
L1000A270:

1000A270 00000000 dd 00000000h
1000A274 96 db 96h; '-'
1000A275 30 db 30h; '0'
1000A276 07 db 07h;
1000A277 77 db 77h; 'w'
1000A278 2C db 2Ch; ','
1000A279 61 db 61h; 'a'
1000A27A 0E db 0Eh;
1000A27B EE db EEh; '®'

rest of table deleted since the first word is enough to figure out what's going on-mike

IT seems that is never ends!(if i don't make any mistake it is 1024 bytes) I don't know anything of crc but this 1024(decimal) hashtable and that 64 above is ....
-------------------------------------------------------------------------
mike
09-05-2004, 07:42 PM
Google is your friend:
http://www.google.co.nz/search?q=77073096
It's crc32.
JMI
09-05-2004, 08:12 PM
Wait. You mean they even have "crypto" on google? :idea: What a concept. That darn company is everywhere and into everything. I just didn't know those bots were good at math. :yay:

Of course, we still need Mike to tell us how the heck that math "works." There are good reasons some of us avoided those subjects after completing school. :cool: We're just not very good at the subject. :thinking:

Regards,
ramin_rad2000
09-06-2004, 01:41 AM
JMI with all the respects,but do you think there is something wrong with my thread? and mike thank you very much for the link.
JMI
09-06-2004, 10:21 AM
ramin_rad2000:

With all due respect, I was simply expressing my not to great suprise that even complex concepts, such as crypto procedures, could be found by searching the net, which you know is one of my pet projects.

The remainder of the post was a general expression of my own personal view that I have always found math a more difficult subject, and therefore less well liked, than most other subjects. I was also expressing my gratitude to people like Mike, who not only like the subject, but are damn good at it and able to explain it to those less talented in the subject, like I am.

So you see, my post really wasn't about "you" at all. It was about "me." :yay:

Regards,
ramin_rad2000
09-07-2004, 03:49 PM
jmi :loveu: man,and i believe in your talent :D
Well i hope that other people also share their knowledge on this subject


Globetrotter Parallel Dongle Clone
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Globetrotter Parallel Dongle Clone
PDA

View Full Version : Globetrotter Parallel Dongle Clone

hubschrauber
09-05-2004, 05:00 PM
Hello,

I built a hardware clone for parallel globetrotter dongle.

It is very easy to make a copy of an existing original dongle.

I can put several dongle IDs into the clone...

Is this helpful for reversing freaks ???

- Hubschrauber -
Woodmann
09-05-2004, 08:48 PM
Howdy,

It is helpful for us "freaks".
I just have a question or two.

Do you need to have the "original" dongle ??
I know you say it is easy to make a clone of an existing dongle but,
If you have the original dongle, why build a clone ??

You will need to convince me how you can put multiple dongle ID's onto one clone and have it know what the hell is going on.

And of course the most important question, HOW MUCH $$$$$$

-obc-
(Hey man, I needs ta know)
hubschrauber
09-06-2004, 02:53 AM
Hi Woodmann,

the idea was to build a clone from an existing dongle to use one lincense on several PCs.
Because I am not a good reverser but a good mircocontroller and hardware specialist, I decided to do this in hardware.
On advantage of this solution is, it works with every software, no special reversing must be done !!!
You need the original dongle to read out the rom-data on rom-id and then store to clone.
But I don't need the dongle physically, everyone can read out the original and send the data to me !!!

At the moment I have stored 4 licenses on my handwired prototye dongle. Works fine !!!!
It is no problem to store up to 10 or 50 licenses to one dongle. The only thing is I need a bigger microcontroller or use a separate data-flash.

My question, why I put this info to this board, it is useful for reversing freaks ?
Maybe it helps when cracking FlexLm manager ???

How Much ????? Currently I am doing PCB stuff.... I will calculate it......

- hubschrauber -
scorpie
09-06-2004, 03:58 AM
It is interesting that you have the solution from the hardware aspect, but do not forget that Globetrotter do not use any query in checking the dongle, just the dongle id and the serial number of the dongle (btw it is a piece of cake to replace with other SuperPro key). It would be more challenging if you could read the content of every cell of the SuperPro from hardware point of view. I am interested in your implementation anyway, and it is great if you have succeeded in "cloning" the Globetrotter dongle.

Bye,
scorpie
hubschrauber
09-06-2004, 04:45 AM
Hi scorpie,
you are right, globetrotter security is a piece of cake !!!!
So it was very easy to build the clone. About a few houres to do !!
I use a ATMEL AVR for emulation.
BUT: It's a nice solution for NON-PROFESSIONAL-REVERSERS

Sorry, I have got no SuperPro Dongle !!
-hubschrauber-
scorpie
09-06-2004, 09:07 AM
Hello hubschrauber,
You are a professinal in your field (solutions from hardware aspect are rare in the message board), and could you more specific with the ATMEL AVR ? (which one ?). It is also great that without having the superpro you can clone it. Do you use the same sentinel driver for reading your "clone dongle" ?

Regards,
scorpie
hubschrauber
09-06-2004, 10:39 AM
Hello Scorpie,

my handwired Proto was based on a MEGA8.
Meanwhile a have finished the PCB for the first series (6 dongles), These Boards
are based on MEGA48/88 or 168, because of their low voltage range. They work from
1.8 V to 5 V !!! This is very important to run on Laptop-LPT-ports with only 3.3V.
The clone is powered from the LPT like "standard" dongles !!!
Drivers: I didn't change anything of the drivers, so I think it is the standards driver from macrovision/globetrotter.
-hubschrauber-
CrackZ
09-06-2004, 03:07 PM
Hiya,

Forgive for I must have missed 60 minutes here ;-).

What exactly is a 'Parallel GlobeTrotter Dongle Clone'. AFAIK GlobeTrotter (of FLEXlm fame) support about 3 dongles (Aladdin/Sentinel and Dallas ifirc) via the FLEXID# license switch and its simply a read of the dongles ID, nothing more.

Which of these dongles does your 'Clone' support?, the technologies (protocols) used to read out the ID's of these 3 dongles are very different (h/w and s/w wise) and I'm pretty sure that FLEXlm uses the dongle vendors client library.

I guess what I'm asking in a nutshell :

1. What use is this? (aside from a cheap dongle replacement for legit FLEXlm clients).
2. How does it work (exact details here!) and which dongle(s) does it support? (i.e. which protocols have you implemented).

I think I speak for everyone on the board, when I say please post some details of everything you have done because there is considerable interest in this subject.

Regards

CrackZ.
hubschrauber
09-06-2004, 04:16 PM
HI CrackZ,

I can tell you what I know about the original dongle:
it is a "Globetrotter Dallas" connected via parallel port (LPT)
This type of dongle uses Dallas 1-Wire Protocol. Inside the
dongle there is 1-Wire-EEPROM with an unique ROM-ID (DS2505)
For connection to the LPT-port a DS1481 is used. This chip is a 1-Wire-Bus-Master
designed to run 1-Wire devices on the LPT-port.

My clone emulates the the DS1481 and the DS2505. The 1-Wire-Bus is designed
as a multi-device bus. So I can emulate many 1-Wire-Eeproms (DS2505) with my
ATMEL AVR-Controller.
To read out the original dongles you can use the Dallas I-Button Software TMEX,
from dallas/maxim homepage. Switch TMEX to DEBUG-mode and save file. This file
includes unique-ROM-ID and EEPROM data.
ROM-ID and EEPROM data I need to include in my controller source file and that's it !!

I think about to build a Copy-Software:
First connect original dongle, PRESS read out.
Second Connect empty clone, PRESS write to clone.

I hope this are enough details !?!?!

-hubschrauber-

-
dELTA
09-06-2004, 07:34 PM
As mentioned above, most of the people on this board have most of their knowledge in the software side of things. It's refreshing, interesting and valuable to have some hardware people/stuff like this here too, I hope you'll stick around and continue posting and contributing cool stuff like this hubschrauber. :yay:
scorpie
09-07-2004, 12:48 AM
Hello hubschrauber, crackZ and deLTA,

I am mistaken with having the impression that hubschrauber "clones" the superpro, and thank crackZ for pointing out other possibilities which Globetrotter support. It is clear now to me.
hubschrauber
09-10-2004, 04:13 PM
Hello TO ALL,

today I got the first 6 PCBs of the clone hardware....
... at the moment I finished soldering...
... programmed the AVR controller...
... checked with FlexLm ...

=> IT WORKS !!!!!

Where I can upload a picture of the clone ???
Has someone an anonymous server ????
Or can I send the picture to anyone by email, who can store to this server ???
Maybe woodmann or a admin could do this ???

- hubschrauber -
dELTA
09-10-2004, 05:43 PM
Cool. :cool: Maybe you can write a tutorial or something about it? That would be very nice and valuable I think, since this hardware stuff is kinda rare in most reversing communities like this one. Also see my PM.
horkey46
09-12-2004, 02:45 AM
Hi Hubschrauber,
I have been following this thread with great interest. I really enjoy the hardware aspect and was wondering what programmer is being used. Is it made by Atmel? Also, you may email the schematic to me if you wish :)
TIA,
horkey
horkey46@hotmail.com
homersux
09-14-2004, 01:27 PM
This is very interesting. I didn't know cloning dongles could be this easy. What did you use to draw the PCB? If it's in protel format? Do you mind sharing one or two of your designs? I believe you can directly attach files to your post so you could attach a zipped file or something that we all can learn from.

Great work.
dELTA
09-14-2004, 04:48 PM
Ok, hubschrauber asked me to upload this image of his actual dongle clone to the board, and said he would provide further explanations then.

Please note though hubschrauber, that everyone can upload images to threads like this, simply attach it with the "manage attachments" button in your post, and it will be displayed like this in the post (only one image per post can be diplayed though if I remember correctly).
hubschrauber
09-15-2004, 02:16 AM
Explanation to the picture of the clone:
- on the upper and right there is the parasite power supply (diodes and caps), so the dongle can run directly from the LPT port.
- on the lower side there is a logic gate chip, it is used to run printers and scanners behind the dongle correctly.
- in the center ther iss the AVR with some connectors for testing.
- on the left side you can see the last modifications I had to do, because of compatibility to the original dongle and problems with some scanner behind the dongle.
=> so it will give an new pcb in near future without handwired connections.
- hubschrauber -

PS: I tested to upload the picture by myself...
scorpie
09-15-2004, 11:26 AM
Excellent Work !!!

The PCB looks quite clean and professional (even with some small modification); congratulation.

Do you mind to share the circuit ? Kindly let me know your PM.

Bye,
scorpie
korvak
09-15-2004, 12:55 PM
For those of you that might think of getting into the hardware side of reversing (Homersux) and want to make your own PCBs for your project, i would recommend www.expresspcb.com

here is why,
free CAD software (windows based)
free schematic software (windows based)
you can save your design as a plot file for manual ordering.

and when you are done with your design, you simply connect via the internet or and upload your design... in 3-5 days and $60 you have 3 (3.8" x 2.5", a little bigger than a DB25 wide, but you can cut that down and in half to get two curcuits from one board) professional PCBs at your doorstep.... as this is all USA based, i do not know if they ship overseas or what payments they take besides visa, MC, etc. so it is worth a shot.

i already have a hardlock based PCB that works, and i am currently working on another dongle, have the prototype board done but have not worked out all the bugs from the code... these are emulators only at this time as tgodd can contest, the alogo is very difficult, and i have not figured it out yet (if ever). but the emulation works.

admins, if i have commited any wrongs here with my plug on the software i am using to make PCBs, i am sorry. i do not work for them nor do i know anyone that works for expresspcb.com. :rolleyes:

hope this helps.

korvak
korvak
09-16-2004, 12:54 PM
this first picture is of the Sentinel Super Pro.... the numbers on the sticker have been altered... but as you can see it is an ASIC type chip under a drop of glue. so you do not get much to go on when attempting to reverse engineer this puppy...

korvak
korvak
09-16-2004, 01:01 PM
this second picture is of the Hardlock, this is the New style as it is using a "Microchip" PIC 16CE625, a 4 mhz crystal and a bunch of caps, diodes, and resistors to do two things... 1) leech power from the comm port, 2) create the pump-charge buffers to change the +-12 volts to TTL for the microcontroller and for the signals from the microcontroller to talk back to the computer over the serial port. i hope that these help some one out there.

korvak
homersux
09-16-2004, 02:38 PM
expressPCB is ok for small project, but protel is more professional imo. I'd like to know if you guys can upload some schematic files of your hack for us hardware noobs to learn from, :)
hubschrauber
09-16-2004, 03:06 PM
korvak,

are you sure, that the second one (PIC-type) is for serial port ????
I think it is also for parallal (LPT) port.

-hubschrauber-
hubschrauber
09-16-2004, 03:14 PM
scorpie,
thank you for the praise, but doing pcb stuff is my profession.
Meanwhile I did further modifications, I added two connections from the controller
to the logic gates. This was necessary for some type of scanner to run in epp/ecp mode. So I think a redesign of the PCB with all handwired changes included should be done.
-hubschrauber-
korvak
09-16-2004, 03:29 PM
hubschrauber , it could be for the parrellel port as well... i know that the one i have emulated works on the serial port... i use a MAX232a for its pump-charge funtions... as i only have access to these two dongles.. i do not have enough information to give you a definitive answer.. sorry... i can only tell you what i know, anything else would be an assumption and counter active.

as for the schmatics... they are all on paper, i will see what i can do to get you something... time permitting. :-/

korvak
korvak
09-16-2004, 03:50 PM
hubschrauber, it would appear that we are both right... i just went to thier website and pulled this from it

" Where can I connect Hardlock?
Hardlock is available for parallel and serial interfaces, as internal ISA and PS/2 bus plug-ins, as PCMCIA (= PC card) cards and for the brand-new USB interface. The user or software developer doesn't have to spend one second thinking about which interface he'll ultimately use. The Hardlock libraries automatically detect where a Hardlock is connected (only when used and operated on the serial interface does the system have to be informed)."

so there are alot of different flavors of this puppy out there....

oh, and i know this is a little late... but, yes in deed, nice PCB.... did you do the soldering yourself? and if so... was it with a soldering iron or a hot-air machine.... i can not find a soldering tip to get down past the SOIC level/805 component in size with out soldering pads and legs together.

korvak
hubschrauber
09-16-2004, 04:13 PM
korvak,

thank you for the information about the serial/parallel dongles.

Soldering: It is hand soldered with a Weller MLR21 solder iron.
I have experience in soldering over 25 years, I started when I was about 9 years.
(-> now it is possilbe to calculate my age, the first who replies a post with the correct age will win a washing machine).
It is no problem for me to solder fine pitch components (0.35mm) or 0603/0402 SMDs.
It a part of my profession to build very quick handsoldered prototype PCBs.
I drilled soldering in my youth, when I was building very smal bugs !!
-hubschrauber-
JMI
09-16-2004, 08:02 PM
OK. I accept the challenge. 9 years of age plus 25 years makes you only 24 years younger than I am. Did I win, huh, did I, did I??? I need a new washer. :devil:

Damn find work all of you. Keep it comming. :yay:

Regards,
hubschrauber
09-17-2004, 02:12 AM
JMI,

yes you win !!!

-hubschrauber-
monguz
09-17-2004, 03:07 AM
nothing realy new but as good old design example for the hardware 'freaks' :)
built around a Philips µC or ASIC (low power) with a small EEPROM and a few passive components, seems to not have own clock generation...
hubschrauber
09-17-2004, 03:28 AM
I think the attached AVI file is very interesting to all non hardware freaks...

It is no fake !!! I touch the DEVICE with the solder in my hand...
... and I am still alive !!!!

Who can explain this ????
- hubschrauber-
dELTA
09-17-2004, 04:32 AM
Cool. :cool: I'm waiting for an explanation too. :)
monguz
09-17-2004, 05:56 AM
it looks like some HighVoltage and higher frequency school experiment in the real-life (i mean out of control :) ) :) or it has to do with insect-killing ?? :)

greatz monguz
p.s. its cool man...
hubschrauber
09-17-2004, 07:34 AM
hi monguz,

you are right: high voltage and high frequency....
... is a special style of CCFL-converter you can find in every notebook backlight system.

This device makes power up to 50 W in the spark !!!
So the solder is melting.

I will go on holiday for 10 days...
... coming back on 30th september...

-hubschrauber-
korvak
09-17-2004, 09:36 AM
here is the top and bottom images of the circuit i made with the expressPCB software... they are in the pdf format, i hope that everyone can view them. i could not get them to convert to a .jpg or another format. all i could do is print from the expessbcb application to the acrobat distiller...anyways, i hope this helps.....

so what are you looking at?

the top and bottom image are just that... the top and bottom of a two sided circuit board.... now i like bells and whistles, and i like versitility in my projects... so in this mess of pads and traces i have a microcontroller "U1", a rs232 converter (U2), a low drop-out voltage regulator (U3), a 64bit serial number chip (U4) and a real-time clock with 56 Bytes of nonvolatile ram (U5), this is a DIP PCB, the rest i have are all surface mount. i did not want to discourage anyone into thinking "i could never do that, the parts are so small....."

So... do you need all of this for emulating the SERIAL hardlock...simply put.. no.. all that is needed is the voltage regulator of some sort, the signal converter (for serial rs232/TTL voltage levels), and a MPU. so you ask yourself.... what is all this other crap then? well, i could never follow the KISS rule (keep it simple stupid, which accounts for many of my lost hours of sleep and thinning hair....) and when i designing something i get all these other ideas in my head of what else this curcuit could be used for :idea: ... hense the other two items that are not needed... i also tend to go with the most powerfullest MPU i can, the reason, is that when i set out to reverse something... there are way too many unknowns, remember you are trying to make something from hardware/software that alot of the time has been created at the hardware level (ASIC), and software is always slower than hardware at the core level... what do you mean?.. well for an example, you may have to use a set of software instructions that shift a datastream in and keep track of how many bits have been shifted in, then once you get those 8 bits to make a byte, then you have to have another set of instruction to move the byte, do some function on the byte, and set up for the next set of bits to be shifted in or out... all of this can easliy be done on the hardware/logic gate level..... still not sure what i mean... let me put it into numbers... take for example a 16x16 bit multiply function, on the same MPU @ 10Mhz, the software level will take a max of 254 Cycles (102.6 microseconds), on the other hand the hardware level will take a max of 36 cycles (14.4 microsoecond). i hope that did not confuse the hell out of you... anyways back to the why the most powerfullest MPU i can get... i would rather have the MPU idle then to have to rework my whole design and code to get a few extra microseconds out of it to meet the needs of whatever i am reversing to make it work... in the prototyping stage, i alway think more is better, when you go to finalization you can always scale back to what is really needed.

so the other two items are a 64 bit lazer etched serial number chip, why? well it allows me to keep track of my PCBs, as no two will ever be the same... i was messing around with 1-wire stuff a while back and liked it so it got put into everything i seem to do now.

the other item is a real time clock with a 32.768 Khz (color-burst) crystal with 56 bytes of non-volatile ram... this uses a 2-wire, bi-directional bus... it is good for time stamping if you are data logging or need time for some reason, and with the 56 bytes of non-volatile ram, you do not need to add an extra memory chip if you only need to store a very little bit of data... if you need more data space you can always add some of the newer serial eeproms or what ever you like, also some of the newer MPU have DATA EEPROM onboard.

well i hope this helps some, if you do not understand all of this... that is ok.. i do not understand all of the stuff you programmers mention... it is all about learning and what you really like to do... :yay:

korvak
dELTA
09-17-2004, 03:09 PM
I combined and converted the files to an uploadable picture, here you go:
cah
09-23-2004, 08:01 AM
Dear Korvak & others

Is any PCB avail for hasp4 lpt & usb locks?
How to access hardware like screet tables, hidden memo, Id?

Help on this suubject is highly appreciated

CaH
korvak
09-23-2004, 08:20 AM
CAH,
i personally do not have any designs for the hasp, as i have not had a need for it... i would think that a parrellel/serial (which ever it uses) would not be hard to do... in the end... the dongle connects to a DB25 (not the usb device, of course) and from there by either direct connects from printer port to MPU or from a Serial port thru a rs232 converter to the MPU...

if you need help in developing this, let me know, i will help where i can... but to keep with the spirit of this BB, you have to put some effort into the project yourself...

here to help....

Korvak
scorpie
09-23-2004, 12:17 PM
Yes,
Here it is.
dELTA
09-23-2004, 01:58 PM
Where now is what now? :confused:
cah
09-24-2004, 12:55 AM
Dear Korvak

Thanks for your response on H4 PCB.
I am interested in this development.
How to start& What we need to start?

send me your mail id
CaH
korvak
09-24-2004, 08:13 AM
CAH,

where to start?

well... now starts the leg work... and alot of it... start by reading the manual or SDK.... have you read the technical details yet? in specific, the pins/signals needed, then you need to get a logic analyzer of some sort to watch the signals...otherwise dont bother, you would be wasting your time.... does the SDK talk about the protocal or handshaking that goes on between the pc and the dongle? this is the first road block that needs to be figured out... how to talk to each other at the very basic level....how many pins are used? serial... one in, one out, clk, what? ... or parrallel, 8 bits every clk cycle....

after that watch your signals for patterns... here comes all the "paperwork", is the data being grouped (ie. data, pause, data, pause...), or is it a constant stream of data, then is it being sent LSB first or MSB first? once you figure this out, you can start to break out the command words and data, there is alot of informaiton on this BB as to what you are looking for...

once you have some of the cmd words and data structure... run an aplication and capture the data session on the dongle...

if you have plans on reuseing your dongle emulator for other projects, you can approach the software in the MPU from a modular design (cmd word response design) instead of a "i already know what it is going to ask next over and over, it is the same thing, so i will send it what it expects" i know this is confusing but look at it as a difference between a "Random" session and a "sequential" session... the random design take a little more work in the beginning, but it pays off in the end if you are going to use this for other projects.

now the real fun part... writing your code to....
1) talk to the pc
2) understand what the pc is telling your MPU to do? (sending cmd words)
3) sending the correct data back to the PC (response)
4) house keeping internally in the MPC (setting up the correct variables everytime and making sure your code does not do strange things)
5) recovery... what does the MPU do if there is an error in the protocal or internally... (stack overflow, stack underflow, brownout, reset, initial power up, etc... )

well this sould get you started on thinking of what needs to be done...

hope this helps.. let me know.

korvak

P.S. Sleep... who needs sleep? i will get all the sleep i need when i am dead :-/
cah
10-01-2004, 02:05 PM
Dear Korvak,
Thanks for your response & reply.
Do you have any PCB designs for both hasp4 & sentinel with component details?
How to find Chips for ASIC, Sources & developing communication with PC?

CaH
korvak
10-04-2004, 08:28 AM
cah, as i stated before in this thread, i do not have any PCBs for the Hasp type dongle, and i am currently prototyping a PCB (wirewrap at this point) for the sentinel SPRO, and as far as the component details... it is again nothing more that a microcontroller, power reg, some caps, resistors, glue components...... and i do not want to sound like i am not forecoming in information, but part of the fun is figuring out what you need to make this work.... so far i have not seen any real effort.... have you even put a scope or logic analyzer to your target? if so, what have you seen and figured out yet, reversing hardware is alot different then software, your just cant run ida or softice and patch the target... you really have to hook stuff up and watch your target...

as for "how to find the chips for the asic".... the easiest way i can think of is to go work at the manufacture as a janitor and "borrow" what you need... but really... i do not know of any way to find out what ASIC it is because 99% of the time the ASIC is "Proprietary", so you are not going to get your hands on it even if you do get a part number or find out what it is, so much for sources, i once call "phillips" about the "FAST" chip in the "hardlock" why? well if you look very closely at teh "FAST" chip you will see the "phillips" logo, and back then when i called, that was all i had to go on, needless to say i hit a stone wall ....

if you are wanting to know how to find an equivelant chip for the ASIC... like i said, i go for the most power i can get out of a MPU and then scale back when the design is done, if the need is there to scale back...ie, to reduce the power consumption due to a high oscillator, the other factor is what you are comfortable with, if you like Amtel, or Microchip, or Intel, or Scenix, or what ever you know how to use in the way of MPUs, then go with that... but there again you have some paperwork to do to find a chip that "might" but able to do the functions you are looking for... and if this is your fist attempt to use a MPU then you have a serious learning curve ahead of you, with the power that some of these MPUs have now, if you are new to this, it can take you weeks just to get the registers to "init" correctly so you can start the real work....

so now to your point of starting... "developing the communication"... are you attempting to hack the serial, parrellel, or usb flavor of the device?

read the specs on the PC port itself.... what are the hardware voltage and current levels, what pins do what? i do not want to sound vague here also but understand that the ports usually have slave chips that are designed to handle the port function and nothing else, so you can not take a serial port and turn it into a parrellel port by changing setup registers and think you are now going to get 5 volts out of an RS232 (+-12 vdc) compliant port...
now look at the signals on those pins, watch ALL of them... what order to do see data on them, and how often? is there a clock signal, or lack of a clock signal? what is the pattern that the pc send data to the target? only when you hit a certain function on the target program? or continuously?

and do some of the "ground" work so that you can step up to this table and we can hack forward.... :D

Korvak


Need Hacking Services Site
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Need Hacking Services Site
PDA

View Full Version : Need Hacking Services Site

Immanuel
09-05-2004, 05:44 PM
it is my first time to post a new thread here but i have mor honor to do it.
At first i'd like to thank all administrators ,moderators and members of this marvelous forum for their great effort.
cuz i like this forum and the woodmann sites at all , i ask for a good hacking site support more services e.g. toolz , tutorials and tips. as th

i 'd like to apologize for my request cuz it is out if the subject of this forum

thanks again for ur services
dELTA
09-05-2004, 07:10 PM
I'm not exaclty sure how you define "hacking", but a large part of the best reversing sites on the net, including tools sites, are listed in the table at the bottom of this page.
Woodmann
09-05-2004, 07:33 PM
Hey,

Maybe he means old school like with a 2400 baud modem and a home made dialer. Oh wait, I saw that in a movie I think :p

Maybe he means where can I get a "root kit".
Perhaps his English aint so good and it will be difficult to determine what it is he is asking.

At least he gave out "props" :D

Woodmann
(BTW, where the hell is +Spl/\J)
JMI
09-05-2004, 08:04 PM
Shhhhh. I'll never tell. :devil:

Regards,
Immanuel
09-08-2004, 03:31 AM
i mean hacking into emails ,web applications -under ASP ,PHP and CGI - ,servers software like IIS 6 ,Appache servers ,Computer systems like Windows 2000 server.
Oki at Thanks anycase for all replies :yay:
JMI
09-08-2004, 10:48 AM
That is not generally what we do or discuss here. You should be able to find all the information you might want using search terms, such as "hacking forums." (without the quotes.)

Regards,
Silver
09-08-2004, 12:29 PM
old school like with a 2400 baud modem

eep. That's old school? Man, I remember when that was brand-spanking-new school!
JMI
09-08-2004, 02:10 PM
Well heck,

I remember using both the hand cranked and the, any color you wanted, as long as it was black, dial telephone and there was no modems to be used. And there was no internet to connect them to, let alone by use of a modem of any speed. :eek:

Regards,
Woodmann
09-08-2004, 04:58 PM
Howdy,

It seems there are now three old bastards here :D

I was actually gonna say 9600 but I didnt think anyone would know what it meant. I started porting to machinery with like friggen 280 ????

He did want a "root kit".
Sorry son, we dont do them there kinda things around these here parts ;)

Woodmann
JMI
09-08-2004, 07:54 PM
And you better mosey on outta here before sundown, or Mr. Dillion will be bending his six gun over long side your head. :eek:

Regards,
Silver
09-09-2004, 11:59 AM
hehe, I had a trusty old US Robotics door wedge 2400 baud thing... was beige plastic with a lime green stripe across it. I thought it was top of the range super-cool because it had red led's for TX and RX separately, instead of TX/RX combined :)

Yeah. I came from the old dial-up bbs scene...
Woodmann
09-09-2004, 04:29 PM
If I recall correctly, was it comp-u-serve to offer easy access.
I do remember direct dial access to the BB scene.
Friggen toll calls to Cali made me broke.

Woodmann
JMI
09-09-2004, 04:32 PM
Why were you calling the Columbian city (you know "Cali"), ordering some blow? :eek:

Or did you mean "Cali-fornia." :whoops: Which is how our Govenator pronounces it anyway. :yay:

Regards,


How to porting this code with SDK
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > How to porting this code with SDK
PDA

View Full Version : How to porting this code with SDK

Limee AKA Lamer
09-05-2004, 05:53 PM
the dialog.asm is written with asmeble,
how to write with SDK?
Who can help me ,thanks!
-----------------------------------------------------

.386
.model flat,stdcall
option casemap:none
DlgProc proto :DWORD,:DWORD,:DWORD,:DWORD

include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib

.data
DlgName db "MyDialog",0
AppName db "Our Second Dialog Box",0
TestString db "Wow! I'm in an edit box now",0

.data?
hInstance HINSTANCE ?
CommandLine LPSTR ?
buffer db 512 dup(?)

.const
IDC_EDIT equ 3000
IDC_BUTTON equ 3001
IDC_EXIT equ 3002
IDM_GETTEXT equ 32000
IDM_CLEAR equ 32001
IDM_EXIT equ 32002

.code
start:
invoke GetModuleHandle, NULL
mov hInstance,eax
invoke DialogBoxParam, hInstance, ADDR DlgName,NULL, addr DlgProc, NULL
invoke ExitProcess,eax

DlgProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
.IF uMsg==WM_INITDIALOG
invoke GetDlgItem, hWnd,IDC_EDIT
invoke SetFocus,eax
.ELSEIF uMsg==WM_CLOSE
invoke SendMessage,hWnd,WM_COMMAND,IDM_EXIT,0
.ELSEIF uMsg==WM_COMMAND
mov eax,wParam
.IF lParam==0
.IF ax==IDM_GETTEXT
invoke GetDlgItemText,hWnd,IDC_EDIT,ADDR buffer,512
invoke MessageBox,NULL,ADDR buffer,ADDR AppName,MB_OK
.ELSEIF ax==IDM_CLEAR
invoke SetDlgItemText,hWnd,IDC_EDIT,NULL
.ELSEIF ax==IDM_EXIT
invoke EndDialog, hWnd,NULL
.ENDIF
.ELSE
mov edx,wParam
shr edx,16
.if dx==BN_CLICKED
.IF ax==IDC_BUTTON
invoke SetDlgItemText,hWnd,IDC_EDIT,ADDR TestString
.ELSEIF ax==IDC_EXIT
invoke SendMessage,hWnd,WM_COMMAND,IDM_EXIT,0
.ENDIF
.ENDIF
.ENDIF
.ELSE
mov eax,FALSE
ret
.ENDIF
mov eax,TRUE
ret
DlgProc endp
end start

---------------------------------------------------------------
dELTA
09-05-2004, 07:14 PM
For the love of f*****g god read the posting guidelines already, I'm starting to get tired of this...

And in addition to that, for pure assembly language programming questions, the following site is better suited:

http://board.win32asmcommunity.net
JMI
09-05-2004, 08:07 PM
It would certainly appear that limee has severe challenges beyond the language barrier. :rolleyes:

And dELTA, the Diety does not need to fornicate. The Diety is, so the story goes, capable of "creation" without such "physical" activities. :idea:

Regards,
Kayaker
09-05-2004, 08:13 PM
the dialog.asm is written with asmeble,
how to write with SDK?
Asmeble. I like that word. What is it you want to do, write it in C/C++ ?
Neitsa
09-05-2004, 08:38 PM
Hello,

Since MASM32 relies heavily on windows, 'translating' a Windows MASM code like the above, to C++ is trully easy (I mean if it doesn't have some specific asm part). There's also an '__asm' keyword in C++ for those specific stuffs.

You'll find a lot of tutorials on basic API programming with C++ (I mean without MFC). Also, be sure to check the MS website, specially the MSDN which is, we must admit, a great knowledge base on Win system.

MASM32 haven't an 'SDK' like C++, but it's trully a powerful low-level language, on the other hand, it is not a good langage for big projects, and it doesn't support OOP (object programming), because it's a procedural language and low level language doesn't support this type of coding.

If you're interested in ASM on windows X86 plateform you should check:

Iczelion web site : http://win32asm.cjb.net/
The AOA ( Art of Assembly): http://webster.cs.ucr.edu/AoA/
MASM32 forum (by hucth): http://www.masmforum.com/
The MASM32 web site: http://www.masm32.com/
and the link provided by Delta which is the biggest Win asm community.

If you're interested in reversing, you'll need to know Asm instructions ! Get a copy of Intel manuals (on paper or in e-version).

Regards, Neitsa.
Limee AKA Lamer
09-06-2004, 06:33 AM
[Merged from separate thread in Advanced forum, by dELTA]

I can't compile it,give me a hand.
thanks!
Neitsa
09-06-2004, 07:19 AM
Hello,

Sorry to answer this way Limee, but, first of all I think you're in the wrong section of the forum, do you think your question is related to "Advanced reversing and programming" ?

You're question is related to the other post you've previously made, so post it in the same thread.

Second, When such a question arise, I think the minimum things to tell to other people is what are the errors given by the compiler ?
dELTA
09-06-2004, 08:14 AM
So limee, that being said, in addition to what you've been told earlier (apparently without you listening at all), one more post breaking the guidelines from you, and you're out... And this time I'm serious.
Woodmann
09-06-2004, 06:00 PM
Seems to me he shall be "right out".

And the counting of the numbers shall be. The number one being the first number shall be spake. After the number one be spake thou shalt proceed to the number two. After the number two be reached thoust shall proceed to the number three. Two shallt not count neither shallt four.

FIVE IS RIGHT OUT.

Once the number three be reached thou shallt lobbest thyne holy hand grenade towards thy foe, who being naughty in thyne site shall snuff it.

(butchered by me on behalf of the "Holy Grail")


IDA_2_PVDasm (MAP)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA_2_PVDasm (MAP)
PDA

View Full Version : IDA_2_PVDasm (MAP)

Bengaly
09-06-2004, 02:18 AM
hi,

here is an IDC Script that will generate a modified MAP file used for PVDasm.
currently it will export function boumdries & data in code segments.

the current version of pvdasm doesn't support the map feature.
but next version will.

thanks for the support,
Bengaly


Down memory lane
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Down memory lane
PDA

View Full Version : Down memory lane

roocoon
09-06-2004, 02:32 AM
Hi all.
I remembered a tool that saved me lots of time in the 80's. It took me longer to remember its name but I did :). Maybe some of you have come across it.
It was called VIM. Not the Linux one. It was a virtual machine emulator that showed up before Softice did and supported DOS. It really beat trying to skip over interrupt vector corruption using DOS's Debug.
Anyway, I found a page by the guy who wrote it and it has links to the program and source code.
Maybe it will have something useful there for some people.
It's not commercial software so I guess posting the link is fine.
h**p://www.datapackrat.com/source/vim.html
dELTA
09-06-2004, 08:02 AM
Hehe, always nice with some nostalgia. :)


Perhaps its Time
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Perhaps its Time
PDA

View Full Version : Perhaps its Time

peterg70
09-06-2004, 07:56 AM
These single posters asking for cracks/etc are gettign excessive. Perhaps its time to restrict these new users to a separate forum where they can post to after seeing the FAQ but unable to post to other sections of the forum.

Lets say until you reach 20 valid posts (not just quick replys) you have to click through the FAQ and the button to proceed only appears after 30 secs. Then when posting they can also see a short version of the FAQ where it states that the post must confirm to these rules.

Anyway my 2 cents worth.
esther
09-06-2004, 08:30 AM
Well I have suggested that in the past since the faq has made.
Forcing them to read the faq for 2 or 3 weeks before they can post on any section or maybe just like exetools in the past hide certain sections which new comers ;)
dELTA
09-06-2004, 04:03 PM
Such "initial limits" can be quite annoying to the "good" new users, and in turn scare them away I think. As long as we are able to flame/delete all bad posts I think this is the most efficient way, while at the same time keeping the good new users coming. Forcing people to see the FAQ might be worth it, but I doubt the ones who make the bad posts would care much anyway in the end. :-/
Woodmann
09-06-2004, 05:49 PM
Howdy,

Despite the "BIG RED LETTERS", people will do what they want.
If they have no plans to stay and learn they will ask whatever it is they want. We just delete them as soon as possible.

I think the bigger problem would be those who say they read the FAQ and include such a statement in their post. Just because they said they read the FAQ doesnt mean they actually understood what they read because after saying they read it they post their lame ass question anyway.

Since I dont want to place restrictions on new posts, the way things are done now seems to be the best way.

Woodmann
JimmyClif
09-07-2004, 02:41 PM
What about giving every new User as default signature something like:

Please flame me if my question could have been answered using the Search (http://www.woodmann.net/forum/search.php?) or the FAQ (http://www.woodmann.net/fravia/rce-faq.htm).

After like 10 posts allow them to change their signature :)
Woodmann
09-07-2004, 06:19 PM
It has potential ;)

Woodmann
dELTA
09-07-2004, 06:26 PM
Hehe, kinda good idea actually. :) The problem is that there doesn't seem to be any option to set a certain default signature on new users (all other necessary functionality to create such a thing exists though), so it seems like it would require a hack. :-/ First of all, it always takes a little time to create a hack, but that would be ok if it wasn't for the fact that you have to manually maintain (and possibly update) these hacks for each new vBulletin update, which sorta sucks. :(
dELTA
09-07-2004, 07:30 PM
Oh to hell with it, it's patched and done. :) Due to a stupid problem in vBulletin this default signature can still be changed by the new users though (ssh, don't tell them), but I'll fix this soon too. Thanks for the idea JimmyClif, let's hope it turns out well. :)
JMI
09-07-2004, 08:59 PM
Oh no not a 10 post limit. Where did you guys steal that concept? :smug:

Regards,
naides
09-07-2004, 10:55 PM
:devil: The Devil's Advocate Here.
And No, I am not trying to start a professional competition with JMI.

Question to the public: Why do you get so much annoyed when a renegade pre-teen posts a crack request or some other nuisance like that?
It is part of the background noise, the price of being public in the net. . .

If you cannot tolearate mosquitoes, you will miss the marvels of Kenya National parks.
Aimless
09-08-2004, 12:10 AM
Wrong move.

Its not in the spirit of spreading of knowledge. And the fact that we allow open access is what makes this board special.

Its like saying that till we use a GNU software application at least 10 times, they will continue showing a nag screen. After that it will stop showing the nag screen. This may be a good idea by purists who think that _only_ really interested people will therefore use the software. In reality most people who need the software would look for alternatives.

I think let things remain as they are. Of course, its not my board so feel free to ignore me if you really want to do it.

But expect a decrease in the traffic. And decrease in the chance that we may come up on a really good cracker.

Keep things open. Otherwise I see us going on the road to "elite" group of fravia's and nothing more. We are no better than PC or UCF.

Have Phun
dELTA
09-08-2004, 08:52 AM
Aimless, please note that this policy wouldn't imply any other limitation whatsoever in addition to not being able to change your signature for the first 10 posts.

But sure, the wording may be unnecessarily harsh, so it is now changed to the following instead:

I promise that I have read the FAQ (http://www.woodmann.com/fravia/rce-faq.htm) and tried to use the Search (http://www.woodmann.com/forum/search.php?) to answer my question.

And we'll also leave it for now that people can change it to something else at any time they want, e.g. immediately. It will still be a good reminder for everyone, and make it harder to claim that "I didn't know that".

Finally, for the people wondering why we care so much about members following the rules. First of all, there are possible legal implications if this board gets a public image of being a place where people trade cracks and do other illegal stuff, which might in turn lead to it being closed altogether, and that's not very good, now is it? Second of all, most of you don't see half of all the stupid/illegal posts, because we remove them before you do. Third of all, as cute as it may be with the odd moron making a fool out if himself, if these posts get too common, it will indeed scare away the people "with potential" too, because it just makes the board look like another gathering place for immature and non productive crack exchange.
JMI
09-08-2004, 11:05 AM
It is a fact that our ISP does get requests to close this place down when others think they get a hint of the posting of prohibited materials under US law. We have had to "re-locate" on more than one occassion because of such threats. Therefore, as dELTA says, we have to be as viligent as possible.

While these first type of posts are potentially dangerous. the second class are simply an annoyance and part of life on such Boards. As Woodmann says, those who aren't going to take the time to look around and get acquainted with the rules, aren't going to look around and get acquainted with the rules, no matter what we do to them. The are simply too self-possessed to get instant gratification and a "solution" to their issue, that nothing else matters to them and they don't care whether or what the rules may be. They will simply have to be dealt with as they appear.

Regards,
CluelessNoob
09-08-2004, 11:48 AM
What about giving every new User as default signature something like:

Please flame me if my question could have been answered using the Search (http://www.woodmann.net/forum/search.php?) or the FAQ (http://www.woodmann.net/fravia/rce-faq.htm).

After like 10 posts allow them to change their signature :)

How about adding a time aspect to it as well? I've been (mostly) lurking here for several months, read through the FAQ many times, etc...

Seems a bit presumptuous to think anyone with less than 10 posts has little to add.

:D
dELTA
09-08-2004, 12:07 PM
As I said above, we're skipping the initial period altogether for now. All we're doing is setting the discussed default signature upon registration, but the new members can change it at any time they like.
Woodmann
09-08-2004, 05:07 PM
'tis nothing more than another reminder.

Woodmann
JMI
09-08-2004, 07:56 PM
Which the truely lame will not even notice. :yay:

Regards,
disavowed
12-28-2004, 08:52 PM
How about requiring new members to pass a quiz based on the FAQ before they can post? The quiz can be multiple-choice, so it can be automated and not require Admin intervention to "grade" the quizes.

Thoughts?
Kayaker
12-28-2004, 10:51 PM
Noble idea, but not all new registrations are necessarily newbies, or unwilling or incapable of searching for their own basic answers before posting. It would seem a shame to submit them to some kindergarten faq quiz before they might contribute something perhaps interesting to the board. Some experienced reversers return here from time to time under a new moniker, with no need or interest in reading the faq, pity they should be subject to grading as well.
JMI
12-29-2004, 03:48 AM
I tend to agree with Kayaker. The truely lame will not read the FAQ no matter what and those who are new, but "not-lame," will read the FAQ or, more probably, do not need to. :idea:

Regards,


another aspr question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > another aspr question
PDA

View Full Version : another aspr question

Sturm
09-06-2004, 10:41 AM
ASProtect 1.23 RC4 - 1.3.08.24 -> Alexey Solodovnikov is the version
i've used the search engine many times to find info on different things here (thus why this is one of my first posts), however there is a small problem i can't overcome with this program and it happened to me before on another program...and im wondering if someone could help me...

Following Labba and R@ider's tut, i get lost after doing the trace eip<900000 ( or the other technique used by R@ider )
in both their examples, they endup on a JMP that goes right back into the asprotection code...mine however ends up on a RET that doesn't go back to the protection code (which seems to be in the 00C000 range) but instead goes on to what seems to be the normal program code (in the 400000 range).
it might be the OEP but i doubt it'd be that easy..

has anyone encountered a similar problem...? if so..how did you bypass it?
my main interest is to learn how to unpack aspr correctly and not really unpack this specific target. however its really annoying me that i can't even find the OEP :|
tks
SvensK
09-07-2004, 03:06 AM
PM me a link for the target.
Sturm
09-11-2004, 02:43 PM
haven't had any luck?
i_registered
10-01-2004, 06:39 PM
I've got the same problem, the code starts with:

00401000 68 01506600 PUSH xxxx.00665001
00401005 E8 01000000 CALL xxxx.0040100B
0040100A C3 RETN
0040100B C3 RETN

After skipping all warnings and a trace over, I end up at:

00C663A3 50 PUSH EAX ; xxxx.<ModuleEntryPoint>
00C663A4 C3 RETN

The entry point then is set to where we originally started, it now looks like:

00401000 EB 10 JMP SHORT xxxx.00401012

I've created a loader (using dUP) that works, but wanted to do an inline patch (which I can't get to work).
hobferret
10-11-2004, 03:33 PM
You are in the right place only the real EP is further down :devil:

Keep tracing and you will find it :eek:

No more clues, there are plenty of posts on this version of ASPR so if you can't find the EP get searching and you will get the info you need :yay:

/hobferret
JMI
10-11-2004, 06:31 PM
hobferret:

Always Reply without Quote unless it is really needed because of intervening posts of to highlight a particular part of the post. Saves room in the Server and the archive. :yay:

Regards,


IID King 2.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IID King 2.0
PDA

View Full Version : IID King 2.0

Crudd
09-06-2004, 02:30 PM
IIDKing allows you to add imports to ANY PE file's import table, thereby
eliminating the need to have to do LoadLibrary then GetProcAddress.

Whats New:
-Added the ability to add an unlimited number of DLL(s) and their
corresponding Function(s) to the target exe.

-You can now run IIDKing an unlimited number of times on any given target and
IIDKing will only ever use ONE section called ".IIDKING" in your target. Old
versions of IIDKing required more.

-When you run IIDKing on a target that has already been modified via IIDKing
v1/v2 it will notify you of this fact and subsequently load the previously
added DLL(s)/Function(s) into the IIDKing dialog. This allows you to re-run
IIDKing for the purpose of removing or adding to past import additions to
your targets.

-Added an easy to use interface for adding DLL(s)/Function(s) in the form of a
list dialog. You simply select the DLL filename as you wish and it will list
all it's available exports for you to choose from. Leaves no room for case
sensitive or spelling errors when adding DLL(s)/Function(s).

-IIDKing v2 is much more intuitive in handling user actions and hence can be
kept open and used continuously on the same target or any given number of
targets. No need to restart iidking ever.

Crudd [RET]

If you cant d/l from here, its on the RET site.

This isnt my tool, i just posted it for SantMat. Its his and he deserves all the thanks.
dELTA
09-06-2004, 04:10 PM
Looks great, thanks for sharing. :cool:
JMI
09-07-2004, 08:52 PM
It is always good to see members trying to make tools for the rest of us to try. Particularily for those of us who have no time to try to code our own. :yay:

Regards,
TQN
09-07-2004, 10:16 PM
Great work, Crudd. Thank you for sharing.
The tool run fine on my Win2K machine at work, but it run no stability on my WinXP (no service pack) machine at home. It delete all the import part of system dll, leave only the import part of adding DLL. When click the "Pick DLL" button, click cancel or click cancel when list of export functions showed, later, click "Pick DLL" will not show anything.
Regards,
TQN
SantMat
09-09-2004, 09:36 PM
The issue on WinXP machines has now been handled and a new and fixed version of IIDKing v2 will be up as soon as possible at www.reteam.org

Furthermore, IIDKing v2.1 is due to be out by this or next weekend as per the ETA on the www.reteam.org projects' page.

Thank you for using IIDKing and giving updates on any bugs you encounter. There should be no more issues concerning the smooth running of IIDKing in the future on any windows os. The only issues after this update will be what new features to add ;)

As soon as IIDKing is up on www.reteam.org you will be able to tell by looking at the 'site updates'.

Thanks,

SantMat[RET]
doug
09-09-2004, 09:53 PM
I'm curious, what kind of bug was it?
I've seen things running on XP but not on 2K, but rarely the other way around.
Devine9
09-10-2004, 12:07 AM
An updated version has been posted on http://www.reteam.org.
TQN
09-10-2004, 01:45 AM
Great work !
Thanks for fast update. But the program will crash when open a PE file have readonly attribute or being used by another process.
I have debugged IIDKing with OllyDbg at this night, and I found a bug in your code. I have some ideas which I wish to share with you if you don't mind.
You call CreateFile with GENERIC_READ | GENERIC_WRITE, but you did not check the return value of this call, and pass return handle directly to CreateFileMapping function. CreateFileMapping return NULL, and program will go to the cleanup code: CloseHandle with two above handle.
As MSDN and Kayaker have said in a post, CloseHandle with a wrong handle value will throw an exception if we are in debugging mode. If we installed VS .NET, mdm.exe (Machine debug service) will run as a startup service. So a exception will throwed although we did not run IIDKing under a debugger.
This is my suggest code to fix this bug:
/* Assign default value to all handle variables */
HANDLE hFile = INVALID_HANDLE_VALUE;
HANDLE hMap = NULL;
LPVOID lpMap = NULL;
....
hFile = CreateFile(xxx);
....
hMap = CreateFileMapping(xxx);
...
lpMap = MapViewOfFile(xxx);
....
Cleanup:
if (NULL != lpMap)
{
UnmapViewOfFile(lpMap);
lpMap = NULL:
}
if (NULL != hMap)
{
CloseHandle(hMap);
hMap = NULL:
}
if (INVALID_HANDLE_VALUE != hFile)
{
CloseHandle(hFile);
hFile = INVALID_HANDLE_VALUE;
}
Best regards,
TQN
SantMat
09-10-2004, 01:08 PM
I will certainly look into that and have all that patched for the v2.1 which is coming soon. Thanks for the feedback TQN.

SantMat[RET]
seven
09-10-2004, 02:01 PM
thx so much
u r the best .
Neitsa
09-10-2004, 04:30 PM
Thanx Crudd for your tool !

I remember using the first one. That was great ! :)

Nice improvements.

Regards, Neitsa.
SantMat
09-10-2004, 07:49 PM
Just to clarify...

I, SantMat, coded IIDKing. I released IIDKing v1 through the Immortal Descendants in 2000 and this latest release, v2, through RET ;)

SantMat[RET]
Neitsa
09-10-2004, 08:14 PM
Hello SantMat, Nice to meet you !

The first version is always in my DD.

I must say it has helped me a lot when I wasn't knowing how to do those things "with my hands". Even knowing how to do it now, I should say I've used it a lot for many reversing purposes. I think I've learned how to do it when disassembling modified files by IIDKing v1.0.

This is trully a good work, and it has learned me a lot.

My best regards, Neitsa.


how to use adb to get the seed on unix?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how to use adb to get the seed on unix?
PDA

View Full Version : how to use adb to get the seed on unix?

jb1968
09-07-2004, 09:17 AM
My target is locked by flexlm, I debug target and set breakpoint at lc_init,my question is :when target stop at lc_init, how to get the seed? thanks.


Why the program crashed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Why the program crashed
PDA

View Full Version : Why the program crashed

Limee AKA Lamer
09-08-2004, 01:37 PM
I establish a SEH handle to deal with
int 1 exception，why the porgram crashed?

.586
.model flat,stdcall
option casemap:none

include kernel32.inc
include user32.inc
include windows.inc

includelib kernel32.lib
includelib user32.lib

.data
szCaption db "SEH",0
szTextSTEP db "The Program run on Step mode！",0
szText db "the program run normally！",0
SafeEsp dd 0

assume fs:nothing
.code
start:
push SEH
push fs:[0]
mov fs:[0],esp
mov [SafeEsp],esp
int 1
nop
invoke MessageBox,0,offset szText,offset szCaption,MB_OK
jmp Exit
SEH:
invoke MessageBox,0,offset szTextSTEP,offset szCaption,MB_OK
Exit:
mov esp,[SafeEsp]
pop fs:[0]
add esp,4
invoke ExitProcess,0
end start
end
nikolatesla20
09-08-2004, 01:46 PM
try

push offset SEH

-nt20
Limee AKA Lamer
09-08-2004, 02:16 PM
00401000 PUSH INT1.00401031 ; SE handler installation
00401005 PUSH DWORD PTR FS:[0]
0040100C MOV DWORD PTR FS:[0],ESP
00401013 MOV DWORD PTR DS:[40302A],ESP
00401019 INT 1
0040101B NOP
0040101C PUSH 0 ; /Style = MB_OK|MB_APPLMODAL
0040101E PUSH INT1.00403000
00401023 PUSH INT1.00403019
00401028 PUSH 0
0040102A CALL <JMP.&user32.MessageBoxA>
0040102F JMP SHORT INT1.00401044
00401031 PUSH 0
00401033 PUSH INT1.00403000
00401038 PUSH INT1.00403004
0040103D PUSH 0
0040103F CALL <JMP.&user32.MessageBoxA> ; \MessageBoxA
00401044 MOV ESP,DWORD PTR DS:[40302A]
0040104A POP DWORD PTR FS:[0]
00401051 ADD ESP,4
00401054 PUSH 0 ; /ExitCode = 0
00401056 CALL <JMP.&kernel32.ExitProcess> ; \ExitProcess
0040105B INT3
0040105C JMP DWORD PTR DS:[<&kernel32.ExitProcess>
00401062 JMP DWORD PTR DS:[<&user32.MessageBoxA>]

-nt20[/QUOTE]
nikolatesla20
09-08-2004, 02:29 PM
Your code works fine for me, must be some other problem.

-nt20
Limee AKA Lamer
09-08-2004, 02:40 PM
Tell me your Compiler version?
Maybe is the compiler question.
Which system is your program run,win9x or 2000/XP?

Your code works fine for me, must be some other problem.

-nt20
nikolatesla20
09-08-2004, 02:52 PM
Im using MASM7.1, on both windows 2000 and windows XP, and it works fine when I compile this. I get the message box "Program run on step mode!"
Limee AKA Lamer
09-08-2004, 03:04 PM
int 1 has be compiled CD 01,
change it to F1,then the program work fine
please tell me which machine code is your int 1?

00401000 PUSH INT1.00401030 ; SE handler installation
00401005 PUSH DWORD PTR FS:[0]
0040100C MOV DWORD PTR FS:[0],ESP
00401013 MOV DWORD PTR DS:[40302A],ESP
00401019 INT1
~~~~
if the INT1 is CD 01 the program will crash,
if the INT1 is F1 the program wil work fine.
please tell me your machine code,thanks.

Im using MASM7.1, on both windows 2000 and windows XP, and it works fine when I compile this. I get the message box "Program run on step mode!"
Limee AKA Lamer
09-08-2004, 03:07 PM
Then the Program work fine.The Compiler is so bad!

include windows.inc
includelib kernel32.lib
includelib user32.lib

.data
szCaption db "SEH",0
szTextSTEP db "程序执行了单步操作！",0
szText db "程序正常运行了！",0
SafeEsp dd 0

assume fs:nothing
.code
start:
push SEH ;自己的结构化异常处理函数
push fs:[0]
mov fs:[0],esp ;加入到SEH链表中
mov [SafeEsp],esp
; int 1
db 0F1H
nop
invoke MessageBox,0,offset szText,offset szCaption,MB_OK
jmp Exit
SEH:
invoke MessageBox,0,offset szTextSTEP,offset szCaption,MB_OK
Exit:
mov esp,[SafeEsp]
pop fs:[0]
add esp,4
invoke ExitProcess,0
end start
end

Im using MASM7.1, on both windows 2000 and windows XP, and it works fine when I compile this. I get the message box "Program run on step mode!"


Fool PEiD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Fool PEiD
PDA

View Full Version : Fool PEiD

RoBa
09-09-2004, 03:54 AM
I wanted to wirte a small program to fool the File Anaylize Tool (such as PEiD or FileInfo) by changing the codes on the EntryPoint.

Now I pretend programs to VC++6.0 successfully, but when I want to pretned them to DELPHI, the FileInfo was fooled,but PEiD says "WIN32 Unknown" instead of "Delphi". I copy more than 100 bytes of the REAL DELPHI PROGRAM to the EntryPoint , but it still doesn't work. And it was the same in VB.

I want to know how the PEiD detected the Programs. Doesn't It detected only by KeyCode of the EP?

BTW:Who has the KeyCode of the shells and compilers ,THANX!
gook
09-09-2004, 05:34 AM
if you open the userdb.txt file you can see a boolean variable called "ep_only"
RoBa
09-09-2004, 07:58 AM
Yes,But I think the detection of the DELPHI (or VC or BASIC) is built in the program. Must I reverse the program ? Oh,It's a difficult task :(
%UNDEFINED%
09-11-2004, 08:55 AM
Basically what you are looking for is a compiler signature.
The entry point is not always the best place to look.
If you are wanting to use the PEiD database you might be able to contact the authors and get some help:

snaker: snaker(AT)myrealbox(DOT)com
Qwerton: qwaci(AT)gmx(DOT)net
Jibz: mail(AT)ibsensoftware(DOT)com

Other tools have been built using their database, such as:
Stud_PE: hxxp://itimer.home.ro/studpe.html

Or perhaps building your own signatures, using hex comparing software with multiple file of the same compiler/packer/encrypter, and looking for a common signature.
nikolatesla20
09-11-2004, 01:59 PM
You can fool PEId by making your own lame cryptor, for example, going thru the first section of code (in the file) and XORing it with a value. Then, add your own code (and set a new PE entrypoint) to re-XOR it at runtime, and jump back to the original entrypoint.

-nt20
mYeXcKsN
09-13-2004, 09:49 PM
I made a program do that 2 months ago. But the important things may be the new OEP should in first section of the locked PE file. So you can backup some code from first section to the last section. copy start code to fisrt section,and jmp to last section,restore code backuped.
Crudd
09-15-2004, 08:37 PM
I think someone may have done this (unless its yours :) :hxxp://wasm.ru/tools/8/FakeSigner.zip


ON THIS DAY 3 YEARS AGO 9/11/01
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > ON THIS DAY 3 YEARS AGO 9/11/01
PDA

View Full Version : ON THIS DAY 3 YEARS AGO 9/11/01

hobferret
09-09-2004, 05:27 AM
Hi Guys

Let us take a little time to reflect. On this day three years ago.

Around 07:46 Eastern flight AA11 took off from Logan for LA or so everyone thought. This started off a chain of events which we all hope will never be repeated.

Approx 1 hour later at 08:46:39 (eastern) to be precise the first innocents died as the plane hit WTC Tower 1.

During the following 90 minutes thousands more were killed by this insane act.

This is probably not the best place in the World to post this but - -:-

Let us all take a couple of minutes to remember them and their relatives.

This rememberance of course does not include the totally insane bin laden mob.

/hobferret

9/11/2004
ughugh
09-09-2004, 05:42 AM
1. No offense meant to those affected by what happened three years ago.
2. The only point of this post is that the world consists of more than what the media is currently focusing on.
3. I have not checked the numbers, but the argument still holds true.
4. With the risk of being banned for life:

http://www.starvation.net/home.htm

Edit: 5. I am in no way affiliated with the above URL, and I'm only pointing at the numbers in the first paragraph, not all the stuff further down.
Tola
09-09-2004, 07:03 AM
Is it 9/11 already in the US? Weird, it's still 9/9 over here...
lifewire
09-09-2004, 09:48 AM
Is it 9/11 already in the US? Weird, it's still 9/9 over here...

here too. weird, those timezones :D
hobferret
09-10-2004, 07:49 AM
here too. weird, those timezones :D

Hey

No need to take the piss :devil:

This was put up 48 hours in advance so some people would get to see it before the anniversary of this atrocity!

Just as a matter of fact it is 9/10 here but it is still 9/11 tomorrow.

/hobferret

Who is still remembering that day
JMI
09-10-2004, 11:10 AM
While death from disease, starvation, and injury are personal tragedies in and of themselves, the intentional taking of the lives of others to attempt to advance a religious/political agenda is an entirely different category of evil perpetrated by man against humanity. The first category is a failure of humanity to rescue one’s fellow man from the effects of poverty, disease, and natural disasters. It is essentially standing by while others die from causes which those standing by did not cause to happen. One may argue about whether there is moral duty to “rescue” humanity from the afflictions of the human condition.

The second category is of another character all together. It is individuals determining that their religious/political agenda justifies their active taking of the lives of innocents to try to make a point about their “cause.” It is evidence of the failure of ideas, which are unable to capture the imagination of the masses, unless provoked through terror and slaughter.

The Deity does not call upon men to deliberately kill other human beings; people use the name of the Deity to justify their own acts of cruelty and inhumanity. This has happened throughout the history of man and is unlikely to stop in the foreseeable future. Those who crash airplanes into buildings, bomb markets, school, nightclubs and other gathering places simply demonstrate their weakness and the bankruptcy of their ideals. Sadly, it is fairly easy to train people to kill one another for little or no real cause. It is far more difficult to teach people to respect and care about one another. The other lesson of history is that violence almost certainly simply generates more violence.

This is neither the best nor the worst of times in human history. It is simply the time in which we live and the realities and cruelities of life abound and, unfortunately, will continue.

Regards,


Vbox 4.6.2 confusion
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Vbox 4.6.2 confusion
PDA

View Full Version : Vbox 4.6.2 confusion

psy_gr
09-09-2004, 07:02 AM
Hello, this is my first post here. Rest assured i have read and comprehented the rules. Warning to the reader: i am a newcomer to the REverse Engineering world. On to my question. There is an Adobe application that i have, which evidently, is protected by Vbox 4.6.2, and thus sports the usuall nag screen.

The version i have is a special, trial one, ie, has some extra features aside being a demo. But i also have the "regular" version, that i have paid for and own. So, investigating the possibility to simply swap the executables, i was faced with a Vbox nag screen when i executed the legal (read: not packed) .exe in the installation directory of the trial version.

My question, and i hope it doesn't sound naive, is, does Vbox only wrap the main executable, or a given set of dll files as well? When one attempts to unpack it, can he count on the numerous how-to guides? Or is there some caveat?
neviens
09-09-2004, 09:11 AM
Adobe usually packs main executables + 1-2 libraries.
VBox can't be considered as difficult to unpack packer, usual tools
(Olly, ImportRec) will do a job.
Neviens.
psy_gr
09-09-2004, 10:42 AM
Thanks for the reply. Another question, if i may. I've read some walkthroughs for defeating Vbox 4.6.2 used in Adobe applications, namelly for Photoshop 7.0.1. But this thread [ http://woodmann.net/forum/showthread.php?t=1506 ] got me thinking that an entire new method should be invoked on targets like InCopy. That is by the way the application that i am currently focusing on. Am i on the right track reading such texts?
neviens
09-10-2004, 02:27 AM
Don't know about texts, but in short I usually do it in a following way:

1. Locate all protected executables and libraries with winhex (open folder),(must contain specified text (PREVIEW))

2. Find the OEPs from preliminary dumps of executables and libraries with IDA (compare, if necessary, with other exes)

3. Dump the executables stopped at OEP with OllyDebug (HW breakpoint, IsDebuugerPresent plugin necessary) with WinHex.

3a. If .dll, load it with little compiled helper exe, containing LoadLibrary function and stop it @OEP with SoftIce with jmp eip.

4. Clean up dumps (EP, RVA==Offset, Section attributes, etc, etc); locate IAT and a free space for IT for step 5

5. Rebuild imports with ImpRec (Trace Level3 (Trap Flag)), failed entries find from IDA dizasm listing.

As you can see, my main tool is IDA here, it's incredibly powerfull tool.
BTW, does anybody know, how to put a HW breakpoint in uninitialized memory (step 3a) in OllyDebug?
Neviens.
Eggi
09-10-2004, 07:39 AM
BTW, does anybody know, how to put a HW breakpoint in uninitialized memory (step 3a) in OllyDebug?

Let the program run and then set a hardware bp on the memory... restart and olly will save the bp and break :). I hope that this is what you want ;).
neviens
09-10-2004, 08:19 AM
>...restart and olly will save the bp and break...
>

Thanks, it works! It is possible to remove 3a. step now :)
Neviens, Sice man.
LetMeIn
09-28-2004, 08:29 PM
neviens - could you elaborate on step two of your five step process for me?

First let me say that I am brand new to all of this and I'm a little slow, so bear with me. Following your process I think I have located the protected exe and libraries with Olly - they are the target app exe, vboxat, and vboxtb. I accomplished this by setting a breakpoint on FreeLibrary and then using the view -> memory. In the memory window, I scrolled to the bottom to find the above files with PREVIEW listed in the section column.

Q1: As a newbie, am I on the right track?

Q2: If I am, how do I go about making prelim dumps of these files to find the OEP?

Thanks,
LetMeIn
neviens
09-29-2004, 02:17 AM
A1: The same goal you can reach with different tools, it's not necessary to
use winhex. You can drop a vboxat, vboxtb from your unpacking list- those
are protector dlls.
A2: I usualy do it with winhex's ram editor, but it's possible to use any
proc dumper (LordPE for example). Dump to file, set up all necessary
entries in pe header, set an entry point to 1000h, dizassemble with IDA with
appropriate signatures.
Neviens.
naides
09-29-2004, 02:49 PM
A couple of points:

Psy-gr, you are putting too much info about the program you are reversing. . .
That is not healthy for you specially if you own a legal registered copy so they have your name in a DB.

If it is the program I am thinking, several dll and plug-in are Vboxed, so you need to take the time to locate them (PEiD would do it) and unpack them, which is slightly more involved than unpacking an .exe file
psy_gr
11-06-2004, 06:55 AM
Psy-gr, you are putting too much info about the program you are reversing. . .
That is not healthy for you specially if you own a legal registered copy so they have your name in a DB.

If it is the program I am thinking, several dll and plug-in are Vboxed, so you need to take the time to locate them (PEiD would do it) and unpack them, which is slightly more involved than unpacking an .exe file
Thank you for the reply. I am aware of the risk involved, but i trust (and hope) that they will have bigger fish to fry than me. Also, i plan to continue this reversing process, so i might have to bug you with my questions, as they arise. Thank you for your valuable patience. Regards.
hobferret
11-07-2004, 05:42 AM
Hey JMI :)

You are slipping up in your OLD AGE target is named in these posts :boo:

Regards

/hobferret
dELTA
11-07-2004, 05:50 AM
There isn't any target-specific (i.e. non-generic) crack info in the thread, and then you can mention target names.
JMI
11-07-2004, 10:16 AM
hobferret:

I am NOT "slipping" into old age. I "leapt" into old age some time ago, just can't remember when. :D

And, although I just hate to admit my friend dELTA is right about anything, :devil: as he stated, there is no "target specific" code or crack information, even though various targets using the protection system are mentioned. However, it would be BEST if the use of target names were very limited. :yay:

Regards,
psy_gr
11-07-2004, 12:46 PM
However, it would be BEST if the use of target names were very limited.
I understand. Thanks for the hint/tip. I will keep it in mind when posting any further inquiries conserning the actual "dirty work" i do. I appreciate the tight community, though i am sure i don't quite fit it with my extremelly limited knowledge in the RE field. Regards.

edit. As i wonder into this project, and contrary to what previous poster have said, it appears that only the main executable is actually packed. A thorough examination of the installation, and observation of readilly available "cracks" point to that direction. Have i been fooled? :thinking:
hobferret
11-07-2004, 03:11 PM
NO

/hobferret
psy_gr
11-08-2004, 09:21 AM
So, i folowed your method hobferret, as documented in the PgMkr walkthrough. I was able to find the OEP, and after the JMP EBX that lead into the application, i made a dump with ollydump. The next step was to initilize imprec and point it to the running executable. I fed it the OEP, and it loaded the imports from the IAT. Now, there are several thunks (modules) that appear not valid, with pointers to vboxta.dll. I tried tracing them with either Hook (2) or Trap Flag (3), but to no avail. I have also set the timeout on (3) to 300 msec. To my understanding, only two of the imports should need manual intervention, but i am faced with 5 valid modules (thunks) out of 9, which means plenty of functions are not imported on the remaining 4 modules. Any suggestions?
hobferret
11-08-2004, 10:52 AM
Try looking at this post :devil:

http://woodmann.net/forum/showthread.php?t=5673&page=4

/hobferret
psy_gr
11-08-2004, 11:36 AM
I've read that post, along with any relative threads i managed to dig out using the local search feature. I cannot comprehend what i must do. :boo: Perhaps you could shed some light to my dead brains cells if we are talking upon a common base. So, i quote below the last thunk of the tree.

FThunk: 00005290 NbFunc: 00000015
1 00005290 vboxta.dll 0001
1 00005294 user32.dll 00C0 DrawTextW
1 00005298 vboxta.dll 0001
1 0000529C vboxta.dll 0001
1 000052A0 vboxta.dll 0001
1 000052A4 vboxta.dll 0001
1 000052A8 user32.dll 00EC GetActiveWindow
1 000052AC vboxta.dll 0001
1 000052B0 vboxta.dll 0001
1 000052B4 vboxta.dll 0001
1 000052B8 user32.dll 0282 SetWindowLongW
1 000052BC user32.dll 0170 GetWindowLongW
1 000052C0 user32.dll 029B SystemParametersInfoW
1 000052C4 user32.dll 0062 CreateWindowExW
1 000052C8 user32.dll 021A RegisterClassW
1 000052CC vboxta.dll 0001
1 000052D0 vboxta.dll 0001
1 000052D4 user32.dll 009A DestroyWindow
1 000052D8 vboxta.dll 0001
1 000052DC user32.dll 02AB TranslateMessage
1 000052E0 vboxta.dll 0001

I am aware that the problem lays at the vboxta.dll entries. How am i supposed to trace it in Olly though? In that thread, you mention:

>Remember what I said before get to the OEP in Olly then look for something
>like CALL DWORD PTR [ADDRESS]. Any unresolved can be stopped in this
>block and then traced to see where you end up!

Does that mean that i have to get back into the OEP in Olly, and then look for a pointer to which address? Assuming OEP is 00403B26 (00003B26 in imprec), with RVA 00005000 sized 000002E8. I hope i don't sound too dumb.
hobferret
11-08-2004, 01:50 PM
OK then dumbo :)

Your first thunk is 1 00005290 vboxta.dll 0001 so you say :devil:

Get to the OEP then goto memory window and goto the address of this and set breakpoint memory on access (or execution) when it stops trace from there and you should end up in the right place in the dll. You just need to remember what it was :D

Then if you are still in trouble repeat this for all unresolved :idea:

¡con duras penas!

/hobferret
psy_gr
11-10-2004, 01:19 PM
Hello. I am back again. I've done some progress, interestingly enough. I have rebuilded the IAT using Olly and Imprec, and attempted to fix the dump. Everything went fine. So, i double-click the resulted file, which to my surprise ran fine. But, at some point, as it was loading some application extension, the vbox nag came up once again.

So, i presume that the particular file is packed as well, besides the regular executable. The problem is, the file isn't a .dll module. It has an arbitrary extension, like this particular application usually does. I do understand that it is of valid PE format (obviously) but how would i go about unpacking it as well?

Thanks for your valuable contribution so far.

edit. Fortunatelly enough, i was able to copy that particular file from the legal retail copy i owned, and it worked flawlessly. I now have a fully operational copy of the program without any nag screens. But still, i would be interested in finding out how to completelly unwrap everything.
naides
11-10-2004, 05:18 PM
edit. Fortunatelly enough, i was able to copy that particular file from the legal retail copy i owned,

Those are plug-in modules, which are .dll in disguise.

They have their wrinkles, but can be unpacked.
Watch and learn son:

1 you have the original one, unpacked, so look at the code pattern around the original entry point. If it is a different version, dissasembly other plugins and learn the code pattern.

2.That way you find the OEP. dump.

3. Also look at the IATs of not packed mods and/or original ubnpacked one. IMPREC gets lost detecting the IAT because it is located in some weird areas. you have two options: Reverse IMPREC, and learn how it decides where the IAT is located, then figure out a "correction factor" to manually input in inprec IAT begin box. The autosearch tends to fuck up.

4. Or learn to fix the IAT by hand without Imprec. Long, slow but etretaining, and instructive.

5. You need to wipe out the packed plugin module from the folders, because the program scans the Plugin folders, finds the packed mod and loads it even if you change the name.

6. PEID locates all the packed mods (at least in my app).

Have fun
hobferret
11-11-2004, 03:22 PM
So, i presume that the particular file is packed as well, besides the regular executable. The problem is, the file isn't a .dll module. It has an arbitrary extension, like this particular application usually does. I do understand that it is of valid PE format (obviously) but how would i go about unpacking it as well?

Hey this sounds interesting can you PM the target :D

/hobferret
psy_gr
11-12-2004, 03:56 AM
Ok. A Private Message is on its way. Regards.
hobferret
11-12-2004, 05:19 AM
psy_gr :)

That is an upgrade so I cant help with that coz I got nowt to upgrade!, read your PM for another approach.

Regards

/hobferret
psy_gr
11-12-2004, 08:17 AM
That is an upgrade so I cant help with that coz I got nowt to upgrade!, read your PM for another approach.
Well, i can assure you that it is not an upgrade of some kind. It is the full program, version 3.0.1 (not mentioning program name there :yay: ) and it does not require any previous versions to be installed. I had it installed inside a virgin Virtual Machine, so i kinda have first hand experience. I've also send you a PM with something along the above lines. Regards.
hobferret
11-12-2004, 10:17 AM
Hmm......

Well the site says it's an update for programXXXX, and it's 100MB. So you will have to wait a while mate :devil:

But I sort of promise I will have a look :whoops:

/hobferret
psy_gr
11-12-2004, 12:48 PM
Well the site says it's an update for programXXXX, and it's 100MB. So you will have to wait a while mate
Yes, indeed. The page title can be (is) a bit misleading i must admit. But fear not, this is the real thing. Ok, take your time. I'll lurk around for any progress you might be doing. Regards.

edit. @naides: Well, a thorough installation directory scan with peid only revealed the main executable to be protected. Somehow, the plugin was not flaged. But, something seemed fishy from the begining of the debugging session, since Olly was complaining about invalid pointers regarding the particular extension. And yes, obviously the plugin must be removed from the plugins folder, as it will get loaded automatically when the application gets initialized.
hobferret
11-14-2004, 04:15 AM
Hi psy_gr :)

OK first look at what my friend nadies had to say in this thread :yay:

Then you say PEID only revealed the main EXE, well with a bit of thought you may have realised that you need to do a recursive scan, which will reveal all modules :boo:

You will find there is 1 more file packed with VB which can easily be resolved by renaming it to something PEID will recognise, when you find it load it into Olly and unpack it :yay:

It does seem that you have the IAT correct so just play with the remaining file which for some reason is called twice :yay:

/hobferret
psy_gr
11-14-2004, 10:22 AM
Then you say PEID only revealed the main EXE, well with a bit of thought you may have realised that you need to do a recursive scan, which will reveal all modules
I don't understand what you are talking about here. What do you mean by "recursive scan"? PEID traversed the entire installation directory including plugin subfolders, etc. That module was not flaged.

You will find there is 1 more file packed with VB which can easily be resolved by renaming it to something PEID will recognise, when you find it load it into Olly and unpack it
But i do know which file is packed already! And why should i rename it to anything it order for PEID to pick it up? I thought it scaned files base on having valid PE structrure, not extension!

It does seem that you have the IAT correct so just play with the remaining file which for some reason is called twice.
Yes, i do have the IAT correct, since everything is working! And there is no file that gets called twice! Please re-read my posts. :boo:
hobferret
11-14-2004, 12:33 PM
NO COMMENT

And there is a file that gets called twice - unless you have a different program - although I gotten hold of where you pointed me :confused:

BTW rename it to something that Olly will recognise not PEID, my mistake coz I am a thick bas**rd :D

Obviously I can't help you anymore coz you know everything :yay:

/hobferret - who is quite obviously thick :idea:
psy_gr
11-15-2004, 05:08 AM
This was of academic nature anyway. If i pursue it further, i'll keep in mind the pointers givenin this thread, and perhaps post back my progress. Thanks for everyone's valuable contribution, and yours in particular. Sorry if i snaped and pissed you off in the end. My bad. I should have been more patient, since i am a newcomer after all. That said, add what you wish. Regards.


Softice doesn't break on "int 21" in 16-bit code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Softice doesn't break on "int 21" in 16-bit code
PDA

View Full Version : Softice doesn't break on "int 21" in 16-bit code

zombie8
09-09-2004, 09:42 AM
Hi

I'v been trying to debug a simple 16-bit "hello world" DOS program. When I load it into Softice (using dldr.exe from Util16 subdirectory) Softice pops up showing the program's code. The cursor is placed at the first instruction and the "int 21" instruction is just a couple of lines below. I input "bpint 21" and "g", the Softice window dissappears and the program terminates normally (i. e. printing "hello world"). Why doesn't Softice break? The Softice User's Guide states that "bpint" can be used to trap software interrupts made by 16-bit programs. I have also tried to set a breakpoint on the interrupt handler but it didn't work either. I haven't found anything helpful in Internet, only some cracking tutorials that use "bpint 21" in Softice for Dos. And Softice for DOS does not start in a DOS box ("Soft-ICE can not run with other 80386 control programs"). What am I doing wrong? I am using Softice 4.2.7 under Windows 2000 SP4.

Help will be greatly appreciated. It's been bothering me for quite a long time.
esther
09-09-2004, 10:15 AM
Since its near to int21 you just need to trace using f7 or f8.

If you want to go to that address just use bpx xxxxxxxx and type x
zombie8
09-10-2004, 02:49 AM
Since its near to int21 you just need to trace using f7 or f8.

Of course I can do that since the "int 21" instruction is near the beginning of the code. But what if it wasn't? I'd really like to know how to make Softice break on it. Another problem is, however, that Softice often hangs the system up when debugging 16-bit apps (this has been already reported on one of these forums). So if Softice can't break on interrupts, what are its advantages as compared to, say, Turbo Debugger for 16-bit apps? I thought things would work out in Softice for DOS, but it doesn't start on W2k. Does somebody have a clue on that?

Thanx in advance
Japheth
09-11-2004, 12:14 PM
> I thought things would work out in Softice for DOS, but
> it doesn't start on W2k. Does somebody have a clue on
> that?

this cannot work because SIDOS is a DOS program which requires ring 0 access either by VCPI or by running in real mode. Both is not true for VDMs on NT platforms.
naides
09-11-2004, 02:34 PM
When you are debugging a 16 bit app in a pure 32 bit environment you have the extra layer of complexity that you are tracing through a virtual machine. Sice gets lost rather easily because most of the interrupts are not actually called but emulated by the VM. I am not sure what you want to acomplish, but to be able to do what you want to do, set up your computer in a true blue DOS environment and use true DOS SoftIce.
zombie8
09-12-2004, 05:11 AM
Thanx for your suggestions. I have tried out the 16-bit Turbo Debugger and I think it's more suitable for debugging 16-bit apps in a 32-bit environment then Softice.


have anybody analysed TRW2000 reversely
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > have anybody analysed TRW2000 reversely
PDA

View Full Version : have anybody analysed TRW2000 reversely

Limee AKA Lamer
09-09-2004, 11:21 AM
I've discovered a big bug in TRW2000 and
want to make a patch for it
have anybody analysed TRW2000 reversely
it seems impossible to find liutaotao now
dELTA
09-09-2004, 11:40 AM
Yes.
Solomon
09-09-2004, 12:34 PM
He is in charge of his small software company. He doesn't want to release the source of TRW for Win9X. and the development of TRW for Win2K stopped long time ago.
Kayaker
09-09-2004, 07:53 PM
I've discovered a big bug in TRW2000 and
want to make a patch for it
have anybody analysed TRW2000 reversely
it seems impossible to find liutaotao now
Hi

Why don't you describe the bug and how you might make a patch for it. An open discussion of such a thing is what this forum is for. Be aware though that you must be accurate and technical in what you post for it to be of any use or consequence. Look for posts by 'dion' for existing TRW reversing.

Kayaker


IPAQ - M$'s EVC++ won't debug
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > IPAQ - M$'s EVC++ won't debug
PDA

View Full Version : IPAQ - M$'s EVC++ won't debug

Terling7
09-09-2004, 07:33 PM
I've been trying to get into Pocket PC/ARM disassembly by following
heXc - Abusing Microsofts EVT as a debugger at:
hxxp://66.98.132.48/fravia/hexc_evtdebug.htm

I can't get the debugger to start. Normal communications to the IPAQ via ActiveSync work fine. I've installed EN_WINCE_EMBDVTOOLS30.exe and the
eMbedded Visual C++ 3.0 runs and I've followed each step carefully:

"run embedded visual c++ click File / Open and choose 'Executable Files' as the file type you wanna display, browse for the file you want to debug (the one you just downloaded from your device) and load it into the ide. next step is to configure the debugger in order to upload your targets exe-file to the right location on your WinCE device. therefor click onto Project / Settings inside the evc++ ide and go to tab: Debug. In the field 'Download directory' enter the path to your targets executable file on the wince device"

This seems easy, but then comes:
"done all that, hit F11 and evc++ ide will automatically upload the target's .exe-file and the debugger to your device. (i sometimes encountered problems while connecting to ma pocketPC. after resetting it and repeating all the steps described above it worked without any problems.) after the upload's finished you're prolly gonna get some messages telling you that the executable file will not run on that kind of device and that no debug information could be found .. please, just ignore that, we're not gonna need them! ;) after a while the debugger breaks and you got the target absolutely naked in front of you!"

I can't get anything to happen by pressing F11, F5 or by selecting the corresponding menu item. Nothing happens at all. I've tried on W2K, XP, 2 diff comps, and serial and USB ActiveSync links. No diff.

I'm clearly doing something wrong, but can't figure it out. Any hints out there? It's prolly something stupid, but his is for Noobs, which fits me when it comes to PPC/ARM debugsville.
Woodmann
09-09-2004, 08:20 PM
Howdy,

This is just a guess.. try the latest debugger.
It could be that the information in the tut you read has become outdated.

Woodmann
Silver
09-13-2004, 02:44 PM
I do a lot of PPC (wow, that always means power-pc to me, not pocketpc...) coding. You might have the wrong version of eVC like Woodmann says. WHat version of Windows CE are you using - PocketPC or Mobile?
Terling7
09-13-2004, 09:08 PM
I do a lot of PPC (wow, that always means power-pc to me, not pocketpc...) coding. You might have the wrong version of eVC like Woodmann says. WHat version of Windows CE are you using - PocketPC or Mobile?

I'm using PocketPC 2002 on an IPAQ. Yes, it appears I'm not using the current version of EVC, so I've d/l'd EVC4,and installed it, but now it complains I've got no CE platform SDK installed. I've actually managed to complete my first project on the IPAQ using IDA, but I'd still like to get a live debugger going, so I'm off to figure out what I'm missing.
Silver
09-14-2004, 11:46 AM
Hm, sorry to tell you this, exe's built with eVC 4 do not work on pocketpc 2002 devices. eVC 3 for pocketpc 2002, eVC 4 for Windows Mobile 2003, and never the twain shall meet.
Terling7
09-14-2004, 02:26 PM
Hm, sorry to tell you this, exe's built with eVC 4 do not work on pocketpc 2002 devices. eVC 3 for pocketpc 2002, eVC 4 for Windows Mobile 2003, and never the twain shall meet.

OK, I'm back to square one then. How do I do live debugging on a Pocket PC 2002 device? I've tried eVC 3 and it seems to run on the PC, but it absolutely refuses to send anything to the IPAQ.
martin
09-15-2004, 09:02 AM
Have you managed any communication between evc and the pda, not just active sync and the pda?

For example, if you build something like a hello world application, will evc transfer the .exe to the pda for you?

You should check that the target device, os, and cpu are what you expect them to be, also play around with "platform manager", which will let you test the connection with different transports.

It's certainly possible to do remote debugging on ppc2002 and 2003 using the relevant evc, perhaps try building and debugging your own apps first.
Terling7
09-15-2004, 09:58 AM
Have you managed any communication between evc and the pda, not just active sync and the pda?.

No. I'm not sure where to start to try to get any communication. I'd love to build a "hello world" app, but I've no idea where to start, and I suspect that's way beyond the scope of any reply here. (although I'm reasonably comfortable in C and ASM on the PC). Thanks for your help. I'll look at more settings in EVC, and try a really clean XP or W2K system. Maybe I've got a firewall/antivirus/Softice or some other conflict interfering.
Silver
09-15-2004, 11:20 AM
As you said, this is going to go way OT for here, but here's some hints. As Martin says, when you create a project in eVC3 for your pocketpc, when you build the exe eVC should automagically send it to the ipaq for you (just like it automatically loads the emulator). If that's not working, you have a comms problem, so I'd sort that out first. Once it's working, it really is as simple as running the app in debug - eVC will transfer the app to the ipaq then run it in debug on the ppc, and show you the normal visual studio debugging screens on your desktop. Word or warning though - unless you're using USB2 or the ethernet sync for your ipaq, be prepared for a hell of a laggy debugging system. When I code apps for my 3970 (USB1), each press of F8 (step over line of code) takes a good 2 or 3 seconds to respond. Now do that for 10 lines of code.........
Terling7
09-22-2004, 12:46 PM
I thought I'd give an update. Despite testing the install on 2 computers, and uninstalling and reinstalling on my main machine, when I installed on a third computer, it worked. For some reason the Pocket PC option and transport would blow up on the first two, and then disappear.

Thanks Martin for "also play around with "platform manager", which will let you test the connection with different transports." This helped me verify what had disappeared and helped confirm that it reappeared and worked when I did a partial reinstall of the Pocket PC SDK. I made several changes and ultimately got it working on both the XP and W2K machines.

The first project was completed with IDA alone, but the second one was helped by using eVT to track through some unfamiliar code.
Thanks to all.
microcode
09-29-2004, 03:17 AM
For the ones who want to go further around Windows CE, I suggest that you download the Platform Builder + Windows CE 5.0 Evaluation Version and Windows XP Embedded @ :

http://msdn.microsoft.com/embedded/downloads/default.aspx

It's an online installer (downloading of setup.exe ~2,7Mb + launch online installer)... And all informations about Windows CE will be available to you ;)

See you


ida sdk api
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ida sdk api
PDA

View Full Version : ida sdk api

guy11
09-10-2004, 10:10 AM
hi
sorry for this question, but is there any good documentation about the
ida sdk api out there.
i mean something like html files which gives an overview about all functions, because the .h browsing is very anoying.
i have a ida pro 4.5 retail.

what is the best way to get in touch with the api ?

please help a newbe to come on the right way.

tnx for help
doug
09-10-2004, 10:22 AM
The official way to get help on the SDK is to buy a support plan from Datarescue (start saving your money now)

Also, some books have guides on creating IDA Plugins. Usually a chapter dedicated to IDA.

I think the best way to learn IDA SDK is still to look at existing source code (see ida utils site hosted on backtrace.de). There really isn't any documentation. Even the IDC help file is pretty bad.

I think datarescue is open-sourcing some processor modules. That should give you some material to study.

And well, you can also post your questions here.
br00t_4_c
09-11-2004, 08:45 AM
Crackz's site hosts the 4.3 and 4.1.4 SDKs, I won't post the link cuz I'll get jumped by the mods... but they have it :yay:
guy11
09-11-2004, 10:21 AM
@br00t_4_c

thats not the problem , i have the sdk 4.5, but i asked for a good docu , execpt from the header files.....
Polaris
09-11-2004, 12:20 PM
@br00t_4_c

thats not the problem , i have the sdk 4.5, but i asked for a good docu , execpt from the header files.....

Hmmm... as doug already said, you can't find the documentation because there is no documentation.

However:
1) Look at plugins source code
2) Read the free chapter of the "Exploting Software" book, which
gives some guidelines on writing IDA plugins.

Then, start experimenting.
yaa
09-12-2004, 05:54 AM
And here is the 3rd chapter.

yaa
Aster!x
09-12-2004, 04:05 PM
examples
_http://www.sport-und-event.de/backtrace.de/index.htm
guy11
09-13-2004, 03:26 AM
@yaa
yes i have this book at home...
so the summary is , ..read plugin sourcecode ..and there is no useful documentation..

thanks for the help ,


What is the sentence mean?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > What is the sentence mean?
PDA

View Full Version : What is the sentence mean?

Limee AKA Lamer
09-10-2004, 10:21 AM
On DR7 is put the value 0x0155, that is all local breakpoint
flags are set and other flags are cleared.

I don't understand.
lifewire
09-10-2004, 10:53 AM
you have some luck, i decided to be friendly enough to pick up my intel system programming guide, and it fell open on exactly the right page (well, almost).

DR7 is the debug control register. L0 .. L3 are local breakpoint enable flags, and are placed on bit 0,2,4 and 6. that makes 0x55. now we still need to explain 0x100: ehm, just download the .pdf's on developer.intel.com :)
JMI
09-10-2004, 11:16 AM
Nah. That would actually require limee to do some of his own homework, instead of just asking someone else to do it for him. :rolleyes:

Regards,
Limee AKA Lamer
09-10-2004, 11:54 AM
When the Dr7 is set the value 0x155.The break point will be
invaild.When the Dr7 is Set the Value 0x00.The Break point
will be valid.I can't get it,yet.

Please give me some explain,thanks.
lifewire
09-10-2004, 12:32 PM
read the manual! if you need other people to answer questions with obvious answers your entire life, you won't get anywhere. the things you ask isn't part of some secret wisdom or something.


Need advice...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need advice...
PDA

View Full Version : Need advice...

Sauliux
09-10-2004, 07:44 PM
Hi. Can someone give me some advices reversing steinberg`s VST plugins??
:cry:
JMI
09-10-2004, 07:48 PM
It would appear that you have not actually read the FAQ linked in your signature line. Time to do that now and then re-think your post.

Regards,
Sauliux
09-10-2004, 07:56 PM
Uppps sorry it wont hapens again :whoops:
JMI
09-10-2004, 08:25 PM
That's all we ask. :yay:

Regards,
nikolatesla20
09-11-2004, 07:35 AM
Welcome, fellow VST reverser :) I've done a couple in my day..

Just a note,

Step 1: Get the VST SDK
Step 2: Build a basic project for yourself.
Step 3: Look at it in debugger and in disassembler, to see where things go.

Now you have a good reference point for any other VST.

-nt20
Sauliux
09-11-2004, 08:19 AM
Wow i must been drunk when i wrote this request :p I have VST SDK for so long time but i didn`t study them cuz only recently i decide to lay my hands on some VST`s :D

Thx nikolatesla20 for opening my eyes ;)


Armadillo unpacker
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Armadillo unpacker
PDA

View Full Version : Armadillo unpacker

crUsAdEr
09-12-2004, 02:13 AM
I do not want knowledge to be lost into oblivion. But rather than simply releasing my unpacker source code, i will start this mini project to write an unpacker for armadillo, whoever interested can just participate and hopefully in the end u will have an armadillo skinner of your own; hopefully u wont spread it to everyone though cos unpackers itself doesnt teach ppl much.

anyway, it is not exactly a simple task so be prepared for some Dumping hard work :), i would estimate if u know arma well to take 2 wks of hard work to code an unpacker, if not will be a month or more... i coded mine fully in masm but u can code in anything u wish...

we will start off with
1. Dumping ArmAccess.dll
2. Dumping protected PE files
3. Fix & rebuild IAT
4. Fix strategic splice code
5. Then fix nanomite
6. Finally bruteforce secure sections.
7. clean up & other misc tasks like handling dll, ocx, exe etc

yep it all can be done and has been done... so no fear or dead end as long as u have the will to do it, i will provide helps where required etc, my unpacker is not complete either so we can work & improve each other... so whoever is interested start as u wish :)

have fun...
crUsAdEr
09-12-2004, 07:12 PM
hah.. now that Zairon mentioning i should use crackme etc instead of real target (which i will do Zairon, :) so dont worry abt me breaking the forum rule)...

of course the unpacker will have to be able to handle custom built version of armadillo, yes it can be overcome rather easily if anyone still has doubt.
tenketsu
09-12-2004, 09:06 PM
I found the trick in nanomites, code splicing & IAT scrambler.

in this moment i have no time to post [in addition my english is very poor].

I'll post or PM in 2 or 3 hours.
Hopcode
09-13-2004, 01:42 PM
Hello :)

Interesting!
Iam up for the challenge :)

I was going to write a couple unpackers for other protectors, those can wait a litle.

your unpacker isn't complete, what is needed ?

Can it unpack Armadillo.exe from their site ?
The real challenge for an unpacker i think. customers , like for any protectors,
apply protections like morons.

Also.. brute forcing secured sections.. this is impossible without a key.
Strong crypto is used i believe.

Cheers,

Hopcode

warming up MASM :)
crUsAdEr
09-13-2004, 03:15 PM
hi Hopcode,

glad you are interested, if unpacking armadillo itself is no problem... my unpacker is incomplete cos it is not fully automatic, some manual work is still required (aka not user friendly but it was never designed to be :)

just get started anyway u want, depends on how much u have worked with arma... well well, trust me, whatever i listed there can be done and has been done so just go ahead :)

just post anything related here, then we can discuss possible solutions to it. Guess u r using masm :)?

anyway, like my first post said, your first task will be dumping the ArmAccess.dll & decrypt it!!!
Hopcode
09-13-2004, 04:04 PM
Hello :)

>glad you are interested, if unpacking armadillo itself is no problem... my >unpacker is incomplete cos it is not fully automatic, some manual work is still >required (aka not user friendly but it was never designed to be

but then, it does handle nanomites completely on latest Armadillo ?
and Import Elimination ? who cares if it is not 100% auto :)

>just get started anyway u want, depends on how much u have worked with >arma... well well, trust me, whatever i listed there can be done and has been >done so just go ahead

I have studied it. not too much in depth, but enough to understand wtf is going :)

>just post anything related here, then we can discuss possible solutions to it. >Guess u r using masm ?

yes, im using MASM. or TASM. depends of my mood :)

>anyway, like my first post said, your first task will be dumping the >ArmAccess.dll & decrypt it!!!

Via the unpacker you mean ?
What do you recommand for that?
Acting like a debugger of some sort ? hooking API ? injecting code inside Packed Process ? since you have done some work on it, which ways do you recommand to handle the protector ?

The fundation is the base of the unpacker, so better start on the good path, rather than realising it is fucked up, and doing it all later.

Hopcode.
crUsAdEr
09-13-2004, 05:31 PM
but then, it does handle nanomites completely on latest Armadillo ?
and Import Elimination ? who cares if it is not 100% auto

lol of course it handles everything completely :)... noone can sit down and manually fix hundreds of nano each time...

1. Via unpacker i mean a software that can run and remove armadillo from the protected target and produce a working target exe :)...
2. Well since armadillo uses a Debugger approach, i decided to do the same, my unpacker acts as a debugger so i can control armadillo execution flow etc... which is a lot easier... with that approach u can inject code, hook API and do anything you wish to the protected exe... though that means u have to emulate arma-debugger process to pass copymem session hashkey to the child process etc (which u will soon discover what a JOKE armadillo is :)
Hopcode
09-13-2004, 08:30 PM
Ok thanks for infos :)

Well, Armadillo might be a joke, but its harder than Asprotect, which IS a bad joke coz it sucks pond water..

Sd protector, as interesting as it might be, is a lot easier too.
SVKP also stinks, so does ACProtect..

Basically, all protectors are jokes then :)

i will start coding this week.

Cheers
SL0rd
09-14-2004, 01:11 PM
Ive studing manual unpacking stuff and this project is all that I was looking for. Unpacking from the very beginning!
I will follow all the steps from 1 to 7, I hope :) and of course use masm ;)
I will learn a lot this time, lets rock!
MrAnonymous
09-14-2004, 06:06 PM
Out of curiosity what kinda crypto is used on Arma secured sections? Obviously if its bruteforce-able its not very strong. Protectors are more/less all about implementation remember, so Protectors are usually as good as the authors of the protected programs :P
nikolatesla20
09-14-2004, 08:53 PM
I have to comment, I don't know why many people insist on using MASM - unless perhaps they don't have access to a C compiler. In MS VC you can just as easily write a good unpacker that is very small, and you can even put inline ASM if you want (which basically IS MASM then).

Don't get me wrong, MASM is great, and I love using it too, but for more complex unpackers it is not a crime to use C. Straight C will usually compile just as tight as MASM would. And with C you get the benifit of the runtime libraries. For example, in all of my unpackers I use vectors and maps (STL classes). It makes everything so much better and easier to read/maintain.

Just stating, don't be afraid of C.

-nt20
armaski8
09-14-2004, 10:53 PM
i agree... i like using turbo c 2.01...

br
crUsAdEr
09-15-2004, 03:26 PM
sl0rd, welcome onboard... just in case u r waiting for smth to happen, nothing aint gonna happen till u do smth :)... yeah so start downloading the lastest Armadillo3.77 on their website and perhaps look at it, play with it...

The first simple task would be removing the first decryption layer which apparently Chad & co have added lots more seh etc but the job should be easy since that layer doesnt do anything beside confusing u and stopping u from applying IDA on it:)... once you get rid of that layer you can use IDA to study how arma decompress the dll, how debug-blocker works, and how nanomites are handled... :)

Hopcode : whenever u start coding, try to keep things organised, it is gonna be a fairly big project so try to break the codes into small files etc, u know the usual coding practise, keeping constants in one place etc... just get the debugger framework up and running and u r good to explore arma :)
SL0rd
09-16-2004, 12:38 PM
There is a lot to do, I think, for a beginner like me. But my goal is to learn not make a unpacker at all :)
About using MASM, I will use it just because I want increase my asm skills, I will use templates almost all time when doing GUI stuffs!
I thinking not use IDA, firstly I have just the trial version, after Im playing with olly debugger and I found it very intersting, I thinking seriously in using olly :)
I will download armadillo right now! lets go gang!!
dELTA
09-17-2004, 04:21 AM
A disassembler and a debugger are two very different things, and one does not exclude the other. People might have a more dead-listing or live debugging directed approach though, but for analyzing advanced stuff there's nothing like a good disassembler (e.g. IDA)...
Hopcode
09-18-2004, 10:56 AM
Hopcode : whenever u start coding, try to keep things organised, it is gonna be a fairly big project so try to break the codes into small files etc, u know the usual coding practise, keeping constants in one place etc... just get the debugger framework up and running and u r good to explore arma :)

This is how i code usually :-)
I started to code the debugger framework.
I will then code something to change IsDebugged in the PEB, in order to
bypass the debugger checks. I think i could use GetThreadContext and access the address pointed by EDX, because it always points to a very handy place ;-)

My first task will be to dump ArmAccess.dll, im not sure yet, how i can find its base Address. Maybe by hooking a couple of API i can find the info i need ?

Did you do it by hooking at all ?

Cheers,

Hopcode
SL0rd
09-18-2004, 11:34 AM
A disassembler and a debugger are two very different things, and one does not exclude the other. People might have a more dead-listing or live debugging directed approach though, but for analyzing advanced stuff there's nothing like a good disassembler (e.g. IDA)...

I think it was for me :) Ok, ok I got it!!
crUsAdEr
09-18-2004, 12:27 PM
This is how i code usually :-)
I will then code something to change IsDebugged in the PEB, in order to
bypass the debugger checks. I think i could use GetThreadContext and access the address pointed by EDX, because it always points to a very handy place ;-)

My first task will be to dump ArmAccess.dll, im not sure yet, how i can find its base Address. Maybe by hooking a couple of API i can find the info i need ?

ok let me discuss some plan of attack :)
Armadillo has 2 process running if they have debug blocker on, so your unpacker must be able to handle case of 2 processes or 1 single process running...
The problem with 2 process running is that your unpacker will acts as a debugger for Armadillo server/father processs (watever u call it :) so your debugger will need to use ToolHelpsAPI for accessing memory of the client/child process...
I take another approach, that is my unpacker acts as a debugger, and i do not hide this fact, so whenever we launch an armadilloed app, the app will think debug blocker is on, then execute as child/client process only and do not create a new process irregardless of protection settings.

That sounds a bit confusing but maybe after some trials u will know what i mean. Just a suggestion:)

Perhaps u can try dumping ArmAccess.dll manually with Olly once, then you will know how code a dumper for it. But first you will need to rip of the first layer of decryption by armadillo... u will need it for nanomite fixing later :).
You will see armadillo excute like this
execute code in section .adata (nothing here at all, just garbage + decryption)
execute code in section .text1 (branch into server/client process...)
u will need to find OEP in section .text1 and your unpacker's first task is to dump at OEP here :)... then we will cont from there...

cheers,
Hopcode
09-18-2004, 03:42 PM
Ok so basically, you suggest to take over Armadillo's parent position?

We are going to act as the parent that is supposed to handle the nanomites, and all the rest?

For the dll, i was thinking of hooking the parent, and then, i could inject some code, to bounce on the debuggee. I think a GetModuleHandle on dll
would have allowed me to get its base address, and then do what i need to (like reading it into my buffer or whatnot)

Though, if i act as the parent, i should be able to inject directly into the debugee (hooks). to find child OEP, i would try to hook for GetVersion for instance, and dump it there. would that work ?

Since Arma is coded in VC++, it has a standard entry point it should work...

I have to experiment, a litle busy right now though.

Thanks for taking the time to explaining :)

Cheers,
Hopcode :yay:
crUsAdEr
09-18-2004, 07:23 PM
yep, any of those ideas will work :)... do watever suits your style... we are simply discussing ideas, so anyone can have their own styles of unpacker :)
tenketsu
09-19-2004, 12:40 AM
This code is 2 or 3 weeks ago [my mid too..]

I have made this table:

Jump Info || Jump Flags

77 - 0F87 JA Jump if above (C=0 and Z=0)
C 0 P 1 A 1 Z 0 S 1 T 1 D 1 O 1 00000F96

73 - 0F83 JAE Jump if above or equal (C=0)
C 0 P 1 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD6

72 - 0F82 JB Jump if below (C=1)
C 1 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000203

76 - 0F86 JBE Jump if below or equal (C=1 or Z=1)
C 1 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000203
C 0 P 0 A 0 Z 1 S 0 T 0 D 0 O 0 00000242

72 - 0F82 JC Jump if carry (C=1)
C 1 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000203

E3 - JCXZ Jump if CX register is 0

E3 - JECXZ Jump if ECX register is 0

74 - 0F84 JE Jump if equal (Z=1)
C 0 P 0 A 0 Z 1 S 0 T 0 D 0 O 0 00000242

7F - 0F8F JG Jump if greater (Z=0 and S=O)
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000202
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 1 00000A82

7D - 0F8D JGE Jump if greater or equal (S=O)
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000202
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 1 00000A82

7C - 0F8C JL Jump if less (S<>O)
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 1 00000A02
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 0 00000282

7E - 0F8E JLE Jump if less or equal (Z=1 or S<>O)
C 0 P 0 A 0 Z 1 S 0 T 0 D 0 O 0 00000242
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 1 00000A02
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 0 00000282

76 - 0F86 JNA Jump if not above (C=1 or Z=1)
C 1 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000203
C 0 P 0 A 0 Z 1 S 0 T 0 D 0 O 0 00000242

72 - 0F82 JNAE Jump if not above or equal (C=1)
C 1 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000203

73 - 0F83 JNB Jump if not below (C=0)
C 0 P 1 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD6

77 - 0F87 JNBE Jump if not below or equal (C=0 and Z=0)
C 0 P 1 A 1 Z 0 S 1 T 1 D 1 O 1 00000F96

73 - 0F83 JNC Jump if not carry (C=0)
C 0 P 1 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD6

75 - 0F85 JNE Jump if not equal (Z=0)
C 1 P 1 A 1 Z 0 S 1 T 1 D 1 O 1 00000F97

7E - 0F8E JNG Jump if not greater (Z=1 or S<>O)
C 0 P 0 A 0 Z 1 S 0 T 0 D 0 O 0 00000242
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 1 00000A02
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 0 00000282

7C - 0F8C JNGE Jump if not greater or equal (S<>O)
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 1 00000A02
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 0 00000282

7D - 0F8D JNL Jump if not less (S=O)
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000202
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 1 00000A82

7F - 0F8F JNLE Jump if not less or equal (Z=0 and S=O)
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000202
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 1 00000A82

71 - 0F81 JNO Jump if not overflow (O=0)
C 1 P 1 A 1 Z 1 S 1 T 1 D 1 O 0 000007D7

7B - 0F8B JNP Jump if not parity (P=0)
C 1 P 0 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD3

79 - 0F89 JNS Jump if not sign (S=0)
C 1 P 1 A 1 Z 1 S 0 T 1 D 1 O 1 00000F57

75 - 0F85 JNZ Jump if not zero (Z=0)
C 1 P 1 A 1 Z 0 S 1 T 1 D 1 O 1 00000F97

70 - 0F80 JO Jump if overflow (O=1)
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 1 00000A02

7A - 0F8A JP Jump if parity (P=1)
C 0 P 1 A 0 Z 0 S 0 T 0 D 0 O 0 00000206

7A - 0F8A JPE Jump if parity even (P=1)
C 0 P 1 A 0 Z 0 S 0 T 0 D 0 O 0 00000206

7B - 0F8B JPO Jump if parity odd (P=0)
C 1 P 0 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD3

78 - 0F88 JS Jump if sign (S=1)
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 0 00000282

74 - 0F84 JZ Jump if zero (Z=1)
C 0 P 0 A 0 Z 1 S 0 T 0 D 0 O 0 00000242

EB - E9 JMP Jump

Each Jump [table of jumps] is comparated with the flags [representing all jumps]:

00000202
00000203
00000206
00000242
00000282
000007D7
00000A02
00000A82
00000F57
00000F96
00000F97
00000FD3
00000FD6

0060353A 8B85 68EEFFFF MOV EAX,DWORD PTR SS:[EBP-1198]
00603540 8B0C85 B8D96200 MOV ECX,DWORD PTR DS:[EAX*4+62D9B8]
00603547 8B95 94EBFFFF MOV EDX,DWORD PTR SS:[EBP-146C]
0060354D 33C0 XOR EAX,EAX
0060354F 8A0411 MOV AL,BYTE PTR DS:[ECX+EDX] ;mov al, jmptype
00603552 8985 78EBFFFF MOV DWORD PTR SS:[EBP-1488],EAX
00603558 8B85 78EBFFFF MOV EAX,DWORD PTR SS:[EBP-1488]
0060355E 99 CDQ
0060355F 83E2 0F AND EDX,0F
00603562 03C2 ADD EAX,EDX
00603564 C1F8 04 SAR EAX,4
00603567 8985 80EBFFFF MOV DWORD PTR SS:[EBP-1480],EAX
0060356D 8B8D 78EBFFFF MOV ECX,DWORD PTR SS:[EBP-1488]
00603573 81E1 0F000080 AND ECX,8000000F
00603579 79 05 JNS SHORT SomeTarget.00603580
0060357B 49 DEC ECX
0060357C 83C9 F0 OR ECX,FFFFFFF0
0060357F 41 INC ECX
00603580 898D 7CEBFFFF MOV DWORD PTR SS:[EBP-1484],ECX
00603586 8B95 80EBFFFF MOV EDX,DWORD PTR SS:[EBP-1480]
0060358C 3B95 7CEBFFFF CMP EDX,DWORD PTR SS:[EBP-1484]
00603592 75 1B JNZ SHORT SomeTarget.006035AF
00603594 8B85 7CEBFFFF MOV EAX,DWORD PTR SS:[EBP-1484]
0060359A 83C0 01 ADD EAX,1
0060359D 25 0F000080 AND EAX,8000000F
006035A2 79 05 JNS SHORT SomeTarget.006035A9
006035A4 48 DEC EAX
006035A5 83C8 F0 OR EAX,FFFFFFF0
006035A8 40 INC EAX
006035A9 8985 7CEBFFFF MOV DWORD PTR SS:[EBP-1484],EAX
006035AF 8B8D 78EBFFFF MOV ECX,DWORD PTR SS:[EBP-1488]
006035B5 8B95 80EBFFFF MOV EDX,DWORD PTR SS:[EBP-1480]
006035BB 8B048D 28CF6200 MOV EAX,DWORD PTR DS:[ECX*4+62CF28]
006035C2 330495 AC726200 XOR EAX,DWORD PTR DS:[EDX*4+6272AC]
006035C9 8B8D 7CEBFFFF MOV ECX,DWORD PTR SS:[EBP-1484]
006035CF 33048D AC726200 XOR EAX,DWORD PTR DS:[ECX*4+6272AC]
006035D6 8985 88EBFFFF MOV DWORD PTR SS:[EBP-1478],EAX
006035DC 8B95 5CECFFFF MOV EDX,DWORD PTR SS:[EBP-13A4] ;mov edx, flags
006035E2 81E2 D70F0000 AND EDX,0FD7
006035E8 52 PUSH EDX
006035E9 8B85 78EBFFFF MOV EAX,DWORD PTR SS:[EBP-1488]
006035EF 0FBE88 90B76200 MOVSX ECX,BYTE PTR DS:[EAX+62B790]
006035F6 FF148D 98B86200 CALL DWORD PTR DS:[ECX*4+62B898]
006035FD 83C4 04 ADD ESP,4
00603600 8985 8CEBFFFF MOV DWORD PTR SS:[EBP-1474],EAX
00603606 8B95 48ECFFFF MOV EDX,DWORD PTR SS:[EBP-13B8]
0060360C 52 PUSH EDX
0060360D 8B85 8CEBFFFF MOV EAX,DWORD PTR SS:[EBP-1474]
00603613 50 PUSH EAX
00603614 FF95 88EBFFFF CALL DWORD PTR SS:[EBP-1478]
0060361A 83C4 08 ADD ESP,8
0060361D 50 PUSH EAX
0060361E 8B8D 78EBFFFF MOV ECX,DWORD PTR SS:[EBP-1488]
00603624 0FBE91 90B76200 MOVSX EDX,BYTE PTR DS:[ECX+62B790]
0060362B FF1495 D8B86200 CALL DWORD PTR DS:[EDX*4+62B8D8] ;algo-check the flags
00603632 83C4 04 ADD ESP,4
00603635 8985 84EBFFFF MOV DWORD PTR SS:[EBP-147C],EAX
0060363B 8B85 84EBFFFF MOV EAX,DWORD PTR SS:[EBP-147C]
00603641 83E0 01 AND EAX,1
00603644 85C0 TEST EAX,EAX ; if eax=1 the jump, JUMP!
00603646 0F84 AE000000 JE SomeTarget.006036FA

0012C2F4 == JmpType
0012C3D8 == Flags
0012BC78 == Is flag active

My english is :boo: , before i'll post more info
Hopcode
09-19-2004, 01:30 PM
Thanks for poiting some code :)

How does the jmp handlers look like nowadays ?
I assume they change them regulary.

Do you find easy to read code ? or kind of obfuscated tests of the flags?
Last time i checked, there were both styles of tests.

Anyway, i have yet to code the first part of the unpacker.
Should be fairly easy to dump at Arma OEP.

Cheers,

Hopcode
tenketsu
09-19-2004, 06:29 PM
in the init [00603552] of code the registers [eax, ecx, etc] are saved.

the next step is do a loop init to end [00603552 to 00603646], copy a table containing the jump types [byte] and other containig the jump flags [dword], the loop compare each jump type with all flags, analizing the result of each comparation we can now the REAL type of jump, in the init the registers would be restored with the data saved before and then init on 00603552.

in the line
0060354F MOV AL,BYTE PTR DS:[ECX+EDX] ;mov al, jump type
mov al, the firts jump type [nano table - 1 byte] ordered minor to mayor

in the line
006035DC MOV EDX,DWORD PTR SS:[EBP-13A4] ;mov edx, flags
mov edx, the jump flags [table in the other post]

in the line
0060362B CALL DWORD PTR DS:[EDX*4+62B8D8] ;check the jmp type
if the flags are active according to the jump set 00000001 in 0012BC78

in the line
00603644 TEST EAX,EAX ;if eax=1 the jump, JUMP!

I'll post an example later. Sorry for my lame english :whoops:
tenketsu
10-14-2004, 12:58 PM
Jump type (byte) [0012C2F0]

Jump Flags (dword) [0012C3D4]

IsFlagActive [0012BC74]

Original registers at EIP==0066220A:

ECX 00DC70B0
EDX 0000000A
EBX 00670A00
ESP 0012BC90
EBP 0012D77C
ESI 00000010
EDI 0012C2E4

Original Code:

006621BD JMP SHORT SomeTarget.006621F2
006621BF ??? ; Unknown command
006621C0 JE SHORT SomeTarget.006621C2
006621C2 JMP SHORT SomeTarget.006621D1
006621C4 MOV EAX,87B90FEB
006621C9 LEAVE
006621CA STC
006621CB XOR AL,90
006621CD STC
006621CE JE SHORT SomeTarget.006621D5
006621D0 JMP SHORT SomeTarget.00662205
006621D2 SAL BYTE PTR DS:[EDX+ESI*8-48],87
006621D7 LEAVE
006621D8 INC EAX
006621D9 DEC EAX
006621DA TEST EAX,EAX
006621DC JNZ SHORT SomeTarget.006621BB
006621DE JMP 92CCBF44
006621E3 XCHG AX,DX
006621E5 MOV EAX,EAX
006621E7 JO SHORT SomeTarget.006621F0
006621E9 JL SHORT SomeTarget.006621EE
006621EB JMP SHORT SomeTarget.006621F2
006621ED CALL FA521D66
006621F2 MOV EAX,DWORD PTR SS:[EBP-119C]
006621F8 MOV ECX,DWORD PTR DS:[EAX*4+68C9C8]
006621FF MOV EDX,DWORD PTR SS:[EBP-1470]
00662205 XOR EAX,EAX
00662207 MOV AL,BYTE PTR DS:[ECX+EDX]
0066220A MOV DWORD PTR SS:[EBP-148C],EAX
00662210 MOV EAX,DWORD PTR SS:[EBP-148C]
00662216 CDQ
00662217 AND EDX,0F
0066221A ADD EAX,EDX
0066221C SAR EAX,4
0066221F MOV DWORD PTR SS:[EBP-1484],EAX
00662225 MOV ECX,DWORD PTR SS:[EBP-148C]
0066222B AND ECX,8000000F
00662231 JNS SHORT SomeTarget.00662238
00662233 DEC ECX
00662234 OR ECX,FFFFFFF0
00662237 INC ECX
00662238 MOV DWORD PTR SS:[EBP-1488],ECX
0066223E MOV EDX,DWORD PTR SS:[EBP-1484]
00662244 CMP EDX,DWORD PTR SS:[EBP-1488]
0066224A JNZ SHORT SomeTarget.00662267
0066224C MOV EAX,DWORD PTR SS:[EBP-1488]
00662252 ADD EAX,1
00662255 AND EAX,8000000F
0066225A JNS SHORT SomeTarget.00662261
0066225C DEC EAX
0066225D OR EAX,FFFFFFF0
00662260 INC EAX
00662261 MOV DWORD PTR SS:[EBP-1488],EAX
00662267 MOV ECX,DWORD PTR SS:[EBP-148C]
0066226D MOV EDX,DWORD PTR SS:[EBP-1484]
00662273 MOV EAX,DWORD PTR DS:[ECX*4+68BF38]
0066227A XOR EAX,DWORD PTR DS:[EDX*4+6862AC]
00662281 MOV ECX,DWORD PTR SS:[EBP-1488]
00662287 XOR EAX,DWORD PTR DS:[ECX*4+6862AC]
0066228E MOV DWORD PTR SS:[EBP-147C],EAX
00662294 MOV EDX,DWORD PTR SS:[EBP-13A8]
0066229A AND EDX,0FD7
006622A0 PUSH EDX
006622A1 MOV EAX,DWORD PTR SS:[EBP-148C]
006622A7 MOVSX ECX,BYTE PTR DS:[EAX+68A7A0]
006622AE CALL DWORD PTR DS:[ECX*4+68A8A8]
006622B5 ADD ESP,4
006622B8 MOV DWORD PTR SS:[EBP-1478],EAX
006622BE MOV EDX,DWORD PTR SS:[EBP-13BC]
006622C4 PUSH EDX
006622C5 MOV EAX,DWORD PTR SS:[EBP-1478]
006622CB PUSH EAX
006622CC CALL DWORD PTR SS:[EBP-147C]
006622D2 ADD ESP,8
006622D5 PUSH EAX
006622D6 MOV ECX,DWORD PTR SS:[EBP-148C]
006622DC MOVSX EDX,BYTE PTR DS:[ECX+68A7A0]
006622E3 CALL DWORD PTR DS:[EDX*4+68A8E8]
006622EA ADD ESP,4
006622ED MOV DWORD PTR SS:[EBP-1480],EAX
006622F3 MOV EAX,DWORD PTR SS:[EBP-1480]
006622F9 AND EAX,1
006622FC TEST EAX,EAX
006622FE JE SomeTarget.006623B2
00662304 PUSHAD
00662305 XOR EAX,EAX
00662307 JNZ SHORT SomeTarget.0066230B
00662309 JMP SHORT SomeTarget.00662320
0066230B JMP SHORT SomeTarget.00662340
0066230D SAL BYTE PTR SS:[EBP+18],7A
00662311 OR AL,70
00662313 PUSH CS
00662314 JMP SHORT SomeTarget.00662323
00662316 CALL F1DF318D
0066231B CALL DWORD PTR DS:[74097900]
00662321 LOCK JMP SHORT SomeTarget.006622AB
00662324 FSTP TBYTE PTR DS:[EDX-10]
00662327 MOV AL,BYTE PTR DS:[8D8B6133]
0066232C OUT DX,AL ; I/O command
0066232E ??? ; Unknown command
00662330 MOV ECX,DWORD PTR DS:[ECX*4+68C8E8]
00662337 MOV EAX,DWORD PTR SS:[EBP-1470]

Modified code:

006621BD NOP
006621BE NOP
006621BF MOV ECX,DWORD PTR DS:[60C058] ; Counter for NanoTypes (initial == 0)
006621C5 XOR EAX,EAX
006621C7 MOV AL,BYTE PTR DS:[ECX+60C000] ; Mov the nanotype
006621CD NOP
006621CE MOV ECX,DWORD PTR DS:[60C05C] ; Counter for JumpFlags
006621D4 MOV EDX,DWORD PTR DS:[ECX*4+60C060]
006621DB MOV DWORD PTR DS:[12C3D4],EDX
006621E1 NOP
006621E2 MOV ECX,0DC70B0 ;Restore Register
006621E7 MOV EDX,0A ;Restore Register
006621EC MOV EBX,SomeTarget.00670A00 ;Restore Register
006621F1 MOV ESP,12BC90 ;Restore Register
006621F6 MOV EBP,12D77C ;Restore Register
006621FB MOV ESI,10 ;Restore Register
00662200 MOV EDI,12C2E4 ;Restore Register
00662205 NOP
00662206 NOP
00662207 NOP
00662208 NOP
00662209 NOP
0066220A MOV DWORD PTR SS:[EBP-148C],EAX ; mov NanoType
00662210 MOV EAX,DWORD PTR SS:[EBP-148C]
00662216 CDQ
00662217 AND EDX,0F
0066221A ADD EAX,EDX
0066221C SAR EAX,4
0066221F MOV DWORD PTR SS:[EBP-1484],EAX
00662225 MOV ECX,DWORD PTR SS:[EBP-148C]
0066222B AND ECX,8000000F
00662231 JNS SHORT SomeTarget.00662238
00662233 DEC ECX
00662234 OR ECX,FFFFFFF0
00662237 INC ECX
00662238 MOV DWORD PTR SS:[EBP-1488],ECX
0066223E MOV EDX,DWORD PTR SS:[EBP-1484]
00662244 CMP EDX,DWORD PTR SS:[EBP-1488]
0066224A JNZ SHORT SomeTarget.00662267
0066224C MOV EAX,DWORD PTR SS:[EBP-1488]
00662252 ADD EAX,1
00662255 AND EAX,8000000F
0066225A JNS SHORT SomeTarget.00662261
0066225C DEC EAX
0066225D OR EAX,FFFFFFF0
00662260 INC EAX
00662261 MOV DWORD PTR SS:[EBP-1488],EAX
00662267 MOV ECX,DWORD PTR SS:[EBP-148C]
0066226D MOV EDX,DWORD PTR SS:[EBP-1484]
00662273 MOV EAX,DWORD PTR DS:[ECX*4+68BF38]
0066227A XOR EAX,DWORD PTR DS:[EDX*4+6862AC]
00662281 MOV ECX,DWORD PTR SS:[EBP-1488]
00662287 XOR EAX,DWORD PTR DS:[ECX*4+6862AC]
0066228E MOV DWORD PTR SS:[EBP-147C],EAX
00662294 MOV EDX,DWORD PTR SS:[EBP-13A8] ; mov edx, JumpFlags
0066229A AND EDX,0FD7
006622A0 PUSH EDX
006622A1 MOV EAX,DWORD PTR SS:[EBP-148C]
006622A7 MOVSX ECX,BYTE PTR DS:[EAX+68A7A0]
006622AE CALL DWORD PTR DS:[ECX*4+68A8A8]
006622B5 ADD ESP,4
006622B8 MOV DWORD PTR SS:[EBP-1478],EAX
006622BE MOV EDX,DWORD PTR SS:[EBP-13BC]
006622C4 PUSH EDX
006622C5 MOV EAX,DWORD PTR SS:[EBP-1478]
006622CB PUSH EAX
006622CC CALL DWORD PTR SS:[EBP-147C] ; Check IsFlagActive
006622D2 ADD ESP,8
006622D5 PUSH EAX
006622D6 MOV ECX,DWORD PTR SS:[EBP-148C]
006622DC MOVSX EDX,BYTE PTR DS:[ECX+68A7A0]
006622E3 CALL DWORD PTR DS:[EDX*4+68A8E8]
006622EA ADD ESP,4
006622ED MOV DWORD PTR SS:[EBP-1480],EAX
006622F3 MOV EAX,DWORD PTR SS:[EBP-1480]
006622F9 AND EAX,1
006622FC TEST EAX,EAX ; if eax==1 the jump, JUMP
006622FE NOP
006622FF MOV ECX,DWORD PTR DS:[60C05C] ; counter to JumpFlags
00662305 INC ECX ; ecx = ecx + 1
00662306 MOV DWORD PTR DS:[60C05C],ECX
0066230C CMP ECX,0D ; Number of JumpFlags
0066230F JNZ SomeTarget.006621BF
00662315 NOP
00662316 MOV DWORD PTR DS:[60C05C],0 ; Reset Counter JumpFlags
00662320 MOV ECX,DWORD PTR DS:[60C058] ; Counter NanoTypes
00662326 INC ECX ; ecx = ecx + 1
00662327 MOV DWORD PTR DS:[60C058],ECX
0066232D CMP ECX,55 ; number Of NanoTypes
00662330 JNZ SomeTarget.006621BF ; Init all Loop
00662336 NOP
00662337 NOP
00662338 NOP
00662339 NOP
0066233A NOP
0066233B NOP
0066233C NOP

Setting a BP-Log;

0066220A - log eax
0066229A - log edx
006622D2 - log [0012BC74]
006622FC - log eax

the result is:

0066220A COND: 00000000 ; nanotype
0066229A COND: 00000202 ; JumpFlags
006622D2 COND: 00000000 ; IsFlagActive
006622FC COND: 00000000 ; The jump, JUMP?

0066220A COND: 00000000 ; nanotype
0066229A COND: 00000203 ; JumpFlags
006622D2 COND: 00000000 ; IsFlagActive
006622FC COND: 00000000 ; The jump, JUMP?

0066220A COND: 00000000
0066229A COND: 00000206
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000000
0066229A COND: 00000242
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000000
0066229A COND: 00000282
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000000
0066229A COND: 000007D7
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000000
0066229A COND: 00000A02
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000000
0066229A COND: 00000A82
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000000
0066229A COND: 00000F57
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000000
0066229A COND: 00000F96
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000000
0066229A COND: 00000F97
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000000
0066229A COND: 00000FD3
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000000
0066229A COND: 00000FD6
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000002
0066229A COND: 00000202
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000002
0066229A COND: 00000203
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000002
0066229A COND: 00000206
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000002
0066229A COND: 00000242
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000002
0066229A COND: 00000282
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000002
0066229A COND: 000007D7
006622D2 COND: 00000001
006622FC COND: 00000001
0066220A COND: 00000002
0066229A COND: 00000A02
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000002
0066229A COND: 00000A82
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000002
0066229A COND: 00000F57
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000002
0066229A COND: 00000F96
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000002
0066229A COND: 00000F97
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000002
0066229A COND: 00000FD3
006622D2 COND: 00000000
006622FC COND: 00000000
0066220A COND: 00000002
0066229A COND: 00000FD6
006622D2 COND: 00000000
006622FC COND: 00000000

etc.

Parsing with a program made by me, in my target the result is

Nanotype = Jump Type (flag condition) == JumpType for JCDN [N.Rec]

Flag Flag Flag Flag Flag Flag Flag Flag FlagsDWORD IsActive Jump?

00 = 74 - 0F84 JZ Jump if equal (Z=1) == 0A

C 0 P 0 A 0 Z 1 S 0 T 0 D 0 O 0 00000242 00000001 00000001
C 1 P 1 A 1 Z 1 S 1 T 1 D 1 O 0 000007D7 00000001 00000001
C 1 P 1 A 1 Z 1 S 0 T 1 D 1 O 1 00000F57 00000001 00000001
C 1 P 0 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD3 00000001 00000001
C 0 P 1 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD6 00000001 00000001

C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000202 00000000 00000000
C 1 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000203 00000000 00000000
C 0 P 1 A 0 Z 0 S 0 T 0 D 0 O 0 00000206 00000000 00000000
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 0 00000282 00000000 00000000
C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 1 00000A02 00000000 00000000
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 1 00000A82 00000000 00000000
C 0 P 1 A 1 Z 0 S 1 T 1 D 1 O 1 00000F96 00000000 00000000
C 1 P 1 A 1 Z 0 S 1 T 1 D 1 O 1 00000F97 00000000 00000000

02 = 71 - 0F81 JNO Jump if not overflow (O=0) == 02

C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000202 00000001 00000001
C 1 P 0 A 0 Z 0 S 0 T 0 D 0 O 0 00000203 00000001 00000001
C 0 P 1 A 0 Z 0 S 0 T 0 D 0 O 0 00000206 00000001 00000001
C 0 P 0 A 0 Z 1 S 0 T 0 D 0 O 0 00000242 00000001 00000001
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 0 00000282 00000001 00000001
C 1 P 1 A 1 Z 1 S 1 T 1 D 1 O 0 000007D7 00000001 00000001

C 0 P 0 A 0 Z 0 S 0 T 0 D 0 O 1 00000A02 00000000 00000000
C 0 P 0 A 0 Z 0 S 1 T 0 D 0 O 1 00000A82 00000000 00000000
C 1 P 1 A 1 Z 1 S 0 T 1 D 1 O 1 00000F57 00000000 00000000
C 0 P 1 A 1 Z 0 S 1 T 1 D 1 O 1 00000F96 00000000 00000000
C 1 P 1 A 1 Z 0 S 1 T 1 D 1 O 1 00000F97 00000000 00000000
C 1 P 0 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD3 00000000 00000000
C 0 P 1 A 1 Z 1 S 1 T 1 D 1 O 1 00000FD6 00000000 00000000

And all the Nanotypes are retrieved to a real JUMP type

See you soon :devil:
dELTA
10-14-2004, 05:31 PM
Thanks for keeping us updated on packer internals tenketsu. :yay: Please just don't identify the target of any explicit code you post, it might get us in trouble (I removed the identifying info in your post).
tenketsu
10-14-2004, 06:59 PM
I'm sorry. I copy it directly from my notes, and I did not become aware of the TARGET.ADDR

I will publish an tutorial in some days of how defeat ALL tricks and the Armadillo's protections.
dELTA
10-14-2004, 09:24 PM
Cool, we're looking forward to see it. :cool:
JMI
10-15-2004, 02:34 AM
Of course once your tut is published, they will change some of "the tricks." :eek:

Regards,
whyIII
10-19-2004, 01:25 AM
has the tut published??
JMI
10-19-2004, 02:08 AM
Now don't you think that if it had been published, there would be some mention of it here? Or did you just want to see your nick on a post? :eek:

Regards,
Rackmount
10-22-2004, 12:45 PM
dELTA: You might want to look at tenketsu's post "This code is 2 or 3 weeks ago [my mid too..]" again. Could be that "SomeTarget" references still exist...
dELTA
10-22-2004, 06:04 PM
Ok, thanks, fixed.
zaratustra
10-27-2004, 01:36 AM
hi, some one
could better explain the code posted by
tenketsu i can't understand it very
much and i've a target that is
very similar....
please help!!!
thank you
ZaiRoN
10-27-2004, 04:19 AM
> i can't understand it very much
What, all the code??? Or something in particular?
zaratustra
10-27-2004, 07:10 AM
hi Zairon
i'm interested "only" in the method on how to solve
this kind of nanomites. where i have to look for the
fantomatic tables and where i have to patch
could you help me?
Spec0p
11-23-2004, 07:23 PM
Hello there,
also i decided to enter the project, 1st because i never coded anything at a so "high" level as an unpacker, and second because iam also a arma lover :D .
I started last week when i seen this post, and my aproach has been unpack it as if i would unpack it manually. So my unpacker ill be some kinda of a debugger that allows me to do everything as if i would do it manually. So i have been packig some small exe's that i coded, and study them, fortunally i have been greatly helped by a friend that its "hyper" advanced at arma, and have been giving me some lights.
I started by the easiest protection of them all the standart+debugblocker, as its my plan to work in one protection option at a time. Currently my unpacker seems being able to dump standart+debugblocker only with help of imprec.
I started today to study the cm2 option, since i had unpacked many targets using that option before, i know +/- how it works, so i started to code, in a way that the unpacker would do the same things i would if doing it manually, at the end of the day, well everything looked ok, i sucessfully completely dumped an exe process to disk. I have to admit i was happy, hehe but not for long :-/ , when analysing the dump i could see that all the pages had been decrypted, but still the code appears to be encrypted :confused: i checked, and checked, step by step, everything seems to be ok, and when i say step by step i really mean line by line, i dont understand why it dont decrypts correctly, while trying to find what was going wrong i steped into the decryption routine, it xor the code first with a constant byte, 59 in my case, and then with a dword key, that changes every page he writes, i didnt entered in detail on this dword key because it looks like it was being calc on a very long table. I even thought that it could be the detection of some of my inject code, but then i thinked about it, and i just do what i do manually, and when i do it manually, well everything runs like it should, i tried everything i could remember, at middle i even found a way to fix all the pages whitout restarting the process, but the bad decryption continues, its 1:18am now, i coded the algo in some 3hours and been trying to fix it for some 6h... and i would be more time gladly if i knwe there were more options, but i think i tried them all, its just so fuc... weird, i dont set any breakpoints, i dont pacth anything that i wouldnt pacth when doing manually, everything equal, and still it decrypts correctly manually, and not when u use the unpacker.
So i hope someone outhere can give me some light why is this happening, specially u Crusader, because it seems u overwalmed all those things, even if u used an different aproach than me, what i sincerelly believe u did, i still hope u can give me some explanation on this matter.

thx,
Spec0p :yay:

P.S. Btw i was dumping using my own function, but just to post that i also thinked it could be some problem at it, and then i used LordPe several times, but everything keeps the same... :mad:
crUsAdEr
11-27-2004, 03:51 PM
hi SpecOp,

Great to have u onboard... sorry for the late reply, was away on Thanksgiving holiday :)

If u could provide a bit more info on where you dump, what is encrypted what is not (whole exe or just .code section) then perhaps i could guess what went wrong...

I suppose you can try comparing the output of manual unpacking with your unpacker output to see where things go wrong...
Spec0p
11-27-2004, 06:39 PM
Hi there crUsAdEr,
thx 4 replying, and yes i noticed the late reply :devil: , but thats not a problem :yay:, hope u had some nice hollidays ;) .
I was dumping at the same place, that i think everyone dumps when doing manually, after the jmp that checks if the maximum pages as been reached, inside the decrypt/encrypt loop.
what is encrypted what is not (whole exe or just .code section) then perhaps i could guess what went wrong...
Well all exe was decrypting badly.
I suppose you can try comparing the output of manual unpacking with your unpacker output to see where things go wrong...
Since all exe was badly decrypted they were diferent from the beggining, and to make things worst, everytime i did a dump all bytes where diferent :sneaky: . But no problem, really have to thx Chad, because that that way he forced me to explore how cm2 works, i analyzed, analyzed and analyzed again, during 3 days (on a 5 days week hollyday :boo: ) i studied and finally compreended how cm2 works, hows keys are hashed, how they are used, even how protector knows if its a cm2 protected app, eventually i have found the problem, the dump could never be good, because arma was creating dummie keys to decrypt it, yes he was decteting my unpacker, and instead of saying it, like with that beautifull textbox saying, that a debugger was detected on sytem blablabla, he just silently hashed bad keys and do everything like normal, so i was looking for errors on my unpacker... So i have now stepped over that problem :p.
And how is going everyone outhere who started also the project, any news??
crUsAdEr
11-27-2004, 09:52 PM
great to hear that :)

keep up the good work... the fun has only just begun :)
Nico
11-28-2004, 10:42 AM
Are you guys having fun ? :-)
nikolatesla20
11-28-2004, 12:10 PM
Yep, hehe we always like to have fun :)

-nt20
crUsAdEr
11-28-2004, 04:48 PM
Are you guys having fun ? :-)

Lol, nice to see silicon realms watching the board so closely... it is funny though...

seriously? Nope... i havent had fun with armadillo for ages... why? cos nothing has changed with armadillo for the last 6 months or so... only the Version number of course :)...
zaratustra
11-29-2004, 01:26 AM
ah ah ah
yes now arma is very fun
and solving nanos too :-P
JMI
11-29-2004, 11:08 AM
Wait a minute. You guys aren't supposed to be having fun, just hard work and making life easier for those of us who do not have the time to have fun either. :idea:

Regards,
NimDa2k3
12-01-2004, 01:09 AM
i need an Armadillio Unpacker 3.36
JMI
12-01-2004, 02:56 AM
Please feel free to make one for yourself and then distribute for others to enjoy. :idea:

Regards,
%UNDEFINED%
12-02-2004, 07:04 PM
i need an Armadillio Unpacker 3.36
And what would that teach you? :confused:

Nothing.

I guess you missed the point of this thread, if you even read it. This thread exisits to learn about and to understand Armadillo. :idea:

And then if possible to engineer a program to automate the unpacking process, while learning how, why, where, when! :eek:

I don't believe that there was even mention of releasing to the public any pre-compiled lamer machine. :smug:

Where is the bus when you need it?
Nico
12-04-2004, 05:33 PM
i need an Armadillio Unpacker 3.36

Contact me ;-)

Edit: I actually got contacted by another board member :)) Fun
Woodmann
12-04-2004, 07:01 PM
Did someone call for the bus ???
Nico
12-04-2004, 07:04 PM
h**p://www.barp.ca/bus/coach/coach-l/lamer680.jpg

Protection authors too can have humor ;-)
%UNDEFINED%
12-05-2004, 11:47 AM
Nice photo, I think I saw a friend of mine in the window...:devil:

Anywho, is there anything new on this topic?

My MASM project needs to go into the recycle bin...I haven't made any progress...Damn COPYMEM keeps me at bay again...but its enough to piss me off to try, and try again :sneaky:

Peace
Spec0p
01-03-2005, 07:49 AM
Hi there arma lovers,
i now also have something that looks like an unpacker to armadillo :D its not MASM or TASM or anything xASM coded, i have some snipets of inline ASM but nothing special..., its C++ but well its works anyway, it has been very, very fun (yeah Nico lots of FUN ;) )coding it. So fun that now that i finished it, well i dont know to do with my life, ill prolly suicide myself :-/ . If my experience on it can help someone, ill gladly share it, since it was based on experience that others shared, that i managed to do it... Keep going guys thats the spirit :)
Nico
01-03-2005, 07:52 AM
Before you decide to kill yourself ;-) you can email it to me, and i will make sure to call Emergency in return ;-)

I am glad you had fun

Cheers,

Nico Asleep
dELTA
01-03-2005, 08:29 AM
So fun that now that i finished it, well i dont know to do with my life, ill prolly suicide myselfHow about using that quote Nico? "Armadillo - any unpacking attempt may be fatal" :D

Sounds like nice work anyway SpecOp. :yay:
Nico
01-03-2005, 09:03 AM
Like this dELTA ? ;-)
dELTA
01-03-2005, 09:18 AM
:)
JMI
01-03-2005, 12:24 PM
Or perhaps:

"Armadillo - not attempting to unpack may be fatal". :devil:

Regards,
Spec0p
01-04-2005, 03:13 AM
I haven't made any progress...Damn COPYMEM keeps me at bay again...but its enough to piss me off to try, and try again :sneaky:

Any progress? Need help?


convert .MAP to .TDS?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > convert .MAP to .TDS?
PDA

View Full Version : convert .MAP to .TDS?

zombie8
09-12-2004, 06:06 AM
Hi

I am debugging a 16-bit app with 16-bit Turbo Debugger. The debugger only accepts .TDS files for symbol information whereas I only have a .MAP file for this app previously created with IDA. Does somebody know how to convert this .MAP file to a .TDS file?

Thanx
ZaiRoN
09-12-2004, 11:00 AM
Hi,
tdmap.exe inside your turbo debugger directory is what you are looking for.

Regards,
ZaiRoN
zombie8
09-14-2004, 02:22 AM
Thanx Zairon. Actually TDMAP.EXE is only part of the stand-alone Turbo Debugger (I was using the one from TASM so I couldn't find TDMAP.EXE).
ZaiRoN
09-14-2004, 08:59 AM
Hm, I thought you were using Turbo Debugger. Don't know if its available online. If you have problem, pm me.

Zai


Olly Prob
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Olly Prob
PDA

View Full Version : Olly Prob

venom925
09-12-2004, 12:25 PM
recently i reformated my HD and made it from a fat32 to a ntfs for win xp pro. before on fat32 olly worked fine but now on the ntfs format i cant get any program to debug or at the very least hit a break point. :confused: when i load the app in and hit f9 its as if the app frezzes, so it never fully opens. has anybody else had this prob? if so how was it fixed
ZaiRoN
09-12-2004, 12:34 PM
Hi,
I changed my hdd from fat32 to ntfs without problems. Maybe your problem is not totally related with that.

Zai
dELTA
09-12-2004, 03:47 PM
Yeah, I agree, it sounds quite unlikely that the problem would be related to that.
venom925
09-12-2004, 07:04 PM
any idea what could cause it then
naides
09-12-2004, 09:23 PM
any idea what could cause it then

Try downloading a fresh copy of it. It may have gotten corrupted
:cry: :cry:

On that same area of discussion, but may have nothing to do with Olly:
When you move from FAT32 to NTFS a new can of worms is opened:
Files and Folders have permissions in NTFS. So dlls, and resources that were widely accessible before, may become restricted to a user or an administrator in NT environment.

I have had a few problems with some apps because of that. Reinstall usually takes care of the problem.
venom925
09-13-2004, 04:12 PM
thanks ill try that


MD5 hash calculator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MD5 hash calculator
PDA

View Full Version : MD5 hash calculator

ChemicalX
09-12-2004, 04:56 PM
Im just starting Crypto Keygenning in Visual C++ and am having a hard time trying to make a simple program to calculate a MD5 hash from a name.

Ive seen many programs from Crypto Keygen websites that do this but they all dont include sources.

If possible can anyone direct me to a sample application with source or show me how its done.

Thanks :yay:
cr.ap
09-12-2004, 07:43 PM
http://www.faqs.org/rfcs/rfc1321.html

or use any of the crypto libraries which come with source Crypto++, libtomcrypt etc.
evlncrn8
09-12-2004, 07:44 PM
search button
google too, read the fking faq

http://www.google.com/search?q=md5.asm&sourceid=firefox&start=0&start=0&ie=utf-8&oe=utf-8

how hard was that?
bilbo
09-13-2004, 01:48 AM
md5.asm
well, since he asked for MS C++ project, he could have googled for
md5.cpp
1320 results...

If he doesn't like googling, he can try this
ftp://ftp.zedz.net/pub/crypto/hashes/mds/md5/

Regards, bilbo
neviens
09-13-2004, 08:07 AM
I did it in the following way:

;--------------------------------------------------
;MD5 hash stuff from advapi32
;--------------------------------------------------
invoke CryptAcquireContext, ADDR phProv, 0, 0, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT ;setup..
test eax, eax
jz _err

invoke CryptCreateHash, phProv, CALG_MD5, 0, 0, ADDR phHash ;..to MD5
test eax, eax
jz _err

invoke CryptHashData, phHash, ADDR buf1, buf1Len, 0 ;do MD5, it's possible to add more data..
test eax, eax ;..with following CryptHashData APIs
jz _err

mov buf1Len, 10h
invoke CryptGetHashParam, phHash, HP_HASHVAL, ADDR buf1, ADDR buf1Len, 0 ;get result
test eax, eax
jz _err

invoke CryptDestroyHash, phHash ;destroy..
test eax, eax
jz _err

invoke CryptReleaseContext, phProv, 0 ;..and release
test eax, eax
jz _err

Not a c++ though.
Neviens.
ChemicalX
09-13-2004, 02:56 PM
FYI ive searched google and found the md5.h/md5.cpp before. Its after that my problem comes.

I do the following code:
MD5_Init(&MD5);
MD5_Update(&MD5, (unsigned char*)Name, strlen(Name));
MD5_Final((unsigned char*)MD5_bytes, &MD5);

That i presume leaves the MD5 hash at MD5_Bytes.
The problem comes when i try to print that.

I found this code in one crypto keygen

for(int i=0; i<16; i++)
{
sprintf(Temp, "%.2X", MD5_bytes[i]&0xFF);
strcat(Buffer, Temp);
}

Then I put
SetDlgItemText(hWnd, IDC_SERIAL, Buffer);

But the text in IDC_SERIAL is not the MD5 hash
Silver
09-13-2004, 03:00 PM
Oh, go on then, because I feel for a fellow C/C++ coder. Leave those asm lunatics to their padded cells ;)

#include <Wincrypt.h>

HCRYPTPROV hCrypt = NULL;
if(!CryptAcquireContext(&hCrypt, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT))
{
//failed
}

HCRYPTHASH hHash;
if(!CryptCreateHash(hCrypt, CALG_MD5, 0, 0, hHash))
{
//failed
}

char* szHashMe = "Hash this string";
if(!CryptHashData(hHash, szHashMe, strlen(szHashMe), 0))
{
//failed
}

char* szHashResult = new char[255];
if(!CryptGetHashParam(hHash, HP_HASHVAL, szHashResult, 255, 0))
{
//failed
}

CryptDestroyHash(hHash);
CryptReleaseContext(hCrypt, 0);

Erm, bear in mind I did this in about 5 mins translating neviens code...
bilbo
09-14-2004, 01:46 AM
Oops, Silver, don't be too sure, you made two errors...

(1) last argument of CryptCreateHash() must be &hHash, not hHash
(2) CryptGetHashParam must not be passed 255, but the address of a long containing 255

ChemicalX, your Buffer doesn't contains ASCII characters, so you need to convert it to a printable form, before passing it to SetDlgItemText().

Please ignore the text above: that's an error of mine...neviens guess is a good one!

Regards, bilbo
neviens
09-14-2004, 08:12 AM
As far as I understand, this code:

for(int i=0; i<16; i++)
{
sprintf(Temp, "%.2X", MD5_bytes[i]&0xFF);
strcat(Buffer, Temp);
}

converts the hex MD5 value to printable ASCII form.
Have you cleared a Buffer before 1st strcat?
Neviens.
Silver
09-14-2004, 11:44 AM
Damn bugs. They're everywhere, and usually in my code.
ChemicalX
09-14-2004, 02:42 PM
here is an example of what im tring to achieve
http://cryptokg.cjb.net/ And in the tools section download the Md5 Checker.

Now ive also downloaded C-Ripper's solution for TMG trial #4. In the keygen, C-Ripper makes a md5 hash and does some other stuff with miracl.h. So i took out all the extra parts with the miracl and made the program display just the md5 hash without any calculations (except for the converting to ascii). But when i compare it with a real hash it is not the same

I don't know if its the way to display, or maybe if the md5.h is modified
Take a look for yourself
ChemicalX
09-14-2004, 03:54 PM
Sorry all this time its been my fault, i have been using the wrong include. I should have used the md5c.c from RSA but instead ive been using md5.c from some random website.
Now my program is working fine.

Thanks for your help


Icedump substitute ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Icedump substitute ?
PDA

View Full Version : Icedump substitute ?

geneticfreak
09-13-2004, 12:24 AM
I used to reverse engineer software a lot a couple of years back and used Icedump to unpack packed programs to dump them with softice. Now I am trying to get back to reverse engineering stuff, but find that the last updated version of icedump does not work with new Softice driver studio 3. :(

Is there any substitute I can use ? Any other dumping programs that can be used to dump memory from inside softice ?
cr.ap
09-13-2004, 08:38 AM
IceExt
mYeXcKsN
09-14-2004, 06:16 AM
iceext 0.65 or 0.62 works fine. There are problems in 0.61 0.64


Visual Basic 5.0/6.0 File reading
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Visual Basic 5.0/6.0 File reading
PDA

View Full Version : Visual Basic 5.0/6.0 File reading

peterg70
09-13-2004, 07:27 AM
Any thoughts or Comments appreciated

I have a visual basic program 5.0/6.0 that reads a data file in. I assume based on previous experience with the programmers style that the file done in records
i.e. open file as read len = 100 bytes

What I would like to know is what software is out there that can tell me how visual basic is reading the file in (len of records) and what integers/longs/currency etc are in each record. i.e the Type format

peterg70
SL0rd
09-13-2004, 11:47 AM
Hi,
begin with filemon, if you didnt already, after use your brain and all the knowledge aquired with the tutorials that certainly you already studied.
I can say that reversing the app, analising its dead list, using a runtime debuger ..., is much more satisfacting that just running an app that prints all the information in a window full of icons, buttons and little flowers if you like!

Reverse it!
neviens
09-13-2004, 02:41 PM
Smartcheck from Numega maybe?
Neviens.
br00t_4_c
09-13-2004, 05:40 PM
Filemon, Regmon and particularly Smartcheck make VB reversing (especially for more "involved" protection schemes) much easier. Reading a VB dead listing will make you old before your time and IMHO would be a bloody waste of time. I don't think people should be discouraged from using tools that might actually increase their efficiency and supplement the information obtained from runtime debugging sessions (@ SL0rd). Reversers who have a basic understanding of how VB executables are structured have little to gain from a pedantic line by line examination of the muddled spaghetti-scratch-code misery that is disassembled VB. But that's just my opinion...
peterg70
09-14-2004, 12:01 AM
Filemon shows the length of access but doesn't indicate type i.e. reads in 260 length but what is that 260 made up of? Int,str,long etc.

Smartcheck (6.03) seems to go to more detail (Still playing with this).
Anyone know how to expand the following in smartcheck
Right$(String"D:\Progr....",long:1)
where the ... is what smartcheck does I want to see the whole line.

Regmon doesn't help in this case.

I have already done the Ollydbg route and found it a total nightmare especially as the main exe has timers shooting off etc. and visual basic as well.

peterg70
Aimless
09-14-2004, 01:27 AM
Two options:

I) The data file is a data file (that is, not plain text)
======================================

1. VB almost always calls through ODBC/ADO. You will need an ODBC spy for that

2. The data file can be, in most cases, compatible with some of the MS ACCESS/ MS EXCEL formats. Try importing them to that format to see what lies beneath.

3. Use TOAD (freeware/pro) to determine the table/relationships/routines, etc.

II) The data file is actually just multiple lines of records each.
=============================================

1. Copy the data file to another file (as backup)

2. From the original, remove all records, except the first line. Essentially, keep the first line and delete all others.

3. Start up any debugger and breakpoint on routines in the msvbvm60.dll and msvbvm50.dll that read text files (read up the docs on M$ site for alist of them). Alternatively, you can also find good breakpoints to place by running boundschecker/smartcheck etc OR, you may try reading the essay (in 2 parts) by Eternal Bliss, titled, (Compare Methods and Breakpoints0 - you'll get it easily if you google. The idea is, when a block of text is read, the debugger/smartcheck/boundschecker will tell you what PART of it is also being read. You can then figure out the length of each field in the record and the type.

4. The dirty way: Simply wait for the data file to be loaded in memory. BPM on read and you can check the data fields. Not working most of the time with XP combo because you have to be in the correct context, and you are not sure who's loading the data file.

Unfortunately, good programmers read the _entire_ line, and subsequently manipulate it so that the record fields are read. So do no depend entirely on the read aspect.

Have Phun
peterg70
09-14-2004, 02:56 AM
Thanks for the info

Actually I think its done by the Open File Command in Visual basic.
the file is opened for access Random

Is there any spys for the open Command in visual basic.?

the file is not a database or text file rather just data (mix of int,long,str) done as bytes.
peterg70
SL0rd
09-14-2004, 12:51 PM
I don't think people should be discouraged from using tools that might actually increase their efficiency and supplement the information obtained from runtime debugging sessions (@ SL0rd). Reversers who have a basic understanding of how VB executables are structured have little to gain from a pedantic line by line examination of the muddled spaghetti-scratch-code misery that is disassembled VB. But that's just my opinion...

Sure, dasm VB is a disgrace! What I really want to say is that, its far more satisfacting (at least for me) discover such thing (like a record format ) with just the help of a runtime debugger or maybe a dead listing rather than using a final app that give all with just one click!

thanks for your post br00t_4_c :)


When MessageBoxA is far away
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > When MessageBoxA is far away
PDA

View Full Version : When MessageBoxA is far away

Medic
09-13-2004, 03:24 PM
Hi,

Would like some guidance on what to do when SICE doesn't take you near the routine you're trying to find.

The prog uses two files, License.txt and Licensekey.txt

First time in the prog checks for License.txt and if missing prompts for name + serial

BPX on messageboxa bring up sice, couple of F11 take me back to the code.
Problem is that the code does loads of writing to license.txt inbetween sending the messagebox and checking the serial so the serial checking routine is nowhere to be seen...

Tryed with Olly and found likely locations for the stored serial (i.e. my dummy) and found routines for checking valid chars of the serial etc but no compares with a valid serial....

Have tried the backdoor and found the compare that writes the Licensekey.txt file but then the prog crashes because the file string isn't valid...

Any hints on how to proceed with this type of protection.

Thanks,

medic
br00t_4_c
09-13-2004, 05:25 PM
You may want too trace into some of the routines that occur between the first time that a file access API call is made to the time the message box with the "bad boy" message is displayed. Making the assumption that you will always be able to fish the full and correct serial out of memory in clear text will cause you nothing but heartache my friend. Very often the correct serial is taken and then hashed into an unrecognizable form and then the information you entered is hashed in a similar manner and then the two hashes are compared to see if they correspond. This way the protection prevents the possibility of "sniffing" out a correct serial in no time flat by isolating the point where a clear-text comparison of the actual and user-supplied serial is made. Look deeper. You've identified this as a keyfile protection of some kind. Take a look at the code where the keyfile is being READ. Examining the keyfile when it is being written may be too late in the game already. Maybe you should consider breaking on a file access API instead of breaking on MessageBoxA and backtracing. Feed it a phony keyfile filled with a readily recognizable character sequence see what is being done to them by the protection. There will likely be length checks, RORs, XORs, SHLs, etc... that result in the keyfile contents being transformed into some kind of "checksum" (not always, but this is the general pattern for relatively simple keyfile protections -though that might be too much of a generalization...meh) Examining the executable under controlled conditions will give you a better idea of what's going down.

Good luck.
Medic
09-14-2004, 12:19 PM
Thanks br00t_4_c,

You are right, serial sniffing has cost me days of headaches in the code woods. I had a look at the tut for key files in the mini project area and got some more tricks from there.

I've had a play with breaking on FileRead API calls and it turns out that the prog reads the License.text twice, then reads the LicenseKey.text twice. I think this is for reading lines one and two from each file. Filemon confirms this.

Anyway after reading the LicenseKey.text it loads the contents into mem and then goes off doing other things... no obvious encryption going on..

So my question. Would you spend more time tracing to find what happens to the serial you enter (a valid one create the LicenseKey.text) or would you reverse the LicenseKey.text using API read calls?

Just wanted to know if there was a general order of how to go about this?

Many thanks, am learning fast because of the help and tuts on the forum.

Medic.
br00t_4_c
09-14-2004, 02:57 PM
Hey Medic,

First of all I would caution that there's no generalized formula, it may indeed be equally productive to go either way. Although I will say that it may be more productive to take a look at what is being done with the contents of the key files (rather than what you have entered) because if the contents are taken, manipulated and then compared to something later on at least you will be able to recognize them if they are in some altered form. From what you have said, I gather the contents of the file are read into a buffer and then basically ignored for a period of time. Well, you might want to set a breakpoint on access of the memory where the file contents are stored. Sometimes protections can be "spread" throughout the application to make it harder for reversers to isolate the "meat" of the protection (security through obscurity essentially, a patient person will eventually piece everything back together in its' correct sequence :D ). Finding out when the stuff taken from the file is "touched" again will probably give you an idea of when you have gotten back into code related to the protection... vague, but I hope it helps :)


Full Delphi 6 and Delphi 7 Signature For IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Full Delphi 6 and Delphi 7 Signature For IDA
PDA

View Full Version : Full Delphi 6 and Delphi 7 Signature For IDA

TQN
09-14-2004, 04:10 AM
Hi all !
I am very glad to say with you: Wow, at the end, I have finished creating the full IDA signatures for Delphi 6 and Delphi 7 (RTL/VCL/BDE/CLX...). I want to share them with all members of our community: Woodmann forum and ExeTools forum.
It take me two weeks to write two IDA plugins, a renew, fast IDB2Sig plugin and a new, very fast LoadMap plugin.
The IDB2SIG plugin I rewrote base on the orginal source code and idea of:
- Quine (quine@blacksun.res.cmu.edu)
- Darko
- IDB2PAT of J.C. Roberts <mercury@abac.com>
Thanks all of you very much. I think all of you will allow me to public the new source code.
The LoadMap plugin I wrote base on the idea of Toshiyuki Tega. It will supports loading and parsing VC++, Borland (Delphi/BC++/CBuilder) and DeDe map files.
And with two plugins, I need only two days to create two signature file for Delphi 6/7. Very fast and convenience. Hereafter, we can use two above plugins to create signature files, load map symbols...
The total size of .PAT files of Delphi 6 is 14.9 MB, of Delphi 7 is 17.2 MB. If you need them (and .bat file, .exc file), you can send a PM to me.
I attached here with two .sig files, two plugins and their source code.
I only wish I will receive many thanks for my hard work.
Hope for your interest !
Best regards,
TQN
TQN
09-14-2004, 04:12 AM
The Delphi 6 signature file
TQN
09-14-2004, 04:15 AM
The Delphi 7 Signature file
TQN
09-14-2004, 04:19 AM
Two plugins and source code
Aimless
09-14-2004, 05:41 AM
Aw Crap!

I thought someone was posting links to full version of Delphi 6 and Delphi 7 (looks that way if you read the forum room consolidations at the first page).

Bluurbb!

Have Phun
dELTA
09-14-2004, 05:50 AM
Really nice work TQN, thanks! :cool: Maybe you should submit the plugin to Datarescue too? They might publish it for you, but just make sure they don't sue you if you don't have a valid IDA license, they can be like that sometimes. :)
mYeXcKsN
09-14-2004, 06:12 AM
nice work! thanks a lot.
Ari Benta
09-14-2004, 07:36 AM
nice job dude, i also appreciate the plugins!
monguz
09-14-2004, 08:19 AM
very good work TQN !! thanks a lot.
btw. 'The Ida Palace' http://www.sport-und-event.de/backtrace.de is a good plugin /signature collector, just for the case of datarescue don't is your favorite option...
regards monguz
Darren
09-14-2004, 04:44 PM
Nice work! TQN
Solomon
09-14-2004, 09:01 PM
great work
TQN
09-15-2004, 11:29 PM
Thanks all of you !
Thank dELTA and monguz for suggestion. But I afraid Ifak will do not receive my small contribution. I have a story which I would like to retell.
When I public my D6RTL and D7RTL, I received a PM on this forum, sent by sporaw. He say he want to contact me. And he just asked Ilfak Guilfanov to add my signatures to installation package of IDA. Ilfak asked sporaw to contact me and request me permission for this. Then I send a mail to Ilfak, said I willing and glad to public my signature files and share them with IDA users, and consider them as a my small contribution to IDA. Ilfak reply immediately, and ask: Are you a our customer. If you are, send the key file to him. If not, he can not accept my contribution. Then I reply: Sorry, but I am a Vietnamese, and IDA is too expensive in comparison with averagely incomming of all Vietnameses. And if I rich, I can not buy it directly. I was using a free IDA version 4.31, public on Simtel. Ilfak was not reply anymore, and it is the end.
What do you think about this. I think Ilfak was very strong stick with his principle. He think IDA do not need any contributions from geniality mans whose do not have condition to become a right, legal user of IDA.
Sorry for my bad English !
TQN
daxia2002
09-16-2004, 12:51 AM
good.
naides
09-16-2004, 05:58 AM
:devil: yes
dELTA
09-16-2004, 10:11 AM
TQN, yeah, I think Ilfak and Pierre are way too anal about the whole thing for their own good... :boo: Oh well, their loss.
123112
09-17-2004, 11:18 AM
3ks!
JMI
09-17-2004, 11:28 AM
One would wonder how Ilfak could complain that you are using a "free" copy he distributes of his software. :boo: Anyway TQN, we appreciate your efforts.

Regards,
SHaG
09-20-2004, 03:53 PM
Thanks TQN, this one's really useful!
TQN
09-20-2004, 10:53 PM
Thanks JMI and SHaG !
SHaG, your OllyScript is always great and number 1 !
Good luck to you. Hope you will have more free times to continue developping OllyScript.
Did you finish your project at work ?
----------------------
To others which already have IDA Pro 4.6, I have compiled two plugins LoadMap and IDB2SIG
with SDK 4.6, and attach binary files (.plw) here.
Regards,
TQN
Silver
09-21-2004, 07:51 AM
Exactly what I was after, thanks for your work (and your post in my thread). Can I suggest you put a more noob-friendly description of your tool in the thread? I'd never have guessed your plugin could do what I needed, as I'm not a Delphi coder.
TQN
09-28-2004, 03:14 AM
Yesterday, I downloaded the new service pack of MASM32, and manual installing it. After rebuilt the MASM32 lib, suddently I think: Why we not create a MASM32 signature for IDA. Many crackers/coders here and on ExeTools forum uses MASM32 to write keygen, crackme, unpackme... So I create the MASM32 signature immediately, with MASM32.lib and FPU.lib. After 10 minutes, I have finished, and collisions are zero. The size of MASM32.sig is small, about 6K. And I have aplied it with dUP 1.08, found dUP used about 8 functions in MASM32.lib.
Hope you will enjoy with this small signature.
Best regards,
TQN
JMI
09-28-2004, 03:36 AM
Another great effort. Thanks again TQN. :yay:

Regards,
dELTA
09-28-2004, 07:28 AM
Hehe, cool TQN, keep 'em coming. :yay:
aka
10-01-2004, 12:16 PM
Thank you very much.

aka
verilog_crack
10-04-2004, 07:14 AM
It's great but is there any tools that can convert delphi exe file to the form format so that we can change the code and recompile it.
regards
JMI
10-04-2004, 12:31 PM
Why not just write the author of the code you want to, err "borrow" and ask them if they won't give their work to you for "free"? That way you won't have to do any hard work of "clicking" on someone's "converter" program. :devil:

Regards,
disavowed
10-04-2004, 10:02 PM
It's great but is there any tools that can convert delphi exe file to the form format so that we can change the code and recompile it.
regards
you don't need the "form format" to change the code ;)
that's the whole point of this website


Explorer add-in patching...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Explorer add-in patching...
PDA

View Full Version : Explorer add-in patching...

Towelie
09-14-2004, 09:31 AM
hi, i have a target which is an add-in to explorer, it has several dlls wrote in VB6, and one that is packed with armadillo, the soft has no executable, and i have no idea where to start.

any suggestion?
Silver
09-14-2004, 11:42 AM
If one has been secuerd with armadillo, the odds are in favour (although not necessarily guaranteed) that it contains the registration system. Review the others quickly first though.

Ask yourself some basic questions about the app. What kind of extension to explorer is it (start here: http://msdn.microsoft.com/msdnmag/issues/04/01/WindowsShell/default.aspx). How do you register it if you have a valid key etc. Attacking a dll is no different to attacking an exe - the only alteration being that code in a dll is "executed indirectly"...
Towelie
09-14-2004, 01:09 PM
is where to start, usually i'm using IDA, but with this target i have no idea on how to start, i haven't found a tool to unpack armadillo protected dlls, and even if i unpacked it, i should be runing explorer inside IDA and then set some BP when it goes on the dll, but disassembeling explorer in IDA? i don't think its possible (or is it?).

i'm looking for directions on where to start
Japheth
09-14-2004, 02:45 PM
Hi,

first you should have some knowledge about how explorer communicates with its "shell extensions". this is done throu COM interfaces, which technically are vtable calls.
Then it would be good to know something about some of the shell interfaces, IShellView and IShellBrowser.

It surely is possible to disassemble explorer, but an alternative would be:

download my explorer clone, which is written in ASM and fully displays the shell's namespace. So it should as well load and execute the dlls in question. Source code is included, so no need for disassembling: http://www.japheth.de/download/explASM.zip

no guarantees of course
Towelie
09-14-2004, 03:27 PM
haven't used the add-in i was talking about, i set it to show the add-in (View->Choose details - > the add-in) and it crashed.

if you want i'll PM the target name......
bilbo
09-15-2004, 01:36 AM
Japheth, congrats for your site, really valuable and impressive stuff inside...

usually i'm using IDA, but with this target i have no idea on how to start, i haven't found a tool to unpack armadillo protected dlls, and even if i unpacked it, i should be runing explorer inside IDA and then set some BP when it goes on the dll, but disassembeling explorer in IDA? i don't think its possible (or is it?).

i'm looking for directions on where to start

Well, if you want to single-step inside a DLL you can simply replace the first byte at entrypoint with CC (INT 3), on the file xxx.DLL, then run the calling application (Explorer) through your preferred debugger. It must stop at DLL entrypoint. Now you can restore back the original byte and reexecute it...

Regards, bilbo


PV Dasm1.5d
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PV Dasm1.5d
PDA

View Full Version : PV Dasm1.5d

ILCH
09-14-2004, 01:15 PM
Hello Guys...PV Dasm has newer Version OUT...
I Like this wonderfull Disassembler....

Give him a Try...;)

http://pvdasm.anticrack.de/


can't find hex code in exe file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > can't find hex code in exe file
PDA

View Full Version : can't find hex code in exe file

nilom
09-14-2004, 03:34 PM
Hi all, I have allways done everything on my own.
About 8 years ago, when it was very difficult to find infomations about cr***ng, I "opened" several software thanks to LordCaligo's, Mammon's, etc. tutorials.
I found the jumps with sice and then with hexedit, patched the programs.
Yesterday i needed to "open" a new software. I found the jump to change, but when I went in hexedit, I didnì't find the hex code.
Something changed? I looked around on the web and found nothing about (or maybe it's said in a different way).
This is my first post. I an not really skilled about cr***ng, but i always find the way. Please pardon my english and HEEEELP!!!!

I forgot the most important thing:

PLEASE

nilom
JMI
09-14-2004, 03:58 PM
nilom:

The "Edit" Button works effectively to correct or add to your post. You really do not need to make a new post to add something you forgot. :yay:

Regards,
Neitsa
09-14-2004, 04:27 PM
Hello nilom,

Well, it's difficult to answer without seeing the code, but time goes and things seems to works near the same...

If you can see the code in Sice it must be somewhere on the exe...but (there's always a "but") it could be located somewhere in memory and maybe not in exactly the same way in the file.

I suppose that you know how to do VA/offset conversion, and you haven't find your code in the PE file.

Maybe the code is loaded dynamically in a memory page (for example with VirtualAlloc) and executed in this page, so you won't be able to find it on your file.

Maybe the code you're searching for is crypted in your PE, with a packer, or it's a SMC (Self Modified code). In that way you won't find it in your file on your hard disk.

Code in memory is mapped or represented sometimes differently than it is in a PE file. Maybe you'll have to trace the program to see what's going on there...

Maybe you can try to replace the instructions by different opcodes that won't be present in the file (like CC [int3], 90 [NOP] or D9D0 [FNOP] opcodes) since they are very few present. Save your modifications and do an hex search to find them, maybe you'll succeed.

Hope it could help.

Regards, Neitsa.
nilom
09-15-2004, 04:08 AM
I suppose that you know how to do VA/offset conversion, and you haven't find your code in the PE file.

No, I didn't know anything about that. I was almost sure that that was the problem.
Now I know for sure what should I look for. :)

Thank you very much

P.S. Even if I took a look at this world time ago, I am still a TOTAL NEWBIE.
Neitsa
09-15-2004, 09:40 AM
Hello,

Nilom, A will try to explain a liitle bit what I was meaning by VA to Offset conversion:

When you launch a program, the "Windows loader" map (in fact load in memory) your program. The static code from the PE file (Portable executable) became a process, which is having is own adress space in memory.

-offset: this is the location of an item within the file itself before beeing processed by the loader. This is, if you want, the position in the file on your hard disk. Just open your file in an hex heditor, an go to the 1000th bytes : you are at offset 1000h ! that's all...

-VA: (Virtual Address)When a program is loaded by the Win loader (it is "mapped"), the VA is an address in the process address space.
Let say you're debugging a file, and the current adress is 401000h, so the current VA is 401000h.

-RVA: RVA (Relative Virtual Address) is nearly the same thing as a VA, except you must subtract the ImageBase of the file.
Let say the current VA is 401000h and the ImageBase is 400000h:
401000h - 400000h = 1000h => the current RVA is 1000h

What is the ImageBase ?

- The ImageBase is the prefered load adresse for a PE File (a PE file can be an EXE, a DLL, a driver, etc. Everythning that can run Code. A pe File is just a structure for executable file).

Where I can find it ?

You can find the ImageBase in the PE header.
Opn your PE file in an Hex editor an search for the PE signature wich is "PE",0,0.
Go at offset 0x3C => You'll find there an offset to the PE signature (on a DWORD) ex: offset 3C: C0000000 . Since intel is using the little endian format you must reverse this number = 000000C0

PE Signature is at 0xC0 => let's go there
0xC0 = 5045000 (in ASCII PE,0,0) : this is the PE signature which is telling us this is trully a PE file

The ImageBase is at PE signature + 0x34 => 0xC0 + 0x34 = 0xF4
0xF4 = 00004000 (little endian) => 0x400000
We have our ImageBase wich is 0x400000

How to do VA/offset conversion ?

It depends where you are exactly (what is the section), most of the time you'll be in the code section of the PE file.

Let's take an example: you want to retrieve on your file disk, the location of the Virtual address 401014. IT means you'll have to do a VA/offset conversion

Firt of all go to the sections loacation in the PE hader: the first section table (charcateristics) is most of the time the code section (.text) an this table is located at PE signature + 0xF8

0xC0 + 0xF8 = 0x1B8

here's an example:

1B8 ASCII ".text" ; SECTION
1C0 DD 00000046 ; VirtualSize = 46 (70.)
1C4 DD 00001000 ; VirtualAddress = 1000
1C8 DD 00000200 ; SizeOfRawData = 200 (512.)
1CC DD 00000400 ; PointerToRawData = 400
1D0 DD 00000000 ; PointerToRelocations = 0
1D4 DD 00000000 ; PointerToLineNumbers = 0
1D8 DW 0000 ; NumberOfRelocations = 0
1DA DW 0000 ; NumberOfLineNumbers = 0
1DC DD 60000020 ; Characteristics = CODE|EXECUTE|READ

The Virtual Address field is in fact an RVA (so the VA is 400000 + 1000 = 401000) this is the base of the code section. The Pointer to rawData is telling us where i is in the file on hard disk, so 0x401000 in memory is at offset 0x400 in the file.
We want to retrieve 0x401014 in your hard disk, so :
-substract ImageBase
-Subtratct Virual Address
-Add Pointer to RawData

0x401014 - 0x400000 = 0x1014
0x1014 - 0x1000 = 0x14
0x400 + 0x14 = 414

So the VA 0x401014 is at offset 414 in the PE file...

Sorry for this long post, but I hope it could help someone. Try to find a PE viewer rather than a simple hex editor, you'll see the PE header fields more clearly (Little endian is not always easy to read).

Reagrds, Neitsa.
nilom
09-15-2004, 01:52 PM
This is not only help this is a tutorial!
I didn't understand that much, but I'll study it.
Be super sure that I will make treasure of this tute.

Thanks alot

Nilom
sigint33
09-19-2004, 09:49 PM
If you are using IDA, both the offset and actual address are shown at the bottom.

SiGiNT
stephenteh
09-21-2004, 01:11 PM
try using Ollydbg.... u can directly change the jump or anything in the program itself and then save the changes...
nilom
09-21-2004, 01:51 PM
it's a vb software. In Ollydbg won't go. Always "Access violation when reading..." "Use Shift f7/f8/f9 to pass exception to program".

Thank you anyway.
SL0rd
09-21-2004, 03:00 PM
Hi friends, what about writing a loader!!?
If you know the address in memory to patch, you can just write a loader and patch it on the fly! right!!??


BPINT 3 Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > BPINT 3 Problem
PDA

View Full Version : BPINT 3 Problem

fifthelement
09-15-2004, 06:20 AM
hi all
I am reversing an application, when I try to load it through symbol loader, it doesnt break on Enter ! why some applications break and some not ? I have tried another application and it breaks !
so I tried to use INT 3 solution, but when I enable BPINT 3 in softice and return to windows, it breaks continuesly some where in ntoskrnl code ! and I can not get to my application. any suggestion ?
I am using driverstudio 4.3.1 on WinXP sp1.
naides
09-15-2004, 11:54 AM
http://66.98.132.48/forum/showthread.php?t=6276

Spekkel post


USB Fake port
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > USB Fake port
PDA

View Full Version : USB Fake port

Cata
09-16-2004, 05:25 AM
Hi everyone,

Looking for software or/and documentation to create a fake USB port.

Any help is welcome.

Thanks.
TBone
09-16-2004, 11:08 AM
It might help if you clarified what you mean by a "fake USB port". Are you trying to emulate some kind of dongle?

At any rate, the only thing that immediately jumped out at me from google was a program called AlarIT, or sometimes ITM. It's described as a virtual USB driver, but it basically sounds like a network redirector for USB. It's supposed to let you create a virtual USB port on your computer that acts like a local USB port, but it's really a proxy to a local port on another computer on your network.

If you're wanting to write something customized for some other purpose, the official specifications for USB aren't hard to find.


A strip of code in the an UnpackFile
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > A strip of code in the an UnpackFile
PDA

View Full Version : A strip of code in the an UnpackFile

Limee AKA Lamer
09-16-2004, 02:04 PM
I have unpacked a file by unpacking tool.
But The unpacking file run error.
As if the file has CRC check.
The file unpacking file name is st.exe in c:\exepath.
here is the code:

00425ED8 PUSH 0
00425EDA PUSH 80
00425EDF PUSH 3
00425EE1 PUSH 0
00425EE3 PUSH 1
00425EE5 PUSH 80000000
00425EEA MOV EAX,DWORD PTR SS:[EBP-8]
00425EED CALL setup.00403858
00425EF2 PUSH EAX ; The point of c:\exepath\st.exe
00425EF3 CALL setup.0040505C ; Thunk to CreateFileA

CreateFileA function
the last parameter is point of c:\exepath\st.exe
Which mean in this code,why Create a file itself?
evlncrn8
09-16-2004, 07:13 PM
it opens the file its running from, so it will read the file in and crc it perhaps? and i believe the param in the createfilea there is open_existing, with generic read access so yup looks like a crc, reroute it to c:\exepath\st.bak so it reads the virgin exe, that might pass the crc check
guhuic
09-16-2004, 09:05 PM
Send out your document to me
czh263100@163.com


How to remove the NAG Window
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to remove the NAG Window
PDA

View Full Version : How to remove the NAG Window

Limee AKA Lamer
09-16-2004, 04:39 PM
Here is the picture
Which API Break point Shall I set?
guhuic
09-16-2004, 06:25 PM
setup program?
evlncrn8
09-16-2004, 07:11 PM
ooops u just identified the target there..
Woodmann
09-16-2004, 07:23 PM
Errrrrrrrrrrrrrr..................

Hang on, I need to check the records to see if this is your final violation.

Woodmann
Woodmann
09-16-2004, 07:34 PM
Your post on 09-03-2004 11:51 AM was removed.

Moderators response:

Nice try, if you make one more crack request or upload commercial software again you'll be banned.

I think you need a new "sig".

You have been around here long enough to know the rules.
You have also been PM'ed to make you aware that you violate the rules constantly.

Now I shall make it known to everyone that you have made your choice and do not care about this place or any of the users.

-cbo-
JMI
09-16-2004, 07:56 PM
I don't know why you were so gentle with him. :devil:

Regards,
Woodmann
09-16-2004, 08:31 PM
I can change that :eek:
Silver
09-17-2004, 10:12 AM
That's one of the more bizarre crack requests I've seen anywhere...
JMI
09-17-2004, 11:24 AM
Limee AKA Lamer certainly is in a class by himself. Woodmann has even given him a new avatar. :devil:

Regards,


Shrinker 3.4
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Shrinker 3.4
PDA

View Full Version : Shrinker 3.4

zombie8
09-17-2004, 03:28 AM
Hi

I know Shrinker has been discussed at lengths here but I still can't resolve an issue concerning it... I was trying to patch a packed program. The approach was as usual: Inject patching code in some empty place and make the unpacker jump to this patching code after unpacking the original program but before calling it. Injecting code was easy. This code patches a byte in the unpacked original program. However, when I changed the unpacking code to jump to the patcher and ran the program again, an error message showed up:

Window Title: Shrinker.err
Message Text: ... (3.4) ... Dispatcher initialisation error trapping exceptions

I traced the inserted jump to the patcher, and the problem is the first instruction of the patcher, the one that changes a byte in the unpacked original program. From there the execution line passes to some NTDLL routine. So I thought that the section that holds the unpacked original program might be protected and gave it "writable" flag in the pe header of the executable but nothing changed. Anyway, it can't be protected right from the beginnig 'cause the unpacker writes to it... Where is the problem? I am quite frustrated, i was just following a tutorial and this error was not meant to happen.

Thanx

zombie
zombie8
09-18-2004, 11:45 AM
Well...

Actually the patched program performs well under Win98. The above happens under Win2k. I have figured out that the memory page where the pather is meant to change a byte, is write-protected. So a call to VirtualProtect with 0x40 as desired protection and issued before patching that page resolved the issue :)

However I still don't know why the patched program works under Win95 without first unprotecting the page to be patched. And I'd like to know where the page attributes are stored, i. e. how to change the protection state of a page without an API call. Any hints?

Greetz

zombie


A FILE HANDLE question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A FILE HANDLE question
PDA

View Full Version : A FILE HANDLE question

Limee AKA Lamer
09-17-2004, 12:04 PM
I found a question,The FILE HANDLE IS ZERO.
I can't understand.

00425304 push 00000000 ; HANDLE IS ZERO
00425306 lea eax, dword ptr [ebp-04]
00425309 push eax
0042530A push 0000001E
0042530C push 0042BB84
00425311 mov eax, dword ptr [0042BB7C]
00425316 push eax
00425317 Call kernel32.ReadFile
0042531C mov eax, dword ptr [0042BB84]
00425321 cmp eax, 04034B50
00425326 je 00425333 --->
00425328 cmp eax, 50000000
0042532D je 00425333 --->
0042532F xor ebx, ebx ;
00425331 jmp 00425335 --->
Neitsa
09-17-2004, 12:27 PM
Hi,

according to MSDN:

BOOL ReadFile(
HANDLE hFile,
LPVOID lpBuffer,
DWORD nNumberOfBytesToRead,
LPDWORD lpNumberOfBytesRead,
LPOVERLAPPED lpOverlapped
);

Parameters are pushed from right to left (or from bottom to top here), then the API is called. So the first parameter in your code isn't the file handle but the pointer to an overlapped struct. As it is NULL, there's no pointer to that struct.

00425304 push 00000000 ;lpOverlapped
//cut
00425311 mov eax, dword ptr [0042BB7C]
00425316 push eax ; EAX==File handle

Check on the MSDN for how parameters can be pushed before a call (_fastcall , _cdecl , _stdcall ...)

Regards, Neitsa.
JMI
09-17-2004, 10:00 PM
You are expecting someone like Limee AKA Lamer to actually read the MSDN? His general way of proceeding is to ask lamer question here.

Regards,


So what does RCE stand for, anyway?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > So what does RCE stand for, anyway?
PDA

View Full Version : So what does RCE stand for, anyway?

TBone
09-17-2004, 05:05 PM
I've been wondering that for some time. All it means to me is Regional Code Enhancement, but I'm pretty sure that's not it :p. I'm guessing the R has something to do with reversing, maybe the C has something to with crypto, and perhaps the E is for engineering, but I can't seem to make anything fit.

Also, where/what is the messageboard regrouping from? Inquiring minds want to know.
Neitsa
09-17-2004, 05:53 PM
Hi,

Reverse Code engineering :D
Woodmann
09-17-2004, 05:54 PM
Hi,

Reverse Code Engineering.

The regroupment thing was from many years ago when
+F changed direction.
I have been to lazy to change/remove it :)

Regards, Woodmann
JMI
09-17-2004, 10:02 PM
It makes us oldtimers think of when we were young. :devil:

Regards,
kugi
09-18-2004, 05:37 AM
Hi,

Regroupment was a good word back then - still is.

Regards, kugi


Can't set a working Hardware breakpoint
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Can't set a working Hardware breakpoint
PDA

View Full Version : Can't set a working Hardware breakpoint

Neitsa
09-18-2004, 11:44 AM
Hello,

I'm currently coding a little debugger for my own knowledge, just to see how it works. I've successfully coded the Software breakpoint (BP) part, but I can't have a working Hardware BP working.

here's some code (coded with MASM) form the debugger loop:

.elseif DebugEvent.dwDebugEventCode==EXCEPTION_DEBUG_EVENT
.if DebugEvent.u.Exception.pExceptionRecord.ExceptionCode==EXCEPTION_BREAKPOINT
.if DebugEvent.u.Exception.dwFirstChance != 0 ;first time break (ntdll.DbgBreakpoint)
;BP address (inputed by user)
push BPADDR
pop Context.iDr0
;set DR7
push 401h
pop Context.iDr7
mov Context.ContextFlags,CONTEXT_DEBUG_REGISTERS
invoke SetThreadContext,ProcessInfo.hThread,addr Context

.else
;other breakpoints /Display message
invoke MessageBox,NULL,addr szBPHere, addr szCaption,MB_OK

.endif
//cut

Little explanation :

When the system BP (ntdll dbgBreakpoint) arise I set my Dr0 and Dr7 for my target.

Dr0 is a linear address
Dr7 is set to 401h

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 1

bits of Dr7:

-0 : L0 => Local breakpoint with Dr0 [set to 1]
-10 : undocumented, set to 1 as intel manual stated
-16/17 : R/W0 => set to 00 for Execution only

- 18/19 : LEN0 => set to 00 for "1 byte length" as intel manuel stated

I think threre's no need to set other bits field, thus Dr7 should be:

10000000001b = 0x401

Now the strange things happens...it never breaks on my target program...

I was just wondering why. I've read the intel manual many times but maybe I've missed something (I'm not setting the Dr6 because I think there's no need to do it...)

I've extracted the Hardware BP part of my program in a fully working program. Attached is the program with source code in asm (with radasm project). There's also a little target that does nearly nothing... (just for testing purpose).

I've tried to set hardware BP on 0x401017 in my target.exe program but it never breaks...

Can someone help me ?

Thank you very much !

Regards, Neitsa.

[edit]
Finally solved, here's a working version :
nikolatesla20
09-18-2004, 02:52 PM
DR7 should be set to 0x101

-nt20
Neitsa
09-18-2004, 09:22 PM
Hello,

Thank you for your answer nikolatesla20.

I've set Dr7 to 0x101 (enabled "Local exact BP") but my debugger loop never catch the Hardware BP...

Does this part of the loop catch hardware BP has it catch software BP (AKA 0CCh opcode) ?

.elseif DebugEvent.dwDebugEventCode==EXCEPTION_DEBUG_EVENT
.if DebugEvent.u.Exception.pExceptionRecord.ExceptionCode==EXCEPTION_BREAKPOINT

The only BP I get is the ntdll DbgBreakPoint, no other BP...Maybe this isn't handling hardware BPs.

Damn, I can't see what's going wrong.

Thank you very much.

Regards, Neitsa.
doug
09-18-2004, 09:43 PM
your software breakpoint raises
EXCEPTION_BREAKPOINT A breakpoint was encountered

while your hardware breakpoint raises:
EXCEPTION_SINGLE_STEP A trace trap or other single-instruction mechanism signaled that one instruction has been executed.
goggles99
09-19-2004, 03:21 AM
wow Neitsa, this is very interesting code to me...
Can you post your updated version source here too (once you get it working properly)

Thanks a lot...... :)
Neitsa
09-19-2004, 09:24 AM
Hello,

Thank you Doug for your answer. Well, I've uploaded a new version of this mini-debugger which handles EXCEPTION_SINGLE_STEP and EXCEPTION_ACCESS_VIOLATION.

I've put also SuspendThread and ResumeThread to be sure that the CONTEXT is set in a proper way...

Same problem... The Hardware breakpoint never raise an exception, breakpoint or single single step for my hardware BP... (I just got the same BP in ntdll)

Damn, I don't understand what is wrong, and I haven't been able to find a source code (Asm or C++) of a debugger that handle hardware BP.

It makes me sad... :(

goggles99 : Be sure that I'll post this code if it could work ! With the above code source you can add the software BP handling which is more easy to do. Just add some WriteProcessMemory (writing an opcode 0CCh) at the desired location in your code, and don't forget to restore the original code. If you want more precision, just feel free to ask.

Regards, Neitsa.
doug
09-19-2004, 12:09 PM
there is a working implementation here:

http://www.woodmann.com/forum/showthread.php?t=5035

download e32unpack.zip from there and check the function SetBreakPoint in e32unpackDlg.cpp.

kudos to bedrock for this, it's a nice piece of work.
nikolatesla20
09-19-2004, 08:28 PM
Here is some code in which I at one time tested using Hardware breakpoints, this code works.

Change the address of the BPM to the address you want to use in your test target.

-nt20
Neitsa
09-19-2004, 10:18 PM
Hello,

Thank you very much doug and nikolatesla20. I've read both source code carefully and they do nearly the same thing I've done (but they works :D).

I think the problem is in my debugger loop, but I haven't find it yet. I'll watch both source carefully, and I'm sure I'll be able to make it works as I need.

Thank you for the help you provided. :yay:

Regards, Neitsa.
goggles99
09-23-2004, 04:07 AM
here is a masm example

"Examples on how to use the DrX registers on 9x, ME and NT/2k"

y0da.cjb.net <---look under "Code Snippets"

Good Luck... Let us know how it goes. :yay:
Neitsa
09-23-2004, 11:55 AM
Hello,

Well goggles99, :loveu:

It works !!!

Even without seeing the source code from the yoda site, the solution was in the readme file... My mistake was I was trying to set the hardware BP too soon

here's a part of the readme:

It's because at the time of the DEBUG_BREAK hasn't the main thread it's real context. NT sets the real context later via the NtContinue API. So a possible method to set a BPM directly at the EntryPoint...

I've done something different than yoda makes, but the final result is the same...

Damn I'm happy !!!

Thanx a lot goggles99 :yay:

I've uploaded the working version of the debugger with hadware and software breakpoints handling at the top (with full source code in Asm)

Thank you very much.

Regards, Neitsa.


Google tremble!!!???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Google tremble!!!???
PDA

View Full Version : Google tremble!!!???

yaa
09-18-2004, 03:22 PM
Dunno if anyone of you have heard of this new search engine:

hxxp://www.a9.com

... experts say that google has reasons to tremble.
BTW it is from Amazon.

yaa
Silver
09-19-2004, 12:36 PM
Don't think Google are that worried:

A9.com is a powerful search engine, using web search and image search results enhanced by Google, Search Inside the Book™ results from Amazon.com, reference results from GuruNet, movies results from IMDb, and more.

They're paying Google a license fee to be able to do that. Absolutely no different than when Yahoo used Google.
JMI
09-19-2004, 12:50 PM
Well then, maybe they are just "trembling" at the thought of the extra revenue. :idea:

Regards,
Silver
09-20-2004, 05:45 AM
"tremble" is one of those words that if you repeat it enough times, it loses all meaning.

And this was a post that has lost all meaning :D
venom925
09-20-2004, 06:57 AM
And this was a post that has lost all meaning :D
I think it lost it when JMI said it :yay:


code injection problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > code injection problem
PDA

View Full Version : code injection problem

razzytaz
09-19-2004, 04:06 AM
hi, this is not exactly a crack

I'm trying to change a program that is similar to weatherbug. it displays the temperature in the systray but I want it in Celsius and it only displays it in Faerenheit

So I disassembled the program and found the spot where I want to change something. I tested it out so that if I changed the eax register to any temperature, it would display that, which is good.

The problem is when I want to insert something like:
isub eax, 32h
imul eax, 5h
idiv eax, 9h
in order to convert the temperature, there isn't any space because this needs to be changed between these two lines:
.text:00404E5C call sub_403B95
.text:00404E61 cmp eax, 0B4h

So I read some tutorials about code injection, and can't find any good place to put my code. Then I decided to remove some useless messagebox function in some other part of the code and put my code there. But when I try to replace the code in hiew, hiew says "operand size do not match or missing". Now I understand it's because I want to change:
push 0
to
isub 20h
and the sizes are different, but how do I get around this?

And my other question is, is there a better way to do this without code injection?

Thanks for reading my lengthy post
zombie8
09-19-2004, 04:26 AM
Why don't you add another section to the executable and put your code there? I think "code snippet creator" can do that. Then replace "cmp eax, 0B4h" with a jump to your code. And don't forget to put "cmp eax, 0B4h" at the end of the "patcher", just before returning to the instruction after 00404E61. This should work... if the program has no CRC check.

zombie
gook
09-19-2004, 05:16 AM
Hello Razzytaz,

The message you get in hiew saying the sizes do not match is a syntax problem. For example, try assembling "mov eax, al". It will give you that exact same error.

Just "sub 20h" won't work by the way. What you probably want is "sub eax, 20h"
razzytaz
09-19-2004, 07:15 PM
ah, that was the problem. hiew recognizes sub eax, 20h

I finally got it after hours of work today :) I kept forgetting certain instructions or jmp ing to the wrong place, or messing up the stack but now it works!

thanks for the help guys


looking for Microguard PC info.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > looking for Microguard PC info.
PDA

View Full Version : looking for Microguard PC info.

requiem
09-19-2004, 06:59 AM
Hi there,

i'm looking for Microguard PC API documentation, anyone can tell me where to find some useful info (ie. not japanese or china-based language :( ) on this dongle ?

the Microguard PC dongle was developed from Micro Macro but they was earned from Aladdin some year ago, and no more web site with docs are available.

i've tried to search with google but no luck, can you help me ?

regards,
rEQU!em


File Handle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > File Handle
PDA

View Full Version : File Handle

ReVeR
09-19-2004, 09:06 AM
HEy.
i need to get a file handle from a process.
Basicly, i got a dll injected into the process, and now somehow i need to find the handle to the file in that process.
i know the name/location of the file.
How can i get the handle.
0rp
09-19-2004, 04:29 PM
the EPROCESS structure of a process contains a table that saves all handles opened by a process

you can retrieve this table in ring0 with PsGetCurrentProcess()->ObjectTable
ReVeR
09-19-2004, 04:31 PM
what is ringo?
can somone give me some info on it?
0rp
09-19-2004, 04:42 PM
ringo is ring 0 or kernelmode

that means that you have to write a little driver that sends this info to your application (which runs in ring 3)
doug
09-19-2004, 05:14 PM
if you let us know what you want to do, we can most likely suggest a better approach then searching for an existing file handle stored "somewhere out there".
ReVeR
09-20-2004, 07:12 AM
i doubt there is one.
but here it is :
i got an app that creates a file, opens it , and when the app closes itself it deletes the file...
i need to get that file, i can't copy it becuase it is open, so any ideas on how to get to the file>
thx
dELTA
09-20-2004, 07:21 AM
Put a breakpoint in the program before the file is closed, then kill the process when it hits. The file is now yours.

You could also modify the flags for the code that opens the file, so that it is not opened in exclusive mode (and not in auto-delete-after-close mode, if that's the case).
ReVeR
09-20-2004, 05:39 PM
that is a possibility, but i wanted a prog that does that for me without actualy screwing with either file, or spending time debugging the progam....and i also wanted to learn some stuff about ring 0, since i never worked with it in the process.
0rp
09-21-2004, 04:27 AM
and what do you want to do with that handle?

i dont know if it is possible that you use a handle from another process in your process

or does DuplicateHandle this work?
ReVeR
09-21-2004, 06:40 AM
no, not like that...
i have a dll injected into the other processs, now i want my dll to get the handle from inside the process and use it.....
to find the handle i need to work with ring -0 (i think i do....)......
Silver
09-21-2004, 07:45 AM
<pedant>
Ring 0 is not necessarily kernel mode. One does not imply the other - rings are a processor-level security mechanism to segment code via descriptors, whereas kernel & user mode are operating system terms that define where code managed by the o/s is running. On a 680x0 (motorola) processor, supervisor (kernel) mode and user mode do exist as the only 2 "rings", because it's a different cpu design. Ring 0 happens to be kernel mode on Windows because Microsoft stuck to a 2 ring model (even though x86 has 4 rings, only ring 0 and ring 3 are used) due to cross-platform compatibility. So, to pick nits, although the Windows kernel runs in ring 0 it's incorrect to call ring 0 "kernel mode".
</pedant>


Spyware/adware on the board
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Spyware/adware on the board
PDA

View Full Version : Spyware/adware on the board

venom925
09-19-2004, 09:39 AM
how come these pop-ups that come up when you sign on the board dish out this spyware/adware? its very annoying.:mad: can anybody do anything about it
dELTA
09-19-2004, 10:19 AM
This is added by the cjb.net redirector, just use the woodmann.com address to get rid of it completely.


SafeDisc 2/3 IAT Rebuilding
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SafeDisc 2/3 IAT Rebuilding
PDA

View Full Version : SafeDisc 2/3 IAT Rebuilding

ZiruX
09-19-2004, 01:33 PM
Hello ppl,

I have been working with SafeDisc for a long time, and I realy can´t
come forward at this subject. It´s the IAT (Importtable) that is the
big problem. I have traced alot, and I realy can´t find how to get the
adresses of the orginal API. Offcourse I could use Revirgin or Imprec,
as a lot of people has told me to do. But I wan to understand how it
works. Any tipps about How I easiest can rebuild it, or any other tipps
that could be useful I would appreciate.

Sorry for my bad english :boo:

Over and out // ZiruX
Hopcode
09-19-2004, 03:26 PM
Hello,

Which version of SafeDisc are you working on ?

Im not sure Imprec will be of any help actually.

Also, IAT isn't the most difficult part of SafeDisc.
You will need to create a bunch of "call fixers" to rebuild IAT, but also
Calls to IAT, and also a bunch of other Code mangling features such as
call safedisc routines, that redirect you to somewhere else in the program.
(There are also jmps)

Finally, you may also need (depending of the version), to cope with Invalid Opcodes Decryption.

Basically, Bad opcodes triggering decryption routines.

I stopped looking at SD on version 2.80, therefore i can't tell you much about the new versions.

Cheers,

Hopcode
ZiruX
09-19-2004, 03:58 PM
It was alot of information, but I wan to take one
thing at the moment, that means, I wan´t ideas
about how to rebuild the IAT. It must be alot of
ways to do it. Thanks for your ansver, I hope on
more ;)

Regards
ZiruX

PS: if anyone wan´t contact me on IRC, My nick is ZiruX on Efnet.
gook
09-20-2004, 03:09 AM
Hello Zirux,

You should run http://www.yates2k.net/cd/TSD27p.txt through a translator. This document holds the information to rebuild the IAT for the most recent versions of SD.
ZiruX
09-20-2004, 05:56 AM
I have already made that, and it´s realy good in many ways.
BUT it´s using pretty bad and old methods, like add info in
Adump. Offcourse I could take that info, and make an own
tool, and I have tried that, but I don´t get he´s method
working on newer versions.
Thanks for ansvering,
Regards
ZiruX


Ollydbg and antidebugger protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Ollydbg and antidebugger protection
PDA

View Full Version : Ollydbg and antidebugger protection

NoName
09-20-2004, 04:44 AM
Hi everyone, I'm a new user and i have a question for anyone that can help me.
When i try to debug a program using Ollydbg 1.10 it pops a message box saying something like this: "Debugger found.Unload the debugger and try again."
The same happens when i try to load the program through the W32Dasm debugger.
Is there any way to fool the program to think that it is not run by a debugger?
Thanks for reading my post, i hope someone could give me a hint.
venom925
09-20-2004, 06:53 AM
Try using the search feature of the forum. Using this
http://www.woodmann.com/forum/search.php?searchid=85653 you only get 5 results and your answer
Also try using google.
dELTA
09-20-2004, 07:19 AM
You cannot dírect link board searches like that, that link will stop working shortly after you performed your search, post the search terms instead.
JimmyClif
09-20-2004, 07:27 AM
Key Word(s): olly, hide, plugin
venom925
09-20-2004, 07:33 AM
heh sorry:whoops: dELTA but i think that the point still stands dont you
JMI
09-20-2004, 02:11 PM
The point is, of course, well taken. He was just pointing out an issue with the vBulletin search function. :yay:

Regards,
NoName
09-21-2004, 03:20 AM
I had already tried the IsDebuggerPresent plugin for OllyDbg (if that's what you suggest venom925) but it doesn't seem to work.
I had also tried the trick from the forum user Shub-nigurrath with changing the 'O' of the Olly in '0' (zero) but that didn't work either.(Besides the antidebugger protection is not OllyDbg-specific since it pops-up even with the debugger of W32Dasm).
I also forgot to mention that the programs that popup that "Debugger found" message are mostly (but not only) games.

I have some new questions:
a)Is there any other plugin for hidding Olly or a program like Frogsice (came across it while searching with google but it says it can only be used with SofIce and win9x) but for use with ollydbg and WinXP?

b)I tried to find a tutorial (using google) about defeating general antidebugger technics but didn't found anything usefull.Does anyone know any tutorial like that?

Thanks for answering my post.:)

I will try a couple of new tricks that i found while searching with google(although i'm not sure that they will work) and will let you know if i find an answer.
JMI
09-21-2004, 11:27 AM
If you read up on "debugger detection," you will generally find that the process you are dealing with either works on the interrupt level, i.e. it is detecting changes made by the debugger to intercept errors or exceptions used to invoke the debugger, or it has a process for determing that any one of a number of programs and/or windows are currently running.

Your's sound like it may be the second category and just changing the name of the program, Ollydbg to 0llydbg may not be enough. For example the program may look for the name of a window which is open in the debugger. Generally searching here for debugger detection should give some additional ideas.

Regards,
JimmyClif
09-21-2004, 02:32 PM
Also try to change the classname and any related strings inside Olly into 0lly with an Hexeditor.
SL0rd
09-21-2004, 03:11 PM
olly can atach to an active task, maybe the app is checking the debugger presence in the start, I think should be possible attach after the process starts and debug it from there, if we look for a registration like dialog its may work!

Please forgive me if Im so wrong Im a beginner, yet!!
NoName
09-22-2004, 02:10 AM
Thanks for your suggestions!
I'll give them a try :)


A public service announcement by JMI?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > A public service announcement by JMI?
PDA

View Full Version : A public service announcement by JMI?

5aLIVE
09-20-2004, 08:41 AM
Sound needed for this important message:
Please listen carefully.
http://www.albinoblacksheep.com/flash/posting.php
Kayaker
09-20-2004, 09:51 AM
LMAO, Oh we gotta add that to the FAQ! :D
venom925
09-20-2004, 11:05 AM
Im with Kayaker. better yet make it standard to view the whole thing before you make your first post :devil:
JMI
09-20-2004, 02:18 PM
Boy with a little editing, that "training film" could be a real gem. :yay:

Regards,
Woodmann
09-20-2004, 03:25 PM
Fucking brilliant :)

Woodmann
Innocent
09-20-2004, 08:30 PM
Heh, my favorite part is when it says "If you just have something to say..."
and then it shows the message "shut up and go outside you forum whore." It passes by pretty quickly :)
5aLIVE
09-21-2004, 03:26 AM
I though this might raise a smile or two. Glad you guys like it.
5aLIVE


Keygen approach for a Delphi app
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Keygen approach for a Delphi app
PDA

View Full Version : Keygen approach for a Delphi app

Silver
09-20-2004, 02:14 PM
Hi guys,

I'm working on a little app at the moment, it's written in Delphi. Using DeDe etc I've found the "top level" serial checking code easily. I've also found a line of code that quite clearly displays the correct serial key for the registration details entered (checked by viewing it, restarting the app and pasting it in). That's fine, and so I figured that this was a prime candidate for a keygen.

I've run into a conceptual problem. Because this app was written in Delphi it is a huge mess of jumps and calls. There are 15 calls in the "top level" serial checker alone. What should be my approach here? Do I give it up as a bad job that will take a huge amount of time to cleanly rip all the serial generation code out? Stick with the usual patch of a jump-to-good-serial? Or do something else?

I'm interested to know people's approaches. Patching it is easy, I was going to do a kg for experience, but to me it doesn't seem feasible from a time perspective.
akimp3
09-20-2004, 03:27 PM
Hi

This is what i do in this kind of situations.
Use the openprocessmemory and writememory API call to add a message box in the program that will display the real serial then close the program from your app and tell the user to enter the serial he has seen in the msgbox.
1-the user have to run your program
2-run the program u want to crack
3-click on the button on your program
4-now your program will do the modification to the program only in memory
5-then he will enter his name and anything he wants as the registration number
6-the real serial will be displaye in msgbox and the program will be closed

by this trick you have made a keygen without knowing the algo.
I can give you delphi source code if you need.

Good luck

Akimp3
dELTA
09-20-2004, 04:58 PM
Or you could use TQN's full Delphi signature IDA pack, and most of those messy calls will quite likely be easily replaceable with the corresponding functions in your own Delphi keygen. :)

http://www.woodmann.com/forum/showthread.php?t=6372
JMI
09-20-2004, 05:48 PM
Wouldn't that be cheating? :eek: Nah. :yay:

Regards,
TQN
09-20-2004, 09:36 PM
Hi Silver !
You can also use DeDe and export the disassembly result to a Map file, and use my IDA LoadMap plugin to load that Map file to IDA. The disassembly result in IDA will be better with more name of VCL controls, properties, methods.
Sorry JMI, I have a question about English: what the meaning of BTW, LOL, Nah... I searched in my English-Vietnam dictionary and not found any words.
Best regards,
TQN
Woodmann
09-20-2004, 10:47 PM
I have a question about English: what the meaning of BTW, LOL, Nah... I searched in my English-Vietnam dictionary and not found any words.

They are abbreviations of words.

BTW="by the way". Kind of meaning "as an after thought" or maybe meaning "incase you did not know "

LOL="laugh out loud".

Nah, it is slang for "no/nevermind/forget it" in English :)
(depending on what region you live)
hobgoblin
09-21-2004, 12:23 AM
To akimp3:

Can I get a copy of the delphi source code you're talking about? I'm currently learning to code using Delphi and I'm interested in seeing how you resolved this. You can mail me at: hobgoblin.at.chello.no

TIA,
hobgoblin
Silver
09-21-2004, 07:40 AM
Thanks guys, plenty to try now :D


Resources
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Resources
PDA

View Full Version : Resources

ReVeR
09-20-2004, 05:53 PM
hey.
i wanted to make a resource editor , and basicly, i was wondeirng onhow can get where the resources are in a file (PE) for starters?
also, how can i identify wich resource it is?
thx.
Kayaker
09-20-2004, 08:37 PM
Hi

As a start you can look at the example in the 2nd zip file in this thread. I uploaded several nice articles+src by Rheingold about the PE structure, one of them being:

Parsing the .rsrc section to locate icons

http://66.98.132.48/forum/showthread.php?t=5423&highlight=Programming+Journal+Articles+Rheingold

Kayaker
Silver
09-21-2004, 07:48 AM
Although this doesn't help (and coding a resource editor is a technically interesting task if you've not done it before), I'd point out that coding a *good* resource editor is pretty time consuming. If you just need a resource editor, find a tool called ResHacker, it's great.


SI problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SI problem
PDA

View Full Version : SI problem

ReVeR
09-20-2004, 06:12 PM
HEy.m just installed Si with driver suit 3.0, anyhow, i got the next problem.....
when i get a break at a breakpoint, i get a problme...the adress is in like 1xxxxxxx values. not the 004xxxxx values.....first of all, any ideas on wtf this is and how to get rid of it?> secont of all, if i can't get rid of it, how can i calcualte the 004xxxxx adress of that same posistion?
thx.
doug
09-20-2004, 08:51 PM
:rolleyes:
strong advice:
you need to go back to the basics. This isn't a SoftICE problem at all.

Also try to fix spelling mistakes, this board isn't a place where you can just shovel shit and expect a descent answer to the world's problems.

More information at: http://www.woodmann.com/forum/showthread.php?t=6394 ;)
--
check what process you are in when it breaks. Furthermore, check in what MODULE inside that process the breakpoint occured. I find the softice commands 'what <address>' or 'what module' to be useful for this.
JMI
09-21-2004, 11:36 AM
I fixed some of the spelling so it is a little more readable, but it does clearly suggest there is need for more study of basic concepts in reversing.

Regards,
ReVeR
09-21-2004, 07:36 PM
ok, sorry for all the spelling mistakes, i am typing without my glasses(not like even seeing what i am typing is gonna help me:P).I am not sure about the basics.....
this is a problem with SI, why? Because, the process has no dll and such loaded. It is just an .exe, therefor, it should not be in 1xxxxxx range.
Also before i updated to driver suit 3.0 i had no problem getting my breakpoints to pop at 004xxxxx range, .Now when i get a break, i get in the system files (7xxxxxxx range), then after i go to where the call originated i am at the 1xxxxxxxx range....
any ideas on why that is?
Aimless
09-22-2004, 12:55 AM
Kid,

Slow down...

You are moving too fast. I'd suggest the following:

1. Get a pair of glasses

2. Understand SoftICE first. You may want to leave all this cracking/reversing business for a week and instead concentrate _ONLY_ on printing and reading the softice manuals.

3. Once you are OK with the softice manuals, you will get a clear idea of why breakpoints are behaving the way they do. If you still don't understand try querying this board with "SOFTICE" and "BREAKPOINTS" and you will find a wealth of information on the same.

4. Alternatively, download the CHM version of this board and search on it.

5. You should be really eager to learn how to use the tools properly. Form and accuracy should be your targets, speed will come later and is not that important.

6. I'd suggest you leave the flexlm/graphic softwares/games away for a while and concentrate on Winzip v5+ and above and MIRC v5+ and above.

Have Phun
ReVeR
09-22-2004, 06:41 AM
rofl, well, i guess u are right about reading softice manuals, i don't think i read a single one n the updated driver suit ....


add ordinal to export table
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > add ordinal to export table
PDA

View Full Version : add ordinal to export table

AmAdEuS
09-20-2004, 07:22 PM
i'm adapting a crack to a new version of a program, but there needed to add 2 new ordinals...
i've already created a new segment in the file with the code from functions...
now how do i add them to the export table?
dELTA
09-21-2004, 07:53 AM
I assume you mean import table?

You can use IID King for example:
http://www.woodmann.com/forum/showthread.php?t=6347
SL0rd
09-21-2004, 03:22 PM
I have an idea here but first I would like to say that you dont work with "segments", unless you have a win3.1 app for example. 32 bit Windows
work with "sections" in the PE file format!

Ok, the idea is, dont worry about creating new sections and making all the stuff related with IAT, just substitute your ordinals in place of some "useless"
function that is listed in the IT, if the dll that exports your ordinals is already listed in the IT. if no I think you will really do a few more work!
Ok, any corrections will be welcome!
AmAdEuS
09-21-2004, 03:34 PM
no that's the point i mean the EXPORT table...
see there'S a securom 5.x protected game...
and i have a workin crack for the old version..
but in the new version the exe has 2 new exported functions that are laodd by some dll from the game....
so i added a new section to the cracked PE that contains the code of these functions which i took from the new versions's original exe.
now i need to make this old cracked exe export the 2 new functions to the game....
i but i know how the export table is built, but when i look @ the code i can't see these structures in there... my new idea is to write a complete new EAT and change the pointer in the header to my new EAT... any comments that could save me useless work? any error in this thought?
AmAdEuS
09-21-2004, 03:54 PM
or is there an tool that could convert the ida-pro output to some masm32 compatible code that can be recompiled? didn't found one... but if there was i could easily modify the stuff
AmAdEuS
09-21-2004, 05:42 PM
finally foud it, the name of this great tool is Lord PE Deluxe
http://mitglied.lycos.de/yoda2k/LordPE/info.htm

and my crack is working :)


Rendering, a nice distraction
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Rendering, a nice distraction
PDA

View Full Version : Rendering, a nice distraction

Silver
09-21-2004, 07:55 AM
Some of you have probably seen this already, but anyway:

http://www.blur.com/html_quicktime/rockfish_480.html

I ran across this yesterday from Atomfilms, it's truly excellent. The quality of the rendering is fantastic. Makes me wonder what hardware they have...

You'll need Quicktime and sound and a free 5 mins.
dELTA
09-21-2004, 08:15 AM
Hehe, cool. :) I'd be much mroe interested in the software though, since all that the hardware can do is speed up the rendering process, it is the software that stands for both the image quality and general quality of the content...
Neitsa
09-22-2004, 04:34 AM
Hello,

The Blur studio uses extensively 3Ds MAX 6 with some high level rendering plug-ins as "Brasil" (Sponge Bob was released with Max6 and brasil).

The final compositing is done with Adobe products like Photoshop, Premiere and After Effects.

Blur is well known for their high quality short movies. It's seems strange since Max is not very used for movies, but much appreciated for Games or Architecture environment. Movie production is more often done by Maya or Xsi. Well, by watching this movie, all that could be says is that MAX is really good if it's in good hands...

Thanx for the link :)

Regards, Neitsa.
Silver
09-22-2004, 07:18 AM
Now I'm really interested to see how the Transformers movie will turn out. I was impressed with the progress for Spirits Within, but Hulk was a total CG disaster. I guess if they have the money (and Transformers is a big enough franchise to generate it), the movie could be fantastic...
tdennist
11-12-2004, 10:38 PM
As a studio max user myself I...am extremely impressed, to say the least. I wouldn't even know where to begin crafting any aspect of that little clip. Well. I could do the rocks. :p. As it is, on my AMD Athlon 1.8 Ghz machine with a gig of ram, that little clip would take like years to render. So I'm impressed mostly with the movie, but also with just the technical difficulties they must have had with rendering that. How many computers does a typical rendering farm such as this one generally have?


MP3 Dumping.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MP3 Dumping.
PDA

View Full Version : MP3 Dumping.

Innocent
09-21-2004, 03:24 PM
I hope someone can help me with this. I was wondering if there was a way to dump an mp3 file from memory? Does a software player store the file somewhere in memory? (or at least part of it because it has to buffer)

I am wondering because I am working on elicense DRM. :)
dELTA
09-21-2004, 05:01 PM
Most players only buffer a small part of the file in a circular buffer, but some of them have options regarding the size of this buffer, which could make it possible to make it buffer the entire file I guess. Otherwise you could always hook the buffering function and make it dump data progressively too I guess.

But on the other hand, is there really any DRM system that's stupid enough to only put an encryption envelope around the whole file, and then decrypt pure sound data in memory? The ones I've seen have been much more "intertwined" than that...
Innocent
09-21-2004, 06:14 PM
But on the other hand, is there really any DRM system that's stupid enough to only put an encryption envelope around the whole file, and then decrypt pure sound data in memory? The ones I've seen have been much more "intertwined" than that...

Actually, I think there is. It is called eLicense.:D Getting an elicense DRM'd file unpacked is as easy as any program that is packed with elicense. While on the subject... wouldn't there be a way to capture the data somehow as it gets sent to the player anyway? (in the case of other DRM protections like M$ DRM) I mean, the player needs to be passed unencrypted data so can't we find where it is passed to the player and progressively dump it?

:idea: The only workaround I can see would be to have a player that "reads" encrypted files. In this case the player would have it's own encryption system. Here is an example:

Say M$ created a new file format. Call it .wme for windows media encrypted (file). Only windows media player can play it. This system would consist of 2 layers of encryption:

1. Take an existing mp3 file and encrypt it in the new .wme standard. The file is now encrypted in a scheme that only windows media player can handle.

Suppose the original mp3 had the data: 10D3D092BD34AA99

Now that it is in .wme it looks like: 2659274501374855

Have the .wme extension trigger the wme reading mode:

Now when playing the file media player sees: 2659274501374855 but recognizes that it is really 10D3D092BD34AA99 and plays that. I suppose this could be done through simple substitution. i.e. the player sees 26h (the first byte of the example string) and knows that it really means 10h by using a substitution table. The key to this is that the "real" bytes are never passed in a buffer so someone can dump it.

Expanding on this: now that you have a working substitution table why not have say, 256 different ones and include which one you want media player to use for this file. (the one that the file is encoded for)

2. Now that you have working .wme files, add the DRM layer. A person buys and downloads the .wme, receives the license key, and can now play the file.
The DRM layer is decrypted on the fly and media player never puts the original bytes of the file in memory.

Call me crazy or whatever. :D I don't know if all this would work or not; it was just my crazy tangent to your post dELTA. :yay:
dELTA
09-21-2004, 07:01 PM
Your description/idea is a simplified description of what I was referring to, yes.

And yes, the unencrypted sound data can always theoretically be captured. The depth of the decryption code inside the decorder loop will determine how tedious it will be.

And you could of course always create a fake sound driver and capture the raw digital output from the player too, but in that case you would have to re-encode the sound data if you wanted it in the original compressed format, which might lead to slight degradation of quality, i.e. this method is not completely clean unless the original sound data source is using non-destructive compression.
Silver
09-22-2004, 07:14 AM
I was going to point out exactly what you said at the end of your post, Delta. As long as it's possible for people to write drivers (video, audio and whatever else), DRM protection is only as difficult as it is to re-encode the data to something. It's the same principle as the WinAMP diskwriter plugin...
Innocent
09-22-2004, 03:10 PM
As long as it's possible for people to write drivers (video, audio and whatever else)

Yes but what about people that don't know how to write drivers like me :) Since the protection I am working on just has the raw data in a buffer how can I progressively dump it? Hopefully there is a not to complex way of doing this...
dELTA
09-22-2004, 03:37 PM
Yes, as I said above in my first post in this thread, simply hook the function that fills the buffer. Should be trivial once you have pinpointed the correct function/location.
evlncrn8
09-22-2004, 04:01 PM
alternatively be lazy, get a male to male din cable, connect speaker out to line in on the soundcard, start an mp3 recording program (tons of em on download.com or shareware places), tell the 'drm' player to play the encrypted file.. job done.. no need to reverse anything, except your lazy ass into a chair.. heh
Innocent
09-22-2004, 05:43 PM
Well, I found where the file is being buffered. I am certainly not on dELTA's level so I don't really know how to proceed :) Man, also I am having trouble writing my first keygen. I have reversed a serial algo and I know exactly what I want to do but I don't know how to code a dialog box app.
dELTA
09-22-2004, 06:34 PM
Hehe, for the keygen: Use Delphi, it rules (yes, there actually is no real reason to be anal about it and do everything in pure assembler, all things have their place :rolleyes: ).

For the mp3 dumper: Read up on coding hooks. Then hook the buffering code right after it has copied the data to the buffer. In your hook code, simply dump this new data from the buffer to a file with a couple of simple API calls.

And remember, programming skills are very important both for the understanding of code and the manipulation of it, so if you want to be able to do any cool stuff at all, take my advice and spend some time becoming a decent programmer first, believe me, you won't regret it.

Keep up the good work anyway! :)
Silver
09-23-2004, 06:09 AM
ew, he just recommended Delphi.... Someone get that guy a doctor.

Real men use C/C++, and if you want to be truly elite, use MFC or WTL too :D
Fake51
09-23-2004, 07:36 AM
Real men use C/C++, and if you want to be truly elite, use MFC or WTL too :D

Real men eat coffee for breakfast, then hexcode their resources into their binaries while bitching about it and m$ for ages, only to end up copypasting their ripped algos into some ageold asm-source they had lying around.

Just thought I'd make my obligatory "once every third month"-remark.
Fake
dELTA
09-23-2004, 09:51 AM
ew, he just recommended Delphi.... Someone get that guy a doctor. Real men use C/C++,I assume this would be the same "real men" who sit and try to get their MFC crap working (after already having given up after three weeks of attempts getting the GUI to work in pure MASM, hoping that noone would notice what a sissy they were to switch to Visual Studio in the first place) while the smart guys already got the program (and the next eight projects) done and went to lunch? :)

I like C/C++ better than Object Pascal in most aspects too, but since noone seems to have put together an equally beautiful and efficient tool as Delphi based on C/C++, I'm sticking to Delphi until someone does. It has the perfect balance between simplicity and power, and also access to all the low-level power you can get in any other language/development platform, as soon as you need it.
Silver
09-23-2004, 10:20 AM
Ouch, handbags at the ready, ladies :D . For my part, I'm a die hard MFC coder. IMO MFC is excellent if you take the time to learn the concepts and quirks up front.

Delta, have you tried Borland's VCL? I know some C++ coders that swear by it. Never used it for win32 myself, but when I tried Kylix C++ under SuSE I thought it was pretty good...
disavowed
09-23-2004, 10:28 AM
why not just use total recorder (http://www.highcriteria.com/productfr_tr.htm)? it records the data that gets sent to your sound card.
dELTA
09-23-2004, 10:37 AM
Silver:
Yes, the VCL is actually shared between Delphi and C++ Builder (and even originally derived from Delphi, since it came first), which is an even bigger testimony to how similar the two languages really are, much more so than most prestige blind C++ coders would like to admit anyway. :) I like C++ Builder too, but for some reason they still added some stuff that made it a bit more inconvenient to use than Delphi in several aspects, which is why I still stuck with Delphi when C++ Builder was released. But I agree, C++ Builder is a very good product indeed. And finally, no matter how much "time you have taken to learn the concepts and quirks of MFC", I bet that you can't beat an equally trained Delphi coder in speed and efficiency (of development that is) for equal results on 95% of all projects. *slowly putting down handbag* :p

disavowed:
Yes, TotalRecorder use the driver technique mentioned earlier, and they were actually the first ones to use it in a commercial product as far as I know. But as also mentioned above, you have to reencode the data in this case, which is not completely "clean".


INT3 and process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > INT3 and process
PDA

View Full Version : INT3 and process

Hero
09-22-2004, 12:47 AM
Hi all
I'm working on an protection algorithm
for my proposal.
I ask my question here because crackers
are the best protectors if they want!:D

My algorithm is based on using INT3 in
the process.I want to know what will be
happened if we get an INT3 in an normal
process(not in Debuge mode).Is it works
similar to normal breakpoint?
In addtion can I change this process used
register values using SetThreadContext
when it get to this INT3?

thanks
sincerely yours
Neitsa
09-22-2004, 03:42 AM
Hello,

I want to know what will be
happened if we get an INT3 in an normal
process(not in Debuge mode)

It will crash ! All interruptions under windows user-mode programs have to be handled by a SEH.

Is it works similar to normal breakpoint?

there's two type of INT3 :

The 0xCC opcode, and the two opcodes 0xCD03 which the form of the INT n instruction with n=3. They are handled in different ways. This is well explained in the Intel manuals. "normal breakpoint" as you said should be "software breakpoints. When a debugger is puting a breakpoint, it is just writing a 0CCh opcode in the program and it's handling the error.

There's another type of breakpoints, which is hardware breakpoint. There is only 4 hardware BP's, cause they are working with Drx (Debug Registers) and there's only 4 Drx for putting an adress (Dr0 to Dr3). They are called hardware 'cause it's an hardware feature of the CPU. Those Drx are accessible only directly (in the form of mov reg,Drx or mov Drx,Reg) under the kernel-mode (AKA Ring0 mode) which is the privileged mode of the CPU and accessible only from a device driver. You can access them with the Get-Set/ThreadContext...

In addtion can I change this process used
register values using SetThreadContext
when it get to this INT3?

This is a way of accessing Registers (even EIP or the Drx) but you can't from the process currently running. You must do it from another process, since you must halt the thread to do it, with SuspendThread and resume the thread with ResumeThread. When you get to an INT3 you must have a SEH that will handles the INT ! the Get-Set/ThreadContext are generally used with a debugger, but it can be used with another thread, but remember that you must handle the INT first, and you can't use those API on the thread where those API will be executed.

Hope this could help.

Regards, Neitsa.
Hero
09-22-2004, 09:01 AM
Thanks for detailed help.
I make a new thread that explain my algorithm of protection.
If you can please consider with it and suggest better way.
sincerely yours


EXECryptor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > EXECryptor
PDA

View Full Version : EXECryptor

omega_red
09-22-2004, 04:16 AM
I was posting this on exetools, but with null response, so maybe here there are people who have tried it (and run it ;).

Has anyone messed with it? It claims to be able to metamorph any protected code (in addition to "normal" anti-whatever). However, I was unable to even run it (without any debugger), the downloadable installer crashed during setup ;)

strongbit.com/execryptor.asp

[edit]
Nah, they're saying I downloaded corrupted file. How professional ;)


a protection algorithm using INT3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > a protection algorithm using INT3
PDA

View Full Version : a protection algorithm using INT3

Hero
09-22-2004, 09:12 AM
Hi all
I'm working on a protection algorithm for my
proposal.I write my algorithm here to everyone
because the cracker are the best protectors if
they want and can tell me this algorithm's weak
points.

I send you abstract of my protection tec.

ONLY FOR EXE FILES.

Phase 1: adding some debugger detection
algorithms to EXE.
Phase 2: replacing all jumps as folowing:
--- ---
--- ---
jxx y jmp a
--- ---
--- ---
a: push r
push t
int 3
there 'r' is some needed data such as process
ID,Jump type,etc. and 't' is target address
of jump that is coded in an algorithm such as RSA.
phase 3: writing a low level hook for "int 3" that
decodes the target address of jump and jumps to
it if is necesssary.
Phase 4: adding an packer surface to program.my
tec in this phase is based on UPX that is an
opensource packer.

protection features:
1-No debugger and dumper can debug this application
because of INT 3;
2-packer surface will make trouble for disassembling.

thanks for help.
sincerely yours. :D
Hopcode
09-22-2004, 10:44 AM
Hello,

Your protection idea to use int 3 isn't new.
Actually its a rip off of Armadillo nanomites.

I assume you are going to use a driver to hook int 3.
Im not really sure to understand how you will handle the jmps though.

how do you know where to jmp ? how do you handle the flags? etc

Also, UPX won't help to protect against disassembling. Sorry.
dELTA
09-22-2004, 10:54 AM
Some immediate problems with the "replacing jumps technique":

1.
It seems like you least said will be short of opcode bytes to do that replace (especially if you will encode the addresses with RSA, which is completely unnecessary btw).

2.
Replacing all jumps like that will make the program so slow that it will be unusable.

3.
Mass-replacing opcodes in general is prone for errors, especially with short opcodes like jumps, which will in turn also make the target unusable.
cyberheg
09-22-2004, 12:30 PM
I'd like to know how you plan to use RSA. I.e. who's having the private key? and will it be signing you will be doing? Have you thought about performance? Theres a reason symetric ciphers were invented and still being used today.

Thanks in avance.
-- CyberHeg
dELTA
09-22-2004, 03:32 PM
Yeah, that's what I implied above too...
Hero
09-22-2004, 03:57 PM
thanks for imediate answer! :D
I only tell "such as RSA" that mean I have no
perfect decision for algorithm.
I know it's aproximately 20% of a program is
its jumps,and this algorithm will slow down it,
But nowadays with the speed of increment of
computers performance,I don't this think slowing
down is very important.
I only want to know other than performace problems,
is there any stucturaly problem in this algorithm
that prevent of making a program work when it is
protected in this way?
Is there any better way to protect???
about jumps targets,perhaps this show it better:
---
---
jxx a
---
---
is replaced by:
---
---
jmp loc1
---
---
loc1:
push r
push t
INT 3
the target 'a' is now coded and is 't'.
r show flags,etc that is needed.
The decoding of target adress will be in the HOOK.
ALL suggestions are welcome! :D

thanks
evlncrn8
09-22-2004, 04:03 PM
protection features:
1-No debugger and dumper can debug this application
because of INT 3;

bullshit
Neitsa
09-22-2004, 04:26 PM
Hello,

Hooking an INT requires to deal with a driver since it can only be achieved in Ring0, at least on NT environment...but you can find some good source code on INT hooking with drivers.

Even with hooking the INT3, I'm not sure that Softice can't handle this...

Before going any further on developping the protection, make sur Sice can't trap the hooked INT3. If it can, your projet will be good to be directed to the trash bin. (A simple I3HERE and/or bp int3 and all the protection is dead).

Regards, Neitsa.
dELTA
09-22-2004, 06:22 PM
---
---
jxx a
---
---
is replaced by:
---
---
jmp loc1
---
---
loc1:
push r
push t
INT 3
the target 'a' is now coded and is 't'.
r show flags,etc that is needed.
Ok, here's a 30-second crack for this scheme:

1.
Dump exe from memory.

2.
Search/replace-patch all the push/push/INT3 sequences with "call <own dumped copy of decryption procedure>".

3.
Enjoy your working exe. :D

Is there any better way to protect???No, not a single way! Ok, just kidding, maybe a couple... of millions. :devil:

And again, please see my comments above, about the relatively grave problems with the whole jump patching concept to begin with (not only performance related, and about that, the performance hit with your described method will be far from "not very important", believe me...).
Hero
09-23-2004, 05:52 AM
Hi
What an exact attack! :D
I thought this attack on this algorithm
but I can't find any better way to prevent
dumpers and debuggers to dump or debug
my protected application.

No, not a single way! Ok, just kidding, maybe a couple... of millions.

Is there anybody to tell me Only one way
to prevent debuger and dumpers to debug or
dump my protected application? :confused:
Who can tell me a better algorithm? :-/

Note:I know it is almost impossible to make a
program protection uncrackable,But I only want
to prevent a normal crackers to crack it.

sincerely yours
dELTA
09-23-2004, 09:40 AM
As you say yourself, you can never really prevent it, only make it harder. One theoretical way to make it harder to dump the program, while still sticking to at least a similar concept as the original one is to keep encrypted copies of certain code pages in dynamically allocated memory (possibly in a separate process space), and then decrypt them in response to page fault exceptions generated by manipulating the memory permissions on the corresponding code section pages. One important difference from your scheme is that the encrypted data will not follow with a dump. It will also be much faster and less prone for errors.
Hero
09-23-2004, 12:18 PM
Hi
I read the last reply,Perhaps I don't get the algorithm correctly,
but in general,Paging a program will make to many problems because
of Jumps.
With the Locality Law a large number of jump targets in a page will
be in the same page,but calculating the other jump targets that is
not in the same page is a problem and replacing new page with old
one will happen to many times that will slow down the program to
much(even there is no decryption). :mad:
But if I don't get algorithm correct,please tell me more detials.

Sepecialy thanks dELTA for its replies. :D
sincerely yours
dELTA
09-23-2004, 02:05 PM
I'm not sure what you mean, there is no need whatsoever to care about any jumps or jump targets with the method I suggested? And no, it will not be slow, and especially not compared to what you suggested earlier. :) You do of course not have to replace the protected pages for each instruction, you could for example replace one restored page with a "tripwired" empty page (preferably using an algo that selects these pages to be far from each other in memory) everytime you restore another such protected page due to a memory violation exception from it.

Also, if at all possible I'd prefer not being referred to as "it". :p
Hero
09-23-2004, 02:58 PM
Hi
Before every thing,My english is not very well then I
am sorry for errors.I correct my sentence:
Sepecialy thanks dELTA for his/her replies. :p

But As I said,I don't get the algorithm correctly:
keep encrypted copies of certain code pages in dynamically allocated memory
You mean all the code segment is encrypted?then its decrypting gets
too long.

In addition,This method will prevent debugging?If this algorithm is as I
think,a debugger can run the program normaly and debugger prevention
will not be added.

thanks so much for help.
Clandestiny
09-23-2004, 03:36 PM
As dELTA states, the performance hit of your suggestion is FAR from non-trivial. I can speak on this idea from experience. A while ago I was playing around with writing a "profiler" tool that could do a sort of coarse grained trace of control flow altering instructions like jmps and calls. I implemented this as an IDA plugin to get all of the jmp references and then wrote a debugger to set int 3 breakpoints on them and log them... This is similar to what you are proposing, but I digress... Suffice it to say that I ran Notepad under this scheme, and a couple minutes later the main window came up on the screen, lol. Perhaps this is an acceptable overhead for tracing an application. It is not, however, acceptable from the end user point of view. And just in case you think I'm running this on an old Pentium 100 MHZ, it is a reasonably up to date machine with a 2.2 GHz processor and 1.5 GB memory.

Cheers,
Clandestiny
dELTA
09-23-2004, 04:26 PM
afshin_pir, don't worry about the English, just kidding. ;)

You mean all the code segment is encrypted?then its decrypting gets
too long.No, you can select any arbitrary number of random pages to do this with, not necessarily (and not to be recommended) all of them.

And no, this scheme does not have anti-debugging "build into it", but it is probably most wise to separate the two (anti-dumping and anti-debugging) for best results anyway (search for separate anti-debugging tricks). Well, actually you do get something of an implied "protection" against direct debugging of the application by a ring 3 debugger anyway, since it won't be able to attach to the process when it is already being debugged by your parent protection process. :)
Hero
09-24-2004, 01:32 AM
Hi
then you mean at the last phase I use an algorithm that
run my application in debug mode then a debugger can't
debug it.
But still for dumper i think that the program will dump in this way:
---
---
b:
decrypt a
---
run a
--
jmp b

when replaced by:
---
---
b:
decrypt a
---
dump a <----cracker jmp to dumper for dumping a
run a
---
jmp b

You don't think so? :confused:
sincerely yours
Aimless
09-24-2004, 02:47 AM
I think along with stupid newbie questions, questions related by protectionist authors should also be banned on this board.

Pseudo crackers-who-can-also-protect-and-knowledge-is-free-so-give-out-how-leet-you-are-by-teaching-others-how-to-protect stuff should also be banned.

I think we are endangering our cracking by going into too many protectionist advise. It seems people on this board are begging to big companies who may be lurking around(look how leet I am!!! I can also protect!!! Offer me a gazillion dollar paying job in your organization.pleaeeaasseee!!)

What do you think?

Flame On

Have Phun
LiSa
09-24-2004, 04:49 AM
hello,
this type of redirection is also done on a malicious protection I investigate year ago :

prg -> self decryptinghread
thread call drivers which also decrypt himself and instaure permanent int1, int3, dr content, GD hook&check
now, in thread
push adress
embedded int3
then you go to drivers which check debugger and process responsible of the int if ok set some parameters then go back to thread int3 handler
thread int3 handler decrypt pushed adress and alter program flow to go on.

It is of course difficult to debug, but as you are tending to hook system, any unsuspected mess with stack, NMI, interrupt levels tend to reboot. What will you do on a dual processor system ?

Such protecting system are not safe for the host computer, that is not good. Look how UCF is protecting some of their patch and you will see some obfuscation that bore tracers and reverser to death.

hope it will help you a little.
Regards
Hero
09-24-2004, 05:44 AM
Hi
This algorithm is not very well as what it said in replies.
But:
Last reply is correct when I only push target address.
my algorithm pushs two values:
push r
push t
INT 3
that:
r = required data such as register values,process ID,etc.
t = target

when I have process ID in hook my pushing r to stack I can
simply test that if our protected program is maked that interupt,
else we alow normal running of every thing.

sincerely yours
dELTA
09-24-2004, 11:39 AM
---
---
b:
decrypt a
---
run a
--
jmp b

when replaced by:
---
---
b:
decrypt a
---
dump a <----cracker jmp to dumper for dumping a
run a
---
jmp b

You don't think so? :confused: I'm not sure where this "b:" location is supposed to be located, and neither why it is in a loop, but if these protected memory pages are spread out in a random fashion, you can also quite easily prevent direct enumeration of them, which means you'd have to manually "touch" them all to secure a good dump. Also, making any such modifications would require changing the code of the parent debugger process in a non-trivial way, and then we are just back to the "nothing is uncrackable with enough effort" fact.
mahdavi
09-25-2004, 01:23 PM
Hi.

Where can i find more information about nanomites? :confused:
I am intrested in it.

yours sincerely.
mahdavi.

Hello,
Your protection idea to use int 3 isn't new.
Actually its a rip off of Armadillo nanomites.

I assume you are going to use a driver to hook int 3.
Im not really sure to understand how you will handle the jmps though.

how do you know where to jmp ? how do you handle the flags? etc

Also, UPX won't help to protect against disassembling. Sorry.
mahdavi
09-25-2004, 01:29 PM
clearly using RSA is not necessary.:eek: your protection schema is not based on encryption technique. it should be based on avoidind debugers and dumpers and dissassemblers and so on.
dELTA
09-25-2004, 05:20 PM
Where can i find more information about nanomites?
I am intrested in it.Hmm, I've heard about this great place, a messageboard I think... The admins are supposed to be really great too (not to mention handsome), I just can't seem to remember the name, RCE something... I've even heard they have a working search feature. :D
JMI
09-25-2004, 06:19 PM
Oh No. They actually have a "SEARCH" function into which one could put something such as "nanomites" and actually find information? Who'd a thunk it. :idea:

Regards,
Hero
09-28-2004, 08:51 AM
Hi all
After these replies I decide to change my algorithm
and goto paging tec.
The changed algorithm is following:
1-I will add some ring0 debugger detection to application.
2-Then I split code segment virtualy to parts,for example p1 to pn
3-Adding decryption code for following encryption to application
4-I change the jump target for each i>1 as following:
ti' = e(ti) xor MD5(i-1,ki)
that:
ti :last jump target
ti' :new jump target
e :encryption using Raijndal algorithm
MD5(i-1,ki) :means MD5 algorithm on virtual part i-1 using pattern ki
ki are a combination of TR(Trap flag) .

features:
1-Debugging this program is not too easy,because adding breakpoint
(INT 3) will change MD5 hash and targets will change.
2-Dumping is not correct.because for debugging we run application
in debug mode that TR=1,This will change ki and jump target will be
protected.

what about this algorithm?
do you think we can attack this one easily?

sincerely yours
dELTA
09-28-2004, 06:20 PM
I don't completely understand what you are saying here, you are quite unclear, but it seems you are still messing with the jumps and have also added tracing with the trace flag? This will still be all too slow if applied to larger portions of the program...
lifewire
09-29-2004, 11:25 AM
imho is MD5 overkill. you can detect breakpoints too using some way simpler hash algorithms.


Converting an old InstallShield Package
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Converting an old InstallShield Package
PDA

View Full Version : Converting an old InstallShield Package

Johnny C.
09-23-2004, 05:26 AM
Hi, I realy don't know much about installshield and I need some help.

I have an installshield package for a program that was created by an old version of installshield, I want to convert it to a newer version of the installer so it could be installed on newer systems without problems (I'm using installshield x).

Here is what I've done so far: I used isdcc2 to decompile the setup.ins file and Unpacked the Cab files ( data1, _sys1, _user1 ) using i5comp with the files seperated according to the the source cab and file groups.

I also created a new project in installshield x and replaced the setup.rul file with the decompiled one.

I need to know what to do next, where to place the files I've extracted, other files I need to decompile etc..

any help, suggestions, tips are welcome Please help in any way you can.
Solomon
09-23-2004, 05:37 AM
There is another way to do this.

Just install it on a fresh machine with some installation monitors on to see what registry keys/shortcuts/services/files/COM servers are added into the system, then reproduce it in your new installshield project.
Johnny C.
09-23-2004, 05:58 AM
I'm aware of that, but since the package is old the only way to run it seems to be in safe mode and that poses a problem with runing the installation monitors.

can you suggest an installation monitor that will run in safe mode ?

Also as I said before my knowledge of installshield is very limited and I would like to recreate the original install as much as possible including install options like minimal install custom install etc..
Silver
09-23-2004, 06:11 AM
If you get a new version of InstallShield (I think Wise does it as well), it will take a snapshot of your system before the installation, run the installer then take another snapshot. It then diffs the snapshots to produce an installation script, which will do exactly what you want. Best thing is, it's not a "monitor" tool so it won't interfere.
Johnny C.
09-23-2004, 06:37 AM
Thanks Silver I'll explore that option, but still if anyone has information that will help me recreate the installtion from the old files please post.
Johnny C.
09-23-2004, 09:22 AM
Silver, I have looked for the feature you mentioned but I can't find one that does that. The version I'm using is the newest most complete version of installshield, can you point out how you access that feture, or the exact name of it in installshield ?
Can you also tell me in what version of installshield did you see it ?
Silver
09-23-2004, 09:39 AM
It's been a long while since I've done it (I actually had to do it for a contract I was working on), but here is a start: http://www.installshield.com/products/adminstudio/features/repackage.asp?source=

Look at the "Installshield Repackaging Wizard" screenshot on the right. The second option in the wizard is "Snapshot". Can't remember exactly how or what you need to do to get that working, but there's the proof it exists...
bilbo
09-23-2004, 09:46 AM
Regshot (http://wasm.ru/tools/17/regshot.zip) is fast and small, and runs in safe mode too... It can take a snapshot of registry and file systems before and after, and then compare them. It comes with sources too...

Regards, bilbo
Johnny C.
09-23-2004, 09:58 AM
Thanks Silver, I'll have to wait until I get adminstudio to check it out, what I have right now is installshield and adminstudio is a different product.

Thanks for the suggestion bilbo perhapse i'll give it a try, but I'm still looking for information on how to rebuild from the old files if anyone could help.


YAPEQ - "Yet Another PE Question"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > YAPEQ - "Yet Another PE Question"
PDA

View Full Version : YAPEQ - "Yet Another PE Question"

Silver
09-23-2004, 08:34 AM
Okay, so I've come across another conceptual problem I have with the PE structure. Not sure why I didn't notice this before, but anyway.

I was unpacking a target packed with a slightly mangled UPX 1.25 (-d wouldn't unpack it), but ran into some problems. So I grabbed upx.exe and upx'd notepad to test the process (I've successfully unpacked upx manually before, so I figure I've just forgotten something). Long story short, I dumped and fixed it without problems, and used Imprec to rebuild the IAT.

When I looked at the PE directory info, I noticed something I don't understand (from procdump PE editor, directory structures editor):

Original notepad:
Import table RVA: 6D20 Size: C8
IAT RVA: 1000 Size: 324

Dumped & Imprec fixed notepad:
Import table RVA: 1D000 Size: B4
IAT RVA: 0 Size: 0

I understand the Import table RVA/size is different due to a new section by imprec, that's fine. What I don't understand is how & why the dumped/fixed notepad still works when the RVA for the IAT isn't set?

I've read a number of PE tutorials & docs, and they don't explain this very clearly (ie: the difference/use/function of the import table entry and the IAT entry in the PE structure). Quote from http://msdn.microsoft.com/msdnmag/issues/02/03/PE2/default.aspx

The anchor of the imports data is the IMAGE_IMPORT_DESCRIPTOR structure. The DataDirectory entry for imports points to an array of these structures. There's one IMAGE_IMPORT_DESCRIPTOR for each imported executable. The end of the IMAGE_IMPORT_DESCRIPTOR array is indicated by an entry with fields all set to 0. Figure 5 shows the contents of an IMAGE_IMPORT_DESCRIPTOR. Each IMAGE_IMPORT_DESCRIPTOR typically points to two essentially identical arrays. These arrays have been called by several names, but the two most common names are the Import Address Table (IAT) and the Import Name Table (INT). Figure 6 shows an executable importing some APIs from USER32.DLL.

Okay, so that says to me that the import table directory entry in the PE header points to a location within the exe that contains 2 arrays - the IAT and the INT. Fine. But if I read part 1 of that essay, I see the following:

IMAGE_DIRECTORY_ENTRY_IAT - Points to the beginning of the first Import Address Table (IAT). The IATs for each imported DLL appear sequentially in memory. The Size field indicates the total size of all the IATs. The loader uses this address and size to temporarily mark the IATs as read-write during import resolution.

Okay, so that says that the IAT directory entry points to the start of the first IAT (which up until now I thought was exactly how this worked).

The original notepad PE has values for both import table and IAT in the directory. The dumped version has no value set for the IAT in the directory, yet it works.

How can the dumped Notepad work without an RVA for the IAT? What am I missing here?
doug
09-23-2004, 08:54 AM
This might not be the kind of complete answer you are expecting, but...

I can't think of a situation where these fields are required.

This is just pointing to the start of the first IAT. What about the others? where does the loader get them? in the IMAGE_IMPORT_DESCRIPTOR. So if it can get the others' IAT from there, there's no reason to have a special case for the "first IAT", it just grabs it from the IID as well.

the loader just does everything from IMAGE_IMPORT_DESCRIPTOR.

Even though most compiled PE files have all their IATs (i.e: for all imported DLLs) in a sequential way. You can build a perfectly valid PE valid with IATs scattered all over the file; as long as each imported DLL's IAT are in 1 sequential block (and 4 bytes-NULL terminated) AND that your IID is correctly built.

I've never bothered with these two PE header fields (rva&size). The way I see it, these fields are redundant. I don't think there is a rationale behind this. performance? legacy feature?
Silver
09-24-2004, 05:45 AM
I've never bothered with these two PE header fields (rva&size)

For the IAT directory entry, you mean? So in other words, the IAT directory entry is irrelevant if the import table entry points to a valid IID array.

Interesting. Anyone else have any further thoughts on this?
doug
09-24-2004, 01:23 PM
yes, when I have to, I rebuild a proper IID and set the new rva&size in the pe header.

as for the IAT directory entry, I usually reset rva&size to 0.
--

So in other words, the IAT directory entry is irrelevant if the import table entry points to a valid IID array.

Yes, but since the IID has to be valid if you want the PE to be loaded at all; the IAT directory seems to always be irrelevant.

I did not look at the w2k source code, but I think the code for the pe loader is in there. Perhaps a better answer can be found there. Try grepping the loader source code with the IAT directory entry symbolic constants.
Silver
09-25-2004, 09:52 AM
Thanks for info doug.
homersux
09-27-2004, 06:05 PM
Matt Pietrek in his MSJ columns have described PE structure extensively. IAT is completely irrelevant on disk. It only matters when the loader loads the PE file into memory and constructs the executible image.
nikolatesla20
09-27-2004, 08:54 PM
Exactly, IAT RVA is not used by the loader. Most likely it was to be used by debuggers, etc.

-nt20
user
09-27-2004, 09:21 PM
This is not right. The loader does use those information if bound import directory exists. I'll let you try to find the explanation as an exercice :), I can't be arsed to explain as you all seemed agreeing on the question. Here is a hint: it's linked with speed improvement.
homersux
09-28-2004, 09:04 AM
hi, user, what you said is correct, but binding is a somewhat ancient technique now and most people will tell you it's not recommended to sacrifice compatibility for the little speed gain. The binding technique were mostly used in old times where loading time is critical on slow computers or during system boot up by windows. It's not surprising that binding is mostly used by windows loading process. I'd say 99.94% PEs are not bound therefore our statement is practically correct.
Silver
09-28-2004, 12:47 PM
homersux, the article I linked to in my first post is the Matt Pietrek article, so unless you mean a different one then I stand by my original assertion that it's not very clear on the subject. IAT is of course irrelevant on disk, but I believed that the directory entry for it was not.

Thanks for the replies.
user
09-28-2004, 06:48 PM
sacrifice compatibility? Hahaha. Either you have a poor understanding on how it works or ur words went a bit further than your thoughts (I'll go for second one).

First of all it's not ancient, check your calc.exe, notepad.exe and you will notice it's still in use. U sacrifice nothing by doing so, u add extra informations that will help the import resolver to speed up if DLL versions matches. I understand why you'd say that but it's innacurrate, it's enough for a newbie to know for sure. But frankly even if it was the case, practically true is still not true in my book.

In the field, for a normal application if it has to be run on multiple of version, it is for sure a waste of time (even though not a problem for 100% correct execution), BUT if you have an application targetted at a specific SP or build, it's worth the effort.
homersux
10-03-2004, 01:47 PM
user, your examples is an annotation of my statement, binding is mostly only used by MS programs to speed up loading time. Most PEs not produced by MS don't use this technique.

Silver, maybe I missed your link, but it'd be the link I'd recommend to anyone who has a PE question.
user
10-03-2004, 08:24 PM
Homersux: I was merely correcting your statements regarding the IAT usage, and the compatibility argument you and other advanced. It's not an annotation, it's a correction/precision. Dispatching incorrect/incomplete information is source of a lot of errors. I personally don't care on the matter itself, feel free to consider it ancient and a source of compatibility problem.

Silver: Anyway, the loader doesn't use the IAT area, it will overwrite it (if no bound import exists). Check a borland generated EXE, and you will see there is no IAT dir. You will notice too that IMAGE_IMPORT_DESCRIPTOR.OriginalFirstThunk is NULL and only FirstThunk is used. FirstThunk acts there as both name/ord table and IAT. The minimum is really having FirstThunk field filled with infos.


Os architectry
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Os architectry
PDA

View Full Version : Os architectry

ReVeR
09-23-2004, 03:25 PM
I was wondering if anyone got an article on os architecture for noobs?(With focus on windows maybe? the nt series). the memory managemnet and such.
i found some but they were either too shallow, and didnt give enoguht info, or were too complex for me to understand.....
.Thx.
dELTA
09-23-2004, 04:18 PM
OS architecture is sorta not for newbies by definition. :) I'd suggest you'd get well aquainted with ring 3 first, and then start with the stuff below.

One example of a good book describing NT architecture is "Inside Windows 2000" anyway.
Hero
09-24-2004, 12:27 AM
Hi
I don't this is against low of this forum,because this site
has no crack,warez,serail,etc.
But is you search you can find ebooks about computer
concepts in it(non commerical):
http://www.intelinfo.com

enjoy! :D
Silver
09-24-2004, 05:49 AM
The WindowsNT/2000 source code is out and about on the net as well, if you're interested in seeing the way Microsoft builds their code (and all their //BUGBUG: comments, :D )


Problem with KD (Kernel debugger) from WinDBG pack.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Problem with KD (Kernel debugger) from WinDBG pack.
PDA

View Full Version : Problem with KD (Kernel debugger) from WinDBG pack.

Neitsa
09-24-2004, 06:34 AM
Hello,

I have a problem with KD to display the whole structure of the TEB. In fact each time I'm trying to display these struct, KD tells me that it can't find the symbols file... (Note that the _PEB struct works well).

I've tried many commands but none seems to work. The "!teb" command works well, but the "dt _TEB" doesn't works. (I've also tried "dt -v -r ntdll!_TEB" or "dt nt! _TEB)

Sounds strange since I can display the _NT_TIB struct but not the entire _TEB.

My O.S is win2k with sp4. I've also tried to force the load of the ntsdexts.dll which is having the instruction to display the structure. I've set my symbols path to the symbols package, and I've even tried to set my symbols path to the web server from MS, and even downloading the whole symbols for my O.S, it won't works....

So what I'm doing wrong ? Do you have any clue ?

Thank you very much.

Regards, Neitsa.
Kayaker
09-24-2004, 04:56 PM
Hi Neitsa,

Are you sure the TEB structure is fully recognized on Win2K? I thought that's what was determined in the thread you started, on why !teb doesn't recognize all the fields, and the circus of chaos and confusion it caused...

On XP as Bilbo showed, dt _TEB works fine, but on Win2K I only found

0: kd> .load kdex2x86
0: kd> !strct teb
Structure is not in database.

http://66.98.132.48/forum/showthread.php?t=6258&highlight=teb

I was under the possibly mistaken assumption that the 'dt' command was for XP only, you get valid results on 2Ksp4? I get the same error as is discussed in the Anticrack thread on the same topic, about having invalid pdb symbol files even with Windbg connected to the MS symbol server.

Cheers,
Kayaker
Neitsa
09-24-2004, 07:05 PM
Hello,

thank you very much for your answer Kayaker.

This afternoon I disassembled the "ntsdexts.dll" on the win2kfree directory. This dll holds the !TEB struct. What I've seen is that the DLL doesn't have the whole struct....(Also disasm kdex2x86.dll and no TEB fields there).

So you're right Kayaker, the whole _TEB struct isn't in win2k ! (damn, it's a shame !!!)

I was under the possibly mistaken assumption that the 'dt' command was for XP only, you get valid results on 2Ksp4?

"dt _PEB" works well on 2k, but as explained before, not for the TEB...

So definitely, the whole TEB is missing for 2k (note that _NT_TIB is here). I wonder why MS doesn't put this struct on KD for Win2k ?!

Since I can have an access to a win XP, I think I'll dump the TEB on XP for a program that Ive coded, and do the same thing on win2k, and just compare the results...It will be long and maybe impossible to recover the meaning of all fields if there's too many differences, but I think it's worth the try...

Thanks for your reply Kayaker.

Regards, Neitsa.


Mini Research Project (Crackme) - 25/Sept - 11/Oct
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Mini Research Project (Crackme) - 25/Sept - 11/Oct
PDA

View Full Version : Mini Research Project (Crackme) - 25/Sept - 11/Oct

aikon987654321
09-25-2004, 02:21 AM
Dear All,

I am assisting in coordinating a mini research project on the topic of "Software Copy Protection Reverse Engineering".

This is a very simple experiment aiming to understand more about "software copy-protection reverse engineers".

Attached is a simple "crackme" written by the project team.

Even an amateur can attempt it. But participation from experts are also very much appreciated to make the experiment a success.

What you need to do:

(1) Read the description of the crackme program (Research_Crackme.txt)
(2) Break the software copy protection of the program (the level of difficulty is set to minimum to ensure optimum participation)
(3) Complete the questionnaire (Questionnaire.txt)
(4) Password protect (zip/rar) and attach your patcher/loader/keygen/serial & questionnaire. Then PM me the password (so that others cannot see your answer/response).

If you have questions about the experiment, you can post it here. But if you have questions about the crackme, please PM me instead so that you will not confuse/influence the thought process of other participants.

Thank you for your time.
sna
09-25-2004, 04:45 AM
Hi.

Could you please provide some more information on the experiment and its purpose?
Who do you represent, what is the overall goal, how will results be compiled and presented etcetera.

Regards, sna
naides
09-25-2004, 07:16 AM
We need a legally binding informed consent, with a confidentiallity clause.
We also need tangible proof that you are who you say you are. . .
By the way, who are you?
Neitsa
09-25-2004, 08:01 AM
Hello,

I agree with Sna and Naides. It seems that you're awaiting something for reversers without providing much infos on who you are, at least, who you are representing...

What will be the result of all gathered informations. Will you publish something ? Does it will help your company to make a stronger protection ? Will you make a blacklist of all nicknames ? Will you enforce protection against tools we use ? ...

well many questions without an answer....

Regards, Neitsa.
aikon987654321
09-25-2004, 10:06 AM
Dear All,

My apologies for not providing more information.

I'm not representing any companies. The purpose of the research is to gather statistics via a controlled experiment on the topic of software copy protection reverse engineering, for a final year project (university). The aim is to understand the behaviour and "thinking process" of a reverse engineer.

If you need more information, I can provide via PM. The reason for not disclosing publicly is also not to turn the research into something high profile.

In the final report, only the number of participants will be mentioned, and the results from the experiment (e.g. tools that are commonly used, methods that are preferred, etc.). Although this information can be found on the web, they cannot be substantiated without a formal controlled experiment. I'm sure many of us who have graduated know this fact.

You do not need to disclose any information about yourself other than your nick name.

I hope I have answered most of the questions.

Apologies & regards.
dELTA
09-25-2004, 11:39 AM
Why is the nickname needed?

:p
aikon987654321
09-25-2004, 11:51 AM
hi dELTA,

Any nickname is accepted. It is to "identify" the participant in the experiment. If you choose to be completely anonymous, then we will just give it a number, e.g. participant001.

Appreciate all the feedback. We are really sincere about this mini research. Hope that you can participate (and help us graduate) ;) .

Thank you.
Silver
09-25-2004, 01:09 PM
If we do choose to participate, how do we return the rar to you? I doubt woodmann will want a load of attachments on a forum thread that no-one can open because they're password protected :D

Also, can I ask exactly what you're hoping to achieve from the questions you ask in the questionnaire? They don't seem to be targeted enough IMO. You're going to come out with x people with x years experience used tools x, y and z. That's not going to provide you with any inisght to the thought process, because you have already admitted that the protection is trivial (I've not looked at it myself yet, BTW). The only conclusions you'll make are that most reverse engineers use similar techniques of a, b and c to achieve their goals, a conclusion that will hold true only for the type of reverse engineering required for this crackme.

I'm just having trouble seeing why/how the results of this "experiment" are going to help you with a final project...
aikon987654321
09-25-2004, 07:51 PM
hi Silver

Thank you for the feedback. After the experiment is over, I will post the discussion/solution/findings for everyone's benefit. The main reason is not to influence the thought process of others.

Actually, this experiment is only a small part of the project. The thought process needs to be inferred from the final results (based on the experience, what method is preferred, e.g. to prove or disprove that those with less experience may not write keygens etc).

Whilst the conclusions will hold true only for this crackme, generalisations are also made based on other research and findings.

This forum is a good avenue, because it reaches out to more people. Interviewing face-to-face is time consuming and limited to people whom you know.

I know this may not be very convincing, but it does contribute to the project.

I hope you can participate too.

tq & regards.

----------------
So far, I have received 10 participations, and had really good discussion with the participants. Really appreciate it. I hope I can get 30 participations to increase the credibility of the results.
----------------
NeO
09-27-2004, 09:03 AM
I dont know but i got a felling that we are like ginny pigs in here,,

Maybe i was wrong.. He can be fbi agent colletiong infos about us :loveu:

Bye NeOXQuiCk
NeO
09-27-2004, 09:12 AM
What can i say.. maybe i was doing to much fuss over nothing .. but i can tell you guys this is too easy..2s of everyones time..

If this would be real protection i would surelly pay money for it..Its worth -100$ :D code something more interesting something more hard ..that you will involve ppl with good and bad knowledge ..with your crackme you cant really do a research since everyone can do it.. :sneaky:

Bye,, everyone even guys that dont crack can get a light on this one :idea:

NeOXQuiCk :devil:
aikon987654321
09-27-2004, 09:24 AM
Hi NeO,

Thank you for your feedback.

with your crackme you cant really do a research since everyone can do it.. :sneaky:

You are right. The crackme should not be difficult for almost all who is a member of this forum.

But I would really appreciate if you could help by participating since it should not take a lot of your time, and yet it means a lot to the project team.

rgds.
Hopcode
09-27-2004, 01:19 PM
NeO,

<flame>
You often brag about things beeing easy, while you fail on them. (then say it seems easy and you don't have time blabla)

Don't try to guess who i am, you won't find.

But please, stop bragging, because you really don't have the skills to do so..

And im sure you forgot most of the hidden checks..
</flame>

What can i say.. maybe i was doing to much fuss over nothing .. but i can tell you guys this is too easy..2s of everyones time..

If this would be real protection i would surelly pay money for it..Its worth -100$ :D code something more interesting something more hard ..that you will involve ppl with good and bad knowledge ..with your crackme you cant really do a research since everyone can do it.. :sneaky:

Bye,, everyone even guys that dont crack can get a light on this one :idea:

NeOXQuiCk :devil:
dELTA
09-27-2004, 04:53 PM
Err, ok, let's be civil now...
aikon987654321
09-27-2004, 06:28 PM
Hi SL0rd

Thank you for your point. But to clarify, no tutorial is required. Just to complete the questionnaire (and try to break the crackme).

I hope you can participate too.

regards.
Aimless
09-29-2004, 09:28 AM
I am beginning to get thoroughly confused by the attitude of the crackers here.

Just a few posts in a different forum, has people falling at each other's feet (try reading INT 3) to help the protectionist make his protection better.

Here he is trying to get a university project (real or faked: don't care) and people are jumping on him, calling him names and general crap by bored crackers.

How comez the difference?

Have Phun
JimmyClif
09-29-2004, 10:01 AM
Aimless, Hear, Hear!

I had a quick look at aikons little project and I can say I'm truly impressed. Maybe it's my fault that I have low expectations from people on Internet messageboards asking for university help (check out the homework threads at win32asmboard). Most people asking for help don't know a single thing and don't care about anything as long as someone does their work for them. Aikon here actually did research on tools used by most people here and added quite a couple of checks for them including SI detection. What I'm trying to say is that writing this sample prog was work, if someone doesn't want to do it fine, but there's no reason to beat him up for doing a survey.
Woodmann
09-29-2004, 02:45 PM
Hold on here...........

The bus will be here to pick up a few of you people very soon :eek:

Here is a tip my dad used to give me. "If you dont have something nice to say, keep your fucking mouth shut".

That meant shut yer yappin pie hole before I smack it shut.

Here are a few more tips.
If the FBI or CIA or MI5 or KGB or Scotland Yard or BSA were really concerned about this place it would have been shutdown long ago.
Keep yer yappin pie hole shut.

I can adjust certain settings on this board that will automatically rate each user. If you want to continue to post "you suck, Lamer" and other such shit
including poor posts with no real value,
I will allow all the users to contribute to your removal from the board VIA voting. Keep yer yappin pie hole shut.

This same rating system can be used in a variety of ways.
Contribute or keep yer yappin pie hole shut.

Woodmann
aikon987654321
09-29-2004, 11:26 PM
Thank you all for your support :yay:

In fact, I have also received many positive support via Private Messages (though not posted here on this thread).

If you have already spent time analysing the research_crackme.exe file, but have not completed the questionnaire, I hope you can just spend another few minutes to do so.

I will definitely share the preliminary findings on this thread when the experiment is over.

;)
NeO
09-30-2004, 03:55 PM
Ehh i need to replay on Hopcode :

You are right,, i am lameass but sometimes i can do it..
its just poor luck! i dont brag but sometime stuff are easy,,that all i was saying ..

And i didnt know i ofended you so much while i didnt want to look at your code !Next time i will!I am not skilled ,you are right about that i am not coder like you !So there for i dont pretend to do all!But if you looked at the stuff he coded i am sure you would agreed!If not then you are better then me ,,what can i say,...

So never the less i am not trying to quess who you are :)

NeO
esther
10-01-2004, 05:40 AM
Wootmann,
You mean the driver is ORC? LOL
Woodmann
10-01-2004, 07:19 PM
;)

I think Kayaker was the one who said it.
The guy who drives the bus get's paid in cash so,
it is no matter to me what his name is. :smug:

Woodmann
%UNDEFINED%
10-05-2004, 08:58 PM
I am assisting in coordinating a mini research project on the topic of "Software Copy Protection Reverse Engineering".

This is a very simple experiment aiming to understand more about "software copy-protection reverse engineers".

Interesting I find it that you ask for a very short question are of the methods used to break the protection.

Yet you state your interest is in the "reverse engineers". Yet no census or psychological type questions are asked.

Such as:

What country we reside in?
What fields we work in?
Why we do this?
Etc...

The few questions that are asked are in relation to solving the protection.
If that is your interest in common methods of defeating anti-debugging tricks and general R.E. why post this thread?

Why not simply browse existing threads and make notes?

Or read the thousands of existing tutorials http://zor.org/krobar

I don't mean to act like I am flaming you, I just don't understand.
aikon987654321
10-05-2004, 11:12 PM
hi %UNDEFINED%

Thank you for your feedback & interest in this thread.

Why not simply browse existing threads and make notes?

Or read the thousands of existing tutorials http://zor.org/krobaram

I just don't understand.
A few more days and the experiment will be over, and I would be able to answer your questions in more detail, as well as sharing the results.

I'm sorry if my explanation sounds rather not convincing. Those who have participated (11 so far) would have understood my predicament. For those who have not participated, appreciate your patience. :cool:
stephenteh
10-06-2004, 07:29 AM
y u guy are so panic to take part in the project ?
if u want to remain anonymous then u just dun put ur nick under the questionnaire...
( i think aikon987654321 dun care about the nick....)
and continue answering the remaining questions.....
sigint33
10-09-2004, 12:04 PM
I don't know as much as what the newest newbie has already forgotten, but this one is stupid - it's a 1 byte fix.

SiGiNT
Kayaker
10-09-2004, 12:26 PM
I don't know as much as what the newest newbie has already forgotten, but this one is stupid - it's a 1 byte fix.

SiGiNT

Hi, you obviously miss the whole point, as well as not having understood the earlier posts in this thread. Instead of calling it stupid for absolutely no reason take it for what it is. At some point in your "newbie" career, you would have been completely lost at how to proceed. Now you're too cool for it. Well, that's great, but if you can't learn at least something from it, then you're doing it all wrong. Your contribution has been much more worthy, thanks. GEESH!

Kayaker
sigint33
10-09-2004, 12:47 PM
Don't mis-understand me, my motto is "when you stop learning you start dying", I definitely learned from this one, not to be distracted by the obvious diversions, and thanx, (really!), for reminding me of that. No flames intended - the "stupid" remark was a reflection of my realization that I was being mis-lead by some of the code. I hope to make friends here and I don't need to give the wrong impression, if anything it was fun and gratifying when I found what I needed to do.

SiGiNT
Kayaker
10-09-2004, 01:13 PM
Hi, that's a good motto :)

Kayaker
Silver
10-09-2004, 01:30 PM
I'm looking forward to the closing of this crackme and aikon posting the results, as it raises some interesting questions...
aikon987654321
10-10-2004, 03:51 AM
Ok, the experiment is over ;)

To clarify some earlier queries:

(1) No, i'm not a lamer looking for "free" tutorials, this is in fact a serious research. But i'll always consider myself a newbie ...
(2) I've been doing reverse engineering since 1996. My first debugger was SoftICE 2.0, did my first keygen in 16-bit assembly ..

and about the experiment:

(1) The "real" aim is to see how effective it is to "mislead/trick" reverse engineers into thinking a copy-protection seems easy, using debugger detection methods to lead them to the decoy algorithm, rather than using offensive anti-debugging tricks

and the results:

(0) 12 participated - 4 amateurs, 6 intermediates, 2 experts
(a) All participants rated the copy-protection as “Easy”, but not one provided a completely working solution at first attempt (i.e. all was tricked into prematurely attacking the decoy algorithm). The participants were told to retry until they succeeded or opted-out.
(b) Only one provided a completely working “key generator” on the third attempt.
(c) Three provided serial numbers that only defeated the fake algorithm.
(d) The remaining eight provided patches; only 3 were completely working (2 to 6 attempts taken).
(e) Eight opted-out from the experiment after the first attempt on the reason that it would have taken them too much time to provide a working solution.

And, I have to specifically mention these 2 participants:

(1) N*****a - the one and only participant who did a completely working keygen => you have the BEST solution
(2) I******t - really respect your endurance, you did it in 6 attempts with a patch!

And for saying "thank you", I have 6 Gmail invites - those who have participated can ask for it if you're interested by sending me a PM ;)

For those who have not participated, you can give it a try, now knowing that the crackme is "a little harder than easy" and is good for your brain ;)

p/s: and those who said "this is just a 1-byte solution", you obviously fell for the fake algo. You need at least "2-bytes", if you know where to find them :cool:
sigint33
10-10-2004, 11:46 AM
OOPS! just realized explaining my 1 byte fix would ruin the fun for others - deleted that info in this post. I've explained it in a PM to you Aiken - it does work, and opens, edits, and saves - fully functional.

SiGiNT

As it turns out, I didn't fully test the prog - print is not enabled, and Aikon tells me that opening files sequentially will disable some menu functions.
blabberer
12-09-2004, 10:43 AM
well i read the read me after i double clicked the exe in w98 :) it crashes and takes the os along with a bsod
any way i loaded it the next time using ollydbg and see it working perfectly till int 41 it crashes on int 41 (w98 se) hope to look into it some time in w2k :) posted this in the hope to elicit info if some one has successfully ran it in w98 se
sigint33
12-09-2004, 07:07 PM
Disable int41 it's a debugger trap.

SiGiNT
blabberer
12-10-2004, 03:51 AM
dear sigint,
thanks for reply
yes i know int41 is checking for debugger

AX = 004Fh
Return:AX = F386h if debugger is present

See Also: INT 68/AX=4400h

the point i was raising was why should it crash the os and also corrupt the stack in w98 se i can understand if the return value 0xF386 was used to manipulate but just by executing int 41 the stack gets corrupt and eip is changed to some absurd value so when a ret is processed it returns to
some doomsday palace and takes the os along i was hoping for an explanation to this peculiarity
yes i can disbale int 41 or disable the whole SetUnhandledExceptionFilter crap and jump directly to WinMain
any way thanks for reply and still hope for an explanation :)

btw int41 does not crash in w2k even after execution as i patched the SetUnhandled it returns to the winmain via unhandled handler in w2k

is int 41 supposed to crash w 98 se on its own even when run without a debugger any tips,links are welcome thanks again
Neitsa
12-10-2004, 08:03 AM
Hello,

I have completely forgot this topic... Well, now it is up and the project is trully over, I can post the working keygen I've submitted to aikon if someone is interested :

It is coded in Asm, and little bit commented (this is not a tutorial).

Source code (radasm project) + binary file included

Just hope it could help...

Regards, Neitsa.
aikon987654321
12-14-2004, 11:59 PM
Hi there Neitsa

Very nice of you to share your great piece of work.

I didn't expect that it would generate any further interest ..., since most of us know that the trick is not to get tricked :p
Neitsa
12-15-2004, 04:17 AM
Hello,

Thanks a lot aikon987654321, but as you've say previously :

(b) Only one provided a completely working “key generator” on the third attempt.

Three attempts to make a working keygen ! :eek: I'm definitely not a 'master of the art'.

I didn't expect that it would generate any further interest ..., since most of us know that the trick is not to get tricked

Like, i think, many of the participants, I was fooled by the apparent simplicity of this crackme (I rated it "simple"), but it was more tricky than it was looking at first sight.

BTW, it was fun :)

Will your project/research results will be available to everyone (maybe on the net) ?

Regards, Neitsa.


File hiding
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > File hiding
PDA

View Full Version : File hiding

ReVeR
09-25-2004, 06:13 PM
Hey.
i was wondering how i can hide files and folders in win xp?
when i mean hide i mean so they are not seen by the windows explorer.....
any ideas?
thx
JMI
09-25-2004, 06:22 PM
Here's a hint. Put something really complex, such as "hiding folders from explorer" in you favorite search engine. Although I only got 22,100 hits, you might get more or less. :idea:

How about your start there and do some of the work to solve your own problem. :yay:

Regards,
0rp
09-25-2004, 06:48 PM
you can hook NtQueryDirectoryFile to manipulate the results of FileFind* api-calls

in ring0, as always
Woodmann
09-25-2004, 07:42 PM
, such as "hiding folders from explorer" in you favorite search engine. Although I only got 22,100 hits, you might get more or less.

"hiding folders from explorer" gave back nothing.
If you remove the quotation marks (you need to indicate these type of things ;) you will get much better results.
I got 22,300 :p
Of course you only need look at the first 5 to get an answer that seems reasonable.

TA TA, Woodmann
JMI
09-26-2004, 06:50 PM
True. I forgot to add my usual statement to that of: (without the quotes). :eek:

Regards,
verilog_crack
10-04-2004, 06:27 AM
....
Of course you only need look at the first 5 to get an answer that seems reasonable.TA TA, Woodmann
Hi,
I searched but all of the google top results suggest program and not a programming technique.
thanks
JMI
10-04-2004, 12:17 PM
So did that not suggest to you the possibility of downloading one of the programs which does the "hiding' and disassemble it and see how "it" does the process? Hum?? :idea: Or did you want someone to do the work for you and give you ready made code? Or course, if you look down below the top level search results, you would probably find that as well. :rolleyes:

Regards,
01111000
10-06-2004, 09:42 AM
Beneath my C[M]I-tool, what`s the problem w/ a simple registry manipulation ?


MASM Syntax.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > MASM Syntax.
PDA

View Full Version : MASM Syntax.

Innocent
09-25-2004, 08:04 PM
I am having a problem with an instruction in my code. I have made a function and in this function I have: mov ecx, username
When I try to compile I get a: "invalid instruction operands" error on this line. I already have username defined and everything but this keeps giving me an error.

Any help is greatly appreciated.

EDIT: Ha! I figured out that I should have been using lea ecx, username. Now I have just completed my first keygen yay!
JimmyClif
09-25-2004, 08:29 PM
or use:

mov eax, offset username
Clandestiny
09-26-2004, 05:53 PM
Hiya Jimmy,

Just saw your name and thought I'd say hi :) Long time, no see, eh?

Cheers,
Clandestiny
JimmyClif
09-27-2004, 11:16 AM
LTNS, true :) but still kicking :yay:


More Armadillo Stuff
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > More Armadillo Stuff
PDA

View Full Version : More Armadillo Stuff

is0x000
09-26-2004, 11:44 AM
Back to the work with an apparently new version of armadillo.
I don't know if it's something new but i haven't seen it before and i haven't been able to find anything about it searching the forum.
I dumped the file as usual,
BPX setprocessworkingsetsize, and find that magic call edi...
Once Dumped Iat Rebuilding

The program I'm unpacking have IAT moved to memory that is allocated in runtime, so all the jmp dword ptr [XXXXXX] points to directions out of the executable so even if you fix the iat with imprec the exe won't run cause the api direction table is missing. The rest works as always, iat redirection that needs to be pached to resolve all the pointers...
How i solved this problem...
I patched the iat redirection routine (thanks Crusader for your tutorial) to obtain a clean pointer table, once the table was filled I made a dump of it. After that, I opened my dumped exe and found a clean place in .idata to stick my dumped table and I coded a lame tool to fix all the jmp dword ptr [01155XXX] to point to my table in the exe substracting the offset on each pointer.
Once I fix all and have a running exe, imprec can be used to refix the iat to be able to run the program on any pc.

Now my problem, after iat fixing, I found the unseen before trick. some (a lot) instructions are replaced with jmps that points to code tables sizeof(1000h) that contains the removed instructions+ some unusefull instructions and ends with a jmp to the next instruction after the jmp to the table.
Now comes to my mind some ways to fix the problem but I would like to know if somebody have seen this before or have an idea to solve the problem.
I haven't analysed all the exe but I imagine that after fixing jumps I will also have to fix nanomites... Long time waiting something interesting to take a look! Let's get the party started...

I have attached a dump of my rebuilded iat table and the first jmp table code.
The jmp table I have attached begins in rva 02691000 I hope that somebody can help me solving my problem.
thank you in advance...
sonkite
09-26-2004, 12:09 PM
I believe you are refering to code splicing.

00A51F43 6A 40 PUSH 40
00A51F45 68 00200000 PUSH 2000
00A51F4A FFB5 78E6FFFF PUSH DWORD PTR [EBP-1988]
00A51F50 FF35 D891A600 PUSH DWORD PTR [A691D8]
00A51F56 FF15 B0B1A500 CALL DWORD PTR [A5B1B0] ; kernel32.VirtualAlloc
00A51F5C 8985 80E6FFFF MOV DWORD PTR [EBP-1980],EAX
00A51F62 83BD 80E6FFFF 00 CMP DWORD PTR [EBP-1980],0
00A51F69 74 33 JE SHORT 00A51F9E
00A51F6B 6A 40 PUSH 40
00A51F6D 68 00100000 PUSH 1000
00A51F72 FFB5 78E6FFFF PUSH DWORD PTR [EBP-1988]
00A51F78 FF35 D891A600 PUSH DWORD PTR [A691D8]
00A51F7E FF15 B0B1A500 CALL DWORD PTR [A5B1B0] ; kernel32.VirtualAlloc
00A51F84 8985 80E6FFFF MOV DWORD PTR [EBP-1980],EAX ; change eax to empty section (i think adata)
00A51F8A 83BD 80E6FFFF 00 CMP DWORD PTR [EBP-1980],0
00A51F91 74 0B JE SHORT 00A51F9E

That will make armadillo jump to the section instead of allocated memory.
is0x000
09-26-2004, 12:59 PM
It was better to wait your aproachment cause I would have spent hours coding lame things to solve problems that can be fixed in an easier way.
Thank you for your fast reply.


problem with NTFS file encryption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > problem with NTFS file encryption
PDA

View Full Version : problem with NTFS file encryption

Hero
09-28-2004, 07:25 AM
Hi all
I using NTFS file encryption for preventing others to
use my private files.
Everything is going well,Until Today I get a strange
problem with NTFS file encryption.
Yesterday I repalce my problemed network card with
new one and setup it normally (Only this change)but
it affect my encrypted files and this files can't be
opened again.
WHY?????!!!!!!! :confused:
It terrible that lost all of my files!

sincerely yours
dELTA
09-28-2004, 07:33 AM
Sounds very strange, the encryption keys should not be bound to the hardware in any way, only to the user accounts... Exactly what happens, can you access the harddisk at all? Are there any error messages? Maybe the drive was damaged while you were poking around inside the computer?
Hero
09-28-2004, 08:37 AM
No there is no error message
everything work correctly(every file is accessable normaly),
except ones that encrypted before this accident.
TQN
09-28-2004, 09:07 AM
Yes, dELTA. It is strange. May be a bug in NTFS part of Windows, because I known the GUID number created with some information of network card.
afshin_pir, what your Windows OS ?
TBone
09-28-2004, 11:00 AM
If you still have the old network card (even though it doesn't work quite right), can you just put it back in, decrypt the files, and then replace the card?

I agree, though. This is very strange. Even if GUID's are generated using info about your network card, they don't change once the account is created.

The only explanation I can offer would be if you were using a domain account. If your new card isn't working, you might be logging on with a local account on your computer instead, and just didn't notice. Of course, you'd have to have a local account with the exact same username and password as your domain account for that to work, but it's certainly possible if you're using the "administrator" account. I've seen a lot of windows domains where some admin thought it was safe to use the same password for the local admin account as he uses for the domain admin account.

At any rate, if you had it defined in group policy, there should be at least one recovery account -- usually "Administrator" -- which can decrypt anyone's files.
Silver
09-28-2004, 12:51 PM
There are no GUIDS that affect EFS in this way. EFS is handled via your private keys, which you can export from any MMC certificate snapin. It sounds like either a) your private key in the user account certificate store has been corrupted, or b) the files themselves have been damaged in some way. When you say "can't be opened", what do you mean precisely? If a user attempts to open an EFS encrypted file owned by another user, they'll get an "access denied". Otherwise the process is transparent. You could also try dragging them to a FAT32 drive (or floppy), which will cause Windows to decrypt on the copy.

One other option is to log on as the EFS Recovery Agent (local admin if it's a workgroup machine, domain admin if it's in a domain) and use escrow to recover the files.
verilog_crack
10-04-2004, 06:05 AM
Hi,
It's very strange. :eek:
Can you tell me your windows version.
I think you can access your file if you login as administrator.
or if your previous network card is in a perfect condition or you have access to it so try it.
I use it at win2000 and win2003 without any problem.
so tell me your version.
regards
TexNAss
10-17-2004, 09:38 AM
A bit of inside info... Remour control has it that the magic code is generated by your mac address which is lifted from your NIC....

If this is correct (and I am not saying it is; because i haven't peeked, only heard) then I'd guess thats what happened.. And in some ways it makes sence...

If i was 'attain' your HDD, the only thing between your data with encrypted file system and me would be your logon password..

Even if we had the same CPU, motherboard, our NIC's mac address would be different.. So it makes sense...

**Greetz to all the ole school lads who are lurking around**
:loveu:

-=-ADDED-=-
http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PG01&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.html&r=1&f=G&l=50&s1='20010044782'.PGNR.&OS=DN%2F20010044782&RS=DN%2F20010044782

==============SNIP===============
[0015] In one aspect, the system includes a software product resident on a computer, the software product having an associated product ID. The software product generates a hardware ID that identifies the set of hardware components on the computer. In one embodiment, a 64-bit hardware ID that identifies a set of ten hardware components within the computer is derived. The 64 bit hardware ID represents ten different components of the user's computer: the CD-ROM device, the disk adapter, the disk device, the display adapter, the first drive serial number, the MAC address, the processor serial number, the processor type, the RAM size in Mb, and the SCSI adapter. Each time the software product is opened, the expanded H/W ID is compared to the hardware on the computer to determine whether a predetermined minimum number of components match. In one embodiment, the expanded H/W ID allows for expansion of the user's computer because so long as the component originally listed in the expanded H/W ID can be found on the computer, then that component matches the expanded H/W ID. Typically, seven out of ten components in the expanded H/W ID must match the computer before the software product will operate.
==============UNSNIP=============
^----Note MAC addy bit

===============SNIP==============
[0016] In another aspect of the invention, the software product is subsequently launched following installation and the software product retrieves the 64-bit hardware ID. The hardware ID is compared to the set of hardware components on the computer on which the software product is installed. If a suitable match occurs, the software product is enabled to operate on the computer. Otherwise, if a suitable match does not occur, the software product is locked and prevented from operating on the computer. Typically, a suitable match is found when at least seven out of ten components identified by the hardware ID are found in the set of hardware components on the current computer. Thus, the invention prevents a user from installing the software product onto multiple different computers because it uses the hardware ID to identify a specific computer.
=================UNSNIP===============

Now okay yes this is 'mainly' applicable for your WinXP/2003 OS activation stuff.... But Now if I want to encrypt a HDD what would be the easiest way to indentify 'this computer and only this computer'???

Programmers are usually lazy and choose the easiest path.. And why not.. If its good enough to ensure Billy Gates makes more money from reduced sales, surely its a good enough method to lock down your precious file system...

http://www.licenturion.com/xp/fully-licensed-wpa.txt
==========Snipped {last 1 trust me}===============
Our answers to these questions are based on Windows XP Release
Candidate 1 (build 2505). Later builds as well as the final version of
Windows XP might differ from build 2505, e.g. in the employed
cryptographic keys or the layout of some of the data
structures.
==========UNSNIPPED==========================

As I said originally; I've had it mentioned to me; and never wasted the time (nor needed) to look into how it works... but maybe this might help..

Looks like you may a hot little project on your hands if you are curious enough to pursue.. You understand how the product key is created.. now look @ how the file encryption system works..

0100hrs time for a snooze
Woodmann
10-17-2004, 04:57 PM
Hi,

Since only the NIC was changed the files should still be accessable.
The drive still meets the other 9 criteria.

Why was the NIC changed ? Are the files on a network drive ?
Are they on another server outside of the network?
EFS will not work on transferred files IE; you cant send them over a network.

Were they encrypted using a method other then MS encryption?

Given the information, local hard drive and changed NIC, this should not be a problem. I think something else has happened like lost or damaged keys.

Woodmann
Silver
10-18-2004, 03:15 AM
Let me just clear up some confusion here.

There is absolutely NO MAGIC WHATSOEVER behind EFS. It doesn't use your NIC's MAC address, your CPU's serial, your hd's volume label or your dog's birthday. It uses an assymetric key system managed via pki certificates. The only Windows system that uses lunar cycles, your wedding anniversary and the average age of your goldfish is the product activation system. EFS has absolutely nothing to do with that.

If you delete the owner keys, the owner loses access to the file. If you delete the EFS recovery agent keys, the EFS recovery agent (usually the local or domain administrator) loses the ability to decrypt ALL files encrypted with the local machine or domain key and any user's key.

EFS is transparent to users. Copy an EFS encrypted file from an NTFS drive to another NTFS drive, it stays encrypted. Copy it to a share on a remote NTFS drive, it stays encrypted. Copy it to a FAT32 disk or share, it is decrypted transparently on the fly. Copy it to a floppy disk (or any other media not NTFSv5 formatted), it will be decrypted transparently on the fly.

Sorry texnass, your statements on EFS are wrong.
TexNAss
10-22-2004, 03:49 AM
Mate no problems.. I dont mind being proven wrong.. Never had a need to peek inside or look at how the drive encryption works..

For anyone interested these 2 links explain most of it..
http://www.winntmag.com/Articles/Index.cfm?ArticleID=5387
http://www.winntmag.com/Articles/Index.cfm?ArticleID=5592

Thanks for the correction Silver.

TexNAss


Marx CryptoBox infos
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Marx CryptoBox infos
PDA

View Full Version : Marx CryptoBox infos

nasty
09-29-2004, 05:45 AM
Hi Guys,
i'm looking for more info (Docs, infos, API, ..) for Marx Crypto Box ... can anyone help me to find or write here more infos about this dongle?
I know only that create, during execution, an external, resource for main .exe, file (like .dll) .

Thanks
monguz
09-29-2004, 12:10 PM
hier you can find usefull stuf.. fxp://fxp.marx.com/pub/cbn-sdk/
and in attachment some minor infos about an old emulation project ..
but i have not find any way to recover the idea keys ..:(
monguz
FoxB
09-30-2004, 05:01 AM
Try h$$p://www.marx.com/MarxIII/ftp/ and h$$p://www.marx.com/ftp/ also.

WBR
Corsair
10-30-2004, 02:07 PM
marx crypto box protected cbndll.dll file


Wrapper question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Wrapper question
PDA

View Full Version : Wrapper question

Fake51
09-29-2004, 06:30 AM
Hi

Haven't been doing much unpacking lately, so I'm not too acquainted with the sigs of different packers. And in this case, trusty Peid was no help (nor was other file scanners I tried). Anyway, what I'm wondering is just whether other people have met the packer in question - I just want to identify it, don't care bout methods of attack or whatever (if I want to crack it, I'll do the moves by myself).
It's used by yahoo for some of the games they have available for download (all those I've seen so far, anyway). It seems a typical wrapper, IT fucked up, lots of junk code in start of code (which is ofcourse located outside main code section) and so on and so forth. All sections in PE header renamed to ????????.
Anyone seen this before?

Fake
Js
09-29-2004, 01:45 PM
activmark?
_http://board.anticrack.de/viewtopic.php?t=3384
Fake51
09-30-2004, 03:10 AM
Yeah, looks like Activemark/Trymedia.

Thanx a bundle
Fake


Some deeply disturbing issues...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Some deeply disturbing issues...
PDA

View Full Version : Some deeply disturbing issues...

Aimless
09-29-2004, 09:47 AM
As Above...
Just my two cents...

We are also getting *too many* of the I'm-so-great-you're-just-a-lousy-noob messages more often.

I don't mind if +ORC or Fravia or Mammon said that but coming from lazy slobs who have not ever created any single cracking tool or posted even 2-3 essays on cracking some _good_ programs, its seems a bit too much of this-is-my-board attitude.

Can the admins please look into this matter. I have told many times on this board and would like to tell again. If you don't want to reply or feel that a person is a noob, ignore him. Don't try go be one of the big boys by berating him. Personally, I don't give a **** who this aikon987654321 is. But I respect that he has made a good statement, and is decent enough to clarify things before you begin. I also totally feel that jerks like SL0rd should'nt be allowed to make such lousy statements, ESPECIALLY considering that slobs like him possibly have not even cracked a single good program.

And wtf is everybody doing on the INT 3 post protection, falling all over the place, trying to help him? I'd like to ask the guy who mentioned FBI whether he's ever posted that in response to the INT 3 protection request? If not, why?

I was never a great cracker. But I don't insult people the way people are doing over here. And who in the name is this Neo? I knew keanu reeves could dodge bullets, but this guy seems ****ing psychic!! He knows the prot is easy before even downloading the frickking file!. How that?

Cmon guys. Can you imagine? The Slord and the slob brigade v/s Phrozen Crew? Neo v/s Death from Execution? I understand from Fravia's interview that ORC is dead. Goddamn!!! He must be turning in his grave to see morons like this. Embodiment of the spirit of cracking? The future of the cracking world? Man, the FBI don't have to stop us. We're doing that to ourselves good enough.

Have Phun
Aimless
09-29-2004, 09:49 AM
The original thread was:

http://www.woodmann.com/forum/showthread.php?t=6411

Have Phun
esther
09-29-2004, 10:11 AM
Yes Yes we know :p
Innocent
09-29-2004, 02:28 PM
Aimless, you should post more often. That shit is funny. :D
Silver
09-29-2004, 02:31 PM
People will be people, and act however they want. Nothing you can do about it, short of turning this (or any forum/irc chan/messageboard/bbs) into a private system where new users aren't allowed and anonymous users can't even get in. Although I don't think that benefits anyone... That said, I understand your frustration.
Polaris
09-29-2004, 02:40 PM
People will be people, and act however they want. Nothing you can do about it, short of turning this (or any forum/irc chan/messageboard/bbs) into a private system where new users aren't allowed and anonymous users can't even get in. Although I don't think that benefits anyone... That said, I understand your frustration.

Although (as the EXETOOLS forum showed ;)) closing registration for a short time is not so bad, a bit more of control (admins? ;)) could be useful....

I really don't like this people (get them banned?) - the university guy has always kept a clean and kind tone, respect for him is a MUST.
dELTA
09-29-2004, 03:08 PM
I was considering deleting some of those posts, especially Slord's, but I decided to let them make fools out of themselves and just drop a short comment instead. I figure it's sometimes better to let people make major asses out of themselves and then send some more major consequences their way, rather than nag about each small thing they do. But believe me, they are under evalutation...

About the "why are we helping protectionists" issue though, just drop it. The guy put in some effort, and from just reading this board any protectionist can learn a hell of a lot anyway, not to mention that many crackers design their own protections too, the old Fravia site even had an entire section dedicated too it. This board is not about making sure that we can always crack all protections easily, it's about learning and evolving, and protections evolving is a part of that.

Btw Aimless, which interview with Fravia are you referring to?
Kayaker
09-29-2004, 05:08 PM
A few quotes that pretty much sum up my feelings as well..

I was considering deleting some of those posts, especially Slord's, but I decided to let them make fools out of themselves

I had a quick look at aikons little project and I can say I'm truly impressed .. actually did research .. writing this sample prog was work .. there's no reason to beat him up for doing a survey.

ORC is dead. Goddamn!!! He must be turning in his grave
(nope, he's driving the bus!)
dELTA
09-29-2004, 05:27 PM
I'll be expecting a royalty for that quote. :p
disavowed
09-30-2004, 01:25 AM
I understand from Fravia's interview that ORC is dead.Btw Aimless, which interview with Fravia are you referring to?
He's referring to this: http://www.woodmann.com/crackz/Orc.htm#finalorc (I linked to this reference because it in fact references me too, heh)

Unfortunately, the link on that page to the original article no longer works. And oddly enough, the first issue of the CodeBreaker's Magazine has entirely disappeared from the face of the web. Only the CodeBreaker's Journal is now available. Anyway, after a lot of searching, I managed to stumble upon the last remaining copy of the CodeBreaker's Magazine: http://web.archive.org/web/20030601070629/codebreakers.anticrack.de/Codebreakers-issue1-2003.pdf

The Fravia interview starts on page 10.

Crackz, if you end up reading this, you may want to save the PDF locally to your site and fix the link.

And as for Orc being dead, I don't think that's quite true. Of course, that's because I have my own opinion of who Orc may be (and it's a possibility I haven't seen anyone ever mention).
dELTA
09-30-2004, 09:41 AM
Cool, thanks disavowed.
doug
09-30-2004, 02:40 PM
I still have the following files:
(actual magazine & source files)

Codebreakers-issue1-2003.pdf
issue1-2003-files.zip

Codebreakers-issue2-2003.pdf
Codebreakers-issue2-2003.zip

if anyone's interested / cant find them anywhere.
SL0rd
09-30-2004, 03:33 PM
Hi people, I need to say something and apologize ....
I really dont mean what I said, Its not really me. Im not saying this because my post may be deleted (Delta will be a favor can delete it) or even my account in this forum nor I want to seem like the real lamer. Im a student, learn a bit everyday.
I dont know who aikon987654321 is and I say, now: Forgive me you aikon and all here, I will not do something so stupid again!
But I think that what aikon want(wanted) is dubious, what I mean is that if he really wants to know about how crackers defeat software protections he must learn how to defeat software protections and not post a crackme and wait for a lot o peoples returning theirs works on it clean and answer a questionarie...
I cant speak english very well, forgive about it too!

One more time forgive me all
SL0rd
dELTA
09-30-2004, 04:12 PM
Ok SLOrd, I'm glad to hear that, good move, as long as people learn from their mistakes and show respect when being corrected, we are happy. :)

And sure, I've removed your post now, according to your request.
Aimless
09-30-2004, 11:40 PM
Spoken like a true man...

I think that gesture of yours is appreciable. Whatever hard feelings I had about you have been cleared with your subseqent post above.

I appreciate your courage.

Have Phun


syncrosoft dongle
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > syncrosoft dongle
PDA

View Full Version : syncrosoft dongle

searchme
09-30-2004, 09:32 AM
hi guys,

i'm looking for further information on $yncrosoft software protection mechs.. afaik cuba$e, nu€ndo and @rcon are using this kind of protection.. the current version includes the ability to encrypt / decrypt data.. i'm interrested in any api-description or some other information.. cause the vendor page doesn't provide any information :(..

thanx
votan
10-01-2004, 04:38 AM
Try social engineering to obtain what you need. Behave as if you were a potential customer who wanna try the demo kit. It really works.


iButton
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > iButton
PDA

View Full Version : iButton

Andy
09-30-2004, 11:24 AM
I'm looking for SDK for iButton 1992. I searching on fxp://fxp.dalsemi.com/pub/software_auth/, but i found only
for 1410, 1412 & 1414. Keys're placed on ISA card, I will to know how the program comunicate with dongle. Greets Andy
monguz
10-01-2004, 03:43 AM
maybe you will find the answers if you take a deep look in the docu
hier is it hxxp://www.spettel.de/ralf/projekte/ibutton/DS1992-DS1994.pdf
monguz
korvak
10-04-2004, 10:29 AM
here is the ASM code from microchip that is designed to read/write to a dallas 1 wire device. also the .pdf is the Dallas Semiconductors "application note 132, Quick guide to 1-wire-net using PCs and Microcintrollers"

hope this helps.

korvak
korvak
10-06-2004, 11:42 AM
for those that have looked at this thread... "andy" has PM'd me several times and what he is looking for is the program internal calls/checks and not the low level communication that goes on at the ibutton... so hopefully one of you experienced program reversers can help him find the calls/jmps/checks he is looking for so he can make a patch to get his program going.

good luck andy, sorry i could not help. :yay:

korvak
Woodmann
10-06-2004, 08:03 PM
Howdy,

You mean he wants someone else to do the work for him ????

Woodmann
JMI
10-06-2004, 08:52 PM
Well, that IS the easist way, isn't it? Doing the work oneself is, after all, work. :rolleyes:

Regards,
korvak
10-11-2004, 07:54 AM
well i am not sure if he is willing to put the effort in him self or if he is looking for the easy way out... from what i gather, the program is an older application and the ibutton SDK he can get from the vendor has different calls/procedures in it. so that when he searches for the code referenced in the SDK, he does not find them, so he is looking for information on how to find these calls to the ibutton/adapter card from a "blind" start, or at least a hint on what to possibly look for in the older SDK/ibutton protected applications.

Andy, correct me if i am wrong.

korvak
JMI
10-11-2004, 10:51 AM
Well, if the answer is that he wants someone else to do the work for him, tell him that is not how things are done here and he would need to go somewhere else. :rolleyes:

Regards,
Woodmann
10-11-2004, 04:37 PM
Howdy,

I am sure I have answered this question before.
Maybe it was by PM :confused:

Woodmann
Andy
10-11-2004, 06:54 PM
nevermind ...
Woodmann
10-12-2004, 05:46 PM
Howdy,

You have not been clear about some information.
iButton 1992, what does this mean ? Year of issue or version ?

It is used on an ISA card, I will assume the ISA card has a serial connection.
How many pins ? MAybe its parallel ??

Name the program, I give you permission :)

Woodmann
korvak
10-13-2004, 10:23 AM
woodmann, the ibutton 1992 is the DS1992 version.....

from ibutton web site:

1024 bits of Read/Write Nonvolatile Memory (DS1992)
256-bit Scratchpad Ensures Integrity of Data Transfer
Memory Partitioned into 256-bit Pages for Packetizing Data
Over 10 years of data retention
Unique, Factory-Lasered and Tested 64-bit Registration Number (8-bit Family Code + 48-bit Serial Number + 8-bit CRC Tester) Assures Absolute Traceability Because No Two Parts are Alike

the ibutton has holders of different types and support for serial, parrellel, usb, and non-conventional direct connect to what ever you are attempting to connect it to... in one of the PM from andy, he stated that he does not have the ibutton that the is trying to hack/bypass so knowing the type of isa card that it connectes to would be of little interest, unless you where attempting to find in the program the calls to that device.... and my vague memory tells me that the "old" ISA type cards had a parrellel port on them...

the name of the program is called (aligner.exe) i have not opened it so i can not say what it is... it is 8mb (1.8mb compressed)

korvak
Woodmann
10-13-2004, 03:40 PM
http://lists.dalsemi.com/htdig/htsearch?config=&restrict=&exclude=&method=and&format=builtin-long&sort=score&words=ds1992
Andy
10-15-2004, 05:31 AM
The programme is called Hunter WinAlign. It is a programme for wheel geometry, the problem was that the programme communicates using the same card with sensors for reading the settings of wheel and with dongle. I did not want anyone to crack this programme for me, I just wanted someone to show me how the programme comunicates with the dongle. I read most articles on the Dallas web site, I downloaded SDK ... After a chat with smola (cheers) it occured that the programme is using an undocumented function API - OpenVxdHandle and also that a driver - VXD (programme runs only on WIN9x), which is for reading the wheel settings, is the same as the reading key. This is where the problem occured. So far we came to a point that programme is gives a specific service number to the driver, which returns a structure, unfortunately without the original card and the key we cannot know which service is used for communication with the reading sensors and which is used for communication with the key...greetz andy
Woodmann
10-15-2004, 03:22 PM
OK,

You will have a good old time trying to figure this out.
There is no real off the shelf iButton stuff that I know of that is going to help you. iButtons are so varied and used in many different ways, it is almost like they are custom to each peice of software they connect with.

And dont fall for the old "I have the crack and will sell it to you" :sneaky:

Woodmann


Archive chm file updated for the collectors...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Archive chm file updated for the collectors...
PDA

View Full Version : Archive chm file updated for the collectors...

Kayaker
10-01-2004, 12:34 AM
Hi all, for those who don't regularly scroll to the bottom of the page or read the fine print, the archives chm file has been updated. FYI, I usually keep 1 or 2 of the previous versions in the root /chmfile/ directory.

http://www.woodmann.net/forum/archive/chmfile/RCEArchive_Sep21_2004.zip
(12.1Mb)

The very observant get bonus points for having already noticed it was updated a week ago, but I guess I should announce these things...:p

Cheers,
Kayaker


article on classes restoration by example of Delphi
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > article on classes restoration by example of Delphi
PDA

View Full Version : article on classes restoration by example of Delphi

pyatachok
10-01-2004, 02:07 PM
Maybe it will be of use for you :)
http://www.apriorit.com/index.php?option=content&task=blogcategory&id=78&Itemid=53
314159265358979
10-01-2004, 05:52 PM
Nothing new, he only applied(???applyed???) d4rtti.idc from the IDA palace and put some comments on it.

314159265358979
dELTA
10-02-2004, 04:53 AM
Still a nice example of reversing, thanks pyatachok.
TQN
10-02-2004, 06:16 AM
Yes, a nice article. Thanks pyatachok. I will reread it.
Regards,
TQN


Plugin OllyDbg problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Plugin OllyDbg problem
PDA

View Full Version : Plugin OllyDbg problem

OllyView
10-02-2004, 12:46 PM
Hello

I have made a program (Delphi), which allows one to convert an ASM snippet from OllyDbg to HTML. (with colors)

I would like to create a plugin from this tool and i have a problem. (Im a newbie) :
How can i get the code selected by the user in the disasm window ? (Like Ctrl-C) :confused: . Do you have any example code i could study ? Thanks for your help.
dELTA
10-02-2004, 05:22 PM
It might not be available directly in the plugin API, but you never know. You might have better luck asking the guys over at the OllyDbg board though.

http://ollydbg.win32asmcommunity.net/
OllyView
10-03-2004, 07:45 AM
Yes I have asking the guys at the OllyDbg board but i try to post in other forum to get more answer. ;)
thanks ...
dELTA
10-03-2004, 10:19 AM
Ok, cool, just wanted you to know about it if you didn't already.


Looking for OpCodes!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Looking for OpCodes!
PDA

View Full Version : Looking for OpCodes!

Hero
10-04-2004, 07:30 AM
Hi all
Perhaps my post's title looks funny,but I can't find detailed
general opcodes for intel processors.
For example opcode 88h means MOV for 8 length memory and
registers.But this instruction with this Opcode has several
lengths for deferent instruction.
I need a detailed list for intel opcodes that show perfect length
and instruction details for intel.
Is there anybody who know where I can find it?

sincerely yours
JimmyClif
10-04-2004, 08:08 AM
It's not all that obvious as you think it is. ;)

Download the Intel Instruction Set Reference at http://developer.intel.com/design/pentium/manuals/ and start reading.


wise installer trouble
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > wise installer trouble
PDA

View Full Version : wise installer trouble

guitarman310
10-04-2004, 08:21 AM
i am completely (can't get any more newbie than me!) new to RE and am working on a wise installer. the setup asks for a serial number. i have tracked the setup to loading and unloading a dll in the temp folder when i press 'next' after entering in a dummy serial. I am totally lost. I do have C/C++, Java, VB experience, and I've rear asm and opcode tutorials, but i'm not sure as what to do next.....i know it sounds like i'm begging (please, please), but i have been trying to figure this one out for a long time. I can post the setup, or ISO of the cd i'm using if it will help. thx
naides
10-04-2004, 08:50 AM
Search google with "wise decompiler" without the quotes,
Learn a little more about wise scripts,
Learn to crack serial numbers in simpler programs
Learn to crawl, then to walk, then to jump
guitarman310
10-04-2004, 08:57 AM
i've got all of that. extracted the wise files (*.EWI was the extension) . it looks like they are all encrypted tho. read thru...found where it was asking for %PSERIAL%.....What is a good program (easy) to lean to crack serials?
JMI
10-04-2004, 12:20 PM
What have YOU done to try to find the answer to that question? Read the information under your signature.

Regards,
guitarman310
10-04-2004, 05:29 PM
i'm not exaclty sure what you mean, JMI. i have searched the boards and read the faq (and visited several linked sites).this is the only program i have tried to crack...cause i've only been attempting to crack for a month or so, and this is the one i need. but if i need to learn on smaller progz, i will. i tried to get the serial from one of the serial sites, but the installer needs a different type of number..."Type B or C serial number", so i figured i'd do it myself. I have hunted down information for hours and tried to look at the prog thru a disassembler, and debugging it, and i have learned a few things...but not much. I can program...but not reverse...i am trying to learn asm now...i'm doing all i know how to do. I just thought that someone might have had experience with the wise installer.
dELTA
10-04-2004, 06:21 PM
Patch the entry point of that dll to an infinite loop, then attach to it when it is loaded, breakpoint all exports, see which ones are called (most likely just one) and check out the return value of it. In most cases you just have to change this return value from 0 to 1 and you're done (then you might of course get trouble with more checks inside the program itself, but what I describe should get you past the installer at least).
LaptoniC
10-04-2004, 06:45 PM
Wise setup script internals have been pubished by the same guy who made first wise unpacker.Try to decompile it by hand.It will take time but I guess you can do it.I attach the details of script file.I have added something to original file.
SL0rd
10-05-2004, 01:22 PM
I can program...but not reverse...
:) Reversing is an art and a new Order in our way of thinking, you must be a lot more than a programmer, you need to see all around you in reversed order, numbers back to front, people walking like in a bizarre world with all goin in reversed steps, you must think reversed, looking trhough a new window. Its a new world beyond simple mortal data base programmers, a new world where things goes time reversed, following quantum rules, a new world, a new Order.
dELTA
10-05-2004, 02:53 PM
Please don't post while being stoned. :rolleyes:
JMI
10-05-2004, 03:54 PM
Or you might get stoned for posting. :sneaky:

Regards,
naides
10-05-2004, 03:58 PM
What do you mean. . . I have to get posted to be able to stone. . .
or, is it the other way around???
dELTA
10-05-2004, 05:37 PM
One more word of gibberish, and I'll get stoned and go postal on you guys, ok? :D
JMI
10-05-2004, 07:21 PM
Or we will nuke um till it hurts. :idea:

Regards,


FlexLM 7.2d, CRO, SEED, VENDOR n LICENSE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > FlexLM 7.2d, CRO, SEED, VENDOR n LICENSE
PDA

View Full Version : FlexLM 7.2d, CRO, SEED, VENDOR n LICENSE

kepeto
10-05-2004, 08:55 AM
hi all,
i try to learn about FlexLM 7.2d protection,
i still cannot figure out how to get CRO and SEED 3 & 4
(i dont know if SEED1,2 and VEDOR key are valid-from my research,
please correct if i make mistake-)
all FEATURE is hard printed in the apps, so its easy to find..
guys, can u help me to reveal all this stuff--some tuts--, thanx

ps: because i cant find where 7.2d SDK, i only have 8.0c SDK...
is that different from 7.2d?????

thanks to
CRACKZ tutorial -about flexlm- from WOODMANN
dirkmill
10-05-2004, 01:40 PM
Hi!

For getting started in the flexlm-business you might want to consider an easier target!
This one is dongled, uses user-crypt-filters and long keys (no CRO!).
Also you should re-read as many flexlm tuts as you can because neither your enc-seeds nor your vkey5 are correct...

Dirk
nikan
10-06-2004, 08:47 AM
hi
you can pm me, i cracked it before.


Problem with an app and ASProtect
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Problem with an app and ASProtect
PDA

View Full Version : Problem with an app and ASProtect

tanis
10-05-2004, 10:21 AM
I am trying to work my way through an application that is protected with ASProtect and a custom serial + activation code combination.

I found out how to get through ASProtect (it's used in some DLLs instead of the EXE) and have a look at the full code using OllyDbg.

I tried bypassing the serial number check and the activation code check and I successfully got into the real application and at a first glance it seems to work.

I tried working with the app and I noticed that there's a component that's actually behaving differently than it was when I was using it as an evaluation version.

Now whta I wonder is if this could be something that has to do with the protection itself or if there's anything else I should check to clear my mind. Maybe this is a known issue that affects applications protected with ASProtect or some other generic protection that I didn't recognize.

Thanks!

-tanis
JMI
10-05-2004, 10:37 AM
It is likely that the serial protection decrypts a part of the code and it is not working properly as a result of what you have done, but it is not possible to make a reliable guess, based upon the little information you provide. Remember that you may post NO code which identifies your target or ANY code if you do identify it.

REgards,
tanis
10-05-2004, 10:54 AM
Yes, it could be that way. What makes me wonder is that there's only a toolbox panel that has some selectable components that you can place in a view that's behaving erratically.

I already tried tracing through the actual code that does the serial number check and the real problem is that it's a very long function (and I really mean that it's got a lot of lines of code) with jumps every few lines.
I would love to use the same code to build a keygen but I found it damn hard. I'm pasting a few lines to give you an idea. Keep in mind that this kind of code repeats many (MANY!!) times :)

012951A6 66:8B45 D4 MOV AX,WORD PTR SS:[EBP-2C]
012951AA 8B7D D2 MOV EDI,DWORD PTR SS:[EBP-2E]
012951AD 66:C1E8 03 SHR AX,3
012951B1 66:894D F2 MOV WORD PTR SS:[EBP-E],CX
012951B5 66:8945 A8 MOV WORD PTR SS:[EBP-58],AX
012951B9 66:C16D F2 06 SHR WORD PTR SS:[EBP-E],6
012951BE 8A55 F2 MOV DL,BYTE PTR SS:[EBP-E]
012951C1 83E7 04 AND EDI,4
012951C4 83E0 04 AND EAX,4
012951C7 83E2 04 AND EDX,4
012951CA 0BC7 OR EAX,EDI
012951CC 897D C4 MOV DWORD PTR SS:[EBP-3C],EDI
012951CF 25 FCFF0000 AND EAX,0FFFC
012951D4 3BD0 CMP EDX,EAX
012951D6 0F85 04040000 JNZ CCPROJ~1.012955E0
012951DC 66:8B45 D2 MOV AX,WORD PTR SS:[EBP-2E]
012951E0 66:C1E9 07 SHR CX,7
012951E4 66:D1E8 SHR AX,1
012951E7 8AD1 MOV DL,CL
012951E9 66:8945 EA MOV WORD PTR SS:[EBP-16],AX
012951ED 32D0 XOR DL,AL
012951EF 8B45 D6 MOV EAX,DWORD PTR SS:[EBP-2A]
012951F2 32D0 XOR DL,AL
012951F4 F6C2 08 TEST DL,8
012951F7 0F85 E3030000 JNZ CCPROJ~1.012955E0
012951FD 8B7D D0 MOV EDI,DWORD PTR SS:[EBP-30]
01295200 83E1 10 AND ECX,10
01295203 66:C1E8 04 SHR AX,4
01295207 8AD0 MOV DL,AL
01295209 83E7 10 AND EDI,10
0129520C 83E2 10 AND EDX,10
0129520F 897D BC MOV DWORD PTR SS:[EBP-44],EDI
01295212 0BD7 OR EDX,EDI
01295214 81E2 F0FF0000 AND EDX,0FFF0
0129521A 3BCA CMP ECX,EDX
0129521C 0F85 BE030000 JNZ CCPROJ~1.012955E0

CCPROJ~1.012955E0 is the location where the message box saying invalid serial gets constructed.
dELTA
10-05-2004, 02:41 PM
Yes, it could be that way. What makes me wonder is that there's only a toolbox panel that has some selectable components that you can place in a view that's behaving erratically.Exactly what do you mean with this, and why does it make you wonder?
tanis
10-05-2004, 03:32 PM
It's just that I was not sure that this behaviour was due to the protection itself instead of anything else.

Today I searched and asked around about that and I found out that yes, it's happening only with a version that has not been completely unprotected.
There's some code that is deciding wether the components will work the right way or not, but I have no clue where to look at.

At this time I think that the best way is to write a keygen. I guess it would be much better and maybe that way the protection itself is going to believe that everything's fine.

Now what I'm asking is for some tips on converting the code up there into a keygen.
I can easily have a look at the various memory references around EBP and see what's going on.

For what I can say, the serial number gets dissected (it's a 16 characters code in the form XXXX-XXXX-XXXX-XXXX) and pieces of the code are being transformed and compared and in some cases written in memory to use the results later for further checks.

The real problem is that if I find a couple of values satisfying the first check and I go on and on like that, there's a point where the results of the first check are being used to do more checks on the serial and this time it fails because my values should satisfy both requirements. I know that my words probably make no sense.. I am not English mothertongue and explaining that kind of stuff is very hard for me.

I hope you've got the idea of what I'm trying to say. Any hint is very appreciated.
Till now I've been doing all the math by hand writing down the results and restarting from scratch every time I had to modify a value that was already checked before.

Thanks again!
dELTA
10-05-2004, 05:32 PM
About the keygen stuff:
You should try to fully reverse and understand the key checking algo before trying to implement any keygen, IDA Pro is very good for this task for example. Experimenting with random values in a live debugger could leave you in the dark codewoods forever.

About the different behavior:
A good bet would be that envelope checks are used, it sounds like it.
tanis
10-06-2004, 10:34 AM
I'm getting IDA and try to see how the code looks like with it. I have never used it before.

What do you mean by "envelope check"? Is it something like CRC?
dELTA
10-06-2004, 02:44 PM
Envelope checks are special functions offered on SDK level by packers. They return one value when the wrapper is still there, and another when the wrapper has been removed, so that easy and clean control flow redirection can be done when the program has been unpacked.
tanis
10-07-2004, 01:47 PM
This means that it is very hard to find out where this kind of control is made.

There isn't a message box or anything that pops up to tell me that my copy has been messed with.

All I get is that a panel (just like a toolbar) has all the right objects displayed but when I click on one of them, the result of what should happen is different than what happens with the regular version (evaluation).

It could be that the check is made when I click on one of the items of the panel, but I doubt it. It sounds more like the control is made beforehand and the icons displayed are the same.. it's just that the events associated with the icons are different and I have no idea of how to check it out.

I still think that the keygen is the best way to go, but the code is driving me mad. If I should use the same assembly stuff, I should still write something like a bruteforce trial & error like application.

Do you mind if I post the full code of the check so that you can have a look at it, too?
dELTA
10-07-2004, 03:23 PM
Do you mind if I post the full code of the check so that you can have a look at it, too?Yes, please don't. We don't want any mile long code listings here, noone will sit down and reverse a complex algo for you anyway, there simply is no other solution than for you to take the needed time and reverse the algo yourself (did you try in IDA yet?). If you have technical questions about small snippets of code you are welcome to ask them though.
tanis
10-07-2004, 03:37 PM
Ok, no list :)

I have tried IDA but I've encountered a new problem.

I dumped the unpacked DLL from within OllyDbg and I checked it with PEditor to make sure that import tables are fine and they do.

So I went on and tried loading the DLL into IDA and here's what happens:
it's just like if the DLL is being executed and a message box pops up saying that my trial period of 30 days is over and go to purchase the product at blablabla.

I did a search of the exact message with google and I noticed that this same message box appears in different apps and games, mainly due to virus infecting the app's executable.

I'm almost sure it's one of those "envelope checks" as you call them. I have not yet found out where in the DLL's code this check is made. I'm hunting it down right now.

Next I tried to replace the original DLL with this one and in fact the same message box pops up and the application terminates.

Is it ok that the DLL gets executed in some way when I drag and drop it into IDA?

Anyway the real difficult task is to merge the various checks here and there and build the exact rules to validate the serial number.

Let's say that the serial is like: A-B-C

The code goes like this:

Sum A and C and place into EAX
shr EAX, 5
Sum B and C and place into ECX
shr ECX, 2
write ECX into memory location 1
compare EAX and ECX
jnz error location
...

and it goes on that way until you stumble in

Sum C and B into EAX
Read the memory in location 1 into ECX
shr ECX, 3
compare EAX, ECX
jnz error location

So you have to go over the whole code to find references to values computed before and therefore write an algorithm that in the first check also takes into account this other condition. It's really a pain to rebuild everything in the correct order :)
dELTA
10-07-2004, 04:01 PM
As long as you find all these checks, it should be a fairly straight forward task to create an equation system out of them, which could then be solved for the "least dependent" variable (i.e. some kind of seed). Then it should be quite easy to write a keygen after that. Don't stare yourself blind on the code, you must extract and understand the algorithm "mathematically" before you can write a keygen.

The two equations for your example above will be:

/ ((A + C) shr 5) = ((B + C) shr 2) = X
<
\ (B + C) = (X shr 3)

----> ((B + C) shr 5) = (B + C)

----> (B + C) = 0

----> ((A + C) shr 5) = 0

----> / B = -C
<
\ (A + C) <= 31Which ends up being the resulting only constraint of your example (with reservation for three hundred possible slip-ups while doing this example in 30 seconds :p )


Newbie password protection help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Newbie password protection help
PDA

View Full Version : Newbie password protection help

Fatty[NegX]
10-05-2004, 11:25 AM
My favorite little app has a "secret area" to get into. This area is password protected. I've looked at many tutorials and most of them all cover plain text passwords. This program doesn't seem to have plain text passwords or it performs a check before accually comparing the two that invalidates your entered PW before even checking the two.

here is what I can't get by:

CMP EAX,1 (I get through this one alright, I assume it makes sure
the PW entered isn't 0 len?)
JNZ proggie.00405298 (just jumps back to the normal program)
CMP BYTE PTR SS:[ESP+61],0A8 (I assume the compare I can't get right)

This program doesn't seem to use any api's to compare strings, only the ASM CMP. there are a bunch of LEA, JNZ, MOV, and a few CMP's after the CMP listed above which I assume check the password, but which I can't get to. Any Ideas?

Also, I've attempted this in w32dasm, ida, and ollydbg. I can't use SIce cause for some reason it doens't like setting breakpoints for me. Even ones defaultly in the program, like kernel32 calls.
SL0rd
10-05-2004, 01:01 PM
Hi,
I would like to play with this app, can you point out where can I get it, maybe you can send me by email ...!
You can PM me!
Silver
10-05-2004, 01:25 PM
If you search the forum, there are approximately 10 billion posts about your softice problem (and I never, ever exaggerate in a hundred million years).

w32dasm, ida, olly and sice are different types of progs intended for different things. It seems from your basic description that just trying different disasm'ers and debuggers won't solve the problem.

CMP EAX,1 (I get through this one alright, I assume it makes sure
the PW entered isn't 0 len?)
JNZ proggie.00405298 (just jumps back to the normal program)
CMP BYTE PTR SS:[ESP+61],0A8 (I assume the compare I can't get right)

We need to know more about what this app is doing around this code (if you're absolutely sure this is where the checking is taking place). If the jnz 405298 jump really does take you back to the main app to say "Bad password", I would guess that there will be further jumps to this (or near this) loc. You need to follow the logic of the code some more - just because it doesn't use API calls doesn't necessarily make this any harder.

How does this "secret area" work? Does it pop up a dialog, ask for a password and then pop up a message box if it's wrong? At some point there is generally a "choke point" in an app - a jump or call for an invalid registration details.

To summarise that blather, more info please.
Fatty[NegX]
10-05-2004, 06:57 PM
WHen I say jumps back to normal program, I mean it just goes back to the normal program, no msgbox's come up.

When you enter the correct password, it goes into a dialog with various options which are "privaliaged"

I know the jnz just goes back to the normal program because I've tried modifying the jump to "incorrect password" to jump there instead, it gives the same effect as not entering a password. (I've cracked a couple proggies that way, so I know it works)

Now after the CMP I have provided, there are a couple MOV's and stuff as I said, and then another jump... which jumps almost to the beginning of the ASM code and it looks to be the real comparing stuff.
here is what comes after the jump to "incorrect password", which is just after the JNZ above.

MOV CL,BYTE PTR SS:[ESP+62]
MOV AL,0CE
CMP CL,AL
JNZ SHORT proggie.0040520B (0040520B being: PUSH 0)
CMP BYTE PTR SS:[ESP+63],AL
SETA AL
MOV BYTE PTR SS:[ESP+62],AL
LEA ECX,DWORD PTR SS:[ESP+F0]
MOV DWORD PTR SS:[ESP+1AC],3
CALL (JMP.&MFC42.#800)
LEA ECX,DWORD PTR SS:[ESP+B0]
MOV BYTE PTR SS:[ESP+1AC],2
CALL (JMP.&MFC42.#609)
MOV BYTE PTR SS:[ESP+1AC],1
JMP proggie.004052CB
PUSH 0
LEA ECX,DWORD PTR SS:[ESP+100]
CALL proggie.00401BC0
MOV AL,BYTE PTR SS:[ESP+63]
MOV BYTE PTR SS:[ESP+1AC],4
CMP AL,66
JNZ SHORT proggie.00405233
MOV DWORD PTR SS:{ESP+67],1
JMP SHORT proggie.00405246
CMP BYTE PTR SS:[ESP+67],1
JNZ SHORT proggie.00405246

Is there a certain ASM snippet that brings up C++ dialogs? if so, then I would
just be able to jump to that instead of trying to figure out the password(which doesn't matter to me) so if you know what ASM code
would do it, please post and I'll look for it in the ASM dump.

and:
w32dasm, ida, olly and sice all "debug" programs and have options for breakpoints when running the program, so I consider them to be pretty much the same. granted they are all considered different types of tools, but they all display ASM coding of a program, and allow you to set breakpoints and view memory. (this is just my opinion, I could be wrong but in my eyes these tools perform the same function.)
JMI
10-05-2004, 07:32 PM
The issue of the "debug" programs is not that they all perform the same function, but whether they all perform with the same functionality. W23dasm is the oldest and probably the least powerful. IDA's in new and the extent of it's functionality not yet widely reported. Softice is a ring 0 debugger and operates on substantially different concepts that olly, which is a ring 3 debugger. Certainly softice and olly have their respective places and reading lots of tuts will suggest when each might be appropriate.

Searching this forum and on the net will lead you to various API which would call a "dialogbox" to enter the serial, but it might not actually "be" a dialogbox. There are other alternatives. Searching will also lead you to that information here.

Regards,


InvalidFS
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > InvalidFS
PDA

View Full Version : InvalidFS

tomhall
10-05-2004, 01:13 PM
I am working on an IBM Thinkpad T41 running Windows XP. The user downloaded SP2 and now receives this error when booting up:

Extended Information: Phase 0, Type 255, Code 8
Operation: Resizing Prior Partition
Partition Type: unknown
Phase: Resize Initialization
Error: INVALIDFS

Press any key to continue.

Once a key is pressed Windows loads and Rapid Restore copies files and says to reboot now or later. If you reboot now it cycles into a loop doing the same thing. You can elect to reboot later and work fine. The only reference I found on this was the following:

http://www.ibmnb.com/forum/viewthread.php?tid=62926&sid=BKCEMW

however, it is in an Oriental Language, if any one can translate that for me I would really appreciate it. Otherwise, if anyone has a solution, that will work also.
Silver
10-05-2004, 01:19 PM
What that says, roughly translated to English, is an old Confucious saying: "He who doesn't read forum FAQ or post anything even remotely on topic soon find out who JMI is".
tomhall
10-05-2004, 01:30 PM
I did read the FAQ's and even though this is not a coding question, I have found several answers to problems I have come across on this site. Did not see any other topic this question would fit under, so newbie it was.
dELTA
10-05-2004, 02:47 PM
Well, it sorta fits under "Off topic" you know. :) I moved it there now anyway, so no problem, I hope you find the solution to your problem.
tomhall
10-05-2004, 03:00 PM
That works for me. Thanks.
JMI
10-05-2004, 03:57 PM
And who is that guy JMI anyway? :devil: Does he work here? :eek:

Regards,
Silver
10-06-2004, 12:38 PM
No idea, but I have heard he's some crazy forum moderator who has real trouble managing access controls for forums and forum posts ;) :devil:
JMI
10-06-2004, 01:06 PM
Oh. That guy. Now I remember him. :devil:

Regards,
user
10-09-2004, 01:03 PM
http://www.ibmnb.com/forum/viewthread.php?tid=62926&sid=BKCEMW

however, it is in an Oriental Language, if any one can translate that for me I would really appreciate it. Otherwise, if anyone has a solution, that will work also.try http://babel.altavista.com/tr and choose simplified chinese to english.
JMI
10-09-2004, 03:03 PM
Or better still, find the Systran program loose in the wild and have multiple languages translation available on your toolbar. :yay:

Regards,
TOTEU
10-14-2004, 02:17 AM
Try also http://forum.thinkpads.com

Regards,
TOTEU


PhotoLine5 (ida crash)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PhotoLine5 (ida crash)
PDA

View Full Version : PhotoLine5 (ida crash)

bullet187
10-06-2004, 07:28 AM
Hello again!
Target: PhotoLine5 (year 1999)
Problem: IDA crash because of low memory or sth

What tha fuck is going on?
That app is 5 years old... I've Celeron 1.7 with 256DDR...
Any sugestions?
Regards
naides
10-06-2004, 09:16 AM
Do not put the target name.
There are anti-dissasembler tricks that work against IDA, one of them is to setup code the calls itself recursively in an endless loop. IDA will run out of space trying to follow the code thead to its ultimate consequences. those instructions are not run by the prog during normal operation so they do not affect the program itself.

Try another dissasm, and perhaps you can identify the offending instructions and nuke them.
Kayaker
10-06-2004, 09:59 AM
Hi, in this case I don't really see a problem with simply naming a file IDA chokes and pukes on. The other post asking for a target related cracking tut was deleted though...
bullet187
10-07-2004, 12:33 AM
Thx for reply!
Regards
JMI
10-07-2004, 08:36 PM
You're welcome, but a little simple searching would have disclosed the answer for you without help. :idea:

Regards,


begin of program in mem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > begin of program in mem
PDA

View Full Version : begin of program in mem

apocalexiz
10-06-2004, 01:00 PM
Hi

I'm under WinXP. Programming with C for a while. Now i want to try new things, just for fun and to see whether its possible or not.

My question is. If i wrote a little program thats good for...nothing. How can i get the adress where its located in virtual memory? The starting adress of the whole program and all the memory it owns. I want to play around with the mem. Searching some variables in the program and change the values, stuff like this.
I guess for such things i have to use strange windows api functions ;) and i can imagine that such "games" not possible, if I'm under normal "User rights". And this is for the next question i got. How to run such a programm beyond all this rights? Should i disguise it as device driver? AFAIK device drivers got full access to anything, right?

If someone got some useful textlinks, book recommendations etc. pls post it or leave me a message. :)

bye

apo
lifewire
10-06-2004, 02:46 PM
you can get the base of where the module is loaded with GetModuleHandle(NULL);. that is the same thing has the HINSTANCE btw.

and yes, there are functions to enumerate allocated memory, but I can't remember them at the moment.. i guess they are in PSAPI, but i'm not sure about that.
dELTA
10-06-2004, 02:52 PM
Check out the section table in the PE header of the executable to get hold of all static memory and memory ranges. This will also tell you more specifically where the code is located and where the different types of data are located (at least for "normal" programs).

To sum it up, check out some good documentation about the PE header. Google and this board's search engine should be more than enough for that.

And applications have surprisingly much access to each other's memory spaces, so this shouldn't be a problem for you, and if you also make sure to be logged in as an administrator while playing around with this there really shouldn't be any problems with anywthing like that. And leave the device driver idea completely for now, you don't want to go there in your current state, believe me. ;)
apocalexiz
10-06-2004, 11:20 PM
>Check out the section table in the PE header of the executable to get hold of
>all static memory and memory ranges.

yesterday in the evening i got nearly the same idea, i downloaded the ms pe documentation file and made a printout ;)

so i'll write a little prog that gives me all relevant information about a pe exec. If i got questions i'll come back ;)

So long!

apo
dELTA
10-07-2004, 05:06 AM
Ok, sounds good. :) And if you'd need some reference, or find out halfway that you don't have time to finish it (or just want to play with another cool little program in general :)) you can always take a look at my exe analyzer, which can be found as an attachment in this thread:

http://www.woodmann.com/forum/showthread.php?t=5264
Silver
10-07-2004, 09:34 AM
Hey delta, I found your app a while back whilst looking for something to find code caves, and IIRC I found a bug in it. When I analysed a certain exe it got a bit confused, put up a message about "overlapping areas" or something and some of the analysis options didn't work. If I can remember which app it was I'll give you a proper bug report, if you're still developing it?
dELTA
10-07-2004, 12:26 PM
I haven't touched that thing for ages, it was just a little hack I did when I was looking into the PE file structure a bunch of years ago. :) But sure, if you have an exe that reproduces the problem, it might be fun anyway, if nothing else to see if the exe is messed up somehow by some protection or similar.


Nuthin' works (breakpoints)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Nuthin' works (breakpoints)
PDA

View Full Version : Nuthin' works (breakpoints)

bullet187
10-07-2004, 01:55 AM
Hello!
Target: Some App
Protection: sn (Dialog with three edits. First with number generated for specified computer, second for e-mail and third for sn)
Problem: getwindowtext,getdlgitemtext,hmemcpy doesn't work (I would try a bmsg wm_gettext for edit or wm_lbuttonup for button but I can't find a handle for both, there's only handle to this dialog)
Sorry for my poor english.
dELTA
10-07-2004, 05:09 AM
It might for example be a Delphi app (in that case you could e.g. use DeDe to find a good breakpoint location), search for some info about that on this board, there should be lots of stuff about it.
bullet187
10-12-2004, 10:25 AM
Hello!
Thx for reply.
I'm affraid it isn't a delphi app 'cause file analyzer show a VC++ compiler.
naides
10-12-2004, 10:39 AM
Try a different aproach:

Look at the text that is present in the sn dialog box. See if you can find those strings in a dissasm of the prog. put a bpm on the memory containing the strings and you would break near the area that generates the dialog box which MIGHT be in the general area of the protection. Also keep in mind that the protection may be handled by a dll, so look in other imported files also.
bullet187
10-12-2004, 10:56 AM
Hello again!
Thx for reply.
I'll check it!


Ida signature and unpacked program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Ida signature and unpacked program
PDA

View Full Version : Ida signature and unpacked program

Foreigner
10-07-2004, 03:52 AM
I am working on a target and I have some problems to apply an ida signature.
The file was packed, I unpacked the target and I used imprec to rebuild the iat. After that, I opened the file with ida and when the autoanalysis is finished I tried to apply miracl signature but Ida is not able to recognize a single reference. This is strange because I can see all miracle's functions inside the exe, I mean mirvar, powmod, ...
Is it possible that Ida is not able to apply signature on unpacked programs? Do I have to change something in the unpacked file, or is it my unpacked file wrong (even if it runs fine)?

Thanks in advance.
foreigner
reverser
10-07-2004, 04:32 AM
IDA applies signatures only to sections with an executable flag set. Your unpacked code section is probably marked just RW.
Foreigner
10-07-2004, 01:00 PM
No, it's also executable... :confused:
TQN
10-08-2004, 12:14 AM
It can be the incorrect version between the miracl lib used to create signature file and the miracl lib used in your program.
Foreigner
10-08-2004, 04:53 AM
TQN: could it be but how can I know which is the version used?
TQN
10-09-2004, 04:16 AM
No way to know, but you can search in the exe to find the hard code version of miracl if it have, and some signature file have the version info in the description which the author of that signature added.
If you know exactly a function of miracl in IDA, try extract the obj file from the lib file of multiple version of miracle, and open it with IDA and compare the code.
Hope it will help you.
Best regards,
TQN


How to repack a file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to repack a file
PDA

View Full Version : How to repack a file

Limee AKA Lamer
10-07-2004, 07:17 AM
I unpacked a upx file manually.
Then I want to repack it with petite,
but it does't work,why?
dELTA
10-07-2004, 08:29 AM
Did the unpacked file work in the first place?

One good guess would be that the imports of your unpacked exe have hardcoded adresses (i.e. not fully rebuilt IAT), which could cause this kind of behavior.
Limee AKA Lamer
10-07-2004, 09:28 AM
The unpacked file can work smoothly,but it can't be
repacked by petite2.2.When it be repacked,then it
can't work.

Did the unpacked file work in the first place?

One good guess would be that the imports of your unpacked exe have hardcoded adresses (i.e. not fully rebuilt IAT), which could cause this kind of behavior.
Limee AKA Lamer
10-07-2004, 12:24 PM
Can you explain the meaning?
thanks.

Did the unpacked file work in the first place?

One good guess would be that the imports of your unpacked exe have hardcoded adresses (i.e. not fully rebuilt IAT), which could cause this kind of behavior.
dELTA
10-07-2004, 12:40 PM
When you dump an app from memory, the import data might be in a state that makes it not resolve the imports again when the dumped exe is being loaded from disk, but it rather uses the exact same addresses that were resolved for the imports in the dumped app instead. This might confuse a packer in the way you describe.

Anyway, read some info about dumping and import rebuilding, and it will all become much more clear.


A new PE editor!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > A new PE editor!
PDA

View Full Version : A new PE editor!

SL0rd
10-07-2004, 08:12 AM
Hi

I have a project and I would like to invite intersted people
that want to learn to join it.
I decided to write a PE editor. The first question that
might arise: Why you want to write a new PE editor if there
are a lot of it, even commercial ones. The answer: I believe
that writing a PE editor is like a final test to see if you(we)
really learned from the articles and tutorials, also some projects here
are not for beginners like me, yet! I think a PE editor is a
beginning viable project.

What will be the features of this app?
1 - Create a new PE file from zero, its mean that the user start inserting
a DOS header, a PE header, sections headers and finally sections data and
setting the headers fields properly, and we hope the windows loader
will not reject it.
We can create exe files from dumped data...
2 - Edit, of course, existing PE files.
3 - Some mechanism to resolve IAT;
4 - some idea?
5 - Lets write it in asm (not pure at all), masm32 is excellent, so
we learn about PE format and exe files loading mechanism and also
learn assembly.

We need some organization, so I think that we must to be
closed to a fixed number (possible 10) of participants, btw any comments, suggestions
by everyone are welcome.

I will close the "subscription period" one or two weeks from now;

Ok! comments are welcome, suggestions by everyone.

One more thing, I would like to work with beginners not who already
have great skills and experience. Its a project to beginners,
of course the participants must have some minimal knowledge
of PE files format and asm prog(or at least C/C++).
Silver
10-07-2004, 09:39 AM
If I can offer a suggestion... If you're serious about writing a PE editor to learn/validate knowledge, it's somewhat pointless to have other people help you. That said, if you want to code a PE editor (or indeed any tool) using an online "team", you need to standardise. The easiest way of doing that is for you to write the core app and provide a facility for plugins. That way you don't need to "manage" an online "team", and everyone can get on and code what they want, when they want. Plugin systems are fantastically easy to write in C++ using late binding DLL's.
SL0rd
10-07-2004, 09:50 AM
If I can offer a suggestion... If you're serious about writing a PE editor to learn/validate knowledge, it's somewhat pointless to have other people help you. That said, if you want to code a PE editor (or indeed any tool) using an online "team", you need to standardise. The easiest way of doing that is for you to write the core app and provide a facility for plugins. That way you don't need to "manage" an online "team", and everyone can get on and code what they want, when they want. Plugin systems are fantastically easy to write in C++ using late binding DLL's.

I think youre right,I will do the way you point. But still if other want to
join in a little group the doors still open ( I will wait for seven days from now or still I get 4 "subscriptions" 4 members are a good number I think;
Woodmann
10-07-2004, 05:06 PM
Howdy,

This is a very excellent idea :yay:

Woodmann
SL0rd
10-08-2004, 09:13 AM
I have the project approved at sourforge, here some informations:

Project Descriptive Name: Another PE file editor
Project Unix Name: apeditor

its going...its just beginning!
JMI
10-08-2004, 09:34 AM
That's how everything starts. By beginning. :yay:

Regards,
SL0rd
10-12-2004, 11:03 AM
I started to code, here is how the apeditor is coming to life:
any comments are welcome!


What links mice to motherboards?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > What links mice to motherboards?
PDA

View Full Version : What links mice to motherboards?

roocoon
10-08-2004, 02:05 AM
Hi all.
Strange message title that I can only answer it myself with "wires" but hopefully somebody would have something more useful to point me to.
Situation:
An Intel mobo with 2.6 P4 chip, lots of other stuff and a MS PS2 Intellimouse with a wheel.
This machine and a couple of other computers, connect to a switch box (keyboard, mouse, monitor). Through the switchbox I access any of these computers.
Sometime ago, the Intel mobo and its P4 chip burned out. I replaced them with an Asus mobo and a 3.2 P4.
The system/software works as before but the mouse is completely dead when I boot into Windows.
If I boot with a DOS diskette, it works fine.
If I boot into Windows is dead as I said, but if I now switch to another machine using the switcher's buttons, it works fine.
So the mouse and the switch are fine therefore it must be software-related.
Everybody suggested reformatting the disks and starting over but that's unacceptable.
Since then, I've upgraded with SP2, then, just in case, installed Windows again over itself using a CD with SP2 incorporated.
Nothing. At no point did the mouse come alive.
I'm using a USB mouse now (its cable reaches to my left side only and you can imagine how twisted I get) but it's pretty cumbersome with two mice in front of me.
Question:
How can I force the low-level mouse drivers to refresh? Or is there another way?
Thanks for any suggestions and sorry for the long message. Unrelated to the board's purposes but since I couldn't get an answer anywhere else and couldn't think of any more technical collection of minds in one place, I couldn't refuse. Ignore or delete it if it offends anyone.
Regards.
naides
10-08-2004, 06:02 AM
So, if I understood correctly, a USB mouse connected directly to the computer works OK, but through the switch refuses to work???

If that is the case, the switch interphase and the driver do not handshake correctly.
Does the switch have a driver? Can you update it? can you borrow another switch and see if the problem repeats? Can you try a OS2 mouse instead, what about a new USB mouse, but do not accept the default driver that Windows XP offers, and force it ti take the vendor's driver during detection/installation, or, uninstall the current mouse from the hardware list, and when you reconnect (is it detected?) force the vendor's driver, or, find out the name of the mouse driver and physically delete it from the disk (system32 folder usually) or. . .
ask the question in this or another board again and see if you have better luck
dELTA
10-08-2004, 06:16 AM
Don't worry, anything can be posted in the off-topic forum as long as it's not offensive or illegal (or in some other way breaks the board rules). :yay:

As for the mouse drivers, I guess you already know that drivers can be "refreshed" from the Device Manager in Windows?

And I agree with naides, those switches are often the source of problems, doing something slightly non-standard that only works with some computers and such...
Silver
10-08-2004, 07:18 AM
I can advise you to give up on this. I had exactly the same problem as you using a Belkin KVM switch. My intellimouse worked fine for 6months, then at random the red "tail-light" flicked on and off and the mouse became unresponsive. Events were logged to the eventlog about i8042prt (or similar) timeouts. I tried the mouse directly on the PS2 port, it worked fine. I emailed Belkin, they said that they had heard of this problem and didn't support Intellimice (even though the box cl;early says they do, grr). Anyway another few months went by and the same thing happened with the mouse direct on the PS2 port.

The only solution I've found is to use Intellimice on USB only.
roocoon
10-08-2004, 08:20 AM
Thank you all for the comments.
I'm afraid none of the above applies in this case.
1) The switch works since it used to talk to the mouse up to the mobo change and it can still talk to it from two other computers. The switch has no drivers and the only bad experience I had with another one a few years ago, was when it couldn't handle the frequencies of a new graphics card I had bought.
2) A major point I neglected to mention because I thought it would be standard procedure for everyone, me first of all, was that I connected the mouse directly to the PC with the new mobo. Still dead as nails.
3) Another major point, same reason as above, is that I tried with another PS2 mouse. Vanilla PS2 compatible, no intellimouse, no wheel. Dead on this PC, works with the others.
4) And similarly another point, I've uninstalled all mice-related drivers and the keyboard, rebooted, the system detected them automatically. Both keyboard and the PS2 mouse. Except that the mouse was still dead as nails.
No warnings in the device panel, no errors when I run hardware diagnostics with a number of various programs, no event viewer errors. Nada. Everything thinks the mouse is there and works fine.
This mouse really gets me frustrated. Where do the mouse messages go?
I've scanned for trojans, keyloggers, viruses, registry errors, disk errors, wrong driver versions etc, using a big number of different scanners, I've reset back and forth the BIOS option to activate the mouse. Nothing. My system is sparkling clean. (Maybe that's the problem. Too clean to support mice running around).
There's only one scenario I can think of that might explain it but I'm not sure of the way this stuff works.
Say the PS2 port on the computer was bad (e.g. loose pin connection) even though the BIOS doesn't detect any errors with it (should it?).
Now, I know XP detects there's a mouse on PS2.
Does it do it by really accessing the port and interrogating the mouse, or does it just look at whatever settings have been specified in the BIOS?
Hmm. Maybe something to do with PnP, ACPI?
JMI
10-08-2004, 08:38 AM
I also had intermittent problems with a wireless mouse used through a KVM. When switching between buttons on the KVM the wireless mouse would lose the USB signal and simply unplugging the USB cable and replugging it in again seemed to reestablish the connection. In that circumstance, I was always using the USB mouse through a PS2 post on the KVM through an adapter and something in the adapter was not making a full USB connection. Unpluging and replugging always seemed to solve the problem, but not an elegant solution.

I have since purchased a new version Belkin KVM with USB support, but the USB support is only for things other than the keyboard and mouse. I'm still using it with adapters for the keyboard and house, but this one doesn't seem to have a problem recognizine the logitech wireless keyboard or the logitech wireless mouse when I switch between computers, at least most of the time. Still, every once and a while it does not recognize the mouse (but still recognizes the keyboard), but unplugging/replugging still solves the problem. So my best guess is that there is something in the signal from the USB products which is not completely compatible with the PS2 mouse signal and sometimes it screws up. I would still suspect it is the KVM and not the Motherboard.

Regards,
naides
10-08-2004, 08:48 AM
2) A major point I neglected to mention because I thought it would be standard procedure for everyone, me first of all, was that I connected the mouse directly to the PC with the new mobo. Still dead as nails.
3) Another major point, same reason as above, is that I tried with another PS2 mouse. Vanilla PS2 compatible, no intellimouse, no wheel. Dead on this PC, works with the others.

This changes things a bit.
But, if you boot with DOS or LINUX(have you tried it) the mouse works. I doubt it is some loose wire tip in the connector, or it would be fucked in all OS environments. I think the problem is in then Mother board /mouse conversation when the windows XP driver is involved. Talk to the MB manufacturer

4) And similarly another point, I've uninstalled all mice-related drivers and the keyboard, rebooted, the system detected them automatically. Both keyboard and the PS2 mouse. Except that the mouse was still dead as nails.

Try to update the mouse driver to another, vendor provided one, using the device manager and pointing to your freshly d/l one, see what happens,

Or get into the exciting world of device drivers debugging, and trace the fucker in two machines, one that works and the one that doesn't, compare and fix.

Another thing, do you have softice installed in your computer? it uses its own low level mouse driver (Some times with very annoying consequences) does the mouse work when you activate Sice window?

This mouse really gets me frustrated. Where do the mouse messages go?
I've scanned for trojans, keyloggers, viruses, registry errors, disk errors, wrong driver versions etc, using a big number of different scanners, I've reset back and forth the BIOS option to activate the mouse. Nothing. My system is sparkling clean.

Advice from an old cracker, forget about it for a couple of days, enjoy the weekend, then come back with a fresh approach. You may be overlooking something big and obvious. . .
roocoon
10-08-2004, 10:12 AM
1) You're right about the problem not being in the pin connections since it works in DOS. (You just killed my only idea.) It works in Linux too (Knoppix version) as well as when I boot up with a BartPE CD built on the XP SP2 kernel..
2) It can't be the switch since I have the same problem when I connect directly to the PC. I don't use any wireless devices either but I have quite a few USB ones.
3) Updating with another driver is an option but how? It's a generic Microsoft PS2 mouse. I don't have any driver diskette for it and it's support is built into Windows.
4) I have Softice of course. Up to XP SP1 and the old mobo, the mouse in Softice and everywhere else, used to work. After the mobo change, it stopped. After XP SP2 (I upgraded after the mobo change), still didn't work.
5) Talking to Asus about it, won't get me far. I've asked in the Asus forum and nobody had this problem.
6) Relaxing for the weekend sounds good but it will not give me any answers I'm afraid. This mobo change, when the problem started, was around May. I've changed a couple of BIOS versions since then but no changes to the mouse behavior.
Weird, isn't it?
I think I used to have a program that would show me the driver chain for a device. I'll try and locate it. Maybe I have something in this system that intercepts the mouse calls and it has been corrupted. It can't be Softice (I had uninstalled it to check this) and it can't be Intellipoint (for the same reason).
Woodmann
10-08-2004, 04:57 PM
You have entered the 4th dimension of computers. When shit just plain wont work.

New MOBO mousie dont work on PS2 >>BUT<< works on USB.

One would have to think that the new board would be able to handle the ages old PS2 drivers. Makes sense doesnt it ????

New MOBO mousie works in DOS >>BUT<< not in Windows.

Once again, no PS2 driver support ???

Mousie works through the switch to other machines.

If you have the same chipset in another comp you could try to switch boards but, I think you should replace the Asus board.

Woodmann
roocoon
10-08-2004, 06:44 PM
Problem solved!
I tried again what Naides suggested about forcing new drivers.
Here's what happened:
1) I removed Softice, just in case, rebooted and got the dead mouse for my efforts.
2) I removed again keyboard and mouse drivers, rebooted, system found and installed them. It claimed everything worked fine but mouse was dead. The mouse driver was an original Windows XP one from 1991. Mouse was shown as "Microsoft PS/2 port mouse".
3) I installed Intellipoint 5.2, removed the mouse driver, rebooted, the system identified and installed the driver.
The mouse got alive again.
The driver was dated 6/3/2004 and identified as "Microsoft PS/2 port mouse (Intellipoint)".
4) Reinstalled Softice and the mouse still works. Back in business.
It was a driver problem after all.
What I think happened, is that the old driver used to work in the old system but not the new one, because of the difference in speed. Maybe it could handle the 2.6GHz but not the 3.2. Probably a bug in its timing routine. It was a 1991 version after all.
Well, one down and I can spend some time trying to straighten my twisted wrist and shoulder.
Thank you all for the suggestions and help. I would have given up again on my own.
Take care.
dELTA
10-08-2004, 07:00 PM
It always warms my heart to see such a thing get resolved, congrats. :yay:

Humans: 1
Computers: 95907869734832608260
Woodmann
10-08-2004, 07:08 PM
:(

And here I was thinking I might be correct for once :rolleyes:

Woodmann
Silver
10-09-2004, 10:30 AM
Woodmann, I've just stolen your quote for my sig.. Classic :D
JMI
10-09-2004, 11:12 AM
Woodmann was correct when he said "we" always blame him when something goes wrong with the server. :devil: So he was correct at least once. :yay:

:loveu:

Regards,
Woodmann
10-09-2004, 03:44 PM
Howdy,

Hey Silver, dont think that by quoting me your gonna get anything for free :devil:

Does anyone remember the old days when there was no driver available so you tried every one you could find just to make the printer print text ???
:D

Woodmann

Now that I read the solution to the problem again, I thought it was the old XP driver, You know, the one from 1991 ?? I think that would cause a problem :smug:
JMI
10-09-2004, 03:55 PM
Damn near everything from 1991 causes a problem, if one is still running it with XP. :D

Regards,
roocoon
10-10-2004, 07:02 AM
You got me wondering about that 1991 but I'm not about to put back the old MS driver and verify it :)
I must have put the wrong number and 2001 sounds more like it (fingers don't type what the mind thinks sometimes).
In any case, it's not a driver I put there. It came with the original XP Pro. I've put service packs in after that, but never a mouse driver other than Intellipoint.
Regards.


a program that detects debugger attachment
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > a program that detects debugger attachment
PDA

View Full Version : a program that detects debugger attachment

kbot
10-09-2004, 04:59 AM
when ever i try attaching ollydbg and other debuggers to this program , it will detect the debugger instantly (... well after i press f9 to resume the process when olly breaks on attaching) and also this is not the work of IsDebuggerPresent because i used the hide debugger plugin + i made a hook on that api to return 0 when testing other debuggers on it. CheckRemoteDebuggerPresent also wont be a problem as i dont have winxp sp1 (just retail)... so any ideas ?

edit:... oh yeah... i cant use softice cuz when i load it up it will use 100% cpu power and then eventually crash (winxp; driver suite 2.7 and also i tested driver suite 3 too).
JMI
10-09-2004, 10:48 AM
You have not stated the information you were required to state in the FAQ and in your signature block. There are several processes which are used to detect debuggers, from the simple to the complex. You need to do some of your own home work and "search" for answers "before" you ask. For example, there are some protection systems which search various places for the "name" of the debugger or its window title and changing the name of the exe and/or searching for the window title and changing that also will prevent some protection systems from spotting your debugger.

Using "detect + debugger" (without the quotes) with the SEARCH button, I got 45 entries here you should review. You could also use "ollydbg + detect" (without the quotes) which gave 10 results you should check. :yay:

Regards,
kbot
10-09-2004, 11:14 AM
it doesnt detect anything to do with titlename/classname b/c i renamed with a hexeditor + i also tried renaming the title with SetWindowText. also as mentioned, i tried this with other debuggers (built into cheat engine and tsearch) and also some other ones like PEBrower Pro.. oh yeah, the protection is asprotect 1.23RC4, tools are: ollydbg XD, i have read tutorials on common debugger detection, meltice, int68, int41, etc, but they most concerns softice and kernel mode debuggers which im not using (though i wish i could use softice again..) and the detection methods for user-mode debuggers, IsDebuggerPresent, that checkremote one and NtQueryInformationProcess, i used an old dll(which is injected) which i made which writes

IsDebuggPresent:
xor eax,eax
ret

and hooks NtQueryInformationProcess to always return 0x0 if the information is requesting for the debugport
JMI
10-09-2004, 12:12 PM
And did you read the threads here on detecting Olly mentioned in my previous post? You see how much more informative your earlier post would have been if you had included, as required by the posting guidelines, the steps you had already tried and the searching you had already done?

Using "ollydbg detect* + asprotect" ( again without the quotes) I got 24 hits in various languages. Have you done such a focused search? Notice the use of the "*" symbol to catch both "detect" and "detection" and "detected". A useful tool for searching.

Regards,
kbot
10-09-2004, 09:37 PM
the point is that its not only ollydbg that gets detected, because i tried other usermode debuggers besides ollydbg, so detection techniques have to be general, and i only can think of 3 methods which i mentioed above(i believe that asprotect uses the IsDebuggerPresent detection, as i remember from unpacking asprotect b4) and concerning, seting up an exception to crash olly, olly can pass exceptions on to the debuggee plus no expections are raised after resume it so thats not a valid detection method.

i looked into those articles in google and found the olly detection mostly to do with FindWindow and Process32First/Process32Next, which is easy to trick... FindWindow=hexedit, Process32First/Process32Next=hook NtQuerySystemInformation, or hook the actual api, or unlink ollydbg from the double linked list containing all active processes. but as mentioned, the method of detection is general to all user-mode debuggers, so its not valid.
evlncrn8
10-09-2004, 11:02 PM
theres a lot more than 3 methods to detect a debugger..
kbot
10-09-2004, 11:06 PM
yes.. but most methods concern softice and kernelmode debuggers... thats y im asking, what methods exist for usermode debugger
0rp
10-10-2004, 11:02 AM
with Get/SetThreadContext, an userapp can read various debug regs, which are used by most debuggers.

i would try to hook GetThreadContext and manipulate its result
dELTA
10-10-2004, 11:20 AM
Normally it wouldn't even have to use these API calls to get them, it could simply catch them directly from the stack in an exception handler, right? In that case this hook wouldn't work...
JMI
10-10-2004, 11:25 AM
And have you considered dissassebly of the exe to see if you can follow the dead listing to determine where the debugger "detection" is occurring? As an alternative, have you attempted to intercept the start of the program and step through it until it detects the presence of the debugger? In other words, are you taking a proactive approach to helping yourself?

Regards,
HAVOK
10-11-2004, 01:09 PM
Hi guys,

My first post here - normally, due to my low logging frequence everything is answered - pleased to meet you all! :D.

@kbot:

Asprotect doesnt have sophisticated anti-debug on its newest versions, perhaps the packer is not this one and has used some trick to hide itself (sections renaming and some code at the entry point, say). If i recall, you should be able to attach to asprotected targets after they run... (not sure).

Anyway, when you hook a procedure you have to keep in mind that the packer will emulate the first instructions and so it's quite likely to miss the call. Indeed, it's possible to emulate (in user-level) until you reach the "int 2E". So, i'd be more careful with hooking...

The latest asprotect has a very improved emulation. I mean, improved with respect to the previous one. Indeed, seems that svkp has "imitated" it (according to what i've read at their web).

Hmmm... if the target is asprotect i think you'd better debug into.

Regards,
havok.


good customer support as an anti-crack measure
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > good customer support as an anti-crack measure
PDA

View Full Version : good customer support as an anti-crack measure

r4g3
10-09-2004, 07:42 AM
From the nfo of the latest warezed IDA release (v4.7.0.830):

Note: Huge thanks to guy, who found us and presented us his fairly purchased version for releasing. Watermarks are not removed (is it possible to remove all of them?), but it's makes no sense for the supplier, because he is angry on DataRescue. They should provide some support for fairly purchased versions, even on hardly catchable bugs, not just telling "Fuck off, you're using pirated version!".
JMI
10-09-2004, 11:07 AM
As yee sow, so shall yee reap. If they can't recognize legitimate customers, they are really in trouble. :eek:

Regards,
Woodmann
10-09-2004, 03:38 PM
Wow,

They really need to get their act together or they will really be sorry when that gets the shit warezed out of it.
You know, when you type in IDA and the first result from google is the crack :eek:

Woodmann


What is the Flags field in the output of a SoftICE Query command?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > What is the Flags field in the output of a SoftICE Query command?
PDA

View Full Version : What is the Flags field in the output of a SoftICE Query command?

Rummy
10-09-2004, 08:38 PM
What is the Flags field in the output of a SoftICE Query command? I assume it has information on resident vs. non-resident, protections, etc, but where is it documented? Does it reflect what I get in MEMORY_BASIC_INFORMATION from VirtualQueryEx ? I've searched and can't find anything definitive. Not from the SI guide or ref, not from Nebbett and not from Google. I searched this board too. :yay: but there's nothing about what's in the 32-bit Flags output from the Query command. Does anybody know what they are? They're not heap flags because the page I'm Querying isn't part of a heap. It's just a page in the process address space.

I have an allocated page in one of my programs that's supposed to be resident but I'm getting errors because I don't think it is. If I knew exactly what those flags were I would be closer to a solution. Can someone enlighten me please?
Kayaker
10-10-2004, 01:45 AM
Hi

This may be the Flags field of the VAD (Virtual Address Descriptor Table), though I'm not sure of its exact significance. The Softice ref gives an example of the output from the QUERY command:

Context Address Range Flags MMCI PTE Name
csrss 7F2D0000-7F5CFFFF 06000000 FD8AC128 E1191068 Heap #07

Address Range - Start and end address of the linear range.
Flags - Flags from the node structure.
MMCI - Pointer to the memory management structure.
PTE - Structure that contains the ProtoPTEs for the address range.

Knowing PTE's were involved, I looked into the VAD structure. Here is the def from ntifs.h. Notice the ProtoPTE field which is also referenced by Sice.

typedef struct _VAD_HEADER {
PVOID StartVPN;
PVOID EndVPN;
PVAD_HEADER ParentLink;
PVAD_HEADER LeftLink;
PVAD_HEADER RightLink;
ULONG Flags; /* LSB = CommitCharge */
PVOID ControlArea;
PVOID FirstProtoPte;
PVOID LastPTE;
ULONG Unknown;
LIST_ENTRY Secured;
} VAD_HEADER, *PVAD_HEADER;

There is a full description of walking the VAD tables (which I believe is what Softice QUERY does) in this Memory Management doc by Prasad Dabak. Slightly different structure used. It only describes the Flags as
"The last member in the VAD node is the flags for the address range."

typedef struct vad {
void *StartingAddress;
void *EndingAddress;
struct vad *ParentLink;
struct vad *LeftLink;
struct vad *RightLink;
DWORD Flags;
}VAD, *PVAD;

http://www.windowsitlibrary.com/Content/356/04/3.html
http://www.windowsitlibrary.com/Content/356/04/4.html

Finally, from the useful RelSoft doc the following structure is described.

Public Type MM_AVL_TABLE
Root As MMADDRESS_NODE
Flags As Long
NodeHint As Long
NodeFreeHint As Long
End Type
Public Type MMADDRESS_NODE
Parent As Long
LeftChild As MMADDRESS_NODE
RightChild As MMADDRESS_NODE
StartingVpn As Long
EndingVpn As Long
End Type

Root- This field contains the first VAD, in the also called a MmAddressNode.
Flags- This field contains the depth and size of the tree.

http://www.relsoft.net/Articles/Process/mmltoken.html

I can't confirm exactly what the Flags field signifies, but I don't know if knowing would really help you much. I've looked at the QUERY code in Softice and while I can roughly follow it, I can't tell if Sice begins by getting the VadRoot from the EPROCESS structure or what. Maybe someone has more info.

Cheers,
Kayaker
Rummy
10-10-2004, 04:23 PM
Thank you, Kayaker, for your very helpful reply. I don't have an ntifs.h file anywhere but I think I know what it is and I'm off to look for it :devil: The MMCI and PTE fields also drew my interest but I couldn't tie them in with anything obvious for the Flags. I have most of the "Undocumented" and "Inside" books but in all the places I searched I never looked there. Thanks for the pointers. I have some more reading to do on Virtual Address Descriptors. Hopefully I can figure out what those flags are exactly. I fixed my programming problem by taking a different approach so my need for this Flags knowledge is not as great as it was yesterday. I'm sure it will come up again though and now I have a different level to start from when I start digging. Thanks again.
bilbo
10-12-2004, 01:57 AM
Hi, Kayaker, thanks for your in-depth synopsis of an important kernel structure!

This may be the Flags field of the VAD (Virtual Address Descriptor Table), though I'm not sure of its exact significance.

Correct!
AddressRange is StartVPN<<0xC - EndVPN<<0xC
Flags is the Flags field
MMCI is the ControlArea field
PTE is FirstProtoPte

There is a full description of walking the VAD tables (which I believe is what Softice QUERY does) in this Memory Management doc by Prasad Dabak.

Correct!
Another complete project of VAD tree walking came out by casual googling
at link http://hume.blogdriver.com/diary/hume/inc/W2kmmvad.rar

I've looked at the QUERY code in Softice and while I can roughly follow it, I can't tell if Sice begins by getting the VadRoot from the EPROCESS structure or what.

Exactly from VadRoot!

Maybe someone has more info.

The only stuff I can add here is the meaning of the flags, taken from Windows XP ntoskrnl.pdb. The bits are defined, from the least significant, as
(position:number_of_bits):

struct _MMVAD_FLAGS {
unsigned long CommitCharge:0:13;
unsigned long PhysicalMapping:13:1;
unsigned long ImageMap:14:1;
unsigned long UserPhysicalPages:15:1;
unsigned long NoChange:16:1;
unsigned long WriteWatch:17:1;
unsigned long Protection:18:5;
unsigned long LargePages:1d:1;
unsigned long MemCommit:1e:1;
unsigned long PrivateMemory:1f:1;
};

A further investigation on the exact meaning of every flag would be very interestings.

Regards, bilbo
JMI
10-12-2004, 11:03 AM
Once again Kayaker and our wandering Hobbit have provided indepth information about the inner workings of an obsture segment of Softice internals. Thanks guys. :yay:

Regards,
Kayaker
10-13-2004, 02:25 AM
Hello Mr. Baggins: ;)

That was very useful info. It appears a bit of bit mapping is in order on those flags, there seem to be only a half dozen or so combinations of Highword values. For reference, the Flags for user processes are consistently 0710000x on Win2k.

There seems to be a small problem with that Vaddump app with version compatibility, and it won't run on my system, but it's nice to have the full source.

I had another look at the QUERY command in Softice trying to find where the hell that [EPROCESS+194h] = VadRoot instruction was. As you may have discovered, you can't confirm it from a static disassembly alone (you can't get there from here).

At the start of the QUERY command, Sice uses a function to get certain variables from the current EPROCESS structure. This is a bit of a global function that's used half a dozen times in Sice code. It gets the current context (KPEB) from a global variable and parses the EPROCESS structure (KPEB in Sice) for various fields to store in an internal structure. It does some of this indirectly, by adding to the EPROCESS address offsets it gets from variables in its data section. You need to be in a process context, not a system context, to see the correct values of these offsets after they are initialized. Some of the data fields seem to be initialized to non-zero as seen in IDA, but this is bogus, they change at runtime.

With some checking I was able to determine Sice gets the following fields:

Directly indexed it gets a bunch of KPROCESS fields including
[EPROCESS+18h] = KPROCESS.DirectoryTableBase

Indirectly indexed (runtime values) it gets
[EPROCESS+194] = VadRoot
[EPROCESS+128] = ObjectTable
[EPROCESS+1B0] = PEB
[EPROCESS+9C] = UniqueProcessId
[EPROCESS+1FC] = ImageFileName

Here's the start of the Softice QUERY command for ntice 4.31, some of the definitions are originals from The Owl.

:00032A10 c_Query: ; DATA XREF: .data:001112BD
:00032A10 55 push ebp
:00032A11 8B EC mov ebp, esp
:00032A13 BE A2 F7 10 00 mov esi, offset bUserCommand
:00032A18 E8 2C 75 03 00 call pSkipWord
:00032A1D 73 14 jnb short loc_32A33
:00032A1F BB EA F6 0E 00 mov ebx, offset buff_Eprocess
:00032A24 8B 15 FF 16 0F 00 mov EDX, dCurrentContext
; = KPEB = EPROCESS (= KPROCESS)
:00032A2A E8 EA F8 FF FF call Get_EPROCESS_Fields
...

And the start of the function:
:00032319 Get_EPROCESS_Fields proc near
:00032319 60 pusha
:0003231A 89 13 mov [ebx], EDX ; EPROCESS(KPEB)
:0003231C 8D 7A 18 lea edi, [edx+18h] ; KPROCESS.DirectoryTableBase
:0003231F E8 BF B0 03 00 call pMOV_EAX_EDI
:00032324 0F 82 0A 01 00 00 jb loc_32434
:0003232A 89 43 08 mov [ebx+8], eax
:0003232D 8B FA mov edi, EDX
:0003232F 03 3D 76 F7 0E 00 add edi, dword_EF776 ; 194h EPROCESS.VadRoot
:00032335 E8 A9 B0 03 00 call pMOV_EAX_EDI
...

The VadRoot is parsed later on to output to the command window, recognized by the
shl eax, cl
instructions which are the Address Range (*VPN<<0xC) Bilbo mentioned.

Ahh, the fun of exploring YAMS (Yet Another MS Structure...:p)

Regards,
Kayaker
bilbo
10-15-2004, 02:18 AM
Well, I hope not only you and me are interested in this stuff (the same holds for your explanation of Sice Breakpoints Table), anyway I am happy you are giving new stimulus in this board... By the way, I hope we are not violating any rule if we go too deep inside the details, who knows, the world is full of rules...

At the start of the QUERY command, Sice uses a function to get certain variables from the current EPROCESS structure. This is a bit of a global function that's used half a dozen times in Sice code.

sub_32319, as you say after...

Some of the data fields seem to be initialized to non-zero as seen in IDA, but this is bogus, they change at runtime.

their values are taken during NTICE initialization from OSINFO.DAT (sub_94B40, a real headache!), a collection of all the interesting data for all the Microsoft platforms.

Indirectly indexed (runtime values) it gets
[EPROCESS+194] = VadRoot
[EPROCESS+128] = ObjectTable
[EPROCESS+1B0] = PEB
[EPROCESS+9C] = UniqueProcessId
[EPROCESS+1FC] = ImageFileName

For Windows XP SP1:
[EPROCESS+11C] = VadRoot
[EPROCESS+C4] = ObjectTable
[EPROCESS+1B0] = PEB
[EPROCESS+84] = UniqueProcessId
[EPROCESS+174] = ImageFileName

Ahh, the fun of exploring YAMS (Yet Another MS Structure...)

Yeah, if they were open-source it would be less fun. isn't it?

Best regards, bilbo


softicent427 ? ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > softicent427 ? ?
PDA

View Full Version : softicent427 ? ?

dalong
10-10-2004, 11:03 PM
Everybody How are you. ^ ^
The appear place softice 3.01 to be being up-to-date version? The siw405nt what and is the softicent427 what?
Kayaker
10-10-2004, 11:17 PM
Apology for English understood.

What?

Is this an answer?

SoftIce 3.01 = old
SoftIce 4.05 = old
SoftIce (DriverStudio) 4.27 = new
DriverStudio 4.31 = newer
...

DO NOT ask where to DOWNLOAD. Understood?
DO NOT ask where to DOWNLOAD. Understood?
dalong
10-11-2004, 12:13 AM
I was misunderstand. It knew well in indebtedness. Thank you.

PS:Only "Apology for English understood." it drew out and all it understood.

Apology for English understood.--->Joke? ki ki ki(One type of Korean netizen laugh)
dalong
10-11-2004, 12:31 AM
Ah~~"Apology for English understood."--->Maybe the expression which is polite?
What kind of meaning Thank you.^ ^
Kayaker
10-11-2004, 01:41 AM
Heheh, this is getting weird :p

You say in your signature:
"I cnanot do well English and it is sorry."

I say:
"I understand that you do not speak English well, but that is OK."

Understand? :)
dalong
10-11-2004, 01:53 AM
Understand! :D


import table - add a dll -
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > import table - add a dll -
PDA

View Full Version : import table - add a dll -

sefo
10-11-2004, 03:34 PM
hello, 2 questions:
this is a sample of the pointer to the import table
0820 0000 2800
2008 should be the address of the table and 28 its size?
i don't understand how i can find these informations with this line

2nd question:
the import table:

8 ......0 ......
....F ... ......
................
8 ......u.ExitPr
ocess.KERNEL32.d
ll

where do I have to put the function i want ?
say USER32!MessAgeBoxA
Directly at the end? And then how can I calculate the changes i have to do to the import table description?

Any link or idea would be welcome
regards
dELTA
10-11-2004, 06:54 PM
There are many factors involved when manipulating PE files, you need to take a good read of a PE specification document before you can understand this in a good way.
doug
10-11-2004, 07:50 PM
If you have problems interpreting these fields, you probably want a tool that does it for you.

Take a look at this thread:
http://www.woodmann.com/forum/showthread.php?t=6347
Peres
10-12-2004, 02:22 AM
Take a look at the thread named 'Changing notepad's background color' in the Mini Project Forum. I explain how to add dlls and import entries there.

Peres


SoftIce Breakpoint Table Structure
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > SoftIce Breakpoint Table Structure
PDA

View Full Version : SoftIce Breakpoint Table Structure

naides
10-12-2004, 01:38 PM
This is related to address context specific breakpoints.
set BreakInSharedMods on allows me to place bpx outside the address context, but placing a bmsg still requires me to be standing on the right addr. Could some one check and tell me if it is the case in your system also??

Thank you
Kayaker
10-13-2004, 07:07 PM
Hi Naides,

So you have something to compare with - from a system context I 'hwnd Notepad' and set a 'bmsg <hwnd> wm_command' on the main Notepad class handle. When I then select a menu item (File/New) in notepad, Sice 4.31 on Win2K obediently breaks at the start of the message queue code. Also occurs (twice) when I type a character in the Edit window. BreakInSharedMods is off.

So, the answer is No I guess...

K.
naides
10-14-2004, 07:58 AM
Oh. well, In wXP it does not seem to recognize the <hwnd> six hex digit number unless I am in the address context of the app that owns the <hwnd>. May be there is some other setting that I have ovelooked. and JMI. I did look up TFM and Google, the UNIVERSAL manual.

By the Way, Thank you for the Response Kayaker. You are always helpful.
JMI
10-14-2004, 11:46 AM
naides you have been here long enough for everyone to assume you made an effort to find the answer yourself without success. :yay:

Regards,
Kayaker
10-15-2004, 12:08 AM
Thanks Naides, let's see if this is helpful...

So, it's starting to look like XP SP2 sucks, er may have compatibility issues with Softice? OK, that wasn't helpful. No matter, maybe we can bypass the problem. Do your breakpoints work if you type ADDR <process> before setting them?

Let's say BMSG breakpoints don't work, what we really NEED is the starting address of the Message Queue which handles the WM_ messages. If you have that you should be able to set a different style of (conditional) BP on that address which will work just as well. How to find that address without deadlisting etc.? By some quirk of magic, Softice knows the address of the Message Queue and translates your "BMSG <hwnd> wm_*" messages directly into an address in its breakpoint table.

A couple of years ago I posted a preliminary examination of the Softice breakpoint table structure. I've updated it for Softice DriverStudio 4.31 and here are the results of my findings. The original stuff was from this thread and the screendumps and notes I made are in the attachment. For other notes on the details of breakpoints, see Softice Internals by +Spath.

IceDump & VXDLDR_LoadDevice error
http://woodmann.net/forum/showthread.php?t=4040&highlight=VXDLDR_LoadDevice

bpstructuredumps.zip (1.8 KB)
http://woodmann.net/forum/attachment.php?attachmentid=490

The SoftIce Breakpoint Table is a block of data in non-paged Sice memory consisting of 32 identical arrays, of a type Softice identifies as "TDJF". Each structure is 178h bytes in length. Thus you are limited to 32 breakpoints of all types, (only 4 of type BPM/BPIO). The structure has changed a bit from Softice 4.05, if my initial analysis was correct the size used to be 183h bytes and a total of 256 BP's were allowed.

Here is the breakpoint structure Softice uses, easily recognized by the beginning and ending ascii strings "TDJF". I renamed this structure BREAKPOINT_INFO here, substitute for the name TDJF. The structure is not fully defined and may have some errors (end disclaimer). I have not compared with any other structures that might be floating around.

0000 BREAKPOINT_INFO struc ; (sizeof=0x178)
0000 ascii_TDJF_1 db 4 dup(?) ; "TDJF"
0004 Breakpoint_Type db ? ; BPINT = 01h
0004 ; BPM/BPIO = 03h
0004 ; BPX = 05h
0004 ; BMSG = 06h
0004
0005 Enabled_Flag db ? ; toggled with BE, BD
0006 DRx_Register db ? ; DR3=83h, DR2=82h, DR1=81h, DR0=80h
0006 ; used with BPM/BPIO breakpoints
0006
0007 Address_1 dd ? ; Breakpoint address or BPIO port number
000B Address_2 dd ? ; unknown usage
000F Breakpoint_Mode db ? ; execute = 0
000F ; write = 1
000F ; read = 2
000F ; read/write = 3
000F
0010 unknown_dword_1 dd ?
0014 CodeSegment_CS dw ? ; 0008, 001B, etc.
0016 unknown_03h db ? ; seems to be 3 for all BP types
0017 Address_1_repeat dd ? ; Duplicate BP address
001B unknown_word_1 dw ?
001D unknown_byte_1 db ?
001E unknown_dword_2 dd ?
0022 unknown_dword_3 dd ?
0026 unknown_dword_4 dd ?
002A unknown_byte_2 db ?
002B BMSG_hWnd dd ? ; Class handle for BMSG breakpoints
002F unknown_word_2 dw ?
0031 unknown_byte_3 db ?
0032 unknown_byte_4 db ?
0032 ;
0033 unknown_dword_5 dd ?
0037 unknown_dword_6 dd ?
003B unknown_dword_7 dd ?
003B ;
003F unknown_byte_5 db ?
0040 unknown_byte_6 db ?
0041 unknown_byte_7 db ?
0042 unknown_byte_8 db ?
0042 ;
0043 unknown_dword_8 dd ?
0047 unknown_dword_9 dd ?
004B unknown_dword_10 dd ?
004F unknown_dword_11 dd ?
0053 unknown_dword_12 dd ?
0057 unknown_dword_13 dd ?
005B unknown_dword_14 dd ?
005F unknown_dword_15 dd ?
0063 unused_dword_1 dd ?
0067 unused_dword_2 dd ?
006B Length_Module_Name db ? ; byte length of string that follows
006C Module_Name_String db 264 dup(?) ; Name of process (breakpoint context)
0174 ascii_Tdjf_2 db 4 dup(?) ; "TDJF"
0178 BREAKPOINT_INFO ends

Now, back to the other issue of finding the address of our BP. The field TDJF.Address_1 is it. If you've set a BMSG bp, this will be the starting address of the Message handling code that BMSG is supposed to break on.

So, Naides, you can check, #1 - if your bp's are being set properly, and #2 - if so, use the address directly if BMSG fails, but let Sice calculate the correct address to break on and scam it from the BP Table.
(ponders if Subclassing is always handled correctly...)

Er, how to find the Breakpoint Table? (an array of TDJF structures). The easiest way to find the starting address of the 1st structure is by searching for hex bytes 54 44 4A 46 ("TDJF") in IDA on your ntice.sys version. Go 178h bytes from there and you've found the 2nd structure (beginning with 54 44 4A 46), etc., up to 32 times. Apply my structure definition and you can examine the Sice "breakpoint" commands.

In memory, which is what you really want, a simple byte scan of ntice code ("DRIVER ntice") should also find the string "TDJF", or better yet, get the address directly from one of the BP commands. Here is the Sice code for BMSG, you should be able to find the BP Table address from any of the TDJF.field[ebx] instructions for your own system.

:000A39ED c_Bmsg proc near ; DATA XREF: .data:00111239
:000A39ED
:000A39ED var_1C = dword ptr -1Ch
:000A39ED
:000A39ED 55 push ebp
:000A39EE 8B EC mov ebp, esp
:000A39F0 83 EC 1C sub esp, 1Ch
:000A39F3 E8 F1 EC F8 FF call sub_326E9
:000A39F8 BE A2 F7 10 00 mov esi, offset bUserCommand
:000A39FD E8 70 AB FC FF call sub_6E572
:000A3A02 E8 42 65 FC FF call pSkipWord
:000A3A07 0F 82 65 01 00 00 jb loc_A3B72
:000A3A0D E8 14 A5 FC FF call pExpression2Integer
:000A3A12 0F 82 6B 01 00 00 jb loc_A3B83
:000A3A18 8D 7D E4 lea edi, [ebp+var_1C]
:000A3A1B 57 push edi
:000A3A1C 50 push eax
:000A3A1D E8 14 DB F9 FF call sub_41536
:000A3A22 0B C0 or eax, eax
:000A3A24 0F 84 7A 01 00 00 jz loc_A3BA4
:000A3A2A 8B 47 0C mov eax, [edi+0Ch]
:000A3A2D E8 FE 47 FA FF call pSwitchContext_InWinice
:000A3A32 E8 D3 0C 00 00 call pAllocateBP
:000A3A37 0F 82 5B 01 00 00 jb loc_A3B98
:000A3A3D 8B D8 mov ebx, eax
:000A3A3F 8B 47 04 mov eax, [edi+4]
:000A3A42 89 83 FA EB 11 00 mov TDJF.BMSG_hWnd[ebx], eax
:000A3A48 C7 83 F1 EB 11 00 FF FF+ mov TDJF.unknown_dword_3[ebx], 0FFFFFFFFh
:000A3A52 8B 57 14 mov edx, [edi+14h]
:000A3A55 83 3F 00 cmp dword ptr [edi], 0
:000A3A58 74 22 jz short loc_A3A7C
:000A3A5A C6 83 EC EB 11 00 20 mov TDJF.unknown_byte_1[ebx], 20h
:000A3A61 C6 83 E5 EB 11 00 03 mov TDJF.unknown_03h[ebx], 3
...

:000A470A pAllocateBP proc near ; CODE XREF: c_Bpint+25
:000A470A ; c_Bpx+1B6
:000A470A 53 push ebx
:000A470B 51 push ecx
:000A470C B9 1F 00 00 00 mov ecx, 1Fh
:000A4711 B8 00 00 00 00 mov eax, 0
:000A4716
:000A4716 loc_A4716: ; CODE XREF: pAllocateBP+1A
:000A4716 80 B8 D3 EB 11 00 00 cmp TDJF.Breakpoint_Type[eax], 0
:000A471D 74 0A jz short loc_A4729
:000A471F 05 78 01 00 00 add eax, 178h
:000A4724 E2 F0 loop loc_A4716
:000A4726 F9 stc
:000A4727 EB 28 jmp short loc_A4751

Cheers,
Kayaker
JMI
10-15-2004, 02:41 AM
Kayaker:

Great stuff, as per usual. :yay: Wish I had more time to play with the code.

Regards,


Are you sharp sighted enough?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Are you sharp sighted enough?
PDA

View Full Version : Are you sharp sighted enough?

dELTA
10-12-2004, 05:04 PM
Spot the three differences...

http://members.home.nl/saen/Special/Zoeken.swf

:devil:
JMI
10-12-2004, 05:41 PM
OK. Now that you broke my glasses, you are going to have to buy me a new pair. Was that a self portrait?

Regards,
Aimless
10-13-2004, 12:41 AM
Goddam!!!

You guys should know I've just had my bypass done!!

I couldn't stop my heart from thumping for seven long seconds!.

I loved the surprise.

Awesome.

Goodthing I don't have a weak heart, or I'd be on the floor. With my mouth wide open.

Delta, you owe me and my heart some... ;)

Have Phun
dELTA
10-13-2004, 06:30 AM
I can't understand why everyone finds it so exciting to just find the differences between two pictures, are they that hard to find? :D Is there anyone who can spot all three differences?
JMI
10-13-2004, 09:15 AM
Why are you limiting it to finding only three, there certainly are more than the three you suggest. :yay:

Regards,
Rackmount
10-13-2004, 11:39 AM
Here is what I saw....tell me if I'm close...

1. The bike rider on the XXXX is heading XXX in first pic and north in second.
2. The man on the XXXX has XXXX in first and XXXXX on second.
3. The XXX in the yard has a blue XXXX in first and XXX in second.

Now....do I win? :D
stephenteh
10-13-2004, 11:48 AM
..............
i found 4 difference places.... :D
anyone found more than me ???
try it see who is the best...... :devil:
JMI
10-13-2004, 12:03 PM
Rackmount and stephenteh:

Congratulations. dELTA has promised to send the person who finds the most differences his humongous monitor as a reward. :yay: :devil:

Regards,
Kayaker
10-14-2004, 10:03 AM
You Bastid!! :mad:

Warning: May not be suitable for those who easily wet themselves or spill coffee on their crotch when surprised.
dELTA
10-14-2004, 10:17 AM
:p That's what so great with this one, there are so many hidden differences that you get really surprised when you start finding them. :D
Silver
10-14-2004, 10:34 AM
Yeah, great... now I need a new mouse... I lept backwards on finding the third difference, mouse flew out my hand and bounced off the wall...

:D
JMI
10-14-2004, 11:49 AM
Your mouse must have noticed the cat in the right hand picture and was just reacting instinctively. :eek:

Regards,
klier
10-14-2004, 04:28 PM
that would be a nice nag screen.
Regards,
Woodmann
10-14-2004, 06:20 PM
Ummmmmmmmm......

That guy on the cruise ship that is waving...
The little kid kicking a ball....
If you look way over to the right you will see the mountain goat...
Was that the Loch Ness monster ??

I dont know how many people dont have their speakers turned on but,
When I turned mine on really loud, I could hear someone saying Auf Wiedersehen Fritzzy.

Woodmann
JMI
10-14-2004, 06:51 PM
Wow. I don't generally have my sound turned on unless I'm listening to music while I work. It's way better with the sound on. :yay: You can even hear the boat whistle, although I still haven't figured our which boat is blowing it's horn. Maybe I need better speaker separation. :idea:

Regards,


Change detection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Change detection
PDA

View Full Version : Change detection

Hero
10-15-2004, 01:18 AM
Hi all
I'm a newbie in cracking,then I can't get through my cracking excercise well.
I start cracking a famous Zip password recovery tool(I think everybody find
it out!).The last version 3.54 of it is worth to write keygen or crack because
it can test up to 15 miliom passes per seceond.
I start with using Stripper for breaking its AsProtect down.
Then I find the protection routine simply by tracing the DialogBoxParam().
Everything goes well until I try to change and remove protection routine
from program(Changing all of it with NOP and make true result for output),
this Program can detect the code modification and will terminate!
I think it uses loading some code from File resourses and use it.But I can't
Find How I can change the code and the program don't detect it.(I think
It compare some codes of program with loaded resource).
Is there anybody that help me for cracking it out?
Note: message that is shown by detection of code modification is come from
the routine of SetUnhandledExceptionFilter().

sincerely yours
JMI
10-15-2004, 02:39 AM
Have you done any review of reference materials on code used to detect code modification, either here or on the net? For example, using the main search feature here, I entered "Code modif* + detect*" (without the quotes) and got at least 20 hits. Are you familiar with CRC-32 checking and similiar processes for detecting modifications? In other words, what have you done to help yourself solve your problem? You may have done alot, but you haven't said.

Regards,
Fake51
10-15-2004, 06:15 AM
This might be one of those great occasions to smack a newbie with the entire HCU archive. As all students who've ever read one of the old essays should know, scanning for 90h in interesting places is all it takes to determine whether or not to trash the hd of a wannabe cracker. Programmers may still be stupid, but that's not really an excuse for not reading up on the most fundamental techniques of patching exe files.

Fake
dELTA
10-15-2004, 07:47 AM
To sum up what the posters above said: The file seems to do "crc check" / "integrity check" / "self check" of some kind on itself. Search and read about this kind of protection and you will find good info.
Shoob
10-16-2004, 03:49 AM
Hi, this program got no "modification" check at all. You want to find a protection routine by tracing a windows API (DialogBoxParamA) ? :thinking: think about it again ...
Fake51
10-16-2004, 04:41 AM
Hi, this program got no "modification" check at all. You want to find a protection routinge by tracing a windows API (DialogBoxParamA) ? :thinking: think about it again ...
While your first comment seems to indicate you know bout the program, your second comment seems more general. Why not look at dialogboxparam?

From the msdn:

INT_PTR DialogBoxParam(
HINSTANCE hInstance,
LPCTSTR lpTemplateName,
HWND hWndParent,
DLGPROC lpDialogFunc,
LPARAM dwInitParam
);

Notice the DLGPROC - supplied by the program. If the serial input is gathered from a dialog, it will pass through there. So why not look at the dialogboxparam? It's just one out of a gazillion different starting points, probably no worse than others.
But then again, your second comment may be program specific, and you know something I don't (haven't looked at said program).

Fake
Shoob
10-16-2004, 05:08 AM
True true, .. i guessed he traced in the startup dialog so that isnt the way to find a "modification" protection like he meaned. You can break on API and trace further but if you trace in it, you will never find a protection against "modification" in it. My first suggest was that he nopped the call to the startup Dialog api out, so the programm wont start anymore. Btw @ first poster: no cracking requests here.


Installshield 7 exe fun
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Installshield 7 exe fun
PDA

View Full Version : Installshield 7 exe fun

Medic
10-16-2004, 05:21 PM
Hi,

Having a bit of fun with this one...

When running the <App>.exe a single messagebox pops up asking for the password. OK & Cancel buttons but OK is greyed out.

So, typed in random password. All chars appear as ||||| in the window and OK button stays greyed out so no Softice bpx option.

Had a look at the .exe with PiED, says its Installshield 2003 stub [overlay]

Decided to look for strings with WDASM32 which revealed a string "PASSWORD", hmmm promising.

Opened OllyDbg and put a break on the PASSWORD string which broke a few times before loading the password enter messagebox.

Saw that in memory a .tmp file was being written.
Temp file contents:-

[Info]
Name=INTL
Version=1.00.000
DiskSpace=8000 ;DiskSpace requirement in KB

[Startup]
CmdLine=
SuppressWrongOS=N
ScriptDriven=1
ScriptVer=7.4.0.377
DotNetOptionalInstallIfSilent=N
Product=<appz name removed for board>
PackageName=<appz name removed for board>.msi
MsiVersion=2.0.2600.2
EnableLangDlg=N
OnUpgrade=1
DoMaintenance=Y
ProductCode={4CF91139-0FA6-4DC3-B118-6D6F58C0BCDC}
PackageCode={38B5B404-FC8B-4DFC-98AD-1E4DFAA7751E}
SuppressReboot=N

[SupportOS]
Win95=1
Win98=1
WinME=1
WinNT4=1
Win2K=1

[Win95]
MajorVer=4
MinorVer=0
MinorVerMax=1
BuildNo=950
PlatformId=1

[Win98]
MajorVer=4
MinorVer=10
MinorVerMax=11
BuildNo=1998
PlatformId=1

[WinME]
MajorVer=4
MinorVer=90
MinorVerMax=91
BuildNo=3000
PlatformId=1

[WinNT4]
MajorVer=4
MinorVer=0
MinorVerMax=1
BuildNo=1381
PlatformId=2
ServicePack=1536

[Win2K]
MajorVer=5
MinorVer=0
MinorVerMax=1
BuildNo=2195
PlatformId=2

[KEY]
Password=1954169968
[Languages]
count=1
default=409
key0=409
[<appz name removed for board>.msi]
Type=1
Location=<appz name removed for board>.msi
[Setup.bmp]
0=setup.bmp
Type=1
[instmsiw.exe]
Type=1
Location=instmsiw.exe
[instmsia.exe]
Type=1
Location=instmsia.exe
[ISScript.msi]
Type=1
Location=isscript.msi

So there it was!!! Under [Key], Password=1954169968 !!!!!!!

But... entering this password does not enable the OK button so I'm still in the dark..

Tried a few Installshield unpackers but nothing worked.

Any suggestions greately appreciated.

Medic
JMI
10-16-2004, 10:19 PM
One suggestion would be that you really didn't need to post all that code just to show that there was s listing for "password" in the strings.

Next, you have not indicated what, if anything you have done to try to solve yourown problem, for example searching here and on the net for information on defeating the protector and/or how such serial protection systems might function. So far, all you've told us you have done is look at the exe in a dissassembler and try the "password" listed in the exe, which didn't work. Were you actually suprised when it didn't?

Did you even try to set a breakpoint when that "password" might be sitting in memory and/or actually examing and try to trace the code where the "password" might be called???

Regards,
Medic
10-17-2004, 02:16 AM
Sorry for posting the whole tmp file, thought it might contain info that would help understand the problem.

Yes, searched this forum (and others) for serial protection tuts and tips but all the serial methods rely on entering dud serials and then bpxs on the OK button which is greyed out in this instance.

Yes, put bpm on memory access to the exe and tmp file read/write of the password but nothing doing, and yes am using the addr context correctley.

Yes, searched for Installsheild decrypters, unpackers tips, found a few isextr, isftw, sid Some of these are for isx, ins files which i dont have, just the exe so far.

Will continue to research but just thought that with the vast knowleadge of the forum you could give me some tips to save time.

Thanks,

Medic
JMI
10-17-2004, 07:04 AM
My point was that the Rules suggest that you make the statement about the extent of your attempt to help yourself in your "first" post, then I don't have to ask if you did. :idea:

You have stated that you have done some searching, but you didn't indicate that you that you have studied the dissassebled "deadlisting" in the procedure which calls the "password" string to see if it contins any information which may be useful or a place which will permit you to place a breakpoint. And I was suggesting that you try breakpoints when one or the other of the registers may actually contain the "password" from the file, not necessarily on "memory access."

I don't know if you can read Russian or have access to a translation program, such as Systran, but there has been some good work done on the Wasm.ru regarding Installshield (although the analysis was of version 6) by Volodya and others. There is an article titled "Study InstallShield 6+ - the survey of the procedures." It's in the Articles section and is number 19 of the top 50. They Systran translator, available in the wild, make it fairly understandable and might give you some insight.

Regards,
naides
10-17-2004, 07:11 AM
Hi Medic.

Run the app under filemon. You may see other temp files being created in weird places. They usually vanish when you close the app, but you can save copies for your self in safe folders.
Pay special attention to files with .dll extentions, or files that despite the name, have PE structure. In my short experience with instshield, that is where the action is. . .

Do not give up with the serial box yet. you can use BMSG <box handle> WM_KEY. . .
to try to catch the program analizing your serial on on the fly, or at least see the mod that does the analisis
Medic
10-17-2004, 08:48 AM
Hi JMI and Naides,

Thanks again for your help,

Have been going at this for several days now, learning more but finding it difficult in deciding on the approach as there are clearly several routes and I'm spending time going down dead ends, but learning as well!!

Attempted to unpack the Installshield, so far no tools found help.

Deadlisting studied but the password string relates to the creation of the tmp file which is not what I need.

Used InCrtl5 to find that the installshield generates a RNG key, so am now looking for brute force approach as I think the PASSWORD created in the tmp file might be the seed for the RNG. Will look at the Filemon route next.

The memory address where the password is stored is for the Installsheild password which is different to the real password. Have set breaks on access to this but no joy. Will look at WM_KEY to see if I can discover how the installer is monitoring the entered password, guess it might be using PEEKMESSAGE but that breaks allot so will have to try another route.

Thanks for your thoughts and patience,

Not had any sleep jet so will have to continue tomorrow

Medic
naides
10-17-2004, 09:33 AM
Hi JMI and Naides,

The memory address where the password is stored is for the Installsheild password which is different to the real password. Have set breaks on access to this but no joy.
Medic

Consider the fact that the OK button is grayed while you key in the serial, and will turn active when you hit gold. . . The serial is not stored in one place, and then analized, it is analized every time you enter a digit.

The Bmsg would break inside the system, when the program gets notified someone entered something. You need to learn a bit about message handling, but it will at least tell you the general area where password validation is taking place. PM the app, I will take a look, but I WILL NOT CRACK IT FOR YOU
hosiminh
10-22-2004, 05:22 AM
I had the same problem with installing another program 'coz there is "Installshield password protection" ; greyed OK button)

Well , I used Ollydbg and M$ Xp Pro

snippet from Ollydbg

Text strings referenced in L***trac:.text, item 64
Address=00405897
Disassembly=PUSH Logitrac.004234E4
Text string=ASCII "Software\InstallShield\ISWI\7.0\SetupExeLog" ( i guess it is "InstallShield v7" setup used too )

Solution (?)
You can use "breakpoint on lstrcmpA" ("bp lstrcmpA") and enter some bogus character , Ollydbg should break , some F8 work untill user code and then just patch some bytes like this:

0040BF78 FF15 CCF14100 CALL NEAR DWORD PTR DS:[<&KERNEL32.lstrcmpA>]
0040BF7E 85C0 TEST EAX,EAX ; patch here 85C0 -> 33C0 XOR EAX,Eax
0040BF80 74 02 JE SHORT LOGITRAC.0040BF84 ; or patch here to JNE

and then it installs OK

The "Password" that i could see in EAX register is 1952762995 (on bp) but suprise it's not working. (on my target)
Medic
10-22-2004, 07:11 AM
Thanks!!!

Will explore over the weekend and get back to you :yay:
hosiminh
10-25-2004, 06:11 AM
InstallShield Password bruteforcing

tools: ollydbg,radasm+masm for bruter

reference: CRC and how to Reverse it by Anarchriz/DREAD

target: <not published here>

level: bruteforcing/advanced

~~~~~~~~~~~~~~~~~~~~~~~~

1. Password bruteforcing

~~~~~~~~~~~~~~~~~~~~~~~~

first the install package asks for a Pass, well we don't have one!
lets see how to get around. bp GetWindowTextA works, and we land into the simple checking
routine:

0040BFC8 push 64 ; /Count = 64 (100.)
0040BFCA push eax ; |Buffer = 00000009
0040BFCB push 3E8 ; |ControlID = 3E8 (1000.)
0040BFD0 push [arg.1] ; |hWnd = 002300EA ('Please enter the password',class='#32770')
0040BFD3 call [<&USER32.GetDlgItemTextA>] ; \GetDlgItemTextA
0040BFD9 test eax,eax
0040BFDB je short 0040C02B
0040BFDD push 1 ; /ControlID = 1
0040BFDF push [arg.1] ; |hWnd = 002300EA ('Please enter the password',class='#32770')
0040BFE2 call [<&USER32.GetDlgItem>] ; \GetDlgItem
0040BFE8 mov ecx,[428EF0]
0040BFEE mov esi,eax
0040BFF0 lea eax,[local.25]
0040BFF3 push eax ; /Arg1 = 00000009
0040BFF4 call 0040BF49 ; \LOGITR~1.0040BF49
0040BFF9 test esi,esi ; LOGITR~1.0040BF8C
0040BFFB je short 0040C02B
0040BFFD movzx eax,al
0040C000 push eax ; /Enable = TRUE
0040C001 push esi ; |hWnd = 0040BF8C
0040C002 call [<&USER32.EnableWindow>] ; \EnableWindow
0040C008 jmp short 0040C02B

0040BFFB je short 0040C02B ;;;;;;--- PassGood? :)

but we are not interested in patching if we can reverse it..

0040BFF3 push eax ; /Arg1 = 0012E8E8 ASCII "dummy"
0040BFF4 call 0040BF49 ; \LOGITR~1.0040BF49

investigating the CheckPass routine leads to

0040BF78 call [<&KERNEL32.lstrcmpA>] ; \lstrcmpA

comparing with hardcoded pass 1952629872

-------------------- [FOR CURIOUS]
bp GetTempFileNameA

INI file:

[KEY]
Password=1952629872
-------------------- [/FOR CURIOUS]

blah, but how to get a working pass?

0040C16F push esi
0040C170 push edi
0040C171 mov edi,ecx
0040C173 call 0040C057
0040C178 push -1 ; /Arg3 = FFFFFFFF
0040C17A push dword ptr [esp+10] ; |/String = "..@"
0040C17E call [<&KERNEL32.lstrlenA>] ; |\lstrlenA
0040C184 push eax ; |Arg2 = 0012E8E8 ASCII "dummy"
0040C185 mov ecx,edi ; |
0040C187 push dword ptr [esp+14] ; |Arg1 = 77D48065
0040C18B call 0040C0B0 ; \LOGITR~1.0040C0B0
0040C190 mov ecx,edi
0040C192 mov esi,eax
0040C194 call 0040C099
0040C199 not esi
0040C19B push esi
0040C19C mov ecx,edi
0040C19E call 0040C0F1
0040C1A3 pop edi ; LOGITR~1.0040BF5D
0040C1A4 pop esi ; LOGITR~1.0040BF5D
0040C1A5 retn 4

(if can't recognize it yourself peid->kanal can)
thats a CRC32 routine + this:

0040C111 movzx eax,byte ptr [ebp-4]
0040C115 push 3
0040C117 push eax
0040C118 call 00415846
0040C11D xor al,74
0040C11F push 5
0040C121 mov [ebp-4],al
0040C124 movzx eax,byte ptr [ebp-3]
0040C128 push eax
0040C129 call 0041581D
0040C12E xor al,74
0040C130 push 7
0040C132 mov [ebp-3],al
0040C135 movzx eax,byte ptr [ebp-2]
0040C139 push eax
0040C13A call 00415846
0040C13F xor al,74
0040C141 push 3
0040C143 mov [ebp-2],al
0040C146 movzx eax,byte ptr [ebp-1]
0040C14A push eax
0040C14B call 0041581D

which turn out to be rol&ror routines

- switching to code -

based on the FACT that crc32 is *reversible*

; THE CHECK ROUTINE OPTIMIZED:
edi points to pass string

invoke StrLen,edi ; length of pass
invoke CRC32,0,edi,eax ; crc32(pass) ; 0=init, edi=pass, eax=len
movzx ebx,al
movzx ecx,ah
shr eax,16
movzx edx,al
movzx eax,ah
and eax,0FFh
and ebx,0FFh
and ecx,0FFh
and edx,0FFh
rol ebx,3 ; rol and mix bytes
ror ecx,5
rol edx,7
ror eax,3
xor bl,74h
xor cl,74h
xor dl,74h
xor al,74h
mov ch,bl
mov ah,dl
and ecx,0FFFFh
shl eax,16
or eax,ecx
cmp eax,1952629872 ; Check if install pass matches

; THE REVERSE :

reverse the obvious:
mov eax,1952629872
mov ecx,eax
shr eax,16
and ecx,0FFFFh
mov bl,ch
mov dl,ah
and eax,0FFh
and ebx,0FFh
and ecx,0FFh
and edx,0FFh
xor bl,74h ; first mix & rol
xor cl,74h
xor dl,74h
xor al,74h
rol al,3
ror dl,7
rol cl,5
ror bl,3
shl eax,8
mov al,dl
shl eax,16
mov ah,cl
mov al,bl
mov esi,eax
lea edi,tbuf ; then brute

; bruteforce something nice :

invoke StrCpy,edi,T('OneofZero!0000 ')
leng equ 18
mov ebx,1000
@@:
inc ebx
cmp ebx,9999
jz @F
invoke DwToStr,ebx,addr [edi+10]

; esi=wantedCrc, edi=newPass, leng=length, leng-4= offset where to put RCRC32
invoke RCRC32,esi,edi,leng,leng-4 ; Calculate Reverse CRC32
; coded with the help of Anarchriz's tut.
; just take some implementation of crc32
; and code it yourself!

movzx eax,byte ptr [edi+leng-4]
invoke ChrIsPrint,eax ; Is char printable?
dec eax
js @B
movzx eax,byte ptr [edi+leng-3] ; Is char printable?
invoke ChrIsPrint,eax
dec eax
js @B
movzx eax,byte ptr [edi+leng-2] ; Is char printable?
invoke ChrIsPrint,eax
dec eax
js @B
movzx eax,byte ptr [edi+leng-1] ; Is char printable?
invoke ChrIsPrint,eax
dec eax
js @B
@@:

the routine goes trough (its very fast)
OneofZero!0000xxxx
OneofZero!1001Đ.†p if printable then break else continue
OneofZero!1002aź†.
:::
OneofZero!9999źźźź

edi has a valid pass!

some passwords:
drizz!1007N0<y
OneofZero!1149BwyS
dELTA
10-25-2004, 07:50 AM
Nice work. Are you sure that the passwords will really work though? Normally, passwords are initially checked with an intentionally weak hash algo, but the whole password is then used for the actual decryption. This way, you get very many passwords that match the a bruteforce hash-check, but only the single real password will work in the end anyway for the decryption.

But then again, of course these guys aren't necessarily that clever, I'm just asking...
hosiminh
10-25-2004, 12:08 PM
I have tested both passwords with my target, and worked with both versions :)
Medic
10-26-2004, 03:15 AM
Hi,

Thanks for the tips. Hosiminhs idea about breaking on lstrcmpA took me striaght into the right code.

Turns out that OK button can be activated by a simple patch which then starts the Install prog proper. It writes isscript.msi and <progname>.msi to the windows temp dir but then must do the serial check again as it fails. It checks for a valid serial (which we've bipassed, then offers a network lic option before exiting...

msi can not be unpacked and if run on it's own pops up a window to say it must be run from setup.exe

Went back to the password bit and the encryption lots strong. HDdrive serial number is combined with a RNG to give a 10 digit key (the one given in my first post). Entered a dummy serial to find what number is produced and tried entering that into the tmp file during run time which allows me to enter "my" password and activate the prog correctely but I still get chucked out after the msi starts working so I guess there is a duplicate check in the msi.

Long night, dont see how the msi route will work so will take another look at bruting the encryption in the morning

Laters,

medic
nikolatesla20
10-26-2004, 09:03 AM
If you've got an MSI you can too "unpack it". An MSI is just a database. There is a tool called ORCA which can open an MSI and allow you to browse, edit, and whatever, to the database.

Of course you have to understand the structure of an MSI to find the stuff you want, so grab a copy of Installshield for Windows Installer or InstallShield 8.0 or X , and practice making some MSI's you'll get familiar with them that way. The Installshield product allows you to edit the MSI tables directly when building an Installer, if you have to. Installshield works with project files only (ISM).

ORCA opens already compiled MSI files, but the tables you will see will be the same tables as when you design the installer.

Look thru the actions table, and the binary table, etc. If the installer has its own custom action that is not allowing you to run, you can just edit it with ORCA. Sometimes installers unpack a DLL from the binary table, and this DLL does the password check.

But, for example, the not allowing to run other than from setup.exe, you should be able to work around that my editing the MSI with ORCA.

-nt20


Changing the key combination to invoke SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Changing the key combination to invoke SI
PDA

View Full Version : Changing the key combination to invoke SI

tdennist
10-16-2004, 08:27 PM
Is there a way to change the default Ctrl-D keystroke for invoking SoftIce? Because that combination seems to create odd problems with the mouse in Windows XP (I know those problems aren't just mine. Hail to the search function! :P).

DriverStudio 3.1
Windows XP (no sp1 or sp2)

Thanks.

edit: never mind! I found the answer at this thread:
http://www.woodmann.com/forum/showthread.php?t=881

edit2: The answer isn't very well written on that link, so I'll restate the answer:
In your Winice.dat file (sometimes in C:\windows, it's in C:\windows\system32\drivers for me), in the line that looks like INIT=, before the "X;" part of it, put in "altkey alt i" and a semicolon. So, my new INIT string looks like this:
INIT="altkey alt i; X;"
You can replace the "alt i" part with any combination you want, of course, so long as it's either a Ctrl or Alt combination.
JimmyClif
10-16-2004, 10:21 PM
An old faq I remember goes as follows:

Q. I'm a PhotoShop/<other application> user & SoftICE's Ctrl+D hotkey is incredibly annoying / inconvenient, is there any way to change it?.
A. You did of course read the SoftICE Command Reference, in particular the ALTKEY command. Place it in your initialization string for added convenience.

;)
JMI
10-16-2004, 10:22 PM
And not you have personally experienced the value of searching before one asks a question and, hopefully, might impress that point on other readers. You have also posted some information which might help others with similiar issues, so, alltogether, not a wasted effort. :yay:

Regards,


Help reversing key validation algoritm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Help reversing key validation algoritm
PDA

View Full Version : Help reversing key validation algoritm

AndyDev
10-17-2004, 10:40 PM
Hiya all,

I'm trying to reverse a VS.net component dll.

I was able to retrieve where the code stores the key (at the end of the dll with a MD5 signature aside, smart, eh? :) )

I was able also to grab the function, which makes the validation of the key.

My problem is, that I'm having trouble reversing the algo.

If anyone could help me doing it, and of course explaining how, it will be a big help.

Small explanation about the function.

text1 stores the key.
The function calculates with the key, the expiration date of the DLL, I've found a key which expires at 1/27/2047, which I marked as a comment in the code.
The code is written in C#

public static bool CheckLicense()
{
string text1 = KeyCheck.GetKey();
// text1="PRAP-6AA2A-E4T4R"; // This key will work for until 1/27/2047
int[] numArray1 = new int[0x10];
string text2 = "RVWX2AD3J4BC5KL6P7EF8MN9QUSGHTYZ-";
for (int num1 = 0; num1 < 0x10; num1++)
{
int num2 = text2.IndexOf(text1[num1]);
if (num2 < 0)
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidKey);
}
if (((num2 == 0x20) && (num1 != 4)) && (num1 != 10))
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidKey);
}
numArray1[num1] = num2;
}
int num3 = ((numArray1[0] << 10) + ((0x1f - numArray1[14]) << 5)) + (0x1f - numArray1[8]);
int num4 = ((numArray1[1] << 10) + (numArray1[5] << 5)) + numArray1[11];
int num5 = (((0x1f - numArray1[3]) << 10) + (numArray1[13] << 5)) + numArray1[12];
int num6 = ((numArray1[7] << 10) + ((0x1f - numArray1[9]) << 5)) + numArray1[2];
if (numArray1[6] != ((num3 >> 7) & 0x1f))
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidKey);
}
if (numArray1[15] != ((num4 >> 9) & 0x1f))
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidKey);
}
int num7 = ((num4 & 0x7e00) >> 9) + ((num4 & 0x1ff) << 6);
num6 ^= num3;
num5 ^= num7;
num3 ^= num4;
if (num3 != num5)
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidKey);
}
DateTime time3 = new DateTime(2000, 1, 1);
DateTime time1 = time3.AddDays((double) num3);
return (DateTime.Now < time1);
}

Thanks all!
Silver
10-18-2004, 03:20 AM
I'm confused as to what you're asking. You've pasted that code which you say is the key validation code, but you're having trouble reversing it?

Is the problem that you don't know any C/C++/C# languages, and thus you can't understand the code? It seems straightforward enough.
naides
10-18-2004, 09:35 AM
I am going to perform some mind reading, as my master and guru dELTA does in these cases:

What AndyDev wants is to Reverse the algorithm ie: Given an arbitrary expiration date, like 12-31-04, generate a valid KEY, effectively reversing every step in the code. . .
Is that what you want?
dELTA
10-18-2004, 01:17 PM
Nice work padawan, your next goal shall be to start capitalizing my name correctly, and after that you will be ready for the challenge of the thousand lame posters. :p
naides
10-18-2004, 03:26 PM
Now I am ready :smug:
JMI
10-18-2004, 04:13 PM
The Force is strong is this one. :yay:

Regards,
dELTA
10-18-2004, 04:58 PM
Yes, he is ready to move on to the next level... Now naides, the next time someone posts something ambiguous like this, instead of simply reading their mind, suggest any random thing as their intended meaning, and then make them think this is what they actually meant by using a Jedi mind trick. Once you get the hang of it, it's actually much more convenient than the mind reading strategy, since you can then always suggest that they meant something concise, and don't have to type as much. :p
AndyDev
10-18-2004, 07:04 PM
Sorry if I didn't explained correctly.
I know C#, so that's not the problem, my problem is, building a keygenerator, which will build valid keys for this function validation.
The keygenerator must know also how many days will the key work.
In simple words, I need to reverse this function, or what naides said :D
Thanks for the fast replies!
Silver
10-19-2004, 01:51 PM
In a sentence:

!!!!?????????????????????????????!!!????!!!?. !!!?. !!. ?????!?. ???????!
naides
10-19-2004, 02:40 PM
Remeber that class in Linear programming you were supposed to take last quarter?
Instead you spent the afternoons smoking weed in your room at the dorm?

That is where you supposedly learn to solve problems like this one, which is NOT TRIVIAL,

this is an integer constrained linear programming problem, that uses binary and agebraic operators simultaenously. Mike is one person with this kind of expertise.
Start from the end:
You need to populate a 0x10 int array with integers that are between 0x0 to 0x19. 0x20 correspond to "-" character. With this array you generate the Key out of characters contained in string2 using the array elements as position indexes.

public static bool CheckLicense()
{
string text1 = KeyCheck.GetKey();
// text1="PRAP-6AA2A-E4T4R"; // This key will work for until 1/27/2047
int[] numArray1 = new int[0x10];
string text2 = "RVWX2AD3J4BC5KL6P7EF8MN9QUSGHTYZ-";
for (int num1 = 0; num1 < 0x10; num1++)
{
int num2 = text2.IndexOf(text1[num1]);
if (num2 < 0)
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidK ey); Checks that all the chars in the key are contained in string2
}
if (((num2 == 0x20) && (num1 != 4)) && (num1 != 10))
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidK ey); Checks that there is a dash in positions 0x4 and 0xA (decimal 10)
}
numArray1[num1] = num2; Fills the array
}

Now you need to know five integers num3, num4 num5 num6 and num7. They will be derived from num3, and have to satisfy all the constrains of these equations. Try to turn bitwise opeartions into algebraic operations, which are simpler to deal with. Example numArray[1] << 10 is the same as numArray[1] * 2^10 or numArray[1] * 1024

int num3 = ((numArray1[0] << 10) + ((0x1f - numArray1[14]) << 5)) + (0x1f - numArray1[8]); Now if you remeber that a number from 0 to 19 can be represented with 5 bits, and see this operations in binary instead of hex, it will be more than clear. Also remember that 0x1f is 11111 in binary
int num4 = ((numArray1[1] << 10) + (numArray1[5] << 5)) + numArray1[11];
int num5 = (((0x1f - numArray1[3]) << 10) + (numArray1[13] << 5)) + numArray1[12];
int num6 = ((numArray1[7] << 10) + ((0x1f - numArray1[9]) << 5)) + numArray1[2];
if (numArray1[6] != ((num3 >> 7) & 0x1f)) Look at the bits, {
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidK ey); Internal checks, equal constrains
}
if (numArray1[15] != ((num4 >> 9) & 0x1f))
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidK ey);
}
int num7 = ((num4 & 0x7e00) >> 9) + ((num4 & 0x1ff) << 6); You need to figure out how to turn the bitwise ands (&) into algebraic operators
num6 ^= num3;
num5 ^= num7;
num3 ^= num4; these xors are killers
if (num3 != num5)
{
throw new KeyCheckException(KeyCheckExceptionStatus.InvalidK ey);
}

all you need to know is num3
DateTime time3 = new DateTime(2000, 1, 1);
DateTime time1 = time3.AddDays((double) num3);
return (DateTime.Now < time1);
}
AndyDev
10-19-2004, 08:05 PM
Thanks a lot! that's exactly what I was thinking.
I will try the bool->math conversion, to make it simplier.

Thanks a lot!
naides
10-20-2004, 09:49 AM
instead of simply reading their mind, suggest any random thing as their intended meaning, and then make them think this is what they actually meant by using a Jedi mind trick.

I just did that master. . . :devil: :devil:

What is my next mission?
JMI
10-20-2004, 10:10 AM
Bring back the era of "free love." I know, a much more daunting task, but there is no "try", there is only "do" or "do not". :devil: Begin now. :yay:

Regards,
dELTA
10-20-2004, 11:17 AM
Hmm, "free love"... Wasn't there some clause in the Jedi oath about us not being supposed to use our powers for dirty stuff or something like that? :p
JMI
10-20-2004, 07:05 PM
No! It simply says that eveyone should cleanse themselves first. :yay:

Regards,
dELTA
10-21-2004, 09:37 AM
Aw crap, in that case I've been missing out big-time... :p


Not another bloody SoftICE problem.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Not another bloody SoftICE problem.
PDA

View Full Version : Not another bloody SoftICE problem.

5aLIVE
10-18-2004, 03:55 AM
I have tried in vain to find the solution to this problem myselfl.

A little history, I had DS3.01 installed and running well on XP Home + SP1,
then one day it decided it no longer wanted to display the console. I can get it to work again by installing a fresh OS and reinstalling DS.

Along comes SP2 which I want running regardless of how desparate I am to get DS up and running. I have downloaded the most recent version of osinfo.dat and ntoskrnl.nms and set NTSYMBOLS=ON in winice.dat. I've also applied the DS30SP2.DAT update.

Launching softICE cause the mouse to freeze, although it works in the console. The console accepts keyboard input as expected. Upon exiting softICE the the mouse pointer remains static and the keyboard only seems to respond to Ctrl+D or numlock keys, capslock light remains off.

I think the problem lies in the error messages displayed in the console, though I can't seem to find an answer on this forum or elsewhere.

The errors are all API hook failures: MiMapViewOfImageSection
MiUnMapViewofSection
MiAddValid PageToWorkingSet
KebugCheck2
MiCopyOnWrite
UhciInsertQh
UhciUnlinkQh
USBPORT_AlocateUSBAddress

Most of the above hint at keyboard and mouse related funtions.
My question is how do I fix this? My keyboard is PS/2 and my mouse is USB using a PS/2 adapter.

Below these messages I see
NTICE: NTRaiseHardError found at index 00b6
IntOE fault in SoftICE at address F2471053 offset 00092D8F Fault Code 3B030000.

Selecting the different combinations of the troubleshooting options didn't help.

BTW. I have tried OllyDbg as an alternative, with erratic results. Perhaps I'll save that for another thread.

I sincerely hope someone can help me in reaching a solution on this one as it is really annoying me.

Thanks for any help or advice.

5aLIVE.
5aLIVE
10-18-2004, 05:47 AM
Hmmm.
I found this although it it dated 2002

"On Windows XP, After installing the Q317277 update from Microsoft's Windows Update site, SoftICE can no longer perform its process of matching symbol tables to loaded modules. The Q317277 update contains new versions of NTOSKRNL.EXE and NTKRNLPA.EXE. If these files are installed, SoftICE will report the following errors in its logging window at startup:

*** API Hook Failure - SegLoad
*** API Hook Failure - PageIn
*** API Hook Failure - CopyOnWrite

I've asked NuMega (now CompuWare) for an updated core file, NTICE.SYS, to address the problem. Wish me luck! CompuWare's site has been structured in such a way that all old links to helpful information now point to pages that offer to sell "enhanced" support. I guess that, if you already paid for support, that isn't good enough!"

I wonder if there are any other further updates available to registered customers? Anyone?
hobferret
10-18-2004, 06:49 AM
Hi :)

My advise would be to get rid of SP2 I had nothing but probs with all sorts of softs since installing it.

WAIT till MS get rid of the bugs in it :boo:

/hobferret
5aLIVE
10-18-2004, 07:20 AM
Thanks for the reply Hobferret.
It looks like I'll be using a spare hard disk with a fresh install of XP and no service packs just to get this to work properly again. Compuware must be losing customer confidence over this issue. What a PITA.

5aLIVE
5aLIVE
10-18-2004, 08:16 AM
Here's a quick update,
I downloaded the latest symbols for NTKRNLPA.EXE
and which has reduced the number of API hook failures down to the following three :

UhciInsertQh
UhciUnlinkQh
USBPORT_AlocateUSBAddress

Perhaps I need updated symbols for another kernel file? Anyone recognise these APIs, I did a Google search and came up with zilch.

Thanks in advance,
5aLIVE.
bilbo
10-19-2004, 01:45 AM
I downloaded the latest symbols for NTKRNLPA.EXE
So I suppose yo're using PAE (Physical Address Extension). Have you tried to disable it (switch /NOPAE in boot.ini)? In this way the kernel loaded will be the more familiar NTOSKRNL.EXE and the symbols will be taken from NTOSKRNL.NMS
[/QUOTE]

UhciInsertQh
UhciUnlinkQh
USBPORT_AlocateUSBAddress

So I suppose you're using USB mouse and/or keyboard.
First two symbols are in USBUHCI.SYS, and the third in USBPORT.SYS. You need the symbols of both drivers.

Regards, bilbo
JMI
10-19-2004, 02:06 AM
The Hobbit has read many an ancient and forgotten lore during the course of his wandernings of Middle Earth. One would be wise to heed his advise. :yay:

Regards,
5aLIVE
10-19-2004, 04:02 AM
Hi Bilbo, thanks for taking the time to write a reply.

So I suppose yo're using PAE (Physical Address Extension).
Have you tried to disable it (switch /NOPAE in boot.ini)?

I'm not sure if I'm using this or not, I don't know what it is or what it does.
Whatever is set as default on install I guess.
I edited my boot.ini on C:\ as you suggested to give:

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect
/noguiboot /NoExecute=OptIn
/nopae

Rebooting the PC and it now asks me which OS I wish to boot from (I only have XP Home). I removed the ref to load NTKRNLPA.nms in winice.dat and started up softICE. The batch file DOS box remains open this time.
SoftICE can be seen using the usual hotkeys.

Only the 3 API hooks fail for the USB drivers remain using this method.

So I suppose you're using USB mouse and/or keyboard.
>No, my keyboard is PS/2 and my mouse is a Logitech USB with a PS/2 adapter.
>I tried disabling USB keyboard and mouse patching in the troubling shooting screen, but this reboots my machine when I start softICE. :(

First two symbols are in USBUHCI.SYS, and the third in USBPORT.SYS. You need the symbols of both drivers.
>Great! Now this is interesting, Okay, I downloaded and added both symbols, this didn't change anything. I winder if disabling/disconnecting my USB modem and pendrive would help?

5aLIVE
bilbo
10-20-2004, 04:58 AM
SoftICE can be seen using the usual hotkeys.
What's the meaning of this? no more NTRaiseHardError? can you work with SoftICE now, at least as soon as it is loaded?

Okay, I downloaded and added both symbols, this didn't change anything.
Well, sorry, I supposed it... Anyway the missing functions are there...

I winder if disabling/disconnecting my USB modem and pendrive would help? I'm afraid no... Maybe you should rather try to disable USB from BIOS if it is possible...

Another question:
Are you really sure you are using the latest OSINFO.DAT AND OSINFOB.DAT?
Have you checked ftp://ftp.compuware.com/pub/driverstudio/outgoing/OsInfo/osinfo.dat and ftp://ftp.compuware.com/pub/driverstudio/outgoing/OsInfo/osinfob.dat?
Sorry if I ask this again, but the three symbols you mentioned should be there, also for XP SP2...

I've also applied the DS30SP2.DAT update. What's that, and how have you applied it? Is it in some way harmful to osinfo[b].dat, which are the only two files loaded and parsed by NTICE, as far as I know?

Sorry if I cannot be more precise, but I cannot reproduce your problem... Maybe I should try to install SP2 but I'm afraid it is not a good idea :-)

Regards, bilbo
5aLIVE
10-20-2004, 07:33 AM
What's the meaning of this? no more NTRaiseHardError? can you work with SoftICE now, at least as soon as it is loaded?

>I never had the NTRaiseHardError displayed. Yes I can work with softICE,
but I could not do anything else when it closed as I have no keyboard or mouse control, therefore I cannot load any program I wish to debug.

Well, sorry, I supposed it... Anyway the missing functions are there...
>It's good information all the same :)

I'm afraid no... Maybe you should rather try to disable USB from BIOS if it is possible...
>No need for that, see below.

Another question:
Are you really sure you are using the latest OSINFO.DAT AND OSINFOB.DAT?
Have you checked ftp://ftp.compuware.com/pub/driverstudio/outgoing/OsInfo/osinfo.dat and ftp://ftp.compuware.com/pub/driverstudio/outgoing/OsInfo/osinfob.dat?
Sorry if I ask this again, but the three symbols you mentioned should be there, also for XP SP2...
>Wow! That's it! I downloaded these OSINFOB.DAT and everything appears to work as it should (I already had the latest OSINFO.DAT installed). I'll test it properly later today. Many thanks Bilbo :D

What's that, and how have you applied it? Is it in some way harmful to osinfo[b].dat, which are the only two files loaded and parsed by NTICE, as far as I know?
>It's an service pack for Driver Suite, I don't know if it updates the OSINFO files, but I do know it updates the softICE display driver, without which I was seeing a corrupt video display when softICE is started.

Sorry if I cannot be more precise, but I cannot reproduce your problem... Maybe I should try to install SP2 but I'm afraid it is not a good idea :-)

No need to apologise, I can't thank you enough for helping me reach a solution. I hope others can benefit from this if they have trouble with SP2.

UPDATE:SoftICE appears to be working well, having said that, it does display
a NTRaiseHardError message. I didn't notice it at first as it wasn't highlighted in cyan like the previous API failures. As far as I know this is because it produced by the operating system and not softICE.

I've searched for this, Compuware support site only mentions this in respect to sICE 1.x,2.x,3.x and Win 95,98 and NT. But I'm sure it is still relevant.

It states that these messages are generated anytime the NTRaiseHardError routine is executed. SoftICE simply displays the message that NTRaiseHardError provides, i.e, these messages are not generated by SoftICE itself.

Many times these hard errors are handled, and execution continues normally.
There are many times when these actually do result in a problem as well. These errors are documented in the ntstatus.h header file in the DDK.

Although this doesn't seem to be a problem I am curious as to why you asked about this before? Do you think I need to look at fixing this using the ntstatus.h file to identify the meaning of the errror?
Error occurs at index 00B6h and Delta 00000000h.

Thanks again,
5aLIVE.


As Above...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > As Above...
PDA

View Full Version : As Above...

Aimless
10-18-2004, 05:29 AM
Hmzz...

The latest version of the most sought after piece of softare is available on the warez sites...

Wonder whether they beat the users and get their keys out of them or they are somehow snooping into the update transfer processes.

Sacré bleu, Pierre...what will you do now?

Have Phun
dELTA
10-18-2004, 09:24 AM
http://www.woodmann.com/forum/showthread.php?t=6456
JMI
10-18-2004, 11:46 AM
And has been available for sometime now. :yay:

Regards,
Aimless
10-19-2004, 11:59 PM
I wonder if people are aware that in the SSG, there is a problem of construction of flowchart when lines are selected....

Have PHun


ActiveMa** unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ActiveMa** unpacking
PDA

View Full Version : ActiveMa** unpacking

agnonymous
10-18-2004, 12:11 PM
Hi all,
This is my first post but i've been a reader of this forum for some time now. I'm grateful to this forum because just one year ago I did not know anything about unpacking, now I think it's one of my hobbies ...
we, manual unpackers have a nice advantage: the packer-cryptor programmer is fighting his natural tendency for order and structure (as a computer programmer), so the most complex protections still have order in them, and that is also the weak point we must look for :)
Anyway...my first post is about activema**.

I've been fighting this beast for a few days now but i can tell you there's nothing impressive about it. I've had a few successful unpackings so far.
basically:
- find OEP
- dump
- fix imports
the packer replaces some of the calls call ds:[API] (6 bytes) with a nop; call proc (the call proc takes only 5 bytes, hence the nop)

so patching the dump is needed. Why I did is opening the partly fixed dump in disassembler, find out all the suspicious calls (nop followed by a call), see what API they eventually call and patch them back to a call ds:[API]
I believe IDA pro + a IDC script would be a very nice solution

At the moment I'm working on static unpacking to avoid api tracing which is too time consuming for me. If someone is working on the same thing I would be interested to share ideas.

manual unpacker ;)
nathan
10-19-2004, 02:03 AM
Did you actually dumped from OEP (e.g., by using Olly) or directly with some PEtool ?

nathan
agnonymous
10-19-2004, 05:39 AM
Did you actually dumped from OEP (e.g., by using Olly) or directly with some PEtool ?

nathan

dumped at OEP. The only tools I use are ollydbg(load/trace target up to OEP) LordPE (dump) and imprec.
R3v3nG3
10-19-2004, 06:00 AM
Hi,
I'm working on the same target and I noticed that there are other commands changed by the packer. Not only

CALL xxx--> NOP CALL yyy

but also

MOV reg, xxx--> NOP MOV reg, yyy

and others. Search for NOP in the dump for a full list.
Hope this help.
Bye,
R3v3nG3
nikolatesla20
10-19-2004, 06:40 AM
Unpacking this and patching all the jumps is really, a non-worthwhile task ( A WASTE OF TIME).

You see, ActiveM*** uses 2 layers. The first layer is the unpacking and decrypting. The second layer is the code replace that you are seeing.

The first layer is finished as soon as you see the nice HTML box come up telling you to register the program.

LunarDust came up with a very creative technique against ActiveM***.

So, to quote from LunarDust:

Got some apps that are version 5.2

Activemark stores time limits in the registry keys and data files mentioned before, but also has a nice trick for NTFS systems, it stores one last copy in the EXE itself, in a NTFS file stream (AFS). You can use a stream viewer to see it, and if you use FileMon you will see the process accessing itself with a filestream moniker with a GUID for its name (xxx.exe:{XXXX-XXXX-XX-XXXXXXXX}).

Imports are easy to recover.

Finding OEP. You don't want OEP of original program, since then you'll have to fix all the ripped code (pain). Instead, Activemark has 3 layers: Compressor, License manager, Original program.

Dump the program when it reaches second layer. YOu know this by just BPX on GetVersion. Second layer uses GetVersion API. Use second layer OEP as entry point of dumped proggie.

More notes:

ActiveMark

TO find program's OEP (the actual real program):

1. dump the program from mem while it's on the HTML splash screen.
2. open the dump in a hex editor
3. look for the text "TdnAVp"
4. Select 0xC bytes (including this text). the DWORD that follows is the original OEP RVA.

However, this info does you no "good" in unpacking the latest, such as Pixelus game.

What you need to do here is:

Use ImpREC to recover the big import table, paste it on the dump.

Disasm with IDA, look for references to GetVersion. YOu will find the "Second layer" of
protection starts with the traditional GetVersion call. This is the OEP of the second
layer. You need to dump at this OEP and start the program from this OEP. That way
any Import API redirects that exists in the real program code (the protector overwrites
many CALL [XXXXXXXX] imports with a NOP, CALL XXXXXXXX to its own code), these redirects
will be in place if you use the original code.

So use SoftICE to bpmb on the OEP of the second layer. It won't work with Break 'n Enter,
the program will detect it. Just start the program and then a few seconds later, CNTRL+D
into SI and set the breakpoint. When you get there do a "a eip, jmp eip, enter" to
freeze the program, leave SI, and dump it with LordPE. Remember to go back and fix your
infinite loop now.

Now paste the imports on this file and you will have a working program. Howerver, it exits.
It detects it's not the original program.

Here's the workaround. On the new 5.2 activmark it exits with ExitProcess. Use Olly to
BPX on ExitProcess to find the call. Find out where ExitProcess gets called, and right
above it, where the value of exiting gets PUSHED, change the instructions to JMP to the
OEP of the REAL PROGRAM. Reason this works is everything is in place now to allow the
real program to run, it just has to be called. So we do this with brute force by just
jumping to it.

You can add the JMP in Olly and then "Copy to executable file->Selection" to save out
the changes (much faster than using hex editor).

OH AND YEAH, this version of ActiveMark uses the same time limit registry and file entries,
but on NTFS systems it adds a new twist: It stores additional data in a file stream (one
of those NTFS hidden file streams) in the original EXE. to get rid of it, simply copy the
file to a FAT32 partition and back again. Or use a stream editor tool to delete it.

Enjoy.

-Lunar_Dust

I love that last part :P Just force the program to run, it's on your hard drive for goodness sakes.

-nt20
agnonymous
10-19-2004, 08:43 AM
I have seen previous attempts at this protection but my goal was different. My goal was to restore the original exe as it was before the protection, not to crack some protected app (reset time limits, etc)

Usually I stop reading tutorials as soon as I see "press F8" or "search for byte sequence 12 45 65 12 ab 1c" because the approach is too specific and there must be a better and more generic way

Anyway, you don't need to patch every location where there is a [nop; call sub_123456] or [nop; mov RegX, sub_123456; call RegX]

you can simply patch at sub_123456 to make it jump to the API it is supposed to jump to. whichever way the target is using to call this sub_123456, it will always jump to the API. Of course this will not produce an exact copy of the original exe (before packing) but it will run perfectly

makes sense?
R3v3nG3
10-21-2004, 10:48 AM
Hi all,
I packed w1nhelp32.exe with ActiveMa** 5.3 and I successfully unpacked it without problem(I followed LunarDust instructions).
After, I tried to unpack a game from Trym3dia with the same method but I get a Visual C++ Runtime Library error at startup.
Any ideas?
Thanks,
R3v3nG3
dELTA
10-21-2004, 03:36 PM
Custom protection underneath the packing layer?
R3v3nG3
10-25-2004, 02:50 AM
You're right! ;)

Thanks,
R3v3nG3
R3v3nG3
10-27-2004, 02:56 AM
No, I was wrong! I'm sure that the error depends from the packer, but it's not an antidebug trick.
My initial target was Scr4b*** and yesterday I found another release of the same game unprotected and well?
I saw 3 files in the installation dir with same names but different sizes. The TryM3dia ones were littler than the other, so I tried to use the larger ones with the exe unpacked by me and it worked!
The conclusion is that the unpacking method, works for the exe but ActiveM4rk packs also some other files and then probably the method is not enough against this feauture.
You can have a proof of that, opening the file with the .fun extension in an hexeditor, you will see it starts with "TMSAMVOH" and you can find this string 3 times inside the unpacked exe too.

I'm going to analyse a bit more....

Bye,
R3v3nG3
condzero
03-03-2005, 07:40 AM
R3v3nG3,

You are 100% correct in your findings regarding the packing of resources as you describe. It's easy to discover in any hex editor. Unfortunately, I have seen noone publish anything that can unpack the resources. To do this, you would have to get your hands on their custom dll and exploit the necessary routines.

Good Luck
Hero
03-03-2005, 08:11 AM
Hi all
Can you tell me the PEid Generic OEP finder,finds OEP for layer 2 or 1?

sincerely yours


HOLY CRAP ;)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > HOLY CRAP ;)
PDA

View Full Version : HOLY CRAP ;)

JimmyClif
10-18-2004, 09:58 PM
A new Logo! Well done! :smug:
JMI
10-18-2004, 10:09 PM
Sure. Budda's always like things which are self-reflective. :D

Regards,
lifewire
10-19-2004, 09:20 AM
not to insult anybody, but what about making the background the same color (purple) as the background color of the forum? now it looks like "we found a picture on the internet and pasted it into our page".
JimmyClif
10-19-2004, 10:49 AM
Lifewire, it is the same color. I guess you're using IE ;) and IE has problems displaying transparency in png's.
lifewire
10-19-2004, 12:44 PM
yes, I do. that explains a lot :)

this is what i see:
JMI
10-19-2004, 01:12 PM
Well shoot. Now I'm going to have to load Opera again and see what it "really" looks like. :idea: I use IE also. :rolleyes:

Regards,
Kayaker
10-19-2004, 01:31 PM
It's not quite as ugly as you thought now is it? :p
Silver
10-19-2004, 01:52 PM
........

You see, in this post I originally said something so amazingly dumb I was quite embarassed. Unfortunately you can't delete your own posts in this forum, so now I'm forced to write something to cover up my dumbnicity.

Move along, nothing to see here.
Woodmann
10-19-2004, 02:42 PM
Ummmmmm........

That is the finest cut and paste job I ever seen :D

TA TA

Oh yes, please feel free to provide some ideas as to what you all think the logo should look like.

One last edit.... The logo does look like ass with IE. Why does IE not properly support .png transparencies correctly?
dELTA
10-19-2004, 03:38 PM
Hmm, I just noticed something about the logo when comparing the two screenshots. It seems like transparent png:s support something like alpha values, you know like "degree of transparency", contrary to transparent gifs? Is that correct, or is it only some side effect of the IE bug? (Here's your chance to say something useful instead Silver, oh local graphics guru ;)).
JMI
10-19-2004, 04:42 PM
Well now that I've seen it using Opera, I'm not sure I like the transparent one as much as what IE shows. But there is still plenty of time to play with it and get feedback. :yay:

Regards,
Woodmann
10-19-2004, 05:37 PM
The logo has been changed to some generic thing for those of you who use IE:p

Woodmann
JMI
10-19-2004, 06:28 PM
It's alive. It's alive. It's changing and changing. Oh what ever will it become next? Only the Shadow knows. :eek:

Regards,
naides
10-19-2004, 07:54 PM
it looked better before! :cry: :cry:
Woodmann
10-19-2004, 09:01 PM
And so it shall be.... before :yay:
JMI
10-19-2004, 09:09 PM
Ahmen.

Regards,
disavowed
10-20-2004, 12:03 AM
Why does IE not properly support .png transparencies correctly?
it's not that IE doesn't support .png transparencies correctly; it's that IE doesn't support .png transparencies. so it's not a bug; it's a lacking feature.
kugi
10-20-2004, 02:21 AM
Nice logo. Thanks for the good work.

Regards, kugi
Silver
10-20-2004, 08:57 AM
Hmm, I just noticed something about the logo when comparing the two screenshots. It seems like transparent png:s support something like alpha values, you know like "degree of transparency", contrary to transparent gifs? Is that correct, or is it only some side effect of the IE bug? (Here's your chance to say something useful instead Silver, oh local graphics guru ;) ).

Hey! I'm useful, finally! ;)

PNG's are a 32bit image format, using a DWORD to represent each pixel. 8 bits (each) for Red Green and Blue channels. The highest 8 bits of the DWORD are alpha, corresponding from 0 to 255 (256 levels of transparency, 255 being opaque and 0 being transparent). The RGB value of the pixel at the current location in the framebuffer is sampled, and then combined with the pixel about to be written using (usually, this is the relevant one GDI+ and DX use) this equation: N = (1 - Rs, 1 - Gs, 1 - Bs, 1 - As), where N is the resultant blend and s is the source pixel value (the one already in the framebuffer).

As for why IE doesn't render it properly, it's because it's crap. (I like brackets). I believe PNG is different to GIF in that GIF specifies the RGB of the "transparent colour" in the file header, whereas PNG specifies alpha per pixel. So, major difference if you're coding your own.
dELTA
10-20-2004, 11:12 AM
Ok, cool, as suspected then. :cool: Thanks Silver, I knew we could count on you. :) And about the "useful", I was referring to your earlier post in this thread, you are normally quite "useful" indeed. ;)
bilbo
10-20-2004, 11:56 AM
Well, there are many solutions on the net to enable transparency in IE (independently on the fact that IE is probably crap - as Silver said).

IMHO the most practical one for us readers (since we do not need to make anything to enable the transparency: it is just an operation in the server) is reported at http://www.mongus.net/pngInfo/.
Try to load that page in IE, and you will see those transparencies... Well, I would have preferred some more human... feminine... picture, as a demo, but it works anyway...

Regards, bilbo

Disclaimer: I'm using Opera, not IE...
dELTA
10-20-2004, 12:05 PM
Cool hack. :) Using a DirectX transform, through a COM-object, through a javascript, through a cascading style sheet. :cool:

Sadly, the "cooler" a hack is in this way, the more likely it is to cause trouble in some browsers, so I'm not sure I dare upload it to the server and having it loaded on every page of the board. ;)
nikolatesla20
10-20-2004, 03:29 PM
I like that hack. DO IIIIIT.

Or you could use <O MY GOD !!!> A .GIF !!

-nt20
Woodmann
10-20-2004, 04:27 PM
I tried the gif with alleged transparency and you lose a lot of detail, it looks like ass.

Maybe I can find another way.

Woodmann

I found another way :D
It is a hack I found that works, not the best but the easiest.
JMI
10-20-2004, 07:07 PM
Now it actually looks a little better to me in IE than when using Opera. :eek:

Regards,
bilbo
10-21-2004, 01:44 AM
Good job!

Thanks to Woodmann for digging out the nice hack (an only-JavaScript hack) and to http://homepage.ntlworld.com/bobosola/ for having written it (a nice JS tutorial, including the dragdrop library from www.walterzorn.com).

bilbo
esther
10-21-2004, 04:11 AM
Just like the former ones :) :yay:
lifewire
10-21-2004, 04:49 AM
Now it looks good on IE, or at least, I guess that it looks as supposed :) (one can debate how the colors grey-blue, brown and purple mix...)
Silver
10-21-2004, 06:33 AM
Who cares... it's got *gasp* reflections! ;)

Looks cool, nice job Mr W.
dELTA
10-21-2004, 09:43 AM
Or you could use <O MY GOD !!!> A .GIF !!Just like Woodmann implies, the alpha blending feature of png:s discussed above makes them infinitely superior to transparent gif:s, which can't really be used for anything nice looking regarding transparency with more than one possible page background color (which is the case with the different skins here at the forum).
Woodmann
10-21-2004, 04:11 PM
Howdy,

My thanks to bilbo for digging up the info.
I just searched through it until I found the easy hack.
It is in fact the Osola hack, I couldnt remember where I found it.

Even if it is just a cut and paste logo, it is better then looking at
that vbulletin logo which, I believe, I have been looking at for damn near 4 years :p

Woodmann
TBone
10-21-2004, 07:13 PM
Hmmm. I've always wanted to try this:
TBone
10-21-2004, 07:18 PM
Bah. That sucks without some kind of background. You lose the effect on a gray background.


Harddisk serial lock
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Harddisk serial lock
PDA

View Full Version : Harddisk serial lock

Medic
10-20-2004, 04:17 AM
Hi,

Am working on a prog that has a serial number which is based on the harddisk serial for vol c:

Anyone know if there is a standard calls that I could watch to see when the HDD serial is fetched?

Had a good look round the forum and web and found that most developers write their own code snipet to fetch the harddisk serial.

Thanks,

Medic
klier
10-20-2004, 05:22 AM
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/getvolumeinformation.asp
Regards,
Medic
10-20-2004, 06:01 AM
Hi klier,

Thanks for the link.

Sadly that method isn't listed in the Import Function list for this prog. Will try and find out if there is another function that does the same thing.

Cheers,

Medic
klier
10-20-2004, 06:52 AM
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/devio/base/deviceiocontrol.asp
Regards,
dELTA
10-20-2004, 07:41 AM
Sadly that method isn't listed in the Import Function list for this prog.It might very well just be dynamically imported, just to make it a little bit harder to hook...
Medic
10-20-2004, 09:23 AM
Thanks,

Filemon holds the answer!

Undocumented function of NTDLL is being called:

FileFsVolumeInformation

Will now try and discover what is calling it!!

Thanks again.

Medic
klier
10-21-2004, 06:39 AM
Good!
my guess is still the first. :)
Regards,


WDasm32 closes when loading Exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > WDasm32 closes when loading Exe
PDA

View Full Version : WDasm32 closes when loading Exe

ksbrace
10-20-2004, 08:46 AM
Hello,
I have 'patched' a handful of trial versions, so far. I thought I would try and improve my skills, so I have a small DOS app that uses a parallel dongle that I thought would be an easy fix. Everytime I attempt to load the exe file in WDasm32, WDasm32 crashes(closes). Any help would be greatly appreciated. Thanks in advance!
Silver
10-20-2004, 09:00 AM
Perhaps the app *deliberately* has something funny in it that causes wdasm to crash, as protection. Have you tried another disasm? Search the forum, I seem to recall some posts about this before. Some packers will cause wdasm to behave oddly if you look at the packed exe.
ksbrace
10-20-2004, 11:22 AM
I found UN-PACK 2.3 and it gave me the following info:

--+-- UN-PACK (File Analyzer and Unpacker) v.2.3 freeware (C) 1998-2003 --+--
--+-- Authors: Snow Panther [UG2003] and many others (see unpack-a.com) --+--
* XXX.EXE is DOS executable file (MZ EXE)
* Created 09.03.1999 at 13:58:06. Attribute Archive
* File size 333872 bytes
* Identificator...........: MZ
* Bytes on last page......: $0170 (368)
* All pages in file.......: $022D (557)
* Relocations.............: $170C (5900)
* Paragraphs in header....: $06A0 (1696)
* Minimum memory..........: $0000 (0)
* Maximum memory..........: $FFFF (65535)
* SS:SP...................: $3EE3:$0080
* Checksum................: $0000 (0)
* CS:IP...................: $0000:$0000
* Relocation table adress.: $003E (62)
* Overlay number..........: 0
* Entry point.............: $00006A00 (27136)
* Compiled by Borland C v.?.?
* Executable file extension
* Trust me, I know what I'm doing...

Any help would be greatly appreciated! Thanks in advance!
dELTA
10-20-2004, 12:09 PM
Whenever one tool crashes, it is always a good strategy to try another one, IDA for example in this case (which is much better anyway)...
ksbrace
10-20-2004, 12:30 PM
Ok, I opened it up in Biew and it didn't crash. I searched in Hexidecimal mode for the error message and it sent me here:

E &l0O
Press any key to continue @ @@r/1 XXAPP security missing - Press any key to retry w/1/ BM.4LG

I then switched to Disassembly View:

000402DB:i42 inc dx
000402DC:i7261 jc file:0004033F =>[3]
000402DE:i636B6D arpl bp,[bp+di+6D]
000402E1:i61 popaw
000402E2:i6E outsb
br00t_4_c
10-20-2004, 01:06 PM
There's a couple of reasons that come to mind as to why W32DASM would choke on a particular binary. First thing that comes to mind is that it is easily fooled by placing code in "data" sections. Did you check the attributes for all of the sections of the exe? Also I came across this, may or may not be applicable (doubt it but I thought I'd mention it...):

Taken from hxxp://www.woodmann.com/crackz/Tutorials/Protect.htm

15. Exploit a W32Dasm bug (this probably won't keep IDA users out but will at least stop the real StringRef crackers which make up the majority).

00401000 JMP 00401005
.
.
.
.
00401005 JMP 00401000

It seems that if this code is placed in a zone that doesn't mess with code flow, it will put W32Dasm in a memory-consuming -> crashing loop. I have to confess I'm not convinced this actually effective.
ksbrace
10-20-2004, 01:10 PM
Thanks for the tips. I loaded it up in OllyDbg, when I run it, it gets stuck in the bolded area(keeps looping) On line: 5F161D88 in OllyDbg there is an upside down ^, when I copy/pasted, it was gone. I'm really not sure what my next step is. Here's the loop:
5F161D7F B9 5040165F MOV ECX,5F164050

5F161D84 8A01 MOV AL,BYTE PTR DS:[ECX]
5F161D86 A8 04 TEST AL,4
5F161D88 74 04 JE SHORT 5F161D8E
5F161D8A 24 FB AND AL,0FB
5F161D8C 8801 MOV BYTE PTR DS:[ECX],AL
5F161D8E 83C1 0C ADD ECX,0C
5F161D91 81F9 1041165F CMP ECX,5F164110
5F161D97 ^7C EB JL SHORT 5F161D84

5F161D99 C3 RETN
sigint33
10-22-2004, 12:48 AM
Try changing the JE (h74) to JMP (h76) and the JL to a NOP 90 for both bytes.

SiGiNT
br00t_4_c
10-22-2004, 10:13 AM
Without giving it too much consideration, that looks more like a decryption loop or a section that modifies the running code on the fly than a "good boy/bad boy" jump, so I don't really see how patching the jump will help the cause. Just my opinion...
sigint33
10-22-2004, 10:41 AM
At least it will break the loop and allow him to proceed, and if he's very lucky it could be a good boy/ bad boy piece of code - but on that one I tend to agree it's probably not.

SiGiNT
br00t_4_c
10-22-2004, 10:56 AM
@ ksbrace:

You do know you can automate the tracing of large repetitive code sections with Olly don't you? If not I suggest you read up on that (learning how to use the available functionality in Olly will save you a lot of sanity and wasted effort in the long run) I highly doubt that the code you cited is an infinite loop, it is probably just a loop that executes many, many times, possibly as part of an anti-tracing protection or as mentioned before it might be a decryption loop or part of a self-modifying code routine.

Perhaps you might gain a little bit more clarity by looking at the executable with a more "modern" PE analyzer like PeID. At least then if the program is packed with a well known packer/crypter then you will know what you are dealing with. Then you can take a look at some tutorials and manually unpack the target (if you want to learn something) or maybe just use an unpacking tool (if you just want to get on with things). Alternately you could trace the execution of the program a lot deeper in the debugger of your choice and maybe figure out what is going on for yourself, or with a bit of reading and practice you could probably generate an accurate dead listing of the program with IDA (see http://www.datarescue.com/idabase/unpack_pe/index.htm for a nice little intro to using IDA to disassemble a packed/crypted exe). This might be a more fruitful approach?

@sigint33:

Yes he could break there, but if the code is indeed encrypted and the unpacking routines have not finished executing or this is a section related to self modifying code, he is just looking at goobledygook that will only serve to confuse things further.
TBone
10-22-2004, 01:08 PM
Clearing the jump will get him past it, but it will almost certainly bork something. Look at what the code is doing -- it's fetching single bytes of data from DS:[ECX], modifyting them (AND AL,0FB), and then writing them back out. ECX gets bigger by 0C every time, and will break out of the loop when it's >= 5F164110. That value screams that this section is modifying or decrypting code just a bit further down that you're about to execute momentarily. So if you break out before it's done, Bad Things will happen.

Manually tracing through decrypting/self-modifying code is a pain, but it's probably a good idea to do it a few times until you get how that sort of thing works. The first few times it's confusing, but then you realize it's just the same tricks over and over with only a few variations. Then it just gets tedious unless you script it. I'm still learning the ropes, so I haven't gotten around to that myself :p.

If you've ever read Ender's Game: "Remember, the enemy's gate is DOWN!" :D. The key is to 1) Use code highlighting that highlites jumps and calls, and 2) when you get to each jump or call, make sure that it's taking you further down the code. If you see a conditional jump that takes you back up, set a breakpoint on the instruction after it, run until it breaks, then remove the breakpoint. If you're being sent back up the code by a CALL or unconditional JMP, you'll just have to go back through the code again. This time watch for any conditional jumps that you didn't take. One of them will send you to another JMP/CALL that breaks you out of loop.
ksbrace
10-22-2004, 02:52 PM
Hey guys,
Thanks for the tips. I was out of town yesterday, but I will give your tips a try and post the results tonight/tomorrow. I dl'd PEid and will give it a try. I'm extremely new to Olly, I have always used W32DASM until this app. Thanks again for your advice!
sigint33
10-22-2004, 03:28 PM
Excellent advice for both of us - thanks for the description of what the loop might be doing, I didn't consider that it might be accumulating code.

That's why I'm in this topic, to learn!

Thanx,

SiGiNT


Why?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Why?
PDA

View Full Version : Why?

DoubleHelix
10-20-2004, 07:47 PM
Wtf is your guy's problem, Im posting relavent stuff with Good questions, Sorry Everyone hasnt spent 5 years on cracking shit! You people shouldnt treat beginers like idiots, All I asked was help On adobe and asked what version Lunar's tutorial was for SINCE YOU ALL KNOW SO MUCH I FIGURED YOUD KNOW. But apparently not, the only thing you people excell in doing for newbies is deleting posts and treating people like idiots. So screw off people theres better sites and better people that actually want to help.
Woodmann
10-20-2004, 08:03 PM
Howdy,

Please feel free to go elsewhere.
If you want some help, stop being a pussy and learn to read.

No one will help you when you violate the forum rules.
Since you dont feel you did anything wrong, I wont waste
my time trying to explain it to you.

TA TA


Personal Experience
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Personal Experience
PDA

View Full Version : Personal Experience

naides
10-20-2004, 08:27 PM
;)
venom925
10-20-2004, 08:52 PM
LOL. Ok I don't know about the rest of you ,but, I think this redefines "pussy whiped" :devil: .

Great post naides :yay:
Silver
10-21-2004, 06:31 AM
heheh, ohh...

So out of interest, how many people here are married?

It's quite wierd to find out the statistics of something like that.... As a comparison, almost the entire demoscene has remained static (the same people) but getting older. People I knew years ago now have wives, kids, mortgages etc... And they still code for their group :D. Almost no new blood coming into the scene. I don't think it's like that with the reversing scene.
disavowed
10-21-2004, 11:12 AM
Almost no new blood coming into the [demo] scene.
that's because today's floppies can hold more than 16k
LiSa
10-22-2004, 11:13 AM
My two children are still looking at me computing and maybe will of course start reversing but on a IA128.. As time goes we began dinosaurs not lion. The reversing scene seems not to evolve too much, anyway protection are always the same soup
Peres
10-22-2004, 03:48 PM
My two children are still looking at me computing and maybe will of course start reversing but on a IA128.. As time goes we began dinosaurs not lion. The reversing scene seems not to evolve too much, anyway protection are always the same soup

Maybe we should take a broader approach and become true reverse engineers. It would be nice to get some thoughts about this.
Woodmann
10-22-2004, 06:08 PM
Interesting ;)
dELTA
10-22-2004, 06:09 PM
True reverse engineers? Exactly who the hell are you calling a fake reverse engineer, boy? :p
JMI
10-22-2004, 10:11 PM
dELTA you are way too young to be calling anyone "boy." :rolleyes: :sneaky:

Regards,
dELTA
10-23-2004, 06:12 AM
Ok, I'm sorry. Then, exactly who the hell are you calling a fake reverse engineer, girl? :D
JMI
10-23-2004, 11:19 AM
And you will never make a favorable impression with the ladies by referring to one of them as "girl." :rolleyes: :devil:

Regards,
Peres
10-23-2004, 11:23 AM
True reverse engineers? Exactly who the hell are you calling a fake reverse engineer, boy? :p

Eh... I would be happy to say there are no fake reverse engineers. Anyway, I should have asked: shall (and how) we become *complete* reverse engineers?
JMI
10-23-2004, 11:33 AM
That would sort of require that you acquire "all" the knowledge of how one might reverse all forms of software protection and obfuscated code, but that, in itself, seems to be a self contradictory concept. One must keep in mind that there is a whole lot included in the concept of "complete" and, just when one might assume they have achieved such a lofty goal, along comes something new, and one is then no longer "complete."

Might I suggest that perhaps the term which may be more appripriate would be a "competent" reverse engineer, capable of understanding the general process of reversing and with a working knowledge of process and procedure and a clear realization that there is always something more to learn and study. :idea: Recognizing that one does not know "everything" is one of the first steps of learning.

Regards,
Peres
10-23-2004, 11:45 AM
Might I suggest that perhaps the term which may be more appripriate would be a "competent" reverse engineer, capable of understanding the general process of reversing

I wish I had a better knowledge of the English language.
I think your 'competent reverse engineer' fits better than my complete one with regard to the neverendingness (!) of his/her learning process. However, I believe we need another adjective to stress the fact he/she should be able to address a wide spectrum of different problems, not merely software protections.
Silver
10-24-2004, 08:03 AM
"Broad horizons" describes it best, IMO. I agree, an expert in A will never be as "competent" as an expert in A who has depth of knowledge about B, C and D too.
nikolatesla20
10-24-2004, 08:21 AM
Reverse Engineering isn't a hobby, it's a lifestyle. RCE's just want to know how things work.

So, unless the particular "cracker" is just a lame-o picking up the crumbs of what others leave behind, their skills are usually broad because of that always-need-to-know-how-it-works passion.

-nt20
JMI
10-24-2004, 03:00 PM
I certainly agree with that. I started taking things apart to see how they worked when I was very yourng and have continued to do that in many aspects of life, both physical and metaphysical and not just software related. :yay:

Regards,
naides
10-25-2004, 03:09 AM
Well, I did not know that the misadventures of a Lion couple, not matter how it reflexes on my personal life would start this philosophical leaning thread.
My 25 cents. . .
I have been a reverse engineer for a long time. I am a biology/immunology researcher and God forgot to write the manual on how living things work, so it is up to us to reverse it and write the manual.
Reverse code Engineering is for me a source of inspiration and attitude, I have learned a lot from these guys: to think outside the box, to look for lateral solutions to the most stubborn problems.
Rennie_B
10-25-2004, 10:57 AM
I began "reversing" not so long time ago, even I have been computing for about twenty years or so. I started visiting this and some other sites and thought that cracking something could be nice. Well, when the first prg was patched and working, if felt really great and ... a bit sad because I felt I had wasted half of my life; I could have started this learning process a long time ago. This site has been a great source of knowledge and inspiration, even I understand merely a tenth of what you are talking about :-) One thing is really makes me wonder - where do you find the time to reverse programs ???
Silver
10-25-2004, 11:52 AM
I am a biology/immunology researcher and God forgot to write the manual on how living things work, so it is up to us to reverse it and write the manual

That's truly an excellent point, and career!
SL0rd
10-27-2004, 09:28 AM
I believe that there is a physical limitation of the protection methods, related to the way of computer are actualy made. The methodes are formulated following the actual computer construction logic, so computers are being faster and increasing your memory capabilities but the logic is still the same, its dont change, the protections methodes are bound to this logic and also dont change at all. The logic must change, then the scene will change!


Virtual Drive
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Virtual Drive
PDA

View Full Version : Virtual Drive

LaBBa
10-21-2004, 02:24 PM
Hi all

Lately I was developing virtual device driver in ring0 and and i allways wanted to know how to code my own Virtual Driver like all of those Virtual CD apps

well I'm happy so tell you all that i found a good source code that does that .

ok .. if anyone wants source code for how to create an Virtual Drive :

http://chitchat.at.infoseek.co.jp/vmware/vfd.html

Download link for source code:

http://chitchat.at.infoseek.co.jp/vmware/vfdsrc-041003-2.zip

enjoy

LaBBa.
dELTA
10-21-2004, 03:57 PM
Cool, thanks. :cool:
0rp
10-21-2004, 06:40 PM
here are similar projects, that include virtual disc driver sources:

http://www.acc.umu.se/~bosse/

http://www.truecrypt.tk/
LaBBa
10-21-2004, 06:59 PM
Tnx ORP ...
I was looking for those.. :D
JMI
10-21-2004, 07:50 PM
LaBBa we do appreciate your efforts and your contribution here.

Regards,
shiny
10-27-2004, 11:43 PM
Thank you very much!!!!


What can edit a directory entry?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > What can edit a directory entry?
PDA

View Full Version : What can edit a directory entry?

roocoon
10-24-2004, 10:58 AM
Hi.
I'm searching for a tool that seems to be impossible to find.
The problem (XP SP2 system with FAT32 disks):
Something (mulfunctioning controller, cacheing or program) has written over a subdirectory's space creating a bunch of ghost files.
Names could be blank or strange, dates are off the wall, starting sector and sizes could be zero or in the terrabyte range.
I've tried everything of course but the files cannot be deleted. The system just doesn't find the file even though it can be displayed.
No chkdsk with any option, not in DOS, no wildcards, not with any utility I've tried.
Only way that worked was by modifying the actual directory entry (they are ghost files after all).
I corrected the dates, the name, file type, set size to zero, etc, and deleted the file. A chkdsk at the end, clears up any conflicts.
So what do I want eh?
To do the above, I used WinHex. It allows editing the directory entry.
The problem is that it is very flakey. It takes multiple tries for the change to stick, if it does, and got fed up with it.
So I'm looking for a replacement. I'd appreciate it if somebody can suggest some tool that does the above.
Thanks.
esther
10-24-2004, 11:14 AM
just my 2 cents :) You can try old Norton diskeditor,it only well in dos or maybe winxp console give a try ;)
JMI
10-24-2004, 03:02 PM
I haven't tested it myself, but I believe RunTime GetDataBack has a recent version for FAT32 which might do the job. There are copies available in the wild, if you know what I mean.

Regards,
esther
10-24-2004, 11:27 PM
Don't know watcha mean LOL
roocoon
10-25-2004, 08:55 AM
Thanks guys.
None of the Norton editions fill the requirement. The old Norton Disk Doctor that did, doesn't support FAT32.
GetDataBack (I had picked it up off the wild a while ago) can only back up files from disks that are hard to access. Nice tool for sure.
But thanks JMI for making doubt my memory :).
That program can call up another one of their programs called Disk Explorer (has also versions for FAT and NTFS).
It got me curious so I unearthed it (I had picked it up at the same time with GetDataBack) and installed it.
Well, this program did the trick.
You can browse to a directory entry and modify its values.
I corrected all the bad entries I had and deleted them with no problems.
Disk is clean again and I'm a happy puppy (make that an old dog).
Take care all.
Silver
10-25-2004, 11:50 AM
I'd vote for Ontrack EasyRecovery Pro. Had great success with that tool.
Anticode
10-27-2004, 07:48 AM
:idea: I would give WinHex a shot..
dELTA
10-27-2004, 08:09 AM
I would read the first post one more time. :p
JMI
10-27-2004, 05:20 PM
Why not actually read the #5 post where raccoon states he has solved his problem. :idea:

Regards,
dELTA
10-27-2004, 05:42 PM
Well, I guess alternative solutions might still be better than the first one found, and interesting for others too if nothing else, so if people want to submit an extra tip or two I'm all for it anyway. :)
JMI
10-27-2004, 11:23 PM
Well, considering you're still relatively young, we can conceed you still have alot to learn. :devil:

Regards,
bilbo
10-28-2004, 02:21 AM
Hi, JMI, what have you eaten for breakfast today?

I've found two more tools which claim to do the (attractive) job (even for NTFS): Acronis Disk Editor and Omnixray (plus LDE for Linux partitions).
Sorry mates, no time to try them...
Regards, bilbo
dELTA
10-28-2004, 08:01 AM
JMI, what have you eaten for breakfast today?Probably some gooey stuff injected directly with a tube, considering this ever so reiterated age thing. :D
roocoon
10-28-2004, 01:24 PM
Acronis Disk Editor doesn't do it. I had already tried Acronis Disk Director 9 -- contains Disk Editor) and it only works at the partition level.
I had also picked up OmniXRay but never tried it. It looks like a possible according to its write-up but working in DOS with EMS, when the other programs can do it under Windows, makes it a last resort. It's a nice program to have though. It reminds me a lot of the DOS days and the tools that used to go around then. Then I think how long ago that was and I get depressed...
JMI
10-29-2004, 12:18 AM
Nah. Those of us here in the cryo facility don't really need breakfast in our frozed state. :D If they actually thawed us our for a meal, our ancient, decrepid bodies would probably turn to dust. :rolleyes:

And dELTA is my friend and we have a tradition of teasing eachother. :loveu:

Regards,
esther
10-29-2004, 08:32 AM
I'd vote for Ontrack EasyRecovery Pro. Had great success with that tool.

Are you fu**** sure this can be done? LOL


Restoreing VB project files...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Restoreing VB project files...
PDA

View Full Version : Restoreing VB project files...

kehu
10-24-2004, 12:29 PM
I have one old "Visual Basic 1" exe file, and i need to get out the project files from it... I searched on the i-net, but didn`t found older than VB3 decompilers. Maybe some of You have something, that may help???
br00t_4_c
10-25-2004, 10:27 AM
kehu,

Not sure if this is exactly what you're looking for (your question was not very specific) but VBReformer is great for breaking VB apps down into their component forms and controls and what not, does not decompile --but can be very useful in certain cases (http://www21.brinkster.com/hexorciser/). There are a couple of VB decompilers of varying quality and usefulness out there. I suggest checking out the protools site for a fairly representative sampling of what's been available for a while. For newer, more refined stuff I suggest you start Googling.
kehu
10-25-2004, 02:11 PM
VBreformer is for VB4-VB6 app`s. But I need VB1 16-bit decompiler and on the i-net I did not found enything useful :(.


Hard Objetive!!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Hard Objetive!!
PDA

View Full Version : Hard Objetive!!

tenketsu
10-24-2004, 07:45 PM
Has somebody tried to unpack some EXE protected with SDProtector?? It's a good mixture [Armadillo with Asprotect] and some AntiDebugger's touches.

Try it!!


lm_checkout() retn
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > lm_checkout() retn
PDA

View Full Version : lm_checkout() retn

Zman
10-25-2004, 02:34 PM
Hi all,

Im working on a target that is using a popular license manager with a newer version v8.2a. It's got all that additional prikey/pubkey stuff as well. I've read most of the essays on the subject but the newer info seems to suggest that reversing this is difficult even for an expert. I found the checkout routine, but being a newbie, I cannot figure out where/how to patch the return value. Anyone else working on something like this? Any info or a push in the right direction would be appreciated. :)
sigint33
10-25-2004, 03:20 PM
If you have an example lic. you can use that by applying, the ECC patch, do a google on that patch, or I can supply you with more details, in simple implementations just eliminating the _l_checkout or _lc_checkout call in conjunction with rhe ECC patch will eliminate the need for a lic.

SiGiNT
Zman
10-25-2004, 04:09 PM
Thank you signit33! I give that a try. :yay:

-Zman.
Zman
10-28-2004, 12:36 AM
All praise SiGiNT!

The ECC patch in combination with the generic license and the NOP's place on the conditional jumps to the lm_checkout() worked like a champ! My first cracked program! Awesome! What a rush! SiGiNT is OBIWAN! :yay:

Zman
appleleafs
10-29-2004, 03:33 PM
As I think that it is usually to risky to patch the l_checkout directly. Some program will checkout redudent features, or anti crack features, if the kind of feature is checked out, they will block some functions. Also, some program check for different feature to determine the current configuration, if every attemp is succeed, you may loose some function of the program.
I think it is better to fix the ECC checking point, so that it fall back to the normal license check, and supply a valid old style license.
sigint33
11-01-2004, 10:48 PM
Appleleafs,

You are absolutely correct - the ECC should do the trick and that is where I pointed Zman for the first attempt, but I have had good success with the checkout patch on a couple of really simple implementations, it won't work with out problems when dealing with the more sophisticated apps, anyway it's always more fun to try to encrypt your own lic! Zman I truly appreciate the compliment, but I really don't deserve it, Flexlm is the only thing I know a small amount about ( I'm a 1 trick pony ) - and I was glad I could help you out, but the real work, (the ECC patch), was found by others and they desreve the credit.

SiGiNT


java class patching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > java class patching
PDA

View Full Version : java class patching

neur0n
10-26-2004, 06:27 AM
I have obfuscated java class where I want to change one method behaviour. Instead of original method code it should always return constant value like in example.

public static long methodName() {
return 11;
}

Problem is that class is obfuscated so after decompiling it contains lots of garbage java code and thus I can not recompile it.

Then I tried bytecode patching approach but this seems not to be an easy task. Java stores all constants in Constant pool so adding a new constant would mean that I would have manually increase size of class, add new constant value and recompute all class structures and fields like Constant pool count.
Then I thought that I could return some existing class constant but unfortunatelly there is no suitable one.

Is there a way how to patch method with desired functionality and avoid to recomputing class structure ?
ksbrace
10-26-2004, 08:11 AM
Couldn't you just extend the obfuscated class and rewrite the method with the new method behavior? aka override the method.
neur0n
10-26-2004, 09:01 AM
Originall class contains several private methods which I can't extend. Those private methods is also obfuscated so I can't copy/paste them to new extended class because I wouldn't compile that code.
dELTA
10-26-2004, 09:48 AM
Hmm, I'm a bit rusty on this, but wasn't it possible to include some low contants directly in the bytecodes? Alternatively, do some arithmetic with existing constants to get your desired constant.
neur0n
10-26-2004, 10:22 AM
As far as I know there are only two low contants which can be entered directly - values 0 and 1.

There are no suitable existing constants which could be used to get value 11 by arithmetic calculation.

At the moment it seems that I will have to create new class with constant value 11 a read it from there but I bet there is some simple solution.
dELTA
10-26-2004, 11:00 AM
You are after all discarding all bytecodes in the entire method, are you really sure that you don't have room for:

B = 1 + 1; // B = 2
A = B + B; // A = 4
A = A + A; // A = 8
A = A + B; // A = 10
A = A + 1; // A = 11
return A;

?
neur0n
10-26-2004, 11:54 AM
You are right your code takes only 26 bytes so it fits there :)

Is there any other general approach ?

E.g. if I would like to return current time which is 1098809442906 for today.
neur0n
10-27-2004, 03:59 AM
If I want to avoid coding complex code in java bytecode it seems the best way would be to call method from new class. For this purpose I still need to add name of the new class to originall class constant list.

I have few questions:

1. Is there a tool which allows to add constant to existing class ? (I hope I will not have to code it on my own :) )

2. Is there a tool (like hiew) which would allow to write java opcode (iconst_1, ireturn) instead of their hex values (0x04, 0xAC) ?

3. Is it possible to add java data (e.g. string) to java code without adding it to class constant list.

Something like in asm: (I don't remember it correctly. I haven't used it for about 10 years.)
JMP label1
label0:
db text 'some text';
label1:
MOV eax, offset label0
martin
10-27-2004, 04:46 AM
I had a similar problem once, when dejunking the obfuscated code was too big a job. Find a description of the class format, and find the byte that determines whether a method is private, protected or public - it is just one byte - then modify it with a hex editor to your required value.

Quite a nice project really, it was a java midlet game for a phone, I wanted to modify it to run full screen on my phone (it was for a smaller screened phone), and I ended up patching it as above so I could override the paint method and resize it before drawing to the screen. Ran like a dog, mind...
neur0n
10-27-2004, 06:03 AM
Good idea :yay: .
dELTA
10-27-2004, 07:30 AM
1. Is there a tool which allows to add constant to existing class ? (I hope I will not have to code it on my own)Yes, there are several class manipulation tools out there. There is a library called BCEL (Byte Code Engineering Library), which is quite powerful, and I have used it earlier for similar tasks.

2. Is there a tool (like hiew) which would allow to write java opcode (iconst_1, ireturn) instead of their hex values (0x04, 0xAC) ?Yes, BCEL can do this too. But another technique could of course also be to just write the java code yourself in a separate class, then compile it and rip it from the compiled class, not having to put together the bytecodes yourself (as long as no constants or such are used from the code this will work).

3. Is it possible to add java data (e.g. string) to java code without adding it to class constant list.No, not normally, since the java format is purposely limited in these aspects due to security reasons.
cr.ap
10-27-2004, 09:40 PM
adding an constant to the pool isnt that complicated in java, since the whole class is read as stream, and theres nowhere position dependant code.

appart from adding to the constant pool, and maybe a bit easier solution would be the inheritance approach, the private functions can be patched to public without bug effort.

you can get an descripton of the clas file format on http://java.sun.com/docs/books/vmspec/2nd-edition/html/VMSpecTOC.doc.html

chapter 4

cr.ap
br00t_4_c
10-28-2004, 10:24 AM
Do I smell a mini project?
neur0n
10-30-2004, 02:52 AM
There is no need for another mini project :) .

BCEL library supports everything we need (changing private atribute, adding new constants,methods, ...).


olly plugin scripts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > olly plugin scripts
PDA

View Full Version : olly plugin scripts

bestobest
10-27-2004, 07:28 PM
I have dowloaded a bunch of scripts for ollydbg, but how do I turm them into plugin, I've noticed that pluging for olly have to be a DLL, how do I turn a script to dll.
JMI
10-27-2004, 11:27 PM
We do have certain rules here, which would be clear to you if you have followed the instructions and read the FAQ. Please explain what you have done to investigate this issue yourself. Have you used the search function here? have you search for answers of the net? Have you been to the Olly Forum and looked for answers there? If you have not done allyou really haven't done what you are supposed to do before asking a question. If you have do some, or all of those things already, you are still supposed to indicate that you have searched for the answer yourself and not been able to find what you are looking for. :whoops:

Regards,
naides
10-28-2004, 02:52 AM
Have you tried to post the question on the Olllydbg forums? Chances are you may find more info there.
dELTA
10-28-2004, 05:14 AM
You don't actually turn the scripts into plugins, but rather you use a plugin to execute the scripts, namely this one:

http://ollyscript.apsvans.com
Polaris
10-28-2004, 05:29 AM
Don't wanna sound boring... But if you don't even know what a DLL or a script is you should forget about RE, learn the basics of computers and then get back here... :devil: :devil: :devil: :devil: :devil: :devil: :devil: :devil:
bestobest
10-31-2004, 10:58 AM
I have searched all over, found something at exetools, but when I tried to register to that site it said not accepting new registration
JMI
10-31-2004, 11:04 AM
That's because I am trying to catch up with the flood of over 2,000 new members in the last couple of months and real workd work has been rather busy. As soon as I can catch up with some house cleaning there, the registration will be open again, at least for a while. In the mean time, did you bother to follow dELTA's advise about ollyscript??

Regards,
%UNDEFINED%
10-31-2004, 07:34 PM
Okay obviously you didn't visit hxxp://ollyscript.apsvans.com/
So I will be nice an do the work for you.

URL to Download the plugin:

hxxp://ollyscript.apsvans.com/getPlugin.php?ver=09

Also, in case you need further help here is the link to the Help (*.chm) file I wrote for OllyScript:

hxxp://ollyscript.apsvans.com/download/osc_091_help.zip

Have a nice day :yay:
JMI
11-01-2004, 01:16 AM
Oh, but all that reading is so HARD. Can't you just tell me how? :eek:

;)

Regards,
bestobest
11-06-2004, 10:21 PM
That's because I am trying to catch up with the flood of over 2,000 new members in the last couple of months and real workd work has been rather busy. As soon as I can catch up with some house cleaning there, the registration will be open again, at least for a while. In the mean time, did you bother to follow dELTA's advise about ollyscript??

Regards,
Thanks for your response..
bestobest
11-06-2004, 10:22 PM
Okay obviously you didn't visit hxxp://ollyscript.apsvans.com/
So I will be nice an do the work for you.

URL to Download the plugin:

hxxp://ollyscript.apsvans.com/getPlugin.php?ver=09

Also, in case you need further help here is the link to the Help (*.chm) file I wrote for OllyScript:

hxxp://ollyscript.apsvans.com/download/osc_091_help.zip

Have a nice day :yay:
Thank you
bestobest
11-07-2004, 06:23 PM
Need some help, I have this progy coded in delphi I think 5 prog does not appear to be protected by anything like asprotect etc. might be emcripted tho. Anyway program run for 20 min. then exit save and print disabled. To register it open a window there you have a serial number alredy filled next box you enter code, offcourse evry code I enter it say invalid code. This is as far I got with DEDE
004759F0 55 push ebp
004759F1 8BEC mov ebp, esp
004759F3 33C9 xor ecx, ecx
004759F5 51 push ecx
004759F6 51 push ecx
004759F7 51 push ecx
004759F8 51 push ecx
004759F9 51 push ecx
004759FA 53 push ebx
004759FB 56 push esi
004759FC 57 push edi
004759FD 8945FC mov [ebp-$04], eax
00475A00 33C0 xor eax, eax
00475A02 55 push ebp

* Possible String Reference to: 'é$Ùøÿëà_^[‹å]Ã'
|
00475A03 68FF5A4700 push $00475AFF

***** TRY
|
00475A08 64FF30 push dword ptr fs:[eax]
00475A0B 648920 mov fs:[eax], esp
00475A0E B301 mov bl, $01
00475A10 C645F700 mov byte ptr [ebp-$09], $00
00475A14 33D2 xor edx, edx
00475A16 55 push ebp
00475A17 68555A4700 push $00475A55

***** TRY
|
00475A1C 64FF32 push dword ptr fs:[edx]
00475A1F 648922 mov fs:[edx], esp
00475A22 8D55EC lea edx, [ebp-$14]
00475A25 8B45FC mov eax, [ebp-$04]

* Reference to control TfrmStudent.txtEnterCode : TEdit
|
00475A28 8B80E0020000 mov eax, [eax+$02E0]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
00475A2E E8D166FBFF call 0042C104
00475A33 8B4DEC mov ecx, [ebp-$14]
00475A36 8D45F0 lea eax, [ebp-$10]

* Possible String Reference to: '$0'
|
00475A39 BA185B4700 mov edx, $00475B18

* Reference to: System.Proc_00403CB4
|
00475A3E E871E2F8FF call 00403CB4
00475A43 8B45F0 mov eax, [ebp-$10]

* Reference to: Unit_0040721C.Proc_004080E4
|
00475A46 E89926F9FF call 004080E4
00475A4B 33C0 xor eax, eax
00475A4D 5A pop edx
00475A4E 59 pop ecx
00475A4F 59 pop ecx
00475A50 648910 mov fs:[eax], edx
00475A53 EB18 jmp 00475A6D

* Reference to: System.Proc_004032F0
|
00475A55 E996D8F8FF jmp 004032F0
00475A5A 0100 add [eax], eax
00475A5C 0000 add [eax], al
00475A5E 847840 test [eax+$40], bh
00475A61 00665A add [esi+$5A], ah
00475A64 47 inc edi
00475A65 0033 add [ebx], dh
00475A67 DBE8 fucomi st(0), st(0)
00475A69 63DA arpl dx, bx
00475A6B F8 clc
00475A6C FF8D45F8BA24 dec dword ptr [ebp+$24BAF845]
00475A72 5B pop ebx
00475A73 47 inc edi
00475A74 00E8 add al, ch
00475A76 0AE0 or ah, al
00475A78 F8 clc
00475A79 FF84DB743A8D55 inc dword ptr [ebx+ebx*8+$558D3A74]
00475A80 EC in al, dx
00475A81 8B45FC mov eax, [ebp-$04]

* Reference to control TfrmStudent.txtEnterCode : TEdit
|
00475A84 8B80E0020000 mov eax, [eax+$02E0]

* Reference to: controls.TControl.GetText(TControl):TCaption;
|
00475A8A E87566FBFF call 0042C104
00475A8F 8B45EC mov eax, [ebp-$14]

* Reference to: Unit_00452AE8.Proc_004545EC
|
00475A92 E855EBFDFF call 004545EC

* Reference to TfrmMain instance
|
00475A97 A100904800 mov eax, dword ptr [$00489000]
00475A9C 8B00 mov eax, [eax]

* Reference to : TfrmMain.AllOK()
|
00475A9E E8C1110100 call 00486C64
00475AA3 84C0 test al, al
00475AA5 7411 jz 00475AB8
00475AA7 8D45F8 lea eax, [ebp-$08]

* Possible String Reference to: 'Code accepted. Close LADSIM down an
| d runit again to gain access to the
| extra features.'
|
00475AAA BA3C5B4700 mov edx, $00475B3C

* Reference to: System.Proc_00403A84
|
00475AAF E8D0DFF8FF call 00403A84
00475AB4 C645F701 mov byte ptr [ebp-$09], $01
00475AB8 6A00 push $00
00475ABA 668B0D985B4700 mov cx, word ptr [$00475B98]
00475AC1 B202 mov dl, $02
00475AC3 8B45F8 mov eax, [ebp-$08]

* Reference to: Dialogs.Proc_0044DB20
|
00475AC6 E85580FDFF call 0044DB20
00475ACB 807DF700 cmp byte ptr [ebp-$09], $00
00475ACF 7408 jz 00475AD9
00475AD1 8B45FC mov eax, [ebp-$04]

* Reference to : TApplication._PROC_004457D0()
|
00475AD4 E8F7FCFCFF call 004457D0
00475AD9 33C0 xor eax, eax
00475ADB 5A pop edx
00475ADC 59 pop ecx
00475ADD 59 pop ecx
00475ADE 648910 mov fs:[eax], edx

****** FINALLY
|

* Possible String Reference to: '_^[‹å]Ã'
|
00475AE1 68065B4700 push $00475B06
00475AE6 8D45EC lea eax, [ebp-$14]

* Reference to: System.Proc_004039EC
|
00475AE9 E8FEDEF8FF call 004039EC
00475AEE 8D45F0 lea eax, [ebp-$10]

* Reference to: System.Proc_004039EC
|
00475AF1 E8F6DEF8FF call 004039EC
00475AF6 8D45F8 lea eax, [ebp-$08]

* Reference to: System.Proc_004039EC
|
00475AF9 E8EEDEF8FF call 004039EC
00475AFE C3 ret

* Reference to: System.Proc_00403428
|
00475AFF E924D9F8FF jmp 00403428
00475B04 EBE0 jmp 00475AE6

****** END
|
00475B06 5F pop edi
00475B07 5E pop esi
00475B08 5B pop ebx
00475B09 8BE5 mov esp, ebp
00475B0B 5D pop ebp
00475B0C C3 ret

Can anyone direct me. Thanks
dELTA
11-08-2004, 05:19 AM
Here's a direction for you:

Don't post miles of uncommented code without any other explanation, just so people should tell you where to patch it! Read the FAQ!
bestobest
11-08-2004, 06:14 PM
Here's a direction for you:

Don't post miles of uncommented code without any other explanation, just so people should tell you where to patch it! Read the FAQ!
Sorry about the mile of code, about undocumented u tell me that is dede stuff, supposed to be self explanatory, find the button click and trace. if you follow trace it compare ur string to nothing from what I saw, I don't want a patch just to understand the algorithim... Thanks
SHaG
11-23-2004, 06:26 AM
1. Read tuts
2. Read more tuts
3. Crack crackmes
4. Search forums
5. Come back and ask constructive questions
yalcm
04-02-2005, 09:05 AM
That's because I am trying to catch up with the flood of over 2,000 new members in the last couple of months and real workd work has been rather busy. As soon as I can catch up with some house cleaning there, the registration will be open again, at least for a while. In the mean time, did you bother to follow dELTA's advise about ollyscript??

Regards,
Hello,
This is my 1st post here although I had visited here and read here since quite a long time ago. Thanks to this great site. SIGH! there is another great site I had visited several times before. But every time I tried to register there. It always told me that the new registration activity was closed. So when can we have a chance to register there, the "www.exetools.com", again ? Please note the time duration between the quote and this post.

Thanks a lot for your attention.


Learning to RE installshield, am i doing it right?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Learning to RE installshield, am i doing it right?
PDA

View Full Version : Learning to RE installshield, am i doing it right?

ear plug
10-28-2004, 08:16 AM
Ok this is proberly old news looking at the dates on some of the posts reguarding installshield.
It's my first attemp to reverse engineer anything, having read tuts by zee zee (decompiling installshield scripts), Natzgul installshield script cracking and a one from this site, krobar serial attack.txt, i though i'd have a go fishing for a serial in an installsheild script.

I'm using win98 and softice 4.05 with the hmemcpy command
am i using the best software for a newbie.
(it's the one I can follow with help from the tuts)

i work through the setup.ins file with softice and can find the location of the serial number i entered (015F:00402AB2) with a push eax command. but can't find the compared serial, would this compare each number by number one at a time if so any pointers.

in fact any help would be grateful as i'm struggling to get any further.
could'nt post any of the code around this location for you to look at as it's on my laptop, but i put the setup.ins file in this location below. ( please delete this link if not allowed. I read the FAQ and though this would be ok but I could be wrong)

<link deleted>

Thanks EarPlug
dELTA
10-28-2004, 02:31 PM
For your first serial fishing exercise, an InstallShield based protection might be unnecessarily messy, you should try something like Winzip or similar instead.

Also, all serial protections don't necessarily compare anything directly (i.e. there won't be any serial to fish), and if they do, it can be done in any number of ways, only the imagination of the author of the program sets the limit.

And yeah, I deleted your link. No code/data that can be used to identify the target here please.
ear plug
10-28-2004, 05:20 PM
Thanks for the reply delta, Guess it's going to be one of those things I’ll keep going back to, hopefully with a bit of luck rather than skill.

Cheers EarPlug

Thanks for removing the link hope I have not offended anyone.


Electronic components
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Electronic components
PDA

View Full Version : Electronic components

Silver
10-28-2004, 03:07 PM
Hi guys,

Way OT, but maybe someone here can point me in the right direction. I'm trying to find out what to look for (or if they even exist) in electronic sensors that can monitor water-solubal chemical parameters, ie: here's a water sample, please provide some readings. Temperature is an easy one, I'm also looking for sensors that can monitor nitrate, ammonia, nitrite, ph, gh (general hardness), and kh (carbonate hardness). The intention is a mental exercise to get me more experienced with electronics, these sensors would be "hooked up" to a circuit which would "be connected" to a pc via serial/parallel. You can tell the bits I haven't researched yet :D

It's easy to measure these parameters via chemical test kits, so I'm sure sensors must exist for them.

I'm coming up blank trying to find these sensors, but whether that's because I'm looking in the wrong place (I've checked all the national electronic component suppliers I know) or looking for the wrong keywords I don't know. All pointers appreciated, unless they're void* ;) . I'm hoping someone here knows off the top of their head whether what I want exists and what it's called. A name or supplier would be great!

Cheers! :yay:
Woodmann
10-28-2004, 03:26 PM
Howdy,

You want to search in the area of optics. I do such things and
all the newer technology is with optics and lasers.

If you need more just let me know.

Woodmann
naides
10-28-2004, 07:18 PM
http://www.abb.com
Kayaker
10-28-2004, 11:13 PM
That sounds very interesting Silver. If you glean any useful info you might want to share eventually, or if Woodmann or others have some cool things to share, please feel free. You probably already have good PC interfacing books, but one I found helpful was:

Real-World Interfacing with your PC
A Hands-on guide to parallel port projects
James Barbarello

I once did the project that uses an LM335 temperature sensor and ADC0831 A/D converter. Even wrote the software in VB (Gag!) I wish I had time to play more with other projects. It would be interesting to see what kind of IC's might be used for those types of water measurements. I would think that some of them would require specialized probes, what's the latest developments in glass pH probes, membrane technology or conductivity meters? You might be able to pick up some cheap bits at a scientific equipment disposal site.

I work in the chem/bio field, I'll ask the guys in the electronic shop their thoughts on chemical sensors, they're always building something interesting ;)

Cheers,
Kayaker
klier
10-29-2004, 08:56 AM
think you need ion selective electrodes.
expensive though. :(
Regards,
Silver
10-29-2004, 11:18 AM
Thanks for the replies guys. From what I've found (now that I know what I'm looking for), I think this project will have to be abandoned. I can only find US suppliers for most of the probes, and the cost is huge - the ammonia one alone is $555...

So unless anyone knows different, looks like I'll have to leave it for now. Kayaker - I'd appreciate it if you let me know what your biochem guys say.
Woodmann
10-29-2004, 03:55 PM
www.trios.de

You owe me a dollar :p

Woodmann
Kayaker
10-29-2004, 04:52 PM
Lol, actually they suggested taking up another hobby such as making your own beer :D This being a Friday afternoon idea of course. One of them had just picked up a nice little gas sensor kit for alcohols, smoke contents,.., that looked like a reasonable home IC project
http://www.kemo-electronic.com/en/home/index.htm

Nice Trios inline cuvette units there, nice bucks! Maybe playing with a scrap O2 sensor from an automobile exhaust system might be more affordable :P
Silver
10-30-2004, 12:21 PM
:D thanks guys!

And that dollar is.. er.. in the post. ;)


Any way not to load si405nt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Any way not to load si405nt
PDA

View Full Version : Any way not to load si405nt

Berger
10-28-2004, 05:13 PM
Hi!
I've installed Softice 4.05 on WinXP SP2.
Every thing is working fine.

My only Problem is that i could not find a way NOT to load it on systemstart.

When I change the startup options to "manually" it is still detected by various programs that -as a consequence - refuse to start (skype f.ex.).

What can I do not to load si the next time i start my windows?

Thanks in advance, Berger
Kayaker
10-28-2004, 05:49 PM
Hi

From the fossil records which I dug up from a 3+ year old post, this is one nice way of doing it I used to use on Win9x, modify as required...

Kayaker

You can edit autoexec.bat to give you the option of starting up Softice on bootup.

Example courtesy of Eternal Bliss:

--------------------------
@echo off
cls
set Winice1=Yes
set Winice2=No
echo Please Specify Whether You Want To Load SoftIce
echo.
echo Press 1 for %Winice1%
echo.
echo Press 2 for %Winice2%
echo.
echo SoftIce will not be loaded if nothing is pressed within 3 seconds
echo.
choice /c:12 /T:2,3 Choose an option
if errorlevel 2 goto NoLo
if errorlevel 1 goto Lo
:Lo
c:\PROGRA~1\NUMEGA\SOFTIC~1\WINICE.EXE
goto end
:NoLo
echo.
echo SoftIce Will Not Be Loaded
:end
------------------------
naides
10-28-2004, 06:03 PM
Hi!
I've installed Softice 4.05 on WinXP SP2.
Every thing is working fine.

Perhaps you are very lucky, and Sice 4.05 landed in a particularly friendly system, but as far as I know not even Sice 4.27 was XP compatible. I suggest you perform a more in depth testing to make sure Sice is indeed working as it should in your system.
Berger
10-28-2004, 06:49 PM
Kayaker that wont work in my case since under xp si is not loaded via winice.exe like it was with win9k - but thx anyway.

naides i was didnt have to much time to test- but it is starting without errors, ctrl+d brings me to sorftice and the few breakpoints i tried worked too.
The only problem i had at the begining was that pressing ctrl+d turned my screen to black, pressing it again brought me back to windows - i fixed that by including Monitor="0" in winice.dat (i have got the possibility to use 2 monitors and it seems to me si didnt know wich one to use)

Nevertheless i think ill give DS 3.1 a try since it has the posibility to switch the startup mode to "unload" - and thats what i wanted anyway :)
bilbo
10-29-2004, 01:48 AM
Hi, Berger,

you could always 'regedit' HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice and set the 'start' value to 4 (0=Boot, 1=System, 2=Automatic, 3=Manual, 4=Disabled)...

Nevertheless i think ill give DS 3.1 a try since it has the posibility to switch the startup mode to "unload" - and thats what i wanted anyway :)
That's a good choice... DS 3.1. has a special driver, bootcfg.sys, which allows you to manually select at boot time the winice configuration.

Regards, bilbo
Berger
10-29-2004, 06:03 AM
Hm. Got Ds 3.0 for now.

Now i can perfectly disable it...

But when i load it manually it says it had load successfully, then it brakes:
Break Due to KeBugCheckEx (Unhandled kernel mode exception)
Error=50 (PAGE_FAULT_IN_NONPAGED_AREA)

When I press Ctrl+D to get out of SI I get a nasty bluescreen telling me the same Error - time for reboot.

I installed the newes osinfo.dat and osinfob.dat - didnt help.
I'm using WinXp Sp2 (<- :-/ )

(Should i have opened another tread for this problem?)

Regards and thx for your help, Berger

EDIT:
Using Symbol Retriever and Symbl Loader did the job - everythin seems to work fine now - thx :devil:
nikolatesla20
10-29-2004, 07:20 AM
EDIT:
Using Symbol Retriever and Symbl Loader did the job - everythin seems to work fine now - thx :devil:

Yes almost all trip up on this problem, the solution has been listed many times, perhaps newbs can be redirected to this exact thread to read the following:

STEP1 TO USING SOFTICE ON WINXP:

GET_THE_FREAKING_SYMBOLS_FROM_M$_BY_USING_
THE_SYMBOL_RETRIEVER!

IF YOU DON'T DO THIS STEP THAN DON'T ASK WHAT'S WRONG !

And have fun reversing :)

-nt20


Star Force 3.3 Cracked!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Star Force 3.3 Cracked!
PDA

View Full Version : Star Force 3.3 Cracked!

LaBBa
10-29-2004, 06:08 AM
Hi all

I just saw a post on the exetools froum about the last star force
here u go a link if you would like to know more..

http://www.exetools.com/forum/showthread.php?t=5764

enjoy

LaBBa
JMI
10-29-2004, 11:03 AM
I'm shocked, shocked to find cracking is going on. :eek: And only four days after it was posted too. :D

But in case any of you are having a heart attack over the prospect of getting your hands on a generic crack for SF3 products, don't stop your hearts just yet. The report is of a crack, but the release info only actually gives a serial number and activation code of one particular product (which shall remain nameless here). It does appear, however, the someone has figured our how to solve this protection system. :yay:

Regards,
esther
10-29-2004, 09:12 PM
Yeah I'm shocked, shocked too :eek: Are you spreading cracks here? :confused:
JimmyClif
10-29-2004, 10:09 PM
Sorry for asking but could anyone send me the exetools attachment to my email at jimmyclif -at- fastmail -dot- fm. I'm not l33t enough yet to see attachments over there ;) Actually, I might have been erased from it's members due to being a nil-poster :-/
gook
10-30-2004, 10:16 AM
What's so special about this? Hasn't this version of SF been cracked before? From what i understand out of this guy's post is that they patched out the cdchecks in the protect.dll? Sure, that's a different approach.. I guess the next SF update will change and they're basicly back to 0.


Gedanken experiment - an uncrackable architecture
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Gedanken experiment - an uncrackable architecture
PDA

View Full Version : Gedanken experiment - an uncrackable architecture

TBone
10-29-2004, 12:51 PM
Ok, long post here, but what the hell.

If you aren't familiar with the term, a "gedanken experiment" is a theoretical experiment carried out in your head (gedanken is the German word for "thought", or so I'm told). I'm not sure who coined the phrase - some attribute it to Einstein, but I suspect it could have been any of the famous German scientists who immigrated to the U.S. during WW2.

Anyway, what got me to thinking about this is quantum cryptography. Well, actually it started with the Diffie-Hellman-Merkle key exchange. The idea that two people can exchange a piece of secret information in a non-secret way demolished a fundamental principle in cryptography that had existed for hundreds (if not thousands) of years. And now we've had an even more startling revelation that by clever use of the uncertainty principle, we can devise a system that allows people to exchange information in a way that makes eavesdropping absolutely impossible by the known laws of physics.

So, my gedanken experiment is this: is there a way to design a computing architecture which is truly uncrackable? The underlying assumption has always been that this impossible because the code must be executed at the processor, where the end user can observe it. If you look a little closer at the premise, what we're really saying is:

If the code is executed by the processor, then the user can observe it.

But what if that's not true? It sounds crazy to suggest that you could execute code without looking at it, but quantum physics is full of situations where simply looking at something completely changes its behavior. Can we design a computing machine that only works right when no one is looking at it? What sort of properties would such as system have to posses in order to work?

I think the first necessary arrangement is that the code is stored at a remote location, and delivered to the computer only as-needed. We can transfer it from the code store to the computer across a quantumly encrypted channel, which we already know how to do over reasonably long distances. Likewise, the computer should be designed so that it never stores any data outside of the execution unit. Data which needs to be stored for later use would need to be sent back to the code store, again using a quantum encryption channel. Obviously, a computer with no local memory is highly impractical for current designs. But this is just a thought experiment, we don't have to be practical, just possible :devil:.

Interestingly enough, the speed penalty of transfering data across long distances becomes much less problematic if we utilize massively parallel processing. If you've read some of Richard Feynman's excellent musings on nanotechnology, you'll see that this is an area in which nanotech shows great potential. Which dovetails in to another property of an uncrackable computer in an interesting unification.

Such a computer would have to be very small. So far we've protected the code from observation from it's storage location to the execution unit, and vice versa. But the much more difficult and unknown task of protecting the execution unit itself from observation remains. Present day circuits are no good for this. They're simply too big. The uncertainty principle and most other quantum effects tend to average out and become negligable in large scale systems. We need a system that's small enough for these effects to become a dominant "force". We have to go down to the atomic and sub-atomic level.

It's here that I get stuck. The general trend in designing such tiny circuits is tha they have to be able to withstand all the random perturbations that occur on such small scale. For example, it's necessary to implement reversable logic gates which will reproduce the original arguments should the flow of the circuit be reversed. But for our system to work, we need the circuits to be in a sense, nondurable. We need the behavior of the circuits to change when observed.

So, does anyone want to take a crack (:p) at this? Can you come up with a general scheme for a system that can only function correctly when you don't look at it?
nikolatesla20
10-29-2004, 02:49 PM
I find my penis tends to function more correctly if I don't look at it.

:p

The problem with any "protection", even one that can change while you observe it, is that it eventually needs to communicate with the outside world, after all, if it doesn't do that, then whats the point?

The weaknesses then, are in the outside communication chain, not in the process itself. As one advances in reverse code engineering, they begin to become enlightened to that fact.

-nt20
Woodmann
10-29-2004, 04:15 PM
Howdy,

It was a few years back when I stated that we would be working at a ring level of -3. ring level 0 we know. Ring level -1 would be voice, ring level -2 would be fingerprint and ring level -3 would be retinal/optical nerve.

So, we could build a rig that could only interact with our own thoughts.
(sounds like a movie that has already been made)

nikola raises the point that if it needs to access the outside world, we will have a problem.
If this rig only works with our own thought patterns, how would one "hook" into the "neural network" ?
Since everything is encrypted EXCEPT our thoughts, think radio waves,
could this be "cracked/hacked/stolen?

Remember, anything is possible in this experiment :)

Woodmann
omega_red
10-30-2004, 05:35 AM
If this rig only works with our own thought patterns, how would one "hook" into the "neural network" ?
Since everything is encrypted EXCEPT our thoughts, think radio waves,
could this be "cracked/hacked/stolen?

Remember, anything is possible in this experiment :)

Woodmann

Thoughts are just electrochemical processes in brain's neurons, we can theoretically stick a probe to each neuron (nanotechnology?) and measure its state ;)
naides
10-30-2004, 11:21 AM
I find my penis tends to function more correctly if I don't look at it.
-nt20

So there is a fundamental entaglement between Viagra and Heinsenberg's Principle??
JMI
10-31-2004, 10:58 AM
Maybe nikolatesla20's only reporting that visualizing the project and contemplating reaching a satisfactory conclusion can bring on performance anxiety. :devil:

Regards,
mike
10-31-2004, 04:23 PM
This might be relevant:
http://arxiv.org/abs/quant-ph/0303173
Woodmann
10-31-2004, 07:13 PM
Nice dig Mike,

Damn quantum stuff is so.. so..... quantum ?? :P:

Woodmann
JMI
11-01-2004, 01:15 AM
And you quantify it very well. :yay:

Regards,
disavowed
11-01-2004, 11:34 PM
If the code is executed by the processor, then the user can observe it.not necessarily. this isn't true on *nix systems for executables with flags -r-w+x (assuming we're not root, etc.)

Can we design a computing machine that only works right when no one is looking at it? What sort of properties would such as system have to posses in order to work?certainly. make if fail if photons leave the system. (btw, this is why it's impossible to observe a closed system from the outside)
SL0rd
11-03-2004, 08:41 AM
the computer should be designed so that it never stores any data outside of the execution unit.

I believe it cant avoid breaking the software, cause locally you have total control over the processor, you can instruct it to do whatever you want, its not you looking at the data but the processor itself, if the processor is a trusted object in the system whoever control it will be also a trusted element!
mike
11-03-2004, 06:16 PM
Another quantum protocol that might interest you is quantum cryptography. It allows communicating parties to detect eavesdropping, since eavesdropping messes up single photons.

There are more conventional protocols to consider, though, like secure function computation. You blind your input, send it to someone else who computes a function with that input, sends you the blinded result, and you unblind to get the true result.

You can also perform a secure computation protocol, where each step in the program is known to both parties, but each has a secret input where the only information that leaks is what you can learn from the output of the computation. If the program you are executing together is an interpreter and one of the parties' secret inputs is the program to be interpreted, then the other party will never know what is being computed.
tdennist
11-04-2004, 06:59 PM
I don't have anything to add to the thread. I just wanted to say that you guys here on these message boards are some of the most intelligent people I've ever encountered.

I respect you all.
Silver
11-05-2004, 05:05 AM
You can also perform a secure computation protocol, where each step in the program is known to both parties, but each has a secret input where the only information that leaks is what you can learn from the output of the computation. If the program you are executing together is an interpreter and one of the parties' secret inputs is the program to be interpreted, then the other party will never know what is being computed.

I may be misunderstanding, but isn't that exactly what PKI & assymetric key encryption does?
mike
11-07-2004, 07:45 PM
With asymmetric crypto, you are merely sending a message. In these protocols, you are computing a function of an input.

In the first, Alice only has a smartcard, but Bob has a desktop pc. Alice wants to compute f(x), but doesn't have the resources. Bob is willing to compute f(x) for her, but Alice doesn't want to tell Bob x. The protocol involves a secret function b that commutes with f and is easy to compute; that is, f(b(x))=b(f(x)). Alice sends Bob y=b(x). Bob computes f(y)=f(b(x))=b(f(x)), and sends it to Alice. Alice computes b'(b(f(x))) = f(x), where b'=inverse(b).

In the second, they trade off doing computations. Alice has a secret A and Bob has a secret B. They want to compute f(A,B), but neither is willing to reveal their secret.

See Schneier's Applied Crypto for some examples.


Sentinel Envelope
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Sentinel Envelope
PDA

View Full Version : Sentinel Envelope

CrackZ
10-29-2004, 08:09 PM
Hrm, OK, I've posted this in the 'Off topic' forum because its 'me_trying_to_find_someone' again.

A while back someone from this board sent me a Sentinel Envelope target (Elab.exe)(note admins if anyone finds the name of the target from that, I'd be *really* surprised, but remove it if they do ;-) ).

Just looking to find that person again for a quick conversation.

Sorry in advance to the admins, my memory is failing quite a lot recently, will do better in 2005 ;-).

Regards

CrackZ.
JMI
10-31-2004, 10:53 AM
Maybe attending a couple of Shania Twain's concert's would get the blood flowing back to the old brain (and, who knows, maybe other parts of the body) again. :D And besides, what you may have "forgotten" about these subjects, is already likely much more than most of us have ever known about them. :yay:

Regards,
cRk
11-21-2004, 09:45 PM
:D


protection i need help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > protection i need help
PDA

View Full Version : protection i need help

mr.smart
10-30-2004, 07:59 PM
Hey,

i have a little prog with a keyprotection.

the name of the prog is deleted
version: 1.0
size: 1.531.904 bytes
protection: key
link: deleted

info:

i need this prog for my work and must pay for every key 75,- euro, but i think this is to much and why we can not make a keygen?

i have try to make, but i'am a newbie and the protection is to hard for me.

i hope you can help me to make a keygen.

here a few of request and answercodes: (A - request; F - answer)

A:1000-00gu-hdrb-2000-200a-ebc9-hpj2-nlv2-pu89-q2kj-vg2n-4pb7
F:9323-g69h-bisl-3000-200c-nc41-nogi-2040-00
F:8ug6-p69h-bisl-3000-200c-nc41-nogi-20o0-00

A:1000-0000-0000-0000-200i-fb49-qh2k-pdhk-np2e-l4ss-6nnc-11po
F:3nb1-06ob-mggc-c000-200c-nc41-nogi-2040-00
F:2ap4-96ob-mggc-c000-200c-nc41-nogi-20o0-00

A:1g00-g58d-s8p8-6000-2000-i219-scon-7nkc-eks1-i3oa-0hd8-7gcn
F:n5ki-90r6-k38m-b000-200c-nc41-nogi-2040-00
F:mo6n-00r6-k38m-b000-200c-nc41-nogi-20o0-00

thanks for your help.
Kayaker
10-30-2004, 08:28 PM
Boy mr.smart, you sure didn't read the FAQ did you? The only reason I didn't delete the crack request outright is that maybe, just maybe, someone might be able to give some generic information on request/answer types of protections. If you're willing to work and learn it might help you, if you're only looking for an easy crack, you're in the wrong place. And don't ever post something like this on the Advanced forum.

Kayaker
mr.smart
10-31-2004, 09:04 AM
i will try to learn. maybe someone can give me some generic information on request/answer types of protections.

then i will look by my self.

thanks.


ok i'm new go easy...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ok i'm new go easy...
PDA

View Full Version : ok i'm new go easy...

bakeacake
10-30-2004, 08:27 PM
ooook, right here goes (ooo first post nerves :P). i just edited this executable i was messing around with that had been annoying me as it was detecting if the file had been renamed or if it had been run from outside command line. Anyways the incesant (i THINK thats how you spell it) messageboxing was annoying me. so anyhow lazy/inexperienced/stupid me tracks down the messagebox calls and with a couple of je -> jmp bingo no more messageboxes :) anways im not bragging cos a) i'm crap b) i'm unimaginably crap, think about how bad you would be if you were to have a full frontal lobotomy, then halve that ability c) they were short jumps, god i can't even remember the hex for a long jump.

anyway, the whole point of the above ramble is....i was wondering how it might actually check the renaming thingy?

PS anyone got any tutorials that are good for really stupid people (either C or RCE or ASM or anything remotely helpful)....but not danish, i tried that once already. its waaaay to hard to pronounce :P
nikolatesla20
10-30-2004, 09:36 PM
Well, if it checks the name then it has to have the original name stored somewhere. Open up the EXE in a hex editor and look for the EXE's name.

-nt20
evlncrn8
10-31-2004, 01:32 AM
getmodulefilenamea (00) - one way
parse commandline - another
and as nikolatesla20 says its gotta store the name to compare against somewhere in the exe
Lord8Bit
10-31-2004, 03:08 AM
Actually, - no, it doesnt have to keep a copy of the original filename. :devil:
Any kind of checksum of the name would reveal a change. :sneaky:

LordByte :yay:
nikolatesla20
11-01-2004, 11:01 AM
Actually, - no, it doesnt have to keep a copy of the original filename. :devil:
Any kind of checksum of the name would reveal a change. :sneaky:

LordByte :yay:

It doesn't have to store the name but it's a good place to start.

-nt20
bakeacake
11-01-2004, 05:30 PM
cheers people, i was wondering why it hadnt got the name stored :) everyone has been most helpful so thanks again.


Further observations in Flexlm...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Further observations in Flexlm...
PDA

View Full Version : Further observations in Flexlm...

Aimless
11-01-2004, 04:56 AM
OK all,

I know I've been at this for a long time now, but I'm nowhere near to the Flexlm crack that I've been expecting. Anyways, an interesting observation, which I thought many would have noticed and am wondering _WHERE_ and _HOW_ exactly it is that it happens and to overcome it...

1. Download software protected by Flexlm
2. Download any EVALUATION key (typically with START and END dates)
3. Install application and EVALUATION key. Run the application. See how nicely it runs...
4. Exit the app and push your date, say, a YEAR forward using the typical date and time control applet.
5. Run the application again. Ohhh. It now says expired.
6. Turn the date back to the current date. BAM! Its _STILL_ expired. Awww...guess I lost the evaluation also.
7. But wait!!....
8. In XP (Ya, I use XP, dunno about other OS), run Start -> Programs -> Accessories -> System Tools -> Disk Cleanup. Let the process finish.
9. Reboot the machine (V.Important)
10. Once the machine comes on again, run the application.
11. VOILA!!! It runs again (albeit in an evaluation mode..)

The flexlm protected application which I am using is not dependent on the date (what it means is: I am OK to work with this application using an old date also..unlike some applications where to get correct results you have to use current date).

I am also not averse to changing the date _EVERYTIME_ to a back dated time so that the app works.

My only issue is running Disk Cleanup everytime. My question is, if the same indeed happens, then there is something in FLEXLM that says that the date is backwarded/forwarded. But that something disappears during Disk cleanup.

Can some guru in Flexlm guide me on why this is happening? I can only think of temp files and that is all that the Disk cleanup clears.

Ideas anyone?

Have phun


deARMPro v1.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > deARMPro v1.0
PDA

View Full Version : deARMPro v1.0

sonkite
11-01-2004, 04:15 PM
This is my decrypter for ARM Protector v0.1, v0.2 and v0.3, hope you like it and it works. :P


Articles: .NET (dotnet) cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Articles: .NET (dotnet) cracking
PDA

View Full Version : Articles: .NET (dotnet) cracking

dELTA
11-01-2004, 05:22 PM
Here are some rather simple but still clean and to the point articles about cracking .NET (aka dotnet) programs, including bypassing Strong Name protection:

Building Security Awareness in .NET Assemblies:

Part 1 - Learn to break a .NET Assembly:
http://www.codeproject.com/dotnet/NeCoder01.asp

Part 2 - Learn to protect your .NET assemblies from being tampered:
http://www.codeproject.com/dotnet/NeCoder02.asp

Part 3 - Learn to break Strong Name .NET Assemblies:
http://www.codeproject.com/dotnet/NeCoder03.asp

Questions about these things have been asked several times here before, so I thought I'd make these articles indexed by the forum search engine by posting them here, enjoy.
readdict
11-04-2004, 02:53 AM
Hey!

I want to add that the mentioned method for bypassing Strong Names in .net assemblies only works on apps that use some kind of windows forms.. If it's anything other than that it won't work. The reason that this even works in the first place is due to a bug in the .net interpreter.

Anyways, I've worked on trying to find a solution for a .net app that utilizes a DLL file and with Strong Names and so far I haven't found any way to bypass it. If I do eventually succeed I will ofcourse share this information here.
The_Saint
11-04-2004, 07:02 AM
Has anyone experience with .net assemblies which contain invalid metadata(will crash ildasm)? There are some obfuscators that insert invalid metadata to protect assemblies from being disassembled.
dELTA
11-04-2004, 08:24 AM
readdict, it would be great if you could elaborate on a few things:

1.
Why does it only work on assemblies with Windows Forms in them?

2.
Exactly what is this bug in the interpreter that you're talking about, are you really sure about that?

3.
I'm not very familiar with the internals of .NET assemblies, but what those articles said was exactly what I had been guessing all the time, with my limited knowledge. Namely, that if some code has a digital signature on it, but the interpreter does not require any particular signature, or even any signature at all, you can simply replace the current signature with anything you like, or even remove it, and then patch/run the program to your heart's content? Exactly what prevents this method from always working, e.g. in the cases you mention?
omega_red
11-04-2004, 09:17 AM
Hey!

I want to add that the mentioned method for bypassing Strong Names in .net assemblies only works on apps that use some kind of windows forms.. If it's anything other than that it won't work. The reason that this even works in the first place is due to a bug in the .net interpreter.

I'd be grateful if you could point us to some binaries that can't be de-strongnamed;) this way.

I've used it succesfully for console-only (and multi-module) apps.
readdict
11-04-2004, 11:06 AM
Delta/Omega red,

It seems that I have mixed up the facts abit, i'm sorry about that. I got some of the information from these forums and other parts I got from experimenting with different .net assemblies... Let me clarify further what I got...

First off some of the info can be found in a thread at this forum:

hxxp://66.98.132.48/forum/showthread.php?t=4389

1. It wasn't when modifying the PublicKey contents but when changing the length of the StrongNameSignature from 80h to 0 that this didn't work with any other .net assemblies than windows forms apps..

But I haven't succeeded in removing the publickey + hash from my console targets yet without making them non-working after recompilation. But with windows forms .net apps I have so far always managed to do so and this is partly the reason that I thought that this applied in all cases, not only with the StrongNameSignature lenght was changed.

But now that Omega red points out that he has successfully managed to reverse .net console apps I'm starting to think that perhaps my targets are using some kind of internal checking that messes this up for me. Also see what I've found out below at 3.

2. No I am not sure about this, I've only read about this in other posts regarding reversal that includes removing the StrongNameSignature. So I cant provide you with any actual proof that this is the case.

3. I have saved some snippets from various sources from back when I was experimenting with this and the one that I find now which explains this somewhat is:

--

Most of the wizard-generated projects in MS Visual Studio .NET place this attribute in a file called AssemblyInfo, but you can put it in any source file you like. When the compiler sees this attribute, it copies the entire public key into the assembly's metadata, and uses the private key to form a digital signature. This is done by hashing the files in the assembly, incorporating those hash values into the manifest for the assembly, hashing the manifest, and, finally, encrypting this final hash value using the corresponding private key and tucking it away as yet another block of metadata in the assembly.

If you look at an assembly's manifest using ILDASM, you'll be able to see its public key quite plainly. What you won't see is the signature or the intermediate hash values. This sometimes confuses people who are learning about strong names. ILDASM doesn't show these things because ILDASM is a disassembler - it is supposed to produce IL that can be compiled into an assembly, and remember that the signature and hash values are output by the compiler (which would be ILASM in this case).

So there you have it. Just because you can use ILDASM doesn't mean you'll be able to access everything in an assembly. You can change the public key, but you won't be able to change the signature or the hash. By changing the public key, you'll render the signature invalid, and the assembly will fail to load.

I might note that the point (at least from Microsoft's perspective) was to not be able to substitute assemblies in a componentized environment. If you built the program with a strong named assembly system, the name, version number, culture code, and public key hash are stored in the manifest. If the runtime comes across an assembly with the same weak name but missing or incorrect strong name, it will fail to execute.

--

Last not but least for Omega red, have a look at hxxp://www.telerik.com and you will find the specific .net component target that I was working on last in which it didn't work by simply removing the publickey and recompiling.
readdict
11-04-2004, 11:19 AM
Some additional information about the use of hashes when verfying the contents of the .net files..

--

Integrity of files is guaranteed by hash verification

The runtime must be able to guarantee that the contents of the assembly have not been changed since it was built. That is, it must be able to guarantee the integrity of each assembly it runs. It does this through hash verification: the assembly manifest contains a list of all files that make up the assembly, including a hash of each file as it existed when the manifest was built. As each file is loaded at load time, its contents are hashed and compared with the hash value stored in the manifest. If the two hashes don't match, the assembly fails to load.

--

It seems that in order to bypass the hash verification one has to generate new hash value on the patched/recompliled file(s) or it would fail?
omega_red
11-04-2004, 12:09 PM
Probably the difference lies in method: messing with binary, or decompiling/changing il/recompiling.
If you decompile signed assembly, remove hashes from ilasm source and then recompile, framework has no means to determine if the original file was signed or not. Ofcourse the file can check its integrity by examining public key or something like that ;)
readdict
11-04-2004, 07:56 PM
I've tried both, patching the binary and decompiling/recompling but it makes no difference.. So I suspect that there is some kind of internal check just like you say. I've lost the motivation for this particular target for now but sometime soon I will give it another go.

Do you have any suggestions to other non windows forms .net apps to reverse? preferably one that uses .DLL files.
nikolatesla20
11-04-2004, 10:44 PM
Has anyone experience with .net assemblies which contain invalid metadata(will crash ildasm)? There are some obfuscators that insert invalid metadata to protect assemblies from being disassembled.

Here's a thread referring to an example of that.

http://www.woodmann.com/forum/showthread.php?t=6027&highlight=salamander

-nt20
The_Saint
11-05-2004, 06:35 AM
Thanks!
Did you try Xen0C0de, they modified the assembly in some way that even IDA can't load it. I don't know where is the trick atm, if a have time I will work on that and post some news here.
lifewire
11-06-2004, 07:06 AM
Interesting articles, dELTA, especially part I (part II&III are a little redundant, imho).

I was wondering if a tool like hiew already exist for .NET. You know, you can disassemble assemblies very easy, but what about helping the cracker to patch some opcodes away like we are used to do, in stead of what the guy that wrote the article is doing: re-assembling the asm into an exe file.

And if such a tool doesn't exist yet, would it be useful? I have no interesting projects to do the last days, so maybe...
zacdac
11-06-2004, 08:36 PM
@readdict

there are two general methods of patching .net assemblies(exe/dll files)
one is to decompile, modify and recompile as the articles delta pointed out,
two is by pure patching

i have previously demonstrated that due to what i believe is a bug in the .net framework you can modify the strong name key size in the clr header to 0 and trick the .net framework into thinking the assembly is not digitally signed (strong named assemblies).
yes this generally works for win forms executables and dll's

for more difficult assemblies, in particular asp.net files, patching the strong name key size alone is not sufficient. You also have to remove the strong name attribute. This involves modifying two bytes just before the RSA signature in the file. This in conjunction with the key size patch will again trick the .net framework into thinking the assembly is not digitally signed and therefore does not check the file.

failing that you could always modify the .net framework itself, always returning true for strong name verifications.

PS. patched versions radcontrols has been released :)

@the saint
generally ida will load most .net assemblies without complaining about metadata issues
however there are some obfuscators out there that wrap the .net managed code into non managed code in an attempt to stop this process.

Zac
readdict
11-07-2004, 03:36 AM
Very interesting stuff there about asp.net files, I'm gonna look into that asap.

I know about modifying the .net framework but I don't like the idea of patching it to achieve the goal.. The target itself should be properly reversed. ;)
readdict
11-07-2004, 04:05 PM
When patching the strong name key size and the two bytes just before the RSA signature in the file the dll loads fully without giving an error about the strong name.

But as soon as any function from the dll's are used I get an error msg again.

--
Assembly Load Trace:

WRN: Comparing the assembly name resulted in the mismatch: PUBLIC KEY TOKEN

Stack Trace:

FileLoadException: The located assembly's manifest definition with name 'RadDesigner' does not match the assembly reference.
--

As you can see it is the comparison of Public Key Token of the DLL files that fails..

I found this: "the public key token for the assembly is a statistically unique hashed representation of the public key"

I'm researching this and hopefully I'll find a way to either create a new hash (if possible) that matches the patched file or some other solution.

All suggestion are welcome.. I'll keep you posted when/if I get any further on this matter.
readdict
11-07-2004, 04:08 PM
btw I forgot about one thing that occured today which I haven't encountered previously.

When I try to complile the .IL file I get this errormsg:

Creating PE file
Error: No entry point declared for executable
Could not create output file, error code=0x80004005

In the PE Header of the .IL file there is a Entrypoint section with a address in it:

Native entry point address: 000234fe

So I don't understand why this happens, anyone who has encountered this before and knows what can be done about it?
dELTA
11-07-2004, 04:48 PM
This means that your IL file is missing the .entrypoint directive, either because you fucked it up somehow while editing it, of because of some other strange reason. Try to add it manually if it actually wasn't you who deleted it in the first place.

Read the articles below for more info about this and a bunch of other useful .NET IL stuff:

Demystifying Microsoft Intermediate Language:

Part 1 - Introduction:
http://www.devcity.net/net/article.aspx?alias=msil_1_intro

Part 2 - A Short Description of .NET Application:
http://www.devcity.net/net/article.aspx?alias=msil_2_dotnet

Part 3 - Debugging:
http://www.devcity.net/net/article.aspx?alias=msil_3_debug
readdict
11-07-2004, 05:52 PM
Ok, then it must be ildasm that messes up somehow with this particular file.. If i just decompile it and then compile it again it gives that error.. So it has nothing to do with my editing.

Anyways, thanks for the info Delta. Now I can try other approaches and see if I can get this working with the .entrypoint present ;)
readdict
11-07-2004, 10:26 PM
I finally solved this.

The .entrypoint thing was just a stupid misstake from my side, since this was DLL files I must use the /DLL option for ILASM when compiling. If I dont it expects the file to have the .entrypoint since it thinks that the file is a normal executable.

The Public Key Token issue is caused by any exe/dll that includes the file you have removed the strongname from (dll file). Since when they normally use your targetfile they use the Publickeytoken to verify that the file isn't tampered in any way before executing any of its functions.

So what you have to do is to locate all files that use your targetfile and decompile them, edit them and search for your targets name and you will find something like:

.assembly extern /*23000003*/ TargetName
{
.publickeytoken = (12 34 56 78 99 87 65 43 )
.ver 1:0:0:0
}

Simply delete all the contents of the extern (.publickeytoken / .ver) so that it looks like this:

.assembly extern /*23000003*/ TargetName
{
}

And then recompile the file and it will work with your strongname-less target again ;)
dELTA
11-08-2004, 05:27 AM
Nice work, thanks for the info. :yay:
The_Saint
11-09-2004, 08:09 AM
@readdict

@the saint
generally ida will load most .net assemblies without complaining about metadata issues
however there are some obfuscators out there that wrap the .net managed code into non managed code in an attempt to stop this process.

Zac
I found some invalid PropertyMap entries, I will try to fix it and hope that ida will load the fixed assembly :D
dELTA
11-17-2004, 06:09 AM
A blog about .NET debugging. Lots of advanced technical info which might not all necessarily be much useful in a hands-on perspective, but it could still be quite interesting.

http://blogs.msdn.com/jmstall/
HaRdLoCk
03-13-2005, 06:27 AM
here is a tool which can change the signature in a modified file:

http://www.atrevido.net/blog/PermaLink.aspx?guid=f772c18a-f389-4c28-bd6a-a30f4ccc84f5

works excellent :-)
KrishnaPG
03-14-2005, 05:50 AM
Dear all,

Hope you would find the article
Securing Managed Assemblies with Native Exe Interoperability (http://www.geocities.com/krishnapg/SecureAssembly.html) available at http://www.geocities.com/krishnapg/SecureAssembly.html
interesting in this regard.

Thanking you,
Yours,
P.GopalaKrishna.
pedrator
04-18-2005, 03:43 PM
Hello,

I'm trying to bypass the Strong name protecnion in one signed assembly.
I have removed the signature and recompiled the .il file and then I have loaded the assembly, but when the assembly calls one metod that has a the attribut ".permissionset linkcheck" the program fails:

Request for the permission of type System.Security.Permissions.StrongNameIdentityPermission,
mscorlib, Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.

Then I have removed the entry

.permissionset linkcheck = (3C 00 50 00 65 ....)

But then I get the error

Object reference not set to an instance of an object.

Do you Know how to bypass the StrongNameIdentityPermission?

Thanks
condzero
04-18-2005, 05:14 PM
For the simple minded, or those that are looking to do some .Net assembly (RE-configuring), read on.
If you are looking to modify strong named assemblies, or not, on your local server,
step 1. download Microsoft .NET Framework 2.0 SDK Beta from MSDN if you don't have it. For those that insist on the old stuff, you can download the 1.1 release.
step 2. decompile the assembly (run ildasm.exe). It's a good idea to create a subfolder (i.e. IL) for the output *.il, *.res, *.resources, etc.
step 3. edit/patch/whatever the *.il assembly (using notepad or similar)
At this point, better before, it's a good idea to backup the original assembly to a new name or different folder.
step 4. compile using (ilasm.exe)
example below for dll assembly:
ilasm "C:\Program Files\Some Software Folder\IL\Your_assembly.il" /resource:"C:\Program Files\Some Software Folder\IL\Your_assembly.res" /dll /output:"C:\Program Files\Some Software Folder\bin\Your_assembly.dll"
step 5. run PEVerify.exe
example below:
PEVerify "C:\Program Files\Some Software Folder\bin\Your_assembly.dll" /md /il
This will tell you a few things.
1. Is this a strong named assembly
2. Is this a managed code assembly
3. Did you F*** up the modifications in your *.il file
If a strong named assembly, then,
step 6. Delete the assembly from the GAC. On my machine it is here:
C:\WINDOWS\assembly
step 7. run sn.exe to remove the strong named assembly from the verification
process in .Net.
example below:
sn -Vr "C:\Program Files\Some Software Folder\bin\Your_assembly.dll"
This must be done on the computer/server where the bin or GAC libraries are.
step 8. goback and run step 5.
PEVerify should not complain any more about the assembly.
Move the assembly to whatever bin folder if not compiled there already, or
if using GAC, then,
step 9. Run gacutil.exe for your *.dll
example below:
gacutil /i "C:\Program Files\Some Software Folder\bin\Your_assembly.dll"

Voila!!

It's always a good idea to cleanup old .Net temp files before using the new
assembly.
On my WINXP SP1 machine running .Net framework 2.0 it would be here:
C:\WINDOWS\Microsoft.NET\Framework\v2.0.40607\Temporary ASP.NET Files.

Make sure you delete ALL occurrences of the old assembly if not using the GAC, OR make references to your NEW and improved assembly.

You should be good to go after that.

Special note: Yes, some vendors are using obfuscators to trick up decompilers, notably ILDASM. I have had some success in exposing the code using a product
from:
http://www.remotesoft.com/

RemoteSoft DotNet explorer. Excellent tool. If you have the bucks it will
do everything, but at the very least, the free version will let you look
at the assembly and it's internals.

Cheers


Debug registers and w2k3
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Debug registers and w2k3
PDA

View Full Version : Debug registers and w2k3

reverser
11-01-2004, 08:53 PM
I've been investigating a program, but I have a problem: it doesn't run under w2k3 (unexpected error). After some looking around it turns out that an exception happens in a dll. The code there is actively using Get/SetThreadContext, DR registers and some SEH. The weird thing is, the program works perfectly under 2000 so it looks like something was changed in w2k3. I tried to bypass the anti-debugging code, but I'm not very familiar with such tricks so I failed. Maybe someone knows why it works differently under w2k3?

I'll try to identify the exact place it crashes in w2k3 and post it later.
JMI
11-02-2004, 11:23 AM
Did you start your quest for knowledge by attempting to help yourself? Did you try putting "anti-debug and win2k" (without the quotes) in the Search button here? I got four hits, including one titled "In Win2K how to defeat the anti-debug trick of ASProtect?" which might have relevant information. There is also lots of information on general "anti-debug" tricks and SEH here which you can find and review by a general search using the same Search button. Using "anti-debug* and win2k" (again without the quotes and notice the "*") I got 147 hits in google

Since you report that your are "not very familiar with such tricks" you really should start with attempting to broaden your knowledge base, rather than ask someone else to solve this problem for you with a particular software. I understand you REALLY want to defeat THIS target, but simply telling you what is needed HERE doesn't actually help you very much in acquiring the skillset to do such things on your own. What you need is some patient study on the concepts used for such tricks and they you will begin to notice how they have been applied as you look at your code.

This is what "learning" is all about. The rest is just "solving" your immediate quest. Think about the difference.

Regards,
reverser
11-02-2004, 12:24 PM
Well I don't really need to "defeat" it, I just want to make it run on w2k3. I did do some search on google, but didn't find anything on differences between 2k and 2k3. I just thought maybe someone here had encountered the same problem, so I can fix it and actually use the program. While "defeating" it might be useful, it's not really what I need right now. And BTW it's not ASProtect or some other packer, the dll is not packed or crypted, just obfuscated in some places. It looks like the protection is custom-made.
Sorry if I sounded arrogant, but I did spent some time researching before posting here.

Now I'll post some snippets from the program along with my findings.

.text:100352A6 push 540h ; size_t
.text:100352AD push offset AntiDebug3 ; void *
;[calculate a random (but valid) pointer in eax]
.text:100352FB push eax ; void *
.text:100352FC mov [esp+5B8h+Context2.Dr3], eax
.text:10035303 call ds:memmove ;copy AntiDebug3 function
.text:10035309 mov eax, [esp+5B8h+Context2.Dr3]
.text:10035310 mov esi, ds:SetThreadContext
.text:10035316 xor eax, 7FFFFFFFh
.text:1003531B add esp, 0Ch
.text:1003531E mov [esp+5ACh+Context2.Dr3], eax //save new address xored with 7FFFFFFF
.text:10035325 lea eax, [esp+5ACh+Context2]
.text:1003532C push eax ; lpContext
.text:1003532D push 0FFFFFFFEh ; hThread
.text:1003532F mov [esp+5B4h+Context2.Dr7], 11110455h
.text:1003533A call esi ; SetThreadContext
.text:1003533C lea ecx, [esp+5ACh+Context2]
.text:10035343 mov edi, 11110400h
.text:10035348 push ecx ; lpContext
.text:10035349 push 0FFFFFFFEh ; hThread
.text:1003534B mov [esp+5B4h+Context2.Dr7], edi
.text:10035352 call esi ; SetThreadContext
.text:10035354 lea edx, [esp+5ACh+Context]
.text:10035358 mov [esp+5ACh+Context.ContextFlags], ebp
.text:1003535C push edx ; lpContext
.text:1003535D push 0FFFFFFFEh ; hThread
.text:1003535F call ebx ; GetThreadContext
.text:10035361 xor eax, eax
.text:10035363 mov [esp+5ACh+Context.Dr1], 1
.text:1003536B mov [esp+5ACh+Context.Dr0], eax
.text:1003536F mov [esp+5ACh+Context.Dr2], eax
.text:10035373 lea eax, [esp+5ACh+Context]
.text:10035377 mov [esp+5ACh+Context.Dr7], 11110455h
.text:1003537F push eax ; lpContext
.text:10035380 push 0FFFFFFFEh ; hThread
.text:10035382 call esi ; SetThreadContext
.text:10035384 lea ecx, [esp+5ACh+Context]
.text:10035388 mov [esp+5ACh+Context.Dr7], edi
.text:1003538C push ecx ; lpContext
.text:1003538D push 0FFFFFFFEh ; hThread
.text:1003538F call esi ; SetThreadContext
.text:10035391 mov edx, [esp+5ACh+Context.Dr3] //get back the address of the copy of AntiDebug3
.text:10035395 push offset AntiDebug5
.text:1003539A xor edx, 7FFFFFFFh //xor it back
.text:100353A0 call edx //call it, param 1 = address of next function to copy&call
.text:100353A2 add esp, 4

This one is pretty straightforward, it copies the function to a new address, then calls it using DR3 for extra protection. There is about 20 such functions, copying and calling each other in chain, and they set slightly different values in dr0-dr2. First I though that maybe 2k3 doesn't like invalid pointer in dr3 (because of xor with 7FFFFFFF), so I patched them all xors to be like "xor edx, 0". This didn't help. Next I made a hook dll, which hooked Get/SetThreadContext and just kept the DR values in memory, instead of setting real values. It still crashed. So I thought before trying to unwind it all by hand, to try and ask a question here.
doug
11-02-2004, 02:46 PM
- What kind of exception are you getting.
- Where does the exception occur & what code is there
- What are the appropriate register values there.
JMI
11-02-2004, 05:03 PM
reverser:

You didn't sound arrogant, you simply ignored one of the Rules, which is, if you have already searched for the answer for issue, you should say so. Then no one needs remind you of the need to search first.

But it is clear that you did not understand the import of my comments. I did not referrer you to articles about ASPR because I believed you were dealing with ASPR, but because these articles, and others I referred you to deal with anti-debug code and Win2k. You stated "the code there is actively using Get/SetThreadContext, DR registers and some SEH." These are not only somewhat common issues for "anti-debug" defense, but are much discussed here and elsewhere.

You do, however demonistrate the other point I was making. You actually are more interested in making THIS piece of software work for you (i.e., "defeating" it) than you actually are in attempting to learn about the general subject of antidebugging, SEH and so forth. That's OK. It simply doesn't hold much prospect of advancing your knowledge base for next time and is a product of the general impatience of youth. As long as you abide by the Rules, you are entitled to proceed anyway you wish. I was attempting only to steer you towards a path of higher learning. The choice was always yours.

Regards,
seapagan
11-03-2004, 01:24 AM
Y'know,

I doesent actually seem to me that he wants to 'defeat' the application - just to get it running on windows 2003, and asking if there were any major SEH related changes under 2003 as opposed to 2000. All the search tips JCM listed point to 2k - which he already said works fine. The rationale of checking aspr info etc is however very valid, lots of examples on understanding and bypassing SEH.
Checking google however, there is an interesting article by Matt Pietrek on MSDN Magazine about new exception handling in W2k3 (Vectored exception handling) which is supposed to co-exist with SEH - but i'm sure that it is possible the complicated SEH tricks used in protection may cause conflicts .... however, i believe that VEH is supported on XP also - does the prog crash on XP? There seems to have been a lot of changes to the debugging api's also in 2k3.
Basically, 2k3 has quite a few changes in the low level area and screws quite a few programs I have tried. I Stopped using it as a server and went back to 2k myself, and would not really consider using it as a workstation.
One other option is checking the website of whatever the program is - you are probably not the first to try to run it under 2k3, and there may be a patch or work-around avaliable there. This is assuming ofcourse that it crashes when run from explorer and not only under a debugger .... ;)

As for the general impatience of youth not sure where this came from? He seems to have done his searching / homework, and he may be older than all of us! :D

just my 0.02 euro's, and first post after a long lurk :cool:

SP
reverser
11-03-2004, 08:55 PM
Sorry for the late reply, been kinda busy.
Now for some answers.

- What kind of exception are you getting.
- Where does the exception occur & what code is there
- What are the appropriate register values there.

I'm getting an AV, trying to execute code at 7FFFFFFFh. It's not really clear where it happens as the stack is pretty much screwed up, and also lots of program code is copied into allocated buffers before execution, so you don't know anymore which function it comes from. I suspect it comes from the code like this, which is present in plenty:

mov edx, [esp+5ACh+Context.Dr3] //get the address of the copied function
push offset AntiDebug5 //next function to copy&execute
xor edx, 7FFFFFFFh //xor address back
call edx //call it
add esp, 4

If the value of DR3 is 0, then we get an exception.

I had some progress on the program. I was able to run it by patching it so it doesn't call the anti-debugging code (I tried that before but skipped too much). While it seems to work, there are some strange errors, so maybe I will need to "break" the code after all, but for now I have a working program.
I will, however, post some snippets that use SEH, it might be interesting for someone.

AntiDebug3_1 proc near

pRegist = dword ptr -1Ch
save_esp = dword ptr -18h
pExceptionPointers= dword ptr -14h
prevreg = dword ptr -10h
handler = dword ptr -0Ch
scopetable = dword ptr -8
_trylevel = dword ptr -4
_ebp = dword ptr 0
retaddr = dword ptr 4
dst = dword ptr 8
src = dword ptr 0Ch
count = dword ptr 10h

push ebp
mov ebp, esp
push 0FFFFFFFFh
push offset Antidebug3_scopetable
push offset _except_handler3
mov eax, large fs:0
push eax
mov large fs:0, esp
sub esp, 0Ch
push ebx
push esi
push edi
mov [ebp+save_esp], esp

;[...]
;do some work
;[...]

mov [ebp+_trylevel], 0
mov eax, large fs:0
mov [ebp+pRegist], eax
mov eax, [ebp+pRegist]
mov dword ptr [eax+4], offset return_seh
pushfw
pop eax
or eax, 100h ;set trace flag -> call return_seh
push eax
popfw
jmp short @@handled_by_debugger
; ﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄ

Antidebug3_filter:
mov eax, 1
retn
; ﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄﾄ

Antidebug3_handler:
mov esp, [ebp+save_esp]

@@handled_by_debugger:
mov [ebp+_trylevel], 0FFFFFFFFh
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
mov ecx, [ebp+prevreg]
mov large fs:0, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
retn
AntiDebug3_1 endp

The function sets up its own SEH handler, and tries to invoke it by setting the single step flag. If it's being debugged, then (I guess) the exception gets ignored and excecution continues "normally". I can't see it doing anything nasty to the debugger, unless it can't handle such stuff.

The handler looks like this:

return_seh proc near

pContext = dword ptr 0Ch

mov eax, [esp+pContext]
push ebx
mov ecx, [eax+CONTEXT.Esp]
mov edx, [ecx]
add ecx, 4
mov [eax+CONTEXT.Edi], edx ; pop edi
mov edx, [ecx]
mov [eax+CONTEXT.Esi], edx ; pop esi
mov ecx, [ecx+4]
mov [eax+CONTEXT.Ebx], ecx ; pop ebx
mov ecx, [eax+CONTEXT.Ebp]
mov edx, [ecx]
add ecx, 4
mov [eax+CONTEXT.Ebp], edx ; ebp = [ebp+0] = saved ebp
mov edx, [ecx]
add ecx, 4
mov [eax+CONTEXT.Eip], edx ; eip = [ebp+4] = retaddr
mov [eax+CONTEXT.Esp], ecx ; esp = ebp+8, basically effect of mov esp, ebp; pop ebp; retn
mov [eax+CONTEXT.Dr7], 400h
push eax
push ebx
mov eax, large fs:0
mov ebx, [eax] ;restore SEH handler
mov ebx, [ebx]
mov [eax], ebx
pop ebx
pop eax
xor eax, eax
pop ebx
retn
return_seh endp

So basically it does what the epilogue code should do, and sets up context to return to the caller.
There is another handler used in a bunch of other places that does about the same, only returns to DR2, not return address in the stack:

ret_to_dr2 proc near

pContext = dword ptr 18h

push ebx
push eax
push ebx
mov eax, large fs:0
mov ebx, [eax]
mov ebx, [ebx]
mov [eax], ebx
pop ebx
pop eax
mov eax, [esp-8+pContext]
pop ebx
mov ecx, [eax+CONTEXT.Esp]
mov edx, [ecx]
add ecx, 4
mov [eax+CONTEXT.Edi], edx ; pop edi
mov edx, [ecx]
mov [eax+CONTEXT.Esi], edx ; pop esi
mov ecx, [ecx+4]
mov [eax+CONTEXT.Ebx], ecx ; pop ebx
mov ecx, [eax+CONTEXT.Ebp]
mov edx, [ecx]
add ecx, 8
mov [eax+CONTEXT.Esp], ecx ; esp = ebp+8 (move esp, ebp; pop ebp; retn)
mov ecx, [eax+CONTEXT.Dr2]
xor ecx, 7FFFFFFFh
mov [eax+CONTEXT.Ebp], edx ; ebp = [ebp+0] = saved ebp
mov [eax+CONTEXT.Dr7], 400h
mov [eax+CONTEXT.Eip], ecx ; eip = dr2 ^ 0x7ffffff
xor eax, eax
retn
ret_to_dr2 endp

The rest is pretty much moving code back and forth with little pieces of real work done in between. It's quite a pain to read, and I've achieved my goal for now, so I'm putting it aside.
Thanks for reading and sorry for wasting your time.


Changes in policy related to patching kernel for MS Windows Server 2003 SP1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Changes in policy related to patching kernel for MS Windows Server 2003 SP1
PDA

View Full Version : Changes in policy related to patching kernel for MS Windows Server 2003 SP1

disavowed
11-01-2004, 11:37 PM
http://www.microsoft.com/whdc/driver/kernel/64bitpatching.mspx
bilbo
11-02-2004, 01:33 AM
Many system structures are protected on x64-based systems, including the system service dispatch tables, the interrupt descriptor table (IDT), and the global descriptor table (GDT).
Wow, nobody has succeeded in this task up to now. Maybe M$ will teach us something interesting?
Regards, bilbo
disavowed
11-04-2004, 10:24 AM
Discussion on Matt Pietrek's blog: http://blogs.msdn.com/matt_pietrek/archive/2004/10/21/245750.aspx
sHice
11-04-2004, 02:21 PM
did i get this right that only "authorized Microsoft-originated hot patches" will be allowed to modify things like the idt ? what would be the point of this? if hot patches can get the rights to modify e.g. the idt what prevents a normal driver to get these rights ?
omega_red
11-04-2004, 02:30 PM
The system will probably check IDT periodically or via some data-write-breakpoint (?).
reverser
11-04-2004, 02:30 PM
did i get this right that only "authorized Microsoft-originated hot patches" will be allowed to modify things like the idt ? what would be the point of this? if hot patches can get the rights to modify e.g. the idt what prevents a normal driver to get these rights ?
Digital signing?
dELTA
11-04-2004, 06:06 PM
Digital signing will of course most likely be in the "first layer of protection", but we are talking lower levels here. Just like with any protection, the signature check has to be done somewhere, and we can patch it away. Depending on exactly how messy and super-entangled this protection will be, I can't see why e.g. the Softice guys (or rootkit makers) couldn't just patch it and then modify whatever system table they want. Sadly, I think that the only people who will suffer here are the makers and users of all the nice smaller scale analysis tools and other useful ring 0 hacks. :(
disavowed
11-05-2004, 01:18 AM
Digital signing will of course most likely be in the "first layer of protection", but we are talking lower levels here. Just like with any protection, the signature check has to be done somewhere, and we can patch it away. Depending on exactly how messy and super-entangled this protection will be, I can't see why e.g. the Softice guys (or rootkit makers) couldn't just patch it and then modify whatever system table they want.
i totally agree. only problem is that then driverstudio's softice etc. drivers can't be microsoft certified, if i understand this all correctly


ASPACK problems with DLL (relocations?)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPACK problems with DLL (relocations?)
PDA

View Full Version : ASPACK problems with DLL (relocations?)

friedo
11-02-2004, 03:19 AM
Hi.

Searched already the board but find no solution for my problem. I think it might have to do with some relocations. I unpacked dll (use aspackdie because it´s faster/but it´s an "unknown algorithm 3"-for aspack 2.12b as PEid said.) but if i load dll with loadlibrary it has another base than loading with ollydbg!

Example Olly:
01A71000 | |EB 10 jmp short 01A71012
01A71002 | |66 db 66 ; CHAR 'f'
01A71003 | |62 db 62 ; CHAR 'b'
01A71004 | |3A db 3A ; CHAR ':'
01A71005 | |43 db 43 ; CHAR 'C'
01A71006 | |2B db 2B ; CHAR '+'
01A71007 | |2B db 2B ; CHAR '+'
01A71008 | |48 db 48 ; CHAR 'H'
01A71009 | |4F db 4F ; CHAR 'O'
01A7100A | |4F db 4F ; CHAR 'O'
01A7100B | |4B db 4B ; CHAR 'K'
01A7100C | |90 nop
01A7100D | |E9 db E9
01A71012 |> \A1 F3A3AF01 mov eax, [dword ds:1AFA3F3]
01A71017 |. C1E0 02 shl eax, 2
01A7101A |. A3 F7A3AF01 mov [dword ds:1AFA3F7], eax
01A7101F |. 8B4424 08 mov eax, [dword ss:esp+8]
01A71023 |. A3 65A4AF01 mov [dword ds:1AFA465], eax
01A71028 |. FF1485 55A4AF>call near [dword ds:eax*4+1AFA455]
01A7102F |. 833D 65A4AF01>cmp [dword ds:1AFA465], 1
01A71036 |. 75 5E jnz short flash001.01A71096
01A71038 |. 803D FFA3AF01>cmp [byte ds:1AFA3FF], 0

This works because for example at 1A71012 mov eax is pointing to memory which is available! (non shared dll memory at 1afa3f7)

But if i load with LoadLibrary it looks like this:
01F91000 > /EB 10 jmp short 01F91012
01F91002 |66:623A bound di, [word ds:edx]
01F91005 |43 inc ebx
01F91006 |2B2B sub ebp, [dword ds:ebx]
01F91008 |48 dec eax
01F91009 |4F dec edi
01F9100A |4F dec edi
01F9100B |4B dec ebx
01F9100C |90 nop
01F9100D -|E9 6CA4AF01 jmp 03A8B47E
01F91012 \A1 F3A3AF01 mov eax, [dword ds:1AFA3F3]
01F91017 C1E0 02 shl eax, 2
01F9101A A3 F7A3AF01 mov [dword ds:1AFA3F7], eax
01F9101F 8B4424 08 mov eax, [dword ss:esp+8]
01F91023 A3 65A4AF01 mov [dword ds:1AFA465], eax
01F91028 FF1485 55A4AF01 call near [dword ds:eax*4+1AFA455]
01F9102F 833D 65A4AF01 0>cmp [dword ds:1AFA465], 1

So the Base is changed from 1A10000 to 1F90000 but the mov eax is still pointing to 1afa3f3. ?!

I just thought a dll is like an exe, so i should not bother with relocations but i think i am wrong? anyway, dumping the file with petools and copying the reloc section changes nothing at this point.

i am at the end of my knowledge.. may be somebody can explain this to me and how to solve this?!
(Btw. it´s on a Windows XP system, i did not test under other os)

regards,
friedo
evlncrn8
11-02-2004, 03:38 AM
yep dlls need relocation data, chances are when the protection was applied the reloc information was destroyed and the protection handles it all runtime.. u got no choice really but to try and get 2 dumps of the dll loaded at a diff base, then compare, and rebuild some form of relocation information from that.. should work then
friedo
11-02-2004, 04:06 AM
Okay. So i was on the right way. I used a simple Ollyscript for ASPACK to determine the real relocation table, patched the whole .reloc section and adapt the relocation table in pe header (that´s what i missed last time and why it doesn´t work.)

Such a changed DLL works at different Imagebases!

Thx so far.

p.s.:
I thought aspackdie would adapt this reloctable automatically... tztztz
Anyway, i got big problems to dump such a unpacked dll with ollydbg oder petools because everytime i do it and adapt the import table with imprec i got an error that´s not a "win32-executable-file". because don´t know how to solve i let aspackdie do the workfor me and changes some things manually...

May be there´s a tutorial out there which explains why my dumped file is not a win32 executable?
[NtSC]
11-02-2004, 10:10 AM
That could be a problem due to wrong sizes for sections (virtualsize), and sizeofimage. simply try to use pe-editor / rebuild pe-header fro 2k/nt and check if rebuilded exe works... if so,could some small subroutine that aligns ur files vsizes + sizeofimage..voila :)


Physical to virtual address translation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Physical to virtual address translation
PDA

View Full Version : Physical to virtual address translation

SynApsus
11-02-2004, 06:12 PM
Hello, I'm back with my annoying questions !
( thanks for all your answers about Low-level Graphics Programming )
As usual, my question is about Ring0.
I'm coding a driver and I need, to access I/O APIC tables, to translate the PHYSICAL address of this table ( mapped in physical memory at 0xFEC00000 )
into a VIRTUAL or LINEAR one ( 0008:xxxxxxxx ) which I could use to access my values.
On my computer, this address is mapped to 0008:0FFD06000h , but it is NOT the same for all computers. Note that there are LOTS of ways of translating a virtual address into a physical one ( ntoskrnl undocumented functions, examples around the web, sysinternals, cr3 register and PTE/PDE paging, and so on )
But I never found a method to retrieve the virtual from a physical. SoftICE does it with the PHYS command ( which returns, from time by time, more than one virtual addresses for the same physical one ) but due to the extreme poverty of this command's output, I had not been able to locate it in my sice's IDB. And the other sice's command I analysed, which translate the FEC00000h to a virtual address ( there are, you can find them by -deeply -analysing the intobj and irq commands in ntice.sys )
There is a ntoskrnl ( undoc ) function too ( MmGetVirtualForPhysical ), but if she sometimes returns the good values ( the Cr3 value for example ) with FEC00000 it returns just shit. And I did not understand this function too, even with the leaked source code of my favourite OS.
If someone could help me ?
Kayaker
11-03-2004, 12:53 AM
Hi SynApsus,

Hey, this isn't an annoying question... Crack requests, those are annoying.
You seem to indicate MmGetVirtualForPhysical sort of works but doesn't work? The PHYSICAL_ADDRESS value is 64 bit, which you can see from ntoskrnl.

From ntddk.h:

NTKERNELAPI
PVOID
MmGetVirtualForPhysical (
IN PHYSICAL_ADDRESS PhysicalAddress
);

In ntoskrnl, there are 2 dwords pushed to call the function, which indeed returns with a retn 8.

mov eax, cr3
mov [ebp-10h], eax
xor eax, eax
xor edi, edi
push eax
push dword ptr [ebp-10h] ; PhysicalAddress
call MmGetVirtualForPhysical

Perhaps the problem you have in address translation is related to the problem discussed here in relation to MmHighestPhysicalPage?

Playing with Windows /dev/(k)mem
http://www.phrack.org/show.php?p=59&a=16

Kayaker
SynApsus
11-03-2004, 08:39 AM
Yes I saw this in my ntoskrnl code analysis. Of course I pushed a 64 bit value !
Ah, note that the MmGetVirtualForPhysical function does destroy some of the values on the stack, that's why I use it after some stack saving ( 3 lame push 00 for example )
And for the article of CrazyLord, I read it some months ago, as I wasn't interested by the physical memory problem. I just read it one more time, but there is nothing interesting... He wants, as usual, to translate virtual into physical address. His MmHighestPhysicalPage problem isn't very useful to me, because this value is 77ef0000.... a page is 4096 bytes long, and I'm far from it with my FEC00000 ! Nope, I want to know if there is a better method, because I'm scared this is not a very good solution.
Kayaker
11-03-2004, 01:47 PM
What I was wondering by the reply, is there any physical address where the high part of that quad word is anything but 0? You have a physical address apparently higher than MmHighestPhysicalPage. Would this be for example a correct declaration for it or not for MmGetVirtualForPhysical?

typedef LARGE_INTEGER PHYSICAL_ADDRESS;

PhysicalAddress.LowPart = (ULONG) 0xFEC00000;
PhysicalAddress.HighPart = (LONG) 0x00000000;
Neitsa
11-03-2004, 07:43 PM
Hello,

Synapsus, I don't know how to help you exactly (I mean I can't provide you more information than you have) but if you haven't done it already you may take a look at "Undocumented windows 2000" chap 4, where there is an explanation of Linear to Physical translation (with some source code if I remember correctly).

There's also very helpfull informations in "Inside Win 2k" chap 7 => Address translation.

Sorry if I couldn't help you more than that...

Regards, Neitsa.
Kayaker
11-03-2004, 08:55 PM
That's excellent Neitsa. The Schrieber book indicates what the high part of PHYSICAL_ADDRESS might be used for in the explanation of MmGetPhysicalAddress.
"On most i386 systems, the upper 32 bits will be always zero. However, on systems with Physical Address Extension (PAE) enabled and more than 4 GB of memory installed, these bits can assume nonzero values"

And Inside Windows explains PAE
"..there is a special version of the core kernel image (Ntoskrnl.exe) with support for PAE called Ntkrnlpa.exe. (The multiprocessor version is called Ntkrpamp.exe.) To select this PAE-enabled kernel, you must boot with the /PAE switch in Boot.ini."

Assuming no PAE or other reason for how MmGetVirtualForPhysical should be called, Synapsus may have found a limitation of the function.
crUsAdEr
11-03-2004, 09:36 PM
Kayaker... u forgot to tell him about the Command table in sice so he can locate the Phys code in 2 second :)
Kayaker
11-03-2004, 09:43 PM
Hi Crusader, yeah I did. I was waiting for you to provide your idc script for parsing the NamesIndex and CommandIndex to make it automatic :D
SynApsus
11-05-2004, 04:41 AM
Hmmm... my processor is non-PAE. I have already read this book ( Undeocumendted Win2k ) and I found nothing interesting, only this fucking Linear to Physical translation ! Lol I know it by heart now, but it doesn't help me much ! :(
And of course Kayaker, I tried MmGetVirtualForPhysical with different values for the HighPart of my PHYSICAL_ADDRESS ( 008, 0000, and other descriptors ). Doesn't work.
If you have another idea... because I have tested A LOT of different techniques before posting, and in first the ones you said. Forget MmGetVirtualForPhysical, but if someone could explain me it's source code...
I could perhaps write my own function. Have only the NuMega developers found the answer to this translation problem ? I think not, this should be done by any of us. :sneaky:
And about this command table... I'm VERY interested, although analysing SoftIce is... a lot much difficult than ntoskrnl.exe ! ( not debuggable ) But I'll have to break my ( lame ) limits !

Thanks, if you have another idea...
Opcode
11-05-2004, 07:36 AM
Try to do some research about the MmPfnDatabase.
Maybe it helps you :yay:

Regards,
Opc0de
SynApsus
11-07-2004, 05:25 AM
That's exactly what I have done, because I found your answer very interesting OpCode. But the result of my research is that the MmPfnDatabase structure IS the one used in the function MmGetVirtualForPhysical. Doesn't work !
Here is the display in my IDA for this :
MmGetVirtualForPhysical proc near

PhysicalAddress = PHYSICAL_ADDRESS ptr 4
mov edx, dword ptr [esp+PhysicalAddress+4]
push esi
mov esi, dword ptr [esp+4+PhysicalAddress]
push 0Ch
pop ecx
mov eax, esi
call _allshr
mov ecx, VirtualAddress ; PfdBase = MmPfnDatabase
lea eax, [eax+eax*2] ; multiplies eax by 3, we can access
; to his entry inside of the Pfn table
; ( PfnEntry is 24 bytes in size )
; with an [ecx+eax*8]
and esi, 0FFFh ; esi = PhysicalAddress.LowPart
mov eax, [ecx+eax*8+4]
; mov eax, MiGetVirtualAddressMappedByPte(Pfn->PteAddress)
; where MiGetVirtualAddressMappedByPte = VirtualAddress ( = PfdBase )
; ( info from the leaked windows sources )
; In fact :
; - we find the entry corresponding to the physical addr in the
; page frame directory ( pfd ) ( and eax=pfn, the page frame number )
; - and we get the member *pteEntry . ( PteAddress )
;
; typedef struct PfdEntry {
; DWORD NextPage,
; void *PteEntry/*PpteEntry,
; DWORD PrevPage,
; DWORD PteReferenceCount,
; void *OriginalPte,
; DWORD Flags;
; } PfdEntry_t;
;
shl eax, 0Ah ; then multiplies it by 2^10 ?! dunno why
add eax, esi ; and add the low part ( offset )
pop esi
retn 8
MmGetVirtualForPhysical endp

It seems that the MmPfnDatabase is a too little table in order to translate this addresses, and is only used for very specific pages ( the pfd itself, that's why cr3 value works ) and the swapped pages.
But perhaps I am wrong... Another idea ?
Kayaker
11-07-2004, 10:12 PM
For what it's worth, I encountered the same problems with MmGetVirtualForPhysical as you SynApsus. Perhaps it is time to look towards the Softice PHYS command for answers. To save describing the procedure yet again I wrote up a little summary here

Setting up IDA for analysing Softice functions
http://66.98.132.48/forum/showthread.php?p=41319#post41319

Cheers,
Kayaker
bilbo
11-09-2004, 02:23 AM
Perhaps it is time to look towards the Softice PHYS command for answers

Well, the algorithm used by Softice is rather intuitive. It scans all the PTEs related to the current 4GB virtual space, starting from the current Page Directory pointer (CR3 register). For every PTE, it compares the physical address associated to it with the physical address we want to map. As soon as we find a match between the two physical addresses, we have found a new virtual address translating the physical one.
In the case that all PTEs are 4K sized, the number of scanned PTE will be 1024 (PDE entries) * 1024 (PTEs per PDE): about one million!
Let's see the code in detail (DS 3.1):

;
; phys2virt(EAX=address, ESI=callback)
; callback is called with: EDX=passed context, EAX=translated virtual,
; and can be called more than once
;
byte_1806B db 0 ; global parameter: stop_at_first_translation
sub_1806C proc near

var_4 = dword ptr -4

pusha
mov ebp, esp

sub esp, 4
and eax, 0FFFh ; offset in page
mov [ebp+var_4], eax ; initialize translated virtual

; save_bios_pte_contents()
; see below
call sub_181FD

mov eax, [ebp+1Ch] ; saved EAX after PUSHA: physical address
and eax, 0FFFFF000h ; start of page
mov edx, eax ; physical address to search

; EDI <- virtual address of Page Directory
mov eax, cr3 ; physical address of Page Directory
mov edi, eax
add edi, dword_E15FF ; mapped_zero_phys (see below)

mov dword_115A06, 0 ; cached_selector_start
mov dword_115A02, 0FFFFFFFFh ; cached_selector_end

mov ecx, 400h ; number of PDE's in Page Directory

; outer loop: a loop per PDE
loc_180AD:
; EDI = physptr_to_PDE + mapped_zero_phys
; peekphyslong(EDI=phys+mapped_zero_phys)
call sub_18286
jb loc_18168 ; break if ko

or eax, eax
jz loc_18157 ; null PDE: continue

test eax, 1
jz loc_18157 ; not present PDE: continue

test eax, 80h ; page directory size
jz short loc_18103

; page directory size is 4M: mask page base address
; (physical address of the first byte of a 4K page)
and eax, 0FFC00000h
cmp edx, eax ; CMP passed physical
jb short loc_18157 ; continue if passed physical is lower

add eax, 400000h ; end of 4M page
cmp edx, eax ; CMP passed physical
jnb short loc_18157 ; continue if passed physical is bigger

; found one virtual
sub eax, 400000h ; go back to start of 4M page
; EAX = bias_in_page = passed physical - physical start of page
sub eax, edx
neg eax

; EAX = current translated virtual + bias_in_page
add eax, [ebp+var_4]

push edx
mov edx, [ebp+14h] ; restore saved EDX
call [ebp+4h] ; saved ESI after PUSHA: callback
pop edx

; see if we must continue or break
cmp ds:byte_1806B, 1 ; global parameter: stop_at_first_translation
jz short loc_18168 ; break
jmp short loc_18157 ; continue

; page directory size is 4K
loc_18103:
; mask PTE lower bits
and eax, 0FFFFF000h
add eax, dword_E15FF ; mapped_zero_phys

push ecx
push edi
mov edi, eax

mov ecx, 400h ; number of PTE's
xor esi, esi ; init bias to add to translated virtual (4K per PTE)
; inner loop
loc_18119:
; peekphyslong(EDI=phys+mapped_zero_phys)
call sub_18286
jb short loc_1814A ; continue inner loop if ko

test eax, 1 ; present bit
jz short loc_1814A ; continue inner loop if PTE not present

and eax, 0FFFFF000h ; physical address of first byte in 4K page
cmp eax, edx ; CMP passed physical
jnz short loc_1814A ; continue inner loop

; matching found
mov eax, [ebp+var_4] ; update translated virtual
; add bias to base translated virtual
or eax, esi

push edx
mov edx, [ebp+14h] ; restore saved EDX
call [ebp+4h] ; saved ESI: callback
pop edx

cmp ds:byte_1806B, 0 ; global parameter: stop_at_first_translation
jz short loc_1814A ; continue inner loop
; done with inner loop
pop edi
pop ecx
jmp short loc_18168 ; break from outer loop

; continue inner loop
loc_1814A:
add esi, 1000h ; 4K more to base translated virtual
add edi, 4 ; update physical PTE pointer
loop loc_18119 ; decrement ECX (number of PTEs)
; done with inner loop
pop edi
pop ecx

loc_18157: ; continue to next PDE (outer loop)
add [ebp+var_4], 400000h ; update translated virtual (+= 4M)
add edi, 4 ; update physptr to PDE
dec ecx ; update remaining PDEs
jnz loc_180AD ; continue

; done with outer loop
loc_18168:
; restore_bios_pte_contents()
call sub_18217
mov esp, ebp
popa ; matches initial PUSHA
retn
sub_1806C endp ; sp = 20h

Some explanations are required regarding mapped_zero_phys and save_bios_pte_contents(), before analyzing the tricky subroutine peekphyslong(), which will map a physical address (the current PTE pointer) to a virtual one, in order to read it.

At init time a MmMapIoSpace(0, 0, 0x100000, 0) is executed (the first two zeros are the physical address to map), and the return value, a virtual address, is saved in mapped_zero_phys: this is the start address of a virtual range mapping the physical range 0-100000. Furthermore, a particular PTE is located which initially maps the BIOS space (F0000-100000): its virtual address is mapped_zero_phys+0xF0000; we'll call it mapped_bios. Its virtual PTE pointer is calculated:
C0000000 (start of consecutive PTEs) + (mapped_bios/4K) * 4 bytesperPTE; we'll call it pBIOS_PTE.
Now we can understand how peekphyslong() works. We have a physical address; we build a new PTE with it; we replace this PTE into pBIOS_PTE; we can now read the 4K page at virtual address mapped_bios. Before and after this operation we issue save_bios_pte_contents() and restore_bios_pte_contents().
Let's see the code:

;
; peekphyslong(EDI=phys+mapped_zero_phys)
;
sub_18286 proc near
push ebx
push edi
; subtract back mapped_zero_phys
sub edi, dword_E15FF
mov ebx, offset sub_6D3E3 ; callback: fastpeeklong(EDI=address)
; map_phys_to_virt_and_do_callback(
; EDI=physaddr, EBX=callback)
call sub_18231
pop edi
pop ebx
retn
sub_18286 endp

;
; map_phys_to_virt_and_do_callback(EDI=physaddr, EBX=callback)
; callback is called with mappedvirt in EDI
;
sub_18231 proc near
push ecx
push edx
push edi
mov ecx, edi ; physaddr

mov edi, dword_D9EB1 ; pBIOS_PTE (it holds F017B: phys F0000)
or edi, edi
jnz short loc_18248

; pBIOS_PTE null: simply add mapped_zero_phys and call callback
; never follow this way!
add ecx, dword_E15FF ; mapped_zero_phys
jmp short loc_1827E ; call callback(EDI<-ECX mappedvirt)

loc_18248:
; pBIOS_PTE not null:
; build 4K PTE
mov edx, ecx
and edx, 0FFFFF000h ; physaddr, start of page
or dl, 7 ; set low pte bits: userpriv|readwrite|present
cmp dword_E4CE4, edx ; saved_bios_pte
jz short loc_18272 ; jump if we have already set it

; set built PTE in pBIOS_PTE
push eax
; pokelong_(EDI=addr, EAX=value) must return !CY
mov eax, edx
call sub_6D5B4
pop eax
jb short loc_18282 ; return if ko

mov dword_E4CE4, edx ; update saved_bios_pte

; flush cache
mov edx, cr3
mov cr3, edx

; passed physaddr: add page offset
loc_18272:
and ecx, 0FFFh
add ecx, dword_D9EB5 ; add mapped_bios to convert to virtual

; call callback(EDI<-ECX)
loc_1827E:
mov edi, ecx
call ebx

; return
loc_18282:
pop edi
pop edx
pop ecx
retn
sub_18231 endp

I hope someone could follow this (rather obfuscated) explanation. Sorry, mates, but I couldn't find easier words.

Best regards, bilbo
SynApsus
11-09-2004, 05:25 AM
Aha ! Thanks Bilbo !
Yes that is the code I found for the PHYS command, by analysing the IRQ command and the init of ntice. But I was not sure it was this function, and I had not been able to analyse it...
Thanks for this great piece of knowledge, I'll use it, write a tut and a proggie with many thanks !

Regards and respect, Syn
Opcode
11-09-2004, 05:28 AM
Very useful information!

Thnx bilbo! :cool:

SynApsus:
Continue to make more "annoying questions" !!! :D

Regards,
Opcode
SynApsus
11-13-2004, 04:45 PM
Just a last question, for Bilbo : in what way are the Save_Bios_Pte_Content and Restore_bios_Pte_Contents calls useful ?
Or can I build my proc without them ?
Because as I was trying to rip the code from ntice to my prog, there was no problem with translating the main peekphyslong code and around, but for Save_Bios_Pte_Content it's nearly impossible : really a LOT of constants and values used, and it would take entire days.
bilbo
11-15-2004, 02:45 AM
AFAIK, the routines I called Save_Bios_Pte_Contents and Restore_Bios_Pte_Contents are not necessary.
I understand them as a sort of cache for the last mapped address: simply to avoid consecutive mappings for the same memory page.
Regards, bilbo
SynApsus
11-20-2004, 07:06 PM
Hmm, I try I try... but I don't seem to be able to fix my problem using this; it's too complex for the time I can spend on my computer nowadays ( very hard @ school ).
I'll see it later... thanks anyway.
bilbo
11-23-2004, 01:35 AM
Hmm, I try I try... but I don't seem to be able to fix my problem using this
By the way, what is your problem? Have you some code to share?
Best wishes for you school results. bilbo


general unpacker for almost all win32 exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > general unpacker for almost all win32 exe
PDA

View Full Version : general unpacker for almost all win32 exe

adrenal
11-03-2004, 03:30 AM
This is the source code of a general unpacker for almost all win32 exe
To download source code go to tinyurl.com/3u9xw
It is open source and the source code is included
The included binaries are packed themselves what reduces performance
Need to update for new versions of packers
Can you compile g u w . e x e from the included source code?
Tried everything to compile but I have only the visualbasic compiler and know how to work with only that compiler
Thanks
disavowed
11-03-2004, 10:37 AM
if it does what you say it can do, why not unpack the .exe with the program itself?

just some advice... any "generic unpacker" like this from 2001 isn't going to be very useful today (plus, he's using a very old version of imprec)
dELTA
11-03-2004, 03:01 PM
General unpacker for almost all executables... Tried everything to compile its assembler source with a Visual Basic compiler... OMFG. :rolleyes:
NimDa2k3
11-03-2004, 04:15 PM
OK , It's a Project OF UNPACKING GOD'S Team !!
SL0rd
11-04-2004, 08:50 AM
I would like to know what the guys working int the armadillo unpacker
project think about beasts like "General unpackers".
MaRKuS-DJM
11-06-2004, 07:58 AM
Teddy Rogers and me had a discussion about generic unpacker some time before and he says the best to do this would be to develop some type of Virtual OS (running in VMWare) which does the neccessary steps to unpack a program completely
dELTA
11-06-2004, 03:48 PM
There are still at least two problems with this:

1.
Knowing when you're at OEP.

2.
The executables are never fully unpacked with the more complex packers, so you really need specific knowledge to restore them to working exes, it practically cannot be done generically. :-/
MaRKuS-DJM
11-07-2004, 07:56 AM
hm... didn't thought about this. maybe it would fail on armadillo copymem first :boo:
Polaris
11-07-2004, 08:28 AM
There are still at least two problems with this:

1.
Knowing when you're at OEP.

2.
The executables are never fully unpacked with the more complex packers, so you really need specific knowledge to restore them to working exes, it practically cannot be done generically. :-/

If I do not recall wrongly, there were attempt to produce general unpackers that tried to find the OEP using compiler-startup code: they continuosly look for compiler startup code... If it is found, then OEp is reached, and every necessary action is performed.

And if I recall that correctly, the same author of GUW32 (which indeed is a very good tool, even if outdated) produced something that worked like this (called SCU).

Extending that concept could help in automated OEP search.... :-/
nikolatesla20
11-07-2004, 03:35 PM
This was my idea for a generic OEP finder, was to look for compiler signatures. This might be defeated by protectors which rip OEP code though. Fortunately, you can't rip OEP code forever, and some protectors, like ASProtect, leave enough of it behind that you can still identify the entry point fairly well. ACProtect, on the other hand, has a pretty darn good OEP ripping method.

-nt20
T.H.A.O
11-08-2004, 01:10 PM
Generic Un-Packer...???
So we don't need a Brain Any-more.?
SL0rd
11-09-2004, 08:28 AM
Generic Un-Packer...???
So we don't need a Brain Any-more.?
It doesnt matter if a "ultimate tool" is created and avaiable to us. We are always looking for learning and we will do manually things even if theres a tool that can make the job. Its like a vicious!


Very basic question bout SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Very basic question bout SI
PDA

View Full Version : Very basic question bout SI

Buuto
11-03-2004, 10:51 AM
My question is just this: What version of SoftIce should I have that I could install DriverStudio v3.1? :confused:

I´v got XP SP2,so I suppose those are needed to get it working.
And also this: http://frontline.compuware.com/nashua/kb/doc/1846.asp

P.S. Where do I get DriverStudio... or should I just warez it? :devil:

P.P.S. Sorry for dictionary probs... I´m not from any english or american country..
Kayaker
11-03-2004, 07:49 PM
My question is just this: What version of SoftIce should I have that I could install DriverStudio v3.1? :confused:

This makes no sense. You want DriverStudio v3.1 complete.

I´v got XP SP2,so I suppose those are needed to get it working.
And also this: http://frontline.compuware.com/nashua/kb/doc/1846.asp

Yes

P.S. Where do I get DriverStudio

NEVER ask that

P.P.S. Sorry for dictionary probs... I´m not from any english or american country...
Buuto
11-04-2004, 04:13 AM
Is SoftIce a part of Driver Studio? :idea:
Or not... :-/

I´ll just warez it then... :p
Silver
11-04-2004, 09:53 AM
Yes, Softice is part of DriverStudio. Install DriverStudio, you can select Softice as a component.

Now I'll just stand over here and wait for the "WHat version of Softice do I have, because Iceext doesn't work?" question. Don't mind me.
dELTA
11-04-2004, 10:50 AM
:)
br00t_4_c
11-04-2004, 12:29 PM
I learned so much from this thread.


How to use the genlic32.exe(version 9.2) to generate license?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to use the genlic32.exe(version 9.2) to generate license?
PDA

View Full Version : How to use the genlic32.exe(version 9.2) to generate license?

flexlm
11-03-2004, 08:20 PM
I have read CrackZ's new paper: "FLEXlm latest information by CrackZ".

From CrackZ's paper we can get these information:

Vendor code structure

04 00 00 00 52 EE F9 99 A6 14 01 63 ED 11 A0 18
97 E1 4B 27 A8 21 6A E2 41 04 58 52 09 00 00 00

Job structure

66 00 00 00 EA 00 AA 00 C6 E0 F4 21 93 65 B8 00
00 00 6F 00 00 00 00 00 00 00 00 00 02 00 00 00

LM_SEED1 = 0x0A192837
LM_SEED2 = 0xF0E1D2C3

vendor name = bitplane

i run the lenv8gen.exe and got:

#define VENDOR_KEY1 0xda96fa16
#define VENDOR_KEY2 0xc09506f0
#define VENDOR_KEY3 0x5530637d
#define VENDOR_KEY4 0x8859a9df
#define VENDOR_KEY5 0x617b2ab0

#define CRO_KEY1 0x801b706d
#define CRO_KEY2 0xb9100f8b

#define VENDOR_NAME "bitplane"

I filled above information into the file lm_code.h(from flexlmsdk9.2) and run the genlic32.exe. An error is given.

where i'm worng?
Aimless
11-04-2004, 10:05 AM
What;s the error?

I am currently trying to break an app with Flexlm 9.2 and CRO implemented. You may first try to look at:

http://dev.csdn.net/user/zxg32

The cracking of a Flexlm 9.2 scheme with license created (fortunately for the cracker, the app did not have CRO. Mine does)

Have Phun
disth
11-05-2004, 10:04 PM
1,lm_seed !=vendor_seed!!!
what you get is vendor_seed!!!
2,nocro is for you do....but you define crokey,would you crack ECC?????
3, as up you said , you are fresh in flexlm,so read the guide(pdf) carefully
r00t
01-18-2005, 11:17 PM
The URL http://dev.csdn.net/user/zxg32, and cannot find any FLEXlm 9.2 tutorial...
Anyone have it?.

Thanks.
JMI
01-19-2005, 01:17 PM
Clearly you are not correctly using your "brain." ;) The Tutorial is not at:

http://dev.csdn.net/user/zxg32

That appears to be a Forum where Aimless suggested one might look for information about "Flexlm 9.2 and CRO implemented." The CrackZ article is in the CrackZ Forum listed at the bottom of this Forum. The article, itself is at:

http://www.woodmann.com/crackz/Tutorials/Flex2004.htm :yay:

Regards,
CrackZ
01-21-2005, 07:45 PM
Hiya,

You are wrong in 2 places.

Firstly for that target, it doesn't use the Counterfeit Resistant Option, so your CRO keys should be 0x0. By default this also means your LM_SEED's 1-3 can be just initialised to any values you make up just to get the SDK or GenLic to accept them as non-unique.

Secondly, the 2 values you have their are ENCRYPTION_SEED1 & ENCRYPTION_SEED2 which you need to add to the lm_code.h manually. This target uses a standard SIGN=12 digits checkout.

Regards

CrackZ.


Flexlm with CRO...need pointers (Crackz?)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Flexlm with CRO...need pointers (Crackz?)
PDA

View Full Version : Flexlm with CRO...need pointers (Crackz?)

Aimless
11-04-2004, 10:10 AM
Hello,

With guidance of questions and replies from crackz (somewhere on this message board, I have managed to get very far in my cracking of a Flexlm 9.2 protected app (unfortunately with CRO, therefore patching is necessary, licensing is secondary).

But I read an interesting point on a 7-part essay pointed out at Crackz' site where the author says that we can put in the public key which we want so that the private key always matches. My two questions are (hopefully, crackz can reply):

1. Where in the heck are the number of bytes consisting of public key stored?
2. And do I have to know ECC mathematically to create a matching private key (in case I decide to create my own public key? - I do know the number of bytes of the keys)

Ufff...This motha is giving me a bad headache...

Have Phun.


distinguishing between imul and mul in C
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > distinguishing between imul and mul in C
PDA

View Full Version : distinguishing between imul and mul in C

tdennist
11-04-2004, 04:36 PM
I've been working on a crackme for about 3 days now. I've got everything I need completed, I think, and the keygen is made. The one problem: the keygen doesn't produce the right number ;-). No, I'm not asking for someone to tell me what's wrong with the keygen. I think I know the problem.

In this crackme, this line exists:

IMUL EAX,6

EAX at this point contains the last letter of the name I entered. What I have in my keygen C file is:

foovar *= 6;

(Yes, foovar is a char containing the last letter :p). My question is: are these two lines equivalent? If they aren't, can you tell me how I can make them equivalent? And if they are...I guess I have some more work to do ;-).

Thanks.

(as a side question, is it possible to edit code in IDA? I was frustrated and was going to change the TEST EAX,EAX before the jnz instruction to XOR so that I could feel good about entering a correct serial, but I couldn't figure out how to edit code in IDA. Thanks again.)
dELTA
11-04-2004, 05:57 PM
Try to use inline assembler for that line, and see if it helps.

And about patching in IDA:
http://www.woodmann.com/forum/showthread.php?t=3670
tdennist
11-04-2004, 06:47 PM
I've never tried inline assembly before, so a bit of googling turned up a solution. But...the solution doesn't work. Here's my code (with line numbers):

41: foovar = name[4];
42: ++count;
43: foovar = (foovar^count);
44: ebx += foovar;
45: cout << ebx << endl;
46:
47: //foovar *= 6;
48: __asm
49: {50: mov eax, foovar
51: imul eax,6
52: push eax
53: call printf
54: pop ebx55: }
56:
57: ebx <<= 7;
58:
59: eax = (foovar + ebx);
//etc. more code follows.

I'm compiling it in Cygwin, and g++ gives me these error messages, along with errors on all the rest of the lines in the file:

keygen1.cpp: In function `int main()':
keygen1.cpp:49: error: parse error before `{' token
keygen1.cpp: At global scope:
keygen1.cpp:57: error: syntax error before `<<=' token
keygen1.cpp:59: error: ISO C++ forbids declaration of `eax' with no type
keygen1.cpp:59: error: `foovar' was not declared in this scope

Any ideas?
disavowed
11-05-2004, 01:22 AM
you're trying to use msvc++'s inline asm syntax with the g++ compiler. the g++ inline asm syntax is here: http://www.delorie.com/djgpp/doc/brennan/brennan_att_inline_djgpp.html
naides
11-05-2004, 07:07 AM
Sorry for dropping in: imul does a signed multipication. foovar is the ascii code of a letter which should be a small, unsigned char. The two operations imul and *= should be equivalent with small ascii codes, below ox7F.

I suggest you trace both the crackme and the keygen (you have the luxury of compiling it with debug info and see the code in proper debugger fashion) and see if the results are the same. My gut feeling is that the problem is somewhere else.

Note: after looking at the code you posted later, foovar contains a computed number which is not simply the ascii code of a letter, then, signed multiplication, overflow and roleover make a lot of difference, numbers above dec 127 or ox7F are interpreted as negative, so imul and *= are not equivalent operations.
doug
11-05-2004, 10:41 PM
besides, using register names as variable names is probably a bad thing if you intend to inline code.
gcc's AT&T asm syntax probably avoids messing things up with the % prefix.. but it took me a while to figure out which identifiers are variables and which ones are registers.

BTW, what is that printf call on line 53? no parameters?

to add to what naides said: right shifts are also common mistakes when converting asm to C or C to asm. (i.e.: what happens with the sign bit varies)
Madmartigan
11-06-2004, 04:22 AM
If you put the char in foovar into an int (a signed int, and the compiler will assume you mean a signed int as long as you don't write unsigned before it), the compiler will generate an imul instruction with a 32-bit operand, which is exactly what is done in the crackme.
tdennist
11-07-2004, 06:06 PM
Doug:
Yeah, I guess that is a not so hot idea. I just don't really like variable names like "temp" and such (though..."eax" and "ebx" are hardly any better :p). That printf call on line 53 is in the crackme.... I shouldn't have included that, and I don't know why. The original code in the crackme is this:
push offset aLx ; format
lea ecx, [ebp+buffer]
push ecx ; buffer
call _sprintf
So as you can see, I typoed it as well as didn't include the other parameters 8-). I think I might have had a reason for it when I wrote it, but that was like a week ago, so I don't know.

Madmartigan: I'm afraid I've been programming too much in Perl/ASM lately...how would I go about moving the value from foovar into an int? Is it simply:

int temp; //:p yes, I do hate these names
temp = foovar;

Thanks for your replies.
Madmartigan
11-08-2004, 04:28 AM
Yes, exactly.


Sentinel sprofindfirstunit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Sentinel sprofindfirstunit
PDA

View Full Version : Sentinel sprofindfirstunit

m2lk
11-05-2004, 04:47 AM
Hi there all - just joined !

I'm newish to all this and am starting out on my first Sentinel target. I read some of the excellent tutorials by Goatass and Cyberheg and embarked on attacking my target.

I have the original dongle, IDA and Killer 3k signatures and started by patching sprofindfirstunit - with a mind to BPX with Softice on Sproread to find the dongle words being passed.

I assumed that I could patch sprofindfirstunit and leave the dongle connected and all would be well, but that's not the case.

Do the generic patches of NOPing the jump and mov Ax, 0 commonly screw up using the original dongle ?

This will probably be the first of many questions!

Thanks for any advice.
Sab
11-06-2004, 07:05 PM
Patching any of the initiliazing api will definetly screw up any other apis even with real dongle connected. there are some infos in the init api used other then return 0 (: But the whole purpose of patching the api boggles my mind because you have the original dongle, simply trace over that api in softice it should pass. Once you have figured out ssproread (which you can also just use a generic dumper from crackz site url on this forum) then you have all the read query values and can do a nice little emulation. Watch out for sproquery thats about the only manual work involved here. Btw, when you have the original dongle you should never need to patch the executable, only when you are done with the dongle can you start to remove these apis, there is no benfit to patching the api in this situation.... i suggest reading the api help for the most basic of the sspro apis, then try programming your own sspro protected app possibly just use the dongle you have if its not a developer dongle, and then crack your own app, now you can go and attack a commercial app which may use some advanced tricks. Have fun...........Sabs
m2lk
11-09-2004, 05:22 AM
Thanks for the reply Sab.

Yes, I soon realised I was going the wrong way about it!

With my limited Assembly knowledge I've managed to get sprofindfirstunit and sproread bypassed okay. Sproquery is somewhat more daunting: Sproquery is called ten times then some CMP are started. I can follow the dongle as it passes each test but I'm not at all sure when the tests stop and the program starts properly. Am I missing any obvious tricks ?

Thanks.
Sab
11-09-2004, 05:42 AM
Well again, you need not go such a difficult way. All you need to do is look at sproquery api or any dongle query api structure in that case. Think of it like this... Dongle needs to be seeded first with a query, then the dongle can give back the corresponding query. i.e. Send dongle 12345 dongle returns 8d3044 . SO..... Log all the queries that the application sends to the dongle by setting ur bpx at sproquery api, then log all the return values and make a table emulation.............................................Sbabsdfsdfsdf
m2lk
11-10-2004, 05:16 PM
I've really got stuck and in a vain hope that someone might put me right I've pasted some of the code. :(

The calls to Sproquery take the form below and repeat about 10 times with only the memory addresses changing. Push 4 and Push 8 remain the same each time.

.text:0047DABD call sproQuery
.text:0047DAC2 test ax, ax
.text:0047DAC5 jnz loc_47DDA4
.text:0047DACB lea ecx, [esp+84h+var_60]
.text:0047DACF push 4
.text:0047DAD1 lea edx, [esp+88h+var_6C]
.text:0047DAD5 push ecx
.text:0047DAD6 lea eax, [esp+8Ch+var_70]
.text:0047DADA push edx
.text:0047DADB push eax
.text:0047DADC push 8
.text:0047DADE push offset unk_598A88
.text:0047DAE3 mov byte ptr [esp+9Ch+var_70], 47h
.text:0047DAE8 mov byte ptr [esp+9Ch+var_70+1], 1
.text:0047DAED mov byte ptr [esp+9Ch+var_70+2], 0B7h
.text:0047DAF2 mov byte ptr [esp+9Ch+var_70+3], 22h
.text:0047DAF7 call sproQuery
.text:0047DAFC test ax, ax
.text:0047DAFF jnz loc_47DDA4
........................................................................etc.

At the end of the 10 calls some CMP are used.

Inside Sproquery we have:

.text:004ED2E0 push ebx
.text:004ED2E1 push esi
.text:004ED2E2 push edi
.text:004ED2E3 mov eax, [esp+arg_0]
.text:004ED2E7 or eax, eax
.text:004ED2E9 jnz short loc_4ED2F5
.text:004ED2EB mov ax, 2
.text:004ED2EF pop edi
.text:004ED2F0 pop esi
.text:004ED2F1 pop ebx
.text:004ED2F2 retn 18h
.text:004ED2F5 ; ---------------------------------------------------------------------------
.text:004ED2F5
.text:004ED2F5 loc_4ED2F5: ; CODE XREF: sproQuery+9j
.text:004ED2F5 push eax
.text:004ED2F6 call sub_4E6B60
.text:004ED2FB mov esi, eax
.text:004ED2FD cmp word ptr [esi], 7242h
.text:004ED302 jz short loc_4ED310
.text:004ED304 mov ax, 2
.text:004ED308 pop edi
.text:004ED309 pop esi
.text:004ED30A pop ebx
.text:004ED30B retn 18h
.text:004ED30B ; ---------------------------------------------------------------------------
.text:004ED30E align 4
.text:004ED310
.text:004ED310 loc_4ED310: ; CODE XREF: sproQuery+22j
.text:004ED310 test byte ptr [esi+12h], 4
.text:004ED314 jnz short loc_4ED326
.text:004ED316 mov word ptr [esi+6], 0B39h
.text:004ED31C mov ax, 39h
.text:004ED320 pop edi
.text:004ED321 pop esi
.text:004ED322 pop ebx
.text:004ED323 retn 18h
.text:004ED326 ; ---------------------------------------------------------------------------
.text:004ED326
.text:004ED326 loc_4ED326: ; CODE XREF: sproQuery+34j
.text:004ED326 mov eax, [esp+arg_8]
.text:004ED32A or eax, eax
.text:004ED32C jnz short loc_4ED340
.text:004ED32E mov word ptr [esi+6], 410h
.text:004ED334 mov ax, 10h
.text:004ED338 pop edi
.text:004ED339 pop esi
.text:004ED33A pop ebx
.text:004ED33B retn 18h
.text:004ED33B ; ---------------------------------------------------------------------------
.text:004ED33E align 4
.text:004ED340
.text:004ED340 loc_4ED340: ; CODE XREF: sproQuery+4Cj
.text:004ED340 mov bx, [esp+arg_14]
.text:004ED345 cmp bx, 38h
.text:004ED349 jbe short loc_4ED35B
.text:004ED34B mov word ptr [esi+6], 414h
.text:004ED351 mov ax, 14h
.text:004ED355 pop edi
.text:004ED356 pop esi
.text:004ED357 pop ebx
.text:004ED358 retn 18h
.text:004ED35B ; ---------------------------------------------------------------------------
.text:004ED35B
.text:004ED35B loc_4ED35B: ; CODE XREF: sproQuery+69j
.text:004ED35B lea edi, [esi+3Ch]
.text:004ED35E push ebx
.text:004ED35F push edi
.text:004ED360 push eax
.text:004ED361 call sub_4E6B30
.text:004ED366 mov word ptr [esi+30h], 10h
.text:004ED36C mov ax, [esp+arg_4]
.text:004ED371 mov [esi+34h], ax
.text:004ED375 mov [esi+36h], bx
.text:004ED379 push esi
.text:004ED37A call sub_4EB6D0
.text:004ED37F or al, al
.text:004ED381 jnz short loc_4ED3C0
.text:004ED383 mov eax, [esp+arg_C]
.text:004ED387 or eax, eax
.text:004ED389 jz short loc_4ED39C
.text:004ED38B push ebx
.text:004ED38C push eax
.text:004ED38D push edi
.text:004ED38E call sub_4E6B30
.text:004ED393 push ebx
.text:004ED394 push 0
.text:004ED396 push edi
.text:004ED397 call sub_4E6C30
.text:004ED39C
.text:004ED39C loc_4ED39C: ; CODE XREF: sproQuery+A9j
.text:004ED39C mov eax, [esp+arg_10]
.text:004ED3A0 or eax, eax
.text:004ED3A2 jz short loc_4ED3B0
.text:004ED3A4 mov ecx, [esi+38h]
.text:004ED3A7 mov [eax], ecx
.text:004ED3A9 mov dword ptr [esi+38h], 0
.text:004ED3B0
.text:004ED3B0 loc_4ED3B0: ; CODE XREF: sproQuery+C2j
.text:004ED3B0 ; sproQuery+EEj
.text:004ED3B0 mov ax, [esi+6]
.text:004ED3B4 push eax
.text:004ED3B5 call sub_4EC520
.text:004ED3BA pop edi
.text:004ED3BB pop esi
.text:004ED3BC pop ebx
.text:004ED3BD retn 18h
.text:004ED3C0 ; ---------------------------------------------------------------------------
.text:004ED3C0
.text:004ED3C0 loc_4ED3C0: ; CODE XREF: sproQuery+A1j
.text:004ED3C0 mov ax, [esi+6]
.text:004ED3C4 push eax
.text:004ED3C5 call sub_4EC520
.text:004ED3CA cmp ax, 0Ch
.text:004ED3CE jnz short loc_4ED3B0
.text:004ED3D0 mov ax, 3
.text:004ED3D4 pop edi
.text:004ED3D5 pop esi
.text:004ED3D6 pop ebx
.text:004ED3D7 retn 18h
.text:004ED3D7 sproQuery endp
.text:004ED3D7
.text:004ED3D7 ; ---------------------------------------------------------------------------

I assume that the dongle call is at 004ED37A with the returned dongle word in EAX at 004ED383 ?

What exactly should I be looking for as the input and output in Sproquery?

Sorry for being such a lamer.
Sab
11-10-2004, 06:58 PM
Id have to say this app is a bit to much to start with, but if you are quick enough you will definetly have no problem making a solution here. As far as sproquery goes, it is only contained from crackers view within this scope..
.text:004ED2E0 push ebx
.text:004ED2E1 push esi
.text:004ED2E2 push edi
.text:004ED2E3 mov eax, [esp+arg_0]
.text:004ED2E7 or eax, eax
.text:004ED2E9 jnz short loc_4ED2F5
.text:004ED2EB mov ax, 2
.text:004ED2EF pop edi
.text:004ED2F0 pop esi
.text:004ED2F1 pop ebx
.text:004ED2F2 retn 18h

ignore the jumps, and since you are probalby using ida here, do a xref on all the calls to 004ed2e0. That will show all the sproquery calls(that are not hidden at least)
text:0047DAF7 call sproQuery this just may be only one call to it. There may be 2 more or hundreds more. Set a breakpoint there and see...
Here are two paths to finish this app...
The easy path...
emulate sproquery to return always 0 like other api...
then butcher the code that goes after the jnz.
text:0047DAE3 mov byte ptr [esp+9Ch+var_70], 47h
.text:0047DAE8 mov byte ptr [esp+9Ch+var_70+1], 1
.text:0047DAED mov byte ptr [esp+9Ch+var_70+2], 0B7h
.text:0047DAF2 mov byte ptr [esp+9Ch+var_70+3], 22h
.text:0047DAF7 call sproQuery
.text:0047DAFC test ax, ax
.text:0047DAFF jnz loc_47DDA4
-----> you stopped pasting here but this is where the magic happens for the easy path, it may look something like..
cmp returnedval, fixedvalue
jnz badplace
mov flag, goodval

or if its a more complicated program and it uses it for calculations in the ruitine later on you see something like..
mov [constantval], returneddongleval
ret
and later in the program it will use it for something either compare or constant in calculation.

Harder but better way....
Find out all the queries, and what is their challenge value.... then log the returned response value. Make a table emulation from this. THe only way to learn how to do this is read the api guide so you know how to locate these values in the stack for emulator... Have fun.. if this doesnt help enough try getting sentinel sdk and programming your own little appy and crack that first....--......-Sabaorksdflkjlsadf
JMI
11-11-2004, 12:51 PM
m2lk:

We really do not want people to post lots and lots of code and ask others to tell them where they went wrong. It just eats up storage room on the server. If you need this much help, this type of detailed exchange of code can be handled through email and/or PM, rather than pasting all this here.

Regards,
m2lk
11-12-2004, 12:07 PM
Apologies JMI. I won't post as much if there's a next time.

Have to say though that I'm glad I did post it :D - YOU ARE A STAR SAB !!!

My App is fully functional without it's dongle and has been working fine for several hours so far.

I had actually already tried your suggestion to force Sproquery to pass any test and I had patched some of the following cmps but I must have given up a few Jumps to early. Your suggestion pushed me on - just what I needed!

I used the butchery method with lots of NOPS and it worked a dream !!

THANKS SO MUCH for the help SAB I owe you some virtual beer!!

Thanks also to this forum!

m2lksduhfeifpsidfasi ;)
Sab
11-15-2004, 02:59 AM
Ill gladly take that virtual beer, but id rather have some virtual lobster dinner or steak. Glad to see you got it working thats the first step generally.. but mots importantly you did it yourself, unlike others who cannot fathime this possibility and must rely on others as though they were mentally handicap. Great job, but I do suggest now you go and do a better quality emulation and by using the table method for sproquery, and copy one of the sproreads that are readily available all over the net. ITs better to learn this method because when you encounter a more complex sentinel, butchering will not be a option. Have fun and good to see progress is still happening.. (: Sabororoisfkdod


RSA implementation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > RSA implementation
PDA

View Full Version : RSA implementation

LaptoniC
11-06-2004, 08:03 AM
I am working on some RSA protected app.It serial scheme is different to regular RSA implemantation so that it decrypts serial with d.I guess I have found the n and d however when I feed this values to my bignumber lib it didnt worked

original program
n=79E7FF0C76D6A4F704DBB6F60674D7AD36CF4616A0DC7D0225A5AF4F7471BFAD
d=2A844C090804BD42A260A4BC01AF1A5181769F16E7BE8A289ACCAF3406C184E7

so I calculated
p=B046688D67641C9BC2697D40879BE175
q=B10A9FC3E2EF4912860338DBA2852659
e=E17
Maybe I should first try to brutefrorce e instead of factorig and geting it :)

I know one valid serial though
name: user600
code: qBaILQ9eHfqaHZw+Ld+gyfBusxmMLOq7CJOBgfHbU2I=
Serial is converted to base64.I am new to RSA thing could you check this values and tell me my values are correct or not for this implementation ?
Thanks
mike
11-07-2004, 04:18 PM
you've got your numbers right: p*q=n, d*e=1 mod phi(n). What's 'code' as a number? (too lazy to figure it out myself)
KSA
11-08-2004, 07:09 AM
Hi LaptoniC

May I ask you How you obtain the p and q (factoring) ?
Which program you are used to factor this 256 bits RSA number ?

KSA
LaptoniC
11-08-2004, 09:55 AM
mike code is as
hex A816882D0F5E1DFA9A1D9C3E2DDFA0C9F06EB3198C2CEABB08938181F1DB5362

dec
76028369049733043146806201961894077383848836998720579113190947617082709857122
for factorizing I used http://www.asahi-net.or.jp/%7EKC2H-MSM/cn/ it is faster than RSA-tool and allows you to save and resume.I factored I guess after 1.5 hour dont remember exactly.
mike
11-08-2004, 04:42 PM
I get code^d mod n =

dec: 32203605056077899989696486620583417132870039787602000620061715128083153892901

hex: 473298337bae3413c451da2685c6c0198f473af75521f5b66904cc7c439f3625

and code^e mod n =
dec: 25633554524463369197540132814160836968933790088022549341000866828215553752435
hex: 38ac13e50fab65f6f3a1d21d4356a5b511039facf5d6d3bf8d3da1c51d7dfd73

http://www.alpertron.com.ar/ECM.HTM is a java factoring applet that's pretty good
LaptoniC
11-08-2004, 06:24 PM
That means I skipped something I will dig it more thanks for your time.
volodya
11-10-2004, 01:52 PM
http://www.alpertron.com.ar/ECM.HTM is a java factoring applet that's pretty good

Not bad indeed. Two-stage ECM with the weeker B-smoothness limitation... Hmm... But it is Java. Therefore, the speed is horrible.
Better use this one:

http://www.loria.fr/~zimmerma/records/ecmnet.html

This one is using GMP engine. Once again, I'm too lasy to check if this guy has implemented FFT-multiplication, but, anyhow...
mike
11-10-2004, 09:39 PM
Java doesn't necessarily imply horrible speed: JIT compilers do a really good job these days, and it's all math calls which are native anyway. Why doesn't someone do a comparison and let us know?
volodya
11-10-2004, 09:52 PM
The keyword here is "JIT compilers" ;)
As to the speed comparison - m-m-m... Nice idea. Slightly later. Pretty busy now :-/
friedo
12-18-2004, 08:47 PM
Is there any known attack if (in addition to modulus N and exponent E) C and M is available?
So i have crypted and plaintext "message" and the modulus and exponent and want to determine my private exponent d. what possibilities do i have without getting my big math bible...?
volodya
12-20-2004, 02:44 PM
Without the math, there is nothing you can do at all. You have to know A LOT. As to your specific problem go read
http://www.hackemate.com.ar/ezines/tic/TIC3.txt/TIC3.txt
There is a very easy description there of the various attacks on RSA that do not involve factoring N and allow you to recover M. But I'm not sure about D...
Since d = e^-1(mod((p-1)*(q-1))) you have to know p and q... Though I must admit, I don't know algebra good enough yet to say it for sure :-/
friedo
12-21-2004, 04:37 AM
Without the math, there is nothing you can do at all. You
I fear that´s true... ;-)
Anyway, there are lots of Attacks. I played a little with RSATool (2.17).. is there somewhere the source of that nice thing? because i miss some functions and not lucky to write all for new...
(So what´s with "factorizing" d instead n, furthermore it shuts down without any error calculating bigger keys..)
volodya
12-21-2004, 02:32 PM
The newest possible version is on my wasm.
http://wasm.ru/toollist.php?list=23

But why do you need it for?
To factor N you should use specific tools parallelized on many machines (like NFS implementation). RSA Tool is build using Miracl and suites for the numbers that are less then 80 digits, say. You can calculate these on your personal PC.
mike
12-28-2004, 03:53 PM
See "Twenty years of attacks on the RSA cryptosystem" by Dan Boneh
http://crypto.stanford.edu/~dabo/abstracts/RSAattack-survey.html


multithread application debugging
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > multithread application debugging
PDA

View Full Version : multithread application debugging

crkzone
11-07-2004, 02:02 AM
I have some problems debugging a multithread application with softice.How can i find the program's executed code when sleep or sleepex or wait_semaphore functions are called.
Silver
11-07-2004, 05:56 AM
Which code? The code in the thread? When the thread is created, a pointer to the function comprising the start of the thread is passed to CreateThread (or whatever). Thus, you have the entry point for your thread.

Your question is a bit vague, but I assume you're asking "How do I know which bit of code is being executed in thread 1 whilst thread 0 is waiting for a semaphore/mutex/section?". There is no simple way to do this, but IMO the best way is to find the call in thread 1 that signals the semaphore/mutex/csection. In other words:

1. Thread 0 creates thread 1.
2. Thread 0 sleeps, waiting for the csection to signal.
3. Thread 1 does stuff.
4. Thread 1 signals the csection.
5. Thread 0 wakes up.

To find what is happening at (3), find (4) and work backwards. This seems the logical way to do it to me, and the way I've done it in the past. Others may be able to suggest a technique/tool that is more efficient.

CreateThread reference:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/createthread.asp

*edit* I lost the ability to type...
crkzone
11-07-2004, 09:44 AM
Thanks for your reply and i know that
HANDLE CreateThread(
LPSECURITY_ATTRIBUTES lpThreadAttributes, // SD
SIZE_T dwStackSize, // initial stack size
LPTHREAD_START_ROUTINE lpStartAddress, // thread function
LPVOID lpParameter, // thread argument
DWORD dwCreationFlags, // creation option
LPDWORD lpThreadId // thread identifier
);
lpStartAddress is the thread start function but there are 2 problems:
1-The program creates too many threads at the startup and i can't trace from this point.
2-When sleep function called It doesn't mean the execution of thread starts from the beginning,and i want to find first instruction from program which executed.
This is my situation
The program calls SendMessageA,break on PeekMessageA and i land on one of programs dll,then it goes in a loop and calls kernel32.sleep and calls some bad stuff!
dELTA
11-07-2004, 04:32 PM
You are still being quite vague, but as far as I can see you want to catch a thread immediately when it returns from a sleep() call? Simply put a breakpoint on the instruction after the sleep() call in the program code. This would be the first instruction of the program's own code being executed after the sleep (while the first instruction in the thread would of course be somewhere inside the sleep API code, but I can't imagine why you would need that anyway).


how to build the lmgrypt.exe with the flexlm SDK v8.1?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > how to build the lmgrypt.exe with the flexlm SDK v8.1?
PDA

View Full Version : how to build the lmgrypt.exe with the flexlm SDK v8.1?

flexlm
11-07-2004, 06:41 AM
how to build the lmgrypt.exe with the flexlm SDK?

I downloaded the flexlm SDK v8.1 & v9.2.

I builded lmgrypt.c with microsoft viusal C++ 6.0, include the necessary head file(.h) and linked to lmgr8b.lib.

after builded it i got an error:

--------------------Configuration: lmcrypt - Win32 Debug--------------------
Linking...
lmcrypt.obj : error LNK2001: unresolved external symbol _l_prikey_sign
Debug/lmcrypt.exe : fatal error LNK1120: 1 unresolved externals
Error executing link.exe.

lmcrypt.exe - 2 error(s), 0 warning(s)

where is the function _l_prikey_sign?


Setting up IDA for analysing Softice functions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Setting up IDA for analysing Softice functions
PDA

View Full Version : Setting up IDA for analysing Softice functions

Kayaker
11-07-2004, 09:57 PM
Hi All,

A lot can be learned about low level system operation from reversing Softice itself. While it is possible to trace live certain sections of Softice code, the more useful analysis is through IDA. Since questions seem to come up all the time which could be clarified by examining SICE code, I decided to write a small introduction to setting up IDA for analysing Softice.

Step 1, as always, is to make use of the invaluable resource provided by The Owl, in the form of IDB files and Softice headers produced while developing Icedump. The package is one I put together to preserve the info and Yates was kind enough to host it.

NTICE and WINICE IDB Files by the_owl (IDB)
http://woodmann.net/yates/ida/softice_idb.zip

There is also a script by Toteu that may be useful:
Icedump inc parsing scripts (IDC)
http://woodmann.net/yates/ida/ice_script.zip

To begin with, you should update the IDA disassembly of Softice to your latest version. I will explain how to set up what I term the CommandIndex, a call table of all the Softice command function addresses. To properly identify each function, you can use a corresponding ascii table, the NameIndex.

These tables have been consistent since early SICE versions, you can usually find them by locating some *known* function by examing SICE messages ("I1HERE is ON" for example), then tracing backwards until you find a long list of pointers. In Win9x they were easy to find by tracing the BCHK interface. The simplest method now is probably to search for the ascii message
'A General Protection Violation has occurred'
the CommandIndex table follows immediately, and the NameIndex follows thereafter. Addresses are from DriverStudio 3.1:

.data:00111061 aAGeneralProtec db 'A General Protection Violation has occurred',0
.data:0011108D CommandIndex dd offset sub_69F81 ; DATA XREF: sub_68326+2C9r
.data:00111091 dd offset sub_5F0F7 ; Altscr
.data:00111095 dd offset sub_A2D5E ; Be
...

.data:00111381 21 00 NameIndex db '!',0 ; DATA XREF: sub_6864B+5o
.data:00111383 AA db 0AAh ; ¬
.data:00111384 2E 00 a__1 db '.',0
.data:00111386 38 db 38h ; 8
.data:00111387 3F 00 a?_3 db '?',0
.data:00111389 30 db 30h ; 0
...

Each ascii string in the NameIndex is followed by an index value which references the correct function address in the CommandIndex. New versions of Softice add new functions to the end of each table.

Parsing the NameIndex:
----------------------
As an example of parsing the NameIndex to identify the correct CommandIndex function address, let's take the PHYS command. When you enter a command in the Softice window it eventually gets called indirectly in the form:

call CommandIndex[eax*4]

where eax is the corresponding NameIndex index value. You may also see it as:

shl eax, 2
call ds:CommandIndex[eax]

Now search in the NameIndex for the command you want to identify, extract the index value, in this case 76h, and plug it into the call equation:

.data:00111648 50 48 59 53 00 aPhys db 'PHYS',0
.data:0011164D 76 db 76h ; v

CALL CommandIndex[eax*4]
or by address
CALL 0011108D[eax*4]

0011108D + (76h*4) =
0011108D + 1D8h =
00111265

00111265 is now the correct CommandIndex address which identifies the PHYS function:
.data:00111265 31 80 01 00 dd offset c_Phys
----------------------

crUsAdEr came up with a very nice IDA script for automating this. I'll take the liberty of posting it here from a PM we had, he can add any comments he may have.

static CmdTable(NameTable, CommandTable) {
auto i, j;
auto CmdIndex, CmdName ;
i = NameTable;
j = NameTable;
while ( Word(i) != 0) {
while ( Byte(j) != 0) j++;
j++;
MakeStr(i,j);
CmdName = "c_" + substr(Name(i),1,j-i);
CmdIndex = Byte(j) * 4;
MakeName( Dword(CommandTable+CmdIndex), CmdName);
j++;
i = j;
}
}

with idc command
CmdTable(0x111381, 0x11108d);
on DS3.1

Now that you have the all the Softice functions named, you can go back to The Owl's IDB files and start filling in the missing pieces, updating your new IDA disassembly. Many of the functions are identical or similar enough that you can start naming some of the global variables and subfunctions that he identified. Do a few of these and you can begin to "read" the disassembly code. It's about here that the little lightbulb above your head goes on ;-)

Regards,
Kayaker
dELTA
11-08-2004, 05:24 AM
Cool, high quality stuff as usual, thanks Kayaker! :cool:
SynApsus
11-08-2004, 06:24 AM
Yeah ! Thanks Kayaker ! This post is in a certain way a reply to my question, isn't it ? ;)
Identification of the PHYS command will a lot help me. Big, big thanks man ! I'll post the results of my research in one week, and i'll certainly write tutie + example on my website.
Have a nice day !
JMI
11-08-2004, 11:52 AM
Great information on the dark codewoods, as usual. :yay:

Regards,
Neitsa
11-08-2004, 12:54 PM
Thank you for sharing informations like this one. This is trully great and could help many reversers. It will help me a lot.

Thank you very much.

Regards, Neitsa.
crUsAdEr
11-08-2004, 09:11 PM
Nice one, Kayaker.
Could not have done it any better!!! Somehow i am quite sure you are in the teaching profession or along that line of work :)?
Kayaker
11-09-2004, 10:16 AM
Glad it's useful. I figure if everyone is on the same 'page' so to speak and has these basics in hand, it might encourage further documentation of Softice internals.

Sorta like this description of the PHYS command....:D

http://woodmann.net/forum/showpost.php?p=41341&postcount=13


ASPR IAT
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASPR IAT
PDA

View Full Version : ASPR IAT

p0thead
11-08-2004, 08:52 AM
lo all im trying to unpack an asprotected app. PEiD recognizes it as Asprotect 1.23 RC4 - Asprotect 1.3.
i'm keeping to andreas asprotect tutorial from reteam.org.
i can nearly find everything i come to the part where the sections get decrypted (the one with the mov [edi],C3 tracer trick). but i absolutely are unable to find the procedure where the IAT is generated! (the one that starts with LODS DWORD DS:[ESI] ). i watched all seh calls and made my way through with stepping into but i just cant find it! i made a search for the opcodes and i can find a slightly changed routine. just the bytes that stands for emulated apis etc got changed) but this code never gets executed or reached ?! i tried traces etc and completely stepping to the OEP. i wondered if its maybe due to this new delphi protection APSR got coz the main program is a delphi application...

TARGET NAME AND URL REMOVED BECAUSE I'M AN IDIOT AND DIDN'T BOTHER TO READ THE FAQ. :whoops:

thanx in advance...


EPROM code patching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > EPROM code patching
PDA

View Full Version : EPROM code patching

philkin
11-09-2004, 08:53 PM
Hi everyone,

I am trying to learn how to patch the programme code from an EPROM that is from my TV system, although I am completely new to this stuff I have managed to buy a programmer and read the EPROM which produced a file that I loaded into IDA successfully. The problem is there is so much code that I am having problems finding the section I need (the pin code) before I can even think about patching the file or creating a jump point.

Can anyone point me to a tutorial or some help in this type of thing please?

Regards

Phil K
cyberbarty
11-10-2004, 07:05 AM
There is no need to do that
there is always a way to reset the TV pin codes
if u have access to engineers manuals it will tell u how :)
JMI
11-10-2004, 07:12 AM
And I don't suppose you bothered to try searching on the net for answers to your questions, or at the very least, you have not followed the posting guidelines and indicated that you have. Please go back and actually read the FAQ, like you were supposed to have done and indicated that you actually did.

Regards,
philkin
11-10-2004, 10:08 AM
Cyberbarty,
Many thanks for your reply... I have had a good look round on the net for information about resetting the pin but it has only produced an engineers code that lets me power-up the TV for a few hours in a fault finding mode and although there may be a way to reset the pin I have not yet found it : (

JMI,
I am surprised at your attitude to my post as a moderator, I have extensively searched for information on this problem for about 4months and that is how I have managed to get this far. Also for your information I have searched this forum for information about EPROM’s but as my question suggests I would like some help in what direction to learn more.

Regards
Phil K
JMI
11-10-2004, 11:39 AM
philkin:

Why would you be suprised by my comments? Do you feel that you have a special dispensation to ignore the Rules? Those Rules DO require that you make an effort to help yourself before you post.

Do you assume that we are mind readers and can intuit that you have made that effort when you do NOT state that you did make such an effort by searching for answers on the net? Are we left to just guess you have actually read the FAQ when you do not indicate that you have and your post indicates that you have not? We were also left to assume you had used the SEARCH function here, because, as I pointed out in my original post, you again did not indicate you had done so.

So let's be clear. It's my job to put new posters on the right path. You may have had information in your head confirming you had done some of the things required here, but you first post clearly fails to state the things I discussed and that is the reason why they were mentioned. I do not believe if you actually re-read your first post you could disagree. That is also why my response was stated in the "conditional" mode, indicating that I was forced to make assumption, based upon your lack of information.

If you had spent any time actually reading these Forums, you would already have been aware of what response you could expect from the way you phrased your post and would have also know to expect my response to what you did write. You still have not indicated that you have actually read the FAQ.

Regards,
Woodmann
11-10-2004, 03:23 PM
Howdy,

Without getting into the particulars about sat tv protections.............

There are plenty of places out there that have all the information you could possibly need about this subject. If you do not know how to read the code in regards to what the EPROM wants, you have no chance to do this.
Every system is different and they change just like commercial software protection.

I dont think you will find many people here who are into sat tv reversing.

Good luck,

Woodmann
philkin
11-10-2004, 06:08 PM
Many thanks Woodmann,

My work is analogue RF (for 30years) and as you can imagine is worlds away from binary data but I am always willing to have a go but sometimes that's not good enough and I try to find the right people to talk with as I do for other people in my work.

This is not a satellite TV decrypt problem it is simply a pin code stored in some binary data that I need help with, but many thanks for your time and as you suggest I will look to other areas.

Regards
Phil K
Essex UK
phantasm
11-17-2004, 09:11 AM
Philkin,

As a suggetion, have you tried looking for any EEproms?

Yes, EProms are used for MPU code, but they can generally be only written to once without UV to erase.

The pin numbers can usually be changed (by the user), so require rewritable memory hence an EEprom.

Try searching for the normall 24lcXX,24Lxx, 93cxx, etc ranged.

Then backup the contents and erase (or swap for a blank eeprom). This trick works for Dell laptops which prompt for a new bios password.

+Phantasm
philkin
11-17-2004, 03:14 PM
Phantasm,

That’s very helpful :yay: and I see what you are saying is that if the EPROM is blank then the microcontroller may reset to a default set-up mode (we hope) and that could give me just what I need so I can get to the installation menu. I will try to get a new blank 28C64 and give it a go.

Much Appreciated

Phil K
Woodmann
11-17-2004, 07:18 PM
Howdy,

A 28C64 is re-writable, you dont need a blank one.
Then again, $4.00 will get you a new one.

Woodmann
philkin
11-23-2004, 08:35 AM
Thanks for your help here guys,

I have fitted a new 28C64 but the result is no power-up so there must be some other code in the device apart from settings pins etc.

All the best

Phil K
lifewire
11-23-2004, 11:00 AM
well, indeed, like phantasm said, it is imho not very likely that the pincode is stored in the same memory where the program code resides. don't you have an identical tv? (not very likely, but that would help you for sure ;) )

ideas that pop-up in my mind is hot swapping the eeprom and other nasty things :)
icray
11-23-2004, 11:15 PM
first, i think you should know the program in eeprom is compiled by which kind of mcu.then maybe you can revserse it. I think you would not read the X86 deassembled code which is compiled by PowerPC compiler. You can find the mcu type in your motherboard.


Recommended Graphics Card for Driversuite 3.1 ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Recommended Graphics Card for Driversuite 3.1 ?
PDA

View Full Version : Recommended Graphics Card for Driversuite 3.1 ?

The SharK
11-10-2004, 08:37 AM
Which graphics card do you use for Driversuite v3.1 ?

I'm going to buy one, because my Radeon 9200 won't
do the job :-/

regards,

The SharK
Silver
11-10-2004, 12:24 PM
Won't do the job? Anyway, pretty much any graphics card currently available will "work". You can pick up a Geforce 4Ti range for about £30.
doug
11-10-2004, 01:54 PM
I never had a problem getting nVidia cards work under softice.
geforce2/4 mx are probably the cheapest you can get (especially if you get a used one)
I'm also using a geforce ti 4.. but they cost more than 30 around here ;-)

I've had varying results with ATI card/drivers.
lifewire
11-10-2004, 01:57 PM
I used it first with a viper 550 (they are ancient and so was my pc) and i have now an ati radeon 9600 xt.
The SharK
11-11-2004, 01:36 AM
I have bought an A180T 64mb DDR Nvidia GeFORCE 4 MX 440.

After installation of it, everything worked fine in Driversuite v3.1
I could break without Driversuite freezing.....very nice !

But after a while, it started freezing again, like before....:(

So now I have two graphics card, and I haven't solved the problem.

I have windows XP SP2, and I have installed the patch for it (OSINFO.DAT)
and it's installed on a Pentium4 3g hertz.

What should I do ?

Uninstall my SP2 ?
Install god ooooold win98 (joking).
Throw the damn P4 out of the window (kidding).

Stop using Driversuite, and build my own debugger.

regards,

a SAD shark :( :( :(
bilbo
11-11-2004, 01:51 AM
I'm going to buy one, because my Radeon 9200 won't
do the job :-/

Well, the problem with the more recent Softice releases, which support the so called "Universal Video Driver" (Ddraw must be set to 1 in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice) is not in the graphic card, but could be in the software driver released by the hardware vendor.
That module must be listed in the value InstalledDisplayDrivers (again in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice), without extension, and must correctly support the DirectDraw Driver Interface documented in Microsoft DDK.
So, be sure to have downloaded the latest driver release from the vendor site.

But after a while, it started freezing again, like before....
So, we may exclude problems in the vendor's driver. Check again the two values in the registry... Maybe are you playing some "dirty" videogame which interacts with the video driver?

Regards, bilbo
disavowed
11-11-2004, 02:09 AM
better solution: use ollydbg ;)
The SharK
11-11-2004, 02:27 AM
better solution: use ollydbg ;)

I like OllyDbg, but it hasn't got the power like SoftIce !
In my opinion Softice is the KING !

So, we may exclude problems in the vendor's driver. Check again the two values in the registry... Maybe are you playing some "dirty" videogame which interacts with the video driver?

No, I'm not into playing games
bilbo
11-11-2004, 07:40 AM
better solution: use ollydbgMaybe he wants to learn some kernel internals, why not?

No, I'm not into playing games
I was just kidding...

So, just as a starting point, check the two keys I told you.

The first, "Ddraw", must be set to 1. This is the same as selecting the "Universal Video Driver" in DriverStudio Configuration -> Softice -> Video.
Select the Universal Video Driver (if it was not already selected) and check the value Ddraw. Set it to 1 if it sticks to 0.

Next...
There are two relevant values under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTice.

The first is named "InstalledDisplayDrivers": it is a list, semicolon separated, without extensions, containing all the drivers in your system which are DirectDraw compatible.
Normally the first is the real driver of your board, and the second (Windows XP) is RDPDD (RDPDD.DLL is the kernel module implementing the Remote Desktop Protocol - you don't need it normally). How can you find the name of your module? Go to ControlPanel->System->Hardware->Peripherals->Video Board->Driver->Details. Put it manually as first value if it is not in the list.

Another value is ExcludedDisplayDrivers. It has the same format of the previous and enumerates the modules not-DirectDraw compliant. On my system "VGA;MNMDD". VGA.SYS is the driver used by Windows in Safe Mode boot. MNMDD.DLL is used by Microsoft NetMeeting.

But you are saying that before something NTICE was working, and after something it was no more working. Can you remember was happened between 'before' and 'after'?

In any case you can always disinstall your graphic board (ControlPanel->System->Hardware->Peripherals->Video Board->right mouse button) and rescan (right button: detect hardware changes) in order to automatically reinstall video driver. Then you can see if NTICE starts again working.

Good luck, bilbo


Need help for Masm32
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help for Masm32
PDA

View Full Version : Need help for Masm32

Hero
11-11-2004, 11:45 AM
Hi All!
I'm looking for some basic debugger detection.I search here and other
forums and find some global ways for this reason.But when I try to use
some of these tricks,I get some problem that I don't know.
Perhaps someone can help me in these problems:
1-problem with fs:[30h] that i get in masm32 is:
error A2108: use of register assumed to ERROR
I don't know why because I get the full code from daemon.anticrack.de
This error accures on this code:
mov eax,fs:[30h]
then the application can't be Assembled.

2-problem with every direct call of INT command.for example the following
code from CrackZ:

MOV AH, 43h
INT 68h
CMP AX, 0F386h
JZ SoftICE_is_here

this one is fully Linked but the target exe file crashs in windows(XP).
or this code:
xor eax,eax
int 1
inc eax
inc eax
or eax,eax
jz found

Is there anybody who tell me what is the problem?
Question:
If you want to prevent simple debuggers use hook or this detections?

I searched and I don't find anything about this.Don't get mad!
I attach two asm file that I can't compile (one about fs:[30h] and the
other INT1 and need of an include file win32.inc that I can't find).
perhaps you can help me.

Sincerely yours
doug
11-11-2004, 12:19 PM
1.
add: assume fs:nothing

2.
side effect of 1. You need an exception handler. (#1)
Neitsa
11-12-2004, 08:41 AM
Hello,

As stated by Doug, you'll need an SEH to catch the INT. Here's a very good link about SEH and Asm programming on Windows:

http://www.jorgon.freeserve.co.uk/ExceptFrame.htm

You may take a look at the whole Jeremy Gordon site, it deserves it !

Regards, Neitsa
Lonely Wolf
11-12-2004, 10:05 AM
hi,
excuse me, however i think that the right place for this kind of problem is www.masmforum.com... i remember that this issue was already covered.

bye
dELTA
11-12-2004, 02:29 PM
Most of the big asm programming forums are very resistant to everything even remotely related to cracking, e.g. anti-debugger tricks and such...
Hero
11-14-2004, 08:50 AM
hi
thanks for all informations about SEH.
it was very usefull.

At the continue of my tests for finding a simple anti-debugging
trick,I found this simple one:

I get the parent process name of current process.If it is not
"explorer.exe",I say an debugger is running.

but after a while,I said myself what will be happen if debugger
renames itself to "explorer.exe"?I test it with ollydbg110,but
when I rename it to "explorer.exe" it crashs! :confused:

why this is happening after renaming?Is this a bug in ollydbg?

sincerely yours
sgdt
11-14-2004, 03:50 PM
You have to rename the contents of the DLLs as well. You will need a hex editor, and it'll be a little tricky because the word "explorer" is longer than "ollydbg". But, it can be done in about 20 minutes or less (when I got mine to be called explorer, it took about 20 minutes mostly because of all the plug-ins and testing).

Might I suggest something more reliable such as spawning a process that will attatch to you as a debugger and drive your code for something important, or inject some needed fragment or what not? That way, you'll be compatible with some of the after market "explorer" replacements (which, btw, aren't called "explorer.exe"), and you won't fall victom to anyone with a hex editor and 20 minutes free time...


Oh, this is funny...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Oh, this is funny...
PDA

View Full Version : Oh, this is funny...

dELTA
11-12-2004, 05:40 PM
Microsoft apparently used pirated software in the creation of parts of the Windows XP distribution, and the evidence is right there on the Windows XP disk (I just verified it myself)... :)

http://www.macwelt.de/news/szene/29407/

(sorry, only German language article right now, but just use a translator, or wait a few hours until this baby hits the fans internationally... :D)
Woodmann
11-12-2004, 08:15 PM
OMFG........:eek: I hope the translation aint true;)

Woodmann
tdennist
11-12-2004, 10:22 PM
Hope it isn't true?!

Dang man, I want it to be true :p. I am amused to no end by this article.
dELTA
11-13-2004, 05:02 AM
As I said above, I verified it myself, it's right there in the files alright, check it out yourself:

Look at any of the WAV-files in this dir in your Windows XP:

C:\Windows\Help\Tours\WindowsMediaPlayer\Audio\Wav

In the last bytes of the files, you will find the name "Deepz0ne", which is a founding member of the famous audio warez group Radium... :D
Silver
11-13-2004, 10:56 AM
Hehe, amazing. Not the first time MS have been caught out either, anyone here remember the "Netscape Engineers are Weiners" thing in one of the IE dll's? :D
lifewire
11-13-2004, 11:31 AM
hahahaha, I would call that funny :) (by the way, who on earth discovers this... i mean, these wav files are the last files on my harddisk i want to view with a hex-editor)
SL0rd
11-13-2004, 02:38 PM
I wonder if theres something similar at executable code level. That is "third part" code in the deeping sections of MS Apps, the Windows inclusive.
nikolatesla20
11-13-2004, 08:37 PM
Well duh, this is the advantage of closed-source code, who knows where it "really" came from? Ever see the movie Antitrust?

It wouldn't be that hard either, with appropriate cracker tools, to for example, rip code from an app you like, and create a new GUI for it, and sell your own alternative.

An what about those virus companies - perhaps creating the illness AND the cure? Who can really know?

-nt20
naides
11-14-2004, 07:25 AM
An what about those virus companies - perhaps creating the illness AND the cure? Who can really know?
-nt20

My paranoid self has been asking that question for some time.
Do you know what happens to McAfee and Norton sales every time some one scores big with a fast spreading virus or worm?

What about commercial software protectionists. Do they hate or love crackers and RCE?
Silver
11-14-2004, 09:07 AM
this is the advantage of closed-source code

Closed source? Depends how "closed" you mean...

L:\Download\MICROSOFT.WINDOWS.2000.AND.NT4.SOURCE.CODE-SCENELEADER

;)
tdennist
11-14-2004, 11:27 AM
It wouldn't be that hard either, with appropriate cracker tools, to for example, rip code from an app you like, and create a new GUI for it, and sell your own alternative.

Hmmm....so, potentially, with enough experience, I could rip the iPod transfer code from iTunes and make a Linux version?

My horizons sure are opening up :-D.
dELTA
11-14-2004, 11:55 AM
Yeah, sure, of course you can. While moving code between operating systems there are potentially a lot system calls and similar that would have to be translated in this process though, but I guess that's where the "enough experience" part comes in. ;)
doug
11-14-2004, 12:10 PM
What about commercial software protectionists. Do they hate or love crackers and RCE?
both. doublethink in full effect. The adversary is the cracker (at least according to their websites), yet ...

there's no reason to believe that they
- don't pirate their development tools
- don't download movies when they get home.
- don't crack & release competitor's product to make the other products look weak (and steal interesting protection ideas)

These things are still developed by humans, after all.
Woodmann
11-14-2004, 03:56 PM
:D
JMI
11-15-2004, 11:39 AM
And I thought the were still putting all those Chimps into a room with manual typerwriters and computer junk and they were still waiting for the next great novel and the next great innovation in software. :D

Regards,
nikolatesla20
11-15-2004, 12:25 PM
both. doublethink in full effect. The adversary is the cracker (at least according to their websites), yet ...

there's no reason to believe that they
- don't pirate their development tools
- don't download movies when they get home.
- don't crack & release competitor's product to make the other products look weak (and steal interesting protection ideas)

These things are still developed by humans, after all.

Yes, I've wondered from time to time if all these "holier than thou" developers that put such strong anticrack words out there really own their developement software.

-nt20
SL0rd
11-15-2004, 01:16 PM
All these discussion could have a big end if all soft. related people in the world change their view forward open source development. All of us know that is perfectly possible make money with open source and after all software is something that "everyone" is able to put their hands and work with, making changes that he/she like.
No more fear, ideas is something that must be owned by humanity. After all nobody is owner of original work, so nobody must believe to be owner of something!
dELTA
11-15-2004, 05:28 PM
Ok, easy there now Stalin... :p
disavowed
11-15-2004, 10:03 PM
What about commercial software protectionists. Do they hate or love crackers and RCE?
both. doublethink in full effect. The adversary is the cracker (at least according to their websites), yet ...

there's no reason to believe that they
- don't pirate their development tools
- don't download movies when they get home.
- don't crack & release competitor's product to make the other products look weak (and steal interesting protection ideas)

These things are still developed by humans, after all.
Plus, no one would buy their products if it wasn't for crackers. If crackers didn't exist, the shareware developers wouldn't need any fancy protection system.
Silver
11-16-2004, 05:13 AM
False argument IMO disavowed. If crackers didn't exist, there would be no protection. So we're back in the 1980's when people just "borrowed" floppies from each other. Which is what caused the creation of copy protection. Which is what created crackers. So it's a vicious circle.

All together now: "Don't copy that floppy!" ;)
dELTA
11-16-2004, 06:34 AM
Hehe, and for the people who don't know what Silver is referring to with that quote:

http://fnarg.com/floppy.html

:)
disavowed
11-16-2004, 10:09 AM
Actually, it's not a circle. There's a difference between copy-protection and cracker-protection. Most shareware coders can write copy-protection, but can't write cracker-protection. The cracker-protection is what's (supposedly) offered by the commercial software protection products.

If a shareware coder can implement copy-protection and there were no crackers, then no one could illegally copy the shareware, and thus there is no circle.
Silver
11-16-2004, 12:44 PM
Hm, but if we step back 15 years. People were copying floppies, and there were no crackers because there was nothing for them to crack. A few years on and protection started to appear to stop people copying. The challenge of defeating this protection is what created crackers, thus I think it's fair to say that creation of protection caused creation of crackers. There was definately an evolution though, through trainers and bootloaders (eg, fairlight's amiga bootloaders/trainers etc)...

I guess all the crackers were always here, they were just doing something else for a challenge. When copy protection appeared, they thought it would be fun to start on that.
Woodmann
11-16-2004, 04:54 PM
Howdy,

Interesting discussion. What came first, the cracker or the egg :p

Woodmann
JMI
11-18-2004, 01:04 PM
Or the broken cracker or the omelet? :D

Regards,


Clarification of breakpoint contexts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Clarification of breakpoint contexts
PDA

View Full Version : Clarification of breakpoint contexts

ss-2
11-12-2004, 10:56 PM
Hi,

I realise that I am going over some of the material that has been covered in the FAQ's, but there are some points that I don't fully understand and need to clarify ... so pls hang off on the flames until you've read the entire post ... :) (and if you think I should have been able to find the answer ... fire away)

I am a newbie and at the moment I can't get SI (SI405WNT in a W2K environment) to trigger any bpx that I set.

SI installed fine, and the exports work, I don't have any video issues - so I'm quite happy with my SI installion except for the fact I can't get my bpx's to work (not one!)

I have read the thread about DriverStudio (I gather this is a later release of SI - which is a package that includes the SI module), and I understand the concept of - if you like - "global" bpx via BreakInSharedMods, unfortunately my version of SI doesn't support this setting.

However there is also a discussion of setting the context via the addr command before then setting the bpx (in fact my SI doco talks about this - page 97 - but only briefly).

My version of SI does support the addr command, and I appear to be able to change contexts (I can see the context change). What concerns me though, is that when I exit (F5) and the return (Ctl-D) the context change is not "remembered".

Also where I have attempted to set the bpx after first changing the context with an essay (i.e. a known program and a known bpx) the bpx still doesn't trigger for me ... which means either:

A. I'm doing something wrong in setting the context and/or the bpx in that context ... or

B. Unfortunately SI405WNT doesn't actually work with W2K (it looks like it works, but it doesn't really).

(this is what I would like to clarify A. or B.)

My other options are:

1. Find DS3.1 ... yes well I've tried that - and for now I think it will be easier to work with SI405WNT (provided that this is in fact possible)

2. Switch to W95 / W98. Many of the essays I've read so far are based on this platform, so there is an argument for that, plus I would have access to hmemcpy ... however these platforms are really not my preference (they tend to go AWOL far too much IMO). Last resort option.

3. Maybe try NT4 (just thought of that now, writing this post)

Apologies for the long-ish post, if you're still awake, thank you for reading.

ss-2
Kayaker
11-13-2004, 02:30 AM
If you break at the start of a program with the Sice loader (assuming you can), and set a breakpoint say a few lines down, either on an address or an API call - does SI break? It should. Make sure you set your bp *while in the context* of the app you want to break into.

This is irrespective of the ADDR command, which you shouldn't have to use since you're already in the correct context. In other words, don't expect to be able to just change the context with ADDR from the desktop and have a reliable bp set. If you do, you also need to specify the CS: portion of the address else you'll set up a bp with the wrong code segment.

If all else fails, you could try BPM x breakpoints, they can be more reliable than BPX bp's for "sticking". However, they especially should be set while *in* the context of the app.
ss-2
11-13-2004, 05:27 AM
Hi Kayaker,

Thank you for responding.

If you break at the start of a program with the Sice loader (assuming you can), and set a breakpoint say a few lines down, either on an address or an API call - does SI break? It should. Make sure you set your bp *while in the context* of the app you want to break into.
Yes, this works.

This is irrespective of the ADDR command, which you shouldn't have to use since you're already in the correct context. In other words, don't expect to be able to just change the context with ADDR from the desktop and have a reliable bp set.
I don't follow you here. The only way I know to get SI into the correct context is via the ADDR command, SI initially always defaults to IDLE.

Also, when I switch into SI, SI is always in full screen mode - I can't access SI from the GUI (which is what I assume you mean when you refer to the "desktop").

If you do, you also need to specify the CS: portion of the address else you'll set up a bp with the wrong code segment.
Um, if this is important, can you clarify.

If all else fails, you could try BPM x breakpoints, they can be more reliable than BPX bp's for "sticking". However, they especially should be set while *in* the context of the app.
This would be a lot harder though, because wouldn't this mean that I'd have to "convert" my BPX breakpoints to BPM's (which means I'd have to locate the calls in the program)? ... I'm not sure that I'm following you correctly here.

The difficulty is that because I'm just starting out, I don't have a "baseline" for what is normal behaviour. So for instance when I am trying to follow an essay and the BPX doesn't work as it should, I don't know whether this is because I have goofed up somewhere (entirely possible at this stage) or whether it's because my configuration isn't working 100%.

Incidentally the other thing I noticed when I was setting the BPM as a test. The first thing I did was use ADDR to set the context to Notepad (which it did). Then I switched up to the Code window to scroll a few lines to find a Call, the ADDR context switched back to IDLE (i.e. each time I toggled to the code window the ADDR context changed ... which to me seems odd). Is it?

You probably were not expecting so many questions in my reply, sorry at this stage I'm still on a steep learning curve. The main thing I want to try and establish is whether SI appears to be working properly or not (I don't know enough to be sure one way or the other). It certainly is very stable, but I'm not sure that it is working the way that it should.
naides
11-13-2004, 06:17 AM
Hi,

I am a newbie and at the moment I can't get SI (SI405WNT in a W2K environment) to trigger any bpx that I set.

SI installed fine, and the exports work, I don't have any video issues - so I'm quite happy with my SI installion except for the fact I can't get my bpx's to work (not one!)

. . .and I understand the concept of - if you like - "global" bpx via BreakInSharedMods, unfortunately my version of SI doesn't support this setting.

Also where I have attempted to set the bpx after first changing the context with an essay (i.e. a known program and a known bpx) the bpx still doesn't trigger for me ... which means either:

A. I'm doing something wrong in setting the context and/or the bpx in that context ... or

B. Unfortunately SI405WNT doesn't actually work with W2K (it looks like it works, but it doesn't really).

As Far as I remember:

1.SI 405 DID work inW2k. It is the NT version right????

2. The address context issues started being a problem with Sice 4.27 or SI 4.30. Before then, All API bp (like bpx messageboxA) were "global" ie address context independent by default.

3. I think your problem may be somewhere else.
4. Did you modif the winice.dat to include all the system dll modules? (just checking).

The test Kayaker sugests is:

Load notepad using the symbol loader,
Sice will break at the program entry point.
Place a bpx in an instruction just a few lines down, where you are SURE the program is going to go through. .
To avoid mistakes use the mouse double click to select the isntruction, it should change color, then type the command bl to make triple sure the bp is selected. . .
Then leave sice by pressing F5.
It should break in your selected inst right away...
ss-2
11-13-2004, 06:52 AM
Hi Naides,

As Far as I remember:

1.SI 405 DID work inW2k. It is the NT version right????
That's correct.

2. The address context issues started being a problem with Sice 4.27 or SI 4.30. Before then, All API bp (like bpx messageboxA) were "global" ie address context independent by default.

If you're right about that, then I definitely have a different problem. Hopefully someone else will clarify this point though.

In the SI manual it states the following:

.."For WIN32 applications, breakpoints set in the upper 2GB of address space are global; they break in any context. Breakpoints in the lower 2GB _are_ context sensitive" ...

On this basis my guess is that context are not global (as I don't have 2GB of memory), and it's unlikely to be paged either.

4. Did you modif the winice.dat to include all the system dll modules? (just checking).
Yes, I understand that, and I have.

The test Kayaker sugests is:

Load notepad using the symbol loader,
Sice will break at the program entry point.
Actually I don't know that I did this exactly. I loaded notepad, then switched into SI. How would I "load notepad using the symbol loader?" ... do I need the nms files - because I don't have them I'm just exporting dll's.
Place a bpx in an instruction just a few lines down, where you are SURE the program is going to go through. .
To avoid mistakes use the mouse double click to select the isntruction, it should change color, then type the command bl to make triple sure the bp is selected. . .
Then leave sice by pressing F5.
It should break in your selected inst right away...
I did this bit OK, but we tested a BPM (not a BPX).

I think the easiest test might be to a BPX on something that is easily reproduced, for instance the OK button in the "About" dialog box in Notepad. If that works, then my SI is functional, if it doesn't - then SI is broken. I have tried a few BPX's already that haven't worked (but that could be because I'm not checking for the correct API for the button)
naides
11-13-2004, 12:22 PM
If you're right about that, then I definitely have a different problem. Hopefully someone else will clarify this point though.

In the SI manual it states the following:

.."For WIN32 applications, breakpoints set in the upper 2GB of address space are global; they break in any context. Breakpoints in the lower 2GB _are_ context sensitive" ...

On this basis my guess is that context are not global (as I don't have 2GB of memory), and it's unlikely to be paged either.

The upper 2GB addresses are assigned to the system modules and services. The lower 2GB addresses are where your app main module and the specific dll it loads are located. This is the way memory is mapped. it is virtual memory, and has nothing to do with the actual RAM you have installed in your computer. Taht is the size of the memory space your application addresses at a time.

Actually I don't know that I did this exactly. I loaded notepad, then switched into SI. How would I "load notepad using the symbol loader?" ... do I need the nms files - because I don't have them I'm just exporting dll's.

in the Numega or compuware folder, you will find severeal files, including one exe file named symbol loader, and several pdfs on using softice. Read the helpon those files.
symbol loader allows you to load an exe file: notepad.exe, then click on module-> load, it will complain about a mistake,, just keed giong then, if you set up the option "break on winmain" in Symbol loader program, Sice will break.
ss-2
11-13-2004, 08:24 PM
Hi Naides,

in the Numega or compuware folder, you will find severeal files, including one exe file named symbol loader, and several pdfs on using softice. Read the helpon those files.
Yeah the trouble is that the doco is assumes that the reader is well acquainted with debugger concepts, which is fair enough SI isn't a newbie program, but I'm a newbie to debugging so I read the doc and try to follow it.
symbol loader allows you to load an exe file: notepad.exe, then click on module-> load, it will complain about a mistake,, just keep going then, if you set up the option "break on winmain" in Symbol loader program, Sice will break.
I did this OK, the "break on winmain" option was selected by default. When I then "load the currently open module" Notepad starts as normal. Now given that the "break on winmain" option is selected, shouldn't I break into SI straight away? ... I don't, I stay in the GUI with Notepad running 'business as usual'.

I also tried loading another program via the symbol loader and then setting a bpx on a known api for that app, and it still doesn't trigger either?

ss-2
ss-2
11-14-2004, 06:19 AM
Hi Naides / Kayaker,

I decided to setup NT4 and install SI on that and see if it made a difference, it did, and now SI works properly (finally bpx works!).

Ironically, as I mentioned when I originally installed SI under W2K I didn't have any setup problems, and I have noticed in my troubleshooting that a number of people have had issues getting SI to work properly (mostly under WXP).

With SI installed under NT4, the system hangs as it loads the GUI if the startup mode is anything other than manual. I tried using the standard VGA, but it didn't make a difference. It doesn't really matter anyway, manual startup will do. Also I noticed that the version I am using is supposed to work under W2K ... who knows ... shit happens.

Appreciate your assistance, thank you.
HX0
11-27-2004, 07:19 PM
If you break at the start of a program with the Sice loader (assuming you can), and set a breakpoint say a few lines down, either on an address or an API call - does SI break? It should. Make sure you set your bp *while in the context* of the app you want to break into.

This is irrespective of the ADDR command, which you shouldn't have to use since you're already in the correct context. In other words, don't expect to be able to just change the context with ADDR from the desktop and have a reliable bp set. If you do, you also need to specify the CS: portion of the address else you'll set up a bp with the wrong code segment.

Hi

This advice seems to contradit the FAQ on ADDR at http://www.woodmann.com/fravia/rce-faq.htm
e.g. > A simple 'addr process-name' should work.

// Introduction:

I am a long time amateur user of Softice on 9x who has recently attempted to debug/reverse an app which only runs on 2k onwards. Serious problems have ensued ...

Installing on XP would in theory work except that I have never, nor have I ever met anybody who has ever succeeded in getting Softice to do anything with XP except crash it one way or the other.

The only version I could get working at all on Win2k was 405. (The later versions with DS 2.7 and 3.1 had dire keyboard and video problems on Win2k which despite numerous patches and days of rebooting, i was unable to circumvent.)

After several days (no exaggeration) of attempting to get SI running on 2k, several OS installs, and hundreds of reboots, I am now on Win2kProSP4 5.00.2195, with SI Ver 405 build 334 and a decent set of NMSs and exports loaded. (even now, I only have video working with SI in Boot mode, any other startup setting crashes ....).

A comment which I believe justified at this stage is that Softice is an extremely buggy application in sofar as its support for both Win2k and XP users is inexcusably atrocious. It literally does not do what it says on the tin under these OS's. This is alpha-quality software. Heaven help anyone who actually pays for it.

// End Intro/rant

I notice that breakpoints do seem to work if I double-click in the Code window in code that already happens to be running when I press CTRL-D (Usually somewhere in HAL.) However, setting BPXs in any other way seems to fail.

Regarding the question in this thread about Symbol Loader, I *never* was able to get any app to break on load under 9x using Symbol Loader. The only prog that would ever do that for me was the modified IceLoad version, which worked perfectly. Under Win2k I find neither Iceload or Symbol Loader will break Notepad on starting it.

Similarly to the comments above I am unable to set the Environment variable to enable global breakpointing (SI reports the var does not exist, apparently it is not in this ver 405)

Using Notepad as an example, I receive an unusal error in Symbol loader:

=========================
G:\WINNT\NOTEPAD.EXE opened successfully
Translating G:\WINNT\NOTEPAD.EXE. . .
Error: Unexpected exception

I select the option to Load Anyway. Notepad loads and is available under ADDR although the default context is set to IDLE.

My attempts to set BPs on system functions have also failed. SI appears to be broken in its breakpoint function

I would be very grateful if anyone could explain how to go forward re. breakpoints in this scenario.

I have tried
addr System
bpx _CreateFileA

but that never fires.

Perhaps there is some other test I could use in order to make some progress towards enabling a working BPX functionality in this scenario?

The target app is an NT service which does not run from its .EXE file and only runs when started from its Services entry. I can see it in ADDR, I can set ADDR to its context, and even better the author was nice enough to leave a .PDB file next to it therefore I have translated to NMS and have a full set of symbols accessible via TABLE and SYM. Perhaps if I could identify the Code Segment for the app, I could manually enter this into the BPX command?

Thanks in advance for any suggestions or clarifications.
WaxfordSqueers
11-27-2004, 09:46 PM
Hi

This advice seems to contradit the FAQ on ADDR at http://www.woodmann.com/fravia/rce-faq.htm
e.g. > A simple 'addr process-name' should work.

I have to apologize for the rust, I haven't done this for some time. Also, the following may not be entirely accurate, although it's in the ballpark.

The addr instruction is not something you should have to use under normal circumstances. If I get correctly what Kayaker is saying, it's that the context refered to must be the app you're debugging.

The term context, in the way it is used in Sice, means a memory space.
If you watch the process as Sice works, it begins in the app you're debugging. Then it might go off to dll's like MFC42.dll, or other dll's not belonging to the app, returning to the main app when those routines are finished. Where it goes off to is another memory address, where those dll's are loaded. That's mainly what is going on as an app executes. The operating system, and the underlying processor support, are contunually swapping code and data in and out of memory and to and from the hard disk.

Those are different contexts because they belong to different programs, hence a different memory space. But, the physical memory space is common, and an area of physical memory could be shared. I'm not talking about the logical memory here, in which each app has it's own space. Logical memory has to be mapped to physical memory, and that is done in a transparent manner to the user or the programmer.

If you set a bpx while your in another dll, that memory space could be reassigned by the time Sice gets around to executing the bpx, because the main app has no control over that. So, if an app is addressing a memory space (context), then you set a bpx in that space, that memory must be under control of the app. If it's not, there's no guarantee that memory to which the bpx is assigned, will be valid next time the app executes.

When an app is loaded into memory, it is assigned it's own memory space, which remains consistent throughout the execution of the program. That is the app's context, and that is the only context in which you can reliably set bpx's...in it's own memory space. When Sice executes a BPX, the address pointed to by the bpx must make sense. If it points to a memory address that was good when you set it, and which doesn't exist when time comes to execute it, the bpx wont trip.

My understanding of bpx's, as related to Sice, is to set them according to the window you are in. Look at the bottom of the code window and it will tell you which program the code belongs to. That, to me, is the context. There's no point in me setting a bpx on the very first instruction of a program if I set it from within the app while it's running. It will never reach that instruction. The only way I can do that is to set it from within the Sice loader.

Someone mentioned earlier in the thread that they set it to winmain. That is not the first instruction in the program. There's a lot of code before winmain, and you need to be right at the beginnng of the proggy sometimes in order to trace into it. That's especially true for self-modifying code and packed programs. When you use the loader, tell it to stop at the first instruction. When you do that, it often looks like something messed up. Just trace into the app one step and the code will straighten itself out.

Certain dll's are always found in the same memory space. System dll's likie kernel32, user32, etc. are always in the same space. However, if you set a bpx in them, in the wrong context, the bpx will trip erratically. For example, if you set a bpx in kernel32 while you're in an app, then you reload the app, the bpx will trip any time another app calls kernel32.

All the other apps use kernel32 as well. So, as you reload your app, any app used in the reloading process, that uses k32, will trip the bpx. The context in which you set the bpx was in the context of your app while it was running. Once you exit the app, in order to reload it, the context has changed. K32 will be accessed from a different context.

You have to be really careful to get into the correct context before you set the bpx. Sometimes you have to set other bpx's to get the app to run to a certain point before setting the bpx you want.
HX0
11-28-2004, 08:38 PM
Thanks for input. To debug the running service I gave up on ice and went for Visual Studio debugger which seemed better. I have started a new topic/question about it.


Location of l_sg v6.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Location of l_sg v6.1
PDA

View Full Version : Location of l_sg v6.1

rogger123
11-13-2004, 07:45 AM
Hi,
I am a newbie this is my first attempt. I have given it my best shot so if i have gone wrong somewhere please advice. My aim was to get the seeds and vendor codes for a target which uses flexlm 6.1(lmgrd325c.dll)
I adopted the procedure outlined in "Making Tools Work Together Original document created January 6, 2000 Version 1.1 written by Nolan Blender" & "Flexlm v6.1 lc_new_job() Written by dan". The sad part is I have flexlm8.4SDK.As outlined in the essay I first generated the signatures for all the .LIB files under the "flexlm\v8.4\i86_n3" directory. then disassembled the .dll using IDA4.5 and applied the signatures. The problem is i still cannot locate "l_sg",lc_new_job,good_lic_key,l_ckout_crypt . It just doesn't show up as a label(function) for the above. I saved this as a map file in IDA. I then converted the map file to .nms. I loaded this along with my Target. I have tried really hard and am new to this can some one please throw some light on my mistakes.

Sorry for not mentioning I have searched the forum for "Flexlm6.1" and "load symbols".well i can see all the symbols in softice and am able to put break points on them except for the call to the above mentioned functions.
can someone please advice me if i am going in the right direction??
Is there any other essay reading on flexlm6.1 that I need.


iTunes + SICE. Will it ever be?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > iTunes + SICE. Will it ever be?
PDA

View Full Version : iTunes + SICE. Will it ever be?

tdennist
11-14-2004, 09:34 PM
http://www.woodmann.com/forum/showthread.php?t=5093&highlight=itunes

This thread turned up when I searched for "itunes." However, there doesn't seem to be a solution attached to it. Does anyone have any more information on this? iTunes really is a big part of my computer life, because I listen to music a lot. I could potentially switch to Winamp, but there are two problems with that: 1) I absolutely hate the UI. It's near impossible to find a song that I like in a straight list of them! (1077 songs). 2) Winamp (as far as I know) doesn't support transfers to my iPod.

So, I am in need of a solution. The solution could come in two forms: 1) Point me to two software alternatives for iTunes (one for music playing, and the other for iPod transfering.) 2) Point me to a tutorial/howto/whatever on how to...er..."fix" iTunes.

Thank you!
evn
11-15-2004, 01:30 AM
The Winamp Media Library (non-lite winamp versions come with it) is very easy to navigate, you choose the artist, and it lists albums, choose the album, it lists the songs. You can type whatever song title you want into the search bar at the top, and it'll list all songs matching the criteria. I believe it even supports regular expressions. ALT+L opens the media library, if you have the full package and want to test.

As for winamp->ipod transfers, theres a plugin available on www.winamp.com which allows just this. I'd take a look around at the reviews and comments before installing and using it however, as it'd suck to lose the contents of your ipod for whatever reason.

Link to the plugin is http://www.winamp.com/plugins/details.php?id=138888
Link to the plugin's homepage is http://www.harrison-fisher.co.uk/mlipod/index.php?page=home
Radialen
11-15-2004, 07:31 AM
If you want a really neat thing to organize and listen to your music check this out:

http://www.giantdisc.org/

It won't help you with your Ipod though...
tdennist
11-15-2004, 04:50 PM
Thanks, guys, for your quick replies. These suggestions have solved all of my problems! Thanks very much.
|azy|eg
12-11-2004, 08:47 AM
Hey, had the same problem with softice and Itunes, but after i installed IceExt 0.65 i havent had problems running Itunes when i have Softice started.


Biting back on SPAM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Biting back on SPAM
PDA

View Full Version : Biting back on SPAM

nikolatesla20
11-15-2004, 06:44 AM
In theory, a lot of the SPAM e-mail we get now comes from worms and virii that have installed themselves on peoples systems, and act as a relay. It's very rare to find an actual open realy email server nowadays (although I'm sure they do exist).

I've spent some time a few months ago tracking down every IP address in my spam inbox, and trying to telnet to it on various ports, in the 'hopes' of maybe finding that spam backdoor. A LOT of these IP's were residential IP addresses (quite a few have dsl.xxx.xxx names ! )

What is your opinion or ideas on this matter? Shouldn't it be possible in some way to trail this spam back to the source and somehow find out who is accessing these zombies, or at least shut down the zombies? Maybe you could flood all the zombie machines you find? Perhaps do a scan for all the latest worm ports until you get a response - (and possibly take over someone's botnet or mail zombienet !)

Also, even with every variant that comes out, most likely they are set to send information to another new location, if you're quick enough maybe you could IDA the sucker and find out where, and get all those addresses yourself. Perhaps use the emailers for your own little reasons even ( a little of the dark side, I know).

Got any thoughts?

-nt20
FoolFox
11-15-2004, 07:20 AM
What is your opinion or ideas on this matter? Shouldn't it be possible in some way to trail this spam back to the source and somehow find out who is accessing these zombies, or at least shut down the zombies?

Shutdown the zombie ? I totally disagree with that point of view. To do
so you'll need at a certain level to gain a control on the server. Meaning
hacking into it to get those privs.

Imagine that I am an admin of a mail server. Or any kind of server that
could be tweaked to do some relay. (I'm not but I've been in this position).
Following a 'hack', the server run as an open relay.

Having someone of the outside came and shutdown the server may
lead to an official complain. The fact that someone abuse of the server
to do is mess (i don't like spamming neither...) is certainly not an
excuse for you to shut down the server. You could cause far more
severe damage than the previous abuse. And you'll be legally responsible
of this.

If you happen to find such sort of server, in my mind the thing to do
is to try to contact the administrator or anyone involved with the
adminsitration of the server to at least, let them know the trouble
they are in. You can even think of helping them if they don't feel
confident in repairing the thing. But I wouldn't go in a 'retaliation'
way, as you'll only hurt people that already are victims.

FoolFox
Woodmann
11-15-2004, 04:25 PM
Howdy,

I have done just about everything you can possibly do to stop my spam.
Emailing abuse does not work because most of the time no one reads your complaint. And if they do they dont understand how to read a header file.
I get complaints sent to me by different mail admins all the time complaining about virii being sent from this server. They cant even see that the originating ip does not match the domain name.

I think that when you click on the link in the spam email to get "removed" from the list, you are only verifying that it is a valid email address. Mail filters do some good but are nowhere effective enough.

The other thing is that spam is relayed through so many servers that it becomes difficult to track down who is responsible.
If everyone disabled the ability to relay mail, it would be a great help.
Sadly, the free mail people cant because it needs the advertising revenue.

Bottom line- admins need to get their heads out of their asses and free mail services need to put some safe gaurds in place.
The only results I have ever received are from upstream providers.
Show them that the spam is coming through their routers/servers and they tend to do something.

My 7 cents worth,
Woodmann
Silver
11-16-2004, 05:10 AM
http://spf.pobox.com is one of the many efforts to try and stop spam. It's going to cause quite a few issues too.

I get huge amounts of spam too, upwards of 150 spam mails per day. Bayesian filtering mostly deals with it - SpamBayes (check Sourceforge) is a great Outlook plugin. It's annoying, but there's nothing we can really do. Mail relaying is an essential service, and targeting relayers won't solve the issue. We need to target the people running insecure machines on the net, which spammers use. For example, smtp.isp.net is a relay that is only accessible to isp's customers - it can't be directly used by spammers. But if a spammer takes a machine belonging to isp's customer, the spammer can use it. In that case the problem is not the relay, it's the end pc.

I have to say I agree with Foolfox. Security is what I do, and hypothetically personally I would be very unhappy if someone tried to root one of my boxes because it was badly configured. From a business and security point of view I'd be more pissed about the hack attempt (which is an attack on me) than the screwup over the open relay (which isn't an attack on me, it's an inconvenience for others). I'd never leave an open relay though ;)
nikolatesla20
11-16-2004, 11:49 AM
I never meant "root on of the servers", or take over the machine. When I said shut down I meant if you could figure out the commands that the virii - planted email relay program responded to, you could send the command to tell it to shut down.

I went thru my entire email bulk folder one day, and tried to ping and then whois each IP address. About 80% of them were addresses assigned to a ISP, and they were not a mail server (I did find some mail servers, but not very many). Which means tons of people out there are still getting mail relay worms and virii. That's my point. If you get one of these virii, you could RCE it and then figure out it's command structure, and possibly sweep a few subnets to tell any worms to shut down, or at least clog them up so the spammers themselves can't use them.

That is what I was talking about guys !

-nt20
Silver
11-16-2004, 12:59 PM
Ahh, similar to the CodeBlue virus, which targetted CodeRed infected IIS servers and patched the vuln. Although it wasn't all nice...

http://virus.daguru.org/codeblue/codeblue.html

"As a result of above the worm disables security breaches that can be used (or were used) by other worms to infect the machine or/and hackers to break through Web security protections"
nikolatesla20
11-16-2004, 02:24 PM
Except it wouldn't be a virus, it would be more like a network scanner that shuts down virii.

For example, one could feed it a list of spam email headers and it would go to work, scanning thru the IP's and bruting thru the various virus communication backdoors to shut them down. (In other words, going thru an internal list of different virii ports, and commands, etc, for each IP to check to see if that IP had a virii or worm to be shut down).

So more of an active sweep, like a white blood cells - when they get notification of an infection, they sweep the area to remove it, or at least identify it.

-nt20
TBone
11-16-2004, 03:33 PM
I just went through all the scum collected by my company's various filters and starting tracing it back. I did see some mail coming from zombied machines, but that wasn't the bulk of it. I'd say easily 70% of it was coming from rogue ISPs in the U.S. who deliberately provide bandwidth for spammers. I have some personal experience this because the company I work for was once hosted by an ISP who sold out to the spam interests. We were getting blacklisted by all the major players becuase our IP address was in one of the subnets used by Eric Reinertsen.

"Funny" story, though - I didn't know he was on our subnet at the time I set up our mail server. I was jacking around with it some time after midnight. I don't recall exactly what I was doing, but I was having trouble getting the thing to work, and to narrow down the problem I momentarily disabled authentication for relaying, but still had it set to only relay mail from our own private IP network (i.e. 192.168.XX.XX). I got up to get a cup of coffee, and I shit you not - by the time I got back to my desk, the server had nearly 150 open outgoing mail queues to all over the world. I killed the mail server fast and checked the logs. Fortunately only 17 messages had actually been successfully sent in that ~3 minute chunk of time. I never have figured out what exploit was being used, because the logs didn't make any sense:

About a minute before the outgoing connections started I see:
2004-05-24 6:24:56 64.119.196.66 - QUIT - - 240 185 4 140
2004-05-24 6:24:56 64.119.196.66 - QUIT - - 240 185 4 797
2004-05-24 6:25:00 64.119.222.252 - QUIT - - 240 119 0 4047
2004-05-24 6:25:00 64.119.196.66 - QUIT - - 240 119 0 4047
There had been no previous communications with those hosts, it was just an isolated probe of some kind. 4 seconds later, the shit hits the fan and the server starts making hundreds of outbound connections all by itself (i.e., they weren't relay requests - it just starts spewing on it's own accord). At 6:28, I shut the mail server down, closed the relay, flushed the queues, and started it back up. The spamming stopped.

What's cute is that 64.119.196.66 and 64.119.222.232 both belonged to fellow iWay "customers" with bulk-mailing operations.
hxxp://www.spamhaus.org/sbl/sbl.lasso?query=SBL7188
hxxp://www.spamhaus.org/sbl/sbl.lasso?query=SBL9538
hxxp://www.spamhaus.org/sbl/sbl.lasso?query=SBL19042

They must have been continuously trolling their own ISP's WAN for open relays to have caught it that fast.

We wrestled back and forth with the ISP trying to get them to fire the spammers, but it quickly became obvious that the spammers were their bread and butter. They also apparently had absolutely no fear of legal action, because these guys were clearly raping their other clients.

Anyhow, that was kind of a long diversion. Probably the other 30% of our spam (and getting higher by the day) is coming from APIC networks. I know a number of sysadmins at other companies that finally got pissed off enough to just mass ban every netblock allocated to APIC. You kind of hate to do something like that, but you can't really blame them.

Every now and then I'll get a few really oddball originating IPs like mail coming from unallocated IP blocks, or from blocks that are supposed to be allocated to the U.S. military.

Personally, I think any method that tries to stop them from delivering their mail will only inconvenience them in the long run. Shut down a few zombies, and they'll just make more. The ways of spewing their garbage are legion. Get them booted from one ISP, and they already have 5 others waiting in the wings. Pass hardcore draconian anti-spam legislation, and they'll just start broadcasting from Maylasia, Pakistan, etc. You have to get at the source and make them stop, but I don't know any way to do that short of vigilantism. I guess you could start with trying to find the ultimate source of their operations and start trashing their data every chance you get.
nikolatesla20
11-18-2004, 12:49 PM
Thanks for the comments TBone. Yeah, I've seen a lot of APIC addresses too.

Most likely they probably are just sitting right on top of a mailer waiting for that relay to open up.

-nt20


Nice paper, reverse engineering a virus
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Nice paper, reverse engineering a virus
PDA

View Full Version : Nice paper, reverse engineering a virus

dELTA
11-15-2004, 06:10 PM
Quite a nice (and big) paper about a full reverse engineering of the Bagle worm to C source code. Also contains good reversing info in general for newbies and up.

Reverse Code Engineering: An In-Depth Analysis of the Bagle Virus:

http://rozinov.sfs.poly.edu/papers/bagle_analysis_v.1.0.pdf
Opcode
11-15-2004, 06:48 PM
Very nice paper.
Thanx for the link! :yay:

Regards,
Opcode
lifewire
11-16-2004, 11:04 AM
Indeed, a nice paper. Only one thing that surprises me is to see that even the guys that can write a paper like this, use dysfunctional comments like:

jecxz loc_1234 ;jump to loc_1234 if ecx is 0

and such.
Kayaker
11-16-2004, 11:57 PM
...and then there are the dysfunctional comments (and some good ones) about the paper at

http://developers.slashdot.org/article.pl?sid=04/11/15/1315208&tid=220&tid=156&tid=172&tid=1


game training
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > game training
PDA

View Full Version : game training

tdennist
11-15-2004, 07:46 PM
Can you guys point me (and future readers of this thread) towards some good (in your opinion) game training tutorials? I've located *many* through the magic of Google, but the problem is they always seem to be written by either people whose primary language is not English or 14 year olds with no grammar. I'm looking for fairly comprehensive ones, as I've done not much in that field, so ones that skip over large parts of it because the author forgot that he knew it and the reader doesn't necessarily are not very helpful.

Thanks.
Tacman
11-16-2004, 12:44 AM
http://www.sheeprec.cjb.net/

http://www.gamehacking.com/
Silver
11-16-2004, 04:43 AM
What are you trying to do, precisely? Basic game training is no harder than normal cracking - in fact, it's usually easier as commercial games have plenty of copy-protection but not much data-protection (excluding MMORPGs). All you're looking to do is to find the triggers that change values - health, armour, bullets etc.

However, if you're trying to do the more advanced game cheats (such as wallhacks and OGC I think it's called for Halflife), then you're a) going to need a good understanding of reversing, b) going to need a good understanding of windows hooking, and c) going to need a good understanding of the API's used by the game (DirectX, OpenGL etc). There is at least one thread in the beginners or advanced forum about this, and one thread in the projects forum where we were doing some DirectX injection. Unfortunately I've been so busy recently I haven't had time to get restarted on that.
tdennist
11-16-2004, 06:19 PM
Tacman: Thanks, I'll check those out :-).

Silver: No, nothing advanced quite yet. Pretty much what I *really* am in need of is the tutorial of how to actually create the code for the trainer. I'm pretty good at the whole idea of using a memory searcher (I use TSearch, for all those people reading this who need some information) to isolate the memory addresses of particular values, and then using SoftIce to find the code related to those. I do need more practice at spotting the code used to change the values, though.
So no, nothing really complicated quite yet :p.

edit: I just read a few tutorials on one of those links Tacman gave me, and I've discovered that I really really need a tutorial on how to actually code the trainer. I.e. making a program that changes game code. I'd prefer to code it in assembly, because it's easier than C, but if someone could point me to a well written tutorial for either, I would be eternally grateful.
dELTA
11-16-2004, 07:47 PM
I think you need to ask more specific questions than "How do I code a trainer"... You must have understood something from those tutorials yourself, right?
tdennist
11-16-2004, 08:57 PM
Haha, I didn't mean to imply that my question was "How do I code a trainer?". Yes, I have learned quite a lot from those tutorials. The problem lies in phrases such as these: "now that you've found the address, all you have to do is make your trainer poke the new value into it." Helpful. What's the code framework for that? What language? Things like that are what I need answers to.
doug
11-16-2004, 09:01 PM
check the links in:
http://www.exetools.com/forum/showthread.php?t=4108&highlight=trainer

For example,
http://pc.nanobot2k.org/
has some in the articles & my work sections (Nanobot2k C Trainer Engine)
dELTA
11-17-2004, 05:22 AM
You will also find a lot of info on this board about injection of code and data into other processes. It is the same technique used for loaders (but even easier, since you can most of the time skip the debugging loop part completely, only doing the data poking directly), which you will e.g. find a good example of in this thread:

http://www.woodmann.net/forum/showthread.php?t=5107

And here are some other old local favorites:

http://www.woodmann.com/fravia/natz_mp2.htm

http://www.woodmann.com/fravia/stone1.htm

http://www.woodmann.com/IDArchive/ID-RIP/database/essays/muad/a2000-1-5.htm

http://www.woodmann.com/fravia/trnfiles/chapter2.txt


Trying to figure this program out.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Trying to figure this program out.
PDA

View Full Version : Trying to figure this program out.

cool_tester
11-16-2004, 04:36 AM
Hello all,
I'm new to this world, and i would like to learn how this little application work.? Attached you will find the .exe if you can help start learning, i would appreciate it.
basically here is what i think the program does.

1. after the exe is launched it loads a packaged file that is attached to the exe itself, then extracts some dll's to the temp folder.
2. (This is the one i can't understand) it loads it's own .swf from memory and then loads the second swf file from memory as well, without extracting them to the temp folder..

Now how do i trap and get the first swf file from memory and dump it to disk...?

also i think the exe is packed by PE Packer and i can't unpack it..?

thanks guys.,
Silver
11-16-2004, 04:57 AM
It seems to me you have 2 options:

1. Unpack the exe, analyze what it does and extract the SWF you want (which will probably be a resource in the exe)

2. Locate the mechanism that loads the SWF file through a debugger (Olly, sice), which I assume will reference the address of the first byte of the SWF. Research how to locate the end/size of an SWF file, and then use this information to dump address of first byte + size of SWF from mem direct to disk.

I haven't looked at your zip, I have no reversing tools on this laptop. If it's commercial software, you need to remove it from your post immediately or JMI will make good use of Mallet's Mallet.
cool_tester
11-16-2004, 05:13 AM
Thanks for the reply,
The program is an exe that is generated with a commercial application but it is registered and therefore allowed to generate .exe, so i don't think there is a problem here... as you can see the file does nothing but load the swf from memory, so nothing real here, just trying to figure out how it all works and look at the Main swf source code for learning purposes.

Now i looked into it further and found out that the swfs are encrypted... bummer now I'm stuck.. i even tried to hook into the exe using a dll i developed that hooks the url loading rootine to get the file right before it is loaded into the acticvex but failed... i think it is because one of the dlls extracted is responsible for loading the resource file. and not the exe itself. which makes it hard to hook them, I'll keep digging.


IceDump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > IceDump
PDA

View Full Version : IceDump

rogger123
11-16-2004, 06:42 AM
Hi,
Could any kind soul send me (PM) a link to Icedump. the link to the site seems to be down or non existent. The other link from one of the sites listed below also appears to be dead.
Thanks in advance
Opcode
11-16-2004, 07:12 AM
hxxp://www.wasm.ru/tools/10/id6026.zip
Woodmann
11-16-2004, 05:47 PM
Oh Man,

You are so lucky JMI aint around.
Asking for tools/links to tools is heresy. You will be forced to take the "bus"
if you do it again.
Please oh please dont do it again.

Woodmann
Opcode
11-16-2004, 06:07 PM
:whoops:

I will no more provide links for tools.
dELTA
11-16-2004, 07:45 PM
Well, this may actually be a valid case, depending on how easy this tool was to find...

Here is an excerpt from the FAQ regarding this:
What questions may I and may I not ask about acquiring tools?
...
2.
You may NOT ask about where to download ANY tool, freeware, pirated or whatever (this is to make sure no links to pirated software occur here, and to avoid people using this forum instead of google, even for freeware tools). This does of course include NOT being allowed to ask if someone can send it to you too!
A valid exception to this rule of not being allowed to ask WHERE a tool can be found is when the original site of a free tool has disappeared, and it is hard to find it by searching. In that case you MAY ask if anyone knows what happened to the site, and if there are any ways to find this tool anywhere else.
...
And Opcode, as long as the tool isn't commercial, it's the guy who's asking who breaks the rules, not someone who may be helpful enough to answer, so don't worry. :)
Opcode
11-16-2004, 08:35 PM
OK. No problem :)
Woodmann
11-16-2004, 09:38 PM
OK,

I have been corrected BUT it still shows up in a Google search locating it at wasm so, bite me :eek: .
Sometimes you have to check more than the first page returned by Google. :thinking:

Woodmann
rogger123
11-17-2004, 02:45 AM
Hi,
My sincere apologies .
It was just that the original site was dead and the link from one of the sites listed below was dead tooo. And my google search didn't lead me to the right place. I guess I was a bit lazy with google extremely sorry.
JMI
11-18-2004, 01:18 PM
Thanks. Saved from another stern warning message. :yay:

Regards,
Woodmann
11-18-2004, 03:15 PM
Hi,

Hey rogger, just playin you :D

Woodmann
rogger123
11-19-2004, 07:06 AM
Thankx ! :sneaky:
Well a few doubts at this stage.. there are a few Flexlm SDK's that arent' availabe (Well I didn't find them). Am I allowed to aask for them ?
Thankx
JMI
11-19-2004, 10:12 AM
This is generally NOT a lending library for software that is difficult to locate. I doubt, generally, that you have exhausted all possible avenues of searching and the real question is WHY someone else should GIVE you something which is difficult to locate simply because you come here as a newbie and "ask" for it????

For example, CrackZ has some such items "available" to those who have something useful to share. Perhaps you should send him a PM and demonstrate you aren't just someone who "wants" stuff he doesn't have. :idea:

Regards,
rogger123
11-20-2004, 07:32 PM
Hi,
Yes I do understand that this is not a lending library. Well, I have made all possible attempts to locate it. I have come here as a newbie not just to ask for things I do not have but to gain the skills I do not posses. Its only when I have attained the required level that I can contribute in the form of small findings. The very fact I don't have the required things(skills and some software) to start with I can't proceed. Its the knowledge that you'll posess that can help me to proceed thats why I am a newbie. I do understand that there are guys who have come here with everything and not had to ask, I am definately not among those. Its not that I have a target to crack and thats it! I already have a license for my target. All I am trying to do is start with older versions of fexlm and work my way up.
Regards
Rogger
Woodmann
11-20-2004, 09:51 PM
Howdy,

You need to scroll down and click on the CrackZ link. If you can not find what you are looking for, a polite email to CrackZ may just help you find the things you desire.

Woodmann
Rackmount
11-22-2004, 11:22 AM
Well, I have made all possible attempts to locate it.

There is a great site that is devoted to searching techniques. The pages in the site seem endless and could perhaps assist you in making "all" possible attempts to locate...anything. To find this site, look to the bottom of this page (betcha can't guess which site it is!) and you will find what you need to be able to find what you need. (I kinda liked the way that last sentence ended....) Good luck!

Rackmount


Windows shut down notification API?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Windows shut down notification API?
PDA

View Full Version : Windows shut down notification API?

dELTA
11-16-2004, 07:28 AM
I'm almost certain that I have seen some Windows API that can be used to register a callback to be called just before Windows is about to shut down, sorta like IoRegisterShutdownNotification, but for ring 3 apps. As usual though, once you really need it, it's completely impossible to find again...

My problem is that the normal Windows quit message that is sent to windowed applications during Windows shutdown for some reason fails at seemingly random occasions for my application, so that the application cleanup and shutdown code isn't executed, and the program gets a "Program XXX isn't responding" warning to the user instead. Hence, I thought that such a registered callback function would hopefully be a little more robust.

If anyone has any clues about such a function, or any other good solution for that matter, please let me know.
Neitsa
11-16-2004, 08:18 AM
Hello Delta,

As far as I know there's only some functions for shutting down windows, and, having browse them, none offer a callback function.

see:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sysinfo/base/system_shutdown_functions.asp

There's only two messages wich are sent to all programs:

WM_ENDSESSION
WM_QUERYENDSESSION

see :

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/sysinfo/base/system_shutdown_messages.asp

you can also force a shutdown (nothing displayed, all programs are shutted down, even if they are doing some job) while calling ExitWindowsEx with the EXW_FORCE flag.

Hope it could help.

Regards, Neitsa.
bilbo
11-16-2004, 11:24 AM
A callback could be in effect called, but only with Console Processes (and that is not supposed your case, dELTA).
You register it with
BOOL SetConsoleCtrlHandler(PHANDLER_ROUTINE HandlerRoutine, BOOL Add)

The handler functions also handle signals generated by the system when the user closes the console, logs off, or shuts down the system.

Just a marginal consideration. Regards, bilbo
Silver
11-16-2004, 12:56 PM
As neitsa says, I've had success with WM_QUERYENDSESSION before. Alternatively, you might have some luck hooking this:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthn/security/wlxshutdown.asp
dELTA
11-16-2004, 03:48 PM
Thanks for the info guys, then I know what I have to work with. :yay:
SL0rd
11-17-2004, 11:05 AM
Hi Delta, I have an idea:

Inject code in the windows kernel, so its send a personalized message to all the applications, you write a callback to this message and...what about it!
Neitsa
11-17-2004, 11:28 AM
Inject code in the windows kernel, so its send a personalized message to all the applications, you write a callback to this message and...what about it!

:D :yay:

Errrr, sounds a little bit difficult....but it worth the try !
SL0rd
11-17-2004, 11:56 AM
Hey Im a beginner, and its was just an idea...
dELTA
11-17-2004, 04:56 PM
Hehe, yeah, I'm sure the users would appreciate me modifying their kernel to get around a quirk in my program, not to mention having their computer BSOD (or at least my program stop working, if the patcher is a bit more clever) when they run Windows Update the next time. ;) Shooting mosquitos with cruise missiles usually gets expensive in the end. :D


Specification of NE executables
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Specification of NE executables
PDA

View Full Version : Specification of NE executables

dELTA
11-16-2004, 03:43 PM
I just found the following format specification of NE executables (16 bit Windows executables, the generation before PE) over at the MS site.

Since I remember that I have at least at one point in the past tried to find a similar specification of these without much luck, I thought I'd post it here if anyone's interested:

http://support.microsoft.com/default.aspx?scid=kb;en-us;65122


Starforce protected games open up security hole in your computer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Starforce protected games open up security hole in your computer
PDA

View Full Version : Starforce protected games open up security hole in your computer

dELTA
11-17-2004, 08:54 AM
That's what happens when you play around too much with drivers...

http://www.securityfocus.com/bid/11628/discussion/
evlncrn8
11-17-2004, 09:21 AM
i think thats old tho, i remember the story,think it was with the old drivers, once the exploit possibility became known afaik they 'fixed' the code in the drivers
dELTA
11-17-2004, 10:23 AM
I remember another issue like this before too, but this one is dated recently, and they also say that a working exploit is in the wild, and that Symantec is analyzing it right now. But then again, you never know with these things, they have a tendency to quite easily become out-of-control rumours... :)
doug
11-17-2004, 01:54 PM
Starforce commented on this:
http://www.star-force.com/index.phtml?id=606&type=5&add=1&category=200

I have the exploit here if anyone's interested. It's sending a few device IO control requests. One of them containing an INT 3 handler. So I suppose you could inject an interrupt service routine using a device io control and from there do whatever you want. I did not test it.

P.S. StarForce would like to thank the hardworking team and their financial backers who have found this driver vulnerability. If it wasn't for you, we wouldn't be in business.
hey this actually cross-references the other off-topic discussion :p


explorer parent process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > explorer parent process
PDA

View Full Version : explorer parent process

Hero
11-17-2004, 11:50 AM
Hi all
I have a simple question.What is the parent process of
"explorer.exe" ?
I use a simple algorithm (perhaps strange) to find parent
process filename of current one.
I use CreateToolhelp32Snapshot,Process32First,Process32Next
too find this.But when I try to find explorer.exe parent process,
I get an strange result:The parent process of explorer.exe
has an ProcessID but has no process!!!!????
I do as following:
search all processes snapshots to find explorer.exe .
from data that I get I can find parent processID.
now I search all processes snapshot for this processID
But there is no process with processID!

Is there nessecery that parents chain get to "[System Process]" ?

sincerely yours
TBone
11-17-2004, 12:35 PM
I always assumed that it was parented by winlogon.exe, but after playing around with getpids (hxxp://http://www.scheibli.com/v3/projects/getpids), I see that's not the case. Apparently the process that starts explorer.exe as the shell when you log in is killed before you get a chance to see it. Windows has no objection to killing parent processes and leaving the child processes orphaned. Play around with tlist and you'll see what I mean.

All the applications that you're running are listed as children of explorer.exe. Now start up the proess manager and kill explorer.exe. Leave the process manager running. Run tlist again, and your applications are all orphaned. Start a new explorer from the process manager. Run getpids from a command line. You'll see that getpids is a child of CMD.EXE, which is a child of Explorer.exe, which is a child of taskmgr.exe, which is a child of the PID for your old explorer app. But now getpids has lost the record of the PID that originally started *that* explorer process, because it can't query a dead app for it's parent.

I'd need to dig around a bit more to find any definitive answers about what process actually starts explorer.exe. But for application programming, I think it's safe to say that you should consider explorer.exe as having no direct parent process.
0rp
11-19-2004, 10:50 AM
winlogon.exe starts userinit.exe which starts the shell


Kind of interesting search engine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Kind of interesting search engine
PDA

View Full Version : Kind of interesting search engine

TBone
11-17-2004, 12:15 PM
I was browsing through RGRN today and came across an unusual piece of spam. In my book spam is something to be put down with extreme prejudice, but the subject line caught my eye: "Mining the Web: eigenVectors, Kriging, Inverse Distance Weighting Searches". This was some seriously geeky spam. The text made it even better. It was a technical description of how their engine performs eigenvector math and Jacobian matrices, how it handles cross-pollination, etc. The full text is at:

hxxp://www.eigensearch.com/inc/constructs/beta.htm

I was thorougly amused by the idea of someone mass spamming something with such narrow appeal, that I broke with my usual rule of conduct and actually took a look at the site. It turns out that it might actually be useful. The main page is, of course:

hxxp://www.eigensearch.com

If nothing else, it's a quicker way of doing complicated search constructs, particularly if you don't know all the CCTLD's by heart. Sadly their formatting isn't very Firefox/Mozilla/Netscape friendly.
Silver
11-17-2004, 12:27 PM
That's reminded me of something... I found a "visual" Google-esque search engine once, you searched for your keywords and instead of results, it returned a visual map of relationships between web pages. I lost the link, never found it again, but it was pretty neat. Don't spose anyone knows what I mean?
JimmyClif
11-17-2004, 12:36 PM
Silver - http://www.kartoo.com
TBone
11-17-2004, 12:37 PM
hxxp://kartoo.com ?

Edit: Bah. Damn these slow fingers!
disavowed
11-17-2004, 11:53 PM
http://www.kartoo.com
very interesting! had never seen that before
Silver
11-18-2004, 07:39 AM
That's it! Thanks, I faithfully promise not to lose this thread :D
disavowed
11-18-2004, 10:34 AM
hehe, you can get it to time-out with the following search term:

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
JMI
11-18-2004, 01:08 PM
OK. Now someone has to help me get my eyes uncrossed. :D

Regards,
Silver
11-18-2004, 02:49 PM
Wait, if you stare really hard you can see a knight fighting a dragon in 3D in that... ;)
klier
11-19-2004, 08:42 AM
New:
http://scholar.google.com/
"Google Scholar enables you to search specifically for scholarly literature,including peer-reviewed papers, theses, books, preprints, abstracts and technical reports from all broad areas of research."
Regards,
JMI
11-19-2004, 10:23 AM
And Silver I AM old, and earned every minute of it, but I just can't remember what I don't "have many left" of ?? Memory fades. :devil:

Regards,
Silver
11-19-2004, 12:16 PM
And very soon you'll forget what's in my sig ;)
JMI
11-19-2004, 03:29 PM
What Sig? What warning???? HuH? :D

Regards,


Olly needs your help with OllyDBG 2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Olly needs your help with OllyDBG 2
PDA

View Full Version : Olly needs your help with OllyDBG 2

Harding
11-18-2004, 03:59 AM
He needs some different OS's to test things on, read more on the homepage
hxxp://home.t-online.de/home/Ollydbg/

Edit: fixed som spelling errors
dELTA
11-18-2004, 04:44 AM
Someone, get the guy a copy of VMWare... :rolleyes:
JMI
11-18-2004, 01:07 PM
What? He can't find his own copy? :eek:

Regards,
Bengaly
11-18-2004, 04:09 PM
some people do buy their copy you know ;)
JMI
11-19-2004, 10:20 AM
No. I'd never heard that before. :eek: Thanks for the tip. :yay: :D

Regards,


Crystallized water...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Crystallized water...
PDA

View Full Version : Crystallized water...

dELTA
11-18-2004, 04:59 AM
Aah, first snow here in Sweden today, feeling christmassy, life is good... :)

Anyone else got snow yet? Maybe you Kayaker? Or maybe JMI? :D

Anyone?
naides
11-18-2004, 06:58 AM
Anyone?

It has been warm here in Antartica, What can I tell you. . .
dELTA
11-18-2004, 07:02 AM
Are you in Antartica, really?
SL0rd
11-18-2004, 07:30 AM
Aah, first snow here in Sweden today, feeling christmassy, life is good... :)

Anyone else got snow yet? Maybe you Kayaker? Or maybe JMI? :D

Anyone?

Ahh, you speak as snow was in everywere in the world. Here in north of Brazil, I just can see it trough the tv. You are very fortunate indeed :)
Maybe someday we can reverse the nature so we can make snow fall when and where we want.
Silver
11-18-2004, 07:45 AM
I hope it doesn't snow here. It snowed about this time last year and brought the entire country to a standstill. Only about 6 inches of snow, too. Makes you laugh when Canada etc get 6 FEET of snow and still manage just fine...
Rennie_B
11-18-2004, 09:19 AM
in the beginning, but when you wake up in the morning, put on all the clothes you have, get out on the -20 deg. celsius weather, dig your car out of the pile of snow and start scraping ice off the windshield, the niceness starts to wear off.
Especially, when you have to repeat this procedure every morning for few months.

Luckily global warming is gradually turning our climate into more mediterranean type, soon I can plant palmtrees on my backyard.
TBone
11-18-2004, 11:40 AM
No snow here in Texas, but what's new?

The last time we got significant snow fall in the Dallas area was over 20 years ago. February of 1978 had 10 inches (~25.4 cm) in matter of a couple days. I think the most I've ever seen in my lifetime was maybe 2 inches of snow on the ground. Most years we don't get enough to even stick to the ground, but there's usually at least one day with snow. Since we're on the topic, here's a kind of geeky fun site with snow data for the U.S.:

hxxp://www.ncdc.noaa.gov/oa/climate/monitoring/snowclim/mainpage.html

Edit: Whoops, left out a decimal place. 200+ cm of snow would be insane :p
lifewire
11-18-2004, 11:44 AM
here in the netherlands was some crystallized water, about 15 centimeters high, some days ago. only not in my area, i could only dream of it :(

but personally I like the form of very strong crystallized water you can stand and ice skate on :)
JMI
11-18-2004, 01:11 PM
Doesn't snow much in the San Francisco Bay Area, although it is not unheard of out past the foothills and there has been light snow on some of the higher foothills many times in the past, but we generally go the Lake Tahoe Area for real snow and skiing. :yay:

Regards,
JimmyClif
11-18-2004, 01:12 PM
In CT last year snow wasn't all that bad - in 2002 however I think we received something along of 3-4 feet inwithin a couple days or so..

Slord, if you think we're fortunate then you don't know the joy of shoveling :D

Rennie: I usually grab a gallon of hot water and melt a medium seethrough hole through the ice in the windshield and start driving... no scraping for me.
mike
11-18-2004, 02:33 PM
Just getting into summer here. No more of the endless weeks of rain (hooray!) Hoping to have a barbecue later this month.
Silver
11-18-2004, 02:51 PM
Rennie: I usually grab a gallon of hot water and melt a medium seethrough hole through the ice in the windshield

Careful with that, hot water on frozen glass will make it shatter... You weren't paying attention in science class, were you :D
Woodmann
11-18-2004, 03:10 PM
Howdy,

It snowed here last Friday. The ski areas are starting to open.
I buy a can of hairspray everytime I go shopping. I dont have any hair,
I just spray it out the window on the way home :eek: .
I'm just doing my part to get this global warming stuff turned up a notch.
(Pun intended)

For those of you who think this is very un-politically correct,
C'mon up and bring a shovel, a window scraper, rock salt and about 1,500
extra dollars to pay for the fuel oil to keep the house warm.
Woodmann
JimmyClif
11-18-2004, 05:22 PM
Careful with that, hot water on frozen glass will make it shatter... You weren't paying attention in science class, were you :D

No I wasn't!

Guess, I'm lucky :thinking: worked fine all last year... hrm, with that new realization... I wonder what to do next... knowing me I'll keep pushing my luck. /me is retarded
bilbo
11-19-2004, 02:03 AM
"So comes snow after fire, and even dragons have their ending." bilbo
klier
11-19-2004, 02:19 AM
snow fun. :)
http://acthtf.hp.infoseek.co.jp/htf/snow.swf
Regards,


checking my ASM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > checking my ASM
PDA

View Full Version : checking my ASM

tdennist
11-18-2004, 07:16 PM
The task: make a trainer for the included Minesweeper game with Windows to stop the timer from advancing. I found the code address, and I made this program. However, it doesn't work :p.

Am I allowed to ask someone to look over my code and tell me what's wrong? In case I am (:-D):

Using Hutch's Masm32 8.2. The problem is that when I press the 'u' key, the program crashes. And SoftIce doesn't pop up, which is rather annoying. Keep in mind when you're reading this that I am really new at this, and this is my first attempt at a serious one of these type things. Don't make too much fun of me :p.

.386
.model flat,stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\user32.inc
include \masm32\include\kernel32.inc
include \masm32\include\gdi32.inc
includelib \masm32\lib\user32.lib
includelib \masm32\lib\gdi32.lib
includelib \masm32\lib\kernel32.lib

WinMain proto :DWORD,:DWORD,:DWORD,:DWORD

.DATA
ClassName db "SimpleWinClass",0
AppName db "Window Name",0
char WPARAM 20h
winName db "Minesweeper",0 ; the name of the window
toWrite QWORD 909090909090h ; the bytes to write; 6 NOPs

.DATA?
hInstance HINSTANCE ?
CommandLine LPSTR ?
IDProcess DWORD ? ; the ID of the process
tempHWnd HWND ? ; the window handle of the process
hProcess HANDLE ? ; eventually, the process to write to

.CODE
start:
invoke GetModuleHandle, NULL
mov hInstance, eax
invoke GetCommandLine
mov CommandLine, eax

invoke WinMain,hInstance,NULL,CommandLine,SW_SHOWDEFAULT
invoke ExitProcess, eax

WinMain proc hInst:HINSTANCE,hPrevInst:HINSTANCE,CmdLine:LPSTR,CmdShow:DWORD
LOCAL wc:WNDCLASSEX
LOCAL msg:MSG
LOCAL hwnd:HWND

mov wc.cbSize, SIZEOF WNDCLASSEX
mov wc.style, CS_HREDRAW or CS_VREDRAW
mov wc.lpfnWndProc, OFFSET WndProc
mov wc.cbClsExtra, NULL
mov wc.cbWndExtra, NULL
push hInstance
pop wc.hInstance
mov wc.hbrBackground, COLOR_WINDOW+1
mov wc.lpszMenuName, NULL
mov wc.lpszClassName, OFFSET ClassName
invoke LoadIcon, NULL, IDI_APPLICATION
mov wc.hIcon, eax
mov wc.hIconSm, eax
invoke LoadCursor, NULL, IDC_ARROW
mov wc.hCursor, eax
invoke RegisterClassEx, addr wc
invoke CreateWindowEx, NULL,\
ADDR ClassName,\
ADDR AppName,\
WS_OVERLAPPEDWINDOW,\
CW_USEDEFAULT,\
CW_USEDEFAULT,\
200,\
200,\
NULL,\
NULL,\
hInst,\
NULL
mov hwnd, eax
invoke ShowWindow, hwnd, CmdShow
invoke UpdateWindow, hwnd

.WHILE TRUE
invoke GetMessage, ADDR msg, NULL, 0, 0
.BREAK .IF (!eax)
invoke TranslateMessage, ADDR msg
invoke DispatchMessage, ADDR msg
.ENDW
mov eax, msg.wParam
ret
WinMain endp

WndProc proc hWnd:HWND, uMsg:UINT, wParam:WPARAM, lParam:LPARAM
LOCAL hdc:HDC
LOCAL ps:PAINTSTRUCT

.IF uMsg == WM_DESTROY
invoke PostQuitMessage, NULL
.ELSEIF uMsg == WM_CHAR
push wParam
pop char
.IF char == 75h ;u
mov char,25h ;%
invoke InvalidateRect, hWnd, NULL, TRUE
call StopTime
.ELSE
invoke InvalidateRect, hWnd, NULL, TRUE
.ENDIF
.ELSEIF uMsg==WM_PAINT
invoke BeginPaint, hWnd, ADDR ps
mov hdc,eax
invoke TextOut, hdc, 90,70, ADDR char, 1
invoke EndPaint, hWnd, ADDR ps
.ELSE
invoke DefWindowProc,hWnd, uMsg, wParam, lParam
ret
.ENDIF
xor eax,eax
ret
WndProc endp

StopTime proc
invoke FindWindowA, NULL, ADDR winName ;get hWnd for Minesweeper
mov tempHWnd, eax ;put it into tempHWnd
invoke GetWindowThreadProcessId, tempHWnd, IDProcess ;get the process ID
invoke OpenProcess, PROCESS_ALL_ACCESS, FALSE, IDProcess ;open the process
mov hProcess, eax ;load the process handle into hProcess
invoke WriteProcessMemory, hProcess, 01002FF5h, ADDR toWrite, 6, NULL ;write the stuff
invoke CloseHandle, hProcess
StopTime endp
end start

Thanks.
Kayaker
11-18-2004, 08:01 PM
Hiya,

Just like the other procs, your StopTime proc needs a 'ret', that should fix 'er up.

Cheers
tdennist
11-18-2004, 09:44 PM
Thank you, that did indeed stop it from crashing.

Now, however, it just plain doesn't work. Do you see any other glaring mistakes? I don't even know if I used the proper procedure for getting the window handle, process ID, etc. Remember, this is my first ever attempt at this :p.

Also, the way I specified the bytes to write to the process seems stupid. Is a quad word the largest amount of bytes I can replace in the file at once? If there were more, would I have to save them in separate quad word variables? (And actually, I don't even know if I did it the right way. Help? :p)

Thanks.

edit: Also, forum mods and other gurus: tell me if I should edit my original post to not specify the game's name outright. I recall one of the forum rules being something about that....
Kayaker
11-19-2004, 12:54 AM
edit: Also, forum mods and other gurus: tell me if I should edit my original post to not specify the game's name outright. I recall one of the forum rules being something about that....
Don't worry about Minesweeper! We can handle any MS goons that might complain :D

Because of a recent hand injury I can't type more than a few words here, so I'll leave the other questions to the ablebodied...

btw, you may want to read Zairon's reversing of Minesweeper at the main archive site,
http://woodmann.net/fravia/what_new.htm
bilbo
11-19-2004, 03:34 AM
tdennist:
(1) first, be sure that the version you have of WINMINE.EXE really brings at address 0x1002FF5 the instruction you want to comment-out (you can check this with a debugger). This condition holds for windows XP version:
01002FF5 FF 05 9C 57 00 01 inc dword ptr ds:[100579Ch]
(2) second, check the name of Minesweeper window; in Windows 2000/XP the name is not Minesweeper, but it depends on the language of your installation, Correct it at winName location of your code

(3) finally, correct an error you made invoking GetWindowThreadProcessId.
The correct syntax is invoke GetWindowThreadProcessId, tempHWnd, ADDR IDProcess
After these three steps, you can digit 'u' in your window and the timer will magically stop!

Is a quad word the largest amount of bytes I can replace in the file at once? If there were more, would I have to save them in separate quad word variables?
Not at all! You can declare them in plain bytes... Try to replace
toWrite QWORD 909090909090h with
toWrite db 90h,90h,90h,90h,90h,90h
and the effects will not change.

you may want to read Zairon's reversing of Minesweeper at the main archive site
LOL, he didn't make a deep reversing, since he misses the fact that the same effect could be reached with the XYZZY trick (google to find it) - joking... that's an instructive reading!

Kayaker:
Sorry for your wound... I hope you will be healthy again, and your brilliant brain has not suffered too ;)

Regards, bilbo
ZaiRoN
11-19-2004, 05:28 AM
Hi bilbo,
he didn't make a deep reversing, since he misses the fact that the same effect could be reached with the XYZZY trickHmmm, you didn't read the initial minesweeper project in the mini project area :D

Best regards,
Zai
bilbo
11-19-2004, 07:02 AM
Please, forgive me ZaiRoN, please...
After I got rid of the Ring, I have become more and more forgetful!
bilbo
ZaiRoN
11-19-2004, 07:20 AM
Please, forgive me ZaiRoN, please...Oh my good old hobbit, you are forgiven this time :P
JMI
11-19-2004, 10:17 AM
Since surrendering the "One Ring" eventually saved Middle Earth, we can forgive an occasional failure of memory among the elder folk. That way I might also get away with a memory failure or three... uh ... what were we talking about? :D

Regards,
Kayaker
11-19-2004, 03:27 PM
Kayaker:
Sorry for your wound... I hope you will be healthy again, and your brilliant brain has not suffered too ;)

Thank you, though I can't say I feel too f*ing brilliant today! ;-)
A few slowly typed cautionary observations about those Olfa "exacto" utility knives with the snap-off blades -

The blades can snap off at the most inopportune time.
They are *very* effective at filleting human flesh, quite reminiscent of cleaning a freshly caught fish actually...
They also sell stronger blades which don't snap off as easily. Now I know why.

Standard knife safety includes protecting ones exposed body parts to the consequences of an "expected" slip (taking into account such things as direction of push, possible angles of deflection, length of blade, how much you value the exposed body part(s), etc.)
Enhanced knife safety should include, where applicable, the consequences of a sudden shortening of blade length while remaining razor sharp.

If the thought "Maybe I shouldn't be doing this" ever crosses your mind while working with a knife, stop immediately and don't dismiss it.
'Close calls' are good to have every once in a while to make one appreciate how wonderful life is.
The realization that "it could have been a lot worse" is a wonderful thing.
Stitches(7) are a wonderful thing. So are flesh wounds that don't cut through tendons or major nerves.
Female doctors are especially attractive when stitching you up :)

Take care out there.

Cheers,
Kayaker
JMI
11-19-2004, 03:32 PM
Kayaker:

Glad to hear you are healing up. Just wanted to know if the lady doc asked you to cough? :devil: And if so, were her hands cold? :whoops:

Regards,
Kayaker
11-19-2004, 03:51 PM
No, I was in an awkward position when working with the knife, not the doctor :p
tdennist
11-19-2004, 05:14 PM
*cough* back on topic....;-).

(2) second, check the name of Minesweeper window; in Windows 2000/XP the name is not Minesweeper, but it depends on the language of your installation, Correct it at winName location of your code

Ok, here's where I feel stupid. Is the name of the windows the text in the title bar? Because if it is, Minesweeper is the right name....

Thanks. :cool:

(edit: I swear, once I learn this stuff, I'm writing a bunch of well written tutorials, explaining step by step and skipping nothing on how to do simple things. Like make a trainer for Minesweeper.)
Silver
11-20-2004, 08:12 AM
tdennist, easiest way to check window and window class names (there is a difference) is by using the spy++ tool that Microsoft ship with Visual Studio (and I think it's on their site for freedownload, and in Resource Kit's etc).
klier
11-20-2004, 08:37 AM
...or use windowjuggler plugin for olly.
Regards,
tdennist
11-20-2004, 04:29 PM
Yay! Thanks, guys. It works now! Now, my next question is, how should I start going about changing it so that I don't have to press 'u' inside my application window? I.e. a hotkey that will work from any application.
dELTA
11-20-2004, 07:26 PM
Look into global hooks in Windows, especially the API function SetWindowsHookEx...
tdennist
11-21-2004, 08:50 PM
Well, I read up on that stuff, and then today, while browsing Iczelion's Win32 assembly page I found this site:

http://spiff.tripnet.se/~iczelion/Win32Api1.htm

Which explains how to create a hotkey. I put it into my Minesweeper game and it works just dandily. Does this solution work? In other words, is it a crappy workaround and should I look into the Windows hooks? Or should I just be happy with this and keep using it?
dELTA
11-22-2004, 07:05 AM
As long as your own program has any windows, the RegisterHotKey-stuff will work just fine for simple uses. The hooks are more versatile and work without the need to have your own window though.
tdennist
11-22-2004, 04:27 PM
In what way are they more versatile? And when would I have an occasion to create an application that doesn't have a window? The only instance I can think of would be a keylogger, but I don't really have much need to create one of those :p.
bilbo
11-23-2004, 01:30 AM
We are slipping in a philosophical disquisition, aren't we?
Regards, bilbo
dELTA
11-24-2004, 09:11 AM
The generic hooks are more versatile because they can capture much more things than simple key-combinations, like for example mouse clicks and key combinations like "if the user first presses this, then that, and then this", and many even more advanced things. But as I said, for simple key combinations in windowed apps, the simpler technique is pretty ok too.

Btw, I'm not sure if they behave differently under full screen DirectX apps either, they might...
Silver
11-24-2004, 11:29 AM
Did somebody say DirectX? :D

What my esteemed colleague dELTA meant when he said "full screen DirectX apps" was actually, "It makes no difference to a keyboard, mouse or any other input device hook if a D3D app is running in windowed or fullscreen mode, however if DirectInput is being used to manage user input a side effect is that any relevant hooks *usually* don't work" :devil:

Basically, D3D is the drawing part of DX, DInput is the input handling part. If you acquire an input device using DInput it's normally handled at a <insert respectful metal-bashing hush here> lower level than normal (ie: direct from device/driver level). There are different ways of acquiring devices, nominally referred to as the "cooperation level" between DInput and the rest of Windows. Depending on a number of factors (including DInput config via the control panel applet and the cooperation level) input hooks usually won't work. There is absolutely no requirement to use DInput to get user input for D3D apps - personally I've coded D3D apps that used normal win32 WM_ for their input, that used WM_ for keyboard and DInput for mouse, and vice versa. So I guess what that rambling is trying to say is, just because an app uses D3D for gfx doesn't mean it uses DInput for input.

This is an interesting article about a similar issue: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dninput/html/nodelaydirectinput.asp
In essence, when you code a DInput app there is an annoying lag in keyboard/mouse input when debugging. It's caused by the same problem.

I'm such a DX geek :D
nikolatesla20
11-24-2004, 12:03 PM
What a nerd :p

-nt20
dELTA
11-24-2004, 07:56 PM
As we all know, mind reading is a main requirement to be accepted into the higher levels of this community, and Silver did a good job as always, yeah, that's exactly what I meant. ;)

Btw, Silver, can a D3D app in windowed mode use DirectInput like that too? In that case I guess it must be disabled as soon as the window of the D3D app loses focus at least, to make all the other apps work normally? That's what caused me to suspect that only "some full screen DirectX apps" (i.e. the ones using DirectInput) could be causing problems like that.
Silver
11-25-2004, 05:02 AM
can a D3D app in windowed mode use DirectInput like that too? In that case I guess it must be disabled as soon as the window of the D3D app loses focus at least, to make all the other apps work normally?

It sure can. DInput will work regardless of fullscreen or windowed. I think the main reason this isn't immediately apparent is that nobody plays games windowed, so the only way you'd know DInput can do this is during development (unless you do remote or dual monitor debugging, it's basically impossible to debug a D3D app running full screen so everything is done windowed).

DInput in windowed mode is all about the cooperation level. The normal effect, however, is that the mouse etc are "locked" to the window and because they're handled at a lower level than normal you can't pre-emptively disable them through DInput as such, you can only react to losing them. Losing focus ("lost device") with a DX app is a nightmare issue I won't go into detail here. Lost devices give all newbie DX coders nightmares. In essence, every iteration of the render and input loop in a DX app you absolutely must validate your devices. You need to make sure you still have access to all the devices represented by your COM objects, and if you don't, go into a testing process to try to reacquire them. This is true for DInput and D3D (if you're interested, look at IDirect3DDevice9::TestCooperativeLevel() ). If you lose a device then reacquire it, you have to reload all your unmanaged resources associated with the device (such as texture resources not created in the managed memory pool).

Damn, I said I wouldn't get into it :D . It's simple enough to understand if you have a basic understanding of DX process, it's the implementation that's awkward. Let me know (or start a new post) if you'd like a better explanation.

Does that answer your question?
dELTA
11-25-2004, 06:57 AM
Hehe, an interesting insight into the wonders of DX as always, I'm already looking forward to the next one. :) And yeah, sure, that answers my question just fine (and my next couple of questions too). ;)


offsets are different in Softice and IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > offsets are different in Softice and IDA
PDA

View Full Version : offsets are different in Softice and IDA

tdennist
11-22-2004, 07:38 PM
Why is this? I located an instruction I want in a loaded program. The instruction looks like this (in Softice):

001B:00423A1F 48 DEC EAX

So, I made my trainer to insert one NOP there, and it didn't work. So, I fire up IDA and I go to check to see if I am in fact NOPing the right address. IDA returns this:

.text:00423A1D jz loc_423C0E

So my question is, what the heck? Where'd my offset go that appeared in Softice? I tried to search the forums but I couldn't quite figure out what to search for...I tried "offsets changing" and "offsets different" but neither worked....

Thanks.
Kayaker
11-22-2004, 08:14 PM
We're not talking Winmine any more huh? It probably means the code has changed after the program is loaded, evidence of decryption perhaps. Is your game not packed? Your IDA disassembly is a bit, er, barren of descriptive information...
tdennist
11-22-2004, 09:03 PM
Haha, sorry about the lack of descriptive information. But this is so baffling and new to me that I had no idea what else to write! I'm afraid I don't really know what packing is. I have a general idea, but nothing more. What other information can I include to help you help me?
Silver
11-23-2004, 07:40 AM
This similar problem confused the hell out of me a while back. Basically one of 2 things is likely occurring.

1. The prog has some self-decryption code. A section of code within the exe has been encoded/enciphered in some way, and once the app has passed some critical point (registration check etc), the code is decrypted. What you see in sice is the "live" code, after the decryption routine has been completed. What you see in the IDA deadlisting is the enciphered code. If you search in this forum, there is an extensive thread started by me about a prog that does exactly this.

2. The prog has obfuscated a jump (not sure of the correct term for this). wdasm is very suceptible to this. In essence, there is a jump to this section of code somewhere else in the exe that changes the first instruction "seen". This is hard to explain in text, but imagine this:

These are some opcodes starting at offset 423a1d:
AB CD EF GH IJ KL

If we place a jmp 423a1d somewhere else in our exe, a disasm prog will see:
AB CD EF GH IJ KL

However, if we then place a jmp 423a1e (except, we do it via an offset, for example ebp+N) in our exe and step through the code as it runs, softice will see:
BC DE FG HI JK

AB is obviously a different opcode to BC, and thus is a different instruction. Therefore you can see how a jump to a single extra byte will *apparently* cause a different opcode/instruction to appear in the live analysis than in the deadlist, at almost the same location.

I hope that's made some kind of sense, it's very easy to demonstrate with an actual exe or a piece of paper. If you are absolutely 100% sure that doing this won't cause problems, you can strategically place a couple of NOP's.

To clarify, somewhere in your code will be a jump to the code block containing in instruction at 423A1D. Let's randomly call this location 423A10, for sake of example. In the deadlist, you WON'T find a jump to 423A10, however if you set a bpm x on this location in sice the breakpoint will trigger because of a jump. What you'll probably find is that a number of bytes immediately PRECEEDING 423A10 will never be called during the app's execution. Thus, if you NOP those bytes (ie: NOP's to 423A10) then reload the deadlist, your disasm prog will be able to correctly interpret it. Note that you shouldn't go NOP'ing everything in sight! Doing this will ONLY work if it's (what I call) an obfuscated jump - if it's a self-decryption block, then it will seriously damage the exe!

I'm sure others will explain better, or poke holes in that explanation. Or you'll post more info and we'll realise it's actually sputnik that's causing the problem. Either way I'm a beginner at this too, so YMMV and good luck :D :yay:
tdennist
11-24-2004, 08:54 PM
Hmm. That's a little above my head, but I think I get what you're saying. Mostly, anyway ;-).

What other information can I provide for you? I'm very intrigued by this new development, so I want to solve it :p. I'm attempting to make a trainer for a game...and that DEC EAX instruction is where it decreases the lives counter. I took the code from my previous (successful :-D) trainer for Minesweeper, and modified it to put one NOP at that location (the one I listed in the original post), but it does not work. So maybe there's some other important part that I'm missing.

Keep in mind this is only my second trainer/real ASM project ever!

Thanks.
Aimless
11-24-2004, 11:21 PM
Mostly though, IDA has mucked up on the start/finish of functions prolly.

Try changing from CODE type to UNKNOWN type and come to your address, then convert to CODE.

If you find your instruction there, most likely IDA has not disassembled correctly (that's one of the reasons why its called INTERACTIVE)

;)

Have Phun
tdennist
11-25-2004, 10:11 AM
Try changing from CODE type to UNKNOWN type and come to your address, then convert to CODE.

Right. So....how shall I go about doing this?
JMI
11-25-2004, 12:55 PM
Looking at your menu options would be a good start. Maybe something which indicates hints of changing "code to unknown" or "data" and then changing it back. It is often useful to RTFM which comes with the program. :yay:

Regards,
tdennist
11-25-2004, 02:19 PM
God forbid I should have to read some documentation ;-).

All right. What I did, and I probably did it wrong, is this: I went to offset 423A1F in IDA, selected "jz" (see my previous posts), pressed d, selected the "db" on the newly created offset 423A1F, pressed c, and this showed up:

.text:00423A1F jmp short loc_423A22
.text:00423A1F ; ---------------------------------------------------------------------------
.text:00423A21 db 0 ;
.text:00423A22 ; ---------------------------------------------------------------------------
.text:00423A22
.text:00423A22 loc_423A22: ; CODE XREF: sub_4235E4+43Bj
.text:00423A22 add [ebx-2076Bh], cl

The bold line is the result of that c keystroke. Then I also pasted what was at that jump location. This is rather odd. Originally in Softice I found a DEC instruction, and now it appears (to me, I'm a noob, remember?) that it's changed into an ADD instruction?

What's going on here?

(by the way, for the next few days I won't have access to this computer, so I won't be able to test out any other suggestions you guys make until I have access again.)

edit!

I converted the next offset to code from data, and this is what resulted!

.text:00423A28 dec dword ptr [ebx+0FC08502h]

Is this finally the location of that pesky DEC instruction? And in the event that it is, what offset should I tell my trainer to NOP?
Kayaker
11-25-2004, 04:53 PM
I don't think your DEC EAX is going to magically appear by twiddling with IDA. What's important are the actual opcodes, you should turn them on by going into Options/General/Disassembly and fill in the Number of Opcode Bytes field to 6 or 8 or something (a + sign will mean an instruction has more bytes not displayed).

Now look for the actual opcode for DEC EAX (48) at that disasm address in IDA. If it isn't there then, again, the code is changed after the program is loaded (decryption, overwriting), a static disassembly won't show this (use OllyDbg). If by chance the opcode 0x48 IS at address 423A1F, then something is either screwy or it might be some SMC (search!) as Silver described. You can do a byte search as well for the Sice opcodes in a hex editor, if they ain't there your IDA disassembly is next to useless.
tdennist
11-25-2004, 05:52 PM
Yeah...the opcode is not present at that location. Nor is anything else even remotely similar to 0x48, not that it would make much of a difference ;-).

Now the next step is...what? Unpacking it...or something?

edit: though...0x84 is at address 423A1F...could, by some very odd chance, be it?
Silver
11-26-2004, 05:32 AM
Okay, here would be my next step. You've located the code you need to change, you've found that the code is different when live than when (the same location is) viewed in the deadlist. Thus the next thing I would do would be to use procdump to dump out the live exe into a deadlist you can analyze.

For sake of argument, as we don't know the code structure, the best way to do this is to set a sice breakpoint at 423A1F (bpm x 423A1F). Make a note of the opcodes from 423A1F onwards (just a couple of bytes is fine). Next, with the EIP on 423A1F, use the sice "a" command to assemble/patch some instructions. Type "jmp eip", hit enter and then escape. You'll see the dec instruction at 423A1F change to the jmp - you've now put your exe in a loop. Control-D out of sice, load procdump and dump the exe (full image) to a file. Once procdump is finished, you'll need to task manager kill the exe task as it's in an infinite loop. Incidentally if you followed this, you've also just learned a very basic principle behind unpacking :D

Now you have another exe on disk that is exactly the same as what you see in sice. Load your favourite hex editor, and go to the DISK/FILE offset equivalent to 423A1F (note the difference here, you'll need to learn a little about for RVAs etc) - we can't tell you this unless we see the PE headers. At this location you'll see the opcode EB FE (someone correct me if I'm wrong, but off the top of my head EB FE is the opcode for jmp eip). Remember you made a note of the opcodes at 423A1F when you were in sice? Overwrite EB FE with the opcodes you wrote down, and save the exe.

You can now load it into ida etc and analyze it, which is what you wanted to do all along. Bear in mind of course, you can't run this exe you dumped - you can only use it to gain an understanding of the code structure at runtime.

All that said (and I hope it helps), I'm not sure why you want to do this. You've already used sice to find the instruction you need to change, so the on-disk structure of the encrypted/enciphered exe is irrelevant and not worth analyzing. All you need to worry about is making your trainer manipulate the exe image in memory - which, unless I've misunderstood, you already know how to do.

*edit* I just saw your edit, are you saying you can see 0x84 in IDA at 423A1F in the deadlist? In which case................ To save confusion, can you paste about 10 bytes at 423A1F as you see them in sice, and as you see them in IDA in the deadlist?
WaxfordSqueers
11-27-2004, 08:37 PM
Why is this? I located an instruction I want in a loaded program. The instruction looks like this (in Softice):

001B:00423A1F 48 DEC EAX

So, I made my trainer to insert one NOP there, and it didn't work. So, I fire up IDA and I go to check to see if I am in fact NOPing the right address. IDA returns this:

.text:00423A1D jz loc_423C0E

I haven't done this for some time...a lot of rust. If you look at your two code statements above, you'll see they are only two bytes off. i.e. the 00423A1F - 2 =00423A1D. I'm bothered by the 001B before the Sice code statement, since I'm used to seeing a CS: instead of a 001B. I'm wondering if that is a context problem? Does the 001B correspond to your CS register value? If not, you have to find out why. If you are in a different context, for whatever reason, and the 001B you listed is not the CS register, there's no way the Sice and IDA codes will match.

It's possible that you have inserted too many bytes somewhere and put the two apps out of sync. Does your app even load correctly? I suggest you begin again with a fresh copy of your trainer. Run it and look at the Sice code, then run it through IDA. Be sure to do what Kayaker suggested: turn on the code display in IDA under 'options' so you can see the opcodes listed in IDA.

If you are inserting bytes, try it manually with a hex editor like UEdit first. Take several of the preceding bytes from the Sice code, or successive bytes, and use the UEdit search engine to find those bytes in the trainer exe. You can do the same with IDA, if you can locate the code location you want. IDA has it's own hex listing, if you want to use it. Uedit will let you alter the exact location in the exe. Of course, if the program is packed, you wont find them.

Sometimes the search engine turns up too many values. Try another code phrase in the immediate vicinity of the Sice code area you want to find in the exe. If you get the right one, you can narrow the search down to one or two finds. Change the code in UEdit and save. Then run the trainer.

You can usually tell if a program is packed when you run it through IDA. If it complains of a bad import table as you load the app, you can bet it's a packed program. If there are no errors as you load it into IDA, it's usually a good indication that the app is not packed. That does not mean it doesn't have some self-modifying code, however.

You have to be careful with changing data to code in IDA. Sometimes you'll tell it to convert to code, and the resulting disassembly looks like code, but it is not. It's really hard to tell sometimes, since a lot of programs include data in the code. There are also jump tables and other goodies to confuse the matter.

Through experience, you can pick out areas in the code like NOPs (0x90) and rows of 0xCC's. A 0xCC on it's own is usually a legitimate instruction or bit of data. A lot of times, hitting the first bit after a series of 0x90's, or rows of 0xCC's, and changing them to code, will give you legitimate code. Other times it wont. You can also identify jump tables by identifying correctly the corresponding jump instructions, 0xEB, etc. If you see lots of EB's in close proximity to each other, you can change them to code and they will form a jump table.

I'm trying to say that hitting an area of code in IDA and converting to code does not assure it is code.
tdennist
11-28-2004, 05:13 PM
*edit* I just saw your edit, are you saying you can see 0x84 in IDA at 423A1F in the deadlist? In which case................ To save confusion, can you paste about 10 bytes at 423A1F as you see them in sice, and as you see them in IDA in the deadlist?

Sure.
Softice:

001B:423A19 8B8608020000 MOV EAX,[ESI+00000208]
001B:423A1F 48 DEC EAX
001B:423A20 5F POP EDI

IDA:

.text:00423A10 0F 84 F8 01 00 00 jz loc_423C0E
.text:00423A16 83 BD F8 FD FF FF 00 cmp [ebp+var_208], 0
.text:00423A1D 0F 84 EB 01 00 00 jz loc_423C0E
.text:00423A23 8B 95 F8 FD FF FF mov edx, [ebp+var_208]
.text:00423A29 8B 02 mov eax, [edx]
.text:00423A2B 85 C0 test eax, eax
.text:00423A2D 0F 84 9C 01 00 00 jz loc_423BCF
.text:00423A33 8B 50 24 mov edx, [eax+24h]
.text:00423A36 85 D2 test edx, edx
.text:00423A38 0F 84 91 01 00 00 jz loc_423BCF

WaxfordSqueers:
001B does indeed correspond with my CS register value. As for the rest, what I'm doing is *making* a trainer for a game. So, the NOP (and it's only one) that I insert to the application only does it at runtime, so it's gone the next time I launch the game. And there weren't any errors loading the game into IDA....
WaxfordSqueers
11-29-2004, 03:20 PM
Sure.
Softice:

001B:423A19 8B8608020000 MOV EAX,[ESI+00000208]
001B:423A1F 48 DEC EAX
001B:423A20 5F POP EDI

WaxfordSqueers:
001B does indeed correspond with my CS register value. As for the rest, what I'm doing is *making* a trainer for a game. So, the NOP (and it's only one) that I insert to the application only does it at runtime, so it's gone the next time I launch the game. And there weren't any errors loading the game into IDA....

Does this code change as you trace through it? For example, after you trace line 001B:423A19 (execute the MOV instruction), is the code still the same at that address, or does it change? I assume after the POP EDI instruction above, there will be a RET statement coming up. If so, check the code before tracing into the RET statement.

The IDA code looks too good to be a fluke. The thing I notice about it is the parameter '208' which is a common offset. i.e. MOV [ESI + 00000208]. That same value shows up in the IDA printout.

It's pretty tough thinking this out without more detail. Even at that, I don't have the expertise to do in-depth analysis.
WaxfordSqueers
11-29-2004, 03:38 PM
So my question is, what the heck? Where'd my offset go that appeared in Softice? I tried to search the forums but I couldn't quite figure out what to search for...I tried "offsets changing" and "offsets different" but neither worked....

Thanks.

This is a follow up on your initial question. Something just came out of the fog between my ears. I'm not an expert on the way apps are loaded by the OS, but it seems to me the base address of 400000 is not written in stone. The app is loaded there only if that address is available. I think there is also an option available to the programmer to load at an alternate address, although I'm not sure.

You might check the 400000 address 'after' your app is loaded. If I remember correctly, you should see the MZ header (the DOS stub) at 0x400000, and a little further on, you'll see the PE header. A little study on PE headers, and the way an OS loads them, will make this clearer. It's possible there is an offset between the Sice address and the IDA address. In fact, look at the beginning of the IDA disassembly and see if it starts at 400000.
dELTA
11-29-2004, 04:02 PM
You are correct in the fact that the programmer/linker can decide the (suggested) imagebase themselves, but for normal executables it will never be the case that this address is "unavailable" or "already taken", as long as it's inside the allowed range. This is because each process has its own virtual memory space in the operating system, with the possibility of using the exact same virtual addresses as any number of other applications at the same time (they will map to different physical addresses though, but that's another story).

The problem you describe can arise for DLL-files though, if some other loaded module of a certain process has already allocated the address range specified in the PE header of a module that loads after it. In this case the operating system will rebase the second module as it sees fit, by help of the relocation info that can be found in DLL files most of the time.
tdennist
11-29-2004, 04:45 PM
Does this code change as you trace through it? For example, after you trace line 001B:423A19 (execute the MOV instruction), is the code still the same at that address, or does it change? I assume after the POP EDI instruction above, there will be a RET statement coming up. If so, check the code before tracing into the RET statement.

The IDA code looks too good to be a fluke. The thing I notice about it is the parameter '208' which is a common offset. i.e. MOV [ESI + 00000208]. That same value shows up in the IDA printout.

It's pretty tough thinking this out without more detail. Even at that, I don't have the expertise to do in-depth analysis.

Ok, I held down F8 for a few seconds, and CS stayed at 001B the whole time :p. And, no, the next instruction after that POP EDI one is:

001B:423F14 C7860402000078000000 MOV DWORD PTR [ESI+00000204],00000078

If it is in fact good code showing up in IDA, what am I doing wrong? What should my next step be?

edit: Quick question: is there a way to copy information from Softice and paste it into, say, this window so that I have an easier way of transferring code fragments while posting on this board?
Kayaker
11-29-2004, 05:18 PM
Hi

Try breaking at the start of program and checking that address to see which instructions are there before the app has had a chance to execute. In theory it should be the IDA disassembly, but could have been overwritten several times by the time you "found" it using Softice.

Can you match up *any* IDA & Sice addresses, say around a recognizable API such as GetStartupInfoA or the first GetModuleHandleA, which should be called early in the code. If you can't find any matches, then the IDA disasm may be offset for some reason as Waxford mentions.

It seems a little unusual for a non-packed app to overwrite a section of code. Perhaps the IDA disasm is only throwaway startup code and for a (large?) game the programmer thought it more efficient to reuse the memory? But then there's the possible global var_208...
tdennist
11-29-2004, 07:15 PM
Try breaking at the start of program and checking that address to see which instructions are there before the app has had a chance to execute. In theory it should be the IDA disassembly, but could have been overwritten several times by the time you "found" it using Softice.

Can you match up *any* IDA & Sice addresses, say around a recognizable API such as GetStartupInfoA or the first GetModuleHandleA, which should be called early in the code. If you can't find any matches, then the IDA disasm may be offset for some reason as Waxford mentions.

All right...don't flame...I looked meticulously through the command reference and attempted a Google search or three...I don't know how to do three things with Softice (and many more, but these are the most important at the moment ;-)):
- Break at the beginning of program execution.
- Finding such "recognizable API" calls as GetStartupInfoA in a running program.
- Jump to a specific code offset. (I have to find the address of the lives variable every time I want to jump to 423A1F, so I can do a bpmb)

Help? *bambi eyes*
WaxfordSqueers
11-29-2004, 10:25 PM
You are correct in the fact that the programmer/linker can decide the (suggested) imagebase themselves, but for normal executables it will never be the case that this address is "unavailable" or "already taken", as long as it's inside the allowed range.

-----snip----
.

Thanks for clarifying that. Is it possible that the PE header could be offset from where it's supposed to be located in the PE header data? For example, if it was supposed to be at 0x4000100 and the start of code was at 0x401000 in the PE header data, is there a way the loaded PE header could be offset from those values?

I'm thinking IDA may read the image file differently than how the OS loads it.
WaxfordSqueers
11-29-2004, 11:13 PM
All right...don't flame...I looked meticulously through the command reference and attempted a Google search or three...I don't know how to do three things with Softice (and many more, but these are the most important at the moment ;-)):
- Break at the beginning of program execution.
- Finding such "recognizable API" calls as GetStartupInfoA in a running program.
- Jump to a specific code offset. (I have to find the address of the lives variable every time I want to jump to 423A1F, so I can do a bpmb)

Help? *bambi eyes*

Basically, you use the loader. You'll find it in the Sice directory and it actually has the word 'loader' with it. You should learn how to use the loader anyway, since it's invaluable at times. For example, in your winice.dat file, you are supposed to have certain imports listed to load automatically at startup. With the loader, you can load them after startup. You can also start the app from the loader and tell it where you want it to break...at start of code or at winmain.

There's another way to do it that I haven't used a lot. Actually, there's a small app that will do the same thing. It loads a 0xCC (I think) in place of the first byte of executable code. I'm not sure whether you have to use the loader, or if you can just run the app, but Sice breaks on the 0xCC because it thinks it's a breakpoint. Please check this information for accuracy. At least it will give you something to research and maybe teach you a bit about loading.

Once you've told the loader to begin, it might stop at a strange looking screen that looks like an error happened. Just single-step over the page (<T><Enter>) and you'll be at the very first byte of executable code (note: be sure you choose the first byte of executable code as a stopping point and not winmain. They are not the same.). You were joking about hitting F8 over and over and nothing happening. I don't use F8, prefering <T> plus <Enter>. That gives a single step. If you start single stepping at the first instruction after the loader, and if you have the key imports loaded, like kernel32, user32, MFC, etc., you will notice instructions like the one Kayaker mentioned near the beginning of the code.

You don't want to step into these unless you don't mind being dragged through the kernel for long periods of time. (BTW...I haven't tried to reverse in XP and references to kernel32, etc., may no longer apply). Anyway, when you come to an import like StartupInfo, stop immediately before it and hit <P> plus <Enter>. That will jump you right over to the other side of the import's code.

If you happen to get caught in the import code, you can often extricate yourself if you hit F12 immediately. Or you can hit F5 to make the program run. Of course, it will either go to the end of execution or stop at the next break point. At least you can reload and start over at the beginning of code.

On your way in, single-stepping, you'll arrive at Call instructions. You can jump over some of these, and others you can't. I used to make printouts of the code from the first instruction after the loader. I'd try each call instruction to see how many I could jump over. If one of them threw me to the end of execution, I'd just start over. It teaches you a lot about how apps are loaded and initialized. Eventually, you'll reach the function like GetStartUpInfo, that are in English.

Get a good function reference. I used Win32 Programming API Bible for years, but it's aimed at Win 95. After a while, you can tell by the parameters preceding the function exactly what it is trying to do. Also, you get used to the initialization functions and can save yourself loads of tracing time by jumping over them.

What Kayaker is telling you to do, however, is examine the code around the area of GetStartUpInfo, or one of the early imports. It will be in English characters if you have loaded it's import. That function is part of kernel32 or user32, so these have to be loaded in memory. Otherwise the function will not appear in character form, but as a Call to a numerical address.

You can make your reversing a lot easier by making .nms files using IDA. I haven't done this recently, but what it does is give character handles, in English, to functions rather than the numerical values you usually see in MFC code.

Print out a page of the code while you're in Sice, then go looking for the GetStartUpInfo function in IDA. The offsets should match, and the code should be the same. If they are different, check the exact differences in offsets, and that should be transferrable to the code section you are checking.

To jump to a specific code offset, first get into an area of code where you can stop the app. For example, BPX on GetStartUpInfo and run the app. Sice will break just into GetStartUpInfo. F12 over it so you're at the instruction on the other side of it. I think it's the 'g' instruction you use then (it's horrible when you've been away from this for a while). Anyway, at the Sice prompt, you enter g 0041Dxxx, or whatever the address is you want to jump to. It will take you right there in most cases. Of course, if you have breakpoints set in between, it will stop there first. :-)
WaxfordSqueers
11-29-2004, 11:37 PM
[QUOTE=WaxfordSqueers]

I'm answering my own reply to clarify the 'call' functions you will encounter as you trace in. .

As you trace from the start of code, and you hit the 'calls' I've mentioned, you can jump over many of them. If you can't jump over one, it's pretty well telling you to trace into it. Following one of the call functions, you should eventually hit winmain. When the program exits, it will return to the other end of that call you traced into and proceed to an exit.

Before you get to that particular call, however, you should hit a few calls with the name of the import after it. That's what you're looking for.
Silver
11-30-2004, 04:30 AM
It seems a little unusual for a non-packed app to overwrite a section of code.
Not that unusual, I found a shareware app not too long ago that did precisely that...

Quick question: is there a way to copy information from Softice and paste it into, say, this window so that I have an easier way of transferring code fragments while posting on this board?
Yes, it's available by default. In the sice Symbol Loader (IIRC), there is a menu option that displays the sice log - this is essentially everything outputted to the main sice "window".

Last point, not sure whether anyone has mentioned this to you but sice won't break on exe's that don't have the PE section marked as executable. If you pick up any basic unpacking tutorial (such as, manual unpacking UPX), it will explain how to check the executable flag in the PE section header and change it if necessary.
dELTA
11-30-2004, 05:21 AM
Thanks for clarifying that. Is it possible that the PE header could be offset from where it's supposed to be located in the PE header data? For example, if it was supposed to be at 0x4000100 and the start of code was at 0x401000 in the PE header data, is there a way the loaded PE header could be offset from those values?

I'm thinking IDA may read the image file differently than how the OS loads it.As I said, the main executable module of a process always gets its suggested address in practice, so these should always be displayed with the correct addresses in IDA. Other modules like DLLs are quite likely to get a different imagebase in IDA than during execution inside a process though.
naides
11-30-2004, 06:31 AM
Quick question: is there a way to copy information from Softice and paste it into, say, this window so that I have an easier way of transferring code fragments while posting on this board?

No. Copy and paste are high level Windows functions, Sice is below windows, and windows services are not working, for the most part.

You can print the screen and copy from there, or, I think IceExt has a service that allow you to dump the contents of the screen into a file, or, learn to use the log service in the loader. you can save pieces of disasm code while you trace it.
naides
11-30-2004, 06:38 AM
- Jump to a specific code offset. (I have to find the address of the lives variable every time I want to jump to 423A1F, so I can do a bpmb)

Help? *bambi eyes*

Consider your self flamed for using animal seduction tactics. . .
If I see a deer looking at me, I reach for my shotgun :devil:

Jump to an specific code offset

in Sice type: u 00423A1F ; 'u' means unassemble

or whatever code offset you wish, Sice will display it in the code window.

Be aware that if you type an address that does not corespond to the true begining of an isntruction, the code you will see is wrong. Look up the concept of "code frame" which I think is at the heart of your problem.
JMI
11-30-2004, 11:10 AM
Alright nadies it is considerably "unsportsman like" to be hunting deer with a "shotgun". :eek: Rifles are the perferred weapon of choice and the only legal one in this country. Although it is always open season on certain newbie questions, with whatever weapon may be at hand. :devil:

Regards,
WaxfordSqueers
11-30-2004, 08:57 PM
Alright nadies it is considerably "unsportsman like" to be hunting deer with a "shotgun". :eek: Rifles are the perferred weapon of choice and the only legal one in this country. Although it is always open season on certain newbie questions, with whatever weapon may be at hand. :devil:

Regards,

Being a vegetarian, and incurable deer hugger (not to mention sheep...baaaa) I came across, with some amusement, an htm file entitled, "Butchering the Human Carcass for Meat". Now, that's what I call original. Something Hannibal Lecterish about it.
:)
tdennist
11-30-2004, 09:51 PM
Thanks for all of your replies. I'm going to meticulously read through each of them tomorrow afternoon when I'm free with no work to do and see if I can make any more progress on this elusive problem :p.

(See? Newbies *can* learn and learn graciously. It's just that so many of them don't take the time to actually think out replies and questions, so they end up turning up like this: "guyz i really want 2 learn 2 crack. can u teech me?????". I'm trying really hard to learn and understand this stuff, and so you'll have to forgive me if I ask really lame and easy questions. But yes, thank you for your time.)


PVDasm 1.5e
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PVDasm 1.5e
PDA

View Full Version : PVDasm 1.5e

Bengaly
11-23-2004, 05:02 AM
Hi all,

a new version is up,
with gui fixes and additions.

hxxp://pvdasm.anticrack.de/index.php?Section=1

Enjoy

-Bengaly.
Bengaly
11-28-2004, 04:57 PM
Due to recent hacks,
i guess some didn't noticed i released a new version which fixed 2 nasty bugs, and i renamed the built to 1.5f. (keep confuse out)
since my domain is down now , i will upload the release here; so some at least can fetch it from the net.

thanks for the support.
regards,

-Bengaly.
Mostek
11-29-2004, 07:13 AM
Hey a nice project. Keep it up. :yay:

Peace
Mostek
Bengaly
11-29-2004, 09:38 AM
2 years old now ;)
thanks.
JMI
11-29-2004, 11:06 AM
Always glad to have your contributions here. Keep up the good work and hopefully anticrack will be back soon. :yay:

Regards,
Bengaly
11-29-2004, 12:35 PM
cool thanks JMI!
Solomon
11-29-2004, 10:42 PM
great disassembler. Hope more features can be added in the feature.
crUsAdEr
11-29-2004, 11:59 PM
I tried it again today, those pop up screen that appears out of no where are really annoying, anywhere to disable those?

I tried disassembling a file and if i force disassembly before EP then it give garbage, plus addresses seems wrong after a while... from 40Axxx it jumps to 3040xxxx... i cant even go to EP, it says address not found!

If i disable disassembly before EP and enable start disassembling from EP then the code looks good except i dont know how to access code area before EP :(

Just a short bug report :)
Bengaly
11-30-2004, 01:05 AM
crUsAdEr:
Just a short bug report
keep'em comming :)

those pop up screen that appears out of no where are really annoying

well, if you put your mouse over a jmp/call address than it will open the window which shows the target code insted of following it by hand.
if you blindly moving the mouse over the instruction, than yes it can be like an annoying popup window :) .. so yes i will add an option to disable it on the fly.

from 40Axxx it jumps to 3040xxxx
can be a buffer problem, i'll have to have the same exe so i can test it here - hint hint.

i cant even go to EP, it says address not found!
yeah, because a disassembler is also depending on FirstPass analyzer, pvdasm currently has a basic one - mostly what it do is to align the data/code

If i disable disassembly before EP and enable start disassembling from EP then the code looks good except i dont know how to access code area before EP
disabling this option will not disassembly anything before the ep, the code will be presenting in byte form.

to somehow make the disassembly more readble, you can try play with the extended options->data window and mark the addresses which should not be disassembled, or you can also increase the bytes from EP to disassemble from 1 to further (11 will be fair enough), and it shell fix your ep not found problem.

and if some still want to use pvdasm, you can share data between pvdasm and ida - load target in ida, make map, load in pvdasm and do whatever you want ;).

Solomon:
thanks, what features you like to see ?

keep bugs comming!
homersux
12-03-2004, 04:27 PM
hi, there, great tool, I use it from time to time. There are a couple things
that can be improved:

1) file lock on open, i understand some people may even prefer this but
I'd really like to see an option to make this either lock or non-lock so that a snapshot of a build can be viewed and compared with another build. As it is, this locking is a major inconvenience for me.

2) on the tool bar, I'd really prefer to have 2 more buttons to open/close files
more quickly rather than go through the mouse clicks

3) move the docking asm window out of the way, at least it should not hide the view of subsequent instructions after call/jmp etc.

I can help to develop these features, PM me if you want me to code something in.
Bengaly
12-04-2004, 05:15 AM
I PM'ed back homersux


Cookie timeout (grumble)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Cookie timeout (grumble)
PDA

View Full Version : Cookie timeout (grumble)

Silver
11-23-2004, 07:48 AM
Hi guys,

Any chance we could change the timeout/expiry on the forum cookies? Reason being, I took my time posting a reply, walked away for a few mins, came back and found the threads I've read/not read had been wiped (ie: like I've left the board and the "last visited" time has been updated). So a bunch of threads I hadn't read got marked as read because of the timeout.

Bah, I can't explain it properly. Anyway, happens to me quite often when I get distracted. To reproduce, wait till someone posts a new thread, visit forum, don't view anything, leave browser open for a bit then refresh main forum page - all the unread post icons are now read post icons.

Moan whine bitch complain ;)
JMI
11-23-2004, 02:17 PM
Ours is not to reason why, ours is but to bitch and cry. :devil:

Are you suggesting we need to change something because you get easily distracted and wander away from your computer for sufficient time for the cookies to time out? Shouldn't you just adjust your behavior, rather than change ours? :smug:

Regards,
Silver
11-23-2004, 03:26 PM
:D Am I sensing some payback for the sig? Damnit :D :p
disavowed
11-24-2004, 01:32 AM
come on jmi, this is obviously YOUR fault. just take the blame, and apologize profusely for your bad settings :)

seriously though, silver, it may be a fun exercise for you to do some reversing to make sure your cookie doesn't time-out (and of course post your findings here ;))
dELTA
11-24-2004, 09:05 AM
Silver, here's the procedure I normally use to get around this problem:

1.
Arrive at the RCE board index.

2.
Select the "New Posts" option (in the "Quick Links" drop-down).

3.
You now have a list of all your unread posts in all forums, and you can leave this window open until you have read them all, even if you go for lunch inbetween or whatever.

4.
Just remember, as soon as you have loaded any of these new posts, update the new posts list again (not by pressing reload, but by accessing the same link from the same dropdown again, because of the fucked up way that vBulletin cashes search results), or you may lose any new posts being made between the listing was done and the last thread was loaded by you (since the timestamp is updated on every server hit). I normally load all the threads in new windows, and then reload the index once to see if there were any new posts made during these few seconds. This way, not a single post can slip by me. :)
Silver
11-24-2004, 11:32 AM
Wow, um, that's really user-unfriendly :D Thanks for the tip though, I'll do that in future.
JMI
11-24-2004, 06:20 PM
Wow. It's really just much easier just not to visit the Forum until you are actually ready to spend some time reviewing the posts. Although I often have to attempt to multitask which reading the posts, I have not run into any problems. Of course, unlike some of our younger readers, I'm not so easily distracted by the rest of the world, having already seen a whole lot of it before. ;) I have it from reliable sources that dELTA falls out his window and gives chase every time a polar bear wanders by, even though he's "been there, done that" many times already. :devil:

Regards,
Silver
11-25-2004, 05:06 AM
I don't think it's a coincidence that JMI's post count ends in 666... ;)
SL0rd
11-25-2004, 07:48 AM
I don't think it's a coincidence that JMI's post count ends in 666...
All that JMI seems to need is a new girlfriend ... :) to make him look life through a more sweet window.
bilbo
11-25-2004, 10:33 AM
...assuming his wife let him free to do it AND assuming he is yet interested to this kind of stuff AND assuming the girlfriend wants to go near him...
JMI
11-25-2004, 01:09 PM
Hey... women aren't afraid to come near me. I bathe at least once a year, whether I need it or not. :sneaky: And bilbo, women with big hairy feet seem to be particularily attracted to me.

And for your information, I have both a spouse and a girlfriend. Age does have it's privileges, although both are probably only interested in what little money I have left. :thinking: And I have the advantage that nearly "every" female is a "younger woman". :smug: :devil:

So what does it mean that my post count now, once again, ends in "69." I seem to recall that also had some interesting connotations, :idea: but, because of my advanced age, I'm not sure I recall correctly. :cool:

Regards,
bilbo
11-26-2004, 01:54 AM
Brilliant!

Since it looks like you are interested to female hobbits, too, here is some info for you: http://www.sciencedaily.com/encyclopedia/female_hobbits

But, please, leave some of them to me, since it appears that I have zero chances with human females...

sad bilbo


Replacing Strings
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Replacing Strings
PDA

View Full Version : Replacing Strings

mbro
11-23-2004, 09:35 AM
I have a dll that exports a function that basically contains a string. I wish to change the value of the string that is being exported.
I loaded the DLL into reshacker and changed the string, when I loaded the product, it didnt work.
So I then looked at the dll in W32Dasm, and saw that the function was actually being assigned a specific resource string - so I went back to reshacker and added a string, changed the dll using Hiew so that it picked up my new string - but it didnt work!

I then looked at the dll in W32Dasm again, and saw that all the string IDs were there apart from the new one I had added. I dont think I am too far away from getting this right, but could do with some help on what I need to do next. I am guessing I somehow need to rebuild the resources for this dll - but I am a newbie and dont know how to do this!

Any help would be appreciated.
naides
11-23-2004, 10:17 AM
1. change the original string instead of adding a new one, asl long as the size is not too different, and leave the resources alone.
2. Run the program in a DEBUGGER put a bp on code of the actual exported function that returns the string, and find out, in real time, where it reads it from, and experiment how you can change that behavoir (make it read your string instead).
mbro
11-23-2004, 10:20 AM
Have already tried the first suggestion, changed an 'm' to a 'w' and it didnt work for some reason!
However when I change the resource id it does pick up the new resource. I.e. there are 10 resources, when I change it from id4 to id3 it works. When I change it to the id I added - doesnt work!
Will look at the second suggestion though, thanks for the help - any other suggestions are welcome!!
naides
11-23-2004, 11:43 AM
Please clarify the sentence it doesn't work.
It means that the function corrects the string it returns or it means that it returns an error or nothing at all?

Smells to me that,given this is related to software protection (i guess), further checks are performed on the string, either before it is returned by the dll function or after, in the main exe. By debugging and tracking who reads/copies the string at each step of the way, you should be able to figure that out.


java BigInteger
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > java BigInteger
PDA

View Full Version : java BigInteger

neur0n
11-23-2004, 12:12 PM
I have a program with following registration check.

regData = new BigInteger(encryptedLicense, 36);
decoded = regData.modPow(e, n);
realData = new String(decoded.toByteArray());
and then check for correct values

Since n is 1598 bit long only way to keygen it is to replace n.
I generated my own n and thought it would be piece of cake but I was wrong.

Problem is that realData must contain character '\' because it is a delimiter.

I was gonna use this code for keygen.

licString = "name\\company\\serial";
m = new BigInteger (licString,36);
c = m.modPow(d,n);
license = new String(c.toByteArray());

Problem is that java BigInteger constructor doesn't accept string with char '\' for radix 36. It takes only small characters and numbers.

How can I create BigInteger from licString ?

I don't want to make other changes to the apllication except changing n.
Solomon
11-23-2004, 07:15 PM
Your plaintext need NOT to be base36 string. Can be base256 string(e.g byte array).

licString = "name\\company\\serial";
m = new BigInteger (licString, 256); //or m = new BigInteger (licString.toByteArray());
c = m.modPow(d,n);
license = new String(c.toByteArray()); //should be license = c.toString(36);
neur0n
11-24-2004, 06:43 AM
Thanks for help. Now it works fine :) .


R.I.P. Win32ASM Forum?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > R.I.P. Win32ASM Forum?
PDA

View Full Version : R.I.P. Win32ASM Forum?

Kayaker
11-23-2004, 07:56 PM
Well this is a tragedy to say the least...

http://board.win32asmcommunity.net/
mike
11-23-2004, 10:07 PM
Did he not have any backups?
disavowed
11-24-2004, 01:29 AM
i think hutch hacked it so that all the traffic would go to hutch's site :-/
Fake51
11-24-2004, 01:51 AM
Crying shame, to say the least.

Fake
omega_red
11-24-2004, 03:40 AM
Too many brainless exploiters... If it was phpbb, recently there was serious hole discovered.
hosiminh
11-24-2004, 05:13 AM
Hey all hackers , shutdown microsoft.com not ollydbg forum !
Neitsa
11-24-2004, 08:02 AM
:mad:

This is trully a shame ! I can't and I think I'll never understand such "so called hackers" which are only bothering and making people sad.

Win32asm was (and I hope will be) a great community with many great coders and people who just want to learn. Many of the users from this forum will maybe not going to the hutch forum...

This is a great lost. I just hope Harold (Hiroshimator) will not give up and soon make a rebirth of the forum.

This makes me sad. I haven't enough words to qualify such action...

Regards, Neitsa.
Rackmount
11-24-2004, 08:45 AM
Read on Hutch's forum that Harold has a good up-to-date backup of the entire database. Hutch has also requested that anyone at his forum who is willing and capable assist in the restoration of the win32asm forum. Hopefully the down time won't be too long. Nothing like a good house wrecking to prompt a little house cleaning. Maybe this is an opportunity to improve upon what previously existed. (Just trying to make some lemonade from the lemons).

Rackmount
JimmyClif
11-24-2004, 10:35 AM
i think hutch hacked it so that all the traffic would go to hutch's site :-/

w00p :D
Silver
11-24-2004, 11:36 AM
Damn :( It's a nightmare keeping any kind of interactive (forum, cms etc) system on the net anymore. My site regularly gets hit with the same automated scanning tools looking for forum/cms vulns...
nikolatesla20
11-24-2004, 11:59 AM
They really should switch to VBulletin or something, phpBB always has major hacks, I grabbed a hack from securityfocus once and was able to hack in to about 75% of the forums my friend visited for the game Raven Shield (clan forums, etc), and was able to SQL inject / capture / crack a lot of passwords. Even made my own admin accounts :)

phpBB SUXOR for SECURITY.

-nt20
omega_red
11-27-2004, 04:40 PM
Damn! Is this a plague or what? board.anticrack.de is dead too...
Bengaly
11-27-2004, 04:55 PM
yup, its got hacked as well,
[pvdasm.anticrack.de]

i checked the server of pvdasm, no files has been deleted or changed except the index one.
JMI
11-27-2004, 06:58 PM
Well, that at least is a small blessing.

Regards,
comrade
11-27-2004, 08:05 PM
masmforum.com just died...
dELTA
11-27-2004, 08:28 PM
Damn, this is getting pretty serious...

Please everyone, read this:

http://www.woodmann.com/forum/showthread.php?t=6578
nikolatesla20
11-27-2004, 10:47 PM
I found this EXE on governmentsecurity.org

used to exploit by script kiddies no doubt.

-nt20
JMI
11-29-2004, 11:10 AM
Do we really want to help spread it around?

Regards,


Indentifing Armadillo version & unpacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Indentifing Armadillo version & unpacking
PDA

View Full Version : Indentifing Armadillo version & unpacking

zambuka42
11-23-2004, 09:46 PM
Ok, this is my first post. :) nice to meet you

Background:
---------------
I am pretty much a newbie.. although I've done a bunch of my own hands on learning cracking various unpacked programs.

I don't need help with cracking, as much as I do unpacking a program.

Research already done:
-----------------------------
I have tried reading tutorials on unpacking various versions of armadillo from 1.x to 3.7, however I was unable to follow

along most of them since I am a newbie. Many of the tuts made references to things most reversers would not need explanations

on.

As far as that, I can't really even find the tut I need until i identify exactly which version of Armadillo is being used..

which I have not had success with (found a tut for that, but wasn't very helpful)

Information I've Gathered:
----------------------------------
I have used Peid and Studpe to identify that the proggy is packed with armadillo.

Peid says: "Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks"
while...
StudPE says: "Armadillo 2.5x - 2.6x -> Silicon Realms Toolworks"

I do have the "cracked" version of a slightly early version of this program(2.08 vs the 2.15 I am working on). The cracked

.exe is also packed with armadillo, and comes with an ARMACCESS.DLL.

If I could unpack this 2.08 cracked.exe, I probably couldn't compare it to the original 2.08 .exe since I can't find a place

to download it.

Conclusion:
--------------
Anyway, any advice on either finding the Armadillo version of the program or the actual unpacking thereof would be very

helpful. Or perhaps just being pointed in the direction of some better tutorials suited for someone like me would also be much

obliged. I know this might be a big project for someone of my level, but I've always learned best by taking on projects too

big. Anywho, Thanks alot. -b

P.S., If you see this same post on some other forums, please don't be upset with me.. I'm too new to the forums to know which

are the best place for to post, so I'm kinda covering my bases :)
zambuka42
11-23-2004, 10:02 PM
Ok.. i had some trouble earlier with mephisto's version number tutorial (it was a real dumb mistake that comes from not using olly very much).

The version is 3.76... so at this point, i'm just trying to find some tutorials for this version. thanks. -b


call stack -back tracing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > call stack -back tracing
PDA

View Full Version : call stack -back tracing

guy11
11-24-2004, 01:52 AM
hi

this is a very simple problem i think... but i need somebody who gives me a push in the right direction ;)...

I try to implement some bof -protection, and so i will try too hook NtResumeThread and some other apis, and trace the call back to the first caller and check if the memory is writeable.....

But it is possible to trace the call back in a fast way ??
can you give me some hints ? or links ??
how manage a debugger like olly this ??

thanks a lot .....
homersux
11-24-2004, 01:14 PM
There is no easy solution for this. You have to analyze the code to be able to back trace. Because of the dynamic nature of execution, you can't
back trace 100% accurately.
bilbo
11-25-2004, 01:25 AM
Hi, guy11, that's not a very simple problem, as homersux pointed out.
Read for some problems you may experience the article at http://developer.novell.com/research/appnotes/1999/june/05/02.htm

You can eventually use the StackWalk API inside DBGHELP.DLL or IMAGEHLP.DLL. An example of its use is at http://win32.mvps.org/misc/stackwalk.html

Regards, bilbo


win32 edit control problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > win32 edit control problem
PDA

View Full Version : win32 edit control problem

homersux
11-24-2004, 12:51 PM
I am a little upset that edit control always select the entire text body in it. The code goes like this:

SetWindowText(hwndEdit, TEXTBUFFER);
SendMessage(hwndEdit, EM_SETSEL, -1, 0); <-- suppose to clear the selection but it doesn't work.

Can someone help me out with this problem? Thanks!

Lately I am hacking this well known new game that just came out, :devil:
I wrote a small application to help me looking into its internals. Oh boy, it's gonna be hacked death just like all the previous games from the same company. :confused: Their developers just don't seem to learn at all.

Edit: I have looked for answers on internet and in books and to no avail to this seemling simple problem...
JMI
11-24-2004, 06:05 PM
Thanks for the edit stating you have searched. Silver suggests I only have "a few stern warnings left" because I'm getting old, but he's wrong on the first point. I have lots left, even if I'm old. :devil:

Regards,
Silver
11-25-2004, 04:45 AM
homersux, that should work. Can you use a window spy to make sure the edit control is receiving the message? Perhaps it's doing a parent handoff or reflection...

Oh and JMI, :p
homersux
11-25-2004, 12:07 PM
JMI, aye, :D I am trying to avoid being stomped upon by the :whoops: bat. :devil:

Silver, the window handle is correct. Notice that the first line puts text into the edit control, and it does. When the edit window is up, the text are all selected by default (the behavior I am trying to get rid of). If i click inside the text edit control, the selection disappears.

Oh, BTW, I kinda moved on to OpenGL hacking, :devil: it's kinda easier with all the available hook points unlike d3d where I must obtain the device ptr somehow and then figure out the location of the beginScene call. With OpenGL, I can do a lot with glBegin and glEnable.
Silver
11-25-2004, 02:12 PM
homer, it's not that the handle isn't correct, I'm wondering if the control is doing command reflection to the parent (in which case it will never see the message). This link is MFC 4 so about, ooh, 64 years old, but should explain what I mean:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vcmfc98/html/_mfcnotes_tn062.asp

And opengl - bah, that's for kiddies ;) Good luck with it though, I'd be interested to read any writeup you do...
nikolatesla20
11-26-2004, 06:04 AM
Hey, I like OpenGL :) (DX is ok too though) BUT I have one rant:

Just why did M$ implement DirectX as COM interfaces?
There really was no point to it. Number 1, the whole creating-a-device is hidden behind the Direct3DCreate* function, and then also any other device creations are done from that returned device pointer. So in essence, it simply becomes a series of function calls anyway (just like OpenGL). Plus Number 2, they finally started putting in things that OpenGL had already, like matrix stacks.

Who's gonna instantiate a DX device or the network (another common use for COM objects)

I just really see no point in the DX interface thing, don't know why they ever did it that way other than to demonstrate / use somehow their own technology.

-nt20
0rp
11-26-2004, 06:46 AM
with COM it is object oriented (handles are oldschool :) ) and it is not bound to c++
The Svin
11-26-2004, 12:47 PM
"SendMessage(hwndEdit, EM_SETSEL, -1, 0); <-- suppose to clear the selection but it doesn't work."

No it shouldn't clear selection - it's in oposite to select all text.
Try SendMessage(hwndEdit, EM_SETSEL, 0, 0)
or any other with both last args the same.
homersux
11-26-2004, 01:45 PM
The Svin, I have tried numerous combinations of the last 2 arguments. None of them get the job done. Any one of you interested in writing a demo program to get it to work? hehehe. It'll take about 2 minutes at most maybe? :cool:

On opengl and d3d, I do notice a slightly worse performance of opengl on my ati 9600 card compared with d3d. My cpu is kinda slow, 1.0G oced to 1.33GHz. I always thought opengl was faster... :confused:

while I am studying the window proc of this program, in the d3d window proc, I found this portion of code:

.text:005852E1 test esi, esi
.text:005852E3 jz short loc_585304
.text:005852E5 mov esi, [esi+0EFCh] ; esi = [esi+0efc] = [hwnd+0efc]
.text:005852EB test esi, esi
.text:005852ED jz short loc_585304
.text:005852EF mov edx, [ebp+wParam]
.text:005852F2 mov ecx, [ebp+hWnd]
.text:005852F5 push edi
.text:005852F6 push edx
.text:005852F7 mov edx, ebx
.text:005852F9 call esi ; hwnd+0EFC => a windows message handler
.text:005852FB pop edi
.text:005852FC pop esi
.text:005852FD pop ebx
.text:005852FE mov esp, ebp
.text:00585300 pop ebp
.text:00585301 retn 10h

Apparently it uses the undocumented HWND data structure to handle window messages. While looking for HWND data structure information, I found this website http://www.winterdom.com/dev/ui/wnd.html. However it is still not complete and does not tell me what's going on in this code segment. Any thought on this usage of HWND data structure? BTW, this esi is not the default window proc.
nikolatesla20
11-27-2004, 08:05 AM
with COM it is object oriented (handles are oldschool :) ) and it is not bound to c++

Well, about the first point, it must not be that effectively object oriented, because every game engine still has to write a ton of wrappers around it. If you're gonna have to write wrappers anyway, then what's the point ? Seriously, if you go thru HeNe's OpenGL tutorials, OpenGL is pretty easy, even if it does use Handles. The way DX works, even though it's OO, it still seems like Handles anyway, because you are just passing object instances around (object addresses). That's pretty much what a Handle is !

Yeah, that second point is a good one I suppose :) Although a DLL is still a DLL ! COM might have been a binary standard, but you still need to ask the system to load the COM object for you, etc. Which means down at some low level you still have to have some C interface for your language (for example, python or VB). And you can still use DLL's from python or VB anyway (for example, to use OpenGL).

I don't have anything against DX, I think it has a lot of benefits, but I just don't know a real good argument for using COM to implement it.

-nt20
homersux
11-27-2004, 03:10 PM
Silver, what is 'GxWindowClassD3D' for d3d window? This looks like a window proc handler. I got it through 'hwnd process' in softice, it reports IME and D3D window proc addresses. Part of the GxWindowClassD3D code:

0b6d6402 55 push ebp
0b6d6403 8BEC mov ebp,esp
0b6d6405 A18C09830B mov eax,[0xB83098C]
0b6d640a 56 push esi
0b6d640b 8B7508 mov esi,[ebp+0x8]
0b6d640e 3BC6 cmp eax,esi
0b6d6410 0F85B8030000 jnz 0x0B6D67CE
0b6d6416 813D8809830B95429542 cmp dword ptr [0xB830988],0x42954295
0b6d6420 0F85A8030000 jnz 0x0B6D67CE
0b6d6426 8B0D9409830B mov ecx,[0xB830994]
0b6d642c F6C140 test cl,0x40
0b6d642f 7407 je short 0x0B6D6438
0b6d6431 33C0 xor eax,eax
0b6d6433 5E pop esi
0b6d6434 5D pop ebp
0b6d6435 C21000 retn 0x10
0b6d6438 A19009830B mov eax,[0xB830990]
0b6d643d 53 push ebx
0b6d643e 8B5D0C mov ebx,[ebp+0xC]
0b6d6441 81FB82000000 cmp ebx,0x82
0b6d6447 894508 mov [ebp+0x8],eax
0b6d644a 7509 jnz short 0x0B6D6455
0b6d644c 83C910 or ecx,0x10
0b6d644f 890D9409830B mov [0xB830994],ecx
0b6d6455 F6C110 test cl,0x10
0b6d6458 57 push edi
0b6d6459 745C je short 0x0B6D64B7
0b6d645b F6C108 test cl,0x8
0b6d645e 7426 je short 0x0B6D6486
0b6d6460 33C9 xor ecx,ecx
0b6d6462 890D8809830B mov [0xB830988],ecx
0b6d6468 890D8C09830B mov [0xB83098C],ecx
0b6d646e 890D9009830B mov [0xB830990],ecx
0b6d6474 890D9409830B mov [0xB830994],ecx
0b6d647a 890D9809830B mov [0xB830998],ecx
0b6d6480 890D9C09830B mov [0xB83099C],ecx
0b6d6486 6842420000 push 0x4242
0b6d648b 56 push esi
0b6d648c FF1524126A0B call [0xB6A1224]
0b6d6492 8B7D08 mov edi,[ebp+0x8]
0b6d6495 57 push edi
0b6d6496 6AFC push -0x4
0b6d6498 56 push esi
0b6d6499 FF1528126A0B call [0xB6A1228]
...
I am trying to find WM_KEY (0x102) in those code but I couldn't.

Edit: Yet another sidious problem from this application. When I set a breakpoint in ollydbg and tigger it inside the application, I cannot switch to ollydbg through 'alt-tab'. I can bring out the task manager which says application is not responding and can't switch to olly. I need a damn way to get back to a debugger and figure out the keyboard handler part! I am so damn close to figure it out through IDA analysis. BTW, the thing will just boot the computer if I use sice and trigger the breakpoint. It seems it does some funky D3D stuff.
Silver
11-28-2004, 09:35 AM
Silver, what is 'GxWindowClassD3D' for d3d window

I've never heard of that, but I'm fairly convinced of something now. Yesterday I wrote a huge reply to this, then firefox crashed and I lost it so never bothered re-writing.

I believe that your D3D app is using the Microsoft Common Files Framework, which is basically a win32 wrapper system for DirectX (kind of like MFC or WTL but DX specific). If you have the SDK installed, you can look at the code to any of the samples - you'll see it's all object oriented and class based, as opposed to the code I've posted previously which is normal "C style" win32 window handling. This doesn't help you much, but I always recommend people NOT to use the common framework, it's confusing and makes things much harder. Unfortunately the DirectX Appwizard that comes with the SDK (before 9.0c) creates common framework apps, so lots of people use it.

nikola, I also wrote a long reply to:
because every game engine still has to write a ton of wrappers around it
In brief, games have wrappers because it's developer and economically sensible to do so. With a wrapper, you only have to port your engine to port the game to PS2, XBox etc. When games houses code games, they normally have 2 teams - the engine team and the gameplay team. The engine team code the wrappers using the DirectX building blocks (for example, texture managers etc). The gameplay team use those wrappers to create the actual game content. This is a big thing for tools coding - every modern game uses its own tool set. By coding an engine wrapper, the tools can use the same codebase that the game does. That means the game designers can build levels, objects etc knowing that if it works in the tool, it'll work in the game.
nikolatesla20
11-28-2004, 12:16 PM
In brief, games have wrappers because it's developer and economically sensible to do so. With a wrapper, you only have to port your engine to port the game to PS2, XBox etc. When games houses code games, they normally have 2 teams - the engine team and the gameplay team. The engine team code the wrappers using the DirectX building blocks (for example, texture managers etc). The gameplay team use those wrappers to create the actual game content. This is a big thing for tools coding - every modern game uses its own tool set. By coding an engine wrapper, the tools can use the same codebase that the game does. That means the game designers can build levels, objects etc knowing that if it works in the tool, it'll work in the game.

Exactly :) Then really, the choice of underlying API is only for functionality, not implementation. (DX has DirectSound and DirectPlay, so it has much more functionality - oh, and pixel and vertex shaders too :)).

-nt20


Honeynet RE challenge
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Honeynet RE challenge
PDA

View Full Version : Honeynet RE challenge

agnonymous
11-25-2004, 06:00 PM
This guy is working for Silicon Realms !

hxxp://seclists.org/lists/honeypots/2004/Oct-Dec/0043.html
hxxp://www.honeynet.org/scans/scan33/index.html
apparently there are also anti-IDA tricks, checkout datarescue's message board
anyone working already on this one?
have fun
comrade
11-25-2004, 10:12 PM
What is this 'Honeynet' organization?
nikolatesla20
11-26-2004, 05:56 AM
I don't mind the idea of a challenge, but why the heck should I give away all my hard work to someone who makes protection systems? It's not worth the effort !

-nt20
dELTA
11-26-2004, 06:07 AM
Hi comrade, nice to see that some of the big names from the win32asm forum decides to come here after the win32asm forum incident, feel free to hang around. :)

About Honeynet:
The Honeynet Project is a non-profit (501c3) research organization of security professionals dedicated to information security. We have no products, services or employees, our research is done on a volunteer basis. It is our goal to learn the tools, tactics, and motives of the blackhat community and share these lessons learned. It is hoped that our research will benefit both its members and the security community. Founded in October, 1999, all of our work is OpenSource and shared with the security community.
user
11-26-2004, 07:30 AM
nikolatesla20: don't worry, nobody ask you to do so. In fact, I think they don't care if you want to take the challenge or not :). I find it funny that you would even think you are concerned. The challenge is targetted to professionnals or at least to people not concerned with their name being exposed. Not that your entry wouldn't have any value, but you seem to miss the point of being an OpenSource/Black Hat challenge. The fact the guy write protection systems for a living is coincidental in a way but however it seems to change drastically your view on the challenge itself and the organisation providing it.

Nevertheless, as an educational value (i.e. what those professionnals have under their sleeve...), you might want to have a look at it. Now nothing force you to release your results.

Anyway that's just my two cents.
Nico
11-26-2004, 06:01 PM
Hello LD and others,

Let me clarify one thing. This challenge has *nothing* to do with my current work, and as you can see , my company isn't even listed on the challenge website.

I don't use Armadillo or any part of Armadillo on this binary.

Beside, i don't ask all your hard work, i can crack this challenge myself without
problems :-)

There are weakenesses on purpose, and it is actually not that complex, especially for people like the guys on this board, ie : lot of reverse engineering
experiences.

On the other hand, i think it's still nice to have some kind of *free* training and reports available for people who wants to learn that kind of stuff.

There are cracking tutorials of course, but many people are quite against
this idea, especially when they are working for big companies.

I don't ask you to participate, you can just break it for fun if you want, i
know that you can crack it without too much troubles, but i still think
its a funny challenge.

Anyway, just thought i could comment about it.

Have a good day.

Nico

Ps: And no, we don't steal your ideas/hard work either ;-)

I don't mind the idea of a challenge, but why the heck should I give away all my hard work to someone who makes protection systems? It's not worth the effort !

-nt20
%UNDEFINED%
11-27-2004, 01:13 PM
I must commend you on Armadillo, although its a bit off subject.
I admire you work on it and I would rate it the best.
I have been unable to sucessfully unpack any version past 3.60.

Why doesn't Silicon Realms sponser something of this nature?
britedream
11-28-2004, 04:27 AM
I don't mind the idea of a challenge, but why the heck should I give away all my hard work to someone who makes protection systems? It's not worth the effort !

-nt20

not only I agree with your wording , but I think it worthes to be smart posting signature.

Regards.
Nico
11-28-2004, 10:39 AM
Hello %UNDEFINED%,

Thank you very much for your kind words, but as you said, its off topic.
I don't want to be flamed right away because i get compliments about Armadillo while i came to clarify the purpose of this challenge:)

Why Siliconrealms doesn't support this challenge?

Because we don't want to make publicity using a non-profit organization ,
that's why the name of my company isn't listed in the site. That would
be bad.

It will just be in the solution i will have to provide for this challenge, but you
won't see any fancy publicity.

I made this challenge because i am part of the french honeynet project, for which i do reverse engineering on binaries found on honeypots, such as worms, backdoors, trojans , virus etc. I wanted to contribute to the honeynet project with an interresting little challenge, which is breakable without too much troubles :)

Cheers,

Nico

I must commend you on Armadillo, although its a bit off subject.
I admire you work on it and I would rate it the best.
I have been unable to sucessfully unpack any version past 3.60.

Why doesn't Silicon Realms sponser something of this nature?
Neitsa
11-29-2004, 12:32 AM
Hello Nico,

Nice to see another RE challenge coming from you. I remember the one from secuobs/securitech which was very hard to break :). I haven't take a look at this one now, but coming from you I think it will be hard again...

Anyway if I can't break trough, I'll wait 'till the solution will be posted, it's always a nice thing to learn from.

Regards, Neitsa.
Nico
11-29-2004, 12:54 PM
Hey,

I think this one is a lot more funnier than the securitech one.
Don't worry, it is not that hard, but its pretty fun i think.
There are a lot of attacks points, and its nice to see how people attack
the same problem with different solutions.

I received a few interresting submissions already, and i think they are well worth reading :)

Have fun!

Nico

Hello Nico,

Nice to see another RE challenge coming from you. I remember the one from secuobs/securitech which was very hard to break :). I haven't take a look at this one now, but coming from you I think it will be hard again...

Anyway if I can't break trough, I'll wait 'till the solution will be posted, it's always a nice thing to learn from.

Regards, Neitsa.
bilbo
11-30-2004, 10:15 AM
Evil Has No Boundaries, isn't it?
Regards, bilbo
Nico
11-30-2004, 10:23 AM
Hi!

Evil Has No Boundaries, isn't it?
Regards, bilbo

hehe :) this is a nice song actually :-)
now, you are on the "fun" part of the code. As i said, it is not hard for people with reverse engineering experiences, but the code you are on now is kind of fun.

Cheers!

Nico
agnonymous
12-02-2004, 11:13 AM
I'm wondering...
If an evil hacker leaves a password protected program on a compromised system (which is obviously the case of this challenge) why bother with obsfucation at all? The best and most simple solution would be to use the supplied key to decrypt the payload (previously encrypted using a strong algorithm) => uncrackable malware!
Did i miss something?
Nico
12-02-2004, 03:28 PM
Hi,

I'm wondering...
If an evil hacker leaves a password protected program on a compromised system (which is obviously the case of this challenge) why bother with obsfucation at all? The best and most simple solution would be to use the supplied key to decrypt the payload (previously encrypted using a strong algorithm) => uncrackable malware!
Did i miss something?

The password is just here to illustrate the protection.
I can't tell anything yet because the challenge is not yet finished.
I could have done something else, its not the point of this binary.

Beside, a lot of would be joe hackers, aren't really smart, and sometimes,
they will use easy to break algos, or patchable protection etc.
Of course you can make a Haval 256 hash of the entered password, and use the result in your favorite strong encryption algo to take care of it all, but that's not the point.

Don't focus on the password itself, this is really not the point of the challenge.

Nico
agnonymous
12-03-2004, 06:13 AM
and Exploit for it doesn't matter :))))
I think I can start finding the right password now :)
Nico
12-03-2004, 06:23 AM
hehehe :)

I hope you don't concentrate too much on the password itself, without realising what's going on :)

Anyway, as i said, this little challenge is not hard for people with reverse engineering experiences :)
agnonymous
12-03-2004, 08:14 AM
Thanks.. that was good ...Looking forward to read the nice solutions on honeynet.
Nico
12-03-2004, 03:19 PM
Im glad you liked it.

I received very nice solutions, and i think, they are really interresting to read.
People will learn from it, definitely.. (Maybe not the skilled guys, but a good amount of people might ;)

Cheers!

Nico
Opcode
01-11-2005, 10:40 PM
The solutions are finally online ;)
Take a look:
http://www.honeynet.org/scans/scan33/

Regards,
Opcode
Kayaker
01-11-2005, 11:05 PM
Hi

This should be excellent reading. Best Regards to Nico (who still has the heart of a reverser...), and to all those who submitted (now I see why Bilbo has been so quiet...) :D

Cheers,
Kayaker
bilbo
01-12-2005, 01:51 AM
(now I see why Bilbo has been so quiet...) :D
Well, the matter is that I've spent all the holidays grabbing olives from trees and pressing them for oil... No Internet, no phone...
Now I feel a little rusty...

Anyway, I suggest the readings as a preliminary tutorial to a serious reversing of Armadillo protection: what I called Matrioska Layers and Garbage Patterns are found without not so many modifications in Armadilloed binaries too...

Regards,
bilbo
Nico
01-12-2005, 07:51 AM
Thank you Kayaker and i hope you like it!

Cheers,

Nico

Hi

This should be excellent reading. Best Regards to Nico (who still has the heart of a reverser...), and to all those who submitted (now I see why Bilbo has been so quiet...) :D

Cheers,
Kayaker
Nico
01-12-2005, 07:56 AM
Hello Bilbo,

First, congratulations for your nice submission.
I liked it a lot, and you gave a lot of details, i enjoyed reading it.

I enjoyed the tutorial layout too, remember me old days...

Anyway, I suggest the readings as a preliminary tutorial to a serious reversing of Armadillo protection: what I called Matrioska Layers and Garbage Patterns are found without not so many modifications in Armadilloed binaries too...

Well, i know there are a few common points, but i would like to recall that, the
tiny ASM loader on Armadillo is just here to block a bunch of people, and i don't think it is really challenging for skilled people to bypass.

More over, the tinay ASM stub hasn't changed for year(s), i should update it some days. The layer generator used for this challenge is more recent, and i didn't use all options either, as you will learn from my submissions.

Armadillo protections are different from what you will learn from this challenge, and the ASM stub isn't really part of the Armadillo protection.

One can protect a binary without this stub if he wants, and it doesn't change much the security of the binary.

My two cents.

Have fun reading the submissions!

Nico
disavowed
01-12-2005, 11:37 PM
Congrats, Bilbo!

I was surprised not more people used IDC scripts to get rid of the junk. My IDC was almost exactly the same as Eloy's hide.idc... I just got lazy when I got to the opcode interpretter :p

Nice challenge there, Nico. Keep up the good work, and I'm sure we're all expecting to see more great stuff in Armadillo ;)
blabberer
01-13-2005, 06:39 AM
Dear nico

"Anti" OllyDbg:

LoaderFlags and NumberOfRvaAndSizes were modified.. I have Reverse Engineered OllyDBG and Soft ICE to find a few tricks that could slow down the analysis of a binary. With those two modifications, Olly will pretend that the binary isn't a good image and will eventually run the application without breaking at its entry point. This could be a bad thing if you wanted to debug a malware on your computer, because you would get infected.

well i was bitten by this problem once so everytime i load unknown executable i physically change the bytes at enty point to 0xeb 0xfe
and load it that way the executable will load and loop at single place
and pressing f12 or esc in olly would pause the target in the entry point
which can be changed

but i thought it was related to only abnormal imagebase but you have quoted as modifying the Loaderbase blah is the reason
do you have the relevent disassembly in ollydbg like you have for softice where olly checks for this Loader Flags and loads it eventually ??

also after reading your submission i dusted off the dll which ran without stopping at ep once :) and glanced at the relevent places in both
the 0x90 and dll the dll doesnt have the Loader Flags modified or Rva blah
modified

ive attached a screen shot i can send you the dll in question if you prefer so

any more details on this behaviour by ollydbg would be appreciated

some funny details from that dlls notes that i made :)

ESP ==> > 2AE71E76 /CALL to GetUserNameA from badep.2AE71E70
ESP+4 > 0006F904 |Buffer = 0006F904
ESP+8 > 0006FA14 \pBufCount = 0006FA14

0006F904 Administrator

2AE6DC19=<badep.checks username with foo,goat,infect,guest>
2AE6DC19=<badep.checks username with foo,goat,infect,guest,sample>
2AE6DC19=<badep.checks username with foo,goat,infect,guest,sample,test,v-lab,virus>

thanks and regards
Nico
01-18-2005, 01:58 PM
Hello,

Dear nico
well i was bitten by this problem once so everytime i load unknown executable i physically change the bytes at enty point to 0xeb 0xfe
and load it that way the executable will load and loop at single place
and pressing f12 or esc in olly would pause the target in the entry point
which can be changed

This is a good practice, but i wouldn't trust it too much either.
One can run code before the entry point is executed, using a little TLS hack.
(Thread Local Storage). One could imagine, the TLS overwriting the bytes at Entry point, in order to make sure, everything runs fine ;)

but i thought it was related to only abnormal imagebase but you have quoted as modifying the Loaderbase blah is the reason
do you have the relevent disassembly in ollydbg like you have for softice where olly checks for this Loader Flags and loads it eventually ??

Unfortunately not, i loose my idb.
The imagebase in my case wasn't related. It also happens with a standard image base. I choose a weird imagebase, because i know a lot of reversers, that are used to "400000" and get crazy when they don't have their "marks".
It was just to tease them :)

For olly, i think it needs the modification of two fields in the PE header.

My original idea was having Olly to think it was a corrupted binary, thus,
it wouldn't load it. Unfortunately, it loads it nonetheless, but many people don't try to run it, after they see the bad message :)

also after reading your submission i dusted off the dll which ran without stopping at ep once :) and glanced at the relevent places in both
the 0x90 and dll the dll doesnt have the Loader Flags modified or Rva blah
modified

There are probably other issues in Olly.

ive attached a screen shot i can send you the dll in question if you prefer so

I will check it out, thanks.

any more details on this behaviour by ollydbg would be appreciated

I am not a huge fan of olly myself, so i don't really know anything more, beside what i said. I wish i still had that idb file..

All i did, was a quick and dirty reverse engineering of Olly to find this.

I mostly only use IDA, to do static analysis. And use Soft ICE when i need to.
Or IDA's debugger, to use its nice disassembly.

thanks and regards

Best Regards,

Nico
Nico
01-18-2005, 02:01 PM
Nice challenge there, Nico. Keep up the good work, and I'm sure we're all expecting to see more great stuff in Armadillo ;)

Thank you very much.
I am glad, i get some positive feedback. Most of the time, people think i steal ideas from the board, and that i can't code a single line of assembly :-)

I hope Armadillo will change, but i am not the one who decides.. sadly.
It would be so different if i could.

Nico
blabberer
01-19-2005, 04:58 AM
thanks for your reply nico
i was hoping to get some pointers to the mystery but unfortunately it seems not :(


database reverse engineering
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > database reverse engineering
PDA

View Full Version : database reverse engineering

vonbruno
11-26-2004, 07:11 AM
i need to reverse engineer a phonebook database. after two weeks of work (and learning) i'm out of ideas and need help. these are the things i found out:

the main database is a .dat file about 200mb big. it has some ascii parts (ie names of towns) but no people names are in plain ascii (didn't expect them to be). all i need are phone numbers. i checked logs from filemonitor and found the offset where the main app is doing phone number searches. from that point in file goes a consistent pattern which i think is some sort of index table.
it starts with
D9F8 4181 A386 0501 C7BF 08AE EC18 02C1 BF40 89A9 3300 C0C5 3383 AE32 00C7 17AC 3C00 C05B 8435 0086 2700

from then on a consistent pattern appears 80 03 0i 41 xx xx xx, i goes from 0 to 8. after each iteration of that pattern another one iterates 09 41 y bytes 0j like in a nested for next loop. j goes from 0 to 9 and y is 10 bytes for j=0, 5 bytes for j=1-8 and 3 bytes for j=9

the xx xx xx bytes are ie EB EC 45, DA B7 20, EF F2 7F, etc. not longint i think. i thought they may be ascii compressed, it would take me 4 bits a number given equal distribution, but then 7 digit phonenumbers wouldn't fit. also before D9 (byte where the search starts) is an plain ascii table and 14 bytes preceeding D9 (i think they are a part of my index table) are:
30 31 32 33 34 35 36 37 38 39 FA B9 1D 00

which seems very odd to me. of course the table could also be encrypted...

i also tried to re the main application. ollydebugger didn't come up with anything workable so i figured the app is packed (actually, olly suggested it :) ). tried ten or so unpackers, didn't come up with anything that works. tried to run it under softice, app detected it and refused to work. everything's been done on xp, i'm currently setting a machine with 98 so i'll try with frogsice

also tried debuggy. by looking through the cached strings, a lot of delphi is mentioned, also in one instance paradox. i figured that must be a paradox database, tried a couple of tools, didn't help. then i found out about WM_GETTEXT, but the window where phone number (and other data) appears is TPaintPanel type, and i don't think i can get the contents of that window with gettext (or can i?)

i'm currently all out of ideas. any help would be appreciated.


Windows undocumented native API, interesting article updated
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Windows undocumented native API, interesting article updated
PDA

View Full Version : Windows undocumented native API, interesting article updated

dELTA
11-27-2004, 12:15 PM
The following nice article was just updated to also cover Windows XP and Windows Server 2003:

http://www.sysinternals.com/ntw2k/info/ntdll.shtml
Silver
11-28-2004, 09:40 AM
While we're on the topic, this book has been updated too and is due to be republished on Dec 8th
http://www.sysinternals.com/windowsinternals.shtml
JMI
11-29-2004, 11:02 AM
And there's already a whole lot of begging on some forums for this to be warez as soon as possible. Some people just have no shame. :eek:

Regards,


other board gone
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > other board gone
PDA

View Full Version : other board gone

ancev
11-27-2004, 06:04 PM
hi,

http://board.anticrack.de/ is no more :(

ancev
dELTA
11-27-2004, 06:16 PM
Yep, seems like someone is on a killing spree, but don't dispair yet...

Btw, it was also mentioned in this thread, together with the news about the win32asm board:

http://www.woodmann.com/forum/showthread.php?t=6566


Win32asm and Anticrack board users, welcome here!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Win32asm and Anticrack board users, welcome here!
PDA

View Full Version : Win32asm and Anticrack board users, welcome here!

dELTA
11-27-2004, 07:06 PM
As most of you know, both of our sister boards the Win32asm board and the Anticrack board have recently been wiped out by hackers. :( Their different fates are still unclear, and stuff is certainly going on to try to make their situations turn out for the best. But...

Until that happens, all users from these boards are very welcome to come hang around here, to help you all regroup and keep the connections with all your old friends from your boards.

We have set up two new temporary forums that will stay until further notice, one for the Win32asm board and one for the Anticrack board. Users from these boards (and any of our current users too of course) are very welcome to use these forums in whatever way they see fit, and also of course use our PM system for similar purposes.

Please spread the word to as many people you can about this, and again, welcome!

Here are direct links to the respective forums, which you can use when giving out links to people when spreading the word:

The Anticrack Mini Regrouping Board:
http://www.woodmann.com/forum/forumdisplay.php?f=31

The Win32asm Mini Regrouping Board:
http://www.woodmann.com/forum/forumdisplay.php?f=32

Enjoy!

/The RCE board crew
dELTA
11-27-2004, 08:27 PM
Ok, masmforum.com was just wiped too. :( We have set up a temp regroupment forum for them too, same thing goes as above:

http://www.woodmann.com/forum/forumdisplay.php?f=33
Woodmann
11-27-2004, 10:47 PM
Sadly, all sites on anticrack are down.
nikolatesla20
11-27-2004, 11:08 PM
The exploit is pretty darn effective, and there's a nice script kid file sitting out there too. So I guess it was only a matter of time.

Seriously, no one on the internet should use phpBB. Stick with Invision or VBulletin. Far less exploits.

-nt20
nikolatesla20
11-27-2004, 11:10 PM
Protools is gone too, dude now I am pissed.
Woodmann
11-27-2004, 11:22 PM
If it matters.......

We are here working 24/7 to make sure we are safe. ;)

Woodmann
esther
11-27-2004, 11:23 PM
Protools is alive!!!!
Woodmann
11-27-2004, 11:46 PM
Seems like you have a case of cache envy :cry:

Unless you have some secret link we dont know about.

Woodamnn
elooo
11-28-2004, 12:44 AM
masmforum seems to be available now ;)

---- edit ----
Oops, it is not correctly rebuild :/
Bengaly
11-28-2004, 04:32 AM
nikolatesla20,
yeah, well, it's only the index file, i hope there is a backup for it.
Zero
11-28-2004, 05:35 AM
Nope. It is not only the index.xxx replaced. There are some other things going on on the box :/
Bengaly
11-28-2004, 05:38 AM
hm.. weird stuff..
Zero
11-28-2004, 06:14 AM
Just for example:
ps -ax show weird processes, the command top is fucke up, some libs have problems...

I will reset the full server, since I am not sure what rootkit is installed additional
Zero
11-28-2004, 06:58 AM
Anticrack will be back in 1 to 2 weeks ;)
Let's take it as sportsman...
esther
11-28-2004, 08:02 AM
Yeah most probably.Hope all forums and sites up soon :)
Seems like you have a case of cache envy :cry:

Unless you have some secret link we dont know about.

Woodamnn
nikolatesla20
11-28-2004, 08:07 AM
LOL Stupid PHPBB Developers, had a whole chance to catch this one. But NOOOO.

If they just ignored the reports they deserve what they get.

lol I got this shot from SecurityFocus. I suppose they only listen to their own "elite"???

-nt20
Silver
11-28-2004, 09:47 AM
What the hell is going on... I wonder why someone decided to target these community boards.

Anyway, for those who don't know, WayBack Machine has a relatively good (but out of date) archive of MasmForum:

http://web.archive.org/web/20040120201308/http://www.masmforum.com/

and of Win32AsmCommunity:

http://web.archive.org/web/20040127202112/http://board.win32asmcommunity.net/

It's out of date, but if you're looking for something it may help in the meantime. (Yes, the url suffixed by /http etc is correct, paste them as I typed them).
dELTA
11-28-2004, 10:39 AM
As mentioned by Zero on this board, Anticrack should be back in 1-2 weeks, and the other two boards are back running in a more or less restored state right now. They are still running vulnerable versions of the board software though, and might also be rootkitted like anticrack, so we will leave the temp forums here for a while just as a precaution, so feel free so use them if you want.
Zero
11-29-2004, 02:02 AM
I have to mention again: the hackers used NOT php or phpBB exploits, they exploited the *machine* directly!
Sure, it looks like they just replaced the index files, but on my machine they worked with root account.
dELTA
11-29-2004, 06:42 AM
Yes, but are you completely sure that the phpBB exploit wasn't the initial attack vector in any case? You can do a lot of fun local privilege escalation with arbitrary php command execution... Or have you positively identified the initial vulnerability that was used? (since I guess that we can assume that the root password to the server was not public knowledge to begin with?)
dELTA
11-29-2004, 06:57 AM
Ok, the win32asm board and the masmforum board have both been running stable for a while now, and they are also both supposedly running patched versions of phpBB (there seems to be a "bug" in phpBB 2.0.11 that makes the version marker still say 2.0.10 :rolleyes: ), so I'm removing the temporary support forums for them over here for now. The anticrack temp forum will stay up until Anticrack itself is back online though.
JMI
11-29-2004, 11:12 AM
Let's hope they are studying their server security issues as well as bugs in their board software. :yay:

Regards,


cracking a flash game
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > cracking a flash game
PDA

View Full Version : cracking a flash game

tdennist
11-28-2004, 06:47 PM
Ok, there's a game that's flash-based that I want to crack. I don't know how out of my league I am on this one, so tell me if it's way above my head :p. The serial number checking form is made in Flash. I set breakpoints in Softice on both GetDlgItemTextA and GetWindowTextA, but with no luck. What else can I try, or what other approaches can I make? Thanks.
dELTA
11-28-2004, 07:06 PM
Don't use normal tools like debuggers, just decompile and patch the Flash file directly.
cyberbarty
11-28-2004, 09:08 PM
Use either sothink quicker or URL action editor to decompile and patch the swf directly. both of these programs decompile flash so you can see (and alter) any part of it :)
tdennist
11-29-2004, 04:30 PM
Hmm. This seems too good to be true. What decent developer would protect his application with a Flash form that checks the serial if they can be so easily decompiled?

edit: ah. I see the source of the confusion. The game is in .exe format, but it's a flash game. What should I do now, as the .swf file isn't available to me?

(I'm almost certain it's a flash file. Is it safe to mention the name of it so someone can double check me and tell me if I'm right or stupid? :p)
dELTA
11-29-2004, 04:53 PM
No, don't mention the name, that would pretty much make this a crack request...

Anyway, try to unpack/extract the SWF data from the exe file, and then attack it with the tools above. Whatever makes you believe it's a Flash game anyway?
tdennist
11-29-2004, 06:45 PM
What makes me think it's a Flash game is that originally the game was on Shockwave.com, and then they made a standalone version of it. Also, on the registration form, it looks very Flash-like (not to mention how Flash-like the game looks). As I said, I'm almost, but not completely sure that it's a Flash game.

...and I'm ashamed to admit I have no idea how to start to unpack/extract the SWF data from the exe file.

Thanks!
disavowed
11-29-2004, 10:36 PM
the shockwave format != the flash format. if it's shockwave, you're kinda screwed :)
tdennist
11-30-2004, 05:02 PM
I refuse to believe there's no way to do the same to Shockwave files as there is to regular executables. Or, is there and it's just above my head?
JMI
11-30-2004, 06:50 PM
Well, the other possibility is always that it isn't "above your head" but beneath you. ;) And if you wish to refuse to believe something, how about doing some research on your own and see if you can find information which assists in your analysis. That's generally how work gets done.

Regards,
tdennist
11-30-2004, 07:39 PM
Ok, I can understand that in most cases. But in this case, somebody stating that there's no way to accomplish something? That goes against my personal beliefs, as well as my background in Perl. What research is there to do? Somebody crafted it, so there must be a way to un-craft it.

It can't be "beneath me" because 1) I believe that all knowledge is worth having, and 2) I'm at rock bottom as it is, nothing is below me ;-).
disavowed
12-01-2004, 01:29 AM
But in this case, somebody stating that there's no way to accomplish something?if you're referring to my response, i didn't say that there's no way to accomplish it. the reason i said what i said is because as far as i know, there are no tools or essays out there for shockwave-specific reverse engineering. this of course does NOT mean it is not possible, it just means that you'd have to start from scratch.
gryzon
12-08-2004, 06:36 AM
Delta: It's very interesting about unpacking/extracting the SWF data from the exe file. Could you tell me how can it be done? :D Thank you.
dELTA
12-08-2004, 06:28 PM
Analyze the loader stub, preferably from two different swf files packed with the same exe-maker, and then see where it loads the swf from memory, and dump it.
gryzon
12-13-2004, 11:38 AM
Ok, thank you very much Delta.
FrankRizzo
12-13-2004, 09:18 PM
Gryzon, another thing that you might want to do, is a to get a package that MAKES swf files, so that you can write little apps, and compile them up. Then, you KNOW the stub is always the same, as you're making it!
Woodmann
12-14-2004, 05:08 PM
Howdy,

It has to be unpacked first before you can do anything.
My dollar is on armadildo 3.61. I am playing with one now and
I have to manually unpack it. That would be the "good" way to do it.

I have found a way to restore it after the 60 minute expiration with just a few mouse clicks but, this is just me playing around ;)

Woodmann
YesItsMe
02-23-2005, 02:02 AM
Hi guys.

can anyone plz pm me a link to this flash game? I think I can help a great deal in this.

P.S: Don't let the posts count give you a wrong idea about my skills it's just that I'v been active in other forums under a different name.
JMI
02-23-2005, 02:33 AM
We generally only draw conclusions from the questions which are asked and the way in which they are asked. Normally, people here do not start with a review of the post count, before reading the Post. :yay:

Regards,
YesItsMe
03-07-2005, 01:30 PM
sorry for the repeated request, it's been two or three weeks and haven't received any reply, so I'm asking : can anyone pm me a link to the application discussed here? I promiss I'll reverse it in no more than 24 hours and that I'll write a tutorial about the "how to" of my approach...

sorry JMI, it's NOT a trick to increase the post count :) just reply and delete if you want...
Woodmann
03-07-2005, 07:42 PM
Hi,

I have no idea what the target is. Just pick your own game and go for it.

If you can get the game with the .SWF extension, it will be a bit easier to work with. The .EXE version is bundled with a bunch of crap you already have to run shockwave stuff.

Then again, maybe they only make the .EXE version available to make it more difficult :thinking:

I worked on a prog yesterday that just need a .DLL file/call patched.
And the header file will tell you a lot ;)

Woodmann


Visual Studio debugger better than SoftICE?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Visual Studio debugger better than SoftICE?
PDA

View Full Version : Visual Studio debugger better than SoftICE?

HX0
11-28-2004, 08:43 PM
Following on from the thread "Clarification of breakpoint contexts"

I finally gave up trying to get Softice working on either Win2k or XP despite trying for several days and using every patch and hint in the known universe. (Yes did try the various symbol approaches, got just more & different freezes and BSODs)

I was attacking a running service with no breakpoints available via Softice (when it ran, which wasn't often) and its loader refusing to break on entry so no chance of even getting a starting BP on the app.

Fired up Visual Studio, selected Attach To Process, and voila ... what have I been missing. It worked perfectly, did everything which Softice seemed to do, did not crash once, and allowed me to reverse the app.

For generally debugging Windows apps is there any advantage to Softice at all? It seems not.
Aimless
11-28-2004, 10:53 PM
Occassionally, I have to agree....

What with guys at Compuware being unable to get more and more knowledge about the advanced versions of windows.

Ice for '98 worked great cause you could RE the entire OS...Ice for NT worked a little buggily cause you couldn't RE the OS...Ice for XP seems to work even more unreliably....Who knows about Longhorn?

Possible cause is that ICE is meant to be a DEVELOPER debugger. It means its expected you have the source...unfortunately, its used for lots other purposes.

But I think MS is gaining in the debugger arena. Though its got a lot of catching up to do (mainly due to the reputation of ICE), its getting there.

Have Phun
0rp
11-29-2004, 08:21 AM
softice is for kernel debugging
and if you can use vsnet instead of softice you arent debugging kernel code

an alternative for kerneldebugging is windbg. its free, its the official microsoft way for doing kernelstuff and its very powerful
JMI
11-29-2004, 11:00 AM
And it is not beyond M$ to screw with the competition and make something in their software that makes other company's software less functional. :boo:

Regards,
HX0
11-29-2004, 07:25 PM
I wonder, would it really be so hard for Numega to do this:

In relation to their Softice which targets XP and Win2k;

1. Get it working, at least most of the time, which it doesn't, no matter how hard the user tries;

2. Make breakpoints work, since they are a feature of it, and they don't work most of the time either.

Surely, that can't be so hard for Numega. They managed it before and these are such basic things for a package loaded with so many esoteric powerful features.
Aimless
11-29-2004, 09:42 PM
Above all, Compuware is a commercial company. Though the tools provided are used by crackers, its primary meant to be used by developers.

Have you noticed a subtle change in their policy by promoting more and more of Visual SoftICE rather than SoftICE? What with all the fancy GUIs and stuff being more popular.

I can imagine Finance and Marketing Directors on the board demanding that something be done about the "backward" interface of SoftICE and give it a more pleasant frontal dressing. THough Visual ICE at the moment takes only remote debugging, nothing prevents its from getting to debug normal apps on single machine too.

And I imagine that they are going to develop a character GUI, much the same way as the Partition Magic Boot Disks so that the user can debug kernel in still the graphical mode.

As always, MONEY above all else. And really, I don't blame them.

Have Phun
Silver
11-30-2004, 04:24 AM
And I imagine that they are going to develop a character GUI

sice has that already, to a point... You can resize the frames, click on registers, right click for menus etc. I think it would be come less user friendly if command line was replaced by 100% GUI. Once you get past the initial learning curve, it works perfectly.
HX0
11-30-2004, 04:44 PM
THough Visual ICE at the moment takes only remote debugging, nothing prevents its from getting to debug normal apps on single machine too.

To clarify: You mean that the Visual Softice only works in a two-machine scenario?

I just installed it and it looks great. But attempting to connect to localhost seems to always fail.

Surely there isn't any real reason why the front and back end of Visual Softice cannot connect? Or cannot be reversed so they will connect?
dELTA
11-30-2004, 07:40 PM
The reason is that Softice freezes the entire machine when you break into it, so that no normal application like e.g. their own GUI can execute. This would not necessarily be easy to workaround at all...
HX0
12-09-2004, 05:43 PM
Looking at the basic capabilities of Visual Studio debugger:

Having installed the Win2k symbol pack from M$

Debug Process -> [Choose a process and attach to it, break it]

Knowing that the program calls Kernel32::ShowWindow

Set breakpoint on Kernel32::ShowWindow

(You may, or may not, see an address light up in the Breakpoints window, and clicking the breakpoint->Properties may, or may not say the debugger recognizes the symbol)

Press F5

Cause your debugged app to show window (Notepad -> About Menu as an example) and ....

no break.

Wonder why 1. Sometimes the breakpoint finds an address and not other times and 2. It doesn't break.

Since this is not a kernel debugger, I wonder if it's possible to break on windows msgs by breaking an API call somewhere conditional upon the message being called?

Sorry to have to resort to such a crude tool as VS debugger, but SoftIce really isn't playing ball with XP and I (we) need something we can fire up and debug on-the-spot as we need it. Softice seems to be falling out of fashion in that role rather rapidly.

Did try windbg, good debugger, didn't seem to be as friendly as Softice or VS debugger though
doug
12-09-2004, 06:25 PM
so what exactly do you want out of your debugger?

do you want to debug something for which you have source code or not?
do you want to debug the kernel or user applications?

The answer to these 2 questions will guide you in choosing the right tool for the right task.
(ollydbg, ms vs debugger, softice, windbg/livekd, ...)
Silver
12-10-2004, 09:48 AM
I absolutely detest windbg... I use it for analyzing crashdumps, and hate every minute of it.
HX0
12-11-2004, 04:17 PM
so what exactly do you want out of your debugger?

do you want to debug something for which you have source code or not?
do you want to debug the kernel or user applications?

The answer to these 2 questions will guide you in choosing the right tool for the right task.
(ollydbg, ms vs debugger, softice, windbg/livekd, ...)

Windows applications without source code. With the ability to breakpoint on calls to Windows APIs and (occasionally, if possible) to break on windows msgs.

What really goes on beyond the entry to an API function isn't of great concern. The target is the windows application .exe not the API.

I have used Softice in Win9x for years and found it a great tool for the above purpose. (The only thing it doesn't do which would be nice is highlighing the contents of referenced strings when viewing disassembly. W32DASM seems to manage that task for a dead listing but having to dead-list before going to work on a prog isn't ideal + W32 doesn't handle string references correctly under XP anyway.)

Ideally I would continue to use Softice however as outlined previously it has technically broken on Windows XP and the 2k version is so bug-riddled I have never been able to get it working properly on anything newer than NT4.

Visual Studio debugger was doing a decent job until I tried to set breakpoints on windows API calls when they wouldn't fire. Softice used to do this successfully on 9x. bpx ShowWindow, etc.

I don't understand the definition of Kernel debugging or at what point in the call stack there is a transition between Kernel and user-mode code. I have no need to trace beyond the code within an .exe so I guess the higher-level debuggers will be OK. However the ability to breakpoint on an API entry point is critical to any kind of reversing.
disavowed
12-11-2004, 07:59 PM
after compuware bought numega, all of the smart people working at numega left. many went to microsoft and wintellect. thus, softice now sucks. get used to windbg, since that's where the future is.
TQN
12-11-2004, 08:54 PM
What version of VS you are using, VS 6 or VS .NET (2002, 2003), and what your OS ?
Kayaker
12-11-2004, 09:31 PM
What's cool about Windbg is that you can write your own dll debugger extensions using the WINDBG_EXTENSION_APIS. What's even cooler is that this feature of Windbg is what the Softice debugger KDextensions are based on, using many of the same API's. Therefore you can actually use Windbg to initially develop the framework for Softice extensions, and believe me this saves on BSOD's. So add LiveKD and the dump check in there and Windbg ain't all that bad (even if it is MS ;)
blabberer
12-13-2004, 04:47 AM
Dear kayaker,
Greets

if by using LiveKd by sysinternals are we able to single step inside
int 2e (ntdll.dll syscalls) int 2b (user32.dll GetDc+0x3a) etc
and is it possible using a single machine setup (not two machines i dont have two machines) well sice may be able i dunno because i dont use sice and dont prefer to use it

btw when ever i run livekd it seems it opens up -z blah\**\\.\.dmp as its commandline
and scrolling up in dos window seems to be a big problem (nothing is visible above the window height)
so if i use livekd -w ir sure opens up windbg with kd > prompt
buti f use ctrl+i and reload or just use .load "path"
it seems the kd prompt just goes off and windbg is turned into plain user mode debugger (for which i use ollydbg and it works absolutely terrific for my needs)

since you comment upon windbg and livekd i post this up in expectation that you would be able to provide some pointers on using
windbg in concurrence with livekd

preferably a small tut with a simple crackme debugged with windbg and livekd :) hope i am not expecting too much :)

thanks and regards

ps a search on livekd in this board would turn up just three or four vague posts on livekd and windbg :) same scenerio in google :)
homersux
12-13-2004, 08:06 AM
if you downloaded livekd, there is a readme file that explains pretty much
everything nicely.
blabberer
12-13-2004, 09:10 AM
Dear homersux,
thanks for answering
i think sysinternals probably changed livekd.zip contents between your downloaded version and my downloaded version
if it is not a problem for you and if the board rules permit i request you to
upload the readme which nicely explains things about livekd usage
thanks and regards
homersux
12-13-2004, 04:47 PM
First download and install the Debugging Tools for Windows
package from Microsoft's web site:

hxxp://www.microsoft.com/whdc/ddk/debugging/

If you install the tools to their default directory of
\Program Files\Microsoft\Debugging Tools for Windows, you
can run LiveKd from any directory. If you haven't installed
symbols for the system on which you run LiveKd, LiveKd will
ask if you want it to automatically configure the system to
use Microsoft's symbol server (see the Debugging Tools for
Windows documentation for information on symbol files and the Microsoft symbol server).

It seems you are asking how to use livekd, well livekd is nothing
but a tool to generate a snapshot of the live machine. The real beef
is inside windbg. Remember 'help' and 'ln' are your friends.
Kayaker
12-13-2004, 05:16 PM
Hi

Sorry, I don't have a LiveKD tutorial + crackme up my sleeve right at the moment, but I'd happily endorse such a Mini-project ;)

LiveKD may not come with a manual, but it does come with a readme which states:
"LiveKd, a utility I wrote for the CD included with Inside Windows 2000, 3rd Edition, is now freely available. "

Which means... where would the best information come from?

Want more? Using good Search parameters on the net should give several examples as well. "copy and paste" code would probably have these search terms in common:
kd> livekd

Kayaker
blabberer
12-14-2004, 05:32 AM
Dear kayaker,
Thanks for a Sensible answer,
hope you grab some time from some vortex and do start a project that
works with windbg and livekd and on ways to get it debug inside syscalls
using single machine
btw Livekd is free but is the book free too (sorry i did not search but just posed this question after i read your answer)
and yes i will try to find code snippets in google with kd > as search terms :)
thanks and Regards

Dear Homersux,
thanks for your answer too,
but i have a niggling feeling that you havent either read my post or saw windbg and live kd and dismissed it as bah some bloody noob with a bloddy useless question to endorse my theory i quote below some parts of my earlier posts

so if i use livekd -w ir sure opens up windbg with kd > prompt

if i read a post with such a sentance i would assume that the poster has
windbg and has installed it in the dir where ever it is supposed to be

btw when ever i run livekd it seems it opens up -z blah\**\\.\.dmp as its commandline

with this i would assume that the poster has successfully run livekd and is trying to ask a question with which he has a problem

but if use ctrl+i and reload or just use .load "path"
it seems the kd prompt just goes off and windbg is turned into plain user mode debugger (for which i use ollydbg and it works absolutely terrific for my needs)

with this sentance i would assume he atleast knows some of the b***s*** which he is talking about

but probably my usage of english is very very bad i assume now because it did not convey what i wanted to convey and i still get a RTFM reply from an experienced guy like you

anyway thank you once again for answering
i hope i could improve my english a little better
regards
homersux
12-15-2004, 09:04 AM
blabberer, thanks for pointing out those important notes, hehe. Personally
I don't use livekd that often, it is only when i need it for a kernel mode
problem, i.e. driver, kernel apis etc. Because livekd only captures a snapshot of the live machine, it's only useful to diagnose a static problem. Softice
is more useful when it comes to a dynamic problem. However, softice is
not as stable as kd, the stability and level of detail goes like this kd > windbg > sice. But sice is still the most powerful in a knowedgable hand.

the book kayaker mentioned does not contain any good kd tips, only thing I found that contains useful tips is a book about debugging windows kernel coredumps. But kd (or windbg) has a nice builtin help command that pretty much explains all the commands nicely. How to combine these commands and craft powerful results require experiment and experience. And if you have some specific question or kd related issues, let us know.

best regards

Edit: I strongly encourage everyone to use Ollydbg as their ring3 debugger, this thing coupled with ollyscript is the most powerful ring3 win32 debugger I've ever seen. However, as the 64bit stuff approaching fast, I hope Ollydbg can catch up too.
disavowed
12-17-2004, 01:52 AM
the stability and level of detail goes like this kd > windbg > siceit's really (kd == windbg) > sice, since kd and windbg use the same engine
homersux
12-17-2004, 10:42 AM
same engine, but kd is console and windbg is gui, and we all know how buggy win32 messsage queue is.
blabberer
12-18-2004, 07:16 AM
Dear homersux,
well i would like to thank you for clarifying my doubts :)
anyway i was intereseted to know if i can do some live single stepping inside syscalls
with a single machine

not getting some static !EPROCESS !threads !psloadedmodulelist !teb ,!peb
i wanted to know if i could single step inside

lie old debug for dos

AX=0000 BX=0000 CX=0000 DX=0120 SP=FFEE BP=0000 SI=0000 DI=0000
DS=1068 ES=1068 SS=1068 CS=1068 IP=0103 NV UP EI PL NZ NA PO NC
1068:0103 B409 MOV AH,09
-t

AX=0900 BX=0000 CX=0000 DX=0120 SP=FFEE BP=0000 SI=0000 DI=0000
DS=1068 ES=1068 SS=1068 CS=1068 IP=0105 NV UP EI PL NZ NA PO NC
1068:0105 CD21 INT 21
-t

AX=0900 BX=0000 CX=0000 DX=0120 SP=FFE8 BP=0000 SI=0000 DI=0000
DS=1068 ES=1068 SS=1068 CS=05F1 IP=0445 NV UP DI PL NZ NA PO NC
05F1:0445 EAA0040B03 JMP 030B:04A0
-t

AX=0900 BX=0000 CX=0000 DX=0120 SP=FFE8 BP=0000 SI=0000 DI=0000
DS=1068 ES=1068 SS=1068 CS=030B IP=04A0 NV UP DI PL NZ NA PO NC
030B:04A0 80FC72 CMP AH,72
-

well from your description it seems it will not be possible :(
correct me if my assumption is wrong
thanks and regards
homersux
12-22-2004, 11:01 AM
If you have windows xp or 2003, I think you can do live debugging with windbg directly. Actually at this point, I am not quite sure about my statement about livekd creating snapshot of live system, you may be able to do realtime debugging as well. I got the statement from the 'windows 200 kernel debugging' book but it seems controdict with livekd readme:

LiveKd
------
LiveKd, a utility I wrote for the CD included with Inside Windows
2000, 3rd Edition, is now freely available. LiveKd allows you
to run the Kd and Windbg Microsoft kernel debuggers, which
are part of the Debugging Tools for Windows package, locally
on a live system. While the latest versions of Windbg and Kd
have a similar capability on Windows XP and Server 2003,
LiveKd works on NT 4 through Server 2003 and enables more
functionality, such as viewing thread stacks with the
!thread command, than debugger's own live kernel debugging
facility.


Boomerang decompiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Boomerang decompiler
PDA

View Full Version : Boomerang decompiler

sf42
11-29-2004, 04:55 AM
Seems to be an attempt to produce a decompiler for executables. I quote from the website: "This project is an attempt to develop a real decompiler for native executables through the open source community". Binaries available from the website are outdated so I suggest to checkout the current from cvs. I managed to build it with Linux but had no luck with msvc or MinGW. Btw, they offer money to people to fix bugs in the program.

hxxp://boomerang.sourceforge.net/index.php


New i2s -> completely rewritten
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New i2s -> completely rewritten
PDA

View Full Version : New i2s -> completely rewritten

Mostek
11-29-2004, 07:03 AM
http://mostek.subcultural.com/IDA/ida2sice_401.rar

[ 25.11.2004 ]
Fuf. Finally it's here. Tataaaaaa (that were the trumpets ;)) ).
So AAAA LOOOOOT has been done in the last month and half. So here are the results:

1st read the what's new in readme.txt
2nd before you start loading the NMS database directly to the SoftIce try to load it with Loader32 first as
Loader32 can detect some error. Now if this happen contact me and be quick as I'll stop supporting i2s soon.
Well school is really killing me lately so even the glDriver project has just a few more months to live.

Now if somebody wants to be the support guy for i2s and SIE just contact me -> well Jimi already said he will
try it, but better to have two -> just to be 100% sure.

So in short what's new:
speed, any types of arrays, disable/enable symbols and/or source listing on separate file,
fixed 2 bugs (segment naming and source listing and command line sinhronization)

Well try it and report (you can even mail me that it works fine). :D

Fuf almost forgot there is new n2t too -> it's in the rar file.

[ 29.11.2004 ]
4.01:
- It looks I've accidentally thrown out the ability to create nms databases if SoftIce isn't loaded.
- Fixed a bug:
In SeSection_SYMD nEnabledSourceFiles wasn't cleared if 'master source listing' flag was cleared.
So NMS database reported that there is source info data even if there wasn't any -> Sice would probably crash.
dELTA
11-29-2004, 07:11 AM
Nice! Too bad about your lack of time, let's hope you'll be back later when you have that degree anyway. ;) Thanks for your great tool.
JMI
11-29-2004, 11:05 AM
Yes. Always want to appreciate those who take the time and have the talent to develop tools for the rest of us who have a shortage of both. :yay:

Regards,


Different paths in different Computers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Different paths in different Computers
PDA

View Full Version : Different paths in different Computers

naides
11-29-2004, 09:28 AM
The problem.
I have an application protected by what I thought was a rather primitive protection: It stores the state "registered" or "not registered" in a global bool variable. I changed the code that sets the variable so I am "registered". the modif works OK on a pentium 4 Windows XP professional OS.
I copied the altered file to a AMD 64 running Windows XP OS. The program complains "not regtistered" I debugged it in the new system: the altered code is still altered, but it is never run.
I traced a little bit, and the symptom is, in this different but very similar computer, the app code flow takes a different path that bypasses my modification. Of course I can fix the problem, but I am somewhat puzzled by this behavoir.

My questions to the public are why? and how?
The OS is the same, as far as I can tell: XP professional sp1 (Installed from from the same CD actually), the CPU is different but this should not be an issue for a ring3 running app, right?

Any suggestions on how I can figure out where or how the execution path diverges between the two machines?

It is out of curiosity, for the most part...
dELTA
11-29-2004, 12:32 PM
One random idea for a method:
Maybe you can set a breakpoint in your patched code in the first machine, and then write down the callstack when it breaks. In the second machine, set breakpoints on all levels of this callstack (shouldn't be too many to handle), and see at which level it stops breaking. The difference in execution flow most likely resorts in this function, and using manual tracing will most likely not be overly bothersome to find the final spot once you know this.

Let us know what it was when you find it anyway. :)
disavowed
11-29-2004, 10:24 PM
reminds me of bleem (the first crack released didn't quite work 100% for amd)
JMI
11-30-2004, 11:16 AM
Someone please call M$ and report that "nobody" has installed their copy of M$ from "the same CD" on more than one machine. :eek: Oh the shame of it all. ;)

Regards,
Kayaker
11-30-2004, 04:38 PM
Any suggestions on how I can figure out where or how the execution path diverges between the two machines?

An API monitor might pick up the differences. If not, I know a more generic call function (as opposed to strictly API) monitor which might, but it hasn't been released yet..
JMI
11-30-2004, 06:57 PM
Wow. Kayaker knows a secret. Now we'll have to kill him so he can't tell. :devil:

Regards,
Kayaker
11-30-2004, 10:05 PM
Aah, no beta-testing for JMI then... :p
Trying to encourage development with a real world scenario, not play "I've got a secret and you don't nyaah" ;)

Cheers
JMI
12-01-2004, 02:54 AM
Uh? Is that there Beta testing anything like them there drug tests where you gots to pee in one of them there little bottles?? :eek: Or is it some other kind of dang test? :yay:

Regards,
Clandestiny
12-03-2004, 09:01 AM
Hi guys,

Been a while since I've had much time for RCE... but I have the tool that Kayaker is referring to... It is currently a very "alpha" version. Real life has gotten in the way of me finishing it up and releasing a beta, but I hope to do so now that I'll have a bit of time over the holidays :) My tool traces at the procedure level granularity and captures all calls realated to local functions, statically compiled library functions, and API funtions. It is similar to an API monitor, but generic in the sense that it can capture the entire call tree of an application. I know that you guys are all skilled reversers / programmers and the implementation for such a handy little tool like this isn't really that difficult if you don't want to wait for my release ;) Mine is implemented as an IDA plugin. Basically, I just query the IDA database for all of the local function start addresses and then use a debugger to place breakpoints on them. When the debugee process starts running, my debugger gets called when one of the bpx's hit and I log the arguments from the stack (I combine this with IDA's static analysis of the stack frame to get argument sizes, names, and such). At this point I can also automatically trace the arguments on the stack for pointers to user defined strings and integer values. I'm sure you can think of lots of uses for this ability ranging from automated serial sniffing to vulnerability discovery. The API's are monitored using IAT hooking and all of this information is logged into a GUI interface. I hope to eventually port this to ring 0, but right now it is limited to ring 3 tracing. It is also incapable of handling obsfucation or dynamically generated code (SMC) since it relies upon the accuracy of IDA's static disassembly for the breakpoint list.

Cheers,
Clandestiny
JMI
12-03-2004, 11:48 AM
Sounds really interesting and we look forward to your eventual release, as we have for all of your contributions to the craft. :yay:

Regards,
homersux
12-03-2004, 04:40 PM
Clandestiny, are you kidding? I would kill for this sort of app. I've always wanted to do something like this but the amount of work scares me away. All right, I'll admit I am lazy. :devil:

Back to the original poster, AMD64 is a different beast when it comes to debugging etc. If you copied a native 32bit program onto it I can imagine why it behave differently. If you have a 64bit version of the same program and you alter some code I think it'll probably behave as you have expected.
naides
12-05-2004, 06:24 AM
Back to the original poster, AMD64 is a different beast when it comes to debugging etc. If you copied a native 32bit program onto it I can imagine why it behave differently.

You are right Homersux, 64 cpu shuld be different from pentium, or they are not worth the extra money you pay for them, but in this situation I am using the same 32 bit OS, the same 32 bit program and the action is taking place at ring3, application level, which, in theory, is several abstraction levels away from the cpu intrinsic operation perversities.
Formally, AMD 64 should emulate perfectly the win32 operation, but apparently it does not. If that were the case, not only cracks, but whole programs would have to be specifically coded/compiled/linked for this CPU strain in order to work!
dELTA
12-05-2004, 04:50 PM
Ok, we've all been waiting long enough now to hear the interesting solution for this naides, so I'd say it's about time you get to it and make use of the tips in this thread and then let us all know what it was. :D
naides
12-05-2004, 05:58 PM
There is not a smiley for blushed face, but it belongs here. . .

I certainly want to use the kind suggestions all of you guys have given me.
The problem is logistics. . .
The AMD64 belongs to my girlfriend and I have not been able to run the app side by side because we are in a fight, so the AMD64 computer and other resources are temporarily out of reach :D

As soon as I patch the situation, I will duly report back to the board.
OK?
dELTA
12-05-2004, 06:12 PM
That was the best excuse I've heard in a long time, good luck with the patching (good breakpoints for these kind of patches are often the APIs GiveFlowers or SubmitExcuse btw, but sometimes if you've got the balls, it may just be a simple matter of not responding to anything in the message queue until the remote peer calls SubmitExcuse themself). :p
JMI
12-05-2004, 08:32 PM
Actually the API "SubmitExcuse" rarly is effective. Long experience has taught that generally the only effective API is "AbjectApology" and/or "Groveling." Sometimes the API "IAmACompleteIdiot" used in conjunction with "I'veBroughtYouAnExpensiveGift" get to the solution more quickly. :idea:

Regards,
homersux
12-06-2004, 11:56 AM
naides, what's the nature of your crack? Does it have anything to do with stack manipulation?
Peres
12-06-2004, 12:15 PM
I think all you guys are giving late advices. Prevention is better. Naides should have wrapped his girlfriend inside a try/catch situation before trying anything else.

Cheers
Peres
Clandestiny
12-06-2004, 01:29 PM
You guys are really geeks :p :D

Clandestiny
dELTA
12-06-2004, 01:38 PM
If I were a real geek, I'd make some comment and congratulation about your postcount just about to exceed 8 bits for your next post... :thinking: Aw crap. :D

Anyway naides, you'd better secure that crack soon, and then pack it real good, before some other guy (or even a whole group!) keygens your target right in front of you. :p Aw crap again, I'm a dirty geek too... :eek: :D
JMI
12-07-2004, 06:11 AM
dELTA:

We knew that about you already. :devil: But we still like you anyway. :yay:

Regards,


Forum Archives CHM file updated - Special Hacking Week Edition
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Forum Archives CHM file updated - Special Hacking Week Edition
PDA

View Full Version : Forum Archives CHM file updated - Special Hacking Week Edition

Kayaker
11-30-2004, 11:41 AM
All things considered, it was time for an update. Linked as usual at the bottom of the page. Now available in multi-part rar format for easy download by dialup users. Less filling, same great taste :D

Enjoy


Delphi RE for obtain decrypted data
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Delphi RE for obtain decrypted data
PDA

View Full Version : Delphi RE for obtain decrypted data

zgrp
11-30-2004, 02:52 PM
Hello,

I'm analyzing a code that was made in Delphi. At start I know that the code generate it:

I input | Program Generate
-----------------------------------------------
69911130 | bhpSiBSTcfU=
69911280 | bhpSiBSQd1k=
69900570 | bhpSiYIvOJk=
57050820 | bWtW7lxL+18=
57017210 | bWtW6itkCb8=

Based on it, i startd to analyze the code, it was generated with Delphi and use a library for encryption called DCPcrypt2 that is avaible at http://www.cityinthesky.co.uk/files/dcpcrypt2.zip

The description of this library is

DCPcrypt is an open source library of cryptographic components (encryption and hash algorithms) for Borland Delphi 4, 5, 6, C++ Builder (3?), 4, 5, 6 and Kylix 1, 2 for Linux.
The idea behind DCPcrypt is that it should be possible to "drop in" any algorithm implementation to replace another with minimum or no code changes. To aid in this goal all cryptographic components are descended from one of several base classes, TDCP_cipher for encryption algorithms and TDCP_hash for message digest algorithms.

DCPcrypt v2 contains full implementations of the following algorithms:

Blowfish, Twofish
Cast-128, Cast-256
DES, 3DES
Ice, Thin Ice, Ice2
IDEA
Mars
Misty1
RC2, RC4, RC5, RC6
Rijndael (the new AES)
Serpent
TEA
Haval
MD4, MD5
RipeMD-128, RipeMD-160
SHA-1, SHA-256, SHA-384, SHA-512
Tiger

The code appear to use twofish to encrypt data (but it have some entrys for SHA-1, and i don't imaginate it, since it should encrypt and not hash). At code i can see this entrys referent to librarys...

debian:/w/tmp/code# strings GPprog.exe |grep -A 3 -B 3 -i algorithm|more
TDCP_hash
TDCP_hash
DCPcrypt2
Algorithml
HashSize
EDCP_cipher
TDCP_cipher
TDCP_cipher
DCPcrypt2
Algorithml
MaxKeySize
TDCP_ciphermode
cmCBC cmCFB8bit
--
Font.Style
Left
TDCP_sha1 DCP_sha11
Algorithm
SHA1
HashSize
Left
TDCP_twofish
DCP_twofish
Algorithm
Twofish
MaxKeySize
BlockSize
--
TipoLogradouro
Size
TDCP_sha1 DCP_sha11
Algorithm
SHA1
HashSize
Left
TDCP_twofish
DCP_twofish
Algorithm
Twofish
MaxKeySize
BlockSize
--
Left
TDCP_twofish
DCP_twofish
Algorithm
Twofish
MaxKeySize
BlockSize
Left
TDCP_sha1 DCP_sha11
Algorithm
SHA1
HashSize
Left

Well, so I started to look at the code, I downloaded DeDe and obtained some good information with dede + ollydb

Crypt Function
offset start: 0050B31C
offset end: 0050B414

Intersting data thougth debugation:

at offset: 0050B329
ECX=00DBF040, {ASCII "aVqT0Q/wHIc="}
Stack [SS:0012F8C0]=00DB4F40

other offsets:
EAX=0050B4DC {GPprog.0050B4DC}, ASCII "GPprog"
EDX=00DBF054, {ASCII, "acqua"}
ESI=00DBF054, {ASCII, "acqua"}
0012E9C4 | 00DBFA10 ASCII "evilacqua"

Here is the code showed in DeDe when click in the event CriptoString in the Unit Form gpbConsultaZGRP that is the "screen I input values and it encrypt".

Unit Form = gpbConsultaZGRP
Class Name = TfrmConsultaZGRP
Event = CriptoString - RVA = 0050B31C - Hint = 0013

0050B31C 55 push ebp
0050B31D 8BEC mov ebp, esp
0050B31F 83C4F4 add esp, -$0C
0050B322 53 push ebx
0050B323 56 push esi
0050B324 33DB xor ebx, ebx
0050B326 895DF4 mov [ebp-$0C], ebx
0050B329 894DF8 mov [ebp-$08], ecx
0050B32C 8955FC mov [ebp-$04], edx
0050B32F 8BD8 mov ebx, eax
0050B331 8B45FC mov eax, [ebp-$04]

* Reference to: system.@LStrAddRef;
|
0050B334 E8978FEFFF call 004042D0
0050B339 8B45F8 mov eax, [ebp-$08]

* Reference to: system.@LStrAddRef;
|
0050B33C E88F8FEFFF call 004042D0
0050B341 8B450C mov eax, [ebp+$0C]

* Reference to: system.@LStrAddRef;
|
0050B344 E8878FEFFF call 004042D0
0050B349 33C0 xor eax, eax
0050B34B 55 push ebp
0050B34C 68ECB35000 push $0050B3EC

***** TRY
|
0050B351 64FF30 push dword ptr fs:[eax]
0050B354 648920 mov fs:[eax], esp

* Reference to field TfrmConsultaZGRP.OFFS_0324
|
0050B357 8B9B24030000 mov ebx, [ebx+$0324]

* Reference to class TDCP_sha1
|
0050B35D 8B0DB81A4F00 mov ecx, [$004F1AB8]
0050B363 8B55FC mov edx, [ebp-$04]
0050B366 8BC3 mov eax, ebx

|
0050B368 E87340FEFF call 004EF3E0
0050B36D 8D45F4 lea eax, [ebp-$0C]
0050B370 8B55F8 mov edx, [ebp-$08]

* Reference to: system.@LStrLAsg;
|
0050B373 E8BC8BEFFF call 00403F34
0050B378 8B450C mov eax, [ebp+$0C]
0050B37B BA04B45000 mov edx, $0050B404

* Reference to: system.@LStrCmp;
|
0050B380 E8A78EEFFF call 0040422C
0050B385 750D jnz 0050B394
0050B387 8D4DF8 lea ecx, [ebp-$08]
0050B38A 8B55F4 mov edx, [ebp-$0C]
0050B38D 8BC3 mov eax, ebx
0050B38F 8B30 mov esi, [eax]
0050B391 FF5654 call dword ptr [esi+$54]
0050B394 8B450C mov eax, [ebp+$0C]
0050B397 BA10B45000 mov edx, $0050B410

* Reference to: system.@LStrCmp;
|
0050B39C E88B8EEFFF call 0040422C
0050B3A1 750D jnz 0050B3B0
0050B3A3 8D4DF8 lea ecx, [ebp-$08]
0050B3A6 8B55F4 mov edx, [ebp-$0C]
0050B3A9 8BC3 mov eax, ebx
0050B3AB 8B30 mov esi, [eax]
0050B3AD FF5658 call dword ptr [esi+$58]
0050B3B0 8BC3 mov eax, ebx
0050B3B2 8B10 mov edx, [eax]
0050B3B4 FF5248 call dword ptr [edx+$48]
0050B3B7 8BC3 mov eax, ebx
0050B3B9 8B10 mov edx, [eax]
0050B3BB FF5244 call dword ptr [edx+$44]
0050B3BE 8B4508 mov eax, [ebp+$08]
0050B3C1 8B55F8 mov edx, [ebp-$08]

* Reference to: system.@LStrAsg;
|
0050B3C4 E8278BEFFF call 00403EF0
0050B3C9 33C0 xor eax, eax
0050B3CB 5A pop edx
0050B3CC 59 pop ecx
0050B3CD 59 pop ecx
0050B3CE 648910 mov fs:[eax], edx

****** FINALLY
|
0050B3D1 68F3B35000 push $0050B3F3
0050B3D6 8D45F4 lea eax, [ebp-$0C]
0050B3D9 BA03000000 mov edx, $00000003

* Reference to: system.@LStrArrayClr;
|
0050B3DE E8DD8AEFFF call 00403EC0
0050B3E3 8D450C lea eax, [ebp+$0C]

* Reference to: system.@LStrClr(String;String);
|
0050B3E6 E8B18AEFFF call 00403E9C
0050B3EB C3 ret

* Reference to: system.@HandleFinally;
|
0050B3EC E9E383EFFF jmp 004037D4
0050B3F1 EBE3 jmp 0050B3D6

****** END
|
0050B3F3 5E pop esi
0050B3F4 5B pop ebx
0050B3F5 8BE5 mov esp, ebp
0050B3F7 5D pop ebp
0050B3F8 C20800 ret $0008

----------------------------------------------------------------

In Reference to class TDCP_sha1 the call 004EF3E0 have

004EF3E0 55 push ebp
004EF3E1 8BEC mov ebp, esp
004EF3E3 83C4F8 add esp, -$08
004EF3E6 53 push ebx
004EF3E7 56 push esi
004EF3E8 57 push edi
004EF3E9 894DF8 mov [ebp-$08], ecx
004EF3EC 8955FC mov [ebp-$04], edx
004EF3EF 8BD8 mov ebx, eax
004EF3F1 807B2400 cmp byte ptr [ebx+$24], $00
004EF3F5 7407 jz 004EF3FE
004EF3F7 8BC3 mov eax, ebx
004EF3F9 8B10 mov edx, [eax]
004EF3FB FF5244 call dword ptr [edx+$44]
004EF3FE 33C0 xor eax, eax
004EF400 55 push ebp

* Possible String Reference to: 'é`@ñÿ¹ìôN'
|
004EF401 68BBF44E00 push $004EF4BB

***** TRY
|
004EF406 64FF30 push dword ptr fs:[eax]
004EF409 648920 mov fs:[eax], esp
004EF40C 8B45F8 mov eax, [ebp-$08]

* Possible reference to virtual method TDCP_sha1.OFFS_38
|
004EF40F FF5038 call dword ptr [eax+$38]
004EF412 85C0 test eax, eax
004EF414 7903 jns 004EF419
004EF416 83C007 add eax, +$07
004EF419 C1F803 sar eax, $03

* Reference to: system.@GetMem;
|
004EF41C E80F34F1FF call 00402830
004EF421 8BF0 mov esi, eax
004EF423 8BCB mov ecx, ebx
004EF425 B201 mov dl, $01
004EF427 8B45F8 mov eax, [ebp-$08]

* Possible reference to virtual method TDCP_sha1.OFFS_2C
|
004EF42A FF502C call dword ptr [eax+$2C]
004EF42D 8BF8 mov edi, eax
004EF42F 8BC7 mov eax, edi
004EF431 8B10 mov edx, [eax]

* Possible reference to virtual method TDCP_sha1.OFFS_40
|
004EF433 FF5240 call dword ptr [edx+$40]
004EF436 8B55FC mov edx, [ebp-$04]
004EF439 8BC7 mov eax, edi

|
004EF43B E8B0FEFFFF call 004EF2F0
004EF440 8BD6 mov edx, esi
004EF442 8BC7 mov eax, edi
004EF444 8B08 mov ecx, [eax]

* Possible reference to virtual method TDCP_sha1.OFFS_44
|
004EF446 FF5144 call dword ptr [ecx+$44]
004EF449 8BC7 mov eax, edi

* Reference to: system.TObject.Free(TObject);
|
004EF44B E8243CF1FF call 00403074
004EF450 8BC3 mov eax, ebx
004EF452 8B10 mov edx, [eax]
004EF454 FF5238 call dword ptr [edx+$38]
004EF457 8BF8 mov edi, eax
004EF459 8B45F8 mov eax, [ebp-$08]

* Possible reference to virtual method TDCP_sha1.OFFS_38
|
004EF45C FF5038 call dword ptr [eax+$38]
004EF45F 3BF8 cmp edi, eax
004EF461 7D16 jnl 004EF479
004EF463 6A00 push $00
004EF465 8BC3 mov eax, ebx
004EF467 8B10 mov edx, [eax]
004EF469 FF5238 call dword ptr [edx+$38]
004EF46C 8BC8 mov ecx, eax
004EF46E 8BD6 mov edx, esi
004EF470 8BC3 mov eax, ebx
004EF472 8B18 mov ebx, [eax]
004EF474 FF5340 call dword ptr [ebx+$40]
004EF477 EB13 jmp 004EF48C
004EF479 6A00 push $00
004EF47B 8B45F8 mov eax, [ebp-$08]

* Possible reference to virtual method TDCP_sha1.OFFS_38
|
004EF47E FF5038 call dword ptr [eax+$38]
004EF481 8BC8 mov ecx, eax
004EF483 8BD6 mov edx, esi
004EF485 8BC3 mov eax, ebx
004EF487 8B18 mov ebx, [eax]
004EF489 FF5340 call dword ptr [ebx+$40]
004EF48C 8B45F8 mov eax, [ebp-$08]

* Possible reference to virtual method TDCP_sha1.OFFS_38
|
004EF48F FF5038 call dword ptr [eax+$38]
004EF492 8BD0 mov edx, eax
004EF494 85D2 test edx, edx
004EF496 7903 jns 004EF49B
004EF498 83C207 add edx, +$07
004EF49B C1FA03 sar edx, $03
004EF49E 8BC6 mov eax, esi
004EF4A0 B9FF000000 mov ecx, $000000FF

* Reference to: system.@FillChar;
|
004EF4A5 E81638F1FF call 00402CC0
004EF4AA 8BC6 mov eax, esi

* Reference to: system.@FreeMem;
|
004EF4AC E89733F1FF call 00402848
004EF4B1 33C0 xor eax, eax
004EF4B3 5A pop edx
004EF4B4 59 pop ecx
004EF4B5 59 pop ecx
004EF4B6 648910 mov fs:[eax], edx
004EF4B9 EB20 jmp 004EF4DB

* Reference to: system.@HandleAnyExZGRPtion;
|
004EF4BB E96040F1FF jmp 00403520

* Possible String Reference to: 'Unable to allocate sufficient memor
| y for hash digest'
|
004EF4C0 B9ECF44E00 mov ecx, $004EF4EC
004EF4C5 B201 mov dl, $01

* Reference to class EDCP_cipher
|
004EF4C7 A108EF4E00 mov eax, dword ptr [$004EEF08]

* Reference to: axctrls.TOleStream.Create(TOleStream;boolean;IStream);
|
004EF4CC E8EBDAF1FF call 0040CFBC

* Reference to: system.@RaiseExZGRPt;
|
004EF4D1 E8F643F1FF call 004038CC

* Reference to: system.@DoneExZGRPt;
|
004EF4D6 E86144F1FF call 0040393C

****** END
|
004EF4DB 5F pop edi
004EF4DC 5E pop esi
004EF4DD 5B pop ebx
004EF4DE 59 pop ecx
004EF4DF 59 pop ecx
004EF4E0 5D pop ebp
004EF4E1 C3 ret

I'm supposing that it's using twofish and the key "aVqT0Q/wHIc=" or some of the other ascii colected in offsets above.

Any idea ? Tip ? Help ?

Regards,
JMI
11-30-2004, 06:47 PM
Why the hell would you believe we would want to have you post lines and lines and lines of code you don't understand and then be asked how to solve your problem???? Didn't you bother to read the FAQ at all? :boo:

Regards,
zgrp
12-01-2004, 07:04 AM
Hello JMI,

Thks for reply. I had read the FAQ, I tryed to post the maximum information that I have, not with the intention that someone WILL make the job for me, but that some members of forum give-me suggestions in your experiences...

Thks a lot and sorry if I was unclean... :rolleyes:

Regards,
JMI
12-01-2004, 12:02 PM
I don't really know whether you may not a bathed recently, but just posting lines and lines and lines of code for someone else to solve for you is not how things are expected to be done here. Apparently, while you were reading the FAQ, you missed that part about "doing some of your own work" and "showing you have done some of your own work." You've only "shown" that you can display a bunch of code you don't understand, and you want "someone else" to do the work. The only information you provided was that you don't know how to interpret this code.

What you did instead simply adds unnecessary and unwanted volumne to the database.

DO NOT DO THIS AGAIN.

Regards,
zgrp
12-01-2004, 01:14 PM
Hello JMI,

Ok, I understood my post isn't appreciated here.

Sorry and thks. :(

Regards
JMI
12-01-2004, 06:30 PM
zgrp:

Perhaps we are having a language problem and a failure to communicate. It is not "a post" that is not appreciated, it is a post which just displays a long, long, long string of code without your having shown any work of your own which is not in compliance with our rules. This is not a place to just post a bunch of code and ask someone else to tell you how it works if you do not show that you have done anything to help yourself solve YOUR problem. If you had shown such an effort and still not figured out some part of the code, posting a part of it and asking a specific question would have been OK.

Regards,


UPPERCASE CHECK
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > UPPERCASE CHECK
PDA

View Full Version : UPPERCASE CHECK

bestobest
11-30-2004, 05:51 PM
Hi I'm a newbie, but I have checked a lot of crackme, and I noticed that almost all of them check serial to see if you entered Uppercase or not, is that true of all programs?....Thanks in advance

PS if that the case there will be a good breakpoint.
JMI
11-30-2004, 06:54 PM
The answer to your question is self-evident. If there is a serial which includes alphabet letters and differentiates between capital and non-capital letters, then there has to be a check. But just because those you have experienced have done such a check, it is not a safe assumption that all do. That does not mean that checking for a comparison of capital letters might not be a good breakpoint, it should tell you that you are in some form of entry checking routine. :idea:

Regards,
bestobest
11-30-2004, 08:15 PM
Thanks for your reply JMI, point taken glad that I at least was understanding something... Thanks again


beginner's series of crackmes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > beginner's series of crackmes
PDA

View Full Version : beginner's series of crackmes

tdennist
11-30-2004, 09:48 PM
I'm looking for a series of crackmes for the beginner. I've found many many many sites full of just lists and lists of crackmes, but what I'm really looking for is a set that starts from the absolute beginning (i.e. hardcoded serials) to the more advanced (i.e. simple name-based ones) to the really advanced (i.e....I don't even know. something on the lines of cracking 3DS Max's algorithm). The problem with the giant crackme lists is that I don't know what about 75% of the stuff is, so I don't know where a good place to start is. If there isn't such a series available, could someone at least do me the kindness of writing out a list in sequential format of what features I should look for in a crackme, so I can sort of build my own set? I've tried one crackme that was name-based serial generation....I worked on it for about 2 weeks on and off, and I'm still without a solution.

Thanks.
WaxfordSqueers
11-30-2004, 11:14 PM
I'm looking for a series of crackmes for the beginner.

Thanks.

the main reason I'm replying is to direct you to the links at the bottom of this page. Just about everything you need will be there. I personally don't think crackme's is the best way to go for absolute newbies. I'd look at tutorials first, since you can follow reversers right through a reversing procedure and see how it's done.

A bit of history. One of the first set of tutorials I came across was the Ork set. They're all at a link at the bottom of this page. They may be a bit primitive now, but they will give you basic concepts of what you're trying to do. Along the time of my discovery of Ork, Fravia's site was a going concern. If you can find one of his old sites, through a search engine, or maybe in the links below, there are hundreds of tutorials by really good reversers. Learn their techniques and how they approach a problem.

In the good old days, there were groups like Frozen Crew (sp??) and UCF (United Cracking Force). They put out a lot of tuts. You'll see a reference to the Caper below...that was the Keyboard Caper, part of the elite crowd in those days and a member of one of the groups above.

Around the time of Fravia, Greythorne had a site, and many of his tuts are good too. You will finds some tuts around on Fravia that border on genius, if not outright genius. You might check Mammon as well. My suggestion is to find tuts by these people, and others, and actually do them. You might have trouble finding the exact app. but you can often find a version near enough to the one in the tut to make it work. Or find an app with a similar protection and apply the techniques.

Learn to search, and read, read, read!! Get a good reference book. Nothing is going to be handed to you, and if it was, you wouldn't learn very much. I know you probably want to do specific work, but you have to learn your chops by doing a range of work. I started with Matt Pietrek's Windows 95 Programming Secrets.

That's where I first got the notion of reversing, something Pietrek refered to as spelunking. I had an old music program that the author had abandoned, and I was tring to modify it. There is another thread on this board refering to a book on Windows that will be re-issued soon. The author has an excellent understanding of Windows and it's structures.
Silver
12-01-2004, 09:45 AM
If you'd like, I can PM you the names of some apps I used during my initial learning curve (and trust me, I'm not that far in front of you). They are easy to crack, some are even 1 or 2 byte patches but will provide the experience you're looking for. For some reason I found it "better" to learn from actual, real-world apps than crackme's. Crackme's are great to learn a principle step-by-step, but (I hope!) you're aiming to learn how to crack for yourself rather than by tutorial etc.
JMI
12-01-2004, 12:35 PM
I say this over and over: "There is no substitute for learning how to search and how to find things on the net."

If you spend the time to master this skill you will be well ahead of the game, because then you can find nearly everything you want to learn about reversing. There is a tremendous body of work out there on such subjects and no substitute for actually taking the time to study and learn some of the basics. Impatience is one of the chief obstacles to good learning skills. It takes time and effort to master the skill set necessary and being in a hurry to "crack something" often interferes with studying those basics. Too many people think that they have to start cracking something right away and then they just fumble around and often reach a solution by "accident" and do not clearly understand what they have done or why. This is not a good learning method.

It is MUCH more effective, although less instant gratification, to spend some quality time JUST studying, until you grasp some of the basic concepts. While there are many, many tuts out there that you can simply follow by rote, step for step, that is not really reversing. You are simply following steps someone else laid out for you without the most important part, knowing "why" those steps were taken when they were taken.

If you want to crack "right away", you are much less likely to truly learn how to reverse engineer. It is a process that can't really be short cut and practicing a lot of crackmes without having a clear understanding of what you are and should be doing, simply results in the "practicing" of a whole group of bad habits. Think of a sports analogy. The more frequently one practices a "wrong" swing of a bat or tennis racket or an incorrect way to kick a ball or shoot a basket, the more one is training the body to do it incorrectly. With enough "wrong" practice, it eventually becomes almost impossible to train the body to do it the correct way for the most effect.

These principles hold true, at least to some degree, with the brain. The more you train it to try to shortcut the "thinking process" the less it learns "how to think." Thinking is the real skill here and it requires both knowledge and understanding. Neither of these come without effort, more for some, less for a few, but effort nevertheless.

So at the end of this long philosophical lesson, we come back to this. If you learn how to properly search, you should have no problem finding crackmes designed for beginners. Usually it is as simple as using combinations of search terms in your favorite search engine, such as "crackmes + beginner" (without the quotes.) :yay:

Regards,
WaxfordSqueers
12-01-2004, 02:27 PM
It is MUCH more effective, although less instant gratification, to spend some quality time JUST studying, until you grasp some of the basic concepts. While there are many, many tuts out there that you can simply follow by rote, step for step, that is not really reversing. You are simply following steps someone else laid out for you without the most important part, knowing "why" those steps were taken when they were taken.

I did not mean to imply in my response that following tuts was the end-all in learning to reverse. Using your sports analogy, I actually applied that learning to playing soccer, and eventually honed my skills to a world-class level. There were no tutorials to follow, all I could do was go out with a soccer ball and work it till the skills came. It was important for me, however, to have role models. I watched some of the great players to see what they were doing, and tried to emulate that.

It's different with reversing, of course. Being an electronics/computer technician, I already had a basic understanding of programming languages, although not to the level of a good programmer. I understood assembler quite well, and had studied Fortran and Basic. That helped me immensely in visualizing program flow and understanding disassembled apps. I know some of the people who reverse at an advanced level are accomplished programmers. The biggest problem for me learning to reverse was seeing the overall picture, and, of course, practicing the application of that.

For someone without a background in programming, I would advise they at least study assembler. I learned the old bare-bones kind of assembler, and actually programmed in machine code at one point. That teaches you about registers and basic processor management, things you need to understand as a technician. It doesn't hurt for anyone approaching reversing to learn that as well.

I also studied Petzold's book on Windows 16-bit programming. He has a later version out for Win32 and I notice he has one out now on C#. Jeffrey Richter has good books out on Windows structure and Russinovich has a rewrite of one of his books due out. A quick check of Matt Pietrek's site ( hxxp://www.wheaty.net ), under 'Other Writers', will give a quick outline of who's who in the world of Window's programming. Many of these people have written excellent books on the subject.

I'm in full agreement with you that reversing is a skill that requires more than one component of learning. And doing it is the main learning procedure. Unfortunately, some of the concepts are so advanced, that literally 'doing it' is not enough. I don't want to drop any names here, but I remember the initial reverse of IDA by someone we will all remember ( Q**** ...or was that Star Trek). As a newbie, I would never have thought out that solution in a million years. Even Ilfak, who wrote IDA, was impressed with the work of Q****.

Reversing serials can be easy, as you know, or get into advanced cipher theory. Or there were those reverses by M******* involving self-modifying code. All I could do was regard his technique with awe. These kinds of tuts are invaluable, even if used only as a reference. I'm not advocating following each one by rote. If you need to reverse a CDROM-related app, however, finding tutorials on that, will give you a reference and teach you what you're looking for. It's. of course, up to you to practice and ultimately do it yourself.

I was browsing through the advanced section of this forum recently and found it interesting to note how far the current group of reversers have progressed. It's really impressive. I don't know what the individual backgrounds are, but I'm sure many are new to reversing in the past few years. It's encouraged me to perhaps get more involved and start learning again. Is there really such a thing as someone who is not a newbie?? :rolleyes:
tdennist
12-01-2004, 04:38 PM
Thanks for your long and detailed replies - I'm in need of those.

I really didn't mean to imply that I am one of those people who takes a tutorial, follows it step by step, and then claims the work for his own. In all of my posts (or most of them :p) I've ended up conveying a message that I didn't mean to. Or, at least, you guys keep replying to something that I didn't intend :p. Let me break down my thoughts on this for you:
- I'm more of a person who likes to apply knowledge rather than just spit it back out exactly according to a textbook
- I'm a pretty patient learner, and not what JMI suggested - a person who really really wants to jump right into advanced reversing stuff.
- I'm not satisfied with myself until I feel I really and completely understand the concepts. I've been this way all of my life. You could call it perfectionism, that's fine, but I have a set of standards for myself that I meet without fail. That's true with all of my work, not just computer related things.
- I think all knowledge is worth having, so I try to branch out in my learnings, not really focusing too much on one thing, unless it intrigues me enough that I want to delve deeper. Reversing is one of those things.

You should know that the way I was introduced to this art, science, whatever you wish to call it is. That being, I was playing an online game (one that I had been playing for a long time), and this guy showed up, he was new at the game, and said he was going to try and hack Vendetta. Now, surrounded by goons who use that word not in its originally intended way, I thought nothing more of it than just as the bold words of a 13 year old who really could do nothing more complicated than ping an IP address. But, as he posted his progress on the message boards, I became more and more convinced that he in fact was one of the rare people on the internet who does everything he claims to, especially when he posted a screenshot of his working environment -- IDA running in Wine, and the modified version of the game.

That was my introduction. I was talking to him in IRC for a while before he left, his task having been accomplished, and got him to tell me the names of the main tools he used. I came up with Softice and IDA. Thus began the Googling. After a week or so of researching, I decided that I'd learn assembly language if nothing else, because the idea of having complete control as opposed to the only half-control that other high level languages give you intrigued me. It took me a while to find a copy of Softice and successfully install it on my XP box, but I finally did. I then followed one of Fravia's tutorials and a few others...but I wanted something more comprehensive. I bought the book, "Hacker: Disassembling Uncovered" and started to read it. About 20 pages into the book I realized that while this book seemed to be exactly what I wanted, it was wayyyy over my head, and I was obviously lacking in assembly language knowledge. So I then bought the book, "Assembly Language, Step by Step" (by Jeff Duntemann, in case anyone's interested. Fantastic book.) and read it cover to cover. It's written for 16 bit programming, but still a fantastic introduction to assembly language.

That puts me about where I was 3 weeks or so ago. Since then I've started to learn Win32 assembly, and the basics of game training. I'm still at the utmost beginning, as I'm sure you can tell by my other posts, but I'm very interested in doing all that it takes to progress.

So you see, I never once lost patience while starting out. I just got the other resources that I needed, and started over again.

While I have successfully made one trainer (for Minesweeper :p) and I fully understand all the concepts in it (including the Win32 ones.) what I'm most interested in is serial number and other encryption reversing. That's mostly because it seems to be a lot more intellectual and interesting than just hunting through code to find one line that decreases one value, and then making a trainer NOP it.

Now, at the end of this essay-like post, I hope you can see that I'm not pushing you guys to spoon-feed me answers, do work for me, or anything else of that sort.

That being said, I'm going to go find something to eat. I'm ravenous.
JMI
12-01-2004, 06:19 PM
Please keep in mind that I generally attempt to write my messages for a wider audience and not just for the person to whom it might appear to be addressed. My comments were intended as general on the subject matter to encourage the widest audience to attempt to follow the proper path through the dark codewoods of reversing. I, of course, do not know you nearly well enough to make any valid evaluative judgments about your character or tendencies.

Remember also that in this context, we are forced to deal with a limited slice of the world and, in particular, a very narrow view of that world in which the poster resides and operates. What is often forgotten by posters is that we see only what they have written, not what they think or what they may have done which they do not describe. We are then forced, not unwillingly, to make some basic assumptions in order to respond at all and if as wide an audience is desired, the response needs to be more generic than if an issue is more focused and directly addressed.

I was attempting to address your general request for "crackmes for beginners" and trying simply to make my favorite point that most things can be found by those who learn how to search effectively. Then I lapsed into general philosophy of reversing for which you need mount no defense, for there was no criticism or attack intended. Just an offer of what I hope is good advise for all who might find it useful. :yay:

Regards,
Aimless
12-01-2004, 10:49 PM
Nothing, but nothing beats cracking older versions of MIRC and Winzip

;)

Nothing.

Have Phun
WaxfordSqueers
12-02-2004, 12:05 AM
In all of my posts (or most of them :p) I've ended up conveying a message that I didn't mean to. Or, at least, you guys keep replying to something that I didn't intend :p. Let me break down my thoughts on this for you:
----snip----

My replies were intended along the line of what JMI wrote...in general. I was doing a lot of reading between the lines in your replies based on your revelation that you were a newbie. So, you did not convey any message that you did not mean. I picked up what you were saying in general and replied with a wide generalization. You asked for a certain amount of information, and I replied with a lot more than what you needed. But, you will need it eventually.

I want to be clear that I don't consider myself an expert. I'm a relative beginner, and any of the more experienced reversers could have had a field day with what I wrote. That's partly how you learn. If you say something dumb, someone usually notices and helps you out. Of course, if it's really dumb, you'll get flamed. That too is part of the learning curve, and part of the humour.

As an example of saying something dumb, please consider how I spell humour. That's the Canadian spelling based on the British English, back when Britain was a colony of Canada. Down in the States, another colony of Canada, they'd spell it humor, or humer in some parts. Some would spell it hummer, but that means something else in Canada.

I'm from the west coast of Canada, which is God's country. We annexed the rest of Canada out of compassion. The reason I'm not as good a reverser as some other Canadians, who run around in canoes (nudge, nudge, wink, wink...say no more) is that we have glorious weather on the west coast and the rest of Canada is ice-bound 11 months of the year. Summer is 1 month of bad skating. They have nothing else to do but reverse.

:devil:

Now...that's how you get flamed. :D
TBone
12-02-2004, 10:50 AM
For some reason, JMI, every time I hear you say "dark codewoods of reversing" I think of Robert Frost:
Two roads diverged in a yellow wood,
And sorry I could not travel both
And be one traveller, long I stood
And looked down one as far as I could.
To where it bent in the undergrowth,

Then took the other, as just as fair,
And having perhaps the better claim,
Because it was grassy and wanted wear,
Though as for that, the passing there
Had worn them really about the same,

And both that morning equally lay
In leaves no step had trodden black.
Oh, I kept the first for another day!
Yet knowing how way leads on to way
I doubted if I should ever come back.

I shall be telling this with a sigh
Somewhere ages and ages hence:
Two roads diverged in a wood, and I --
I took the one less travelled by,
And that has made all the difference.
Being very much just one traveling newbie, I can't tell you how many times this has popped into my head while trying to trace through multiple branches of code :p
Kayaker
12-02-2004, 09:24 PM
It's encouraged me to perhaps get more involved and start learning again. Is there really such a thing as someone who is not a newbie?? :rolleyes:

Now that *is* the sign of a good reverser, someone who doesn't realize they are :) We're all newbies at one level or another, that's what keeps you learning through life.

I think learning to program in assembly is one of the most useful things to do first, as soon as the reversing bug has taken hold, you've gone past the first rush, and you start to realize how many friggen things there are to learn. This is mainly to learn general program flow, how APIs work and how the Message Queue is structured (all from an ASM perspective). When you are comfortable with how a 'normal' program operates and how it looks in a debugger or disassembler, it becomes easier to pick out what is *not* normal, in terms of protection or other significant code you might want to reverse.

It used to be you could learn much of this by plenty of tracing in any generic shareware app you happened to choose as "this nights/weeks target". Now however, everything is so AcmeProtected that you can never "see" the underlying program unless you unpack it successfully first, a whole different kettle of fish entirely as it were.

Keep the faith tdennist, you're on the right track ;)

I like your interpretation of history WaxfordSqueers :D
It's true, there are only 2 seasons in the rest of Canada, both based on the state of the water, liquid or solid. The second requires special paddling equipment and crotch warmers. It might surprise a lot of people to know that there *is* a rain forest on Canada's west coast. It must be nice never to have to buy sunglasses. I figured West Coast reversers would spend most of their time indoors anyway :devil:
WaxfordSqueers
12-03-2004, 12:46 AM
It used to be you could learn much of this by plenty of tracing in any generic shareware app you happened to choose as "this nights/weeks target". Now however, everything is so AcmeProtected that you can never "see" the underlying program unless you unpack it successfully first, a whole different kettle of fish entirely as it were.

That's where I'm at right now: pre-AcmeProtection. I've tried a few of the earlier packed proggies and spent a fair bit of time trying to reconstruct import tables. But I need to concentrate on it.

If you get some time, maybe you could leave a brief outline of how you got into ring 0 code. You seem to be pretty well at home discussing it. I've traced through ring 0, very carefully, and actually came out the other end. Often as not, as soon as I enter ring 0 code, I F12 out of it....fast.

I like your interpretation of history WaxfordSqueers :D
It's true, there are only 2 seasons in the rest of Canada, both based on the state of the water, liquid or solid. The second requires special paddling equipment and crotch warmers. It might surprise a lot of people to know that there *is* a rain forest on Canada's west coast. It must be nice never to have to buy sunglasses. I figured West Coast reversers would spend most of their time indoors anyway :devil:

Bit of west coast blather. Thanks for not mentioning the webbed feet. I lived in Regina for a year and survived the winter. It hit -50C a couple of times, but -35C is brutal enough, especially with a wind blowing. In fact, spent part of a winter north of Edmonton recently (Fort Saskatchewan) working 10 hour night shifts outside in -20C weather.

Many Europeans have been mislead with regard to our rain forrests. They seem to think we're hacking them all down. I don't think they understand how big these forrests are. I got in a ferry on the north end of Vancouver Island and travelled overnight up the Pacific Coast to Prince Rupert. That's about 400 miles, and there's nothing but trees along that coast. There aren't even roads into most of it.
JMI
12-03-2004, 11:44 AM
WaxfordSqueers:

Thanks for the history lessons. I had not realized that Britain and the U.S. were former colonies of Canada. Just goes to show you how poor our school history books have become. :eek: But at least you folks up there were kind enough to share your West Coast weather with those of us in the "lower 48." :yay: We too have much better weather (generally year round) than our cousins on the East Coast.

TBone:

If memory serves, the "dark codewoods" is a phrase I believe I borrowed from +Orc's writings contained in the materials found in +Fravia's original site (linked below) and other places on the web. Since I had read and enjoyed the Lord of the Rings Trilogy more than 40 years ago, the phrase always resonated with me and reminded me of some of the adventures described therein and seems a perfect anology for some of the "dangers" lurking in the code waiting to trap or divert the unwary or unskilled in such arts.

Regards,
WaxfordSqueers
12-03-2004, 12:38 PM
WaxfordSqueers:

Thanks for the history lessons. I had not realized that Britain and the U.S. were former colonies of Canada. Just goes to show you how poor our school history books have become. :eek: But at least you folks up there were kind enough to share your West Coast weather with those of us in the "lower 48." :yay: We too have much better weather (generally year round) than our cousins on the East Coast.

You folks are too kind, JMI. I was expecting some really ascerbic wit. :)

Even our winters on the "wet" coast have been milder, at least in my part of the world. We haven't had snow yet this year and probably wont through Christmas. I remember, as a kid, having winters with a couple of feet of snow. We get a fair amount of rain, but there doesn't even seem to be as much of that. Or maybe I'm just not noticing it. The good thing with rain, as the saying goes, is that you don't have to shovel it.

If memory serves, the "dark codewoods" is a phrase I believe I borrowed from +Orc's writings ---snip---- and seems a perfect anology for some of the "dangers" lurking in the code waiting to trap or divert the unwary or unskilled in such arts.
Regards,

As Kayaker pointed out, there is more of an implemented set of traps laid today than in +Orc's time. I remember working through some of his lessons, and about all you'd get was an error message along the lines of, "gotcha, evil cracker". What's this world coming to when an upstanding reverser can't even get into the dark code woods till he has removed the wrapper? Is that like not being able to see the forrest for the trees?
:)


asprotect 2.0x working tut?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > asprotect 2.0x working tut?
PDA

View Full Version : asprotect 2.0x working tut?

Shub-nigurrath
12-01-2004, 06:59 AM
searched a lot around but haven't found a really working tutorial on AsProtect 2.0x

Could some1 point me to the right direction to a tut which worked for him..

particularly I'm working on an asprotected dll..

10x in advance!
p0thead
12-02-2004, 10:41 AM
http://www.ech2004.net/tutoriales/Reventando%20el%20ASProtect%202%20alfa%20(by%20DeAtH).rar

mebbe this is a bit helpfull to you...
Hero
01-15-2005, 11:21 PM
I don't know,perhaps That's my problem,But I can't get anything.

sincerely yours
XFlorian
01-20-2005, 11:25 AM
The link doesn't work. Can you send another?
ZaiRoN
01-20-2005, 12:24 PM
Yes, there is an error in the link p0thead gave you but, you can try using: http://www.ech2004.net/tutoriales/

C'mon, go over the appearances ;)
Formal
01-20-2005, 12:31 PM
It works, remove the space in 'death'. Unfortunately I don't understand the language.
JMI
01-20-2005, 01:02 PM
Because you do not speak or read all languages, the Diety invented something called "online translators." Perhaps you've heard of them? A search on line should find one that can give a fairly good translation of this tutorial. :yay:

Regards,
Formal
01-21-2005, 02:36 AM
10x, I'll try.
Hero
01-21-2005, 07:26 AM
I have translated this tutorial.The main language is Spanish and I used an
online translator,then this tutorial is now ONLY readable. :devil:
You can get it from attachement.

sincerely yours
DeAtH HaS cOMe
01-22-2005, 06:18 AM
Hehe this tutorial is a brief essay about aspr 2.x, you can find more in CracksLatinos (http://www.crackslatinos.hispadominio.net), but also in Spanish, so you must learn Spanish! or how to use a traslation tool :)
RedH@wK
01-22-2005, 06:38 AM
he Death very good your tutorial of Asprotect..te I congratulate

Greetings
:yay:
DeAtH HaS cOMe
01-22-2005, 01:24 PM
Thanks you Redh@wk! :rolleyes:
Morales
01-25-2005, 12:42 PM
Good work Death as is usually in you.
nikolatesla20
01-28-2005, 11:26 AM
Hm I don't know spanish, and I'm trying to read this tute..does it cover the new "ripped code" or emulated calls in ASProtect 2.x?

For example, I have a program which has the usual IAT redirection, and that's easy to repair, but then some entries in the IAT have been changed from

jmp dword ptr [xxxxxxxx]

to

call xxxxxxxx (high mem)

and also some code sections throughout the EXE also contain this high mem call, almost seems like a code ripping.

So, I have this code:

* Reference To: msvbvm60.EVENT_SINK_Release, Ord:0192h
|
:00404B2A FF25C4114000 Jmp dword ptr [004011C4]

* Reference To: msvbvm60.GetMemStr, Ord:012Fh
|
:00404B30 FF25F0104000 Jmp dword ptr [004010F0]

* Reference To: msvbvm60.PutMemStr, Ord:0135h
|
:00404B36 FF251C114000 Jmp dword ptr [0040111C]
:00404B3C E8BFB4F500 call 01360000 <-- looks ripped
:00404B41 84E8 test al, ch
:00404B43 B9B4F500F9 mov ecx, F900F5B4

* Reference To: msvbvm60.EVENT_SINK_GetIDsOfNames, Ord:0193h
|
:00404B48 FF2500104000 Jmp dword ptr [00401000]

* Reference To: msvbvm60.EVENT_SINK_Invoke, Ord:0194h
|
:00404B4E FF254C104000 Jmp dword ptr [0040104C]

* Reference To: msvbvm60.GetMemEvent, Ord:013Fh
|
:00404B54 FF2520124000 Jmp dword ptr [00401220]

* Reference To: msvbvm60.PutMemEvent, Ord:0140h
|
:00404B5A FF25B8124000 Jmp dword ptr [004012B8]

and then the same thing in other parts of the code (other than just the IAT)

* Reference To: msvbvm60.__vbaChkstk, Ord:00B6h
|
:004226FE E8AD1FFEFF Call 004046B0
:00422703 53 push ebx
:00422704 56 push esi
:00422705 57 push edi
:00422706 8965E8 mov dword ptr [ebp-18], esp
:00422709 C745EC40134000 mov [ebp-14], 00401340
:00422710 C745F000000000 mov [ebp-10], 00000000
:00422717 C745F400000000 mov [ebp-0C], 00000000
:0042271E C745FC01000000 mov [ebp-04], 00000001
:00422725 C745FC02000000 mov [ebp-04], 00000002
:0042272C 6AFF push FFFFFFFF
:0042272E E8CDD8F300 call 01360000 <-- ripped
:00422733 94 xchg eax,esp
:00422734 C745FC03000000 mov [ebp-04], 00000003
:0042273B C78524FFFFFF00000000 mov dword ptr [ebp+FFFFFF24], 00000000
:00422745 C7851CFFFFFF0B000000 mov dword ptr [ebp+FFFFFF1C], 0000000B
:0042274F 8D951CFFFFFF lea edx, dword ptr [ebp+FFFFFF1C]
:00422755 8D4DD0 lea ecx, dword ptr [ebp-30]
:00422758 E8A3D8F300 call 01360000 <-- ripped here
:0042275D E5C7 in ax, C7
:0042275F 45 inc ebp
:00422760 FC cld
:00422761 0400 add al, 00
:00422763 0000 add byte ptr [eax], al
:00422765 833D24D0460000 cmp dword ptr [0046D024], 00000000
:0042276C 751C jne 0042278A
:0042276E 6824D04600 push 0046D024
:00422773 68B0DC4000 push 0040DCB0
:00422778 E883D8F300 call 01360000 <-- more ripping..

I'm thinking this must be the "emulate system calls" option perhaps..

I'm assuming at this time that it's a code rip that then jumps to the right place after calculating (just like VBox and ACProtect).

The good thing is since this is a VB program, the OEP and IAT is insanely simple to restore (heck you can restore the OEP manually if you want, vb only has oep of 2 instructions).

Anyone have more details? I'm still playing with it for now.

-nt20
Js
01-28-2005, 02:40 PM
00404B3C E8BFB4F500 call 01360000 <-- looks ripped

when you land on this set a bp write on 00404B3C+1 and all becomes clear.
nikolatesla20
01-28-2005, 03:59 PM
Yea I noticed that after that call returns the call has been "rewritten" to go to another high mem location, and that location sets up a pre-code jump into the actual API (it has some ripped code from the api it looks like).

Pretty yucky stuff, but not undefeatable...

-nt20
Pepone
01-28-2005, 06:58 PM
1st thanx Hero for translation. ;)
2nd I have serious problem with breaking at IAT writing in this crackme. I followed at 404bc4 MessageBoxA, and set hw bp on write dword (4 bytes) at 40b1c8. Changed exception - checked all, and run app with F9. No hw break at all. Like no bp seted. After restarting app, bp still active, still no break. What I doing wrong ? :-/ IsDebuggerPresent is properly hidden of course. :rolleyes:
Zero
01-31-2005, 11:22 PM
FYI: Some more infos can be found here, not a full tutorial, but some nice screenshots ;)

http://community.reverse-engineering.net/viewtopic.php?t=3486


Some interesting papers
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Some interesting papers
PDA

View Full Version : Some interesting papers

Neitsa
12-02-2004, 05:38 PM
Hello,

I've found some interesting papers related to computer science.

http://www.cs.arizona.edu/research/reports.html

In fact this is from an university research center. Depending on the topic you're interested you'll find some good papers there.

Hope you'll enjoy it.

Regards, Neitsa.
disavowed
12-02-2004, 11:18 PM
wow, they have papers dating back to 1989
lifewire
12-03-2004, 10:03 AM
interesting, thanks!
JMI
12-03-2004, 11:54 AM
Gosh. I didn't even realize they had computers back in 1989. :D No wait, I bought my first MAC back in 1986 and paid $10,000 for my second one in 1988. :eek: Imagine $900.00 for a 20Mg (yes I said megabyte) HD. Never though I'd be able to fill it. Now I have two 200 Gig HDs running a RAID on just one of my machines. Some things have changed for the better. :yay: But I still keep finding interesting reading and other things to fill them up with. Time to add some more. Thanks.

Regards,
TBone
12-03-2004, 09:56 PM
Hmm. Was that triassic, jurassic, or cretaceous? I can never remember.
disavowed
12-04-2004, 02:22 AM
Now I have two 200 Gig HDs running a RAID on just one of my machines.
that's a lotta kiddy porn you got there, jmi... better watch out for the feds!
Silver
12-04-2004, 10:37 AM
I bought my first MAC back in 1986

Between an amiga and a mac, he chose mac. And thus, we know everything we need to know about JMI ;)
lifewire
12-04-2004, 11:13 AM
that's a lotta kiddy porn you got there, jmi... better watch out for the feds!

:boo:
JMI
12-04-2004, 04:38 PM
disavowed:

The rig with the RAID is the system I work on all day. The fun stuff is on one of the other machines. I don't let my kiddies, who are already grown, play with my "art works". :sneaky: And maybe I AM the Feds. :idea: :devil:

Silver:

Yep. We know he recognizes a stable and functional machine which is capable of doing both work and fun and not prone to crashing every few minutes. At the time, I was using mostly music software and reversing the stupid PACE protection system which came with it. Still have a MAC for music processing and playback, although GigaSampler is pretty awesome on the windows side.

Regards,
Kayaker
12-06-2004, 11:52 AM
If you're interested, here's a picture of JMI and the PC he keeps his 'fun' stuff on... :D

http://woodmann.net/JMIsPC.bmp
Neitsa
12-06-2004, 11:58 AM
ROFL !!! :yay: :D
disavowed
12-07-2004, 12:02 AM
http://woodmann.net/JMIsPC.bmpthis was actually going around my team at work very recently, until someone posted http://www.snopes.com/inboxer/hoaxes/computer.asp :rolleyes:
JMI
12-07-2004, 06:30 AM
OK Kayaker:

Now that you've blown my cover by pasting my photo into that old submarine picture, I'm going to have to send someone up there to place a time delayed device in your Kayak, so that it sinks in some cold and frosty stream, when you are least expecting it. :devil:

Regards,


Ring 0 -> Ring 3 : Upward calls and downward returns theoretically possible?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Ring 0 -> Ring 3 : Upward calls and downward returns theoretically possible?
PDA

View Full Version : Ring 0 -> Ring 3 : Upward calls and downward returns theoretically possible?

Clandestiny
12-03-2004, 09:28 AM
Hi guys,

I was recently reading a paper on the old MULTICS ring architecture.

http://www.multicians.org/protection.pdf

It is rather interesting in the sense that it gives the history behind the development of the Pentium protection ring architecture which is, in fact, based upon MULTICS.

We all know that you can't call a ring 3 function from ring 0, but interestingly this seems to be "theoretically" possible. The described procedure for an upward call in MULTICS is basically the same as for the downward call (ring 3 to ring 0 for example) and is accomplished by installing a call gate. There are, however, a few caveats.

1. The calling procedure will need to copy the arguments into a segment accessible by the lesser privileged callee.
2. 2 call gates must be installed, one for the call, and one for the return to the greater privilege level.
3. Recursion is a problem becauses you would essentially need a "stack" for return gates.

Here is the excerpt from the paper that discusses these issues if anyone is interested:

"upward call occurs when a procedure executing in ring
n calls an entry point in another procedure segment
whose execute bracket bottom is m > n. When the call
occurs, the ring of execution will change to m. The subsequent
return is downward, resetting the ring of execution
to n. These cases exhibit two unpleasant characteristics
of a general cross-domain call and return that were
not present in the other cases.

The first is that the calling procedure may specify
arguments that cannot be referenced from the ring of the
called procedure. (For a downward call, the nested subset
property of rings guaranteed that this could not
happen.) There are at least three possible solutions to
this problem. Oneis to require that the calling procedure
specify only arguments that are accessible in the highernumbered
ring of the called procedure. This solution
compromises programming generality by forcing the
calling procedure to take special precautions in the case
of an upward call. Another possible solution is to dynamically
include in the ring of the called procedure the
capabilities to reference the arguments. Because a segment
is the smallest unit of information for which access
can be individually controlled, this forces segments
which contain arguments to contain no other information
that should be protected differently, again compromising
programming generality, unless segments are inexpensive
enough that, as a matter of course, every data
item is placed in its own segment. It may also be expensive
to dynamically include and remove the argument
referencing capabilities from the called ring. The third
possible solution is copying arguments into segments
that are accessible in the called ring, and then copying
them back to their original locations on return. This solution
restricts the possibility of sharing arguments with
parallel processes. None of the three solutions lends
itself to a straightforward hardware implementation.

The second unpleasant characteristic is that a gate
must be provided for the downward return. (For an
upward return the nested subset property of rings made
a return gate unnecessary.) The return gate must be
created at the time of the upward call and be destroyed
when the subsequent return occurs. If recursive calls
into a ring are allowed, then this gate must behave as
though it were stored in a push-down stack, so that only
the gate at the top of the stack can be used. The gates
specified in SDWts seem poorly suited to this sort of dynamic
behavior.

Processor mechanisms to provide dynamic,
stacked return gates are not obvious at this time.
Because of these two problems, the hardware described
in the next section does not implement upward
calls and downward returns without software intervention.
Although the same object code sequences that
perform all calls and returns are used in these cases as
well, the hardware responds to each attempted upward
call or downward return by generating a trap to a supervisor
procedure which performs the necessary environment
adjustments.

The manner in which the stack pointer register value
of the calling procedure is saved when a call occurs and
restored when the subsequent return occurs has not yet
been discussed. For a same-ring or downward call, it is
reasonable to trust the called procedure to savethe value
left in the stack pointer register by the calling procedure
and then restore it before the subsequent return, since in
these cases the called procedure has access capabilities
which allow it to cause the calling procedure to malfunction
in other ways anyway. For an upward call and the
subsequent downward return, the same convention can
be used without violating the protection provided by the
lower ring if the intervening software verifies the restored
stack pointer register value when performing the
downward return.

Cheers,
Clandestiny
JMI
12-03-2004, 11:49 AM
Thanks for the heads up. :yay:

Regards,
homersux
12-03-2004, 04:30 PM
Very Interesting Stuff, imagine the possibilities with this hack.
doug
12-03-2004, 11:07 PM
am I the only one who doesn't understand the real benefit of this?

I understand ring3->ring0, as you obviously gain something.. but why on earth would you want to go through the pain of calling ring3 from ring0?
Woodmann
12-04-2004, 05:32 PM
Hi,

I dont really see this as an upward versus downward thing. Call gates that can be opened and closed without using the stack is brilliant. Then again, I cannot understand how this could work. Perhaps this is just some way to prevent "hooking" a call ?

It seems to me that they are suggesting a way to store or move data at a level that could be considered sub-processor.

I am so full of shit :eek:

Woodmann
JMI
12-05-2004, 08:25 PM
Well, who would want to disagree with the Boss?? :D

Regards,
evlncrn8
12-06-2004, 02:20 AM
i did it another way, via dioc, passing the va of the r3 api call (messageboxa in my case) to the r0 driver.. worked fine heh and then calling it via call eax etc...
begemott
12-09-2004, 03:16 AM
Hi All,

>We all know that you can't call a ring 3 function from ring 0, but >interestingly this seems to be "theoretically" possible.

My 2 cents:

There is a very interesting (IMHO) paper here:
http://www.osronline.com/article.cfm?id=168
It describes how to call a R3 function from R0 practically ;-)
Even more:
"The resulting function, within the user?s address space, then executes in kernel mode."

Cheers
Begemott
Kayaker
12-09-2004, 06:46 PM
Hi

Thanks. The not-directly-accessible document which was just mentioned is called
Understanding and Using Execution Context in NT Drivers
and is included with this thread

Link: Kernel Services in User Space on Win2K
http://woodmann.net/forum/showthread.php?t=6003

Kayaker
nikolatesla20
12-09-2004, 06:50 PM
Yes, almost 90% of driver calls from ring3 will actually execute in the ring3 app's context, which means the driver can simply use the ring3 app's memory addresses without problem.

A driver that uses delay dispatch or queues can still accomplish this if the ring3 app passes the driver it's processID in some sort of initialization routine. Then the driver can simply KeSwitchContext() or whatever to change to the ring3 app's context, and wallah.

-nt20


Authorization from floppy disk
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Authorization from floppy disk
PDA

View Full Version : Authorization from floppy disk

bestobest
12-03-2004, 11:59 AM
First time That I have encountered a program that in order to register you need authorization from a floppy disk, if you don't have that disk, how can you tackle this application....
JMI
12-03-2004, 12:05 PM
Have you done what your are supposed to do FIRST and tried to find an answer to your own question? Have you used the search function here at all?

Thinking conceptually, there is not to much different from a protection searching for a file on your HD or your CD or your Floppy. The API may be different for each but it has to read something, confirm that it is the "right" something, and then tell the program which demanded the check that you are a good boy and not a bad cracker. So you have several ways to approach your problem. You can find the correct call to "read" from where it wants to find the file, you can then attempt to intercept the comparison of the file which is found, or where it branches if it is not found, and determine whether you can "fool" the program into thinking it did find the correct file.

One other option, which makes the process much more difficult is that it reads something from this "file" to decrypt part of the program and, if it does not find it, that part of the program is non-functional.

Now it's up to you to go study up on how some of these actions can be accomplished.

Regards,
bestobest
12-03-2004, 02:23 PM
jmi you always have good answers
FrankRizzo
12-07-2004, 11:50 PM
What does it say if the disk isn't in there? (I'm old school, and floppy based protection used to be my bag).
Clandestiny
12-08-2004, 11:01 AM
Do not forget that what it's looking for may not be found in a "file" per se. There are other places where data can be hidden. Bad sectors (that are not really bad), for example, or in file / RAM slack (the empty space at the end of a clustor / sector). Floppies are usually FAT 12, btw.

Cheers,
Clandestiny
0xf001
12-08-2004, 11:39 AM
hence imagine the decryption routine itself is started from disc and you do not have the algorhitm available as well - that would be a challenge :)
JMI
12-08-2004, 11:58 AM
Clandestiny's comment reminded me that there were, indeed, some copy protections for floppy based systems that also used "bad sectors" as a method of attempting to prevent the copying of the floppy itself. Standard copy programs would not copy the disk when it discovered the "bad sectors." As I recall, this was common on music software and was sometimes referred to as the "key disk" protection. You had to "prove" your possession of the software, by inserting the key disk, much as you have described.

You now have several possibilities to investigate. That's part of what makes it all interesting. :idea:

Regards,
bestobest
12-08-2004, 04:00 PM
What does it say if the disk isn't in there? (I'm old school, and floppy based protection used to be my bag).

It simply say authorization key not found on floppy, even tho I had no floppy inserted, but from all you guys suggestion I bpx on int13 with no luck, I tried getdive, well everything I could think that reference a drive, could not get the program to break, if it at least break, I could find out what it is looking for, anyway thanks all. I will keep trying
FrankRizzo
12-08-2004, 11:18 PM
There were ALL manner of disk protections. There were "bad sectors", there was one that reformatted track 1 so that it had 1 extra sector, and most copy programs would only read the normal number. There was monkeying with the intra-sector gaps, and my personal favorite, Rob Northen's Copylock used to reformat track 1 as 1 big sector. When the copy programs read it, they chopped off the gaps, thus funking up the data.

(It also generated 4 checksums of the data in that track, and used them to unencrypt the program before it ran. His downfall was that he spent an inordinate amount of time on his "wrapper", so, when I found a SIMPLE way through it, and wrote a dumper, he had nothing.. So, he went off and started writing compressors for the SNES).

So, let me ask some questions here. Are you saying that the program runs, and then you have to put the disk in to get it registered? Or, does it start, access the floppy, and then just drop back to DOS with an error message?

BTW, it SOUNDS like you are looking at Everlock by AZ-Tech in Missouri. They tried hard, but most of their stuff was easy to crack.
TBone
12-09-2004, 11:46 AM
I seem to remember that all the old Sierra games like Space Quest 1 and King's Quest 1 used the old intrasector gap trick you mentioned. Of course, if you did a raw copy of the disk instead of a FS copy, then it would work. But DOS didn't come with a raw writing utility like dd. I could be remembering incorrectly, though. I think was 5 years old when my father brought home a mega1337 IBM XT clone and a copy of Space Quest one Christmas. Ahhh, the memories. Are the two guys from Andromeda doing anything these days? Or, for that matter, any of the old Sierra staff like Ken and Roberta? I haven't heard anything about any of them since they sold the company.

Anyway, I think it's kind of funny how copy protection schemes sort of repeat themselves over the long haul. A lot of those old schemes came back in a modified form as CD copy protections. SafeDisc is a pretty good example of the bad sector trick with a new twist. Deliberately write bad sectors to the disc, and then use the pattern of good and bad sectors as a binary code to encrypt the executable.
bestobest
12-09-2004, 12:46 PM
There were ALL manner of disk protections. There were "bad sectors", there was one that reformatted track 1 so that it had 1 extra sector, and most copy programs would only read the normal number. There was monkeying with the intra-sector gaps, and my personal favorite, Rob Northen's Copylock used to reformat track 1 as 1 big sector. When the copy programs read it, they chopped off the gaps, thus funking up the data.

(It also generated 4 checksums of the data in that track, and used them to unencrypt the program before it ran. His downfall was that he spent an inordinate amount of time on his "wrapper", so, when I found a SIMPLE way through it, and wrote a dumper, he had nothing.. So, he went off and started writing compressors for the SNES).

So, let me ask some questions here. Are you saying that the program runs, and then you have to put the disk in to get it registered? Or, does it start, access the floppy, and then just drop back to DOS with an error message?

BTW, it SOUNDS like you are looking at Everlock by AZ-Tech in Missouri. They tried hard, but most of their stuff was easy to crack.
Well the program run with a lot of options disabled, if you want them enabled, you will have to enter an authorization key. You enter a key and say authorization not found on floppy disk.....my problem is not being able to break. I checked with peid, and as far as it go it it not packed with anything.
Also say compiled with vb5 or vb6..
FrankRizzo
12-09-2004, 07:39 PM
The more you tell me about this app, the more it DOESN'T sound like a real floppy protection. It sounds like it's looking for a file on the disk, not some hijinx. Is it possible that it's trying to open a file, and read a serial number out of it? I've seen such done before. You might want to run this under smartcheck, and see if it's a "FileOpen" or something weird.

I BET it's a FileOpen kinda situation. If not, I might offer to look at this, and give you some hints about it.


dword ptr question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > dword ptr question
PDA

View Full Version : dword ptr question

ReVeR
12-03-2004, 10:18 PM
Hey.
i was wondeirng if anyone could explain the next line to me:
mov edx,dword ptr [ebp-68]
what does it do?
Clandestiny
12-03-2004, 11:09 PM
The instruction is just saying "load 4 bytes at the memory address pointed to by ebp-68 into register edx." The dword ptr synatx just clarifies the size of the data being pointed to as 4 bytes. The ebp-68 also leads me to believe that this instruction is accessing a local variable since it is standard for a procedure to allocate its local variables on the stack and reference them as a negative offset from ebp. ...Therefore, without further contextal information I would say that this particular instruction is simply loading a local variable of type integer into edx.

You might want to read an introductory book on ASM like Randall Hyde's Art Of Assembly before you delve too deeply into this RCE stuff. It is free and in ebook format, btw :)

Cheers,
Clandestiny
ReVeR
12-04-2004, 07:27 AM
i don't like reading book siwhtou practice...i might take a look at that one again....i know the basics, but whne u just read it u odn't remeber it....
how do u know it is an int variable?
naides
12-05-2004, 04:34 PM
how do u know it is an int variable?

int variables are 4 byte long in most if not all win32 programming languages, because they perfectly fit inside a 32 bit register like eax.
WaxfordSqueers
12-05-2004, 09:33 PM
You might want to read an introductory book on ASM like Randall Hyde's Art Of Assembly before you delve too deeply into this RCE stuff. It is free and in ebook format, btw :)

Cheers,
Clandestiny

I remember reading something about this is Matt Pietrek's book, Windows 95 Programming Secrets. On page 654 of Chapter 9, there is a section called 'Identifying local variables'. Earlier in the chapter, Matt describes the EBP register as a stack frame register. The variables from functions are passed on the stack between CALLing functions and the function called. The EBP register usually points to the bottom of the local stack.

Matt gives this example:

LRESULT WINAPI WndProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)

This is a declaration for function WndProc. Inside the WndProc code, the stack frame for a 32 bit process looks like this:

lParam DWORD PTR [EBP+14]
wParam DWORD PTR [EBP+10]
msg DWPRD PRT [EBP+0C]
hWnd DWORD PTR [EBP+08]
return EIP DWORD PTR [EBP+04]
previous EBP DWORD PTR [EBP+00]

(My notation)The functions parameters have been pushed onto the stack from right to left, and the EBP is pointing to the previous EBP. By examining the code in positive offsets of double words, you can find each of the functions parameters, which follow the original EBP and EIP doublewords.

A newbie might be interested to know that the values before a CALL statement can be identified if you have a handy API reference that describes functions and their parameters. Look for PUSH statements, in general, immediately before a CALL function, and they will most likely be pushing parameters for that function onto the stack. You have to be careful because sometimes the parameters are passed by more devious means. If you look at the function layout in an API reference, they will be pushed as above. Careful scrutiny will tell you what's what.

Matt goes on to say: Like function parameters, a routine's local variables are also usually found on the stack. The key difference in distinguishing between a parameter and a local variable is that the code references local variables with a negative offset from the stack frame. For example, in 16-bit code, [BP-04], or in 32-bit, [EBP-04].

Unlike parameters, there's no semi-mechanical method for determining the types, uses, and locations of local variables. Instead, you have to examine how the function's code uses a particular memory location.

----snip----

Determining that a program is using a global variable is particularly easy. Almost any memory reference that uses a hardcoded address is a global variable. Put another way, global variables don't require the assistance of registers like EBP to address them. In 32-bit code, a global variable reference would look something like this:

MOV EAX, [00464398]

Anybody who is interested can read the rest for themselves.
WaxfordSqueers
12-05-2004, 09:47 PM
Hey.
i was wondeirng if anyone could explain the next line to me:
mov edx,dword ptr [ebp-68]
what does it do?

I was thinking of your question again, and maybe I got too particular in my long blurb. I don't know how much you know about how code is written.

When you see brackets, like [ebp-68], it's telling you to look for a value at the memory address inside the brackets. In this particular case, the address is referenced by the EBP register, which means the memory address is also a stack. It's telling you to look at the value in the memory location of the EBP address minus 68 hex. Then, it tells you to move (MOV) that value to the EDX register.

I don't know, obviously, what your app will do with it then, but that's where it wants it.
ReVeR
12-07-2004, 08:06 PM
thx, this is great, exectly what i wanted:D thx yall


Script kiddies or woud be crackers ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Script kiddies or woud be crackers ?
PDA

View Full Version : Script kiddies or woud be crackers ?

Nico
12-04-2004, 11:07 AM
Hello everyone,

I post it in Off topic, because it is not directly related to Software Reverse Engineering. Well kind of..

I hope the admin and moderators won't mind me to posting this here but
i think we are going to see posts around soon about it, i want to clarify
the situation.

In the past, we (at siliconrealms), have seen working attacks on Armadillo.
Skamer made a lot of keygens because of vulnerabilities in our algo, then TMG did find a weakness in one of our PRNG after the source leak we had..

We respect that, because this is real work.

Now, a few days ago, a group called FFF released a keygen for two of our customers, and they were using the biggest level of Security in term of Licensing. We use Elliptic Curves Cryptography and it isn't a secret to anyone anymore. I first was impressed and respectful until i figured it all.

If you want to read it:

h**p://www.siliconrealms.com/fff-keygens.htm

Don't flame for this, im just pissed off by stupidity.

I know most of you don't care of protection authors and like to dish us, but
I want to point out that, we respect reverse engineer works... We don't respect lamers.

Have a good day.

Nico
doug
12-04-2004, 12:11 PM
Just a thought here,

I guess this just goes to show that there's more to a secure system than a strong exe guard module...

crackers rarely go the hard way when there's an easier route.

As a protection author, you add features thinking a reverser will have to do X->Y->Z in order to counter it.. (Y being extremely long) a determined reverser will indeed go through x->y->z.. but a better one might find another route and directly apply x->z

these people found a weakness in the system.. is that why they are lamers? What about that website that had the certificates available to anyone who could hijack the webserver.
Silver
12-04-2004, 12:13 PM
As I see it, that's an issue you need to take up with your client. "Resource" companies (such as Havok for example, who lost all their source when HL2 was leaked) often have penalty clauses for this type of thing.

But yes, you/they/someone got rooted, and they found the pot of gold. I'd question the back-end infrastructure and security practices of the organisation in question - by virtue of the fact that they use your protection they must be selling a software product. And one which is no longer generally protected by your protection.

Just because a company is full of coders doesn't mean they have the technical skills for security.
Nico
12-04-2004, 12:28 PM
I totally agree with you. Security is a global process.

That's not the point of my post.. I start to have complains about Armadillo itself, people think the problem is in the guard module because the keygen
brags about ECDSA-113, like they really did it.. The GFX says : breaking the limits.. C'mon, they think they are doing like TMG..

I just want to clarify that, their keygen has nothing to do with Reverse Engineering. Of course they brag and call it real work, people on various forums thought they did it the hard way.. that's what i call lame.

I can't be behind every customers checking out if they apply security patch on their web sites. I have of course contacted them all by now.

To answer to Doug, the certificates are on their web sites, because like most protection systems, you can use CGI to generate keys and provide them to your customers. This isn't related to Armadillo, its every protection offering such options to their customers.

I just want to avoid the false claims about the algo itself, when they just copy pasted the certificat they have stolen.

As i said, i have respect for people doing real reverse engineering.
On this, i enjoyed your paper about RPC a long time ago, that was reverse engineering..

Don't get me wrong in my post.. Im just tired of kids bragging for things they didn't do.

Cheers.
CrackZ
12-04-2004, 01:11 PM
Hiya Nico ;-).

I'm not so sure I'd be _quite_so_critical about these guys, especially if people here have read the paper 'Why CryptoSystems Fail?', I'm sure you must have ;-) - thats not to say that I advocate exploiting customers websites though.

The basic analogy as I see it (though given to me by someone else) is that copy protection is kind of like fence building. Not everyone wants to / or is capable of scaling the heights required to get over the wall, when someone does, you respect them because of the effort they've put in. However, eventually you build an insurmountable wall (or in the Armadillo case you heal all your weak PRNG's, increase your Blowfish key length and choose ECDSA-113 ;-) ). So the attackers decide rather than climb your wall they'll simply tunnel underneath, and the end result is exactly the same, except its ruthlessly more time efficient than pouring over your source code and finding weaknesses.

Each time you got 'bruteforced' or 'keygenned' because of your weak PRNG's you healed the hole and advised your customers to upgrade - the only difference now is that your educating your customers on 'securing their websites' ..... I totally accept your point that the technical competence required to produce a 5 line keygenerator is insignificant and that anyone capable of breaking ECDSA-113 ought to have better things in the universe to attack than a few lousy shareware apps ;-).

My point is a wider one, with the best system and will in the world, everything is subject to the _human_element_ of failure, I see today a scene where a plethora of people simply choose to hack websites or steal credit card numbers rather than play the reverse engineering game ..... you can bitch about it as much as you like, as I do on a regular basis ;-) but you just won't stop it
.....

Take it easy mate ;-).

CrackZ.
Nico
12-04-2004, 01:25 PM
Heya CrackZ ;)

I agree with you too.
On the other hand, i wanted to clarify how they did it to avoid any rumors.

I still have no respect for those lame practice.

Cheers!

Nico
Woodmann
12-04-2004, 04:33 PM
Howdy,

I think it would be a bit naive to think that someone/crew put in the time to reverse it the old fashioned way. They just want to be the first to say "Hey I did it". We all know its about getting "proper cred" :cry:.

There have been more then a few of these instances when someone gets a hold of something with a big value. Everyone survives the initial onslaught, things change ;). Lamers will always be around, they just cant help themselves.

-CBO-
ran
12-04-2004, 09:17 PM
I agree, that's no different than putting out a stolen registration key on the net.

UCF have also been releasing Armadillo keygens lately, and I wonder if they chose this route too.
Nico
12-04-2004, 09:27 PM
UCF releases keygens of applications using the old registration systems
kept for backward compatibility only. The algo is different and has weaknesses.
Skamer proved it in the past, and UCF is doing the exact same thing nowadays.

Many customers can't change their registration key easily because they don't have the man power to issue new ones to each of their customers.

I doubt UCF would go the hacking / ready made exploit way anyway.. because it isn't cracking at all..

Cheers.
disavowed
12-04-2004, 09:42 PM
Nicolas, just out of curiousity, do you have an alias that you usually go by in the reversing scene? Or do you stay out of it entirely?

I only ask because I (and many other reversers, I'm sure) go by both my alias and my real name, depending on the context.
Nico
12-04-2004, 09:50 PM
I have no official alias.. I usually use 0x90 or null byte because of the first letters. I don't need to explain what this 0x90 means ;-)

Im out of the "scene", but i have to stay around and see what's going on for obvious reasons. I choose to come here to talk a little and clarify a few things.

From the top of my head, you had an alias *many* years ago.. Stormer or something like that, Am i right ? :-)

Im not the only one coming here, protection authors visit those forums regulary, as well as people from various governement agency :-) They just read though.

Edit: st0rmer even :D
jB_
12-05-2004, 07:44 AM
Nico,

I understand your reaction, and here is my point of view.
First we never claimed to have broken the Armadillo reg. scheme. I said to *all* -but one, and I had a reason- the people who asked me about these keygens that:
- It was easy
- We used a lame method

I knew you would look at the keygen. We let the encryption template because of that. I'm not dumb, I know it is impossible to recover such a long passphrase... -I studied the algo, and you can guess I've understood it-. We deliberately used codegen.dll and the encryption template.

We could have used the stolen KeyMaker.c, and easily replaced the encryption template by the private key parameters. The point is that we didn't want to make others believe that we broke the scheme.

I agree with you for the text in the gfx. The text doesn't represent what we've done. For the About text, there's a reason about it, and it is not to look like skilled guys as you may think.

I can PM you if you want more information.

jB
disavowed
12-05-2004, 01:53 PM
From the top of my head, you had an alias *many* years ago.. Stormer or something like that, Am i right ? :-)

yes, google is a wonderful thing ;)

and if you're wondering why the name-switch: http://sunsite.berkeley.edu/Web4Lib/archive/9906/0332.html, namely "hope this poor gal (guy?) st0rmer doesn't suffer an fbi raid from all the attention web4lib is sending them" (you can find the rest of the thread on the site if you're interested)... yes, guy (not gal), and no, i never heard from the fbi regarding this ;)

it was actually my own fault though. i wasn't following the industry-accepted approach to submitting security vulnerabilities. this was five years ago, and ironically, i've met and have had intelligent conversations with some of the people in that thread since (although they only knew me by my real-life name)
Nico
12-05-2004, 06:09 PM
yes, google is a wonderful thing ;)

No :) no google :)
I have been around for seven years, and i remember a Pcode crackme of yours, that was tutorialised on Fravia's site. I have good memory when it comes to nick names ;-)

and if you're wondering why the name-switch: http://sunsite.berkeley.edu/Web4Lib/archive/9906/0332.html, namely "hope this poor gal (guy?) st0rmer doesn't suffer an fbi raid from all the attention web4lib is sending them" (you can find the rest of the thread on the site if you're interested)... yes, guy (not gal), and no, i never heard from the fbi regarding this ;)

I will check it out.

it was actually my own fault though. i wasn't following the industry-accepted approach to submitting security vulnerabilities. this was five years ago, and ironically, i've met and have had intelligent conversations with some of the people in that thread since (although they only knew me by my real-life name)

I will definitely look this thread :)
Congrats for the 5 years old full disclosure mess ;-)
Nico
12-05-2004, 06:21 PM
Nico,

I understand your reaction, and here is my point of view.
First we never claimed to have broken the Armadillo reg. scheme. I said to *all* -but one, and I had a reason- the people who asked me about these keygens that:
- It was easy
- We used a lame method

Well, it doesn't look that evident with your keygens. You make sure to write
about the Level 10 (ECDSA 113), you put comments about *real* work, and
the GFX above it, which sounds definitely like you did something good.

I was impressed and respectful when i saw those keygens.. until i figured it out. If it had been a real keygen, you can make sure that i wouldn't have written this half assed html page. Now you have every lamers spreading rumors, and customers thinking there are problems..

I knew you would look at the keygen. We let the encryption template because of that. I'm not dumb, I know it is impossible to recover such a long passphrase... -I studied the algo, and you can guess I've understood it-. We deliberately used codegen.dll and the encryption template.

Understanding it is one thing, breaking it, is another story.
Well, you stole those encryption templates on those web servers, of course you used them.

We could have used the stolen KeyMaker.c, and easily replaced the encryption template by the private key parameters. The point is that we didn't want to make others believe that we broke the scheme.

I would still recognize the KeyMaker.c code, and those two customers had
very common things.. actually, i looked at 3 web sites to get it.. you know which one is the third one.

I agree with you for the text in the gfx. The text doesn't represent what we've done. For the About text, there's a reason about it, and it is not to look like skilled guys as you may think.

I don't see anything related to *real* work in what you have done, and when you talk about stolen releases, i know that you refer to lamers stealing keygens. My comment on the other hand, was an analogy to this, and your practice.. because you did steal too.

I can PM you if you want more information.

I don't need anymore informations.

Thank you, but I have everything i need.
cRk
12-05-2004, 11:02 PM
NICO = Nelson ..... sorry to hear bad news again.. but obviously you're mad about the new hole found... Asprotect haven't been keygenned for a while ... :D remember TMG got help to keygen what they had . maybe those from FFF are lamers .. you shouldn't care too much then :yay:
Nico
12-06-2004, 04:19 AM
Here we go.

Nico and Chad are two different guys.
I read your comments on exetools, no need to post twice :)

You don't seem to understand what happened (and for some reasons, it doesn't surprise me...) but the same could have happened to the protector you are
talking about.. actually it did. And its not related to their protector either.

Oh well..
CrackZ
12-06-2004, 01:16 PM
Just to add ; and kill ANY conspiracy theories right here and now.

I can guarantee that Nico != Chad ;-). In fact Nico bares more resemblence to the Silicon Realms cat than Chad, but thats another story yet again.....

Regards

CrackZ
neur0n
12-06-2004, 01:20 PM
It seems that everyone thinks Skamer made a lot of arm. keygens. Point is he only released them, actual work was done by another cracker who didn't want to be known.
Nico
12-06-2004, 01:44 PM
It seems that everyone thinks Skamer made a lot of arm. keygens. Point is he only released them, actual work was done by another cracker who didn't want to be known.

I have heard a lot of rumors about that too.
One of them saying the author of those keygens is P.C..
neur0n
12-06-2004, 03:40 PM
Author of those keygens is not P.C. but both live in the same country.
P.C retired long time ago and doesn't crack anymore.
Nico
12-06-2004, 03:43 PM
Im just repeating the rumors i heard.

Who ever was the real guy. i respect his work, because he broke the registration system.
QuickeneR
12-07-2004, 12:46 AM
Speaking of "script kiddie way" vs. the "hardcore reverse engineering way", I have a question for Nico.

Why did not Silicon Realms do it "properly"? You could have underestimated the time required to fake a key (a quote from Armadillo 2.61 "A level-1 signed key is at least 28 digits long. On a 450MHz Pentium-II class system, it would take roughly 71 days to learn to forge it.") but after the first keygens it was clear that the keysystem was insecure. The obvious solution was to adequately increase the key length and probably switch to another crypto scheme. But until recently this was not done.

I'm really curious what caused this. Did you consider key length to be more important than security? Or were there some marketing reasons involved?
neur0n
12-07-2004, 02:29 AM
Im just repeating the rumors i heard.

This rumor is not true :). It doesn't matter who the real guy was but I have to say it because P.C wouldn't want
his name to be connected with it. I knew Skamer,P.C and the real guy. P.C and the real guy were awesome crackers
but Skamer, well he shouldn't get respect for making those keygens.

And for those who know P.C., yes he is damn good table tennis player :) .
Nico
12-07-2004, 06:38 AM
Hi,

First, I have nothing to do with the registration system. I didn't work on
it any single time.

Anway, the registration proved to be insecure. I told SR to changes the key system, or a least to use bigger key, and to review it etc.

The problem is : backward compatibility. When you have a lot of customers, you can't change the key system all of a sudden, especially when you don't have man power to issue new keys.

Even if its a security problem.. SR tried to introduce new level thinking it would fix the problem, yet allowing to keep the backward compatibility.

Oh well..

You can't change everything you want in a protection system, when you have a lot of customers.. it needs testing etc.

Speaking of "script kiddie way" vs. the "hardcore reverse engineering way", I have a question for Nico.

Why did not Silicon Realms do it "properly"? You could have underestimated the time required to fake a key (a quote from Armadillo 2.61 "A level-1 signed key is at least 28 digits long. On a 450MHz Pentium-II class system, it would take roughly 71 days to learn to forge it.") but after the first keygens it was clear that the keysystem was insecure. The obvious solution was to adequately increase the key length and probably switch to another crypto scheme. But until recently this was not done.

I'm really curious what caused this. Did you consider key length to be more important than security? Or were there some marketing reasons involved?
Nico
12-07-2004, 01:27 PM
The page has been removed from our web site.

I wanted to clarify this issue, and my point has been made.

Thank you to the board members who didn't flame right away and sorry about this fuss.

Im glad protections authors can have mature discussions with Reversers here.

You can remove the thread if you like too.

Take care,

Nico


NEOLITE 2.0 UNPACK
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > NEOLITE 2.0 UNPACK
PDA

View Full Version : NEOLITE 2.0 UNPACK

master
12-04-2004, 02:41 PM
one silly question about a DLL unpack.
it's after i found the oep
How do i put the "CC" (INT 3) (i've rad that in a tut) in code. I have winhex, and cannot edit the code.

Thanx alot
hosiminh
12-07-2004, 02:46 AM
I believe you are looking for this : hxxp://members.home.nl/code.inside/tutorials.html

I assume you want to do it with Softice + symbol loader
I would put my eyes on tutorials 13 , 25 ,26 ,27 . You can apply the same technique to the dll file .

Small tip : With Ollydbg you can load *.exe , *.dll and *.ocx files .
master
12-08-2004, 10:03 AM
The problem is that i cannot find the OEP. This is the first step of unpacking (so i was reading it in every tut). The file DLL. And it's beeing called froam an exe that is not compressed.
When i load it in Olly, and press a couple time shift+F9, i enter in this packed shit, and code looks like this:

01194EEE 8B0B MOV ECX, DWORD PTR DS:(EBX)
01194EF0 66:8DBD MOV BX,BX
01194EF3 0FB9 ???? - Unknown command, that meens it is compressed.

I checked with StudPE it says Neolite 2.0.

I tried to follow the procedure written in the tut you said, i cannot even find the OEP because in tut it's with exe.

If you have some idea, please help

THNX
master
12-08-2004, 10:33 AM
I forget to write te Section information, it looks like this:
Name Virtual Size Virtual Offset Raw Size Raw Offset Characteristics
.text 00012000 00001000 00012000 00001000 60000020
.rdata 00005000 00013000 00005000 00013000 C0000040
.data 00004724 00018000 00003000 00018000 C0000040
.rsrc 00022000 0001D000 00022000 0001B000 40000040
.reloc 00003000 0003F000 00003000 0003D000 C2000040
.protect 000D4000 00042000 000D4000 00040000 E0000020 that's the protectet shit :(

From the Header info, the Entry point is 00042280
Can i found out the OEP?

THNX AGAIN
hosiminh
12-09-2004, 04:45 AM
Well , i guess i wasn't clear enough . Get a copy of Ollydbg (hxxp://home.t-online.de/home/Ollydbg) . Run Ollydbg , choose File > Open and choose in file type "Dinamyc-link library (*.dll)" . Ollydbg will ask you something ...Launch LOADDLL.exe?... Click YES . Now you should be at the PEP (packer entry point) . Now begin to trace with F7 and F8 . As i remember , neolite always use instruction "JMP EAX" before it jumps from packer code to OEP (original entry point) :)

Here you will find some tutorials about this packer :
hxxp://tutorials.accessroot.com/
hxxp://unpacking.free.fr/tuts/unpack/neolite/Tutorial-Manual-Unpacking-Neolite2.0.html
hxxp://www.iespana.es/ollydbg/akira.html
master
12-09-2004, 11:34 AM
Thnx hosiminh!

I am actually using OLLY the whole time. I tried that procedure you wrote, oep still not found.
The "JMP EAX" was not in the procedure, before i got the famous "hasp not found".
Must check the last tut you mentioned, that have i not found earlier.
Maybe, the problem is, because the progi is with hasp hardlock, maybe it is packed on some other way too (hasp envelope).
Thanks anyway
master
12-09-2004, 12:01 PM
Well, maybe you got some time.

The program is located at:
http://www.woodmann.com/fravia/rce-faq.htm

But don't bother to much. It would be gread if you knew where i could start.
I checked every tut on hasp, and neolite. Nothing similar found in here :(

THNX
dELTA
12-09-2004, 04:43 PM
Don't post target name/address, read the FAQ!
master
12-10-2004, 12:09 PM
sorry dELTA :)


SoftIce 2.7 and HT ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftIce 2.7 and HT ?
PDA

View Full Version : SoftIce 2.7 and HT ?

TQN
12-04-2004, 07:21 PM
Hi all !
I have a problem which I could not solve after 3 days for searching, trying. Recently, I have upgraded my PC (mainboard, CPU, add more RAM). My CPU is Intel P4 3.01 GHz, Hyper Threading enable. When I manual start SoftIce 2.7, the system hang, no mouse, no keyboard, no Ctrl-Alt-Del. I have updated new SIWVID (sp4), newest OSINFO.DAT, ntoskrnl.exe symbols, but no effect. But if I turn off the Hyper Threading, SoftIce will work fine. Do you have any tips or tricks to allow SoftIce run in HT mode.
Thanks for your help and read my post.
Best regards,
TQN
naides
12-04-2004, 11:47 PM
Hi all !
But if I turn off the Hyper Threading, SoftIce will work fine. Best regards,
TQN
For once, I am not trying to be the smart ass I am usually when I make my postings, but, Compuware site/forum/technical assistance would be the best place you could find some answers, provided you own a legit copy of DriverStudio. ( Not, Right? :D )
Otherwise,
My first instinct would be to try DS 3.1 and see if this nuisance goes away


about the book <<How Debuggers Work.. >>
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > about the book <<How Debuggers Work.. >>
PDA

View Full Version : about the book <<How Debuggers Work.. >>

lordor
12-05-2004, 05:48 AM
Who have the book <<How Debuggers Work : Algorithm,Data Structure,and Architecture>> written by Jonathan B RosenBerg
This book is special in debugger.
I am in China , I am to write a debugger, I in dire need of the book,However, I can't find the book in domestic shop .
Who can Help me
thanks much!
ZaiRoN
12-05-2004, 08:59 AM
http://www.amazon.com/exec/obidos/tg/detail/-/0471149667/qid=1102249725/sr=1-1/ref=sr_1_1/002-2238987-6505649?v=glance&s=books
Silver
12-05-2004, 10:39 AM
I think the point is he can't order the book in china... It's very old, I've had a look and don't have it PDF'd. I'm guessing it's old enough that it never came with an ebook version, so you'll have to hope someone has scanned it.
Woodmann
12-05-2004, 01:17 PM
People in China cant buy books from Amazon ???
disavowed
12-05-2004, 01:42 PM
if you need to write a debugger for windows, the documentation on msdn is very comprehensive.
lordor
12-05-2004, 08:09 PM
I had finded this ebook from here
deleted
NO ILLEGAL EBOOK LINKS!!

In china to buy a book from us,that will cost me half of a month salary.
Silver
12-06-2004, 06:19 AM
People in China cant buy books from Amazon ???

Silly of me, it's called the "People's Republic", so I guess the people can do whatever they want ;)
Clandestiny
12-06-2004, 05:44 PM
Hiya,

I have read the book you refer to. I was actually a bit disappointed in the book as I was hoping for more in-depth information specifically relating to kernel level debugging. The book is very "high-level" in its treatment of the subject and focuses almost exclusivly on ring 3 debuggers. It only briefly mentions SoftICE and then gives no discussion of the "real-world" issues involved in designing such a system level debugger. IMO, it would be great for a theoretical computer science class on debugging concepts or even somewhat decent if you just want to use the Windows API to write an application debugger. If, however, you are looking for detailed low level information, forget it.

Clandestiny


what about linux
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > what about linux
PDA

View Full Version : what about linux

0xf001
12-05-2004, 07:52 AM
hi all,

i have seen here posts regarding linux, too.
is it an option to add a linux section?
i know this board is mainly discussing abt windows.
actually at least I would be very happy to have a more structured approach when talking about linux.

i have seen now lots of protection systems for linux in commercial applications, and there are many interesting things to discuss and knowledge i would like to share and improve.

however i like this forum to discuss, and the chm download, ...
so i prefer this board over others :)

currently one has to use the search button to see whether there are new posts concerning linux protections, ...

i would actually be glad even if just 1 section for linux would be added,
i know there are crossreferences to platform independant posts like encryption, ...

i feel the whole linux RE is not getting pretty much started, as there are
not so many places to discuss topics, in the quality like here.

what are your opinions? yes / no / cancel ? bullshit? we do not want linux here? great idea? :)
disavowed
12-05-2004, 01:36 PM
i would recommend to you http://hculinux.cjb.net or http://www.hcunix.org/, but both seem to be down/gone. anyone have the most recent address? (or is it gone for good?)

in the meantime, you might want to checkout http://www.eccentrix.com/members/mammon/ and its discussion board: http://www.eccentrix.com/members/mammon/wwwboard/index.html
0xf001
12-05-2004, 01:49 PM
hi disavoved!

thanks for reply! i know those sites already, yes they are down...

i am not looking for ressources, i know many other sites as well. and just here comes the point :) i wanted to ask what you people think of adding a linux section to the RCE forum. i know the anticrack forum. they have a linux section, but for my opinion the board itself is not soo good (pleas do not kill me by that opinion :) )... eg you can not see the latest topic where was posted on the main site. no archive download and such minor things. it is not a problem and also not the point :)

it seems here is another community which is quite BIG, and it is an RCE forum, but not many ppl talk about linux. so if one has a question/something interresting to post he would probably not do so, as it looks "windows only",
and either search for somewhere else or just not start to discuss.

by seeing an own section for linux, probably the section would spread quite far along with the knowledge!

maybe even some windows reverse engineers will have a look into it and can learn / discuss here on the board as well.

technically there is no reason for it of course.

maybe i am alone with those thoughts, maybe it has already been thought of, here is somebody interested! :)

cheers, 0xf001
Woodmann
12-05-2004, 03:40 PM
It will be discussed and a decision will be made.

Thanks for the suggestion.

Woodmann
0xf001
12-06-2004, 11:11 AM
thank you very much for taking care!

cheers, 0xf001


Altering a DLL file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Altering a DLL file
PDA

View Full Version : Altering a DLL file

mbro
12-06-2004, 10:01 AM
I have a DLL file that contains a string I need to change. Now when I load the DLL in W32DASM and open string references I can see the string, when I load it into something like ResHacker to change the string - the string isnt there.
I am guessing that this could mean the string is being pulled from a different file or is not part of the string table - how do I change this string, can anyone help me pls?

Thanks
TBone
12-06-2004, 11:04 AM
Decompilers (like W32DASM) and debuggers find string references all throughout the code, not just in the string table. I don't know the exact method(s) employed, since I don't exactly have the source code for IDA sitting in front of me :p. But, strings have a pretty distinctive profile, so they aren't that hard to find. I would imagine that it starts by scanning the code for anything that looks like a string, and then walks through the code and marks off the ones that are actually referenced somewhere.

I'm not sure what you do with string that don't appear to be referenced. Some may be junk, but a lot of them probably do get referenced, only the decompiler doesn't know it. That would be one example of why intelligent decompilers (like IDA) that actually follow the code execution are preferable to static (deadlisting) decompilers like W32DASM.

Anyway, to answer the question you actually asked, your string probably isn't in the resource tables. You'll need a hex editor to find it. If you know the RVA of the string from W32DASM, you can convert that to the file offset so you know where to look. Or, you could just search for the string directly in the hex editor. It should be in plain sight, if you can see it with W32DASM.
WaxfordSqueers
12-06-2004, 05:31 PM
I have a DLL file that contains a string I need to change. Now when I load the DLL in W32DASM and open string references I can see the string, when I load it into something like ResHacker to change the string - the string isnt there.
I am guessing that this could mean the string is being pulled from a different file or is not part of the string table - how do I change this string, can anyone help me pls?

Thanks

There are search apps like 'grep', that are written to allow a search through files themselves. I couldn't tell you off-hand where you could find grep, but I think it's a Unix utility that can be used in Windows. You point it to a directory, or even the entire drive, and let it go.

Strings are often entered in Unicode. Each 8-bit byte is padded out to 16 bits. In a dead listing, byte will appear as 'b.y.t.e' . The period (.) doesn't mean it's a period, it's just that the hex editor can't reproduce that character. So, a text search wont find it unless the search engine is made aware of the unicode structure. Study unicode and look at how it is listed in a hex dump.

Alternately, you could follow up on your own point that the string is in another file. Don't assume anything, it may even be in a help file, or not even in the local directory. Hopefully it's not in a system file. Run other exe's, dll's and just about any executable through reshacker and see if you can spot it. It may not even be listed as a string. It may be part of a template. Look very carefully through every section of reshacker. To cut down your search, you can pretty well eliminate icons, etc.

The free tools from sysinternals are invaluable here. You can watch which files are being accessed, and that narrows down your search. That's partly what it's all about, learning how to make short cuts.

If you read +Orks tutorials, he urges you to think like the programmer. If you can't find the string as a unit, ask yourself why. Maybe the programmer doesn't want you to find it. So, how would you load a string so it couldn't be found by a dead listing? You'd load it one byte at a time and put pieces of it all over the place. To make it even tougher, you'd XOR them with a key byte and have them totally hidden.

Have you tried running the app through Boundschecker (or Smartcheck for VB apps). If you learn how to use these tools, you can pinpoint the string and see exactly where it's being loaded from, and how. Look up string functions in an API reference and see how each function manipulates strings. Then look for these string functions in Boundschecker. To save you scouring the entire app, learn how to use Boundschecker to zero in on where the string might be.

Using Sice, you can break near the string itself, and see where the string fuction is getting it from. In that case, all you do is run the app to the point where the string is being loaded and note where the bytes are being loaded from.

I would consider Tbone's advice to use IDA. WDASM is easier to use, but it doesn't have near the power of IDA. If you can't find something easily using WDASM, go to IDA.
bilbo
12-07-2004, 01:32 AM
Strings are often entered in Unicode.
you can use "strings": grab it at - guess where? - http://www.sysinternals.com/ntw2k/source/misc.shtml#strings

Regards, bilbo
WaxfordSqueers
12-07-2004, 02:10 AM
thanks for the tip bilbo. I'm chuckling here at your nym. I was working at an oil refinery a couple of years ago, in the fall, on a night shift. It was getting cold, well below zero, and the steam from the refinery pipes in one area made the environment pretty eerie.

We were all bundled up against the cold, looking like overstuffed toys, wearing balaclavas, and hardhat liners that had thick quilted lugs, like Snoopy's ears, wrapping down around our chins. On top of that, we were all wearing safety googles and fireproof coveralls. It looked like a kind of Hobbit atmosphere. So we started calling one of the guys who worked that area, Bilbo Baggins. You need a bit of off-hand humour to survive those jobs. :p
bilbo
12-07-2004, 11:17 AM
You make me curious, WaxfordSqueers...
What had that guy different from others? The height? The age? The feet? The smell?

Regards, bilbo
WaxfordSqueers
12-07-2004, 03:57 PM
no...he was actually a courageous guy. He was one of those types who did his job conscientously but who refused to kiss up to management. In fact, they fired him after an incident in which management had targeted the entire crew for an incident and threatened to fire all of them unless the perpetrator owned up. He stepped forward. It wasn't till after he got fired that we learned he didn't do it, he just took the fall for it. You don't find many selfless people like that.

We tagged him Bilbo Baggins out of respect and affection. I think he was the one who started calling his area, with the steam and everything, Hobbittville. Naturally, he got the name Bilbo Baggins. Some people command respect out of quietness and their actions. Even before he got fired, everybody respected him.


Exetools
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Exetools
PDA

View Full Version : Exetools

Silver
12-06-2004, 01:52 PM
Haven't been able to get to exetools forum for a few days now, I can resolve the FQDN but the connection just times out. Would have though a transient problem would be sorted by now - anyone else having trouble? JMI - anything wrong?
dELTA
12-06-2004, 02:59 PM
I just accessed it without any problems, both the main site and the forum. Maybe you've been put on China's official list of banned IPs, for your participation in the thread below? :D

http://www.woodmann.com/forum/showthread.php?t=6605
JMI
12-07-2004, 06:24 AM
Nothing wrong that is visible to me on my connection. Like dELTA, I have no problem connecting. Did you try dumping your cookies and then try to reconnect?

Regards,
Silver
12-07-2004, 07:24 AM
Maybe you've been put on China's official list of banned IPs

:P

JMI, yes, same thing happens from a different net connection, different machine, different browser. It's not a cookie thing, it's an actual response timeout (ie: trying telnet forum 80 doesn't connect and let me GET). DNS resolution wokrs fine. Perhaps a UK routing issue, seeing as it's affecting 2 different peers...
bedrock
12-07-2004, 07:42 AM
Perhaps a UK routing issue, seeing as it's affecting 2 different peers...

Exetools seems to be working fine for me in the UK, So Pipex/UUNET routing seems to be okay.

--
bedrock
Silver
12-08-2004, 11:29 AM
It's working again now. Someone must have clicked the wrong switch. Never mind, thanks for the replies.


Why you crack program?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Why you crack program?
PDA

View Full Version : Why you crack program?

Hero
12-06-2004, 10:51 PM
Hi all
I post This poll,Because of an Important answer to a question:
Why we crack a program? :thinking:
Perhaps it is no matter to you,But I want to now why I should try
cracks a program? :confused:
Be honest,And say a real answer.
sincerely yours

NOTE: this is not only a poll,You can say your suggestions too.
evlncrn8
12-07-2004, 12:03 PM
you need an 'all of the above' choice too
JMI
12-07-2004, 12:32 PM
You have to be several bottles short of a six-pack to need someone else to tell you why you should try to crack programs. If you don't know why you should try, you have asked the wrong question. You should as well have asked "why am I here at all and why am I posting this silly poll?" :eek: The reasons "other people" do it are not good reasons for you to do it. Instead, you should search your own mind and determine whether and why it is of interest to you.

Regards,
0xf001
12-07-2004, 01:13 PM
because we are addicted to crack :) !

hahaha, sorry you were asking for such an answer
PederLustzo
12-07-2004, 01:16 PM
Also I think the option "because I bought it and think I have the right to do that" (anti-closed-source( is missing. oh and btw: Hi everyone I am new here :-)
Js
12-07-2004, 01:29 PM
do my eyes deceive me or have 16.67% selected "I don't want to asnswer" :confused:
sigint33
12-07-2004, 05:16 PM
It's missing the catagory - just for the challenge and fun of it in addition to learning.

SiGiNT
Lord8Bit
12-08-2004, 11:32 AM
Why do you climb the mountain ?
What makes man fly to the moon ?

Because its there .. Because you can !

And its fun too :-)

Best regards
LordByte


Torrent Spoof?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Torrent Spoof?
PDA

View Full Version : Torrent Spoof?

Xero7
12-06-2004, 11:41 PM
Is there some kind of torrent ratio spoofing/faking prog or a way to spoof it?
Juca
12-07-2004, 02:15 AM
Yes, it is called upload... :D


Keyboard repeating in softice
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Keyboard repeating in softice
PDA

View Full Version : Keyboard repeating in softice

shmore
12-07-2004, 01:13 AM
im using ds 3.1 and a logitech elite keyboard. After getting everything running i have a anoying problem. when i use F10 or the p command the keyboard keeps sending blank lines to softice if i hit another button it will stop until i use F10 again, this is making it hard to step through programs since if im not on the ball i can go a couple steps at a time before catching it and you all know how quick we are at 3 in the morning. any ideas? i would like to use this keyboard if possible :confused:
JMI
12-07-2004, 06:20 AM
First - Have you tried doing a search here or on the net using terms such as "softice + keyboard + repeating" (without the quotes)? You have read, have you not, the FAQ where it says you are supposed to search and also explain what you have done to try to solve your own problem? This contemplates that you actually try something other than just asking a question here. Have you considered reading some of the information posted on the company website? Had you even thought of that?

Regards,
Kayaker
12-07-2004, 01:24 PM
Hi

This sounds more like a "sticky key" problem, except you say it happens with both F10 and p/P?
Have you tried remapping the function to another key? No problems with F8?

You might check your keyboard with some type of keylogger/monitor just to make sure it's not putting out multiple messages for each keypress. If you're using the included Logitech software, try disabling it and let Windows use its own defaults.

Kayaker
shmore
12-07-2004, 01:36 PM
Jesus a litlle moody are we? :D just joking ya i have searched here and google for some kind of solution but with no luck and if i missed a post in here about it i am sorry, i have tried telling it not to patch the keyboard driver that didn't change anything, my keyboard is plugged into the usb port and i tried telling it not to patch usb keyboard then the keyboard didn't work. Ocassionaly i get a message in softice telling me my keyboard is sending useless information or somthing along that lines, im at work so i can't check for sure right now what it was. i will also search for my usb to ps2 adapter when i get home and will report back if that changes anything.
doug
12-07-2004, 02:33 PM
I noticed the same thing when I'm using a KVM switch to share my keyboard, mouse & monitor between two pcs. I'm also using a ps/2 to usb keyboard adapter. I'm quite sure that's your problem.

My main problem was:
When typing too fast, around 50% of the keys get read.
I've also seen the "keyboard is sending useless reports" message.

These adapters are not as 'intelligent' as we'd like them to be. :boo:
JMI
12-07-2004, 02:43 PM
Doug:

I believe he is reporting the condition with the opposite set-up. He said he is "going to search for my usb to ps2 adapter" which suggests he is currently running with usb and is going to try the converter, while you are reporting the :converter" caused similar problems for you.

Regards,


Remote debug & Visual SI
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Remote debug & Visual SI
PDA

View Full Version : Remote debug & Visual SI

PVA
12-07-2004, 05:14 AM
Hello guys,

environment:2xPC (w2ksp3 eng, ds3.1 - both)
process:
- configure target to allow all users w/o authentication by serial (COM1, 115200)
- install serial.* drivers on target (it had some troubles, but tests passed)
- reboot target - wait about 60 secs (while autoconnect timeout?) on boot
- test target configuration - ok
problem:
link creation error while connecting to COMx (1,2) from host VisualSI

All hardware (COMs, cable) works normally: standart windows direct cable connection network works.

Have you any ideas how can I solve this?
thx


Collision vulnerabilities in MD5 Checksums
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Collision vulnerabilities in MD5 Checksums
PDA

View Full Version : Collision vulnerabilities in MD5 Checksums

hosiminh
12-07-2004, 07:34 AM
Collision vulnerabilities in MD5 Checksums - It is possible to create different executables which have the same md5 hash. The attacks remain limited, for now. The attack allows blocks in the checksumm'd file to be swapped out for other blocks without changing the final hash. This is an excellent vector for malicious developers to get unsafe code past a group of auditors, perhaps to acquire a required third party signature. Alternatively, build tools themselves could be compromised to embed safe versions of dangerous payloads in each build.

hxxp://www.astalavista.com//data/md5_someday.pdf

hxxp://www.astalavista.com//data/stripwire1.1.tar.gz (in perl )
mike
12-07-2004, 04:49 PM
Except that everyone knows MD5 is hosed. No one should be using it to verify the authenticity of anything.
Silver
12-08-2004, 11:25 AM
hosiminh, MD5 collisions ("birthday attack") have been around for a very long time. The conceptual problem with them is that whilst you can find a "bad" string that produces a collision with the "good" string, actually making anything useful from the bad string is exceptionally difficult. SHA-1 is a better choice.
JMI
12-08-2004, 12:25 PM
Um, Silver- - - You actually have to belive in the message of Christmas, not the commercial hype which surrounds it, and if one does, no one could actually steal it from them. :yay:

And who'd want to steal that lump of coal you are going to get anyway? :devil:

Regards,
hosiminh
12-09-2004, 03:56 AM
Silver

Even SHA-1 can be solved . Look for example hxxp://www.xbox-linux.org/docs/friday13th.html .
Some more stuff : searching for "Crypto 2004+sha-1" (without quotes) will bring up interesting results (Eli Biham @t work).
Silver
12-09-2004, 10:15 AM
hosiminh, if I'm reading correctly SHA-1 hasn't been broken yet, but has been conceptually/theoretically shown to be vulnerable (ie: "matter of time").

JMI, that lump of coal keeps me warm. Hands off ;)
halvar
12-13-2004, 09:51 AM
Given all the FUD about MD5, I'd like to clear up a few facts:

1) The stripwire attacks are of limited use as they depend on the original
input vector for MD5 (as the published collisions use original input vector).
This implies that two files must have the collisions as first string in the
file, which makes the published collisions useless for backdooring w/o a
dedicated external file loader (which will raise all alarms).
The assertion made in the paper that collisions with different IV's can be
generated rings true, so in general it would be possible to create two
executables with identical MD5sum bit different behaviour. The impact for
security is IMO miniscule, as both executables need to be identical except
for the colliding block -- so any (even cursory) analysis of either executable
will raise all alarms (a self-modifying executable by definition can't be
trusted, a non-self modifying executable will carry all "evil" code bits in it).

We also have to keep in mind that the difference between colliding blocks
cannot be at arbitrary places in the colliding block -- the collisions need
the changes to occur in such a manner that the differences within the MD5
calculation stay in the MSB as to limit the avalanche effect of addition mod
2^32.

2) MD5 for integrity checking is currently unproblematic. The degrees of
freedom you
have when generating an MD5 collision are severely limited, and second-
preimage attacks for MD5 aren't going to happen unless a major breakthrough
occurs. It is important to keep in mind that second preimage has _not_ been
solved even for the "simple" MD4. This doesn't mean you shouldn't replace
MD5, but no need for panicking. I challenge anyone to come up with a way
that given executable A he can create executable A' with the same MD5sum.
(the change doesn't have to leave the executable executable, but touching
executable A is not allowed) :-)

3) Trust in SHA-1 should not be placed significantly higher than in MD5.
In many places, the design of SHA-0 was extremely simplistic and did not
take into account lessons learnt from the MD4/MD5 attacks Dobbertin did.
SHA-0's message expansion is completely linear -- why ? The changes
between SHA-0 and SHA-1 are miniscule (a 1-bit rotation only), and some
promising attacks have been made either by linearisation of the addition in
SHA or by using OBDD-like structures for solving equation systems.
In general SHA-1 looks to have been designed with a small "security margin".

Something to always keep in mind: NSA can buy the worlds biggest
computers -- they thus have no interest in building a backdoored crypto algo,
but they do have an interest in limiting the complexity of an attack on a
crypto algo to less than 2^80 or so -- e.g. outside the reach of any
other government.

Cheers,
Halvar :-)
mike
12-14-2004, 04:38 PM
Given two semantically equivalent instructions, you can embed a bit of information: add x,y means 0, sub -x,y means 1. Given 160 bits of channel in two exes, one good, one bad, you can use van Oorschot's method (see birthday attack in wikipedia for a link) to produce a pair of exes semantically equivalent to the first but with the same hash. You can then submit the good one for signing.

Finding a preimage is far harder than finding a collision.


Unpacking help - possible armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking help - possible armadillo
PDA

View Full Version : Unpacking help - possible armadillo

ForbiddenCode
12-07-2004, 11:49 AM
I'm quite fluent with win32 coding but relatively new to reverse engineering, so please bear with me.

I'm interested in studying the workings of a particular EXE which I have. I'm not particularly bothered about being able to alter it - however it would be nice for me to be able to step through it, analyze it's behaviour, possibly extract some resources, etc. I basically want to gather enough information to allow me to write a similar program myself.

In the past I've used IDA for this kinda thing, and I love it. The problem is with this particular file I get complete garbage - the short snippets IDA identifies as code don't make much sense, and the parts it identifies as data seem to be encoded as they contain no readable or meaningful strings.

After checking the file with PEID v0.92, it's identified as packed with "Armadillo 3.78 -> Silicon Realms Toolworks". Is this information reliable? Several posts on here seem to indicate there are often discrepancies between what different PE analyzers find and reality.

Assuming the file IS packed with Admadillo 3.78, what are my options? I've read in numerous posts that it's one of the most difficult packers to get around, and there are no tutorials for the newer versions (post v3.6x). Defeating the protection myself is beyond my skills. Should I give up now, or is there someone who can give some good advice or help me in any way?
%UNDEFINED%
12-07-2004, 07:41 PM
Well first of all, using the exisiting materials have you been able to determine if it uses the COPYMEM protection?

Have you attempted to unpack the file at all?
You will need to post what all you have done.

No one will unpack it for you, I don't have a problem walking you through it, but based on my experience even with the newer (3.6->3.75...3.78?) armadillo the exisiting materials give a great starting point.

You must first understand the basics of unpacking:

finding Original Entry Points (OEP) versus the files Entry Point (EP).
An general understanding of :
Bypassing Anti-Debug routines
Structured Exception Handling (SEH)
Application Programming Interface (API) redirection
Import Table (IAT) rebuilding and repairing
Dumping of the file out of memory
Rebuilding of the PECOFF
Nanomites (Armadillo Specific)
Code Splicing (Armadillo Specific)

Any other questions?

Peace
ForbiddenCode
12-08-2004, 07:47 AM
You must first understand the basics of unpacking:

finding Original Entry Points (OEP) versus the files Entry Point (EP).
An general understanding of :
Bypassing Anti-Debug routines
Structured Exception Handling (SEH)
Application Programming Interface (API) redirection
Import Table (IAT) rebuilding and repairing
Dumping of the file out of memory
Rebuilding of the PECOFF
Nanomites (Armadillo Specific)
Code Splicing (Armadillo Specific)

Okeys, from your post I gather that unpacking armadillo is not something which can be done by someone with little experience of reverse engineering without possibly spending days on it :(

What I am trying to do is write an open-source smartphone flash patching utility. In order to do this, I need to learn more about the protocol used for communicating with the bootloader (specifically the algorithm used to calculate checksums). From the limited research I've done into armadillo, it looks like bypassing the protection alone would take me more time than all the other things I was planning to do.

Thanks for the help anyways, but it looks like I'm venturing a little out of my league...
JMI
12-08-2004, 12:03 PM
And you identified as good part of your real problem with the phrase: "From the limited research I've done." One should always "start" with the basic research and "then" ask questions. It is not only what is required by our rules, outlined in the FAQ, it is the only way to acquire sufficient background knowledge to even know how to try to ask the right questions to get the answers you are really seeking. :idea:

Regards,
crusher
04-05-2005, 08:23 AM
contact me with your target in !PRIVATE!
I may be able to help you ;)

if no problem, I am also interested on what you would like to patch in firmware...


Another reason to crack.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Another reason to crack.
PDA

View Full Version : Another reason to crack.

WaxfordSqueers
12-07-2004, 05:05 PM
I found the vote question interesting, but found none of the responses spoke for me. I do crossword puzzles as well, the hardest I can find, like the New York Times weekend puzzles. I stopped reading newspapers, and I buy a paper on the weekend just to get the NYTimes puzzles. I would regard that as a hobby and a means of exercising my brain. That's much the same way I regard reversing. Like Mallory said when asked why he wanted to climb Everest..."because it's there".

That's much the way I look at reversing. Let's face it, with a little bit of patience and judicious search skills, anyone can find many programs already cracked, somewhere on the net. If not, there are countless serials, keygens and patches for most programs. I personally don't have the motivation to reverse just for the sake of learning. If I wanted to do that, I'd get serious and study computer programming and become a systems analyst.

There's a little bit of anarchy in it too. One definition of anarchy is an absence of order. Whereas I don't advocate wholesale disobedience of the law, for our mutual good and respect of others, I don't prescribe to what the software manufacturers are doing. If I'm right, the internet was first set up by the military, then became a public domain educational enterprise. It was a creation of the human spirit and a testament to the human ability to share. Then along came the businesses, like they usually do, and try to claim it as their own private domain.

The internet is not for private enterprise alone, it's for everybody (even Bill Gates), much like a public park. Private enterprise has already taken it's pound of flesh by charging us to get on a system that rightfully belongs to the public. One could argue that it was the universities to whom it rightfully belongs, but it's usually the public who pay for them. And it's the public who support the military. So, the internet was created with taxpayer's money.

I say to software companies, "if you want to use 'my' internet, then behave yourselves". The software companies have offered trials on the net to lure people into buying their products. I prescribe to the theory that we should support the development of these products by buying the products. But some of these companies are so damned greedy and arrogant that it becomes repugnant to support them. They gleefully come out with contrived protection schemes, and you can just sense the attitude of "shove it up yours, John Q. Public". When someone reverses their products, they run to the courts screaming, "foul!!". I have to admit to a certain contentment in showing myself I can reverse these kinds of protections. It's a childish pleasure, but fun all the same. It's a challenge.

I'm opposed to someone stealing a software product and selling it for profit. And I'm not sure how I feel about reversing a product and releasing it onto the net. I don't do it myself, although I'm being hypocritical, if you get my drift. There's something a little Robin Hoodish about it. I feel for legitimate software companies who are simply trying to make a living, but I tend to smirk at the larger corporations who are socking it to the consumer through inflated prices and poor customer support.

I'd like to know how others feel about it. Am I alone in my thinking?
disavowed
12-08-2004, 10:47 PM
Then along came the businesses, like they usually do, and try to claim it as their own private domain.If it wasn't for the businesses that came along, two things wouldn't have happened:
1. If the telecom businesses hadn't come along, the internet would have died, since .edu's wouldn't have been able to supply the infrastructure for the entire internet as we know it today.
2. If "computer businesses" (used in the broadest sense) hadn't come along to promote the internet, its popularity never would have grown to its current state, and I doubt we would have entered into the "information age".

Private enterprise has already taken it's pound of flesh by charging us to get on a system that rightfully belongs to the public.The public doesn't own the infrastructure. Businesses do. Therefore it's not fair to say that the internet belongs to us.

So, the internet was created with taxpayer's money.ARPANET was created with taxpayers' money. "Today's internet" wasn't.

I say to software companies, "if you want to use 'my' internet, then behave yourselves".So you're against free speech?

They gleefully come out with contrived protection schemes, and you can just sense the attitude of "shove it up yours, John Q. Public". Actually, most software companies use protection schemes to stop casual copying, not to stop determined reversers.

When someone reverses their products, they run to the courts screaming, "foul!!".Actually, this is not true. Perhaps you're thinking of the FBI going after piracy groups, or certain reversers (like Dmitry), or the RIAA going to court with DVD Jon. But software companies don't bring reversers to court. (However, they may have their lawyers send letters to the reversers, which I think they have the right to do)
WaxfordSqueers
12-08-2004, 11:49 PM
1. If the telecom businesses hadn't come along, the internet would have died, since .edu's wouldn't have been able to supply the infrastructure for the entire internet as we know it today.

the telecom business was there long before the internet became commericalized. Telephone PABX's were hot all through the 80's, long before CAT 5 appeared. Besides, most of the business generated for telecom companies comes from in-house structured wiring systems. They wouldn't have done dick all if the demand hadn't been there.

Anyway I'm not talking about edu's. The actual www was created by CERN, a university conglomerate. They also created the HTTP language and laid out the foundation for the web as we know it today.

2. If "computer businesses" (used in the broadest sense) hadn't come along to promote the internet, its popularity never would have grown to its current state, and I doubt we would have entered into the "information age".

you've got the cart before the horse partner. All business is fuelled by consumers. If the consumers didn't take to the internet, it wouldn't have grown.

The public doesn't own the infrastructure. Businesses do. Therefore it's not fair to say that the internet belongs to us.

you missed my point. 'Initially' the internet structure was in place. Businesses don't own dick, other than their own routers, etc. They are granted nodes. Last time I looked, the web was still run by CERN. I'm not sure on their status today, or how the web is run. But businesses still apply to a non-profit body for nodes and IP addresses, as I understand it.

This is yet another example of public funded universities doing research and having private enterprise be the beneficiary. Why didn't they do it on their own? I know some businesses fund universities, but where I'm from John Q. Public pays the lion's share. Right or wrong, I still think of it as our web.

Actually, most software companies use protection schemes to stop casual copying, not to stop determined reversers.

I'm talking about the ones who were bragging about their protections being crack-proof. That's a taunt, and it goes back years. They used to talk about reversers as if they were snotty-nosed kids with adolescence problems. I remember one company putting out what they called an irreversible algorhythm. It wasn't long before the Marquis de Soiree wrote an algorhythm to reverse their irresversible one.

Actually, this is not true. Perhaps you're thinking of the FBI going after piracy groups, or certain reversers (like Dmitry), or the RIAA going to court with DVD Jon. But software companies don't bring reversers to court. (However, they may have their lawyers send letters to the reversers, which I think they have the right to do)

you missed my point again. It's not that they are prosecuting reversers, it's the whining. I agree they have the right to prosecute. It's looking down their noses at reversers and laughing, then crying when the reverser beats them. They start the game, then they cry when they lose.

I'm thinking of the concerted efforts of music software companies to go after the likes of Radium in the music software cracking field. They've changed their tack now. They are cozying up to would be users of cracked music products with the lament, "Hey guys, give us a break, we've got to make a living". Radium made a point of not reversing anything under a certain value to give the smaller companies a break. And they were the first, if not one of the first urging people to try, then buy.

There was a company hired in the UK just to monitor music piracy. And they were prosecuting. Nowadays we have that dumbass act aimed at mp3's,etc., that even music producers are pissed off about. It's like McCarthyism all over again, and it was brought on by private business lobbyists.

There was a good article on ProAudio, I think it was, about a guy who bought a copy-protected music app, and it messed up his system. He was pissed off because he knew other people who owned the product but who were d/ling cracked apps with the wrapper removed so it wouldn't screw their systems.
disavowed
12-09-2004, 12:42 AM
the telecom business [...] wouldn't have done dick all if the demand hadn't been there.right. i don't see where we disagree on this point ;)

The actual www was created by CERNyes, but in your original post you were talking about the internet, not the www :)

you've got the cart before the horse partner. All business is fuelled by consumers. If the consumers didn't take to the internet, it wouldn't have grown.i agree. both are required for the system to work

Last time I looked, the web was still run by CERN. I'm not sure on their status todayread the book Angels & Demons :p

But businesses still apply to a non-profit body for nodes and IP addresses, as I understand it.most businesses apply to for-profit bodies for ip addresses

This is yet another example of public funded universities doing research and having private enterprise be the beneficiary. Why didn't they do it on their own?why bother? it had already been done.

Right or wrong, I still think of it as our web.well it's a matter of opinion. all i'll say is that the internet wouldn't have expanded to its current state if private businesses hadn't ponied up the infrastructure

I'm talking about the ones who were bragging about their protections being crack-proof.in that case, disregard my response ;)

you missed my point again. It's not that they are prosecuting reversers, it's the whining.i haven't seen any anti-reversing software companies whining about having their protections being defeated. could you provide some examples?


OllyDebug bpx question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > OllyDebug bpx question
PDA

View Full Version : OllyDebug bpx question

ReVeR
12-07-2004, 08:08 PM
Hey.
i got the following set up.
i got an app (.exe in windows xp), that loades a .dll file (i knwo what it is and where it is etc...), i was wondeirng after i run the program in ollydebug, where can i set break points onto the dll imported function? i want to set a break point onto a function that dll uses, however dll is loaded by .exe, and the result of the call goes to the .exe...so i was wondeirng how cna i set that breakpoint in dll while running it from the .exe file...
thx
blabberer
12-08-2004, 10:57 AM
case 1 dll is loaded dynamically using loadlib etc
debugging options,events,break on dll load when the dll is loaded olly will break
view executable modules,follow entry to that dll and analyse the dll and then view names set bp on whatever function you knowwill be called or setbrekpoints on exported functions by dll

case2 the dll is already loaded when ollystops in ep
view executable modules follow ep analyse set breaks
(the case one will also work but it annaoying as itbreak on all dlls)

you can also try searching for names on all modules and find referances to the call and set bp on referances

and last but not least youcan load the dll alone in ollydbg and set the stackframe with args passed and call the function yourself from loaddll

have fun
ReVeR
12-08-2004, 03:03 PM
ok..i think i got a slight problem, i don';t think the dll that i though was used to determine whether the stupid nag would pop or not , is the one that actualkly does it. I never saw it being loaded into the memory in ollydegbug. Now i was wondering ...8is there a way to motior if a file is being accessed, and by what and from where?
thx
TQN
12-08-2004, 08:30 PM
Use FileMon of SysInternals (www.sysinternals.com)
yalcm
04-02-2005, 09:32 AM
We all know in sice we can use "reg eip=SomeAddress" to change the next program execution flow. But how can we accompany this in ollydbg ? I had tried a lot in olly's cmdbar interactively, but got no luck. Anywho can have a answer of that ? Don't blame me about this simple question, I know it might be stupid also. But I'm much appreciated if you can help me out off this puzzle.

Thanks.
JMI
04-02-2005, 12:47 PM
yalcm:

You posted essentially this same question in the Ollydbg Forum yesterday and a response was posted there for you a 9:34 this morning.

How about you follow-up there, where you started? :yay:

Regards,
yalcm
04-02-2005, 01:38 PM
Catched it & Thank you very much.


create slockpk cert without priv. key?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > create slockpk cert without priv. key?
PDA

View Full Version : create slockpk cert without priv. key?

_Servil_
12-08-2004, 03:47 AM
hallo there,

is any chance to create slockpk 2.02 certificates with having only the public key? is 512-bit long, does it mean the private key is the same length?
and is it able to use license generator in custom code without having delphi installed? (i mean the cert generator engine available as c library in some of common formats )

thanks


quick question about __allrem function
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > quick question about __allrem function
PDA

View Full Version : quick question about __allrem function

dive2code
12-08-2004, 06:58 AM
I have a quick question about __all??? (__alldiv, _allmul, __allrem) function.
I googled and got only that these funtions are related with int64 converstion.
But I couldn't find any stuff explaing that.
Plz let me know the the definition, meaning or reference.

This code is what I met.

push 0
push 1Ah
push FFFFFFFF
push 80000011h
call __allrem

After the call, debuger showed changed register values,
such as EAX=FFFFFFF9, ECX=1A, EDX=FFFFFFFF, EBX=0

Thank you
Neitsa
12-08-2004, 02:15 PM
Hello,
I've disasembled those functions from ntdll. Here's what I guess they do :

//******************
//*_alldiv.NTDLL
//******************
LONGLONG WINAPI _alldiv( LONGLONG a, LONGLONG b )
{
return a / b;
}

//******************
//*_allmul.NTDLL
//******************
LONGLONG WINAPI _allmul( LONGLONG a, LONGLONG b )
{
return a * b;
}

//******************
//*_allrem.NTDLL
//******************
LONGLONG WINAPI _allrem( LONGLONG a, LONGLONG b )
{
return a % b;
}

//******************
// * _aulldiv.NTDLL
// ******************
ULONGLONG WINAPI _aulldiv( ULONGLONG a, ULONGLONG b )
{
return a / b;
}

//*******************
// *_aullrem.NTDLL
// ******************
ULONGLONG WINAPI _aullrem( ULONGLONG a, ULONGLONG b )
{
return a % b;
}

Hope it could help...

Regards, Neitsa.
TQN
12-08-2004, 08:26 PM
Hi dive2code !
If you have Visual Studio 6 or VS .NET, go to the CRT\Src\Intel directory, and you will see the llmul.asm, lldiv.asm, llrem.asm... They are source code of _alldiv, _allmul, _allrem functions.
Regards,
TQN
dive2code
12-08-2004, 10:48 PM
Thanx so much Neitsa, TQN :yay:


ICE License
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > ICE License
PDA

View Full Version : ICE License

gryzon
12-08-2004, 07:37 AM
Is there a way to reversing ICE License? Thanks in advance.
naides
12-08-2004, 12:41 PM
Yes


A little help in understanding some crypto
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > A little help in understanding some crypto
PDA

View Full Version : A little help in understanding some crypto

nikolatesla20
12-08-2004, 03:21 PM
I was wondering if someone here (maybe Mike?) could help me with this.

Mind you, I'm not looking for the answer, or a cheat, or anything. It's just the happy folks over at hxxp://www.hackthissite.org seem to enjoy keeping everyone in the dark about crypto. I've been working on their "encryption challenges". I'm still a newb at crypto in a lot of ways tho, so I haven't gotten any of them done!

They had 3 challenges in place one was considered difficulty "insane", one "moderate", and the last "hard". Since I didn't know squat yet, I and some other users made some requests for for an easier challenge.

Yesterday challenge number 4 was posted, and it's supposed to be "easy". I've been working at it for a while but my brain is fried soon.

Look, you guys know me fairly well on this board. You know I'm not looking for a direct answer, but they don't have ANY tutorials on encryption on the site, so how am I ever supposed to learn how to start and things to look for other than groping in the dark for a millinea. I've posted on their forum about a possible tutorial for challenges that are already complete and won, but no one has answered me yet. It's getting very frustrating.

Anyway, they gave this short text for encryption challenge 4:

HTWMAA

And that's it. Now, I think this could be anything. I mean, it could be the word "ACROSS", or who knows. I just don't agree that this is "easy" since there's not enough ciphertext to really know what is going on.

In fact, if I run this thru a Crypto cracker for substition algos, I get a number of options:

1 RECALL
2 BYPASS
3 DRAGEE
4 PAYOFF
5 THRILL
6 ACROSS
7 BURGOO
8 CUTOFF
9 MORASS
10 SQUALL

Who knows which one, or if it's any? There's not context to the message..

I send the answer "ACROSS" to the encryption author but he replied that it was not correct.

So far I've tried bruting Ceaser shift, bruting Affine cipher, and also trying XORs with each character position. Perhaps it's a combination of these, so I'm still working on my bruter to try that.

Basically, what would be some other ways to cryptoanalyze this? Anyone have any more suggestions to try ? There's not enough text to do frequency analysis, and also doesn't seem enough for a Vinegire cipher, so it's got to be some math ops going on or something. But right now it's considered "easy" and I thought I've tried most of the easy approaches now..

Thanks guys.

-nt20
dELTA
12-08-2004, 06:42 PM
Since the cipher text is so extremely limited, my only guess would be that they have used a simple crypto, e.g. some of the ones you mention, and then left a visible clue in the correct key. So I would try to brute the shortest key combinations of all the most simple ciphers, and look for interesting patterns/clues in the keys (or at least the ones that generate a plain text that gets a hit in a good dictionary if the number of keys to analyze needs to be reduced).
bilbo
12-09-2004, 02:18 AM
nikola,

if I were you I wouldn't waste my time in such a silly thing, where hundreds of solutions are all equally correct...

Regards, bilbo

P.S. I appreciate the answer of dELTA, but I am afraid it is too intelligent for a "quite simple" challenge
nikolatesla20
12-09-2004, 03:37 AM
Thanks Delta, that's a good idea, I'll try bruting for a nice looking key

-nt20
dELTA
12-09-2004, 09:09 AM
I appreciate the answer of dELTA, but I am afraid it is too intelligent I hate when that happens. :D :p
JMI
12-09-2004, 10:59 AM
And such a rare occurance also. :devil:

Regards,
jsteed
12-10-2004, 09:07 AM
Maybe it's a transposition code rather than a substitution one.

cheers, jsteed
naides
12-11-2004, 11:07 AM
HTWMAA

-nt20

Hi Nikola, A challenge is a challenge, I think you are like me, not being able to solve a puzzle just makes me try again and again in the most obsessive way..

some observations:

The only thing with Structure is the AA at the end, which assuming this is a simple substitution cypher narrows the meaning of the cyphertext AA to letters that apear in pairs in the english language: EE, FF, OO, LL, SS, TT and so on. you can test the hypothesis by guessing the algorithm that converts AA into SS for instance, and see if the other characters in the cyphertext turn into something that makes sense, when you apply the same algorithm to them

just an idea. . .
nikolatesla20
12-11-2004, 02:22 PM
Yes, I've been trying that..

I thought maybe transposition, like maybe "AW MATH" but the author replied that is incorrect.

So yes I thought of double letters, like LL, EE, etc. However if this is any type of stream XOR cipher that won't hold true, since the letters will be masked..

The author has now changed the difficulty to "moderate". See, I told him it's not "easy".

-nt20
mike
12-16-2004, 06:51 PM
Did they change it? HTMEQA is on the site now; this seems to have only one "cryptogram" style decryption: ISRAEL.
mike
12-16-2004, 07:01 PM
Also, it might be an acronym: "hack this message encrypted quality assurance" or something.
nikolatesla20
12-17-2004, 11:15 AM
Yeah mike they changed it, he said he screwed up.

As a small make up for messing up the ciphertext, the author now gave a hint that the real text (the decrypted text) is also only five characters.

So for now I was trying to imagine the text fitting in between the six characters somehow - you know, because a six-letter word has five spaces in between.

so,

H T M E Q A

is

72 84 77 69 81 65

So if the five letter word was in there:

72 X 84 X 77 X 69 X 81 X 65

Where the X's are the letters of the word. Maybe the numbers on either side are chosen by some method ...

I bruted every combo that could come between each sub-combo (like between 72-84 and 84-77, etc , for all five chars) and needless to say I still get quite a list...

Or of course one of the characters could just be null padding!

Man, so far I've tried bruting (by brute I mean I use a large dictionary, and for all 5 - 6 letter words I encrypt and then look for ciphertext of "htmeqa" or such to show I have the algo):

each char * charposition mod 26...
each char ^ charposition mod 26...
ciphertext XOR'd against 5-6 char words as the key, looking for decrypted text...yes I did get quite a few real words too !

get this, yesterday, I decided to try XOR'ing the ciphertext with every 5 or 6 letter word from a dictionary file. The script that did this would output to a new file in the format of <xor'd text> : <dictionary word (key)>

Then I have another script that loads this output file and looks to see if any of the xor'd text is a real work in the dictionary, and then collects all those it finds, so I can compare real words and keys it used. I actually get quite a few matches doing that.

Yesterday though it was funny, because I got the following sequence in this order, at the end of my dictionary brute match output. I am not kidding !

This is the <xor'd with the ciphertext output> : <original dictionary word xor'd with>

DRUGS : keycc
DYING : klehw
GRAMS : nemic
HADES : otnac

LOL!!!!

I also got

AVERY : haiti

I was using the "elcomenglish.txt" dictionary, which is from elcomsoft, they use it to attach zips and stuff.

I'm sure I'm overthinking this. So far 2 people have gotten it though.

-nt20


GetDriveTypeA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > GetDriveTypeA
PDA

View Full Version : GetDriveTypeA

ReVeR
12-08-2004, 06:03 PM
Hey
i was wondering about teh return values of teh GetDriveTypeA.
i know that 5 is a cd rom drive. But what is the harddrive?
It was on the msdn, btu they changed it and now i am stuck
dELTA
12-08-2004, 06:48 PM
Yeah, sure, they changed msdn and removed some APIs just for fun... :rolleyes:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/getdrivetype.asp

Look up the constants in the SDK or possibly windows.inc (or write a friggin one line program and test it yourself :p ).
WaxfordSqueers
12-08-2004, 08:25 PM
...snip....(or write a friggin one line program and test it yourself :p ).

Now that's something I wouldn't have thought of. See...even in your sarcasm you're helpful :p

I've been using the Windows 95 Win32 Programming API Bible from the Waite Group. Do you know of any good books (not apps) that are more recent? Sometimes I prefer to hold a book in my hands and read it. Old habits
doug
12-08-2004, 09:55 PM
First: Get the platform SDK: msdn.microsoft.com/platformsdk/
Right now, there are 2 versions of it.. the XP SP2 (2004) & the server 2003 (february 2003). Make sure you install ALL documentation.

@rever: don't be lazy. That information is everywhere.
1. search the net
2. search the platform SDK include directory for the name, you'll get the constant.
3. Look in undocumented windows resources.
4. ask

@WaxfordSqueers:
Show the contents and print the overviews.
Then also navigate in the index for the "* functions" and the general topics (ex: About *")

The About <some topic> in the index is a very good introduction to a subject.

Don't forget to check the "See also" sections at the bottom.

example:

About Hooks

--------------------------------------------------------------------------------
Hooks tend to slow down the system because they increase the amount of processing the system must perform for each message. You should install a hook only when necessary, and remove it as soon as possible.
This section discusses the following:

Hook Chains
Hook Procedures
Hook Types
ReVeR
12-09-2004, 06:22 AM
excuse me for my stupidity....but which one of the return values in getdrivetypeA is the number for the hd. Because all i see are the string retunr values, while in the olly w/e etc.. they are numbers.....so am i suppoused to strart counting from 0 or 1 to get to the network drive?
Neitsa
12-09-2004, 07:22 AM
Hello,

As stated by Delta, just write a single line and take a look at the return !

Asm :

invoke GetDriveType,NULL

debug it, look at EAX and you'll have the value for FIXED_DRIVE (wich is harddrive).

If you don't know how to write even a single line of program, I suggest you to look at header files (C ; C++ ,etc.) or inc files in asm, you should be able to find a clue...

If you doesn't have headers nor include files, just try googling !

typing "getdrivetype hard disk" on google return, for the first match, the right answer !

Is it so hard that you haven't been able to do it ?
|azy|eg
12-09-2004, 01:08 PM
http://custom.programming-in.net/articles/art9-1.asp?f=GetDriveType

Const Unknown = 0
Const NoRootDrive = 1
Const Removable = 2
Const LocalDisk = 3
Const Network = 4
Const CD = 5
Const RAMDrive = 6


Hex
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hex
PDA

View Full Version : Hex

ReVeR
12-08-2004, 06:23 PM
Hey.
i got this think in olly, i got a registor, it got string data that is in hex, i want to mod the string data...i only forgot how the numbers are arranged , in what order for it to make up a string....something must be read from right to left or something like that....
Any ideas?
thx
dELTA
12-08-2004, 06:51 PM
OMFG, your questions are beginning to get just a little too "unresearched". :mad: Read the FAQ and proceed with caution...
ReVeR
12-09-2004, 06:24 AM
yeah...my questions have tendency to do that after a time..concept called entropy.....
a/w sry for stupid q
JMI
12-09-2004, 10:53 AM
And here I just thought it was called "lazy." :D

Regards,


Video recorder
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Video recorder
PDA

View Full Version : Video recorder

ReVeR
12-08-2004, 06:31 PM
Hey.
i need somethign that wil record my screen at 24 frames per second, (well, i mgiht be able to live wiht 12 ), and taht will not lag up my pc too much. The deal is that, wehn i am RCE in olly, it is bloddy enoing after spending like an hour in the code, and finally get it working that u forget what the hell u were suppoused to pach in the exe....
Any ideas for such a prog?
thx
Woodmann
12-08-2004, 06:42 PM
Howdy,

24 per second ?? I hope you have a huge hard drive and some big ram ;)

Search "screen capture".

Woodmann
disavowed
12-08-2004, 10:54 PM
i faced this challenge a few years ago. the best solution i found (in terms of frame rate + resolution) was to get a video card with s-video-out and record directly onto a dv-camcorder
ReVeR
12-09-2004, 06:23 AM
crap...time to go to radio shack adn get me a dam cable to connect my video card to my tv so i can record it onto tapes....
0xf001
12-09-2004, 08:38 AM
i also faced this problem of course, and am lazy, too. i tried to force myself remembering:
immediately after making any change: press "screenshot" key.

parallel having some evil msword/openoffice running or any app where i can quickly paste it into, and do not loose time.

so i have just the points in time which i need. because your next problem could probably be: ok i have 10hours video - ahm now how do i best find the important "scenes" :)

i do not always do it this way of course, at least it is simple, does not need much time, and gives you "all" the information you need

cheers, 0xf001
dELTA
12-09-2004, 09:24 AM
Just be careful with those tapes, if your girlfriend finds a hidden tape containing a four hours long screendump of a debugger screen in your closet, she might just wish you were a normal guy hiding some porn... :D
blabberer
12-09-2004, 11:00 AM
in olly haha it has a patch window and it remembers all patches even after you restart
also will warn you if the total number of patches (a patch is considered a block of continuous bytes no matter what size) exceeds 1000 :) you can selectively apply the patches by going to the patch window
0xf001
12-09-2004, 11:11 AM
patch window is right, but what if you are not saving all this - or patch with a hexeditor for some reasons (olly might crash because of your patches :) )? it is a good idea of course!
TBone
12-09-2004, 12:10 PM
Fraps might do the trick, if you're looking for a quick-and-dirty solution that won't necessarily require additional hardware. I've always heard that the pros do a two computer setup - one just to run the program that's being captured, and then a second with a video encoder card to capture the output. Otherwise it really kills your framerate (at least if you're capturing something like a FPS game).


HASP ENVELOPE AGAIN...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HASP ENVELOPE AGAIN...
PDA

View Full Version : HASP ENVELOPE AGAIN...

master
12-09-2004, 12:31 AM
I have a progi, with hasp envelope. Hardlock i don't have. I tried to find the OEP, but not succesfull, with some knowledge from a fiev tuts.

The exe is unpacked, and it call the install.dll which is packed (says olli). STUDPe says it's NEOLITE.

Question: Do i need to unpack it first before i can disable the call to dongle, or need no unpacking.

I am using OLLYDBG,

THNX
MASTER


Security Accounts Manager
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Security Accounts Manager
PDA

View Full Version : Security Accounts Manager

disavowed
12-09-2004, 02:00 AM
I just stumbled upon this site: http://www.beginningtoseethelight.org/ntsecurity/index.php

It's a very comprehensive reversing of Windows' SAM
Opcode
12-09-2004, 04:59 AM
Very impressive article!

Thanx for the link :yay:

Regards,
Opcode


Where to start
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Where to start
PDA

View Full Version : Where to start

|azy|eg
12-09-2004, 10:30 AM
Hey guys, found this forum when trying to get softice to work and also beeing able to hide it... well i know those things now, and got around 100-150 different tutorials ranging from way back to the 286/386 time to more recent tutorials. Now my new problem is ... where should i start? (lol totaly newbie). have noticed after having a few tries on new games that they are silly packed with protection, so have tried to stay with small programs for starter. if anyone could give me some pointers i would really appreaciate it.
blabberer
12-09-2004, 10:50 AM
have you looked into crackmes.de (may be hall of fame or yet unsolved catagory )
there are some nice little gems out there (if there is a solution dont read them try the
crackme by yourself and when you succeed try comparing solutions)
hope i did not misunderstand you and have replied with a probable answer
|azy|eg
12-09-2004, 11:03 AM
no actually i have been working on some crackme's, but i used the tutorial throughout the whole prosedure. I found my first tutorial 4 days ago, and had never heard of assembly before then, so you can say any pointers at all would be great. Many of the tutorials i have tell me i should focus on learning asm, whilest others say dont bother. tried looking into asm, and it looks like wingdings the first few seconds ;p
JMI
12-09-2004, 11:12 AM
You aren't really going to make much progress until you acquire some working knowledge of the meaning of the assembly language listings you will see in most debuggers. This is not a process you can start from the middle and work both ways. Do a search here for reference to "assembly language tutorial" (without the quotes) and you should find suggestions of some necessary reading. For example this thread:

http://66.98.132.48/forum/showthread.php?t=177

referencing "The Art of Assembly." Keep in mind you are not trying to actually learn how to program in assembly, at least not at this point, only to understand what you are seeing in the disassembler actually means in terms of what's happening with your program. Unless you understant that, you aren't going to really make much progress. You might "follow" a tut by rote, but you won't really understand what's happening. :idea:

Regards,
|azy|eg
12-09-2004, 11:17 AM
Thank you that clarifies my question. going to go back to the assembly tuts i got and have a look in the bible at the faq.

thanks for the fast response :yay:


Two different program with same package
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Two different program with same package
PDA

View Full Version : Two different program with same package

bestobest
12-10-2004, 03:48 PM
Hi I downloaded two different programs packed with aspack 2.12, Peid both got oep, dumped with olly dump, peditor, etc..revirgin. Everything went well.
Second program did the samething, but when went to revirgin, revirgin hang, ok I figured second program PEid gave me wrong oep, so I tried to used Ricardo Narvaja trick with the eception, but this program give you no eceptions, you press F9 and the program just run, how can I find oep another way.,. BTW I also used the plugin for aspack, gave me same oep as PEid..Thanks
MiniMind
12-11-2004, 05:44 AM
You can unpack ASPack very easy manually...

With Olly or something like that...

Search for a tut about it.

MiniMind


Domain & web hosting recommendation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Domain & web hosting recommendation
PDA

View Full Version : Domain & web hosting recommendation

crUsAdEr
12-11-2004, 04:09 AM
Hi folks,

I am looking for a new hosting service with PHP & MySQL and i was wondering if anyone knows of some good one...

I am hoping for reasonable fee & security... so it wont suffer the fate of some recent forums exploits... of course nothing is perfect.. just try to get the best deal out there :)

Thanks
dELTA
12-11-2004, 07:32 AM
What will be on your site? A forum? About what? Something else?
Silver
12-11-2004, 09:37 AM
Delta asks a good question. I know lots of good hosts, but if you're intending to host anything even remotely RCE related (ie: the vague potential for legal issues), they'll shut you down immediately...

BTW, I'm wondering if you're the same Crusader I knew a long time ago. Does "Crusader&Candyman" mean anything to you?
crUsAdEr
12-11-2004, 09:55 PM
nope... a forum but not RCE related... too many good forum out here for RCE already... why would i need 1 more :)...

just a forum for local friends to exchange IT knowledge in local language :) so i think legality will not be an issue...

Thanks...
hobgoblin
12-15-2004, 04:04 AM
hi there,
Will the local language you're talking about be one of the Scandinavian languages?
dELTA
12-15-2004, 05:02 AM
Vad skulle du i så fall föreslå? :)
bilbo
12-16-2004, 03:19 AM
Vad skulle du i så fall föreslå? :)
Mmmh... this sounds like a new crypto challenge to me... Haven't been able to find a single swedish translator on the net :confused:
ZaiRoN
12-16-2004, 04:51 AM
Hey bilbo, systran can ;)
bilbo
12-16-2004, 05:43 AM
thanks a lot, ZaiRoN, this is the second time you are confusing me...

please be patient, in these days I'm struggling with some new-generation armadillos and they are slowly eating my brain...

regards, bilbo
hobgoblin
12-16-2004, 05:51 AM
Norsk, selvfølgelig... :D
ZaiRoN
12-16-2004, 08:51 AM
No problem bilbo ;)
JMI
12-16-2004, 12:16 PM
There is also:

http://www.tranexp.com:2000/InterTran

which suggest that the translation is something like:

What would you in so case suggest?

Which I would read as "In such case, what would you suggest?" But dELTA's English is way better that any translator I've seen. :yay:

Regards,
disavowed
12-17-2004, 01:57 AM
But dELTA's English is way better that any translator I've seen. :yay:
speaking of which, whatever happened to "evabulator"? does he still post?
dELTA
12-17-2004, 06:18 AM
I think he has completely migrated to the Exetools forum for some reason. :-/


protection CD's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > protection CD's
PDA

View Full Version : protection CD's

NimDa2k3
12-12-2004, 09:03 AM
HI everybody,

I'm a normail programmer
I want to code a Lock for protection CDs
But I don't know anything about the structure of Cds and Cd ROMs
I need some Books,Ebooks,Essays about these things
I hope someone can help and direct me to the best atricles
Thanks in advance

Regards,
Nimda.
evlncrn8
12-12-2004, 12:57 PM
iso9660 format.. google, theres ur beginning, and a lock for protection cd's will generally also require some form of glass mastering, so unless you have shitloads of money u might as well give up trying to make your own
JMI
12-12-2004, 01:45 PM
Um evlncrn8:

Just how big is a "shitload" these days? When I was a youth and shoveling the real thing, we used to measure it by the wagon full. :eek:

Regards,
evlncrn8
12-12-2004, 05:46 PM
a convoy i guess then ;) course im not sure how big a wagon was when dinosaurs roamed the earth.. im still in my youth .. kinda ish ;)
Woodmann
12-12-2004, 06:53 PM
BWAHAHAHAHAHHAHAAAA.....

Hey J, remember Mel Brooks as the 10,000 year old man ??

Wood
JMI
12-13-2004, 08:34 PM
Hey Woody:

They don't make them like that any more. At least not very often.

Regards,
shadz
12-15-2004, 03:49 AM
May I suggest "CD Cracking uncovered" by Kris Kaspersky, from alist publishing, ISBN 1-931769-33-8

I find it extremely comprehensive :)


Targets with commercial protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Targets with commercial protection
PDA

View Full Version : Targets with commercial protection

quantumbarrier
12-12-2004, 03:50 PM
Disclaimer: I am NOT asking for links to warez ;)
I'd like to learn about commercial CD protections like Safedisc, Securom etc., but how could I get hold of a target without actually buying commercial games or apps? Or is there any way I could practice without such a target? Thanks in advance for replies, PMs are also very welcome ;)
evlncrn8
12-12-2004, 05:48 PM
download a patch update for a game protected with the protection you are interested in, hope you can extract the files without having to have the game installed.. u might get lucky..
shaddar
12-13-2004, 12:22 PM
Well, interesting topic.

I fail to crack these protections all of the time. :(

The old resources one can find about these protections are no longer valid. Well maybe one or two well known facts are still true (like whole protection in one .exe, etc.), but most (if not everything) has changed.

If anyone has any informations about current versions of safedisc or securom please share them here. :sneaky:

Sorry for thread-hijacking. :D
ReVeR
12-13-2004, 02:44 PM
what is safedisk, secureom used for anyways? stuff to verify if a valid cd is in? baislcly the crack is a no cd crack?
shaddar
12-13-2004, 03:30 PM
Right. But it's not like

GetDriveTypeA
cmp eax,5

you know :D
ReVeR
12-13-2004, 05:46 PM
really? the last ones i checked...were 1999 and i had no trouble doing some of those types of protection.....
will get some new info on these new ones...gotta get me up to speed...and outta the last centuary.
R3v3nG3
12-14-2004, 03:27 AM
Hi,
If you are looking for targets, Safecast can be found in Bo0nty games, distributed by Yaho0 (for example: Clued0).
Bye,
R3v3nG3
JMI
12-14-2004, 03:36 AM
R3v3nG3:

How about you quite trying to appear "L33t0" with the stupid spellings. It really has the opposite effect. :thinking:
Or didn't you realize that? :idea:

Regards,
R3v3nG3
12-14-2004, 05:44 AM
JMI:
eh... what... eh... uh...
S0rry, t0o stup1d t0 real1z3 th4t...

PS: It was only to avoid appearing in search like: Yaho*, Clued* and Bo*nty, Safecast instead is spelled correctly.

Bye
JMI
12-14-2004, 12:45 PM
Gosh:

And who did you think you would be fooling? :eek:

Regards,
Woodmann
12-14-2004, 05:10 PM
I like his answer. ;)

Woodmann
sarge
12-15-2004, 11:14 AM
Yeh, and if we only knew what "L33t0" was, like maybe

"Lost, 33 to 0"
or
"Lakers 33, towners 0"
or
(well, you get the idea)

ForTUnatELy, I haVE a SpeLL CHeckER ThAT HandlES All thaT fOR Me.

SaRgE
JMI
12-15-2004, 11:34 AM
Well why don't we all just go back to "Kenny Speak" and be sooo cool our fingers will freeze and fall off our hands. :devil:

Regards,
sigint33
12-15-2004, 12:11 PM
I guess I'll never post her again, oh the SHaMe!!!

as alWaYs,

SiGiNT
TBone
12-15-2004, 02:47 PM
Fmpmfpmmmfmp fppppffmfpmfmpm mmpmpp pffmmmmpm!
Woodmann
12-15-2004, 03:39 PM
Relax Francis,

Take a few jabs and get over it ;)

Woodmann
ReVeR
12-19-2004, 11:14 AM
are there any ways to analyze a cd or an installed prog for what type of protection tehre is?
i tried something liek safedisk analyzer but that is only for safedisks....
and only for old versions....
are there any other ones that can tell me what the protection is?
dELTA
12-19-2004, 11:29 AM
Yeah, the best one is called "google"...

http://www.google.com/search?q=analyze+cd+protection+tool

(and yes, using the "I'm feeling lucky" button will get you more than enough tools too...)
JMI
12-19-2004, 11:33 AM
And notice the use of multiple words as the search criteria. This is an extremely useful technique that may be used to attempt to focus a search down closer to the specifics of what you really, really want to find.

Regards,
quantumbarrier
12-26-2004, 03:07 AM
For those who are looking for a game with a particular protection: there are protection databases. This one is wonderful, you can search by protection (and even by version):
http://www.copybase.ch
My problem is solved so far ;-)
disavowed
12-27-2004, 12:20 AM
are there any ways to analyze a cd or an installed prog for what type of protection tehre is?
i remember Clony used to do a decent job at this. no idea if it's been updated in the past few years, though.


Resources
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Resources
PDA

View Full Version : Resources

ReVeR
12-13-2004, 06:54 AM
Hey.
i need to find where a certain resource is stored on the hd. I can find it in the program adn stuf..i need to find the file itlsef....
any ideas on how to do that?
thx
dELTA
12-13-2004, 07:21 AM
I think you really need to clarify that messy question...
ReVeR
12-13-2004, 02:42 PM
ok. i need to find where a resource is saved on hd. either it is in exe, dll, or a res file. this resource is used in a program. This resource is a dialob box. I can get handle to the window when this resource is used and stuff like that.
how do i pi point where the resource is on teh hd? is it in the .exe file, is it in one of the dll files, or in some totaly other file?
thx
dELTA
12-13-2004, 05:20 PM
Searching your harddisk for files containing strings related to the dialog box would most likely be a good start, hooking some resource related APIs during the execution of the process might be fun too, not to mention old trusty filemon...

And for the love of f*cking god, proof read your messages at least one half time before pressing the post button...
ReVeR
12-13-2004, 05:44 PM
sure, will profffff read my stuff before i post it....
and the searching the hdes for the files that have a dialog box related string....what program does that?
i got 2 of google, but with my hd(120 gbes), the estimate time left is 8 hours....so they are not too good...any programs that you know are good in this area?
btw, i can't scan specific fodler becuase i donno where all the files go...i know some of them but those are not it.
Woodmann
12-13-2004, 06:59 PM
Howdy,

Go to system internals and get some basic tools.
There is no way that we can tell you where your files are going on your hard drive.

Prickmann
ReVeR
12-13-2004, 07:38 PM
sry for misunderstaning, i was not asking that, i was jsut pointing out that i needed some other tools for searching because the ones i got are inefiencet to search my hd.
JMI
12-13-2004, 08:31 PM
YO:

Please pay attention to what Woodmann said. Go to:

http://www.sysinternals.com/

Read about the available tools and maybe you will get an idea ( :idea: ) that will help you. :thinking:

Regards,


How to implement
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > How to implement
PDA

View Full Version : How to implement

friedo
12-13-2004, 01:07 PM
Hello.

I have a function f(x)=y while x and y are 16 bit values. (see list)
It seems to be something with shift and xor operations. Is there any way to find an acceptable function for this instead of saving all 65536 solution words?
Any Ideas are welcome...
Regards,
friedo

x = f(x)
00 00 = 2F 57
01 ec = ad 50
08 c5 = 16 df
0e 70 = 17 2c
0f 23 = 8e a0
14 D5 = B3 63
15 1A = B2 AC
18 8d = 4c f1
1F 0C = 61 09
1f 38 = 11 1c
21 74 = E2 1A
21 a9 = c7 73
29 6a = bb ed
2b 10 = aa 93
2c 80 = 97 44
2c ad = 51 92
2d 10 = cb ca
30 27 = f3 f2
32 CD = 0E 9E
32 E8 = 82 26
33 9a = e3 4b
37 d5 = d6 49
39 28 = F6 B1
3b fe = 07 ad
41 45 = 11 45
4A 0C = 65 5B
4d a4 = 86 41
53 78 = 70 63
54 2B = 74 0A
58 E5 = A2 4D
5B B1 = 1B 8F
5c 13 = ef e7
5d 71 = 61 22
5D C5 = 82 62
60 CD = B7 5A
6B CB = BB 1A
6f 63 = d4 a7
73 c8 = 8e 26
77 4f = 06 3c
79 6e = 6c 7e
7b 50 = 5b 71
dELTA
12-13-2004, 02:13 PM
Where did you get these numbers? If they are from a program you have, just debug it and reverse the code of the algorithm directly. If the numbers are in a cycle (or rather just unique for all inputs), you might be lucky and it being an LCG (linear congruential generator), and in that case you can break it easily. I would have tried that in a blackbox situation anyway.
friedo
12-13-2004, 02:29 PM
Where did you get these numbers? If they are from a program you have, just debug it and reverse the code of the algorithm directly. If the numbers are in a cycle, you might be lucky and it's an LCG (linear congruential generator), and in that case you can break it easily. I would have tried that in a blackbox situation anyway.

No, these numbers are from an "unknown blackbox".

I already tried some possibilities like rotate left/xor for 16 bit keys and every shiftlength but get no solution which is acceptable for all values. til now i only have unique values!(but i have to get them manually and this takes long time so may be there are some values which are not unique...)

anyway, may be i write a little generator to test other things too...
nathan
12-14-2004, 02:26 AM
Where did you get these numbers? If they are from a program you have, just debug it and reverse the code of the algorithm directly. If the numbers are in a cycle (or rather just unique for all inputs), you might be lucky and it being an LCG (linear congruential generator), and in that case you can break it easily. I would have tried that in a blackbox situation anyway.

Hi Delta,

do you have any pointer to attacking LCG ?

Thnx,

nathan
dELTA
12-14-2004, 03:10 AM
Sorry, I meant LFSR (Linear feedback shift register), which can be easily fully reversed with the Berlekamp-Massey algorithm. LCGs are weak too though, but I'm not sure if there is any deterministic algorithm to reverse their parameters directly from any output stream. Can you clear it up Mike?
friedo
12-14-2004, 03:16 AM
Here you find a nice sample of that LSFR:
http://ihome.ust.hk/~trippen/Cryptography/BM/frameset.html
naides
12-14-2004, 08:17 AM
Can you post a series of Consecutive values of x, with the corresponding f(x)?

Finding patterns,if any, is easier that way.

Also,

Graph the function, and see clusters and trends,

Also, if you try two the same x more than once, you get the same f(x) right???
mike
12-14-2004, 03:24 PM
Neither LFSRs nor LCGs have any input, so the function can't be either of those. It might be a linear function. You can test for linearity like this:

1. Collecting 16 input-output pairs,
2. Write them as rows of a 16x32 binary matrix
3. Then row-reduce. This will give you an xor pattern for each of the 16 bits.
4. Check against some more input-output pairs: take the patterns corresponding to each input bit and xor them together. They should match the output.

If that's the case, then you only need to store 16 patterns instead of 2^16.

However, it's likely that it's a nonlinear function. All nonlinear functions on 16 bits can be written as polynomials over GF(2^16) or over integers, but you may end up storing 2^16 coefficients, so there's no guarantee it'll take up less room.

You can test to see if it's an nth order polynomial by taking points x1, x2, ..., xn, calculating the polynomial f(x) = (x-x1)(x-x2)...(x-xn) and seeing if the rest of the points fit what you have so far.

BTW, This is the basis of secret splitting: for a 3/2 split (3 total shares, any 2 of which give a solution), choose three points f(a),f(b),f(c) on a cubic curve and make a fourth point f(d) be the secret key.

f(a),f(b) first share
f(b),f(c) second share
f(c),f(a) third share

Only when two players get together can they fit the cubic to the points and calculate f(d).
dELTA
12-14-2004, 03:32 PM
Neither LFSRs nor LCGs have any inputI was thinking that the LFSR och LCG would be reseeded with the input each time, but come to think about it that really doesn't make much sense. I guess I was drunk or something, sorry. ;)
nikolatesla20
12-15-2004, 08:23 AM
Holy cow mike, how did you get so good with these maths :)

I tell ya...I need to go back to school some more. I can write unpackers but crypto is so hard to wrap my head around sometimes.

Well, gotta start somewhere..

-nt20
JMI
12-15-2004, 11:54 AM
It might be because "holy cow mike" may just happen to have some connection with crypto in his "real" life. :idea: And, unlike some of us who flunked out of math in the third grade (what do you mean "divide" the number, is that like cutting it with a knife?), he actually may use some of this stuff, as well as understand it. :D

Of course, on the other hand, he could just be completely wierd and actually LIKE math. :eek: Over my long and useless life I've actually heard rumours that there are such people. I might actually have talked to one or two, without realizing it, because, of course, I would have had no idea what they were talking about. :smug:

But even if I have no idea what the heck they are talking about, I am glad they keep using those numbers and crazy symbols and "stuff" to keep explaining how the universe actually works and to make "stuff" that makes life easier for those of us who aren't bright enough to actually "get it." :whoops:

Of course it's all "relative." :idea:

Regards,
nikolatesla20
12-15-2004, 01:10 PM
Yes, I'm sure Mike uses this stuff a lot for his daily routine, of course I realize that..

prolly a good uni degree too.

-nt20
mike
12-15-2004, 03:24 PM
JMI got it: I like math. Here's an example:

The cross product of two vectors is proportional to the area they sweep out, so the cross product of any vector with itself is zero. The cross product only exists in three dimensions, but a generalization called the wedge product, denoted /\, exists in all dimensions. The wedge product of any vector with itself is also zero.

When dealing with the cross product, people often use x,y,z or i,j,k as the directions. With the wedge product, they just use the letter e with a subscript: e_1, e_2, ..., e_i, ..., e_n.

Finally, there's a field of mathematics called differential geometry; here the vectors are called "differential forms".

Now I can tell you a pun I made up:

Old MacDonald had a form: e_i /\ e_i = 0 :D
gabri3l
12-15-2004, 03:53 PM
Oh boy Mike now you started with math puns. :)
This one is borrowed from a Foxtrot comic.

M(2.71828)r^2 (1/y) ^-1 sqrt(x^2)(force/acceleration)
JMI
12-15-2004, 04:41 PM
Alright now, you people cut that out. I already explained that there are those of us who can't speak "math." :eek: :D I can sing the Inchworm Song, from the movie "Hans Christian Anderson" though. :yay: No wait, most of you weren't born when that was in the Theaters. :thinking:

Regards,
mike
12-15-2004, 06:44 PM
I saw it on the Muppet show:
"Inchworm, inchworm,
measuring the marigolds,
you and your arithmetic
will probably go far.
Inchworm, inchworm,
measuring the marigolds,
seems to me you'd stop and see
how beautiful they are!"

And the "powers of 2 chorus"
2 & 2 are 4
4 & 4 are 8
8 & 8 are 16
16 & 16 are 32
(repeat)

I'd always take it out to 2^16, but it never quite fit the meter.

M(2.71828)r^2 (1/y) ^-1 sqrt(x^2)(force/acceleration)
How apropos that we have Gabriel announcing Merry Christmas!
JMI
12-15-2004, 07:16 PM
That's the one. :yay: And, now that you've "translated" gabri3l's clever Merry Christmas, I actually do see it. :idea:

Now if we could only get everyone to understand the concept of "Peace on Earth and Good Will to Everyone," in whatever language they may speak or understand, then we'd really have something going. :yay:

Regards,
Woodmann
12-15-2004, 09:45 PM
Ya know,

I can remember when I said, "when the hell will I ever need to use this math shit in real life". They said "take calculus, it will be good for you".
What a bunch of bullshit until, holy o fuck, I get a job that actually requires such knowledge.

Thankfully there are quick reference manuals for us "power lamers" :p .

Anyway, I love to read the posts in this crypto forum, it helps me to realize that there are still somethings that will always be important :)

Woodmann
Silver
12-16-2004, 06:30 AM
http://www.sosmath.com. That's all I have to say on the matter ;)
JMI
12-16-2004, 11:58 AM
The only time I can remember actually using my high school trig was when I was trying to figure out the "exact" angle of the meeting of two walls in my kitchen as part of a remodeling project I was building. It was not "square" and "something less than 90 degrees, and I had a fairly expensive countertop being made and I wanted it to fit "exactly." So I dug out the old trig book and worked it out. :idea:

Of course, the fabrication shop then cut it wrong, twice. :eek: They didn't make any money on that project. :rolleyes: And, of course, the long wall was not straight and I ended up floating out that wall to make it "appear" level. Sometimes it IS just easier to tear the thing down and start with new wood. After 40 years, things start to get all bent out of shape. Even people. :D

Regards,
volodya
12-17-2004, 01:32 PM
Sorry, I meant LFSR (Linear feedback shift register), which can be easily fully reversed with the Berlekamp-Massey algorithm. LCGs are weak too though, but I'm not sure if there is any deterministic algorithm to reverse their parameters directly from any output stream.

http://www.uni-mainz.de/~pommeren/Kryptologie/Bitstrom/2_Analyse/LCGcrack.html


tool for searching strings
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > tool for searching strings
PDA

View Full Version : tool for searching strings

figugegl
12-15-2004, 08:36 PM
after reading the ollydbg-hide-thread...

some time ago i coded this little tool which might be useful for some of you.

"This little tool shows all ASCII and UNICODE strings in a file. You can edit, copy, paste, sort, search and much more. ..."

please read the included readme.txt for more information.

cheers
figugegl

It may be that your sole purpose in life is simply to serve as a warning to others
JMI
12-16-2004, 12:02 PM
Thanks for sharing your efforts. :yay:

Regards,
tommy2guns
12-18-2004, 07:40 PM
I'll chime in with a thanks as well. Been using "bintext" but your tool is far superior.

T
smarter
12-31-2004, 09:35 PM
Thanks for your product and code,I'll study it!
Jacques
01-06-2005, 10:36 PM
Great little tool, thanks figugegl!

Jacques
volodya
01-13-2005, 12:52 PM
figugegl

well, let me tell you first that the effort is great. thanks for the tool. also the coding style is nice. so now I'd like to say about the things I didn't like.

1. You are not using MMF.
This:

iFileSize = (unsigned long long) GetFileSize (hFile, NULL);
pszFileBuffer = (char *) malloc (iFileSize);

cannot be considered as a good strategy. Honestly, use MMF.

2. Your searching algo is a very simple one. Consider using something more sophisticated, such as Boeyr-Moor search. I suggest you reading D. Knuth's book or a Sedgewik's one.

As for the rest - thanks again.
figugegl
01-14-2005, 07:50 PM
@all
thank you for your roses and suggestions. i know i'm not much of a coder. as i don't do much reversing/coding these days anymore i only wanted to share one of my private tools with you guys.

@volodya
1) i was thinking of mmf as well initially, but can't remember why i dropped the idea.

2) afaik boyer-moore is for searching a known string in another. but here i'm searching for ANY possible string. or do you refer to the "strings-search"-menu only? then you're rigth of course!

i don't think i will ever update showstring, i'm way too busy with "real" projects. yepp, life's finally taking over :) - but here's the code. maybe some of you is going to improve the tool. or how about a mini-coding-project?
countryman
01-15-2005, 07:38 AM
i got a your tool.
i think that your tool is very nice
speake again, thanks figugegl!
i wish fot your good health~~~~
bye
jb1968
01-15-2005, 10:03 AM
it is like ida 's string tool .
cRk
01-15-2005, 06:24 PM
i had a quick look on it but i believe bintext is similar to this one and has more options... thanks anyway :yay:
tDJ
01-24-2005, 02:27 PM
Thanks for sharing this helpfull tool. :cool:

But there's a small prob. W/o ShowString.ini it default shows ascii and unicode stringtypes, which is good. But it doesn't store it in the ShowString.ini. So if you restart the prog it doesn't show the unicode stringtypes. And it doesn't neither if you change this in Strings - Options. To change this to default in ShowString.ini, than you have to edit it and add Type=3 in the [File] section.


SoftIce strange behaviour
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SoftIce strange behaviour
PDA

View Full Version : SoftIce strange behaviour

robson
12-17-2004, 10:18 AM
I have a question regarding SoftIce. I'm running it on Windows 2000 Professional. When I was a debugging a program that contains calls like messageboxa and createdialogparama I encountered strange behaviour and it wasn't for the first time. It was breaking fine on both routines, but then after couple program restarts (10 or more) it stopped breaking on a program and started to break a program on a message that displays SoftIce "An error occurred during symbol translation/load. Load executable anyway?" after you re-load a program. I rebooted PC, but now it doesn’t break on any of these calls, even they are there and SoftIce is loaded. And this is not for the first time. It has happened to me before on different PCs with different programs. Please can you tell me what am I doing wrong?
Thanx for any help.
naides
12-17-2004, 02:34 PM
I just want to tell you that I have seen similar problems.

In winXP ( I do not have a clue to what extent in win2k) the Sice "status" is saved when you hybernate or close(The previously placed BPX "survive" the boot off ) the puter, but I doubt compuware and microsoft are exchanging quality costumer info. So unpredictable problems will and may come through. . .
No suggest appart from do your debug on a clean, reboot environment.
robson
12-20-2004, 03:08 AM
Thank you for a confirmation.
I'm surprised, that 80 people have seen this thread, but just one response. I thought, that there is some logical explanation, or work around. If you can't depend on softice that it breaks a program execution at the set up point, than the toll is totally useless. I believe there has to be some explanation for such behaviour. If some experienced cracker could bring some light in ..... highly appreciated.
naides
12-20-2004, 07:52 AM
I read your Post more carefully, see coments in red

I have a question regarding SoftIce. I'm running it on Windows 2000 Professional. When I was a debugging a program that contains calls like messageboxa and createdialogparama I encountered strange behaviour and it wasn't for the first time. It was breaking fine on both routines, but then after couple program restarts (10 or more) it stopped breaking on a program and started to break a program on a message that displays SoftIce "An error occurred during symbol translation/load. Load executable anyway?"

You have breakpoints on messageboxA and CreateDialogParamA. The SoftIce Symbol loader uses those API to display its messages. The API calls may be not thread specific, so surprise, you are just breaking on a Windows API

. . .after you re-load a program. I rebooted PC, but now it doesn’t break on any of these calls, even they are there and SoftIce is loaded.

But perhaps the symbol loader is not loaded, right?
. . . And this is not for the first time. It has happened to me before on different PCs with different programs. Please can you tell me what am I doing wrong?

The key to the erratic behavoir is the use of the Symbol Loader. Get used to it and it will be your friend. Also learn the concept of thread specifc versus global BPX and things may make more sense

Thanx for any help.
robson
12-20-2004, 10:07 AM
I read your Post more carefully, see coments in red

I clarify it little bit more. I used SoftIce symbol loader. It worked for a while (it broke program on a messagebox call), and then it simply stopped (It didn't breake on messagebox in a program, but it did on message box of the symbol loader.)
After I rebooted a pc I started a symbol loader and loaded the applic again. Softice driver was set to load with windows automatically. I set up a break point on messageboxa, but I didn't work at all.

I just outline the way how I used a symbol loader and how I set up a break point. I loaded a applic from the symbol loader and then the message appered "An error occurred during symbol translation/load. Load executable anyway?" I clicked OK and landed in softice window. I typed bpx messageboxa and pressed enter followed by ctrl+D.
Is there anything I did wrong what explains that behaviour?
naides
12-20-2004, 10:24 AM
I clarify it little bit more. I used SoftIce symbol loader. It worked for a while (it broke program on a messagebox call), and then it simply stopped (It didn't breake on messagebox in a program, but it did on message box of the symbol loader.)
After I rebooted a pc I started a symbol loader and loaded the applic again. Softice driver was set to load with windows automatically. I set up a break point on messageboxa, but I didn't work at all.

For messageboxA, or other API breakpoint to "work", it has to be set in the right "address context": If you look at the lower right corner of the Sice window you will see which address context you are standing in. Also, when you use Symbol Loader, it will break for the first time within the address context of your App. Search the board on Address context and you will see other posts about it

I just outline the way how I used a symbol loader and how I set up a break point. I loaded a applic from the symbol loader and then the message appered "An error occurred during symbol translation/load. Load executable anyway?"

Pay no attention to this message, you have no debug symbols for a regular app

I clicked OK and landed in softice window. I typed bpx messageboxa and pressed enter followed by ctrl+D.

This sounds like I would do

Is there anything I did wrong what explains that behaviour?

Cheers
robson
12-22-2004, 09:29 AM
I want to thank everybody who replied and pointed me at the right direction. I have studied all articles posted to the forum about the address content and I tested it again, with AC in the mind and yes it worked. I can't see, what I did wrong before, but now it works as it should and I'm happy.
Thanks.
naides
12-22-2004, 10:00 AM
but now it works as it should and I'm happy.
Thanks.

Happy Holidays, May the Gods keep you from getting married in 2005.
JMI
12-22-2004, 12:21 PM
Well it appears that "noboby" is unhappy about their state of marital bliss. :eek: And I doubt the "Gods" take responsibility for such choices. We have "nobody" to blame, but ourselves. :idea:

Regards,
dELTA
12-23-2004, 05:41 PM
May the Gods keep you from getting married in 2005.Does that mean we will never get to hear about the solution to that "different execution path on different computers" problem? :p
naides
12-23-2004, 06:33 PM
That deal is with the girlfriend, a different story all together :sneaky: :sneaky:
JMI
12-23-2004, 08:16 PM
Wait until you have both a wife and a girlfriend to deal with. :eek:

Regards,
naides
12-25-2004, 10:36 AM
I do have a wife and a girlfriend, but for some strange reason, they don't like each other, and now They both are mad at me. . .

How come? Go figure!
JMI
12-25-2004, 08:50 PM
Yes, but at least they both agree on that one point. :devil: Such is generally the way of such things. :eek:

Regards,


Steganos Encrypted File and forgotten Password
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Steganos Encrypted File and forgotten Password
PDA

View Full Version : Steganos Encrypted File and forgotten Password

Zwerg
12-17-2004, 10:58 AM
Hi

Has anyone a better idea as Brute Force to get the Data of a Steganos Encrypted File (made with Steganos 7) back.

The Problem: My girlfriend has forgotten the password for the Decryption of the File. So she asked me, if i can help her.
The thing, for what i hate myself is, that i told her a few month ago, that password under 8 signs are useless. So she took a password for this brute force would be a bad choice.

Because of this, can anybody give me some hint for a better method.

I would be thanksfull for every little bit, that could help.

Bye
Zwerg
volodya
12-17-2004, 01:37 PM
The Steganos Security Suite has been one of the best-selling encryption products for years and is used by 2 million people worldwide. Only the most modern encryption algorithms, such as the Advanced Encryption Standard (AES) are used. You can now save up to 256 GB* to its four virtual drives in real time - enough space for your film archive, multimedia data,large graphics files and other sensitive data.

If this is true (well, if it is Rijndael indeed) you have one of the two possibilities:
1) bruteforce 2^128 - useless
2) try to understand HOW the program creates the key for Rijndael. If it is not sophisticated enough, you do have a chance.
Woodmann
12-17-2004, 07:06 PM
Hi,

So your girl lost the password to her steg program. I hate when that happens.
Search for a program called stego-ripper. It can help you to recover your lost passwords.

-OBC-
Snowski
04-16-2005, 11:24 AM
So your girl lost the password to her steg program. I hate when that happens.

Indeed...LOL! :D


MASM Forum, check your email carefully
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > MASM Forum, check your email carefully
PDA

View Full Version : MASM Forum, check your email carefully

Silver
12-17-2004, 11:32 AM
Hi guys,

Everyone that's registered an email addr with MASMForum, take a look in your mailbox please. I just got the following mail sent to me from the MASMForum site itself (ie: through what would be the admin console to send all members a message). So either Hutch has been hacked again, or something wasn't solved the first time. Look at the headers I pasted below, namely the userid etc. And of course checking the main masmforum site shows... well. You'll see.

The following is an email sent to you by an administrator of "www.masmforum.com". If this message is spam, contains abusive or other comments you find offensive please contact the webmaster of the board at the following address:

hutch@movsd.com

Include this full email (particularly the headers).

Message sent to you follows:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

www.y4hoo.net | PORN | Forum | Yahoo | MSN | AIM | Crackers | Exploits | 1000s of Downloads | Movies | Full Games | ~Check us out~

Return-Path: <masmforum@www05.powweb.com>
X-Original-To: xxxxxxxxxxx
Delivered-To: xxxxxxxxxxxxxxxx
Received: from localhost (localhost [127.0.0.1])
by xxxxxxxxx (Postfix) with ESMTP id 3CA60500C
for <ssssssssss>; Fri, 17 Dec 2004 17:38:51 +0100 (CET)
Received: from ssssssssss ([127.0.0.1])
by localhost (sss [127.0.0.1]) (amavisd-new, port 10024) with ESMTP
id 29741-08 for <xxxxxxxxx>;
Fri, 17 Dec 2004 17:38:46 +0100 (CET)
Received: from xxxxxxxxx (mx0.123-reg.co.uk [212.67.202.214])
by xxxxxxxxxx(Postfix) with ESMTP id E3D13500A
for <xxxxxxxxxxx>; Fri, 17 Dec 2004 17:38:43 +0100 (CET)
Received: from [66.152.98.105] (helo=www05.powweb.com)
by xxxxxxxxxxxxx with esmtp (Exim 3.36 #5)
id 1CfL7m-00072V-00
for xxxxxxxxxx; Fri, 17 Dec 2004 16:38:38 +0000
Received: by www05.powweb.com (Postfix, from userid 62510)
id D7964A8B51; Fri, 17 Dec 2004 08:38:38 -0800 (PST)
To: hutch@movsd.com
Subject: www.y4hoo.net
MIME-Version: 1.0
Content-type: text/plain; charset=iso-8859-1
Date: Fri, 17 Dec 2004 16:38:38 UT
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: PHP
From: hutch@movsd.com
X-AntiAbuse: Board servername - masmforum.com
X-AntiAbuse: User_id - 99999
X-AntiAbuse: Username - ze3lock
X-AntiAbuse: User IP - 68.37.26.27
Message-Id: <20041217163838.D7964A8B51@www05.powweb.com>
Content-Transfer-Encoding: quoted-printable
X-Spam-Status: No, hits=3.233 tagged_above=-999 required=5 tests=BAYES_50,
MISSING_MIMEOLE, NO_REAL_NAME, URIBL_OB_SURBL
X-Spam-Level: ***
X-UIDL: OW7!!fIA"!eN""!@ZW!!
Status: U
nikolatesla20
12-17-2004, 11:59 AM
I found this meta refresh tag in the main page source

<meta http-equiv="refresh" content="1;url=http://www.y4hoo.net"><br />

it was here:

<tr>
<td class="row1" align="center" valign="middle" height="50"><img src="templates/subSilver/images/folder_big.gif" width="46" height="25" alt="No new posts" title="No new posts" /></td>
<td class="row1" width="100%" height="50"><span class="forumlink"> <a href="viewforum.php?f=3" class="forumlink">The Workshop</a><br />

</span> <span class="genmed">The Workshop is where general purpose questions and answers are posted. Any assembler programming topic is welcome and discussion is encouraged as long as its friendly.<meta http-equiv="refresh" content="1;url=http://www.y4hoo.net"><br />
</span><span class="gensmall">Moderators <a href="profile.php?mode=viewprofile&amp;u=6">donkey</a>, <a href="profile.php?mode=viewprofile&amp;u=9">sluggy</a>, <a href="profile.php?mode=viewprofile&amp;u=74">P1</a>, <a href="profile.php?mode=viewprofile&amp;u=429">pbrennick</a></span></td>
<td class="row2" align="center" valign="middle" height="50"><span class="gensmall">298</span></td>

<td class="row2" align="center" valign="middle" height="50"><span class="gensmall">1909</span></td>
<td class="row2" align="center" valign="middle" height="50" nowrap="nowrap"> <span class="gensmall">Fri Dec 17, 2004 12:03 am<br /><a href="profile.php?mode=viewprofile&amp;u=2">hutch--</a> <a href="viewtopic.php?p=32596#32596"><img src="templates/subSilver/images/icon_latest_reply.gif" border="0" alt="View latest post" title="View latest post" /></a></span></td>
</tr>

Looks like some inject stuff into the forum description or something. (XSS). But I think they would have to still have admin rights to do it. Should go thru the SQL database and check all who have admin rights, since a user could have added themselves to the admin list and no one would ever know.

Looks like as well PHPBB does not filter HTML elements like it should from forum topic descriptions.

Also, the page title was modified as well.

-nt20
dELTA
12-18-2004, 06:39 AM
There was a new remote root vulnerability for phpBB reported a few days ago. I warned all the other boards as soon as it was released, but apparently hutch didn't listen very well...
Zero
12-19-2004, 06:39 AM
Where can I find infos about this vulnerability ?
dELTA
12-19-2004, 07:31 AM
In the email I sent you the same day it was released? :) Aren't you using your old anticrack.de address anymore? Please contact me by PM or email for more info...
JMI
12-19-2004, 11:49 AM
Certainly when it comes to security vulnerabilities, one would be well advised to listen to young master dELTA. He does know his server security and stays up late at night, eating rice pudding, and keeping up on all the latest news on the subject and warning us to get our sh*t together or pay the price. :smug: As we have seen recently, sometimes that price is high. :eek:

Regards,


more forum hacking?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > more forum hacking?
PDA

View Full Version : more forum hacking?

doug
12-17-2004, 01:44 PM
bad news for PHP users

The Hardened-PHP Project has announced several serious and according to them, easy-to-exploit vulnerabilities within PHP. A flaw within the function unserialize() is rated as very critical for millions of PHP servers, because it is exposed to remote attackers through lots of very popular webapplications. The list includes forum software like phpBB2, WBB2, Invision Board and vBulletin. It is time to upgrade now.

http://developers.slashdot.org/developers/04/12/17/1641212.shtml?tid=169&tid=172
dELTA
12-18-2004, 06:37 AM
They just use all those names of well known products to get more attention for that report, they are just examples of random php applications, none of them are explicitly vulnerable as far as I know.
hosiminh
01-13-2005, 02:15 AM
Well , not much to say , yet another board got hacked:

_http://forum.accessroot.com/
Shub-nigurrath
01-13-2005, 02:48 AM
What the hell our site has been defeated by a lamer group.

There's no more respect for honest crackers which do their job "honestly"..these stupid lamers attack anything has a little probability of being hacked, without worrying of what are they attacking!

Lamers of the situation are: http://www.c0d3rz.org/

blame on them!
Shub-nigurrath
01-14-2005, 03:45 AM
well,
we collected enough information to do some countermeasures (hope ) and we are now back online with both forum and site.
have phun


Searching string literal in remote process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Searching string literal in remote process
PDA

View Full Version : Searching string literal in remote process

homersux
12-17-2004, 05:51 PM
I am trying to write a subroutine to search for string literals in a remote process. I am pretty sure the wheel is available and I don't think my version is working that well. SO I'd appreciate if you could comment/modify/advice for code improvement, thanks a lot! I have a small tool that's about to finish with this function added. I'll release it asap afterwards.

BOOL searchProcMemory(HANDLE hp, DWORD addr, DWORD dwBytes, LPBYTE sStr,
BOOL literal, HWND listresult){

PBYTE data = 0;
BOOL retval = FALSE;
DWORD dwRead = 0, i, j;

MEMORY_BASIC_INFORMATION mbi;

LPBYTE lp = 0;
BYTE buffer[512];
DWORD found = 0, alen = strlen(sStr);

SendMessage(listresult, LB_RESETCONTENT, 0, 0);

__try{

while(VirtualQueryEx(hp, lp, &mbi, sizeof(MEMORY_BASIC_INFORMATION)) == sizeof(mbi)){
if(!mbi.State&MEM_COMMIT || mbi.Protect&PAGE_NOACCESS
|| (DWORD)mbi.AllocationBase >= 0x70000000){
lp += mbi.RegionSize;
continue;
}
data = malloc(mbi.RegionSize);
if(data == 0){
ListBox_AddString(listresult, "Reading data from remote process failed, cannot allocate");
__leave;
}

retval = ReadProcessMemory(hp, (PDWORD)mbi.BaseAddress, (LPVOID)data,
mbi.RegionSize, &dwRead);
if(retval == FALSE || dwRead != mbi.RegionSize){
sprintf(buffer, "%08X %08X %08X %08X %08X", mbi.AllocationBase, mbi.BaseAddress, mbi.RegionSize, dwRead, data);
ListBox_AddString(listresult, buffer);
ListBox_AddString(listresult, "Reading data from remote process failed, cannot read");
//__leave;
}else{
for(i = 0; i < mbi.RegionSize; i ++){
if(strncmp(data+i, sStr, alen) == 0){
found ++;
if(found < 100){
sprintf(buffer, "0x%08X - %s", (LPBYTE)mbi.AllocationBase+i, sStr);
ListBox_AddString(listresult, buffer);
}else
ListBox_AddString(listresult, "Too many found matches, skipping..");
}
}
}
free(data);
lp += mbi.RegionSize;
}
retval = TRUE;
}
__finally{
if(data) free(data);
}
return retval;
}
TQN
12-17-2004, 10:09 PM
I have some idea, hope you will not mind.
1. The listbox will splash many times when found strings added. You can prevent it by SendMessage(listresult, WM_SETREDRAW, FALSE, 0) below the SendMessage(listresult, LB_RESETCONTENT, 0, 0) line to turn off the listbox redraw and turn it on with SendMessage(listresult, WM_SETREDRAW, TRUE, 0) in the finally block.
2. The "if(data) free(data)" can cause your app crash because you double free it in the "free(data); lp += mbi.RegionSize" block.
3. GPF can occur in the block:
for(i = 0; i < mbi.RegionSize; i ++){
if(strncmp(data+i, sStr, alen) == 0){
strncmp function can read exceed mbi.RegionSize memory block.
For safely, I think we need change it to:
for (i = 0; i < mbi.RegionSize - alen; i ++){
if(strncmp(data+i, sStr, alen) == 0){
4. strncmp is a slow function, so if you need for speed, you can use the BooyerMoore algorithm in MASM32.
5. You allocate and free memory many times in the while loop. It will make slowndown your app. I think mbi.RegionSize is a constant, so you can allocate it one time before the while loop and free it in the finally block.
6. I am wonder a string can be overlapped between two pages ? If it is, the string will not be found ?
Best regards,
TQN
homersux
12-22-2004, 10:50 AM
Thanks for the sound tips. RegionSize is not fixed so I have to dynamically allocate/free the memory. Speed is a problem sometimes, I can accelerate that a bit because string literals are usually very sparse in a executible memory image.
TQN
12-26-2004, 09:34 AM
Sorry homersux, I have a mistake about RegionSize. It is a size of a continuous memory blocks have same protection flags.
I have some little ideas, hope you will dont mind.
- You can add an option to search Unicode string. Just convert sStr to an another local Unicode string variable by MultiByteToWideChar, and use the wstrncmp function to compare.
- Use realloc function instead of malloc. If latter RegionSize is larger than previous size, save this size to a local variable, realloc the memory with new size, and afterall, free that memory block only once time in __finally block.
Wait for your release tool.
Best regards,
TQN


Speaking of SoftIce problems, it ate my boot screen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Speaking of SoftIce problems, it ate my boot screen
PDA

View Full Version : Speaking of SoftIce problems, it ate my boot screen

TBone
12-18-2004, 12:33 AM
No, seriously. It's really no big deal, but I thought that was odd. I installed Driver Studio 3.1 on my Windows XP box a while back. I think that was pre-SP2 at the time. Among other odd things it did, it ate my boot screen. I.e., not the login screen, but the actual boot-up screen with the pointless little green scrolly before it switches to full-blown grahic mode. Instead, I just get a black screen. Is really disconcerting since you can't tell if it's frozen or what.

I eventually uninstalled Driver Studio after getting highly frustrated with all the other issues I had with it. But the boot screen is still MIA. I can't figure out what the %#$* it did with it. The boot screen is a resource in ntoskrnl.exe. I've pulled out a resource editor and taken a look at it. The boot screen is there. I've even loaded it up in photoshop and fooled around with it. It's just not displaying, and I just can't imagine what would cause that, especially after uninstalling Driver Studio. I guess I don't really care, it's just really....weird. :p

Anybody have a clue what this is about? (And yes, I've searched - this seems to be a unique problem)
Tola
12-18-2004, 05:34 AM
it sets a flag in your boot.ini, /noguiboot iirc.
Silver
12-18-2004, 08:46 AM
TBone, I think I posted about exactly the same thing a while ago. I believe there's a patch on the Numega/Compuware support site for it. As I only use the box in question for reversing and have a ghost of it, I never bothered finding & applying the patch as it didn't bother me much.
sigint33
12-18-2004, 03:22 PM
As noted above just remove /noguiboot iirc from your boot.ini file. Useless familiar screen is back, I know it's disappearance irritated me also.

SiGiNT


Need help with Sentinel SuperPro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help with Sentinel SuperPro
PDA

View Full Version : Need help with Sentinel SuperPro

Calintz
12-18-2004, 05:27 PM
Hello everybody,

first wanna thank all who're doing effort to keep this forum the best.

Recently I had affair with a HASP dongle protected program , Having the original dongle i didn't had problem to emulate , emulation was perfect with HaspEmul made by brain's studio. just dumped the original dongle , i converted manually to reg , & installed the the emulated driver and activated the dump , the emulator emulated the dongle as it was the reg , the key name of the reg was the pwd for the dongle, it just worked fine.

Now with a software which is protected with Sentinel superpro , I've found some emulators , brute forced the pwd for the dongle , & successfully dumped , but was choqued that in the dump was several bytes x00 x00 , just two who were x01 & x07 , also some weren't decrypted, Is this dump the real dump from the Dongle , I dunno ... , but continued my work & activated the emulator , (that emulator doesn't give where to put the reg in the registry) I got an idea, I activated the emulation , & did the brute force , now the program that brute force will search in the reg for the key , & found that he was brute forcing this path: HKLM\Controlset001\Services\Sentinel\XXXX ; (XXXX --> is the brute force area , 0001 .. 0002 .... 0003...) I've created a key with the Dongle pwd & put the dump in a Binary Value , but still the emulator doesn't give those info in the binary value to the soft , ... if someone could explain what's wrong i'll be thankful, just to tell if he does see the problem nothing else Thank you very much.
CrackZ
12-18-2004, 08:59 PM
2 suggestions.

1st, whatever happened to debugging the Sentinel API or the driver and figuring it out? ;-).

2nd. Perhaps this is more helpful. If this is the dongle emulator I'm thinking it is which I believe it probably is, you require some additional registry entries, specifically, "MemoryAccess" to tell the emulator what status each memory cell has, and also "Status" & "Security". If you'd loaded the driver into IDA you would probably have seen this.

Regards

CrackZ.
JMI
12-19-2004, 11:30 AM
Listen to the man. He knows whereof he speaks. :yay:

Regards,
Calintz
12-20-2004, 04:17 PM
sentinel drivers V5.41 , I used all emulator that I found, "sentemul" & "sentinel emul pro all versions"
V0.43 of SEP worked fine. it emuled the dongle.

Let me talk a little about the software ; it's not an exe file it's like a plugin that add a menu on a program, two .arx files that when i hexedit they have the index of an executable but doesn't execute (not a valid win32 application), one of the arx files is the responsible of calling spro even the name is (sproXXXX.arx) for that reason I cannot trace them with softice (i'm working with softice on xp) not to mention that the main program is anti-softice .... , well with ida i opened the 'sproXXXX.arx' , sigs didn't show any RNBO call , but found the famous '7242' called many many times , I patched all of them , no result ... , always (dongle not found)
the thing that I don't understand is :

I have the original dongle, I tried to dump it , with brute force it found the id at '7AD9' & dump. but the full real id is '7AD9A5' (took from the dongle info that the software gives), Dump isn't what i was waiting for, there was too much x00 bytes only two byes with x01 & x07 , & others that weren't decrypted.
well now i continued the work & tried to emulate , without emulation & dongle not connected when i click a menu it says (dongle not found). But when I used the sentinel emulator pro(0.43) and without placing the dump anywhere in the reg (cuz i don't know even where to place it, the emulator doesn't say where ) I click the added protected menu on the program , It's says first (you have XXX days left for evaluation (xxx generate each time i click a menu (256,19,12,140...) and just after the box that says you have xxx days evaluation left , another box appear (I don't acceed the menu ) saying : "Key Incorrect" it means that the soft read the key info from I dunno where and it was incorrect and was shocked when I clicked on 'dongle info in the program' & saw that the id emulated was 7AD9XXXX (xxxx numbers that generate each time I click a menu) the one that the emulator emulated were the first 4 digits of my dongle id , where did he saw this ??...
CrackZ
12-20-2004, 06:44 PM
I assumed you were talking about Sentemul.

I'm puzzled by your reasons as to why you can't debug .arx files (I'm assuming they are AutoCAD plugins, if not please correct me), I've never had any problems with them since they are loaded like libraries by AutoCAD (big hint here). I'd bet the anti-SoftICE is trivial also.....have you researched what method might be obstructing your debugging?.

OK, you found many '7242' references and patched them all, with all due respect, how in the hell did you honestly expect this to work? ;-), what patches did you make? (I'm assuming you simply assumed the 7242 reference was a Sentinel function and fired back EAX=0), did you identify any of the RNBO functions?, lets face it if it reads or queries the dongles memory or does anything even remotely using the API EAX=0 just isn't going to cut it ;p.

So your dongle ID is 0x7AD9, Sentinel Developer ID's are a max. of 0xFFFF, so the software reporting "full real id is '7AD9A5'" is getting the A5 from elsewhere. I don't understand why you are unsure of the 'dump', if in doubt use good old spath's dumper from my page, some cells may not read out properly if designated as 'algorithm descriptors'.

This is the format of how your registry entry for this emulator should look :
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Emulator\Sentinel\7AD9]
"Memory"=hex: (memory go's here)
"MemoryAccess"=hex: (memory access flags go here)
"Status"=hex:
"Security"=hex: (the emulator isn't free you know!)

If you want to e-mail me and ask further questions, feel free, I dare say if the off the shelf emulator your using doesn't come with something even closely resembling instructions expect to have to do some work to get it to play how you like ;-).

Regards

CrackZ.
souz
01-15-2005, 06:34 AM
Can you explain memory access flags for this driver?
damar2003
03-18-2005, 11:30 AM
hi all,

can anybody give a hints on trapping a "security" emulator if it was not free


finding documents about CPU cache locking ( for Intel P4)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > finding documents about CPU cache locking ( for Intel P4)
PDA

View Full Version : finding documents about CPU cache locking ( for Intel P4)

zitazita
12-18-2004, 09:27 PM
Hello,

I’m looking for a detailed document, including code sample, of how to
implement Cache Locking (locking instruction cache & data cache and
creating data ram) in Intel Pentium 4.

It should be similar to the documents I found below, which are for
XScale micro-architecture and CPU 80321.

http://www.intel.com/design/iio/papers/27387202.pdf
(look into section 4.5 and appendix C)

http://www.intel.com/design/intelxscale/27347302.pdf
(look into section 6.4 and its examples)

Thank you.
contact me at : funnyroadboy@yahoo.com as soon as possible !
JMI
12-19-2004, 11:40 AM
zitazita:

If you had read the FAQ like you were supposed to, you would have known that you are not supposed to cross-post you question in more than one Forum here. How about you going back and actually reading it now, so you follow the rest of the rules. :yay:

Regards,


Ollybug
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Ollybug
PDA

View Full Version : Ollybug

Eggi
12-19-2004, 10:00 AM
Im not sure it this is only a bug from olly or if this also happens in other debuggers but when olly goes into api OutputDebugStringA with the argument: %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s it closes with an error message.

Info about this api:

If the application has no debugger, the system debugger displays the string. If the application has no debugger and the system debugger is not active, OutputDebugString does nothing.

Im not sure if this is the correct place but the trick is from an protector ;).
omega_red
12-19-2004, 10:45 AM
Olly probably treats the string as a format like in printf, not literal. "%s%s" is enough to crash. Seems that patch is needed ;)
HAVOK
12-19-2004, 10:54 AM
Im not sure if this is the correct place but the trick is from an protector ;).

This is an exploit published about 4 or 5 months ago, only OllyDbg. Perhaps there is a patch you can use for it. I'm not sure... But it's only called twice, right?. :D

As people moves to use Olly more and more packers start to add it to their blacklists.

See you,
blabberer
12-19-2004, 10:59 AM
well read this post copy pasted the string and assembled inline with olly
and singlestepped through it (f7)
it seems to work without crashing as you can see in the attached picture
it has broke on the second bp i set
if there is no bp it executes both the jump and loops on ebfe when i single stepped ( i used 98 se and single stepping inside kernel32.dll will work for only two or three instructions so i cant say more will test with w2k some time and trace it but till then thought ill post it)

if you f8 or f9 it crashes olly dbg
well cant do jit now but will make olly jitand debug this if possible

OLLYDBG caused an invalid page fault in
module OLLYDBG.EXE at 0167:004a74cf.
Registers:
EAX=7fffffff CS=0167 EIP=004a74cf EFLGS=00010206
EBX=0078d973 SS=016f ESP=0078c194 EBP=0078c6c0
ECX=00000000 DS=016f ESI=0078f1cc FS=29af
EDX=00000001 ES=016f EDI=00000020 GS=0000
Bytes at CS:EIP:
80 3a 00 75 ee e9 c5 00 00 00 f7 c7 00 01 00 00
Stack dump:
015202ec fffbb613 0078d914 75626544 74732067 676e6972 96ac203a 2073254d 7325202d 004a77d8 0078c1cc 0078f1e8 00008258 0078f234 4e52454b 32334c45
disavowed
12-19-2004, 01:43 PM
see http://www.woodmann.com/forum/showthread.php?t=6153
JMI
12-19-2004, 04:42 PM
Ladies and Gentlemen, we seem to have evidence that Eggi failed to use the search function here before posting his question. :whoops:

OutputDebugString would have been a good place to start that search. :idea:

Regards,


How-to log port IO protocol?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How-to log port IO protocol?
PDA

View Full Version : How-to log port IO protocol?

aba
12-20-2004, 02:22 AM
I need log protocol work program with own hardware.
How-to it`s make ? SoftIce can help me? Also need value registers.
Thanks.
dELTA
12-20-2004, 05:47 AM
I need you give much more info and read friggin FAQ. :rolleyes:
aba
12-20-2004, 07:19 AM
For update flash BIOS CD-Rom need capacity logging all send and received data.
In sources UsersPort i not found place where insert my routine for logging data .
I not good programmer.Sorry for my englich :)


the new packer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > the new packer
PDA

View Full Version : the new packer

gunterg
12-20-2004, 04:08 AM
WARNING - The Following Self Promotional Claims Have NOT Been Verified By ANY Credible Source

Themida 1.0

I believe that the author is the same than the Xprotector
Kernel Mode operation in all Windows platforms: Ring0 technology in most of the internal protection engines; Anti-debugger techniques that detect/fool any kind of debugger; Anti-memory dumpers techniques for any Ring3 and Ring0 dumpers; Different encryption algorithms and keys in each protected application; Anti-API scanners techniques that avoids reconstruction of original import table; Automatic decompilation and scrambling techniques in target application; Virtual Machine emulation in specific blocks of code; Advanced Mutator engine; SDK communication with protection layer; Anti-disassember techniques for any static and interactive disassemblers; Multiple polymorphic layers with more than 50.000 permutations; Advanced API-Wrapping techniques; Anti-monitors techniques against file and registry monitors; Random garbage code insertion between real instructions; Specialized protection threads; Advanced Threads network communication; Anti-Memory patching and CRC techniques in target application; Ring-0 garbage code insertion between real instructions; metamorphic engine to scramble original instructions; Advanced Entry point protection; Debugger interrupts emulation; Dynamic encryption in target application; Anti-tracing code insertion between real instructions; Advanced Anti-breakpoint manager; Real time protection in target application; compression of target application, resources and protection code; Advanced kernel mode decryption layers; Anti-“debugger hiders” techniques; Full mutation in protection code to avoid pattern recognition; Real-time simulation in target application; Intelligent protection code insertion inside target application; Random internal data relocation; Possibility to customize dialogs in protected application; Support of command line; Many many more...
199€ :) A expensive little do you not believe?
http://www.oreans.com/index.php
dELTA
12-20-2004, 05:44 AM
Sounds like a fun toy, although quite certain to royally mess up the computers of half of your customers or so... :rolleyes:
nikolatesla20
12-20-2004, 06:06 AM
um who cares, unless it actually starts to get used somewhere.

also, all threats we've heard before :)

FULL this , FULL that. COFFEE HOLDER Included. BACK / FOOT massager (not for use in internal areas)

Just run it in VMWare anyway :P

-nt20
JMI
12-20-2004, 11:11 AM
Since when did we permit this Forum to become a self promotion page for makers of new protection schemes who are trying to advertise their products and sell to new customers? :boo:

I am taking the liberty of reducing the volumn of this advertisement.

There now, isn't that better. :smug:

Regards,
JMI
12-20-2004, 11:36 AM
And read this thread:

http://www.exetools.com/forum/showthread.php?t=6016

Seems "just like xprotector" this "protector" manages to crash those machines on which it has been tried to run. :yay: Brillant marketing strategy.

Regards,
CluelessNoob
12-20-2004, 07:37 PM
And the ultimate in protection. You can't reverse what you can't run.

:devil:
GabryJ
12-22-2004, 02:39 AM
Actually it seems Sergio Lara gave up the job and Rafael Aucha take the project ahead beeing bought by Oreans. If you look in the about you can see his name and possibility to send him an email.
nikolatesla20
12-22-2004, 10:20 AM
Keep ur day job, guys.

Plus, you'll have lots more fun when IBM and Intel finally come out with the multi-core chips in every desktop. Enjoy keeping up with hardware the rest of your life !

-nt20
JMI
12-22-2004, 12:29 PM
Uh ... people actually have day jobs :confused: I thought everybody did most of their work at night. :D

Regards,


Taking control of a prog
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Taking control of a prog
PDA

View Full Version : Taking control of a prog

ReVeR
12-20-2004, 11:16 AM
Hey.
i wanted to try somthing like pressing buttons in another pror from my program.
So i was thinking using something like send message to teh windows....
but how would i send mesage like button click on.....
i knwo the button click message, but how would i specify whihc button is being clicked?
What is the parameter and is it wParam or lParam in Send message?
thx
JMI
12-20-2004, 11:27 AM
Two Points:

1. How about you running your posts through a basic English spell checker or at the very least READ them yourself to catch the most obvious of spelling/typing errors.

2. How about you do some of your own damn basic research and look at some materials on basic windows program elements. THAT is what the net is for and one of the requirements of this Forum, that YOU TRY to solve your own problem BEFORE you come post questions you should have discovered yourself. For examply Micro$oft has a whole library on line that should answer your questions. :whoops:

Regards,
Kayaker
12-20-2004, 01:18 PM
I have to agree with one point, there seem to be a number of "new" posters who don't seem to give a sh*t about basic spelling or grammar. They are obviously typing too damn fast and don't seem to give a sh*t whether or not they've transposed half a dozen letters or their post is at all readable.

Well, allowing for honest English language mistakes, when I see that lack of effort or attention to detail, then I just don't give a sh*t to read it or waste any time whatsoever to help. This of course incl00ds the l33t script posters, but that's something different again.

I'm not targetting this poster specifically, but in general, a half-assed post barely merits a half-assed response. Why should it?
Extremist
12-20-2004, 01:19 PM
Besides MSDN, the two essays on Shatter attacks by Foon might be of use.
Radialen
12-21-2004, 03:10 AM
If you're too lazy to do it yourself - there is something called "dragon utilities" available as .dll and Delphi DCU which will do what you want.

.
dELTA
12-21-2004, 05:43 AM
And it doesn't get any better by the fact the he promised to proof read his posts the last time I told him this:

http://www.woodmann.com/forum/showthread.php?t=6640

Shape up or be banned ReVeR, you don't have too many chances left...
Fake51
12-21-2004, 10:09 AM
Shame new blood doesn't come by the gallon, wouldn't be much need for patience with busybees asking instead of searching.

Fake

Note to self: gotta remember donor-appointment tomorrow ...
naides
12-21-2004, 01:22 PM
Note to self: gotta remember donor-appointment tomorrow ...

With the Sperm Bank?

Thank you for sharing the Holiday Spirit!
Fake51
12-22-2004, 01:43 AM
With the Sperm Bank?

Thank you for sharing the Holiday Spirit!

Oh no, you have discovered my plan to secretly spread my genes!

Fake
JMI
12-22-2004, 12:18 PM
Ah, small problem report on "the Plan." The concept requires willing females to "accept" the gift offering. :D Of course you are following the tradition which states it is better to "give" than to "receive." :thinking: But at least it is in the Holiday spirit. :yay:

Regards,


Hack-a-Bike
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hack-a-Bike
PDA

View Full Version : Hack-a-Bike

disavowed
12-20-2004, 10:19 PM
Great article (originally linked to from DataRescue's board): http://www.ccc.de/hackabike/index.html
dELTA
12-21-2004, 05:31 AM
Cool. :cool:
CluelessNoob
12-21-2004, 08:37 AM
Since the 'Intellectual Property' lockbit of the Atmel was undefined, it was possible to read out the 8KB firmware of the flash.

Not so cool. What good is all that fancy programming if you leave it in plain site.

:whoops:
JMI
12-21-2004, 10:34 AM
Well, maybe it was reasonably safe from "most" of the riding public who are "clueless" of such things. :idea:

Regards,
Woodmann
12-21-2004, 04:48 PM
Howdy,

I love this shit :) People who just do it because they can :yay: .

What harm was caused ??? NONE.
(except someones feelings got hurt due to lack of security features;) )
Woodmann
disavowed
12-22-2004, 01:00 AM
What harm was caused ???The company now has to fix/replace all the bikes that had been tampered with (and will hopefully upgrade them all with improved tamper-resistance)
dELTA
12-22-2004, 03:23 AM
The problem is that the hackers now already have the old code, and that stop-bit on the chip only prevents reading, not writing, as far as I understand, and hence the hackers can just flash it with the old code again as soon as the upgraded bikes are released, or am I wrong? This would only leave the bike guys with the two options of either relatively major hardware changes, or "physical intrusion prevention" measures on the boxes themselves. :)
JMI
12-22-2004, 12:31 PM
For "physical intrusion prevention measures" they could just send an armed guard along with each bike. :devil:

Regards,
4nil
01-05-2005, 08:09 PM
good in deed!
i like it! :loveu:
Woodmann
01-05-2005, 09:30 PM
Howdy,

Sorry for the late reply.

Those bikes that have been "flashed" will only be available to those who know the "flashed" code. Otherwise the bike acts as normal and no one will know the difference. Those who provided the new "flashed" code put in measures to prevent new hackers from accessing their code.

Woodmann


Mophun
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Mophun
PDA

View Full Version : Mophun

chronos
12-21-2004, 02:29 AM
Hi, I'm just wondering if anyone tried to reverse a Mophun application (gaming language for Nokia/SonyEricsson phones) ? I tried to look around for any documentation on it but was not successful.

Any tips will be appreciated.
Shub-nigurrath
12-21-2004, 02:40 AM
the mophun games are easy to crack because indeed uses all the same time checking routine..there's a program used to patch all these apps DateMophun.

I attached it here.. Not anymore you didn't, DON'T POST CRACKS YOU MORON! I tested it on ericsson cells and works fine..

Generally speaking to disassemble it you must know the cellular's processor type and if supported use IDA or any other disasm supporting that specific processor..
chronos
12-21-2004, 02:57 AM
Hi there Shub-nigurrath, I'm not sure if you're the same guy I know from another board ;)

Thanks for the fast reply and the attached file. I'll go try it out.

Do you know if IDA pro can handle Mophun files? The version I have is 4.3 and it doesn't recognise the format of the file.

Thanks for the help buddy. :yay:
Shub-nigurrath
12-21-2004, 02:59 AM
the signature should tell you if I'm the same..anyway the problem with IDA (I have 4.7) it's that you should specify the cpu for which mophun game has been compiled..mophun are a set of api and libraries available for different phones, so cpu dependant.

anyway try to google on IDA sites with word "mophun"
chronos
12-21-2004, 03:15 AM
Ok thanks Shub-nigurrath, looks like I need a newer copy of IDA.


RAID 5 and RAID 50 reliability
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > RAID 5 and RAID 50 reliability
PDA

View Full Version : RAID 5 and RAID 50 reliability

TBone
12-21-2004, 05:15 PM
I'm setting up a big RAID array as part of a MSCS cluster for the company I work for (a small engineering company). We're using two Dell powervaults - a 660F chained to a 224F. Each has 14 36GB 10k fibre channel drives.

In the first enclosure:
2 drives in RAID 1 mode will be the cluster quorum (which is overkill, but it requires it's own LUN)
2 drives in RAID 1 mode will be for Exchange (which also requires it's own LUN)

This leaves 24 drives. At least one of these should be set aside as a hot spare for automatic drive rebuilding if one of the active drives fails. So that leaves no more than 23 drives to work with. I want the basically all of the remaining drives to go towards their main storage shares. Read performance is more important that write performance, but neither is critical. The main factor is maximizing storage efficiency while still providing good fault tolerance, and reasonable performance for general purpose storage needs.

RAID 50 sounds like the best candidate for the remaining drives. To me, it seems most logical to make 3 "sub-arrays" of 7 disks in RAID 5, and then raid those three sub-arrays together using RAID 0 into a "super array" of 21 disks. That would leave two more drives unused, but it might not be such a bad idea to have additional spares anyway. If at later date we added another 224Fs with 14 drives, they would be evenly divisble by 7. So this would also work out well for expanding the array at a future date (supposedly Dell's software can do this with the storage on-line if you have the right quantity of disks).

What do you think? There seem to be a lot of different recommendations for how many drives are "safe" to put together in a RAID 5 array. Most people seem to prefer 5-6, and I've heard several recommend no more than 8. Do you think 7 is a good compromise, or is it too big? Also, should I stagger the locations of the drives in each RAID 5 sub-array so that the drives in each sub-array are never adjacent to one another? I'm trying to think of all contingencies, including thermal failure which might effect drives that are physically close to one another. But maybe that's just paranoid :eek: :D
Woodmann
12-21-2004, 06:15 PM
Howdy,

RAID 50.
What are you using for controllers ?

Hard drive speed as well as traffic will determine what is best.
You could try up to 14, maybe more. Each array should have its own spare disk.
(the spare disk should equal the smallest "active" disk)

The only way to find out is to try it. I would stagger them.

Then again, you could just ask Dell :yay:

Woodmann
TBone
12-22-2004, 11:47 PM
Well, screw it. It turns out that the controllers on the 660F Powervaults don't support RAID 50. In fact, the only concatenated RAID level they support is RAID 1+0. Which is really fault-tolerant, but wastes a lot of space. Now, one might think you could just make a bunch of RAID-5 arrays presented as virtual disks to Windows, and then convert them to dynamic disks and do a striped NTFS volume across the arrays. But no, MSCS doesn't support dynamic disks for reasons that can only be described as "pointless" or "sadistic", I'm not sure which.

So, I'm stuck with doing single-level RAID. And to make matters even more fun, you can only have up to 16 physical disks per disk group, and virtual disks (LUNs) can't span multiple disk groups. So in a nut shell, the largest contiguous drive space I can give them is a 16-disk array of 36 GB drives.

On the plus side, it turns out that it will let you create multiple virtual disks using the same set of disks, even using completely different RAID modes. So, I can take two drives and put both the cluster quorum and the exchange database and logs on the same physical disks without the OS wising up to it. So I only need two disks for that instead of four.

Ultimately what I settled for was this:

The first group has two disks. The first 500 MB of each drive uses RAID-1 to make a virtual disk for the quorum. The remainder of both drives makes another ~35GB RAID-1 virtual drive for our Exchange server's database and logs. The current database is 4GB, but we haven't done any archiving at all. I don't forsee it growing to anywhere near 35 GB until well after we've purchased more storage.

The second group has 16 drives in RAID-5. That's our main storage for active projects, and other general use. It works out to ~500 GB of usable storage.

The second group has 8 drives in RAID-5 (~250 GB). We'll use this one for archiving inactive projects, and I'll probably also put our roaming profiles on it. We might throw other things on it too, but that's for someone else to decide.

There are two spare drives in the system for automatic rebuilds. The disks for all volumes are staggered as well as possible, and they each have an equal number of drives on each channel for better throughput.

As for asking Dell, we didn't buy it from them so they aren't exactly forthcoming. They've retired the powervault line recently and sold out to SMC, which makes the Clariion line now. This is an "on the cheap" setup we got from Ebay. About $3k, including two fibre channel host bus adapters, which run about $250 each, for a refurb. $400+ new. So, not a bad deal all things considered. But the warranty has definitely expired, so I'm on my own for this one.


tutorial on soleau type games
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > tutorial on soleau type games
PDA

View Full Version : tutorial on soleau type games

bestobest
12-21-2004, 08:05 PM
Hi where can I find a tutorial on games done with macromedia, can't seems to find suitable breakpoint, dialogs windows on such programs are strange to me

PS. believe me I search all over, used visual c ++ and macromedia get nothing
disavowed
12-22-2004, 01:03 AM
PS. believe me I search all over, used visual c ++ and macromedia get nothingif you had searched THIS BOARD, you'd know that no tutorials have been written on it.
bestobest
12-24-2004, 03:58 PM
if you had searched THIS BOARD, you'd know that no tutorials have been written on it.

And what do you mean by that, my question is where can I find it not that it is here
JMI
12-24-2004, 07:09 PM
He's telling you that "if you had searched here" you would know that "there are none available."

Regards,
bestobest
12-25-2004, 11:33 AM
Can you tell me why is that, I can go anywhere and get the serial, but that is not what I want, I want to know how to get it.

PS none available anywhere?
JMI
12-25-2004, 08:53 PM
The reason is, of course, obvious. There are none because, so far, no one has chosen to write one and distribute it on the net. ;)

Regards,
bestobest
12-26-2004, 08:01 AM
You make me feel much better with your answer JMI. That tell me my search was not that bad... thank you


winxp sice BSOD
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > winxp sice BSOD
PDA

View Full Version : winxp sice BSOD

rowdy
12-21-2004, 09:38 PM
Hi All,
I have moved form win98 to winxp SP1 and have just installed Driverstudio 3.1.
I have only installed the debug part of driverstudio.
I am starting softice in boot startup. After the boot configuration screen passes I get BSOD with message

Stop: 0x0000007e (0xc0000005,0xf98b64e6,0xf9e4d4a0,0xf9e4d1a0)
SIWVID.SYS - Address f98b64e6 base at f98b4000 datestamp 3fd8b4b2

I am using universal video driver with mem set to 8Mb and am using Nvidia Gf3 video card at 800x600x32bit

I have searched forum and tried suggestions but no good.
I am a newbie so please be understanding.

Thanks
Aimless
12-22-2004, 05:02 AM
You may try to download the "OSINFO.DAT" file from compuware frontline for Driver Studio 3.1

Relpace the OSINFO.DAT (around 300kb) in your C:\windows\system32\drivers\OSINFO.Dat overwriting the OSINFO.DAT(around 200kb) file present there. The new OSINFO.DAT file which you downloaded contains good information about Windows XP Service packs, which tend to dork up your applications.

Have Phun
rowdy
12-23-2004, 04:44 AM
Thanks for replying.

I tried your suggestion but it did not work.
I have changed from boot start to manual.
When I start softice I now get this error message

SOFTICE START FAILURE
Error code 31
A device attached to system is not functioning
Please check Event Viewer for more info

What and where is 'Event Viewer'

All help appreciated
bilbo
12-23-2004, 05:10 AM
Hmmm...
this sounds like you have not a valid key for SoftIce...

Event Viewer:
ControlPanel -> AdministrativeTools -> EventViewer

regards, bilbo


Old DOS Stack handling by Win2k
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Old DOS Stack handling by Win2k
PDA

View Full Version : Old DOS Stack handling by Win2k

Nukacola
12-22-2004, 03:30 AM
Hi all,
My problem is that i have a BIG DOS4GW Application running under Win2k or WinXp and i wanna try to read/write the Stack of this Application with a Win32 App. (Is it possible???)

I write myself a small pure DOS (no extender) Application to point out how NTVDM.EXE is handling the Stack. Then i Debugged the Application with ollydbg but i can't find out how the stack is access.

Then i wrote a Win32 app and try ReadProcessMemory to read the memory of the Process (my testapp interpreted by ntvdm.exe) and check if it changed.
I wanted obtain the Address of the stack but didn't work. Delivered only a dump of NTVDM.EXE

After that i tried the Debug API's to access the stack, and read out ESP with GetThreadContext and check that value it is (esp=248).
Then i read the pointer from [esp]. but it also fails

Any Suggestion to get this Probleme solved or more detailed information about NTVDM.EXE i read two post about ntvdm here with some good info.

DOS APP Teststack.exe -> teststack.asm
Win32 APP Debug4.exe -> debug.asm

you can take a look a my sources under h**p://phalcon.net/masm32/

sincerly

Nukacola
Japheth
12-22-2004, 10:59 AM
Have you tried WinDbg? It surely is better than OllyDbg for debugging applications running with NTVDM.
Nukacola
12-22-2004, 01:33 PM
No but i will try that tomorrow

Thanks for that tip


DebugActiveProcess
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DebugActiveProcess
PDA

View Full Version : DebugActiveProcess

pix
12-22-2004, 08:41 AM
Hello,

how can i have a pointer to a PROCESS_INFORMATION structure after using DebugActiveProcess?

I can't have a GetThreadContext working because i dont find how to do that:

GetThreadContext(pi.hThread,&TempContext); :confused:

Thx
Nukacola
12-22-2004, 09:43 AM
look at my source i'm using the debug API's (pure masm32 assembler). I think it is self explaining how to use the structure.

h**p://phalcon.net/masm32/debug3.asm

Feel free to ask if you don't understand.

sincerly nukacola
pix
12-22-2004, 12:17 PM
Thx :)

And how can i set a breakpoint on access? is it the same as the int3? :thinking:
pix
12-22-2004, 03:27 PM
please could someone check that and help me to fix it?

My target is a little .exe i made with 1 button. When i push it a variable is incremented after a if comparaison. For my tests I directly modified the code of the .exe at address 401824 where the result of the comparison is and i did set an int3 instruction. For each breakpoint a message box appear.

No matter what i do i have this:
1 message box : windows breakpoint
1 message box : Breakpoint ok
2 message boxes : Access violation
1 message box: exiting
proggys both exit
:eek:

DebugActiveProcess(pid);
for(;;)
{
(WaitForDebugEvent (&DebugEv, INFINITE));
{
switch (DebugEv.dwDebugEventCode)
{
case EXCEPTION_DEBUG_EVENT:
switch (DebugEv.u.Exception.ExceptionRecord.ExceptionCode)
{
case EXCEPTION_BREAKPOINT:
if (DoneOnce == FALSE)//Breakpoint sent by windows
{
MessageBox(NULL, "windows breakpoint", "warning!", MB_OK);
dwContinueStatus = DBG_CONTINUE;
DoneOnce = TRUE;
break;
}
if (DoneOnce == TRUE)
{
if (DebugEv.u.Exception.ExceptionRecord.ExceptionAddress==((LPVOID)0x00401824))
// If the breakpoint come from 0x401824 address then Message Box breakpoint ok
{
MessageBox(NULL, "Breakpoint ok!!!", "warning!", MB_OK);
Context.ContextFlags = CONTEXT_CONTROL;
//WriteProcessMemory(hand, (void*)0x00401824, &OriginalByte,1, &bytes);
//GetThreadContext(DebugEv.u.CreateProcessInfo.hThread, &Context);
//Context.Eip--;
//SetThreadContext(DebugEv.u.CreateProcessInfo.hThread, &Context);
dwContinueStatus = DBG_CONTINUE;
break;
}
else // Message box Breakpoint not handled
{
MessageBox(NULL, "breakpoint Not handled", "warning!", MB_OK);
dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;
break;
}
}
break;
case EXCEPTION_ACCESS_VIOLATION:// Message box access violation
MessageBox(NULL, "Access Violation", "warning!", MB_OK);
dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;
break;
case EXCEPTION_SINGLE_STEP:// Never raise
MessageBox(NULL, "SingleStep", "warning!", MB_OK);
dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;
break;
default:
// Handle other exceptions
MessageBox(NULL, "Other exception", "warning!", MB_OK);
dwContinueStatus = DBG_EXCEPTION_NOT_HANDLED;
break;
}
break;
case EXIT_PROCESS_DEBUG_EVENT: //Exit message box
MessageBox(NULL, "Exiting", "warning!", MB_OK);
dwContinueStatus = DBG_CONTINUE;
exit(1);
break;
}
}
ContinueDebugEvent (DebugEv.dwProcessId,DebugEv.dwThreadId,dwContinueStatus);
}


Some DRx Questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Some DRx Questions
PDA

View Full Version : Some DRx Questions

Lenus
12-22-2004, 10:28 AM
as we known,in OD the hardware breakpoint use the DR0-DR3.
my questions are
1. F8 and F4 are also use these debug registers,but they still work after i set 4 hardware breakpoints.how can OD do?
2. when i set a memory breakpoint,it appear in the DR0,but it is overlayed by another hardware breakpoint after i set the hardware breakpoint.fortunately the memory breakpoint still work. where is it?
3.at the memory map,we can set a memory breakpoint to a section with F2 or "right button" .what is the difference?
4.when i set a memory breakpoint to a section,how can OD do?i means whether the OD use the DRx debug registers or not.if no,how can OD do it?
thx:)
QuickeneR
12-24-2004, 12:17 AM
I think memory breakpoints are done with memory protection options (PAGE_NOACCESS, PAGE_GUARD and such) rather than hardware breakpoints. And I'm not sure if tracing with hw bp is done correctly - when I set all four hw bps, Olly starts breaking on every command.
HAVOK
12-28-2004, 05:11 PM
Hi Lenus,

1. There are only four hardware breakpoints, so Olly has to use a standard 0CCh replacement. The 0CCh will be replaced by the original byte as soon as you press F8. Code a little procedure to check the return address and you will see if i'm right. Note that this a problem with checksums...

2. Olly has problems with the hardware breakpoints. For example, they are still there if you clear the debug registers!. This is partially a feature, cos you dont have to loose time adding them again, and a problem, cos a packer could use a hardware breakpoint as well. Restoring them could be done at ntdll.ZwContinue, but never before.

Let's do a little experiment: we set the 4 hardware breakpoints and now we set a memory breakpoint. It works fine. Then, this means that Olly has also used a PAGE_GUARD for the later one, however we have not been shown the exception. A debugger chooses when to report an exception (example: SICE controls most of the intel predefined interrupts but you only "see" int1 and int3).

3,4 are already answered in the post above.

Hope it helps :D

PS: you can debug Olly with Olly, set a breakpoint (a standard one) at WriteProcessMemory, ReadProcessMemory, WaitDebugEvent,... and observe what happens. Check the context changes when it calls Get/SetThreadContext.


INT1 question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > INT1 question
PDA

View Full Version : INT1 question

0rp
12-22-2004, 09:15 PM
hi,

is there a programmatically detectable difference between an INT1 that is caused by an enabled trap flag in the EFlags reg and an INT1 that is caused by an "INT 1" instruction ?

thx
FrankRizzo
12-23-2004, 12:34 AM
not that I recall, I reversed "CopyLock" a LONG time ago, and it made extensive use of INTs 1 & 3. IIRC, they both just call the INT 1 int. vector, so there should be NO difference. (Unless the INT 1 handler checked the flags to see).
bilbo
12-23-2004, 05:06 AM
Hi Orp,

one macroscopic difference is that, if you are in USER MODE (RING 3) an "INT 1" instruction generates an access violation exception, not a single step exception.

In all cases (RING 0 or RING 3), your handler can always peek at the opcode which generated the exception.

On the other hand, it is useless for the exception handler to look at the EFLAGS, as FrankRizzo suggested, because the Trace Flag is automatically reset by the hardware as soon as the exception is generated.

Have a look at the following VisualC snippet:

#include <windows.h>
#include <stdio.h>

//#define INT_1

void
main(void)
{
LPEXCEPTION_POINTERS pep = 0;

__try {
#ifdef INT_1
__asm int 1;
#else
__asm {
pushfd
or dword ptr [esp], 0x100
popfd
nop
nop // <-- exception here
}
#endif
}
// copy the pointers to "pep" be accessed by the handler later
__except (pep=GetExceptionInformation(), EXCEPTION_EXECUTE_HANDLER) {
printf("%x EIP=%x TRACEFLAG=%x opcode=%x\n",
pep->ExceptionRecord->ExceptionCode,
pep->ExceptionRecord->ExceptionAddress,
pep->ContextRecord->EFlags & 0x100,
*(LPBYTE)pep->ExceptionRecord->ExceptionAddress);
exit(0);
}
}

If you compile the code with INT_1 defined, you will see the output

c0000005 EIP=401034 TRACEFLAG=0 opcode=cd

C0000005 is the code for STATUS_ACCESS_VIOLATION, CD is the opcode for "int N"

If you compile the code with INT_1 not defined, you will see the output

80000004 EIP=40103e TRACEFLAG=0 opcode=90

80000004 is the code for STATUS_SINGLE_STEP, 90 is the opcode for "nop"

Regards, bilbo
user
12-23-2004, 06:40 AM
There are actually a few differences :

- Considering u use INT1 aka ICEBP (0xF1), the trap flag is set immediatly on next opcode versus what happens with playing with TF (i.e. one opcode latency).
- If you use INT 1 (0xCD 0x01), the result won't be what u think and may lead to bilbo's note.

Please note as well that the CPU may induce a slightly different behaviour:

- An AMD K6 will not like ICEBP as is, it will trigger a fault (that's a bug). One need to adjust the DPL for it to work as expected.
- There are probably some other flavour behaving differently but I don't remember them.

Some drivers may alter functionnality too :

- DbgMsg.vxd on 98SE will trash the result and induce infinite loops and what not. Their handler interferes and do not pass back the correct information to real handler.

Generally speaking using INT1 is a bad idea if u don't make sure about the behaviour, i.e. install your own handler.

That should clarify things, I hope.
omega_red
12-23-2004, 06:58 AM
INT1 (0xf1) opcode is NOT DEFINED in Intel's IA-32 architecture manuals. By using it, you are relying on undocumented CPU behaviour.
user
12-23-2004, 09:57 AM
That point is innacurate, you can find definition in previous incarnation of the manual: the current table has an empty entry, which is strange you will admit, they just do not advertise about it anymore. If you check AMD ref, it is defined there... even in the x86-64 flavour.

Nevertheless, since every INTEL cpu have a consistant and exact execution of that so-called "undocumented" instruction (well since recently), and that the only issues highlighted were from other vendors WHICH documents it and where it was inconsistant with their own definitions, it's difficult to agree with you. The initial question being about differences between int1 and setting EFlags.TF=1, this has to be mentioned.

This being said I'd not advocate to use this particular instruction, not because I know of some silicon mistakes on some now defunct CPU, but, more importantly, because of some potential software interference. But we are now far from the initial subject of this thread.
Japheth
12-23-2004, 12:16 PM
> one macroscopic difference is that, if you are in USER MODE
> (RING 3) an "INT 1" instruction generates an access
> violation exception, not a single step exception.

An access violation will only occur - in protected mode, not vm86 - if the trap/interrupt gate selector in IDT for int 1 isn't a "ring 3" selector.
FrankRizzo
12-23-2004, 01:24 PM
Just for the record, I was talking about old DOS days, I didn't consider the current "All protected mode all the time" scenario. My bad!


new borland libraries format dumper?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > new borland libraries format dumper?
PDA

View Full Version : new borland libraries format dumper?

_Servil_
12-24-2004, 01:39 AM
greetz everybody,

is there a description for new 'Borland Compiled Package' format available ? (*.bcp)
looks similar like dcu.
is possible to dump the signatures some way?
the omf dumper fails.
anyhow it would be handly having the signatures...
thx.


Editing Installshield CAB files.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Editing Installshield CAB files.
PDA

View Full Version : Editing Installshield CAB files.

mbro
12-24-2004, 03:53 AM
Hi All,
I am using i6comp to replace some files contained within an IS Cab file, all the files are being replaced without any complications. However prior to replacing them I am able to extract the cab file using ZipScan, but once I have made the changes I get an error telling me that Data3.cab which is a continuance of Data1.cab cant be found.
There is no data3.cab, just data1 and data2. After replacing several files in the cab files, the size goes up by about 3MB and the program doesnt install properly.

Can anyone help me with this pls, hope I have explained it OK, if not, pls ask me!

Thanks


Merry Xmas All
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Merry Xmas All
PDA

View Full Version : Merry Xmas All

Uradox
12-24-2004, 09:13 AM
Everyone have themselves a merry little christmas, hope you get what you wished for. :D
evlncrn8
12-24-2004, 07:37 PM
well i wished that noone would post a merry christmas thread, you just spoiled christmas you did ! ;p bah humbug
Woodmann
12-24-2004, 08:18 PM
Thanks for the greetings Uradox.

I hope you all have a wonderful X-mas :)

Woodmann
esther
12-24-2004, 08:39 PM
Merry Xmas And Happy Reverse Engineering New Year to all :)
JMI
12-24-2004, 09:57 PM
Let me join with Woodmann and wish everyone a Merry Christmas and a Happy New Year. :yay:

Regards,
lucid_dream
12-25-2004, 01:48 AM
Well i s'pose this is as good a place as any for my first post... Hi, Merry Xmas and Happy New Year to all.

Btw, i think this forum is a really great idea... wonder why i never found it b4 :-/
crUsAdEr
12-25-2004, 03:10 AM
Merry Christmas & a Happy New Year to everyone :)
Polaris
12-25-2004, 04:05 AM
HOHOHOHOHOHO.... Merry Xmas to all!!!!!!!!!!

Don't drink too much guys :devil:

Take care,

Polaris
Silver
12-25-2004, 02:54 PM
Indeed, a merry xmas to all of you.
dELTA
12-26-2004, 03:00 AM
Ditto dudes. :)
Uradox
12-27-2004, 05:52 AM
Hangovers anyone? :devil:
Neitsa
12-27-2004, 10:22 AM
Well, I'm a bit late but... Merry Christmas to all, and (I'm not late for that one) an Happy new year :D

Regards, Neitsa.


Cool book: "The Mezonic Agenda"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Cool book: "The Mezonic Agenda"
PDA

View Full Version : Cool book: "The Mezonic Agenda"

nikolatesla20
12-24-2004, 09:33 AM
"The Mezonic Agenda: Hacking the presidency"

If you guys get a chance to read this, it's a pretty cool book, the main character is a reverse engineer. They give reverse engineers big props in the book, stating how even most phd's in comp sci nowadays don't know how the low-level stuff works, etc. It's got encryption stuff, and stego stuff, all that, and a good story to boot.

Not trying to advertise for it, just thought it was orginal, never seen a book with so much stuff about reverse engineering before - most are only about hacking . Cracking and warez groups also get mention of course..

Syngress press.

-nt20
JMI
12-24-2004, 11:25 AM
niko:

Glad to see you got past the "666" count in time for Christmas. :yay: Sounds like it might be an interesting read.

Regards, and have a Merry,
Opcode
12-25-2004, 02:28 PM
No doubt! Pretty cool book and the contest is very interesting too!

Regards,
Opcode


unpack hasp enveloped file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unpack hasp enveloped file
PDA

View Full Version : unpack hasp enveloped file

master
12-24-2004, 01:23 PM
Hello people

I searched the whole forum for this problem:

I have 2 same files, one is hasp enveloped, the other has someone unpacked (he had the hardlock key).

Question:

Can I (and how) unpack the enveloped file with some infos from the unpacked one?
The reason why i want to unpack the same file again are some data from the licensed user written in the unpacked file
THANX A LOT
Happy hollidays!!


Reverse engineering a firmware
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Reverse engineering a firmware
PDA

View Full Version : Reverse engineering a firmware

Jan
12-25-2004, 05:48 PM
Hello!

How can I dissasemble (correctly) a image?
CPU : AMD x86 embedded

IDA isnt working well, it says I gotta point EP ..
Btw, image (part of it?) is compressed, I assume that's normal.

String inside it says :
"PKWARE Data Compression Library (R) for DOS
Copyright 1989-1995 PKWARE Inc. All Rights Reserved.
PKWARE Data Compression Library Reg. U.S. Pat. and Tm. Off.
Patent No. 5,051,745
Version 1.10"

Also interesting strings such as : "4.46-00-120110 'knevotcn'ê^@^@^W^O´t]v^@^@¬E
^C^@0^G^@hExploding file KBRIDGE.CMP => KBRIDGE.BIN
^@Done!
^@Error in compressed file! Halting..."

Thank you very much for any info that you can provide me!
JMI
12-25-2004, 08:57 PM
And, of course, you have NOT followed the instructions of the FAQ and explained what YOU have done to try to solve your own problem and have not explained what searching you have attempted, either here or on the net.

Those things are expected here BEFORE you get help from the members here.
How about you check the FAQ and start again.

Regards,
Kayaker
12-25-2004, 11:21 PM
The simple answer is you'll need to dump the uncompressed file from memory to get a correct disassembly, or explore it "live" with a debugger.

Interesting, it sounds like a non-Winzip implementation of the PKWARE compression. A guess that their .CMP extension stands for 'compressed'. So why can't you disassemble the .bin file, because it's firmware? Now outline what you've done.

Kayaker
Jan
12-26-2004, 01:26 AM
Thank you, Kayaker, for quick response!

IDA identifies it as Binary file (ofcourse) and processor type Intel 80x86 metapc. Says "IDA Pro can't identify the entry point automatically as there is no standard of binaries. Please move the what u think is an entry point and press C..."

First 3 bytes of file starts with : 0xE9, 0xB5, 0x43
At 7th byte I've got signature of firm : "Copyright 1991-2001 by XXX Inc."

Mentioned file "KBRIDGE.CMP => KBRIDGE.BIN" isnt this file. (KBRIDGE is inside this file?)
This is knrgotcn-vSOME_VER.bin

Hmm, can I 'catch' some important information while uploading this image into HW?

Btw, is it possible to debug a firmware !? Well, disassemble ok, but debug? Only if I have a emulator, right?
dELTA
12-26-2004, 03:03 AM
Packed firmware, cool. :)
.:hack3r2k:.
12-26-2004, 05:19 PM
Depends on what kind of firmware. You must first identify type of the chip-procesor used by the device using that firmware. After this only thing that remained is to select type of it in ida like ARM, C166, ATMEL, MOT etc. For real debugging of firmware exist specialized external hardware with dedicated software. Also u can use software emulator for those much better then ida. Also must take care if the firmware is crypted or not. For example in new NOKIA devices this firmware is stored crypted in flash chips and decrypted on fly while running. offcourse u need a good knowledge of instruction sets different "bugs" u may study.

Br;)
.:hack3r2k:.
12-26-2004, 05:25 PM
If data is sended by serial port u may catch it using a serial sniffer. Also bad bad is that bootloader of the device could take care of data while sended.

Br;)
Jan
12-26-2004, 07:05 PM
Ok, I've got more information :

CPU :
STPC Elite
32-bit 5x86 core with L1 cache and FPU

http://us.st.com/stonline/products/support/micro/stpc/elite.htm
halvar
12-28-2004, 01:59 PM
From my experience dealing with embedded devices:

Debugging in any manner is usually not an option, as ROM does not permit
setting breakpoints inside. The limited debugging capabilities you might have
usually do not include setting debug register breakpoints, so for me debugging
was pretty much out of the picture.

When faced with the flat executable, you can proceed in different ways:
You could manually track the floppy boot loader. If it's an x86 system, the
device will boot from the ROM image just as if it was a floppy with boot sector,
and then you'll have some very retro DMA code to transfer stuff into memory
and unpack. The disadvantage here is that you don't really care about most
of the code, statically emulating a pkunzip routine is rarely fun. What I used
with great success is grepping the ROM image for PK headers, then using
your favourite hex editor to carve .zip files out of it. Unpack, and repeat
the process (many ROM's have multiple layer of zipping -- e.g. a bootstrap
layer that unzips and loads an embedded OS image that unzips and loads
a bunch of executables). Once you've reached the end, you take a few
educated guesses as to what file format you have in front of you -- in
many cases it'll be ELF or a.out.

The odds of encountering a file format for which IDA has no loader are low,
as most larger embedded devices have their software written in C and
compiled to a.out or something.

I am _very_ interested in hearing more feedback on this, and in talking
to more people that are into ROM disassemblies. It's an important hobby
of mine these days, and I'd like to meet likeminded people :)

Cheers,
Halvar
zexbig
01-04-2005, 12:55 PM
firmware is uploaded to device with snmp, you connect cross cable between pc and device and with provided application you connect to device with snmp and then upload firmware and key with application.
It's not serial connection.
Jan
01-04-2005, 02:23 PM
halvar,

Sorry, I've been away. I'll check your advice and look more into it...

I'll keep you posted, if you're interested ...
halvar
01-06-2005, 03:34 PM
Cool :-)
Polaris
01-06-2005, 04:22 PM
I'll keep you posted, if you're interested ...

It's really interesting! :yay:
Jan
01-11-2005, 08:46 AM
Ok, I've done next step by identifying couple of instructions...
Looking for 3 bytes (push ebp; mov ebp, esp) gives me couple of small routines. Code seems valid, except addresses used in instructions seems wild (read: big, not-normal), but I dont have expirience with firmware so maybe data is mapped at that location (?).

File is custom format...

It's holding loader, BIOS, drivers, ... inside it, so any advice on how to identify it and taking it apart ... ?

As I said before, it's x86 compatible so I'm disassembling it with correct tool (IDA)...
halvar
01-11-2005, 11:19 AM
Check an old x86 book on boot loaders -- there's an offset in the file
at which the code will start to execute. It will start in 16-bit mode, and
then usually do something like set up descriptor tables and switch into
pmode.
Jan
01-12-2005, 02:48 PM
Ok, Halvar, I'm looking more into it, but not that easy ...

Disassembling inside IDA with code as 16 bit (2 choice at beginning : 16bit or 32bit code) looks much more better.
Still no EP, since it's unknown file format, BUT IDA disassembles couple of routines automatic!

I'm getting crazy now ...

I've uploaded stuff here :

hXXp://web.vip.hr/fritz_hr.vip/image.bin
hXXp://web.vip.hr/fritz_hr.vip/KCFLDR

If anyone get anywhere with this, I'm be incredible happy and I'll continue to move on with my life... :)
halvar
01-12-2005, 02:55 PM
It is crucial that you start the disassembly at the entry point,
e.g. at the point where the boot loader would start. Check some
old boot disk code -- in the case of Cisco PIX you just started
at the offset that a boot disk loader would start, and you had
a fairly quick switch into protected mode afterwards. Then go
from there. "Blindly" disassembling the file will yield bad results
because you can't tell if a particular piece of code will be executed
in 16 bit or 32 bit mode if you do so.
Jan
01-12-2005, 03:54 PM
Halvar,
Thank you for your replies, since anyone else of reversers isnt familiar with this subject...

I've taked some small time and checked boot process ...
Status I've done so far :
http://web.vip.hr/karlit0.vip/re1.txt

As you will see, I'm stuck on jumping to next part of code...
Which is mapped somewhere where I can't go untill I figure out memory part ... Right?
halvar
01-12-2005, 04:07 PM
Hey Jan,

this looks fairly standard -- it just reads the file from the "disk" (rom),
and sets up the segments. You probably need to read sub_95A6 and
see where on the disk it "seeks" to, and the textfile isn't complete
enough to understand things. How come the code is starting at 0x9494 ?
That is not the standard offset for boot loaders...

The trick is to understand how that thing sets up memory, e.g. which
parts of the rom are moved into segment 7D0. Then start setting up
things in IDA properly and move there.

It is a bit of tedious and oldschool work, but ROM disasm is soo omuch
fun...

Sorry for not posting more disasm results myself, my life is a bit crazy
right now (exam time in uni + private shit).

Cheers,
Halvar
Jan
01-12-2005, 04:35 PM
Halvar,

sub_95A6 is pretty short. As u can see here :
(link below)
EP isnt at that offset, 0x9494
Oh ... damn ... :)
EP : It's starts at offset 0x0000...
Sorry, this new disassembling in 16bit reveals much different output and I was confused also (I'm tired of exams on unis. also ... ) :)

There is much more code before this one in re1.txt

Additional info,check this out :
hXXp://web.vip.hr/karlit0.vip/re2.txt

I'll have to check can somehow be showed/emulated next part of memory at next segment 7D0 in IDA ...
Jan
01-12-2005, 04:48 PM
After more understanding situation, I think I can be more specific now with my goal.

I'm interested in one algorithm (protection part) in this firmware.
Commented part of disassembly, that's from KCFLDR. That is BIOS + loader, maybe I shouldn't work on this at all...

Since goal-part that I'm chasing, as I suspect, is in image.bin
The problem with image.bin, it's also unknown file format, seems partionally packed with PKWARE as there are strings inside and IDA can't do much work as done in KCFLDR (which isnt packed).

What's the next step in this long journey ... ?
zexbig
01-13-2005, 05:27 PM
I think that is preaty safe to say that loader does not have any protection scheme inside it, becouse that loader is used also on rg device and many others.
Jan, did you discover wich file format is used with older version of image.bin 3.x ?
OddbOd
01-14-2005, 08:21 AM
:thinking: What protection? It would appear that there is none, and, that the packing algorithm used has been identified. My suggestion would be to head over to the DataCompression.info Lempel-Ziv page which links to a description of the format and also some source for unpacking it. http://datacompression.info/LZSS.shtml
Packed firmware, cool.
Yes, but more common than you may think. My PocketPC ROM contains mostly packed binaries, as I discovered when attempting to create custom flashes for it.
Jan
01-15-2005, 08:01 AM
Ok, I'm getting somewhere...step by step... :)

Thank you for that information.
Now I know that PKWARE DCL is used here and that it's not public compression/format.
But, some Ben did RE on it and thanks to him, Mark Adler (zlib) wrote a decompressor (zlib/contrib/blast).

Now, the problem is how to locate compressed stream...
It looks simple, format, but this one is inside a image and that's a problem.

Anyone?

with respect,
Jan
Anticode
01-16-2005, 12:07 PM
from http://groups.google.com/groups?q=author:Ben+author:Rudiak-Gould&hl=en&rnum=1&selm=34259d52.0108131038.21dd88f9%40posting.google.com

A PKWARE Data Compression Library compressed stream consists of a
two-byte header followed by a bitstream of arbitrary length.

The first byte of the header is either 0 or 1, and determines the way
in which literal bytes are represented in the bitstream (see below).

The second byte of the header is equal to 4, 5, or 6, and determines
the size of the sliding-window dictionary: 4, 5, and 6 indicate a 1K,
2K and 4K dictionary respectively.

this might cut down the possibilities.

Anti.
Jan
01-16-2005, 02:11 PM
Anticode,

Yes, thank you, but I've seen it, as oddbog pointed me before.
The problem was with locating it inside a file. That you for that header,but .. still...
I was speaking with compression guru, M. A., he said that I should start decompressing all, moving step by step, untill decompressed output makes sense.
So, I'll start with that. The problem is, as u know, decompressed output isnt text, it's code so I need to decompress and disassemble every time...

Sounds like a long journey ... :(

with respect,
Jan
zexbig
01-17-2005, 10:30 AM
Well if are in compresed file you have some strings, you will know when you uncompress from right start byte.
Anticode
01-18-2005, 02:43 AM
I was speaking with compression guru, M. A., he said that I should start decompressing all, moving step by step, untill decompressed output makes sense.

According to this method:
1) Decompress the stream, disassemble the output, see if it makes sence.
Yes -> done.
No -> advance one byte, jump to step 1).

You get tens thoushand of possibilities. not to mention the hard work and waisted time.

My Method:
1) Binary scan the file for these patterns:
00h,04h
00h,05h
00h,06h
01h,04h
01h,05h
01h,06h
and mark those addresses.
2) Decompress the stream at the current addresses, disassemble the output, see if it makes sence.
Yes -> done.
No -> advance to next address in the list, jump to step 2).

You get few hundred possibilities max.

Now what method a wise man would choose!?
WaxfordSqueers
01-18-2005, 03:45 AM
First 3 bytes of file starts with : 0xE9, 0xB5, 0x43

I'm a little out of my league in this section of the forum, but I've worked as a computer tech in the past. The E9 seems to be a jump instruction and that would make sense. It's probably a bootstrap loader.

If you load it in IDA as a binary, highlight the E9, and change it to code, it might unfold a whole bunch more code for you. That would depend on you finding the correct start of code, however (try 0x0 and 0x100...like in an old COM file). As I recall. however, you have to tell IDA whether it's 16 or 32 bit on the way in, and I think you have to set up your own segments. I've had luck with bin files in the past using just one segment.
thewhiz
01-19-2005, 02:08 PM
It is crucial that you start the disassembly at the entry point,
e.g. at the point where the boot loader would start. Check some
old boot disk code -- in the case of Cisco PIX you just started
at the offset that a boot disk loader would start, and you had
a fairly quick switch into protected mode afterwards. Then go
from there.

Well, at least on newer PIX images, the meat of the OS are contained in a pkzipped file that is decompressed via a secondary boot stage, unless they went back to their older flat file format recently?
halvar
01-19-2005, 03:56 PM
No, PIX (or any larger Cisco device) is still best
done by looking for the PK headers and dumping the
zip files out of the .bin. This doesn't change the fact
that if there's no zip headers in the image file, you'll
have no choice but to disassemble the boot loader
and see what it does :)
Jan
01-29-2005, 09:24 AM
First, moderators, excuse me for reviving old thread.

Hello Halvar, Anticode & thewhiz.
I'm pretty busy with college, exams ...

Anyway, I dont have much time for doing this, so disassembling the bootloader and analyzing every step-by-step is pretty long journey, as we all know.

I was thinking lastnight ... how could I debug a bootloader and code after that...
The problem is that it wouldn't be classic debugging, since this isn't under any OS so we can pullout the debugger and start hacking...
So, solution would be debugging a whole 'computer'... Like if there would be machine under machine... Then it hit me, virtual computer (vmware, bochs, ...).
After looking, there is no such thing that can debug EVERY step in virtual computer except bochs. Bochs support such operations. So, I'll have to load that loader under Bochs and debug it. Then I could analyze everything I need... even dumping from there a uncompressed image ... right?

I was talking with Bochs developers and they said that Bochs would be solution, yes.

Looks like new approach :)

Comments?
thewhiz
01-29-2005, 04:36 PM
Bochs would be an interesting solution to this problem. I have personally used a hardware approach to this in the past -- an incircuit emulator, but that is generally cost prohibitive to the average hacker.


Window handles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Window handles
PDA

View Full Version : Window handles

Quell
12-26-2004, 01:38 AM
Hey.
i tried to get a window handle of a button in a win32 application under windows xp. I used the Spy++ to try to get the name of the button, however i could not select the button, i could only select the area around it. I also used Winspector Spy(free imitation of spy++)
same problem.
I am positive i can't find any info about this. I looked on msdn on documentation to spy++
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vcug98/html/_asug_opening_window_properties.asp

any ideas on why i can't select the button, i can only select the dialog box itself?
thx
TQN
12-26-2004, 03:33 AM
This can be a windowless control, such as TBitBtn in Delphi, some button in VB as I know. They do not have a window handle, instead of they will be drawed directly on the area of parent control.
Quell
12-26-2004, 11:17 AM
is there a way to be sure if it is windowless?
when i move my find window tool over the window i get that is is of "Surface" class. So i figure it is a custom class.
I found some of the .res file:

"LoginButton"
{
"ControlName" "Button"
"fieldName" "LoginButton"
"xpos" "120"
"ypos" "117"
"wide" "80"
"tall" "24"
"autoResize" "0"
"pinCorner" "0"
"visible" "1"
"enabled" "1"
"tabPosition" "3"
"labelText" "#Login_Btn"
"textAlignment" "west"
"dulltext" "0"
"brighttext" "0"
"wrap" "0"
"Command" "Login"
"Default" "1"
}

Any ideas if this button resource is suaully used as a window or not. just by assosiation, have anyone seen a resource declaation like this an was it used as a window or not?


A few tips please
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A few tips please
PDA

View Full Version : A few tips please

Emerson
12-26-2004, 06:29 PM
Hi,

I'm looking for a few tips on how I should look at code when I'm reversing it with regards to using it in a keygen. Below is a small section from a real app's serial validation routine. I guess I'm after the thought process that you would have when looking at this code. Theres 2 variables, Hardware ID and serial. They are marked accordingly. The routine should return EAX = 1 if all is well.

Something along the lines of :-

Ok, we start at the bottom and work up. From the NEG EAX down simply equates to :- IF EAX = 0 THEN EAX = 1

Then above that we have XOR EAX, EDX. So at this point EAX must equal EDX to make the above line true.

Up again is :-
SHR EAX, 8
AND DL, 0
Ok, So we are only interested in the middle 16 bits of EAX as the roll will zero out the top 8 and the AND will nuke the bottom 8.

Up once more is XOR EDX, ECX. As the step above will SHR, the importaint bits are only the top 16. So the top 16 bits of both registers must match here.

And so on........ (I could probably explain like this all the way to the top but I just cant seem to rewrite it from the bottom up, or even if this is how I should attack it)

XOR EAX, EAX
MOV ECX, DWORD PTR SS:[EBP+8] << Serial (DWORD)
MOV EDX, ECX
ADD ECX, 6AECED9F
IMUL EDX, EDX,8497123
SUB EAX, EDX
MOV EDX, DWORD PTR SS:[EBP+C] << Hardware ID (DWORD)
IMUL EDX, EDX,16846817
SUB EAX, 65101561
XOR EDX, ECX
SHR EAX, 8
AND DL, 0
XOR EAX, EDX
NEG EAX
SBB EAX, EAX
INC EAX

I've already fished a working serial for my machine, but I've been reasonably sucessful at serial fishing for some time and I'm starting to feel a bit lame now when I find algo's that look simple to reverse and I dont do it. I'm also thinking that maybe I'm reading to much detail and not looking at the whole, so to speak. Kinda like reading a sentence where each word has little meaning until the whole sentence is read. Know what I mean ?

No solutions yet please, I dont think that would help me much at the moment.

Thanks,
Emerson
quantumbarrier
12-27-2004, 05:08 AM
because eax must equal edx at line "xor eax, edx", i came up with this equation (x is the serial):

(0 - (x IMUL 8497123) - 65101561) SHR 8 = ((hardwareid IMUL 16846817) XOR (x + 6AECED9F)) & FFFFFF00

i tried to transform the equation to "x = ..." but failed. (i can't even say if it's at all possible or if you'll have to brute your way to a correct serial.) i'll leave that to others :)
Emerson: please post solution when you're done.
Emerson
12-28-2004, 11:21 AM
Hi quantumbarrier,

I'm gonna come back to it now with a fresh mind....

Out of interest I had to brute a serial and here is a valid pair !!

HardwareID = 373A0830
Serial = 77710A89

I'll post my solution as\if\when I solve it
naides
12-28-2004, 12:58 PM
Suggestions:

Do your operations simultaneously in binary and hex (excel can handle it for you)
Pay very close attention to the SIGNED character of the imul operation, because the bit extension details in signed integers.


SoftICE / bpx
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SoftICE / bpx
PDA

View Full Version : SoftICE / bpx

izik
12-27-2004, 01:32 PM
Hello,

I've got Windows XP (SP1) and SoftICE installion went pretty quick and painless. afteward i've started to play with it a little and tried to parctice few bpx's. that's when i've discover that SoftICE doesn't break in (or out) on anything that i've set.

I've the tried the usual MessageBox, MessageBoxExA calls and i've got few crackme's that are using those api calls (i've double check that) but still SoftICE ignores it.

I've went and checked the company homepage, they do say that it's problmetic to run SoftICE over new platforms and i've went through all the soultions. inculding replacing the 'OSINFO.DAT' and the 'NTSYMBOLS=YES' and still nothing working. i've also tried few versions of SoftICE and still nothing :|

Has anyone ran into this issue before? anyone can suggest a patch nor soultion?

Thanks in advance!
ZaiRoN
12-27-2004, 01:35 PM
Hi, did you read the faq?
izik
12-27-2004, 01:42 PM
Hello,

Yes, i've read the faq and also been in http://frontline.compuware.com/nashua/kb/doc/1846.asp

And i've 1st took it with DriverStudio v3.1 and it's still doesn't work :|

I've also got SoftICE Lite (?) which suppose (at least by the .NFO)
to be perfectly working on both Windows XP (SP1) and NT (SP4)

Have i missed something? i've also tried to re-create the symbol (.pdb/.dbg)
from my current osntkrnl.exe and push it to SoftICE, didn't made any change.

I did something wrong here?
Kayaker
12-27-2004, 03:15 PM
Yes, i've read the faq
Hi

And of course you read with great interest the section of the faq entitled

I am not able to set breakpoint with new version of Softice (on NT system)?

...looked at the threads mentioned in the answer, explored the "Similar Threads" that were linked to on those pages, exhausted all the documentation that comes with the software, and still are having problems? Oh my.

Kayaker
JMI
12-27-2004, 06:54 PM
Those kayak paddlers are always very subtle. :yay:

Regards,
Kayaker
12-28-2004, 01:08 AM
Not so subtle I hope that the poster doesn't pick up on the importance of 'Context' when setting Softice breakpoints... ;)
izik
12-28-2004, 02:16 AM
Oh my, i was so tired last night i've skipped right over that paragraph. i'm extermly sorry the problme was indeed solved using 'addr' before 'bpx' !

I have to mention that the tons of cracking tutorials and i think pretty much almost all SoftICE tutorials out there are talking about 'bpx' without 'addr'
which is very confusing. made me think the problme was SoftICE itself nor the way i'm programming it to work ... :-/

Thanks for your help guys! And i'm sorry again for rushing it without fully going over your faq. honestly after a long day of fighting with SoftICE and endless reboots, i had enough. Thanks once again!
JMI
12-28-2004, 11:16 AM
And the REASON most of those tuts do not mention the use of context sensitive breakpoints is because they did not become context sensitive until the more recent versions of SICE. :idea: But as you will find in the Threads here on the subject of the recent versions of the software, now they are. :yay:

Regards,
dev_zero
01-22-2005, 06:54 PM
Oh my, i was so tired last night i've skipped right over that paragraph. i'm extermly sorry the problme was indeed solved using 'addr' before 'bpx' !

I have to mention that the tons of cracking tutorials and i think pretty much almost all SoftICE tutorials out there are talking about 'bpx' without 'addr'
which is very confusing. made me think the problme was SoftICE itself nor the way i'm programming it to work ... :-/

Thanks for your help guys! And i'm sorry again for rushing it without fully going over your faq. honestly after a long day of fighting with SoftICE and endless reboots, i had enough. Thanks once again!
That is true, that many tutorials leave the addr out. But they say that you should read the SoftICE manual.. Have you read it? Many functions to learn..
sigint33
01-22-2005, 09:26 PM
You could also look 4 threads down - SoftIce patch for NT/XP is discussed.

SiGiNT
dev_zero
01-23-2005, 06:30 AM
You could also look 4 threads down - SoftIce patch for NT/XP is discussed.

SiGiNT

I think he's trying to get DriverStudio 3.1 to work, not SoftICE 4.05..
sigint33
01-23-2005, 12:54 PM
HMMMM!

He says SoftICE, and later says tried DiverStudio also.

SiGiNT
bestobest
01-23-2005, 05:41 PM
Hello,

Has anyone ran into this issue before? anyone can suggest a patch nor soultion?

Thanks in advance!
have uread the post by bestobest


VB resource editor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > VB resource editor
PDA

View Full Version : VB resource editor

Quell
12-27-2004, 11:33 PM
Hey.
does anyone know of any vb resrouce editor?
usually i would just edit the data maually, but in some cases it is a bitch to scroll through hundrends of dialog boxes to find the right one.
Silver
12-28-2004, 06:23 AM
Not even remotely close to an answer to your question, but I found this MSDN page which may be useful in future.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vcresed/html/_asug_Overview.3a_.Resource_Editors.asp
Quell
12-28-2004, 09:57 AM
it is not execlty what i looked for but it good some good stuff on it thx.
disavowed
12-28-2004, 04:19 PM
http://protools.reverse-engineering.net/files/decompilers/vbde.zip

try searching next time
JMI
12-28-2004, 07:10 PM
Or BEFORE you ask for something which is forbidden by the FAQ which you were supposed to have alread READ. :idea:

Regards,
Kayaker
12-28-2004, 07:46 PM
Hmm, I hadn't realized Protools got hacked too, and it looks like they never got all the mess cleaned up. The link disa gave is OK, the main page etc. is OK, but try to shortcut directly to the directory without specifying the index.html file and you get the same hackers page Anticrack etc. got hit with...i.e.

http://protools.reverse-engineering.net/files/decompilers/
http://protools.reverse-engineering.net/files/patchers/
Zero
12-30-2004, 01:51 AM
Seems that they exchanged files in the subdirectories as well...
I will fix the subdirectory index files when I am back home...


Installshield v6.31 problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Installshield v6.31 problem
PDA

View Full Version : Installshield v6.31 problem

Mr.Red
12-29-2004, 07:19 AM
Hi - first of all I have to say great work to Morlac for his i6comp util, which
works great in most cases. But a few days ago I found myself in the situation
that I needed to first of all, list the contents of a Installshield .CAB archive,
thus being able to remove components that was not necessary. And at
earlier times, i6comp have been working great for that matter.

Though this time it complained about missing header file (data2.hdr), while
the package only ships with one header file (data1.hdr for data1.cab). And
thus leaving me without a possible sollution. I've tried other ways of
approaching it, using other tools, but they are either outdated, or not
good for this matter.

Which leaves me with these questions:

1) Is it possible to create a header file for this type of installation?
- even though originally it does not have a header file.
2) Are there any other sollutions that I might have missed?

Installshield setup version: 6.31.100.1190

Any help would be most appreaciated.
Woodmann
12-29-2004, 08:10 PM
Howdy,

"1) Is it possible to create a header file for this type of installation?
- even though originally it does not have a header file.

You said it has a header file, data1.hdr.
You can create header files although, how do you know what is needed to create a data2.hdr file ? what info is it looking for ?

Woodmann
Mr.Red
12-29-2004, 08:40 PM
I guess I should have made it a bit more clear, the package contains of
two .cab files (data1.cab and data2.cab), while data1.cab got an header
file with it - namely data1.hdr, data2.cab does not, and i6comp complains
about missing header file when trying to extract/list the contents of that
particular CAB file - and of course, its data2.cab I need the data from.

Hopefully that made it a bit more clear on what the exact problem is - and
since most of the problems I found around the NET, and on the board here
covered other aspects of Installshield - and its CAB files, I was left without
a clue on how to approach it - other than the obvious of re-creating the
header file.

And regarding what information it looks for - I guess i6comp is written so
that it bases itself on the information that is stored in the header files, thus
without the header files, it's not possible to use that particular tool to
even view the CAB files. In other words, what I am trying to achieve is to
get the index (in term of i6comp) of the files in that particular CAB file, so
that I can determine what files is needed, and whom could be deleted.

Thanks in advance!
Woodmann
12-29-2004, 08:47 PM
There are utilities to extract .cab files if this is what you desire.

CabExtract ???

Woodmann
Mr.Red
12-29-2004, 09:04 PM
The different tools I've tested - where a few of them was named CABExtract,
then those of which I've tested have either been tools spesifically for
Microsoft Cabinet Archives - or similar, but not accepting Installshield CAB
files - and further tested CAB tools that have been able to handle different
types of cabinet compression methods like MSZIP, Quantum, LZX and others.

Further, I also tested ZipScan v2.2 - which gives you the ability to extract
CAB files (both Microsoft and Installshield), but this one, only managed to
open the data1.cab file, while the big one data2.cab file, which actually
contains the programdata, was not possible to open.

I know there are tools for *nix as well, though from where I am at the
moment I can only use Windows based tools, leaving me a bit capped on
the possibillities. I wouldn't be surprised if there are *nix based tools that
would work great, though not an option for me right now. If it turns out
that it would be the only sollution, then I would just need to let the project
rest untill vacation is at an end, and undertake it again at a later stage.

The tool / sollution, needs to give me option to;
a) List/Delete - or -
b) Extract/Compress

Thanks for the rather quick answer, most appreaciated :)
Woodmann
12-29-2004, 09:19 PM
Hi,

Lets try ISCAB.exe ?? Or something like that.
If you search the installshield site, I am sure you will find something to help you.

The only other thing is to rebuild the entire project using your own header files.
I do not think this is necessary.

Woodmann
mbro
01-12-2005, 05:30 AM
Woodmann, I am in a similar position to this guy, and I tried ISCAB, but then setup complained about an invalid Support file. What I did was use ISCAB to list the files, then selected to replace the dll that I had amended, then when I ran ISCAB to update all was ok. However when I run setup I get the error I mentioned about an invalid Support file.
How would I go about rebuilding a project from header files? A pointer to a tut or any help would be appreciated.

Thanks
Rackmount
01-12-2005, 10:31 AM
I am curious, if the package initially discussed comes with two cab files, can they be installed as is in the usual manner? Could the information of header2 be contained in the header1 file? This is out of my area of knowledge, but it would seem that if the package is capable of being installed, then the header2 information must be present somewhere.
jsteed
01-13-2005, 10:02 AM
Rackmount,
The information for data2.cab is indeed in the data1.hdr. I don't think iscab.exe will work in this situation. Try using the cab file viewer that comes with Installshield X Studio. It's GUI, not console based. With it, you can view the contents and extract the files from either cab.
WaxfordSqueers
01-16-2005, 02:15 AM
How would I go about rebuilding a project from header files? A pointer to a tut or any help would be appreciated.Thanks

I don't know if I understand the question, but here are some things to consider:

1)assuming the app will run normally, is it dumping it's cab files along the way in a remote directory? Use filemon to find out.

2)if it's too smart for that, can you start the program using symbol loader and trace it manually in softice till it opens it's cabs? You can use break points to skip over large chunks of code, or bpx in where the last Installshield window appears. You may run into anti-ice tricks, or the app may be packed, but what's that to this outfit?

3)there used to be an Installshield script debugger. Is a later version available? Or am I so out of touch that Installshield is suddenly impossible to trick?

4)are you using an updated version of i5comp or i6comp? I got caught with that one a while back. The earlier versions of the same wont open the cab files.


Attaching a .res file to a process
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Attaching a .res file to a process
PDA

View Full Version : Attaching a .res file to a process

Quell
12-29-2004, 12:14 PM
hey.
i was wondering if anyone knows how to load a .res file inot a running process so it would show it?
i want to do this programeticly/
any ideas?
thx
JMI
12-29-2004, 12:18 PM
Yes. Read the Damn FAQ and provide the information that your are supposed to provide about what you have done to try to solve your own problem, such as whether you have attempted to search, both here and on the net for answers, and what you have actually tried to do YOURSELF, besides ask a question here, without actually reading the FAQ.
:boo:

Regards,
Quell
12-29-2004, 12:40 PM
fine i read the faq, here is modified post:
1. What is the problem.:
I need to load a .res file into a process.
2. What is the protection.
None, this is just a programming quesiotion.
3. What tools are you using.
A c compiler.
4. What tutorials have you read.
Read tutorial on injection.
5. Show your output listing WITH comments.
No output so far. I can laod teh dll correctly inot a process.
6. NOW ask your question
How do i load a .res to show teh dialog box etc.....
I was going to do this using a dll injecting inot the process, then load teh .;res file from the dll.
I have the injectiong code done, and i have a skeleton of the dll to be injected.
The only problems is how do i load a .res file.
Is this posted in a correct manager?
P.S. i ahve searched teh google, foudn nothing on loading .res files with c/c++.
JMI
12-29-2004, 01:24 PM
Point two:

ACTUALLY READ your post and LOOK for OBVIOUS spelling/typing errors.

"No output so far. I can laod teh dll correctly inot a process."

"How do i load a .res to show teh dialog box etc.....
I was going to do this using a dll injecting inot the process, then load teh .;res file from the dll."

"P.S. i ahve searched teh google, foudn nothing on loading .res files with c/c++."

These are SIMPLE typing errors caused by NOT PAYING ATTENTION TO WHAT YOU TYPE. USE A SPELL CHECKER. There is an EDIT BUTTON you can use to correct these errors. You spoil the whole effect of your question by not caring enough to catch these errors and you turn off many of those who might otherwise attempt to help you. :idea:

Regards,
Kayaker
12-29-2004, 01:27 PM
Hello ReVeR... :devil:
JMI
12-29-2004, 01:29 PM
Good call. :yay: Forgot to check. :rolleyes: Looks like he's about to get deleted again. :idea:

Regards,
Quell
12-29-2004, 01:31 PM
sorry for the above crap,will not happen again.Another repost:
fine i read the FAQ, here is modified post:
1. What is the problem.:
I need to load a .res file into a process.
2. What is the protection.
None, this is just a programming question.
3. What tools are you using.
A c compiler.
4. What tutorials have you read.
Read tutorial on injection.
5. Show your output listing WITH comments.
No output so far. I can load the dll correctly into a process.
6. NOW ask your question
How do i load a .res to show the dialog box etc.....
I was going to do this using a dll injecting into the process, then load the .;res file from the dll.
I have the injection code done, and i have a skeleton of the dll to be injected.
The only problems is how do i load a .res file.
Is this posted in a correct manager?
P.S. i have searched the google, found nothing on loading .res files with c/c++.
Quell
12-29-2004, 01:32 PM
dam it, will need a new e mail.....:P oh wtf, will get me another proxy as well :D
JMI
12-29-2004, 01:36 PM
Point three:

PAY ATTENTION. I clearly stated that you could use the edit button to correct your typing errors. There was NO NEED to type the whole damn thing again. That's how one makes corrections. Hit the edit button and correct any obvious errors. I make typing errors all the time and try to catch and correct them by editing what I post.

Since you have a history here, you will be watched carefully for further blatant failures to conform to the minimum expected from posters here. And we know about your proxies. The problem is that you can't disguise that you simply chose to ignore the rules and that your questions, themselves, give you away.

Regards,
Kayaker
12-29-2004, 06:52 PM
Oh My Gosh, do I detect a readable sentence and semi-comprehensible question? :eek:

Having understood the words, I'm not sure exactly what you're trying to do. From your other posts it sounds like you extracted a .res dialog from some program and you're trying to get it to "show" through an injected dll? Since you're writing the dll itself you should be able to import the dialog .res file as a new resource, same as a bitmap or icon. Recompile the dll and you should see the new resource in Reshacker say. Now you need to make use of the res binary.

I'm not sure why you'd want use an external dialog box when you can recreate it any way you wish, including duplicating resource Ids. All it is is a shell with buttons you press. If you're trying to duplicate a dialog so you can enter data from your injected dll, you still need dialog box procedure code to tie it to, which was presumably in your target program.

I'm lost as to the purpose of this, but look into using either a CreateDialog* routine, or the sequence FindResource, LoadResource, LockResource to make programmatic use of resources. There are examples in the Asm forums, I'd search there for examples. Search, and please don't ask them.

Kayaker
Aimless
12-29-2004, 11:13 PM
1. Create a new resource
2. Put the resource in a dll file
3. Run your application
4. Inject the dll into the memory space of that application (You'll have to find out how...but many tuts available on google if you search for: dll injection)
5. Modify the application space so that the call points to the call in your injected dll which uses the resource.
6. Enjoy.

Have Phun
Aimless
12-29-2004, 11:14 PM
Don't forget to return back to your application from the dll call you just made, LOL.

Have Phun
Quell
12-30-2004, 12:21 AM
thx all, i got it now.
Fake51
12-30-2004, 06:25 AM
Point two:

ACTUALLY READ your post and LOOK for OBVIOUS spelling/typing errors.

Damn, posting around here is gettin real hard.

You spoil the whole effect of your question by not caring enough to catch these errors and you trun off many of those who might otherwise attempt to help you. :idea:

Heh, couldn't help myself. Did you do that on purpose? :)

Fake
JMI
12-30-2004, 12:36 PM
Nope. :eek: But that one was probably an "eyesight" problem. When the eyes get tired, the vision is more blurred. :idea:

But remember I also stated: "I make typing errors all the time and try to catch and correct them by editing what I post." That one I missed, but I did correct a couple of others in that post. :smug:

Regards,
Fake51
12-31-2004, 06:08 AM
Basically I agree with you, and in the case of born englishspeakers it's sad to see a neglect of the language (as in examples of what you're talking about). The only thing to consider, ofcourse, is that this board attracts quite a few nationalities, many of which don't use english as a first language.

Basically, it just seemed funny that standards are going up up up :) No longer enough just to read the faq and behave accordingly ;)

Fake


New i2s -> 4.03
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New i2s -> 4.03
PDA

View Full Version : New i2s -> 4.03

Mostek
12-29-2004, 12:30 PM
4.03: Fixed a bug and changed memory management a little.

http://mostek.subcultural.com/IDA/ida2sice_403.rar
JMI
12-29-2004, 01:27 PM
Thanks, as always.

Regards,


New i2s -> 4.04
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New i2s -> 4.04
PDA

View Full Version : New i2s -> 4.04

Mostek
12-29-2004, 05:21 PM
[ 29.12.2004 ]
It looks today I'm in the mooood.
4.04: Fixed a bug with original file reading(if properties of the missing segment needs to be read).

Anyway forget to mention there is also a small update to n2t utility.

http://mostek.subcultural.com/IDA/ida2sice_404.rar

Peace
Mostek
JMI
12-29-2004, 05:36 PM
Well alright then, Thanks once again for your contributions. :yay:

Regards,


How to edit instruction in IDA pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > How to edit instruction in IDA pro
PDA

View Full Version : How to edit instruction in IDA pro

viewer
12-29-2004, 10:33 PM
I use IDA pro 4.7.0 as a run-time debugger. When I used OllyDbg, I can edit instruction or operand by press space bar. But I can`t find a menu in IDA pro. Is there anyone who knows it? please let me know...
ZaiRoN
12-30-2004, 05:03 AM
Once again we have a new user that make his first post without reading a single line of the FAQ (http://www.woodmann.com/fravia/rce-faq.htm). The answer to your question is not in the faq but, you will find a hint in the faq that will lead you to the answer of your question.

I won't tell you anything else, take my post as a stupid riddle :D

Good luck,
ZaiRoN
JMI
12-30-2004, 12:42 PM
Hey ZaiRoN:

It's not a "stupid riddle." You put him on the correct path through the dark codewoods and now it's time for him to try to find his own way. :yay:

Regards,
bestobest
12-31-2004, 05:51 PM
I won't tell you anything else, take my post as a stupid riddle :D

Good luck,
ZaiRoN[/QUOTE]
Love that riddle


C++ Object editor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > C++ Object editor
PDA

View Full Version : C++ Object editor

halvar
12-30-2004, 05:10 AM
Hey all,

we all see lots of OOP/C++ code nowadays, and I have had an idea
spooking around in my head for the last few years, but never time
or motivation to actually tackle it:

A C++ object editor. This would work via interfacing with a disassembler
(IDA?) to identify vtables, and then to search for pointers to the vtable
in a process address space. By doing so, all instances of a particular object
could be found. If fed with a prototype for the class, one could build a
run-time object viewer/editor where all fields of the object could be view/
editable.

Very useful for hijacking/monitoring method calls, too.

Cheers,
Halvar
Silver
12-30-2004, 07:21 AM
That would be handy. I recall a discussion about this before (somewhere other than this forum). I think one of the major sticking points was inheritance, it became extremely difficult to infer inheritance and heirarchy from the asm. Technically you wouldn't need to give it the class prototype, it "should" be able to infer it from code. Where things will really fall down is with non-contiguous prototypes, for example members included in the prototype but not used in the code. That would really screw any pointer work...

I'd need to have a proper think about it, but I have that feeling that tells me there are some pretty important obstacles we'd need to figure out first. I came across pdf of a book about OO asm once, fairly old but very in depth. Perhaps that may be of use for ideas.
halvar
12-30-2004, 09:22 AM
Telling inheritance can be done by examining constructors -- a constructor
that calls another constructor of a class A w/o changing the this pointer is either a
constructor of a class derived from A or has A as first member. The class prototype
is tricky -- we can't necessarily tell type from the constructor alone (but we should
be able to infer member boundaries from it).

I am not sure wether we need to tell inheritance -- if the RE can provide a prototype
and a vtable address, there's no need for us to know the relation between the
objects inheritance-wise.


Ollydebug access violation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Ollydebug access violation
PDA

View Full Version : Ollydebug access violation

Quell
12-30-2004, 09:49 AM
Hey.
i have a problem.
Olly debug gives me access violation.Why?
My os is windows xp pro. No SP's installed
when i debug an application in olly debug i constanly get access violation at 0x000000 . I figures this has something to do with how the memroy is being open to be read? Or trying to delete a pointer that has already been deleted?
So i figure this is a problem on behalf of the debugee.
I read some web sites and i found a way to stop this from being a problem(unchecking break on access violations in debug options).
But i was wondereing if it is Olly causing these problem? Or was i right and it is a flaw in the programing of the debugee?
evlncrn8
12-30-2004, 10:51 AM
i doubt its olly causing it, i also doubt its a flaw in the programming of olly, some protections use exceptions to alter code flow etc.. and how can a memory access violation at 0x00000000 be deleting a pointer thats already been deleted, stop guessing, do some research, answer ur own questions
klier
12-30-2004, 11:41 AM
http://www.cit.gu.edu.au/~anthony/icons/large/troll.jpg
Regards,
Quell
12-30-2004, 12:02 PM
i did do research, and access violation can happen when a pointer is being re-deleted....
the 0x0000000 screwed me up becuase it is not in the range where the program is running, and the olly says that the violation is at that adress.
is that possible or is it a bug?
evlncrn8
12-30-2004, 05:24 PM
it is in the range where the program is running, but its a protected memory area that causes an access violation when accessed.. like

xor eax,eax ; eax= 0
mov eax,[eax] = access memory area 0.. instant crash

the program could be deliberately causing exceptions (some protections do this),
so sure its possible, as to it being a bug.. doubtful.. if the program runs if you dont debug it then its probably some protection check causing the exception, if it doesnt run when you dont debug it then it could be a bug.. the bug however is not in olly


"brand-new-ways-crypted" crackme for new year!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > "brand-new-ways-crypted" crackme for new year!
PDA

View Full Version : "brand-new-ways-crypted" crackme for new year!

evaluator
12-31-2004, 02:56 AM
just coded hot puzzle for our MB:)
find "brand-new-ways-crypted" message!
dELTA
01-01-2005, 05:29 PM
Nice to see you around here again Eval, thanks for the puzzle. :yay:
JMI
01-01-2005, 07:09 PM
Careful. I welcomed him back and got a very "cryptic" reply. :D

Regards,
Kayaker
01-01-2005, 09:14 PM
Hi Eval,

As usual your code excursions are interesting. Also minimal and cryptic in and of themselves ;)

Is your message THE code, or is there a message IN the code?

I see an interesting MISuse of a privileged instruction, a little trick a protector could play for a quick exit. Is there a further message?

Cheers,
Kayaker
Neitsa
01-02-2005, 08:53 PM
Hello,

Nice riddle but I'm a little bit lost...

I've tried various things (like "xoring" between 0x402005 to 0x402018 with different values) but none seems to works...No readable string or executable code seems to appear.

Some strange things :

1) The use of "HLT" in a ring3 process must call the SEH handler, so we go directly to Pop the handler+ExitProcess...

2) Why there's so much INT3 opcodes ? so why the Entry point is not at the base of the code section ? and BTW, the VirtualSize (and SizeOfRawData) are trully big for just some lines of code...

Nothing important in the PE header, and the import table is ok with just one import...

Well... I'm stuck :D

Any advices or clues ?

Regards, Neitsa.
Woodmann
01-02-2005, 10:45 PM
Hmmmmmmmmmmmm.........

I have spent a few hours on this and I am also wondering the same things.
A big pile of int3's. I thought they were there to put "us" lost in an infinite loop/ kill debugger. Perhaps even a stack crasher but I could not find anything to indicate a stack crash. (I could have missed it :P )
The HLT is a bit strange.

Perhaps we are mis-interpeting the name of this challenge. ;)

Woodmann
Tola
01-02-2005, 10:46 PM
happy new year to you, too, evaluator :D
Kayaker
01-02-2005, 11:02 PM
Nice one Tola :yay:
You speak Evabulator I see :D
klier
01-03-2005, 08:41 AM
shit how could i have missed that.
nice puzzle evaluator. :cool:
Regards,
evaluator
01-03-2005, 10:55 AM
ok, open for public you findungs, Kayk & Tola..
Neitsa
01-03-2005, 11:50 AM
:confused: Ok, I'm must be blind, dumb or something like that...

I haven't got it .... :thinking: Waiting for the light to come :idea:

I'm still searching...
Tola
01-03-2005, 11:56 AM
hlt
and eax, 79h
push 5
pop ecx
inc eax
...

:idea:
Neitsa
01-03-2005, 12:01 PM
:D :yay:

Damn ! It reminds me +Mala's riddles, where searching too far for things that are...just here under your nose...

That was fun.

Regards, Neitsa.
Woodmann
01-03-2005, 03:56 PM
:cool:

Woodmann
dELTA
01-04-2005, 06:30 AM
My IDA Pro fails to decode the instructions in the middle of the message, I only get this:

.text:00402005 hlt
.text:00402006 and eax, 79h
.text:00402009 push 5
.text:0040200B pop ecx
.text:0040200C inc eax
.text:0040200D neg eax
.text:0040200D ; -----------------------------------------
.text:0040200F dd 419B0B0Fh, 0D083770Fh
.text:00402017 ; -----------------------------------------
.text:00402017 and ebx, eax
.text:00402019 retnAny idea why anyone? The processor is set to metapc, so it should recognize any x86 instructions, right? Which instructions is it that it's unable to decode?
Neitsa
01-04-2005, 07:47 AM
Hello,

This is due to the UD2 opcode (0x0F0B : Undefined opcode wich cause an invalid opcode exception).

noping those bytes and IDA can decode it:

.text:00402005 000 hlt
.text:00402006 000 and eax, 79h
.text:00402009 000 push 5
.text:0040200B 004 pop ecx
.text:0040200C 000 inc eax
.text:0040200D 000 neg eax
.text:0040200F 000 nop
.text:00402010 000 nop
.text:00402011 000 wait
.text:00402012 000 inc ecx
.text:00402013 000 emms
.text:00402015 000 adc eax, 21h
.text:00402018 000 retn

This is strange that IDA Pro cannot decode this opcode since it is documented in the Intel manuals...

Maybe it is possible to "teach" to IDA what is this instruction but I don't know how to do it...

Regards, Neitsa.
blabberer
01-04-2005, 09:46 AM
ollydbg decodes thus :)

00402005 HLT
00402006 AND EAX, 79
00402009 PUSH 5
0040200B POP ECX
0040200C INC EAX
0040200D NEG EAX
0040200F UD2
00402011 WAIT
00402012 INC ECX
00402013 EMMS
00402015 ADC EAX, 21
00402018 RETN
00402019 RETN
evaluator
01-05-2005, 03:05 AM
"I love you (:)
"You love NY ):(

little fun poetry by me. good?


Awesome Artistry / Not mine
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Awesome Artistry / Not mine
PDA

View Full Version : Awesome Artistry / Not mine

chesspupil
12-31-2004, 08:31 AM
http://rhee.dakindesign.com/

Poor kid, never had a chance.
Kayaker
12-31-2004, 02:06 PM
Lol! Poor kid yes, I hate to say it but he makes a great Shrek :p
sigint33
12-31-2004, 06:25 PM
Excellent work! My vote's for Yoda.

SiGiNT
CluelessNoob
12-31-2004, 07:30 PM
Yoda. Definitely Yoda.
Silver
01-12-2005, 11:55 AM
And here's his brother....

http://www.kontraband.com/show/show.asp?ID=1759&NEXTID=0&PREVID=0&DISPLAYORDER=20041217150522&CAT=movies&NSFW=


The RCE Staff
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > The RCE Staff
PDA

View Full Version : The RCE Staff

bestobest
01-01-2005, 11:04 AM
Happy new year all, to all newbie like me and all new member, I made a new year resolution to stop and smell the roses, the roses I'm talking about is pay attention to detail, I have read the FAQ on this board a million time and got nothing out of it until today, why because I decided not to just read it but study it, and let me tell to me it is like the best tutorial ever......LOVE you RCE
JMI
01-01-2005, 12:47 PM
I smell "something," but I'm not sure it's roses. :devil:

Regards,
venom925
01-01-2005, 12:55 PM
Maybe he's just trying to get his signature changed :D
JMI
01-01-2005, 01:21 PM
Well, we can be sure of at least one thing. He IS exagerating his count of the number of times he has read the FAQ. :eek: He's not nearly old enough to have actually read it "a million times." :D But we "knew" that was just a "figure of speech." :idea:

But, it is the "thought" which counts, and in that, his advise is sound. :yay:

Regards,
bestobest
01-02-2005, 09:45 AM
But, it is the "thought" which counts, and in that, his advise is sound. :yay:

Thank u JMI
I really mean what I said this board is awsome


Stuck with registry query
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Stuck with registry query
PDA

View Full Version : Stuck with registry query

toones
01-01-2005, 02:25 PM
I am working with TARGET NAME DELETED. I have been reading numerous tutorials and have gotten stuck. The program will take any key entered, thank you for registering, write the value to the registry, then ask you to restart. On open (restarting), using regmon I find that it reads the input key from the registry. I suspect that the compare is done then, but have no idea where/how to set the breakpoint in SoftIce since it is done before any dialogs.

In addition to all of that, I find that using W32DASM only shows a details page when opening the exe. If I dissassemble the exe I get all of the code, but can edit/patch the code. I think the program is VB from the DLLs it installs, so it may be a p-code/native issue. Unfortuantely with the tutorials I have read, I can't find anything that identifies how to tell which is used.

If anyone can help, or point me to a tutorial that will "clear things up" for me I would appreciate it.
JMI
01-01-2005, 02:48 PM
IF you had actually read the FAQ you would realize that your post is within a hair's breath of violating the Rule which states:

"DO NOT POST TARGET SPECIFIC CODE THAT INCLUDES THE NAME OF THE TARGET: this means do not post code that shows where and how to patch/keygen blah blah blah on a specific target. Keep your code snippets as generic as possible while explaining your problem."

While you didn't actually post any "target specific code," you did post the "name of the target" and invite "someone else" to give you the point in the code "for that specific target" where that compare might be done. That is not permitted here. With the name of the "target" deleted, someone can give you "general" concepts on how you might find a compare of the key you entered with one that "works" without violating this Rule. Otherwise your post falls in the nature of a "Crack Request," and would disappear. I hope, for your sake, you understand the difference. If someone responds with questions about the target, such things may be discussed by PM or e-mail only.

By the way, regmon should tell you "where" the program is reading that registry entry. That might not be a bad place to start with your search. That call comes from somewhere "within" the program, and then the program must "do" something with what it has "read" don't you think????? Does that not suggest a breakpoint on the registry read regmon shows you? Doesn't it give you the title of the API????

Regards,


New i2s -> 4.05
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New i2s -> 4.05
PDA

View Full Version : New i2s -> 4.05

Mostek
01-02-2005, 06:35 PM
1. Added a small protection against possible source files database problems.
2. Added protection against unk_xxxxxxxx names definitions and zero length names.
(Some strange databases had the unk_xx names that didn't appear in source listing -> i2s crashed.
At the same time I added the zero length protection also as it looks that can happen also.)

http://mostek.subcultural.com/IDA/ida2sice_405.rar

Peace
Mostek
dELTA
01-03-2005, 04:32 AM
Nice, thanks Mostek. :)
JMI
01-03-2005, 12:21 PM
We certainly do appreciate your work. :yay:

Regards,


Activating functions provided by add-in ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Activating functions provided by add-in ?
PDA

View Full Version : Activating functions provided by add-in ?

Rand0m
01-02-2005, 06:48 PM
Hopefully this isn't too dumb a question, but I've been working on a simple patch for a target that unlocks it and removes branding, etc.

I've managed to patch the target successfully and have unlocked all the features for this target; I have noticed that there are additional resources (dialog screens, etc) already embedded in the target that are supposed to provided by an add-in, according to the vendor.

My question is whether it would be possible to somehow unlock the functionality without having the add-in, seeing as the resources are already there.

I've double checked and haven't been able to find any references to hidden/disabled menu items or other checks that would unlock the additional features.

If anyone could give me a hint on what approach to take when looking at this I'd appreciate it.
FrankRizzo
01-02-2005, 09:58 PM
If it were me, I would IDA your target, and see if anything references the dialogs in question. I would think that it would also be possible that any plug-in(s) would call a function from the main program, or the main .dll's to check for authorization. There is a chance that you have already fixed it!
Rand0m
01-18-2005, 01:51 AM
Thanks for the tip. I tried using IDA & WDASM on it to look for any references, but wasn't able to find references to the particular dialogs. There were a few interesting exported functions, but nothing that explicitly referenced the dialogs.
WaxfordSqueers
01-18-2005, 02:49 AM
My question is whether it would be possible to somehow unlock the functionality without having the add-in, seeing as the resources are already there.

Did you find your resources using a resource editor like Reshacker? You can find plenty of detail in such an editor with regard to resource names and the numbers that reference them. Sometimes it's as simple as searching through IDA for an immediate value (in hex).

Reshacker lists the ID numbers for strings, dialogs, etc., in decimal. So you have to convert to hex first, then search. You'll find the ID (atom number) beside a string, for example. Say the number in Reshacker beside a certain string is 100 decimal. Use the IDA search engine to look for the immediate value 0x64. You'll probably find a bunch of them, but the one's you want are associated with a PUSH, and usually just before a CALL procedure.

You'll see something like: PUSH 64.

Here's an example from an app I was just working on. The registration window has dialog number 196 decimal (taken from Reshacker). I convert that to 0xC4 and run it throught the IDA 'immediate' search engine. I get a bazzillion hits, but find only a couple of references to 'push 0C4h'. I try each one and find this little gem:

.text:0052228C call sub_4C0340
.text:00522291 add esp, 8
.text:00522294 cmp eax, 8
.text:00522297 jz loc_522127
.text:0052229D push 0C4h <--------------
.text:005222A2 call sub_585C87
.text:005222A7 mov ecx, eax
.text:005222A9 add esp, 4

look what's sitting right before it. I wonder what that jz could be about? That's what you want to track down in your own app. Locate the omitted resources, if they are there, using the method I just described. Then look for conditional jumps just before them. Sometimes, the jumps are quite a bit before them, however.

Anyway, that's one way of investigating. Of course, you've probably thought of that already if you've unlocked most of the hidden funcs.


VB reversing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > VB reversing
PDA

View Full Version : VB reversing

Opcode
01-03-2005, 06:06 AM
More one good paper from Alex Ionescu:

http://www.relsoft.net/Articles/VB/vb.pdf

Regards,
Opcode


Automated Imports Reconstruction
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Automated Imports Reconstruction
PDA

View Full Version : Automated Imports Reconstruction

Admiral
01-03-2005, 02:14 PM
I was reading into IAT reconstruction of Armadilloed binaries recently when I came up with an idea I haven't been able to shake since. I'm fairly sure that I am misunderstanding something or other and so I don't want to go to the effort of coding the following dumper/fixer without being at least nearly sure that it won't be a total waste of time.

As I understand it, the IDATA section is a part of the (disk) executable header that tells the operating system which DLL imports to load, and the IAT is the part of the (memory image) header into which the OS loads all of the addresses. Many modern packers will pack the whole subject file including the header, and when executed, will unpack the whole file, step through its IDATA section filling in the IAT manually before/while destroying all the evidence in the IDATA area.
If this isn't right so far, then perhaps I have the wrong end of the stick entirely.

My problem is the apparent simplicity with which this IDATA section could be reconstructed. My conceptual panacaea program would attach itself to the target app once it has been unpacked; dump the relevant sections, then scan the code area for CALL commands that point to memory locations known to be imports. It will keep a record of all such CALLs, noting all relevant details before going on to redirect them in the dump as necessary and manually adding the entries into the IDATA section of the dumped PE header. Failing that, more elegant examples exist in which the app is loaded as a debugged process and all calls to LoadLibrary are logged etc etc.

If this was possible then surely somebody would already have implemented it, so what am I missing?
evlncrn8
01-03-2005, 02:30 PM
a lot.. you're missing how you'll handle dll forwarding, exports with diff names but at the same addresses etc etc.. it is possible to make an automated iat/it rebuilder, some including myself have done it, but it aint quite that simple
JMI
01-03-2005, 03:07 PM
Nothing in life is "quite that simple." :)

Regards,
Admiral
01-03-2005, 03:09 PM
Guess I'd better get reading then :-/
CrackZ
01-03-2005, 03:30 PM
Hiya Admiral,

Your idea is one of those that sounds great in concept but doesn't work exactly in practice, and I'll tell you what, I recommend you actually code it ;-), (as I myself did a long time back), it'll teach you more about import rebuilding than any tutorial ever can.

The problem is the forever ending game of cat and mouse that you play with protectors, the Armadillos of this world I'm thinking (although there are a few others), you'll probably find your panacea app is actually able to defeat many of the easier packers out there.

As an example, I once thought that hooking GetProcAddress() at system level would be a really good idea, then along came the protector who now looks up his import addresses directly.....You find ways, they find counter measures, the only way you stay ahead it seems is not to share information or your tools.

Now I'm going another way, an instruction decoder/tracer with *tricks and hacks* (probably a lot of people have done similar).....Nothings ever perfect, I wanted a tool for me that did the majority of the boring stuff for me, not everything for anyone, thats where most of the existing tools fell down, they tried to do 'everything' and attracted users who didn't care for the details.

Regards

CrackZ.
cRk
01-06-2005, 10:29 AM
Nice truly Comment CrackZ :yay:

Regards
Admiral
01-11-2005, 08:15 AM
Cheers for the wise words, all.

I think I will try to write an auto-unpacker for something simple first, UPX perhaps. If I have any success I'll move on to bigger and better things, one step at a time.

Take it easy
Admiral


Import table doesn't really resolved
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Import table doesn't really resolved
PDA

View Full Version : Import table doesn't really resolved

Ja187
01-04-2005, 02:45 AM
App is packed with UPX. I've already dump it with OllyDump and rebuid import table (manually). App works well, but imports are still fucked up under Olly... There was on this forum topics about this, but I'm not sure how to find full Import Table.

Any sugestions?

Greetz to crackers, especially polish.
esther
01-04-2005, 08:00 AM
Use imprec?
Ja187
01-04-2005, 08:32 AM
I don't wanna use ImpRec. I wanna do this by myself.
Anyway thanks for trick... :)
_Servil_
01-04-2005, 11:50 AM
if upx iat is 1 homogenic chunk unless some exotic compiler used
find the range easily FF 15 ?? ?? ?? ?? or FF 25 ?? ?? ?? ??


[BUG] NTICE DDRAW function
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > [BUG] NTICE DDRAW function
PDA

View Full Version : [BUG] NTICE DDRAW function

Timbo
01-04-2005, 06:22 AM
Let's image you use "set maximize on" and enter a directx game
press your hot-key to enter debugger (ntice)
How many lines did you get ?

I get (standard) 25 lines but if type in 'rs' to see the screen and
quit with ESC i get 47 lines (maximize works)
Why didn't maximize work if i enter debugger ???
Is it a bug or a feature ???


DirectDraw editbox breakpoint
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DirectDraw editbox breakpoint
PDA

View Full Version : DirectDraw editbox breakpoint

Ja187
01-04-2005, 08:55 AM
Target: Game (DirectDraw)
Desc: Editbox(DDraw) for passwd
Problem: Standard bpxs doesn't work. I've only one handle (for DirectDraw window of whole app).

Any suggesions?
JMI
01-04-2005, 04:45 PM
Go back and actually read the FAQ and then FOLLOW it's directions about how to ask a question.

REgards,
Silver
01-12-2005, 11:26 AM
My suggestion is that you need to figure out if it's a win32 editbox, or a rendered editbox. If it's the latter, go learn lots of DirectX. If it's the former, there's no difference in approach.


Softice - updating code in memory ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice - updating code in memory ?
PDA

View Full Version : Softice - updating code in memory ?

Neitsa
01-04-2005, 11:43 AM
Hello,

When I'm debugging my drivers, I'm breaking on their code with an INT3 embedded in the code and typing I3HERE command.

If my driver has some bugs (well they are all buggy :D) I'm compiling again my driver's code, but the code remain the same in Softice when loading it again.

The only way I've found to update the code in softice is to reboot the O.S...

Is there another way to update the memory than rebooting ?

Reading the Softice manual it seems that it 's possible to do it with the softice loader, but as I've said before, I'm not using the Softice loader to break on my drivers.

Thank you very much.

Regards, Neitsa.
Opcode
01-04-2005, 12:26 PM
Hi Neitsa,

Strange behaviour!

I do the same, I always put a INT3 instructions in my drivers to debug with
SoftICE but my code is always updated when I run it.

I don't know if this is important, but I'm using Windows XP SP1 and to load my drivers I'm using the Four-F KmdManager.

Regards,
Opcode
Neitsa
01-04-2005, 12:44 PM
Thank you Opcode for your reply.

Hmm yes it sounds strange since some of my friends have the same problem as mine.

I'm using Win 2k and D.S 3.1. Generally I'm using an SCP (service control program) to load my driver which have a user-mode counterpart (or Osrloader/Kmdmanager from four-f if no SCP).

This problem is in fact the same as the 'A' (assemble) command in softice on windows NT, when the changed code remains "sticky" (this is explained in the Softice command manual at the 'A' command).

Well I dunno what I'm doing wrong...I'll investigate...

Thank you very much.

Regards, Neitsa.
Kayaker
01-04-2005, 01:48 PM
Hi Neitsa,

You write buggy driver code too hey? :D

That does sound a bit strange. The only problems I've had is when I forget to update the .NMS file after recompiling, and the SRC and disassembly don't match.

If your driver isn't UNloading properly then your newly compiled version shouldn't load at all, but you *should* be receiving (or have incorporated) some kind of error message in that case .

The other issue that can happen after a driver development bug crash (not BSOD) is a conflict with the existing driver name in the registry. I have had the problem of not being able to reload my driver after a crash and had taken to re-naming development versions incrementally after a crash. After a reboot all was OK again. Renaming is better than rebooting but usually means changes to several modules and later cleaning up of the registry.

The reg entries are of course here:
HKLM\System\CurrentControlSet\Services\<DriverName>
(removed on uninstall)
HKLM\SYSTEM\ControlSet\Enum\Root\LEGACY_<DriverName>

For the record I use I1HERE breakpoints and have converted from ASM to VC6++ for driver writing. I don't mind using ASM for GUI stuff, I love the size/efficiency benefit, but for drivers C/C++ just seems so much cleaner than ASM (sorry Opcode :p)

Kayaker
Opcode
01-04-2005, 02:17 PM
but for drivers C/C++ just seems so much cleaner than ASM (sorry Opcode :p)

No problem, I'm doing the same :eek:

Regards,
Opcode
Neitsa
01-04-2005, 07:06 PM
Thanks for your replies, I'll see if I can solve my problem with your hints.

Maybe the problem is due to remote debugging (I'm testing my drivers on a target system with a 2k box on a VMWare system as target).

BTW, I'm currently looking to switch to C to have more readable code too...Asm is great for low-level stuff but source code can sometimes be a real pain to maintain (on the other hand it is very easy to debug).

That's trully a hard choice...

Thank you very much.

Regards, Neitsa.
Kayaker
01-05-2005, 12:26 AM
Btw, Neitsa. I've read your remote debugging with VMWare tutorial in French, it is a very useful reference. You've got a nice little site there, too bad I had to search for it to Peer inside it...

I'd encourage a link to it hint hint... :yay:
JMI
01-05-2005, 01:49 AM
Mon Dieu. Le Kayaker lit des Français. L'eau est aujourd'hui très froid, n'est pas lui. :eek: :devil:

Regards,
Neitsa
01-05-2005, 11:04 AM
Hello,

You've got a nice little site there, too bad I had to search for it to Peer inside it...

Thank you very much ! this is trully nice, especially coming from you.

We do not have many reversing tutorials/websites in French (or they are from "old" reversers like TheAnalyst or Christal, etc.). I don't think my site will be interesting for non-english speakers since there is many very good sites out there... And maybe as you've seen there not so many things in mine...making tutorials takes time and this is time that I can't spent on reversing engineering. :)

Anyway, thanks again for your cheers !

Mon Dieu. Le Kayaker lit des Français. L'eau est aujourd'hui très froid, n'est pas lui.

OMG !!! JMI is talking french !!! :D (BTW, there's some mistakes in it..., but I know how it is difficult to learn french [even for us, natural speakers]).

Regards, Neitsa.
JMI
01-05-2005, 11:44 AM
Neitsa:

Blame it on Systran Translator. :D I last "studied" French in the 1960's, followed by a few years of German, and then 1400 classroom hours of Vietnamese, all in one year. :cry: But well spoken French is a very pleasant language to hear spoken. Much more melodic than English or German. :yay: And most westerners have trouble with the tonal languages like Chinese and Vietnamese. But at least Vietnamese had no verb declensions or articles to match to the proper gender and/or grammar case.

Regards,
TQN
01-05-2005, 10:19 PM
Wow, JMI had learnt Vietnamese. "Ban con nho va noi duoc tieng Viet khong ?"
Chuc mung nam moi (Happy New Year in Vietnamese)
FrankRizzo
01-05-2005, 10:58 PM
All I know about Vietnamese is that Pho Kim Long in Las Vegas is a good restaurant..
I wondered if they had another one called Pho Kim Hard!

(For the uninformed, Pho is pronounced like FUH, and refers to a beef-broth based soup with noodles, and all kinds of greenery in it.. VERY tasty!)
roocoon
01-07-2005, 02:41 PM
That problem used to happen some time ago and I guess it still does.
From what I remember, it used to happen if you exited a debugged application while software breakpoints were still set, modified the app and restarted it under SoftICE. The old memory image was still used in this case.
The fix was to disable breakpoints before exiting the app, modify it, restart it, and enable the breakpoints again.
If you only have the hardwired CC codes, the above shouldn't apply but maybe I'm wrong.


DRIVER_OBJECT structures list
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > DRIVER_OBJECT structures list
PDA

View Full Version : DRIVER_OBJECT structures list

Opcode
01-04-2005, 02:14 PM
Hi!

I'm trying to find a way to get a list of all DRIVER_OBJECT structure addresses of the drivers loaded in the kernel.
SoftICE knows how to get the list, but I don't :D

PsLoadedModuleList variable was not useful to me.

Maybe some reverser know how to generate this list.
It is pratically the same of getting the list of the DEVICE_OBJECT
structure.

Thanks in advance for any help.

Regards,
Opcode
Kayaker
01-04-2005, 02:37 PM
Hi Opcode,

Funny, I've been thinking about doing that exact same thing, I wanted to try to get the addresses of the IRP_MJxx functions (and other info) from the DRIVER_OBJECT structure for all loaded modules. I thought PsLoadedModuleList might be the way in too... I'd had a quick look at the Softice DRIVER command for the answer but apparently never shouted "Eureka!" Interesting question.

Regards,
Kayaker
Kayaker
01-04-2005, 05:28 PM
Hi

Just quickly, looking again at the Softice c_Driver function, after initially parsing the command window text with the driver name, Sice apparently uses ZwOpenDirectoryObject in a subfunction. That would seem to be the key to developing a routine.

:000105FE _c_Driver3 proc near ; CODE XREF: sub_2C904+1Dp
:000105FE ; _c_Driver9+3B
:000105FE
:000105FE ObjectAttributes= OBJECT_ATTRIBUTES ptr -24h
:000105FE var_C = dword ptr -0Ch
:000105FE Handle = dword ptr -4
:000105FE
:000105FE push ebp
:000105FF mov ebp, esp
:00010601 sub esp, 24h
:00010604 mov eax, Object
:00010609 push esi
:0001060A xor esi, esi
:0001060C cmp eax, esi
:0001060E jnz short loc_1067D
:00010610 push offset dword_105FA ; dd 5C = unicode 0, <\>,0
:00010615 lea eax, [ebp+var_C]
:00010618 push eax
:00010619 call ds:RtlInitUnicodeString_0
:0001061F lea eax, [ebp+var_C]
:00010622 mov [ebp+ObjectAttributes.ObjectName], eax
:00010625 lea eax, [ebp+ObjectAttributes]
:00010628 push eax ; ObjectAttributes
:00010629 push 1 ; DesiredAccess
:0001062B lea eax, [ebp+Handle]
:0001062E push eax ; DirectoryHandle
:0001062F mov [ebp+ObjectAttributes.Length], 18h
:00010636 mov [ebp+ObjectAttributes.RootDirectory], esi
:00010639 mov [ebp+ObjectAttributes.Attributes], 40h
:00010640 mov [ebp+ObjectAttributes.SecurityDescriptor], esi
:00010643 mov [ebp+ObjectAttributes.SecurityQualityOfService], esi
:00010646 call ds:ZwOpenDirectoryObject
:0001064C test eax, eax
:0001064E jnz short loc_10678
:00010650 push esi ; HandleInformation
:00010651 push offset Object ; Object
:00010656 push esi ; AccessMode
:00010657 push esi ; ObjectType
:00010658 push 1 ; DesiredAccess
:0001065A push [ebp+Handle] ; Handle
:0001065D call ds:ObReferenceObjectByHandle
:00010663 mov ecx, Object
:00010669 call ds:ObfDereferenceObject
:0001066F push [ebp+Handle] ; Handle
:00010672 call ds:ZwClose
:00010678
:00010678 loc_10678: ; CODE XREF: _c_Driver3+50j
:00010678 mov eax, Object
:0001067D
:0001067D loc_1067D: ; CODE XREF: _c_Driver3+10j
:0001067D pop esi
:0001067E leave
:0001067F retn
:0001067F _c_Driver3 endp
Neitsa
01-04-2005, 06:52 PM
Hello,

Maybe a good way to have a DRIVER_OBJECT list is to disassemble KD (kernel debugger from debugging tools) and its DLLs.

Listing all drivers:

kd> !object \device
Object: 82b18030 Type: (82b1c040) Directory
ObjectHeader: 82b18018
HandleCount: 0 PointerCount: 253
Directory Object: 82b1c390 Name: Device
13 symbolic links snapped through this directory
HashBucket[ 00 ]: 82a7faf0 Device 'KsecDD'
82ae0cd0 Device 'HarddiskVolume12'
82a7ead0 Device 'Ndis'
810d08d0 Device 'AdiUsbAdsl'
813fd110 Device 'Beep'
[cut]

retrieving DRIVER_OBJECT struct for a particular driver:

kd> !drvobj beep
Driver object (81a678f0) is for:
\Driver\Beep
Driver Extension List: (id , addr)

Device Object list:
813fd110

Maybe this field is important (I mean it *could* be an array of pointers to all xxx_OBJECT) :

Directory Object: 82b1c390

The bang command !drvobj is located in those dlls :

Windows 2000 : kdextx86.dll
Windows XP and later : kdexts.dll

For further details on those commands see windbg help.

Dunno if it could help you, but maybe it worth the try.

Regards, Neitsa.
0rp
01-04-2005, 07:41 PM
hi,

to get a list of all legacy drivers you can do:

OBJECT_ATTRIBUTES attributes;
UNICODE_STRING name;
HANDLE directory;
BYTE buf[3000];
DWORD idx, len;

RtlInitUnicodeString(&name, L"\\Driver");
InitializeObjectAttributes(&attributes, &name, OBJ_CASE_INSENSITIVE, NULL, NULL);
ZwOpenDirectoryObject(&directory, DIRECTORY_QUERY, &attributes);
ZwQueryDirectoryObject(directory, buf, sizeof(buf), TRUE, TRUE, &idx, &len);

do
{
OBJECT_NAMETYPE_INFO *p = (OBJECT_NAMETYPE_INFO *)buf;

DbgPrint("%S\n", p->ObjectName.Buffer);
}
while(NT_SUCCESS(ZwQueryDirectoryObject(directory, buf, sizeof(buf), TRUE, FALSE, &idx, &len)));

and to retrieve infos about attached deviceobjects:

DRIVER_OBJECT *driverobj;
UNICODE_STRING name;
DEVICE_OBJECT *device;

RtlInitUnicodeString(&name, L"\\Driver\\atapi");

ObReferenceObjectByName(&name, 0, NULL, 0, *IoDriverObjectType, KernelMode, NULL, &driverobj);

for (device = driverobj->DeviceObject; device != NULL; device = device->NextDevice)
{
DbgPrint("devobj: %08X\n", device);
}

ObDereferenceObject(driverobj);
Opcode
01-04-2005, 07:51 PM
Hi!

I was reading the Valerino's great article at rootkit.com:
http://www.rootkit.com/newsread.php?newsid=209

This article show how to hide a Driver entry in the \Driver directory.

I created a litle driver based in the Valerino article. See the attachment...
Use DebugView to see the list.

It is very similar with the 0rp's code.
I will try the 0rp code to see if I can get the DRIVER_OBJECT address
of each driver.

Thanks for all replies. :yay:

Regards,
Opcode
Kayaker
01-04-2005, 11:44 PM
That works really nice Opcode. Your code spits out a DRIVER_OBJECT pointer for each driver listed in the global Driver Object directory (WinObj). The pointer matches (naturally) the one from the DEVICE_OBJECT structure which you can get from the Softice DRIVER command. I can definitely make use of this ;)

Thanks for the code examples everyone.

BTW, we allow http:// here, there's a modification to the board to prevent direct clickable links outside the server, so no need for the ugly hxxp://

Cheers,
Kayaker


welcome
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > welcome
PDA

View Full Version : welcome

0xf001
01-04-2005, 02:41 PM
hello and welcome everybody to the brandnew linux RCE forum!

this forum was created to have a better structured approach for
talking about linux related RCE topics.

woodmann thankfully provided us with this forum, so i will try to
find some introductional words :)

i will be your moderator for this forum. the idea is to have a
platform to invite you (linux) reverse engineers to discuss here.
and i think it is just the right time.

why linux rce? well, many people might think that linux is open
source and therefore RCE is a little bit useless. now this is
not completely right. the kernel and gnu environment are providing
the sourcecode, yes.
but there are many programs out for linux (ported or not)
which use protection systems: anti disassembling, anti debugging,
anti tracing, encryption, time trials, serial number checks, ...
all those things you have in linux, too of course.
and the source code of the kernel does not really tell you why you
can not debug this file you just downloaded. and it also does not
tell you of course how you get to debug it :) and which tools you
have available and so on ...

so this is exactly what this forum is about:
to discuss about analyzing unknown binaries, parts or whole
protection schemes, where you have no source code available, talk about
the tools you have available and how to use them, extend them, ...

well on the other side there are things which should be avoided:
flamewars linux<->windows are so boring that they need not be discussed
here. also typical system administration topics (installation of OS,
increasing filesystem, ...) are not really what this forum is about.
also i think there is no need to duplicate typical security boards,
and announce each new found exploit. well, of course the techniques
used in an exploit are worth a topic to discuss.

a final thought: here are many very experienced windows reverse
engineers. parts of protection systems (encryption algorythms,...)
are independent from the OS, so i think in one or the other way
the windows RCengineers could help in this forum as well! and
vice versa of course :)

so, without loosing too many words ....

welcome to the linux RCE forum!

0xf001
naides
01-07-2005, 05:49 AM
Hi. 0xF001

Thank you for sharing your experience and knowledge with us.
I am going to dust my Linux CDs and give it a try. . .
Is it possible for you to PM or point me to some fresh Linux targets?
(Without bringing on us JMI's wrath of course :) )
0xf001
01-07-2005, 07:37 AM
Hi naides,

I am going to dust my Linux CDs and give it a try. . .

wow, this is what I call engagement! :yay:

Is it possible for you to PM or point me to some fresh Linux targets?
well, as you say Without bringing on us JMI's wrath of course
you can try it :D

a good start is to check the crackmes on ptth://www.crackmes.de, there
are some for linux as well. or search the web for other crackmes. of course
you will not find there "commercial" protections, but allready something to work on :)

please PM me for any question! I will try my best to support you!

thank you,

0xf001
blabberer
01-07-2005, 09:43 AM
in rea board there is a link to one crackme called dcrkme by discord
or if you are interested in exploit type games
you can look into
vortex.labs.catalyst.pulltheplug.org <--- level based
catalyst.labs.pulltheplug.org <--- free style no levels
iirc 0xf001 quoted a link to felinemenace.org
the above links are a part of felinemenace.org
they also host some more namely jessica,blackhole,semtex,etc etc
which i havent explored personnally
:)
have fun :)
andrewg
01-10-2005, 08:44 PM
Hello,

Since I'm involved with pulltheplug and felinemenace I thought I'd post to provide more information for people since people seem to be interested.

As 0xf001 posted on his website, there is a paper I'm in the process of writing. It can be found at http://felinemenace.org/papers/Binary_protection_schemes-1.00-prerelease.tar.gz. This is about various techniques (with included source code) that can be used to help protect binaries under linux against various things. While people may say that its just a collection of stuff already out there, there are some various things that I haven't seen out there, and some tricks I discovered against various tools.

Any feedback on that document is greatly appreciated as well.

Now for the various games:

vortex:

Vortex is a level based exploitation game, which grows in difficultly. Some of the levels include maths problems, heap corruption, stack overflows, integer overflows, etc. Its a decent challenge even for the most dedicated people. Vortex can be found at http://vortex.labs.pulltheplug.org

Catalyst:

Catalyst is a free-style (ie, there is no fixed direction you must follow) binary analysis game. I'm using this to "support" my paper above for the most part, and has various challenges. Currently catalyst doesn't have many things available, so feel free to send me levels to put up :). catalyst is at http://catalyst.labs.pulltheplug.org

Blackhole:

Blackhole is a FreeBSD remote exploitation game, and focuses on various tricks people can use when writing remote exploits. The box is currently down at the moment, due to a failed software upgrade I believe.

Semtex:

Semtex is a network based challenge. The idea behind semtex is that you have to do various network based challenges, such as using proxies, writing a icmp tunneling client, and so on. Semtex is due to come live in the short future.

Obelix:

Obelix is an "evade the ids" type game, where the goal is to use various techniques (new and old) to evade ids detection. The timeline for obelix is undetermined at the moment, but should be done in the next couple of weeks.

Jessica:

Jessica isn't a game box, its a linux shell box for various trusted people.

So, this may beg the question, what is pulltheplug? is a community of like minded people, mainly relating to computer security stuff, but there are various people interested in reversing etc there. The website can be found at www.pulltheplug.org

(Since I admin, or at least am strongly involved with the various things, I presume it would be safe to provide complete links for people.)
0xf001
01-10-2005, 08:59 PM
thanks for the explanations andrewg, and welcome to the board :yay:

i tried catalysts level0 today, interesting "game" for reversing :)

cheers, 0xf001
andrewg
01-12-2005, 08:47 AM
Thanks for the greeting :)
SiNTAX
01-12-2005, 10:18 AM
but there are many programs out for linux (ported or not)
which use protection systems: anti disassembling, anti debugging,
anti tracing, encryption, time trials, serial number checks, ...

Euhm really?! Apart from crackme's, I can't think of any..
0xf001
01-12-2005, 10:59 AM
well, I do not want to explicitly name targets here, but I do give you one example I am SURE you know, and I think nearly every linux / windows user has come across :) :

just try ...ware workstation, the popular "virtual PC" :idea:

cheers, 0xf001

PS: "quote":
Evaluate .... Workstation

You may evaluate ...... Workstation for a 30-day period. To evaluate ????? Workstation (for Windows or Linux operating systems), please do the following:

Click here to register for a license key that is valid for 30 days only.
...
...
After your 30-day evaluation license has expired, go to ...ware Web Store to purchase your copy of ...ware Workstation.

PPS: I do not really like to write the real name, as it could be misunderstood to encourage people reversing a commercial product ;)
Silver
01-12-2005, 12:03 PM
There's also a well known, commercial IDE suite that one might believe was Delphi until one looked closer and realised it was a Linux version that does C++. There's a free version of that, but it comes with a nag screen inserted into every app you build.

I've done a little Linux coding but never looked at rce. Will be reading with interest :)
SiNTAX
01-13-2005, 02:16 AM
Yes I know there are commercial apps.. but I was more refering to "protection systems: anti disassembling, anti debugging,
anti tracing"

Not that I have really looked at any of those targets hinted at.
0xf001
01-13-2005, 06:39 PM
hi SiNTAX!

i see, i got you wrong then :)

without giving the names of the applications I could tell everything of course,
well the strangest thing I have encountered is a commercial product, which ships on a CD containing a fully armored linux, using 2.0.x kernel and of course very old libc. the CD also contains the encrypted installation files.

the installer boots off the cd into this linux, displays a hardware key and asks for a installation key (which of course must match the hardware key and the encryption key of the installation files). this is level 1 :)

the binary asking you for the key is also using nice anti* stuff. for example it communicates with a kernel module, which is part of the encryption.

so first you boot into a strange environment. you have no shell. you can not
debug. you have no tools. tools you have in your own distro do not work with the old binaries anymore. and you do not know upfront what all was modified, what is hidden. so you need to find a way to boot this thing into a shell. then you will not like what you see, because you can use no debugger :(
i found nowhere a recently old gdb binary. compiling it from source is a good idea, but the recent (and even older) gcc compilers refuse to compile this code correctly. ok, so you need to compile a very old gcc. this you also can not do without lots of efforts. i must admit I failed to compile any useful
tool trying it indepth and using friends which are experts in those topics.
so other approach ....

i managed to get this "semi debugged" on a 2.6 kernel by copying the process loader from the CD to my distro, but for full
study one would need to build up a linux based on the 2.0 kernel and the related gnu libs, tools. as you can not load this §"$%&/ kernel module into a 2.4 / 2.6 kernel.
...
patching the installer to accept any serial is of course possible. but it does not help since the application can not be decrypted this way. and the only way to get this "vendor key" is to calculate it from your hardware key and the unknown installation key. to be potentially able calculate them, you need the kernel module working... aargh!

well, once you got your installation key generated :D, the app installs as again an armored linux environment. the probably best "trick" is to use this kernel module. it is very hard to debug this. for luck you can disassemble it :)

now the installed app turns out to be protected in a similar way like the installation, but now needs for each functional part an own installation key.
the installation key must match the now displayed new hardware key2 (it is longer, ...), and must match additionally

vendor key
include information like installation date, expiry date, ...
type of license
AND product key.

this product key you also do not know. it is to be obtained from the vendor, like the installation key.

I could probably write a whole book about this protection, as each part of protection contains so many details. this indeed is the best solution I ever saw. but limited to the fact that the app comes with the OS together.

I will grab some code parts and post them here for discussion.

and ... the app finally runs fine in my vmware :devil:

cheers, 0xf001
SiNTAX
01-14-2005, 02:36 AM
About the strange linux environment... just write them and have them release their sources.. afterall the kernel/libc are GPL... so they are in violation of a license if they don't release their modifications.
The kernel module is another matter.. depends on which exported kernel functions they used.. some of them are GPL only.

Anyway... sounds like a nice target indeed... didn't know there were that 'advanced' things out there..
Am I right into thinking this is a hardware based product?!

BTW: have you tried to run the CD with QEMU or BOCHS yet? If it runs with those, you will have the same power as SoftICE on windows. (and since you have the source for bochs/qemu, the sky is the limit!)
0xf001
01-14-2005, 12:02 PM
SiNTAX,

Am I right into thinking this is a hardware based product?!

no :) it is an industrial product, but of course not running on "all PCs". They just have support for a limited set of network cards, graphic cards and such.

BTW: have you tried to run the CD with QEMU or BOCHS yet? If it runs with those, you will have the same power as SoftICE on windows. (and since you have the source for bochs/qemu, the sky is the limit!)

no, never :) I booted it in vmware, or used mount -o loop /path/to/image.iso, to access the files from the CD when inspecting the binaries being able to use some tools against it.

well at the point of time i did not know about bochs, qemu...

and i do not need it anymore, as i said it is allready up and running and fully functional :)

but thank you for the tip, i see bochs does emulation this is actually very good indeed! must check if it provides some debugging facilities ....

thanks, 0xf001


linux RCE starter
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > linux RCE starter
PDA

View Full Version : linux RCE starter

0xf001
01-04-2005, 02:47 PM
hi everybody!

i have put together a little "linux RCE entry point" - a reference listing
the typical tools you need doing RCE on linux:

debuggers, disassemblers, tracers, file editors, ...

as well as some introductional papers ...

as this grew too big for a post, I have loaded it up to

http://home.pages.at/f001/

this should be quite useful for a getting started reference.

cheers, 0xf001
0xf001
01-04-2005, 06:33 PM
hi again!

the new 29A#8 magazine provides an interesting article for ASM coding
under linux, related to ELF header parsing. thx to gabri3l who told me!

i have hosted this file temporary on the linux RCE starter page, until the
29A#8 online version is fixed.

enjoy!

regards, 0xf001
esther
01-05-2005, 12:55 AM
Some guys already started writting tutes :)

http://biw.rult.at/tuts/stingduk_linux_disasm.htm
blabberer
01-05-2005, 03:52 AM
hi Foo1,
word wrap the texts to fit into 800*600 the horizontal scroll is icky
btw iirc you coded one crackme yeah nice little trick checksumming the image before decrypting using int 80 i dont see a referance to it or a solution to it
anyway nice page :)

ps edit sorry about the crackme itwasnt by you but by some disorder :)
0xf001
01-05-2005, 03:59 AM
cat dump1 | more

this guy likes to type very redundant :) but yes for a beginners tut it is fine!

oltough I do not really like objdump as it is very limited and it displays in AT&T syntax :)

i can be arrogant, too hehe!

thanks for the link,

0xf001
0xf001
01-05-2005, 04:07 AM
blabberer,

800*600 (uuuh) - OK, I will do it for you :) !

you are talking about the "trythis" crackme on biw.rult.at? Well, fine if there
is no solution yet, let's give it a try ... ! Have you solved it?

cheers, 0xf001
blabberer
01-05-2005, 06:19 AM
oltough I do not really like objdump as it is very limited and it displays in AT&T syntax
try this :)

objdump -M intel -d "yur exe" > dumpo
cat dumpo | more :)

well i kinda solved it lit four leds :) but dont have access to shell all the time
and i was talking about dcrkme by discord :)
running a gui app half way across the world from a windows pc with x-11
forwarding is kinda time consuming :) a click takes two minutes to break on gdb running in shell :)
and thanks for
800*600 (uuuh) - OK, I will do it for you !
0xf001
01-05-2005, 02:57 PM
thank you blabberer :) !

i really missed this objdump option (-M intel). or maybe allready forgot?
does not matter... this is indeed a very good option to remember!

but nevertheless I do very seldom use objdump, as I prefer "real"
disassemblers which are made for this purpose. for quick looking well, I
still use it sometimes. my concern is more about what I called
"it is very limited" :)

well i kinda solved it lit four leds

hehe, good! this I also did before, without even looking at the code:), just
at the function names and I guessed how the syntax for the serial must be, hehe :) it is a nice crackme.
now I have disassembled the serial algorythm and am writing a keygen....

I am making an indepth tutorial out of it, will post the link here :)

anyone else working on it?

regards, 0xf001
0xf001
01-06-2005, 11:38 PM
update: I found a

linux reverse engineering whitepaper by O'Reilly / _mammon

at ptth://searchenterpriselinux.techtarget.com/searchEnterpriseLinux/downloads/SecurityWarrior.pdf

it is quite long, and includes LOTs of topics, in very nice quality, ie:

tools and techniques, debugging, runtime monitoring (tracing, ...), disassembly (incl working with intermediate code representation), anti RE techniques, RE tool development

and pretty much example code in it! :yay:

definately a "must read" so I linked it on the starter page :)

enjoy, 0xf001

ps: blabberer I finally REwrote the page into real HTML so it is now independent of the screen resolution as I do not use the <pre> tag
anymore


Help with Delphi 7 app
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Help with Delphi 7 app
PDA

View Full Version : Help with Delphi 7 app

sloppysam
01-04-2005, 04:20 PM
1. What is the problem....
I am stuck in where to go from here. I have located the routine but am unable to proceed.

2. What is the protection.....
When installed the progam is unpacked but it randomly generates a 7 digit installation number that it uses to compare to the serial number entered.

3. What tools are you using....
I used DEDE to find the section of code that does the compare routine. I then used ollydbg to watch the program and try to fish out the correct serial.

4. What tutorials have you read....
A few on Delphi, dede and I have been using olly for quite a while

5. Show your output listing WITH comments....

0050C74C 55 PUSH EBP ; Push Button
0050C74D 8BEC MOV EBP,ESP
0050C74F B9 04000000 MOV ECX,4
0050C754 |> 6A 00 /PUSH 0
0050C756 |. 6A 00 |PUSH 0
0050C758 |. 49 |DEC ECX
0050C759 |.^75 F9 \JNZ SHORT Name Deleted.0050C754
0050C75B |. 51 PUSH ECX
0050C75C |. 53 PUSH EBX
0050C75D |. 56 PUSH ESI
0050C75E |. 57 PUSH EDI
0050C75F |. 8BF8 MOV EDI,EAX
0050C761 |. 33C0 XOR EAX,EAX
0050C763 |. 55 PUSH EBP
0050C764 |. 68 D5C85000 PUSH Name Deleted.0050C8D5
0050C769 |. 64:FF30 PUSH DWORD PTR FS:[EAX]
0050C76C |. 64:8920 MOV DWORD PTR FS:[EAX],ESP
0050C76F |. B8 02000000 MOV EAX,2
0050C774 |. E8 AF6AEFFF CALL Name Deleted.00403228
0050C779 |. 8BD8 MOV EBX,EAX
0050C77B |. 8BC3 MOV EAX,EBX
0050C77D |. 83E8 01 SUB EAX,1 ; Switch (cases 0..1)
0050C780 |. 72 04 JB SHORT Name Deleted.0050C786
0050C782 |. 74 3B JE SHORT Name Deleted.0050C7BF
0050C784 |. EB 70 JMP SHORT Name Deleted.0050C7F6
0050C786 |> 68 CBBC0C00 PUSH 0CBCCB ; Case 0 of switch 0050C77D
0050C78B |. 8D55 F4 LEA EDX,DWORD PTR SS:[EBP-C]
0050C78E |. B8 28000000 MOV EAX,28
0050C793 |. E8 B8A3FFFF CALL Name Deleted.00506B50
0050C798 |. 8B4D F4 MOV ECX,DWORD PTR SS:[EBP-C]
0050C79B |. 8B15 C83D5900 MOV EDX,DWORD PTR DS:[593DC8] ; Name Deleted.00594CB4
0050C7A1 |. 8B12 MOV EDX,DWORD PTR DS:[EDX]
0050C7A3 |. 8D45 F8 LEA EAX,DWORD PTR SS:[EBP-8]
0050C7A6 |. E8 3188EFFF CALL Name Deleted.00404FDC
0050C7AB |. 8B4D F8 MOV ECX,DWORD PTR SS:[EBP-8] ; |
0050C7AE |. B2 01 MOV DL,1 ; |
0050C7B0 |. A1 1C6F4F00 MOV EAX,DWORD PTR DS:[4F6F1C] ; |
0050C7B5 |. E8 86A8FEFF CALL Name Deleted.004F7040 ; \FitnessA.004F7040
0050C7BA |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0050C7BD |. EB 37 JMP SHORT Name Deleted.0050C7F6
0050C7BF |> 68 BC129D00 PUSH 9D12BC ; Case 1 of switch 0050C77D
0050C7C4 |. 8D55 EC LEA EDX,DWORD PTR SS:[EBP-14]
0050C7C7 |. B8 29000000 MOV EAX,29
0050C7CC |. E8 7FA3FFFF CALL Name Deleted.00506B50
0050C7D1 |. 8B4D EC MOV ECX,DWORD PTR SS:[EBP-14]
0050C7D4 |. 8B15 C83D5900 MOV EDX,DWORD PTR DS:[593DC8] ; Name Deleted.00594CB4
0050C7DA |. 8B12 MOV EDX,DWORD PTR DS:[EDX]
0050C7DC |. 8D45 F0 LEA EAX,DWORD PTR SS:[EBP-10]
0050C7DF |. E8 F887EFFF CALL Name Deleted.00404FDC
0050C7E4 |. 8B4D F0 MOV ECX,DWORD PTR SS:[EBP-10] ; |
0050C7E7 |. B2 01 MOV DL,1 ; |
0050C7E9 |. A1 1C6F4F00 MOV EAX,DWORD PTR DS:[4F6F1C] ; |
0050C7EE |. E8 4DA8FEFF CALL Name Deleted.004F7040 ; \Name Deleted.004F7040
0050C7F3 |. 8945 FC MOV DWORD PTR SS:[EBP-4],EAX
0050C7F6 |> B9 ECC85000 MOV ECX,Name Deleted.0050C8EC ; ASCII "AKSDHASA"; Default case of switch 0050C77D
0050C7FB |. B2 01 MOV DL,1
0050C7FD |. A1 2C2F4F00 MOV EAX,DWORD PTR DS:[4F2F2C]
0050C802 |. E8 6169FEFF CALL Name Deleted.004F3168
0050C807 |. 8BF0 MOV ESI,EAX
0050C809 |. 8D55 E8 LEA EDX,DWORD PTR SS:[EBP-18]
0050C80C |. 8B87 24030000 MOV EAX,DWORD PTR DS:[EDI+324]
0050C812 |. E8 1901F7FF CALL Name Deleted.0047C930
0050C817 |. 8B4D E8 MOV ECX,DWORD PTR SS:[EBP-18]
0050C81A |. BA 00C95000 MOV EDX,Name Deleted.0050C900 ; Grab code here
0050C81F |. 8BC6 MOV EAX,ESI
0050C821 |. E8 0668FEFF CALL Name Deleted.004F302C
0050C826 |. 68 00003540 PUSH 40350000
0050C82B |. 6A 00 PUSH 0
0050C82D |. A1 9C3B5900 MOV EAX,DWORD PTR DS:[593B9C]
0050C832 |. E8 BD74EFFF CALL Name Deleted.00403CF4
0050C837 |. E8 E063EFFF CALL Name Deleted.00402C1C
0050C83C |. 52 PUSH EDX ; |/Arg2
0050C83D |. 50 PUSH EAX ; ||Compare to Seed 8475015
0050C83E |. 8D45 E4 LEA EAX,DWORD PTR SS:[EBP-1C] ; ||
0050C841 |. E8 AED3EFFF CALL Name Deleted.00409BF4 ; |\Name Deleted.00409BF4
0050C846 |. 8B45 E4 MOV EAX,DWORD PTR SS:[EBP-1C] ; |
0050C849 |. 50 PUSH EAX ; |Arg1
0050C84A |. B9 02000000 MOV ECX,2 ; |
0050C84F |. 8BD6 MOV EDX,ESI ; |
0050C851 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; |
0050C854 |. E8 F7ADFEFF CALL Name Deleted.004F7650 ; \Name Deleted.004F7650
0050C859 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0050C85C |. E8 1F3DF0FF CALL Name Deleted.00410580
0050C861 |. 8BC3 MOV EAX,EBX
0050C863 |. E8 84BAFFFF CALL Name Deleted.005082EC
0050C868 |. A1 303B5900 MOV EAX,DWORD PTR DS:[593B30]
0050C86D |. 8338 00 CMP DWORD PTR DS:[EAX],0
0050C870 |. 74 1E JE SHORT Name Deleted.0050C890 ; COMPARE JUMP is bad no jump good
0050C872 |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
0050C875 |. B8 25000000 MOV EAX,25
0050C87A |. E8 D1A2FFFF CALL Name Deleted.00506B50
0050C87F |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]
0050C882 |. E8 D909F3FF CALL Name Deleted.0043D260
0050C887 |. 8BC7 MOV EAX,EDI
0050C889 |. E8 263BF9FF CALL Name Deleted.004A03B4
0050C88E |. EB 15 JMP SHORT Name Deleted.0050C8A5
0050C890 |> 8D55 DC LEA EDX,DWORD PTR SS:[EBP-24]
0050C893 |. B8 26000000 MOV EAX,26
0050C898 |. E8 B3A2FFFF CALL Name Deleted.00506B50
0050C89D |. 8B45 DC MOV EAX,DWORD PTR SS:[EBP-24]
0050C8A0 |. E8 BB09F3FF CALL Name Deleted.0043D260 ; Bad key message
0050C8A5 |> 33C0 XOR EAX,EAX
0050C8A7 |. 5A POP EDX
0050C8A8 |. 59 POP ECX
0050C8A9 |. 59 POP ECX
0050C8AA |. 64:8910 MOV DWORD PTR FS:[EAX],EDX
0050C8AD |. 68 DCC85000 PUSH Name Deleted.0050C8DC
0050C8B2 |> 8D45 DC LEA EAX,DWORD PTR SS:[EBP-24]
0050C8B5 |. BA 03000000 MOV EDX,3
0050C8BA |. E8 3584EFFF CALL Name Deleted.00404CF4
0050C8BF |. 8D45 E8 LEA EAX,DWORD PTR SS:[EBP-18]
0050C8C2 |. E8 0984EFFF CALL Name Deleted.00404CD0
0050C8C7 |. 8D45 EC LEA EAX,DWORD PTR SS:[EBP-14]
0050C8CA |. BA 04000000 MOV EDX,4
0050C8CF |. E8 2084EFFF CALL Name Deleted.00404CF4
0050C8D4 \. C3 RETN

6. NOW ask your question....
I could use some help on were to look, how to proceed. I can't seem to figure out where it is comparing what is entered for the serial to grab it. Is it that it doesn't store it anywere visible? If that is the case then any suggestions on how I can proceed attacking this routine.

Thanks
JMI
01-04-2005, 04:55 PM
sloppysam:

Very nice job of attempting to follow the FAQ on your first post, and you did really well, until you got "sloppy" on one "critical" point. You failed to review your code snippet to remove identifying information about the identity of your target. Review your code above and notice how many times the words "Name Deleted" appears and you will see the magniture of your error.

ATTENTION TO DETAIL IS REQUIRED, although you were making a good effort. I stress this point because it is critical to avoid unwanted attacks upon this Board for posting "crack" information. :idea:

Regards,
sloppysam
01-04-2005, 05:08 PM
Yes, thank you for pointing out my error, with a bit of appreciated humor. I am sure that this happens often and I thank you for being nice about it and fixing the problem. I will make note of this and fix this in the future before posting again.

Thank you
JMI
01-04-2005, 07:29 PM
And thank you for understanding that it is not just mindless bitching. Some of the Rules are in place to attempt to make the management's job, and the understanding of the questions, easier. Others, like this particular one, are in place to try to protect the Board itself from frequent attacks on our ISP for allegations that we are hosting cracks. :eek:

You really DID make a very good first effort :yay: , and it is NOT unusual that users forget to "clean-up" their code snippets, because they tend to think about the question they ask, but not carefully read the literal content of their code.

And, yes, where possible, I try to add some humour to my posts. And sometimes, it is even actually humourous and sometimes that is even appreciated. :devil:

Please also remember, that now that you have posted "target specific code" you may NOT post the name of the program, but you MAY communicate it to interested persons by PM or email. :idea:

Welcome and happy reversing.

Regards,
naides
01-04-2005, 09:43 PM
0050C84A |. B9 02000000 MOV ECX,2 ; |
0050C84F |. 8BD6 MOV EDX,ESI ; |
0050C851 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4] ; |
0050C854 |. E8 F7ADFEFF CALL Name Deleted.004F7650 ; \Name Deleted.004F7650
0050C859 |. 8D45 FC LEA EAX,DWORD PTR SS:[EBP-4]
0050C85C |. E8 1F3DF0FF CALL Name Deleted.00410580
0050C861 |. 8BC3 MOV EAX,EBX
0050C863 |. E8 84BAFFFF CALL Name Deleted.005082EC
0050C868 |. A1 303B5900 MOV EAX,DWORD PTR DS:[593B30] ; start by the end: The flag that says 'badboy is a DWORD stored at address 593B30.
If that flag is equal to 0, DS:[EAX] is equal to 0 and the bad boy jump is taken. SO PUT A WATCH or a BPM on that address and see who reads it, and
more important who writes to it. Who or whatever stores a value different from 0 is the good boy routine. better yet, at the beginging of the routine ,
manually place a 00000001 value into that mem address, [593B30], and watch carefully who changes it.

0050C86D |. 8338 00 CMP DWORD PTR DS:[EAX],0
0050C870 |. 74 1E JE SHORT Name Deleted.0050C890 ; COMPARE JUMP is bad no jump good
0050C872 |. 8D55 E0 LEA EDX,DWORD PTR SS:[EBP-20]
0050C875 |. B8 25000000 MOV EAX,25
0050C87A |. E8 D1A2FFFF CALL Name Deleted.00506B50
0050C87F |. 8B45 E0 MOV EAX,DWORD PTR SS:[EBP-20]

Thanks

Question: If you manually invert the

0050C870 |. 74 1E JE SHORT Name Deleted.0050C890

Do you get registered?

If you manually change the value stored at:

DWORD PTR DS:[593B30]

do you get the good boy message/behavoir??
sloppysam
01-04-2005, 10:40 PM
I tried reversing the jmp so that it would be a jne as this works for many programs. What happens is that you get the good boy message but are not registered. This program stores everything in dat files and I believe that it checks at startup and if the correct number isn't there it doesn't say that it is registered.

I am going to try changing the memory and see what happens.

Thanks for the hints.
sloppysam
01-05-2005, 02:16 AM
start by the end: The flag that says 'badboy is a DWORD stored at address 593B30.
If that flag is equal to 0, DS:[EAX] is equal to 0 and the bad boy jump is taken. SO PUT A WATCH or a BPM on that address and see who reads it, and
more important who writes to it. Who or whatever stores a value different from 0 is the good boy routine. better yet, at the beginging of the routine ,
manually place a 00000001 value into that mem address, [593B30], and watch carefully who changes it.

When I change that memory address it always crashes the program. So I went further into the code figuring I could reverse some more jumps and see what happens.

Ok by reversing some more jumps I got the program to say that it is registered until you restart it. That means that it is getting the information from one of its .dat files. I need to get the program to bypass that on start up. So I went looking for the referenced memory address and found a bunch of compares to that address when the program starts up. 4 of the 5 do nothing obvious when reversed but one of them gives the message that this is now an invalid copy of the program and to reinstall it. Looks like we hit a nerve here.

So instead of changing it to a reversed jump i just changed it to jump to the location. That along with a couple other references to the date did it. Now it just says that there are negative days remaining. Thanks a bunch naides, you didn't give me the answer but you gave me an idea and it pointed me inthe right direction.

This is a really dirty solution but it works. Perhaps we could keep working on this to find a more eloquent solution?
naides
01-05-2005, 07:37 AM
This is a really dirty solution but it works. Perhaps we could keep working on this to find a more eloquent solution?
Gr8!

You are 95% there. I would locate the routine that WRITES or somehow stores a 0 value there. it may even be read it from .dat file as a resource or something.


Article about next-generation movie/DVD encryption
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Article about next-generation movie/DVD encryption
PDA

View Full Version : Article about next-generation movie/DVD encryption

dELTA
01-05-2005, 05:40 AM
Article about next-generation movie/DVD encryption, contains some nice details. Seems that they at least will be using a scheme where the real keys are encrypted with a dynamic set of player-keys this time, for easy revocation of compromised keys. They've also learned that baking your own cool crypto is not such a good idea (AES will be used).

http://www.spectrum.ieee.org/WEBONLY/publicfeature/jan05/0105ldvd.html

I completely agree with the guy quoted in the end of the article though:
"As long as I have the technology in my living room to watch it for myself, I can modify the system to extract the video. They can make it hard, but they can't make it impossible. They are living in a fantasy world."


Experiences with AVP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Experiences with AVP
PDA

View Full Version : Experiences with AVP

Fake51
01-05-2005, 07:42 AM
Was just wondering if anyone has ever worked on Kasperskys AVP. Not looking for help, hints or anything, just wondering if anyone has tried their hands at it, and succeded. Just doing it for the fun of it.

Fake
evlncrn8
01-05-2005, 06:50 PM
you mean making a valid registration key or cracking it?
Fake51
01-06-2005, 05:26 AM
I mean any and all experiences with it, whether that be reversing the whole app, making a valid keyfile, patching it up, fooling it, whatever.
As I said before, I'm not looking for any essays, tuts, helps, hints, or cracked exes, just curious what other people thought about taking it on.

Fake
cRk
01-06-2005, 10:27 AM
maybe is not good idea at all trying to reverse/kill crc checks of KAV files.. it's part of itselft virus detection/protection.... :idea:
Fake51
01-06-2005, 11:18 AM
Heh, you're right. Or, you should be. However, I changed an AVP dll file (inserted an int 3), but it didn't seem to care at all about that (patched it back in mem, when it triggered, but there should have been something before that). Ofcourse there could have been silent alarms, but since the app went on about its business as if nothing happened whatsoever, it is a bit amusing/worrying ;)

Heh, and speaking of antivirus that should do selfchecks: I remember toying with mcafee once. Found a good spot for patching and went about my business, but mcafee ofcourse complained. Then I tried patching another place in the same file, and everything went smooth. Far as I could tell, their crc-routine only cared about every other byte, making a onebyte patch in the right place work fine. Talk about security (but then again, what should one expect from a company that doesn't have decent security on it's ftp).

Fake


new tutorial
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > new tutorial
PDA

View Full Version : new tutorial

0xf001
01-05-2005, 10:57 PM
hi all,

i have written an in depth tutorial for detten's "trythis" crackme, the crackme
can be found at ptth://biw.rult.at

the tutorial includes much explanation as well as a serial generator :D

you can grab it at
ptth://home.pages.at/f001/0xf001_trythis_tutorial.txt

enjoy!

regards, 0xf001
blabberer
01-06-2005, 04:16 AM
well in gdb you can use set di i
or in big form
set disassembler-flovor intel to get gdb to produce intel output rather than AT&T
if you wish so :)
but if you use intel flavour the dissassembly in registers gets to decimal notation

ie an address like this [ebp-520] here 520 is deimal not hex :)
so if you want to do hexdump $[ebp-520] or ddump $[ebp-520] you have to use
hexdump $[ebp-0x208] or ddump $[ebp-0x208]

or you set the input-radix to 10. (notice the dot :) )
ie
gdb trythis
bp main
set di i
set input-radix 10.
run

will get you better results :) as you prefer intel syntax :)
have fun and change your tut and wrap it to 800.600
i still see a horizontal scroll making reading the page an irritation :)
nice tut
0xf001
01-06-2005, 08:03 AM
thx for the hints blabberer,

you could send a gdb tutorial :)

well i am not so concerned about at&t or radix, as you might think :)

in fact i prefer hex notation before decimal one. i wrote as a part of
an argument in the other thread that i do not like to use objdump for disassembly as it is very limited. this is the main concern.

with very limited i mean: relying on section headers, and also not doing
control flow disassembly. by that it is useless to most jobs. of course
your gcc created executables it can disassemble. but nothing that
uses the most basic tricks.

thanks, 0xf001


Assembler to C
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Assembler to C
PDA

View Full Version : Assembler to C

XFlorian
01-07-2005, 10:32 AM
hi

I'm looking for a tutorial which describes how can I translate Assembler code oder Assembler commands into C. Does anyone no one? If so I would be very happy :)
dELTA
01-07-2005, 10:54 AM
http://research.sun.com/people/cristina/decompilation-publications.html
Hero
01-12-2005, 01:17 AM
This tutorial is great.But As I know for some languages we can't make good
decompiler such as C,C++,... and this is because of its compiler optimizer.
But for some languages like java we can find decompiler that makes decompiled
applications with a good mapping to its source code.For C,C++,... using a
dissassembler is better.

sincerely yours
4nil
01-18-2005, 11:35 PM
yeah,i think c/c++ is very difficult to discompile, so there are no good discompile software for c/c++ around the world.
Aimless
01-19-2005, 12:18 AM
As I understand it, you would like to do it for a better understanding of what the program does rather than trying to recompile it back again.

If that is indeed the case, you may try out:

1. A utility (wingraph works OK) that creates flowchart of your assembly program (better still, use it with IDA ;))

2. Plugins for IDA like desquire and one other from Polaris (the name slips by me right now)

Be warned though, it is difficult to even think of decompiling anything but the most easiest of programs.

Have Phun
disavowed
01-19-2005, 12:23 AM
Be warned though, it is difficult to even think of decompiling anything but the most easiest of programs.
From personal experience of decompiling malware, I would say it's more time consuming than difficult. (Read as: EXTREMELY time consuming, and only relatively difficult)
lifewire
01-19-2005, 11:35 AM
indeed, like disavowed says; it isn't very hard to do. however, you'll need quite good knowledge the language it was written in originally as well as in assembler, and some general knowledge and experience how HLL looks in assembler. the nice thing of compilers is that they are quite limited and have a well defined behavior, you can recognize locals easily, if APIs are called you can identify the type of the arguments which are passed to the API, etc. such things make life easier. on the other hand, whiles and fors are equal, etc. a lot of information disappears while compiling.
Rackmount
01-22-2005, 10:35 AM
XFlorian:

Mammon wrote a good tutorial on the very subject you are interested in. Although a bit old and dusty, it should provide you with typical logic involved in taking asm back to c.

hxxp://www.eccentrix.com/members/mammon/Text/StringManip.html

Indeed, you should read many of the other tutorials on this site as well.

Rackmount


Interesting book on RCE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Interesting book on RCE
PDA

View Full Version : Interesting book on RCE

Polaris
01-07-2005, 02:10 PM
Ok this is still to come but... Sounds interesting ;) We'll see...

http://eu.wiley.com/WileyCDA/WileyTitle/productCd-0764574817.html
disavowed
01-10-2005, 08:14 PM
Hmm... this concerns me:

"Offers a primer on advanced reverse-engineering, delving into 'disassembly'-code-level reverse engineering-and explaining how to decipher assembly language"

Hmm... if disassembling is considered advanced, I don't know what that says about the rest of the book. Maybe I'm misreading the line or am being too critical.

Thanks for posting the link, though, Polaris!
Polaris
01-11-2005, 01:51 AM
Sure... The great danger with this kind of books is that they turn out into "beginner's stuff" :(

However the description says: "Beginning with a basic primer on reverse engineering-including computer internals, operating systems, and assembly language-and then discussing the various
applications of reverse engineering, this book provides readers with practical, in-depth techniques for software reverse engineering."

So maybe it will first introduce assembly (but I ask:how can be something complex like asm just introduced???) and then carry on more advanced tasks.... :D

We'll see..........

Byez!
Silver
01-12-2005, 11:58 AM
One comment in it's defence. Every "advanced" topic book from a major publisher contains beginner sections. It's the same with DirectX books. The publisher mandates that the authors must dedicate a percentage of the book (say, 25%) to covering basic topics. The thinking behind this is that it allows anyone to pick up the book and use it. In reality all it does is fool people into thinking the book is appropriate for them, and when they get home they're very disappointed to not understand a word of it. To give a practical example, some of the Premier Press DirectX books are supposedly for advanced DX coders. Excluding the fact that they're not, they even have a C++ primer section along with an introduction to DX. If you don't even know C++ before starting on DirectX, you shouldn't be looking at any DX books.

I guess it's the same principle. Not the authors fault, the publisher pays the bills...


PSDS_Crypto (panasonic crypto)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > PSDS_Crypto (panasonic crypto)
PDA

View Full Version : PSDS_Crypto (panasonic crypto)

LOUZEW
01-10-2005, 04:11 PM
Hi, all
Picked up some technical docs about a Switchboard from panasonic. They are PDF files, when i try to open them, Acrobat reader try to update online, but never go fine !

I've tried to open them with some tools like Advanced PDF Password Recovery Pro and it tell me that this file is encrypted by panasonic crypto (PSDS_Crypto).

I've searched alot (here, but on other board too and on the whoole internet), and find quite nothing (just a guy on one forum speking off an adobe plugin but without any mention to the plugin name or something like that). Moreover this board is in RUSSIAN language, i've tranlated the thread with a soft but we all know these soft limits !

Does anybody know about this protection and maybe a way to decrypt ? I've no idea.
mike
01-11-2005, 10:09 PM
Adobe has an extensible encryption architecture. Companies can roll their own encryption dlls and encrypt with them. Sounds like you got a PDF encrypted by whatever encryption Panasonic is using. Unless you get ahold of those dlls to reverse-engineer, you're out of luck.
HaRdLoCk
01-25-2005, 05:38 PM
check this out:

hxxp://www.wrs1.com/sheme/viewers/Panasonic_PSDS_HASP-Crypto_plugin_for_Adobe_Acrobat_Reader.zip

it seems that this plugin uses hasp protection. that archive holds also an emulator.. no clue if it works but you might give it a try. :-)
LOUZEW
01-31-2005, 03:55 PM
Many thank's Hardlock
Will try it tomorrow !
LOUZEW
02-01-2005, 12:00 PM
Many Thank's Hardlock ! ! !
It work fine, it's exactly what i need !


Memory Hacking Software
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Memory Hacking Software
PDA

View Full Version : Memory Hacking Software

disavowed
01-10-2005, 11:43 PM
Could someone with access to downloading from ExeTools' forums post here the tool from http://forum.exetools.com/showthread.php?t=6217? Thanks!
lifewire
01-11-2005, 07:20 AM
pssst... don't tell JMI ;)
SiNTAX
01-11-2005, 10:31 AM
Ohhh we can make requests here for exetools downloads :)

/me grabs his list...
JMI
01-11-2005, 07:26 PM
Well, let's not get TOO carried away. :eek:

Regards,
countryman
01-12-2005, 05:24 AM
i'm beginner in cracking
so, i want to learn how to the cracking
please ~~~
lifewire
01-12-2005, 11:26 AM
Ohhh we can make requests here for exetools downloads :)

/me grabs his list...

nah, this service only applies to people with an animated avatar containing only green RGB-components who joined in april 2002... :devil:
Rackmount
01-12-2005, 12:40 PM
Dang...and to think I was gonna ask for the updated version of the topic proggie. After all, I need that browser button...
disavowed
01-12-2005, 10:47 PM
hmm... this program wasn't quite what I expected it to be.

thanks for posting it, though, lifewire!


little state of art in decompilation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > little state of art in decompilation
PDA

View Full Version : little state of art in decompilation

Shub-nigurrath
01-11-2005, 03:45 AM
A while back I found an interesting paper "Reverse Engineering and the Computing Profession" by C. Cifuentes, Computer Dec 2001, pp.166-168

Inside there were an interesting sidebar about the state of the art in Decompilation and RCE in general, which had some interesting links, some of which new to me also.

This come in my hands again recently in electronic format, and despite the paper dates back 2001, the information inside are still valid. I decided to share it here for your convenience, to whom's interested with the sake of being useful to some1.

State of the Art
American and European researchers have developed several good high-level tools for reverse engineering. Tools such as Rigi (http://www.rigi.csc.uvic.ca), PBS (http://swag.uwaterloo.ca/pbs/), and GUPRO (http://www.gupro.de/) aid in program understanding and software architecture recovery.
Other tools, such as SHriMP (http://www.thechiselgroup.org/shrimp), significantly contribute to understanding a large piece of software through different visualization techniques.

Most tools focus on one aspect of reverse engineering. They may specialize in parsing code well, producing different types of graph views, or producing architecture diagrams in UML. Unlike program transformation tools such as compilers, which build an intermediate representation in memory and apply transformations to that representation internally, reverse engineering tools tend to cooperate with each other to support different parts of the reverse engineering process.

The Graph eXchange Language (http://www.gupro.de/GXL/) has simplified reverse-engineering tool interoperability. GXL, based on XML, resulted from an international collaboration between researchers in academia and industry. An extensible language, it supports any graph-based data format. For example, you can describe a control flow graph or an abstract syntax tree in GXL.
A key difficulty in using reverse engineering tools arises from their need to support a variety of languages or be capable of extension to support another language. Although building them has often proven to be a daunting task, tools have been successfully designed to convert Cobol code to C, and to translate C code to C++ or Java code.

Some low-level reverse engineering tools have also been successful, including interactive commercial disassemblers such as IDA Pro (http://www.datarescue.com/idabase/ida.htm) and Sourcer (www.v-com.com/product/Sourcer_Home.html), which provide good quality assembly code for a variety of machines. During the Y2K crisis, a few companies provided decompilation services for Cobol binaries because many large organizations have vast legacy applications written in that language. Java decompilers have also been written—more easily than some other decompilers because the Java program’s binary format is not machine code but rather an intermediate representation called Java bytecodes.
Otherwise, most decompilation techniques are supported manually: The engineer decompiles assembly code mentally and annotates the representation with its high-level equivalent.


XP using not only ring0/ring3?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > XP using not only ring0/ring3?
PDA

View Full Version : XP using not only ring0/ring3?

omega_red
01-11-2005, 05:50 AM
Recently, I've run my GDT/IDT/LDT dumper on an XP SP2 system, and found some really interesting data.

In GDT:

#0009: 0048 [8203c000:00000177] * 32bit=0, gran=0, present=1, dpl=0, type=[S] LDT

This LDT is not empty:

Reading secondary Local Descriptors Table...
Base = 8203c000, limit = 0177

#0000: 0002 [41540a2e:00000000] * 32bit=1, gran=0, present=0, dpl=2, type=[S] 16-bit TSS (busy)
#0001: null
#0002: 0012 [82140000:00030000] * 32bit=0, gran=0, present=1, dpl=2, type=[S] Unknown [0000]
#0003: 001a [821c8203:0003c014] * 32bit=0, gran=0, present=1, dpl=2, type=[S] Unknown [0000]
#0004: 0022 [82248203:0003c01c] * 32bit=0, gran=0, present=1, dpl=2, type=[S] Unknown [0000]
#0005: 0028 [00008203:0008c024] * 32bit=0, gran=0, present=0, dpl=0, type=[S] 16-bit Call Gate
#0006: null
#0007: null
#0008: null
#0009: 0048 [00000000:00000000] * 32bit=0, gran=0, present=1, dpl=0, type=[S] Unknown [0000]
#000a: null
#000b: null
#000c: null
#000d: 0068 [00000000:00000000] * 32bit=0, gran=0, present=0, dpl=0, type=[S] 16-bit TSS (available)
#000e: null
#000f: null
...

The LDT from LDTR is null, however. What's interesting, that in this "secondary" 16-bit LDT some descriptors have DPL = 1 or 2. I don't know if it's just garbage (it seems so), but then what's the purpose of this? The #9 selector in GDT is null in w2k. As I recall, XP SP1 was similar to 2k - no secondary LDT. My tool seems to work good, I wish I had SoftIce at my office to check it ;)

Full dumps from w2k sp4 and xp sp2:
http://ry.pl/~omega/n/sdt_dump_2k_sp4.txt
http://ry.pl/~omega/n/sdt_dump_xp_sp2.txt

The utility:
http://ry.pl/~omega/asm/sdt.zip
WaxfordSqueers
01-29-2005, 05:45 PM
The LDT from LDTR is null, however. What's interesting, that in this "secondary" 16-bit LDT some descriptors have DPL = 1 or 2. I don't know if it's just garbage (it seems so), but then what's the purpose of this? ]

I'm pretty new to GDT/LDT and don't pretend to understand it well. My understanding is that the LDT is being reserved for DOS-based applications in XP, and in XP that would mean the DOS window. I have never seen a listing for the LDT in XP with SP2 using purely 32 bit apps. Of course, I haven't looked a lot either. :)

I read somewhere as well that Windows doesn't use privelege levels 1 and 2 to keep it compatible with Unix based systems (I think). If you are seeing LDT listings and the use of privelege levels 1 and 2, would that not suggest a DOS app is running? I'm wondering about the app you're using to view the GDT/LDT. Maybe it's using DOS extended mode.

Windows starts in real mode then switches to protected mode. I don't know if an app running in DOS extended mode can start in Windows or whether it needs to boot clean.
evaluator
01-30-2005, 04:07 AM
LDT mostly is need for 16bit apps..
debug them & see.


Additional process without name...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Additional process without name...
PDA

View Full Version : Additional process without name...

Ja187
01-11-2005, 08:26 AM
Target: Few apps (year 2004)
Problem: App have some antidebugging tricks. When I execute it , it shows me messagebox with "Debugger detected!" error. So I bmsg xxx wm_destroy on it and I land in a code that don't have name in softice. I realized that app have sth like additional proccess with protection routine. The code of additional process is unreachable at start (app unpacks it.. I suppose). I can't dump it.
Kayaker
01-11-2005, 04:46 PM
And...?

Something you might try, I don't know if it would detect the code section or not, is the Softice QUERY command to display the virtual address map of the process, specify either the process or the linear address of the code in question. Use ADDR to make sure you're in the correct context. The code might be executing in its own thread in which case THREAD -x might give useful info. Then there's the HEAP command, if the app allocates memory to run some code, it might pick that up (also shown by QUERY). Also, using the STACK command might be useful when you break into the code.

I don't know if any of the results would be useful for you, but it might give some info. Especially if you compare with results from a "debugger hidden" run (Iceext?). If not, I think at least some of the information could be obtained from other tools without Sice running.

Kayaker
crUsAdEr
01-11-2005, 05:52 PM
ADDR will list out all running process,
ADDR processname will switch to the desired process where you can patch, dump and take a look ard your cryptic process :)


Jobs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Jobs
PDA

View Full Version : Jobs

Ja187
01-11-2005, 08:52 AM
I'm just curious...
How old are you and what kind of job do you have?
I'm 22 years old, and I'm a student of informatics...
dELTA
01-11-2005, 11:20 AM
I'm 38 and I'm an FBI agent, and I'm here to take you all dow... err, I mean... :p Seriously, there are probably a lot of people who don't want to give out that kind of info here, but I guess you could always try... :rolleyes:
JMI
01-11-2005, 07:28 PM
I KNEW dELTA had been lying about his age. :eek: Now if I could only figure out "WHEN." :devil:

Regards,
disavowed
01-12-2005, 10:35 PM
what kind of job do you have?
software security and reverse engineering :yay:
lifewire
01-13-2005, 09:48 AM
student, something with electronics i guess.
klier
01-13-2005, 01:04 PM
when i grow up,i want to be a rider like my father.
Regards,
JMI
01-13-2005, 01:44 PM
And what does your father "ride"? :eek:

Regards,
klier
01-13-2005, 02:09 PM
the breeze...
what were you thinking?!
Regards,
JMI
01-13-2005, 02:45 PM
Maybe a Harley. :yay:

Regards,
Kayaker
01-13-2005, 03:48 PM
That's NOT what you were thinking, and you know it! :devil:
JMI
01-13-2005, 04:13 PM
Actually, I was really wondering if he had mispelled "writer" with "rider". :eek:

Now Kayaker, what the heck were YOU thinking????? :smug:

Regards,
0xf001
01-13-2005, 08:43 PM
i really do not know what you all think, but I thought nothink while reading his thread until your post,

jmi: it is good that you emphasize the word "really", I think :)

I also think there is somebody who thinks he can, thinks he can, thinks he can ...

ok, enough I better should get a job ...

my 2 thoughts :thinking: <-- even he is : thinking :
TBone
01-15-2005, 08:54 AM
That guy who thinks he can sounds crazy. You should hang around better people :p
0xf001
01-15-2005, 09:28 AM
i like your signature! :)
just because people think so much or not i meantioned it
cheers!
JMI
01-15-2005, 02:22 PM
When I was a child, several centuries ago, there was a children's song about a little train engine who was trying to prove he could pull cars like the "big boys." A part of the song was about him starting to pull a load of cars and the refrain was: "I think I can, I think I can, I think I can." ;) In the song it was sung like the sound of a steam engine slowly reving up and slowly getting faster and faster.

Now see what fun all you youngins missed. :idea:

Regards,
TBone
01-15-2005, 09:59 PM
It's funny you should mention that, JMI. Maybe I should fill people in.

Those of you who didn't grow up as a child in America probably won't quite catch the whole significance of my sig. It's a quote from a "The Little Engine That Could", which is a very famous children's book in the U.S. Almost every child read it at some point, and probably most of us actually had a copy when we were knee-high. I know I did, and my parents probably still have it somewhere in their attic.

It was originally published in 1930, so it's been around long enough that maybe even the "old man's" old man might have read it as a child. It's been a long time since I've read it, but as I recall the story goes something like this: there were a whole bunch of toys in train cars that were supposed to be sent to all the little boys and girls, but they couldn't find an engine that would pull them up the steep mountain. They asked a brand new shiny engine to pull them, but it was too vain to pull the toys, so it only told them "I can not. I can not." And then they went to a big strong engine and asked it to pull them up the mountain. But it was too haughty to pull the toys and told them "I can not. I can not." So finally, they went to a little blue switch train (a small engine that's only used to haul small loads in a switching yard) and asked her to pull them up the mountain. The little engine just told them "I think I can." So it started up the mountain saying, "I think I can, I think I can, I think I can..." getting slower and slower, "I think...I...can...I...think...I...can..." And just as it was about to wear out, they madee it over the mountain peak, and all the way down it said, "I thought I could! I though I could!..."

Well, I feel thoroughly foolish now having held "story time" for all the adults around here, but somehow I thought it might be interesting :p. I don't know for sure how the book became so popular, but if you say "I think I can, I think I can," just about anyone who spent their childhood in America will recognize it. The book's authorship was attributed to "Watty Piper", but that was just a psuedonym used by a publishing company. To this day, no one really knows for sure who wrote the story. In all likelyhood, the earliest version of it dates back to the first decade of the 20th century, or maybe earlier. The original publisher finally settled a lawsuit by agreeing that Frances Ford wrote the book, but no one was able to prove it satisfactorily. There's a surprisingly well researched biography of the book here (I guess English Lit. majors must get bored :D):

hxxp://tigger.uic.edu/~plotnick/littleng.htm

I don't know exactly which version JMI heard, but there are 4 or 5 recorded song versions of the story listed in the bibliography. I have no idea if the book became a classic in any other English-speaking countries, or if they just look at us like we're crazy :thinking:. Any Brits or Aussies out there want to compare notes?
Silver
01-16-2005, 07:35 AM
I don't recall hearing any story similar to that, so maybe it's a US thing. But it does bear an uncanny resemblance to Thomas the Tank Engine :D
Hero
01-16-2005, 12:17 PM
I'm 21.A student of software engineering.
But I think I can find some parts of computer courses better in here,such as OS. :p

sincerely yours
JMI
01-17-2005, 11:51 AM
TBone:

That is indeed the story and song to which I referred. Last time I actually heard and/or read it would have been in the early 1950's. :eek: I recall having both the record and the book as part of my early reading materials. ;)
The old man's old man, however, did not grow up in the U.S. and I do not recall him ever expressing any familiarity with it. :thinking: But the old man's mother did grow up here and thought the book and the song were something her children should read and learn its lessons. :yay: Those lessons were, of course, that if one does not try, and sometimes try very very hard, one surely can not, and will not succeed.

Regards,
naides
01-17-2005, 12:07 PM
I am 19,

I hold several jobs

Laptop Dancer

Tabletop Dancer

Non-therapeutic massage

House calls

In my free time I do other, more boring things, like. . . working!
dELTA
01-17-2005, 01:16 PM
But the old man's mother did grow up here and thought the book and the song were something her children should read and learn its lessons. Those lessons were, of course, that if one does not try, and sometimes try very very hard, one surely can not, and will not succeed.Are you sure it wasn't just "Don't get too many toys, you're gonna have to drag around the damn things yourself, cause we sure as hell ain't gonna help you."? :D
JMI
01-17-2005, 01:21 PM
Since I had "too many toys," and didn't move very ofter between the age of three and 18, that couldn't have been the rule. :rolleyes: But it certainly is something which came into play later in life. :yay: It is not at all "untypical" for Americans to require some form of "storage" facility to keep all the "stuff" they have, but are really no longer actually using. :eek:

Regards,
Silver
01-18-2005, 12:50 PM
didn't move very ofter between the age of three and 18

Who says the rumour of Americans being lazy and not making the effort to exercise is true, eh ;)
JMI
01-18-2005, 01:46 PM
Silver:

You are right, I was lazy. I should have done more than just the tennis, gymnastics, and fencing. :D Reposte. :yay:

Regards,
JimmyClif
01-18-2005, 02:38 PM
IIRC in 'Major Payne' (http://www.imdb.com/title/tt0110443/) the 'Major' tells a variation of the little engine story ;)
dELTA
01-19-2005, 09:18 AM
http://majorpayne.tyreeonline.com/mp3/little_engine.mp3

And text version:
Once upon a time, deep deep in the jungle. There was a little engine that could. He was chugging his way across the enemy line...chugga chugga, toot toot. This little engines' mission was to take some AK-47's and a nuclear payload, over the mountain to the 2063 Battalion. Needless to say, there was plenty of opposition. You think that stopped the little engine that could? No siree bob. He just kept chugging along...chugga chugga toot toot. Not even when they climbed aboard the train, and popped out the eyes of the conducter, and blood and snot was drippin out of his eye sockets. Think that stopped the engine that could? Damn skippy...he just kept chuggin along...chugga chugga toot toot. Wasn't until Charlie rigged the bridge with plastic explosive as the little engine was making his way across the tressel. BOOM...an explosion happened. And blood, and guts, and spit, and ass was everywhere. Bubba come crawling out the back with both legs missing. Lula May's baby boy, and he looked up and me and he said," Payne I can't feel my legs." And I said," Bubba, they aint there." And I looked down and them little bloody nubs was kicking. And I said," Bubba, its 30 miles to the nearest town, and unless you can flip upside down walk on your hands you aint gonna make it." All of the sudden, Charlie was all over the place. Just me and my sidearm, and I had no other alternative, but to blast my way out...."AHHHHHHHHHHH!!" Die pig die....you'll never take Major Benson Winniford Payne alive. :D
JimmyClif
01-19-2005, 11:43 AM
Nice find Delta :)
JMI
01-19-2005, 01:22 PM
Damn. Another childhood memory tainted with the evils of "modern" society. :eek: :D

Regards,
hobferret
01-25-2005, 08:16 AM
Hi all :)

Well I was a year older on the 17th, getting closer to the grave!

When I was a teenager I wanted to be like J P McShane but it never worked out. After thinking of old Mis I could not stand that sort of pressure. So basically I was a coward and became an electrical engineer.

/hobferret


Required Watching
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Required Watching
PDA

View Full Version : Required Watching

jsteed
01-11-2005, 09:53 AM
I stumbled across this and thought JMI could put it to good use. http://albinoblacksheep.com/flash/posting.php
Opcode
01-11-2005, 10:08 AM
Very cool :D

Regards,
Opcode
dELTA
01-11-2005, 11:22 AM
Already posted here before, but still nice. :)
JMI
01-11-2005, 07:30 PM
Yep. We have seen this before, but it was fun the first time. :yay:

Regards,


Need help with crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help with crackme
PDA

View Full Version : Need help with crackme

lucid_dream
01-11-2005, 01:55 PM
Hi all, I recently got a new crackme to do, but am having major problems with it.

Basically, the enter serial box checks the length of input and once it reaches 7 chars it enables a "Register" button. I found when I click register it calls rtcAnsiValueBstr 7 times (but not vbastrcmp like I'm used to :( ), but after that I have no idea what I should be looking for.

Could anyone please give me some pointers as this is driving me nuts now lol.

Thanks
naides
01-11-2005, 04:36 PM
http://www.infonegocio.com/vbcrack/cracks2.htm

Search the forking net, man!
venom925
01-11-2005, 07:57 PM
lucid: perhaps it would if you showed us exactly where it is your getting stuck. I dont think the posting of crackme code is aginst the rules . your likly to get more help that way

note: JMI what's up with the smilies? they just put up a link
JMI
01-11-2005, 08:11 PM
;) :D :devil: :whoops: Don't know what to tell you. Seem to be working fine here.

Regards,
lucid_dream
01-12-2005, 03:32 AM
Thanks for the replies, I got help from someone on here and have now solved it, I was looking at it too much and didn't see the obvious.

Regards


Unfinished Wise Script Decompiler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Unfinished Wise Script Decompiler
PDA

View Full Version : Unfinished Wise Script Decompiler

LaptoniC
01-11-2005, 02:50 PM
I dont have anytime to work on this project so I present you my sloppy wise script decompiler with unreadable asm source code.Enjoy.You can extract scripts by using 3rd party tools like exwise hwun etc.
bilbo
01-12-2005, 01:32 AM
thanks for sharing
bilbo


Using proxies and all that
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Using proxies and all that
PDA

View Full Version : Using proxies and all that

WaxfordSqueers
01-12-2005, 08:46 AM
I haven't been doing much reversing the past couple of years and am slowly getting back into it...as a hobby. A lot has changed, and I'm putting myself in the newbie category because I'm rusty, and I never was that far removed from being a rookie. With respect to reversing, I'm kind of a jack of all trades and a master of none. :)

I was digging through the RCE archives, trying to familiarize myself with recent trends. I came across an article, I think by JMI, talking about masking one's IP, using a proxy. I've never bothered with that in the past but I'm wondering if it's wise to be discussing our trade on a forum with my IP so readily obtainable.

Like I said, I'm a hobbyist. I don't reverse anything and post it on the net. I'd appreciate a few comments from people on how to approach this. At the same time, I don't want to put anyone on the spot, especially the owners of the forum. Am I the only one not using a proxy? :idea:

BTW...I've read through the archives under 'anonymity' to see if more was posted about this.
dELTA
01-12-2005, 10:44 AM
Who are you referring to as the ones who see your IP address? Only board admins/mods should be able to do this?
Rackmount
01-12-2005, 10:54 AM
Seems it's too late for you...my suggestion is that you head down to the nearest FBI office and turn yourself in. They are probably waiting for your arrival and have a file that is stuffed full of all kinds of incriminating evidence alluding to your subversive actions here and other places on the net. :devil:

No....wait :idea: ...on second thought, perhaps you should flee the country....yes...that's it. :yay: I am sure that some of the gracious people here would be willing to hide you in one of the forum's secret safe houses...there you can hang out with the likes of Trinity and Morpheous...I hear Neo may stop by on occasion... :cool:

In reality though, and apart from the above, while it is highly likely that sites like this are monitored from time to time by governmental agencies from various countries (and they would be stupid not too IMHO, as this site frequently has advanced discussions on many security related topics of interest) it is highly unlikely that you yourself are a target of interest to "them". Still, it is always wise to maintain some control over what traces of yourself that you leave behind when surfing the net. I personally feel that using proxies is something that we all should be capable of, so by all means, look further into this subject and become familiar with the tools. Then once you have an understanding of what good a proxy may serve in your undertakings, you can make an informed decision as to whether or not to use one for your regular surfing activities.
JMI
01-12-2005, 11:03 AM
I just rechecked WaxfordSqueers' "file" and there really wasn't anything very interesting in it. :rolleyes: WaxfordSqueers, time to do something "interesting." :devil:

Regards,
TBone
01-12-2005, 03:07 PM
Who are you referring to as the ones who see your IP address? Only board admins/mods should be able to do this?That's just what THEY want you to believe...you know...THEM. :eek:

Seriously, though, I don't think the MIBs are particularly interested in tracking the people on this board down, or in shutting the board down. For one thing, they would have done it already by now. But really it doesn't make sense for them to do it. What would they have to gain? No cracks are posted here, and no targets are ever identified. Just talking about reversing a target without saying what it is would be darn near impossible to prosecute. And the goverment itself doesn't have much of a vested interest in whether or not someone privately cracks a commercial target anyway - that's the company's problem, not theirs.

I think the government's only concern is the wholesale cracking and distribution of software, and they know that's not what goes on here. The hub of "the scene" :rolleyes: is elsewhere. This is just a place to discuss theory about reversing, which makes it a far more valuable to them as a source of information than whatever minor gains they might get from taking a heavy-handed approach. It's better for them to quitely listen in and try to stay ahead of the security game (or should I say, less behind :p) than to shut it down and scatter everyone to the night.
WaxfordSqueers
01-12-2005, 05:01 PM
Who are you referring to as the ones who see your IP address? Only board admins/mods should be able to do this?

Seeing we're using THEM in this thread as the vernacular for the law, your point is valid so long as THEY don't raid the board.

I'm wondering if we shouldn't investigate the legalities a little farther. I live in Canada, and the cops need probable cause to investigate. If I post on this forum asking a question about softice, and THEY wanted to check me out, THEY could obtain my IP address through the board with a warrant. Now, I'm not so paranoid as to stay up nights worrying about that. If it happened, THEY could get my home address from the IP and check with Nu Mega to see if I had a registered copy. Depending on my wording on the forum, they might then have probable cause to investigate.

That's a very amateurish legal opinion, obviously. If THEY were going to raid the board, they wouldn't do it for one name, I wouldn't think. If THEY did, however, what would THEY be looking for? Probably, it would be direct inferences. If I post a question about softice, for example, and I infer that I have it, through the wording of my question, that would seem to give them probable cause to investigate further. Now, they can go to Nu Mega, with my address garnered from my IP, and see if I have a legitimate copy.

I haven't read enough in the archives to see if posters take any precautions to that effect. I'm not paranoid about it because I really don't give a s**t. But I've been around long enough in life to realize it's not all that smart to be too naive.
WaxfordSqueers
01-12-2005, 05:21 PM
In reality though, and apart from the above, while it is highly likely that sites like this are monitored from time to time by governmental agencies from various countries (and they would be stupid not too IMHO, as this site frequently has advanced discussions on many security related topics of interest) it is highly unlikely that you yourself are a target of interest to "them".

I don't know what country you live in but I would not underestimate THEM so much. I don't know if you're aware of the Joseph McCarthy reign in the United States during the '50's. Essentially, people were branded as communists for any convenient reason, and called in front of tribunals to defend themselves. They were encouraged to turn others in, and if they refused, they were prosecuted and/or harrassed.

Guess what, Heeeeee's back. If you look at the recent laws in the States aimed at music piracy, you should be concerned. Even the musical equipment manufacturers are concerned. The Bush administration is about as right wing as you'd want to get in a democracy and a lot of them are plain paranoid. And if you live in another country, don't underestimate the reach of the US government and it's corporate sponsors.

I'm not as much of a newbie as your opening, patronizing remark might imply. I was on Fravia's site regularly a few years ago and I know he took steps to cover his ass. There was more paranoia back then, and I'm wondering if perhaps the lack of response from the law has made us a little too slack with the way we discuss things. I'm just asking.

Still, it is always wise to maintain some control over what traces of yourself that you leave behind when surfing the net. I personally feel that using proxies is something that we all should be capable of, so by all means, look further into this subject and become familiar with the tools. Then once you have an understanding of what good a proxy may serve in your undertakings, you can make an informed decision as to whether or not to use one for your regular surfing activities.

I can definitely see the need of a proxy for posting to newsgroups, or whatever. Still, what's to stop THEM from setting up their own proxies and leaving them out there for you to post through? If I can think of that, do you not think THEY have? Whereas I'm in agreement that the law is probably not interested in small fry, I would not stand pat on that assumption. It's a chance you take, and I started this thread in the hopes that someone might enlighten me as to how much of a chance.

Proxies are not all that secure anyway. A few years ago there was a famous anonymous remailer in Norway that was shut down by the Norwegian government. I read articles on that at the time, and it became apparent that any government can track down an IP to a neighbourhood, even through a so-called anonymous proxy. A lot of them are required to keep logs, especially if they are under a court order to do so.

We make a lot of assumptions about what is anonymous and what is not. But how do we know? We have no idea who is running a proxy and what they do with the information we send such as IP addresses. If THEY want your IP address, THEY'll get it, anonymous or not.
WaxfordSqueers
01-12-2005, 05:35 PM
I just rechecked WaxfordSqueers' "file" and there really wasn't anything very interesting in it. :rolleyes: WaxfordSqueers, time to do something "interesting." :devil:

Regards,

Now that's what I call anonymous!!
:yay:

I'm just getting wound up JMI. I got away from reversing because I have interests in music as well. I still do and I find time is at a premium. Sometimes I get the urge to immerse myself in the software/programming end of things, but life is about much more, wouldn't you say?
WaxfordSqueers
01-12-2005, 05:50 PM
That's just what THEY want you to believe...you know...THEM. :eek:

Seriously, though, I don't think the MIBs are particularly interested in tracking the people on this board down, or in shutting the board down. For one thing, they would have done it already by now.

I appreciate your comments and they seem reasonable. They're along the lines of what I was thinking myself. Still, it's a chance you take. At my age, I really don't give a s**t anyway. But the way THEY proceed is to scoop your computer, and good luck getting it and your software back. From what I've seen, all the software companies want is a promise not to do it again. That is, if you have something illegally stored on your computer.

Then again, how many hundreds of thousand, if not millions of people in the States alone have software on their machines that isn't theirs? Even Microsoft doesn't seem to be concerned about that. If you have XP on your system with a legitimate licence, they don't seem concerned if you lend a copy to a family member or a friend (in case you're reading this thread Bill Gates, my licence for XP is legit).

If the authorities decide to do something about it, however, you can bet the members of forums like ours will be on the front lines. I am concerned about the recent Draconian law passed in the States with regard to music piracy. Granted, it is a much bigger issue, but it's the zeal with which these lawmakers have proceeded that concerns me. How close are we to a crackdown on software piracy in general? And if it comes, how broad will the sweep be? Will it include forums like ours, most of whom are probably just hobbyists like me? Law enforcement officials are not quick to differentiate, many of them just wanting a bust, or to harrass.
TBone
01-12-2005, 08:41 PM
For what it's worth, I don't think you're paranoid, even if I don't think there's much cause for concern. I really ought to be taking better precautions about my privacy than I am right now. I used to be a little bit more paranoid. As in, keeping everything on a PGP disk inside of another PGP disk paranoid :thinking:. Maybe I've just gotten lax with age. Or maybe it's just that I'm a newbie and the feds would have to be really desparate to come after me :p

I guess the deciding factor for me is that we're talking about the government. And no matter what you do, governments tend to behave like a bureaucracy (damn, I can never spell that without looking it up!). Even law enforcement does, if to a lesser extent. In that kind of environment, there's not a lot to gain by sticking your neck out. It's better to just "meet expectations" and coast through without doing anything that might make you a scapegoat. Prosecutors won't try cases that they don't think they have a good chance of winning, because it's less damaging to your career to let someone slide than to bungle a case in court.

The RIAA/MPAA suits are overzealous and they engage in practices which would be entirely illegal if anyone else did them, but nevertheless their ire seems to be aimed elsewhere. They get their panties in a wad about P2P networks and the big, well-known crack/warez/porn-o-rama sites catering to Joe Q. User, since that's what's costing them money on a wholesale level. So as a government employee, you've got to be asking yourself, "if they don't care, why should I?" It's easier and more pleasing to the stuffed suits to go bust the torrent tracker du jour. Sort of the "nobody has even been fired for buying IBM" mentality.
WaxfordSqueers
01-12-2005, 09:19 PM
I guess the deciding factor for me is that we're talking about the government. And no matter what you do, governments tend to behave like a bureaucracy (damn, I can never spell that without looking it up!). Even law enforcement does, if to a lesser extent.

I don't view all government or law enforcement as being inherently bad. It's the clowns who are on power trips that bug me. It took a long time to bring McCarthy back in line, and all it took was a writer with enough guts to expose him for what he was: a mindless bully. I'm leary about the fact that the present US government has the ear of corporate types. Then again, they've been around for 4 years and have bigger things to worry about, like terrorists.

Thanks for the support.
sigint33
01-12-2005, 10:23 PM
I have access to several different proxy software packages but use them very seldom, as far as I know, except for the DOD bust about 4 years ago the only enforcement going on right now is for distributing copywritten material or causing damage to other systems - if you want to be a legal philosopher you could argue that even though you didn't pay for it, as soon as you accept the EULA you are licensed to use the software, anyway proxies can almost always be traced back to you, otherwise hackers would never get busted distributing their evil bugs.

Anyway the Judge probably is using a pirated copy of office!

SiGiNT
Silver
01-13-2005, 04:58 AM
I'm not a lawyer, and don't play one on TV ( ;) ), but in order for law enforcement to "raid" somewhere (be it a home, business, server hosting datacenter) they need something called "probable cause". In other words, a warrant for entry, investigation and seizure will only be issued if a Judge can be convinced that an illegal activity is taking place. A warrant application will only be made by law enforcement if they are reasonably confident of getting a successful prosecution. Reverse engineering software is very different from distributing cracked software. If this forum was taken down, any prosecution would first have to prove that the activities discussed on this board were illegal. That in itself is a serious issue, as the charter of the forum and the activity of the mods clearly shows that all actions are taken to prevent illegal software from being distributed. So the question becomes, is it illegal for researchers to discuss and analyze code? Bear in mind that security vuln researchers spend all day doing precisely this, so it isn't a clear cut yes or no answer.

Investigating and prosecuting online "crimes" (and by this I mean the DoD busts etc) is fantastically time consuming and expensive. Normally the effort is only expended when the results will be spectacular. With the greatest respect to this forum, it's small fry compared to some of the larger warez forums or ftp sites out there. Shutting it down would be a small victory, and actually prosecuting anyone would be a waste of time.

You have nothing to worry about, IMO.


Open Sourcing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Open Sourcing
PDA

View Full Version : Open Sourcing

Hero
01-12-2005, 11:24 AM
Hi all
I don't know is it againt the laws of this forum or not,But I want to know is it
possible to make a good protection with an open source protector?
I reading aritcle and found some open sorce protectors such as Yoda's YC,but
I don't know what is the best open source protector for learning making
protection issues.
Is there anybody to help? :thinking:

sincerely yours


Looking for compression Library jcalg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Looking for compression Library jcalg
PDA

View Full Version : Looking for compression Library jcalg

doug
01-12-2005, 02:52 PM
I've been trying to find a file for some time, but without luck.

I'm looking for the JCALG compression Library written by Jeremy Collake (JCALG1)

There were several host changes:
pecompact.cjb.net
pecompact.com
www.collakesoftware.com
www.bitsum.com

My problem is that all websites showing up in search results refer to www.collakesoftware.com (www.collakesoftware.com/files/jcalg1_r534.zip); but that domain has expired on dec-28-2004.

Using the wayback machine at archive.org, I managed to get r521, but I would like to get the latest version (r534 I believe).

filename: jcalg1_r534.zip

It's an open source library so I don't think it would be a problem to post the file in here.
Thanks
Woodmann
01-12-2005, 04:17 PM
Howdy,

I could only find 5.32.
gabri3l
01-12-2005, 04:33 PM
I checked the bitsum webpage and they linked to the file except under the collakesoftware site name. Assuming the bitsum site and the collakesoftware were the same site just different urls. You can get ver. 3.4 by replacing collakesoftware with bitsum

hxxp://www.bitsum.com/files/jcalg1_r534.zip

revision history is not updated but file size is different from 5.32 and matches what 5.34 is supposed to be.
doug
01-12-2005, 04:48 PM
Thanks.

I went as far as trying to get the old dns resolve of collakesoftware.com to try to reach the website via its IP address, but didn't think about substituting the hostname for the latest one :whoops:


shiva
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > shiva
PDA

View Full Version : shiva

mike
01-12-2005, 04:23 PM
SHIVA, ELF encryption tool
http://www.securiteam.com/tools/5XP041FA0U.html

zipped ppt attached explaining the tool
0xf001
01-12-2005, 05:09 PM
definately a cool tool!

did anyone get it to run? I tried (just quick, no "analysis") with kernel 2.6.x, 2.4.x, on mdk, knoppix, suse and "out of the box" it segfaults :)

but they say currently they expect many problems with it as it is under development.

I can't wait to get a running copy and play around with it. I potentionally
see weaknesses when one patches (wrapps) ptrace(), is using other kernel modules to load the executable, or implements tracer / debugger which do
not use ptrace(); Also luckily one can patch the /proc modules so ....
we will see...

Next came to my mind that code analysis using intermediate representation is missing a good tool, isn't it? (meaning I do not know one :) ) At least the obfuscation could be cleaned up by that.

Those are all "approaches" of course, or - some initial thoughts :idea: haha

thanks for this link!!

0xf001
NOP
01-13-2005, 07:16 AM
some packers crypters :yay:
http://www.exetools.com/forum/showthread.php?t=5042
0xf001
01-16-2005, 07:31 AM
cool NOP!

I am not allowed to download those tools in the forum, but googled them. Actually none of them worked on my system :( maybe I have to use older kernel / libc / ... need time :) !

for shiva0.95 I have found some very interesting links, it was defeated at least in 3 different ways, as described here:

http://www.blackhat.com/presentations/bh-asia-03/bh-asia-03-clowes.pdf

more details here
http://www.blackhat.com/presentations/bh-federal-03/bh-federal-03-eagle/bh-fed-03-eagle.pdf

There should be 0.96 out, did not find it yet :(

Shiva was besides others attached by using the IDA code emulation plugin

http://ida-x86emu.sourceforge.net/


How to write array-elements using a loop in MASM32?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to write array-elements using a loop in MASM32?
PDA

View Full Version : How to write array-elements using a loop in MASM32?

profdracula
01-13-2005, 08:24 AM
Hi all!

I'm a newbee to ASM-coding. I'm writing a patch for an app, but don't know how to write bytes(from an array) to the target-app using a loop. My code writes first byte at required offset sucessfully. But how to write remaining bytes? [ Of course Offsets are also at random locations in EXE].

Part of my code is:

bytPatch DB Byte1, Byte2,.............., Byte-n
ofsOffset DD Offset1, Offset2,.........., Offset-n

;----------------------------------------------------------------]
invoke SetFilePointer, hFile, ofsOffset, 0, 0
.IF eax==-1
;Handle-error
.ENDIF
invoke WriteFile, hFile, offset bytPatch, 1, offset bWrite, 0
.IF !eax
;Handle-error
.ENDIF
;----------------------------------------------------------------]
lifewire
01-13-2005, 09:47 AM
mov esi, offset sourcearray
mov edi, offset destination
mov ecx,size
rep movsb
profdracula
01-13-2005, 10:24 AM
Thanx lifewire!

Can you tell me where i put this in my code and how does this loop terminate?
JimmyClif
01-13-2005, 12:12 PM
Hi all!

I'm a newbee to ASM-coding. I'm writing a patch for an app, but don't know how to write bytes(from an array) to the target-app using a loop. My code writes first byte at required offset sucessfully. But how to write remaining bytes? [ Of course Offsets are also at random locations in EXE].

If you have many places to patch and you want to use WriteFile you could do it the following way:

;;;;>>>Untested Code<<<;;;;;;

BytesToPatch db 03,a1 ; lenght == 2
db c1,d1,d1 ; lenght == 3
db 90 ; lenght == 1
db 90,90, ab, cd ; lenght == 4
db etc...

LenghtsToPatch dd 02, 03, 01, 04

OffsetsToPatch dd 00492321, 00987652, etc.... , 0 ; terminating 0 for the while loop ending at WHILE [EDI] != 0

mov edi, OffsetsToPatch
mov esi, BytesToPatch
mov ebx, LenghtsToPatch
.WHILE [edi] != 0
invoke SetFilePointer, hFile, [edi] , 0, 0
.IF eax==-1
;Handle-error
.ENDIF
invoke WriteFile, hFile, [esi] , [ebx], offset bWrite, 0
.IF !eax
;Handle-error
.ENDIF
add edi, 4
add esi, [ebx]
add ebx, 4
.ENDW

Now this code will load the offset of the PatchLocations into EDI, after each SetFilePointer & WriteFile we will add 4 to EDI so it points to the next OffsetLocation and then we restart the loop.

This code will have all the bytes to change in one big declaration, I split them up by how many bytes are in per location... This BytesToPatch will get loaded into ESI. At the end of the loop I add to ESI the number of bytes that Location needs to patch, which for me EBX keeps track for.

I used ESI, EDI and EBX because these registers are preserved through API calls. I did not use them as Destination and Source Registers as Lifewire did.


DS31 softice in XP with XP2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > DS31 softice in XP with XP2
PDA

View Full Version : DS31 softice in XP with XP2

WaxfordSqueers
01-13-2005, 09:25 PM
Hi...I've spent over 10 hours reading through the RCE archives the past few days looking for softice (DS31) setup hints on XP with SP2. A lot of the hints were helpful and I've got myself setup to a point where softice will stick at the program entry point using symbol loader. I can also trace through code without incident. The following are issues I'm having a hard time resolving.

1)my system slows down incredibly when I'm not in softice. If I try to open a file manager, it can take 30 secs to a minute before it loads. My system is P4 with a 2 gig processor.

2)the DOS window that opens when I load Ice manually stays open, even if I try to close it. I read about this in another thread and it seemed related to a firewall. I shut my firewall down and it did not help. It's a Sygate free personal firewall and I did not unload the app.

3)I can't shut down windows without using hboot in ice. After using ice, sometimes the task manager won't even open.

4)I'm afraid to try loading softice other than manually because I'm using a dual boot system with Win 98SE in the primary partition and XP on the second partition. It's on a FAT 32 system. I've heard there may be problems with a dual boot system.

5)I tried out IceExt and it loaded ice fine. I got it to dump a screendump from Ice in raw format so I could send it to this forum, but how do I translate the raw code? It's in unicode and I can see it on Uedit in hex dump mode, but not in text mode.

I wanted to send some code from ice, because IceExt 'seems' to have added an EB FE at F2D5F294 in NTICE. I did not use breakpoints in my tracing other than a 'G' instruction to jump to a code position. This prevents me terminating a running app in ice. Before the EB FE showed up, I was tracing an app that loaded a splash screen followed by an message box generated by an exception. The message box said the app trial had expired.

BTW...when the message box opened, it had an OK button. I hit it and Ice disintegrated. It was after ctrl-Ding out and back in that I noticed the EB FE in Ntice.

Actually, I found the code from NTICE:

0008:F2D5F28F 1F POP DS
0008:F2D5F290 83C404 ADD ESP,04
0008:F2D5F293 FB STI
0008:F2D5F294 EBFE JMP F2D5F294 <---------
0008:F2D5F296 CD01 INT 01
0008:F2D5F298 CF IRETD
0008:F2D5F299 53 PUSH EBX
0008:F2D5F29A 56 PUSH ESI

If I CTRL-D now, ice is stuck at the position indicated by the arrow above at F2D5F294. I know about the EB FE trick for freezing Ice so you can get out for a minute. But why was it inserted in NTice? It might explain why I'm having trouble shutting XP down after using Ice. It might be a good idea to look up the actual bytes so I can replace them.

Notes: I have added all the SP2 files recommended.
doug
01-13-2005, 10:35 PM
for #1 to #4
I'm not using DS3.1 nor SP2, so I can't help much.
However, after installing a new OS/system, softice is one of the first things I install. This removes a software/driver conflict from the list of possible cause(s) of problem(s).

Also, did you analyze carefully the log messages left by NTice & IceExt? IceExt outputs a detailed report of the hooks it installs & it is open source; so it is easier to find out why things go wrong by reading the src code :-)

for #5
there's a folder "SiwRender" in the IceExt installation.

edit SiwRender.ini to reflect your settings & desired font. then run SiwRender.exe
WaxfordSqueers
01-14-2005, 01:20 AM
Also, did you analyze carefully the log messages left by NTice & IceExt? IceExt outputs a detailed report of the hooks it installs & it is open source; so it is easier to find out why things go wrong by reading the src code :-)
I did to the extent I'm capable. I noted three items as follows:

1)'Warning: AC97 not found.' ...near end of IceExt load

2)reference to AVP (Kaspersky) module that is being 'unloaded'. I don't know what the unloading means.

NTICE: Unload32 MOD=AvpShlEx
NTICE: Unload32 MOD=avp32Loc

I'm not using the AVP monitor features, but I'm wondering if it's spy
facility is still loaded. If so, I have no idea how to unload it. There was an app called Registry Drill that would let you block drivers at boot time.

3)in softice load, there is reference to an 'Int0E fault' with code 1. Most of
this is beyond me. I have copied the pertinent lines below. I didn't want to copy the entire loading log because it's quite long.

NTICE: Load32 START=73D30000 SIZE=17000 KPEB=FFA72590 MOD=wbemcons
001
Int0E Fault in SoftICE at address F2E69EF4 offset 00093C50
Fault Code=00000001
DS=0010 ES=0023 FS=0030 GS=0000 ESI=00000000 EDI=8058AE20 ESP=F3F0ECB4
EAX=00000001 EBX=F8947E20 ECX=00000000 EDX=00000001 EBP=F3F0ED08

FrameEBP RetEIP Syms Symbol
F3F0ED08 F887673A N NTice!.text+00095B74

Raw Stack Dump: ESP=F3F0ECB4
F2E68C6E
F8870010
00000086
8058AE20
00000000
F3F0ED08
F3F0ECE0
F8947E20
F88792EC
FE9ACBD8

for #5 there's a folder "SiwRender" in the IceExt installation.

thanks for the tip. When he said screen image, that's what he meant. It's a BMP file.
:)
Fake51
01-14-2005, 04:04 AM
A possible solution to your softice problems - it worked wonders for me anyway.

It's avp fucking up your softice - bet you have it loaded on startup. If you don't let it run at startup, and don't run softice when it's been loaded, you might get lucky. There's an extra catch, tho, as avp loads a couple of services that you'll have to turn off manually. Search this place for "avp" or "kaspersky" - one of the threads should have details on how to change the registry, so those services will only load manually.

Anyway, that did the trick for me and others.

Fake

ps. In the future, stick your "softice doesn't work"-questions in tools of our trade.
WaxfordSqueers
01-14-2005, 04:16 AM
It's avp fucking up your softice - bet you have it loaded on startup.

thanks for the tip, but I don't. I also checked the registry thing earlier and could not find anything related to it starting any monitor.

I do think I have other problems which might be similar. I noticed on my bootlog.txt file that the system is loading vxd's from my win 98 partition. Programmers get arrogant and/or stupid at times and assume everbody loads Windows in C:\Windows. It's more stupid than arrogant, however, to load vxd's from another operating system into XP. They are in different partitions.
Then again, XP loads some of it's boot files in the Win 98 partition.

I've heard that XP doesn't deal with vxd's, but it must have a thunk system similar to what 95 and 98 had for 16 bit proggies. How else would it be able to run apps written for systems other than XP?

ps. In the future, stick your "softice doesn't work"-questions in tools of our trade.

I didn't want to appear arrogant. I'm closer to a newbie in many things although perhaps intermediate in others. I felt some things in my post might not be intermediate enough to post in the Tools section.

I'll take you up on your tip to research AVP/Kaspersky on this site.

Thanks
Fake51
01-14-2005, 05:11 AM
Are you sure that you have all kaspersky services disabled or set to load manually? They only show up in the registry, not when browsing the services part of admin controls (and they still load even if avp isn't set to load automatically). Since you note that you see some references to avp I still think that this is your problem.
Look for services under hklm/system/yadayadayada/services/k???? that don't have any description, don't have counterparts in the services app, and don't have start value as automatic, disabled or manually. Check the files in your winnt dir, they should have version infos or the likes, identifying them as kaspersky files.

As for the forum part: It was meant as more of a suggestion, lest JMI should suddenly decide to edit your post for fun. The point was merely to divide your post in two, seeing half of it would be better put elsewhere.

Fake
WaxfordSqueers
01-14-2005, 06:23 AM
Are you sure that you have all kaspersky services disabled or set to load manually?
I'm still working on it. I renamed both the drivers that show up in the softice log (from symbol loader) and AVP seem to work without complaining. It's getting late though, so I'll probably leave it till I'm fresh lest I make a catastrophic blunder. The AVP Control Centre shows up under Administration/Services and I have it both turned off and disabled. But I'll poke through the registry anyway. Thanks. I think I might uninstall my firewall too and hopefully remember to disconnect from the internet when I do it. :)
I'll check out all your tips. Thanks.

As for the forum part: It was meant as more of a suggestion, lest JMI should suddenly decide to edit your post for fun. The point was merely to divide your post in two, seeing half of it would be better put elsewhere.
Fake
I'll PM JMI and ask if it's OK to advertise in both. The complexity level is about intermediate.
dELTA
01-14-2005, 06:38 AM
It's not ok to double post, but this thread is ok for the Tools of our trade forum, I just moved it there.
LOUZEW
01-14-2005, 02:37 PM
Hi, all
I don't know where is the problem but for sure, it's not Kaspersky. I'm using DS and KASPERSKY from many years now and never had any prob.
For your info, i have XP SP2 corporate, KAV personal pro 5.0.1.4, DS 3.1, ZAP 5.5.0.62.

Have you patched OSINFO.DAT for use with SP2 like it's said on compuware site ?
WaxfordSqueers
01-14-2005, 03:53 PM
Have you patched OSINFO.DAT for use with SP2 like it's said on compuware site ?

Yes...I did it exactly as shown on their site. I've got symbol rertriever working off my hard drive with the entire sym file from M$. All my NMS files are loading fine.

I'm concerned right now about a driver conflict. I have a dual-boot system with Win 98SE on partition 1 and XP home on partition 2. I was looking at a fresh bootlog.txt for an XP startup and it's loading a lot of vxd's from the win 98 partition (eg. C:\win98\smartdrv and C:\win98\himem.sys). I find it really strange that one operating system would go into another operating system's partition and load files from it.

This is NOT an old system which I loaded XP over. The initial intention was to load XP by itself. But I had problems with my new Intel motherboard (turned out to be a bad processor) and I loaded Win 98 fresh to see if it would load. It did load, which lead me into thinking it wasn't the processor. XP would not load at all, getting to the first splash screen and freezing. Of course, when I loaded XP, I did it as a dual-boot system on partition 2. Once the processor was replaced the dual-boot worked fine so I left it. I've had no problems with it since and it's handy to have 98 and XP on the same FAT 32 drive since I can use 98 to spy on XP.

I also had the Win 98/XP dual-boot computer networked with an older P2 Asus 440BX computer. I'm not running that system now, but I'm seeing drivers being loaded currently by XP that were for the older computer. For example, XP is loading drivers for an Asustek Broadcom NIC that has never been on my new dual-boot system. In fact, it's an on-board NIC on my P2 440BX on the old computer. The only way XP could do that is if it got information through the old network. But why would it go into another partition to do that?

I know this is getting away from 'our tools' but it's still a problem about why softice in DS31 wont load, and maybe it will help others in the future. Does anyone have any thoughts on this other than flames? :)
WaxfordSqueers
01-14-2005, 09:20 PM
It's not ok to double post, but this thread is ok for the Tools of our trade forum, I just moved it there.thanks Delta.
doug
01-14-2005, 10:27 PM
My opinion is that there are too many possible issues for it to be worth investing time troubleshooting; unless you are really keen on the subject and want to study it.

Softice either works well or doesn't. Why it works well on some systems and not on others is rumoured to be a random process :devil:
WaxfordSqueers
01-14-2005, 10:57 PM
My opinion is that there are too many possible issues for it to be worth investing time troubleshooting; unless you are really keen on the subject and want to study it.

I hear what your saying. Whereas it can be aggravating at times, I have an interest in breaking through to new ground. I have enough experience to realize it could be about something really simple that's not obvious.

I feel like I'm close enough that giving up is not an option yet. The fact that the DOS window ice opens in does not shut down is a clue. I'm currently trying to eliminate things and reading a lot. Of course, like you say, it could be a total waste of time.

thanks for dropping in. :)
WaxfordSqueers
01-15-2005, 06:29 AM
I feel like I'm close enough that giving up is not an option yet.

Feel like a bit of a dummy. It was the Sygate firewall. I say a bit of a dummy because I did follow my options relatively methodically, but there is another thread in the archives (from quetzalcoatl ....thanks Q) which specified that very remedy. After uninstalling the firewall and rebooting, everything was hunky dory. It was even peachy.

The symptoms are as follows:

-When ice is activated manually, a DOS window opens, and the typical Ice screen (not to be confused with Ice cream) can be seen loading in the window.

-Under normal conditions, the DOS window closes by itself. With Sygate loaded, it doesn't close and it can't be closed, even with a kill from the task manager.

-XP can't be shut down other than by using HBoot in ice.

-other apps in XP slow right down, some intolerably.

-this error message appears in a history dump:

"Int0E Fault in SoftICE at address F2E69EF4 offset 00093C50
Fault Code=00000001"

-ice will appear to crash at times, with the screen breaking up like a jigsaw puzzle. CTRL-Ding out and back in again clears the screen breakup and will reveal code from NTIce which has an EB FE opcode at EIP. ie. The instruction jumps to itself. Funny enough, you can reload the app through symbol loader and it breaks happily at start of code again. And tracing is normal. The mystery is what puts the EB FE into NTIce and what reinserts the original bytes. I thought we were the only one's who did that. :)

All that from a firewall. BTW...for anyone using the free Sygate firewall, the new version (5.6 build 2808) is reported to have bugs in it which Sygate have acknowledged. They claim the bugs will be removed by the next upgrade.
Fake51
01-16-2005, 04:24 AM
Hi, all
I don't know where is the problem but for sure, it's not Kaspersky. I'm using DS and KASPERSKY from many years now and never had any prob.

Well, it sure was my problem. I'd say Doug is more than half right.

Fake
WaxfordSqueers
01-16-2005, 07:13 PM
It was the Sygate firewall. BTW...for anyone using the free Sygate firewall, the new version (5.6 build 2808) is reported to have bugs in it which Sygate have acknowledged. They claim the bugs will be removed by the next upgrade.

Update: Ice (ver. 4.3.1 in DS31) seems to work with the most recent update (ver 5.6 build 2808) of Sygate's free personal firewall. All of the problems I listed above have disappeared and I was able to reverse a simple 'trial expired' app. As I pointed out, however, this version of Sygate has been reported as buggy. So far, I've had no problem with it on XP with SP2.

It has crossed my mind that maybe it's not the upgrade per se. It may just have been uninstalling Sygate and reinstalling that did the trick. Maybe it needs to detect the debugger and can't do that if the debugger is installed after the firewall is installed. I read something about debuggers and Sygate on a forum at one time, so if anyone is having problem with an ice install on XP, they might check that out.

Be aware that M$ turns on their own firewall by default when SP2 installs. From the reports I've read the M$ firewall still does not block outgoing traffic. Although Sygate claims their firewall will happily co-exist with the XP firewall, I'd check that if there are problems with ice.

All is not quite well yet in reversing land, however. When using the DEX command to setup the four DATA windows, I was able to switch between data windows by clicking on the number of the window at the top right of the window. That doesn't seem to work now. It's been a couple of years and my memory is foggy. Maybe there was another way of switching them. I found it really helpful to give data windows to ds:esi and es:edi. to keep tract of ascii strings, etc.

Also, there seems to be a problem with the ADDR context switch, although I may be using it wrong. There were times when I couldn't dump various register addresses to the data window in order to examine their contents. All I got were question marks in place of data, even though I knew there was data at the address. That seemed to be a context issue.

I typed in 'ADDR' and the highlighted context address of my app and got an error message that the context can't be found. Sometimes, however, it worked. I don't know if these problems are related to firewall issues, or whether I'm not applying them correctly. I know there's an option to turn off the newer context switching and return to the older type. I'm checking that out.


W32Dasm v8.9 Problems
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32Dasm v8.9 Problems
PDA

View Full Version : W32Dasm v8.9 Problems

TheElder
01-14-2005, 03:25 AM
I have been using W32Dasm for years....just to studdy working binarys
since I instaled Win XP sp2 all that is dispalyed is wingdings

Dose anyone know what the hell is going on or how to corect it?

Sincearly
TheElder
l0rtsu
01-14-2005, 05:13 AM
Just look settings(file/options or something like that), there is somewhere place where you can choose font.
Neitsa
01-15-2005, 04:37 AM
Hello,

W32Dasm is quite a bit old now...Even if it's have been a good disassembler and done a very good job for the RE community, you should think about trying the free version of IDA (which is in fact the v. 4.1).

try to download it here :

http://www.simtel.com/product.php?url_fb_product_page=29498

This version is very good, and IMHO better than W32Dasm. Just give it a try.

Neitsa.


Key generating, computer ID, etc.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Key generating, computer ID, etc.
PDA

View Full Version : Key generating, computer ID, etc.

Le-Fay
01-14-2005, 05:37 AM
Hello there fellow reversers,
I'm a programmer and I have some experience in encryption but merely non in reversing. so bear with me...
I came across a software I want to reverse engineer.
The thing is that, when you install the software it generates a unique ID specific to the computer. what I is to find how this ID is generated.
I have no idea where to start. can I place a breakpoint on the ID I know it'll generate for my machine?
The software is a .NET form application, is it possible to decompile it (it should be ...). is it likely that the installer is also a .NET application?
:confused: :confused: :confused:
Thanks,
Le-Fay.
TBone
01-14-2005, 07:01 AM
Few people seem to use totally home-grown installers these days. Usually it's some version of Installshield, Wise, etc. If you can determine which type it is, you can probably find a lot of specific information here just by searching on the installer system's name.

But in more direct answer to your question, whether it's .NET or not, you should be able to decompile/debug it like any other program. If you know roughly when the installer generates the ID, there's lots of ways you could break near the generation routine with a debugger and try to analyze what it does. For example, maybe when it's done generating the ID, it displays it in a dialogue box. Try breaking on the dialogue box and then follow the call stack up. Of course, a good decompiler can be even more helpful sometimes with regards to that kind of analysis.
Le-Fay
01-14-2005, 07:27 AM
Hi TBone, thank you for the quick reply.
The installer is some version of Installshield as you said.
The ID isn't displayed on the screen but I have a reason to believe it is saved on a file named "LIC.DAT" encrypted in some way.
As for debugging I have access to SoftIce, can you give me a hint as for what kind of break point will be a good idea?
Hero
01-14-2005, 11:07 PM
If you installed VS .NET,You can find an internal decompiler in the SDK of VS .NET directory.
I don't use it too much,But perhaps be a help. :D

sincerely yours
Solomon
01-14-2005, 11:22 PM
Use a disassembler, then try to find "LIC.DAT" in the dead-list. Or use CreateFileA/_lopen as breakpoint. Some progs use GetVolumeInformationA to get the disk volume serial to generate the computer IDs, some use "CPUID" instruction, some use the BIOS strings in Windows registry.

Hi TBone, thank you for the quick reply.
a file named "LIC.DAT"


Reversing Pocket PC Apps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Reversing Pocket PC Apps
PDA

View Full Version : Reversing Pocket PC Apps

dream
01-14-2005, 09:19 AM
hi,

i have a problem with reversing some pocket pc app. i copied all the files from my pocket pc(acer n30 running microsoft windows mobile 2003) to a folder on my hd. then i let ida run on the program. it detected an arm executable file. then when the disassemlation starts im asked for some additional dll files. those are:
commctrl.dll
COREDLL.dll
AYGSHELL.dll
i installed:
c++ 4 embedded edition
sdk for windows 2003
sdk for windows ce .net
but none of those packages does contain the files i need. i also tried copying the files from the pocket pc's windows directory but it gives me an error that the files are in use and cant be copied. can anyone tell me how to get those files from my pocket pc or where to find them?

thanks

dream
Iwarez
01-14-2005, 11:15 AM
There are some ids files especially for ida which you can find here: hxxp://www.itsx.com/pocketpc/wince-ids.zip
dream
01-15-2005, 06:57 AM
thank you for those files, it works pretty fine. but i ran into another problem when trying to debug the app in evc 4. i found the place(at least i think so) where the program checks the serial my ida deadlisting. now i want to check whats going on in the evc debugger but when i launch the app i get a totally different adress than ida is showing me. the adress i want to break on is 1BD30 in ida. in evc the first adress in my program is 2602c03c and lordpe tells me the entry point of my program is 1c03c. the image base is 10000. can someone tell me how to calculate the proper adress so i can set the breakpoint?

thanks
Iwarez
01-16-2005, 01:48 PM
You can just use ctrl-g and type in the address on which you like to break on. There are several tutorials out there explaining how to use evc.
dream
01-17-2005, 06:37 AM
i know how to use evc, i just dont know how to translate between ida deadlisting addresses to the ones seen in evc.


The Infamous "VB4 PCODE & sx32w.dll"
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > The Infamous "VB4 PCODE & sx32w.dll"
PDA

View Full Version : The Infamous "VB4 PCODE & sx32w.dll"

DrQ
01-14-2005, 11:42 AM
Hi,

i have a target written in VB4 (pcode) and the sx32w.dll (sentinel superpro v 5.x). Debugging the VB4 program is a pain, tons and tons of instructions (ExDec (crash), dodi (stop with “unsupported custom control”, vbreformer (?!)), Wdasm goes in error. I use OllyDbg (it works great).

The target calls in sequence:

1. RNBOsproFormatPacket
2. RNBOsproInitialize
3. RNBOsproFindFirstUnit
4. six calls to VB400032.rtcMidCharVar ('BFC060CE')
5. RNBOsproQuery (with cell 0x08)
6. many calls to VB400032.rctHexVarFromVar
7. RNBOsproFindNextUnit
8. rctMessageBox (error key not found)
9. PROGRAM EXIT

I have patched the following routines:

RNBOsproFormatPacket
xor eax,eax
retn 08h

RNBOsproInitialize
xor eax,eax
retn 04h

RNBOsproFindFirstUnit
push ebx esi
xor eax,eax
pop esi ebx
retn 08h

RNBOsproFindNextUnit
mov eax,0Ah
retn 04h

I also have the dump of the original dongle:

Cell 0x00: YYYY (1/0) (Dongle Serial Number)
Cell 0x01: XXXX (1/0) (Developer ID)
Cell 0x02: ???? (1/4) (OverWrite Password 1)
Cell 0x03: ???? (1/4) (OverWrite Password 2)
Cell 0x04: ???? (1/4) (Write Password)
Cell 0x05: ???? (1/4) (Reserved Cell)
Cell 0x06: ???? (1/4) (Reserved Cell)
Cell 0x07: ???? (1/4) (Reserved Cell)
Cell 0x08: ???? (1/4) (Active Algorithm) (Read Only Data)
Cell 0x09: ???? (1/4) (Read Only Data)
Cell 0x0A: ???? (1/4) (Inactive Algorithm) (Read Only Data)
Cell 0x0B: ???? (1/4) (Read Only Data)
Cell 0x0C: ???? (1/4) (Active Algorithm) (Read Only Data)
Cell 0x0D: ???? (1/4) (Read Only Data)
Cell 0x0E: ???? (1/4) (Active Algorithm) (Read Only Data)
Cell 0x0F: ???? (1/4) (Read Only Data)
Cell 0x10: ???? (1/4) (Active Algorithm) (Read Only Data)
Cell 0x11: ???? (1/4) (Read Only Data)
Cell 0x12: ???? (1/4) (Inactive Algorithm) (Read Only Data)
Cell 0x13: ???? (1/4) (Read Only Data)
Cell 0x14: ???? (1/4) (Active Algorithm) (Read Only Data)
Cell 0x15: ???? (1/4) (Read Only Data)
Cell 0x16: ???? (1/4) (Inactive Algorithm) (Read Only Data)
Cell 0x17: ???? (1/4) (Read Only Data)
Cell 0x18: 0000 (0/0)
Cell 0x19: 0000 (0/0)
Cell 0x1A: 0000 (0/0)
Cell 0x1B: 0000 (0/0)
....
Cell 0x3E: 0000 (0/0)
Cell 0x3F: 0000 (0/0)

The problem is here:

4. six calls to VB400032.rtcMidCharVar ('BFC060CE')
5. RNBOsproQuery (with cell 0x08)
6. many calls to VB400032.rctHexVarFromVar

but, the target is very hard to debug (for me :( ).

Any tips?

Thanx.
DrQ
KSA
01-14-2005, 02:44 PM
Hi,

You have also to emulate the query with it's corresponding response.

To do this make a breakpoing in the sx32w.dll at query function and see it's response value. So, you can emulate it.

KSA
nikan
01-15-2005, 02:08 AM
hi

you must use wktdbg for vb p-code debugging.
also you can get my sentinel monitor from exetools forum. it can monitor and collect all of data and query pairs for you.
DrQ
01-15-2005, 04:03 AM
you must use wktdbg for vb p-code debugging.

wktdbg works only for vb >= 5

also you can get my sentinel monitor from exetools forum. it can monitor and collect all of data and query pairs for you.

i have forgotten to say, that i don'have the dongle (but only the dump)

Thanx
DrQ
Phase5
01-15-2005, 01:48 PM
Hi

Maybe it would be good to read this article
hxxp://www.programmersheaven.com/articles/userarticles/john/vbvm.htm
It's about VB6 pcode but the overall
layout of the virtual machine in VB 4 is similar
to that of VB6 (the usage of the jump table for example).
It can be helpful when stepping through the VM.


Desperetely looking for Sentinel LM SDK 7.1.0
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Desperetely looking for Sentinel LM SDK 7.1.0
PDA

View Full Version : Desperetely looking for Sentinel LM SDK 7.1.0

01-15-2005, 01:50 PM
Hi all

I am new to revesing! i am learning slowly but surely! ;)

I am working on a target protected by Sentinel LM 7.1.0

I did extremely extensive research on the web for the 7.1.0 LM SDK but didnt find it! My target is not a known public program but a specific program used internally by the compagnie i am working for! Anyone could please...please... provide me with a link a even better has it in his possession (the SDK)?

Thanks in advance for any help

NewbiRev
Kayaker
01-15-2005, 03:44 PM
Hi,

The problem isn't with your question, which is just a question after all, though you should never begin a request "Desperately looking for" anything.. If you really had done 'extremely extensive' research on Sentinel LM, you should have picked up a name or two which undoubtedly would have directed you here. And you are here. And if you had done any research here, you would have naturally found the link at the bottom of the page:

http://woodmann.net/crackz/Flexlm.htm#sentinellm

Where you would have seen the statement:

"SentinelLM SDK v7.1 (Regrettably. As with the FLEXlm SDK's this download is now on the other side."

Read the statement and link to the 'other side' to read what's there. That is your answer, there are no others. You are welcome to ask other questions related to the subject though.

Kayaker
01-15-2005, 04:19 PM
Hi Kayaker

I know all that!

I found out about the sentinelLM SDK being on "The other side". I actually found out longggggggggg... time ago. Everything i learned so far in reversing, i learning from many essays from nolan and many others (thanks Crackz!), and by trying myself of course using the information i found in these great documents made by uncredibly knowledgeble persons. Couple years ago, i downloaded the LM SDK from here since it was available (before it was moved to the "other side"). Unfortunately for me, i lost it along with my old crashed PC.

I just restarted to work on my target recently and i would need the SDK again. So, of course, i checked again where i found it the first time and i saw it was not freely available anymore. THEN i made some extensive research on the web but without any luck! That is when i contacted Crackz explaining him that i understand he wanted some help in exchange but that i dont see what i could trade in exchange for now but i promised to publish my own essay once i will be done with my target to share with others my findings. He said he will see if he could setup something for me so i am waiting for a week but didnt get anything yet(but i am still hoping...). That is where i posted my question here in last resort.

I didnt want to post the entire STORY since i am a KISS (keep it....) type of guy and details arent important to me. But now you got the picture.

If anyone can help, you can PM me.

thanks
Aimless
01-16-2005, 06:19 AM
You should chill....

Crackz generally takes a lot of time to reply. Prolly busy. Just be a little patient. Unless he doesn't want you to...in which case he would have told you upfront.

So be a little optimistic and hold on a little longer....

Someone who knows,

Have Phun,
tom324
01-16-2005, 07:36 AM
I did extremely extensive research on the web for the 7.1.0 LM SDK but didnt find it!

Not so extensive ;)

Sentinel LM SDK 7.1 , 7.2 and 7.3 are available at exetools' FTP .

Tom
blabberer
01-16-2005, 09:41 AM
available at exetools' FTP .

i dunno they dont even let a new member view posts since last visit
so prolly even if it is there it may be utterly useless for him :)
some thing like fools gold or a mirage kinda thing
tom324
01-16-2005, 03:58 PM
I can not disclose login/password for my account would be revoked.
Registering on the exetools' forum and making usefull posts is the only way I know.

Tom
blabberer
01-17-2005, 04:28 AM
I can not disclose login/password for my account

hey i never asked you your login or password and i am at the moment not interested in dongle or sentinel or its sdk or ftp access to extools

i just followed some links from here to that forum and registered there
and then i logged in next day to see if there are new posts
i saw a link saying blah blah posts after you last visited i followed that link and what i get is a nice little nag saying the feature is disabled
:( thats what i posted if they dont allow to see new posts i dunno how they expect some one to post to threads

anyway dont worry i am not going to ask you your login or password :D


new linux crackmes - let's crack them!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > new linux crackmes - let's crack them!
PDA

View Full Version : new linux crackmes - let's crack them!

0xf001
01-15-2005, 04:12 PM
hi all,

I have found some (for me new) linux crackmes:

http://racl.oltrelinux.com/crackme/index.html

as this is a potentialli italian site (at least not english), and I saw no links to solutions, I will start working on them ... :devil:, and post my efforts here ...

Would be cool if some guys can join and spread their knowledge, hehe!

Especially "newbies" are VERY welcome to join , and ask really _any_ question, starting by choice and use of tools etc, as that are the questions other people can benefit from!

just pick up one of the files and see how far you come! once you are stuck, post it here!

I hope to get a little more traffic into the forum, hehe :)

let's crack!

have fun! 0xf001

PS: i have just downloaded them, and no idea about difficulty and so on ...
0xf001
01-19-2005, 03:25 PM
hi all,

I just wanted to try the qt crackme, and it showed, it needs some old libraries, of course :)
the shared libs

libstdc++-libc6.1-1.so.2
and
libqt.so.1

were missing on my system, and simply making a link from current libc / libqt to fake those files did not work, as it misses some symbols then.

So I found those required files in the rpms (google):

compat-libstdc++-6.2-2.9.0.16.i386.rpm
qt1x-1.45-16.i386.rpm

and did a
rpm2cpio compat-libstdc++-6.2-2.9.0.16.i386.rpm | cpio -idv
rpm2cpio qt1x-1.45-16.i386.rpm | cpio -idv

to extract the rpms files into the current dir, as we of course do not want to install them on the system.

then you can copy the 2 files mentioned in the beginning to the crackmes dir

then say export LD_LIBRARY_PATH=.:$LD_LIBRARY_PATH

so prepend the current path to the searchorder for shared libs.

now you can run this crackme :)

btw looking shortly into the disassembly tells this one is quite easy. like the gtkmm trythis you find the checkserial without knowing about Qt :)

have fun, 0xf001

PS: i did not yet try to "attack" it ... :)
PPS: I decided to upload those files, so you have it easy :)
just remove the .zip from the filename!
[edit] files are probably too big, I provide them somewhere else ....
0xf001
01-21-2005, 11:16 AM
has anyone yet tried the blaad crackme (the Qt one)?

I found quite immediately the serial checking function. some hours later I had the serial algo (incl necessary data) reverse translated into C and verified it is correct.

now actually I am working on a method to break it. I am not sure if it is possible to reverse the hash algorythm. bruteforcing is not really an option... it is quite tricky, has anyone had a look at it?

regards, 0xf001
0xf001
01-25-2005, 05:02 AM
hi!

I have looked again at this crackme and had _the idea_ :)

I made a tutorial, which requires a little bit of math understanding. I can only recommend this crackme to everyone it is quite tricky in the first place.

For having difficulties getting the hash algorithm - but do not want to read the solution I do post it here as a help :)

for(C=0;C<0xf;C++)
S[0xe-C] = C + 1 + (0xFFC8 - (10*C & 0xff)) ^ ( S[0xe-C] ^ S[C] )

whereby S is the entered serial.

Have fun, 0xf001
dirty_deeds
02-07-2005, 10:01 PM
I have been working through the "trythis" crackme(which 0xf001) has written about. It seems that after each check for a led, and before the led count is incremented, there is a section of code which is never reached. For instance, the section of code
0x0805305F - 0x0805307D
Any idea what is going on here?


NEW: Syser Kernel Debugger by wuyanfeng
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > NEW: Syser Kernel Debugger by wuyanfeng
PDA

View Full Version : NEW: Syser Kernel Debugger by wuyanfeng

Kayaker
01-15-2005, 08:27 PM
Hi All

I came upon what looks to be a very promising kernel debugger on a Chinese forum. There is an active thread discussing it here:

http://www.driverdevelop.com/forum/html_61514.html?1105821078

There appears to be 2 download packages, I had some problems with CRC corrupt rar files for both packages, but was finally able to d/l a clean copy of the 2nd.

One with an .msi installer (5.4MB):
ftp://soft:mysoft@www.zndev.com/syserinstall.rar

and the other without (1.9MB):
http://link.coolala.net/temp/syser.rar
SyserMgr.exe
wisp.dat
wispsyser.sys

From another link I found pictures of the debugger:
http://link.coolala.net/temp/debug1.jpg
http://link.coolala.net/temp/debug2.jpg

It has a *very* impressive subset of the usual Softice commands, as well as many interesting new ones ("Set Debug Register DR7" anyone?). It supports windows 2000 server, windows xp, windows xp sp1, 2003 server.

I've only begun to look at it, but it seems to run well even under VMWare. It seems like it is supposed to be compatible with Softice in some fashion, but I've found conflicts. I'm not sure if it's a ring3 debugger with a kernel component (something I've been expecting as a natural progression for a long time...), or whether it can also trace ring0 code.

I tried its I1HERE ON option to break on an INT 1 in my own kernel driver, to see if it would trace in kernel code, and under VMWare it went BSOD. If it can trace ring0 it could be extremely useful, if not it may still have a few nice extended capabilities as a ring3 debugger.

There is a lot of exploring to do here. Since there is neither source nor a help file, any analysis of it here would be interesting. That also includes if anyone has the language capabilities to decipher any of the active thread and report anything useful... did I see the name Sephiroth? ;)

After loading the sys driver, attach to a process. You can toggle into a command window with Ctrl-2 and type 'help' for a list of commands.

Regards,
Kayaker
disavowed
01-16-2005, 01:52 AM
Cool post, Kayaker.

Luckily, http://www.worldlingo.com/en/websites/url_translator.html (Chinese-simp) does a hell of a good job translating it! :yay:
ZaiRoN
01-16-2005, 01:08 PM
Hi Kayaker,
nice link :)
It seems like it is supposed to be compatible with Softice in some fashion, but I've found conflictsI tried this tool on a xp-sp1 machine with Softice. The program starst but it doesn't load the WispSyser driver (fails on OpenServiceA); I tried to load the driver with KmdManager and it passes OpenServiceA call loading the driver without problem... pretty strange.
It runs fine on a xp-sp1 machine without Softice, btw.
I tried its I1HERE ON option to break on an INT 1 in my own kernel driverI did the same thing (on the machine without Softice) and the result is a nice bsod... :confused:

Best regards,
Z.
Kayaker
01-16-2005, 09:26 PM
That's not a bad translation actually... it seemed to do a better job than I used to get with Babelfish and wasm.ru anyway. The debugger is obviously still in the bugfix stage, will be worth watching for updates.

I tried tracing into an Int2E and kernel code, but the debugger couldn't handle it, still not sure if it's designed to. It seems to be able to create its own system symbol files, but I couldn't get them loaded successfully, nor my own source files. Still, poking around the disassembly should be interesting to see how the author approached things.
Solomon
01-16-2005, 10:32 PM
The above machine translation is understandable. It's a ring0 debugger just like softice.The author implemented a rich set of GUI functions by directly manipulating video RAM. He said there will be a Linux version after 1~2 year. If you need further translation, I can do. I'm Chinese.
disavowed
01-16-2005, 10:53 PM
Just to make myself clear, I wasn't being sarcastic above. I too am impressed with the translation compared to that of Babelfish, etc.
4nil
01-16-2005, 11:56 PM
The above machine translation is understandable. It's a ring0 debugger just like softice.The author implemented a rich set of GUI functions by directly manipulating video RAM. He said there will be a Linux version after 1~2 year. If you need further translation, I can do. I'm Chinese.
yeah, i'm a chinese too,if u go to bbs.pediy.com,and what's ur ID there?
Kayaker
01-17-2005, 07:04 PM
To come to some conclusion on this,

The larger download with full install is the much newer version of the debugger (Dec/08/2004). It now uses 4 drivers,
Syser.sys
SysBoot.sys
SyserDisk.sys
SysLang.sys

loads on boot, has full symbol download connection to the MSDN server (converts them to its own SDS format), can load executable or kernel driver for debugging. While it looks much improved, I have lockup problems I didn't have with the earlier version I tested. I single step once and the keyboard and mouse are unresponsive and the system locks. Until I sort it out I can't do much more. :-(

Kayaker
fudy
02-25-2005, 02:33 AM
yeah, i'm a chinese too,if u go to bbs.pediy.com,and what's ur ID there?

i'm a chinese three. it's seems a little cold here, would you please introduce
a hotter site about driver&kernel development to me?
Kayaker
02-25-2005, 10:22 AM
Hi,

The usual method is not to complain about the cold, but to add fuel to the fire. But I understand what you're saying.

If you want traditional, the most "active" forums I know of are:
microsoft.public.win32.programmer.kernel
microsoft.public.development.device.drivers

If you want untraditional:
rootkit.com

There are others that try, as we do, to encourage driver development discussions, but you would likely find these "cold" as well ;)

If you find other sites, please pass them along.

Kayaker
4nil
02-27-2005, 09:02 AM
i'm a chinese three. it's seems a little cold here, would you please introduce
a hotter site about driver&kernel development to me?
maybe exeTool in Eng & DFCG in Chinese is hotter...
Solomon
03-15-2005, 01:24 AM
new version, seems more stable, but still need more development.
hxxp://www.syser.net/download/SyserSetup.exe
screenshot
hxxp://www.syser.net/jpg/
at least 256MB RAM is needed, or your system will crash.

Syser Debugger 是基于X86平台专门为 Windows NT Family 开发的内核级的全
图形界面的调试器．支持汇编级调试和源代码级调试．

系统需求：
至少 256M 内存(少于256MB会导致系统崩溃)
    至少 CPU 300MHz．
操作系统支持：
windows 2000 (sp1,sp2,sp3,sp4)
windows xp (sp1,sp2)
windows 2003 (sp1)
....

软件特点：

1.　彩色反汇编支持．
2. 源代码级调试支持语法配色．
3. 源代码级调试支持原代码与汇编指令折叠式对映.
4. 支持动态加载也卸载．
5. 全键盘操作支持．（如果在没有鼠标设备的情况所有操作都可以用键盘来操作）
6. 全鼠标操作支持．（在没有键盘设备的情况可以用鼠标控制所有操作．这在
softice 中是不可能的．如果softice 被激活，没有键盘时就没有办法退出）
7. 命令兼容Softice
8.　多语言支持．底层全 unicode 实现.
9. 插件机制支持．
10. 多 CPU 的支持．支持 Intel Hyper-Threaded processors.
11. 支持启动脚本。(类似于批处理文件)
12. 调试符号文件的自动生成和自动加载机制。省去了 softice 源代码调试的
    烦琐步骤．如果你开发和调试使用同一台机器．在你不改变源代码存放目
    录的情况下，你只要在你编译出的可执行文件上点鼠标右键，在右键菜单
    中选择用Debug with Syser 菜单项就可以进入我们的调试器进行源代码级
    或汇编级调试．

13. 可以和Softice和平共处．Softice 在 Syser 之后启动.Syser 也可以卸载．甚至可以调试softice．
14. PDB 调试符号文件的全面支持。
15. 自动装载 驱动程序调试。

硬件输入设备支持：

1. USB 键盘和 USB 鼠标支持．
2. PS2 键盘和 PS2 鼠标支持．
3. 笔记本的 TouchPad （触摸板）和　TrackPoint（轨迹点）设备的全面支持．（TouchPad 和TrackPoint的高级模式在 DS 3.2中尚不支持）.
disavowed
03-22-2005, 10:30 PM
It seems to crash when trying to debug something inside VirtualPC :(


linux anti anti debugging tut
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > linux anti anti debugging tut
PDA

View Full Version : linux anti anti debugging tut

0xf001
01-15-2005, 10:55 PM
hi all,

i have written a basic but detailed linux anti anti debugging tutorial,

you can grab it here :)

hope it is useful,

cheers, 0xf001
lifewire
01-16-2005, 06:15 AM
Nice and clear paper, however, 90% of it could applied to win32 too :) (besides of the usage of the linux tools like the debugger and such).
0xf001
01-16-2005, 06:44 AM
hi lifewire!

i am aware of that - as said it is basic, the tools and how to use them with examples is what I tried to give hints for newbies who do not know where to start because gdb does not break etc :)

cheers, 0xf001
blabberer
01-16-2005, 07:07 AM
i dunno why it looks garish in notepad all the 0x0d 0x0a got hardcoded
and every line is merged inside one another

probably some unix -->windows crlf problem i would assume

btw you started using objdump :)
0xf001
01-16-2005, 07:30 AM
blabberer :D

exactly, you could use an editor which "understands" unix textfiles, or use wordpad MFC,ultraedit, .... OR view it under linux :)

and no, I did not start using objdump. I just started to use the -M option, hehe :yay:
this is the beginners version, objdump is available everywhere, so it is easy to explain :)

Of course - if any corrupted section header, nothing will work anymore. Therefore another tut is in the works :)
SiNTAX
01-18-2005, 04:48 AM
3) Detecting debugging (ptrace)

Euhm wouldn't it be a hell of a lot easier to use LD_PRELOAD here, with your own ptrace() function :)
0xf001
01-18-2005, 04:02 PM
Hi SiNTAX,

this would of course be an option. but then you can not debug your binary anymore with gdb, since it wants to also use ptrace()

you have to code gdb detection into the ptrace function and there I think it gets more complicated, but it is another option.

I have a little example attached, just for fun :)

// ptrace.c -- Our little ptrace dummy --
int ptrace(int i, int j, int k, int l)
{
printf(" PTRACE CALLED!\n");
}

// antiptrace.c -- Our little ptrace test executable --
int main()
{
if (ptrace(0,0,1,0) < 0)
{
printf("DEBUGGER PRESENT!\n");
exit(1);
}
printf("Hello World!\n");
}

now if you run this it says Hello World!

Running in gdb it says DEBUGGER PRESENT! and Hello World

If we compile the above code with

gcc antiptrace.c -o antiptrace
gcc -shared ptrace.c -o ptrace.so

and set LD_PRELOAD=ptrace.so and run it in the debugger it says

# gdb antiptrace
GNU gdb 6.0-2
Copyright 2003 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i586-linux-gnu"...Using host libthread_db library "/lib/tls/libthread_db.so.1".

gdb> bp _start
Breakpoint 1 at 0x8048300: file ../sysdeps/i386/elf/start.S, line 48.
gdb>
gdb> run
PTRACE CALLED!
PTRACE CALLED!
Hello World!

Program exited with code 010.
You can't do that without a process to debug.
_______________________________________________________________________________
Error while running hook_stop:
No registers.
gdb>
gdb> q

but of course the breakpoint did not work, therefore the program did not detect us :)

has anyone a good gdb detection method in his ptrace.c :)?

cheers, 0xf001
andrewg
01-18-2005, 04:44 PM
Or, incidentially, there is an easier method to bypass the LD_PRELOAD trick, as shown below.

gdb> help set environment
Set environment variable value to give the program.
Arguments are VAR VALUE where VAR is variable name and VALUE is value.
VALUES of environment variables are uninterpreted strings.
This does not affect the program until the next "run" command.

:)
0xf001
01-18-2005, 04:54 PM
the elegant solution :)

thanks, 0xf001
SiNTAX
01-18-2005, 05:14 PM
0xf001,

just test for the TRACEME flag, otherwise pass the call onto the real ptrace().
0xf001
01-18-2005, 05:39 PM
hi sintax,

yes i know. the above code snippet is just to illustrate the concept :)

the question afterwards was how to explicitly detect gdb, since any ptrace calls can be made by the executable. as i do not often use gdb :), i did not realize yet you can set the environment from gdb as well :)
andrewg
01-18-2005, 07:03 PM
Hmm, I'll have to post my anti-debug binary if/when I finish it. There will be countless fun I'd imagine ;)

Just need motivation and stuff.
0xf001
01-19-2005, 07:24 AM
hi andrewg!

please do so I highly appreciate it :yay:

we can then test your antidebuggings and see if we find a way around it :devil:

thanks, 0xf001
0xf001
01-21-2005, 06:48 PM
hi,

I have updated the anti anti debugging tutorial. it is extended and a little bit cleaned up ...

enjoy, 0xf001


Trouble with Unpacking Crypkey 5.6
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Trouble with Unpacking Crypkey 5.6
PDA

View Full Version : Trouble with Unpacking Crypkey 5.6

pjr
01-16-2005, 05:12 AM
I know that it must look funny to you that I am having problems with Crypkey, and that too with v5.6 !!!!!

But I have been trying to unpack this prog for the past several months without much success !!!!!!!!

I had downloaded the archives of the RCE forums (the lastest zip file gives upto Nov 26 I believe) and had gone thoroughly through them...I'd also looked up the essays by Fravia, the excellent paper by Exefoliator, and several others on the net regarding Crypkey. I was interested in unpacking by myself. So I'd done a lot of research including trying to use the CKKeygen and CKinfo108.zip among others. Of course...With no sucess...Which is why I am posting here.

The prog is an exe file packed with Crypkey. No PE tools including PEiD etc give any info and Olly refuses to load it in and says it is not a valid Win32 PE file. Maybe so...Since when I actually DO run it, on Win 2000, on a Pentium 4, the prog name is not shown in the Task Manager but it runs under the DOS Virtual Machine and what is seen there is only wowexec under the ntvdm.exe or something similar in the task manager. Therefore it is pretty difficult to dump it. Imprec 1.6 is quite useless here as it claims that it is not a Win32 executable and hence refuses to get the imports when I tried to get the imports from the running app without dumping...

I had found some info on the net for patching LCRYPKYD.dll or some such file, but when I finallly found it in the App's directory, it turned out to be a 16-bit file and it really made me go nuts as to how to edit it since OLLY etc refused to load the file saying it is a 16-bit one. IDA Pro 4.3 loaded it and the GetAuthorization Module was also easily found but editing it became a problem. When I SOMEHOW tried to do calculations and changed the Hex bytes in Hex Editor, the file when put back into the Dir and when the prog was run, it said" Too big to fit into Memory" or some such thing (It was a few months ago in the initial stages so I don't remember exactly the message...)

So I changed my approach to trying to keygen the SiteKey. To that end, loaded the prog in VMware Virtual Machine (So that I could repeatedly try the various keys and just go back if the prog expired), used CKinfo v1.08 to find out as many details as possible. I used the key from the .rst file, .key file, and also the Master and User Keys got from the exe prog by disassembling it as they are stored as PlainText. Then I used the same CKinfo 1.08 prog to generate the SiteKey. Generated it successfully and input it also. The message box goes off but when I restart the prog, it again asks for the key with a different SiteCode. The prog refuses to run and just exits whether I repeat the process and give a new key or whether I press cancel.
It may be of interest to note that when I enter the SiteKey thus generated, the AUTHORIZED value stays on, the trial type changes to unlimited, and the days remaining and days used boxes go blank in the messagebox where we enter the sitekey. But the prog refuses to run thereafter. I had got the OptionLevel and the KeyLevel or something by using CK info in the manner:
CKinfo.exe /SiteKey XXXXXXX where the XXXXXXX was got from the .key file.

The prog is not crippled and is designed to run for 30 days. I had got the info about the Crypkey Ver used by CK Info 1.08 which says that v5.6 libraries of Crypkey are used. It is interesting to note that the actual file claimed to be encrypted by Crypkey according to CK info is EH.exe. But EH.exe is only 0 bytes though it exists in the dir and the actual fun which is run is RADAR8.EXE from which I'd got the User And Master Keys.

Your forum archives mention SKW.exe to generate the SiteKeys. I'd downloaded the demo from the Crypkey site itself an year ago. It was v5.7 which was downloaded at that time. If I install that Demo, I get a SKW.exe file also along with others, in the installed dir. Will it work for v5.6 also or is the SDK something else... I have a feeling it is something else and Google search did not help me...Then or now...

My attempts to keygen using CK Info 1.08 in the above manner had worked on Swish 2.0 which is also Crypkey protected... So my method I believe is not fundamentally wrong...

Can someone please point me in the right direction so that I may be able to keygen the SiteKey...

Am frustrated...Kindly please help ASAP...

Thanks in advance...

P.S. I know that you shouldn't ask for software...But the SKW.exe mentioned in the RCE archives is difficult to get hold of presently...Especially if it is not the same SKW.exe that comes with the CrypkeyDemo. I also have come across a post in the archives where a member was e-mailed the SKW.exe (If I remember right)...Any help in the direction for me to procure the SKW.exe will be greatly appreciated...Along with clues to how to patch it to generate keys for any company - This I think I can try to a large extent as there are posts in the archive on how to do the necessary patching. But procuring the SKW is a different thing altogether...
dELTA
01-16-2005, 12:47 PM
Good first post, kudos to you, you have potential. ;) I hope you get some answers anyway...
pjr
01-17-2005, 01:18 AM
Thanks to Delta for the encouraging comment...

I had gone back and tried patching LCRYPKYD.dll file using Hiew the way it was suggested in one of the tutorials on the web in the GetAuthorization export part of it so that it always should return Authorized to the calling function.

But immediately the prog refused to run and the messagebox said Not Authorized and in the Site Code box it says -1.

I am desperately in need of a prod in the right direction...

Thanks in advance...
jsteed
01-17-2005, 10:09 AM
Crapkey brings back memories. It's been years since I looked at it but from what I can remember and the few notes I've found, I can give you a few tips.

Unpacking the program was very easy, at least by todays standards. Note that I did this on a Win98 machine using softice. I don't think Olly had been invented yet. The unpacking routine is small and easy to follow. What you want to do is let crapkey unpack the program for you and then dump it when it reaches the real oep. From some old notes that I had the jump to oep is performed by the instruction jmp eax. As I recall this is a signature instruction. There is only one of those in the unpacker part of the program.

Once you dump the program, you'll have to realign the first section and change the oep to the real one. You can use LordPE for this. Lastly, you may or may not have a good IAT. You'll find out when you run the dumped program and receive a message about a missing dll. I don't remember if crapkey modified the IAT, but if it did, Imprec will create a new one for you.

Once you've done those steps, the crapkey wrapper will be removed from the program. Good luck. ;)
pjr
01-18-2005, 01:40 AM
jsteed...
The trouble seems to be that it is not a Win32 PE file at all as I already posted in my first post, and it runs under ntvdm/wowexec...

So, all the PE tools including ImpRec etc do not work there. I am going to try dumping once again under Sice under Win 98 as previously I was trying it under WinXP and failing...

Thanks anyway for the info...

BTW, I had successfully dumped/modified some other Crapkey progs like Swish , etc since they are valid PE files...
pjr
01-20-2005, 03:51 AM
I am more comfortable in using Olly than Sice...So I'd used Olly on a similar prog which came on the same CD...The only difference being that the packed exe was a valid WinPE Win32 executable, of course, protected with crypkey 5.6.

The idea was that if I could unpack this file first, then I could try my hands on that other file also, even if be using Sice.

The problem was finding the OEP of the program. I was using olly and tried to break on GetProcAddress - The third one...
Then I tried to come into the caller prog and step until I came to a sub eax,ecx followed by a jmp eax instruction.
I am not sure whether I'd missed it but I didn't find EITHER of those instructions.

I will be very happy if you could please tell me the EXACT steps YOU'D do to get to the goal of finding the OEP.

In other words, the question is very simple... - How EXACTLY do i get the OEP of a program which is packed with Crypkey 5.6?
There is not much useful material on the net reg this point which I could follow.
And I'd spent almost 3 months researching about this Crypkey business.

I'm sure that there MUST be a simple and generic way to find the OEP of Crypkey programs...

Any guidance in this direction will be much appreciated...
Thanks....
jsteed
01-20-2005, 11:20 AM
As I said, it's been a while since I looked at this and my notes are not complete. As I recall the first thing crapkey does is unpack itself with a small loop. The entire protion of the loader that you are interested in is only 300 - 400 instructions long. There are more than 3 calls to GetProcAddress in the main loader so you may not have gone far enough.

If you follow along with the loader, the crapkey nag screen will appear. Just after this, crapkey decrypts your program using cki32?.dll. Once this is done and the program returns from this dll back to the loader, crapkey then jumps to oep.

This should give you the clues you need to find the jump to oep. Here's one more from my notes, GetModuleHandleA is called just before the call to cki32x.
pjr
01-21-2005, 01:42 AM
Thanks for the info jsteed...

The trouble was, that the executable was not packed with Crapkey but rather was just calling functions from the library from the code. :whoops: This was rightly pointed out by squidge in pm and am going to try to register the prog using the SKW.exe than patch it...

Will keep you posted...

Thanks all... :)

Bye
peterg70
01-22-2005, 03:52 AM
pjr :

Its good to see someone who has actually done their research rather than just asking for a crack.
I have versions 5.7 and greater of the crapkey still installed on my win98 machine so I should be able to provide some pointers.

It sounds like the program is a 16bit program so it would be best to attach to it under windows 98 as this handled 16bit applications alot better than windows XP.

It sounds like you have found the various decryption codes and the password using ckinfo.
One of the tricks with some programs is that they may use the options to determine which version is authorise i.e. Option 100 is actually version 1.00, Options 126 is for Version 1.26. This ensure clients update their license to use a new version.

Another trick is that the license code is checked after decoding to have certain flags in the code. Or there is another wrapper or extra letters are appended to the license key as another checksum authorisation.
.
It sounds like the program rechecks the license when booting and if it isn't valid it then generates a new sitecode and requests to be authorised. Therefore only the basic entry of information and checking is actually done.
When the program restarts it will call the various check license dll commands. There must be other options which are checked against the application code to ensure that the license is valid.

Peterg70
pjr
01-23-2005, 03:31 AM
Peterg70:
Thank you very much for your reply which shows you have looked into the problem deeply...Though it took some time for you to answer :)

I have pmailed you... Pls check it.

Before you'd answered, squidge had given some pointers and am working on it...
pjr
01-29-2005, 08:32 AM
Hi Friends...

Thanks to everyone who'd contributed their time and energy to this thread. Especially peterg70 and squidge, who also helped me through pm etc...
The dilemna has been finally solved !

I will just summarize the problem and the solution in a few lines for the benefit of future users who may refer to this thread.

The problem lay in the fact that the application in question did not in fact use crapkey instant wrapper but rather used the v5.6 libraries which come with the SDK. There were several calls in the program code calling functions in the crapkey libraries.

When I'd actually tried to register the application using the patched version of the SKW.exe to generate a site key for the application, I found that I could in fact register it for UNLIMITED use. :)
That means there was nothing wrong with the generated site key. In fact I also found that using CKinfo.exe instead of the patched SKW.exe to generate the site key gave identical results in the form of me being able to successfully register it.

However, there were SEVERAL HARD-CODED statements within the program code that actually made sure that the app was not exceeding 30 days of use after first run, and this included the app checking the time stamps of the file and some others, checking the .key , .rst and .ent files, etc.

This particular version of the prog was made for the purpose of demo and only for demo, and in fact that was why it was not possible to register it for UNLIMITED use by merely generating a valid site key. If I'd wanted the prog, then the vendors were actually going to supply me another prog with dongles etc. though even the trial version was not otherwise crippled in any way. Therefore they'd made sure that one could not register it by site keys for indefinite use by merely providing a site key, since they'd NEVER intended in the first place to give keys to allow the users to try the prog beyond 30 days...The statements for checking 30-days of use were there for that purpose.

The solution to this problem lies in ruthlessly nopping out the calls that check this 30-days or in modifying it so that it ALWAYS returns the "good" value in EAX. Of course there are several CRC checks in the prog, but these will have to be redirected as well. :)

The job is mostly over...And it is mostly an exercise in reversing and analyzing protections for me rather than to crack the prog and use it indefinitely... In fact, I will be probably buying the prog if I think I will be actually needing it in future. the prog will now be sitting in one of the corners of my hard disk, now that its protection is mostly analyzed and reversed. :cool:

Thanks once again to all who contributed to this thread... :yay:


Internet based protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Internet based protection
PDA

View Full Version : Internet based protection

nimadismal
01-16-2005, 12:07 PM
Hi there
I dont know this is a newbie or an advanced topic but anyway..
how can we crack applications which requires an access to internet for verifying valid registeration?

Thanks

buy bay
Hero
01-16-2005, 12:38 PM
you can use several ways to find needed APIs:
1-you can use monitoring such as APISpy,... to trace API running and find
needed network access API.
2-setting breakpoint on APIs such as gethostbyname(),... that usually use
before connecting or other network APIs.

And another suggestion:If you want to use this forum,You should use do
what you promised in signature.Search before posting! :devil:

sincerely yours
Silver
01-17-2005, 10:12 AM
You can also inspect the data being sent back to a server using some packet capturing software, such as Ethereal, which may or may not assist in reversing. Quite often some interesting info turns up in a packet capture, as people go to all the trouble of online registration checking but then forget (or cannot afford the server capacity) to protect the data being sent out.
nimadismal
01-22-2005, 12:25 AM
thanks guy, i found another approach instead of registering that software, it requires to dump a ASPacked dll and changing it, but something interesting happened! i changed the dumped dll and it works pretty nice in windoZe98 but it doestnt work in winxp ! any idea?


Problems Reversing a PE File
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Problems Reversing a PE File
PDA

View Full Version : Problems Reversing a PE File

aam245
01-16-2005, 03:11 PM
Hi All
I am trying to reverse a demo PE file I would call PROG.EXE. Sometime back I successfully reversed an older demo version of this PROG using W32DSM by NOPing certain checks and it worked perfectly well. Now with this new version using W32DSM crashed my PC. I searched the forums and tried ProcDump and PEID etc but I simply could not understand them. I had gone through the Newbees sections and FAQs and unpacking tutorials but this bugger is probably more difficult.

I tried IDA and it disassmbled it however IDA freeware I have doesnt have a debugger. I came to Ollydbg and successfully made a Dump. However when I debug the Dump it stops on module MSVFW32 saying "Don't know how to step because memory at 0000001 is not readdable, try to change the EIP or pass exception to Program". Exactly the same message I got when I tried debugging the PROG.exe.

The Trace looks like this from top to bottom:

796313E9 8B7424 0C MOV ESI,DWORD PTR SS:[ESP+C];MSVFW32.796310A7
796313ED 57 PUSH EDI ; <ModuleEntryPoint>
796313EE 56 PUSH ESI ; <ModuleEntryPoint>
796313EF A3 68506479 MOV DWORD PTR DS:[79645068],EAX
796313F4 68 7C506479 PUSH MSVFW32.7964507C ; ASCII "MSVFW32.DLL"
796313F9 68 70506479 PUSH MSVFW32.79645070 ; ASCII "MSVIDEO.DLL"
796313FE E8 39110000 CALL MSVFW32.7963253C
7963253C 5A POP EDX ; <ModuleEntryPoint>
7963253D 68 4D256379 PUSH MSVFW32.7963254D ; ASCII "ls_ThunkData16"
79632542 68 D8506479 PUSH OFFSET MSVFW32.ls_ThunkData32
79632547 52 PUSH EDX ; KERNEL32.BFFC9490
79632548 E9 4F9E0000 JMP <JMP.&KERNEL32.ThunkConnect32>
7963C39C -FF25 10D66479 JMP DWORD PTR DS:[<&KERNEL32.ThunkConnec>
79631403 57 PUSH EDI ; <ModuleEntryPoint>
79631404 56 PUSH ESI ; MSVFW32.796310A7
79631405 68 7C506479 PUSH MSVFW32.7964507C ; ASCII "MSVFW32.DLL"
7963140A 68 70506479 PUSH MSVFW32.79645070 ; ASCII "MSVIDEO.DLL"
7963140F E8 A7100000 CALL MSVFW32.796324BB
796324BB 5A POP EDX ; <ModuleEntryPoint>
796324BC 68 AC246379 PUSH MSVFW32.796324AC; ASCII "sl_ThunkData16"
796324C1 68 B4506479 PUSH OFFSET MSVFW32.sl_ThunkData32
796324C6 52 PUSH EDX
796324C7 E9 D09E0000 JMP <JMP.&KERNEL32.ThunkConnect32>
7963C39C -FF25 10D66479 JMP DWORD PTR DS:[<&KERNEL32.ThunkConnec>
79631414 B8 01000000 MOV EAX,<ModuleEntryPoint>
79631419 5F POP EDI ; 01CDFC10
7963141A 5E POP ESI ; 01CDFC10
7963141B C2 0C00 RETN 0C
00000001 ???

I kept the Dump Entry Point the same (00D635CE) and few line before the entry and after the entry are looking like this:

00D635B0 -FF25 4C681301 JMP DWORD PTR DS:[<&MSVCRT.fprintf>] ; MSVCRT.fprintf
00D635B6 -FF25 50681301 JMP DWORD PTR DS:[<&MSVCRT.fwrite>] ; MSVCRT.fwrite
00D635BC -FF25 54681301 JMP DWORD PTR DS:[<&MSVCRT.fread>] ; MSVCRT.fread
00D635C2 -FF25 58681301 JMP DWORD PTR DS:[<&MSVCRT.log10>] ; MSVCRT.log10
00D635C8 -FF25 5C681301 JMP DWORD PTR DS:[<&MSVCRT.remove>] ; MSVCRT.remove
00D635CE > 55 PUSH EBP
00D635CF 8BEC MOV EBP,ESP
00D635D1 6A FF PUSH -1
00D635D3 68 F8CBFF00 PUSH DUMP.00FFCBF8
00D635D8 68 4A37D600 PUSH <JMP.&MSVCRT._except_handler3>
00D635DD 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
00D635E3 50 PUSH EAX
00D635E4 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
00D635EB 83EC 68 SUB ESP,68
00D635EE 53 PUSH EBX
00D635EF 56 PUSH ESI
00D635F0 57 PUSH EDI
00D635F1 8965 E8 MOV DWORD PTR SS:[EBP-18],ESP
00D635F4 33DB XOR EBX,EBX
00D635F6 895D FC MOV DWORD PTR SS:[EBP-4],EBX
00D635F9 6A 02 PUSH 2
00D635FB FF15 A8681301 CALL DWORD PTR DS:[<&MSVCRT.__set_app_ty>; MSVCRT.__set_app_type
00D63601 59 POP ECX ; DUMP.00400000

Well my experience with WDSM has been very good but this new stuff is bugging me specially how to proceed with this whole thing in a step by step manner. Apart from the packing/unpacking thing the real objective would be to overcome the protection mechanisms.

I would highly appreciate help in this matter.
aam245
Fake51
01-17-2005, 04:17 AM
Well, I'd suggest you do the following:
First off, do the required reading of the pe header (and exactly what that means is somewhat fuzzy. Just get ahold of some pe-documents - try www.wotsit.org, for instance - and read those. There should be plenty of threads on this board too, search for PE).
Secondly, learn how to use a filescanner. If the file is packed (and something would suggest that it is) it's always best to know with what. If you're lucky, you can just apply an unpacker. If not, at least you may search for essays that can help.
Thirdly, run the thing in ollydbg - if it doesn't crash, it should load at ep and you should be able to look at things (from the code you posted, it doesn't look too much like you ever got near the ep with your dump)
Fourthly, stay away from dumps till you know what you're dealing with - in the end, you might find that a loader is a much easier way, or that something else is.

Fake
blabberer
01-17-2005, 04:43 AM
well the 635ce looks like standard msvc compiled exes prolog so you probably have
the right entry point
and above it there is a jump table so probably the import table is merged in code section
olly puts out that message if it encounters an illegal instruction that it cant execute
like 0xffff etc etc and it will put out that message even if you pass the exception to the app without letting olly handle it
so when it pops up press ok then if it not paused but running press f12 and pause
when if it paused click the k button (view call stack ) and locate what calls are still pending in stack (you can follow the call procedure etc from that window)
if there are some calls from the module you are tarcing follow there and set a break point and restart ollydbg
olly should now pause in you break point now you can probaly single step through and find where some problem is occurs
aam245
01-17-2005, 11:12 AM
Thanks Fake and Blabberer

I will once more referesh my PE header knowledge. The Dump.exe and Prog.exe are looking exactly the same and I kept the entry offset also the same.

Yes Import table may be merged in the code however when I see the Memory map and follow the PE header section it clearly gives the start, size and offsets of import table for the main module.

The EP is definitely 635CE as both IDA and Olly are showing it. There is one intersting thing just one line down after the ep, Note again this is the 3rd line after ep in the main module (same in Dump.exe and Prog.exe):

00D635D3 68 F8CBFF00 PUSH DUMP.00FFCBF8

When I try to look for the immediate constant for the address, this address is found in .rdata section and both IDA and Olly are showing unknown command in disassembly. It looks like this at 00FFCBF9,
00FFCBF1 33D6 XOR EDX,ESI ; MSVFW32.79630000
00FFCBF3 0000 ADD BYTE PTR DS:[EAX],AL
00FFCBF5 0000 ADD BYTE PTR DS:[EAX],AL
00FFCBF7 00FF ADD BH,BH
00FFCBF9 FFFF ??? ; Unknown command
00FFCBFB FF0C37 DEC DWORD PTR DS:[EDI+ESI]
00FFCBFE D6 SALC
00FFCBFF 0020 ADD BYTE PTR DS:[EAX],AH
What the Heck is this unknown command ????? and what is it doing in .rdata, and why the main program calling such thing just after the ep. When I sift through the .rdata there are several of this kind scattered there;

As for the call stack the only thing visible on Call stack is MSVFW32.dll and there are calls within it. The program halts after the appearance of the error message I mentioned inoriginal mail and no key Ctrl+F(any) works.

Any further suggestions are highly regarded.
Thanks
blabberer
01-17-2005, 11:53 AM
ffff is unknown command because it is not defined
ffff is not an opcode so no disassembler can decode it properly
in ollydbg there is an option in options ---> debugging option--->security-->
allow stepping into unknown commands
if you check it olly will let you step through it

but before that what ever is in r data probably has no bearing to the disassembly you quoted
all those commands are single steppable without generating any exceptions

PUSH EBP ;standard stackframe setting
MOV EBP,ESP ;""
PUSH -1 ;pushes -1
PUSH DUMP.00FFCBF8 ;pushes an address 0xf8cbff into stack
PUSH <JMP.&MSVCRT._except_handler3> ;pushes an address into stack
MOV EAX,DWORD PTR FS:[0] ;standard seh frame setup
PUSH EAX
MOV DWORD PTR FS:[0],ESP
SUB ESP,68 ;creates locals in stack

as i said you need to single step through the code by breaking some where
before it puts out the message

try to make it run before unpacking inside debugger
use debugger options --> exceptions--> add range (add all) then check every box in that dialog and press ok
get hide debugger plugins and hide the debugger
find the find window code in dll and conditional break point some where down deep inside its code and when you find it use a condition to parse stack for ollydbgstring and make it stop only for that string and when it stops
nullify the string or modify the string so it fails automatically :)
find unhandled exception filter code and patch it
what ever it takes to fool the application :) to believe it is running outside debugger while actually it is running inside it
then when it is fooled and it is running use pause inside debugger and verify the call stack for pending calls
then from there use ctrl+g enter etc and play through the fully running code :)
aam245
01-17-2005, 12:23 PM
Wow...Thats something...Thanks again Blabberer...
One little thing however....You said "when you find it use a condition to parse stack for ollydbgstring and make it stop only for that string.."

Can you explian it a bit further how to set up thsi Ollydbgstring ???
Appreciate all the help.. and will gothrough one step at a time.
Regards,
blabberer
01-17-2005, 12:52 PM
HWND FindWindow(
LPCTSTR lpClassName,
LPCTSTR lpWindowName
);

so both of them are strings or class name may be an atom (we leave that possibility now) so since they are strings they have to passed in clear (system dlls have no way to decrypt your schmuck)
now at the start of find windows code
it will have the string in
stack top and stacktop+4 (esp ,esp+4)
you can set set condition like this
[string [esp]] == "you string"
now if you prefer to set conditional break point some where deep

just change [esp] to [esp+ whatever position] (you need to find it once independent)
but it will remain same no matter what for next n times in your computer :)
get olly script plugin or get ollymachine plugin
and try to write scripts that do this automatically for you
its kinda involved the best tutor is f7 :) experiment :)
aam245
01-17-2005, 01:46 PM
thanks again blabberer....I will follow this lead...and yes you are right about the best tutor...however direction from peers is equally important...and direction you gave is just great....
will report on my tries after a while .....l dont want to get infamous with this famous software....
WaxfordSqueers
01-17-2005, 07:53 PM
I tried IDA and it disassmbled it however IDA freeware I have doesnt have a debugger.
you don't need the debugger in IDA. When IDA disassembles the file does it complain about a hashed import table? If not, then it's probably not packed. You can verify that in IDA by looking under the 'Jump' menu and click 'Jump to segment' on the menu that pops up. Highlight '.idata' and press OK. You'll land in the imports section. In a packed app, this section will be be almost completely wiped out.

Something seem out of order in your trace. For example, why is there a minus sign ( - ) in front of FF in your jmp statements?

7963C39C -FF25 10D66479 JMP DWORD PTR DS:[<&KERNEL32.

there are no such signs anywhere else. I don't know if that's a peculiarity with Ollydebug, or what. But there should be no minus sign in that jump statement. If it's there in your code it will no doubt throw an exception.

Also, given the address range, you seem to be tracing through a system file.
Is this a dump from MSVFW32.DLL, and if so, why would you want to modify it? It seems to me it's a system file. It's highly unlikely a programmer would mess with a system file when adding protection.

Well my experience with WDSM has been very good but this new stuff is bugging me specially how to proceed with this whole thing in a step by step manner. Apart from the packing/unpacking thing the real objective would be to overcome the protection mechanisms.

you'll find as you get into more complex stuff that WDASM is very limited. I know it's tough to learn an app like IDA or softice, but that's where your bread and butter will be as you progress. I'm not going to say anything negative about Ollydebug because I've never used it.

IDA gives you a lot of advantages for tracing through raw code. It's called an interactive disassembler because you are required to interact with it. That's not easy at first, but as you get used to it, you can squeeze information out of disassemblies that you could never get out of WDASM. Do yourself a favour and take the plunge. Also, try softice and compare it to Ollydebug.
WaxfordSqueers
01-17-2005, 08:21 PM
I tried IDA and it disassmbled it however IDA freeware I have doesnt have a debugger. I came to Ollydbg and successfully made a Dump. However when I debug the Dump it stops on module MSVFW32 saying "Don't know how to step because memory at 0000001 is not readdable, try to change the EIP or pass exception to Program". Exactly the same message I got when I tried debugging the PROG.exe.

If I'm reading you correctly, that you dumped memory from Ollydebug, then tried to run it through a debugger, it doesn't surprise me you got an error. If you loaded your dump in IDA, provided it would load, and you were tracing visually and came to the following statement:

CALL MSVFW32.7963253C

what would you expect to happen? You need to call MSVFW32.dll but it's not loaded or connected to the dump. You have no where to go. When you load your app in IDA, it loads only the app, not the import DLL's.

When Ollydebug loads an app to debug it, the app loads exactly as it would normally. That means the loader fixes up all the CALL statements like the one above, so the execution sequence can find the DLL. When you dump it, it doesn't dump the DLL as well. It only dumps the CALL to it.
WaxfordSqueers
01-17-2005, 08:42 PM
When I try to look for the immediate constant for the address, this address is found in .rdata section and both IDA and Olly are showing unknown command in disassembly.

That's because this is not code. Look at the instructions. ADD BH, BH makes little sense in this context and opcodes of 00 00, which translate to:

ADD BYTE PTR DS:[EAX], AL, is not good code. Also, the other instructions are garbage.

The RDATA section doesn't contain code normally. But a disassembler often mistakes it for code and tries to translate ordinary numbers into opcodes. That's what happened below. The FFFF is not meant to be an instruction.

Disassemblers, even good ones like IDA make mistakes. Don't rely on them being accurate. They rely on you to know what is good code and what isn't.

Data usually, but not always aligns on even boundaries like 00000000, 00000004, 00000008, 0000000C. The opcode for XOR can be 33 but it's unlikely that they'd XOR EDX and ESI. So, look for a data boundary, say at 00FFCB4. That would give 00000000, the next boundary is at 00FFCB8, giving
FFFFFFFF. That's what your code is, the data byte FFFFFFFF. Next byte is at 00FFCBC and that's 0C37D600.

If you were in IDA, you could get it to fix that by declaring it unknown and resetting it to data.

It looks like this at 00FFCBF9,
00FFCBF1 33D6 XOR EDX,ESI ; MSVFW32.79630000
00FFCBF3 0000 ADD BYTE PTR DS:[EAX],AL
00FFCBF5 0000 ADD BYTE PTR DS:[EAX],AL
00FFCBF7 00FF ADD BH,BH
00FFCBF9 FFFF ??? ; Unknown command
00FFCBFB FF0C37 DEC DWORD PTR DS:[EDI+ESI]
00FFCBFE D6 SALC
00FFCBFF 0020 ADD BYTE PTR DS:[EAX],AH
blabberer
01-18-2005, 03:24 AM
waxford
the - in front of jmp table means it was analysed by ollydbg and it doesnt have any valid referance
for ex
olly will put if it finds a valid call that is calling this jmp table

00401176 $- FF25 00204000 JMP NEAR DWORD PTR DS:[<&KERNEL32.Vi>; KERNEL32.VirtualProtect

if it is unanalysed or it cant find a referance to the call then it will put

00401164 - FF25 10204000 JMP NEAR DWORD PTR DS:[<&USER32.Mess>; USER32.MessageBoxA

btw ida did not disassemble it correctly coz the f9cbff points to 0xffffffff == -1
and it is shown as in midlle of another instruction so one cant actually go by idas disassembly without using c | u | d whatever it takes to make it disassemble it right
WaxfordSqueers
01-18-2005, 07:50 AM
waxford
the - in front of jmp table means it was analysed by ollydbg and it doesnt have any valid referance

thanks for explanation.

btw ida did not disassemble it correctly coz the f9cbff points to 0xffffffff == -1 and it is shown as in midlle of another instruction so one cant actually go by idas disassembly without using c | u | d whatever it takes to make it disassemble it right

It is an 'interactive' disassembler. I do a lot of fixing up when I use IDA. It gets an amazing amount of stuff right, but with the modern OOP stuff, there's data everywhere. Also, the compiler puts it's own references in the code too, like in a statement such as:

mov eax, [eax+ecx*4+18h]

the value moved to eax is dependent on the variable of [eax + ecx]. Sometimes the values used for eax and ecx are listed as data bytes in the middle of some code. It's a little table of data bytes keys inserted in the code by the compiler. It's little wonder IDA gets messed up from time to time.

Then there's jump tables. You'll find series of doublewords in the middle of code. I find IDA sometimes gets messed up in the middle of that.
aam245
01-18-2005, 09:47 AM
Gentlemen
Thnaks for your comments.
First of all I only used IDA first for disassembly, it disassmbled the code and I can see the nice function calls and graphs etc but it could not debug as I only have the IDA freeware. IDA didnt complain the hash table etc. now I have a .idb file from IDA which i am using to see the disassembly. I also made an .asm file and when I tried using WDASM on this .asm file it took hours and ultimately hanged my PC and my w386.swp in windows grew to 800 M. I stopped on that path.

Then I used the Olly...in olly I got that message that I mentioned earlier...I saw the trace and message is coming out of the system file MSVFW32...I didnt touch the system file...nor I am planning to...
I Dumped the code and Olly created the FileDUMP.exe for me...I kept the same offset for the ep...so the ep in Dump is appearing to be on same address...so that i dont have to calculate everything all the time....
Both Dump.exe and Prog.exe are looking the same and throwing the same error. Both on the third line of entry are pointing to an address at .rdata...blaberer says its only loading the address on stack...but my question is why it is loading that address which is in .rdata and olly and IDA both can't identify the instructions.

about the trace the trace is offcourse from the system file because where olly crashed..again I am using Olly as debuger and not IDA...and its loading the .dll when called whether from Dump or PROG.exe.

yes the line at the trace is showing the - sign in fact there is only one line in the trace as it jumps back to some other location in the same dll however if I look around that line in the dll there are several of these kind... such as:

7963C384 -FF25 20D66479 JMP DWORD PTR DS:[<&KERNEL32.K32Thk1632P>
7963C38A -FF25 1CD66479 JMP DWORD PTR DS:[<&KERNEL32.K32Thk1632E>
7963C390 -FF25 18D66479 JMP DWORD PTR DS:[<&KERNEL32.MapSLFix>]
7963C396 -FF25 14D66479 JMP DWORD PTR DS:[<&KERNEL32.UnMapSLFixA>
7963C39C -FF25 10D66479 JMP DWORD PTR DS:[<&KERNEL32.ThunkConnec>
7963C3A2 -FF25 0CD66479 JMP DWORD PTR DS:[<&KERNEL32.SMapLS_IP_E>
7963C3A8 -FF25 08D66479 JMP DWORD PTR DS:[<&KERNEL32.SUnMapLS_IP>
7963C3AE -FF25 04D66479 JMP DWORD PTR DS:[<&KERNEL32.SMapLS_IP_E>
7963C3B4 -FF25 00D66479 JMP DWORD PTR DS:[<&KERNEL32.SUnMapLS_IP>
7963C3BA -FF25 FCD56479 JMP DWORD PTR DS:[<&KERNEL32.SMapLS_IP_E>
7963C3C0 -FF25 F8D56479 JMP DWORD PTR DS:[<&KERNEL32.SUnMapLS_IP>
7963C3C6 -FF25 E8D56479 JMP DWORD PTR DS:[<&KERNEL32.MapLS>]
7963C3CC -FF25 E4D56479 JMP DWORD PTR DS:[<&KERNEL32.UnMapLS>]
7963C3D2 -FF25 34D86479 JMP DWORD PTR DS:[<&WINMM.#3>]
7963C3D8 -FF25 20D86479 JMP DWORD PTR DS:[<&WINMM.#1>]
7963C3DE -FF25 CCD46479 JMP DWORD PTR DS:[<&DCIMAN32.DCICreatePr>; DCIMAN32.DCICreatePrimary
7963C3E4 -FF25 C8D46479 JMP DWORD PTR DS:[<&DCIMAN32.DCIOpenProv>; DCIMAN32.DCIOpenProvider
7963C3EA -FF25 C4D46479 JMP DWORD PTR DS:[<&DCIMAN32.DCIClosePro>; DCIMAN32.DCICloseProvider
7963C3F0 -FF25 C0D46479 JMP DWORD PTR DS:[<&DCIMAN32.DCIDestroy>>; DCIMAN32.DCIDestroy
7963C3F6 -FF25 BCD46479 JMP DWORD PTR DS:[<&DCIMAN32.DCIEndAcces>; DCIMAN32.DCIEndAccess
7963C3FC -FF25 B8D46479 JMP DWORD PTR DS:[<&DCIMAN32.DCIBeginAcc>; DCIMAN32.DCIBeginAccess

My basic thing was to run the sh** step by step and overcome the protection....I am not a professional ....just doing it for my sake as it will be a usefull thing if done...
Again I will brush up my PE header knowledge....however Olly shows nice sections with starts, size, ep, and offsets etc...for all the modules in the memory map....
The independent program runs perfect except that it has a limitation...however Olly throws the error...seems lilke somewhere there is something which is detecting it although I try to hide the olly using the plugin...

Moreover if I try to search the string in IDA (which I see when runing the normal program about the limitation of demo)......I dont find it .....most of the strings shown in the IDA are looking like garbage....

May be program is encrypted and not packed...I am not very sure of the difference between the encrypted code and packed code...to my knowledge its the same thing....isn't?????
Rest assured I will slowly continue on it and try to find the nagging thing...
Thanks again to all for valuable advice..
Fake51
01-18-2005, 10:59 AM
Seriously, get Peid or some other filescanner before doing else, and find out if it's packed or not. And if it is indeed packed, look for an unpacker or some file dumper. In general, take a quick tour of protools.
It seems you're trying to run at full speed into something you have no idea what is. There's nothing wrong with manually trying to unpack some target - except if you have no idea what you're going into and how you're supposed to get out. You'll just end up wasting your resources way too quick.

Fake
aam245
01-18-2005, 11:58 AM
Hi Fake and Other
I just used the PEID on it. Using the hardcore / deep / normal scan it says:
Microsoft Visual C++ 6.0 [Debug]
On external scan it says:
Nothing found [Debug] *

When I click >> >> on the lower right corner it gives following information:
Detected: Nothing found [Debug] *
Scan Mode: Hardcore
Entropy: 5.67 (Not Packed)
EP Check: Not Packed
Fast Check: Not Packed

However when I click PlugIns ->PEID Generic Unpacker it says snaker's tracer works with WINNT platforms...(I have WIN98)

On clicking PlugIns -> CryptoAnalyzer it gives following:
- BASE64 table::00CE65A8 :: 010E65A8
referenced at 010E65A4
- BLOWFISH [sbox] :: 00CE5010 :: 010E5010
Referenced at 00B8BA6A
- PI fraction (NIMBUS / BLOWFISH) :: 00CE4FC8 :: 010E4FC8
Referenced at 00BB8BA4F

Now my questions:
1- It looks like it is not packed...however is it encrypted ????
2- Whats the difference between encrypted code and packed code...if there is any ??
3- If it is encrypted how to proceed ??
4- in PEID readme says
"Disassembler Module..."You can have a quick disassembly of the file loaded in PEiD. Double click to follow JMPs and CALLs and use the Back button to trace back to the original positions. Thanks to Overflow for his code.""

When I give the entry point address in the disassembled code in the PEID nothing happens...the disassembly window (text window I open) is showing listing starting from ep...
All the suggestions are again highly appreciated...
Regards to all of you

3-
Fake51
01-18-2005, 12:35 PM
Ok, some answers:

1) without actually looking at the thing, it's very hard to say. There might be some uses of encryption in it, but it seems more likely that the thing isn't encrypted.
2) packed code means that the code has been packed in order to save space - that was the idea of it, once, anyway. Since modern day coders can figure out how to make small apps, they can use packers to minimize their apps. Encrypted code means that some kind of encryption has been used to modify the code. This doesn't make the code smaller, however. Packers and encryptors typically have more or less the same effect on the code: it will not be possible to do a disassemble of the app.
3) if it's encrypted or packed, you can try a filedumper or an unpacker. Procdump, LordPe, etc etc etc. What you could consider doing is actually doing a dump of the file, and compare it to what you have on disk. If the dump is a lot bigger, then the file was probably packed. If the code sections match, then the file hasn't been modified.
4) haven't been playing around with that function of peid, so can't help ya.

A few basic pointers: you might not find any strings in the app, and yet that doesn't necessarily mean that it's packed or encrypted. The app might store it's strings in some other manner.
Secondly, if the app relies heavily on some library for the main part of it's functions, then you might have some trouble locating any fun parts. Fishing around in msvc can be quite a bother, for instance.

Btw, since I'm apparently sort of interested, pm the name of the target. If I have some time, maybe I'll look into some of your questions and see if I can get you on your way.

Fake
WaxfordSqueers
01-18-2005, 05:11 PM
May be program is encrypted and not packed...I am not very sure of the difference between the encrypted code and packed code...to my knowledge its the same thing....isn't?????
Rest assured I will slowly continue on it and try to find the nagging thing...
Thanks again to all for valuable advice..

It's not clear to me what you're trying to do, and I'm no expert. But let me see if I can get you going in a direction which will help you.

What I'd call a fully encrypted program is one like a zip file or rar file. In those files, the bytes are altered in the compression algorithm but they can also be encrypted with a password. So, no matter what you did, you could not read the program with IDA and running either through softice or Olly would not be possible. With those kinds of programs, you need another program to decrypt them. Of course, there are rar files with exe extensions that unpack themselves, but that's another matter.

There are many types of packed programs. The difference between them and the fully encrypted ones, is that packed files must be able to run (execute) on their own. That means they must have a certain amount of legitimate code at the beginning, and IDA should be able to disassemble that code. Somewhere after the good code, the file is compressed and/or encrypted, and other steps are taken to prevent (or try to prevent) unpacking. This includes hashing the import table, compressing the code, and other nasty anti-debugging tricks.

When a packed file runs, it decompresses itself using code built in to the program. This code is called a wrapper, since it wraps around the real application. This code does other things as well, like checking CRC (for modifications) or looking for debuggers. There are different strategies for bypassing that code or defeating it, and you'll find that in the archives.

Is there a chance with the program you're hacking now, that you have changed bytes in it already? Can you start again with a completely fresh copy of the app and see if it still crashes? Better still, will it run on it's own?
Fake51
01-19-2005, 10:44 AM
It seems the app is using a Sentinel software protection. Does the demo have any "register" or "install key" feature? In that case, you might choose another path.

Fake


Just to count out how many chinese here.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Just to count out how many chinese here.
PDA

View Full Version : Just to count out how many chinese here.

4nil
01-17-2005, 12:04 AM
rt

yeah
if anyone will be interest in this thread and sing ur name down...?hehe :devil:


easy printf reversen
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > easy printf reversen
PDA

View Full Version : easy printf reversen

XFlorian
01-17-2005, 06:49 AM
i have compilied a easy printf under linux
gcc print.c -o print

void main ()
{
printf("A test");
}

Than I decompiet it with IDA PRO .
.text:08048384 public main
.text:08048384 main proc near ; DATA XREF: _start+17o
.text:08048384
.text:08048384 var_8 = dword ptr -8
.text:08048384
.text:08048384 push ebp ;
.text:08048385 mov ebp, esp ; ESP =EBP
.text:08048387 sub esp, 8 ;
.text:0804838A and esp, 0FFFFFFF0h // What is done here?
.text:0804838D mov eax, 0 //Why is EAX =0

.text:08048392 sub esp, eax // Why ist ESP - EAX
.text:08048394 mov [esp+8+var_8], offset aEinTestMitEinf ; "A test".
text:0804839B call _printf
.text:080483A0 leave
.text:080483A1 retn
.text:080483A1 main endp

My questions are above

__do_global_dtors_aux proc near
frame_dummy
I didn't post the whole IDA, when you wish that I will.

Is there a tutorial or a book to this topic?

THX
lifewire
01-17-2005, 07:57 AM
imho it is weird code indeed, not the usual HLL stuff. it just looks (or better "feels") odd. but well, what I can make of it: the and aligns ESP on 16 bytes, and about the other stuff and more in general: I think that it has something to do with the varying number of arguments that is passed to a printf, with va_list and other nasty stuff. It's just a guess though.
andrewg
01-17-2005, 08:14 AM
The best method of understanding various compilers output would have to be sitting down and trying various loops, calling procedures, how they do stack stuff, etc, and then doing it again at different optimisation levels.

Some things are more file format specific. For example, the name __do_global_dtors_aux suggests it does global dtors destruction. A documentation on the ELF specs can be found at http://www.x86.org/ftp/manuals/tools/elf.pdf.

GCC has had, imo, various bugs where it would do spurious things, such as mov eax, 0; sub esp, eax, as that could be optimised out imo. Another case where I've seen some bugs is how it would allocate space for some buffers, and how it vary.... (which makes it annoying when you consider I was trying to play around with various off-by-ones and playing with exploiting stuff.)
blabberer
01-17-2005, 12:09 PM
actually gcc produces code which is imho is not secure enough too
for example i compiled one of the c code in andrewgs site with bcc free comand line tools removing linux dependent code and substituting printf() in thier place i see bcc generates an entirely different output where it absolutely avoids the possibility of exploit
bcc uses registers whereas gcc used stack
stack is writable but register isnt writable unless i get to set a
seh and get the context and probably modify the register
was the only way i could come up with
0xf001
01-17-2005, 08:53 PM
hi XFlorian,

.text:08048387 sub esp, 8 ;
.text:0804838A and esp, 0FFFFFFF0h // What is done here?

indeed here the stack is aligned to the next 16 byte boundary (-8 as stack grows "downwards" in memory).

text:0804838D mov eax, 0 //Why is EAX =0
.text:08048392 sub esp, eax // Why ist ESP - EAX

I tried several things like using 0 or more local variables for main and came to the conclusion: this 2 instructions will always be there (except optimization turned on).
Now I think this code comes initially from the request to align the stack
( ptth://gcc.gnu.org/ml/gcc-bugs/2001-08/msg00139.html ), and as the start of the code in main() starts at byte 16 then, this seems to be another alignment issue. Maybe when using inline assembly for having an aligned code start.
And from a coders perspective you have the easy possibility to move your stack around by patching the zeros haha :)

__do_global_dtors_aux proc near
frame_dummy

those are called by the _init / _fini functions, which are inserted into every gcc compiled executable by the c runtime. the _init function calls ie the __do_global_ctors_aux, frame_dummy functions which means run the "global constructors" to initialize the global data (set up the environment for main: argv, argc, env, stackframe), and is therefore executed before main(). the __do_global_dtors_aux is the opposite and ran at the very end to cleanup.

Now when I looked at my gcc output, I realized that subsequent function calls are also provided with an aligned stack: :)

My gdb gave the output for your prog:

08048336 <main>:
8048336: 55 push ebp
8048337: 89 e5 mov ebp,esp
8048339: 83 ec 08 sub esp,0x8
804833c: 83 e4 f0 and esp,0xfffffff0
804833f: b8 00 00 00 00 mov eax,0x0
8048344: 29 c4 sub esp,eax
8048346: 83 ec 0c sub esp,0xc ; <==== 0xc
8048349: 6a 01 push 0x1 ; <==== + 0x4 = 0x10
804834b: e8 dc ff ff ff call 804832c <func0>
8048350: 83 c4 10 add esp,0x10
8048353: c9 leave
8048354: c3 ret

you see the sub esp, 0xc there. together with the push, the esp is exactly one boundary.

when using 2 or three parameters the output shows it clearly:

08048336 <main>:
8048336: 55 push ebp
8048337: 89 e5 mov ebp,esp
8048339: 83 ec 08 sub esp,0x8
804833c: 83 e4 f0 and esp,0xfffffff0
804833f: b8 00 00 00 00 mov eax,0x0
8048344: 29 c4 sub esp,eax
8048346: 83 ec 08 sub esp,0x8 ; <===== 0x8
8048349: 6a 02 push 0x2 ; <===== + 0x4
804834b: 6a 01 push 0x1 ; <===== + 0x4 = 0x10
804834d: e8 da ff ff ff call 804832c <func0>
8048352: 83 c4 10 add esp,0x10
8048355: c9 leave
8048356: c3 ret

or

08048336 <main>:
8048336: 55 push ebp
8048337: 89 e5 mov ebp,esp
8048339: 83 ec 08 sub esp,0x8
804833c: 83 e4 f0 and esp,0xfffffff0
804833f: b8 00 00 00 00 mov eax,0x0
8048344: 29 c4 sub esp,eax
8048346: 83 ec 04 sub esp,0x4 ; <===== 0x4
8048349: 6a 03 push 0x3 ; <===== + 0x4
804834b: 6a 02 push 0x2 ; <===== + 0x4
804834d: 6a 01 push 0x1 ; <===== + 0x4 = 0x10
804834f: e8 d8 ff ff ff call 804832c <func0>
8048354: 83 c4 10 add esp,0x10
8048357: c9 leave
8048358: c3 ret

so there seems to be a lot of alignment stuff in gcc :)

cheers, 0xf001
SiNTAX
01-18-2005, 04:35 AM
Few remarks on this:

- gcc -S is useful too.. compiles to an asm file (filename.s)
- without -O2 (or -O) the output can be quite stupid
- gcc -g for debug info and then 'objdump -d' to disassemble can be handy too
- code compiled with -mregparm=X will use registers for function calling instead of stack (for i386.. x86_64 defaults to register calling, ie 6 args in regs, rest on the stack)

And last but not least.. the linux tools (objdump/gas/...) use AT&T style syntax, whereas IDA (and most windows tools) use Intel style.
In AT&T style: src, dst
In Intel style: dst, src
stanks
01-22-2005, 12:08 PM
Few remarks on this:

- gcc -S is useful too.. compiles to an asm file (filename.s)
...

Add -masm=intel and you will have intel syntax in asm file

stanks
SiNTAX
01-23-2005, 08:50 AM
To be honest.. having spend most of my asm days in Motorola 680x0 assembler (amiga), I always prefered the Motorola/AT&T syntax (left to right).


Evaluator's crackme#2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Evaluator's crackme#2
PDA

View Full Version : Evaluator's crackme#2

evaluator
01-17-2005, 08:01 AM
For "www.Cracmes.De'" i created maybe interesting crackme "jE!_crme02".
go there i fight with me:)
Kayaker
01-17-2005, 09:44 AM
Ooh, ooh, I think I solved the first part, which is fixing the link:
www.Crackmes.De
;-)
ZaiRoN
01-17-2005, 12:11 PM
Since of it seems to be an interesting crackme I take the liberty to open a new thread. For those whom want to try, here is the direct link of the crackme: http://www.crackmes.de/users/je/crackmes/je_crme02/download

Good luck,
Z.
evaluator
01-17-2005, 01:49 PM
B-T-W!
I'm against discussing here,
bcoz I dedicated this crackme to Crackmes.De;
pEalZ, respect my dedication & Crackmes.De:)

What now!?

EDIT BY KAYAKER:
That's fine, people can go to the Crackmes And Reversemes Area of the Anticrack forum if that's what you prefer. This thread is therefore locked, OK?


question about HASP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > question about HASP
PDA

View Full Version : question about HASP

dive2code
01-19-2005, 12:38 AM
Hi all,

I tried with hasp dongle, may be hasp4.

In this case, the seed code (eax) of IsHasp() is 'zero'.

Is it not important or something wrong?
CrackZ
01-21-2005, 07:39 PM
Hiya,

IsHasp() (service 1) doesn't care about a SeedCode (nor in fact the HASP passwords, it just fires back EAX=1 for HASP present or 0 no HASP), the seed is only relevant to HaspCode() (service 2).

Regards

CrackZ.
dive2code
01-22-2005, 07:12 AM
Hi CrackZ,

Yes, the seed code is not meaningful for service1.

And emulating was no problem.

But I am wondering the seed code is still 'zero' value with service2 in this target.

cmp bh,32
jb short 0040C9FF
mov esi,dword ptr [ebp+28]
mov eax,dword ptr [esi]
mov esi,dword ptr [ebp+20]
mov esi,dword ptr [esi]
push ebp
call 0040C0BD -==> ax 0x0
-==> bx 0x0201
-==> cx 0x7882
-==> dx 0x20CE

I want to know why the seed code is still 'zero' in service2,

and the meaning of bl.

( the 2nd question may be solved by myself with reference in the web :P )
CrackZ
01-22-2005, 07:49 AM
Hiya,

I don't see the problem, the seed code can range 0x0-0xFFFF, so 0x0 is a perfectly valid query. If I remember rightly BL holds the LPT number.

Regards

CrackZ.
dive2code
01-22-2005, 02:17 PM
Thanks a lot CrackZ ;)


windev and api's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > windev and api's
PDA

View Full Version : windev and api's

gentilevil
01-19-2005, 05:22 PM
hello
i am working on windev and a igot some problem , it's different from visyal c++ and other programming language .
i am looking for some information about it's structure and how it call the API's .
and i want to know if it's structure of PE is the same as other programs?


Any Germans looking for a cool job? ;-)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Any Germans looking for a cool job? ;-)
PDA

View Full Version : Any Germans looking for a cool job? ;-)

dELTA
01-20-2005, 05:40 AM
http://yro.slashdot.org/article.pl?sid=05/01/19/0021255

:)
CluelessNoob
01-20-2005, 08:07 AM
after it became obvious that copy protections would not only annoy teenage school boys

Isn't that what all copy protection is for afterall?

:D
JMI
01-20-2005, 09:56 AM
Well we wouldn't want German youth to become "constricted" from lack of access to "German Federation of the Phonographic Industry" materials, now would we. :eek: Or did they misspell that and it was supposed to be "German Federation of the Pornographic Industry"? :idea:

Regards,
Woodmann
01-20-2005, 04:06 PM
Howdy,

I read an article about a company near me that has produced a one time use dvd. They claim it will physically self destruct after one use.

Woodmann
nikolatesla20
01-20-2005, 06:52 PM
Fortunately that one use was me ripping it on to the computer :devil:

-nt20
Woodmann
01-20-2005, 07:40 PM
You kick ass :yay:

Woodmann
naides
01-21-2005, 06:32 AM
Now, that is a killer sales strategy. . .
From now on I will only buy these single use DVDs.

If there was a single little problem with the install process. . . Fuck! you lose
Silver
01-21-2005, 06:43 AM
See, using stuff that "physically self destructs" whilst inside my very expensive laptop is never going to give me much confidence. Maybe you'll have to remove your DVD drive, open it and shake it upside down over a trashcan to get all the little 1's and 0's out every few weeks. Just like you have to do with toasters and the bits of toast that get stuck on the bottom.


Multiple same hardware issue in programming
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Multiple same hardware issue in programming
PDA

View Full Version : Multiple same hardware issue in programming

Flopik
01-20-2005, 09:13 AM
just want to know if Windows use the same driver if the exact hardware exist on the machine ? Because i have problem when im trying to capture audio from 3 PCI card from the same compagny. If the card are from different vendor it's ok. The same problem with usb material.
nikolatesla20
01-20-2005, 06:49 PM
Well, I'm not sure about USB but PCI uses a GUID ID for every device, so whatever driver windows sees that matches that GUID, it will probably use, but most likely it will try to use signed drivers first.

-nt20
Mostek
01-25-2005, 05:42 AM
It all depends how you have set up your inf file.

If all devices use the same driver windows will use the same driver(even in the same address space) for every one of the cards. So this means that your driver must be capable of handling multiple cards at the same time.
This is normally done so that you allocate class memory and do everything with that class pointer which is then saved in some kind of bag that M$ driver type supplies you.
But you can also set a global variable that contains pointers to this classes.
Anyway the first way is the right way, but if you will also write an ASIO driver you will have to use the second way.

Anyway which driver type are you using (portClass, AVStream)?
In a few months I'll publish a whole AVStream + ASIO driver source so if you want it now to check how some things are done just say so.

Peace
Mostek
Flopik
01-25-2005, 08:37 AM
Thanks for the reply.
But I havent code the driver at all , im using the manufacturer driver or the windows drivers for the soundcards. Im not playing in the kernel lands. I using API in usermode.
Mostek
01-25-2005, 09:35 AM
From that point of view as nikolatesla20 said a GUID represents every stereo channel you want to access. Now if the driver is written in multiple cards support mode is another thing -> normally the 1st version of multicard system is used so the driver it self doesn't know it's supporting multiple cards at once -> it's like every card has it's own driver.

If you have problems with multiple cards maybe it would be good to contact vendor and ask if they support multiple cards in system.

Peace
Mostek
Flopik
01-25-2005, 09:45 AM
Is kinda weird because the card work alone but not when im trying to use both card in the same time. My program work when the card are different , so is why im asking about multiple same hardware issue with drivers.
Mostek
01-25-2005, 09:58 AM
Well it's time to contact the card creators. :)

For my part it's strange that the driver doesn't support multiple cards in the same system as this is one of the initial requirements.

Anyway what are you working on?

Peace and good luck
Mostek
Flopik
01-25-2005, 10:51 AM
A projet about localisation with 3 microphones using triangulation. So i need 3 soundcards. I catching the sound at the same time on each card and take the distance etc.
Mostek
01-25-2005, 04:13 PM
Cool. :)
Flopik
01-28-2005, 03:32 PM
Im pretty sure is related to Windows drivers somewhere and is not the fault of the driver.


softice 4.o5 winnt and XP
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > softice 4.o5 winnt and XP
PDA

View Full Version : softice 4.o5 winnt and XP

bestobest
01-20-2005, 06:02 PM
Hi all found a nice patch for softice, it work beautiful, for those interested visit hxxp://www.ech2004.net/tools.htm

enjoy


+Splaj Awave tutorial revisited.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > +Splaj Awave tutorial revisited.
PDA

View Full Version : +Splaj Awave tutorial revisited.

WaxfordSqueers
01-21-2005, 04:15 AM
Howdy,

I decided to try +Splaj's Awave tute because I'm setting up Ice 4.3.1 on XP Sp2 and wanted to put it through it's paces. Much to my chagrin, it seems Alexey has been hard at work with a different revision. :)

I tried the BPX on GetVersion but only got the program coming up. I didn't know if it was Ice's breakpoints not sticking, or what. I finally got one to stick on IsDebuggerPresent. But I couldn't F12 out of the call because SXS.dll was being ornery.

New strategy. I changed the file attributes to F0000060 and loaded via symbol loader and it broke at the program entry point. IDA could not make hide nor hair of it, though, on disassembly due to copious amounts of SMC. Then I tried GetVersion, but no luck. I got a messagebox telling me my file was corrupted. After many bright ideas, I decided to go cold turkey and trace in.

I've looked in the memory image PE header to see if i could change my file attributes back after loading with ice loader. I can't seem to find them. I wonder if Alexey hid them till the file's nearly loaded?

Got to a point where there are about 6 calls in a row, I mean one after the other. The message box always showed up in the last one. Took me a long time to see what it was. Alexey's pretty smart. He set up the following statement:

XOR [EAX], EAX

which causes an exception, because [EAX] is -1 and EAX is 0. I don't know why, but it does a good job. There's about 10 of these little beauties that I've found and all are buried in self modifying code.

My first problem comes when I inadvertantly hit an exception and the message box shows up. I have to reload from scratch and NOP each XOR statement in memory. Is there a better way out of these exceptions? I have tried tracing through them and F12ing out, but I always crash.

I feel that I'm pretty close to paydirt, but my latest crash is not an obvious exception. I'm at the point after the code is decompressed and loaded, and something is happening with respect to to the path and file name. I'm using Iceext and the IsDebuggerPresent doesn't seem to see it. So, I'm thinking it's a flag issue because there's no XOR's around. There are a couple of CMP's I need to check.

BTW...I found the group of imports +Splaj mentioned but they're not near where he said they'd be. When I try his search trick, about a couple dozen POPADS show up. I'm thinking Alexey may have seeded them. Also, he's built XOR exception producers around the imports, like land mines. It's getting dangerous to trace through the dark code woods.

For the longest time, I've tried to understand how to convert 8xxxxxxx numbers to the 04xxxxxx equivalent. I've read a lot on descriptors, and understand the segmentation pretty decently with the selector and offset, but the conversion still eludes me. Could one of you gurus say something about it?

For example, when I do the search, the results come back as something like 28:83579230. How do I convert that into the selector:offset like cs:eip.

thanks
doug
01-21-2005, 08:02 AM
First, when you reach a breakpoint, you can always set another breakpoint on the return address (bpx *esp). I don't know the details of why you can't keep on tracing (did you try F11 / G @SS:ESP when you are at the first instruction of the API?), but if you do the return address bpx, you'll be able to continue tracing after IsDebuggerPresent.

Simply NOP'ing out the exceptions will not work if useful work is being done inside the exception handler. Check what exception handler is being installed before these exceptions occur (tip: look for instructions dealing with fs segment).
WaxfordSqueers
01-21-2005, 09:31 AM
First, when you reach a breakpoint, you can always set another breakpoint on the return address (bpx *esp). I don't know the details of why you can't keep on tracing (did you try F11 / G @SS:ESP when you are at the first instruction of the API?), but if you do the return address bpx, you'll be able to continue tracing after IsDebuggerPresent.

Hey Doug. My problem is that I'm tracing through Asprotect wrapper code. There aren't any breakpoints to speak of, and when you get close to paydirt, Alexey has the good BP's protected with exception traps. So, if I use the GetVersion BP suggested by +Splaj, I get hit by several exceptions before the BP triggers. The exceptions are calling the messagebox with an error message, and that's probably because I altered the PE header to make the file executable.

If I don't alter the the file attributes, it wont break on anything. That's where i need advice from you more-senior types. :)

I'm wondering if the exceptions are re-entrant. I'm used to kernel32 tracing, and what you'd see there is a call to K32, and a subsequent call back into the calling code from the K32 call. I've tried to trace into the exception code, but I get BSOD's, or hit by the message box. I'm thinking the message box must belong to Awave, so the exception is probably calling it along the way.

I have read through the softice manual many times, and looked through the archives, but I'm still foggy on the more advanced use of BP's. I've been using F12 to force a return from a call, but I use <T> <Enter> and <P> <Enter> for single-stepping and jumping over functions. I guess the next thing is to get serious with those, but I have so many things to refresh and learn I find it hard knowing where to spend my time.

I'm very comfortable with BMSG and BPX, and I've used BPR and BPM extensively. You got me there with the F11 / G @SS:ESP, so instead of hypothesizing, I'll go have a read. The BPX *ESP is a good idea and I'll need to check that out. Thanks.

The obvious thing is that normal code execution isn't bothered by the bad code. So, it must be throwing an exception and having control returned after the exception. In my case, though, because I altered the PE file, it's diverting me to the Awave message box. I have no idea where that is happening, or how to attack it.

Simply NOP'ing out the exceptions will not work if useful work is being done inside the exception handler. Check what exception handler is being installed before these exceptions occur (tip: look for instructions dealing with fs segment).

I'll check the fs segment thingy. Thanks.

The NOPing gets me past the bad code statement. I was thinking about the problem, and an XOR needs positive logic. You need a +1 or 0. If you give it a -1, it goes, "Hmmmm??!!". If I don't NOP it, I'd need to trace into every exception. But what you've said indicates I need to read more on exceptions.

I was reading the Intel 1 manual, and on the first pages, they define an exception as mainly a fault due to a bad instruction. What we're seeing with the SEH seems to be an improvised fault based on software. That kind of threw me, being a computer tech, because I tend to think of exceptions like interrupts, which they are. But they're controlled interrupts in that sense. Any other interrupt I know of is more decisive, whereas the SEH's are a more forgiving type.
crUsAdEr
01-21-2005, 04:21 PM
Hi,

The way to avoid except all together is
faults off

:) it is in softice manual...

However while tracing if you happen to encounter a
xor [eax], eax
trap in asprotect, do NOT NOP it since asprotect CRC check will generate an error...
the way to skip over it is
r eip eip+2

the best way to understand how aspr seh works is do dump the asprotect.dll file, how to dump it :)? well i suppose a few tutorial search wont hurt ya...
WaxfordSqueers
01-21-2005, 05:42 PM
Hi, The way to avoid except all together is faults off
:) it is in softice manual...

Thanks for reply. I'm fairly decent with Sice all around, but I just have to bear down and learn those grey areas. I read a lot about SEH's today, especially Jeremy Gordon's treatise. It didn't make much sense till I tackled Asprotect. Also, I just happened to read about the 'faults off' today as well.

However while tracing if you happen to encounter a xor [eax], eax
trap in asprotect, do NOT NOP it since asprotect CRC check will generate an error...the way to skip over it is r eip eip+2

thanks for that one. That's probably the error I'm encountering near the end.
The only way i seem to be able to get in using XP is to set the flags to E0000060. I left the 6 in there because LordPE had it set already. I've been setting the flags back to C0000040 in the PE section of the memory image, but i wonder if it's too late by then.

the best way to understand how aspr seh works is do dump the asprotect.dll file, how to dump it :)? well i suppose a few tutorial search wont hurt ya...

I've read so many tutes and forum posts the past few days that my eyes are like two pee holes in the snow. My head hurts. :) In fact, I was reading one of your threads from 2002 in which you were talking about SEH's and a loader. I saw another from Clandestiny in which he was talking about writing a tute on SEH's, but I haven't come across it yet.

NicolasTesla seems to have a good grasp on them. It would be nice if he wrote a tute on SEH's (hint, hint). :D
crUsAdEr
01-21-2005, 06:04 PM
3. AsProtect.dll seh tricks

Here is how a typical seh is set up in AsProtect and you will know that seh is used not less than 30 times in this dll. It used to stop newbies like me from tracing AsProtect code but not anymore once you understand what is going on. Before you read this, please read some essential information about seh (I suggest Jeremy Gordon's excellent paper on seh).

004106B2 E8 49 C6 FF FF call Clear_API_emu_code ; upper limit
004106B7 E8 25 00 00 00 call set_seh_3
004106BC
004106BC seh_3_handler: ;
004106BC 8B 44 24 0C mov eax, [esp+0Ch] ; get context to eax
004106C0 83 80 B8 00 00 00+ add dword ptr [eax+0B8h], 2 ; add context.eip by 2
004106C7 51 push ecx
004106C8 31 C9 xor ecx, ecx
004106CA 89 48 04 mov [eax+4], ecx ; clear debug register 0
004106CD 89 48 08 mov [eax+8], ecx ; clear debug register 1
004106D0 89 48 0C mov [eax+0Ch], ecx ; clear debug register 2
004106D3 89 48 10 mov [eax+10h], ecx ; clear debug register 3
004106D6 C7 40 18 55 01 00+ mov dword ptr [eax+18h], 155h ; context.dr7 := 155
004106DD 59 pop ecx
004106DE 31 C0 xor eax, eax ; exception handled, continue
004106E0 C3 retn
004106E0 set_seh_1 endp ; sp = 4
004106E1
004106E1 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
004106E1
004106E1 set_seh_3 proc near ; CODE XREF: set_seh_1+25p
004106E1 31 C0 xor eax, eax
004106E3 64 FF 30 push dword ptr fs:[eax] ; set up seh 3
004106E6 64 89 20 mov fs:[eax], esp
004106E9 31 00 xor [eax], eax ; cause seh 3
004106E9 ; this seh clear debug register
004106EB 64 8F 05 00 00 00+ pop large dword ptr fs:0 ; remove seh struc
004106F2 58 pop eax
004106F3 E8 CC 1F FF FF call @System@Randomize$qqrv ; System::Randomize(void)

The seh is set up in a slightly different way which makes it harder to detect but with IDA everything becomes very clear!

004106B7 call set_seh_3 ; this is equivalent to push handler and move eip to 4106E1 same as

; push 4106BC (our seh handler)

004106E1 xor eax, eax
004106E3 push dword ptr fs:[eax] ; set up seh 3
004106E6 mov fs:[eax], esp
004106E9 xor [eax], eax ; cause seh 3
004106E9 ; this seh clear debug register
004106EB pop large dword ptr fs:0 ; remove seh struc
004106F2 pop eax
Thus when we trace over 4106E9, the seh is triggered and our context is retrieved to eax, where eip is adjusted by increasing it by 2 to point to the next working instruction, also debug registers are cleared the same way. (this is posted by R!sc before)

This is interesting indeed! For example when you are tracing and you are at 4106B7, if you trace into with F8 you will meet the faulty instruction at 4106E9 and be lost in kernel seh code! if you trace over with F10, sice will place a break point at the next instruction which happen to be the seh handler and then you will soon meet the "ret" at 4106E0 and again you will be lost in seh kernel code! Now that we know how this whole seh scheme works, we can trace anywhere we want, simply do a "r eip eip+2" at the faulty instruction and seh handler will be skipped altogether!

Lol, dig out some old notes for you :)
WaxfordSqueers
01-21-2005, 10:01 PM
[code] 3. AsProtect.dll seh tricks

Thanks Crusader. I just found your full essay, and it's pretty impressive. It's amazing how you dumped that dll and pieced it together again with a spare Delphi header you had lying around. :)

It will take me quite a while to digest what you're saying. I have seen some of those routines as I traced through the app. I made the mistake of not approaching it with a fresh mind. I had done a Petit unpack a while back and this app reminded me a lot of that. So, I kind of ignored all the unpacking with the intention of getting to the other side of it.

That was my downfall. I was looking for a nice clean 'test eax, eax' and a jump to paydirt. I couldn't figure out how I was ending up in SEH-ville. I did find the imports listed by you and +Splaj, and I also found a structure of large numbers that looked like they could have been keys. They were all being moved at once with individual MOV instructions, and whereas some seemed random in order, others were straight, like 01234567, or 89ABCDEF.

What happened to Damien's site? Was it anticrack.de? I was interested in what you said in your essay about his papers on anti-debugging.
WaxfordSqueers
01-29-2005, 06:30 PM
First, when you reach a breakpoint, you can always set another breakpoint on the return address (bpx *esp). I don't know the details of why you can't keep on tracing (did you try F11 / G @SS:ESP when you are at the first instruction of the API?), but if you do the return address bpx, you'll be able to continue tracing after IsDebuggerPresent.

I don't know if you'll see this Doug, but I've done a fair bit more since you replied. I've tried what you suggested above but the app doesn't like the use of F11. I can sometimes use the G [address] instruction to send it over an exception, but things get tricky once I'm inside. Also, I can reach addresses using the G [address] from the code entry point. The G instruction happily jumps over the exceptions.

Basically all they are doing in some exceptions is setting up the handler and issuing one bad instruction, XOR [EAX], EAX. That send it to the system exception handler. There is obviously a point in there where the system sends it back to the app handler, and it seems that handler is wiping out any breakpoints that are set.

I've tried single-stepping through the system code and got to watch a BSOD forming. It's kind of neat when you see the INT 3 then the blue screen. Doesn't seem as formidable that way. I'd like to know how to get to the app handler while it's executing. I'm still a bit fuzzy on what I can do regarding single-stepping and setting breakpoints.

The code below is typical of the exceptions, and the XOR statement is used 31 times throughout the app. Of course, it's all SMC....note the CD 20 at 40F383 and the jmp before it. Also the data byte at 40F38A.

I recognize the PUSH at 40F385 as the beginning of the exception, but I'm still not clear as to what it does. According to Jeremy Gordon, assuming they are using a per threadhandler, "A per-thread handler is installed at run-time and is pointed to by the first dword in the Thread Information Block whose address is at FS:[0]". In the code below, EAX = 0, therefore it is FS:0, and the value being pushed should be both the TIB address and the address of the handler.

My understanding is that once the bad instruction is hit, it should flag an exception and the system should examine it and call the app handler. It seems to me, however, things get complicated due to the use of breakpoints and/or single-stepping. I can jump over the exception using G [address], but I can't using F11. F12 (P ret) used in the exception causes a BSOD. Also, if I set any breakpoint before the first exception, it gets wiped out.

40F37F 31 C0 xor eax, eax
40F381 EB 02 jmp short loc_40F385
40F381 ; ---------------------------------------
40F383 CD 20 db 0CDh, 20h
40F385 ; ---------------------------------------
40F385
40F385 loc_40F385:
40F385 64 FF 30 push dword ptr fs:[eax]
40F388 EB 01 jmp short loc_40F38B
40F388 ; ----------------------------------------
40F38A E9 db 0E9h
40F38B ; ----------------------------------------
40F38B
40F38B loc_40F38B:
40F38B 64 89 20 mov fs:[eax], esp
40F38E 31 00 xor [eax], eax
40F390 EB 01 jmp short loc_40F393

Simply NOP'ing out the exceptions will not work if useful work is being done inside the exception handler. Check what exception handler is being installed before these exceptions occur (tip: look for instructions dealing with fs segment).

Crusader suggested r eip eip+2 which I have used since. Maneuvering through the code becomes tricky because there are 31 exceptions alone using the bad XOR instruction.

I've already unassembled the handler code in softice and I see the RtlUnwind at the end of it. But I can't see what the registers say. I'd like to reach that code as it's executing. A thought just occured to me. Maybe I'll try the G [address] on it. Hmmmm.
doug
01-30-2005, 11:01 AM
You are missing an instruction that places the exception handler on the stack.
Remember that exceptions are chained. If the top exception doesn't handle the fault, there might be another exception handler that can. The instructions that you see, are building this chain.

Usually this is what you have:

push offset Handler
push fs:[0]
mov fs:[0], esp

Before single stepping over the exception, you can check what exception handler will execute first, and bpx it.
? *(fs:0)
u cs:esp->4 // don't forget that softice remembers the last segment prefix
// d cs:esp->0 would show you the next exception handler 'block'
// and u cs:esp->0->4 would list the next exception handler code.

Crusader suggested r eip eip+2 which I have used since. Maneuvering through the code becomes tricky because there are 31 exceptions alone using the bad XOR instruction.

This will only work if:
(1) The exception handler doesnt do anything useful. Some protections use exception handlers as part of the protection (i.e: they put some decryption in there)
(2) The exception handler was going to return immediately after the instruction that caused the exception. It's not uncommon to see protections use exceptions as redirection mechanism.

What I mean here, is you should really inspect the exception handler before deciding what you do.

You might also be interested in http://www.woodmann.com/forum/showthread.php?t=5022 for both the debug register access & how windows dispatches exceptions. (hint: nice place to hook)

I'm not a big ollydbg user myself, but I think it allows you to skip these exceptions?
blabberer
01-31-2005, 04:28 AM
ollydbg can skip all exceptions to the handler
all you need to do is go to debug option --> (ctrl+o) exception and check mark the
exception you want olly to skip to the original handler

also if there are custom exceptions generated like
exception DeadCafe,BeefBabe,badbabe2,ace1ace1
you can use add last exception and olly will happily skip them too :)

anyway if you are interested in breaking on all and sundry exceptions but dont want to set a break in the executable load the symbols for ntdll.dll
and
set a break here
CALL ntdll.RtlpExecuteHandlerForException

if you single step into this call you will see a call near ecx which invaribaly
always calls the exception handler :)

if you are using ollydbg you can press enter and follow there and study the handler for its actions without stepping there
if you are not interested in looking at the handler but just wish to know where the handler lies so that you will dead list the location later
you can set a conditional breakpoint which logs the ecx in these cases

Log data
Address Message
00401002 Access violation when writing to [00000000]
77F92536 COND: 77EA13FD
77F92538 Breakpoint at ntdll.77F92538

the seh chain in my case
SEH chain of main thread
Address SE handler
0012FC30 ntdll.77F8A896
0012FFE0 KERNEL32._except_handler3 (here this is what is called now by 77ea13fd)

77EA13FD KERNEL32._except_handler3 $ 55 PUSH EBP ; Structured exception handler
WaxfordSqueers
02-03-2005, 12:10 AM
You are missing an instruction that places the exception handler on the stack.

Sorry for delay in replying. I checked out what you're saying, and there are back to back routines. The first routine is set up exactly as I indicated, with no handler address. The second one does have the handler. Thanks for pointing that out.

I was getting irritated by my lack of progress so I decided to brute force it to the OEP. After a while I began to see a pattern using P ret and it became like a game in which you crash and have to restart. Anyway, I came out of this fogbank of crypted SMC and there it was. I nearly ran right past it. Essentially, I've traced from the program entry point to the OEP of the protected app, using a divide and conquer approach. I had to keep reminding myself that the app will run properly on it's own, exceptions and all, so it should be possible to trace it.

So, I've been busy dumping, pasting , making IAT's and tweaking. Besides, the trial version was running out of time and I needed to get the wrapper removed. I'll get back to the SEH's a little later. I did go back and retrace the IAT formation, but I understand from an essay by AndreaGeddon that what I thought was the IAT is just a bridge, as he calls it, and the real IAT is further along. That's a project for another day. Meanwhile, I used Revirgin for my IAT.

This should probably be a new thread, but I'm having trouble with the unwrapped app. It starts fine with symbol loader, and I can trace through the initialization code, but it crashes abruptly on a very innocent looking statement, something like MOV AL, [ESI]. ESI points to an address in the rsrc section but nothing is there. It seems to be an illegal memory access (full of ??? characters) and generates a C0000005 exception. I can jump over it and carry on, perhaps stupidly, but it is the memory access to resources that is the issue and several crashes follow that one.

I have double checked my PE header in Lord PE and manually. I find that Lord PE sometimes doesn't save when you press 'Save'. IDA seems to approve since it's created a beautiful .idata section which used to have only 5 imports. And it lists all the sections in the right place.

I have to do more research, but I thought I'd mention it just in case you've come across that. I'm not clear on the subject of relocations, for example. I was under the impression you're supposed to wipe them out after a dump. Also, some of the imports may have been switched. Alexey is a clever guy.

Before single stepping over the exception, you can check what exception handler will execute first, and bpx it.
I tried that Doug, but it wont take. They seem to be doing something in the handler to clear off BPX and BPM. The only function I can use is the G address, but even it wont take inside the exception handler. Unless, of course, I'm feeding it the wrong address. I need to go back sometime and trace into the system handler.

Ding, Ding!! Bells go off. I changed contexts going into the system handler, didn't I, he says as he smacks himself up the side of his hard hat? Doesn't eveybody wear a hard hat while reversing?? The new version of softice doesn't like that. I recall reading of a way to turn that off.

You might also be interested in http://www.woodmann.com/forum/showthread.php?t=5022 for both the debug register access & how windows dispatches exceptions. (hint: nice place to hook)
I checked that out earlier and tried using the accompanying exe file. It doesn't crash or anything, but I think it might have issues with Iceext. Don't quote me on that, but something froze up till I shut down Yates' app. I will investigate further, but he may have written it for an earlier version of softice.
WaxfordSqueers
02-03-2005, 12:20 AM
ollydbg can skip all exceptions to the handler
Sorry for delay in replying. I'm a bit of a masochist...I like tracing through places I'm not supposed to be. I was getting quite intimate with K32 till they changed it on me for XP. I appreciate that feature in Olly but I like to see how things tick.
anyway if you are interested in breaking on all and sundry exceptions but dont want to set a break in the executable load the symbols for ntdll.dll
and set a break here CALL ntdll.RtlpExecuteHandlerForException
yeah...thanks for that tip...I'll give it a go. I'm going to trace right through it one day, system and all. I have no idea what to look for at this point with respect to flags, however. XP specializes in the BSOD if you don't treat it nice.if you single step into this call you will see a call near ecx which invaribaly always calls the exception handler :)nice to know what to look for in advance...thanks. Thanks for the rest of your info too...I'll check it all out.


windbg final 6.4.7.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > windbg final 6.4.7.2
PDA

View Full Version : windbg final 6.4.7.2

0rp
01-23-2005, 06:11 PM
http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx
Kayaker
01-23-2005, 08:47 PM
Wha.., just released too, do you get MS's internal newsletter or something to inform you of these breaking updates? :D
Thanks for the heads up.
0rp
01-24-2005, 08:05 AM
hehe, no, i'm just reading microsoft.public.windbg


DLL used by VB Application for Object Type
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DLL used by VB Application for Object Type
PDA

View Full Version : DLL used by VB Application for Object Type

peterg70
01-24-2005, 05:52 AM
I have an application that uses a DLL (C++ compiled) which provides a Object type

The program is in VB6 and using the following code I can insert the Evaulation License and Username and the KeyIsValid returns True.
i.e.

Private Sub SubmitLicenseBtn_Click()

Dim Licensecheck As Object
Set Licensecheck = DLL.ServerManager
Licensecheck.LicenseKey = "0000-0000-0000-0000"
If Not Licensecheck.KeyIsValid Then
MsgBox Licensecheck.KeyStatus, vbExclamation, "License Check"
End If
LicenseStatus.Text = Licensecheck.KeyStatus
Set Licensecheck = Nothing

End Sub

Where DLL.ServerManager has the following variables
KeyIsValid
KeyStatus
UserName
LicenseKey

But the problem I am having is how to intercept the functions in the DLL that are performing the License Checks.They are not listed via the view Names Functions.

Brute forcing doesn't help as the username forms part of the license check and I need to examine the routine. to determine where the check sum is before Bruteforcing it.

Any thoughts appreciated.
dELTA
01-24-2005, 06:34 AM
I'm not sure what you're saying here, is the problem that you want to find a good breakpoint for a method of a COM-object in a DLL? I remember there should be some threads about it on this board already in that case. And what are there "view names functions" that you mention?
bilbo
01-24-2005, 11:06 AM
If dELTA hypothesis is correct (you want to dive yourself in some ActiveX secrets) you can always follow this approach:

(1) get a trace of the called methods:
http://www.kogosoft.com/olespy.htm OR
http://staff.develop.com/jasonw/comspy/

(2) obtain the addresses of the called methods inside the DLL:
http://www.microsoft.com/msj/0399/comtype/comtype.aspx

(3) play with breakpoints and assembly code

All the links are very old, but yet useful...

Regards, bilbo
babar0ga
01-24-2005, 04:41 PM
(2) obtain the addresses of the called methods inside the DLL:
http://www.microsoft.com/msj/0399/comtype/comtype.aspx

Yes, great nfo there...
I must add that with VS 6 there is TLBINF32.DLL installed on the system which can provide even more useful info about type libraries...
bilbo
01-25-2005, 07:19 AM
Yup, babar0ga,

"You learn something new every day", as said Kayaker in another thread... (even if it is not completely true that TLBINF32.DLL can provide MORE info on type libraries: it just offers other interfaces to get the info).

By the way, the same code in MSJ magazine has been reused by Dieter Spaar in his COM Interface Plugin for IDA (02/11/2002):
http://www.datarescue.com/freefiles/com_plugin_V1_21.zip

Regards, bilbo


patching pocketpc smartphone apps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > patching pocketpc smartphone apps
PDA

View Full Version : patching pocketpc smartphone apps

Shub-nigurrath
01-24-2005, 11:46 AM
While patching apps is feasible, using IDA, running apps is not for me.

To my knowledge, only apps signed by Microsoft can run. Since patched applications differs from signed apps they will not run on the smartphone.

I read that depending on the device and service provider, you may be able to get it application unlocked (so it will run unsigned apps) by your service provider. For example Orange unlock it via their website.

But I also read that the signed application running check can be patched also. Is it true? How can I run patched apps on a restricted smartphone, without involving the provider?

10x in advance!


DConsoleapplication?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DConsoleapplication?
PDA

View Full Version : DConsoleapplication?

venom925
01-24-2005, 10:27 PM
I recently tried to use DeDe to work out a crack me but I came across a small problem. When I hit Process I get "DConsoleapplication compiled with runtime packages found !". Then I get nothing, no forms, no code. So I guess what I'm asking is, is there some sort of anti DeDe code I should look for? I have searched here , google, and dare I say it even Yahoo :eek: All point to nothing. Can anybody offer any help with this?
Formal
01-25-2005, 01:02 AM
You get no forms, as the application is Delphi console application - that means it uses the console and it has NO forms. The RTTI is also not available for this kind of application. 'Compiled with runtime packages' means that the VCL it uses is not included in the executable, but is expected to be found in the .dll search path. Can you run the application? If you can, this is an indication that you have those DLL-s (they are with extension .bpl). DeDe is designed to be run upon Delphi GUI Applications, so it might be better to use generic disassembler in this case.
Kayaker
01-25-2005, 01:03 AM
Hi

You could check in a hex editor to see if the "TPF0" header is missing from the RCDATA resources.

In Delphi, an Rcdata resource normally begins with "TPF0"

0004E3E8 54 50 46 30 06 54 46 6F 72 6D 31 05 46 6F 72 6D TPF0.TForm1.Form

But this could be changed to 1234.TForm1.Form for example and the app will still run. DeDe of course is looking for "TPF0" and will not recognize the resource.

Also, the PackageInfo structure (which DeDe uses to get its Unit List), can also be modified. The app will run but DeDe misses in its analysis of it.

These little tricks came out a couple of years ago in response to a post about Asprotect. A search for "TPF0" (TPF-zero) will find the pertinent threads, if this is indeed the problem.

Kayaker
Kayaker
01-25-2005, 01:12 AM
You get no forms, as the application is Delphi console application - that means it uses the console and it has NO forms. DeDe is designed to be run upon Delphi GUI Applications, so it might be better to use generic disassembler in this case.

Oops, My explanation is apparently not valid in this case then. We posted at the same time, I never picked up on the significance of DConsoleapplication and forms. You learn something new every day. The tricks still could apply with a gui app though.


IDA Buffer Overflow Vulnerability
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA Buffer Overflow Vulnerability
PDA

View Full Version : IDA Buffer Overflow Vulnerability

ZaiRoN
01-25-2005, 05:12 AM
The title says all. All the details are here:
http://www.idefense.com/application/poi/display?id=189&type=vulnerabilities&flashstatus=true
Reading the page you will find a link for a temp patch.

Thanks to Zero for the news.

Regards,
ZaiRoN
dELTA
01-25-2005, 05:45 AM
Apparently W32Dasm has the same vulnerability too:

http://www.securityfocus.com/archive/1/388251
Bengaly
01-25-2005, 01:57 PM
ouch, i don't want that too..
so i added pvdasm a check on the import's length to avoid buffer Overflow Vulnerability.

about w32dasm.. a dead tool since ages.
IDA will have it fixed in the next release.
PEid as well.
and ofcourse PVDasm.

good day.
ZaiRoN
01-26-2005, 03:36 AM
Ida has the bug, windasm has the bug, peid has the bug, pvdasm has the bug... who copies who http://66.98.132.48/forum/images/smilies/tongue.gif
blabberer
01-26-2005, 05:38 AM
so doesnt olly have it or does it only affect disassemblers and not debuggers or is oleh l33t :)
Bengaly
01-26-2005, 11:54 AM
ZaiRoN,
PVDasm HAD the bug! ;)
seems i am the only one who really cares bout his code ;)

who copies who
e.g:
well, i guess wsprintf(buffer,"%s",import->api_name);
is pretty obious for anyone who wanna retrieve the api name :)

about ollydbg,
if oleh used any string copy function to retrieve the api name without check the len of the api against the buffer, than yes, ollydbg has the same exploid just as any disasm around... also windbg,ida,win32dasm, (not pvdasm.. its bug free :P)


advanced Crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > advanced Crackme
PDA

View Full Version : advanced Crackme

XFlorian
01-25-2005, 05:43 AM
Hello! Here's a german Crackme. I want to know how to set the Breakpoint und how I calculate the serial rountine. Just rename the file from .jpg in .exe :)

http://mitglied.lycos.de/dbautozug/Crackme2.jpg

When you got the message "Wearscht......" you have cracked it.
evaluator
01-25-2005, 07:29 AM
that is shame VB6 crackme. learn about VB6 & go on.. search how to debug
bilbo
01-25-2005, 08:17 AM
Well, it's a native app (not P-coded), so it does not require special techniques and it is not so advanced as you said...

The initial breakpoint will be told you by some tool such as VBDE (search for VBDE085).
It will tell you that Command2_Click routine starts at RVA 002470: this means that the initial breakpoint must be put at address 0x402470.

Next you have to learn the API exported by the Visual Basic runtime (google for them).

Good luck, bilbo
XFlorian
01-26-2005, 07:40 AM
ok thanks. And how can I calculate the serial routine?
bilbo
01-26-2005, 08:46 AM
ok thanks. And how can I calculate the serial routine?
Do not ask for help without showing you made an effort. This includes asking *lameass* questions in the Newbies Forum.

Regards, bilbo
JMI
01-26-2005, 11:17 AM
Well said Master bilbo. :yay:

Regards,
blabberer
01-27-2005, 09:16 AM
seems to fail at __vbaR8Str() which calls
VarR8FromStr
Converts a variant of type OLECHAR* to double.

HRESULT VarR8FromStr(
OLECHAR * strIn,
LCID lcid,
unsigned long dwFlags,
double * pdblOut
);

DISP_E_TYPEMISMATCH return value

so stack is unwound and Msvbvm SehJumps to 0x402f00
the seh that is called doesnt seem to do some usefull work
well but i may be wrong is anyone looking at this crackme ??
bilbo
01-28-2005, 01:47 AM
blabberer,

sure enough if you try to convert a date string (in the format "1/27/2005" or "27/01/2005" depending on the nationality of your Windows) to a float you will generate an exception, due to the slashes used as separators...

but do not forget that they are Germans...
try to set a german-mode date...

you will get a string in the form "27012005": this makes sense, isn't it?

regards, bilbo
blabberer
01-28-2005, 02:28 AM
sure it would make sense bilbo :) i was thinking of memory modifying the result of getuserlcid() which returns 409 on my computer to some compatible result :) but before that i quickly changed my time setting to german time but still i saw it was returning it with / so i never went into control panel to change regional settings :) but posted my little quip above
any way thanks for clarifiaction :) but would you consider it a bug or not :)
bilbo
01-28-2005, 11:13 AM
but would you consider it a bug or not :)
well, after having seen evaluator's "cryptic" crackme (as you said) everything looks better... :D

best regards, bilbo
blabberer
01-28-2005, 11:29 AM
hehe i was commenting on his reply to the isDebuggerPresent cmp with 0 will return 0
i did not understand it and i didnt know if he meant i patch the kernel32.dll in w9x
and sure his cryptic crackme is for sure cryptic :) i passed the 7e8 still it wont run
so dropped looking at it for now :)


PEiD Buffer Overflow Vulnerability
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PEiD Buffer Overflow Vulnerability
PDA

View Full Version : PEiD Buffer Overflow Vulnerability

disavowed
01-25-2005, 11:10 AM
http://www.idefense.com/application/poi/display?id=189&type=vulnerabilities&flashstatus=true

(Same link as in http://www.woodmann.com/forum/showthread.php?t=6787, but thought it deserved a seperate post title for those on this board who use PEiD and not IDA)


How to unpack an ASProtected .dll?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > How to unpack an ASProtected .dll?
PDA

View Full Version : How to unpack an ASProtected .dll?

*RemedY*
01-25-2005, 04:05 PM
Hi there,

I´m pretty interested in unpacking stuff and managed to unpack some minor targets so far, but this time I´m faced with an .dll protected with:
ASProtect 1.2x - 1.3x [Registered] -> Alexey Solodovnikov
Strange enough the first section identifies itself as .aspack. Anyway, my question is more general. I would like to know, where to start unpacking an protected .dll. I use Olly and I tried with the loaddll-feature, but I got lost at once. I simply don´t know what to do with this .dll. I´ve unpacked ASProtect-Targets before but nevertheless don´t know what to do now. Is there any Tut on unpacking .dlls? Any help is greatly appreachiated.
Thanks a lot in advance.

Best regards *RemedY*
WaxfordSqueers
01-26-2005, 04:57 PM
Anyway, my question is more general. I would like to know, where to start unpacking an protected .dll.

your question is a little too general. There's a procedure here if you need help. Read the FAQ, then search the archives. You can even download them if you look at the bottom of this page.

What I did on my first protected 'exe' unpack, was to stop at the code entry point. It's the very first bytes the program executes before it initializes itself. You can get to it from the symbol loader in softice but don't know how in Olly. Then I started single-stepping and making scads of notes, listing the addresses of important instructions, loops, etc. After a while, you see a pattern and find ways to progress quickly.

With a dll I don't know because I've never seen a packed dll. If there is such an animal, I'm sure it's listed in the archives. If not, show you've done some work on it, and I'm sure someone will help you out.

The only way I can see doing a totally protected dll, is to watch for it being called from the running app. Then start tracing into it and watch how it is unpacked. You could first try disassembling it in IDA to see if that reveals anything.
*RemedY*
01-27-2005, 09:33 AM
Hi,

maybe you got me a little bit wrong. I did all the things like searching the forum before i posted my question but unfortunally I found nothing. I know the general behaviour one has to show to get an answer, but there is nothing I´m able to do with this .dll. I´m able to unpack normal ASProtected .exe-files, but -as I said- this is the first time I came across an packed .dll. This is was I did so far: I let Olly break on new .dlls and stepped into the target .dll - but after one single step [which is a mov eax,dword ptr ds:[xxxxxxxx] it leaves the .dll, steps into another and never come back. For me, there is no obvious reason, why it leaves this .dll. If I were able to do more with this .dll, I would have written it here. I need some general information regarding the procedure of unpacking an .dll.
I hope someone is willing to help me nevertheless.
Thanks a lot in advance.

Best regards *RemedY*


Need help figuring out code from unpacker.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Need help figuring out code from unpacker.
PDA

View Full Version : Need help figuring out code from unpacker.

WaxfordSqueers
01-25-2005, 07:23 PM
Howdy,

The code below comes from an Asprotect packed file. Values to the right of the <<<< signs was added by me based on the value in each register. It seems to be a check of some kind involving the CPUID instruction. I can follow it to a certain extent, but the following questions arise:

1)what is this piece of code doing? Upon return from the CPUID instruction, the AH, AL reg is manipulated to get 0F. That value is compared to 03 at 408B08, after the return. The return code is right below the main body. There's a branch there that I suspect is a good guy/bad guy thing.

2) Is there a way in softice to see the entire flag register?

It seems to me bit 21 on the flags reg is checked by way of an XOR to see if CPUID is supported. Also, bit 18 is checked for alignment. It's possible other flags are being manipulated that I can't see out of inexperience. It would be nice to watch them as it happened.

BTW...I have Iceext loaded (XP with SP2 and Ice 4.3.1) with full protection on. It does such a good job that even symbol loader can't find softice. :-) Setting byte one of the unhandledexceptionfilter code to 90, dynamically in memory, before Iceext loads, allows all the hiding features of Iceext to come on. It replaces the NOP with 68, but it doesn't seem to want to load that protection otherwise if Softice grabs it with a CC first.

3)there's a POPFD instruction at 408AC3 that adds the value in the stack to the value in the EAX register. How does that work? Before the POPFD, the EAX was 0x00000003. After the POPFD, it was 40206, and the POPFD value was 40202. Can POPFD add to a value in a register? I don't see that in any Intel literature. I can't see anything that would have altered the flags from the time they were pushed and re-popped, unless the XOR at 408ABA altered the parity and auxiliary flag, or something.

00408AA4 53 push ebx
00408AA5 51 push ecx
00408AA6 52 push edx
00408AA7 89 E3 mov ebx, esp
00408AA9 83 E4 FC and esp, 0FFFFFFFCh
00408AAC 9C pushfd <<<<<<<<00000202
00408AAD 9C pushfd <<<<<<<<00000202
00408AAE 58 pop eax <<<<<00000202
00408AAF 89 C1 mov ecx, eax <<<<ECX= 00000202
00408AB1 35 00 00 04 00 xor eax, 40000h <<<0040202
00408AB6 50 push eax <<<<0040202
00408AB7 9D popfd
00408AB8 9C pushfd
00408AB9 58 pop eax <<<<40202
00408ABA 31 C8 xor eax, ecx <<<EAX=40000 after the XOR
00408ABC B8 03 00 00 00 mov eax, 3 <<<EAX = 00000003
00408AC1 74 24 jz short loc_408AE7
00408AC3 9C pushfd
00408AC4 58 pop eax <<<<0040206
00408AC5 89 C1 mov ecx, eax
00408AC7 35 00 00 20 00 xor eax, 200000 <<<<240206h
00408ACC 50 push eax <<<<240206
00408ACD 9D popfd
00408ACE 9C pushfd
00408ACF 58 pop eax <<<<204026
00408AD0 31 C8 xor eax, ecx <<<EAX=200000 (ECX was 40206)
00408AD2 B8 04 00 00 00 mov eax, 4 <<<EAX=4
00408AD7 74 0E jz short loc_408AE7
00408AD9 53 push ebx <<<<12FF68
00408ADA B8 01 00 00 00 mov eax, 1
00408ADF 0F A2 cpuid <<<<ret EAX=F27; EBX=1080A;
ECX=4400;EDX=BFEBFBFF

00408AE1 88 E0 mov al, ah <<<eax=0000000F
00408AE3 83 E0 0F and eax, 0Fh
00408AE6 5B pop ebx
00408AE7
00408AE7 loc_408AE7:
00408AE7 ; sub_408AA4+33j
00408AE7 9D popfd
00408AE8 89 DC mov esp, ebx
00408AEA 5A pop edx
00408AEB 59 pop ecx
00408AEC 5B pop ebx
00408AED C3 retn to 408B03

00408B03 mov ds:dword_413098, eax
00408B08 cmp ds:dword_413098, 3 <<<<<cmp F to 3.
00408B0F jle short loc_408B26
00408B11 mov ds:dword_413090, offset loc_4046B8
00408B1B mov ds:dword_413094, offset loc_4046D8
00408B25 C3 retn
WaxfordSqueers
01-25-2005, 09:51 PM
1)what is this piece of code doing? Upon return from the CPUID instruction, the AH, AL reg is manipulated to get 0F. That value is compared to 03 at 408B08, after the return. The return code is right below the main body. There's a branch there that I suspect is a good guy/bad guy thing.

Kind of bad when I answer my own question. :)

Crusader advised that people read through the Asprotect dll he went to so much trouble to create. I finally did and see now that the code above comes early near the initialization part of the dll. So, it may be legit. If one of you code gurus has the time or inclination, could you have a peek at it anyway to confirm that it's harmless? I'm getting paranoid about SEH's and anti-ice tricks.

I wouldn't mind an answer to the POPFD mystery and to whether there's more info available on the hidden flags in softice.

If this is taking up too much room, please delete it. And thanks again Crusader for all your work on Asprotect.
upb
01-26-2005, 12:56 AM
the pushfd \ pop \ xor \ push \popfd sequences flip a flag each time.
but im not @ home atm so check the intel manual about the structure of EFLAGS register to find out what flags it is flipping.
hope this helps.
bilbo
01-26-2005, 02:41 AM
Hi, WaxfordSqueers,

I finally did and see now that the code above comes early near the initialization part of the dll. So, it may be legit.

You got it!
The code simply checks for the Processor family. Look!

; save registers on stack
00408AA4 53 push ebx
00408AA5 51 push ecx
00408AA6 52 push edx

; save stack pointer into EBX
00408AA7 89 E3 mov ebx, esp

; align stack pointer to long (not necessary IMHO: already aligned!)
00408AA9 83 E4 FC and esp, 0FFFFFFFCh

; save EFLAGS on stack
00408AAC 9C pushfd <<<<<<<<00000202

; 386 processor check follows:
; the AC bit (bit #18 in EFLAGS) was introduced
; on the 486 processor: this bit cannot be set on the Intel386 processor
;
; save first EFLAGS snapshot into EAX and ECX
00408AAD 9C pushfd <<<<<<<<00000202
00408AAE 58 pop eax <<<<<00000202
00408AAF 89 C1 mov ecx, eax <<<<ECX= 00000202

; flip the AC bit into EFLAGS
00408AB1 35 00 00 04 00 xor eax, 40000h <<<0040202
00408AB6 50 push eax <<<<0040202
00408AB7 9D popfd

; get a second snapshot of EFLAGS into EAX
00408AB8 9C pushfd
00408AB9 58 pop eax <<<<40202

; compare the two EFLAGS snapshots
00408ABA 31 C8 xor eax, ecx <<<EAX=40000 after the XOR

; if the two snapshot are same (386 processor), return 3 for 386
00408ABC B8 03 00 00 00 mov eax, 3 <<<EAX = 00000003
00408AC1 74 24 jz short loc_408AE7

; 486 processor check:
; check for the ability to set/clear ID flag (Bit 21 in EFLAGS)
; which indicates support for the CPUID instruction (Pentium)
;
; save first EFLAGS snapshot into EAX and ECX
00408AC3 9C pushfd
00408AC4 58 pop eax <<<<0040206
00408AC5 89 C1 mov ecx, eax

; flip the ID bit into EFLAGS
00408AC7 35 00 00 20 00 xor eax, 200000 <<<<240206h
00408ACC 50 push eax <<<<240206
00408ACD 9D popfd

; get a second snapshot of EFLAGS into EAX
00408ACE 9C pushfd
00408ACF 58 pop eax <<<<204026

; compare the two EFLAGS snapshots
00408AD0 31 C8 xor eax, ecx <<<EAX=200000 (ECX was 40206)

; if the two snapshot are same (486 processor), return 4 for 486
00408AD2 B8 04 00 00 00 mov eax, 4 <<<EAX=4
00408AD7 74 0E jz short loc_408AE7

; save EBX on stack
00408AD9 53 push ebx <<<<12FF68

; issue CPUID with argument 1:
; return version information into EAX
00408ADA B8 01 00 00 00 mov eax, 1
00408ADF 0F A2 cpuid <<<<ret EAX=F27

; insulate and return family into EAX (0FH for Pentium 4 Processor Family)
00408AE1 88 E0 mov al, ah <<<eax=0000000F
00408AE3 83 E0 0F and eax, 0Fh

; restore EBX from stack
00408AE6 5B pop ebx

; return EAX
00408AE7 loc_408AE7:
; restore flags from stack
00408AE7 9D popfd

; restore stack pointer from EBX
00408AE8 89 DC mov esp, ebx

; restore registers from stack
00408AEA 5A pop edx
00408AEB 59 pop ecx
00408AEC 5B pop ebx
00408AED C3 retn to 408B03

00408B03 mov ds:dword_413098, eax ; Family

00408B08 cmp ds:dword_413098, 3 <<<<<cmp F to 3.
; jump if processor is less/equal 386
00408B0F jle short loc_408B26

00408B11 mov ds:dword_413090, offset loc_4046B8
00408B1B mov ds:dword_413094, offset loc_4046D8
00408B25 C3 retn

Best regards, bilbo
WaxfordSqueers
01-26-2005, 04:36 PM
Hi, WaxfordSqueers,You got it!
The code simply checks for the Processor family. Look!

thanks for the analysis Bilbo, very helpful. At first, I thought they might be checking for the trap flag, to see if I was single-stepping, but I was being a little too paranoid.

I made a mistake when analyzing the flags register. From the diagram of the register in the Intel manual, it shows the flags listed from 0 to 31. There are positions between cf and pf, pf and af and af and zf that are reserved slots for the system. The 1,3 and 5 slots seem to be permanently set to 1, 0 and 0 respectively. I was calculating my numbers based on what I saw in softice rather than what is actually in the flags reg.

Based on the Intel manual, the 4 LSB's are as follows:

0 pf 1 cf
3 2 1 0 <<<<LSB's

with slots 1 and 3 permanently set. With cf=pf=0, that would give the 2 in 202. Obviously, then, the pf flag was turned on by the XOR statement immediately before the 0x00000003 was loaded into EAX. That would set the 4 LSB's to 0110, giving the 40206 value.

BTW, Intel describes the action of XOR as follows:

The OF and CF flags are cleared; the SF, ZF, and PF flags are set according to the result. The state of the AF flag is undefined.

That clears that mystery, but I'm still wondering if there is a way to examine the entire flags register in softice.

thanks again for your input Bilbo.
Kayaker
01-26-2005, 06:47 PM
That clears that mystery, but I'm still wondering if there is a way to examine the entire flags register in softice.
Yes, the CPU command, check the EFL output lines. Only the flags Sice cares about are listed, but you could do a bit check on the rest. Interestingly Not responsive to manual changing of the flags with R FL x.

Huh, that was interesting Middle Earth lore. If I ever do a processor check I'll use that code ;)
JMI
01-26-2005, 10:12 PM
Yes sir, that wandering Hobbit has discovered some interesting lore in his travels. :yay:

Regards,
WaxfordSqueers
01-26-2005, 11:29 PM
Yes, the CPU command, check the EFL output lines. Only the flags Sice cares about are listed, but you could do a bit check on the rest. Interestingly Not responsive to manual changing of the flags with R FL x.

Thanks Kayaker. I looked at the CPU command, but obviously not closely enough.

Before I got sane and bought my P4 processor, I was looking at a way to run a P3 at 1.3 gigs on a 440BX motherboard (designed for P2 at about 300Mhz). It was being done by rewiring the processor socket and isolating pins on the processor itself. If they wont let us at the flags, etc., we may have to go that route. :p I don't think we have a forum for reversing-related hardware mods on this board, do we?
WaxfordSqueers
01-26-2005, 11:40 PM
Yes sir, that wandering Hobbit has discovered some interesting lore in his travels. :yay: Regards,

Travelling can be a good Habbit.
bilbo
01-27-2005, 01:38 AM
Thanks, humans, for your appreciations...

in fact I travelled the net...
http://www.google.com/search?q=cpuid.asm+intel

best regards, bilbo
JMI
01-27-2005, 09:35 AM
That's also good traveling and good lore. :yay:

Regards,
WaxfordSqueers
01-27-2005, 05:29 PM
Thanks, humans, for your appreciations...in fact I travelled the net...http://www.google.com/search?q=cpuid.asm+intelbest regards, bilbo

Hey Bilbo...I'm sure you are aware of the free set of reference manuals at Intel:

http://www.intel.com/design/pentium4/manuals/index_new.htm
bilbo
01-28-2005, 01:35 AM
Thanks, WaxfordSqueers
I have a local copy of them and I use them many times in a month...
Maybe the link should be put at the end of this Board, isn't it?

Best regards, bilbo


RVA Of Events
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RVA Of Events
PDA

View Full Version : RVA Of Events

venom925
01-25-2005, 07:43 PM
Is there a program that will give me the RVA of events such as a button click for any exe simular to this screen shot taken from DeDe looking into a crackme.

Im not looking for where to dl it, I can find that on my own. I just need to know what to look for
doug
01-26-2005, 09:47 AM
First, in windows, the type of events you are refering to are known as messages.

I don't know if there exists program to identify specifically where to set a breakpoint, for each event... but it's not very hard to figure it out yourself.

- You can set breakpoint on messages in softice.
- You can find the message loop / WindowProc and 95% of the time, it's just a bunch switch/case.
venom925
01-26-2005, 11:25 AM
maby i didnt make my question clear enough. I am looking for a program that will give me the rva of where the code for the event(message) is located in the exe. That screen shot was taken from a c++ app.
disavowed
01-27-2005, 12:43 AM
maby i didnt make my question clear enough. I am looking for a program that will give me the rva of where the code for the event(message) is located in the exe.
There is no program to do this for a generic .exe.
That screen shot was taken from a c++ app.
You mean Delphi
Silver
01-27-2005, 06:28 AM
There is no program to do this for a generic .exe.

Is there any reason why not, other than no-one has bothered to write it? I don't see it as a particularly hard thing to code for a basic level, although some of the more esoteric ways of creating controls might cause a few headaches...
dELTA
01-27-2005, 08:11 AM
Is there any reason why notI guess because the message loop code could be anything (i.e. not just a simple switch/case, but crypted/packed/obfuscated/whatever), and the only way to see where a certain message is processed is to do intelligent generic analysis of the code? Or am I missing something?

He's not only talking about locating the message loop I think, but rather locating the exact code location for the processing of certain events (messages), like "ButtonPressed"/"MouseMoving"/"MouseClick"/whatever...
venom925
01-27-2005, 09:59 AM
He's not only talking about locating the message loop I think, but rather locating the exact code location for the processing of certain events (messages), like "ButtonPressed"/"MouseMoving"/"MouseClick"/whatever...

Exactly what I was talking about, If there is no such program there should be http://66.98.132.48/forum/images/smilies_Kayaker/thumbsup.gif. Mainly I was refering to when the button ie: "Register" was clicked, What was the start or RVA of the code that it calls. For those of you who have used DeDe, I think you know what I'm refering to.
dELTA
01-27-2005, 10:22 AM
Well, due to the reasons I listed above, that is not possible in a generic way.
venom925
01-27-2005, 12:09 PM
Well, due to the reasons I listed above, that is not possible in a generic way.

http://66.98.132.48/forum/images/smilies/confused.gif I wonder if the people who wrote the packers/crypters thought the same thing at first http://66.98.132.48/forum/images/smilies_Kayaker/undecided.gif.
All things should be possible just who can figure it out first http://66.98.132.48/forum/images/smilies_Kayaker/thumbsup.gif. Thats the true question.
dELTA
01-27-2005, 12:47 PM
"Generic" is the keyword here. The reason that there does not exist any programs for this is the exact same reason that there does not exist any generic unpackers.

Once you have analyzed one particular version of one particular packer (or in this case obfuscated message loop), there is usually no problems writing an unpacker/analyzer, no, but since the discussed issue here was to create a program that could perform exactly this analysis (i.e. the generic nature is implicated) that would defeat its own purpose. For this you would have to implement an AI equivalent of a human reverse engineer. Sure, there are no theoretical limitations preventing this, but this is way ahead even the state of the art in artificial intelligence today, not to mention the resources of someone wanting to write a cracker tool. :p
JMI
01-27-2005, 01:42 PM
And venom925:

If you want to bemoan the absence of such a tool and contradict good advise explaining why it is not possible, why don't YOU start studying and acquire the necessary skill set and code your own damn tool and stop complaining that no one else has one to gift you with. :idea:

Regards,
doug
01-27-2005, 05:16 PM
If no tool exist, it's probably because the benefit of writing such tool VS the time & complexity to build it is simply not worth it.

Figuring out where the exact location inside your message loop really isn't that hard when you have a resource tool, a debugger and a disassembler.

You can try to implement one; but for every build of it you produce, I can assure you that someone in here would be able to make a message loop that breaks your tool.

side note: there are unsolvable problems in computer science.
venom925
01-27-2005, 06:36 PM
JMI: I was mearly stating that there were probably people who thought that things like the packers/crypters were impossible. Not complaining that no one has a "gift" for me

Delta: Thanks for the explanation of why this could not be made

doug: Thanks for the info on how to find the calls im looking for with SI

Thanks to everybody who responded. None of these post were meant to piss anybody off, I didn't find the info i was looking for so i asked. Is that not what this board is for?
bilbo
01-28-2005, 01:31 AM
venom925,

I think your approach - looking for a GENERAL tool - is not correct.
Try to limit the field of investigation...

For Delphi, and Visual Basic, and VisualC with MFC classes, for example, the tool you are talking about is possible. Why? Because all those high level languages store in some internal structures the addresses of the snippets which will handle the individual events.

For other languages, such as ASM and C, those structures are not necessarily present, so the only address exported to the underlying GUI is the entry point of the Window/DialogBox procedure.

Regards, bilbo
disavowed
01-28-2005, 11:31 AM
Actually, it can be done in a generic way, but it's messy:

GetWindowLong(<target button's HWND (can be found with Spy++, etc.)>, GWL_WNDPROC) will give you the handle to the button's window procedure. This call will fail if the caller is not the process that the button exists in, so we have to do the CreateRemoteThread(...) trick to inject the GetWindowLong(...) call into the target process containing the target button.

The messy part is converting the window procedure handle to the window procedure address. It's doable, but again, quite messy and very undocumented :)
bilbo
01-29-2005, 01:28 AM
Actually, it can be done in a generic way, but it's messy

disavowed,
your hint is nice, but I am afraid that from a practical point of view we are not interested to a button window procedure which in the most cases will be always the same (USER32!ButtonWndProcA)... We are interested to the parent window procedure, but - again - we know just the entrypoint of it.

Regards, bilbo


Need some help for hardware protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need some help for hardware protection
PDA

View Full Version : Need some help for hardware protection

Hero
01-25-2005, 11:10 PM
Hi all
Before everything I should say this is my first test for cracking a program that
uses hardware locks.
My program uses Sentinel+Flexlm protection.But the big problem is that I don't
have hardware dongle of sentinel and no license structure for Flexlm.This program
first tests existance of dongle,then go for Flexlm license,Then if there is no dongle
that never goes for checking the license.
I found a jump that prevent checking license when there is no dongle,But now
i'm in flexlm checking routine that there is no license structure.
my problems:
1-How I can find the version of Flexlm used in program?(Strange but I don't know
how to find it!)
2-I read some tutorials from CrackZ,but in most of them we know licenses structure
,what should I do when I have nothing about it?(My last error is ERR_FILE_NOT_FOUND !)
3-I don't know why,but none of sentinel signature that I get for IDA is not working
and find no functions in body,why?(I test it least 5 deferent Signatures that I found
for sentinel.

If somebody know any tutorial for when we should crack program with Flexlm except
making license for it,please tell me.

sorry for this questions,this is my first Hardware dongle and Flexlm protection bypassing
then I need some help.
sincerely yours
FrankRizzo
01-26-2005, 07:53 AM
Hero, here are my answers to your questions:

1 - the simple way to find out what version of FlexLM you have, is to just search through your target for FlexLM, normally they proclaim the version number loudly, and proudly within their code.

2 - 99% of the people who use Flex use the same format, so, just copy any license file, and change the necessary bits, (product name, company name), and see if you can get it to the point where it's just complaining about your code not being correct.

3 - The only answer I have for this one, is that it's a different version that the one that you're dealing with.

CrackZ has some great tutorials, but if they don't apply 100% to your target, you have to take what you can from them, and fill in the gaps with your own experience.
Aimless
01-26-2005, 10:15 AM
1. Go to macrovision site. Download lmutils.exe. Run it and it will ask you for a file. Select the .dll or .ocx. or .exe files that you think (better to select all files one by one in the directory of the app) and it will show you which version of Flexlm

If you can bypass Sentinel dongle check, then you don't need any other information to break the Flexlm protection apart from the dummy license file with feature names and their versions.

Have Phun
sigint33
01-26-2005, 11:39 AM
Aimless is refering to the ECC patch - easy to find info on, most targets that use FlexLM can use a dongle or other piece of hardware, the dongle is not a necessity, some even allow HostID=ANY, the Important thing to learn is the lic. structure and the feature names, that info along with the ECC patch may get you going. If you want to have some fun try and find the seeds and with the vendor ID you can generate a valid lic. using any one of several tools - Flexgen for older versions - EFA licgen for newer versions and a few other tools.

SiGiNT
Hero
01-28-2005, 06:34 AM
Thanks for help.
I now have more information about my problem.The program uses Flexlm 6.1a
that using a server and there is no dll(such as lmg*.dll).
There is only a server for Flexlm named vlg_lmd.
This Flexlm uses an Rainbow Sentinel dongel for all of its programs(for example
the program HOSTID.EXE will not work without that dongle)
But I still need some help:
1-The VENDORNAME that is send to _lc_init is the vendor name of product,isn't
it?Then why the Srever name(vlg_lmd) is sent to it?
2-There is no demo Flexlm license for this application(because when there is no
dongle,there is no test for license file),Then where is the best place for finding
out the structure of license file?(I followed the program and find out some parts
of this file,but I still have problem with it)
3-I can't find any help for this version of Flexlm routines or it's SDK,Is there anybody
who know where I can find it?(All that I found is for newer versions)
4-What is the best why for bypassing dongle in this mode?Do you know any tutorials
that is similar to my problem?(an Flexlm license generating without any data for its
license file structure that uses an sentinel dongle too without having dongle)

Perhaps this will be simple for you but that isn't for me in first time.
I attached my uncompeleted license file that I figure out,If you know something
that I should add to it(normally will found with this problem) please tell me.

sincerely yours
sigint33
01-28-2005, 10:26 AM
If it requires a dongle for lic. check, (unusual!), there is an emulator available that emulates both ver 7.x and 6.x, PM me and I can either get it to you or point you where to look, your license is missing the encrypted info, even with the ECC patch it needs to be there, the feature line needs to be formated correctly, have you been able to locate the seeds? Maybe generating a valid lic. would be easier, I'll get chastised for this but, in a single feature situation, sometimes disabling the l_checkout or lc_checkout will allow the target to function without a lic. One way to do this is to replace the sub-routine with XOR EAX, EAX followed by a RTN - 33 C0 C3. The problem with this approach is occaisionally it appears to work and all of a sudden the feature disappears will running the tartget.

SiGiNT
Hero
01-28-2005, 01:03 PM
Thanks for quick reply.
But I should say that I never get to lc_checkout in my tracing to disable it! :-/

In addition thanks for emulator suggestion,I get it,and now I should test it!
sincerely yours
CrackZ
01-28-2005, 01:44 PM
Hiya,

You sound very confused. If there is no lmg*.dll try searching the binaries for the static lmgr.lib, use lmtools available all over the web and check the main executables/dll's. vlg_lmd.exe is the vendor daemon and has the same name as the vendor, thats how FLEXlm works (its not unusual), else people could name their vendor daemons the same and problems would ensue.

The FLEXlm licensing layer has no way to force use a dongle, the dongle routines are only called if it detects the FLEXID= in the license string, the only possibility is that the vendor makes a check of his own before calling FLEXlm, this ought to be trivial to verify and you NEED to do this as a priority.

You need a FLEXlm SDK, but you need to know which version your dealing with first (catch 22). Someone suggested an ECC patch, if this is v6.1a FLEXlm the format of your license is absolutely fine, ECC wasn't conceived at this time.

On your next post please try to state.

1. What version of FLEXlm it definitely is (as reported by lmtools), and the files that are protected.
2. What you have done to locate the FLEXlm and/or Sentinel routines, i.e. we'll need to know whether you reach _lc_checkout() or not, or what part of the dongle routines you are struggling with.
3. Some code illustrating 2. would most likely be useful.

Regards

CrackZ.
Hero
01-28-2005, 02:37 PM
Hi CrackZ
Before everything I should thank for your IDA signature of Flexlm That I found
in you site,That helped me too much for tracing program.(I downloaded all of
your site with wget! ;) )

To answer your question I should say:
1-As I said my program uses Flexlm v6.1a,because lmtools says:
--------- Version ---------
FLEXlm 6.1a (liblmgr.a), Copyright (C) 1988-1998 Globetrotter Software, Inc.
In addtion all .exe files in program main directory and only 1 DLL uses this version
of Flexlm too.
2-It was strange for me,but I can't get to _lc_checkout,Is it depend on correctance
of my license file structure?In most of tutorials that I saw they use this function
but I can't reach it.
3-My major attemp to now was making the correct structure for license file,I don't
know it's better to work on something else or not.
4-I can't find this versions SDK,and don't know where to get it.(perhaps somebody
can help for this. ;) )
5-For making correct license file,I trace out program and see that the first line
of license is that I write(SERVER this_host \),But when I get to _l_get_one_id
for the second line,this function returns an error code that I don't know why.
6-As I find out mine program uses an .lib file that compiled with program,becuase
using IDA Flair on main program will show up Flexlm functions.
Edited:7-Don't believe everything that I write in that license.because Its only for test,
For example I get VENDORNAME from lc_init() and it should be correct,But I don't
know that my feature names are correct or not.
sinecerly yours
sigint33
01-28-2005, 03:58 PM
Of course CrackZ is absolutely right about the ECC patch - that doesn't apply till later versions, Thanx for correcting me - It was early when I posted -LOL- new rule 2 cups of coffee before posting.

Thanx again

SiGiNT

Later thought: You know the vendor code and you have the feature name, all you need to do is find the seeds and generating a valid lic using flexgen would be an option rather than patching.
CrackZ
01-29-2005, 08:30 AM
Hiya again ;-).

1. Fine.

2. This is your main problem; If you can't reach _lc_checkout() you MUST figure out why the code isn't getting there; I suggest also you paste to us what you think is _lc_checkout() so we can verify your looking in the right place.

3. Not having a valid license file format usually has absolutely nothing to do with _lc_checkout() not being executed, its a waste of time to tinker pointlessly with your fake license file thats never going to be accessed (from what I saw the formats fine anyway, you can worry about features when you get to _lc_checkout() ;-)). See 2. _lc_checkout() is the encapsulating routine responsible for finding, validating and checking out your license, it has to execute.

4. Once you know why, I can provide you a SDK ;-).

5. I see no point you having a SERVER or VENDOR entry in your license file unless you are going to attack/use the vendor daemon.

6/7. Your problem is getting _lc_checkout() to execute, the rest are details to solve AFTER. The vendor name is correct, if you have a vendor daemon of the same name.

Note to sigint33 - Sorry if I came off as some kind of asshole in that last post ;-), I'm more for tea though ;P.

Regards

CrackZ.
sigint33
01-29-2005, 11:31 AM
CrackZ,

No offense taken! With my less than thimble-full of knowledge regarding Dongle cracking, I expect some flames, I'm just trying to be of some help, I'm sure you are going to continue to be a valuable resource, and I'd really not like to get on your shitlist!

SiGiNT
Hero
01-30-2005, 10:42 AM
Hi again
1-Bad NEWS:I can't reach _lc_checkout() yet!
I suggest also you paste to us what you think is _lc_checkout() so we can verify your looking in the right place.
I don't get exactly what do you mean by that,by the way I think what is shown
by IDA Flirt as _lc_checkout() is _lc_checkout() ! :D
2-Good NEWS:I can find out a place that prevent reaching _lc_checkout(),And
it is depend on existance of license file.Look at this:

*******
.text:00547A46 lea eax, [edi+2] ; switch 5 cases <----This switchs between feature types.
.text:00547A49 cmp eax, 4
.text:00547A4C ja short loc_547A88 ; default
.text:00547A4E jmp ds:off_547A9C[eax*4] ; switch jump
.text:00547A55
.text:00547A55 loc_547A55: ; DATA XREF: .text:off_547A9Co
.text:00547A55 mov al, byte_61ED00 ; case 0x2
.text:00547A5A test al, al
.text:00547A5C jnz short loc_547A8F ; case -0x2<---If there is no license file this jump will not happen.
.text:00547A5E push offset aNoFeatureAvail ; "No feature available in license file.\n"
.text:00547A63 push offset byte_61ED00
.text:00547A68 call ds:sprintf
.text:00547A6E mov ecx, [esp+28h+arg_0]
.text:00547A72 mov dword_61D5F4, 0FFFFFFFBh
.text:00547A7C add esp, 8
.text:00547A7F mov [ecx], edi
.text:00547A81 pop edi
.text:00547A82 pop esi
.text:00547A83 pop ebp
.text:00547A84 add esp, 14h
.text:00547A87 retn
*******

Is there any idea for finding out the place of needed _lc_checkout()?(except tracing
all the program that I doing it now! :D )

In addtion I attach the wingraph32 result for xrefs to _lc_checkout(),perhaps be usefull.

sincerely yours
sigint33
01-30-2005, 11:38 AM
Just a thought, you've made a license of sorts, is it located where the target is looking for it, is there an env. variable, or a reg. entry that needs to point to it?

SiGiNT
jb1968
01-31-2005, 09:39 AM
the version of the target is flexlm 6.1 on solaris .i know the seed on windows , but i can't get it on solaris . i have only one question : where is thr breakpoint ?
Aimless
02-01-2005, 11:07 PM
I'd suggest the following steps:

1. Download lmtools.exe from the web

2. Search the entire directory where you application is installed with, say, Ultraedit, for the words, FLEXLM (a good idea is to search for exe, dll and ocx)

3. Run lmtools.exe on all the binary files with the words FLEXLM in them and note their versions.

4. Use filemon while running the program to see which files above are involved when you initially execute your program. Remember, some crappy apps put the flexlm based application dlls in the WINDOWS directory. Hence filemon.

5. For each of those exe or dlls, find out where _lc_checkout() is. A good idea is to try and find it MANUALLY using Crackz 2004 muster (great tut Crackz!)

6. Run it through SOFTICE to see whether it breaks. If it breaks, follow on as usual. If it does not, then I'd suggest you look to see if there is any DONGLE checking code (not flexlm based, but as Crackz puts it, vendor based)

7. Hope you are not confused between _l_checkout and _lc_checkout

8. IMPORTANT: You will HAVE to find out correct feature name and feature version. Other things are all 'K not to have.

9. Prepare a dummy license file. See what happens. If the system is giving an error, complaining about the invalide license file, then you know that _lc_checkout() has been reached.

10. Try putting a BPM X instead of a BPX when you try to breakpoint in SoftICE.

11. Check out whether Crackz's sig file is applicable to 6.1 versions of Flexlm (hence better to do it manually as per pointers in his Muster 2004)

12. By the way, you'll have to find out whether the application is STATICALLY linked or DYNAMICALLY linked. Don't think applications will use only either exculsively. I have experienced ones that use BOTH static and dynamic at the same darn time, with ECC on it (Thx. Crackz)

13. I'm talking about windows here, of course. I have no exp on Solaris. But I guess the basics would remain the same (though wondering how you're gonna use ICE on Solaris? ;))

14. You will ultimately, have to perform two steps to break the application. Create a valid license file (valid as in feature and version only) AND patch the executable/dll containing the code (if statically linked) or the flexlm dll (if dynamically linked)

Let us know how you are progressing. We'll all try to assist you the best we can.

Crackz, 5 apps and still counting ;) Thx.

Have Phun
jb1968
02-04-2005, 09:37 AM
hi,Aimless:
i just want to know the method how to get the seed from the daemon on unix. Because on win , i had got it correctly . :devil:
Hero
02-04-2005, 09:52 AM
Hi again
I came back with some good news now! :D
I finally find out feature names and feature versions but not with _lc_checkout()
because I didn't have an valid license.
First I should thanks CrackZ for SDK,After reading it I see that I can get features
from _lc_get_config().
With It,I find features(name and version from tracing),And by reading SDK documents
I finally build a valid license that get me to _lc_checkout() :yay: .
Now I get some confused on continue.
I reading this tutorial from CrackZ site for my problem:

hxxp://www.woodmann.com/crackz/Tutorials/Danflex.htm

But I get some obfuscated in some part of it:
Part 6 - Seeds are uncovered - the answer
OK, back to l_sg. I bpx'ed lc_init, lc_checkout, and l_sg. I knew that it would be called in both routines, but I wanted to see it when it got into lc_checkout. This time l_sg took the jump to the vector!. I should have known. It would have saved me a lot of time to just break on this jump in the first place!. The first part of the vector code went like this :-
???
I didn't get why the jump to vector is happened this time.Perhaps I done something
wrong because I never reach that call to vector.
In addtion,What is the best way to find lc_new_job?I think that because the program
should test the seeds,I can find it with this trick,but it does not work:
As I read,the mask of seeds are as following:
mask = vendorkey1 ^ vendorkey2 ^ dword const ^ vname hash ^ random
seed 1 = mask ^ vendorcode.data[0]
seed 2 = mask ^ vendorcode.data[1]
Then I can set a hardware breakpoint on accessing data[0] & data[1] in vendorcode,
then when the seed are calculated for checking they are correct,I can get the point of
testing mask.
But this is not good result for me,because I get somewhere that I can't imagine
the calculating the seeds.Is there any problem with my way?

sincerely yours
Hero
02-05-2005, 10:35 PM
Hi all
Thanks for any help.
I finally generate the license successfully.:D

Sincerely yours


Question about aspack
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question about aspack
PDA

View Full Version : Question about aspack

Eskimobob
01-26-2005, 01:01 AM
Hello all,

Greetz to all you masters out there of unpacking as this is an art in my opinion.

As a general forum spider, I've already done research on this topic many times and have found that there are many articles out there. It's just that they fall a little short of explaining one thing that I can't seen to understand or grasp.

It may be though I'm doing something that hasn't been done or rather that is just a little different.

I'm trying to unpack a file that has been compressed with aspack 2.12 (as told to me by pied/PE_Tools) and it's not quite working. This file is like a dll.

The steps that I have taken so far is generally speaking:

I've run the file, using both my own dll loading program and another program. Set it to break on access violations. Then when it does, I check the memory, find the code area, and place a breakpoint. After I do that I do a dump and I get this massively large version of the same dll I assume. I can then repair the PE using LordPE but it returns the DLL to *about* the original thing. Of course the DLL knows that something is changed and fails when it is run. I assume something changed and the CRC's are different.

Back to a little before that, I am using Olly and have dumped sucessfully using OllyDump. I also have loaded the DLL using olly's internal loader and have come to the same problem.

The part I don't understand is the part about getting the start adress and the part about repairing the dump. I assume it needs to be repaired although all the tutorials I have found have conflicting advice.

I've done alot of research so please don't kill me for asking such an age old question. I'm a little confused and after many many many hours I have resorted to asking the masters here.

I have read many posts about this including:
hxxp://www.woodmann.net/forum/showthread.php?t=2707
hxxp://www.exetools.com/forum/showthread.php?t=4550

In both cases I must be too much of a noob to really follow or I may be dealing with something a bit different. Either way I can't seem to unpack this for the life of me. Would anyone mind helping?

[Edit - 2]

The packed entry point is the instruction PUSHAD.
I then put a read breakpoint on the word pointed to by [ESP] and then run..
Aftre the break point, you step over about 5 lines and boom you are at the entry. (Thanks for the Tutorial on this)

I did this, over and over again actually. After going and setting the breakpoint I hit a memory access error. [000...0] As shown below. Within 1 step from that I'm out of that module and in another. I return somewhere else. Doing this process over again leads me to more mem errors and nothing that looks like it's the OEP.

Using Lord_PE the OEP is: say 1084673 value. I notice that the start of the file, is indeed 1000000, so the Entry point was set at 84673, with the image base set at 10000000. The problem is after I hit: Rebuild PE, the file I rebuilt still has the protection on it.
Eskimobob
01-26-2005, 01:07 AM
Ah I forgot to mention:
The logfile I have is:

File 'PATH TO: A.ax'
New process with ID 000003B8 created
00410070 Main thread with ID 000009AC created
00400000 Module Z:\Crack\odbg110\LOADDLL.EXE
77D40000 Module C:\WINDOWS\system32\USER32.DLL
77DD0000 Module C:\WINDOWS\system32\ADVAPI32.dll
77E60000 Module C:\WINDOWS\system32\kernel32.dll
77F50000 Module C:\WINDOWS\System32\ntdll.dll
78000000 Module C:\WINDOWS\system32\RPCRT4.dll
7E090000 Module C:\WINDOWS\system32\GDI32.dll
10000000 Module 'PATH TO: A.ax'
77120000 Module C:\WINDOWS\system32\oleaut32.dll
77C10000 Module C:\WINDOWS\system32\MSVCRT.DLL
771B0000 Module C:\WINDOWS\system32\OLE32.DLL
77C00000 Module C:\WINDOWS\system32\version.dll
71AD0000 Module C:\WINDOWS\System32\wsock32.dll
71AB0000 Module C:\WINDOWS\System32\WS2_32.dll
003AA8ED Access violation when writing to [00000000]
IsDebugPresent hidden
00400000 Unload Z:\Lost\odbg110\LOADDLL.EXE
10000000 Unload 'PATH TO: A.ax'
71AB0000 Unload C:\WINDOWS\System32\WS2_32.dll
71AD0000 Unload C:\WINDOWS\System32\wsock32.dll
77120000 Unload C:\WINDOWS\system32\oleaut32.dll
771B0000 Unload C:\WINDOWS\system32\OLE32.DLL
77C00000 Unload C:\WINDOWS\system32\version.dll
77C10000 Unload C:\WINDOWS\system32\MSVCRT.DLL
77D40000 Unload C:\WINDOWS\system32\USER32.DLL
77DD0000 Unload C:\WINDOWS\system32\ADVAPI32.dll
77E60000 Unload C:\WINDOWS\system32\kernel32.dll
77F50000 Unload C:\WINDOWS\System32\ntdll.dll
78000000 Unload C:\WINDOWS\system32\RPCRT4.dll
7E090000 Unload C:\WINDOWS\system32\GDI32.dll
Process terminated

Also when I use a program that uses this file generally when I execute the program I go through 9-10:
XXXXXXXX Access violation when writing to [00000000]
(shift - f9)
and then finally the program executes with no problems.
hobferret
01-26-2005, 05:38 AM
Hi :)

You will always get a bigger file than the packed exe :yay:

The OEP should be around 3 to 5 instructions after you break on the word address. Dump it there, don't rebuild imports and don't forget you still have to fix the IAT :idea:

/hobferret
Eskimobob
01-26-2005, 03:52 PM
hobferret,

If you don't mind allow me to run through the process that I have done. When I load the program in Olly, I'm presented with this code:

10186001 <ModuleEntryPoint> 60 PUSHAD
10186002 E8 03000000 CALL SOURCE.1018600A
10186007 -E9 EB045D45 JMP 557564F7

The PUSHAD is indicated as the program's entry. The # 10186001 is also the # in Lord_PE. I then take a look at EST register an that has: 0006F8E8. I then hit Follow in dump, and choose th first two hex pairs and hit Breakpoint --> Hardware, On Access --> Word. Finally I hit shift f9.

After a few moments, the program stops moving. The memory address at the to of the screen is:
10001000 53 DB 53; CHAR 'S'

If I remove analysis:
10001000 53 PUSH EBX

The problem is that at the bottom it states: "Initialization of Debugged Dll Finished. " <---- Is that a problem?

Now, following what you said:
If I hit: F8 only once, I'm taken straight back into the LOADDLL modual. Which isn't what I want. If I continue hitting F8 after 20 or so times it crashes.

Did I pass the OEP? Where was the OEP?

****************
I'd also like to say that this package is a little different in the fact there is not .aspack there's a .apack. I assume that this = .aspack.
Woodmann
01-26-2005, 06:46 PM
Howdy,

apack is not the same as aspack.

Woodmann
Eskimobob
01-26-2005, 09:22 PM
Woodmann,
Thanks for your post.

[Edit]

Actually I was a moron and typed apack instead of .adata.
I'm still not able to locate the OEP as I think there's some sort of fake one placed in here. Any other ideas?

Eskimobob.
evaluator
01-27-2005, 03:42 AM
at ASPACK2.12_section + 39Ah you will see instruction:
MOV EAX, Some_Value
that is OEP, which you need to set in LordPE;

at ASPACK2.12_section + 1C2h you will see instruction:
OR EBX, EBX
at this address you must dump target;

at ASPACK2.12_section + 278h you will see instruction:
MOV ESI, Some_Value
that is IT_address you need to set in LordPE;

RELOCS are at ASPACK2.12_section + 54Bh

what now? did it helps you? do you learn something??
inststead, trace in debugger..
Eskimobob
01-27-2005, 04:59 AM
Evaluator,

Thanks for the reply. My goal with this is to learn, rather than rely on quick fixes and the knowlege of people who know everything. Ie... you :-) I thank you wholeheartedly -- but have to ask another question.

Below is a *modified* memory dump of my running program.

10000000 00001000 Source PE header Imag R RWE
10001000 000D1000 Source code Imag R RWE
100D2000 00001000 Source code Imag R RWE
100D3000 00071000 Source data,exports Imag R RWE
10144000 00018000 Source Imag R RWE
1015C000 0000F000 Source .rsrc resources Imag R RWE
1016B000 0001B000 Source Imag R RWE
10186000 0001D000 Source .data SFX,imports, Imag R RWE
101A3000 00001000 Source .adata Imag R RWE

Following the many tutorials, one section should be named: .aspack, that as shown above is not present. According to what you said, should I be going with the .data section or the .adata section.

The .adata is completely empty and after checking what you siad, I can not find any MOV commands at (Section)+39A (I've treid them all.)

Furthermore, tracing the the debugger leads me to no real definition of raw code. The only time I get to a portion of memory that I think has unpacked code is at 1001000. This value isn't recognised as the OEP.

So I'm a bit lost...
evaluator
01-27-2005, 01:58 PM
i NOT said "Look in .adata". OK!?
so guess & look in section where is EIP..
hobferret
01-27-2005, 02:36 PM
Sorry late getting back to you :)

But agree with what our musical friend has said :yay:

Nothing more to add :whoops:

/hobferret
Eskimobob
01-27-2005, 04:33 PM
Gentleman,

My apologies for this complete mess.
Stud_PE was reporting to me that it was aspack. This isn't the case.

It's
ASProtect 2.0x Registered -> Alexey Solodovnikov

Now, does anyone know of the *existance* of any good tutorials on this?

I'm looking now myself but I just wanted to know if there was any favorites.
hobferret
01-28-2005, 05:20 AM
Who's a stupid boy eh :devil:

Search for tutes by R@ider or Ferrari, both have done good tutes on this program :yay:

Don't run before you can walk :whoops:

/hobferret
Eskimobob
01-28-2005, 06:14 AM
Hey now :eek: ,
I have 2 versions of PiED installed, and one version of Stud_PE. One version of PiED reports the same thing as Stud_PE which was Aspack 2.12. I wouldn't quite blame this all on me... :-/

On the other hand, I agree. I should learn how to walk before I go running. I just think I chose a hard test subject to start with. You can be ambitious can't you? ;)

Thanks for the heads up, hobferret. I will look for them. I found one in spanish by DeAtH HaS cOMe I believe. Unfor, my version of Asprotect does not quite fall under that category.

I thank you, evaluator, and Woodmann for the help though. Maybe I'll come back when I know a little more on the test subject. :p
evaluator
01-28-2005, 06:38 AM
well, in fact we give quite info about aspack-unpacking
& Thread's Title is not wrong.

as about asprotect, seems you will not able unpack it with
current state of your knowledge. Better start work with aspack
& learn it out.. then other packers.. then protectors..
if you really interesting in unpacking as hobbie..

in fact, why you need unpack some .AX file!?
for steal codec code!?
if u are tottaly freeware-iLLegaL, then you are welcome
if u are shareware-illegal, then you are not welcome

btw, SIZE of EIP-section?
Eskimobob
01-29-2005, 12:17 AM
in fact, why you need unpack some .AX file!?
for steal codec code!?

No, I'd rather not steal code.
In the sense for reproduction rights.
It's about learning. How do things work, how does this do what it does.

if u are tottaly freeware-iLLegaL, then you are welcome
if u are shareware-illegal, then you are not welcome

I'm sorry but I do not understand a thing you're saying here.
What is "tottaly freeware-iLLegaL." Are you asking if I am unpacking something freeware?
hobferret
01-29-2005, 05:30 AM
Eskimobob :)

The majority of us on this board reverse targets for educational purposes :yay:

I can't speak for the rest but in the majority of cases I just make notes then delete the program. I only keep them active while someone else is asking sensible questions about the program :idea:

Aspr 2 is similar to it's forerunners except for the rediredted calls :devil:

As for evaluator, well we have always had problems with his English. I don't know if English is his mother language and he does it deliberately or if he is foreign :devil:

If we go back to the early days of tutorials they always stated "If you like the program then buy it! :yay:

Anyways, good luck with your project :cool:

/hobferret
Eskimobob
01-29-2005, 05:53 AM
I can assure anyone here, I work for no software company or I am not working for any commercial gains...

This project isn't to see how break into the software security, hell it's not even to crack, it's more to see what they did, how to improve and maybe make something that could function as a replacment of course, and *never* for any financial gains.

I, as a programmer, wouldn't want to copy code as having my own code stolen is terrible. Even some of my freeware programs that I've made which include source have had the code stolen and there all I ask for is due credit.

The reason I come here is because the community allows for questions. In a field like this there's few places that you can go that will help you start. Being a programmer does help but theres some aspects that really are underexplained, partly due to the aparent explaination that one gets from experiance. Learning how to unpack is / will be a bonus to me learning how things work.

What can I say... I'm curious. :D

Oh and BTW... the program I am working on... is fully liscnesed on my machine. I support them heavily (as in always buying upgrades... etc) because I think they're work is great. I'll always support them too, it's just when I see something amazing... I wonder why I can't think up of it and try to figure out what they did... Something like a magic trick.

ps.
thank you hobferret & evaluator for your kind words.
evaluator
01-29-2005, 09:09 AM
all points for start learning we gave you. (reread them)

thread done. unsubscribing..


Guide How to play with processes memory, write loaders and Oraculums + full framework
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Guide How to play with processes memory, write loaders and Oraculums + full framework
PDA

View Full Version : Guide How to play with processes memory, write loaders and Oraculums + full framework

Shub-nigurrath
01-26-2005, 05:25 AM
Hi all,
exiting new tutorial from me .. I placed it here because it includes also a complete framework ... see the tut

Guide on How to play with processes memory, write loaders and Oraculums
Download at: http://tutorials.accessroot.com

This tutorial aim is to do a whole flight over loaders, memory patching and how to build them. Told this you might think that there’s nothing new in this, because there are several excellent tutorials (not that many anyway) already around, which already cover this argument, but the real final target of this tutorial is to teach how to write an “Oraculum”, and to write an Oraculum is impossible without first of all understanding all the things about loaders, processes and memory patching of applications.
At the same time reading this requires a little of knowledge of the C programming language. All the examples I provide have been written in C (and tested using Visual C++ 6.0), but I tried to leave things as much easy as possible.

I must admit that this is a really long tutorial, the longest I ever written, but I wanted to take by hand all the possible readers giving them also the path to understand all the concepts: it think that anyone can read it starting from the first to the last page. Of course those of you alread expert in this can skip earlier pages!

Inside it you will find a complete description of the loader theory and a complete description of the framework I wrote to support others writing new oraculums. I also will present two oraculums for two real applications.

Do not forget to write comments to me or on the ARTeam's forum or here, also to help me improving the code :D .

Have phun!
doug
01-26-2005, 10:00 AM
For those wondering what an Oraculum is ... (it's in the pdf)

Oraculous - \O*rac"u*lous\, a. Oracular; of the nature of an oracle. [R.] ``Equivocations, or oraculous speeches.'' --Bacon. ``The oraculous seer.'' --Pope. -- O*rac\"u*lous*ly, adv. -- O*rac\"u*lous*ness, n.

Informatically speaking, an oraculum is a loader, an external program which executes the target program and does some memory patching in order to obtain some information such as usually the serial code, and then it reports those things to the user.

----
I think your spell checker didn't like the word SEH :)
"SHE - Structured Exception Handling"
"Using the SHE instead lead us ..."
:devil:

-----
Thanks for sharing
Shub-nigurrath
01-26-2005, 12:00 PM
oops damned word! fixed.. ;-)
Eskimobob
01-26-2005, 03:54 PM
Shub-nigurrath: Thanks for all your hard work. I've been to that site before and have read a couple of your other works. I just wanted to thank you here.

*Downloading*
JimmyClif
01-26-2005, 05:34 PM
Nice work...
Ricardo Narvaja
01-27-2005, 04:32 AM
I think the tutorial is a good job but i have one or two questions.

I make a tut of a loader debugger in 5 parts one month ago, and the idea is the same (we not discover the TNT jeje) but i think why your loader don´t debug the program?

Debugging the program you can put Breakpoints, Hardware Breakpoints, Breakpoints on memory access, on write, on execution etc, and the loader debugger, catch easy the exceptions produced by the debuggee and you can work more easy, quickly and more powerful, you can change registers, flags, memory, in the same form any ring3 debugger.

this is the unique point you need for put a breakpoint put a ebfe loop and look with the loader if the victim are looping for know if the EB FE was triggered, with a BP (CC) the loader debugger catch the excepcion perfectly.

And a debugger is only a loop, i think is more easy and powerful, but is only my opinion, maybe you have better reasons for make the loader not debugger and i´m wrong (very high possibility, i´m only a self teached in cracking and have hundred of errors jeje)

Is only for know and learn from other opinions sorry

Ricardo Narvaja
Shub-nigurrath
01-27-2005, 07:59 AM
Hi Ricardo,
nice to see you, you are always welcomed!

I knew of your tutorial and I read it indeed before releasing this one: ThuderPwr/Powermos told to me that you were writing it...but I promise that I haven't copied/taken a single line from them :smug:

First of all the genesis of my tutorial was to introduce the Oraculum concept: I like to introduce new concepts and this was not still "defined" AFAIK. Then started writing the appetite come (you know) and I decided to write a more complete document.

Secondly, coming to your observations. My approach doesn't uses debugAPIs (or better doesn't use breakpoints because get/set thread context and read/write processmemory are indeed in the debug library) because several programs can detect if the program is being debugged, quite easily and in different ways, while they are not able (most of the times simply doesn't do it) to detect direct memory writing/reading (except for CRCs, but can be "skipped").

The concept I applied is "let the program run freely, normally and trap it trasparently"...the debugging APIs are a little more invasive.

I agree of course that the debug library is more powerfull, it exists for this specific purpose afterall, but IMHO the advantage of my approach is just in what I said above.

On the other hand the EBFE trick and the whole method is less powerful of the debugAPIs because you cannot easily do a lot of things, but most of the times what you only need is stopping at a specific point in the program, do some patches, read some values and continue to the next stop.
90% of the patches will fall into these actions..and the framework I released helps to manage these complications.

The work made for the QuickUnpack.dll, I released some time ago, based on an original code of FEUERRADER, uses essentially the whole set of debug APIs + online memory patching for the isDebugPresent API (like Ollydbg plugins does), but this time I preferred to do something different.

Of course anyone can find different situations where one approach is better than the other, there are no universal laws.

I would suggest anyone to consider both approaches, before create loaders for a specific victim..

I hope this answer to your comments.

Thanks again,
Shub-Nigurrath
Ricardo Narvaja
01-27-2005, 08:47 AM
i learn so much of your explanation, is perfect and your tute is great programming in VC++ or other langiuajes, and i´m learn by myself and my tut is very simple, writing directly in ollydbg but all contibutions help, do you know?

Again very good job

Ricardo Narvaja
Shub-nigurrath
01-28-2005, 03:30 AM
Updated to version 1.1 both tutorial and framework.

Version 1.1 -
- added KillisDebuggerPresent which patches the isDebuggerPresent API with an example too
- accordingly updated the documentation
evaluator
01-28-2005, 07:22 AM
That is very NOT secure to show, how exactly change Kernel32 code,
so some heavy-stopid-prot then can check for that & f_out newbies PCs.
that is strictly PRIVATE thing, how patch or not patch system code..
Shub-nigurrath
01-28-2005, 09:23 AM
I don't think so, this isdebugpresent patch is a normal well known from anybody patch, there are already plenty of tutorials around explaining how to do it manually with Olly. What the code does is exactly what you would do doing it in Olly. So I strongly disagree with you.

This is no more a secret. look the code of this method, it's a simple monkey-level code with no secrets at all inside.

the secrets are others IMHO and for those I haven't placed anything public.
blabberer
01-28-2005, 09:32 AM
i believe he is talking about you retn4 patch to OutputDebugString()
but not sure about it :) his ramblings are usually as cryptic as his crackmes :)
no offence Eval its just a joke
nikolatesla20
01-28-2005, 11:11 AM
Good tutorial, this will probably help out a lot of those newbie unpacker authors that don't know where to start !

I've used that EBFE trick before in my arma unpackers, although I didn't know it had a "name" :)

-nt20
evaluator
01-28-2005, 02:38 PM
i not yet read tut.
i'm about changing Kernel32.dll code; that is bad;
if you mean changing byte in PEB, that is good;
evaluator
01-29-2005, 04:23 AM
blump, my ARcobat_reader4.05 won't open "Oraculum_..pdf";
& i won't install newer acrotba..;

What goods these guys found in PDF?

RTF is GREIT!!
Shub-nigurrath
01-29-2005, 07:17 AM
well 5.0 is the minimum, there are also free opensource readers btw
evaluator
01-29-2005, 09:05 AM
ok, forget it;

Do you agree about: Changing Kernel code is bad?
(bcz can be yasy detected & kicked?)
Shub-nigurrath
01-29-2005, 03:25 PM
"easy detected & kicked" by who: protection developers (like Chad & friends) or ppl at M$ or application developers?
evaluator
01-30-2005, 04:05 AM
by them, who want..

// you can't say, that you was not warned;
// why accept only working examples, if human can also theoretic??

bye-bye.


Harlock eye help
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Harlock eye help
PDA

View Full Version : Harlock eye help

master
01-27-2005, 06:21 AM
Hy to all.

I dumped the hardlock e-y-e with sporaw's hl-dump (link on crackz site), but found no instruction what to do next with the .reg file that the program created. I tried to import it to registry, but could not run the program without the hardlock :(. Does someone know anything on this? If there is a tutorial (i searched a lot on the net), please give me some link.
I have the hardlock till monday, i could try some other method also (dumping the protected file with procdump to disk). I already did that but the .protect section still exists.
Please help

Thank you
MASTER
P.S Sorry for my bad english
CrackZ
01-27-2005, 07:08 PM
Hiya,

Drop me an e-mail.

You need sp0raw's own emulator or a commercial Hardlock emulator that implements the HL_CODE() emulation algorithm (via the data you dumped) for it to work.

Regards

CrackZ.
isnull
02-21-2005, 04:22 AM
Master
Send this dump to isnull @ mail.ru.
I help you emulate dongle.
searchme
03-09-2005, 01:56 AM
can anyone please post the dump of the demo-HL.. thanks!!


linux dongles
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > linux dongles
PDA

View Full Version : linux dongles

0xf001
01-27-2005, 06:55 AM
hi,

I have just found this:

http://www.dongles.com/Linux_Dongles.htm

has anyone got experience with those or other linux dongles? they only have downloads for windows there :)

ah and I found this as well:

http://www.matrixlock.de/english/index.htm

they are offering also linux dongles, and have driver/API downloads online

cheers, 0xf001
FoxB
01-27-2005, 09:22 AM
First link is MARX ® CRYPTO-BOX Software Protection System.

All files place at http://www.dongles.com//ftp/
0xf001
01-27-2005, 09:41 AM
hi,

thanks, yes that is what they say, but there is no file you can use for linux, or am I wrong?

cheers, 0xf001


Re-Pair 0.2
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Re-Pair 0.2
PDA

View Full Version : Re-Pair 0.2

Crudd
01-28-2005, 01:02 PM
RE-Pair is a 'tool' that will make some of our (reverse engineers) tools a
bit more difficult to detect. Why the name 'RE-Pair'? Simple, it helps
'fix' our tools, by making them somewhat more difficult to detect.

Currently 'fixes': Any tool. Either in memory (for packed apps and one time
changes) or on disk (for permenant patches of non-packed apps). It does this
by changing the caption/classname to a random string (defeating FindWindow
method). It also patches OllyDbg to fix the 'OutputDebugString' vulnerability
(Used by Armadillo and others).
NOTE: Using the 'Fix Other' option may take a while to 'Fix' 'on disk'.

The 'in mem' option allows you to fix packed tools such as PEiD and ImpRec. And Classnames are only patched 'on disk'.
Fixed the ollydbg.ini bug.
Attached and here: http://crudd.reteam.org/files/re-pair.zip
Crudd [RET]
dELTA
01-29-2005, 04:24 PM
Cool, thanks for notifying us about your tool releases. :cool:
JMI
01-29-2005, 05:17 PM
And for making them in the first place and saving those of us who don't have the skills or time to code our own and have to fumble with piecemeal modifications without such combined tools. :yay:

Regards,
nikolatesla20
01-30-2005, 10:19 PM
Thank you very much for doing this, it's been needed for a while, and most of us have just been to lazy to do it :)

Just curious, but hopefully it randomizes the strings it edits in some fashion as well.

-nt20
Crudd
01-30-2005, 11:37 PM
Yeh, i used some lame RandomNameGenerator. It creates a 5 char random string for the Caption/Classname. This should be plenty 'randomness' for this purpose. If anyone has any suggestions or additions, ill gladly try to add them. Thanks for all the 'thanks'.
Crudd [RET]
Crudd
02-05-2005, 03:08 AM
Lots of new stuff and bug fixes. Let me know what you think.
Crudd [RET]
Snowski
04-16-2005, 06:29 AM
Excellent, thanks alot for sharing! :D

Works great for patching the exploit Armadillo uses... ;)


Question about breakpoint.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question about breakpoint.
PDA

View Full Version : Question about breakpoint.

dive2code
01-29-2005, 02:07 AM
Hi all,

Can I set breakpoint on Std. driver routine like as a IRP_MJ_Read in SI?

thanx in advance...
Kayaker
01-29-2005, 04:33 AM
Hi

You should be able to in normal cases. Type DRIVER <name> in Softice, get the address of the IRP_MJ_xx function you want to break on, set a breakpoint, then fire away. I'm able to track IRP_MJ_DEVICE_CONTROL routines this way. You can use something like DriverSpyNT by Jeremy Collake to test for the IRP_MJ functions being used.

It would depend on how things are implemented as to how you would have to set the BP I would think. It's during the user StartService call that a drivers DriverEntry is called, and it is here that the IRP_MJ_xx Dispatch routines are set up. It is only after this point, or StartService is returned from, that you can find their addresses in Softice. If your IRP_MJ_xx routine is used soon after, you may need to set an intermediate BP in the user app before setting your IRP_ breakpoint.

Kayaker
dive2code
01-29-2005, 09:31 AM
yup! you are right, Kayaker.

OSR's Devietree was also useful.

I was able to to track IRP_MJ_DEVICE_CONTROL routines,

although IoCallDevice annoying me :P

thanx again.
disavowed
01-29-2005, 08:34 PM
You might also want to check out IrpTracker: http://www.osronline.com/article.cfm?article=199


Two funny links
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Two funny links
PDA

View Full Version : Two funny links

disavowed
01-29-2005, 04:18 AM
Stumbled upon this site from Raymond Chen's "The Old New Thing" site: http://thedailywtf.com/

Stumbled upon this usenet thread from thedailwtf.com: http://groups-beta.google.com/group/comp.object/browse_thread/thread/9384f6c79d253cf3
omega_red
01-29-2005, 09:22 AM
Thedailywtf rocks... Although browsing it can cause irreversible changes in the brain ;)
evaluator
01-30-2005, 04:10 AM
is there some fun linkz about B_l G_te!?
disavowed
01-30-2005, 03:10 PM
is there some fun linkz about B_l G_te!?

He has an 's' at the end of his last name.
evaluator
01-31-2005, 02:26 PM
i asked not about 's' @ end!!
disavowed
02-01-2005, 01:21 AM
i asked not about 's' @ end!!

Then no, "there is no fun linkz about Bill Gate"
disavowed
02-01-2005, 01:23 AM
Hah... 52,000 hits on Google for "Bill Gate"

... morons
evaluator
02-01-2005, 02:55 AM
t_anks for hint!! (so there are, ye!?)
i'm examining now 5th link from google:

http://www.geekculture.com/geekfiles/headhockey/headhockey.html


W32DASM Buffer Overflow
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > W32DASM Buffer Overflow
PDA

View Full Version : W32DASM Buffer Overflow

br00t_4_c
01-29-2005, 01:32 PM
Has anyone seen this? LOL. That's almost as funny as a buffer overflow in a debugger (Olly). Heh.

hxxp://www.securiteam.com/windowsntfocus/5BP0M1FEKG.html
doug
01-29-2005, 01:36 PM
Yes, 3 threads down in this forum section:
http://www.woodmann.com/forum/showthread.php?t=6787
http://www.woodmann.com/forum/showthread.php?t=6789
:devil:
lifewire
01-30-2005, 06:01 AM
the guys who released that exploit are really poor, it is 1. a direct rip of from yup's IDA buffer overflow and 2. it makes as much sense as exploiting the windows 1.1 notepad.


Need a Javascript/IE setup guru
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Need a Javascript/IE setup guru
PDA

View Full Version : Need a Javascript/IE setup guru

roocoon
01-29-2005, 05:17 PM
Hi all.
I'm posting this just in case somebody has come across this problem before.
A simple-looking case but I don't see what causes it.

I run a java-based web server that puts a database's data on a form and allows modification of the fields, some by direct entry and some by selecting from a dropdown list.
The form consists of a couple of frames and coded with Javascript (I didn't write it but I can see the code by browsing the page's source).

Problem: When I access the form from my laptop and hilight an option from a drop-down list (it gets highlighted as the mouse pointer moves over the list), I cannot select it. The clicks don't have any effect.

It should be some Javascript option in IE that causes this but which one?

Another computer on my intranet has no problem accessing that form.
Same OS (XP SP2), same security patches, same Java VM, same firewall, same security patches for IE, the exact same IE options. This computer is even more loaded and has a lot more of services running.

In the laptop, I removed all the IE plugins, disabled the firewall, made all Javascript options options enabled, low security, reregistered all the suggested DLLs as per MS instructions, and nothing. Same problem.

I thought it might even be the graphics driver (NVidia - the same version on both computers but different flavors of the chip) but Opera, on the laptop, works fine with that form so the problem should be something specific to IE.

I doubt it can be remote-fixed by anybody, unless you've come across this before, so the question is a bit more general.

How do you trace Javascript behavior on a case like this? Is there any tool that allows that? Alternatively, is there anything that can verify the correct setup of Javascript on a computer (other than reinstalling XP on top of itself)?
MS's Sfc didn't find anything and QfeCheck didn't identify any problems with the service patches.

Thanks in advance for any suggestions.
Woodmann
01-29-2005, 07:08 PM
Reset all the internet options back to default.

I know its generic but, you need to have some base to start at.

When Opera works and IE doesnt then it can only be IE or Java.

What version of Java is Opera using ?

Woodmann
roocoon
01-30-2005, 04:28 AM
Thanks.
I'm running with everything in Default mode now and Low security. No difference in IE behavior.
Opera (7.60.7141) is installed without its own Java engine.
It shows as active the plugins installed by Sun's JRE 1.4.2_06.
Both computers use the same JRE but on the laptop I have it disabled now since I'm eliminating variables.
It didn't work when the JRE plugin was active anyway.
Funny thing too, this JRE is not an officially supported version by the application I'm running but it works fine on the desktop computer.
Eliminated the graphics driver too.
I tried in Safe mode and the problem remains.
Woodmann
01-30-2005, 03:51 PM
Try an older version like 1.4.2_03

Woodmann
roocoon
01-31-2005, 08:24 AM
Can't be that, I'm afraid.
The working machine has 1.4.2_06 and works.
On the non-working machine, even removing the Sun JRE doesn't help.
It must be something specific to IE's Javascript that causes that. I'm still looking for some DLL that might have been overriden, but no luck yet.
naides
01-31-2005, 09:05 AM
I had a somewhat similar problem sometime ago. I could not select rows with a mouse click. The fact that you can do it in another computer with similar OS settings suggest to me that the problem is below OS Browser and JAVA: The mouse/touchpad driver may not be generating the expected harware event that the OS/JAVA software is expecting.

Suggestions:

Connect an extra mouse to the laptop: try a serial, a OS/2 and a USB and see if the problems solve. Also try to deactivate the intrinsic laptop mouse/touchpad device

Consider updating or, pain of pains, tracing the mouse driver event generation software in the computer that works and in the computer that does not. That is what I ended up doing. Good luck
roocoon
02-01-2005, 02:02 AM
Thanks.
I hope I don't have to go that route to resolve it. They'll have a new version out before I get halfway through :)
I'm already using an external mouse.
Nevertheless I disabled it, then I disabled the touchpad instead. Still the same. It's got to be some DLL. I have a bunch of Java development tools installed that might have overriden something.
The question is, what? How to identify all DLLs that MS Javascript uses? Is there a list of them somewhere?
It looks like I won't avoid the reinstall of XP on top of itself.
naides
02-01-2005, 05:50 AM
If you can spare a laptop hardrive or have an extra loaner laptop available, try starting with a fresh system, then see if the click mistake is present in a clean install. Then stepwise reconstruct your laptop system while using an install log utility. eventually, one of your tools installation will fuck up the click function, so you can narrow down the util/dll that has the problem.

Sounds involved , but it may take a few hours only. It all depends on how bad you want to squash this bug.
roocoon
02-02-2005, 02:10 AM
Thanks naides.
Your procedure is clean and would find the problem eventually but it isn't anything I want to have to try :).
I can't get the extra hardware and this laptop has too many development tools on it. It would take me weeks to reinstall them. The missing functionality of this application doesn't bother me much since I can have it through other machines. But it annoys me that I can't figure out the "why"s of it.
I'll keep looking for this elusive problem. I'll post here if I ever resolve it.
Thank you all for the suggestions.


Article: Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Article: Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass
PDA

View Full Version : Article: Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass

dELTA
01-29-2005, 07:03 PM
Defeating Microsoft Windows XP SP2 Heap protection and DEP bypass:

http://www.maxpatrol.com/defeating-xpsp2-heap-protection.htm

(parent page with some more stuff, including example program: http://www.maxpatrol.com/ptmshorp.asp)
JMI
01-29-2005, 07:57 PM
Uuuuppppssss. There they go again. :rolleyes:

Regards,
bilbo
01-31-2005, 01:49 AM
Great stuff. Thanks, dELTA. bilbo
Silver
02-02-2005, 03:20 PM
Follow-up fluff news story:

http://www.informationweek.com/story/showArticle.jhtml?articleID=59200465


Question about IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Question about IDA
PDA

View Full Version : Question about IDA

doco
01-31-2005, 02:37 AM
Hi,
just a little question:
If i want to use IDA, would it be better to get a (pirated) uptodate version , i think 4.7 or so, or would the free 4.3 version be enough for doing "some" ?
JMI
01-31-2005, 03:31 AM
Depends entirely upon your operating system and what you want to do with it.

There a number of Threads here about problems associated with the use of various versions of Softice and WinXP SP2. You should use the SEARCH function here, as you were instructed to do in the FAQ, to look for information about Softice and the various versions.

That's why that statement appears under your signature. :yay:

Regards,
doco
01-31-2005, 03:37 AM
Yes, but.....
are IDA and SoftIce the same ?
JMI
01-31-2005, 03:45 AM
Ups. Sorry. Reading too many threads at the same time and crossed those references from IDA to Softice.

Parts of the answer is still correct. Some versions of IDA are discussed here. For example you could do a search for "problems + IDA" (without the quotes) and find some discussion of IDA 4.3. I found 43 Threads you may review.

Part of the issue is still what you want to do with the program. If you are trying to use some special processor, you might need the more advanced features of the newer version. If you are starting out and have no familarity with the program, I would recommend you start with the free version, because it takes some getting use to to learn how the program works. For that "reading the manual" is always a good place to start.

Regards,
doco
01-31-2005, 04:17 AM
ok, thanks...
quasar
01-31-2005, 06:47 AM
Hi,
just a little question:
If i want to use IDA, would it be better to get a (pirated) uptodate version , i think 4.7 or so, or would the free 4.3 version be enough for doing "some" ?

If you are newbie IDA Freeware is all you need to start reversing on Intel platform under windows.

hxxp://quasar.prv.pl/idafw.html -> import library for IDA Freeware 4.3
doco
01-31-2005, 12:00 PM
If you are newbie IDA Freeware is all you need to start reversing on Intel platform under windows.

Thank you so much, that is exactly the info i needed :yay:
Aimless
02-01-2005, 10:50 PM
Why don't you download and install both?

When you need the debugger (and its GOOD for tracing Function Calls only) you can use the IDA 4.7 (warezed)

WHen you need the flow chart analysis for PART of your code, then you can use IDA freeware. The PART flowchart for 4.7 is broken.

Better, get IDA 4.6 from the net (Warezed again) and enjoy both debugging AND PART flowcharts.

Get them all.

Have Phun
doco
02-02-2005, 11:24 AM
Yeah thanks, Aimless, but i currently try to reduce my warez as much as i can. Lets see how much i can achieve with just Freeware/ Open Source... :rolleyes:


armadillo unpacking problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > armadillo unpacking problem
PDA

View Full Version : armadillo unpacking problem

fighter_81
01-31-2005, 08:17 AM
Hi to all of you, i have a problem while trying to unpack a program that if you want you can find at http://wtf.deleted.com. it seems that it is not compressed but when i break at the eip with mi SICE i found this:
PUSHAD
CALL 004F7000 //PROTECTION ENTRY POINT.
The program detects the debugger with the int 1 method.
Well, i put a bpmb SetProcessWorkingSetSize x, this breaks two times. I rebuild the IAT and when i run the prg it says that the program has been dameged by avirus or bla.... Now the question is if in your opinion it's a crc check maded by arma or if i have missed the oep. has one of you guru an :idea: ? I worked around this prg for weeks but i'm not able to cave a spider from a hole.
fighter_81
02-03-2005, 08:41 AM
i just want to say that i am sorry for posting a direct link to a software. i will never do that again. i promise


Archive CHM file updated Jan 28 (*NM*)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Archive CHM file updated Jan 28 (*NM*)
PDA

View Full Version : Archive CHM file updated Jan 28 (*NM*)

Kayaker
01-31-2005, 12:41 PM
(*NM*) means No Message, so what are you looking in here for? :p
JMI
01-31-2005, 12:54 PM
I'm always seeking enlightment. :yay: Darn. Still haven't found it. :D But I'll keep looking. :idea:

Thanks for the update. ;)

Regards,
TBone
01-31-2005, 01:22 PM
Wait a minute - if there's no message, then what is this?

(*NM*) means No Message, so what are you looking in here for? :p
* head explodes *
JMI
01-31-2005, 01:23 PM
Don't ya just hate it when that happens? So messy. :D

Regards,
ZaiRoN
01-31-2005, 02:53 PM
Wait a minute - if there's no message, then what is this?Hmmm, it's the usual trick used by both Kayaker and JMI to increase their own number of posts :devil:

bwhahahaha http://66.98.132.48/forum/images/smilies_Kayaker/smug.gif
bilbo
02-01-2005, 01:31 AM
Hmmm, it's the usual trick used by both Kayaker and JMI to increase their own number of posts
just curious: is there some advantage in having an high number of posts?
regards, bilbo
ZaiRoN
02-01-2005, 04:45 AM
just curious: is there some advantage in having an high number of posts?Hm, no but... ask them :p
blabberer
02-01-2005, 05:50 AM
i was thinking of asking it for some time :)
does this archieve contain all the threads along with thier attachments ??
or are they only threads no attachments ??

any way i should find some time to download and look into it :)
ZaiRoN
02-01-2005, 09:27 AM
or are they only threads no attachments ??Yes, only threads, no attachments.
babar0ga
02-01-2005, 03:05 PM
Seams to me that this thread deserves at least one message...
Who will post it? (;
Kayaker
02-01-2005, 05:56 PM
Well I'm certainly not going to be the first one to write a sensible message here.

just curious: is there some advantage in having an high number of posts?
regards, bilbo
Sufficient posts and 3 boxtops will get you the honorary title of Pooh-Bah. Not the head of the Royal Order of Waterbuffalo to which Fred Flintstone is a member, but the Gilbert and Sullivan one...

This exalted position of Pooh-Bah includes the offices of Lord Chief Justice, Master of the Buckhounds, Groom of the Back Stairs, and of course Lord High Everything Else.

Someone else not me rewrote the libretto for Pooh-Bah in the spirit of G&S:

He is so wise,
His talk supplies
Analysis for
Those seeking more--
But all admit
His fabled wit
Helps make things clear
To a listener's ear.

His wisdom grows
And what he knows
Confounds his foes
As on he goes (as on he goes)--

I hope that cleared things up...
JMI
02-01-2005, 07:06 PM
Thanks. That did clear that up. :yay: From my own experience in the Military, the main "advantage" of getting noticed for anything was that one got to clean the latrines. :eek:

Regards,
bilbo
02-02-2005, 03:35 AM
I luv u boys, you learn everyday something new...
JMI, if you means by "latrines" this forum, you are doing the job egregiously (in the archaic acception of the term).
Regards, bilbo
JMI
02-02-2005, 07:08 AM
Ah Master bilbo:

You have learned some "extraordinary" things in your travels through Middle Earth. Your contributions are always marked with erudition and, in this case, too kind (in the obsolete acception of the word). :yay:

However, in this case, I was recounting the literal, rather than the allegorical (in the biblical sense), if I may elucidate. ;)

Regards,
babar0ga
02-23-2005, 08:12 AM
Well I'm certainly not going to be the first one to write a sensible message here.

Well, it seems it's going to be me...

Probably becuase of moving to new server someone forgot about CHM archive. Anyway, link is dead...
JMI
02-23-2005, 09:34 AM
Spolied Sport: :D

I'll take a look at the links later this morning. There are still a few little nagging issues to finish up with from the move. Like the big, ugly icons which show there are new posts in a Forum. I forgot to upload those older, smaller, icon, while attempting to fix the initial avatar issues. :rolleyes: Will get to both issues ASAP. :idea:

Regards,
Kayaker
02-23-2005, 10:33 AM
Sheesh, you mean people actually want things to WORK too?? :p

OK, I put the chm file back in the proper place, after the "redecoration".

Kayaker
JMI
02-23-2005, 10:42 AM
Maybe you could add a new coat of paint while you're at it. :idea:

Regards,


Armadillo Tools v0.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Armadillo Tools v0.1
PDA

View Full Version : Armadillo Tools v0.1

tenketsu
02-01-2005, 04:15 PM
ArmTools v0.1 is an application to make easy some tasks in the unpack of Armadillo 3.x - 4.x, 100% assembler code

The pack contains the tool and 2 manuals

Armadillo 3.x - 4.x [CopyMemII, IAT Scrambler, Code Splicing & Nanomites]

http://www.geocities.com/tlatoanimt002/ArmaTute3x4x.zip 594 KB

Mirror
http://www.geocities.com/tlatoanimt001/ArmaTute3x4x.zip 594 KB

ONLY in spanish, sorry!
JMI
02-01-2005, 04:46 PM
Should be useful in any case. Thanks for the sharing. :yay:

Regards,
seven
02-01-2005, 06:02 PM
thx so much

but zip file can not be extracted ( damaged ) .
tenketsu
02-01-2005, 06:30 PM
I've downloaded the zip again & the zip works OK, Try again
seven
02-01-2005, 06:38 PM
U R Right

thx so much .
NeO
02-02-2005, 02:39 AM
What can i say...good work and about GreaT tuts and amazing tool.-

Keep a good work :devil:

NeO
fly
02-03-2005, 11:06 PM
Thanks for sharing your efforts.
wizard
02-04-2005, 08:46 AM
Hi tenketsu,
following your tutorial to page 18/19 of parte2 i see you are using N-Rec 1.7 to process the .exe
I'm using winxp and the outdated N-Rec has never worked for me.
The tool only runs the process and does not continue.
Running N-Rec in win95/win98 compatible mode results in Access violation.

What os are you using to run N-Rec or has anybody successfully used N-Rec on winxp (sp 1/2) ?

The tools look great but require these bin files by N-Rec. Any way to retrieve these files manually?

Thanks.
- Necromancer
tenketsu
02-04-2005, 05:55 PM
...
The tools look great but require these bin files by N-Rec. Any way to retrieve these files manually?

I utilize N Rec to prove that the nanomites's protection has not changed very much, in addition to save time.

If you want to get the nanomite's tables, look for the excellent manual of Ricardo Narjava.
JMI
02-04-2005, 07:13 PM
Searching for such information will be easier if you use the correct spelling of Ricardo's last name. It is: Ricardo Narvaja. :yay: ( I suspect that, like I often do, the mispelling was just a "typo") And he is a living example that a man who works in a field completely unrelated to computers can acquire excellent skills as a reverse code engineer.

You will find many reference to him here and on the exetools forum, where his nick is ricnar456. He has written many fine and informative tuts on ARMA, also in Spanish, his native language, and leads to many of them can be found by searching here and on the net. :yay:

Regards,
tenketsu
02-05-2005, 10:18 AM
Thanks for correct me =)
Vodka
02-05-2005, 12:04 PM
Nice!

Translation can be found at hxxp://armadillo.cjb.net
hosiminh
02-21-2005, 04:11 AM
I got 404 Error on above link ( @rmadillo.cjb.net) . Does any have a mirror/alternative ?
fighter_81
02-21-2005, 04:37 AM
i am not at home but when i arrived at home, this evening if you give me your e-mail i will send it to you.
Regards
FIGHTER_81
disavowed
02-22-2005, 12:53 AM
You will find many reference to him here and on the exetools forum, where his nick is ricnar456.
he also is (or at least was) relatively active on the ollydbg users' forum
codeX
03-23-2005, 12:33 PM
Hi Vodka,

Please share the translated tut.
Snowski
04-18-2005, 10:13 AM
Yeah, would love to see the translated tut...if you want, I will post it somewhere.


KeyGen-Me Crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > KeyGen-Me Crackme
PDA

View Full Version : KeyGen-Me Crackme

active bytex
02-01-2005, 09:15 PM
Hi all

This crackme is really easy for the newbies that give the first steps inside the keygenerators.

The KeyGen_Me change the number every that is executed , and have Aspr protection.

You CANN'T PATCH or UNPACK! - Only can make a KeyGenerator.

Enjoy :yay:

ActiveByTex
evaluator
02-02-2005, 05:09 AM
on W98 Asprotect can't finish unpacking & dislpays errors;
Seems becuase it is unregistered Aspr!?
ZaiRoN
02-02-2005, 10:25 AM
Hi! The KeyGen_Me change the number every that is executedI have taken a little glance at the target but seems like I can use the same serial every time I run the crackme. I am pretty sure its machine dependent, btw.
Can someone confirm this?

and have Aspr protection.This doesn't increase the level of the crackme. You can see almost all the crackme's code using Dede ;)

Regards,
ZaiRoN
active bytex
02-02-2005, 02:40 PM
Hi All!

I have taken a little glance at the target but seems like I can use the same serial every time I run the crackme. I am pretty sure its machine dependent, btw. Can someone confirm this?

Great Point! I explain badly, the serial number doesn't change every open the crackme, the serial number changes if you put a correct serial number. It's the point for only is possible make a keygen.

Yes! the number dependent the PC, if you run in other machine the number change.

This doesn't increase the level of the crackme. You can see almost all the crackme's code using Dede ;)

I pack the file to prevent them from modifying the crackme, because with a few jumps the crackme it's cracked. :sneaky:

I attach the crackme without ASPR .

Enjoy! :yay:
evaluator
02-02-2005, 02:40 PM
i can confirm, this KGen is about
RPCRT4.DLL UuidCreateSequential for(WinVer5) or UuidCreate for less WinVer.

& Am i correct, when say - this aspr not loads on W98SE!?
active bytex
02-02-2005, 03:07 PM
I don't undestand :confused: i test the file with ASPR in Win98se and works fine :confused:

Download the attach in my other post , sure works for you!

Enjoy! :yay:
evaluator
02-02-2005, 04:27 PM
nope, it can't finish unpack under W98se, displays error with big strings..
but on XP runs so we have legal resons to unpack it for newbies..

ye, not bad crackme for newbies, if they also will try to KG using again Delphi.

ps. Zairon, uid will different also per system, but don't care about. call same
func..

[edit] ok, i removed attachmemt
TQN
02-02-2005, 11:40 PM
We can place a breakpoint at 004519BA (_LStrCmp), we will find the serial at EDX. If we found a correct serial, the correct serial will be save to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\EmuSN. The crackme will invoke a command: NET START EmuND. I don't know and don't understand this command. A dangerous code or why ???
Regards,
TQN
active bytex
02-03-2005, 01:06 AM
goodd!!! :yay:

When you have a correct serial number the keygen me start a "process" NOT dangerous (not start nothing in PC ) only is the process that changes the serial number when you initiate again the keygen me.

Enter a valid serial number and check this!

Enjoy! :yay:
TQN
02-04-2005, 02:41 AM
The "net start xxx" will start a Win32 xxx service. I don't know about EmuND service, and it is not existed on my computer (WinXP SP1 and Win2K). Your keygen-me not extract or create any exe to register a service. So, how does it change the serial number ???
active bytex
02-04-2005, 03:49 AM
The "net start xxx" will start a Win32 xxx service. I don't know about EmuND service, and it is not existed on my computer (WinXP SP1 and Win2K). Your keygen-me not extract or create any exe to register a service. So, how does it change the serial number ???

Give me a keygen , or/and correct serial number ...the process not start nothing , search in the code and the change serial number :sneaky:

look and tell me if the keygen me make other process ... :-/

Enjoy! :yay:
Ricardo Narvaja
03-12-2005, 05:51 AM
i´m trying download the archives and the two archives are corrupted (bad CRC in the rar when unzip), do you can, reupload or put a link to a valid file?

Ricardo Narvaja
Kayaker
03-12-2005, 07:51 PM
Hi Ricardo,

I don't have these recent files as backups. Maybe we can coerce JMI or someone else to upload them.

K.
JMI
03-12-2005, 08:31 PM
Sometime between now and tomorrow evening, I will try to get the attachments issues sorted out. :yay: Only real world work has prevented me from fixing the attachments already. The problem is related to a backup made with a version of mySQL using one characterset and our current Forum running a restored backup and running a later version of mySQL using a different characterset. :whoops:

Regards,
JMI
03-12-2005, 09:15 PM
Hum? Ricardo:

I may have misread your post. When you said "archive" files, I thought you were referring to the "Forum Archive" linked at the bottom of the Forums. I just reloaded the zip and "multi-part" versons of the January 2005 "Archive.". :eek: I have downloaded them again, and they seem to work fine.

Reading you Post again, I am guessing you really want to two "attachments" listed in this Thread. I will re-upload those for you in the next few minutes. :yay:

I have now re-uploaded the two attachments in this Thread:

Keygenme01_Active_ByteX.zip, and KeyGen_Me.zip

I then downloaded and extracted both files. Both worked correctly on my machine.

Regards,
ZaiRoN
03-13-2005, 04:44 AM
Thanks JMI ;)
Ricardo Narvaja
03-13-2005, 05:06 AM
yes i download now and are perfect, thanks.

Ricardo Narvaja
TQN
03-13-2005, 10:37 AM
This is my keygen for Keygenme of ActiveByTex. In the zip file is keygen.exe and keygen Delphi source code. I write and test only in my WinXP. But it can run on WinNT or above (2000, ...)
Regards,
TQN


Article: The Misuse of RC4 in Microsoft Word and Excel
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Article: The Misuse of RC4 in Microsoft Word and Excel
PDA

View Full Version : Article: The Misuse of RC4 in Microsoft Word and Excel

dELTA
02-02-2005, 05:09 AM
A couple of weeks old, but still deserves a link if someone missed it:

The Misuse of RC4 in Microsoft Word and Excel:
http://eprint.iacr.org/2005/007


decrypt decompile precompiled resources
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > decrypt decompile precompiled resources
PDA

View Full Version : decrypt decompile precompiled resources

blabberer
02-02-2005, 06:35 AM
any idea what the heck is a precompiled resource and how to include them in an exe and if it was included then how to rip them off and and decompress
decrypt de whatever it modify them and re compress,compile and crypt it
back into the original application

well google yielded some info that a precompiled resource maybe *.res but analyzing ( i mean simple comparing of some arbitary rsrc.res file with the out put of reshack hacked
precompiled resource dont show any kind of match

the signatures are different
the precompiled resource has a signature of Cpd`& and none of the first three pages in google yield anything decipherable to my dumb brain

the precompiled resource is used like this by the application

FindResource()-->LoadResource-->LockResource-->GlobalAlloc--->Decompress---> then blah blah blah the blah is of no concern to me
i memory dumped the decompressed output

so basically if i modify it can i compile it with modification and use reshack to
add that instead of original if yes some pointers would be helpfull

the app is coded in bcb so it probably uses brc something to precompile it is what i think or is precompiling a home grown concept ??

well i dont want to reverse the decompress or rip it and recode it
at the moment if i find some simple answers which i may have obviously missed
any questions comments are welcome no search the blah blah black ship please :devil: :D
thanks and regards
JMI
02-02-2005, 07:19 AM
I believe that is "blah blah black sheep," but we all know that I'm spelling challenged, so who am I to attempt such corrections. :smug:

Regards,
blabberer
02-02-2005, 07:45 AM
haha the fish ate the worm and got hooked into the bait i was wondering how :confused: why :confused: i couldnt hook it for 36 posts welcome to my cosy little osier
btw how did the ship taste was it baa baa or blah blah
JMI
02-02-2005, 08:02 AM
Sorry blabberer:

You did not hook anyone or anything. I simply used your alliteration as you provided it to poke fun at my own spelling deficiencies (which I spelled with two "f"s the first time I wrote it here. :thinking: ).

But it was a nice try. :yay:

Regards,


The end of win 2k is programmed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > The end of win 2k is programmed
PDA

View Full Version : The end of win 2k is programmed

Neitsa
02-02-2005, 05:19 PM
Hello,

This is official, the end of windows 2000 is coming. The SP4 will be the last SP for windows 2000, and a latest hotfix (all fix which has come since the SP4) will come on march 2005.

The free support will be abandonned on June 2005, and you'll have to pay for support from now on.

It makes me sad, since I trully like this O.S, and I've never be able to appreciate win XP. IMHO, win 2k is trully a stable and reliable O.S.

Even if longhorn is far (seems to come in 2007), MS have choosen to make win 2k an 'old O.S' from now on...

Things like this have to come, but I'll continue to use win2k until i can switch to stable 64 bits O.S.

Well, this post isn't very important and is not a big deal, but that's just a point of vue from a user which has discovered windows internals, sys coding and many features with this O.S...

Regards, Neitsa.
disavowed
02-02-2005, 08:45 PM
It makes me sad, since I trully like this O.S, and I've never be able to appreciate win XP.
Then upgrade to Windows 2003
Aimless
02-03-2005, 02:56 AM
Server! it should be added, as there is no 2003 Professional.

Seriously, I think XP is better than 2000 Professional. But then, that's just me.

Have Phun.
Silver
02-03-2005, 11:09 AM
It'll be extended, I bet, just like NT4 was. For anyone that's interested:

http://support.microsoft.com/gp/lifewin
TBone
02-03-2005, 02:43 PM
/shrug

XP is basically just 2000 with a face-lift. The core OS isn't really all that different, SP2 modifications not withstanding. With minimal effort, you can configure it to look and behave just like 2000 did. So I consider it largely moot for the desktop market.

On the business end, however, this seems incredibly assinine. I've got to agree with Silver on this one - they'll extend support. Since Microsoft can't meet their own deadlines with Longhorn, Windows 2000 server is only one version behind. Discontinuing support for it under the auspices of it being "too old" only underscores their own failure to release a newer version in a timely fashion.

The fact is that tons of businesses are still running primarily on Windows 2000 server. 2003 just wasn't a big enough of a difference to justify the cost of upgrading for most people. If they yank support in June, people will cry bloody murder. Plus, wasn't XP released in 2001? How would people react if MS announced they were discontinuing support for XP next year?
evaluator
02-03-2005, 04:10 PM
"BWHA_HA"!?

now is GOOD time for remember many_ones said phraze:

"W9x is dead OS, move to w2k"..
so wich will die first, that is yet question:)
Woodmann
02-03-2005, 08:02 PM
See this for what it is, a marketing ploy by MS to see how the public will react.

Yes, I think 98 should be finished but, to even consider the other OS's to be on the verge of relegation is foolish.
ME and 2000 will probably be done by the end of 2005 when they finally release the next OS that is somewhat stable. Server 03 should be pretty much secure until they release something better. I also agree that 03 is no big deal. I had it and I dumped it to go back to plain 'ole 2000.

Now I have XP and I hate to say it but, bundled with this very commercial computer, I have no complaints.
And that is scary :eek:

Woodmann
Silver
02-04-2005, 01:36 PM
The fact is that tons of businesses are still running primarily on Windows 2000 server

There are tons of business still running NT4, and Microsoft know it. The upgrade path and timescale for the server market is moving too fast. Businesses won't take risks with untested and unproven technology, which means waiting for it to mature. By the time a sizeable amount of businesses have decided that the "latest" tech is now suitable and stable, half its lifecycle has passed.

Eventually Microsoft are going to hit massive resistance with their forced-upgrades policy.


Is this real ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Is this real ?
PDA

View Full Version : Is this real ?

doco
02-03-2005, 04:30 AM
hxxp://msmvps.com/chrisl/archive/2005/01/31/34499.aspx

Any idea where to get those 2 progs : DRMDbg and DRM2WMV ?
JMI
02-03-2005, 07:26 AM
This appears to be a really stupidly disguised "tool request," which is generally prohibited by our rules. :whoops:

And if you'd actually read the article, you might have noticed the last line, which says:

Update: Thanks to the information provided by ArchAngelKing, it is looking more and more like there is no crack for DRM10. If anyone has information otherwise, please post. :-)

There is nothing there which appears to confirm the tools actually exist or that they are available.

Time for you to go back and actually READ the FAQ. :idea:

Regards,
volodya
02-03-2005, 09:53 AM
MS DRM is using ECC open key crypto + some symmetric algoes. As people are saying, the crypto there seems to be pretty well implemented. Try reading this:

http://home.wanadoo.nl/lc.staak/freeme.htm

The main idea of the proggies you've cited is they CANNOT decrypt the file WITHOUT the key. Meaning - you MUST bye a VALID one and, only after it, the whole DRM crap will be removed from vmw.


Aristocrats
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Aristocrats
PDA

View Full Version : Aristocrats

dELTA
02-03-2005, 03:47 PM
http://up2.fastuploads.com/joke.wmv.zip

(http://www.imdb.com/title/tt0436078/#comment)

:D


Looking for some help with softice and installshield methods
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Looking for some help with softice and installshield methods
PDA

View Full Version : Looking for some help with softice and installshield methods

kittmaster
02-06-2005, 08:57 AM
I'm looking to find the highest level of access to my target, I have access to the demo versions and edu version available, but I'd like to find the top tier key that unlocks the entire program (I've been told directly by support that the iso I have will turn into the top tier program with the correct serial). I'd like my own personal copy of the top tier version. I've never attempted a compressed installation attack before, I've been through all the crackmes, but none address how to handle compressed comparison of the strings.

The one thing I don't understand is how to get from script decompilation to the actual breakpoints under ice to verify the number routines, most of the tuts make a lot of assumptions and I don't have enough information get from one point to the next and could use some guidance.

This is all part of the compressed installer that I'm trying to i figure to get the right password. The latest tuturials are dated 2001 and the ones that are out there make a lot of assumptions.

If someone is willing to take a look, I'll send the links to the isos if it can be done.

Can anyone help? What do the Lnumbers mean, the place holder?

The serials look like

L=letters
X=Numbers

LL-XXXX-XXXXX-XXXX-XXXXX

but from what i've seen, it will take the code without the - so it will look like

LLXXXXXXXXXXXXXXXXXX

Anyone?

This is the setup.ins file, below is the value.shl which contains the locator variables, and belwo that is the hex infomation

lNumber6 = LAST_RESULT = 0;
lNumber5 = lNumber5 && lNumber6;
lNumber6 = lNumber2 = 116;
lNumber7 = lNumber2 >= 136;
lNumber8 = lNumber2 <= 145;
lNumber7 = lNumber7 && lNumber8;
lNumber6 = lNumber6 || lNumber7;
lNumber5 = lNumber5 && lNumber6;
if (lNumber5 = 0) then
goto label197;
endif;
lNumber2 = lNumber2 - 100;
NumToStr(lString2, lNumber2);
NumToStr(lString3, lNumber3);
SetByte(string14, lNumber2, 49);
lNumber5 = lNumber3 = 0;
if (lNumber5 = 0) then
goto label196;
endif;
lNumber5 = lNumber2 = 16;
if (lNumber5 = 0) then
goto label182;
endif;
lString6 = "Gerbtool";

label182: //Ref: 005C3E
lNumber4 = 1;
lNumber5 = lNumber2 = 36;
if (lNumber5 = 0) then
goto label183;
endif;
lNumber4 = 5;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "5" + lString7;
goto label192;

label183: //Ref: 005C7C
lNumber5 = lNumber2 = 37;
if (lNumber5 = 0) then
goto label184;
endif;
lNumber4 = 10;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "10" + lString7;
goto label192;

label184: //Ref: 005CD3
lNumber5 = lNumber2 = 38;
if (lNumber5 = 0) then
goto label185;
endif;
lNumber4 = 15;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "15" + lString7;
goto label192;

label185: //Ref: 005D2B
lNumber5 = lNumber2 = 39;
if (lNumber5 = 0) then
goto label186;
endif;
lNumber4 = 20;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "20" + lString7;
goto label192;

label186: //Ref: 005D83
lNumber5 = lNumber2 = 40;
if (lNumber5 = 0) then
goto label187;
endif;
lNumber4 = 25;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "25" + lString7;
goto label192;

label187: //Ref: 005DDB
lNumber5 = lNumber2 = 41;
if (lNumber5 = 0) then
goto label188;
endif;
lNumber4 = 35;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "35" + lString7;
goto label192;

label188: //Ref: 005E33
lNumber5 = lNumber2 = 42;
if (lNumber5 = 0) then
goto label189;
endif;
lNumber4 = 50;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "50" + lString7;
goto label192;

label189: //Ref: 005E8B
lNumber5 = lNumber2 = 43;
if (lNumber5 = 0) then
goto label190;
endif;
lNumber4 = 75;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "75" + lString7;
goto label192;

label190: //Ref: 005EE3
lNumber5 = lNumber2 = 44;
if (lNumber5 = 0) then
goto label191;
endif;
lNumber4 = 100;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "100" + lString7;
goto label192;

label191: //Ref: 005F3B
lNumber5 = lNumber2 = 45;
if (lNumber5 = 0) then
goto label192;
endif;
lNumber4 = 250;
StrLoadString("", "NUM_NET_USERS", lString7);
lString6 = "250" + lString7;

label192: //Ref: 005CB8 005D10 005D68 005DC0 005E18 005E70 005EC8 005F20 005F79 005F94
lNumber5 = lNumber4 > number46;
if (lNumber5 = 0) then
goto label193;
endif;
number46 = lNumber4;

label193: //Ref: 005FE6
StrFind(string13, lString0);
lNumber5 = LAST_RESULT;
lNumber5 = lNumber5 < 0;
if (lNumber5 = 0) then
goto label195;
endif;
StrCompare(string13, "");
lNumber5 = LAST_RESULT = 0;
if (lNumber5 = 0) then
goto label194;
endif;
string13 = lString0;
goto label195;

label194: //Ref: 00604A
lString7 = string13 + ":";
string13 = lString7 + lString0;

label195: //Ref: 006022 006060
goto label196;

label196: //Ref: 005C1E 006084
StrLoadString("", "FEATURE_VALID", lString7);
Sprintf(lString5, lString7, lString6);
AskYesNo(lString5, 1);
lNumber0 = LAST_RESULT;
lString0 = "";
goto label198;

label197: //Ref: 005BD4
Delay(2);
StrLoadString("", "FEATURE_INVALID", lString7);
AskYesNo(lString7, 1);
lNumber0 = LAST_RESULT;

label198: //Ref: 0060CD
goto label178;

label199: //Ref: 0059C0
lNumber5 = number46 <= 2;
lNumber5 = number45 && lNumber5;
if (lNumber5 = 0) then
goto label200;
endif;
StrLoadString("", "NET_USERS", lString7);
MessageBox(lString7, -65534);

label200: //Ref: 006133
return(lNumber0);
return;
end;

// ------------- FUNCTION function119 --------------
function function119()
number lNumber0;
number lNumber1;
number lNumber2;
number lNumber3;
number lNumber4;
number lNumber5;
number lNumber6;
number lNumber7;
number lNumber8;
number lNumber9;
string lString0;
string lString1;
string lString2;
string lString3;
string lString4;
string lString5;
string lString6;
string lString7;
string lString8;
string lString9;
string lString10;
string lString11;
string lString12;
begin
RegDBSetDefaultRoot(-2147483646);
lString5 = "";
lString6 = "\\Software\\"TARGET NAME REMOVED"\\"TARGET NAME REMOVED"\\Install";
RegDBCreateKeyEx(lString6, lString5);
RegDBSetKeyValueEx(lString6, "Link", 1, "0", -1);
OpenFileMode(2);
lString11 = SRCDIR ^ "..\\";
OpenFile(lNumber4, lString11, "netreg.ini");
lNumber9 = LAST_RESULT;
lNumber9 = lNumber9 < 0;
if (lNumber9 = 0) then
goto label47;
endif;
return(-1);

label47: //Ref: 001FF1
CloseFile(lNumber4);
lString11 = SRCDIR ^ "..\\";
lString11 = lString11 + "Netreg.ini";
GetProfString(lString11, "install", "Serial", string7);
lString11 = SRCDIR ^ "..\\";
lString11 = lString11 + "Netreg.ini";
GetProfString(lString11, "install", "FC", string13);
lString1 = SRCDIR;
StrFind(lString1, "setup");
lNumber0 = LAST_RESULT;
lNumber9 = lNumber0 >= 0;
if (lNumber9 = 0) then
goto label48;
endif;
SetByte(lString1, lNumber0, 0);
goto label49;

label48: //Ref: 0020B8
lString1 = SRCDIR ^ "..\\";

label49: //Ref: 0020D3
Ishield5.CheckSerialNumber(string7, lString10, lNumber6, number44);
lNumber5 = 0;

label50: //Ref: 0021D6
lNumber9 = lNumber5 <= 46;
if (lNumber9 = 0) then
goto label53;
endif;
NumToStr(lString9, lNumber5);
lString11 = SRCDIR ^ "..\\";
lString11 = lString11 + "Netreg.ini";
lString12 = "F" + lString9;
GetProfString(lString11, "install", lString12, lString8);
StrCompare(lString8, "1");
lNumber9 = LAST_RESULT = 0;
if (lNumber9 = 0) then
goto label51;
endif;
SetByte(string14, lNumber5, 49);
goto label52;

label51: //Ref: 002194
SetByte(string14, lNumber5, 48);

label52: //Ref: 0021AF
lNumber5 = lNumber5 + 1;
goto label50;

label53: //Ref: 00211F
TARGETDIR = lString1;
string4 = TARGETDIR;
number48 = 1;
number47 = 0;
lString5 = "";
lString0 = "0";
lString6 = "\\Software\\"TARGET NAME REMOVED"\\"TARGET NAME REMOVED"\\Install";
RegDBCreateKeyEx(lString6, lString5);
RegDBSetDefaultRoot(-2147483646);
RegDBSetKeyValueEx(lString6, "Link", 1, "1", -1);
number45 = 1;
StrLoadString("", "PRODUCT_NAME", SHELL_OBJECT_FOLDER);
return(0);
return;
end;

C:\1>

This is the value.shl file

[Data]
FINISHED=Setup has finished installing %P on your computer.
PRODUCT_NAME_DEMO= "TARGET NAME REMOVED"
TITLE_MAIN="TARGET NAME REMOVED"
DISK_SPACE_REQUIREMENTS=Drive requirements:
DISK_SPACE3=%s requires approximately %dMb of free disk\nspace on drive %s.
ACROBAT_ERROR=Unable to find Adobe Acrobat. You will not be able to view the User Guide.
ERROR_SVGARESOLUTION=This program requires VGA or better resolution.
DONGLE_INCORRECT=The serial number you entered does not match the one in your Dongle.
FEATURE_VALID=Valid Feature Code for %s.\n\nDo you wish to enter another Feature Code?
PRODUCT_REG="TARGET NAME REMOVED"
COMPANY_NAME="TARGET NAME REMOVED"
ERROR_COMPONENT=Component:
DB_MISSING=Unable to convert database.
ICON_COMPONENT_HELP=Component Help
COMPANY_NAME16=Company
FEATURE_INVALID=This is not a valid Feature Code. Would you like to try again?
ERROR_SPACE_PATHNAME=Spaces in pathnames are not supported. Please use a pathname without spaces.
FOLDER_NAME_DEMO="TARGET NAME REMOVED"
OVERWRITE_FILES_OLD=Setup has found a copy of "TARGET NAME REMOVED" in the selected destination directory and will overwrite the files.\nAll changes made to your User Library will be copied into the new "TARGET NAME REMOVED" Library.\n\nDo you wish to overwrite the files?
DB_CONVERT1="TARGET NAME REMOVED" Setup has located an earlier version of the User Database on this computer.
LAUNCH_NEW_SETUP=Launching Setup for %s...
ICON_APPEND=User Guide Appendices
PRODUCT_VERSION=7
ERROR_MOVEDATA=An error occurred during the move data process: %d
ERROR_FILEGROUP=File Group:
DONGLE_INSERT=This version of %s requires a Dongle. Please make sure it is firmly inserted into a parallel port.
OVERWRITE_FILES=Setup has found a copy of “TARGET NAME REMOVED” in the selected destination directory and will overwrite the files.\n\nDo you wish to overwrite the files?
DB_CONVERT2=Would you like to copy this database into your new User Database in "TARGET NAME REMOVED"?
INSTALL_ABORT=Setup will now terminate.
DISK_SPACE="TARGET NAME REMOVED" requires %dMB of free disk space on drive %s.\nYou only have %dMB available.\nChoose the 'Back' button and select anoother drive or\nchoose 'Cancel' to quit.
UNINST_KEY_DEMO="TARGET NAME REMOVED"
DB_CONVERT3=This procedure will not affect the existing database. If you choose not to proceed with this conversion at this time you may convert later from within "TARGET NAME REMOVED".
ICON_HELP="TARGET NAME REMOVED" Help
UNINST_KEY="TARGET NAME REMOVED"
TITLE_MAIN_DEMO="TARGET NAME REMOVED"
UPGRADE_PROMPT3=Unable to find "TARGET NAME REMOVED" on your system.\n\nPlease install a previous version of "TARGET NAME REMOVED" before installing this update.
TITLE_CAPTIONBAR="TARGET NAME REMOVED"
UPDATE_USER_DATABASE_FAILED=Library update failed.The parts in your User Library were not merged into the new "TARGET NAME REMOVED"Library.
UPGRADE_PROMPT4=Unable to find the correct version of “TARGET NAME REMOVED” on your system.\n\nThis update can only be used with %s.
ICON_GET_START="TARGET NAME REMOVED" Getting Started
SERIAL_VERIFY=Verifying serial number ...
FEATURE_TEXT=Some versions of "TARGET NAME REMOVED" require a code to enable certain features of the software.\nIf you were supplied with a Feature Code, type it in now. Otherwise, click Next to continue.
ICON_README=Read Me
ICON_USER_GUIDE="TARGET NAME REMOVED"User Guide
INSTALL_ACROBAT=The online User Guide requires Adobe Acrobat.\nIf you do not have it installed on your computer, you may install it now.\nAt the end of the Acrobat install, if you are prompted to re-boot your computer, please select No.\n\nInstall Adobe Acrobat?
SERIAL_OK=Valid serial number for %s.
PRODUCT_NAME16=Product
ERROR_FILE=File:
FOLDER_NAME="TARGET NAME REMOVED"
SERIAL_INVALID=Incorrect serial number.
DONGLE_INSERT_TITLE=Insert Dongle
CONGRAT1=Congratulations on successfully installing "TARGET NAME REMOVED".\n\n "TARGET NAME REMOVED" has been shipped with a number of sample designs so you can explore all its functionality.\nThey are located in a "Samples" directory inside the "TARGET NAME REMOVED" main directory.\n\n
UPDATE_USER_DATABASE=Merging User Library into new "TARGET NAME REMOVED" Library...
CONGRAT2=NOTE: This software requires a Release Code to be inserted within 15 days of installation.\nTo obtain the Release Code, you should contact "TARGET NAME REMOVED" or your local distributor.\n\nWeb: "TARGET NAME REMOVED" (preferred method)\n
TITLE_CAPTIONBAR_DEMO="TARGET NAME REMOVED"
UNINST_DISPLAY_NAME_DEMO="TARGET NAME REMOVED"
UNINST_DISPLAY_NAME="TARGET NAME REMOVED"
PRODUCT_KEY="TARGET NAME REMOVED"
CONGRAT3=Phone: xxxxxxxxxxxxxxxxxx (North America Only)
NUM_NET_USERS= user Network Version
NT_MSG1=This installation requires Administrator Privileges.
PRODUCT_NAME="TARGET NAME REMOVED"
ERROR_UNINSTSETUP=unInstaller setup failed to initialize. You may not be able to uninstall this product.
NET_USERS=You did not enter a feature code which determines the maximum number of users able to run “TARGET NAME REMOVED” on a network.\n"TARGET NAME REMOVED" will now install as a single user version.
UPDATE_VERSION=This will update your version of "TARGET NAME REMOVED"program files to %s. Do you wish to continue?
NT_MSG2=Setup needs to make changes to your system configuration and cannot proceed without Administrator Privileges.\n

[General]
Language=0009
Type=STRINGTABLESPECIFIC
Version=1.00.000
FrankRizzo
02-07-2005, 11:51 PM
I've done some installshield work before, so I can help some.

the lnumbers are just temp variables from all I have been able to gather. The usage is what makes them look strange. For instance in normal C "lNumber6 = LAST_RESULT = 0;" would translate to "set both lNumber6 AND LAST_RESULT to 0". Not so in IS code. What it does here, is store the result of a boolean test, which, in C, would look more like lNumber6 = (LAST_RESULT == 0) ? 1:0;

So, as you now see, that whole block of code at the top is nothing more than a bunch of boolean tests, and a couple of "JUMP if 0"s. As for debugging it, the first thing that I determined was that it wasn't very debuggable with SI. BUT, It IS very close, code-wise, to VB. So, I took the code that I was working on, and just rewrote small bits in VB, and made a keygen that way.

Now, it looks like you found the RIGHT code, but the important stuff appears to be right ABOVE the sample you included. For instance, we have no way to know where the value for lNumber2 comes from. I would assume that it MIGHT be from the text that you enter, but I can't be sure.
kittmaster
02-22-2005, 08:31 PM
FrankRizzo

Thank you for the response, it makes a lot of sense. What is the best way to pass these arguement test into vb? I keep getting errors like variable not defined and the whole gammot. The script file is totally incomplete. It exceeds the forums maximum character counts.

What is the success rate for finding the right serial for the install? All these numbers have to be discovered easily. I also found the serial check export routine in a temp file called ishield5.org but can seem to find where in the exe it is called.

I've read every tut I can get my hands on.......still can't seem to put it together.

Any other insite that you might be able to pass along?

thanks again

Chris
FrankRizzo
02-22-2005, 08:57 PM
Well, what I did on my target, was just rewrite the code from the point where it gets the input data from the dialog box fields, up to the point where it called the bad-boy message box. It's not really hard at all. You just paste the code in, and convert those stupid formatted compares that we spoke of earlier, into IF THENs. Most of the math stuff worked as is. (IIRC). So, the first 2 steps that you should do if you haven't. Find the place where it gets the values from the dialog box. Number 2, find the place where it complains about your number being invalid. Now, you have a start, and an end. With the code being relatively simple as it is, you should be able to "run" the code with calc.exe, and maybe a sheet of paper. (Talk about feeling the zen of the code!). MOST of the time, the calcs aren't super complicated, just tedious.

Once you understand the PATH it takes to get to the message box, you can figure out how it got there, and further decrease the amount of code between your start, and end. Once you get it to THIS point, you can put THAT code into VB, and make it run.
Then, you can single step it, watch variables, etc.

Sometimes you have to do THIS kinda stuff. I was working on a PowerBuilder app, and I had to download a trial version of PB to be able to clarify what this REALLY BIZARRE block of code did, but I ended up making it work, and wrote a keygen in VB.net.

More than anything else, reversing is all about thinking outside the box. The more unconventional your approach, the less likely it is that the programmer of the protection thought of it!
kittmaster
02-22-2005, 09:03 PM
This target is very confusing. What you said makes perfect sense, this target actually is tier level controlled based upon the number entered and its allllllways complaining about an invalid number..........LOL. The script decompilation seems to be massive and I'm unable to follow the entry point of the script sequencing because of the tier option controls. Do you think you could contact me via email or maybe a one on one direct chat via IM? If not I understand. You can send me an email or pm via my profile of this board?

Thanks again for the fast response

Chris
JMI
02-22-2005, 10:16 PM
Kittmaster:

When you respond, try to use the small button on the far right or the Quick Reply feature at the bottom, rather the Quote Button.

Using the Quote Button, when "quoting" some part of the previous post is not actually required to may the follow-up, simply doubles up the storage load of the previous post. You quoted FrankRizzo's entire post, without any need to do so. If some part relates, specifically to your response, just quote that part. This saves room in the database for new information. :yay:

Regards,
kittmaster
02-22-2005, 10:18 PM
No problem, I'll edit my post after I submit this one.

EDIT: Looks like you already did it for me.......LOL...thanks

Regards,
Chris
JMI
02-22-2005, 10:26 PM
No big deal. Just an attempt to remind everyone who may read my response of some general considerations for assisting the proper maintenance of the database load. :idea: You did notice to remove the target identifying information, and that was a GOOD thing. :yay:

Regards,
kittmaster
02-22-2005, 10:28 PM
Not to make this thread any longer than necessary..................<but I think I had a little help with that one...........LMAO>

I love this sight.......I missed it while it was "gone"

Chris


Newbie ReverseMe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Newbie ReverseMe
PDA

View Full Version : Newbie ReverseMe

lucid_dream
02-06-2005, 07:06 PM
Hi all,

I've been hanging around here for a while now reading, and thought I'd contribute something back, I made a ReverseMe that I think might be good for newbies (although I think it would be a little too easy for most of the gurus around here ;) )

Let me know what you think... Any comments/criticism welcome.

The object is to get the password, if you patch it to jump to "good boy" routine, it just echo's the wrong password back.

Regards,

lucid
blabberer
02-07-2005, 05:22 AM
nice to see the crackme but you should guard your buffers against over flow
and should force null terminators when using string functions like lstrcat()
also you should memmove(NULL) on your buffers if you wish to play with strings :)
that way you will not run into strange problems like
your subsequent lstrcats concating more passwords to the old string

0012FD00 00000000 |hOwner = NULL
0012FD04 00403110 |Text = "The password is ********The password is ********Th6032F9CE9BA8D6E1The password is ********"
0012FD08 0040300C |Title = "Crackme #2 by lucid_dream"
0012FD0C 00000000 \Style = MB_OK|MB_APPLMODAL
lucid_dream
02-07-2005, 05:53 AM
Ok I'll bear all that in mind for my next one ;) Thanks for posting.

So you got the right password then? Was it too easy?

The idea was just that it would last a bit longer for newbies than a simple "change jne->je" or whatever.

Btw I thought I'd mention I'm new to Win32ASM programming (although I've done C for a while) and that's what I wrote it in, as I get better at ASM no doubt my crackmes will get better! :)
blabberer
02-08-2005, 04:20 AM
well it has got nothing to do with asm or c or delphi its basically the basic
considerations for programming i was ranting at :)
what do you mean by did i get the right password are there lot of passowrds that
would qualify ?? :( i just got out with the first one that puts out a messagebox saying the password word is blah blah :devil: i was hoping it was tougher than that
secretly i dunno if my hope is right


dongel emulator and reg key
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > dongel emulator and reg key
PDA

View Full Version : dongel emulator and reg key

whowho
02-07-2005, 12:07 AM
Dont u hate a newbie?
Ok.. i have a dongel emulator and a "trial" that has exspired. This trile when clicked on, modifies the registery. I have tried to open it in hex editors and a few other programs with luck. Now, i have no idea what I am looking for, to remove the trial limitations. The only programing i know (badly) is html.
I think my first question is. where do i start? Am I on the right track? hints? sugestions? tips?
JMI
02-07-2005, 12:38 AM
You can not run before you learn to crawl. If you want to reverse code engineer, you need a reasonably good understanding of the assembly language code you see in most debuggers and/or disassemblers. You need to find a copy of "The Art of Assembly." If you put that title in the search box here (without the quotes) or in your favorite search engine, you will find versions of the file in .pdf, html, and maybe others.

Once you have that and have digested some of the information, you need to search, here and on the net, for information on dongle reversing. If you know that your program modifies a registry entry, there are a number of programs available which could help you track what is being changed. Read up, here and on the net, on "registry monitors", such as regmon, for starters.

It would be essentially useless for you to simply jump into the swamp with NO IDEA what lies under the surface, and until you do some studying, and preferrably, alot of studying, you are certain to step into quicksand very soon. There is NO shortcut to taking the time necessary to LEARN the basics and not controlling your desire to simply stumble blindly through the swamp becuase you wanna get somewhere NOW is neither useful nor productive.
But, it is your choice.

You also need to actually READ the FAQ, because the form of your question shows that you really haven't. :rolleyes:

Regards,
CrackZ
02-07-2005, 05:22 AM
OK, I'm with JMI, however.....

Which dongle emulator?.

Regards

CrackZ.
mr.x
02-07-2005, 09:34 AM
I think he is talking about some application was emulated with Sentinel SUPERPRO Dongle.
whowho
02-07-2005, 09:35 AM
its sent2004. the file that i beleave has the trial limitation is for the reg.
I already have 4 full licened dongels. I have a computer that the paralel port is not working any more (i have checked everything its the port).
Its more like the company that owns the license are totalt (CENCORED) and will not replace one of my dongels with a usb dongel with out me having to spend $2200 in a program upgrade. And my business (event photography) is not doing all that well either. I really dont have the $460 to buy the emulator for this program. Im just trying to make it through the winter with enough licenses to do the job right. just being down one computer hurts my sales baldy
sigint33
02-07-2005, 11:22 PM
whowho,

My PM was RE whether the dongles were flexid - I might have been able to help you some with that, but it appears you have the superpro variety, a low cost/no work option, worth a try, is to buy an I/O card - that may give you a working parallel port again - you could probably find one for 10 or 15 bucks.

SiGiNT


ASProtect 1.3 Problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ASProtect 1.3 Problem
PDA

View Full Version : ASProtect 1.3 Problem

XFlorian
02-07-2005, 02:12 AM
Hello I've a problem with a tool which is packed with ASProtect 1.3.The last session bevore the tool started is:

00DA8AFB C601 FE MOV BYTE PTR DS:[ECX],0FE
00DA8AFE CB RETF ; Far return
00DA8AFF 3980 A7E0A3BE CMP DWORD PTR DS:[EAX+BEA3E0A7],EAX
00DA8B05 3F AAS
00DA8B06 A6 CMPS BYTE PTR DS:[ESI],BYTE PTR ES:[EDI]
00DA8B07 0B67 64 OR ESP,DWORD PTR DS:[EDI+64]
00DA8B0A 8F06 POP DWORD PTR DS:[ESI]
00DA8B0C 0000 ADD BYTE PTR DS:[EAX],AL
00DA8B0E 83C4 04 ADD ESP,4
00DA8B11 334C24 28 XOR ECX,DWORD PTR SS:[ESP+28]
00DA8B15 83D9 E1 SBB ECX,-1F
00DA8B18 59 POP ECX
00DA8B19 A1 08A4DB00 MOV EAX,DWORD PTR DS:[DBA408]
00DA8B1E C640 12 00 MOV BYTE PTR DS:[EAX+12],0
00DA8B22 A1 DC87DB00 MOV EAX,DWORD PTR DS:[DB87DC]
00DA8B27 8B80 84000000 MOV EAX,DWORD PTR DS:[EAX+84]
00DA8B2D 50 PUSH EAX
00DA8B2E 53 PUSH EBX
00DA8B2F E8 6CD1FFFF CALL 00DA5CA0
00DA8B34 8BF0 MOV ESI,EAX
00DA8B36 85F6 TEST ESI,ESI
00DA8B38 74 1B JE SHORT 00DA8B55
00DA8B3A 8D56 08 LEA EDX,DWORD PTR DS:[ESI+8]
00DA8B3D A1 08A4DB00 MOV EAX,DWORD PTR DS:[DBA408]
00DA8B42 E8 EDCEFFFF CALL 00DA5A34
00DA8B47 84C0 TEST AL,AL
00DA8B49 75 0A JNZ SHORT 00DA8B55
00DA8B4B 68 688BDA00 PUSH 0DA8B68 ; ASCII "151
"
00DA8B50 E8 F3BFFFFF CALL 00DA4B48
00DA8B55 8BC3 MOV EAX,EBX
00DA8B57 E8 C49FFEFF CALL 00D92B20
00DA8B5C 5E POP ESI
00DA8B5D 5B POP EBX
00DA8B5E C3 RETN
00DA8B5F 00FF ADD BH,BH

I set a BP at the C3 00DA8B5E. Then I open the Memory BP Window with ALT+M and set a memory BP at the code session of the tool. After pressing CLTR+F11 I landed here:

00DA9FB5 C700 8F05AAF1 MOV DWORD PTR DS:[EAX],F1AA058F-------here
00DA9FBB DD27 FRSTOR (108-BYTE) PTR DS:[EDI]
00DA9FBD 9B WAIT
00DA9FBE 2A20 SUB AH,BYTE PTR DS:[EAX]
00DA9FC0 86B5 48F38167 XCHG BYTE PTR SS:[EBP+6781F348],DH
00DA9FC6 64:8F06 POP DWORD PTR FS:[ESI]
00DA9FC9 0000 ADD BYTE PTR DS:[EAX],AL
00DA9FCB 83C4 04 ADD ESP,4
00DA9FCE 2BC3 SUB EAX,EBX
00DA9FD0 58 POP EAX
00DA9FD1 A1 0088DB00 MOV EAX,DWORD PTR DS:[DB8800]
00DA9FD6 8B00 MOV EAX,DWORD PTR DS:[EAX]
00DA9FD8 8B68 1C MOV EBP,DWORD PTR DS:[EAX+1C]
00DA9FDB A1 0088DB00 MOV EAX,DWORD PTR DS:[DB8800]
00DA9FE0 8B00 MOV EAX,DWORD PTR DS:[EAX]
00DA9FE2 8B00 MOV EAX,DWORD PTR DS:[EAX]
00DA9FE4 894424 04 MOV DWORD PTR SS:[ESP+4],EAX
00DA9FE8 A1 0088DB00 MOV EAX,DWORD PTR DS:[DB8800]
00DA9FED 8B00 MOV EAX,DWORD PTR DS:[EAX]
00DA9FEF 8D78 18 LEA EDI,DWORD PTR DS:[EAX+18]
00DA9FF2 A1 8087DB00 MOV EAX,DWORD PTR DS:[DB8780]
00DA9FF7 8858 08 MOV BYTE PTR DS:[EAX+8],BL
00DA9FFA 833F 00 CMP DWORD PTR DS:[EDI],0
00DA9FFD 75 1D JNZ SHORT 00DAA01C
00DA9FFF 83C5 20 ADD EBP,20
00DAA002 A1 6C86DB00 MOV EAX,DWORD PTR DS:[DB866C]
00DAA007 8078 09 00 CMP BYTE PTR DS:[EAX+9],0
00DAA00B 75 0F JNZ SHORT 00DAA01C
00DAA00D B8 1F000000 MOV EAX,1F
00DAA012 E8 B987FEFF CALL 00D927D0

But where's the call, which is right? Can anyone help me to find the OEP?
TechLord
02-08-2005, 01:51 AM
Please pm the target name and url to me so that I can have a look at it.
hosiminh
02-21-2005, 04:26 AM
From what you showed , it looks like you are still in aspr code , start hiting Ctrl+F11 untill you land at some 40xxxx or 50xxxx (or whatever)
When you land somewhere outside 00DAXXXX you will probably be in your target code.


Literal Bitwise Calculations
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Literal Bitwise Calculations
PDA

View Full Version : Literal Bitwise Calculations

bilbo
02-08-2005, 04:39 AM
Does anybody know if such a tool exists?

E.G.
INPUT: B xor 2 (where B is a byte)
OUTPUT: b7 b6 b5 b4 b3 b2 ~b1 0 (where bX are bits, ~b1 means NOT b1)

Thanks, bilbo
Kayaker
02-21-2005, 06:21 PM
Hi All,

This thread was started just as the server was changed (no bilbo, you didn't actually break the board ;p)
It was continued in the temp forum kindly provided by Reverse-Engineering-Community, now I copy it back to this thread for continuation.

Cheers,
Kayaker

//////////////////////////////////////////////////////////////////////////////

bilbo
Tool Request: Symbolic Boolean Algebra Bitwise Manipulator

Hello, mates,

I made this request immediately before RCE board was gone...
I hope Zero's board will no crash too...

I'm looking for a tool which can manipulate bits without knowing their values.
I've found, besides the big apps like Maple or Mathematica, other open-source apps like Yacas or Q-lang (on sourceforge), but nothing specifically devoted to Boolean Algebra.

Here is an example of what I'm talking about...
Suppose you want to evaluate the expression A^2.
In that case I will put in input (a7 a6 a5 a4 a3 a2 a1 a0) ^ (1 0)
and I will obtain in output (a7 a6 a5 a4 a3 a2 ~a1 a0).

Can you imagine the use of such a tool? Instead of trying to reverse some boolean algorithm (with intermixed boolean operators and add/sub/mult/div), which is in nearly all case impossible, I could obtain an equation for every bit of the result.

Do you think it is possible?
Thanks, bilbo

//////////////////////////////////////////////////////////////////////////////

dELTA
Except for the fact that the expressions for each bit will grow quite big after a few steps, it shouldn't be really hard to do. Can't think of seeing any specific util that does it though.

//////////////////////////////////////////////////////////////////////////////

0xf001
hi bilbo!

interesting question. i hardly use math tools (mathcad once impressed me ), for such jobs I often write small C programs but dedicated to the specific purpose. I guess you want to work "symbolic only", and then get all possibilities to reducd the number of tries or "similar?"

well, if you give some more inputs I think we can develop such thingy
so dELTA, bilbo - I have more than enough to do, but start a lillte project is always fun. what do you say?

cheers, 0xf001

PS: aahm. I must admit I do not sooo much like to develop a windows solution anymore. does that hurt?

//////////////////////////////////////////////////////////////////////////////

elfZ
I remember myself doing something like this some time ago. Not exactly boolan and bitwise, but there was some straightforward long code sequence in a (possibly crackme) which I didn't really want to dvelve into, kinda buffer manipulation or something, so the easiest way was to write a python scriptie to parse the asm listing and spit out the final results of the registers and buffer (i.e a[4] = a[3] * 5 + a[17] * 9 and stuff)

Yet I can't picture the interface for a generic tool for the tool to be useful. The situations when such an approach would be comfortable are quite different for the generic approach IMHO.

//////////////////////////////////////////////////////////////////////////////

dELTA
Quote:
so dELTA, bilbo - I have more than enough to do, but start a lillte project is always fun. what do you say?

Well, I sadly have more than more than enough to do, but anyone else may feel entirely free to do so.

//////////////////////////////////////////////////////////////////////////////

bilbo
Thanks for the answers, especially to 0xf001 for being so helpful.

The truth is that I started the project a couple of years ago (I can eventually try to dig out the sources from my hard disks and share them), but I stopped it because it was not so easy...

The application of such a toy could be enormous in crypto fields. Imagine to process a SHA-1 algorithm with this parser, knowing the final result. At the end of the process we could eventually have a system of N equations, one for each bit of the result, having as unknown variables the input bits. Obviously the equations would be extremely complicated, as dELTA stated; but could be relatively fast to find all the possible values for the input bits!!! In other words, SHA-1 would have been reversed!

So I started defining a C++ class (bit_collection) with two main methods: parse(), to resolve and simplify the bit expressions, and evaluate() to replace the literals with values 0/1, so we can check the intermediate results and debug the parser.
Why C++? Because the operators can be overloaded, and this makes very simple to describe the algorithm to be parsed.

But I got soon tangled inside the strings manipulations: I choose to represent the expressions as strings, and this was probably an error.
A stack could have been better. Yesterday I found a sample of RPN stack applied to booleans in a Google cache: h..p://66.102.9.104/search?q=cache:-vB6zpKGcPoJ:www.sunlightd.com/Projects/BooleanParse/BooleanParse.cpp.html
Even elfZ idea - processing a string in Python language - is interesting...

The biggest problem I found up to now, not yet solved, was given by additions/subtractions/multiplications/divisions. Those operations are not bitwise, and to go on in some way you have to take into account the carries and borrows from right side bit and to left side bit.
At the moment, after a raging search on Google, I'm thinking this project cannot have a solution...

But maybe the word impossible is not so correct, from an informatics point of view...

Best regards, bilbo

//////////////////////////////////////////////////////////////////////////////

naides
Hi Bilbo:

1. One tool I have found helpful, while not all encompassing to deal with problems you suggest is (urgghhh) Excel

It can perform hex to bin transforms, it can perform most if not all algebraic and boolean operations and also has an addin language (Visual basic, visual C++) in which you can code your own, more unusual functions and plug them in.

2. I once found in the net an academic article on this subject: Transforming algebraic operations into bool ops and viceversa. I will have to dig it up, it is buried in my compressed archives, but I am sure it is in one of my computers, but I know it was the dissertation of a math PhD student, 2-3 years ago.

//////////////////////////////////////////////////////////////////////////////

stingduk
yeah i was about to suggest excel but
it cant transform something above 511 to bin format
the string 101010110 blah for 511 is the max it can change
using dec2bin()

tools --> addins --> analysis toolpack (this is not added by default)
you have add it in then
all these functions pop on FX

and now to use Xor AND OR ETC you have to dig into vba
Xor doesnt work as a function And OR works as functions in the spread sheet

111111111 DEC2BIN(511)
111111111 HEX2BIN("1ff")
111111111 OCT2BIN("777")
_________________
felix qui potuit rerum cognoscere causas

//////////////////////////////////////////////////////////////////////////////

0xf001
hi all,

hmm. my opinion is c++ wold be a good if not the best choice. I know python as well and my brother is an expert in it, while I am more the perl guy for scripting languages. well, it is like perl not really slow and precompiled and powerful and esp python is a very serious language proven for years to be good and you find everything for it, but for a serious approach not to use. excel is even worse, i am sorry

you can not use it for a serious job like this. well, beeing more on linux than windows (does not mean I do not know about what I speak, I had to do fancy things in VB as well and have tons of experience in programming in nearly all flavors existing) it is a "quickhack" solution which i am sure wil turn into its limits. VB for me is a toy language, but I should not say so, as it is probably unfair and dependent on the purpose, and a flamewar I do not want to do.

But seriously we need speed and not try to f*ck VB to get things done for which it is far not designed.
You can try it and have quick some success, but are very limited in efficient data representation and handling. Efficient!
Yes you can integrate assembler, C, C++ into VB, no problem at all, but hey as I said the job is not to get VB to be able to do it, we want to do a good job and not deal with VB.
Delphi would be a far better choice if you need a click click wizard IDE

A console app can be enough, and so we can do platform independent code The gui if you need it can sit on top. And no matter whether VB, C, C++, assembler, perl/TK, GTK, KDE, MFC, blablabla you use then it is up to you. But the core in Excel - uuaaah

however, I got a little shock reading excel and VB

cheers, 0xf001

//////////////////////////////////////////////////////////////////////////////

0xf001
an addition

I hope I did not offend anybody, had much stress while posting and just wanted to give my opinion to say please let us not do this in excel / VB as I think this is not a good choice.

regards, 0xf001

//////////////////////////////////////////////////////////////////////////////

stingduk
hehe yep me too no flame war
but i would say i have done some of my keygens with excel and vba including
some old school dos apps
any way there are lot of binary num blah blah addins avl for
excel
may be taking a look into one of these addins may lead to some output
://digilander.libero.it/foxes/binum_review.htm
://digilander.libero.it/foxes/SoftwareDownload.htm
_________________
felix qui potuit rerum cognoscere causas

//////////////////////////////////////////////////////////////////////////////

0xf001
stingduk,

ok, I know and can imagine what you can do with libraries. but for what do you need excel then?
in C you say array[x] ^ array[y] voila. fast, no library call, efficient, nice.
is not it a shame to need a function to call for xor???
and if you want to write an application which can handle huge keyspace search I still think it is not good to do in excel you have to use data formats that VB understands. in C you can pointer and typecast around as you like, and make your datatypes efficient in size, usability. when VB stores strings ie in unicode there it starts
I am mainly concerned about the performance of the result and of the quirks you need to do to tell VB what you want to do ie call an XOR function. maybe i am picky, but well, i do not like to do things just "somehow" when there is a better solution i take the better solution. then I can be happy about the result

cheers, now fight back , 0xf001

PS: the question is not if it is possible in VB. the question is how the result will be (in a spreadsheet (for what), slow, pain to code), oltough I really think that you can not do in excel what bilbo really wants.

//////////////////////////////////////////////////////////////////////////////

bilbo
naides,
(1) I know people makes everything with Excel!
Someone (Vidar) can also show the Mandelbrot set! (h..p://www.vidarholen.net/contents/mandelmacro/)...
But the task we are talking about is (nearly?) impossible before starting and it is presumed to occupy huge amount of memory and cpu-time; so I think it would be better do not rely on external frameworks such as Excel or VB... stingduk pointed out also some scaring idiosyncrasies...
I would prefer more specialized applications such as Mathematica or Maple, in that case, but also them are too hungry, in terms of resources...
(2) Transforming algebraic operations into bool ops and viceversa? It sounds very interesting, but I could not find anything related on Google... Maybe I have lost a lot of that amusing jargon that people speaked at academic world and I have no more key words for researching through Google...

0xf001,
I agree in your point of view, even in your love for Linux and for console apps...
An amphibious (Linux/Windows) console app would be the best...
Perl? Python? We must first decide:
(a) if we want to go on with this (impossible?) project and, if yes, if we will parse strings or binary stacks/trees
(b) how we can bypass the carry/borrow problem
(c) who will host the project (sourceforge, woodmann?)

Best regards, bilbo

//////////////////////////////////////////////////////////////////////////////

0xf001
bilbo, I am glad somebody understands me hehe

to be honest I still did not have time to sit down and think of the problems in implementation, and also the +,-,*,/ etc problem.
also i have no real imagination yet with what kind of representation we should work. i have time in the evening and give it a brainstorm.

also to be honest I had this idea, too (but for me only about 2 months ago, wanted to do this for the last phrack release *gggggggg* ), and there realized that this is not so easy. when we work together I think we will have a chance! I was unsure and had not time to go into deep as I soon realized all the possible "maths" opcodes I would need to deal with and had not found a solution around them. and the amount of time to research, plan, test out things scared me...

so as said, I think about it and tell you what I can come up with so far

hosting should not matter. we can use any version control system, I am open, but a lazy CVS user arch rocks more I know.
from my experience sourceforge provides a damn good service (even CVS), I have one project there and love it. the question is how open you want to source

to summarize:

perl or python I think we should not use because of performance, and limits in efficient binary data handling (speed will be a matter). a compiled executable is better imho

a) impossible? i do not know. but want to try i am for binary. can be "mixed", but calculations binary -> functions can take strings, and return strings as representation, but transform to binary arrays first

b) research

c) as you like

cheeeers, 0xf001

//////////////////////////////////////////////////////////////////////////////

naides
Gentlemen,

No offense taken and no flame started.

I put forward Excel with an Urrgggghh, because its wrinkles.

I have used it for a quick hack of a relative simple problem at hand, because it is visual, and it is simple, so one does not have to re-invent the wheel from scratch every time one is faced with a problem-solving excercise. . .

If you want a more powerful, plastic, efficent and encompassing tool, then code away . . .

//////////////////////////////////////////////////////////////////////////////

bilbo
Post subject: New Perspectives...
After some researching, I've found at least two good projects on sourcefourge dealing with the initial request of this thread:

h..p://sourceforge.net/projects/qlogico/ (implemented in C++)
h..p://sourceforge.net/projects/bexpred/ (Boolean EXPRession REDucer) (in JAVA)

None of them deal with extended algebra: they do not accept in input +,-,*,/
But my initial request is (partially) satisfied.

Next step would be to introduce other algebraic operators (+,-,*,/).
I think though that we must first learn what other people have already done, first.
And since time is an issue for both of us I would suggest to wait some time before starting the project...

As for the implementative choices, 0xf001, once again, I agree with you in both cases: a compiled executable (even if BEXPRED was realized in Java), and a mixed internal representation strings/binary stack (my initial approach based on only strings was too complicated).

In the meanwhile we must also "research" about the problem of not-bitwise operators (+,-,*,/).

Best regards, and "see" you soon 0xf001
bilbo

//////////////////////////////////////////////////////////////////////////////

0xf001
naides,

when reading my posts uuups I was not in best mood it seems ahem.

well, no problem at all, I also admit to have used excel for some tasks before like calculating audio compressors *gggggggg*, so yes it is not too bad.

the thing is I have no numbers yet, but there will be huge datastructures as result and they need to be processed. Faced with VB I often ran into perfomance problems (expected, but tried anyway). well you can go further and having an ie MS-SQL server backend for the data *ggggggggg*

bilbo:
hmm. I tell you what my understanding is to see if we are talking about the same, and well I am not so expert in crypto stuff, I do not know if the tool would be able to bring an advantage faced with real encryption routines.
I thought of going through the "target" algorithm, also knowing the encrypted data. now for each instruction encountered all possible bit combinations of the input vector are stored. or you store it symbolic, does not matter. when thinking further and going through some simple algos, the number of possible input vectors increases exhaustive. I would need to go through an algo as example to compare this against full bruteforcing to see how much is won.
on the other side, I think you are talking about getting equations. can you explain that a little more?
I can probably build the equations but lacking the imagination of how to further work with them.
I know how to solve an equation system with multiple variables.
But my maths knowledge is limited
we would need to implement an "boolean/arithmetic equation solver" which takes the built equations then as input and outputs all the numeric values based on the "output vector" the encrypted block.

also I have no imagination of where comes a RPN stack in the game. I know how to work with RPN (HP calculators rock ) but all this brings me to the assumtion we are talking about sthg different, hehe

can you somehow help me with the understanding of how you want to process?
The problem with add/div, ... as long as it is "integer" I see not as problem, you get some more subtrees of modified input vectors. for all of them you need to proceed as if it was a single bit operation.

I strongly assume the advantage you see is working symbolic. When thinking of the method I had in my mind when reading my post - as I said - I do not know if this is really such a power tool compared to bruteforcing, but need to run through a real live example to be able to tell it.

I see another problem: floating point operations. uaah

cheers, 0xf001

//////////////////////////////////////////////////////////////////////////////

dELTA
The non-linear parts of more secure crypto algorithms (like e.g. the S-boxes in DES) were included to prevent the possibility to express these algorithms as equation systems, just so you know... They also make sure that the already exponential growth of the size of your expressions get a nice and big exponential base.

Like 0xf001 says, you don't have much to win on this method when it comes to real crypto algorithms, but it might indeed be useful for some serial number algos created by less mathematically gifted shareware authors though.

//////////////////////////////////////////////////////////////////////////////

bilbo
dELTA wrote:
The non-linear parts of more secure crypto algorithms (like e.g. the S-boxes in DES) were included to prevent the possibility to express these algorithms as equation systems, just so you know... They also make sure that the already exponential growth of the size of your expressions get a nice and big exponential base.

I agree with you... at least, this is the theory... But who knows that in some cases, for special input values, some flaw becomes possible?
Remember the flaw recently discovered for MD5 algorithm (google: "MD5 flaw").
A tool like the one we are discussing about could help in discovering such weaknesses and, yes, "it might indeed be useful for some serial number algos created by less mathematically gifted shareware authors".

0xf001 wrote:
when thinking further and going through some simple algos, the number of possible input vectors increases exhaustive. I would need to go through an algo as example to compare this against full bruteforcing to see how much is won.

You, and dELTA, are right, but remember that even for simple cases the bruteforce approach may require months and years of computations. With the symbolic approach, in my intuition, I feel that the bigger problem is not time but space. Not so bad, isn't it?
Remember the Rainbow Tables approach (google: "Rainbow tables")

0xf001 wrote:
on the other side, I think you are talking about getting equations. can you explain that a little more?

Let's see this stupid example...
We will work with 4-bits only integers, and we want to solve this "crackme" formula: A xor (A << 1) = 3
Uh? We use a simple bruteforce approach...

Code:

#include <stdio.h>

void
main(void)
{
int i;

for (i=0; i<0xF; i++)
if ((i^(i<<1)) == 3) printf("%x\n", i);
}

Oh! Just one solution is possible: 1...
Let's try now the symbolic approach:
(a3 a2 a1 a0) ^ ( (a3 a2 a1 a0) << 1 ) = (0 0 1 1) =>
(a3 a2 a1 a0) ^ (a2 a1 a0 0) = (0 0 1 1) =>

a3 ^ a2 = 0
a2 ^ a1 = 0
a1 ^ a0 = 1
a0 ^ 0 = 1
We start solving the last equation in the 4-equation system and we find a0=1
Next third equation: a1^1 = 1, so a1=0
Next second equation: a2^0=0, so a2=0
Finally first equation: a3^02=0, so a3=0
The input value which will satisfy our algorithm will be (a3 a2 a1 a0) = (0 0 0 1) = 1
In this stupid case, the bruteforce approach was surely faster; but what about more complex cases?

0xf001 wrote:
also I have no imagination of where comes a RPN stack in the game.

Have a look at sourceforge's sources...

0xf001 wrote:
The problem with add/div, ... as long as it is "integer" I see not as problem, you get some more subtrees of modified input vectors. for all of them you need to proceed as if it was a single bit operation.

I do not understand what you are saying, but I have found a rather simple solution to add one bit in term of boolean operators: it is the one-bit adder model!
If a and b are bits, a + b = (a XOR b) taking also in account a carry given by
(a AND b)

0xf001 wrote:
I see another problem: floating point operations. uaah

yup! I didn't think of it... Is coprocessor too involved in crypto algorithms
nowadays?

Regards, bilbo

//////////////////////////////////////////////////////////////////////////////

agnonymous
Hi!
Take a look at this stuff ..similar to what you want to do bilbo
I tried to use mathematica in the past...not the most natural tool for binary equations ..I don't know if mathematica 5 has improved support though
http://www.cryptosystem.net/
http://www.minrank.org/~courtois/myresearch.html

//////////////////////////////////////////////////////////////////////////////

bilbo
Hi, agnonymous, you make my nights even more sleepless!

Those links are really valuable and I started to study...
High application is required, tough...

agnonymous wrote:
I tried to use mathematica in the past...

Tried MAXIMA today (free and open source, based on TCL) but this package too is unfriendly for bitwise operations.

Thanks again for the links...
Maybe we should divulgate a little more that stuff.
I feel that only few (even if great) brains are working on it, whilst a lot of (amusing) work can be done!

bilbo

"If this method can be made to work in practice, it is a major revolution in cryptanalysis" (Nicolas T. Courtois)

//////////////////////////////////////////////////////////////////////////////

stingduk
well i am sorry to bring excel back into the topic but its just disseminating info
nothing else so no flame

i was playing with that xnumbers and binum.xla

and i see it is able to convert the unsigned content of register viz
0xffffffff to its binary equivalent string

so i just converted the above code for a test
eax^(eax shl 1)
i alloted eax == 0xffffffff
and i see it is spitting out the result like this

Quote:
a1 b1 c1
11111111111111111111111111111111 4294967295 ffffffff
a2 b2 c2
11111111111111111111111111111111 4294967295 ffffffff
d2
11111111111111111111111111111110

c5
00000000000000000000000000000001

a1=cvDecBin(B1)
a2=cvDecBin(B2)
d2=b_shl(A2,1)
c5=b_xor(A1,D2)
b1=HEX2DEC(C1)
b2=HEX2DEC(C2)

now ill see if i can force it find a result for some arbutrary value
_________________
felix qui potuit rerum cognoscere causas

//////////////////////////////////////////////////////////////////////////////

upb
yes, i support cluey 100%, with excel you could implement this project in a nice OO way, even hide it behind some strategy patterns or smth so it could work on both boolean and nonboolean functions.

//////////////////////////////////////////////////////////////////////////////

stingduk
Quote:

# 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
#
#
# 1 1 1 1 0 1 1 0 0 0 0 1 1 0 0 1 0 0 0 1 0 1 0 0 0 0 1 1 1 0 1 1
# 1 1 1 0 1 1 0 0 0 0 1 1 0 0 1 0 0 0 1 0 1 0 0 0 0 1 1 1 0 1 1 0
# 0 0 0 1 1 0 1 0 0 0 1 0 1 0 1 1 0 0 1 1 1 1 0 0 0 1 0 0 1 1 0 1

not sure if this makes sense or not but with the above blah i am
now able to find any value for the posted algorithm on 32 bit level
ie
R32out ^ (R32out << 1) = R32in

all i have to specify is r32in
it will spit r32out

like this

Quote:

input inhex 1a2b3c4d
shl digits 1
outputinhex F619143B

input inhex deadbeef
shl digits 1
outputinhex 4A6495A5

input inhex 2badbabe
shl digits 1
outputinhex 1964966A

input inhex 1337babe
shl digits 1
outputinhex F112966A

btw how long would the above results will take to brute force
say for a given set of ten r32out
_________________
felix qui potuit rerum cognoscere causas

//////////////////////////////////////////////////////////////////////////////

bilbo
Post subject: Another example
stingduk,
i was talking about LITERAL calculations.
It does not seems you are performing it that way.

You are just teaching Excel to perform boolean calculations (correct me if I am wrong), so, to solve the given equation

Code:
A xor (A << 1) = 3

you have to bruteforce it also in Excel.

I would like to transform the given equation into a system of 4 equations (assuming again that the input range can be 0x0-0xF), at bit level:

Code:

a0 = 1
a1 = 0
a2 = 0
a3 = 0

In that way you are sure that the ONLY valid solution is 1!

Take just another example:

Code:
A*(3-A) + (3 xor A) + (2 xor A)

assuming now that the input range is 8 bits (1 byte).

This equation is solved only for ODD values of input byte A.
It would be nice to show this in a way different from bruteforcing, isn't it?

Regards, bilbo

//////////////////////////////////////////////////////////////////////////////

stingduk
hehe i donot know if this is brute force or not
i coded this

Code:

Sub blah()
a = Application.InputBox("enter the result you want", "xorshift", Type:=1)
c = Application.InputBox("enter the number to shift left", "xorshift", Type:=1)
b = binum.cvdecbin(a, 32)
Range("c4:ah4").FormulaArray = binum.b_cvvect(b)
If c = 1 Then
Range("ah3").Value = 0
Range("ah2").Formula = binum.b_xor(Range("ah4"), Range("ah3"))
For i = 33 To 3 Step -1
Cells(3, i).Value = Cells(2, i + 1).Value
Cells(2, i).Formula = binum.b_xor(Cells(4, i), Cells(3, i))
Next i
Else
MsgBox ("shit")
End If
End Sub

and i got this result

Quote:

F619143B 11110110000110010001010000111011 1 1 1 1 0 1 1 0 0 0 0 1 1 0 0 1 0 0 0 1 0 1 0 0 0 0 1 1 1 0 1 1
EC322876 11101100001100100010100001110110 1 1 1 0 1 1 0 0 0 0 1 1 0 0 1 0 0 0 1 0 1 0 0 0 0 1 1 1 0 1 1 0
1A2B3C4D 00011010001010110011110001001101 0 0 0 1 1 0 1 0 0 0 1 0 1 0 1 1 0 0 1 1 1 1 0 0 0 1 0 0 1 1 0 1

have fun
_________________
felix qui potuit rerum cognoscere causas

//////////////////////////////////////////////////////////////////////////////
bilbo
02-22-2005, 04:52 AM
Thanks Kayaker,

for who is interested to the argument, I found something vaguely related to the argument (but different elucubrations) at http://board.win32asmcommunity.net/viewtopic.php?t=20582

Regards, bilbo
halvar
02-26-2005, 05:41 AM
Hey all,

since the topic is so much fun, a small puzzle for you all to solve :-)

\begin{eqnarray}
l_0 & = & ((( c_0 + k_0 ) \bigoplus k_1) + k_2 ) \bigwedge 0x7FFFFFFF\\
l_1 & = & ((( c_1 \bigoplus k_1 ) + k_2) \bigoplus k_0 ) \bigwedge 0xFFFFFFFF\\
l_2 & = & ((( c_2 + k_2 ) \bigoplus k_0 ) + k_1 ) \bigwedge 0x3FFFFFFF
\end{eqnarray}
In the above equation, \(c_0, c_1, c_2, l_0, l_1, l_2\) are given, and we
want to determine \(k_0, k_1, k_2\).

Any takers ?
I'll publish "my" (which is an adaption of somebody elses method)
solution here in 2 months or so (when I have time again :-)

Cheers,
Halvar
blabberer
02-27-2005, 08:38 AM
well for some who may be wondering what the heck bigoplus and bigwedge means like me :) it was latex and this is what it gets translated to :)
halvar
02-27-2005, 08:55 AM
And it is supposed to mean XOR (Bigoplus) and AND (Wedge)
blabberer
02-27-2005, 09:20 AM
btw do you have a solution set
i mean the values of l0,c0,k0 etc to atleast test the result
halvar
02-27-2005, 05:39 PM
You can tetst the results yourself by just
putting them into the equation, no ? :)

BTW: Single solutions for some values aren't
all that interesting, the interesting part is an
algorithm to compute the set of all solutions for
arbitrary values of the known values :)
mike
02-27-2005, 06:48 PM
Hi! Glad this place is back up.

Crypto is designed to prevent algebraic attacks, as bilbo noted, by making the equations grow exponentially. The latest research on trying to break stuff this way is called XSL and is summarized here:

http://phatnav.com/wiki/index.php?title=XSL_attack

It sounds like you want a symbolic math package. That would be maple, macsyma, or mathematica for commercial stuff, mupad or maxima for free.
bilbo
02-28-2005, 03:06 AM
It sounds like you want a symbolic math package. That would be maple, macsyma, or mathematica for commercial stuff, mupad or maxima for free.
Neither of them is able to automatically decompose bytes into bits, so transforming a single equation into a system of equations, correct?

halvar,
what about +? it is supposed to mean ARITHMETIC PLUS or BITWISE OR?

Regards, bilbo
blabberer
02-28-2005, 07:59 AM
yep sorry it was meaning less question wasnt thinking straight i posted the gif and saw your xor post thought i would engage you to post some thing more :) and asked that meaning less question :) without thinking

to admins
does the gif i attached is visible only to logged in members ?? i mean i look the post as guest and i could not see that gif but i login i can see that gif ?? :) or is it a case of blindness ?? :)
halvar
02-28-2005, 03:23 PM
+ is just normal arithmetic mod 2^32, e.g. arithmetic in registers
mike
02-28-2005, 06:14 PM
Neither of them is able to automatically decompose bytes into bits, so transforming a single equation into a system of equations, correct?

halvar,
what about +? it is supposed to mean ARITHMETIC PLUS or BITWISE OR?

Regards, bilbo
None of them have built-in stuff to do it, but you can write a program to do it; for example, you define +, *, xor, etc. on arrays of symbols, type in your equation, and get a system of equations (if you don't run out of memory in the process!). You can then ask the system to solve the system. I know maple and mathematica can look for solutions mod n, so you can let it look for solutions mod 2.
scorpie
03-01-2005, 07:50 AM
Yes, I should agree with Mike that Maple or Mathematica is a good choice to solve the problem, while Macsyma is "vague" now; yet another good choice would me APL, but it is not popular. You can get a workong demo version at microAPL site.


Reverse Engineering Conference 2005
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Reverse Engineering Conference 2005
PDA

View Full Version : Reverse Engineering Conference 2005

disavowed
02-20-2005, 08:12 AM
I posted this on the temp forum, but I'd like to post it here as well:

RECON 2005 - http://www.recon.cx/ (http://www.recon.cx/)

This looks like it's going to be really cool. Hope to see a bunch of you there! http://community.reverse-engineering.net/images/smiles/icon_biggrin.gif
evaluator
02-21-2005, 11:12 AM
who the .. are those?
do you know them?
disavowed
02-22-2005, 12:50 AM
who the .. are those?
do you know them?
who?
Zero
02-22-2005, 08:44 AM
What he means is maybe: who is behind this conference? Who are the organizers of this event?
evaluator
02-22-2005, 04:13 PM
ok, i read already something in Zeros forum..
dataworm
02-23-2005, 03:32 PM
Hi evaluator

Looking for me? :)

I am one of the organisators.
evaluator
02-24-2005, 03:57 AM
please, don't join/waste forums for single offtopic post
dELTA
02-24-2005, 04:10 AM
First of all, we're in the off-topic forum. :) Second of all, the post seems quite on-topic for this thread, so give the guy a break, ok? :) Why are you so grumpy lately eval? ;)
+SplAj
02-25-2005, 01:22 PM
Mr Grumpy he maybe........ :loveu: But his Englese is improving :)
JMI
02-25-2005, 02:14 PM
He mangles his English when it pleases him to do so. :D

+Splaj: You should have seen your noble avatar before I recovered the avatars. :cry: Evaluator's was unrecognizable also.

Regards,
Zero
02-26-2005, 01:19 PM
I submitted my paper ;) Anyone else ?
evaluator
02-28-2005, 11:58 AM
well, lost iconnection 3 days ago, now restored..

1. generally, not will good for anyplace, if every near-walking person will login for single word..

2. personally, i not accept smilies from strangers..
esther
02-28-2005, 10:08 PM
>2. personally, i not accept smilies from strangers

Did you personally meet the admins(forum) in real life?
disavowed
03-01-2005, 08:12 AM
I submitted my paper ;) Anyone else ?
i decided against it. though my idea for a paper was interesting, it wasn't groundbreaking enough to be representative of my company and me :boo:
dataworm
03-01-2005, 10:16 AM
well, lost iconnection 3 days ago, now restored..

1. generally, not will good for anyplace, if every near-walking person will login for single word..

I did't create a account just for a single word, I check this board from time to time, I am just hiding. I used to have a account, I guess it got removed from inactivity or I was just posting as Guest. Btw if you search for my nick, you will find at least 1 old post from 2002... Oh wait that might mean I am near-walking this forum :whoops:

2. personally, i not accept smilies from strangers..

Sorry no more smiling :sneaky:

Oh wait, can't resist :devil:
dataworm
03-01-2005, 10:20 AM
i decided against it. though my idea for a paper was interesting, it wasn't groundbreaking enough to be representative of my company and me :boo:

What was the topic? Saying it was't groundbreaking enough somehow mean it was groundbreaking, and that is a good start :yay:
evaluator
03-01-2005, 03:29 PM
ok, dataworm, grab my Sorries..
i looked only on post count & thought, you just logged..

***
continue, plz: )
keep silence, watch forum, sell knowlidge..
disavowed
03-01-2005, 11:29 PM
What was the topic? Saying it was't groundbreaking enough somehow mean it was groundbreaking, and that is a good start :yay:
i'd rather not say, since that would allow someone to steal the idea :)
i know you can now say, "so why should we believe you had an idea in the first place?" well, i can't argue with that, so say what you will.
disavowed
03-04-2005, 01:43 AM
I've had a change of heart. I think I will be submitting the paper after all. :yay:
dataworm
03-04-2005, 03:11 PM
I've had a change of heart. I think I will be submitting the paper after all. :yay:

cool, I'll wait for it :)


ARMADILLO 3.78 HELP NEEDED
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ARMADILLO 3.78 HELP NEEDED
PDA

View Full Version : ARMADILLO 3.78 HELP NEEDED

fighter_81
02-21-2005, 04:13 AM
Ok i've done some work but the problem is still the same. i just can't unpack the son of a bitch.
This is what i've done. I used 2 different debugger:
Olly and SICE.
With SICE i am be able to find the OEP by setting a breakpoint on SETPROCESSWORKINGSETSIZE.
The program tries to detect it via INT 1. After bypass this trick i found the original entry point of the program. Now the problem is that i just can't rebuild the IAT. In fact the prg steals it by call a memory space out of the code.
So i think:
If i can redirect this space into the code space i can then use the goog IMPREC 1.6 (thanks to MACKT icon_twisted.gif ) to rebuiild the whole IAT.
So i redirect it to an unused space of the code but the problem is that this son of a bitch clears my BPMD on the redirected IAT address.
So i take olly to put ahardware breakpoint on it but the problem is that with olly i just can't reach the OEP so i cannot put a hardware breakpoint on write a dword like all armadillo tutorial on the iat redirected space memory. Another thing is that if i put a breakpoint on WriteProcessMemory to change th bytes and make an infinite loop of the father and after that a breakpoint at WaitForDebugEvent and then PUSH PID of son, and call the DebugActiveProcessStop to attach
the son, when i open the second instance of fighter.exe (Ollyrenamed), i attach to the correct PID that i pushed before, it calls the exitthread and it exits without attach. Any suggestion is pleased and if someone could help me i'll be glad to him/her.
Regards
FIGHTER_81
Spec0p
02-22-2005, 05:00 AM
hello,
big confusion around there, if u want me to take a look, private msg me the app name/address...
Spec0p
02-22-2005, 03:48 PM
fighter_81, 4 what i could see it looks standart IAT Elim, so u must be doing something wrong, i say that because the OEP u gived me is incorrect, the correct one is 0x45AB71. Iam using olly, please check the existing tuts and eventually u ill get it. I wish i could help u more, but u ill have to be a little more specific on ur doubts :\ Iam attaching fixed imports so u can compare something? :s

Regards
Spec0p

P.S. Its also protected with nanos :x
dELTA
02-22-2005, 03:53 PM
Iam attaching fixed imports so u can compare something?No you don't, and especially not when it contains the target name. You will have to handle such things privately outside this board.
fighter_81
02-22-2005, 04:15 PM
Thank you very much for your help.
I will retry and i let you know
Spec0p
02-23-2005, 03:14 AM
:eek:
sry about that dELTA, i thougth that there was no prob in posting the imports since its only api names, any app can use them , even windows,what i didnt realized thought is that there was the app name inside, thats maybe because i dont save the tree often. Ill be carefull next time.. :\
JMI
02-23-2005, 03:24 AM
We don't allow "fixed" imports, because they would permit someone to paste them into their attempted crack and we might then be accused of hosting cracks and have to move our server AGAIN. I hope this is clear. You may, however send whatever you want to another member by PM, you just can't post things which cause the Board trouble. :idea:

Regards,
Spec0p
02-23-2005, 06:17 AM
Clear enought for me, dont get me wrong i had never the intention to prejudice the board in any way... is just that i had the impression i had seen some 3/4 times iat.txt around here somewhere without being warned, that was the only reason i posted it, if i had the minimum clue, i wouldnt had posted it, belive me :(
p.e http://www.woodmann.com/forum/showthread.php?t=2811
http://www.woodmann.com/forum/showthread.php?t=2667
http://www.woodmann.com/forum/showthread.php?t=2839
Anyway i wont do it again :yay:

Regards,
Spec0p
dELTA
02-23-2005, 07:35 AM
Yeah, some remnants can be found from the old times when the rules of this board weren't as strict as now. We understand your mistake anyway, no problem.
JMI
02-23-2005, 09:28 AM
And it was BECAUSE of some of the Threads you found, and the problems they caused, that we changed the rules. :yay:

Regards,
fighter_81
02-23-2005, 10:03 AM
i'll be glad with all that have replied me and i have been able to unpack this bastard with sice. Now i only have to fix nanomites
thanks
Regards
FIGHTER_81
p.s.
My OEP is 0045a9f7
p.p.s
Grazie


Suspending a riot process..how?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Suspending a riot process..how?
PDA

View Full Version : Suspending a riot process..how?

Shub-nigurrath
02-21-2005, 07:20 AM
Hi,
I'm working on a patch of a program and writing a loader for it.
But for it I have this problem: the SuspendThread won't suspend the thread.

I launch the victim process using CreateProcess in suspended mode as:

if( !::CreateProcess( victimFileName.c_str(), // No module name (use command line).
NULL, // Command line.
NULL, // Process handle not inheritable.
NULL, // Thread handle not inheritable.
NULL, // Set handle inheritance to FALSE.
CREATE_SUSPENDED, // suspended creation flags.
NULL, // Use parent's environment block.
NULL, // Use parent's starting directory.
&si, // Pointer to STARTUPINFO structure.
&pi ) // Pointer to PROCESS_INFORMATION structure.
)
{
MessageBox(NULL, GetLastErrorMsg().c_str(), MSG_CAPTION,
MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL);
return 1;
}

And then after an initial resume of the process, to skip the initial unpacking and wait the guard condition to come active (I wait a memory address assuming a specific value or the main program's window to appear). I do as following:

//Before patching the victim application it's better to suspend it..
//If we cannot for some protection suspend the application then
//a little of tentatives are tried:
//1. repeat several time SuspendThread (see comment below to see why)
//2. try to lower the priority
//3. try using the kernel counterparts zwSuspendThread and zwSuspendProcess
//4. open the process to get another process handle.
// If all these things fails then closes the patcher with an error!
if(SuspendThread(pi.hThread)==-1) {
//If the thread is making a kernel call, SuspendThread fails.
//An application may need to repeat the SuspendThread several times for it
//to succeed.
int trials_count=0;
BOOL skiptherest=FALSE;
while(trials_count<=MAX_SUSPENDTHREAD_TRIALS) {
if(SuspendThread(pi.hThread)!=-1) {
skiptherest=TRUE;
break;
}
trials_count++;
}

//Try to lower the the thread's priority.
if(!skiptherest) {
thPriority=GetThreadPriority(pi.hThread);
if(thPriority!=THREAD_PRIORITY_NORMAL)
SetThreadPriority(pi.hThread,THREAD_PRIORITY_NORMAL);
if(SuspendThread(pi.hThread)!=-1)
skiptherest=TRUE;
}

//Try suspending the process using kernel equivalent functions
NTSTATUS ret=0;
if(!skiptherest) {
ret=ZwSuspendThread(pi.hThread, NULL);
if(ret>0)
skiptherest=TRUE;
}
if(!skiptherest) {
ret=ZwSuspendProcess(pi.hProcess);
if(ret>0)
skiptherest=TRUE;
}

if(!skiptherest) {
HANDLE hProc=OpenProcess(PROCESS_ALL_ACCESS,FALSE, pi.dwProcessId);
if(hProc==NULL) {
MessageBox(NULL, GetLastErrorMsg().c_str(), MSG_CAPTION,
MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL);
return 1;
}
pi.hProcess=hProc;
bProcessOpened=TRUE;
NTSTATUS ret=ZwSuspendProcess(pi.hProcess);
if(ret>0)
skiptherest=TRUE;
}

if(!skiptherest) {
::MessageBox(NULL, GetLastErrorMsg().c_str(), MSG_CAPTION,
MB_OK|MB_ICONEXCLAMATION|MB_APPLMODAL);
return 1;
}

}

then patch it using writememory..

I don't know if all the tentatives are sensefull or not, but all fails as well as the simple SuspendThread.

Anyway a simple SuspendThread has worked fine for all the loaders I wrote, this is the first time I cannot suspend the process at all.

Any suggestion regarding this will be extremely welcome!

10x in advance!
dELTA
02-21-2005, 10:12 AM
As soon as you have resumed the thread the first time after the creation, it may create additional threads. These threads will still be running when you suspend the main thread the second time, and hence they may execute any code and modify anything in the memory space of the application. May that be it, or did I misunderstand anything?
evaluator
02-21-2005, 11:31 AM
are you playng with SDprotector?
it creates threads with 'inherited' parameter & SuspendProcess can't
suspend them..

on this case, seems you are creating non-debugged process, ye?

but in case of DEBUG-flag, you need to awoid detection via ZwQueryInform..
nikolatesla20
02-23-2005, 11:53 AM
This is one good reason that a loader/unpacker SHOULD be a debugger, because ALL threads will freeze when they are being debugged, not to mention you can intercept CreateThreads then too - you can still hide the debugger if you know what API's and other techniques are being used to detect it, because the debugger can just intercept those techniques and modify the answer.

Like eval said one technique is ZWQueryInformationProcess (look that up in search on this board)

Another is checking the parent process's name (the app checks to make sure it's not being launched by anything but explorer)

Another is the common PIB flag for debugger (The flag that IsDebuggerPresent() actually uses internally)

All of these techniques can be found on the board.

I wrote an unpacker a while ago for SoftDefender that had to hide itself very well using all of these techniques combined....and did some other fancy stuff too (tricking SD into thinking it didn't need to launch another process, etc).

A Debugger process can emulate anything, it's just a matter of finding what it needs to do. What I've found as a good way to approach it is learn how to unpack the target manually, and then write the unpacker to do the same steps.

-nt20
Shub-nigurrath
02-23-2005, 12:03 PM
Hi,
I know what a debugger program can do and I agree with you at all.

I made the work on the program for which I made this post on the two different ways: with and without disturbing the debugging library .. and I managed them two to work with the same results. I did it for a tutorial I'm writing that will argue on the loaders and will present a c/c++ framework I wrote to create new loaders more easily..

Meanwhile between exetools and here I got my answers..

10x for your suggestions.


New but backwards compatible DVD copy protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > New but backwards compatible DVD copy protection
PDA

View Full Version : New but backwards compatible DVD copy protection

dELTA
02-21-2005, 11:19 AM
Sounds interesting (as in "snake oil"), I'd like to see the details of this one:

http://www.latimes.com/business/la-fi-dvd15feb15,0,823039.story?coll=la-home-business

"claims can block 97% of the DVD-copying software that pirates use without interfering with a DVD's playability or picture quality"

Until a 2 minute patch is done to this software most likely I'd say...
disavowed
02-22-2005, 12:51 AM
Until a 2 minute patch is done to this software most likely I'd say...
or everyone just moves to using the working 3%, in which case macrovision didn't solve anything :thinking:
TBone
02-22-2005, 10:31 AM
"But until they fix the analog hole … it doesn't solve the problem."
:thinking:

"Fix" the "analog hole". That's bloody brilliant. People near my office are wondering what I'm laughing at right now. I'm trying to picture the meeting that must have occured at some point:

Lackey: Sir! We just discovered an analog hole in our copy protection system! People watch our movies and, like, these photons hit them in the eye and their brains record it chemically, and they can play it back any time they want!
Stuffed suit: Sweet, fancy Moses! Do you realize what this means? This could be costing the industry billions -- we must find a way to stop this analog piracy!
Lackey: I'll get started on making our DVDs unwatchable right away, sir. :idea:
dELTA
02-22-2005, 11:59 AM
:D
JMI
02-22-2005, 12:12 PM
Stuffed suit: That could be the sticky bit, what. :D

Regards,
Silver
02-22-2005, 12:51 PM
<falls off chair laughing>


Welcome Back
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Welcome Back
PDA

View Full Version : Welcome Back

LOUZEW
02-21-2005, 01:45 PM
:yay: :loveu: :yay: :loveu: :yay:
Nice to see you back online
Many thank's Woodman ( JMI and all other....)
JMI
02-21-2005, 02:09 PM
Most of the "hard" work, especially trying to figure out some small, nagging problems with php, was done by 0xf001. Appears that the "latest" CVS version of php we were trying to use, has some anomalies in it when used with vBulletin.

We WILL be closing the Forum, hopefully very briefly, sometime today or tomorrow, simply to make a complete up to the minute copy of the vBulletin database, which has to be "upgraded" to work with the new v3.0.7 vBulletin. I did the same process last night, without closing the Forum, for the v3.0.6 vBulletin, to test how things were working. Everything went smoothly and I had the v3.0.6 up and running in only a few minutes. Should work the same for the upgrade to v3.0.7. :idea:

Welcome back.

Regards,
Aimless
02-21-2005, 10:23 PM
I think that this messageboard is already a part of my life. My life had 3 important things:

Food
Clothing
Shelter

It went from that to

Food
Clothing
Shelter
Woodman's board

Seriously, if any of the copyright/DCMA/MIPAA/CIA/FBI/wtf DO manage to close this down, I'm don;t really know what I'm gonna do without my daily fix.

On a more legal note, Woodmann, I know that on some pretext of the other, you website hosted CAN be taken down. But can you also be LEGALLY arrested where you come from?

Have Phun
JMI
02-21-2005, 10:34 PM
The DCMA has mostly civil penalties. One can get arrested from distributing pirated software, but we don't do that, and this place generally gets booted from a server because they don't want to deal with complaints. :yay:

Regards,
JMI
02-22-2005, 12:08 AM
In case anyone has not noticed :eek: we are now running the version 3.0.7 vBulletin. There were some substantial issues with most of the custom avatars, probably having something to do with the backup which was used to restart the forums here. I've managed, I hope, to recover and re-install most of them.

If your custom avatar has vanished or does not appear as it should, simply re-upload it and, hopefully, that will fix the problem.

Regards,
bilbo
02-22-2005, 04:59 AM
My life had 3 important things:
Food
Clothing
Shelter
Umhh, did you forget something, or are you a rather uncommon human creature?

Regards, bilbo
JMI
02-22-2005, 05:02 AM
I suspect he puts THAT in the "food" category. :devil:

Regards,


Please help...SentinelLM question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Please help...SentinelLM question
PDA

View Full Version : Please help...SentinelLM question

02-21-2005, 07:12 PM
Following CrackZ essay on Sentinel LM, i should be able to get the vendor ID of my target. I am new in reversing and i am learning slowly but surely! ;)

I am having some problems finding the Vendor ID of my target. Anyone can shed some light on this?

I dissasembled LSAPIW32.dll in IDA pro, applied the LM sigs and put a breakpoint on "_computevendorcode". Then, from IDA menu i go to "Debugger\process option" and set the path of my target executable. Then start debug and it reach the breakpoint on "_computevendorcode". My question is:

At that point how do i retrieve the Vendor ID?

If i do Ctrl-F7 (run until return) The content of EAX shows 0x00000FA0

so i thought it was the VendorID i was looking for so, i used the S\N Bruteforcer and reinstalled the SDK with the Matched S\N, created an Undongled Wlscgen but the codes generated doesnt work. That make me think i dont have the right Vendor ID. Anyone can help me out with that?

thanks in advance
nikan
02-22-2005, 09:55 AM
hi

for targets that use sentinellm via lsapi32.dll you have 2 choice.
1: writing an emulator dll. it is a simple way and always work fine.
2: license generation. but some programs do not work with unlimited demo license. so possibly this is the reason of your problem.

however for finding vendorcode, working in ida is very time consuming. a better way is using ollydbg. always you can use godup plugin and load ida sig to olly. but for sentinellm i can recomend a shortcut that is good for all versions of sentinellm.(sentinellm ida sigs that currently can be found in internet is not good for lm ver >7.1). you can load your target to olly. open lsapi32.dll or other lm protected executable file in cpu window. then search for all reference strings. and then search for "%s error: illegal vendor identification.". one reference can be found that is in _computevendorcode function. the content of eax on return is vendorcode.

nikan (TORO)
02-22-2005, 05:44 PM
Hi Nikan

First of all i want to thank you very very much for replying. It is very much appreciated! :)

Now, i downloaded ollydbg 1.10 and tried to familiarize with it. I can load lsapiw32.dll in ollydbg, find the reference string you mentionned and put a breakpoint on that same string, but how do i tell ollydbg to use my target (prog.exe) to start the debugging process???

thanks
nikan
02-23-2005, 08:31 AM
hi

you must load your main exe file to olly and then press ALT+E and then select lsapi32.all.

there are many tut for olly on the net.


Corrupted ZIP files
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Corrupted ZIP files
PDA

View Full Version : Corrupted ZIP files

goggles99
02-22-2005, 12:26 AM
It is GREAT to have woodmann.com back up and running. Thanks to all who who helped get it back up for all of their efforts.

I noticed that all attached ZIP files I have downloaded seem to be corrupt :confused: , also many of the users avatars seem corrupted as well. Were all binary objects corrupted somehow? It so, This is a GREAT loss to this board :eek:

thanks
JMI
02-22-2005, 12:56 AM
Nothing is "lost." Some things may not yet be installed correctly. Also of the avatar issues were, I believe, fixed earlier in the evening. I haven't looked at the zip files (attachments) yet, but they definately are not "gone." I have several sets on my HD. :yay:

Regards,
Kayaker
02-22-2005, 01:07 AM
Yes unfortunately, zip attachments seem to be corrupted, but as JMI said not lost by a longshot. That too will be sorted out soon.

Kayaker
sigint33
03-01-2005, 06:37 PM
Just as a note, RE-PAIR zip file is still corrupt, in the TOT forum, if you need it get it from the RET site.

SiGiNT
goggles99
03-01-2005, 08:50 PM
Thanks...
but the files I need to finish a project I have been working on cannot be found anywhere else. They were custom made in the mini-project section. :cry:
esther
03-01-2005, 09:10 PM
Hi,

There is a tool called zipfix.You can try your luck on google
JMI
03-01-2005, 09:50 PM
The problem with the zip files appears to be related to the use of mySQL v4.1.9 which is not fully compatible with vBulletin and we are in the process of downgrading back to a 4.0.20+ version of mySQL. I have working copies of all the zip files and will have even our current setup working shortly. Real World work sometimes intrudes on fun. :eek:

Regards,
goggles99
03-03-2005, 02:53 PM
@esther...
Thanks, but I have tried this and many other supessed zip repair utilities with no luck.

@JMI
Thank you as always for all your work here. I don't however think the problem is between mySQL v4.1.9 and vBulletin (Newly uploaded ZIP files seem fine). It seems more logical that all BLOB's in the mySQL database were corrupted during the mysql conversion. Upgrading from MySQL 4.0 to MySQL 4.1.x is required to first backup all data, uninstall MySQL 4.0, then install MySQL 4.1.x, restore all data. During the restore, if you didn't sepcify the default character set specifically, you may have accidentally selected a different character set, causing binary file corruption during the restore. :eek:

Anyway, good luck sorting this out
JMI
03-03-2005, 03:08 PM
Thanks, but I am aware of all that. The "default" characterset of our old mySQL was Latin_1. The default set of version 4.1.+ seems to be Latin_1 Swedish, which may be fine for our young master Svensk, but does seem to have corrupted the zip files and avatars. Originally, dELTA made a backup of the database, just before the old server went dark. That backup was "restored" through the usual mySQL restore function and both the avatars and attachments were toast. Natuarally, the new ones work, because they were created with the new characterset. There is also the issue that we have gone through two vBulletin upgrades in the process and there may be some issues with the upgrades as they use the new mySQL.

I have since installed several copies of the actual database files on other working version of the forum that I downloaded a day before dELTA took the mySQL backup and have manually reinstalled all the avatars on the current database. This was not such a great task, because there were only 64 of them. However, there are over 830 attachments, so a manual approach does not seem as practical.

However, cutting and pasting them into some of the copies of the current database worked and others didn't and I suspect it is an issue of permissions for read and write. I am working through the options as I try to keep up with real world work as well and should have it working soon. On some of the test forums, avatars would work and attachments not, and on others the avatars didn't work and the attachments did, even though both came from the same source files and both were copied and pasted in, rather than "restored" through mySQL. Go figure why. :eek: Also we are in the process of downgrading the mySQL version because vBulletin recommends against v4.1.+, so that issue may go away and the old attachments from my back work correctly with only the few "new" attachments needing to be manually re-installed and most of them are simply text files anyway. :yay:

And it shouldn't be difficult to "rescue" a particular zip file for completion of your project, if you can identify it, I probably can upload it here for you. :yay:

Regards,
goggles99
03-05-2005, 07:22 AM
Thanks a bunch JMI, You made my day. :D
The 2 attachments I am looking for is in the "Low Level Graphics Programming Project" thread. here (http://www.woodmann.com/forum/showthread.php?t=6310&page=2&pp=15)

d3d_proj_2.zip (http://www.woodmann.com/forum/attachment.php?attachmentid=1131) and targetInjected.zip (http://www.woodmann.com/forum/attachment.php?attachmentid=1132)

Thanks a lot. :yay:
Kayaker
03-05-2005, 11:37 AM
1
Kayaker
03-05-2005, 11:38 AM
2
Kayaker
03-05-2005, 11:39 AM
I can u/l the files here because
a) I'm in the neighbourhood
b) Your request is reasonable since they are miniproject, not "cracking" related files
c) I wanted to see what went wrong with the corrupted files
d) We want JMI to work for his 3000+ post :p

Re c), I compared the 2 corrupted files with their original versions and found a very strange thing. It seems *every* occurrence of the bytes 81, 8D, 8F, 90, and 9D in the corrupted zip files were replaced by the single byte 3F. So, if this were a Latin_1 Swedish error of mySQL, what the Svensk is the difference between the 2 charactersets that it would modify those bytes while installing? If the avatars were similarly corrupted, it might explain why they only displayed a few lines of the image.

Kayaker
goggles99
03-06-2005, 09:16 PM
Thank you Kayaker...
Much Appreciated :)
kugi
03-09-2005, 03:47 AM
It is great to see the RCE back. Thought that I had lost an old friend for a while. Thanks to all for keeping this Forum going. The Forum has been a valuable asset for many years.

Kayaker - good thinking to u/l the files. It was the right thing to do.

Regards, kugi
Kayaker
03-09-2005, 02:45 PM
Kugi, I'm glad to see that you keep finding the Forum after all the moves, shuffles, ducks, feints and head bobs it's forced to undergo occasionally. None of the blows hit very hard though. RCE shall survive. Float like a butterfly, sting like a bee... :devil:

Regards,
Kayaker
blabberer
03-10-2005, 04:36 AM
stinging butterflies do they exist god you are weird probably were mad when you made them
naides
03-10-2005, 06:10 AM
stinging butterflies do they exist god you are weird probably were mad when you made them

(Quote allowed JMI):

stinging butterflies, do they exist? god: you are weird. probably YOU were mad when you made them. . .

stinging. butterflies, do they exist, god? You are weird probably. You were mad. when you made them?

stinging butterflies, do they exist? god, you are weird! probably were mad when you made them, or wrote this post.

Note:

If you read the FAQ it is discouraged to post while you, god, or the stinging butterflies are under the influence of mind altering substances!
blabberer
03-10-2005, 06:21 AM
you are probably accustomed to windbg and source mode reversing
i am accustomed to ollydbg and non source code reversing
so i like it without labels comments ifs and butts just straight mov [god],me
jmp fffff000 :D
Woodmann
03-10-2005, 04:47 PM
Howdy,

Was he Cassius Clay or Muhammad Ali when he said that ???

Woodmann
JMI
03-10-2005, 06:36 PM
I believe it was actually Lou Alcindor! :D

Regards,
Kayaker
03-11-2005, 10:10 AM
Cassius begat Muhammad in '64 after beating Sonny Liston, the stinging butterfly emerged soon after I believe. Someone else might have invented it, but the phrase always seems ascribed to Ali.

Lew Alcindor? Butterflies, Bees and Basketball??
JMI
03-11-2005, 01:30 PM
Just playing with "another" famous name change. :yay:

And Cassius/Muhammad's "motto" said nothing about a "stinging butterfly." I remember watching him when the statement was made on TV. It was " Float like a butterfly, sting like a bee" a phrase coined by corner man Drew "Bundini" Brown

Not to be confused with his "rope-a-dope." ;)

http://www.muhammad-ali.info/

Regards,


Two small questions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Two small questions
PDA

View Full Version : Two small questions

Hero
02-22-2005, 11:13 AM
Hi all
I have two small question:
1-I'm truing to make signature file for directX libraries.I should make pattern file
first.For finding the type of Lib file,I open it in IDA and it says this Lib type is AR.What is AR type?And how I can make singnature from it?No one of included
pattern generators in FLIRT SDK is not working on it.
2-This is mostly a programming question but I don't know you can answer it or not:
I'm writing an application in .NET that should get a program source code,Compile
and then run it.But I want set privilege for the running process that run for example
in an specific folder(and when that program is 'system("format c:\")' I don't lost
my c: :D ).
How I can do this?

sincerely yours
Neitsa
02-23-2005, 08:05 AM
Hello,

1) The ar type of library format is in fact an XCOFF format (Extended COFF) wich allows having both 32 and 64 bits versions of an object file (.obj). This means that you ave both in the same file and compile the version you desire (in 32 or 64 bits).

To make a .sig file for IDA you'll need the FLAIR package which comes with IDA. First of all you'll need to produce a pattern file (.pat) of the .lib with pcf.exe, then do a sigmake.exe from the pattern file (which normally produce the .sig). You may need to handle collisions in the produced files.

Everything is explained in the sigmake.txt file in the FLAIR package.

BTW, This is clearly stated in the pattern help file :

PCF stands for "parse COFF" and processes AR object libraries.

2) Just try to do a GetCommandLine or a GetModuleFileName at the beginning of your program to know where your program is currently located. If it's not in the correct directory, just do a proper Exit (ExitProces) or warn the user about that fact. I think this is a simple solution which requires just a few lines of code...

Hope it could help.

Regards, Neitsa.
Hero
02-23-2005, 09:23 AM
Hi Neitsa
Thanks for help.But I should say that I have FLIRT SDK and know how to make
pattern for COFF lib files with pcf.exe,But problem is that the pcf.exe is making
an fatal error on directx libraries and say that this is not a COFF file. :confused:
I attached one of directx libraries for testing.I don't know what is the problem.

In addition the way that you are suggested can not be used for .NET normally except
using unmanaged code that is not well.

sincerely yours
Neitsa
02-23-2005, 10:16 AM
:( You're right...

I tried both utility but haven't been able to output a .pat file :

COFF parser.[...]
Pattern length: 32
Warning [d3dx9d.lib] (d3dx9d.dll): please note, not a coff module at 0xb29a
Fatal [d3dx9d.lib] (d3dx9d.dll): not a coff module
press enter to exit.

same thing with plb.exe... I don't understand exactly what is the error. I've checked what is at this offset, but I'm not a master in lib format, so i couldn't evaluate what is wrong there...

Sorry, but it seems that none of the tools provided with IDA will work. In a last (and poor) advice, as stated in the sigmake.txt, you'll have to write your own lib parser... (ouch!).

Maybe someone in the forum will be able to help you , I just hope !

Regards, Neitsa.
TQN
02-23-2005, 07:29 PM
Hi Hero !
This is an COFF import library for d3dx9d.dll, not a COFF static lib. pcf only works with COFF static lib, and you don't need to make signature for a import library.
Regards,


Quick reply functional change
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Quick reply functional change
PDA

View Full Version : Quick reply functional change

Silver
02-22-2005, 12:53 PM
Hi guys,

Any chance you can revert the quick-reply to its previous function? I used to be able to type a reply directly into the quick-reply box and hit either "Quick reply" or "Go Advanced". Now when I try that, it tells me to click one of the posts in the thread.

Cheers!
dELTA
02-22-2005, 03:44 PM
Ok, it's fixed.
Silver
02-23-2005, 12:56 PM
Thanks :)


a place for REAL newbies??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > a place for REAL newbies??
PDA

View Full Version : a place for REAL newbies??

whispers
02-22-2005, 08:16 PM
I probably do NOT fit in there yet..and certainly don't need to get banned or flamed for asking the wrong questions...LOL.. but is there any place for a beginner to start reverse engineering? Such as how to use SoftIce / Driver Studio? Tutorials..etc..etc..but mainly a place that friendly to REAL newbies..and can help them get started? Or maybe a "nice" IRC channel? (oxy moron?) Basically a place that can handle the DUMB question us newbies will ask? the question answer part is what Im concerned with getting. I am at ground 0 on this (dont even have or know how to truly install SoftIce even yet)...just been reading and collecting files and what not.

Sorry to bother you all and thanks for any replies/help.

Thanks for your time.
esther
02-22-2005, 08:31 PM
Your question must be a smart question even you are the beginer in cracking/reverse enginerring!

You ask a lousy question,you will get a lousy anwser.
whispers
02-22-2005, 09:03 PM
Hi thanks. Well I guess Im looking for place that is more forgiving with newbies. Most are NOT..and I dont wanna "step" on anyones toes..and disrespect anyones "house" (so to speak).

Like I stated..I dont even have SoftIce installed. Can I ask what is the difference between SoftIce and Driver Studio? Why would you use/have one over the other?

I see there is anew rlease for Driver Studio.... does this one work with XP? I have read that most can NOT install SoftIce using XP..or if they do..the OS freezes up..
I guess we'll start there. (or are these not good enough?? just trying to learn..have to start somewhere I suppose)

Thanks
esther
02-22-2005, 09:16 PM
> I dont wanna "step" on anyones toes..and disrespect anyones "house" (so to speak).

>Like I stated..I dont even have SoftIce installed. Can I ask what is the >difference between SoftIce and Driver Studio? Why would you use/have >one over the other?

You ask a lousy question and you will get a lousy anwser!
Driverstudio is a updated softice with more features!

>I see there is anew rlease for Driver Studio.... does this one work with XP? I >have read that most can NOT install SoftIce using XP..or if they do..the OS >freezes up..
>I guess we'll start there

Driverstudio 3.1 WORKS perfect in winxp sp1!

And REMEMBER TO READ THE FAQ!!!!
YOU DIDN'T DO THAT!!!!!!
JMI
02-22-2005, 10:10 PM
We are not all quite as insane as esther, :eek: however, your question does suggest that you have not followed the rules which require one to TRY to help themselves before asking a question.

To illustrate this point, Softice and DriverStudio are made by a company called Compuware. They have a website and product descriptions which would have provided you with ample information to understand that Softice is a debugger and is part of DriverStudio and may also be acquired as a standalone product. It even comes in a Lite version.

If you had done some research either here and/or on the net, you would have discovered that most of the problems reported with softice and XP relate to XP with SP2. You would also have discovered that some people report problems with SP2 and some report few problems. It stands to reason, that the latest version of the software is the "most likely" to operately properly with the "latest" operating system.

But all this simply begs the question. Why do you want to start with Softice and do you have any idea of the differences between using Softice and another debugger, such as Ollydbg and/or the debugger which comes with the later versions of IDA. These are all things which general reading on the subject of reversing should provided you with some working knowledge.

In short there is a qualitative difference between a "dumb" question, asked because you tried to find an answer to your own question and didn't find the answer, or really didn't understand what you found, and a question that is "dumb" simply because it demonstrates the person who asked the question didn't bother to try to help themselves to acquire basic knowledge that is readily available to people who make an effort to help themselves.

There is a whole lot to try to learn BEFORE you should start reversing. That includes attempting to acquire a working knowledge of Assembly language instructions. Why you ask, well, it's because what you generally see in the output of a debugger is Assembly Language. If you don't recognize what you are seeing there, what is the point of starting off worrying about which debugger to use???

You have to learn to crawl before you can try to fly and there really is no effective shortcut to taking the time to try to learn some of the fundimentals. Too many "newbies" want to jump right into the deep water, hoping they can learn to swim after they are up to their necks in a whirlpool and going down for the last time. Impatience with wanting to "crack" something often gets in the way of learning how to reverse software.

You get to chose which path you will take, but you have to take the consequences of demonstrating the you really haven't thought through what you ought to be doing. For example, there are several good collections of knowledge linked at the bottom of these Forums, where you may begin your journey through the Dark Codewoods. If you really want to help yourself, you have a whole lot of more reading and studying before you should be trying to work the magic. :idea:

Regards,
whispers
02-22-2005, 11:01 PM
Thanks for the replies. I understand I have a long road ahead of me.... I didnt install SoftIce or Driver Studio....nor have I even tried. I am trying to understand the "lingo"..and the basic logic behind "cracking" a program. As for ASM...I have had exposure to it in satellite card form...breaking down and running through DSW/SW routines/executions.....branches..jumps..etc..etc....and Im ot all that unfamliar with it...but by no means a GURU..or even average.
I was just using SoftIce as the example..as it is the most popular..and the name most thrown around when referring to RE, but I dont know the difference between them. I dont even know what questions to ask to tell the differences anyways.

I was wanting to try and get a print out of some ASM source form some app...and try to look for simple jumps..and follow where they go...etc..etc. I see there are soem tutorials...and "crackmes" that are for newbs to learn how to walk through or test ways of "cracking" programs...but those are still above me.

You say Im nto ready......and I have alot of things to learn ahead of me...so where would one start? You say google..searching for what? is there a path?

Noone is looking for a shortcut...just looking for some basic "learnin' the ropes" type talk..and some friendly advice. Everyone has to start somewhere. Is ther a .doc I should read first. I skimmed the "FAQ"....and took in what made sense to me.

Thanks for your time.
esther
02-22-2005, 11:15 PM
Take your time and learn asm.And search the forum.There are lots of infos in here.And remeber don't restrict the tools when learning :)

Welcome aboard :cool:
disavowed
02-23-2005, 02:00 AM
My advice would be to start here: http://www.woodmann.com/fravia/index.htm
Read as many essays as you can that are rated as "Beginner"
If you see something that you don't understand in one of those essays, search for answers on this board.
Shub-nigurrath
02-23-2005, 02:21 AM
I would also point to hxyp://tutorials.accessroot.com there are several tutorials specifically thought for beginners..
whispers
02-23-2005, 06:25 AM
Thanks for the replies..and the welcome. =)

Another quick question..before I go on a reading binge at those links you posted.

In my former exposue to ASM.. there was what was known as an "instruction set"....basically each "card"...had its very own....each had different "OP" codes it responded to.....usually based of some sort of large public released "micro-controller"

Is there a specific instruction set with a break down of what OP codes work for RE stuff?...or does that NOT apply here?

Thanks..I will try to read over the "noobie" tuts..and search on the text I dont understand...
naides
02-23-2005, 07:15 AM
Concentrate on the intel i86 assembly dialect. Look for "the art of assembly".
While the more assembler you know, the better, you do not need to be an assembler wizard to start to crack. For starters, you only need a working understannding of a handful of instructions. As you go along, you will search for more and learn more instructions, structures, calling conventions blah blah. At least in my case, Cracking was an excellent introduction to learn assembler!
whispers
02-23-2005, 07:43 AM
Naides-

thanks for the tip..as well as the comment of encouragement. That is basically how I learned about Smart Card ASM...tirla and error...learn a few instructions/op-codes...and from there...I just tore down other people's "code" to see how they were doing the checks/cloaks & defeats. Im glad you dont need to be a ASM Wizard..because I surely am NOT...LOL.

I guess the "logic" behind things are what i need to learn first.

Like you "unpack" an .exe........decompile/debug the app.....look at the source code and run through the ASm to see what is goin on INSIDE.. from there I can tackle reading up on each part..and interpreting it as I see fit...(ie: translate to idiot....LOL)

Not sure when you know your ready to "crack" your first app. I would think a crackme is always the first step...to get familar with different kinds of protections/defeats.....correct? For my first REAL WORL app..I was thinking something like WinZip?? So the i86 instruction set is what I shall focus on. What was YOUR first step at "cracking"...readmes.....creackmes....tuts....everything..

Thanks ;)
Neitsa
02-23-2005, 08:25 AM
Hello,

I would think a crackme is always the first step...to get familar with different kinds of protections/defeats.....correct?

From my point of view, the most part of the actual crackmes/keygenmes are not intended to learn how to defeat actual protections.

Crackmes are programmed by crackers for other crackers, but I like to see it like a game, or maybe a way to give to crackers some automatisms (for the simplier ones). The more you train on crackme, the more you'll see some common points, but you'll not gain training on actual protection (except on some packers / protectors).

If i take all crackmes submitted to crackmes.de, I don't think you can see many protection schemes that are in actual sharewares. For a summary I was just trying to say, that you'll get "a way to think" not a "way to defeat".

From my point a view, that's trully better. It remind me a part of the Book : "if you want to feed someone, give him a fish. If you teach him how to fish, he'll get food for his entire life" (sorry i don't know how to translate it, but the idea is there).

Regards, Neitsa.
babar0ga
02-23-2005, 08:51 AM
Hello,
It remind me a part of the Book : "if you want to feed someone, give him a fish. If you teach him how to fish, he'll get food for his entire life" (sorry i don't know how to translate it, but the idea is there).

Indeed. There is even a "translation" to "real world" use...

+ORC
hxxp://www.woodmann.com/fravia/howto82.htm

(look at the end of tutorial)
Silver
02-23-2005, 12:55 PM
I also recommend you gain a good understanding of the win32api. Good enough that writing your own apps in C/C++ is second nature (for the api, rather than the language). Many times I've overcome a lack of asm knowledge with good api knowledge, and been able to fill-in-the-gaps. When you can look at an app, see the part of the app you want to find in the deadlisting and immediately come up with a bunch of likely api calls that you can look for, you're on the right road.
whispers
02-23-2005, 01:29 PM
What is Win32API? The instruction setused to communicate with hardware through the OS? (I know..I'll look it up) ;)....

But I am by NO means a programmer in any language. I have some exposure to it..being a little Java, .NET (C#/ASP)...and ActionScript (if that quailfies)..LOL...
(what is an api call?)

So should I focus on learning more of ASM or a prgrammign language such as C++ or C#?)

thanks
TBone
02-23-2005, 02:06 PM
You are in a maze of twisty little passages, all alike.

I feel your pain. It's not that you want people to teach you how to crack, it's that you need someone to teach you how to teach yourself how to crack :p It's kind of a "meta" problem or bootstrap problem; I'm not sure what you'd call it.

Don't get me wrong, the "help yourself before you get smacked around" principle exists for a good reason, but sometimes you've got to know when to bend the rules just a bit to help save someone's sanity. The "dark codewoods" as JMI is fond of saying are just so vast that it's an impressively large hurdle just to know how to start. A beginner who truly wants to read and figure things out on his/her own can spend days and weeks just spinning their wheels - they're putting out tons of effort reading, etc., but it's not very effective if you're spending your time on the wrong things.

I'm trying to work on being concise, so there's not a lot of explanation given here for why I would do things in this particular order:

1) Learn IA-32 assembly. 64-bit stuff can wait. Don't fret over x87 (FPU) or MMX opcodes for now. If you need more detail later, you can always dive into it. Intel's IA-32 Architecture Software Developer's Manual is the prime source for this. Volume I is worth reading cover-to-cover, IMHO. I don't recommend that for volume II, but it is an essential reference of every opcode. Volume III is ring-0 stuff. Save it until you need it.

2) Learn the PE/COFF format. For now, you just need to know the PE header, the section table, and to understand the process of loading an executable into memory. Before long, you'll want to understand the IAT, too. MS maintains the official specification, but various other sources are probably more "friendly", and may cover things that MS doesn't document.

3) Learn how stack frames work, and learn the most common calling conventions. It's not totally essential to know this, but it helps a lot. There's not really a good source for this; info is scattered all over the place.

4) Get a general feel for how windows programs are structured. Iczelion's tutorials a good source for this. Reading them all isn't necessary, but I'd read at least the first few.

5) Grab a good decompiler and debugger and get cracking. W32DASM is only useful for quick deadlistings since it can't intelligently follow code. IDA is highly recommended. Dede is specifically for delphi programs - I haven't messed with it yet, but it's supposed to much better than a general decompiler for delphi apps. Debuggers are a matter of personal preference. SICE is highly venerated by many, and it's probably your only viable choice for ring-0 debugging. It's also a b#&%* to get working on modern systems, often times. Ollydbg is ring-3 only, but it's a very nice tool for beginners. It has some bugs in its tracing functions, but it's still pretty early in its life cycle.

At this point, it's all pretty much hands-on and lots of tutorial reading for specific protection schemes. Nearly all programs these days are wrapped by some kind of a crypter/packer. They range from the easy, like UPX, to the insanely hard, like Starforce. I'd start by doing some simple reversing of unprotected apps like Winzip. Do some serial fishing just for fun and then move on to the protected targets. Start with simple packers like UPX and ASPack, then move on to medium level stuff like ASProtect. After that are the advanced schemes like Armadillo.

Most importantly, stay organized. I actually have a "Reverser" directory on my computer. Inside this are 3 directories: tools, reference, and "shit to be cracked" :p If you don't keep your tutorials, references, notes, etc. divided up into some kind of logical order, you'll go insane.
whispers
02-23-2005, 03:24 PM
Thank you for the reply... you have helped IMMENSLY...you have done the BEST thing possible..given me direction! LOL

I will start doing the following:

1.) Read up on: IA-32 assembly & Intel's IA-32 Architecture

2.) Learn the PE/COFF format (and even what each of those acronyms mean...and even the differnce between each..as of now I dont even knwo what type of format that applies to) Specifically these areas: PE header, the section table, and the process of loading an executable into memory

3.) Learn how stack frames work, and learn common calling conventions (IS this the same as the "stack" in most ASM code? (Like a register or temp holding place?)

Does this foloow the first in last out procedure?

4.) GO to : Iczelion's tutorials to get a general idea on how Windows Programs are structured.

5.) Learn the differences between debuggers, decompilers..and find one what that best suits me and my needs.

Sidenote: find out what the h*ll ring-0 & ring-3 mean....LOL

Then install one and start doing osme hands on?

Sound about right?..
TBone
02-23-2005, 04:48 PM
Sounds good to me. Just keep in mind that I am newbie, so I'm not the most qualified person (by far) to give you advice :p. This was just an order I found helpful for myself, as someone who likes to order things in a simple-to-complex order.

In order to understand how a protection scheme works, you first need to understand how windows programs work.

In order to understand how windows programs work, you need to understand the win32 APIs, the PE/COFF format, and how programs in general work.

In order to understand general programing, you need to understand how the stack is utilized, how calls and returns work, how parameters are passed (calling conventions), and assembly language itself.

I tend to learn things best from the bottom up, so the list I gave you is basically the reverse order of this. I understand that for some people, this is a total bass-ackwards way of doing things. So YMMV.

Really, 2)-4) could be done in any order. It's all just foundational knowledge that lets you understand the context in which a program you want to work on operates. You could just jump right in with nothing more than a working knowledge of asm, but it would be really hard to understand what you're seeing. Program flow by itself is horribly convoluted if you don't abstract things. And to do that, you have understand the whole of the Windows-on-x86 environment.

Edit: I forgot to mention, ring-0 and ring-3 are just "slang" for privelege levels 0 (kernel mode) and 3 (app mode) on x86 processors. They can also refer to the subset of opcodes and registers which are accessible from those privelege levels. Ring-1 and ring-2 aren't used at all on POSIX-compatible operating systems. Or at least, they aren't supposed to be. IIRC, Windows actually does use ring-1 for certain driver-level code. Don't quote me on that, though.
Silver
02-24-2005, 07:34 AM
This may not help much as you're not a C/C++ coder, but I'll throw it in there anyway. The vast majority of apps you're likely to crack will be C/C++. I'll ignore VB for now, as that requires a different process, and Delphi apps have DeDe which is a massive help. There are only a negligible number of apps written in asm that you'll want to crack. The goal is not so much to learn asm and how to code an app in asm, it's to learn what the asm produced by a compiler from C/C++ code looks like. There is a real huge difference between a basic Windows app written in C/C++ and compiled, and one written in asm. One way I found to quickly understand the structure and format of the deadlisting of a C program was to leave the disassembly window open in my IDE (Visual C++). I didn't use it for debugging, but I made a point of looking at it and trying to correlate the asm I saw to the C I wrote.

I will pm you the name of a commercial app that is a very simple, 2 byte crack. The code logic is easy to follow, and once you get to the point where you want to try to crack something on your own, it's a good start. It'll also give you a sense of achievement knowing you figured out the crack on your own, without any tutorials.


sick template-stuff aka compile-time programs
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > sick template-stuff aka compile-time programs
PDA

View Full Version : sick template-stuff aka compile-time programs

0rp
02-23-2005, 08:13 AM
#include <stdio.h>

template<int N> class Factorial
{
public:
enum { value = N * Factorial<N-1>::value };
};

class Factorial<1>
{
public:
enum { value = 1 };
};

int main(int argc, char **args)
{
printf("%d\n", Factorial<10>::value);
return 0;
}

solving algorithms at compiletime
funny shit
dELTA
02-23-2005, 08:38 AM
Hehe, I once wrote a complete executable linker in pure compile-time MASM macro language. It even used self modifying macro code, and produced very nice and compact viral code too... :D Pffft, two-line factorial solvers... ;)
bilbo
02-23-2005, 11:22 AM
solving algorithms at compiletime
Great example of templates!
In fact the resulting disassembly is simply

push 375F00h
push "%d"
call _printf

I was asking why in the hell enum had been used... In fact, in the net, you can find also the variant which replaces

enum { value = N * Factorial<N-1>::value };
enum { value = 1 };

with

static const int value = N * Factorial<N-1>::value;
static const int value = 1;

Then I understood. It is a bug in Micro$oft (oops... the temp forum $...) compiler! See http://support.microsoft.com/kb/241569/EN-US/

Regards, bilbo


An unusual driver based Time-trial protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > An unusual driver based Time-trial protection
PDA

View Full Version : An unusual driver based Time-trial protection

Kayaker
02-23-2005, 06:17 PM
Hi All,

I thought I'd mention a little driver based time-limited demo found running loose in the wilds...

I was examining a 'security' driver recently, with a friend and fellow member, to see how it operates. Purely academic reversing you understand, so I was quite naturally concerned that its 15-day time trial might interfere with our long term research plans... ;-)

Briefly, it hardcodes the download date (y/m/d) within the .data section of the sys driver, which is bundled with 5 other executables (exe/dll) into a single install file. If you download the install file the next day from the server, the file has been updated to the new date, the only changes between the 2 files. We'll call this weakness #1...

The driver, which loads on system startup, uses KeQuerySystemTime to get the current date, then uses RtlTimeFieldsToTime to convert its hardcoded download date from the .data section, to a comparable format. Then there is a simple comparison and an ExpiredFlag is set.

The ExpiredFlag is checked in 3 different ways. There is a DeviceIoControl call by the main GUI app when it starts up, which simply checks if the ExpiredFlag is set in the driver and returns. If expired, a Nag dialog pops up, thence to _Exit. The other 2 ways are slightly more interesting.

The driver itself is designed to monitor applications starting up as part of its functionality, along with hooking certain IDT and ServiceDescriptorTable vectors, and making version-specific patches to ntoskrnl. It uses both PsSetCreateProcessNotifyRoutine and PsSetCreateThreadNotifyRoutine to register system callback routines, which are user-defined functions which will be notified any time a new process or thread is created or destroyed.

The PsSetCreateProcessNotifyRoutine callback has only 1 purpose - every time an application on your system starts/ends, there is a further check using KeQuerySystemTime and RtlTimeFieldsToTime to set (or not) the ExpiredFlag.

ProcessNotifyRoutine:
call querytime ; KeQuerySystemTime + RtlTimeFieldsToTime
test eax, eax
jnz @F
mov ExpiredFlag, 1
@@:
retn 0Ch

The 2nd callback registered to the system, by PsSetCreateThreadNotifyRoutine, monitors thread creation and deletion, and is the actual workhorse of the driver. But what it *also* does is sneakily take a look at the ExpiredFlag once again and act accordingly.

(*PCREATE_THREAD_NOTIFY_ROUTINE) (
IN HANDLE ProcessId,
IN HANDLE ThreadId,
IN BOOLEAN Create
);

ThreadNotifyRoutine:
...
mov edx, [ebp+ProcessId]
lea ecx, [ebp+var_4]
push ecx ; OUT PEPROCESS *Process,
push edx ; IN PVOID ProcessId
call PsLookupProcessByProcessId
test eax, eax
jl _exitThreadNotifyRoutine
mov eax, ExpiredFlag
test eax, eax
jnz _exitThreadNotifyRoutine
...

And finally, the hardcoded date check itself:

; Format of embedded trial date in the .sys driver data section
; .data:0 HardcodedTrialDate_year dd 7D518h
; .data:4 HardcodedTrialDate_month dd 200h
; .data:8 HardcodedTrialDate_day dd 1A00h

QueryTime proc near

CurrentTime = LARGE_INTEGER ptr -20h
Time = LARGE_INTEGER ptr -18h
TimeFields = TIME_FIELDS ptr -10h

.text:10 sub esp, 20h
.text:13 push ebx
.text:14 push esi
.text:15 lea eax, [esp+28h+CurrentTime]
.text:19 push edi
.text:1A push eax ; CurrentTime
.text:1B call ds:KeQuerySystemTime ;
.text:1B ; KeQuerySystemTime obtains the current system time
.text:1B ;
.text:1B ; KeQuerySystemTime(
.text:1B ; OUT PLARGE_INTEGER CurrentTime
.text:1B ; );
.text:1B ;
.text:21 mov esi, HardcodedTrialDate_month
.text:27 mov edi, HardcodedTrialDate_day
.text:2D mov ebx, HardcodedTrialDate_year
.text:33 xor ecx, ecx
.text:35 mov dword ptr [esp+2Ch+TimeFields.Year], ecx
.text:39 and esi, 0FFFFh
.text:3F and edi, 0FFFFh
.text:45 mov dword ptr [esp+2Ch+TimeFields.Day], ecx
.text:49 lea edx, [esp+2Ch+Time]
.text:4D lea eax, [esp+2Ch+TimeFields]
.text:51 shr ebx, 8
.text:54 shr esi, 8
.text:57 shr edi, 8
.text:5A mov dword ptr [esp+2Ch+TimeFields.Minute], ecx
.text:5E push edx ; Time
.text:5F push eax ; TimeFields
.text:60 mov dword ptr [esp+34h+TimeFields.Milliseconds], ecx
.text:64 mov [esp+34h+TimeFields.Day], di ; 1Bh = Day 27
.text:69 mov [esp+34h+TimeFields.Year], bx ; 7D5h = Year 2005
.text:6E mov [esp+34h+TimeFields.Month], si ; 02h = Month Feb.
.text:73 call ds:RtlTimeFieldsToTime ;
.text:73 ; RtlTimeFieldsToTime converts TIME_FIELDS information
.text:73 ; to a system time value
.text:73 ;
.text:73 ; RtlTimeFieldsToTime(
.text:73 ; IN PTIME_FIELDS TimeFields,
.text:73 ; IN PLARGE_INTEGER Time
.text:73 ; );
.text:73 ;
.text:73 ; TimeFields
.text:73 ; Points to the following structure, containing
.text:73 ; the time information to be converted:
.text:73 ; typedef struct TIME_FIELDS {
.text:73 ; CSHORT Year;
.text:73 ; CSHORT Month;
.text:73 ; CSHORT Day;
.text:73 ; CSHORT Hour;
.text:73 ; CSHORT Minute;
.text:73 ; CSHORT Second;
.text:73 ; CSHORT Milliseconds;
.text:73 ; CSHORT Weekday;
.text:73 ; } TIME_FIELDS;
.text:73 ;
.text:79 mov ecx, [esp+2Ch+CurrentTime.HighPart]
.text:7D mov eax, [esp+2Ch+Time.HighPart]
.text:81 cmp ecx, eax
.text:83 jl short _notexpired
.text:85 jg short check_nondemo_magic_value
.text:87 mov edx, [esp+2Ch+CurrentTime.LowPart]
.text:8B mov eax, [esp+2Ch+Time.LowPart]
.text:8F cmp edx, eax
.text:91 jbe short _notexpired
.text:93
.text:93 check_nondemo_magic_value:
.text:93 cmp ebx, 709536h ; and the answer is...?
.text:99 jz short _notexpired
.text:9B cmp esi, 709536h
.text:A1 jz short _notexpired
.text:A3 cmp edi, 709536h
.text:A9 jz short _notexpired
.text:AB pop edi
.text:AC pop esi
.text:AD xor eax, eax
.text:AF pop ebx
.text:B0 add esp, 20h
.text:B3 retn
.text:B4 ; ---------------------------------------------------------------------------
.text:B4 _notexpired:
.text:B4 pop edi
.text:B5 pop esi
.text:B6 mov eax, 1
.text:BB pop ebx
.text:BC add esp, 20h
.text:BF retn
.text:BF QueryTime endp

So what we have are 2 driver callback routines that are continually monitoring the Time-trial status while the driver operates, every time a new process or thread is created/deleted. An interesting approach, while regretfully naive, for a "payment non-assurance plan" :D

Cheers,
Kayaker
disavowed
02-23-2005, 09:42 PM
and making version-specific patches to ntoskrnl
ughh... that's not good software design :sneaky:
Kayaker
02-23-2005, 11:40 PM
Let's see, there are about 26 variables to hold version-specific info, such as index values for the SSDT, EPROCESS/KTHREAD field offsets, etc., plus 2 version specific ntoskrnl patch search patterns, all defined for the 4 common OS versions from NT to Server2003, which makes about er, (26+2)*4, carry the 1, a heck of a lot of,... what you said. It goes with the hack nature of the driver, pretty it's not ;)
LiSa
03-11-2005, 11:08 AM
Very interesting post Kayaker, these crappy drivers seems to be used on more application than the well known t*k*.sys found on specific music sofwares....Using ssdt and idt and trampolining int1 or int3 always results in a terrific mess whith non permissives homemade rootkits. It is really nosense to sell such things (in fact look like stolen from a russian virii, I disassembled one year ago) as a protection.

L!sA
Kayaker
03-12-2005, 12:50 AM
Hi L!sA, I agree with you. Some of these "protections" get too intrusive for their own good. From what I've read, Pace is an excellent example, it's set the professional audio community into an uproar and any software using it, is recommended to be avoided like the plague. It's unfortunate for the developers that they relied on such an aggressive and expensive protection.

From a discussion group soundly complaining about the driver I found this excellent and chilling essay which should be a lesson to all responsible software developers

http://www.prorec.com/prorec/articles.nsf/files/4F0B51C39C17DA6386256B7F0077FBA6

a few comments:

-----
"Isn’t it a pity that such intrusive code was introduced to such a benign application as an audio plugin?

"My experience is clear: products protected by PACE Interlok are incompatible with one another such that uninstalling one can deactivate the others. It’s a shame when an application will not play fair and interoperate with other applications. It’s ridiculous when it will not interoperate with itself.

The situation is so farcical that the common practice is, “buy the software, but install the crack.” A large majority of people I know and respect have all done exactly that. They purchased the software, so that they own a license, but they installed the pirated version, and so avoided the copy protection altogether.

You might ask why someone would install the pirated version if they own the license. The answer is that the common wisdom is that the pirated version (which does not contain any traces of PACE Interlok) is more stable, and if you need to reinstall it, you don’t have to request a reauthorization"
-----

An interesting reflection on the futility of protections...

Kayaker


winice / ds 3.1, SP2 & AMD64 processors
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > winice / ds 3.1, SP2 & AMD64 processors
PDA

View Full Version : winice / ds 3.1, SP2 & AMD64 processors

lifewire
02-24-2005, 01:12 PM
I haven't been able to get winice working on my system for months, and I felt naked and defenceless with it. I tried almost everything I found on various forums, but I wasn't able to get it working at all. Until a week a go or so, somewhere in the time that this board was down, then some very cool guy on the exetools board wrote in some thread that adding '/NoExecute=alwaysoff' to the boot.ini could fix such problems. And well, it did. Maybe this help other people too, who don't have 1337 enough warez connections to get ds 3.2...

good luck.
JMI
02-24-2005, 01:27 PM
The ONLY reason someone might not have "1337 enough warez connections to get ds 3.2" is that they would have to "not know how to search the net" for what they wanted to find. :idea:

Regards,
sirius
03-01-2005, 05:50 AM
...that the best place to start learning the art of finding objects in the wild desert is
http://www.searchlores.org/

good luck


c2u by Proferror Nimnull and MakeCrk by Doctor Stein's Lab
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > c2u by Proferror Nimnull and MakeCrk by Doctor Stein's Lab
PDA

View Full Version : c2u by Proferror Nimnull and MakeCrk by Doctor Stein's Lab

Robert Booth
02-24-2005, 04:31 PM
I have been reading and working my way through the examples in the book Hacker Disassembling Uncovered by Kris Kaspersky.

He uses two tools that I am unable to find.

c2u by Professor Nimnull

MakeCrk by Doctor Stein's Lab

If you have any information on where I can get copies of these programs it would be greatly appreciated.

Robert
Kayaker
02-24-2005, 05:41 PM
Sorry to say, but this one took about 2 minutes ;) :

luck with the other,

http://programsss.narod.ru/programs/c2u.zip
sigint33
02-24-2005, 07:17 PM
8 word specific hits on google at least 2 in english for makecrk.

SiGiNT


Rootkit Revealer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Rootkit Revealer
PDA

View Full Version : Rootkit Revealer

Silver
02-25-2005, 06:25 PM
Not exactly a tool of our trade, but Sysinternals work is interesting nonetheless.

http://www.sysinternals.com/ntw2k/freeware/rootkitreveal.shtml

RootkitRevealer is an advanced root kit detection utility. It runs on Windows NT 4 and higher and its output lists Registry and file system API discrepancies that may indicate the presence of a user-mode or kernel-mode rootkit. RootkitRevealer successfully detects all persistent rootkits published at www.rootkit.com, including AFX, Vanquish and HackerDefender.
l0rtsu
03-15-2005, 01:41 PM
http://www.f-secure.com/blacklight/

F-secure released something similar a while ago.
Extremist
03-15-2005, 05:13 PM
RootkitRevealer works by diffing high-level (API) and low-level (direct data-structure interpretation) file/registry views. To hide from it, a rootkit just needs NOT to hide from it. :)
blabberer
03-18-2005, 12:10 AM
or assign use root process :) go to rootkit.com or hxdef home and read through thier forums infact some already hid it and the counter war white hacks have tried to randomize the name and the black hats have started checking the hash of process
http://blogs.msdn.com/robert_hensing/archive/2005/03/10/392092.aspx
Kayaker
03-18-2005, 02:44 PM
http://blogs.msdn.com/robert_hensing/archive/2005/03/10/392092.aspx

There are some nice references in there, thx.
blabberer
03-19-2005, 08:38 AM
Dear kayaker,
my pleasure
yes pretty interesting techniques from horses mouth like running .gif on cmd.exe to execute an exe etc etc and unpublished forensic tools good blog so i linked it
Opcode
03-23-2005, 05:55 PM
http://blogs.msdn.com/robert_hensing/archive/2005/03/10/392092.aspx

Russinovich has updated the Rootkit Revealer to block this attack. :)
There is no more a comand line version of this tool.

This war will be very funny.

Regards,
Opcode


[JOB OFFER] Reverse Engineer wanted!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > [JOB OFFER] Reverse Engineer wanted!
PDA

View Full Version : [JOB OFFER] Reverse Engineer wanted!

Zero
02-26-2005, 01:22 PM
I have received the following job offer, which I was asked to forward in this board.

URL http://secunia.com/german_security_specialist/

German Security Specialist

Secunia seeks IT Security Specialists

If your native language is German and you are fluent in C and English, communicate via TCP, use your debugger / disassembler to find software bugs, and read Full-Disclosure instead of the morning cartoons, then you would love to work at Secunia.

Secunia offers a position where an important part of your daily work involves reverse engineering of software and exploit code, source code reviews, test and evaluation of vulnerabilities.

It is important that you are experienced in reverse engineering and is profound in C coding. Your experience with reverse engineering and C programming does not need to be work related.

Preferably you have coded and reverse engineered software on both Windows and Linux or other *BSD and Unix variants.

Secunia offers a position in a young and dynamic company, where you will be working closely together with our highly skilled security researchers and developers.

Secunia is an international organisation with employees from Norway, Sweden, Germany, and Denmark. All employees work at our offices in central Copenhagen, close to major railway stations.

Secunia is the market leading provider of vulnerability intelligence and vulnerability management solutions.

For more information about Secunia and the position contact CTO Thomas Kristensen (tk@secunia.com).

Secunia
Toldbodgade 37B
1253 Copenhagen K
Denmark


New I2S -> 4.06
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New I2S -> 4.06
PDA

View Full Version : New I2S -> 4.06

Mostek
02-28-2005, 05:13 AM
Ok finally the undefined bytes are supported in the definition of the structure also.
But i2s will still complain on structures with 0 defined variables.

So what is so special about this?
Well. Because of this I could also support variable length structures. :)
I2S now automatically detects the last variable length so that in SIce you can also see it as if it was a normal variable.

Now this was not so easy to do as I had to fix reentrant procedures. Well they are not a simple reentrant
procedures, but reenter the procedure from different layers and from different places of i2s.
Now because of this I could break something. I have done some tests, but thee is no way I could do them all.
So if you get any strange behaviour with regards of structures (like structures, local variables, registers),
please let me know.

http://mostek.subcultural.com/IDA/ida2sice_406.rar
dELTA
03-01-2005, 08:06 AM
Nice work, as always. :)
Kayaker
03-13-2005, 11:39 PM
Thank you Mostek for your continued development of this invaluable plugin. I was wondering if there were any issues to be aware of or if anyone else has a problem, when using it for driver symbols. I have no problems with a user app, but with a kernel driver the 12s produced .nms file seems not to be fully incorporated into Softice by default.

Softice *does* import the nms file symbols and section offsets, as shown by SYM, but the actual addresses don't seem to be calculated. So the symbols are never really translated into the code. However, if I then load into Softice the .nms file produced from the debug version of the MS VisualC++ code, and *then reload* the I2s-produced .nms file, the addresses displayed by SYM are now correct, and the symbols are correctly displayed from the I2s file.

I may be doing something awry, but an example from a small skeleton driver I created:

Disassembling a release version of the driver in IDA, I first created the nms file from I2s and loaded it into Softice, then I loaded the driver, which had an embedded Int3 written in DriverEntry so I would break in context. The SYM command showed the proper symbols and offsets, but note that they are section *offsets*, not full addresses. It's as if the base address is not recognized and taken into account during the translation. I'll show partial output to try to illustrate.

:sym
Address Symbol Name
.text(0001:00000000, 00000200 bytes)
...

INIT(0003:00000000, 00000180 bytes)
0003:00000000 start
0003:00000073 JumpLabel1 ; this is my IDA produced label
; not properly displayed in Sice
0003:00000092 loc_10592

After loading the MS VisualC++ debug source nms file:

:sym
Address Symbol Name
.text(0008:F39E5260, 00000200 bytes)
...

INIT(0008:F39E5460, 00000180 bytes)
0008:F39E5460 DriverEntry
0008:F39E54F8 __IMPORT_DESCRIPTOR_ntoskrnl
0008:F39E550C __NULL_IMPORT_DESCRIPTOR

After reloading the I2s produced nms file. Addresses now in context:

:sym
Address Symbol Name
.text(0008:F39E5260, 00000200 bytes)
...

INIT(0008:F39E5460, 00000180 bytes)
0008:F39E5460 start
0008:F39E54D3 JumpLabel1 ; now displays OK in Softice
0008:F39E54F2 loc_10592

Any idea how to make sure the symbols are correctly translated, or could this be a driver specific problem which needs looking into?

Regards,
Kayaker
Kayaker
03-15-2005, 02:27 AM
Oh well, easy fix. As some may have experienced, use of the SYMLOC command is necessary to relocate the symbol base for driver applications, or other situations. For reference:

Usage (symbols loaded):

symloc <section-number> <selector> <linear-address>

section-number - For 32-bit tables only. PE file 1 based section-number.
selector - For 32-bit tables only. Protected mode selector.
linear-address - For 32-bit tables only. Base address of the section.

Get the section addresses from MAP32:

:map32 skeletondriver
Owner Obj Name Obj# Address Size Type
SkeletonDr.text 0001 0008:F39F8280 0000018E CODE RO
SkeletonDr.data 0002 0023:F39F8480 00000004 IDATA RW
SkeletonDrINIT 0003 0008:F39F8500 0000017C CODE RW
SkeletonDr.reloc 0004 0023:F39F8680 0000003A IDATA RO

Set symbol base for sections 1 and 3 (.text and .INIT):

:symloc 1 08 f39f8280
:symloc 3 08 f39f8500

The correct symbols should be immediately visible in Softice. Will be necessary to relocate the symbol base each time the driver is loaded.

This doesn't really explain why Softice correctly translates the *full source* nms file without the use of SYMLOC, there must be some other factor involved. The manual symloc translation is only required when using the IDA created I2s nms file. Hardly a problem though, all is good.

Kayaker


HASP HL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > HASP HL
PDA

View Full Version : HASP HL

jorono
02-28-2005, 05:52 AM
Hi all,
I'd like to get some information about HASP HL; I visited aladdin sites, but what I really want to know are the advences, the real situation breaking that pretection system.
Thx in advance
Melvill
02-28-2005, 08:30 AM
Hi,

You can begin here
http://www.woodmann.com/crackz/Dongles.htm

i tell you that is a good start :)

Melvill
CrackZ
02-28-2005, 08:35 AM
I think they pretty much tell you the technology.

128-bit AES encryption, wanna bet where those keys are going to be stored or coming from ? ;-).

Likely scenario is either a single AES key assigned per developer or a single set of AES keys assigned and then selected for encryption/decryption using certain API parameters.

Only real question is whether they've dispensed with an ASIC of sorts in between or whether its a straight AES In/Out unit, ASIC dev costs are high so they might not have developed anything new, however it'd be just as secure to ditch the ASIC altogether.

Its the same old problem really, someone with a legitamate device will be able to study data sent and data returned. Only possibility is how the crackers are going to read out the contents, I doubt they'll use friendly Cypress chips again ;p.

Regards

CrackZ.

NB - Just thinking about it, the best place to look is probably the API guides and SDK, I expect they are available.
scorpie
03-01-2005, 08:06 AM
Cypress products have the characteristics that it is one time programmed chips, while HL (especially previous HL) put the "ID" (password, "algorithms", etc.) in the processor (ROM part), so even if we know the "ID" (refer to some program from Glasha), we can not duplicate 100% the HL, unless we know the whole contents of the ROM of the processor. As far as the encryption is concerned, it is probably still using AES, as a "standard" Cypress.

To CrackZ,

If you are interested we can have a look SuperPro USB, since the ID is put in the memory. I have a sample of the content of the memory, but it is crypted, and I am not sure if it is MD5 as somebody mentioned. For instance, the WP becomes Dword (high or low order dword of the MD5 ?) instead of a byte.
CrackZ
03-01-2005, 03:04 PM
scorpie,

Shall we continue this conversation via e-mail? ;-).
scorpie
03-02-2005, 12:01 AM
CrackZ,

Thank you very much for the positive response.

Good idea to continue via e-mail, and I am not sure if I can attach anything to your e-mail as mentioned on your web. I will try to-night to send e-mail through your "Yahoo".

Bye,
Scorpie


I don't know anything about assembly instructions
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > I don't know anything about assembly instructions
PDA

View Full Version : I don't know anything about assembly instructions

nicromonicon
02-28-2005, 06:12 AM
in hiew we dont want nop,jne,je..... right?
we want it all jmp..
so we converse from 85 to 84 and so..
my question is: where to get all conversions? like 90,74,0F8C and so?
thnx :D
naides
02-28-2005, 06:19 AM
In Hiew you should use decode mode, then while the cursor is at the opcode you want to change click F3 (edit) then F2 (asm) Now you can write the instruction you want:

Jmp 0x???????? and HIEW will lookup the correct hex equivalent and replace it for you

Option 2: Search in Reverse tools repositories, there are some utilities that lookup the hex equivalent of an opcode for you.
nicromonicon
02-28-2005, 06:47 AM
??
nicromonicon
02-28-2005, 06:54 AM
i didnt understand :confused: see i want reverse of this..
example
85----->turned to 84
0F8C------>???
0F83----->???
0F82----->???
0F86----->???
0F8E----->???

and so on...
ZaiRoN
02-28-2005, 07:22 AM
The meaning of the different jumps: jne, je, jmp, ja, js, jg, jl, jle, jge ??The answer is in your signature: I promise that I have read the FAQ (http://www.woodmann.com/fravia/rce-faq.htm) and tried to use the Search (http://www.woodmann.com/forum/search.php?) to answer my question.
blabberer
02-28-2005, 07:40 AM
well try to grab opcodes.hlp
its avl in the masm package by hutch
or look in biws site you can get it seperate
or better google
it has all those opcodes and thier menaings defined properly
like this

0F 8C cw/cd JNGE rel16/32 Jump near if not greater or equal (SF<>OF)
0F 8D cw/cd JNL rel16/32 Jump near if not less (SF=OF)

0F 8F cw/cd JNLE rel16/32 Jump near if not less or equal (ZF=0 and SF=OF)

or get ollydbg and use its assemble feature and assemble all jcc one by one and get the relevernt opcodes like this

004012EC ^\EB F6 JMP SHORT <virtualq.bullshit>
004012EE ^ E9 F1FFFFFF JMP <virtualq.bullshit>
004012F3 ^ 74 EF JE SHORT <virtualq.bullshit>
004012F5 ^ 0F84 E9FFFFFF JE <virtualq.bullshit>
004012FB ^ 75 E7 JNZ SHORT <virtualq.bullshit>
004012FD ^ 0F85 E1FFFFFF JNZ <virtualq.bullshit>
00401303 ^ 78 DF JS SHORT <virtualq.bullshit>
00401305 ^ 79 DD JNS SHORT <virtualq.bullshit>
00401307 ^ 0F88 D7FFFFFF JS <virtualq.bullshit>
0040130D ^ 0F89 D1FFFFFF JNS <virtualq.bullshit>
00401313 7A CF JPE SHORT <virtualq.bullshit>
00401315 7B CD JPO SHORT <virtualq.bullshit>
00401317 0F8A C7FFFFFF JPE <virtualq.bullshit>
0040131D 0F8B C1FFFFFF JPO <virtualq.bullshit>
00401323 ^ 72 BF JB SHORT <virtualq.bullshit>
00401325 ^ 73 BD JNB SHORT <virtualq.bullshit>
00401327 ^ 0F82 B7FFFFFF JB <virtualq.bullshit>
0040132D ^ 0F83 B1FFFFFF JNB <virtualq.bullshit>
00401333 ^ 7C AF JL SHORT <virtualq.bullshit>
00401335 ^ 0F8C A9FFFFFF JL <virtualq.bullshit>
0040133B ^ 0F8C A3FFFFFF JL <virtualq.bullshit>
00401341 ^ 0F8D 9DFFFFFF JGE <virtualq.bullshit>

i dont use hiew much (its great for search and replace and that is the only function i do with it :)

as far as i know it will put 66 prefix if you use f4--> f4---> f3 ---> f2
f4 -> f4 == mode hex
f3 == edit
f2 == asm
f9 == update
but i may be wrong coz i have some old probably hiew16
blabberer
02-28-2005, 07:44 AM
oops double meaning less post i think you should get a dose of jmi's tonic
it will be good for your health :)
nicromonicon
02-28-2005, 08:05 AM
downloaded the help file...didnt help :-/
plz guys all i want is the reverse of 0F8C thats all ..
thnx :D
CrackZ
02-28-2005, 08:27 AM
Your best reference is the Intel manuals, specifically the Instruction Set References.

hxxp://www.intel.com/design/pentiumii/manuals/243191.htm

Regards

CrackZ.

NB - If this isn't exactly what you want you get my drift, just search around intel.com.
Hero
02-28-2005, 08:49 AM
I will describe more for you:
Open an assembly ebook(for example Art of assembly),then jumps section,You will see
a table that discuss all of them.

sincerely yours
nicromonicon
02-28-2005, 09:07 AM
thnx man! :D
nicromonicon
02-28-2005, 12:20 PM
whats the reverse of 0FC8 ?
where to find reverse of opcodes?
thnx :D
lifewire
02-28-2005, 12:37 PM
0fc8 is a bswap eax. i used hiew to figure this out, probably the fastest way.
lifewire
02-28-2005, 12:40 PM
http://www.unixwiz.net/techtips/x86-jumps.html
http://64.81.49.134/
TBone
02-28-2005, 03:37 PM
Whoah. Did some threads just get merged, or am I trapped in some kind of reality-distorting time loop a la Star Trek?
JMI
02-28-2005, 04:27 PM
Some threads got merged, one got removed altogether, and someone was sent to their room without supper for creating a mess; for failure to actually read the FAQ; for failing to do any research before asking a series of really basis questions; and, finally, for posting the name of the target and target specific code. :whoops:

He would also have been spanked, but he was too far away. :rolleyes:

Regards,
Woodmann
02-28-2005, 08:08 PM
The question has been answered about six times.

This thread comes to an end.

Wood


Some problem with my simple import protector
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Some problem with my simple import protector
PDA

View Full Version : Some problem with my simple import protector

Hero
02-28-2005, 08:45 AM
Hi all
I have been witten an small import protector for some training,but I got an strange
problem in it.My algorithm is following:
I simply inject some codes in program that cause all of import table is retranslated
to use of LoadLibrary,GetProcAddress,FreeLibrary.
My problem is that when I protect the import table of an application that has no message
translation loop(for example a simple MessageBoxA in masm32) it runs normaly,but
when I protect a program that has an messge loop it get terminated with error code 80h
(ERROR_WAIT_NO_CHILDREN).
Do you know why this will happen?I can't solve it myself.
In addtion I attached to small programs and protected one to see.

sincerely yours
blabberer
02-28-2005, 09:34 AM
i dunno a quick look shows you are probably giving wrong hInstance to CreateWindowExA()

0012FF4C 004010A3 /CALL to CreateWindowExA from popup_pr.0040109E
0012FF50 00000388 |ExtStyle = WS_EX_TOPMOST|WS_EX_TOOLWINDOW|WS_EX_WINDOWEDGE|WS_EX_CLIENTEDGE
0012FF54 0040106D |Class = "LISTBOX"
0012FF58 00403000 |WindowName = "Popup ListBox"
0012FF5C 00EF1140 |Style = WS_OVERLAPPED|WS_MINIMIZEBOX|WS_MAXIMIZEBOX|WS_VSCROLL|WS_SYSMENU|WS_THICKFRAME|WS_CAPTION|1140
0012FF60 BA558190 |X = BA558190 (-1168801392.)
0012FF64 0000012C |Y = 12C (300.)
0012FF68 8B550000 |Width = 8B550000 (-1957363712.)
0012FF6C 00000000 |Height = 0
0012FF70 00000000 |hParent = NULL
0012FF74 00000000 |hMenu = NULL
0012FF78 43EDCC00 |hInst = 43EDCC00
0012FF7C 00000000 \lParam = NULL

can you give more specifically what problem ?? did you try using ollydbg with
as your just in time debugger to catch the exception and look at call stack ??

further down it you try to SendMessage() this
[/code]
0012FF6C 004010D6 /CALL to SendMessageA from popup_pr.004010D1
0012FF70 0009026C |hWnd = 9026C
0012FF74 00000030 |Message = WM_SETFONT
0012FF78 018A0028 |hFont = 018A0028 (font)
0012FF7C 00000000 \Redraw = 0
[/code]

which selects object here

0012FDC0 77E2B753 /CALL to SelectObject from USER32.77E2B751
0012FDC4 01010057 |hDC = 01010057
0012FDC8 018A0028 \hObject = 018A0028 (font)

after this it returns here and crashes when returning

004012D1 |. E8 20000000 CALL popup_pr.004012F6
004012D6 |. C9 LEAVE
004012D7 \. C2 1000 RETN 10

and this code is one of your callback code
Hero
02-28-2005, 10:59 AM
Hi blabberer
Thanks for quick reply.
you are probably giving wrong hInstance to CreateWindowExA()

I didn't think that I made hInstance wrong,because the sequence that I use for push and pop
data to stack is identical,and hInstance will be saved to memory and I didn't do anything in
memory.
You exactly see what I found:
did you try using ollydbg with
as your just in time debugger to catch the exception and look at call stack ??

You mean this problem is from a part of my code injection that cause CreateWindowExA()
failed and there is nothing for hdc in next sentences?

sincerely yours
Kayaker
02-28-2005, 01:32 PM
Hi

I'm curious where you get the ERROR_WAIT_NO_CHILDREN termination message. If I run the file on XP, it dies after the first CallWindowProcA, the problem being that the ret ESP is invalid, a simple stack crash.

It occurs here:

.text:004012BF push [ebp+arg_C]
.text:004012C2 push [ebp+arg_8]
.text:004012C5 push [ebp+arg_4]
.text:004012C8 push [ebp+arg_0]
.text:004012CB push dword_40301A
.text:004012D1 call sub_4012F6
.text:004012D6 leave stack not restored correctly
.text:004012D7 retn 10h faulty return handled by KiUserExceptionDispatcher
.text:004012D7 sub_40129E endp

Using an API monitor, the code that leads up to this is:

004010D1:SendMessageA(HWND:0041029A,DWORD:00000030,DWORD:018A0028,DWORD:00000000)
0040414A: LoadLibraryA(LPSTR:004043ED:"USER32.dll")
0040414A: LoadLibraryA = 77D40000
00404162: GetProcAddress(HANDLE:77D40000,LPSTR:004043F8:"CallWindowProcA")
00404162: GetProcAddress = 77D45F5A
00404169: FreeLibrary(HANDLE:77D40000)
00404169: FreeLibrary = 1
004012D1: CallWindowProcA(LPDATA:77D632BC,HWND:0041029A,DWORD:00000030,DWORD:018A0028,DWORD:00000000)
004012D6: CallWindowProcA = 0
same thing, all roads lead to KiUserExceptionDispatcher

I wonder if this is one and the same problem, or a different issue entirely?

Kayaker
CoDe_InSiDe
02-28-2005, 05:14 PM
Hi Hero (And the others),

Hmm, none of those "protected" files run on my system (Win2K SP4) :)
And I know why...

In those protected files you've added you're own Import Table which imports 3 API's from "KERNEL32.DLL".

Now when I run the file "test_protected_no_problem.exe" (Which displays a MessageBox from "USER32.DLL"), you're injected code loads the library "USER32.DLL" with LoadLibraryA, then gets the address of MessageBoxA with GetProcAddress, and THEN it frees the library "USER32.DLL" with FreeLibrary...
This results in an exception because the address of MessageBoxA isn't valid anymore because you freed the library "USER32.DLL" (Which wasn't loaded by the Import Table).

Although I don't know why you all don't have this problem? :D
The same problem happens offcourse with the file "popup_protected_problem.exe"...

Regards,

CoDe_InSiDe
Kayaker
02-28-2005, 07:12 PM
CoDe_InSiDe might be correct about freeing User32.dll too early. The reason may be in the use of SendMessageA to execute window procedures, SendMessageA does not return until the window procedure has processed the message (WM_FONT, LB_ADDSTRING, ...). However, you do use FreeLibrary on USER32 before SendMessage has been allowed to return. Likely a similar problem with MessageBoxA which waits for user input.

If you look at the working app with the unaltered imports,
note how CallWindowProcA is a "child" of SendMessageA
DWORD:00000030 = WM_FONT

004010D1:SendMessageA(HWND:000501D4, DWORD:00000030, DWORD:018A0028,DWORD:00000000)
004012D1: CallWindowProcA(LPDATA:77E24506,HWND:000501D4,DWORD:00000030,
DWORD:018A0028,DWORD:00000000)
004012D6: CallWindowProcA = 0 (POPUP.EXE)
004010D6:SendMessageA = 0 (POPUP.EXE) ; return from SendMessageA

And your "protected" version,

004010D1:SendMessageA(HWND:000F0142,DWORD:00000030,DWORD:018A0028,DWORD:00000000)
0040414A: LoadLibraryA(LPSTR:004043ED:"USER32.dll")
0040414A: LoadLibraryA = 77E10000 (ppp.exe)
00404162: GetProcAddress(HANDLE:77E10000,LPSTR:004043F8:"CallWindowProcA")
00404162: GetProcAddress = 77E15349 (ppp.exe)
00404169: FreeLibrary(HANDLE:77E10000) ; WHOOPS, TOO EARLY?
00404169: FreeLibrary = 1 (ppp.exe)
004012D6: CallWindowProcA(LPDATA:77E24506,HWND:000F0142,DWORD:00000030,
DWORD:018A0028,DWORD:00000000)
004012D6: CallWindowProcA = 0 (ppp.exe)
CRASH OCCURS HERE ON XP & 2K

Since there's no way around using SendMessage with a listbox and LB_ADDSTRING for example, you may need to modify your code not to FreeLibrary until all your initialization code etc. is completed, anywhere this may be a problem. This includes your ShowWindow and UpdateWindow calls which also wrap around CallWindowProcA calls.

I can't *directly* tie this to User32.dll being freed too early, but I always get the same stack error on the first CallWindowProcA call executed, so something in there isn't correct.

Cheers,
Kayaker
nikolatesla20
02-28-2005, 09:01 PM
Why exactly do you wish to free the library anyway, it needs to be there. Don't free it !

-nt20
doug
02-28-2005, 10:04 PM
Although I don't know why you all don't have this problem? :D

The library gets freed when its reference count gets to zero. I suppose you have a very tight machine with few extras added? Or maybe windows XP just loads more dlls that depend on USER32, by default.

In any case, it is a bug in Hero's code ;-)
Hero
02-28-2005, 11:34 PM
Hi all
First of all I should say that I found a bug in my code that cause protected popup
is not running(it was simple,I forget to push and pop EBP and that cause problem),
and now my program is running for this target,But still some other target are not
working.
Why exactly do you wish to free the library anyway
I should do something for memory allocation and should freed somewhere.
But I get what you mean,If I free it it cause problem.
But I still don't know why test_protected_no_problem.exe is working with no problem
on my computer,But on your computer it make some trouble(mine is XP).

In addtion,Is it correct that I say sending parameters to APIs are all from its parameters
(In the other word by using stack) and the value of global register has no effect on
running an API?

sincerely yours
blabberer
03-01-2005, 04:58 AM
well there are lot of replies till now and as i posted it was crashing on CallWindowProc
return wher the stack is no balenced again (at that leave retn 10 )

so i quickly hacked it to correct the ebp yesterday and tried to run it it runs without problem in w2k sp4 ( but wait it is not showing up :) but it shows up as running in task manager :) and inside ollydbg it is again running but not showing up :)

here is the hack i did yesterday

redirected from
004012D1 /E9 76000000 JMP <popup_pr.hack>

0040134C <popup_hack.>/> \E8 A5FFFFFF CALL popup_pr.004012F6
00401351 |. 8BEC MOV EBP, ESP
00401353 \.^ EB 81 JMP SHORT popup_pr.004012D6

here is the log window details :)

Log data
Address Message
00404160 COND: GetModuleHandleA
00404160 COND: GetCommandLineA
77E10000 Module C:\WINNT\system32\USER32.dll
77F40000 Module C:\WINNT\system32\GDI32.DLL
75E60000 Module C:\WINNT\System32\IMM32.DLL
77DB0000 Module C:\WINNT\system32\ADVAPI32.DLL
00404160 COND: GetSystemMetrics
00404160 COND: GetSystemMetrics
00404160 COND: CreateWindowExA
00404160 COND: SetWindowLongA
00404160 COND: GetStockObject
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: SendMessageA
00404160 COND: CallWindowProcA
00404160 COND: ShowWindow
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: CallWindowProcA
00404160 COND: UpdateWindow
00404160 COND: GetMessageA

to kayaker
is using FreeLibrary work if there is only one count ??
that is the after the first time it is loaded and before being unloaded
it will call DllEntryPoint to denote detach and it can fail if the resources that it allocated arent deallocated and the FreeLibrary will actually not Free the Library
i think :) any way i tried to FreeLibrary some time back when working with a malware dll that got loaded into explorer i couldnt free it
yeah i tried diamond softwares apm (advanced process manger which claimed it could
unload any module and it failed and then i had to code some hacks to look why some thing fails
other wise one can use FreeLibrary() at the Start of code and and unload all dlls
that are loaded isnt it ?? it didnt work when i tried it :) what do you think any comments insights appreciated
Kayaker
03-01-2005, 10:09 PM
Hi

I'm not too sure of the question blabberer (or the answer), but you can get some clue to the internals of FreeLibrary and its reference count check as doug mentions, by disassembling with symbols, ntdll!_LdrUnloadDll. There is further description of the module reference count procedure LdrpUpdateLoadCount, in:

What Goes On Inside Windows 2000: Solving the Mysteries of the Loader
Russ Osterlund
http://msdn.microsoft.com/msdnmag/issues/02/03/default.aspx

If you take stock of what you have seen and learned so far, you will realize that the first three parts in LdrpLoadDll's processing have been completed. The last part of LdrpLoadDll to explore involves an update to module reference counts. That is the job for LdrpUpdateLoadCount.
LdrpUpdateLoadCount is a dual-purpose routine; it is called when the DLL is both loading and unloading. It attempts to walk either the Bound Imports table or the Imports table, and it will recurse on itself for any subordinate modules. The result is code that will likely be difficult for you to follow, but LdrpUpdateLoadCount.cpp contains my attempt to write pseudocode for this procedure. Distilling the essence of the pseudocode leaves the following: LdrpUpdateLoadCount walks through either the Bound Imports Descriptor or the Imports Descriptor looking for imported modules using LdrpCheckForLoadedDll and the NTDLL hash table. If the module was newly loaded by a LoadLibraryExW call, then LdrpUpdateLoadCount updates its reference count and walks its tables for any imports.

You can easily imagine a tree structure that describes the relationships between DLLs and their imports, and LdrpUpdateLoadCount must walk the tree completely to update everyone's reference count correctly. Some modules enter the process with a reference count of -1 and are skipped by this update. I leave here a question for future exploration: why do some DLLs have a reference count of -1 and the others contain an actual count?

Kayaker
blabberer
03-02-2005, 06:49 AM
Dear Kayaker,
thanks for answering
i have skimmed through osterlunds article earlier and some more articles by pietrek like avoiding dll hell

the question in simple terms is like this
assume you load iczelions win.exe (tut 03) into ollydbg
and when it has stopped on 401000

you code

00401000 >PUSH WIN_orig.004021B4 ; /pModule = "KERNEL32.dll"
00401005 CALL KERNEL32.GetModuleHandleA ; \GetModuleHandleA
0040100A PUSH EAX ; /hLibModule = 77E80000
0040100B CALL KERNEL32.FreeLibrary ; \FreeLibrary
00401010 JMP SHORT WIN_orig.<ModuleEntryPoint>

and execute it you will see FreeLibrary wont return failure :) that is it will return 1 but you will see it neither unloads the module :)

like you say it will check for -1 some where here and

77F8AA4C ntdll.RtlEnterCriticalSection MOV ECX, DWORD PTR FS:[18]
77F8AA53 MOV EDX, DWORD PTR SS:[ESP+4] ; ntdll.LoaderLock
77F8AA57 CMP DWORD PTR DS:[EDX+14], 0
77F8AA5B JNZ ntdll.77F9A0F6 <--- will not jump 77F8AA61 NOP
77F8AA62 INC DWORD PTR DS:[EDX+4] <---- here
77F8AA65 JNZ ntdll.77F8B523

if you try to play with flags and make it jump
it will still create do
77F83609 |. E8 96FFFFFF CALL ntdll.RtlpCheckDeferedCriticalSection

the param here is Loaderlock
then on its result
create an event, semaphores and wait for single object and hang for ever

[code]
Call stack of main thread
Address Stack Procedure / arguments Called from Frame
0012FC48 77F8ED75 ntdll.ZwWaitForSingleObject ntdll.RtlpWaitForCriticalSec 0012FCB8
0012FC4C 00000044 Arg1 = 00000044
0012FC50 00000000 Arg2 = 00000000
0012FC54 00000000 Arg3 = 00000000
0012FCBC 77F8ECF1 ntdll.RtlpWaitForCriticalSection ntdll.77F8ECEC 0012FCB8
0012FCC0 77FCD301 Arg1 = 77FCD301
0012FCC4 77F8F979 ntdll.RtlEnterCriticalSection ntdll.LdrGetDllHandle+60 0012FF38
0012FCC8 77FCD348 Arg1 = 77FCD348
0012FF3C 77E87F6A KERNEL32.LdrGetDllHandle KERNEL32.77E87F65 0012FF38
0012FF90 77E8DBF3 KERNEL32.GetModuleHandleForUnicodeString KERNEL32.77E8DBEE 0012FF8C
0012FFB0 77E956FC KERNEL32.GetModuleHandleW KERNEL32.77E956F7 0012FFAC
0012FFB4 7FFDEC00 pModule = "KERNEL32.dll"
0012FFBC 0040100A KERNEL32.GetModuleHandleA WIN_orig.00401005 0012FFB8
0012FFC0 004021B4 pModule = "KERNEL32.dll"

anyway thanks
hope i will understand some thing someday
Kayaker
03-03-2005, 12:37 AM
Hi

Maybe to clarify a bit, a comment on that code. I must have a different Icz tut#3 from you, because mine looks different and doesn't even export FreeLibrary. No matter, more to the point is that it's always useful to make use of the documentation on hand before delving into unknown code and changing flags willy-nilly hoping to achieve something.

Using debug symbols on ntdll!_LdrUnloadDll identifies some of the flags you should be aware of:

:77F8B61B cmp _LdrpInLdrInit, 0 ; a much used global flag
:77F8B622 jnz short loc_77F8B63E ; don't use a CriticalSection
:77F8B624 mov eax, large fs:18h ; TEB
:77F8B62A mov [ebp+var_88], eax
:77F8B630 mov eax, [eax+30h] ; PEB
:77F8B633 push dword ptr [eax+0A0h] ; PEB.LoaderLock // CRITICAL_SECTION
:77F8B639 call _RtlEnterCriticalSection@4
:77F8B63E
:77F8B63E loc_77F8B63E: ; CODE XREF: LdrUnloadDll(x)+43j
:77F8B63E inc _LdrpActiveUnloadCount
:77F8B644 cmp _LdrpShutdownInProgress, 0
:77F8B64B jnz loc_77F8B790 ; decrement _LdrpActiveUnloadCount and exit
...

Knowing RtlEnterCriticalSection takes a CRITICAL_SECTION as a parameter, you can analyze the code you posted and see what flags you are actually messing with. RtlEnterCriticalSection is simply used to synchronize (protect as a resource) the code that will follow.

typedef struct _RTL_CRITICAL_SECTION {
PRTL_CRITICAL_SECTION_DEBUG DebugInfo;

// The following three fields control entering and exiting the critical
// section for the resource

LONG LockCount;
LONG RecursionCount;
HANDLE OwningThread; // from the thread's ClientId->UniqueThread
HANDLE LockSemaphore;
DWORD SpinCount;
} RTL_CRITICAL_SECTION, *PRTL_CRITICAL_SECTION;

You can probably see that changing the jump after the check for RTL_CRITICAL_SECTION.SpinCount (DWORD PTR DS:[EDX+14]), may not be what you want to do. At least not without in conjunction with some other modification.. ;)

As a sideline to this re "the loading process", for the tech-heads, you can enable the Debug version of the ntdll Loader by modifying the PEB NtGlobalFlag bit 2 (FLG_SHOW_LDR_SNAPS, see struc SYSTEM_GLOBAL_FLAG, ntapi.h). The various LDR: DbgPrint messages used by the loader in ntdll will be sent to Softice or other debugger.

Fortunately, you don't have to do this bit modification yourself, the Resource Kit util, GetFlags (gflags.exe) will do it for you (and modify the other 25 NtGlobalFlag bits for playing). Here's the output for Icz's WIN.exe, the loader LDR: messages interspersed with the NTICE ones:

NTICE: Load32 START=400000 SIZE=4000 KPEB=81A6CA80 MOD=WIN
NTICE: Load32 START=77F80000 SIZE=7B000 KPEB=81A6CA80 MOD=NTDLL
LDR: PID: 0x28c started - 'c:\win.exe'
LDR: NEW PROCESS
Image Path: c:\win.exe (win.exe)
LDR: USER32.dll used by win.exe
NTICE: Load32 START=77E10000 SIZE=65000 KPEB=81A6CA80 MOD=USER32
LDR: USER32.dll bound to NTDLL.DLL
LDR: USER32.dll has correct binding to NTDLL.DLL
LDR: USER32.dll bound to KERNEL32.DLL
NTICE: Load32 START=7C4E0000 SIZE=B9000 KPEB=81A6CA80 MOD=KERNEL32
LDR: KERNEL32.DLL bound to NTDLL.DLL
LDR: KERNEL32.DLL has correct binding to NTDLL.DLL
LDR: USER32.dll has correct binding to KERNEL32.DLL
LDR: USER32.dll bound to NTDLL.DLL via forwarder(s) from KERNEL32.DLL
LDR: USER32.dll has correct binding to NTDLL.DLL
LDR: USER32.dll bound to GDI32.DLL
NTICE: Load32 START=77F40000 SIZE=3C000 KPEB=81A6CA80 MOD=GDI32
LDR: GDI32.DLL bound to NTDLL.DLL
LDR: GDI32.DLL has correct binding to NTDLL.DLL
LDR: GDI32.DLL bound to KERNEL32.DLL
LDR: GDI32.DLL has correct binding to KERNEL32.DLL
LDR: GDI32.DLL bound to NTDLL.DLL via forwarder(s) from KERNEL32.DLL
LDR: GDI32.DLL has correct binding to NTDLL.DLL
LDR: GDI32.DLL bound to USER32.DLL
LDR: GDI32.DLL has correct binding to USER32.DLL
LDR: USER32.dll has correct binding to GDI32.DLL
LDR: Snapping imports for win.exe from USER32.dll
LDR: KERNEL32.dll used by win.exe
LDR: Snapping imports for win.exe from KERNEL32.dll
LDR: Refcount USER32.dll (1)
LDR: Refcount KERNEL32.DLL (1)
LDR: Refcount GDI32.DLL (1)
LDR: Refcount KERNEL32.DLL (2)
LDR: Refcount USER32.DLL (2)
LDR: Refcount KERNEL32.dll (3)
LDR: Real INIT LIST
C:\WINNT\system32\KERNEL32.DLL init routine 7c4ece51
C:\WINNT\system32\USER32.dll init routine 77e311c5
LDR: KERNEL32.DLL loaded. - Calling init routine at 7c4ece51
LDR: USER32.dll loaded. - Calling init routine at 77e311c5
LDR: PID: 0x28c finished - 'c:\win.exe'
NTICE: Exit32 PID=28C MOD=WIN
NTICE: Unload32 MOD=WIN

Have fun,
Kayaker
blabberer
03-03-2005, 09:20 AM
hehe kayaker ,
iczelion made only one set of tuts and they will be same for you as well as me
:)

i said you code that meant assembling it onsite

and when you assemble in ollydbg you dont have to have any imports imported by the exe if the module is loaded ollydbg will call any exports that module exports without the implicit need by the loaded app importing it

all you have to do is
call "Module_Name.Import_Name"

anyway on your second point of using gflags.exe well i dont use gflags.exe but use
a registry file
which is like this

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"GlobalFlag"=dword:00000002

just merging this will put out all those dbgprint messages in ollydbg

77F9FA77 Debug string: LDR: Snapping imports for WIN_original.exe from KERNEL32.dll
77F9FA77 Debug string: LDR: Refcount USER32.dll (1)
77F9FA77 Debug string: LDR: Refcount KERNEL32.DLL (1)
77F9FA77 Debug string: LDR: Refcount GDI32.DLL (1)
77F9FA77 Debug string: LDR: Refcount KERNEL32.DLL (2)
77F9FA77 Debug string: LDR: Refcount USER32.DLL (2)
77F9FA77 Debug string: LDR: Refcount KERNEL32.dll (3)
00400000 Module C:\masm32\ICZTUTES\TUTE03\WIN_original.exe

anyway what i was asking was is it possible to free a module which was loaded
explicitly by an app by calling FreeModule()

thanks and regards
Kayaker
03-03-2005, 12:29 PM
hehe kayaker ,
iczelion made only one set of tuts and they will be same for you as well as me :)
i said you code that meant assembling it onsite

Aah good, I thought maybe you'd gotten hold of a l33t set of Icz tuts or something :p
I think I understand now, sorry, I'm not too familiar with all the cool things you can do with Ollydbg.

Cheers
Hero
03-09-2005, 04:21 AM
Thanks for great help on everybody.
Now my import protector is more better and is able to protect import table for
more compilicated programs such as winrar.
But I still have a big problem.It about MFC dlls.
The way that I used to protect IT with LoadLibrary and GetProcAddress is that
I inject some code based on orginal program IT into new program and overwrite
the FirstThunk of imported functions to mine program addresses and destroy that headers of that imports.
But this will cause problem in MFC.
Because programs that uses MFC,will use IT in other ways too.In some functions
they read the address in IT table for some function,Then read what is in that address.
Any suggestion that How I can bypass this problem?
(I think I should write all in an other way :( ,Can you suggest a better way or how
I can correct this?)

sincerely yours
Hero
04-07-2005, 05:08 AM
Hi again!

I should say that I try to correct this problem.I make a list for DLL that should not

recontructed like this,and I use the previous place of their FirstThunk value for them.

I mean When I try to make a new IT for protected file,After the main IMAGE_IMPORT_DESCRIPTOR

that contains the needed kernel32.dll function for me,I add the DLLs that should not

rebuilded IMAGE_IMPORT_DESCRIPTOR after them,but for these DLLs I use the

previous FirstThunk.

But I don't know why my PE structure crashs.I explore protected program with

"PE explorer" and the PE structure is correct on the face of it and I can't find
the PE problem.Do you have any suggestion?
I attachech a sample for corrupted file.

sincerely yours
blabberer
04-07-2005, 11:48 AM
your 30 kb test is looking for 1.5 mb download in the name of mfc71.dll
and msvcr71.dll :) well i had them some where in my hdd :)

so by copying them to local directory i was able to load your hello world :)
both of them in ollydbg (didnt look further but it seems your protected exe is not loading the mfc dll at all :( look at the debug strings that i have attached if you downloaded it or if you dont want please reply so that i can delete the attachment

anyway your protected is crashing here it seems you are trying to loadlib msvcr

0040A8E3 FF75 0A PUSH DWORD PTR SS:[EBP+A] ; MFCtest_.0040CB46
0040A8E6 8B55 14 MOV EDX, DWORD PTR SS:[EBP+14] ; MFCtest_.0040CBAD
0040A8E9 FF12 CALL NEAR DWORD PTR DS:[EDX]
0040A8EB 33D2 XOR EDX, EDX ; MFCtest_.0040CBAD
0040A8ED 8B5D 0A MOV EBX, DWORD PTR SS:[EBP+A] ; MFCtest_.0040CB46

but [edx] == 000000 at this point
DS:[0040CBAD]=00000000
Hero
04-08-2005, 03:01 AM
Thanks blabberer
I get that log then if you want,you can delete it.
In addition I can't see anything abnormal for MFCTest_p log,Do you see any?
The main problem is that in some MFC programs DLLs like "msvcrt",Program use
has an strange use of IT.It gets the address of FirstThunk from IT for some
functions and then use data that is written on that address.
This will make trouble for my protector,Because I used IT table redirection.Then
I should use previous IT table for this DLL.Then Simply I create the needed
IMAGE_IMPORT_DESCRIPTOR after my program main IT for protected program
and then sets its FirstThunk to FirstThunk of previuos IT table in another section(
I should use this becuase I can't change all program use of msvct).But now this
program Crashs.
Is it possible this happen because I use two sections for saving my IT table
IMAGE_IMPORT_BY_NAME(one is the previous IT for msvrt and the other one
for my main IT table?

sincerely yours
blabberer
04-08-2005, 03:17 AM
as i stated i did not look further apart from loading both in ollydbg
and during the fleetin glance that i took at the debugstring i saw some
add to list string by ollydbg that states import lookuptable address out of blah blah also during stepping i noticed that i faced a single step exception
which i think shouldnt apaart from these observations i did not look further
bilbo
04-08-2005, 04:25 AM
Hero,

I don't understand exactly what have you done (you should have also provided some source code to better clarify your imports obfuscation process, but maybe it is too valuable to give to us :D )...

Anyway, be warned that the address you get from some system DLL is NOT ALWAYS the imported function entrypoint!

E.g (XPSP1):
KERNEL32!RtlUnwind shows the address (taken from imports table) 0x77EB3ADA; but there isn't any code at all at that location. There is just a simple ASCII string, null terminated: "NTDLL.RtlUnwind", a sort of redirection...

In fact, if you execute
GetProcAddress(LoadLibrary("KERNEL32"), "RtlUnwind");
you will not get 0x77EB3ADA, but 0x77F50C44, which - you already can guess it - is the address of NTDLL!RtlUnwind.

Amazing, isn't it?
Best regards, bilbo
Hero
04-08-2005, 11:05 AM
Hi bilbo
Thanks for that notification! :yay:
But I should say that rerirection will not affect me,Because my main algorithm
is this:
1-Add a section to file with a sub routine that gets an address for encoded name
of function that I need.
2-I decode name of that function,Then using LoadLibrary and GetProcAddress I will
find and run it.
3-The important phase is changing the value that is refered by FirstThunk of
IT table to address of my program that generate needed address for decoding
function,and eliminating IMAGE_IMPORT_DESCRIPTOR of main program.
I think you get what happened now!I will add a redirection to program!
(I think after completing this protector it is no need for writing its cracking tutorial
because I said anything here for this phase of protector! ;) )
Now I get problems from msvrt DLL in MFC programs.For get my problem you can
simply run MFC_test.exe in ollydbg and see how program is using this DLL.
Accessing this DLL is deferent to normal use of IT table in some places.

sincerely yours


phys @ EE200000h..
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > phys @ EE200000h..
PDA

View Full Version : phys @ EE200000h..

evaluator
02-28-2005, 12:05 PM
was offline & was testing my mem-reader &..

yesterday unbeleavable times pressed RESET on my PC bcoz of
this strange video memory EE200000h..

as finally discovered, on this page can be read first 600h byte;
if try read more, processor will freeze;

keep in mind..
disavowed
03-01-2005, 08:16 AM
let me guess... nvidia driver? :)
evaluator
03-01-2005, 12:49 PM
what then?
i'm directly accesing that memory, not driver;
disavowed
03-01-2005, 11:30 PM
what then?
i'm directly accesing that memory, not driver;
you said it was video memory. i took that to mean you were writing to the video card through mapped memory
evaluator
03-02-2005, 05:50 AM
that is video memory=EE200000h physical address.
it mapped into virtual memory somewhere..

is someone teached me, use in softice command:
PHYS EE200000

than try to view that page fully in sice.

i just blacklisted that phys_mem in driver;

if for non-nvidia tape cards is not same..
disavowed
03-02-2005, 11:15 PM
right... your question (answer?) was lost in translation :)


HOW TO UNPACK FILES FROM MICROSOFT MSP ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HOW TO UNPACK FILES FROM MICROSOFT MSP ?
PDA

View Full Version : HOW TO UNPACK FILES FROM MICROSOFT MSP ?

nebular
02-28-2005, 09:10 PM
THE FILES CAN BE DISPLAYED IN winrar ,but cannt extract form it , how can i extract the files in it ? i have tried orca( windows installer sdk) it can not display
files
nebular
03-01-2005, 03:59 AM
i have done it with total commander (msi plugin) :D


Distributed reverse engineering with IDA Pro seems to be now a reality
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Distributed reverse engineering with IDA Pro seems to be now a reality
PDA

View Full Version : Distributed reverse engineering with IDA Pro seems to be now a reality

Polaris
03-02-2005, 08:06 AM
It seems that finally someone (pedram) worked out a way to let multiple Reverse Engineers work __concurrently__ using IDA Pro as a client and then sending data to a centralized server.

Link is here:
http://www.idefense.com/iia/releases/ida_sync.zip

The most interesting thing is the worderful opportunity this plugin gives us all: if we'd ever need to join on a single project, we can do that in real-time without the annoiance of working with dumped IDCs and large IDBs.
dELTA
03-03-2005, 11:13 AM
Cool! :cool:
JMI
03-03-2005, 02:53 PM
dELTA:

When you said "cool," were you referring to "The MountainSide" and the "Cryptic WinterStorms"??? Or to the concurrent use of IDA??? Or all three??? :devil:

Regards,
Polaris
03-03-2005, 03:06 PM
dELTA:

When you said "cool," were you referring to "The MountainSide" and the "Cryptic WinterStorms"??? Or to the concurrent use of IDA??? Or all three??? :devil:

Regards,

:D :D :D :D :D :D
evaluator
03-03-2005, 03:13 PM
delta is about connection your PC to some unknown server:)
JMI
03-03-2005, 03:23 PM
And I was about teasing my friend dELTA and having some fun with Polaris' "signature." :smug:

Regards,
evaluator
03-04-2005, 08:43 AM
JMI!!

you have 1999 post! don't post something sometime, to keep this interesting value:))
esther
03-04-2005, 09:20 AM
and get a lollypop from you rofl
dELTA
03-04-2005, 10:04 AM
delta is about connection your PC to some unknown server:)Yeah, while taking a first glance it wasn't apparent that this "central server" had to be the one owned by iDefense, which makes the whole thing a lot less interesting, but anyway... :-/
disavowed
03-04-2005, 10:28 AM
Yeah, while taking a first glance it wasn't apparent that this "central server" had to be the one owned by iDefense, which makes the whole thing a lot less interesting, but anyway... :-/
Umm... I just looked at it and it's designed for you to run your own server. I don't think iDefense would think that people would want to use theirs.
dELTA
03-04-2005, 10:42 AM
Ok, I guess that means I should really stop listening to all these rumors and start looking into things myself instead. :) Now, if I could only find that store that someone told me was selling time... ;)
JMI
03-04-2005, 12:49 PM
Eval:

Just for you I won't post "something sometime" to keep that "interesting value," but I shall post "anything anytime" to change it. :devil:

Regards,


Execryptor
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Execryptor
PDA

View Full Version : Execryptor

jorono
03-02-2005, 12:57 PM
Hi all,
I'd like to ask a simple question: Is there a way to unpack notepad.exe once you packed it with execryptor?
JMI
03-02-2005, 02:51 PM
Ah, but you really want more than a "simple" answer. If the answer were "yes," your next question would be "how" and you really need to actually read the FAQ before you even think about asking the second question. :yay:

Regards,
jorono
03-03-2005, 02:46 AM
Hi,
JMI, huhuhu, I have read the FAQ...that's why I asked If it's possible, not how! :) However, my problem it's finding EOP. Im using ollydbg, but as I saw on google, execryptor has tricks to avoid it. Same with procdump. What tools are the best? Sice hidden? Thx
JMI
03-03-2005, 10:36 AM
And if you actually READ the FAQ, did you read the other threads on this subject which are here in the Forums? And which part of the FAQ that states that you need to show some of your work (without target specific code) did you NOT understand. So far, all you have said is that YOU don't know how to do ANYTHING with this protector. This is NOT the place where you should ask someone else to do EVERYTHING for you.

If you read the threads here you might have learned some information about the "packer" used with excryptor and if you had actually "searched" on the net you should have discovered that there is an Olly script designed for this protector, and reading even the limited discussion of the topic posted on the Olly Forum should have given you some useful clues, which you apparently haven't discovered yet.

In other words, you have apparently not done much of anything to try to solve your own problem before you posted your "simple question" here. More than that is "expected" of posters here.

Regards,
jorono
03-03-2005, 11:02 AM
Hi all,

No, JMI..you're wrong. I've been working with execryptor more than a month. I know the ollyscript you mentioned, but it only works with 1.5x version. Im working with 2.1.xx

An hour ago, I found th EOP (at least I think so :) ), but now revirgin hangs.. :S

I couldn't find on the forum any thread about execrypt; that's not correct: I found 3 items but no one can help me.

I feel my question is no welcome. It's true? Why? Maybe is only my paranoic mind...

Thanks in advance
dELTA
03-03-2005, 11:28 AM
All good questions are welcome here, but you didn't tell anyone any of these things from the start, that's the biggest problem, you came off as a stupid crack request, and you still have some proving to do that it's not...
jorono
03-03-2005, 01:55 PM
oki, I'll preppare an essay with my steps trying unpack execryptor. Nowadays i'm working, but always have time for assembler!
thanks and be nice!
JMI
03-03-2005, 02:45 PM
As dELTA has said, the issue is not what you may know or what you may have done, but what you have written here. We are not mind readers and do not know what you may or may not have done before posting your question, except what you say you have done. That is why I used the word "apparently," which means that is how it "appears" from what you have posted. The FAQ does contain a list of what one should try to include in a post and if you review that list and look at your first three posts you will see that you have provided very little information about what YOU may have done to try to help yourself.

The point is, that although you MAY have actually done a great deal, you didn't actually SAY you had done ANYTHING until your third post and even that one does not reveal much about what you have actually done. For example you did not say you had searched for or found anything about this protector. And you have not said whether you found that the program is still using UPX as a packer? You have not confirmed whether it still excrypts only certain portions of the code of the original software? You have not said whether you know about hiding Olly and whether you have tried anything to do so? You have not said whether you have examined the plugin for Olly for this protector to determine it's effectiveness for this version of the protector? You have not said whether you have tried Imprec because revirgin hangs. Do you see the difference?

Regards,
evaluator
03-03-2005, 03:15 PM
& when you will done all what JMI asked, then..
then..
JMI & delta can't help you:)
JMI
03-03-2005, 03:20 PM
Oh what a cruel world. :D And if I wanted to, I could tell him that there is more current information on the subject on exetools. :rolleyes: Maybe I will, and maybe I won't. :sneaky:

Regards,
jorono
03-04-2005, 03:02 AM
Hi all,
Hehehe, I see..... you're right, but I also. I just said if it's possible! By the way, from my point of view, this would be a philosophical thread (to be or not to be :D), and it's not! You are allowed to suspect i'm a 'script kiddie' and act in consecuence, but I'll demonstrate you are wrong, at least I hope so!! jejejje Now I will explain what I'm doing, but I need time because as I said, I'm working so far away from my home, and only can spend a few minutes per day on assembler. When I'll come back, i'll post my paper over my work. Till this moment, have a nice day!
thanks to all.
evaluator
03-04-2005, 08:49 AM
GENERIKO:

Indefinitely things we CAN, Indefinitely things we CAN'T;

yes, such thing you can do, but costs it that time time??

you also can learn programing & code you notepad:)
more good time loosing:)
jorono
03-04-2005, 09:36 AM
evaluator, I'm working as teacher 12 hour per day. 7 days in a week. Do you think I hve time or predisposition to write a long paper? Not really. I'll finish my work next week. I'll write then.
Thanks and c u!
dELTA
03-04-2005, 10:09 AM
I'm sorry we misunderstood your philosophical question, here's a philosophical answer for you: Yes :rolleyes:

And you really don't need to post an essay either, listing all the valid details will be just fine.
evaluator
03-04-2005, 10:11 AM
wow!
what program you are trying unpack, PM it (if you fail for unpack);
jorono
03-05-2005, 01:42 PM
Hi all,
dELTA: Another philosophical question: and why yes? ;) (joke)

evaluator: I'd prefer to try first by myself, thx.

I don't want to spend time in jokes or indirect words (I don't know the expression in englih, ut you know what I mean)

Other think. Yesterday I made a experiment: I have 2 files: file a (packed) and file b (dumped but packed I think). file a weights 2Mb and file 5mb does. File a of course works. File b doesn't. With PEditor I splitted all sections of file a and file b. Then I inserted .protect section of file b into file b. file a still work and hexviewing I can read a lot of string references. With olly plugin IsDebuggerPresent I can trace into ntdll, but it still hangs.. any comment will be appreciated.
Thanks and have a nice weekend!
jorono
03-05-2005, 01:44 PM
evaluator: I'd prefer to try first by myself, thx.

And maybe it's not allowed to PM comercial aplications, I don't know.
JMI
03-05-2005, 02:17 PM
You may give him the name and a download location by PM. You may NOT post them in the Forums. :yay:

Regards,
jorono
03-06-2005, 06:50 AM
Well, this sunday morning i had no much work, so I continue with my file.
Now I have a completly functional exe file. How I got? let's see:
With the original one (2mb) y got a dump with procdump (to avoid its detection at execution time, just rename it :O). The dump image is 5mb. Then I took the .protect section and put into the original. Later I fixed the characteristics to E0000020 and RS=VS & RO=VO. The new file works perfectly and is 7mb. Now, with peid i check the entropy of the different sections and I still get 2 of them packed. Any hint?
Thanks
cRk
03-10-2005, 01:27 AM
i'm not sure but is hard to believe Prodump, a very old tool, is able to make good dump runable for execrypted app.... did you added IAT manually or dumped included working IAT as well ??
jorono
03-10-2005, 04:54 AM
Hi all,
Well, it's hard to believe that excryptor detects procdump and nag with 'debugger dedectec', but its harder to say that just renaming the procdump exe that protection is bypassed.. :O However, I dumped with iat fix option active.

In other way, a user PM me and told not to spend time in unpacking, just debugging. Are you agree? It's not possible to unpack as I started this thread?

Regards
jorono
03-10-2005, 04:55 AM
i'm not sure but is hard to believe Prodump, a very old tool, is able to make good dump runable for execrypted app
What tool do you suggest? Softice with dump 'plugin'?
cRk
03-10-2005, 12:03 PM
i suggest to find OEP manually and dump from there.. rebuild IAT with Imprec + plugin for the protector if you have any.. either with SICE or olly

but if you are out of time and already you got working dumped that prodump did ... don't waste more time.. but will be good idea to analyze the script that you used with prodump to make it work... you used generic unpacking procedure method ? .... if you did then analize the script it has for that matter and easily you will be able to do it manually with any debugger like prodump did.. PM the target if possible...

Regards
MaRKuS-DJM
03-23-2005, 06:29 AM
i had a target with execryptor. my problem wasn't to find OEP but more how to get the original code back instead of all this morphing. i think unpacking it without doing this is useless because you can't analyse it correct then.
codeX
03-23-2005, 12:59 PM
Yes...
Really Pscycological thread..

Have yuu unpacked the target..
bilbo
03-24-2005, 07:50 AM
Don't be afraid to tell the truth...

It seems that no crackers (evaluator is a cracker?) have (yet and officially) come to a solution with Execryptor.
Please, correct me if I am wrong.

They put a crackme on www.crackmes.de 4 months ago, but it is yet unsolved. You can download it from their site too (http://www.softcomplete.com/download/execryptorcrackme.zip), so it is legal stuff.

Best regards, bilbo


Are we back..?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Are we back..?
PDA

View Full Version : Are we back..?

SpeKKeL
03-02-2005, 02:39 PM
Ajo,

Are we back or am i surfing a ghost server ?

Spekk.
Kayaker
03-02-2005, 02:51 PM
ssshh, this is a fragment of your imagination, go back to sleep now...
JMI
03-02-2005, 02:56 PM
And we can't be "back" because we are not where we were before, so, technically, we are "new," with the old stuff. :devil: We are still working through some mySQL issues and vBulletin compatibility and at the moment the downloading of attachments is not working correctly, but that should be remedied shortly. The rest of it seems to now be working correctly. :yay:

Regards,
bilbo
03-03-2005, 01:46 AM
Yup, I love these panamanian vacations... bilbo
Woodmann
03-03-2005, 06:34 PM
:yay:
blabberer
03-04-2005, 05:15 AM
really are we back yet i get a lot of connection timed out
it opens only after some repeated tries for the past few days :(
dELTA
03-04-2005, 09:58 AM
Ok, sure, we're not really back, you caught us, the ghosts on this non-existing server are just extra active lately, or maybe you're like that Constantine guy, but with messageboards... or something. :p But then of course, whether the new server is working without any glitches is another story. ;)


Perhaps be useful:Linux Kernel Debugger (Linice) v2.5 Released
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > Perhaps be useful:Linux Kernel Debugger (Linice) v2.5 Released
PDA

View Full Version : Perhaps be useful:Linux Kernel Debugger (Linice) v2.5 Released

Hero
03-03-2005, 07:44 AM
Hi all
I see perhaps this will be usefull then I post it.
Linux Kernel Debugger (Linice) v2.5 Released:

http://www.linice.com/

sincerely yours
0xf001
03-04-2005, 04:56 AM
hi!

yes linice is probably the debugger of choice!
i have tried from linice v 2.1 to 2.4 to get it running under 2.6 kernel with mixed success. I never have problems with exported symbols but just when i load the module everything freeeeezes :)

regards, 0xf001


Need Help with Strange JSR Call
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need Help with Strange JSR Call
PDA

View Full Version : Need Help with Strange JSR Call

BrashL
03-03-2005, 09:02 AM
Hi,
First post so go easy.

I'm working on a palm program using PalmDemon and PilotDis. I'm 99% sure I found the subroutine I need to patch, but instead of calling a specific location, the jsr is calling an address register that I can't figuire out:

0003b37a 4eadf2a4 L7590 JSR -3420(A5)
0003b37e 4a00 TST.B D0
0003b380 4fef000c LEA 12(A7),A7
0003b384 6726 BEQ L7591
0003b386 206effee MOVEA.L -18(A6),A0
0003b38a 48680006 PEA 6(A0)
0003b38e 206dcbba MOVEA.L -13382(A5),A0
0003b392 20680014 MOVEA.L 20(A0),A0
0003b396 4868003c PEA 60(A0)
0003b39a 4e4fa0c5 TRAP #15,$A0C5 = sysTrapStrCopy
0003b39e 3f3c0571 MOVE.W #1393!$571,-(A7)
0003b3a2 4e4fa192 TRAP #15,$A192 = sysTrapFrmAlert
0003b3a6 4fef000a LEA 10(A7),A7
0003b3aa 6032 BRA L7593
0003b3ac 3f3c0572 L7591 MOVE.W #1394!$572,-(A7)
0003b3b0 4e4fa192 TRAP #15,$A192 = sysTrapFrmAlert
0003b3b4 486effee PEA -18(A6)
0003b3b8 600a BRA L7592

I've never seen this in any tutorials and I can't figuire out where A5 is even populated. Any advice on where to look is greatly appreciated.
BrashL
03-06-2005, 07:50 PM
OK, no takers on that one, lets see if anyone can help with this.

I was able to get a look at the subroutine that JSR calls, but I can't seem to find the spot where D0 is set to 0. I have a log of the last couple of lines before the test D0 and I have no clue what's going on. How is D0 being set back to zero?

D0:00002004 D1:00002000 D2:00000064 D3:0000A004 D4:0003F344 D5:74760001 D6:74766572 D7:0003A20A
A0:0003F344 A1:10C94E52 A2:0003F344 A3:0003E7D0 A4:0003A298 A5:000088BC A6:0003DB4E A7:0003DB0A
USP:00000000 PC:10C98B7C SR:0000A604
10C98B7C 46C0 MOVE.W D0, SR

an RTS line here

D0:00000000 D1:00000009 D2:00000050 D3:00000008 D4:0003DD76 D5:00000000 D6:00002746 D7:0003A20A
A0:0003CF86 A1:0003DC18 A2:00008D88 A3:00008B64 A4:0003DC6C A5:000088BC A6:0003DC7A A7:0003DC48
USP:00000000 PC:0008FB36 SR:0000A004
0008FB36 4A00 TST.B D0

I thought the TST.B D0 line is looking at D0, but now I'm wondering how the flag that gets set in the first line ties in.

Sorry if these are dumbass newbie questions, but I'm really trying to figuire this out and nowhere have I found any think like this in a tutorial or paper. Appreciate and help.
lostson
03-11-2005, 03:01 PM
hi there,

have u tried to use a debugger? tracing down the code may give u a better view on whats going on.

regards
ColdWinterWind
03-15-2005, 01:17 PM
an RTS line here

If the A#-A##'s are equivilant to REGISTER's EAX, EDX, etc., I'd say that the R(eady)T(o)S(end) event re-set's the A0 register to 0 to act as a # of bits sent counter, or some such.

Just a guess, though.
lostson
03-16-2005, 01:56 PM
well...RTS is called RETUTN FROM SUBROUTINE. its just a simple return.

regarding the registers:

DXX = data registers
AXX = address registers (stack, etc)

the best way is to trace the code with a debugger (palmdebugger or southdebugger).

regards,
lostson
03-16-2005, 02:26 PM
10C98B7C 46C0 MOVE.W D0, SR

well, brashl did not post the lines before this opcode...there he will find his answer.

:)


Hiew
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Hiew
PDA

View Full Version : Hiew

naides
03-03-2005, 11:19 AM
I just want to ask arround about some annoyance in HIEW

I have Version 6.82, which was working OK until a few weeks ago. In the interim, WinXP security updates and SP2 were installed in my computer.
Now Hiew refuses to run:

It complains it cannot find the hiew.exe or the hiew32.exe files in the system: They are there, computer, I just clicked on them!!

I tried to run hiew32 from a command window, and it claims it uses an unsupported 80x300 page window format(????)

I tried to run it from a shortcut it also complains it cannot find the pif file. . .

It smells to me that the file security system does not allow this low level/all powerful editor to run/have access to the file system.

Has anyone else seen this problem and or can suggest some solutions?
lifewire
03-03-2005, 12:27 PM
I have hiew 7.01 under WinXP SP2 and it works fine. but well, just set the size of your console to 80x50, it should work fine. And by the way, hiew isn't really low level/powerful in the sense that it does nasty low level tricks, it is just a very standard app, the only thing is that it runs in a console, which is somehow rare these days.
naides
03-03-2005, 03:11 PM
Thank you Lifewire for your answer.
I think I fixed the problem, but I still don't know how.
When I run Hiew or Hiew32 in safemode, or as administrator, I have no problems. Nor did I before the SP2 was installed running as a regular user. I thought this little critter would have nothing to do with file permissions and such things.
disavowed
03-04-2005, 01:23 AM
stop using hiew. use rta instead :)
bilbo
03-04-2005, 02:02 AM
stop using hiew. use rta instead :)
I agree, it is open source too...
(but everyone is free to use the tools he likes most)
Regards, bilbo
oep
03-04-2005, 08:14 AM
I have hiew 7.01 under WinXP SP2 and it works fine. but well, just set the size of your console to 80x50, it should work fine. And by the way, hiew isn't really low level/powerful in the sense that it does nasty low level tricks, it is just a very standard app, the only thing is that it runs in a console, which is somehow rare these days.

THere is a BUG in my hiew7.01/hiew710, it's that the jump address is wrong. If the first byte of the instruction is E9, the following jump codes will appear wrong address.
So I use HIEW6.86, it works well in my WIN2K/WINXP.
evaluator
03-04-2005, 09:58 AM
use hiew, but where is RTA!?
disavowed
03-04-2005, 10:24 AM
THere is a BUG in my hiew7.01/hiew710, it's that the jump address is wrong. If the first byte of the instruction is E9, the following jump codes will appear wrong address.
see my recommendation above :)

(but everyone is free to use the tools he likes most)
no, everyone must use rta!! :p

use hiew, but where is RTA!?
Unfortunately, Squidge's website looks to be down. You can grab it from here for now: http://www.wasm.ru/baixado.php?mode=tool&id=181
UrgeOverKill
03-04-2005, 07:29 PM
naides, check to see if your printer spooler is enabled, its not a well known fact but SP2 does wreak havoc on some machines. I have investigated quite a number of instances where SP2 *modifies* some default settings internally on some machines. I have traced it to how the instruction set on various cpu's handles the file system. Sometimes just a sime defrag is the answer. I am curious what type of processor you are using and especially if its one of those hyper-threaded ones.........

hope this helps
dmx
03-20-2005, 08:39 AM
May be this can fix this problem: (from 6,86 faq file-7.xx not has it at all)
Q02. How can I run Hiew on Win2k/WinXP ?
A02. (Ruslan Kantorovych)
So what is a problem, the HIEW works up 120x50 mode, but the setting for
every DOS mode window on Win2k/WinXP is 80x300.
I solved this problem by setting the default mode to 80x25 for every
window.
How you can do it:
Open the DOS mode window;
Click on the picture of the DOS mode window in the left up angle of
the window;
Choose "Default" (it's important);
After that choose "Properties";
Open "Layout" dialog;
In the "Screen Buffer Size" area put the number 25 into "Height"
control (by default it's 300);
Press OK button it's all :)

i use hiew 7.01 on xp pro sp2 and has no problem, and hiew.exe (6,86 version) run correctly. Also i'm never start up Hiew directly- integrate hiew with TotalCommander and have fun! =) just drag *exe to Hiew icon and it will be open or make hotkey.

Unfortunately, Squidge's website looks to be down
yes it's bad, if this tool open sourse why him not use sf.net for making site project? like BIEW. RTA it's intresting tool, it has inline assembly... nice feature...


Serial fishing
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Serial fishing
PDA

View Full Version : Serial fishing

warf
03-03-2005, 11:31 AM
sup all im new to this place :D i just wanted to come straight out and say.. when is the best time to trace a call ? say i put my fake serial/name info then it breaks. when i look on the right of the register window in ollydbg i can see my name and serial a lot then it compares then i look back at the main cpu window and i see a call.. would that be the perfect time to call or what ? i hate tracing hella calls and not getting anything

warf
evlncrn8
03-03-2005, 04:53 PM
trace it and see you lazy git ;p
CrackZ
03-03-2005, 06:13 PM
.....and there was me wondering why Ollydbg provides such useless features like searching in memory and breakpoints on memory addresses.

Help!, I'm falling into a vortex of the blatently fu*king obvious.....

Normally I'd write 'Regards', but deleting this thread seems to be about the kindest thing I could suggest ;-).

CrackZ.
Woodmann
03-03-2005, 06:55 PM
Howdy,

He obviously doesnt have the latest plug-in for Olly.
The new plug-in will answer your questions with a simple query.

OK, I had to have some fun with this one :D

Read up on Olly features and you will see how easy it is to
find what you are looking for.
Olly gives you pretty much everything. You just need to know
how to utilize the different windows/features.

Oh ya, tracing hella calls is a way of life with most programs.

Woodmann
Aimless
03-04-2005, 12:52 AM
Alternatively, you can also try disassembling the file in IDA and looking at that call graphically...

Have Phun
blabberer
03-04-2005, 05:07 AM
He obviously doesnt have the latest plug-in for Olly.

may i know which plugin are you talking about :) that latest released was one ollyperl by joe stewart and that lurhq guy for thier schmoo conferance

i would like to know if i miss some thing in my collection of olly plugins :)

thanks and regards
dELTA
03-04-2005, 09:54 AM
I'm afraid all you missed was the joke... :rolleyes:


having trouble understanding
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > having trouble understanding
PDA

View Full Version : having trouble understanding

MZ_66
03-03-2005, 08:21 PM
I am having trouble understanding what this program is doing can someone please point me in the right direction???

The setup exe file has no compression envelope that can be detected with PIED or PROTECTION SCANNER (by CDKiller).

The setup.exe file properties says it is a Package For The Web Stub ver 1.3.197.10707
By InstallShield,

Running the setup.exe creates 2 folders

1: C:\DOCUME~1\yyyyyy~1\LOCALS~1\Temp\xxxxxxx

2: C:\WINDOWS\Temp\_ISTMP1.DIR

The 1st folder contains 18 files that are used to start the setup process
The 2nd folder contains 7 files don’t know the reason for them

None of the files have compression

The setup.exe file in folder 1 starts the install process it is only 56k in size this must be some kind of loader that starts _ISDEL.EXE this file is only 8k not sure of the use of this file
This file will not load on its own with OLLYDBG as it is not a valid PE file

The next file that is started is
_INS0576._MP (the number 576 changes with each re-run of package for the web )

This is were the programme ask for a serial number or do you want to install a demo
You can install the demo and modify it later into a full version this is not that hard

The problem I have is how do you find an unlock code when _INS0576._MP is deleted and recreated on the next re-run of setup.exe??

So patching the file will not work.

If you attach to the running file with OLLYDBG and set a memory breakpoint on the fake serial you have just entered you loose control of the installing process and end up in a loop of loading your serial

None of the other files are recognised as valid PE files

Softice dose not run under win xp reliable so that’s out

Can some please point me at a tut that covers this type of a problem or suggest a another way of approaching this problem :confused:
Woodmann
03-03-2005, 08:51 PM
Howdy,

These questions are all very generic. You can easily find out what they mean by searching Google.
After searching Google, you can ask your questions again but with better detail as to what you do not understand.

Woodmann
MZ_66
03-07-2005, 08:01 PM
My question is how dose one find a serial that is requested from an InstallShield setup.exe package

I realise i need to read up on how this installation works but finding something that explains it in detail has been hard

I was hoping some one could explain what function these 2 files do

(_ISDEL.EXE) & (_INS0576._MP)

I have search the web but can only find problems people are having with installations crashing they don’t go into the details or the functions of these files

Maybe I am looking @ this problem from the wrong angle ???


Generic IDAPro/ASM questions...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Generic IDAPro/ASM questions...
PDA

View Full Version : Generic IDAPro/ASM questions...

midnitrcr
03-04-2005, 02:49 PM
In IDA I have seen the parameter listing inside functions contain any of the following...

arg_0
arg_C
var_1
var_2
var_3

I'm assuming there is some sort of logic to the naming convention, but I haven't figured it out.

Also, what register do *return* values for functions get placed in? For instance a program that looks like the following...

push [ebp+var_1]
push [ebp+var_2]
call function_12345

...where the function would take those two parameters, manipulate them and return execution to the calling segment.
Polaris
03-04-2005, 03:30 PM
In IDA I have seen the parameter listing inside functions contain any of the following...

arg_0
arg_C
var_1
var_2
var_3

I'm assuming there is some sort of logic to the naming convention, but I haven't figured it out.

It is quite simple, indeed... The "arg_" prefix is used for passed arguments (positive offsets), while the "var_" prefix is used for locals vars (negative offsets). Then the offset address is used to complete the name.

Also, what register do *return* values for functions get placed in? For instance a program that looks like the following...

push [ebp+var_1]
push [ebp+var_2]
call function_12345

...where the function would take those two parameters, manipulate them and return execution to the calling segment.

This heavily depends on compiler specifications; usually using the accumulator register (EAX).

HTH,

Polaris
evaluator
03-04-2005, 04:04 PM
arg_C probably = argument at [ebp+0Ch]..

retern can be anywhere where code will want.. go there & look
TBone
03-04-2005, 05:58 PM
There are various calling conventions that define how return values are handled, but as has been pointed out, a function can return a value any way it wants to. It can even not return at all, or return to somewhere other than where it came from, as I'm sure you'll discover if/when you play around with packers/crypters. But, probably 99% of the time, something will be returned in EAX, even if it's just a status code that indicates success or a failure code. The only way to know for sure is to look at the function and see what registers are referenced and modified by the code. It could also return values by modifying data in memory. Look for any memory addresses that are pushed as arguments to the function. Variables and structures in memory that are passed by address could have their contents modified. A function could also modify the contents of a global variable without having the address passed to it.

On a related note, you can rename the variables and arguments in IDA, although I don't know if you can change the default naming convention. So if you've figured out that var_4 is the serial number, you can call it that. If you look at the top of a subroutine, IDA provides a variable legend for you. Something like:

.text:00401320 LocalFileTime = _FILETIME ptr -0C4h
.text:00401320 Time = SYSTEMTIME ptr -0BCh
.text:00401320 lParam = dword ptr -0A8h
.text:00401320 var_A4 = dword ptr -0A4h
.text:00401320 var_A0 = dword ptr -0A0h
...
.text:00401320 hWnd = dword ptr 4
.text:00401320 FileTime = FILETIME ptr 8
.text:00401320 arg_C = dword ptr 10h
.text:00401320 arg_10 = dword ptr 14h
...

As you can see, the arg_X names seem to be off by 4, for some reason, and it automatically assigns descriptive names (and types) when an argument or variable is only used as an argument to some API call that IDA recognizes.
tom324
03-05-2005, 02:31 AM
About calling conventions:

http://www.codeproject.com/cpp/calling_conventions_demystified.asp

Tom
midnitrcr
03-11-2005, 08:57 AM
Thanks for the input guys... Nice to find a place that people actually understand what the hell it is I'm talking about and can give some solid answers.
ColdWinterWind
03-15-2005, 01:28 PM
It's always good to not have to dumb-yourself-down, or spend so much time Explaining-to-Lucy that you forget your original thought!

Now if I could just find a decompiler so I'll know what my teenaged kids are talking about!


need hlp dongle emulation
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > need hlp dongle emulation
PDA

View Full Version : need hlp dongle emulation

hesho
03-05-2005, 07:11 AM
Hi all

What should I do after taking dongle dump file?
any one can help me...

best regards
hesho
CrackZ
03-05-2005, 07:28 AM
You might need to tell us which dumper you used and which dongle.

My psychic ability is playing up of late ;P.

Regards

CrackZ.
hesho
03-05-2005, 08:16 AM
Sorry
the dongle is sentinal
the dumper link
http://send2print.spymac.net/dumper.zip
thanks for ur post
CrackZ
03-05-2005, 12:09 PM
You really need to look at what precise make of dongle your trying to dump, this dumper didn't work with any of the HASP's or Sentinels I have here, however it managed to recognise a Sentinel CPlus (oddly when I had a Hardlock plugged in).

Use some of the more established dumpers from my page or around the web is my advice.

Regards

CrackZ.
Aimless
03-06-2005, 12:30 AM
Hiya Crackz,

I've been following up a couple of recent posts by you. You seem a different person. Nice to know that aggressive is a new you. Being sugary all the time can give diabetes. Wot?

No offense.

Have Phun
CrackZ
03-06-2005, 07:40 AM
Hiya Aimless,

No offence taken ;-) and I'm still as sweet as ever (honestly!), with the right brand of British tea that is ;P.

I prefer to think of the last 2 posts I've made as more 'cranky' than aggressive, a gentle prod for posters to remember that to get some help you need to make a little bit of effort, I rate it somewhere between Dr Jekyll & JMI ;P.

Have Phun (to shamelessly coin a phrase).

Regards ;-).

CrackZ.
JMI
03-06-2005, 09:48 AM
Have a cuppa? Just remember...none of those gastly tea bags. :eek: And will you play mother? Or shall I? Cucumber sandwiches anyone?

Regards,
CrackZ
03-06-2005, 10:36 AM
I was actually hoping you'd play the butler ;-).....

This might be the point where I quit while I'm ahead ;p.

CrackZ.


article on ring0 exploits
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > article on ring0 exploits
PDA

View Full Version : article on ring0 exploits

HAVOK
03-05-2005, 10:12 AM
Hi everybody,

The article below explains a few things about ring0 that are useful for coding exploits, for example:

Finding the image base of ntoskrnl.
Enumerating processes -> threads.
Running user-level code from ring0 (this was discussed in this forums).

I think it is an interesting reading:

http://www.eeye.com/html/research/whitepapers/index.html

"remote windows kernel exploitation -step into the ring 0 (pdf)"

Regards,
Havok.
thandermax
04-20-2005, 04:06 AM
Beg ur perdon ,
ANother idea would be : =>

why use this type of tricky code , where you can build your custom exploitated device driver and use it to run code in RING 0 from Ring 3 by cleaver use of code . AND THE OS WILL ALWAYS WELCOMES TO LOAD NEW DRIVER ANYTIME WITH OUT ANY CHECK.
and provides u a ntAPI to get the kernel base.

Use the driver as Resource and load it from there in runtime and hook sepecific parts of the OS!

See the code like used in InpOut32.dll.The source code is available for free from codersheaven.com

waiting for ur critisism!

:devil:
dELTA
04-20-2005, 04:10 AM
The techniques in that paper are focused on code injected directly into ring 0 code (by means of e.g. a buffer overflow) and then you must use these tricks to "break out of the driver" first before being able to do anything else...
laola
04-20-2005, 06:46 AM
Beg ur perdon ,
ANother idea would be : =>

why use this type of tricky code , where you can build your custom exploitated device driver and use it to run code in RING 0 from Ring 3 by cleaver use of code . AND THE OS WILL ALWAYS WELCOMES TO LOAD NEW DRIVER ANYTIME WITH OUT ANY CHECK.
and provides u a ntAPI to get the kernel base.

This method is used here and there (most prominently in regmon and filemon I guess), BUT: You have to have the permissions to load drivers :D
There are sanity checks, so much for sure. (Just my $0.05... ah well, inflation all around...) E.g. the OS won't load a driver with a wrong or no proper PE header checksum. (This can be fixed easily, and after some tool destroyed my patch code in the PE header by adding a tag mindlessly, I made up my own patcher, dead easy ;))
Clandestiny
04-21-2005, 08:36 AM
Beg ur perdon ,
why use this type of tricky code , where you can build your custom exploitated device driver and use it to run code in RING 0 from Ring 3 by cleaver use of code . AND THE OS WILL ALWAYS WELCOMES TO LOAD NEW DRIVER ANYTIME WITH OUT ANY CHECK.
and provides u a ntAPI to get the kernel base.

The OS will load any driver without checks, but that doesn't mean that some AV or anti-rootkit program hasn't hooked into driver loading and will halt your driver from being loaded if it resembles a virus or rootkit ;) In this case, the method presented in the article might be more stealthy (albeit more complex and less stable).

Clandestiny


16 Bit Sub-system
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > 16 Bit Sub-system
PDA

View Full Version : 16 Bit Sub-system

mac53
03-05-2005, 11:42 AM
I'm running Windows XP Home on the NTFS format. Through my browsing experience, I have learn that running any type of crack-editing material is recommended that a 32 Bit [fat32] based os is recommended. Many uses the Windows 95 os within their tutorials. I don't have Windows 95, but I still do have my 98se. Will using 98se supply the proper base requirements for working within the 16 bit sub-system? I'm also understanding that with xp, working in dos is almost impossible, or extremely difficult, [I should say]. If 98se is acceptable, then I'm going to have to put another tower together, could anyone inform me as to the maximum ram, cpu speed and type of motherboard I can use to succeed in constructing a properly functioning system to perform this type of work?

Thank you very much for your time and any assistance that may be extended. :confused:
Woodmann
03-05-2005, 05:01 PM
Howdy,

I dont have any problems with 16 bit softwares on XP.
DOS is DOS, I dont have any problems using it on this box.

You will need to run a 16 bit prog to see if there are any problems.

Woodmann
mac53
03-06-2005, 08:26 AM
Woodmann...
Thank you for your reply...
The issue I keep running into is that there's something to do with the [Windows/System32/Autoexec.nt]. I'm trying to duplicate the 16 bit issue right now...when it occurrs, which it won't be long, then I'll get back to you and document the error.

Again...Thank you...

*********************************************************

The error I received was the same as I stated above and I quote. [The system file is not suitable for running MS-DOS and Windows applications].

I guess my next question for you is...What format are you running your XP on? I'm running the NTFS format.

Again... Thank you. :-/
Woodmann
03-06-2005, 03:24 PM
I am running NTFS.

The autoexec.nt error is common.

Try this attachment and see if it helps.
If the download is corrupt, just search for xpfix on Google.

Autoexec.nt should be in the system32 directory. If it isnt there
you can search your hardrive for it and copy it into system32 directory.

Woodmann
mac53
03-07-2005, 05:32 PM
Woodmann...

Thank you for the zip, it did the trick. :yay:

I have another question... I'm new at trying to learn how to remove the cd checks in the game's .exe. I have W32dasm89 and the HIEW_v6[1].85_Full.
Are there any good tutorials that can help teach me the process? I've search all over google and haven't succeeded as of this time. I have a couple laying around in my computer, but the dudes who wrote them either needs a course in language to text skills or just needs to stop putting their so-called information out there.

Well...Thanks again for the zip and I'm hoping you can help me with this one.
UrgeOverKill
03-07-2005, 08:08 PM
check out the RCE-CD link at the bottom of this home page............


Anti Debugging ? ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Anti Debugging ? ?
PDA

View Full Version : Anti Debugging ? ?

LOUZEW
03-05-2005, 12:00 PM
Hi, all
I've unpacked an Asprotected App (***)and it work fine but when i run it with Softice active, i have a big problem when shuting down this App.
An ***.exe process is active and it's occupying 99% CPU time, I think it's an anti-debugging tip and i've searched for common issues, searched on this board too but i can't find anything.

Note : This prob don't appear when i'm debugging with Olly, the process is killed when i close Olly !

Does anybody have an idea ?

Thank's in advance
disavowed
03-05-2005, 12:05 PM
Read the FAQ: http://www.woodmann.com/fravia/rce-faq.htm
LOUZEW
03-05-2005, 02:36 PM
Hi, disavowed !
I think you are pointing this part of the rules :
DO NOT POST TARGET SPECIFIC CODE THAT INCLUDES THE NAME OF THE TARGET: this means do not post code that shows where and how to patch/keygen blah blah blah on a specific target. Keep your code snippets as generic as possible while explaining your problem.

I know this rule but if you read correctly my post, you can see that i never post any SPECIFIC RELATED CODE for this App, so i think i can post the target name no ?
Kayaker
03-05-2005, 06:03 PM
Hi

I don't really see a need to name the target at all. What would that result in? Say by chance you've discovered a new trick, though I see no logic at all in such an 'anti' tactic. We're talking about the usually straightforward *exit* process here. Well, this is a reversing board, so reverse it! wm_close, wm_destroy,... You should be able to find out where it's hanging at least, if not why. Then tell us there's something to get excited about.

Regards,
Kayaker
disavowed
03-05-2005, 06:57 PM
Hi, disavowed !
I think you are pointing this part of the rules :

I know this rule but if you read correctly my post, you can see that i never post any SPECIFIC RELATED CODE for this App, so i think i can post the target name no ?
i stand corrected
LOUZEW
03-06-2005, 01:33 PM
Hi, guys !
First of all, i've to said to KAYAKER that the target name is not an important thing, i send it here for exemple only !

Finally my problem was not the app itself but DS 3.2.
In fact, my unpacked target work fine but Softice had a bug after updating Windows XP (inline) with the last updates available.
The first App loaded under DS (or run with DS active), don't exit correctly and an app related process stay in memory using 99% CPU time. In this case if i load a second app under softice, this one exit correctly.
I've tried to reload the Compuware patch (OSINFO.DAT), nothing to do.
Tried to re-install DS 3.1, same thing.
For now, not found any solution and i don't want to reinstall all my system.

Let you know if i can find anything !

Peace.
Kayaker
03-06-2005, 07:40 PM
Oh, I know LOUZEW, you've been around long enough to know which end is up, and that the target had nothing to do with the question, it simply wasn't necessary that's all. Nor to encourage a dump/oep discussion...

There could very well likely be issues with the OSINFO.dat files after the latest MS updates, that does seem to happen. But on the other hand, there may simply be some weird glitch in your dump. If nothing else seems to fail, then you probably know the answer.

You say,

> In this case if i load a second app under softice, this one exit correctly.

Do you mean a 2nd instance of the hung app while the CPU is still looping on the 1st?
In this case the target name may be important ;-)
ART.exe doesn't allow a 2nd instance of itself. It uses a mutex named App_Art to prevent this, which you can see in WinObj, or from the OpenMutexA near the start of code. If, as you say, you can open a 2nd instance, then logically this mutex *must not exist* on the system, as seen by WinObj. Else the initialization of the 2nd app should fail as it's designed to. The mutex will be deleted sometime during ExitProcess by the system, if not explicitly with CloseHandle.

In other words, check if the mutex exists when your app is hung. If it doesn't exist, then this hang is *very, very* late in the overall exit process, and may be stack related. If it does exist, check if Art normally allows more than one instance. If not, then it seems like you've done the impossible ;)

Luck,
Kayaker
LOUZEW
03-07-2005, 03:52 PM
Do you mean a 2nd instance of the hung app while the CPU is still looping on the 1st?
In this case the target name may be important ;-)

MAny thank's for your response Kayaker but i'm sure at 99% that my prob is not ART itself but DS.
It's not a second instance of the hung app but an other app. Moreover, any app loaded in softice hang when exiting.

Tried to reinstall XP SP2 (without lastests updates) on an other computer, in this case DS work fine but when i apply the lastest updates, the problem appear again.
I think it's a pb with one of the latest updates !
LOUZEW
03-11-2005, 11:11 AM
YES guys, i found it !

Problem with Microsoft KB867282 update. When you update your XP with this package, Softice Hang your system;
Compuware don't release the OSINFO.DAT after these XP update, we have to wait for or to remove this XP update package (it's what i've done).

FOR JMI or any ADMINISTRATOR

Maybe this thread can be moved to the "Tools of our Trade (TOT) Messageboard" like a DS 3.2 troubleshooting !


HOW TO:Breaking flash movie protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > HOW TO:Breaking flash movie protection
PDA

View Full Version : HOW TO:Breaking flash movie protection

Hero
03-06-2005, 12:53 AM
Hi all
I don't know this is good article for here or not,but this is interesting:

hxxp://webdesign.templatemonster.com/cat/flash/articles/removing-flash-movie-protection-exclusive-article.3698.html

sincerely yours


disasseble for arm-processor...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > disasseble for arm-processor...
PDA

View Full Version : disasseble for arm-processor...

SpeKKeL
03-06-2005, 06:59 AM
I've bought a pda with arm processor.
Should i see more :p

I know ida can disassemble but know i've to learn those arm mnemonics ???
(i doesn't see jumps or calls,sjit!)
So i am looking the best way to reverse the progs of this machine...
Debugging on my xp machine is possible ???
Somebody here who did it earlier?
Yep i read the forum-threads about wince but i need to know whats to best way to start and using what tools.

SpeKK.
naides
03-06-2005, 09:26 AM
Try http://Ka0s.net and the links in there.
They have lists of ARM opcodes, links and tuts for debuggers etc.
disavowed
03-06-2005, 12:31 PM
In IDA, you can go to Options -> General -> Disassembly tab, and check Auto comments. This may give you enough info on the mnemonics to do your task.
SpeKKeL
03-06-2005, 04:31 PM
Thanks for the link and yes that auto comments in ida is very usefull!
Now looking futher how to debug.

Thanks again,

Spekk
SpeKKeL
03-23-2005, 02:56 AM
Hajo,

Trying to debug a pocketpc prog. i followed a tut by hexc ( www.woodmann.com/fravia/hexc_evtdebug.htm ) after installing ms embedded c++ 4.0 i copied the file target file from pocket to my desktop pc> then went to settings and gave in debug tab the download directory from the target of the pocketpc.Then when start to debug all went fine till it tries to copy the file from my desktop comp. :error:Downloading failed while copying the file from my hd... .
Anyone knows what i am doing wrong ??

Thanks,

Spekk
Shub-nigurrath
03-23-2005, 04:47 PM
just yesterday we released an first tut on wince patching, http://tutorials.accessroot.com/ might help you.
SpeKKeL
03-24-2005, 06:20 AM
Thanks Shub,

Verry good tutorial (there are so few ).
It seems i had the wrong version or missed some sdk?????
I installed 3.0 and all goes fine.
Back to "Hello world" ans study your tut!

Spekk.
naides
03-24-2005, 07:50 AM
That is a very nice and thorough tutorial indeed Shub.
I have one comment (irrelavant to the contents of the tut, just a curosity)

When you state that ARM asm does not have an op code equivalent to the x86 'nop': 0x90, so we have to implement an operation that does nothing, like (MOV R1, R1).

Actually, that is exactly what x86 assembler does: the true meaining of the instruction coded by 0x90 is 'xchg ax,ax', while 0x91 codes for 'xchg ax,cx'. of course everybody uses the most popular opcode synonym : nop
Shub-nigurrath
03-24-2005, 08:16 AM
Well, in x86 architectures the NOP is one of the documented official instructions which the CPU uses and for which there's an opcode. How that is implemented by the cpu is another matter..

this is what the intel instruction reference document tells..

NOP—No Operation
Performs no operation. This instruction is a one-byte instruction that takes up space in the
instruction stream but does not affect the machine context, except the EIP register.
The NOP instruction is an alias mnemonic for the XCHG (E)AX, (E)AX instruction.
Flags Affected: None.
Exceptions (All Operating Modes): None.
Opcode Instruction Description: 90 NOP No Operation

ARM doesn't even have this..
bilbo
03-24-2005, 08:58 AM
Shub-nigurrath,
naides is pointing out a (nice) outcome from opcodes decoding.

If you look at the opcode for XCHG Reg, EAX, the manual says it is implemented with one-byte opcode: 90+Reg,
where Reg (according to one of the initial tables of the manual) can assume the values

0=EAX, 1=ECX, 2=EDX, 3=EBX, 4=ESP, 5=EBP, 6=ESI, 7=EDI

So 90 (90+0) can be indifferently decoded as NOP, or also as XCHG EAX,EAX (in 16 bit mode XCHG AX,AX).

Best regards, bilbo
Shub-nigurrath
03-24-2005, 02:41 PM
humm, interesting, indeed, nice being this the situation so the observation is correct..ARM doesn't have an "official" way to implement the NOP (this is directly "suggested" by intel), you have to think one, given the NOP concept as one operation doing nothing, modifying only the EIP.

..fine.


Dual Plataform RCE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > Dual Plataform RCE
PDA

View Full Version : Dual Plataform RCE

naides
03-07-2005, 01:28 PM
Hi.

I am going through my first steps in Linux RCE, and before I go in a wild geese chase, I would like to ask more experienced people the viability of my approach.

I have a commercial app that is available for both Win and Linux plataforms.

I have much more experience dealing with Win RCE, so I thought analysing the protection in Win would give me the heads up when dealing with the protection in Linux.

So far, I have not made much progress, but in your opinion and experience,
How common/likely it is that the protection location, code, and implementation would be similar between the two plataforms?

Or am I just working twice here?
Polaris
03-07-2005, 02:59 PM
Well, I think that the protection per se will be NOT the same, mostly due to the substantial differences between the two OSs. So you could directly attack LINUX target...

Also for recovering source code I would directly start on Linux... IDA Pro does a great job on it! ;)

Just my 2c :D
JMI
03-07-2005, 04:57 PM
ANOTHER REMINDER!!!

Please use the small button on the far right to Reply without Quotes or the larger "Post Reply" button on the left, or the "Quick Reply" feature below the post and ONLY use the "Quote" button when you need to quote something particular to make your post clear. Quoting everything just takes up extra, unnecessary space in the database and should be avoid where ever possible. :yay:

Regards,
andrewg
03-08-2005, 12:38 AM
check both the windows and linux version to see if they have debug symbols (and/or optimisations etc).. more often than not people slip up and include debug symbols in one, it usually depends if they're mainly a windows shop. ;)

If they're both equal, go for what you know best if you want to do a quick job of it, if you wanna expland your horizons, go for the other.
Polaris
03-08-2005, 06:29 AM
Woooopppppppsss... Sorry JMI, I am a bit brainwashed in this period... :-/


RSS feed??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > RSS feed??
PDA

View Full Version : RSS feed??

Polaris
03-07-2005, 03:02 PM
Does this board support RSS??
JMI
03-07-2005, 04:53 PM
I believe it is a function supported by vBulletin, but it is not a function we have currently considered implimenting. Is there some reason why you might be interested in this feature, say as opposed to subscribing and email notification? We do not appear to be sufficiently active to sustain a feed of new information.

Regards,


Anti Smartcheck
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Anti Smartcheck
PDA

View Full Version : Anti Smartcheck

sigint33
03-07-2005, 05:04 PM
Ok,

I've been reading and learning and watching this forum for quite a while, and now I think I'm brave enough to start a thread. I've been playing with this tool and I really like it, but it seems that there are some anti-Smartcheck tricks out there that I can't find any info on, I've found a couple of threads that discuss one of these problems - Smartcheck crashes when loading the target - they end with the assumption that the file header was unpacked incorrectly, but this doesn't seem to be the case, I've got a target that has not been packed that does this, (no traces of previous packing either), and another app that loads fine but when run shows absolutely no event info. None of these has the types of anti-smartcheck stuff I've found - search for the string smartcheck or the NMSC--- thing, I do have one crackme that is dumb enough to issue a nag so I know how to bypass that one - I guess my long winded request is for a pointer to a good tut on how to defeat anti-snartcheck routines. There is some good info from the other side located at :

http://www.activelock.org/boards/index.php?showtopic=6

Any additional help would be appreciated. (I've been using both ver, 6.03 and 6.6).

Thanx!,

SiGiNT

Someone in one of the threads mentioned a 2 Byte change to a Smartcheck DLL that would presumably defeat some of the anti-smartcheck schemes, does anyone have that info?
Ricardo Narvaja
03-08-2005, 08:40 AM
smartcheck activate IsDebuggerPresent flag and can be detected with the api IsdebuggerPresent or checking the byte checked by the api.

Ricardo Narvaja
FoolFox
03-08-2005, 09:02 AM
also smartcheck didn't like so much multi-thread application...

that may be why you didn't see anything in the event windows. Have
you ever been successful with Smartcheck ? because he need to be
properly configured to give desired results....

FoolFox
sigint33
03-08-2005, 01:22 PM
Thanx for the replies!

I'm using the settings recommended by Eternal Bliss in the eb_tut4, although I've read several tuts all with different recommendations, and have had very good success with fishing out serials that are not encrypted, the only difficulty in reversing a serial protection has been when the input serial is encrypted, and checked against the encrypted real serial, it appears that Smartcheck isn't great at exposing arithmetic ops. I don't think IsDebuggerPresent is the problem as the targets run fine outside of smartcheck with smartcheck open, and a dead listing doesn't show that call. I kinda wonder about the QueryInterface call - maybe that is where the detection is taking place.

SiGiNT
Ricardo Narvaja
03-08-2005, 01:36 PM
if smartcheck is open but not debugging your aplication the flag is not activated only when you debug with smart check or other debugger the flag change to 1.

The test is by example, run your program in a debugger (ollydbg by example) without any plugin for hide the debugger of the api IsDEbuggerpresent, if the program run, is other problem,if not the flag is tested directly.

Ricardo Narvaja
sigint33
03-09-2005, 06:08 PM
Ricardo,

1 of my targets will not run in olly - bad memory write - so IsDebuggerPresent is probably the reason it crashes Smartcheck, but I still have others that do run in olly but crash smartcheck. Now the good news - they all run in BoundsChecker (a variation on Smartcheck), the difference being that BoundsChecker does not flag specific events like RegClick or Click1, that narrow the search, all the data is there but it's buried in the continuous stream of timer data and is much harder to find. If i can find the differences in the environment between Smartcheck and Boundry Checker, I'll know what to look for. In the mean time I also need to find the reason for no event reporting for my other crackme.

Thanx for your help!

SiGiNT
Crudd
03-10-2005, 09:46 PM
Theres a few ways of detecting SC, that i know of. You can use FindWindow to check the if any of the captions/classnames match up to the one(s) in an unmodified version. My tool RE-Pair will fix SC so that this method doesnt work.
IsDebuggerPresent can also be used as Ricardo Narvaja stated. Note that just because the API isnt there, doesnt mean the programmer hasnt coded his own version (its only a few asm lines long).
And one more method that i know of is checking for the presence of .SUP files in the programs directory. These files are created and used by SC. I havent quite figured out where the .SUP file creation takes place, so RE-Pair doesnt fix this yet. If anyone knows, i would love for them to share it with me.
Hope this helps you out. If one of these methods is not used, I would love to take a look at the app to see if i can figure it out.
Crudd [RET]
sigint33
03-10-2005, 11:05 PM
Crudd,

I think I can prevent the crashing problem by preventing the app from issuing an alt f4 keystroke - I'm doing a lot of searching and can't seem to find the hex equivalent, (I would imagine this is probably the 2 byte SmartCheck dll modification, but which one? there are about 8 or 10 of them), I tried RE-PAIR and it didn't work, probably because I'm on an XP platform - actually it seemed to disable SmartCheck 6.03 I haven't tried it on ver 6.6 yet. I have a tendency to obssess on problems like this so I hope eventually I'll find an answer - this is probably a good trait for a newbie! Of course I could always break down and learn how to use olly.

SiGiNT

You can prevent the .sup file being written by making the directory the target is in read-only.

Added later:

Well NUTZ! blocking alt f4 doesn't do it - back to the reading room! I'm sure you would have no problems with this target, but if I don't figure out myself , I wouldn't really be learning anything, thanks for the offer! I may have you look at the one that Smartcheck loads and runs without showing any events, that's a crackme from FCE.


Tools: Developer Playground & ComTrace
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Tools: Developer Playground & ComTrace
PDA

View Full Version : Tools: Developer Playground & ComTrace

Kayaker
03-08-2005, 12:56 AM
A couple of nice little programs to add to the RCE toolchest...

Developer Playground
http://www.blunck.info/dp.html

Hooks any process, and tracing single calls to external DLLs
Shows run-time DLL dependencies for running processes
Integrates with favorite tools such as Google, OleView, Depends and the Explorer
Saves trace output to text file
Comes with semi-integrated HTML help (not that it's necessary)

ComTrace
http://www.blunck.info/comtrace.html

ComTrace is a tool that will intercept both calls made on your interfaces and calls made to the COM library, and trace these for you. You will see the name of the method call, the parameters passed to the method and the returning HRESULT.

ComTrace will walk the callstack before method invocation and trace the values of the parameters. Before the call returns to the client, ComTrace will once again walk the callstack and hook any interfaces beeing returned to the client (such as [out], [out, retval] parameters).

Kayaker
dELTA
03-10-2005, 06:16 PM
Nice, thanks! :cool:


Identifying a protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Identifying a protection
PDA

View Full Version : Identifying a protection

kaotix
03-08-2005, 03:37 PM
Hi,

DISCLAIMER: I'm pretty new to this trade, all I did by now is the easier kind of inverting jump conditions and NOPing etc., I do however have some years of programming experience, including assembler. So if anything of the below seems stupid, please bear with me :-)

I'm working on a target which requires a serial number to be unlocked. From what I saw, a working number is not dependant on a user name or anything. I found two suspicious long hex numbers as strings (w/ 0x prepended) in the code. The longer one I haven't really tackled yet, the shorter one is 72 hex bytes which are converted to binary representation and then stroed in a 40-byte array by some algorithm I was able to reproduce in C++. This happens both when entering a serial and when reading the serial as a string from the registry, so I assume it's some kind of magic array. The entered serial number is processed by a similar algorithm which I could also reproduce.
Unfortunately the code that follows then is so packed with calls and jumps that I'm not much farther...
So I left the attempt to keygen the beast for a bit and tried to just patch out the checks, which seemed very simple as the first serial I entered (all 1's) already wasn't rejected as invalid but as for an older version - which is funny because I also found in the EXE the possible characters in the serial and that charset doesn't include '1' :-)
Anyway, I was able to unlock the thing by chaning a single byte of data while debugging, so I changed the code a bit to set that byte to 1 and BANG! Now the program aborts not right away, but when switching tabs in its main dialog.
I tested some more and found out that any change to the EXE has this result, so I gather there is some checksum or even a real signature. I doubt it's too complicated, as the whole thing isn't packed or anything.
However, I set a bpx on the PEP and then a bpm on a code location where I definately know a change resulted in the termination, to find the routine that checks the code for tampering. But that bpm never ever hit, so I'm wondering how the target could possibly check that EXE is unchanged?
It doesn't seem to me that it reads the file from disk, all calls to CreateFileA() refer to user-created data files.
Then, there seems to be some kind of anti-debugger routines, which I didn't examine too closely yet, anyway it somehow walks the process tree to look for the module VMDBG.dll, but it doesn't seem to care about sice or gdb.

Long story short, my questions are: is a r/rw bpm on the code segment supposed to work? How could I find the checksum/sig verification when such a bpm doesn't hit? Does any of the above sound like a known protection tool to you?

Thanks,
kaotix
Kayaker
03-08-2005, 05:35 PM
Hi, a few ideas

You should check other API's as well which might be used in the checksum,
CreateFileA, ReadFile, OpenFile, _hread, _lcreat, _lopen, CreateFileMapping, MapViewOfFile

Since you say it's unpacked, an api monitor would be useful.
Are any sections encrypted which might contain crc check code? A direct reading from memory may also be possible.
A checksum routine might be recognized by occurrences of any combination of ROL ROR SHL SHR in a long loop.

As for the bpm r issue, there might be breakpoint detection, though it seems less likely in general for unpacked apps. More likely is it's doing the crc check from a mapped view of the file, so your actual BP needs to be located there instead of an address in the real image.

Kayaker
kaotix
03-08-2005, 10:08 PM
Thanks for the hints. It wasn't all that hard, the EXE *is* opened with CreateFileA, apparently I was too tired last time to spot this call :-(
But hey, you made me check again ;-)

The second 0x.... string contains the checksum in some mangled way, but I won't figure that one out this time. For now I went for a slightly unclean but simple approach. Patched 6 bytes to defuse the crc check and another 1 byte to accept the bogus serial and now 1111... is recognized as valid :-)

Oh well, once again someone did soo much to implement all these checks and still it was relatively easy to bypass even for such a noob...
+SplAj
03-09-2005, 01:56 AM
Hi

Yes BPM -r and trace is the usual method however
PEiD has a nice 'krypto anlayzer' plugin that detects crypted parts. That gives a good clue as to where some checking could be done.


Tornado's crackers notes
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Tornado's crackers notes
PDA

View Full Version : Tornado's crackers notes

SaintSinner
03-08-2005, 09:47 PM
I was reading the FAQ and I noticed that there was a zip file that you could get titled Tornado's crackers notes but when I clicked on the link nothing happened. I'm new to programming and I really don't know where to start. If someone could please tell me where I could get this FAQ I would really appreciate it.

Thanks

SaintSinner
Kayaker
03-08-2005, 11:27 PM
That is an error in the FAQ which will be fixed. The link should be to woodmann.com. Start by browsing Crackz site listed below.

Kayaker


Win32dasm
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Win32dasm
PDA

View Full Version : Win32dasm

TrainingDay
03-09-2005, 01:11 PM
Hi,

I have a program that has no string references in wdasm,but when I use peek11 to extract text it shows alot. The program ask for a user/key combination. When I search in wdasm with the what peek11 comes up with it never finds it. Peid shows the program to be armidillo 3.00-3.69. thank for any help.
TrainingDay
03-09-2005, 03:32 PM
Is there a tut for this that does no require 15 post to download? And where can I find ollydpg plugin like hide olly? thank you
JMI
03-09-2005, 03:43 PM
TrainingDay:

Are you actually paying attention to where the hell you are? This is not the Exetools Forum and has no restrictions on downloading. What we DO HAVE is a FAQ which outlines what YOU are supposed to do BEFORE you ask a question and what YOU are supposted to do to TRY TO HELP YOURSELF before you ask someone else to help you.

If you want to find a tut on "armidillo 3.00-3.69" then put something REALLY complex, like "armidillo 3 + tuts" (without the quotes) in you favorite search enging and SEARCH for one your self. There is also a SEARCH button at the top of these Forums.

If you have no clue how to hide OLLY, WHY haven't YOU gone to the Olly Forum and looked for information on hiding Olly? If you do not know how to hide OLLY, why haven't YOU SEARCHED for information on hiding OLLY, here and on the net?

Actually READ THE FAQ, then get off your lazy behind and actually do some of your own work. :yay:

And, by the way, I happen to know the evil Administrator on the Exetools Forum and you only need 7 posts to have downloading privileges for attachments. :smug:

Regards,
sigint33
03-09-2005, 05:58 PM
Geesh!

JMI, you've upped it to SEVEN?

I'll never get there......

SiGiNT
JMI
03-09-2005, 08:26 PM
I have not UPPED anything on the Exetools Forum. Aaron makes those decisions and I just enforce them. :cool:

Regards,
Aimless
03-10-2005, 12:27 AM
Hello TrainingDay,

I hope you know that Wdasm DOES NOT read unicode. There are patches for Wdasm that promise you that will enable Wdasm to read unicode, but they work spordiacally at best.

I'd suggest you stop using Wdasm. Try downloading a free version of the IDA disassembler. You'll see your strings and everything else there. And besides, Wdasm is not good for disassembling complex programs.

A small word of caution. Understanding that you are using Wdasm and are as yet unaware of hiding Ollydbg, it may be a good idea to stop cracking whatever it is that you are cracking (the a'dilloed app).

Instead, I might suggest you start with cracking the Winzip version 5 and upwards and MIRC version 5 and upwards. Stop trying to crack the program you want to use. Instead LEARN cracking first. In the longrun, there will be NO shortcuts. You have to go through the steps.

Best of luck in your new career :)

Have Phun
disavowed
03-10-2005, 11:27 AM
can we create a filter on this board such that whenever anyone tries to post something with *w32dasm* or *wdasm*, their post is rejected and they're told that we don't support that disassembler here? :)
Kayaker
03-10-2005, 12:39 PM
Sure disa, and you for one know how effective those board ascii filters are, right? heheh :D :D


Need dilloed apps
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Need dilloed apps
PDA

View Full Version : Need dilloed apps

Vodka
03-09-2005, 04:17 PM
Hi guys, i'm looking for all kinds of different dillo apps.
Planning to update a older unpacker.

Thanks!
armaski8
03-09-2005, 07:39 PM
tell me where to send..

br,
Vodka
03-10-2005, 04:08 AM
Sorry, send to
narcotixx[at]gmail.com
please. Thanks.


Why I have this access between processes?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Why I have this access between processes?
PDA

View Full Version : Why I have this access between processes?

Hero
03-10-2005, 03:53 AM
Hi all
I get some strange(perhaps for me) result when I using GetWindowLong , SetWindowLong.
See this code:

OldWindowProc = (WNDPROC)GetWindowLong(hwnd,GWL_WNDPROC);
SetWindowLong(hwnd,GWL_WNDPROC,(long)(CProcessIdDlg::WindowProc));
My problem is that shown handle is not in current process of application,and its
process is compeletly separated from current application process.
Then why I can set that handle's window's WinProc in that process to a WinProc in my Application?????
I think the processes' memory are isolated from each other and they can't access
each one in normal why,Then why this work?
I using Windows CE 4.2 for my test.

sincerely yours
blabberer
03-10-2005, 04:43 AM
windows ce it probably allows you to set the GWL_WNDPROC

msdn says that restriction applies only to nt/2000/xp

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/winui/winui/windowsuserinterface/windowing/windowclasses/
indowclassreference/windowclassfunctions/setwindowlong.asp

GWL_WNDPROC
Sets a new address for the window procedure.

Windows NT/2000/XP: You cannot change this attribute if the window does not belong to the same process as the calling thread.

btw if SendMessage,PostMessage can work then all these functions must also work
all it needs is a handle and if you provide a handle then the underlying code will just validate the hWnd and work if it was validated i think


Making the change
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Making the change
PDA

View Full Version : Making the change

Ryno
03-11-2005, 12:17 AM
Hi there!

First of all, I would appreciate anybody’s input to answer my following question.

After a couple of weeks that I have been learning ASM and doing various crackme challenges I understand how reverse engineering and cracking works. The current challenge that I’m working on requires to apply some changes to the program i.e. changing the window’s title string (Title = "Unregistered"). What I need to know is, how do you actually apply the changes? Let’s say I want to change the title string. Do you need to patch it or what?

Thanx,

Ryno
:yay:
JMI
03-11-2005, 02:00 AM
Ryno:

If you have actually read the FAQ, you would know that you are supposed to show that you have attempted to find the answer to your own question. You obviously haven't done anything to try to find out how to change the title of a window, which suggests you have no idea how windows get their titles, where such titles may be found in the code, and/or the process windows uses to change them. This suggests that you haven't done much in the way of basic research on how windows works, certainly with regard to window creation and naming.

This is not a basic education school where you can come and plead ignorance and ask someone to teach you everything you might need to know about the basics of how window display and naming works in various programing systems.

Time for you to do your own work and do some searching on the net for information. One possible search criteria which comes easily to mind might be;

"changing a window's name" (without the quotes.)

You could try variations of the suggestion, such as "window's title" and you might even go the the Microsoft website and try reading up on how windows gives titles to the windows it displays, although your program, which you should not name, might be written in visual basic, .net. or some other programining language, which would affect that criteria.

You also need to read up on resource editors and hex editors which offer ways to change certain code within an exe.

At the bottom of these Forums you will find links which will provide you with a whole host of reading materials on the basics of reverse code engineering.

Regards,
Ryno
03-11-2005, 02:12 AM
Ok fair enough. I wasn’t actually asking you to teach me anything regarding window titles. If you look closely you will see that my question focused more on how the process of making changes to you application works. I’m not lazy to read up on stuff neither to do research. Since this is a forum to post questions I see no harm by seeking GUIDELINES and other’s point of view.

Thanks you for your reply though JMI… :)

Ryno
evlncrn8
03-11-2005, 08:41 AM
you hexedit your changes using a hexeditor oddly enough
esther
03-11-2005, 09:09 AM
You can also used Ollydbg by searching the strings and change the values in the memory,and then copy to executable
bilbo
03-11-2005, 11:13 AM
Or you SendMessage a WM_SETTEXT message to the target window , after it has been created...

Regards, bilbo
LOUZEW
03-11-2005, 11:29 AM
There is alot of patching apps on the net but the better one is this one you can write yourself !
sigint33
03-11-2005, 01:16 PM
Or you can use a utility recently posted here. (Showstring)

SiGiNT
Ryno
03-13-2005, 10:58 PM
Thanks guys.
See... that was all I was looking for... :p
Fake51
03-14-2005, 02:44 AM
Oh, and just about every beginner newbie cracking tut that targets an app to be patched (and that's a shitload) should have info on patching. Heck, I think there's got to be at least 100+ tuts on fravia, that mentions patching in one way or another.
While asking might help you along quick and will probably introduce you to some of the people, reading tuts and experimenting on your own still is the best way to learn.

Fake
TechLord
03-14-2005, 11:40 AM
I would like to say that JMI and Fake51 are both right...And I HAVE to agree with them... :)

Anyway, another way is to use ResourceHacker ( You can easily find it on the net and it's free) to change the items you wanted and more...If the resources are not packed or encrypted or hidden in any way...


Hardlock HL-CODE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > Hardlock HL-CODE
PDA

View Full Version : Hardlock HL-CODE

searchme
03-11-2005, 09:43 AM
hi,

@mods:
seems that my last post contained a little bit too much, didn't it? however, i'll give it another try..

to emulate the hl-code-function you have to calculate some seeds, which is usually no problem (and i promise that i'm familiar with the tutorials etc. - so this is no request like "please cr@ck smth. for me" etc. - maybe i was misunderstood in my last posting - all i want is more information - no tool etc.).. it seems that i got 2 hardlocks that use another type of encryption than the others like the demo-hardlock for example... has anyone more information about that?

regards
CrackZ
03-11-2005, 04:15 PM
Hiya,

Yes, recently I've also run into several Hardlocks where the seeds couldn't be derived from a dump. Amongst people I've been speaking too we've dubbed these the 'german hardlocks', it appears they are re-programmed in some manner, I have no more information than that.

Sp0raw assures me he will post an updated version of his dumper shortly which should allow us to "see" exactly what this modification is. A few people have been examining Hardlock's 'programmer' application and its dll as a starting point.

Regards

CrackZ.

Note to mods : Crypto probably isn't the right forum for this post imho.
JMI
03-11-2005, 05:06 PM
Agreed. ;) Although, whether it might more properly be here or in unpacking was not as clear, but I opted for here. :cool:

Regards,
isnull
03-16-2005, 10:42 AM
"German" hardlocks = old hardlocks, based on early "Flora" ASIC.
Old dongles have only function HL_CALC.

New hardlocks contains "Luna" ASIC. (support HL_CODE function)


Breakpoint
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Breakpoint
PDA

View Full Version : Breakpoint

TrainingDay
03-11-2005, 04:31 PM
Read below if it dont get deleted.
JMI
03-11-2005, 04:52 PM
First, tell us what YOU have done to try to find the answer to your OWN question. Have you been to the OLLY Forum and read anything there??? Have you done any searching here or on the net to see if the answer to your question is ALREADY out there??? These are things you are supposted to do BEFORE you post a question here.

This is NOT the place to post a question if you have done NOTHING to try to solve your own problem.

I don't want anyone answering this guy's question until he responds with information about the results of his own search.

Regards,
TrainingDay
03-12-2005, 03:08 AM
I know what I did maybe is not the correct way of doing this,but hey I got it done(partially). First I searched for all the tuts related to my vb program, and elimated them by comparing them with the program I had. Which searched for username/pw at start-up with a nag screen.

Well I finally limited my tuts to Olly tut by Gabri3l(hxxp://cracking.accessroot.com/). I used different segments of each finally got the program reversed. Tut1- I did a str ref with wdsam wrote down the offset(for both jumps since it was asking for u/pw) for the jumps then went to hex edit 4.1 and changed the 75 to BE on both offsetsand saved and backup. Well I fired up my program and entered the u/pw,but it didnt give me a successful registration or the bad registration code message box,but it did still say demo version.

I went ahead and tried the game out and it was still in demo mode after 10 chess moves no more hints where given and you cant move less then 1 sec at a time. So I figured I made some progress in my first crack at this reverse engineering stuff. Well the next thing in his tut 1 was to search the registry for the file because either the serial is stored in a the registry or a file. Well this program didnt have nothing in the registry like the program he was training in the tut with. I did a complete search in the registry of the main files in the program folder and nothing came up. So that was as far as tut 1 could help me with this especially since setting a breakpoint on RegQueryValueExA was the next step. I also realized there is a file I need either a regfile or inf that holding the u/pw combo,but after searching the program folder and opening every file none had anything i could figure would help.

Tut 2-This is where I needed to start because this program being tested is a vb7 like the one I was working with and didnt need unpacking. Anyway I made another copy of the main exe(....2.exe) and opened it with ollydbg and did a right click search for all ref text strings. I found the string that was the error message so I double clicked it, and it took me to the code in the main program. From there the tut searched for TEST EAX,EAX above the error message. So I searched for the that about 13 lines above the error message and set a breakpoint on it like in the tut. Once I set the bpx on it and hit f9 to run the program ask for u/pw as normal. The program goes to the error box for incorrect username/pw so I click ok, and it takes me back to entering the u/pw(sheesh). In his tut it suppose to have broke somewhere after entering the u/pw or atleast after clicking ok on the error box. Well it didnt do neither one. So I tried to figure out how he knew what test eax that he needed by comparing all the code before and after his with mine. Needless to say none of it look the same so i did what may be wrong.

I started from that test eax,eax and starting going up to ever test eax,eax with a jump one to two lines beneath it from that point. Well after 13 bpx I finally found the test eax that I needed,and it broke after I pressed ok on the error box for wrong u/pw. So now I was in line with the tut again I figured,and hey I felt good finding out that little piece of work. From there tut 2 was useless cause just by happened his serial was right there in ecx and edx after his bpx. So I was on my own with nothing but time to have fun and figure some things out.

I remebered in another tut that I can hit f8 in olly to do step on a particular code to see whats it doing. So I went back to that test eax, eax and hit (f9) then once I got to the bpx f8 just to see what will happen(after I restarted the whole ollydbg with the bpx still on the test eax). It would not go no farther cause it wanted a u/pw so i entered that. Well evertime I hit f8 I would look in the eax register since most tuts I read always have the password there,but I also looked for any jumps while pressing f8. Every I came to a jump if it was jnz or jne I would right click them and choose edit-binary-and switch them to 74(JE) and of course if it was je i would leave it je. Well I did this like 27 times and eventually started getting acsii in eax register window. I wrote down anytime there was anything thing in the window,but it was never what I put in the u/pw box. Then after like 36 times of hitting f8 it stopped again and would not go no farther. So I clicked on the program and to my surprise there was a box that said registred to:(blank) and the name of the company,but it didnt say demo version or nothing anymore. So again progress, and to my great surprise once the program started it was not in demo mode at all I started playing the computer a chess game, and before after 10 moves no hint was given,but now that option was still there. I clicked help and about and no registration box came up and the registered "to" field was still blank.

At this point I am totally confused because I didnt know the username and password used to activate the program. I closed down olly and everything mad cause I thought I missed something. So I remembered that I wrote down the acsii on notepad as they came up so I tried them on the original program. Once I opened up the original program it went straight to the registrered to(blank box) and started right up registered! So I thought maybe i used olly on the original and not the copy. So i opened up the copy and same thing already registred. Now i am totally confused how this happened. So i went to the registry to see if for some reason now the program have registry values so i searched the whole registry and theres nothing there still for the program. Now im mad and very confused and restart my computer thinking afterwards it may have something in the registry. Well once I go to the program folder there was a new file in there called lastgame.dat to my surprise. Mainly because that file is the only reference file in olly and wdsam,but it was never in the folder I even did a search on my computer for it and nothing came up. Well i right clicked it and chose properties, and it was modified 2 min ago which was once i restarted my computer. Now i fell out my chair cause im totally lost on how this files gets there and realize this file is the one that most likely hold the u/pw. I open with ultraedit and it has one line with this:

wK…¦²ÍøêË:Û'5à…ñ¾ù—ô5{ÍŒçDâG5E2>yð…èw”[`ì¸;RA°0ðçÇ

I dont know what that is but sure its encoded with the u/pw somewhere in it. So as asked to tell everything I done there it is. Now any help in figuring out this file will be greatly appreciated. I used Peek11 to extract text from the file and all it came up with was G5e2.
naides
03-12-2005, 10:11 AM
Aaaaaaghhhhh!
TrainingDay
03-12-2005, 01:43 PM
Ok I edited the post to the best I could. Is this better? Can I received help now?
JMI
03-12-2005, 03:13 PM
TrainingDay:

After editing your long, rambling Reply, at Kayaker's direction, it is now at least something approaching a posting meeting the requirements of our Rules. However, has it not occurred to you that it really has nothing specific to do with the subject you first posted about "bpx lstrcmp" and "Olly", and that you did NOT respond to my direction that you should SEARCH, YOURSELF, for the answer to that question and post your findings here?

How about you demonstrate that you can follow the directions which were given and post what you found about THAT question, before you ask for more detailed help, otherwise you appear to simply be attempting "avoidance" of the instructions you were given. :rolleyes:

Regards,
lostson
03-12-2005, 05:20 PM
tell me... those hundreds of words...are they worth it? jmi?

just help him out..or leave him alone... whats the problem???

train: tried to use anyof the well known plugins? or the strg+l command??

regards,
JMI
03-12-2005, 06:13 PM
I did not ask him for hundred of words. I asked him to demonstrate that he was following our Rules about searching for an answer before asking a question. The original question was limited, and so should have been his response. Then he avoided my directions that he do a search for the answer for the question he originally asked and, instead, posted a different long and rambling question.

The purpose of the original comments and the follow-ups, are to attempt to inform new posters who ignore the Rules in the FAQ, that we do take those Rules seriously and we expect them to be followed. Otherwise, his post would have simply been removed. In other words, it was an object lesson, not entirely about the Poster.

Regards,
TrainingDay
03-12-2005, 06:14 PM
Really it has everything to do with my original question because I was FOLLOWING TUTS FROM YOUR LINKS AT THE BOTTOM OF THE PAGE! Really I dont know what high horse you on,but like stated above it have to be easier to say,"That file appeared because..." then to rample on and on about did you search. Like I would spend all the time writing excuse me typing all that if I didnt first search for the answer so I wouldnt have to ask you. Last mentioned my post most likely will be deleted so be it, but thats the price I pay for coming here thinking I could receive quality help, and not bashing every post. I assume you think this is the only reversion forum and most likely it is or most likely is the best forum as far as knowledge,but I rather go somewhere else then to put up with a bunch of 12 year old thinking they something. I have to atleast say I appreciate all the searching and reading it did do here to help me reverse my first program. I simply asked why that file appeared after doing so and the meaning of its content thats all. Arrogance is not going to get you to far.
Manko
03-12-2005, 06:49 PM
Hi!

JMI is WAAAAAAAYYYYY older than that. ;p

/Manko
Woodmann
03-12-2005, 07:52 PM
Howdy,

12 year olds just flame because they can.
The old cranky bastard bitches because he wants you to learn.

You all need to stop taking it personally when JMI requests you to show some effort. Why is this so hard to understand ????

The number one rule is: show some effort.
and I dont mean "I searched and I could not find"..........

This rule will NEVER be changed. If you can not show some effort then your question is nothing more than a crack request.

NOW, stop being a bunch of whiney little pussies and step up.

-OBC-
esther
03-12-2005, 10:54 PM
>The number one rule is: show some effort.
>and I dont mean "I searched and I could not find"..........

He didn't search but he showed the effort to post what he did.Isn't that enough?????

>I don't want anyone answering this guy's question until he responds with information about the results of his own search.

Arrogance pays
JMI
03-13-2005, 12:59 AM
Once again esther you are apparently trying to earn another trip to the halls of the "uninvited."

Since TrainingDay deleted his first post's contents after my second post, you obviously don't know what was going on, or just don't care.

It is simply foolish for you to make comments about character traits you proclaim in your signature your find noteworthy in yourself.

Regards.


JavaCard internal structure (JCOP, CyberFlex, etc.)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > JavaCard internal structure (JCOP, CyberFlex, etc.)
PDA

View Full Version : JavaCard internal structure (JCOP, CyberFlex, etc.)

FractalizeR
03-11-2005, 04:35 PM
Hello, dear Sirs!

I'd like to know, what is the internal structure of such JavaCards like IBM JCOP and CyberFlex for example. Their memory, where applets are stored is undumpable. How is this achieved? What are these cards based on, so nobody can read their memory contents?
JMI
03-11-2005, 05:02 PM
IF you have read the FAQ, then tell us what YOU have done to try to find the answer to your question, because that is supposed to be your FIRST step. Have you done any searching with "JavaCards" (without the quotes) or even "JavaCards + structure" (again without the quotes)??? Do that first and then come back.

Regards,
FractalizeR
03-12-2005, 10:29 AM
Hello!
Thank you for your answer. I read the fAQ of course. And I of course searched your forum for "JavaCard" and the result is only one post
http://woodmann.net/forum/showthread.php?t=4543
which of course is not affiliated with my question.

I did a search over Google for "JavaCard", "dump", "CyberFlex" and so on, but I didn't find any information about JavaCard (JCOP or CyberFlex) internal architecture or methods of dumping them. I know GlobalPlatform standard, I use CyberFlex cards for protecting my programs. They contain hidden algos, which are the core of my programs. I wrote my own APDU protocol implementation for using in my software.
I know, that it is impossible to get applet code, after applet is uploaded to the cards at least on CyberFlex and JCOP cards. But why? What protection is used to prevent dumping applets from card's memory? This information is of course not public. CyberFlex cards is patented and of course nobody will tell me: "Dear, our cards are based on xxx. To dump applet you need to make yyy"

I just want to know, is there at least one occurence of dumping applet code from card in a world? I never heard about such. If it was happen, what is the cost of such operation (I mean 10$, 1000$, or may be 100000$)? I'd like to have such information to know, if I can use JavaCards to protect my software without worrying or not?
JMI
03-12-2005, 02:59 PM
NOW that is a MUCH better and informative question, which complies with the FAQ. Hopefully, someone who may have played with thess structures can now give you some information which would help you advance you understanding. :yay:

One more important point. When you Reply, unless there is some specific reason to quote a part of a previous post, use the small button on the far left, which replys without quotes. There are also the found on the right, a Post Reply Button and below a Quick Reply plane. These choices do not automatically include a quote of the entire previous post. Including the entire previous post is generally a complete waste of database space, since it is there for anyone to read anyway.

Welcome aboard.

Regards,
FractalizeR
03-13-2005, 05:47 AM
Thank you once more. I will wait for somebody to answer...
ColdWinterWind
03-15-2005, 12:36 PM
It sounds like you've got a situation similar to satellite receiver systems that use a smart-card. The only way to access/mod the 'embedded' area of the card is via a dedicated controller (hardware) box, which interfaces your computer with the card, and has the necessary additional circuitry to manipulate the Control Pins (sic) on the card's chip.

Since I don't have any logic probes, and can't solder for squat anyway, I don't poke around in it much.

Just Googled 'JavaCard controller'.... many hitz.
FractalizeR
03-15-2005, 02:39 PM
Thank you, I searched Google for JavaCard controller too, but found, that this Controller is just the heart of the card itself. It is not the device to read it's memory...
ColdWinterWind
03-18-2005, 07:21 AM
Yeah. It may be that no-one has built an EEPROM burner for that particular type of card. Googling EEPROM burner JCARD only had one (!) hit, to a French page that isn't accessible. You might find something n the satellite community...


Q:Number analysis...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Q:Number analysis...
PDA

View Full Version : Q:Number analysis...

mambox
03-12-2005, 07:04 AM
hello,

i'm looking,if it exist,a soft who can analyze a sequence of numbers-letters
well i explain here's a sequence:

SG77GTWHH
SXPVWGLW7
SHXXZPHGY
S6GJNN47X

and determine the combinaison used to generate those seq.

is it possible?

thanks!
naides
03-12-2005, 10:06 AM
Try a more thorough explanation:

Each line of 9 char is a series?

Who generated the series?

Is one series derived form the other?
mambox
03-12-2005, 01:28 PM
well...its a commercial offering.

each pack give you a code (upper) and i'm trying to know how to find the generation of those without buying thousand of packs ;)

and yes its 9 chars long,starting with S

SHXXZPHGY or
S7WUP6LG4 or
SG77GTWHH or
SXPVWGLW7 or
SHXXZPHGY or
S6GJNN47X or

and so on....

i doubt hundred thousands numbers are generated randomly and checked each time the code is sent,would be way too long to check.

anyway,i'm a bit lost with all my knowledge into this science..

is my question a bit more understandable?

thanks!
JMI
03-12-2005, 03:21 PM
Just a thought. Perhaps you are approaching the problem ass-backwards. Maybe, rather than wondering how the numbers are generated, you might simply want to try to find out "where" and "how" the numbers are "validated" by the program. The process may be long and complex or it might not, but eventually, it has to reach some point which results in the equivalent of a "goodboy" or "bad cracker" decision. Maybe you can circumvent the need for the correct number altogether. :idea:

Regards,
mambox
03-13-2005, 08:13 AM
erm...well its checked online by the server,you only have to give the number and it validate or not the result...so i doubt its not possible then.

was just interested if it was possible to find a tool who analyze the sequences..

thanks for all answers anyway!!
mike
03-13-2005, 03:39 PM
Nope. They could give you a completely random string and just keep a list of all the ones they've issued on the server.

What kind of software is it?
sigint33
03-13-2005, 04:10 PM
I think I know this target, and a couple of keygens have been attempted, my best guess is that the number sequence is kept in a list and then issued randomly from that list, the number would not be valid until it had been issued, so keygenning a number might give you a valid number, but it wouldn't work unless it had been issued already.

At least I think that's how it works.

SiGiNT
naides
03-19-2005, 07:32 AM
If the validation is done in the server, then the generation is done in the software, that you have. It is not completely random, You have a few rules (constrains): The S charater in the first position, the length of the key, uppercase alphanumeric space. . .

What about locating the code that generates the keys and reversing it?

Could you PM the name of the software? you got me curious now. . .
JMI
03-19-2005, 07:40 AM
"Nobody" remembers what curiosity did to the cat! :D

Regards,
sigint33
03-19-2005, 11:18 AM
If this is the same target, (or similar), that I've seen, then there definitely is an algo. in the code, it won't install without a correct serial, the problem is whether or not that serial has been flagged as issued at the server.

SiGiNT
naides
03-19-2005, 12:38 PM
Based on the info you provided, Mambox :sneaky: , you are deducing the generation/validation algo from a blackbox. It could be anything, unless you can collect a substantial number of valid, and invalid keys to be able to deduce patterns.

Bilbo started a thread on a tool that could do just that.
Under the current circumstances, a brutal force generator sounds like the only viable option, at least initially.
In fact, as it was stated before, the key space may be indeed random, with no validation rules attached to them except being present in the server/validation database, which makes any 'intelligent" attack useless.
%UNDEFINED%
03-20-2005, 10:28 AM
well...its a commercial offering.

each pack give you a code (upper) and i'm trying to know how to find the generation of those without buying thousand of packs

I don't think this is software, sounds to me more like a product promotion. Pepsi, 7-UP, Coke, Candy Bars, Trading Cards, Potato Chip, etc... could be anything, sounds to me like that. Where each pack you buy contains a code and you enter that code online and see what its worth, or if you won anything...

Examples:
hxxp://www.dell.com/bigbucks
hxxp://www.apple.com/itunes/pepsi/

Regards,
mambox
03-20-2005, 10:29 AM
my coding skill is not enough high to make such bruteforce,if its the way to find.

well thanks for all answers,now i know its much more cryptic than i think :)


I love IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > I love IDA
PDA

View Full Version : I love IDA

Equimanthorn
03-13-2005, 02:28 AM
i just wanted to drop by and tell everyone how much i love IDA. it's only now that i'm beginning to truly understand what she means to me. if i ever have a daughter, i'll name her Ida. i only say xref graphs. i feel so much love for that program right now. i'm sorry, i haven't slept for some time.
Invictus
03-14-2005, 04:02 PM
Yeah, she's cute...
bilbo
03-15-2005, 01:59 AM
By the way. who knows who is the woman in IDA's icon?
I found some resemblance with
http://www.rootsweb.com/~usgenweb/tx/bell/photo/ida.htm,
but I thinks it is merely casual

Regards, bilbo
tom324
03-15-2005, 03:34 AM
IIRC, there is a thread on Datarescue board about the IDA's icon

Tom
JMI
03-15-2005, 03:56 AM
Since the company is from Belgium, is suggests that the picture's origin might more likely be related to some history associated with that country, or Russian, for Ilfak Guilfanov. :confused:

Regards,
bilbo
03-15-2005, 05:06 AM
Got it, thanks to tom324...

She is intended to be Lady Lovelace, the daughted of Lord Byron, the first programmer in the world (on Babbage computer).
Funny enough, her name is Ada (like the language, so called in her memory), not Ida, and the image in the icon is taken from Madame de Maintenon for copyright reasons...

So this time Guilfanov has not been so patriotic (she was born in London)...
Regards, bilbo

The link: http://www.datarescue.com/cgi-local/ultimatebb.cgi?/topic/4/85.html
naides
03-15-2005, 06:40 AM
No need to go that far:

http://207.218.156.34/forum/showthread.php?t=5972&highlight=lovelace
bilbo
03-15-2005, 07:17 AM
Sorry naides,

I promise that next time I will read the FAQ and I will try to use the Search to answer my curiosity.

Stll I don't see the Belgian connections that dELTA suggested (just a name of beer...)

Regards, bilbo


Nasty harddisk problem, need some tips fast :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Nasty harddisk problem, need some tips fast :(
PDA

View Full Version : Nasty harddisk problem, need some tips fast :(

dELTA
03-13-2005, 09:03 AM
It seems like one of my harddisks is about to give up on me. :( A couple of days ago I noticed the following eventlog messages when starting Windows:

The driver detected a controller error on \Device\Harddisk2\D.
(sent by the source "Disk" to the "System" eventlog)
(about 5-10 times)and

A parity error was detected on \Device\Ide\IdePort1.
(sent by the source "atapi" to the "System" eventlog)

First of all, I'm not sure about which physical harddisk it is referring to? (I have three harddisks in this computer) This is of course the first thing I'd like to make clear, to be able to switch it if it's broken.

In the message above it mentions "\Device\Harddisk2\D". Does anyone know how to positively match this to one of my physical disks? One thing that confuses me a lot is that it has a "D" on the end, which one would think would indicate that it is the "D" partition on my IDE primary master disk, but it also says "Harddisk2", which is not the disk number that this disk has in the "Disk manager" in Windows?!

So, first question: How can I know which physical disk "\Device\Harddisk2\D" is referring to?

Today when I started the computer, I got the following messages instead:

Failed to obtain the front-panel ID or serial number.
(sent by the source "MaxtorFrontPanel1" to the "System" eventlog)and

The system failed to flush data to the transaction log. Corruption may occur.
(sent by the source "Ftdisk" to the "System" eventlog)

I'm starting to get really shaky here, and would like to pinpoint this problem as soon as possible. :( I'm starting to believe it might be more than a harddisk error, maybe some motherboard/IDE controller issue? I haven't noticed any operating system malfunction, or any other problem using the computer, which also feels a bit strange if there is some such serious problem with the Windows boot drive disk. (although it might of course take time before such errors are noticed or have any effect too)

Based on the info above, does anyone have any idea about what it might be, or how to analyze it further?

Also, finally, I've only gotten all these eventlog messages immediately on computer startup this far, and then nothing else during the entire days when using the computer, any idea about why that might be?

I'd really appreciate any and all input about this, as soon as possible. :(
omega_red
03-13-2005, 09:32 AM
I think Windows numbers disk devices as follows: First bus/Master is 0, first bus/slave is 1, second bus/master is 2 etc... But you can look at drive properties in My computer, and there on the "Hardware" tab is a device number ("Localization"). Correct me if I'm wrong on this though :)
dELTA
03-13-2005, 01:59 PM
I'm not sure this is the same thing, because two of my disks show "0 (0)" in this field, and the last one shows "1 (1)"?

Anyone else has any ideas whatsoever?
JMI
03-13-2005, 02:15 PM
Yo Svensk Dude :D

I tried something desperate and entered into Google:

A parity error was detected on \Device\Ide\IdePort1

and received a number of interesting hits, including this one

http://support.microsoft.com/?kbid=262448

SYMPTOMS
If you are using DMA transfer mode with an ATA66 hard disk, you may receive the following error messages at startup:
Disk error
Driver detected a controller error on the device, \Device\Harddisk1\DR1

ATAPI Error
Parity error on device \IDE\IDEport1
CAUSE
ATA66 DMA transfer mode is not supported for the onboard IDE controller.
RESOLUTION
To resolve this issue, change the transfer mode for the controller: 1. Right-click My Computer, and then click Manage.
2. Double-click System Tools in the right pane, and then double-click Device Manager.
3. Double-click IDE ATA/ATAPI Controller in the right pane, and then double-click the appropriate controller.
4. On the Advanced Settings tab, click PIO Only in the Transfer Mode box.
5. Click OK, close the Computer Management window, and then reboot the computer.

Since I believe you have probably been using these HDs for some time, this probably isn't your issue, but there are other hits which might shed some light on your problem. :yay:

Regards,
JMI
03-13-2005, 02:45 PM
This also might help:

Converting Drive Letters to MS-DOS INT 13H Disk Drive Numbers

http://support.microsoft.com/default.aspx?scid=kb;en-us;62571

". If the device is a hard disk drive, you need to interpret the hard disk partition table to differentiate between a primary partition and a logical partition because the ordering of logical drive numbers does not necessarily reflect the physical order and corresponding BIOS physical drive number.

For more information, query on the following keywords:
prod(msdos) and driver.sys and order

Once you know how MS-DOS assigns logical drive letters on system initialization, you need to address the correct physical hard disk and compute the offset (starting sector number) of any logical drive by using the starting sector values supplied in the hard disk's partition table. These starting sector numbers would be supplied to the BIOS Int 13H function to access those sectors representing a logical drive. "Advanced MS-DOS Programming" by Ray Duncan has more information on the boot record and partition tables. Example
-------

HD 1: Bios# 80H HD 2: Bios# 81H HD X: Bios# X...

C: (primary) E: (logical)
----------- -----------
D: (logical) F: (logical)

To access logical drive D, address HD 1: Bios# 80H, but sectors starting at logical partition D:.

--------------------------------------------------------------------------------

Also you might check out:

Basic and Dynamic Disks and Volumes

http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prdg_dsm_hzec.asp

And the subsection titled:

Converting Basic Disks to Dynamic Disks

http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prdg_dsm_hzec.asp

The list volume command in DiskPart also shows the system, boot, and paging file volumes as follows:

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volume 0 G Unknown 0 B
Volume 1 C NTFS Partition 4096 MB Healthy System
Volume 2 F NTFS Partition 4651 MB Healthy
Volume 3 D NTFS Partition 4096 MB Healthy Boot
Volume 4 P NTFS Partition 4664 MB Healthy Pagefile
Volume 5 E NTFS Partition 9 GB Healthy

For more information about using DiskPart, see "Managing Disks from the Command Line by Using DiskPart" later in this chapter.

Hope this helps. :idea:

Regards,
Woodmann
03-13-2005, 05:30 PM
Howdy,

Enter setup when booting and see what it says for settings for your hard drives.

Do you have RAID setup ??? What about VMWARE ???

How long has this box been running the current setup before it started to have problems ???

What type of drives are they ???

Woodmann
esther
03-13-2005, 08:57 PM
>a controller error on \Device\Harddisk2\D.
which means your d drive has some errors

>The system failed to flush data to the transaction log. Corruption may occur.
(sent by the source "Ftdisk" to the "System" eventlog)
Thats partition or hadddisk sectors errors I assume.Your best bet is to take out the d drive(harddisk) and see what happens
dELTA
03-14-2005, 04:47 AM
Thanks for all the tips. I have done some more searching, and it seems it might be some problem with my external firewire disk (these are apparently still mounted as IDE disks to the system, go figure), or the caddy I have my boot harddisk in. I have disconnected the firewire disk, and I'm waiting to see what will happen (the error messages did not come on every boot earlier either).

To answer some questions made in this thread:

* I don't use RAID.

* All three disks are 200 GB Maxtor IDE disks, using ATA100 or 133.

* It's a physical computer, not in VMware.

* The computer has been running well for 1.5 years. The HD caddy was added 3-5 months ago, and the firewire disk more than a year ago.

Well, I'm still shaky though, and if you don't see me here for a while, you know what happened anyway. ;)

Any further ideas or suggestions are of course still welcome, thanks for all the ideas so far.
Woodmann
03-14-2005, 02:45 PM
Howdy,

Since it has been running for quite a long time it must be something physical like a cable/firewire or the Mother board connections or the mobo itself.
I have also seen Master Boot virus that can do the same thing.

Woodmann
dELTA
03-15-2005, 10:41 AM
Yes, a motherboard malfunction was my first thought too, which is not a very pleasant thing indeed. :-/ Well, let's just wait and see I guess, not much more to do right now...
naides
03-15-2005, 10:46 AM
Not to state the obvious, but have you done a total backup before it really fucks up??
Silver
03-15-2005, 05:09 PM
Crazy tip, but it works. I've previously got "dead" disks working again by putting them in the fridge for an hour. I have no idea why or how this works, all I know is that the drives wouldn't spin up properly or read data before, but after a quick chilling I could copy most of the data off before they died again.

You may also find Ontrack EasyRecovery Pro a great too for diagnosis/recovery.
dELTA
03-16-2005, 03:20 AM
Naides, yeah, most of the Terabyte on my disks is backed up, the important stuff anyway. :) Although I'm always a little nervous about if the backups will all work once they are needed and such, but hopefully...

And thanks for the tip Silver, I'll be sure to keep it in mind. :)
UrgeOverKill
03-19-2005, 09:54 AM
good tip Silver, I did the same thing a few years back, what happens is that when put in a freezer the cold aligns the sectors onto the disk but use this only as a last resort to recover any data. Once the hd warms up and gets hot...shows over.
TBone
03-20-2005, 12:31 PM
I've heard about the freezer trick, too. I always thought it was just an old hacker's tale until someone I know from another message board actually tried it and managed to get a bunch of music files he composed off of an apparently dead drive. No one really knows for sure why it works. My WAG - the slight contraction of the metal may let a jammed component spin clear (bad bearings on the spindle, maybe), or might give you a little extra clearance between the read heads and the platter if you've had some kind of head crash.

You can usually do this several times, if you have to. But if I were you, I would put the drive in a ziploc freezer bag. Stick a straw down one edge of the bag and seal it up to the straw. Suck the air out of the bag and seal the gap where the straw was as you pull it out of the bag. You want to get the drive cold, but not wet. A bunch of condensation can't be good for the drive's electronics when you plug it in. The straw trick is also a good tip for sealing food. Less air = less moisture = less freezerburn :yay:
bilbo
03-21-2005, 02:07 AM
I tried the freezer trick (among many others) some months ago on a 40giga Maxtor affected by the "click click of death": no success... I lost my last developments on Linux...

Regards, bilbo


Turbo Pascal V7
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Turbo Pascal V7
PDA

View Full Version : Turbo Pascal V7

mac53
03-13-2005, 10:33 AM
I have downloaded a couple of programs that assist in scanning and showing other information related to .exes. When I tried to use them I received a [Runtime Error 200 at 0985:0091]. I had downloaded the "Pascal Turbo V7" patch and had a successful installation, atleast I thought, because I'm still getting the error. Does anyone know where I went wrong in applying this patch? and if you do, mind advising me where I went wrong? Trying to learn how to crack here, I'm in my fifties and it's like trying to learn to walk all over again...I envy you "Young Bloods" out there...having all this technology available to you in your youth...I didn't.

Thanks for letting me whine...my brain itches... :yay:
esther
03-13-2005, 12:05 PM
It might not run in win2k or winxp coz its an old program.Try your luck on win9x.Age is not the obstacle on learning,narrow minded does
Polaris
03-13-2005, 01:48 PM
Otherwise you can always try the DOS-Box approach... ;)

Have a look :yay:
http://dosbox.sourceforge.net/

HTH,

Polaris
mac53
03-13-2005, 04:18 PM
Polaris...
I had a look...it sounds like it's mainly for the Mac & Linux systems, although I saw a Windows front-end. I'm not sure what that software is about, so I sorta agree with "esther". I'll throw another computer together and run that sh_ty 98se with it.

Thanks for the raps... :yay:
Guys pop up with anything new...please let me know.
lostson
03-14-2005, 09:35 AM
@mac: dosbox is available for windows, too. just check the download page on the site polaris posted. its the first thing i do on a page: look for the download section ;)

dosbox is a "DOS in a BOX"... you can use it to "emulate" old dos, for some older apps and gamez they also provide the needed parameters. give it a try!

regards,
mac53
03-14-2005, 12:49 PM
lostson...

Now that I have the DOS-Box for Win32, I have a couple of questions.

Will a Win32 App run on a NTFS file system? and

Here's a stupid one...Do I still need the Windows Front-end that I had found on the Site?

I'm new at this...please excuse my ignorance :confused:

Thank you for your response :yay:
Hero
03-14-2005, 12:57 PM
Hi
As I know,this problem is not because of OS.It's because of computer speed itself.
Because TP7 uses in Longint for its counter for making delays and this counter
overflows on newer computers because of their high speed.
I get a patch for it some time ago that make it work on XP too,But I forget the link.
If you search,you will be able to find one.

sincerely yours
mac53
03-14-2005, 01:14 PM
Hero...

Ok, I'll search...but what type of patch am I looking for?

Is it for the "Turbo Pascal V7", Dos-Box or my OS?

I found a patch for the Pascal V7, but that's all the patching I know of at this time.

Thank you for your input :yay:

**********************************************************

I read your post once again and you answered that question for...sorry about that. I am searching for a specific patch [XP].
lostson
03-14-2005, 05:48 PM
heyho mac53,

it should run on a ntfs system, and no, you dont need the frontend.

btw. which programm you want to execute? info about exes?
try peid or any other "modern" peidentifer or scanner!

:)

regards,
mac53
03-14-2005, 11:37 PM
lostson...

Thanks :yay:
bilbo
03-15-2005, 01:42 AM
Hi, mac53,
I was curios about the informative answer from Hero and I searched google for the 3 words "tp7" "patch" "longint".

In the first page you will find the link
http://www.geocities.com/SiliconValley/2926/tp_pato.html
containing links and explanations to all the possible patches for TP7.
I hope this can solve your problems!

I don't think the DOS-Box is necessary; the Windows Command Prompt should make well his job.

Best regards from a coeval dude,
bilbo
mac53
03-15-2005, 08:34 AM
bilbo...

Thank you...I went to the site's URL you provided and found that puppy! :yay:

There are a couple of DOS .exe scanning and info providing programs I want to try out.

Thanks for your reply :D


A debugger that can step backwards
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > A debugger that can step backwards
PDA

View Full Version : A debugger that can step backwards

bilbo
03-15-2005, 02:38 AM
Seen the announcement on another forum...

http://www.virtutech.com/products/simics-hindsight.html

Regards, bilbo


SoftWrap 6.1.1 unpacking tuts
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > SoftWrap 6.1.1 unpacking tuts
PDA

View Full Version : SoftWrap 6.1.1 unpacking tuts

Morales
03-15-2005, 01:21 PM
I have written three tuts about this protection

http://www.exetools.com/forum/showthread.php?p=34824#post34824

MORALES.
Ricardo Narvaja
03-15-2005, 04:39 PM
A 3 excellent tuts by an excellent crackslatinos member.

Congratulations my friend
Ricardo Narvaja
hobferret
03-21-2005, 09:57 AM
Hi all :)

Most of the guys at CrackLatinos know their stuff :yay:

Good stuff morales :yay:

Just been reading a thread on exetools where a couple of members were complaining about them being in Spanish. JMI gave a good reply then closed the thread :whoops:

He stated this:-

"O usted podría trabajar en habilidades sociales y podría intentar hacer a los amigos con alguien que lee y escribe ambos inglés y español. Siempre bueno para hacer a los nuevos amigos."

Done it in Spanish just to annoy them blokes from exetools :cry:

OK hablar ver creer and you will be OK

/hobferret
JMI
03-21-2005, 02:34 PM
JMI closed the thread because several idiots refused to search for translators and kept asking for them in that thread. :boo: Locking it was the only way to stop that process of Request/Response. :sneaky:

Regards,


Sentinel, and now ?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Sentinel, and now ?
PDA

View Full Version : Sentinel, and now ?

andreas heinz
03-15-2005, 04:21 PM
Hi Guys,
I'm a new member and this is my first posting.
I'm from Hamburg, Germany and 31 Years old.

I've read nearly all Tut's from woodman.com and now it's the time to ask for some asskickin' in the right direction ;-) :confused:

I got one licensed version of my app, protected(Har :P) by a SentinelSuperPro from Alladin.The API-Calls are inside my Target, not linked against any DLL(so statically linked).
And now i need some advice on how to get either the emulator workin or to find the points of interest for patching...
I swear, i tried all the standard ways, but it seems to give any subroutines which makes me confused.
So, my dump from my SentinelSuperPro (using Sdump,thanks to CrackZ ;P) and the whole IDA-Listing of the interesting func's are attached as .txt-file

Please inform me, if U need additional informations.
Greetz and Tribute to all the great People who know how to reverse and share Knowledge with us, namely +spath, CrackZ, Sp0raw, MeteO, Killer3K , CyberHeg,and all the others being unamed.....
Greetz
SuumCuique
JMI
03-15-2005, 04:44 PM
andreas heinz:

Please edit your post and take out the long listing of code and put it into a text file and attach it. We really do not need that much code displayed in the thread for the few who may have a specific interest in it.

Regards,
andreas heinz
03-16-2005, 09:38 AM
Yep, it will be done...
andreas heinz
03-16-2005, 02:03 PM
:confused:
Hi all,
I need some additional informations on emulating a sentinelsuperPro and on how to insert the dump into my App.
I have no dll's, the whole stuff is statically linked. And the func calls are very nested.
I first posted in the newbie frorum, because I'm new in this forum, and so I point to this posting, because there are the listings of the SproCalls, which i patched and with my dump.
Please excuse my xpost, but it seems, here are the ones who got more experience on Dongles... :yay:
CrackZ
03-16-2005, 06:46 PM
Hiya andreas,

First suggestion, do JMI a big favour and ask him to merge your posts (this one and the one from the newbie forum), I think you might even be able to do it yourself ;-).

OK, my initial suggestions :

1. sproFormatPacket() shouldn't need to be patched.
2. Read a few tutorials about sproRead(), more specifically to emulate that function your emulation code needs to pass back emulated dongle memory, simply clearing AX to 0 will pass only the status check, the code after just looks like a loop of reading each word. This is likely your main problem at this stage.
3. The rest of your code paste is pretty much junk ;-), keep in mind you are here to attack the dongle API and nothing else, if you can't simulate the dongle API your just going to blindly force checks instead of working out why the code flows as it does.
4. You can brute force the write password, overwrites are another story (pray you've got them in the app if you really need to recover them).
5. Forget getting your dump to work with any 'Sentinel Emulators' at least in the short term.
6. Read SSPro API guide (this is IMPERATIVE!) or contact me someway.

Regards

CrackZ.
JMI
03-16-2005, 07:55 PM
Actually he can't, but anything for an admirer of Shania. :D

Regards,
andreas heinz
03-23-2005, 05:29 AM
1. Ok, will try to merge ...
2. Right, i inserted FormatPacket as patched, but it wasn't. Was unchanged. My failure (Perhaps one beer too much;-) )
3. Well, The main Problem for me is not be confused by the whole loops.
Can't see the forest, because of the trees....
So, to suggest the flow I have to investigate a lot more...
I downloaded the Rainbow Toolkit and studied the API-Documentation, the details of the functions, the return values and their meaning was very helpfully (thanks for your advice), could be the start point to write a bruteforce function to get the Passwords.
And it seems, you prefer to insert the dump into the target and forward the query flows to the memory adresses....
Well, we'll see...
I will give Feedback when done...
Regards
egalerst
03-24-2005, 05:14 PM
my 2 cents, if any of the gods here knows better correct me.

you made a good approach.
formatpacket normally only needs to be patched for users who dont have the sentinel driver installed.
u already succesfully patched the findfirstunit() and your next step would be dealing with sproread(). to accomplish this task u have to trace the program with the dongle attached(sounds like u got it;). now when sproread is called take a look at the destination buffer (remember u have the api guide ;)
now write down the result after the sproread()
next step is to replace the sproread() with one of crackz' fine emulator code.
sprowrite() is almost the same approach.
good luck
andreas heinz
03-29-2005, 12:11 PM
Thanks for the advice.
Think it's the lack of experience which let me lead into the deeps of the loops.
Well, I'm checkin' the DestinBuffer and SproRead is called 61 times in one loop and after that no more (checked the app. SproRead() is called only this one time.)
Now the job is to get it emulated ;-)
Will try what's in CrackZ-Tutorials
(But I never ever setted up a deltaOffset, now it's the time for cooling a six-pack)
Regards


DES question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > DES question
PDA

View Full Version : DES question

akimp3
03-15-2005, 04:39 PM
Hi,

anyone knows why the decryption function of DES is the same as the encryption function exept the key order?
I have to find the response (mathematical) of this question. I have looked in Handbook of Applied Cryptography, Applied Cryptography,Cryptography theory and practice and the Internet but i hav'nt found the response.

Thanks in advance
mike
03-15-2005, 05:47 PM
It's a Feistel cipher. The Feistel construction splits a message into two pieces, computes a keyed nonlinear function on one half and xors the result to the other half, then switches them. That's called a "round".

If you xor the same thing in twice, it cancels out. So they just reverse the key order to cancel each step out, and you get the plaintext back.
akimp3
03-16-2005, 01:04 PM
Hi

Thank you very much. You always help me to learn new things in cryptography. I just want to thank you for all the things you have done for me.

akimp3
mike
03-19-2005, 02:07 AM
You're welcome. That's what I'm here for.


iceext 0.67 prob
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > iceext 0.67 prob
PDA

View Full Version : iceext 0.67 prob

mambox
03-16-2005, 04:14 AM
hi,

i use sice 4.3.2 build 2485 and tried to install iceext 0.67.

when i use some ice command like !protect i get 'command extension not found'

i've use the search,found an exetools thread,didnt help me more.

tried to uninstall,use the 0.66,same occur.

its not in boot mode,its startup manual so the registry key to '3' is not required to change.

does the siwrender initialization...

whats wrong?
searched with google no results.
thanks :confused:
tyj_yy
03-16-2005, 08:20 AM
I have the same prob
Kayaker
03-16-2005, 10:30 AM
Hi,

You may get an error message when typing "net start Iceext" in a command box, something like:
"Insufficient system resources exist..."

Using regedit, under

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet/Services/NTIce]

; increase the KDHeapSize to 100000h from its default setting of 1FA0h

"KDHeapSize"=dword:00100000

Kayaker
mambox
03-16-2005, 01:00 PM
you make my day Kayaker!

it would be almost impossible for me to find such key to correct!

thanks!!
tyj_yy
03-16-2005, 06:35 PM
thank you!
laola
04-12-2005, 10:47 AM
Iceext will display a corresponding warning with the full registry path in the debugger window upon unsuccessful load. At least 0.67 does, these checks for sufficient heap allocation etc. were somewhere on the whatsnew I read some time ago. Of course, this is the first thing I forget when setting up a new install :D


Why IDA crashs for MSVBVM60.dll?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Why IDA crashs for MSVBVM60.dll?
PDA

View Full Version : Why IDA crashs for MSVBVM60.dll?

Hero
03-17-2005, 08:35 AM
Hi all
I'm trying to disassemble MSVBVM60.dll by IDA Pro 4.7 .But It crashs at the end
of file (btree error.).
Do you have the same problem?Why this happens?Why I can prevent this error?

Sincerely yours
naides
03-17-2005, 11:06 AM
I just disassembled it and it went fine.
I did load the MSVBVM60.pdb file.

Sounds like you exceeded the indexing capacity of one of IDA's database class access functions


Need help with network debugging
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help with network debugging
PDA

View Full Version : Need help with network debugging

crUsAdEr
03-17-2005, 01:59 PM
Ok i must start off i am a networking idiot so do go easy on me...

I have a client software that logs into a remote server and query & submit data to the server. I would like to find out how this client is interacting with the server, which API call, data format being sent so i can write my own software to interact with the server & submit data.

Well, here go.. i havent got a clue on how to start... it uses MFC7... so some start up tips would be appreciated.

cheers,
crUs
midnitrcr
03-17-2005, 02:07 PM
Can you sniff a legit session between that application and another client? if so that is probably your only way of doing this as randomly sending data to the server is going to get you nowhere.

This is how a lot of the open-source chat clients figured out things like the yahoo and aim protocols.
crUsAdEr
03-17-2005, 02:11 PM
Can you be more specific :)? I have the software, i can run, control when it should connect when it doesnt... i suppose i can "sniff" but how should i go about doing it :)? Oh yeah i have legit access to the server, it is nothing illegal, i can log in anytime, just trying to find a more efficient way of submitting data...

I was thinking more of like debugging the software to see how/when it connect to the remote server, send the data to server etc.
midnitrcr
03-17-2005, 02:23 PM
First thing is first. Is this a binary or text-based protocol? My guess is binary which will be much more difficult to analyze. (although still possible) I will use a text-based protocol for the sake of brevity though.

Take SMTP for instance. Every connection to the server is initiated with a 'HELO' string followed by keywords telling who the message is from, the subject, etc... Assuming the conversation is not encrypted you could fire up something like ethereal on that network segment and collect the information transmitted back and forth. This is basic sniffing.

Then all you have to do is program your new client to use the same commands, formatting, etc... as what you viewed and you have your own SMTP mailer. Binary protocols will work the same way but it won't be as intuitive because its not in human-readable format. This means you will have to look at your packets you have collected and say "ok, the session initiates with the byte sequence 0x01 0x02 0x00" and implement your client to do the same. Not a fast process, but possible...

If you don't understand how sniffers work or how to read an ethereal/tcpdump packet log you are probably in over your head. Not meaning to be offensive, just statement of fact...
naides
03-17-2005, 02:31 PM
Do you have or can you get a copy of the Server Software?

You could set up the server in a VMware virtual machine and the client in your host sytem or another Virtual machine. Then using VMtools like VnetSniffer and debuggers in both server and client VM you may have much better control in your analysis.

Just an idea.
midnitrcr
03-17-2005, 02:33 PM
naides - what is vmsniff? I've not heard of that one before...
naides
03-17-2005, 03:08 PM
my bad, I had just a vague recollection of the name.
The tool is called vnetsniffer
babar0ga
03-17-2005, 04:00 PM
Hello!

For sniffing network communications i use Ethereal.
It's a realy fine piece of software...

You can download it from http://www.ethereal.com (it's open source)
And here is good screen shoot of what you can except: http://www.ethereal.com/mm/image/tcpstream-20010427.gif
Notice different colour for client and server data so you can't get lost easily...
blabberer
03-17-2005, 11:55 PM
tamos softwares comm view is also a good sniffer and you can sniff in promiscous mode too with it it has a 30 day trial (half of the packets will not be visible some thing like that crap handicaps exist in trial)

there is a review article by Steve gibson of grc.com on various sniffers and
thier

look for shieldsup documentation part

i paste a url wander through the site there are valuble info in there
though the claims tend to be bombastic and self serving me me kind
http://www.grc.com/su-rebindingnt.htm
bilbo
03-18-2005, 02:23 AM
I have a client software that logs into a remote server and query & submit data to the server.
In many cases a full sniffer like ethereal or commview is not necessary: an HTTP protocol tracer could be enough. It MUST be enough if client and server can work also through an HTTP proxy.
I use HttpTracer, for example.
Best regards, bilbo
crUsAdEr
03-18-2005, 03:39 PM
erm... thanks for the response guys...
Actually i was planning to approach it the reseving way, that is break on network API, then trace to find the code that interact with server, not tweaking with packet being transmitted over the network... hence was hoping for some tips on common API used by MFC7 or common MFC7 library function for remote networking...

Nope i do not have the server program. But i belive once i find the code that does the interaction with the server, reversing those code to work out data format, transmission protocol isnt hard... hence i am trying to take that approach.
Silver
03-19-2005, 07:21 AM
MFC (well, VS) comes with the MFC call trace tool which may help you. A small hiccup will be MFC/win32 integration. MFC provides class libs for network operations, but some are limited and buggy. So a lot of MFC coders use the base classes for simple work, but revert to direct winsock code for anything more complex.
blabberer
03-19-2005, 07:31 AM
networking apis ??
you mean wsastartup,socket,gethostbyname,gethostbyaddr,connect,recv,send,close socket if you break on recv then you should be able to sniff on the data tht is sent by some server now if there is an algo that decrypts it that has to follow close thats how it works generally

here is a small piece of c code that recvs and sends modified data back to
server

#include <windows.h>
#pragma argsused
WINAPI WinMain (HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nCmdShow)
{
WSADATA wsaData;
SOCKET conn;
struct hostent *hp;
char *servername ="whatever your server name is";
long addr;
struct sockaddr_in server;
unsigned int buff[100] = {0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0};
unsigned int temp[8] = {0,0,0,0,0,0,0,0};
char reabuff[500];
int i;
int wsaret = WSAStartup(0x101,&wsaData);
if(wsaret)
return;
conn = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if(conn == INVALID_SOCKET)
return;
if(inet_addr(servername)==INADDR_NONE)
{
hp = gethostbyname(servername);
}
else
{
addr = inet_addr(servername);
hp=gethostbyaddr((char*)&addr,sizeof(addr),AF_INET);
}
if(hp==NULL)
{
closesocket(conn);
return;
}
server.sin_addr.s_addr=*((unsigned long*)hp->h_addr);
server.sin_family=AF_INET;
server.sin_port=htons(5842);

if(connect(conn,(struct sockaddr*)&server,sizeof(server)))
{
closesocket(conn);
return;
}
recv(conn,buff,100,0);

\\ what ever happens to the crap that was recieved will be here
\\do whatever you want to do with it and send back your response
\\ it will most probably be a infinite loop recvinng all the time and
\\sendvinng till you shut it down
for(i=0;i<4;i++)
{
temp[1]+= buff[i];
}
send(conn,&temp[1],4,0);
recv(conn,reabuff,200,0);
return;
}
nikolatesla20
03-19-2005, 08:48 AM
while it might seem like a good idea to break on the network API's, a sniffer really would help a lot, so you can see what the data looks like ahead of time. That way at least when you do start BPXing on API's you'll know you did it right cause of the data you will see...

CommView is an excellent sniffer, as well as that Ethereal.

To do network stuff you really need to use a sniffer, etc, it helps a lot. And get a good book on networking (A very good book about TCP/IP) Anything by SAMS will be excellent.

-nt20
tiocsti
03-19-2005, 11:39 AM
To do network stuff you really need to use a sniffer, etc, it helps a lot. And get a good book on networking (A very good book about TCP/IP) Anything by SAMS will be excellent.

I'd recommend tcp/ip illustrated, volume 1. It will allow you to understand the protocols (particularly tcp) better.


I want to look at source code
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > I want to look at source code
PDA

View Full Version : I want to look at source code

mdhakk
03-19-2005, 12:07 AM
I used the search feature and couldn't find what I wanted, and I have a feeling I'm going to be ridiculed/chastised for posting this, but this is sort of a last resort. I don't want to be a cracker, all I want to do is take a peek at some code used to run some of my older games and maybe mess with the values a bit. My problem is that the code is compiled or whatever in to a dat file. Is there a program that is able to unpack text/binary dat files? Once again, I'm a novice programmer, and I really dont know much at all about this kind of stuff, so I'm sorry if I've done something I shouldn't have, but I would rather learn how a program works than how it's security and what not works.
Fake51
03-19-2005, 06:15 AM
I'll leave it to JMI as to whether you deserve any scolding.

What you need to do, is locate the code exactly. If the whole .dat file is code, you're lucky. Otherwise, you'll have to dig it out.
When located, you need to run it through a disassembler of some kind. You might have some luck using hiew or tools like it (as they can quite easily start disassembly from whereever you want in the code), but then again, IDA might be able to do the work for you, if configured right.
Heck, if you're lucky, the .dat file is just a rename .exe or .com file. Check the start of the file for the telltale signs.

Now, since you're probably gonna come up against some obstacles, figure out the following:
1. Is the code compiled to machine language? Or is it some vb crap kinda thing?
2. Is it packed or plain?
3. What machine was it intended to run on, and for what system?

Get those right, and things should be somewhat easier.
In short, get a hexeditor, get a disassembler, get some readin matter, get busy, and don't come back here before you've made some progress.

Fake
mdhakk
03-19-2005, 02:01 PM
wouldn't this require me to learn assembly and a whole bunch of other stuff? I literally have never reverse engineered anything in my life, is it feasible that I would be able to see the code in this dat file with less than a week's work? Like I said before, I'm not looking to learn to reverse engineer, I just wanted to find an easy way to look at the source code, and I guess that isn't happening.

I did try a little bit though. The file is all code, and no hiew did not magically convert it to legible text (unless you count tons of smiley faces). I messed around with hiew for about an hour, but I couldn't understand even a little bit of it. It seems to me that there would be a lot of work involved in order for me to be able to do this, and I really don't have the time.

So I guess what I'm asking, is whether or not this is something I can learn in a short period of time, or am I just going to have to give up?
JMI
03-19-2005, 02:40 PM
What do you assume you are going to be able to discover if you do not understand what you are actually looking at in the code? If you do not understand anything about packed/unpacked code and have no idea about how to use disassemblers (or even what they are) or debuggers, it would appear that you have set yourself a fairly unattainable goal, just in the hope of cheating on a game you want to have a better score.

You probably would better spend your time if you learned how to search for information on the net to determine whether or not there is already information out there on how to hack the specific games you are interested in hacking. You would be amazed at how much information is already out there if you try searching. There is a link at the bottem of these forums to searchlore which should give you a good start in that direction if you are as clueless about searching as you are about reversing.

There is nothing wrong with being clueless about reversing or searching. We all started out in that category. There is something wrong with not trying to learn how to help oneself to do one or both of these things and you appear to have at least attempted to start off in a proper direction.

If you actually want to learn how to reverse, you need to accept the fact that it is a study intensive proposition, which might not be well suited for your limited ambitions as stated, and it is not prone to shortcuts which work well. However, searching for a ready solution for your particular programs might lead to information or a solution which avoids the necessity of learning very much beyond how to implement what the game hackers have already discovered.

Regards,
mdhakk
03-19-2005, 02:55 PM
I can understand the code well enough, I just dont know how to reverse engineer, and like I said earlier, at the moment I'm not too interested in learning how to. I did search for someone who has already cracked it, but to no avail. I'm not really interested in cheating to get a higher score, which has nothing to do with anything, but it certainly makes my motives seem childish and stupid. I'm more interested in modifying the code to try and effect the gameplay itself. I'm assuming the game is coded in some sort of vartiation of C, and it's easy enough to modify anything C just by looking at syntax.

I realize I'm out of luck, seeing as how hacking this file is way over my head, but that's really all I wanted to know. Whether or not this was something I was capable of doing, and apparently it is not.
naides
03-19-2005, 06:44 PM
Hi mdhakk.

One harsh reality I learned early in this business is that the object code, once compiled and optimized has essentially no resemblance to the original source code.
Regardless how proficient you are in C, most of the RevEng work is done at the asm level. The original syntaxis and structure is gone.
disavowed
03-19-2005, 08:22 PM
Despite this, it is possible to manually rewrite the object code as C code, though this does require a good deal of reverse engineering skill and can be quite time consuming. I hope that answers your original question.
mdhakk
03-19-2005, 09:52 PM
ahhh, well thanks for the info. I thought as much. I guess I'll have to find another way to amuse myself, seeing as how people have cracked later iterations of the game, I doubt they would go back and reverse engineer a game older than ones they had already done.

thanks again


Knoppix anyone?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > Knoppix anyone?
PDA

View Full Version : Knoppix anyone?

UrgeOverKill
03-19-2005, 09:48 AM
Has anybody have any experience with this one? It seems interesting to me being run from the cd.
0xf001
03-19-2005, 11:44 AM
hi urgeoverkill,

knoppix of course it has set the standard for live distros and many others base on it. It is known ie for its execellent hardware support, ...
live distros now you will find countless others, and they work perfect, you can access your harddisks and so perfectly try out linux with all your media files and else data, or use them as firewalls, ... some fit on usb sticks, ...
please let me add the comment that this forum should be used for RE topics, and not a discussion about distros :idea:

you can visit ptth://www.knoppix.net/ there is a forum as well:
ptth://www.knoppix.net/forum/

cheers, 0xf001
bilbo
03-21-2005, 02:31 AM
Has anybody have any experience with this one?
Hi, UrgeOverKill,
please do not think I want to be unpolite with you, but... Why are you asking this?
Try it yourself... You will get a clean idea of it, better than any suggestion given by others...

Furthermore, it makes no harm at all to your hard disk, and it is nearly free: you neither need to download it, you find it at your newspaper kiosk!

Best regards, bilbo
Woodmann
03-21-2005, 07:58 PM
Hi,

I have played with this and I think it has potential.
Being able to run from CD, it has many usefull tools
when your OS has been corruped.

Woodmann
UrgeOverKill
03-21-2005, 08:08 PM
Thanks for the replys, it seem intresting to me to rce a target with a *portable* OS. Just thinking of the possibilities.........http://www.woodmann.com/forum/images/icons/icon10.gif
bilbo
03-22-2005, 02:29 AM
Apropos live OS-es (CD-only), which can be used as tools collection to repair corrupted OS-es (Woodmann) or as portable platforms for RCE (UrgeOverKill), you could also take into account:

(a) the possibility of building a customizable live CD with Windows OS:
http://www.nu2.nu/pebuilder/

(b) the possibility of building a full customizable Linux OS:
http://ibuild.livecd.net/ (Debian based) or
http://www.babytux.org/articles/howto/how2livecd.php (Mandrake based)

Best regards, bilbo

EDIT: sorry, 0xf001, maybe this message is completely off-topic; feel free to remove it.
0xf001
03-22-2005, 08:23 AM
bilbo and all,

its no problem we can leave it here this time
(just to increase the number of posts of course) :)

for example there exists PHLAK, a cool live CD (ptth://www.phlak.org)
packed and made to be full of hacker tools. there ie is biev as disassembler
included.

and maybe there will soon come a new live CD full of linux RE tools as well :idea: hehe

cheers, 0xf001
Zero
04-08-2005, 05:27 PM
Well, as we are all security nerds, you should try this knoppix:

http://www.knoppix-std.org/


Softice Breakpoints
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Softice Breakpoints
PDA

View Full Version : Softice Breakpoints

JRoger
03-20-2005, 09:17 AM
Ive got Compuware Driver Studio 3.1 on my Win XP SP2 computer. It works great, and I can use:

addr process
bpx 00440000

or whatever and softice pops up great.
But I cant understand why softice wont pop up when I set breakpoints on windows api calls.

Firstly I added the EXP=.....user32.dll lines in winice.dat
and then when i set bpx MessageBoxA, and type BL
it recognises it as 00) BPX USER32!MessageBoxA. But, however many MessageBoxA I execute it wont pop up.

Then I try the symbol retriever, grab the symbols, load them into softice, comment out the EXP= lines in winice.dat and set another breakpoint.
The same thing happens, it recognises MessageBoxA as User32, but it just wont pop up.

So many tutorials tell me to do bpx GetDlgItemTextA and softice will pop up, but it wont... Im gettin so frustrated, any help would be greatly appreciated.

John
naides
03-20-2005, 09:43 AM
but it wont... Im gettin so frustrated, any help would be greatly appreciated.
John

Relax, Roger. Breath. . . Don't get frustrated.

Chances are you set the bpx MessageBoxA while you are standing on a different address context than the app that you intend to generate the API call. . .

If you place a bpx MessageBoxA while standing on the ADDR context of application A, you will only break when Application A (or any of its modules) calls MessageBoxA.

If app B or any other app but A calls MessageBoxA, Sice will not break!

Search the board and learn the Sice setup command to disable this behavoir.

Better: Address context specific BPXs are actually GOOD. Before the ADDR context thingy, every time I placed a BPX on GetSystemTime, Sice would break relentlessly on every fucking app in the system tray that called this API, meaning all of them, 10 times per second. So I could never get to the code of interest.
It is better to set up the BP effectively to derive maximum advantage from them.
JRoger
03-20-2005, 05:51 PM
I just tried bpx GetSystemTime just now, still nothing. I dont know whether this is normal, but as soon as ive set the breakpoint, if i type BL, it gives me _GetSystemTime. If i have to wait a while before it shows Kernel32!GetSystemTime. The problem is not Softice breaking too often (I would be delighted if it did), but its more that it wont break at all!

I have tried doing ADDR targetapp, and making the app run my breakpoint, but softice refuses to break. Why???

BTW, what is your init string for Soft Ice?
JRoger
03-20-2005, 06:13 PM
DOH, im sorry guys. A simple case of RTFM, or even the FAQ on the forum...
For anyone else with this problem, use the command "Set BreakInSharedMods ON", and hurray, problem solved.

Sorry for the time-wasting
evlncrn8
03-20-2005, 08:01 PM
wasnt the bpx.p and bpx.t meant for the context specific stuff? ;)
Kayaker
03-21-2005, 07:12 PM
Hi

I think the subtleties are in how they are all used. The .p and .t qualifiers make the breakpoints conditional on the PID or TID, literally adding IF statements. "BPX.p eip" is transformed to "BPX eip IF (PID==0xXXX)".

What defines context? Context can be considered a fairly broad term I suppose, which includes both process and thread identifiers, and everything that they define, structures, addresses, etc., etc. How Softice defines context may be seen in how it handles the BreakInSharedMods setting.

There is a global variable, dCurrentContext, which is used in many places in Softice code when comparing or switching context. It is actually a pointer to the current KPROCESS structure, or KPEB as Sice names it, identifiable by the 0x1B in the 1st dword of the structure:
0000 KPROCESS struc ; (sizeof=0x6c)
0000 Header DISPATCHER_HEADER ? ; DO_TYPE_PROCESS (0x1B)
0010 ProfileListHead LIST_ENTRY ?
0018 DirectoryTableBase dd ?
001C PageTableBase dd ?
0020 LdtDescriptor KGDTENTRY ?
0028 Int21Descriptor KIDTENTRY ?
0030 IopmOffset dw ?
0032 Iopl db ?
0033 VdmFlag db ?
0034 ActiveProcessors dd ?
0038 KernelTime dd ?
003C UserTime dd ?
0040 ReadyListHead LIST_ENTRY ?
0048 SwapListEntry LIST_ENTRY ?
0050 ThreadListHead LIST_ENTRY ? ; KTHREAD.ThreadListEntry
0058 ProcessLock dd ?
005C Affinity dd ?
0060 StackCount dw ?
0062 BasePriority db ?
0063 ThreadQuantum db ?
0064 AutoAlignment db ?
0065 State db ?
0066 ThreadSeed db ?
0067 DisableBoost db ?
0068 PowerState db ?
0069 DisableQuantum db ?
006A Spare db 2 dup(?)
006C KPROCESS ends
As far as Softice is generally concerned, a pointer to this structure is what defines "context".

Here's a small snippet from a portion of breakpoint setup code in Softice where BreakInSharedMods is used. The code cycles through the array of TDJF breakpoint structures that have been defined, testing and setting some of the fields. (see my previous posts on TDJF Breakpoint Table structure if interested).

SET BreakInSharedMods ON, is used to set non context-sensitive breakpoints in shared ring3 modules (for system dll APIs basically). If the BreakInSharedMods flag is OFF (non global), a pointer to the *current* KPROCESS structure is added to the rest of the information in the breakpoint table, limiting the breakpoint to only that process context.
_loop:
...
:000A0F36 80 BB D3 EB 11 00 03 cmp TDJF.Breakpoint_Type[ebx], 3 ;
:000A0F36 ; BPINT = 01h
:000A0F36 ; BPM/BPIO = 03h
:000A0F36 ; BPX = 05h
:000A0F36 ; BMSG = 06h
:000A0F3D 75 5C jnz short NextTDJF

:000A0F3F 8A 83 DE EB 11 00 mov al, TDJF.Breakpoint_Mode[ebx] ;
:000A0F3F ; execute = 0
:000A0F3F ; write = 1
:000A0F3F ; read = 2
:000A0F3F ; read/write = 3
:000A0F45 24 03 and al, 3
:000A0F47 3C 02 cmp al, 2
:000A0F49 74 50 jz short NextTDJF

:000A0F4B 42 inc edx
:000A0F4C 80 3D 96 8A 10 00 01 cmp BreakInSharedMods_dbFlag, 1
:000A0F53 74 13 jz short @BreakInSharedMods_ON

; specify current context (pointer to KPROCESS) for this breakpoint
:000A0F55 60 pusha
:000A0F56 8B 83 D6 EB 11 00 mov eax, TDJF.BPAddress_1[ebx]
:000A0F5C E8 AD 77 FA FF call GetCurrentContext ; KPROCESS
:000A0F61 89 83 02 EC 11 00 mov TDJF.CurrentContext[ebx], eax
:000A0F67 61 popa

:000A0F68 @BreakInSharedMods_ON:
...

NextTDJF:
:00A0F9B 81 C3 78 01 00 00 add ebx, 178h ; sizeof TDJF
:000A0FA1 49 dec ecx
:000A0FA2 0F 85 44 FF FF FF jnz _loop

I hope this is suitably esoteric Softice information, harmful in mass quantities.. ;-)

Cheers,
Kayaker
bilbo
03-22-2005, 02:53 AM
Great, Kayaker!

I just would add that the code is taken from DriverStudio 3.1, and I would add some more defines for breakpoint types:

:000A0F36 ; BPINT = 01h
:000A0F36 ; BPM/BPIO = 03h
:000A0F36 ; BPX = 05h
:000A0F36 ; BMSG = 06h

IMO, in field TDJF.Breakpoint_Type, we can find:

0=free, 1=BPINT, 2=BPIO, 3=BPM, 4=BPR, 5=BPX, 6=BMSG, 7=BPTE

Best regards, bilbo
naides
03-22-2005, 07:03 AM
Yes, right, Kayaker and Bilbo. That is what I wanted to say, in other words :p :p :p :p
Kayaker
03-22-2005, 08:08 PM
Thanks bilbo, now that you mention it, for DS 3.2 the Breakpoint_Type for BPIO is indeed = 2. However, I do see a difference in DS 3.1, where Breakpoint_Type = 3 for both BPIO and BPMx. This can be seen in live testing (staring fixedly at the Breakpoint Table while changing BP's), or from the code, certain parts of which are identical:

DS 3.1
BPM
:000A3F3E loc_A3F3E: ; CODE XREF: c_Bpm+284j
:000A3F3E B0 03 mov al, 3 ; Breakpoint_Type
:000A3F40 E8 73 06 00 00 call TDJF_Checkfor_DuplicateBP
:000A3F45 72 29 jb short _retn
:000A3F47 66 0F B3 0D 94 1B 12 00 btr word_121B94, cx
:000A3F4F 80 C9 80 or cl, 80h
:000A3F52 88 8B D5 EB 11 00 mov TDJF.DRx_Register[ebx], cl
:000A3F58 C6 83 D3 EB 11 00 03 mov TDJF.Breakpoint_Type[ebx], 3

BPIO
:000A41CF loc_A41CF: ; CODE XREF: c_Bpio+102j
:000A41CF B0 03 mov al, 3 ; Breakpoint_Type
:000A41D1 E8 E2 03 00 00 call TDJF_Checkfor_DuplicateBP
:000A41D6 72 1D jb short _retn
:000A41D8 66 0F B3 0D 94 1B 12 00 btr word_121B94, cx
:000A41E0 80 C9 80 or cl, 80h
:000A41E3 88 8B D5 EB 11 00 mov TDJF.DRx_Register[ebx], cl
:000A41E9 C6 83 D3 EB 11 00 03 mov TDJF.Breakpoint_Type[ebx], 3

As you mentioned, this has changed in DS 3.2.

BPT? Lol, I had to look that one up, I guess I never use it though I might now. Um, you are right there is a ref. to an unknown BP type "7" somewhere in the beepee code (cmp and ignore), but I can't see that it's BPT. The command itself simply dumps an existing BP into the command line for editing into a new BP. Checking it visually, the new BP (next free TDJF structure) then takes on whatever BreakPoint_Type is required, not specifically 7. Do you have secret info?

As for BPR, we are all saddened it went the way of Win9x and the Dodo..

Just like naides said :p

K.
TQN
03-22-2005, 08:28 PM
Great analysis, Kayaker and bilbo.
I have learnt many things from you. It is a good idea to reverse SoftIce.
bilbo
03-23-2005, 03:19 AM
It is a good idea to reverse SoftIce.I agree... but don't speak so loud, someone thinks it is illegal, like coca!

Kayaker, I indeed had not yet time/money:)/will to look at DS3.2...
So let's go on with DS3.1:

I based my assertion on sub_A45B8 (which you call TDJF_Checkfor_DuplicateBP) where the code which checks duplicated BPIO's is separated from the code which checks for other duplicated breakpoints

loc_A45E9:
mov esi, dword_11EBD6[edx] ; bkstruct+7: address / number

cmp al, 2 ; BPIO
jz short loc_A4619 ; checks for duplicated BPIO
cmp al, 6 ; BMSG
jz short loc_A4623 ; checks for duplicated BMSG
cmp al, 7 ; BPTE
jz short loc_A4667 ; continue in loop: skip checks for duplicated BPTE
; checks follow for duplicated BPX/BPM/BPINT

but especially from sub_A30D6, which decodes the different breakpoint types

sub_A30D6 proc

movzx eax, byte_11EBD3[ebx] ; bkstruct+4: bkstruct type
cmp eax, 0
jz short loc_A3156 ; return CY if free

pusha
push edi
dec eax ; set type origin to 0
; strcpy_(ESI=from, EDI=to)
lea esi, aBpint[eax*8]
call sub_6E540

where aBpint is an array defined as "char aBpint[7][8]", 8 bytes per breakpoint type:

aBpint:
db 'BPINT ',0,0,0 ; type 1
db 'BPIO ',0,0,0 ; type 2
db 'BPM ',0,0,0,0 ; type 3
db 'BPR ',0,0,0,0 ; type 4
db 'BPX ',0,0,0,0 ; type 5
db 'BMSG ',0,0,0 ; type 6
db 'BPTE ',0,0 ; type 7

No secret info, as you see, things are simpler than they seem :)
And you are right: on a practical point of view BPIO(2), BPR and BPTE are just defined but not used.

Best regards, bilbo

P.S: I hope I have not annoyed or disgusted someone on the board...
Kayaker
03-23-2005, 04:47 PM
Aha! You do have secret info!! :D

You are definitely right Bilbo, there is an unused BPTE command! I should have looked closer at the strings, I'm ashamed of myself :p. I thought your BPTE might have been a typo, but I didn't really believe you would make a mistake. The error messages are interesting:

.data:00111D11
db 'BPTE KTEB [IF expresssion] - Ring 3 threads only!',0

:000A659E
db 'BPTE: Invalid command line. Try BPTE { KTEB }',0
db 'BPTE: Invalid command line. You must specify a thread.',0
db 'BPTE: Invalid command line. Try BPTE { KTEB }',0
db 'Unable to find thread %x',0
db 'Unable to find process %x',0

The unused command prologue:
:000A37BA BE A2 F7 10 00 mov esi, offset bUserCommand
:000A37BF 56 push esi
:000A37C0 E8 A7 2E 00 00 call _BPTE
:000A37C5 C3 retn

It's a very extensive command. Maybe for future use, break on thread entry? Of course you realize I have to try to run it now... I'll be back after the crash ;-)

Regards,
Kayaker


Marx Cryptobox emulation/hacking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Marx Cryptobox emulation/hacking
PDA

View Full Version : Marx Cryptobox emulation/hacking

derFireBird
03-21-2005, 03:16 AM
Hi,

at first, sorry for my bad english, im german...

im a really noob, so please help me.

i have a programm :whoops: ,its protected with a Marx Crypto-Box.
How can i emulate this Cryptobox, or how can i crack the programm that it starts without the cryptobox???

please help me.
thanks...

Chris
monguz
03-21-2005, 06:24 AM
At first: please edit your post.. i think no target name are allowed..?!
The Marx-Box uses IDEA or AES-Rijndael Crypto. DeCrypt/EnCrypt its used most to get appropriate Read/Write Passwords to Memory of Crypto-Box.
Check if the software use the MPIWIN32.dll if so try to 'emulate' the needed answers... the most used functions are:
MPIWIN32.MPI_Close
MPIWIN32.MPI_DecryptEx
MPIWIN32.MPI_EncryptEx
MPIWIN32.MPI_Open
MPIWIN32.MPI_ReadID
MPIWIN32.MPI_ReadMem
MPIWIN32.MPI_SearchFirst
MPIWIN32.MPI_SetChannel
MPIWIN32.MPI_SetNetworkParameter
MPIWIN32.MPI_SubmitPasswordEx
MPIWIN32.MPI_WriteMem

Read,Search then see what happends
greetz monguz
derFireBird
03-21-2005, 06:45 AM
hi, thanks for reply...

i can't find this file on my pc.
but in the folder of the prog, ther are a lot of "cb9" files.
cb9.vxd
cb9.vdd
cb9win.dll

and a "dongle32.dll"... on this file the program access on start...

and i have access to a "original" dongle, so i can maybe it readout,
the dongle is on work, but i will use the programm at home...
but i can't take the dongle every evening at home, because other people would work with it on work...

plz help me...

greets from germany, Chris
Woodmann
03-21-2005, 08:11 PM
Howdy,

n00b and "I dont speak English" do not work here. Since you can read English you can type English. We can figure out what you mean.

Since you have access to the dongle, you can use some tools to read what is passed between the software and the dongle. Then you can make the needed "patches" so it will work without the dongle.

Make some effort to find an answer. It will go a long way to getting some help.

Woodmann


odd behavior in a keygen crackme
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > odd behavior in a keygen crackme
PDA

View Full Version : odd behavior in a keygen crackme

tdennist
03-21-2005, 08:04 PM
So, I (hopefully!) successfully reversed using OllyDbg this crackme that asks for a name and then calculates the serial from the name. Here's what I discerned to be the algorithm:

004012BA /$ 53 PUSH EBX ; 0
004012BB |. 56 PUSH ESI ; our serial
004012BC |. 57 PUSH EDI ; our name
004012BD |. BF 88304000 MOV EDI,keygen_#.00403088
004012C2 |. 33C0 XOR EAX,EAX
004012C4 |. 33DB XOR EBX,EBX
004012C6 |. 33C9 XOR ECX,ECX ; zero out our counter register
004012C8 |> 8A1C39 /MOV BL,BYTE PTR DS:[ECX+EDI] ; this will move into BL the letters of the name individually, depending on ecx our counter
004012CB |. 84DB |TEST BL,BL ; test to see if we have a letter
004012CD |. 74 08 |JE SHORT keygen_#.004012D7 ; jump if there are no more letters
004012CF |. 03C3 |ADD EAX,EBX ; add ebx to the value of eax
004012D1 |. 83C0 10 |ADD EAX,10 ; increase the letter val by 10. i.e. 74 becomes 84
004012D4 |. 41 |INC ECX ; increment our counter
004012D5 |.^EB F1 \JMP SHORT keygen_#.004012C8
004012D7 |> 50 PUSH EAX ; /push final serial to stack
004012D8 |. 68 76304000 PUSH keygen_#.00403076 ; |Format = "%X"
004012DD |. 68 D0304000 PUSH keygen_#.004030D0 ; |s = keygen_#.004030D0
004012E2 |. E8 1F000000 CALL <JMP.&user32.wsprintfA> ; \call wsprintf, storing final serial in keygen_#.004030D0
004012E7 |. 83C4 0C ADD ESP,0C ; clean up stack
004012EA |. 5F POP EDI
004012EB |. 5E POP ESI
004012EC |. 5B POP EBX
004012ED \. C3 RETN

With comments that I made to the side. So, I run the application in OllyDbg and try the string "tyler" as the name, and "280" as the serial, and lo and behold, it works! However, if I run the program from windows and try the same name/serial combination, it does not work.

(Also odd is that my keygen which I wrote in Perl generates the serial number "280" for the name "tyler", which apparently is correct, but when I try other generated serials, they don't work through OllyDbg OR Windows! Is it legal for me to post my Perl here, too, and have someone go over that?)

So you see, I've done my stuff...I found the algorithm (or what I believe to be it) and I made the keygen. In other words...don't go ballistic calling me a newbie and such ;-). I did what I think is right, and now I just have some questions.

Thanks!
bilbo
03-22-2005, 02:10 AM
Hi, tdennist,

Tyler? I love her... She is one of my best friends... She is our Elf princess!

The algorithm is ok: tyler->0x280

In C language (with a printf at every step, to see better the serial building process):

#include <windows.h>
#include <stdio.h>

void
main(void)
{
DWORD ret=0;
char *name = "tyler";

while (*name) {
ret += *name++ + 0x10;
printf("%x\n", ret);
}
}

Anyway, I suspect you are facing two problems here...

First problem:
So, I run the application in OllyDbg and try the string "tyler" as the name, and "280" as the serial, and lo and behold, it works! However, if I run the program from windows and try the same name/serial combination, it does not work.There must be some other name manipulation outside of this routine, which you are not aware of using a debugger... Try using an "hide debugger plugin"...

Second problem:
When I try other generated serials, they don't work through OllyDbg OR Windows!Are you sure you are building up your Perl result in a longword? Maybe Perl is wrapping inside a 16bit word, but the check is performed on 32bits? Just a speculation...

Best regards, bilbo
ZaiRoN
03-22-2005, 05:30 AM
Hi tdennist,
if you want you can share your crackme with us. We'll try to figure out the problem...

Regards,
ZaiRoN
tdennist
03-22-2005, 05:36 PM
My gosh...you can't imagine how frustrated that makes me that you were able to bang out that utterly simple keygen, when I went around and around first with C, then with C++, then finally with Perl, all with no luck. While I admit I am verrry very far from proficient in C/C++ (in fact, as it is I greatly prefer programming in ASM than either C or C++...they're just so RESTRICTING...), I like to consider myself at the very least proficient in Perl. Maybe I'll try my next one in Java....

But anyhoo.

As far as getting a "hide debugger plugin" is concerned...I have absolutely no idea where one would go to get one o' those, nor how one would go about using one. So...any suggestions? :p

I am indeed not sure what is wrong with my Perl. I'll post it here and anybody else who knows Perl mayhap can tell me what's wrong:

#!/usr/bin/perl
#keygen for keygen #1.exe

print "Name: ";
chomp($name=<STDIN>);

$serial = 0;
$ascletter = 0x0;

@letters = split(//,$name);

#doing all arithmetic in base 10, then at the end converting to base 16
foreach $letter (@letters) {
$ascletter = ord($letter);
$serial += $ascletter;
$serial += 16; # 16 = 0x10
}

printf("Serial! -> %x\n", $serial);

And as far as ZaiRoN's suggestion goes...I've attached it! Feel free to scan it for virii and such, but I'm fairly certain it's free of 'em.

Thanks for your time and help!
TQN
03-22-2005, 08:58 PM
You are right, bilbo !
The keygen uses IsDebugPresent to detect debugger.

.text:0040100C call IsDebuggerPresent
.text:00401011 cmp eax, 1
.text:00401014 jnz short ShowDlg
.text:00401016 push eax
.text:00401017 pop bDebuggerPresent

And at 004011C8, the keygen call one of two check function, according to bDebuggerPresent flag:

.text:004011C8 HaveNameAndSerial: ; CODE XREF: DoCheck+17j
.text:004011C8 mov eax, bDebuggerPresent
.text:004011CD cmp eax, 1
.text:004011D0 jnz short loc_4011D9
.text:004011D2 call GenerateFakeSerial
.text:004011D7 jmp short CompareSerial
.text:004011D9 ; ---------------------------------------------------------------------------
.text:004011D9
.text:004011D9 loc_4011D9: ; CODE XREF: DoCheck+37j
.text:004011D9 call GenerateRealSerial
.text:004011DE CompareSerial:

So the real generating serial code at 0040123C.

.text:0040123C GenerateRealSerial proc near ; CODE XREF: DoCheck:loc_4011D9p
.text:0040123C push ebx
.text:0040123D push esi
.text:0040123E push edi
.text:0040123F push 155h
.text:00401244 push offset DoCheck
.text:00401249 call CheckCRC32
.text:0040124E cmp eax, crc32ofDoCheck
.text:00401254 jz short Start
.text:00401256 call GenerateFakeSerial
.text:0040125B jmp short Done
.text:0040125D ; ---------------------------------------------------------------------------
.text:0040125D
.text:0040125D Start: ; CODE XREF: GenerateRealSerial+18j
.text:0040125D mov edi, offset nameBuf
.text:00401262 xor eax, eax ; eax = 0
.text:00401264 xor ebx, ebx ; ebx = 0
.text:00401266 xor ecx, ecx ; ecx = 0
.text:00401268 xor edx, edx ; edx = 0
.text:0040126A
.text:0040126A Loop: ; CODE XREF: GenerateRealSerial+49j
.text:0040126A mov bl, [ecx+edi] ; bl = nameBuf[ecx]
.text:0040126D test bl, bl ; bl == 0 ?
.text:0040126F jz short Check
.text:00401271 add edx, ebx ; edx += nameBuf[ecx]
.text:00401273 or eax, edx ; eax |= edx
.text:00401275 inc eax ; eax++
.text:00401276 rol edx, cl ; edx <<= cl
.text:00401278 not eax ; eax = !eax
.text:0040127A mov esi, offset realSerialBuf
.text:0040127F add al, [esi+4]
.text:00401282 inc ecx ; ecx++
.text:00401283 add eax, edx ; eax += edx
.text:00401285 jmp short Loop
.text:00401287 ; ---------------------------------------------------------------------------
.text:00401287
.text:00401287 Check: ; CODE XREF: GenerateRealSerial+33j
.text:00401287 push edx
.text:00401288 push 155h
.text:0040128D push offset DoCheck
.text:00401292 call CheckCRC32
.text:00401297 pop edx
.text:00401298 cmp eax, crc32ofDoCheck
.text:0040129E jz short Right
.text:004012A0
.text:004012A0 Wrong:
.text:004012A0 push eax
.text:004012A1 jmp short Format
.text:004012A3 ; ---------------------------------------------------------------------------
.text:004012A3
.text:004012A3 Right: ; CODE XREF: GenerateRealSerial+62j
.text:004012A3 push edx
.text:004012A4
.text:004012A4 Format: ; CODE XREF: GenerateRealSerial+65j
.text:004012A4 push offset asc_403076 ; "%X"
.text:004012A9 push offset realSerialBuf
.text:004012AE call wsprintfA
.text:004012B3 add esp, 0Ch
.text:004012B6
.text:004012B6 Done: ; CODE XREF: GenerateRealSerial+1Fj
.text:004012B6 pop edi
.text:004012B7 pop esi
.text:004012B8 pop ebx
.text:004012B9 retn
.text:004012B9 GenerateRealSerial endp

The source of keygen:

#include <stdio.h>
#include <string.h>

int main(void)
{
char szName[36] = { 0 };
int serial = 0;

printf("Input user name: ");
scanf("%32s", szName);

for (int i = 0, len = strlen(szName); i < len; i++)
{
serial += szName[i];
serial <<= i;
}

printf("Serial = %X\n", serial);

return serial;
}

Serial for "tyler" is "4C5A0"
Regards,
TQN
bilbo
03-23-2005, 02:24 AM
tdennist,
please allow me to write down just 3 remarks, without any malicious intent:

(1) I greatly prefer programming in ASM than either C or C++...they're just so RESTRICTING... everything is RESTRICTING when you cannot fully dominate it... also Windows is so RESTRICTING, isn't it? Why? Because it comes without sources...

(2) I quoted "hide debugger plugin" just for an easy cut and paste of the three words into Google (without quotes): try it, it will make no harm to you!

(3) Have you already read the two solutions submitted on www.crackmes.de? But yes, TQN's one is better: TQN, why don't you submit it?

Best regards, bilbo
TQN
03-23-2005, 02:45 AM
Hi bilbo !
I am very afraid when writting English because my bad English skill, and a solution for crackmes.de need a long description, and I am always open aside a Vietnam-English dictionary when writting English.
Best regards,
TQN
bilbo
03-23-2005, 05:36 AM
TQN,
why you do not write an English<->Vietnamese dictionary for Babylon?
They will reward you for this...
http://www.babylon.com/display.php?id=55

By the way, a nice project would be to reverse engineer the Babylon dictionary format (.BGL) - compressed and/or encrypted - in order to revert back to its source format (.GLS) ;)

Best regards, bilbo
TQN
03-23-2005, 05:57 AM
Thank for your idea, bilbo !
I will take a look at it.


Attached Zip files are fixed fixed
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Attached Zip files are fixed fixed
PDA

View Full Version : Attached Zip files are fixed fixed

goggles99
03-22-2005, 12:21 AM
Attached Zips seem to be fixed :yay:
Thanks to whoever helped with the fixin... :)
JMI
03-22-2005, 12:33 AM
You are welcome. :yay:

Regards,


Trying to Crack Linux program with maybe AntiDebugging?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > Trying to Crack Linux program with maybe AntiDebugging?
PDA

View Full Version : Trying to Crack Linux program with maybe AntiDebugging?

barshad
03-22-2005, 01:46 AM
I'm trying to crack linux program
when i open the program in GDB and run it works fine
but when ever i set a break point it exit with SIGKILL
can some one help me ?
0xf001
03-22-2005, 07:07 AM
hi!

cool it seems there could be antidebugging involved. did you try the basic checks in
ptth://home.pages.at/f001/linux_anti_anti_debugging4CBJ.txt

you can just quickly check if it calls ie ptrace.

cheers, 0xf001
andrewg
03-22-2005, 07:18 AM
strace -i might be useful for a quick attack upon the process. (examine the output, see if its doing ptrace, or kill(SIGKILL, getpid()) or so).

The -i prints out the eip of where the syscall happens. If its in the text segment (>0x08048000) it means the binary is either statically compiled, or alternatively, they are embedding the assembly commands in, and not depending on libc).

At any rate, you'll probably want to put a break point on that eip, and see if you can reach it. If you can reach it, do a back trace, and find out where in the code it is... from there I'd imagine it'd be pretty easy to identify where it is.

If you need more advice, you might want to tell us a bit more about the binary. For example,
- Whether or not its statically compiled.
- What symbols does it import (objdump -R will tell you)
- maybe some strace information of areas you think are suspect.

Hope this helps.
barshad
03-26-2005, 09:15 PM
if i run the software with strace, it exits
Please check the attachment for strace
andrewg
03-27-2005, 07:25 AM
Hmmm.. that strace output didn't overly mean too much. It might be worthwhile checking your system log files though, as it logs to syslog (grep test.x /var/log/* or so.. you may need to find where your syslog logs to though if its not there.)

You may find some interesting information in there; for example, why it exited. You could also re-run strace with a larger string size outputed (-S 2048 or so should work, if not, check the strace man page)

An interesting note is that its threaded, so that makes some things slightly more complicated.. for starters you might want to tack -f to the strace arguments as well, and that might shed some light onto the matter.

Additionally, you might want to put a breakpoint on the code you're interested in, and also put a hardware breakpoint on that memory as well, in order to check if the code breaks inside a crc-type loop. You should be able to do the hardware assisted breakpoint via the gdb awatch command.

I noticed it appears to be statically compiled, did you try to restore symbols on the binary, or does it have symbols on it? that could provide useful for cross-referencing purposes. (Locating ptrace() calls, etc.)

Hope this helps,
- andrewg
0xf001
03-30-2005, 05:51 AM
hi,

when looking at your strace output i can see the binary uses the clone() syscall. the name is quite self explaining, it creates a clone process of it self. this is how it implements the thread(s) ([0855ad55] clone). I also wanted to suggest to use the -f option of strace (to trace the threads as well), but I never tried it on the clone syscall. can just hope it works.

also it creates several pipes to communicate either with it's clone or sthg else. I saw the syslo g facility am I right? interesting is also that it redirects via rt_sigaction the signal handlers. by this it might as well check for a debugger presence.
also the gettimeofday, time calls seem suspicous to me, it might measure the execution speed for being singlestepped broken and continued etc.

somehow I maybe you can see the whole thing under a different light - can you run linice on your system? i am pretty sure you will be able to find it quicker what is going on and maybe then this binary does not recognize a debugger at all.

for a little bit more information can you run the strace like
strace -tt -v -x -f -s 2048 yourexecutable

what the options are for you will find in the manpage :)

regards, 0xf001

PS: andrewg my debian says -Ssortby -sstrsize is this a typo, or?
andrewg
04-03-2005, 02:01 PM
0xf001, that was a typo. Wasn't on a box with strace installed to confirm at time of writing.

At any rate, syslog() uses various time syscalls to format the time part of the logs that are generated.


802.11n detector
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > 802.11n detector
PDA

View Full Version : 802.11n detector

Silver
03-22-2005, 10:48 AM
Hi,

Can anyone recommend a good 802.11(a/b/g) detector unit? By unit, I mean pocket-sized self contained device that detects network signal & strength. Looking for recommendations, quite a few on the market at the moment but oddly I don't know anyone who has used one.

Thanks.


armadillo nanomites
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > armadillo nanomites
PDA

View Full Version : armadillo nanomites

fighter_81
03-23-2005, 09:18 AM
Hello to all of you, i was attempt to unpack a program packed with arma and after dumping at oep and after the iat fixing i had to beat the nanomites protection and to do this i thought that i can install a Structured Handler Exception to deal with the int3. My first question was where can i install it?
After some thinking i found an answer to my own question and i think that i could install mi seh between the GetThreadContext where it gets the place where int3 occurs and the SetThreadContext where it get the control back to the int3.
What do you think of this method to defeat them?
And my final question is if is better to install a per-thread handler or a final-thread one.
What do you think?
Hope having an answer.
Regards,
FIGHTER_81


IDA Pro FLAIR421 "issues"...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > IDA Pro FLAIR421 "issues"...
PDA

View Full Version : IDA Pro FLAIR421 "issues"...

Wotan
03-23-2005, 01:27 PM
Hello all,

I’m trying to reverse engineer a satellite receiver based on the STMicroelectronics Sti5500 (ST20 core) using IDA Pro. I’m pretty sure that the receiver was coded using STM’s ST20 Toolbox (The toolbox has it’s own version of C for development).

Now, I’ve been able to load the receiver’s firmware into IDA Pro, but would like to use the FLAIR tools to generate SIG patterns to get a better idea of what’s going on in the code. This is where the wheels fell off… The ST20 Toolset has a library (chock full of functions), but they don’t seem to be of any “type” that the FLAIR tools recognizes.

Anybody have any ideas on how to get the FLAIR tool to recognize these library functions, or how to make to code a little more readable? …ST20 assembly is a real “bear” to work with… :-/ ...Any advice would be appreciated…

I’ve attached one of the math libraries if anyone what’s to have a look at what “type” it is…

TIA,

W
Wotan
03-29-2005, 02:39 PM
Hmmm... Was the question too stupid? Or was it that no one knows? Anyone? :(

W
doug
03-29-2005, 03:45 PM
Do you need guidance with IDA's ST20 .sigs or with creating your own sigs from an existing idb; or both?
Wotan
03-30-2005, 12:01 AM
Thanks Doug,

Well, like I said, I'm assuming (from what I've read) that I can use the FLAIR tool to generate PAT/SIGs from a C library that I believe the receiver was programmed in, correct? (although I'm somewhat familiar with IDA, I've never used the FLAIR tool)

I'm trying to build a signature database for all these C functions (in the ST20 Toolbox) to reverse the firmware and make it a little more "readable"... But the problem seems to be that these libraries aren’t in any standard that the FLAIR tool can read or recognize.

It’s quite possible that I’ve misunderstood what the FLAIR tool does. Am I on the right track here? I may need guidance, lol…

Thanks,

W
Polaris
03-30-2005, 01:16 AM
The signature toolkit of IDA Pro does work only with a finite type of libraries format.

If (and this is your situation :-/ ) you have libraries that are in another one, you need a workaround.

My advice is:
1)get your hands over the STxxx toolkit
2)use the libraries to produce a binary full of silly calls to most known library functions...
3)reverse it, and identify all of the functions
4)dump bytes for every function along with names
5)write a small IDC script that opens the dumps created and search for them in the IDB
6) You are done!

It seems really more complex than it is... However, I once did something like this over some Modula2 binary, and it produced really good results.

Byez ;)
tom324
03-30-2005, 03:45 AM
If you can load math.lib into IDA Pro there are two plugins which can be of help: idb2sig and idb2pat. Both of them create .pat file from chosen function(s) in IDA database, so:

1. load math.lib into IDA
2. Create .PAT file for all functions
3. create .sig file fom .pat file using flair
4. Apply .sig file to the receiver’s firmware

I have been using idb2sig for x86 only, for Sti5500 it may require some modification.

Tom
Polaris
03-30-2005, 05:53 AM
If you can load math.lib into IDA Pro there are two plugins which can be of help: idb2sig and idb2pat.

You are completely right man!
I really forgot about those two plugins.... Are they updated anymore? :yay:
Wotan
04-01-2005, 11:29 AM
Gentlemen, thank-you very much for the tips! I'll give those a shot and see what I can come up with... At least it gives me a starting point...

Thanks again, :yay:

W


OSIX Articles: Avoiding Debuggers; Self Modifying Code - Defeating the Disassembler
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > OSIX Articles: Avoiding Debuggers; Self Modifying Code - Defeating the Disassembler
PDA

View Full Version : OSIX Articles: Avoiding Debuggers; Self Modifying Code - Defeating the Disassembler

Kayaker
03-23-2005, 06:18 PM
A couple of very nice articles I hope the author doesn't mind me attaching here for future reference.

Written by Giovanni Tropeano 11/2004
Prepared for OSIX

Avoiding Debuggers - Protect your programs!
http://www.osix.net/modules/article/print.php?id=594

This time we will look at how to make it very difficult for people to trace through your code. Learn about debuggers, how they work, and how your applications can detect them.

<< Sections in this document <<

...Preface
...Brief history of debuggers
...How debuggers work
...Tracing, and how to overcome
...Getting around breakpoints

-------------------------------------------

Self Modifying Code: A Guide to Defeating the Disassembler
http://www.osix.net/modules/article/print.php?id=592

This article takes an in depth look at self modifying code (SMC) and how you can use it in your own applications. There are examples in C++ using inline assembly, as well as pure assembler. I also talk about executing code on the stack, which is essential to successfully write and execute SMC.

<< Sections in this document >>

...Brief History of Self Modifying Code...
...Windows Memory - How it's put together...
...Using WriteProcessMemory - New Best Friend...
...Putting Code on the Stack, and executing it!...
...Why relocatable code can be bad for your health...
...I got your optimization right here!...
...Using SMC in your own apps...
...How to contact me about this document...

-------------------------------------------

Kayaker
bilbo
03-24-2005, 08:10 AM
Thanks for the link, Kayaker, this is definitely a must read!

I love the capacity which has this author of giving stimulus on many fields, due to his comparative knowledges (Windows/Linux, ASM/C, Microsoft/Borland, and so on...)

Other papers from the same guy:
Examining Viruses (http://www.osix.net/modules/article/?id=629)
Common Hacking Techniques to be Aware Of (http://www.osix.net/modules/article/?id=632)

Thanks again...
The whole site too is extremely interesting,
bilbo
thandermax
04-20-2005, 04:42 AM
other link such about virus and releted :

can be found here =>

http://vx.netlux.org

u can get many sources also.

A very good site about those , but ofcource to enhance ur knowledge not to let others computer down. :yay:


Need help for Sentinel LM
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Need help for Sentinel LM
PDA

View Full Version : Need help for Sentinel LM

Hero
03-24-2005, 01:30 AM
Hi all
I'm working on my first Sentinel LM.But I get an strange problem when working
on it.
Look at the values of sended args to LSRequest in my work:

EBP ==> >/0013F654
EBP+4 >|771273D0 RETURN to OLEAUT32.771273D0
EBP+8 >|00B62538 ---->1st arg
EBP+C >|00000008
EBP+10 >|00000000
EBP+14 >|0045FC10 UNICODE "WinGslib"
EBP+18 >|00B620A0 ASCII "WinGslib"
EBP+1C >|00000008
EBP+20 >|0017D4B8
EBP+24 >|0045F9E0 wingslib.0045F9E0 ---->8th arg

But as you see some parameters are NULL that can't be(for example FeatureName).
How this is possible?This is the only time that I get to LSRequest.
In addition How I can find out version of Sentinel LM used for protection?

Edit:After trying my test program I get another trouble too.In one of my tracings
suddenly my 30 days trial expired without any change in any file befor ending this
30 days.But more important problem is that now the program tracing will not get to
LSRequest except before.How this is possible?Is it possible that main license and demo
license file is deferent from each other?

sincerely yours


SoftIce 3.25 nt
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > SoftIce 3.25 nt
PDA

View Full Version : SoftIce 3.25 nt

mac53
03-24-2005, 08:37 AM
I'm running Windows xp on the nt 5 file system. When I went to install SoftIce 3.25 nt a notice [warning] box apperared stating that there are several issues with installing SoftIce on NT 5. Below, I paste this warning:
*********************************************************

Using SoftICE with NT 5.0
-------------------------
NOTE: NT 5.0 is a beta operating system. Unfortunately, this means
that the subtle changes to NT 5.0 internals between interim builds can
break key functionality in SoftICE. We have tested SoftICE for NT
version 3.25 with Windows2000 (NT 5.0 beta 3) (1946). SoftICE is supported with known limitations on this build (see Windows2000 limitations later on in this section).

There are different manual configurations that can be made to SoftICE to
increase the chance of supporting builds other than 1946. However,
support cannot be guaranteed on builds of Windows2000 other than 1946 at this point.

Here is a list of changes that must be made for Windows2000 support.

1) Due to problems with file system access in boot drivers, if you want
to load SoftICE as a boot driver, you MUST read the text file
NT5BOOT.TXT in the SoftICE directory. It contains an explanation and
instructions to successfully use SoftICE as a boot device.

2) If using an Windows2000 build other than build 1946, you will need to do
the following. Place the NTSYMBOLS=ON keyword on a separate line in
winice.dat, and automatically load symbols for NTOSKRNL. This
keyword will allow SoftICE to use the kernel symbols for hooking key
routines and data. Be sure that the symbols being loaded are
properly matched to the build of NTOSKRNL.exe. The method that
SoftICE uses alternatively is impacted by binary changes in the
NTOSKRNL module. Using symbols eliminates this impact. Automatic
loading of symbols is done via the Symbol Loader (Loader32.exe)
Edit|SoftICE Initialization Settings menu item. Symbols for NTOSKRNL
are provide in the form of a ntoskrnl.dbg file. This file can be
translated, using the Loader32.exe or nmsym.exe, to create a .nms
file. NOTE: The debug binaries for Windows2000 Beta 3 are build with VC
6.0. Place the file 'mspdb60.dll' in the path to translate symbols
for this and later builds. This file is located on setup CD 1, in
the Common\MSDEV98\BIN directory.

3) Keyboard support will most likely break in builds of Windows2000 that are
not specifically tested. This is due to the fact that SoftICE's
keyboard driver patching is dependent on particular binary images.
For keyboard support on builds of Windows2000 that are not specifically
tested, download the i8042prt.sys driver on ftp.numega.com\anonymous\tech. Replace the driver currently
installed on your system with the downloaded driver (please backup
the original driver). This version of the driver is supported. It is
simply the i8042prt.sys driver from build 1946.

4) It is necessary to disable the boot GUI that was added in NT 5.0
build 1814. There have been some cases where the boot GUI causes
problems with SoftICE's VGA support. SoftICE will not be able to
popup in VGA or text mode if the boot GUI is not disabled. The
SoftICE version 3.25 installation will automatically add a /noguiboot switch to the Windows2000 configurations that are listed in the boot.ini file. To reenable the boot gui, remove the /noguiboot switch. Here is an example of boot.ini with a /noguiboot switch.

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows2000 Professional Edition" /noguiboot

* Known Limitations with SoftICE ver 3.25 and NT 5.0 builds 1773 and
greater:

1) SoftICE will most likely work improperly when loaded as a boot driver. One of two things can happen. One, the file I\O will not work in SoftICE. The file system is not initialized completely at this point. Therefore SoftICE cannot load symbol files, exports and configuration files. Secondly, a page fault can occur in the IoIsOperationSynchronous() kernel routine. These incompatibilities are a result of some major architectural changes in Windows2000. ICEPACK is the current solutions for this problem. If you experience either of these problems, read the NT5BOOT.txt file in the SoftICE install directory for instuctions on using this or, change the SoftICE startup mode to SYSTEM.
**********************************************************

The reason I do this is because after reading this I became very apprehensive as to whether to install it or not. I post this to get a professional opinion from one of our members. I see that according to this warning, they mention ICEPACK! Now whether that's the only solution to this issue, I don't know. Are there patches for this isue? Again, Idon't know! This is why I'm asking for help with this one. :confused:

Thank you...
lifewire
03-26-2005, 06:57 AM
forget it, it won't work. get DS3.2. and if i were you i'd change my signature. but that is a matter of taste ofcourse :D
mac53
03-26-2005, 08:10 AM
First off...you're not me. What's DS3.2 and what's wrong with my signature?
:smug:
disavowed
03-26-2005, 12:08 PM
First off...you're not me.
that's why he said, "if"

you don't want to use softice, believe me. it's barely supported by compuware anymore, and as time goes on it will only get worse.

instead of softice, you're better off using ollydbg for user-mode debugging and windbg for kernel-mode (although i doubt you'll have a need for the latter)

you also might want to upgrade to xp pro instead of xp home (don't ask how i know that you're using xp home)
mac53
03-26-2005, 01:00 PM
Ok...I won't ask...but I will ask why do you think that xp pro is better than the version I'm using? Oh yeah, by the way...I'm not changing my signature for anyone, furthermore I don't see where it's causing any harm! [suck it up] :devil:
disavowed
03-26-2005, 02:12 PM
Ok...I won't ask...but I will ask why do you think that xp pro is better than the version I'm using?

Well it's not necessary per se, but the things that I appreciate about XP Pro (vs. Home) are Remote Desktop and Access Control. To see all of the differences, you can look at: http://www.microsoft.com/windowsxp/home/howtobuy/choosing2.mspx
The advice was just general, not really reverse engineering related.

Oh yeah, by the way...I'm not changing my signature for anyone, furthermore I don't see where it's causing any harm! [suck it up] :devil:
The advice was so that you would look less like a newbie/outsider here. It was actually constructive criticism. But, of course, it's your decision whether you want to keep it or not.
mac53
03-26-2005, 02:20 PM
Ok...thanks for the explanation.

I'm not sure if those few extra options in an OS would benefit me or not, disavowed.
Especially for me to go out and purchase another OS...christ, I already have 5 Windows Os's as it is. But, in your opinion, if you know that upgrading to pro will help me in my endeavors, then I guess that's something I'll have to look into. :yay:


ec problem
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > ec problem
PDA

View Full Version : ec problem

teaser
03-24-2005, 11:07 AM
I tried to search, but i cant find anything about:
how to compute order of curve over gf(p^m) [p>3,m>1] ?
mike
03-28-2005, 04:26 PM
I don't know much about ECC, but this looks like it might answer your question.

http://www.ams.org/journal-getitem?pii=S0025-5718-99-01081-9
teaser
03-28-2005, 04:51 PM
To be honest i didnt think it can be so hard. This article looks weirdly, but i will try to understand *something* ;)
Big thanks for your answer.
mike
03-28-2005, 08:44 PM
Do you know how to compute it for F_p and F_(2^n)? If you can explain these to me, then I can work out how to do the other.

The best place to ask for a real answer would be on the sci.crypt usenet group.


W32DASM USER MESSAGE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > W32DASM USER MESSAGE
PDA

View Full Version : W32DASM USER MESSAGE

mac53
03-24-2005, 01:44 PM
There is one particular .exe that when I try to disassemble I get this message:

W32Dasm could only allocate enough memory to process 368640 lines of text. The disassembly listing will not be complete and the search functions may not be successful. You can free up additional memory by closing other programs, increasing RAM/or virtual memory. Also, be sure to have at least 150MB of free space on your working drive. If you are running Win 3.1 with Win32S, please note that W32Dasm works better in Windows 95 when disassembling large files.
*********************************************************

The file is 848KBs in size...I'm running 1024MB RAM [512mbs each side] and I have about 70 gbs of hard space left. I'm running xp. Can anyone tell me what's going on here? Really would appreciate some advise. :yay:

Thanks
JMI
03-24-2005, 02:59 PM
Do yourself a favor and move up to IDA. W32Dasm is really older technology which has, for the most part, been passed by because it hasn't been updated. IDA is much more complex and will include a learning curve, but is well forth the transition. Since you are just starting in the reversing area, you might as will start with modern tools, especially since you are using XP.

Regards
naides
03-24-2005, 05:52 PM
Even a small app can fill up the available memory by placing anti-dissasembly code:

004533045: call 004633045
.
.
.
004633045: jmp 004533045

or variations on the theme. W32Dasm just goes round and round until the buffer overloads, but IDA will only disassemble code that will actually excecute in some instance.

Needless to say, the real application never gets to execute such code.
mac53
03-25-2005, 08:44 AM
naides...

Is there some way that I can noop this anti-disassembly code or if it appears the way you displayed it in your post, enter code to stop this from running awry? If it is, then I'd like to learn this among everything else. I'm going to hop on google now and look for IDA.

Thank you and JMI for responding
naides
03-25-2005, 10:17 AM
naides...

Is there some way that I can noop this anti-disassembly code or if it appears the way you displayed it in your post, enter code to stop this from running awry?
Thank you and JMI for responding

Yes, there are, but it would be an excercise of futility. . .

You would need heavy use of IDA (INTERACTIVE) Disassembler to locate and modify the code and/or Learn to Debug the W32Dasm disassembly machine live and direct, to locate and deactivate the Anti-disassmbly tricks.

If you look for Anti-disassmbly in the web and in this board, you will find that those tricks can be quite sophisticated, (not like my quick and dirty example), so you would need deep undertading of the code and the disassembly process. . .

In other words NOT WORTH THE TIME AND EFFORT.
mac53
03-25-2005, 10:38 AM
naides...

Got'cha...Thanks

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Man...you are right...JMI set a helava post back in April of 2001 on this issue.
I'm going to take Wdasm89 and use it on itself to see if I can find that loop...wish me luck!!! :yay:
disavowed
03-25-2005, 11:34 AM
jmi, naides... i think we failed :\
mac53
03-25-2005, 12:06 PM
disavowed...

jmi, naides... i think we failed :\

Who are you? Where did you come in on this conversation? I don't see you anywhere else in this thread! What do you mean,"You failed"? Elaborate :mad:
naides
03-25-2005, 01:40 PM
Relax, man. . .!
Disavowed post is tongue in cheek!
mac53
03-25-2005, 02:01 PM
ha ha ha ha ha....OK man! I also offer my humble appology to all who deserves to receive it. That dude just rubbed me the wrong way. Won't happen again...rest assured.
Oh yeah, by the way...I realized my mistake when I submitted that one post...The issue doesn't lie within the Wdasm as I stated...it lies within the .exe, dlls and possibly the .shl files that are incorporated with the install. I just don't recogonize the code when one directs to the other, that's all.

Thanks for the laugh naides...being as new at this as I am, you wouldn't believe the actual headaches I'm going through trying to learn this crap without any software development experience what-so-ever. I downloaded the IDA Pro Demo as you gents suggested, but it seems like I need a hard-back users manual to teach me how to understand it. If I could just understand what codes say go where, then I'd have a pretty good start at things. MAN I WANT TO LEARN HOW TO CRACK. Once I did, I'd crack my a*s off.

Later :yay:
JMI
03-25-2005, 05:12 PM
If you REALLY want to learn you simply have to accept the fact that it is NOT a quick process to learn how. You have to acquire some basic knowledge in several subjects before you will grasp what the heck you are looking at and what you are doing. A really good starting point is learning the basics of Assembly Language, not to the level that you can program in the language, but to the level that you recognize what the heck you are looking at when you see the code in a debugger or disassembler. Most of the time that view will be assembly language. If your do not recognize what the operation codes are doing with the registers and flags and such, you are in a dark hole looking up into a starry sky wondering whether there is a pattern to the heavens which you just haven't recognized. All these things take TIME. There are no really effective short cuts to spending the time it takes, however that is for YOU. Impatience is your worst enemy. It makes you try to take short cuts which hurt you in the long run.

FIRST try to learn what you are seeing and what is happening with the code, and THEN began to try to figure out how to change it to do what you want it to do.

Regards,
Bender
03-25-2005, 11:57 PM
W32Dasm could only allocate enough memory to process 368640 lines of text. The disassembly listing will not be complete and the search functions may not be successful. You can free up additional memory by closing other programs, increasing RAM/or virtual memory. Also, be sure to have at least 150MB of free space on your working drive. If you are running Win 3.1 with Win32S, please note that W32Dasm works better in Windows 95 when disassembling large files.....

This message from W32Dasm is misleading. It actually has nothing to with physical memory. The message occurs if the section containing the code doesn't have the executable attribute checked. You will need a PE Editor to change this attribute for the code section. ;)
disavowed
03-26-2005, 01:21 AM
jmi, i remember e!nstein (or something like that) had a really good crash-course on x86 and win32api for reversers. this tutorial is from several years ago, but if anyone knows what i'm talking about, it might be good to post a link to it ;)
Bengaly
03-26-2005, 07:04 AM
he mabye got the msg (seen in the first post) because w32dasm creates a tmp file (<win>\temp) and either his hdd space was low or the file was too large for the listview (not virtual listview) to handle over 32k data.
dmx
04-01-2005, 03:30 PM
use this patch. Also i have many patches (custom bug-fixes from different people) but this better. His old but cool :)
mac53
04-01-2005, 03:47 PM
dmx...

Thank you...I'll give'er a shot. :yay:
*******************************************************

Got an invalid checksum...but went ahead with'er anyway. :cool:
dmx
04-02-2005, 04:25 AM
Got an invalid checksum..
i'm to, but it's working ;)

Do yourself a favor and move up to IDA.W32Dasm is really older technology which has, for the most part, been passed by because it hasn't been updated.
Of corse ida more powerful, but by my opinion it's very slow-and for example, it cannot be used for working with big files. One time i give it some file.. i go to look cinema, and when i come back i found what ida still working... :devil: windasm32 work much more faster...
mac53
04-08-2005, 02:38 PM
dmx...

ok...I'll check aroung for it...thanks :yay:


Is there such a tool?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Is there such a tool?
PDA

View Full Version : Is there such a tool?

lazybones
03-24-2005, 07:30 PM
Is there such a tool that can help me to study 80386's protect mode????
thx.......... :loveu: :devil:
naides
03-24-2005, 07:32 PM
Google?
lazybones
03-24-2005, 09:24 PM
i mean is a software,not google!
thx.......
JMI
03-24-2005, 11:46 PM
He means search for the tool yourself, like it says in the title to the Tools of the Trade Forum:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them..

ACTUALLY READ what;s written under your signature and then read the damn FAQ, like you were supposed to do in the first place. :whoops:

Regards,
disavowed
03-25-2005, 12:31 AM
c'mon JMI... he did say :loveu:

:P
Kayaker
03-25-2005, 12:52 AM
Is there such a tool that can help me to study 80386's protect mode????
Yes, google is the tool, there is no magic involved here. The question would better be, What aspect of PM do you want to look at? Hell, Sysinternals is full of tools to explore many aspects of how the system is structured under protected mode. What are you interested in?

If you don't know exactly, then your question is much too early in your studies.


PVDasm 1.6c is Available
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > PVDasm 1.6c is Available
PDA

View Full Version : PVDasm 1.6c is Available

Bengaly
03-25-2005, 04:39 AM
Hey all,
have fun with the new release.
get it here: pvdasm.reverse-engineering.net

regards,
Ben
Ricardo Narvaja
03-25-2005, 05:40 AM
when you enter to this page user and password are required

Ricardo Narvaja
monguz
03-25-2005, 10:49 AM
Ricardo,
try this: http://pvdasm.reverse-engineering.net/PVDasm.v1.6c.zip
regards
dmx
04-01-2005, 03:10 PM
Thanks, Bengaly! I'd like this one... i'm sorry, but you are forget update some code in PVDasm: about window still show 1.06c version :)
homersux
04-01-2005, 05:30 PM
The pop window is a little bit too persistent. Maybe they can be let go after afew seconds (say 10) of mouse inactivity? Right now I need to push ESC to close it, and it comes back in about 3 seconds (this behavior needs to be changed imo, it should pop up again only if the mouse hovers back to the assembly line or make the subsequent popup a 10 seconds delay to give the user time to change line). Otherwise, great tool, thanks!
Bengaly
04-22-2005, 05:46 PM
homersux,

i will fix the annoyable window :)
btw, it pops only on Calls (non api)/Jxx instructions.

regards,
-Bengaly


Dead Links [SoftIce]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Dead Links [SoftIce]
PDA

View Full Version : Dead Links [SoftIce]

mac53
03-25-2005, 02:31 PM
I don't know if any one has posted that the link below for [exe tools] has dead links in there for many of the "SoftIce" versions. :(
I really hope that this could be fixed... :smug:
JMI
03-25-2005, 05:23 PM
Repeat the mantra after me.....

I will google to look for tools of the trade which I want to find; I will google to look for tools of the trade which I want to find; I will google to look for tools of the trade which I want to find. etc.

Now why would you want to use an old link to find an old version of a tool when newer versions of most tools are available on the net to those who learn how to search??

Besides, I have it on good authority that the Administrator of that Forum is evil and cranky and that you wouldn't want to mess with him. :devil:

Regards,
mac53
03-25-2005, 08:36 PM
repeat after me...

What's my problem...what's my problem...I may be a moderator, but ain't no GOD. :devil:
mac53
03-25-2005, 08:51 PM
JMI...

Just received a PM from a member explaining a couple of things to me. If I knew what he had told me...I wouldn't have set that post.
esther
03-25-2005, 09:45 PM
Although its off topic but you should nag yourselve in exetools forum rather than post it here.Nothing here has to do with exetools please keep in mind
disavowed
03-26-2005, 01:17 AM
don't use softice. use ollydbg or windbg. softice has zero future
TBone
03-26-2005, 12:11 PM
In some respects, I wish that were true. The problem is, softice does have a future, it just isn't a very pretty one. Compuware keeps dragging it along like some kind of shambling, muttering zombie. The whole thing is just kind of held together with tape and bubblegum because they apprently don't see any value in, you know...actually updating the friggin' code once in a decade or so. Anyway, they either need to let it live by actively developing new versions that work, or let it die. But they can't let it die because what are you going to replace it with? I'm not saying there aren't any alternatives for ring-0 debuggers, but none that really compare to softice. It's the only tool of its kind, if you can actually get it to work.

As much as I like olly, it's can't be a total replacement for softice. I'm not sure what Olleh's plans for version 2 are, but I gather that they don't involve any ring-0 debugging yet. But, it's still early in Olly's life, so maybe someday. All I'm hopin for in version 2 is that he gets all the bugs shaken out of the conditional tracing feature, and maybe some speed inreases there, too. There are a lot of things that Olly does very well, and even better than softice, really.

Maybe that new Virutech debugger (hindsight?) will be ring-0. I don't think it even goes beta until May, though :(


DLL modification
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > DLL modification
PDA

View Full Version : DLL modification

chemist
03-25-2005, 08:37 PM
Hi everyone I am just wondering how you update the contents of a compressed DLL file that is called from an executable.

I have been using Olly and usually when it comes to patching an executable you just go "copy to executable...etc" after you have made your ASM changes.

The program i am working has an executable. It calls a DLL and the serial registration routine is in there. If you open the DLL directly, it says it is compressed, encrypted or whatever and says it may not open properly. The crack is easy, simply changing a JE to a JNZ and i can do this in OLLY however there is no way to save the changes to the DLL file.

So, how do you make such a change permanent???

Regards
evlncrn8
03-26-2005, 12:14 AM
add in some code in the executable, changing the entrypoint to your code that then patches the import table of the executable rerouting the LoadLibraryA api to your own code which simply calls the LoadLibraryA, then you'll have the base address of the dll, add on the displacment to the area you want to patch, VirtualProtect it to make it read/write, apply your patch, VirtualProtect it back to read/execute (or whatever it was previously), and return, once you've applied that detour from the import, simply jmp to the original entrypoint, easiest method, cos otherwise you have to deal with unpacking the dll, fixing up relocs (which the packer probably trashed) and other madness ;)
goggles99
03-26-2005, 08:28 PM
By compressed, my guess is that you mean it is packed with something. Well just unpack it and patch it, then replace the original compressed/packed one with your "fixed up" one,

another thing you can do is find the point in the dll's DllMain where the code is finished being decompressed and place a jump there to a code cave that patches the memory address "JE to a JNZ" then jumps back.

If the dll is not loaded dynamically (using loadlibrary) it's address in memory should be static and you can create a loader to patch it on the fly.
:yay:
sigint33
03-26-2005, 08:59 PM
I know I'm pointing out what seems to be the obvious but it wasn't mentioned in the other posts, you can easily patch it sometimes even without unpacking, with a hex editor - Winhex, Hview, Hiew, etc:.
JNZ=75 xx JZ=74 xx

SiGiNT


unknown armadillo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > unknown armadillo
PDA

View Full Version : unknown armadillo

pico
03-26-2005, 08:04 PM
hi, i have here a tagret which is unknown version but difinately armadillo packed (with hardware fingerprint)..

peid0.93 tells me:

Armadillo 1.xx - 2.xx -> Silicon Realms Toolworks [Overlay]

but i dont trust that...

i read tutorial on getting version with ollydbg, but this does not work. string "armVersion>" is not found..

i use peid to get generic oep, it tells me 5a3fe5

i use a tutorial to try find oep i ollydbg but am confused on this..

i put bp on CreatThread and am told to "step out 2 calls" (whatever this means). anyway, on CreatThread, edi=12f054. i f8 all the way down till RETN 18 and end up back in module target.exe. i carry on f8 for a bit, and always edi stays the same. so maybe thats the oep?

but, i read another tutorial about "detach father from son". so i make a new bp, bp WriteProcessMemory.

well, olly breaks twice on this api before program starts. neither of the locations it breaks on have "buffer 2 bytes" pushed. so i cannot do this method :confused:

however, i notice that when the "enter your name/key" box pops up, edi is set to 12e150. so is this the real oep?

also, do i need to subtract 40000 from these to make a working oep address?

now the big questions, what to do when i have oep :thinking:

i read soooooo many tutorial i ust dont know now..

i have made a dump of the target using lordpe, but this makes an application with the message "this program has been damaged, please reinstall.."

i proceed anyway, to use imprec.. opened the target, clicked "get imports", all thunks are not valid..

so i click "iat auto search", it tell me "try rva 001CD000". now "get imports" agen, this time all not valid, except bottom 3 reference kernell32, gdi32,user32 which are yes.

so i delete bad thunks and select "kix dump". still the result is "program has been damaged.."

btw, i have tried with both set rva size to 10000 like suggest by "iat search" and also left as it was. same results..

btw2, if i change oep in imprec to one i have found then click "fix dump", when i run the target it will seem to load for maybe 5 seconds (more..) with harddrive light flashing, then i get windows error:

dumped__.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

if i click "debug", as i have VC.net installed, i get told "access violation 0xc0....5"..

can i get some help here plz?

i have searched all forums i find and many many many google pages. i have here on my desktop maybe 30 new folders with arma tutorials and tools :cry:

i worked on this for two days with little sleep :-/

br
pico
03-26-2005, 08:07 PM
plus one very basic question, what does rva stand for?
at i guess i say relative address?

no tutorials mention stuff like that. stuff i am interested to know..

thx
Woodmann
03-26-2005, 09:51 PM
Howdy,

Relative Virtual Address.

Woodmann
Pepone
03-27-2005, 04:49 AM
pico PM me target link. ;)
Ricardo Narvaja
03-27-2005, 05:01 AM
try (hardware breakpoint on execution) HE WriteProcessMemory (BP IS DETECTED IN NEW ARMAS AND DONT STOP the 3rd time)

Ricardo Narvaja
pico
03-27-2005, 07:35 AM
hi, thx for ur replies.

ok, i got it to break on WriteProcessMemory and follow the tutorial by lownoise fully.

i get problem at the end of chapter 1 though. after i make the new assemble for DebugActiveProcessStop etc and press f9, the tut says "if EAX=1 then success".

my EAX=0 :-/ :confused: :(

anyways, next chapter says "start a new olly session", will i leave old olly runing also?

i went aheads anyway with new olly window open, select "attach", choose same ID (0260). this time process was not in red

get told "unable to attach.."

i also try hardware breakpoint on the NOP but still EAX=0

ok thx
JMI
03-27-2005, 08:17 AM
Pico:

Don't add a new post every couple of minutes as you try each new thing, especially when there has been no Reply. Use the EDIT button at the bottom Right. That's what it's for.

Regards,
pico
03-27-2005, 08:26 AM
sorry jmi mate.

i have already made some edits and deleted some posts on here but i got carried away..

sorry
JMI
03-27-2005, 08:40 AM
No big deal. Just trying to save some room in the database. ;)

Regards,
disavowed
03-27-2005, 12:24 PM
Have you searched the parent process's memory for "armVersion>" after the initial unpacking is done? (If you only searched for it in the static file, you probably won't find it).

If you did search for it in memory and didn't find it, does anyone know of the latest method for determining the Armadillo version? (I haven't played with Armadillo for awhile, but I'd like to know if a new version detection method is required)
Pepone
03-27-2005, 03:06 PM
Pico: What about PM me target link ? I can't help you much until I will see that for own eyes. :D
pico
03-28-2005, 04:57 AM
ahhh pepone, your pm inbox is too full to accept new messages
Ricardo Narvaja
03-28-2005, 04:57 AM
if you are in the father process and the son is running and you are working in XP only, when you write

push (PID OF THE SON)
Call DebugActiveProcessStop

change EIP to point this push and trace with two f8, EAX is 1 if not there are some posibilities

1)You put the PID of the son bad (error in the pid)
2)You don´t use XP (only is possible detach in XP)
3)You are detaching when the son is not looping -running in bad moment
4)i make this infinite times and work in all armadillos with copymem2 from 2.x to 4.x and work perfect.

Ricardo Narvaja
pico
03-28-2005, 05:24 AM
ah ok thx richardo, now i have detached farther from son :D

now i am at this problem, i have restored the bytes which was causing JMP EIP loop then press F9. tutorial tells me:

Now that the original bytes are restored press F9 to start App. We'll fall in several exceptions but we ignore them till will see the programs splash screen.

but for this target, there is no splash screen. just a message box telling us we need key to work, and then a dialog box which is asking for name/key..

when these two things pop up, place in olly debug window does not change :(

so i cannot continue to find OEP?

i dont think this metho will work for me, as the target require key/serial to work :confused:
Ricardo Narvaja
03-28-2005, 09:43 AM
i think you have a armadillo with key, this armadillo don´t run if you don´t have a valid key, and the son is bad decrypted, the method of my tuts are only for armadillos than run, and don´t need key for run.

If you look in internet and get a valid key than run your program, you can continue with the method of the tut, if you don´t get a valid key, sorry the tut don´t help to you.

Ricardo Narvaja
pico
03-28-2005, 10:28 AM
dear richardo, i just start to read your tut on nanomites part 1 but i dont find time to read it all now.

i have valid key/name/finger print combo for this app already, but i need to change the fingerprint in ram as its not from my computer..

i have problems with this.. i download latest winhex and get keygen from emule but it tells me "invalid user.txt" when i try to change ram value..

so i get early version of winhex (11.5 i think), this is telling me the same :(

i made uninstall of latest winhex first, also deleted temp folder content..

i try to do this same thing with olly, but the strings are not found.

finally, i tried with some program, i think called qview. this find the strings in ram and let me replace. but still i am told "key not valid.."

combintaion definetly work, it is from a customer and he use the program fine.

i thikn, if i could just get it registered then dillodumper would do most the works for me :(

btw, i see mentiond that u have some tut in ur ftp. can i get the link to that plz? thx
disavowed
03-28-2005, 11:18 AM
push (PID OF THE SON)
Call DebugActiveProcessStop
...
2)You don´t use XP (only is possible detach in XP)

Actually, it's also possible to detach with Windows Server 2003.
pico
03-28-2005, 12:06 PM
hi,
well i got the prog regged using winhex 10.something. but i dont think i will be able to unpack with the methods i have readed till now, as it was packed with unlicensed version of armadillo..

so when it comes to point of getting oep using olly, i will never get to there cos the stupid "unlicensed arma" message box comes..

is there anything to be done here?

also, i have here an app called "unarm". it is only for win98, and i get told "cannot hook from xp".

source is included, and i have done some coding in asm in the past years. but what is the method this is thing is using? i maybe make it to work in xp..

the source however, is nothing like i seen before. he made a looooooooot of declarations and is using a dialog box as gui (i used windows cos i learn from master icezelion ;))

here is the project if u wish to look
http://www.picogsm.co.uk/UNARM.rar

one question about armadillo, how does the program know he is registered?

i have deleted temp entry created by arma and also any registry entry, but still program runs fine :confused:

should have had filemon/regmon running on install but i never thought :thinking:
Pepone
03-28-2005, 04:11 PM
Pico: My fault with full box, now is empty and waiting for your PM with link and key too. Btw http://www.picogsm.co.uk/UNARM.rar is down. ;)
pico
03-29-2005, 05:16 AM
sorry, my server is very annoying, everything is case sensative :|

http://www.picogsm.co.uk/UNARM.RAR
crusher
04-05-2005, 08:32 AM
yes, making it registered is the deal. I have armadillo 4.0.
still, I cannot access FATHER process memory from any program... not even with my own ring0 dumper and custom ring3 dumper injected either.

I tried to debug it but it does not VirtualProtect nothing.

where does father process install guards? I guess it cannot even read its own code section...


GenuineCheck.exe
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > GenuineCheck.exe
PDA

View Full Version : GenuineCheck.exe

naides
03-27-2005, 12:56 PM
OK. This thread is completely off topic.

This is reagarding this little program that Microsoft asks you to download and run before allowing you to Download certain new functionalities and updates. (an Anti Spyware, among others, from all things). Its function is to check that you are running a genuine copy of the WinXP OS, generates some Key that you are supposed to send back to MS web site. . .
When I ran the little contraption, my firewall could not detect any communiction it generated to the outside world, but when I disassembled it, Oh boy! its almost completely composed of TCP/IP and other network functions, which I seriously doubt are required to extract a meager activation key from your system. . .
Does anybody (perhaps people with inside information) know what is the whole story about this little program?
Sounds like institutionalized spyware to me!
babar0ga
03-27-2005, 09:42 PM
hi naides!

I downloaded that file from hxxp://download.microsoft.com/download/1/1/a/11a73739-0b11-4bf2-950f-cbd99511904c/GenuineCheck.exe
and started it. My firewall(Agnitum Outpost) reported inet activity(go.microsoft.com:80) to me and i was able to block it(hope so).
After that i looked at imports section...There are 12 API's from WININET lib.
File size is 337,672 bytes
Is it same over at your's place?
naides
03-28-2005, 07:37 AM
Yes, It is the same file.
I wonder why you did detect inet activity. Pehaps my firewall is crappy, or the app does not always send packets (phone home) when activated.
Time to do some debugging and run this app under more controlled conditions.
It will be nice to find out WTF this thing is sending to microsoft.com
lifewire
03-28-2005, 07:37 AM
Which firewall do you use, naides? (I use Kerio personal firewall, and it detects it too)
naides
03-28-2005, 08:43 AM
MxAfee Personal Firewall plus
babar0ga
03-28-2005, 11:59 AM
Seams to me it's going to hxxp://go.microsoft.com/fwlink/?LinkId=34628
which is redirected to hxxp://www.microsoft.com/downloads/sync.aspx.
It's sending nothing(at least at that stage) but receiving some "code"...

I checked it(link) with Opera and IE and both gave me the same result...
1:2b4fbbe0-b95b-7ff2-bbd9-8dcd4211787f
but last time I chcked it was different probably becuase my IP was different and/or date...
babar0ga
03-28-2005, 01:04 PM
Im sorry. My mistake...

Here is communication...

GenuineCheck.exe --> microsoft
GET /fwlink/?LinkId=34628 HTTP/1.1
Accept: */*
User-Agent: LegitCheck
Host: go.microsoft.com
Cache-Control: no-cache
Cookie: MC1=GUID=845b0a3e74ff68459a25db4a431a8610&HASH=3e0a&LV=20053&V=3

GenuineCheck.exe <-- microsoft

HTTP/1.1 302 Found
Connection: close
Date: Mon, 28 Mar 2005 18:27:37 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Location: http://www.microsoft.com/downloads/sync.aspx
Cache-Control: private
Expires: Mon, 28 Mar 2005 18:26:37 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 161

<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href='http://www.microsoft.com/downloads/sync.aspx'>here</a>.</h2>
</body></html>

GenuineCheck.exe--> microsoft

GET /downloads/sync.aspx HTTP/1.1
Accept: */*
User-Agent: LegitCheck
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: MC1=GUID=845b0a3e74ff68459a25db4a431a8610&HASH=3e0a&LV=20053&V=3
Host: www.microsoft.com

GenuineCheck.exe <-- microsoft

HTTP/1.1 200 OK
Cache-Control: public
Content-Length: 38
Content-Type: text/html; charset=utf-8
Expires: Mon, 28 Mar 2005 14:00:00 GMT
Server: Microsoft-IIS/6.0
X-AspNet-Version: 1.1.4322
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
X-Powered-By: ASP.NET
Date: Mon, 28 Mar 2005 18:27:52 GMT

1:2b4fbbe0-b95b-7ff2-bbd9-8dcd4211787f

Well, it's pretty much clear that GenuineCheck.exe IS sending something to ms at this stage...
It's MC1=GUID=845b0a3e74ff68459a25db4a431a8610&HASH=3e0a&LV=20053&V=3
After all that I checked once more with Opera that link
and received same code back: 1:2b4fbbe0-b95b-7ff2-bbd9-8dcd4211787f

So it's seams that cookie is not so important coz my opera didn't send it...

After that stage is completed GenuineCheck.exe started
communication with 131.107.97.95:443 which i blocked.
After few exceptions it tryed mpa.one.microsoft.com:443 which i also blocked.
At the end GenuineCheck.exe presented me with this code : WXPWK6D
and instructing me to validate it at their's pages.

That's all for now. Im going to debug it later this week...

Hope to hear from you guys soon...

regards
JMI
03-28-2005, 01:38 PM
Of course you could just download their Anti-Spyware off the net and skip their "GenuineCheck.exe" all together :rolleyes: , but I recognize the point was to figure out what the heck they were checking.

Besides, you all do have "Genuine" Windo$ws products, don't you? :thinking: You do know how to have M$ give you a "Genuine" authentication if you've "misplaced" yours, don't you? :idea:

Regards,
naides
03-28-2005, 02:26 PM
MS anti Spyware is not all that good JMI. I am looking at this out of curiosity. I just think it is ironic that the anti Spyware software function is to protect one's privacy from sneaky infomation exchange over the net.

This particular file did not include the 'reassuring' disclaimer: no personal information will be sent to MS server. . .
TBone
03-28-2005, 06:47 PM
Heh, if you poke around a little, you'll find the infamous WINE check. No updates for joo!
JMI
03-29-2005, 01:14 AM
"Nobody" should have thought that a program labled "GenuineCheck.exe" might actually need to check if one had "Genuine" M$ products, and that to do that, it might need to send and/or receive some information to determine one has such products. :devil:

The Anti-Spyware page has this statement:

Before obtaining the requested download, please take a moment to validate your genuine Microsoft Windows installation. Validation assures that you are running an authentic and fully-licensed copy of Windows. Validating now will enable faster access to genuine Windows downloads upon future visits to the Download Center. Please see the Why Validate? page to learn more about the Windows Genuine Advantage program and why validation is recommended.

When you select Yes below you will be guided through the short validation process. If you see a Security Warning dialog box from Microsoft, click Yes to install and run the Windows Genuine Validation tool automatically.

On the Why Validate? page:

http://www.microsoft.com/genuine/downloads/whyValidate.aspx?familyId=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displayLang=en

You will find the following:

What is genuine Windows validation?

Validation is a short process that enables you to verify that your copy of Windows is genuine. If you request a genuine Windows download from the Microsoft Download Center, you will be prompted to complete the validation process. You may choose not to validate your Windows and still obtain your requested download. However, validating now will enable faster access to the Download Center in the future when validation may be required. After successful validation, a Microsoft Windows Download Key will be stored on your system for future use. Following the validation process, you'll be returned to your original page to obtain your requested download.

How are validation and Windows activation related?

The validation process determines if you have activated your copy of Windows. If you have not activated Windows, you will be asked to enter the 25-character Product Key printed on the Certificate of Authenticity (COA) you received with your PC or software purchase. If you have already activated Windows, the validation process will sense that the PC has been activated, and will not request Product Key entry.

Will I be asked to provide personal information?

During the validation and activation processes, Microsoft does not collect any information, such as your name or email address, that can be used to identify you or contact you. These processes simply enable Microsoft to create a match between your PC's hardware profile and your 25-character Product Key (located on the COA), which we then store and check against future activation and validation attempts. We do this to ensure that your Product Key cannot be used by another person in a malicious manner, such as activating a pirated or non-genuine copy of Windows.

There is a FAQ here:

http://www.microsoft.com/genuine/downloads/FAQ.aspx?displaylang=en&FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671

So it is clear that reading the info associated with the "GenuineCheck.exe" does "include the 'reassuring' disclaimer: no personal information will be sent to MS server." It also tells you something is going to be checked (a Hardware profile hash?) and whether the OS is "Activated" and then a hash is going to be downloaded to your machine for "future use" by M$.

And now we also all know babar0ga"s "activation check" download key and can just use his. :sneaky:

Of course, now all they will have to do is figure out what to do when our hardware changes and that changes the Hardware Profile. :thinking:

Regards,
naides
03-29-2005, 05:27 AM
Hardware signatures associated with IP addresses are private, personal, identifying information, which could be used and or abused, and should not be collected without consent, or probable cause. Even under the guise of a good deed.
Is this a private infringement of the Fourth Amendment, Counselor?
JMI
03-29-2005, 09:02 AM
"Nobody" who checks with Mr. Google (or watches to much TV) could be confused about whether or not this procedure conflicts with the "Fourth Amendment" of the U.S. Constitution for at least two reasons.

The Fourth Amendment states:

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

First, the Fourth Amendment seems to apply only to "governmental" searches and seizures . Second, there is a doctrine apparently applied to those governmental searches called "implied consent."

"Fourth Amendment rights, like other constitutional rights, may be waived, and one may consent to search of his person or premises by officers who have not complied with the Amendment."

Mr. Google does not suggest that the Fourth Amendment applies to "searches" by private individuals and/or companies at all. In this instance, we do not have "governmental action" (although one could argue M$ IS bigger than the government :devil: ) and there is "express consent" for the search which apparently occurres here.

Also, it is not apparent, from babar0ga's information, that the IP is at all relevant, except maybe for the cookie he received at times. It also would not seem to be useful for the purposes of such a check, since the "hardware" might well be a laptop computer, with "genuine" software, which is mobile and more than likely to connect from different IPs at various times. If IPs were part of the "profile," such a machine would report a "different hardware profile" simply when connected from a different location, and M$'s "match between your PC's hardware profile and your 25-character Product Key" would not work as described. You would not be "validated" or able to download updates requiring "validation", except from that first IP where your original "validation" occurred. :whoops:

Regards,
naides
03-29-2005, 09:17 AM
First, the Fourth Amendment seems to apply only to "governmental" searches and seizures .
Regards,

So, as long as I am not the goverment, I can search and seize your property?
Or even prevent you form excersizing your freedom of speech and assembly?

The bill of rights protects your right to privacy from every person or agency, including the goverment, not exclusively from the goverment.
JMI
03-29-2005, 09:56 AM
Sorry, that is not correct.

The Bill of Rights only protects individuals and individual rights from the Government. Violations of "privacy" by non-governmental action is generally only a "civil" lawsuit issue. I remember newspaper accounts of people being kidnapped from other countries and brought back to the U.S. for criminal trial here. The government was permitted to convict them, despite the fact they had been "seized" without a warrant in a foreign country. I have also read about private individuals "seizing" materials "without a warrant" and turning it over to the government and such materials were allowed to be used for criminal trial against the person whose materials were "stolen".

For example, you can not charge your Boss with violating your "free speech" rights under the Constitution for firing you for exercising your "right' to tell him/her your "opinion" of their character. And you can be fired for "assemblying" around the water cooler to discuss basketball all day, instead of working.

If someone (or some company) violates your "privacy rights," you might be able to sue them in civil court, depending on where you live and what "privacy" they violated, but this is not a "right" guaranteed by the Constitution, but by State or Federal law.

But again, here you have to consent to M$'s access to your computer to do this "search" and that would probably be a problem even in a civil lawsuit. :idea:

Regards,
sigint33
03-29-2005, 11:29 AM
Implied/express consent, when entering into a contract for employment.
Only by subpoena or owner's consent give any individual the right to violate my possessions or property outside the workplace or utilize any of the information gained during that violation with out possible criminal prosecution, IE identity theft. The EULA we all never read when installing products including M$ OS's grants consent or implied consent.

SiGiNT
TBone
03-29-2005, 11:56 AM
"Nobody" should have thought that a program labled "GenuineCheck.exe" might actually need to check if one had "Genuine" M$ products, and that to do that, it might need to send and/or receive some information to determine one has such products. :devil:
Fair enough, but IIRC, the big hubub about the WINE thing was that people were trying to get updates for legitimate copies of MS Office, which they were running via WINE. They had a genuine copy of the software, they just weren't running it on MS Windows(TM)(R), which is apparently in Microsoft's big book of Things Thou Shalt Not Do.

Of course, if you "search" the box, you'll find this magical "system requirements" box, which says the program requires Windows. So, it's still stupid to get bent out of shape about it, but it's still kind of funny. If you modify the code to skip the WINE check, it works just fine under WINE. So it's not like there's actually a technical reason why the needed to check for it.
JMI
03-29-2005, 01:50 PM
http://news.zdnet.co.uk/software/linuxunix/0,39020390,39188944,00.htm

Wine maker relaxed over Microsoft's 'blockade'

ZDNet UK
February 23, 2005, 13:00 GMT

Microsoft's anti-piracy tool appears to block users who run a Windows emulator on Linux

A company that sells products based on Wine, an open source application that allows users to run Windows applications under Linux, said it isn't worried that Microsoft's anti-piracy application appears to be blocking the emulation software.

Jeremy White, chief executive at CodeWeavers, which sells Wine-based products, said this week that he wasn't worried about the issue because Microsoft would face legal action if it attempted to tie Office and Windows too tightly together.

I think people have blown it out of proportion because it's not a problem," said White. "If they [Microsoft] start saying you can only get Microsoft Office updates if you are running the Windows operating system then that would expose them to legal repercussions as they would be tying one monopoly product to another. We would be delighted if they did this -- we could sue them and become rich."

Last month Microsoft said from the middle of 2005 customers will need to verify that their copies of Windows are genuine before downloading updates and add-on tools, through a programme, called Windows Genuine Advantage (WGA). WGA uses a validation tool to check whether a particular version of Windows is genuine, which is already running on the Microsoft site.

Wine developer Ivan Leo Puoti subsequently warned on a mailing list that the WGA validation program appears to be blocking Wine. The problem affected Wine users emulating various versions of Windows, apart from Windows XP.

This appears to be a deliberate attempt to block Wine, as a Wine configuration key was found in an application used as part of the validation process, according to Puoti. "Even if this is only an initial attempt, they [Microsoft] appear to want to discriminate Wine users," said Puoti.

Web site Slashdot posted information on the this issue last week, which lead to concerned postings from some Wine users who were worried they would not be able to download updates to their licensed version of Microsoft Office.

"I don't use Wine to run Windows OS [operating system], I run it to run some (work required) Office apps and some games," said one posting. "The Office apps were purchased and presumably have rights to be updated the same as any other user of Office apps. Same with the games. But Microsoft is saying that, because I am using a valid purchased version of their software on an OS other than Windows (by using Wine) they will not allow updates from their servers."

White believes this issue shows that Microsoft is worried about Wine, which he believes is good news for his company.

"The reason we love this is because this shows that Microsoft is aware of Wine at very high levels," said White. "For us it's exciting -- it is an acknowledgement of us as a threat. Microsoft does not want the world to know how terrified of Wine they are."

White's main concern is that people who hear about this issue may think that they cannot run Microsoft Office on Linux, which would discourage people from moving to the open source operating system. "Microsoft would love it if people thought that," said White.

http://news.zdnet.co.uk/0,39020330,39189180,00.htm

Microsoft admits targeting Wine users

ZDNet UK
February 25, 2005, 12:30 GMT

The software giant has admitted specifically excluding users of the popular Windows compatibility toolkit with its update tool

Microsoft prioritised making its anti-piracy tool prevent users of Wine, an open source toolkit that allows users to run Windows applications under Linux, from downloading Windows updates, the software giant said on Friday.

A Microsoft spokesperson told ZDNet UK it made sure the validation tool used by its Windows Genuine Advantage (WGA) programme identified Wine users, so that only users are running a genuine version of Windows could download updates and add-on tools.

"As the most popular third-party translation technology in use, Wine was the first emulator to be specifically tested for via WGA," said the spokesperson. "Microsoft does not knowingly provide copyrighted Microsoft Windows OS files to users of third-party emulators or cross-platform API translation technologies such as Wine."

The spokesperson said users who are not running Windows XP or Windows 2000 natively can still download updates for Microsoft Office from the Office Update Web site.

Microsoft's public acknowledgement of Wine suggests a shift in corporate policy. Earlier this week Jeremy White, chief executive at CodeWeavers, which sells products based on Wine, said that Microsoft has until now had "a clear corporate policy to not talk about Wine".

Plus 'ca change, plus ce' la meme chose.

Regards,


Looking for Sentinel SuperPro Emulator
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Looking for Sentinel SuperPro Emulator
PDA

View Full Version : Looking for Sentinel SuperPro Emulator

barshad
03-27-2005, 11:32 PM
Hi,
I've been searching the net for the past week but cant find a sentinel superpro emulator :( . Would appreciate if someone could point a link/upload the emulator for me.

Thanks.

Barshad
korvak
03-28-2005, 09:17 AM
barshad,
i too was looking for an emulator for the sentinel superpro.... after many attempts to locate one and failing, i had to restore to creating my own. this is hardware based using microcontrollers and is not a true emulator as i am not able to emulate the Algo that it uses (i'm not smart enough, i guess). so i had to resort to a lookup table, this has to be done using an original dongle, watching the session between the dongle and the PC and storing that session. then i have to extract the part of the session that deals with the Algo and place that in the lookup table. That is if the program even uses the Algo, alot only use a simple check to see 1) if the dongle is present, 2) is there specific data in specific cells... some programmers are more interested in the application and waste little time in attempt to keep it secure from the general hacker/pirate....

note that a simple change in the program revision/update could make the emulator useless until you can create/watch another session to get the informaiton that is being requested by the changed program... this could be very time consumming and your need for the dongle emulator and what it accesses will be the driving force as to the time needed and wasted in updating your emulator to work again...

tgodd would most likely be your best source for information... that is if he answers you, he has not been around very often anymore, and he is limited to what he can tell you, do to his job and legal obligations that he falls under..

i am afraid i can not just give you the emulator/crack PCB/source code, as that will defeat the whole essence of this Forum, you have to be willing to put forth some effort to achieve your goal and LEARN... otherwise all of my headaches would be for nothing...

If you are willing to work your target, i am willing to help....

for what it is worth, i hope this helps...

i may have totally mis-read what you are looking for, assuming you know about the dongle utilities on this site at the link below, if not, here it is....
hxxp://www.woodmann.com/crackz/Dongles.htm

Korvak


Dynamic Memory Allocation Question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Dynamic Memory Allocation Question
PDA

View Full Version : Dynamic Memory Allocation Question

Rip0r
03-28-2005, 03:38 AM
I Written a trainer for Act of War: Direct Action, retrieved the memory address using 'Art Money' and managed to get the trainer working etc.... but once the game is closed down and restarted the memory address for the money in the game changes....
I presume this is because it will use alloc() or something similar to allocation memory during runtime dynamically?

is there anyway i can get my program to retrieve the address where the money is stored each time? for example would ther not be a memory address thats static, that points to the dynamic memory address?
CoDe_InSiDe
03-28-2005, 04:55 AM
Hi Rip0r,

Yes, most likely it gets some space for all those variables and saves this pointer somewhere.

Did you use some Gamehack program or something?
I hate those kind of programs, there's no fun when you use them :)
It's much more fun to find all the stuff yourself by debugging/disassembling/searching ;)
So my suggestion is: SEARCH for it yourself ;)

Regards,

CoDe_InSiDe
Rip0r
03-28-2005, 06:56 AM
lol yea its one of them GameHack programs :rolleyes:
I tryed using a debugger before, but fwooor went streight over my head.
Would prob help if i knew ASM, can grasp the basics but i never tryed learnin it.....

How would i do the Breakpoint thing on Memory Addresses using a debugger? (Ollydbg) and trace it back to where its been called??
evlncrn8
03-28-2005, 12:28 PM
without knowing asm it'll be a tad difficult as you probably wont see the woods for the trees


PAGE_GUARD protected memory
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PAGE_GUARD protected memory
PDA

View Full Version : PAGE_GUARD protected memory

0rp
03-28-2005, 02:01 PM
hi,

i'm trying to use the PAGE_GUARD flag for memoryregions to get breakpoint functionality without using a real debugging loop.

to use PAGE_GUARD exceptions, i add an exceptionhandler to the SEH-chain with the AddVectoredExceptionHandler api

this works very well and i can detect memoryaccess. the problem is, that after accessing a PAGE_GUARDed region, the PAGE_GUARD-flag will be removed from that region and to detect more accesses, PAGE_GUARD must be re-enabled. the question is how or better when.

if i enable PAGE_GUARD in my exceptionhandler, the trapping instruction will never be executable, so this wouldn't work at all.

in other words: how can i re-enable PAGE_GUARD for memoryregions?

thx
goggles99
03-28-2005, 03:42 PM
This is a good situation for the use of the trace flag. With it, you can specify a the number of instructions to execute before another exception is triggered.

I would suggest looking over this atricle.
New Vectored Exception Handling in Windows XP
by Matt Pietrek
http://msdn.microsoft.com/msdnmag/issues/01/09/hood/default.aspx

and more specifically this example (figure 2 from that article).
http://msdn.microsoft.com/msdnmag/issues/01/09/hood/figures.asp

// Set trace flag in the EFlags register so that only one
// instruction will execute before we get a STATUS_SINGLE_STEP
// (see below)
pExceptionInfo->ContextRecord->EFlags |= 0x00000100;
:D
0rp
03-29-2005, 05:16 AM
singlestepping could work
thanks for the hint :)
homersux
03-29-2005, 03:11 PM
Can you elaborate on the statement "if i enable PAGE_GUARD in my exceptionhandler, the trapping instruction will never be executable, so this wouldn't work at all.". I don't see why you cannot renable
PAGE_GUARD in the trap handler.
0rp
03-29-2005, 03:50 PM
if i reenable PAGE_GUARD in my handler and return EXCEPTION_CONTINUE_EXECUTION, the same instruction will throw a new STATUS_GUARD_PAGE_VIOLATION
[NtSC]
03-30-2005, 03:28 AM
You would need to check the length of the triggering opcode and update the EIP reg before you return back to code to avoid the same instruction triggering u again,no?
Fake51
03-30-2005, 04:20 AM
I'd say he is tracing and not debugging, hence he wouldn't want to step over the opcode but execute it.

Either use goggles suggestion, or figure out opcode length and place an int 3.

Fake
0rp
03-30-2005, 10:03 AM
does any1 has an idea, why i get a stack overflow for this code?

DWORD addr;

LONG WINAPI handler(PEXCEPTION_POINTERS ExceptionInfo)
{
if (ExceptionInfo->ExceptionRecord->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION)
{
addr = (DWORD)ExceptionInfo->ExceptionRecord->ExceptionAddress;
ExceptionInfo->ContextRecord->EFlags |= 0x00000100;
return EXCEPTION_CONTINUE_EXECUTION;
}
else if (ExceptionInfo->ExceptionRecord->ExceptionCode == STATUS_SINGLE_STEP)
{
MEMORY_BASIC_INFORMATION mbi;
DWORD oldprotect;

VirtualQuery((void *)addr, &mbi, sizeof(mbi));
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, mbi.AllocationProtect | PAGE_GUARD, &oldprotect);
return EXCEPTION_CONTINUE_EXECUTION;
}

return EXCEPTION_CONTINUE_SEARCH;
}

int main(int argc, char **args)
{
MEMORY_BASIC_INFORMATION mbi;
DWORD oldprotect, len;
BYTE *mem;

len = 100;
mem = new BYTE[len];

AddVectoredExceptionHandler(1, handler);

VirtualQuery(mem, &mbi, sizeof(mbi));
VirtualProtect(mbi.BaseAddress, mbi.RegionSize, mbi.AllocationProtect | PAGE_GUARD, &oldprotect);

mem[10] = 1234;
mem[11] = 1234;
mem[12] = 1234;

VirtualProtect(mbi.BaseAddress, mbi.RegionSize, mbi.AllocationProtect, &oldprotect);

printf("done\n");

return 0;
}

this is a very weird problem
accessing protected memory like mem[10]=1234 doesnt work
but if i fill mem with NOPs and a RET and execute this mem with a CALL, it works fine
0rp
03-30-2005, 10:54 AM
addr = (DWORD)ExceptionInfo->ExceptionRecord->ExceptionAddress;

this is wrong

instead of saving the address _where_ the exception occured, i should save the adress of the used memory
bilbo
03-30-2005, 10:54 AM
Little bug!

You want to remove the page guard protection, in your exception handler after the single step, not to put it again, isn't it?

So simply replace

..., mbi.AllocationProtect | PAGE_GUARD, ...

with

..., mbi.AllocationProtect & ~PAGE_GUARD, ...

Regards, bilbo
0rp
03-30-2005, 10:59 AM
You want to remove the page guard protection, in your exception handler after the single step, not to put it again, isn't it?

no
the page guard protection will automatically be removed by the os and i have to re-enable it if i'm interested in further accesses
disavowed
03-30-2005, 01:15 PM
I'd say he is tracing and not debugging, hence he wouldn't want to step over the opcode but execute it.
I wouldn't really recommend this, but you could do it: have your exception code emulate the instruction, then step over it. Probably crap-loads more work than you want to do, though ;)
kao
03-31-2005, 03:02 AM
Hmm... After catching SINGLE_STEP exception you should remove SINGLE_STEP flag, shouldn't you? ;)
bilbo
03-31-2005, 03:44 AM
You are right, 0rp, PAGE_GUARD is removed by O.S., and no, kao, also SINGLE_STEP is removed by O.S.

Now, the real problem is that

addr = (DWORD)ExceptionInfo->ExceptionRecord->ExceptionAddress;
is the address containing the offending opcode (the EIP contents) and not the guarded page address!

So you want to assign addr as

addr = ExceptionInfo->ExceptionRecord->ExceptionInformation[1];

Best regards, bilbo

EDIT: OOPS, I DIDN'T SEE 0rp MESSAGE #9 - YOU DID ALREADY FIND THE REASON!
0rp
03-31-2005, 07:10 AM
EDIT: OOPS, I DIDN'T SEE 0rp MESSAGE #9 - YOU DID ALREADY FIND THE REASON!

yes, but i didn't know that exception param 1 is the memaddress :)


PC Based Fortran
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > PC Based Fortran
PDA

View Full Version : PC Based Fortran

Sonny
03-28-2005, 10:08 PM
I have a 13 year old dos program written in fortran. Small group who wrote the program is out of business and cannot be contacted. Output files need to be modified along with some other changes. I do not have source code - only executable file. From someone with experience, is reverse engineering an older program like this reatively feasible? Just looking for an indiction as to how feasible this task is. Thanks, Sonny
dELTA
03-29-2005, 02:42 AM
It is indeed feasible, yes.
Sonny
03-29-2005, 12:27 PM
dELTA,

Thank you. From your reply, I gether this should be relatively straightforward.

Thank yo again.

Sonny
Peres
03-29-2005, 01:27 PM
I would be glad to take a look at this old fortran program. I never tried and reverse the output of a fortran compiler. PM me if you wish.

Peres


New remote code execution vulnerability in IDA Pro...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > New remote code execution vulnerability in IDA Pro...
PDA

View Full Version : New remote code execution vulnerability in IDA Pro...

dELTA
03-29-2005, 02:37 AM
http://www.securityfocus.com/bid/12819/discussion/

Maybe in a bunch of other tools too, as for the last IDA vulns?
disavowed
03-29-2005, 09:44 AM
Old news.

IDA 4.8 isn't affected, and a patch for 4.7 was released right after the post to Bugtraq: http://www.datarescue.com/ubb/ultimatebb.php?/topic/2/155.html
dELTA
03-29-2005, 02:03 PM
Yeah, I know, but what I found interesting was the whole bunch of tools that were found to have the same vulnerability as the last IDA vulnerability when we posted about it here before (among other, some tools written by members of this board), so I thought I'd let everyone know anyway.
disavowed
03-30-2005, 01:12 PM
ok, i forgive you :P


Two small plugins for OllyDbg...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Two small plugins for OllyDbg...
PDA

View Full Version : Two small plugins for OllyDbg...

Hero
03-30-2005, 01:27 AM
Hi all
I wrote this too small plugins for olly for the first time,perhaps be usefull then
I send them to you.
1-BreakOnLoad:I try to simulate SI's bpload in olly.it is not perfect but it works! :D
2-Memorybackup:Is used for making a backup from memoryand saving it to a file.
Perhaps there is another ways for doing it but I didn't found and write this.

sincerely yours
g0dmoney
03-30-2005, 02:58 AM
the dump tool is nice, just tested it out. havent finished unpacking this but im pretty sure it'll work just fine. Nice if ya want to just dump specific parts of memory and not the whole process. good job m8 :)

g$
blabberer
03-30-2005, 05:38 AM
nice plugins though both functionalities exist natively in ollydbg :)

for dumping you right click and select backup create backup
it will back up the whole page ( ie if you are in eip 401025 and the page starts from 401000 olly will save everything from 401000 to 401fff as
blah_00401000.mem

and in fact you can further load several backups thus produced by using load backups you can view backps instantly though i find no one using them
ever no tuts out there that use these functionalities

for bp load you can use options--> debug options--> events--> break on new modules
though with your plugin one can specify the exact module instead of breaking on every module that loads :) nice
Hero
03-30-2005, 07:18 AM
Hi blabberer

Thanks for tell me.I see myself Backup in OllyDbg,But I can't use it well.But I can't find

that break on new modules,thanks for it.:D
Next time I will search more before writing my plugin!:idea:

sincerely yours


[.AVF FILE]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > [.AVF FILE]
PDA

View Full Version : [.AVF FILE]

mac53
03-30-2005, 09:35 AM
I'm trying to reverse an old 16 bit game here and I've been at it for weeks. I have read many of the tuts that I have found and no one has hit with teaching me to [No-CD] this game. I've been following the instructions from some members of this forum, by trying to research for the answers via google, prevailing nothing. There is one particular file that lies with the HDVideo folder [insertcd.avf] that what software I have, can't do a thing with. Hiew will open it but I have no idea what offset to target, because the disassembler gives me no "string data reference" option. I believe that the no-cd issue lie within this file. Am I on the right path to solving this issue, or do I need to look in another direction?

Thank you for your time and patience with me. :yay:
bilbo
03-30-2005, 11:02 AM
The AVF extension sounds to me like a proprietary format of some video animation to prompt the user to insert the CD if it is missing, but I haven't found confirmation on google.

Try, without cd, to run the file with and without that file and see what happens...

Regards, bilbo
Peres
03-30-2005, 12:45 PM
Assuming it is a data file, you should try and look for locations from where that file is accessed in executable code. Maybe the filename is hardcoded somewhere.

Avf sounds like Audio/Video File to me, too. Also, it is in a folder named 'hdvideo', so it is a logical guess.

Peres
mac53
03-30-2005, 01:09 PM
I agree with the both of you and yes it is in a video folder...but there's a catch. I'll be back shortly with the details. Need to type it up on notepad so I can just paste it. Back shortly!!!! :yay:
**********************************************************

The game comes in a [two disc] set. Disc 1 has all the bells and whistles, where disc 2 shows only a couple of folders and a few cab files. During the installation procedure, to insert disc 2 is not an option. This is what I do. I dump disc 1 into a folder on my drive which includes doing the same for disc 2. I name both folders according to the disc's label. From the HHD I run the set up and install the game to it's default location the Program Files. Once this is done, I click on the desk-top short-cut and the game launches without the cd being the drive. Disc 2 contains two folders, cd sound and cd video...there's nothing in the cd sound folder but cd video has over 530mbs of .avf files.
After launching the game it gets to a certain point to where it says insert cd 2. I've tried tranferring the remaining avf files from cd2 over into the installed program's hd video folder, but that doesn't help. I've tried to make some changes in the game's ini file, like changing the paths of the new location of the files, but this does no good either. I used Wdasm89 and Hiew32 to make to changes,I used the nop code, but I still get the insert cd2 anyway.

bilbo suggested that I'd try to run this game by extracting this file at certain points of its function...these are the results:

Removed "insertcd.avf" from the game dump folder [before install] = "no install"

Removed "insertcd.avf" from installed game's folder [Program Files] = recived window "Game"
Unable to open file C:\Game Title\Game disc label folder[where I dumped the game from the disc]\cdvideo\insertcd.avf...I ckicked "OK" and received...MICROSOFT VISUAL C++ Runtime Library...Runtime Error!...Program:C:\Program Files\Game Title\Game Sub-Title\Game.exe...abnormal program termination.

Remove "insertcd.avf" from both the dump folder and the program folder and the game crashes.

These are the results...I'm still going to investigate further, but any help da_n sure would be appreciated.
Woodmann
03-30-2005, 06:10 PM
Howdy,

Lets try a cd emulator program.

Woodmann
mac53
03-31-2005, 06:46 AM
Howdy Woodmann...

I don't want any Virtual Drives...that's just a form of quitting.
bilbo
03-31-2005, 08:21 AM
I don't want any Virtual Drives...that's just a form of quitting. eh eh, rather coriaceous these old dudes (I'm speaking for myself)...

Well, if I were you - since I do not know nothing about 16-bits (and we also need to find out if the OS is a pure DOS or Windows 16) I would grab a No-CD patch (search for "N**** D***"" + "no cd", with the quotes - is correct my guess about the game?) - I am sure you will find it! - and I would study the differences before and after the "maquillage".

Best regards, bilbo
mac53
03-31-2005, 09:10 AM
bilbo...

I did look for it, that was one of the very first things that I did. Not finding it was the reason I had decided to research the possibilities of my learning how to do it myself. I'm sure most if not all of the newer games are a little easer to debug. It's just that this da_n 16 bitter has me on a mission. Do you know...I never thought about the possibility of this thing being an DOS game though! Thanks buddy. ;)


A hell of a reverse engineering project
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > A hell of a reverse engineering project
PDA

View Full Version : A hell of a reverse engineering project

disavowed
03-31-2005, 12:44 AM
These three guys added multiplayer support to GTA3: http://osdir.com/Article4775.phtml
bilbo
03-31-2005, 04:33 AM
It's amazing! And it's amazing also the fact that Rockstar Games "has a policy of permitting fan-produced projects like it, so long as they are not made for profit"!.

Unfortunately the project is not Open Source as it initially seemed to be, but they will release anyway an SDK for further plugins.

Regards, bilbo
Polaris
03-31-2005, 12:34 PM
It's amazing! And it's amazing also the fact that Rockstar Games "has a policy of permitting fan-produced projects like it, so long as they are not made for profit"!.

Unfortunately the project is not Open Source as it initially seemed to be, but they will release anyway an SDK for further plugins.

Regards, bilbo

Well, making the project open source would mean releasing the game's sources... And Rockstar Games would not have permitted that.

However, I really respect those guys, they did a really good job. :yay:
lifewire
04-01-2005, 02:31 AM
Well, making the project open source would mean releasing the game's sources...

Well, i don't really think so. Ofcourse they didn't reverse engineer and restore 100% of the source, they "just" hook and hack new code into the existing binaries, if i read it correctly.

Still an amazing and advanced job though ;)
Polaris
04-01-2005, 03:56 AM
Well, i don't really think so. Ofcourse they didn't reverse engineer and restore 100% of the source, they "just" hook and hack new code into the existing binaries, if i read it correctly.

Still an amazing and advanced job though ;)

Their injection seems to be too much well made and designed... I really think that they investigated in depth the internals of the game... And I don't think that any company would like to see their "knowledge" spread around... Otherwise they'll directly given sources along with binary.

But, however, I hope to see many projects like this, and maybe even some well written tutorial about them... :yay: :yay:
Uradox
04-01-2005, 05:28 AM
I attualy used to play this hack a fair bit around this time last year. At that time it was a looot better than it was that same time the year before. They have done some serious alterations to the game to add that support. There is defantly a lot of RE work behind the scenes that the developers/hackers/whateverucallthem have done.
They even had cool stun maps where you try and do synchronized jumping out of a office building with a firetruck, a bike with a bikini girl on - and sometimes someone recording it to a avi for later laffs. It was great fun.
Feel like installing GTA3 and giving it a go again now :)
bilbo
04-01-2005, 06:36 AM
But, however, I hope to see many projects like this, and maybe even some well written tutorial about them...

I like to mention, by the way, www.scummvm.org...
They (34 developers) are very active (last release: 28 march 2005) and are releasing, truly OPEN SOURCE, not just an injection module but the whole interpreter for the SCUMM language. The project started with a complete reverse engineering of 16-bit LucasArt games...

And there are more engine clones (see their Links page).
Best regards, bilbo
disavowed
04-04-2005, 10:58 PM
I like to mention, by the way, www.scummvm.org (http://www.scummvm.org)...
The project started with a complete reverse engineering of 16-bit LucasArt games...
dott 0wn3d
cronos
04-10-2005, 11:21 AM
In terms of reversing projects you might want to check out d2jsp which added a full javascript scripting engine to d2lod and enabled people to write bots, etc for d2lod. In fact the javascript engine they use is from mozilla.
bilbo
04-11-2005, 08:33 AM
In terms of reversing projects you might want to check out d2jsp which added a full javascript scripting engine to d2lod and enabled people to write bots, etc for d2lod. In fact the javascript engine they use is from mozilla.
It looks like they reversed the net protocol, not the game...
Anyway, I find also this project amazing, especially the fact that they can make money from a copyrighted game and an Open Source Engine :devil:

Regards, bilbo
cronos
04-11-2005, 10:07 AM
Actually they have reversed large parts of the game itself for d2jsp - game structs are available for javascript scripts to read and write. They have spent a lot of time reversing things like the mapping and writing pathing algorithms to traverse maps. Some of the notable hooks are on the networking side and I think a lot of previous d2lod hacks were simply intercepting packets and faking packets but d2jsp has come a long way since then.

Of course it used to be free as well.........


BinDiff in IDA Pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > BinDiff in IDA Pro
PDA

View Full Version : BinDiff in IDA Pro

netsniper
03-31-2005, 12:56 AM
I would like to compare two very similar binary executable files, but I am having a problem with BinDiff, the plugin for IDA Pro. Basically, every time I try to compare the two binaries, I am beiing asked for a *.sig file, which has never been created before, and thus, the comparison of the binaries will fail if I cannot locate this file. I don't understand why it is asking me for a sig fule, since the BinDiff docs show that it is not supposed to be necessary (analysis of Bagel/W versus Bagel/X).

Does anyone here have experience with BinDiff? I am using thr trial version for now with IDA Pro 4.7 -- but I don't believe that is a problem. Please let me know if any of you have experience with BinDiff before...thanks!

netsniper
Polaris
03-31-2005, 01:56 AM
I suppose that this is the limitation of the demo version ;)
If I recall correctly there are no other things that prevent you from using the version without problems.
netsniper
03-31-2005, 02:27 AM
I suppose that this is the limitation of the demo version ;)
If I recall correctly there are no other things that prevent you from using the version without problems.

Hrmm, so are the *.sig files not needed in the retail version? And isn't this demo useless if I don't have a sig file? How can I analyze the two binaries to determine if BinDIff is worth the money??!?!

netsniper
disavowed
03-31-2005, 09:23 AM
My understanding is that the BinDiff demo only allows you to diff the two .exes that come with the demo. The licensed version allows you to diff any files.
naides
03-31-2005, 09:31 AM
The Demo version is missing the code that Generates the *.sig files. Without it the app is very much usless except with the demo files to which they provide a ready made .sig file
netsniper
03-31-2005, 10:00 AM
The Demo version is missing the code that Generates the *.sig files. Without it the app is very much usless except with the demo files to which they provide a ready made .sig file

I am going to buy this software...

netsniper
Rackmount
04-01-2005, 09:18 AM
You can get the version that generates the sig file from SABRE security. Now please pay me money to my p4yp4l account. :devil:

Rackmount
JMI
04-01-2005, 10:55 AM
netsniper:

Do NOT ask again on these Forums where to find a cracked version of commercial software. :whoops: :boo:

Regards,
dmx
04-02-2005, 10:00 AM
hxxp://www.sabre-security.com/products/bindiff.html
intresting.. commercial plugin for commercial app... and it's price more what personal version of ida..
Single User License: 800 EU
seem's to people who making it, live in madhouse... :-)


PE packer identification and Anti-Ollydbg
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > PE packer identification and Anti-Ollydbg
PDA

View Full Version : PE packer identification and Anti-Ollydbg

netsniper
03-31-2005, 03:54 AM
I am going to try and unpack an unkown packed PE and crack the anti-ollydbg functions...

netsniper
JMI
03-31-2005, 06:28 AM
Read this Thread, particularily my initial comments about searching these Forums for information about detection of debuggers, and Olly in particular:

http://www.woodmann.com/forum/showthread.php?t=6455

That is, afterall, what our Rules require and what we initially have written under the signature of every new poster.

Regards,


No Oldie: How to hide Regmon?!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > No Oldie: How to hide Regmon?!
PDA

View Full Version : No Oldie: How to hide Regmon?!

laola
03-31-2005, 05:40 AM
First of all, please take the time to read my post before flaming, thanks :)

I have a target which is protected with a newer version of Pr*tectCD (Version 5, Build 1042). I tried to track down the blacklists and to do so, I had to patch Regmon so that my target won't detect it and exit with some complaint about a debugger running. However, this turned out to be some rather difficult thing!

I searched on the forum and via google and came up with basically two methods of detecting regmon: The window class and the process name. So I started patching...

I did the following:

- renamed regmon.exe
- patched every occurrence of strings containing "regmon" or similar
- patched the device driver (stored in a binary resource and extracted/loaded at runtime), fixed the PE header checksum for the driver, patched the symbolic device name the driver registers
- patched the version info for device driver and regmon.exe
- patched the window class regmon registers
- patched the mutex the driver creates

And still, Pr*tect can detect my regmon! At present, I am out of ideas what to patch next. My hope is that somebody here has already encountered a similar situation and can give me some tips on this matter.

I admit, I am a newbie, and Pr*tectCD is a rather tough target, I fear I am not smart enough to examine Pr*tectCD itself, so I thought I should stick to the blacklists first :)

Btw, I am using Regmon 6.0.12 (downloaded a few days ago from Sysinternals, so it should be current).

Sidenote: Regmon calculates two random numbers to create the window class for registering it, but fails to seed the random number generator, so it always creates the same window class ;) I found code making use of this so I patched this problem as well, but to no avail (as I mentioned before)...

So at present I am almost back to field one and looking for some input on what to try next.
naides
03-31-2005, 05:58 AM
How feasible is to find/modify/deactivate the regmon DETECTION code in Pr*tectCD app itself instead of modifying regmon?
laola
03-31-2005, 06:24 AM
From what I read about Pr*tectCD and considering me (rather green) skills... not really an option :) That's why I opted to have a look at the blacklists first. I am reading as much as I can and try to learn from everything I read, however, rome wasn't built in a day ;)
I couldn't find much information about newer Pr*tectCD versions anyway, so I guess I'll have to build up generic skills first, before I can successfully examine Pr*tectCD.
JMI
03-31-2005, 06:37 AM
Since you recognize that Rome wasn't built in a day, you would be correct to recognize that reversing skills are also the result of some entended study of the basics of the process. If you do not yet have the assembly language skills to find the code in the protection which is detecting your debugger, that might be a good place to focus your attention at the moment.

Consider that after the detection of a "debugger" (in this case only Regmon) the code (as you describe it) is sending you to an error message. That error message has to be in the code somewhere and the call to that message has to come from somewhere. Maybe this suggests something which can permit you to look at the code besides with a debugger. Maybe IDA could show you some of the code which is being executed and the processes which lead to the message about "detection" of a debugger. Maybe it will also show you the "strings' contained in the program and where they are called from.

Regards,
laola
03-31-2005, 06:46 AM
From what I see in IDA, my target is heavily wrapped and encrypted. There are only two different error messages, and Pr*tectCD always walks through the whole examination process before it complains (or launches the protected target), which makes back-tracking quite difficult. Static analysis won't help much, so I guess I will have to take my SoftICE and patch it to the hilt against detection and try again :)
Thanks for the suggestions. I know that nobody will do *my* work, but I hoped that I could pick up some extra knowledge from all the skilled people here. (I'll spare you the part about re-inventing the wheel etc. ;) )
I'll keep you updated about my findings.
naides
03-31-2005, 06:53 AM
I searched on the forum and via google and came up with basically two methods of detecting regmon: The window class and the process name. So I started patching...

I did the following:

- renamed regmon.exe
- patched every occurrence of strings containing "regmon" or similar
- patched the device driver (stored in a binary resource and extracted/loaded at runtime), fixed the PE header checksum for the driver, patched the symbolic device name the driver registers
- patched the version info for device driver and regmon.exe
- patched the window class regmon registers
- patched the mutex the driver creates

And still, Pr*tect can detect my regmon! At present, I am out of ideas what to patch next.

1. You are not all that green, you serarched info about the problem and did a heluvalot of patching. . .

Another possiblity to explore: there are other programs that have similar functionality to Regmon but are not regmon. Perhaps Pr*tectCD is wired specifically for REgmon, and other apps may go below the radar.
laola
03-31-2005, 07:12 AM
Naides: Thanks for the compliment :) I'll try to find some alternative for Regmon. BTW, one thing I forgot to mention: Regmon installs a driver at runtime to hook the respective registry APIs, the existence of this driver seems to be harmless. So I went on and patched EB FE at the entrypoint of regmon, launched it and tried once more. No debugger alert again!
My conclusion was that it has to have something to do with any action that Regmon does... Maybe this does ring a bell?
Fake51
03-31-2005, 07:54 AM
I remember a long time ago seeing a good "debugger detection" piece of code. I can't remember what exactly was being detected (softice or regmon or filemon or whatever), but the approach is what was interesting:
The idea is to look thru the drivers loaded, and scan the first bytes of each, looking for a pattern. Since you had some luck regmon, the protection just might be looking for the presence of specific code in memory, or the presence of a given driver.
If you want to try looking for this, either change the name of the driver, or change some of the driver code (the startup part, likely).
Just a suggestion.

Fake
laola
03-31-2005, 08:06 AM
Fake51: thanks for the suggestion. As it seems, Pr*tectCD does enumerate the drivers (using NtQuerySystemInformation resp. the kernel variant ZwQuerySystemInformation using the value SystemModuleInformation), and I had changed the driver name to counter that. What I didn't try yet is changing the startup part of the driver :)
Another thing that might be done by Pr*tectCD is checking existing hooks on Ring0. This would be pretty difficult to neutralize :( I hope it doesn't do that *g*
Kayaker
03-31-2005, 12:22 PM
Another thing that might be done by Pr*tectCD is checking existing hooks on Ring0. This would be pretty difficult to neutralize :( I hope it doesn't do that *g*
Hi

That's quite possible/likely. It's fairly easy to detect the ServiceDescriptorTable hooks Regmon uses, as illustrated by KProcCheck by SIG^2 (www.security.org.sg):

C:\KProcCheck>kproccheck -t

Checks SDT for Hooked Native APIs

KeServiceDescriptorTable 805492C0
KeServiceDescriptorTable.ServiceTable 804FE1C8
KeServiceDescriptorTable.ServiceLimit 284

ZwClose 19 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC3206]
ZwCreateKey 29 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC306A]
ZwDeleteKey 3F \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC3385]
ZwDeleteValueKey 41 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC3427]
ZwEnumerateKey 47 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC36B3]
ZwEnumerateValueKey 49 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC3963]
ZwFlushKey 4F \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC32DC]
ZwLoadKey 62 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC3C0C]
ZwOpenKey 77 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC2EB6]
ZwQueryKey A0 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC378D]
ZwQueryValueKey B1 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC3A81]
ZwSetValueKey F7 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC3521]
ZwUnloadKey 107 \??\C:\WINDOWS\System32\Drivers\REGSYS.SYS [F7AC3DCB]

Number of Service Table entries hooked = 13

Hiding would likely involve hooking the hookers or faking the ServiceDescriptorTable, I suspect an elegant solution has been demonstrated somewhere... ;)

Kayaker
Opcode
03-31-2005, 05:50 PM
Hi,

To make sure that Pr*tectCD is detecting the Regmon hooks,
try to unhook the kernel by using the sdtrestore tool
described in
http://www.security.org.sg/code/sdtrestore.html
and see how the application will behave.

And post to us the results.

After this, maybe we need try to hide the regmon driver from
the ZwQuerySystemInformation function :idea:

Regards,
Opcode
laola
04-01-2005, 07:50 AM
Hi,

To make sure that Pr*tectCD is detecting the Regmon hooks,
try to unhook the kernel by using the sdtrestore tool

Obviously, Pr*tectCD does something else. I ran my patched regmon.exe, ran sdtrestore, verified that no sdt hooks were detected anymore with KProcCheck and finally ran my target. To my surprise, it complained about a debugger again.

So I guess we are back to putting loops in regmon.exe and try up to where my target will not complain, right?
I changed the driver name to something completely different and SystemModuleInformation output indicates my changes were successful ;)
Opcode
04-01-2005, 08:01 AM
Hi!

Oops. Even without hooks? :eek:
Maybe you should try to hide the
regmon driver from the Object Directory
using the valerino technique:
http://www.rootkit.com/newsread.php?newsid=209

Stupid question:
Do you have another debugger installed?
laola
04-01-2005, 08:10 AM
Yes, even without hooks :) KProcCheck indicates zero hooked functions.
And no, there is currently no debugger installed on my test system (for good reasons, hehe). I will have a look at the link you posted and post my findings ASAP :)
Polaris
04-01-2005, 09:12 AM
This thread is becoming really interesting.

:idea: I propose that moderators move this to the TOT board or even better to the mini project area with the goal of making regmon undetectable.

:yay:
laola
04-01-2005, 09:48 AM
Maybe you should try to hide the
regmon driver from the Object Directory
using the valerino technique:
http://www.rootkit.com/newsread.php?newsid=209

Doh, looks like Ring0 code to me. I don't have a dummy driver skeleton at hand to try that code right now, so this will take some time.

Meanwhile I put another endless loop in the middle of the message processing loop in WinMain() so that it stops after the window appears, and voila, Pr*tectCD complains about a debugger. Maybe it is something connected to the main window of regmon? I'll investigate a bit further on this :)

Update:
Pr*tectCD's Regmon detection is defeated, finally. In the end, it turned out that there is a certain signature string in regmon.exe which I overlooked. So after doing sort of a "total conversion" of all ansi and unicode strings in the exe and driver parts (and fixing the driver checksum) it is now working.
Thanks for all the valuable contribution and tips!

P.S. My next tool patching project will be Filemon. I am curious whether the same approach will work there as well. I will post my findings soon!
Opcode
04-01-2005, 06:25 PM
In the end, it turned out that there is a certain signature string in regmon.exe which I overlooked. So after doing sort of a "total conversion" of all ansi and unicode strings in the exe and driver parts (and fixing the driver checksum) it is now working.

Post more details about this signature string.

Regards,
Opcode
JMI
04-01-2005, 07:10 PM
Alright now folks... PAY ATTENTION:

You have an identified Target posted in this Thread. That means NO TARGET SPECIFIC CODE may be posted in this Thread.

I'm not suggesting that the string which is searched for by the Target may not be posted, I am saying that NO CODE which identifies WHERE the Target looks for that string may be posted here. We still have not changed the Rule which prohibits the posting of Target specific Code in these Fprums.

It may be somewhat close to the line here, because preventing the "protection" from recognizing regmon may not, of itself, constitute a "crack" of the protection, but nevertheless, it would violate our current Rules to post the location of the check. If the string from regmon which is detected is posted, that alone should permit others to edit their versions in a manner which prevents detection from this system, but posting it will also likely result in an "update" of the protection to circumvent the circumvention.

Our Rules do permit that the "Target specific" information about the check may be circulated by PM. :idea:

Regards,
Opcode
04-01-2005, 07:44 PM
No problem :D

This discussion is dead to me.

Regards,
Opcode
JMI
04-01-2005, 08:09 PM
The "warning" was intended to be "cautionary" and not "punitive." It is simply to outline what may and what may not be posted "publically." That does NOT mean the "discussion" needs or should end, only that it follow the Rules. :yay: I also am curious as to which string it was identifying. :confused: ;)

Regards,
Opcode
04-01-2005, 08:32 PM
Hi JMI,

It's everthing ok! :yay:
I just don't want to break any rule
of this very cool forum :D

Regards,
Opcode
laola
04-01-2005, 11:19 PM
I am fully aware of all these issues, I am not so naive to think that nobody "from the other side" may be reading this forum :D
The signature however is a plain ascii string and easy to find. I don't know why I overlooked it initially :D
I have to admit, I am glad that it turned out to be that easy, I know of protections using the method KProcCheck demonstrates. I wouldn't know how to fake an SDT for circumventing such, except for setting up an appropriate exception handler and setting the guard page flag for the memory range where the SDT is located. This may, however, have serious impact on system performance und stability :)


interesting time based debugger detection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > interesting time based debugger detection
PDA

View Full Version : interesting time based debugger detection

LiSa
04-01-2005, 03:28 AM
hello,

I found an interesting debugger detection wich use the pseudo random generator of
irvinelib : random32(seed). It is looking like :

time1 := keGetSystemTime()
/ / little stuff
time2 := keGetSystemTime()

value1 := random32(time2) xor random32(time2) mod 5 * time1
/ /
later

number = complexfunction (value1) mod 3

if number =0 ou 1 -> BAD
if number =2 OK

I ripped part of code and make a small prg to test this,the results are the following :

If time 2 - time1 < 5 ms will return 2
If time 2 - time1 > 5 ms will return 0 or 1

So this program is indeed monitoring iteself the performance of a pseudonumber generation,
if debugged this is somewhat altered and you are detected.

I fake this by patching time1 and constraining time2=time1+2 (very fast computer...;)

Have someone already seen such a stuff and what is the mathematical backgound behind that?

Thanks.
naides
04-01-2005, 07:08 AM
I have a question: If you call random32 two times WITH THE SAME SEED, would not it return the same number both times? then

value1 := random32(time2) xor random32(time2) mod 5 * time1

equals

value1 := 32bitconst xor 32bitconst mod 5 * time1

value1 := 0 mod 5 * time1

value 1:= 0 Always (??)

/ /
l

Or am I wrong?
LiSa
04-01-2005, 09:13 AM
I made a little mistake,

value1 := random32(time2) xor (time1 mod 5 * time1)

thank you
nikolatesla20
04-01-2005, 10:16 AM
I know SoftDefender uses this trick, as well as a host of other nice ones.

-nt20
naides
04-01-2005, 10:44 AM
value1 := random32(time2) xor (time1 mod 5 * time1)
thank you

OK now I understand a little better.

What you have determined so far using a black-box/experimental approach (which is perfectly valid, by the way)
is that the program is using a convoluted and obfuscated way to evaluate a simple question: What is the lapse time difference between time2 and time1?

The program brackets a critical stretch of code with the two keGetSystemTime() calls and later figures out how apart they were, effectively detecting realtime tracing.

They obscure the comparison with the random32 function but once you learn the inner workings of random32 generation, is not more difficult to detect and neutralize than seeing code directly compare time1 and time2 and generating a badboy call if the difference is more than five miliseconds.

I think you did a great job locating and dissecting this tracing detection device.


Unpacking some packers VIII
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Unpacking some packers VIII
PDA

View Full Version : Unpacking some packers VIII

DeAtH HaS cOMe
04-01-2005, 06:45 AM
Hi all, here becomes a new tutorial!
http://www.ech2004.net/tutoriales/Desempacado%20de%20packers%20varios%20VIII%20(por%20DeAtH).rar
The packers are:
DotFix FakeSinger, WinKript, Stone's PE-ExeEncrypter, VGCrypt

I hope it was helpful
Ciao!
Ricardo Narvaja
04-01-2005, 04:17 PM
Very happy you return to write tuts, you are greath DEATH.

Ricardo Narvaja
disavowed
04-04-2005, 11:09 PM
Seems like you have to use http://www.ech2004.net/tutoriales/ (http://www.ech2004.net/tutoriales/) as the HTTP Referer :\


How to determine what Specific API calls do
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How to determine what Specific API calls do
PDA

View Full Version : How to determine what Specific API calls do

ShCiPwA
04-01-2005, 10:13 AM
Hi, I am currently working on my first cracking / Reverse Eng project. And i think i am jumping into the deep end a bit, but have picked up a HUGE amount in the last week. I am trying to derive the formula for a challenge / response auth code for an online program, and need to copy the algorithm from the decompiled ASM code to insert into an imitation version of the program. so far I have figured out where the challenge manipulation starts, and now need to find out what a bunch of API calls actually do. I am pretty sure i am looking in the right spot as the API calls look alot like string manipulation, but the definitions that IDA come up with are very ambiguous

for example

extrn __imp_??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z:dword

is the first one, can someone tell me what i am looking at, and where i can find a reference of what it does,

By the way, it is imported from MSVC6

Thanks, ShCiPwA
nikolatesla20
04-01-2005, 10:19 AM
basic_string is an STL class the you can use to handle strings, it creates memory space for the string, and takes care of when you add two strings, etc. Look up the docs for <string> to find out more about how it works, and from there you should be able to find what you are looking for (the memory where the string is, etc)

By the way the weird names you see are called "mangling", and that's how the linker knows for example which function to link to. For example in C++ you can have two functions of the same name but different arguments or different return values. The compiler adds characters to the name when creating the symbol table, the characters represent the argument types, number of args, etc, and creates the mangled name you see. This way the linker knows which function to link to between functions that have the same names in your code.

-nt20
blabberer
04-02-2005, 12:21 PM
there are lot of c++ demanglers out there

your string will be demangled like this

??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z

class std::basic_string<char,struct std::char_traits<char>,class std::allocator<
char> > __cdecl std::operator+(class std::basic_string<char,struct std::char_tr
aits<char>,class std::allocator<char> > const &,class std::basic_string<char,str
uct std::char_traits<char>,class std::allocator<char> > const &)
Polaris
04-02-2005, 12:35 PM
I am pretty sure i am looking in the right spot as the API calls look alot like string manipulation, but the definitions that IDA come up with are very ambiguous

for example

extrn __imp_??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z:dword

is the first one, can someone tell me what i am looking at, and where i can find a reference of what it does

In IDA, just go to Options->Demangled Names and select "Show as names"... This will allow to see names in a human understandable way.

To know what these functions do... well, just google! :devil: :devil:
JMI
04-02-2005, 12:52 PM
Oh NO, not searching! :eek: Who'd have thunk it. :idea: ;)

Regards,


Amazing new searching tool!
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Amazing new searching tool!
PDA

View Full Version : Amazing new searching tool!

TBone
04-01-2005, 11:23 AM
http://www.google.com/googlegulp/

:P
JMI
04-01-2005, 12:14 PM
I'll drink to that. :idea:

Regards,
dmx
04-02-2005, 05:56 AM
http://www.google.com/bsd :loveu:


Strange Reaction In Program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Strange Reaction In Program
PDA

View Full Version : Strange Reaction In Program

ecks
04-01-2005, 05:11 PM
im trying to crack an app so that it will accept any registration key i enter and iv been able to isolate the bytes i need to change and when i test it in my debugger it works fine and excepts any reg code i enter.

the weird thing is, when i open it with my Hex editor then and change the bytes and then re-launch the app it just quits before even displaying a window.

I have an IsDebugPresent plugin to hide my debugger (OllyDbg) and im not sure why it works when i test it in my debugger but not when i hex it... so any ideas of stuff i should look for?

thnx for any help
_Ecks :(
homersux
04-01-2005, 05:22 PM
the weird thing is, when i open it with my Hex editor then and change the bytes and then re-launch the app it just quits before even displaying a window.
_Ecks :(

This usually happens when the app has another registration check at
the initialization phase. You need to trace into the app and see what
it does after it accepts fake registration code. Or you can look for similar
code pattern as the registration code check routine. It's highly likely
that the reg code check routine is called multiple times, so you can also
look for "CALL 00423b7D" (for example) in your disassembler.
naides
04-01-2005, 06:17 PM
the weird thing is, when i open it with my Hex editor then and change the bytes and then re-launch the app it just quits before even displaying a window.

_Ecks :(

Another posiblility is that the application checks for the integrity of the file you modifyied early during the start process:

When you do the changes with the debugger, the check has already occurred and passed , so it is OK, but when you modif the exe file with your hex editor the app catches the change and quits on you.
Search for crc checks in this board and in google, also look for program exit APIs like PostQuitMessage and the like. . .
ecks
04-01-2005, 11:26 PM
iv looked around and understand more about the crc checks now but cant locate one in my target file....

iv searched for CreateFile apis and ExitProcess and so fourth but i have no idea were the routine is, so is there any tips or ideas for things i should look for?

(this is only my second app i'v ever cracked on my own so bare with me ;P)
Fake51
04-02-2005, 02:31 AM
When doing an integrity check on the file, there's two options (not excluding ones):
- you can check the file on disk
- you can check the loaded file

Per the first, you should look for functions that open and read the file. There's quite a few, so you'll have to do some searching. However, if the file you're working on is not packed or encrypted (it would seem not, since you can patch it), disassemble with Ida or w32dasm and look for suspects.

Per the second, try and put a memory breakpoint on the place for the patch. If the file is doing an integrity check on itself in mem, it should trigger a memory breakpoint.

If both of these fail, I'd recommend taking Homersux' advice and go looking for another place of serialcheck.

Fake


ProcessSpy
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > ProcessSpy
PDA

View Full Version : ProcessSpy

homersux
04-01-2005, 05:35 PM
This is a little tool I created to help me investigate naughty programs that are very paranoid about memory space being invaded or debuggers being present. Both executible and source are included. The source code is a mass as I am not so good at win32 gui programming but it's usable.
homersux
04-01-2005, 05:43 PM
The enclosed file has the necessary dlls. They are pretty handy for other tasks.
blabberer
04-03-2005, 03:18 AM
24 and 16 downloads and not one complaint ??
is it only me for whom these zips get downloaded corrupted ?? :(
i tried yesterday when it was 2,3 download it was corrupt
i try again today it still turns out corrupt :(
can some one confirm ??
CoDe_InSiDe
04-03-2005, 03:28 AM
Hi blabberer,

can some one confirm ??

I confirm, they are corrupt... :)

Regards,

CoDe_InSiDe
TQN
04-03-2005, 07:05 AM
Use WinRAR to unzip them.
hosiminh
04-03-2005, 09:59 AM
It's rar although it has zip suffix . Use hex editor to see it yourself :idea:
CoDe_InSiDe
04-03-2005, 11:20 AM
Hmm, renaming them to .RAR worked indeed :)
But why do they have .ZIP extensions while they are .RAR's?

Regards,

CoDe_InSiDe
doug
04-03-2005, 11:38 AM
The list of Valid file extensions: bmp doc gif jpe jpeg jpg pdf png psd txt zip
CoDe_InSiDe
04-03-2005, 12:15 PM
The list of Valid file extensions: bmp doc gif jpe jpeg jpg pdf png psd txt zip

Aha, I'll keep that in mind the next time ;)

Regards,

CoDe_InSiDe
homersux
04-04-2005, 12:13 AM
Doug posted the exact reason why they are named .zip files. :)
JMI
04-04-2005, 12:31 AM
However, homersux, it would have been useful if you had notified members with your first post that the "zip" files should be renamed to "rar" to unpack. Would also have saved six additional posts added to the database. :idea:

Regards,


Question about Nag's
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Mini Project Area > Question about Nag's
PDA

View Full Version : Question about Nag's

dmx
04-02-2005, 04:09 AM
Good day. I found one intresting crackme. It using some function that calling nag.. I want patch it.. but don't know how.. after pathing always got error...
see this function making nag...
00426583 CALL CreateWindowExA ;(when class name-TMessageForm)
but i tired look for correct call before this or somfind like that...
My solution is something similar to loader.. i don't like this way..:whoops:
Maibe you know-after window created - it using something for showing or no?
Any idea?
TQN
04-02-2005, 08:24 PM
This crackme was written in Delphi 4. At 004431A6, it call Dialogs::ShowMessage(string s) to show the nag message box. So, you can nop this call to turn off the nag.
Regards,
haule_nth
04-03-2005, 12:46 AM
ok only NOP the CALL before it can be called
dmx
04-03-2005, 09:15 AM
Of course! Thanks! I'm forget make 2 thing's..
also you can look at 441821...it's to can be useful to :-)


Cracking a trial - Time Up dialog text is not in stringdata
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Cracking a trial - Time Up dialog text is not in stringdata
PDA

View Full Version : Cracking a trial - Time Up dialog text is not in stringdata

nog_lorp
04-02-2005, 01:33 PM
I am trying to crack a TimeTrial. I have removed CRC and several other checks, and it is now functional so long as I move my clock back.

When the time runs out, I get the message "The time limit for this evaluation has expired.", followed by another message (too app-specific to post).

I have searched quite a bit, and W32DASM does not show this text in any of the References, or anywhere in the disassembly. But when simply open the dll with notepad, and search, it is there. According to "ResEdit", it is in RC Data, 1000(1033).

Any information about how to find references to this would be great.

Thanks,
~nog_lorp
( :) )
dmx
04-02-2005, 03:13 PM
Think more...what code can be used for generate this window? what function can get SystemTime for example?
Admiral
04-02-2005, 04:53 PM
If you can get the target exe to run when you set the clock back, try to create logs of both successful and unsuccessful exectutions & compare them. I like to use SmartCheck for this:

Tell SmartCheck (if you have it) to log all API calls & run until the app complains about your registration, stop logging and keep the window up. Open up a new instance of SmartCheck and do the same with your clock set backwards. Now it's a matter of comparing the API-call logs to find the point where the results differ (you may want to Page-Down it if the logs are short, or perhaps code a binary comparer if the exported dumps are unworkable). Once you've found the point where they branch, I'm sure you can use your experience to find a decent point to break in order to find where the check is made. Chances are that it'll be near a call like GetSystemTime or FileTimeToSystemTime.

If you don't have Smartcheck, you could effectively do the same thing using OllyDebug's 'Run Trace' (although I find this tends to be somewhat more time-consuming). Obviously, depending on where the check takes place, this can take a very long time to trace.

Of course, this solution is only necessary if the obvious efforts like BPX on GetSystemTime and similars don't help you.
nog_lorp
04-02-2005, 08:15 PM
Thanks for the help.

I have tried bp'ing MessageBoxA, and the program would break immediatley before the nag appeared, but I did not manage to figure out how to stop that.

I did not think of trying GetSytemTime, but I have looked at the several GetSystemTime and GetLocalTime references (in W32DASM), and haven't (I don't think...) found it.

I did not consider trying FileTimeToSystemTime, how would the program use this (so I can see it's the right reference)?

Also, would it be possible for you to point me in the direction of SmartCheck?
(EDIT: nevermind, I think Im on track to finding it. NuMega SmartCheck, right?)

Thanks again,
~nog_lorp
( :) )
Hero
04-03-2005, 03:09 AM
Hi
a sugestion for finding what is the api function that checks time,or making that message:
Simply get a program named APISpy.Using this program,you can run your program
and log all api function calls.Then easily see that log and you will find the function
that makes that message or read time.

sincerely yours
naides
04-03-2005, 07:30 AM
I have tried bp'ing MessageBoxA, and the program would break immediatley before the nag appeared, but I did not manage to figure out how to stop that.

When the debugger breaks, you are deep into one of the system's dll. you need to trace until the messagebox appears, click the ok button and then keep tracing until you go back to you application code. Then note the instruction that generated the code, and who decides to run that instruction.

I did not think of trying GetSytemTime, but I have looked at the several GetSystemTime and GetLocalTime references (in W32DASM), and haven't (I don't think...) found it.
You need to do live debugging, to locate the GetSystemTime assiciated with your NAG screen

I did not consider trying FileTimeToSystemTime, how would the program use this (so I can see it's the right reference)? Look at the import function list in the Wdasm or IDA listing and you will have list of the time API that the program calls

Also, would it be possible for you to point me in the direction of SmartCheck?
(EDIT: nevermind, I think Im on track to finding it. NuMega SmartCheck, right?)

Thanks again,
~nog_lorp
( :) )

OK
TBone
04-03-2005, 08:58 PM
You can also try to work your way back up from the failure message instead of trying to break just before it. Start the program with olly and run until you get to the failure message. Pause the debugger and look at the stack window. Follow the stack frames back until you see a return to the program's module (user code). You may have to work back this way several levels until you get to the top of the registration checking code (or whatever it is). Of course, this won't work if the code has deliberately messed with the stack to hide its tracks (ex. returning to a different section of code than where it called from), but most of the time, it's pretty straight forward.

Once you find the start of the checking code, just set a breakpoint on it and unpause the program. Exit the program and then restart it in the debugger. Olly remembers where you set breakpoints, so you'll be ready to drop straight in.
nog_lorp
04-04-2005, 09:04 PM
Hmm, don't see any API calls that would create a window (in the trace).

Anyways, how would I go about finding refrences to certain data sections? The time-up message is in the .rsrc section, and is not shown as a Reference in OllyDBG or W32DASM.
Hero
04-04-2005, 11:35 PM
Hi
If the message string is directly in resources (rsrc section),noramlly it loads with
"LoadString" api function,But if all the dialog that contains messge is in resouces
normal function that will be used is "DialogBox" or "DialogBoxParam".

sincerely yours
r99
04-05-2005, 01:55 AM
load dll in Pexplorer and then search your string in resources
This string must have some ID (= 128 for example)
after that load your exe in Hiew and search binary string 688000
(push 80)
80h=128
Aimless
04-05-2005, 06:21 AM
Hullo,

I am assuming you understand that w32DASM does not read Unicode data. And if it does via the patches and addins, it does so quite shoddily.

A general idea in this case is to use a good text/hex editor like ultraedit and search the entire directory for the message. Once normally, and other with unicode box checked.

Note that it is NOT necessary that you will find the exe/dll/etc in the program directory. It could be in windows, it could be in System32 it could, frankly, be anywhere it pleased.

Also, if the strings are PACKED (yeh! only string packing is possible too) or its alternative FUNCTIONS have been used to create the string dynamically during runtime, you will also not find it.

As always, its a good idea in these cases to breakpoint on the nag. If its a messagebox its easy to find the push which points to the address. Rest is easy to find out from the query option in softice. Alternatively, if its a dialogbox or any of its variants, you may have to search a couple of pushes to find out the right one.

Either way, its a good idea to move to IDA. Its free and its good.

Have Phun,
Silver
04-05-2005, 11:16 AM
I've found this to be useful:

http://www.analogx.com/contents/download/program/textscan.htm
nog_lorp
04-09-2005, 04:13 PM
Hmm, analogX was helpful for finding the offset, I'll try the suggestion of searching for the Resource next.

Update: I found the offset of the string, and am now looking in to references to it (there seem to be several junk references).


Winrar SFX Archive Cracking
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Winrar SFX Archive Cracking
PDA

View Full Version : Winrar SFX Archive Cracking

haule_nth
04-03-2005, 12:48 AM
Who know how to by pass the password of a Winrar SFX Archive :devil:
Hero
04-03-2005, 03:00 AM
Hi
I think this question is asked here for several times.
A general answer:
You can't crack an archives password without checking it bruteforcly or using
dictionary that these ways also can't find password all times.

sincerely yours
laola
04-11-2005, 09:11 AM
As Winrar uses strong encryption (AES with reasonable key length), brute-force attacks against a Winrar archive are pretty useless if a proper password has been used. Even Elcomsoft provides nothing better than a brute-force plus dictionary attack tool for Winrar archives.
If your archive was retrieved from one of the common sources for encrypted rar archives, you may end up better searching for the matching password in the same place ;)
disavowed
04-11-2005, 09:20 PM
And if you don't want to pay for Elcomsoft's tool, you can get a free one here: http://www.password-crackers.com/crack.html#RAR
laola
04-12-2005, 04:34 AM
Thanks for that link! Great site :D Too bad they don't have a free tool for Lotus Approach :( All I could dig up were commercial tools :(


Breaking a challenge / response algo
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > Breaking a challenge / response algo
PDA

View Full Version : Breaking a challenge / response algo

ShCiPwA
04-03-2005, 03:04 AM
Hi, i am currently trying to recreate a program used to open up a firewall using a username and password, the problem is not the login details, but the program. It is large and intrusive, and requires that you be logged in to access the resources of the servers. This is quite a hastle to have to open it up everytime you want to use it. It would be much easier if the program would sit down in your system tray and penetrate the firewall with a valid login, but leave the accessing of resources to better programs.

That is simply what i want to create, logins can be created feely, but there is a built in challenge response code similar to a Name / Serial key generation done by the program. for example:

1
Challenge: "fqzzywoevmzrzzlg"

Response: "riejkhfsmlv"
2
Challenge: "jzlvypwkqewaoith"

Response: "uilsqhrpenb"

These are 2 examples of server sending a challenge and program responding with authentication code. I have been working on reverse engineering the algo from the asm code, but it is quite complex and i have only been learning asm for a few days. The task seems beyond me. I have narrowed it down to about 50 lines of asm where the manipulation is done, that i am sure of. But I cant seem to make sense of what the code does.

I was wondering if:
A: There is a mathematical process to derive the algo?
or
B: There is some sort of translator to make the asm more understandable, eg to pseudo(spelling) code or a c like layout?
I am quite experienced in alot of higher level languiges, and just cant make the connection.

if there is some nice person who is fluent in asm that could have a quick breese through the code to tell me where i should be heading / make some sense of it / tell me if its a too big task, i will attach the asm that does the calc.

Any input on the subject would be usefull

Thanks, ShCiPwA
MrAnonymous
04-03-2005, 04:22 AM
A: There is a mathematical process to derive the algo?
Without looking really closesly yes, algo doesn't look extremly hard you may benifet from opening it in OllyDBG and seeing the algo in action instead of a dead listing.

B: There is some sort of translator to make the asm more understandable, eg to pseudo(spelling) code or a c like layout?
I am quite experienced in alot of higher level languiges, and just cant make the connection.
Nope.
blabberer
04-03-2005, 04:33 AM
well there are lot of loose ends in that snippet get a decent debugger
(i would say ollydbg) and set a break point on the recieve and trace
through and observe live
for example the first memset

.text:00422838 push edi <<<< no of bytes to be set
.text:00422839 lea eax, [ebp-2C4h]
.text:0042283F push ebx <<< char to be set
.text:00422840 push eax <<< pointer to buffer that is set
.text:00422841 call memset

0012FFB8 0012FD2C |s = 0012FD2C <<< pointer to buffer start is set
0012FFBC 00000000 |c = 00 <<< char to be set
0012FFC0 00000010 \n = 10 (16.) <<< no of bytes to be set

another example

0012FFB8 0012FD2C |s = 0012FD2C
0012FFBC 00000041 |c = 41 ('A') << i wanna set with A
0012FFC0 00000010 \n = 10 (16.)
before execution
0012FD2C 01 00 00 00 17 00 01 00 00 00 00 00 00 00 00 00
.............

after execution
0012FD2C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
................

second example result
0012FD2C 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41
AAAAAAAAAAAAAA

now next three lines

movsx eax, byte ptr [ebp-1C2h] < moves a signed byte from buffer to eax
movsx ecx, byte ptr [ebp-1C0h] < moves another sdbyte from buffer to ecx
imul eax, ecx < multiplies eax with ecx and the result will be in eax

so if first byte was A (41h) and second byte was also A (41h)
after execution of thes three instruction eax will be 00001081
but instead of 41 if the first byte was 81h eax will be
FFFFDFC1 === (-7fh * +41h) ie (100 - 81) =7f and signed and so on

now next lines

mov dword_486400, eax < so the result will be now stored into
some buffer that is pointed by 486400
mov al, [ebp-1C4h] < moves one more byte from earlier buffer to al
add esp, 0Ch < compiler has balenced the memsset stack here
cmp al, bl we know bl will be pointing to the char that was used
for filling the memset buffer
jz short loc_4228B0 if it was same this jump will be taken
( we can safely assume from this that bl should be 0 and the buffer
was set with 0 and it now checks for 0 )

assuming the jz was taken

we skip what continues and jump back to
.text:004228B0 lea eax, [ebp-1C4h] < takes the address of buffer to eax
.text:004228B6 mov [ebp-14h], ebx <since we assumed 0 for ebx earlier we can safely assume it is putting a null terminator to the string in buffer
.text:004228B9 push eax <--- pushes the string
.text:004228BA call strlen <--- and the strings length is calculated here

.text:004228BF cmp eax, ebx <-- ebx = 0 so it checks if the strlen== 0
.text:004228C1 pop ecx < stack balence for strlen argument
.text:004228C2 jle short loc_422902 < if it was 0 or less that 0 this
jump is taken :)
lea ecx, [ebp-1C4h] < takes the buffer address
.text:004228CA dec ecx < reduces the buffer address by one
.text:004228CB mov [ebp-1Ch], ecx < stored for future refarance

and so on and on :)

btw this has nothing to do with crypto graphics :) try to post in relevant
sections or you may face the wrath of :devil: oops :devil:
ShCiPwA
04-03-2005, 07:58 AM
Thank you so much for your help, its all starting to make sense now. i think i need to hit the tuts again and get a bit more asm knowlage to get going again. But it doesnt look so much like japaniese now.

Just another quick question

[ebp-1C2h], is that just saying "get the data at 1C2 bytes ahead of the stack?

Thanks again for all your help
naides
04-03-2005, 09:35 AM
Just another quick question

[ebp-1C2h], is that just saying "get the data at 1C2 bytes ahead of the stack?

It depends on the instruction context:

For instance:

mov eax, [ebp-1C2h]
eax gets the 4 bytes located at 1C2 bytes below (ahead) of the stack base pointer ebp.

Thanks again for all your help

but in other situations may mean something else


how to identify if a file is packed more than once?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > how to identify if a file is packed more than once?
PDA

View Full Version : how to identify if a file is packed more than once?

yuriprime
04-03-2005, 08:53 AM
how do you know when a file is packed more than once?

:D
lifewire
04-03-2005, 10:47 AM
It is packed more than once when you unpack it and see that it is still packed :D


Reversing few parts from a guitar program
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Reversing few parts from a guitar program
PDA

View Full Version : Reversing few parts from a guitar program

opeth
04-04-2005, 12:15 AM
Hello,

First time in here. Anyways, I've been a programmer by hobby for a few years and now I've got a new hobby - guitar playing and there's this program called XXXXXXXXX, which makes us all happy reading the guitar tablatures in it for the simplicity and midi playback. Having myself about 30,000+ tabs and knowing not 3% of them I would like to be able to write a program that would do this "Find all tabs that have a 3/6 time signature in it" or "All tabs that don't have percussion track" or even "All tabs that have 7 string guitars tuned woth F", etc. Since the tab format is not known to me (I've searched wotsit and other sources with no luck) I decided I'd go the hardway - Reverse the binary. Judging from the mistakes XXXXXXXX programmer did in earlier versions, I can only deduce he uses very simple file format containing a raw midi copy inside of the file and with guitar pro's specifics in the header. With a few searching, I was able to tell the binary was done with Delphi (or BCPPBuilder, I'm running to bed, will check it tomorrow for sure!). I also downloaded Dafixer's delphi decompiler (DeDe) version 3.50.04. However, it hangs during the extended analysis :whoops:

I'm not trying to crack guitar pro's as I bought my copy....but since the author himself doesn't do the features I asked neither does he provided me a format spec for the tabs... I've to go the hardway... I've also roughly read the F.A.Q but I hope I'm not crossing the line with the questions I'm about to ask.

1. Where can I find decent information on examining delphi files?
2. I know I shouldn't ask this (or should I, in either way, you're free not to answer any questions - that's how boards work like =)), but is there any tool that works similar to DeDe? I've found DeDe a bit workdemanding to manage the binaries (not a lot of search options, for example)

Thanks for any info and keep rocking \m/
Kayaker
04-06-2005, 12:14 AM
Hi

That's an ambitious project you've got there, adding some sort of search capabilities for tab files. As a long time fan of .tab files myself I can see that as being quite useful, even as a standalone app that recognizes this particular file format.

You might be able to use the fact that GP can convert its .G** tab files to raw MIDI format (I believe, it's been a while since I've used it so correct me if I'm wrong). I looked at a couple of the files, they may not follow the standard midi format at all, though some similar information must be encrypted in the patterns. If you can isolate the conversion of the unknown format to the -> known, defined, standard MIDI SMF format, you might have a way of identifying some of the bits and pieces.

You might look at the MIDI SMF file format at any good midi site for an overview. Briefly, MIDI files are organized into data chunks. The file begins with a Header Chunk, identified by "MThd" (0x4D546864), followed by variable sized offsets to data such as Format Type, Number of Tracks, Time Division. Then there follows 1 or more Track Chunks, "MTrk" (0x4D54726B). Each track contains more variable length data to MIDI Events, which define every other aspect of the tune being played, notes, tempo, pitch, controller effects, instrument name, copyright info., etc, etc.

There's probably a few ways to approach it. If GP can import raw MIDI files and convert to its own format, then you can create your own very small *known* .mid file and compare it to the .g** format(s). If you're keen you can "write" your own basic 1 track .mid file manually in a hex editor (or programatically). It's not that hard to do, you'd have complete control of the changes you make and you could create a basic skeleton, say a 4 note piano riff, in about 60 bytes. You could synth it live or with a program as well, also a good way to study the midi format.

If you can break and trace from when GP reads the raw midi file, you can pull out more information that way. When a *.g** file is opened, GetFilePointer might be used to offset where it should start reading the file for each type of output relevant to the music portion of the info, Filemon should clearly indicate this.

As for the rest, DeDe is what you want to use if you can, with or without IDA. If you can't use DeDe, then the other tools come into play, an API monitor, a good window spy (DPeeper used to be a very good Delphi spy, unfortunately never updated to new Delphi versions).

For Delphi specific reversing, in terms of understanding some of its structure, there are a couple of classic tuts on the old Fravia's site linked below.

Good luck with it and let us know what you discover.

Cheers,
Kayaker


dillo fingerprints :( :( :( :( :(
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > dillo fingerprints :( :( :( :( :(
PDA

View Full Version : dillo fingerprints :( :( :( :( :(

pico
04-04-2005, 06:40 AM
hi, now i work on sometihng protected with dillo 3.00 -> 3.61

again, target is protected with hardware fingerprint..

but i cannot get program registered like usual :confused:

fingerprint i get displayed is:

543286-151

i dont find this in memory! i have reversed only first "section" (543286) and search hex but not find..
i convert ths as ascii to hex and search again, not find..

someone gives to me a working combination but his is different. he give me fingerprint:

2460757722

see how there is no dash in there?

i tihnk if someone make hardware fingerprint with armadillo, then app is uncrackable..


New Vbox Name HASP SL
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > New Vbox Name HASP SL
PDA

View Full Version : New Vbox Name HASP SL

LaBBa
04-04-2005, 11:54 AM
Hello all

Well Aladding company buy Vbox and improved it allot!! this is where you can find more info about it .
HASP SL ---- http://www.aladdin.com/HASPSL/features.asp

i have also a target but i can't post it here (they will kill me)

this is the post at EXE tools where we talk about the target :

hxxp://www.exetools.com/forum/showthread.php?p=35687#post35687

enjoy ;

LaBBa.


Unicode strings in IDA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Unicode strings in IDA
PDA

View Full Version : Unicode strings in IDA

naides
04-04-2005, 09:16 PM
I apologize if this question is too elementary, but I am not sure what I am doing wrong.

I have certain .exe file that I have disassembled with IDA.
I tried to find a string that I need to figure out the protection.

The string is in unicode format, but I could not find by searching it in the IDA disassembly window, Hex window or strings window.

I searched the string with a Hexeditor, and found it at raw offset 1895E2
When I try to get to that offset in IDA, it is beyond the end of the IDA disassembly and the Hex window, after correcting for the the base address.

I searched for other, non-Unicode strings and found them at the right places, for instance at address 51F5E2 in IDA hex window, correctly corresponding to the address 11F5E2 that the HEXeditor gave, with a base address 400000.

But my unicode string would be at 5895E2 which is beyond IDA disassembly and IDA Hex .

I disassembled the file with W32Dasm and it correctly identified the String as a String Resource and cross referenced it correctly in the code.

IDA did not detect this Unicode string as a string resource, and did not labeled the code with the proper cross reference.

How do I make IDA locate the string resources and cross reference them?
disavowed
04-04-2005, 11:07 PM
Regarding the image at http://www.datarescue.com/idabase/unpack_pe/2a.gif, you want to make sure "Load resources" is checked.

You can't get IDA to xref the resource strings because they're "loaded" via Win32 API, not direct code references. I suppose you could create some IDC script to emulate the resource API functions and determine xrefs. Make sure to post the .idc here when it's done ;)
naides
04-05-2005, 05:40 PM
Make sure to post the .idc here when it's done ;)

Many thanks disavowed.

Someone (mammon and Quine) already tackled the problem.
I am posting their collection of .idc, available on the net. :yay:
disavowed
04-06-2005, 01:39 AM
Many thanks disavowed.

Someone (mammon and Quine) already tackled the problem.
I am posting their collection of .idc, available on the net. :yay:
Ahh, sweet. Never looked at that.

For archiving purposes, should the attached .zip above ever become inaccessible, it's currently archived at http://home.arcor.de/idapalace/idc/m_script.zip
Kayaker
04-06-2005, 02:39 AM
Not that it matters where it came from, since we're all one big happy family here :-), but that zip file, along with some others, is one I made up to preserve the info and gave to Yates for public safekeeping, initially here:
http://www.woodmann.com/yates/ida/m_script.zip
sigint33
04-17-2005, 10:41 AM
Just to add a little to this old thread, I've been using Winhex for years for patching, I just discovered, (DUH!), it has a great string search utility, either ascii or unicode, it will even search all files in a directory, now for the question, I found my string and it appears in a chunk of code at the end of my target that doesn't appear in any disassembler I've tried, it's not packed, and is straight C++ originally, I suspect that the parts I need to look at are in this section, anybody else run in to this? and why is this code inaccessable, I'm not even sure what to search for to learn about this.

SiGiNT

Never mind the question, I just answered it myself - MD5, Blowfish encrypted, now I know what to search for!
disavowed
04-17-2005, 11:07 AM
are you loading the resources with ida like i said above?
sigint33
04-17-2005, 02:10 PM
No, why would I want to make it easy? :idea: I guess I need to add to my acronyms, RTFT T=thread!

Thanx, It now shows up but in a pure data segment, no code there, back to the drawing board.

SiGiNT
disavowed
04-17-2005, 03:14 PM
did you try the .zip naides posted above to provide references into the resource section?
sigint33
04-17-2005, 10:32 PM
YEP!,

Downloaded it I'll work on using the scripts tomorrow. Work you know, kind of gets in the way of the important stuff.

SiGiNT


GODUP question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > GODUP question
PDA

View Full Version : GODUP question

Danilizer
04-05-2005, 07:11 PM
Hi all, does anyone know the correct process for importing IDA comments into Olly with GODUP? When I do it the labels import fine but I can't get the comments to show up.
blabberer
04-07-2005, 05:59 AM
well godup as far as i have used doesnt do a good job it seems
the resource section always seem to be blank with no info of any sort
if you use ida loader and try to apply it some how says applied some blah but
if you try to find the names (user defined they almost always come up nil in many cases also the guis check box etc are kinda screwed up (may be some resizing bug :( i dunno) etc etc

but the old mapconv plugin almost always does a good job
for it to work load the app in ida and then create a map file then use the map conv plugin to get those labels and comments into olly :) does its job almost always
if you check the demangle names and use the plugin sysmbol loader in ida the map will also contain undocumented functions and importing them into olly will make the job pretty good :)
Danilizer
04-07-2005, 06:18 PM
Thanks blabberer, I don't have the mapconv plugin but I will check it out. Godup does seem to do a good job with labels but for some reason I can't get the comments to import. Anyway thanks for the help.


Identifying a packer, PEiD/TrID fail
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Identifying a packer, PEiD/TrID fail
PDA

View Full Version : Identifying a packer, PEiD/TrID fail

netsniper
04-05-2005, 07:32 PM
1. What is the problem....
I cannot determine the packer of a certain binary, and thus, cannot unpack it automatically

2. What is the protection.....
Unsure as of yet, but would probably need to unpack first to find out

3. What tools are you using....
I have tried PEiD, TrID, Ollydbg, Winhex, and IDA Pro to get some idea of how it is packed -- but no luck

4. What tutorials have you read....
I have read some basic unpacking tutorials on common packers like UPX, ASPack, etc and have unpacked these on my own before

5. Show your output listing WITH comments....
PEiD v0.93 with all plugins on their site shows "Nothing Found *", with options Hardcore scan, recurse subdirectories, use external signatures, reg shell ext, min to sys tray, load plugins, allow mult instances.

TrID output:
C:\Program Files\TrID>trid "c:\Program Files\fakefolder\fakefile.exe"

TrID/32 - File Identifier v1.56 - (C) 2003-04 By M.Pontello

Collecting data from file: c:\Program Files\fakefolder\fakefile.exe
Definitions found: 1552
Analyzing...

72.4% (.EXE) Win32 Executable Generic (10527/13/4)
13.8% (.EXE) Generic Win/DOS Executable (2002/3)
13.8% (.EXE) DOS Executable Generic (2000/1)
0.0% (.CEL) Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3)

C:\Program Files\TrID>

6. NOW ask your question....
Are there any other tools that can help me identify the packer of this binary? I would like to investigate the underlying code itself, so I need to unpack it first. If manual unpacking is necessary, I would like to learn how to do this. However, since my situation is also time critical, would it be against the rules to offer monetary reward for an expert to help? This was not detailed in the FAQ.

I eagerly await your replies ;-)

netsniper
esther
04-05-2005, 08:15 PM
Autodesk? It might be dongle related...

my 2 cents
netsniper
04-05-2005, 08:21 PM
Autodesk? It might be dongle related...

The exe is NOT an autodesk application. I think that TrID is identifying a file format that autodesk uses within my fakefile.exe app, which does video encoding (i'm hiding the name of the file on purpose). Anyways, are there any other ways to attack this?

netsniper
disavowed
04-06-2005, 01:50 AM
Are there any other tools that can help me identify the packer of this binary?
If PEiD couldn't detect it, chances are that other apps won't be able to either.

However, since my situation is also time critical
If your situation is time critical, then you may want to just run your target, dump its memory, and analyze the dump (as opposed to doing a perfect unpacking job).

would it be against the rules to offer monetary reward for an expert to help
If this is third-party (not written by you) commercial software, then you shouldn't offer such a reward here. However, if it is not commercial software or the software's EULA explicitly allows for reverse engineering, then please say so and you may get some offers to help.
netsniper
04-06-2005, 02:40 AM
If your situation is time critical, then you may want to just run your target, dump its memory, and analyze the dump (as opposed to doing a perfect unpacking job).

I would try to do this, but the app also seems to have code that stops me from using Ollydbg in this way. Is there an easier way to dump the running process to memory? Also, even though I have tricked the program to letting Ollydbg run a few times, when I "attach to process" the code still looks like junk! I'm wondering if there is much SMC here that is screwing everything up. All I really want to do is analyze the "virgin" function structures, without jumping through all these fscking h00ps :-O Man, these guys are really trying to hide their source. It is about a $1000 program, which I also assume to have ripped code from GPL projects. I'll give a big hint. Their website has been posted on /. many times in recent weeks and this site went down today ;-P I think they are pressured by my analysis of their other "product"...

In conclusion, how can I dump the memory so I can analyze this file's functions?

If this is third-party (not written by you) commercial software, then you shouldn't offer such a reward here. However, if it is not commercial software or the software's EULA explicitly allows for reverse engineering, then please say so and you may get some offers to help.

If it is suspected that GPL code is within, would that be legal? I have already proven, very publicly, that this company's other "product" was stolen from GPL sources. I would like to do that again with this application that they are protecting so well. There must be something underneath, or else, why would they hide so well :-) I ask in the name of open source for help, and if none is available, I offer -- out of curiosity for the conclusion -- a monetary reward for unpacking, which should aid in proving the stolen source code. This is a big deal...

netsniper
nikolatesla20
04-06-2005, 06:36 PM
Information required as follows:

HOw many sections in the PE file?

Names of PE file sections?

Is OEP in the final section?

Sizes of sections in file?

Any functions in the Import Table? If so, how many and what are their names?

When the program executes, is there only one "instance" running?

Can you simply dump the program from memory using LordPE while it's running? or does LordPE give you an error when trying to do so?

-nt20
netsniper
04-07-2005, 02:04 AM
HOw many sections in the PE file?

seven sections...

Names of PE file sections?

In order by virtual address:
.text
xm618ywi
.data
.rsrc
bvium466
fbnk3hol
q7n4woxj

Is OEP in the final section?

I don't know the OEP. and am a little naive to finding it since I don't have SoftICE. I am trying to get it installed after reading this fine tutorial and getting a good idea how to do it:
hxxp://www.woodmann.com/fravia/predator_unpacking.htm

Can I locate the OEP some other way? This application seems to have anti-debugging code so I don't know how to get around that to find the OEP. Is there some other way without the debugger? I mean, if I try to open Ollydbg, the protected application immediately closes it.

In PE Explorer, the listed "Address of Entry Point" is 003DB93B. But I am assuming that this is not the OEP...

Sizes of sections in file?

From PE Explorer:
Name | Vrt Sz | Vrt Addr | Sz Raw Data | Ptr Raw Data | Chars | Ptr Dirs

.text | 000d2000h | 00401000h | 00000000h | 00000400h | e0000020h | --
xm618ywi | 00022000h | 004d3000h | 00000000h | 00000400h | e0000060h | --
.data | 0010f000h | 004f5000h | 00000000h | 00000400h | c0000040h | --
.rsrc | 00088000h | 00604000h | 0002b000h | 00000400h | c0000040h | Resource Table
bvium466 | 00016000h | 0068c000h | 00000000h | 0002b400h | e2000060h | --
fbnk3hol | 00054000h | 006a2000h | 00000000h | 0002b400h | e0000020h | --
q7n4woxi | 000e6000h | 006f6000h | 000e5d24h | 0002b400h | e0000060h | Import Table: TLS Table

Any functions in the Import Table? If so, how many and what are their names?

I am not that familiar with packed programs messing with the import table. I am now reading this guide:
http://sandsprite.com/CodeStuff/Understanding_imports.html

However, still not sure how to detect how many fuctions there are and what the names are. I can say that the DLLs in the program folder seem to be msvc71*.dll files, so I am assuming a .NET application. Since the raw size of the q7n4woxj section seems large, I'm guessing that most of the code is in here...

OK, I took a look at the section in a hex editor and see only a few notable functions in here -- but everything else looks garbled:
GetModuleHandleA
LoadLibraryA
GetProcAddress
ExitProcess
MessageBoxA

When the program executes, is there only one "instance" running?

It only runs one instance at a time.

Can you simply dump the program from memory using LordPE while it's running? or does LordPE give you an error when trying to do so?

I can dump the running process, but the dumped file does not run correctly. It hangs with a greyed out window and I have to end task it...

Thanks for your guidance, and hope to hear back from you soon :-)

netsniper
bilbo
04-07-2005, 02:46 AM
It looks to me Execryptor... one of the best toys in the market!
Regards, bilbo
kao
04-07-2005, 06:15 AM
Agree with Bilbo - looks like Execryptor: very hard but crackable. There is no SMC, but lots of junk code. Developer can also hide parts of his code in the junk code. There is huge performance hit for doing that, so usually only serial checking routine is "junked".

Execryptor does not support .NET applications, though. It might be normal application compiled with VS 2003.
disavowed
04-07-2005, 10:05 AM
... which I also assume to have ripped code from GPL projects. I'll give a big hint. Their website has been posted on /. many times in recent weeks and this site went down today ;-P I think they are pressured by my analysis of their other "product"...
Ahh... found it with http://www.google.com/search?btnI&q=netsniper+gpl

If it is suspected that GPL code is within, would that be legal?
I'm not a lawyer, but my guess would be no.

I offer -- out of curiosity for the conclusion -- a monetary reward for unpacking, which should aid in proving the stolen source code. This is a big deal...
perhaps you should use half of that monetary award to pay a lawyer to determine whether or not unpacking it and reverse engineering it would be legal. if the lawyer confirms that it's legal, then come back here and offer the other half of the monetary award for unpacking it. (and of course provide references to the lawyer and their decision)
JMI
04-07-2005, 10:58 AM
It seems they should have already talked to lawyers because they are collecting donations on the "PearPC Legal Suit Donation Page."

From everything I've read on the net, there is no legal prohibition on reverse engineering any software code for the purposes of examining it. As I understand the issue, the problem comes from "misappropriating" the intellectual property of another and "using" that work without the permission (or compensation) of the author. Examining the code of others is something which is done all the time in software companies.

California made some news a couple of years ago as part of the release and publication of the DeCSS code which allowed one to "access" movie CDs. California's Supreme Court eventually got involved in the controversy and issued a decision in the case, titled: DVD COPY CONTROL v. BUNNER. The United States (and California has it's own State regulation adopting the U.S. model) has Something called the "Uniform Trade Secrets Act (UTSA)."

According to that Act:

Trade secret misappropriation occurs whenever a person: (1) acquires another's trade secret with knowledge or reason to know "that the trade secret was acquired by improper means" (§ 3426.1, subd. (b)(1)); (2) discloses or uses, without consent, another's trade secret that the person "[u]sed improper means to acquire knowledge of" (id., subd. (b)(2)(A)); (3) discloses or uses, without consent, another's trade secret that the person, "[a]t the time of disclosure or use, knew or had reason to know that his or her knowledge of the trade secret was" (a) "[d]erived from or through a person who had utilized improper means to acquire it" (id., subd. (b)(2)(B)(i)), (b) "[a]cquired under circumstances giving rise to a duty to maintain its secrecy or limit its use" (id., subd. (b)(2)(B)(ii)), or (c) "[d]erived from or through a person who owed a duty to the person seeking relief to maintain its secrecy or limit its use" (id., subd. (b)(2)(B)(iii)); or (4) discloses or uses, without consent, another's trade secret that the person, "before a material change of his or her position, knew or had reason to know that it was a trade secret and that knowledge of it had been acquired by accident or mistake" (id., subd. (b)(2)(C)).

But, for our purposes, here is the interesting part under both U.S. and California law:

Acquisition of a trade secret by "'[i]mproper means' includes theft, bribery, misrepresentation, breach or inducement of a breach of a duty to maintain secrecy, or espionage through electronic or other means." (§ 3426.1, subd. (a).) "Reverse engineering or independent derivation alone," however, is not "considered improper means."

It would seem that if one where seeking to sue another for "misappropriating" their intellectual property in the form of their code and incorporating it into their own software, reverse engineering the code would be "required" and the principle form of "proof" that a "misappropriation" had occurred. If the trade secret actually "belongs" to the person doing the reversing, it probably would be hard to successfully argue they were "misappripriating" their own code. :idea:

Regards,
naides
04-07-2005, 12:36 PM
Naive Observation. (Packing and unpacking IS NOT MY THING):

Even when the application is up and running, The code looks scrambled?

May be I misunderstood but have you done this?:

Get the app up and running.
The code should be unpacked in memory, at least some parts of it.
Using a dumping tool like PE Tools, find the process in the memory and dump it.

You could analyze the dump for code patterns, strings, etc.
The API calls and communication with the system dlls is probably scrambled beyond recognition, but the code flow and the structure of the functions should be recognizable
netsniper
04-07-2005, 12:55 PM
It looks to me Execryptor... one of the best toys in the market!

Better than Silicon Realm's Armadillo/Software Passport?

netsniper
netsniper
04-07-2005, 01:27 PM
"Reverse engineering or independent derivation alone," however, is not "considered improper means."

It would seem that if one where seeking to sue another for "misappropriating" their intellectual property in the form of their code and incorporating it into their own software, reverse engineering the code would be "required" and the principle form of "proof" that a "misappropriation" had occurred. If the trade secret actually "belongs" to the person doing the reversing, it probably would be hard to successfully argue they were "misappripriating" their own code. :idea:

Great insight dude :-) Yes, I think that it is fine to reverse the software, but I will also speak with my lawyer and see what he says. I want to make sure that this is allowable. If that is the case, how much of a time investment would it be to "virginize" this application? I'm assuming that manual work would need to be done to get the code into a usable form for IDA Pro analysis (ie. unpack, recover from junk code blocks, remove anti-debug code, remove anit-trace, etc...). Let me know and then offer up a bid. After I talk to my lawyer I would love to speak with someone about doing this, and afterward, finding out how they went about their work. Maybe they could also write up an article on how they did it? I found someone else on the net that was doing similar research and seems to show that XVID and LAME code is in their product! I'm about to email him and talk some more about it. See for yourself here:
http://www.tliquest.net/ryan/cherryos/vx30/oldversion/

netsniper
netsniper
04-07-2005, 03:43 PM
Even when the application is up and running, The code looks scrambled?

May be I misunderstood but have you done this?:

Get the app up and running.
The code should be unpacked in memory, at least some parts of it.
Using a dumping tool like PE Tools, find the process in the memory and dump it.

Yeah, I did dump the process, but it still seems like junk! I am wondering wtf is going on here. I am new to this though, so I must be doing something stupid. Another guy on the net did happen to get a dump working correctly and analyzed the code a little bit. Maye I can just snag the resultant executables from him so I can do some IDA Pro analysis. This is getting very interesting...

netsniper
disavowed
04-07-2005, 07:58 PM
There's some discussion of this issue on DataRescue's bulletin board, as well as a link to this thread: http://www.datarescue.com/ubb/ultimatebb.php?/topic/4/274.html
netsniper
04-07-2005, 11:58 PM
Yea, its too bad I can't post to that forum to clear up the inconsistencies, so here goes:

The "analysis" is very basic, I know. Actually, I think the only IDA Pro feature I put to use was the function flow graphing. Everything else could have been researched in a disassembler. It was done using a demo version of IDA Pro, but be aware that I do plan to buy the product at some point.

I have also talked to Halvar about getting BinDiff via academic licensing. Does DataRescue offer such a discounted rate for students?

The "pirated" copy of software that you mention on my website is nothing of the sort. Maui X-Stream does not even have the right to distribute their own product (GPL violations), and since I have the OK from PPC, then I am also not breaking any rules -- since it is their code in the CherryOS product! However, coincidentally, I did remove it tonight in light of a strategic move on the part of the developers.

I do not condone piracy, so let that be known. I am contirubting much of my free time to make sure that Maui X-Stream is reprimanded for _their_ piracy. Surely this should be some indication. I also contribute to Open Source Software projects on Sourceforge...

netsniper
MrAnonymous
04-08-2005, 12:09 AM
Better than Silicon Realm's Armadillo/Software Passport?

netsniper

Armadillo doesn't use any ASM Obfustication so it's not really comparable to EXECryptor what I will say though is the one EXE Cryptor program I looked at simply wouldn't run on my PC (the previous versions of the prog before it was packed with it worked fine) but in the 'crypted' version just crashes. I wouldn't use EXECryptor for any of my own programs.
bilbo
04-08-2005, 03:10 AM
Better than Silicon Realm's Armadillo/Software Passport?

MrAnonymous has already answered this. I would add that Armadillo has some ASM obfuscation too, but more localized.

naides, I think you should study modern packers/encryptors, because they are becoming every day more interesting... They are changing IRREVERSIBLY the target, and not just for what is concerning DLL calls!

Armadillo (Nicolas Brulez) started with the NANOMITES idea: he replaced the conditional/unconditional JUMP opcodes with a CC opcode (INT 3), passing the control to an external debugger written ad hoc in order to solve at run time the jumps (and the jump solver is well obfuscated by the way ;-)), on the basis of pre-built tables. But the original jump code was thrown away, not just stolen or relocated.

Execryptor rebuild the code in another place, converting it to spaghetti code and adding here and there exceptions to confuse the debuggers. Furthermore the code is not localized in the same place, but scattered at many different addresses (with jumps/calls/SEH to tie one fragment with another) so the flow analysis cannot locate subroutines: it can only locate part of the iterations. Obviously this process is not performed on the whole executable for performance issues, as kao pointed out: the continuos jumping here and there nullifies the opcodes cache/pipeline.

Well, IRREVERSIBLY is anyway a too restricting word: it is possible to write some pseudo-intelligent stuff which attempts to revirgin back the target (obviously in another memory area and not necessary the same as the original - so not always suitable for a BinDiff analysis).

Best regards, bilbo
kao
04-08-2005, 05:21 AM
netsniper, can you list all DLLs used by main program? I was able to unpack GUI part, but main EXE just refuses to load..
netsniper
04-08-2005, 02:31 PM
netsniper, can you list all DLLs used by main program? I was able to unpack GUI part, but main EXE just refuses to load..

You want all the DLLs in the program directory or all the DLL's it loads? I mean, there are tons of standard DLLs it loads for obvious functionality. Also, I dont know what version you are using -- I went back to trying to play with the 1.5.x.x version instead of 2.x since it seems to be using older execryptor...

netsniper
kao
04-08-2005, 03:50 PM
You want all the DLLs in the program directory or all the DLL's it loads? I mean, there are tons of standard DLLs it loads for obvious functionality.
A list of all the DLLs that process loads would be nice. Perhaps I'm missing one of those "almost" standard ones, since process refuses to start and stops somewhere is Execryptor junkcode.

Also, I dont know what version you are using -- I went back to trying to play with the 1.5.x.x version instead of 2.x since it seems to be using older execryptor...

It's one of the latest 2.x versions. How/where can I check exact version number?
netsniper
04-08-2005, 04:31 PM
A list of all the DLLs that process loads would be nice. Perhaps I'm missing one of those "almost" standard ones, since process refuses to start and stops somewhere is Execryptor junkcode.

I would give the exact DLLs, but for some reason, in the latest VX30 2.x version, WinHex does NOT see the VX30Encoder process!!?!?? This is weird. Are they trying to hide their own process? Using WinHex I am usually able to dump the list of loaded DLLs it it using. You have another way to do it? See if WinHex works for you -- you can try using the "Open RAM" function...

It's one of the latest 2.x versions. How/where can I check exact version number?

Help -> About? I forget the exact place where it is shown -- perhaps it is not even shown in newer versions anymore. I think I had this problem too. Hrmm, sorry dude. I am really just going back to the 1.x version, because I think it is easier to crack...

netsniper
kao
04-09-2005, 11:50 AM
Heh, GdiPlus.dll was missing on my Win2K and it caused the nasty crash. ;)

2.0.0.3452 is unpacked and working (on my computer only...). There are 2 areas (780 and 2350 bytes) protected with Execryptors junk code - they look terrible and will cause crash on other PCs. Everything else looks and works beautiful. :)

Has anyone ever recovered original code from Execryptors junk code?
netsniper
04-09-2005, 04:06 PM
Heh, GdiPlus.dll was missing on my Win2K and it caused the nasty crash. ;)

2.0.0.3452 is unpacked and working (on my computer only...). There are 2 areas (780 and 2350 bytes) protected with Execryptors junk code - they look terrible and will cause crash on other PCs. Everything else looks and works beautiful. :)

Has anyone ever recovered original code from Execryptors junk code?

Can you do me a favor? Can you scan the running process or hex edit the unpacked executable and search for the strings "xvid", "lame", and "ogg"? I would really appreciate it...

netsniper
kao
04-10-2005, 02:30 AM
Some people never change... The following interesting strings are present and probably relevant to your research:

This software is derived from the GNU GPL XviD codec (0.9.2). Your software distributor has to give access to its source code.
Xiph.Org libVorbis I 20030909
lame_encode_main_power
lame_encode_stop
Andrew S. Gildehaus, agildehaus#runbox.com
Marcel Hoffs, marcelhoffs#hotmail.com
Usage: mplayerc.exe "pathname" [switches]
Server: MPC WebServer
MPCSESSIONID
; Note: This file was saved by Subresync.
; http://www.anime-fansubs.org
deflate 1.1.4 Copyright 1995-2002 Jean-loup Gailly
RASetPwd
Ardubancel Quazanga
RASetDLLAccessPath
libfaad 2.0, http://www.audiocoding.com/
libdts 0.0.2, http://www.videolan.org/dtsdec.html

These 2 are there for some unknown reason:

www.paco.net
GET /test.php?testvar=privet+is+Odessi+goodbye HTTP/1.1

paco.net is Ukrainian ISP. "Privet is Odessi" translates as "Hello from Odessa". And I thought those guys are from US.. :p

Check PM for more details.

kao


Visual C++ Toolkit 2003
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Visual C++ Toolkit 2003
PDA

View Full Version : Visual C++ Toolkit 2003

yaa
04-06-2005, 04:57 AM
Hello,

I thought this might be useful to people who do not have access to the full VC++ IDE:

Visual C++ Toolkit 2003 - http://www.microsoft.com/downloads/details.aspx?FamilyId=272BE09D-40BB-49FD-9CB0-4BFA122FA91B&displaylang=en

Visual C++ .NET 2003 Code Samples - http://www.microsoft.com/downloads/details.aspx?FamilyId=6E6FAC4B-5B51-41FE-9604-1D9752E8A71A&displaylang=en

Hope this forum is the correct one to post this stuff.

yaa


process dumper
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Linux RCE > process dumper
PDA

View Full Version : process dumper

fr1end
04-06-2005, 05:49 AM
Hi all ...

I am searching for a tool like procdump for linux
or a tool/program/script that can give me the memory dump of a process...

Thanx in Advance
_Fr1end
andrewg
04-06-2005, 06:08 PM
There are a couple of alternatives to use, such as fetchmem (http://lcamtuf.coredump.cx/soft/memfetch.tgz), using gdb's dump memorycommand, or writing some stuff yourself using /proc/pid/maps. You might be able to adapt http://reverse.lostrealm.com/tools/xocopy.html as well for example. Kinda depends exactly what you're after :)

Best bet might be to write your own.. perhaps you could send a SIGSTOP to a process, detach the current debugger, attach the dumper, and reattach the debugger if needed.
0xf001
04-06-2005, 07:18 PM
hi!

i can also recommend memfetch. if it hangs try -m option (ie on my 2.6.11 it does) - besides that nice and handy :yay:

cheers, 0xf001
fr1end
04-06-2005, 11:11 PM
Hi ...

Thanx andrewg && 0xf001,
i shall do a work around with memfetch, On my kernel(2.4.18)

Bye
_fr1end
andrewg
04-23-2005, 03:26 AM
Here is another application that may be of use: hxxp://cryopid.berlios.de/
Also allows you to resume processes etc as well.

To quote,

"Current features are:
* Can run as an ordinary user! (no root privileges needed)
* Works on both 2.4 and 2.6.
* Can start & stop a process multiple times
* Can migrate processes between machines and between kernel versions! (with some restrictions - you must (a) either save all libraries to the image, or ensure libraries are identical on both machines; (b) you need to specify the new code segment using the -c option on the resumer; (c) you cannot move a process running on a 2.6 kernel linked against a TLS-enabled libc (see ldd) to a 2.4 kernel).

Yes, checkpointing software such as this is nothing new, but I was unable to find a tool that worked on Linux that did not require at least one of the following:

* root privileges
* modifications to the kernel
* recompiling/relinking your software
* using an LD_PRELOAD when you start your program.

CryoPID requires none of these and hence can be used as an ordinary user on any Linux machine running a 2.4 or 2.6 kernel (2.2 untested). This will remain one of the main design goals of CryoPID.
"
0xf001
04-23-2005, 06:46 PM
coool!! :yay:

... must try that out ... :) could be of use for a kind of cluster as well I think, hmmm ;)

thx, 0xf001


about Visual Studio .NET 2003
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > about Visual Studio .NET 2003
PDA

View Full Version : about Visual Studio .NET 2003

Hero
04-06-2005, 09:59 AM
Hi all
I need some help with VS .NET 2003.I writing a program in simple VC++ using this
IDE,and I want to now that can I set a memory breakpoint for my program using it
or not?Beacuse memory and hardware breakpoints are very usefull for debugging but
I can't find them in embedded debugger in VS .NET 2003.
Do you know anyway to use these breakpoints?Is there any plugin or option that be
able to do this?

sincerely yours
JMI
04-06-2005, 11:12 AM
How about YOU starting with some homework of your own. Try something like "memory breakpoints + VS .NET 2003" (without the quotes) in your favorite search engine. After that try something like "hardware breakpoints + VS .NET 2003" (again, without the quotes) and if you get really desperate, try rtfm. :idea:

Regards,
bilbo
04-07-2005, 02:36 AM
Well, JMI,
I was interested to the problem too some time ago, but unfortunately if you google "memory OR hardware breakpoints" "VS .NET 2003"
(which means to combine both searches "memory breakpoints"+"VS .NET 2003" and "hardware breakpoints"+"VS .NET 2003") you will not find anything.

rtfm could someway help (or better: Debug->New Breakpoint->Help button) but the explanation is not so exhaustive.

This is what I found out myself.
With the Visual Studio debugger (version 7: use the command line devenv /debugexe; version 6: use the command line msdev) you can put ONLY hardware breakpoints on memory writes: set them through the dialog box New Breakpoint->Data.

Is there any plugin or option that be able to do this?
The plugin idea is smart, and is teoretically possible, but not yet implemented... By the way, Visual Studio has a powerful plugin interface, but almost nobody knows it!
You will find some interesting work in this direction at address
http://codeproject.com/macro/vsedebugaddin.asp

Best regards, bilbo
Hero
04-07-2005, 04:49 AM
Thanks bilbo
This was great!:D
I should try to write some like plugin for it to these breakpoints.:yay:

sincerely yours
JMI
04-07-2005, 10:17 AM
The point of course, as I pointed out in the second post that Hero made within a few minutes of eachother, was that he did not post anything which would indicate that he had attempted to do anything to try to help himself or research his own problem before posting his question here. Had he posted anything which indicated he had tried to find the answer and found nothing useful, I would not have suggested to him that he try that first. A simple phrase, such as "I have searched for an answer but didn't find anything useful" goes a long way. :yay:

For example, using VS .NET 2003 + memory breakpoints I quickly found references to a book titled:

"Debugging Applications for Microsoft® .NET and Microsoft Windows®"

Which was reviewed here: http://www.stolin-software.com/04booklist/0-7356-1536-5.html

and contains index references, such as:

WDBG: A Real Debugger 190
Reading and Writing Memory 192
Breakpoints and Single Stepping 195
Symbol Tables, Symbol Engines, and Stack Walking 200
Step Into, Step Over, and Step Out 209
So You Want to Write Your Own Debugger 210
What's Next for WDBG? 211
5 Advanced Debugger Usage with Visual Studio .NET 213
Advanced Breakpoints and How to Use Them 214
Breakpoint Tips 215
Quickly Breaking on Any Function 217
Location Breakpoint Modifiers 224
Multiple Breakpoints on a Single Line 227
The Watch Window 228
Calling Methods in the Watch Window 230
The Set Next Statement Command 232
...
7 Advanced Native Code Techniques with Visual Studio .NET 269
Advanced Breakpoints for Native Applications 269
Advanced Breakpoint Syntax 270
Breakpoints on System or Exported Functions 271
Conditional Expressions 274
Data Breakpoints 277

All of which seemed like they might help.

Comments on the "Windows Marketplace" which stated: "Programming is tricky, but with Visual Studio's superb debugging tools, you can iron out the bugs efficiently. Using memory watching breakpoints for example, you can catch the line of C++ that corrupts a variable."

There is a powerpoint presentation titled: "Debugging and Tracing .NET Applications" at techrepublic.com.com/5102-22-1058825.html

and at least 10 other pages of references which Hero did not indicate he had checked or even thought to review. :idea: I did not take the time to read all of them, but they certainly suggested that Hero had not reviewed the available information. This is why "Searching" for the answers is required by our Rules and why I remind people that is what they should try "first."

Regards,


A quesion about PE
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A quesion about PE
PDA

View Full Version : A quesion about PE

Hero
04-06-2005, 10:37 AM
Hi
Do you know what is the ForwarderChain in IMAGE_IMPORT_DESCRIPTOR of PE?
I didn't see any comment on this field on any tutorials that I read.

sincerely yours
JimmyClif
04-06-2005, 11:16 AM
Well, Matt pietreck does mention it in his "Inside the PE Format" paper.. which you can read here : http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dndebug/html/msdn_peeringpe.asp

Looks pretty uninteresting. Basically the DLL says it does have a function by that name, but instead of really having it it forwards any request to that function to some other dll. Probably used for some backwards compatibilities.

>Geesh, 'compatibilities' is a hell of a word.. ;)
JMI
04-06-2005, 11:27 AM
Once again you seem to be unwilling to do your own homework about things you should search for before asking basic questions. Did you try something, such as "ForwarderChain + IMAGE_IMPORT_DESCRIPTOR + PE" (without the quotes) or even "ForwarderChain + PE" (again with no quotes) in your favorite search engine or is this the first place you post every time there is some programming information you do not already know?

Get off your lazy butt and do some of your own searching FIRST.

The point here is that just because you haven't read anything about the subject yet, doesn't excuse your failure to search for the information BEFORE you post here asking someone to do this minimal effort for you.:whoops:

Regards,
disavowed
04-06-2005, 10:09 PM
It's fun to create circular ForwarderChains between DLLs. You get an out of memory error from the image loader.
nikolatesla20
04-11-2005, 09:25 AM
If i'm not mistaken, I believe forwards are used on Win2K and XP to NTdll.dll from Kernel32.dll. In other words, the PE file points to Kernel32.dll, but then in memory you actually get ntdll.dll function calls. Which of course throws off tools that aren't ready for it (ImpREC handles the situation correctly however)

-nt20
disavowed
04-11-2005, 09:19 PM
If i'm not mistaken, I believe forwards are used on Win2K and XP to NTdll.dll from Kernel32.dll.
You are not mistaken ;)

Which of course throws off tools that aren't ready for it
I've actually had good luck with all tools despite this. Perhaps it's because it's really not that difficult to code for (again, as long as you watch for loops).


VB P-code article
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > VB P-code article
PDA

View Full Version : VB P-code article

disavowed
04-07-2005, 01:20 AM
This article is three years old, but I ran into it for the first time just now: http://www.virusbtn.com/magazine/articles/technical/2002/06_01.xml
bilbo
04-07-2005, 02:53 AM
great reading... thanks
bilbo


How to force data into a specific PE section?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > How to force data into a specific PE section?
PDA

View Full Version : How to force data into a specific PE section?

Clandestiny
04-07-2005, 09:11 AM
Hi,

I'm not quite sure which forum this question belongs on, but as its more of a programming related question I posted it here: Admins feel free to move it if its off topic.

Ok, here goes:
I want to force some global data into a specific section in the PE file I'm compiling. By default, it is allocated inline in the .text section which is not what I need. I have examined both the linker and compiler flags but have been unable to find exactly what I'm looking for. Maybe I'm overlooking something?

Thanks,
Clandestiny
Clandestiny
04-07-2005, 09:45 AM
Well, I guess I answered my own question with a bit more research. In case anyone else is curious about the answer too, it is to use the #pragma directive.

#pragma data_seg(".special")

//all data delcarations down here go into the "special" section.

Cheers,
Clandestiny

PS. Admins feel free to delete this thread.
blabberer
04-07-2005, 11:12 AM
what is the language you are using ?? with masm i can say how to create a section
with some specified name and give it specific charecteristics

all you have to do is make another .code section and give it your name like

.code bullshit
db "hello you are my new crap ",0

then with link you specify an option like this

\masm32\bin\Link /section:bullshit,ERW

and assemble it that is all

your new section will be created like this

Memory map, item 14
Address=00402000
Size=00001000 (4096.)
Owner=v8 00400000
Section=bullshit
Type=Imag 01001002
Access=R
Initial access=RWE

00402000 68 65 6C 6C 6F 20 79 6F 75 20 61 72 65 20 6D 79 hello you are my
00402010 20 6E 65 77 20 63 72 61 70 20 00 00 00 00 00 00 new crap ......

oops you answerd your q before me :) anyway may be it is usefull may be not let admins decide :)

004001D0 62 75 6C 6C>ASCII "bullshit" ; SECTION
004001D8 1B000000 DD 0000001B ; VirtualSize = 1B (27.)
004001DC 00200000 DD 00002000 ; VirtualAddress = 2000
004001E0 00020000 DD 00000200 ; SizeOfRawData = 200 (512.)
004001E4 00080000 DD 00000800 ; PointerToRawData = 800
004001E8 00000000 DD 00000000 ; PointerToRelocations = 0
004001EC 00000000 DD 00000000 ; PointerToLineNumbers = 0
004001F0 0000 DW 0000 ; NumberOfRelocations = 0
004001F2 0000 DW 0000 ; NumberOfLineNumbers = 0
004001F4 200000E0 DD E0000020 ; Characteristics = CODE|EXECUTE|READ|WRITE
Clandestiny
04-07-2005, 01:06 PM
Hi blabberer,

I'm writing this in C, but I occasionally use MASM as well. Its good to know how to do in both languages. Thanks for the information.

Cheers,
Clandestiny
doug
04-07-2005, 03:36 PM
check this thread for more info:
http://www.woodmann.com/forum/showthread.php?t=6175&highlight=.org
bilbo
04-08-2005, 03:31 AM
By default, it is allocated inline in the .text section which is not what I need.
Global data in the .text section ??

all data delcarations down here go into the "special" section.
As far as you assign them (e.g. "int aaa = 0;" and not just "int aaa;")

I'm talking about M$VC
Regards, bilbo
Clandestiny
04-08-2005, 09:32 AM
Hi all and thanks for the informative replies...

To Bilbo: This is a driver and I'm using the DDK build utility to compile it. Maybe I wasn't real clear, but there are some strings that get allocated in the .text section and I need to make sure they stay in the .data section (ie. I need to keep data out of the code section). The #pragma seems to be doing exactly what I need although I've filed the MASM and other info away for future reference :D

Cheers,
Clandestiny


Flexible Patcher?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Flexible Patcher?
PDA

View Full Version : Flexible Patcher?

Malakar
04-07-2005, 08:05 PM
I did a search on these forums, but did not find what I'm looking for. However I have a feeling this has been asked before... Sorry about that.

I am looking for a flexible patcher - something like aPATCH which uses a script I write. I've been using aPATCH, but its wildcard searches are not flexible enough. Often times instructions are swapped around in different compilations, so a simple method of a certain number of wildcard bytes will not always work. So I need something that allows a variable number of wildcard bytes. I would also like multiple possibility bytes - for when the same operation has multiple opcodes depending on the register used.

I started to search the web for patchers, but the problem is there are so many of them that do the same simple patching methods. So I came here, where knowledgable crackers are.
evlncrn8
04-08-2005, 12:57 AM
code your own then
diablo2oo2
04-11-2005, 08:54 AM
code your own then

hehe, that was also my first thought.... :devil:

but back to topic:

So I need something that allows a variable number of wildcard bytes

how you mean that? can you explain with an example? :confused:

I would also like multiple possibility bytes - for when the same operation has multiple opcodes depending on the register used.

isnt it possible to use a wildcard for this? :confused:
Manko
04-11-2005, 02:28 PM
Hi!

/.../ I am looking for a flexible patcher /.../
So I came here, where knowledgable crackers are.

Well the problem with many knowledgable crackers are that they have long since stopped using other peoples generic apps and instead write their own patchers/loaders, and have forgotten about those they might have used in the beginning.... Hmm...

I suggest you start learning to code your own too!

It might be some work at first, but it is not THAT difficult, and you will make it if you put in the hours. Some people here will even be MORE willing to help you when you show that you have made some effort yourself. :)

/Manko


what the hell with windows installer
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > what the hell with windows installer
PDA

View Full Version : what the hell with windows installer

ya_humm
04-07-2005, 08:34 PM
Hi,msi passionate and guru.
I didn't always reverse programme based on .inx or .msi.Nowaydays it seemed that windows installer had made some change.The setup.msi would create msi*.dll which contains the serial information,and immediately delete them after check it.And You can log the msi*.dll in filemon,but you can't get it and then disassemble with ida.
So how did you deal with this pb?
disavowed
04-08-2005, 12:27 AM
why not set a breakpoint on DeleteFile(...) and catch the file before it's deleted?
Solomon
04-08-2005, 08:50 AM
use Total Commander with msi plugin to extract the DLL.
JimmyClif
04-08-2005, 10:32 AM
Old trick used to be to break when the dll is created and HBOOT ;)
Kayaker
04-08-2005, 11:11 AM
Old trick used to be to break when the dll is created and HBOOT ;)
Damn sneaky crackers! :D
ya_humm
04-08-2005, 07:37 PM
Old trick used to be to break when the dll is created and HBOOT ;)

Can you explain it detailedly?Thanks in advance.


sentinel
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > sentinel
PDA

View Full Version : sentinel

iamritu
04-07-2005, 08:52 PM
i know for sure that an application is using sentinel licensing. But it doesnt have a dongle. How do i know which version of sentinel it is using. BTW i did get sentinel SSd 1.45 somewhere in the exe. Is it the version and can somebody help me telling more abou it
CrackZ
04-11-2005, 07:07 PM
Hiya,

Seems highly unlikely to me to be v1.45 (v5.41 is probably a better bet).

I'm afraid unless you can actually specify what Rainbow or Sentinel technology is actually in use there is going to be a pretty limited amount of advice anyone can provide you with.

It might well be SentinelLM, but I just haven't a clue from the info you've provided.

Regards

CrackZ.


Hardlock HL-Dump
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Hardlock HL-Dump
PDA

View Full Version : Hardlock HL-Dump

nasty
04-08-2005, 05:03 AM
Hi to all,
i have made a dump, with HL-Dump, of an Hardlock.
After brute the MODAD and dumped, i have now the reg file.
Now how i can use this reg within an emulator? what emulator i need?
Please help if you can.
Thanks a lot
NaSTy
CrackZ
04-08-2005, 04:26 PM
Hiya,

Typically there are a few emulators that your dumped Hardlock data is compatible with. I'm sure sp0raw's own emulator which he can *sell* you should you so wish to *buy* a solution is one such option.

Alternatively some kind soul around the msgboard here (interested in dongle research) may help you out were you to send them the dump.

On a simplistic level, the dump enables fast derivation of the 3 16-bit seeds used by the Hardlock internal algorithm, anyone seriously interested in this should examine exactly what sp0raw's dumper does.

Regards

CrackZ.
scorpie
04-09-2005, 08:06 AM
There is another question, especially to CrackZ.
Hardlock has another protection mechanism called Hardlock Limas. Can the dumper also dump this part, as I have no opportunity yet to have a look Hardlock with the Limas in action.

Bye,
scorpie


Unpacking Intall creator pro
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Unpacking Intall creator pro
PDA

View Full Version : Unpacking Intall creator pro

freakboy
04-08-2005, 02:59 PM
Unpacking Intall creator pro [the best installer in the market imo]

Hi, im new to the board, and to the cr.ing and i would like to
get a ser1al for this program:
link deleted
but the installer is wrapped in upx-like packer [not the program itself],
so i cant see anything in the debugger [im using hiew, windasm and rlzer for making a c.rack]
theres no c.racks/ser1als yet done for this proggy.

could anyone explain how to unpack it or other way to get it patched.
unregistered version displays nag dialog at the end of all installers build with unregistered prog.
thnx.
JMI
04-08-2005, 04:25 PM
Time for your to ACTUALLY READ the FAQ and see what you are allow and not allow to post in these Forums. :whoops: So far, this just looks like a crack request and we don't do that here.

Regards,


Trials, how do they work?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Trials, how do they work?
PDA

View Full Version : Trials, how do they work?

Duke
04-08-2005, 10:11 PM
My question is very basic. How do trial periods work? Where do applications usually store the information on your computer that tells them that the trial has expired? Any suggestions on how to extend trials would also be valuable. I'm not looking to crack the installer at this time, I just want to know how programs handle trial periods. Thanks for any help.
evlncrn8
04-08-2005, 10:49 PM
the answers are too various, theres multiple methods the programs could use, and multiple places they could store the information, and something tells me you probably didnt read the faq at all or bother searching
Duke
04-09-2005, 04:15 PM
I did read it, but i am still a bit confused.
Admiral
04-09-2005, 07:16 PM
The trial system works by saving the date/time at which the application was installed, then comparing this with the current time at runtime (generally at startup).
The data can be stored just about anywhere you can permanently store information. Software authors have been known to use locations as simple as the registry or an ini file and as complex as creating a (not so temporary) tempfile whose CRC can be XORed into a time structure.

Locating these data is generally an impossible task without reverse-engineering the executable in order to find out what it does. Hence removing/extending trial periods is done most often by patching the binary itself rather than locating and editing the installation fingerprint data.
Duke
04-11-2005, 02:24 PM
Thank you, I remember back when things were really simple, like reg settings or ini settings, those were always fun to play with, but I have not seen them in temp files before, i think I'll have to go looking for that. Trying to get back back in the game, well, for me its a game anyhow. I just do it because its fun and challenging, not of any real desire to use such program.
sigint33
04-11-2005, 08:38 PM
Suprisingly a lot of them still keep the time period in the code, do a search for the hex value representing the trial period - in IDA you would search for 1Eh for 30 days, make sure you put a space before the value when searching or you'll get too many hits on code addresses that end in 1Eh, if found it's pretty obvious whether this is an elapsed time section of code.

SiGiNT


Two PE detector,Why two detections?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Two PE detector,Why two detections?
PDA

View Full Version : Two PE detector,Why two detections?

Hero
04-09-2005, 05:05 AM
Hi all
I try a program with two PE tools,PEid and TrId.But I get a strange result:
PEid return file signature as Borland Delphi 3.0,But The highest percent that
TrId returned was PECompact!TrId return Borland Delphi too,but with a ver
low percent.
How this is possible?Because all of program should have special signature,isn't it?
Then Why this strange result will happen?

sincerely yours
Admiral
04-09-2005, 07:26 PM
Packed programs don't have special signatures as such. Different binaries packed with the same packer will generally look quite different, even in the areas that are supposed to be characteristic of the packer in question. This is why TrID gives you a percentage resemblance rather than a concrete answer.

Maybe PECompact is designed with PEiD's algorithm in mind such that its targets are made to look like Borland Delphi 3.0? Then again, maybe it's just a coincidence.
If I were you, I'd Google the result. It's probable sombody has been in this situation before and has succeeded in identifying the packer.
If that fails, I guess you'll have to play around with both possibilities (bearing in mind that it may well be neither) to get a better idea of what stands between you and your target.
MrAnonymous
04-10-2005, 01:54 AM
Packers generally (not always) have a consistant pattern of bytes at the EP, thats one of the ways PEiD detects packers/protectors. I would look at what sections are in the files, and the EP Section. If its a Delphi than the the EP section should be CODE. Disasmble the file, judging by the text strings you should easily beable to see if its packed or not.


Call for dELTA
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Call for dELTA
PDA

View Full Version : Call for dELTA

naides
04-09-2005, 10:34 AM
dELTA,

my spiritual guide. . .
My Norse Hero . . .
My tacit friend. . .

Where are thou?
dELTA
04-12-2005, 03:06 PM
Hehe, have no fear dear padawan, uncle dELTA is just having quite a lot to do at work, and might also have allocated one or two (hundred) hours too much time for his girlfriend lately. His watching eye still sweeps over each and every post on this board though, ready to assist whenever it might be needed. You have grown strong enough in the force to take good care of yourself lately though, so I've mostly just had to watch in content from a distance. ;)

Btw, [imagine really deep voice] naides, I am your father... Ok, not really, but it would have fit the metafor quite good though. :D

To quote a guy from another movie, [imagine german accent] I'll be back... :)
JMI
04-12-2005, 04:40 PM
Honey do this... Honey do that. Soon there is no time left for reversing. ;) :D You have been warned. Of course, some of the alternative activities can be rather pleasant. :devil:

Regards,
disavowed
04-13-2005, 01:18 AM
To quote a guy from another movie, [imagine german accent] I'll be back... :)
austrian, not german ;)
naides
04-13-2005, 05:02 AM
Hehe, uncle dELTA is just having quite a lot to do at work??, and might also have allocated one or two (hundred) hours too much time for his girlfriend lately.

Oh No. . . Master dELTA is. . . ENCOÑADO!
dELTA
04-13-2005, 07:15 AM
Hehe, aren't we all aggravated that there is never enough time... But is it really that surprising to you that I have a job? :p
0xf001
04-13-2005, 08:10 AM
wuhahaha :)

dELTA maybe it is maybe more surprising that you have a girlfriend :devil:

cheers, 0xf001
naides
04-13-2005, 08:41 PM
Hehe, aren't we all aggravated that there is never enough time... But is it really that surprising to you that I have a job? :p

Nop, I know you have a Job.

What I am wondering is what exactly you are working on, right now. . . :devil:


are these down ??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > are these down ??
PDA

View Full Version : are these down ??

blabberer
04-09-2005, 11:27 AM
any news or is any one aware on hf's,hoglunds site also aarons exe tools ?? all are unreachable for me for the past few days ?? kayaker :) hf's mirror was online till yesterday its unavailable tody :(
Kayaker
04-09-2005, 11:57 AM
Hi, I have it on good authority RK will be back, though it may be a few weeks or so.
As of writing, I can still reach the hf site http://rootkit.host.sk/
JMI
04-09-2005, 02:39 PM
As I'm writing this, exetools has been operational over the last several days without interruption. I was on earlier this morning (my time) and am on at the moment without problem.

Regards,
disavowed
04-09-2005, 03:19 PM
supposedly, hoglund posted some stuff on RK to piss off some people, and those people decided to DDoS RK


WinMX Issues
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > WinMX Issues
PDA

View Full Version : WinMX Issues

Silver
04-10-2005, 06:24 AM
Hi all.

Just wanted to get some opinions. I've used WinMX a few times in the past to download perfectly legal, freely distributable files :D . Recently I've noticed I'm totally unable to download anything. I can search, find the files I want (with plenty of sources) and tag them for download. The files go to the transfer window and show as "Initiating network connection" (or similar). Then instead of going green and downloading, they timeout after a few minutes and turn red. This happens on any file, regardless of server area or sources.

So I did a bit of fiddling and a bit of searching, it seems as though a lot of people are reporting the same issue on newsgroups. Some of the reports are junk, but there are a significant number that do appear to be legitimate issues. Unfortunately the normal responses from other usenet posters are along the lines of "you don't know what you're doing, you suck, get a life, stop complaining" etc. There are also a significant number of people reporting that they have no problems at all, which is backed up by the large number of sharers on the network. The usual advice (check firewall, port settings, are you sharing files etc) all don't apply in my case, and I'm confident everything is set up correctly. I am not aware of any changes to my setup between (say) 3 months ago when I could download, and today when I can't.

So a couple of points. Why does WinMX work for some and not others? Why can I search and tag files for download, but they only timeout at the network connection phase? Is there some larger "conspiracy" at work here, with the central WinMX servers under attack? But if so, everyone would be affected. Questions, questions.

Any thoughts?
dELTA
04-12-2005, 03:19 PM
Sounds strange. I haven't used WinMX in a long time myself though. :/ Have you tried to sniff your network traffic to see if there are any incoming packets at all to your network interface when you try to download a file? This might help to find out if the problem is located elsewhere than in your computer (i.e. if you don't get any incoming packets at all, the problem is seemingly upstream, but if you get some packets it is still an open question, but you might still get clues from the network traffic).

Another seemingly too obvious question is also: Are you using the latest version of WinMX? If I'm not mistaken, WinMX is known for making updates that you "have to upgrade to" to be able to continue using the program, since they have often been not backwards compatible.
Woodmann
04-12-2005, 05:56 PM
Howdy,

The latest version (3.53) is a bit of a pain to get configured.
If you are behind a firewall, you will need to shut it off or,
you will need to get some ports opened.
I got it to run but it took 20 mins to make it work with my firewall
shut off.

These file sharers are starting to get picky about how they send and
receive packets.

This is like edonkey ???? I have to disconnect my digital phone
modem to use that service. When I connect to it I can search
and pick my downloads but nothing happens.

Woodmann
bilbo
04-13-2005, 01:03 AM
Another seemingly too obvious question is also: Are you using the latest version of WinMX? If I'm not mistaken, WinMX is known for making updates that you "have to upgrade to" to be able to continue using the program, since they have often been not backwards compatible.
I sometime use ver. 3.3, without upgrading it and without problems.
Regards, bilbo
Silver
04-13-2005, 03:44 PM
dELTA, must confess, I've been too lazy to break out Ethereal. It's the best way to see what's up, you're right. I'm on the latest WinMX version as per their website.

Woodmann, you're right about it being picky but I've had it working before with no issues. As far as I know I've made no changes, but I guess it's possible I altered some "unrelated" firewall rule which has caused the change. I've got everything opened, forwarded and configured as per the docs, one thing I could do is shut the firewall off for a few minutes and see what the results are on an open connection.

What confuses the issue is that I can connect to the network and retrieve filelists from users etc, just not any files. They're not multipoint downloads though, so that may account for the discrepancy.

Cheers for your thoughts.
naides
04-14-2005, 06:16 AM
Suggestions for an experiment:

Use or borrow a laptop (clean, no firewall) , install winMX and connect it through your network connection. See how it performs. If the anomaly is still present, the problem is likely outside your network card. But if the anomaly resolves, then it is something inside your computer. Firewall, network software, etc.
dELTA
04-14-2005, 12:16 PM
And remember not to patch that computer that you put directly on the internet without any firewall too, to rule out the possibility that any of the latest security patches are causing the problem. :p

Anyway, "connecting to the network", and sometimes also getting search results (and in some extreme cases even getting file lists from users) is often done through the initial outgoing TCP connection by P2P filesharing programs, while the file downloads themselves practically always make use of direct connections between the users. Hence, all this first stuff can very well work flawlessly while at the same time the file transfers themselves might be blocked by problems with firewall blocking or port forwarding at some level.

Also, some of these programs are quite unclear in their documentation about the possible fact that they actually use both the TCP and the UDP version of some given port number, and hence it is in these cases quite easy to miss configuring the port forwarding of any hypothetical firewall/router correctly (i.e. missing out on the communication from one of the protocols). Not that any of my first guesses would be that you misconfigured your firewall, but then again we're all only human. :)
naides
04-14-2005, 02:16 PM
A related but different question:

If I have, let's say, a Windows XP running on a VMware virtual machine and the VM Network Interphase Card is running in bridged mode, Does the software firewall of the host system filter, monitor or in any way influence the traffic between the network and the virtual machine??
dELTA
04-14-2005, 02:22 PM
It is usually not protected by personal firewalls, no. Mostly due to the fact that it uses its own protocol driver, i.e. bypasses the normal TCP/IP protocol driver.
naides
04-14-2005, 04:06 PM
In that case, having a Virtual machine, an keeping a snapshot of a fresh windows install could be handy in pinpoint and debugging network problems like these.
dELTA
04-15-2005, 02:35 AM
Yep, not to mention most other computer related problems too. :)
esther
04-18-2005, 01:41 AM
There are some other reasons that there might be some virus /trojans which slows down your connection or blocked by other p2p clients coz they detect you "have" the variants...


How I can inject code in windows CE DLLs or Hook them?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > How I can inject code in windows CE DLLs or Hook them?
PDA

View Full Version : How I can inject code in windows CE DLLs or Hook them?

Hero
04-11-2005, 09:42 AM
Hi all
I don't know that you tried hooking a DLL functions in windows CE or not,but
SetWindowsHookEx is too limited in this windows and I don't know how to use
it for hooking my special function.Do you know how I can do this?
Do you know why I need this?There is an DLL named ril.dll there,and I need add
some feature to RIL_Dial for my special reason.There is two way for this,One is
Hooking and the other one is patching it.Because this is for ARM processor,I can't
find any good and Debugger for it,then patching is too hard.What do you suggest?
Hooking to patch?
Is there any suggestion that how I can do this?

sincerely yours
laola
04-11-2005, 10:16 AM
Even if you hooked a DLL call, do you have access to the matching development tools (i.e. compiler etc.) for the ARM platform? What particular feature would you want to add? Give some more details, as chances are that somebody else might have done similar stuff... You don't have to invent the wheel again and again...

BTW, I'd vote you get a nice part-time job and purchase *cough* *cough* IDA Pro, it's really worth the money. I've had so much fun with it playing around with all kinds of embedded platform and ancient CPU stuff... :D

Nothing better than looking at some classy C64 stuff :devil:


What kind of papers do you want to read today?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > What kind of papers do you want to read today?
PDA

View Full Version : What kind of papers do you want to read today?

CrackZ
04-11-2005, 07:15 PM
Whilst sat here proofreading some of my latest offerings I thought I'd pose the question above and see what areas and topics the 'message board scene' is actually really interested in ;-) and what people are actually working on right now.

It feels to me a lot of the 80's and 90's generation grew up and got day jobs since even the steady supply of 'protections busting tutorials' that Fravia's site thrived on has pretty much dried up it seems.

Anyway, everyones thoughts appreciated.

Regards

CrackZ.
Woodmann
04-11-2005, 08:24 PM
Howdy CrackZ,

I am working on a project that includes access to an internet based license server.
It is not a one time access, it will request access to the license server at random intervals while using the program.
Is it possible to find a "master" registration and serial that would not require access to a license server ?

Woodmann
disavowed
04-11-2005, 09:23 PM
It feels to me a lot of the 80's and 90's generation grew up and got day jobs
The lucky of us got jobs where we're paid to legally reverse engineer :cool:
0xf001
04-12-2005, 03:10 AM
hi crackz,

hmm. dried up. somehow yes and no. i can just speak for myself of course... some years ago it was exciting to read / write articles on protection schemes reversing / cracking, virii. and also to maybe release cracks for software.
this excitement somehow you get used to it and might also search sthg new / or more legal. this might be a reason for reduced articles.
i just can see that there are established channels like phrack, 29a, ... so maybe noone felt the need to setup sthg new. also ie the coderbreakers-journal in my opinion tries to fill the gap. universitas virtualis as well. it seems the new goal is to have quality and profund research.
it might be interesting on the one side to have tuts which are dedicated to targets.
i personally like to read them. somehow such articles are nice but i also somehow think they help somehow more the newbies. and therefor ie this messageboard is a very good ressource. the more advanced topics seem to be tried to be published more seriously and independent from the target.

i definately would like to contribute some articles especially the linux front. but i have some very target specifics where i do not know how to best publish it. if i publish it with details i can not use my nick ;) if i do not publish all, it is half the fun. maybe more ppl have this problem :) ?

somehow also there are tons of RE sites now, even recent paper magazines catch the train. in the last 3 standard linux magazines, hakin9, ... everywhere "a demo RE session" described. honeynet scan of the month 32,33 topic: reverse engineering.

it might be worth to channel the powers and make a more central place to find tuts. but how to compete with the different RE sites spread all over the globe who offer tuts?

if such an action is beeing taken i want to join! and add a section linux if possible.

i would contribute cracking tuts for some linux protections (and 1 extremely hardcore) hehe.
also i work on different RE topics on linux, where i could share some things.

what is the plan? :)

cheers 0xf001


Audio waves Reverse Engineering
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Audio waves Reverse Engineering
PDA

View Full Version : Audio waves Reverse Engineering

bilbo
04-12-2005, 06:20 AM
Does anyone knows if there is some tool to reverse an audio wave?

Suppose I have a .WAV with a song with some voice, some guitar, some bass and some percussions.
May I obtain back the single tracks from the wave, or is it an impossible task?

By the way, what is the algorithm to mix the tracks? Simply addition, followed by volume normalization?
Sorry if my questions are rather naive...
bilbo
0xf001
04-12-2005, 06:45 AM
hi bilbo!

what you are asking for is quite an advanced task. and "reversing" a wav is not easy, technically not 100% IMpossible, very much depending on your wav.

if you want to extract single "tracks" then you have some possibilities. i would recommend a good wav editor to you. like soundforge. or cool edit pro.

there are filters that ie filter by the panning of the signal amount. ie all that is plain in the middle can be filtered out. this is useful to find / extract voices. but depends on your wav.

you always have to cut out several ranges of the frequency spectrum afterwards ie normal equalizing (poor) or some configurable 24dB low|high|bandpass|bandblock filters.

a maybe better way to easily come to at least some result is to use cool edit pro's noise reduction filter.

you can mark an area of your wav, and generate a "noise profile" of it. that gives a frequency spectrum of that part. if you choose a part where there is only percussions then you will have the freq spectrum of "only percussions".

you can use this noise profile then and apply it to the whole wav. you can say either to cut out the profile or all else. meaning you get only the percussions, or all else.

please do not expect too good results. i sometimes was able to extract voices, but you need to remaster them. usually the frequency spectrum overlaps for the several "tracks" so you will never get a perfect result.
you can also work with compressors which wipe out all signals below a certain level etc. usually quite a komplex chain of different processing is required.

but try cool edit it might give you some quick success.

to mix, yes add them and normalize, the question is how (hopefully not in 16bit space) hehe :)

hope this helps as a quick start,

cheers, 0xf001
disavowed
04-12-2005, 10:44 AM
You may also want to consider searching for a midi of the song, which you can rip tracks out of directly.
bilbo
04-13-2005, 01:00 AM
Thanks, 0xf001 you told me some useful hints for a newbie like me...
I tried Noise Profile trick (FFT profiling) and FFT filtering with different windowing types (it seems that there are many algorithm for FFT filtering!)... the results are anyway not excellent, as you wrote...

I will also try to play with some direct sound manipulation and some simple program written by me, using maybe some sound manipulation package...

disavowed, your suggestion is like cheating! I was referring to some analogic sound obtained by mixing different instruments and voices and I was wondering if the mixing operation is really irreversible. Thanks anyway.

bilbo
laola
04-13-2005, 04:24 AM
Well, in theory it can be done but looking at the practical side shows that the amount of work is just more than insane. Mixing various audio sources into one result audio stream causes practically irrevocable overlappings and extinctions. In theory, you might FFT and get a complex system of equations which you just have to solve to get back (almost) the individual streams, but alas, quantum computers will be needed for this :D A poor but understandable comparison might be mixing paint... in theory you can separate the different paints again to get the individual colors back, but there is no practical way of separating them (don't come up with suggestions about making use of the different physical characteristics of the color molecules!) :D
0xf001
04-13-2005, 08:12 AM
hehe,

good comparison laola!

cheers, 0xf001
naides
04-13-2005, 09:43 AM
a complex system of equations which you just have to solve to get back (almost) the individual streams, but alas, quantum computers will be needed for this :D

I friendly disagree. The human brain, for once, is able to abstract sounds from a complex, analog stream, like talking to someone in a rather noisy environment, you are able to clearly follow the other persons voice, and suppress the background. Also, a trained musician can focus on, and follow an individual instrument, even when the whole orchestra is playing simultaneously. The brain is not, as far as we know, a quantum computer.

The process of deconvoluting a complex stream of signal into the individual elements that generated it is routinely performed by computers. MRI and Echography imaging are good examples. Mass spectroscopy data is analyzed in this fashion.
0xf001
04-13-2005, 09:58 AM
naides,

i friendly disagre, too :)

the human brain can not filter in respect to get this part out. it can recognize and interpolate. this is a difference. in order to do the same thing with digital sound you have to
use another approach, we want to "extract" from a wav (also you can not hear a wav file, you can do some maths with it) hehehe :)

> and suppress the background.

that is what i mean. it does not suppress the background. it is always present.

regards, 0xf001
laola
04-13-2005, 10:02 AM
Well, okay, let me rephrase that "quantum computer" issue: You will need enormous computing power to get reasonable results. As you are mentioning mass spectroscopy and MRI... data of this kind is usually processed on computers that are very specialised and have much more computing power than a common PC :) Accepting your comment, let me cut a long story short: In theory it CAN be done but it doesn't really make sense because it is too much effort. Neither a trained musician nor the human brain will deliver the desired output bilbo asked for and I don't think he will buy a super computer to retrieve the original audio streams from the mixer result :D
Okay now? :beer:
naides
04-13-2005, 11:32 AM
I owe you a pint of Guinness
Woodmann
04-13-2005, 02:07 PM
Howdy,

This is in deed one of those things that can be done but,
at what cost.

You could take a look at some of the stuff Cakewalk has.
Other then that, you will need to invest some serious money
to do what you desire. ($12,000-$15,000 US dollars)

Woodmann
gabri3l
04-13-2005, 02:28 PM
You might find this article interesting: hxxp://www.soundonsound.com/sos/sep04/articles/qa0904-7.htm

In theory a waveform added to its inverse will cancel out. So if you happened to have the waveform of just the guitar in a song you could create the inverse of that and apply it to the original song thus removing the guitar. The problem is that the original waveform usually doesnt exist. Thats where the math and quantum computer comes in. :)

sort of off topic but an interesting article from a while back on removing digital watermarks from music:
hxxp://www.usenix.org/events/sec01/craver.pdf
laola
04-13-2005, 02:35 PM
I owe you a pint of Guinness
Sounds cool ;)
I'd suggest we all go over to the pub and first round is on me :D


ACI 2005 (C) [Armadillo Code Injection]
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > ACI 2005 (C) [Armadillo Code Injection]
PDA

View Full Version : ACI 2005 (C) [Armadillo Code Injection]

tenketsu
04-13-2005, 01:03 AM
Armadillo, compendio de - Tomo I
How to unpack & inject code to armadillo & how to defeat the armadillo expiration system

Armadillo, compendio de - Tomo II
How to unpack & inject code to armadillo with nanomites, no CopyMemII

Download
http://www.geocities.com/tlatoanimt002/ArmadilloTomoI.zip
http://www.geocities.com/tlatoanimt002/ArmadilloTomoII.zip

Mirror
http://softcomx.spymac.net

Spanish only, sorry =(

Wait for III & IV
NeO
04-15-2005, 12:08 AM
I will rather w8 if someone will translate this to eng.I wouldnt like to learn spanish now so i would be able to read it ...

By the way good work anyway tut looks very good as your privious 2..
Keep a good work

Bye
fly
04-15-2005, 03:43 AM
good work
Snowski
04-16-2005, 05:25 PM
I do speak very little spanish...will try to rewrite the tut and post it somewhere.

Thanks, this might help. :)
JohnWho
04-19-2005, 10:11 AM
Thanks for the tut tenketsu!

I have succesfully inline patched older versions of Armadillo but the target i'm working on now is using version 3.78 which uses sh!t loads of selfmodifying code shortly after EP, so the VirtualAlloc CALL's isn't hardcoded!

Is there any easy way to get the bytes after VirtualAlloc patches? I'm not asking for the solution, rather some hint's :)

The way i'm proceeding now is gonna take like forver as i have to patch an address shortly after EP to jump to my cave which will patch next present address etc. etc. and there's extremely many patches that have to made!

JW.
Snowski
04-19-2005, 10:31 AM
I know there are a few people who have successfully unpacked Arma 3.78 with the Olly script..have you tried that?

_http://ollyscript.apsvans.com/showScript.php?id=75

Also, if you ID'ed your target with PEiD, and it says version 3.78, it could also be version 4.XX...as is the case in a target that I am trying to unpack at the moment.

Hope that helps ya..! :)
JohnWho
04-19-2005, 10:38 AM
Thanks for the reply bro :)

I know this is the packing/unpacking forum but i sneaked in my post as it was regarding to the tenketsu tutor!

The thing is that i'm not really into unpacking stuff, i like to patch :)

P.S. could you PM me a link to the app your working on, would like to check it out!
tenketsu
04-19-2005, 10:26 PM
I have succesfully inline patched older versions of Armadillo but the target i'm working on now is using version 3.78 which uses sh!t loads of selfmodifying code shortly after EP, so the VirtualAlloc CALL's isn't hardcoded!
JW.

The only self-modifying code [EP] that I have seen is

The EP this in .adata, this code *decrypt* the code of the section .text [static way], you can copy the code *decrypted* of .text and change the EP

This case is discussed in the tome III
JohnWho
04-20-2005, 09:36 AM
Thanks for your input, it's really appreciated :)
Snowski
04-20-2005, 10:18 AM
The only self-modifying code [EP] that I have seen is

The EP this in .adata, this code *decrypt* the code of the section .text [static way], you can copy the code *decrypted* of .text and change the EP

This case is discussed in the tome III

Tomo III...? Great...where can I find it? :)
tenketsu
04-20-2005, 10:53 AM
Tomo III...? Great...where can I find it? :)

In this thread [first post], maybe... 4 or 6 days
Snowski
04-22-2005, 11:04 AM
Can you tell me if one of your tuts (TOMO III or TOMO IV) will discuss a case of COPYMEM II + Nanomites?

I think my target has that...and I can not get to OEP in the son or child process.

BPX WriteProcessMemory will break, and first writes two bytes (EB FE) and on the second break it writes another 2 bytes (60 E8). After that, it will write in 1000 byte sections.

I have separated the child from the parent, fixed the loop, but can not locate OEP.
tenketsu
04-22-2005, 06:28 PM
Can you tell me if one of your tuts (TOMO III or TOMO IV) will discuss a case of COPYMEM II + Nanomites?

Tomo III: CopyMemII + Nanomites

Tomo IV: CopyMemII + Nanomites + CodeSplicing + IATScrambler

Tomo V: Reversing Armadillo 4.10
Snowski
04-22-2005, 07:08 PM
Excellent....looking forward to the final release....thanks! :)


Impossible Protection?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Impossible Protection?
PDA

View Full Version : Impossible Protection?

vikingp
04-14-2005, 01:04 AM
After days and nights of failing and failing... I wonder :-/ , can this be reversed???
Maybe, since none has made a working keygen beside the single one Snowpanter made some years ago. But for a older version of this software!

The software generate a key with 192 Characther based on a Cd key, then gives u a user code based on username (also cd key i think), then it want a user password back based on the cd key, username and usercode...
Also, the cd key is version based, and type (Student, Base, Full)!

Kanal 2.82 plugin for PEiD shows 9 crypto signatures: :thinking:
Blowfish [sbox]
CRC32
CryptCreateHash [Import]
CryptDecrypt [Import]
CryptEncrypt [Import]
CryptHashData [Import]
MD2 [Char]
PI fraction (NIMBUS / BLOWFISH)

PEiD Gives:
Detecded: Microsoft Visual C++ 7.0 [Debug]
Entropy: 6.32 (Not Packed)
EP Check: Not Packed
Fast Check: Not Packed

So... How does it look?? Can this be done?
Surely some good reverser/cracker can fix this. But since no one has bother to make a keygen to this verry nice cad/architect software... I had to make a try... Haven't done this in years now so lot's of this encryption is new to me.

So my big question is... Is there any easy solution?

Since i'm not sure about this forums rules (couldn't find it :)) i haven't posted any information about what software this is.
If anyone is curious or simply would like to test this software pm me.

Ahh.. :whoops: There was the faq!
0xf001
04-14-2005, 02:57 AM
hi,

i think this is not uncommon situation. i ie discovered once a very similar type of protection (that was "layer 1" of it) also on linux.
i thought it is impossible (as there were so many layers, keys and algos involved), the trick was to turn the checking routine against itself.
in my case i was able (after a really long (3 weeks nearly every night)) to identify one part where the comparison for this first check is done. there were multiple license modes involved which made it harder to find ...

if the check is only needed for verification, you might really patch it to accept any code.
that works well, but if the code is used to build a decryption key for an ie encrypted SW installation archive you can not do it this way.

try to find this comparison. in my case i was lucky to print out the expected bytes by patching the installers code verification by inserting printf("%2X ", c) calls. it might not be easy, but the only tip i can give is really try to find the verification of your entered string (what is quite a standard approach) :idea:

cheers, 0xf001
vikingp
04-14-2005, 11:49 AM
Need something to do the next couple of weeks then :D

So this is quite a good protection then? Maybe that's why nobody has made a keygen to this then! It's really a damn good software that peoples are crying after all around the net.

Anyway, here is what i have come up with. Can anybody make some coment on this? Would help me a lot. Also some good tips on how to bypass or reverse. Don't need a tutorial, just a simple tip!

I guess a good thing to know is that the cd key is xxxxxxx-xxxxxxx.

When putting a break on GetDlgItemTextA OllyDbg pops, and after a couple of Ctrl-F9 i get back inside my software module.

->My first part of cd key is 5A6BCDE.

00AD7E6A |. 8BC6 MOV EAX,ESI -> ESI=09C17B78, (ASCII "5A6BCDE") EAX=00000007
00AD7E6C |. 8D50 01 LEA EDX,DWORD PTR DS:[EAX+1]
00AD7E6F |. 90 NOP
00AD7E70 |> 8A08 MOV CL,BYTE PTR DS:[EAX]
00AD7E72 |. 40 INC EAX
00AD7E73 |. 84C9 TEST CL,CL
00AD7E75 |.^75 F9 JNZ SHORT APPZ_Name.00AD7E70 ->Loop.

Here it takes my cd key and runs every characther trou this funktion, Left To Right.
Since it's stores my key up CL i guess its before the verification? Right?

After last characther and it has passed a zero value true the function it passes on.

00AD7E77 |. 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14]
00AD7E7B |. 2BC2 SUB EAX,EDX
00AD7E7D |. 50 PUSH EAX
00AD7E7E |. 56 PUSH ESI
00AD7E7F |. E8 9CA993FF CALL APPZ_Name.00412820

Stepping into the call:
Did just copy some part of my function window. Can my verification be in here?
Or have the verification already been done?

00412820 /$ 53 PUSH EBX
00412821 |. 8BD9 MOV EBX,ECX
00412823 |. 8B53 18 MOV EDX,DWORD PTR DS:[EBX+18]
00412826 83FA 10 CMP EDX,10 ->App is Version 10, could this be a version check?
00412829 |. 56 PUSH ESI
0041282A |. 57 PUSH EDI
0041282B |. 72 05 JB SHORT APPZ_Name.00412832
0041282D |. 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4]
00412830 |. EB 03 JMP SHORT APPZ_Name.00412835
00412832 |> 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4]
00412835 |> 8B7424 10 MOV ESI,DWORD PTR SS:[ESP+10]
00412839 3BF0 CMP ESI,EAX -> Cmp my cd key with EAX
0041283B |. 72 34 JB SHORT APPZ_Name.00412871
0041283D 83FA 10 CMP EDX,10
00412840 |. 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4]
00412843 |. 72 04 JB SHORT APPZ_Name.00412849
00412845 |. 8B08 MOV ECX,DWORD PTR DS:[EAX]
00412847 |. EB 02 JMP SHORT APPZ_Name.0041284B
00412849 |> 8BC8 MOV ECX,EAX
0041284B |> 8B7B 14 MOV EDI,DWORD PTR DS:[EBX+14]
0041284E |. 03F9 ADD EDI,ECX
00412850 3BFE CMP EDI,ESI
00412852 |. 76 1D JBE SHORT APPZ_Name.00412871
00412854 |. 83FA 10 CMP EDX,10
00412857 |. 72 02 JB SHORT APPZ_Name.0041285B
00412859 |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
0041285B |> 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14]
0041285F |. 51 PUSH ECX
00412860 |. 2BF0 SUB ESI,EAX
00412862 |. 56 PUSH ESI
00412863 |. 53 PUSH EBX
00412864 |. 8BCB MOV ECX,EBX
00412866 |. E8 C5FEFFFF CALL APPZ_Name.00412730
0041286B |. 5F POP EDI
0041286C |. 5E POP ESI
0041286D |. 5B POP EBX
0041286E |. C2 0800 RETN 8
00412871 |> 55 PUSH EBP
00412872 |. 8B6C24 18 MOV EBP,DWORD PTR SS:[ESP+18]
00412876 83FD FE CMP EBP,-2
00412879 |. 76 07 JBE SHORT APPZ_Name.00412882
0041287B |. 8BCB MOV ECX,EBX
0041287D |. E8 AE568C00 CALL APPZ_Name.00CD7F30
00412882 |> 8B43 18 MOV EAX,DWORD PTR DS:[EBX+18]
00412885 3BC5 CMP EAX,EBP
00412887 |. 73 1B JNB SHORT APPZ_Name.004128A4
00412889 |. 8B53 14 MOV EDX,DWORD PTR DS:[EBX+14]
0041288C |. 52 PUSH EDX
0041288D |. 55 PUSH EBP
0041288E |. 8BCB MOV ECX,EBX
00412890 |. E8 1B95FFFF CALL APPZ_Name.0040BDB0
00412895 |. 85ED TEST EBP,EBP
00412897 |> 76 68 JBE SHORT APPZ_Name.00412901
00412899 |. 837B 18 10 CMP DWORD PTR DS:[EBX+18],10
0041289D |. 72 2F JB SHORT APPZ_Name.004128CE
0041289F |. 8B7B 04 MOV EDI,DWORD PTR DS:[EBX+4]
004128A2 |. EB 2D JMP SHORT APPZ_Name.004128D1
004128A4 |> 85ED TEST EBP,EBP
004128A6 |.^75 EF JNZ SHORT APPZ_Name.00412897
004128A8 83F8 10 CMP EAX,10
004128AB |. 896B 14 MOV DWORD PTR DS:[EBX+14],EBP
004128AE |. 72 0F JB SHORT APPZ_Name.004128BF
004128B0 |. 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4]
004128B3 |. 5D POP EBP
004128B4 |. 5F POP EDI
004128B5 |. C600 00 MOV BYTE PTR DS:[EAX],0
004128B8 |. 5E POP ESI
004128B9 |. 8BC3 MOV EAX,EBX
004128BB |. 5B POP EBX
004128BC |. C2 0800 RETN 8
004128BF |> 5D POP EBP
004128C0 |. 8D43 04 LEA EAX,DWORD PTR DS:[EBX+4]
004128C3 |. 5F POP EDI
004128C4 |. C600 00 MOV BYTE PTR DS:[EAX],0
004128C7 |. 5E POP ESI
004128C8 |. 8BC3 MOV EAX,EBX
004128CA |. 5B POP EBX
004128CB |. C2 0800 RETN 8
004128CE |> 8D7B 04 LEA EDI,DWORD PTR DS:[EBX+4]
004128D1 |> 8BCD MOV ECX,EBP
004128D3 |. 8BC1 MOV EAX,ECX
004128D5 |. C1E9 02 SHR ECX,2
004128D8 |. F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS>
004128DA |. 8BC8 MOV ECX,EAX
004128DC |. 83E1 03 AND ECX,3
004128DF |. F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[>
004128E1 |. 837B 18 10 CMP DWORD PTR DS:[EBX+18],10
004128E5 |. 896B 14 MOV DWORD PTR DS:[EBX+14],EBP
004128E8 |. 72 10 JB SHORT APPZ_Name.004128FA
004128EA |. 8B43 04 MOV EAX,DWORD PTR DS:[EBX+4]
004128ED |. C60428 00 MOV BYTE PTR DS:[EAX+EBP],0

Am i eaven close to be on the right track here?
I am new to this and can't say i can see straight up what all this code does.

And if any one who feel's good enough to have a wack on this software, i'll be happy to share. As loong as i get some feedback/help :yay:

Sorry if my english suck, so no jokes about it! :D
0xf001
04-15-2005, 02:12 AM
hi vikingp,

cool you dig into it hehehe :yay:

> So this is quite a good protection then?

well the actual implementation will show this, the principle is quite standard imho

this part ....

00AD7E6A |. 8BC6 MOV EAX,ESI -> ESI=09C17B78, (ASCII "5A6BCDE") EAX=00000007
00AD7E6C |. 8D50 01 LEA EDX,DWORD PTR DS:[EAX+1]
00AD7E6F |. 90 NOP
00AD7E70 |> 8A08 MOV CL,BYTE PTR DS:[EAX]
00AD7E72 |. 40 INC EAX
00AD7E73 |. 84C9 TEST CL,CL
00AD7E75 |.^75 F9 JNZ SHORT APPZ_Name.00AD7E70 ->Loop.

right this runs through your code. it does not compare anything. it goes until your code byte (first "5", then "A", then "6", "B", ... ) equals to 0. Meaning it goes to the end of the string.
It might then check if the length (number of entered chars) is correct, or needs the pointer to the end of the string elsewhere.

00AD7E77 |. 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14]
00AD7E7B |. 2BC2 SUB EAX,EDX

like here above: EAX ist still your start of string and EDX was setup as DWORD PTR DS:[EAX+1]. this might be for some check of the different parts of the string.

you are on the right track ;)

imho what will follow in the code is that it takes several parts of the string and lets it run through some maths. what I would recommend to you is to step through the following part of code and carefully singlestep it.

write everything down that may be of interest. give your variables names. you can use a disassembler that helps with naming, or simply copy/paste the code to an editor and do it there. inspect the contents of the registers. all guesses you might have, comment them - as you allready did.
go line by line until (maybe a few tens of times) until you figure what is going on. you might not need to understand all immediatley.
go through the code and in the first run do not step into subroutines. just let them execute and compare the registers before and after the call. try to interpret a little what the ppl who wrote the SW want to achieve and in tht context what the functions might do.
most of it will be taking parts of strings and messing them up with other parts of the string, other keys, ... so it is important to verify all the involved pointers.

i hope this helps,

cheers, 0xf001
vikingp
04-15-2005, 03:32 AM
Thx 0xf001!
Nice to see that i might be on the right track!
I will try your sugestion, on writing everything down and commenting them.
Forcing the brain to think :D

Yea, that did help! Atleast on my spirite :yay:

Thx, once again!
vikingp
04-15-2005, 05:06 AM
After running a few more steps i get some strange info in dump.
Could this be of any use?
______________________________________________________
0091ACEA |. 8B46 04 MOV EAX,DWORD PTR DS:[ESI+4]
0091ACED |. 8B48 04 MOV ECX,DWORD PTR DS:[EAX+4] ; Appz_name.00DCAC10
______________________________________________________
Stack DS:[00120908]=00DCAC10 (Appz_name.00DCAC10)
ECX=7C91056D (ntdll.7C91056D)
______________________________________________________
Value In dump (ascii):
00DCA638 HX@par != NULL..\source\sup
00DCA678 rroom.cpp...rP->sequence < rmSize...rP->sequence < size._key.siz
00DCA6B8 e() % 4 == 0...._key.size() > 12.....\source\blowfish.cpp..._key
00DCA6F8 .length() % 4 == 0.._key.length() > 12..encryptedData.size() ==
00DCA738 lSize...AccessCheck() failed with error %lu.....ÿÿÿÿ....u‘.Ônä.
00DCA778 Pž‘.dn.0ž‘.ðÍž.ðÍž.°È|.°È|.wizard != NULL...\source\regwiz.cpp.
00DCA7B8 oä.PŸ‘.*‘.°Ÿ‘..±‘.ð¤‘.0´‘.°È|.doä.à«‘.ÐÂ‘.®‘.ðÍž..®‘.pG’.°È|.
00DCA7F8 ¬oä..¬‘.Ð‘.ð¸‘.ðÍž.ðÍž.M’.°È|.ôoä. ¬‘.à»‘.@Ã‘.*©‘.ðÍž.€U’.°È|.
00DCA838 <pä.@¬‘.*Y’.€V’.ðÍž.€’.°È|.ž‘.DefCompany..DefName.Software\Mic
00DCA878 rosoft\MS Setup (ACME)\User Info....encrypted User Informati....
00DCA8B8 c:\autobuild 10.0\source\source\Secure.h....Ppä.à"’.pŽ«.à•A.0–A.
00DCA8F8 –A.Â¬.ÐÂ¬.°«.à–A.....dpä.*•A.`"’.p×K.b.@ ½.Ðú¼.*T¼.õ¼.pùÃ.
00DCA938 Ðõ¼.pùÃ.Ð¨Å.Ðp¼.ðp¼..¬.0”A.P”A.`˜A.*p¼.°p¼.Ý¼.*Ü¼.àÜ¼.àÕ¼..Ö¼.
00DCA978 `”A.°_i.p”A.0Ý¼.Ý¼.”A.@p¼.àn¼.@u¼.ð”A..•A.•A.Ðà¼. •A.0•A.€n¼.
00DCA9B8 *n¼.rÁ.@•A.p×K.b.*RŒ.pÏ|..x¼.àÝ¼..Þ¼.`à¼.P•A. á¼.€á¼. â¼.€â¼.
00DCA9F8 *˜A.Pr¼.`•A.`y¼.Ðy¼.Px¼.y¼.0y¼.*RŒ.@ß¼.ß¼.q¼.Pq¼.°¬¼..*¼.P~¼.
00DCAA38 ps¼.s¼.€r¼..U¼.°r¼.t¼.pt¼.*t¼.€U¼.€•A.àå¼.0ä¼.*×¼.`ä¼.ç¼.pç¼.
00DCAA78 *ç¼.Ðç¼..è¼.ðî¼.•A.à×¼.°{¼.`{¼.0ë¼. q¼.@q¼.°z¼.z¼.`z¼.°ó¼.@|¼.
00DCAAB8 `}¼..|¼.ÐU¼. ¼.0è¼.ðy¼.ÐË¼.°Ê¼.°¨^. v¼.P€¼.0£O.*Ð¼.ðÌ¼.Pw¼. ¼.
00DCAAF8 ðW¼.0²¼.€³¼.0º¼.°¼.°ýD.P*¼.pV¼.ðÍž. X¼. #’.€º¬.PX.*RŒ.Ø¬.NP.
00DCAB38 p"’.#’. ,’.à¹¬..º¬.*RŒ.°ýD.*RŒ.€"’.@Xz.à*.³A.PX."’.p¿¬.ÐD~.
00DCAB78 ÐD~.ÐD~.*"’..#’.*RŒ.0»¬.p¿¬.p¿¬.°"’.p¿¬.À"’.pÏ|.ðÍž.Ð–A.¿¬.0¿¬.
00DCABB8 P¿¬.Ð"’.*RŒ.p¾¬.*RŒ.*RŒ.°×¬.pÏ|.°È|.Ð#*.Èpä.PÁ‘.@–V.À–V.°ýD.Ð™‘.
00DCABF8 NP.PŒV.`©V.*©V.°©V.°V.üÿÿÿð......Emergency:..e+../cgi-bin/reg
00DCAC38 ister8?.AL8MNFR432EGHQXK015679SPYTUWDB...\source\secrutil.cpp...
00DCAC78 outSize > strlen(in)/2..num == 0........)
lostson
04-20-2005, 08:31 AM
hiho...

00DCABF8 NP.PŒV.`©V.*©V.°©V.°V.üÿÿÿð......Emergency:..e+ ../cgi-bin/reg
00DCAC38 ister8?.AL8MNFR432EGHQXK015679SPYTUWDB...\source\s ecrutil.cpp...

seems like it uses an online check for verification... the cgi-script may indicate that.

just my two cent... :)
regards,
vikingp
04-20-2005, 11:00 AM
Ok! yes it tryes to connect to internet for download of user information based on the cd-key.
Btw, i'm totaly stuck on this! Have tested and tested, and tryed to follow 20-30 tutorials based on different encryption.
So if anyone has some time to spend on this i'll be happy to share this software. Just PM me.


New Anti-debug protection?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > New Anti-debug protection?
PDA

View Full Version : New Anti-debug protection?

br00t_4_c
04-14-2005, 06:38 AM
Recently reported security vulnerability in multiple debugging platforms (Olly, Windbg, etc -see hxxp://www.security-assessment.com/Whitepapers/PreDebug.pdf for further details) seems to present some interesting possibilities for anti-debugging protections. A protection of this nature could probably be easily circumvented by placing breakspoints on module loads, but might be a worthwhile trick to add to the anti-debugging arsenal?? Has anyone seen this implemented yet? I've looked around and haven't found much of anything.

Actually, let me clarify: this paper seems to provide us with a means of better hiding standard anti-debug protections and other nastiness.
disavowed
04-14-2005, 09:54 AM
A protection of this nature could probably be easily circumvented by placing breakspoints on module loads
If you mean checking the "break-on-module-load" checkbox in OllyDbg, then no, that doesn't apply to DLLs in the IT. They're loaded into memory before Windows passes control to OllyDbg.

If you mean scanning the IT for DLLs and placing a breakpoint at the EP of each file on disk, then yes, that would work as long as you have JIT-debugging set up appropriately. However, this is problematic when it comes to DLLs that are already in use (like kernel32.dll) and can't easily be modified on disk. But in such situations, you can use side-by-side (SxS) DLLs.
blabberer
04-14-2005, 10:14 AM
if i recall correctly ricardo narvaja had a challenge that actually caused a dll to be executed before reaching entry point and it was discussed in ollydbg forum long ago i think error 11 some thing is the topic title

hold on ill post the link

http://ollydbg.win32asmcommunity.net/index.php?action=vthread&forum=1&topic=576&page=0#29

yes LdrLoadDll on its way to debugger executes an init routine in every
dll that it loads

you can find what is the init routine of every program
if you enable LDR_SHOW_SNAPS (using what he mention Execution options)
or using gflags or its clones ( i wrote a half plugin dll to enable these flags in olly but kinda dropped it :)

here is the debug print
Log data, item 0
Address=77F9FA77
Message=Debug string: C:\WINNT\system32\KERNEL32.DLL init routine 77e8c3d8

it gets these option by this function in loader then goes
to execute the init routine

77F9985D PUSH EBX ; /Arg6 = 00000000
77F9985E PUSH 4 ; |Arg5 = 00000004
77F99860 LEA EAX, DWORD PTR SS:[EBP-24] ; |
77F99863 PUSH EAX ; |Arg4 = 000732A4
77F99864 PUSH 4 ; |Arg3 = 00000004
77F99866 PUSH ntdll.77F9979A ; |Arg2 = 77F9979A
77F9986B LEA EAX, DWORD PTR DS:[ESI+2C] ; |
77F9986E PUSH EAX ; |Arg1 = 000732A4
77F9986F CALL ntdll.LdrQueryImageFileExecution>; \LdrQueryImageFileExecutionOptions

77F8E715 PUSH DWORD PTR SS:[EBP+8] ; /Arg4 = 00000000
77F8E718 PUSH 1 ; |Arg3 = 00000001
77F8E71A PUSH DWORD PTR DS:[ESI+18] ; |Arg2 = 77D40000
77F8E71D PUSH EDI ; |Arg1 = 77D43958
77F8E71E CALL ntdll.LdrpCallInitRoutine ; \LdrpCallInitRoutine

Log data
Address Message
77F9FA77 Debug string: LDR: RPCRT4.DLL loaded.
77F9FA77 Debug string: - Calling init routine at 77d43958

well as far as the other hack is concerned does he mention about
windows file protection problems one might encounter when replacing a system dll ?? ( i did not read throughly sorry if i didnt grasp some thing correctly )

regards
laola
04-14-2005, 10:19 AM
Replacing a system DLL is not necessarily required, in addition there are tools to disable WFP programmatically. I haven't had the time to see how they do it but I guess it is just as easy as disabling the stupid warning about unsigned driver installations :D
blabberer
04-14-2005, 10:25 AM
hehe the question here is not about disbaling it or forcing it :) i know it can be done i am meaning a specially crafted malware which would be able to do it on the fly by the proposed vulnerabilities how easy or hard is it thats the question :)
ok i reread it again it seems he is hexing a malware dll in the iat of compiled app so actually he isnt replacing any system dll :( sorry for dud question
blabberer
04-14-2005, 10:46 AM
no actually placing a single break point in ntdll LdrInit blah suffices to get the entry point of all dlls disawoved ( break on modules wont break) but you can break on the first executed code of init from any dll if you place a break on ntdll inti routine
here i paste log of all breaks that i get before ep is reached from iczelions messagebox.exe (tut -02)

Log data
Address Message

File 'C:\masm32\ICZTUTES\TUTE02\tut02\msgbox.exe'
New process with ID 00000278 created
00401000 Main thread with ID 000003E8 created
77F9FA77 Debug string: LDR: PID: 0x278 started - '"C:\masm32\ICZTUTES\TUTE02\tut02\msgbox.exe"'
77F9FA77 Debug string: LDR: NEW PROCESS
77F9FA77 Debug string: Image Path: C:\masm32\ICZTUTES\TUTE02\tut02\msgbox.exe (msgbox.exe)
77F9FA77 Debug string: Current Directory: C:\masm32\ICZTUTES\TUTE02\tut02\
77F9FA77 Debug string: Search Path: C:\masm32\ICZTUTES\TUTE02\tut02;.; snip
77F9FA77 Debug string: LDR: KERNEL32.dll used by msgbox.exe
77F9FA77 Debug string: LDR: KERNEL32.dll bound to NTDLL.DLL
77F9FA77 Debug string: LDR: KERNEL32.dll has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: Snapping imports for msgbox.exe from KERNEL32.dll
77F9FA77 Debug string: LDR: USER32.dll used by msgbox.exe
77F9FA77 Debug string: LDR: USER32.dll bound to NTDLL.DLL
77F9FA77 Debug string: LDR: USER32.dll has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: USER32.dll bound to KERNEL32.DLL
77F9FA77 Debug string: LDR: USER32.dll has correct binding to KERNEL32.DLL
77F9FA77 Debug string: LDR: USER32.dll bound to NTDLL.DLL via forwarder(s) from KERNEL32.dll
77F9FA77 Debug string: LDR: USER32.dll has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: USER32.dll bound to GDI32.DLL
77F9FA77 Debug string: LDR: GDI32.DLL bound to NTDLL.DLL
77F9FA77 Debug string: LDR: GDI32.DLL has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: GDI32.DLL bound to KERNEL32.DLL
77F9FA77 Debug string: LDR: GDI32.DLL has correct binding to KERNEL32.DLL
77F9FA77 Debug string: LDR: GDI32.DLL bound to NTDLL.DLL via forwarder(s) from KERNEL32.dll
77F9FA77 Debug string: LDR: GDI32.DLL has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: GDI32.DLL bound to USER32.DLL
77F9FA77 Debug string: LDR: GDI32.DLL has correct binding to USER32.DLL
77F9FA77 Debug string: LDR: USER32.dll has correct binding to GDI32.DLL
77F9FA77 Debug string: LDR: Snapping imports for msgbox.exe from USER32.dll
77F9FA77 Debug string: LDR: Refcount KERNEL32.dll (1)
77F9FA77 Debug string: LDR: Refcount USER32.dll (1)
77F9FA77 Debug string: LDR: Refcount KERNEL32.DLL (2)
77F9FA77 Debug string: LDR: Refcount GDI32.DLL (1)
77F9FA77 Debug string: LDR: Refcount KERNEL32.DLL (3)
77F9FA77 Debug string: LDR: Refcount USER32.DLL (2)
00400000 Module C:\masm32\ICZTUTES\TUTE02\tut02\msgbox.exe
77E10000 Module C:\WINNT\system32\USER32.dll
77E80000 Module C:\WINNT\system32\KERNEL32.dll
77F40000 Module C:\WINNT\system32\GDI32.DLL
77F80000 Module C:\WINNT\System32\ntdll.dll
77F86CDC Breakpoint at ntdll.77F86CDC
77F8C31F Breakpoint at ntdll.LdrpRunInitializeRoutines <------ broke here
77F9FA77 Debug string: LDR: Real INIT LIST
77F9FA77 Debug string: C:\WINNT\system32\KERNEL32.dll init routine 77e8c3d8
77F9FA77 Debug string: C:\WINNT\system32\USER32.dll init routine 77e33bb4 first init is done here
77F9FA77 Debug string: LDR: KERNEL32.dll loaded.
77F9FA77 Debug string: - Calling init routine at 77e8c3d8 second init here
77F9986F Breakpoint at ntdll.77F9986F
77F9FA77 Debug string: LDR: USER32.dll loaded. <--------dll loaded
77F9FA77 Debug string: - Calling init routine at 77e33bb4
77F8E71E Breakpoint at ntdll.77F8E71E
77F9FA77 Debug string: LDR: LdrGetDllHandle, searching for C:\WINNT\System32\IMM32.DLL from
77F9FA77 Debug string: LDR: LdrGetDllHandle, searching for C:\WINNT\System32\IMM32.DLL from C:\masm32\ICZTUTES\TUTE02\tut02;.;
77F9FA77 Debug string: LDR: LdrLoadDll, loading C:\WINNT\System32\IMM32.DLL from C:\masm32\ICZTUTES\TUTE02\tut02;
77F9FA77 Debug string: LDR: Loading (DYNAMIC) C:\WINNT\System32\IMM32.DLL
77F9FA77 Debug string: LDR: IMM32.DLL bound to USER32.DLL
77F9FA77 Debug string: LDR: IMM32.DLL has correct binding to USER32.DLL
77F9FA77 Debug string: LDR: IMM32.DLL bound to NTDLL.DLL
77F9FA77 Debug string: LDR: IMM32.DLL has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: IMM32.DLL bound to KERNEL32.DLL
77F9FA77 Debug string: LDR: IMM32.DLL has correct binding to KERNEL32.DLL
77F9FA77 Debug string: LDR: IMM32.DLL bound to NTDLL.DLL via forwarder(s) from KERNEL32.dll
77F9FA77 Debug string: LDR: IMM32.DLL has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: IMM32.DLL bound to GDI32.DLL
77F9FA77 Debug string: LDR: IMM32.DLL has correct binding to GDI32.DLL
77F9FA77 Debug string: LDR: IMM32.DLL bound to ADVAPI32.DLL
75E60000 Module C:\WINNT\System32\IMM32.DLL
77F9FA77 Debug string: LDR: ADVAPI32.DLL bound to NTDLL.DLL
77F9FA77 Debug string: LDR: ADVAPI32.DLL has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: ADVAPI32.DLL bound to KERNEL32.DLL
77F9FA77 Debug string: LDR: ADVAPI32.DLL has correct binding to KERNEL32.DLL
77F9FA77 Debug string: LDR: ADVAPI32.DLL bound to NTDLL.DLL via forwarder(s) from KERNEL32.dll
77F9FA77 Debug string: LDR: ADVAPI32.DLL has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: ADVAPI32.DLL bound to RPCRT4.DLL
77DB0000 Module C:\WINNT\system32\ADVAPI32.DLL
77F9FA77 Debug string: LDR: RPCRT4.DLL bound to NTDLL.DLL
77F9FA77 Debug string: LDR: RPCRT4.DLL has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: RPCRT4.DLL bound to KERNEL32.DLL
77F9FA77 Debug string: LDR: RPCRT4.DLL has correct binding to KERNEL32.DLL
77F9FA77 Debug string: LDR: RPCRT4.DLL bound to NTDLL.DLL via forwarder(s) from KERNEL32.dll
77F9FA77 Debug string: LDR: RPCRT4.DLL has correct binding to NTDLL.DLL
77F9FA77 Debug string: LDR: RPCRT4.DLL bound to ADVAPI32.DLL
77F9FA77 Debug string: LDR: RPCRT4.DLL has correct binding to ADVAPI32.DLL
77F9FA77 Debug string: LDR: ADVAPI32.DLL has correct binding to RPCRT4.DLL
77F9FA77 Debug string: LDR: IMM32.DLL has correct binding to ADVAPI32.DLL
77F9FA77 Debug string: LDR: Refcount ADVAPI32.DLL (1)
77F9FA77 Debug string: LDR: Refcount RPCRT4.DLL (1)
77F9FA77 Debug string: LDR: Refcount ADVAPI32.DLL (2)
77F8797F Breakpoint at ntdll.77F8797F
77F8C31F Breakpoint at ntdll.LdrpRunInitializeRoutines
77F9FA77 Debug string: LDR: Real INIT LIST
77F9FA77 Debug string: C:\WINNT\system32\RPCRT4.DLL init routine 77d43958
77F9FA77 Debug string: C:\WINNT\system32\ADVAPI32.DLL init routine 77db87c7
77F9FA77 Debug string: C:\WINNT\System32\IMM32.DLL init routine 75e61264
77F9986F Breakpoint at ntdll.77F9986F
77F9FA77 Debug string: LDR: RPCRT4.DLL loaded.
77F9FA77 Debug string: - Calling init routine at 77d43958
77F8E71E Breakpoint at ntdll.77F8E71E
77F9FA77 Debug string: LDR: LdrLoadDll, loading kernel32.dll from C:\masm32\ICZTUTES\TUTE02\tut02;
77F9FA77 Debug string: LDR: LdrGetProcedureAddress by
77F9FA77 Debug string: NAME - InterlockedCompareExchange
77F9986F Breakpoint at ntdll.77F9986F
77F9FA77 Debug string: LDR: ADVAPI32.DLL loaded.
77F9FA77 Debug string: - Calling init routine at 77db87c7
77F8E71E Breakpoint at ntdll.77F8E71E
77F9986F Breakpoint at ntdll.77F9986F
77F9FA77 Debug string: LDR: IMM32.DLL loaded.
77F9FA77 Debug string: - Calling init routine at 75e61264
77F8E71E Breakpoint at ntdll.77F8E71E
snip=====================
77F9FA77 Debug string: LDR: LdrGetDllHandle, searching for C:\WINNT\System32\IMM32.DLL from
77F9FA77 Debug string: LDR: LdrGetDllHandle, searching for C:\WINNT\System32\IMM32.DLL from C:\masm32\ICZTUTES\TUTE02\tut02;
77E87900 Breakpoint at KERNEL32.77E87900
00401000 Program entry point
disavowed
04-14-2005, 11:58 PM
blabberer, regarding your last post, was that from ollydbg or your own debugger code? i presume the latter. if the former, how?
blabberer
04-15-2005, 12:18 AM
hehe i am not so l33t to code my own debugger disawoved :) its is from ollydbg
actually loader emits debug strings when it is loading any application which
you can log them and analyze them if you have set LDR_SHOW_SNAPS
Global Flag

as i said i wrote a standlone exe to enable it per system session
it use ZwSetSystemInfo api to set NtGlobalFlag aka peb:some number i cant remember right off iwrote it in masm and when i tried to convert it into a plugin dll using ollydbg.inc,ollydbg.lib by eviloid i faced lot of problems so i dropped it

but if you want to try to enable it you open regedit and set this value

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager]
"GlobalFlag"=dword:00000002

you will see olly spitting all those debug messages :)
if you have windbg you can use its gflags.exe to enable this flag
per session or permanently ( for per session it uses ZwSetSystemInfo for permanancy it uses RegCreateKey,RegSetValue)

and getting all those .pdb from ms sysmbol servers and analysing the all modules with ollydbg (look into ollydbg forum for details on symbol path hack ) will actually give you lot of names
one of them is LdrInitroutine call
if you set a break there olly will let you trace all init code :)

hope it helps
disavowed
04-15-2005, 10:05 AM
Ahh... sorry... I misread your gflags comment earlier. Cool.

One more question: how do you set a useful breakpoint on LdrInitroutine if the DLL init functions are called before OllyDbg gets ahold of the target .exe?
0rp
04-15-2005, 07:40 PM
If you mean checking the "break-on-module-load" checkbox in OllyDbg, then no, that doesn't apply to DLLs in the IT. They're loaded into memory before Windows passes control to OllyDbg.

eh?
no

for every dll in the IT WaitForDebugEvent returns with LOAD_DLL_DEBUG_EVENT
blabberer
04-15-2005, 11:35 PM
as far as i ve seen the system creates a thread then maps the exe
snpas its import table and maps it and confirms the validity then if all are ok it maps ntdll.dll (creates the 7fffde000 and 7fffdf000 sections )
and handles control to ntdll.dll for further actions using KiUserApcDispatch some blah

if you locate this in ntdll.dll and set a f2 break point (not call eax but actaul procedure) olly will break there
now it checks for fs:[30]+68 (7fffdf068) and ands it value with 2 and sets
LdrShowSnaps flag to 2
then from there it proceeds to run LdrApplicationCompatGoo () LdrInitializeRoutine () QueryImageFileExecuteOption() for every dll ClearLoadinprogress() etc etc you can set f2 break on all these functions
in ntdll.dll and olly will break on all these functions because they are all run in user context (if that is the technical term :) KiUserApcDespatch sets the context and context body in stack and has already initialized ntdll.dll

i have a commented snippet of the process in some hdd ill paste it later here

0rp what do you mean ?? if you set (debug options --> events break on load module olly will not break for any dll that is in iat is what disavowed said and it is true as far as i know can you elaborate on the event your specify and your method to break there with ollydbg ???
0rp
04-16-2005, 04:04 AM
0rp what do you mean ?? if you set (debug options --> events break on load module olly will not break for any dll that is in iat is what disavowed said and it is true as far as i know can you elaborate on the event your specify and your method to break there with ollydbg ???

ollydbg is somewhat strange with break on oep and it dlls, but if you use windbg or write an own debugger, you will get a LOAD_DLL_DEBUG_EVENT for each it-dll

try to use windbg, open notepad, enable dll load event in debug events

the PEB for the first breaks doesnt contain any ldr table at all (!):

7c810867 ?? ???
0:000> !peb
PEB at 7ffda000
InheritedAddressSpace: No
ReadImageFileExecOptions: No
BeingDebugged: Yes
ImageBaseAddress: 01000000
Ldr 00000000
*** unable to read Ldr table at 00000000
SubSystemData: 00000000
ProcessHeap: 00000000
.....

in fact the process doesnt even has the exe image loaded (thats why disasm shows '???')

next break:

7c91eb94 c3 ret
0:000> !peb
PEB at 7ffda000
InheritedAddressSpace: No
ReadImageFileExecOptions: No
BeingDebugged: Yes
ImageBaseAddress: 01000000
Ldr 001a1ea0
Ldr.Initialized: Yes
Ldr.InInitializationOrderModuleList: 001a1f58 . 001a1f58
Ldr.InLoadOrderModuleList: 001a1ee0 . 001a1f48
Ldr.InMemoryOrderModuleList: 001a1ee8 . 001a1f50
Base TimeStamp Module
1000000 41107cc3 Aug 04 08:05:55 2004 C:\WINDOWS\notepad.exe
7c910000 411096d4 Aug 04 09:57:08 2004 C:\WINDOWS\system32\ntdll.dll
SubSystemData: 00000000
ProcessHeap: 000a0000
....


SoftICE Keyboard Support under Win2K
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > SoftICE Keyboard Support under Win2K
PDA

View Full Version : SoftICE Keyboard Support under Win2K

Jattie
04-14-2005, 10:30 AM
I am trying to get SoftICE working under Windows 2000 Version 5.0.2195 Service Pack 4 Build 2195.

My keyboard shortcus (Ctrl-D) is not working and after doing lots of reading first on FAQ's on asking questions and more reading on SoftICE I came across this snippet.

" For keyboard support on builds of Windows 2000 that are not specifically tested, download the i8042prt.sys driver on ftp.numega.com\anonymous\tech. Replace the driver currently installed on your system with the downloaded driver (please backup the original driver). This version of the driver is supported. It is simply the i8042prt.sys driver from a build that is specifically supported. "

The mentioned link does not exist anymore. Any pointers on getting hold of the i8042prt.sys driver that is "specifically tested" assuming from the document it refers to builds 1946, 2000 2021, and 2031. I tried the obvious searches, so any advice or pointers will be much appreciated.
sigint33
04-14-2005, 02:49 PM
You can find the file at the compuware Japanese site - hxxp://www.compuware.co.jp/products/driverstudio/util_DS.html
I don't know if it's exactly what you need but give it a try.

SiGiNT
disavowed
04-14-2005, 11:52 PM
use ollydbg instead. or windbg if you need a kernel debugger. softice is dead
laola
04-15-2005, 06:52 AM
Compuware changed the website design recently, you have to login to their "Frontline" system now to download any of the previously freely available updates. I will see if they still have that sys file for download there. I am using Softice from DS 3.0.1 under w2k without a problem, you just have to add NTSYMBOLS=ON to the softice configuration and use the symbol retriever with ntoskrnl.exe (and afterwards load the resulting nms file in softice)...
Repeating this can be necessary after installing windows updates :)

I checked their website and found a new download link. As I am unsure whether I should post it here or not, I won't :)


autorun question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > autorun question
PDA

View Full Version : autorun question

mac53
04-14-2005, 10:54 AM
I have performed a search with keyword "Autorun.inf" in the forum and have not quite found an answer to the question I am posting here today.

"COR Entertainment" has developed three "free" very high quality games and their titles are; "Battle for Earth" at 136mb, "Alien Arena" at 127mb and "Martian Chronicles" at 127mb. They are downloaded individually in one complete "Installshield" package. "Alien Arena" has a 58mb update that is used to correct some issues with playing online and, I think, some other performance wrinkles. I am familiar with writing an autorun.inf file to have these automatically start to install when the cd I burnt them to is inserted into the drive. Without the use of an "Install Menu", is there some way that I can write an autorun for "Alien Arena" so that the update file will automatically install after I install the main game? By looking at other autoruns I see commands such as, "shell", "run" etc. I also see that the [;] is used. All I want to do is to automatically run the update after the main game has been installed. Can this be done with a single autorun file?

Thank you for your time and for any responses I may receive in reference to this. :yay:
dELTA
04-14-2005, 12:23 PM
If nothing else, write a small loader program that first runs the installer and then the update. Then call this program from the autorun.inf file instead. :)
mac53
04-14-2005, 02:03 PM
Without asking out-of-term, could you advise me as to what small loader program I can use?

Thank you ;)
dELTA
04-14-2005, 02:24 PM
I don't know of any such ready-made programs off the top of my head, that's why I said you should write one yourself. :) (that does not mean they don't exist though, on the contrary I'm quite sure they do) It should be quite simple anyway, a few API calls and that's all.
disavowed
04-15-2005, 12:01 AM
what does this question have to do with "Reverse Software Engineering help & support"? (the parent forum)
dELTA
04-15-2005, 02:38 AM
Yeah, yeah, moved to off-topic then. :)
disavowed
04-15-2005, 10:07 AM
Yeah, yeah, moved to off-topic then. :)
The parent forum of off-topic is still "Reverse Software Engineering help & support" ;)
JMI
04-15-2005, 10:58 AM
Well Mr. Grumpy.... it has to do with "reversing" and modifying an "autorun file" to do the things Mac53 wants it to do. If you don't like the topic, how about you just don't post in it. :idea:

How about you leave the administrative decisions to the administration. :yay: Of course I can soften my critical comments by ending my post with a simlie. ;)

Regards,
Silver
04-15-2005, 01:22 PM
Code like dark woods.

What, JMI can end on a simile but I can't? ;)
JMI
04-15-2005, 03:37 PM
Of course you can. :D

Regards,
laola
04-16-2005, 11:28 AM
Such a program would basically consist of like 4 lines (quick and dirty):
CreateProcess for the first program, using the returned handle for WaitForSingleObject and then da capo for the second program.
You may have to check for child processes doing the real work, though. Completely depends on the installer being used. There are like gazillions of hobby programmers out there who can write up something, just in case your skills are completely located in a different field ;)
sigint33
04-16-2005, 03:22 PM
I think all of you are assuming that Mac has programming skills, If I assume that he doesn't, I think he is looking to modify the autorun file, much like making a batch file to install the app and then run the update - quick, dirty, and simple (non-elegant), am I correct Mac?

SiGiNT
mac53
04-16-2005, 05:34 PM
FINALLY...

Thank.....You...... :yay:
laola
04-16-2005, 07:00 PM
The problem with that is that the autorun.inf parser uses CreateProcess() to launch the specified file. Therefore, non-executable content is not usable directly. For a batch file, it is easy though: launch a temporary copy of cmd.exe (or command.com, depends on your target system, use the %comspec% environment variable) to run your batch file. This will need some testing :)
Inside the batch file, run your applications using the start command with the /wait parameter (this will delay the batch file execution until the started process has terminated).
If these hints are not enough, you are strongly recommended to use your head for more than just a hat holder :D
Abundant documentation about writing batch files is available all over the net, just learn how to operate google properly :)
Silver
04-17-2005, 05:35 AM
And while we're on the topic:

http://cwashington.netreach.net/

Handy site, especially when you're in a plagiarising kind of mood.


Sentinel SuperPro USB
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Sentinel SuperPro USB
PDA

View Full Version : Sentinel SuperPro USB

brentw
04-15-2005, 02:10 PM
OK here is a little background on the software the key ect. I have Target Name Deleted that requires a Sentinel SuperPro Key the Drivers are the 5.41 drivers. I have been able to dump the dongle info with a few programs off woodmann site. I just don't know were to go from here I have limited knowledge of coding. I am also unable to find the sentinel superpro EMUL prog anywhere. All I have been able to find is some time trial crack for the prog. The versions I notice when I searched your forum were .045 I believe correct me if I am wrong. I am sure there is more than one version though. I was able to find a patch file for the software sentinel.sys but it didn't work. I am not sure what to do with the .dll or the .dpr files. I am at a loss can someone give me some direction I don't want things handed to me I want to learn. The other question was the file sproio.zip I was wondering if anyone has any tips on how to read the text files or the program once installed what language is it is there a decryptor.
JMI
04-15-2005, 03:43 PM
It would appear that you REALLY DIDN'T READ THE FAQ. :eek: How about you actually do it NOW. You also clearly haven't shown any of YOUR work.

Regards,


Good tut / essay on CD protection
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Good tut / essay on CD protection
PDA

View Full Version : Good tut / essay on CD protection

Drbharucha
04-15-2005, 09:15 PM
I am newbies to RCE .. can u guys help to find a good tut/essay on cd protection RCE.

I have programme which give nag screen of "Insert CD......" This progie using MSVBVM60.DLL import functions :confused:
JMI
04-15-2005, 10:44 PM
Sigh...... Clearly you DID NOT READ THE FAQ. Had you done so, I would not need to remind you that you are supposed to SEARCH, both here and on the net for answers to your question, before you ask for help here.

For example, there is a SEARCH function at the top bar of the Forums. If you open it and put "CD Protection" in it you will find many threads with information about your subject. There are also several links at the bottome of these forums with information which might help you. You should also have searched on the net, using some search terms such as "cd protection + tuts" (without the quotes). There are other combinations you could use addressing these same subjects.

We also have a Rule here that you are supposed to show some of your own work when you ask a question. At the moment, it appears only that you have done nothing to try to help yourself. If this is not correct, then you should explain what YOU have done to try to find such tutorials. :idea:

Regards,
Drbharucha
04-16-2005, 02:28 AM
Thanks...JMI..

As I tld, I am new to this part of world... I'll get back to u with more details..

Thanks any away...


Armadill0 4.05 or 4.10
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > Armadill0 4.05 or 4.10
PDA

View Full Version : Armadill0 4.05 or 4.10

Snowski
04-16-2005, 11:18 AM
Hi all,

Got a target that is packed using Armadillo version 4.05 or 4.10.
Target has no nag screen, nor expiry stuff etc...it is just plain packed.
The target is a program that checks if a XDA is attached to the PC via USB. Then it checks if the XDA is in a bootloader mode, and then reads and writes data back and forth, outputting the read data in a file (using a dialogbox).

Prepared my OllyDbg, and patched it against the overflow vuln., which this version of Arma uses (2x "%%%%%%%%%%%%%").

PEiD version 0.93 does not find OEP... :mad:

When running the program in Windows (XP) it runs fine, no keys needed. In Task Manager it shows two processes running with both the same target's name...

Don't know the exact version, coz the "old" methods don't work anymore... Read the tut on how to find version number, but nothing found...
(And can't set any BP, as this will be detected.)

Using bp WriteProcessMemory does not give any breaks... (Strange).

Running the target with F9 results in the dialogbox:

"Don't know how to bypass command at address 010645C5...etc."

However, doing a search string ("Search for -> All Referenced Text Strings") does not show me the string I am looking for ("Don't know...etc"), as explained in one of the Ricardo tuts.

Running the target with just one (!) SHIFT+F9 is ok, but will not allow to do anything after that...thinking the program does not have to do anything anymore after that.

On the bottom of Olly, it states:

Module C:\WINDOWS\msctfime.ime (Running)

Setting a Memory break yields no results...

Also tried HE WriteProcessMemory (Hardware BP on Execution)...but no breaking... :???:

Any one have any ideas, tips, comments?

If you want, I will post target here, or start of OEP (different from 'older' arma-packed files)

Cheers, and thanks in advance!

Snow :)

-------
Some details:

WIN XP
OllyDbg patched (<--- New Armadillo will exploit vuln and crash Olly)
HideDebugger 1.22

____________________________________________
MrAnonymous
04-16-2005, 04:44 PM
Is your target a single process? I dont believe that Armas set to 'Minimal or Standard' Protection will call WriteProcessMemory, have you tried the BP CreateThread and CALL EDI etc?
condzero
04-16-2005, 04:54 PM
Snowski,

I suggest you read the post underneath this one from Tenketsu regarding Armadillo tricks. In a nutshell, if you don't have it, I suggest you get NTREGMON from the Sysinternals websit. Then execute NTREGMON filtering out all but your application. Then look at the results in NTREGMON specifically for something like "HKEY_LOCAL_MACHINE\SOFTWARE\Licenses". You should see entries for this. And right above it, you should see an entry for "HKEY_CLASSES_ROOT\CLSID\???????? (some subkey). If you go to this subkey in your registry, it may look like some valid key, however, Armadillo creates a key here for its own malicious use. Also, you may find a temp file in your "C:\Documents and Settings\%USERNAME%\Local Settings\Temp" folder if using WINXP or similar. The bottom line, you can delete the license keys and the CLSID keys in your registry and your program should run as if for the first time.

Basically, what I am saying, is the more you know, the less you'll have to ask other members, and perhaps you will be able to offer something new that we all haven't seen before.

Good luck!!!
Snowski
04-16-2005, 05:22 PM
@ MrAnonymous: Interesting point...it is a single process, I think. I have tried BP CreateThread, no break there. Have not tried CALL EDI...will do some research on that and report back.

I did try some HE's though...but no luck there.

Moreover, I think Arma was set for maximum protection, so with COPYMEM II, and DEBUG BLOCKER. Perhaps also Table Destruction, but that's for later worries... ;)

@ Condzero: Thanks for your reply. Will certainly look into that! And believe me, I would love to discover something new and make it into a tut, to give back to the community for all to learn..! :)

What I did notice (and this is how I found out Armadillo was used), was to look closely at RegMon. The program accesses Armadillo in my register, and stores/looks for a key there.

Will report back with findings...thanks! :)
MrAnonymous
04-16-2005, 09:24 PM
When you run the program, goto Task Manager and see if it is two process's than you can extrapolate some of the settings it may or may not be using.
Snowski
04-17-2005, 03:39 AM
I have tried that, MrAnonymous, and the program does run TWO instances in Task Manager, so called Father and Son processes...I think one is the real (core) program.

But Task Manager has limited functions...How do I "extrapolate" settings?

Are there any other tools that will alllow me to play with the two running processes. I have running: RegMon, FileMon, and have tried to dump using LordPE.
Admiral
04-17-2005, 09:16 AM
I'm not sure if Armadillo uses this antidebug trick, but perhaps it's worth looking into (if you haven't already).

Many common API functions start with the same few opcodes. It is possible to code your app with a wrapper-function for certain API functions (in particular the ones that are exploited by ['Dillo] reverse-engineers, such as CreateThread) which emulate the first few operations of that function before calling, for example, [CreateThread] + 0x0C and finally returning.
Calling this wrapper function would have exactly the same effect as calling CreateThread, but would bypass the memory location where 'BP CreateThread' would place its interrupt, and hence your debugger will fail to break.

If you can excuse the condescendingly detailed explanation, my point is that you may want to try manually putting a breakpoint (or even better, a hardware breakpoint) deeper into the API call in question.

Good luck
Admiral
Snowski
04-17-2005, 09:51 AM
Admiral,

Please be condescending....I do not mind at all...your explanation makes a lot of sense. Thanks for that, will give it a go. :)

And FYI: Dillo's DebugBlocker feature is used in this case, but no problem to get around that... ;)
nikolatesla20
04-17-2005, 07:20 PM
Arma acts like a debugger to the child process. So all you need to do is bpx on GetThreadContext and the program will stop when the first instruction of the real program is executed. If you know the arguments to GetThreadContext you can search the stack and find the actual OEP of the program with this technique quite easily. Mind you this is only if the program uses CopyMem protection. You will know it's copymem if the following 2 things are true:

1. The program has more than one "instance"

2. You get an error when trying to dump the program with LordPE.

-nt20
Snowski
04-18-2005, 02:09 AM
Interesting...thanks! :)

I can dump only one instance in LordPE (I think this is the parent, using "Dump full...").

The other instance that I see running I can not full dump, error is "can't grab process".

For sure I think I am dealing with CopyMem-II here. Thanks for your tip on bpx GetThreadContext, have not tried that, although this arma version does not like bp's or bpx's...will try and report back. :yay:
nikolatesla20
04-18-2005, 06:59 AM
The trick is not to bpx on the API itself, but do a "U GetThreadContext" and look at the code, and then set a bpx a little distance down from the beginning of the GetThreadContext function. I've never had a problem with bpx's and Arma tho, and I used to use Olly to do it. But I have to admit I have not looked at Arma in a long long time now.

-nt20
Snowski
04-18-2005, 07:33 AM
The trick is not to bpx on the API itself, but do a "U GetThreadContext" and ...

Thanks for your help and ideas, nt20, much appreciated.

But what do you mean by a "U GetThreadContext"...? :confused:

Cheers,

Snow :)
dELTA
04-20-2005, 03:40 AM
It's a Softice command to disassemle the code of the GetThreadContext API.
Snowski
04-20-2005, 05:54 AM
Aha, thx dELTA...! I don't use SoftIce...prefer Olly instead.

But now it makes sense...will give that a try, thanks! :)
Snowski
04-20-2005, 01:38 PM
OK, great news...am at the point to where the parent starts writing 2 bytes to the child...

Unfortunately this is not the "1000 bytes method", as I know how to deal with that.

In the memory dump, I see that the two first bytes he writes are EB FE...
But that is an infite loop! :confused:

So it was indeed a COPYMEM-II, but I am not sure how to continue from here.

Hitting F9 again will give me the second break:

0012DBC4 0042A46B /CALL to WriteProcessMemory from XXXX.0042A465
0012DBC8 00000050 |hProcess = 00000050 (window)
0012DBCC 0043D000 |Address = 43D000
0012DBD0 00453E3C |Buffer = XXXX.00453E3C
0012DBD4 00000002 |BytesToWrite = 2
0012DBD8 0012DEB8 \pBytesWritten = 0012DEB8

...the two bytes in the memory dump at 00453E3C read: 60 E8.

If I hit F9 once more, it now breaks at BP WriteProcessMemory number 3, where it starts to write 1000 bytes:
0012DE24 00429F19 /CALL to WriteProcessMemory from XXXX.00429F13
0012DE28 00000050 |hProcess = 00000050 (window)
0012DE2C 00403000 |Address = 403000
0012DE30 009023A0 |Buffer = 009023A0
0012DE34 00001000 |BytesToWrite = 1000 (4096.)
0012DE38 0012DE80 \pBytesWritten = 0012DE80

Etcetera...

In a nutshel: Here are the WriteProcessMemory breaks.
The parent writes/copies:

1. Two bytes: EB FE (infinite loop)
2. Two bytes: 60 E8
3. 1000 bytes
...
6. 1000 bytes (last one)

How to proceed unpacking here?

Thanks in advance for your help! :)
JMI
04-20-2005, 08:35 PM
DO NOT FORGET that you may NOT post tuts here which contain the target name and code to reverse the protection. You can post it somewhere else, however, and post a link to your tut. :yay:

Regards,
Snowski
04-21-2005, 04:46 AM
Updated post (the one above JMI).

Not trying to bump it, as it has enough attention, but if you browse forums like I do, you might miss the edit. ;)
Snowski
04-22-2005, 09:05 AM
OK, am a step further.

After I have assembled the loop...I let it run, and set a BP WaitForDebugEvent, etc. This way, I can separate the child process from the parent.

I open a new Olly, Attach the child process, and patch the loop bytes back to the original ones (patch EB FE back to 60 E8).

I put a BPX on CreateThread, and let Olly run. It will break there...all OK so far.

My problem now: I can not find CALL EDI.

After tracing into the RETNs I land on a POP ECX, good.

But now...the only comparable call I see is CALL ECX, and that can't be right.
There is no CALL EDI before the RETN.

Help? Pretty please? ;)
nikolatesla20
04-22-2005, 11:23 AM
Heres a test EXE I have for the context OEP trick. I may or may not work anymore, so I don't take responsibilty if it does not - I don't have interest or time to update it anymore :p

-nt20
Snowski
04-22-2005, 12:41 PM
Nice one, -nt20, thanks!

It does the job nicely on my other laptop (WIN 2000)...at least, it did find an OEP. Checking it out right now in Olly if it is correct and working.

EDIT: Works fine under WIN XP SP2. :p

If so, this would mean that the proggie would -still- work for Arma 4.XX CopyMem II...!
nikolatesla20
04-22-2005, 03:18 PM
Yeah, it might have problems with XP sp2. I've never tested it with that.
wanna-b
04-23-2005, 07:05 AM
@SNOWSKI

waiting for ur tutorial mate may b with pics n with good steps
JMI
04-23-2005, 07:40 AM
Maybe he could just come over to your house and do all the work for you. How about that. :idea:

Regards,
MrAnonymous
04-24-2005, 01:23 AM
Snowski: In a recent arma I looked at (no copymem2 or fancey tricks) the CALL EDI was gone replaced by a CALL ECX (I think there might have been more than one of them, only one being the actual OEP call obviously) just try and step into them one should be the OEP I think.
Snowski
04-24-2005, 04:35 AM
Hiya MrAnonymous,

I indeed see two CALL ECX before the RETN (using a BPX Createthread in the child).

The last one is the correct one, leads me to OEP. But the child needs to decrypt itself...when I land on OEP, the code is still encrypted:

0040375B ED IN EAX,DX ; I/O command
0040375C 78 37 JS SHORT Target.00403795
0040375E E5 47 IN EAX,47 ; I/O command
00403760 9B WAIT
00403761 FB STI
00403762 1AF8 SBB BH,AL
00403764 F3: PREFIX REP: ; Superfluous prefix
00403765 B3 B7 MOV BL,0B7
00403767 EE OUT DX,AL ; I/O command
00403768 B3 DB MOV BL,0DB
0040376A EB 19 JMP SHORT Target.00403785
0040376C F3: PREFIX REP: ; Superfluous prefix
0040376D DB ??? ; Unknown command
0040376E 8F ??? ; Unknown command
0040376F B8 A3BF069D MOV EAX,9D06BFA3

Did I miss a step somewhere?
MrAnonymous
04-24-2005, 11:57 AM
I'm not expierenced with CopyMem2 so I can only help a limited amount, but just seperating the process's with WaitForDebugEvent than DebugActiveProcessStop doesn't defeat CopyMem2, think you got to search out the cryptor call like on some of Ricardo's tutorials. Personally I was never able to find it tho, so good luck :P
Snowski
04-24-2005, 12:31 PM
Thanks for replying...I downloaded pretty much all dillo-related tuts from Ricardo...but can't find what I am looking for yet.

Guess I will have to wait for the TOMOIII or TOMOIV tutorials...


Programming Languages Used by Pest Authors ...
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Programming Languages Used by Pest Authors ...
PDA

View Full Version : Programming Languages Used by Pest Authors ...

yaa
04-16-2005, 05:19 PM
An interesting page detailing languages and packers used by pest writers:

h**p://research.pestpatrol.com/Lists/ProgrammingLanguages.asp

... VB6 is still leading the way.

yaa
nikolatesla20
04-17-2005, 07:13 AM
That list is screwed up, it has lots of repeats. Who knows what they are really trying to say.

-nt20


starforce 3 question
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > starforce 3 question
PDA

View Full Version : starforce 3 question

josefk
04-17-2005, 11:41 AM
hi all,

could anyone give me some clues about how to break at EP of an starforce
protected exe?. By searching this board i found only one mention to this
made by Volodya , which states that:

"...Obviously, EP will contain RVA in 98% of cases, but you never took a look on StarForce protection. Code section is NOT present in the PE file ON DISK, but takes some virtual memory! Therefore, EP MUST be VA. "

Can someone explain this a bit ? Where is the code section ?? And how
does starforce load that exe?

Any info will be highly apreciated...
evlncrn8
04-17-2005, 02:49 PM
the code section in the sf exe is NOT present on the disk, its put in by the starforce 3 dll, as for breaking on the ep, thats a totally different story
josefk
04-17-2005, 03:01 PM
the code section in the sf exe is NOT present on the disk, its put in by the starforce 3 dll, as for breaking on the ep, thats a totally different story

thx a lot for your answer.

the code must be somewhere on the disk :)
you mean it is in one of the sf3 sys files? or theres also a dll?

second, i wanna find out how to break on EP, that is, the first byte of
the executed code and NOT on the OEP, where sf3 gives control back
to the program.

hope to hear again from you :)
JMI
04-17-2005, 03:02 PM
josefk:

Just a thought, since "it's kind of like my job Dude." You said you searched here for information on your target protection, but did you also search on the net? Try something such as "starforce + cracking" (without the quotes) or try "starforce dll + cracking (or reversing) (again, no quotes). Also did you search here for information on how to reverse dlls? There are several Threads on the exetools forum about this target which you might also want to review. :idea: There is a tool on the net that allows one to run your target protection without the CD itself, but don't know whether it has been updated for your version of interest. Lots of information out there for those who learn how to search. :yay:

Regards,
evlncrn8
04-18-2005, 06:25 AM
the code must be somewhere on the disk :)
you mean it is in one of the sf3 sys files? or theres also a dll?

yes theres also a dll, check the iat of the exe, note the dlls, one of them is the starforce dll, and did i mention the .sys files.. no ..

second, i wanna find out how to break on EP, that is, the first byte of
the executed code and NOT on the OEP, where sf3 gives control back
to the program.

heh, slight problem, the iat loads the starforce dll (before oep is reached), dll does its stuff then jumps to the real oep, study the code somemore, either you are out of your depth or you havent studied your target enough
josefk
04-18-2005, 10:51 AM
well,

-JMI,
i already 'googled' starforce , but the harvest was pretty poor...
i also found something on exetools , anyway not much since i'm
looking for 'technical' infos ...
btw , it would be very nice if you could implement the search
function on exetools forum for non-member also.
i also know how to use starfuck/sf nightmare/mini-images to launch
a sf3 game. :)

thx anyway

- evlncrn8,
thx a lot that's exactly the answer i was looking for.
this trick to launch the protection is indeed very simple,
and i must admit that somehow i missed it...i was almost
sure that must be something more complicated.

now i have a starting point...hopefully i will be able to dig out
something from it :)

ps. you seem to be pretty familiar with starforce.you already
cracked it , or you're from the developers team? :)
evlncrn8
04-18-2005, 11:18 AM
nah i've cracked it before


Olly Invisible Plugin
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Olly Invisible Plugin
PDA

View Full Version : Olly Invisible Plugin

JMI
04-17-2005, 04:30 PM
One of the members on the Exetools, named Terrayoot, has created a plugin for Olly named "Olly Invisible Plugin" with some interesting code which seems to be developing into a very nice plugin indeed. You can check out his work and the informative discussion of debugger detection code in this thread:

http://www.exetools.com/forum/showthread.php?t=7363

It seems to be very effective, but is still under development, so I'm not going to attach a copy of it here yet.

There is also an interesting small piece of code by TQN, who is a member here, called "AntiDBG" which is useful for determing whether your Debugger is well hidden from most current methods of finding it. Since TQN is a member, I will allow him to decide whether or not to post his detector here also.

Worth checking out. :yay:

Regards,
condzero
04-18-2005, 08:09 AM
JMI,

Any chance us less fortunate individuals (read: cannot register Exetools forum) get access to the plug-in download at this site? The thread
was very interesting and many thanks for posting it here.
TQN
04-18-2005, 07:08 PM
Hello JMI,
I saw in the ExeTools, read count about 1500, but download count only above 20. Too many people can not download it. I think Teerayoot will agree to share the plugin at this forum.
JMI
04-18-2005, 09:21 PM
I agree. The only reason I haven't posted it already was that he was changing it nearly every day and that would create problems of constantly updating here as well. I am merely waiting for a "stable" relase of a couple days vintage and I will attach a copy here for all to play with and possibly help delevope. :yay:

Regards,
Knight
04-19-2005, 12:05 PM
Maybe it's not best place to ask that, but anyway. JMI, in one your post u said that registration at ExeTools is closed just temporaly. That was long time ago and i'm just curious is it still closed just temporaly? If yes then when we can expect it to be open again?

Best regards
evaluator
04-19-2005, 12:19 PM
i think, reposting here is not cool idea;
maybe author will create some web-page with download & post here link
sigint33
04-24-2005, 02:15 PM
Olly Invisible is now available on the arteam site -http://intechhosting.com/~access/forums/index.php?showtopic=888 (http://)

SiGiNT


XOR property (MD4/5 related)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > XOR property (MD4/5 related)
PDA

View Full Version : XOR property (MD4/5 related)

bilbo
04-18-2005, 04:53 AM
Hi all,
how can we prove that:
(X and Y) or (notX and Z) can be replaced by
(Z xor (X and (Y xor Z)))???

Well, the "bruteforce" demonstration is obvious: we test the whole space for inputs (with SPACE 1 as well as 256 for X,Y,Z: it is enough the case one-bit)

#include <stdio.h>

#define SPACE 1

void
main(void)
{
int X, Y, Z;

for (X=0; X<SPACE; X++) for (Y=0; Y<SPACE; Y++) for (Z=0; Z<SPACE; Z++)
if ((X&Y | (~X&SPACE-1)&Z) != (Z ^ (X & (Y^Z)))) {
printf("ko: X=%d, Y=%d, Z=%d\n", X, Y, Z);
return;
}
printf("ok\n");
}

but, is there some more elegant demonstration?
Thanks, bilbo
Shub-nigurrath
04-18-2005, 05:08 AM
generally speaking these things are demonstrated through a truth table, that's a "bruteforcing", used to find the minimum or equivalent circuit. There are no theorems that come to my mind at the moment. And anyway all the theorems are demonstrated always using a trugh table and showing that the two circuits are equivalent at the pins..
mike
04-18-2005, 05:09 AM
is there some more elegant demonstration?
Yeah: notice that there aren't any carries, so showing it's true for one bit means it's true for n bits. Or is that what you meant by SPACE=1?

Anyway, A xor B = A+B; A and B = AB; A or B = A+B+AB; notA = A+1; AA=A

(X and Y) or (notX and Z)
= XY + (X+1)Z + XY(X+1)Z
= XY+XZ+Z+XYZ+XYZ
= XY+XZ+Z
= Z+X(Y+Z)
=(Z xor (X and (Y xor Z)))
naides
04-18-2005, 05:41 AM
Mike:

Perhaps it is just a set of different, but equivalent conventions, but as far as I recall:

A or B = A + B

A xor B = A(notB) + (notA)B

I know chances are I am wrong. . .
bilbo
04-18-2005, 09:51 AM
Got it, Mike, but...
ooh, I'm so short-sighted...

can we also elegantly demonstrate
A or B = A xor B xor AB or is it just a matter of truth tables, as Shub-nigurrath suggested?

Thanks, bilbo
sigint33
04-18-2005, 12:40 PM
The HTML wouldn't paste correctly, maybe this link will apply.

http://www.omnifarious.org/~eljay/info_ttable.html (http://)

SiGiNT
mike
04-18-2005, 04:19 PM
Perhaps it is just a set of different, but equivalent conventions Yes. It depends on which rig you choose. Here I'm using + to mean normal addition modulo 2.
can we also elegantly demonstrate A or B = A xor B xor AB
How would you write OR when all you've got is multiplication and addition mod 2? We can pretty much just take it as the definition of OR.

If you want to use + to mean OR, that's fine, but then we have to define XOR like naides suggested, and you'd be asking for an elegant demonstration of that :D
bilbo
04-19-2005, 12:32 AM
Thanks, Mike,

I intended, for elegantly, only in terms of AND/OR (canonical XOR definition suggested by naides) and De Morgan theorems (and I know it can be done, see exercise 1 at http://www.ee.scu.edu/classes/2000fall/elen021/hwk/hw3/hw3.html).

Anyway, also your point of view (only in terms of plus/times operators) is interesting.

Best regards, bilbo
mike
04-19-2005, 03:30 AM
Yes, it can be done, but the derivation is a lot longer. In fact, if elegance is inversely proportional to the length of the proof, then the most elegant proof is the truth table!

A rig is a mathematical gadget (R, 0, 1, +, *), where R is a set and 0,1,+ and * behave the way you'd normally expect: * distributes over +, 0 annihilates under multiplication and is the additive identity, 1 is the multiplicative identity, etc.

There are two 2-element rigs,
({F,T}, F, T, OR, AND) = ({0,1}, 0, 1, max, min)
and
({F,T}, F, T, XOR, AND) = ({0,1}, 0, 1, + mod 2, *)

Other rigs include the integers: ( {..., -2, -1, 0, 1, 2, 3, ...}, 0, 1, +, *)
the reals: ( Reals, 0, 1, +, *)
the nonnegative rationals: ( rationals >= 0, 0, 1, +, *)
the complex numbers, the quaternions, polynomials--in fact, any ring or field;

Here's a much stranger one: the role of zero is played by infinity, the role of one is played by zero, the role of plus is played by min, and the role of * is played by +!

(reals>=0, infinity, 0, min, +)

distributive: a + min(c,d) = min(a+c, a+d)
additive identity: min(infinity,a) = a
multiplicative identity: a + 0 = a
annihilation under multiplication: a+infinity = infinity

The right tool can make all the difference!
bilbo
04-19-2005, 09:43 AM
Yes, it can be done, but the derivation is a lot longer. In fact, if elegance is inversely proportional to the length of the proof, then the most elegant proof is the truth table!

You are definitely right!
In fact, after a lot of thinking, I could elaborate the following solution...

Assumptions:
(1) + is OR, . (or nothing) is AND, ^ is XOR
(2) in following dissertation, A' means notA
(3) A xor B = AB' + A'B (XOR definition "in OR,AND rig" or "a la Naides")
(4) A+B is equals to A'B' (DeMorgan law)

Theorem:
X xor Y xor XY = X +(or) Y

Demonstration:
X ^ Y ^ XY = associative property
(X ^ Y) ^ XY = XOR definition for first XOR
(XY'+X'Y) ^ XY = XOR definition for second XOR
(XY'+X'Y)'(XY) + (XY'+X'Y)(XY)' = DeMorgan for the two negated parenthesis
(XY')'(X'Y)'(XY) + (XY'+X'Y)(X'+Y') = DeMorgan for the new two negated parenthesis
(X'+Y)(X+Y')(XY) + (XY'+X'Y)(X'+Y') = resolving the first two and last two parenthesis (distributive property)
(X'X+X'Y'+YX+YY')(XY) + (XY'X'+XY'Y'+X'YX'+X'YY') = some semplification
(X'Y'+YX)(XY) + XY' + X'Y =
X'Y'XY + YXXY + XY' + X'Y =
XY + XY' + X'Y =
X(Y+Y') + X'Y =
X + X'Y = distributive property of + against .
(X+X')(X+Y) =
1.(X+Y) =
X + Y

Phew! This stuff is far away from elegant!

Best regards, bilbo


Just a loose idea for a tool.
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > Just a loose idea for a tool.
PDA

View Full Version : Just a loose idea for a tool.

naides
04-18-2005, 07:57 AM
By no means this is a completely thought out thing,
I would just like to listen ideas about how useful and how feasible a tool like this might be.

When a protected program is installed, it introduces an arbitrary number of changes in the system: new files, new registry keys, hidden files, hidden records at low level hard disk locations, to keep track of time of install, number of uses, registered demo etc. etc.

What I would like is a tool that produces an inventory of all these changes: At the time of installation, and at the time of 'demo expired' state.

Of course Filemon and Regmon can keep track of many of these things, but with a lot of background noise, and necessarily running along the proctected app.

What I would try goes like this:

Set up a VMware virtual machine (Yes, I am fascinated with this toy).
Clone it and install the Software in the clone.
Clone it and expire the software.

Now we have Static Snapshots of the three states, clean, active and expired.

Scan the VMware .vmx files and pointout the differences:

Of course scan means reversing the vmx internal structure, sorting out the disk logic structure, the file system structure and the windows registry structure.

Because the analysis is done 'static', any antidebug, anti regmon anti filemon anti monitor tricks are effectively neutralized, no API hooking is necessary, the prtotection is NOT running, only its interactions with the machine are recorded.

Comments?
ughugh
04-18-2005, 08:20 AM
You can, for simplicity, mount the drives in another virtual machine, so you don't have to figure out the vmx stuff. Install OS on fat32, and you'll have minimal fuss finding the differences.
Silver
04-18-2005, 09:36 AM
Naides, most software packagers are capable of doing this. I've used Installshield and Wise to repackage "nasty" applications into "easy" single click installer.exes. You set them to scan the system, then you make whatever changes you require (install app etc), then you set them to post-scan the system. They produce a comprehensive difference file and an installer script to make the changes. They're extremely effective and a lot easier than messing with VMX files. Although that would be an interesting task in itself - a la Ghost Explorer for VMware disk images.
naides
04-18-2005, 10:02 AM
Hi, Silver, thank you for your answer.
One question: Would installshield, Wise, and other scanners like them catch low level, direct writing to specific disk clusters, like c-dilla and safecast/safedisk do?
Without testing, I think these would go below the radar.
Silver
04-19-2005, 08:45 AM
I can't answer that, unfortunately. My initial thoughts were that these programs somehow hook every API call that occurs, until I saw one quite happily deal with dongle-based registration of a CAD program. I am fairly certain they do not take disk-level images for comparison due to the speed of diff file generation and style of install script. One note, I believe the "standard" Installshield doesn't provide this facility, I think you need the Admin Studio version.


Any crackers idea???
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Any crackers idea???
PDA

View Full Version : Any crackers idea???

Hero
04-18-2005, 09:44 AM
Hi all
I don't know this is legal to ask this question here or not,But I want to know
what you will do if you want to protect your program for selling through web?
I know everything is crackable,I only want to make it longer to crack,and I will
assume that there is no dongle.
Can you suggest something for inspecting?

sincerely yours
JimmyClif
04-18-2005, 10:29 AM
I think the best idea :devil: is to distribute a sh-tload of bad cracks and fake serials to the most common places yourself after you released your app. Add to most keygens and cracks a virus wrecking some havoc or completely effing up the install of your app and/or let it patch a little place somewhere which makes the app crash at random intervals and there you go..

People will register stating that they thought about using the crack but blah blah blah... for some crazy reason they decided to pay for your app.

Also be consistent.. add every week another 'keygen' or 'crack' and even though your app will be cracked in no time it will make it very hard for average Joe to get ahold of a working solution.

It's not the cracker you're fighting - it's the enduser who doesn't want to fork over the cash who is the enemy.

Jimmy
YesItsMe
04-18-2005, 12:34 PM
It's a horrible suggestion! why should you do something like that? you might get on the nerves of cracking groups for spreading viruses in the name of cracks, you'll be facing the whole scene then, you'll end up having every bit of useless software that you release cracked at 0 day...

I think the best approach is not to make a full version available for public, instead a demo lacking the crucial functionality such as saving or printing with no option to enable that...you send the full version to your trusted customers after they pay you and let it be protected with something as strong as Themida 2004 and we'll see then if/when it gets cracked.
Woodmann
04-18-2005, 04:18 PM
Howdy,

you might get on the nerves of cracking groups for spreading viruses in the name of cracks.....

Are we to assume that people who host cracks actually check them beyond the basic virus scan ?

If you introduce a bogus serial/reg to enough places, it will be picked up by all of them. Once you have "market" saturation, you will have possibly defeated those who are looking for an easy answer. They want instant gratrification.

It doesnt need to have a virus, a bunch of malwares attached will do the job.

JimmyClif, I think your reply is brilliant.

Woodmann
esther
04-18-2005, 07:32 PM
>you might get on the nerves of cracking groups for spreading viruses

I doubt that,Cracking groups will not risk their reputation on doing silly things , they aren't kiddies out there :)
JimmyClif
04-18-2005, 07:38 PM
Well, thank you Woodmann.
Hero
04-18-2005, 10:01 PM
Hi JimmyClif
Add to most keygens and cracks a virus wrecking some havoc or completely effing up the install of your app and/or let it patch a little place somewhere which makes the app crash at random intervals and there you go..
I think this suggestion will affect your program itself,and making its tilte bad too.
I think this will not be a very good idea for all types of program.

I think the best approach is not to make a full version available for public, instead a demo lacking the crucial functionality such as saving or printing with no option to enable that...you send the full version to your trusted customers after they pay you and let it be protected with something as strong as Themida 2004 and we'll see then if/when it gets cracked.
This can't be used for any application.For example you worked on an encryption
algorithm for your program for a long time.Do you want to get it open source?

By this question,I mean that if have access to all newly developed protection
allgorithms,and you add some checking features to your program,what will you
do for protection?What is the protection that you will use?And you will use what
checking and inspecting ways that make it harder to crack a program?
I asked this question here,because I think if a cracker wants to make a protection,
that protection will be the best one! :yay:

sincerely yours
Silver
04-19-2005, 08:53 AM
I asked this question here,because I think if a cracker wants to make a protection, that protection will be the best one!

Yes, it's the old "hire a thief to catch a thief" conundrum.

One point to take into account is the vast majority of cracks and keygens are not initially distributed widely across the net. Places like odaycn and the p2p networks pick them up as they slowly leak off the private group and 0day ftp/bbs's. So whilst I agree seeding the public distributions with bad files will impact some end users of the crack, there will always be a clear delineation between "good" cracks (on the group sites) and "bad" cracks out in the wide world. What you're proposing is essentially the same tactic as record companies seeding kazaa etc with bad MP3's - we know this doesn't work.

On that note, you may find this interesting: http://slashdot.org/article.pl?sid=05/04/18/1831256&tid=95&tid=188

I have had an idea for a protection system for a while that depends on distributing code sections between server and client. Although it would be totally impractical for a commercial app, as a theoretical protection system I believe it would be quite strong.
0xf001
04-19-2005, 09:57 AM
you might get on the nerves of cracking groups for spreading viruses in the name of cracks, you'll be facing the whole scene then, you'll end up having every bit of useless software that you release cracked at 0 day...

i also think this will not be the case until you submit your crack under the name of a known group then they of course have a reason :)

and i also like this approach!! it is reaching the goal as a side effect but imho it is very effective :yay: cool!
thandermax
04-19-2005, 11:14 AM
Step 1)
Perform all the above mentioned tips
step 2)
Try to build your own packer.
step 3)
Use Threads instead of main message loop to check the REG validation. Use as many threads you can.
step 4)
If you could build a REG Check Device Driver (*.vxd or *.sys)which will check the REG CHK.
step 5)
Encrypt all the text used to show the user "The serial what u hav entered is fake ... etc.". Decrypt it in RunTime.
step 6)
Use Net check and upload all the registered user's info and check it Randomly.
Some firewall might block it (BLAH BLAH)
step 7)
use switch case type algorithem which is a bit confusing.

After all you have done , wait for atleast 1 year to crack to be available. HA HA.
Cause someone will find the trick SOMEDAY BUT SURE. But you can release new ver of your app.

HAPPY CODING
Regards,
ThanderMAX.
evaluator
04-19-2005, 11:58 AM
forget all..

Here is my GOLD suggestion:

Make really GOOD program & you will Always(R) have customers..
.. & cr0cks, wich will indicate: your program worth to cr0ck;
sigint33
04-19-2005, 06:03 PM
All the companies and individuals that are selling apps. they authored, are still making money, even if cracks are available, I think if you have a great app. you will always profit from it, just protect it as best you can and forget the malicious stuff - some of which might have legal implications, make the price reasonable and they will buy it - especially if they want upgrades and support, I'd buy a true VB5/6 decompiler in a hot second, I've even thought of buying one of the half-assed ones on the market.

SiGiNT
disavowed
04-20-2005, 12:04 AM
If you could build a REG Check Device Driver (*.vxd or ...
No one in the world should be coding .vxd's anymore. They are incredibly outdated, deprecated, and were never officially documented to begin with.
TBone
04-20-2005, 12:31 PM
If you really want a good protection system, don't let the user have all of the code in the first place. Use a client-server model and give the client app away for free. Then charge people to access your server. Obviously, this approach is better suited for some applications than others.

But seriously, as bandwidth keep increasing, I expect to see this sort of approach more often. Do all of the core, critical computation server-side, pipe only the output to the client and charge them a monthly/yearly/whatever fee for the service. Don't verify people at your server with some serial key - keep a database of unique accounts.

If you want to use the program for free, your options are to either steal someone else's account (difficult to get away with for long if the server doesn't allow multiple simultaneous connections), make an account with stolen credit card info, break into the servers, or write an emulator. The first option is impractical, the second and third are too risky and/or too difficult for most people, and the fourth option is enormously time consuming if your program has any complexity at all.

Hey, it works for Everquest :p
Hero
04-20-2005, 01:06 PM
Thanks anyone for suggestion!
If you really want a good protection system, don't let the user have all of the code in the first place.
What I think on,was the same idea as you suggest.But if you want to use it as
an client/server application,as you said,you need an powerfull server,and all users
should have an active network available.
This will not be acceptable for everyone.In addition you can't prove that your
application has no spyware or such programs,and this will affect your program.

sincerely yours


Newbie
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Newbie
PDA

View Full Version : Newbie

elche2
04-18-2005, 03:43 PM
Ok im new in this world (debuggers, hex editors, etc) i know C++ and that is all but i would like learn how to use ollydbg so i just want a tutorial or guide to
newbies, so i ll aprecciate u r advices!!..i want learn this programm coz this 1 can help in debugg a game call it : muonline 0.99b+. Have severals bug!! well i hope some day i have the half knowlodge of u. Thank in advance!!
Woodmann
04-18-2005, 04:23 PM
Howdy,

Google-----enter ollydbg------press search or your enter/return key.

Woodmann
naides
04-18-2005, 04:29 PM
If elche2 stands for El Che Guevara, ;), You have the language skills to read Ricardo Narvaja's tutorials, which are quite detailed and extensive on Olly
elche2
04-18-2005, 04:38 PM
OMG! thx naides ill search ricardo narvajas's tutorials coz o search on google thousand of time with several names: ollydbg +guide, or + tutorials, etc. but the best tutorial u must paid coz are books. well thank and i hope some day can help in this forum like u ppls!!!..Hasta Luego! = c u soon!
sigint33
04-18-2005, 05:33 PM
You might want to take a look here also -

http://ollydbg.win32asmcommunity.net (http://)

SiGiNT
elche2
04-18-2005, 06:21 PM
Thank u very much sigint33
*SIGHT* Thank for ur time, i c this is a great comunnity, i really hope some day i can help u 2!! Thank Thank Thank very very very Much!!!!!
vikingp
04-20-2005, 11:10 AM
Here is a great site to!
http://tutorials.accessroot.com/


BGL (babylon glossary) to GLS (babylon glossary source).
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Advanced reversing and programming > BGL (babylon glossary) to GLS (babylon glossary source).
PDA

View Full Version : BGL (babylon glossary) to GLS (babylon glossary source).

acidmelt
04-19-2005, 04:15 AM
hello reversers, a while back i tried to reverse the babylon GLS format so i would be able to read data out of it and use it in my own personal project, this task however is beyond my very noobish debugging skills and obviously i failed.

i wasnt sure about where this post best fits in, it was either advanced reversing (since this requires pretty advanced practises) or the mini project area, feel free to move it.

anyways this is the data i have gathered so far:
the decryption algo can be found at the "babylon" program itself (http://www.babylon.com)
the encryption algo can be found at the "babylon builder" program which is used to write dictionaries and is publicly available (http://www.babylon.com/builder)
-----------
there is zero documentation about this format available on the net.
ive found this page (http://fjolliton.free.fr/babytrans/) which asserts that the new babylon bgl format is encrypted using the "Cipher Square" algorithm (http://www.esat.kuleuven.ac.be/~rijmen/square/).
-----------
after examining a few *.blg's it is visible that the first 8 bytes of the file are the signature.
ive checked wotsit.org for documentation and found nothing.

in a recent thread (http://www.woodmann.com/forum/showthread.php?t=6934) bilbo have suggested this as a project.. so i thought that id start this thread and see what happens.

what do you say? :devil:
bilbo
04-19-2005, 11:05 AM
In my opinion, that would be a nice true RE activity, and not related to software stealing...
You have my support, as long as I have time...!

For the moment, I tell you how I would start...

(1) Install Babylon - I have 5.0.1 r7 - dunno if last - and focalize on one BGL you have installed...
The program is not compressed/protected in any way from debuggers.
(2) Menu->Glossaries->Glossary Options, and remove your BGL
(3) Attach to Babylon.exe with your preferred debugger and set a breakpoint on CreateFileA / ReadFile
(4) Menu->Glossaries->Install glossary from disk, and reinstall your target BGL
(5) Debugger will break at start of API: on stack you will find the return address and the BGL file name.
(6) ... no time for now to go on...

Best regards, bilbo
acidmelt
04-20-2005, 07:49 AM
hey bilbo, i have tried your suggestion for debugging the app (using olly) and i have encountered a rather strange behaviour.. it seems that at startup babylon is iterating thru all the files inside %windir%\fonts and opening each one of them... i dont see any reason for that.
anyways, i have stepped-over the code searching for the right CreateFile() and i wasnt able to find any reference that is opening a *.bgl.

another problem was that as soon as i go into glossaries->add glossaries olly reports a memory access violation.. id guess that babylon does holds some sort of anti-reversal protection :eek:

as i said my debugging skills are very limited and i would be glad if you (bilbo) or any other experienced reversers would take a look at that :p

oh, and one last thing.. judging by the ram usage and the speed of seeking i assume that the glossaries are being loaded into memory at startup (duh.) so taking a memory dump should provide us with a valid copy of the decrypted gloss right? :-/
bilbo
04-20-2005, 11:07 AM
Hello, acidmelt!

I had some time to make other nice steps in "our" project. Let's see...
it seems that at startup babylon is iterating thru all the files inside %windir%\fonts and opening each one of them... i dont see any reason for that.No, that's not my case (I've checked with FILEMON). It could be that you have a yet fresh installation of Babylon, and it is yet auto-learning the fonts installed on your system for OCR. If that is the case you should also see an high CPU load for the following hours on your system.
anyways, i have stepped-over the code searching for the right CreateFile() and i wasnt able to find any reference that is opening a *.bgl. That was the reason I suggested you to put a breakpoint only after the initial phase and load a new BGL when the program is already started.
another problem was that as soon as i go into glossaries->add glossaries olly reports a memory access violation.. id guess that babylon does holds some sort of anti-reversal protection :eek:You're right, I don't use Olly and I did not noticed it. It is not a Memory Access Violation neither an anti-debugging trick. It is a lot of Exceptions C++ E06D7363. I dunno the exact reason. Anyway: Options->Debugging Options-> Exceptions->select Ignore Custom Exceptions and press button "Add last exception". This solves Olly problem!

oh, and one last thing.. judging by the ram usage and the speed of seeking i assume that the glossaries are being loaded into memory at startup (duh.)Correct!
so taking a memory dump should provide us with a valid copy of the decrypted gloss right? :-/You have yet to localize the data and to interpret them, though!

Ive found this page (http://fjolliton.free.fr/babytrans/) which asserts that the new babylon bgl format is encrypted using the "Cipher Square" algorithm (http://www.esat.kuleuven.ac.be/~rijmen/square/).That's a wrong info, as far as I've seen!

And now the good news.
What you already found, the 4(8?)-bytes signature, can be of three types:
12340003 .BDC extension - to be studied
12340002 .BGL generated by the builder in some cases - to be studied
12340001 .BGL distributed on Babylon site - I've started from these...

I've managed to identify their decompression (not decryption) algorithm, using the 5 steps I suggested you. It is simply ZLIB, release 1.1.3 (rather old...). The routines are inside BabyServices.DLL, but they are called from BContentServer.DLL. I will tell you more details in the following messages if you are interested.

Since the Library is completely free, and not GPL-ed, they cannot be blamed for performing a GPL violation, I suppose.

Now, take one BGL of the last type, remove the first 0x47 bytes, and save it with a .GZ extension. The new file must start with 0x1F. Then you can extract it with WinZip, and you can browse its uncompressed contents.
Not so bad, isn't it? There are many initial field we must discover yet, tough.

If you want to play reversing some more, put a breakpoint at 0x9B29AF, run Baby and "Install glossary from disk" as I told you at step (4).
You must land at this code

009B29AF lea ecx,[ebp-1030h] ; uncompressed buffer to be filled
009B29B5 push 1 ; number of bytes to uncompress
009B29B7 push ecx
009B29B8 mov ecx,dword ptr [ebp-1Ch]
009B29BB push ecx ; compression structure 64h bytes
009B29BC mov ecx,eax ; ZLIB object (Baby source is in C++)
009B29BE call dword ptr [edx+18h] ; inflate

Execute the whole subroutine and you will find in the buffer the first uncompressed byte, 60 in my case. Try to discover the meaning of that value...
I stop here at the moment... no more time.

Best regards, bilbo

P.S. JMI, I don't know if I can go on. Maybe the subforum is not correct, the matter is against rules, nobody else is interested, etc. etc.
Please let me know...
JMI
04-20-2005, 11:20 AM
Seems OK so far. Go for it. :yay:

Regards,
acidmelt
04-20-2005, 12:48 PM
bilbo that is some awesome information! :D

here are my finding:
to my surprise, after decompression the resulting files dont require any further decryption.. after scrolling a bit (offset 0xC47 at the eng_eng dictionary) you can see simple html tags and inbetween them are the definitions
try changing the extension of the uncompressed file to html :sneaky:

i have created a simple glossary with only 3 words to figure out the way that the definitions are aligned:
TERM 0x000C DEFINITION 0x101809 TERM 0x000C and so on..
however this is different in 12340001 bgls.. ill further analyse them. :devil:

the byte at offset 0x5 points to the begining of the gzip header, convenient :)
the gzip header of 12340001 files starts at 0x47 (as you said).
the gzip header of 12340002 files starts at 0x69.

on 12340003 (*.bdc) files however this is not the case.. this files seem to be uncompressed and it seems that their format is similer to the old *.dic.

p.s im stupid, i totaly forgot about babylons ocr capabilities.

thank you bilbo :D
bilbo
04-21-2005, 11:28 AM
Hello, acidmelt, and everyone interested (nobody seems to be...),

try changing the extension of the uncompressed file to html

ok, but that is just a resource... the whole dictionary is not HTML format

the byte at offset 0x5 points to the begining of the gzip header, convenient

great... I would say at offset 0x4, though, because all the Baby entities are in big-endian form (the high byte first, read on)

the gzip header of 12340002 files starts at 0x69

great! one point to you!

And now the step for today...
:)
I started from the address I told you yesterday and I have reversed some stuff here and there (sub_9B1DCO and related ones). These are my findings.

The uncompressed file is a collection of records.
Every record has a one-byte header.
The low nibble is the record type.
The high nibble holds indication of the record length, with the following rule:

high nibble>=4: subtract 4; that is the length
high nibble <4: add 1: that is the number of bytes for the following length (in big-endian format)

As for the record types:
0 - one-byte specifier will follow, and the data next
1 - this is an entry: the entry name will follow as a string preceded by one byte for length, and the definition next
2 - this is a named resource: the resource name will follow as above (e.g xxx.bmp, xxx.html) (and the data next)
3 - two byte specifier will follow, and the data next
4/6 - no specifier, 0 bytes of data - type 6 is at end

But I hate the theory, so here is a little program which will scan the whole uncompressed file.
I have tried it successully on a little BGL: Code Analysis, at http://info.babylon.com/gl_index/gl_template.php?id=46760

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

void
main(int argc, char **argv)
{
char resname[256];
unsigned char hdr, high_nibble, lenbyte;
unsigned char specifier[2];
int i, record_length;
FILE *fpin;
long curpos, datapos;

if (argc != 2) {
printf("usage: %s uncompressed_filename\n", argv[0]);
return;
}

fpin = fopen(argv[1], "rb");
if (!fpin) goto ko;

// a record per loop
while (1) {
curpos = ftell(fpin);
fread(&hdr, 1, sizeof(hdr), fpin);
if (feof(fpin)) return;

// get the record size
high_nibble = hdr >> 4;
if (high_nibble >= 4) record_length = high_nibble - 4;
else for (i=record_length=0; i<high_nibble+1; i++) {
record_length *= 256;
fread(&lenbyte, 1, sizeof(lenbyte), fpin);
record_length += lenbyte;
}
datapos = ftell(fpin);

switch (hdr & 0xF) { // low nibble

case 0: // one-byte specifier follows
fread(specifier, 1, 1, fpin);
printf("@%x: <id %x> %x bytes\n",
curpos, specifier[0], record_length);
break;
case 3: // two-bytes specifier follows
fread(specifier, 1, 2, fpin);
printf("@%x: <id %x> %x bytes\n",
curpos, specifier[0]*256+specifier[1], record_length);
break;
case 4: // no specifier
case 6: // no specifier
printf("@%x: <no id(%d)> %x bytes\n",
curpos, hdr&0xF, record_length);
break;

case 2: // named resource
fread(&lenbyte, 1, sizeof(lenbyte), fpin);
fread(resname, 1, lenbyte, fpin);
printf("@%x: <res %.*s> %x bytes\n",
curpos, lenbyte, resname, record_length);
break;

case 1: // entry
fread(&lenbyte, 1, sizeof(lenbyte), fpin);
fread(resname, 1, lenbyte, fpin);
printf("@%x: <entry> \"%.*s\"> %x bytes\n",
curpos, lenbyte, resname, record_length);
break;

default:
printf("unexpected low_nibble %x\n", hdr & 0xF);
return;
}
fseek(fpin, datapos+record_length, SEEK_SET);
}

return;
ko:
printf("exit due to error %d: %s\n", errno, strerror(errno));
}

We need only to understand the meaning of the specifiers...
Best regards, bilbo
dELTA
04-22-2005, 03:20 AM
Nice work as always bilbo. :yay:

and everyone interested (nobody seems to be...)Sure we are, just lurking. ;) Keep up the good work.
acidmelt
04-22-2005, 03:56 AM
hey bilbo!

again thats plenty of great information.. thank you :D

i wrote a little program to explore uncompressed bgls based on your code :)

#include <stdio.h>
#include <windows.h>
#include <conio.h>

int isvalidchar(char ch);
void stripjunk(char *buffer);

struct bdc {
char szTerm[256];
char szDefinition[256];
} **babyterm[27];
int ptrcnt[27]; //sorted

void main(int argc,char **argv) {
FILE *fdic;
int ix,iy,rec_length;
unsigned char hdr,high_nibble,lenbyte,tmpch;
unsigned long datapos;
char tmpbuff[256];
char uterm[256];
int bg,eg;

if(argc!=2) { printf("usage: %s uncompressed_filename\n", argv[0]); return; }
//initial allocation of pointers
for(ix=0;ix<27;ix++) {
babyterm[ix]=(struct bdc**)malloc(sizeof(struct bdc*));
ptrcnt[ix]=0;
}
//>>parsing
fdic=fopen(argv[1],"rb");
if(!fdic) { printf("error opening file [%s].\n",argv[1]); return; }
bg=GetTickCount();
while(1) {
fread(&hdr,sizeof(char),1,fdic);
if(feof(fdic)) break;

//get record size
high_nibble=hdr >> 4;
if(high_nibble>=4) rec_length=high_nibble-4;
else {
for(ix=rec_length=0;ix<high_nibble+1;ix++) {
rec_length*=256;
fread(&lenbyte,sizeof(char),1,fdic);
rec_length+=lenbyte;
}
}
datapos=ftell(fdic);

switch(hdr & 0xF) {
case 1: {
fread(&lenbyte,sizeof(char),1,fdic);
memset(tmpbuff,0,lenbyte+1);
fread(tmpbuff,sizeof(char),lenbyte,fdic);
if(!isalpha(tmpbuff[0])) break;
stripjunk(tmpbuff);
//printf("TERM [%s] -> \n",tmpbuff);
//>>allocating space for term struct
tmpch=tolower(tmpbuff[0])-'a';
babyterm[tmpch][ptrcnt[tmpch]]=(struct bdc*)malloc(sizeof(struct bdc));
if(babyterm[tmpch][ptrcnt[tmpch]]==NULL) {
printf(":O ran out of space.\n");
return;
}
strcpy(babyterm[tmpch][ptrcnt[tmpch]]->szTerm,tmpbuff);
//>>
fseek(fdic,1,SEEK_CUR); //definiton lenbyte is next
fread(&lenbyte,sizeof(char),1,fdic);
memset(tmpbuff,0,lenbyte+1);
fread(tmpbuff,sizeof(char),lenbyte,fdic);
stripjunk(tmpbuff);
strcpy(babyterm[tmpch][ptrcnt[tmpch]]->szDefinition,tmpbuff);
//printf("DEF [%s]\n",tmpbuff);
ptrcnt[tmpch]++;
} break;
default: break;
}
fseek(fdic,datapos+rec_length,SEEK_SET);
}
eg=GetTickCount();
fclose(fdic);

printf("total parsing time: %dms\n",eg-bg);

printf("--------------------------\n");
for(ix=0;ix<27;ix++) {
if(ptrcnt[ix]>0) {
for(iy=0;iy<ptrcnt[ix];iy++) {
printf("--\n[%s][%s]\n",babyterm[ix][iy]->szTerm,babyterm[ix][iy]->szDefinition);
if(getch()==27) goto takeinp;
}
}
}
printf("--------------------------\n\n");
takeinp:
for(;;) { //input loop
memset(uterm,0,256);
printf("Term:");
scanf("%256s",uterm);
if(uterm[0]) {
tmpch=tolower(uterm[0])-'a';
for(ix=0;ix<ptrcnt[tmpch];ix++)
if(!strcmpi(babyterm[tmpch][ix]->szTerm,uterm))
printf("%s = \n%s\n",uterm,babyterm[tmpch][ix]->szDefinition);
}
}
}

void stripjunk(char *buffer) {
int ix,slen;
slen=strlen(buffer);

for(ix=1;ix<slen;ix++)
if(buffer[ix]=='$') { buffer[ix]=0; break; }
slen=ix;
for(ix=0;ix<slen;ix++)
if(!isvalidchar(buffer[ix])) { buffer[ix]=0; break; }

}

int isvalidchar(char ch) {
int ix;
char valtab[]="abcdefghijklmnopqrstuvwxyz 0123456789!@#$%&8()_-+=|{}[]<>\"',.%%/\\:;!?";
ch=tolower(ch);

for(ix=0;(unsigned)ix<strlen(valtab);ix++)
if(ch==valtab[ix]) return 1;
return 0;
}

however whats about the rest of the data?
it seems as if the uncompressed files have some sort of header?

i just took a look at some *.gls and i belive our goal is completed (well you did most of the work so kudos to you) :D

the format is really simple:
### Glossary title:testTitle
### Author:testAuthor
### Description:testGlossDescription
### Source language:English
### Source alphabet:Default
### Browsing enabled?No
### Type of glossary:00000000
### Case sensitive words?0
### Glossary section:

test1
meaning1

test2
meaning2

test3
meaning3
--------
using the code above it is really easy to produce gls's.. :devil:
bilbo
04-22-2005, 09:52 AM
Good, acidmelt, you added some indexing feature (dynamic array 'babyterm'), but... there is a bug...

You initialized babyterm[ix] just at init time with only one pointer in it! In this way the entries are overwritten as they grow.
You can remove the whole initialization loop, but you must add, before every new entry allocation, a resizing of the **babyterm array:

babyterm[tmpch] = (struct bdc**)realloc(babyterm[tmpch],
(ptrcnt[tmpch]+1)*sizeof(struct bdc*));
babyterm[tmpch][ptrcnt[tmpch]] = (struct bdc*)malloc(sizeof(struct bdc));

instead of the simple

babyterm[tmpch][ptrcnt[tmpch]] = (struct bdc*)malloc(sizeof(struct bdc));

By the way, realloc will work also the first time, when the area to reallocate has address 0.

Ok.
And you removed a lot of things: not just spaces in the source, I see, you don't like spaces :)); but also non ASCII characters which are used as quotes or underscores, etc. If you try your program on the BGL I suggested, many definitions are cut.

That's all for this weekend, I have other things to do...
A simple addition would be to integrate ZLIB in the program in order to uncompress the file automatically...

Best regards, bilbo

P.S. thx dELTA (and acidmelt) for appreciation...
P.P.S. I suggest to have a look at the dictionary I linked in my previous message, there is also something for Fravia

+Fravia: One of the best reverser in the world. Founder of +Fravia's Pages of Reverse Engineering

and for our friend Zero

Universitas Virtualis: Free knowledge project which provides a professional place for Algorithms, Software-Engineering, Software-Protection and Reverse Code Engineering, Cryptography and Cryptanalysis.
acidmelt
04-24-2005, 03:45 AM
hey bilbo!

thanks for the corrections :)
in my previous code i have ignored some important details which made the parsing crippled.. anyways here is a fixed code incorporating zlib, so there is no need to manually unpack bgls ;)

#include <stdio.h>
#include <windows.h>
#include "zlib.h"

#pragma comment(lib,"zlib.lib")

int isvalidchar(char ch);
void stripjunk(char *buffer,char type);
int focc(char *cstr,char ch);
int uncomp_bgl(char *bglname,char *datname);
int writegls(char *datname);

char glsheader[1024];
char glsheadertemplate[]=
"### Glossary title:%s\r\n"
"### Author:%s\r\n"
"### Description:%s\r\n"
"### Source language:English\r\n"
"### Source alphabet:Default\r\n"
"### Target language:English\r\n"
"### Target alphabet:Default\r\n"
"### Browsing enabled?No\r\n"
"### Type of glossary:00000000\r\n"
"### Case sensitive words?0\r\n"
";gls generated by bglgls\r\n\r\n"
"### Glossary section:\r\n\r\n";

int main(int argc,char **argv) {
int ix;
char szAuth[32];
char szTitle[32];
char szDescription[128];
char datfname[128];

if(argc!=2) {
printf("usage: bglgls.exe filename.bgl\n");
return 0;
}
//>get input
printf("gls Author:");
fgets(szAuth,32,stdin);
printf("gls Title:");
fgets(szTitle,32,stdin);
printf("gls Description:");
fgets(szDescription,128,stdin);

szAuth[strlen(szAuth)-1]=0;
szTitle[strlen(szTitle)-1]=0;
szDescription[strlen(szDescription)-1]=0;
sprintf(glsheader,glsheadertemplate,szAuth,szTitle,szDescription);
//>set output filename
strncpy(datfname,argv[1],128);
ix=focc(datfname,'.');
if(ix<0) { printf("invalid filename\n"); return 0; }
datfname[ix]=0;
strcat(datfname,".dat");
//>>
if(!uncomp_bgl(argv[1],datfname)) { printf("error uncompressing BGL.\n"); return 0; }
if(!writegls(datfname)) { printf("error writing GLS.\n"); return 0; }
return 0;
}
//>>uncompression routine
int uncomp_bgl(char *bglname,char *datname) {
FILE *ztmp;
FILE *zfile;
char iobuff[128];
char tmppath[256];
char tmpfname[256];
unsigned char zptrbyte;
int tread;

//get temp filename
GetTempPath(256,tmppath);
GetTempFileName(tmppath,"bgl",0,tmpfname);
ztmp=fopen(tmpfname,"wb");
if(!ztmp) return 0;
//>
zfile=fopen(bglname,"rb");
if(!zfile) return 0;
fseek(zfile,0x5,SEEK_SET);
fread(&zptrbyte,sizeof(char),1,zfile);
printf("zlib header@0x%X\n",zptrbyte);
fseek(zfile,zptrbyte,SEEK_SET);
while(!feof(zfile)) {
tread=fread(iobuff,sizeof(char),128,zfile);
fwrite(iobuff,sizeof(char),tread,ztmp);
}
fclose(zfile);
fclose(ztmp);
//>>uncompressing >
zfile=fopen(datname,"wb");
ztmp=gzopen(tmpfname,"rb");
if(!zfile||!ztmp) return 0;
while(!gzeof(ztmp)) {
tread=gzread(ztmp,iobuff,128);
fwrite(iobuff,sizeof(char),tread,zfile);
}
gzclose(ztmp);
fclose(zfile);
DeleteFile(tmpfname); //get rid of temporary file
return 1;
}
//write gls
int writegls(char *datname) {
FILE *fdic,*fgls;
int ix,rec_length;
short int lenword;
unsigned char hdr,high_nibble,lenbyte;
unsigned char lenmul,lenadd;
unsigned long datapos;
char tmpbuff[1024];
char glsf[256];
int tt=0,lt=0;

//gls filename
strcpy(glsf,datname);
ix=focc(glsf,'.');
glsf[ix]=0;
strcat(glsf,".gls");
printf("gls filename:%s\n",glsf);
fgls=fopen(glsf,"wb");
if(!fgls) return 0;
//>write header
printf("writing GLS");
fwrite(glsheader,sizeof(char),strlen(glsheader),fgls);
//>>parsing
fdic=fopen(datname,"rb");
if(!fdic) return 0;
while(1) {
fread(&hdr,sizeof(char),1,fdic);
if(feof(fdic)) break;

//get record size
high_nibble=hdr >> 4;
if(high_nibble>=4) rec_length=high_nibble-4;
else {
for(ix=rec_length=0;ix<high_nibble+1;ix++) {
rec_length*=256;
fread(&lenbyte,sizeof(char),1,fdic);
rec_length+=lenbyte;
}
}
datapos=ftell(fdic);

switch(hdr & 0xF) {
case 1: {
fread(&lenbyte,sizeof(char),1,fdic);
memset(tmpbuff,0,1024);
fread(tmpbuff,sizeof(char),lenbyte,fdic);
if(!isalpha(tmpbuff[0])) break;
stripjunk(tmpbuff,0);
strcat(tmpbuff,"\r\n");
fwrite(tmpbuff,sizeof(char),strlen(tmpbuff),fgls);
fread(&lenmul,sizeof(char),1,fdic);
fread(&lenadd,sizeof(char),1,fdic);
memset(tmpbuff,0,1024);
lenword=lenmul*256+lenadd;
if(lenword>1019) lenword=1019;
fread(tmpbuff,sizeof(char),lenword,fdic);
stripjunk(tmpbuff,1);
strcat(tmpbuff,"\r\n\r\n");
fwrite(tmpbuff,sizeof(char),strlen(tmpbuff),fgls);
if(tt-100==lt) { lt=tt; printf("."); }
tt++;
} break;
default: break;
}
fseek(fdic,datapos+rec_length,SEEK_SET);
}
fclose(fdic);
fclose(fgls);
DeleteFile(datname); //we dont need the *.dat anymore..
printf("%d terms written to file!\n",tt);
return 1;
}
//find occurrence
int focc(char *cstr,char ch) {
int ix;
for(ix=0;(unsigned)ix<strlen(cstr);ix++)
if(cstr[ix]==ch) return ix;
return -1;
}
//>
void stripjunk(char *buffer,char type) {
int ix,slen;
slen=strlen(buffer);

if(!type) {
for(ix=1;ix<slen;ix++)
if(buffer[ix]=='$') { buffer[ix]=0; break; }
slen=ix;
}
for(ix=0;ix<slen;ix++)
if(!isvalidchar(buffer[ix])) { buffer[ix]=0; break; }
}
//valid term/definition char
int isvalidchar(char ch) {
int ix;
char valtab[]="abcdefghijklmnopqrstuvwxyz 0123456789!@#$%&8()_-+=|{}[]<>\"',.%%/\\:;!?";
ch=tolower(ch);
for(ix=0;(unsigned)ix<strlen(valtab);ix++)
if(ch==valtab[ix]) return 1;
return 0;
}

i have tested it with the code_analysis bgl that you suggested and it now works perfectly. i have also tested it with bablyons english_english dictionary (since it is the largest (18mb unpacked)) and it works really well.

though something is missing and i couldnt figure it out.. babylon shows part-of-speech for each word and id guess that this information is stored in a table somewhere inside the bgl.. thats the last piece missing i believe.

heres a binary (http://www.woodmann.com/forum/attachment.php?attachmentid=1230&stc=1) compiled and linked with zlib. :yay:


Windows NT DDK Kit
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Windows NT DDK Kit
PDA

View Full Version : Windows NT DDK Kit

thandermax
04-19-2005, 10:58 AM
Hi,
I am ThanderMAX.

I wanted to make a generic driver to fecilate low level RING 0 from RING 3 user application level to access to various devices and ports . It will enable others to format a drive , read or write a disk sector while running in WIN 9x or XP or NT , Direct Port access to facilate :confused: , debugging or dumping a process programatically etc .
:whoops:

But the problem is the driver development kit (DDK ) by which i can compile the driver is not currently available for free download and is quite costly (perhaps arround $450). But it was available for free quite sometime ago from MSDN DDK site.

So if any body has it or have a link to the kit Please give me. I am waiting for it. :mad:

The Completed Project (i.e. driver + source code) will be available for free from me upon completion. :yay:

Please ,Kindly,Generously etc. etc. help MEEE.

regards,
ThanderMAX
bilbo
04-19-2005, 11:10 AM
ThanderMAX,
why don't you study some assembler and grab KMDKit?
(http://phr34k.game-host.org/ebook/four-f/)

It comes with a lot of beautiful examples!
Regards, bilbo
doug
04-19-2005, 01:16 PM
$450 ? where did you get that figure?

I bought the XP DDK for $20 ($0+ $20 shipping) last year.

And if you really want it for free, there are some websites hosting the old win2k DDK (which was downloadable). And if you can search the net, you will also find the most recent version of it. ;) .
JMI
04-19-2005, 03:29 PM
And which part of the statement in the FAQ did YOU NOT understand?

What questions may I and may I not ask about acquiring tools?

2. You may NOT ask about where to download ANY tool, freeware, pirated or whatever (this is to make sure no links to pirated software occur here, and to avoid people using this forum instead of google, even for freeware tools). This does of course include NOT being allowed to ask if someone can send it to you too!
A valid exception to this rule of not being allowed to ask WHERE a tool can be found is when the original site of a free tool has disappeared, and it is hard to find it by searching. In that case you MAY ask if anyone knows what happened to the site, and if there are any ways to find this tool anywhere else.

You will also note in the heading of the Tools of the Trade Forum the statement:

Do not ask where to get the Tools of our Trade. Do not even think about asking for them.

Clearly YOU do NOT care about our Rules if YOU want something. This was a completely lameass move on your part. Violate our Rules in this manner again and YOU are history. No excuses will be tolerated. :boo:

Regards,


Injecting code in Symbian??
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > Injecting code in Symbian??
PDA

View Full Version : Injecting code in Symbian??

eminemence
04-20-2005, 01:33 AM
Hi,
First of all are there any Symbian programmers here? :)
Also if there are , has anybody tried injecting code in .app and .exe files
on the phone. :devil:
Bye.
--eminemence.
eminemence
04-20-2005, 11:51 PM
Update :
Have just found the Symbian .app file format specs ,
will this help in some way in injecting code.
Pls somebody atleast reply with how to injecting code
in Windows,coz I know Symbian programming so I can
probably figure out how to do it here.
Bye.
--eminemence.
dELTA
04-21-2005, 02:11 AM
http://www.google.com/search?q=%22code+injection%22+tutorial+-web
eminemence
04-21-2005, 02:25 AM
Okay,
If I find sometihg interesting I will surely post it here.
Thanks.
--eminemence.


CRC Check
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > CRC Check
PDA

View Full Version : CRC Check

n00b
04-20-2005, 01:59 AM
hello ,

how to know if the PE is making a "CRC Check" ?

and How to defeat that?
JMI
04-20-2005, 02:28 AM
n00b:

Did you actually read that part in the FAQ which says you are supposed to SEARCH for the answers to your question BEFORE you ask a question. This is such a basic subject, you should have found alot of information by searching both here and on the net for the subject of CRC checks, how they work, and how they might be defeated.

Try searching on the net for "CRC Checks" (without the quotes) and for things like "defeat + CRC Checks" (again with no quotes). Then try with other combinations of words. You should also try using the SEARCH function at the top of the Forums to search here for information.

Generally, you should suspect that there is something like a CRC check when you change anything in the program and it puts up an error message indicating that there is a CRC error. But that's just a general statement.

Now go do some of your own homework and come back with a more focused question which shows you have been trying to help yourself.

Regards,
n00b
04-20-2005, 10:02 AM
i have a file packed with telock 0.98 , i unpacked it using UNtelock 0.98+
i can see the source now , but the file Doesnt RUN now!
why? , from googlin i found that there maybe a "CRC CHeck".
i read many tut`s that dealin with " CRC check ".
but those tut`s were defeatin error msg`s like "file has been modified...."

my problem differs , ( the file DOESNT RUN ).

i think when i unpacked the file an error occured for the PE

is there a tool to verify the PE?
how to know if it was a PE error or a CRC Check?
thx,.
dELTA
04-21-2005, 01:57 AM
You must debug the program yourself so see if it has such a check. Search this forum, and you'll find many specific techniques to do it.
JMI
04-21-2005, 02:06 AM
Searching? Who'd a thought of Searching. :eek:

Regards,
JohnWho
04-21-2005, 03:11 AM
Here's some of the more common API's used for CRC checks!

ReadFile
CreateFile
CreateFileMapping
MapViewOfFile
OpenFileMapping
UnmapViewOfFile
CloseHandle

But tracing from EP usually gives you an idea of whats going on, then compare with a trace in packed file!
naides
04-21-2005, 06:36 AM
The file does not run. . . umhh!

1. The unpacker does not work for this file? Remember that unpackers are handcrafted tools that cannot garantee will work in every instance.

2. Perhaps The file knows it was unpacked. Either by a CRC check or by other device.
You need to disassemble the unpacked, trace the packed and the unpacked with a debugger, look why and how your file quits: does it load, then do a check, then quits?
or when it loads a dll, the dll is the one that does the checking and then quits?
What do you mean when you say 'it does not run': a page violation exception? a silent but clean quit? a complete system fuckup?

Disassemble and debug, which is the hard, long, interesting, challenging , ilegal and expensive way,

Or buy the program, what is quick and cheaper. Believe me, ther are few other options.


A problem in Flexlm 6.1
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > The Newbie Forum > A problem in Flexlm 6.1
PDA

View Full Version : A problem in Flexlm 6.1

Hero
04-21-2005, 01:09 AM
Hi all
I made an license for a Flexlm 6.1 protected program some time ago.and I test
it on 2 computers and it works well.
But when I get that license to one of my friends,he said me that the lincense is
not working.
After testing again,I get that this license is working on 3 of 6 test computers.How
this is possible?Why this license is not working on any computer?(I make it without
any limition in license file)

sincerely yours
sigint33
04-21-2005, 08:57 AM
If you are not using HOSTID=ANY and you are using the NIC ID the problem could be because of a "feature" some computers have, the NIC card shuts itself down when there is no network hardware present, or there could be conflicting MAC addresses, IE a NIC and a wireless card.

SiGiNT
Hero
04-21-2005, 11:04 AM
Hi
I using HOSTID=ANY.The structure of license that I generated is like this:
SERVER this_host ANY
FEATURE <----------> <--------> <----> permanent uncounted <---------> HOSTID=ANY

sincerely yours
sigint33
04-21-2005, 01:20 PM
Try using LMTools to see what the problem is, it's a great utility to help you create licenses (Thanx Globetrotter!).

SiGiNT
tom324
04-21-2005, 03:19 PM
Error code returned from the application or daemon can help in tracing the problem.

Tom


IDA auto function arguments
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA auto function arguments
PDA

View Full Version : IDA auto function arguments

taylorjonl
04-21-2005, 07:14 PM
I have been stumbling around IDA for a few days and am getting the hang of it, sorta. I am trying to figure out if it is able to follow the function arguments. I have defined the function below but it doesn't auto follow ECX like I thought it would.

.text:6FAA1140
.text:6FAA1140 ; ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦ S U B R O U T I N E ¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦¦
.text:6FAA1140
.text:6FAA1140
.text:6FAA1140 ; void __fastcall sub_6FAA1140(CellFile *UiImage)
.text:6FAA1140 sub_6FAA1140 proc near ; CODE XREF: sub_6FAA7440+Cp
.text:6FAA1140 ; sub_6FAA7440+2Dp ...
.text:6FAA1140 push esi
.text:6FAA1141 mov esi, ecx
.text:6FAA1143 push esi
.text:6FAA1144 call D2CMP_10032 ; Call Procedure
.text:6FAA1144
.text:6FAA1149 test esi, esi ; Logical Compare
.text:6FAA114B jz short loc_6FAA115D ; Jump if Zero (ZF=1)
.text:6FAA114B
.text:6FAA114D push 0
.text:6FAA114F push 7Ah
.text:6FAA1151 mov edx, offset aCProjectsD2_10 ; "C:\\projects\\D2\\head\\Diablo2\\Source\\D2Cl"...
.text:6FAA1156 mov ecx, esi
.text:6FAA1158 call Fog_10043 ; Call Procedure
.text:6FAA1158
.text:6FAA115D
.text:6FAA115D loc_6FAA115D: ; CODE XREF: sub_6FAA1140+Bj
.text:6FAA115D pop esi
.text:6FAA115E retn ; Return Near from Procedure
.text:6FAA115E
.text:6FAA115E sub_6FAA1140 endp ; sp = -0Ch
.text:6FAA115E

I have read through the help file but it is very lacking, this has got to be one of the most un-userfriendly programs I have ever used. btw, I am using 4.7.

If you can tell me how to set this up I would appreciate it. Also would like to know if it can mark the arguments going into the function when it is called.
naides
04-21-2005, 08:15 PM
In fast_call convention the arguments are passed in registers, and IDA will not auto-label them as arguments.

In your example the pointer argument *UiImage appears to be passed in ECX,
which is typical of microsoft C++ 4.0 to 6.0 compilers.

I agree, IDA is an advanced tool that assumes the user has a great ammount of advanced knowledge.

Hacker Disassembling Uncovered by Kris Kaspersky covers a lot of the IDA basics
sigint33
04-21-2005, 08:15 PM
Not an answer to your question, but a suggestion, The Art of Assembly is an excellent reference on assembler, good reading for what you need to know IDA can't do everything, and it does a lot of guessing based on it's analysis.

SiGiNT
taylorjonl
04-21-2005, 09:41 PM
I am pretty familiar with assembly, I know that fastcalls ECX and EDX are first 2 args the rests are pushed onto stack. I have been using Ollydbg for a few years but was wanting to get used to IDA since it is a bit more advanced for dissassembly. I was just hoping it would trace where the variable is passed around to. That example is very simple but on some the variables may get passed around quite a bit making it a pain having to play musical registers.

That answers my first question what about if I can make it trace what is passed into the function? Even a simple labeling of it so I can see the args and not have to go the the functions address to check the prototype?
naides
04-22-2005, 06:05 AM
That is when the I (interactive) of IDA comes into play.
You could write a IDC script to do the 'follow the register' game for you. But without somehow peeking the function prototype, or examining several instances of the code that call the function, the script will make mistakes, just as IDA often makes mistakes, when doing the auto-labeling.

Remember that calling conventions are only that, conventions, and in certain situations, either code optimization done by the compiler, inline coding done by the coder, or linking modules wirtten in different languages and compiled with different compilers could produce rather peculiar and unpredictible argument passing and handling that neither IDA, your script, or you yourself could easily sort out without some live tracing.


IDA FLIRT Annoyances
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDA FLIRT Annoyances
PDA

View Full Version : IDA FLIRT Annoyances

bilbo
04-22-2005, 05:57 AM
Hi mates,
in frequent cases, when I try to disassemble with IDA, the FLIRT engine fails to identify some functions...

For example, using MSVC:

/*
* file pgm.c
* WARNING: this program is not intended to be runned :-)
*/

#include <stdio.h>

void
main(void)
{
fwrite(0, 0, 0, 0);
fread(0, 0, 0, 0);
}

If we compile this file as "cl pgm.c" there are no problems: _fread and _fwrite are correctly identified.
But if we compile as "cl -MT pgm.c" both functions are not recognized. The reason is simple: the library used is now LIBCMT.LIB, and no more LIBC.LIB.

Furthermore, in many cases, "unknown_libname"'s are proposed to the reverser (due to signature collisions, that's true, but the position in the executable and the names of the nearest functions could help in the identification!).

Some questions arise at this point:

(1) is there some public signature repository, in order to avoid to rebuild every time the .SIG files (and to avoid to own the corresponding .LIB)? I'm afraid I already know the answer... so next question is: could someone host some public signature repository etc. etc?

(2) How IDA can automatically plan to load some signatures better than others? In the case above I want to avoid the automatic loading of VC32RTF.SIG, and use a better one, for example. And, is possible to remove already applied signatures?

(3) Is there some alternate "FLIRT" engine on the scene?
Azure, by Polaris, seems a good candidate, but I haven't see nothing at the moment. What is the input signature files format? Is it Open Source?

Best regards, bilbo
Polaris
04-22-2005, 06:57 AM
(1) is there some public signature repository, in order to avoid to rebuild every time the .SIG files (and to avoid to own the corresponding .LIB)? I'm afraid I already know the answer... so next question is: could someone host some public signature repository etc. etc?

Well, I suppose that one can ask for hosting to the IDA Palace... I know they have already some signature stuff floating around... But I also fear they would only support registered users...

Otherwise, I have a resource section in my website that can easily host reverser-made signatures.

(2) How IDA can automatically plan to load some signatures better than others? In the case above I want to avoid the automatic loading of VC32RTF.SIG, and use a better one, for example. And, is possible to remove already applied signatures?

AFAIK, IDA uses special (different from standard) scanning techniques over CRT to identify the compiler (these are called STARTUP SIGNS)... Then just applies signs corresponding to the identified compiler.

It is not possible to remove the applied signs, due to heavyness of the information *usually* applied with signatures: code paths, names, parameters, special cases...

In special situations, I load the input file without using FLIRT and then applying manually the signatures.

(3) Is there some alternate "FLIRT" engine on the scene?
Azure, by Polaris, seems a good candidate, but I haven't see nothing at the moment. What is the input signature files format? Is it Open Source?

Best regards, bilbo

Well, I am currently *extemely* busy :( and cannot dedicate much time to AZURE (well, hopely this will change in summer ;)). But do not lose faith... I still master Nebulah Frost! ;)


IDC to UDD converter?
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > IDC to UDD converter?
PDA

View Full Version : IDC to UDD converter?

taylorjonl
04-22-2005, 07:51 PM
I was wondering if someone has writting a IDC to UDD converter? I use IDA for dissassembly but use OllyDBG for debugging. Would be nice to be able to have OllyDbg aware of my discoveries in IDA. I am mostly thinking in lines of a program that will transfer my labels for addresses from the IDC file to the UDD file. Converting the function definitions to .arg formate would be awesome too.

If noone has does anyone have a link to info on the IDC and UDD formats? The IDC seems straight forward but the UDD seems a little more cryptic.
naides
04-22-2005, 08:12 PM
GODUP??
TQN
04-22-2005, 09:08 PM
Export .map file from IDA (File - Procedure File - Export MAP file...), and use GODUP plugin to import the .map file to OllyDbg. This is a fastest way.
taylorjonl
04-23-2005, 12:55 PM
Thanks, I will try it out tonight.
taylorjonl
04-23-2005, 04:41 PM
I can't seem to find a download, is this tool among the ones I am not allowed to ask for a download location?
JMI
04-23-2005, 08:02 PM
So what you are "confessing" is that you generally suck at searching and you want a suspension of the Rules "just for you" because you don't know how to put "Godup" in google and find what you are looking for, is that it? :rolleyes:

Yes I know the ollydbg forum plugin section is unreachable at the moment, but it is available on the exetools forum and on at least one Chinese site I know of. However, since this IS a free tool and the site where it "used to be" seems not to be available, I'll attach it for you. :devil:

Regards,
naides
04-23-2005, 09:04 PM
Aaahhh!!!!

So JMI does have a heart :sneaky: :loveu:
JMI
04-24-2005, 02:23 AM
Shhhhh! You'll let everybody know. ;) It'll be our secret. :devil:

Regards,


XOR equations :)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Rce Cryptographics > XOR equations :)
PDA

View Full Version : XOR equations :)

halvar
04-23-2005, 02:47 AM
http://eprint.iacr.org/2004/294.pdf

Have fun reading :)


problem running unpacked file
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Packing and Unpacking Forum > problem running unpacked file
PDA

View Full Version : problem running unpacked file

n00b
04-23-2005, 03:02 AM
i have a file packed with telock , i have UNpacked it with two ways.
1- manually , olly ( dump )
2- by using unTelock.

the unpacked file doesnt run if the original one (packed) is not running.
i should run the packed file 1st , then the unpacked file <-- will work.

but if i run the unpacked file it will close after 1 second.

what is going on? :whoops:
Tola
04-23-2005, 04:27 AM
hint: have a look at the telock options
Manko
04-23-2005, 04:42 AM
...or search this board... I think I remember what this is... createmutexa...
n00b
04-23-2005, 05:15 AM
i dont know , but i see no much threads! , i opened packing/unpacking section
it has 4 threads only
Showing threads 1 to 4 of 4 , is there a problem ? or its only has 4 threads?

Manko , what to search? there is nothing lol!
Snowski
04-23-2005, 05:26 AM
Change your board settings...there are more than 4 threads... ;)

:yay:
BeatriX
04-23-2005, 06:49 AM
yes, it is the option "mutex" which is surely used as Manko said. The TElock loader creates a mutex and the target test if this mutex exists. If you unpack the file, the loader don't create it and the file unpacked kick you out :) you just have to break on createmutex... you must find something like this :

call CreateMutex
call GetLastError
cmp eax, ERROR_ALREADY_EXISTS
jnz Get_Out_Of_Here_If_You_Are_Lucky (it could be a devil routine !! )


Opera Browser 7.54 For Free (As In Beer)
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Off Topic > Opera Browser 7.54 For Free (As In Beer)
PDA

View Full Version : Opera Browser 7.54 For Free (As In Beer)

JimmyClif
04-24-2005, 08:41 AM
Go to http://www.slickdeals.net/#p5986 and follow the link. Use the code provided. It's from a German magazine called c't. License Registration will be sent to your email. German Opera Homepage states that one can upgrade to Opera 8 for the bargain price of only 8 Euros. Should be about $10.

Not bad, not bad. My Man, my man.

That Opera 8 version upgrade is only accessible through the page
http://www.opera.com/ct-magazin/buy.dml


RE: Adding mouse functionality
RCE Messageboard's Regroupment > Reverse Software Engineering help & support > Tools of our Trade (TOT) Messageboard > RE: Adding mouse functionality
PDA

View Full Version : RE: Adding mouse functionality

LOUZEW
04-24-2005, 11:53 AM
Not sure it's the right place to post that. If it's in wrong place, please mods, move it in the right one

I'm sure i've seen anywhere some advices on adding mouse functionality to an App but i can't remember where and can't find it anymore.

Where is my problem ?

Some time, for a quick disassembly i use W32DASM (yes, i know IDA, it's THE tool but sometimes there is no need of).
W32DASM is very usefull for simple proggies but the Wheel mouse functionality is not implemented and it's what i want to do.

I've no idea how i can do that, if somebody here can help !

Thank's
JMI
04-24-2005, 01:18 PM
Since you also posted this question on the Exetools Forum, I will also post my response to that Thread here. There MaRKuS-DJM reminded you you should look for the patches to WDasm made by Bratalarm, which had previously been posted on Exetools. Searching for that Thread there would lead to the patch and a post by Volodya, a member both there and here, which reported that the Bratalarm patches to WDasm 8.93 and a "WDasm 10" mofidication by J.Ping/Killer could be found on Wasm.ru at:

http://www.wasm.ru/toollist.php?list=13

for you to download and try.

Regards,
ZaiRoN
04-24-2005, 01:26 PM
Hi.
[/mode joke on]
JMI, seems like you failed to follow one of the rule of our forum: search the board.
A simple search will reveal a nice thread by Kayaker named "Code Injection with Code Snippet Creator: W32Dasm + Mouse Wheel support (http://207.218.156.34/forum/showthread.php?t=4089&highlight=windasm+wheel)".
[/mode joke off]

Best regards,
ZaiRoN :D
LOUZEW
04-24-2005, 02:20 PM
Many thank's Zairon
It's what i was searching for !

:whoops: And sorry, i've searched this board too but it seem i've not searched the right words.

:loveu: Thank's again
JMI
04-24-2005, 05:39 PM
Hi ZaiRoN:

I actually started in the Exetools with this answer and was only expanding on information MaRKuS-DJM posted there. I didn't actually search here or there because it wasn't MY job to find what was requested. :idea: I mearly passed on the location of the tools MaRKuS-DJM mentioned because i remembered where it could be found. :yay:

The only one who should have searched was LOUZEW and apparently he did, but without success.

But I DO appreciate the humor of your post. :yay: :cool:

Regards,